commit 8cd9520d35a6c38db6567e97dd93b1f11f185dc6 Author: Linus Torvalds Date: Sun Jun 14 15:58:38 2026 +0100 Linux 7.1 commit 424280953322cf66314f3ba5e2d1ef345f21c770 Merge: e21ee273e6fa38 009b6c6486b94a Author: Linus Torvalds Date: Sun Jun 14 15:37:39 2026 +0100 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM fixes from Russell King: - Avoid KASAN instrumentation of half-word IO - Use a byte load for KASAN shadow stack - Fix kexec and hibernation with PAN * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9476/1: mm: fix kexec and hibernation with CONFIG_CPU_TTBR0_PAN ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O commit e21ee273e6fa3879aec9a27251cfce98156e07c4 Merge: 2b07ea76fd2898 f29a24c9470549 Author: Linus Torvalds Date: Sat Jun 13 18:21:44 2026 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "Fixes for the Qualcomm and Google GS101 clk drivers: - Skip parking clks on some Qualcomm platforms so that the recovery console keeps working - Fix Google GS101 resume by using the correct div register" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked commit 2b07ea76fd28989bde5993532d7a943a6f90e246 Merge: a5e98d1679809c 0d046ae106255c Author: Linus Torvalds Date: Sat Jun 13 08:23:36 2026 -0700 Merge tag 'core-urgent-2026-06-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects fix from Ingo Molnar: - Fix potential debugobjects deadlock on PREEMPT_RT kernels (Waiman Long) * tag 'core-urgent-2026-06-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Don't call fill_pool() in early boot hardirq context commit a5e98d1679809cbad0f88f1b6b60e92134d8ee13 Merge: 062871f1371b2e 35ebcfcc9ef29a Author: Linus Torvalds Date: Sat Jun 13 08:14:17 2026 -0700 Merge tag 'i2c-for-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "The biggest news here is that this is my last pull request as I2C maintainer after 13.5 years. Starting with the 7.2 cycle, Andi Shyti is taking over who helped me greatly maintaining the host drivers for a while now. Thank you, Andi, and good luck with the subsystem. I'll be around for help, of course. Technically, there are two patches which might be a tad large for this late cycle, but most of them is explaining comments, so I think they are suitable. - MAINTAINERS: - hand over I2C maintainership to Andi - minor updates - rust: fix I2cAdapter refcount double increment - imx: keep clock and pinctrl states consistent in runtime PM - imx-lpi2c: fix DMA resource leaks on PIO fallback - qcom-cci: fix NULL pointer dereference on remove - riic: fix reset refcount leak on resume_noirq error path - stm32f7: account for analog filter in timing computation - tegra: - fix suspend/resume handling in NOIRQ phase - update Tegra410 I2C timings to match hardware specs" * tag 'i2c-for-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: mux-gpio: name correct maintainer MAINTAINERS: hand over I2C to Andi Shyti i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan() MAINTAINERS: i2c: designware: Remove inactive reviewer i2c: tegra: Fix NOIRQ suspend/resume i2c: tegra: Update Tegra410 I2C timing parameters i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() i2c: stm32f7: fix timing computation ignoring i2c-analog-filter i2c: imx: fix clock and pinctrl state inconsistency in runtime PM i2c: riic: fix refcount leak in riic_i2c_resume_noirq() rust: i2c: fix I2cAdapter refcounts double increment commit 062871f1371b2e02a272ff5279c6479aff0a37ef Merge: 4fa048ed72531d 3f786abd23951f Author: Linus Torvalds Date: Fri Jun 12 17:23:05 2026 -0700 Merge tag 'pinctrl-v7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Two fixes for the mcp23s08 driver. - Revert an earlier fix to the AMD pin controller that was all wrong. A proper fix is being developed. * tag 'pinctrl-v7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: Revert "pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11" pinctrl: mcp23s08: Read spi-present-mask as u8 not u32 pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init commit 4fa048ed72531d6c2a2147fa9b52b6a5451213a2 Merge: 2a2974b5145cdf 7c62657a10625e Author: Linus Torvalds Date: Fri Jun 12 15:51:16 2026 -0700 Merge tag 'drm-fixes-2026-06-13' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Looks like it's settled down a bit more thankfully. Small changes across the board, amdgpu/xe leading with some colorop changes in the core/amd. Otherwise some misc driver fixes. colorop: - make lut interpolation mutable - track colorop updates correctly amdgpu: - UserQ fix - Userptr fix - MCCS freesync fix - track colorop changes correctly amdkfd: - Fix an event information leak - Events bounds check fix - Trap cleanup fix i915: - Check supported link rates DPCD read - Fix phys BO pread/pwrite with offset xe: - fix oops in suspend/shutdown without display - RAS fixes - Use HW_ERR prefix in log - include all registered queues in TLB invalidation - Fix refcount leak in xe_range_tree in error paths - fix job timeout recovery for unstarted jobs and kernel queues amdxdna: - fix possible leak of mm_struct ivpu: - fix integer truncation vc4: - fix leak in krealloc() error handling virtio: - fix dma_fence ref-count leak" * tag 'drm-fixes-2026-06-13' of https://gitlab.freedesktop.org/drm/kernel: (24 commits) accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() drm/xe: fix job timeout recovery for unstarted jobs and kernel queues drm/xe: fix refcount leak in xe_range_fence_insert() drm/xe: include all registered queues in TLB invalidation drm/xe/hw_error: Use HW_ERR prefix in log drm/xe/drm_ras: Add per node cleanup action drm/xe/drm_ras: Make counter allocation drm managed drm/xe/display: fix oops in suspend/shutdown without display drm/amd/display: use plane color_mgmt_changed to track colorop changes drm/atomic: track individual colorop updates drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable drm/colorop: Remove read-only comments from interpolation fields drm/i915/gem: Fix phys BO pread/pwrite with offset drm/vc4: fix krealloc() memory leak drm/virtio: Fix driver removal with disabled KMS drm/i915/edp: Check supported link rates DPCD read accel/ivpu: Fix signed integer truncation in IPC receive drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() drm/amd/display: Consult MCCS FreeSync cap only if requested & supported drm/amdkfd: Unwind debug trap enable on copy_to_user failure ... commit 7c62657a10625e4e113de248d41f543d5a2f3a1a Merge: 6fe5552f678bdb 2f41af638c92ba Author: Dave Airlie Date: Sat Jun 13 07:50:04 2026 +1000 Merge tag 'drm-misc-fixes-2026-06-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: amd: - track colorop changes correctly amdxdna: - fix possible leak of mm_struct colorop: - make lut interpolation mutable - track colorop updates correctly ivpu: - fix integer truncation vc4: - fix leak in krealloc() error handling virtio: - fix dma_fence ref-count leak Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260612081418.GA17001@2a02-2455-9062-2500-e496-5a17-62ba-545e.dyn6.pyur.net commit 2a2974b5145cdf2f4db134be1a2157e9ca4a1cf0 Merge: 28608283615e5e d898796a8e7ed8 Author: Linus Torvalds Date: Fri Jun 12 13:49:45 2026 -0700 Merge tag 'pci-v7.1-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fix from Bjorn Helgaas: - Add Frank Li as PCI endpoint reviewer (Frank Li) * tag 'pci-v7.1-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: MAINTAINERS: Add Frank Li as PCI endpoint reviewer commit d898796a8e7ed8528c775f33da056e9978c4c248 Author: Frank Li Date: Thu Jun 11 17:00:05 2026 -0400 MAINTAINERS: Add Frank Li as PCI endpoint reviewer I have volunteered to review PCI endpoint-related changes. Add myself as a reviewer to be notified when related patches are posted. Signed-off-by: Frank Li Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Wilczyński Link: https://patch.msgid.link/20260611210007.529205-1-Frank.Li@oss.nxp.com commit 28608283615e5e7e92ea79c8ea13507f4b5e0cbe Merge: 880b719ca0da9d 3c60184e39b57e Author: Linus Torvalds Date: Fri Jun 12 11:06:16 2026 -0700 Merge tag 'spi-fix-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of driver specific fixes: a small targeted fix for hardware error handling on DesignWare controllers and another for handling of custom chip select management on Qualcomm GENI controllers" * tag 'spi-fix-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dw: fix race between IRQ handler and error handler on SMP spi: qcom-geni: Fix cs_change handling on the last transfer commit 880b719ca0da9d2470fd2652e8ed959ca5143280 Merge: 2e04e0961e9226 29fe1bd01b9971 Author: Linus Torvalds Date: Fri Jun 12 10:49:59 2026 -0700 Merge tag 'io_uring-7.1-20260611' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Tweak for an off-by-one in the CQ ring accounting for the min wait support. - Don't truncate end buffer length for a bundle, as the transfer might not happen. It's not required in the first place, as the completion side handles this condition already. * tag 'io_uring-7.1-20260611' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/wait: fix min_timeout behavior io_uring/kbuf: don't truncate end buffer for bundles commit 2e04e0961e9226d7e1fdd5bda3373289ba7a3f24 Merge: c133f0433ad78e e47832c73b83ec Author: Linus Torvalds Date: Fri Jun 12 10:29:06 2026 -0700 Merge tag 'usb-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt fixes from Greg KH: "Here are some small bugfixes for USB serial and Thunderbolt drivers for some reported and found issues. Included in here are: - usb serial overflow bugs fixed - new usb serial device id - thunderbolt validation fixes for reported issues All of these have been in linux-next this week with no reported issues" * tag 'usb-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: serial: kl5kusb105: fix bulk-out buffer overflow USB: serial: option: add usb-id for Dell Wireless DW5826e-m USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() USB: serial: io_ti: fix heap overflow in get_manuf_info() thunderbolt: Limit XDomain response copy to actual frame size thunderbolt: Validate XDomain request packet size before type cast thunderbolt: Clamp XDomain response data copy to allocation size thunderbolt: Bound root directory content to block size thunderbolt: Reject zero-length property entries in validator commit c133f0433ad78ef51b5b4d3d26ed1940236d71a2 Merge: 9a837eff9032ca 88e994c57a79f6 Author: Linus Torvalds Date: Fri Jun 12 10:10:12 2026 -0700 Merge tag 'staging-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are two small bugfixes for a staging driver to fix a much-reported issue. The fixes are for the rtl8723bs driver and it's something that many scanning tools keep tripping over in convoluted ways (and seems to be able to be triggered by network traffic) These fixes have been in linux-next for many weeks with no reported issues, sorry for the delay in getting them to you" * tag 'staging-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction staging: rtl8723bs: fix buffer over-read in rtw_update_protection commit 9a837eff9032ca0e047b068ff101d2183eb0afa1 Merge: 1dadb7e7eb5a05 07ebe87915d8ac Author: Linus Torvalds Date: Fri Jun 12 09:00:28 2026 -0700 Merge tag 'char-misc-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small driver fixes for 7.1-final to resolve some reported issues. Included in here are: - slimbus qcom driver bugfixes - nvmem driver bugfixes - fastrpc driver bugfixes - stratix10 firmware driver bugfixes All of these have been in linux-next for over a week with no reported issues" * tag 'char-misc-7.1-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: misc: fastrpc: fix use-after-free race in fastrpc_map_create misc: fastrpc: Fix NULL pointer dereference in rpmsg callback misc: fastrpc: fix DMA address corruption due to find_vma misuse misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD slimbus: qcom-ngd-ctrl: Initialize controller resources in controller slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership slimbus: qcom-ngd-ctrl: Fix probe error path ordering slimbus: qcom-ngd-ctrl: Fix up platform_driver registration slimbus: qcom-ngd-ctrl: fix OF node refcount nvmem: core: fix use-after-free bugs in error paths nvmem: layouts: onie-tlv: fix hang on unknown types firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe firmware: stratix10-svc: Don't fail probe when async ops unsupported firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported commit 1dadb7e7eb5a052a58fb2ec8d60c07186158efc4 Merge: fd41dc46db5eec b0d1553d51c3d1 Author: Linus Torvalds Date: Fri Jun 12 08:52:10 2026 -0700 Merge tag 'sound-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A few small fixes for the last spurt. All changes are small, mostly consisting of driver-specific fixes, along with two UAF fixes for the ALSA timer core. Core: - Two UAF fixes in ALSA timer core ASoC: - SDCA: Fix NULL pointer dereference - amd / yc: Add DMI quirk for ASUS ExpertBook PM1403CDA - SOF amd: Fix garbage/spurious warnings - wm_adsp: Fix potential NULL dereference when removing firmware controls - loongson: Fix negative position calculation - spi-rzv2h-rspi: Fix SPDR read access width on 16-bit RX path" * tag 'sound-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions ASoC: loongson: Fix invalid position error in ls_pcm_pointer spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1403CDA ASoC: SOF: amd: set ipc flags to zero ASoC: SOF: amd: fix for ipc flags check ASoC: wm_adsp: Fix NULL dereference when removing firmware controls ALSA: timer: Fix UAF at snd_timer_user_params() ALSA: timer: Forcibly close timer instances at closing commit fd41dc46db5eecf21c9d53fe034a731a2767030a Merge: f51cae6603c05b 9c648f35549207 Author: Linus Torvalds Date: Fri Jun 12 08:44:56 2026 -0700 Merge tag 'soc-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "Two more small fixes came in, both addressing corner cases in platform specific code: the microchip mpfs system controller probe and the CPU power management on 32-bit rockchips SoCs" * tag 'soc-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: rockchip: keep reset control around soc: microchip: mpfs-sys-controller: fix resource leak on probe error commit 35ebcfcc9ef29afcf258db854ccf25572c75baef Merge: 5cad752e1e73c3 9bffa2a61551da Author: Wolfram Sang Date: Fri Jun 12 17:05:44 2026 +0200 Merge tag 'i2c-host-fixes-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v7.1-rc8 - imx: keep clock and pinctrl states consistent in runtime PM - imx-lpi2c: fix DMA resource leaks on PIO fallback - qcom-cci: fix NULL pointer dereference on remove - riic: fix reset refcount leak on resume_noirq error path - stm32f7: account for analog filter in timing computation - tegra: fix suspend/resume handling in NOIRQ phase - tegra: update Tegra410 I2C timings to match hardware specs - MAINTAINERS: hand over I2C maintainership to Andi commit 5cad752e1e73c326c9d784ceb34c9129285539c5 Author: Wolfram Sang Date: Thu Jun 11 14:20:53 2026 +0200 dt-bindings: i2c: mux-gpio: name correct maintainer The YAML conversion added me as maintainer but I can't recall being asked nor do I want to maintain it. Add Peter as maintainer for the binding as he is maintainer of the driver. Signed-off-by: Wolfram Sang Acked-by: Peter Korsgaard Acked-by: Conor Dooley commit 9bffa2a61551da9ac32171f09d556974cb96d70a Author: Wolfram Sang Date: Tue Jun 9 11:16:14 2026 +0200 MAINTAINERS: hand over I2C to Andi Shyti After 13.5 years of maintaining I2C, it is finally time for me to move to other areas. So, I hereby transfer I2C maintainership to Andi Shyti. He has been taking care of the I2C host drivers for a while now and kindly agreed to look after the whole subsystem. Thank you, Andi! I also want to thank all contributors, reviewers, and fellow maintainers making all these years a mostly smooth ride. Happy hacking, everyone! Signed-off-by: Wolfram Sang Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260609091612.8228-4-wsa+renesas@sang-engineering.com commit 6fe5552f678bdbb925388ecff30a257b382cb9f6 Merge: c7be3088588900 347ccc0453fca2 Author: Dave Airlie Date: Fri Jun 12 13:57:16 2026 +1000 Merge tag 'drm-xe-fixes-2026-06-11' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes UAPI Changes: Cross-subsystem Changes: Core Changes: Driver Changes: - fix oops in suspend/shutdown without display (Jani) - RAS fixes (Raag) - Use HW_ERR prefix in log (Raag) - include all registered queues in TLB invalidation (Tangudu) - Fix refcount leak in xe_range_tree in error paths (Wentao) - fix job timeout recovery for unstarted jobs and kernel queues (Rodrigo) Signed-off-by: Dave Airlie From: Matthew Brost Link: https://patch.msgid.link/aitt8ZkYmxIT9cdP@gsse-cloud1.jf.intel.com commit c7be308858890007b4da9b6498a1c1f3e6647dee Merge: 2aaaf5931b1693 d21ad938398bca Author: Dave Airlie Date: Fri Jun 12 13:32:49 2026 +1000 Merge tag 'drm-intel-fixes-2026-06-11' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Check supported link rates DPCD read [edp] (Nikita Zhandarovich) - Fix phys BO pread/pwrite with offset [gem] (Joonas Lahtinen) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patch.msgid.link/aipkcUDnTlzre-8F@linux commit f51cae6603c05b4b1fac65c773592e5bc8037251 Merge: 2b414a95b8f730 6ec91df8aff77e Author: Linus Torvalds Date: Thu Jun 11 14:22:26 2026 -0700 Merge tag 'dma-mapping-7.1-2026-06-11' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fix from Marek Szyprowski: "Three more fixes for the DMA-mapping code, related to PCI P2PDMA, DMA debug and DMA link ranges API (Li RongQing and Jason Gunthorpe)" * tag 'dma-mapping-7.1-2026-06-11' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: iommu/dma: Do not try to iommu_map a 0 length region in swiotlb dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments commit b0d1553d51c3d188baae6d77e6f3dfb415a7b623 Merge: 053a401b592be4 e4c60a1d4b6ccc Author: Takashi Iwai Date: Thu Jun 11 21:29:47 2026 +0200 Merge tag 'asoc-fix-v7.1-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.1 A few more fixes for this release, some smaller driver specific ones plus a final quirk. commit 2b414a95b8f7307d42173ba9e580d6d3e2bcbfce Merge: 22e2036479cb77 1f57f68c4dd101 Author: Linus Torvalds Date: Thu Jun 11 10:30:37 2026 -0700 Merge tag 's390-7.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fix from Alexander Gordeev: - s390 selects GENERIC_LOCKBREAK when PREEMPT is enabled to tackle an old compile error that no longer exists. Since recently PREEMPT is always enabled, this LOCKBREAK config causes massive performance regressions. Remove GENERIC_LOCKBREAK from s390 Kconfig to fix the degradation. * tag 's390-7.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: Remove GENERIC_LOCKBREAK Kconfig option commit 22e2036479cb77df6281ebbd376ae6c330774790 Merge: 79f2670da86722 7360b960998063 Author: Linus Torvalds Date: Thu Jun 11 10:17:49 2026 -0700 Merge tag 'net-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from IPsec and netfilter. This is relatively small, mostly because we are a bit behind our PW queue. I'm not aware of any pending regression. Current release - regressions: - netfilter: nf_tables_offload: drop device refcount on error Previous releases - regressions: - core: add pskb_may_pull() to skb_gro_receive_list() - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() - ipv6: fix a potential NPD in cleanup_prefix_route() - ipv4: fix use-after-free caused by the fqdir_pre_exit() flush - eth: - bnxt_en: fix NULL pointer dereference - emac: fix use-after-free during device removal - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - tun: zero the whole vnet header in tun_put_user() - sit: reload inner IPv6 header after GSO offloads Previous releases - always broken: - core: fix double-free in netdev_nl_bind_rx_doit() - netfilter: nf_log: validate MAC header was set before dumping it - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() - tcp: restrict SO_ATTACH_FILTER to priv users - mctp: usb: fix race between urb completion and rx_retry cancellation - eth: - mlx5: fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - mvpp2: sync RX data at the hardware packet offset" * tag 'net-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits) octeontx2-af: fix IP fragment flag corruption on custom KPU profile load ipv6: Fix a potential NPD in cleanup_prefix_route() net: txgbe: initialize PHY interface to 0 net: txgbe: distinguish module types by checking identifier net: txgbe: initialize module info buffer net: mvpp2: build skb from XDP-adjusted data on XDP_PASS net: mvpp2: refill RX buffers before XDP or skb use net: mvpp2: limit XDP frame size to the RX buffer net: mvpp2: sync RX data at the hardware packet offset netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register netfilter: nft_fib: fix stale stack leak via the OIFNAME register netfilter: nft_exthdr: fix register tracking for F_PRESENT flag netfilter: nf_log: validate MAC header was set before dumping it netfilter: x_tables: avoid leaking percpu counter pointers netfilter: nf_conntrack: destroy stale expectfn expectations on unregister netfilter: nf_tables_offload: drop device refcount on error netfilter: revalidate bridge ports rds: mark snapshot pages dirty in rds_info_getsockopt() ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() ptp: ocp: fix resource freeing order ... commit 79f2670da86722d075633d20fa57418994ee6940 Merge: 6e9e0dfc7f2e34 fba0510cd62666 Author: Linus Torvalds Date: Thu Jun 11 09:54:51 2026 -0700 Merge tag 'pmdomain-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - imx: Fix OF node refcount - ti: Fix wakeup configuration for parent devices of wakeup sources * tag 'pmdomain-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: imx: fix OF node refcount pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source commit 2f41af638c92bac6f1f9275ea2d1901baef578f3 Author: Lizhi Hou Date: Wed Jun 10 08:11:27 2026 -0700 accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() aie2_populate_range() jumps back to the again label without calling mmput(mm), leaking a reference to the mm_struct. Add the missing mmput() before jumping to again. Fixes: e486147c912f ("accel/amdxdna: Add BO import and export") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260610151127.2994185-1-lizhi.hou@amd.com commit 6e9e0dfc7f2e34627a4280b8e168479018d95732 Merge: 9716c086c8e8b1 a23226b7c1f69e Author: Linus Torvalds Date: Thu Jun 11 09:15:57 2026 -0700 Merge tag 'gpio-fixes-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix NULL pointer dereference in gpio-mvebu - fix runtime PM leak in remove path in gpio-zynq - reject invalid module params in gpio-mockup - fix generic IRQ chip leak in remove parh in gpio-rockchip - fix resource leaks in GPIO chip cleanup path on hog failure - fix a regression in how GPIO hogging code handles multiple GPIO chips reusing the same OF node * tag 'gpio-fixes-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: handle gpio-hogs only once gpio: fix cleanup path on hog failure gpio: rockchip: fix generic IRQ chip leak on remove gpio: mockup: reject invalid gpio_mockup_ranges widths gpio: zynq: fix runtime PM leak on remove gpio: mvebu: fix NULL pointer dereference in suspend/resume commit e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd Author: Kean Ren Date: Thu Jun 11 10:37:57 2026 +0800 ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions sdca_dev_unregister_functions() iterates over all SDCA function descriptors and calls sdca_dev_unregister() on each func_dev without checking for NULL. When a function registration has failed partway through, or the device cleanup races with probe deferral, func_dev entries may be NULL, leading to a kernel oops: BUG: kernel NULL pointer dereference, address: 0000000000000040 RIP: 0010:device_del+0x1e/0x3e0 Call Trace: sdca_dev_unregister_functions+0x37/0x60 [snd_soc_sdca] release_nodes+0x35/0xb0 devres_release_all+0x90/0x100 device_unbind_cleanup+0xe/0x80 device_release_driver_internal+0x1c1/0x200 bus_remove_device+0xc6/0x130 device_del+0x161/0x3e0 device_unregister+0x17/0x60 sdw_delete_slave+0xb6/0xd0 [soundwire_bus] sdw_bus_master_delete+0x1e/0x50 [soundwire_bus] ... sof_probe_work+0x19/0x30 [snd_sof] This was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake) with the SOF audio driver probe failing due to missing Panther Lake firmware, causing the subsequent cleanup of SoundWire devices to trigger the crash. Fix this with three changes: 1) Add a NULL guard in sdca_dev_unregister() so that callers do not need to pre-validate the pointer (defense in depth). 2) In sdca_dev_unregister_functions(), skip NULL func_dev entries and clear func_dev to NULL after unregistration, making the function idempotent and safe against double-invocation. 3) In sdca_dev_register_functions(), roll back all previously registered functions when a later one fails, so the function array is never left in a partially-populated state. Fixes: 4496d1c65bad ("ASoC: SDCA: add function devices") Signed-off-by: Kean Ren Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260611023757.1553960-1-rh_king@163.com Signed-off-by: Mark Brown commit 009b6c6486b94a3aff566b017256b598dc96bf18 Author: Florian Fainelli Date: Mon May 25 17:38:17 2026 +0100 ARM: 9476/1: mm: fix kexec and hibernation with CONFIG_CPU_TTBR0_PAN Commit 7af5b901e847 ("ARM: 9358/2: Implement PAN for LPAE by TTBR0 page table walks disablement") implemented PAN for LPAE kernels by setting TTBCR.EPD0 on every kernel entry, disabling TTBR0 page-table walks while running in kernel mode. The commit correctly updated cpu_suspend() in arch/arm/kernel/suspend.c, but missed two other code paths that switch the CPU to the identity mapping before jumping to low-PA (TTBR0-range) physical addresses: 1. setup_mm_for_reboot() in arch/arm/mm/idmap.c, used by the kexec reboot path. With TTBCR.EPD0 still set, the subsequent branch to the identity-mapped cpu_v7_reset causes a PrefetchAbort because the TTBR0 page-table walk needed to resolve the identity-mapped address is disabled. This manifests as a hard hang or "bad PC value" panic on LPAE kernels booted on CPUs that strictly enforce EPD0 for instruction fetch (e.g. Cortex-A53 in AArch32 mode) while the same image may accidentally work on Cortex-A15 due to microarchitectural differences in EPD0 enforcement. 2. arch_restore_image() in arch/arm/kernel/hibernate.c, which calls cpu_switch_mm(idmap_pgd, &init_mm) directly without going through setup_mm_for_reboot(), leaving TTBCR.EPD0 set while the identity mapping is active. Fix both sites by calling uaccess_save_and_enable() before switching to the identity mapping, mirroring what the original commit did for cpu_suspend(). Assisted-by: Cursor:claude-sonnet-4.6 Fixes: 7af5b901e847 ("ARM: 9358/2: Implement PAN for LPAE by TTBR0 page table walks disablement") Cc: Catalin Marinas Cc: Linus Walleij Reviewed-by: Linus Walleij Signed-off-by: Florian Fainelli Signed-off-by: Russell King commit 77a1f6883dc6e837bb2cb30b9b02e2f94338e2c6 Author: Karl Mehltretter Date: Sun May 24 06:52:35 2026 +0100 ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Commit 44e9a3bb76e5 ("ARM: 9430/1: entry: Do a dummy read from VMAP shadow") added a dummy read from the KASAN VMAP stack shadow in __switch_to(). The read uses ldr, but the KASAN shadow address is byte-granular and is not guaranteed to be word aligned. ARMv5 faults unaligned word loads. With CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK enabled, ARM926/VersatilePB crashes in __switch_to() with an alignment exception before reaching init. Use ldrb for the dummy shadow access. The code only needs to fault in the shadow mapping if the stack shadow is missing, so a byte load is sufficient and matches the granularity of KASAN shadow memory. Fixes: 44e9a3bb76e5 ("ARM: 9430/1: entry: Do a dummy read from VMAP shadow") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Karl Mehltretter Reviewed-by: Linus Walleij Signed-off-by: Russell King commit d59ed803715a71fb9582e139d648ece8d66dc743 Author: Karl Mehltretter Date: Sun May 24 06:52:36 2026 +0100 ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O For CPUs before ARMv6, __raw_readw() and __raw_writew() are implemented as C volatile halfword accesses so the compiler can generate an access sequence that is safe for those machines. With KASAN enabled, those C accesses are instrumented as normal memory accesses. That is not valid for MMIO. On ARM926/VersatilePB with KASAN enabled, PL011 probing traps in __asan_store2() while registering the UART, because the instrumented writew() tries to check KASAN shadow for an MMIO address. Keep the existing volatile halfword access, but move the ARMv5 definitions into __no_kasan_or_inline functions so raw MMIO halfword accesses are not instrumented by KASAN. The ARMv6-and-newer inline assembly path is unchanged. Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM") Cc: stable@vger.kernel.org # v5.11+ Signed-off-by: Karl Mehltretter Reviewed-by: Linus Walleij Signed-off-by: Russell King commit 347ccc0453fca2c669e8dc8a72000e76ca4adf10 Author: Rodrigo Vivi Date: Wed Jun 10 11:25:49 2026 -0400 drm/xe: fix job timeout recovery for unstarted jobs and kernel queues A job that GuC never scheduled (never started) indicates a GuC scheduling failure; previously such jobs were silently errored out instead of triggering a GT reset to recover. Trigger a GT reset and resubmit them, but only when the queue was not already killed or banned: an unstarted job on an already banned queue is the ban working as intended and must neither clear the ban nor kick off a reset, otherwise a banned userspace queue could be resurrected and spam GT resets. Kernel queues are always recovered this way and wedge the device once recovery attempts are exhausted, since kernel work must not silently fail. A started job that times out on a userspace VM bind queue stays banned rather than being reset and retried. The queue is banned early in the timeout handler to signal the G2H scheduling-done handler so it wakes the disable-scheduling waiter; without it the waiter sleeps the full 5s timeout. When a reset is warranted the ban is cleared before rearming so that guc_exec_queue_start() can resubmit jobs after the GT reset - a still-banned queue would block resubmission and cause an infinite TDR loop. The already-banned case is gated out before this point via skip_timeout_check, so it is unaffected. v2: (Himal) Do it for any queue type, not just kernel/migration v3: - (Sashiko and Sanjay): don't clear the ban / GT reset for already killed/banned queues on unstarted-job timeout - Update commit message - (Matt) Add Fixes tag Fixes: fe05cee4d953 ("drm/xe: Don't short circuit TDR on jobs not started") Cc: Matthew Auld Cc: Matthew Brost Cc: Sanjay Yadav Cc: Himal Prasad Ghimiray Assisted-by: GitHub-Copilot:claude-sonnet-4.6 Assisted-by: GitHub-Copilot:claude-opus-4.8 Tested-by: Sanjay Yadav Reviewed-by: Sanjay Yadav Reviewed-by: Matthew Brost Reviewed-by: Himal Prasad Ghimiray Link: https://patch.msgid.link/20260610152548.404575-3-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit b1107d085e7e8ed15ba6f80c102528a9c8a6cb0e) Signed-off-by: Matthew Brost commit ba36786b21d19082e696eda85bfcd49e7071944a Author: Wentao Liang Date: Wed Jun 10 10:27:05 2026 -0700 drm/xe: fix refcount leak in xe_range_fence_insert() xe_range_fence_insert() acquires a reference on fence via dma_fence_get() and stores it in rfence->fence. It then calls dma_fence_add_callback() and handles two cases: when the callback is successfully registered (err == 0) the fence is transferred to the tree for later cleanup; when the fence is already signaled (err == -ENOENT) it manually drops the extra reference with dma_fence_put(fence). However, dma_fence_add_callback() can fail with other errors (e.g. -EINVAL) and in that case the code falls through to the free: label without releasing the acquired reference, leaking it. Fix the leak by adding an else branch that calls dma_fence_put() before jumping to free: for any error other than -ENOENT. Fixes: 845f64bdbfc9 ("drm/xe: Introduce a range-fence utility") Signed-off-by: Wentao Liang Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260610172705.3450560-1-matthew.brost@intel.com (cherry picked from commit 98c4a4201290823c2c5c7ba21692bd9a64b61021) Signed-off-by: Matthew Brost commit 7360b96099806396f4ce15233f6dddcb69248d34 Author: Kiran Kumar K Date: Mon Jun 8 15:24:55 2026 +0530 octeontx2-af: fix IP fragment flag corruption on custom KPU profile load npc_cn20k_apply_custom_kpu() overwrites KPU profile entries with custom firmware values and then calls npc_cn20k_update_action_entries_n_flags() over all entries. Since the same function already ran during default profile initialisation, entries not overridden by the custom firmware get their flags translated twice, corrupting the CN20K-specific values. Fix this by extracting the per-entry translation into a helper npc_cn20k_translate_action_flags() and calling it as each custom entry is loaded, removing the redundant batch call at the end. Fixes: ef992a0f12e8 ("octeontx2-af: npc: cn20k: MKEX profile support") Cc: Suman Ghosh Signed-off-by: Kiran Kumar K Signed-off-by: Nitin Shetty J Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260608095455.1499203-1-nshettyj@marvell.com Signed-off-by: Paolo Abeni commit 64ced6c0882756db52cbedf50bc66338de4a4045 Merge: 29899ec61ac6fc c7d573551f9286 Author: Paolo Abeni Date: Thu Jun 11 12:29:59 2026 +0200 Merge tag 'nf-26-06-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Revalidate bridge ports, add missing NULL checks to fetch the bridge device by the port. From Florian Westphal. 2) Fix netdevice refcount leak in the error path of nft_fwd hardware offload function, also from Florian. 3) Unregister helper expectfn callback on conntrack helper module removal, otherwise dangling pointer remains in place, from Weiming Shi. 4) Fix possible pointer infoleak in getsockopt() IPT_SO_GET_ENTRIES, From Kyle Zeng. 5) Validate that device MAC header is present before nf_syslog accesses it. From Xiang Mei. 6-8) Three patches to address a possible infoleak of stale stack data in three nf_tables expressions, due to mismatch in the _init() and _eval() function which is possible since 14fb07130c7d. From Davide Ornaghi and Florian Westphal. netfilter pull request 26-06-10 * tag 'nf-26-06-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register netfilter: nft_fib: fix stale stack leak via the OIFNAME register netfilter: nft_exthdr: fix register tracking for F_PRESENT flag netfilter: nf_log: validate MAC header was set before dumping it netfilter: x_tables: avoid leaking percpu counter pointers netfilter: nf_conntrack: destroy stale expectfn expectations on unregister netfilter: nf_tables_offload: drop device refcount on error netfilter: revalidate bridge ports ==================== Link: https://patch.msgid.link/20260610161629.214092-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 6ad3914e06a48a02e362d0df2b1073c7c567c93d Author: Li Jun Date: Thu Jun 11 09:00:45 2026 +0800 ASoC: loongson: Fix invalid position error in ls_pcm_pointer The "invalid position" error occurred when the DMA position descriptor returned an invalid address value (e.g., pos = -1048838144). This happened because the `bytes_to_frames()` function returns a signed value, but when `addr < runtime->dma_addr`, the subtraction produces a negative result that gets interpreted as a large unsigned integer in comparisons. when the addr is abnormal, for example,the DMA controller is abnormal in hardware,x=0 should not be a point(x == runtime->buffer_size),but a range, which includes the addr address being less than runtime ->dma1-adr, and the addr exceeding the DMA address range.the value of pos should not better a negative，return 0, maybe better. [ 32.834431][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 32.845019][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 32.855588][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 32.866145][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 32.995394][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 33.006025][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 33.016748][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 Signed-off-by: Li Jun [Remove XRUN reporting I'd mistakenly avised adding on prior review -- broonie] Link: https://patch.msgid.link/20260611010045.3668574-1-lijun01@kylinos.cn Signed-off-by: Mark Brown commit 29899ec61ac6fcc9d46f5f8d0b72117d9a676c2e Merge: b70c687b7cf267 26aad08a928901 Author: Paolo Abeni Date: Thu Jun 11 12:00:49 2026 +0200 Merge tag 'ipsec-2026-06-10' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2026-06-10 1) xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() Propagate SKBFL_SHARED_FRAG when paged fragments are moved between skbs so ESP can decide whether in-place crypto is safe. 2) xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload Replace the unlocked read of xtfs->ra_newskb with a local flag so a concurrent reassembly can no longer free first_skb between spin_unlock and the post-loop check. 3) xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Prune the inexact bin under xfrm_policy_lock so a concurrent xfrm_hash_rebuild() can no longer free it before xfrm_policy_kill() dereferences it. 4) xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() Move hrtimer_cancel() for the output and drop timers ahead of their spinlocks, breaking the softirq/lock cycle that could deadlock against the timer callbacks on SMP. 5) xfrm: espintcp: do not reuse an in-progress partial send Fail a new send when espintcp_push_msgs() returns with emsg->len still set, so a blocking caller can no longer overwrite ctx->partial while a previous transfer still owns it. 6) esp: fix page frag reference leak on skb_to_sgvec failure Add a flag to esp_ssg_unref() to unconditionally unref the source scatterlist, releasing the old page references that are otherwise leaked when the second skb_to_sgvec() in esp_output_tail() fails. Please pull or let me know if there are problems. ipsec-2026-06-10 * tag 'ipsec-2026-06-10' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: esp: fix page frag reference leak on skb_to_sgvec failure xfrm: espintcp: do not reuse an in-progress partial send xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() ==================== Link: https://patch.msgid.link/20260610140800.2562818-1-steffen.klassert@secunet.com Signed-off-by: Paolo Abeni commit b70c687b7cf267fb08586667a3946c8851cad672 Author: Ido Schimmel Date: Tue Jun 9 17:54:48 2026 +0300 ipv6: Fix a potential NPD in cleanup_prefix_route() addrconf_get_prefix_route() can return the fib6_null_entry sentinel entry which has a NULL fib6_table pointer. Therefore, before setting the route's expiration time, check that we are not working with this entry, as otherwise a NPD will be triggered [1]. Note that the other callers of addrconf_get_prefix_route() are not susceptible to this bug: 1. addrconf_prefix_rcv(): Requests a route with the 'RTF_ADDRCONF | RTF_PREFIX_RT' flags which are not set on fib6_null_entry. 2. modify_prefix_route(): Fixed by commit a747e02430df ("ipv6: avoid possible NULL deref in modify_prefix_route()"). 3. __ipv6_ifa_notify(): Calls ip6_del_rt() which specifically checks for fib6_null_entry and returns an error. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [...] Call Trace: __kasan_check_byte (mm/kasan/common.c:573) lock_acquire.part.0 (kernel/locking/lockdep.c:5842 (discriminator 1)) _raw_spin_lock_bh (kernel/locking/spinlock.c:182 (discriminator 1)) cleanup_prefix_route (net/ipv6/addrconf.c:1280) ipv6_del_addr (net/ipv6/addrconf.c:1342) inet6_addr_del.isra.0 (net/ipv6/addrconf.c:3119) inet6_rtm_deladdr (net/ipv6/addrconf.c:4812) rtnetlink_rcv_msg (net/core/rtnetlink.c:6997) netlink_rcv_skb (net/netlink/af_netlink.c:2555) netlink_unicast (net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1899) __sock_sendmsg (net/socket.c:802 (discriminator 4)) ____sys_sendmsg (net/socket.c:2698) ___sys_sendmsg (net/socket.c:2752) __sys_sendmsg (net/socket.c:2784) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Fixes: 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list of routes.") Reported-by: Ji'an Zhou Reviewed-by: David Ahern Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20260609145448.768318-1-idosch@nvidia.com Signed-off-by: Paolo Abeni commit 0068940907d33217ae01217f84910a5cde606c17 Merge: b59873c9c40d0c 47f848aac4e79b Author: Paolo Abeni Date: Thu Jun 11 10:55:15 2026 +0200 Merge branch 'net-txgbe-fix-module-identification' Jiawen Wu says: ==================== net: txgbe: fix module identification For AML devices, there are some issues where the wrong module indentified then configure PHY failed. The module info buffers should be initialized to 0 before the firmware returns information. And DECLARE_PHY_INTERFACE_MASK() does not guarantee zeroed contents, so explicitly clear the temporary interface masks before setting supported interfaces. Rework txgbe_identify_module() to validate module identifiers through explicit type checks instead of relying on transceiver_type heuristics. When using the SFP module, transceiver_type could be a random value, because it was read from an invalid register. ==================== Link: https://patch.msgid.link/20260608070842.36504-1-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 47f848aac4e79bdb197f849fa86e71fff1ad36ef Author: Jiawen Wu Date: Mon Jun 8 15:08:42 2026 +0800 net: txgbe: initialize PHY interface to 0 DECLARE_PHY_INTERFACE_MASK() does not guarantee zeroed contents. Add a new macro DECLARE_PHY_INTERFACE_MASK_ZERO(), make the stack variable to be zeroed before setting supported interfaces. Fixes: 57d39faed4c9 ("net: txgbe: improve functions of AML 40G devices") Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20260608070842.36504-4-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit f2df54ddbfb04a006ee326a5d8270434a414e0af Author: Jiawen Wu Date: Mon Jun 8 15:08:41 2026 +0800 net: txgbe: distinguish module types by checking identifier Rework txgbe_identify_module() to validate module identifiers through explicit type checks instead of relying on transceiver_type heuristics. When using the SFP module, transceiver_type could be a random value, because it was read from an invalid register. Fixes: 57d39faed4c9 ("net: txgbe: improve functions of AML 40G devices") Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20260608070842.36504-3-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 0487cfca46517ff6699c72dc1a8872b0af3c31a9 Author: Jiawen Wu Date: Mon Jun 8 15:08:40 2026 +0800 net: txgbe: initialize module info buffer The module info buffer should be initialized to 0 before the firmware returns information. Otherwise, there is a risk that the buffer field not filled by the firmware is random value. Fixes: 343929799ace ("net: txgbe: Support to handle GPIO IRQs for AML devices") Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20260608070842.36504-2-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit b59873c9c40d0cbc16df86cf6cb5430330a0ac74 Merge: 512db8267b73a2 77a6b90ce56bc9 Author: Paolo Abeni Date: Thu Jun 11 09:57:33 2026 +0200 Merge branch 'net-mvpp2-fix-xdp-rx-buffer-handling' Til Kaiser says: ==================== net: mvpp2: fix XDP RX buffer handling This is v5 of the earlier XDP_PASS fix. The XDP_PASS change is retained, and the series also fixes related RX/XDP buffer handling issues found during review. Tested with tools/testing/selftests/drivers/net/xdp.py on mvpp2 hardware. ==================== Link: https://patch.msgid.link/20260607134943.21996-1-mail@tk154.de Signed-off-by: Paolo Abeni commit 77a6b90ce56bc982dcfa94229b8e28e6abb16e95 Author: Til Kaiser Date: Sun Jun 7 15:49:43 2026 +0200 net: mvpp2: build skb from XDP-adjusted data on XDP_PASS When an XDP program uses bpf_xdp_adjust_head() or bpf_xdp_adjust_tail() and then returns XDP_PASS, mvpp2 still builds the skb from fixed offsets derived from the original RX descriptor. Packet geometry changes made by the XDP program are therefore discarded before the skb reaches the stack. Update rx_offset and rx_bytes from xdp.data and xdp.data_end for XDP_PASS. This makes skb_reserve() and skb_put() reflect the packet seen by XDP, and makes RX byte accounting for XDP_PASS follow the length of the skb passed to the network stack. Keep a separate rx_sync_size for page-pool recycling on skb allocation failure, which must stay tied to the received buffer range. Non-PASS verdicts continue to account the descriptor length because no skb is passed up in those cases. Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support") Signed-off-by: Til Kaiser Link: https://patch.msgid.link/20260607134943.21996-5-mail@tk154.de Signed-off-by: Paolo Abeni commit 5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6 Author: Til Kaiser Date: Sun Jun 7 15:49:42 2026 +0200 net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM. Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support") Fixes: d6526926de73 ("net: mvpp2: fix memory leak in mvpp2_rx") Signed-off-by: Til Kaiser Link: https://patch.msgid.link/20260607134943.21996-4-mail@tk154.de Signed-off-by: Paolo Abeni commit f3c6aa078927e6fe8121c9c591ddee8716c5305a Author: Til Kaiser Date: Sun Jun 7 15:49:41 2026 +0200 net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet. Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support") Signed-off-by: Til Kaiser Link: https://patch.msgid.link/20260607134943.21996-3-mail@tk154.de Signed-off-by: Paolo Abeni commit 180235600934bef6add3be637c296d6cf3272e67 Author: Til Kaiser Date: Sun Jun 7 15:49:40 2026 +0200 net: mvpp2: sync RX data at the hardware packet offset mvpp2 programs the RX queue packet offset, so hardware writes received data at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at dma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the unused headroom and misses the same number of bytes at the packet tail. On non-coherent DMA systems this can leave the CPU reading stale cache contents for the end of the received frame. Use dma_sync_single_range_for_cpu() with MVPP2_SKB_HEADROOM as the range offset so the sync covers the Marvell header and packet data actually written by hardware. Fixes: e1921168bbd4 ("mvpp2: sync only the received frame") Signed-off-by: Til Kaiser Link: https://patch.msgid.link/20260607134943.21996-2-mail@tk154.de Signed-off-by: Paolo Abeni commit 9716c086c8e8b141d35aa61f2e96a2e83de212a7 Merge: 767622308a1d8b 6100a82e34cb75 Author: Linus Torvalds Date: Wed Jun 10 11:53:55 2026 -0700 Merge tag 'pm-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These address some remaining fallout after introducing dynamic EPP support in the amd-pstate driver during the current development cycle: - Restore allowing writing EPP of 0 when in performance mode in the amd-pstate driver which was unnecessarily disallowed by one of the recent updates (Mario Limonciello) - Remove stale documentation of the epp_cached field in struct amd_cpudata that has been dropped recently (Zhan Xusheng)" * tag 'pm-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq/amd-pstate: Fix setting EPP in performance mode cpufreq/amd-pstate: drop stale @epp_cached kdoc commit e4aaac46593733a06ec1a1f1a63128206d67fcaa Author: Tangudu Tilak Tirumalesh Date: Mon Jun 8 21:57:44 2026 +0530 drm/xe: include all registered queues in TLB invalidation Context-based TLB invalidation currently selects only scheduling-active exec queues via q->ops->active(). During rebind flows, queues may be suspended (or transitioning through resume) while still owning valid translations, causing them to be skipped from invalidation and leading to missed TLB invalidations on LR rebinds. The underlying issue is a TOCTOU: q->guc->state bits are flipped lock-free from enable_scheduling(), disable_scheduling{,_deregister}(), the suspend/resume sched-msg handlers, handle_sched_done(), and guc_exec_queue_stop(); nothing in send_tlb_inval_ctx_ppgtt() serializes against them, so any state-based predicate can race. Include all the registered queues so that TLB invalidations are not missed. This is race-free because list membership on vm->exec_queues.list is stable under vm->exec_queues.lock held by the caller. The performance impact is expected to be minimal and harmless. If it does turn out to be a concern, we can come back with a race-safe solution to ignore certain queues. Fixes: 6cdaa5346d6f ("drm/xe: Add context-based invalidation to GuC TLB invalidation backend") Assisted-by: Claude:claude-opus-4.6 Suggested-by: Thomas Hellstrom Signed-off-by: Tangudu Tilak Tirumalesh Reviewed-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260608162745.338725-2-tilak.tirumalesh.tangudu@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit aa625e1e9f0710e424fe4f0e3f032807df81b5b0) Signed-off-by: Matthew Brost commit 381b3576a87f4ed6e76adb78d7d9400428f8f4b7 Author: Raag Jadav Date: Tue Jun 2 10:18:44 2026 +0530 drm/xe/hw_error: Use HW_ERR prefix in log Hardware errors should be logged with HW_ERR prefix. Make them consistent with existing logs. Fixes: 01aab7e1c9d4 ("drm/xe/xe_hw_error: Add support for PVC SoC errors") Signed-off-by: Raag Jadav Reviewed-by: Riana Tauro Link: https://patch.msgid.link/20260602044919.702209-5-raag.jadav@intel.com Signed-off-by: Matt Roper (cherry picked from commit ad60a618c49fef07d1860bfb1091140d29f5eddb) Signed-off-by: Matthew Brost commit 3e3f5b0c5ae6845b4d8d23f079e872635cd8b0ae Author: Raag Jadav Date: Tue Jun 2 10:18:43 2026 +0530 drm/xe/drm_ras: Add per node cleanup action cleanup_node_param() is not registered for previous node in case of counter allocation failure, which results in stale memory of previous node that isn't cleaned up on unwind. Add per node cleanup action which guarantees cleanup on unwind and also simplifies the cleanup logic. Fixes: b40db12b542f ("drm/xe/xe_drm_ras: Add support for XE DRM RAS") Signed-off-by: Raag Jadav Reviewed-by: Riana Tauro Link: https://patch.msgid.link/20260602044919.702209-4-raag.jadav@intel.com Signed-off-by: Matt Roper (cherry picked from commit 67fc5543d8274b2fcbef87734fad0469358f4478) Signed-off-by: Matthew Brost commit 4dcfcdc9fbb5efef21e149adf349d42d84c9da04 Author: Raag Jadav Date: Tue Jun 2 10:18:42 2026 +0530 drm/xe/drm_ras: Make counter allocation drm managed cleanup_node_param() is not registered for previous node in case of counter allocation failure, which results in stale memory of previous node that isn't cleaned up on unwind. Fix this using drm managed allocation, which is guaranteed to be cleaned up on unwind. Fixes: b40db12b542f ("drm/xe/xe_drm_ras: Add support for XE DRM RAS") Signed-off-by: Raag Jadav Reviewed-by: Riana Tauro Link: https://patch.msgid.link/20260602044919.702209-3-raag.jadav@intel.com Signed-off-by: Matt Roper (cherry picked from commit 58d77c77ea0c5cb2b755ebe23e973c8272acd896) Signed-off-by: Matthew Brost commit 68938cc08e23a94fd881e845837ff918de005ce7 Author: Jani Nikula Date: Fri May 15 19:09:20 2026 +0300 drm/xe/display: fix oops in suspend/shutdown without display The xe driver keeps track of whether to probe display, and whether display hardware is there, using xe->info.probe_display. It gets set to false if there's no display after intel_display_device_probe(). However, the display may also be disabled via fuses, detected at a later time in intel_display_device_info_runtime_init(). In this case, the xe driver does for_each_intel_crtc() on uninitialized mode config in xe_display_flush_cleanup_work(), leading to a NULL pointer dereference, and generally calls display code with display info cleared. Check for intel_display_device_present() after intel_display_device_info_runtime_init(), and reset xe->info.probe_display as necessary. Also do unset_display_features() for completeness, although display runtime init has already done that. This will need to be unified across all cases later. Move intel_display_device_info_runtime_init() call slightly earlier, similar to i915, to avoid a bunch of unnecessary setup for no display cases. Note #1: The xe driver has no business doing low level display plumbing like for_each_intel_crtc() to begin with. It all needs to happen in display code. Note #2: The actual bug is present already in commit 44e694958b95 ("drm/xe/display: Implement display support"), but the oops was likely introduced later at commit ddf6492e0e50 ("drm/xe/display: Make display suspend/resume work on discrete"). Fixes: 44e694958b95 ("drm/xe/display: Implement display support") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7904 Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/6150 Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260515160920.1082842-1-jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit 7c3eb9f47533220888a67266448185fd0775d4da) Signed-off-by: Matthew Brost commit c7d573551f9286100a055ef696cde6af54549677 Author: Davide Ornaghi Date: Wed Jun 10 12:39:13 2026 +0200 netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register NFT_META_BRI_IIFHWADDR declares its destination register with len = ETH_ALEN (6 bytes), which the register-init tracking rounds up to two 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does memcpy(dest, br_dev->dev_addr, ETH_ALEN), writing only 6 bytes and leaving the upper 2 bytes of the second register as uninitialised nft_do_chain() stack. A downstream load of that register span leaks those stale bytes to userspace. Zero the second register before the memcpy so the full declared span is written. Fixes: cbd2257dc96e ("netfilter: nft_meta_bridge: introduce NFT_META_BRI_IIFHWADDR support") Cc: stable@vger.kernel.org Signed-off-by: Davide Ornaghi Signed-off-by: Pablo Neira Ayuso commit ab185e0c4fb82dfba6fb86f8271e06f931d9c64c Author: Davide Ornaghi Date: Wed Jun 10 12:39:12 2026 +0200 netfilter: nft_fib: fix stale stack leak via the OIFNAME register For NFT_FIB_RESULT_OIFNAME the destination register is declared with len = IFNAMSIZ (four 32-bit registers), but on the lookup-fail, RTN_LOCAL and oif-mismatch paths nft_fib{4,6}_eval() only writes one register via "*dest = 0". The remaining three registers are left as whatever was on the stack in nft_do_chain()'s struct nft_regs, and a downstream expression that loads the register span can leak that uninitialised kernel stack to userspace. The NFTA_FIB_F_PRESENT existence check has the same shape: it is only meaningful for NFT_FIB_RESULT_OIF, yet it was accepted for any result type while the eval stores a single byte via nft_reg_store8(), leaving the rest of the declared span stale. Fix both: - replace the bare "*dest = 0" in the eval with nft_fib_store_result(), which strscpy_pad()s the whole IFNAMSIZ for OIFNAME (and is already used on the other early-return path), and - restrict NFTA_FIB_F_PRESENT to NFT_FIB_RESULT_OIF and declare its destination as a single u8, so the marked span matches the one byte the eval writes. Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression") Suggested-by: Florian Westphal Cc: stable@vger.kernel.org Signed-off-by: Davide Ornaghi Signed-off-by: Pablo Neira Ayuso commit 772cecf198da732faebb5dcfc46d66a505be8495 Author: Florian Westphal Date: Tue Jun 9 21:28:09 2026 +0200 netfilter: nft_exthdr: fix register tracking for F_PRESENT flag nft_exthdr_init() passes user-controlled priv->len to nft_parse_register_store(), which marks that many bytes in the register bitmap as initialized. However, when NFT_EXTHDR_F_PRESENT is set, the eval paths write only 1 byte (nft_reg_store8) or 4 bytes (*dest = 0 on TCP/DCCP error path). When len > 4, registers beyond the first are never written, retaining uninitialized stack data from nft_regs. Bail out if userspace requests too much data when F_PRESENT is set. Reported-by: Ji'an Zhou Fixes: c078ca3b0c5b ("netfilter: nft_exthdr: Add support for existence check") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit a84b6fedbc97078788be78dbdd7517d143ad1a77 Author: Xiang Mei Date: Tue Jun 9 15:55:02 2026 -0700 netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log. This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed). Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before. BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) Read of size 1 at addr ffff88800ea49d3f by task exploit/148 Call Trace: kasan_report (mm/kasan/report.c:595) dump_mac_header (net/netfilter/nf_log_syslog.c:831) nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) nf_log_packet (net/netfilter/nf_log.c:260) nft_log_eval (net/netfilter/nft_log.c:60) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307) nf_hook_slow (net/netfilter/core.c:619) nf_hook_direct_egress (net/packet/af_packet.c:257) packet_xmit (net/packet/af_packet.c:280) packet_sendmsg (net/packet/af_packet.c:3114) __sys_sendto (net/socket.c:2265) Fixes: 7eb9282cd0ef ("netfilter: ipt_LOG/ip6t_LOG: add option to print decoded MAC header") Reported-by: Weiming Shi Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei Signed-off-by: Pablo Neira Ayuso commit f7f2fbb0e893a0238dc464f8d8c0f5609bec584f Author: Kyle Zeng Date: Sat Jun 6 01:10:31 2026 -0700 netfilter: x_tables: avoid leaking percpu counter pointers The native and compat get-entries paths copy the fixed rule entry header from the kernelized rule blob to userspace before overwriting the entry's counter fields with a sanitized counter snapshot. On SMP kernels, entry->counters.pcnt contains the percpu allocation address used by x_tables rule counters. A caller can provide a userspace buffer that faults during the initial fixed-header copy after pcnt has been copied but before the later sanitized counter copy runs. The syscall then returns -EFAULT while leaving the raw percpu pointer in userspace. Copy only the fixed entry prefix before counters from the kernelized rule blob, then copy the sanitized counter snapshot into the counter field. Apply this ordering to the IPv4, IPv6, and ARP native and compat get-entries implementations so a fault cannot expose the internal percpu counter pointer. Fixes: 71ae0dff02d7 ("netfilter: xtables: use percpu rule counters") Signed-off-by: Kyle Zeng Signed-off-by: Pablo Neira Ayuso commit c3009418f9fa1dcb3eb86f4d8c92583537b5faa3 Author: Weiming Shi Date: Wed Jun 3 00:38:17 2026 -0700 netfilter: nf_conntrack: destroy stale expectfn expectations on unregister NAT helpers such as nf_nat_h323 store a raw pointer to module text in exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister() only unlinks the callback descriptor and never walks the expectation table, so an expectation pending at module removal survives with a dangling exp->expectfn into freed module text. When the expected connection arrives, init_conntrack() invokes exp->expectfn(), now a stale pointer into the unloaded module. Reproduced on a KASAN build by loading the H.323 helpers, creating a Q.931 expectation, unloading nf_nat_h323, then connecting to the expected port: Oops: int3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d1 init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) __ip_local_out (net/ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_output.c:1715) tcp_connect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/ipv4/tcp_ipv4.c:345) __sys_connect (net/socket.c:2167) Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323] Reaching the dangling state requires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper that still has live expectations, so this is a robustness fix; leaving an expectation pointing at freed text is wrong regardless. Add nf_ct_helper_expectfn_destroy(), which walks the expectation table and drops every expectation whose ->expectfn matches the descriptor being torn down. Call it from each NAT helper's exit path after the existing RCU grace period, so no expectation outlives the code it points at and no extra synchronize_rcu() is introduced. With the fix, the same reproducer runs to completion without the Oops. Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port") Reported-by: Xiang Mei Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi Signed-off-by: Pablo Neira Ayuso commit efc542561729a2859397dad51bda1fe41262beb1 Author: Florian Westphal Date: Fri Jun 5 13:47:12 2026 +0200 netfilter: nf_tables_offload: drop device refcount on error Reported by sashiko: If nft_flow_action_entry_next() returns NULL, dev reference leaks. Fixes: c6f85577584b ("netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it") Reported-by: Juri Lelli Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit ccb9fd4b87538ccf19ccff78ee26700526d94867 Author: Florian Westphal Date: Tue Jun 2 17:04:25 2026 +0200 netfilter: revalidate bridge ports ebt_redirect_tg() dereferences br_port_get_rcu() return without a NULL check, causing a kernel panic when the bridge port has been removed between the original hook invocation and an NFQUEUE reinject. A mere NULL check isn't sufficient, however. As sashiko review points out userspace can not only remove the port from the bridge, it could also place the device in a different virtual device, e.g. macvlan. If this happens, we must drop the packet, there is no way for us to reinject it into the bridge path. Switch to _upper API, we don't need the bridge port structure. Also, this fix keeps another bug intact: Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER too aggressive, which prevents certain logging features when queueing in bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old CONFIG_BRIDGE_NETFILTER cruft is off. Fixes tag is a common ancestor, this was always broken. Fixes: f350a0a87374 ("bridge: use rx_handler_data pointer to store net_bridge_port pointer") Reported-by: Ji'an Zhou Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 310628484ef06f95c5589374fade917a5689787b Author: Felix Gu Date: Wed Jun 10 20:08:17 2026 +0800 spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX The RZ/V2H hardware manual (section 7.5.2.2.1) specifies that read access size for the SPI Data Register (SPDR) are fixed at 32 bits. The RZV2H_RSPI_RX macro for the 16-bit data path used readw(), violating this requirement. Switch to readl() for the 16-bit RX path to conform to the hardware specification. Fixes: 8b61c8919dff ("spi: Add driver for the RZ/V2H(P) RSPI IP") Suggested-by: Geert Uytterhoeven Signed-off-by: Felix Gu Reviewed-by: Geert Uytterhoeven Reviewed-by: Fabrizio Castro Link: https://patch.msgid.link/20260610-rzv2h-rspi-v2-1-40c80b4a2c90@gmail.com Signed-off-by: Mark Brown commit 512db8267b73a220a64180d95ab5eebe7c4964a8 Author: Breno Leitao Date: Mon Jun 8 02:32:05 2026 -0700 rds: mark snapshot pages dirty in rds_info_getsockopt() rds_info_getsockopt() pins the destination user pages with FOLL_WRITE and the RDS_INFO_* producers memcpy the snapshot into them through kmap_atomic(). Because that copy goes through the kernel direct map, the dirty bit on the user PTE is never set, so unpin_user_pages() releases the pages without marking them dirty. A file-backed destination page can then be reclaimed without writeback, silently discarding the copied data. Use unpin_user_pages_dirty_lock() with make_dirty=true so the modified pages are marked dirty before they are unpinned. Fixes: a8c879a7ee98 ("RDS: Info and stats") Signed-off-by: Breno Leitao Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20260608-rds_fix-v1-1-006c88543408@debian.org Signed-off-by: Jakub Kicinski commit a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9 Author: Eric Dumazet Date: Mon Jun 8 16:46:13 2026 +0000 ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address. Fixes: fbe68ee87522 ("vti6: Add a lookup method for tunnels with wildcard endpoints.") Signed-off-by: Eric Dumazet Cc: Steffen Klassert Reviewed-by: Nicolas Dichtel Link: https://patch.msgid.link/20260608164613.933023-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 767622308a1d8b111038fca0059b964da1f6d9c4 Merge: 805d5a2b792819 15b41551385056 Author: Linus Torvalds Date: Wed Jun 10 07:18:32 2026 -0700 Merge tag 'riscv-for-linux-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Fix the implementation of the CFI branch landing pad control prctl()s to return -EINVAL if unknown control bits are set, rather than silently ignoring the request; and add a kselftest for this case - Fix unaligned access performance testing to happen earlier in boot, which fixes a performance regression in the lib/checksum code - Fix a binfmt_elf warning when dumping core (due to missing .core_note_name for CFI registers) * tag 'riscv-for-linux-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: cfi: reject unknown flags in PR_SET_CFI riscv: Fix fast_unaligned_access_speed_key not getting initialized riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI commit 805d5a2b792819171be100c50c9ddafa0f8c2231 Author: Jann Horn Date: Fri Jun 5 22:27:33 2026 +0200 namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories open_tree(..., OPEN_TREE_NAMESPACE) and fsmount(..., FSMOUNT_NAMESPACE, ...) currently work on non-directories, like regular files. That's bad for two reasons: - It ends up mounting a regular file over the inherited namespace root, which is a directory; mounting a non-directory over a directory is normally explicitly forbidden, see for example do_move_mount() - It causes setns() on the new namespace to set the cwd to a regular file, which the rest of VFS does not expect Fix it by restricting create_new_namespace() (which is used by both of these flags) to directories. Leave the behavior for OPEN_TREE_CLONE as-is, that seems unproblematic. Fixes: 9b8a0ba68246 ("mount: add OPEN_TREE_NAMESPACE") Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: stable@kernel.org Signed-off-by: Jann Horn Signed-off-by: Linus Torvalds commit e47832c73b83ec21e67026726a1c8124697792af Merge: 4316acc7ddaaa4 96d47e40bf9db4 Author: Greg Kroah-Hartman Date: Wed Jun 10 12:25:33 2026 +0200 Merge tag 'usb-serial-7.1-rc8' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial fixes for 7.1-rc8 Here is one more buffer overflow fix. This one has been in linux-next overnight with no reported issues. * tag 'usb-serial-7.1-rc8' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: kl5kusb105: fix bulk-out buffer overflow commit d79716401a954677a93c4dd51fec65beccb38296 Author: Melissa Wen Date: Tue Jun 9 12:20:21 2026 +0200 drm/amd/display: use plane color_mgmt_changed to track colorop changes Ensure the driver tracks changes in any colorop property of a plane color pipeline by using the same mechanism of CRTC color management and update plane color blocks when any colorop property changes. It fixes an issue observed on gamescope settings for night mode which is done via shaper/3D-LUT updates. Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Reviewed-by: Harry Wentland Reviewed-by: Alex Hung Signed-off-by: Melissa Wen Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260609110420.1298352-5-mwen@igalia.com commit 2e235e2a2784b12b735321e5b42240ca51c49b0f Author: Melissa Wen Date: Tue Jun 9 12:20:20 2026 +0200 drm/atomic: track individual colorop updates As we do for CRTC color mgmt properties, use color_mgmt_changed flag to track any value changes in the color pipeline of a given plane, so that drivers can update color blocks as soon as plane color pipeline or individual colorop values change. Since we're here, only announce and track changes to plane COLOR_PIPELINE prop if its value is actually changing. Fixes: 8c5ea1745f4c ("drm/colorop: Add BYPASS property") Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") Fixes: 41651f9d42eb ("drm/colorop: Add 1D Curve subtype") Fixes: 3410108037d5 ("drm/colorop: Add multiplier type") Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") Fixes: e5719e7f1900 ("drm/colorop: Add 3x4 CTM type") Fixes: 99a4e4f08abe ("drm/colorop: Add 1D Curve Custom LUT type") Fixes: 2afc3184f3b3 ("drm/plane: Add COLOR PIPELINE property") Reviewed-by: Harry Wentland #v1 Reviewed-by: Chaitanya Kumar Borah Reviewed-by: Alex Hung Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Signed-off-by: Melissa Wen Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260609110420.1298352-4-mwen@igalia.com commit 94ff735296d371045fce163451a3d65e44ac4729 Author: Melissa Wen Date: Tue Jun 9 12:20:19 2026 +0200 drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable As interpolation props are actually mutable props, any changes should be handled by drm_colorop_state. Move their enum and make it correctly behaves as mutable. Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") Reviewed-by: Chaitanya Kumar Borah Reviewed-by: Alex Hung Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Signed-off-by: Melissa Wen Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260609110420.1298352-3-mwen@igalia.com commit e480228cf65583040c894bb9cc02e1d5b328cee0 Author: Alex Hung Date: Tue Jun 9 12:20:18 2026 +0200 drm/colorop: Remove read-only comments from interpolation fields The lut1d_interpolation and lut3d_interpolation fields and their associated properties were marked as read-only, but userspace can set them via drm_atomic_colorop_set_property(). Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") Reviewed-by: Chaitanya Kumar Borah Signed-off-by: Alex Hung Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Signed-off-by: Melissa Wen Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260609110420.1298352-2-mwen@igalia.com commit d21ad938398bca695a511307de38a65889e3b354 Author: Joonas Lahtinen Date: Wed Jun 10 09:03:14 2026 +0300 drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted platform with overlay or cursor planes using phys mapping was Gen3/945G/Lakeport. Reported-by: Matthew Wilcox (Oracle) Fixes: c6790dc22312 ("drm/i915: Wean off drm_pci_alloc/drm_pci_free") Cc: # v4.5+ Cc: Tvrtko Ursulin Cc: Simona Vetter Cc: Jani Nikula Cc: Rodrigo Vivi Signed-off-by: Joonas Lahtinen Reviewed-by: Tvrtko Ursulin Link: https://patch.msgid.link/20260610060314.26111-1-joonas.lahtinen@linux.intel.com (cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6) Signed-off-by: Tvrtko Ursulin commit a23226b7c1f69eafd9ced4e037fb51c9758c0501 Author: Daniel Drake Date: Mon Jun 8 22:01:08 2026 +0100 gpiolib: handle gpio-hogs only once Commit d1d564ec49929 ("gpio: move hogs into GPIO core") introduced a behaviour change that breaks boot on Raspberry Pi 5 when using the firmware-supplied device tree: gpiochip_add_data_with_key: GPIOs 544..575 (/soc@107c000000/gpio@7d517c00) failed to register, -22 brcmstb-gpio 107d517c00.gpio: Could not add gpiochip for bank 1 brcmstb-gpio 107d517c00.gpio: probe with driver brcmstb-gpio failed with error -22 gpio-brcmstb registers two gpio_chips against the device tree node gpio@7d517c00, one for each bank. The firmware-supplied DT includes a gpio-hog on RP1 RUN, and this gpio-hog is attempted to be applied to *both* gpio_chips. This succeeds against bank 0 (which hosts the GPIO) and fails for bank 1 (which does not). In the previous implementation, failures to apply gpio-hogs were quietly ignored. In the new code, the error code propagates and causes probe to fail. Closely approximate the previous behaviour by using the OF_POPULATED flag to ensure that each gpio-hog is processed only once. The flag was previously being set before the gpio-hogs were processed, so as part of this change, the flag now gets set only after the gpio-hog is actioned. The handling of gpio-hogs on a DT node with multiple gpio_chips remains a bit incomplete/unclear, but this at least retains the ability to apply hogs to the first gpio_chip per node. Fixes: d1d564ec49929 ("gpio: move hogs into GPIO core") Signed-off-by: Daniel Drake Link: https://patch.msgid.link/20260608210108.36248-1-dan@reactivated.net Signed-off-by: Bartosz Golaszewski commit 64911f5aac534191e6b9a52ca1d50ba870a12d86 Author: Bartosz Golaszewski Date: Tue Jun 9 14:17:50 2026 +0200 gpio: fix cleanup path on hog failure If gpiochip_hog_lines() successfully processes some hogs but fails on a later one, the error handling path in gpiochip_add_data_with_key() jumps directly to err_remove_of_chip. This leaks resources allocated earlier for ACPI, interrupts and hogs that were successfully processed. Use the right label in error path. Closes: https://sashiko.dev/#/patchset/20260608210108.36248-1-dan%40reactivated.net Fixes: d1d564ec4992 ("gpio: move hogs into GPIO core") Reviewed-by: Andy Shevchenko Reviewed-by: Mika Westerberg Link: https://patch.msgid.link/20260609-gpio-hogs-fixes-v1-2-b4064f8070e7@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 627366c51145a07f675b1800fb5ea2ec960bd900 Author: Vadim Fedorenko Date: Mon Jun 8 15:59:52 2026 +0000 ptp: ocp: fix resource freeing order Commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") added a call to ptp_disable_all_events() which changes the configuration of pins if they support EXTTS events. In ptp_ocp_detach() pins resources are freed before ptp_clock_unregister() and it leads to use-after-free during driver removal. Fix it by changing the order of free/unregister calls. To avoid irq handler running on the other core while ptp device unregistering, call synchronize_irq() after HW is configured to stop producing irqs and no irqs are in-flight. Fixes: a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20260608155952.240304-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 7f2fcff15e99bb852f6967396ed12b38376e2c8d Author: Xiang Mei Date: Sat Jun 6 22:44:28 2026 -0700 tun: zero the whole vnet header in tun_put_user() tun_put_user() declares an on-stack struct virtio_net_hdr_v1_hash_tunnel without zeroing it. For a non-tunnel skb, virtio_net_hdr_tnl_from_skb() only initializes the first 10 bytes (sizeof(struct virtio_net_hdr)), leaving bytes 10..23 (num_buffers and the hash/tunnel fields) as stack garbage. An unprivileged user can set the vnet header size to 24 with TUNSETVNETHDRSZ, so __tun_vnet_hdr_put() copies all 24 bytes of the partially-initialized struct to userspace, leaking 14 bytes of kernel stack on every read of a non-tunnel packet. Fix it the same way tun_get_user() already does by zeroing the whole header right after declaration. Fixes: 288f30435132 ("tun: enable gso over UDP tunnel support.") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260607054428.3050243-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski commit 34080db3e70ddf94c38512ad2331e3c3afca6cc1 Author: Weiming Shi Date: Sat Jun 6 12:24:48 2026 -0700 net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion rds_ib_xmit_atomic() always programs a masked atomic opcode (IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD) for every RDS atomic cmsg. But the completion-side switch in rds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked atomic completion falls through to default and returns rm == NULL while send->s_op is left set. rds_ib_send_cqe_handler() then dereferences the NULL rm via rm->m_final_op, oopsing in softirq context. An unprivileged AF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection triggers it; on hardware that natively accepts masked atomics (mlx4, mlx5) no extra setup is needed. RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR! Oops: general protection fault [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282) Call Trace: rds_ib_send_cqe_handler (net/rds/ib_send.c:282) poll_scq (net/rds/ib_cm.c:274) rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294) tasklet_action_common (kernel/softirq.c:943) handle_softirqs (kernel/softirq.c:573) run_ksoftirqd (kernel/softirq.c:479) Kernel panic - not syncing: Fatal exception in interrupt Handle the masked atomic opcodes in the same case as the non-masked ones: they map to the same struct rds_message.atomic union member, so the existing container_of()/rds_ib_send_unmap_atomic() body is correct for them. Fixes: 20c72bd5f5f9 ("RDS: Implement masked atomic operations") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20260606192447.1179255-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit 1ee90b77b727df903033db873c75caac5c27ec98 Author: Kyle Zeng Date: Sat Jun 6 19:18:19 2026 -0700 net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET instead of struct sock_exterr_skb. If such an skb is received with timestamping enabled, the generic timestamp cmsg path can read AF_PACKET control-buffer state as sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop counter overlaps opt_stats. An odd drop count makes the path emit SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear skbs this copies past the linear head and can trigger hardened usercopy or disclose adjacent heap contents. Keep skb_is_err_queue() local to net/socket.c, but make it verify that the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal receive ownership and no longer pass as error-queue skbs, while legitimate sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free ownership. Fixes: 8605330aac5a ("tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs") Signed-off-by: Kyle Zeng Reviewed-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260607021819.49698-1-kylebot@openai.com Signed-off-by: Jakub Kicinski commit 6f4c80a2a7e6d06753b89a578b710a2499a5e62b Author: Xin Long Date: Sun Jun 7 19:03:47 2026 -0400 sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Sashiko Signed-off-by: Xin Long Link: https://patch.msgid.link/75af23a89adf881a0895d511775e4770da367cbf.1780873427.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit d289d5307762d1838aaece22c6b6fcad9e8865f9 Author: Eric Dumazet Date: Mon Jun 8 15:59:18 2026 +0000 ip6_vti: set netns_immutable on the fallback device. john1988 and Noam Rathaus reported that vti6_init_net() does not set the netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0). Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel) correctly set this flag during their fallback device initialization to prevent them from being moved to another network namespace. Fixes: 61220ab34948 ("vti6: Enable namespace changing") Reported-by: Noam Rathaus Signed-off-by: Eric Dumazet Cc: Steffen Klassert Reviewed-by: Nicolas Dichtel Link: https://patch.msgid.link/20260608155918.787644-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit f8373d7090b745728de66308deeecc67e8d319ce Author: Michael Bommarito Date: Mon Jun 8 08:22:34 2026 -0400 sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 ("net: sctp: fix KMSAN uninit-value in sctp_inq_pop"). Fixes: df2185771439 ("[SCTP]: Update association lookup to look at ASCONF chunks as well") Signed-off-by: Michael Bommarito Acked-by: Xin Long Link: https://patch.msgid.link/20260608122234.459098-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski commit d930276f2cddd0b7294cac7a8fe7b877f6d9e08d Author: Kyle Meyer Date: Fri Jun 5 17:25:24 2026 -0500 bnxt_en: Fix NULL pointer dereference PCIe errors detected by a Root Port or Downstream Port cause error recovery services to run on all subordinate devices regardless of administrative state. The .error_detected() callback, bnxt_io_error_detected(), disables and synchronizes IRQs via bnxt_disable_int_sync(), which calls bnxt_cp_num_to_irq_num() to map completion rings to IRQs using bp->bnapi. Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe error recovery on a closed NIC can dereference a NULL pointer. Check if bp->bnapi is NULL before disabling and synchronizing IRQs. Fixes: e5811b8c09df ("bnxt_en: Add IRQ remapping logic.") Cc: stable@vger.kernel.org Signed-off-by: Kyle Meyer Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/aiNM1CY2-StPilxW@hpe.com Signed-off-by: Jakub Kicinski commit a5f8a90ac9f77c678a9781c0a464b635e0d63e49 Author: Wyatt Feng Date: Fri Jun 5 13:53:42 2026 +0800 sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions. Fixes: 637784ade221 ("sctp: introduce priority based stream scheduler") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Zhengchuan Liang Reported-by: Xin Liu Signed-off-by: Wyatt Feng Signed-off-by: Ren Wei Acked-by: Xin Long Link: https://patch.msgid.link/d78954ecd94954653ee299400e98d74a03a6f7d3.1780603399.git.bronzed_45_vested@icloud.com Signed-off-by: Jakub Kicinski commit acb7500801e98639f6d8c2d796ed9f64cba83d3a Merge: 06f4462d05bdfb df996599cc69a9 Author: Linus Torvalds Date: Tue Jun 9 17:20:00 2026 -0700 Merge tag 'trace-rv-v7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull runtime verifier fixes from Steven Rostedt: - Fix reset ordering on per-task destruction Reset the task before dropping the slot instead of after, which was causing out-of-bound memory accesses. - Fix HA monitor synchronization and cleanup Ensure synchronous cleanup for HA monitors by running timer callbacks in RCU read-side critical sections and using synchronize_rcu() during destruction. - Avoid armed timers after tasks exit Add automatic cleanup for per-task HA monitors to prevent timers from firing after task exit. - Fix memory ordering for DA/HA monitors Fix race conditions during monitor start by using release-acquire semantics for the monitoring flag. - Fix initialization for DA/HA monitors Ensure monitors are not initialized relying on potentially corrupted state like the monitoring flag, that is not reset by all monitors type and may have an unknown state in monitors reusing the storage (per-task). - Fix memory safety in per-task and per-object monitors Prevent use-after-free and out-of-bounds access by synchronizing with in-flight tracepoint probes using tracepoint_synchronize_unregister() before freeing monitor storage or releasing task slots. - Adjust monitors for preemptible tracepoints Fix monitors that relied on tracepoints disabling preemption. Explicitly disable task migration when per-CPU monitors handle events to avoid accessing the wrong state and update the opid monitor logic. - Fix incorrect __user specifier usage Remove __user from a non-pointer variable in the extract_params() helper. - Fix bugs in the rv tool Ensure strings are NUL-terminated, fix substring matching in monitor searches, and improve cleanup and exit status handling. - Fix several bugs in rvgen Fix LTL literal stringification, subparsers' options handling, and suffix stripping in dot2k. * tag 'trace-rv-v7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: verification/rvgen: Fix ltl2k writing True as a literal verification/rvgen: Fix options shared among commands verification/rvgen: Fix suffix strip in dot2k tools/rv: Fix cleanup after failed trace setup tools/rv: Fix substring match when listing container monitors tools/rv: Fix substring match bug in monitor name search tools/rv: Ensure monitor name and desc are NUL-terminated rv: Use 0 to check preemption enabled in opid rv: Prevent task migration while handling per-CPU events rv: Ensure synchronous cleanup for HA monitors rv: Add automatic cleanup handlers for per-task HA monitors rv: Do not rely on clean monitor when initialising HA rv: Fix monitor start ordering and memory ordering for monitoring flag rv: Ensure all pending probes terminate on per-obj monitor destroy rv: Prevent in-flight per-task handlers from using invalid slots rv: Reset per-task DA monitors before releasing the slot rv: Fix __user specifier usage in extract_params() commit 06f4462d05bdfb6f1fb7b1f263f5a3425ab210f7 Merge: 685441a6d3f174 e9e41d3035032e Author: Linus Torvalds Date: Tue Jun 9 17:05:19 2026 -0700 Merge tag 'trace-tools-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull RTLA fix from Steven Rostedt: - Fix multi-character short option parsing Fix regression in parsing of multiple-character short options (eg -p100 /= -p 100/, -un /= -u -n/) caused by getopt_long() internal state corruption after a refactoring. * tag 'trace-tools-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla: Fix parsing of multi-character short options commit 3c60184e39b57e5efe664fe8540cdbc1bc7ea899 Author: Peng Yang Date: Mon Jun 8 17:58:49 2026 +0800 spi: dw: fix race between IRQ handler and error handler on SMP On SMP systems, dw_spi_handle_err() can be called from the SPI core kthread while the IRQ handler is still accessing the FIFO on another CPU. Resetting the chip via dw_spi_reset_chip() during an active FIFO read/write causes a bus error. Fix this by calling disable_irq() before the chip reset, which masks the IRQ and waits for any in-flight handler to complete via synchronize_irq(). This ensures no handler is accessing the FIFO when the reset occurs. Signed-off-by: Peng Yang Suggested-by: Jonathan Chocron Link: https://patch.msgid.link/20260608095849.3446-1-pyangyyd@amazon.com Signed-off-by: Mark Brown commit 0e152e4126fa14e697d8514cdd1567b18c679f08 Author: Zhang Heng Date: Thu Jun 4 20:58:15 2026 +0800 ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1403CDA Add a DMI quirk for the ASUS EXPERTBOOK PM1403CDA fixing the issue where the internal microphone was not detected. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221608 Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260604125815.42297-1-zhangheng@kylinos.cn Signed-off-by: Mark Brown commit 5ac5ec84734fd338867055d4d7b650f18a023cb0 Author: Viken Dadhaniya Date: Tue Jun 9 14:13:09 2026 +0530 spi: qcom-geni: Fix cs_change handling on the last transfer TPM TIS SPI probe fails with: tpm_tis_spi: probe of spi11.0 failed with error -110 TPM TIS SPI sets cs_change=1 on single-transfer messages to keep CS asserted across the header, wait-state, and data phases of a transaction. CS deassertion between these phases violates the TCG SPI flow control specification. This bug was introduced by commit b99181cdf9fa ("spi-geni-qcom: remove manual CS control"), which replaced manual CS control with automatic CS control via the FRAGMENTATION bit. The FRAGMENTATION bit controls CS behavior after a transfer: when set to 1, CS remains asserted; when cleared to 0, CS is deasserted. The commit correctly sets FRAGMENTATION for non-last transfers with cs_change=0 to keep CS asserted between chained transfers, but misses the case where cs_change=1 is set on the last transfer. When cs_change=1 on the last transfer, the client requests CS to remain asserted after the message completes, so FRAGMENTATION must be set to 1 in this case as well. Fix setup_se_xfer() to set FRAGMENTATION when cs_change=1 on the last transfer. Also fix the same missing case in setup_gsi_xfer() and correct it to write 1 instead of the raw bitmask FRAGMENTATION (value 4) to peripheral.fragmentation. This field is a 1-bit boolean consumed by gpi_create_spi_tre() via u32_encode_bits(..., TRE_SPI_GO_FRAG). Writing 4 to a 1-bit field causes u32_encode_bits() to mask it to 0, silently disabling the FRAGMENTATION bit in the GPI TRE regardless of the cs_change logic. Fixes: b99181cdf9fa ("spi-geni-qcom: remove manual CS control") Cc: stable@vger.kernel.org Reviewed-by: Jonathan Marek Signed-off-by: Viken Dadhaniya Link: https://patch.msgid.link/20260609-fix-spi-fragmentation-bit-logic-v2-1-e18efc255563@oss.qualcomm.com Signed-off-by: Mark Brown commit 6ec91df8aff77e2e8fe3179c1f3fc15b43a40ba3 Author: Jason Gunthorpe Date: Mon Jun 8 15:10:04 2026 -0300 iommu/dma: Do not try to iommu_map a 0 length region in swiotlb iommu_dma_iova_link_swiotlb() processes a mapping that is unaligned in three parts, the head, middle and trailer. If the middle is empty because there are no aligned pages it will call down to iommu_map() with a 0 size which the iommupt implementation will fail as illegal. It then tries to do an error unwind and starts from the wrong spot corrupting the mapping so the eventual destruction triggers a WARN_ON. Check for 0 length and avoid mapping and use offset not 0 as the starting point to unlink. This is frequently triggered by using some kinds of thunderbolt NVMe drives that trigger forced SWIOTLB for unaligned memory. NVMe seems to pass in oddly aligned buffers for the passthrough commands from smartctl that hit this condition. Cc: stable@vger.kernel.org Fixes: 433a76207dcf ("dma-mapping: Implement link/unlink ranges API") Reported-by: Mark Lord Signed-off-by: Jason Gunthorpe Reviewed-by: Christoph Hellwig Reviewed-by: Leon Romanovsky Reviewed-by: Samiullah Khawaja Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/0-v1-8536728bc89f+469-swiotlb_warn_jgg@nvidia.com commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b Author: Alexander A. Klimov Date: Sat Jun 6 14:38:10 2026 +0200 drm/vc4: fix krealloc() memory leak Don't just overwrite the original pointer passed to krealloc() with its return value without checking latter: MEM = krealloc(MEM, SZ, GFP); If krealloc() returns NULL, that erases the pointer to the still allocated memory, hence leaks this memory. Instead, use a temporary variable, check it's not NULL and only then assign it to the original pointer: TMP = krealloc(MEM, SZ, GFP); if (!TMP) return; MEM = TMP; While on it, use krealloc_array(). Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.") Signed-off-by: Alexander A. Klimov Signed-off-by: Maíra Canal Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de commit 25b17c06040fae60518b4ff9c46f2bb12285d538 Author: Vijendar Mukunda Date: Tue Jun 9 21:38:45 2026 +0530 ASoC: SOF: amd: set ipc flags to zero As per design, set IPC conf structure flags to zero during acp init sequence. Link: https://github.com/thesofproject/linux/pull/5642 Signed-off-by: Vijendar Mukunda Tested-by: Umang Jain Link: https://patch.msgid.link/20260609160938.3717513-2-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 6042c91df60e825625bc7d5c5c3b5a87b91d5805 Author: Vijendar Mukunda Date: Tue Jun 9 21:38:44 2026 +0530 ASoC: SOF: amd: fix for ipc flags check Firmware will set dsp_ack to 1 when firmware sends response for the IPC command issued by host. Similarly dsp_msg flag will be updated to 1. During ACP D0 entry, the value read from the sof_dsp_ack_write scratch flag can be uninitialized. A non-zero garbage value is treated as a pending DSP IPC ack before SOF_FW_BOOT_COMPLETE, causing a spurious "IPC reply before FW_BOOT_COMPLETE" log. Fix the condition checks for ipc flags. Fixes: 738a2b5e2cc9 ("ASoC: SOF: amd: Add IPC support for ACP IP block") Link: https://github.com/thesofproject/linux/pull/5642 Signed-off-by: Vijendar Mukunda Tested-by: Umang Jain Link: https://patch.msgid.link/20260609160938.3717513-1-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 685441a6d3f17404b47087d051963bc7fb665ef0 Merge: fed2efe803e014 0c25b873436757 Author: Linus Torvalds Date: Tue Jun 9 08:24:25 2026 -0700 Merge tag 'mm-hotfixes-stable-2026-06-08-20-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "11 hotfixes. 9 are for MM. 8 are cc:stable and the remaining 3 address post-7.1 issues or aren't considered suitable for backporting. Thre's a two-patch series "mm/damon/{reclaim,lru_sort}: handle ctx allocation failures" from SeongJae Park which fixes a couple of DAMON -ENOMEM bloopers. The rest are singletons - please see the individual changelogs for details" * tag 'mm-hotfixes-stable-2026-06-08-20-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/mincore: handle non-swap entries before !CONFIG_SWAP guard arm64: mm: call pagetable dtor when freeing hot-removed page tables mm/list_lru: drain before clearing xarray entry on reparent mm/huge_memory: use correct flags for device private PMD entry mm/damon/lru_sort: handle ctx allocation failure mm/damon/reclaim: handle ctx allocation failure zram: fix use-after-free in zram_bvec_write_partial() MAINTAINERS: update Baoquan He's email address tools headers UAPI: sync linux/taskstats.h for procacct.c mm/cma_sysfs: skip inactive CMA areas in sysfs ipc/shm: serialize orphan cleanup with shm_nattch updates commit fed2efe803e014e5c419bc7592caa8633683603e Merge: 2d3090a8aeb596 13e91fd076306f Author: Linus Torvalds Date: Tue Jun 9 08:19:48 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Several significant bug fixes of pre-existing issues: - Missing validation on ucap fd types passed from userspace - Missing validation of HW DMA space vs userpace expected sizes in EFA queue setup - DMA corruption when using DMA block sizes >= 4G when setting up MRs in all drivers - Missing validation of CPU IDs when setting up dma handles - Missing validation of IB_MR_REREG_ACCESS when changing writability of a MR - Missing validation of received message/packet size in ISER and SRP" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/srp: bound SRP_RSP sense copy by the received length IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN RDMA: During rereg_mr ensure that REREG_ACCESS is compatible RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc RDMA/umem: Fix truncation for block sizes >= 4G RDMA/efa: Validate SQ ring size against max LLQ size RDMA/core: Validate the passed in fops for ib_get_ucaps() commit 26aad08a928901296aabfbc7a33ecb951656bb98 Author: Alessandro Schino <7991aleschino@gmail.com> Date: Fri Jun 5 14:22:15 2026 +0200 esp: fix page frag reference leak on skb_to_sgvec failure In esp_output_tail(), when esp->inplace is false, the old skb page frags are replaced with a new page from the xfrm page_frag cache The source scatterlist (sg) is built from the old frags before the replacement, and esp_ssg_unref() is responsible for releasing the old page references after the crypto operation completes However, if the second skb_to_sgvec() call (which builds the destination scatterlist from the new page) fails, the code jumps to error_free which only calls kfree(tmp). The old page frag references captured in the source scatterlist are never released: 1 sg[] is built from old frags via skb_to_sgvec() (no extra get_page) 2 nr_frags is set to 1 and frag[0] is replaced with the new page 3 Second skb_to_sgvec() fails -> goto error_free Fix this by adding a bool parameter to esp_ssg_unref() that, when true, unconditionally unrefs the source scatterlist frags. Since req->src is not yet initialized by aead_request_set_crypt() at the point of the error, the source scatterlist is obtained directly via esp_req_sg() Existing callers pass false to preserve the original behavior The same issue exists in both esp4 and esp6 as the code is identical Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") Signed-off-by: Alessandro Schino <7991aleschino@gmail.com> Signed-off-by: Steffen Klassert commit 0aa05daef7848a5ac11158949dc73cd741995dc1 Merge: 004e9ecfe6c538 881a3113b74964 Author: Paolo Abeni Date: Tue Jun 9 15:23:15 2026 +0200 Merge branch 'net-mctp-usb-minor-fixes-for-mctp-over-usb-transport-driver' Jeremy Kerr says: ==================== net: mctp: usb: minor fixes for MCTP over USB transport driver This series adds a couple of fixes in the ndo_open / ndo_stop path for the MCTP over USB transport, where we are incorrectly sequencing two error cases. Signed-off-by: Jeremy Kerr ==================== Link: https://patch.msgid.link/20260608-dev-mctp-usb-rx-requeue-v2-0-29a3aa507609@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 881a3113b74964918cdd72747e3bc119c02b0c0c Author: Jeremy Kerr Date: Mon Jun 8 09:25:41 2026 +0800 net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission In the ndo_open path, a deferred queue open will report a failure, and so the netdev will not be ndo_stop()ed, leaving us with the rx_retry work potentially pending. Don't report a deferred queue as an error, as we are still operational. This means we use the ndo_stop() path for future cleanup, which handles rx_retry_work cancellation. Fixes: 0791c0327a6e ("net: mctp: Add MCTP USB transport driver") Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20260608-dev-mctp-usb-rx-requeue-v2-2-29a3aa507609@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 54665dce982689e2fd99b32e9a0dcc204fda8a51 Author: Jeremy Kerr Date: Mon Jun 8 09:25:40 2026 +0800 net: mctp: usb: fix race between urb completion and rx_retry cancellation It's possible that sequencing between setting ->stopped and cancelling the rx_retry work (in ndo_stop) could leave us with an urb queued: T1: ndo_stop T2: rx_retry_work ------------ ---------------- LD: ->stopped => false ST: ->stopped <= true usb_kill_urb() mctp_usb_rx_queue() usb_submit_urb() cancel_delayed_work_sync() That urb completion can then re-schedule rx_retry_work. Strenghen the sequencing between the stop (preventing another requeue) and the cancel by updating both atomically under a new rx lock. After setting ->rx_stopped, and cancelling pending work, we know that the requeue cannot occur, so all that's left is killing any pending urb. Fixes: 0791c0327a6e ("net: mctp: Add MCTP USB transport driver") Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20260608-dev-mctp-usb-rx-requeue-v2-1-29a3aa507609@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 1c1e0fc88d6ef65bf15d517853251f75ab9d18c3 Author: Marco Scardovi Date: Mon Jun 8 01:05:02 2026 +0200 gpio: rockchip: fix generic IRQ chip leak on remove The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe. However, on driver remove/teardown, the generic chips are not automatically freed when the IRQ domain is removed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC. This causes both the domain generic chips structure and the associated generic chips to be leaked. Additionally, the generic chips remain on the global gc_list and may later be visited by generic IRQ chip suspend, resume, or shutdown callbacks after the GPIO bank has been removed, potentially resulting in a use-after-free and kernel crash. Fix the resource leak by explicitly calling irq_domain_remove_generic_chips() before removing the IRQ domain in rockchip_gpio_remove(). Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Marco Scardovi Link: https://patch.msgid.link/20260607230504.35392-2-scardracs@disroot.org Signed-off-by: Bartosz Golaszewski commit 446e8c31d0fc7f1d92c06c2d2f7e7ed27f55f0c6 Author: Samuel Moelius Date: Tue Jun 9 00:45:38 2026 +0000 gpio: mockup: reject invalid gpio_mockup_ranges widths gpio-mockup validates only that each second gpio_mockup_ranges value is non-negative before creating the mock chips. The fixed-base form uses the second value as the first GPIO number after the range, while the dynamic-base form uses it as the number of GPIOs. gpio_mockup_register_chip() stores the resulting number of GPIOs in a u16 and passes it through a PROPERTY_ENTRY_U16("nr-gpios", ...). Values greater than U16_MAX therefore truncate silently. For example, gpio_mockup_ranges=-1,65537 creates a one-line mock GPIO chip instead of rejecting the invalid request. Reject zero-width, reversed, and over-U16 ranges before registering any mock chip. Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius Link: https://patch.msgid.link/20260609004538.1240091.3fba33a20b88.gpio-mockup-ngpio-u16-truncation@trailofbits.com Signed-off-by: Bartosz Golaszewski commit 6edb934de9bda3b7abcec856eaee6fc8b4278dd1 Author: Ruoyu Wang Date: Tue Jun 9 15:33:13 2026 +0800 gpio: zynq: fix runtime PM leak on remove pm_runtime_get_sync() increments the runtime PM usage counter even when it returns an error. zynq_gpio_remove() uses it to keep the controller active while removing the GPIO chip, but never drops the usage counter again. Balance the get with pm_runtime_put_noidle() after disabling runtime PM. Fixes: 3242ba117e9b ("gpio: Add driver for Zynq GPIO controller") Signed-off-by: Ruoyu Wang Link: https://patch.msgid.link/20260609073313.5-1-ruoyuw560@gmail.com Signed-off-by: Bartosz Golaszewski commit 004e9ecfe6c5384f9e0b2f6f6389d42ec22789af Author: Anton Leontev Date: Thu Jun 4 19:59:38 2026 +0300 hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf netvsc_copy_to_send_buf() copies page buffer entries into the VMBus send buffer using phys_to_virt() on the entry PFN. Entries for the RNDIS header and the skb linear data come from kmalloc'd memory and are always in the kernel direct map, but entries for skb fragments reference page cache or user pages, which on 32-bit x86 with CONFIG_HIGHMEM=y can live above the LOWMEM boundary. For such a page phys_to_virt() returns an address outside the direct map and the subsequent memcpy() faults on the transmit softirq path, which is fatal. Map the pages with kmap_local_page() instead, handling two properties of the page buffer entries: - pb[i].pfn is a Hyper-V PFN at HV_HYP_PAGE_SIZE (4K) granularity, not a native PFN. Reconstruct the physical address first and derive the native page from it, so the mapping stays correct where PAGE_SIZE > HV_HYP_PAGE_SIZE (e.g. arm64 with 64K pages). - Since commit 41a6328b2c55 ("hv_netvsc: Preserve contiguous PFN grouping in the page buffer array"), an entry describes a full physically contiguous fragment and pb[i].len can exceed PAGE_SIZE, while kmap_local_page() maps a single page. Copy page by page, splitting at native page boundaries. The copy path only handles packets smaller than the send section size (6144 bytes by default); larger packets take the cp_partial path where only the RNDIS header is copied. So entries here are bounded by the section size and a copy is split at most once on 4K-page systems. On !CONFIG_HIGHMEM configs kmap_local_page() folds to page_address() and no mapping work is added. Fixes: c25aaf814a63 ("hyperv: Enable sendbuf mechanism on the send path") Cc: stable@vger.kernel.org Signed-off-by: Anton Leontev Link: https://patch.msgid.link/20260604165938.32033-1-leontyevantony@gmail.com Signed-off-by: Paolo Abeni commit 09a5bf856aa759513afc4afd233d15bcc711b84e Author: Dawei Feng Date: Thu Jun 4 22:37:56 2026 +0800 octeontx2-af: fix memory leak in rvu_setup_hw_resources() If rvu_npc_exact_init() fails in rvu_setup_hw_resources(), the function returns directly instead of jumping to the error handling path. This causes a resource leak for the previously initialized CGX, NPC, fwdata, and MSI-X states. Fix this by replacing the direct return with goto cgx_err to ensure proper cleanup. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc6. An x86_64 allyesconfig build showed no new warnings. As we do not have access to Marvell OcteonTX2 RVU AF hardware to test with, no runtime testing was able to be performed. Fixes: 3571fe07a090 ("octeontx2-af: Drop rules for NPC MCAM") Cc: stable@vger.kernel.org Signed-off-by: Dawei Feng Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20260604143756.1524482-1-dawei.feng@seu.edu.cn Signed-off-by: Paolo Abeni commit f329e8325e054bd6d84d10904f8dd51137281b92 Author: Dmitry Osipenko Date: Thu Jun 4 15:27:43 2026 +0300 drm/virtio: Fix driver removal with disabled KMS DRM atomic and modesetting aren't initialized if virtio-gpu driver built with disabled KMS, leading to access of uninitialized data on driver removal/unbinding and crashing kernel. Fix it by skipping shutting down atomic core with unavailable KMS. Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support") Signed-off-by: Dmitry Osipenko Tested-by: Ryosuke Yasuoka Reviewed-by: Ryosuke Yasuoka Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.com commit 333b6d5bb9f87827ac2639c737bf9613dbae7253 Author: David Howells Date: Thu Jun 4 12:46:00 2026 +0100 rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't. Fixes: d57a3a151660 ("rxrpc: Save last ACK's SACK table rather than marking txbufs") Reported-by: Michael Bommarito Link: https://lore.kernel.org/r/20260513180907.2061972-1-michael.bommarito@gmail.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org cc: stable@kernel.org Link: https://patch.msgid.link/105362.1780573560@warthog.procyon.org.uk Signed-off-by: Paolo Abeni commit 19440600e729d4f74a42591a872099cf25c7d28a Author: Chih Kai Hsu Date: Thu Jun 4 17:22:47 2026 +0800 r8152: handle the return value of usb_reset_device() If usb_reset_device() returns a negative error code, stop the process of probing. Fixes: 10c3271712f5 ("r8152: disable the ECM mode") Signed-off-by: Chih Kai Hsu Reviewed-by: Hayes Wang Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260604092247.27158-450-nic_swsd@realtek.com Signed-off-by: Paolo Abeni commit 695fcefd4a81466ef9c529790b4e96f1ea2ba051 Author: Carlos Song Date: Wed May 20 17:33:23 2026 +0800 i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan() The LPI2C driver requests DMA channels using dma_request_chan(), but never releases them in lpi2c_imx_remove(), resulting in DMA channel leaks every time the driver is unloaded. Additionally, when lpi2c_dma_init() successfully requests the TX DMA channel but fails to request the RX DMA channel, the probe falls back to PIO mode and completes successfully. Since probe succeeds, the devres framework will not trigger any cleanup, leaving the TX DMA channel and the memory allocated for the dma structure held for the lifetime of the device even though DMA is never used. Switch to devm_dma_request_chan() to let the device core manage DMA channel lifetime automatically. Wrap all allocations within a devres group so that devres_release_group() can release all partially acquired resources when DMA init fails and probe continues in PIO mode. Fixes: a09c8b3f9047 ("i2c: imx-lpi2c: add eDMA mode support for LPI2C") Signed-off-by: Carlos Song Cc: # v6.14+ Reviewed-by: Frank Li Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260520093323.2882070-1-carlos.song@oss.nxp.com commit 9c648f3554920721d8878807cd794fe2d7f989e8 Merge: 2736a790528d91 6fc5666aa576c6 Author: Arnd Bergmann Date: Tue Jun 9 09:16:25 2026 +0200 Merge tag 'v7.1-rockchip-arm32fixe' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes A change in 7.1-rc improved the general handling for reset controllers using SRCU, but at the same time broke really early users before work- queues are available. So adapt the SMP bringup to keep the core-resets around, instead of aquiring/releasing them on ever SMP action. * tag 'v7.1-rockchip-arm32fixe' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: rockchip: keep reset control around Signed-off-by: Arnd Bergmann commit 2736a790528d916df3d1a9efc15bfd7698cc748d Merge: 7fd2df204f342f 75ef233975589d Author: Arnd Bergmann Date: Tue Jun 9 09:15:49 2026 +0200 Merge tag 'riscv-soc-fixes-for-v7.1-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes RISC-V soc fixes for v7.1-rc7 Microchip: Fix a resource leak in an unlikely probe failure case. Signed-off-by: Conor Dooley * tag 'riscv-soc-fixes-for-v7.1-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: soc: microchip: mpfs-sys-controller: fix resource leak on probe error Signed-off-by: Arnd Bergmann commit 2673cefa99ca918e7ac5b0388ff578a83656c896 Author: Nikita Zhandarovich Date: Fri May 29 17:57:58 2026 +0300 drm/i915/edp: Check supported link rates DPCD read intel_edp_set_sink_rates() reads DP_SUPPORTED_LINK_RATES into a local stack array and then parses the array unconditionally. If the read fails, the array contents are not valid and may result in bogus sink link rates being used. Use drm_dp_dpcd_read_data() and clear the sink rate array on failure, so the existing parser falls back to the default sink rate handling. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 68f357cb7347 ("drm/i915/dp: generate and cache sink rate array for all DP, not just eDP 1.4") Signed-off-by: Nikita Zhandarovich Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260529145759.1640646-1-n.zhandarovich@fintech.ru Signed-off-by: Jani Nikula (cherry picked from commit bd61c7756b34157e093028225a69383b4b1203cc) Signed-off-by: Tvrtko Ursulin commit d9faef564438d1e4579c692c046603e7ada7bdf4 Author: Andrzej Kacprowski Date: Mon Jun 1 18:16:43 2026 +0200 accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast to signed int before being used in min_t(). Large unsigned values (>= 0x80000000) become negative, causing unsigned wraparound and oversized memcpy operations that can overflow the stack buffer. Change min_t(int, ...) to min() as both values are unsigned and can be handled by min() without explicit cast. Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done messages") Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: Andrzej Kacprowski Reviewed-by: Karol Wachowski Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260601161643.229342-1-andrzej.kacprowski@linux.intel.com commit ee30dd2909d8b98619f4341c70ec8dc8e155ab02 Author: Adrian Moreno Date: Thu Jun 4 14:19:46 2026 +0200 net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch in the "Fixes" tag, the allocation of the "reply" skb can happen either before or after locking the ovs_mutex. However, error cleanups still follow the classical reversed order, assuming "reply" is allocated before locking: it is freed after unlocking. If "reply" allocation happens after locking the mutex and it fails, "reply" is left with an ERR_PTR, and execution jumps to the correspondent cleanup stage which will try to free an invalid pointer. Fix this by setting the pointer to NULL after having saved its error value. Fixes: 893f139b9a6c ("openvswitch: Minimize ovs_flow_cmd_new|set critical sections.") Signed-off-by: Adrian Moreno Reviewed-by: Aaron Conole Acked-by: Eelco Chaudron Link: https://patch.msgid.link/20260604121946.942164-1-amorenoz@redhat.com Signed-off-by: Jakub Kicinski commit f0e42f0c4337b1f220de1ddd63f47197c7dee4de Author: Kyle Zeng Date: Fri Jun 5 00:34:48 2026 -0700 ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb. Fixes: 14909664e4e1 ("sit: Setup and TX path for sit/UDP foo-over-udp encapsulation") Signed-off-by: Kyle Zeng Reviewed-by: Eric Dumazet Reported-by: syzbot+6eb9ca986d80f6f88cf9@syzkaller.appspotmail.com Link: https://patch.msgid.link/20260605073448.6524-1-kylebot@openai.com Signed-off-by: Jakub Kicinski commit a7767290e77ca2e926b49f8bfa29daa12262c612 Author: Fushuai Wang Date: Fri Jun 5 18:21:12 2026 +0800 net/mlx5: Use effective affinity mask for IRQ selection When a sf is created after a CPU has been taken offline, the IRQ pool may contain IRQs with affinity masks that include the offline CPU. Since only online CPUs should be considered for IRQ placement, cpumask_subset() check would fail because the iter_mask contains offline CPUs that are not present in req_mask, causing sf creation to fail. This is an example: 1. When mlx5 driver loads, it initializes the IRQ pools. For sf_ctrl_pool with ≤64 sf: - xa_num_irqs = {N, N} (There is only one slot) 2. When the first SF is created: - The ctrl IRQ is allocated with mask=cpu_online_mask={0-191} 2. We take CPU 20 offline 3. Existing ctl irq still have mask={0-191} 4. Create a new SF: - req_mask={0-19,21-191} - iter_mask={0-191} - {0-191} is NOT a subset of {0-19,21-191} - least_loaded_irq=NULL 5. Try to allocate a new irq via irq_pool_request_irq() 6. xa_alloc() fails because the pool is full(There is only one slot) 7. sf creation fails with error Use irq_get_effective_affinity_mask() instead, which returns the IRQ's actual effective affinity that already excludes offline CPUs. Fixes: 061f5b23588a ("net/mlx5: SF, Use all available cpu for setting cpu affinity") Suggested-by: Shay Drory Signed-off-by: Fushuai Wang Reviewed-by: Shay Drory Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260605102112.91772-1-fushuai.wang@linux.dev Signed-off-by: Jakub Kicinski commit b69004f5a6ad32da84d8aa5b23b9c0caafe6252e Author: Dragos Tatulea Date: Thu Jun 4 16:54:46 2026 +0300 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure In the XSK branch of mlx5e_xmit_xdp_buff(), when sq->xmit_xdp_frame() returns false (e.g. XDPSQ is full), the function returns without unmapping the DMA address or freeing the xdp_frame allocated by xdp_convert_zc_to_xdp_frame(). The xdpi_fifo push only happens on success, so the completion path cannot recover these entries. With CONFIG_DMA_API_DEBUG=y, the leak surfaces on driver unbind: DMA-API: pci 0000:08:00.0: device driver has pending DMA allocations while released from device [count=1116] One of leaked entries details: [device address=0x000000010ffd7028] [size=1534 bytes] [mapped with DMA_TO_DEVICE] [mapped as phy] WARNING: kernel/dma/debug.c:881 at dma_debug_device_change+0x127/0x180 ... DMA-API: Mapped at: debug_dma_map_phys+0x4b/0xd0 dma_map_phys+0xfd/0x2d0 mlx5e_xdp_handle+0x5ae/0xac0 [mlx5_core] mlx5e_xsk_skb_from_cqe_mpwrq_linear+0xc4/0x170 [mlx5_core] mlx5e_handle_rx_cqe_mpwrq+0xc1/0x290 [mlx5_core] Add the missing unmap + xdp_return_frame, matching the cleanup already done in mlx5e_xdp_xmit(). has_frags is rejected earlier in this branch, so no per-frag unmap is needed. Fixes: 84a0a2310d6d ("net/mlx5e: XDP_TX from UMEM support") Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260604135446.456119-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 894e036a24a26a6dd7b17d8d3fb5c53ab48a6074 Author: Dragos Tatulea Date: Thu Jun 4 16:58:49 2026 +0300 net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using the PF's log_max_current_uc/mc_list capabilities. When querying a VF vport with a larger configured max (via devlink), the firmware response can overflow this buffer: BUG: KASAN: slab-out-of-bounds in mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core] Read of size 4 at addr ff1100013ffc8a12 by task kworker/u96:2/385 CPU: 12 UID: 0 PID: 385 Comm: kworker/u96:2 Not tainted 7.0.0-rc6+ #1 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) Workqueue: mlx5_esw_wq esw_vport_change_handler [mlx5_core] Call Trace: dump_stack_lvl+0x69/0xa0 print_report+0x176/0x4e4 kasan_report+0xc8/0x100 mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core] esw_update_vport_addr_list+0x2e3/0xda0 [mlx5_core] esw_vport_change_handle_locked+0xa1f/0x1060 [mlx5_core] esw_vport_change_handler+0x6a/0x90 [mlx5_core] process_one_work+0x87f/0x15e0 worker_thread+0x62b/0x1020 kthread+0x375/0x490 ret_from_fork+0x4dc/0x810 ret_from_fork_asm+0x11/0x20 Fix by querying the vport's own HCA caps to size the buffer correctly. Refactor the function to allocate and return the MAC list internally, removing the caller's dependency on knowing the correct max. Fixes: e16aea2744ab ("net/mlx5: Introduce access functions to modify/query vport mac lists") Signed-off-by: Dragos Tatulea Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260604135849.458060-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit a2171131ecda1ed61a594a1eb715e75fdad0fef5 Author: Mingyu Wang <25181214217@stu.xidian.edu.cn> Date: Thu Jun 4 14:48:01 2026 +0800 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the port is removed from the qrtr_ports XArray and before the RCU grace period elapses. This breaks the fundamental RCU update paradigm. It exposes a race window where a concurrent RCU reader (such as qrtr_reset_ports() or qrtr_port_lookup()) can obtain a pointer to the socket from the XArray, and attempt to call sock_hold() on a socket whose reference count has already dropped to zero. This exact race condition was hit during syzkaller fuzzing, leading to the following refcount saturation warning and a potential Use-After-Free: refcount_t: saturated; leaking memory. WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0 Modules linked in: qrtr(+) bochs drm_shmem_helper ... Call Trace: qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr] __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr] qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr] kernel_bind+0xe4/0x120 net/socket.c:3592 qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr] qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr] do_one_initcall+0xf5/0x5e0 init/main.c:1283 ... Fix this by deferring the reference count decrement until after the xa_erase() and the synchronize_rcu() complete. (Note: The v1 of this patch incorrectly replaced __sock_put() with sock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove() still hold a reference to the socket, so freeing the socket memory here would lead to a subsequent UAF in the caller. Thus, the __sock_put() is kept, but only repositioned to close the RCU race.) Fixes: bdabad3e363d ("net: Add Qualcomm IPC router") Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260604064801.1180388-1-w15303746062@163.com Signed-off-by: Jakub Kicinski commit 83fc67ccbd2339e1beb21c361a92c45b177cf9d7 Merge: c849de7d8757a7 5a0082ec20a05e Author: Jakub Kicinski Date: Mon Jun 8 17:43:29 2026 -0700 Merge branch 'net-phy-some-cleanups-following-phy_port-sfp' Maxime Chevallier says: ==================== net: phy: some cleanups following phy_port SFP While posting the v11 of phy_port netlink, sashiko found some pre-existing issues, and following the tentative fix, Nicolai found some more :) This is V3, with a re-ordering of the port/sfp cleanup, as well as a new patch (patch 3) that also reorders the phy_remove() path. ==================== Link: https://patch.msgid.link/20260604092819.723505-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 5a0082ec20a05ef2378410323a5089a8f1786f4a Author: Maxime Chevallier Date: Thu Jun 4 11:28:18 2026 +0200 net: phy: don't try to setup PHY-driven SFP cages when using genphy We don't have support for PHY-driver SFP cages with the genphy code. On top of that, it was found by sashiko that running sfp_bus_add_upstream() for genphy deadlocks, as for genphy the PHY probing runs under RTNL, which isn't the case for non-genphy drivers. This problem was reproduced, and does lead to a deadlock on RTNL. Before the blamed commit, the phy_sfp_probe() call was made by individual PHY drivers, so there was no way to get to the SFP probing path when using genphy. Let's therefore only run phy_sfp_probe when not using genphy. Reviewed-by: Nicolai Buchwitz Fixes: bad869b5e41a ("net: phy: Only rely on phy_port for PHY-driven SFP") Signed-off-by: Maxime Chevallier Link: https://patch.msgid.link/20260604092819.723505-5-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 4497f5028675b7e51c4aa59c3f4df01f29424277 Author: Maxime Chevallier Date: Thu Jun 4 11:28:17 2026 +0200 net: phy: Clean the phy_ports after unregistering the downstream SFP bus As reported by sashiko when looking a other patches, we need to ensure that the downstream SFP bus gets unregistered prior to destroying the phy_ports attached to a phy_device, as the SFP code may reference these ports. Let's make sure we follow that ordering in phy_remove(). Fixes: 589e934d2735 ("net: phy: Introduce PHY ports representation") Signed-off-by: Maxime Chevallier Reviewed-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260604092819.723505-4-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit b1e780bb37c641d8291c51d7b4bde33450d18fb4 Author: Maxime Chevallier Date: Thu Jun 4 11:28:16 2026 +0200 net: phy: remove phy ports upon probe failure When phy_probe fails, let's clean the phy_ports that were successfully added already. Suggested-by: Nicolai Buchwitz Reviewed-by: Nicolai Buchwitz Fixes: 589e934d2735 ("net: phy: Introduce PHY ports representation") Signed-off-by: Maxime Chevallier Link: https://patch.msgid.link/20260604092819.723505-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 48774e87bbaa0056819d4b52301e4692e50e3252 Author: Maxime Chevallier Date: Thu Jun 4 11:28:15 2026 +0200 net: phy: clean the sfp upstream if phy probing fails Sashiko reported that we don't call sfp_bus_del_upstream() in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling 'upstream' field, that may be used later on during SFP events. This issue existed before the generic phylib sfp support, back when drivers were calling phy_sfp_probe themselves. Reviewed-by: Nicolai Buchwitz Fixes: 298e54fa810e ("net: phy: add core phylib sfp support") Signed-off-by: Maxime Chevallier Link: https://patch.msgid.link/20260604092819.723505-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit c849de7d8757a7af801fc4a4058f71d481d367f2 Author: Jakub Kicinski Date: Fri Jun 5 18:21:24 2026 -0700 netdev: fix double-free in netdev_nl_bind_rx_doit() Sashiko flags that genlmsg_reply() always consumes the skb. The error path calls nlmsg_free(rsp) so we can't jump directly to it. Let's not unbind, just propagate the error to the user. This is the typical way of handling genlmsg_reply() failures. They shouldn't happen unless user does something silly like calling the kernel with an already-full rcvbuf. Reported-by: Sashiko Fixes: 170aafe35cb9 ("netdev: support binding dma-buf to netdevice") Reviewed-by: Bobby Eshleman Acked-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 71de0177b28da751f407581a4515cf4d762f6296 Author: Santosh Kalluri Date: Wed Jun 3 17:08:43 2026 -0700 net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same list can still hold a pointer to the object after it has been removed, leading to a slab-use-after-free. Use kfree_rcu(), matching the lifetime rule already used by phonet_address_del() for the same object type. Fixes: eeb74a9d45f7 ("Phonet: convert devices list to RCU") Cc: stable@vger.kernel.org Signed-off-by: Santosh Kalluri Acked-by: Rémi Denis-Courmont Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit a0130d682222ae21afc395aead7cd2d87e1a8358 Author: Rosen Penev Date: Wed Jun 3 15:12:17 2026 -0700 net: ibm: emac: Fix use-after-free during device removal The driver was using devm_register_netdev() which causes unregister_netdev() to be deferred until the devres cleanup phase, which runs after emac_remove() returns. This creates a use-after-free window where: 1. emac_remove() is called, which tears down hardware (cancels work, detaches modules, unregisters from MAL) 2. emac_remove() returns 3. devres cleanup runs and finally calls unregister_netdev() During step 3, the network stack might still process packets, triggering emac_irq(), emac_poll(), or other handlers that access now-freed hardware resources (dev->emacp, dev->mal, etc.). Fix this by replacing devm_register_netdev() with manual register_netdev() and calling unregister_netdev() at the beginning of emac_remove(), before any hardware teardown. This ensures the network device is fully stopped and unregistered before hardware resources are released. The change is safe because: - dev->ndev is assigned very early in probe (before any error paths that could bypass emac_remove) - platform_set_drvdata() is only called after successful registration, so emac_remove() only runs for fully registered devices - unregister_netdev() is idempotent and safe to call on any registered device Fixes: a4dd8535a527 ("net: ibm: emac: use devm for register_netdev") Signed-off-by: Rosen Penev Reviewed-by: Jacob Keller Signed-off-by: Jakub Kicinski commit 2365343f4aad3e1b1e7a2e87e98cf66d5e590589 Author: Yao Sang Date: Wed Jun 3 14:10:44 2026 +0800 net/mlx4: avoid GCC 10 __bad_copy_from() false positive mlx4_init_user_cqes() fills a scratch buffer with the CQE initialization pattern and then copies from that buffer to userspace. In the single-copy path, the copy length is array_size(entries, cqe_size), but the scratch buffer is allocated with PAGE_SIZE. GCC 10 does not carry the branch invariant strongly enough through the object size checks and falsely triggers __bad_copy_from(). Size the scratch buffer to the actual copy length for the active path, keep array_size() for the single-copy case, and retain a WARN_ON_ONCE() guard for the PAGE_SIZE invariant before allocating the buffer. Fixes: f69bf5dee7ef ("net/mlx4: Use array_size() helper in copy_to_user()") Signed-off-by: Yao Sang Reviewed-by: Jacob Keller Signed-off-by: Jakub Kicinski commit f2bb3434544454099a5b6dec213567267b05d79d Author: HanQuan Date: Thu Jun 4 14:46:25 2026 +0000 net: add pskb_may_pull() to skb_gro_receive_list() skb_gro_receive_list() calls skb_pull(skb, skb_gro_offset(skb)) without first ensuring the data is in the linear area via pskb_may_pull(). When the skb arrives via napi_gro_frags(), skb_headlen can be 0 (all data in page fragments) while skb_gro_offset is non-zero (after IP+TCP header parsing). The skb_pull() then decrements skb->len by skb_gro_offset but skb->data_len stays unchanged, hitting BUG_ON(skb->len < skb->data_len) in __skb_pull(). The UDP fraglist GRO path already contains this guard at udp_offload.c:749. Adding it to skb_gro_receive_list() itself provides centralized protection for all callers (TCP, UDP, and any future protocols), and ensures the precondition of skb_pull() is satisfied before it is called. On pskb_may_pull() failure, set NAPI_GRO_CB(skb)->flush = 1 so the skb is not held as a new GRO head and is instead delivered through the normal receive path, matching the UDP handling. Fixes: 8d95dc474f85 ("net: add code for TCP fraglist GRO") Reported-by: HanQuan Reported-by: MingXuan Signed-off-by: HanQuan Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit 5d39580f68e6ddeedd15e587282207489dfb3da2 Author: Eric Dumazet Date: Fri Jun 5 11:21:34 2026 +0000 tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets to users with CAP_NET_ADMIN capability. This blocks potential side-channel attack where an unprivileged application attaches a filter to leak TCP sequence/acknowledgment numbers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reported-by: Tamir Shahar Reported-by: Amit Klein Cc: Willem de Bruijn Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Andrii Nakryiko Cc: Martin KaFai Lau Cc: Eduard Zingerman Cc: Kumar Kartikeya Dwivedi Cc: Song Liu Cc: Yonghong Song Cc: Jiri Olsa Cc: John Fastabend Cc: Stanislav Fomichev Acked-by: Daniel Borkmann Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Kicinski commit 498cc8f0a93b3e71d186e30d1b93b6f3eca96738 Author: Andi Shyti Date: Mon Jun 8 14:49:03 2026 +0200 MAINTAINERS: i2c: designware: Remove inactive reviewer Emails to Jan Dabros bounce with a permanent failure due to an inactive account. Remove him from the list of reviewers. Signed-off-by: Andi Shyti Signed-off-by: Wolfram Sang commit 656646b3847ac6a21b074a813223feef2aadd6e2 Author: Akhil R Date: Mon May 18 17:10:13 2026 +0530 i2c: tegra: Fix NOIRQ suspend/resume The Tegra I2C driver relies on runtime PM to wake up the controller before each transfer. However, runtime PM is disabled between the system suspend and NOIRQ suspend. If an I2C device initiates a transfer during this window, the I2C controller fails to wake up and the transfer fails. To handle this, the controller must be kept available for this period to allow transfers. Rework the I2C controller's system PM callbacks such that the controller is resumed from runtime suspend during system suspend and it stays RPM_ACTIVE throughout the suspend-resume cycle until it is runtime suspended back in the system resume. The clocks are disabled in NOIRQ suspend and enabled back in NOIRQ resume by calling the controller's runtime PM functions directly. Fixes: 8ebf15e9c869 ("i2c: tegra: Move suspend handling to NOIRQ phase") Assisted-by: Cursor:claude-4.6-opus Signed-off-by: Akhil R Cc: # v5.4+ Reviewed-by: Jon Hunter Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260518114013.62065-5-akhilrajeev@nvidia.com commit 97d0a9c6e80903d342656ab8a7743a9ec50c92e1 Author: Akhil R Date: Mon May 18 17:10:12 2026 +0530 i2c: tegra: Update Tegra410 I2C timing parameters Update Tegra410 I2C timing parameters based on hardware characterization results. This adjusts the fast mode and HS mode settings to be compliant with the I2C specification. Fixes: 59717f260183 ("i2c: tegra: Add support for Tegra410") Signed-off-by: Akhil R Reviewed-by: Jon Hunter Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260518114013.62065-4-akhilrajeev@nvidia.com commit 3f26bb732cc136ab20176697c92f32c9c84cb125 Author: Wentao Liang Date: Sun Jun 7 09:03:03 2026 +0000 drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() dma_fence_unwrap_for_each() internally calls dma_fence_unwrap_first() which does cursor->chain = dma_fence_get(head), taking an extra reference. On normal loop completion, dma_fence_unwrap_next() releases this via dma_fence_chain_walk() -> dma_fence_put(). When virtio_gpu_do_fence_wait() fails and the function returns early from inside the loop, the cursor->chain reference is never released. This is the only caller in the entire kernel that does an early return inside dma_fence_unwrap_for_each. Add dma_fence_put(itr.chain) before the early return. Cc: stable@vger.kernel.org Fixes: eba57fb5498f ("drm/virtio: Wait for each dma-fence of in-fence array individually") Signed-off-by: Wentao Liang Reviewed-by: Dmitry Osipenko Signed-off-by: Dmitry Osipenko Link: https://patch.msgid.link/20260607090303.92423-1-vulab@iscas.ac.cn commit 729ac5a4b966aac42e08a94dea966f4429008548 Author: Vladimir Zapolskiy Date: Sat May 16 02:41:18 2026 +0300 i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() On all modern platforms Qualcomm CCI controller provides two I2C masters, and on particular boards only one I2C master may be initialized, and in such cases the device unbinding or driver removal causes a NULL pointer dereference, because cci_halt() is called for all two I2C masters, but a completion is initialized only for the single enabled master: % rmmod i2c-qcom-cci Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: __wait_for_common+0x194/0x1a8 (P) wait_for_completion_timeout+0x20/0x2c cci_remove+0xc4/0x138 [i2c_qcom_cci] platform_remove+0x20/0x30 device_remove+0x4c/0x80 device_release_driver_internal+0x1c8/0x224 driver_detach+0x50/0x98 bus_remove_driver+0x6c/0xbc driver_unregister+0x30/0x60 platform_driver_unregister+0x14/0x20 qcom_cci_driver_exit+0x18/0x1008 [i2c_qcom_cci] .... Fixes: e517526195de ("i2c: Add Qualcomm CCI I2C driver") Signed-off-by: Vladimir Zapolskiy Cc: # v5.8+ Reviewed-by: Konrad Dybcio Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260515234121.1607425-2-vladimir.zapolskiy@linaro.org commit a124579c0763da7bc408f4cd7e8f606cadc94855 Author: Guillermo Rodríguez Date: Tue May 26 11:12:09 2026 +0200 i2c: stm32f7: fix timing computation ignoring i2c-analog-filter stm32f7_i2c_compute_timing() uses i2c_dev->analog_filter to pick the analog filter delay, but i2c_dev->analog_filter is parsed from the "i2c-analog-filter" DT property only after the compute_timing loop in stm32f7_i2c_setup_timing(), so in practice the timing calculations always ignore the analog filter. On an STM32MP1 board with clock-frequency = <400000> and i2c-analog-filter set, measured SCL frequency was ~382 kHz. This also affects (widens) the computed SDADEL range. At high bus clock speeds, this can select an SDADEL value that violates tVD;DAT (data valid time). Fix by parsing "i2c-analog-filter" before the compute_timing loop. Fixes: 83c3408f7b9c ("i2c: stm32f7: support DT binding i2c-analog-filter") Signed-off-by: Guillermo Rodríguez Cc: # v5.13+ Acked-by: Alain Volmat Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260526091210.20383-1-guille.rodriguez@gmail.com commit 7d3fb78b550301e43fdc60312aed733069694426 Author: Richard Fitzgerald Date: Thu Jun 4 11:12:44 2026 +0100 ASoC: wm_adsp: Fix NULL dereference when removing firmware controls In wm_adsp_control_remove() check that the priv pointer is not NULL before attempting to cleanup what it points to. When cs_dsp creates a control it calls wm_adsp_control_add_cb() so that wm_adsp can create its own private control data. There are two cases where private data is not created: 1. The control is a SYSTEM control, so an ALSA control is not created. 2. The codec driver has registered a control_add() callback that hides the control, so wm_adsp_control_add() is not called. When cs_dsp_remove destroys its control list it calls wm_adsp_control_remove() for each control. But wm_adsp_control_remove() was attempting to cleanup the private data pointed to by cs_ctl->priv without checking the pointer for NULL. Signed-off-by: Richard Fitzgerald Fixes: 0700bc2fb94c ("ASoC: wm_adsp: Separate generic cs_dsp_coeff_ctl handling") Link: https://patch.msgid.link/20260604101244.1402862-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 8783fb8031799f1230997c16df8c8dce9fcd1841 Author: Carlos Song Date: Thu May 21 14:50:38 2026 +0800 i2c: imx: fix clock and pinctrl state inconsistency in runtime PM In i2c_imx_runtime_suspend(), the clock is disabled before switching the pinctrl state to sleep. If pinctrl_pm_select_sleep_state() fails, the runtime suspend is aborted but the clock remains disabled, causing a system crash when the hardware is subsequently accessed. Fix this by switching the pinctrl state before disabling the clock so that a pinctrl failure leaves the clock enabled and the hardware accessible. In i2c_imx_runtime_resume(), restore the pinctrl state back to sleep if clk_enable() fails to keep the consistent. Fixes: 576eba03c994 ("i2c: imx: switch different pinctrl state in different system power status") Signed-off-by: Carlos Song Cc: # v6.14+ Reviewed-by: Frank Li Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260521065038.2954998-1-carlos.song@oss.nxp.com commit 1f57f68c4dd101e5e8ffc9ffa6428f45bcdd776a Author: Heiko Carstens Date: Fri Jun 5 17:32:06 2026 +0200 s390: Remove GENERIC_LOCKBREAK Kconfig option s390 selects GENERIC_LOCKBREAK if PREEMPT is enabled. Reason is a historic 18 years old commit [1] which fixed a compile error for PREEMPT enabled kernels. Back than only PREEMPT_NONE and PREEMPT_VOLUNTARY kernels were considered to be important for s390. PREEMPT should "just work". However, since recently PREEMPT is always enabled [2], which also causes GENERIC_LOCKBREAK to be always enabled. For some workloads this leads to massive performance degradation; e.g. a simple kernel compile on machines with many CPUs may take up to four times longer. To fix this just remove the GENERIC_LOCKBREAK from s390's Kconfig, since the compile error from 18 years ago does not exist anymore. [1] commit b6b40c532a36 ("[S390] Define GENERIC_LOCKBREAK.") [2] commit 7dadeaa6e851 ("sched: Further restrict the preemption modes") Cc: stable@vger.kernel.org Reported-by: Massimiliano Pellizzer Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 13e91fd076306f5d0cdfa14f53d69e37274723c4 Author: Michael Bommarito Date: Tue Jun 2 18:04:57 2026 -0400 RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them. Fixes: aef9ec39c47f ("IB: Add SCSI RDMA Protocol (SRP) initiator") Link: https://patch.msgid.link/r/20260602220457.2542840-1-michael.bommarito@gmail.com Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Reviewed-by: Bart Van Assche Signed-off-by: Jason Gunthorpe commit 29e7b925ae6df64894e82ab6419994dc25580a8a Author: Michael Bommarito Date: Tue Jun 2 15:46:42 2026 -0400 IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added. Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver") Link: https://patch.msgid.link/r/20260602194642.2273217-1-michael.bommarito@gmail.com Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Signed-off-by: Jason Gunthorpe commit badad6fad60def1b9805559dd81dbab3d97b82aa Author: Jason Gunthorpe Date: Thu Jun 4 15:03:13 2026 -0300 RDMA: During rereg_mr ensure that REREG_ACCESS is compatible If IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be re-evaluated to ensure it is properly pinned as RW. Since the umem is hidden inside each driver's mr struct add a ib_umem_check_rereg() function that each driver has to call before processing IB_MR_REREG_ACCESS. mlx4 has to retain its duplicate ib_access_writable check because it implements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items in place sequentially while the MR is live, so it will continue to not support this combination. Cc: stable@vger.kernel.org Fixes: b40656aa7d55 ("RDMA/umem: remove FOLL_FORCE usage") Link: https://patch.msgid.link/r/0-v1-06fb1a2d6cf5+107-rereg_access_jgg@nvidia.com Reported-by: Philip Tsukerman Signed-off-by: Jason Gunthorpe commit 9c37eac31c559b079d55890d1dbe70072fec0435 Author: Wentao Liang Date: Mon Jun 8 07:11:23 2026 +0000 i2c: riic: fix refcount leak in riic_i2c_resume_noirq() When riic_i2c_resume_noirq() is called, it deasserts the reset using reset_control_deassert(), which for shared resets increments a reference count. If pm_runtime_force_resume() then fails, the function returns without calling reset_control_assert() to decrement the count. This leaves the reset deasserted and the reference count unbalanced, which can prevent other users of the shared reset from properly asserting it later. Fix the leak by calling reset_control_assert() on the error handling path for a failed pm_runtime_force_resume(). Fixes: e383f0961422 ("i2c: riic: Move suspend handling to NOIRQ phase") Signed-off-by: Wentao Liang Cc: # v6.19+ Reviewed-by: Geert Uytterhoeven Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260608071123.128964-1-vulab@iscas.ac.cn commit 2d3090a8aeb596a26935db0955d46c9a5db5c6ce Merge: e92a7628772ba4 ecf3edd349dfab Author: Linus Torvalds Date: Mon Jun 8 07:58:32 2026 -0700 Merge tag 'v7.1-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: - Fix random config build failure on s390. * tag 'v7.1-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: s390 - add select CRYPTO_AEAD for aes commit b9ad50d7505ebd48282ec3630258dc820fc85c81 Author: Yun Zhou Date: Mon Jun 8 16:43:34 2026 +0800 gpio: mvebu: fix NULL pointer dereference in suspend/resume mvebu_pwm_suspend() and mvebu_pwm_resume() are called for all GPIO banks during suspend/resume, but not all banks have PWM functionality. GPIO banks without PWM have mvchip->mvpwm set to NULL. Calling mvebu_pwm_suspend() with mvpwm == NULL causes a NULL pointer dereference when it tries to access mvpwm->blink_select. Unable to handle kernel NULL pointer dereference at virtual address 00000020 when write [00000020] *pgd=00000000 Internal error: Oops: 815 [#1] PREEMPT ARM Modules linked in: CPU: 0 UID: 0 PID: 406 Comm: sh Not tainted 6.12.74-rt12-yocto-standard-g4e96f98fb7db-dirty #353 Hardware name: Marvell Armada 370/XP (Device Tree) PC is at regmap_mmio_read+0x38/0x54 LR is at regmap_mmio_read+0x38/0x54 pc : [] lr : [] psr: 200f0013 sp : f0c11d10 ip : 00000000 fp : c100d2f0 r10: c14fb854 r9 : 00000000 r8 : 00000000 r7 : c1799c00 r6 : 00000020 r5 : 00000020 r4 : c179c7c0 r3 : f0a231a0 r2 : 00000020 r1 : 00000020 r0 : 00000000 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 135ec059 DAC: 00000051 Call trace: regmap_mmio_read from _regmap_bus_reg_read+0x78/0xac _regmap_bus_reg_read from _regmap_read+0x60/0x154 _regmap_read from regmap_read+0x3c/0x60 regmap_read from mvebu_gpio_suspend+0xa4/0x14c mvebu_gpio_suspend from dpm_run_callback+0x54/0x180 dpm_run_callback from device_suspend+0x124/0x630 device_suspend from dpm_suspend+0x124/0x270 dpm_suspend from dpm_suspend_start+0x64/0x6c dpm_suspend_start from suspend_devices_and_enter+0x140/0x8e8 suspend_devices_and_enter from pm_suspend+0x2fc/0x308 pm_suspend from state_store+0x6c/0xc8 state_store from kernfs_fop_write_iter+0x10c/0x1f8 kernfs_fop_write_iter from vfs_write+0x270/0x468 vfs_write from ksys_write+0x70/0xf0 ksys_write from ret_fast_syscall+0x0/0x54 Add a NULL check for mvchip->mvpwm before calling the PWM suspend/resume functions. Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support") Signed-off-by: Yun Zhou Link: https://patch.msgid.link/20260608084334.2960803-1-yun.zhou@windriver.com Signed-off-by: Bartosz Golaszewski commit e92a7628772ba49f3cdc1d141cd2b0b5d607bda2 Merge: 4549871118cf61 98e0fc32e53dd6 Author: Linus Torvalds Date: Mon Jun 8 07:31:41 2026 -0700 Merge tag 'hyperv-fixes-signed-20260607' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - MSHV driver fixes from various people (Anirudh Rayabharam, Can Peng, Dexuan Cui, Michael Kelley, Jork Loeser, Wei Liu) - Hyper-V user space tools fixes (Thorsten Blum) - Allow VMBus to be unloaded after frame buffer is flushed (Michael Kelley) * tag 'hyperv-fixes-signed-20260607' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv: support 1G hugepages by passing them as 2M-aligned chunks Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs mshv: use kmalloc_array in mshv_root_scheduler_init mshv: Add conditional VMBus dependency hyperv: Clean up and fix the guest ID comment in hvgdk.h drm/hyperv: During panic do VMBus unload after frame buffer is flushed Drivers: hv: vmbus: Provide option to skip VMBus unload on panic mshv: unmap debugfs stats pages on kexec mshv: clean up SynIC state on kexec for L1VH mshv: limit SynIC management to MSHV-owned resources hv: utils: replace deprecated strcpy with strscpy in kvp_register hv: utils: handle and propagate errors in kvp_register mshv: add a missing padding field commit 6100a82e34cb75571feba920a9c18f60698d598a Merge: df488cac6140aa 5629eec1a28298 Author: Rafael J. Wysocki Date: Mon Jun 8 15:20:04 2026 +0200 Merge tag 'amd-pstate-v7.1-2026-06-02' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Pull amd-pstate fixes for 7.1 (2026-06-02) from Mario Limonciello: "* Fix a kdoc issue * Fix an issue setting performance state in EPP mode introduced earlier in the cycle from new 7.1 content" * tag 'amd-pstate-v7.1-2026-06-02' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: cpufreq/amd-pstate: Fix setting EPP in performance mode cpufreq/amd-pstate: drop stale @epp_cached kdoc commit 96d47e40bf9db4a9efd5c8fb53287a508d165f14 Author: HyeongJun An Date: Mon Jun 8 18:09:26 2026 +0900 USB: serial: kl5kusb105: fix bulk-out buffer overflow klsi_105_prepare_write_buffer() is called by the generic write path with the bulk-out buffer and its size (bulk_out_size, 64 bytes). It stores a two-byte length header at the start of the buffer and copies the payload from the write fifo starting at buf + KLSI_HDR_LEN, but passes the full buffer size as the number of bytes to copy: count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, size, &port->lock); When the fifo holds at least size bytes, size bytes are copied starting two bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its end. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for the header as safe_serial already does. Writing bulk_out_size or more bytes to the tty triggers a slab out-of-bounds write, observed with KASAN by emulating the device with dummy_hcd and raw-gadget: BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0 Write of size 64 at addr ffff888112c62202 by task python3 kfifo_copy_out klsi_105_prepare_write_buffer [kl5kusb105] usb_serial_generic_write_start [usbserial] Allocated by task 139: usb_serial_probe [usbserial] The buggy address is located 2 bytes inside of allocated 64-byte region The out-of-bounds write no longer occurs with this change applied. Fixes: 60b3013cdaf3 ("USB: kl5usb105: reimplement using generic framework") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An Signed-off-by: Johan Hovold commit b3f240cca1ec061afa1224b3a6e3b473b5b4f3e1 Merge: 4549871118cf61 4eb422482ca5d9 Author: Wolfram Sang Date: Mon Jun 8 09:47:50 2026 +0200 Merge tag 'rust-i2c-7.1-rc7' of https://github.com/ikrtn/linux into i2c/for-current rust: i2c: fix I2cAdapter refcount double increment commit 2aaaf5931b16938a017b7db51b8d9fadad857adc Merge: 4549871118cf61 2eeb342aff6647 Author: Dave Airlie Date: Mon Jun 8 15:53:32 2026 +1000 Merge tag 'amd-drm-fixes-7.1-2026-06-04' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.1-2026-06-04: amdgpu: - UserQ fix - Userptr fix - MCCS freesync fix amdkfd: - Fix an event information leak - Events bounds check fix - Trap cleanup fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260604230955.19629-1-alexander.deucher@amd.com commit 4549871118cf616eecdd2d939f78e3b9e1dddc48 Author: Linus Torvalds Date: Sun Jun 7 15:37:58 2026 -0700 Linux 7.1-rc7 commit 29fe1bd01b99714f3136f922230a643c2742cda9 Author: Christian A. Ehrhardt Date: Sat Jun 6 22:11:20 2026 +0200 io_uring/wait: fix min_timeout behavior The wakeup condition if a min timeout is present and has expired is that at least _one_ CQE was posted. Thus set the cq_tail target to ->cq_min_tail + 1. Without this commit a spurious wakeup can result in a premature wakeup because io_should_wake() will return true even if _no_ CQE was posted at all. Cc: Tip ten Brink Fixes: e15cb2200b93 ("io_uring: fix min_wait wakeups for SQPOLL") Cc: stable@vger.kernel.org Signed-off-by: Christian A. Ehrhardt Link: https://patch.msgid.link/20260606201120.1441447-1-lk@c--e.de Signed-off-by: Jens Axboe commit 70f4886bcbb929e88038c8807f1daf7fc587ae7c Author: Jens Axboe Date: Sun Jun 7 16:05:47 2026 -0600 io_uring/kbuf: don't truncate end buffer for bundles If buffers have been peeked for a bundle receive, the kernel will truncate the end buffer, if the available length is shorter than the buffer itself. This is unnecessary, as applications iterating bundle receives must always use the minimum size of the buffer length and the remaining number of bytes in the bundle. The examples in liburing do that as well, eg examples/proxy.c. If the kernel does truncate this buffer AND the current transfer fails, then the buffer will be left with a smaller size than what is otherwise available. Just remove the buffer truncation, as it's not necessary in the first place. Link: https://lore.kernel.org/io-uring/CAAEr8jbY60noGj1fw_k91UJRBkyiRVoS6=nLhZ7Svwidjn4CAA@mail.gmail.com/ Reported-by: Federico Brasili Cc: stable@vger.kernel.org Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers") Signed-off-by: Jens Axboe commit c68691dc1dcacbdaaef04edcf7639ce68e3eb58c Merge: 09feffa073d8a5 6f6947b2387e94 Author: Linus Torvalds Date: Sun Jun 7 13:12:29 2026 -0700 Merge tag 'x86-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Add more AMD Zen6 models (Pratik Vishwakarma) - Avoid confusing bootup message by the Intel resctl enumeration code when running on certain AMD systems (Tony Luck) * tag 'x86-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Only check Intel systems for SNC x86/CPU/AMD: Add more Zen6 models commit 09feffa073d8a5362739ecf0509c29ca7f6d9991 Merge: 77e8e6861bc000 d486b4934a8e50 Author: Linus Torvalds Date: Sun Jun 7 13:02:02 2026 -0700 Merge tag 'timers-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Ingo Molnar: - Fix the arch_inlined_clockevent_set_next_coupled() prototype in the !CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST case (Naveen Kumar Chaudhary) - Fix an off-by-1 bug in the sys_settimeofday() usecs validation code (Naveen Kumar Chaudhary) - Mark vdso_k_*_data pointers as __ro_after_init (Thomas Weißschuh) - Fix livelock race in tmigr_handle_remote_up() (Amit Matityahu) * tag 'timers-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timers/migration: Fix livelock in tmigr_handle_remote_up() vdso/datastore: Mark vdso_k_*_data pointers as __ro_after_init time: Fix off-by-one in settimeofday() usec validation clockevents: Fix duplicate type specifier in stub function parameter commit 77e8e6861bc000b90ad37b4cceccbe0da5f4fc6a Merge: 96c1ddbc16f4dd 6d99479799c69c Author: Linus Torvalds Date: Sun Jun 7 12:54:37 2026 -0700 Merge tag 'sched-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull rseq fix from Ingo Molnar: - Fix uninitialized stack variable in rseq_exit_user_update() (Qing Wang) * tag 'sched-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() commit 96c1ddbc16f4dd15d6d359ce55ba29e8cd80dc46 Merge: e2264c52e18bd5 40a25d59e85b3c Author: Linus Torvalds Date: Sun Jun 7 12:43:21 2026 -0700 Merge tag 'locking-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Ingo Molnar: - Fix a NULL pointer dereference bug in the FUTEX_CMP_REQUEUE_PI code (Ji'an Zhou) - Fix a NULL pointer dereference bug in the rtmutex code (Davidlohr Bueso) * tag 'locking-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock commit e2264c52e18bd54a4f762c393e341cb27fd5e5cd Merge: 33d8d8ec31b591 29d87434cb91b7 Author: Linus Torvalds Date: Sun Jun 7 12:39:36 2026 -0700 Merge tag 'regulator-fix-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "Arnd's randconfig testing turned up a missing selection of CONFIG_IRQ_DOMAIN which was causing build breaks" * tag 'regulator-fix-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: mt6363: select CONFIG_IRQ_DOMAIN commit 33d8d8ec31b591952ded59d596c2f3db45004937 Merge: 979c294509f924 fb402386af4cdc Author: Linus Torvalds Date: Sun Jun 7 08:40:53 2026 -0700 Merge tag 'input-for-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - two quirks for atkbd to deal with laptops that can not handle "deactivate" command on the keyboard PS/2 port * tag 'input-for-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) commit 053a401b592be424fea9d57c789f66cd5d8cec11 Author: Takashi Iwai Date: Sat Jun 6 18:11:41 2026 +0200 ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter. Reported-by: Kyle Zeng Tested-by: Kyle Zeng Cc: Link: https://patch.msgid.link/20260606161145.1933447-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit da3039e91d1f835874ed6e9a33ea19ee80c2cb92 Author: Takashi Iwai Date: Sat Jun 6 18:11:40 2026 +0200 ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tries to unlink all instances and just set NULL to each ti->timer, then releases the resources immediately. The problem is, however, when there are slave timer instances that are associated with a master instance linked to this timer: namely, those slave instances still point to the freed timer object although the master instance is unlinked, which may lead to user-after-free. The bug can be easily triggered particularly when a new userspace-driven timers (CONFIG_SND_UTIMER) is involved, since it can create and delete the timer object via a simple file open/close, while the other applications may keep accessing to that timer. This patch is an attempt to paper over the problem above: now instead of just unlinking, call snd_timer_close[_locked]() forcibly for each pending timer instance, so that all assigned slave timer instances are properly detached, too. Since snd_timer_close() might be called later by the driver that created that instance, the check of SNDRV_TIMER_IFLG_DEAD is added at the beginning, too. Reported-by: Kyle Zeng Tested-by: Kyle Zeng Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260606161145.1933447-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 15b4155138505669d3d43d7692459ee8ea2a86e7 Author: Richard Patel Date: Mon May 18 18:39:18 2026 +0000 riscv: cfi: reject unknown flags in PR_SET_CFI prctl(PR_SET_CFI,PR_CFI_BRANCH_LANDING_PADS) silently ignored unknown control values. Only PR_CFI_{ENABLE,DISABLE,LOCK} should be permitted. This changes the behavior of the uABI (fails previously accepted bits with EINVAL). Fixes: 08ee1559052b ("prctl: cfi: change the branch landing pad prctl()s to be more descriptive") Signed-off-by: Richard Patel Link: https://patch.msgid.link/20260518183918.322545-1-ripatel@wii.dev [pjw@kernel.org: change the patch description to note that although this is a uABI change, it does not break the uABI] Signed-off-by: Paul Walmsley commit aad60bdd0b5a6dfa40454ab03ce658408eaf4615 Author: Nam Cao Date: Tue Apr 7 14:06:39 2026 +0200 riscv: Fix fast_unaligned_access_speed_key not getting initialized The static key fast_unaligned_access_speed_key is supposed to be initialized after check_unaligned_access_all_cpus() has been completed. However, check_unaligned_access_all_cpus() has been moved to late_initcall while setting fast_unaligned_access_speed_key still happens at arch_initcall_sync, thus the static key does not get properly initialized. fast_unaligned_access_speed_key can still be initialized in CPU hotplug events, but that cannot be relied on. Move fast_unaligned_access_speed_key's initialization into check_unaligned_access_all_cpus() to fix this issue. This also prevent someone from moving one initcall while forgetting the other in the future. Fixes: 6455c6c11827 ("riscv: Clean up & optimize unaligned scalar access probe") Reported-by: Michael Neuling Closes: https://lore.kernel.org/linux-riscv/CAEjGV6y0=bSLp_wrS0uHFj1S2TCRtz4GKzaU5O-L1VV-EL7Nnw@mail.gmail.com/ Signed-off-by: Nam Cao Link: https://patch.msgid.link/20260407120639.4006031-1-namcao@linutronix.de Signed-off-by: Paul Walmsley commit e3573f739e3dadab57ec80488d07e05c8f6e82d3 Author: Andreas Schwab Date: Fri May 22 00:34:30 2026 +0200 riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI Fixes a warning while dumping core: [54983.546369][ C7] WARNING: [!note_name] fs/binfmt_elf.c:1771 at elf_core_dump+0x910/0xf68, CPU#7: abort01/31982 Fixes: 2af7c9cf021c ("riscv/ptrace: expose riscv CFI status and state via ptrace and in core files") Signed-off-by: Andreas Schwab Link: https://patch.msgid.link/87y0hcxuh5.fsf@igel.home Signed-off-by: Paul Walmsley commit 979c294509f9248fe1e7c358d582fb37dd5ca12d Author: Nathan Chancellor Date: Thu Jun 4 17:33:21 2026 -0700 cfi: Include uaccess.h for get_kernel_nofault() After commit 0652a3daa787 ("tracing: Fix CFI violation in probestub being called by tprobes"), there are many build errors when building ARCH=arm multi_v7_defconfig + CONFIG_CFI=y like: In file included from drivers/base/devres.c:17: In file included from drivers/base/trace.h:16: In file included from include/linux/tracepoint.h:23: include/linux/cfi.h:44:6: error: call to undeclared function 'get_kernel_nofault'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 44 | if (get_kernel_nofault(hash, func - cfi_get_offset())) | ^ 1 error generated. get_kernel_nofault() is called in the generic version of cfi_get_func_hash() but nothing ensures uaccess.h is always included for a proper expansion and prototype. Include uaccess.h in cfi.h to clear up the errors. Cc: stable@vger.kernel.org Fixes: 0652a3daa787 ("tracing: Fix CFI violation in probestub being called by tprobes") Signed-off-by: Nathan Chancellor Acked-by: Masami Hiramatsu (Google) Reviewed-by: Sami Tolvanen Signed-off-by: Linus Torvalds commit fb402386af4cdce108ff991a796386de55439735 Author: Cryolitia PukNgae Date: Fri Jun 5 15:27:21 2026 +0800 Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard After commit 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID"), HONOR BCC-N, aka HONOR MagicBook 14 2026's internal keyboard stops working. Adding the atkbd_deactivate_fixup quirk fixes it. DMI: HONOR BCC-N/BCC-N-PCB, BIOS 1.04 04/07/2026 Fixes: 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID") Reported-by: Hongfei Ren Link: https://github.com/colorcube/Linux-on-Honor-Magicbook-14-Pro/issues/1#issuecomment-4562679891 Tested-by: Hongfei Ren Cc: stable@kernel.org Signed-off-by: Cryolitia PukNgae Link: https://patch.msgid.link/20260605-honor-v1-1-78e05e491193@linux.dev Signed-off-by: Dmitry Torokhov commit 6086121dc424b6906602617449f0445aeab00277 Merge: d054796f8bb7d0 2b5ff4db5d7aa5 Author: Linus Torvalds Date: Sat Jun 6 09:49:16 2026 -0700 Merge tag 'sound-7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "It's getting calmer, but we still came up with a handful of small fixes, including two core fixes. All look sane and safe. Core: - Fix wait queue list corruption in snd_pcm_drain() on linked streams - Fix UMP event stack overread in seq dummy driver USB-audio: - Add quirk for AB13X USB Audio - Fix the regression with sticky mixer volumes in 7.1-rc ASoC: - Fix 32-slot TDM breakage on Freescale SAI - Varioud DMI quirks for AMD ACP" * tag 'sound-7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: seq: dummy: fix UMP event stack overread ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams ASoC: amd: acp70: add standalone RT721 SoundWire machine ASoC: amd: yc: Add MSI Raider A18 HX A9WJG to quirk table ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write ASoC: amd: yc: Enable internal mic on MSI Bravo 17 C7VF ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11 ALSA: usb-audio: Set the value of potential sticky mixers to maximum commit d054796f8bb7d0aa9068d83feda76fe3b215f991 Merge: 76351effa53d49 905b06d32a52af Author: Linus Torvalds Date: Sat Jun 6 09:44:42 2026 -0700 Merge tag 'rust-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Fix 'rustc-option' (the Makefile one) when cross-compiling that leads to build or boot failures in certain configs - Work around a Rust compiler bug (already fixed for Rust 1.98.0) thats lead to boot failures in certain configs due to missing 'uwtable' LLVM module flags - Support a Rust compiler change (starting with Rust 1.98.0) in the unstable target specification JSON files - Forbid Rust + arm + KASAN configs, which do not build 'kernel' crate: - Fix NOMMU build by adding a missing helper" * tag 'rust-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: x86: support Rust >= 1.98.0 target spec rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES rust: helpers: add is_vmalloc_addr wrapper for NOMMU builds rust: kasan/kbuild: fix rustc-option when cross-compiling ARM: Do not select HAVE_RUST when KASAN is enabled commit 76351effa53d49114907dc9fd228110c2115292b Merge: 8e65320d91cdc3 2eea7f44b9c8b4 Author: Linus Torvalds Date: Sat Jun 6 07:28:59 2026 -0700 Merge tag 'vfs-7.1-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix error handling in ovl_cache_get() - Tighten access checks for exited tasks in pidfd_getfd() - Fix selftests leak in __wait_for_test() - Limit FUSE_NOTIFY_RETRIEVE to uptodate folios - Reject fuse_notify() pagecache ops on directories - Clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - Fix failure to unlock in nfsd4_create_file() - Fix pointer arithmetic in qnx6 directory iteration - Fix UAF due to unlocked ->mnt_ns read in may_decode_fh() - Avoid potential null folio->mapping deref during iomap error reporting * tag 'vfs-7.1-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: iomap: avoid potential null folio->mapping deref during error reporting fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() fs/qnx6: fix pointer arithmetic in directory iteration VFS: fix possible failure to unlock in nfsd4_create_file() signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() fuse: reject fuse_notify() pagecache ops on directories fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios selftests: harness: fix pidfd leak in __wait_for_test pidfd: refuse access to tasks that have started exiting harder ovl: keep err zero after successful ovl_cache_get() commit 4eb422482ca5d924d7212ad2ca1cb7ea6f5b524d Author: Nicolás Antinori Date: Sun May 31 15:23:07 2026 -0300 rust: i2c: fix I2cAdapter refcounts double increment When `I2cAdapter::get` executes, it first calls `bindings::i2c_get_adapter()` which increments the device and module reference counts. It then takes a reference to the raw pointer and converts it to an `ARef` via `.into()`. The implementation of `From<&T> for ARef` where `T: AlwaysRefCounted` unconditionally calls `T::inc_ref()`. This leads to a second increment to the reference counts. Since the returned `ARef` will only release a single reference when dropped via `dec_ref()`, this leaks one device and module reference count on every call. This fix was suggested by sashiko.dev. Link: https://sashiko.dev/#/patchset/20260521190937.248904-1-nico.antinori.7@gmail.com Signed-off-by: Nicolás Antinori Reviewed-by: Igor Korotin Signed-off-by: Igor Korotin commit 0d046ae106255cba5eb83b23f78ee93f3620247d Author: Waiman Long Date: Fri Jun 5 13:30:38 2026 -0400 debugobjects: Don't call fill_pool() in early boot hardirq context When booting a debug PREEMPT_RT kernel on an ARM64 system, a "inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage" lockdep warning message was reported to the console. During early boot, interrupts are enabled before the scheduler is enabled. In this window (before SYSTEM_SCHEDULING is set) interrupts can fire and in the hard interrupt context handler attempt to fill the pool This can lead to a deadlock when the interrupt occurred when the interrupt hits a region which holds a lock that is required to be taken in the allocation path. Add a new can_fill_pool() helper and reorder the exception rule and forbid this scenario by excluding allocations from hard interrupt context. Fixes: 06e0ae988f6e ("debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING") Suggested-by: Sebastian Andrzej Siewior Suggested-by: Thomas Gleixner Signed-off-by: Waiman Long Signed-off-by: Thomas Gleixner Reviewed-by: Sebastian Andrzej Siewior Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260605173038.495075-1-longman@redhat.com commit 9772589b57e44aedc240211c5c3f7a684a034d3a Author: Chenguang Zhao Date: Wed Jun 3 09:13:53 2026 +0800 netlabel: validate unlabeled address and mask attribute lengths netlbl_unlabel_addrinfo_get() used the address attribute length to determine whether the attribute data could be read as an IPv4 or IPv6 address, but did not independently validate the corresponding mask attribute length. A crafted Generic Netlink request could therefore provide a valid IPv4/IPv6 address attribute with a shorter mask attribute, which would later be read as a full struct in_addr or struct in6_addr. NLA_BINARY policy lengths are maximum lengths by default, so use NLA_POLICY_EXACT_LEN() for the unlabeled IPv4/IPv6 address and mask attributes. This rejects short attributes during policy validation and also exposes the exact length requirements through policy introspection. Fixes: 8cc44579d1bd ("NetLabel: Introduce static network labels for unlabeled connections") Signed-off-by: Chenguang Zhao Signed-off-by: Jakub Kicinski commit 3847d94783c0b893c27ff0b26a3325796d9444c6 Author: Vikas Gupta Date: Thu Jun 4 22:07:09 2026 +0530 bnge: fix context mem iteration The firmware advertises context memory (backing store) types through a linked list, with BNGE_CTX_INV serving as the end-of-list sentinel. However, the driver incorrectly assumes that the list is strictly ordered and prematurely terminates traversal when it encounters an unrecognized type (>=BNGE_CTX_V2_MAX). As a result, any valid context types that appear later in the chain are silently skipped, leading to incomplete memory configuration and eventual driver load failure. Fix this by traversing the entire list until the BNGE_CTX_INV sentinel is reached, while safely ignoring only those context types that fall outside the supported range. Fixes: 29c5b358f385 ("bng_en: Add backing store support") Signed-off-by: Vikas Gupta Reviewed-by: Dharmender Garg Signed-off-by: Jakub Kicinski commit 954981dbbfbd78f21d2fbac1ac0742dbf38b4e69 Author: Arthur Kiyanovski Date: Thu Jun 4 08:07:04 2026 +0000 net: ena: PHC: Add missing barrier Add dma_rmb() barrier after req_id completion check in ena_com_phc_get_timestamp(). On weakly-ordered architectures, payload fields may be read before req_id is observed as updated. Fixes: e0ea34158ee8 ("net: ena: Add PHC support in the ENA driver") Closes: https://sashiko.dev/#/patchset/20260430032507.11586-1-akiyano%40amazon.com Signed-off-by: Arthur Kiyanovski Signed-off-by: Jakub Kicinski commit f9f25118faa4dd2b6e3d14a03d123bbdbd59925d Author: ZhaoJinming Date: Thu Jun 4 15:03:52 2026 +0800 net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues() of_reserved_mem_lookup() may return NULL if the reserved memory region referenced by the "memory-region" phandle is not found in the reserved memory table (e.g. due to a misconfigured DTS or a removed memory-region node). The current code dereferences the returned pointer without checking for NULL, leading to a kernel NULL pointer dereference at the following lines: dma_addr = rmem->base; // line 1156 num_desc = div_u64(rmem->size, buf_size); // line 1160 Add a NULL check after of_reserved_mem_lookup() and return -ENODEV if the lookup fails, which is consistent with the existing error handling for of_parse_phandle() failure in the same code block. Fixes: 3a1ce9e3d01b ("net: airoha: Add the capability to allocate hwfd buffers via reserved-memory") Cc: stable@vger.kernel.org Signed-off-by: ZhaoJinming Acked-by: Lorenzo Bianconi Signed-off-by: Jakub Kicinski commit 8e65320d91cdc3b241d4b94855c88459b91abf66 Merge: c10130c234c81f 1a4f03d22fb655 Author: Linus Torvalds Date: Fri Jun 5 18:02:23 2026 -0700 Merge tag 'drm-fixes-2026-06-06' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly drm fixes, not contributing to things settling down unfortunately. Lots of driver fixes for various bounds checks, leaks and UAF type things, i915/xe probably the most sane, amdgpu has a mix of fixes all over, then ethosu has lots of small fixes. The problem of fixing thing in private has really hit us with the change handle ioctl, and "Sima was right" and we should have disabled the ioctl, since it was only introduced a couple of kernels ago and failed to upstream it's tests in time. The patch here fixes the problems Sima identified, but disables the ioctl as well, with a list of known problems in it and a request for proper tests to be written and upstreamed. It's a niche user ioctl designed for CRIU with AMD ROCm, so I think it's fine to just disable it. Maybe this week will settle down. core: - disable the gem change handle ioctl for security reasons (plan to fix it on list later with proper test coverage) dumb-buffer: - remove strict limits on buffer geometry amdgpu: - BT.2020 fix for DCE - DC bounds checking fixes - SDMA 7.1 fix - UserQ fixes - SI fix - SMU 13 fixes - SMU 14 fixes - GC 12.1 fix - Userptr fix - GC 10.1 fix - GART fix for non-4K pages amdkfd: - UAF race fix - Fix a potential NULL pointer dereference - GC 11 buffer overflow fix for SDMA xe: - Revert removing support for unpublished NVL-S GuC - Suspend fixes related to multi-queue i915: - Fix color blob reference handling in intel_plane_state - Revert "drm/i915/backlight: Remove try_vesa_interface" ethosu: - reject unsupported NPU_OP_RESIZE - fix index of IFM region - fix weight index - fix overflows in DMA-size calculations - reject DMA commands with uninitialized length - fix OOB write in ethosu_gem_cmdstream_copy_and_validate imx: - fix kernel-doc warnings ivpu: - add overflow checks in firmware handling and get_info_ioctl v3d: - wait for pending L2T flush before cleaning caches - fix leak of vaddr - skip CSD when it has zeroed workgroups - fix ref counting in performance monitoring" * tag 'drm-fixes-2026-06-06' of https://gitlab.freedesktop.org/drm/kernel: (50 commits) drm/gem: Try to fix change_handle ioctl, attempt 4 Revert "drm/i915/backlight: Remove try_vesa_interface" accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() accel/ethosu: reject DMA commands with uninitialized length accel/ethosu: fix arithmetic issues in dma_length() accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85 accel/ethosu: reject NPU_OP_RESIZE commands from userspace accel/ethosu: fix IFM region index out-of-bounds in command stream parser drm/v3d: Fix global performance monitor reference counting drm/xe/multi_queue: skip submit when primary queue is suspended drm/xe: Clear pending_disable before signaling suspend fence Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems drm/amdgpu/userq: move wptr_obj cleanup in mqd_destroy drm/amdgpu: improve the userq seq BO free bit lookup drm/amdgpu/userq: remove the vital queue unmap logging drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 drm/amdkfd: fix NULL dereference in get_queue_ids() drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14) ... commit c93952cc0034dc491cf082d1df11e996513a53ed Merge: 4aacf509e537a7 85b0cbc1f38bc1 Author: Jakub Kicinski Date: Fri Jun 5 16:41:19 2026 -0700 Merge branch 'intel-wired-lan-driver-updates-2026-06-02-i40e-ice-idpf' Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-06-02 (ice, idpf) Petr Oros adds missing callbacks for U.FL DPLL pins on ice. Alok Tiwari corrects copy/paste error causing incorrect reporting of PTP mailbox capability for idpf. ==================== Link: https://patch.msgid.link/20260602225513.393338-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 85b0cbc1f38bc1e38956a9e6d7b04d309b435697 Author: Alok Tiwari Date: Tue Jun 2 15:55:11 2026 -0700 idpf: fix mailbox capability for set device clock time The current code incorrectly uses VIRTCHNL2_CAP_PTP_SET_DEVICE_CLK_TIME for both direct and mailbox capabilities, causing mailbox-only support to be ignored and potentially reporting IDPF_PTP_NONE. Fixes: d5dba8f7206da ("idpf: add PTP clock configuration") Signed-off-by: Alok Tiwari Tested-by: Samuel Salin Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260602225513.393338-4-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit f1fa677e428e8873486938086bd934dc18169b47 Author: Petr Oros Date: Tue Jun 2 15:55:10 2026 -0700 ice: fix missing priority callbacks for U.FL DPLL pins The U.FL2 input pin advertises DPLL_PIN_CAPABILITIES_PRIORITY_CAN_CHANGE in its capability mask, but ice_dpll_pin_ufl_ops does not provide .prio_get and .prio_set callbacks. As a result the DPLL subsystem cannot report or accept priority for U.FL pins: pin-get omits the prio field on U.FL2 and pin-set with prio is rejected as invalid, even though the capability is present. This prevents user space from using priority to select or disable U.FL2 as a DPLL input source. Reproducer with iproute2 (dpll command): # dpll pin show board-label U.FL2 pin id 16: module-name ice board-label U.FL2 type ext capabilities priority-can-change|state-can-change parent-device: id 0 direction input state selectable phase-offset 0 /* note: no "prio" between "direction" and "state", even though priority-can-change is advertised */ # dpll pin set id 16 parent-device 0 prio 5 RTNETLINK answers: Operation not supported After the fix the prio field is reported by pin show and pin set with prio is accepted on U.FL2. Add the missing .prio_get and .prio_set callbacks to ice_dpll_pin_ufl_ops, reusing ice_dpll_sw_input_prio_{get,set}. The same ops struct is shared by U.FL1 and U.FL2: U.FL2 (input) delegates to the backing hardware input pin, while U.FL1 (output) does not advertise DPLL_PIN_CAPABILITIES_PRIORITY_CAN_CHANGE so the dpll core capability gate never invokes prio_set for it, and prio_get reports the OUTPUT sentinel (ICE_DPLL_PIN_PRIO_OUTPUT) on the output side exactly like the SMA path does today. Fixes: 2dd5d03c77e2 ("ice: redesign dpll sma/u.fl pins control") Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Signed-off-by: Petr Oros Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260602225513.393338-3-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 1a4f03d22fb655e5f192244fb2c87d8066fcfca2 Author: Simona Vetter Date: Thu Jun 4 21:44:37 2026 +0200 drm/gem: Try to fix change_handle ioctl, attempt 4 [airlied: just added some comments on how to reenable] On-list because the cat is out of the bag and we're clearly not good enough to figure this out in private. The story thus far: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") tried to fix a race condition between the gem_close and gem_change_handle ioctls, but got a few things wrong: - There's a confusion with the local variable handle, which is actually the new handle, and so the two-stage trick was actually applied to the wrong idr slot. 7164d78559b0 ("drm/gem: fix race between change_handle and handle_delete") tried to fix that by adding yet another code block, but forgot to add the error handling. Which meant we now have two paths, both kinda wrong. - dc366607c41c ("drm: Replace old pointer to new idr") tried to apply another fix, but inconsistently, again because of the handle confusion - this would be the right fix (kinda, somewhat, it's a mess) if we'd do the two-stage approach for the new handle. Except that wasn't the intent of the original fix. We also didn't have an igt merged for the original ioctl, which is a big no-go. This was attempted to address off-list in the original bugfix, and amd QA people claimed the bug was fixed now. Very clearly that's not the case. Here's my attempt to sort this out: - Rename the local variable to new_handle, the old aliasing with args->handle is just too dangerously confusing. - Merge the gem obj lookup with the two-stage idr_replace so that we avoid getting ourselves confused there. - This means we don't have a surplus temporary reference anymore, only an inherited from the idr. A concurrent gem_close on the new_handle could steal that. Fix that with the same two-stage approach create_tail uses. This is a bit overkill as documented in the comment, but I also don't trust my ability to understand this all correctly, so go with the established pattern we have from other ioctls instead for maximum paranoia. - Adjust error paths. I've tried to make the error and success paths common, because they are identical except for which handle is removed and on which we call idr_replace to (re)install the object again. But that made things messier to read, so I've left it at the more verbose version, which unfortunately hides the symmetry in the entire code flow a bit. - While at it, also replace the 7 space indent with 1 tab. And finally, because I flat out don't trust my abilities here at all anymore: - Disable the ioctl until we have the igt situation and everything else sorted out on-list and with full consensus. v2: Sashiko noticed that I didn't handle the error path for idr_replace correctly, it must be checked with IS_ERR_OR_NULL like in gem_handle_delete. So yeah, definitely should just the existing paths 1:1 because this is endless amounts of tricky. Also add the Fixes: line for the original ioctl, I forgot that too. Reported-by: DARKNAVY (@DarkNavyOrg) Signed-off-by: Simona Vetter Fixes: dc366607c41c ("drm: Replace old pointer to new idr") Cc: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Cc: Edward Adam Davis Cc: Dave Airlie Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Fixes: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") Cc: David Francis Cc: Puttimet Thammasaeng Cc: Christian Koenig Fixes: 7164d78559b0 ("drm/gem: fix race between change_handle and handle_delete") Cc: Zhenghang Xiao Fixes: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") Reviewed-by: David Francis Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260604194437.1725314-1-simona.vetter@ffwll.ch commit 8ff3adc8c322a9b5a987bf29f52ba727f8b5c406 Merge: f80cbe57ec4169 2914709c914101 Author: Dave Airlie Date: Sat Jun 6 08:42:14 2026 +1000 Merge tag 'drm-intel-fixes-2026-06-05' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix color blob reference handling in intel_plane_state (Chaitanya Kumar Borah) - Revert "drm/i915/backlight: Remove try_vesa_interface" [backlight] (Suraj Kandpal) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patch.msgid.link/aiKgmwz7VGOaFXIv@linux commit f80cbe57ec4169c6e9eafa4f1d31feced32177d3 Merge: 9317df76ca54bf c0837b9cf6eabb Author: Dave Airlie Date: Sat Jun 6 08:37:21 2026 +1000 Merge tag 'drm-misc-fixes-2026-06-05' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: dumb-buffer: - remove strict limits on buffer geometry ethosu: - reject unsupported NPU_OP_RESIZE - fix index of IFM region - fix weight index - fix overflows in DMA-size calculations - reject DMA commands with uninitialized length - fix OOB write in ethosu_gem_cmdstream_copy_and_validate imx: - fix kernel-doc warnings ivpu: - add overflow checks in firmware handling and get_info_ioctl v3d: - wait for pending L2T flush before cleaning caches - fix leak of vaddr - skip CSD when it has zeroed workgroups - fix ref counting in performance monitoring Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260605072602.GA268798@linux.fritz.box commit c10130c234c81f4a7a143edbf413080235f8d8ce Merge: 06121e12c27aef ed46f39c47eb55 Author: Linus Torvalds Date: Fri Jun 5 13:52:15 2026 -0700 Merge tag 'io_uring-7.1-20260605' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "A single fix for a missing flag mask when multishot is used with an incrementally consumed buffer ring, potentially leading to application confusion because of lack of IORING_CQE_F_BUF_MORE consistency" * tag 'io_uring-7.1-20260605' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries commit 06121e12c27aef6e1a09b4cdec809b9c91f6eb59 Merge: 95b78879a80ab0 65b09bfa8aa7eb Author: Linus Torvalds Date: Fri Jun 5 11:16:15 2026 -0700 Merge tag 'kbuild-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fix from Nicolas Schier: "A single simple commit that fixes the currently broken kconfig selftests" * tag 'kbuild-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kconfig: Fix repeated include selftest expectation commit 95b78879a80ab034cd56cc70f057c3cb4f2612a6 Merge: d1b0937f0eadbc 7ec0360122d8f5 Author: Linus Torvalds Date: Fri Jun 5 10:38:45 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "arm64: - Correctly drop the ITS translation cache reference when it actually gets invalidated - Take the SRCU lock for SW page table walks - Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming inaccessible from EL0 after running a guest - Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init and MMU notifiers are mutually exclusive - Correctly handle FEAT_XNX at stage-2 s390: - More fixes for the new page table management and nested virtualization x86: - More fixes for GHCB issues: - Read start/end indices of page size change requests exactly once per vmexit - Unmap and unpin the GHCB as needed on vCPU free" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (23 commits) KVM: arm64: Correctly identify executable PTEs at stage-2 KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX KVM: arm64: Reassign nested_mmus array behind mmu_lock KVM: arm64: Restore POR_EL0 access to host EL0 KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT KVM: SEV: Add an anonymous "psc" struct to track current PSC metadata KVM: SEV: Make it more obvious when KVM is writing back the current PSC index KVM: s390: Remove ptep_zap_softleaf_entry() KVM: s390: Fix possible reference leak in fault-in code KVM: s390: Prevent memslots outside the ASCE range KVM: s390: Lock pte when making page secure KVM: s390: Fix fault-in code KVM: s390: vsie: Fix rmap handling in _do_shadow_crste() KVM: s390: Fix guest / virtual address confusion in _essa_clear_cbrl() ... commit d1b0937f0eadbc30b528d37589ec7fb6ce9f4114 Merge: a8dc5f60d127f1 85e0f27dd13963 Author: Linus Torvalds Date: Fri Jun 5 10:33:32 2026 -0700 Merge tag 'probes-fixes-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing/probes fix from Masami Hiramatsu: "Fix the eprobe event parser to point error position correctly" * tag 'probes-fixes-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/probes: Point the error offset correctly for eprobe argument error commit 65b09bfa8aa7ebe087093b591525385efb2d58b0 Author: Zhou Yuhang Date: Wed May 20 15:08:00 2026 +0800 kconfig: Fix repeated include selftest expectation The err_repeated_inc test was added with an expected stderr fixture that does not match the diagnostic printed by kconfig. Running "make testconfig" currently fails in that test even though the parser reports the duplicated include correctly: [stderr] Kconfig.inc1:4: error: repeated inclusion of Kconfig.inc3 Kconfig.inc2:3: note: location of first inclusion of Kconfig.inc3 The fixture expects "Repeated" and "Location" with capital letters, but the diagnostic emitted by scripts/kconfig/util.c uses lowercase words. Update the fixture to match the real message. Fixes: 102d712ded3e ("kconfig: Error out on duplicated kconfig inclusion") Signed-off-by: Zhou Yuhang Tested-by: Nicolas Schier Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260520070800.2265479-1-zhouyuhang1010@163.com Signed-off-by: Nicolas Schier commit 7ec0360122d8f5033177ed0210d5ad71ec5b50c7 Merge: bd2e19cf8f3028 17f073f78fc432 Author: Paolo Bonzini Date: Fri Jun 5 18:54:37 2026 +0200 Merge tag 'kvmarm-fixes-7.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.1, take #5 - Correctly drop the ITS translation cache reference when it actually gets invalidated - Take the SRCU lock for SW page table walks - Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming inaccessible from EL0 after running a guest - Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init and MMU notifiers are mutually exclusive - Correctly handle FEAT_XNX at stage-2 commit a8dc5f60d127f1d147a8e778563fcef7715d1316 Merge: 6a5358410af387 317d5146fb399a Author: Linus Torvalds Date: Fri Jun 5 09:34:14 2026 -0700 Merge tag 'nfs-for-7.1-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client fix from Trond Myklebust: - Fix a use after free in nfs_write_completion * tag 'nfs-for-7.1-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFS: write_completion: dereference loop-local req, not hdr->req commit 6a5358410af387fd48251a5e5cc4cf73dc16de52 Merge: 2b389a573b76f4 dabfaca8140f64 Author: Linus Torvalds Date: Fri Jun 5 08:34:32 2026 -0700 Merge tag 'xfs-fixes-7.1-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "A collection of fixes mostly for the RT device, including a small refactor that has no functional change" * tag 'xfs-fixes-7.1-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: Remove mention of PageWriteback xfs: abort mount if xfs_fs_reserve_ag_blocks fails xfs: factor rtgroup geom write pointer reporting into a helper xfs: drop the RTG reference later in xfs_ioc_rtgroup_geometry xfs: fix rtgroup cleanup in CoW fork repair xfs: fix error returns in CoW fork repair xfs: fix overlapping extents returned for pNFS LAYOUTGET xfs: fix use of uninitialized imap in xfs_fs_map_blocks error path xfs: handle racing deletions in xfs_zone_gc_iter_irec commit 2b389a573b76f4e3e1e17654eeaced3eb48c2972 Merge: e4a9638a0b2295 27f2d085bd72ab Author: Linus Torvalds Date: Fri Jun 5 08:28:10 2026 -0700 Merge tag 'erofs-for-7.1-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Fix a UAF of sbi->sync_decompress when compressed I/Os race with unmount - Fix a regression introduced this development cycle that incorrectly rejects multiple-algorithm images * tag 'erofs-for-7.1-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check() erofs: fix use-after-free on sbi->sync_decompress commit e4a9638a0b2295fc6b69500b25d01510aa8d66ac Merge: ddd664bbff63e0 f580d27e892882 Author: Linus Torvalds Date: Fri Jun 5 08:23:02 2026 -0700 Merge tag 'v7.1-rc7-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix use after free in SMB2_CANCEL - Fix race in ksmbd_reopen_durable_fd - Fix oplock and lease break potential NULL-dref * tag 'v7.1-rc7-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers commit 07ebe87915d8accdaba20c4f88c5ae430fe62fbb Author: Zhenghang Xiao Date: Sat May 30 21:45:28 2026 +0100 misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero) on this unprotected pointer. A concurrent MEM_UNMAP can free the map between the lock release and the kref operation, resulting in a use-after-free on the freed slab object. Restore the take_ref parameter to fastrpc_map_lookup so the reference is acquired atomically under fl->lock before the pointer is exposed to the caller. Fixes: 10df039834f8 ("misc: fastrpc: Skip reference for DMA handles") Cc: stable@vger.kernel.org Signed-off-by: Zhenghang Xiao Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204528.116920-5-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5401fb4fe10fac6134c308495df18ed74aebb9c4 Author: Mukesh Ojha Date: Sat May 30 21:45:27 2026 +0100 misc: fastrpc: Fix NULL pointer dereference in rpmsg callback A NULL pointer dereference was observed on Hawi at boot when the DSP sends a glink message before fastrpc_rpmsg_probe() has completed initialization: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178 pc : _raw_spin_lock_irqsave+0x34/0x8c lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] ... Call trace: _raw_spin_lock_irqsave+0x34/0x8c (P) fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] qcom_glink_native_rx+0x538/0x6a4 qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem] The faulting address 0x178 corresponds to the lock variable inside struct fastrpc_channel_ctx, confirming that cctx is NULL when fastrpc_rpmsg_callback() attempts to take the spinlock. There are two issues here. First, dev_set_drvdata() is called before spin_lock_init() and idr_init(), leaving a window where the callback can retrieve a valid cctx pointer but operate on an uninitialized spinlock. Second, the rpmsg channel becomes live as soon as the driver is bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata() is called at all, resulting in dev_get_drvdata() returning NULL. Fix both issues by moving all cctx initialization ahead of dev_set_drvdata() so the structure is fully initialized before it becomes visible to the callback, and add a NULL check in fastrpc_rpmsg_callback() as a guard against any remaining window. Fixes: f6f9279f2bf0 ("misc: fastrpc: Add Qualcomm fastrpc basic driver model") Cc: stable@vger.kernel.org Signed-off-by: Mukesh Ojha Reviewed-by: Bjorn Andersson Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204528.116920-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 464c6ad2aa16e1e1df9d559289199356493d1e00 Author: Junrui Luo Date: Sat May 30 21:45:26 2026 +0100 misc: fastrpc: fix DMA address corruption due to find_vma misuse fastrpc_get_args() uses find_vma() to look up the VMA for a user-provided pointer and compute a DMA address offset. When the address falls in a gap before the returned VMA, (ptr & PAGE_MASK) - vma->vm_start underflows, corrupting the DMA address sent to the DSP. Replace find_vma() with vma_lookup(), which returns NULL when the address is not contained within any VMA. Cc: stable@vger.kernel.org Fixes: 80f3afd72bd4 ("misc: fastrpc: consider address offset before sending to DSP") Reported-by: Yuhao Jiang Signed-off-by: Junrui Luo Reviewed-by: Dmitry Baryshkov Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204528.116920-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit e85eb5feca8e254905ffa6c57a3c99c89a674a0f Author: Anandu Krishnan E Date: Sat May 30 21:45:25 2026 +0100 misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race between fastrpc_device_release() and the workqueue that processes DSP responses. When the user closes the file descriptor, fastrpc_device_release() frees the fastrpc_user structure. Concurrently, an in-flight DSP invocation can complete and fastrpc_rpmsg_callback() schedules context cleanup via schedule_work(&ctx->put_work). If the workqueue runs fastrpc_context_free() in parallel with or after fastrpc_device_release() has freed the user structure, it dereferences the freed fastrpc_user. Depending on the state of the context at the time of the race, any one of the following accesses can be hit: 1. fastrpc_buf_free() calls fastrpc_ipa_to_dma_addr(buf->fl->cctx, ...) to strip the SID bits from the stored IOVA before passing the physical address to dma_free_coherent(). 2. fastrpc_free_map() reads map->fl->cctx->vmperms[0].vmid to reconstruct the source permission bitmask needed for the qcom_scm_assign_mem() call that returns memory from the DSP VM back to HLOS. 3. fastrpc_free_map() acquires map->fl->lock to safely remove the map node from the fl->maps list. The resulting use-after-free manifests as: pc : fastrpc_buf_free+0x38/0x80 [fastrpc] lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc] fastrpc_context_free+0xa8/0x1b0 [fastrpc] fastrpc_context_put_wq+0x78/0xa0 [fastrpc] process_one_work+0x180/0x450 worker_thread+0x26c/0x388 Add kref-based reference counting to fastrpc_user. Have each invoke context take a reference on the user at allocation time and release it when the context is freed. Release the initial reference in fastrpc_device_release() at file close. Move the teardown of the user structure — freeing pending contexts, maps, mmaps, and the channel context reference — into the kref release callback fastrpc_user_free(), so that it runs only when the last reference is dropped, regardless of whether that happens at device close or after the final in-flight context completes. Fixes: 6cffd79504ce ("misc: fastrpc: Add support for dmabuf exporter") Cc: stable@kernel.org Signed-off-by: Anandu Krishnan E Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204528.116920-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 55f2ea9ff83cc27a85526b14bc9b32f96a08d6ec Author: Bjorn Andersson Date: Sat May 30 21:44:21 2026 +0100 slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock During the SSR/PDR down notification the tx_lock is taken with the intent to provide synchronization with active DMA transfers. But during this period qcom_slim_ngd_down() is invoked, which ends up in slim_report_absent(), which takes the slim_controller lock. In multiple other codepaths these two locks are taken in the opposite order (i.e. slim_controller then tx_lock). The result is a lockdep splat, and a possible deadlock: rprocctl/449 is trying to acquire lock: ffff00009793e620 (&ctrl->lock){+.+.}-{4:4}, at: slim_report_absent (drivers/slimbus/core.c:322) slimbus but task is already holding lock: ffff00009793fb50 (&ctrl->tx_lock){+.+.}-{4:4}, at: qcom_slim_ngd_ssr_pdr_notify (drivers/slimbus/qcom-ngd-ctrl.c:1475) slim_qcom_ngd_ctrl which lock already depends on the new lock. Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ctrl->tx_lock); lock(&ctrl->lock); lock(&ctrl->tx_lock); lock(&ctrl->lock); The assumption is that the comment refers to the desire to not call qcom_slim_ngd_exit_dma() while we have an ongoing DMA TX transaction. But any such transaction is initiated and completed within a single qcom_slim_ngd_xfer_msg(). Prior to calling qcom_slim_ngd_exit_dma() the slim_controller is torn down, all child devices are notified that the slimbus is gone and the child devices are removed. Stop taking the tx_lock in qcom_slim_ngd_ssr_pdr_notify() to avoid the deadlock. Fixes: a899d324863a ("slimbus: qcom-ngd-ctrl: add Sub System Restart support") Cc: stable@vger.kernel.org Signed-off-by: Bjorn Andersson Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204421.116824-9-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6a003446b725c44b9e3ffa111b0effbaa2d43085 Author: Bjorn Andersson Date: Sat May 30 21:44:20 2026 +0100 slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD The pm_runtime_enable() and pm_runtime_use_autosuspend() calls are supposed to be balanced on exit, add these calls. Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") Cc: stable@vger.kernel.org Signed-off-by: Bjorn Andersson Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204421.116824-8-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 07c564ea5fb859b7381429de935d5df4781947c6 Author: Bjorn Andersson Date: Sat May 30 21:44:19 2026 +0100 slimbus: qcom-ngd-ctrl: Initialize controller resources in controller The work structs and work queue are controller resources, create and destroy them in the controller context. Creating them as part of the child device's probe path seems to be okay now that the controller's probe has been updated, but if for some reason the child does not probe successfully a SSR or PDR notification will schedule_work() on an uninitialized "ngd_up_work". Move the initialization of these controller resources to the controller probe function to avoid any issues, and to clarify the ownership. Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") Cc: stable@vger.kernel.org Reviewed-by: Dmitry Baryshkov Reviewed-by: Mukesh Ojha Signed-off-by: Bjorn Andersson Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204421.116824-7-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2a9d50e9ea406e0c8735938484adc20515ef1b47 Author: Bjorn Andersson Date: Sat May 30 21:44:18 2026 +0100 slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd When the remoteproc starts in parallel with the NGD driver being probed, or the remoteproc is already up when the PDR lookup is being registered, or in the theoretical event that we get an interrupt from the hardware, these callbacks will operate on uninitialized data. This result in issues to boot the affected boards. One such example can be seen in the following fault, where qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work. [ 21.858578] ------------[ cut here ]------------ [ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116 ... [ 21.859251] Call trace: [ 21.859255] __queue_work+0x5e0/0x790 (P) [ 21.859265] queue_work_on+0x6c/0xf0 [ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] [ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] [ 21.859318] notifier_call_chain+0xa4/0x230 [ 21.859329] srcu_notifier_call_chain+0x64/0xb8 [ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common] [ 21.859355] rproc_start+0x130/0x230 [ 21.859367] rproc_boot+0x3d4/0x518 ... Move the enablement of interrupts, and the registration of SSR and PDR until after the NGD device has been registered. This could be further refined by moving initialization to the control driver probe and by removing the platform driver model from the picture. Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") Cc: stable@vger.kernel.org Reviewed-by: Mukesh Ojha Signed-off-by: Bjorn Andersson Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204421.116824-6-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 960b53a3f76fa214c2fc493734ae7b3c5e713bbf Author: Bjorn Andersson Date: Sat May 30 21:44:17 2026 +0100 slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership PDR and SSR callbacks are registred from the controller probe function, but currently released from the child device's remove function. The remove() function should only be unwinding what was done in the same device's probe() function. Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") Cc: stable@vger.kernel.org Reviewed-by: Dmitry Baryshkov Reviewed-by: Mukesh Ojha Signed-off-by: Bjorn Andersson Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204421.116824-5-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2c22ff152d380ec3d3af099fa05d0ac5ca9b4c1e Author: Bjorn Andersson Date: Sat May 30 21:44:16 2026 +0100 slimbus: qcom-ngd-ctrl: Fix probe error path ordering qcom_slim_ngd_ctrl_probe() first registers the SSR callback then allocates the PDR context, as such the error path needs to come in opposite order to allow us to unroll each step. Fixes: 16f14551d0df ("slimbus: qcom-ngd: cleanup in probe error path") Cc: stable@vger.kernel.org Reviewed-by: Dmitry Baryshkov Reviewed-by: Mukesh Ojha Signed-off-by: Bjorn Andersson Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204421.116824-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8663e8334d7b6007f5d8a4e5dd270246f35107a6 Author: Bjorn Andersson Date: Sat May 30 21:44:15 2026 +0100 slimbus: qcom-ngd-ctrl: Fix up platform_driver registration Device drivers should not invoke platform_driver_register()/unregister() in their probe and remove paths. They should further not rely on platform_driver_unregister() as their only means of "deleting" their child devices. Introduce a helper to unregister the child device and move the platform_driver_register()/unregister() to module_init()/exit(). Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") Cc: stable@vger.kernel.org Reviewed-by: Dmitry Baryshkov Reviewed-by: Mukesh Ojha Signed-off-by: Bjorn Andersson Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204421.116824-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 120134fe75c6b0ae38f14eb8b548ad1e5761f912 Author: Bartosz Golaszewski Date: Sat May 30 21:44:14 2026 +0100 slimbus: qcom-ngd-ctrl: fix OF node refcount Platform devices created with platform_device_alloc() call platform_device_release() when the last reference to the device's kobject is dropped. This function calls of_node_put() unconditionally. This works fine for devices created with platform_device_register_full() but users of the split approach (platform_device_alloc() + platform_device_add()) must bump the reference of the of_node they assign manually. Add the missing call to of_node_get(). Cc: stable@vger.kernel.org Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") Signed-off-by: Bartosz Golaszewski Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204421.116824-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5b6b6fc491899d583eaa75344e094796ae9b530b Author: Bartosz Golaszewski Date: Sat May 30 21:43:40 2026 +0100 nvmem: core: fix use-after-free bugs in error paths Fix several instances of error paths in which we call __nvmem_device_put() - which may end up freeing the underlying memory and other resources - and then keep on using the nvmem structure. Always put the reference to the nvmem device as the last step before returning the error code. Cc: stable@vger.kernel.org Fixes: 7ae6478b304b ("nvmem: core: rework nvmem cell instance creation") Fixes: e888d445ac33 ("nvmem: resolve cells from DT at registration time") Signed-off-by: Bartosz Golaszewski Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204340.116743-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit ea41020b9018e31c2ea7e9d89021e3e6d7470883 Author: Andre Heider Date: Sat May 30 21:43:39 2026 +0100 nvmem: layouts: onie-tlv: fix hang on unknown types The EEPROM on my board has a vendor specific entry of type 0x41. When stumbling upon that, this driver hangs in an endless loop. Fix it by keep incrementing the offset on unknown entries, so the loop will eventually stop. Fixes: d3c0d12f6474 ("nvmem: layouts: onie-tlv: Add new layout driver") Cc: Stable@vger.kernel.org Signed-off-by: Andre Heider Reviewed-by: Miquel Raynal Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260530204340.116743-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit b5277b3a6f5024cd175c25455bda342cab342553 Merge: e43ffb69e0438c bfd2eb9bba548a Author: Greg Kroah-Hartman Date: Fri Jun 5 17:17:30 2026 +0200 Merge tag 'svc_fixes_for_v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-linus Dinh writes: firmware: stratix10-svc and stratix10-rsu: fixes for v7.1 - Return -EOPNOTSUPP when ATF async is not supported - Fix SVC driver from loading entirely when asynchronous ops is not supported in older ATF. - Fix a NULL pointer dereference on a timeout in rsu_send_msg() * tag 'svc_fixes_for_v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe firmware: stratix10-svc: Don't fail probe when async ops unsupported firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported commit 4316acc7ddaaa4572da1a55a2bc561d341c9c2a4 Merge: 108c8b6c06b7c7 1938fb9fe38c4f Author: Greg Kroah-Hartman Date: Fri Jun 5 17:16:27 2026 +0200 Merge tag 'usb-serial-7.1-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial fixes for 7.1-rc7 Here are two fixes for buffer overflows in the io_ti driver and a new modem device id. All have been in linux-next with no reported issues. * tag 'usb-serial-7.1-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add usb-id for Dell Wireless DW5826e-m USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() USB: serial: io_ti: fix heap overflow in get_manuf_info() commit 17f073f78fc43280891ecde8f8ec3f84f98bb37c Author: Oliver Upton Date: Tue Jun 2 09:59:01 2026 -0700 KVM: arm64: Correctly identify executable PTEs at stage-2 KVM invalidates the I-cache before installing an executable PTE on implementations without DIC. Unfortunately, support for FEAT_XNX broke this check as KVM_PTE_LEAF_ATTR_HI_S2_XN was expanded to a bitfield. Fix it by reusing kvm_pgtable_stage2_pte_prot() and testing the abstract permission bits instead. Fixes: 2608563b466b ("KVM: arm64: Add support for FEAT_XNX stage-2 permissions") Reported-by: Sashiko (gemini/gemini-3.1-pro-preview) Signed-off-by: Oliver Upton Reviewed-by: Wei-Lin Chang Link: https://patch.msgid.link/20260602165901.52800-3-oupton@kernel.org Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit 49b32ddb87a3a109afecea89e55d70f73956b8bc Author: Oliver Upton Date: Tue Jun 2 09:59:00 2026 -0700 KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX XN has already been extracted from its bitfield position so using FIELD_PREP() on the mask that clears XN[0] is completely broken, having the effect of unconditionally granting execute permissions... Fix the obvious mistake by manipulating the right bit. Cc: stable@vger.kernel.org Fixes: d93febe2ed2e ("KVM: arm64: nv: Forward FEAT_XNX permissions to the shadow stage-2") Reviewed-by: Wei-Lin Chang Signed-off-by: Oliver Upton Link: https://patch.msgid.link/20260602165901.52800-2-oupton@kernel.org Signed-off-by: Marc Zyngier commit ed46f39c47eb5530a9c161481a2080d3a869cfaf Author: Clément Léger Date: Thu Jun 4 09:07:13 2026 -0700 io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries When a bundle recv retries inside io_recv_finish(), the merge logic OR the saved cflags from the previous iteration with the cflags returned by the new iteration: cflags = req->cqe.flags | (cflags & CQE_F_MASK); Bits listed in CQE_F_MASK are inherited from the new iteration, and all other bits (notably IORING_CQE_F_BUFFER and the buffer ID) come from the saved cflags. Before this change CQE_F_MASK covered only IORING_CQE_F_SOCK_NONEMPTY and IORING_CQE_F_MORE. When using provided buffer rings (IOU_PBUF_RING_INC) with incremental mode, and bundle recv, io_kbuf_inc_commit() can leave the head ring entry partially consumed, __io_put_kbufs() then sets IORING_CQE_F_BUF_MORE on the returned cflags so userspace knows the buffer ID will be reused for subsequent completions. Because IORING_CQE_F_BUF_MORE was not in CQE_F_MASK, the merge above silently dropped it whenever the final retry iteration partially consumed the buffer, and the subsequent req->cqe.flags = cflags & ~CQE_F_MASK save would have left a stale IORING_CQE_F_BUF_MORE in the carried-over cflags had one been present. Userspace would then wrongfully advance it ring head past an entry the kernel still uses. Add IORING_CQE_F_BUF_MORE to CQE_F_MASK so it is both inherited from the new iteration into the user-visible CQE and stripped from the saved cflags between iterations. Cc: stable@vger.kernel.org Signed-off-by: Clément Léger Assisted-by: Claude:claude-opus-4.6 Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption") Link: https://patch.msgid.link/20260604160715.2482972-1-cleger@meta.com Signed-off-by: Jens Axboe commit c381039ade2e161ab08c0eda73c4f8b9a7115928 Author: Wyatt Feng Date: Wed Jun 3 00:46:27 2026 +0800 xfrm: espintcp: do not reuse an in-progress partial send espintcp keeps a single in-flight transmit in ctx->partial. Before building a new sk_msg, espintcp_sendmsg() first tries to flush that state through espintcp_push_msgs(). For blocking callers, espintcp_push_msgs() may return success even when the previous partial send is still pending. espintcp_sendmsg() would then reinitialize emsg->skmsg and reuse ctx->partial while the old transfer still owns that state. Do not rebuild the send message when ctx->partial is still in progress. If espintcp_push_msgs() returns with emsg->len still set, fail the new send instead of overwriting the live partial state. This is a memory-safety fix: reusing the live partial-send state can leave a stale offset attached to a new sk_msg and lead to an out-of- bounds read in the send path. tcp_sendmsg_locked() already handles waiting for send buffer memory, so the fix here is just to preserve espintcp's one-message-at-a-time transmit state. Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Zhengchuan Liang Reported-by: Xin Liu Assisted-by: Codex:GPT-5.4 Signed-off-by: Wyatt Feng Signed-off-by: Ren Wei Signed-off-by: Steffen Klassert commit c8a8a75b733467b00c08b91a38dbaf207a08ed6e Author: Tristan Madani Date: Tue Jun 2 17:16:41 2026 +0000 xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() iptfs_destroy_state() calls hrtimer_cancel() while holding a spinlock that the timer callback also acquires, leading to an ABBA deadlock on SMP systems. For the output timer (iptfs_timer): - iptfs_destroy_state() holds x->lock, calls hrtimer_cancel() - iptfs_delay_timer() callback takes x->lock For the drop timer (drop_timer): - iptfs_destroy_state() holds drop_lock, calls hrtimer_cancel() - iptfs_drop_timer() callback takes drop_lock Both timers use HRTIMER_MODE_REL_SOFT, so their callbacks run in softirq context. When hrtimer_cancel() is called for a soft timer that is currently executing on another CPU, hrtimer_cancel_wait_running() spins on softirq_expiry_lock -- the same lock held by the softirq running the callback. If the callback is blocked waiting for the spinlock held by the caller of hrtimer_cancel(), a circular dependency forms: CPU 0: holds lock_A -> waits for softirq_expiry_lock CPU 1: holds softirq_expiry_lock -> waits for lock_A Fix by calling hrtimer_cancel() before acquiring the respective locks. hrtimer_cancel() is safe to call without holding any lock and will wait for any in-progress callback to complete. For the output timer, the lock is still acquired afterwards to drain the packet queue. For the drop timer, the lock/unlock pair is removed entirely since it only existed to serialize with the timer callback, which hrtimer_cancel() already guarantees. Found by source code audit. Fixes: 4b3faf610cc6 ("xfrm: iptfs: add new iptfs xfrm mode impl") Cc: Christian Hopps Cc: Steffen Klassert Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani Signed-off-by: Steffen Klassert commit 70543358fa08e0f7cebc3447c3b70fe97ad7aaa8 Author: Hyunwoo Kim Date: Fri Jun 5 17:27:01 2026 +0900 KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which can run at any time. kvm_vcpu_init_nested() reallocates the array and frees the old buffer while holding only kvm->arch.config_lock, so such a walker can reference the freed array. Allocate the new array outside of mmu_lock, as the allocation can sleep. Under the lock, copy the existing entries, fix up the back pointers and reassign the array. Free the old buffer after dropping the lock, as kvfree() can sleep as well. Fixes: 4f128f8e1aaac ("KVM: arm64: nv: Support multiple nested Stage-2 mmu structures") Signed-off-by: Hyunwoo Kim Reviewed-by: Oliver Upton Link: https://patch.msgid.link/aiKIVVeIr1aAB1yp@v4bel Signed-off-by: Marc Zyngier Cc: stable@vger,kernel.org commit cbaffe843a942c0d3102e0f9bce0e72b029b2594 Author: Joey Gouly Date: Thu Jun 4 11:54:34 2026 +0100 KVM: arm64: Restore POR_EL0 access to host EL0 CPTR_EL2.E0POE was being cleared in __deactivate_cptr_traps_vhe(), which meant that any accesses to POR_EL0 from host EL0 would trap and be reported to userspace as an Illegal instruction. This would happen after running any VM, regardless if it used POE or not. Signed-off-by: Joey Gouly Link: https://sashiko.dev/#/patchset/20260602155430.2088142-1-maz@kernel.org?part=1 Link: https://patch.msgid.link/20260604105434.2297268-1-joey.gouly@arm.com Signed-off-by: Marc Zyngier Cc: stable@vger,kernel.org commit 2914709c914101eb704e01bed2351070d4161ccf Author: Suraj Kandpal Date: Sun May 17 08:17:09 2026 +0530 Revert "drm/i915/backlight: Remove try_vesa_interface" This reverts commit 40d2f5820951dee818d05c14677277048bd85f9f. Removing the try_vesa_interface gate caused a backlight regression on panels whose VBT correctly reports INTEL_BACKLIGHT_DISPLAY_DDI and whose PWM path is the actual backlight control, but whose DPCD optimistically advertises DP_EDP_BACKLIGHT_AUX_ENABLE_CAP / _BRIGHTNESS_AUX_SET_CAP. After the commit such panels silently bind to the VESA AUX backlight funcs; AUX writes complete but the panel ignores them, leaving brightness stuck (no-op backlight). Observed on at least KBL and TGL eDP setups. Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260517024709.1016121-1-suraj.kandpal@intel.com (cherry picked from commit f30fddb4402313aa5301a74d721638d343395269) Signed-off-by: Tvrtko Ursulin commit f2ca45b50d4216c9cc7ffabf50d9ad1932209251 Author: Hyunwoo Kim Date: Wed Jun 3 21:09:33 2026 +0900 KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation walk_s1() and kvm_walk_nested_s2() expect to be called while holding kvm->srcu to guard against memslot changes. While this is generally the case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the respective walkers without taking kvm->srcu. Fix by acquiring kvm->srcu prior to the table walk in both instances. Cc: stable@vger.kernel.org Fixes: 50f77dc87f13 ("KVM: arm64: Populate level on S1PTW SEA injection") Fixes: be04cebf3e78 ("KVM: arm64: nv: Add emulation of AT S12E{0,1}{R,W}") Suggested-by: Oliver Upton Signed-off-by: Hyunwoo Kim Reviewed-by: Oliver Upton Link: https://patch.msgid.link/aiAZfdeyanIvP8SD@v4bel Signed-off-by: Marc Zyngier commit 13031fb6b8357fbbcded2a7f4cba73e4781ee594 Author: Hyunwoo Kim Date: Mon Jun 1 23:53:26 2026 +0900 KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each entry with vgic_put_irq(). It puts the iterated pointer, though, rather than the value returned by xa_erase(). The function is called from contexts that do not exclude one another: the ITS command handlers hold its_lock, the GITS_CTLR write path holds cmd_lock, and the path that clears EnableLPIs in a redistributor's GICR_CTLR holds neither. Two or more of them can drain the same cache concurrently, and if each one observes the same entry, erases it and then puts it, the single reference the cache holds on that entry is dropped more than once. The entry can then be freed while an ITE still maps it. xa_erase() is atomic and returns the previous entry, so put only the entry that this context actually removed. The cache reference is then dropped exactly once per entry even when the invalidations run concurrently, and the behavior is unchanged when only one context runs. Fixes: 8201d1028caa ("KVM: arm64: vgic-its: Maintain a translation cache per ITS") Signed-off-by: Hyunwoo Kim Reviewed-by: Oliver Upton Link: https://patch.msgid.link/ah2c5lu4JbUg7dj-@v4bel Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit 6f6947b2387e94e405f80d472f8a189bfbf2bd6c Author: Tony Luck Date: Thu Jun 4 21:46:49 2026 -0700 x86/resctrl: Only check Intel systems for SNC topology_num_nodes_per_package() reports values greater than one on certain AMD systems resulting in resctrl's Intel model specific SNC detection printing the confusing message: "CoD enabled system? Resctrl not supported" Add a check for Intel systems before looking at the topology. [ reinette: Add Closes tag, fix tag typos, rework changelog ] Fixes: 59674fc9d0bf ("x86/resctrl: Fix SNC detection") Reported-by: Babu Moger Signed-off-by: Tony Luck Signed-off-by: Reinette Chatre Signed-off-by: Ingo Molnar Tested-by: Babu Moger Link: https://patch.msgid.link/9849330f45ac86344cc5ac54df2d313906d70bc4.1780634584.git.reinette.chatre@intel.com Closes: https://lore.kernel.org/lkml/37ac0376-43a3-4283-a3d5-4d57b3bec578@amd.com/ commit 2b5ff4db5d7aa5b981d966df02e687f79ad7b311 Author: Kyle Zeng Date: Fri Jun 5 01:02:04 2026 -0700 ALSA: seq: dummy: fix UMP event stack overread The dummy sequencer port forwards events by copying an incoming struct snd_seq_event into a stack temporary, rewriting source and destination, and dispatching the temporary to subscribers. That legacy event storage is smaller than struct snd_seq_ump_event. When a UMP event reaches the dummy client, the copy leaves the UMP flag set but only provides legacy-sized stack storage. The subscriber delivery path then uses snd_seq_event_packet_size() and copies a UMP-sized packet from that stack object, reading past the end of the temporary. Use the existing union __snd_seq_event storage and copy the packet size reported for the incoming event before rewriting the common routing fields. This preserves the full UMP packet for UMP events while keeping legacy event handling unchanged. Fixes: 32cb23a0f911 ("ALSA: seq: dummy: Allow UMP conversion") Signed-off-by: Kyle Zeng Link: https://patch.msgid.link/20260605080204.32045-1-kylebot@openai.com Signed-off-by: Takashi Iwai commit c0837b9cf6eabbad8b8cbddaff1a46a6d0a2e29d Author: Muhammad Bilal Date: Sat May 23 19:08:43 2026 +0000 accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() The command stream parsing loop increments the index variable a second time when a 64-bit command word is encountered (bit 14 set), but does not re-check the loop bound before writing the second word: for (i = 0; i < size / 4; i++) { bocmds[i] = cmds[0]; if (cmd & 0x4000) { i++; bocmds[i] = cmds[1]; /* unchecked */ } } The buffer bocmds is backed by a DMA allocation of exactly size bytes from drm_gem_dma_create(ddev, size), giving valid indices [0, size/4-1]. When i == size/4 - 1 on entry to an iteration and bit 14 of cmds[0] is set, bocmds[size/4-1] is written in bounds, i is then incremented to size/4, and bocmds[size/4] writes four bytes past the end of the allocation. Userspace controls both the buffer contents and the size argument via the ioctl, making this a userspace-triggerable heap out-of-bounds write. Fix by checking the incremented index against the buffer bound before the second write and returning -EINVAL if the buffer is too small to contain the extended command. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260523190843.33977-1-meatuni001@gmail.com Signed-off-by: Rob Herring (Arm) commit 4aacf509e537a711fa71bca9f234e5eb6968850e Author: Bartosz Golaszewski Date: Tue Jun 2 09:34:14 2026 +0200 net: mv643xx: fix OF node refcount Platform devices created with platform_device_alloc() call platform_device_release() when the last reference to the device's kobject is dropped. This function calls of_node_put() unconditionally. This works fine for devices created with platform_device_register_full() but users of the split approach (platform_device_alloc() + platform_device_add()) must bump the reference of the of_node they assign manually. Add the missing call to of_node_get(). Cc: stable@vger.kernel.org Fixes: 76723bca2802 ("net: mv643xx_eth: add DT parsing support") Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260602073414.22500-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 32594b09854970d7ba83eb2dc8c69a2edd158c8e Author: Hyunwoo Kim Date: Tue Jun 2 19:21:05 2026 +0900 inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail. inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes after the flush and takes the queue lock then finds an empty queue and starts a new run instead of dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush, so drop the now duplicate code there. Cc: stable@vger.kernel.org Fixes: 006a5035b495 ("inet: frags: flush pending skbs in fqdir_pre_exit()") Suggested-by: Eric Dumazet Signed-off-by: Hyunwoo Kim Link: https://patch.msgid.link/ah6ukYq5G98LshdA@v4bel Signed-off-by: Jakub Kicinski commit d9d021218162b6c4fe0bdf42b2b340f1aae23a12 Author: Muhammad Bilal Date: Sun May 24 13:03:19 2026 +0000 accel/ethosu: reject DMA commands with uninitialized length cmd_state_init() initializes the command state with memset(0xff), leaving dma->len at U64_MAX to signal missing setup. The only setter is NPU_SET_DMA0_LEN; if userspace omits this command and issues NPU_OP_DMA_START, dma->len remains U64_MAX. In dma_length(), a positive stride added to U64_MAX wraps to a small value. With size0 == 1, check_mul_overflow() does not trigger and dma_length() returns 0 instead of U64_MAX. The caller's U64_MAX check then passes, region_size[] stays 0, and the bounds check in ethosu_job.c is bypassed, allowing hardware to execute DMA with stale physical addresses. Fix by checking for U64_MAX at the start of dma_length() before any arithmetic, consistent with the sentinel value used throughout the driver to detect uninitialized fields. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260524130319.12747-1-meatuni001@gmail.com Signed-off-by: Rob Herring (Arm) commit ee6d9b6e51626f259c6f0e38d94f91be4fd14754 Author: Muhammad Bilal Date: Sun May 24 10:37:10 2026 +0000 accel/ethosu: fix arithmetic issues in dma_length() dma_length() derives DMA region usage from command stream values and updates region_size[]: len = ((len + stride[0]) * size0 + stride[1]) * size1 region_size[region] = max(..., len + dma->offset) Several arithmetic issues can corrupt the derived region size: - signed stride values may underflow when added to len - intermediate multiplications may overflow - len + dma->offset may overflow during region_size updates - dma_length() error returns were not validated by the caller region_size[] is later used by ethosu_job.c to validate command stream accesses against GEM buffer sizes. Arithmetic wraparound can therefore under-report region usage and bypass the bounds validation. Fix by validating signed additions, using overflow helpers for multiplications and offset updates, and propagating dma_length() failures to the caller. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260524103710.47397-1-meatuni001@gmail.com Signed-off-by: Rob Herring (Arm) commit e703843f242b28e35ac79408de571ae110c740b5 Author: Muhammad Bilal Date: Sat May 23 21:07:53 2026 +0000 accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85 On non-U65 hardware (e.g. U85), opcode 0x4093 is NPU_SET_WEIGHT2_LENGTH. The BASE handler for the same opcode correctly assigns to st.weight[2].base, but the LENGTH handler mistakenly assigns cmds[1] to st.weight[1].length instead of st.weight[2].length. This leaves weight[2].length at its initialised sentinel value of 0xffffffff and corrupts weight[1].length with the user-supplied value, breaking the software bounds-check state for both weight buffers on U85. Fix the index to match the BASE handler. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260523210840.92039-3-meatuni001@gmail.com Signed-off-by: Rob Herring (Arm) commit ef911805d86a05363d3ec2fa9835a41def83bb7e Author: Muhammad Bilal Date: Sat May 23 21:07:52 2026 +0000 accel/ethosu: reject NPU_OP_RESIZE commands from userspace NPU_OP_RESIZE is a U85-only command that the driver does not yet implement. The existing WARN_ON(1) placeholder fires unconditionally whenever userspace submits this command via DRM_IOCTL_ETHOSU_GEM_CREATE, causing unbounded kernel log spam. If panic_on_warn is set the kernel panics, giving any unprivileged user with access to the DRM device a trivial denial-of-service primitive. Replace the WARN_ON(1) with an explicit -EINVAL return so the ioctl rejects the command before it reaches hardware. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260523210840.92039-2-meatuni001@gmail.com Signed-off-by: Rob Herring (Arm) commit 00f547e0dfecf83014fb32bcba587c6b684c1362 Author: Muhammad Bilal Date: Sat May 23 19:51:59 2026 +0000 accel/ethosu: fix IFM region index out-of-bounds in command stream parser NPU_SET_IFM_REGION extracts the region index with param & 0x7f, giving a maximum value of 127. However region_size[] and output_region[] in struct ethosu_validated_cmdstream_info are both sized to NPU_BASEP_REGION_MAX (8), giving valid indices [0..7]. Every other region assignment in the same switch uses param & 0x7: NPU_SET_OFM_REGION: st.ofm.region = param & 0x7; NPU_SET_IFM2_REGION: st.ifm2.region = param & 0x7; NPU_SET_WEIGHT_REGION: st.weight[0].region = param & 0x7; NPU_SET_SCALE_REGION: st.scale[0].region = param & 0x7; The 0x7f mask on IFM is inconsistent and appears to be a typo. feat_matrix_length() and calc_sizes() use the region index directly as an array subscript into the kzalloc'd info struct: info->region_size[fm->region] = max(...); A userspace caller supplying NPU_SET_IFM_REGION with param > 7 causes a write up to 127*8 = 1016 bytes past the start of region_size[], corrupting adjacent kernel heap data. Fix by applying the same & 0x7 mask used by all other region assignments. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Link: https://patch.msgid.link/20260523195159.55801-1-meatuni001@gmail.com Signed-off-by: Rob Herring (Arm) commit ddd664bbff63e09e7a7f9acae9c43605d4cf185f Merge: 44ed32d16c9d0e b6197b386677ae Author: Linus Torvalds Date: Thu Jun 4 14:35:55 2026 -0700 Merge tag 'net-7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from Netfilter, wireless and Bluetooth. Current release - fix to a fix: - Bluetooth: MGMT: fix backward compatibility with bluetoothd which adds stray bytes to MGMT_OP_ADD_EXT_ADV_DATA Previous releases - regressions: - af_unix: fix inq_len update inaccuracy on partial read - eth: fec: fix pinctrl default state restore order on resume - wifi: iwlwifi: - mvm: don't support the reset handshake for old firmwares - pcie: simplify the resume flow if fast resume is not used, work around NIC access failures Previous releases - always broken: - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - sctp: fix a couple of bugs in COOKIE_ECHO processing - sched: fix pedit partial COW leading to page cache corruption - wifi: nl80211: reject oversized EMA RNR lists - netfilter: - conntrack_irc: fix possible out-of-bounds read - bridge: make ebt_snat ARP rewrite writable - appletalk: zero-initialize aarp_entry to prevent heap info leak - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - mptcp: fix number of bugs reported by AI scans and discovered during NVMe over MPTCP testing" * tag 'net-7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (85 commits) Reapply "bnxt_en: bring back rtnl_lock() in the bnxt_open() path" udp: clear skb->dev before running a sockmap verdict sctp: purge outqueue on stale COOKIE-ECHO handling bonding: annotate data-races arcound churn variables net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr rtase: Avoid sleeping in get_stats64() ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() ipv6: mcast: Fix use-after-free when processing MLD queries selftests: net: add vxlan vnifilter notification test vxlan: vnifilter: fix spurious notification on VNI update vxlan: vnifilter: send notification on VNI add rtase: Reset TX subqueue when clearing TX ring octeontx2-af: npc: Fix CPT channel mask in npc_install_flow dt-bindings: ethernet: eswin: fix hsp-sp-csr backward compatibility sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing net/sched: fix pedit partial COW leading to page cache corruption vsock/vmci: fix sk_ack_backlog leak on failed handshake net: bonding: fix NULL pointer dereference in bond_do_ioctl() geneve: fix length used in GRO hint UDP checksum adjustment net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown ... commit 9317df76ca54bf837eb97e0f372e8fc14e4d6fe6 Merge: 36cda56d7e44e9 ec4cbdd163f9bb Author: Dave Airlie Date: Fri Jun 5 07:18:09 2026 +1000 Merge tag 'drm-xe-fixes-2026-06-04' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Revert removing support for unpublished NVL-S GuC (Daniele) - Suspend fixes related to multi-queue (Niranjana) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aiHPGiPrAyHgwBZl@intel.com commit 44ed32d16c9d0e0f3a4b594982a2bb168d2f56ea Merge: 6a08076f009e3d 0652a3daa78723 Author: Linus Torvalds Date: Thu Jun 4 13:38:42 2026 -0700 Merge tag 'trace-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fix from Steven Rostedt: - Fix CFI violation in probestub function The probestub is a function to allow tprobes to hook to a tracepoint to gain access to its parameters. The function itself is only referenced by the tracepoint structure which lives in the __tracepoint section. objtool explicitly ignores that section and when processing functions in the kernel, if it detects one that has no references it will seal it to have its ENDBR stripped on boot up. This means the probstub function will have its ENDBR stripped and if a tprobe is attached to it with IBT enabled, it will go *boom*. * tag 'trace-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix CFI violation in probestub being called by tprobes commit 2eeb342aff66477e0db9833a6393e581a6dac4f3 Author: Michel Dänzer Date: Mon May 18 17:48:09 2026 +0200 drm/amd/display: Consult MCCS FreeSync cap only if requested & supported When the do_mccs parameter is false, we don't call dm_helpers_read_mccs_caps, so sink->mccs_caps.freesync_supported is unlikely to be true. Fixes: 6f71d5dd3206 ("drm/amd/display: Read sink freesync support via mccs") Bug: https://gitlab.freedesktop.org/drm/amd/-/work_items/5286 Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher (cherry picked from commit 115bf5ca318e18a3dc1888ec6271c7052774952a) commit a50676d5a72a26829d4885ff7d62df8d82f462b1 Author: Yongqiang Sun Date: Tue Jun 2 09:59:44 2026 -0400 drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap, set debug_trap_enabled, taken an extra process reference, and opened the debug event file. Return -EFAULT without unwinding that state, leaving inconsistent trap state and a refcount imbalance that could break later DISABLE/ENABLE. On copy_to_user failure, deactivate the trap and undo the rest of the enable setup before returning. Signed-off-by: Yongqiang Sun Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 01112e241e37f9ac98b6f418d93ce2e0b87b7ee0) commit 9c6ffdb41fa5dcf47a262c656e9f443d0d26049c Author: Sunday Clement Date: Tue May 19 10:02:30 2026 -0400 drm/amdkfd: Add bounds check for AMDKFD_IOC_WAIT_EVENTS The kfd_wait_on_events ioctl passes a user-supplied num_events parameter directly to alloc_event_waiters() which calls kcalloc() without validation. This allows unprivileged users with /dev/kfd access to trigger large kernel memory allocations, potentially causing memory exhaustion and denial of service via the OOM killer. Add a check to reject num_events values exceeding KFD_SIGNAL_EVENT_LIMIT (4096), which is the maximum number of events a single process can create. Signed-off-by: Sunday Clement Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher (cherry picked from commit 39eb6da7acee8d0cc12a8959235b590f295d7b4c) commit 40396ffdf6120e2380706c59e1a84d7e765a37b6 Author: Christian König Date: Wed Feb 25 15:12:02 2026 +0100 drm/amdgpu: restart the CS if some parts of the VM are still invalidated Make sure that we only submit work with full up to date VM page tables. Backport to 7.1 and older. Signed-off-by: Christian König Reviewed-by: Vitaly Prosyak Tested-by: Vitaly Prosyak Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 59720bfd8c6dbebeb8d5a7ab64241b007efd9213) Cc: stable@vger.kernel.org commit d097095dda7449f85d963911584112555071b2f5 Author: David Rosca Date: Sat Sep 13 16:51:02 2025 +0200 drm/amdgpu/userq: Fix reading timeline points in wait ioctl Use correct u64 type. Signed-off-by: David Rosca Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 0ac98160dfb6ab3c6d7b38e0ff9687780beed9cb) commit 3b347d011773d147b62f84ec60a7824629148be2 Author: Yongqiang Sun Date: Wed May 27 09:50:47 2026 -0400 drm/amdkfd: fix SMI event cross-process information leak kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers. Signed-off-by: Yongqiang Sun Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 92a8dba246d371fe268280e5fd74b0955688e6df) commit 6a08076f009e3d9460bebae9f209c1dc1d8a46b7 Merge: 9154c4af7829b6 7c6535c37dbc03 Author: Linus Torvalds Date: Thu Jun 4 12:31:20 2026 -0700 Merge tag 's390-7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Enable IOMMUFD and VFIO cdev such that PCI pass-through to QEMU/KVM can optionally utilize native IOMMUFD - With HAVE_ARCH_BUG_FORMAT enabled the BUG infrastructure might misinterpret flags or fault. Fix this by moving the "format" field emission into __BUG_ENTRY() - The generic version of _THIS_IP_ is known to be brittle and may break with current and future GCC and Clang optimizations. Fix it by overriding _THIS_IP_ * tag 's390-7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: Implement _THIS_IP_ using inline asm s390/bug: Always emit format word in __BUG_ENTRY s390/configs: Enable IOMMUFD and VFIO cdev in defconfigs commit b6197b386677ae5268d4702e23849d9ad53051ad Author: Jakub Kicinski Date: Wed Jun 3 12:58:45 2026 -0700 Reapply "bnxt_en: bring back rtnl_lock() in the bnxt_open() path" This reverts commit 850d9248d2eac662f869c766a598c877690c74e5. This reapplies commit 325eb217e41f ("bnxt_en: bring back rtnl_lock() in the bnxt_open() path"). Breno reports a lockdep warning in bnxt. During FW reset the driver may end up calling netif_set_real_num_tx_queues() (if queue count changes), so calls to bnxt_open() still require rtnl_lock. net/sched/sch_generic.c:1416 suspicious rcu_dereference_protected() usage! dev_qdisc_change_real_num_tx+0x54/0xe0 netif_set_real_num_tx_queues+0x4ed/0xa80 __bnxt_open_nic+0x9cb/0x3490 bnxt_open+0x1cb/0x370 bnxt_fw_reset_task+0x80d/0x1e80 process_scheduled_works+0x9c1/0x13b0 The reverted commit was just an optimization / experiment so let's go back to taking the lock. Reported-by: Breno Leitao Link: https://lore.kernel.org/ah726OtFX-Qw3U-R@gmail.com Fixes: 850d9248d2ea ("Revert "bnxt_en: bring back rtnl_lock() in the bnxt_open() path"") Acked-by: Stanislav Fomichev Reviewed-by: Michael Chan Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260603195845.2574426-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3c94f241f776562c489876ff506f366224565c21 Author: Sechang Lim Date: Wed Jun 3 16:27:33 2026 +0000 udp: clear skb->dev before running a sockmap verdict On the UDP receive path skb->dev is repurposed as dev_scratch (the truesize/state cache set by udp_set_dev_scratch()), through the union { struct net_device *dev; unsigned long dev_scratch; } in sk_buff. When a UDP socket is in a sockmap, sk_data_ready is sk_psock_verdict_data_ready(), which calls udp_read_skb() -> recv_actor() (sk_psock_verdict_recv) to run the attached SK_SKB verdict program in softirq. If that program calls a socket-lookup helper (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp), bpf_skc_lookup() does: if (skb->dev) caller_net = dev_net(skb->dev); skb->dev still holds the dev_scratch value (a non-NULL integer), so dev_net() dereferences it as a struct net_device * and the kernel takes a general protection fault on a non-canonical address in softirq: Oops: general protection fault, probably for non-canonical address 0x1010000800004a0 CPU: 1 UID: 0 PID: 1406 Comm: syz.2.19 Not tainted 7.1.0-rc6 #1 PREEMPT(full) RIP: 0010:bpf_skc_lookup net/core/filter.c:7033 [inline] RIP: 0010:bpf_sk_lookup+0x45/0x160 net/core/filter.c:7047 Call Trace: bpf_prog_4675cb904b7071f8+0x12e/0x14e bpf_prog_run_pin_on_cpu+0xc6/0x1f0 sk_psock_verdict_recv+0x1ba/0x350 udp_read_skb+0x31a/0x370 sk_psock_verdict_data_ready+0x2e3/0x600 __udp_enqueue_schedule_skb+0x4c8/0x650 udpv6_queue_rcv_one_skb+0x3ec/0x740 udp6_unicast_rcv_skb+0x11d/0x140 ip6_protocol_deliver_rcu+0x61e/0x950 ip6_input_finish+0xa9/0x150 NF_HOOK+0x286/0x2f0 ip6_input+0x117/0x220 NF_HOOK+0x286/0x2f0 __netif_receive_skb+0x85/0x200 process_backlog+0x374/0x9a0 __napi_poll+0x4f/0x1c0 net_rx_action+0x3b0/0x770 handle_softirqs+0x15a/0x460 do_softirq+0x57/0x80 The rmem charge that dev_scratch accounted for is released by skb_recv_udp() on dequeue, just above, so the scratch is dead by the time recv_actor() runs. Clear skb->dev so bpf_skc_lookup() falls back to sock_net(skb->sk), which skb_set_owner_sk_safe() set just above. Fixes: 965b57b469a5 ("net: Introduce a new proto_ops ->read_skb()") Cc: stable@vger.kernel.org Signed-off-by: Sechang Lim Reviewed-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260603162737.697215-1-rhkrqnwk98@gmail.com Signed-off-by: Jakub Kicinski commit e374b22e9b07b72a25909621464ff74096151bfb Author: Xin Long Date: Wed Jun 3 14:11:44 2026 -0400 sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths. Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Zhengchuan Liang Reported-by: Xin Liu Reported-by: Yuqi Xu Reported-by: Ren Wei Signed-off-by: Xin Long Link: https://patch.msgid.link/94318159b9052907a6cbb7256aee8b5f8dfbfccb.1780510304.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit b47ff80f280e18ad2310f44293cc057d9b64ff11 Author: Eric Dumazet Date: Wed Jun 3 12:35:14 2026 +0000 bonding: annotate data-races arcound churn variables These fields are updated asynchronously by the bonding state machine in ad_churn_machine() while holding bond->mode_lock. bond_info_show_slave() and bond_fill_slave_info() read them without bond->mode_lock being held, we need to add READ_ONCE() and WRITE_ONCE() annotations. Note that AD_CHURN_MONITOR, AD_CHURN, and AD_NO_CHURN are defined exclusively in (kernel private) include/net/bond_3ad.h header. They should be moved to include/uapi/linux/if_bonding.h or userspace tools will have to hardcode their values. Fixes: 4916f2e2f3fc ("bonding: print churn state via netlink") Fixes: 14c9551a32eb ("bonding: Implement port churn-machine (AD standard 43.4.17).") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260603123514.388226-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7561c7fbc694308da73300f036719e63e42bf0b4 Author: Yizhou Zhao Date: Wed Jun 3 14:00:13 2026 +0800 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr In mrp_pdu_parse_vecattr(), vector attribute events are encoded three per byte and valen tracks the number of events left to process. The parser decrements valen after processing the first and second events from each event byte, but not after processing the third one. When valen is exactly a multiple of three, the loop continues after the last valid event and consumes the next byte as a new event byte, applying a spurious event to the MRP applicant state. Additionally, when valen is zero the parser unconditionally consumes attrlen bytes as FirstValue and advances the offset, even though per IEEE 802.1ak a VectorAttribute with only a LeaveAllEvent has valen of zero and no FirstValue or Vector fields. This corrupts the offset for subsequent PDU parsing. Also, when valen exceeds three the loop crosses byte boundaries but the attribute value is not incremented between the last event of one byte and the first event of the next. This causes the first event of the next byte to use the same attribute value as the third event rather than the next consecutive value. Decrement valen after processing the third event, skip FirstValue consumption when valen is zero, and increment the attribute value at the end of each loop iteration. Fixes: febf018d2234 ("net/802: Implement Multiple Registration Protocol (MRP)") Reported-by: Yizhou Zhao Reported-by: Yuxiang Yang Reported-by: Ao Wang Reported-by: Xuewei Feng Reported-by: Qi Li Reported-by: Ke Xu Signed-off-by: Yizhou Zhao Link: https://patch.msgid.link/20260603060016.21522-1-zhaoyz24@mails.tsinghua.edu.cn Signed-off-by: Jakub Kicinski commit 9fc237f8d49f06d05f0f8e80361047b718894e81 Author: Justin Lai Date: Wed Jun 3 14:18:16 2026 +0800 rtase: Avoid sleeping in get_stats64() The .ndo_get_stats64 callback must not sleep because it can be called when reading /proc/net/dev. rtase_get_stats64() calls rtase_dump_tally_counter(), which polls the tally counter dump bit with read_poll_timeout(). This may sleep while waiting for the hardware counter dump to complete. Use read_poll_timeout_atomic() instead to avoid sleeping in the get_stats64() path. Fixes: 079600489960 ("rtase: Implement net_device_ops") Cc: stable@vger.kernel.org Signed-off-by: Justin Lai Link: https://patch.msgid.link/20260603061816.31356-1-justinlai0215@realtek.com Signed-off-by: Jakub Kicinski commit 3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3 Author: Eric Dumazet Date: Wed Jun 3 07:29:55 2026 +0000 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interface (configured by the user or test case). Since the packet is not IPv6, the 6LoWPAN header_ops->create function (lowpan_header_create or header_create) returns early without initializing the lowpan_addr_info structure in the skb headroom. In the transmit function (lowpan_xmit), the driver calls lowpan_header (or setup_header) which unconditionally copies and uses the lowpan_addr_info from the headroom, which contains uninitialized data. Fix this by dropping non IPv6 packets. A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit(). Fixes: 4dc315e267fe ("ieee802154: 6lowpan: move transmit functionality") Reported-by: syzbot+f13c19f75e1097abd116@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a1fd763.278b5b03.2bcf39.0049.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: Miquel Raynal Link: https://patch.msgid.link/20260603072955.4032221-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 791c91dc7a9dfb2457d5e29b8216a6484b9c4b40 Author: Ido Schimmel Date: Wed Jun 3 13:18:11 2026 +0300 ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer is later dereferenced without being reloaded despite the fact that the skb header might have been reallocated following the pskb_may_pull() calls, leading to a use-after-free [1]. Fix by copying the multicast group address when the packet is initially parsed. [1] BUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512) Read of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118 Workqueue: mld mld_query_work Call Trace: dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_address_description.constprop.0 (mm/kasan/report.c:378) print_report (mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) __mld_query_work (net/ipv6/mcast.c:1512) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) [...] Freed by task 118: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) pskb_expand_head (net/core/skbuff.c:2335) __pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4)) __mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1)) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Fixes: 97300b5fdfe2 ("[MCAST] IPv6: Check packet size when process Multicast") Reported-by: Leo Lin Reviewed-by: David Ahern Signed-off-by: Ido Schimmel Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260603101811.612594-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 05ef0afa1bd63ae36a594e9b8e92057660e3b3a2 Merge: ab1ecaabe74b7d 8df1c84e7272a5 Author: Jakub Kicinski Date: Thu Jun 4 08:47:48 2026 -0700 Merge branch 'vxlan-vnifilter-fix-vni-add-update-notifications' Andy Roulin says: ==================== vxlan: vnifilter: fix VNI add/update notifications When a vxlan device has vnifilter enabled, userspace observers (e.g., bridge monitor vni) miss VNI add events and see spurious notifications on no-op VNI re-adds. Patch 1 fixes the missing notification on VNI add: vxlan_vni_add() guarded the notification on a 'changed' flag that vxlan_vni_update_group() only sets when a multicast group or remote is supplied, so VNIs added without a group (e.g., L3 VXLAN) were silently created. Patch 2 fixes the spurious notification on VNI update: vxlan_vni_update() tested 'if (changed)' against a bool pointer instead of dereferencing it, so every re-add produced a notification regardless of whether anything actually changed. Patch 3 adds a selftest covering both bugs along with a few related cases (add with remote, remote update, delete-nonexistent). ==================== Link: https://patch.msgid.link/20260602185138.253265-1-aroulin@nvidia.com Signed-off-by: Jakub Kicinski commit 8df1c84e7272a5e24b563df7e50111dc81014d4a Author: Andy Roulin Date: Tue Jun 2 11:51:38 2026 -0700 selftests: net: add vxlan vnifilter notification test Add a selftest for VXLAN vnifilter netlink notifications that verifies RTM_NEWTUNNEL and RTM_DELTUNNEL are sent correctly when VNIs are added, deleted, or updated, and that no spurious notifications are sent when a VNI is re-added with the same attributes. Signed-off-by: Andy Roulin Acked-by: Petr Machata Link: https://patch.msgid.link/20260602185138.253265-4-aroulin@nvidia.com Signed-off-by: Jakub Kicinski commit 84683b5b60c7274e2c8f7f413d39d78d3db5540f Author: Andy Roulin Date: Tue Jun 2 11:51:37 2026 -0700 vxlan: vnifilter: fix spurious notification on VNI update When a VNI is re-added with the same attributes (e.g. same group or no group), vxlan_vni_update() sends a spurious RTM_NEWTUNNEL notification even though nothing changed. The bug is that 'if (changed)' tests whether the pointer is non-NULL, not the bool value it points to. Since every caller passes a valid pointer, the condition is always true and the notification fires unconditionally. Fix by dereferencing the pointer: 'if (*changed)'. Reproducer: # ip link add vxlan100 type vxlan dstport 4789 local 10.0.0.1 \ nolearning external vnifilter # ip link set vxlan100 up # bridge monitor vni & # bridge vni add vni 1000 dev vxlan100 # bridge vni add vni 1000 dev vxlan100 # spurious notification Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device") Signed-off-by: Andy Roulin Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260602185138.253265-3-aroulin@nvidia.com Signed-off-by: Jakub Kicinski commit aa6ca1c5c338907817374b59f7551fd855a88754 Author: Andy Roulin Date: Tue Jun 2 11:51:36 2026 -0700 vxlan: vnifilter: send notification on VNI add When a new VNI is added to a vxlan device with vnifilter enabled, no RTM_NEWTUNNEL notification is sent to userspace. This means 'bridge monitor vni' never shows VNI add events, even though VNI delete events are reported correctly. The bug is in vxlan_vni_add(), where the notification is guarded by 'if (changed)'. The 'changed' flag is set by vxlan_vni_update_group() only when the multicast group or remote IP is modified, but for a new VNI added without a group (e.g. in L3 VxLAN interface scenarios), the function returns early without setting changed=true. Since this is a new VNI, the notification should be sent unconditionally. The notification is not guarded by the return value of vxlan_vni_update_group() because, at this point, the VNI has already been inserted into the hash table and list with no rollback on error. The VNI will be visible in 'bridge vni show' regardless, so userspace should be informed. This is consistent with vxlan_vni_del() which also notifies unconditionally. The 'if (changed)' guard remains correct in vxlan_vni_update(), which handles the case where a VNI already exists and is being re-added -- there, we only want to notify if the group/remote actually changed. Reproducer: # ip link add vxlan100 type vxlan dstport 4789 local 10.0.0.1 \ nolearning external vnifilter # ip link set vxlan100 up # bridge monitor vni & # bridge vni add vni 1000 dev vxlan100 # no notification # bridge vni delete vni 1000 dev vxlan100 # notification received Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device") Reported-by: Chirag Shah Signed-off-by: Andy Roulin Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260602185138.253265-2-aroulin@nvidia.com Signed-off-by: Jakub Kicinski commit ab1ecaabe74b7d86c38ab2ab44bd56cdcc33645a Author: Justin Lai Date: Tue Jun 2 19:46:59 2026 +0800 rtase: Reset TX subqueue when clearing TX ring rtase_tx_clear() clears the TX ring and resets the ring indexes. However, the TX queue state and BQL accounting are not reset at the same time. This may leave __QUEUE_STATE_STACK_XOFF asserted after rtase_sw_reset(), preventing new TX packets from being scheduled. Reset the TX subqueue when clearing the TX ring so the TX queue state and BQL accounting are restored together. Fixes: 5a2a2f15244c ("rtase: Implement the rtase_down function") Cc: stable@vger.kernel.org Signed-off-by: Justin Lai Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20260602114659.12335-1-justinlai0215@realtek.com Signed-off-by: Jakub Kicinski commit 1d31eb27e570daa04f5373345f9ac98c95863be9 Author: Nithin Dabilpuram Date: Tue Jun 2 10:28:53 2026 +0530 octeontx2-af: npc: Fix CPT channel mask in npc_install_flow Use the CPT-aware NIX channel mask in the npc_install_flow path so that when the host PF installs steering rules in kernel for a VF used from userspace (e.g. DPDK), MCAM entries see the same channel mask semantics as other RX paths. Fixes: 56bcef528bd8 ("octeontx2-af: Use npc_install_flow API for promisc and broadcast entries") Cc: Naveen Mamindlapalli Signed-off-by: Nithin Dabilpuram Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260602045853.1558530-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 1232b3104b4b2c0267f31608fe0f8a8758428f28 Author: Zhi Li Date: Tue Jun 2 09:45:28 2026 +0800 dt-bindings: ethernet: eswin: fix hsp-sp-csr backward compatibility Commit c36069c6f46c ("dt-bindings: ethernet: eswin: add optional TXD and RXD delay register offsets") added two optional cells to eswin,hsp-sp-csr but omitted minItems: 4. As a result, dt-schema implicitly required all 6 cells, which broke backward compatibility with existing 4-cell device trees. Add minItems: 4 to preserve backward compatibility. Fixes: c36069c6f46c ("dt-bindings: ethernet: eswin: add optional TXD and RXD delay register offsets") Reported-by: Sashiko AI Closes: https://lore.kernel.org/all/20260519022334.35742C2BCB7@smtp.kernel.org/ Reviewed-by: Krzysztof Kozlowski Signed-off-by: Zhi Li Link: https://patch.msgid.link/20260602014528.2076-1-lizhi2@eswincomputing.com Signed-off-by: Jakub Kicinski commit 0861615c28de668669d748ef4eb913ea9262d13b Author: Xin Long Date: Mon Jun 1 21:06:06 2026 -0400 sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Brian Geffon Signed-off-by: Xin Long Link: https://patch.msgid.link/eb60825fa22d6f9e663c7d4dbb69f397b5d34d42.1780362366.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 899ee91156e57784090c5565e4f31bd7dbffbc5a Author: Rajat Gupta Date: Sun May 31 08:32:21 2026 -0400 net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined. Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable") Reported-by: Yiming Qian Reported-by: Keenan Dong Reported-by: Han Guidong <2045gemini@gmail.com> Reported-by: Zhang Cen Reviewed-by: Han Guidong <2045gemini@gmail.com> Tested-by: Han Guidong <2045gemini@gmail.com> Reviewed-by: Davide Caratti Tested-by: Davide Caratti Reviewed-by: Toke Høiland-Jørgensen Tested-by: Toke Høiland-Jørgensen Reviewed-by: Victor Nogueira Tested-by: Victor Nogueira Acked-by: Jamal Hadi Salim Signed-off-by: Rajat Gupta Link: https://patch.msgid.link/20260531123221.48732-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit d76b56b06b2734c6e0ff519599126919fa4f154b Author: Lianqin Hu Date: Thu Jun 4 12:40:28 2026 +0000 ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: new full-speed USB device number 2 using xhci-hcd usb 1-1: New USB device found, idVendor=3c20, idProduct=3d21 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: AB13X USB Audio usb 1-1: Manufacturer: Generic usb 1-1: SerialNumber: 20210726905926 Signed-off-by: Lianqin Hu Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/TYUPR06MB62174610061C213260E1A992D2102@TYUPR06MB6217.apcprd06.prod.outlook.com commit 88fe2e3658726cb21ff2dcf9770bf672f9b9d31b Author: Ji'an Zhou Date: Thu Jun 4 14:25:59 2026 +0000 ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add_wait_queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake_up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait_queue_head_t), causing a kernel panic. Replace init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/ finish_wait. init_wait_entry clears prev/next via INIT_LIST_HEAD on each iteration and sets autoremove_wake_function which auto-removes the entry on wake-up. finish_wait safely handles both the already-removed and still-queued cases. Fixes: 9b1dbd69ba6f ("ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain") Signed-off-by: Ji'an Zhou Link: https://patch.msgid.link/20260604142559.3840881-1-eilaimemedsnaimel@gmail.com Signed-off-by: Takashi Iwai commit b734412619821f3ed63ba63533f539672cb7a76d Merge: aa2f4addab4440 d2dcd85f9e09fe Author: Takashi Iwai Date: Thu Jun 4 17:21:01 2026 +0200 Merge tag 'asoc-fix-v7.1-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.1 There's only one actual fix here, for the TDM configuration on the Freescale SAI controller, everytihng else is DMI quirks for AMD systems. One of those is relatively large as it adds a bunch of different structs but it's all data. commit df996599cc69a9b74ff437c67751cf8a61f62e39 Author: Gabriele Monaco Date: Thu May 14 17:20:48 2026 +0200 verification/rvgen: Fix ltl2k writing True as a literal The rvgen parser for LTL stores literal true values in the python representation (capitalised True), this doesn't build in C. The Literal class should already handle this case but ASTNode skips its strigification method and converts the value (true/false) directly. Fix by delegating ASTNode stringification to the Literal and Variable classes instead of bypassing them. Fixes: 97ffa4ce6ab32 ("verification/rvgen: Add support for linear temporal logic") Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260514152055.229162-8-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 5f845ad706c0b394ae274e9a930044f78bef782e Author: Gabriele Monaco Date: Thu May 14 17:20:47 2026 +0200 verification/rvgen: Fix options shared among commands After rvgen was refactored to use subparsers, the common options (-a and -D) were left in the main parser. This meant that they needed to be called /before/ the subcommand and using them without subcommand was allowed. This is not the original intent. rvgen -D "some description" container -n name Define the options as parent in the subparsers to allow them to be used from both subcommands together with other options. rvgen container -n name -D "some description" Fixes: 5270a0e3041c ("verification/dot2k: Replace is_container() hack with subparsers") Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260514152055.229162-7-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 85339442de941e4d7ff5d53f51ae1413905e45ec Author: Gabriele Monaco Date: Mon Jun 1 17:38:38 2026 +0200 verification/rvgen: Fix suffix strip in dot2k __start_to_invariant_check() and __get_constraint_env() parse the environment variable's name from sources that have it padded with the monitor name. This is removed using rstrip(), which is not meant to strip a substring but rather a set of characters. Use removesuffix() to actually get rid of the trailing _. Fixes: a82adadb16894 ("verification/rvgen: Add support for Hybrid Automata") Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-12-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 33ec2269a4155cad7e9e42c92327dcaa9aee59a7 Author: Gabriele Monaco Date: Thu May 14 17:20:45 2026 +0200 tools/rv: Fix cleanup after failed trace setup Currently if ikm_setup_trace_instance() fails, the tool returns without any cleanup, if rv was called with both -t and -r, this means the reactor is not going to be cleared. Jump to the cleanup label to restore the reactor if necessary. Fixes: 6d60f89691fc9 ("tools/rv: Add in-kernel monitor interface") Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260514152055.229162-5-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit ba0247c5aa3fcb2890a92a97a88c70fe5ce704a6 Author: Gabriele Monaco Date: Thu May 14 17:20:43 2026 +0200 tools/rv: Fix substring match when listing container monitors When listing monitors within a specific container (rv list ), the tool incorrectly matched monitors if the requested container name was only a prefix of the actual container (e.g., 'rv list sche' would incorrectly list monitors from 'sched:'). Fix this by ensuring the container name is an exact match and is immediately followed by the ':' separator. Fixes: eba321a16fc6 ("tools/rv: Add support for nested monitors") Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260514152055.229162-3-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit a963fbf3166f2e178ac38b6c3c186a0c98092fb9 Author: Gabriele Monaco Date: Thu May 14 17:20:42 2026 +0200 tools/rv: Fix substring match bug in monitor name search __ikm_find_monitor_name() relies on strstr() to find a monitor by name, which fails if the target monitor is a substring of a previously listed monitor. Fix it by tokenizing the available_monitors file and matching full tokens instead. Fixes: eba321a16fc6 ("tools/rv: Add support for nested monitors") Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260514152055.229162-2-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 08904765bb941f98306ae6841c33cfd299343faf Author: Gabriele Monaco Date: Thu Jun 4 14:09:45 2026 +0200 tools/rv: Ensure monitor name and desc are NUL-terminated ikm_fill_monitor_definition() copies monitor name and description with strncpy(), but does not guarantee NUL termination when source strings are equal to or longer than the destination buffers. Clamp copies to sizeof(dst) - 1 and explicitly append '\0' for both fields to keep them safe for later string operations. Suggested-by: unknownbbqrx Fixes: 6d60f89691fc9 ("tools/rv: Add in-kernel monitor interface") Link: https://lore.kernel.org/r/20260604120946.90302-2-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 6bf7e2affc6e62da7add393d7f352d4040f5bc27 Author: Maíra Canal Date: Sun May 31 17:18:55 2026 -0300 drm/v3d: Fix global performance monitor reference counting In the SET_GLOBAL ioctl, v3d_perfmon_find() bumps the reference count on the perfmon it returns, but v3d_perfmon_set_global_ioctl() and v3d_perfmon_delete() fail to release that reference on several paths: 1. v3d_perfmon_set_global_ioctl() leaks the reference on its error paths. 2. CLEAR_GLOBAL leaks both the find reference and the reference previously stashed in v3d->global_perfmon by the SET_GLOBAL ioctl that configured it. 3. Destroying a perfmon that is the current global perfmon leaks the reference stashed by the SET_GLOBAL ioctl. Release each of these references explicitly. Cc: stable@vger.kernel.org Fixes: c6eabbab359c ("drm/v3d: Add DRM_IOCTL_V3D_PERFMON_SET_GLOBAL") Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260531-v3d-perfmon-lifetime-v2-1-60ed4485a203@igalia.com Signed-off-by: Maíra Canal commit ec4cbdd163f9bb2a2bd44eb93ecf4a2fa0e912a9 Author: Niranjana Vishwanathapura Date: Wed Jun 3 16:39:47 2026 -0700 drm/xe/multi_queue: skip submit when primary queue is suspended Return early in submit path when the multi-queue primary exec queue is suspended to avoid submitting while suspended. v2: Remove idle_skip_suspend fix as that feature is being reverted here https://patchwork.freedesktop.org/series/167262/ Fixes: bc5775c59258 ("drm/xe/multi_queue: Add GuC interface for multi queue support") Cc: stable@vger.kernel.org # v7.0+ Assisted-by: GitHub-Copilot:claude-sonnet-4.6 Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Niranjana Vishwanathapura Link: https://patch.msgid.link/20260603233946.863663-2-niranjana.vishwanathapura@intel.com (cherry picked from commit b7fb55cc3364ca128cfff9d50649ffd4327cd01e) Signed-off-by: Rodrigo Vivi commit 54f2a0442a30fe7a0f6bc8345e81f8b2db8effbd Author: Tangudu Tilak Tirumalesh Date: Wed Jun 3 12:22:16 2026 +0530 drm/xe: Clear pending_disable before signaling suspend fence In the schedule-disable done path for suspend, we signal the suspend fence before clearing pending_disable. That wakeup can let suspend_wait complete and resume be queued immediately. The resume path may then reach enable_scheduling() while pending_disable is still set and hit the !exec_queue_pending_disable(q) assertion. Fix this by clearing pending_disable before signaling the suspend fence, so any resumed transition observes a consistent state. Fixes: 87651f31ae4e ("drm/xe/guc_submit: fix race around suspend_pending") Cc: stable@vger.kernel.org # v7.0+ Signed-off-by: Tangudu Tilak Tirumalesh Reviewed-by: Thomas Hellstrom Signed-off-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260603065217.3131066-3-tilak.tirumalesh.tangudu@intel.com (cherry picked from commit 4b1ae138b0e103d753773956a84eebc2edbf62c4) Signed-off-by: Rodrigo Vivi commit fa7c84726dc217ce0c183926ef9411636c7a2213 Author: Tangudu Tilak Tirumalesh Date: Wed Jun 3 12:22:15 2026 +0530 Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" This reverts commit 8533051ce92015e9cc6f75e0d52119b9d91610b6. The idle-skip optimization bypasses GuC suspend, so the GPU may not perform the context switch that flushes TLB entries for invalidated userptr VMAs. In LR/preempt-fence VM mode, this can lead to missed TLB invalidation and page faults during userptr invalidation tests. Restore unconditional schedule toggling on suspend so the context-switch TLB flush is always performed. This optimization will be reintroduced with a fix that does not skip suspend in LR/preempt-fence VM mode. Fixes: 8533051ce920 ("drm/xe: Skip exec queue schedule toggle if queue is idle during suspend") Cc: stable@vger.kernel.org # v7.0+ Suggested-by: Thomas Hellstrom Signed-off-by: Tangudu Tilak Tirumalesh Reviewed-by: Thomas Hellstrom Signed-off-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260603065217.3131066-2-tilak.tirumalesh.tangudu@intel.com (cherry picked from commit 6a1e7934d9a6cf46aecae00a99c2603d1295e170) Signed-off-by: Rodrigo Vivi commit d486b4934a8e504376b85cdb3766f306d57aff5b Author: Amit Matityahu Date: Wed Jun 3 17:01:39 2026 +0000 timers/migration: Fix livelock in tmigr_handle_remote_up() tmigr_handle_remote_cpu() skips timer_expire_remote() when cpu == smp_processor_id(), assuming the local softirq path already handled this CPU's timers. This assumption is wrong because jiffies can advance after the handling of the CPU's global timers in run_timer_base(BASE_GLOBAL) and before tmigr_handle_remote() evaluates the expiry times. As a consequence a timer which expires after the CPU local timer wheel advanced and becomes expired in the remote handling is ignored and the callback is never invoked and removed from the timer wheel. What's worse is that fetch_next_timer_interrupt_remote() keeps reporting it as expired, and the event is re-queued with expires == now on each iteration. The goto-again loop spins indefinitely. Fix this by calling timer_expire_remote() unconditionally. That's minimal overhead for the common case as __run_timer_base() returns immediately if there is nothing to expire in the local wheel. [ tglx: Amend change log and add a comment ] Fixes: 7ee988770326 ("timers: Implement the hierarchical pull model") Reported-by: Alon Kariv Signed-off-by: Amit Matityahu Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260603170139.33628-1-amitmat@amazon.com commit c05fa14db43ebef3bd862ca9d073981c0358b3f0 Author: Raf Dickson Date: Tue May 26 10:43:56 2026 +0000 vsock/vmci: fix sk_ack_backlog leak on failed handshake When vmci_transport_recv_connecting_server() returns an error, vmci_transport_recv_listen() calls vsock_remove_pending() but never calls sk_acceptq_removed(). This leaves sk_ack_backlog incremented permanently. Repeated handshake failures (malformed packets, queue pair alloc failure, event subscribe failure) cause sk_ack_backlog to climb toward sk_max_ack_backlog. Once it reaches the limit the listener permanently refuses all new connections with -ECONNREFUSED, a silent denial of service requiring a process restart to recover. The two existing sk_acceptq_removed() calls in af_vsock.c do not cover this path: line 764 checks vsock_is_pending() which returns false after vsock_remove_pending(), and line 1889 is only reached on successful accept(). Fix by balancing sk_acceptq_added() with sk_acceptq_removed() on the error path. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Cc: stable@vger.kernel.org Signed-off-by: Raf Dickson Acked-by: Stefano Garzarella Link: https://patch.msgid.link/20260526104356.469928-1-rafdog35@gmail.com Signed-off-by: Paolo Abeni commit d2dcd85f9e09fe3566d4cdcd357856a42ac73f93 Author: Aleksander Pshenitsyn Date: Sun May 31 13:11:59 2026 +0300 ASoC: amd: acp70: add standalone RT721 SoundWire machine The ASUS Vivobook 18 M1807GA (AMD ACP7.x, PCI 1022:15e2, subsystem 1043:3531) exposes a single Realtek RT721 SDCA codec on SoundWire link 1. The BIOS reports the ACP audio config flag as 0 (SoundWire mode), so snd_pci_ps claims the device, brings up the SoundWire managers and enumerates the RT721 peripheral (sdw:0:1:025d:0721:01); the rt721-sdca codec driver binds successfully. No sound card is created, however: acp63_sdw_machine_select() walks snd_soc_acpi_amd_acp70_sdw_machines[] and finds no entry whose declared SoundWire peripherals are all present on the bus. The only existing RT721 entry, acp70_rt721_l1u0_tas2783x2_l1u8b, additionally requires two TAS2783 amplifiers and deliberately exposes the RT721 as jack + DMIC only. This M1807GA variant has no external amplifiers - the RT721's internal AIF2 amplifier path drives the speakers - so that entry never matches and no machine device is registered. Add a standalone RT721 machine entry for link 1 exposing all three RT721 endpoints (jack/AIF1, speaker amplifier/AIF2, DMIC/AIF3), mirroring the standalone RT722 configuration. Place it after the TAS2783 combo entry so platforms that do have the external amplifiers continue to match the more specific entry first. ACPI _ADR of the codec: 0x000130025D072101 (link_id=1 version=3 mfg_id=0x025d Realtek part_id=0x0721 class=0x01). Verified on the hardware: with the entry present the amd_sdw machine binds, an "amd-soundwire" card is registered exposing the rt721-sdca AIF1 (SimpleJack) and AIF2 (SmartAmp) PCM devices, and audio plays out of the built-in speakers. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221282 Signed-off-by: Aleksander Pshenitsyn Link: https://patch.msgid.link/20260531101159.14241-1-brains.fatman@gmail.com Signed-off-by: Mark Brown commit cad530a8371124da988608f11df30b7dd82391ef Author: David Glushkov Date: Sun May 31 23:45:12 2026 +0200 ASoC: amd: yc: Add MSI Raider A18 HX A9WJG to quirk table The MSI Raider A18 HX A9WJG has an internal digital microphone connected through AMD ACP6x, but this machine does not expose the AcpDmicConnected ACPI property, so acp_yc_mach does not bind. Add a DMI quirk for this model. This was tested on an MSI Raider A18 HX A9WJG with board MS-182L, BIOS E182LAMS.31A, AMD ACP6x rev 0x62, and Realtek ALC274. After applying the quirk, the internal microphone appears as an acp6x DMIC capture device and records correctly. Signed-off-by: David Glushkov Link: https://patch.msgid.link/20260531214512.170716-1-david.glushkov@sntiq.com Signed-off-by: Mark Brown commit 4790af1cc2e8871fb31f28c66e42b9a949a23992 Author: Chancel Liu Date: Mon Jun 1 17:33:27 2026 +0900 ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write When configuring 32 slots TDM (channels == slots == 32), the xMR (Mask Register) write used: ~0UL - ((1 << min(channels, slots)) - 1) The literal "1" is a signed 32-bit int. Shifting it by 32 positions is undefined behaviour which may set this register to 0xFFFFFFFF, masking all 32 slots. Use GENMASK_U32() macro instead. For 32 slots this produces a zero mask: ~GENMASK_U32(31, 0) = ~0xFFFFFFFF = 0x00000000 Behaviour for fewer than 32 slots is unchanged. Fixes: 770f58d7d2c5 ("ASoC: fsl_sai: Support multiple data channel enable bits") Cc: stable@vger.kernel.org Signed-off-by: Chancel Liu Reviewed-by: Shengjiu Wang Link: https://patch.msgid.link/20260601083327.1535185-1-chancel.liu@oss.nxp.com Signed-off-by: Mark Brown commit 7f2d76c9c03257c0782afef9d95321fa04096f60 Author: Sanghyun Park Date: Tue Jun 2 18:49:05 2026 +0900 xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since the lock is already held. The wrapper xfrm_policy_inexact_prune_bin() becomes unused and is removed. Race: CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO) ========================== ========================== xfrm_policy_bysel_ctx(): spin_lock_bh(xfrm_policy_lock) bin = xfrm_policy_inexact_lookup() __xfrm_policy_unlink(pol) spin_unlock_bh(xfrm_policy_lock) xfrm_policy_kill(ret) // wide window, lock not held xfrm_hash_rebuild(): spin_lock_bh(xfrm_policy_lock) __xfrm_policy_inexact_flush(): kfree_rcu(bin) // bin freed spin_unlock_bh(xfrm_policy_lock) xfrm_policy_inexact_prune_bin(bin) // UAF: bin is freed Fixes: 6be3b0db6db8 ("xfrm: policy: add inexact policy search tree infrastructure") Signed-off-by: Sanghyun Park Signed-off-by: Steffen Klassert commit a764b0e8317a863006e05732e1aefe821b9d8c2d Author: ZhaoJinming Date: Mon Jun 1 16:56:49 2026 +0800 net: bonding: fix NULL pointer dereference in bond_do_ioctl() In bond_do_ioctl(), slave_dev is obtained via __dev_get_by_name() which can return NULL if the requested interface name does not exist. However, the subsequent slave_dbg() call is placed before the NULL check: slave_dev = __dev_get_by_name(net, ifr->ifr_slave); slave_dbg(bond_dev, slave_dev, "slave_dev=%p:\n", slave_dev); //here if (!slave_dev) return -ENODEV; The slave_dbg() macro expands to netdev_dbg(bond_dev, "(slave %s): " fmt, (slave_dev)->name, ...) which unconditionally dereferences slave_dev->name before the NULL check is performed. This results in a NULL pointer dereference kernel oops when a user calls bonding ioctl (e.g. SIOCBONDENSLAVE, SIOCBONDRELEASE, etc.) with a non-existent slave interface name. This is reachable from userspace via the bonding ioctl interface with CAP_NET_ADMIN capability, making it a potential local denial-of-service vector. Fix by moving the slave_dbg() call after the NULL check. Fixes: e2a7420df2e0 ("bonding/main: convert to using slave printk macros") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: ZhaoJinming Link: https://patch.msgid.link/20260601085649.4029067-1-zhaojinming@uniontech.com Signed-off-by: Paolo Abeni commit 0652a3daa78723f955b1ebeb621665ce72bec53e Author: Eva Kurchatova Date: Wed Jun 3 18:31:42 2026 +0300 tracing: Fix CFI violation in probestub being called by tprobes The probestub is a function to allow tprobes to hook to a tracepoint to gain access to its parameters. The function itself is only referenced by the tracepoint structure which lives in the __tracepoint section. objtool explicitly ignores that section and when processing functions in the kernel, if it detects one that has no references it will seal it to have its ENDBR stripped on boot up. This means when a tprobe is attached to the sched_wakeup tracepoint, when it is triggered it will call __probestub_sched_wakeup and due to the missing ENDBR on a CFI-enabled machine it will take a #CP exception. Fix this by adding CFI_NOSEAL annotation to probestub declaration. Cc: stable@vger.kernel.org Acked-by: Masami Hiramatsu (Google) Link: https://patch.msgid.link/20260603153147.573589-1-eva.kurchatova@virtuozzo.com Fixes: d5173f753750 ("objtool: Exclude __tracepoints data from ENDBR checks") Signed-off-by: Eva Kurchatova [ Updated change log ] Signed-off-by: Steven Rostedt commit e9e41d3035032ed6053d8bad7b7077e1cb3a6540 Author: Tomas Glozar Date: Tue Jun 2 14:55:06 2026 +0200 rtla: Fix parsing of multi-character short options A bug was reported where the parsing of multi-character short options, be it a short option with an argument specified without space (e.g. "-p100") or multiple short options in one argument (e.g. -un), ignores options specific to individual tools. Furthermore, if the rest of the option is supposed to be an argument, it gets reinterpreted as a string of options. For example, -p100 gets interpreted as -100, which is due to hackish implementation read as --no-thread --no-irq --no-irq with timerlat hist, causing rtla to error out: $ rtla timerlat hist -p100 no-irq and no-thread set, there is nothing to do here This behavior is caused by getopt_long() being called twice on each argument, once in common_parse_options(), once in [tool]_parse_args(): - common_parse_options() calls getopt_long() with an array of options common for all rtla tools, while suppressing errors (opterr = 0). - If the option fails to parse, common_parse_options() returns 0. - If 0 is returned from common_parse_options(), [tool]_parse_args() calls getopt_long() again, with its own set of options. * [tool] means one of {osnoise,timerlat}_{top,hist} At least in glibc, getopt_long() increments its internal nextchar variable even if the option is not recognized. That means that in the case of "-p100", common_parse_options() sets nextchar pointing to '1', and timerlat_hist_parse_args() sees '1', not 'p'; the same then repeats for the first and second '0'. As there is no way to restore the correct internal state of getopt_long() reliably, fix the issue by merging the common options back to the longopt array and option string of the [tool]_parse_args() functions using a macro; only the switch part is left in the original function, which is renamed to set_common_option(). Fixes: 850cd24cb6d6 ("tools/rtla: Add common_parse_options()") Reported-by: John Kacur Tested-by: John Kacur Link: https://lore.kernel.org/r/20260602125506.3325345-1-tglozar@redhat.com Signed-off-by: Tomas Glozar commit 1231623fd3b5aa6b41cce799ffb0d82e10914be4 Author: Antoine Tenart Date: Fri May 29 16:47:00 2026 +0200 geneve: fix length used in GRO hint UDP checksum adjustment In geneve_post_decap_hint the length used for adjusting the UDP checksum should be 'skb->len - gro_hint->nested_tp_offset' (UDP length) instead of 'skb->len - gro_hint->nested_nh_offset' (IP length). Fixes: fd0dd796576e ("geneve: use GRO hint option in the RX path") Cc: Paolo Abeni Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260521131436.748832-1-jhs%40mojatatu.com Signed-off-by: Antoine Tenart Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260529144713.780938-1-atenart@kernel.org Signed-off-by: Paolo Abeni commit 2eea7f44b9c8b42fd7d3a1a87c06a7cd1b99c327 Author: Joanne Koong Date: Wed Jun 3 18:18:58 2026 -0700 iomap: avoid potential null folio->mapping deref during error reporting When a buffered read fails, iomap_finish_folio_read() reports the error with fserror_report_io(folio->mapping->host, ...). This is called after ifs->read_bytes_pending has been decremented by the bytes attempted to be read. For a folio split across multiple read completions, the folio is only guaranteed to stay locked while read_bytes_pending > 0. Once iomap_finish_folio_read() decrements read_bytes_pending, another in-flight read can complete and end the read on the folio, which unlocks it. This allows truncate logic to run and detach the folio (set folio->mapping to NULL). The error reporting path then can dereference a NULL folio->mapping. As reported by Sam Sun, this is the race that can occur: CPU0: failed completion CPU1: final completion CPU2: truncate ----------------------- ---------------------- -------------- read_bytes_pending -= len finished = false /* preempted before fserror_report_io() */ read_bytes_pending -= len finished = true folio_end_read() truncate clears folio->mapping fserror_report_io( folio->mapping->host, ...) ^ NULL deref Fix this by reporting the error first before decrementing ifs->read_bytes_pending. Fixes: a9d573ee88af ("iomap: report file I/O errors to the VFS") Cc: stable@vger.kernel.org Reported-by: Sam Sun Closes: https://lore.kernel.org/linux-fsdevel/CAEkJfYPhWdd59RKmuNLJg-bkypHz7xiOwaWyNVu3A8CUqQCnvg@mail.gmail.com/ Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20260604011858.2297561-1-joannelkoong@gmail.com Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner (Amutable) commit 40ab6644b99685755f740b872c00ef40d9aa870e Author: Jann Horn Date: Wed Jun 3 21:31:57 2026 +0200 fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() may_decode_fh() accesses mount::mnt_ns without holding any locks; that means the mount can concurrently be unmounted, and the mnt_namespace can concurrently be freed after an RCU grace period. This race can happens as follows, assuming that the mount point was created by open_tree(..., OPEN_TREE_CLONE): thread 1 thread 2 RCU __do_sys_open_by_handle_at do_handle_open handle_to_path may_decode_fh is_mounted [mount::mnt_ns access] [mount::mnt_ns access] __do_sys_close fput_close_sync __fput dissolve_on_fput umount_tree class_namespace_excl_destructor namespace_unlock free_mnt_ns mnt_ns_tree_remove call_rcu(mnt_ns_release_rcu) mnt_ns_release_rcu mnt_ns_release kfree [mnt_namespace::user_ns access] **UAF** Fix it by taking rcu_read_lock() around the mount::mnt_ns access, like in __prepend_path(). Additionally, document the semantics of mount::mnt_ns, and use WRITE_ONCE() for writers that can race with lockless readers. This bug is unreachable unless one of the following is set: - CONFIG_PREEMPTION - CONFIG_RCU_STRICT_GRACE_PERIOD because it requires an RCU grace period to happen during a syscall without an explicit preemption. This doesn't seem to have interesting security impact; worst-case, it could leak the result of an integer comparison to userspace (from the level check in cap_capable()), cause an endless loop, or crash the kernel by dereferencing an invalid address. Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn Link: https://patch.msgid.link/20260603-vfs-fhandle-uaf-fix-v2-1-d05db76a5084@google.com Signed-off-by: Christian Brauner (Amutable) commit 1938fb9fe38c4f04a3f30bea44f8071c80a63be4 Author: Jack Wu Date: Thu Jun 4 10:04:40 2026 +0800 USB: serial: option: add usb-id for Dell Wireless DW5826e-m Add support for Dell DW5826e-m with USB-id 0x413c:0x81ea T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=413c ProdID=81ea Rev= 5.04 S: Manufacturer=DELL S: Product=DW5826e-m Qualcomm Snapdragon X12 Global LTE-A S: SerialNumber=358988870177734 C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#=12 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I:* If#=12 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#=13 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#=13 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Jack Wu Reviewed-by: Lars Melin Cc: stable@vger.kernel.org [ johan: reserve also interface 4 ] Signed-off-by: Johan Hovold commit 060c1daac7e0d01651cff326c8e0326b3787b272 Merge: d20da913083042 80df409e1a4836 Author: Jakub Kicinski Date: Wed Jun 3 19:15:34 2026 -0700 Merge branch 'fix-use-after-free-in-metadata-dst-teardown-in-airoha_eth-and-mtk_eth_soc-drivers' Lorenzo Bianconi says: ==================== Fix use-after-free in metadata dst teardown in airoha_eth and mtk_eth_soc drivers airoha_metadata_dst_free() and mtk_free_dev() call metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path and runs call_rcu_hurry() if refcount goes to zero. ==================== Link: https://patch.msgid.link/20260602-airoha-mtk-metadata-uaf-fix-v1-0-3aaa99d83351@kernel.org Signed-off-by: Jakub Kicinski commit 80df409e1a483676826a6c66e693dba6ac507751 Author: Lorenzo Bianconi Date: Tue Jun 2 11:21:05 2026 +0200 net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed. Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260602-airoha-mtk-metadata-uaf-fix-v1-2-3aaa99d83351@kernel.org Signed-off-by: Jakub Kicinski commit b38cae85d1c45ff189d7ecb6ac36f41cdc3d84d0 Author: Lorenzo Bianconi Date: Tue Jun 2 11:21:04 2026 +0200 net: airoha: Fix use-after-free in metadata dst teardown airoha_metadata_dst_free() runs metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, an use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed. Fixes: af3cf757d5c9 ("net: airoha: Move DSA tag in DMA descriptor") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260602-airoha-mtk-metadata-uaf-fix-v1-1-3aaa99d83351@kernel.org Signed-off-by: Jakub Kicinski commit d20da913083042203221c16bc19bd2f3c12d171f Merge: ac056099822eb6 149324fc762c2a Author: Jakub Kicinski Date: Wed Jun 3 19:07:46 2026 -0700 Merge tag 'for-net-2026-06-03' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_core: fix memory leak in error path of hci_alloc_dev() - hci_sync: reject oversized Broadcast Announcement prepend - MGMT: Fix backward compatibility with userspace - MGMT: validate advertising TLV before type checks - L2CAP: reject BR/EDR signaling packets over MTUsig - RFCOMM: validate skb length in MCC handlers - RFCOMM: hold listener socket in rfcomm_connect_ind() - ISO: Fix not releasing hdev reference on iso_conn_big_sync - ISO: Fix a use-after-free of the hci_conn pointer - ISO: Fix data-race on iso_pi fields in hci_get_route calls - SCO: Fix data-race on sco_pi fields in sco_connect - BNEP: reject short frames before parsing * tag 'for-net-2026-06-03' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: MGMT: Fix backward compatibility with userspace Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync Bluetooth: fix memory leak in error path of hci_alloc_dev() Bluetooth: bnep: reject short frames before parsing Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig Bluetooth: RFCOMM: validate skb length in MCC handlers Bluetooth: MGMT: validate advertising TLV before type checks Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() ==================== Link: https://patch.msgid.link/20260603162714.342496-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit ac056099822eb6ffba2ad5d793348bc5a8d7552f Merge: 11c31f8ee9fb65 cb9959ab5f9961 Author: Jakub Kicinski Date: Wed Jun 3 19:07:34 2026 -0700 Merge tag 'wireless-2026-06-03' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Things are finally quieting down: - iwlwifi: - FW reset handshake removal for older devices - NIC access fix in fast resume - avoid too large command for some BIOSes - fix TX power constraints in AP mode - cfg80211: - fix netlink parse overflow - fix potential 6 GHz scan memory leak - enforce HE/EHT consistency to avoid mac80211 crash - mac80211: guard radiotap antenna parsing * tag 'wireless-2026-06-03' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: cfg80211: enforce HE/EHT cap/oper consistency wifi: fix leak if split 6 GHz scanning fails wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap wifi: nl80211: reject oversized EMA RNR lists wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used wifi: iwlwifi: mvm: avoid oversized UATS command copy wifi: iwlwifi: mld: send tx power constraints before link activation wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares ==================== Link: https://patch.msgid.link/20260603113208.171874-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 11c31f8ee9fb650e3ed6968d4c65c79afb3b9935 Merge: 672bd0519e27c3 bd34fa0257261b Author: Jakub Kicinski Date: Wed Jun 3 19:04:46 2026 -0700 Merge branch 'mptcp-misc-fixes-for-v7-1-rc7' Matthieu Baerts says: ==================== mptcp: misc fixes for v7.1-rc7 Here are various unrelated fixes: - Patch 1: fix missing wakeups when multiple threads are reading from the same fd. A fix for v5.7. - Patch 2: fix retransmission loop when MPTCP checksum is enabled. A fix for v5.14. - Patch 3: fix a TOCTOU race while computing rcv_wnd. A fix for v5.11. - Patch 4: allow subflows receive window to shrink if needed. A fix for v5.19. - Patches 5-6: avoid 'extra_subflows' to underflow with the userspace PM. A fix for v5.19. - Patch 7: report errors if one subflow cannot set SO_TIMESTAMPING. A fix for v5.14. - Patch 8: try to set TCP_MAXSEG on all subflows, before reporting errors, if any. A fix for v6.17. - Patch 9: check desc->count in read_sock, to act as expected. A fix for v7.0. - Patch 10: fix an uninit value in mptcp_established_options, reported by syzbot. A fix for v7.1-rc1. - Patch 11: fix a similar issue than the previous patch, exposed by the same modification from v7.1-rc1, but was already causing issues since v5.15. ==================== Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit bd34fa0257261b76964df1c98f44b3cb4ee14620 Author: Matthieu Baerts (NGI0) Date: Tue Jun 2 22:14:18 2026 +1000 mptcp: add-addr: always drop other suboptions When an ADD_ADDR needs to be sent, it could be prepared if there is enough remaining space and even if the packet is not a pure ACK. But it would be dropped soon after. Indeed, in mptcp_pm_add_addr_signal(), there is enough space to fit a DSS of 20 octets and an ADD_ADDR echo containing an IPv4 address on 8 octets for example. In this case, the packet would be prepared, the MPTCP_ADD_ADDR_ECHO bit would be removed from pm->addr_signal, but the option would be silently dropped in mptcp_established_options_add_addr() not to override DSS info in the union from 'struct mptcp_out_options', and also because mptcp_write_options() will enforce mutually exclusion with DSS. Instead, don't even try to send an ADD_ADDR if it is not a pure ACK. Retry for each new packet until a pure-ACK is emitted. That's fine to do that, because each time an ADD_ADDR (echo) is scheduled, a pure ACK is queued. This also simplifies the code, and the skb checks can be done earlier, before the lock. Note: also, since commit 6d0060f600ad ("mptcp: Write MPTCP DSS headers to outgoing data packets"), opts->ahmac would not have been set to 0 when other suboptions were not dropped, and when sending an ADD_ADDR echo. That would have resulted in sending an ADD_ADDR using garbage info, where there was not enough space, instead of an echo one without the ADD_ADDR HMAC. Fixes: 1bff1e43a30e ("mptcp: optimize out option generation") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-11-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit 5e939544f9d2b4d5c052a07cfcde97de44263946 Author: Paolo Abeni Date: Tue Jun 2 22:14:17 2026 +1000 mptcp: fix uninit-value in mptcp_established_options syzbot reported the following uninit splat: BUG: KMSAN: uninit-value in mptcp_write_data_fin net/mptcp/options.c:542 [inline] BUG: KMSAN: uninit-value in mptcp_established_options_dss net/mptcp/options.c:590 [inline] BUG: KMSAN: uninit-value in mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874 mptcp_write_data_fin net/mptcp/options.c:542 [inline] mptcp_established_options_dss net/mptcp/options.c:590 [inline] mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874 tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192 __tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499 tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505 mptcp_subflow_shutdown+0x164/0x690 net/mptcp/protocol.c:3137 mptcp_check_send_data_fin+0x31b/0x3d0 net/mptcp/protocol.c:3218 __mptcp_wr_shutdown net/mptcp/protocol.c:3234 [inline] __mptcp_close+0x860/0x1360 net/mptcp/protocol.c:3313 mptcp_close+0x42/0x260 net/mptcp/protocol.c:3367 inet_release+0x1ee/0x2a0 net/ipv4/af_inet.c:442 __sock_release net/socket.c:722 [inline] sock_close+0xd6/0x2f0 net/socket.c:1514 __fput+0x60e/0x1010 fs/file_table.c:510 ____fput+0x25/0x30 fs/file_table.c:538 task_work_run+0x208/0x2b0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:67 [inline] exit_to_user_mode_loop+0x306/0x1b60 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] __do_fast_syscall_32+0x2c7/0x460 arch/x86/entry/syscall_32.c:310 do_fast_syscall_32+0x37/0x80 arch/x86/entry/syscall_32.c:332 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Local variable opts created at: __tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499 The output path currently omits initializing the mptcp extension `use_map` flag in a few corner cases. Address the issue always zeroing all the extensions flags before eventually initializing the individual bits. To that extent, introduce and use a struct_group to avoid multiple bitwise operations. Fixes: cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()") Cc: stable@vger.kernel.org Reported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-10-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit c378b1a6f8dd3e02eb08661f4d5d50f236eead03 Author: Gang Yan Date: Tue Jun 2 22:14:16 2026 +1000 mptcp: check desc->count in read_sock __tcp_read_sock() checks desc->count after each skb is consumed and breaks the loop when it reaches 0. The MPTCP variant lacks this check. This is a functional bug, other subsystems also rely on this check: TLS strparser sets desc->count to 0 once a full TLS record is assembled and depends on this break to stop reading. Add the same desc->count check to __mptcp_read_sock(), mirroring __tcp_read_sock(). Fixes: 250d9766a984 ("mptcp: implement .read_sock") Cc: stable@vger.kernel.org Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-9-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit 7690137e70ab0fb1f8b5a30e6f087f8ee908b680 Author: Matthieu Baerts (NGI0) Date: Tue Jun 2 22:14:15 2026 +1000 mptcp: sockopt: set sockopt on all subflows The mptcp_setsockopt_all_sf(), currently used only with TCP_MAXSEG, stopped when one subflow returned an error. Even if it is not wrong, this is different from the other helpers trying to set the option on all subflows, and then returning an error if at least one of them had an issue. Follow this behaviour, for a question of uniformity. Fixes: 51c5fd09e1b4 ("mptcp: add TCP_MAXSEG sockopt support") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-8-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit 57132affbc89c02e1bf73fdf5724311bdc9a29da Author: Matthieu Baerts (NGI0) Date: Tue Jun 2 22:14:14 2026 +1000 mptcp: sockopt: check timestamping ret value sock_set_timestamping() can fail for different reasons. The returned value should then be checked. If sock_set_timestamping() fails for at least one subflow, the first error is now reported to the userspace, similar to what is done with other socket options. Fixes: 9061f24bf82e ("mptcp: sockopt: propagate timestamp request to subflows") Cc: stable@vger.kernel.org Reported-by: Willem de Bruijn Closes: https://lore.kernel.org/willemdebruijn.kernel.178a41a53d041@gmail.com Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-7-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit 06fd2bec7aebf393288e4b78924482fe170caabc Author: Tao Cui Date: Tue Jun 2 22:14:13 2026 +1000 selftests: mptcp: add test for extra_subflows underflow on userspace PM Add a test to verify that when userspace PM fails to create a subflow (e.g. using an unreachable address), the extra_subflows counter is not decremented below zero. Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos") Cc: stable@vger.kernel.org Signed-off-by: Tao Cui Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-6-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit 14e9fea30b68fc75b2b3d97396a7e6adb544bd2a Author: Tao Cui Date: Tue Jun 2 22:14:12 2026 +1000 mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation The userspace PM increments extra_subflows after __mptcp_subflow_connect() succeeds, but __mptcp_subflow_connect() calls mptcp_pm_close_subflow() on failure to roll back the pre-increment done by the kernel PM's fill_*() helpers. Because the userspace PM hasn't incremented yet at that point, this decrement is spurious and causes extra_subflows to underflow. Fix it by aligning the userspace PM with the kernel PM: increment extra_subflows before calling __mptcp_subflow_connect(), so the existing error path in subflow.c correctly rolls it back on failure. Also simplify the error handling by taking pm.lock only when needed for cleanup. Fixes: 77e4b94a3de6 ("mptcp: update userspace pm infos") Cc: stable@vger.kernel.org Signed-off-by: Tao Cui Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-5-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit da23be77e1292cd611e736c3aa17da633d7ddce7 Author: Paolo Abeni Date: Tue Jun 2 22:14:11 2026 +1000 mptcp: allow subflow rcv wnd to shrink In MPTCP connection, the `window` field in the TCP header refers to the MPTCP-level rcv_nxt and it's right edge should not move backward. Such constraint is enforced at DSS option generation time. At the same time, the TCP stack ensures independently that the TCP-level rcv wnd right's edge does not move backward. That in turn causes artificial inflating of the MPTCP rcv window when the incoming data is acked at the TCP level and is OoO in the MPTCP sequence space (or lands in the backlog). As a consequence, the incoming traffic can exceed the receiver rcvbuf size even when the sender is not misbehaving. Prevent such scenario forcibly allowing the TCP subflow to shrink the TCP-level rcv wnd regardless of the current netns setting. Fixes: f3589be0c420 ("mptcp: never shrink offered window") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-4-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit 8ab24fdebc369c0dfb90f82c1650b1e66662bb45 Author: Paolo Abeni Date: Tue Jun 2 22:14:10 2026 +1000 mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack. Fixes: fa3fe2b15031 ("mptcp: track window announced to peer") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-3-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit d1918b36edcaed0ec4ef6888b2358c6b1ddcff47 Author: Paolo Abeni Date: Tue Jun 2 22:14:09 2026 +1000 mptcp: fix retransmission loop when csum is enabled Sashiko noted that retransmission with csum enabled can actually transmit new data, but currently the relevant code does not update accordingly snd_nxt. The may cause incoming ack drop and an endless retransmission loop. Address the issue incrementing snd_nxt as needed. Fixes: 4e14867d5e91 ("mptcp: tune re-injections for csum enabled mode") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-2-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit 9d8d28738f24b75616d6ca7a27cb4aed88520343 Author: Paolo Abeni Date: Tue Jun 2 22:14:08 2026 +1000 mptcp: fix missing wakeups in edge scenarios The mptcp_recvmsg() can fill MPTCP socket receive queue via mptcp_move_skbs(), but currently does not try to wakeup any listener, because the same process is going to check the receive queue soon. When multiple threads are reading from the same fd, the above can cause stall. Add the missing wakeup. Fixes: 6771bfd9ee24 ("mptcp: update mptcp ack sequence from work queue") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-1-856831229976@kernel.org Signed-off-by: Jakub Kicinski commit 672bd0519e27c357c43b7f8c0d653fce3817d06e Author: Kurt Kanzenbach Date: Fri May 29 19:11:47 2026 +0200 ptp: vclock: Switch from RCU to SRCU The usage of PTP vClocks leads immediately to the following issues with ptp4l with LOCKDEP and DEBUG_ATOMIC_SLEEP enabled: "BUG: sleeping function called from invalid context". ptp_convert_timestamp() acquires a mutex_t within a RCU read section. This is illegal, because acquiring a mutex_t can result in voluntary scheduling request which is not allowed within a RCU read section. Replace the RCU usage with SRCU where sleeping is allowed. Reported-by: Florian Zeitz Closes: https://lore.kernel.org/all/00a8cce8-410e-4038-98af-49be6d93d7bd@schettke.com/ Fixes: 67d93ffc0f3c ("ptp: vclock: use mutex to fix "sleep on atomic" bug") Signed-off-by: Kurt Kanzenbach Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20260529-vclock_rcu-v2-1-02a5531fab92@linutronix.de Signed-off-by: Jakub Kicinski commit d3915a1f5a4bc0ac911032903c3c6ab8df9fcc7c Author: Eric Dumazet Date: Tue Jun 2 16:15:47 2026 +0000 ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options This patch restricts setting Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) IP options to users with CAP_NET_RAW capability. This prevents unprivileged applications from forcing packets to route through attacker-controlled nodes to leak TCP ISN and possibly other protocol information. While LSRR and SSRR are commonly filtered in many network environments, they may still be supported and forwarded along some network paths. RFC 7126 (Recommendations on Filtering of IPv4 Packets Containing IPv4 Options) recommend to drop these options in 4.3 and 4.4. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Tamir Shahar Reported-by: Amit Klein Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260602161547.2642155-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit c8e14cc9ccf999336d65bd3f638329e8bb7800ef Merge: 9a85ec3dc28b6d dd8975ad710ea1 Author: Jakub Kicinski Date: Wed Jun 3 18:52:28 2026 -0700 Merge branch 'af_unix-fix-inq_len-update-issue' Jianyu Li says: ==================== af_unix: Fix inq_len update issue From: Jianyu Li This series fix the problem that inq_len is inconsistent with actual remaining byte count when only part of a skb is consumed. ==================== Link: https://patch.msgid.link/20260601113640.231897-1-jianyu.li@mediatek.com Signed-off-by: Jakub Kicinski commit dd8975ad710ea1f3d7c7a36295072fd5ee59ca0a Author: Jianyu Li Date: Mon Jun 1 19:36:40 2026 +0800 af_unix: Add test for SCM_INQ on partial read Add test to verify that when a skb is partially consumed, unix_inq_len() return correct remaining byte count. Before: # RUN scm_inq.stream.partial_read ... # scm_inq.c:165:partial_read:Expected remain (512) == *(int *)CMSG_DATA(cmsg) (768) # partial_read: Test terminated by assertion # FAIL scm_inq.stream.partial_read not ok 2 scm_inq.stream.partial_read After: # RUN scm_inq.stream.partial_read ... # OK scm_inq.stream.partial_read ok 2 scm_inq.stream.partial_read Signed-off-by: Jianyu Li Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260601113640.231897-3-jianyu.li@mediatek.com Signed-off-by: Jakub Kicinski commit c1f07a7f2d47aeb9878301e7bb36bc1c2bc2be8e Author: Jianyu Li Date: Mon Jun 1 19:36:39 2026 +0800 af_unix: Fix inq_len update problem in partial read Currently inq_len is updated only when the whole skb is consumed. If only part of the data is read, following SIOCINQ query would get value greater than what actually left. This change update inq_len timely in unix_stream_read_generic(), and adjust unix_stream_read_skb() accordingly to prevent repetitive update. Fixes: f4e1fb04c123 ("af_unix: Use cached value for SOCK_STREAM in unix_inq_len().") Signed-off-by: Jianyu Li Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260601113640.231897-2-jianyu.li@mediatek.com Signed-off-by: Jakub Kicinski commit 36cda56d7e44e9c3b438f2305012ba5bf3dd95c1 Merge: e43ffb69e0438c 03b70e0d8aa26b Author: Dave Airlie Date: Thu Jun 4 11:15:28 2026 +1000 Merge tag 'amd-drm-fixes-7.1-2026-06-03' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.1-2026-06-03: amdgpu: - BT.2020 fix for DCE - DC bounds checking fixes - SDMA 7.1 fix - UserQ fixes - SI fix - SMU 13 fixes - SMU 14 fixes - GC 12.1 fix - Userptr fix - GC 10.1 fix - GART fix for non-4K pages amdkfd: - UAF race fix - Fix a potential NULL pointer dereference - GC 11 buffer overflow fix for SDMA Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260604011351.2373027-1-alexander.deucher@amd.com commit 9a85ec3dc28b6df246801c19e4d9bae6297a25b0 Author: Suman Ghosh Date: Fri May 29 17:07:05 2026 +0530 octeontx2-af: Fix initialization of mcam's entry2target_pffunc field NPC mcam entry stores a mapping between mcam entry and target pcifunc. During initialization of this field, API kmalloc_array has been used which caused some junk values to array. Whereas, the array is expected to be initialized by 0. This patch fixes the same by using kcalloc instead of kmalloc_array. Fixes: 55307fcb9258 ("octeontx2-af: Add mbox messages to install and delete MCAM rules") Signed-off-by: Suman Ghosh Signed-off-by: Subbaraya Sundeep Reviewed-by: Simon Horman Link: https://patch.msgid.link/1780054625-17090-1-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit a910fb8f7b9e4c566db363e6c2ec378dc7153995 Author: Geetha sowjanya Date: Fri May 29 17:07:57 2026 +0530 octeontx2-pf: Fix NDC sync operation errors On system reboot "rvu_nicpf 0002:03:00.0: NDC sync operation failed" error messages are shown, even if the operations is successful. This is due to wrong if error check in ndc_syc() function. Fixes: 42c45ac1419c ("octeontx2-af: Sync NIX and NPA contexts from NDC to LLC/DRAM") Signed-off-by: Geetha sowjanya Signed-off-by: Subbaraya Sundeep Reviewed-by: Simon Horman Link: https://patch.msgid.link/1780054677-17249-1-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit 2cdeaba5a1087f0f83e56729ea5c730b498639d9 Author: Yizhou Zhao Date: Fri May 29 18:50:16 2026 +0800 appletalk: aarp: zero-initialize aarp_entry to prevent heap info leak aarp_alloc() allocates struct aarp_entry without zeroing it, but only initializes refcnt and packet_queue. When an unresolved AARP entry is created, hwaddr[ETH_ALEN] is left uninitialized. aarp_seq_show() later prints this field with %pM when users read /proc/net/atalk/arp. This can expose 6 bytes of stale heap data for each unresolved entry. Fix this by zero-initializing struct aarp_entry at allocation time. Reported-by: Yizhou Zhao Reported-by: Yuxiang Yang Reported-by: Ao Wang Reported-by: Xuewei Feng Reported-by: Qi Li Reported-by: Ke Xu Signed-off-by: Yizhou Zhao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260529105017.81531-1-zhaoyz24@mails.tsinghua.edu.cn Signed-off-by: Jakub Kicinski commit 56d0885514491e5ed8f7593400879ab77c52504c Author: Jonas Jelonek Date: Thu May 28 20:52:40 2026 +0000 net: sfp: initialize i2c_block_size at adapter configure time sfp->i2c_block_size is only assigned in sfp_sm_mod_probe(), which runs from the state machine timer after SFP_F_PRESENT has been set. Between those two points, sfp_module_eeprom() (the ethtool -m callback) gates only on SFP_F_PRESENT and can be entered with i2c_block_size still at its kzalloc'd value of 0. On a pure-I2C adapter, sfp_i2c_read() then issues an i2c_transfer() with msgs[1].len = 0 inside a loop that subtracts this_len from len each iteration; on adapters that succeed a zero-length read the loop never advances, spinning while holding rtnl_lock. This was previously addressed by initializing i2c_block_size in sfp_alloc() (commit 813c2dd78618), but the initialization was dropped when i2c_block_size was split from i2c_max_block_size. Initialize sfp->i2c_block_size from sfp->i2c_max_block_size in sfp_i2c_configure(), so the field is valid as soon as the adapter is known. sfp_sm_mod_probe() still reassigns it on each module insertion to recover from a per-module clamp to 1 (sfp_id_needs_byte_io). Fixes: 7662abf4db94 ("net: phy: sfp: Add support for SMBus module access") Cc: stable@vger.kernel.org Signed-off-by: Jonas Jelonek Link: https://patch.msgid.link/20260528205242.971410-2-jelonek.jonas@gmail.com Signed-off-by: Jakub Kicinski commit 22ba97ea9cc1f63a0d0244fae38057ed452b6ac7 Author: Jason Xing Date: Sat May 30 12:26:30 2026 +0800 xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() The TX metadata area resides in the UMEM buffer which is memory-mapped and concurrently writable by userspace. In xsk_skb_metadata(), csum_start and csum_offset are read from shared memory for bounds validation, then read again for skb assignment. A malicious userspace application can race to overwrite these values between the two reads, bypassing the bounds check and causing out-of-bounds memory access during checksum computation in the transmit path. Fix this by reading csum_start and csum_offset into local variables once, then using the local copies for both validation and assignment. Note that other metadata fields (flags, launch_time) and the cached csum fields may be mutually inconsistent due to concurrent userspace writes, but this is benign: the only security-critical invariant is that each field's validated value is the same one used, which local caching guarantees. Closes: https://lore.kernel.org/all/20260503200927.73EA1C2BCB4@smtp.kernel.org/ Reviewed-by: Maciej Fijalkowski Signed-off-by: Jason Xing Acked-by: Stanislav Fomichev Fixes: 48eb03dd2630 ("xsk: Add TX timestamp and TX checksum offload support") Link: https://patch.msgid.link/20260530042630.80626-1-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 0c25b8734367574e21aeb8468c2e522713134da7 Author: Usama Arif Date: Tue Jun 2 10:22:47 2026 -0700 mm/mincore: handle non-swap entries before !CONFIG_SWAP guard mincore_swap() also fields migration/hwpoison entries (and shmem swapin-error entries), which can exist on !CONFIG_SWAP builds when CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE is enabled. The !IS_ENABLED(CONFIG_SWAP) guard ran before the non-swap-entry early return, so mincore_pte_range() can spuriously WARN and report these pages nonresident on !CONFIG_SWAP kernels. Move the guard below the non-swap-entry check so only true swap entries trip the WARN, and migration/hwpoison entries take the existing "uptodate / non-shmem" path. Link: https://lore.kernel.org/20260602172247.279421-1-usama.arif@linux.dev Fixes: 1f2052755c15 ("mm/mincore: use a helper for checking the swap cache") Signed-off-by: Usama Arif Reviewed-by: Pedro Falcato Reviewed-by: Kairui Song Reviewed-by: Lorenzo Stoakes Acked-by: Johannes Weiner Cc: Baoquan He Cc: Chris Li Cc: Jann Horn Cc: Liam R. Howlett Cc: Rik van Riel Cc: Shakeel Butt Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit c594b83457ccdee76d458416fb3bc9348a37592f Author: Alistair Popple Date: Thu May 21 13:27:30 2026 +1000 arm64: mm: call pagetable dtor when freeing hot-removed page tables Since 5e8eb9aeeda3 ("arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping()") page-table allocation on ARM64 always calls pagetable_{pte,pmd,pud,p4d}_ctor(). This sets the page_type to PGTY_table, increments NR_PAGETABLE and possible allocates a PTL. However the matching pagetable_dtor() calls were never added. With DEBUG_VM enabled on kernel versions prior to v6.17 without 2dfcd1608f3a9 ("mm/page_alloc: let page freeing clear any set page type") this leads to the following warning when freeing these pages due to page->page_type sharing page->_mapcount: BUG: Bad page state in process ... pfn:284fbb page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x284fbb flags: 0x17fffc000000000(node=0|zone=2|lastcpupid=0x1ffff) page_type: f2(table) page dumped because: nonzero mapcount Call trace: bad_page+0x13c/0x160 __free_frozen_pages+0x6cc/0x860 ___free_pages+0xf4/0x180 free_pages+0x54/0x80 free_hotplug_page_range.part.0+0x58/0x90 free_empty_tables+0x438/0x500 __remove_pgd_mapping.constprop.0+0x60/0xa8 arch_remove_memory+0x48/0x80 try_remove_memory+0x158/0x1d8 offline_and_remove_memory+0x138/0x180 It can also lead to leaking the ptl allocation if ALLOC_SPLIT_PTLOCKS is defined and incorrect NR_PAGETABLE stats. Fix this by calling pagetable_dtor() in free_hotplug_pgtable_page() prior to freeing the page to undo the effects of calling pagetable_*_ctor(). Link: https://lore.kernel.org/20260521032730.2104017-1-apopple@nvidia.com Fixes: 5e8eb9aeeda3 ("arm64: mm: always call PTE/PMD ctor in __create_pgd_mapping()") Signed-off-by: Alistair Popple Cc: Catalin Marinas Cc: David Hildenbrand Cc: Will Deacon Cc: Signed-off-by: Andrew Morton commit 98733f3f0becb1ae0701d021c1748e974e5fa55c Author: Shakeel Butt Date: Mon Jun 1 09:15:01 2026 -0700 mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. This opens a window where a concurrent list_lru_del() arriving for the dying memcg sees xa_load() == NULL, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and calls list_del_init() on an item still physically linked on the dying memcg's list. If another in-flight thread holds the dying memcg's per-node lock at the same moment (another list_lru_del, or a list_lru_walk_one running an isolate callback), both threads modify ->next/->prev pointers on the same physical list under different locks. Adjacent items can corrupt each other's links. Fix it by reversing the order: reparent each per-node list and mark the child's list lru dead and then clear the xarray entry. Any concurrent list_lru op that finds the still-set xarray entry either takes the dying memcg's per-node lock (synchronizing with the drain) or sees LONG_MIN and walks to the parent, where the items now live. Link: https://lore.kernel.org/20260601161501.1444829-1-shakeel.butt@linux.dev Fixes: fb56fdf8b9a2 ("mm/list_lru: split the lock to per-cgroup scope") Signed-off-by: Shakeel Butt Reported-by: Chris Mason Reviewed-by: Kairui Song Acked-by: Muchun Song Cc: Dave Chinner Cc: Johannes Weiner Cc: Roman Gushchin Cc: Signed-off-by: Andrew Morton commit 43e7f189769c512c843184a8a5892ac779a6bd90 Author: Lorenzo Stoakes Date: Mon Jun 1 09:30:44 2026 +0100 mm/huge_memory: use correct flags for device private PMD entry Commit 65edfda6f3f2 ("mm/rmap: extend rmap and migration support device-private entries") updated set_pmd_migration_entry() to use pmdp_huge_get_and_clear() in the softleaf case, but made no further adjustments to the function itself. Therefore this function continues to incorrectly use pmd_write(), pmd_soft_dirty() and pmd_uffd_wp() to determine whether the installed migration entry should be marked writable, softdirty or uffd-wp respectively. Whilst all are incorrect, the most problematic of these is pmd_write(), as this can lead to corrupted rmap state. On x86-64 _PAGE_SWP_SOFT_DIRTY is aliased to _PAGE_RW. So calling pmd_write() on a softleaf will return the softdirty state encoded in the entry, assuming CONFIG_MEM_SOFT_DIRTY was enabled. This was observed when running the hmm.hmm_device_private.anon_write_child selftest: 1. The test faults in a range then migrates it such that a device-private THP range is established. 2. The parent then migrates it to a device-private writable PMD entry whose folio is entirely AnonExclusive with entire_mapcount=1, softdirty set (accidentally correct write state). 3. The parent forks and the PMD entries are set to device-private read only entries, entire_mapcount=2, softdirty still set. 4. [BUG] The child writes to the range then migrates to RAM - intending to install non-writable migration entries - but replacing parent and child PMD mappings with WRITABLE entries due to misinterpreting the softdirty bit. 5. In remove_migration_pmd(), if !softleaf_is_migration_read(entry) we set the RMAP_EXCLUSIVE flag when calling folio_add_anon_rmap_pmd() for both parent and child, which are therefore AnonExclusive. 6. [SPLAT] Child sets migrated folio entire_mapcount=1, parent sets entire_mapcount=2 and we end up with an AnonExclusive folio with entire_mapcount=2! Assert fires in __folio_add_anon_rmap(): VM_WARN_ON_FOLIO(folio_test_large(folio) && folio_entire_mapcount(folio) > 1 && PageAnonExclusive(cur_page), folio) This patch fixes the issue by correctly referencing the softleaf entry fields for writable, softdirty and uffd-wp in set_pmd_migration_entry(). It also only updates A/D flags if the entry is present as these are otherwise not meaningful for a softleaf entry. This patch also flips the if (!present) { ... } else { ... } logic in set_pmd_migration_entry() so it is easier to understand, and adds some comments to make things clearer. I was able to bisect this to commit 775465fd26a3 ("lib/test_hmm: add zone device private THP test infrastructure") which first exposes this bug as it was the commit that permitted test_hmm to generate the test. However commit 65edfda6f3f2 ("mm/rmap: extend rmap and migration support device-private entries") is the commit that actually enabled this behaviour. Link: https://lore.kernel.org/20260601083044.57132-1-ljs@kernel.org Fixes: 65edfda6f3f2 ("mm/rmap: extend rmap and migration support device-private entries") Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Arm) Reviewed-by: Dev Jain Reviewed-by: Balbir Singh Reviewed-by: Baolin Wang Reviewed-by: Oscar Salvador (SUSE) Reviewed-by: Barry Song Reviewed-by: Lance Yang Reviewed-by: Zi Yan Cc: Baolin Wang Cc: Liam R. Howlett Cc: Nico Pache Cc: Ryan Roberts Cc: SeongJae Park Cc: Wei Yang Cc: Signed-off-by: Andrew Morton commit ab04340b5ae5d52c1d46b750538febcde9d889e7 Author: SeongJae Park Date: Thu May 28 17:01:03 2026 -0700 mm/damon/lru_sort: handle ctx allocation failure DAMON_LRU_SORT allocates the damon_ctx object for its kdamond in its init function. damon_lru_sort_enabled_store() wrongly assumes the allocation will always succeed once tried. If the damon_ctx allocation was failed, therefore, code execution reaches to damon_commit_ctx() while 'ctx' is NULL. As a result, it dereferences the NULL 'ctx' pointer. Avoid the NULL dereference by returning -ENOMEM if 'ctx' is NULL. Link: https://lore.kernel.org/20260529000104.7006-3-sj@kernel.org Fixes: c4a8e662c839 ("mm/damon/lru_sort: use damon_initialized()") Signed-off-by: SeongJae Park Cc: # 6.18.x Signed-off-by: Andrew Morton commit 7e2ed8a29427af534bf2cb9b8bc51762b8b6e654 Author: SeongJae Park Date: Thu May 28 17:01:02 2026 -0700 mm/damon/reclaim: handle ctx allocation failure Patch series "mm/damon/{reclaim,lru_sort}: handle ctx allocation failures". DAMON_RECLAIM and DAMON_LRU_SORT could dereference NULL pointers if their damon_ctx object allocations fail. The bugs are expected to happen infrequently because the allocations are arguably too small to fail on common setups. But theoretically they are possible and the consequences are bad. Fix those. The issues were discovered [1] by Sashiko. This patch (of 2): DAMON_RECLAIM allocates the damon_ctx object for its kdamond in its init function. damon_reclaim_enabled_store() wrongly assumes the allocation will always succeed once tried. If the damon_ctx allocation was failed, therefore, code execution reaches to damon_commit_ctx() while 'ctx' is NULL. As a result, it dereferences the NULL 'ctx' pointer. Avoid the NULL dereference by returning -ENOMEM if 'ctx' is NULL. Link: https://lore.kernel.org/20260529000104.7006-2-sj@kernel.org Link: https://lore.kernel.org/20260419014800.877-1-sj@kernel.org [1] Fixes: 3f7a914ab9a5 ("mm/damon/reclaim: use damon_initialized()") Signed-off-by: SeongJae Park Cc: # 6.18.x Signed-off-by: Andrew Morton commit 732fd9f0b9c1cdc6dfd77162ded60df005182cc0 Author: Cunlong Li Date: Thu May 28 10:48:44 2026 +0800 zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still in flight. The caller then runs memcpy_from_bvec(), zram_write_page() and __free_page() on the buffer, leaving the async read to write into a freed page. zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the write_partial counterpart was missed. Link: https://lore.kernel.org/20260528-zram-v3-1-cab86eef8764@gmail.com Fixes: 8e654f8fbff5 ("zram: read page from backing device") Reviewed-by: Christoph Hellwig Reviewed-by: Sergey Senozhatsky Signed-off-by: Cunlong Li Cc: Jens Axboe Cc: Minchan Kim Cc: Yisheng Xie Cc: Signed-off-by: Andrew Morton commit 8ad974459aef3349ec5cb3cc54e2bfc1b7aebf34 Author: Baoquan He Date: Thu May 28 21:14:54 2026 +0800 MAINTAINERS: update Baoquan He's email address I will switch to use @linux.dev mailbox, update all entries in MAINTAINERS. And map the address in .mailmap. Link: https://lore.kernel.org/20260528131454.1996752-1-baoquan.he@linux.dev Signed-off-by: Baoquan He Signed-off-by: Andrew Morton commit 5921629dd625a69546692a92e1ca7ae987f03964 Author: Wang Yaxin Date: Wed May 27 21:35:58 2026 +0800 tools headers UAPI: sync linux/taskstats.h for procacct.c After commit 9b93f7e32774 ("tools/getdelays: use the static UAPI headers from tools/include/uapi"), the Makefile was changed to use -I../include/uapi/ instead of -I../../usr/include to ensure tools always use the up-to-date UAPI headers. However, only linux/taskstats.h was added to tools/include/uapi/ in commit e5bbb35a07b3 ("tools headers UAPI: sync linux/taskstats.h"), but linux/acct.h was missing. This causes procacct.c to fail to compile with: procacct.c:234:37: error: 'AGROUP' undeclared (first use in this function) gcc -I../include/uapi/ getdelays.c -o getdelays gcc -I../include/uapi/ procacct.c -o procacct procacct.c: In function `print_procacct': procacct.c:234:37: error: `AGROUP' undeclared (first use in this function) did you mean `NOGROUP'? 234 | , t->version >= 12 ? (t->ac_flag & AGROUP ? 'P' : 'T') : '?' | ^~~~~~ | NOGROUP procacct.c:234:37: note: each undeclared ident because procacct.c uses the AGROUP macro defined in linux/acct.h. Add the missing linux/acct.h to complete the static UAPI header set. Link: https://lore.kernel.org/20260527213558929EhiHHy9EDTMjmg3uuDOMi@zte.com.cn Fixes: 9b93f7e32774 ("tools/getdelays: use the static UAPI headers from tools/include/uapi") Signed-off-by: Wang Yaxin Reviewed-by: Thomas Weißschuh Cc: Fan Yu Cc: Jonathan Corbet Cc: xu xin Cc: Yang Yang Signed-off-by: Andrew Morton commit 0ade3a8d83a8f5bc274e1ace776c1a26aa7a0308 Author: Kaitao Cheng Date: Fri May 22 21:14:34 2026 +0800 mm/cma_sysfs: skip inactive CMA areas in sysfs cma_activate_area() can fail after a CMA area has already been added to cma_areas[]. In that case the area is left in the global array, but it does not reach the point where CMA_ACTIVATED is set. cma_sysfs_init() currently walks all cma_area_count entries and creates sysfs files for every area, including ones that failed activation. These areas are not usable CMA areas and should not be exposed to userspace as valid CMA regions. If such an inactive area is exposed, userspace sees a CMA directory whose read-only accounting files report zeros. total_pages and available_pages report zero because the failed activation path clears cma->count and cma->available_count, while the allocation and release counters also stay at zero because the area cannot service CMA allocations. This makes the failed area look like a valid but empty CMA region and can mislead tests, monitoring, and diagnostics. Skip CMA areas that did not reach CMA_ACTIVATED when creating the sysfs objects. Since inactive entries can now be skipped, make the error unwind tolerate entries that never had cma_kobj initialized. Link: https://lore.kernel.org/20260524140420.61864-1-kaitao.cheng@linux.dev Link: https://lore.kernel.org/20260522131434.78532-1-kaitao.cheng@linux.dev Fixes: 43ca106fa8ec ("mm: cma: support sysfs") Signed-off-by: Kaitao Cheng Reported-by: David Hildenbrand (Arm) Suggested-by: David Hildenbrand (Arm) Suggested-by: Muchun Song Reported-by: Muchun Song Closes: https://lore.kernel.org/linux-mm/55481a8b-dcfc-4bef-ba59-aa0b43dca88b@kernel.org/ Acked-by: Muchun Song Cc: David Hildenbrand Cc: Dmitry Osipenko Cc: Greg Kroah-Hartman Cc: John Hubbard Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2e5c6f4fd4001562781e99bbfc7f1f0127187542 Author: Yilin Zhu Date: Thu Apr 30 13:21:34 2026 +0800 ipc/shm: serialize orphan cleanup with shm_nattch updates shm_destroy_orphaned() walks the shm idr under shm_ids(ns).rwsem, but that does not serialize all fields tested by shm_may_destroy(). In particular, shm_nattch is updated while holding shm_perm.lock, and attach paths can do that without holding the rwsem. Do not decide that an orphaned segment is unused before taking the object lock. Move the shm_may_destroy() check under shm_perm.lock, matching the other destroy paths, and unlock the segment when it no longer qualifies for removal. Link: https://lore.kernel.org/9d97cc1031de2d0bace0edf3a668818aa2f4eca6.1777410234.git.zylzyl2333@gmail.com Fixes: 4c677e2eefdb ("shm: optimize locking and ipc_namespace getting") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Yilin Zhu Signed-off-by: Ren Wei Cc: Christian Brauner Cc: Jeongjun Park Cc: Kees Cook Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Serge Hallyn Cc: Vasiliy Kulikov Cc: Davidlohr Bueso Cc: Oleg Nesterov Cc: Serge Hallyn Cc: Signed-off-by: Andrew Morton commit 40a25d59e85b3c8709ac2424d44f65610467871e Author: Davidlohr Bueso Date: Thu May 7 04:29:13 2026 -0700 locking/rtmutex: Skip remove_waiter() when waiter is not enqueued syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI: KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] class_raw_spinlock_constructor remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 rt_mutex_start_proxy_lock+0x103/0x120 futex_requeue+0x10e4/0x20d0 __x64_sys_futex+0x34f/0x4d0 task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") made this fatal. Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() (where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to account for try_to_take_rt_mutex(). Fixes: 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") Reported-by: syzbot+78147abe6c524f183ee9@syzkaller.appspotmail.com Signed-off-by: Davidlohr Bueso Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/ Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net commit 03b70e0d8aa26bab89a0f1394c1c80a871925e42 Author: Priya Hosur Date: Thu May 7 13:31:37 2026 +0530 drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range In smu_v14_0_0_set_soft_freq_limited_range(), the gfxclk floor is programmed via SetHardMinGfxClk together with SetSoftMaxGfxClk. Under power_dpm_force_performance_level=high this pins HardMin to peak gfxclk. In PMFW arbitration HardMin has higher priority than SoftMax, so the firmware thermal/PPT throttler cannot clamp gfxclk via SoftMax once HardMin is set to peak. Replace SetHardMinGfxClk with SetSoftMinGfxclk so the driver still requests peak performance but the firmware throttler retains the ability to clamp gfxclk under thermal/PPT pressure. SoftMax handling is unchanged and no other clock domains are affected. Signed-off-by: Priya Hosur Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 3ea273267fd29cbf6d83ee72329f59eb5042605b) Cc: stable@vger.kernel.org commit ec4c462e2d8161b32038e21e7187f4a15fe1661d Author: Donet Tom Date: Wed May 27 18:49:31 2026 +0530 drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems When mapping VRAM pages into the GART page table, amdgpu_gart_map_vram_range() assumes that the system page size is the same as the GPU page size. On systems with non-4K page sizes, multiple GPU pages can exist within a single CPU page. As a result, the mappings are created incorrectly because fewer page table entries are programmed than required. Fix this by programming the mappings correctly for non-4K page size systems. Fixes: 237d623ae659 ("drm/amdgpu/gart: Add helper to bind VRAM pages (v2)") Reviewed-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Donet Tom Signed-off-by: Alex Deucher (cherry picked from commit a8f0bc22388f74e0cf4ed8b7d1846c580eaf44cc) Cc: stable@vger.kernel.org commit 14ad7e1e6e2cd44f866e2dbb3f6a2b2f4a39b96d Author: Sunil Khatri Date: Mon May 25 09:56:23 2026 +0530 drm/amdgpu/userq: move wptr_obj cleanup in mqd_destroy In case when queue_create fails and mqd has already been allocated and hence wptr_obj is not cleaned up. So moving that cleanup part to mqd_destroy so it takes care of all the cases of clean up and during tear down of the queue. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 43355f62cd2ef5386c2693df537c232ea0f2ce6c) commit 5af28a22ce834544bb22efbba30ffb837098b2b8 Author: Prike Liang Date: Tue May 26 10:25:26 2026 +0800 drm/amdgpu: improve the userq seq BO free bit lookup Use find_next_zero_bit() to locate the next free seq slot bit instead of the current walk, for more efficient bitmap scanning. Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit ff905a9b6228de9eedd0db71ecb1bdde91fb898d) commit 2a07f3fa4998e2ef248e1f55cd3776348758aec0 Author: Sunil Khatri Date: Mon May 25 13:18:00 2026 +0530 drm/amdgpu/userq: remove the vital queue unmap logging Mesa userqueues free does not wait for the free to complete and go ahead in unmapping the vital bos while kernel is still in queue free and corresponding cleanup. So ideally we don't need the logging for that and hence remove the warn message as this is expected behaviour and functionally, we are making sure to wait for the required fences before unmap. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 758a868043dcb07eca923bc451c16da3e73dc47c) commit 352ea59028ea48a6fff77f19ae28f98f71946a80 Author: Andrew Martin Date: Thu May 28 12:54:39 2026 -0400 drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct v11_sdma_mqd) (512 bytes), causing a 1536-byte overflow. During CRIU checkpoint of an SDMA queue on Navi3x: - checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer, leaking 1536 bytes of adjacent GTT memory to userspace During CRIU restore: - restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer, corrupting 1536 bytes of adjacent GTT memory (often the ring buffer or neighboring MQDs) This is a copy-paste regression unique to v11. All other ASIC backends (cik, vi, v9, v10, v12) correctly use the SDMA-specific variants. Add checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly handle the smaller v11_sdma_mqd structure, matching the pattern used in other MQD managers. Fixes: cc009e613de6 ("drm/amdkfd: Add KFD support for soc21 v3") Assisted-by: Claude:Sonnet 4-5 Signed-off-by: Andrew Martin Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c) Cc: stable@vger.kernel.org commit 2bd550b547deabef98bd3b017ff743b7c34d3a6d Author: Muhammad Bilal Date: Sat May 23 16:56:46 2026 +0000 drm/amdkfd: fix NULL dereference in get_queue_ids() When usr_queue_id_array is NULL and num_queues is non-zero, get_queue_ids() returns NULL. The callers check only IS_ERR() on the return value; since IS_ERR(NULL) == false the check passes, and suspend_queues() calls q_array_invalidate() which immediately dereferences NULL while iterating num_queues times. Userspace can trigger this via kfd_ioctl_set_debug_trap() by supplying num_queues > 0 with a zero queue_array_ptr, causing a kernel panic. A NULL usr_queue_id_array with num_queues == 0 is a legitimate no-op (q_array_invalidate never executes, and resume_queues already guards all queue_ids dereferences behind a NULL check). Return ERR_PTR(-EINVAL) only when num_queues is non-zero and the pointer is absent; both callers already propagate IS_ERR() returns correctly to userspace. Fixes: a70a93fa568b ("drm/amdkfd: add debug suspend and resume process queues operation") Signed-off-by: Muhammad Bilal Signed-off-by: Alex Deucher (cherry picked from commit f165a82cdf503884bb1797771c61b2fcc72113d4) Cc: stable@vger.kernel.org commit e47b0056a08dc70430ffc44bbf62197e7d1ff8ea Author: Vitaly Prosyak Date: Fri May 29 13:50:38 2026 -0400 drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14) Problem: While developing the amd_close_race IGT test (which intentionally triggers execute permission faults by removing VM_PAGE_EXECUTABLE from GPU page table entries), we discovered that on Navi10 (GFX 10.1.x) these faults produce zero diagnostic output. The GPU simply hangs silently for ~10s until the scheduler timeout fires. There is no way to distinguish an execute permission fault from any other type of GPU hang. Root cause: GFX 10.1.x defaults to noretry=0, which sets RETRY_PERMISSION_OR_INVALID_PAGE_FAULT=1 in the GFXHUB UTCL2 registers (gfxhub_v2_0.c line 313). With this bit set, permission faults (valid PTE, wrong R/W/X bits) are handled entirely within the UTCL1/UTCL2 hardware loop: UTCL2 returns an XNACK to UTCL1, and UTCL1 re-requests the translation indefinitely, expecting software to eventually fix the permission bits (as happens in SVM/HMM recovery). No interrupt of any kind reaches the IH ring. This is different from invalid-page faults (V=0) which DO generate a retry fault interrupt that the driver can escalate to a no-retry fault. Permission faults with valid PTEs loop silently forever in hardware. GFX 10.3+ already defaults to noretry=1, which makes permission faults generate immediate L2 protection fault interrupts. GFX 10.1.x was inadvertently left out of this default. Fix: Change the noretry=1 threshold from IP_VERSION(10, 3, 0) to IP_VERSION(10, 1, 0) in amdgpu_gmc_noretry_set(). This is a one-line change that aligns GFX 10.1.x behavior with GFX 10.3+ and all newer generations. With noretry=1, the existing non-retry fault handler (gmc_v10_0_process_interrupt) already decodes and prints the full GCVM_L2_PROTECTION_FAULT_STATUS register including PERMISSION_FAULTS, faulting address, VMID, PASID, and process name. No additional logging code is needed — the fix is purely routing permission faults to the existing, fully-capable non-retry interrupt handler. v2: Dropped GFX10-specific logging from gmc_v10_0.c and kfd_int_process_v10.c (Felix Kuehling). v1 added logging in the retry fault handler, but with noretry=1 permission faults take the non-retry path — the v1 retry handler code was dead and would never execute. Tested on Navi10 (GFX 10.1.10): - Execute permission faults now produce immediate, clear output: [gfxhub] page fault (src_id:0 ring:64 vmid:4 pasid:592) Process amd_close_race pid 13380 thread amd_close_race pid 13384 in page at address 0x40001000 from client 0x1b (UTCL2) GCVM_L2_PROTECTION_FAULT_STATUS:0x00700881 PERMISSION_FAULTS: 0x8 - No regressions with properly-mapped GPU workloads Cc: Christian Koenig Cc: Alex Deucher Cc: Felix Kuehling Signed-off-by: Vitaly Prosyak Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit eb21edd24c40d81066753f8ac6f23bce15745395) Cc: stable@vger.kernel.org commit 40bab7c606702e8ea3e95c6f30c99cc8295826af Author: Timur Kristóf Date: Mon May 25 13:45:02 2026 +0200 drm/amdgpu/gfxhub: Program CRASH_ON_*_FAULT bits to 0 as needed When the fault stop mode isn't AMDGPU_VM_FAULT_STOP_ALWAYS, these bits should be programmed to 0. Program CRASH_ON_NO_RETRY_FAULT and CRASH_ON_RETRY_FAULT always, to make sure to clear the bits when we don't want to crash. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit d0cd99e73090700b7a942b98a3327ec966597d0a) commit 58bafc666c484b21839a2d27e923ae1b2727a1df Author: Christian König Date: Wed Feb 18 13:05:46 2026 +0100 drm/amdgpu: fix waiting for all submissions for userptrs Wait for all submissions when userptrs need to be invalidated by the MMU notifier, not just the one the userptr was involved into. Signed-off-by: Christian König Reviewed-by: Vitaly Prosyak Tested-by: Vitaly Prosyak Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 91250893cbaa25c86872deca95a540d08de1f91e) Cc: stable@vger.kernel.org commit e3fa02872e223d24a925eb876b31c00d833bce7c Author: Harish Kasiviswanathan Date: Tue May 12 10:57:49 2026 -0400 drm/amdgpu: drm/amdgpu: Set correct DMA mask for gfx12.1 Set correct DMA mask for gfx12 Signed-off-by: Harish Kasiviswanathan Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit a2ef14ee2593b48242b8d90f229f71c1710529da) commit ae4e30f24d67075dc975002effa68d424c7ff7e3 Author: Harish Kasiviswanathan Date: Tue Apr 28 17:45:06 2026 -0400 drm/amdgpu: Use asic specific pte_addr_mask For PTE creation use asic specific physical page base address mask v2: Change variable name from pa_mask to pte_addr_mask Signed-off-by: Harish Kasiviswanathan Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit 2ea989885941a6e5607ef86dbe309e90b7191f21) commit a169b326bab4a3617a9b1d34beddaaa6f798aa20 Author: Yang Wang Date: Mon May 11 16:33:37 2026 +0800 drm/amd/pm: zero unused SMU argument registers SMU messages may use fewer arguments than the available argument registers, the previous code only wrote used registers and left the rest unchanged, so stale values from a prior message could persist. Write all argument registers for each message and zero the unused tail to keep command arguments deterministic and avoid unintended carry-over. Signed-off-by: Yang Wang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher (cherry picked from commit e03b635f61f77ebd5107ef82f48e3221cb695856) commit ee193c5bbd5e2b56bbeb54ef554414b43a6fc896 Author: Yang Wang Date: Fri May 29 11:47:31 2026 +0800 drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 EnergyAccumulator is unsupported on SMU 14.0.2, mark it invalid. Signed-off-by: Yang Wang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher (cherry picked from commit 646b05043eeed04b51c14aad22a400a8250af4b7) Cc: stable@vger.kernel.org commit bb204f19e4a115f094a6a3c4d82fcf48862d0766 Author: Yang Wang Date: Tue May 19 11:18:12 2026 +0800 drm/amd/pm: fix smu13 power limit default/cap calculation smu_v13_0_0_get_power_limit() and smu_v13_0_7_get_power_limit() mix runtime power_limit with PP table limits when reporting default/min/max. When current power limit query succeeds, default_power_limit was set to the runtime value instead of the PP table default, and min/max could be derived from inconsistent bases (MsgLimits/runtime), leading to incorrect cap info. Use SocketPowerLimitAc/Dc as the PP default base (pp_limit), keep current_power_limit as runtime value, and derive min/max from pp_limit with OD percentages. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5227 Signed-off-by: Yang Wang Reviewed-by: Kenneth Feng Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit 1eaf26db95901ca70737503a89b831dd763c8453) Cc: stable@vger.kernel.org commit 2493d87bb4c31ec9ca7f0ef7257e33b8b175f913 Author: Yang Wang Date: Thu May 21 22:36:37 2026 +0800 drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload On SMU v13.0.10, sending PrepareMp1ForUnload with the default parameter may leave the device in an inaccessible state. This can affect runtime power management and partial PnP flows. e.g: kexec, driver unload, boco/d3cold. Pass the required workaround parameter 0x55, when preparing MP1 for unload on SMU v13.0.10, keep the existing behavior for other SMU versions. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5133 Signed-off-by: Yang Wang Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher (cherry picked from commit 4e8ee1afeedb8d24dd22cdd5ae9f98a6d76ebe4b) Cc: stable@vger.kernel.org commit a40412285ec17a69ed728675a56b7ad479c86e36 Author: Timur Kristóf Date: Mon May 25 13:22:04 2026 +0200 drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on all SI It seems that Pitcairn has the same issues as Tahiti with regards to the TLB size. This commit fixes a VCE1 FW validation timeout on suspend/resume on Pitcairn. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5336 Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 629279e2e798cd161cf74f40aaebfeb16d45eb01) commit e0153b94a1d104cf4545878c83302672573de65e Author: Prike Liang Date: Thu May 14 17:21:09 2026 +0800 drm/amdgpu: unmap userq for evicting user queue If the driver only preempts queues, there can still be inflight waves, pending dispatch state, or resume/redispatch possibility tied to the same queue. Then the VM/TTM side may proceed to move/unmap queue related BOs during evicting userq objects while shader TCP clients still need to access them. So for eviction, unmap is safer because it makes the queue nonrunnable before memory backing is invalidated. Meanwhile, for a idle queue it's more sutiable for unmapping it rather preempt and unmapping also can save more processing time than preempt. Signed-off-by: Prike Liang Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit d87c9d86727a0bcc95c3009a213a1b27a11b691e) commit 1a4a55f181a9584386701f9b4183d9ecc5271b21 Author: Alex Deucher Date: Wed May 27 15:41:59 2026 -0400 drm/amdgpu/sdma7.1: fix support for disable_kq Set the flag in the ring structure. Fixes: 80d4d3a45b86 ("drm/amdgpu/sdma7.1: add support for disable_kq") Reviewed-by: Kent Russell Signed-off-by: Alex Deucher (cherry picked from commit e0a3aa8a6750e8cf067fe2146dc618ffd296d5ef) commit 181eda5549c5d9fad3fdb88b050fbf0844d884f8 Author: Alysa Liu Date: Wed May 27 11:31:35 2026 -0400 drm/amdkfd: fix UAF race in destroy_queue_cpsch wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use is_being_destroyed flag to serialize destruction. Reviewed-by: Amir Shetaia Signed-off-by: Alysa Liu Signed-off-by: Alex Deucher (cherry picked from commit ac081deaf16a639ea7dff2f285fe421a33c1ade0) commit ff287df16a1a58aca78b08d1f3ee09fc44da0351 Author: Harry Wentland Date: Tue May 12 15:24:22 2026 -0400 drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;) and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the terminator record causes unbounded iteration at probe time, potentially hundreds of thousands of iterations with record_size=1. In the final iterations near the BIOS image boundary, struct casts beyond the 2-byte header validated by GET_IMAGE can also read out of bounds. Cap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines up to 22 distinct record types and atomfirmware.h has 13. Assuming an average of less than 10 records per type (which is reasonable since most are connector- based) 256 is a generous upper bound. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Assisted-by: Copilot:claude-opus-4.6 Mythos Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93) Cc: stable@vger.kernel.org commit f0f3981c43b32cadfe373d636d9e9ca522bb3702 Author: Harry Wentland Date: Thu May 7 15:38:37 2026 -0400 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size [Why & How] During HDCP 2.x repeater authentication over HDMI, the driver reads the sink's RxStatus register and extracts a 10-bit message size field (max value 1023). This value is used as the read length for the ReceiverID list without being clamped to the size of the destination buffer rx_id_list[177]. A malicious HDMI repeater could advertise a message size larger than the buffer, causing an out-of-bounds write during the I2C read. Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the rx_id_list buffer, matching the approach already used in the DP branch. Fixes: eff682f83c9c ("drm/amd/display: Add DDC handles for HDCP2.2") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09) Cc: stable@vger.kernel.org commit 49c3da65961fe9857c831d47fa1989084e87514a Author: Harry Wentland Date: Tue May 5 11:50:07 2026 -0400 drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() [Why & How] gpio_bitshift is a uint8_t read directly from the VBIOS GPIO pin table. If the value is >= 32, the expression "1 << gpio_bitshift" triggers undefined behaviour in C (shift count exceeds type width). On x86 the shift is silently masked to 5 bits, producing an incorrect GPIO mask that may cause wrong MMIO register bits to be toggled. Validate gpio_bitshift before use and return BP_RESULT_BADBIOSTABLE for out-of-range values. Fixes: ae79c310b1a6 ("drm/amd/display: Add DCE12 bios parser support") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit eadf438ab8d370b9d19acee9359918c85afeb80d) Cc: stable@vger.kernel.org commit da48bc4461b8a5ebfb9264c9b191a701d8e99009 Author: Harry Wentland Date: Tue May 5 11:52:15 2026 -0400 drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends. Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue. Fixes: 2004f45ef83f ("drm/amd/display: Use kernel alloc/free") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707) Cc: stable@vger.kernel.org commit adf67034b1f61f7119295208085bfd43f85f56af Author: Harry Wentland Date: Mon May 11 16:46:25 2026 -0400 drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) Fixes: c7ba3653e977 ("drm/amd/display: Generic SDP message access in amdgpu") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300) Cc: stable@vger.kernel.org commit fb0707ce00eef4e2d60c3020e1c0432739703e4a Author: Harry Wentland Date: Mon May 4 15:51:13 2026 -0400 drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9] and dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated before use, so a malformed VBIOS can specify values up to 255, causing an out-of-bounds heap write during driver probe. Clamp each register count to the destination array size using min_t() before the copy loops, in both get_integrated_info_v11() and get_integrated_info_v2_1(). Assisted-by: GitHub Copilot:claude-opus-4.6 Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69) Cc: stable@vger.kernel.org commit e8b4d37eba05141ee01794fc6b7f2da808cee83b Author: Harry Wentland Date: Tue May 5 11:44:15 2026 -0400 drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() [Why & How] The aux_rd_interval array in struct dc_lttpr_caps is declared with MAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset parameter passed to dp_get_eq_aux_rd_interval() can be as large as MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters via DPCD. This leads to an out-of-bounds read of aux_rd_interval[7] when offset is 8. Fix this by growing aux_rd_interval to MAX_REPEATER_CNT elements to accommodate the full range of valid repeater counts defined by the DP spec. Assisted-by: GitHub Copilot:Claude claude-4-opus Signed-off-by: Harry Wentland Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit a55a458a8df37a65ffda5cf721d554a8f74f6b04) Cc: stable@vger.kernel.org commit 6590fe323ce2807f5d9454e7fccf3fab875d4352 Author: Leorize Date: Wed May 27 23:58:54 2026 -0700 drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs DCE-based hardware does not have the CSC matrices for BT.2020, which causes the driver to fallback to the GPU built-in matrices. This does not appear to cause any issues for RGB sinks, but causes major color artifacts for YCbCr ones (e.g. black becomes green). This commit adds the missing CSC matrices (taken from DC common) to DCE CSC tables, resolving the issue. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/3358 Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5333 Assisted-by: oh-my-pi:GPT-5.5 Signed-off-by: Leorize Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 51e6668ab4baf55b082c376318d51ef965757196) Cc: stable@vger.kernel.org commit 323c98a4ff06aa28114f2bf658fb43eb3b536bbc Author: Yishai Hadas Date: Mon May 25 17:21:36 2026 +0300 RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc The cpu_id attribute supplied by user space through UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed directly to cpumask_test_cpu() without first verifying that the value is within the valid CPU range. Passing such untrusted data to cpumask_test_cpu() may lead to an out-of-bounds read of the underlying cpumask bitmap: the helper expands to a test_bit() that indexes the bitmap by cpu_id / BITS_PER_LONG with no bound check. In addition, on kernels built with CONFIG_DEBUG_PER_CPU_MAPS it trips the WARN_ON_ONCE() in cpumask_check(); combined with panic_on_warn this turns a bad user input into a machine reboot. Reject any cpu_id that is not smaller than nr_cpu_ids with -EINVAL before it is used. Reported by Smatch. Fixes: d83edab562a4 ("RDMA/core: Introduce a DMAH object and its alloc/free APIs") Link: https://patch.msgid.link/r/20260525142136.28165-1-yishaih@nvidia.com Cc: stable@vger.kernel.org Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/ag68qoAW3P04J7pT@stanley.mountain/ Signed-off-by: Yishai Hadas Signed-off-by: Jason Gunthorpe commit 30252e6f71ba974ecf9cd8ce395b73b9900bc378 Author: Thomas Zimmermann Date: Tue Jun 2 13:24:01 2026 +0200 drm/dumb-buffer: Drop buffer-size limits for now The size limits break some of the CI tests. So drop them for now. Keep the other overflow tests from commit 5ab62dd3687b ("drm: prevent integer overflows in dumb buffer creation helpers") in place. There is still a pre-existing overflow check for 32-bit type limits in drm_mode_create_dumb() that will catch the really absurd size requests. Drivers that still do not use drm_mode_size_dumb() should be updated. The helper calculates dumb-buffer geometry with overflow checks. Signed-off-by: Thomas Zimmermann Fixes: 5ab62dd3687b ("drm: prevent integer overflows in dumb buffer creation helpers") Reported-by: Jani Nikula Closes: https://lore.kernel.org/dri-devel/ddf0233e50044059c85279f928661563ef6a55bf@intel.com/ Cc: Rajat Gupta Cc: Thomas Zimmermann Cc: Maarten Lankhorst Cc: Maxime Ripard Acked-by: Jani Nikula Link: https://patch.msgid.link/20260602112842.252279-1-tzimmermann@suse.de commit 9154c4af7829b6f82712b4d1a2a720adddacdb8d Merge: e7524845cda3c0 f595e8e77a51ee Author: Linus Torvalds Date: Wed Jun 3 09:09:24 2026 -0700 Merge tag 'mmc-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fix host controller programming for eMMC fixed driver type MMC host: - dw_mmc-rockchip: Add missing private data for very old controllers - litex_mmc: Fix clock management - renesas_sdhi: Add OF entry for RZ/G2H SoC - sdhci: Manage signal voltage switch during system resume for some hosts - sdhci-of-dwcmshc: Fix reset, clk and SDIO support for Eswin EIC7700" * tag 'mmc-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci: add signal voltage switch in sdhci_resume_host mmc: dw_mmc-rockchip: Add missing private data for very old controllers mmc: litex_mmc: Set mandatory idle clocks before CMD0 mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin EIC7700 mmc: core: Fix host controller programming for fixed driver type commit e7524845cda3c0713c0e61681dcd5263f0270fbe Merge: ac5c3716c699f7 57aff991119693 Author: Linus Torvalds Date: Wed Jun 3 08:59:24 2026 -0700 Merge tag 'cgroup-for-7.1-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "One cpuset fix and a maintenance update, both low-risk: - Fix cpuset partition CPU accounting under sibling CPU exclusion that could produce wrong CPU assignments and trigger scheduling-domain warnings. Includes selftests. - Update an email address in MAINTAINERS" * tag 'cgroup-for-7.1-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/cpuset: Change Ridong's email cgroup/cpuset: Add test cases for sibling CPU exclusion on partition update cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask calculation commit ac5c3716c699f7eb6f84fc7931fdf74f0b4ceaee Merge: ba3e43a9e60163 02e545c4297a26 Author: Linus Torvalds Date: Wed Jun 3 08:52:26 2026 -0700 Merge tag 'sched_ext-for-7.1-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: "Two low-risk fixes: - Drop a spurious warning that can fire during cgroup migration while a sched_ext scheduler is loaded - Fix a drgn-based debug script that broke after scheduler state moved into a per-scheduler struct" * tag 'sched_ext-for-7.1-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() tools/sched_ext: Fix scx_show_state per-scheduler state reads commit 149324fc762c2a7acef9c26790566f81f475e51f Author: Luiz Augusto von Dentz Date: Tue Jun 2 16:48:34 2026 -0400 Bluetooth: MGMT: Fix backward compatibility with userspace bluetoothd has a bug with makes it send extra bytes as part of MGMT_OP_ADD_EXT_ADV_DATA which are now being checked to be the exact the expected length, relax this so only when the expected length is greater than the data length to cause an error since that would result in accessing invalid memory, otherwise just ignore the extra bytes. Link: https://lore.kernel.org/linux-bluetooth/20260602204749.210857-1-luiz.dentz@gmail.com/T/#u Fixes: d3f7d17960ed ("Bluetooth: MGMT: validate Add Extended Advertising Data length") Signed-off-by: Luiz Augusto von Dentz commit 4847c5bca22227100ae69e96af86618b6fd2671f Author: SeungJu Cheon Date: Mon Jun 1 20:19:08 2026 +0900 Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect sco_sock_connect() copies the destination address into sco_pi(sk)->dst under lock_sock(), then releases the lock and calls sco_connect(), which reads dst, src, setting, and codec without holding lock_sock() in hci_get_route() and hci_connect_sco(). These fields may be modified concurrently by connect(), bind(), or setsockopt() on the same socket, resulting in data-races reported by KCSAN. Fix this by snapshotting dst, src, setting, and codec under lock_sock() at the start of sco_connect() before passing them to hci_get_route() and hci_connect_sco(). BUG: KCSAN: data-race in memcmp+0x45/0xb0 race at unknown origin, with read to 0xffff88800e6b0dd0 of 1 bytes by task 315 on cpu 0: memcmp+0x45/0xb0 hci_connect_acl+0x1b7/0x6b0 hci_connect_sco+0x4d/0xb30 sco_sock_connect+0x27b/0xd60 __sys_connect_file+0xbd/0xe0 __sys_connect+0xe0/0x110 __x64_sys_connect+0x40/0x50 x64_sys_call+0xcad/0x1c60 do_syscall_64+0x133/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 9a8ec9e8ebb5 ("Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm") Signed-off-by: SeungJu Cheon Signed-off-by: Luiz Augusto von Dentz commit 9ca7053d6215d89c33f28893bfd1625a32919d3f Author: SeungJu Cheon Date: Mon Jun 1 20:19:07 2026 +0900 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync() call hci_get_route() using iso_pi(sk)->dst, iso_pi(sk)->src, and iso_pi(sk)->src_type without holding lock_sock(). These fields may be modified concurrently by connect() or setsockopt() on the same socket, resulting in data-races reported by KCSAN. Fix this by snapshotting the required fields under lock_sock() before calling hci_get_route(). BUG: KCSAN: data-race in memcmp+0x45/0xb0 race at unknown origin, with read to 0xffff8880122135cf of 1 bytes by task 333 on cpu 1: memcmp+0x45/0xb0 hci_get_route+0x27e/0x490 iso_connect_cis+0x4c/0xa10 iso_sock_connect+0x60e/0xb30 __sys_connect_file+0xbd/0xe0 __sys_connect+0xe0/0x110 __x64_sys_connect+0x40/0x50 x64_sys_call+0xcad/0x1c60 do_syscall_64+0x133/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 241f51931c35 ("Bluetooth: ISO: Avoid circular locking dependency") Signed-off-by: SeungJu Cheon Signed-off-by: Luiz Augusto von Dentz commit f50331f2a1441ec49988832c3a95f2edacc47322 Author: Luiz Augusto von Dentz Date: Mon Jun 1 14:52:09 2026 -0400 Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer In iso_sock_rebind_bc(), the bis pointer is cached, then the socket lock is dropped: bis = iso_pi(sk)->conn->hcon; /* Release the socket before lookups since that requires hci_dev_lock * which shall not be acquired while holding sock_lock for proper * ordering. */ release_sock(sk); hci_dev_lock(bis->hdev); During the unlocked window, could a concurrent close() destroy the connection and free the bis structure, causing hci_dev_lock(bis->hdev) to access memory after it is freed, fix this by using the hdev reference which was safely acquired via iso_conn_get_hdev(). Fixes: d3413703d5f8 ("Bluetooth: ISO: Add support to bind to trigger PAST") Reported-by: Sashiko Signed-off-by: Luiz Augusto von Dentz commit 5cbf290b79351971f20c7a533247e8d58a3f970c Author: Luiz Augusto von Dentz Date: Mon Jun 1 14:45:42 2026 -0400 Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync hci_get_route() returns a reference-counted hci_dev pointer via hci_dev_hold(). The function exits normally or with an error without ever releasing it. Fixes: 07a9342b94a9 ("Bluetooth: ISO: Send BIG Create Sync via hci_sync") Reported-by: Sashiko Signed-off-by: Luiz Augusto von Dentz commit 37b3009bf5976e8ab77c8b9a9bc3bbd7ff49e37f Author: Bharath Reddy Date: Mon Jun 1 08:54:26 2026 +0530 Bluetooth: fix memory leak in error path of hci_alloc_dev() Early failures in Bluetooth HCI UART configuration leak SRCU percpu memory. When device initialization fails before hci_register_dev() completes, the HCI_UNREGISTER flag is never set. As a result, when the device reference count reaches zero, bt_host_release() evaluates this flag as false and falls back to a direct kfree(hdev). Because hci_release_dev() is bypassed, the SRCU struct initialized early in hci_alloc_dev() is never cleaned up, resulting in a leak of percpu memory. Fix the leak by explicitly calling cleanup_srcu_struct() in the fallback (unregistered) branch of bt_host_release() before freeing the device. Reported-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=535ecc844591e50588a5 Tested-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com Fixes: 1d6123102e9f ("Bluetooth: hci_core: Fix use-after-free in vhci_flush()") Signed-off-by: Bharath Reddy Signed-off-by: Luiz Augusto von Dentz commit 6770d3a8acdf9151769180cc3710346c4cfbe6f0 Author: Zhang Cen Date: Fri May 29 11:22:09 2026 +0800 Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU. bnep_rx_frame() reads the packet type byte immediately and, for control packets, reads the control opcode and setup UUID-size byte before proving that those bytes are present. bnep_rx_control() also dereferences the control opcode without rejecting an empty control payload. Use skb_pull_data() for the fixed fields in bnep_rx_frame() so a NULL return gates each dereference. Split the control handler so the frame path can pass an opcode that has already been pulled, and keep the byte-buffer wrapper for extension control payloads. For BNEP_SETUP_CONN_REQ, name the UUID-size byte before pulling the setup payload. struct bnep_setup_conn_req carries destination and source service UUIDs after that byte, each uuid_size bytes, so the parser now documents that tuple explicitly instead of leaving the pull length as an opaque multiplication. Validation reproduced this kernel report: KASAN slab-out-of-bounds in bnep_rx_frame.isra.0+0x130c/0x1790 The buggy address belongs to the object at ffff88800c0f7908 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes to the right of allocated 1-byte region [ffff88800c0f7908, ffff88800c0f7909) Read of size 1 Call trace: dump_stack_lvl+0xb3/0x140 (?:?) print_address_description+0x57/0x3a0 (?:?) bnep_rx_frame+0x130c/0x1790 (net/bluetooth/bnep/core.c:306) print_report+0xb9/0x2b0 (?:?) __virt_addr_valid+0x1ba/0x3a0 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) kasan_addr_to_slab+0x21/0x60 (?:?) kasan_report+0xe0/0x110 (?:?) process_one_work+0xfce/0x17e0 (kernel/workqueue.c:3200) worker_thread+0x65c/0xe40 (?:?) __kthread_parkme+0x184/0x230 (?:?) kthread+0x35e/0x470 (?:?) _raw_spin_unlock_irq+0x28/0x50 (?:?) ret_from_fork+0x586/0x870 (?:?) __switch_to+0x74f/0xdc0 (?:?) ret_from_fork_asm+0x1a/0x30 (?:?) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: Codex:gpt-5.5 Signed-off-by: Zhang Cen Signed-off-by: Luiz Augusto von Dentz commit 5c65b96b549ea2dcfde497436bf9e048deb87758 Author: Yuqi Xu Date: Fri May 29 16:54:23 2026 +0800 Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no longer fit in the temporary buffer used to rebuild the advertising data. Reject that case before copying the existing payload and report the failure through the device log. This keeps the existing advertising data intact and avoids overrunning the temporary buffer. Fixes: 5725bc608252 ("Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Zhengchuan Liang Reported-by: Xin Liu Assisted-by: Codex:GPT-5.4 Signed-off-by: Yuqi Xu Signed-off-by: Ren Wei Signed-off-by: Luiz Augusto von Dentz commit dd214733544427587a95f66dbf3adff072568990 Author: Michael Bommarito Date: Thu May 21 10:45:17 2026 -0400 Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2cap_core.c:l2cap_sig_channel() accepts BR/EDR signaling packets up to the channel MTU and dispatches each command without enforcing the signaling MTU (MTUsig). A Bluetooth BR/EDR peer within radio range can send a fixed-channel CID 0x0001 packet that is larger than MTUsig and contains many L2CAP_ECHO_REQ commands before pairing. In a real-radio stock-kernel run, one 681-byte signaling packet containing 168 zero-length ECHO_REQ commands made the target transmit 168 ECHO_RSP frames over about 220 ms. Impact: a Bluetooth BR/EDR peer within radio range, before pairing, can force 168 ECHO_RSP frames from one 681-byte fixed-channel signaling packet containing packed ECHO_REQ commands. Define Linux's BR/EDR signaling MTU as the spec minimum of 48 bytes and reject any larger signaling packet with one L2CAP_COMMAND_REJECT_RSP carrying L2CAP_REJ_MTU_EXCEEDED before any command is dispatched. The Bluetooth Core spec wording for MTUExceeded says the reject identifier shall match the first request command in the packet, and that packets containing only responses shall be silently discarded. Linux intentionally deviates from that prescription: silently discarding desynchronizes the peer because the remote stack never learns its responses were dropped, and locating the first request command requires walking command headers past MTUsig, i.e. processing bytes from a packet we have already decided is too large to process. We therefore always emit one reject and use the identifier from the first command header, a single fixed-offset byte read. The unrestricted BR/EDR signaling parser and ECHO_REQ response path both trace to the initial git import; no later introducing commit is available for a Fixes tag. Cc: stable@vger.kernel.org Suggested-by: Luiz Augusto von Dentz Link: https://lore.kernel.org/r/20260518002800.1361430-1-michael.bommarito@gmail.com Link: https://lore.kernel.org/r/20260520135034.1060859-1-michael.bommarito@gmail.com Link: https://lore.kernel.org/r/20260521000555.3712030-1-michael.bommarito@gmail.com Assisted-by: Claude:claude-opus-4-7 Assisted-by: Codex:gpt-5-5-xhigh Signed-off-by: Michael Bommarito Signed-off-by: Luiz Augusto von Dentz commit 23882b828c3c8c51d0c946446a396b10abb3b16b Author: SeungJu Cheon Date: Mon May 25 20:04:43 2026 +0900 Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can send truncated MCC frames and trigger out-of-bounds reads in these handlers. Fix this by using skb_pull_data() to validate and access the required data before dereferencing it. rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows 1-byte RPN requests. Handle this by validating only the DLCI byte first, and validating the full struct only when len > 1. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Muhammad Bilal Signed-off-by: SeungJu Cheon Signed-off-by: Luiz Augusto von Dentz commit de23fb62259aa01d294f77238ae3b835eb674413 Author: Zhang Cen Date: Thu May 28 17:45:06 2026 +0800 Bluetooth: MGMT: validate advertising TLV before type checks tlv_data_is_valid() reads each advertising data field length from data[i], then inspects data[i + 1] for managed EIR types before checking that the current field still fits inside the supplied buffer. A malformed field whose length byte is the last byte of the buffer can therefore make the parser read one byte past the advertising data. KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING request reached that path: BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid() Read of size 1 Call trace: tlv_data_is_valid() add_advertising() hci_mgmt_cmd() hci_sock_sendmsg() Move the existing element-length check before any type-octet inspection so each non-empty element is proven to contain its type byte before the parser looks at data[i + 1]. Fixes: 2bb36870e8cb ("Bluetooth: Unify advertising instance flags check") Reviewed-by: Paul Menzel Signed-off-by: Zhang Cen Signed-off-by: Luiz Augusto von Dentz commit 43c441edacf953b39517a44f5e5e10a93618b226 Author: Zhang Cen Date: Thu May 28 15:56:41 2026 +0800 Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock, but returns the selected listener after dropping that lock without taking a reference. rfcomm_connect_ind() then locks the listener, queues a child socket on it, and may notify it after unlocking it. The buggy scenario involves two paths, with each column showing the order within that path: rfcomm_connect_ind(): listener close: 1. Find parent in 1. close() enters rfcomm_get_sock_by_channel() rfcomm_sock_release(). 2. Drop rfcomm_sk_list.lock 2. rfcomm_sock_shutdown() without pinning parent. closes the listener. 3. Call lock_sock(parent) and 3. rfcomm_sock_kill() bt_accept_enqueue(parent, unlinks and puts parent. sk, true). 4. Read parent flags and may 4. parent can be freed. call sk_state_change(). If close wins the race, parent can be freed before rfcomm_connect_ind() reaches lock_sock(), bt_accept_enqueue(), or the deferred-setup callback. Take a reference on the listener before leaving rfcomm_sk_list.lock. After lock_sock() succeeds, recheck that it is still in BT_LISTEN before queueing a child, cache the deferred-setup bit while the parent is locked, and drop the reference after the last parent use. KASAN reported a slab-use-after-free in lock_sock_nested() from rfcomm_connect_ind(), with the freeing stack going through rfcomm_sock_kill() and rfcomm_sock_release(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhang Cen Signed-off-by: Luiz Augusto von Dentz commit bd2e19cf8f3028620428c698f6783de5306a6342 Merge: db38bcb3311053 c1edda54a0f713 Author: Paolo Bonzini Date: Wed Jun 3 16:46:31 2026 +0200 Merge tag 'kvm-s390-master-7.1-3' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: More gmap and vsie fixes commit db38bcb3311053954f62b865cd2d86e164b04351 Author: Sean Christopherson Date: Fri May 29 20:35:42 2026 +0200 KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free Unmap and unpin the GHCB as needed when freeing a vCPU. If the VM is destroyed after mapping+pinning the GHCB on #VMGEXIT, without re-running the vCPU, KVM will effectively leak the GHCB and any mappings created for the GHCB. Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT") Cc: stable@vger.kernel.org Tested-by: Michael Roth Reviewed-by: Tom Lendacky Reviewed-by: Michael Roth Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-18-seanjc@google.com> Signed-off-by: Paolo Bonzini Message-ID: <20260529183549.1104619-18-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini commit f041dc80de4abbdd0909d871bf64f3f87d2350ff Author: Sean Christopherson Date: Fri May 29 20:35:41 2026 +0200 KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA Decouple synchronizing the GHCB SA from freeing/unpinning the SA, so that the free/unpin path can be reused when freeing a vCPU. Opportunistically add a WARN to harden KVM against stomping over (and thus leaking) an already-allocated scratch area. Cc: stable@vger.kernel.org Reviewed-by: Tom Lendacky Reviewed-by: Michael Roth Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-17-seanjc@google.com> Signed-off-by: Paolo Bonzini Message-ID: <20260529183549.1104619-17-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini commit 08385c5e1814edee829ffe475d559ed730354335 Author: Sean Christopherson Date: Fri May 29 20:35:40 2026 +0200 KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() Relocate sev_free_vcpu() down in sev.c so that it's definition comes after sev_es_unmap_ghcb(). This will allow sharing unmap functionality between the two functions without needing a forward declaration (or weird placement of the common code). No functional change intended. Cc: stable@vger.kernel.org Reviewed-by: Tom Lendacky Reviewed-by: Michael Roth Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-16-seanjc@google.com> Signed-off-by: Paolo Bonzini Message-ID: <20260529183549.1104619-16-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini commit 8618004d3e897c0f1b71d9a9ab860461289bb89a Author: Sean Christopherson Date: Fri May 29 20:35:39 2026 +0200 KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying When marking a page dirty, complain about not having a running/loaded vCPU if and only if the VM is still alive, i.e. its refcount is non-zero. This will allow fixing a memory leak for x86 SEV-ES guests without hitting what is effectively a false positive on the WARN. For some SEV-ES VM-Exits, KVM keeps a writable mapping of a guest page across an exit to userspace, and typically unmaps the page on the next KVM_RUN. But if userspace never calls KVM_RUN after such an exit, then KVM needs to unmap the page when the vCPU is destroyed, which in turn triggers the WARN about not having a running vCPU. Alternatively, SEV-ES could temporarily load the vCPU to suppress the WARN, as is done in nested_vmx_free_vcpu() (but for completely unrelated reasons; suppressing WARN from nested_put_vmcs12_pages() is pure happenstance). But loading a vCPU during destruction is gross (ideally nVMX code would be cleaned up), risks complicating the SEV-ES code (KVM would need to ensure the temporarily load()+put() only runs when the vCPU isn't already loaded), and is ultimately pointless. The motivation for the WARN is to guard against KVM dirtying guest memory without pushing the corresponding GFN to the active vCPU's dirty ring, e.g. to ensure userspace doesn't miss a dirty page. But for the VM's refcount to reach zero, there can't be _any_ userspace mappings to the dirty ring, as mapping the dirty ring requires doing mmap() on the vCPU FD. I.e. if userspace had a valid mapping for the dirty ring, then the vCPU file and thus the owning VM would still be alive. And so since userspace can't possibly reach the dirty ring, whether or not KVM technically "misses" a push to the dirty ring is irrelevant. Reported-by: Michael Roth Cc: stable@vger.kernel.org Reviewed-by: Michael Roth Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-15-seanjc@google.com> Signed-off-by: Paolo Bonzini Message-ID: <20260529183549.1104619-15-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini commit ce6ea7b33e0075335b1eb3b227a21a98e3196e41 Author: Sean Christopherson Date: Fri May 29 20:35:38 2026 +0200 KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT Rework Page State Change (PSC) handling to read the guest-provided start and end indices exactly once, at the beginning of the request. Re-reading the indices is "fine", _if_ the guest is well-behaved. KVM _should_ be safe against concurrent guest modification of the indices, but there is zero reason to introduce unnecessary risk. Reviewed-by: Tom Lendacky Reviewed-by: Michael Roth Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-14-seanjc@google.com> Signed-off-by: Paolo Bonzini Message-ID: <20260529183549.1104619-14-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini commit 00b9744a3688758c5c492756d08a1cd599a76965 Author: Sean Christopherson Date: Fri May 29 20:35:37 2026 +0200 KVM: SEV: Add an anonymous "psc" struct to track current PSC metadata Add a "psc" struct to vcpu_sev_es_state to avoid having to prefix all of the fields with "psc_". Take advantage of the code churn to opportunistically rename local variables to "guest_psc" to make it more obvious that the buffer is guest data, and more importantly, guest accessible! Opportunistically rename inflight => batch_size as well, because there can really only be one operation in-flight (per-vCPU), i.e. "inflight" _looks_ like a boolean, but in actuality is an integer tracking how many pages are being handled by the current operation. No functional change intended. Reviewed-by: Tom Lendacky Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-13-seanjc@google.com> Signed-off-by: Paolo Bonzini Message-ID: <20260529183549.1104619-13-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini commit 17d62e0b157f262dd8c7586cb882ece72a5b10c2 Author: Sean Christopherson Date: Fri May 29 20:35:36 2026 +0200 KVM: SEV: Make it more obvious when KVM is writing back the current PSC index Increment the guest-visible "cur_entry" index outside of the for-loop when processing Page State Change entries, and add a comment to make it more obvious which code is operating on trusted data, and which code is touching guest-accessible data. No functional change intended. Reviewed-by: Tom Lendacky Reviewed-by: Michael Roth Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-12-seanjc@google.com> Signed-off-by: Paolo Bonzini Message-ID: <20260529183549.1104619-12-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini commit 9bfaa86b405381326c971984fd6da184c289713f Author: Li RongQing Date: Wed Jun 3 20:37:08 2026 +0800 dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device In debug_dma_sync_sg_for_device(), when iterating over a scatterlist, the debug entry population mistakenly uses the head of the scatterlist 'sg' to fetch the physical address via sg_phys(), instead of using the current iterator variable 's'. This causes dma-debug to track the physical address of the very first scatterlist entry for all subsequent entries in the list. Fix this by passing the correct loop iterator 's' to sg_phys() Fixes: 9d4f645a1fd49ee ("dma-debug: store a phys_addr_t in struct dma_debug_entry") Signed-off-by: Li RongQing Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260603123708.1665-1-lirongqing@baidu.com commit 15fe76e23615f502d051ef0768f86babaf08746c Author: Jason Gunthorpe Date: Mon Jun 1 13:52:31 2026 -0300 RDMA/umem: Fix truncation for block sizes >= 4G When the iommu is used the linearization of the mapping can give a single block that is very large split across multiple SG entries. When __rdma_block_iter_next() reassembles the split SG entries it is overflowing the 32 bit stack values and computed the wrong DMA addresses for blocks after the truncation. Use the right types to hold DMA addresses. Link: https://patch.msgid.link/r/1-v1-88303e9e509f+f7-ib_umem_types_jgg@nvidia.com Cc: stable@vger.kernel.org Fixes: a808273a495c ("RDMA/verbs: Add a DMA iterator to return aligned contiguous memory blocks") Signed-off-by: Jason Gunthorpe commit cb9959ab5f99611d27a06586add84811fe8102dc Author: Johannes Berg Date: Wed Jun 3 11:18:11 2026 +0200 wifi: cfg80211: enforce HE/EHT cap/oper consistency Xiang Mei reports that mac80211 could crash if eht_cap is set but eht_oper isn't. Rather than fixing that for the individual user(s), enforce that both HE/EHT have consistent elements. Reported-by: Xiang Mei Fixes: 22c64f37e1d4 ("wifi: mac80211: Update MCS15 support in link_conf") Link: https://patch.msgid.link/20260603091812.101894-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg commit 7f93fad5ea0affc9e1505dd0f7596c0fdb496213 Author: Maíra Canal Date: Tue Jun 2 14:50:15 2026 -0300 drm/v3d: Skip CSD when it has zeroed workgroups A compute shader dispatch encodes its workgroup counts in the CFG0..CFG2 registers. Kicking off a dispatch with a zero count in any of the three dimensions is invalid. First, the hardware will process 0 as 65536, while the user-space driver exposes a maximum of 65535. Over that, a submission with a zeroed workgroup dimension should be a no-op. These zeroed counts can reach the dispatch path through an indirect CSD job, whose workgroup counts are only known once the indirect buffer is read and may legitimately be zero, but such scenario should only result in a no-op. Overwrite the indirect CSD job workgroup counts with the indirect BO ones, even if they are zeroed, and don't submit the job to the hardware when any of the workgroup counts is zero, so the job completes immediately instead of running the shader. Cc: stable@vger.kernel.org Fixes: d223f98f0209 ("drm/v3d: Add support for compute shader dispatch.") Suggested-by: Jose Maria Casanova Crespo Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260602-v3d-fix-indirect-csd-v4-2-654309e32bc0@igalia.com Signed-off-by: Maíra Canal commit ae7676952790f421c40918e2586a2c9f12a682b6 Author: Maíra Canal Date: Tue Jun 2 14:50:14 2026 -0300 drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups v3d_rewrite_csd_job_wg_counts_from_indirect() maps both the indirect buffer and the workgroup buffer and is expected to release them before returning. When any of the workgroup counts read from the buffer is zero, the function bailed out early and skipped the cleanup, leaking the vaddr mappings of both BOs. Jump to the cleanup path instead of returning directly, so the mappings are always dropped. Cc: stable@vger.kernel.org Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job") Suggested-by: Jose Maria Casanova Crespo Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260602-v3d-fix-indirect-csd-v4-1-654309e32bc0@igalia.com Signed-off-by: Maíra Canal commit d9022172c1abea9e220d13ee453813dafec5b9e4 Author: Gabriele Monaco Date: Mon Jun 1 17:38:37 2026 +0200 rv: Use 0 to check preemption enabled in opid Tracepoint handlers no longer run with preemption disabled by default since a46023d5616 ("tracing: Guard __DECLARE_TRACE() use of __DO_TRACE_CALL() with SRCU-fast"), the opid monitor should now count 1 in the preemption count as preemption disabled. Change the rule for preempt_off to preempt > 0. Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-11-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 7c147fae71f3b3542ba3292d2099ef7237cfc0da Author: Gabriele Monaco Date: Mon Jun 1 17:38:36 2026 +0200 rv: Prevent task migration while handling per-CPU events Tracepoint handlers are fully preemptible after a46023d5616 ("tracing: Guard __DECLARE_TRACE() use of __DO_TRACE_CALL() with SRCU-fast"). When a per-CPU monitor handles an event, it retrieves the monitor state using a per-CPU pointer. If the event itself doesn't disable preemption, the task can migrate to a different CPU and we risk updating the wrong monitor. Mitigate this by explicitly disabling task migration before acquiring the monitor pointer. This cannot guarantee the monitor runs on the correct CPU but reduces the race condition window and prevents warnings. Reviewed-by: Wen Yang Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-10-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 74e17bd6fc8ed7e30363bb78d4c50b38cfd71efe Author: Gabriele Monaco Date: Mon Jun 1 17:38:35 2026 +0200 rv: Ensure synchronous cleanup for HA monitors HA monitors may start timers, all cleanup functions currently stop the timers asynchronously to avoid sleeping in the wrong context. Nothing makes sure running callbacks terminate on cleanup. Run the entire HA timer callback in an RCU read-side critical section, this way we can simply synchronize_rcu() with any pending timer and are sure any cleanup using kfree_rcu() runs after callbacks terminated. Additionally make sure any unlikely callback running late won't run any code if the monitor is marked as disabled or if destruction started. Use memory barriers to serialise with racing resets. Fixes: f5587d1b6ec9 ("rv: Add Hybrid Automata monitor type") Fixes: 4a24127bd6cb ("rv: Add support for per-object monitors in DA/HA") Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-9-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 700782ec8f6589c5792b323efd6e004dd183328b Author: Gabriele Monaco Date: Mon Jun 1 17:38:34 2026 +0200 rv: Add automatic cleanup handlers for per-task HA monitors Hybrid automata monitors may start timers, depending on the model, these may remain active on an exiting task and cause false positives or even access freed memory. Add an enable/disable hook in the HA code, currently only populated by the per-task handler for registration and deregistration. This hooks to the sched_process_exit event and ensures the timer is stopped for every exiting task. The handler is enabled automatically but may be disabled, for instance if the monitor uses the event for another purpose (but should still manually ensure timers are stopped). Fixes: f5587d1b6ec9 ("rv: Add Hybrid Automata monitor type") Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-8-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 713c9e1ea7623846f8e0bb657f1b9d211d1a61e6 Author: Gabriele Monaco Date: Mon Jun 1 17:38:33 2026 +0200 rv: Do not rely on clean monitor when initialising HA Hybrid Automata monitors hook into the DA implementation when doing da_monitor_reset(). This function is called both on initialisation and teardown, HA monitors try to cancel a timer only when it's initialised relying on the da_mon->monitoring flag. This flag could however be corrupted during initialisation. This happens for instance on per-task monitors that share the same storage with different type of monitors like LTL or in case of races during a previous teardown. Stop relying on the monitoring flag during initialisation, assume that can have any value, so use a separate da_reset_state() skiping timer cancellation. New monitors (e.g. new tasks) are always zero-initialised so it is safe to rely on the monitoring flag for those. Reported-by: Wen Yang Closes: https://lore.kernel.org/lkml/d02c656aada7d071f083460a5c9a454363669b61.1778522945.git.wen.yang@linux.dev Suggested-by: Nam Cao Fixes: f5587d1b6ec9 ("rv: Add Hybrid Automata monitor type") Reviewed-by: Wen Yang Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-7-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 2b9a8c27417eeef01967c6297def426a44776c04 Author: Wen Yang Date: Mon Jun 1 17:38:32 2026 +0200 rv: Fix monitor start ordering and memory ordering for monitoring flag da_monitor_start() set monitoring=1 before calling da_monitor_init_hook(), may racing with the sched_switch handler: da_monitor_start() sched_switch handler ------------------------- --------------------------------- da_mon->monitoring = 1; if (da_monitoring(da_mon)) /* true */ ha_start_timer_ns(...); /* hrtimer->base == NULL, crash */ da_monitor_init_hook(da_mon); /* hrtimer_setup() sets base */ Fix the ordering and pair with release/acquire semantics: da_monitor_init_hook(da_mon); smp_store_release(&da_mon->monitoring, 1); /* da_monitor_start() */ return smp_load_acquire(&da_mon->monitoring); /* da_monitoring() */ On ARM64 a plain STR + LDR does not form a release-acquire pair, so the load can observe monitoring=1 while hrtimer->base is still NULL. The plain accesses are also data races under KCSAN. Use WRITE_ONCE for the monitoring=0 store in da_monitor_reset() to cover the reset path. Fixes: 792575348ff7 ("rv/include: Add deterministic automata monitor definition via C macros") Signed-off-by: Wen Yang Reviewed-by: Gabriele Monaco Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-6-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 32171d828ab964dc1f05f2056a81477522a3361b Author: Gabriele Monaco Date: Mon Jun 1 17:38:31 2026 +0200 rv: Ensure all pending probes terminate on per-obj monitor destroy The monitor disable/destroy sequence detaches all probes and resets the monitor's data, however it doesn't wait for pending probes. This is an issue with per-object monitors, which free the monitor storage. Call tracepoint_synchronize_unregister() to make sure to wait for all pending probes before destroying the monitor storage. Fixes: 4a24127bd6cb ("rv: Add support for per-object monitors in DA/HA") Reviewed-by: Wen Yang Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-5-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit c3d016ea823a9941ab8cbcef01a500821ff0cf16 Author: Gabriele Monaco Date: Mon Jun 1 17:38:30 2026 +0200 rv: Prevent in-flight per-task handlers from using invalid slots Per-task monitors use a slot in the task_struct->rv[] array and store that locally (e.g. task_mon_slot), this slot is returned during the destruction process but currently hanlers can be running while that slot is returning and this race may lead to accessing an invalid slot. Synchronise with all in-flight tracepoint handlers using tracepoint_synchronize_unregister() before returning the slot. Fixes: f5587d1b6ec9 ("rv: Add Hybrid Automata monitor type") Fixes: a9769a5b9878 ("rv: Add support for LTL monitors") Suggested-by: Wen Yang Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-4-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit e32d7f404d7d9dac307c1cd9a1fe132fa62ab6d6 Author: Gabriele Monaco Date: Mon Jun 1 17:38:29 2026 +0200 rv: Reset per-task DA monitors before releasing the slot Per-task monitors use task_mon_slot to determine which slot in the array to use for the monitor. During destruction, this slot is returned but this is done before resetting the monitor. As a result, the monitor's reset is in fact resetting a slot that is outside of the array (RV_PER_TASK_MONITOR_INIT). Release the slot only after the reset to avoid out-of-bound memory access. Fixes: f5587d1b6ec93 ("rv: Add Hybrid Automata monitor type") Cc: stable@vger.kernel.org Suggested-by: Wen Yang Reviewed-by: Wen Yang Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-3-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 4793e8a6e20e4c17ed4e755ea40e5912cc3539af Author: Gabriele Monaco Date: Mon Jun 1 17:38:28 2026 +0200 rv: Fix __user specifier usage in extract_params() The attributes variables extracted from syscalls in the helper are both defined with the __user specifier although only the actual pointer to user data should be marked. Remove the __user specifier from attr. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604150820.Ny143u6X-lkp@intel.com Fixes: b133207deb72 ("rv: Add nomiss deadline monitor") Reviewed-by: Wen Yang Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-2-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit fba0510cd62666951dcc0221527edc0c47ae6599 Author: Bartosz Golaszewski Date: Thu May 21 10:36:27 2026 +0200 pmdomain: imx: fix OF node refcount for_each_child_of_node_scoped() decrements the reference count of the nod after each iteration. Assigning it without incrementing the refcount to a dynamically allocated platform device will result in a double put in platform_device_release(). Add the missing call to of_node_get(). Cc: stable@vger.kernel.org Fixes: 3e4d109ee8fc ("pmdomain: imx: gpc: Simplify with scoped for each OF child loop") Signed-off-by: Bartosz Golaszewski Signed-off-by: Ulf Hansson commit 4db207599acfc9d676340daa2dc6b52bfca17db4 Author: Kendall Willis Date: Wed May 6 22:16:45 2026 -0500 pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source Set wakeup constraint for any device in a wakeup path. All parent devices of a wakeup device should not be turned off during suspend. This ensures the wakeup device is kept on while the system is suspended. Cc: stable@vger.kernel.org Fixes: 9d8aa0dd3be4 ("pmdomain: ti_sci: add wakeup constraint management") Reported-by: Vitor Soares Closes: https://lore.kernel.org/linux-pm/c0fe43a2339c802e9ce5900092cd530a2ba17a6b.camel@gmail.com/ Signed-off-by: Kendall Willis Reviewed-by: Sebin Francis Signed-off-by: Ulf Hansson commit 26eb7c0a7ab09d83eec833db6a5a2bc60b9d4d9a Author: Chaitanya Kumar Borah Date: Mon Jun 1 13:59:53 2026 +0530 drm/i915: Fix color blob reference handling in intel_plane_state Take proper references for hw color blobs (degamma_lut, gamma_lut, ctm, lut_3d) in intel_plane_duplicate_state() and drop them in intel_plane_destroy_state(). v2: - handle blobs in hw state clear Cc: #v6.19+ Fixes: 3b7476e786c2 ("drm/i915/color: Add framework to program PRE/POST CSC LUT") Fixes: a78f1b6baf4d ("drm/i915/color: Add framework to program CSC") Fixes: 65db7a1f9cf7 ("drm/i915/color: Add 3D LUT to color pipeline") Reviewed-by: Pranay Samala #v1 Reviewed-by: Uma Shankar Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260601082953.128539-4-chaitanya.kumar.borah@intel.com (cherry picked from commit c6eea1925154b6697fe22b217faab9bb30635e6b) Signed-off-by: Tvrtko Ursulin commit 7752c543536d614bfad7ada731bcee90bd214a52 Merge: e8694f7cc29287 093305d801fae6 Author: Johannes Berg Date: Tue Jun 2 13:28:38 2026 +0200 Merge tag 'iwlwifi-fixes-2026-05-31' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next wifi: iwlwifi: fixes - 2026-05-31 Miri Korenblit says: ==================== This contains a few fixes: - Don't grab nic access in non-fast-resume - Don't send a large hcmd than transport supports - In AP mode, don't send tx power constraints command before activating the link - Don't do sw reset handshake on older firmwares. ==================== Signed-off-by: Johannes Berg commit e8694f7cc29287e843648d1075177b9a2000d957 Author: Fedor Pchelkin Date: Mon Jun 1 12:41:56 2026 +0300 wifi: fix leak if split 6 GHz scanning fails rdev->int_scan_req is leaked if cfg80211_scan() fails. Note that it's supposed to be released at ___cfg80211_scan_done() but this doesn't happen as rdev->scan_req is NULL at that point, too, leading to the early return from the freeing function. unreferenced object 0xffff8881161d0800 (size 512): comm "wpa_supplicant", pid 379, jiffies 4294749765 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................ backtrace (crc c867fdb6): kmemleak_alloc+0x89/0x90 __kmalloc_noprof+0x2fd/0x410 cfg80211_scan+0x133/0x730 nl80211_trigger_scan+0xc69/0x1cc0 genl_family_rcv_msg_doit+0x204/0x2f0 genl_rcv_msg+0x431/0x6b0 netlink_rcv_skb+0x143/0x3f0 genl_rcv+0x27/0x40 netlink_unicast+0x4f6/0x820 netlink_sendmsg+0x797/0xce0 __sock_sendmsg+0xc4/0x160 ____sys_sendmsg+0x5e4/0x890 ___sys_sendmsg+0xf8/0x180 __sys_sendmsg+0x136/0x1e0 __x64_sys_sendmsg+0x76/0xc0 x64_sys_call+0x13f0/0x17d0 Found by Linux Verification Center (linuxtesting.org). Fixes: c8cb5b854b40 ("nl80211/cfg80211: support 6 GHz scanning") Signed-off-by: Fedor Pchelkin Link: https://patch.msgid.link/20260601094157.92703-1-pchelkin@ispras.ru Signed-off-by: Johannes Berg commit 560000d619ef162568746ce287f0c725e24ea967 Author: Li RongQing Date: Wed Jun 3 09:37:23 2026 +0800 dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments In dma_direct_map_sg(), the case PCI_P2PDMA_MAP_THRU_HOST_BRIDGE incorrectly used 'break' instead of falling through to MAP_NONE. As a result, segments traversing the host bridge skipped the required dma_direct_map_phys() call entirely, leaving sg->dma_address uninitialized and leading to DMA failures. Fix this by using 'fallthrough;'. Fixes: a25e7962db0d79 ("PCI/P2PDMA: Refactor the p2pdma mapping helpers") Reviewed-by: Logan Gunthorpe Signed-off-by: Li RongQing Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260603013723.2439-1-lirongqing@baidu.com commit f723ccaff2fb72b71ae8a9fd283f0dee4d9ae7a3 Author: Jiayuan Chen Date: Fri May 29 23:22:18 2026 +0800 ipv6: anycast: insert aca into global hash under idev->lock syzbot reported a splat [1]: a slab-use-after-free in ipv6_chk_acast_addr(), which walks the global inet6_acaddr_lst[] hash under RCU and dereferences a struct ifacaddr6 that has already been freed while still linked in the hash, so a later reader walks into a dangling node. In __ipv6_dev_ac_inc() the aca is allocated with refcount 1, then aca_get() bumps it to 2 to keep it alive across the unlocked region. It is published to idev->ac_list under idev->lock, but ipv6_add_acaddr_hash() runs after write_unlock_bh(). A concurrent teardown (ipv6_ac_destroy_dev() from addrconf_ifdown(), under RTNL) can slip into that window: CPU0 __ipv6_dev_ac_inc CPU1 ipv6_ac_destroy_dev (RTNL) ------------------------------ ------------------------------------ aca_alloc() refcnt 1 aca_get() refcnt 2 write_lock_bh(idev->lock) add aca to ac_list write_unlock_bh(idev->lock) write_lock_bh(idev->lock) pull aca off ac_list write_unlock_bh(idev->lock) ipv6_del_acaddr_hash(aca) hlist_del_init_rcu() is a no-op, aca is not in the hash yet aca_put() refcnt 2->1 ipv6_add_acaddr_hash(aca) aca now inserted into the hash aca_put() refcnt 1->0 call_rcu(aca_free_rcu) -> kfree(aca) The hash removal becomes a no-op because the insertion has not happened yet, so once CPU0 inserts and drops the last reference, the aca is freed while still linked in inet6_acaddr_lst[], and readers dereference freed memory after the slab slot is reused. This window opened once RTNL stopped serializing the join path against device teardown. Move ipv6_add_acaddr_hash() inside the idev->lock section so the ac_list and hash insertions are atomic with respect to teardown: a racing remover now either misses the aca entirely or finds it in both lists. acaddr_hash_lock is now nested under idev->lock, which is acquired in softirq context, so switch all acaddr_hash_lock sites to spin_lock_bh() to avoid the irq lock inversion reported in [2]. [1] https://syzkaller.appspot.com/bug?extid=a01df04303c131efbf3a [2] https://lore.kernel.org/netdev/6a194ef7.ba3b1513.1890b4.0000.GAE@google.com/ Reported-by: syzbot+819eb928d120d2bdad0e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6a191f87.ce022c6e.138e56.0003.GAE@google.com/T/ Reviewed-by: Kuniyuki Iwashima Fixes: eb1ac9ff6c4a ("ipv6: anycast: Don't hold RTNL for IPV6_JOIN_ANYCAST.") Signed-off-by: Jiayuan Chen Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260529152219.235475-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit ad0979fe053e9f2db82da82188256ef6eb41095a Author: Zeyu WANG Date: Wed Jun 3 01:09:09 2026 +0800 Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) The Lenovo Yoga Air 14 (83QK) laptop keyboard becomes unresponsive after the standard atkbd init sequence. Controlled testing on the actual hardware shows the F5 (ATKBD_CMD_RESET_DIS / deactivate) command specifically corrupts the EC state, causing zero IRQ1 interrupts after init. Skipping only the deactivate command (while keeping F4 ENABLE) resolves the issue completely: both keystroke input and CapsLock LED toggle work correctly. The reverse test - skipping only F4 while keeping F5 - makes the problem worse (zero keystroke interrupts), confirming F5 is the sole culprit. Add a DMI quirk entry for LENOVO/83QK using the existing atkbd_deactivate_fixup callback, consistent with the existing entries for LG Electronics and HONOR FMB-P that address the same EC F5 deactivate issue. Signed-off-by: Zeyu WANG Link: https://patch.msgid.link/20260602170909.14725-1-zeyu.thomas.wang@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 57aff991119693e09b414aff3267c0eae5e81da0 Author: Ridong Chen Date: Tue Jun 2 17:10:38 2026 +0800 cgroup/cpuset: Change Ridong's email The chenridong@huaweicloud.com is no longer a valid email, replace it with the personal email ridong.chen@linux.dev Signed-off-by: Ridong Chen Acked-by: Waiman Long Signed-off-by: Tejun Heo commit 02e545c4297a26dbbc41df81b831e7f605bcd306 Author: Tejun Heo Date: Mon Jun 1 09:22:37 2026 -1000 sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() A WARN fires when systemd's user manager writes "+cpu +memory +pids" to its own subtree_control while a sched_ext scheduler is loaded: WARNING: at kernel/sched/ext.c:3227 scx_cgroup_move_task+0xa8/0xb0 scx_cgroup_move_task+0xa8/0xb0 sched_move_task+0x134/0x290 cpu_cgroup_attach+0x39/0x70 cgroup_migrate_execute+0x37d/0x450 cgroup_update_dfl_csses+0x1e3/0x270 cgroup_subtree_control_write+0x3e7/0x440 scx_cgroup_can_attach() arms cgrp_moving_from only when a task's cpu cgroup changes. It can still be NULL when scx_cgroup_move_task() runs, through this sequence: Step Result --------------------------------- ---------------------------------- 1. cpu enabled on cgroup G cpu css = A 2. cpu toggled off then on for G A killed, B created (same cgroup) 3. an exiting task keeps A alive migration skips it, A now stale 4. +memory migrates G stale A vs current B pulls cpu in 5. cpu attach runs for all tasks hits a live, cpu-unchanged task 6. scx_cgroup_move_task() on it cgrp_moving_from NULL -> WARN The mismatch is that scx_cgroup_can_attach() keys on cgroup identity while migration drives the move on css identity, so a NULL cgrp_moving_from here is a legitimate css-only migration, not a missing prep. The call is already gated on cgrp_moving_from, so just drop the warning. ops.cgroup_prep_move() and ops.cgroup_move() stay paired. Fixes: 819513666966 ("sched_ext: Add cgroup support") Cc: stable@vger.kernel.org # v6.12+ Reported-by: Matt Fleming Closes: https://lore.kernel.org/all/20260601124156.2205704-1-mfleming@cloudflare.com/ Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 5eba3e48d78edd7551b992cb7ba687019b3a78da Author: Zhao Zhang Date: Sat May 30 23:57:14 2026 +0800 sctp: diag: reject stale associations in dump_one path The SCTP exact sock_diag lookup can hold a transport reference, block on lock_sock(sk), and then resume after sctp_association_free() has marked the association dead and freed its bind address list. When that happens, inet_assoc_attr_size() and inet_diag_msg_sctpasoc_fill() can still dereference association state that is no longer valid for reporting. In particular, inet_diag_msg_sctpasoc_fill() may read an empty bind-address list as a real sctp_sockaddr_entry and trigger an out-of-bounds read from unrelated association memory. Reject the association after taking the socket lock if it has been reaped or detached from the endpoint, and report the lookup as stale. This keeps the exact dump-one path from formatting torn association state. Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Zhengchuan Liang Reported-by: Xin Liu Signed-off-by: Zhao Zhang Signed-off-by: Ren Wei Acked-by: Xin Long Link: https://patch.msgid.link/fac6043fa20a2ff68e12958c431836f692c51268.1780113823.git.zzhan461@ucr.edu Signed-off-by: Jakub Kicinski commit b455410146bf723c7ebcb49ecd5becc0d6611482 Author: Tapio Reijonen Date: Fri May 29 06:18:57 2026 +0000 net: fec: fix pinctrl default state restore order on resume In fec_resume(), fec_enet_clk_enable() is called before pinctrl_pm_select_default_state() in the non-WoL path, inverting the ordering used in fec_suspend() which correctly switches to the sleep pinctrl state before disabling clocks. For PHYs with the PHY_RST_AFTER_CLK_EN flag (e.g. TI DP83848 or SMSC LAN87xx), fec_enet_clk_enable() triggers a hardware reset pulse via the phy-reset GPIO. With the GPIO pin still in sleep pinctrl state at that point, the GPIO write has no physical effect and the PHY never receives the required reset after clock enable, leading to unreliable link establishment after system resume. Fix by restoring the default pinctrl state before enabling clocks, making resume the proper mirror of suspend. The call is made unconditionally: fec_suspend() only switches to the sleep pinctrl state on the non-WoL path and leaves the pins in the default state when WoL is enabled, so on a WoL resume the device is already in the default state and pinctrl_pm_select_default_state() is a no-op. Fixes: de40ed31b3c5 ("net: fec: add Wake-on-LAN support") Signed-off-by: Tapio Reijonen Reviewed-by: Wei Fang Link: https://patch.msgid.link/20260529-b4-fec-resume-pinctrl-order-v3-1-6eda0f592fca@vaisala.com Signed-off-by: Jakub Kicinski commit 8173d22b211f615015f7b35f48ab11a6dd78dc99 Author: David Thompson Date: Fri May 29 21:03:00 2026 +0000 net: lan743x: permit VLAN-tagged packets up to configured MTU VLAN-tagged interfaces on lan743x devices were previously unreachable via SSH and failed to respond to large ping packets (e.g. "ping -s 1469" given MTU=1500). In these scenarios, "ethtool -S" reports non-zero "RX Oversize Frame Errors". According to Microchip AN2948, the MAC_RX FSE (VLAN field size enforcement) bit determines whether frames with VLAN tags exceeding the base MTU plus tag length are discarded. The driver must set the MAC_RX.FSE bit before setting MAC_RX.RXEN to allow VLAN-tagged frames up to the interface MTU, preventing them from being treated as oversized. As a result, both the base and VLAN-tagged interfaces can use the same MTU without receive errors. Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver") Signed-off-by: David Thompson Reviewed-by: Thangaraj Samynathan Reviewed-by: Nicolai Buchwitz Tested-by: Nicolai Buchwitz # lan7430 on arm64 (RevPi Link: https://patch.msgid.link/20260529210300.433135-1-davthompson@nvidia.com Signed-off-by: Jakub Kicinski commit 20cf0fb715c41111469577e85e35d15f099473e0 Author: Yuqi Xu Date: Fri May 29 21:01:44 2026 +0800 net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so it can run during partial startup and on repeated shutdown attempts. It uses NULL pointers to distinguish resources that are still owned from resources that have already been released. When rds_ib_setup_qp() fails after allocating i_sends but before allocating i_recvs, the sends_out path frees i_sends without clearing the pointer. A later shutdown pass can still treat that stale pointer as a live send ring allocation. Clear i_sends after vfree() in the error unwind path so the existing shutdown logic continues to use the correct ownership state. Fixes: 3b12f73a5c29 ("rds: ib: add error handle") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Zhengchuan Liang Reported-by: Xin Liu Signed-off-by: Yuqi Xu Signed-off-by: Ren Wei Reviewed-by: Allison Henderson Link: https://patch.msgid.link/5a0f7624bb9845a7b67d26166a150b59e7f394ce.1779632468.git.xuyq21@lenovo.com Signed-off-by: Jakub Kicinski commit 74e144274af39935b0f410c0ee4d2b91c3730414 Author: Ji'an Zhou Date: Tue Jun 2 09:12:04 2026 +0000 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting waiter->task. The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences the NULL waiter->task, causing a kernel crash. Add a self-deadlock check for non-top waiters before calling rt_mutex_start_proxy_lock(), analogous to the top-waiter check in futex_lock_pi_atomic(). Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()") Signed-off-by: Ji'an Zhou Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org commit 3f7fbde4cdd4a25c199a60849897459a63907ca5 Author: Thomas Weißschuh Date: Wed May 13 08:32:46 2026 +0200 vdso/datastore: Mark vdso_k_*_data pointers as __ro_after_init These pointers are only modified once in vdso_setup_data_pages(), during the init phase. Make them read-only after that. Drop __refdata as that would conflict with __ro_after_init. Modpost does accept the reference from a __ro_after_init symbol to an __init one. Fixes: 05988dba1179 ("vdso/datastore: Allocate data pages dynamically") Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260513-vdso-ro-after-init-v1-1-4b51f74015a4@linutronix.de commit 16e408e607a94b646fb14a2a98422c6877ae4b3c Author: Yizhou Zhao Date: Wed May 27 16:31:58 2026 +0800 net: garp: fix unsigned integer underflow in garp_pdu_parse_attr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeof(*ga) - ga->len; ga->len is the on-wire attribute length and includes the GARP attribute header. For normal attributes with data, ga->len is larger than sizeof(*ga), so the subtraction underflows in unsigned arithmetic. The resulting value is later passed to garp_attr_lookup(), whose length argument is u8. After truncation, the parsed data length usually no longer matches the length stored for locally registered attributes, so received Join/Leave events are ignored. This breaks the GARP receive path for common attributes, such as GVRP VLAN registration attributes. Compute the data length as the attribute length minus the header length. Fixes: eca9ebac651f ("net: Add GARP applicant-only participant") Reported-by: Yizhou Zhao Reported-by: Yuxiang Yang Reported-by: Ao Wang Reported-by: Xuewei Feng Reported-by: Qi Li Reported-by: Ke Xu Signed-off-by: Yizhou Zhao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260527083200.42861-1-zhaoyz24@mails.tsinghua.edu.cn Signed-off-by: Jakub Kicinski commit ce4abda5e12622f33450159e76c8f56d28d7f03d Author: Naveen Kumar Chaudhary Date: Tue Jun 2 23:37:37 2026 +0530 time: Fix off-by-one in settimeofday() usec validation The validation check uses '>' instead of '>=' when comparing tv_usec against USEC_PER_SEC, allowing the value 1000000 through. After conversion to nanoseconds (*= 1000), this produces tv_nsec == NSEC_PER_SEC, violating the timespec invariant that tv_nsec must be less than NSEC_PER_SEC. Use '>=' to reject tv_usec values that are not in the valid range of 0 to 999999. Fixes: 5e0fb1b57bea ("y2038: time: avoid timespec usage in settimeofday()") Signed-off-by: Naveen Kumar Chaudhary Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://patch.msgid.link/4rikk44zew3s6577dugmx4jyblz7o5c57niuap6ct3td5yfm6w@gh7pcumg7qor commit c1ca14ca227e92101c7ae597213275b60f4212c6 Author: Naveen Kumar Chaudhary Date: Mon Jun 1 09:27:46 2026 +0530 clockevents: Fix duplicate type specifier in stub function parameter The stub for arch_inlined_clockevent_set_next_coupled() has 'u64 u64 cycles' in its parameter list. Since u64 is a typedef, the compiler parses the second 'u64' as the parameter name, making 'cycles' an unused token. Remove the duplicate so the parameter is correctly named. Fixes: 89f951a1e8ad ("clockevents: Provide support for clocksource coupled comparators") Signed-off-by: Naveen Kumar Chaudhary Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/7tostpvxzdn6tobmyow63a5rweatls5kux3scqp2vzhe7mv6uq@ecr746b4hyhf commit afd0f17ca46258cec3a5cc48b8df9327fe772490 Author: Kuniyuki Iwashima Date: Sat May 30 06:42:58 2026 +0000 hsr: Remove WARN_ONCE() in hsr_addr_is_self(). syzbot reported the warning [0] in hsr_addr_is_self(), whose assumption is simply wrong. hsr->self_node is cleared in hsr_del_self_node(), which is called from hsr_dellink(). Since dev->rtnl_link_ops->dellink() is called before unregister_netdevice_many(), there is a window when user can find the device but without hsr->self_node. Let's remove WARN_ONCE() in hsr_addr_is_self(). [0]: HSR: No self node WARNING: net/hsr/hsr_framereg.c:39 at hsr_addr_is_self+0x211/0x3f0 net/hsr/hsr_framereg.c:39, CPU#0: syz.4.16848/17220 Modules linked in: CPU: 0 UID: 0 PID: 17220 Comm: syz.4.16848 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:hsr_addr_is_self+0x211/0x3f0 net/hsr/hsr_framereg.c:39 Code: 33 2f 41 0f b7 dd 89 ee 09 de 31 ff e8 c8 b4 c6 f6 09 dd 74 54 e8 0f b0 c6 f6 31 ed eb 53 e8 06 b0 c6 f6 48 8d 3d 2f 50 9c 04 <67> 48 0f b9 3a 31 ed eb 42 e8 c1 13 1f 00 89 c5 31 ff 89 c6 e8 96 RSP: 0018:ffffc900041c70e0 EFLAGS: 00010283 RAX: ffffffff8afdc6ca RBX: ffffffff8afdc4e6 RCX: 0000000000080000 RDX: ffffc90010493000 RSI: 0000000000000948 RDI: ffffffff8f9a1700 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffffc900041c71e8 R11: fffff52000838e3f R12: dffffc0000000000 R13: ffff888041f9e3c0 R14: ffff888086ee3802 R15: 0000000000000000 FS: 00007f6fe985d6c0(0000) GS:ffff888126176000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f80bd437dac CR3: 0000000025096000 CR4: 00000000003526f0 DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002 DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: check_local_dest net/hsr/hsr_forward.c:592 [inline] fill_frame_info net/hsr/hsr_forward.c:728 [inline] hsr_forward_skb+0xa11/0x2a80 net/hsr/hsr_forward.c:739 hsr_dev_xmit+0x253/0x370 net/hsr/hsr_device.c:236 __netdev_start_xmit include/linux/netdevice.h:5368 [inline] netdev_start_xmit include/linux/netdevice.h:5377 [inline] xmit_one net/core/dev.c:3888 [inline] dev_hard_start_xmit+0x2df/0x860 net/core/dev.c:3904 __dev_queue_xmit+0x1428/0x3900 net/core/dev.c:4870 neigh_output include/net/neighbour.h:556 [inline] ip_finish_output2+0xcec/0x10b0 net/ipv4/ip_output.c:237 ip_send_skb net/ipv4/ip_output.c:1510 [inline] ip_push_pending_frames+0x8b/0x110 net/ipv4/ip_output.c:1530 raw_sendmsg+0x1547/0x1a50 net/ipv4/raw.c:659 sock_sendmsg_nosec net/socket.c:787 [inline] __sock_sendmsg net/socket.c:802 [inline] ____sys_sendmsg+0x7da/0x9c0 net/socket.c:2698 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752 __sys_sendmsg net/socket.c:2784 [inline] __do_sys_sendmsg net/socket.c:2789 [inline] __se_sys_sendmsg net/socket.c:2787 [inline] __x64_sys_sendmsg+0x1c3/0x2a0 net/socket.c:2787 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6feb62ce59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6fe985d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f6feb8a6090 RCX: 00007f6feb62ce59 RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 RBP: 00007f6feb6c2d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6feb8a6128 R14: 00007f6feb8a6090 R15: 00007ffcf01cc488 Fixes: f266a683a480 ("net/hsr: Better frame dispatch") Reported-by: syzbot+652670cf249077eb498b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a1a861e.b111c304.35cd64.0016.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260530064300.340793-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 9de5cbbe707d1dec14355b5214ae6a9e7f392311 Merge: e10902df24488c bb061d3de41707 Author: Jakub Kicinski Date: Tue Jun 2 11:57:21 2026 -0700 Merge tag 'nf-26-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter/IPVS fixes for net: 1) Fix splat with PREEMPT_RCU because smp_processor_id() in nfqueue, from Fernando Fernandez Mancera. 2) Fix possible use of pointer to old IPVS scheduler after RCU grace period when editing service, from Julian Anastasov. 3) Fix possible forever RCU walk over rt->fib6_siblings in nft_fib6, if rt is unlinked mid-iteration, apparently same issue happens in the fib6 core. From Jiayuan Chen. 4) Add mutex to guard refcount in synproxy infrastructure, since concurrent hook {un}registration can happen. From Fernando Fernandez Mancera. 5) Bail out if IRC conntrack helper fails to parse a command, do not try parsing using other command handlers, from Florian Westphal. This fixes a possible out-of-bound read. 6) Possible use-after-free in nft_tunnel by releasing template dst after all references has been dropped, from Tristan Madani. 7) Ignore conntrack template in nft_ct, from Jiayuan Chen. 8) Missing skb_ensure_writable() in ebt_snat, Yiming Qian. 9) Remove multi-register byteorder support, this allows for kernel stack info leak, from Florian Westphal. * tag 'nf-26-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_byteorder: remove multi-register support netfilter: bridge: make ebt_snat ARP rewrite writable netfilter: nft_ct: bail out on template ct in get eval netfilter: nft_tunnel: fix use-after-free on object destroy netfilter: conntrack_irc: fix possible out-of-bounds read netfilter: synproxy: add mutex to guard hook reference counting netfilter: nft_fib_ipv6: bail out of sibling walk if rt got unlinked ipvs: clear the svc scheduler ptr early on edit netfilter: xt_NFQUEUE: prefer raw_smp_processor_id ==================== Link: https://patch.msgid.link/20260601115923.433946-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit e10902df24488ca722303133acfc82490f7d59ad Author: Kuniyuki Iwashima Date: Mon Jun 1 18:20:55 2026 +0000 tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.") Reported-by: syzbot+e809069bc15f26300526@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6a1a7bcf.0a9e871e.332604.000b.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20260601182101.3183993-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit b748765019fe9e9234660327090fc1a9665cdbdd Author: Kuniyuki Iwashima Date: Fri May 29 19:39:23 2026 +0000 net: Annotate sk->sk_write_space() for UDP SOCKMAP. UDP TX skb->destructor() is sock_wfree(), and UDP holds lock_sock() only for UDP_CORK / MSG_MORE sendmsg(). Otherwise, sk->sk_write_space() may be read locklessly while SOCKMAP rewrites sk->sk_write_space(). Let's use WRITE_ONCE() and READ_ONCE() for sk->sk_write_space(). Note that the write side is annotated by commit 2ef2b20cf4e0 ("net: annotate data-races around sk->sk_{data_ready,write_space}"). Fixes: 7b98cd42b049 ("bpf: sockmap: Add UDP support") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Jakub Sitnicki Link: https://patch.msgid.link/20260529193941.3897256-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 73bf3cca7de6a73f53b6a52dc3b1c82ae5667a4d Author: Oscar Maes Date: Thu May 28 16:03:20 2026 +0200 pcnet32: stop holding device spin lock during napi_complete_done napi_complete_done may call gro_flush_normal (though not currently, as GRO is unsupported at the moment), which may result in packet TX. This will eventually result in calling pcnet32_start_xmit - resulting in a deadlock while trying to re-acquire the already locked spin lock. It is safe to split the spinlock block into two, because the hardware registers are still protected from concurrent access, and the two blocks perform unrelated operations that don't need to happen atomically. Fixes: 5b2ec6f2be51 ("pcnet32: use napi_complete_done()") Reviewed-by: Andrew Lunn Signed-off-by: Oscar Maes Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20260528140320.5556-1-oscmaes92@gmail.com Signed-off-by: Jakub Kicinski commit ba3e43a9e601636f5edb54e259a74f96ca3b8fd8 Merge: 4a694a77c3d60b fce4668a01227a Author: Linus Torvalds Date: Tue Jun 2 10:54:11 2026 -0700 Merge tag 'soc-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "Following the previous set of fixes, this addresses another significant number of small issues found in firmware drivers (tee, optee, qcomtee, qcom ice, exynos acpm) drivers through various tools. This is about error handling, resource leaks, concurrency and a use-after-free bug. The fixes for the Qualcomm ICE driver also introduce interface changes in the UFS and MMC drivers using it. Outside of firmware drivers, there are a few fixes across the tree: - Minor driver code mistakes in the Atmel EBI memory controller, the i.MX soc ID driver and socfpga boot logic - A defconfig change to avoid a boot time regression on multiple qualcomm boards - Device tree fixes for qualcomm, at91 and gemini, addressing mostly minor configuration mistakes" * tag 'soc-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (28 commits) firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling ARM: dts: gemini: Fix partition offsets ARM: socfpga: Fix OF node refcount leak in SMP setup soc: qcom: ice: Fix the error code when 'qcom,ice' property is not found arm64: dts: qcom: eliza: Add power-domain and iface clk for ice node arm64: dts: qcom: milos: Add power-domain and iface clk for ice node tee: qcomtee: add missing va_end in early return qcomtee_object_user_init() tee: fix params_from_user() error path in tee_ioctl_supp_recv tee: shm: fix shm leak in register_shm_helper() tee: fix tee_ioctl_object_invoke_arg padding arm64: defconfig: Enable PCI M.2 power sequencing driver scsi: ufs: ufs-qcom: Remove NULL check from devm_of_qcom_ice_get() mmc: sdhci-msm: Remove NULL check from devm_of_qcom_ice_get() soc: qcom: ice: Return proper error codes from devm_of_qcom_ice_get() instead of NULL soc: qcom: ice: Return -ENODEV if the ICE platform device is not found soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() ARM: dts: microchip: sam9x7: fix GMAC clock configuration firmware: samsung: acpm: Fix mailbox channel leak on probe error ... commit b230b57bd6f242aaac3b8e62c7d18c69e1e30392 Author: Yonatan Nachum Date: Tue May 26 08:15:36 2026 +0000 RDMA/efa: Validate SQ ring size against max LLQ size Validate the SQ ring size against the device's max LLQ size. This ensures that when using 128-byte WQEs, userspace cannot exceed the queue limits. On create QP, userspace provides the SQ ring size (depth x WQE size) which is validated against the max LLQ size. Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation") Link: https://patch.msgid.link/r/20260526081536.1203553-1-ynachum@amazon.com Reviewed-by: Michael Margolin Signed-off-by: Yonatan Nachum Signed-off-by: Jason Gunthorpe commit 5629eec1a2829871d496f3042884cdc267612f6a Author: Mario Limonciello (AMD) Date: Sat May 30 17:04:34 2026 +0200 cpufreq/amd-pstate: Fix setting EPP in performance mode EPP 0 is the only supported value in the performance policy. commit 798c47593cca ("cpufreq/amd-pstate: Add support for platform profile class") changed this while adding platform profile support to the dynamic EPP feature, but this actually wasn't necessary since platform profile writes disable manual EPP writes. Restore allowing writing EPP of 0 when in performance mode. Reviewed-by: Marco Scardovi Tested-by: Marco Scardovi Reported-by: Stuart Meckle Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221473 Closes: https://gitlab.freedesktop.org/upower/power-profiles-daemon/-/work_items/190 Fixes: 798c47593cca ("cpufreq/amd-pstate: Add support for platform profile class") Signed-off-by: Mario Limonciello (AMD) commit c1edda54a0f713412f5914f9c9080856694bddca Author: Claudio Imbrenda Date: Tue Jun 2 16:23:56 2026 +0200 KVM: s390: Remove ptep_zap_softleaf_entry() Migration entries do not need to be removed. The swap subsystem has been (and still is being) heavily reworked. The current implementation of ptep_zap_softleaf_entry() has been slowly modified and is now wrong, since it unconditionally calls swap_put_entries_direct() for both swap and migration entries. Remove ptep_zap_softleaf_entry() altogether, merge the path for proper swap entries directly in the only caller, and ignore migration entries. Fixes: 200197908dc4 ("KVM: s390: Refactor and split some gmap helpers") Signed-off-by: Claudio Imbrenda Message-ID: <20260602142356.169458-11-imbrenda@linux.ibm.com> commit 6ae67dcac742529210a23dac6c9a7de1acfb52a3 Author: Claudio Imbrenda Date: Tue Jun 2 16:23:55 2026 +0200 KVM: s390: Fix possible reference leak in fault-in code If kvm_s390_new_mmu_cache() fails, kvm_s390_faultin_gfn() returns without releasing the faulted page. Fix this by moving the allocation of the memory cache outside of the loop. There is no reason to check at every iteration. Opportunistically fix a comment. Fixes: e907ae530133 ("KVM: s390: Add helper functions for fault handling") Signed-off-by: Claudio Imbrenda Message-ID: <20260602142356.169458-10-imbrenda@linux.ibm.com> commit 7b53b4801884d48551f26a17f00cdc0ae4640d64 Author: Claudio Imbrenda Date: Tue Jun 2 16:23:54 2026 +0200 KVM: s390: Prevent memslots outside the ASCE range With KVM_S390_VM_MEM_LIMIT_SIZE, userspace can set the highest address allowed for the VM. Creating a memslot that lies over the maximum address does not make sense and is only a potential source of bugs. Prevent creation of memslots over the maximum address, and prevent the maximum address from being reduced below the end of existing memslots. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda Message-ID: <20260602142356.169458-9-imbrenda@linux.ibm.com> commit 4a694a77c3d60bc974c6ef7fb98cdb872b5330ea Merge: 6f3ed7fec72fc8 9d7bea186ba5a0 Author: Linus Torvalds Date: Tue Jun 2 08:59:35 2026 -0700 Merge tag 'mm-hotfixes-stable-2026-06-01-20-58' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: "13 hotfixes. All are for MM. 10 are cc:stable and the remaining 3 address post-7.1 issues or aren't considered suitable for backporting. There's a three-patch series "userfaultfd: verify VMA state across UFFDIO_COPY retry" from Mike Rapoport which fixes a few uffd things. The rest are singletons - please see the individual changelogs for details" * tag 'mm-hotfixes-stable-2026-06-01-20-58' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: userfaultfd: remove redundant check in vm_uffd_ops() userfaultfd: refuse to __mfill_atomic_pte() for unsupported VMAs userfaultfd: verify VMA state across UFFDIO_COPY retry mm/huge_memory: update file PMD counter before folio_put() mm/huge_memory: update file PUD counter before folio_put() mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback mm/damon/ops-common: call folio_test_lru() after folio_get() mm/cma: fix reserved page leak on activation failure mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison mm/hugetlb: restore reservation on error in hugetlb folio copy paths mm/cma_debug: fix invalid accesses for inactive CMA areas memcg: use round-robin victim selection in refill_stock mm/hugetlb: avoid false positive lockdep assertion commit 42546fc642e929de07459ff839a9f43a653ffb4e Author: Claudio Imbrenda Date: Tue Jun 2 16:23:53 2026 +0200 KVM: s390: Lock pte when making page secure Make sure _kvm_s390_pv_make_secure() takes the pte lock for the given address when attempting to make the page secure. One of the steps in making the page secure is freezing the folio using folio_ref_freeze(), which temporarily sets the reference count to 0. Any attempt to get such a folio while frozen will fail and cause a warning to be printed. Other users of folio_ref_freeze() make sure that the page is not mapped while it's being frozen, thus preventing gup functions from being able to access it. For _kvm_s390_pv_make_secure(), this is not possible, because the page needs to be mapped in order for the import to succeed. By taking the pte lock, gup functions will be blocked until the import operation is done, thus avoiding the race. In theory this does not completely solve the issue: if a page is mapped through multiple mappings, locking one pte does not protect from calling gup on it through the other mapping. In practice this does not happen and it is a decent stopgap solution until a more correct solution is available. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda Message-ID: <20260602142356.169458-8-imbrenda@linux.ibm.com> commit 9a1dfbbd3506c4f7159feab5ef27434e80256fa5 Author: Claudio Imbrenda Date: Tue Jun 2 16:23:52 2026 +0200 KVM: s390: Fix fault-in code Fix the fault-in code so that it does not return success if a concurrent unmap event invalidated the fault-in process between the best-effort lockless check and the proper check with lock. The new behaviour is to retry, like the best-effort lockless check already did. This prevents the fault-in handler from returning success without having actually faulted in the requested page. Fixes: e907ae530133 ("KVM: s390: Add helper functions for fault handling") Reviewed-by: Steffen Eiden Signed-off-by: Claudio Imbrenda Message-ID: <20260602142356.169458-7-imbrenda@linux.ibm.com> commit 6af5563e827913d3e14dbf12eefd5af4aa592739 Author: Claudio Imbrenda Date: Tue Jun 2 16:23:51 2026 +0200 KVM: s390: vsie: Fix rmap handling in _do_shadow_crste() Fix _do_shadow_crste() to also apply a mask on the reverse address, to prevent spurious entries from being created, like already done in gmap_protect_rmap(). Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda Message-ID: <20260602142356.169458-6-imbrenda@linux.ibm.com> commit ca42c16638d5570c44842ff68a772c62e6dd0124 Author: Claudio Imbrenda Date: Tue Jun 2 16:23:50 2026 +0200 KVM: s390: Fix guest / virtual address confusion in _essa_clear_cbrl() Until now, gmap_helper_zap_one_page() was being called with the guest absolute address, but it expects a userspace virtual address. This meant that in the best case the requested pages were not being discarded, and in the worst case that the wrong pages were being discarded. Fix this by converting the guest absolute address to host virtual before passing it to gmap_helper_zap_one_page(). Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda Message-ID: <20260602142356.169458-5-imbrenda@linux.ibm.com> commit 89fa757931dc0bcd64ef22b28d1d5ad00c5d02f4 Author: Claudio Imbrenda Date: Tue Jun 2 16:23:49 2026 +0200 KVM: s390: Avoid potentially sleeping while atomic when zapping pages Factor out try_get_locked_pte(), which behaves similarly to get_locked_pte(), but does not attempt to allocate missing tables and performs a spin_trylock() instead of blocking. The new function is also exported, since it will be used in other patches. If intermediate entries are missing, there can be no pte swap entry to free, so it's safe to ignore them. This avoids potentially sleeping while atomic. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda Message-ID: <20260602142356.169458-4-imbrenda@linux.ibm.com> commit d1adc098ce08893c92fce3db63f7bb750fbb4c30 Author: Claudio Imbrenda Date: Tue Jun 2 16:23:48 2026 +0200 KVM: s390: Fix _gmap_crstep_xchg_atomic() The previous incorrect behaviour cleared the vsie_notif bit without returning false, which allowed shadow crstes to be installed without the vsie_notif bit. Return false and do not perform the operation if an unshadow event has been triggered, but still attempt to clear the vsie_notif bit from the existing crste. This will prevent the installation of shadow crstes without vsie_notif bit and will also prevent the caller from looping forever if it was not checking for the sg->invalidated flag. Fixes: b827ef02f409 ("KVM: s390: Remove non-atomic dat_crstep_xchg()") Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Signed-off-by: Claudio Imbrenda Message-ID: <20260602142356.169458-3-imbrenda@linux.ibm.com> commit 29e8751c1dd278262fb4cd234e8909287d4189d4 Author: Claudio Imbrenda Date: Tue Jun 2 16:23:47 2026 +0200 KVM: s390: Fix _gmap_unmap_crste() In _gmap_unmap_crste(), the crste to be unmapped is zapped calling gmap_crstep_xchg_atomic() exactly once, and expecting it to succeed. This is a reasonable sanity check, since kvm->mmu_lock is being held in write mode, and thus no races should be possible. An upcoming patch will change the behaviour of gmap_crstep_xchg_atomic() to return false and clear the vsie_notif bit if the operation triggers an unshadow operation. With the new behaviour, an unmap operation that triggers an unshadow would cause the VM to be killed. Prepare for the change by checking if the vsie_notif bit was set in the old crste if gmap_crstep_xchg_atomic() fails the first time, and try a second time. The second time no failures are allowed. Fixes: b827ef02f409 ("KVM: s390: Remove non-atomic dat_crstep_xchg()") Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Signed-off-by: Claudio Imbrenda Message-ID: <20260602142356.169458-2-imbrenda@linux.ibm.com> commit 6c0cf89f36ac0c0fd8687a4ccdce2efb23a9c663 Author: Deepanshu Kartikey Date: Sun May 31 06:47:21 2026 +0530 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value directly as a shift count: info->control.antennas |= BIT(*iterator.this_arg); *iterator.this_arg is an 8-bit value taken straight from the frame supplied by userspace, so BIT() can be asked to shift by up to 255. That is undefined behaviour on the unsigned long and is reported by UBSAN: UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30 shift exponent 235 is too large for 64-bit type 'unsigned long' Call Trace: ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174 ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451 ... packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109 info->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna indices 0 and 1 can ever be represented. Ignore any larger value instead of shifting out of bounds. Reported-by: syzbot+8e0622f6d9446420271f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8e0622f6d9446420271f Fixes: ef246a1480cc ("wifi: mac80211: support antenna control in injection") Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260531011721.102941-1-kartikey406@gmail.com Signed-off-by: Johannes Berg commit 4cd92957e8f8cc4ebfe8a5d4203c14c592fde6b1 Author: Yuqi Xu Date: Fri May 29 23:25:37 2026 +0800 wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed element count in a u8-backed cfg80211_rnr_elems::cnt field and uses that count to size the flexible array allocation. Reject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches 255, before incrementing it again. This keeps the parser aligned with the data structure it fills and matches the existing bound check used by nl80211_parse_mbssid_elems(). Fixes: dbbb27e183b1 ("cfg80211: support RNR for EMA AP") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Zhengchuan Liang Reported-by: Xin Liu Assisted-by: Codex:gpt-5.4 Signed-off-by: Yuqi Xu Signed-off-by: Ren Wei Link: https://patch.msgid.link/20260529152542.1412734-1-n05ec@lzu.edu.cn Signed-off-by: Johannes Berg commit 6d99479799c69c3cb588fcda19c81d8f61d64ecd Author: Qing Wang Date: Tue Jun 2 11:08:54 2026 +0800 rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() There is an bug in which an uninitialized stack variable is used in rseq_exit_user_update() as reported by syzbot: BUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline] The local variable: struct rseq_ids ids = { .cpu_id = task_cpu(t), .mm_cid = task_mm_cid(t), .node_id = cpu_to_node(ids.cpu_id), }; According to the C standard, the evaluation order of expressions in an initializer list is indeterminately sequenced. The compiler (Clang, in this KMSAN build) evaluates `cpu_to_node(ids.cpu_id)` *before* `ids.cpu_id` is initialized with `task_cpu(t)`. This is fixed by moving the assignment of ids.node_id outside the structure initialization. Fixes: 82f572449cfe ("rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode") Closes: https://syzkaller.appspot.com/bug?extid=185a631927096f9da2fc Reported-by: syzbot+185a631927096f9da2fc@syzkaller.appspotmail.com Signed-off-by: Qing Wang Signed-off-by: Peter Zijlstra (Intel) Acked-by: Mark Rutland Link: https://patch.msgid.link/20260602030854.574038-1-wangqing7171@gmail.com commit eb48730bb827d1550401a5d391903f9d90b493c8 Author: Zhenghang Xiao Date: Tue May 26 18:53:28 2026 +0800 xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_payload() stores first_skb into xtfs->ra_newskb under drop_lock when starting partial reassembly, then unlocks and breaks out of the processing loop. The post-loop check reads xtfs->ra_newskb without the lock to decide whether first_skb is still owned: if (first_skb && first_iplen && !defer && first_skb != xtfs->ra_newskb) Between spin_unlock and this read, a concurrent CPU running iptfs_reassem_cont() (or the drop_timer hrtimer) can complete reassembly, NULL xtfs->ra_newskb, and free the skb. The check then evaluates first_skb != NULL as true, and pskb_trim/ip_summed/consume_skb operate on the freed skb — a use-after-free in skbuff_head_cache. Replace the unlocked read with a local bool that records whether first_skb was handed to the reassembly state in the current call. The flag is set after the existing spin_unlock, before the break, using the pointer equality that is stable at that point (first_skb == skb iff first_skb was stored in ra_newskb). Fixes: 3f3339885fb3 ("xfrm: iptfs: add reusing received skb for the tunnel egress packet") Signed-off-by: Zhenghang Xiao Signed-off-by: Steffen Klassert commit 0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae Author: Adrian Korwel Date: Mon May 25 09:58:32 2026 -0500 USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() build_i2c_fw_hdr() allocates a fixed-size buffer of (16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then copies le16_to_cpu(img_header->Length) bytes into it without validating that Length fits within the available space after the firmware record header. img_header->Length is a __le16 from the firmware file and can be up to 65535. check_fw_sanity() validates the total firmware size but not img_header->Length specifically. Fix by rejecting images where img_header->Length exceeds the available destination space. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Adrian Korwel Signed-off-by: Johan Hovold commit 183c1076eca43bbb3e7bdf597456f91d81c73e74 Author: Adrian Korwel Date: Mon May 25 09:58:31 2026 -0500 USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which is sizeof(struct edge_ti_manuf_descriptor) = 10 bytes. The Size field comes from the device and is only validated (in check_i2c_image()) to make sure the descriptor fits within TI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size. A malicious USB device can therefore set Size to any value up to 16377, causing a heap overflow of up to 16367 bytes when plugged into a host running this driver. valid_csum() is called after read_rom() and also iterates buffer[0..Size-1], compounding the out-of-bounds access. Fix by rejecting descriptors with unexpected length before calling read_rom(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Adrian Korwel [ johan: amend commit message; also check for short descriptors ] Signed-off-by: Johan Hovold commit 317d5146fb399ad1e87b310ee7d018fe648d40ba Author: Dave Jones Date: Mon May 18 14:46:28 2026 -0400 NFS: write_completion: dereference loop-local req, not hdr->req 5d3869a41f36 ("NFS: fix writeback in presence of errors") introduced a dereference of hdr->req->wb_lock_context in nfs_write_completion's per-request loop. hdr->req is set once at nfs_pgheader_init() time and is not refcount-protected for the lifetime of the loop; when hdr aggregates requests from multiple page groups (common under heavy NFSv3 writeback), a parallel COMMIT on hdr->req's group can drop the last reference and free it while the outer loop is still iterating requests from other groups. KASAN catches this as an 8-byte read at offset +24 of a freed nfs_page slab object (wb_lock_context). All requests in a given pgio share the same open_context, so reading the loop-local req's wb_lock_context yields the same value and is safe -- req is still on hdr->pages and holds its writeback kref through the commit branch. Caught with kasan: BUG: KASAN: slab-use-after-free in nfs_write_completion+0x8f8/0xa50 [nfs] Read of size 8 at addr ffff888118af2058 by task kworker/u16:16/122062 CPU: 2 UID: 0 PID: 122062 Comm: kworker/u16:16 Kdump: loaded Not tainted 7.1.0-rc4+ #ge05a759574b2 PREEMPT Workqueue: nfsiod rpc_async_release Call Trace: dump_stack_lvl+0xaf/0x100 ? nfs_write_completion+0x8f8/0xa50 [nfs] print_report+0x157/0x4a1 ? __virt_addr_valid+0x1fb/0x400 ? nfs_write_completion+0x8f8/0xa50 [nfs] kasan_report+0xc2/0x190 ? nfs_write_completion+0x8f8/0xa50 [nfs] nfs_write_completion+0x8f8/0xa50 [nfs] ? nfs_commit_release_pages+0xbd0/0xbd0 [nfs] ? lock_acquire+0x182/0x2e0 ? process_one_work+0x937/0x1890 ? nfs_pgio_header_alloc+0xd0/0xd0 [nfs] rpc_free_task+0xee/0x160 rpc_async_release+0x5d/0xb0 process_one_work+0x9b0/0x1890 ? pwq_dec_nr_in_flight+0xed0/0xed0 ? rpc_final_put_task+0x140/0x140 worker_thread+0x75a/0x10a0 ? process_one_work+0x1890/0x1890 ? kthread+0x1af/0x4d0 ? process_one_work+0x1890/0x1890 kthread+0x3d3/0x4d0 ? kthread_affine_node+0x2c0/0x2c0 ret_from_fork+0x669/0xa50 ? native_tss_update_io_bitmap+0x660/0x660 ? __switch_to+0x9dd/0x1310 ? kthread_affine_node+0x2c0/0x2c0 ret_from_fork_asm+0x11/0x20 Allocated by task 121997 on cpu 3 at 31643.290294s: kasan_save_stack+0x1e/0x40 kasan_save_track+0x13/0x60 __kasan_slab_alloc+0x62/0x70 kmem_cache_alloc_noprof+0x1ab/0x4e0 nfs_page_create+0x152/0x460 [nfs] nfs_page_create_from_folio+0x7e/0x210 [nfs] nfs_update_folio+0x7a9/0x32a0 [nfs] nfs_write_end+0x290/0xc60 [nfs] generic_perform_write+0x4ce/0x990 nfs_file_write+0x6b3/0xce0 [nfs] vfs_write+0x63c/0xfa0 ksys_write+0x122/0x240 do_syscall_64+0xc3/0x13f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 122046 on cpu 0 at 31647.037964s: kasan_save_stack+0x1e/0x40 kasan_save_track+0x13/0x60 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x3b/0x60 kmem_cache_free+0x11b/0x5a0 nfs_page_group_destroy+0x13a/0x210 [nfs] nfs_unlock_and_release_request+0x64/0x90 [nfs] nfs_commit_release_pages+0x339/0xbd0 [nfs] nfs_commit_release+0x51/0xb0 [nfs] rpc_free_task+0xee/0x160 rpc_async_release+0x5d/0xb0 process_one_work+0x9b0/0x1890 worker_thread+0x75a/0x10a0 kthread+0x3d3/0x4d0 ret_from_fork+0x669/0xa50 ret_from_fork_asm+0x11/0x20 The buggy address belongs to the object at ffff888118af2040\x0a which belongs to the cache nfs_page of size 96 The buggy address is located 24 bytes inside of\x0a freed 96-byte region [ffff888118af2040, ffff888118af20a0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118af2 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x4000000000000040(head|zone=2) page_type: f5(slab) raw: 4000000000000040 ffff88818cf2c4c0 ffffea000e61b990 ffffea0004e7d110 raw: 0000000000000000 0000000800190019 00000000f5000000 0000000000000000 head: 4000000000000040 ffff88818cf2c4c0 ffffea000e61b990 ffffea0004e7d110 head: 0000000000000000 0000000800190019 00000000f5000000 0000000000000000 head: 4000000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 121997, tgid 121997 (rsync), ts 31643290274577, free_ts 31642154777182 post_alloc_hook+0xd1/0x100 get_page_from_freelist+0xbad/0x2910 __alloc_frozen_pages_noprof+0x1c6/0x4a0 allocate_slab+0x330/0x620 ___slab_alloc+0xe9/0x930 kmem_cache_alloc_noprof+0x35b/0x4e0 nfs_page_create+0x152/0x460 [nfs] nfs_page_create_from_folio+0x7e/0x210 [nfs] nfs_update_folio+0x7a9/0x32a0 [nfs] nfs_write_end+0x290/0xc60 [nfs] generic_perform_write+0x4ce/0x990 nfs_file_write+0x6b3/0xce0 [nfs] vfs_write+0x63c/0xfa0 ksys_write+0x122/0x240 do_syscall_64+0xc3/0x13f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 page last free pid 122202 tgid 122202 stack trace: __free_frozen_pages+0x6da/0xf30 qlist_free_all+0x53/0x130 kasan_quarantine_reduce+0x198/0x1f0 __kasan_slab_alloc+0x46/0x70 kmem_cache_alloc_noprof+0x1ab/0x4e0 __alloc_object+0x2f/0x230 __create_object+0x22/0x80 kmem_cache_alloc_node_noprof+0x416/0x4d0 __alloc_skb+0x146/0x6e0 tcp_stream_alloc_skb+0x35/0x660 tcp_sendmsg_locked+0x1746/0x4260 tcp_sendmsg+0x2f/0x40 inet_sendmsg+0x9e/0xe0 __sock_sendmsg+0xd9/0x180 sock_sendmsg+0x122/0x200 xprt_sock_sendmsg+0x4ff/0x9a0 Memory state around the buggy address: ffff888118af1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc ffff888118af1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888118af2000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ^ ffff888118af2080: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888118af2100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Reviewed-by Jeff Layton Fixes: 5d3869a41f36 ("NFS: fix writeback in presence of errors") Cc: Olga Kornievskaia Cc: Trond Myklebust Cc: Anna Schumaker Cc: linux-nfs@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Dave Jones Signed-off-by: Trond Myklebust commit ae0383e5a9a4b12d68c76c4769857def4665deff Author: Yicong Hui Date: Mon Apr 6 19:00:13 2026 +0100 drm/imx: Fix three kernel-doc warnings in dcss-scaler.c Fix the following W=1 kerneldoc warnings by adding the missing parameter descriptions for @phase0_identity and @nn_interpolation in dcss_scaler_filter_design() and @phase0_identity in dcss_scaler_gaussian_filter() Warning: drivers/gpu/drm/imx/dcss/dcss-scaler.c:173 function parameter 'phase0_identity' not described in 'dcss_scaler_gaussian_filter' Warning: drivers/gpu/drm/imx/dcss/dcss-scaler.c:270 function parameter 'phase0_identity' not described in 'dcss_scaler_filter_design' Warning: drivers/gpu/drm/imx/dcss/dcss-scaler.c:270 function parameter 'nn_interpolation' not described in 'dcss_scaler_filter_design' Fixes: 9021c317b770 ("drm/imx: Add initial support for DCSS on iMX8MQ") Signed-off-by: Yicong Hui Reviewed-by: Laurentiu Palcu Link: https://patch.msgid.link/20260406180013.2442096-1-yiconghui@gmail.com Signed-off-by: Liu Ying commit fb176425837693f50c5c9fc8db6fbb04af22bd0a Author: Andrzej Kacprowski Date: Fri May 29 14:08:41 2026 +0200 accel/ivpu: Add buffer overflow check in MS get_info_ioctl Add validation that the info size returned from the metric stream info query is not exceeded when checked against the allocated buffer size. If the firmware returns a size larger than the buffer, reject the operation with -EOVERFLOW instead of proceeding with an incorrect buffer copy. Fixes: cdfad4db7756 ("accel/ivpu: Add NPU profiling support") Cc: stable@vger.kernel.org # v6.18+ Signed-off-by: Andrzej Kacprowski Reviewed-by: Karol Wachowski Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260529120841.135852-1-andrzej.kacprowski@linux.intel.com commit dd1311bcf0e62f0c515115f46a3813370f4a4bb1 Author: Andrzej Kacprowski Date: Fri May 29 13:58:42 2026 +0200 accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds (< data_size) before using them. If out-of-bounds indices are encountered (from firmware), clamp them to safe values instead of proceeding with invalid offsets. This prevents potential out-of-bounds buffer access when firmware supplies invalid log indices. Fixes: 1fc1251149a7 ("accel/ivpu: Refactor functions in ivpu_fw_log.c") Cc: stable@vger.kernel.org # v6.18+ Signed-off-by: Andrzej Kacprowski Reviewed-by: Karol Wachowski Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260529115842.135378-1-andrzej.kacprowski@linux.intel.com commit 1d0b597facdd3c0239c88e8797c1014e1ea0ef15 Author: Andrzej Kacprowski Date: Fri May 29 14:08:53 2026 +0200 accel/ivpu: Add bounds check for firmware runtime memory Validate that the firmware runtime memory specified in the image header is properly aligned and sized to hold the firmware image. This prevents errors during memory allocation and image transfer. Fixes: 2007e210b6a1 ("accel/ivpu: Split FW runtime and global memory buffers") Cc: stable@vger.kernel.org # v7.0+ Signed-off-by: Andrzej Kacprowski Reviewed-by: Karol Wachowski Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260529120853.135876-1-andrzej.kacprowski@linux.intel.com commit 6f3ed7fec72fc8979b2a8c7219c0a9fcfc8d07b5 Merge: 4b5821f73b9518 d3f0a606b9f278 Author: Linus Torvalds Date: Mon Jun 1 19:55:30 2026 -0700 Merge tag 'for-7.1/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fix from Mikulas Patocka: - fix race condition in dm-cache-policy-smq * tag 'for-7.1/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm cache policy smq: check allocation under invalidate lock commit 3522b21fd7e1863d0734537737bd59f1b90d0190 Author: Mark Bloch Date: Thu May 28 22:14:10 2026 +0300 devlink: Release nested relation on devlink free devlink relation state is normally released from devl_unregister(), which calls devlink_rel_put(). This misses devlink instances that get a nested relation before registration and then fail probe before devl_register() is reached. That flow can happen for SFs. The child devlink gets linked to its parent before registration, then a later probe error calls devlink_free() directly. Since the instance was never registered, devl_unregister() is not called and devlink->rel is leaked. Release any pending relation from devlink_free() as well. The registered path is unchanged because devl_unregister() already clears devlink->rel before devlink_free() runs. Fixes: c137743bce02 ("devlink: introduce object and nested devlink relationship infra") Signed-off-by: Mark Bloch Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20260528191411.3270532-1-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 4b5821f73b95181720338ba09a08de9c08cd6bf4 Merge: e43ffb69e0438c 4dc76c305a73ba Author: Linus Torvalds Date: Mon Jun 1 19:50:33 2026 -0700 Merge tag 'auxdisplay-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay Pull auxdisplay updates from Andy Shevchenko: - Fix potential out-of-bound access in line-display library - Miscellaneous refactoring and cleaning up [ Andy says this could easily be delayed until 7.2, but it's _so_ tiny that it's more work for me to schedule it for later than to just take it now, and just doesn't seem worth delaying - Linus ] * tag 'auxdisplay-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay: auxdisplay: Kconfig: drop unneeded quotes in PANEL_BOOT_MESSAGE dep auxdisplay: line-display: fix OOB read on zero-length message_store() auxdisplay: max6959: use regmap_assign_bits() in max6959_enable() commit a213a8950414c684999dcf03edeea6c46ede172e Author: Lee Jones Date: Wed May 27 13:36:29 2026 +0000 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF). Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp_session_put() is cleanly called on all return paths to drop the reference. To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock_do_ioctl()). Signed-off-by: Lee Jones Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Link: https://patch.msgid.link/20260527133630.2120612-1-lee@kernel.org Signed-off-by: Jakub Kicinski commit 2a58899d11009bffc7b4b32a571858f381121837 Author: Yizhou Zhao Date: Wed May 27 16:18:01 2026 +0800 6lowpan: fix off-by-one in multicast context address compression The second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses &data[1] as destination and &ipaddr->s6_addr[11] as source, but both should be offset by one: &data[2] and &ipaddr->s6_addr[12] respectively. This off-by-one has two consequences: 1. data[1] is overwritten with s6_addr[11], corrupting the RIID field in the compressed multicast address 2. data[5] is never written, so uninitialized kernel stack memory is transmitted over the network via lowpan_push_hc_data(), leaking kernel stack contents The correct inline data layout must match what the decompression function lowpan_uncompress_multicast_ctx_daddr() expects: data[0..1] = s6_addr[1..2] (flags/scope + RIID) data[2..5] = s6_addr[12..15] (group ID) Also zero-initialize the data array as a defensive measure against similar bugs in the future. Fixes: 5609c185f24d ("6lowpan: iphc: add support for stateful compression") Reported-by: Yizhou Zhao Reported-by: Yuxiang Yang Reported-by: Ao Wang Reported-by: Xuewei Feng Reported-by: Qi Li Reported-by: Ke Xu Signed-off-by: Yizhou Zhao Acked-by: Alexander Aring Link: https://patch.msgid.link/20260527081806.42747-1-zhaoyz24@mails.tsinghua.edu.cn Signed-off-by: Jakub Kicinski commit 4a1b1ac2744694a2ecd66a84bdb1445f4ef24bee Author: Jason Gunthorpe Date: Tue May 26 12:40:25 2026 -0300 RDMA/core: Validate the passed in fops for ib_get_ucaps() Sashiko pointed out it is not safe to rely only on the devt because char/block alias so if the user finds a block device with the same dev_t it can masquerade as a ucap cdev fd. Test the f_ops to only accept authentic cdevs. Link: https://patch.msgid.link/r/0-v1-fd9482545e37+1e25-ib_ucaps_fd_ops_jgg@nvidia.com Cc: stable@vger.kernel.org Fixes: 61e51682816d ("RDMA/uverbs: Introduce UCAP (User CAPabilities) API") Signed-off-by: Jason Gunthorpe commit 5057e1aca011e51ef51498c940ef96f3d3e8a305 Author: Jamal Hadi Salim Date: Sun May 31 12:08:12 2026 -0400 net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() <-- holds the idr lock 0: rcu_read_lock() 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR) 0: mutex_unlock() <-- releases the idr lock 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) <-- Action removed from IDR 1: mutex_unlock() <-- mutex released allowing us to delete the action 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Let's illustrate the new restored code path: 0: rcu_read_lock() 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period 0: p = idr_find(idr, index) 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur. Fixes: d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") Suggested-by: Jakub Kicinski Reported-by: Kyle Zeng Tested-by: Victor Nogueira Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Jamal Hadi Salim Tested-by: Kyle Zeng Reviewed-by: Pedro Tammela Reviewed-by: Eric Dumazet Reviewed-by: Victor Nogueira Link: https://patch.msgid.link/20260531160812.68020-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit abf888b03a9805a3bc37948a0df443553b1c0910 Author: Maíra Canal Date: Sat May 30 15:37:42 2026 -0300 drm/v3d: Wait for pending L2T flush before cleaning caches v3d_clean_caches() starts the cache-clean sequence by writing V3D_L2TCACTL_TMUWCF to V3D_CTL_L2TCACTL and then polling for that bit to clear. It does not, however, check for an L2T flush (L2TFLS) that may still be in flight from a previous operation. On pre-V3D 7.1 hardware, kicking off the TMU write-combiner flush while an L2T flush is still pending can clobber bits in L2TCACTL and cause cache inconsistencies. Poll for L2TFLS to clear before writing L2TCACTL on V3D < 7.1, ensuring any pending flush has completed before a new clean is issued. Cc: stable@vger.kernel.org Fixes: d223f98f0209 ("drm/v3d: Add support for compute shader dispatch.") Link: https://patch.msgid.link/20260530-v3d-fix-rpi4-freezes-v1-1-c2c8307da6ce@igalia.com Signed-off-by: Maíra Canal Reviewed-by: Iago Toral Quiroga commit 27f2d085bd72abe4235689d34d8654cfc876d568 Author: Zhan Xusheng Date: Mon Jun 1 16:51:36 2026 +0800 erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check() Commit a5242d37c83a ("erofs: error out obviously illegal extents in advance") changed the per-extent algorithm presence check from "is the bit set" to "is the only bit set": - !(sbi->available_compr_algs & (1 << map->m_algorithmformat)) + (sbi->available_compr_algs ^ BIT(map->m_algorithmformat)) `available_compr_algs` is a bitmap of every compression algorithm available in the image (z_erofs_parse_cfgs() iterates it with for_each_set_bit()), so an image that enables more than one algorithm has multiple bits set. XOR is zero only when the bitmap is exactly BIT(map->m_algorithmformat); for any image with two or more algorithms the test is non-zero for every extent and the read fails with -EFSCORRUPTED ("inconsistent algorithmtype %u"). Reproducer (mkfs.erofs from erofs-utils 1.7.1): $ mkdir src $ yes A | head -c 100K > src/a $ head -c 64K /dev/zero > src/b $ mkfs.erofs -zlz4:deflate multi.erofs src $ mount -t erofs -o loop multi.erofs /mnt $ cat /mnt/a >/dev/null cat: /mnt/a: Structure needs cleaning $ dmesg | tail erofs (device loop0): inconsistent algorithmtype 0 for nid 46 erofs (device loop0): read error -117 @ 0 of nid 46 The erofs on-disk format (Z_EROFS_COMPRESSION_MAX = 4 with LZ4, LZMA, DEFLATE, ZSTD) and the kernel parser explicitly support multi-algorithm images, and erofs-utils 1.7.1 generates them via the "-z X:Y" syntax. Restore the original per-bit presence check. Fixes: a5242d37c83a ("erofs: error out obviously illegal extents in advance") Signed-off-by: Zhan Xusheng Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit b5f53e6d3d32f2884d71500bb6d773c7bfe21f2e Author: Pratik Vishwakarma Date: Sat May 30 06:18:18 2026 +0000 x86/CPU/AMD: Add more Zen6 models Family 0x1a, models 0xd0 - 0xef are Zen6, so add them to the range which sets X86_FEATURE_ZEN6. [ bp: Massage commit message. ] Signed-off-by: Pratik Vishwakarma Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260530061819.9721-1-Pratik.Vishwakarma@amd.com commit 42445de1765547f56f48d107c0b8f3482c98458e Author: Daniele Ceraolo Spurio Date: Fri May 29 12:36:02 2026 -0700 Revert "drm/xe/nvls: Define GuC firmware for NVL-S" This reverts commit 4e88de313ff4d1c67b644b1f39f9fb4089711b71. The early GuC FW definition meant for our CI branch was accidentally merged to the drm-xe-next branch instead. This GuC FW will never be released to linux-firmware, so we do not want the definition to be available in the mainline Linux codebase. Fixes: 4e88de313ff4 ("drm/xe/nvls: Define GuC firmware for NVL-S") Signed-off-by: Daniele Ceraolo Spurio Cc: Julia Filipchuk Cc: Rodrigo Vivi Cc: Matt Roper Cc: stable@vger.kernel.org # v7.0+ Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260529193558.185436-11-daniele.ceraolospurio@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 65b8e0ac86e48cfc9128c04dfc53ea3395d030dd) Signed-off-by: Rodrigo Vivi commit c9c64820a48dcc739311fd7a9138511888539d02 Author: João Miguel Date: Sat May 23 22:35:48 2026 +0100 ASoC: amd: yc: Enable internal mic on MSI Bravo 17 C7VF The MSI Bravo 17 C7VF routes its internal digital microphone through the ACP6x. The machine driver only enables the DMIC for boards present in the DMI quirk table, so on this model the internal mic is never detected and no capture device is created. Add a quirk entry matching the board's DMI identifiers so the DMIC is enabled and the internal microphone works. Signed-off-by: João Miguel Link: https://patch.msgid.link/20260523213548.5219-1-jmiguel.ghp@gmail.com Signed-off-by: Mark Brown commit fc12cf16df9af867e1455b011cdd9310474a612e Author: Jackie Dong Date: Wed May 27 18:20:05 2026 +0800 ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11 Lenovo Yoga Pro 7 15ASH11 with AMD RYZEN AI MAX+ 388 (Strix Halo, ACP 7.0) uses Realtek ALC287 series codec and no any DMIC connected by ACP. All DMICs directly connet with ALC codec. Without this quirk, Input Device of Gnome Sound settings shows Internal Stereo Microphone and Digital Microphone by default. In fact, Digital Microphone of ACP doesn't work due to no connecting with ALC287 codec, the Internal Stereo Microphone as analog device based on snd_hda_intel driver can work well. Add a DMI quirk to override the flag to 0, consistent with the existing entry for the HN7306EA. Signed-off-by: Jackie Dong Link: https://patch.msgid.link/20260527102005.58528-1-xy-jackie@139.com Signed-off-by: Mark Brown commit 108c8b6c06b7c77787fd85f92d15a1e992fa1de4 Merge: e43ffb69e0438c 4db2bd2ed4785d Author: Greg Kroah-Hartman Date: Mon Jun 1 17:50:38 2026 +0200 Merge tag 'thunderbolt-for-v7.1-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v7.1-rc7 This includes more fixes to harden XDomain message handling against possible malicious hosts. All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v7.1-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Limit XDomain response copy to actual frame size thunderbolt: Validate XDomain request packet size before type cast thunderbolt: Clamp XDomain response data copy to allocation size thunderbolt: Bound root directory content to block size thunderbolt: Reject zero-length property entries in validator commit d3f0a606b9f278ece8a0df626ded9c4044071235 Author: Guangshuo Li Date: Fri May 29 23:57:45 2026 +0800 dm cache policy smq: check allocation under invalidate lock commit 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks") added mq->lock around the destructive part of smq_invalidate_mapping(), but left the e->allocated check outside the critical section. That leaves a check-then-act race. Two concurrent invalidators can both observe e->allocated as true before either of them takes mq->lock. The first invalidator that acquires the lock removes the entry from the queues and hash table and then calls free_entry(), which clears e->allocated and puts the entry back on the free list. The second invalidator can then acquire mq->lock and continue with the stale result of the unlocked check. This can corrupt the SMQ queues or hash table by deleting an entry that is no longer on those structures. It can also hit the allocation check in free_entry() when the same entry is freed again. Move the allocation check under mq->lock so the predicate and the destructive operations are serialized by the same lock. Fixes: 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks") Signed-off-by: Guangshuo Li Signed-off-by: Mikulas Patocka commit fce4668a01227abb2c60e3202cf866137fbfcef2 Merge: d4715546cc4c77 63838c323924fe Author: Arnd Bergmann Date: Mon Jun 1 16:25:19 2026 +0200 Merge tag 'socfpga_fix_for_v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes SoCFPGA dts fix for v7.1 - Fix OF node refcount leak * tag 'socfpga_fix_for_v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: ARM: socfpga: Fix OF node refcount leak in SMP setup Signed-off-by: Arnd Bergmann commit d4715546cc4c77faf445a34b5826c78c328b1d18 Merge: 930c88202003f6 765aaba18413a6 Author: Arnd Bergmann Date: Mon Jun 1 16:24:59 2026 +0200 Merge tag 'at91-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes Microchip AT91 fixes for v7.1 This update includes: - a fix for the GMAC DT node on SAM9X7 SoC to properly describe the available clocks * tag 'at91-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: microchip: sam9x7: fix GMAC clock configuration Signed-off-by: Arnd Bergmann commit 02896a7fa4cd3ec61d60ba30136841e4f04bdeac Author: Nikolay Kuratov Date: Tue May 26 19:29:32 2026 +0300 net/mlx5: Reorder completion before putting command entry in cmd_work_handler Assuming callback != NULL && !page_queue, cmd_work_handler takes command entry with refcnt == 1 from mlx5_cmd_invoke. If either semaphore timeout or index allocation error happens, it does final cmd_ent_put(ent). To avoid access to freed memory, notify slotted completion before cmd_ent_put. This is theoretical issue found by Svace static analyser. Cc: stable@vger.kernel.org Fixes: 485d65e135712 ("net/mlx5: Add a timeout to acquire the command queue semaphore") Fixes: 0e2909c6bec90 ("net/mlx5: Fix variable not being completed when function returns") Signed-off-by: Nikolay Kuratov Reviewed-by: Md Haris Iqbal Reviewed-by: Moshe Shemesh Acked-by: Tariq Toukan Link: https://patch.msgid.link/20260526162932.501584-1-kniv@yandex-team.ru Signed-off-by: Paolo Abeni commit bb061d3de41707415269be75ebf700efb03ec212 Author: Florian Westphal Date: Tue May 12 15:36:14 2026 +0200 netfilter: nft_byteorder: remove multi-register support 64bit byteorder conversion is broken when several registers need to be converted because the source register array advances in steps for 4 bytes instead of 8: for (i = ... src64 = nft_reg_load64(&src[i]); ~~~~~ u32 *src nft_reg_store64(&dst64[i], Remove the multi-register support, it has other issues as well: Pablo points out that commit caf3ef7468f7 ("netfilter: nf_tables: prevent OOB access in nft_byteorder_eval") alters semantics: before the loop operated on registers, i.e. for ( ... ) dst32[i] = htons((u16)src32[i]) .. but after the patch it will operate on bytes, which makes this useless to convert e.g. concatenations, which store each compound in its own register. Multi-convert of u32 has one theoretical application: ct mark . meta mark . tcp dport @intervalset Because ct mark and meta mark are host byte order, use with intervals has to convert the byteorder for ct/meta mark value to network byte order (bigendian). nftables emits this: [ meta load mark => reg 1 ] [ byteorder reg 1 = hton(reg 1, 4, 4) ] [ ct load mark => reg 9 ] [ byteorder reg 9 = hton(reg 9, 4, 4) ] ... I.e. two separate calls. Theoretically it could be changed to do: [ meta load mark => reg 1 ] [ ct load mark => reg 9 ] [ byteorder reg 1 = htonl(reg 1, 4, 8) ] ... But then all it would take to change the set to meta mark . tcp dport . ct mark ... and we'd be back to two "byteorder" calls. IOW, support to convert a range of registers is both dysfunctional and dubious. Simplify this: remove the feature. Pablo Neira Ayuso points out that nftables before 1.1.0 can generate incorrect byteorder conversions, see 9fe58952c45a, "evaluate: skip byteorder conversion for selector smaller than 2 bytes" in nftables.git). Affected rulesets fail to load with this change and old userspace due to 'len != size' check. Fixes: c301f0981fdd ("netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()") Cc: # may break rule load with old nftables versions Reported-by: Michal Kubecek Link: https://lore.kernel.org/netfilter-devel/20240206104336.ctigqpkunom2ufmn@lion.mk-sys.cz/ Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 67ba971ae02514d85818fe0c32549ab4bfa3bf49 Author: Yiming Qian Date: Sat May 23 12:29:10 2026 +0000 netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits(). Fixes: 63137bc5882a ("netfilter: ebtables: Fixes dropping of small packets in bridge nat") Reported-by: Yiming Qian Signed-off-by: Yiming Qian Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 3027ecbdb5fdf9200251c21d4818e4c447ef78e1 Author: Jiayuan Chen Date: Thu May 28 19:09:19 2026 +0800 netfilter: nft_ct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report [1]. A rule like the one below is enough to trigger the bug: table ip t { chain pre { type filter hook prerouting priority raw; ct zone set 1 ct original saddr 1.2.3.4 accept } } The first expression attaches a per-cpu template ct via nft_ct_set_zone_eval() (nf_ct_tmpl_alloc -> kzalloc, tuple is all zero, nf_ct_l3num(ct) == 0). The next expression then calls nft_ct_get_eval() on the same skb, treats the template as a real ct and hits the 16-byte memcpy path. With dreg at NFT_REG32_15 this overflows past struct nft_regs on the kernel stack; with smaller dreg values it silently clobbers adjacent registers. Reject template ct at the eval entry and in nft_ct_get_fast_eval(), mirroring the check nft_ct_set_eval() already has. Additionally, bound the address copy in NFT_CT_SRC / NFT_CT_DST by priv->len instead of by nf_ct_l3num(ct): nf_ct_get_tuple() zeroes the tuple before pkt_to_tuple() fills in only the protocol-relevant leading bytes, so the trailing bytes of tuple->{src,dst}.u3.all are well-defined zero. priv->len is validated at rule load, so the copy size is now bounded by the destination register rather than by an untrusted field on the conntrack. [1]: https://syzkaller.appspot.com/bug?id=389cf09cb72926114fce90dc85a2c3231dcb647c Fixes: 45d9bcda21f4 ("netfilter: nf_tables: validate len in nft_validate_data_load()") Suggested-by: Florian Westphal Signed-off-by: Jiayuan Chen Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit c32b26aaa2f9216520a38b3f4bfeec846eb3eb8a Author: Tristan Madani Date: Wed May 27 13:57:50 2026 +0000 netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set. Fixes: af308b94a2a4 ("netfilter: nf_tables: add tunnel support") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 66eba0ffce3b7e11449946b4cbbef8ea36112f56 Author: Florian Westphal Date: Wed May 27 12:20:19 2026 +0200 netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This helper should be deprecated, given prevalence of TLS I doubt it has any relevance in 2026. Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port") Closes: https://sashiko.dev/#/patchset/20260525182924.28456-1-fw%40strlen.de Signed-off-by: Florian Westphal Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 2fcba19caaeb2a33017459d3430f057967bb91b6 Author: Fernando Fernandez Mancera Date: Tue May 26 23:58:31 2026 +0200 netfilter: synproxy: add mutex to guard hook reference counting As the synproxy infrastructure register netfilter hooks on-demand when a user adds the first iptables target or nftables expression, if done concurrently they can race each other. Introduce a mutex to serialize the refcount control blocks access from both frontends. While a per namespace mutex might be more efficient, it is not needed for target/expression like SYNPROXY. Fixes: ad49d86e07a4 ("netfilter: nf_tables: Add synproxy support") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 36d29ceec32c8206a12dc2810cf65fd394e45baa Author: Jiayuan Chen Date: Tue May 26 10:02:27 2026 +0800 netfilter: nft_fib_ipv6: bail out of sibling walk if rt got unlinked This was reported by Sashiko [1]. The RCU walk over rt->fib6_siblings can spin forever if rt is unlinked mid-iteration: rt->fib6_siblings.next still points into the old ring, so the loop never meets &rt->fib6_siblings as its terminator. fib6_purge_rt() always does WRITE_ONCE(rt->fib6_nsiblings, 0) before list_del_rcu(), so readers can use rt->fib6_nsiblings == 0 as the detach signal. The same pattern is used in fib6_info_uses_dev() and rt6_nlmsg_size(). [1]: https://sashiko.dev/#/patchset/20260520023411.391233-1-jiayuan.chen%40linux.dev Suggested-by: Florian Westphal Fixes: 1c32b24c234b ("netfilter: nft_fib_ipv6: switch to fib6_lookup") Signed-off-by: Jiayuan Chen Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 193989cc6d80dd8e0460fb3992e69fa03bf0ff9b Author: Julian Anastasov Date: Mon May 25 07:07:44 2026 +0300 ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This can cause packets to use the old scheduler at the time when svc->sched_data is already freed after RCU grace period. Fix it by clearing the ptr early in ip_vs_unbind_scheduler(), before the done_service method schedules any RCU callbacks. Also, if the new scheduler fails to initialize when replacing the old scheduler, try to restore the old scheduler while still returning the error code. Link: https://sashiko.dev/#/patchset/20260519015506.634185-1-rosenp%40gmail.com Fixes: 05f00505a89a ("ipvs: fix crash if scheduler is changed") Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit c6c5327dd18bec1e1bbf139b2cf5ae53608a9d30 Author: Fernando Fernandez Mancera Date: Fri May 22 12:47:17 2026 +0200 netfilter: xt_NFQUEUE: prefer raw_smp_processor_id With PREEMPT_RCU this triggers a splat because smp_processor_id() can be preempted while inside a RCU critical section. If xt_NFQUEUE target is invoked via nft_compat_eval() path, we are inside a RCU critical section. Just use the raw version instead. Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit e9096a5a170e7ecd6467bc2e08668ec39897cda7 Author: Takao Sato Date: Tue May 26 13:09:57 2026 -0300 xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() iptfs_consume_frags() transfers paged fragments from one socket buffer to another but fails to propagate the SKBFL_SHARED_FRAG flag. This is the same class of bug that was fixed in skb_try_coalesce() for CVE-2026-46300: when fragments backed by read-only page-cache pages are merged, the marker indicating their shared nature must be preserved so that ESP can decide correctly whether in-place encryption is safe. Apply the same two-line fix used in skb_try_coalesce() to iptfs_consume_frags(). Fixes: b96ba312e21c ("xfrm: iptfs: share page fragments of inner packets") Cc: stable@vger.kernel.org # 6.14+ Signed-off-by: Takao Sato Signed-off-by: Steffen Klassert commit 9d7bea186ba5a002456471edf36cc9b69f809397 Author: Mike Rapoport (Microsoft) Date: Wed May 27 21:47:51 2026 +0300 userfaultfd: remove redundant check in vm_uffd_ops() Lorenzo says: static const struct vm_uffd_ops *vma_uffd_ops(struct vm_area_struct *vma) { if (vma_is_anonymous(vma)) return &anon_uffd_ops; return vma->vm_ops ? vma->vm_ops->uffd_ops : NULL; } This is doing a redundant check _and_ making life confusing, as if !vma->vm_ops is a condition that can be reached there, it can't, as vma_is_anonymous() is literally a !vma->vm_ops check :) Remove the redundant check. Link: https://lore.kernel.org/20260527184751.4147364-4-rppt@kernel.org Fixes: 0f48947c4232 ("userfaultfd: introduce vm_uffd_ops") Signed-off-by: Mike Rapoport (Microsoft) Suggested-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Cc: David Hildenbrand Cc: Liam R. Howlett Cc: Peter Xu Cc: David Carlier Cc: Michael Bommarito Signed-off-by: Andrew Morton commit df3ee3b3bbc327f570c5451666bbaf6cf8b4436a Author: Mike Rapoport (Microsoft) Date: Wed May 27 21:47:50 2026 +0300 userfaultfd: refuse to __mfill_atomic_pte() for unsupported VMAs __mfill_atomic_pte() unconditionally dereferences ops because there is an assumption that VMAs that can undergo mfill_* operations are vetted on registration and must have valid vm_uffd_ops. Add a guard against potential bugs and make sure __mfill_atomic_pte() bails out if ops is NULL. Link: https://lore.kernel.org/20260527184751.4147364-3-rppt@kernel.org Fixes: ad9ac3081332 ("userfaultfd: introduce vm_uffd_ops->alloc_folio()") Signed-off-by: Mike Rapoport (Microsoft) Suggested-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Reviewed-by: David CARLIER Cc: David Hildenbrand Cc: Liam R. Howlett Cc: Michael Bommarito Cc: Peter Xu Signed-off-by: Andrew Morton commit 85668fda932a5b8f15f649cf06411525a0e4c8ec Author: Mike Rapoport (Microsoft) Date: Wed May 27 21:47:49 2026 +0300 userfaultfd: verify VMA state across UFFDIO_COPY retry Patch series "userfaultfd: verify VMA state across UFFDIO_COPY retry", v2. ... and two more small fixes. This patch (of 3): mfill_copy_folio_retry() drops the VMA lock for copy_from_user() and reacquires it afterwards. The destination VMA can be replaced during that window. The existing check compares vma_uffd_ops() before and after the retry, but if a shmem VMA with MAP_SHARED is replaced with a shmem VMA with MAP_PRIVATE (or vice versa) the replacement goes undetected. The change from MAP_PRIVATE to MAP_SHARED will treat the folio allocated with shmem_alloc_folio() as anonymous and this will cause BUG() when mfill_atomic_install_pte() will try to folio_add_new_anon_rmap(). The change from MAP_SHARED to MAP_PRIVATE allows injection of folios into the page cache of the original VMA. There is no need to change for hugetlb because it never uses mfill_copy_folio_retry(). Introduce helpers for more comprehensive comparison of VMA state: - mfill_retry_state_save() to save the relevant VMA state into a struct mfill_retry_state (original uffd_ops, relevant VMA flags, vm_file and pgoff) before dropping the lock - mfill_retry_state_changed() to compare the saved state with the state of the VMA acquired after retaking the locks - mfill_retry_state_put() to release vm_file pinning. Use DEFINE_FREE() cleanup to wrap mfill_retry_state_put() to avoid complicating error handling paths in mfill_copy_folio_retry(). Link: https://lore.kernel.org/20260527184751.4147364-1-rppt@kernel.org Link: https://lore.kernel.org/20260527184751.4147364-2-rppt@kernel.org Fixes: 292411fda25b ("mm/userfaultfd: detect VMA type change after copy retry in mfill_copy_folio_retry()") Fixes: 6ab703034f14 ("userfaultfd: mfill_atomic(): remove retry logic") Co-developed-by: Michael Bommarito Signed-off-by: Michael Bommarito Signed-off-by: Mike Rapoport (Microsoft) Suggested-by: Peter Xu Co-developed-by: David Carlier Signed-off-by: David Carlier Reviewed-by: Lorenzo Stoakes Cc: David Hildenbrand Cc: Liam R. Howlett Signed-off-by: Andrew Morton commit 8d878059924f12c1bc24556a92ec56add74de3c8 Author: Yin Tirui Date: Tue May 26 18:13:37 2026 +0800 mm/huge_memory: update file PMD counter before folio_put() __split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folio_put() drops the last reference, mm_counter_file() can later read freed folio state via folio_test_swapbacked(). Move the counter update before folio_put(). Link: https://lore.kernel.org/20260526101337.1984081-1-yintirui@huawei.com Fixes: fadae2953072 ("thp: use mm_file_counter to determine update which rss counter") Signed-off-by: Yin Tirui Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand (arm) Reviewed-by: Lance Yang Reviewed-by: Dev Jain Cc: Baolin Wang Cc: Barry Song Cc: Chen Jun Cc: Kefeng Wang Cc: Liam R. Howlett Cc: Nico Pache Cc: Ryan Roberts Cc: Vlastimil Babka Cc: Yang Shi Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit 40990c87a26e371594475acdc560c93cfae308a1 Author: Yin Tirui Date: Tue May 26 18:13:55 2026 +0800 mm/huge_memory: update file PUD counter before folio_put() __split_huge_pud_locked() updates the file/shmem RSS counter after dropping the PUD mapping's folio reference. If folio_put() drops the last reference, mm_counter_file() can later read freed folio state via folio_test_swapbacked(). Move the counter update before folio_put(). Link: https://lore.kernel.org/20260526101355.1984244-1-yintirui@huawei.com Fixes: dbe54153296d ("mm/huge_memory: add vmf_insert_folio_pud()") Signed-off-by: Yin Tirui Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand (arm) Reviewed-by: Lance Yang Reviewed-by: Dev Jain Cc: Alistair Popple Cc: Baolin Wang Cc: Barry Song Cc: Chen Jun Cc: Kefeng Wang Cc: Liam R. Howlett Cc: Nico Pache Cc: Ryan Roberts Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit c7bde43f6daf70e05a64fbca7efdf6fa93e057dc Author: Muchun Song Date: Mon May 25 10:52:13 2026 +0800 mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback vmemmap_restore_pte() rebuilds restored vmemmap pages from a tail-page template derived from compound_head(). This is wrong when the current PTE already maps a page whose contents are not tail-page metadata. In the rollback path of vmemmap_remap_free(), the first restored PTE is backed by vmemmap_head and contains head-page metadata. Reconstructing that page from a tail-page template overwrites the head-page state and corrupts the restored vmemmap page. Fix this by copying the full page from the page currently mapped by the PTE. Also pass vmemmap_tail to the rollback walk so only PTEs backed by the shared tail page are restored, while the head PTE remains mapped to vmemmap_head. Add VM_WARN_ON_ONCE() checks for unexpected cases. Link: https://lore.kernel.org/20260525025213.2229628-1-songmuchun@bytedance.com Fixes: c0b495b91a47 ("mm/hugetlb: refactor code around vmemmap_walk") Signed-off-by: Muchun Song Acked-by: Kiryl Shutsemau Acked-by: Oscar Salvador (SUSE) Cc: David Hildenbrand Cc: Signed-off-by: Andrew Morton commit d6b8b02a27b3dd09ec12144322b3dac46d9bc9ef Author: SeongJae Park Date: Mon May 25 09:22:55 2026 -0700 mm/damon/ops-common: call folio_test_lru() after folio_get() damon_get_folio() speculatively calls folio_test_lru() before folio_try_get(). The folio can get freed and reallocated to a tail page. In the case, VM_BUG_ON_PGFLAGS() in const_folio_flags() can be triggered. Remove the speculative call. Also mark folio_test_lru() check right after folio_try_get() success as no more unlikely. The race should be rare. Also the problem can happen only if the kernel has enabled CONFIG_DEBUG_VM_PGFLAGS. No real world report of this issue has been made so far. This fix is based on only theoretical analysis. That said, a bug is a bug. A similar issue was also fixed via commit 3203b3ab0fcf ("mm/filemap: don't call folio_test_locked() without a reference in next_uptodate_folio()"). I don't expect this change will make a meaningful impact to DAMON performance in the real world, though I will be happy to be corrected from the real world reports. The issue was discovered [1] by Sashiko. Link: https://lore.kernel.org/20260525162256.8317-1-sj@kernel.org Link: https://lore.kernel.org/20260517234112.89245-1-sj@kernel.org [1] Fixes: 3f49584b262c ("mm/damon: implement primitives for the virtual memory address spaces") Signed-off-by: SeongJae Park Cc: Fernand Sieber Cc: Leonard Foerster Cc: Shakeel Butt Cc: # 5.15.x Signed-off-by: Andrew Morton commit f580d27e8928828693df44ba2db0fffdbe11dfea Author: Gil Portnoy Date: Mon Jun 1 08:27:56 2026 +0900 ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on conn->async_requests via setup_async_work(), with cancel_fn = smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock. When the request is cancelled, the worker frees the file_lock with locks_free_lock() and takes the cancelled early-exit, which "goto out"s and never reaches release_async_work() -- the only site that unlinks the work from conn->async_requests and clears cancel_fn/cancel_argv. The work therefore stays matchable on async_requests with a live cancel_fn pointing at the freed file_lock, until connection teardown finally runs release_async_work(). smb2_cancel() fires cancel_fn unconditionally with no state guard, so a second SMB2_CANCEL for the same AsyncId, arriving in that window, re-runs smb2_remove_blocked_lock() on the freed file_lock -- a slab use-after-free: BUG: KASAN: slab-use-after-free in __locks_delete_block __locks_delete_block locks_delete_block ksmbd_vfs_posix_lock_unblock smb2_remove_blocked_lock smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn handle_ksmbd_work Allocated by ...: locks_alloc_lock <- smb2_lock Freed by ...: locks_free_lock <- smb2_lock (cancelled branch) ... cache file_lock_cache of size 192 Reproduced on mainline with KASAN by an authenticated SMB client. Skip a work whose state is already KSMBD_WORK_CANCELLED so its cancel callback cannot be fired a second time. Cc: stable@vger.kernel.org Signed-off-by: Gil Portnoy Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7ce4fc40018de07f05f3035241122d992610dbfb Author: Gil Portnoy Date: Thu May 28 00:00:00 2026 +0000 ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd Two concurrent same-user DHnC reconnects can both observe fp->conn == NULL before either sets it. ksmbd_reopen_durable_fd() checks fp->conn to guard against a handle already being reconnected, but the check and the binding assignment are not atomic: both threads pass the guard, both call ksmbd_conn_get() on the same fp, and both eventually reach kfree(fp->owner.name) -- a double-free of the owner.name slab object. The double-bound ksmbd_file also causes a write-UAF on the 344-byte ksmbd_file_cache object when a concurrent smb2_close() spins on fp->f_lock after the object has been freed by the losing reconnect path. KASAN on 7.1-rc5 (48-thread concurrent reconnect, 3000 cycles): BUG: KASAN: double-free in ksmbd_reopen_durable_fd+0x268/0x308 BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xac/0x150 Write of size 4 at offset 24 into freed ksmbd_file_cache object Five double-bind windows observed; 63 total KASAN reports triggered. Fix: validate and claim fp->conn under write_lock(&global_ft.lock) so the check-and-claim is atomic. ksmbd_lookup_durable_fd() already treats fp->conn != NULL as "in use" and skips such an fp; setting fp->conn before dropping the lock closes the race. ksmbd_conn_get() is a non-sleeping refcount increment, safe under the rwlock. The rollback path on __open_id() failure also clears fp->conn/tcon under the lock so concurrent readers see a consistent state. Fixes: b1f1e80620de ("ksmbd: centralize ksmbd_conn final release to plug transport leak") Assisted-by: Henry (Claude):claude-opus-4 Signed-off-by: Gil Portnoy Acked-by: Namjae Jeon Signed-off-by: Steve French commit b003086d76968298f22e7cf62239833b5a3a06b1 Author: Gil Portnoy Date: Thu May 28 00:00:00 2026 +0000 ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn into a local with neither READ_ONCE() nor a NULL check. Both run from oplock_break() after opinfo_get_list() has dropped ci->m_lock, so a concurrent SMB2 LOGOFF (session_fd_check()) can set op->conn = NULL under ci->m_lock within that window. ksmbd_conn_r_count_inc(conn) then writes through NULL at offset 0xc4 -- a remotely triggerable oops. Guard both reads the way compare_guid_key() already does: read opinfo->conn with READ_ONCE() and return early if it is NULL, before allocating the work struct so nothing leaks. A NULL conn means the client is gone and the break is moot, so return 0; oplock_break() treats that as success and runs the normal teardown. Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2") Assisted-by: Henry (Claude):claude-opus-4 Signed-off-by: Gil Portnoy Acked-by: Namjae Jeon Signed-off-by: Steve French commit e43ffb69e0438cddd72aaa30898b4dc446f664f8 Author: Linus Torvalds Date: Sun May 31 15:14:24 2026 -0700 Linux 7.1-rc6 commit 8d9c51eac648ec953ea534b536d62337be3744b7 Merge: 968966c2823a4b 171022c7d594c1 Author: Linus Torvalds Date: Sun May 31 11:50:39 2026 -0700 Merge tag 'media/v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - rc: igorplugusb: fix control request setup packet - vsp1: revert a couple patches to fix regressions when setting DRM pipelines * tag 'media/v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: rc: igorplugusb: fix control request setup packet Revert "media: renesas: vsp1: brx: Fix format propagation" Revert "media: renesas: vsp1: Initialize format on all pads" commit 968966c2823a4b426a1c71101cb682faa0982892 Merge: 13bd441bb98e9c 44eeff9bc467bc Author: Linus Torvalds Date: Sun May 31 08:52:16 2026 -0700 Merge tag 'x86-urgent-2026-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Make the clearcpuid= boot parameter less prominent and warn about its dangers & caveats (Borislav Petkov) - Do not access the (new) PLATFORM_ID MSR when running as a guest (Borislav Petkov) - x86 ftrace: Relocate %rip-relative percpu refs in dynamic trampolines, to fix crash when using such trampolines (Alexis Lothoré) - Fix x86-64 CFI build error (Peter Zijlstra) - Revert FPU signal return magic number check optimization, because it broke CRIU and gVisor in certain FPU configurations (Andrei Vagin) * tag 'x86-urgent-2026-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Revert "x86/fpu: Refine and simplify the magic number check during signal return" x86/kvm/vmx: Fix x86_64 CFI build x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines x86/microcode: Do not access MSR_IA32_PLATFORM_ID when running as a guest Documentation/arch/x86: Hide clearcpuid= commit 13bd441bb98e9cc91f9fb4449415e0519a0de7a9 Merge: 9cf1afe6de1dc9 85db7391310b13 Author: Linus Torvalds Date: Sun May 31 08:45:08 2026 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two core changes, the only one of significance being the change to kick queues in SDEV_CANCEL which had a small window for stuck requests. The major driver fixes are the one to the FC transport class to widen the FPIN counter to counter a theoretical (and privileged) fabric traffic injection attack and the other is an iscsi fix where a malicious target could trick the kernel into an output buffer overrun. Both the driver fixes were AI assisted" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: target: iscsi: Validate CHAP_R length before base64 decode scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 scsi: scsi_debug: Add missing newline in scsi_debug_device_reset() scsi: megaraid_sas: Fix NULL pointer dereference on firmware duplicate completion scsi: devinfo: Add BLIST_NO_RSOC for Promise VTrak E310f scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues commit 9cf1afe6de1dc9dfced6070328626830794bac9d Merge: 227abb780c6868 1d774589f92405 Author: Linus Torvalds Date: Sun May 31 08:33:08 2026 -0700 Merge tag 'i2c-for-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - davinci: fix fallback bus frequency on missing clock-frequency - virtio: mark device ready initially * tag 'i2c-for-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: virtio: mark device ready before registering the adapter i2c: davinci: fix division by zero on missing clock-frequency commit 227abb780c68687d6800cf9eafaff0cbeca4bf45 Merge: 174914ea551314 dab48a7e74e6a3 Author: Linus Torvalds Date: Sun May 31 08:27:18 2026 -0700 Merge tag 'input-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - updates to Elan I2C touchpad driver to handle a new IC type and to validate size of supplied firmware to prevent OOB access - updates to Xpad controller driver to recognize ASUS ROG RAIKIRI II and "Nova 2 Lite" from GameSir controllers as well as a fix to prevent a potential OOB access when handling "Share" button - an update to Synaptics touchpad driver to use RMI mode for touchpad in Thinkpad E490 - updates to Atmel MXT driver adding checks to prevent potential OOB accesses - a fix to IMS PCU driver to free correct amount of memory when tearing it down - a fixup to the recent change to Atlas buttons driver - a small cleanup in fm801-fp for PCI IDs table initialisation * tag 'input-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 Input: atlas - check ACPI_COMPANION() against NULL Input: atmel_mxt_ts - check mem_size before calculating config memory size Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem Input: fm801-gp - simplify initialisation of pci_device_id array Input: xpad - add "Nova 2 Lite" from GameSir Input: xpad - add support for ASUS ROG RAIKIRI II Input: elan_i2c - validate firmware size before use Input: xpad - fix out-of-bounds access for Share button Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size Input: elan_i2c - increase device reset wait timeout after update FW Input: elan_i2c - add ic type 0x19 commit aa2f4addab44407c7aa742321de5dc1914ab5762 Author: Rong Zhang Date: Sun May 31 03:52:49 2026 +0800 ALSA: usb-audio: Set the value of potential sticky mixers to maximum It makes no sense to restore the saved value for a sticky mixer, since setting any value is a no-op. However, in some rare cases, SET_CUR is effective despite GET_CUR always returns a constant value. These mixers are not sticky, but there's no way to distinguish them. Without any additional information, the best thing we can do is to set the mixer value to the maximum before bailing out, so that a soft mixer can still reach the maximum hardware volume if the mixer turns out to be non-sticky. Meanwhile, all channels must be synchronized to prevent imbalance volume. Fixes: 86aa1ea1f15c ("ALSA: usb-audio: Do not expose sticky mixers") Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20260531-uac-sticky-error-path-v1-1-12c2329d17ef@rong.moe Signed-off-by: Takashi Iwai commit 093305d801fae6ff9b8bb531fd78b579794c4f80 Author: Emmanuel Grumbach Date: Sun May 31 13:30:19 2026 +0300 wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used In most distributions, NetworkManager shuts the device down before entering system suspend, so fast suspend is typically not used. On older devices, resume currently tries to grab NIC access to infer whether the device was powered off while suspended. That probe is only meaningful for the fast-suspend path where the device is expected to remain alive. Unfortunately, for unclear reasons, grabbing NIC access was harmful as reported in the bugzilla ticket below. Workaround this issue by simply not grabbing NIC access if fast suspend is not used. Cc: stable@vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221501 Assisted-by: GitHub Copilot:gpt-5.3-codex Signed-off-by: Emmanuel Grumbach Link: https://patch.msgid.link/20260531133005.e2ed9e0cd44f.If283625983a843933e0c01561a421daff184e9e9@changeid Signed-off-by: Miri Korenblit commit 174914ea551314c52a61713b9c4bde9e42d48073 Merge: 9d87d0fc8c8e0a 9d2491197a00ac Author: Linus Torvalds Date: Sat May 30 17:05:58 2026 -0700 Merge tag 'v7.1-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - fix uninitialized variable in smb2_writev_callback() - detect short folioq copy in cifs_copy_folioq_to_iter() * tag 'v7.1-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix uninitialized variable in smb2_writev_callback smb: client: detect short folioq copy in cifs_copy_folioq_to_iter() commit 9d87d0fc8c8e0a2a2b5026a169db2f270b4828c1 Merge: a29c0b0cafc78a 8fd2f26fa2a33c Author: Linus Torvalds Date: Sat May 30 15:39:47 2026 -0700 Merge tag 'liveupdate-fixes-2026-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux Pull liveupdate fixes from Mike Rapoport: "Two kexec handover regression fixes: - fix order calculation for kho_unpreserve_pages() to make sure sure that the order calculation in kho_unpreserve_pages() mathes the order calculation in kho_preserve_pages(). - fix math in calculation of KHO_TREE_MAX_DEPTH to make it work with 16KB pages" * tag 'liveupdate-fixes-2026-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: kho: fix order calculation for kho_unpreserve_pages() kho: fix KHO_TREE_MAX_DEPTH for non-4KB page sizes commit a29c0b0cafc78a45f44ac4a98efee0c11dd7996d Merge: 670b77dfebe725 7c2eee9c136734 Author: Linus Torvalds Date: Sat May 30 15:37:05 2026 -0700 Merge tag 'fixes-2026-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock fix from Mike Rapoport: "Fix regression from memblock_free_late() refactoring After refactoring of memblock_free_late() and free_init_pages() it became possible to call memblock_free() after memblock init data was discarded. Make sure memblock_free() does not touch memblock.reserved unless it is called early enough or when ARCH_KEEP_MEMBLOCK is enabled" * tag 'fixes-2026-05-30' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: don't touch memblock arrays when memblock_free() is called late commit e0c121d545134af886b28c4c26d91abf5dd39c17 Author: Emmanuel Grumbach Date: Fri May 29 08:57:07 2026 +0300 wifi: iwlwifi: mvm: avoid oversized UATS command copy MCC_ALLOWED_AP_TYPE_CMD exceeds the fixed copied host-command buffer and triggers warnings in the gen2 enqueue path when command 0xc05 is sent. Use IWL_HCMD_DFL_NOCOPY as it was done before the offending commit. Fixes: 078df640ef05 ("wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2") Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260529085453.9af349ab459b.I348df3980764c15efce0099a35fe8a88fb2a6ee2@changeid commit 9bf1b409afc7c4a1f0340f3975846c4f3278643a Author: Pagadala Yesu Anjaneyulu Date: Fri May 29 08:57:06 2026 +0300 wifi: iwlwifi: mld: send tx power constraints before link activation TX power constraints must be sent to the firmware before link activation. If not, the firmware will use default power values. Fix this by moving the iwl_mld_send_ap_tx_power_constraint_cmd() call from iwl_mld_start_ap_ibss() to iwl_mld_assign_vif_chanctx(), before iwl_mld_activate_link() for AP interfaces. Also update the guard in the function to allow it to run before link activation for AP interfaces. Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260529085453.06c94b01efd2.Id43bdfe5eb030061c23348779687ba71b5f58182@changeid commit 0eaa1f245ac03ed0c6394159360532726f666811 Author: Emmanuel Grumbach Date: Fri May 29 08:57:05 2026 +0300 wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares -77.ucode doesn't contain the fixes for this flow it seems. Don't use the firmware reset handshake even if the firmware claims support for it. Fixes: 906d4eb84408 ("iwlwifi: support firmware reset handshake") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220600 Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260529085453.9307b81d9b02.I21bba9e649f4cd0e35d3ea6cd97a03258be5832f@changeid commit 171022c7d594c133a45f92357a2a91475edabe20 Author: Henri A Date: Wed May 20 10:25:44 2026 -0400 media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules. However, the driver still passes &ir->request to usb_fill_control_urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb_ctrlrequest. USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot: usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0 Pass ir->request itself as the setup packet. Fixes: eac69475b01f ("media: rc: igorplugusb: heed coherency rules") Reported-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=11f0e4f957c7c3bf3d51 Tested-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5.5 Signed-off-by: Henri A Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 670b77dfebe7257adc0defbc48a4c43cfdf6c8f6 Merge: 495fb8dd7f1da9 645d4eda1d0db0 Author: Linus Torvalds Date: Sat May 30 08:37:45 2026 -0700 Merge tag 'usb-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB and Thunderbolt fixes from Greg KH: "Here is a set of USB fixes and new device ids for 7.1-rc6. Nothing major in here, just lots of tiny fixes for reported issues found by users and some older patches found by some scanning tools. Included in here are: - typec fixes found by fuzzers that have decided to finally look at that device interaction path (i.e. before a driver is bound to a device) - typec fixes for issues found by users - thunderbolt driver fixes for reported problems - cdns3 driver fixes - dwc3 driver fixes - new device quirks added - usb serial driver fixes for broken devices - other small driver fixes All of these have been in linux-next for over a week with no reported issues" * tag 'usb-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (54 commits) USB: serial: cypress_m8: validate interrupt packet headers USB: serial: safe_serial: fix memory corruption with small endpoint USB: serial: omninet: fix memory corruption with small endpoint USB: serial: mxuport: fix memory corruption with small endpoint USB: serial: cypress_m8: fix memory corruption with small endpoint USB: cdc-acm: Fix bit overlap and move quirk definitions to header usb: dwc2: Fix use after free in debug code usb: chipidea: core: convert ci_role_switch to local variable usb: gadget: f_fs: serialize DMABUF cancel against request completion usb: gadget: f_fs: copy only received bytes on short ep0 read usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports dt-bindings: usb: Fix EIC7700 USB reset's issue usbip: vudc: Fix use after free bug in vudc_remove due to race condition dt-bindings: usb: ti,omap4-musb: Drop duplicate 'usb-phy' property constraints usb: storage: Add quirks for PNY Elite Portable SSD USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize usb: usbtmc: check URB actual_length for interrupt-IN notifications xhci: tegra: Fix ghost USB device on dual-role port unplug usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind ... commit 495fb8dd7f1da991c5325f4a0a50d0b042f19523 Merge: 25447851777a53 e4240d8845445d Author: Linus Torvalds Date: Sat May 30 08:34:03 2026 -0700 Merge tag 'tty-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are some small serial driver fixes for 7.1-rc6. Included in here are: - mips serial driver fixes to resolve some long-standing issues with how they interacted with the console. That's the "majority" of the changes in this merge request - sh-sci driver regression fix - 8250 driver regression fixes - other small serial driver fixes for reported problems. All of these have been in linux-next for over a week with no reported issues" * tag 'tty-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: dz: Enable modular build serial: zs: Convert to use a platform device serial: dz: Convert to use a platform device serial: zs: Switch to using channel reset serial: zs: Fix bootconsole handover lockup serial: dz: Fix bootconsole handover lockup serial: dz: Fix bootconsole message clobbering at chip reset serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() serial: 8250: dispatch SysRq character in serial8250_handle_irq() serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) tty: serial: samsung: Remove redundant port lock acquisition in rx helpers serial: altera_jtaguart: handle uart_add_one_port() failures serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma tty: add missing tty_driver include to tty_port.h serial: qcom-geni: fix UART_RX_PAR_EN bit position serial: sh-sci: fix memory region release in error path tty: serial: pch_uart: add check for dma_alloc_coherent() serial: zs: Fix swapped RI/DSR modem line transition counting commit 25447851777a53bd4b501e7f2cb418332ad584cc Merge: 1246c246d9f684 05d5d79440c2cc Author: Linus Torvalds Date: Sat May 30 08:30:12 2026 -0700 Merge tag 'char-misc-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc/iio fixes from Greg KH: "Here are some small char/misc/iio driver fixes for 7.1-rc6. Included in here are: - lots of small IIO driver fixes for reported problems. - Android binder bugfixes for reported issues. - small comedi test driver fixes - counter driver fix - parport driver fix (people still use this?) - rpi driver fix - uio driver fix All of these have been in linux-next for over a week with no reported problems" * tag 'char-misc-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (41 commits) Revert "gpib: cb7210: Fix region leak when request_irq fails" misc: rp1: Send IACK on IRQ activate to fix kdump/kexec gpib: cb7210: Fix region leak when request_irq fails parport: Fix race between port and client registration uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory rust_binder: Avoid holding lock when dropping delivered_death rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw iio: gyro: itg3200: fix i2c read into the wrong stack location iio: dac: ad5686: fix powerdown control on dual-channel devices iio: dac: ad5686: acquire lock when doing powerdown control iio: temperature: tsys01: fix broken PROM checksum validation iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings iio: buffer: hw-consumer: fix use-after-free in error path iio: dac: ad5686: fix input raw value check iio: dac: ad5686: fix ref bit initialization for single-channel parts iio: ssp_sensors: cancel delayed work_refresh on remove iio: adc: meson-saradc: fix calibration buffer leak on error ... commit 1d774589f924056b8403e271fdecaf9a803a50fc Author: Alexis Bouzigues Date: Fri May 29 09:28:14 2026 -0500 i2c: virtio: mark device ready before registering the adapter virtio_i2c_probe() synchronously probes child i2c drivers on the bus, but peripherals may use the bus at probe for tasks like reading a chip id. The vhost-user-i2c backend stalls at such probes unless DRIVER_OK is already set before the virtqueue is first kicked. Set DRIVER_OK explicitly before i2c_add_adapter(), as done for the same reason in commit f5866db64f34 ("virtio_console: enable VQs early") and commit 71e4b8bf0482 ("virtio_rpmsg: set DRIVER_OK before using device"). Signed-off-by: Alexis Bouzigues Signed-off-by: Wolfram Sang commit e2aecff95bc6d59030332959a18f8c9f654961be Merge: e7ae89a0c97ce2 030675aa54cf75 Author: Wolfram Sang Date: Sat May 30 15:50:41 2026 +0200 Merge tag 'i2c-host-fixes-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v7.1-rc6 davinci: fix fallback bus frequency on missing clock-frequency commit 85e0f27dd1396307913ffc5745b0c05137e9beac Author: Masami Hiramatsu (Google) Date: Mon May 25 11:21:14 2026 +0900 tracing/probes: Point the error offset correctly for eprobe argument error Fix to point the error offset correctly for eprobe argument error. In the cleanup commit 1b8b0cd754cd ("tracing/probes: Move event parameter fetching code to common parser"), due to incorrect backward compatibility aimed at conforming to the test specifications, the error location was set to 0 when a non-existent formal parameter was specified for Eprobe. However, this should be corrected in both the test and the implementation to point correct error position. Link: https://lore.kernel.org/all/177967567399.209006.1451571244515632097.stgit@devnote2/ Fixes: 1b8b0cd754cd ("tracing/probes: Move event parameter fetching code to common parser") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt commit 905b06d32a52afe32fcf5f30cf298c9ea6359f11 Author: Miguel Ojeda Date: Sat May 30 13:49:25 2026 +0200 rust: x86: support Rust >= 1.98.0 target spec Starting with Rust 1.98.0 (expected 2026-08-20), the target spec will not support `x86-softfloat` anymore [1]. Instead, `softfloat` should be used, which is an alias. Otherwise, one gets: error: error loading target specification: rustc-abi: invalid rustc abi: 'x86-softfloat'. allowed values: 'x86-sse2', 'softfloat' at line 3 column 32 | = help: run `rustc --print target-list` for a list of built-in targets Thus conditionally use one or the other depending on the version. The alias has existed since Rust 1.95.0 (released 2026-04-16) [2], but use the newer version instead to avoid changing how the build works for existing compilers, at least until more testing takes place. Cc: Ralf Jung Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Link: https://github.com/rust-lang/rust/pull/157151 [1] Link: https://github.com/rust-lang/rust/pull/151154 [2] Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260530114925.260754-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 05d5d79440c2cc0784f91b61f2012753e66be472 Author: Greg Kroah-Hartman Date: Sat May 30 12:25:36 2026 +0200 Revert "gpib: cb7210: Fix region leak when request_irq fails" This reverts commit 2eae90a457baa0048a96ed38ad93090ee38c8b2f. Turns out not to be correct. Link: https://lore.kernel.org/r/PpNUbGhrvT8I_KayoDvQYI2PYjmMw1QEkuVBDZz2PwBsVVgPkBXJarc2mBM0IhiH3AQG0GtgqEsDRXNj3yUKEDBaZa25u73pAjvcE6vfRsg=@protonmail.com Reported-by: Dominik Karol Piątkowski Cc: Mark Brown Cc: Hongling Zeng Cc: Hongling Zeng Signed-off-by: Greg Kroah-Hartman commit 7c6535c37dbc03c1c35926b7420d66fb122b513a Author: Marco Elver Date: Thu May 21 14:27:23 2026 +0200 s390: Implement _THIS_IP_ using inline asm Both GCC [1] and Clang [2] consider the generic version of _THIS_IP_ to be broken: #define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; }) In particular, the address of a label is only expected to be used with a computed goto. While the generic version more or less works today, it is known to be brittle and may break with current and future optimizations. For example, Clang -O2 always returns 1 when this function is inlined: static inline unsigned long get_ip(void) { return ({ __label__ __here; __here: (unsigned long)&&__here; }); } Fix it by overriding _THIS_IP_ in (which is included by ) using an architecture-specific inline asm version. Additionally, avoiding taking the address of a label prevents compilers from emitting spurious indirect branch targets (e.g. ENDBR or BTI) under control-flow integrity schemes. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=120071 [1] Link: https://github.com/llvm/llvm-project/issues/138272 [2] Signed-off-by: Marco Elver Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit ac35b5580ace12e5d0a0b5e61e36d2c4e1ffa29c Author: Alice Ryhl Date: Wed May 27 18:18:07 2026 +0000 rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES Due to a rustc bug [1] the -Cforce-unwind-tables=y flag only emits the uwtable annotation for functions, but not for the module. This means that compiler-generated functions such as 'asan.module_ctor' do not receive the uwtable annotation. When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, this leads to boot failures because the dwarf information emitted for the kasan constructors is wrong, which causes the SCS boot patching code to patch the constructor in an illegal manner. Specifically, the paciasp instruction is patched, but the autiasp instruction is not. This mismatch leads to a crash when the constructor is called during boot. ================================================================== BUG: KASAN: global-out-of-bounds in do_basic_setup+0x4c/0x90 Read of size 8 at addr ffffffe3cc7eb488 by task swapper/0/1 Specifically the faulting instruction is the (*fn)() to invoke the constructor in do_ctors() of the init/main.c file. Once the fix lands in rustc, this flag can be made conditional on the rustc version. Note that passing the flag on a rustc with the fix present has no effect. [ The fix [1] has landed for Rust 1.98.0 (expected release on 2026-08-20). Thus add a version check as discussed. - Miguel ] Fixes: d077242d68a3 ("rust: support for shadow call stack sanitizer") Cc: stable@kernel.org Link: https://github.com/rust-lang/rust/pull/156973 [1] Reported-by: Bo Ye Debugged-by: Isaac Manjarres Debugged-by: Sami Tolvanen Tested-by: Isaac Manjarres Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260527-uwtable-module-flag-v1-1-caa41342be4b@google.com [ Adjusted link and comment. - Miguel ] Signed-off-by: Miguel Ojeda commit dabfaca8140f64535a79020f0f86ea56f5db5bb2 Author: Matthew Wilcox (Oracle) Date: Tue May 26 20:53:59 2026 +0100 xfs: Remove mention of PageWriteback Update a comment to refer to folios instead of pages. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 8070a50b88971f9fada55a3ae3330f529bef9adc Author: Christoph Hellwig Date: Wed May 27 14:32:37 2026 +0200 xfs: abort mount if xfs_fs_reserve_ag_blocks fails xfs_mountfs currently ignores all errors from xfs_fs_reserve_ag_blocks, which can lead to the mount path continuing on corruption errors. Fix the check to only ignore -ENOSPC as in other callers, and unwind for all other errors. Fixes: 81ed94751b15 ("xfs: fix log intent recovery ENOSPC shutdowns when inactivating inodes") Signed-off-by: Christoph Hellwig Reviewed-by: "Darrick J. Wong" Signed-off-by: Carlos Maiolino commit 2fa29c1a167739fdef0fda9742ddeb15d9a6c7e4 Author: Christoph Hellwig Date: Wed May 27 14:39:29 2026 +0200 xfs: factor rtgroup geom write pointer reporting into a helper Sticks out a bit better if we add a separate helper for it. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Wilfred Mallawa Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit c316bb56bf4dda9bd3456a163c3a3856ca1b9498 Author: Christoph Hellwig Date: Wed May 27 14:39:28 2026 +0200 xfs: drop the RTG reference later in xfs_ioc_rtgroup_geometry Keep the rtgroup reference until after reporting the write pointer, as that uses it. Right now this is not a major issue as we don't support shrinking file systems in a way that makes RTGs go away, but let's stick to the proper reference counting to prepare for that. Fixes: c6ce65cb17aa ("xfs: add write pointer to xfs_rtgroup_geometry") Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Wilfred Mallawa Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit c3e073894379532c00cca7ba5762e18fafe29da8 Author: Yingjie Gao Date: Wed May 27 12:31:34 2026 +0800 xfs: fix rtgroup cleanup in CoW fork repair xrep_cow_find_bad_rt() initializes scrub rtgroup state before the force-rebuild path calls xrep_cow_mark_file_range(). If that call fails, the code jumps directly to out_rtg, which skips the scrub rtgroup cleanup and only drops the local rtgroup reference. Remove the unnecessary jump so the function falls through to out_sr, ensuring the realtime cursors, lock state, and sr->rtg reference are released before returning. Fixes: fd97fe111208 ("xfs: fix CoW forks for realtime files") Cc: # v6.14 Signed-off-by: Yingjie Gao Reviewed-by: "Darrick J. Wong" Signed-off-by: Carlos Maiolino commit fcf4faba9f986b3bb528da11913c9ec5d6e8f689 Author: Yingjie Gao Date: Wed May 27 12:31:33 2026 +0800 xfs: fix error returns in CoW fork repair xrep_cow_find_bad() returns success after the cleanup labels even if AG setup, btree queries, or bitmap updates failed. This can make repair continue with an incomplete bad-file-offset bitmap instead of stopping at the original error. The force-rebuild path has a related cleanup problem. If xrep_cow_mark_file_range() fails, the function returns directly and skips the scrub AG context and perag cleanup. Let the force-rebuild path fall through to the existing cleanup code and return the saved error after cleanup. Fixes: dbbdbd008632 ("xfs: repair problems in CoW forks") Cc: # v6.8 Signed-off-by: Yingjie Gao Reviewed-by: "Darrick J. Wong" Signed-off-by: Carlos Maiolino commit 36ca6f11424a5b6d92b88df37c40bf2fe825d5a0 Author: Dai Ngo Date: Tue May 19 17:32:59 2026 -0700 xfs: fix overlapping extents returned for pNFS LAYOUTGET xfs_fs_map_blocks() currently passes XFS_BMAPI_ENTIRE to xfs_bmapi_read(), which causes the bmap code to expand the mapping to cover the entire extent rather than the requested range. A single LAYOUTGET request from the client can cause the server to issue multiple calls to xfs_fs_map_blocks() for different offsets within the same extent. Because the use of XFS_BMAPI_ENTIRE flag, these calls can produce overlapping mappings. As a result, the LAYOUTGET reply sent to the NFS client may contain overlapping extents. This creates ambiguity in extent selection for a given file range, which can lead to incorrect device selection, inconsistent handling of datastate, and ultimately data corruption or protocol violations on the client side. Problem discovered with xfstest generic/075 test using NFSv4.2 mount with SCSI layout. Fix this by replacing the XFS_BMAPI_ENTIRE flag with '0' so that xfs_bmapi_read() returns only the mapping for the requested range. Fixes: cc6c40e09d7b1 ("NFSD/blocklayout: Support multiple extents per LAYOUTGET"). Signed-off-by: Dai Ngo Reviewed-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 97bdbf2613eb89428b739ce09d1a6e1c8435a286 Author: Dai Ngo Date: Tue May 19 17:32:58 2026 -0700 xfs: fix use of uninitialized imap in xfs_fs_map_blocks error path xfs_fs_map_blocks() acquires the data map lock and then calls xfs_bmapi_read(). If xfs_bmapi_read() fails, the function currently still falls through to xfs_bmbt_to_iomap(), which consumes an uninitialized imap record and may return invalid data to the caller. Fix this by releasing the data map lock and returning immediately when xfs_bmapi_read() reports an error. This prevents xfs_bmbt_to_iomap() from being called with an uninitialized xfs_bmbt_irec. Fixes: 527851124d10f ("xfs: implement pNFS export operations") Signed-off-by: Dai Ngo Reviewed-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit bc95fa240a1b8ae64d3dabe87cbe103b912afc45 Author: Hans Holmberg Date: Mon May 18 08:52:24 2026 +0200 xfs: handle racing deletions in xfs_zone_gc_iter_irec Under heavy garbage collection pressure from RocksDB workloads, filesystem shutdowns can occur in xfs_zone_gc_iter_irec when xfs_iget() returns -EINVAL for deleted files. Fix this by handling -EINVAL just like we handle -ENOENT, allowing zone GC to safely ignore stale mappings. Fixes: 080d01c41d44 ("xfs: implement zoned garbage collection") Signed-off-by: Hans Holmberg Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 1246c246d9f684599e1dd7498043062c89fb0a36 Merge: 2765233a483feb cc57232cae23c0 Author: Linus Torvalds Date: Fri May 29 21:50:56 2026 -0700 Merge tag 'v7.1-rc6-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - security fix for FSCTL_SET_SPARSE - fix leak in ksmbd_query_inode_status() - fix OOB read in smb_check_perm_dacl() * tag 'v7.1-rc6-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE ksmbd: release ksmbd_inode ref via ksmbd_inode_put on lookup paths ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops commit 2765233a483febb1bf56f0abdcc5aa06d25633d7 Merge: f5e5d3509bffb9 7164d78559b0ff Author: Linus Torvalds Date: Fri May 29 19:08:20 2026 -0700 Merge tag 'drm-fixes-2026-05-30' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Regular pull, doesn't seem too insane or AI owned, couple of UAF fixes and another repair for an earlier fix, mostly amdgpu and i915 display with xe/i915 accel, and misc core/driver fixes. It might be a bit bigger than usual at this stage, but I'm not seeing anything too scary here. dumb-buffer: - prevent overflows in dumb-buffer creation dma-buf: - fix UAF in dma_buf_fd() tracepoint gem: - fix for the fix for the fix for the change handle ioctl i915: - Fix potential UAF in TTM object purge - Use polling when irqs are unavailable - Fix HDR pre-CSC LUT programming loop - Block DC states on vblank enable when Panel Replay supported - Use DC_OFF wake reference to block DC6 on vblank enable xe: - Restore IDLEDLY regiter on engine reset amdgpu: - GEM_OP warning fix - GEM_OP locking fix - Userq fixes - DCN 2.1 refclk fix - SI fix - HMM fixes amdkfd: - svm_range_set_attr locking fix - CRIU restore fix - KFD debugger fix amdxdna: - require IOMMU on AIE2 hyperv: - improve protocol validation ivpu: - test write offset in debugfs rocket: - fix UAF in bo creation" * tag 'drm-fixes-2026-05-30' of https://gitlab.freedesktop.org/drm/kernel: (33 commits) drm/gem: fix race between change_handle and handle_delete drm: prevent integer overflows in dumb buffer creation helpers dma-buf: fix UAF in dma_buf_fd() tracepoint drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx drm/amdgpu: fix amdgpu_hmm_range_get_pages drm/amdgpu/userq: use array instead of list for userq_vas drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj valid drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapper drm/amd/pm/si: Disregard vblank time when no displays are connected drm/amdkfd: Check for pdd drm file first in CRIU restore path drm/amdgpu: fix potential overflow in fs_info.debugfs_name drm/amdgpu/userq: make sure queue is valid in the hang_detect_work drm/amdgpu/userq: reserve root bo without interruption drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart fails drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_index drm/amdkfd: fix NULL pointer bug in svm_range_set_attr drm/amd/display: Write REFCLK to 48MHz on DCN21 drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lock drm/amdgpu/userq: Fix doorbell object cleanup of queue ... commit f5e5d3509bffb95c6648eb9795f7f236852ae62d Merge: 230ff934f744a4 79378db6a86c70 Author: Linus Torvalds Date: Fri May 29 18:07:37 2026 -0700 Merge tag 'spi-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "One substantive fix here, fixing corruption of the maximum frequency for spi-mem operations which caused users to remember what should have been a temporarily modified maximum frequency as the standard going forward, potentially causing instability when the modification raised rather than lowered the frequency. We also have a trivial patch which just documents the correct way to describe the Qualcomm IPQ5210 SNAND controller in the DT, there are no code changes" * tag 'spi-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-mem: avoid mutating op template in spi_mem_supports_op() spi: dt-bindings: spi-qpic-snand: Add ipq5210 compatible commit 230ff934f744a4c2e4b74893ccf6734f6556db90 Merge: f3be0c984ecbcb 006c66d1d52f19 Author: Linus Torvalds Date: Fri May 29 16:39:56 2026 -0700 Merge tag 'regmap-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "Some other fixing in an API user turned up the fact that we weren't correctly applying cache only mode to volatile registers in regmap_update_bits(), causing us to try to access hardware that was powered off or otherwise not in a state to accept I/O. This fix returns an error instead, avoiding more serious consequences" * tag 'regmap-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: reject volatile update_bits() in cache-only mode commit f3be0c984ecbcb82b0bec408022c4ef738cb3843 Merge: 77590cacabb3bf 78ef59e7a6459b Author: Linus Torvalds Date: Fri May 29 15:46:40 2026 -0700 Merge tag 'net-7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull more networking fixes from Jakub Kicinski: "Quick follow up, nothing super urgent here. Main reason I'm sending this out is because the IPsec and Bluetooth PRs did not make it yesterday. I don't want to have to send you all of this + whatever comes next week, for rc7. The fixes under "Previous releases - regressions" are for real user-reported regressions from v7.0. Previous releases - regressions: - Revert "ipv6: preserve insertion order for same-scope addresses" - xfrm: move policy_bydst RCU sync, a fix which added a sync RCU on netns exit got backported to stable and was causing serious accumulation of dying netns's for real workloads - pcs-mtk-lynxi: fix bpi-r3 serdes configuration Previous releases - always broken: - usual grab bag of race, locking and leak fixes for Bluetooth - handful of page handling fixes for IPsec" * tag 'net-7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (36 commits) wireguard: send: append trailer after expanding head Revert "ipv6: preserve insertion order for same-scope addresses" net: skbuff: fix pskb_carve leaking zcopy pages ipv6: fix possible infinite loop in fib6_select_path() ipv6: fix possible infinite loop in rt6_fill_node() bpf: sockmap: fix tail fragment offset in bpf_msg_push_data vsock/virtio: bind uarg before filling zerocopy skb Revert "esp: fix page frag reference leak on skb_to_sgvec failure" net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration sctp: fix race between sctp_wait_for_connect and peeloff net: mana: Skip redundant detach on already-detached port net: mana: Add NULL guards in teardown path to prevent panic on attach failure Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Bluetooth: ISO: fix UAF in iso_recv_frame Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading ... commit 77590cacabb3bffba7e2e95c359889bc44241b68 Merge: d0ee290071b475 175db11786bde9 Author: Linus Torvalds Date: Fri May 29 15:17:53 2026 -0700 Merge tag 'clang-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux Pull clang build fix from Nathan Chancellor: "A small fix to disable -Wattribute-alias for clang in the few places it is already disabled for GCC, now that tip of tree clang has implemented -Wattribute-alias as GCC has" * tag 'clang-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux: Disable -Wattribute-alias for clang-23 and newer commit 44eeff9bc467bc7d1fec34fc3f6001f385fe462c Author: Andrei Vagin Date: Tue May 26 20:50:43 2026 +0000 Revert "x86/fpu: Refine and simplify the magic number check during signal return" This reverts dc8aa31a7ac2 ("x86/fpu: Refine and simplify the magic number check during signal return"). The aforementioned commit broke applications that construct signal frames in userspace (such as CRIU and gVisor) if the frame's xstate size is smaller than the kernel's fpstate->user_size. Furthermore, this introduces a critical issue for checkpoint/restore tools like CRIU. If a process is checkpointed while inside a signal handler, its stack contains a signal frame formatted according to the source host's xstate capabilities. If that process is later restored on a destination host with larger xstate capabilities (e.g., a newer CPU with more features enabled, resulting in a larger fpstate->user_size), the kernel will look for FP_XSTATE_MAGIC2 at the destination host's larger user_size offset instead of the offset encoded in the frame's fx_sw->xstate_size. This causes the magic2 check to fail, forcing sigreturn to silently fall back to "FX-only" mode. Upon return from the signal handler, the process's extended state is reset to initial values instead of being restored, leading to silent data corruption. The aforementioned commit cited d877550eaf2d ("x86/fpu: Stop relying on userspace for info to fault in xsave buffer") as justification to stop relying on userspace for the magic number check. However, these two changes are fundamentally different. The last one only changed how much memory the kernel ensures is paged-in before running XRSTOR to prevent an infinite loop. It did not change the signal frame format or how the layout is validated. Reverting this change restores the use of fx_sw->xstate_size for locating magic2 and restores the necessary sanity checks, ensuring that the signal frame remains self-describing and portable. [ bp: Massage commit message. ] Fixes: dc8aa31a7ac2 ("x86/fpu: Refine and simplify the magic number check during signal return") Signed-off-by: Andrei Vagin Signed-off-by: Borislav Petkov (AMD) Acked-by: Chang S. Bae Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20260429000623.3356606-1-avagin@google.com commit 3f786abd23951f3f600a62fef42469d9200d5f52 Author: Hardik Prakash Date: Fri May 29 15:38:36 2026 +0530 Revert "pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11" This reverts commit 3812a9e84265a5cdd90d29fe8d97a023e91fb945. The probe ordering fix in the following patch ensures amd_gpio_probe() completes before i2c-designware probes AMDI0010:02, allowing the existing amd_gpio_irq_enable() flow to work correctly. The manual IRQ restoration added by this patch is therefore no longer needed. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221494 Signed-off-by: Hardik Prakash Reviewed-by: Mario Limonciello (AMD) Fixes: 3812a9e84265a ("pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11") Signed-off-by: Linus Walleij commit 930c88202003f6c0bab08ba064250316eead17de Merge: f5e70b3f30adbe 754d60ad1c9189 Author: Arnd Bergmann Date: Fri May 29 23:39:45 2026 +0200 Merge tag 'memory-controller-drv-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/fixes Memory controller drivers - fixes for v7.1 Fix probing of Atmel EBI memory controller driver e.g. on at91 sam9x60-curiosity board due to usage of platform_driver_probe() which is not handling deferred probe. Lack of EBI driver caused dependant NAND controller to fail to probe, basically failing entire board boot. * tag 'memory-controller-drv-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: atmel-ebi: Allow deferred probing Signed-off-by: Arnd Bergmann commit f5e70b3f30adbe2be5ced5e43d0de27e6ab84064 Merge: 04e12996daf13e 7fe40c32a33905 Author: Arnd Bergmann Date: Fri May 29 23:37:25 2026 +0200 Merge tag 'samsung-drivers-fixes-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/fixes Samsung SoC driver fixes for v7.1 Fix several concurrency issues present in Samsung ACPM firmware drivers, used currently only on Google GS101. Tudor with help of Sashiko identified several missing barriers and incomplete synchronization, leading to possible transfer data corruption or use after free. Few other issues related to probe, including missing mailbox cleanup, were also fixed. * tag 'samsung-drivers-fixes-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling firmware: samsung: acpm: Fix mailbox channel leak on probe error firmware: samsung: acpm: Fix cross-thread RX length corruption Signed-off-by: Arnd Bergmann commit 7164d78559b0ff29931a366a840a9e5dd53d4b7c Author: Zhenghang Xiao Date: Tue May 26 16:53:13 2026 +0800 drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path. Fixes: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") Signed-off-by: Zhenghang Xiao Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260526085313.26791-1-kipreyyy@gmail.com commit d0ee290071b475410476b4126c72da4bf6a2194c Merge: 9215e74f228f2b 713074d53be5c8 Author: Linus Torvalds Date: Fri May 29 13:47:55 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "arm64: - Restore CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC to its former glory by making sure the config symbol is correctly spelled out in the code - Don't reset the AArch32 view of the PMU counters to zero when the guest is writing to them - Fix an assorted collection of memory leaks in the newly added tracing code - Fix the capping of ZCR_EL2 which could be used in an unsanitised way by an L2 guest x86: - Include the kernel's linux/mman.h in KVM selftests to ensure MADV_COLLAPSE is defined, as older libc versions may not provide it. - Include execinfo.h if and only if KVM selftests are building against glibc, and provide a test_dump_stack() for non-glibc builds. - Silence an annoying RCU splat on (even non-KVM-related) panics. The splat is technically legit, but in practice not an issue. To have a race, you would need to unload the KVM modules at exactly the time a panic happens; and speaking of incredibly rare races, taking the locks risks introducing a deadlock if the module unload code took the lock on a CPU that has been halted. Which seems possibly more likely than the RCU grace period issue, so just shut it up. This code used to be in KVM but is now outside it; but the x86 maintainers haven't picked it up, so here we are. - Rate-limit global clock updates once again (but without delayed work), as KVM was subtly relying on the old rate-limiting for NPT correction to guard against "update storms" when running without a master clock on systems with overcommitted CPUs. - Fix a brown paper bag goof where KVM checked if ERAPS is "dirty" instead of marking it dirty when emulating INVPCID. - Flush the TLB when transitioning from xAVIC => x2AVIC to ensure the CPU TLB doesn't contain AVIC-tagged entries for the APIC base GPA. - The top 10 commits fix buffer overflow (and potential TOC/TOU) flaws in the page state change protocol for encrypted VMs. AI models find it quite easily given it was reported three times, but aren't as good at writing a comprehensive fix. There's more to clean up in the area, which will come in 7.2" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (22 commits) KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer KVM: SEV: Check PSC request indices against the actual size of the buffer KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 KVM: SEV: Compute the correct max length of the in-GHCB scratch area KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests KVM: SEV: Ignore Port I/O requests of length '0' KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ KVM: SEV: Ignore MMIO requests of length '0' KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor KVM: arm64: Fix memory leak in hyp_trace_unload() KVM: arm64: Fix rollback in hyp_trace_buffer_share_hyp() KVM: arm64: Fix meta-page unsharing in pKVM hyp tracing KVM: arm64: PMU: Preserve AArch32 counter low bits KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC KVM: x86: Fix ERAPS RAP clear on INVPCID single-context invalidation KVM: arm64: Fix CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC KVM: selftests: Guard execinfo.h inclusion for non-glibc builds KVM: x86: Rate-limit global clock updates on vCPU load ... commit 6e40c937893338ed0b627c08f712ce7d66ddcf84 Merge: e81d3b59f7288a 5ab62dd3687bcc Author: Dave Airlie Date: Sat May 30 06:39:58 2026 +1000 Merge tag 'drm-misc-fixes-2026-05-29' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: amdxdna: - require IOMMU on AIE2 dumb-buffer: - prevent overflows in dumb-buffer creation dma-buf: - fix UAF in dma_buf_fd() tracepoint hyperv: - improve protocol validation ivpu: - test write offset in debugfs rocket: - fix UAF in bo creation Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260529070009.GA313534@linux.fritz.box commit 78ef59e7a6459b16f8102e0ee1c718443323d1af Merge: 072aa0f5c3d8f1 f75e3eb08fe31d Author: Jakub Kicinski Date: Fri May 29 13:01:31 2026 -0700 Merge branch 'wireguard-fixes-for-7-1-rc6' Jason A. Donenfeld says: ==================== WireGuard fixes for 7.1-rc6 Please find one small patch, fixing the order of adding padding onto a packet, to ensure padding bytes get zeroed properly. ==================== Link: https://patch.msgid.link/20260529173134.3080773-1-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit f75e3eb08fe31d30a9af6ed80cdd22e6772837e2 Author: Jason A. Donenfeld Date: Fri May 29 19:31:34 2026 +0200 wireguard: send: append trailer after expanding head With how this is currently written, we add the trailer, zero it out, and then add the header space on. If that header space requires a reallocation + copy, the zeros in the trailer aren't copied, because the skb len hasn't actually been yet expanded to cover that. Instead add the padding at the end of the process rather than at the beginning. Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Cc: stable@vger.kernel.org Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20260529173134.3080773-2-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 072aa0f5c3d8f11f3159037418ec45edce7440b8 Author: Fernando Fernandez Mancera Date: Fri May 29 13:23:57 2026 +0200 Revert "ipv6: preserve insertion order for same-scope addresses" Chris Adams reported that preserving insertion order for same-scope addresses is causing SSH connections to be dropped after stopping a VM while running NetworkManager. NetworkManager caches the IPv6 address configuration, when a RA arrives, it determines the list of addresses to configure and checks if the addresses are already in the right order in the kernel. If they aren't, NetworkManager removes and re-adds them to achieve the desired order. As the order changes, NetworkManager is confused and reconfigures the addresses on every update. In addition, this would also affect to cloud tooling that relies on IPv6 addresses order to identify primary and secondaries addresses. This reverts commit cb3de96eea66f5e4a580086c6a1be46e765f97f4. Fixes: cb3de96eea66 ("ipv6: preserve insertion order for same-scope addresses") Reported-by: Chris Adams Closes: https://lore.kernel.org/netdev/20260521135310.GC977@cmadams.net/ Signed-off-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260529112357.5079-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit c84ff04def255edb51e57c9f969efdfade0da16a Merge: ff6e798c2eac3e 6851161feb01ce Author: Jakub Kicinski Date: Fri May 29 12:57:22 2026 -0700 Merge tag 'ipsec-2026-05-29' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2026-05-29 1) xfrm: route MIGRATE notifications to caller's netns Thread the caller's netns through km_migrate() so that MIGRATE notifications go to the issuing netns, fixing both the init_net listener leak and MOBIKE notifications inside non-init netns. From Maoyi Xie. 2) xfrm: ipcomp: Free destination pages on acomp errors Move the out_free_req label up so that allocated destination pages are released on decompression errors, not only on success. From Herbert Xu. 3) xfrm: Check for underflow in xfrm_state_mtu Reject configurations that cause xfrm_state_mtu() to underflow, preventing a negative TFCPAD value from becoming a memset size that triggers an out-of-bounds write of several terabytes. From David Ahern. 4) xfrm: ah: use skb_to_full_sk in async output callbacks Convert the possibly-incomplete skb->sk to a full socket pointer in async AH callbacks so that a request_sock or timewait_sock never reaches xfrm_output_resume() downstream consumers. From Michael Bommarito. 5) Add and revert: esp: fix page frag reference leak on skb_to_sgvec failure The patch does not fix te issue completely. 6) xfrm: esp: restore combined single-frag length gate Check the aligned post-trailer combined length against a page limit in the fast path, preventing skb_page_frag_refill() from falling back to a page too small for the destination scatterlist. From Jingguo Tan. 7) xfrm: iptfs: reset runtime state when cloning SAs Reinitialise the clone's mode_data runtime objects before publishing it, preventing queued skbs from being freed with list state copied from the original SA when migration fails. From Shaomin Chen. 8) xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit Flush policy tables and drain the workqueue in a .pre_exit handler so that cleanup_net() pays one RCU grace period per batch instead of one per namespace, fixing stalls at high CLONE_NEWNET rates. From Usama Arif. 9) xfrm: input: hold netns during deferred transport reinjection Take a netns reference when queueing deferred transport reinjection work and drop it after the callback completes, keeping the skb->cb net pointer valid until the deferred work runs. From Zhengchuan Liang. * tag 'ipsec-2026-05-29' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: Revert "esp: fix page frag reference leak on skb_to_sgvec failure" xfrm: input: hold netns during deferred transport reinjection xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit xfrm: iptfs: reset runtime state when cloning SAs xfrm: esp: restore combined single-frag length gate esp: fix page frag reference leak on skb_to_sgvec failure xfrm: ah: use skb_to_full_sk in async output callbacks xfrm: Check for underflow in xfrm_state_mtu xfrm: ipcomp: Free destination pages on acomp errors xfrm: route MIGRATE notifications to caller's netns ==================== Link: https://patch.msgid.link/20260529092648.3878973-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit ff6e798c2eac3ebd0501ad7e796f583fab928de8 Author: Pavel Begunkov Date: Thu May 28 19:43:53 2026 +0100 net: skbuff: fix pskb_carve leaking zcopy pages When SKBFL_MANAGED_FRAG_REFS is set, frag pages are not refcounted but their lifetime is controlled by the attached ubuf_info. To make a copy of the skb_shared_info, we either should clear the flag and reference the frags, or keep the flag and have frags unreferenced. pskb_carve_inside_header() and pskb_carve_inside_nonlinear() don't follow the rule and thus can leak page references. Let's clear SKBFL_MANAGED_FRAG_REFS from the original skb to fix it. It's the simplest way to address it, but there are more performant ways to do that if it ever becomes a problem. Link: https://lore.kernel.org/all/20260523085809.26331-1-nvminh232@clc.fitus.edu.vn/ Fixes: 753f1ca4e1e50 ("net: introduce managed frags infrastructure") Reported-by: Minh Nguyen Reported-by: Willem de Bruijn Signed-off-by: Pavel Begunkov Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/1e2086aa69217d7f9c8da3d38f5be7160f1b4cd1.1779993185.git.asml.silence@gmail.com Signed-off-by: Jakub Kicinski commit 9c7da87c2dc860bb17ca1ece942495d28b1ce3b9 Author: Jiayuan Chen Date: Wed May 27 13:31:31 2026 +0800 ipv6: fix possible infinite loop in fib6_select_path() Found while auditing the same pattern Sashiko reported in rt6_fill_node() [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()"). Writers holding tb6_lock can list_del_rcu(&first->fib6_siblings) without waiting for RCU readers; first->fib6_siblings.next then still points into the old ring and this softirq-side walker never reaches &first->fib6_siblings as its terminator. fib6_purge_rt() always WRITE_ONCE()s first->fib6_nsiblings to 0 before list_del_rcu(), so an inside-loop check is a reliable detach signal. [1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn") Signed-off-by: Jiayuan Chen Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260527053133.180695-2-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 9f72412bcf60144f252b0d6205106abf14344abc Author: Jiayuan Chen Date: Wed May 27 13:31:30 2026 +0800 ipv6: fix possible infinite loop in rt6_fill_node() Sashiko reported this issue [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()"). Writers holding tb6_lock can list_del_rcu(&rt->fib6_siblings) without waiting for RCU readers; rt->fib6_siblings.next then still points into the old ring and this softirq-side walker never reaches &rt->fib6_siblings, causing a CPU stall. fib6_del_route() always WRITE_ONCE()s rt->fib6_nsiblings to 0 before list_del_rcu(), so an inside-loop check is a reliable detach signal. [1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn") Signed-off-by: Jiayuan Chen Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260527053133.180695-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit f72eed9b84fb771019a955908132410a9ba9ea3f Author: Yuqi Xu Date: Wed May 27 11:48:15 2026 +0800 bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is page-local, but the code advances it with `start`, which is the message-global insertion point. For inserts into a non-first SG entry, this over-advances the offset and leaves the split layout inconsistent. Advance the right fragment offset by the fragment-local delta, `start - offset`, which matches the length removed from the front of the original entry. Fixes: 6fff607e2f14 ("bpf: sk_msg program helper bpf_msg_push_data") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Zhengchuan Liang Reported-by: Xin Liu Signed-off-by: Yuqi Xu Signed-off-by: Ren Wei Link: https://patch.msgid.link/8b129d10566aa3eb43f61a8f9757bcf51707d324.1779636774.git.xuyq21@lenovo.com Signed-off-by: Jakub Kicinski commit 1e584c304cfb94a759417130b1fc6d30b30c4cce Author: Jingguo Tan Date: Wed May 27 10:33:01 2026 +0800 vsock/virtio: bind uarg before filling zerocopy skb virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg before entering the send loop, but virtio_transport_alloc_skb() still fills the skb before it inherits that uarg. When fixed-buffer vectored zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach managed frags and return -EMSGSIZE. The rollback path call kfree_skb() to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so skb_release_data() falls through to ordinary frag unref. Pass the uarg into virtio_transport_alloc_skb() and bind it immediately before virtio_transport_fill_skb(). This keeps control or no-payload skbs untouched while ensuring success and rollback share one lifetime rule. Fixes: 581512a6dc93 ("vsock/virtio: MSG_ZEROCOPY flag support") Signed-off-by: Lin Ma Signed-off-by: Rongzhen Cui Signed-off-by: Jingguo Tan Acked-by: Arseniy Krasnov Acked-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20260527023301.1075581-1-malin89@huawei.com Signed-off-by: Jakub Kicinski commit 713074d53be5c8684cb31fa7a8f09ffb679338d9 Merge: 5ff17b19582309 c8cc238093ca6c Author: Paolo Bonzini Date: Fri May 29 20:25:59 2026 +0200 Merge commit 'kvm-psc-for-7.1' into HEAD commit c8cc238093ca6c99267032f6cfe78f59389f3157 Author: Sean Christopherson Date: Fri May 1 13:22:35 2026 -0700 KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READ_ONCE()/WRITE_ONCE() for cases where KVM is writing (and not consuming the result!), as the guest isn't supposed to touch the buffer while it's being processed. I.e. using READ_ONCE() is all about protecting against misbehaving guests. Fixes: 9b54e248d264 ("KVM: SEV: Add support to handle Page State Change VMGEXIT") Cc: stable@vger.kernel.org Reviewed-by: Tom Lendacky Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-11-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 121d88de56bc5c0ba0ce2f6381af67f948a7e7c1 Author: Sean Christopherson Date: Fri May 1 13:22:34 2026 -0700 KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change (PSC) requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximum size if the guest provided a pointer that isn't exactly at the start of the GHCB shared buffer. Fixes: 9b54e248d264 ("KVM: SEV: Add support to handle Page State Change VMGEXIT") Cc: stable@vger.kernel.org Reviewed-by: Tom Lendacky Reviewed-by: Michael Roth Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-10-seanjc@google.com> Signed-off-by: Paolo Bonzini commit ebe4b2dc9cfbfb2d8f665667c4d08f4c6c9bec05 Author: Sean Christopherson Date: Fri May 1 13:22:33 2026 -0700 KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() Stop explicitly passing the PSC buffer to snp_begin_psc(): it *must* be the scratch area. This will allow fixing a variety of bugs without further complicating the code. No functional change intended. Cc: stable@vger.kernel.org Reviewed-by: Tom Lendacky Reviewed-by: Michael Roth Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-9-seanjc@google.com> Signed-off-by: Paolo Bonzini commit f185e05dce6f170f83c4ba602e969b1c3c7a22e6 Author: Sean Christopherson Date: Fri May 1 13:22:32 2026 -0700 KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 Now that all paths in KVM properly validate the length needed for the scratch area, and are guaranteed to pass in a non-zero length, WARN if KVM attempts to configured the scratch area with min_len==0 to guard against future bugs. Cc: stable@vger.kernel.org Reviewed-by: Tom Lendacky Reviewed-by: Michael Roth Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-8-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 5867d7e202e09f037cefe77f7af4413c7c0fa088 Author: Sean Christopherson Date: Fri May 1 13:22:31 2026 -0700 KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible size given the start of the guest-provided pointer, and the end of the shared buffer. The code was "fine" when first introduced, as KVM doesn't consult the length of the buffer when emulating MMIO, because the passed in @len always specifies the *max* size required. But for PSC requests, the incoming @len is just the minimum length (to process the header), and KVM needs to know the full size of the scratch area to avoid buffer overflows (spoiler alert). Opportunistically rename @len => @min_len to better reflect its role. Fixes: 9b54e248d264 ("KVM: SEV: Add support to handle Page State Change VMGEXIT") Cc: stable@vger.kernel.org Reviewed-by: Tom Lendacky Reviewed-by: Michael Roth Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-7-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 2be54670bdc017004c4a4b8bddb6ff02ebe7dbe2 Author: Sean Christopherson Date: Fri May 1 13:22:30 2026 -0700 KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests When handling a Page State Change (PSC) #VMGEXIT use the size of the PSC header as the minimum size for the scratch area. Per the GHCB spec, PSC requests do NOT provide the length, i.e. using control->exit_info_2 for the length is completely made up behavior. The existing code "works", e.g. even though Linux-as-a-guest always passes '0', because KVM doesn't do anything with the length when the request is in the GHCB's shared buffer. Use the header as the min length. Once the header is retrieved, KVM can use the specified indices to compute the full size of the request. Fixes: 9b54e248d264 ("KVM: SEV: Add support to handle Page State Change VMGEXIT") Cc: stable@vger.kernel.org Reviewed-by: Tom Lendacky Reviewed-by: Michael Roth Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-6-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 3988bd2723de407ae90fa7a6f6029b4e60238c58 Author: Sean Christopherson Date: Fri May 1 13:22:29 2026 -0700 KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0. Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT") Cc: stable@vger.kernel.org Reviewed-by: Tom Lendacky Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit dcf1b2d4b0564a27e4ca7c654871aab4f9620046 Author: Sean Christopherson Date: Fri May 1 13:22:28 2026 -0700 KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ When using GHCB v2+, reject MMIO requests that are larger than 8 bytes. Per the GHCB spec: SW_EXITINFO2 must be less than or equal to 0x7fffffff for version 1 and less than or equal to 0x8 for all other versions. Fixes: 4af663c2f64a ("KVM: SEV: Allow per-guest configuration of GHCB protocol version") Cc: stable@vger.kernel.org Reviewed-by: Tom Lendacky Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 1aa8a6dc7dac8b83234b53518311bf78231f4fa5 Author: Sean Christopherson Date: Fri May 1 13:22:27 2026 -0700 KVM: SEV: Ignore MMIO requests of length '0' Explicitly ignore MMIO requests of length '0', so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for special casing '0' in the future. Fixes: 8f423a80d299 ("KVM: SVM: Support MMIO for an SEV-ES guest") Cc: stable@vger.kernel.org Reviewed-by: Tom Lendacky Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7 Author: Michael Roth Date: Fri May 1 13:22:26 2026 -0700 KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v2+ require the software scratch area to reside in the GHCB's shared buffer. Note, things like Page State Change (PSC) requests _rely_ on this behavior, as the guest can't provide a length when making the request, i.e. the size of the guest payload is bounded by the size of the shared buffer. Failure to force usage of the GHCB, and a slew of other flaws, lets a malicious SNP guest corrupt host kernel heap memory, and leak host heap layout information. setup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2), where exit_info_2 is guest-controlled. With exit_info_2=24, this yields a 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer holds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only entries[0] and entries[1] are in-bounds. snp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253) but NOT against the actual buffer size: idx_end = hdr->end_entry; if (idx_end >= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer snp_complete_psc(svm, ...); return 1; } for (idx = idx_start; idx <= idx_end; idx++) { entry_start = entries[idx]; // OOB when idx >= 2 The guest sets end_entry=10+, causing the host to iterate entries[2+] which are OOB into adjacent slab objects. For each OOB entry: - The host reads 8 bytes (OOB READ / info leak oracle) - If the data passes PSC validation, __snp_complete_one_psc() writes cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806) - If validation fails, the error response reveals whether adjacent memory is zero vs non-zero (information disclosure to guest) The guest controls allocation size (exit_info_2), entry range (cur_entry/end_entry), and can fire unlimited VMGEXITs to repeatedly hit different slab positions. By exploiting the variety of bugs, a malicious SEV-SNP guest can: - OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure) - OOB write cur_page bits into adjacent objects (heap corruption) - Trigger use-after-free conditions across VMGEXITs E.g. with KASAN enabled, a single insmod of the PoC guest module produces 73 KASAN reports: BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890 Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199 BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890 Write of size 8 at addr ffff888351566648 by task qemu-system-x86/2199 The buggy address belongs to the object at ffff888XXXXXXXXX which belongs to the cache kmalloc-cg-32 of size 32 The buggy address is located N bytes to the right of allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX) Breakdown: 62 slab-out-of-bounds (reads + writes past allocation) 7 slab-use-after-free 4 use-after-free All credit to Stan for the wonderful description and reproducer! Reported-by: Stan Shaw Cc: Michael Roth Cc: Tom Lendacky Cc: Peter Gonda Cc: Jacky Li Fixes: 4af663c2f64a ("KVM: SEV: Allow per-guest configuration of GHCB protocol version") Cc: stable@vger.kernel.org Signed-off-by: Michael Roth [sean: write changelog] Reviewed-by: Tom Lendacky Signed-off-by: Sean Christopherson Message-ID: <20260501202250.2115252-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 9215e74f228f2b239f41271da9e5076ee3439d1b Merge: 80169db922c1bf b051bb6bf0a231 Author: Linus Torvalds Date: Fri May 29 10:41:07 2026 -0700 Merge tag 'block-7.1-20260529' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fix from Jens Axboe: "Just a single fix for the block side, making a slight tweak to a fix from this cycle" * tag 'block-7.1-20260529' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: blk-mq: reinsert cached request to the list commit 80169db922c1bfb2947e901514e33165a64787c2 Merge: 3101173200b8ef a88c02915d9c61 Author: Linus Torvalds Date: Fri May 29 10:36:57 2026 -0700 Merge tag 'io_uring-7.1-20260529' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Just a single fix for a regression introduced in this cycle, where we should ensure the node is visible before the entry is added to the tctx list" * tag 'io_uring-7.1-20260529' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/tctx: set ->io_uring before publishing the tctx node commit 5ff17b19582309110269d76ce604453d2c401123 Merge: b3978970165729 83726330748981 Author: Paolo Bonzini Date: Fri May 29 19:30:56 2026 +0200 Merge tag 'kvmarm-fixes-7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.1, take #4 - Restore CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC to its former glory by making sure the config symbol is correctly spelled out in the code - Don't reset the AArch32 view of the PMU counters to zero when the guest is writing to them - Fix an assorted collection of memory leaks in the newly added tracing code - Fix the capping of ZCR_EL2 which could be used in an unsanitised way by an L2 guest commit b3978970165729eea7a80d10d52f17cc495672cd Merge: e7ae89a0c97ce2 a9e18aa3263f35 Author: Paolo Bonzini Date: Fri May 29 19:28:16 2026 +0200 Merge tag 'kvm-x86-fixes-7.1-rc6' of https://github.com/kvm-x86/linux into HEAD KVM x86 fixes for 7.1-rcN - Include the kernel's linux/mman.h in KVM selftests to ensure MADV_COLLAPSE is defined, as older libc versions may not provide it. - Include execinfo.h if and only if KVM selftests are building against glibc, and provide a test_dump_stack() for non-glibc builds. - Fudge around an RCU splat in the emegerncy reboot code that is technically a legitimate flaw, but in practice is a non-issue and fixing the flaw, e.g. by adding locking, would incur meaningful risk, i.e. do more harm than good. - Rate-limit global clock updates once again (but without delayed work), as KVM was subtly relying on the old rate-limiting for NPT correction to guard against "update storms" when running without a master clock on systems with overcommitted CPUs. - Fix a brown paper bag goof where KVM checked if ERAPS is "dirty" instead of marking it dirty when emulating INVPCID. - Flush the TLB when transitioning from xAVIC => x2AVIC to ensure the CPU TLB doesn't contain AVIC-tagged entries for the APIC base GPA. commit 3101173200b8ef6b725d7ab289e9508659b20d61 Merge: b0ab604210059c d90f236f8b9e35 Author: Linus Torvalds Date: Fri May 29 10:04:09 2026 -0700 Merge tag 'cxl-fixes-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull Compute Express Link (CXL) fixes from Dave Jiang: - cxl/test: update mock dev array before calling platform_device_add() * tag 'cxl-fixes-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/test: Update mock dev array before calling platform_device_add() commit b0ab604210059c3626c9c77142b51f39e9842504 Merge: 7b554459602135 00c257948900fa Author: Linus Torvalds Date: Fri May 29 09:25:58 2026 -0700 Merge tag 'iommu-fixes-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - Fix compile warning with gcc-16.1 - Intel VT-d: Simplify calculate_psi_aligned_address() - MAINTAINERS updates * tag 'iommu-fixes-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: MAINTAINERS: Add my employer to my entries MAINTAINERS: Add Vasant Hegde to reviewers of AMD IOMMU iommu, debugobjects: avoid gcc-16.1 section mismatch warnings iommu/vt-d: Simplify calculate_psi_aligned_address() commit 7b5544596021351f22ac01d5586c71cbeebb52e2 Merge: e6f4f084ecd876 2c142b63c8ee98 Author: Linus Torvalds Date: Fri May 29 08:55:41 2026 -0700 Merge tag 'sound-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of recent small fixes and quirks. We still see a bit more changes than wished, but most of them are device-specific ones that are pretty safe to apply, while a core fix is a typical UAF fix for PCM core that was recently caught by fuzzer; so overall nothing looks really worrisome. Core: - Fix a UAF in PCM OSS proc interface HD-audio: - Fix memory leaks in CS35L56 driver - Various device-specific quirks for Realtek and CS420x codecs USB-audio: - Quirk for TAE1160 USB Audio - Fix for Scarlett2 Gen4 direct monitor gain ASoC: - Fixes for QCom q6asm-dai, Intel bytcht_es8316, and simple-mux codec FireWire: - Fix for Motu DSP event queue protection" * tag 'sound-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: codecs: simple-mux: Fix enum control bounds check ALSA: usb-audio: Add iface reset and delay quirk for TAE1160 USB Audio ALSA: hda/cs420x: Add CS4208 fixup for iMac16,1 ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1 ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP ASoC: qcom: q6asm-dai: use pointer type with kzalloc_obj() ASoC: qcom: q6asm-dai: remove unnecessary braces ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params ASoC: qcom: q6asm-dai: close stream only when running ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors ALSA: hda/realtek: Limit mic boost on Positivo DN140 ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 ALSA: pcm: oss: Fix setup list UAF on proc write error ALSA: hda: cs35l56: Fix system name string leaks ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Lenovo Yoga Slim 7 14AGP11 ALSA: hda/realtek: Fix incorrect comment for ALC299_FIXUP_PREDATOR_SPK ALSA: firewire-motu: Protect register DSP event queue positions commit e6f4f084ecd876a333c4cf13d0229217dbfcd8e8 Merge: 8fde5d1d47f69d c0a8899e02ddeb Author: Linus Torvalds Date: Fri May 29 08:51:46 2026 -0700 Merge tag 'hid-for-linus-2026052801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - buffer overflow fix for lenovo (Kean) and wacom (Lee Jones) drivers - segfaults prevention in lenovo-go driver when used with an emulated device (Louis Clinckx) - cleanup of resources in u2fzero (Myeonghun Pak) - a quirk for a USB mouse and a cleanup in hid.h (hlleng and Liu Kai) * tag 'hid-for-linus-2026052801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: wacom: Fix OOB write in wacom_hid_set_device_mode() HID: lenovo-go: drop dead NULL check on to_usb_interface() HID: lenovo-go: reject non-USB transports in probe HID: lenovo: Fix buffer over-read and unaligned access in X12 Tab raw_event handler HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse HID: remove duplicate hid_warn_ratelimited definition HID: u2fzero: free allocated URB on probe errors commit f595e8e77a51eee35e331f69321766593a845ef2 Author: Jisheng Zhang Date: Sun May 24 10:34:55 2026 +0800 mmc: sdhci: add signal voltage switch in sdhci_resume_host I met one suspend/resume issue with sdr104 capable sdio wifi card (with "keep-power-in-suspend" set in DT property): After resuming from suspend to ram, the sdio wifi card stops working. Further debug shows that although ios shows the sdio card is at sdr104 mode, the voltage is still at 3V3. This is due to missing the calling of ->start_signal_voltage_switch() in sdhci_resume_host(). Fix this issue by adding ->start_signal_voltage_switch() in sdhci_resume_host(). This also matches what we do for sdhci_runtime_resume_host(). Then the question is: why this issue hasn't reported and fixed for so long time. IMHO, several reasons: Some host controllers just kick off the runtime resume for system resume, so they benefit from the well supported runtime pm code; Some platforms just use the old sdio wifi card which doesn't need signal voltage switch at all, the default voltage is 3v3 after resuming. Fixes: 6308d2905bd3 ("mmc: sdhci: add quirk for keeping card power during suspend") Signed-off-by: Jisheng Zhang Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 1e9a4850afa0ceb63984fb1a9f3e86d0fc4fd18f Author: Heiko Stuebner Date: Fri May 22 20:43:07 2026 +0200 mmc: dw_mmc-rockchip: Add missing private data for very old controllers The really old controllers (rk2928, rk3066, rk3188) do not support UHS speeds at all, and thus never handled phase data. For that reason it never had a parse_dt callback and no driver private data at all. Commit ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating support") makes the private data sort of mandatory, because the init function checks whether phases are configured internally or through the clock controller. This results in the old SoCs then experiencing NULL-pointer dereferences when they try to access that private-data struct. While we could have if (priv) conditionals in all places, it's way less cluttery to just give the old types their private-data struct. Fixes: ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating support") Cc: stable@vger.kernel.org Signed-off-by: Heiko Stuebner Acked-by: Shawn Lin Signed-off-by: Ulf Hansson commit 99982b743e5ba72bd1f5de0e03e3b96ae70b1e51 Author: Inochi Amaoto Date: Thu May 21 15:21:21 2026 +0800 mmc: litex_mmc: Set mandatory idle clocks before CMD0 The litex_mmc driver assumes the card is already probed in the BIOS and skip the phy initialization. This will cause the command fail like the following when the old card is unplugged and then insert a new card: [ 62.923593] litex-mmc f0004000.mmc: Command (cmd 8) error, status -110 [ 62.949717] litex-mmc f0004000.mmc: Command (cmd 55) error, status -110 [ 62.976606] litex-mmc f0004000.mmc: Command (cmd 55) error, status -110 [ 63.002516] litex-mmc f0004000.mmc: Command (cmd 55) error, status -110 [ 63.028442] litex-mmc f0004000.mmc: Command (cmd 55) error, status -110 Add required clock settings and initialization for the CMD 0, so it can probe the new card. Fixes: 92e099104729 ("mmc: Add driver for LiteX's LiteSDCard interface") Signed-off-by: Inochi Amaoto Reviewed-by: Gabriel Somlo Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit b837e38c255dd9f8b53511d52e87f1fda32b3dfe Author: Inochi Amaoto Date: Thu May 21 15:21:20 2026 +0800 mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation The previous clock uses roundup_pow_of_two() to calculate the core clock frequency. It does not meet the actual hardware meaning. The actual frequency is calculated by "ref_clk / ((div >> 1) << 1)". Fix the clock divider calculation. Fixes: 92e099104729 ("mmc: Add driver for LiteX's LiteSDCard interface") Signed-off-by: Inochi Amaoto Reviewed-by: Gabriel Somlo Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit f48ee49726ee4ab545fd2dc644f169c0809b19b3 Author: Lad Prabhakar Date: Tue May 19 14:53:40 2026 +0100 mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC The RZ/G2H (R8A774E1) SoC was previously handled via the generic "renesas,rcar-gen3-sdhi" fallback compatible string. However, because the SDHI IP on RZ/G2H is identical with the R-Car H3-N (R8A77951), it requires the specific quirks and configuration defined in `of_r8a7795_compatible` rather than the generic Gen3 data. Add the explicit "renesas,sdhi-r8a774e1" match entry to map it correctly. Note that the DT binding file renesas,sdhi.yaml does not need an update as the entry for this SoC is already present. Fixes: 31941342888d ("arm64: dts: renesas: r8a774e1: Add SDHI nodes") Cc: stable@vger.kernel.org Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Signed-off-by: Ulf Hansson commit 8d4ae34e997062076a9098602eaca43353665bd9 Author: Huan He Date: Sat May 9 16:49:07 2026 +0800 mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin EIC7700 The EIC7700 code in sdhci-of-dwcmshc uses host->mmc->caps2 to select different configuration paths for different card types. The current logic distinguishes eMMC and SD, but does not handle SDIO separately. Update the EIC7700 card-type checks so that eMMC, SD and SDIO are distinguished explicitly. Switch the reset path to dwcmshc_reset() so that pending interrupt state is cleared consistently, and use sdhci_enable_clk() so the clock enable sequence follows the standard SDHCI flow. Fixes: 32b2633219d3 ("mmc: sdhci-of-dwcmshc: Add support for Eswin EIC7700") Signed-off-by: Huan He Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 7fe40c32a33905302341797b5d12c541729dd08d Author: Tudor Ambarus Date: Tue May 5 13:13:04 2026 +0000 firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion Sashiko identified a possible infinite loop [1]. ACPM IPC sequence numbers are tracked via a 64-bit bitmap. Previously, acpm_prepare_xfer() used a do...while loop to search for a free sequence number. If all 63 available sequence numbers are leaked due to transient hardware timeouts or mailbox failures, the bitmap becomes full. The next call to acpm_prepare_xfer() would enter an infinite loop. Fix this by utilizing the kernel's optimized bitmap search functions (find_next_zero_bit / find_first_zero_bit). If the pool is completely exhausted, log the failure and return -EBUSY to allow the kernel to fail gracefully instead of hanging. Furthermore, drop the allocation loop entirely. Because acpm_prepare_xfer() is strictly called under the 'tx_lock' mutex, sequence number allocations are perfectly serialized. If find_next_zero_bit() locates a free bit, a single test_and_set_bit_lock() is mathematically guaranteed to succeed. To enforce this locking invariant, wrap the allocation in a WARN_ON_ONCE. If the atomic set fails, it indicates the driver's mutex serialization is fundamentally broken. The warning generates a stack trace for debugging, while returning -EIO immediately aborts the transfer to prevent silent payload corruption. Cc: stable@vger.kernel.org Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org [1] Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-7-43b5ee7f1674@linaro.org Signed-off-by: Krzysztof Kozlowski commit bf296f83a3ddab1ab875edc4e8862cb10553064f Author: Tudor Ambarus Date: Tue May 5 13:13:03 2026 +0000 firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator Sashiko identified memory ordering races in [1]. The ACPM driver uses a globally shared 'bitmap_seqnum' to track available sequence numbers. Even though threads now strictly free their own sequence numbers, the allocation and freeing of these bits across concurrent threads are effectively lockless operations and require explicit LKMM memory barriers. Previously, the driver used plain bitwise operators (test_bit, set_bit, clear_bit), which lack ordering guarantees. This creates two race conditions on weakly ordered architectures like ARM64: 1. Polling Release Violation: The polling thread copies its payload and calls clear_bit(). Without a release barrier, the CPU can reorder the memory operations, making the cleared bit globally visible before the payload reads have fully completed. 2. TX Acquire Violation: The TX thread loops on test_bit(), calls set_bit(), and then wipes the payload buffer via memset(). Without an acquire barrier, the CPU can speculatively execute the memset() before the bit is safely and formally claimed. If these reorderings overlap, a new TX thread can claim the sequence number and overwrite the buffer while the original polling thread is still actively reading from it. Fix this by upgrading the bitwise operators. Wrap the TX allocation in test_and_set_bit_lock() to establish formal LKMM Acquire semantics, and pair it with clear_bit_unlock() in the polling path to enforce Release semantics. Cc: stable@vger.kernel.org Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Closes: https://sashiko.dev/#/patchset/20260423-acpm-fixes-sashiko-reports-v1-0-2217b790925e%40linaro.org [1] Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-6-43b5ee7f1674@linaro.org Signed-off-by: Krzysztof Kozlowski commit c889b146478885344a220dd468e5a08de088cbc5 Author: Tudor Ambarus Date: Tue May 5 13:13:02 2026 +0000 firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling Sashiko identified severe races in the polling state machine [1]. In the ACPM driver's polling mode, threads waited for responses by monitoring the globally shared 'bitmap_seqnum'. This caused false timeouts because if a thread processed its response and freed the sequence number, a concurrent TX thread could immediately reallocate it before the polling thread woke up. Additionally, the driver suffered from a cross-thread Use-After-Free (UAF) preemption race. Previously, acpm_get_rx() cleared the sequence number of whichever RX message it drained from the hardware queue. This meant Thread A could globally free Thread B's sequence slot while Thread B was asleep. A new Thread C could then steal the slot, overwrite the buffer, and leave Thread B to wake up to corrupted state or a timeout. Fix this by rewriting the polling state machine: 1. Decouple polling from the global allocator by introducing a per-slot 'completed' flag, synchronized via smp_store_release() and smp_load_acquire(). 2. Strip acpm_get_saved_rx() out of acpm_get_rx() to make it a pure queue-draining function. Introduce a 'native_match' boolean argument which evaluates to true only if the thread natively processed its own sequence number during the call. This explicitly informs the polling loop whether it must retrieve its payload from the cross-thread cache. 3. Centralize the cache fallback and sequence number free (clear_bit) inside the polling loop. Crucially, the free operation now strictly targets the thread's own TX sequence number (xfer->txd[0]), rather than the drained RX sequence number. This enforces strict ownership: a thread only ever frees its own allocated sequence slot, and only at the exact moment it completes its poll, eliminating the UAF window. Furthermore, explicitly guard the 'native_match' assignment with an if (rx_seqnum == tx_seqnum) check, even for zero-length (no payload) responses. While an unguarded assignment wouldn't crash (because the cache fallback acpm_get_saved_rx() safely returns early on zero-length transfers) doing so would "lie" to the state machine. If a thread drained the queue and found another thread's zero-length message, setting native_match = true would falsely convince the polling loop that it natively handled its own response. Maintaining a rigorous state machine requires that native_match is only set when a thread explicitly processes its own sequence number. Cc: stable@vger.kernel.org Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Closes: https://sashiko.dev/#/patchset/20260429-acpm-fixes-sashiko-reports-v3-0-47cf74ab09ad%40linaro.org [1] Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-5-43b5ee7f1674@linaro.org Signed-off-by: Krzysztof Kozlowski commit f78073e84c800ae146ce62447e7a685a5ceeb92d Author: Laurent Pinchart Date: Thu May 7 00:56:50 2026 +0300 Revert "media: renesas: vsp1: brx: Fix format propagation" This reverts commit 937f3e6b51f1cea079be9ba642665f2bf8bcc31f. The change to format propagation in the BRx broke configuration of the DRM pipeline. Revert it to fix the regression. The original commit was meant to fix a v4l2-compliance failure, with no known userspace applications being affected beside test tools. Reverting is the simplest option, a more comprehensive fix can be developed (and tested more thoroughly) later. Reported-by: Lad Prabhakar Closes: https://lore.kernel.org/linux-media/CA+V-a8t481xuwava0nb7uY9CUPqFWZ_8EP0xrK3BgumP7HDcLg@mail.gmail.com Fixes: 937f3e6b51f1 ("media: renesas: vsp1: brx: Fix format propagation") Tested-by: Lad Prabhakar # On RZ/T2H Reviewed-by: Lad Prabhakar Link: https://patch.msgid.link/20260506215650.1897177-3-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit a0d8f7ac03e387634c5a7efe3dc162f7d605e2cd Author: Laurent Pinchart Date: Thu May 7 00:56:49 2026 +0300 Revert "media: renesas: vsp1: Initialize format on all pads" This reverts commit 133ac42af0a1b389e8b7b3dc7c1cc8c30ff162b6. The change to format initialization, along with the change to format propagation in the BRx in commit 937f3e6b51f1 ("media: renesas: vsp1: brx: Fix format propagation"), broke configuration of the DRM pipeline. Revert it to fix the regression. The original commit was meant to fix a v4l2-compliance failure, with no known userspace applications being affected beside test tools. Reverting is the simplest option, a more comprehensive fix can be developed (and tested more thoroughly) later. Fixes: 133ac42af0a1 ("media: renesas: vsp1: Initialize format on all pads") Tested-by: Lad Prabhakar # On RZ/T2H Reviewed-by: Lad Prabhakar Link: https://patch.msgid.link/20260506215650.1897177-2-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 83726330748981372bde86ed5411d7b306612991 Author: Mark Brown Date: Fri May 29 00:01:44 2026 +0100 KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor ZCR_EL2 can be updated by a VHE guest hypervisor either using ZCR_EL2 (which traps) or ZCR_EL1 (which does not trap). KVM handles both in different way: - on ZCR_EL2 trap, ZCR_EL2.LEN is immediately capped at the VM's own VL limit. This has the potential to break existing SW that relies on the full LEN field to be stateful. - on ZCR_EL1 access, we do absolutely nothing. On restoring the SVE context for an L2 guest, we directly restore the guest hypervisor's view of ZCR_EL2 into the physical ZCR_EL2. If the guest's view of the register was updated using the ZCR_EL2 accessor, the value has already been sanitised (with the caveat mentioned above). But if the guest used ZCR_EL1, the raw value is written into the HW, and the L2 guest can now access VLs that it shouldn't. Fix all the above by moving the VL capping to the restore points, ensuring that: - the HW is always programmed with a capped value, irrespective of the accessor being used, - the ZCR_EL2.LEN field is always completely stateful, irrespective of the accessor being used. Additionally, move ZCR_EL2 to be a sanitised register, ensuring that only the LEN field is actually stateful. This requires some creative construction of the RES0 mask, as the sysreg generation script does not yet generate RAZ/WI fields. Fixes: b3d29a823099 ("KVM: arm64: nv: Handle ZCR_EL2 traps") Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260529-kvm-arm64-fix-zcr-len-nv-v2-1-86cad51992bd@kernel.org [maz: rewrote commit message, tidy up access_zcr_el2()] Signed-off-by: Marc Zyngier commit 6851161feb01cea41358c9ec304bd2f981fc8505 Author: Steffen Klassert Date: Fri May 29 10:23:25 2026 +0200 Revert "esp: fix page frag reference leak on skb_to_sgvec failure" This reverts commit 2982e599fff6faa21c8df147d96fc7af6c1a2f24. The patch does not fully fix the issue and the Author does not match the 'Signed-off-by:' tag, so revert it for now. Signed-off-by: Steffen Klassert commit 5ab62dd3687bcc2cc542b99385aabac5c996db6f Author: Rajat Gupta Date: Wed May 20 22:11:21 2026 -0700 drm: prevent integer overflows in dumb buffer creation helpers Fix integer overflow issues in the dumb buffer creation path: 1. drm_mode_create_dumb() does not bound width, height, or bpp before passing them to driver callbacks. Downstream helpers (e.g. drm_gem_dma_dumb_create_internal) perform pitch/size alignment in u32 arithmetic that can overflow for extreme values. Add hard limits: width and height < 8192, bpp <= 32. No legitimate software rendering use case exceeds these. 2. drm_mode_align_dumb() uses roundup(pitch, hw_pitch_align) without checking for overflow. If pitch is near U32_MAX, roundup() wraps to a small value, making subsequent check_mul_overflow() pass with a much smaller pitch than intended. Add an overflow check after roundup. 3. drm_mode_align_dumb() uses ALIGN(size, hw_size_align) which only works correctly for power-of-two alignment values. Replace with roundup() which works for any alignment. Suggested-by: Thomas Zimmermann Signed-off-by: Rajat Gupta Signed-off-by: Thomas Zimmermann commit ecf3edd349dfabee9bc8a46c5ff91c9ebd858d48 Author: Arnd Bergmann Date: Wed May 20 09:38:44 2026 +0200 crypto: s390 - add select CRYPTO_AEAD for aes The aes driver registers both skcipher and aead algorithms, but when aead is not enabled this causes a link failure: s390-linux-ld: arch/s390/crypto/aes_s390.o: in function `aes_s390_fini': arch/s390/crypto/aes_s390.c:969:(.text+0x115e): undefined reference to `crypto_unregister_aead' s390-linux-ld: arch/s390/crypto/aes_s390.o: in function `aes_s390_init': arch/s390/crypto/aes_s390.c:1028:(.init.text+0x294): undefined reference to `crypto_register_aead' Add the missing 'select' statement. Fixes: bf7fa038707c ("s390/crypto: add s390 platform specific aes gcm support.") Signed-off-by: Arnd Bergmann Reviewed-by: Harald Freudenberger Signed-off-by: Herbert Xu commit 1aee05e814d292064bf5fa15733741040cdc48ba Author: Gao Xiang Date: Fri May 22 16:27:16 2026 +0800 erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi->sync_decompress. When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all folios are unlocked, unmount workflow can proceed and sbi will be freed before accessing to sbi->sync_decompress. Thread (unmount) I/O completion kworker queue_work z_erofs_decompressqueue_work (all folios are unlocked) cleanup_mnt .. erofs_kill_sb erofs_sb_free kfree(sbi) access sbi->sync_decompress // UAF!! Fixes: 40452ffca3c1 ("erofs: add sysfs node to control sync decompression strategy") Reported-by: syzbot+52bae5c495dbe261a0bc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=52bae5c495dbe261a0bc Reviewed-by: Chao Yu Reviewed-by: Jianan Huang Signed-off-by: Gao Xiang commit 00739e4dd46dde2b39dd9dd19a27e3c8af4ca0d0 Author: Muchun Song Date: Sat May 23 14:01:23 2026 +0800 mm/cma: fix reserved page leak on activation failure If cma_activate_area() fails after allocating only part of the range bitmaps, the cleanup path still has to release the reserved pages when CMA_RESERVE_PAGES_ON_ERROR is clear. That is still worth doing even in this __init path. A bitmap_zalloc() failure does not necessarily mean the system cannot make further progress: freeing the reserved CMA pages can return a substantial amount of memory to the buddy allocator and may relieve the temporary memory shortage that caused the allocation failure in the first place. However, the cleanup path currently uses the bitmap-freeing bound for page release as well. That is only correct for ranges whose bitmap allocation already succeeded. The failed range and all later ranges still keep their reserved pages, so a partial bitmap allocation failure can permanently leak them. Fix this by releasing reserved pages for all ranges. Use the saved early_pfn[] value for ranges whose bitmap allocation already succeeded and for the failed range, and use cmr->early_pfn for later ranges whose bitmap allocation was never attempted. Link: https://lore.kernel.org/20260523060123.2207992-1-songmuchun@bytedance.com Fixes: c009da4258f9 ("mm, cma: support multiple contiguous ranges, if requested") Signed-off-by: Muchun Song Reviewed-by: Oscar Salvador (SUSE) Acked-by: Usama Arif Cc: David Hildenbrand Cc: Frank van der Linden Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 3c2d42b8ee345b17a4ba56b0f6492d1ff4c1178e Author: Wupeng Ma Date: Fri May 22 09:03:05 2026 +0800 mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page can trigger a recursive spinlock self-deadlock (AA deadlock) on hugetlb_lock when racing with a concurrent unmap: thread#0 thread#1 -------- -------- madvise(folio, MADV_HWPOISON) -> poisons the folio successfully madvise(folio, MADV_HWPOISON) unmap(folio) try_memory_failure_hugetlb get_huge_page_for_hwpoison spin_lock_irq(&hugetlb_lock) <- held __get_huge_page_for_hwpoison hugetlb_update_hwpoison() -> MF_HUGETLB_FOLIO_PRE_POISONED goto out: folio_put() refcount: 1 -> 0 free_huge_folio() spin_lock_irqsave(&hugetlb_lock) -> AA DEADLOCK! The out: path in __get_huge_page_for_hwpoison() calls folio_put() to drop the GUP reference while the hugetlb_lock is still held by the hugetlb.c wrapper get_huge_page_for_hwpoison(). If concurrent unmap has released the page table mapping reference, folio_put() drops the folio refcount to zero, triggering free_huge_folio() which attempts to re-acquire the non-recursive hugetlb_lock. Fix this by moving hugetlb_lock acquisition from the hugetlb.c wrapper into get_huge_page_for_hwpoison(). Place spin_unlock_irq() before the folio_put() at the out: label so the folio is always released outside the lock. [akpm@linux-foundation.org: fix race, rename label per Miaohe] Link: https://sashiko.dev/#/patchset/20260522010305.4099834-1-mawupeng1@huawei.com Link: https://lore.kernel.org/f39f405e-4b4b-8f79-70fe-a2b5b62114eb@huawei.com Link: https://lore.kernel.org/20260522010305.4099834-1-mawupeng1@huawei.com Fixes: 405ce051236c ("mm/hwpoison: fix race between hugetlb free/demotion and memory_failure_hugetlb()") Signed-off-by: Wupeng Ma Acked-by: Oscar Salvador (SUSE) Acked-by: Muchun Song Reviewed-by: Kefeng Wang Acked-by: Miaohe Lin Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 40c81856e622a9dc59294a90d169ac07ea25b0b0 Author: David Carlier Date: Wed May 20 05:49:12 2026 +0100 mm/hugetlb: restore reservation on error in hugetlb folio copy paths Two sites in mm/hugetlb.c allocate a hugetlb folio via alloc_hugetlb_folio() (consuming a VMA reservation) and then call copy_user_large_folio(), which became int-returning in commit 1cb9dc4b475c ("mm: hwpoison: support recovery from HugePage copy-on-write faults") and can now fail (e.g. -EHWPOISON on a hwpoisoned source page). On the failure path, folio_put() restores the global hugetlb pool count through free_huge_folio(), but the per-VMA reservation map entry is left marked consumed: - hugetlb_mfill_atomic_pte() resubmission path (UFFDIO_COPY) - copy_hugetlb_page_range() fork-time CoW path when hugetlb_try_dup_anon_rmap() fails (rare: pinned hugetlb anon folio under fork) User-visible effect: on UFFDIO_COPY into a private hugetlb VMA where the resubmission copy fails, the reservation for that address is leaked from the VMA's reserve map. A subsequent fault at the same address takes the no-reservation path, and under hugetlb pool pressure the task is SIGBUSed at an address it had previously reserved. The fork-time CoW path leaks the same way in the child VMA's reserve map, though it requires the much rarer combination of pinned hugetlb anon page + hwpoisoned source. Add the missing restore_reserve_on_error() call before folio_put() on both error paths. Link: https://lore.kernel.org/20260520044912.6751-1-devnexen@gmail.com Fixes: 1cb9dc4b475c ("mm: hwpoison: support recovery from HugePage copy-on-write faults") Signed-off-by: David Carlier Reviewed-by: Muchun Song Cc: David Hildenbrand Cc: Mina Almasry Cc: Muchun Song Cc: Oscar Salvador Cc: yuehaibing Cc: Signed-off-by: Andrew Morton commit c0ca59beb5252ea2bd4fdaef009d003dedc2030e Author: Muchun Song Date: Wed May 20 14:10:25 2026 +0800 mm/cma_debug: fix invalid accesses for inactive CMA areas cma_activate_area() can fail after allocating range bitmaps. Its cleanup path frees those bitmaps, but only clears cma->count and cma->available_count. It leaves cma->nranges and each range's count in place, so cma_debugfs_init() can still register debugfs files for an area that never activated successfully. That exposes two problems. Reading the bitmap file can make debugfs walk a freed range bitmap and trigger an invalid memory access. Reading maxchunk can also take cma->lock even though that lock is initialized only on the successful activation path. Fix this by creating debugfs entries only for CMA areas that reached CMA_ACTIVATED. c009da4258f9 introduced the invalid access to bitmap file. 2e32b947606d introduced the invalid access to cma->lock. This change applies to both issues. So I added two Fixes tags. Link: https://lore.kernel.org/20260520061025.3971821-1-songmuchun@bytedance.com Fixes: c009da4258f9 ("mm, cma: support multiple contiguous ranges, if requested") Fixes: 2e32b947606d ("mm: cma: add functions to get region pages counters") Signed-off-by: Muchun Song Acked-by: Mike Rapoport (Microsoft) Acked-by: Oscar Salvador (SUSE) Acked-by: David Hildenbrand (Arm) Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Frank van der Linden Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Michal Nazarewicz Cc: Stefan Strogin Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit c0cafe24d3f6534294c4b2bc2d47734ff7cbd313 Author: Shakeel Butt Date: Thu May 21 15:37:51 2026 -0700 memcg: use round-robin victim selection in refill_stock Harry Yoo reported that get_random_u32_below() is not safe to call in the nmi context and memcg charge draining can happen in nmi context. More specifically get_random_u32_below() is neither reentrant- nor NMI-safe: it acquires a per-cpu local_lock via local_lock_irqsave() on the batched_entropy_u32 state. An NMI that lands on a CPU mid-update of the ChaCha batch state and recurses into the random subsystem would corrupt that state. The memcg_stock local_trylock prevents re-entry on the percpu stock itself, but cannot protect an unrelated subsystem's per-cpu lock. Replace the random pick with a per-cpu round-robin counter stored in memcg_stock_pcp and serialized by the same local_trylock that already guards cached[] and nr_pages[]. No atomics, no random calls, no extra locks needed. Link: https://lore.kernel.org/20260521223751.3794625-1-shakeel.butt@linux.dev Fixes: f735eebe55f8f ("memcg: multi-memcg percpu charge cache") Signed-off-by: Shakeel Butt Reported-by: Harry Yoo Closes: https://lore.kernel.org/4e20f643-6983-4b6e-b12d-c6c4eb20ae0c@kernel.org/ Acked-by: Harry Yoo (Oracle) Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Muchun Song Cc: Roman Gushchin Cc: Signed-off-by: Andrew Morton commit b4aea43cd37afad714b5684fe9fdfcb0e78dba26 Author: Lorenzo Stoakes Date: Wed May 13 09:56:58 2026 +0100 mm/hugetlb: avoid false positive lockdep assertion Commit 081056dc00a2 ("mm/hugetlb: unshare page tables during VMA split, not before") changed the locking model around hugetlbfs PMD unsharing on VMA split, but did not update the function which asserts the locks, hugetlb_vma_assert_locked(). This function asserts that either the hugetlb VMA lock is held (if a shared mapping) or that the reservation map lock is held (if private). If you get an unfortunate race between something which results in one of these locks being released and a hugetlb VMA split and you have CONFIG_LOCKDEP enabled, you can therefore see a false positive assertion arise when there is in fact no issue. Since this change introduced a new take_locks parameter to hugetlb_unshare_pmds(), which, when set to false, indicates that locking is sufficient, simply pass this to the unsharing logic and predicate the lock assertions on this. This is safe, as we already asserted the file rmap lock and the VMA write lock prior to this (implying exclusive mmap write lock), so we cannot be raced by either rmap or page fault page table walkers which the asserted locks are intended to protect against (we don't mind GUP-fast). Separate out huge_pmd_unshare() into __huge_pmd_unshare() to add a check_locks parameter, and update hugetlb_unshare_pmds() to pass this parameter to it. This leaves all other callers of huge_pmd_unshare() still correctly asserting the locks. The below reproducer will trigger the assert in a kernel with CONFIG_LOCKDEP enabled by racing process teardown (which will release the hugetlb lock) against a hugetlb split. void execute_one(void) { void *ptr; pid_t pid; /* * Create a hugetlb mapping spanning a PUD entry. * * We force the hugetlb page allocation with populate and * noreserve. * * |---------------------| * | | * |---------------------| * 0 PUD boundary */ ptr = mmap(0, PUD_SIZE, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_SHARED | MAP_ANON | MAP_NORESERVE | MAP_HUGETLB | MAP_POPULATE, -1, 0); if (ptr == MAP_FAILED) { perror("mmap"); exit(EXIT_FAILURE); } /* * Fork but with a bogus stack pointer so we try to execute code in * a non-VM_EXEC VMA, causing segfault + teardown via exit_mmap(). * * The clone will cause PMD page table sharing between the * processes first via: * copy_process() -> ... -> huge_pte_alloc() -> huge_pmd_share() * * Then tear down and release the hugetlb 'VMA' lock via: * exit_mmap() -> ... -> vma_close() -> hugetlb_vma_lock_free() */ pid = syscall(__NR_clone, 0, 2 * PMD_SIZE, 0, 0, 0); if (pid < 0) { perror("clone"); exit(EXIT_FAILURE); } if (pid == 0) { /* Pop stack... */ return; } /* * We are the parent process. * * Race the child process's teardown with a PMD unshare. * * We do this by triggering: * * __split_vma() -> hugetlb_split() -> hugetlb_unshare_pmds() * * Which, importantly, doesn't hold the hugetlb VMA lock (nor can * it), meaning we assert in hugetlb_vma_assert_locked(). * * . * |----------.----------| * | . | * |----------.----------| * 0 . PUD boundary */ mmap(0, PUD_SIZE / 2, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0); } int main(void) { int i; /* Kick off fork children. */ for (i = 0; i < NUM_FORKS; i++) { pid_t pid = fork(); if (pid < 0) { perror("fork"); exit(EXIT_FAILURE); } /* Fork children do their work and exit. */ if (!pid) { int j; for (j = 0; j < NUM_ITERS; j++) execute_one(); return EXIT_SUCCESS; } } /* If we succeeded, wait on children. */ for (i = 0; i < NUM_FORKS; i++) wait(NULL); return EXIT_SUCCESS; } [ljs@kernel.org: account for the !CONFIG_HUGETLB_PMD_PAGE_TABLE_SHARING case] Link: https://lore.kernel.org/agWZsPGYid08uU6O@lucifer Link: https://lore.kernel.org/20260513085658.45264-1-ljs@kernel.org Fixes: 081056dc00a2 ("mm/hugetlb: unshare page tables during VMA split, not before") Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Arm) Acked-by: Oscar Salvador Cc: Jann Horn Cc: Muchun Song Cc: Signed-off-by: Andrew Morton commit e81d3b59f7288a7ffa81175586c2148dfa9d7dd9 Merge: 4ab97280e89db6 1c824497d8acd3 Author: Dave Airlie Date: Fri May 29 11:55:08 2026 +1000 Merge tag 'amd-drm-fixes-7.1-2026-05-28' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.1-2026-05-28: amdgpu: - GEM_OP warning fix - GEM_OP locking fix - Userq fixes - DCN 2.1 refclk fix - SI fix - HMM fixes amdkfd: - svm_range_set_attr locking fix - CRIU restore fix - KFD debugger fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260528211843.893681-1-alexander.deucher@amd.com commit 4ab97280e89db6674708e31abed902dc55e393c5 Merge: 96c85df77f12d3 f657a6a3ba4c20 Author: Dave Airlie Date: Fri May 29 11:28:52 2026 +1000 Merge tag 'drm-xe-fixes-2026-05-28' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Restore IDLEDLY regiter on engine reset (Bala) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/ahhBUt8fDqjB-mQq@intel.com commit f29a24c94705496254dd9ce7ea8a31efb6eb4358 Merge: eec00425d38dbc 5285b046757844 Author: Stephen Boyd Date: Thu May 28 18:21:54 2026 -0700 Merge tag 'qcom-clk-fixes-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-fixes Pull Qualcomm clk driver fixes from Bjorn Andersson: The parking of shared RCGs during registration parks the MDP source clock, disabling display until the msm display driver successfully initializes the hardware again. Mark this clock on Makena and Hamoa as "no_init_park" to retain a working recovery console etc. * tag 'qcom-clk-fixes-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked commit eec00425d38dbc17ad92217a9f58d91c617c86d2 Merge: de019f203b0d47 78ee734b36284d Author: Stephen Boyd Date: Thu May 28 18:19:26 2026 -0700 Merge tag 'samsung-clk-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-fixes Pull a Samsung clk driver fix from Krzysztof Kozlowski: Google GS101: Correct the register name for saving and restoring state during system suspend and resume. Lack of proper save/restore leads to incorrect clock values after system resume. * tag 'samsung-clk-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs commit 96c85df77f12d309d41257f051a7c2357d26dc97 Merge: e7ae89a0c97ce2 3549a9649dc7c5 Author: Dave Airlie Date: Fri May 29 11:12:48 2026 +1000 Merge tag 'drm-intel-fixes-2026-05-27' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix potential UAF in TTM object purge (Janusz Krzysztofik) - Use polling when irqs are unavailable [aux] (Michał Grzelak) - Fix HDR pre-CSC LUT programming loop [color] (Pranay Samala) - Block DC states on vblank enable when Panel Replay supported [psr] (Jouni Högander) - Use DC_OFF wake reference to block DC6 on vblank enable [psr] (Jouni Högander) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patch.msgid.link/ahajfPMJE_qKzig5@linux commit 422b5233b607476ac7176bfa2a101b9a103d7653 Author: Frank Wunderlich Date: Tue May 26 17:32:38 2026 +0200 net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration Commit 8871389da151 introduces common pcs dts properties which writes rx=normal,tx=normal polarity to register SGMSYS_QPHY_WRAP_CTRL of switch. This is initialized with tx-bit set and so change inverts polarity compared to before. It looks like mt7531 has tx polarity inverted in hardware and set tx-bit by default to restore the normal polarity. The MT7531 datasheet quite clearly states: Register 000050EC QPHY_WRAP_CTRL -- QPHY wrapper control Reset value: 0x00000501 BIT 1 RX_BIT_POLARITY -- RX bit polarity control 1'b0: normal 1'b1: inverted BIT 0 TX_BIT_POLARITY -- TX bit polarity control (TX default inversed in MT7531) 1'b0: normal 1'b1: inverted Till this patch the register write was only called when mediatek,pnswap property was set which cannot be done for switch because the fw-node param was always NULL from switch driver in the mtk_pcs_lynxi_create call. Do not configure switch side like it's done before. Fixes: 8871389da151 ("net: pcs: pcs-mtk-lynxi: deprecate "mediatek,pnswap"") Signed-off-by: Frank Wunderlich Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260526153239.30194-1-linux@fw-web.de Signed-off-by: Jakub Kicinski commit 2412591cfe66e681374c5265e691695cd913d099 Merge: f14fe6395a8b3d cdf88b35e06f1b Author: Jakub Kicinski Date: Thu May 28 17:02:54 2026 -0700 Merge tag 'for-net-2026-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_core: Rework hci_dev_do_reset() to use hci_sync functions - hci_conn: Fix memory leak in hci_le_big_terminate() - hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - hci_sync: Reset device counters in hci_dev_close_sync() - hci_sync: fix UAF in hci_le_create_cis_sync - L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - L2CAP: use chan timer to close channels in cleanup_listen() - L2CAP: clear chan->ident on ECRED reconfiguration success - ISO: fix UAF in iso_recv_frame - ISO: serialize iso_sock_clear_timer with socket lock - HIDP: fix missing length checks in hidp_input_report() - 6lowpan: check skb_clone() return value in send_mcast_pkt() - btusb: Allow firmware re-download when version matches - hci_qca: Use 100 ms SSR delay for rampatch and NVM loading * tag 'for-net-2026-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock Bluetooth: ISO: fix UAF in iso_recv_frame Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() Bluetooth: btusb: Allow firmware re-download when version matches Bluetooth: HIDP: fix missing length checks in hidp_input_report() Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() ==================== Link: https://patch.msgid.link/20260528131839.462344-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit f14fe6395a8b3d961a61e138ad7b36ba3626dd4e Author: Zhenghang Xiao Date: Wed May 27 11:24:11 2026 +0800 sctp: fix race between sctp_wait_for_connect and peeloff sctp_wait_for_connect() drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the association to a new socket via getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After re-acquiring the old socket lock, sctp_wait_for_connect() returns success without noticing the migration — the caller then accesses the association under the wrong lock in sctp_datamsg_from_user(). Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf() already has, returning an error if the association was migrated while we slept. Fixes: 668c9beb9020 ("sctp: implement assign_number for sctp_stream_interleave") Signed-off-by: Zhenghang Xiao Acked-by: Xin Long Link: https://patch.msgid.link/20260527032411.60959-1-kipreyyy@gmail.com Signed-off-by: Jakub Kicinski commit ab4ac5a93b1b76aa6b12cadcba30450868d21a6f Merge: 3e20009988e247 5b05aa36ee2429 Author: Jakub Kicinski Date: Thu May 28 16:33:45 2026 -0700 Merge branch 'net-mana-fix-null-dereferences-during-teardown-after-attach-failure' Dipayaan Roy says: ==================== net: mana: Fix NULL dereferences during teardown after attach failure When mana_attach() fails (e.g. during queue allocation), the error cleanup frees apc->tx_qp and apc->rxqs and sets them to NULL. Multiple subsequent teardown paths can then dereference these NULL pointers, causing kernel panics. Patch 1 adds NULL guards in the low-level teardown functions (mana_fence_rqs, mana_destroy_vport, mana_dealloc_queues) so they are safe to call regardless of queue initialization state. This covers all callers: mana_remove(), mana_change_mtu() recovery, and internal error paths in mana_alloc_queues(). Patch 2 adds an early exit in mana_detach() for already-detached ports, making it safe for non-close callers. This allows the queue reset handler to safely retry mana_attach() without redundant teardown. ==================== Link: https://patch.msgid.link/20260525081129.1230035-1-dipayanroy@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 5b05aa36ee24297d7296ca58dfd8c448d0e4cda3 Author: Dipayaan Roy Date: Mon May 25 01:08:25 2026 -0700 net: mana: Skip redundant detach on already-detached port When mana_per_port_queue_reset_work_handler() runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc->tx_qp and apc->rxqs already freed. Calling mana_detach() again unconditionally leads to NULL pointer dereferences during queue teardown. Add an early exit in mana_detach() when the port is already in detached state (!netif_device_present) for non-close callers, making it safe to call idempotently. This allows the queue reset handler and other recovery paths to simply retry mana_attach() without redundant teardown. Fixes: 3b194343c250 ("net: mana: Implement ndo_tx_timeout and serialize queue resets per port.") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy Link: https://patch.msgid.link/20260525081129.1230035-3-dipayanroy@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 17bfe0a8c014ee1d542ad352cd6a0a505361664a Author: Dipayaan Roy Date: Mon May 25 01:08:24 2026 -0700 net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc->tx_qp and apc->rxqs. Multiple teardown paths such as mana_remove(), mana_change_mtu() recovery, and internal error handling in mana_alloc_queues() can subsequently call into functions that dereference these pointers without NULL checks: - mana_chn_setxdp() dereferences apc->rxqs[0], causing a NULL pointer dereference panic (CR2: 0000000000000000 at mana_chn_setxdp+0x26). - mana_destroy_vport() iterates apc->rxqs without a NULL check. - mana_fence_rqs() iterates apc->rxqs without a NULL check. - mana_dealloc_queues() iterates apc->tx_qp without a NULL check. Add NULL guards for apc->rxqs in mana_fence_rqs(), mana_destroy_vport(), and before the mana_chn_setxdp() call. Add a NULL guard for apc->tx_qp in mana_dealloc_queues() to skip TX queue draining when TX queues were never allocated or already freed. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy Link: https://patch.msgid.link/20260525081129.1230035-2-dipayanroy@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 04e12996daf13eaa8e16c6312c02c7d71d96800a Merge: 66ac2df408ede6 2c6821657ce3b3 Author: Arnd Bergmann Date: Thu May 28 23:59:09 2026 +0200 Merge tag 'imx-soc-fixes-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into arm/fixes i.MX SoC fixes for v7.1 Fix CAAM driver probe failures caused by missing SoC information by retrieving the match data directly through of_machine_get_match_data(), which provides the correct SoC-specific data. * tag 'imx-soc-fixes-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: soc: imx8m: Fix match data lookup for soc device Signed-off-by: Arnd Bergmann commit 66ac2df408ede627aaae588d4ce7e611dd25b4f9 Author: Linus Walleij Date: Thu May 28 10:25:26 2026 +0200 ARM: dts: gemini: Fix partition offsets These FIS partition offsets were never right: the comment clearly states the FIS index is at 0xfe0000 and 0x7f * 0x200000 is 0xfe0000. Tested on the iTian SQ201. Fixes: d88b11ef91b1 ("ARM: dts: Fix up SQ201 flash access") Fixes: b5a923f8c739 ("ARM: dts: gemini: Switch to redboot partition parsing") Signed-off-by: Linus Walleij Signed-off-by: Arnd Bergmann commit acbfa4ed973a20ae6d1419ad10b0290d700b7683 Merge: d1b90365139388 b73953af9bbd5c Author: Arnd Bergmann Date: Thu May 28 23:57:25 2026 +0200 Merge tag 'qcom-arm64-defconfig-fixes-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm Arm64 defconfig fixes for v7.1 A number of targets now depends on the M.2 PCIe power sequencing driver, enable this to keep these devices functional with a defconfig build. * tag 'qcom-arm64-defconfig-fixes-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Enable PCI M.2 power sequencing driver Signed-off-by: Arnd Bergmann commit d1b903651393881d3016d04abd9fbcdad0c082ff Merge: a3a7c052725b2a 67802f981361eb Author: Arnd Bergmann Date: Thu May 28 23:55:17 2026 +0200 Merge tag 'qcom-arm64-fixes-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm Arm64 DeviceTree fixes for v7.1 Add missing power-domain and iface clocks for the ICE node of Eliza and Milos to avoid the validation errors that resulted from late binding changes. Also drop the reference clock for the USB QMP PHYs, for the same reason. Avoid touching the 20'th I2C bus on the Hamoa-based (X Elite) Dell laptops, as this conflicts with the battery management firmware. * tag 'qcom-arm64-fixes-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: eliza: Add power-domain and iface clk for ice node arm64: dts: qcom: milos: Add power-domain and iface clk for ice node arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins arm64: dts: qcom: glymur: Drop RPMh CXO clocks from QMP PHYs Signed-off-by: Arnd Bergmann commit a3a7c052725b2a1628d9c42a820f68f552be1811 Merge: c6066e3295fd4e 462a85f9f887a4 Author: Arnd Bergmann Date: Thu May 28 23:47:31 2026 +0200 Merge tag 'qcom-drivers-fixes-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm driver fixes for v7.1 The Qualcomm ICE driver suffers from race conditions between probe() and get() and will in certain cases return the wrong error code, which results in storage drivers failing to probe. Fix these issues. Also correct the DeviceTree binding, to ensure that relevant clocks are described and voted for, to prevent the driver from accessing unclocked hardware during boot. * tag 'qcom-drivers-fixes-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: ice: Fix the error code when 'qcom,ice' property is not found scsi: ufs: ufs-qcom: Remove NULL check from devm_of_qcom_ice_get() mmc: sdhci-msm: Remove NULL check from devm_of_qcom_ice_get() soc: qcom: ice: Return proper error codes from devm_of_qcom_ice_get() instead of NULL soc: qcom: ice: Return -ENODEV if the ICE platform device is not found soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk Signed-off-by: Arnd Bergmann commit 8fde5d1d47f69db6082dfa34500c27f8485389a5 Merge: de85416e95c9cc 3109f9f3880084 Author: Linus Torvalds Date: Thu May 28 13:45:10 2026 -0700 Merge tag 'acpi-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fixes from Rafael Wysocki: "Fix three issues in the ACPI button driver: a possible crash due to a button press after unloading the driver (introduced during the 6.15 development cycle), function keys breakage on Toshiba Tecra X40 due to missing ACPI events (introduced during the 7.0 development cycle), and a missing probe rollback path item that has not been added by mistake during a recent update" * tag 'acpi-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: button: Add missing device class clearing on probe failures ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time ACPI: button: Fix ACPI GPE handler leak during removal commit de85416e95c9cc9b18a3710e2554630f842b8334 Merge: 3e20009988e247 df488cac6140aa Author: Linus Torvalds Date: Thu May 28 13:30:28 2026 -0700 Merge tag 'pm-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix a possible amd-pstate-ut cpufreq driver crash introduced by a recent update (K Prateek Nayak)" * tag 'pm-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq/amd-pstate-ut: Disable dynamic_epp after the mode switch commit 3e20009988e2470063824c58b19d1c80816cc46d Merge: b0f908d785e19d 8d26955ea5a469 Author: Linus Torvalds Date: Thu May 28 13:13:48 2026 -0700 Merge tag 'net-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "This is again significantly bigger than the same point into the previous cycle, but at least smaller than last week. I'm not aware of any pending regression for the current cycle. Including fixes from netfilter. Current release - regressions: - netfilter: walk fib6_siblings under RCU Previous releases - regressions: - netlink: fix sending unassigned nsid after assigned one - bridge: fix sleep in atomic context in netlink path - sched: fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop - ipv4: fix net->ipv4.sysctl_local_reserved_ports UaF - eth: tun: free page on short-frame rejection in tun_xdp_one() Previous releases - always broken: - skbuff: fix missing zerocopy reference in pskb_carve helpers - handshake: drain pending requests at net namespace exit - ethtool: - rss: avoid modifying the RSS context response - module: avoid leaking a netdev ref on module flash errors - coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES - netfilter: fix dst corruption in same register operation - nfc: hci: fix out-of-bounds read in HCP header parsing - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - eth: - vti: use ip6_tnl.net in vti6_changelink(). - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()" * tag 'net-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (94 commits) dpll: zl3073x: make frequency monitor a per-device attribute dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work dpll: export __dpll_device_change_ntf() for use under dpll_lock net/handshake: Drain pending requests at net namespace exit net/handshake: Verify file-reference balance in submit paths net/handshake: Close the submit-side sock_hold race net/handshake: hand off the pinned file reference to accept_doit net/handshake: Take a long-lived file reference at submit net/handshake: Pass negative errno through handshake_complete() nvme-tcp: store negative errno in queue->tls_err net/handshake: Use spin_lock_bh for hn_lock net: skbuff: fix missing zerocopy reference in pskb_carve helpers net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path net: hibmcge: disable Relaxed Ordering to fix RX packet corruption selftests/tc-testing: Add netem test case exercising loops selftests/tc-testing: Add mirred test cases exercising loops net/sched: act_mirred: Fix return code in early mirred redirect error paths net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop net/sched: fix packet loop on netem when duplicate is on ... commit b0f908d785e19d53f0c41cb5d83639b038d2e489 Merge: 43a1e3744548e6 9500077678230e Author: Linus Torvalds Date: Thu May 28 12:36:39 2026 -0700 Merge tag 'gpio-fixes-for-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix interrupt handling in gpio-mxc - fix scoped_guard() usage in gpio-adnp - don't accept partial writes in gpio-virtuser debugfs interface as they can't really work correctly - fix resource leaks in gpio-rockchip - fix locking issues in remove path in shared GPIO management - undo the vote of a GPIO shared proxy virtual device on GPIO release * tag 'gpio-fixes-for-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: rockchip: teardown bugs and resource leaks gpio: rockchip: convert bank->clk to devm_clk_get_enabled() gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() gpio: shared: fix lockdep false positive by removing unneeded lock gpio: shared: fix deadlock on shared proxy's parent removal gpio: adnp: fix flow control regression caused by scoped_guard() gpio: shared: undo the vote of the proxy on GPIO free gpio: mxc: fix irq_high handling commit 43a1e3744548e6fd85873e6fb43e293eb4010694 Author: Linus Torvalds Date: Thu May 28 11:45:41 2026 -0700 security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period. The regular key handling doesn't see this because holding the keyring semaphore hides any lifetime issues, but the persistent key handling uses a different model. Instead of extending the keyring locking, just do the simple RCU locking that the assoc_array was designed for. Reported-by: Nicholas Carlini Cc: David Howells Cc: Jarkko Sakkinen Cc: Paul Moore Cc: James Morris James Morris Cc: Serge E. Hallyn Signed-off-by: Linus Torvalds commit bfd2eb9bba548a8f63c3339bb1fb9a2031a42d86 Author: Dinh Nguyen Date: Wed May 20 21:54:57 2026 -0500 firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe rsu_send_msg() can return -ETIMEDOUT when wait_for_completion_interruptible_timeout() fires while the SMC call is still pending. In stratix10_rsu_probe(), the error paths for COMMAND_RSU_DCMF_VERSION, COMMAND_RSU_DCMF_STATUS, COMMAND_RSU_MAX_RETRY and COMMAND_RSU_GET_SPT_TABLE call stratix10_svc_free_channel() - which sets chan->scl to NULL - but then fall through and queue the next request on the same channel. The next svc kthread that runs will dereference pdata->chan->scl in its receive callback path, triggering a NULL pointer dereference identical to the one fixed by commit c45f7263100c ("firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled") for the COMMAND_RSU_STATUS path. Apply the same cleanup pattern to the remaining failure paths: remove the async client, free the channel, and return early so no further messages are queued on a channel whose scl has been cleared. While at it, clean up stratix10_rsu_probe() in two ways without changing behavior: - Drop redundant zero-initialization of fields already cleared by devm_kzalloc(): client.receive_cb, status.* and spt0/1_address (INVALID_SPT_ADDRESS is 0x0). - Replace five identical 3-line error-cleanup blocks (stratix10_svc_remove_async_client() + stratix10_svc_free_channel() + return ret) with goto labels (remove_async_client, free_channel), matching the standard kernel resource-unwinding pattern and making it easier to extend the probe sequence without forgetting matching cleanup. Also move init_completion() next to mutex_init() so sync-primitive initialization is grouped before anything that could trigger a callback. Fixes: 15847537b623 ("firmware: stratix10-rsu: Migrate RSU driver to use stratix10 asynchronous framework.") Cc: stable@kernel.org Assisted-by: Claude:claude-4.7-opus-high Cursor Signed-off-by: Dinh Nguyen --- v2: Add a minor clean-up of the function stratix10_rsu_probe() to have a centralize exit for all the rsu_send_async_msg() and rsu_send_msg(). commit 371aa062219a0af108fb8992f0759d1bac1e8c91 Author: Muhammad Amirul Asyraf Mohamad Jamian Date: Thu Apr 16 00:22:07 2026 -0700 firmware: stratix10-svc: Don't fail probe when async ops unsupported When the ATF version is too old to support SIP SVC v3 asynchronous operations (e.g. ATF 2.5), stratix10_svc_async_init() returns -EOPNOTSUPP. The probe function currently treats any non-zero return as fatal and aborts, logging: stratix10-svc firmware:svc: Intel Service Layer Driver: ATF version \ is not compatible for async operation stratix10-svc firmware:svc: probe with driver stratix10-svc failed \ with error -95 This prevents the SVC driver from loading entirely, causing all dependent client drivers (hwmon, RSU, FCS) to also fail to probe even though they can operate correctly via the synchronous V1 SMC path. Fix this by treating -EOPNOTSUPP from stratix10_svc_async_init() as a non-fatal degraded condition. The driver loads in sync-only mode and logs: stratix10-svc firmware:svc: Intel Service Layer Driver Initialized \ (sync-only mode) Fixes: bcb9f4f07061 ("firmware: stratix10-svc: Add support for async communication") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Amirul Asyraf Mohamad Jamian Signed-off-by: Dinh Nguyen commit 3e529f57931417120fab700afeef6e49553250d5 Author: Muhammad Amirul Asyraf Mohamad Jamian Date: Thu Apr 16 00:22:06 2026 -0700 firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported Add a 'supported' flag to struct stratix10_async_ctrl to indicate whether the secure firmware supports SIP SVC v3 asynchronous communication. When the ATF version check in stratix10_svc_async_init() fails, set supported=false and return -EOPNOTSUPP instead of -EINVAL. This allows callers to distinguish between "async not supported by this ATF version" (-EOPNOTSUPP) and "programming error / bad argument" (-EINVAL), and take appropriate action (e.g. fall back to synchronous V1 SMC path) rather than treating both as fatal. Also update stratix10_svc_add_async_client() to return -EOPNOTSUPP immediately when async is not supported, rather than -EINVAL from the !actrl->initialized check, so client drivers receive a consistent and meaningful error code. This patch is a prerequisite for the following fix and must be applied together with it to correctly restore functionality on old ATF versions. Fixes: bcb9f4f07061 ("firmware: stratix10-svc: Add support for async communication") Cc: stable@vger.kernel.org Suggested-by: Anders Hedlund Signed-off-by: Mahesh Rao Signed-off-by: Muhammad Amirul Asyraf Mohamad Jamian Signed-off-by: Dinh Nguyen commit c0a8899e02ddebd51e2589835182c239c2e224ae Author: Lee Jones Date: Wed May 27 17:05:26 2026 +0100 HID: wacom: Fix OOB write in wacom_hid_set_device_mode() wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE usage is always located in the first field (field[0]) of the feature report. However, a device can specify HID_DG_INPUTMODE in a different field. If HID_DG_INPUTMODE is in a field other than the first one and the first field has a report_count smaller than the usage_index of HID_DG_INPUTMODE, this leads to an out-of-bounds write to r->field[0]->value. Fix this by storing the field index of HID_DG_INPUTMODE in 'struct hid_data' during feature mapping. In wacom_hid_set_device_mode(), use this stored field index to access the correct field and add bounds checks to ensure both the field index and the value index are within valid ranges before writing. Cc: stable@vger.kernel.org Fixes: 5ae6e89f7409 ("HID: wacom: implement the finger part of the HID generic handling") Tested-by: Ping Cheng Reviewed-by: Ping Cheng Signed-off-by: Lee Jones Signed-off-by: Benjamin Tissoires commit ead6680f354f83966c796fc7f9463a3171789616 Author: David Carlier Date: Sat May 23 19:14:46 2026 +0100 dma-buf: fix UAF in dma_buf_fd() tracepoint Once FD_ADD() returns, the fd is live in the file descriptor table and a thread sharing that table can close() it before DMA_BUF_TRACE() runs. The close drops the last reference, __fput() frees the dma_buf, and the tracepoint then dereferences dmabuf to take dmabuf->name_lock -- slab-use-after-free. Split FD_ADD() back into get_unused_fd_flags() + fd_install() and emit the tracepoint between them. While the fdtable slot is reserved with a NULL file pointer, a racing close() returns -EBADF without entering __fput(), so the dma_buf stays alive across the trace. Same approach as commit 2d76319c4cbb ("dma-buf: fix UAF in dma_buf_put() tracepoint"). This undoes the FD_ADD() conversion done in commit 34dfce523c90 ("dma: convert dma_buf_fd() to FD_ADD()"); FD_ADD() has no place to hook the tracepoint safely. Reported-by: syzbot+7f4987d0afb97dd090cb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7f4987d0afb97dd090cb Fixes: 281a22631423 ("dma-buf: add some tracepoints to debug.") Cc: stable@vger.kernel.org # 7.0.x Signed-off-by: David Carlier Reviewed-by: Christian König Signed-off-by: Sumit Semwal Link: https://patch.msgid.link/20260523181446.69525-1-devnexen@gmail.com commit 006c66d1d52f1905e6ccfb615cf27235e4e6e745 Author: bui duc phuc Date: Thu May 28 12:32:04 2026 +0700 regmap: reject volatile update_bits() in cache-only mode Prevent _regmap_update_bits() from accessing hardware when the register map is in cache-only mode. Unlike regmap_raw_read() and _regmap_read(), the volatile _regmap_update_bits() fast path bypasses the cache_only check. This can result in unexpected hardware accesses while the device is suspended. Return -EBUSY to ensure behavior is consistent with other cache-only access paths. Signed-off-by: bui duc phuc Link: https://patch.msgid.link/20260528053204.46783-1-phucduc.bui@gmail.com Signed-off-by: Mark Brown commit 175db11786bde9061db526bf1ac5107d915f5163 Author: Nathan Chancellor Date: Sat May 16 04:34:14 2026 +0900 Disable -Wattribute-alias for clang-23 and newer Clang recently added support for -Wattribute-alias [1], which results in the same warnings that necessitated commit bee20031772a ("disable -Wattribute-alias warning for SYSCALL_DEFINEx()") for GCC. kernel/time/itimer.c:325:1: error: alias and aliasee have different types 'long (unsigned int)' and 'long (typeof (__builtin_choose_expr((__builtin_types_compatible_p(typeof ((unsigned int)0), typeof (0LL)) || __builtin_types_compatible_p(typeof ((unsigned int)0), typeof (0ULL))), 0LL, 0L)))' (aka 'long (long)') [-Werror,-Wattribute-alias] 325 | SYSCALL_DEFINE1(alarm, unsigned int, seconds) | ^ include/linux/syscalls.h:225:36: note: expanded from macro 'SYSCALL_DEFINE1' 225 | #define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__) | ^ include/linux/syscalls.h:236:2: note: expanded from macro 'SYSCALL_DEFINEx' 236 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^ include/linux/syscalls.h:251:18: note: expanded from macro '__SYSCALL_DEFINEx' 251 | __attribute__((alias(__stringify(__se_sys##name)))); \ | ^ kernel/time/itimer.c:325:1: note: aliasee is declared here include/linux/syscalls.h:225:36: note: expanded from macro 'SYSCALL_DEFINE1' 225 | #define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__) | ^ include/linux/syscalls.h:236:2: note: expanded from macro 'SYSCALL_DEFINEx' 236 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^ include/linux/syscalls.h:255:18: note: expanded from macro '__SYSCALL_DEFINEx' 255 | asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \ | ^ :16:1: note: expanded from here 16 | __se_sys_alarm | ^ Disable the warnings in the same way for clang-23 and newer. Disable the warning about unknown warning options to avoid breaking the build for versions of clang-23 that do not have -Wattribute-alias, such as ones deployed by vendors like Android or CI systems or when bisecting LLVM between llvmorg-23-init and release/23.x. Cc: stable@vger.kernel.org Closes: https://github.com/ClangBuiltLinux/linux/issues/2163 Link: https://github.com/llvm/llvm-project/commit/40da6920a0d71d49dfa2392b09153600b0759f5e [1] Link: https://patch.msgid.link/20260515-syscall-disable-attribute-alias-for-clang-v1-1-9a9d95d41df6@kernel.org Signed-off-by: Nathan Chancellor commit c6066e3295fd4eac1596d8d6752d8391a32d561a Merge: 56d582972068bb 471c18323dfdfe Author: Arnd Bergmann Date: Thu May 28 15:31:47 2026 +0200 Merge tag 'qcomtee-fix-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes QCOMTEE fix for v7.1 Adding a missing va_end in early return qcomtee_object_user_init() * tag 'qcomtee-fix-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: qcomtee: add missing va_end in early return qcomtee_object_user_init() Signed-off-by: Arnd Bergmann commit 56d582972068bb78d0907f7ffff79c8e6b5a561a Merge: 9193ffe5b478a0 387a926ee16681 Author: Arnd Bergmann Date: Thu May 28 15:28:19 2026 +0200 Merge tag 'optee-fix-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes OP-TEE fix for v7.1 Prevent possible use after free in supplicant communication. * tag 'optee-fix-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: optee: prevent use-after-free when the client exits before the supplicant Signed-off-by: Arnd Bergmann commit 9500077678230e36d22bf16d2b9539c13e59a801 Author: Marco Scardovi Date: Tue May 26 19:02:46 2026 +0200 gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock (bank->db_clk) is obtained using of_clk_get() which increments the clock's reference count, but clk_put() is never called. Register a devm action to cleanly release it on unbind. Note that of_clk_get(..., 1) remains necessary over devm_clk_get() because the DT binding does not define clock-names, precluding name-based lookup. 2. Unregistered chained IRQ handler: The chained IRQ handler is not disconnected in remove(). If a stray interrupt fires after the driver is removed, the kernel attempts to execute a stale handler, leading to a panic. Fix this by clearing the handler in remove(). 3. IRQ domain leak: The linear IRQ domain and its generic chips are allocated manually during probe but never removed. Remove the IRQ domain during driver teardown to free the associated generic chips and mappings. Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Marco Scardovi Link: https://patch.msgid.link/20260526171050.12785-3-scardracs@disroot.org [Bartosz: don't emit an error message on devres allocation failure] Signed-off-by: Bartosz Golaszewski commit 3e46c18d5d87f063a93ae0fe7662fbf6660459d5 Author: Marco Scardovi Date: Tue May 26 19:02:45 2026 +0200 gpio: rockchip: convert bank->clk to devm_clk_get_enabled() The bank->clk was previously obtained via of_clk_get() and manually prepared/enabled. However, it was missing a corresponding clk_put() in both the error paths and the remove function, leading to a reference leak. Convert the allocation to devm_clk_get_enabled(), which also properly propagates failures from clk_prepare_enable() that were previously ignored. The GPIO bank device uses the same OF node as the previous of_clk_get() call, so devm_clk_get_enabled(dev, NULL) correctly resolves the same clock provider entry. Fix the reference leak and simplify the code by removing the manual clk_disable_unprepare() calls in the probe error paths and in the remove function. Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Marco Scardovi Link: https://patch.msgid.link/20260526171050.12785-2-scardracs@disroot.org Signed-off-by: Bartosz Golaszewski commit 8a122b5e72cc0043705f0d524bcd15f0c0b3ec15 Author: Dan Carpenter Date: Mon May 25 10:15:16 2026 +0300 gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write() If *ppos is non-zero (user-space write split over multiple calls to write()) then simple_write_to_buffer() won't initialize the start of the buffer. Really, non-zero values for *ppos aren't going to work at all. Check for that and return -EINVAL at the start of the function. Fixes: 91581c4b3f29 ("gpio: virtuser: new virtual testing driver for the GPIO API") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/ahP3BJWWy-m_qI0X@stanley.mountain Signed-off-by: Bartosz Golaszewski commit 9d7697fabbc72428f981c01ddbe0a6be0ce8b6fa Author: Bartosz Golaszewski Date: Fri May 22 11:12:37 2026 +0200 gpio: shared: fix lockdep false positive by removing unneeded lock By the time gpio_device_teardown_shared() is called, the parent device is gone from the global list of GPIO devices and all outstanding SRCU read-side critical sections have completed. That means that no concurrent gpio_find_and_request() can call gpio_shared_add_proxy_lookup() for this device at this time. There's also no risk of the parent device being re-bound to the driver before the unbinding completes (including the child devices). Lockdep produces a false-positive report about a possible circular dependency as it doesn't know the ordering guarantee. Not taking the ref->lock in gpio_device_teardown_shared() silences it and is safe to do. Cc: stable@vger.kernel.org Fixes: ea513dd3c066 ("gpio: shared: make locking more fine-grained") Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260522-gpio-shared-deadlock-v1-2-76bca088f8c0@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit a1b836607304f71051f9f9dcccf8b5097b86a1fb Author: Bartosz Golaszewski Date: Fri May 22 11:12:36 2026 +0200 gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set") used the mutex embedded in struct gpio_shared_entry to protect the offset field which now can be modified after assignment. The critical section however is too wide and introduced a potential deadlock on the removal of the shared GPIO proxy's parent. Make the critical section shorter - only protect the offset when it's being read. While at it: mention the fact that the entry lock is now also used to protect against concurrent access to the offset field in the structure's documentation. Cc: stable@vger.kernel.org Fixes: 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set") Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260522-gpio-shared-deadlock-v1-1-76bca088f8c0@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit a5c627d90809b793fc053849b3a00609db305776 Author: Bartosz Golaszewski Date: Fri May 22 09:35:27 2026 +0200 gpio: adnp: fix flow control regression caused by scoped_guard() scoped_guard() is implemented as a for loop. Using it to protect code using the continue statement changes the flow as we now only break out of the hidden loop inside scoped_guard(), not the original for loop. Use a regular code block instead. Fixes: c7fe19ed3973 ("gpio: adnp: use lock guards for the I2C lock") Reported-by: David Lechner Closes: https://lore.kernel.org/all/cde2abb2-4cc8-4fc9-b34a-0c5d2b95779f@baylibre.com/ Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260522073527.9812-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit bbec30f7e19d9a1c604da7164b8057ccee590e72 Author: Bartosz Golaszewski Date: Fri May 22 09:49:35 2026 +0200 gpio: shared: undo the vote of the proxy on GPIO free When the user of a shared GPIO managed by gpio-shared-proxy calls gpiod_put() to release it, we never undo the potential "vote" for driving the shared line "high". In the free() callback, check if this proxy voted for "high" and - if so - decrease the number of votes and potentially revert the value to low if this is the last user. Cc: stable@vger.kernel.org Fixes: e992d54c6f97 ("gpio: shared-proxy: implement the shared GPIO proxy driver") Closes: https://sashiko.dev/#/patchset/20260513-gpio-shared-dynamic-voting-v1-1-8e1c49961b7d%40oss.qualcomm.com Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260522-gpio-shared-free-vote-v3-1-8a4fddc6bedb@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 9193ffe5b478a0ccb7eb7d68ea5ed636f057aa13 Merge: 7fd2df204f342f 6fa9b543f6b4ed Author: Arnd Bergmann Date: Thu May 28 15:20:29 2026 +0200 Merge tag 'tee-fixes-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes TEE fixes for v7.1 Fixing: - params_from_user() cleanup in error path in tee_ioctl_supp_recv() - possible tee_shm leak in error path in register_shm_helper() - padding in struct tee_ioctl_object_invoke_arg * tag 'tee-fixes-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: fix params_from_user() error path in tee_ioctl_supp_recv tee: shm: fix shm leak in register_shm_helper() tee: fix tee_ioctl_object_invoke_arg padding Signed-off-by: Arnd Bergmann commit cdf88b35e06f1b385f7f6228060ae541d44fbb72 Author: Heitor Alves de Siqueira Date: Tue May 26 10:50:59 2026 -0300 Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() Before resetting or closing the device, protocol counters should also be zeroed. Fixes: d0b137062b2d ("Bluetooth: hci_sync: Rework init stages") Signed-off-by: Heitor Alves de Siqueira Signed-off-by: Luiz Augusto von Dentz commit 525daaea459fc215f432de1b8debbd9144bf97b0 Author: Heitor Alves de Siqueira Date: Tue May 26 10:50:58 2026 -0300 Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_sync() can now be called during the reset path, we should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts while the hdev workqueue is being drained. Fixes: 877afadad2dc ("Bluetooth: When HCI work queue is drained, only queue chained work") Signed-off-by: Heitor Alves de Siqueira Signed-off-by: Luiz Augusto von Dentz commit 40b87657200cfae93e48904fd9c9c8fc3e192cae Author: Heitor Alves de Siqueira Date: Tue May 26 10:50:57 2026 -0300 Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions The current HCI reset function in hci_core.c duplicates most of the work done by hci_dev_close_sync(), and doesn't handle LE, advertising or discovery. Instead of porting these to hci_dev_do_reset(), directly call the close/open functions from hci_sync to reset the hdev. MGMT now notifies when a user performs a reset. Suggested-by: Luiz Augusto von Dentz Signed-off-by: Heitor Alves de Siqueira Signed-off-by: Luiz Augusto von Dentz commit 4b5f8e608749b7e8fa386c6e4301cf9272595859 Author: Muhammad Bilal Date: Wed May 27 04:59:18 2026 +0000 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk). iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the socket lock held: if (!iso_pi(sk)->conn) return; cancel_delayed_work(&iso_pi(sk)->conn->timeout_work); Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)->conn to NULL and may result in the final reference to the connection being dropped: CPU0 CPU1 ---- ---- iso_sock_clear_timer() if (conn != NULL) ... lock_sock(sk) iso_chan_del() iso_pi(sk)->conn = NULL cancel_delayed_work(conn) /* NULL deref or UAF */ iso_pi(sk)->conn is not stable across the unlock window, causing a NULL pointer dereference or use-after-free. Serialize iso_sock_clear_timer() with the socket lock by moving it inside lock_sock()/release_sock(), matching the pattern used in iso_conn_del() and all other call sites. Fixes: ccf74f2390d60a2f9a75ef496d2564abb478f46a ("Bluetooth: Add BTPROTO_ISO socket type") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Signed-off-by: Luiz Augusto von Dentz commit 47f23a259517abbdb8032c057a1e8a6bf3734878 Author: Muhammad Bilal Date: Wed May 27 04:59:17 2026 +0000 Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on sk->sk_state and sock_queue_rcv_skb(). Fix by replacing the bare pointer read with iso_sock_hold(conn), which calls sock_hold() while the spinlock is held, atomically elevating the refcount before the lock drops. Add a drop_put label so sock_put() is called on all exit paths where the hold succeeded. Fixes: ccf74f2390d60a2f9a75ef496d2564abb478f46a ("Bluetooth: Add BTPROTO_ISO socket type") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Signed-off-by: Luiz Augusto von Dentz commit 41c2713b204e6cb6a94587bc6bf6935107df5479 Author: Luiz Augusto von Dentz Date: Mon May 11 12:09:42 2026 -0400 Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan->dcid may be assigned previously it really needs to be disconnected. Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously. Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") Signed-off-by: Luiz Augusto von Dentz commit 00e1950716c6ed67d74777b2db286b0fa23b4be9 Author: Zhenghang Xiao Date: Tue May 26 18:51:52 2026 +0800 Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success l2cap_ecred_reconf_rsp() returns early on success without clearing chan->ident. Every other L2CAP response handler (l2cap_ecred_conn_rsp, l2cap_le_connect_rsp, l2cap_config_rsp) clears chan->ident after a successful transaction to prevent the channel from matching subsequent responses with the recycled ident value. A remote attacker that completed a reconfiguration as the peer can replay a failure response with the stale ident, causing the kernel to match and destroy the already-established channel via l2cap_chan_del(chan, ECONNRESET). Clear chan->ident for all matching channels on success, and harden the failure path by using l2cap_chan_hold_unless_zero() consistent with other L2CAP handlers (l2cap_le_command_rej, __l2cap_get_chan_by_ident). Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") Signed-off-by: Zhenghang Xiao Signed-off-by: Luiz Augusto von Dentz commit 79378db6a86c7014cce40b65252e6c18f5b8bcc2 Author: Santhosh Kumar K Date: Wed May 27 23:07:36 2026 +0530 spi: spi-mem: avoid mutating op template in spi_mem_supports_op() spi_mem_supports_op() accepts a const struct spi_mem_op pointer but casts away const internally to call spi_mem_adjust_op_freq(). This mutates the caller's op template, which causes stale max_freq values when callers reuse persistent templates - subsequent calls won't re-apply the device frequency cap since spi_mem_adjust_op_freq() skips non-zero values. Fix by operating on a stack-local copy instead. Fixes: a4f8e70d75dd ("spi: spi-mem: add spi_mem_adjust_op_freq() in spi_mem_supports_op()") Cc: Tianyu Xu Cc: stable@vger.kernel.org Signed-off-by: Santhosh Kumar K Reviewed-by: Miquel Raynal Link: https://patch.msgid.link/20260527173736.2243004-1-s-k6@ti.com Signed-off-by: Mark Brown commit 89c4a1167f3a0a0efd2ec3e1801036d2eb65ae1a Author: Arpith Kalaginanavoor Date: Tue May 26 05:38:58 2026 -0700 fs/qnx6: fix pointer arithmetic in directory iteration The conversion to qnx6_get_folio() in commit b2aa61556fcf ("qnx6: Convert qnx6_get_page() to qnx6_get_folio()") introduced a regression in directory iteration. The pointer 'de' and the 'limit' address were calculated using byte offsets from a char pointer without scaling by the size of a QNX6 directory entry. This causes the driver to read from incorrect memory offsets, leading to "invalid direntry size" errors and premature termination of directory scans. Fix this by casting 'kaddr' to 'struct qnx6_dir_entry *' before applying the offset and last_entry(...) increments. This allows the compiler to correctly scale the pointer arithmetic by the 32-byte stride of the directory entry structure. Fixes: b2aa61556fcf ("qnx6: Convert qnx6_get_page() to qnx6_get_folio()") Cc: stable@vger.kernel.org Signed-off-by: Arpith Kalaginanavoor Link: https://patch.msgid.link/20260526123858.1683035-1-arpithk@nvidia.com Signed-off-by: Christian Brauner (Amutable) commit e824bbd4d224cce4b5fb59cc9dcd3447fe0b7e44 Author: NeilBrown Date: Mon May 25 16:23:45 2026 +1000 VFS: fix possible failure to unlock in nfsd4_create_file() atomic_create() in fs/namei.c drops the reference to the dentry when it returns an error. This behaviour was imported into dentry_create() so that it will drop the reference if an error is returned from atomic_create(), though not if vfs_create() returns an error (in the case where ->atomic_create is not supported). The caller - nfsd4_create_file() - is made aware of this by checking path->dentry, which will either be a counted reference to a dentry, or an error pointer. However the change to use start_creating()/end_creating() (which landed shortly before the dentry_create() change landed, though was likely developed around the same time) means that nfsd4_create_file() *needs* a valid dentry so that it can unlock the parent. The net result is that if NFSD exports a filesystem which uses ->atomic_create, and if a call to ->atomic_create returns an error, then nfsd4_create_file() will pass an error pointer to end_creating() and the parent will not be unlocked. Fix this by changing dentry_create() to make sure path->dentry is always a valid dentry, never an error-pointer. The actual error is already returned a different way. Note that if ->atomic_create() returns a different dentry (which may not be possible in practice) we are guaranteed (because it is only ever provided by d_spliace_alias()) that it will have the same d_parent and so it will have the same effect when passed to end_creating(). Fixes: 64a989dbd144 ("VFS/knfsd: Teach dentry_create() to use atomic_open()") Signed-off-by: NeilBrown Link: https://patch.msgid.link/177969022571.3379282.16448744624428323496@noble.neil.brown.name Reviewed-by: Jeff Layton Reviewed-by: Benjamin Coddington Reviewed-by: Jori Koolstra Signed-off-by: Christian Brauner (Amutable) commit 8d26955ea5a4697c1e21a3869ceb36b90389b051 Merge: 1af2af707f772f c1224569cef038 Author: Paolo Abeni Date: Thu May 28 14:05:31 2026 +0200 Merge branch 'dpll-zl3073x-various-fixes' Ivan Vecera says: ==================== dpll: zl3073x: various fixes Three fixes for the zl3073x DPLL driver. Patch 1 exports __dpll_device_change_ntf() for use by drivers that need to send device change notifications from within callbacks already running under dpll_lock. Patch 2 replaces the change_work workqueue mechanism with direct calls to __dpll_device_change_ntf(), eliminating a race condition where the work handler could dereference a freed dpll_dev pointer during device teardown. Patch 3 moves the freq_monitor flag from per-DPLL to per-device scope to match the hardware behavior where frequency measurement registers are shared across all DPLL channels. ==================== Link: https://patch.msgid.link/20260526074525.1451008-1-ivecera@redhat.com Signed-off-by: Paolo Abeni commit c1224569cef038b040db0459510cd7948ecd467b Author: Ivan Vecera Date: Tue May 26 09:45:25 2026 +0200 dpll: zl3073x: make frequency monitor a per-device attribute The frequency monitoring feature uses shared hardware registers that measure input reference frequencies independently of individual DPLL channels. However, the freq_monitor flag was incorrectly placed in the per-DPLL structure, causing each channel to track its own enable/disable state independently. Since the DPLL core calls measured_freq_get() only for the first pin registration, the measured_freq_check() in the periodic worker was gated by the per-DPLL freq_monitor flag of whichever channel happens to be checked. If the first DPLL channel had frequency monitoring disabled while another had it enabled, measurements were never reported. Move freq_monitor from struct zl3073x_dpll to struct zl3073x_dev so all DPLL channels share a single flag, matching the hardware behavior. Update freq_monitor_set() to notify other DPLL devices about the change (like phase_offset_avg_factor_set() already does) and remove the mode-dependent guard in zl3073x_dpll_changes_check() since all input pin monitoring (pin state, phase offset, FFO, and measured frequency) works correctly in all DPLL modes. Fixes: bfc923b642874 ("dpll: zl3073x: implement frequency monitoring") Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260526074525.1451008-4-ivecera@redhat.com Signed-off-by: Paolo Abeni commit d733f519f6443540f8359461a34e3b0042099bbe Author: Ivan Vecera Date: Tue May 26 09:45:24 2026 +0200 dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work The change_work was introduced to send device change notifications from DPLL device callbacks without deadlocking on dpll_lock, since the callbacks are already invoked under that lock. Now that __dpll_device_change_ntf() is exported for callers that already hold dpll_lock, use it directly and remove the change_work infrastructure entirely. This eliminates a race condition where change_work could be re-scheduled after cancel_work_sync() during device teardown, potentially causing the handler to dereference a freed or NULL dpll_dev pointer. Fixes: 9363b4837659 ("dpll: zl3073x: Allow to configure phase offset averaging factor") Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260526074525.1451008-3-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 20040b2a3cb992f84d3db4c086b909eb9b906b31 Author: Ivan Vecera Date: Tue May 26 09:45:23 2026 +0200 dpll: export __dpll_device_change_ntf() for use under dpll_lock Export __dpll_device_change_ntf() so that drivers can send device change notifications from within device callbacks, which are already called under dpll_lock. Using dpll_device_change_ntf() in that context would deadlock. Add lockdep_assert_held() to catch misuse without the lock held. Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20260526074525.1451008-2-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 00c257948900fae69dae2a055b378edf09aacf6e Author: Joerg Roedel Date: Thu May 28 09:53:18 2026 +0200 MAINTAINERS: Add my employer to my entries AMD pays for my IOMMU maintainer work, so mention that in the MAINTAINERS file as well. Signed-off-by: Joerg Roedel commit 2e4eed207cb4ba513e4a1fdcecbb3732e98f4914 Author: Joerg Roedel Date: Thu May 28 09:53:17 2026 +0200 MAINTAINERS: Add Vasant Hegde to reviewers of AMD IOMMU Vasant has a long history of providing valuable feedback and testing results for the AMD IOMMU code. Still, too often he gets not Cc'ed on code changes, so make his reviewer status official. Acked-by: Vasant Hegde Signed-off-by: Joerg Roedel commit 2c142b63c8ee982cdfdba49a616027c266294838 Merge: 14912d49718828 f63ad68e18d774 Author: Takashi Iwai Date: Thu May 28 13:48:04 2026 +0200 Merge tag 'asoc-fix-v7.1-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.1 This round of fixes is mostly Sirini's Qualcomm cleanups that have been in review for a while, we also have a couple of small fixes from Cássio. commit 1af2af707f772f7f7ae7853ebe6d2695354fe85e Merge: 98d0912e9f841e ea5fe6a73ca57e Author: Paolo Abeni Date: Thu May 28 13:35:47 2026 +0200 Merge branch 'net-handshake-anchor-request-lifetime-to-a-pinned-file-reference' Chuck Lever says: ==================== net/handshake: anchor request lifetime to a pinned file reference handshake_nl_accept_doit() has accumulated four follow-on fixes since 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests"): 7ea9c1ec66bc, 7798b59409c3, fe67b063f687, and dabac51b8102. Each was a local refcount or NULL-check correction; none moved where the file reference is owned, and the same code keeps producing the same class of bug. Reworking the ownership is what breaks the pattern. For the duration of a request, sock->file has no single owner. Submit publishes the request without taking a file reference; accept_doit acquires one inside the handler, after the request has already left the pending list. The consumer can drop its own reference at any time, including the moment between handshake_req_next() popping the request and accept_doit reaching get_file(). The submit-side sock_hold() pins only struct sock; struct socket and sock->file remain under the consumer's control via the file descriptor. This series places the file reference under unambiguous ownership. handshake_req_submit() pins it on the request and completion or cancel drops it (patches 4-5); the submit-side sock_hold() then becomes redundant, and dropping it also closes a publish-before-pin race the late sock_hold itself opened (patch 6). The handshake_complete() API and its consumers move to a uniform negative-errno sign convention (patch 3), with the matching sign correction in nvme-tcp (patch 2). Patch 1 hardens hn_lock for BH context, the netns-exit drain fix builds on the new file-pin infrastructure (patch 8), and new KUnit file-count assertions verify the refcount contract (patch 7). Three things in this restructuring want a careful look. In handshake_complete(), the fput() of the request's file reference has to come after hp_done() -- fput() can transitively run handshake_sk_destruct() and free the request, so the patch stashes hr_file in a local first. handshake_sk_destruct() itself is kept on purpose: it owns rhashtable removal and kfree, and remains the backstop if a consumer path bypasses handshake_complete() entirely. Third, handshake_req_next() now returns its request with an extra get_file() held under hn_lock; accept_doit must consume that reference (FD_PREPARE on success, explicit fput on the fdf.err path), and any future caller has to honor the same contract. v2: https://patch.msgid.link/20260521-handshake-file-pin-v2-0-b9dadc472840@oracle.com v1: https://patch.msgid.link/20260518-handshake-file-pin-v1-0-4bbcb7e62fda@oracle.com ==================== Link: https://patch.msgid.link/20260525-handshake-file-pin-v3-0-66c616906ead@oracle.com Signed-off-by: Paolo Abeni commit ea5fe6a73ca57e5150b8a38b341aef2636eb72f0 Author: Chuck Lever Date: Mon May 25 12:51:22 2026 -0400 net/handshake: Drain pending requests at net namespace exit The arguments to list_splice_init() in handshake_net_exit() are reversed. The call moves the local empty "requests" list onto hn->hn_requests, leaving the local list empty, so the subsequent drain loop runs zero iterations. Pending handshake requests that had not yet been accepted are not torn down when the net namespace is destroyed; each one keeps a reference on a socket file and on the handshake_req allocation. Pass the source and destination in the documented order (list_splice_init(list, head) moves list onto head) so the pending list is transferred to the local scratch list and drained through handshake_complete(). Fixing the splice direction exposes a list-corruption race. After the splice each req->hr_list still has non-empty link pointers, threading the stack-local scratch list rather than hn_requests. A concurrent handshake_req_cancel() -- for example, from sunrpc's TLS timeout on a kernel socket whose netns reference was not taken -- finds the request through the rhashtable, calls remove_pending(), and sees !list_empty(&req->hr_list). __remove_pending_locked() then list_del_init()s an entry off the scratch list while the drain iterates, corrupting it. The same call arriving after the drain loop has run list_del() on an entry hits LIST_POISON instead. Have remove_pending() check HANDSHAKE_F_NET_DRAINING under hn_lock and report not-found when drain is in progress. The drain has already taken ownership; handshake_complete()'s existing test_and_set on HANDSHAKE_F_REQ_COMPLETED still arbitrates between drain and cancel for who calls the consumer's hp_done. Use list_del_init() rather than list_del() in the drain so req->hr_list does not carry LIST_POISON after drain releases the entry. The DRAINING guard in remove_pending() makes cancel return false, but cancel still falls through to test_and_set_bit on HANDSHAKE_F_REQ_COMPLETED and drops the request's hr_file reference. Without another pin, if that is the last reference, sk_destruct frees the request while it is still linked on the drain loop's local list. Pin each request's hr_file under hn_lock before releasing the list, and drop that drain pin after the loop finishes with the request. Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Signed-off-by: Chuck Lever Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260525-handshake-file-pin-v3-8-66c616906ead@oracle.com Signed-off-by: Paolo Abeni commit 204a5efde5ed52932840ee1d15d3b581cfda48e2 Author: Chuck Lever Date: Mon May 25 12:51:21 2026 -0400 net/handshake: Verify file-reference balance in submit paths The new file-reference contract on struct handshake_req is silently breakable: a missing get_file() at submit or a missing fput() on an error path leaves the file leaked but does not crash the test, so the existing absence-of-crash checks pass either way. Snapshot file_count(filp) before each handshake_req_submit() in the submit-success, EAGAIN, EBUSY, and cancel tests, and assert the expected balance after submit and again after cancel. The already-completed cancel test also asserts the post-complete balance, which pins down that handshake_complete() drops the reference and that the subsequent cancel does not double-fput. The destroy test gets the same treatment before __fput_sync(), which double-checks that cancel's fput() ran and the only remaining reference is the one sock_alloc_file() established. Signed-off-by: Chuck Lever Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260525-handshake-file-pin-v3-7-66c616906ead@oracle.com Signed-off-by: Paolo Abeni commit 5da98f55b13173c08f003011b76531b25c821c07 Author: Chuck Lever Date: Mon May 25 12:51:20 2026 -0400 net/handshake: Close the submit-side sock_hold race handshake_req_submit() publishes the request via handshake_req_hash_add() and __add_pending_locked(), drops hn_lock, and calls handshake_genl_notify() (which can sleep) before taking sock_hold() on req->hr_sk. A fast tlshd ACCEPT followed by DONE can drive handshake_complete()'s sock_put() into the window between the spin_unlock and the late sock_hold(); on a system where the consumer's fd held the only sk reference, the late sock_hold() then operates on an sk whose refcount has reached zero. The preceding two patches install an explicit file reference on struct handshake_req. That file pins sock->file, which pins the embedded struct socket, which defers inet_release()'s sock_put(). As long as hr_file is held, sk cannot reach refcount zero from the consumer side, and the submit-side sock_hold() with its matching sock_put() calls in handshake_complete() and handshake_req_cancel() is now redundant. Drop all three. The file reference already keeps each request's socket alive, and the lifetime story is contained in a single get_file()/fput() pair. Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Signed-off-by: Chuck Lever Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260525-handshake-file-pin-v3-6-66c616906ead@oracle.com Signed-off-by: Paolo Abeni commit f4251190e58b209999c1ba9e6d2976136a1be055 Author: Chuck Lever Date: Mon May 25 12:51:19 2026 -0400 net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() reads req->hr_sk->sk_socket and dereferences sock->file (once in FD_PREPARE() and again in get_file()). In that window a consumer running tls_handshake_cancel() followed by sockfd_put() (svc_sock_free) or __fput_sync() (xs_reset_transport) releases sock->file. sock_release() then runs sock_orphan(), zeroing sk_socket, and frees the struct socket. The accept-side code either reads NULL through sk_socket or chases freed memory. The submit-side sock_hold() does not prevent this. sk_refcnt protects struct sock, but struct socket and sock->file are independently refcounted via the file descriptor the consumer owns. Pinning sk leaves sock and sock->file unprotected. Retarget the accept-side dereferences at req->hr_file, which was pinned at submit time, instead of req->hr_sk->sk_socket->file. Pinning on its own is not sufficient: a consumer that cancels between handshake_req_next() returning and accept_doit reaching FD_PREPARE() takes the !remove_pending() branch in handshake_req_cancel() and drops hr_file before the accept side takes its own reference. Hand off an additional file reference inside handshake_req_next(), under hn_lock, so the accept side operates on a reference that no concurrent handshake_req_cancel() can revoke. FD_PREPARE() consumes that handed-off reference, either by transferring it to the new fd in fd_publish() or by dropping it in the cleanup destructor on error; the explicit get_file() that previously balanced FD_PREPARE() is therefore redundant and goes away. Update handshake_req_cancel_test2 and _test3 to simulate the FD_PREPARE() consumption with an fput() so the kunit file-count assertions stay balanced. Reported-by: Chris Mason Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Signed-off-by: Chuck Lever Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260525-handshake-file-pin-v3-5-66c616906ead@oracle.com Signed-off-by: Paolo Abeni commit 09dba37eee70d0596e26645015f1aa95a9848e9d Author: Chuck Lever Date: Mon May 25 12:51:18 2026 -0400 net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file reference, sock_release() tears the socket down regardless of any sock_hold. Add an hr_file pointer to struct handshake_req and acquire an explicit reference on sock->file during handshake_req_submit(). handshake_complete() and handshake_req_cancel() release the reference on the completion-bit-winning path. The submit error path must also release the file reference, but after rhashtable insertion a concurrent handshake_req_cancel() can discover the request and race the error path. Gate the error-path cleanup -- sk_destruct restoration, fput, and request destruction -- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same serialization handshake_complete() and handshake_req_cancel() already use. When cancel has already claimed ownership, the submit error path returns without touching the request; socket teardown handles final destruction. The accept-side dereferences are not yet retargeted; that change comes in the next patch. Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260525-handshake-file-pin-v3-4-66c616906ead@oracle.com Signed-off-by: Paolo Abeni commit 6b22d433aa13f68e3cd9534ca9a5f4277bfa01c2 Author: Chuck Lever Date: Mon May 25 12:51:17 2026 -0400 net/handshake: Pass negative errno through handshake_complete() handshake_complete() declares status as unsigned int and tls_handshake_done() negates that value (-status) before handing it to the TLS consumer. Consumers match on negative errno constants -- xs_tls_handshake_done() has switch (status) { case 0: case -EACCES: case -ETIMEDOUT: lower_transport->xprt_err = status; break; default: lower_transport->xprt_err = -EACCES; } so the API as designed expects callers to pass positive errno values that the tlshd shim then negates. Three internal callers in handshake_nl_accept_doit(), the net-exit drain, and a kunit test follow kernel convention and pass negative errnos -- -EIO, -ETIMEDOUT, -ETIMEDOUT. The implicit conversion to unsigned int turns -ETIMEDOUT into 0xFFFFFF92; the subsequent -status in tls_handshake_done() wraps back to 110, the consumer's switch falls through, and the xprt reports -EACCES on what should be -ETIMEDOUT or -EIO. Fix the API rather than the call sites. The natural kernel convention is negative errno in, negative errno out. Change handshake_complete() and hp_done to take int status, drop the negation in tls_handshake_done(), and negate once in handshake_nl_done_doit() where status arrives from the wire as an unsigned netlink attribute. The three internal callers were already correct under that convention and need no change. At the same wire boundary, declare MAX_ERRNO as the netlink policy upper bound for HANDSHAKE_A_DONE_STATUS. Attribute validation rejects out-of-range values before handshake_nl_done_doit() runs, and negating a bounded u32 there stays within int range -- closing the UBSAN-visible signed- integer overflow that an unconstrained u32 would invoke. Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Signed-off-by: Chuck Lever Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260525-handshake-file-pin-v3-3-66c616906ead@oracle.com Signed-off-by: Paolo Abeni commit 9015985b5eb1a90eb86caf5bce1dfcf1aa38f8ad Author: Chuck Lever Date: Mon May 25 12:51:16 2026 -0400 nvme-tcp: store negative errno in queue->tls_err nvme_tcp_tls_done() assigns queue->tls_err in three branches. The ENOKEY lookup failure and the EOPNOTSUPP initializer both store negative errnos. The third branch, reached when the handshake layer reports a non-zero status, stores -status. The handshake layer delivers status to the consumer callback as a negative errno; the other in-tree consumers -- xs_tls_handshake_done() and the nvmet target callback -- treat their status argument that way. The extra negation in nvme_tcp_tls_done() flips the sign, leaving tls_err as a positive value (for instance, +EIO), which nvme_tcp_start_tls() then returns to its caller. Drop the extra negation so queue->tls_err uniformly carries a negative errno on failure. Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall") Signed-off-by: Chuck Lever Reviewed-by: Hannes Reinecke Reviewed-by: Alistair Francis Link: https://patch.msgid.link/20260525-handshake-file-pin-v3-2-66c616906ead@oracle.com Signed-off-by: Paolo Abeni commit cc993e0927ec8bd98ea33377ada03295fcda0f24 Author: Chuck Lever Date: Mon May 25 12:51:15 2026 -0400 net/handshake: Use spin_lock_bh for hn_lock nvmet_tcp_state_change(), a socket callback that runs in BH context, can reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue() and tls_handshake_cancel(). handshake_req_cancel() acquires hn->hn_lock with plain spin_lock(). If a process-context thread on the same CPU holds hn->hn_lock when a softirq invokes the cancel path, the lock attempt deadlocks. This is the only caller that invokes tls_handshake_cancel() from BH context; every other consumer calls it from process context. Deferring the cancel to process context in the NVMe target is not straightforward: nvmet_tcp_schedule_release_queue() must call tls_handshake_cancel() atomically with its state transition to DISCONNECTING. If the cancel were deferred, the handshake completion callback could fire in the window before the cancel runs, observe the unexpected state, and return without dropping its kref on the queue. Reworking that interlock is considerably more invasive than hardening the handshake lock. Convert all hn->hn_lock acquisitions from spin_lock/spin_unlock to spin_lock_bh/spin_unlock_bh so the lock is never taken with softirqs enabled. Fixes: 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall") Signed-off-by: Chuck Lever Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260525-handshake-file-pin-v3-1-66c616906ead@oracle.com Signed-off-by: Paolo Abeni commit 98d0912e9f841e5529a5b89a972805f34cb1c69d Author: Minh Nguyen Date: Tue May 26 11:12:39 2026 +0700 net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy the old skb_shared_info header into a new buffer via memcpy(), which includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs. Neither function calls net_zcopy_get() for the new shinfo, creating an unaccounted holder: every skb_shared_info with destructor_arg set will call skb_zcopy_clear() once when freed, but the corresponding net_zcopy_get() was never called for the new copy. Repeated calls drive uarg->refcnt to zero prematurely, freeing ubuf_info_msgzc while TX skbs still hold live destructor_arg pointers. KASAN reports use-after-free on a freed ubuf_info_msgzc: BUG: KASAN: slab-use-after-free in skb_release_data+0x77b/0x810 Read of size 8 at addr ffff88801574d3e8 by task poc/220 Call Trace: skb_release_data+0x77b/0x810 kfree_skb_list_reason+0x13e/0x610 skb_release_data+0x4cd/0x810 sk_skb_reason_drop+0xf3/0x340 skb_queue_purge_reason+0x282/0x440 rds_tcp_inc_free+0x1e/0x30 rds_recvmsg+0x354/0x1780 __sys_recvmsg+0xdf/0x180 Allocated by task 219: msg_zerocopy_realloc+0x157/0x7b0 tcp_sendmsg_locked+0x2892/0x3ba0 Freed by task 219: ip_recv_error+0x74a/0xb10 tcp_recvmsg+0x475/0x530 The skb consuming the late access still referenced the same uarg via shinfo->destructor_arg copied by pskb_carve_inside_nonlinear() without a refcount bump. This has been verified to be reliably exploitable: a working proof-of-concept achieves full root privilege escalation from an unprivileged local user on a default kernel configuration. The fix follows the pattern of pskb_expand_head() which has the same memcpy/cloned structure. For pskb_carve_inside_header(), net_zcopy_get() is placed after skb_orphan_frags() succeeds, so the orphan error path needs no cleanup. For pskb_carve_inside_nonlinear(), net_zcopy_get() is placed after all failure points and just before skb_release_data(), so no error path needs cleanup at all -- matching pskb_expand_head() more closely and avoiding the need for a balancing net_zcopy_put(). Fixes: 6fa01ccd8830 ("skbuff: Add pskb_extract() helper function") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Minh Nguyen Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260526041240.329462-1-minhnguyen.080505@gmail.com Signed-off-by: Paolo Abeni commit 85576d7a489a9fcbc2c6fd4364564921f69259ab Merge: 031f1592e592e3 b545b6ea1802b3 Author: Paolo Abeni Date: Thu May 28 13:02:59 2026 +0200 Merge branch 'hibmcge-fix-rx-packet-corruption-issue' Jijie Shao says: ==================== hibmcge: fix RX packet corruption issue This series fixes an RX packet corruption issue observed when SMMU is disabled on the hibmcge driver. The fixes include disabling PCI Relaxed Ordering and correcting the order of DMA barrier operations in the RX data sync path. ==================== Link: https://patch.msgid.link/20260525144525.94884-1-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit b545b6ea1802b32436fa97f1d2918718212cc831 Author: Jijie Shao Date: Mon May 25 22:45:25 2026 +0800 net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path The dma_rmb() barrier was placed before dma_sync_single_for_cpu(), which is incorrect. DMA sync must complete first to make the buffer accessible to the CPU, then the rmb barrier ensures subsequent descriptor reads observe the latest data written by the hardware. Reorder the operations so dma_sync_single_for_cpu() is called before dma_rmb() to guarantee the driver reads consistent data from the DMA buffer. Fixes: f72e25594061 ("net: hibmcge: Implement rx_poll function to receive packets") Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20260525144525.94884-3-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit 463a1271aa26eac992851b9d98cc75bc3cd4a1ed Author: Jijie Shao Date: Mon May 25 22:45:24 2026 +0800 net: hibmcge: disable Relaxed Ordering to fix RX packet corruption When SMMU is disabled, the hibmcge driver may receive corrupted packets. The hardware writes packet data and descriptors to the same page, but with Relaxed Ordering enabled, PCI write transactions may not be strictly ordered. This can cause the driver to observe a valid descriptor before the corresponding packet data is fully written. Fix this by clearing PCI_EXP_DEVCTL_RELAX_EN in the PCI bridge control register to ensure strict write ordering between packet data and descriptors. Fixes: f72e25594061 ("net: hibmcge: Implement rx_poll function to receive packets") Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20260525144525.94884-2-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit 031f1592e592e333a25d5e2ba9edd4e8c6821fdc Merge: 9d5e7a46a9f6d8 0f6e00aa5f652f Author: Paolo Abeni Date: Thu May 28 12:26:38 2026 +0200 Merge branch 'net-sched-fix-packet-loops-in-mirred-and-netem' Jamal Hadi Salim says: ==================== net/sched: Fix packet loops in mirred and netem This patchset adds a 2-bit per-skb tc_depth counter that travels with the packet. The existing per-CPU mirred nest tracking loses state when a packet is deferred through the backlog or moves between CPUs via XPS/RPS. A per-skb field covers both cases. Patch 1 adds the tc_depth field in a padding hole in sk_buff. Patches 2-3 revert the check_netem_in_tree() fix and its tests, which broke legitimate multi-netem configurations. Patch 4 uses tc_depth to stop netem duplicate recursion. Patch 5 uses tc_depth to catch mirred ingress redirect loops. Patch 6 fixes the infinite loop in the mirred egress blockcast case. Patch 7 fixes drop stats in early return error scenarios in tcf_mirred_act for redirect (caught by Sashiko [1]). Patches 8-9 add mirred and netem test cases. [1] https://sashiko.dev/#/patchset/20260413082027.2244884-1-hxzene%40gmail.com ==================== Link: https://patch.msgid.link/20260525122556.973584-1-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit 0f6e00aa5f652f5653e0039b9c9a8835f4b4174b Author: Victor Nogueira Date: Mon May 25 08:25:56 2026 -0400 selftests/tc-testing: Add netem test case exercising loops Add a netem nested duplicate test case to validate that it won't cause an infinite loop Acked-by: Jamal Hadi Salim Acked-by: Stephen Hemminger Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20260525122556.973584-10-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit d38dc56a0225664e494221b5b251931b35d125ef Author: Victor Nogueira Date: Mon May 25 08:25:55 2026 -0400 selftests/tc-testing: Add mirred test cases exercising loops Add mirred loop test cases to validate that those will be caught and other test cases that were previously misinterpreted as loops by mirred. This commit adds 12 test cases: - Redirect multiport: dummy egress -> dev1 ingress -> dummy egress (Loop) - Redirect singleport: dev1 ingress -> dev1 egress -> dev1 ingress (Loop) - Redirect multiport: dev1 ingress -> dummy ingress -> dev1 egress (No Loop) - Redirect multiport: dev1 ingress -> dummy ingress -> dev1 ingress (Loop) - Redirect multiport: dev1 ingress -> dummy egress -> dev1 ingress (Loop) - Redirect multiport: dummy egress -> dev1 ingress -> dummy egress, different prios (Loop) - Redirect multiport: dev1 ingress -> dummy ingress -> dummy egress -> dev1 egress (No Loop) - Redirect multiport: dev1 ingress -> dummy egress -> dev1 egress (No Loop) - Redirect multiport: dev1 ingress -> dummy egress -> dummy ingress (No Loop) - Redirect singleport: dev1 ingress -> dev1 ingress (Loop) - Redirect singleport: dummy egress -> dummy ingress (No Loop) - Redirect multiport: dev1 ingress -> dummy ingress -> dummy egress (No Loop) Acked-by: Jamal Hadi Salim Acked-by: Stephen Hemminger Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20260525122556.973584-9-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit e80ad525fc7e8c933ad78478c5dda286cfd55c60 Author: Victor Nogueira Date: Mon May 25 08:25:54 2026 -0400 net/sched: act_mirred: Fix return code in early mirred redirect error paths Since retval is set as TC_ACT_STOLEN in the mirred redirect case, returning retval in cases where redirect failed will make the callers not register the skb as being dropped. Fix this by returning TC_ACT_SHOT instead in such scenarios. Fixes: 16085e48cb48 ("net/sched: act_mirred: Create function tcf_mirred_to_dev and improve readability") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260413082027.2244884-1-hxzene%40gmail.com Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20260525122556.973584-8-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit a005fa5d7502eefec7ee6e1c01adadc06de2f9ad Author: Kito Xu (veritas501) Date: Mon May 25 08:25:53 2026 -0400 net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow tcf_mirred_act() checks sched_mirred_nest against MIRRED_NEST_LIMIT (4) to prevent deep recursion. However, when the action uses blockcast (tcfm_blockid != 0), the function returns at the tcf_blockcast() call BEFORE reaching the counter increment. As a result, the recursion counter never advances and the limit check is entirely bypassed. When two devices share a TC egress block with a mirred blockcast rule, a packet egressing on device A is mirrored to device B via blockcast; device B's egress TC re-enters tcf_mirred_act() via blockcast and mirrors back to A, creating an unbounded recursion loop: tcf_mirred_act -> tcf_blockcast -> tcf_mirred_to_dev -> dev_queue_xmit -> sch_handle_egress -> tcf_classify -> tcf_mirred_act -> (repeat) This recursion continues until the kernel stack overflows. The bug is reachable from an unprivileged user via unshare(CLONE_NEWUSER | CLONE_NEWNET): user namespaces grant CAP_NET_ADMIN in the new network namespace, which is sufficient to create dummy devices, attach clsact qdiscs with shared blocks, and install mirred blockcast filters. BUG: TASK stack guard page was hit at ffffc90000b7fff8 Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI CPU: 2 UID: 1000 PID: 169 Comm: poc Not tainted 7.0.0-rc7-next-20260410 RIP: 0010:xas_find+0x17/0x480 Call Trace: xa_find+0x17b/0x1d0 tcf_mirred_act+0x640/0x1060 tcf_action_exec+0x400/0x530 basic_classify+0x128/0x1d0 tcf_classify+0xd83/0x1150 tc_run+0x328/0x620 __dev_queue_xmit+0x797/0x3100 tcf_mirred_to_dev+0x7b1/0xf70 tcf_mirred_act+0x68a/0x1060 [repeating ~30+ times until stack overflow] Kernel panic - not syncing: Fatal exception in interrupt Fix this by incrementing sched_mirred_nest before calling tcf_blockcast() and decrementing it on return, mirroring the non-blockcast path. This ensures subsequent recursive entries see the updated counter and are correctly limited by MIRRED_NEST_LIMIT. Fixes: fe946a751d9b ("net/sched: act_mirred: add loop detection") Signed-off-by: Kito Xu (veritas501) Link: https://patch.msgid.link/20260525122556.973584-7-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit db875221ab08d213a83bf30196ae8b64d55a3403 Author: Jamal Hadi Salim Date: Mon May 25 08:25:52 2026 -0400 net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop When mirred redirects to ingress (from either ingress or egress) the loop state from sched_mirred_dev array dev is lost because of 1) the packet deferral into the backlog and 2) the fact the sched_mirred_dev array is cleared. In such cases, if there was a loop we won't discover it. Here's a simple test to reproduce: ip a add dev port0 10.10.10.11/24 tc qdisc add dev port0 clsact tc filter add dev port0 egress protocol ip \ prio 10 matchall action mirred ingress redirect dev port1 tc qdisc add dev port1 clsact tc filter add dev port1 ingress protocol ip \ prio 10 matchall action mirred egress redirect dev port0 ping -c 1 -W0.01 10.10.10.10 Fixes: fe946a751d9b ("net/sched: act_mirred: add loop detection") Tested-by: Victor Nogueira Reviewed-by: Stephen Hemminger Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260525122556.973584-6-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit 9552b11e3edabc97cfcd9f29103d5afbce7ae183 Author: Jamal Hadi Salim Date: Mon May 25 08:25:51 2026 -0400 net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or memory is exhausted. The original duplication guard temporarily zeroed q->duplicate around the re-enqueue, but that does not cover all cases because it is per-qdisc state shared across all concurrent enqueue paths and is not safe without additional locking. Use the skb tc_depth field introduced in an earlier patch: - increment it on the duplicate before re-enqueue - skip duplication for any skb whose tc_depth is already non-zero. This marks the packet itself rather than mutating qdisc state, therefore it is safe regardless of tree topology or concurrency. Fixes: 0afb51e72855 ("[PKT_SCHED]: netem: reinsert for duplication") Reported-by: William Liu Reported-by: Savino Dicanosa Closes: https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/ Co-developed-by: Victor Nogueira Signed-off-by: Victor Nogueira Reviewed-by: William Liu Reviewed-by: Stephen Hemminger Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260525122556.973584-5-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit b213a4c6074fc4ee4f1cdef9a73b34732606b637 Author: Jamal Hadi Salim Date: Mon May 25 08:25:50 2026 -0400 Revert "selftests/tc-testing: Add tests for restrictions on netem duplication" This reverts commit ecdec65ec78d67d3ebd17edc88b88312054abe0d. The tests added were related to check_netem_in_tree() which was just reverted in the previous patch. Reviewed-by: Stephen Hemminger Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260525122556.973584-4-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit eda0b7f203bb166c98d1418b204135bd566ac83b Author: Jamal Hadi Salim Date: Mon May 25 08:25:49 2026 -0400 net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" This reverts commit ec8e0e3d7adef940cdf9475e2352c0680189d14e. The original patch rejects any tree containing two netems when either has duplication set, even when they sit on unrelated classes of the same classful parent. That broke configurations that have worked since netem was introduced. The re-entrancy problem the original commit was trying to solve is handled by later patch using tc_depth flag. Doing this revert will (re)expose the original bug with multiple netem duplication. When this patch is backported make sure and get the full series. Fixes: ec8e0e3d7ade ("net/sched: Restrict conditions for adding duplicating netems to qdisc tree") Reported-by: Ji-Soo Chung Reported-by: Gerlinde Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220774 Reported-by: zyc zyc Closes: https://lore.kernel.org/all/19adda5a1e2.12410b78222774.9191120410578703463@zohomail.cn/ Reported-by: Manas Ghandat Closes: https://lore.kernel.org/netdev/f69b2c8f-8325-4c2e-a011-6dbc089f30e4@gmail.com/ Reviewed-by: Stephen Hemminger Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260525122556.973584-3-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit 98b34f3e8c3492cfc89ff943c9d92b4d52863d1d Author: Jamal Hadi Salim Date: Mon May 25 08:25:48 2026 -0400 net: Introduce skb tc depth field to track packet loops Add a 2-bit per-skb tc depth field to track packet loops across the stack. The previous per-CPU loop counters like MIRRED_NEST_LIMIT assume a single call stack and lose state in two cases: 1) When a packet is queued and reprocessed later (e.g., egress->ingress via backlog), the per-cpu state is gone by the time it is dequeued. 2) With XPS/RPS a packet may arrive on one CPU and be processed on another. A per-skb field solves both by travelling with the packet itself. The field fits in existing padding, using 2 bits that were previously a hole: pahole before(-) and after (+) diff looks like: __u8 slow_gro:1; /* 132: 3 1 */ __u8 csum_not_inet:1; /* 132: 4 1 */ __u8 unreadable:1; /* 132: 5 1 */ + __u8 tc_depth:2; /* 132: 6 1 */ - /* XXX 2 bits hole, try to pack */ /* XXX 1 byte hole, try to pack */ __u16 tc_index; /* 134 2 */ There used to be a ttl field which was removed as part of tc_verd in commit aec745e2c520 ("net-tc: remove unused tc_verd fields"). It was already unused by that time, due to remove earlier in commit c19ae86a510c ("tc: remove unused redirect ttl"). The first user of this field is netem, which increments tc_depth on duplicated packets before re-enqueueing them at the root qdisc. On re-entry, netem skips duplication for any skb with tc_depth already set, bounding recursion to a single level regardless of tree topology. The other user is mirred which increments it on each pass and limits to depth to MIRRED_DEFER_LIMIT (3). The new field was called ttl in earlier versions of this patch but renamed to tc_depth to avoid confusion with IP ttl. Note (looking at you Sashiko! Dont ignore me and continue bringing this up): 1. Since both mirred and netem utilize the same 2-bit tc_depth field it is possible when netem and mirred are used together that netem qdisc to skip the duplication step. This is a known trade-off, as a 2-bit field cannot independently track both features' recursion depths and it is not considered sane to have a setup that addresses both features on at the same time. 2. skb_scrub_packet does not clear tc_depth. This means a packet's loop history is preserved even across namespaces. While this might be restrictive for some topologies, it is also design intent to provide robustness against loops across namespaces. Reviewed-by: Stephen Hemminger Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260525122556.973584-2-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit 3daad7f60aa92d0307fa2b2edd38c886a09902f2 Author: Jan Polensky Date: Thu May 21 14:01:32 2026 +0200 s390/bug: Always emit format word in __BUG_ENTRY When CONFIG_DEBUG_BUGVERBOSE is disabled, the s390 __BUG_ENTRY() macro omits the format string pointer, so the generated __bug_table entry no longer matches struct bug_entry. With HAVE_ARCH_BUG_FORMAT enabled, the generic BUG infrastructure reads bug_entry::format via bug_get_format(). If the format word is missing, subsequent fields are read from the wrong offset, which may: - Misinterpret flags (BUG vs WARN classification errors) - Fault when dereferencing a misread format pointer The root cause is that __BUG_ENTRY() delegates format word emission to __BUG_ENTRY_VERBOSE(), which is conditional on CONFIG_DEBUG_BUGVERBOSE. Fix this by moving the format field emission directly into __BUG_ENTRY() so it is always emitted unconditionally. Remove the format parameter from __BUG_ENTRY_VERBOSE() and keep only file/line emission conditional on CONFIG_DEBUG_BUGVERBOSE. Fixes: 2b71b8ab9718 ("s390/bug: Use BUG_FORMAT for DEBUG_BUGVERBOSE_DETAILED") Signed-off-by: Jan Polensky Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 8aeb879baf12fe64889f019da9a4f8347c604e91 Author: Peter Zijlstra Date: Tue May 26 11:06:31 2026 +0200 x86/kvm/vmx: Fix x86_64 CFI build It was missed that idt_do_interrupt_irqoff() gets compiled on x84_64; this is a problem for CFI builds because it includes an unadorned indirect call. It is however completely dead code. Rework things to not emit this function at all. Fixes: 0701c9e17bd9 ("x86/kvm/vmx: Move IRQ/NMI dispatch from KVM into x86 core") Reported-by: Nathan Chancellor Reported-by: Calvin Owens Signed-off-by: Peter Zijlstra (Intel) Tested-by: Nathan Chancellor Link: https://patch.msgid.link/20260526090631.GA4149641@noisy.programming.kicks-ass.net commit 4c9ad387aa2d6785299722e54224d34764edaeb3 Author: Arnd Bergmann Date: Wed May 13 16:53:54 2026 +0200 iommu, debugobjects: avoid gcc-16.1 section mismatch warnings gcc-16 has gained some more advanced inter-procedual optimization techniques that enable it to inline the dummy_tlb_add_page() and dummy_tlb_flush() function pointers into a specialized version of __arm_v7s_unmap: WARNING: modpost: vmlinux: section mismatch in reference: __arm_v7s_unmap+0x2cc (section: .text) -> dummy_tlb_add_page (section: .init.text) ERROR: modpost: Section mismatches detected. >From what I can tell, the transformation is correct, as this is only called when __arm_v7s_unmap() is called from arm_v7s_do_selftests(), which is also __init. Since __arm_v7s_unmap() however is not __init, gcc cannot inline the inner function calls directly. In debug_objects_selftest(), the same thing happens. Both the caller and the leaf function are __init, but the IPA pulls it into a non-init one: WARNING: modpost: vmlinux: section mismatch in reference: lookup_object_or_alloc+0x7c (section: .text.lookup_object_or_alloc) -> is_static_object (section: .init.text) Marking the affected functions as not "__init" would reliably avoid this issue but is not a good solution because it removes an otherwise correct annotation. I tried marking the functions as 'noinline', but that ended up not covering all the affected configurations. With some more experimenting, I found that marking these functions as __attribute__((noipa)) is both logical and reliable. In order to keep the syntax readable, add a custom macro for this in include/linux/compiler_attributes.h next to other related macros and use it to annotate both files. Link: https://lore.kernel.org/all/abRB6g-48ZX6Yl2r@willie-the-truck/ Cc: Will Deacon Cc: Thomas Gleixner Cc: Andrew Morton Cc: Miguel Ojeda Cc: linux-kbuild@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann Acked-by: Will Deacon Acked-by: Thomas Gleixner Acked-by: Miguel Ojeda Signed-off-by: Joerg Roedel commit 9d5e7a46a9f6d8f503b41bfefef70659845f1679 Author: Rahul Chandelkar Date: Mon May 25 21:10:31 2026 +0530 ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment. Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr") Signed-off-by: Rahul Chandelkar Link: https://patch.msgid.link/20260525154031.2290876-1-rc@rexion.ai Signed-off-by: Jakub Kicinski commit d07e5b20f1c81f53d6e99a666b1944c6edf5be71 Merge: ce1e33020a5f36 67cfdd9210b99f Author: Jakub Kicinski Date: Wed May 27 17:42:18 2026 -0700 Merge branch 'ethtool-more-bug-fixes' Jakub Kicinski says: ==================== ethtool: more bug fixes Last week I sent two patch sets - one fixing bugs in RSS handling, and one fixing CMIS / module handling. This set contains the remaining fixes. There's a concentration of fixes around PHY and timestamp config handling but not enough to break those out as separate sets. ==================== Link: https://patch.msgid.link/20260526153533.2779187-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 67cfdd9210b99f260b3e0afeb9525e0acc7be31e Author: Jakub Kicinski Date: Tue May 26 08:35:33 2026 -0700 ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM (fallback_set_params()) validates that offset < eeprom_len, but does not check that offset + length stays within eeprom_len. The ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has always enforced both bounds: if (eeprom.offset + eeprom.len > total_len) return -EINVAL; This could lead to surprises in both drivers and device FW. Add the missing offset + length validation to fallback_set_params(), mirroring the ioctl. Similarly - ethtool core in general, and ethtool_get_any_eeprom() in particular tries to zero-init all buffers passed to the drivers to avoid any extra work of zeroing things out. eeprom_fallback() uses a plain kmalloc(), change it to zalloc. Fixes: 96d971e307cc ("ethtool: Add fallback to get_module_eeprom from netlink command") Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260526153533.2779187-11-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2376586f85f972fefe701f095bb37dcfe7405d21 Author: Jakub Kicinski Date: Tue May 26 08:35:32 2026 -0700 ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback All ethtool driver op calls should be sandwiched between ethnl_ops_begin() / ethnl_ops_complete(). In Netlink eeprom code, if the paged access failed we fall back to old API, but we first call _complete() and the fallback never does its own ethnl_ops_begin(). Move the fallback into the _begin() / _complete() section. Fixes: 96d971e307cc ("ethtool: Add fallback to get_module_eeprom from netlink command") Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260526153533.2779187-10-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a8d8bef6b45bf7cc0b1f6110c5cd8d0160a9bad7 Author: Jakub Kicinski Date: Tue May 26 08:35:31 2026 -0700 ethtool: strset: fix header attribute index in ethnl_req_get_phydev() strset_prepare_data() passes ETHTOOL_A_HEADER_FLAGS (3) as the header attribute to ethnl_req_get_phydev(). This is incorrect, in the main attr space 3 is ETHTOOL_A_STRSET_COUNTS_ONLY, not the request header attr. The correct constant is ETHTOOL_A_STRSET_HEADER (1). ethnl_req_get_phydev() only uses this value for the extack, so this is not a "functionally visible"(?) bug. Fixes: e96c93aa4be9 ("net: ethtool: strset: Allow querying phy stats by index") Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260526153533.2779187-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c3fc9976f686f9a95baf87db9d387f218fd65394 Author: Jakub Kicinski Date: Tue May 26 08:35:30 2026 -0700 ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure The goto err label leads to: genlmsg_cancel(skb, ehdr); return ret; If ethnl_tsinfo_prepare_dump() failed, it has not started a genlmsg. There's nothing to cancel, and passing an error pointer to genlmsg_cancel() would cause a crash. Fixes: b9e3f7dc9ed9 ("net: ethtool: tsinfo: Enhance tsinfo to support several hwtstamp by net topology") Reviewed-by: Maxime Chevallier Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20260526153533.2779187-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1de405699c62c3a9544bcdcfb9eff8a01cfc7582 Author: Jakub Kicinski Date: Tue May 26 08:35:29 2026 -0700 ethtool: tsinfo: fix uninitialized stats on the by-PHC path tsinfo_prepare_data() has two code paths: a "by-PHC" path for user-specified hardware timestamping providers, and the old path. Commit 89e281ebff72 ("ethtool: init tsinfo stats if requested") added ethtool_stats_init() to mark stat slots as ETHTOOL_STAT_NOT_SET before the driver callback populates them, but placed the call inside the old-path block. When commit b9e3f7dc9ed9 ("net: ethtool: tsinfo: Enhance tsinfo to support several hwtstamp by net topology") added the by-PHC early return, it landed above the stats initialization. On that path the stats array retains the zero-fill from ethnl_init_reply_data()'s zalloc. This leads to the reply including a stats nest with four zero-valued attributes that should have been absent. Reject GET requests for stats with HWTSTAMP_PROVIDER or dump. Fixes: b9e3f7dc9ed9 ("net: ethtool: tsinfo: Enhance tsinfo to support several hwtstamp by net topology") Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260526153533.2779187-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6386bd772de64e6760306eb91c7e86163af6c22f Author: Jakub Kicinski Date: Tue May 26 08:35:28 2026 -0700 ethtool: tsconfig: fix missing ethnl_ops_complete() tsconfig_prepare_data() calls ethnl_ops_begin(), we need to call ethnl_ops_complete() before returning the error. Fixes: 6e9e2eed4f39 ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config") Reviewed-by: Vadim Fedorenko Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20260526153533.2779187-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ab5bf428fb6bd361163c7247b92750d1d24ca2ed Author: Jakub Kicinski Date: Tue May 26 08:35:27 2026 -0700 ethtool: pse-pd: fix missing ethnl_ops_complete() pse_prepare_data() is missing ethnl_ops_complete() if ethnl_req_get_phydev() returned an error. Move getting phydev up so that we don't have to worry about this (similar order to linkstate_prepare_data()). Note that phydev may still be NULL (this is checked in pse_get_pse_attributes()), the goal isn't really to avoid the _begin() / _complete() calls, only to simplify the error handling. While at it propagate the original error. Why this code overrides the error with -ENODEV but !phydev generates -EOPNOTSUPP is unclear to me... Fixes: 31748765bed3 ("net: ethtool: pse-pd: Target the command to the requested PHY") Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260526153533.2779187-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 596c51ed9e125b12c4d85b4530dfd4c7847634b7 Author: Jakub Kicinski Date: Tue May 26 08:35:26 2026 -0700 ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error linkstate_prepare_data() calls ethnl_req_get_phydev() before ethnl_ops_begin(), but routes its error path through "goto out" which calls ethnl_ops_complete(). Fixes: fe55b1d401c6 ("ethtool: linkstate: migrate linkstate functions to support multi-PHY setups") Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260526153533.2779187-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a888bbd43940cada72f7686337741ce86d1cf869 Author: Jakub Kicinski Date: Tue May 26 08:35:25 2026 -0700 ethtool: tsconfig: fix reply error handling A couple of trivial bugs in error handling in tsconfig_send_reply(). If we failed to allocate rskb we need to set the error. If we did allocate it but failed to send it - we need to remember to free it. Fixes: 6e9e2eed4f39 ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config") Reviewed-by: Vadim Fedorenko Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20260526153533.2779187-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7281b096b072f6c6e30420e3467d738f2e4c4b57 Author: Jakub Kicinski Date: Tue May 26 08:35:24 2026 -0700 ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION nest list with an index 'i' and writes new_profile[i++] without bounding i. The destination is kmemdup()'d at NET_DIM_PARAMS_NUM_PROFILES entries (5), but the Netlink nest count is entirely user-controlled. Netlink policies do not have support for constraining the number of nested entries (or number of multi-attr entries). Fixes: f750dfe825b9 ("ethtool: provide customized dim profile management") Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260526153533.2779187-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ce1e33020a5f365823e9a0bfd18d6b3f20e206c6 Merge: 8ba68464e4787b 147f3b1f23cbd7 Author: Jakub Kicinski Date: Wed May 27 17:23:07 2026 -0700 Merge branch 'bridge-fix-sleep-in-atomic-context' Ido Schimmel says: ==================== bridge: Fix sleep in atomic context Under certain circumstances the bridge driver can call dev_set_promiscuity() while holding the bridge spin lock. This is a problem as dev_set_promiscuity() might sleep. Patches #1-#2 fix the problem in the netlink and sysfs configuration paths by only taking the lock where it is actually needed, thereby avoiding calling dev_set_promiscuity() from an atomic context. Patch #3 adds test cases for both configuration paths in rtnetlink.sh which already includes test cases for similar issues. Note that dev_set_promiscuity() can sleep either when it takes the net device mutex or when calling netif_rx_mode_sync(). I encountered the problem with the latter, but blamed the former since it came earlier. ==================== Link: https://patch.msgid.link/20260526064818.272516-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 147f3b1f23cbd74f1022cc5689570a06f6bc47c8 Author: Ido Schimmel Date: Tue May 26 09:48:18 2026 +0300 selftests: rtnetlink: Add bridge promiscuity tests Add two test cases that always pass, but trigger sleeping in atomic context BUGs without "bridge: Fix sleep in atomic context in netlink path" and "bridge: Fix sleep in atomic context in sysfs path". Reviewed-by: Nikolay Aleksandrov Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20260526064818.272516-4-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 6d34594cc619d0d4b07d5afcad8b5984f3526dcf Author: Ido Schimmel Date: Tue May 26 09:48:17 2026 +0300 bridge: Fix sleep in atomic context in sysfs path Since the start of the git history, brport_store() always acquired the bridge lock. Back then this decision made sense: The bridge lock protects the STP state of the bridge and its ports and at that time the function was only used by two STP related attributes (cost and priority). Nowadays, brport_store() processes a lot more attributes and most of them do not need the bridge lock: * Bridge flags: Only require RTNL. Read locklessly by the data path. Annotations can be added in net-next. * FDB port flushing: Only requires the FDB lock. * Multicast attributes: Only require the multicast lock. * Group forward mask: Only requires RTNL. Read locklessly by the data path. Annotations can be added in net-next. * Backup port: Only requires RTNL. Read locklessly by the data path. This is a problem as the bridge calls dev_set_promiscuity() when certain bridge port flags change and this function can sleep since the commit cited below, resulting in a splat such as [1]. Fix this by reducing the scope of the bridge lock and only take it when processing the two STP related attributes that require it. Remove the now stale comment from br_switchdev_set_port_flag(). The SWITCHDEV_F_DEFER flag can be removed in net-next. [1] BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c:1262 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 372, name: bash preempt_count: 201, expected: 0 RCU nest depth: 0, expected: 0 5 locks held by bash/372: #0: ffff88810c51c3f0 (sb_writers#7){.+.+}-{0:0}, at: ksys_write (fs/read_write.c:740) #1: ffff888115ce9480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter (fs/kernfs/file.c:343) #2: ffff88810b9fd330 (kn->active#37){.+.+}-{0:0}, at: kernfs_fop_write_iter (fs/kernfs/file.c:80 fs/kernfs/file.c:344) #3: ffffffffa59473a0 (rtnl_mutex){+.+.}-{4:4}, at: brport_store (net/bridge/br_sysfs_if.c:326) #4: ffff8881099d2d58 (&br->lock){+...}-{3:3}, at: brport_store (./include/linux/spinlock.h:348 net/bridge/br_sysfs_if.c:345) Preemption disabled at: 0x0 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) __might_resched.cold (kernel/sched/core.c:9163) netif_rx_mode_run (net/core/dev_addr_lists.c:1262) netif_rx_mode_sync (net/core/dev_addr_lists.c:1428) dev_set_promiscuity (net/core/dev_api.c:289) br_manage_promisc (net/bridge/br_if.c:135 net/bridge/br_if.c:172) br_port_flags_change (net/bridge/br_if.c:242 net/bridge/br_if.c:747) store_learning (net/bridge/br_sysfs_if.c:79 net/bridge/br_sysfs_if.c:235) brport_store (net/bridge/br_sysfs_if.c:346) kernfs_fop_write_iter (fs/kernfs/file.c:352) new_sync_write (fs/read_write.c:595) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Fixes: 78cd408356fe ("net: add missing instance lock to dev_set_promiscuity") Reviewed-by: Nikolay Aleksandrov Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20260526064818.272516-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 5eec4427b89c2fb2beac54920101e55a2f1c0c21 Author: Ido Schimmel Date: Tue May 26 09:48:16 2026 +0300 bridge: Fix sleep in atomic context in netlink path Since the introduction of the netlink configuration path for bridge ports in commit 25c71c75ac87 ("bridge: bridge port parameters over netlink"), br_setport() was always called with the bridge lock held around it. Back then this decision made sense: The bridge lock protects the STP state of the bridge and its ports and at that time the function only processed three STP related netlink attributes (cost, priority and state). Nowadays, br_setport() processes a lot more attributes and most of them do not need the bridge lock: * Bridge flags: Only require RTNL. Read locklessly by the data path. Annotations can be added in net-next. * FDB port flushing: Only requires the FDB lock. * Multicast attributes: Only require the multicast lock. * Group forward mask: Only requires RTNL. Read locklessly by the data path. Annotations can be added in net-next. * Backup port and NHID: Only require RTNL. Read locklessly by the data path. This is a problem as the bridge calls dev_set_promiscuity() when certain bridge port flags change and this function can sleep since the commit cited below, resulting in a splat such as [1]. Fix this by reducing the scope of the bridge lock and only take it when processing the three STP related attributes that require it. This is consistent with the multicast attributes where each attribute acquires the multicast lock instead of having one critical section for all relevant attributes. [1] BUG: sleeping function called from invalid context at net/core/dev_addr_lists.c:1262 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 356, name: bridge preempt_count: 201, expected: 0 RCU nest depth: 0, expected: 0 2 locks held by bridge/356: #0: ffffffff919473a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg (net/core/rtnetlink.c:80 net/core/rtnetlink.c:7002) #1: ffff888115072d58 (&br->lock){+...}-{3:3}, at: br_setlink (./include/linux/spinlock.h:348 net/bridge/br_netlink.c:1117) Preemption disabled at: 0x0 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) __might_resched.cold (kernel/sched/core.c:9163) netif_rx_mode_run (net/core/dev_addr_lists.c:1262) netif_rx_mode_sync (net/core/dev_addr_lists.c:1428) dev_set_promiscuity (net/core/dev_api.c:289) br_manage_promisc (net/bridge/br_if.c:135 net/bridge/br_if.c:172) br_port_flags_change (net/bridge/br_if.c:242 net/bridge/br_if.c:747) br_setport (net/bridge/br_netlink.c:1000) br_setlink (net/bridge/br_netlink.c:1118) rtnl_bridge_setlink (net/core/rtnetlink.c:5572) rtnetlink_rcv_msg (net/core/rtnetlink.c:7005) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1318 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sock_sendmsg (net/socket.c:787 (discriminator 4) net/socket.c:802 (discriminator 4)) ____sys_sendmsg (net/socket.c:2698) ___sys_sendmsg (net/socket.c:2752) __sys_sendmsg (net/socket.c:2784) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Fixes: 78cd408356fe ("net: add missing instance lock to dev_set_promiscuity") Reviewed-by: Nikolay Aleksandrov Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20260526064818.272516-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 8ba68464e4787b6a7ec938826e16124df20fd23d Author: Oliver Hartkopp Date: Tue May 26 21:33:19 2026 +0200 bonding: refuse to enslave CAN devices syzbot reported a kernel paging request crash in can_rx_unregister() inside net/can/af_can.c. The crash occurs because a virtual CAN device (vxcan) is being enslaved to a bonding master. During the enslavement process, the bonding driver mutates and modifies the network device states to fit an Ethernet-like aggregation model. However, CAN devices operate on a completely different Layer 2 architecture, relying on the CAN mid-layer private data structure (can_ml_priv) instead of standard Ethernet structures. Since bonding does not initialize or maintain these CAN structures, subsequent operations on the half-enslaved interface (such as closing associated sockets via isotp_release) lead to a null-pointer dereference when accessing the CAN receiver lists. Bonding CAN interfaces is architecturally invalid as CAN lacks MAC addresses, ARP capabilities, and standard Ethernet link-layer mechanisms. While generic loopback devices are blocked globally in net/core/dev.c, virtual CAN devices bypass this check because they do not carry the IFF_LOOPBACK flag, despite acting as local software-loopbacks. Fix this by explicitly blocking network devices of type ARPHRD_CAN from being enslaved at the very beginning of bond_enslave(). This prevents illegal state mutations, eliminates the resulting KASAN crashes, and avoids potential memory leaks from incomplete socket cleanups. As the CAN support has been added a long time after bonding the Fixes-tag points to the introduction of ARPHRD_CAN that would have needed a specific handling in bonding_main.c. Fixes: cd05acfe65ed ("[CAN]: Allocate protocol numbers for PF_CAN") Reported-by: syzbot+8ed98cbd0161632bce95@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8ed98cbd0161632bce95 Signed-off-by: Oliver Hartkopp Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20260526-bonding-candev-v1-1-ba1df400918a@hartkopp.net Signed-off-by: Jakub Kicinski commit 98e0fc32e53dd62cd38a0d67eaf5846ae20078cc Author: Anirudh Rayabharam (Microsoft) Date: Wed May 13 13:25:56 2026 +0000 mshv: support 1G hugepages by passing them as 2M-aligned chunks The hypervisor's map GPA hypercall coalesces contiguous 2M-aligned chunks into 1G mappings when alignment permits, so the driver can support 1G hugepages by feeding them in as 2M chunks. Note that this is the only way to make 1G mappings; there is no way to directly map a 1G hugepage using the hypercall. Always emit a 2M (PMD_ORDER) stride for the huge-page case. The hypercall has no 1G stride, so 1G folios are processed as a sequence of 2M chunks. Folios whose order is less than PMD_ORDER (e.g. mTHP) fall back to single-page stride; mapping them as 2M would fail in the hypervisor anyway. Assisted-by: Copilot-CLI:claude-opus-4.7 Signed-off-by: Anirudh Rayabharam (Microsoft) Acked-by: Stanislav Kinsburskii Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 016a25e4b0df4d77e7c258edee4aaf982e4ee809 Author: Dexuan Cui Date: Thu May 7 14:28:38 2026 -0700 Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs If vmbus_reserve_fb() in the kdump/kexec kernel fails to properly reserve the framebuffer MMIO range (which is below 4GB) due to a Gen2 VM's screen.lfb_base being zero [1], there is an MMIO conflict between the drivers hyperv-drm and pci-hyperv: when the driver pci-hyperv's hv_allocate_config_window() calls vmbus_allocate_mmio() to get an MMIO range, typically it gets a 32-bit MMIO range that overlaps with the framebuffer MMIO range, and later hv_pci_enter_d0() fails with an error message "PCI Pass-through VSP failed D0 Entry with status" since the host thinks that PCI devices must not use MMIO space that the host has assigned to the framebuffer. This is especially an issue if pci-hyperv is built-in and hyperv-drm is built as a module. Consequently, the kdump/kexec kernel fails to detect PCI devices via pci-hyperv, and may fail to mount the root file system, which may reside in a NVMe disk. The issue described here has existed for SR-IOV VF NICs since day one of the pci-hyperv driver, and has been worked around on x64 when possible. With the recent introduction of ARM64 VMs that boot from NVMe, there is no workaround, so we need a formal fix. On Gen2 VMs, if the screen.lfb_base is 0 in the kdump/kexec kernel [1], fall back to the low MMIO base, which should be equal to the framebuffer MMIO base [2] (the statement is true according to my testing on x64 Windows Server 2016, and on x64 and ARM64 Windows Server 2025 and on Azure. I checked with the Hyper-V team and they said the statement should continue to be true for Gen2 VMs). In the first kernel, screen.lfb_base is not 0; if the user specifies a very high resolution, it's not enough to only reserve 8MB: let's always reserve half of the space below 4GB, but cap the reservation to 128MB, which is the required framebuffer size of the highest resolution 7680*4320 supported by Hyper-V. While at it, fix the comparison "end > VTPM_BASE_ADDRESS" by changing the > to >=. Here the 'end' is an inclusive end (typically, it's 0xFFFF_FFFF for the low MMIO range). Note: vmbus_reserve_fb() now also reserves an MMIO range at the beginning of the low MMIO range on CVMs, which have no framebuffers (the 'screen.lfb_base' in vmbus_reserve_fb() is 0 for CVMs), just in case the host might treat the beginning of the low MMIO range specially [3]. BTW, the OpenHCL kernel is not affected by the change, because that kernel boots with DeviceTree rather than ACPI (so vmbus_reserve_fb() won't run there), and there is no framebuffer device for that kernel. Note: normally Gen1 VMs don't have the MMIO conflict issue because the framebuffer MMIO range (which is hardcoded to base=4GB-128MB and size=64MB for Gen1 VMs by the host) is always reported via the legacy PCI graphics device's BAR, so the kdump/kexec kernel can reserve the 64MB MMIO range; however, if the VM is configured to use a very high resolution and the required framebuffer size exceeds 64MB (AFAIK, in practice, this isn't a typical configuration by users), the hyperv-drm driver may need to allocate an MMIO range above 4GB and change the framebuffer MMIO location to the allocated MMIO range -- in this case, there can still be issues [4] which can't be easily fixed: any possible affected Gen1 users would have to use a resolution whose framebuffer size is <= 64MB, or switch to Gen2 VMs. [1] https://lore.kernel.org/all/SA1PR21MB692176C1BC53BFC9EAE5CF8EBF51A@SA1PR21MB6921.namprd21.prod.outlook.com/ [2] https://lore.kernel.org/all/SA1PR21MB69218F955B62DFF62E3E88D2BF222@SA1PR21MB6921.namprd21.prod.outlook.com/ [3] https://lore.kernel.org/all/SN6PR02MB415726B17D5A6027CD1717E8D4342@SN6PR02MB4157.namprd02.prod.outlook.com/ [4] https://lore.kernel.org/all/SA1PR21MB69213486F821CA5A2C793C81BF342@SA1PR21MB6921.namprd21.prod.outlook.com/ Fixes: 4daace0d8ce8 ("PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs") CC: stable@vger.kernel.org Reviewed-by: Michael Kelley Tested-by: Krister Johansen Tested-by: Matthew Ruffell Signed-off-by: Dexuan Cui Signed-off-by: Wei Liu commit c53763aa2b9c96fbabee68ebe1e13074cb09bfb2 Author: Can Peng Date: Wed May 20 15:16:32 2026 +0800 mshv: use kmalloc_array in mshv_root_scheduler_init Replace kmalloc() with kmalloc_array() to prevent potential overflow, as recommended in Documentation/process/deprecated.rst. No functional change. Signed-off-by: Can Peng Signed-off-by: Wei Liu commit a17dc12bfed8868e6a86f3b45c16065a70641acb Author: Alexis Lothoré (eBPF Foundation) Date: Wed May 27 21:12:31 2026 +0200 x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform (eg: Skylake), with retbleed=stuff, registering a dynamic ftrace trampoline crashes on the first call into the traced function: BUG: unable to handle page fault for address: ffff88817ae18880 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 4b53067 P4D 4b53067 PUD 0 Oops: Oops: 0002 [#1] SMP PTI CPU: 3 UID: 0 PID: 187 Comm: usleep Not tainted 7.0.10 #243 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 Code: 24 78 00 00 00 00 48 89 ea 48 89 54 24 20 48 8b b4 24 b8 00 00 00 48 8b bc 24 b0 00 00 00 48 89 bc 24 80 00 00 00 48 83 ef 05 <65> 48 c1 3d 1f a8 b6 02 05 48 8b 15 f6 00 00 00 4c 89 3c 24 4c 89 Call Trace: ? find_held_lock ? exc_page_fault ? lock_release ? __x64_sys_clock_nanosleep ? lockdep_hardirqs_on_prepare ? trace_hardirqs_on __x64_sys_clock_nanosleep do_syscall_64 ? exc_page_fault ? call_depth_return_thunk entry_SYSCALL_64_after_hwframe ... Kernel panic - not syncing: Fatal exception This small reproducer allows to easily trigger the crash: # echo 'p __x64_sys_clock_nanosleep' > /sys/kernel/tracing/kprobe_events # echo 1 > /sys/kernel/tracing/events/kprobes/p___x64_sys_clock_nanosleep_0/enable # usleep 1 Monitoring the crash under GDB points to the exact instruction in charge of incrementing the call depth: sarq $5, %gs:__x86_call_depth(%rip) This instruction matches the one inserted by the ftrace_regs_caller from ftrace_64.S. This emitted code was likely working fine until the introduction of 59bec00ace28 ("x86/percpu: Introduce %rip-relative addressing to PER_CPU_VAR()"): it has made the call depth accounting addressing relative to $rip, instead of being based on an absolute address. As this code exact location depends on where the trampoline lives in memory, the corresponding displacement needs to be adjusted at runtime to actually correctly find the per-cpu __x86_call_depth value, otherwise the targeted address is wrong, leading to the page fault seen above. Fix the %rip-relative displacement of the copied CALL_DEPTH_ACCOUNT instruction (from ftrace_regs_caller) by calling text_poke_apply_relocation(), as it is done for example by the x86 BPF JIT compiler through x86_call_depth_emit_accounting(). This corrects both CALL_DEPTH_ACCOUNT slots, in ftrace_caller and ftrace_regs_caller. [ bp: Massage. ] Fixes: 59bec00ace28 ("x86/percpu: Introduce %rip-relative addressing to PER_CPU_VAR()") Signed-off-by: Alexis Lothoré (eBPF Foundation) Signed-off-by: Borislav Petkov (AMD) Acked-by: Peter Zijlstra (Intel) Acked-by: Steven Rostedt Cc: Link: https://patch.msgid.link/20260527-fix_call_depth_in_trampoline-v1-1-1c1abc8ae310@bootlin.com commit 9d2491197a00acf8c423512078458c2855102b66 Author: Steve French Date: Fri May 22 18:28:49 2026 -0500 smb: client: fix uninitialized variable in smb2_writev_callback compiling with W=2 pointed out that "written may be used uninitialized" Fixes: 20d72b00ca81 ("netfs: Fix the request's work item to not require a ref") Cc: stable@vger.kernel.org Reviewed-by: David Howells Signed-off-by: Steve French commit 426a35d7530722ffa2d89d759c39f5157e0e500d Author: Jeremy Erazo Date: Wed May 20 18:23:31 2026 +0000 smb: client: detect short folioq copy in cifs_copy_folioq_to_iter() cifs_copy_folioq_to_iter() copies a requested number of bytes from a folio queue into the destination iterator. Since the encrypted SMB2 READ path was changed to pass the server-declared payload length (data_len) instead of the larger folioq buffer length, the caller can ask for fewer bytes than the folio queue holds. In that case the helper continues walking the remaining folios after data_size has reached zero and calls copy_folio_to_iter() with len = 0, which is unnecessary work. The helper also returns 0 (success) when the folio queue is exhausted before data_size bytes have been copied. The caller has no way to distinguish that from a full copy and the reported transfer count ends up larger than the amount of data placed in the iterator. Add an early exit when data_size reaches zero, and return an error when the folio queue is exhausted before all requested bytes have been copied. Signed-off-by: Jeremy Erazo Reviewed-by: David Howells Signed-off-by: Steve French commit 840b740a35bf969734e0f2e44c21289fdd03079e Author: Michael Kelley Date: Tue May 26 07:13:04 2026 -0700 mshv: Add conditional VMBus dependency When the VMBus driver is not part of the kernel (CONFIG_HYPERV_VMBUS=n), the MSHV root driver fails to link: ERROR: modpost: "hv_vmbus_exists" [drivers/hv/mshv_root.ko] undefined! Fix this while meeting these requirements: * It must be possible to include the MSHV root driver without the VMBus driver. In such case, the MSHV root driver can be built-in to the kernel image, or it can be built as a separate module. * If both the MSHV root driver and the VMBus driver are present, the MSHV root driver and VMBus driver can both be built-in, or they can both be separate modules. Or the MSHV root driver can be a module while the VMBus driver can be built-in, but the reverse is disallowed. Regardless of the build choices, the VMBus driver must be loaded before the MSHV driver in order for the SynIC to be managed properly (see comments in the MSHV SynIC code). The fix has two parts: * Add a Kconfig entry for MSHV_ROOT to depend on HYPERV_VMBUS if HYPERV_VMBUS is present. The entry disallows MSHV_ROOT being built-in when HYPERV_VMBUS is a module, but without requiring that HYPERV_VMBUS be built. * Add a stub implementation of hv_vmbus_exists() for when the VMBus driver is not present so that the MSHV root driver has no module dependency on VMBus. When the VMBus driver *is* present, the module dependency ensures that the VMBus driver loads first when both are built as modules. Existing code ensures that the VMBus driver loads first if it is built-in. The VMBus driver uses subsys_initcall(), which is initcall level 4. The MSHV root driver uses module_init(), which becomes device_init() when built-in, and device_init() is initcall level 6. Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/all/20260520074044.923728-1-arnd@kernel.org/ Signed-off-by: Michael Kelley Acked-by: Arnd Bergmann Reviewed-by: Jork Loeser Reviewed-by: Hardik Garg Signed-off-by: Wei Liu commit 83eb00f31eb1b10735d48e469df72cc2b0e06f6d Author: Dexuan Cui Date: Wed May 27 12:21:01 2026 -0700 hyperv: Clean up and fix the guest ID comment in hvgdk.h Change the "64 bit" to "64-bit", and the "Os" to "OS". Remove the obsolete paragraph since the guideline has been published in the Hypervisor Top Level Functional Specification for many years. The "OS Type" is 0x1 for Linux, not 0x100. No functional change. Fixes: 83ba0c4f3f31 ("Drivers: hv: Cleanup the guest ID computation") Signed-off-by: Dexuan Cui Reviewed-by: Hamza Mahfooz Signed-off-by: Wei Liu commit fa21e86caba2347e89eb65af926205a36a097c53 Author: Shuai Zhang Date: Mon May 25 14:51:56 2026 +0800 Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading When bt_en is pulled high by hardware, the host does not re-download the firmware after SSR. The controller loads the rampatch and NVM internally. On HMT chip, the rampatch is ~264 KB and the NVM is ~9.4 KB. The loading process takes approximately 70 ms. The previous 50 ms delay is too short, causing the controller to not respond to the reset command sent by the host, which leads to BT initialization failure: Bluetooth: hci0: QCA memdump Done, received 458752, total 458752 Bluetooth: hci0: mem_dump_status: 2 Bluetooth: hci0: Opcode 0x0c03 failed: -110 Increase the delay to 100 ms, which was confirmed as a safe value by the controller, to ensure the controller has finished loading the firmware before the host sends commands. Steps to reproduce: 1. Trigger SSR and wait for SSR to complete: hcitool cmd 0x3f 0c 26 2. Run "bluetoothctl power on" and observe that BT fails to start. Fixes: fce1a9244a0f ("Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT_EN is pulled up by hw") Cc: stable@vger.kernel.org Reviewed-by: Dmitry Baryshkov Signed-off-by: Shuai Zhang Signed-off-by: Luiz Augusto von Dentz commit bfea6091e0fffb270c20e74384b660910277eb6c Author: Doruk Tan Ozturk Date: Mon May 25 18:24:38 2026 +0200 Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL: hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL); While hci_conn_del() dequeues with data=conn: hci_cmd_sync_dequeue(hdev, NULL, conn, NULL); Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never matches, and the pending work item is not cancelled. Fix this by saving conn->conn_timeout into a local variable while the locks are still held, so the stale conn pointer is never dereferenced after unlock. This is the same class of bug as the one fixed by commit 035c25007c9e ("Bluetooth: hci_sync: Fix UAF on le_read_features_complete") which addressed the identical pattern in a different function. This vulnerability was identified using 0sec.ai, an open-source automated security auditing platform (https://github.com/0sec-labs). Fixes: c09b80be6ffc ("Bluetooth: hci_conn: Fix not waiting for HCI_EVT_LE_CIS_ESTABLISHED") Cc: stable@vger.kernel.org Reported-by: Doruk Tan Ozturk Signed-off-by: Doruk Tan Ozturk Signed-off-by: Luiz Augusto von Dentz commit 3c40d381ce04f9575a5d8b542898183c3b4b38dc Author: Zhao Dongdong Date: Tue May 26 11:21:39 2026 +0800 Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() The skb_clone() function can return NULL if memory allocation fails. send_mcast_pkt() calls skb_clone() without checking the return value, which can lead to a NULL pointer dereference in send_pkt() when it dereferences skb->data. Add a NULL check after skb_clone() and skip the peer if the clone fails. Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices") Signed-off-by: Zhao Dongdong Signed-off-by: Luiz Augusto von Dentz commit 82855073c1081732656734b74d7d1d5e4cfd0da7 Author: Shuai Zhang Date: Thu May 21 13:25:47 2026 +0800 Bluetooth: btusb: Allow firmware re-download when version matches The Bluetooth host decides whether to download firmware by reading the controller firmware download completion flag and firmware version information. If a USB error occurs during the firmware download process (for example due to a USB disconnect), the download is aborted immediately. An incomplete firmware transfer does not cause the controller to set the download completion flag, but the firmware version information may be updated at an early stage of the download process. In this case, after USB reconnection, the host attempts to re-download the firmware because the download completion flag is not set. However, since the controller reports the same firmware version as the target firmware, the download is skipped. This ultimately results in the firmware not being properly updated on the controller. This change removes the restriction that skips firmware download when the versions are equal. It covers scenarios where the USB connection can be disconnected at any time and ensures that firmware download can be retriggered after USB reconnection, allowing the Bluetooth firmware to be correctly and completely updated. Fixes: 3267c884cefa ("Bluetooth: btusb: Add support for QCA ROME chipset family") Cc: stable@vger.kernel.org Signed-off-by: Shuai Zhang Signed-off-by: Luiz Augusto von Dentz commit 2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6 Author: Muhammad Bilal Date: Wed May 20 18:56:43 2026 -0400 Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough data. hidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching to hidp_input_report(). If a paired device sends a truncated packet, the handler reads beyond the valid skb data, resulting in an out-of-bounds read of skb data. The OOB bytes may be interpreted as phantom key presses or spurious mouse movement. Replace the open-coded length tracking and pointer arithmetic with skb_pull_data() calls. skb_pull_data() returns NULL if the requested bytes are not present, eliminating the need for a manual size variable and the separate skb->len guard. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal Signed-off-by: Luiz Augusto von Dentz commit 8c8e620467a7b51562dbcefbd1f09f288d7d710d Author: Siwei Zhang Date: Wed May 20 22:12:20 2026 -0400 Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close() removes the channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs under the parent sk_lock, so acquiring conn->lock would invert the established conn->lock -> chan->lock -> sk_lock order. Instead of calling l2cap_chan_close() directly, schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously. The timeout handler already acquires conn->lock and chan->lock in the correct order. The timer is only armed when chan->conn is still set: if it is already NULL, l2cap_conn_del() has already processed this channel (l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb), so there is nothing left to do. If l2cap_conn_del() races in after the timer is armed, __clear_chan_timer() inside l2cap_chan_del() cancels it; if the timer has already fired, the handler returns harmlessly because chan->conn was cleared. Fixes: 3df91ea20e74 ("Bluetooth: Revert to mutexes from RCU list") Cc: # 0b58004: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Signed-off-by: Siwei Zhang Signed-off-by: Luiz Augusto von Dentz commit 9dbd84990394c51f5cee1e8871bb5ff8af5ed939 Author: Siwei Zhang Date: Wed May 20 22:30:36 2026 -0400 Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the end, but the early return when chan->conn is NULL skips the put, leaking the reference. Add the missing l2cap_chan_put() before the early return. Fixes: adf0398cee86 ("Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout") Cc: stable@vger.kernel.org Signed-off-by: Siwei Zhang Signed-off-by: Luiz Augusto von Dentz commit bfa9d28960ed677d556bdf097073bc3129686229 Author: Pavitra Jha Date: Thu May 21 04:04:14 2026 -0400 Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() hci_le_big_terminate() allocates iso_list_data via kzalloc_obj but returns 0 without freeing it when neither pa_sync_term nor big_sync_term flags are set after evaluating the PA and BIG sync connection state. This early-return path was introduced when hci_le_big_terminate() was refactored to take struct hci_conn instead of raw u8 parameters, adding PA/BIG flag evaluation logic. The existing kfree() on hci_cmd_sync_queue failure does not cover this path. Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections") Cc: stable@vger.kernel.org Signed-off-by: Pavitra Jha Signed-off-by: Luiz Augusto von Dentz commit b565a73baec275a3f4b49c1300ab396daf4a748e Author: Zicheng Qu Date: Wed May 27 17:38:50 2026 +0800 tools/sched_ext: Fix scx_show_state per-scheduler state reads scx_show_state.py still reads scx_aborting and scx_bypass_depth as global symbols. Those symbols no longer exist after the state was moved into struct scx_sched, so the drgn script fails when it reaches either field. Read aborting and bypass_depth from scx_root instead. This preserves the script's current root-scheduler view: with sub-scheduler support, the reported values are for the root scheduler and sub-schedulers are not enumerated. Fixes: 5c8d98a1b4de ("sched_ext: Move bypass state into scx_sched") Fixes: c1743da43cf5 ("sched_ext: Move aborting flag to per-scheduler field") Signed-off-by: Zicheng Qu Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 645c3b7ef1a7eed9627664bd11d7a8eb4519ee15 Author: Sun Shaojie Date: Wed May 27 15:05:09 2026 +0800 cgroup/cpuset: Add test cases for sibling CPU exclusion on partition update When sibling CPU exclusion occurs, a partition's effective_xcpus may be a subset of its user_xcpus. The partcmd_update path must use effective_xcpus instead of user_xcpus when calculating CPUs to return to or request from the parent. Add two test cases to verify this behavior: 1) Narrowing cpuset.cpus to only the sibling-excluded CPUs should not return CPUs to parent that the partition never actually owned. 2) Expanding cpuset.cpus after a sibling becomes a member should correctly request the additional CPUs from parent. Co-developed-by: Zhang Guopeng Signed-off-by: Zhang Guopeng Signed-off-by: Sun Shaojie Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 0a68853de27b522bca2b9934127277185374a24f Author: Sun Shaojie Date: Wed May 27 14:43:28 2026 +0800 cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask calculation When sibling CPU exclusion occurs, a partition's user_xcpus may contain CPUs that were never actually granted to it. These CPUs are present in user_xcpus(cs) but not in cs->effective_xcpus. The partcmd_update path in update_parent_effective_cpumask() uses user_xcpus(cs) (via the local variable xcpus) to compute the addmask (CPUs to return to parent) and delmask (CPUs to request from parent). This is incorrect: 1) When newmask removes a CPU that was previously excluded by a sibling, addmask incorrectly includes that CPU and tries to return it to the parent even though the partition never actually owned it, causing CPU overlap with sibling partitions and triggering warnings in generate_sched_domains(). 2) When newmask adds a previously excluded CPU that is now available, delmask fails to request it from the parent because user_xcpus(cs) already includes it. Fix this by using cs->effective_xcpus instead of user_xcpus(cs) in all partcmd_update paths that calculate addmask or delmask, including the PERR_NOCPUS error handling paths. Reproducers: Example 1 - Removing a sibling-excluded CPU incorrectly returns it: # cd /sys/fs/cgroup # echo "0-1" > a1/cpuset.cpus # echo "root" > a1/cpuset.cpus.partition # echo "0-2" > b1/cpuset.cpus # echo "root" > b1/cpuset.cpus.partition # echo "2" > b1/cpuset.cpus # cat cpuset.cpus.effective # Actual: 0-1,3 Expected: 3 Example 2 - Expanding to a previously excluded CPU fails to request it: # cd /sys/fs/cgroup # echo "0-1" > a1/cpuset.cpus # echo "root" > a1/cpuset.cpus.partition # echo "0-2" > b1/cpuset.cpus # echo "root" > b1/cpuset.cpus.partition # echo "member" > a1/cpuset.cpus.partition # echo "1-2" > b1/cpuset.cpus # cat cpuset.cpus.effective # Actual: 0-1,3 Expected: 0,3 Fixes: 2a3602030d80 ("cgroup/cpuset: Don't invalidate sibling partitions on cpuset.cpus conflict") Cc: stable@vger.kernel.org # v7.0+ Suggested-by: Zhang Guopeng Signed-off-by: Sun Shaojie Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 880fa3a1e5c493d0deafe9153f8c2bed427b9428 Author: Shivam Kalra Date: Sat May 23 00:24:32 2026 +0530 rust: helpers: add is_vmalloc_addr wrapper for NOMMU builds Commit 47ac2a4b5cd8 ("rust: kvec: implement shrink_to for KVVec") introduced a call to bindings::is_vmalloc_addr(). However, this fails to compile on architectures where CONFIG_MMU is disabled, resulting in the following build error: error[E0425]: cannot find function `is_vmalloc_addr` in crate `bindings` --> rust/kernel/alloc/kvec.rs:781:32 | 781 | if !unsafe { bindings::is_vmalloc_addr(self.ptr.as_ptr().cast()) } { | ^^^^^^^^^^^^^^^ not found in `bindings` When CONFIG_MMU is not set, is_vmalloc_addr() is defined as a static inline function in that unconditionally returns false. Because bindgen skips static inline functions when generating bindings, the symbol is completely missing from the Rust bindings crate. Fix this by providing a C helper wrapper, rust_helper_is_vmalloc_addr(), in rust/helpers/vmalloc.c. This ensures the function is reliably exposed to Rust regardless of the MMU configuration. On NOMMU builds, this allows KVVec::shrink_to() to successfully compile and correctly route all allocations through the kmalloc realloc path. Fixes: 47ac2a4b5cd8 ("rust: kvec: implement shrink_to for KVVec") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605220811.LRplxeBR-lkp@intel.com/ Signed-off-by: Shivam Kalra Reviewed-by: Danilo Krummrich Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260523-is-vmalloc-addr-build-fix-v1-1-73c919440c41@zohomail.in [ Pasted exact compiler output and expanded it. - Miguel ] Signed-off-by: Miguel Ojeda commit 1c824497d8acd3187d585d6187cedc1897dcc871 Author: Christian König Date: Wed Feb 18 12:31:29 2026 +0100 drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx Otherwise we don't invalidate page tables on next CS. Signed-off-by: Christian König Reviewed-by: Vitaly Prosyak Tested-by: Vitaly Prosyak Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit b6444d1bcbc34f6f2a31a3aab3059be082f3683e) Cc: stable@vger.kernel.org commit 962d684b5dc0741dcd93485d41b450de402d5592 Author: Christian König Date: Wed Feb 18 12:53:27 2026 +0100 drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized return value and use the common define for 2G range. Signed-off-by: Christian König Reviewed-by: Vitaly Prosyak Tested-by: Vitaly Prosyak Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit c08972f555945cda57b0adb72272a37910153390) Cc: stable@vger.kernel.org commit 181307acf8ea597ad63fd574b44d0f98a329a61b Author: Sunil Khatri Date: Wed May 20 16:39:49 2026 +0530 drm/amdgpu/userq: use array instead of list for userq_vas Use arrays instead of list for userq_vas since we have fixed no of bos. Also, we dont have to worry to free that memory later since this array would be free along with queue only. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit ef7dc711a664b0c548ecfdf13a00436b7446b8e7) commit 0b8a1600ab50f331aeeba47c777a1b34cba606bf Author: Sunil Khatri Date: Wed May 20 16:25:50 2026 +0530 drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj valid mqd_destroy cleans up queue core objects like mqd and fw_object which are needed for any pending fence to signal properly. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 4ad65d610096498c8e265615aba42b3c47441bb5) commit 93f5534b35a05ef8a0109c1eefa800062fee810a Author: Eric Huang Date: Tue May 12 10:19:52 2026 -0400 drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger get_queue_ids() computes array_size = num_queues * sizeof(uint32_t), which could overflow on 32-bit size_t build. using array_size() instead, it saturates to SIZE_MAX on overflow. Signed-off-by: Eric Huang Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 2d57a0475f085c08b49312dfd8edcb461845f285) Cc: stable@vger.kernel.org commit ca8e7a119a2e4045324cffb8f9f58bedcc3dc928 Author: Sunil Khatri Date: Wed May 20 16:13:09 2026 +0530 drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapper Remove the amdgpu_userq_create/destroy_object wrappers and use directly the kernel bo allocation function which does all the things which are done in wrapper. Signed-off-by: Sunil Khatri Suggested-by: Christian König Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit deb02080ca5d3f015cf71e56067a39ef2f141998) commit dd4f3ee535b3b0ac027f75dbf9dc5fc88733c765 Author: Timur Kristóf Date: Tue May 19 10:41:54 2026 +0200 drm/amd/pm/si: Disregard vblank time when no displays are connected When no displays are connected, there is no vblank happening so the power management code shouldn't worry about it. This fixes a regression that caused the memory clock to be stuck at maximum when there were no displays connected to a SI GPU. Fixes: 9003a0746864 ("drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)") Fixes: 9d73b107a61b ("drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)") Reviewed-by: Alex Deucher Tested-by: Jeremy Klarenbeek Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 6d87e0199f7b83735b56e422d59f170a201897a8) Cc: stable@vger.kernel.org commit 6842b6a4b72da9b2906ffc5ca9d846ace2c54c14 Author: David Francis Date: Thu May 14 10:31:20 2026 -0400 drm/amdkfd: Check for pdd drm file first in CRIU restore path CRIU restore ioctls are meant to be called by CRIU with no existing drm file. There's an error path for if the drm file unexpectedly exists. It was positioned so it was missing a fput(drm_file). Do that check earlier, as soon as we have the pdd. Signed-off-by: David Francis Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 2bab781dac78916c5cc8de76345a4102449267d7) Cc: stable@vger.kernel.org commit 0fb4a8e64a9db74eeda8da7d0b78985392ae483b Author: Stanley.Yang Date: Mon May 11 16:49:19 2026 +0800 drm/amdgpu: fix potential overflow in fs_info.debugfs_name Use snprintf() with sizeof(fs_info.debugfs_name) so a long RAS block name plus the "_err_inject" suffix cannot overflow the 32-byte buffer. Signed-off-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher (cherry picked from commit 1a58070fda26857a8f6acc0ab05428e60d5c6844) commit cf4aafdccefccc7f8236fed028d06725246e289e Author: Sunil Khatri Date: Mon May 18 19:58:08 2026 +0530 drm/amdgpu/userq: make sure queue is valid in the hang_detect_work Thread 1: Running amdgpu_userq_destroy which eventually remove the queue from door bell and set userq_mgr = NULL. Thread2: An interrupt might have scheduled the hang_detect_work which still need userq_mgr to be valid but could get an NULL ptrs. To fix that make sure we cancel the hang_detect_work again before setting userq_mgr to NULL. Along with that we also need all the queue va to remain valid till we could be running anything on the queue and hence moving the userq_va post hang_detect handler is cancelled. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 1a66ceb98b137d18d303b9889f0e7d8c4db73943) commit a00caed2302c604c19a5cab781e34d7ba4fa7558 Author: Sunil Khatri Date: Mon May 18 18:55:25 2026 +0530 drm/amdgpu/userq: reserve root bo without interruption Fix the code to make it an uninterruptible reservation for root bo. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit d409ab4e387d94b2e593d558b54b7bfd315e0e75) commit cedee93d43f893ce67e39b57c67240965c7c5a69 Author: Sunil Khatri Date: Mon May 18 18:33:00 2026 +0530 drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart fails Unpin the wptr_obj->obj when amdgpu_ttm_alloc_gart fails. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit d8145c437ccdc2d91c579787290f82788172bea0) commit d8d9c820405eb1fcbde959de8898ad7d716a2d7b Author: Sunil Khatri Date: Mon May 18 17:42:15 2026 +0530 drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_index amdgpu_userq_get_doorbell_index returns a uint64 type index as well as a int type failure values. Simplifying this and using a int type return value and getting the index in input pointer of type uint64 type. Also since it's used at once place making it static would be better. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit e947ec9d0529d5f93dbdb33cd197347f6a7b2922) commit e984d61d92e702096058f0f828f4b2b8563b88ce Author: Eric Huang Date: Thu May 7 15:51:49 2026 -0400 drm/amdkfd: fix NULL pointer bug in svm_range_set_attr The process_info could be NULL if user doesn't call kfd_ioctl_acquire_vm before calling kfd_ioctl_svm. Signed-off-by: Eric Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4) Cc: stable@vger.kernel.org commit ec78a85d95e9c37b6ca16d6ed1639fa64d5dd6dc Author: Ivan Lipski Date: Thu May 14 11:53:50 2026 -0400 drm/amd/display: Write REFCLK to 48MHz on DCN21 [Why&How] dccg21_init() calls dccg2_init() which hardcodes 100MHz refclk values for MICROSECOND_TIME_BASE_DIV and MILLISECOND_TIME_BASE_DIV. DCN21 uses 48MHz refclk, so the wrong values corrupt DCCG timing and cause eDP link training failure on cold boot. Write the correct 48MHz values directly instead of calling dccg2_init(). v2: Fixed typo Fixes: e6e2b956fc81 ("drm/amd/display: Add missing DCCG register entries for DCN20-DCN316") Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5272 Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5311 Reported-by: Max Chernoff Tested-by: Max Chernoff Signed-off-by: Ivan Lipski Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 08236c3ef284cd2d110e5e3d51fc9615e551f9dc) Cc: stable@vger.kernel.org commit ba4c0ff47ee098c8e17d25f9dc050e6276bf9979 Author: Sunil Khatri Date: Tue May 19 15:12:42 2026 +0530 drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lock mutex fence_drv_lock is destroyed in amdgpu_userq_fence_driver_free also in one of the jump condition mutex_destroy is also called leading to double mutex_destroy. So rearranging the code so amdgpu_userq_fence_driver_free takes care of the clean up along with mutex_destroy. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 384dbef269d101e5b671fc7b942c56734cd1d186) commit 4a03d23ce6ad474cb15862563bc9132e16e3e31e Author: Sunil Khatri Date: Tue May 19 15:02:00 2026 +0530 drm/amdgpu/userq: Fix doorbell object cleanup of queue Unpin and unref the door bell obj if queue creation fails before initialization is complete. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 8c7506f7ba945f21e5abe7f8eac0a3acca6b5330) commit a1ba4594232c87c3b8defd6f89a2e40f8b08395d Author: Ziyi Guo Date: Sun Feb 8 00:02:55 2026 +0000 drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO kvcalloc(args->num_entries, sizeof(*vm_entries), GFP_KERNEL) at amdgpu_gem.c:1050 uses the user-supplied num_entries directly without any upper bounds check. Since num_entries is a __u32 and sizeof(drm_amdgpu_gem_vm_entry) is 32 bytes, a large num_entries produces an allocation exceeding INT_MAX, triggering WARNING in __kvmalloc_node_noprof(), causing a kernel WARNING, TAINT_WARN, and panic on CONFIG_PANIC_ON_WARN=y systems. Add a size bounds check before we invoke the kvzalloc() to reject oversized num_entries early with -EINVAL. Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP ioctl") Signed-off-by: Ziyi Guo Signed-off-by: Alex Deucher (cherry picked from commit 1fe7bf5457f6efd7be60b17e23163ba54341d73d) Cc: stable@vger.kernel.org commit 2e7f55eb408c3f72ee1957a0d0ad11d8648a6379 Author: Michael Bommarito Date: Sun May 17 09:17:42 2026 -0400 drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO The AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl() holds three cleanup-tracked resources before calling kvcalloc(): the drm_gem_object reference from drm_gem_object_lookup(), the drm_exec lock on the looked-up GEM via drm_exec_lock_obj(), and the drm_exec lock on the per-process VM root page directory via amdgpu_vm_lock_pd(). All three are released by the out_exec label that every other error path in this function jumps to. The kvcalloc() failure path returns -ENOMEM directly, skipping out_exec and leaking all three. The leaked per-process VM root PD dma_resv lock is the load-bearing leak: any subsequent operation on the same VM (further GEM ops, command-submission, eviction, TTM shrinker callbacks) blocks on the held lock. DRM_IOCTL_AMDGPU_GEM_OP is DRM_AUTH | DRM_RENDER_ALLOW, so this is an unprivileged-local denial of service against the caller's GPU context, reachable by any process with /dev/dri/renderD* access. Route the failure through out_exec so drm_exec_fini() and drm_gem_object_put() run. Reproduced on stock 7.0.0-10, Ryzen 7 5700U / Radeon Vega (Lucienne): the failing ioctl returns -ENOMEM and a second GET_MAPPING_INFO on the same fd then blocks in drm_exec_lock_obj() on the leaked dma_resv. SIGKILL on the caller does not reap the task; the fd-release path during process exit goes through amdgpu_gem_object_close() -> drm_exec_prepare_obj() on the same lock, leaving the task in D state until the box is rebooted. The patched kernel was not rebuilt and re-tested on this hardware; the fix is mechanical. Tested on a single Lucienne / Vega box only. Ziyi Guo posted an independent INT_MAX-bound check for args->num_entries in the same branch [1]; the two patches are complementary and can land in either order. Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP ioctl") Link: https://lore.kernel.org/all/20260208000255.4073363-1-n7l8m4@u.northwestern.edu/ # [1] Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Alex Deucher (cherry picked from commit b69d3256d79de15f54c322986ff4da68f1d65b0a) Cc: stable@vger.kernel.org commit f657a6a3ba4c20bc01f5be3752d53498ee1bfe35 Author: Balasubramani Vivekanandan Date: Fri May 22 22:05:32 2026 +0530 drm/xe: Restore IDLEDLY regiter on engine reset Wa_16023105232 programs the register IDLEDLY. The register is reset whenever the engine is reset. Therefore it should be added to the GuC save-restore register list for it to be restored after reset. Fixes: 7c53ff050ba8 ("drm/xe: Apply Wa_16023105232") Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260522163531.1365540-2-balasubramani.vivekanandan@intel.com Signed-off-by: Balasubramani Vivekanandan (cherry picked from commit df1cfe24743a93b71eab27687e148ab8ae9b69e3) Signed-off-by: Rodrigo Vivi commit adae9996c04fea3b1791099b6d79e1df76d50849 Author: Vincent Donnefort Date: Thu May 21 13:46:13 2026 +0100 KVM: arm64: Fix memory leak in hyp_trace_unload() During trace remote loading, hyp_trace_load() allocates the descriptor pages but fails to store the allocated size in trace_buffer->desc_size. As a result, when unloading the trace buffer, hyp_trace_unload() calls free_pages_exact() with a size of 0 which fails to free the memory. Fix this by updating the descriptor size in trace_buffer->desc_size. Fixes: 3aed038aac8d ("KVM: arm64: Add trace remote for the nVHE/pKVM hyp") Reported-by: Sashiko Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260521124613.911067-4-vdonnefort@google.com Signed-off-by: Marc Zyngier commit a23780ea9db3f3cadbb52ff6151384bff89d95d2 Author: Vincent Donnefort Date: Thu May 21 13:46:12 2026 +0100 KVM: arm64: Fix rollback in hyp_trace_buffer_share_hyp() When sharing the trace buffer with the hypervisor, if sharing a page fails, the rollback path in hyp_trace_buffer_share_hyp() misses unsharing the metadata page (meta_va) which was successfully shared before entering the page sharing loop. Additionally, if a failure occurs, the cleanup calls hyp_trace_buffer_unshare_hyp() with an incorrect CPU index. Since that CPU's pages were already rolled back locally in the loop, this leads to duplicate unsharing attempts. Fix both issues affecting the rollback. Fixes: 3aed038aac8d ("KVM: arm64: Add trace remote for the nVHE/pKVM hyp") Reported-by: Sashiko Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260521124613.911067-3-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 0f7abb6eaa3c3965f925e231c18409dac4f5a0c1 Author: Vincent Donnefort Date: Thu May 21 13:46:11 2026 +0100 KVM: arm64: Fix meta-page unsharing in pKVM hyp tracing As the hyp_trace_buffer_unshare_hyp() function name suggests we should unshare all the previously shared pages, otherwise we leak hyp-shared pages which won't be reusable for hyp memory. Fix the typo by calling __unshare_page() on the meta-page, ensuring all previously shared pages are correctly unshared. Fixes: 3aed038aac8d ("KVM: arm64: Add trace remote for the nVHE/pKVM hyp") Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260521124613.911067-2-vdonnefort@google.com Signed-off-by: Marc Zyngier commit f63ad68e18d774a5d15cd7e405ead63f6b322679 Author: Cássio Gabriel Date: Wed May 27 09:24:00 2026 -0300 ASoC: codecs: simple-mux: Fix enum control bounds check simple_mux_control_put() rejects values greater than e->items, but enum control values are zero based. For the two-entry mux used by this driver, valid values are 0 and 1, so value 2 must be rejected as well. Accepting e->items can store an invalid mux state, pass it to the GPIO setter, and pass it on to the DAPM mux update path where it is used as an index into the enum text array. Use the same >= e->items check used by the ASoC enum helpers. Fixes: 342fbb7578d1 ("ASoC: add simple-mux") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260527-asoc-simple-mux-enum-bounds-v1-1-3f805b9fc671@gmail.com Signed-off-by: Mark Brown commit 1750ad1388e03fb27068cd1f22c9c8b4590fe936 Author: Qiang Ma Date: Tue May 26 15:46:40 2026 +0800 KVM: arm64: PMU: Preserve AArch32 counter low bits AArch32 writes to PMU event counters cannot update the top 32 bits, even when PMUv3p5 makes the counters 64-bit. KVM therefore needs to preserve the existing high half and only update the low half written by the guest, unless the caller explicitly forces a full reset through PMCR.P. The current code masks @val down to the old high half before taking lower_32_bits(val), which means the low half is always zero. As a result, AArch32 writes to event counters discard the guest-provided low 32 bits instead of storing them. Build the new value from the old high 32 bits and the low 32 bits of the value supplied by the guest. Fixes: 26d2d0594d70 ("KVM: arm64: PMU: Do not let AArch32 change the counters' top 32 bits") Signed-off-by: Qiang Ma Signed-off-by: Marc Zyngier Link: https://patch.msgid.link/20260526074640.791991-1-maqianga@uniontech.com Cc: stable@vger.kernel.org commit 14912d497188283f5a0aa5daaa161e52f79c7f34 Author: Lianqin Hu Date: Wed May 27 03:33:08 2026 +0000 ALSA: usb-audio: Add iface reset and delay quirk for TAE1160 USB Audio Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: new full-speed USB device number 2 using xhci-hcd usb 1-1: New USB device found, idVendor=25aa, idProduct=600b usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: TAE1159 usb 1-1: Manufacturer: Generic usb 1-1: SerialNumber: 20210726905926 Signed-off-by: Lianqin Hu Link: https://patch.msgid.link/TYUPR06MB621736D7C85D43200E54E740D2082@TYUPR06MB6217.apcprd06.prod.outlook.com Signed-off-by: Takashi Iwai commit 4db42e5fb9327c27b41f26bb9427ba0b97ecec30 Author: Jakub Pisarczyk Date: Tue May 26 22:18:30 2026 +0200 ALSA: hda/cs420x: Add CS4208 fixup for iMac16,1 The 21.5" Retina 4K iMac (Late 2015, DMI product name "iMac16,1") ships with a Cirrus Logic CS4208 codec wired to an external speaker amplifier enabled through codec GPIO0 -- the same arrangement as the late-2013 MacBookPro 11,x. Without a matching entry in cs4208_mac_fixup_tbl[] the fixup picker logs: snd_hda_codec_cs420x hdaudioC1D0: CS4208: picked fixup for codec SSID 106b:0000 i.e. an empty fixup name, GPIO0 stays low, the external amp is never powered up, and the internal speakers are silent on a stock kernel. The codec SSID reported by hardware is 0x106b:0x7f00. Reusing CS4208_MBP11 (GPIO0 + SPDIF switch fixup) makes the internal speakers and S/PDIF output work out of the box, removing the need for users to set `options snd_hda_intel model=mbp11` via /etc/modprobe.d/. Tested on iMac16,1 (kernel 6.17.0): four internal drivers (Left tweeter, Left woofer, Right tweeter, Right woofer, exposed as the 4 channels of the analog-surround-40 ALSA profile) produce audio after the fixup is applied. Signed-off-by: Jakub Pisarczyk Link: https://patch.msgid.link/20260526201830.34097-1-pisarz77@gmail.com Signed-off-by: Takashi Iwai commit 0a10faad5ca58332ad70f7663ba82611f4daf736 Author: Fabian Lippold Date: Tue May 26 17:41:01 2026 +0200 ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1 Add PCI quirk for HP Dragonfly Folio G3 (PCI ID 103c:8a06) to select the CS35L41 SPI4 & GPIO LED fixup variant. Signed-off-by: Fabian Lippold Link: https://patch.msgid.link/20260526154418.1850568-3-fabianlippold1184@gmail.com Signed-off-by: Takashi Iwai commit dd433671fef381fdaf7b530c631e6b782d66e224 Author: Qi Tang Date: Sat May 23 22:32:45 2026 +0800 ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting the on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length. The length was validated only at parse time (ipv6_parse_hopopts(), etc.). An nftables payload-write expression can rewrite hdrlen after parsing and before the skb reaches recvmsg; the write itself is in-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040 bytes from an 8-byte header. nftables is reachable from an unprivileged user namespace, so this is an unprivileged slab-out-of-bounds read: BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540 put_cmsg+0x3ac/0x540 udpv6_recvmsg+0xca0/0x1250 sock_recvmsg+0xdf/0x190 ____sys_recvmsg+0x1b1/0x620 Add ipv6_get_exthdr_len() which validates that at least two bytes are accessible before reading the hdrlen field, then checks the computed length against skb_tail_pointer(skb), returning 0 on failure. Extension headers are kept in the linear skb area by pskb_may_pull() during input, so skb_tail_pointer() is the correct bound. Use ipv6_get_exthdr_len() at all non-AH call sites: the five standalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR) and the three standard cases in the extension-header walk loop (DSTOPTS, ROUTING, default). AH retains an inline bounds check because its length formula differs ((ptr[1]+2)<<2). The walk loop also gets a pre-read bounds check at the top to validate ptr before any case accesses ptr[0] or ptr[1]. When the walk loop detects a corrupted header, return from the function instead of continuing to process later socket options. Cc: stable@vger.kernel.org Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Qi Tang Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260523143245.2281415-1-tpluszz77@gmail.com Signed-off-by: Jakub Kicinski commit cc57232cae23c0df91b4a59d0f519141ce9b5b02 Author: Sean Shen Date: Tue May 26 22:07:16 2026 +0900 ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE FSCTL_SET_SPARSE in fsctl_set_sparse() modifies the file's sparse attribute and saves it through xattr without any permission checks. This exposes two issues: 1) A client on a read-only share can change the sparse attribute on files it opened, even though the share is read-only. Other FSCTL write operations already check test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE), but FSCTL_SET_SPARSE does not. 2) Even on writable shares, clients without FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES access should not modify the sparse attribute. Similar handle-level checks exist in other functions but are missing here. Add both share-level writable check and per-handle access check. Use goto out on error to avoid leaking file references. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: Namjae Jeon Cc: Sergey Senozhatsky Cc: Steve French Signed-off-by: Sean Shen Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2f15dcd0d4b502c704a52f5c7de128b163677978 Author: Aleksandr Golovnya Date: Tue May 26 01:50:18 2026 +0700 ksmbd: release ksmbd_inode ref via ksmbd_inode_put on lookup paths ksmbd_query_inode_status() and ksmbd_lookup_fd_inode() both take a reference on a ksmbd_inode via __ksmbd_inode_lookup() (which performs atomic_inc_not_zero()) and later release it using a bare atomic_dec(&ci->m_count). Unlike ksmbd_inode_put(), a bare atomic_dec() does not check whether the reference count has reached zero, so if the caller happens to drop the last reference, the ksmbd_inode is leaked: it stays in the global inode hash table with m_count == 0, future __ksmbd_inode_lookup() calls reject it via atomic_inc_not_zero(), and ksmbd_inode_free() is never invoked. The race is: T1: __ksmbd_inode_lookup() -> atomic_inc_not_zero(): m_count = 2 T2: ksmbd_inode_put() -> atomic_dec_and_test(): m_count = 1 (not freed) T1: atomic_dec(&ci->m_count) -> m_count = 0 return (LEAK) In ksmbd_lookup_fd_inode() the matched-fp path (which now also uses ksmbd_inode_put()) cannot currently reach m_count == 0 because the matched ksmbd_file holds its own reference on ci, but converting it to the proper API keeps the three call sites consistent and avoids future regressions if the locking changes. Because ksmbd_inode_put() may free the ksmbd_inode if this drops the last reference, the call must happen after up_read(&ci->m_lock) on the two affected paths in ksmbd_lookup_fd_inode(). On the no-match path this is a pure reordering; on the matched path ksmbd_fp_get() is moved above the unlock so that the returned ksmbd_file is pinned before the inode reference is released. Signed-off-by: Aleksandr Golovnya Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0e60dafe97eca61721f3db456f97d97a80c6c8ae Author: Ali Ganiyev Date: Mon May 25 10:23:47 2026 +0900 ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE) Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates to `aces_size < 0`. Because `aces_size` is always non-negative, this check becomes dead code and never breaks the loop. Worse, that commit removed the old 4-byte guard, meaning the loop now reads `ace->size` (offset 2) even when `aces_size` is 0-3 bytes. This re-opens a 2-byte heap out-of-bounds (OOB) read past the pntsd allocation during subsequent SMB2_CREATE operations. Fix this by properly transposing the comparison to require at least 16 bytes (8-byte offset + 8-byte SID base), matching the correct form used in smb_inherit_dacl(). Fixes: d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") Cc: stable@vger.kernel.org Signed-off-by: Ali Ganiyev Acked-by: Namjae Jeon Signed-off-by: Steve French commit e66c456f7ce45f2b6c267e5a77bb6e049378dd86 Merge: 509323077ef79a f23bf992d65a42 Author: Jakub Kicinski Date: Tue May 26 18:32:34 2026 -0700 Merge tag 'nfc-7.1-rc6' of https://codeberg.org/linux-nfc/linux David Heidelberg says: ==================== nfc pull request for net: Code improvements - llcp: Fix use-after-free in llcp_sock_release() - llcp: Fix use-after-free race in nfc_llcp_recv_cc() - hci: fix out-of-bounds read in HCP header parsing Regression fixes: - nxp-nci: i2c: use rising-edge IRQ on ACPI systems Signed-off-by: David Heidelberg * tag 'nfc-7.1-rc6' of https://codeberg.org/linux-nfc/linux: nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems nfc: hci: fix out-of-bounds read in HCP header parsing nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() nfc: llcp: Fix use-after-free in llcp_sock_release() ==================== Link: https://patch.msgid.link/217c0646-8a30-4037-b613-580c2b189729@ixit.cz Signed-off-by: Jakub Kicinski commit 509323077ef79a26ba0c60bb556e45c12c398b2d Author: Eric Dumazet Date: Fri May 22 11:55:12 2026 +0000 tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535. Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part. Note that iptunnel_pmtud_check_icmpv6()) is fine. Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") Reported-by: Damiano Melotti Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260522115512.1519110-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7d9ef0cb271555d8cf39fefe6c981e1493b25ecf Author: Eric Dumazet Date: Mon May 25 20:36:42 2026 +0000 vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko. Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") Signed-off-by: Eric Dumazet Reviewed-by: Stefano Brivio Link: https://patch.msgid.link/20260525203642.2389723-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b4bc94353050b1fa7b702bd4c6600710dd926cff Author: Eric Dumazet Date: Mon May 25 20:13:35 2026 +0000 tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed. Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") Signed-off-by: Eric Dumazet Reviewed-by: Stefano Brivio Link: https://patch.msgid.link/20260525201335.2361845-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d895767c337814cf4b97d5ad5375e5ed7e12018d Author: Lucien.Jheng Date: Sun May 24 14:39:15 2026 +0800 net: phy: air_en8811h: add AN8811HB MCU assert/deassert support AN8811HB needs a MCU soft-reset cycle before firmware loading begins. Assert the MCU (hold it in reset) and immediately deassert (release) via a dedicated PBUS register pair (0x5cf9f8 / 0x5cf9fc), accessed through a registered mdio_device at PHY-addr+8. Add __air_pbus_reg_write() as a low-level helper taking a struct mdio_device *, create and register the PBUS mdio_device in an8811hb_probe() and store it in priv->pbusdev, then implement an8811hb_mcu_assert() / _deassert() on top of it. Add an8811hb_remove() to unregister the PBUS device on teardown. Wire both calls into an8811hb_load_firmware() and en8811h_restart_mcu() so every firmware load or MCU restart on AN8811HB correctly sequences the reset control registers. Fixes: 5afda1d734ed ("net: phy: air_en8811h: add Airoha AN8811HB support") Signed-off-by: Lucien Jheng Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260524063915.47961-1-lucienzx159@gmail.com Signed-off-by: Jakub Kicinski commit 05f95729ca844704d15e49ce14868af4b403b32b Author: Michael Bommarito Date: Fri May 22 22:34:23 2026 -0400 l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname A reader in l2tp_session_get_by_ifname() can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcount_inc(), but every other session getter in the same file (l2tp_v2_session_get, l2tp_v3_session_get, and the corresponding _get_next variants) uses refcount_inc_not_zero() because the IDR/RCU lookup can race with refcount_dec_and_test() -> l2tp_session_free() -> kfree_rcu(). The ifname getter is the only outlier; the inconsistency was raised on-list after 979c017803c4 ("l2tp: use list_del_rcu in l2tp_session_unhash"). A reader inside rcu_read_lock_bh() that matches session->ifname can be preempted between the strcmp() and the refcount_inc(). If the last reference drops on another CPU in that window, the reader's refcount_inc() runs on a counter that has reached zero. refcount_t catches the addition-on-zero, prints "refcount_t: addition on 0; use-after-free", saturates the counter, and returns the saturated pointer to the caller. Session memory is held live by the in-flight RCU read section, but the kfree_rcu() callback queued from l2tp_session_free() will free it once the grace period closes; a caller that dereferences the returned session past that point hits a slab-use-after-free. On PREEMPT_RT local_bh_disable() is a per-CPU sleeping lock and the preemption window is real; on stock PREEMPT kernels local_bh_disable() is a preempt_count increment that closes the cross-CPU race in practice (see below). Use refcount_inc_not_zero() and continue the list walk on failure, matching the other session getters in the file. The ifname getter is the only session getter in net/l2tp/ that still uses the bare refcount_inc() pattern; this change restores file-internal consistency. The success path is unchanged. Fixes: abe7a1a7d0b6 ("l2tp: improve tunnel/session refcount helpers") Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito Reviewed-by: James Chapman Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260523023423.2568972-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski commit 030675aa54cf757769b3db65642433d626b3ed7c Author: Chaitanya Sabnis Date: Tue May 26 15:52:40 2026 +0530 i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency' property is missing from the device tree, the driver falls back to DAVINCI_I2C_DEFAULT_BUS_FREQ. However, this macro was defined in kHz (100), whereas the device tree property is expected in Hz. The probe function divided the fallback value by 1000, causing integer truncation that resulted in dev->bus_freq = 0. This triggered a deterministic division-by-zero kernel panic when calculating clock dividers later in the probe sequence. Fix this by redefining DAVINCI_I2C_DEFAULT_BUS_FREQ in Hz (100000) to match the expected device tree property unit, allowing the existing division logic to work correctly for both cases. Fixes: b04ce6385979 ("i2c: davinci: kill platform data") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260514044726.57297C2BCB7@smtp.kernel.org/ Signed-off-by: Chaitanya Sabnis Cc: # v6.14+ Reviewed-by: Bartosz Golaszewski Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260526102240.4949-1-chaitanya.msabnis@gmail.com commit 6fc5666aa576c6c3bec256fa31d72653210319d5 Author: Heiko Stuebner Date: Thu May 21 23:09:15 2026 +0200 ARM: rockchip: keep reset control around Do not put the reset control, retain exclusive control over it. After turning on a CPU, the corresponding reset line must stay deasserted. This also avoids calling reset_control_put() before workqueues are operational. Fixes: 78ebbff6d1a0 ("reset: handle removing supplier before consumers") Signed-off-by: Philipp Zabel Tested-by: Steven Price Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260521210915.2331176-1-heiko@sntech.de commit b051bb6bf0a231117036aa607cadf55be8e63910 Author: Keith Busch Date: Tue May 26 08:35:31 2026 -0700 blk-mq: reinsert cached request to the list A previous commit removed an optimization out of caution for a scenario that turns out not to be real: all the "queue_exit" goto's are safe to reinsert the request into the cached_rq's plug list as they are either from a non-blocking path, or a successful merge that already holds the queue reference. This optimization is most needed for small sequential workloads that successfully merge into larger requests. Fixes: dc278e9bf2b9 ("blk-mq: pop cached request if it is usable") Suggested-by: Ming Lei Suggested-by: Christoph Hellwig Signed-off-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Link: https://patch.msgid.link/20260526153531.2365935-1-kbusch@meta.com Signed-off-by: Jens Axboe commit d90f236f8b9e354848bd226f581db27755ab901d Author: Li Ming Date: Wed May 20 20:14:57 2026 +0800 cxl/test: Update mock dev array before calling platform_device_add() CXL test environment hits the following error sometimes. cxl_mem mem9: endpoint7 failed probe All mock memdevs are platform firmware devices added by cxl_test module, and cxl_test module also provides a platform device driver for them to create a memdev device to CXL subsystem. cxl_test module uses cxl_rcd/mem_single/mem arrays to store different types of mock memdevs. CXL drivers calls registered mock functions for a mock memdev by checking if a given memdev is in these arrays. When cxl_test module adds these mock memdevs, it always calls platform_device_add() before adding them to a suitable mock memdev array. However, there is a small window where CXL drivers calls mock function for a added memdev before it added to a mock memdev array. In above case, cxl endpoint driver considers a added memdev was not a mock memdev, then calling devm_cxl_endpoint_decoders_setup() for it rather than mock_endpoint_decoders_setup(). An appropriate solution is that adding a new mock device to a mock device array before calling platform_device_add() for it. It can guarantee the new mock device is visible to CXL subsystem. This patch introduces a new helped called cxl_mock_platform_device_add() to handle the issue, and uses the function for all mock devices addition. Fixes: 3a2b97b3210b ("cxl/test: Improve init-order fidelity relative to real-world systems") Signed-off-by: Li Ming Tested-by: Alison Schofield Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260520121457.234404-1-ming.li@zohomail.com Signed-off-by: Dave Jiang commit eb3f4b7426cfd2b79d65b7d37155480b32259a11 Merge: e909cedf6800ef 0b474240327ceb Author: Linus Torvalds Date: Tue May 26 13:49:13 2026 -0700 Merge tag 'nfsd-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Regressions: - Tighten bounds checking for sunrpc cache hash tables - Don't report key material in the ftrace log Stable fix: - Fix lockd's implementation of the NLM TEST procedure" * tag 'nfsd-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: lockd: fix TEST handling when not all permissions are available. NFSD: Report whether fh_key was actually updated sunrpc: prevent out-of-bounds read in __cache_seq_start() commit e909cedf6800ef493063f18a089f3632817a8c2d Merge: d60ec36cab338d fb6988b83b4caf Author: Linus Torvalds Date: Tue May 26 13:37:26 2026 -0700 Merge tag 'linux_kselftest-kunit-fixes-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit fix from Shuah Khan: "Fix a use-after-free in kunit debugfs when using kunit.filter when the executor frees dynamically allocated resources after running boot-time tests. This resulted in fatal hardware exception due to invalidation of capability flags on the reclaimed memory on some architectures such as CHERI RISC-V that support the feature, and silent memory corruption on others. The fix for this couples the lifetime of the filtered suite memory allocation to the lifetime of the kunit subsystem and its associated VFS nodes. Ownership of the boot-time suite_set is now transferred to a global tracker ('kunit_boot_suites'), and the memory is cleanly released in kunit_exit() during module teardown" * tag 'linux_kselftest-kunit-fixes-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: fix use-after-free in debugfs when using kunit.filter commit cda64169bade79427f264e43d0f422eaed9dc116 Author: Borislav Petkov Date: Wed May 13 22:06:01 2026 +0200 x86/microcode: Do not access MSR_IA32_PLATFORM_ID when running as a guest Patch in Fixes: causes the usual: unchecked MSR access error: RDMSR from 0x17 at ... (intel_get_platform_id) Call Trace: early_init_intel early_cpu_init setup_arch _printk start_kernel x86_64_start_reservations x86_64_start_kernel common_startup_64 because the kernel is booted in a guest. In order to avoid it, this MSR access needs to be prevented when running virtualized. That is usually done by checking X86_FEATURE_HYPERVISOR but for this particular case it is too early yet. The platform ID needs to be read as early as when microcode is loaded on the BSP: load_ucode_bsp ... -> get_microcode_blob ... -> intel_find_matching_signature and by that time, CPUID leafs haven't been parsed yet. The microcode loader already has logic to check early whether the kernel is running virtualized so make that globally available to arch/x86/. The query whether running virtualized is getting more and more prominent in recent times so might as well make it an arch-global var which the rest of the code can use. Fixes: d8630b67ca1ed ("x86/cpu: Add platform ID to CPU info structure") Reported-by: Vishal Verma Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Tested-by: Binbin Wu Link: https://lore.kernel.org/all/20260430020953.1405535-1-binbin.wu@linux.intel.com commit 60474437af5fe12abd20607766c809e0ad4e7245 Author: Varadarajan Narayanan Date: Thu May 14 12:15:31 2026 +0530 spi: dt-bindings: spi-qpic-snand: Add ipq5210 compatible Since the QPIC-SPI-NAND flash controller present in ipq5210 is the same as the one found in ipq9574, document the ipq5210 compatible and with ipq9574 as the fallback. Signed-off-by: Varadarajan Narayanan Link: https://patch.msgid.link/20260514-ipq5210-nand-v1-1-cbdd7492e826@oss.qualcomm.com Signed-off-by: Mark Brown commit d60ec36cab338dfe2ae40d73e9c8d6c4af70d2b8 Merge: e8c2f9fdadee7c 54cf41c969da66 Author: Linus Torvalds Date: Tue May 26 08:23:19 2026 -0700 Merge tag 'mm-hotfixes-stable-2026-05-25-16-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "13 hotfixes. 9 are for MM. 9 are cc:stable and the remaining 4 address post-7.1 issues or aren't considered suitable for backporting. All patches are singletons - please see the individual changelogs for details" * tag 'mm-hotfixes-stable-2026-05-25-16-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: Revert "mm: introduce a new page type for page pool in page type" mm/vmalloc: do not trigger BUG() on BH disabled context MAINTAINERS, mailmap: change email for Eugen Hristev mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page kernel/fork: validate exit_signal in kernel_clone() mm: memcontrol: propagate NMI slab stats to memcg vmstats mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one zram: fix use-after-free in zram_writeback_endio memfd: deny writeable mappings when implying SEAL_WRITE ipc: limit next_id allocation to the valid ID range Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" MAINTAINERS: .mailmap: update after GEHC spin-off commit c66d7c3c1f173cf73a2a2f8302666d86beafff22 Merge: a0bfd64397b819 d5551f4c1800dc Author: Jakub Kicinski Date: Tue May 26 08:19:36 2026 -0700 Merge branch 'ethtool-module-fix-a-handful-of-small-bugs' Jakub Kicinski says: ==================== ethtool: module: fix a handful of small bugs I've been poking at the locking in ethtool and it appears that the FW flashing is not currently taking the ops lock. Existing drivers which implement module FW flashing seem to have their own locking, so this series doesn't actually add the ops lock (I'll add it in net-next). But a number of other errors have been surfaced in the process. ==================== Link: https://patch.msgid.link/20260522231312.1710836-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d5551f4c1800dc714cec86647bdd651ae0de923e Author: Jakub Kicinski Date: Fri May 22 16:13:12 2026 -0700 ethtool: cmis: validate fw->size against start_cmd_payload_size cmis_fw_update_start_download() copies start_cmd_payload_size bytes from the firmware blob into the CDB LPL vendor_data[] payload without validating that the FW has enough data. Since the start_cmd_payload_size can only be ~120B an image too short is most likely corrupted, so reject it. Fixes: c4f78134d45c ("ethtool: cmis_fw_update: add a layer for supporting firmware update using CDB") Reviewed-by: Maxime Chevallier Reviewed-by: Danielle Ratson Link: https://patch.msgid.link/20260522231312.1710836-10-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 12c2496a71f82f63617971ca9b730dffa05cf58b Author: Jakub Kicinski Date: Fri May 22 16:13:11 2026 -0700 ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code reads start_cmd_payload_size from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination buffer is 112 bytes (ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious module (or corrupted response) can cause a OOB write later on in cmis_fw_update_start_download(). Let's error out. If modules that expect longer LPL writes actually exist we should revisit. struct cmis_cdb_start_fw_download_pl's definition has to move, no change there. Fixes: c4f78134d45c ("ethtool: cmis_fw_update: add a layer for supporting firmware update using CDB") Reviewed-by: Maxime Chevallier Reviewed-by: Danielle Ratson Link: https://patch.msgid.link/20260522231312.1710836-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3e8c3d464c36bb342fe377b026577c7ec27fdbb4 Author: Jakub Kicinski Date: Fri May 22 16:13:10 2026 -0700 ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl ethtool_cmis_cdb_compose_args() accepts msleep_pre_rpl as u16 but stores it into the u8 field ethtool_cmis_cdb_cmd_args::msleep_pre_rpl, silently truncating values >= 256. Seven of the nine call sites pass 1000 ms (it's the third argument from the end). Fixes: a39c84d79625 ("ethtool: cmis_cdb: Add a layer for supporting CDB commands") Reviewed-by: Maxime Chevallier Reviewed-by: Danielle Ratson Link: https://patch.msgid.link/20260522231312.1710836-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6c3f999a9d1338c6c89a9ff4549eafe72bc2e7b1 Author: Jakub Kicinski Date: Fri May 22 16:13:09 2026 -0700 ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpl_len longer than what cmis_cdb_process_reply() expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be buggy and/or the reads may occasionally get corrupted, so let's protect the kernel. The existing check protects from short replies. We need to protect from long ones, too. All callers that pass a non-zero rpl_exp_len cast the reply payload to a fixed-layout struct and read fields at fixed offsets, with no version negotiation or short-reply handling: - cmis_cdb_validate_password() - cmis_cdb_module_features_get() - cmis_fw_update_fw_mng_features_get() so let's assume that responses longer than expected do not have to be handled gracefully here. Add a warning message to make the debug easier in case my understanding is wrong... Note that page_data->length (argument of kmalloc) comes from last arg to ethtool_cmis_page_init() which is rpl_exp_len. Note2 that AIs also like to point out overflows in args->req.payload itself (which is a fixed-size 120 B buffer, on the stack), but callers should be reading structs defined by the standard, so protecting from requests for more data than max seem like defensive programming. Fixes: a39c84d79625 ("ethtool: cmis_cdb: Add a layer for supporting CDB commands") Reviewed-by: Danielle Ratson Link: https://patch.msgid.link/20260522231312.1710836-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 760d04ebad5c4304f22c0d2251c9623b87a117c8 Author: Jakub Kicinski Date: Fri May 22 16:13:08 2026 -0700 ethtool: module: fix cleanup if socket used for flashing multiple devices When a single Netlink socket issues MODULE_FW_FLASH_ACT against multiple devices, ethnl_sock_priv_set() overwrites sk_priv->dev on each call, retaining only the last one. The socket priv is used on socket close, to walk the global work list and mark the uncompleted flashing work as "orphaned". Otherwise if another socket reuses the PID it will unexpectedly receive the flashing notifications. Don't record the device, record net pointer instead. The purpose of the dev is to scope the work to a netns, anyway. If we store netns the overrides are safe/a nop since all flashed devices must be in the same netns as the socket. Fixes: 32b4c8b53ee7 ("ethtool: Add ability to flash transceiver modules' firmware") Reviewed-by: Danielle Ratson Link: https://patch.msgid.link/20260522231312.1710836-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 504eaefa44c8dec50f7499edcb36d24f3aefab2a Author: Jakub Kicinski Date: Fri May 22 16:13:07 2026 -0700 ethtool: module: check fw_flash_in_progress under rtnl_lock ethnl_set_module_validate() inspects module_fw_flash_in_progress but validate is meant for _input_ validation, not state validation. rtnl_lock is not held, yet. Move the check into ethnl_set_module(). Fixes: 32b4c8b53ee7 ("ethtool: Add ability to flash transceiver modules' firmware") Reviewed-by: Maxime Chevallier Reviewed-by: Danielle Ratson Link: https://patch.msgid.link/20260522231312.1710836-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7a84b965ffc12030af63cd10a8f3a1123ff39b7a Author: Jakub Kicinski Date: Fri May 22 16:13:06 2026 -0700 ethtool: module: avoid racy updates to dev->ethtool bitfield When reviewing other changes Gemini points out that we currently update module_fw_flash_in_progress without holding any locks. Since module_fw_flash_in_progress is part of a bitfield this is not great, updates to other fields may be lost. We could use a bool and sprinkle some READ_ONCE/WRITE_ONCE here but seems like the issue is rather than the work is an unusual writer. The other writers already hold the right locks. So just very briefly take these locks when the work completes. Note that nothing ever cancels the FW update work, so there's no concern with deadlocks vs cancel. Fixes: 32b4c8b53ee7 ("ethtool: Add ability to flash transceiver modules' firmware") Reviewed-by: Maxime Chevallier Reviewed-by: Danielle Ratson Link: https://patch.msgid.link/20260522231312.1710836-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit fb7f511d62692661846c47f199e0afe25c2982db Author: Jakub Kicinski Date: Fri May 22 16:13:05 2026 -0700 ethtool: module: avoid leaking a netdev ref on module flash errors module_flash_fw_schedule() is missing undo for setting the "in_progress" flag and taking the netdev reference. Delay taking these, the device can't disappear while we are holding rtnl_lock. Fixes: 32b4c8b53ee7 ("ethtool: Add ability to flash transceiver modules' firmware") Reviewed-by: Maxime Chevallier Reviewed-by: Danielle Ratson Link: https://patch.msgid.link/20260522231312.1710836-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 84371fb58423f997939aacdcbc02d128d76a54e5 Author: Jakub Kicinski Date: Fri May 22 16:13:04 2026 -0700 ethtool: module: call ethnl_ops_complete() on module flash errors When validate() fails we are skipping over ethnl_ops_complete() even tho we already called ethnl_ops_begin(). Fixes: 32b4c8b53ee7 ("ethtool: Add ability to flash transceiver modules' firmware") Reviewed-by: Maxime Chevallier Reviewed-by: Danielle Ratson Link: https://patch.msgid.link/20260522231312.1710836-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a0bfd64397b819c8ad0c4ac7fd948702e78193e0 Merge: 2e357f002c61fd 32a9ecde62731c Author: Jakub Kicinski Date: Tue May 26 08:18:09 2026 -0700 Merge branch 'ethtool-rss-fix-a-handful-of-small-bugs' Jakub Kicinski says: ==================== ethtool: rss: fix a handful of small bugs Fix a handful of small bugs in the ethtool Netlink RSS code. ==================== Link: https://patch.msgid.link/20260522230647.1705600-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 32a9ecde62731c9f7412507709192c84dafc38d1 Author: Jakub Kicinski Date: Fri May 22 16:06:47 2026 -0700 ethtool: rss: avoid device context leak on reply-build failure We wait with filling the reply for new RSS context creation until after the driver ->create_rxfh_context call. The driver needs to fill some of the defaults in the context. The failure of rss_fill_reply() is somewhat theoretical, but doesn't take much effort to handle it properly. Call ->remove_rxfh_context(). If the driver's remove callback fails (some implementations like sfc can return real command errors from firmware RPCs) - skip the xa_erase and kfree, leaving the context in the xarray. This matches how ethnl_rss_delete_doit() behaves. Fixes: a166ab7816c5 ("ethtool: rss: support creating contexts via Netlink") Link: https://patch.msgid.link/20260522230647.1705600-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 78ccf1a70c6378e1f5073a8c2209b5129067b925 Author: Jakub Kicinski Date: Fri May 22 16:06:46 2026 -0700 ethtool: rss: fix hkey leak when indir_size is 0 rss_get_data_alloc() allocates a single buffer that backs both the indirection table and the hash key, but only assigned data->indir_table when indir_size was nonzero. The expectation was that no driver implements RSS without supporting indirection table but apparently enic does just that (it's the only such in-tree driver). enic has get_rxfh_key_size but no get_rxfh_indir_size. data->indir_table stays as NULL, hkey gets set but rss_get_data_free() kfree(data->indir_table) is a nop and the allocation leaks. Always store the allocation base in data->indir_table so the free path is unambiguous. No caller treats indir_table as a sentinel; everything keys off indir_size. Fixes: 7112a04664bf ("ethtool: add netlink based get rss support") Link: https://patch.msgid.link/20260522230647.1705600-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 266297692f97008ca48bc311775c087c59bd7fe3 Author: Jakub Kicinski Date: Fri May 22 16:06:45 2026 -0700 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation. Fixes: 4f038a6a02d2 ("net: ethtool: Don't call .cleanup_data when prepare_data fails") Link: https://patch.msgid.link/20260522230647.1705600-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8d60141a32875248ef71d49c9920fa5e2aa40b29 Author: Jakub Kicinski Date: Fri May 22 16:06:44 2026 -0700 ethtool: rss: fix falsely ignoring indir table updates rss_set_prep_indir() compares the new indirection table against the current one to determine whether any update is needed. The memcmp call passes data->indir_size as the length argument, but indir_size is the number of u32 entries, not the byte count. Fixes: c0ae03588bbb ("ethtool: rss: initial RSS_SET (indirection table handling)") Link: https://patch.msgid.link/20260522230647.1705600-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3e6c6e9782ff8a8d8ded774b07ad4590cd61d04c Author: Jakub Kicinski Date: Fri May 22 16:06:43 2026 -0700 ethtool: rss: add missing errno on RSS context delete Remember to set ret before jumping out if someone tries to delete a context on a device which doesn't support contexts. Fixes: fbe09277fa63 ("ethtool: rss: support removing contexts via Netlink") Link: https://patch.msgid.link/20260522230647.1705600-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c75b6f6eaacd0b74b832414cc3b9289c3686e941 Author: Jakub Kicinski Date: Fri May 22 16:06:42 2026 -0700 ethtool: rss: avoid modifying the RSS context response Gemini says that we're modifying the RSS_CREATE response skb. I think it's right, the comment says that unicast() should unshare the skb but I'm not entirely sure what I meant there. netlink_trim() does a copy but only if skb is not well sized (it's at least 2x larger than necessary for the payload). Fixes: a166ab7816c5 ("ethtool: rss: support creating contexts via Netlink") Link: https://patch.msgid.link/20260522230647.1705600-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3cd07ee35a66038fd1a643632bfc057645e07c9a Author: Zhan Xusheng Date: Tue May 26 10:21:31 2026 +0800 cpufreq/amd-pstate: drop stale @epp_cached kdoc Commit 4e16c1175238 ("cpufreq/amd-pstate: Stop caching EPP") removed the epp_cached field from struct amd_cpudata in favour of always reading from cppc_req_cached, but the kdoc above the struct still documents @epp_cached. Drop the now-stale @epp_cached entry. Reviewed-by: Mario Limonciello (AMD) Fixes: 4e16c1175238 ("cpufreq/amd-pstate: Stop caching EPP") Signed-off-by: Zhan Xusheng Link: https://lore.kernel.org/r/20260526022131.1302373-1-zhanxusheng@xiaomi.com Signed-off-by: Mario Limonciello (AMD) commit 63838c323924fe4a78b2323bd45aa1030f72ca60 Author: Yuho Choi Date: Sun May 24 22:47:09 2026 -0400 ARM: socfpga: Fix OF node refcount leak in SMP setup socfpga_smp_prepare_cpus() looks up the Cortex-A9 SCU node with of_find_compatible_node(), which returns a node reference that must be released with of_node_put(). The function maps the SCU registers and then returns without dropping that reference, leaking the node on both the success path and the of_iomap() failure path. Drop the reference once the mapping attempt is complete. The returned MMIO mapping does not depend on keeping the device node reference held. Fixes: 122694a0c712 ("ARM: socfpga: use of_iomap to map the SCU") Cc: stable@vger.kernel.org Signed-off-by: Yuho Choi Signed-off-by: Dinh Nguyen commit 29d87434cb91b7689de2917830ca82acfd2770f5 Author: Arnd Bergmann Date: Tue May 26 12:19:37 2026 +0200 regulator: mt6363: select CONFIG_IRQ_DOMAIN When build-testing this driver without CONFIG_IRQ_DOMAIN causes a compile-time error: drivers/regulator/mt6363-regulator.c: In function 'mt6363_regulator_probe': drivers/regulator/mt6363-regulator.c:884:18: error: implicit declaration of function 'irq_find_host' [-Wimplicit-function-declaration] 884 | domain = irq_find_host(interrupt_parent); | ^~~~~~~~~~~~~ drivers/regulator/mt6363-regulator.c:884:16: error: assignment to 'struct irq_domain *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 884 | domain = irq_find_host(interrupt_parent); | ^ drivers/regulator/mt6363-regulator.c:896:30: error: implicit declaration of function 'irq_create_fwspec_mapping'; did you mean 'irq_create_of_mapping'? [-Wimplicit-function-declaration] 896 | info->virq = irq_create_fwspec_mapping(&fwspec); | ^~~~~~~~~~~~~~~~~~~~~~~~~ | irq_create_of_mapping This is rather hard to trigger because so many other drivers enable IRQ_DOMAIN already, but I ran into this on an s390 randconfig build. Ensure this is always enabled using a Kconfig 'select IRQ_DOMAIN' entry, as we do for all other users of this. Fixes: 3c36965df808 ("regulator: Add support for MediaTek MT6363 SPMI PMIC Regulators") Signed-off-by: Arnd Bergmann Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20260526102003.2527570-1-arnd@kernel.org Signed-off-by: Mark Brown commit 2e357f002c61fd76fd8f12468744a06a5ec48eaa Author: Björn Töpel Date: Fri May 22 14:06:40 2026 +0200 net: Avoid checksumming unreadable skb tail on trim pskb_trim_rcsum_slow() keeps CHECKSUM_COMPLETE valid by subtracting the checksum of the bytes removed from the skb tail. That assumes the removed bytes can be read. io_uring zcrx skbs may contain unreadable net_iov frags. With fbnic header/data split, small TCP/IPv4 packets can carry Ethernet padding in such a frag. ip_rcv_core() trims the skb to iph->tot_len before TCP sees it, and the CHECKSUM_COMPLETE adjustment then calls skb_checksum() on the padding. This is exposed by IPv4 because small TCP/IPv4 frames can be shorter than the Ethernet minimum payload. TCP/IPv6 frames are large enough in the normal zcrx path, so they do not hit the same padding trim. Keep the existing checksum adjustment for readable skbs. If the remaining packet is fully linear, drop CHECKSUM_COMPLETE and let the stack validate the packet after trimming. If unreadable payload would remain, fail the trim; the checksum cannot be adjusted without reading the trimmed tail. Also clear skb->unreadable when trimming removes all frags. Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") Signed-off-by: Björn Töpel Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260522120643.242974-1-bjorn@kernel.org Signed-off-by: Paolo Abeni commit 4db2bd2ed4785dbadaeeab9f4e346b21ac5fb8eb Author: Michael Bommarito Date: Mon May 25 05:28:29 2026 -0400 thunderbolt: Limit XDomain response copy to actual frame size tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the valid frame data in the DMA pool buffer into stale contents from previous transactions. Use the minimum of frame size and expected response size for the copy length. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Signed-off-by: Mika Westerberg commit a504b9f2797b739e0304d537e8aa4ce883ecce39 Author: Michael Bommarito Date: Mon May 25 05:28:28 2026 -0400 thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast. Fixes: 8e1de7042596 ("thunderbolt: Add support for XDomain lane bonding") Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Signed-off-by: Mika Westerberg commit 322e93448d908434ae5545660fcbe8f5a7a8e141 Author: Michael Bommarito Date: Mon May 25 05:28:27 2026 -0400 thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write past the kcalloc allocation. Clamp the per-packet copy length so that the cumulative offset never exceeds data_len. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Signed-off-by: Mika Westerberg commit 65423079c7420e3dbf9a7aa345c243a3f5752e5d Author: Michael Bommarito Date: Mon May 25 05:28:26 2026 -0400 thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing content_offset and content_len to reject directories whose content extends past the block. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Signed-off-by: Mika Westerberg commit cff8eb65d1eafe7793e54b4d0cf6bf831644630b Author: Michael Bommarito Date: Mon May 25 05:28:25 2026 -0400 thunderbolt: Reject zero-length property entries in validator tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the null-termination logic: property->value.text[property->length * 4 - 1] = '\0'; When property->length is 0 this writes to offset -1 relative to the allocation. Reject zero-length entries early in the validator since they have no valid representation in the XDomain property protocol. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Signed-off-by: Mika Westerberg commit df488cac6140aa04ae52af9b4507d8f99a3762be Author: K Prateek Nayak Date: Sat May 23 05:55:03 2026 +0000 cpufreq/amd-pstate-ut: Disable dynamic_epp after the mode switch Dan reported a possible NULL pointer dereference in amd-pstate-ut.c from static analysis and sure enough, running amd-pstate-ut in active mode with amd_dynamic_epp=enable results in a crash as a reult of the policy reference being set to NULL early, before disabling dynamic EPP. Kalpana also reported seeing amd-pstate-ut error out with -EBUSY for "amd_pstate_ut_epp" test when starting from the passive mode and amd_dynamic_epp=enable in the command line. The reason for the failure is that the command line enables dynamic_epp by default after the mode switch and the modifications to EPP values are blocked when running in dynamic EPP mode. Solution to both problems is to toggle off dynamic_epp *after* the mode switch when the driver grabs the policy reference again since the unit test is in full control of the policy after that point. The final restoration step will reset the dynamic_epp state via mode switch based on the initial conditions of the system. Reported-by: Kalpana Shetty Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-pm/ahEq0CvdBX0T7_cO@stanley.mountain/ Fixes: f9f16835d4dc ("cpufreq/amd-pstate-ut: Drop policy reference before driver switch") Signed-off-by: K Prateek Nayak Link: https://patch.msgid.link/20260523055503.7651-1-kprateek.nayak@amd.com Signed-off-by: Rafael J. Wysocki commit 364c2fdacf1ab2e1568277d509c9d86f4e52ca26 Merge: 25fe708bbc5928 8b484efd5cb4ee Author: Paolo Abeni Date: Tue May 26 11:16:14 2026 +0200 Merge branch 'ip6_vti-vti6_changelink-and-vti6_siocdevprivate-netns-fixes' Maoyi Xie says: ==================== ip6_vti: vti6_changelink and vti6_siocdevprivate netns fixes 1/2 carries forward Eric Dumazet's Reviewed-by. Only the Fixes tag changes there. 2/2 changes the Fixes tag and adds the ns_capable hunk. ==================== Link: https://patch.msgid.link/20260521130555.3421684-1-maoyixie.tju@gmail.com Signed-off-by: Paolo Abeni commit 8b484efd5cb4eeef9021a661e198edc5349dacf6 Author: Maoyi Xie Date: Thu May 21 21:05:55 2026 +0800 ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) for the collision lookup. For a tunnel moved through IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net. SIOCCHGTUNNEL on a migrated tunnel then runs: net = dev_net(dev) /* migrated netns */ t = vti6_locate(net, &p1, false) /* misses target in t->net */ ... t = netdev_priv(dev) vti6_update(t, &p1, false) /* mutates t->net's hash */ A caller in the migrated netns picks params that match a tunnel in the creation netns. The lookup in dev_net(dev) finds nothing. vti6_update() prepends the migrated tunnel at the head of the creation netns hash bucket for those params. Later lookups in the creation netns resolve to the migrated device. xfrm receive delivers the matched packets through a device the caller controls. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts. Switch the SIOCCHGTUNNEL path on a non fallback device to use t->net for the lookup. The lookup now matches the netns vti6_update() operates on. Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) before the lookup. The check at the top of the case is against dev_net(dev)->user_ns, which after migration is the attacker's netns. A caller there can pick params absent from self->net, the lookup returns NULL, t becomes self, and vti6_update() inserts the device into the creation netns hash. The new check requires CAP_NET_ADMIN in the creation netns user_ns too. SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep dev_net(dev), which equals init_net there. Fixes: 61220ab34948 ("vti6: Enable namespace changing") Suggested-by: Jakub Kicinski Suggested-by: Xiao Liang Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Maoyi Xie Link: https://patch.msgid.link/20260521130555.3421684-3-maoyixie.tju@gmail.com Signed-off-by: Paolo Abeni commit 11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe Author: Kuniyuki Iwashima Date: Thu May 21 21:05:54 2026 +0800 ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns. vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts. Fixes: 61220ab34948 ("vti6: Enable namespace changing") Reported-by: Maoyi Xie Reviewed-by: Eric Dumazet Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260521130555.3421684-2-maoyixie.tju@gmail.com Signed-off-by: Paolo Abeni commit 25fe708bbc59289d3d1ea4b126fbc1b460a072a5 Author: Weiming Shi Date: Thu May 21 01:12:01 2026 -0700 net: team: fix NULL pointer dereference in team_xmit during mode change __team_change_mode() clears team->ops with memset() before restoring safe dummy handlers via team_adjust_ops(). A concurrent team_xmit() running under RCU on another CPU can read team->ops.transmit during this window and call a NULL function pointer, crashing the kernel. The race requires a mode change (CAP_NET_ADMIN) concurrent with transmit on the team device. BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: 0010 [#1] SMP KASAN NOPTI RIP: 0010:0x0 Call Trace: team_xmit (drivers/net/team/team_core.c:1853) dev_hard_start_xmit (net/core/dev.c:3904) __dev_queue_xmit (net/core/dev.c:4871) packet_sendmsg (net/packet/af_packet.c:3109) __sys_sendto (net/socket.c:2265) The original code assumed that no ports means no traffic, so mode changes could freely memset()/memcpy() the ops. AF_PACKET with forced carrier breaks that assumption. Prevent the race instead of making it safe: replace memset()/memcpy() with per-field updates that never touch transmit or receive. Those two handlers are managed solely by team_adjust_ops(), which already installs dummies when tx_en_port_count == 0 (always true during mode change since no ports are present). WRITE_ONCE/READ_ONCE prevent store/load tearing on the handler pointers. synchronize_net() before exit_op() drains in-flight readers that may still reference old mode state from before port removal switched the handlers to dummies. Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260521081159.1491563-3-bestswngs@gmail.com Signed-off-by: Paolo Abeni commit c16f74dc1d75d0e2e7670076d5375deda110ebeb Author: Zhengchuan Liang Date: Fri May 22 17:31:55 2026 +0800 xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until the deferred callback runs. Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybe_get_net() so the queueing path does not revive a namespace that is already being torn down. This keeps the existing workqueue design and fixes the netns lifetime handling in one place for all users of xfrm_trans_queue_net(). Fixes: 7b3801927e52 ("xfrm: introduce xfrm_trans_queue_net") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Xin Liu Co-developed-by: Luxing Yin Signed-off-by: Luxing Yin Signed-off-by: Zhengchuan Liang Signed-off-by: Ren Wei Assisted-by: Codex:gpt-5.4 Signed-off-by: Steffen Klassert commit 3e52417318473782012b236d0325bf7d2266a597 Author: Usama Arif Date: Thu May 21 03:29:26 2026 -0700 xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit The struct pernet_operations docstring in include/net/net_namespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking RCU primitives, such as synchronize_rcu(), should be implemented via exit_batch. [...] Please, avoid synchronize_rcu() at all, where it's possible. Note that a combination of pre_exit() and exit() can be used, since a synchronize_rcu() is guaranteed between the calls. xfrm_policy_fini() violates this: it calls synchronize_rcu() before freeing the policy_bydst hash tables (so no RCU reader is mid- traversal at free time), but runs from xfrm_net_ops.exit -- once per namespace -- so a cleanup_net() of N namespaces pays N full RCU grace periods serially. Use the documented pre_exit/exit split. Move the policy flush (and the workqueue drains it depends on) into a new .pre_exit handler; xfrm_policy_fini() then runs in .exit and frees the hash tables after the synchronize_rcu_expedited() that cleanup_net() guarantees between the two phases. Providing O(1) RCU grace periods per batch instead of O(N). Observed on Linux 6.18 with a workload doing unshare(CLONE_NEWNET) at ~13/sec sustained: cleanup_net() and the netns_wq rescuer kthread both stuck in xfrm_policy_fini()'s synchronize_rcu(), >300k struct net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and __put_net counts were balanced, ruling out a refcount leak. Fixes: 069daad4f2ae ("xfrm: Wait for RCU readers during policy netns exit") Signed-off-by: Usama Arif Signed-off-by: Steffen Klassert commit 7f83d174073234839aea176f265e517e0d50a1d2 Author: Shaomin Chen Date: Thu May 21 02:07:23 2026 +0800 xfrm: iptfs: reset runtime state when cloning SAs iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This copies runtime objects which must not be shared with the original SA, including the embedded sk_buff_head, hrtimers, spinlock, and in-flight reassembly/reorder state. If xfrm_state_migrate() fails after clone_state() but before the later init_state() call has reinitialized those fields, the cloned state can be destroyed by xfrm_state_gc_task() with list and timer state copied from the original SA. With queued packets this lets the clone splice and free skbs owned by the original IPTFS queue, leading to use-after-free and double-free reports in iptfs_destroy_state() and skb release paths. Reinitialize the clone's runtime state before publishing it through x->mode_data. Because clone_state() now publishes a destroyable mode_data object before init_state(), take the mode callback module reference there. Avoid taking it again from __iptfs_init_state() for the same object. Fixes: 0e4fbf013fa5 ("xfrm: iptfs: add user packet (tunnel ingress) handling") Cc: stable@vger.kernel.org Signed-off-by: Shaomin Chen Signed-off-by: Steffen Klassert commit 3549a9649dc7c5fc586ab12f675279283cdcb2a7 Author: Jouni Högander Date: Wed May 20 13:49:44 2026 +0300 drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable We are observing following warnings: *ERROR* power well DC_off state mismatch (refcount 0/enabled 1) gen9_dc_off_power_well_enabled is considering target state DC_STATE_DISABLE as DC_OFF power well being enabled. Fix this by using wakeref for the purpose. To achieve this we need to modify notification code as well. Currently it is possible that PSR gets notified vblank enable/disable twice on same status. This is currently not a problem as it is just triggering call to intel_display_power_set_target_dc_state with same target state as a parameter. When using wakeref this becomes a problem due to reference counting. Fix this storing vbank status on last notification and use that to ensure there are no more than one notification with same vblank status. v2: ensure there is no subsequent notifications with same status Fixes: aa451abcffb5 ("drm/i915/display: Prevent DC6 while vblank is enabled for Panel Replay") Cc: # v6.13+ Signed-off-by: Jouni Högander Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/20260520104944.239797-2-jouni.hogander@intel.com (cherry picked from commit 35485ac56d878192a3829a58cb26503125ec7104) Signed-off-by: Tvrtko Ursulin commit 8bb9093df555f9e89fdbe1405118b11384c03e04 Author: Jouni Högander Date: Wed May 20 13:49:43 2026 +0300 drm/i915/psr: Block DC states on vblank enable when Panel Replay supported Currently we are blocking DC states only when Panel Replay is enabled on vblank enable. It may happen that Panel Replay is getting enabled when vblank is already enabled. Fix this by blocking DC states always if Panel Replay is supported. While at it take care of possible dual eDP case by looping all encoders supporting PSR. Fixes: 0c427ac78a1d ("drm/i915/psr: Add interface to notify PSR of vblank enable/disable") Cc: # v6.16+ Signed-off-by: Jouni Högander Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/20260520104944.239797-1-jouni.hogander@intel.com (cherry picked from commit eb5911f990554f7ce947dd53df00c114362e4465) Signed-off-by: Tvrtko Ursulin commit d196136a988051173f68f91de0b5a1bd32122dd7 Author: Pranay Samala Date: Tue May 19 13:23:08 2026 +0530 drm/i915/color: Fix HDR pre-CSC LUT programming loop The integer lut programming loop never executes completely due to incorrect condition (i++ > 130). Fix to properly program 129th+ entries for values > 1.0. Cc: #v6.19 Fixes: 82caa1c8813f ("drm/i915/color: Program Pre-CSC registers") Signed-off-by: Pranay Samala Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260519075308.383877-1-pranay.samala@intel.com (cherry picked from commit f33862ec3e8849ad7c0a3dd46719083b13ade248) Signed-off-by: Tvrtko Ursulin commit 202e77cf2e839e1adc804433322dc5c9ee511c9f Author: Michał Grzelak Date: Thu Apr 16 18:37:44 2026 +0200 drm/i915/aux: use polling when irqs are unavailable PTL with physically disconnected display was observed to have 40s longer execution time when testing xe_fault_injection@xe_guc_mmio_send_recv. The issue has not been seen when reverting commit 40a9f77a28fa ("Revert "drm/i915/dp: change aux_ctl reg read to polling read""). Apparently the configuration suffers from not having AUX enabled when using interrupts. One probable cause can be xe enabling interrupts too late: interrupts need memory allocations which currently can't be done before the display FB takeover is done. As for now, use polling for AUX in case interrupts are unavailable. Fixes: 40a9f77a28fa ("Revert "drm/i915/dp: change aux_ctl reg read to polling read"") Suggested-by: Ville Syrjälä Signed-off-by: Michał Grzelak Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260416163744.288107-1-michal.grzelak@intel.com (cherry picked from commit 05e0550b65cd1604bd515fbc65f522bce4c10a87) Signed-off-by: Tvrtko Ursulin commit 5c4063c87a619e4df954c179d24628636f5db15f Author: Janusz Krzysztofik Date: Fri May 8 14:23:51 2026 +0200 drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right pointer. A user reported hitting the following bug under heavy use on DG2: [26620.095550] Oops: general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 1 SMP NOPTI [26620.095556] CPU: 2 UID: 0 PID: 631 Comm: Xorg Not tainted 6.18.8 #1 PREEMPT(lazy) [26620.095558] Hardware name: ASRock B850M Steel Legend WiFi/B850M Steel Legend WiFi, BIOS 3.50 09/18/2025 [26620.095559] RIP: 0010:i915_ttm_purge+0x84/0x100 [i915] [26620.095604] Code: 00 00 00 48 8d 54 24 10 48 89 e6 48 89 fb e8 83 aa ae ff 85 c0 75 6f 48 83 bb a8 01 00 00 00 74 2c 48 8b 45 78 48 85 c0 74 23 <48> 8b 78 20 48 c7 c2 ff ff ff ff 31 f6 e8 7a 73 e3 e0 48 8b 7d 78 [26620.095605] RSP: 0018:ffffc90005fd7430 EFLAGS: 00010282 [26620.095607] RAX: a56b6b6b6b6b6b6b RBX: ffff8881f46c3dc0 RCX: 0000000000000000 [26620.095608] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 00000000ffffffff [26620.095609] RBP: ffff888289610f00 R08: 0000000000000001 R09: ffff88823b022000 [26620.095609] R10: ffff888103029b28 R11: ffff8881fc7f3800 R12: ffff88810b6150d0 [26620.095609] R13: ffff888289610f00 R14: 0000000000000000 R15: ffff8881f46c3dc0 [26620.095610] FS: 00007f1004d86900(0000) GS:ffff88901c858000(0000) knlGS:0000000000000000 [26620.095611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [26620.095611] CR2: 00007f0fdf489000 CR3: 000000035b0c1000 CR4: 0000000000750ef0 [26620.095612] PKRU: 55555554 [26620.095612] Call Trace: [26620.095615] [26620.095615] i915_ttm_move+0x2b9/0x420 [i915] [26620.095642] ? ttm_tt_init+0x65/0x80 [ttm] [26620.095644] ? i915_ttm_tt_create+0xc6/0x150 [i915] [26620.095667] ttm_bo_handle_move_mem+0xb6/0x160 [ttm] [26620.095669] ttm_bo_evict+0x100/0x150 [ttm] [26620.095671] ? preempt_count_add+0x64/0xa0 [26620.095673] ? _raw_spin_lock+0xe/0x30 [26620.095675] ? _raw_spin_unlock+0xd/0x30 [26620.095675] ? i915_gem_object_evictable+0xb7/0xd0 [i915] [26620.095704] ttm_bo_evict_cb+0x6e/0xd0 [ttm] [26620.095705] ttm_lru_walk_for_evict+0xa6/0x200 [ttm] [26620.095708] ttm_bo_alloc_resource+0x185/0x4f0 [ttm] [26620.095709] ? init_object+0x62/0xd0 [26620.095712] ttm_bo_validate+0x7a/0x180 [ttm] [26620.095713] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095714] __i915_ttm_get_pages+0xb0/0x170 [i915] [26620.095737] i915_ttm_get_pages+0x9f/0x150 [i915] [26620.095759] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915] [26620.095786] ? alloc_debug_processing+0xd0/0x100 [26620.095787] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095788] ? i915_vma_instance+0xa0/0x4e0 [i915] [26620.095822] __i915_gem_object_get_pages+0x2f/0x40 [i915] [26620.095848] i915_vma_pin_ww+0x706/0x980 [i915] [26620.095875] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915] [26620.095904] eb_validate_vmas+0x170/0xa00 [i915] [26620.095930] i915_gem_do_execbuffer+0x1201/0x2b40 [i915] [26620.095953] ? alloc_debug_processing+0xd0/0x100 [26620.095954] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095955] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915] [26620.095977] ? __wake_up_sync_key+0x32/0x50 [26620.095979] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915] [26620.096001] ? __slab_alloc.isra.0+0x67/0xc0 [26620.096003] i915_gem_execbuffer2_ioctl+0x11a/0x240 [i915] Results from decode_stacktrace.sh pointed to dereference of a file pointer field of a i915 TTM page vector container associated with an object being purged on eviction. That path is taken when the object is marked as no longer needed. Code analysis revealed a possibility of the i915 TTM page vector container being replaced with a new instance inside a function that purges content of the object, should it be still busy. That function is called, indirectly via a more general function that changes the object's placement and caching policy, before the problematic dereference, but still after a pointer to the container is captured, rendering the pointer no longer valid. Fix the issue by capturing the pointer to the container only after its potential replacement. v2: Move the container_of() inside the if block (Sebastian), - a simplified version of the commit description that explains briefly why the change is necessary (Christian). Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/14882 Fixes: 7ae034590ceae ("drm/i915/ttm: add tt shmem backend") Signed-off-by: Janusz Krzysztofik Cc: stable@vger.kernel.org # v5.17+ Cc: Matthew Auld Cc: Thomas Hellström Cc: Sebastian Brzezinka Cc: Christian König Reviewed-by: Andi Shyti Reviewed-by: Christian König Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260508122612.469227-2-janusz.krzysztofik@linux.intel.com (cherry picked from commit 4462966a93eb185849b7f174f0d0de53476d00a4) Signed-off-by: Tvrtko Ursulin commit dac917ed5aead741004db8d0d5151dd577802df8 Author: Alexander Stein Date: Tue May 26 08:35:01 2026 +0200 gpio: mxc: fix irq_high handling If port->irq_high is -1 (fsl,imx21-gpio compatible) and gpio_idx is >= 16 enable_irq_wake() is called with -1 which is wrong. Fixes: 5f6d1998adeb ("gpio: mxc: release the parent IRQ in runtime suspend") Signed-off-by: Alexander Stein Reviewed-by: Frank Li Link: https://patch.msgid.link/20260526063504.25916-1-alexander.stein@ew.tq-group.com Signed-off-by: Bartosz Golaszewski commit 8fd2f26fa2a33cfe8ac043f976137ecf5b567f03 Author: Pratyush Yadav (Google) Date: Tue May 19 15:33:30 2026 +0200 kho: fix order calculation for kho_unpreserve_pages() Commit 91e74fa8b1bc ("kho: make sure preservations do not span multiple NUMA nodes") made sure preservations from kho_preserve_pages() do not span multiple NUMA nodes. If they do, the order is reduced and tried again. The same logic was not implemented for kho_unpreserve_pages(). This can result in unpreserve calculating a different order than preserve, and thus not actually unpreserving the pages. Fix this by moving the order calculation logic to __kho_preserve_pages_order() and use it from both preserve and unpreserve paths. Move __kho_unpreserve() down to avoid having a forward declaration. Its users are further down in the file anyway. Also, it results in grouping for all the page-level preservation and unpreservation functions. This unfortunately makes the diff hard to read, but the main change in __kho_unpreserve() is to call __kho_preserve_pages_order() instead of open-coding the order calculation. Fixes: 91e74fa8b1bc ("kho: make sure preservations do not span multiple NUMA nodes") Cc: stable@vger.kernel.org Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Samiullah Khawaja Reviewed-by: Pasha Tatashin Link: https://patch.msgid.link/20260519133332.2498092-1-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit d64b0372760e09de6d18a0616d7bc652c8c6891d Author: George Guo Date: Sat May 9 10:44:15 2026 +0800 kho: fix KHO_TREE_MAX_DEPTH for non-4KB page sizes KHO_TREE_MAX_DEPTH is calculated as: DIV_ROUND_UP(KHO_ORDER_0_LOG2 - KHO_BITMAP_SIZE_LOG2, KHO_TABLE_SIZE_LOG2) + 1 For systems with 16KB pages (e.g. arm64 with CONFIG_ARM64_16K_PAGES=y or LoongArch), this gives a depth of 4. Since levels are 0 based, with depth = 4 the effective top level is 3 and the top-level shift at bit 39. PAGE_SHIFT = 14 KHO_BITMAP_SIZE_LOG2 = PAGE_SHIFT + 3 = 17 KHO_TABLE_SIZE_LOG2 = log(2; (1 << PAGE_SHIFT) / 8) = 11 shift = ((3 - 1) * KHO_TABLE_SIZE_LOG2) + KHO_BITMAP_SIZE_LOG2 = 39 The order-0 bit sits at bit 50 (KHO_ORDER_0_LOG2 = 64 - PAGE_SHIFT = 50). When inserting or reading a key, the index extracted at the top level is: (1 << 50) >> 39 = 2048 2048 is exactly the table size (PAGE_SIZE / sizeof(phys_addr_t) = 2048 for 16KB pages), so it wraps to 0, aliasing the order bit to index 0 and losing it silently. On the second kernel, kho_radix_decode_key() sees a key without the order bit, calls fls64() on the wrong bit, computes a wrong order and thus a garbage physical address. phys_to_page() of that address faults in kho_preserved_memory_reserve(), causing a kernel panic early in boot. Fix by adding +1 to the DIV_ROUND_UP numerator so the formula accounts for the order bit itself, giving depth 5 for 16KB pages. The top-level shift becomes 50, and (1 << 50) >> 50 = 1, which is nonzero and unambiguous. For 4KB and 64KB page sizes the depth is unchanged. Link: https://patch.msgid.link/20260509024415.33190-1-dongtai.guo@linux.dev Fixes: 3f2ad90060f6 ("kho: adopt radix tree for preserved memory tracking") Tested-by: Kexin Liu Signed-off-by: George Guo Reviewed-by: Pasha Tatashin [rppt: added actual math to the changelog] Signed-off-by: Mike Rapoport (Microsoft) commit 4a44b17406cb5a93f90af3df9392b3a45eb336fb Author: Alice Ryhl Date: Thu May 7 11:14:42 2026 +0000 rust: kasan/kbuild: fix rustc-option when cross-compiling The Makefile version of rustc-option currently checks whether the option exists for the host target instead of the target actually being compiled for. It was done this way in commit 46e24a545cdb ("rust: kasan/kbuild: fix missing flags on first build") to avoid a circular dependency on target.json. However, because of this, rustc-option currently does not function when cross-compiling from x86_64 to aarch64 if CONFIG_SHADOW_CALL_STACK is enabled. This is because KBUILD_RUSTFLAGS contains -Zfixed-x18 under this configuration. Since that flag does not exist on the host target, rustc-option runs into a compilation failure every time, leading to all flags being rejected as unsupported. To fix this, update rustc-option to pass a --target parameter so that the host target is not used. For targets using target.json, use a built-in target that is as close as possible to the target created with target.json to avoid the circular dependency on target.json. One scenario where this causes a boot failure: * Cross-compiled from x86_64 to aarch64. * With CONFIG_SHADOW_CALL_STACK=y * With CONFIG_KASAN_SW_TAGS=y * With CONFIG_KASAN_INLINE=n Then the resulting kernel image will fail to boot when it first calls into Rust code with a crash along the lines of "Unable to handle kernel paging request at virtual address 0ffffffc08541796". This is because the call threshold is not specified, so rustc will inline kasan operations, but the kasan shadow offset is not specified, which leads to the inlined kasan instructions being incorrect. Note that the -Zsanitizer=kernel-hwaddress parameter itself does not lead to a rustc-option failure despite being aarch64-specific because RUSTFLAGS_KASAN has not yet been added to KBUILD_RUSTFLAGS when rustc-option is evaluated by the kasan Makefile. Cc: stable@vger.kernel.org Fixes: 46e24a545cdb ("rust: kasan/kbuild: fix missing flags on first build") Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260507-rustc-option-cross-v2-1-2f650a49c2b5@google.com [ Edited slightly: - Reset variable to avoid using the environment. - Use a simply expanded variable flavor for simplicity. - Export variable so that behavior in sub-`make`s is consistent. This matches other variables. - Miguel ] Signed-off-by: Miguel Ojeda commit 539b7cf1f77a5135241f410777b3c780c6e23994 Author: Niklas Schnelle Date: Thu May 21 13:10:44 2026 +0200 s390/configs: Enable IOMMUFD and VFIO cdev in defconfigs Enable IOMMUFD and VFIO cdev such that PCI pass-through to QEMU/KVM can optionally utilize native IOMMUFD. Note that because the defconfigs do not enable IOMMUFD_VFIO_CONTAINER the default PCI pass-through using VFIO with the existing container interface is not affected. Signed-off-by: Niklas Schnelle Acked-by: Heiko Carstens Acked-by: Matthew Rosato Signed-off-by: Alexander Gordeev commit 44e151be23deb788d9f6124de93823faf6e04e99 Author: Dan Carpenter Date: Mon May 25 10:14:42 2026 +0300 accel/ivpu: prevent uninitialized data bug in debugfs The simple_write_to_buffer() will only initialize data starting from the *pos offset so if it's non-zero then the first part of the buffer uninitialized. Really, if *pos is non-zero then this code won't work so just check for that at the start of the function. Fixes: 320323d2e545 ("accel/ivpu: Add debugfs interface for setting HWS priority bands") Signed-off-by: Dan Carpenter Reviewed-by: Karol Wachowski Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/ahP24m6Mii9EDL7Q@stanley.mountain commit 20587302f8d700f26ee2c8a60ffb0a69ae0edf16 Author: Zhang Heng Date: Tue May 26 09:36:11 2026 +0800 ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP Add quirk for ALC294 codec on ASUS ROG Strix G615LP (SSID 1043:1214) using ALC287_FIXUP_TXNW2781_I2C_ASUS to fix speaker output. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221173 Cc: Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260526013611.1954949-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 80501dff814eeccebf44a59340c3fe3a205eb120 Author: Borislav Petkov (AMD) Date: Wed May 20 13:25:07 2026 -0700 Documentation/arch/x86: Hide clearcpuid= This option was never meant to be used in production because it solely clears the X86_FEATURE kernel-internal representation of what CPUID bits it has detected and doesn't do any *proper* feature disablement like clearing CR4.CET in the user shadow stack case, for example. So remove its documentation so that it doesn't get used in production and people get silly ideas. It is meant strictly for debugging; and if a chicken bit for properly disabling a feature is warranted, then that would need proper enablement. No functional changes. Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Cc: Mathias Krause Cc: Linus Torvalds Link: https://patch.msgid.link/20260520202508.160112-1-bp@kernel.org commit f229426072fc865654a60978bb7fda790a051ff3 Author: Luka Gejak Date: Sat May 23 15:03:30 2026 +0200 net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this, a truncated frame could cause an out-of-bounds access. Fixes: eafaa88b3eb7 ("net: hsr: Add support for redbox supervision frames") Signed-off-by: Luka Gejak Reviewed-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260523130330.61880-1-luka.gejak@linux.dev Signed-off-by: Jakub Kicinski commit 2156a29aecfffa2eb7c558255690084efbe9f3b0 Author: Michael Bommarito Date: Wed May 20 11:41:57 2026 -0400 octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY request body verbatim, and rvu_rep_up_notify() then forwards event->pcifunc (the nested body field, distinct from the AF-normalised header pcifunc) into rvu_get_pfvf(), rvu_get_pf() and the AF->PF mailbox device index without any bounds check. A VF attached to a PF that has been put into switchdev representor mode reaches this path: the VF mailbox handler otx2_pfvf_mbox_handler() forwards every message id including MBOX_MSG_REP_EVENT_NOTIFY to AF without an allowlist, and the AF dispatcher rewrites only msg->pcifunc, leaving struct rep_event::pcifunc attacker-controlled. The sibling rvu_mbox_handler_esw_cfg() refuses requests whose header pcifunc is not rvu->rep_pcifunc; this handler has no equivalent gate. An out-of-range body pcifunc selects an &rvu->pf[]/&rvu->hwvf[] element past the allocated array and, for RVU_EVENT_MAC_ADDR_CHANGE, turns into a six-byte attacker-chosen OOB ether_addr_copy() target inside the queued worker; KASAN reports a slab-out-of-bounds write in rvu_rep_wq_handler. Reject malformed requests at the handler entry by gating on is_pf_func_valid(), which is already the canonical PF/VF range check in this driver; expose it via rvu.h so callers in rvu_rep.c can use it instead of open-coding the same range arithmetic. Fixes: b8fea84a0468 ("octeontx2-pf: Add support to sync link state between representor and VFs") Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260520154157.1439319-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski commit e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 Merge: 13e4d2579eb34e 974820a59efde7 Author: Linus Torvalds Date: Mon May 25 12:49:27 2026 -0700 Merge tag 'for-7.1/hpfs-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull hpfs fix from Mikulas Patocka: - Fix a crash on corrupted filesystem * tag 'for-7.1/hpfs-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: hpfs: fix a crash if hpfs_map_dnode_bitmap fails commit 13e4d2579eb34e9731bcc5ca73205708355e5d99 Merge: c112662a0e7341 fb7415f2ab0e3c Author: Linus Torvalds Date: Mon May 25 12:45:40 2026 -0700 Merge tag 'for-7.1/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fix from Mikulas Patocka: - fix crashes in dm-vdo if GFP_NOWAIT allocation fails * tag 'for-7.1/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm vdo: use GFP_NOIO for blkdev_issue_zeroout on format path commit e68842b3356471ba56c882209f324613dac47f64 Author: Junrui Luo Date: Wed May 20 11:47:55 2026 +0800 macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in the upper half, pn_same_half(pn, lower) is true and the XPN else-if does not fire either, leaving next_pn_halves unchanged. An attacker that captures the legitimate frame carrying pn == 0xFFFFFFFF on an XPN association can then replay it indefinitely, since lowest_pn never rises above the captured pn and macsec_decrypt() reconstructs the same IV. Extend the XPN else-if to also fire when pn + 1 wraps to 0, so receipt of pn == U32_MAX advances next_pn_halves to (upper + 1, 0). Fixes: a21ecf0e0338 ("macsec: Support XPN frame handling - IEEE 802.1AEbw") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB78813FD49E58F253B989F197AF012@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Jakub Kicinski commit c112662a0e734129985cf3386250cfa59f6b7aa0 Merge: e7ae89a0c97ce2 f42d01aadcedd7 Author: Linus Torvalds Date: Mon May 25 12:22:50 2026 -0700 Merge tag 'bootconfig-fixes-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig fix from Masami Hiramatsu: - Fix buf leak in apply_xbc * tag 'bootconfig-fixes-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tools/bootconfig: Fix buf leaks in apply_xbc commit d47548a36639095939f4747d4c43f2271366f565 Author: Justin Iurman Date: Fri May 22 13:20:13 2026 +0200 ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Justin Iurman Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260522112013.12342-1-justin.iurman@gmail.com Signed-off-by: Jakub Kicinski commit f7b52afe3592eae66e160586b45a3f2242972c63 Author: Zhengchuan Liang Date: Fri May 22 17:42:26 2026 +0800 ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head. This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage. Fixes: a831f5bbc89a ("[IPV6] MIP6: Add inbound interface of home address option.") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Xin Liu Co-developed-by: Luxing Yin Signed-off-by: Luxing Yin Signed-off-by: Zhengchuan Liang Signed-off-by: Ren Wei Reviewed-by: Justin Iurman Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/7aba1debc2196189172499e5769802b026f8caf8.1779247873.git.zcliangcn@gmail.com Signed-off-by: Jakub Kicinski commit 7c2eee9c136734825ff524dd8b2146438a4f8250 Author: Mike Rapoport (Microsoft) Date: Wed May 13 13:51:22 2026 +0300 memblock: don't touch memblock arrays when memblock_free() is called late When memblock_free() is called after memblock_discard() on architectures that don't select ARCH_KEEP_MEMBLOCK, it tries to update memblock.reserved that was already discarded and it causes use-after-free, for example [ 8.514775] BUG: KASAN: use-after-free in memblock_isolate_range+0x4ac/0x650 [ 8.514775] Read of size 8 at addr ffff88a07fe6a000 by task swapper/0/1 [ 8.514775] Call Trace: [ 8.514775] [ 8.514775] kasan_report+0xb2/0x1b0 [ 8.514775] memblock_isolate_range+0x4ac/0x650 [ 8.514775] memblock_phys_free+0xc4/0x190 [ 8.514775] housekeeping_late_init+0x257/0x280 [ 8.514775] do_one_initcall+0xaa/0x470 [ 8.514775] do_initcalls+0x1b4/0x1f0 [ 8.514775] kernel_init_freeable+0x4b5/0x550 [ 8.514775] kernel_init+0x1c/0x150 [ 8.514775] ret_from_fork+0x5dc/0x8e0 [ 8.514775] ret_from_fork_asm+0x1a/0x30 [ 8.514775] Make sure memblock_free() updates memblock.reserved only when called early enough or when ARCH_KEEP_MEMBLOCK is enabled. Reported-by: Waiman Long Reported-by: Breno Leitao Closes: https://lore.kernel.org/all/20260505051821.1107133-1-longman@redhat.com Tested-by: Waiman Long Tested-by: Breno Leitao Fixes: 87ce9e83ab8b ("memblock, treewide: make memblock_free() handle late freeing") Link: https://patch.msgid.link/20260513105122.502506-1-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit f6f1bfc1980a08a8d1eb8eaf161b79c7c67095ba Merge: 86f1d0f063e423 18014147d3ee78 Author: Jakub Kicinski Date: Mon May 25 10:37:27 2026 -0700 Merge tag 'nf-26-05-22' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net Patches 7+8 fix a regression from 7.1-rc1. Everything else is from 2.6.x to 5.3 releases. There are additional known issues with these patches (drive-by-findings in related code). There are many old bugs all over netfilter and our ability to review feature patches has come to a complete halt due to lack of time. There are further security bugs that we cannot address due to lack of time, maintainers and reviewers. Other remarks: The xtables 32bit compat interface is already off in many vendor kernels, the plan is to remove it soon. 1) Prevent RST packets with invalid sequence numbers from forcing TCP connections into the CLOSE state without a direction check. From Hamza Mahfooz. 2) Re-derive the TCP header pointer after skb_ensure_writable in synproxy_tstamp_adjust. Prevent use-after-free and invalid checksum updates caused by stale pointers during buffer expansion. From Chris Mason. 3) Fix a race condition causing keymap list corruption in conntracks gre/pptp helper. 4) Use raw_smp_processor_id() in xt_cpu to prevent splats under PREEMPT_RCU. 5) Disable netfilter payload mangling in user namespaces (nft_payload.c and nf_queue). TCP option mangling via nft_exthdr.c remains enabled. There will be followups here to restrict resp. revalidate headers. 6) Fix an out-of-bounds read in ebtables's compat_mtw_from_user function. 7) Use list_for_each_entry_rcu() to traverse fib6_siblings in nft_fib6_info_nh_uses_dev(). Ensure safe list walking under RCU. 8) Fix an out-of-bounds read in nft_fib_ipv6 caused by incorrect list traversal. 9) Add nft_fib_nexthop selftest to netfilter. Cover nexthop enumeration for single, group, and multipath route shapes. All three nft_fib6 fixes from Jiayuan Chen. 10) Fix destination corruption in shift operations when source and destination registers overlap. Reject partial register overlap for all operations from control plane. From Fernando Fernandez Mancera. * tag 'nf-26-05-22' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: fix dst corruption in same register operation selftests: netfilter: add nft_fib_nexthop test netfilter: nft_fib_ipv6: handle routes via external nexthop netfilter: nft_fib_ipv6: walk fib6_siblings under RCU netfilter: ebtables: fix OOB read in compat_mtw_from_user netfilter: disable payload mangling in userns netfilter: xt_cpu: prefer raw_smp_processor_id netfilter: nf_conntrack_gre: fix gre keymap list corruption netfilter: synproxy: refresh tcphdr after skb_ensure_writable netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check ==================== Link: https://patch.msgid.link/20260522104257.2008-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 86f1d0f063e423a5c1982db1e5e7a8eac511e603 Author: Prathamesh Deshpande Date: Wed May 6 01:00:31 2026 +0100 net/mlx5: HWS: Reject unsupported remove-header action mlx5_cmd_hws_packet_reformat_alloc() handles MLX5_REFORMAT_TYPE_REMOVE_HDR by looking up a matching HWS remove-header action. If mlx5_fs_get_action_remove_header_vlan() returns NULL, the code only logs an error and continues. The function then returns success with a NULL HWS action stored in the packet-reformat object. Return an error when no matching remove-header action is available. Fixes: aecd9d1020e3 ("net/mlx5: fs, add HWS packet reformat API function") Signed-off-by: Prathamesh Deshpande Reviewed-by: Simon Horman Reviewed-by: Yevgeny Kliteynik Acked-by: Tariq Toukan Link: https://patch.msgid.link/20260506000054.51797-1-prathameshdeshpande7@gmail.com Signed-off-by: Jakub Kicinski commit 974820a59efde7c1a7e1260bcfe9bb81f833cc9f Author: Mikulas Patocka Date: Mon May 25 14:48:58 2026 +0200 hpfs: fix a crash if hpfs_map_dnode_bitmap fails If hpfs_map_dnode_bitmap fails, the code would call hpfs_brelse4 on uninitialized quad buffer head, causing a crash. Signed-off-by: Mikulas Patocka Reported-by: Farhad Alemi Cc: stable@vger.kernel.org commit 500eb0203cd1a7b8feea0443f5add9a47444a7b2 Merge: afb2a3a9d8369d 909595c288af23 Author: Mark Brown Date: Mon May 25 13:46:48 2026 +0100 ASoC: qcom: q6asm-dai: fix error handling Srinivas Kandagatla says: Here is the set of patches, that fixes one of the isssue reported by Richard Acayan, while doing fix for the reported issue, found various other issues in the existing code. This set contains some of those cleanups along with few trivial coding style patches which looked uncomfortable to read. Patch 1 should be enough to fix the issue reported. Tested this is on UNO-Q. Link: https://patch.msgid.link/20260518092347.3446946-1-srinivas.kandagatla@oss.qualcomm.com commit 909595c288af2304d0902488698e91c8aeee36a3 Author: Srinivas Kandagatla Date: Mon May 18 09:23:47 2026 +0000 ASoC: qcom: q6asm-dai: use pointer type with kzalloc_obj() Use kzalloc_obj(*prtd) instead of explicitly naming the structure type. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260518092347.3446946-6-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit c92d880cde739a3fb6346f42fc5feb2f093c063c Author: Srinivas Kandagatla Date: Mon May 18 09:23:46 2026 +0000 ASoC: qcom: q6asm-dai: remove unnecessary braces The ASM_CLIENT_EVENT_DATA_WRITE_DONE case does not declare any local variables or require a separate scope, so drop the unnecessary braces. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260518092347.3446946-5-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 4b4db09f283df65d780bc7cee66cb4a7e9bf4770 Author: Srinivas Kandagatla Date: Mon May 18 09:23:45 2026 +0000 ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params Fix error handling in q6asm_dai_compr_set_params() and q6asm_dai_prepare() for both CMD_CLOSE and q6asm_unmap_memory_regions(). In both the functions, we are doing q6asm_audio_client_free in failure cases, which means if prepare or set_params fail, we can never recover. Now open and close are done in respective dai_open/close functions. Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260518092347.3446946-4-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 048c540ee76ded666bda74f9dae1ca3254e0633c Author: Srinivas Kandagatla Date: Mon May 18 09:23:44 2026 +0000 ASoC: qcom: q6asm-dai: close stream only when running q6asm_dai_close() and q6asm_dai_compr_free() currently issue CMD_CLOSE whenever prtd->state is non-zero. After prepare() closes an existing stream, the state is updated to Q6ASM_STREAM_STOPPED. Since this state is also non-zero, the close and free paths can send CMD_CLOSE again for a stream that has already been closed. Restrict CMD_CLOSE to the Q6ASM_STREAM_RUNNING state so the command is sent only when the ASM stream is still active. Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260518092347.3446946-3-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit cee3e63e7106c3c81b2053371fdf14240bfba2fc Author: Srinivas Kandagatla Date: Mon May 18 09:23:43 2026 +0000 ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks The q6asm-dai stream state is used by prepare() to decide whether an existing stream setup needs to be closed before opening/configuring a new one. Updating the state from trigger or asynchronous DSP callbacks can make that state stale or incorrect relative to the actual setup lifetime. In particular, setting Q6ASM_STREAM_STOPPED on STOP or EOS completion can make prepare() believe there is no active setup to close, which can result in opening/configuring the same stream more than once. Keep stream state updates tied to prepare(), where the stream is actually closed and reopened, and stop changing it from trigger and EOS callbacks. Fixes: bfbb12dfa144 ("ASoC: qcom: q6asm-dai: perform correct state check before closing") Cc: Stable@vger.kernel.org Closes: https://lore.kernel.org/all/afS7rTHdc9TyIeLx@rdacayan/ Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260518092347.3446946-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit afb2a3a9d8369d18122a0d7cd294eba9a98259c6 Author: Cássio Gabriel Date: Tue May 19 13:51:47 2026 -0300 ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors byt_cht_es8316_init() enables MCLK before configuring the codec sysclk and creating the headset jack. If either of those later steps fails, the function returns without disabling MCLK, leaving the clock enabled after card registration fails. Track whether this driver enabled MCLK and disable it on the init error paths. Add the matching DAI link exit callback so the same clock enable is also balanced when ASoC cleans up a successfully initialized link. Fixes: a03bdaa565cb ("ASoC: Intel: add machine driver for BYT/CHT + ES8316") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260519-asoc-bytcht-es8316-mclk-leak-v1-1-b4a11cdc2afd@gmail.com Signed-off-by: Mark Brown commit 7f87763f47a3c22fb50265a00619ef10f2394b18 Author: Berkant Koc Date: Sat May 23 15:27:47 2026 +0200 drm/hyperv: validate VMBus packet size in receive callback hyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv->recv_buf. The completion path then runs memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that wakes on wait_for_completion_timeout() can read up to 16 KiB of residue from a prior message as if it were the response payload. Pass bytes_recvd into hyperv_receive_sub() and reject any packet that does not cover the pipe + synthvid header. A single switch on msg->vid_hdr.type then computes the type-specific payload size: the three completion-driving types (SYNTHVID_VERSION_RESPONSE, SYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through to a shared exit that requires that size before memcpy/complete, while SYNTHVID_FEATURE_CHANGE validates its own payload and returns before reading is_dirt_needed. Unknown types are dropped. SYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills resolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT array. Validate the fixed prefix first so resolution_count can be read, bound it against the array, then require only the count-sized array, so the shorter responses the host actually sends are accepted. Only run the sub-handler when vmbus_recvpacket() returned success. The memcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE only on a successful receive; on -ENOBUFS vmbus_recvpacket() instead reports the required length, which can exceed hv->recv_buf, so copying bytes_recvd would read and write past the 16 KiB buffers. Gating on the success return keeps the copy bounded. The nonzero-return path is itself a malformed-message case and is now logged rather than silently skipped; channel recovery is not attempted. Rejected packets are reported via drm_err_ratelimited() rather than silently dropped, matching the CoCo-hardened pattern in hv_kvp_onchannelcallback(). Fixes: 76c56a5affeb ("drm/hyperv: Add DRM driver for hyperv synthetic video device") Cc: stable@vger.kernel.org # 5.14+ Signed-off-by: Berkant Koc Assisted-by: Claude:claude-opus-4-7 berkoc-pipeline Reviewed-by: Michael Kelley Tested-by: Michael Kelley Signed-off-by: Hamza Mahfooz Link: https://patch.msgid.link/8200dbc199c7a9b75ac7e8af6c748d2189b5ebd5.1779542874.git.me@berkoc.com commit 13d33b9ef67066c77c84273fac5a1d3fde3533d1 Author: Berkant Koc Date: Tue May 19 22:08:17 2026 +0200 drm/hyperv: validate resolution_count and fix WIN8 fallback A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past the supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] array in the parse loop. Bound resolution_count against the array size, folded into the existing zero-check. When the WIN10 resolution probe fails, the caller in hyperv_connect_vsp() left hv->screen_*_max / preferred_* unpopulated, which sets mode_config.max_width / max_height to 0 and makes drm_internal_framebuffer_create() reject every userspace framebuffer with -EINVAL. The pre-WIN10 branch had the same gap for preferred_width / preferred_height. Use a single post-probe fallback guarded by screen_width_max == 0 so both paths converge on the WIN8 defaults. Signed-off-by: Berkant Koc Assisted-by: Claude:claude-opus-4-7 berkoc-pipeline Fixes: 76c56a5affeb ("drm/hyperv: Add DRM driver for hyperv synthetic video device") Cc: stable@vger.kernel.org # 5.14+ Reviewed-by: Michael Kelley Tested-by: Michael Kelley Signed-off-by: Hamza Mahfooz Link: https://patch.msgid.link/6945b22419c7d404b4954a113de2ac9c900dba93.1779542874.git.me@berkoc.com commit 3109f9f38800841e46769e95e1ba11f1f8c7b230 Author: Rafael J. Wysocki Date: Fri May 22 16:53:48 2026 +0200 ACPI: button: Add missing device class clearing on probe failures Commit e18947038bf4 ("ACPI: driver: Do not set acpi_device_class() unnecessarily") modified acpi_button_remove() to clear the device class field in struct acpi_device on driver removal, but it should also have updated the rollback path in acpi_button_probe(), which it didn't do, so do it now. Fixes: e18947038bf4 ("ACPI: driver: Do not set acpi_device_class() unnecessarily") Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/6167713.MhkbZ0Pkbq@rafael.j.wysocki commit a004b8f0d3bc5d82d3f2c91ff93f4b4b7ccb8f76 Author: Rafael J. Wysocki Date: Fri May 22 16:52:10 2026 +0200 ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time Prior to commit 57c31e6d620f ("ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons"), ACPI button wakeup GPEs having handler methods remained enabled after acpi_wakeup_gpe_init(), but currently they are not enabled because acpi_setup_gpe_for_wake() disables them. That causes function keys to stop working on some systems [1] and there may be other related issues elsewhere. To address that, make the ACPI button driver enable wakeup GPEs for ACPI buttons so long as they have handler methods. While this does not restore the old behavior exactly (the ACPI button driver needs to be bound to the button devices for the GPEs to be enabled), it should be sufficient to restore the missing functionality. For this purpose, introduce acpi_enable_gpe_cond() that enables a GPE if its dispatch type matches the supplied one and modify acpi_button_probe() to use that function for enabling the GPEs in question. Fixes: 57c31e6d620f ("ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons") Reported-by: Nick Closes: https://lore.kernel.org/linux-acpi/E2OXET.4X5GTP37VTNC3@kousu.ca/ [1] Signed-off-by: Rafael J. Wysocki Tested-by: Nick Cc: 7.0+ # 7.0+ Link: https://patch.msgid.link/9629117.CDJkKcVGEf@rafael.j.wysocki commit fe80251152fed5b185f795ef2cd9f7fe9c3162e0 Author: Rafael J. Wysocki Date: Fri May 22 16:49:44 2026 +0200 ACPI: button: Fix ACPI GPE handler leak during removal Commit a7e23ec17fee ("ACPI: button: Install notifier for system events as well") changed the ACPI notify handler type for ACPI buttons to ACPI_ALL_NOTIFY, but it forgot to update acpi_button_remove() to reflect that change. This leads to leaking the notify handler past driver removal, which may cause a kernel crash to occur if ACPI notify on the given device is triggered after removing the driver, and causes a subsequent probe of the given device with the same driver to fail. Address this by updating the acpi_remove_notify_handler() call in acpi_button_remove() as appropriate. Fixes: a7e23ec17fee ("ACPI: button: Install notifier for system events as well") Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) Cc: 6.15+ # 6.15+ Link: https://patch.msgid.link/7954431.EvYhyI6sBW@rafael.j.wysocki commit b0c13ec17438577f90b379d448dfed1233e2c0a4 Author: Judith Mendez Date: Wed May 13 18:11:54 2026 -0500 pinctrl: mcp23s08: Read spi-present-mask as u8 not u32 The binding (microchip,mcp23s08) specifies microchip,spi-present-mask as uint8, but driver would read u32, causing type mismatch. Use device_property_read_u8 to match binding spec, hardware (8 chips max), & prevent probe failure. Cc: stable@vger.kernel.org Fixes: 3ad8d3ec6d87 ("dt-bindings: pinctrl: convert pinctrl-mcp23s08.txt to yaml format") Signed-off-by: Judith Mendez Signed-off-by: Linus Walleij commit 8473c3a197b57ff01396f7a2ec6ddf65383820d4 Author: Judith Mendez Date: Wed May 13 18:11:53 2026 -0500 pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init Regmap initialization triggers regcache_maple_populate() which attempts SPI read to populate cache. SPI read requires mcp->dev and mcp->addr to be set, without them, NULL pointer dereference occurs during probe. Move initialization before mcp23s08_spi_regmap_init() call. Cc: stable@vger.kernel.org Fixes: f9f4fda15e72 ("pinctrl: mcp23s08: init reg_defaults from HW at probe and switch cache type") Signed-off-by: Judith Mendez Signed-off-by: Linus Walleij commit 7740c6cedb2599d8e4534574a0a72042ba63c1c7 Author: Edson Juliano Drosdeck Date: Sun May 24 15:53:24 2026 -0300 ALSA: hda/realtek: Limit mic boost on Positivo DN140 The internal mic boost on the Positivo DN140 is too high. Fix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain. Signed-off-by: Edson Juliano Drosdeck Link: https://patch.msgid.link/20260524185324.28959-1-edson.drosdeck@gmail.com Signed-off-by: Takashi Iwai commit db37cf47b67e38ade40de5cd74a4d4d772ff1416 Author: Geoffrey D. Bennett Date: Sun May 24 06:34:14 2026 +0930 ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 Firmware 2417 for the Scarlett 4th Gen 2i2 moved the direct monitor gain parameter by 4 bytes, from offset 0x2a0 to 0x2a4, breaking the "Direct Monitor X Mix Y" controls. Special-case the offset in the get/set config helpers when the running firmware is 2417 or later. Fixes: 4e809a299677 ("ALSA: scarlett2: Add support for Solo, 2i2, and 4i4 Gen 4") Cc: Signed-off-by: Geoffrey D. Bennett Link: https://patch.msgid.link/ahIWTueUlWA5xiV+@m.b4.vu Signed-off-by: Takashi Iwai commit 4cc54bdd54b337e77115be5b55577d1c58608eae Author: Cássio Gabriel Date: Fri May 22 22:09:40 2026 -0300 ALSA: pcm: oss: Fix setup list UAF on proc write error snd_pcm_oss_proc_write() links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the already linked entry and leaves setup_list pointing at freed memory. A later OSS device open can then walk the stale list entry in snd_pcm_oss_look_for_setup() and dereference freed memory. Allocate the task name and initialize the setup entry before publishing the entry on setup_list. Also fetch the initial proc read iterator only after taking setup_mutex, so all setup_list traversal follows the same list lifetime rules. Reported-by: syzbot+8e498074a794999eb41c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6a1062b7.170a0220.35b2b7.0003.GAE@google.com Closes: https://syzkaller.appspot.com/bug?extid=8e498074a794999eb41c Fixes: 060d77b9c04a ("[ALSA] Fix / clean up PCM-OSS setup hooks") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260522-alsa-pcm-oss-setup-uaf-v1-1-40bdcc4d17e8@gmail.com Signed-off-by: Takashi Iwai commit a0d9e8df2ebca290c2efff70abc05426e5a476b0 Author: Cássio Gabriel Date: Fri May 22 09:49:30 2026 -0300 ALSA: hda: cs35l56: Fix system name string leaks cs35l56_hda_read_acpi() gets an allocated ACPI _SUB string from acpi_get_subsystem_id(). On success, that string is used to create the firmware system name. Several error paths after the _SUB lookup can return without releasing the allocated string. This includes speaker ID lookup errors other than -ENOENT, and errors after a firmware system name has been allocated. Use scoped cleanup for the temporary _SUB string and make cs35l56->system_name device-managed. This releases the temporary _SUB string on every error path and lets devres release the firmware system name on probe failure and device removal. Fixes: 6f03b446cbae ("ALSA: hda: cs35l56: Add support for speaker id") Fixes: 40b1c2f9b299 ("ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX") Signed-off-by: Cássio Gabriel Reviewed-by: Richard Fitzgerald Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260522-alsa-cs35l56-system-name-leak-v4-1-a6154dd09cd9@gmail.com commit f7b1f71566ff9d5344a516fa745118cee924c8d0 Author: Kris Kater Date: Fri May 22 08:09:02 2026 +0200 ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Lenovo Yoga Slim 7 14AGP11 The BIOS on the Lenovo Yoga Slim 7 14AGP11 (AMD Ryzen AI / Kraken Point chassis; board LNVNB161216, product 83QS) programs the PCI subsystem ID of the HDA function as 17aa:0000. As a result no entry in alc269_fixup_tbl[] matches via SND_PCI_QUIRK, the fixup falls back to the generic auto-routing path, and the bass speaker pin is left mis-routed. Laptop speakers sound noticeably thin. The codec's own internal subsystem ID register reports 0x17aa394c correctly, so an HDA_CODEC_QUIRK entry (which matches on the codec SSID rather than on the PCI SSID) binds the chassis to the existing ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN fixup. This mirrors the same workaround already in place for the closely-related Yoga 7 2-in-1 14AKP10 and 16AKP10 entries earlier in the table. With this change the kernel log goes from ALC287: picked fixup for PCI SSID 17aa:0000 to ALC287: picked fixup alc287-yoga9-bass-spk-pin and speaker routing matches what the firmware intended. Verified by the reporter against the equivalent modprobe override (model=,alc287-yoga9-bass-spk-pin). Link: https://bugzilla.kernel.org/show_bug.cgi?id=221438 Signed-off-by: Kris Kater Link: https://patch.msgid.link/20260522060902.9423-1-kris@kater.nu Signed-off-by: Takashi Iwai commit 4e273bca232ec71bbf072f10f7d395a28e85e4e1 Author: Zhang Heng Date: Fri May 22 14:07:42 2026 +0800 ALSA: hda/realtek: Fix incorrect comment for ALC299_FIXUP_PREDATOR_SPK The comment for the pin configuration 0x21 in the fixup ALC299_FIXUP_PREDATOR_SPK states "use as headset mic, without its own jack detect", but the fixup name and the actual usage indicate that the pin is meant to be used as internal speaker. Correct the comment to avoid confusion. Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260522060742.1384390-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 98fb1c1bb11e29eb609b7200a25e136e05aa4498 Author: Cássio Gabriel Date: Thu May 21 08:01:23 2026 -0300 ALSA: firewire-motu: Protect register DSP event queue positions The register DSP event queue is updated under parser->lock, but snd_motu_register_dsp_message_parser_count_event() reads pull_pos and push_pos without the lock. snd_motu_register_dsp_message_parser_copy_event() also reads both queue positions before taking the lock. Protect these accesses with parser->lock as well. This keeps the hwdep poll/read path consistent with the producer side and with the cached meter/parameter accessors. Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260521-alsa-firewire-motu-event-locking-v1-1-708e1c2b5e56@gmail.com commit e7ae89a0c97ce2b68b0983cd01eda67cf373517d Author: Linus Torvalds Date: Sun May 24 13:48:06 2026 -0700 Linux 7.1-rc5 commit 6a97c4d5262d02f04d1f41113b0d090ea51f08dd Merge: 3526d7462355c4 9a12fa5213cfc3 Author: Linus Torvalds Date: Sun May 24 12:50:36 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "arm64: - Fix ITS EventID sanitisation when restoring an interrupt translation table. - Fix PPI memory leak when failing to initialise a vcpu. - Correctly return an error when the validation of a hypervisor trace descriptor fails, and limit this validation to protected mode only. RISC-V: - Fix invalid HVA warning in steal-time recording - Return SBI_ERR_FAILURE to guest upon OOM in pmu_event_info() and pmu_snapshot_set_shmem() - Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler - Fix sign extension of value for MMIO loads s390: - Fix bugs in vSIE (nested virtualization) and UCONTROL, caused by the page table rewrite. x86: - Apply erratum #1235 workaround (disable AVIC IPI virtualization) on Hygon Family 18h, just like on AMD Family 17h. - When KVM_CAP_X86_APIC_BUS_CYCLES_NS is queried on a specific VM, return the VM's configured APIC bus frequency instead of the default. This is less confusing (read: not wrong) and makes it easier to fill in CPUID information that communicates the APIC bus frequency to the guest. Selftests: - Do not include glibc-internal ; it worked by chance and broke building KVM selftests with musl" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235) KVM: selftests: Verify that KVM returns the configured APIC cycle length KVM: x86: Return the VM's configured APIC bus frequency when queried KVM: selftests: elf: Include instead of KVM: s390: Properly reset zero bit in PGSTE KVM: s390: vsie: Fix redundant rmap entries KVM: s390: vsie: Fix unshadowing logic KVM: s390: Fix leaking kvm_s390_mmu_cache in case of errors KVM: s390: vsie: Fix memory leak when unshadowing KVM: arm64: Fix nVHE/pKVM hyp tracing error on invalid desc KVM: arm64: vgic: Free private_irqs when init fails after allocation KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits RISC-V: KVM: Fix sign extension for MMIO loads RISC-V: KVM: Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when OOM riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM RISC-V: KVM: Fix invalid HVA warning in steal-time recording commit a88c02915d9c6160cfc7ab1b26ed64b2993e2b94 Author: Lim HyeonJun Date: Sun May 24 20:08:53 2026 +0900 io_uring/tctx: set ->io_uring before publishing the tctx node io_register_iowq_max_workers() walks ctx->tctx_list under ctx->tctx_lock and dereferences each node's task->io_uring without a NULL check: list_for_each_entry(node, &ctx->tctx_list, ctx_node) { tctx = node->task->io_uring; if (WARN_ON_ONCE(!tctx->io_wq)) continue; ... } __io_uring_add_tctx_node() installs the node into ctx->tctx_list (via io_tctx_install_node(), which does the list_add() under tctx_lock) and only assigns current->io_uring = tctx afterwards. A task doing its first io_uring operation on a shared ring therefore has a window in which its node is already visible on ctx->tctx_list while node->task->io_uring is still NULL. A concurrent IORING_REGISTER_IOWQ_MAX_WORKERS on the same ring reads that NULL and dereferences tctx->io_wq: KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: io_register_iowq_max_workers io_uring/register.c:423 Publish current->io_uring = tctx before installing the node, so any node visible on ctx->tctx_list always has a valid task->io_uring. Fixes: 7880174e1e5e ("io_uring/tctx: clean up __io_uring_add_tctx_node() error handling") Signed-off-by: Lim HyeonJun Link: https://patch.msgid.link/20260524110853.115634-1-shja0831@gmail.com Signed-off-by: Jens Axboe commit 3526d7462355c4df269d4a87eed53dbd48a1df02 Merge: a674bf74b31079 fd948c3f96b18f Author: Linus Torvalds Date: Sun May 24 11:00:45 2026 -0700 Merge tag 'x86-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - On SEV guests, handle set_memory_{encrypted,decrypted}() failures more conservatively by assuming that all affected pages are unencrypted (Carlos López) - Disable broadcast TLB flush when PCID is disabled (Tom Lendacky) - Fix VMX vs. hrtimer_rearm_deferred() regression (Peter Zijlstra) - Move IRQ/NMI dispatch code from KVM into x86 core, to prepare for a KVM x2apic fix (Peter Zijlstra) - Fix incorrect munmap() size on map_vdso() failure (Guilherme Giacomo Simoes) * tag 'x86-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: virt: sev-guest: Explicitly leak pages in unknown state x86/mm: Disable broadcast TLB flush when PCID is disabled x86/kvm/vmx: Fix VMX vs hrtimer_rearm_deferred() x86/kvm/vmx: Move IRQ/NMI dispatch from KVM into x86 core x86/vdso: Fix incorrect size in munmap() on map_vdso() failure commit a674bf74b31079782d7d8f333c8d832374f0b65c Merge: ee651da6d3e1e3 c9b7598eb013c6 Author: Linus Torvalds Date: Sun May 24 10:55:21 2026 -0700 Merge tag 'irq-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irqchip driver fixes from Ingo Molnar: - Fix the hardware probing error path of the renesas-rzt2h irqchip driver - Fix the exynos-combiner irqchip driver on -rt kernels by turning the IRQ controller spinlock into a raw spinlock * tag 'irq-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/renesas-rzt2h: Use pm_runtime_put_sync() in probe error path irqchip/exynos-combiner: Switch to raw_spinlock commit ee651da6d3e1e3c57d22dd6f03850af980b7cd10 Merge: 2be86a8c57773b 5f41161059fd0f Author: Linus Torvalds Date: Sun May 24 10:48:55 2026 -0700 Merge tag 'core-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects fix from Ingo Molnar:: - Fix debugobjects regression on -rt kernels: don't fill the pool (which uses a coarse lock) if ->pi_blocked_on, because that messes up the priority inheritance of callers * tag 'core-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Do not fill_pool() if pi_blocked_on commit 2be86a8c57773bce1b5c845c49e0bfa3caac838c Merge: 53676e4d44d6b3 4e4af55aaca7f6 Author: Linus Torvalds Date: Sun May 24 10:37:55 2026 -0700 Merge tag 'hwmon-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - adm1266: Various fixes from Abdurrahman Hussain The fixed issues were reported by Sashiko as part of a code review of a functional change in the driver. - lenovo-ec-sensors: Convert to devm_request_region() to fix release_region cleanup, and fix EC "MCHP" signature validation logic, from Kean Ren * tag 'hwmon-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer hwmon: (pmbus/adm1266) include adapter number in GPIO line label hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer hwmon: (pmbus/adm1266) reject implausible blackbox record_count hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX hwmon: (pmbus/adm1266) seed timestamp from the real-time clock hwmon: (lenovo-ec-sensors): Fix EC "MCHP" signature validation logic hwmon: (lenovo-ec-sensors): Convert to devm_request_region() commit 53676e4d44d6b38c8a0d9bff331f170ae2e41bbe Author: Nathan Chancellor Date: Mon May 18 15:17:14 2026 -0700 drm/msm: Restore second parameter name in purge() and evict() After commit 3392291fc509 ("drm/msm: Fix shrinker deadlock"), all supported versions of clang warn (or error with CONFIG_WERROR=y): drivers/gpu/drm/msm/msm_gem_shrinker.c:105:58: error: omitting the parameter name in a function definition is a C23 extension [-Werror,-Wc23-extensions] 105 | purge(struct drm_gem_object *obj, struct ww_acquire_ctx *) | ^ drivers/gpu/drm/msm/msm_gem_shrinker.c:117:58: error: omitting the parameter name in a function definition is a C23 extension [-Werror,-Wc23-extensions] 117 | evict(struct drm_gem_object *obj, struct ww_acquire_ctx *) | ^ 2 errors generated. With older but supported versions of GCC, this is an unconditional hard error: drivers/gpu/drm/msm/msm_gem_shrinker.c: In function 'purge': drivers/gpu/drm/msm/msm_gem_shrinker.c:105:35: error: parameter name omitted purge(struct drm_gem_object *obj, struct ww_acquire_ctx *) ^~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/msm/msm_gem_shrinker.c: In function 'evict': drivers/gpu/drm/msm/msm_gem_shrinker.c:117:35: error: parameter name omitted evict(struct drm_gem_object *obj, struct ww_acquire_ctx *) ^~~~~~~~~~~~~~~~~~~~~~~ Restore the parameter name to clear up the warnings, renaming it "unused" to make it clear it is only needed to satisfy the prototype of drm_gem_lru_scan(). Cc: stable@vger.kernel.org Fixes: 3392291fc509 ("drm/msm: Fix shrinker deadlock") Signed-off-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit f0e77c598ebbb1ae055b156aaa33b7433ae45e51 Merge: 4cbfe4502e3d4b 7dd62566e0d108 Author: Linus Torvalds Date: Sun May 24 09:53:17 2026 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix bpf_throw() and global subprog combination (Kumar Kartikeya Dwivedi) - Fix out of bounds access in BPF interpreter (Yazhou Tang) - Fix potential out of bounds access in inner per-cpu array map (Guannan Wang) - Reject NULL data/sig in bpf_verify_pkcs7_signature (KP Singh) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: libbpf: fix off-by-one in emit_signature_match jump offset bpf: Reject NULL data/sig in bpf_verify_pkcs7_signature selftests/bpf: Cover global subprog exception leaks bpf: Check global subprog exception paths bpf: make bpf_session_is_return() reference optional bpf: Use array_map_meta_equal for percpu array inner map replacement selftests/bpf: Add test for large offset bpf-to-bpf call bpf: Fix s16 truncation for large bpf-to-bpf call offsets bpf: Fix out-of-bounds read in bpf_patch_call_args() commit 4cbfe4502e3d4bda48eb4b83dfad8d7da3b22e90 Merge: 400544639d2a11 4ec9c8e023c79f Author: Linus Torvalds Date: Sat May 23 16:59:02 2026 -0700 Merge tag 'v7.1-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - fix for creating tmpfiles - fix durable reconnect error path - validate SID in security descriptor when inheriting DACL * tag 'v7.1-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd: smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close ksmbd: validate SID in parent security descriptor during ACL inheritance ksmbd: fix durable reconnect error path file lifetime commit 400544639d2a11a9c1e276a912a9dff8fe4107dc Merge: f83ef5bca211a1 f13342e15deafb Author: Linus Torvalds Date: Sat May 23 16:54:48 2026 -0700 Merge tag 'for-7.1-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A batch of fixes to simple quotas: - add conditional rescheduling point not dependent on the lock during inode iterations to avoid delays with PREEMPT_NONE enabled - fix subvolume deletion so it does not break the squota invariants - properly handle enabling squota, tracking extents in the initial transaction - catch and warn about underflows, clamp to zero to avoid further problems And one fix to inode size handling: - fix handling of preallocated extents beyond i_size when not using the no-holes feature" * tag 'for-7.1-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: swallow btrfs_record_squota_delta() ENOENT btrfs: clamp to avoid squota underflow btrfs: fix squota accounting during enable generation btrfs: check for subvolume before deleting squota qgroup btrfs: always drop root->inodes lock before cond_resched() btrfs: mark file extent range dirty after converting prealloc extents commit f83ef5bca211a1bdc1ea661c11543712f96a6cea Merge: eed108edc11704 8339dd0e5090f0 Author: Linus Torvalds Date: Sat May 23 16:51:22 2026 -0700 Merge tag 'xfs-fixes-7.1-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fix from Carlos Maiolino: "A single fix for a race in xfs buffer cache which may lead to filesystem shutdown due to inconsistent metadata if the buffer lookup happens to find an old dead buffer still in the cache" * tag 'xfs-fixes-7.1-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix a buffer lookup against removal race commit eed108edc1170404bbef9e7d0189d18a3cc354f5 Merge: 95e6d3ba057133 e90ef85ada8578 Author: Linus Torvalds Date: Sat May 23 09:21:08 2026 -0700 Merge tag 'nios2_updates_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull nios2 fixes from Dinh Nguyen: - Implement _THIS_IP_ for inline asm - Add Simon Schuster as a maintainer and mark the NIOS2 as Supported * tag 'nios2_updates_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: nios2: Implement _THIS_IP_ using inline asm MAINTAINERS: arch/nios2: Add Simon Schuster as co-maintainer commit 95e6d3ba0571330df866911da9dedd83e05417ca Merge: c8561c73b4a866 4a09f4a23a3003 Author: Linus Torvalds Date: Sat May 23 09:13:00 2026 -0700 Merge tag 'loongarch-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Rework KASLR to avoid initrd overlap, remove some unused code to avoid a build warning, fix some bugs in kprobes and KVM" * tag 'loongarch-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Move some variable declarations to paravirt.h LoongArch: kprobes: Fix handling of fatal unrecoverable recursions LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions LoongArch: Remove unused code to avoid build warning LoongArch: Avoid initrd overlap during kernel relocation LoongArch: Skip relocation-time KASLR if already applied efi/loongarch: Randomize kernel preferred address for KASLR commit 7dd62566e0d108d29034bcff8503b827f8763320 Author: KP Singh Date: Fri May 22 23:53:36 2026 +0200 libbpf: fix off-by-one in emit_signature_match jump offset The offset for the cleanup-label jump is computed before the MOV R7 instruction is emitted, but the JMP lands after it. Account for the extra insn in the offset calculation (-2 instead of -1). Drop the redundant self-loop in the else branch; gen->error = -ERANGE already marks the generation as failed. Fixes: fb2b0e290147 ("libbpf: Update light skeleton for signing") Signed-off-by: KP Singh Link: https://lore.kernel.org/r/20260522215337.662271-2-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit c8561c73b4a8669bb13c57a5853318cd02655f9b Merge: 3f264650ca7d2a 215c90ee656114 Author: Linus Torvalds Date: Sat May 23 07:49:05 2026 -0700 Merge tag 'driver-core-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Remove the software node on platform device release(); without this, the software node remains registered after the device is gone and a subsequent platform_device_register_full() reusing the same node fails with -EBUSY - In sysfs_update_group(), do not remove a pre-existing directory when create_files() fails; the previous code would silently destroy a sysfs group that the caller did not create - Set fwnode->secondary to NULL in fwnode_init() to avoid dereferencing uninitialized memory (e.g. in dev_to_swnode()) when the firmware node is allocated on the stack or via a non-zeroing allocator * tag 'driver-core-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: device property: set fwnode->secondary to NULL in fwnode_init() sysfs: don't remove existing directory on update failure driver core: platform: remove software node on release() commit 3f264650ca7d2a2d6de86234d919f305211632cd Merge: ab868c10971c5d 023453cb7eb0f5 Author: Linus Torvalds Date: Sat May 23 07:32:39 2026 -0700 Merge tag 'i2c-for-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Core: - smbus: fix a potential uninitialization bug Tegra: - drop runtime PM reference when exiting on mutex_lock failure - preserve transfer errors when releasing the mutex" * tag 'i2c-for-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: smbus: fix a potential uninitialization bug i2c: tegra: make tegra_i2c_mutex_unlock() return void i2c: tegra: fix pm_runtime leak on mutex_lock failure commit ab868c10971c5d2cd27b3709d11225941eabe78e Merge: f53a244224ec03 5b74373390113f Author: Linus Torvalds Date: Sat May 23 07:17:27 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: - syzbot triggred crash in rxe due to concurrent plug/unplug - Possible non-zero'd memory exposed to userspace in bnxt_re - Malicous 'magic packet' with SIW causes a buffer overflow - Tighten the new uAPI validation code to not crash in debugging prints and have the right module dependencies in drivers - mana was missing the max_msg_sz report to userspace - UAF in rtrs on an error path * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/rtrs: Fix use-after-free in path file creation cleanup RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn() RDMA/core: Move the _ib_copy_validate_udata* functions to ib_core_uverbs RDMA/siw: Reject MPA FPDU length underflow before signed receive math RDMA/bnxt_re: zero shared page before exposing to userspace selftests/rdma: explicitly skip tests when required modules are missing RDMA/nldev: Add mutual exclusion in nldev_dellink() commit 8339dd0e5090f092c525c5e04b2a75ec5e5305a6 Merge: 79bd2dded182b1 c69439a891ccb3 Author: Carlos Maiolino Date: Sat May 23 16:15:18 2026 +0200 Merge tag 'xfs-fixes-7.1-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux into test_merge xfs: fixes for v7.1-rc5 Signed-off-by: Carlos Maiolino Lines starting with '#' will be ignored. commit f53a244224ec0304209917e3f4d68dc83b1967db Merge: 79bd2dded182b1 e7537735028c3a Author: Linus Torvalds Date: Sat May 23 07:13:06 2026 -0700 Merge tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl Pull fwctl fix from Jason Gunthorpe: - Buffer overflow due to missing input validation in pds * tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl: fwctl: pds: Validate RPC input size before parsing commit 645d4eda1d0db0202ed8e4a2c3abb2ebce6b86ef Merge: 5eb070769ea5e1 9f9bfc80c67f35 Author: Greg Kroah-Hartman Date: Sat May 23 13:21:56 2026 +0200 Merge tag 'usb-serial-7.1-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial fixes for 7.1-rc5 Here are a number of fixes for memory corruption and information leaks due to missing endpoint and transfer sanity checks dating back to simpler times when we trusted our hardware. Included are also a fix for a recently added modem device id entry and some new modem devices ids. All but the last five commits have been in linux-next and with no reported issues. * tag 'usb-serial-7.1-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: cypress_m8: validate interrupt packet headers USB: serial: safe_serial: fix memory corruption with small endpoint USB: serial: omninet: fix memory corruption with small endpoint USB: serial: mxuport: fix memory corruption with small endpoint USB: serial: cypress_m8: fix memory corruption with small endpoint USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL USB: serial: option: add MeiG SRM813Q USB: serial: mct_u232: fix missing interrupt-in transfer sanity check USB: serial: mct_u232: fix memory corruption with small endpoint USB: serial: keyspan: fix missing indat transfer sanity check USB: serial: digi_acceleport: fix memory corruption with small endpoints USB: serial: belkin_sa: validate interrupt status length commit 9a12fa5213cfc391e0eed63902d3be98f0913765 Author: Tina Zhang Date: Fri May 22 12:00:14 2026 +0800 KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235) Hygon Family 18h CPUs are derived from AMD Family 17h (Zen1) silicon and share the same erratum #1235: hardware may read a stale IsRunning=1 bit during ICR write emulation and silently fail to generate an AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on the sending vCPU. The absence of the VM-Exit causes KVM to miss the required wakeup of blocking target vCPUs, leading to hung vCPUs and unbounded delays in guest execution. Extend the existing AMD Family 17h erratum #1235 workaround to also cover Hygon Family 18h. With IPI virtualization disabled, KVM never sets IsRunning=1 in the Physical ID table, so every non-self IPI generates a VM-Exit and is correctly emulated. Fixes: 8de4a1c8164e ("KVM: SVM: Disable (x2)AVIC IPI virtualization if CPU has erratum #1235") Cc: Signed-off-by: Tina Zhang Message-ID: <20260522040014.3380201-1-zhang_wei@open-hieco.net> commit d9c41dc531b0e8feb046ee3d31ce37657101b137 Author: Sean Christopherson Date: Fri May 22 10:35:26 2026 -0700 KVM: selftests: Verify that KVM returns the configured APIC cycle length Add checks in the APIC bus clock test to verify that querying KVM_CAP_X86_APIC_BUS_CYCLES_NS on the VM after changing the frequency returns the VM's actual APIC cycle length, not KVM's default. For giggles, verify that KVM still returns its default frequency for the system-scoped check. Signed-off-by: Sean Christopherson Message-ID: <20260522173526.3539407-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 86e2de10eb14446a49019791bd0674faa5fae088 Author: Sean Christopherson Date: Fri May 22 10:35:25 2026 -0700 KVM: x86: Return the VM's configured APIC bus frequency when queried When KVM_CAP_X86_APIC_BUS_CYCLES_NS is queried on a specific VM, return the VM's configured APIC bus frequency, not KVM's default. Aside from the fact that returning the default frequency is blatantly wrong if userspace has changed the frequency, returning the configured frequency means userspace can blindly trust the result, e.g. when filling PV CPUID information that communicates the APIC bus frequency to the guest. Fixes: 6fef518594bc ("KVM: x86: Add a capability to configure bus frequency for APIC timer") Reported-by: David Woodhouse Closes: https://lore.kernel.org/all/ab84153e33fbe7c25667f595c56b310d4d5a93ef.camel@infradead.org Signed-off-by: Sean Christopherson Message-ID: <20260522173526.3539407-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 2d42c7cf1a2dad694db0c518b0e004502859f11c Author: Hisam Mehboob Date: Thu Apr 9 21:40:22 2026 +0500 KVM: selftests: elf: Include instead of is a glibc-internal header that explicitly states it should never be included directly: #error "Never use directly; include instead." Replace it with the correct public header which works on all C libraries including musl. Building KVM selftests with musl-gcc fails with: lib/elf.c:10:10: fatal error: bits/endian.h: No such file or directory Fixes: 6089ae0bd5e1 ("kvm: selftests: add sync_regs_test") Signed-off-by: Hisam Mehboob Message-ID: <20260409164020.1575176-4-hisamshar@gmail.com> Signed-off-by: Paolo Bonzini commit 06c4f99526784938663a5e82b1ea1b67a4794491 Merge: 37f32d5ab83968 c7832534a81602 Author: Paolo Bonzini Date: Sat May 23 10:04:35 2026 +0200 Merge tag 'kvm-riscv-fixes-7.1-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 7.1, take #1 - Fix invalid HVA warning in steal-time recording - Return SBI_ERR_FAILURE to guest upon OOM in pmu_event_info() and pmu_snapshot_set_shmem() - Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler - Fix sign extension of value for MMIO loads commit 37f32d5ab83968d63cfba6092ecaae3e582db964 Merge: e23844b2ddbdd0 9029496abfae3c Author: Paolo Bonzini Date: Sat May 23 10:03:58 2026 +0200 Merge tag 'kvm-s390-master-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: some vSIE and UCONTROL fixes Fix some memory issues and some hangs in vSIE. commit e23844b2ddbdd004285f14bdc672b4d854ad4c4e Merge: 5200f5f493f79f 1702da76e017ae Author: Paolo Bonzini Date: Sat May 23 10:03:10 2026 +0200 Merge tag 'kvmarm-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.1, take #3 - Fix ITS EventID sanitisation when restoring an interrupt translation table. - Fix PPI memory leak when failing to initialise a vcpu. - Correctly return an error when the validation of a hypervisor trace descriptor fails, and limit this validation to protected mode only. commit 9f9bfc80c67f35a275820da7e83a35dface08281 Author: Zhang Cen Date: Fri May 22 22:54:42 2026 +0800 USB: serial: cypress_m8: validate interrupt packet headers cypress_read_int_callback() parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a one-byte combined status/count header. The usb-serial core sizes the interrupt-in buffer from the endpoint descriptor's wMaxPacketSize, and successful interrupt transfers can complete short when URB_SHORT_NOT_OK is not set. Check that the completed packet contains the selected header before reading it. Malformed short reports are ignored and the interrupt URB is resubmitted through the existing retry path, preventing out-of-bounds header-byte reads. KASAN report as below: KASAN slab-out-of-bounds in cypress_read_int_callback+0x240/0x7f0 Read of size 1 Call trace: cypress_read_int_callback() (drivers/usb/serial/cypress_m8.c:1009) __usb_hcd_giveback_urb() dummy_timer() Fixes: 3416eaa1f8f8 ("USB: cypress_m8: Packet format is separate from characteristic size") Assisted-by: Codex:gpt-5.5 Signed-off-by: Zhang Cen Fixes: 3416eaa1f8f8 ("USB: cypress_m8: Packet format is separate from characteristic size") Cc: stable@vger.kernel.org # 2.6.26 [ johan: use constants in header length sanity checks ] Signed-off-by: Johan Hovold commit 438061ed1ad85e6743e2dce826671772d81089ec Author: Johan Hovold Date: Fri May 22 16:22:18 2026 +0200 USB: serial: safe_serial: fix memory corruption with small endpoint Make sure that the bulk-out buffer size is at least eight bytes to avoid user-controlled slab corruption in "safe" mode should a malicious device report a smaller size. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 60df93d30f9bdd27db17c4d80ed80ef718d7226b Author: Johan Hovold Date: Fri May 22 16:20:58 2026 +0200 USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a smaller endpoint max packet size than expected. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 4085f0dbb1ce2251c9a5938d693de6593f0ab2bd Author: Johan Hovold Date: Fri May 22 16:19:50 2026 +0200 USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size. Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver") Cc: stable@vger.kernel.org # 3.14 Cc: Andrew Lunn Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 85db7391310b1304d2dc8ae3b0b12105a9567147 Author: Alexandru Hossu Date: Thu May 21 17:11:21 2026 +0200 scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly to chap_base64_decode() without checking whether the input length could produce more than digest_size bytes of output. chap_base64_decode() writes to the destination unconditionally as long as there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and the "0b" prefix stripped by extract_param(), up to 127 base64 characters can reach the decoder. 127 characters decode to 95 bytes. For SHA-256 (digest_size=32) this overflows client_digest by 63 bytes; for MD5 (digest_size=16) the overflow is 79 bytes. The length check at line 344 fires after the write has already happened. The HEX branch in the same switch statement already validates the length up front. Apply the same approach to the BASE64 branch: strip trailing base64 padding characters, then reject any input whose data length exceeds DIV_ROUND_UP(digest_size * 4, 3) before calling the decoder. Stripping trailing '=' before the comparison handles both padded and unpadded encodings. chap_base64_decode() already returns early on '=', so the full original string is still passed to the decoder unchanged. The mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is kzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at CHAP_CHALLENGE_STR_LEN characters, so at most CHAP_CHALLENGE_STR_LEN-1 base64 characters reach the decoder. The maximum decoded size, DIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than CHAP_CHALLENGE_STR_LEN, so no overflow is possible there. A comment is added at the call site to document this. Fixes: 1e5733883421 ("scsi: target: iscsi: Support base64 in CHAP") Cc: stable@vger.kernel.org Signed-off-by: Alexandru Hossu Reviewed-by: David Disseldorp Link: https://patch.msgid.link/20260521151121.808477-1-hossu.alexandru@gmail.com Signed-off-by: Martin K. Petersen commit bf33e01f88388c43e285492a63e539df6ffed64c Author: Michael Bommarito Date: Mon May 11 14:49:14 2026 -0400 scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check the remaining buffer capacity: *length += sprintf(output_buf, "%s=%s", er->key, er->value); *length += 1; output_buf = textbuf + *length; The 8192-byte ceiling at iscsi_target_check_login_request() bounds the *input* Login PDU payload, but a single PDU can carry up to 2048 minimal four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte "a=NotUnderstood\0" output record via iscsi_add_notunderstood_response(). 2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB heap overrun in the kmalloc-8k slab. The fix introduces a static iscsi_encode_text_record() helper that uses snprintf() with a per-call bounds check against the remaining buffer, and threads a u32 textbuf_size parameter through iscsi_encode_text_output(). Both call sites in iscsi_target_handle_csg_zero() (PHASE_SECURITY) and iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls iscsi_release_extra_responses() to drop queued records, and returns -1; both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR / ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning, so the initiator sees an explicit failed-login response rather than a silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL caller did that; the PHASE_SECURITY caller is converted to the same shape.) Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Tested-by: John Garry Reviewed-by: John Garry Signed-off-by: Martin K. Petersen commit 778c2ab142c625a8a8afa570e0f9b7873f445d99 Author: Michael Bommarito Date: Sat Apr 18 11:49:27 2026 -0400 scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"): 1) DataDigest CRC buffer overread (4 bytes past text_in). text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then incremented by ISCSI_CRC_LEN to make room for the received DataDigest in the iovec, but the same (now-bumped) rx_size is passed as the buffer length to iscsit_crc_buf(): if (conn->conn_ops->DataDigest) { ... rx_size += ISCSI_CRC_LEN; } ... if (conn->conn_ops->DataDigest) { data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL); iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so when DataDigest is negotiated it reads 4 bytes past the end of the text_in allocation. KASAN reproduces this directly on the unpatched mainline tree as slab-out-of-bounds in crc32c() called from the Text PDU path. The OOB bytes feed crc32c() and are then compared against the initiator-supplied checksum, so the value does not flow back to the attacker, but the kernel does read past the buffer on every Text PDU with DataDigest=CRC32C. Fix by passing the actual padded payload length (ALIGN(payload_length, 4)) that was used for the kzalloc(). 2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest drop. On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler silently drops the PDU and lets the initiator plug the CmdSN gap: kfree(text_in); return 0; cmd->text_in_ptr still points at the freed buffer. The next Text Request on the same ITT re-enters iscsit_setup_text_cmd(), which unconditionally does kfree(cmd->text_in_ptr); cmd->text_in_ptr = NULL; freeing the same pointer a second time. Session teardown via iscsit_release_cmd() has the same shape and hits the same double-free if the connection is dropped before a second Text Request arrives. On an unmodified mainline tree the bug-1 CRC overread fires first on the initial valid Text Request and perturbs the subsequent state, so #4 was isolated by building a kernel with only the bug-1 hunk of this patch applied plus temporary printk() observability around the three relevant kfree() sites. The observability prints are not part of this patch. On that build, a three-PDU Text Request sequence after login produces two back-to-back splats: BUG: KASAN: double-free in iscsit_setup_text_cmd+0x?? BUG: KASAN: double-free in iscsit_release_cmd+0x?? showing the same pointer freed in the ERL>0 drop path and again in iscsit_setup_text_cmd() (next Text Request on the same ITT) and once more in iscsit_release_cmd() (session teardown). On distro kernels with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free becomes a remote kernel BUG(); on non-hardened kernels it corrupts the slab freelist. Fix by clearing cmd->text_in_ptr after the kfree() in the ERL>0 drop path. With both hunks applied #4 is directly observable on the stock tree without observability printks; fixing bug-1 alone would mask #4 less, not more, so the hunks are submitted together. Both fixes are one-liners. The Text PDU state machine is unchanged and the wire protocol is unaffected. Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Tested-by: John Garry Reviewed-by: John Garry Signed-off-by: Martin K. Petersen commit 87a1e0fe7776da7ab411be332b4be58ac8840d10 Author: Eric Dumazet Date: Thu May 21 12:21:47 2026 +0000 ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports too soon. Only after unregister_net_sysctl_table() we can be sure no threads can possibly use the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports. Fixes: 122ff243f5f1 ("ipv4: make ip_local_reserved_ports per netns") Reported-by: Ji'an Zhou Signed-off-by: Eric Dumazet Cc: Cong Wang Reviewed-by: Jason Xing Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260521122147.3584624-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4157501b9a8ff1bbe32ff5a7d8aece7ab18eff40 Author: Stefano Garzarella Date: Thu May 21 14:47:32 2026 +0200 vsock/virtio: fix skb overhead overflow on 32-bit builds On 32-bit architectures, both skb_queue_len() and SKB_TRUESIZE(0) evaluate to 32-bit values. The multiplication can overflow before being assigned to the u64 skb_overhead variable, making the skb overhead check ineffective. Cast skb_queue_len() to u64 so the multiplication is always performed in 64-bit arithmetic. This issue was reported by Sashiko while reviewing another patch. Fixes: 059b7dbd20a6 ("vsock/virtio: fix potential unbounded skb queue") Closes: https://sashiko.dev/#/patchset/20260518090656.134588-1-sgarzare%40redhat.com Cc: stable@vger.kernel.org Signed-off-by: Stefano Garzarella Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260521124732.125771-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit 9eed1bd59937e6828b00d2f2dfef631d964f3636 Author: Michael Bommarito Date: Mon May 18 10:43:07 2026 -0400 scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker drivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the descriptor cursor by an attacker-supplied fip_dlen without ever requiring dlen >= sizeof(struct fip_desc) in the default branch. The named descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked their per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor (fip_dtype >= 128, which the standard requires receivers to silently ignore) skipped that check entirely. An unauthenticated L2 peer on the FCoE control VLAN could hang fcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely by emitting one FIP CVL frame whose single descriptor had fip_dtype == FIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes per iteration and the loop condition rlen >= sizeof(*desc) stayed true forever, blocking every subsequent FIP frame on that controller. Tighten the outer dlen guard to also reject dlen < sizeof(struct fip_desc), so a malformed descriptor whose length cannot even cover the descriptor header is rejected before the switch. This is the same lower-bound the named cases already apply and is the minimum scope that closes the loop. Fixes: 97c8389d54b9 ("[SCSI] fcoe, libfcoe: Add support for FIP. FCoE discovery and keep-alive.") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260518144307.2820961-1-michael.bommarito@gmail.com Signed-off-by: Martin K. Petersen commit a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153 Author: Michael Bommarito Date: Wed May 20 09:30:15 2026 -0400 scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic, for example as a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that permits source spoofing. The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32-bit on-wire pname_count field, and did not bound pname_count by the descriptor body already validated by the TLV walker. A pname_count of 256 therefore wraps the counter and keeps the loop condition true indefinitely. Factor the shared pname_list[] walk into one helper, widen the counter to u32, and clamp pname_count against the entries that fit in the descriptor body before iterating. Fixes: 3dcfe0de5a97 ("scsi: fc: Parse FPIN packets and update statistics") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Reviewed-by: Christoph Hellwig Reviewed-by: John Garry Link: https://patch.msgid.link/20260520133015.1018937-1-michael.bommarito@gmail.com Signed-off-by: Martin K. Petersen commit e4bb73bf3ac11b4a93634660345b9d764a4a80df Author: Ewan D. Milne Date: Tue May 19 16:53:56 2026 -0400 scsi: scsi_debug: Add missing newline in scsi_debug_device_reset() A "\n" at the end of the sdev_printk() string appears to have been inadvertently removed. Add it back for correct log message formatting. Fixes: a743b120227a ("scsi: scsi_debug: Stop printing extra function name in debug logs") Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Ewan D. Milne Reviewed-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/20260519205356.1040855-1-emilne@redhat.com Signed-off-by: Martin K. Petersen commit a4719ae23fb5b1b6229120c7ea4b6143a501a62e Author: Milan P. Gandhi Date: Thu May 14 13:27:54 2026 +0530 scsi: megaraid_sas: Fix NULL pointer dereference on firmware duplicate completion Add NULL check for scmd_local in the MPI2_FUNCTION_SCSI_IO_REQUEST case to handle firmware duplicate/stale completions. When firmware sends a duplicate completion for a command that was already processed and returned to the pool, the driver accesses NULL scmd pointer causing a crash. Timeline of the bug: 1. Command completes normally, megasas_return_cmd_fusion() called 2. This sets cmd->scmd = NULL and clears io_request with memset(..., 0, ...) 3. Firmware sends duplicate/stale completion for same SMID (firmware bug) 4. Driver processes reply descriptor again 5. Cleared io_request has Function = 0 (MPI2_FUNCTION_SCSI_IO_REQUEST) 6. Switch statement matches SCSI_IO_REQUEST case by accident 7. Accesses megasas_priv(NULL scmd)->status -> crash at offset 0x228 The offset 0x228 = sizeof(struct scsi_cmnd) 0x220 + offsetof(status) 0x8. This issue was observed on PERC H330 Mini running firmware 25.5.9.0001 after 3+ days of heavy I/O load. Crash signature: BUG: unable to handle kernel NULL pointer dereference at 0x228 RIP: complete_cmd_fusion+0x428 Function: megasas_priv(cmd_fusion->scmd)->status Add defensive check to skip processing when scmd_local is NULL. This handles duplicate completions from firmware and prevents accessing freed command structures. The check protects all scmd_local uses in both the SCSI_IO path and the fallthrough LDIO path. Signed-off-by: Milan P. Gandhi Link: https://patch.msgid.link/agWAgtk6rtHqNWb5@machine1 Signed-off-by: Martin K. Petersen commit adda8a44e1e43aceba058839f56fa1c599f6f99b Author: Alexander Perlis Date: Tue May 12 18:12:54 2026 -0500 scsi: devinfo: Add BLIST_NO_RSOC for Promise VTrak E310f The extremely slow boots reported July 2014 in bug 79901: https://bugzilla.kernel.org/show_bug.cgi?id=79901 for Promise VTrak E610f 3U 16-bay FC RAID enclosure occur also with the Promise VTrak E310f 2U 12-bay FC RAID enclosure. The 2014 patch: https://bugzilla.kernel.org/attachment.cgi?id=144101&action=diff added support for the BLIST_NO_RSOC flag and specified that flag for the Promise VTrak E610f. This current patch simply adds the E310f to that same list. One curiosity is the additional BLIST_SPARSELUN flag. This was also in the 2014 patch for the E610f, and was already in place for *all* Promise devices since 2007 due to commit e0b2e597d5dd ("[SCSI] stex: fix id mapping issue") which added the line: {"Promise", "", NULL, BLIST_SPARSELUN} The 2007 commit message talks of issues with SuperTrak EX (stex) but the added line did not limit itself to that particular device family. The current patch for E310F, like the 2014 patch for E610f, adds BLIST_NO_RSOC while preserving BLIST_SPARSELUN from 2007. Signed-off-by: Alexander Perlis Suggested-by: Nikkos Svoboda Link: https://patch.msgid.link/20260512231254.27530-1-aperlis@math.lsu.edu Signed-off-by: Martin K. Petersen commit 7205b58702273baf21d6ba7992e6ba15852325f7 Author: David Jeffery Date: Fri May 15 14:09:41 2026 -0400 scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues While a SCSI host is in a recovery state, scsi_mq_requeue_cmd() will not set the requeue list for a requeued command to be kicked in the future. The expectation is a call to scsi_run_host_queues() will kick all SCSI devices once the recovery state is cleared. However, scsi_run_host_queues() uses shost_for_each_device() which uses scsi_device_get() and so will ignore devices in a partially removed state like SDEV_CANCEL. But these devices may also have requeued requests, leaving their requests stuck from not being kicked and causing the removal process of the device to hang. scsi_run_host_queues() needs to run against more devices than the macro shost_for_each_device() allows. Instead of using the too limiting scsi_device_get() state checks, only ignore devices in SDEV_DEL state or when unable to acquire a reference. Attempt to run the queues for all other devices when scsi_run_host_queues() is called. Fixes: 8b566edbdbfb ("scsi: core: Only kick the requeue list if necessary") Signed-off-by: David Jeffery Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260515180941.9698-1-djeffery@redhat.com Signed-off-by: Martin K. Petersen commit 3589d20a666caf30ad100c960a2de7de390fce88 Author: Breno Leitao Date: Thu May 21 07:11:45 2026 -0700 net/iucv: fix locking in .getsockopt Mirror iucv_sock_setsockopt() and wrap the whole switch in lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock becomes redundant and is removed. Any AF_IUCV HIPER user can potentially crash the kernel by racing recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences iucv->hs_dev->mtu after iucv_sock_close() (called from the racing recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference oops. Suggested-by: Stanislav Fomichev Fixes: 51363b8751a6 ("af_iucv: allow retrieval of maximum message size") Signed-off-by: Breno Leitao Reviewed-by: Alexandra Winter Tested-by: Alexandra Winter Link: https://patch.msgid.link/20260521-af_iucv_fix2-v1-1-f16b1c510aa9@debian.org Signed-off-by: Jakub Kicinski commit 9e4389b0038781f19f97895186ed941ff8ac1678 Author: Alexandra Winter Date: Thu May 21 16:56:39 2026 +0200 net/smc: Do not re-initialize smc hashtables INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(), proto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht being reset even though hash entries already exist and are being used, possibly resulting in a corrupted list. Remove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in smc_init(); it is implicitly initialised to zero anyhow. Add HLIST_HEAD_INIT to the definitions for clarity. Fixes: f16a7dd5cf27 ("smc: netlink interface for SMC sockets") Suggested-by: Halil Pasic Signed-off-by: Alexandra Winter Acked-by: Halil Pasic Reviewed-by: Mahanta Jambigi Link: https://patch.msgid.link/20260521145639.10317-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski commit f54ea9ba95b8002d62fe0fb3b3cbe1b6dbdaf5a9 Merge: aae9d8a5528b8e 2e43b64248909c Author: Jakub Kicinski Date: Fri May 22 17:11:11 2026 -0700 Merge branch 'netlink-fixes-for-cross-namespace-nsid-reporting' Ilya Maximets says: ==================== netlink: fixes for cross-namespace nsid reporting While working on some new features for OVS and OVN we discovered that self-referential NSIDs get unintentionally allocated in the system as well as unexpectedly reported for local events on all-nsid listeners. More details in the patches. They change user-visible behavior, but the current behavior is arguably a bug, as it makes it hard to use all-nsid sockets without a decent amount of extra unrelated work of tracking when new NSIDs are allocated for your local namespace. Tests are added to check the expected behavior and YNL is extended to support all-nsid sockets in the tests. ==================== Link: https://patch.msgid.link/20260520172317.175168-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 2e43b64248909c617281921d6d9ba3bfc0159473 Author: Ilya Maximets Date: Wed May 20 19:22:38 2026 +0200 selftests: net: add a test case for nsid in all nsid notifications The test subscribes to link events from all namespaces and makes sure that local events do not carry NSID in their ancillary data (even if there is a self-referential NSID allocated for the local namespace), and remote events do. Signed-off-by: Ilya Maximets Acked-by: Nicolas Dichtel Link: https://patch.msgid.link/20260520172317.175168-5-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 88b126b39f9757e9debc322d4679239e9af089c7 Author: Ilya Maximets Date: Wed May 20 19:22:36 2026 +0200 net: netlink: don't set nsid on local notifications In most cases, notifications on sockets with NETLINK_LISTEN_ALL_NSID do not contain NSID in their ancillary data in case the event is local to the listener. However, when a self-referential NSID is allocated for a namespace, every local notification starts sending this ID to the user space. This is problematic, because the listener cannot tell if those notifications are local or not anymore without making extra requests to figure out if the provided NSID is local or not. The listener can also not figure out the local NSID beforehand as it can be allocated at any point in time by other processes, changing the structure of the future notifications for everyone. The value is practically not useful, since it's the namespace's own ID that the application has to obtain from other sources in order to figure out if it's the same or not. So, for the application it's just an extra busy work with no benefits. Moreover, applications that do not know about this quirk may be mishandling notifications with NSID set as notifications from remote namespaces. This is the case for ovs-vswitchd and the iproute2's 'ip monitor' that stops printing 'current' and starts printing the nsid number mid-session. Lack of clear documentation for this behavior is also not helping. A search though open-source projects doesn't reveal any projects that use NETNSA_NSID_NOT_ASSIGNED and rely on metadata to contain self-referential NSIDs (expected, since the value is not useful). Quite the opposite, as already mentioned, there are few applications that rely on NSID to not be present in local events. Since the value is not useful and actively harmful in some cases, let's not report it for local events, making the notifications more consistent. Also adding some blank lines for readability. Fixes: 59324cf35aba ("netlink: allow to listen "all" netns") Reported-by: Matteo Perin Signed-off-by: Ilya Maximets Acked-by: Nicolas Dichtel Link: https://patch.msgid.link/20260520172317.175168-3-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 70f8592ee90585272018a725054b6eb2ab7e99ca Author: Ilya Maximets Date: Wed May 20 19:22:35 2026 +0200 net: netlink: fix sending unassigned nsid after assigned one If the current skb is not shared, it is re-used directly for all the sockets subscribed to the notification. If we have remote all-nsid socket receiving a message first, then the 'nsid_is_set' will be set to 'true'. If the nsid is NOT_ASSIGNED for the next socket in the list, the 'nsid_is_set' will remain 'true' and the negative value is be delivered to the user space. All subsequent nsid values will be delivered as well, since there is no code path that sets the flag back to 'false'. Fix that by always dropping the flag to 'false' first. Fixes: 7212462fa6fd ("netlink: don't send unknown nsid") Signed-off-by: Ilya Maximets Acked-by: Nicolas Dichtel Link: https://patch.msgid.link/20260520172317.175168-2-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 79bd2dded182b1d458b18e62684b7f82ffc682e5 Merge: de37e502a31567 0c1a9dce208b4d Author: Linus Torvalds Date: Fri May 22 16:43:33 2026 -0700 Merge tag 'sched_ext-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Spurious WARN in ops_dequeue() racing with concurrent dispatch - Self-deadlock between scheduler disable and a concurrent sub-sched enable * tag 'sched_ext-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Fix spurious WARN on stale ops_state in ops_dequeue() sched_ext: Fix deadlock between scx_root_disable() and concurrent forks commit de37e502a315677138009d2965f87e2c0721e76f Merge: 4a5860ea6098bc 22572dbcd3486e Author: Linus Torvalds Date: Fri May 22 16:28:47 2026 -0700 Merge tag 'cgroup-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "Two rstat fixes: - Out-of-bounds access in the css_rstat_updated() BPF kfunc when called with an unchecked user-supplied cpu - Over-strict NMI guard after the recent switch to try_cmpxchg left sparc and ppc64 unable to queue rstat updates from NMI" * tag 'cgroup-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: rstat: relax NMI guard after switch to try_cmpxchg cgroup/rstat: validate cpu before css_rstat_cpu() access commit 4a5860ea6098bc6c0a966bb415d5dfe96adb4a86 Merge: 0e6582a51610ee 84335a9985867c Author: Linus Torvalds Date: Fri May 22 16:15:32 2026 -0700 Merge tag 'drm-fixes-2026-05-23' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Regular fixes pull, amdgpu/xe being the usual, with bonus msm content to bulk things out, otherwise it has the usual scattered changes, with amdxdna dropping a badly thought out userspace api. gem: - clean up LRU locking msm: - Core: - Fixed bindings for SM8650, SM8750 and Eliza - Don't use UTS_RELEASE directly - Fix typo in clock-names property - DPU: - Fixed CWB description on Kaanapali - Fixed scanline strides for YUV UBWC formats - Stopped DSI register dumping to access past the end of region - DSI: - Fix dumping unaligned regions - GPU: - Fix GMEM_BASE for a6xx gen3 - Fix userspace reachable crash on a2xx-a4xx - Fix sysprof_active for counter collection with IFPC enabled GPUs - Fix shrinker lockdep amdgpu: - Userq fixes - VPE fix - SMU 15 fix - Misc fixes - VCE fixes - DC bios parsing fixes - DC aux fix - Mode1 reset fix - RAS fixes amdkfd: - Misc fixes radeon: - CS parser fix xe: - SRIOV related fixes - Fix leak and double-free - Multi-cast register fixes - Multi-queue fix i915: - Fix joiner color pipeline selection [display] - Fix readback for target_rr in Adaptive Sync SDP [dp] - Apply Intel DPCD workaround when SDP on prior line used [psr] amdxdna: - remove mmap and export for ubuf bridge: - chipone-icn6211: managed bridge cleanup - lt66121: acquire reset GPIO - megachips: fix clean up on failed IRQ requests v3d: - fix UAF in error code paths - release GEM-object ref on free'd jobs virtio: - use uninterruptible resv locking in plane updates mediatek: - fix sparse warnings" * tag 'drm-fixes-2026-05-23' of https://gitlab.freedesktop.org/drm/kernel: (78 commits) drm/xe/oa: Fix exec_queue leak on width check in stream open drm/virtio: use uninterruptible resv lock for plane updates drm/amdgpu: fix handling in amdgpu_userq_create drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check drm/amdgpu: userq_va_mapped should remain true once done drm/amdgpu: avoid integer overflow in VA range check drm/amd/ras: Fix UMC error address allocation leak drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 reset drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async drm/amd/display: Validate GPIO pin LUT table size before iterating drm/amd/display: Fix integer overflow in bios_get_image() drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id drm/amdgpu: use atomic operation to achieve lockless serialization drm/amdkfd: Check bounds on allocate_doorbell drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets drm/amdgpu/vce1: Stop using amdgpu_vce_resume drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets drm/amdgpu/vce1: Don't repeat GTT MGR node allocation drm/amdgpu/vce1: Check if VRAM address is lower than GART. ... commit 0e6582a51610ee1efb1a3acae96d2960490b6f4b Merge: 59825bc9ce0628 b71cb088b2e342 Author: Linus Torvalds Date: Fri May 22 16:08:06 2026 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Small fixes, two in drivers and the remaining a sign conversion probem in sd with no user visible consequences (non-zero is error)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: target: tcm_loop: Fix NULL ptr dereference scsi: isci: Fix use-after-free in device removal path scsi: sd: Fix return code handling in sd_spinup_disk() commit 59825bc9ce06281224c15c51ec535bf339112d8c Merge: cca95436be15d0 654ddf855bebd8 Author: Linus Torvalds Date: Fri May 22 15:45:26 2026 -0700 Merge tag 'platform-drivers-x86-v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from - Add ACPI_HANDLE()/ACPI_COMPANION() NULL checks (many drivers) to handle match overrides gracefully - asus-armoury: - Fix mini-LED mode get/set - Add support for FA401EA, FX607VU, G614FR, and GU605CP - bitland-mifs-wmi: - Add CONFIG_LEDS_CLASS dependency - hp-wmi: - Add thermal support for Omen 16-c0xxx (board 8902) - intel/vsec: - Fix enable_cnt imbalance due to PCIe error recovery - surface/aggregator_registry: - Remove battery & AC nodes on Surface Laptop 7 to avoid duplicated devices - uniwill-laptop: - Handle uninitialized and invalid charging threshold values - Accept charging threshold of 0 through power supply sysfs ABI and clamp it to 1 - Make 'force' parameter to work also when device descriptor is found - Do not enable charging limit despite the 'force' parameter to avoid permanent damage to battery * tag 'platform-drivers-x86-v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (35 commits) platform/x86: bitland-mifs-wmi: add CONFIG_LEDS_CLASS dependency platform/x86: wireless-hotkey: Check ACPI_COMPANION() against NULL platform/x86: toshiba_haps: Check ACPI_COMPANION() against NULL platform/x86: toshiba_bluetooth: Check ACPI_COMPANION() against NULL platform/x86: toshiba_acpi: Check ACPI_COMPANION() against NULL platform/x86: system76: Check ACPI_COMPANION() against NULL platform/x86: sony-laptop: Check ACPI_COMPANION() against NULL platform/x86: panasonic-laptop: Check ACPI_COMPANION() against NULL platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL platform/x86: intel/smartconnect: Check ACPI_HANDLE() against NULL platform/x86: intel/rst: Check ACPI_COMPANION() against NULL platform/x86: fujitsu-tablet: Check ACPI_COMPANION() against NULL platform/x86: fujitsu: Check ACPI_COMPANION() against NULL platform/x86: eeepc-laptop: Check ACPI_COMPANION() against NULL platform/x86: dell/dell-rbtn: Check ACPI_COMPANION() against NULL platform/x86: asus-laptop: Check ACPI_COMPANION() against NULL platform/x86: acer-wireless: Check ACPI_COMPANION() against NULL platform/x86: asus-armoury: add support for GU605CP platform/x86: asus-armoury: add support for FA401EA platform/x86: asus-armoury: add support for G614FR ... commit 84335a9985867c1a6cd28c693ffbedc4ef1caa39 Merge: 4378a411656788 4d25342543c013 Author: Dave Airlie Date: Sat May 23 07:50:49 2026 +1000 Merge tag 'drm-xe-fixes-2026-05-21' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - SRIOV related fixes (Wajdeczko, Mohanram) - Fix leak and double-free (Lin) - Multi-cast register fixes (Gustavo) - Multi-queue fix (Niranjana) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/ag9rR5VwCdkA0lzI@intel.com commit cca95436be15d00ddac02d73054b612649485495 Merge: e216d85eaf4ca5 ea17fc4d7dc2ba Author: Linus Torvalds Date: Fri May 22 13:23:21 2026 -0700 Merge tag 'phy-fixes-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: - Big pile of Qualcomm DP/eDP config fixes and kaanapali PHY PLL lock failure fix - Apple typec switch/mux leak fix - Marvell incoorect register fix for mvebu utmi phy - Tegra per-pad calibration fix * tag 'phy-fixes-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config phy: apple: atc: Fix typec switch/mux leak on unbind phy: spacemit: Remove incorrect clk_disable() in spacemit_usb2phy_init() phy: eswin: Fix incorrect error check in probe() phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4 fix phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870 phy: tegra: xusb: Fix per-pad high-speed termination calibration phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access phy: qcom: edp: Add PHY-specific LDO config for eDP low vdiff phy: qcom: edp: Fix AUX_CFG8 programming for DP mode phy: qcom: edp: Add SC7280/SC8180X swing/pre-emphasis tables phy: qcom: edp: Add eDP/DP mode switch support phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis tables commit e216d85eaf4ca525520ca2c0a7d99ee8639a5718 Merge: ddae1043d8c46a 27cd2dde35b2c3 Author: Linus Torvalds Date: Fri May 22 13:19:41 2026 -0700 Merge tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "Another batch of driver fixes from Johan fixing error handling paths, plus another from Felix. We also have a new device ID added in the DT bindings for SpacemiT K3" * tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: fsl-qspi: support SpacemiT K3 spi: ti-qspi: fix use-after-free after DMA setup failure spi: sprd: fix error pointer deref after DMA setup failure spi: qup: fix error pointer deref after DMA setup failure spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() spi: ep93xx: fix error pointer deref after DMA setup failure commit ddae1043d8c46a193b8d5d93ca59f320f03902fe Merge: 003759d49a407c f9b2d3b703d13d Author: Linus Torvalds Date: Fri May 22 13:17:29 2026 -0700 Merge tag 'regulator-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of fixes here, one very minor Kconfig fix and a fix for a nasty issue with error reporting in the tps65219 driver" * tag 'regulator-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: tps65219: fix irq_data.rdev not being assigned regulator: Kconfig: fix a typo in help commit 003759d49a407c712f0bbe77cf5cf5b57f03d9e0 Merge: 99e08debac1a38 3812a9e84265a5 Author: Linus Torvalds Date: Fri May 22 12:33:28 2026 -0700 Merge tag 'pinctrl-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Implement the GPIO .get_direction() callback in the Mediatek driver to rid dmesg warnings - Mark the Qualcomm IPQ4019 pins used as GPIO as using the GPIO pin function, so there is no conflict with orthogonal muxing - Fix incorrect settings of the "PUPD" (pull-up-pull-down) register during suspend/resume in the Renesas RZG2L - Fix the SMT register cache to be per-bank in the Renesas RZG2L - Fix the QDSS track clock and control pin group names in the Qualcomm Eliza driver - Fix a deadlock in the Amlogic driver, caused by playing around in sysfs - Fix some GPIO wakeup interrupt handling in Qualcomm QCS615. and a similar fix for the Qualcomm SM8150 - Allow parsing DTs without explicit function nodes in the Freescale i.MX1 driver - Enable the IRQ for the WACF2200 touchscreen using a DMI quirk * tag 'pinctrl-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11 pinctrl: imx1: Allow parsing DT without function nodes pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615 pinctrl: meson: amlogic-a4: fix deadlock issue pinctrl: qcom: eliza: Fix QDSS trace clock/control pingroup names pinctrl: renesas: rzg2l: Fix SMT register cache handling pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function pinctrl: mediatek: moore: implement gpio_chip::get_direction() commit 99e08debac1a381d57bd50a26e377e27674d91b7 Merge: c22407252a2421 a4fa45c1d980bc Author: Linus Torvalds Date: Fri May 22 12:28:47 2026 -0700 Merge tag 'gpio-fixes-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - propagate the error code from regulator_enable() in resume path in gpio-pca953x - take the device lock when calling device_is_bound() in virtual GPIO drivers - fix software node leak in remove path in gpio-aggregator - fix a potential use-after-free in gpio-aggregator - harden the GPIO character device uAPI: check that line config attributes are correctly zeroed * tag 'gpio-fixes-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: virtuser: lock device when calling device_is_bound() gpio: aggregator: lock device when calling device_is_bound() gpio: sim: lock device when calling device_is_bound() gpio: aggregator: remove the software node when deactivating the aggregator gpio: aggregator: fix a potential use-after-free gpio: cdev: check if uAPI v2 config attributes are correctly zeroed gpio: pca953x: propagate regulator_enable() error from resume commit c22407252a2421286998323831095e6b8a1d9532 Merge: 3997e3bb1d30a4 2519003dd5fb6f Author: Linus Torvalds Date: Fri May 22 12:22:22 2026 -0700 Merge tag 'sound-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "As expected, we still continue receiving lots of small fixes. One major change is about HD-audio pending IRQ handling, but this would influence only on odd machines or slow VMs. There are a few other fixes for the core part, but most of them are not-too-serious UAF fixes, while the rest are mostly device-specific fixes and quirks. ALSA Core: - Fix for PCM silencing with bogus iov_iter - Fixes for past-the-end iterators in timer and seq - Serialization of UMP output teardown - Rate-limit ELD parsing errors HD-audio: - Fixes for IRQ work handling and SSID matching - Various Realtek quirks for HP and ASUS laptops, including LED fixes ASoC: - Intel: ACPI match table updates for PTL, NVL, and ARL platforms - Cirrus Logic: Fixes for cs-amp-lib and cs35l56 codecs - Various platform fixes for AMD, FSL SAI, TI OMAP, and Qualcomm - DT-binding fix for MediaTek Others: - USB ua101: Reject too-short USB descriptors - Scarlett2: Fix for flash writes - ASIHPI: Fix for potential OOB access - AMD SPI: Fix for bus number in ACPI probe MAINTAINERS: - Updates for SOF and TI maintainers" * tag 'sound-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (47 commits) ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put() ASoC: Intel: soc-acpi-intel-ptl-match: Remove unnecessary cs42l43 match ASoC: soc-acpi-intel-ptl-match: Make Chrome matches conditional ASoC: Intel: soc-acpi: Add entry for sof_es8336 in NVL match table. ASoC: Intel: sof_sdw: Add support for nvlrvp in NVL platform ASoC: cs-amp-lib: Fix typo in error message: write -> read ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup() ASoC: cs-amp-lib: Fix wrong sizeof() in _cs_amp_set_efi_calibration_data() ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() MAINTAINERS: ASoC: Intel/SOF: Remove Ranjani Sridharan as maintainer ALSA: seq: Serialize UMP output teardown with event_input ALSA: scarlett2: Allow flash writes ending at segment boundary ALSA: hda/realtek: Add LED quirk for HP ProBook 430 G6 ALSA: hda/intel: Make sure to cancel irq-pending work at closing PCM stream ALSA: hda: Move irq pending work into hda-intel stream ASoC: soc-utils: Add missing va_end in snd_soc_ret() ALSA: ua101: Reject too-short USB descriptors ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() ... commit 3997e3bb1d30a426c0599918ebaac51698fcc959 Merge: dbae42cfa618ab f6982769910ecd Author: Linus Torvalds Date: Fri May 22 12:06:23 2026 -0700 Merge tag 'block-7.1-20260522' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - Fix memory leak for peer-to-peer addresses - Fix dma map leaks on resource errors - Another bio integrity fix, fixing a recent regression - Fix for an issue with the request pre-allocation and caching when IO is queued, where if a bio split occurred and ended up blocking, the list could be corrupted * tag 'block-7.1-20260522' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block: avoid use-after-free in disk_free_zone_resources() blk-mq: pop cached request if it is usable nvme-pci: fix dma mapping leak on data setup error nvme-pci: fix dma_vecs leak on p2p memory bio-integrity-fs: pass data iter to bio_integrity_verify() commit dbae42cfa618abc57f0bc3c28cc140292f4f7410 Merge: 558c3eca715ea0 e97ff8b62d4690 Author: Linus Torvalds Date: Fri May 22 11:53:28 2026 -0700 Merge tag 'io_uring-7.1-20260522' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix for an issue with IORING_OP_NOP and using injection results - Fix for an issue in IORING_OP_WAITID, where the info state was assumed cleared by the lower level syscall handler, but for some cases it is not. Just clear the data upfront, so that non-initialized data isn't copied back to userspace - Fix for a lockdep reported issue, where IORING_OP_BIND enters file create and hence hits mnt_want_write(), which creates a three part lockdep cycle between the super lock, io_uring's uring_lock, and the cred mutex - Fix a regression introduced in this cycle with how linked timeouts are deleted - Ensure that the ->opcode nospec indexing on the opcode issue side covers all the cases * tag 'io_uring-7.1-20260522' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/nop: pass all errors to userspace io_uring/timeout: splice timed out link in timeout handler io_uring: propagate array_index_nospec opcode into req->opcode io_uring/waitid: clear waitid info before copying it to userspace io_uring/net: punt IORING_OP_BIND async if it needs file create commit aae9d8a5528b8ee9ff8dc5d3558b8a9f852a724a Author: Ziyu Zhang Date: Wed May 20 00:56:36 2026 +0800 vsock: keep poll shutdown state consistent vsock_poll() reads vsk->peer_shutdown before taking the socket lock to set EPOLLHUP and EPOLLRDHUP, then reads it again after taking the lock to report EOF readability. A shutdown packet can update peer_shutdown while poll is waiting for the lock, so one poll invocation can report EOF readability without the corresponding HUP/RDHUP bits. For connectible sockets, take one peer_shutdown snapshot after lock_sock() and use it for all peer-shutdown-derived poll bits. For datagram sockets, which do not take lock_sock() in poll(), take one lockless READ_ONCE() snapshot and pair it with WRITE_ONCE() on the writer side. This keeps the peer-shutdown-derived bits internally consistent for each poll pass. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Signed-off-by: Ziyu Zhang Link: https://patch.msgid.link/20260519165636.62542-1-ziyuzhang201@gmail.com Signed-off-by: Jakub Kicinski commit 558c3eca715ea0110fe6fce38b063a6f9936188c Merge: 632360e8f5fce2 dcd4313f0987d6 Author: Linus Torvalds Date: Fri May 22 10:52:26 2026 -0700 Merge tag 'v7.1-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix missing lock - Fix dentry in use after unmounting - cifs.upcall security fix - require CAP_NET_ADMIN for swn netlink - change allocation in DUP_CTX_STR to GFP_KERNEL - minor smbdirect debug fix - handle_read_data() folio fix * tag 'v7.1-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: change allocation requirements in DUP_CTX_STR macro smb: client: require net admin for CIFS SWN netlink smb: smbdirect: divide, not multiply, milliseconds by 1000 cifs: Fix busy dentry used after unmounting smb: client: use data_len for SMB2 READ encrypted folioq copy smb: client: reject userspace cifs.spnego descriptions smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() commit 632360e8f5fce2eee720e952fd84e8cefb5749b6 Merge: 45255ea1ca096b 3a8389d42bdf42 Author: Linus Torvalds Date: Fri May 22 10:44:18 2026 -0700 Merge tag 'zonefs-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs fix from Damien Le Moal: - Avoid potential overflow when converting a zonefs file number string to an inode number (from Johannes) * tag 'zonefs-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: handle integer overflow in zonefs_fname_to_fno commit aa8963fdce667a42fb7f0bdd2909fadcab02f9a8 Author: Weiming Shi Date: Thu May 21 09:33:13 2026 -0700 tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk. Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform. Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Dongli Zhang Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260521163312.1479805-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit 3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2 Author: Weiming Shi Date: Thu May 21 09:32:31 2026 -0700 tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one(). Fixes: 0efac27791ee ("tap: accept an array of XDP buffs through sendmsg()") Fixes: ed7f2afdd0e0 ("tap: add missing verification for short frame") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Dongli Zhang Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260521163230.1478627-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit dab48a7e74e6a394f3aa0461a2b1fb0c7b38fcb8 Author: Thomas Fourier Date: Fri May 22 10:54:04 2026 +0200 Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() The input buffer size is pcu->max_in_size, but pcu->max_out_size is passed to usb_free_coherent(). Change size to match the allocation size. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20260522085412.45430-2-fourier.thomas@gmail.com Signed-off-by: Dmitry Torokhov commit f4feb1e20058e407cb00f45aff47f5b7e19a6bbf Author: Weiming Shi Date: Wed May 20 09:00:21 2026 -0700 tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each short frame in a batch leaks one page-frag chunk. A local process that can open /dev/net/tun and /dev/vhost-net can hit this path: it attaches a tun/tap device as the vhost-net backend and feeds TX descriptors whose length minus the virtio-net header is below ETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a tight submission loop exhausts host memory and triggers an OOM panic. Free the page before returning -EINVAL, matching the XDP-program error path in the same function. Fixes: 049584807f1d ("tun: add missing verification for short frame") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Dongli Zhang Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260520160020.375349-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit 45255ea1ca096b11b1303c9b54502a28f3a31dd1 Merge: 28222dcdad2181 a67f3113331d9f Author: Linus Torvalds Date: Fri May 22 07:13:13 2026 -0700 Merge tag 'pm-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix maximum frequency computation in the intel_pstate driver for two processor models, update its documentation and fix issues related to the dynamic EPP support (added during the current development cycle) in the amd-pstate driver: - Fix maximum frequency computation in the intel_pstate driver for Raptor Lake-E and Bartlett Lake that are SMP platforms derived from hybrid ones (Rafael Wysocki, Henry Tseng) - Fix the description of asymmetric packing with SMT in the intel_pstate driver documentation (Ricardo Neri) - Fix multiple amd-pstate driver issues related to dynamic EPP support added recently, including making it opt-in only (K Prateek Nayak, Mario Limonciello)" * tag 'pm-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq/amd-pstate: Drop Kconfig option for dynamic EPP cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E Documentation: intel_pstate: Fix description of asymmetric packing with SMT cpufreq/amd-pstate-ut: Drop policy reference before driver switch cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp commit e1a9d791fd66ab2431b9e6f6f835823809869047 Author: Johan Hovold Date: Fri May 22 12:16:21 2026 +0200 USB: serial: cypress_m8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a malicious device report a smaller size. Fixes: 3416eaa1f8f8 ("USB: cypress_m8: Packet format is separate from characteristic size") Cc: stable@vger.kernel.org # 2.6.26 Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 28222dcdad2181e3b153b2300ac4cb9cb3304fd7 Merge: ef7f594f5d291a c35cb4fc723170 Author: Linus Torvalds Date: Fri May 22 07:06:21 2026 -0700 Merge tag 'acpi-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fix from Rafael Wysocki: "Unbreak system wakeup on critical battery status in the ACPI battery driver inadvertently broken during the 7.0 development cycle" * tag 'acpi-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: battery: Fix system wakeup on critical battery status commit f6982769910ecddabdb5b8b9afdab0bb8b6668ac Author: Damien Le Moal Date: Fri May 22 20:56:22 2026 +0900 block: avoid use-after-free in disk_free_zone_resources() The function disk_update_zone_resources() may call disk_free_zone_resources() in case of error, and following this, blk_revalidate_disk_zones() will again calls disk_free_zone_resources() if disk_update_zone_resources() failed. If a zone worker thread is being used (which is the default for a rotational media zoned device), disk_free_zone_resources() will try to stop the zone worker thread twice because disk->zone_wplugs_worker is not reset to NULL when the worker thread is stopped the first time. In disk_free_zone_resources(), fix this by correctly clearing disk->zone_wplugs_worker to NULL when the worker thread is stopped. And while at it, since disk_free_zone_resources() is always called after a failed call to disk_update_zone_resources(), remove the unnecessary call to disk_free_zone_resources() in disk_update_zone_resources(). Fixes: 1365b6904fd0 ("block: allow submitting all zone writes from a single context") Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260522115622.588535-1-dlemoal@kernel.org Signed-off-by: Jens Axboe commit ef7f594f5d291a98a4da2cc95e7713d3971bedaa Merge: cbadb98b7cb017 c2ff4764e03e7a Author: Linus Torvalds Date: Fri May 22 06:53:11 2026 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Handle probe on hinted conditional branch instructions. BC.cond instructions can be simulated in the same way as B.cond instructions, so extend the decode mask for B.cond to cover BC.cond - Flush the walk cache when unsharing PMD tables. Recent changes to huge_pmd_unshare() introduced mmu_gather::unshared_tables but the arm64 code was still treating the TLB flushing as only targeting leaf entries (TLBI VALE1IS). Fix it by using non-leaf-only instructions (TLBI VAE1IS) when tlb->unshared_tables is set * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: tlb: Flush walk cache when unsharing PMD tables arm64: probes: Handle probes on hinted conditional branch instructions commit cbadb98b7cb017b6b7376940781cb108f7baac71 Merge: 46de4087d38ece 540f4a4f6ef806 Author: Linus Torvalds Date: Fri May 22 06:40:31 2026 -0700 Merge tag 's390-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Fix PAI NNPA mismatch between counting and recording, where sampling reports twice the value - Fix loss of PAI counter increments during recording on systems with many CPUs under heavy load, while counting is not affected - On some supported machines, CHSC cannot access memory outside the DMA zone, causing CHSC command failures. Restore GFP_DMA flag when allocating memory for CHSC control blocks - Align the numbering scheme for higher-level topology structures like socket, book, drawer with other hardware identifiers e.g. in sysfs, procfs and tools like lscpu * tag 's390-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/topology: Use zero-based numbering for containing entities s390/cio: Restore GFP_DMA for CHSC allocation s390/pai: Fix missing PAI counter increments under heavy load s390/pai: Disable duplicate read of kernel PAI counter value commit 46de4087d38ece8477ab4b6b7630c13c82c27f1a Merge: 1c04dcd891c011 67ea9d353d0ba1 Author: Linus Torvalds Date: Fri May 22 06:23:56 2026 -0700 Merge tag 'slab-for-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - Stable fix for a missing cpus_read_lock in one of the cpu sheaves flushing paths (Qing Wang) * tag 'slab-for-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache() commit 90918794a4e2c3b440f8fcf3847765a8b1d81b25 Author: Aleksandr Nogikh Date: Thu May 21 16:22:40 2026 +0200 signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() When a multi-threaded process receives a stop signal (e.g., SIGSTOP), do_signal_stop() sets JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME on all threads and sets signal->group_stop_count to the number of threads. If one of the threads concurrently calls execve(), de_thread() invokes zap_other_threads() to kill all other threads. zap_other_threads() aborts the pending group stop by resetting signal->group_stop_count to 0 and clears the JOBCTL_PENDING_MASK for all other threads. However, it fails to clear the job control flags for the calling thread. When execve() completes, the calling thread returns to user mode and checks for pending signals. Seeing the stale JOBCTL_STOP_PENDING flag, it calls do_signal_stop(), which invokes task_participate_group_stop(). Since JOBCTL_STOP_CONSUME is still set, it attempts to decrement the already-zero signal->group_stop_count, triggering a warning: sig->group_stop_count == 0 WARNING: CPU: 1 PID: 6475 at kernel/signal.c:373 task_participate_group_stop+0x215/0x2d0 Call Trace: do_signal_stop+0x3be/0x5c0 kernel/signal.c:2619 get_signal+0xa8c/0x1330 kernel/signal.c:2884 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this race condition by clearing the JOBCTL_PENDING_MASK for the calling thread in zap_other_threads(), ensuring it does not retain any stale job control state after the thread group is destroyed. This aligns with other functions that tear down a thread group and abort group stops, such as zap_process() and complete_signal(), which correctly clear these flags for all threads including the current one. Fixes: 39efa3ef3a37 ("signal: Use GROUP_STOP_PENDING to stop once for a single group stop") Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot Reported-by: syzbot+b109633ea805cac54a61@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b109633ea805cac54a61 Link: https://syzkaller.appspot.com/ai_job?id=d70208cc-862b-4fe3-bf02-3031e10cd0b3 Signed-off-by: Aleksandr Nogikh Link: https://patch.msgid.link/20260521142240.2973022-1-nogikh@google.com Signed-off-by: Christian Brauner (Amutable) commit 9c954499d43aefac01c5dfb57a82b13d2dcf4b94 Author: Jann Horn Date: Tue May 19 16:29:38 2026 +0200 fuse: reject fuse_notify() pagecache ops on directories The operations FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE allow the FUSE daemon to actively write/read pagecache contents. For directories with FOPEN_CACHE_DIR, the pagecache is used as kernel-internal cache storage, and userspace is not supposed to have direct access to this cache - in particular, fuse_parse_cache() will hit WARN_ON() if the cache contains bogus data. Reject FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE on anything other than regular files with -EINVAL. Fixes: 5d7bc7e8680c ("fuse: allow using readdir cache") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn Link: https://patch.msgid.link/20260519-fuse-dir-pagecache-v2-1-5428fa48e175@google.com Acked-by: Miklos Szeredi Signed-off-by: Christian Brauner (Amutable) commit 4e3d1b2c48ca6c55f1e9ca7f8dccc76f120f276c Author: Jann Horn Date: Tue May 19 16:40:34 2026 +0200 fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios FUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folios can contain uninitialized data. Since FUSE_NOTIFY_RETRIEVE is intended to only return data that is already in the page cache and not wait for data from the FUSE daemon, treat !uptodate folios as if they weren't present. This only has security impact on systems that don't enable automatic zero-initialization of all page allocations via CONFIG_INIT_ON_ALLOC_DEFAULT_ON or init_on_alloc=1. Cc: stable@kernel.org Fixes: 2d45ba381a74 ("fuse: add retrieve request") Signed-off-by: Jann Horn Link: https://patch.msgid.link/20260519-fuse-retrieve-uptodate-v1-1-a7a1912a37f9@google.com Acked-by: Miklos Szeredi Signed-off-by: Christian Brauner (Amutable) commit 1c04dcd891c011839f57d0501e9bc473cc0aae7d Merge: 23884007afe901 af0c3f05866237 Author: Linus Torvalds Date: Fri May 22 06:16:00 2026 -0700 Merge tag 'dma-mapping-7.1-2026-05-22' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "Two minor updates for the DMA-mapping code, mainly fixing some rare corner cases (Petr Tesarik, Jianpeng Chang)" * tag 'dma-mapping-7.1-2026-05-22' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-mapping: move dma_map_resource() sanity check into debug code dma-direct: fix use of max_pfn commit 23884007afe901352349e709e33eb19373a842d7 Merge: 6779b50faa562e 8f0f5c4fb9df0e Author: Linus Torvalds Date: Fri May 22 06:09:58 2026 -0700 Merge tag 'trace-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Avoid NULL return from hist_field_name() The function hist_field_name() is directly passed to a strcat() which does not handle "NULL" characters. Return a zero length string when size is greater than the limit. This is used only to output already created histograms and no field currently is greater than the limit. But it should still not return NULL. - Do not call map->ops->elt_free() on allocation failure When elt_alloc() fails, it should not call the map->ops->elt_free() function if it exists, as that function may not be able to handle the free on allocation failures. The ->elt_free() should only be called when elt_alloc() succeeds. * tag 'trace-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Do not call map->ops->elt_free() if elt_alloc() fails tracing: Avoid NULL return from hist_field_name() on truncation commit 654ddf855bebd8d45a6e707f5dc2344921f5e0cf Author: Arnd Bergmann Date: Tue May 19 22:28:01 2026 +0200 platform/x86: bitland-mifs-wmi: add CONFIG_LEDS_CLASS dependency The newly added driver requires the LED classdev support and causes a link failure when that is disabled: x86_64-linux-ld: vmlinux.o: in function `bitland_mifs_wmi_probe': bitland-mifs-wmi.c:(.text+0xede02a): undefined reference to `devm_led_classdev_register_ext' Fixes: dc1ec4fa86b2 ("platform/x86: bitland-mifs-wmi: Add new Bitland MIFS WMI driver") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260519202804.1339581-1-arnd@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 18014147d3ee7831dce53fe65d7fc8d428b02552 Author: Fernando Fernandez Mancera Date: Mon May 11 16:37:56 2026 +0200 netfilter: nf_tables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then immediately reads from src to calculate the carry for the next iteration. Because src and dst could point to the same memory location, the carry is incorrectly calculated using the newly modified dst value instead of the original src value. Adding a temporary local variable to cache the original value before writing to dst and using it for the carry calculation solves the problem. In addition, partial overlap is rejected from control plane for all kind of operations including byteorder. This was tested with the following bytecode: table test_table ip flags 0 use 1 handle 1 ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1 ip test_table test_chain 2 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x66443322 0x00887766 ] [ counter pkts 0 bytes 0 ] ip test_table test_chain 4 3 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x55443322 0x00887766 ] [ counter pkts 21794 bytes 1917798 ] Fixes: 567d746b55bc ("netfilter: bitwise: add support for shifts.") Acked-by: Jeremy Sowden Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit a40aaaef2f8f5a17a779eeac7032f2f7d5322406 Author: Jiayuan Chen Date: Wed May 20 10:34:11 2026 +0800 selftests: netfilter: add nft_fib_nexthop test Functional coverage of nft_fib6_eval()'s nexthop enumeration over three route shapes: 1) single external nexthop (nhid) 2) external nexthop group (nhid -> group) 3) old-style multipath (nexthop ... nexthop ...) Each scenario places one nexthop on the input device (veth0). For (2) and (3) the matching nexthop is the second member, so the walk has to traverse beyond the primary nh. Two nft counters on prerouting verify the data path: one increments only when fib reports veth0 as the oif, the other counts "missing" results and must stay at zero. ./nft_fib_nexthop.sh PASS: single external nexthop (nhid -> veth0) PASS: nexthop group (dummy0 + veth0) PASS: old-style multipath (sibling on veth0) Suggested-by: Florian Westphal Signed-off-by: Jiayuan Chen Signed-off-by: Florian Westphal commit f81b0c2d281faa93e4c2b7247047922aaf3e4ba6 Author: Jiayuan Chen Date: Wed May 20 10:34:10 2026 +0800 netfilter: nft_fib_ipv6: handle routes via external nexthop fib6_info has a union: union { struct list_head fib6_siblings; struct list_head nh_list; }; Old-style multipath (ip -6 route add ... nexthop ... nexthop ...) uses fib6_siblings. External nexthop (ip -6 route add ... nhid N) uses nh_list, linked into &nh->f6i_list. nft_fib6_info_nh_uses_dev() blindly walks &rt->fib6_siblings, causing an OOB read past the struct nexthop slab when rt->nh is set: ================================================================== BUG: KASAN: slab-out-of-bounds in nft_fib6_eval+0x1362/0x16c0 Read of size 8 at addr ffff888103a099d0 by task ping/386 CPU: 2 UID: 0 PID: 386 Comm: ping Not tainted 7.1.0-rc3+ #251 PREEMPT Call Trace: dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x5f0 kasan_report+0xe7/0x130 __asan_report_load8_noabort+0x14/0x30 nft_fib6_eval+0x1362/0x16c0 nft_do_chain+0x279/0x18c0 nft_do_chain_ipv6+0x1a8/0x230 nf_hook_slow+0xad/0x200 ipv6_rcv+0x152/0x380 __netif_receive_skb_one_core+0x118/0x1c0 ================================================================== Branch by route shape: when rt->nh is set, walk via nexthop_for_each_fib6_nh() (also covers nh groups, which the original code missed); otherwise walk fib6_siblings, guarded by READ_ONCE() of rt->fib6_nsiblings as required by commit 31d7d67ba127 ("ipv6: annotate data-races around rt->fib6_nsiblings"). Fixes: 1c32b24c234b ("netfilter: nft_fib_ipv6: switch to fib6_lookup") Signed-off-by: Jiayuan Chen Signed-off-by: Florian Westphal commit 1d001b0a6182b0d2f41a8d687f7522b6f1e94280 Author: Jiayuan Chen Date: Wed May 20 10:34:09 2026 +0800 netfilter: nft_fib_ipv6: walk fib6_siblings under RCU nft_fib6_info_nh_uses_dev() runs from nft_fib6_eval() in softirq under rcu_read_lock(). fib6_siblings is modified by writers that hold tb6_lock but do not wait for RCU readers, so the sibling walk should use list_for_each_entry_rcu(): it adds READ_ONCE() on the ->next pointer and lets CONFIG_PROVE_RCU_LIST validate the locking. No functional change for non-debug builds. Fixes: 1c32b24c234b ("netfilter: nft_fib_ipv6: switch to fib6_lookup") Signed-off-by: Jiayuan Chen Signed-off-by: Florian Westphal commit f438d1786d657d57790c5d138d6db3fc9fdac392 Author: Florian Westphal Date: Tue May 19 22:52:07 2026 +0200 netfilter: ebtables: fix OOB read in compat_mtw_from_user Luxiao Xu says: The function compat_mtw_from_user() converts ebtables extensions from 32-bit user structures to kernel native structures. However, it lacks proper validation of the user-supplied match_size/target_size. When certain extensions are processed, the kernel-side translation logic may perform memory accesses based on the extension's expected size. If the user provides a size smaller than what the extension requires, it results in an out-of-bounds read as reported by KASAN. This fix introduces a check to ensure match_size is at least as large as the extension's required compatsize. This covers matches, watchers, and targets, while maintaining compatibility with standard targets. AFAIU this is relevant for matches that need to go though match->compat_from_user() call. Those that use plain memcpy with the user-provided size are ok because the caller checks that size vs the start of the next rule entry offset (which itself is checked vs. total size copied from userspace). The ->compat_from_user() callbacks assume they can read compatsize bytes, so they need this extra check. Based on an earlier patch from Luxiao Xu. Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Luxiao Xu Signed-off-by: Ren Wei Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit 968cc2c96390f06e56ed6a43f935bfebdefed28f Author: Florian Westphal Date: Sat May 16 23:23:21 2026 +0800 netfilter: disable payload mangling in userns Several parts of network stack rely on iph->ihl validation done by network stack before PRE_ROUTING. Disable this feature for user namespaces for now. tcp option handling is likely safe even for LOCAL_IN, so this this leaves tcp option mangling via nft_exthdr.c as-is. I don't think these are the only means to alter packets, but these appear to be relatively prominent. This could be relaxed later. Example: - allow userns for ingress hook. - allow userns if base is transport header. Also, we should revalidate or restrict generally: - Don't allow linklayer writes to spill into network header - restrict ipv4 and ipv6 to 'known safe' writes, e.g. saddr/daddr/check/tos Reported-by: Qi Tang Reported-by: Tong Liu Tested-by: Qi Tang Link: https://lore.kernel.org/netfilter-devel/20260515100411.3141-1-fw@strlen.de/ Signed-off-by: Florian Westphal commit c376f07e16c02239ed44cabb97145d03f65b4d15 Author: Florian Westphal Date: Tue May 19 20:10:08 2026 +0200 netfilter: xt_cpu: prefer raw_smp_processor_id With PREEMPT_RCU we get splat: BUG: using smp_processor_id() in preemptible [..] caller is cpu_mt+0x53/0xd0 net/netfilter/xt_cpu.c:37 CPU: 1 .. Comm: syz.3.1377 #0 PREEMPT(full) Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 check_preemption_disabled+0xd3/0xe0 lib/smp_processor_id.c:47 cpu_mt+0x53/0xd0 net/netfilter/xt_cpu.c:37 [..] Just use raw version instead. This is similar to 14d14a5d2957 ("netfilter: nft_meta: use raw_smp_processor_id()"). Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") Reported-by: syzbot+690d3e3ffa7335ac10eb@syzkaller.appspotmail.com Signed-off-by: Florian Westphal commit 47980b6dbf83961eec1c1363ea986e9c06ff8054 Author: Florian Westphal Date: Thu May 14 14:21:57 2026 +0200 netfilter: nf_conntrack_gre: fix gre keymap list corruption Quoting reporter: A race between GRE keymap insertion and destruction can corrupt the kernel list or use a freed object. `nf_ct_gre_keymap_add()` publishes a new keymap pointer before the embedded `list_head` is linked, while `nf_ct_gre_keymap_destroy()` can concurrently delete and free that same object. An unprivileged user can reach this through the PPTP conntrack helper by racing PPTP control messages or helper teardown, leading to KASAN-detectable list corruption/UAF in kernel context. ## Root Cause Analysis `exp_gre()` installs GRE expectations for a PPTP control flow and then adds two GRE keymap entries [..] The add path publishes `ct_pptp_info->keymap[dir]` before linking the embedded list node [..] Concurrent teardown deletes that partially initialized object. Make add/destroy symmetric: install both, destroy both while under lock. Furthermore, we should refuse to publish a new mapping in case ct is going away, else we may leak the allocation. The "retrans" detection is strange: existing mapping is checked for key equality with the new mapping, then for "is on the list" via list walk. But I can't see how an existing keymap entry can be NOT on list. Change this to only check if we're asked to map same tuple again -- if so, skip re-install, else signal failure. Last, add a bug trap for the keymap list; it has to be empty when namespace is going away. Reported-by: Leo Lin Signed-off-by: Florian Westphal commit 92170e6afe927ab2792a3f71902845789c8e31b1 Author: Chris Mason Date: Tue May 19 12:36:14 2026 -0700 netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb->head. After that point the cached th is stale: caller (ipv[46]_synproxy_hook) th = skb_header_pointer(skb, ..., &_tcph) synproxy_tstamp_adjust(skb, protoff, th, ...) skb_ensure_writable(skb, optend) pskb_expand_head() /* kfree(old skb->head) */ ... inet_proto_csum_replace4(&th->check, ...) /* writes into freed head, or into the caller's stack copy leaving the on-wire checksum stale */ The option bytes are written through skb->data and are fine; only the checksum update goes through th and so lands in the wrong place. The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload. Fix by re-deriving th from skb->data + protoff immediately after skb_ensure_writable() succeeds, so the subsequent checksum update targets the linear, writable header. Fixes: 48b1de4c110a ("netfilter: add SYNPROXY core/target") Assisted-by: kres (claude-opus-4-7) Signed-off-by: Chris Mason Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a Author: Hamza Mahfooz Date: Mon May 11 10:43:14 2026 -0400 netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction. Cc: stable@vger.kernel.org Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") Signed-off-by: Hamza Mahfooz Signed-off-by: Florian Westphal commit 215c90ee656114f5e8c32408228d97082f8e0eef Author: Bartosz Golaszewski Date: Wed May 6 13:57:00 2026 +0200 device property: set fwnode->secondary to NULL in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitalized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. Cc: stable Fixes: 01bb86b380a3 ("driver core: Add fwnode_init()") Signed-off-by: Bartosz Golaszewski Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Andy Shevchenko Reviewed-by: Sakari Ailus Link: https://patch.msgid.link/20260506115701.23035-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 36770417153644bc88281c7284730ef1d14d8d3c Author: Xiaolei Wang Date: Mon May 18 15:34:05 2026 +0800 misc: rp1: Send IACK on IRQ activate to fix kdump/kexec After a kexec/kdump reboot, the macb Ethernet controller fails to receive any packets, causing DHCP to hang indefinitely and the network interface to be unusable despite link being up. The root cause is that RP1's level-triggered MSI-X interrupt sources (such as macb on hwirq 6) may have their internal state machines stuck in the "waiting for IACK" state. This happens because the previous kernel crashed before sending the acknowledgment for a pending level interrupt. In this stuck state, RP1 will not generate new MSI-X writes even though the interrupt source remains asserted. Since no new MSI-X is sent, the GIC never sees a new edge, the chained IRQ handler is never invoked, and the interrupt is permanently lost. Fix this by sending MSIX_CFG_IACK in rp1_irq_activate(). This unconditionally resets the MSI-X state machine back to idle when a child device requests its interrupt. If the interrupt source is still asserted, RP1 will immediately issue a new MSI-X with the freshly configured msg_addr/msg_data, and normal interrupt delivery resumes. Writing IACK when the state machine is already idle (i.e., on a normal cold boot) is harmless — it has no effect. Fixes: 49d63971f963 ("misc: rp1: RaspberryPi RP1 misc driver") Cc: stable Signed-off-by: Xiaolei Wang Link: https://patch.msgid.link/20260518073405.2115003-1-xiaolei.wang@windriver.com Signed-off-by: Greg Kroah-Hartman commit 2eae90a457baa0048a96ed38ad93090ee38c8b2f Author: Hongling Zeng Date: Mon May 18 10:29:39 2026 +0800 gpib: cb7210: Fix region leak when request_irq fails When request_irq() fails, the region allocated by request_region() is not released. Fix this by adding an error handling path with proper goto labels to release the region. Fixes: e9dc69956d4d ("staging: gpib: Add Computer Boards GPIB driver") Closes: https://lore.kernel.org/oe-kbuild-all/202605160620.ReBOadPX-lkp@intel.com/ Signed-off-by: Hongling Zeng Cc: stable Link: https://patch.msgid.link/20260518022939.16881-1-zenghongling@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit ef15ccbb3e8640a723c42ad90eaf81d66ae02017 Author: Ben Hutchings Date: Tue May 5 20:45:12 2026 +0200 parport: Fix race between port and client registration The parport subsystem registers port devices before they are fully initialised, resulting in a race condition where client drivers such as lp can attach to ports that are not completely initialised or even being torn down. When the port and client drivers are built as modules and loaded around the same time during boot, this occasionally results in a crash. I was able to make this happen reliably in a VM with a PC-style parallel port by patching parport_pc to fail probing: > --- a/drivers/parport/parport_pc.c > +++ b/drivers/parport/parport_pc.c > @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base, > if (!p) > goto out3; > > - base_res = request_region(base, 3, p->name); > + base_res = NULL; > if (!base_res) > goto out4; > and then running: while true; do modprobe lp & modprobe parport_pc wait rmmod lp parport_pc done for a few seconds. In the long term I think port registration should be changed to put the call to device_add() inside parport_announce_port(), but since the latter currently cannot fail this will require changing all port drivers. For now, add a flag to indicate whether a port has been "announced" and only try to attach client drivers to ports when the flag is set. Fixes: 6fa45a226897 ("parport: add device-model to parport subsystem") Closes: https://bugs.debian.org/1130365 Closes: https://lore.kernel.org/all/6ba903ad-9897-42bb-8c2d-337385cc3746@molgen.mpg.de/ Cc: stable Signed-off-by: Ben Hutchings Acked-by: Sudip Mukherjee Link: https://patch.msgid.link/afo6uBv68GDevbMD@decadent.org.uk Signed-off-by: Greg Kroah-Hartman commit f74c8696f14149d5e43cc28b015326a759c48f00 Author: Guangshuo Li Date: Tue May 5 23:02:56 2026 +0800 uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in probe(), but then calls kfree(udev) both on the probe() error path (label out_free) and again in remove(). Because devm_kzalloc() allocations are devres-managed and are freed automatically when the device is detached (including after a failing probe() and during driver unbind), the explicit kfree() can lead to a double free. If probe() fails after devm_kzalloc(), the error path frees udev and devres cleanup will free it again when the core unwinds the partially bound device. On normal driver removal, remove() frees udev and devres will free it again when the device is detached. This issue was identified by a static analysis tool I developed and confirmed by manual review. Fix by removing the manual kfree() calls and dropping the now-unused label. Fixes: 3397c3cd859a2 ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c") Cc: stable Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260505150256.614071-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman commit c2ff4764e03e7a8d758352f4aceb8fe1be6ac971 Author: Zeng Heng Date: Thu May 21 15:30:11 2026 +0800 arm64: tlb: Flush walk cache when unsharing PMD tables When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the aarch64 tlb_flush() only checked tlb->freed_tables to determine whether to use TLBF_NONE (vae1is, invalidates walk cache) or TLBF_NOWALKCACHE (vale1is, leaf-only). This caused the stale PMD page table entry to remain in the walk cache after unshare, potentially leading to incorrect page table walks. Fix by including unshared_tables in the check, so that when unsharing tables, TLBF_NONE is used and the walk cache is properly invalidated. Here is the detailed distinction between vae1is and vale1is: | Instruction Combination | Actual Invalidation Scope | | ------------------------ | --------------------------------------------------| | `VAE1IS` + TTL=`0` | All entries at all levels (full invalidation) | | `VAE1IS` + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 | | `VALE1IS` + TTL=`0` | Leaf entries at all levels (non-leaf not cleared) | | `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only | Signed-off-by: Zeng Heng Fixes: 8ce720d5bd91 ("mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather") Cc: Signed-off-by: Catalin Marinas commit f6d8fea9e3953151a4adb4f603503dc3dc9c69da Author: Matthew Maurer Date: Fri Apr 3 18:18:58 2026 +0000 rust_binder: Avoid holding lock when dropping delivered_death In 6c37bebd8c926, we switched to looping over the list and dropping each individual node, ostensibly without the lock held in the loop body. If the kernel were using Rust Edition 2024, the comment would be accurate, and the lock would not be held across the drop. However, the kernel is currently using 2021, so tail expression lifetime extension results in the lock being held across the drop. Explicitly binding the expression result to a variable makes the lockguard no longer part of a tail expression, causing the lock to be dropped before entering the loop body. This was detected via `CONFIG_PROVE_LOCKING` identifying an invalid wait context at the drop site. Reported-by: David Stevens Signed-off-by: Matthew Maurer Cc: stable Fixes: 6c37bebd8c92 ("rust_binder: avoid mem::take on delivered_deaths") Reviewed-by: Alice Ryhl Acked-by: Carlos Llamas Link: https://patch.msgid.link/20260403-lockhold-v1-1-c332b56cd8ae@google.com Signed-off-by: Greg Kroah-Hartman commit 4c19719eb8b8df08c5bec7c499f73ddaea6f09fc Author: Alice Ryhl Date: Tue Apr 14 12:02:34 2026 +0000 rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN When an outdated transaction is removed from `oneway_todo` due to `TF_UPDATE_TXN`, its `Allocation` is dropped. The current implementation of `Allocation::drop` calls `pending_oneway_finished()`, assuming the transaction was executed. This leads to premature execution of the next queued one-way transaction. Fix this by taking the `oneway_node` from the `Allocation` of the outdated transaction before it is dropped. This prevents `Allocation::drop` from signaling completion. We do not call `take_oneway_node()` from `Transaction::cancel` because it's actually correct to call `pending_oneway_finished()` on cancel if the transaction did not come from `oneway_todo`. This ensures that if `BINDER_THREAD_EXIT` is invoked and cancels a oneway transaction, then the next transaction is taken from `oneway_todo`. This bug does not lead to any issues in the kernel, but may lead to Binder delivering transactions to userspace earlier than userspace expected to receive them. Cc: stable Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Assisted-by: Antigravity:gemini Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Link: https://patch.msgid.link/20260414-tf-update-txn-fix-v1-1-d2b83303acc9@google.com Signed-off-by: Greg Kroah-Hartman commit e4240d8845445d58b4b96f7066adfe175a61bd0c Author: Maciej W. Rozycki Date: Wed May 6 23:42:56 2026 +0100 serial: dz: Enable modular build Enable modular build since the driver now has a proper module_exit() handler. There's nothing specific to DZ hardware to prevent driver unloading and reloading from working. Signed-off-by: Maciej W. Rozycki Link: https://patch.msgid.link/alpine.DEB.2.21.2605062331420.46195@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman commit 7cac59d08a73cb866ec51a483a6f3fe0f531947c Author: Maciej W. Rozycki Date: Wed May 6 23:42:52 2026 +0100 serial: zs: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to mono frame buffer device 160x64 fb0: PMAG-AA frame buffer device at tc0 DECstation Z85C30 serial driver version 0.10 CPU 0 Unable to handle kernel paging request at virtual address 0000002c, epc == 803ab00c, ra == 803aafe0 Oops[#1]: CPU: 0 PID: 1 Comm: swapper Not tainted 6.4.0-rc3-00031-g84a9582fd203-dirty #57 $ 0 : 00000000 10012c00 803aaeb0 00000000 $ 4 : 80e12f60 80e12f50 80e12f58 81000030 $ 8 : 00000000 805ff37c 00000000 33433538 $12 : 65732030 00000006 80c2915d 6c616972 $16 : 80e12f00 807b7630 00000000 00000000 $20 : 00000004 00000348 000001a0 807623b8 $24 : 00000018 00000000 $28 : 80c24000 80c25d60 8078b148 803aafe0 Hi : 00000000 Lo : 00000000 epc : 803ab00c serial_base_ctrl_add+0x78/0xf4 ra : 803aafe0 serial_base_ctrl_add+0x4c/0xf4 Status: 10012c03 KERNEL EXL IE Cause : 00000008 (ExcCode 02) BadVA : 0000002c PrId : 00000440 (R4400SC) Modules linked in: Process swapper (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000) Stack : 80760000 00000cc0 00400044 00400040 803aa02c 80d61ab8 00000000 807b7630 80760000 807623b8 807b7628 803aa644 80386998 00000000 80e17780 80220f68 80e17780 80d61ab8 80c17d80 80e17780 80e17780 8063c798 80e17780 80383fa0 00000010 80e17780 00000000 80386998 807a0000 00000000 00400040 8038f848 807623b8 80d61ab8 00000004 80e17780 00000000 803a68e4 80c25e2c 803bb884 ... Call Trace: [<803ab00c>] serial_base_ctrl_add+0x78/0xf4 [<803aa644>] serial_core_register_port+0x174/0x69c [<8077e9ac>] zs_init+0xc8/0xfc [<800404d4>] do_one_initcall+0x40/0x2ac [<8076cecc>] kernel_init_freeable+0x1e4/0x270 [<80605bec>] kernel_init+0x20/0x108 [<800431e8>] ret_from_kernel_thread+0x14/0x1c Code: 2442aeb0 ae120024 ae0200d0 <8c67002c> 50e00001 8c670000 3c06806e 3c05806e afb30010 ---[ end trace 0000000000000000 ]--- (report at the offending commit) -- where a pointer is dereferenced that has been derived from a null pointer to the port's parent device. Since no device is available with legacy probing and it's not anymore a preferable way to discover devices anyway, switch the driver to using a platform device and use it as the port's parent device. Update resource handling accordingly and only request the actual span of addresses used within the slot, which will have had its resource already requested by generic platform device code. Use platform_driver_probe() not just because SCC devices are fixed with solder on board and not straightforward to remove, but foremost because the associated TTY's major device number is the same as used by the dz driver and the first driver to claim it will prevent the other one from using it. Either one DZ device or some SCC devices will be present in a given system but never both at a time, and therefore we want the major device number to be claimed by the first driver to actually successfully bind to its device and platform_driver_probe() is a way to fulfil that. An unfortunate consequence of the switch to a platform device is we now hand the console over from the bootconsole much later in the bootstrap. The firmware console handler appears good enough though to work so late and in particular with interrupts enabled. Since there is one way only remaining to reach zs_reset() now, remove the port initialisation marker as no longer needed and go through the channel reset unconditionally. Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM") Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org # needs to use .remove_new for <= 6.10 Link: https://patch.msgid.link/alpine.DEB.2.21.2605062328480.46195@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman commit 5d7a49d60b8fda66da60e240fd7315232fa1754f Author: Maciej W. Rozycki Date: Wed May 6 23:42:48 2026 +0100 serial: dz: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to colour frame buffer device 160x64 tgafb: SFB+ detected, rev=0x02 fb0: Digital ZLX-E1 frame buffer device at 0x1e000000 DECstation DZ serial driver version 1.04 CPU 0 Unable to handle kernel paging request at virtual address 000000bc, epc == 8048b3a4, ra == 80470a78 Oops[#1]: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0-dirty #35 NONE $ 0 : 00000000 1000ac00 00000004 804707ac $ 4 : 00000000 80e20850 80e20858 81000030 $ 8 : 00000000 8072c81c 00000008 fefefeff $12 : 6c616972 00000006 80c5917f 69726420 $16 : 80e20800 00000000 808f8968 80e20800 $20 : 00000000 807f5a90 808b0094 808d3bc8 $24 : 00000018 80479030 $28 : 80c2e000 80c2fd70 00000069 80470a78 Hi : 00000004 Lo : 00000000 epc : 8048b3a4 __dev_fwnode+0x0/0xc ra : 80470a78 serial_base_ctrl_add+0xa0/0x168 Status: 1000ac04 IEp Cause : 30000008 (ExcCode 02) BadVA : 000000bc PrId : 00000220 (R3000) Modules linked in: Process swapper/0 (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000) Stack : 00400044 00400040 8046f4cc 00000000 808a6148 808a0000 808f8968 8086983c 808e0000 8046fc84 1000ac01 00000028 80e20700 802ba3f8 80e20700 80d34a94 80c1b900 80e20700 80e20700 80e20700 80e20700 80444650 00000000 00000000 00000000 807f5a90 808b0094 80447080 00400040 808e0000 80d34a94 808a6148 80d34a94 00000004 80e20700 00000000 8076974c 80469810 80c2fe3c 1000ac01 ... Call Trace: [<8048b3a4>] __dev_fwnode+0x0/0xc [<80470a78>] serial_base_ctrl_add+0xa0/0x168 [<8046fc84>] serial_core_register_port+0x1c8/0x974 [<808c6af0>] dz_init+0x74/0xc8 [<800470e0>] do_one_initcall+0x44/0x2d4 [<808b111c>] kernel_init_freeable+0x258/0x308 [<8072e434>] kernel_init+0x20/0x114 [<80049cd0>] ret_from_kernel_thread+0x14/0x1c Code: 27bd0018 03e00008 2402ffea <8c8200bc> 03e00008 00000000 27bdffc0 afbe0038 afb30024 ---[ end trace 0000000000000000 ]--- -- where a pointer is dereferenced that has been derived from a null pointer to the port's parent device. Since no device is available with legacy probing and it's not anymore a preferable way to discover devices anyway, switch the driver to using a platform device and use it as the port's parent device. Update resource handling accordingly and only request the actual span of addresses used within the slot, which will have had its resource already requested by generic platform device code. Use platform_driver_probe() not just because the DZ device is fixed with solder on board and not straightforward to remove, but foremost because the associated TTY's major device number is the same as used by the zs driver and the first driver to claim it will prevent the other one from using it. Either one DZ device or some SCC devices will be present in a given system but never both at a time, and therefore we want the major device number to be claimed by the first driver to actually successfully bind to its device and platform_driver_probe() is a way to fulfil that. An unfortunate consequence of the switch to a platform device is we now hand the console over from the bootconsole much later in the bootstrap. The firmware console handler appears good enough though to work so late and in particular with interrupts enabled. Conversely only starting the console port so late lets the reset code fully utilise our delay handlers, so switch from udelay() to fsleep() for transmitter draining so as to avoid busy-waiting for an excessive amount of time. Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM") Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org # needs to use .remove_new for <= 6.10 Link: https://patch.msgid.link/alpine.DEB.2.21.2605062326540.46195@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman commit 8572955630f30948837088aa98bcbe0532d1ceac Author: Maciej W. Rozycki Date: Wed May 6 23:42:43 2026 +0100 serial: zs: Switch to using channel reset Switch the driver to using the channel reset rather than hardware reset, simplifying handling by removing an interference between channels that causes the other channel to become uninitialised afterwards. There is little difference between the two kinds of reset in terms of register settings that result, and we initialise the whole register set right away anyway. However this prevents a hang from happening should the console output handler in the firmware try to access the other port whose transmitter has been disabled and line parameters messed up. For example this will happen if the keyboard port (port A) is chosen for the system console, unusually but not insanely for a headless system, as the port is wired to a standard DA-15 connector and an adapter can be easily made. Or with the next change in place this would happen for the regular console port (port B), since the keyboard port (port A) will be initialised first. Just remove the unnecessary complication then, a channel reset is good enough. We still need the initialisation marker, now per channel rather than per SCC, as for the console port zs_reset() will be called twice: once early on via zs_serial_console_init() for the console setup only, and then again via zs_config_port() as the port is associated with a TTY device. Fixes: 8b4a40809e53 ("zs: move to the serial subsystem") Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org # v2.6.23+ Link: https://patch.msgid.link/alpine.DEB.2.21.2605062323430.46195@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman commit 6c05cf72e13314ce9b770b5951695dc5a2152920 Author: Maciej W. Rozycki Date: Wed May 6 23:42:39 2026 +0100 serial: zs: Fix bootconsole handover lockup Calling zs_reset() in the course of setting up the serial device causes line parameters to be reset and the transmitter disabled. We've been lucky in that no message is usually produced to the kernel log between this call and the later call to uart_set_options() in the course of console setup done by zs_serial_console_init(), or the system would hang as the console output handler in the firmware tried to access a port the transmitter of which has been disabled and line parameters messed up. This will change with the next change to the driver, so fix zs_reset() such that line parameters are set for 9600n8 console operation as with the system firmware and the transmitter re-enabled after reset. This also means zs_pm() serves no purpose anymore, so drop it. Fixes: 8b4a40809e53 ("zs: move to the serial subsystem") Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org # v2.6.23+ Link: https://patch.msgid.link/alpine.DEB.2.21.2605062308040.46195@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman commit 7f127b2208e5e2b817243cad41fe4211a6d5a7a3 Author: Maciej W. Rozycki Date: Wed May 6 23:42:35 2026 +0100 serial: dz: Fix bootconsole handover lockup Calling dz_reset() in the course of setting up the serial device causes line parameters to be reset and the transmitter disabled. We've been lucky in that no message is usually produced to the kernel log between this call and the later call to uart_set_options() in the course of console setup done by dz_serial_console_init(), or the system would hang as the console output handler in the firmware tried to access a port the transmitter of which has been disabled and line parameters messed up. This will change with the next change to the driver, so fix dz_reset() such that line parameters are set for 9600n8 console operation as with the system firmware and the transmitter re-enabled after reset. This also means dz_pm() serves no purpose anymore, so drop it. Fixes: e6ee512f5a77 ("dz.c: Resource management") Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org # v2.6.25+ Link: https://patch.msgid.link/alpine.DEB.2.21.2605062302010.46195@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman commit ca904f4b42355287bc5ce8b7550ebe909cda4c2c Author: Maciej W. Rozycki Date: Wed May 6 23:42:31 2026 +0100 serial: dz: Fix bootconsole message clobbering at chip reset In the DZ interface as implemented by the DC7085 gate array the serial transmitters are double buffered, meaning that at the time a transmitter is ready to accept the next character there is one in the transmit shift register still being sent to the line. Issuing a master clear at this time causes this character to be lost, so wait an extra amount of time sufficient for the transmit shift register to drain at 9600bps, which is the baud rate setting used by the firmware console. Mind the specified 1.4us TRDY recovery time in the course and continue using iob() as the completion barrier, since the platforms involved use a write buffer that can delay and combine writes, and reorder them with respect to reads regardless of the MMIO locations accessed and we still lack a platform-independent handler for that. When called from dz_serial_console_init() this is too early for fsleep() to work and even before lpj has been calculated and therefore the delay is actually not sufficient for the transmitter to drain and is merely a placeholder now. This will be addressed in a follow-up change. Fixes: e6ee512f5a77 ("dz.c: Resource management") Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org # v2.6.25+ Link: https://patch.msgid.link/alpine.DEB.2.21.2605062259080.46195@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman commit 2e211723953f7740e54b53f3d3a0d5e351a5e223 Author: Jacques Nilo Date: Wed May 13 15:30:25 2026 +0200 serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() dw8250_handle_irq() calls serial8250_handle_irq_locked() with the port lock held via guard(uart_port_lock_irqsave). The guard destructor is plain uart_port_unlock_irqrestore(), so a SysRq character captured into port->sysrq_ch by uart_prepare_sysrq_char() is dropped without ever being dispatched to handle_sysrq(). This is the same regression pattern as in serial8250_handle_irq(), introduced when 883c5a2bc934 ("serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling") moved the function to the guard()-based locking scheme without using the sysrq-aware unlock helper. Switch to guard(uart_port_lock_check_sysrq_irqsave) so that captured sysrq_ch is dispatched on scope exit, matching the fix in serial8250_handle_irq(). Fixes: 883c5a2bc934 ("serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling") Cc: stable@vger.kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Jacques Nilo Link: https://patch.msgid.link/ed56fcaf4af24e4ed011a7bce206e0182acb761c.1778675349.git.jnilo@free.fr Signed-off-by: Greg Kroah-Hartman commit 71f42b2149a1307a97165b409493665579462ea0 Author: Jacques Nilo Date: Wed May 13 15:30:24 2026 +0200 serial: 8250: dispatch SysRq character in serial8250_handle_irq() serial8250_handle_irq() captures a SysRq character into port->sysrq_ch inside serial8250_handle_irq_locked() via uart_prepare_sysrq_char() (reached from serial8250_read_char()). Dispatch of that captured character to handle_sysrq() is expected to happen at port-unlock time, through uart_unlock_and_check_sysrq[_irqrestore](). After commit 8324a54f604d ("serial: 8250: Add serial8250_handle_irq_locked()") the function was reduced to a wrapper that takes the port lock via guard(uart_port_lock_irqsave) whose destructor is plain uart_port_unlock_irqrestore(). The sysrq-aware unlock helper is no longer called, so port->sysrq_ch is captured but never dispatched: BREAK + SysRq key is consumed silently. This was the very condition Johan Hovold's 853a9ae29e978 ("serial: 8250: fix handle_irq locking", 2021) introduced uart_unlock_and_check_sysrq_irqrestore() to address. Switch to the new guard(uart_port_lock_check_sysrq_irqsave), whose destructor is the sysrq-aware unlock helper, restoring the pre-split behaviour. Update the Context: comment on serial8250_handle_irq_locked() so future HW-specific 8250 wrappers know to use the same guard or the explicit sysrq-aware unlock. Verified on RTL8196E with CONFIG_MAGIC_SYSRQ_SERIAL=y: BREAK + 'h' on the console UART produces the SysRq help dump in dmesg and the brk counter in /proc/tty/driver/serial increments correctly. Fixes: 8324a54f604d ("serial: 8250: Add serial8250_handle_irq_locked()") Cc: stable@vger.kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Jacques Nilo Link: https://patch.msgid.link/52692ae6c3501f7940347cef364ad7fcacaab7e5.1778675349.git.jnilo@free.fr Signed-off-by: Greg Kroah-Hartman commit c3cce2e67bb22a223f5b8ef05db0fcde70994068 Author: Jacques Nilo Date: Wed May 13 15:30:23 2026 +0200 serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) uart_handle_break() and uart_prepare_sysrq_char() (in include/linux/serial_core.h) capture a SysRq character into port->sysrq_ch while the port lock is held and rely on the unlock helper -- uart_unlock_and_check_sysrq_irqrestore() -- to dispatch the captured character to handle_sysrq() on scope exit. The existing guard(uart_port_lock_irqsave) cannot be used by IRQ handlers that process RX, because its destructor calls plain uart_port_unlock_irqrestore() and silently drops port->sysrq_ch. Add a dedicated guard(uart_port_lock_check_sysrq_irqsave) variant whose destructor is the sysrq-aware unlock helper. The lock side is identical to uart_port_lock_irqsave -- only the unlock-time behaviour differs. Callers that may capture SysRq characters must use guard(uart_port_lock_check_sysrq_irqsave); the existing guard(uart_port_lock_irqsave) keeps its current plain-unlock semantics for the many callers that do not process RX. The new macro is placed after the CONFIG_MAGIC_SYSRQ_SERIAL block so both definitions of uart_unlock_and_check_sysrq_irqrestore() (sysrq enabled and disabled) are visible at expansion time. When CONFIG_MAGIC_SYSRQ_SERIAL=n the destructor degenerates to plain uart_port_unlock_irqrestore(), so there is no overhead. No functional change on its own; users are converted in the following patches. Cc: stable@vger.kernel.org Signed-off-by: Jacques Nilo Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/3849af4bc55d5d2a424fa850844e94d641b2f8a6.1778675349.git.jnilo@free.fr Signed-off-by: Greg Kroah-Hartman commit a3bb136bff5e6a5e48cdd813246c9c4686feaaa9 Author: Tudor Ambarus Date: Fri May 15 12:41:21 2026 +0000 tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged [1]. When console flow control is enabled (UPF_CONS_FLOW), s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable(). The serial core framework invokes the .stop_tx() and .start_tx() callbacks with the port->lock spinlock already held. Furthermore, all internal driver paths that invoke stop_tx (such as the DMA TX completion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ handler s3c24xx_serial_tx_irq()) also acquire port->lock prior to calling it. (Note that s3c24xx_serial_start_tx() is only invoked by the serial core). However, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() unconditionally attempt to acquire port->lock again using uart_port_lock_irqsave(). Since spinlocks are not recursive, this causes a deadlock on the same CPU when console flow control is engaged. Remove the redundant lock acquisition from both rx helper functions. Cc: stable Fixes: b497549a035c ("[ARM] S3C24XX: Split serial driver into core and per-cpu drivers") Reported-by: John Ogness Closes: https://sashiko.dev/#/patchset/20260506121606.5805-1-john.ogness%40linutronix.de [1] Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260515-samsung-tty-flow-control-deadlock-v1-1-93255edbc9bc@linaro.org Signed-off-by: Greg Kroah-Hartman commit ea66be25f0e934f49d24cd0c5845d13cdba3520b Author: Myeonghun Pak Date: Tue May 12 15:56:57 2026 +0900 serial: altera_jtaguart: handle uart_add_one_port() failures altera_jtaguart_probe() maps the register window before registering the UART port, but it ignores failures from uart_add_one_port(). If port registration fails, probe still returns success and the mapping remains live until a later remove path that is not part of probe failure cleanup. Return the uart_add_one_port() error and unmap the register window on that failure path. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 5bcd601049c6 ("serial: Add driver for the Altera JTAG UART") Cc: stable Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Link: https://patch.msgid.link/20260512065837.79528-1-mhun512@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5eb070769ea5e18405535609d1d3f6886f3755bd Author: Wentao Guan Date: Fri May 22 17:13:58 2026 +0800 USB: cdc-acm: Fix bit overlap and move quirk definitions to header The VENDOR_CLASS_DATA_IFACE and ALWAYS_POLL_CTRL quirk flags added in commit f58752ebcb35 ("USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen") were placed inside the acm_ctrl_msg() function rather than in the header with the other quirk flags. Then, their values (BIT(9) and BIT(10)) collided with NO_UNION_12 which is already BIT(9). Move the definitions to drivers/usb/class/cdc-acm.h where they belong and shift them to BIT(10) and BIT(11) to avoid the overlap. Fixes: f58752ebcb35 ("USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen") Cc: stable Signed-off-by: Wentao Guan Link: https://patch.msgid.link/20260522091357.1301196-1-guanwentao@uniontech.com Signed-off-by: Greg Kroah-Hartman commit 9029496abfae3c208336855ae6f3e1f5f881ef76 Author: Claudio Imbrenda Date: Tue May 19 17:01:14 2026 +0200 KVM: s390: Properly reset zero bit in PGSTE In case of memory pressure, it's possible that a guest page gets freed and then almost immediately reused by the guest. If CMMA is enabled, _essa_clear_cbrl() will discard all pages that are either unused or zero. If a discarded page is reused before _essa_clear_cbrl() is called, and the pgste.zero bit is not cleared, the page will be discarded despite not being unused. When calling _gmap_ptep_xchg(), always clear the pgste.zero bit. This prevents the page from being accidentally discarded when not unused. Signed-off-by: Claudio Imbrenda Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Reviewed-by: Steffen Eiden Signed-off-by: Christian Borntraeger commit a488e753de5853bec2e2e4d0c5a73f25d464bd2e Author: Claudio Imbrenda Date: Tue May 19 17:01:13 2026 +0200 KVM: s390: vsie: Fix redundant rmap entries The address passed to the gmap rmap was not being masked. As a consequence several different (but functionally equivalent) rmap entries were being created for each shadowed table. Fix this by properly masking the address depending on the table level. Signed-off-by: Claudio Imbrenda Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Reviewed-by: Christian Borntraeger Signed-off-by: Christian Borntraeger commit 2d505c290667eba67352c5db303ec92b7de860ad Author: Claudio Imbrenda Date: Tue May 19 17:01:12 2026 +0200 KVM: s390: vsie: Fix unshadowing logic In some cases (i.e. under extreme memory pressure on the host), attempting to shadow memory will result in the same memory being unshadowed, causing a loop. Add a PGSTE bit to distinguish between shadowed memory and shadowed DAT tables, fix the unshadowing logic in _gmap_ptep_xchg() to prevent unnecessary unshadowing and perform better checks. Also fix the unshadowing logic in _gmap_crstep_xchg_atomic() which did not unshadow properly when the large page would become unprotected. Opportunistically add a check in gmap_protect_rmap() to make sure it won't be called with level == TABLE_TYPE_PAGE_TABLE. Signed-off-by: Claudio Imbrenda Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Reviewed-by: Christian Borntraeger Signed-off-by: Christian Borntraeger commit 4df4b7cdf54620aa848e7d83d253bb944313f7bd Author: Claudio Imbrenda Date: Tue May 19 17:01:11 2026 +0200 KVM: s390: Fix leaking kvm_s390_mmu_cache in case of errors Fix a memory leak that can happen if gmap_ucas_map_one() or kvm_s390_mmu_cache_topup() return error values. Also fix a similar issue in gmap_set_limit(). Signed-off-by: Claudio Imbrenda Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Reported-by: Jiaxin Fan Reviewed-by: Christian Borntraeger Signed-off-by: Christian Borntraeger commit d0f2eb4493d1c3c8fecb5eadb5c1382074873ef9 Author: Claudio Imbrenda Date: Tue May 19 17:01:10 2026 +0200 KVM: s390: vsie: Fix memory leak when unshadowing When performing a partial unshadowing, the rmap was being leaked. Add the missing kfree(). Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Signed-off-by: Claudio Imbrenda Reviewed-by: Christoph Schlameuss Reviewed-by: Christian Borntraeger Signed-off-by: Christian Borntraeger commit 9ea06a3fbf9f16e0d98c52cb3b99642be15ec281 Author: Dan Carpenter Date: Wed May 20 08:59:28 2026 +0300 usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usb_hcd_giveback_urb() so save the urb->status ahead of time. Fixes: 7359d482eb4d ("staging: HCD files for the DWC2 driver") Cc: stable Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/ag1NwBpqT4IEQcdJ@stanley.mountain Signed-off-by: Greg Kroah-Hartman commit 8f6aa392653e52a45858cff5c063df550028836b Author: Xu Yang Date: Mon Apr 27 15:57:55 2026 +0800 usb: chipidea: core: convert ci_role_switch to local variable When a system contains multiple USB controllers, the global ci_role_switch variable may be overwritten by subsequent driver initialization code. This can cause issues in the following cases: - The 2nd ci_hdrc_probe() sees ci_role_switch.fwnode as non-NULL even though the "usb-role-switch" property is not present for the controller. - When the ci_hdrc device is unbound and bound again, ci_role_switch fwnode will not be reassigned, and the old value will be used instead. Convert ci_role_switch to a local variable to fix these issues. Fixes: 05559f10ed79 ("usb: chipidea: add role switch class support") Cc: stable Acked-by: Peter Chen Reviewed-by: Frank Li Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260427075755.3611217-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 2796646f6d892c1eb6818c7ca41fdfa12568e8d1 Author: Michael Bommarito Date: Sun Apr 19 12:12:27 2026 -0400 usb: gadget: f_fs: serialize DMABUF cancel against request completion ffs_epfile_dmabuf_io_complete() calls usb_ep_free_request() on the completed request but leaves priv->req, the back-pointer that ffs_dmabuf_transfer() set on submission, pointing at the freed memory. A later FUNCTIONFS_DMABUF_DETACH ioctl or ffs_epfile_release() on the close path still sees priv->req non-NULL under ffs->eps_lock: if (priv->ep && priv->req) usb_ep_dequeue(priv->ep, priv->req); so usb_ep_dequeue() is called on a freed usb_request. On dummy_hcd the dequeue path only walks a live queue and pointer-compares, so the freed pointer reads without faulting and KASAN requires an explicit check at the FunctionFS call site to surface the use-after-free. On SG-capable in-tree UDCs the dequeue path dereferences the supplied request immediately: * chipidea's ep_dequeue() does container_of(req, struct ci_hw_req, req) and reads hwreq->req.status before acquiring its own lock. * cdnsp's cdnsp_gadget_ep_dequeue() reads request->status first. The narrower option of clearing priv->req via cmpxchg() in the completion does not close the race: the completion runs without eps_lock, so a cancel path holding eps_lock can still observe priv->req non-NULL, race a concurrent completion that clears and frees, and pass the freed pointer to usb_ep_dequeue(). A slightly longer fix that moves the free into the cleanup work is needed. Same class of lifetime race as the recent usbip-vudc timer fix [1]. Take eps_lock in the sole place that mutates priv->req from the callback direction by moving usb_ep_free_request() out of the completion into ffs_dmabuf_cleanup(), the existing work handler scheduled by ffs_dmabuf_signal_done() on ffs->io_completion_wq. Clear priv->req there under eps_lock before freeing, and only clear if priv->req still names our request (a subsequent ffs_dmabuf_transfer() on the same attachment may have queued a new one). This keeps the existing dummy_hcd sync-dequeue invariant: the completion callback is still invoked by the UDC without eps_lock held (dummy_hcd drops its own lock before calling the callback), and the callback now takes no f_fs lock at all. Serialization against the cancel path happens in cleanup, which runs from the workqueue with no f_fs lock held on entry. The priv ref count protects the containing ffs_dmabuf_priv: ffs_dmabuf_transfer() takes a ref via ffs_dmabuf_get(), cleanup drops it via ffs_dmabuf_put(), so priv stays live for the cleanup even after the cancel path's list_del + ffs_dmabuf_put. The ffs_dmabuf_transfer() error path no longer frees usb_req inline: fence->req and fence->ep are set before usb_ep_queue(), so ffs_dmabuf_cleanup() (scheduled by the error-path ffs_dmabuf_signal_done()) owns the free regardless of whether the queue succeeded. Reproduced under KASAN on both detach and close paths against dummy_hcd with an observability hook (kasan_check_byte(priv->req) immediately before usb_ep_dequeue) at the two FunctionFS cancel sites to surface the stale-pointer access; the hook is not part of this patch. The KASAN allocator / free stacks in the captured splats identify the same request: alloc in dummy_alloc_request, free in dummy_timer, fault reached from ffs_epfile_release (close) and from the FUNCTIONFS_DMABUF_DETACH ioctl (detach). With the patch applied, both paths are silent under the same hook. The bug is reached from the FunctionFS device node, which in real deployments is owned by the privileged gadget daemon (adbd, UMS, composite gadget services, etc.); it is not reachable from unprivileged userspace or from a USB host on the cable. FunctionFS mounts default to GLOBAL_ROOT_UID, but the filesystem supports uid=, gid=, and fmode= delegation to a non-root gadget daemon, so on real deployments the attacker may be a less-privileged service rather than root. Fixes: 7b07a2a7ca02 ("usb: gadget: functionfs: Add DMABUF import interface") Link: https://lore.kernel.org/all/20260417163552.807548-1-michael.bommarito@gmail.com/ [1] Cc: stable Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260419161227.1587668-1-michael.bommarito@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4e036c10e7f4df5d951c69cc3697bc8e209c6d02 Author: Michael Bommarito Date: Sun Apr 19 12:03:59 2026 -0400 usb: gadget: f_fs: copy only received bytes on short ep0 read ffs_ep0_read() allocates its control-OUT data buffer with kmalloc() (not kzalloc) at the Length value from the Setup packet, then copies that full len to userspace regardless of how many bytes were actually received: data = kmalloc(len, GFP_KERNEL); ... ret = __ffs_ep0_queue_wait(ffs, data, len); if ((ret > 0) && (copy_to_user(buf, data, len))) ret = -EFAULT; __ffs_ep0_queue_wait() returns req->actual, which on a short control OUT transfer is strictly less than len. The copy_to_user() call still copies len bytes, so on a short OUT the last (len - ret) bytes of the kmalloc() buffer -- uninitialised slab residue -- are delivered to the FunctionFS daemon. Short ep0 OUT completions are specified USB control-transfer behavior and are produced by in-tree UDCs: * dwc2 continues on req->actual < req->length for ep0 DATA OUT (short-not-ok is the only ep0-OUT stall path). * aspeed_udc ends ep0 OUT on rx_len < ep->ep.maxpacket. * renesas_usbf logs "ep0 short packet" and completes the request. * dwc3 stalls on short IN but not on short OUT. A short ep0 OUT is therefore not evidence of a broken UDC; it is a normal condition f_fs has to cope with. The sibling gadgetfs implementation in drivers/usb/gadget/legacy/inode.c already does this correctly via min(len, dev->req->actual) before copy_to_user(). This patch brings f_fs.c to the same safe pattern rather than trimming at a defensive layer. The bug is reached from the FunctionFS device node, which in real deployments is owned by the privileged gadget daemon (adbd, UMS, composite gadget services, etc.); it is not reachable from unprivileged userspace. Linux host stacks normally reject short-wLength control OUTs before they reach the gadget, so reproducing this required a build that bypasses that host-side check. With the bypass in place, a 1-byte payload on a 64-byte Setup produces 63 bytes of non-canary slab residue in the daemon's read buffer. Fix by copying only ret (actually received) bytes to userspace. Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver") Cc: stable Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260419160359.1577270-1-michael.bommarito@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7d9633528dd40e33964d2dc74a5abbf5c4d116ce Author: Seungjin Bae Date: Mon May 18 19:43:14 2026 -0400 usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports The `dummy_hub_control()` function handles USB hub class requests to the virtual root hub. The `GetPortStatus` case returns -EPIPE for requests with `wIndex != 1`, since the virtual root hub has only a single port. However, the `ClearPortFeature` and `SetPortFeature` cases lack the same check. Fix this by extending the `wIndex != 1` rejection to both cases, matching the existing behavior of `GetPortStatus`. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Suggested-by: Alan Stern Signed-off-by: Seungjin Bae Reviewed-by: Alan Stern Link: https://patch.msgid.link/20260518234314.1889396-1-eeodqql09@gmail.com Signed-off-by: Greg Kroah-Hartman commit f1ecb0e563595d4ba9a3b8e39ed52a3dc2d8e328 Author: Hang Cao Date: Wed Apr 15 14:42:38 2026 +0800 dt-bindings: usb: Fix EIC7700 USB reset's issue The EIC7700 USB requires a USB PHY reset operation; otherwise, the USB will not work. The reason why the USB driver that was applied can work properly is that the USB PHY has already been reset in ESWIN's U-Boot. However, the proper functioning of the USB driver should not be dependent on the bootloader. Therefore, it is necessary to incorporate the USB PHY reset signal into the DT bindings. This patch does not introduce any backward incompatibility since the dts is not upstream yet. As array of reset operations are used in the driver, no modifications to the USB controller driver are needed. Fixes: c640a4239db5 ("dt-bindings: usb: Add ESWIN EIC7700 USB controller") Cc: stable Signed-off-by: Hang Cao Acked-by: Conor Dooley Link: https://patch.msgid.link/20260415064238.1784-1-caohang@eswincomputing.com Signed-off-by: Greg Kroah-Hartman commit d96209626a29ea64666be98c30b30ac82e5f1be6 Author: Michael Bommarito Date: Fri Apr 17 12:35:52 2026 -0400 usbip: vudc: Fix use after free bug in vudc_remove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudc_remove(). The original thread stalled on Shuah Khan's request for runtime testing of the unplug/unbind path. This patch supplies that testing and keeps Zheng's original fix shape. In vudc_probe(), v_init_timer() binds udc->tr_timer.timer to v_timer(). usbip_sockfd_store() starts the timer via v_start_timer()/v_kick_timer(). vudc_remove() can then free the containing struct vudc while the timer is still pending or executing. KASAN confirms the race on an unpatched x86_64 QEMU guest with CONFIG_KASAN=y, CONFIG_USBIP_VUDC=y, CONFIG_USB_ZERO=y, and a tight loop that repeatedly writes a socket fd to usbip_sockfd, closes the socket pair, and unbinds/rebinds usbip-vudc.0: BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x8ba/0x8e0 Write of size 8 at addr ffff888001b80740 by task trigger_and_unb/239 Allocated by task 239: vudc_probe+0x4d/0xaa0 Freed by task 239: kfree+0x18f/0x520 device_release_driver_internal+0x388/0x540 unbind_store+0xd9/0x100 This lands in the timer core rather than v_timer() itself because the embedded timer_list is being walked after its containing struct vudc has already been freed. The underlying lifetime bug is the same one Zheng reported. With v_stop_timer() called from vudc_remove() and the timer deleted synchronously, the same harness completed 5000 bind/unbind iterations with no KASAN report. Fixes: b6a0ca111867 ("usbip: vudc: Add UDC specific ops") Cc: stable Reported-by: Zheng Wang Closes: https://lore.kernel.org/linux-usb/20230317100954.2626573-1-zyytlz.wz@163.com/ Signed-off-by: Michael Bommarito Acked-by: Shuah Khan Link: https://patch.msgid.link/20260417163552.807548-1-michael.bommarito@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0b5bde9e1c4df3bbf93a01a0e00c05085f3449fd Author: Rob Herring (Arm) Date: Fri May 8 13:25:55 2026 -0500 dt-bindings: usb: ti,omap4-musb: Drop duplicate 'usb-phy' property constraints The deprecated 'usb-phy' property is documented already in usb.yaml and doesn't need a type definition here. It just needs constraints on how many entries there are. As this is a host controller, reference usb-hcd.yaml which then references usb.yaml. Fixes: 70fcdc82cf4a ("dt-bindings: usb: ti,omap4-musb: convert to DT schema") Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260508182556.1759173-1-robh@kernel.org Signed-off-by: Greg Kroah-Hartman commit b53ebb811e00be50a779ce4e7aee604178b4a825 Author: Sam Burkels Date: Fri May 1 15:23:46 2026 +0200 usb: storage: Add quirks for PNY Elite Portable SSD The PNY Elite Portable SSD (USB ID 154b:f009) is a sibling of the already-quirked PNY Pro Elite SSDs (154b:f00b and 154b:f00d). Like its siblings, it uses a Phison-based USB-SATA bridge that exhibits firmware bugs when bound to the uas driver. Without quirks, the device fails to complete READ CAPACITY commands when accessed over UAS on a SuperSpeed (USB 3) port. The device enumerates and reports as a SCSI direct-access device, but reports zero logical blocks and never finishes spin-up: usb 2-3: new SuperSpeed USB device number 8 using xhci_hcd usb 2-3: New USB device found, idVendor=154b, idProduct=f009 usb 2-3: Product: PNY ELITE PSSD usb 2-3: Manufacturer: PNY scsi host0: uas scsi 0:0:0:0: Direct-Access PNY PNY ELITE PSSD 0 sd 0:0:0:0: [sda] Spinning up disk... [...10+ seconds of polling, no progress...] sd 0:0:0:0: [sda] Read Capacity(16) failed: hostbyte=DID_ERROR sd 0:0:0:0: [sda] Read Capacity(10) failed: hostbyte=DID_ERROR sd 0:0:0:0: [sda] 0 512-byte logical blocks: (0 B/0 B) Tested each individual quirk to find the minimum that fixes this: - US_FL_NO_ATA_1X alone: device hangs on spin-up - US_FL_NO_REPORT_OPCODES alone: works on USB 2.0, hangs on USB 3.0 - US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES: works on both With both quirks the device enumerates correctly while still using the uas driver, and delivers full UAS throughput (~281 MB/s sequential read on a USB 3.0 Gen 1 port). The existing PNY Pro Elite entries (f00b, f00d) only set NO_ATA_1X, but this device additionally chokes on REPORT OPCODES under SuperSpeed. Signed-off-by: Sam Burkels Acked-by: Oliver Neukum Cc: stable Link: https://patch.msgid.link/20260501132346.86572-1-sam@1a38.nl Signed-off-by: Greg Kroah-Hartman commit 9ddb9c0deca48d2c2a22ebf4d2f35c925a520328 Author: Stephen J. Fuhry Date: Wed May 13 13:14:19 2026 -0400 USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers The Lenovo ThinkPad USB-C Dock Gen2 (17ef:a391, 17ef:a392) hub controllers exhibit link instability when USB Link Power Management is enabled, similar to the dock's Ethernet adapter (17ef:a387) which already carries USB_QUIRK_NO_LPM. When the dock reconnects after a transient disconnect, the hub controllers enter LPM states between re-enumeration retries, causing repeated disconnect/reconnect cycles lasting up to two minutes. Disabling LPM for these devices restores stable enumeration. Signed-off-by: Stephen J. Fuhry Cc: stable Link: https://patch.msgid.link/20260513171419.44849-1-fuhrysteve@gmail.com Signed-off-by: Greg Kroah-Hartman commit 121d2f682ba912b1427cddca7cf84840f41cc620 Author: Heitor Alves de Siqueira Date: Tue May 5 15:56:04 2026 -0300 usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize The USB488 subclass specification requires interrupt wMaxPacketSize to be 0x02, unless the device sends vendor-specific notifications. Endpoints that advertise less than 2 bytes for wMaxPacketSize are unlikely to work with the current driver, as URBs will not have enough space for interrupt headers. Considering that any notification URBs will be ignored by the driver, reject these endpoints early during probe. Fixes: 041370cce889 ("USB: usbtmc: refactor endpoint retrieval") Cc: stable Suggested-by: Michal Pecio Signed-off-by: Heitor Alves de Siqueira Link: https://patch.msgid.link/20260505-usbtmc-iin-size-v3-2-a36113f62db7@igalia.com Signed-off-by: Greg Kroah-Hartman commit 52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd Author: Heitor Alves de Siqueira Date: Tue May 5 15:56:03 2026 -0300 usb: usbtmc: check URB actual_length for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the driver does not check if these headers are present before accessing the data buffers. In cases where the URB actual_length is not enough to fit these headers, the driver will either cause an out-of-bounds read, or consume stale leftover data from a previous notification. Fix by checking if actual_data contains enough bytes for the headers, otherwise resubmit URB to the interrupt endpoint. Fixes: dbf3e7f654c0 ("Implement an ioctl to support the USMTMC-USB488 READ_STATUS_BYTE operation.") Reported-by: syzbot+abbfd103085885cf16a2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=abbfd103085885cf16a2 Cc: stable Suggested-by: Michal Pecio Signed-off-by: Heitor Alves de Siqueira Link: https://patch.msgid.link/20260505-usbtmc-iin-size-v3-1-a36113f62db7@igalia.com Signed-off-by: Greg Kroah-Hartman commit 5a4c828b8b29b47534814ade26d9aee09d5101fc Author: Wei-Cheng Chen Date: Tue May 5 19:26:30 2026 +0800 xhci: tegra: Fix ghost USB device on dual-role port unplug When a USB device is unplugged from the dual-role port, the device-mode path in tegra_xhci_id_work() explicitly clears both SS and HS port power via direct hub_control ClearPortFeature(POWER) calls. This preempts the xHCI controller's normal disconnect processing -- PORT_CSC is never generated, the USB core never sees the disconnect, and the device remains in its internal tree as a ghost visible in lsusb. Add an otg_set_port_power flag to control whether the dual-role switch path performs explicit port power management. SoCs that need it (Tegra124 / Tegra210 / Tegra186) set the flag; later SoCs (Tegra194 and beyond) rely on the PHY mode change to handle disconnect naturally and skip all port power calls. Within the port power path, otg_reset_sspi additionally gates the SSPI reset sequence on host-mode entry for SoCs that require it. Flags set per SoC: Tegra124, Tegra186 -> otg_set_port_power Tegra210 -> otg_set_port_power, otg_reset_sspi Tegra194 and later -> (none) Fixes: f836e7843036 ("usb: xhci-tegra: Add OTG support") Cc: stable Signed-off-by: Wei-Cheng Chen Link: https://patch.msgid.link/20260505112630.217704-1-weichengc@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 68aa70648b625fa684bc0b71bbfd905f4943ca20 Author: Kai Aizen Date: Thu Apr 30 20:56:43 2026 +0300 usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind uvc_function_bind() walks &opts->extension_units twice without holding opts->lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times via uvc_copy_descriptors() (once per speed), where the helper iterates uvc->desc.extension_units (which aliases &opts->extension_units) to size and emit XU descriptors. The configfs side (uvcg_extension_make / uvcg_extension_drop, in drivers/usb/gadget/function/uvc_configfs.c) takes opts->lock around its list_add_tail / list_del operations. A privileged userspace process that holds the configfs subtree open and writes the gadget UDC name to bind the function while concurrently rmdir()'ing an extensions subdir can race uvcg_extension_drop() against the bind-time list walks and dereference a freed struct uvcg_extension. Hold opts->lock from the start of the XU string-descriptor fixup through the last uvc_copy_descriptors() call, releasing on the descriptor-error path via a new error_unlock label that drops the lock before falling through to the existing error label. This matches the locking discipline of the configfs callbacks and removes the only remaining unsynchronised reader of the XU list during bind. Reachability: only privileged processes that can mount configfs and write to gadget UDC files can trigger the race, so this is a correctness fix rather than a security boundary. Fixes: 0525210c9840 ("usb: gadget: uvc: Allow definition of XUs in configfs") Cc: stable Signed-off-by: Kai Aizen Link: https://patch.msgid.link/20260430175643.67120-1-kai.aizen.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit c8547c74988e0b5f4cbb1b895e2a57aae084f070 Author: Guangshuo Li Date: Mon Apr 27 23:36:51 2026 +0800 usb: gadget: net2280: Fix double free in probe error path usb_initialize_gadget() installs gadget_release() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadget_release() when the gadget device's last reference is dropped. The probe error path calls net2280_remove(), which tears down the partially initialized device and drops the gadget reference with usb_put_gadget(). Calling kfree(dev) afterwards can free the same object again. Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing. Fixes: f770fbec4165 ("USB: UDC: net2280: Fix memory leaks") Cc: stable Signed-off-by: Guangshuo Li Reviewed-by: Alan Stern Link: https://patch.msgid.link/20260427153651.337846-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4f88d65def6f3c90121601b4f62a4c967f3063a6 Author: Guangshuo Li Date: Mon Apr 13 22:21:19 2026 +0800 usb: gadget: f_hid: fix device reference leak in hidg_alloc() hidg_alloc() initializes hidg->dev with device_initialize() before calling dev_set_name(). If dev_set_name() fails, the function currently jumps to err_unlock and returns without calling put_device(). This leaves the device reference unbalanced and prevents hidg_release() from being called. Calling put_device() here is also safe, since hidg_release() only frees resources owned by hidg. The issue was identified by a static analysis tool I developed and confirmed by manual review. Route the dev_set_name() failure path through err_put_device so the device reference is dropped properly. Fixes: 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev") Cc: stable Reviewed-by: Johan Hovold Signed-off-by: Guangshuo Li Reviewed-by: Johan Hovold johan@kernel.org Link: https://patch.msgid.link/20260413142119.2977716-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman commit e194ce048f5a6c549b3a23a8c568c6470f40f772 Author: Wentao Liang Date: Thu Apr 9 10:11:04 2026 +0000 usb: musb: omap2430: Fix use-after-free in omap2430_probe() In omap2430_probe(), of_node_put(np) is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the of_node_put() calls after the last use of np in both the success and error paths. Fixes: ffbe2feac59b ("usb: musb: omap2430: Fix probe regression for missing resources") Cc: stable Signed-off-by: Wentao Liang Link: https://patch.msgid.link/20260409101104.480623-1-vulab@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40 Author: Jingguo Tan Date: Mon May 18 17:06:48 2026 +0800 xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len. Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len. Restore this combined-length page gate for both IPv4 and IPv6. Fixes: 5bd8baab087d ("esp: limit skb_page_frag_refill use to a single page") Cc: stable@vger.kernel.org Signed-off-by: Lin Ma Signed-off-by: Chenyuan Mi Signed-off-by: Jingguo Tan Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 2982e599fff6faa21c8df147d96fc7af6c1a2f24 Author: e521588 Date: Wed May 20 09:27:17 2026 +0200 esp: fix page frag reference leak on skb_to_sgvec failure In esp_output_tail(), when esp->inplace is false, the old skb page frags are replaced with a new page from the xfrm page_frag cache. The source scatterlist (sg) is built from the old frags before the replacement, and esp_ssg_unref() is responsible for releasing the old page references after the crypto operation completes. However, if the second skb_to_sgvec() call (which builds the destination scatterlist from the new page) fails, the code jumps to error_free which only calls kfree(tmp). The old page frag references captured in the source scatterlist are never released: 1. sg[] is built from old frags via skb_to_sgvec() (no extra get_page) 2. nr_frags is set to 1 and frag[0] is replaced with the new page 3. Second skb_to_sgvec() fails -> goto error_free 4. kfree(tmp) frees the sg[] memory but old frags are not unref'd 5. kfree_skb() only releases frag[0] (the new page), not the old ones Fix this by adding a bool parameter to esp_ssg_unref() that, when true, unconditionally unrefs the source scatterlist frags without checking req->src and req->dst, since those fields are not yet initialized by aead_request_set_crypt() at the point of the error. Existing callers pass false to preserve the original behavior. The same issue exists in both esp4 and esp6 as the code is identical. Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") Signed-off-by: Alessandro Schino <7991aleschino@gmail.com> Signed-off-by: Steffen Klassert commit 4a09f4a23a3003d31f8545dd0770f2b3b0f54d8b Author: Bibo Mao Date: Fri May 22 15:05:12 2026 +0800 LoongArch: KVM: Move some variable declarations to paravirt.h Some variables relative with paravirt feature are declared in the header file asm/qspinlock.h, however this file can be included only when option CONFIG_SMP is on. There is compiling warnings if CONFIG_SMP is off since variables are not declared. Move these variable declarations to header file asm/paravirt.h to avoid compiling warnings. Fixes: c43dce6f13fb ("LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605061313.O8Hswm2b-lkp@intel.com/ Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 1c856e158fd34ef2c4475a81c1dc386329989938 Author: Tiezhu Yang Date: Fri May 22 15:05:07 2026 +0800 LoongArch: kprobes: Fix handling of fatal unrecoverable recursions KPROBE_HIT_SS and KPROBE_REENTER are two types of fatal recursions that can not be safely recovered in kprobes. KPROBE_HIT_SS means that a kprobe is hit during single-stepping. At this point, the architecture-specific single-step context is already active. Nested single-stepping would corrupt the state, as the kprobe control block (kcb) and hardware registers cannot safely store multiple levels of stepping state. KPROBE_REENTER means that a third-level recursion occurs when a probe is hit while the system is already handling a nested probe (second- level). The kcb only provides a single slot (prev_kprobe) to backup the state. When a third probe is hit, there is no more space to save the state without corrupting the first-level backup. Kprobes work by replacing instructions with breakpoints. In order to execute the original instruction and continue, it must be moved to a temporary "single-step" slot. Since there is no backup space left to set up this slot safely, the CPU would be forced to return to the same original breakpoint address, triggering an endless loop. Currently, the code only prints a warning and returns. This leads to an infinite re-entry loop as the CPU repeatedly hits the same trap and a "stuck" CPU core because preemption was disabled at the start of the handler and never re-enabled in this early return path. Fix the logic by: 1. Merging KPROBE_HIT_SS and KPROBE_REENTER cases, as both represent fatal recursions that cannot be safely recovered. 2. Replacing WARN_ON_ONCE() with BUG() to terminate the system. This aligns LoongArch with other architectures (x86, arm64, riscv) and prevents stack overflow while providing diagnostic information. Fixes: 6d4cc40fb5f5 ("LoongArch: Add kprobes support") Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit e3ef9a28f558d1cbf0b42d6dcd16c60da557562b Author: Tiezhu Yang Date: Fri May 22 15:05:07 2026 +0800 LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions On SMP systems, kprobe handlers would occasionally fail to execute on certain CPU cores. The issue is hard to reproduce and typically occurs randomly under high system load. The root cause is a software-side instruction hazard. According to the LoongArch Reference Manual, while the cache coherency is maintained by hardware, software must explicitly use the "IBAR" instruction to ensure the instruction fetch unit (IFU) observes the effects of recent stores. The current arch_arm_kprobe() and arch_disarm_kprobe() only execute the "IBAR" barrier (via flush_insn_slot -> local_flush_icache_range) on the local CPU. This leaves a vulnerable window where remote CPU cores may continue executing stale instructions from their pipelines or prefetch buffers, as they have not executed an "IBAR" since the code modification. Switch to larch_insn_text_copy() to fix this: 1. Synchronization: It uses stop_machine_cpuslocked() to synchronize all online CPUs, ensuring no CPU is executing the target code area during modification. 2. Visibility: By passing cpu_online_mask to stop_machine_cpuslocked(), the callback text_copy_cb() is executed on all online cores. Each CPU core invokes local_flush_icache_range() to execute "IBAR", clearing instruction hazards system-wide and ensuring the "break" instruction is visible to the fetch units of all cores. 3. Robustness: It properly manages memory write permissions (ROX/RW) for the kernel text segment during patching, ensuring compatibility with CONFIG_STRICT_KERNEL_RWX. Cc: # 6.18+ Fixes: 6d4cc40fb5f5 ("LoongArch: Add kprobes support") Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 2519003dd5fb6f89f10f031e3a97ecb7c9d1b816 Merge: 60a1969fae6209 09e8f9a9aa19aa Author: Takashi Iwai Date: Fri May 22 08:25:18 2026 +0200 Merge tag 'asoc-fix-v7.1-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.1 A bigger batch of fixes than usual due to -next not happeing last week, this is mostly stuff for laptops - a lot of quirks and small fixes, mainly for x86 and SoundWire. Nothing too big or exciting individually, just two week's worth. commit 5285b046757844435d1db96c1b5c3a6621b2979a Author: Pengyu Luo Date: Tue Mar 3 23:01:51 2026 +0800 clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time Parking disp{0,1}_cc_mdss_mdp_clk_src clk broke simplefb on HUAWEI Gaokun3, the image will stuck at grey for seconds until msm takes over framebuffer. Use clk_rcg2_shared_no_init_park_ops to skip it. Signed-off-by: Pengyu Luo Tested-by: Jérôme de Bretagne Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") Link: https://lore.kernel.org/r/20260303150152.90685-1-mitltlatltl@gmail.com Signed-off-by: Bjorn Andersson commit 54cf41c969da6637cce790b7400da1451609db9b Author: Byungchul Park Date: Fri May 15 12:47:01 2026 +0900 Revert "mm: introduce a new page type for page pool in page type" This reverts commit db359fccf212 ("mm: introduce a new page type for page pool in page type") and a part of 735a309b4bfb9e ("net: add net_iov_init() and use it to initialize ->page_type"). Netpp page_type'ed pages might be used in mapping so as to use @_mapcount. However, since @page_type and @_mapcount are union'ed in struct page, these two can't be used at the same time. Revert the commit introducing page_type for Netpp for now. The patch will be retried once @page_type and @_mapcount get allowed to be used at the same time. The revert also includes removal of @page_type initialization part introduced by commit 735a309b4bfb9e ("net: add net_iov_init() and use it to initialize ->page_type"), which will be restored on the retry. Link: https://lore.kernel.org/20260515034701.17027-1-byungchul@sk.com Fixes: db359fccf212 ("mm: introduce a new page type for page pool in page type") Signed-off-by: Byungchul Park Reported-by: Dragos Tatulea Closes: https://lore.kernel.org/all/982b9bc1-0a0a-4fc5-8e3a-3672db2b29a1@nvidia.com Acked-by: Jakub Kicinski Acked-by: David Hildenbrand (Arm) Acked-by: Harry Yoo (Oracle) Reviewed-by: Lorenzo Stoakes Cc: Alexei Starovoitov Cc: Baolin Wang Cc: Brendan Jackman Cc: David S. Miller Cc: Eric Dumazet Cc: Ilias Apalodimas Cc: Jesper Dangaard Brouer Cc: Johannes Weiner Cc: John Fastabend Cc: Leon Romanovsky Cc: Liam R. Howlett Cc: Mark Bloch Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Paolo Abeni Cc: Pavel Begunkov Cc: Saeed Mahameed Cc: Simon Horman Cc: Stanislav Fomichev Cc: Suren Baghdasaryan Cc: Tariq Toukan Cc: Toke Hoiland-Jorgensen Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 04aa71da5f35aacdc9ae9cb5150947daa624f641 Author: Uladzislau Rezki (Sony) Date: Fri May 15 17:30:09 2026 +0200 mm/vmalloc: do not trigger BUG() on BH disabled context __get_vm_area_node() currently triggers a BUG() if in_interrupt() returns true. However, in_interrupt() also reports true when BH are disabled. The bridge code can call rhashtable_lookup_insert_fast() with bottom halves disabled: __vlan_add() -> br_fdb_add_local() spin_lock_bh(&br->hash_lock); <-- Disable BH -> fdb_add_local() -> fdb_create() -> rhashtable_lookup_insert_fast() -> kvmalloc() -> vmalloc() -> __get_vm_area_node() -> BUG_ON(in_interrupt()) spin_unlock_bh(&br->hash_lock) this triggers the BUG() despite the caller not being in NMI or hard IRQ context. Replace the in_interrupt() check with in_nmi() || in_hardirq(). Link: https://lore.kernel.org/20260515153009.2296191-1-urezki@gmail.com Fixes: c6307674ed82 ("mm: kvmalloc: add non-blocking support for vmalloc") Signed-off-by: Uladzislau Rezki (Sony) Cc: Ido Schimmel Reported-by: syzbot+8b12fc6e0fb139765b58@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69ff8c7c.050a0220.1036b8.000b.GAE@google.com/ Reviewed-by: Baoquan He Cc: Signed-off-by: Andrew Morton commit f0af98ff6b3077278974a460becbd05bbc710e60 Author: Eugen Hristev Date: Sat Apr 25 16:06:48 2026 +0300 MAINTAINERS, mailmap: change email for Eugen Hristev Replace old bouncing emails with ehristev@kernel.org Link: https://lore.kernel.org/20260425-eh-mailmap-v1-1-58788d401eef@kernel.org Signed-off-by: Eugen Hristev Signed-off-by: Andrew Morton commit 2c6f81d58741349298f51ff697d988cb42881453 Author: Sunny Patel Date: Fri May 1 17:21:16 2026 +0530 mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page When migrate_vma_insert_huge_pmd_page() jumps to unlock_abort due to a PMD check failure, the pgtable allocated earlier via pte_alloc_one() is never freed, causing a memory leak. Added free_abort label to release the pgtable in error path. Link: https://lore.kernel.org/20260501115122.23288-1-nueralspacetech@gmail.com Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages") Signed-off-by: Sunny Patel Acked-by: David Hildenbrand (Arm) Reviewed-by: Huang Ying Cc: Alistair Popple Cc: Balbir Singh Cc: Byungchul Park Cc: Gregory Price Cc: Joshua Hahn Cc: Matthew Brost Cc: Rakie Kim Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit 09e7827e785729f391c8d46dc71becce70d296ab Author: Deepanshu Kartikey Date: Mon Mar 16 20:49:56 2026 +0530 kernel/fork: validate exit_signal in kernel_clone() When a child process exits, it sends exit_signal to its parent via do_notify_parent(). The clone() syscall constructs exit_signal as: (lower_32_bits(clone_flags) & CSIGNAL) CSIGNAL is 0xff, so values in the range 65-255 are possible. However, valid_signal() only accepts signals up to _NSIG (64 on x86_64). A non-zero non-valid exit_signal acts the same as exit_signal == 0: the parent process is not signaled when the child terminates. The syzkaller reproducer triggers this by calling clone() with flags=0x80, resulting in exit_signal = (0x80 & CSIGNAL) = 128, which exceeds _NSIG and is not a valid signal. The v1 of this patch added the check only in the clone() syscall handler, which is incomplete. kernel_clone() has other callers such as sys_ia32_clone() which would remain unprotected. Move the check to kernel_clone() to cover all callers. Since the valid_signal() check is now in kernel_clone() and covers all callers including clone3(), the same check in copy_clone_args_from_user() becomes redundant and is removed. The higher 32bits check for clone3() is kept as it is clone3() specific. Note that this is a user-visible change: previously, passing an invalid exit_signal to clone() was silently accepted. The man page for clone() does not document any defined behavior for invalid exit_signal values, so rejecting them with -EINVAL is the correct behavior. It is unlikely that any sane application relies on passing an invalid exit_signal. [oleg@redhat.com: the comment above kernel_clone() should be updated] Link: https://lore.kernel.org/abwvgU17W8wuW2-J@redhat.com Link: https://lore.kernel.org/20260316151956.563558-1-kartikey406@gmail.com Fixes: 3f2c788a1314 ("fork: prevent accidental access to clone3 features") Signed-off-by: Deepanshu Kartikey Signed-off-by: Oleg Nesterov Reported-by: syzbot+bbe6b99feefc3a0842de@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bbe6b99feefc3a0842de Tested-by: syzbot+bbe6b99feefc3a0842de@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/20260307064202.353405-1-kartikey406@gmail.com/T/ [v1] Link: https://lore.kernel.org/all/20260316104536.558108-1-kartikey406@gmail.com/T/ [v2] Acked-by: Oleg Nesterov Acked-by: Michal Hocko Cc: Ben Segall Cc: Christian Brauner Cc: David Hildenbrand Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Mel Gorman Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Cc: Tetsuo Handa Signed-off-by: Andrew Morton commit e16f17a9c5af50221184d1ef4be4056bf3c4209e Author: Alexandre Ghiti Date: Mon May 18 10:28:19 2026 +0200 mm: memcontrol: propagate NMI slab stats to memcg vmstats flush_nmi_stats() drains per-node NMI slab atomics into the per-node lruvec_stats, but does not propagate them to the memcg-level vmstats. For non NMI case, account_slab_nmi_safe() calls mod_memcg_lruvec_state() which updates both per-node lruvec_stats and memcg-level vmstats, so flush_nmi_stats() needs to flush to per-node lruvec_stats as well as memcg-level vmstats. So fix this by flushing to the memcg-level vmstats for NMI too. Link: https://lore.kernel.org/20260518082830.599102-1-alex@ghiti.fr Fixes: 940b01fc8dc1 ("memcg: nmi safe memcg stats for specific archs") Signed-off-by: Alexandre Ghiti Acked-by: Shakeel Butt Acked-by: Johannes Weiner Reviewed-by: Harry Yoo (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Signed-off-by: Andrew Morton commit 441f92f7d386b85bad16de49db95a307cba048a2 Author: SeongJae Park Date: Mon May 18 08:25:58 2026 -0700 mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() DAMON sysfs maintains the DAMOS tried region directory objects via a linked list. When the user requests refresh of the directories, DAMON sysfs removes all the region directories first, and then generate updated regions directory on the empty space. The removal function (damon_sysfs_scheme_regions_rm_dirs()) only puts the kobj objects. Deletion of the container region object from the linked list is done inside the kobj release callback function. If somehow the callback invocation is delayed, the list will contain regions list that gonna be freed. If the updated region directories creation is started in this situation, the list can be corrupted and use-after-free can happen. Because the kobj objects are managed by only DAMON sysfs, the issue cannot happen in normal situation. But, such delays can be made on kernels that built with CONFIG_DEBUG_KOBJECT_RELEASE. On the kernel, the issue can indeed be reproduced like below. # damo start --damos_action stat # cd /sys/kernel/mm/damon/admin/kdamonds/0/ # for i in {1..10}; do echo update_schemes_tried_regions > state; done # dmesg | grep underflow [ 89.296152] refcount_t: underflow; use-after-free. Fix the issue by removing the region object from the list when decrementing the reference count. Also update damos_sysfs_populate_region_dir() to add the region object to the list only after the kobject_init_and_add() is success, so that fail of kobject_init_and_add() is not leaving the deallocated object on the list. The issue was discovered [1] by Sashiko. Link: https://lore.kernel.org/20260518152559.93038-1-sj@kernel.org Link: https://lore.kernel.org/20260513011920.119183-1-sj@kernel.org [1] Fixes: 9277d0367ba1 ("mm/damon/sysfs-schemes: implement scheme region directory") Signed-off-by: SeongJae Park Cc: # 6.2.x Signed-off-by: Andrew Morton commit 3f8968e9cbf95d5d87d32218906cab0b9b9eddbe Author: Dev Jain Date: Mon May 18 12:06:56 2026 +0530 mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Initialize nr_pages to 1 at the start of each loop iteration, like folio_referenced_one() does. Without this, nr_pages computed by a previous folio_unmap_pte_batch() call can be reused on a later iteration that does not run folio_unmap_pte_batch() again. mmap a 64K large folio with MAP_ANONYMOUS | MAP_DROPPABLE, then call madvise(MADV_FREE), then make the last page device-exclusive via HMM_DMIRROR_EXCLUSIVE. Trigger node reclaim through sysfs. Now, in try_to_unmap_one(), we will first clear the first 15 out of 16 entries mapping the lazyfree folio. This will set nr_pages to 15. In the next pvmw walk, this nr_pages gets reused on a device-exclusive pte, thus potentially corrupting folio refcount/mapcount. At the moment, I have a userspace program which can make the kernel spit out a trace, but the blow up is in folio_referenced_one(), because there are existing bugs in the interaction between device-private and rmap (which too I am investigating). I did a one liner kernel change to avoid going into folio_referenced_one(), and the kernel blows up at folio_remove_rmap_ptes in try_to_unmap_one which is what I wanted. Note that the bug is there not since file folio batching but lazyfree folio batching, since device-exclusive only works for anonymous folios. Userspace visible effect is simply kernel crashing somewhere due to refcount/mapcount corruption. Link: https://lore.kernel.org/20260518063656.3721056-1-dev.jain@arm.com Fixes: 354dffd29575 ("mm: support batched unmap for lazyfree large folios during reclamation") Signed-off-by: Dev Jain Acked-by: Barry Song Acked-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes Cc: Anshuman Khandual Cc: Barry Song Cc: Dev Jain Cc: Harry Yoo Cc: Jann Horn Cc: Liam R. Howlett Cc: Rik van Riel Cc: Ryan Roberts Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit bf62f69574b19720ae5fbbbcdf24a0c4e3e05e43 Author: Richard Chang Date: Tue May 12 07:49:18 2026 +0000 zram: fix use-after-free in zram_writeback_endio A crash was observed in zram_writeback_endio due to a NULL pointer dereference in wake_up. The root cause is a race condition between the bio completion handler (zram_writeback_endio) and the writeback task. In zram_writeback_endio, wake_up() is called on &wb_ctl->done_wait after releasing wb_ctl->done_lock. This creates a race window where the writeback task can see num_inflight become 0, return, and free wb_ctl before zram_writeback_endio calls wake_up(). CPU 0 (zram_writeback_endio) CPU 1 (writeback_store) ============================ ============================ zram_writeback_slots zram_submit_wb_request zram_submit_wb_request wait_event(wb_ctl->done_wait) spin_lock(&wb_ctl->done_lock); list_add(&req->entry, &wb_ctl->done_reqs); spin_unlock(&wb_ctl->done_lock); wake_up(&wb_ctl->done_wait); zram_complete_done_reqs spin_lock(&wb_ctl->done_lock); list_add(&req->entry, &wb_ctl->done_reqs); spin_unlock(&wb_ctl->done_lock); while (num_inflight) > 0) spin_lock(&wb_ctl->done_lock); list_del(&req->entry); spin_unlock(&wb_ctl->done_lock); // num_inflight becomes 0 atomic_dec(num_inflight); // Leave zram_writeback_slots // Free wb_ctl release_wb_ctl(wb_ctl); // UAF crash! wake_up(&wb_ctl->done_wait); This patch fixes this race by using RCU. By protecting wb_ctl with rcu_read_lock() in zram_writeback_endio and using kfree_rcu() to free it, we ensure that wb_ctl remains valid during the execution of zram_writeback_endio. Link: https://lore.kernel.org/20260512074918.2606208-1-richardycc@google.com Fixes: f405066a1f0d ("zram: introduce writeback bio batching") Signed-off-by: Richard Chang Suggested-by: Sergey Senozhatsky Suggested-by: Minchan Kim Acked-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Brian Geffon Cc: Jens Axboe Cc: Martin Liu Cc: wang wei Cc: Signed-off-by: Andrew Morton commit 3b041514cb6eae45869b020f743c14d983363222 Author: Pratyush Yadav (Google) Date: Tue May 5 15:39:20 2026 +0200 memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means one can use SEAL_EXEC to apply SEAL_WRITE while having writeable mappings. This breaks the contract that SEAL_WRITE provides and can be used by an attacker to pass a memfd that appears to be write sealed but can still be modified arbitrarily. Fix this by adding the implied seals before the call for mapping_deny_writable() is done. Link: https://lore.kernel.org/20260505133922.797635-1-pratyush@kernel.org Fixes: c4f75bc8bd6b ("mm/memfd: add write seals when apply SEAL_EXEC to executable memfd") Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Pasha Tatashin Acked-by: Jeff Xu Cc: Baolin Wang Cc: Brendan Jackman Cc: Greg Thelen Cc: Hugh Dickins Cc: Kees Cook Cc: "David Hildenbrand (Arm)" Cc: Signed-off-by: Andrew Morton commit fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139 Author: Linpu Yu Date: Sun May 10 13:43:30 2026 +0800 ipc: limit next_id allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted. Link: https://lore.kernel.org/cover.1778336914.git.linpu5433@gmail.com Link: https://lore.kernel.org/2eebe949bfa7d1f6e13b5be6a92c64c850ce9d45.1778336914.git.linpu5433@gmail.com Fixes: 03f595668017 ("ipc: add sysctl to specify desired next object id") Signed-off-by: Linpu Yu Signed-off-by: Ren Wei Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Cc: Kees Cook Cc: Stanislav Kinsbursky Cc: Davidlohr Bueso Cc: Signed-off-by: Andrew Morton commit 83f9efcce93f8574be2279090ee2aec58b86cda7 Author: Lorenzo Stoakes Date: Tue May 12 17:06:43 2026 +0100 Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" This reverts commit ea52cb24cd3f ("mm/hugetlbfs: update hugetlbfs to use mmap_prepare") with conflict resolution to account for changes in commit ea52cb24cd3f ("mm/hugetlbfs: update hugetlbfs to use mmap_prepare"). The patch incorrectly handled hugetlb VMA lock allocation at the mmap_prepare stage, where a failed allocation occurring after mmap_prepare is called might result in the lock leaking. There is no risk of a merge causing a similar issues, as VMA_DONTEXPAND_BIT is set for hugetlb mappings. As a first step in addressing this issue, simply revert the change so we can rework how we do this having corrected the underlying issues. We maintain the VMA flags changes as best we can, accounting for the fact that we were working with a VMA descriptor previously and propagating like-for-like changes for this. Note that we invoke vma_set_flags() and do not call vma_start_write() as vm_flags_set() does. This is OK as it's being done in an .mmap hook where the VMA is not yet linked into the tree so nobody else can be accessing it. Link: https://lore.kernel.org/20260512160643.266960-1-ljs@kernel.org Fixes: ea52cb24cd3f ("mm/hugetlbfs: update hugetlbfs to use mmap_prepare") Signed-off-by: Lorenzo Stoakes Reported-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> Closes: https://lore.kernel.org/linux-mm/20260425070700.562229-1-25181214217@stu.xidian.edu.cn/ Acked-by: Muchun Song Acked-by: Oscar Salvador Cc: David Hildenbrand Cc: Liam R. Howlett Cc: Pedro Falcato Cc: Signed-off-by: Andrew Morton commit 83ec6eeb74a592e6568cb0723bac99fb8b3810b4 Author: Ian Ray Date: Wed May 6 09:33:35 2026 +0300 MAINTAINERS: .mailmap: update after GEHC spin-off Update my email address from @ge.com to @gehealthcare.com after GE HealthCare was spun-off from GE. Link: https://lore.kernel.org/20260506063335.3-1-ian.ray@gehealthcare.com Signed-off-by: Ian Ray Reviewed-by: Luca Ceresoli Cc: Neil Armstrong Signed-off-by: Andrew Morton commit e90ef85ada857819313000cc50c6edfcddec6850 Author: Marco Elver Date: Thu May 21 14:23:55 2026 +0200 nios2: Implement _THIS_IP_ using inline asm Both GCC [1] and Clang [2] consider the generic version of _THIS_IP_ to be broken: #define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; }) In particular, the address of a label is only expected to be used with a computed goto. While the generic version more or less works today, it is known to be brittle and may break with current and future optimizations. For example, Clang -O2 always returns 1 when this function is inlined: static inline unsigned long get_ip(void) { return ({ __label__ __here; __here: (unsigned long)&&__here; }); } Fix it by overriding _THIS_IP_ in (which is included by ) using an architecture-specific inline asm version. Additionally, avoiding taking the address of a label prevents compilers from emitting spurious indirect branch targets (e.g. ENDBR or BTI) under control-flow integrity schemes. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=120071 [1] Link: https://github.com/llvm/llvm-project/issues/138272 [2] Signed-off-by: Marco Elver Reviewed-by: David Laight Signed-off-by: Dinh Nguyen commit 7734b168cad167a43e5bda19bc8ccc65669ec964 Author: Simon Schuster Date: Thu May 21 14:46:28 2026 +0200 MAINTAINERS: arch/nios2: Add Simon Schuster as co-maintainer Add Simon Schuster as a co-maintainer for the nios2 architecture and mark it as supported. Signed-off-by: Simon Schuster Acked-by: Arnd Bergmann Signed-off-by: Dinh Nguyen commit 4ec9c8e023c79f613fe4d5ad8cc737112efb2e44 Author: ChenXiaoSong Date: Mon May 18 15:23:22 2026 +0000 smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close Reproducer: 1. server: systemctl start ksmbd 2. client: mount -t cifs //${server_ip}/export /mnt 3. client: C program: openat(AT_FDCWD, "/mnt", O_RDWR | O_TMPFILE, 0600) Do not treat `FILE_DELETE_ON_CLOSE_LE` as delete pending while files remain open. This patch fixes xfstests generic/004. Cc: stable@vger.kernel.org Link: https://chenxiaosong.com/en/smb-xfstests-generic-004.html Co-developed-by: Huiwen He Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Tested-by: Steve French Acked-by: Namjae Jeon Signed-off-by: Steve French commit 69f030cf95488ae1186c72ac8c66fd279664ea7f Author: Junyi Liu Date: Tue May 19 16:12:04 2026 +0900 ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smb_validate_ntsd_sid() helper to safely validate Owner SID and Group SID inside the NT Security Descriptor (smb_ntsd) retrieved from the parent directory. Cc: stable@vger.kernel.org Signed-off-by: Junyi Liu Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 3515503322f4819277091839eed46b695096aca5 Author: Junyi Liu Date: Mon May 18 23:27:19 2026 +0900 ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes the same ksmbd_file into the session volatile-id table. If smb2_open() then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp) and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp). In this case fp and dh_info.fp are the same object. The first put drops the reconnect lookup reference, but the final durable put can run __ksmbd_close_fd(NULL, fp). Because the final close is not session-aware, it can free the file object without removing the volatile-id entry that was just published into the session table. Use the session-aware put for the final reconnect drop when the reconnect had already succeeded and the error path is cleaning up the republished file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep using the durable-only put path. Fixes: 1baff47b81f9 ("ksmbd: fix use-after-free in smb2_open during durable reconnect") Signed-off-by: Junyi Liu Acked-by: Namjae Jeon Signed-off-by: Steve French commit 462a85f9f887a4fef36550bb76c7f7d7a0fa296c Author: Manivannan Sadhasivam Date: Wed May 20 21:27:04 2026 +0530 soc: qcom: ice: Fix the error code when 'qcom,ice' property is not found When both 'ice' reg entry and 'qcom,ice' property are not found in DT, then it implies that ICE is not supported. So return -EOPNOTSUPP instead of -ENODEV to client drivers to specify ICE functionality is not supported. Fixes: b9ab7217dd7d ("soc: qcom: ice: Return proper error codes from devm_of_qcom_ice_get() instead of NULL") Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/linux-arm-msm/8bac0358-9da0-4cbb-98ee-333b85ba4908@samsung.com Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20260520155704.130803-1-manivannan.sadhasivam@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4378a4116567887066011b8e0cd443241609e467 Merge: 71d9e1561aab0a 87ed4e845d5a90 Author: Dave Airlie Date: Fri May 22 08:30:46 2026 +1000 Merge tag 'mediatek-drm-fixes-20260521' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20260521 1. fix sparse warnings Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patch.msgid.link/20260521135649.4681-1-chunkuang.hu@kernel.org commit 6779b50faa562e6cca1aa6a4649a4d764c6c7e28 Merge: 68993ced0f618e ed831e7ea1a860 Author: Linus Torvalds Date: Thu May 21 15:02:12 2026 -0700 Merge tag 'pci-v7.1-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Remove obsolete PCIe maintainer addresses (Florian Eckert, Hans Zhang) - Restore a brcmstb link speed assignment that was inadvertently removed, reducing bcm2712 performance (Florian Fainelli) * tag 'pci-v7.1-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: brcmstb: Assign pcie->gen from of_pci_get_max_link_speed() MAINTAINERS: Remove Jianjun Wang as PCIe mediatek maintainer MAINTAINERS: Remove Chuanhua Lei as PCIe intel-gw maintainer commit 68993ced0f618e36cf33388f1e50223e5e6e78cc Merge: 6d3b2673e1fd55 0e3c08f1b7b79b Author: Linus Torvalds Date: Thu May 21 14:39:12 2026 -0700 Merge tag 'net-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from Bluetooth, wireless and netfilter. Craziness continues with no end in sight. Even discounting the driver revert this is a pretty huge PR for standards of the previous era. I'd speculate - we haven't seen the worst of it, yet. Good news, I guess, is that so far we haven't seen many (any?) cases of "AI reported a bug, we fixed it and a real user regressed". Current release - fix to a fix: - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events - vsock/virtio: relax the recently added memory limit a little Current release - regressions: - IB/IPoIB: make sure IB drivers always use async set_rx_mode since some (mlx5) are now required to use it due to locking changes Previous releases - regressions: - udp: fix UDP length on last GSO_PARTIAL segment - af_unix: fix UAF read of tail->len in unix_stream_data_wait() - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction - mlx5e: fix unlocked writing to ICOSQ, breaking AF_XDP Previous releases - always broken: - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - Bluetooth: a lot of locking and concurrency fixes (as always) - batman-adv (mesh wireless networking): a lot of random fixes for issues reported by security researchers and Sashiko - netfilter: same thing, a lot of small security-ish fixes all over the place, nothing really stands out Misc: - bring back the old 3c509 driver, Maciej wants to maintain it" * tag 'net-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (187 commits) net: enetc: avoid VF->PF mailbox timeout during SR-IOV teardown net: enetc: fix init and teardown order to prevent use of unsafe resources net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx() net: enetc: fix race condition in VF MAC address configuration net: enetc: fix TOCTOU race and validate VF MAC address net: enetc: add ratelimiting to VF mailbox error messages net: enetc: fix missing error code when pf->vf_state allocation fails net: enetc: fix incorrect mailbox message status returned to VFs net: bridge: prevent too big nested attributes in br_fill_linkxstats() l2tp: use list_del_rcu in l2tp_session_unhash net: bcmgenet: keep RBUF EEE/PM disabled ethernet: 3c509: Fix most coding style issues ethernet: 3c509: Update documentation to match MAINTAINERS ethernet: 3c509: Add GPL 2.0 SPDX license identifier ethernet: 3c509: Fix AUI transceiver type selection Revert "drivers: net: 3com: 3c509: Remove this driver" tools: ynl: support listening on all nsids net: gro: don't merge zcopy skbs pds_core: ensure null-termination for firmware version strings ... commit 67802f981361ebb49cc25175c57179aecb14626c Merge: 4b15b03166cc5d 90825ab392ac15 Author: Bjorn Andersson Date: Thu May 21 16:29:19 2026 -0500 Merge branch '20260416-qcom_ice_power_and_clk_vote-v5-13-5ccf5d7e2846@oss.qualcomm.com' into arm64-fixes-for-7.1 Merge the fixes to add power-domain and correct clocks for the ICC block in Eliza and Milos through a topic branch, to allow them to be merged also into arm64-for-7.2 to resolve the merge conflicts that would otherwise appear. Signed-off-by: Bjorn Andersson commit 90825ab392ac15a51f62e3f561ad77e0226a1cfc Author: Harshal Dev Date: Thu Apr 16 17:29:30 2026 +0530 arm64: dts: qcom: eliza: Add power-domain and iface clk for ice node Qualcomm in-line crypto engine (ICE) platform driver specifies and votes for its own resources. Before accessing ICE hardware during probe, to avoid potential unclocked register access issues (when clk_ignore_unused is not passed on the kernel command line), in addition to the 'core' clock the 'iface' clock should also be turned on by the driver. This can only be done if the GCC_UFS_PHY_GDSC power domain is enabled. Specify both the GCC_UFS_PHY_GDSC power domain and the 'iface' clock in the ICE node for eliza. Fixes: af20af39fc09b ("arm64: dts: qcom: Introduce Eliza Soc base dtsi") Signed-off-by: Harshal Dev Reviewed-by: Konrad Dybcio Fixes: 54a4f0239f2e ("KVM: MMU: make kvm_mmu_zap_page() return the Reviewed-by: Kuldeep Singh Link: https://lore.kernel.org/r/20260416-qcom_ice_power_and_clk_vote-v5-13-5ccf5d7e2846@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b7c9047f851e80b580aba485b61785c7554b992c Author: Harshal Dev Date: Thu Apr 16 17:29:29 2026 +0530 arm64: dts: qcom: milos: Add power-domain and iface clk for ice node Qualcomm in-line crypto engine (ICE) platform driver specifies and votes for its own resources. Before accessing ICE hardware during probe, to avoid potential unclocked register access issues (when clk_ignore_unused is not passed on the kernel command line), in addition to the 'core' clock the 'iface' clock should also be turned on by the driver. This can only be done if the UFS_PHY_GDSC power domain is enabled. Specify both the UFS_PHY_GDSC power domain and the 'iface' clock in the ICE node for milos. Fixes: 04bb37433330e ("arm64: dts: qcom: milos: Add UFS nodes") Signed-off-by: Harshal Dev Reviewed-by: Konrad Dybcio Reviewed-by: Kuldeep Singh Link: https://lore.kernel.org/r/20260416-qcom_ice_power_and_clk_vote-v5-12-5ccf5d7e2846@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a9e18aa3263f356edae305e29830e5fe63d8597a Author: Sean Christopherson Date: Fri May 15 10:15:36 2026 -0700 KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC Flush the current TLB when xAVIC *or* x2AVIC is activated, as KVM is (apparently) responsible for purging TLB entries when transitioning from xAVIC to x2AVIC. The APM says a whole lot of nothing about TLB flushing with respect to (x2)AVIC, but empirical data strongly suggests hardware also does a whole lot of nothing. Failure to flush the TLB when enabling x2AVIC can lead to guest accesses to the APIC base address getting incorrectly redirected to the virtual APIC page. The flaw most visibly manifests as failures in KVM-Unit-Test's verify_disabled_apic_mmio() testcase when x2APIC is enabled (though for reasons unknown, the test only reliably fails with EFI builds). Fixes: 0ccf3e7cb95a ("KVM: SVM: Flush the "current" TLB when activating AVIC") Fixes: 4d1d7942e36a ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode") Cc: stable@vger.kernel.org Cc: Naveen N Rao (AMD) Link: https://patch.msgid.link/20260515171536.1841645-1-seanjc@google.com Signed-off-by: Sean Christopherson commit b60621c5121c9435eda99af7dc2100f5c0f88695 Author: Emily Ehlert Date: Mon May 18 13:59:56 2026 +0000 KVM: x86: Fix ERAPS RAP clear on INVPCID single-context invalidation Use kvm_register_mark_dirty() instead of kvm_register_is_dirty() to actually mark VCPU_EXREG_ERAPS as dirty when emulating INVPCID_TYPE_SINGLE_CTXT. kvm_register_is_dirty() is a read-only predicate whose return value is discarded, making the call a no-op. Without this fix, a single-context INVPCID will not trigger a RAP clear on the next VMRUN, breaking the ERAPS security guarantee. Fixes: db5e82496492 ("KVM: SVM: Virtualize and advertise support for ERAPS") Signed-off-by: Emily Ehlert Link: https://patch.msgid.link/20260518135956.82569-1-ehemily@amazon.de Signed-off-by: Sean Christopherson commit 6d3b2673e1fd553395933b6f2bc88c9e9d2a2bc5 Merge: 7acfa2c5f4366d 9fc75b71fdd384 Author: Linus Torvalds Date: Thu May 21 14:17:28 2026 -0700 Merge tag 'ceph-for-7.1-rc5' of https://github.com/ceph/ceph-client Pull ceph fix from Ilya Dryomov: "A fix for an 'rbd unmap' race condition which popped up on a production setup where many RBD devices are frequently mapped and unmapped, marked for stable" * tag 'ceph-for-7.1-rc5' of https://github.com/ceph/ceph-client: rbd: eliminate a race in lock_dwork draining on unmap commit 0b474240327cebeff08ad429e8ed3cfc6c8ee816 Author: NeilBrown Date: Tue Apr 28 15:47:44 2026 -0400 lockd: fix TEST handling when not all permissions are available. The F_GETLK fcntl can work with either read access or write access or both. It can query F_RDLCK and F_WRLCK locks in either case. However lockd currently treats F_GETLK similar to F_SETLK in that read access is required to query an F_RDLCK lock and write access is required to query a F_WRLCK lock. This is wrong and can cause problems - e.g. when qemu accesses a read-only (e.g. iso) filesystem image over NFS (though why it queries if it can get a write lock - I don't know. But it does, and this works with local filesystems). So we need TEST requests to be handled differently. To do this: - change nlm_do_fopen() to accept O_RDWR as a mode and in that case succeed if either a O_RDONLY or O_WRONLY file can be opened. - change nlm_lookup_file() to accept a mode argument from caller, instead of deducing base on lock time, and pass that on to nlm_do_fopen() - change nlm4svc_retrieve_args() and nlmsvc_retrieve_args() to detect TEST requests and pass O_RDWR as a mode to nlm_lookup_file, passing the same mode as before for other requests. Also set lock->fl.c.flc_file to whichever file is available for TEST requests. - change nlmsvc_testlock() to also not calculate the mode, but to use whatever was stored in lock->fl.c.flc_file. This behaviour of lockd - requesting O_WRONLY access to TEST for exclusive locks - has been present at least since git history began. However it was hidden until recently because knfsd ignored the access requested by lockd and required only READ access for all locking requests (unless the underlying filesystem provided an f_op->open function which checked access permissions). The commit mentioned in Fixes: below changed nfsd_permission() to NOT override the access request for LOCK requests and this exposed the bug that we are now fixing. Note that there is another issue that this patch does not address. The flock(.., LOCK_EX) call is permitted on a read-only file descriptor. Linux NFS maps this to NLM locking as whole-file byte-range locks. nfsd will see this as though it were fcntl( F_SETLK (F_WRLCK)) and will now require write access, which it might not be able to get. It is not clear if this is a problem in practice, or what the best solution might be. So no attempt is made to address it. Reported-by: Tj Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1128861 Fixes: 4cc9b9f2bf4d ("nfsd: refine and rename NFSD_MAY_LOCK") Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit fc151100098d2899b7aed99aa1bcfe27bf00d58d Author: Chuck Lever Date: Tue Apr 21 15:20:21 2026 -0400 NFSD: Report whether fh_key was actually updated The nfsd_ctl_fh_key_set tracepoint was introduced to capture operator activity on the filehandle signing key. Earlier revisions logged the key bytes verbatim; the version that landed hashes the 16 key bytes through crc32_le and stores the result. CRC32 is a linear projection of its input rather than a one-way function, and truncating any hash of fixed-size secret material leaves the key recoverable under offline brute force when the threat model includes an attacker with access to the trace ring. The operational question the fingerprint was meant to answer is whether a NFSD_CMD_THREADS_SET call that carries an NFSD_A_SERVER_FH_KEY attribute actually replaced the active key or re-installed the value already in place. Answer that question directly: compare the incoming key bytes against the current nn->fh_key inside nfsd_nl_fh_key_set() and surface a single bit to the tracepoint. The event now prints "updated" when the stored key changed and "unmodified" otherwise. A first set that fails kmalloc reports "unmodified" because no key was installed. Reported-by: jaeyeong Fixes: 62346217fd72 ("NFSD: Add a key for signing filehandles") Cc: Benjamin Coddington Reviewed-by: Benjamin Coddington Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit ea25e3c7915b24e0ef93ee85190f3fada037dfb1 Author: Chuck Lever Date: Tue Apr 21 12:11:25 2026 -0400 sunrpc: prevent out-of-bounds read in __cache_seq_start() Commit 7b546bd89975 ("sunrpc/cache: improve RCU safety in cache_list walking.") changed the tail of __cache_seq_start() to unconditionally store *pos = ((long long)hash << 32) + 1 before returning, dropping a prior "hash >= cd->hash_size" guard. When the while loop exits because every remaining bucket was empty, hash equals cd->hash_size, so the stored *pos is one position past the table's last valid bucket. seq_read_iter() caches that index in m->index. A subsequent pread(2) at the same file offset skips traverse() and hands the stored index back to __cache_seq_start(), which decodes hash = cd->hash_size and dereferences cd->hash_table[cd->hash_size] -- one hlist_head past the end of the kzalloc'd table. KASAN reports an eight-byte slab-out-of-bounds read at the tail of the 2048-byte hash_table allocation for the NFSD export cache (EXPORT_HASHMAX * sizeof(struct hlist_head) == 256 * 8). Reject an input hash that is out of range before touching the hash table. cache_seq_next() already bounds-checks its own loop; the start routine needs to be symmetric. Reported-by: syzbot+60cfa08822470bbebe44@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=60cfa08822470bbebe44 Fixes: 7b546bd89975 ("sunrpc/cache: improve RCU safety in cache_list walking.") Reviewed-by: Benjamin Coddington Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit 7acfa2c5f4366d63653380646ffa7dbd1bfaccc0 Merge: 758c807bb94313 057caace5214da Author: Linus Torvalds Date: Thu May 21 14:05:09 2026 -0700 Merge tag 'trace-ringbuffer-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ring-buffer fixes from Steven Rostedt: - Fix reporting MISSED EVENTS in trace iterator When the "trace" file is read with tracing enabled, if the writer were to pass the iterator reader, it resets, sets a "missed_events" flag and continues. The tracing output checks for missed events and if there are some, it prints out "[LOST EVENTS]" to let the user know events were dropped. But the clearing of the missed_events happened when the tracing system queried the ring buffer iterator about missed events. This was premature as the ring buffer is per CPU, and the tracing code reads all the CPU buffers and checks for missed events when it is read. If the CPU iterator that had missed events isn't printed next, the output for the LOST EVENTS is lost. Clear the missed_events flag when the iterator moves to the next event and not when the missed_events flag is queried. Also clear it on reset. - Flush and stop the persistent ring buffer on panic On panic the persistent ring buffer is used to debug what caused the panic. But on some architectures, it requires flushing the memory from cache, otherwise, the ring buffer persistent memory may not have the last events and this could also cause the ring buffer to be corrupted on the next boot. - Fix nr_subbufs initialization in simple_ring_buffer_init_mm The remote simple ring buffer meta data nr_subbufs is initialized too early and gets cleared later on, making it zero and not reflect the actual number of sub-buffers. - Fix unload_page for simple_ring_buffer init rollback On error, the pages loaded need to be unloaded. To unload a page it is expected that: page = load_page(va); -> unload_page(page). But the code was doing: unload_page(va) and not unload_page(page). - Create output file from cmd_check_undefined The check for undefined symbols checks if the file *.o.checked exists and if so it skips doing the work. But the *.o.checked file never was created making every build do the work even when it was already done previously. * tag 'trace-ringbuffer-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Create output file from cmd_check_undefined tracing: Fix unload_page for simple_ring_buffer init rollback tracing: Fix nr_subbufs initialization in simple_ring_buffer_init_mm() ring-buffer: Flush and stop persistent ring buffer on panic ring-buffer: Fix reporting of missed events in iterator commit 71d9e1561aab0a506f6c783a6c3e16042fd27dff Merge: aee43aaf26c7f1 9af1b6e175c82d Author: Dave Airlie Date: Fri May 22 07:00:45 2026 +1000 Merge tag 'drm-misc-fixes-2026-05-21' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: amdxdna: - remove mmap and export for ubuf bridge: - chipone-icn6211: managed bridge cleanup - lt66121: acquire reset GPIO - megachips: fix clean up on failed IRQ requests gem: - clean up LRU locking v3d: - fix UAF in error code paths - release GEM-object ref on free'd jobs virtio: - use uninterruptible resv locking in plane updates Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260521071456.GA14644@localhost.localdomain commit 27cd2dde35b2c3b8659fa18f6a935c61fedee5c1 Author: Zhengyu He Date: Thu May 21 22:44:45 2026 +0800 spi: dt-bindings: fsl-qspi: support SpacemiT K3 Add the SpacemiT K3 QSPI compatible to the fsl-qspi binding. K3 and K1 use the same QSPI controller, so document the K3 compatible with "spacemit,k1-qspi" as fallback. Signed-off-by: Cody Kang Signed-off-by: Zhengyu He Acked-by: Conor Dooley Link: https://patch.msgid.link/20260521-k3-pico-itx-qspi-v2-for-next-20260521-v2-1-52bce26e5fd8@gmail.com Signed-off-by: Mark Brown commit dc278e9bf2b9513a763353e6b9cc21e0f532954e Author: Keith Busch Date: Thu May 21 12:02:53 2026 -0700 blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use. Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway. The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it. Fixes: b0077e269f6c1 ("blk-mq: make sure active queue usage is held for bio_integrity_prep()") Fixes: 7b4f36cd22a65 ("block: ensure we hold a queue reference when using queue limits") Signed-off-by: Keith Busch Link: https://patch.msgid.link/20260521190253.242065-1-kbusch@meta.com Signed-off-by: Jens Axboe commit 09e8f9a9aa19aa8c1b0cc7a0ebc68f6ecf86a660 Author: Jeongjun Park Date: Thu May 21 20:37:12 2026 +0900 ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put() In the pcm512x chipset driver, pcm512x_overclock_xxx_put() is defined as a general mixer kcontrol instead of a DAPM kcontrol, so struct snd_soc_dapm_context must not be accessed via snd_soc_dapm_kcontrol_to_dapm(). This causes a NULL pointer dereference, so it must be modified to use snd_soc_component_to_dapm(). Cc: stable@kernel.org Closes: https://github.com/raspberrypi/linux/issues/7242 Fixes: 02dbbb7e982a ("ASoC: codecs: pcm512x: convert to snd_soc_dapm_xxx()") Signed-off-by: Jeongjun Park Link: https://patch.msgid.link/20260521113712.227438-1-aha310510@gmail.com Signed-off-by: Mark Brown commit 45cf24da0a10203890fae4bd10ca5dbfca430324 Author: Charles Keepax Date: Wed May 20 17:36:30 2026 +0100 ASoC: Intel: soc-acpi-intel-ptl-match: Remove unnecessary cs42l43 match For PTL onwards Cirrus are intending to rely on function topologies, rather than using a match table for each system type. Remove this unnecessary match table entry. Having the match entries can mean that systems match when they should use function topologies instead, resulting in incorrect audio configurations. Although, admittedly this is not too likely with this 6x amp configuration as those are quite rare, but best to follow best practice. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260520163631.3300102-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit e0fb794d67f86726817756bcc25c628f4894df29 Author: Charles Keepax Date: Wed May 20 17:36:29 2026 +0100 ASoC: soc-acpi-intel-ptl-match: Make Chrome matches conditional For PTL onwards Cirrus are intending to rely on function topologies, rather than using a match table for each system type. Chrome systems tend to have custom magic in the topology and thus need to load a specific file. This causes problems as these system can have the same layout as generic laptops causing the match to apply to other laptops. Add a DMI quirk that forces these matches to only apply to specific devices. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260520163631.3300102-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 2b8305f24a61b290f3258a3368be548f17451533 Author: Balamurugan C Date: Wed May 20 14:11:43 2026 +0800 ASoC: Intel: soc-acpi: Add entry for sof_es8336 in NVL match table. Adding ES83x6 I2S codec support for NVL platforms and entry in match table. Signed-off-by: Balamurugan C Reviewed-by: Liam Girdwood Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260520061143.2024963-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit fd9b9204f30e0463e1abec222aeec33b98571b71 Author: Jairaj Arava Date: Wed May 20 14:08:13 2026 +0800 ASoC: Intel: sof_sdw: Add support for nvlrvp in NVL platform Add an entry in the soundwire quirk table for novalake boards to support NVL RVP Signed-off-by: Jairaj Arava Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260520060814.2024852-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit c9b7598eb013c6dbf2526dc050364bd8dc24f0d3 Author: Cosmin Tanislav Date: Wed May 20 23:31:15 2026 +0300 irqchip/renesas-rzt2h: Use pm_runtime_put_sync() in probe error path pm_runtime_put() may trigger the idle check after pm_runtime_disable() is run as part of devm_pm_runtime_enable()'s cleanup action, leaving runtime PM active. Use pm_runtime_put_sync() to ensure the idle check runs synchronously. Fixes: 13e7b3305b64 ("irqchip: Add RZ/{T2H,N2H} Interrupt Controller (ICU) driver") Signed-off-by: Cosmin Tanislav Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260520203117.1516442-2-cosmin-gabriel.tanislav.xa@renesas.com commit 0e3c08f1b7b79b2e9635e70fde3a2f053c99eff1 Merge: c33f944a33d63c dc14686f27df64 Author: Jakub Kicinski Date: Thu May 21 11:03:58 2026 -0700 Merge tag 'wireless-2026-05-21' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Quite a few more updates: - cfg80211/mac80211: - various security(-ish) fixes - fix A-MSDU subframe handling - fix multi-link element parsing - ath10: avoid sending commands to dead device - ath11k: - fix WMI buffer leaks on error conditions - fix UAF in RX MSDU coalesce path - allow peer ID 0 on RX path (legal for mobile devices) - reinitialize shared SRNG pointers on restart - ath12k: - fix 20 MHz-only parsing of EHT-MCS map - iwlwifi: - fix TSO segmentation explosion - don't TX to dead device - fix warning in WoWLAN - fix TX rates on old devices - disconnect on beacon loss only if also no other traffic - fill NULL-ptr deref - fix STEP_URM hardware access * tag 'wireless-2026-05-21' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (24 commits) wifi: cfg80211: wext: validate chandef in monitor mode wifi: mac80211: consume only present negotiated TTLM maps wifi: wilc1000: fix dma_buffer leak on bus acquire failure wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb wifi: mac80211: fix multi-link element inheritance wifi: mac80211: fix MLE defragmentation wifi: mac80211: don't override max_amsdu_subframes wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only parsing wifi: ath11k: clear shared SRNG pointer state on restart wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() wifi: ath11k: fix peer resolution on rx path when peer_id=0 wifi: iwlwifi: mld: disconnect only after 6 beacons without Rx wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o BSS vif wifi: iwlwifi: use correct function to read STEP_URM register wifi: iwlwifi: mvm: fix driver-set TX rates on old devices wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it wifi: iwlwifi: mld: stop TX during firmware restart wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled wifi: ath10k: skip WMI and beacon transmission when device is wedged ... ==================== Link: https://patch.msgid.link/20260521152903.374070-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit a8878e19d2f5205ad1f170fc230c2cc25a3b9390 Author: Lizhi Hou Date: Wed May 20 15:35:31 2026 -0700 accel/amdxdna: Block running when IOMMU is off The AIE2 device firmware requires IOMMU on. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5319 Reviewed-by: Mario Limonciello Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260520223531.1403302-1-lizhi.hou@amd.com commit e97ff8b62d4690c69297f0f6de874f0564cc01a4 Author: Alexander A. Klimov Date: Wed May 20 20:00:44 2026 +0200 io_uring/nop: pass all errors to userspace This fixes an inconsistency where io_nop() called req_set_fail() based on ret, but passed just nop->result to userspace. Originally, ret is a even copy of nop->result, but is set to an error when such happens subsequently. Now that's also passed to userspace. Fixes: a85f31052bce ("io_uring/nop: add support for testing registered files and buffers") Signed-off-by: Alexander A. Klimov Link: https://patch.msgid.link/20260520180045.538533-1-grandmaster@al2klimov.de Signed-off-by: Jens Axboe commit f706e6a4ce75585af979aec3dcbdce68bc76306b Author: Dhabaleshwar Das Date: Thu May 21 00:00:00 2026 +0530 accel/rocket: fix UAF via dangling GEM handle in create_bo rocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via drm_gem_handle_create() early on, then performs several operations that can fail (sgt allocation, drm_mm insert, iommu_map). If any fail after the handle is live, the error path calls drm_gem_shmem_object_free() which kfree's the object without removing the handle from the IDR. This leaves a dangling handle pointing to freed slab memory. Any subsequent ioctl using that handle (PREP_BO, FINI_BO, SUBMIT) calls drm_gem_object_lookup() and dereferences freed memory (UAF). Fix by moving drm_gem_handle_create() to after all fallible operations succeed, matching the pattern used by panfrost, lima, and etnaviv. Also fix drm_mm_insert_node_generic() whose return value was silently overwritten by iommu_map_sgtable() on the next line. Add the missing error check. [tomeu: Move handle creation to the very end] Fixes: 658ebeac3351 ("accel/rocket: Add IOCTL for BO creation") Reported-by: Dhabaleshwar Das Signed-off-by: Dhabaleshwar Das Reviewed-by: Tomeu Vizoso Link: https://patch.msgid.link/20260521165720.2113571-1-tomeu@tomeuvizoso.net Signed-off-by: Tomeu Vizoso commit fb6988b83b4cafe8db63999c1ddff1b7c66d2ff5 Author: Florian Schmaus Date: Thu May 7 10:48:54 2026 +0200 kunit: fix use-after-free in debugfs when using kunit.filter When the kernel is booted with a kunit filter (e.g., kunit.filter="speed!=slow"), the kunit executor dynamically allocates copies of the filtered test suites using kmalloc/kmemdup. During the initial boot execution, kunit_debugfs_create_suite() creates debugfs files (such as /sys/kernel/debug/kunit//run) and permanently stores a pointer to the dynamically allocated suite in the inode's i_private field. Previously, the executor freed this dynamically allocated suite_set immediately after executing the boot-time tests. Because the debugfs nodes were not destroyed, any subsequent interaction with the debugfs `run` file from userspace triggered a use-after-free (UAF). On systems with architectural capabilities, like CHERI RISC-V, this resulted in an immediate fatal hardware exception due to the invalidation of the capability tags on the reclaimed memory. On other architectures, it resulted in silent memory corruption. Fix this UAF by properly coupling the lifetime of the filtered suite memory allocation to the lifetime of the kunit subsystem and its associated VFS nodes. Ownership of the boot-time suite_set is now transferred to a global tracker ('kunit_boot_suites'), and the memory is cleanly released in kunit_exit() during module teardown. Link: https://lore.kernel.org/r/20260507084854.233984-1-florian.schmaus@codasip.com Fixes: e2219db280e3 ("kunit: add debugfs /sys/kernel/debug/kunit//results display") Signed-off-by: Florian Schmaus Reviewed-by: Martin Kaiser Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 0c1a9dce208b4dc265925898e5da98934f7f9266 Author: Samuele Mariotti Date: Thu May 21 12:59:11 2026 +0200 sched_ext: Fix spurious WARN on stale ops_state in ops_dequeue() ops_dequeue() can race with finish_dispatch() and spuriously trigger the "queued task must be in BPF scheduler's custody" warning. ops_dequeue() snapshots p->scx.ops_state via atomic_long_read_acquire() and then, in the SCX_OPSS_QUEUED arm, asserts that SCX_TASK_IN_CUSTODY is set. The two reads are not atomic w.r.t. a concurrent finish_dispatch() running on another CPU: CPU 1 CPU 2 ===== ===== dequeue_task_scx() ops_dequeue() opss = read_acquire(ops_state) = SCX_OPSS_QUEUED finish_dispatch() cmpxchg ops_state: SCX_OPSS_QUEUED -> SCX_OPSS_DISPATCHING [succeeds] dispatch_enqueue(SCX_DSQ_GLOBAL, SCX_ENQ_CLEAR_OPSS) call_task_dequeue() p->scx.flags &= ~SCX_TASK_IN_CUSTODY WARN_ON_ONCE(!(p->scx.flags & SCX_TASK_IN_CUSTODY)) /* opss is stale: QUEUED, * but task already claimed */ set_release(ops_state, SCX_OPSS_NONE) The race has been observed via two distinct call chains: the most common goes through sched_setaffinity(), a rarer variant through sched_change_begin(). For SCX_DSQ_GLOBAL / SCX_DSQ_BYPASS, dispatch_enqueue() clears SCX_TASK_IN_CUSTODY before clearing ops_state to SCX_OPSS_NONE (intentional, to avoid concurrent non-atomic RMW of p->scx.flags against ops_dequeue()). The window between those two writes is exactly what ops_dequeue() observes as "QUEUED without custody". The observed state is not actually inconsistent, it just means CPU 1 has already claimed the task and the QUEUED value held by CPU 2 is stale. Re-read ops_state in that case; the next read is guaranteed to return SCX_OPSS_DISPATCHING or SCX_OPSS_NONE, both of which exit the switch cleanly. The retry is bounded: once IN_CUSTODY is cleared, ops_state has already advanced past QUEUED for this dispatch cycle, and a fresh QUEUED would require re-enqueue under p's rq lock, which CPU 2 holds. Changes in v2: - Use READ_ONCE() for p->scx.flags to ensure fresh reads and prevent compiler reordering in the lockless path - Add cpu_relax() to reduce power consumption and improve performance during the spin-wait - Use unlikely() to optimize branch prediction for the common case - Expand the in-code comment to document the race condition and bounded retry guarantee Fixes: ebf1ccff79c4 ("sched_ext: Fix ops.dequeue() semantics") Suggested-by: Andrea Righi Signed-off-by: Samuele Mariotti Signed-off-by: Paolo Valente Signed-off-by: Tejun Heo commit dcd4313f0987d69c4134c12bbe3a8cdf795f6c1e Author: Fredric Cover Date: Wed May 13 13:19:15 2026 -0700 smb: client: change allocation requirements in DUP_CTX_STR macro Currently, the macro DUP_CTX_STR allocates new_ctx->field using GFP_ATOMIC. DUP_CTX_STR is only used in smb3_fs_context_dup(), which is never called in an atomic context. Using GFP_ATOMIC puts unnecessary pressure on emergency memory pools. Change GFP_ATOMIC to GFP_KERNEL. Signed-off-by: Fredric Cover Signed-off-by: Steve French commit d1ebfce2c1d161186a82e77590bf7da2ea1bce91 Author: Michael Bommarito Date: Sun May 17 20:11:50 2026 -0400 smb: client: require net admin for CIFS SWN netlink CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation currently has no capability flag, so any local process can send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler. The same family exposes CIFS_GENL_MCGRP_SWN without multicast-group capability flags. Register messages sent to that group include the witness registration id and, for NTLM-authenticated mounts, the username, domain, and password attributes copied from the CIFS session. An unprivileged local process should not be able to join that group and receive those messages. Require CAP_NET_ADMIN for incoming SWN_NOTIFY commands with GENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for joining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The cifs.witness service runs with the privileges needed for both operations. Fixes: fed979a7e082 ("cifs: Set witness notification handler for messages from userspace daemon") Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Steve French commit 758c807bb943138f887d42d986b645e12446ba9c Merge: dd3802fc4f6b52 d8809f6931065c Author: Linus Torvalds Date: Thu May 21 08:59:52 2026 -0700 Merge tag 'efi-fixes-for-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - Permit ACPI PRM runtime firmware calls when acpi_init() runs - Add another Lenovo Ideapad framebuffer quirk - Cosmetic tweak * tag 'efi-fixes-for-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: sysfb_efi: Extend quirk to cover IdeaPad Duet 3 10IGL5-LTE efi: efi.h: Remove extra semicolon efi: Allocate runtime workqueue before ACPI init commit c33f944a33d63c65f3506eee6f2ca3771b68454f Merge: bdd39576bf50a5 9e68817f12d593 Author: Jakub Kicinski Date: Thu May 21 08:49:01 2026 -0700 Merge branch 'net-enetc-sr-iov-robustness-and-security-fixes' Wei Fang says: ==================== net: enetc: SR-IOV robustness and security fixes This patch series addresses a number of robustness, security, and correctness issues in the ENETC driver's SR-IOV subsystem, focusing primarily on the VF-to-PF mailbox communication path. The series can be grouped into the following categories: 1. DoS and security fixes: - Prevent an unbounded loop DoS in the VF-to-PF message handler, which could be triggered by a malicious or misbehaving VF. - Fix a TOCTOU (Time-of-Check-Time-of-Use) race and add proper validation of VF MAC addresses to prevent spoofing or invalid configuration from being applied. 2. Race condition fixes: - Fix a race condition in VF MAC address configuration that could lead to inconsistent state between the VF request and PF application. - Fix a race condition during SR-IOV teardown that could cause VF->PF mailbox operations to time out, resulting in unnecessary errors during shutdown. 3. Memory safety fixes: - Fix a DMA write to freed memory in enetc_msg_free_mbx(), which could cause silent memory corruption or system instability. 4. Error handling and initialization fixes: - Fix missing error code propagation when pf->vf_state allocation fails, ensuring callers receive a proper errno instead of succeeding silently. - Fix incorrect mailbox message status values returned to VFs, which could cause VFs to misinterpret PF responses. - Fix initialization order to prevent the use of uninitialized resources during driver probe, which could cause undefined behavior on certain configurations. 5. Diagnostics improvement: - Add rate limiting to VF mailbox error messages to prevent log flooding in the presence of a misbehaving VF. These fixes improve the overall stability and security of the ENETC SR-IOV implementation, particularly in multi-tenant environments where VFs may be assigned to untrusted guests. ==================== Link: https://patch.msgid.link/20260520064421.91569-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 9e68817f12d5935dbf73f2fe6e6299644f6de1b6 Author: Wei Fang Date: Wed May 20 14:44:21 2026 +0800 net: enetc: avoid VF->PF mailbox timeout during SR-IOV teardown During SR-IOV teardown, enetc_msg_psi_free() disables the MR interrupt before pci_disable_sriov() removes the VFs. If a VF sends a mailbox message during this window, the PF cannot receive it, causing the VF to timeout waiting for a reply. Since the timeout occurs during SR-IOV teardown when the VF is about to be removed anyway, it has no functional impact on operation. However, more messages will be added in the future, some visible error logs may confuse users. So fix it by calling pci_disable_sriov() first to remove all VFs, then safely clean up the mailbox resources. This eliminates the race window where VFs could send messages to an unresponsive PF. Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support") Signed-off-by: Wei Fang Reviewed-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20260520064421.91569-10-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 54362b0176080b905dbd0651ee3dbb295da41541 Author: Wei Fang Date: Wed May 20 14:44:20 2026 +0800 net: enetc: fix init and teardown order to prevent use of unsafe resources Sashiko reported a potential issue in enetc_msg_psi_init() where the IRQ handler is registered before DMA resources are fully initialized [1]. The current initialization sequence is: 1. request_irq(enetc_msg_psi_msix) <- IRQ handler registered 2. INIT_WORK(&pf->msg_task, ...) <- work_struct initialized 3. enetc_msg_alloc_mbx() <- mailbox DMA allocated This ordering is unsafe because if a spurious interrupt or pending interrupt from a previous device state fires immediately after request_irq() returns, the registered ISR enetc_msg_psi_msix() will execute and unconditionally call: schedule_work(&pf->msg_task) At this point, pf->msg_task has not been initialized by INIT_WORK(), so the work_struct contains garbage values in its internal linked list pointers (work_struct->entry). Passing an uninitialized work_struct to schedule_work() could corrupt the kernel's workqueue linked lists, potentially leading to: - Kernel panic in __queue_work() - Memory corruption in workqueue data structures - System deadlock or undefined behavior Additionally, even if the work_struct was initialized, the mailbox DMA buffers (pf->rxmsg[]) may not yet be allocated when the work handler enetc_msg_task() runs, resulting in NULL pointer dereference. Fix by reordering the initialization sequence to ensure all resources are properly initialized before the interrupt handler can execute: 1. enetc_msg_alloc_mbx() <- Allocate all mailboxes 2. INIT_WORK(&pf->msg_task, ...) <- Initialize work first 3. request_irq(enetc_msg_psi_msix) <- Register IRQ last 4. Configure hardware & enable MR interrupts This guarantees that when enetc_msg_psi_msix() runs: - pf->msg_task is properly initialized (safe for schedule_work) - pf->rxmsg[] buffers are allocated (safe for work handler access) - Hardware is configured appropriately As the inverse of enetc_msg_psi_init(), enetc_msg_psi_free() also has similar problems. For example, if a pending interrupt fires between enetc_msg_free_mbx() and free_irq(), the ISR enetc_msg_psi_msix() may schedule the work handler again via schedule_work(), which could then access already-freed DMA buffers (pf->rxmsg[]), leading to use-after-free and potential memory corruption. Therefore, the order of enetc_msg_psi_free() is adjusted: 1. enetc_msg_disable_mr_int() <- Stop new interrupts first 2. free_irq() <- Ensure no IRQ handler can run 3. cancel_work_sync() <- Wait for any pending work 4. enetc_msg_disable_mr_int() <- Re-disable in case work re-enabled it 5. enetc_msg_free_mbx() <- Safe to free DMA buffers now Link: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1 Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support") Signed-off-by: Wei Fang Reviewed-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20260520064421.91569-9-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit f8ae63de2a872fa3b68c287c35379f6d73d38a5d Author: Wei Fang Date: Wed May 20 14:44:19 2026 +0800 net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging The enetc_msg_task() function has several issues that need to be addressed: 1. Unbounded loop causing potential DoS: enetc_msg_task() processes VF-to-PF mailbox messages in an unbounded for(;;) loop that keeps polling ENETC_PSIMSGRR until no MR bits are set. A malicious guest VM can exploit this by continuously sending messages at a high rate - immediately sending a new message as soon as the PF acknowledges the previous one. Since the worker thread never yields or enforces a processing budget, the mr_mask check frequently evaluates to non-zero, causing the PF to spin indefinitely and starving other tasks. Fix this by replacing the unbounded loop with a single snapshot read at task entry. The task processes only the VFs whose MR bits were set at that point, then re-enables message interrupts before returning. This bounds work per invocation to at most num_vfs iterations. No messages are lost because the message interrupt is disabled in enetc_msg_psi_msix() before scheduling enetc_msg_task(), so any new messages arriving during processing will trigger a fresh interrupt once re-enabled, scheduling another task invocation. 2. Write order of ENETC_PSIIDR and ENETC_PSIMSGRR: Both ENETC_PSIIDR and ENETC_PSIMSGRR contain MR bits indicating messages have been received from VSIs, but only ENETC_PSIIDR trigger the CPU interrupt. Previously, ENETC_PSIMSGRR was written before ENETC_PSIIDR. Writing ENETC_PSIMSGRR returns the message code to the VSI in its upper 16 bits, signaling to the VF that message processing is complete and it may send the next message. If the VF sends a new message before ENETC_PSIIDR is written, the subsequent w1c write to ENETC_PSIIDR would inadvertently clear the MR bit set by the new message, causing the interrupt to be lost and the new message to go unprocessed. Therefore, write ENETC_PSIIDR first to clear the interrupt source, then write ENETC_PSIMSGRR to acknowledge the message to the VSI. 3. Check both ENETC_PSIMSGRR and ENETC_PSIIDR for mr_status: The write order change above introduces a potential race: if a VF sends a new message in the window between the ENETC_PSIIDR w1c and the ENETC_PSIMSGRR w1c, the ENETC_PSIMSGRR MR bit for the new message may not be set. If mr_status was derived solely from ENETC_PSIMSGRR, this message would never be detected despite ENETC_PSIIDR retaining its MR bit, leading to an unacknowledged interrupt storm. Fix this by computing mr_status as the union of both ENETC_PSIMSGRR and ENETC_PSIIDR MR bits, ensuring all pending messages are detected regardless of which register reflects the new message state. Additionally, rename the per-register MR macros (ENETC_PSI*_MR_MASK, ENETC_PSI*_MR) to register-agnostic names (ENETC_PSIMR_MASK, ENETC_PSIMR_BIT) since the MR bit layout is shared across ENETC_PSIMSGRR, ENETC_PSIIER, and ENETC_PSIIDR. Make the mask macro dynamic based on the actual number of active VFs rather than hardcoded. Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260520064421.91569-8-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit adb4599979cd00d5d426f26cf78b65264217e35b Author: Wei Fang Date: Wed May 20 14:44:18 2026 +0800 net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx() The teardown sequence in enetc_msg_psi_free() frees the DMA buffer before clearing the device's DMA address registers. If a VF sends a message or a pending DMA transfer completes within this window, the hardware will perform a DMA write into the kernel memory that has already been returned to the allocator. The result is silent memory corruption that can affect arbitrary kernel data structures. Therefore, clear the DMA address registers before the DMA buffer is freed. Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support") Signed-off-by: Wei Fang Reviewed-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20260520064421.91569-7-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit f262f5d893327a7131ed25ac8dd01ed7024bcc18 Author: Wei Fang Date: Wed May 20 14:44:17 2026 +0800 net: enetc: fix race condition in VF MAC address configuration Sashiko reported a potential race condition between the VF message handler and administrative VF MAC configuration from the host [1]. The VF message handler (enetc_msg_pf_set_vf_primary_mac_addr) runs asynchronously in a workqueue context and accesses vf_state->flags without any locking. Concurrently, the host can administratively change the VF MAC address via enetc_pf_set_vf_mac(), which executes under RTNL lock and modifies both vf_state->flags and hardware registers. This creates two race windows: 1) TOCTOU race on vf_state->flags: The check of ENETC_VF_FLAG_PF_SET_MAC and subsequent MAC programming are not atomic, allowing the flag state to change between check and use. 2) Torn MAC address writes: Hardware MAC programming requires multiple non-atomic register writes (__raw_writel for lower 32 bits and __raw_writew for upper 16 bits). Concurrent updates from VF mailbox and PF admin paths can interleave these operations, resulting in a corrupted MAC address being programmed into the hardware. Fix by introducing a per-VF mutex to serialize access to vf_state and hardware MAC register updates. Both enetc_pf_set_vf_mac() and enetc_msg_pf_set_vf_primary_mac_addr() now acquire this lock before accessing vf_state->flags or programming the MAC address, ensuring atomic read-modify-write sequences and preventing register write interleaving. Link: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1 Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support") Signed-off-by: Wei Fang Reviewed-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20260520064421.91569-6-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit c666fa632fe628c34904bcd59aeb96bf08e40d31 Author: Wei Fang Date: Wed May 20 14:44:16 2026 +0800 net: enetc: fix TOCTOU race and validate VF MAC address Sashiko reported that the PF driver accepts arbitrary MAC address from from VF mailbox messages without proper validation, creating a security vulnerability [1]. In enetc_msg_pf_set_vf_primary_mac_addr(), the MAC address is extracted directly from the message buffer (cmd->mac.sa_data) and programmed into hardware via pf->ops->set_si_primary_mac() without any validity checks. A malicious VF can configure a multicast, broadcast, or all-zero MAC address. Therefore, a validation to check the MAC address provided by VF is required. However, simply checking the MAC address is not enough, because it also has the potential TOCTOU race [2]: The code reads the MAC address from the DMA buffer to validate it via is_valid_ether_addr(), if validation passes, reads the same DMA buffer a second time when calling enetc_pf_set_primary_mac_addr() to program the hardware. A malicious VF can exploit this window by overwriting the MAC address in the DMA buffer between the validation check and the hardware programming, bypassing the validation entirely. Therefore, allocate a local buffer in enetc_msg_handle_rxmsg() and copy the message content from the DMA buffer via memcpy() before processing. This ensures the PF operates on a stable snapshot that the VF cannot modify. Link: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1 Link: https://sashiko.dev/#/patchset/20260513103021.2190593-1-wei.fang%40nxp.com #2 Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support") Signed-off-by: Wei Fang Reviewed-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20260520064421.91569-5-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 4a995d37b537f437daa01752d39cf44c6ba9ee2c Author: Wei Fang Date: Wed May 20 14:44:15 2026 +0800 net: enetc: add ratelimiting to VF mailbox error messages Sashiko reported that a buggy or malicious guest VM can flood the host kernel log by repeatedly sending VF-to-PF messages at a high rate, degrading host performance and hiding important system logs [1]. Fix by replacing dev_err()/dev_warn() with dev_err_ratelimited(), limiting output to the default kernel ratelimit. This ensures errors are still logged for debugging while preventing log flooding attacks. Link: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1 Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support") Signed-off-by: Wei Fang Reviewed-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20260520064421.91569-4-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 5027266dea471e140f93dd534845c9c4f43219a3 Author: Wei Fang Date: Wed May 20 14:44:14 2026 +0800 net: enetc: fix missing error code when pf->vf_state allocation fails In enetc_pf_probe(), when the memory allocation for pf->vf_state fails, the code jumps to the error handling label but the variable 'err' is not assigned an appropriate error code beforehand. This causes the function to return 0 (success) on an allocation failure path, misleading the caller into thinking the probe succeeded. So set err to -ENOMEM before jumping to the error handling label when the allocation for pf->vf_state returns NULL. Fixes: e15c5506dd39 ("net: enetc: allocate vf_state during PF probes") Signed-off-by: Wei Fang Reviewed-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20260520064421.91569-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 8c84c5ec4aaff6ad7aac49935e050fed6b360a28 Author: Wei Fang Date: Wed May 20 14:44:13 2026 +0800 net: enetc: fix incorrect mailbox message status returned to VFs There are two cases where VFs receive an incorrect success status from the PF mailbox message handler, misleading them into believing their requests have been fulfilled: In enetc_msg_handle_rxmsg(), *status is pre-initialized to ENETC_MSG_CMD_STATUS_OK. When an unsupported command type is received, the default case only logs an error without updating *status, so it remains as ENETC_MSG_CMD_STATUS_OK. In enetc_msg_pf_set_vf_primary_mac_addr(), when the PF has already assigned a MAC address for the VF (ENETC_VF_FLAG_PF_SET_MAC is set), the function rejects the request but returns ENETC_MSG_CMD_STATUS_OK instead of ENETC_MSG_CMD_STATUS_FAIL. Therefore, correct the status value for the two cases mentioned above. Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support") Signed-off-by: Wei Fang Reviewed-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20260520064421.91569-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit bdd39576bf50a50bdafe3da968fd271bc674a48f Author: Eric Dumazet Date: Wed May 20 11:42:07 2026 +0000 net: bridge: prevent too big nested attributes in br_fill_linkxstats() After commit ff205bf8c554 ("netlink: add one debug check in nla_nest_end()") syzbot found that br_fill_linkxstats() can send corrupted netlink packets. Make sure the nested attribute size is bounded. Fixes: a60c090361ea ("bridge: netlink: export per-vlan stats") Reported-by: syzbot+a35f9259d08f907c06e6@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a0b0da3.050a0220.175f0c.0000.GAE@google.com/ Signed-off-by: Eric Dumazet Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260520114207.1394241-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 979c017803c40829b03acd9e5236e354b7622360 Author: Michael Bommarito Date: Mon May 18 14:34:47 2026 -0400 l2tp: use list_del_rcu in l2tp_session_unhash An unprivileged local user can pin a host CPU indefinitely in l2tp_session_get_by_ifname() by issuing L2TP_CMD_SESSION_GET on L2TP_ATTR_IFNAME concurrently with L2TP_CMD_SESSION_CREATE and L2TP_CMD_SESSION_DELETE on the same tunnel. All three commands take GENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN in the netns user namespace suffices; on any host that has l2tp_core loaded the trigger is reachable from a standard `unshare -Urn` sandbox. l2tp_session_unhash() removes a session from tunnel->session_list with list_del_init(), but that list is walked by l2tp_session_get_by_ifname() with list_for_each_entry_rcu() under rcu_read_lock_bh(). list_del_init() leaves the deleted entry's next/prev self-pointing; a reader that has loaded the entry and then advances pos->list.next reads &session->list, container_of()s back to the same session, and list_for_each_entry_rcu() never reaches the list head. The CPU stays in strcmp() inside the walker, with BH and preemption disabled, so RCU grace periods on the host stall behind it and the wedged thread cannot be killed (SIGKILL is delivered on syscall return). Use list_del_rcu() to match the existing list_add_rcu() in l2tp_session_register(); the deleted session remains visible to in-flight walkers with consistent next/prev pointers until kfree_rcu() in l2tp_session_free() releases it. tunnel->session_list has exactly one list_del_init() call site; the list_del_init (&session->clist) at l2tp_core.c:533 operates on the per-collision list, which is not walked under RCU. list_empty(&session->list) is not used anywhere in net/l2tp/ after the unhash point, so dropping the post-delete self-init is safe; the fix has no userspace-visible behavior change. Fixes: 89b768ec2dfef ("l2tp: use rcu list add/del when updating lists") Cc: stable@vger.kernel.org # 6.11+ Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260518183447.64078-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski commit dd3802fc4f6b52201a93330d44981a66bd6ef883 Merge: 8bc67e4db64aa7 1fcf4149418e7a Author: Linus Torvalds Date: Thu May 21 08:43:26 2026 -0700 Merge tag 'soc-fixes-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: - The ff-a firmware driver gets 11 individual bugfixes for a number of issues with robustness to buggy firmware or client implementations. Another firmware fix address suspend to RAM via PSCI firmware. - The final code change is for the old Arm Integrator reference platform that recently started exposing an old NULL pointer dereference bug. - The MAINTAINERS file gets two updates, notably James Tai and Yu-Chun Lin are stepping up as co-maintainers for the Realtek platform. - The remaining patches are all for devicetree files. Two of these are for riscv boards, the rest are all for enesas Arm platforms, addressing build time checking issues as well as minor configuration problems. * tag 'soc-fixes-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (30 commits) firmware: psci: Set pm_set_resume/suspend_via_firmware() for SYSTEM_SUSPEND ARM: realtek: MAINTAINERS: Include pin controller drivers MAINTAINERS: Add maintainers for ARM/REALTEK ARCHITECTURE ARM: integrator: Fix early initialization firmware: arm_ffa: Fix sched-recv callback partition lookup firmware: arm_ffa: Snapshot notifier callbacks under lock firmware: arm_ffa: Align RxTx buffer size before mapping firmware: arm_ffa: Validate framework notification message layout firmware: arm_ffa: Keep framework RX release under lock firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0 firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue firmware: arm_ffa: Avoid collapsing NPI work from different CPUs firmware: arm_ffa: Skip free_pages on RX buffer alloc failure firmware: arm_ffa: Check for NULL FF-A ID table while driver registration riscv: dts: microchip: fix icicle i2c pinctrl configuration riscv: dts: starfive: jh7110: Drop CAMSS node arm64: dts: renesas: r9a09g056: Add #mux-state-cells to usb20phyrst arm64: dts: renesas: r9a09g057: Add #mux-state-cells to usb2{0,1}phyrst ARM: dts: renesas: rskrza1: Drop superfluous cells ... commit 9a1730245e416d11ad5c0f2c100061d61cc43f60 Author: Nicolai Buchwitz Date: Wed May 20 20:43:20 2026 +0200 net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to DMA, so rx_packets is no longer incremented at the netdev level. On some boards the corruption ends up as a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. Reproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian Fainelli on an internal Broadcom 4908-family board with the same crash signature. RBUF_PM_EN is not publicly documented. This shows up more often now that phy_support_eee() enables EEE by default, but it also affects older kernels as soon as TX LPI is turned on via ethtool, so it is not specific to recent changes. Always clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so the bits stay off across resets. UMAC and TBUF setup is left alone so TX-side EEE keeps working. Link: https://github.com/raspberrypi/linux/issues/7304 Fixes: 6ef398ea60d9 ("net: bcmgenet: add EEE support") Cc: stable@vger.kernel.org Signed-off-by: Nicolai Buchwitz Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260520184320.652053-1-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit 8f0f5c4fb9df0e19a341e0c6ed8dc4fda9124f03 Author: Masami Hiramatsu (Google) Date: Thu May 21 13:49:14 2026 +0900 tracing: Do not call map->ops->elt_free() if elt_alloc() fails In paths where tracing_map_elt_alloc() failed to allocate objects, the map->ops->elt_alloc() call was never successful. In this case, map->ops->elt_free() should not be called. Link: https://sashiko.dev/#/patchset/20260520223101.34710-1-rosenp%40gmail.com Cc: stable@vger.kernel.org Cc: Tom Zanussi Cc: Mathieu Desnoyers Cc: Rosen Penev Reported-by: Sashiko Fixes: 2734b629525a ("tracing: Add per-element variable support to tracing_map") Link: https://patch.msgid.link/177933895460.108746.5396070821443932634.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt commit c5fcca7f662f0c0918eac60ea193bf65a36863e3 Merge: 3287e81292f49d 014767c709a44b Author: Jakub Kicinski Date: Thu May 21 08:28:58 2026 -0700 Merge branch 'ethernet-3c509-bring-driver-back-and-make-some-fixes' Maciej W. Rozycki says: ==================== ethernet: 3c509: Bring driver back and make some fixes As per the previous discussions[1][2] this patch series brings the 3c509 driver back. Picking up net rather than net-next as I consider it a fix to accidental removal and so that any downstream users do not suffer from disruption when using released kernels. In the course of making the coding style changes requested I have come across an actual bug in transceiver type selection code, where the old setting is not masked out before ORing in the new one, causing no change to be actually made in a requested transition from BNC to AUI. I guess this code must have been executed exceedingly rarely, as it's always been wrong ever since it was added in 2.5.42 back in 2002. Therefore I find it not worth backporting to stable branches, however for the sake of appropriateness, in case someone downstream does want to have the fix, I chose to apply it second in the series, right after the actual revert and before code clean-ups. The remaining patches of the series should be obvious; see the respective commit descriptions for details. [1] "drivers: net: 3com: 3c509: Remove this driver", . [2] "MAINTAINERS: Add self for the 3c509 network driver", . ==================== Link: https://patch.msgid.link/alpine.DEB.2.21.2605201115010.1450@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit 014767c709a44b4e0a0bf70ee9101fb73f4e288b Author: Maciej W. Rozycki Date: Wed May 20 12:19:06 2026 +0100 ethernet: 3c509: Fix most coding style issues Update the driver for our current coding style according to output from `checkpatch.pl' and manual code review, where no change to binary code results, as indicated by `objdump -dr'. Exceptions are as follows: - incomplete reverse xmas tree in set_multicast_list(), as that would change binary output, - referring el3_start_xmit() verbatim rather than via `__func__' with pr_debug(), likewise, - a bunch of pr_cont() calls, likewise, - a long udelay() call in el3_netdev_set_ecmd() made under a spinlock, likewise plus it's not eligible for conversion to a sleep in the first place, - a blank line at the start of a block in el3_interrupt(), to improve readability where the first statement would otherwise visually merge with the controlling expression of the enclosing `while' statement. These issues are benign and depending on circumstances may be adressed with suitable code refactoring later on. Signed-off-by: Maciej W. Rozycki Link: https://patch.msgid.link/alpine.DEB.2.21.2605201208280.1450@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit 75756cb4b2aa148816b32d7d40c1f79f9a11eef6 Author: Maciej W. Rozycki Date: Wed May 20 12:19:02 2026 +0100 ethernet: 3c509: Update documentation to match MAINTAINERS There has been apparently a single message only ever publicly posted by David Ruggiero, back in 2002, which added this documentation piece among others, and MAINTAINERS was never updated accordingly. It is therefore doubtful that his maintainer status has actually come into effect. Just replace the reference then so as not to confuse people. Signed-off-by: Maciej W. Rozycki Link: https://patch.msgid.link/alpine.DEB.2.21.2605201207380.1450@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit 240117bb51b95ce93ec28c7c9439c9a87d7b120c Author: Maciej W. Rozycki Date: Wed May 20 12:18:57 2026 +0100 ethernet: 3c509: Add GPL 2.0 SPDX license identifier This driver has landed with Linux 0.99.13k, which was covered by the GNU General Public License version 2, and no further conditions as to licensing terms have been specified within the copyright notice included with the driver itself. Signed-off-by: Maciej W. Rozycki Link: https://patch.msgid.link/alpine.DEB.2.21.2605201206370.1450@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit 029a6b3a14bf02e6f59ce6ecd10f9d003334c612 Author: Maciej W. Rozycki Date: Wed May 20 12:18:53 2026 +0100 ethernet: 3c509: Fix AUI transceiver type selection The transceiver type is held in bits 15:14 of the Address Configuration Register, with the values of 0b00, 0b01, and 0b11 denoting TP, AUI, and BNC types respectively. Therefore switching from BNC to AUI requires bits to be cleared before setting bit 14 or the setting won't change. NB this has always been wrong ever since this code was added in 2.5.42. Signed-off-by: Maciej W. Rozycki Link: https://patch.msgid.link/alpine.DEB.2.21.2605201205160.1450@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit 28db0338db61ec75d146192463907351907a0dbc Author: Maciej W. Rozycki Date: Wed May 20 12:18:49 2026 +0100 Revert "drivers: net: 3com: 3c509: Remove this driver" This reverts commit 91f3a27ae9f66d81a5906461762c37c8a2bcab06. Contrary to the assumption stated with the original commit description this driver is in use and I'm going to maintain it for the foreseeable future. Signed-off-by: Maciej W. Rozycki Link: https://patch.msgid.link/alpine.DEB.2.21.2605201204260.1450@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit 3287e81292f49dca2f253113c458e8f3d4ea091b Author: Ilya Maximets Date: Wed May 20 19:22:37 2026 +0200 tools: ynl: support listening on all nsids A new method ntf_listen_all_nsid() to enable listening on events from all namespaces. Useful for testing cross-namespace functionality. recv() replaced with recvmsg() to be able to receive NSID through the ancillary data. Signed-off-by: Ilya Maximets Link: https://patch.msgid.link/20260520172317.175168-4-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 4db79a322db8c97f7b73b8a347395ef4d685eb40 Author: Sabrina Dubroca Date: Wed May 20 22:44:42 2026 +0200 net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs. Fixes: 753f1ca4e1e5 ("net: introduce managed frags infrastructure") Reported-by: Huzaifa Sidhpurwala Signed-off-by: Sabrina Dubroca Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/c3b7f906bbfcbdfd7b4fa9d6c18a438870df85be.1779307748.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 3d4432d34c1992701289cbe12df9fd024f315998 Author: Nikhil P. Rao Date: Wed May 20 20:58:42 2026 +0000 pds_core: ensure null-termination for firmware version strings The driver passes fw_version directly to devlink_info_version_stored_put() without ensuring null-termination. While current firmware null-terminates these strings, the driver should not rely on this behavior. Add explicit null-termination to prevent potential issues if firmware behavior changes. Fixes: 45d76f492938 ("pds_core: set up device and adminq") Signed-off-by: Nikhil P. Rao Link: https://patch.msgid.link/20260520205842.1486718-1-nikhil.rao@amd.com Signed-off-by: Jakub Kicinski commit 985d4a55e64e43bd86eeb896b81ceba453301989 Author: Lorenzo Bianconi Date: Wed May 20 15:12:02 2026 +0200 net: airoha: Disable GDM2 forwarding before configuring GDM2 loopback Hw design requires to disable GDM2 forwarding before configuring GDM2 loopback in airoha_set_gdm2_loopback routine. Fixes: 9cd451d414f6e ("net: airoha: Add loopback support for GDM2") Tested-by: Madhur Agrawal Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260520-airoha-disable-gdm2-fwd-v1-1-1eeea5dffc2f@kernel.org Signed-off-by: Jakub Kicinski commit e46e6bc97fb1f339730ff1ba74267fbf48e7a422 Author: Justin Iurman Date: Wed May 20 14:42:42 2026 +0200 ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In ipv6_hop_ioam(), the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skb_ensure_writable(), which might reallocate the buffer: if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len)) goto drop; /* Trace pointer may have changed */ trace = (struct ioam6_trace_hdr *)(skb_network_header(skb) + optoff + sizeof(*hdr)); ioam6_fill_trace_data(skb, ns, trace, true); ioam6_event(IOAM6_EVENT_TRACE, dev_net(skb->dev), GFP_ATOMIC, (void *)trace, hdr->opt_len - 2); If the skb is cloned or lacks sufficient linear headroom, skb_ensure_writable() will invoke pskb_expand_head(), which reallocates the skb's data buffer and frees the old one, invalidating pointers to it. While the code recalculates the trace pointer immediately after the call to skb_ensure_writable(), it fails to recalculate the hdr pointer. This patch fixes the above by recalculating the hdr pointer before passing hdr->opt_len to ioam6_event(), so that we avoid any UaF. Fixes: f655c78d6225 ("net: exthdrs: ioam6: send trace event") Cc: stable@vger.kernel.org Signed-off-by: Justin Iurman Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260520124242.32320-1-justin.iurman@gmail.com Signed-off-by: Jakub Kicinski commit bddc09212c24934643bd44fc794748d2bbb3b6cd Author: Weiming Shi Date: Wed May 20 00:57:38 2026 -0700 tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an uninitialised on-stack struct sockaddr_storage to userspace via ifr_hwaddr, but netif_get_mac_address() only writes sa_family and dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised. Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a macvtap chardev returns kernel .text and direct-map pointers, defeating KASLR. Initialise ss at declaration. Fixes: 3b23a32a6321 ("net: fix dev_ifsioc_locked() race condition") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260520075736.3415676-3-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit 2bccfb8476ca5f3548afbd623dc7a6980d4e77de Author: Dawei Feng Date: Wed May 20 15:03:23 2026 +0800 qed: fix double free in qed_cxt_tables_alloc() If one of the later PF or VF CID bitmap allocations fails, qed_cid_map_alloc() jumps to cid_map_fail and frees the previously allocated CID bitmaps before returning an error. qed_cxt_tables_alloc() then calls qed_cxt_mngr_free(), which invokes qed_cid_map_free() again. Fix this by setting each CID bitmap pointer to NULL after bitmap_free() to avoid double free. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3. Runtime reproduction was not attempted because exercising the failing allocation path requires device-specific setup. Fixes: fe56b9e6a8d9 ("qed: Add module with basic common support") Cc: stable@vger.kernel.org Signed-off-by: Zilin Guan Signed-off-by: Dawei Feng Link: https://patch.msgid.link/20260520070323.2762379-1-dawei.feng@seu.edu.cn Signed-off-by: Jakub Kicinski commit b809d0409991b75a6cff846a5ac27c3062953f84 Author: Aditya Garg Date: Tue May 19 22:15:53 2026 -0700 net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Signed-off-by: Aditya Garg Reviewed-by: Haiyang Zhang Link: https://patch.msgid.link/20260520051553.857120-1-gargaditya@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 9eddc819f00b5b74bb4ac91396f80bd35f5f3561 Author: Ratheesh Kannoth Date: Wed May 20 10:00:36 2026 +0530 octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs When installing the allmulticast NPC rule, rvu_npc_install_allmulti_entry() should skip LBK and SDP VFs (only CGX PF/VF may add the entry). The code combined is_lbk_vf() and is_sdp_vf() with logical AND, which is never true for a single pcifunc, so the intended early return never ran. Use logical OR instead. Cc: Geetha sowjanya Fixes: ae703539f49d2 ("octeontx2-af: Cleanup loopback device checks") Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260520043036.1523798-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit da7f96a68c39de9eb1c351a261e7fbf716375c91 Author: Louis Clinckx Date: Fri May 15 14:57:40 2026 +0000 HID: lenovo-go: drop dead NULL check on to_usb_interface() to_usb_interface() is a container_of_const() macro: it performs pointer arithmetic and never returns NULL. The if (!intf) and if (intf) tests in get_endpoint_address() can never fire. Remove them in both drivers. No functional change. Suggested-by: Derek J. Clark Signed-off-by: Louis Clinckx Reviewed-by: Derek J. Clark Tested-by: Derek J. Clark Signed-off-by: Benjamin Tissoires commit 2ee7e632405b022319f42c01635eb6fbbd86414a Author: Louis Clinckx Date: Fri May 15 14:57:39 2026 +0000 HID: lenovo-go: reject non-USB transports in probe These drivers only match HID_USB_DEVICE() entries and assume the underlying bus is USB. Make that explicit at probe by rejecting any non-USB hdev, following the pattern used by other HID drivers. Signed-off-by: Louis Clinckx Reviewed-by: Derek J. Clark Tested-by: Derek J. Clark Signed-off-by: Benjamin Tissoires commit 94449463d2ab125067adccc2b0c2d7cd753edfb4 Merge: 431e40042d3599 1bf86336e4b6cf Author: Jens Axboe Date: Thu May 21 09:12:40 2026 -0600 Merge tag 'nvme-7.1-2026-05-21' of git://git.infradead.org/nvme into block-7.1 Pull NVMe fixes from Keith: "- Fix memory leak for peer-to-peer addresses - Fix dma map leaks on resource errors" * tag 'nvme-7.1-2026-05-21' of git://git.infradead.org/nvme: nvme-pci: fix dma mapping leak on data setup error nvme-pci: fix dma_vecs leak on p2p memory commit c7ee0b73c8c4dfb7eafa49aaef5247890862a948 Author: Kean Date: Thu May 14 20:58:38 2026 +0800 HID: lenovo: Fix buffer over-read and unaligned access in X12 Tab raw_event handler In lenovo_raw_event(), the X12 Tab keyboard handler reads a 4-byte little-endian value from the raw HID report buffer but: 1. The size guard is size >= 3, while the access reads 4 bytes. A malformed 3-byte report with ID 0x03 would over-read the buffer by one byte. 2. Casting u8 *data directly to __le32 * can trigger unaligned access faults on architectures like ARM, MIPS, and SPARC, because HID input buffers carry no alignment guarantee. (e.g. uhid payloads start at offset 6 in struct uhid_event, giving only 2-byte alignment.) Fix both by tightening the size check to >= 4 and replacing the open-coded cast + le32_to_cpu() with get_unaligned_le32(), which handles the LE-to-CPU conversion safely regardless of alignment. Link: https://sashiko.dev/#/message/20260512044911.99B6DC2BCB0%40smtp.kernel.org Assisted-by: CLAUDE:claude-4-sonnet Signed-off-by: Kean Signed-off-by: Benjamin Tissoires commit c367b9082194d01cb38bdefac6e887ebf1ab017d Author: Zhang Cen Date: Tue May 19 18:46:47 2026 +0800 netpoll: normalize skb->dev to the netpoll device __netpoll_send_skb() always transmits through np->dev and queues busy packets on np->dev->npinfo->txq, but it leaves skb->dev unchanged. Stacked callers such as DSA and macvlan can reach netpoll with skb->dev still naming the upper device while np->dev is the lower device that owns the netpoll state. If the skb has to be deferred, queue_process() later dequeues it from the lower device's txq but retries it through skb->dev. That can re-enter the upper ndo_start_xmit path on an already transformed skb, and if the upper device disappears before the lower txq drains the workqueue can dereference a stale skb->dev pointer. The buggy scenario involves two paths, with each column showing the order within that path: path A label: netpoll enqueue path path B label: upper-device teardown 1. Stacked xmit calls netpoll 1. Teardown unregisters the upper with lower np->dev and upper net_device while lower npinfo skb->dev. stays alive. 2. __netpoll_send_skb() uses 2. netdev_release() runs for the np->dev->npinfo as the txq upper net_device. owner. 3. Busy transmit queues the skb 3. The lower txq still owns the on that lower txq with upper deferred skb. skb->dev. 4. queue_process() drains the 4. queue_process() dereferences lower txq and reads skb->dev. that stale upper skb->dev. Normalize skb->dev to np->dev after loading np->dev from the netpoll instance, before either the direct transmit path or the fallback enqueue. This keeps the queued skb in the same device and txq domain as the netpoll state that owns it. KASAN report as below: KASAN slab-use-after-free in queue_process+0x7c/0x480 Workqueue: events queue_process The buggy address belongs to the object at ffff88810906c000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 168 bytes inside of freed 4096-byte region [ffff88810906c000, ffff88810906d000) Read of size 8 Call trace: dump_stack_lvl+0x73/0xb0 (?:?) print_report+0xd1/0x620 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x215/0x420 (?:?) kasan_complete_mode_report_info+0x64/0x200 (?:?) kasan_report+0xf7/0x130 (?:?) queue_process+0x7c/0x480 (net/core/netpoll.c:88) kasan_check_range+0x10c/0x1c0 (?:?) __kasan_check_read+0x15/0x20 (?:?) process_one_work+0x8b7/0x1af0 (kernel/workqueue.c:3200) assign_work+0x170/0x3f0 (?:?) worker_thread+0x574/0xf10 (?:?) _raw_spin_unlock_irqrestore+0x4b/0x60 (?:?) trace_hardirqs_on+0x2a/0x180 (?:?) kthread+0x2fc/0x3f0 (?:?) ret_from_fork+0x58b/0x830 (?:?) __switch_to+0x58e/0xe90 (?:?) __switch_to_asm+0x39/0x70 (?:?) ret_from_fork_asm+0x1a/0x30 (?:?) Freed by task stack: kasan_save_stack+0x3d/0x60 (?:?) kasan_save_track+0x18/0x40 (?:?) kasan_save_free_info+0x3f/0x60 (?:?) __kasan_slab_free+0x48/0x70 (?:?) kfree+0x20e/0x4e0 (?:?) kvfree+0x31/0x40 (?:?) netdev_release+0x71/0x90 (net/core/net-sysfs.c:2227) device_release+0xd2/0x250 (?:?) kobject_put+0x181/0x4c0 (lib/kobject.c:730) netdev_run_todo+0x700/0x1000 (net/core/dev.c:11666) rtnl_dellink+0x396/0xc00 (net/core/rtnetlink.c:3558) rtnetlink_rcv_msg+0x740/0xc20 (net/core/rtnetlink.c:6897) netlink_rcv_skb+0x147/0x3a0 (?:?) rtnetlink_rcv+0x19/0x20 (net/core/rtnetlink.c:7021) netlink_unicast+0x4d1/0x830 (net/netlink/af_netlink.c:1327) netlink_sendmsg+0x840/0xe10 (net/netlink/af_netlink.c:1812) ____sys_sendmsg+0x8a7/0xb50 (?:?) ___sys_sendmsg+0x104/0x190 (?:?) __sys_sendmsg+0x135/0x1d0 (?:?) __x64_sys_sendmsg+0x7b/0xc0 (?:?) x64_sys_call+0x205c/0x2130 (?:?) do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?) Fixes: 5de4a473bda4 ("netpoll queue cleanup") Signed-off-by: Zhang Cen Link: https://patch.msgid.link/20260519104647.3517990-1-rollkingzzc@gmail.com Signed-off-by: Jakub Kicinski commit c5d93b2c40355e999715262a824965aac025a427 Author: Abdun Nihaal Date: Tue May 19 11:57:39 2026 +0530 net: wwan: iosm: fix potential memory leaks in ipc_imem_init() The memory allocated in ipc_protocol_init() is not freed on the error paths that follow in ipc_imem_init(). Fix that by calling the corresponding release function ipc_protocol_deinit() in the error path. Fixes: 3670970dd8c6 ("net: iosm: shared memory IPC interface") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20260519062815.55545-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski commit 373452ac0649846431ca0f88574a2fa6382d2045 Author: Vincent Donnefort Date: Wed May 20 23:08:30 2026 +0100 KVM: arm64: Fix CONFIG_PKVM_DISABLE_STAGE2_ON_PANIC A typo in the config guard in __hyp_do_panic broke the stage-2 disabling and made backtraces for pKVM quite unreliable. Fix that typo. Fixes: 9019e82c7e46 ("KVM: arm64: Add PKVM_DISABLE_STAGE2_ON_PANIC") Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260520220830.273289-1-vdonnefort@google.com Signed-off-by: Marc Zyngier commit d98d413ca65d0790a8f3695d0a5845538958ab84 Author: Myrrh Periwinkle Date: Tue May 19 18:41:40 2026 +0700 usb: typec: ucsi: Don't update power_supply on power role change if not connected We only need to update the power_supply on power role change if the port is connected, because otherwise the online status should be the same for both cases. Cc: stable Fixes: 7616f006db07 ("usb: typec: ucsi: Update power_supply on power role change") Signed-off-by: Myrrh Periwinkle Reported-and-tested-by: Sergey Senozhatsky Link: https://patch.msgid.link/20260519-ucsi-fix-2-v1-2-6f1239535187@qtmlabs.xyz Signed-off-by: Greg Kroah-Hartman commit b80e7d34c7ea6a564525119d6138fbb577a23dba Author: Myrrh Periwinkle Date: Tue May 19 18:41:39 2026 +0700 usb: typec: ucsi: Check if power role change actually happened before handling The CrOS EC may send a connector status change event with the power direction changed flag set even if the power direction hasn't actually changed after initiating a SET_PDR command internally [1]. In practice this happens on every system suspend due to other changes performed by the EC [2][3][4], causing suspend to fail. Fix this by checking if the power role change actually happened before handling it. [1]: https://source.chromium.org/chromiumos/chromiumos/codesearch/+/main:src/platform/ec/zephyr/subsys/pd_controller/pdc_power_mgmt.c;l=1689;drc=2d5a1cffce4e5ac8a39442cb3b764d2d5e1cf794 [2]: https://source.chromium.org/chromiumos/chromiumos/codesearch/+/main:src/platform/ec/zephyr/subsys/pd_controller/pdc_power_mgmt.c;l=3923;drc=2d5a1cffce4e5ac8a39442cb3b764d2d5e1cf794 [3]: https://source.chromium.org/chromiumos/chromiumos/codesearch/+/main:src/platform/ec/zephyr/subsys/pd_controller/pdc_power_mgmt.c;l=5094;drc=2d5a1cffce4e5ac8a39442cb3b764d2d5e1cf794 [4]: https://source.chromium.org/chromiumos/chromiumos/codesearch/+/main:src/platform/ec/zephyr/subsys/pd_controller/pdc_power_mgmt.c;l=2229;drc=2d5a1cffce4e5ac8a39442cb3b764d2d5e1cf794 Cc: stable Fixes: 7616f006db07 ("usb: typec: ucsi: Update power_supply on power role change") Signed-off-by: Myrrh Periwinkle Reported-and-tested-by: Sergey Senozhatsky Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260519-ucsi-fix-2-v1-1-6f1239535187@qtmlabs.xyz Signed-off-by: Greg Kroah-Hartman commit c06e6cd488194e37ed4dc29d1488d1ffb760de60 Author: Sebastian Reichel Date: Wed Apr 29 18:33:32 2026 +0200 usb: typec: tcpm: improve handling of DISCOVER_MODES failures UGREEN USB-C Multifunction Adapter Model CM512 (AKA "Revodok 107") exposes two SVIDs: 0xff01 (DP Alt Mode) and 0x1d5c. The DISCOVER_MODES step succeeds for 0xff01 and gets a NAK for 0x1d5c. Currently this results in DP Alt Mode not being registered either, since the modes are only registered once all of them have been discovered. The NAK results in the processing being stopped and thus no Alt modes being registered. Improve the situation by handling the NAK gracefully and continue processing the other modes. Before this change, the TCPM log ends like this: (more log entries before this) [ 5.028287] AMS DISCOVER_SVIDS finished [ 5.028291] cc:=4 [ 5.040040] SVID 1: 0xff01 [ 5.040054] SVID 2: 0x1d5c [ 5.040082] AMS DISCOVER_MODES start [ 5.040096] PD TX, header: 0x1b6f [ 5.050946] PD TX complete, status: 0 [ 5.059609] PD RX, header: 0x264f [1] [ 5.059626] Rx VDM cmd 0xff018043 type 1 cmd 3 len 2 [ 5.059640] AMS DISCOVER_MODES finished [ 5.059644] cc:=4 [ 5.069994] Alternate mode 0: SVID 0xff01, VDO 1: 0x000c0045 [ 5.070029] AMS DISCOVER_MODES start [ 5.070043] PD TX, header: 0x1d6f [ 5.081139] PD TX complete, status: 0 [ 5.087498] PD RX, header: 0x184f [1] [ 5.087515] Rx VDM cmd 0x1d5c8083 type 2 cmd 3 len 1 [ 5.087529] AMS DISCOVER_MODES finished [ 5.087534] cc:=4 (no further log entries after this point) After this patch the TCPM log looks exactly the same, but then continues like this: [ 5.100222] Skip SVID 0x1d5c (failed to discover mode) [ 5.101699] AMS DFP_TO_UFP_ENTER_MODE start (log goes on as the system initializes DP AltMode) Cc: stable Fixes: 41d9d75344d9 ("usb: typec: tcpm: add discover svids and discover modes support for sop'") Reviewed-by: Heikki Krogerus Signed-off-by: Sebastian Reichel Reviewed-by: RD Babiera Reviewed-by: Badhri Jagan Sridharan Link: https://patch.msgid.link/20260429-tcpm-discover-modes-nak-fix-v4-1-75945d0ed30f@collabora.com Signed-off-by: Greg Kroah-Hartman commit c8778ff817a7047d6848fefba99dcb27b1bf01fe Author: Yongchao Wu Date: Thu May 14 00:00:12 2026 +0800 usb: cdns3: gadget: fix request skipping after clearing halt According to the cdns3 datasheet, the EPRST (Endpoint Reset) command causes the DMA engine to reposition its internal pointer to the next Transfer Descriptor (TD) if it was already processing one. This issue is consistently observed during the ADB identification process on macOS hosts, where the host issues a Clear_Halt. Although commit 4bf2dd65135a ("usb: cdns3: gadget: toggle cycle bit before reset endpoint") attempted to avoid DMA advance by toggling the cycle bit, trace logs show that on certain hosts like macOS, the DMA pointer (EP_TRADDR) still shifts after EPRST: cdns3_ctrl_req: Clear Endpoint Feature(Halt ep1out) cdns3_doorbell_epx: ep1out, ep_trbaddr f9c04030 <-- Should be f9c04000 cdns3_gadget_giveback: ep1out: req: ... length: 16384/16384 As shown above, the DMA pointer jumped to the next TD, causing the controller to skip the initial TRBs of the request. This leads to data misalignment and ADB protocol hangs on macOS. Fix this by manually restoring the EP_TRADDR register to the starting physical address of the current request after the EPRST operation is complete. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Cc: stable Cc: Peter Chen Signed-off-by: Yongchao Wu Acked-by: Peter Chen Link: https://patch.msgid.link/20260513160012.2547894-1-yongchao.wu@autochips.com Signed-off-by: Greg Kroah-Hartman commit ae6f3b82324e4f39ad8443c9020787e6fc889637 Author: Peter Chen Date: Wed May 13 16:53:10 2026 +0800 usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles Call pm_runtime_allow(dev) conditionally at cdns3_plat_remove. Fixes: f738957277ba ("usb: cdns3: Split core.c into cdns3-plat and core.c file") Cc: stable Reported-by: sashiko-bot Closes: https://lore.kernel.org/linux-devicetree/agKaEePSFknhDBg2@nchen-desktop/T/#m21e1d9c1574eb127ce03c0c2a1a49002ce435b52 Signed-off-by: Peter Chen Link: https://patch.msgid.link/20260513085310.2217547-3-peter.chen@cixtech.com Signed-off-by: Greg Kroah-Hartman commit e6970cda63fd4b4546aeed9d0e2f53a7c95cd09c Author: Peter Chen Date: Wed May 13 16:53:09 2026 +0800 usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure Move usb2_phy initialization after usb3_phy acquisition. Fixes: f738957277ba ("usb: cdns3: Split core.c into cdns3-plat and core.c file") Cc: stable Reported-by: sashiko-bot Closes: https://lore.kernel.org/linux-devicetree/agKaEePSFknhDBg2@nchen-desktop/T/#m21e1d9c1574eb127ce03c0c2a1a49002ce435b52 Signed-off-by: Peter Chen Link: https://patch.msgid.link/20260513085310.2217547-2-peter.chen@cixtech.com Signed-off-by: Greg Kroah-Hartman commit 07466fc91c55532edcfb5c6a7ccd2ea52728d6bd Author: hlleng Date: Tue May 12 09:57:37 2026 +0800 HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse The SIGMACHIP USB mouse with VID/PID 1c4f:0034 can disconnect and re-enumerate repeatedly after it has been enumerated if its interrupt endpoint is not continuously polled. This was observed with the device reporting itself as "SIGMACHIP Usb Mouse". Keeping the input event device open avoids the disconnects. Add HID_QUIRK_ALWAYS_POLL for this device so the HID core keeps polling it even when there is no userspace input consumer. Cc: stable@vger.kernel.org Signed-off-by: hlleng Signed-off-by: Benjamin Tissoires commit 1bf86336e4b6cf40873fda47a7fe191446864937 Author: Keith Busch Date: Tue May 19 13:01:57 2026 -0700 nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing unmap helper because it depends on the tracking descriptor being successfully allocated, so a new one for an in-use iterator is provided. The mappings were also leaking when the driver detects an invalid bio_vec when mapping PRPs, so fix that too. Fixes: b8b7570a7ec87 ("nvme-pci: fix dma unmapping when using PRPs and not using the IOVA mapping") Fixes: 7ce3c1dd78fca ("nvme-pci: convert the data mapping to blk_rq_dma_map") Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 85686c72966c5ee637893f124ddb31a1cace7bee Author: Keith Busch Date: Tue May 19 18:03:44 2026 -0700 nvme-pci: fix dma_vecs leak on p2p memory We don't unmap P2P memory, so we don't need to track it. The dma_vec allocation was getting leaked on the completion. Fixes: b8b7570a7ec87 ("nvme-pci: fix dma unmapping when using PRPs and not using the IOVA mapping") Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 85fac50b58ca0e96dc8bfa649705cb901400877f Author: Michael Grzeschik Date: Thu May 21 15:49:29 2026 +0200 MAINTAINERS: Update address for Michael Grzeschik Since I am moving from Pengutronix update my email address for the ARCNET subsystems to point to my kernel.org address. Also update .mailmap. Signed-off-by: Michael Grzeschik Acked-by: Jakub Kicinski Acked-by: Markus Schneider-Pargmann Link: https://patch.msgid.link/20260521-maintainer-v1-1-29b5e106682d@kernel.org Signed-off-by: Jakub Kicinski commit 099258bde1c94d8c8d0988b543436192f9d7438b Author: Jakub Kicinski Date: Wed May 20 17:41:51 2026 -0700 MAINTAINERS: add missing entry for Bluetooth include files We X-out net/bluetooth/ from "NETWORKING [GENERAL]" so that only the dedicated list is CCed on patches, and networking gets them once already processed by Luiz. We missed include/net/bluetooth. Link: https://patch.msgid.link/20260521004151.625049-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit dfc077043351a81887d1e4c9ac244e9243f3cbf2 Author: Nimrod Oren Date: Wed May 20 18:39:28 2026 +0300 selftests: net: Fix checksums in xdp_native Data adjustment cases failed with "Data exchange failed" when using IPv4 because the program did not update the IP and UDP checksums in the IPv4 branch. The issue was masked when both IPv4 and IPv6 were configured, since the test harness prefers IPv6. While here, generalize csum_fold_helper() to fold twice so it works for any 32-bit input. Fixes: 0b65cfcef9c5 ("selftests: drv-net: Test tail-adjustment support") Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Nimrod Oren Link: https://patch.msgid.link/20260520153928.3371765-1-noren@nvidia.com Signed-off-by: Jakub Kicinski commit 1341db322417266fb5845df81d28305b83a37324 Author: Yuho Choi Date: Tue May 19 23:03:28 2026 -0400 ipv6: route: Unregister netdevice notifier on BPF init failure ip6_route_init() registers ip6_route_dev_notifier before registering the IPv6 route BPF iterator target. If bpf_iter_register() fails after the notifier has been registered, the error path currently jumps to out_register_late_subsys and unwinds the RTNL handlers and pernet route state without removing the notifier from the netdevice notifier chain. This leaves ip6_route_dev_notify() callable after the IPv6 route state it uses has been torn down. Add a separate unwind label for the BPF iterator failure path and unregister the netdevice notifier before continuing with the existing cleanup. Fixes: 138d0be35b14 ("net: bpf: Add netlink and ipv6_route bpf_iter targets") Signed-off-by: Yuho Choi Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260520030329.1061183-1-dbgh9129@gmail.com Signed-off-by: Jakub Kicinski commit ca927fc45e4906bdab42426da044fba4d3584f34 Author: Felix Gu Date: Tue Apr 28 21:18:21 2026 +0800 usb: typec: fusb302: Fix resource leak when devm_drm_dp_hpd_bridge_add() fails If devm_drm_dp_hpd_bridge_add() fails during fusb302_probe(), the original code returned directly without cleaning up the resources. Move bridge registration before the IRQ is requested and route bridge registration failures through the existing TCPM unregister and fwnode cleanup path. Fixes: 5d79c525405d ("usb: typec: fusb302: add DRM DP HPD bridge support") Signed-off-by: Felix Gu Reviewed-by: Heikki Krogerus Reviewed-by: Sebastian Reichel Link: https://patch.msgid.link/20260428-fusb-v2-1-aa3b5942cabb@gmail.com Signed-off-by: Greg Kroah-Hartman commit c1a0ecbf32c4b397353204e2ec94c5bb9f3300ed Author: Radhey Shyam Pandey Date: Tue May 19 17:25:29 2026 +0530 usb: dwc3: xilinx: fix error handling in zynqmp init error paths Fix error handling and resource cleanup i.e remove invalid phy_exit() after failed phy_init(), route failures through proper cleanup paths and return 0 explicitly on success. Fixes: 84770f028fab ("usb: dwc3: Add driver for Xilinx platforms") Cc: stable@vger.kernel.org Acked-by: Thinh Nguyen Signed-off-by: Radhey Shyam Pandey Link: https://patch.msgid.link/20260519115529.2980421-1-radhey.shyam.pandey@amd.com Signed-off-by: Greg Kroah-Hartman commit 92cc6708f4a2ce15433b8355f363d446429ba88c Author: Matthieu Baerts (NGI0) Date: Wed May 20 11:34:43 2026 +1000 selftests: rds: config: disable modules The run.sh script explicitly checks that CONFIG_MODULES is disabled. By default, this config option is enabled. Explicitly disable it to be able to run the RDS tests. Note that writing '# CONFIG_(...) is not set' is usually recommended to disable an option in the .config, but it looks like selftests usually set 'CONFIG_(...)=n', which looks clearer. Fixes: 0f5d68004780 ("selftests: rds: add tools/testing/selftests/net/rds/config") Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20260520-net-rds-config-modules-v1-1-2100df02fe9a@kernel.org Signed-off-by: Jakub Kicinski commit dbc81608e3a653dea6cf403f20cae35468b8ab9c Author: Zijing Yin Date: Tue May 19 10:26:33 2026 -0700 phonet/pep: disable BH around forwarded sk_receive_skb() The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process context. In that case release_sock() -> __release_sock() drops the slock with spin_unlock_bh() and then calls sk->sk_backlog_rcv() with bottom halves enabled. Typical sk_backlog_rcv handlers process the socket whose backlog is being drained, so the BH state at entry is irrelevant for the slocks they touch. pep_do_rcv() is different: when the inbound skb targets an existing PEP pipe, it forwards the skb to a different *child* socket via sk_receive_skb(). That helper takes the child slock with bh_lock_sock_nested(), which is just spin_lock_nested() and assumes BH is already off. The same child slock therefore ends up acquired with BH on (process path) and with BH off (softirq path): process context softirq context --------------- --------------- release_sock(listener) __netif_receive_skb() __release_sock() phonet_rcv() spin_unlock_bh() __sk_receive_skb(listener) [BH now ENABLED] [BH already disabled] sk_backlog_rcv: sk_backlog_rcv: pep_do_rcv() pep_do_rcv() sk_receive_skb(child) sk_receive_skb(child) bh_lock_sock_nested(child) bh_lock_sock_nested(child) => SOFTIRQ-ON-W => IN-SOFTIRQ-W Lockdep flags this as inconsistent lock state, and it can become a real self-deadlock if a softirq on the same CPU tries to receive to the same child socket while its slock is held in the BH-enabled path: WARNING: inconsistent lock state inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. (slock-AF_PHONET/1){+.?.}-{3:3}, at: __sk_receive_skb+0x1cf/0x900 __sk_receive_skb net/core/sock.c:563 sk_receive_skb include/net/sock.h:2022 [inline] pep_do_rcv net/phonet/pep.c:675 sk_backlog_rcv include/net/sock.h:1190 __release_sock net/core/sock.c:3216 release_sock net/core/sock.c:3815 pep_sock_accept net/phonet/pep.c:879 Wrap the forwarded sk_receive_skb() in local_bh_disable() / local_bh_enable() so the child slock is always acquired with BH off. local_bh_disable() nests safely on the softirq path. Discovered via in-house syzkaller fuzzing; the same root cause also on the linux-6.1.y syzbot dashboard as extid 44f0626dd6284f02663c. Reproduced under KASAN + LOCKDEP + PROVE_LOCKING, reproducer: https://pastebin.com/A3t8xzCR Fixes: 9641458d3ec4 ("Phonet: Pipe End Point for Phonet Pipes protocol") Link: https://syzkaller.appspot.com/bug?extid=44f0626dd6284f02663c Cc: stable@vger.kernel.org Signed-off-by: Zijing Yin Acked-by: Rémi Denis-Courmont Reported-by: syzbot+9f4a135646b66c509935@syzkaller.appspotmail.com Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260519172635.86304-1-yzjaurora@gmail.com Signed-off-by: Jakub Kicinski commit fbc15231181669b51c0103fd74c9c2ac2756ab56 Author: Alexander A. Klimov Date: Wed May 20 20:03:58 2026 +0200 smb: smbdirect: divide, not multiply, milliseconds by 1000 Unless smbdirect_connection_legacy_debug_proc_show() wants to debug-log keep_alive_interval as microseconds, a magnitude higher precision than available by the way, keepalive_interval_msec should not be multiplied by 1000. Fixes: cc55f65dd352 ("smb: client: make use of common smbdirect_socket_parameters") Reviewed-by: Stefan Metzmacher Signed-off-by: Alexander A. Klimov Signed-off-by: Steve French commit c68337442f03953237a94577beb468ab2662a851 Author: Zhihao Cheng Date: Tue May 19 17:18:05 2026 +0800 cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in generic_shutdown_super: BUG: Dentry 00000000a14a6845{i=c,n=file} still in use (1) [unmount of cifs cifs] The detailed processs is: process A process B kworker fd = open(PATH) vfs_open file->__f_path = *path // dentry->d_lockref.count = 1 cifs_open cifs_new_fileinfo cfile->dentry = dget(dentry) // dentry->d_lockref.count = 2 close(fd) __fput cifs_close queue_delayed_work(deferredclose_wq, cfile->deferred) dput(dentry) // dentry->d_lockref.count = 1 smb2_deferred_work_close _cifsFileInfo_put list_del(&cifs_file->flist) umount cleanup_mnt deactivate_super cifs_kill_sb cifs_close_all_deferred_files_sb cifs_close_all_deferred_files // cannot find cfile, skip _cifsFileInfo_put kill_anon_super generic_shutdown_super shrink_dcache_for_umount umount_check WARN ! // dentry->d_lockref.count = 1 cifsFileInfo_put_final dput(cifs_file->dentry) // dentry->d_lockref.count = 0 Fix it by flushing 'deferredclose_wq' before calling kill_anon_super. Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=221548. Fixes: 340cea84f691c ("cifs: open files should not hold ref on superblock") Cc: stable@vger.kernel.org Reviewed-by: Shyam Prasad N Signed-off-by: Zhihao Cheng Signed-off-by: Steve French commit dd2147375a8fe7c5bc3f1f1b1d3a9567c26faefa Author: Liu Kai Date: Thu May 7 16:32:04 2026 +0800 HID: remove duplicate hid_warn_ratelimited definition The hid_warn_ratelimited macro is defined twice in include/linux/hid.h: - first one added by commit 4051ead99888 ("HID: rate-limit hid_warn to prevent log flooding") - second one added by commit 1d64624243af ("HID: core: Add printk_ratelimited variants to hid_warn() etc")). The second definition is correctly grouped with other ratelimited macros. Remove the duplicate definition. Fixes: 1d64624243af ("HID: core: Add printk_ratelimited variants to hid_warn() etc") Signed-off-by: Liu Kai [bentiss: edited commit message] Signed-off-by: Benjamin Tissoires commit 1129c0011b90f0d0453dadac4d1e81824aac07ff Merge: 18e7bd9f244666 a6852526868516 Author: Mark Brown Date: Thu May 21 15:13:52 2026 +0100 ASoC: cs-amp-lib: Some bug and typo fixes Richard Fitzgerald says: This series fixes bugs and a typo in cs-amp-lib. Link: https://patch.msgid.link/20260521122511.987322-1-rf@opensource.cirrus.com commit a685252686851633b795bc30facac8a39344ae09 Author: Richard Fitzgerald Date: Thu May 21 13:25:11 2026 +0100 ASoC: cs-amp-lib: Fix typo in error message: write -> read Fix the error message in cs_amp_read_cal_coeff() to say "Failed to read". It was incorrectly "Failed to write", probably a copy-paste error. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260521122511.987322-4-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit ba28a07a9a0b53a538c809e04e517e1ce1f1bee3 Author: Richard Fitzgerald Date: Thu May 21 13:25:10 2026 +0100 ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup() Rewrite cs_amp_create_debugfs() so that dput() will be called on a valid dentry returned from debugfs_lookup(). The pointer returned from debugfs_lookup() must be released by dput(). The pointer returned from debugfs_create_dir() does not need to be passed to dput(). Signed-off-by: Richard Fitzgerald Fixes: cdd27fa3298a ("ASoC: cs-amp-lib: Add helpers for factory calibration") Link: https://patch.msgid.link/20260521122511.987322-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 67a52d3ebb5a0ae0c0e23ffa99470d9463179c9f Author: Richard Fitzgerald Date: Thu May 21 13:25:09 2026 +0100 ASoC: cs-amp-lib: Fix wrong sizeof() in _cs_amp_set_efi_calibration_data() When calculating data->count replace the incorrect sizeof(data) with use of struct_offset(). The faulty sizeof(data) was incorrectly calculating the size of the pointer instead of the size of the struct pointed to. As it happens, both values are 8 on a 64-bit CPU. In the unlikely event of using this code on a 32-bit CPU the number of available bytes would be calculated 4 larger than is actually available. Instead of changing to sizeof(*data) it has been replaced by struct_offset() because it has better chance of detecting these sorts of typos. Also the offset of the data[] array is actually what we want to know here anyway. Signed-off-by: Richard Fitzgerald Fixes: 2b62e66626f0 ("ASoC: cs-amp-lib: Add function to write calibration to UEFI") Link: https://patch.msgid.link/20260521122511.987322-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 4e4af55aaca7f6d7673d5f9889ad0529db86a048 Author: Abdurrahman Hussain Date: Mon May 18 17:52:32 2026 -0700 hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock adm1266_state_read() backs the sequencer_state debugfs entry and issues an i2c_smbus_read_word_data(client, ADM1266_READ_STATE) against the device without taking pmbus_lock. pmbus_core holds pmbus_lock around its own multi-transaction sequences (notably the "set PAGE, then read paged register" pattern used by hwmon attributes), so an unlocked debugfs reader can land between a PAGE write and the subsequent paged read in another thread. READ_STATE itself is not paged, so it cannot corrupt PAGE in flight, but the same defensive serialisation that applies to the GPIO accessors applies here: any direct device access from outside pmbus_core should be ordered with respect to pmbus_core's own. Take pmbus_lock at the top of adm1266_state_read() via the scope-based guard(). Fixes: ed1ff457e187 ("hwmon: (pmbus/adm1266) add debugfs for states") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-8-e425e4f88139@nexthop.ai Signed-off-by: Guenter Roeck commit 9f1dd8f9491eb840cbea7ffdf4cad031e25f8ae0 Author: Abdurrahman Hussain Date: Mon May 18 17:52:31 2026 -0700 hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock adm1266_nvmem_read() is the reg_read callback the NVMEM core invokes when userspace reads /sys/bus/nvmem/devices/.../nvmem on this chip. On the first byte of every read it does a memset of data->dev_mem, walks the device blackbox through adm1266_nvmem_read_blackbox() (which issues a chain of PMBus block transactions), and then memcpys the refreshed buffer out to userspace. None of that runs under pmbus_lock today. Two consequences: - The PMBus traffic the refresh issues is not serialised against pmbus_core's own multi-step PAGE+register sequences. A paged hwmon attribute read from another thread can land between a PAGE write and the paged read in either direction and corrupt one side's view of the device state machine. - The NVMEM core does not serialise concurrent reg_read calls, so two userspace readers racing at offset 0 can interleave the memset of data->dev_mem with another reader's adm1266_nvmem_read_blackbox() refill or memcpy out, returning torn data to userspace. Take pmbus_lock at the top of adm1266_nvmem_read() via the scope-based guard(). Patch 5 of this series moves adm1266_config_nvmem() past pmbus_do_probe() so the lock is guaranteed to be live before the callback is reachable from userspace. Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-7-e425e4f88139@nexthop.ai Signed-off-by: Guenter Roeck commit bab8c6fb5af8df7e753d196c1262cb78e92ca872 Author: Abdurrahman Hussain Date: Mon May 18 17:52:30 2026 -0700 hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock adm1266_gpio_get(), adm1266_gpio_get_multiple(), and adm1266_gpio_dbg_show() all issue PMBus reads against the device but none of them take pmbus_lock. The pmbus_core framework holds pmbus_lock around its own multi-transaction sequences (notably the "set PAGE, then read paged register" pattern used by hwmon attributes), so an unlocked GPIO accessor can land between a PAGE write and the subsequent paged read in another thread and corrupt either side's view of the device state machine. Take pmbus_lock at the top of each of the three accessors via the scope-based guard(). The lock is uncontended in the common case and adds only a single mutex round-trip per call. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-6-e425e4f88139@nexthop.ai Signed-off-by: Guenter Roeck commit 6af713af91d5c34ec049eb3cc2c5b3f5eba953b8 Author: Abdurrahman Hussain Date: Mon May 18 17:52:29 2026 -0700 hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() adm1266_probe() calls adm1266_config_nvmem() -- which goes on to devm_nvmem_register() and exposes adm1266_nvmem_read() to userspace -- before pmbus_do_probe() has initialised the per-client PMBus state. Same latent hazard as the gpio_chip one fixed in the previous patch: once the nvmem device is registered, gpiolib's nvmem char-dev / sysfs interface is reachable, and any concurrent read triggers adm1266_nvmem_read() -> adm1266_nvmem_read_blackbox(), which issues PMBus traffic that races pmbus_do_probe()'s own device accesses with no serialisation. Move adm1266_config_nvmem() down past pmbus_do_probe() so the nvmem device isn't reachable from userspace until the PMBus state the nvmem accessors depend on is fully initialised. Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-5-e425e4f88139@nexthop.ai Signed-off-by: Guenter Roeck commit 491403b9b76cf66abd81301c5901aa4a4549f1e8 Author: Abdurrahman Hussain Date: Mon May 18 17:52:28 2026 -0700 hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() adm1266_probe() calls adm1266_config_gpio() -- which goes on to devm_gpiochip_add_data() and exposes the gpio_chip callbacks to gpiolib -- before pmbus_do_probe() has initialised the per-client PMBus state (notably the pmbus_lock mutex the core hands out via pmbus_get_data()). That ordering is already a latent hazard: any GPIO access that lands between adm1266_config_gpio() and the end of pmbus_do_probe() (for example a sysfs read from a user space agent that opens the gpiochip the instant gpiolib advertises it) races pmbus_do_probe()'s own device accesses with no serialisation. Move adm1266_config_gpio() down past pmbus_do_probe() so the chip isn't reachable from userspace until the PMBus state it depends on is fully initialised. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-4-e425e4f88139@nexthop.ai Signed-off-by: Guenter Roeck commit a7232f68c43ca62f545049b7f5fbfc75137b843b Author: Abdurrahman Hussain Date: Mon May 18 17:52:27 2026 -0700 hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the pin-status word as pins_status = read_buf[0] + (read_buf[1] << 8); right after i2c_smbus_read_block_data(), guarding only against an error return. A well-behaved device returns 2 bytes for GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or 1-byte response too. If the device returns 0 bytes, both read_buf slots are uninitialized stack memory; if it returns 1 byte, read_buf[1] is. The composed value then flows through set_bit() into the caller's *bits in adm1266_gpio_get_multiple(), or into the return value of adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and the char-dev ioctls). That leaks a few bits of kernel stack per request on any device whose firmware glitch, bus error, or hostile slave produces a short block-read response. Add the missing length check to both call sites and surface a short response as -EIO. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-3-e425e4f88139@nexthop.ai Signed-off-by: Guenter Roeck commit 3327a12aee9e10ffa903e28b8445dfd1af5307c0 Author: Abdurrahman Hussain Date: Mon May 18 17:52:26 2026 -0700 hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple adm1266_gpio_get_multiple() zeroes *bits before the GPIO_STATUS loop and then a second time before the PDIO_STATUS loop: *bits = 0; for_each_set_bit(gpio_nr, mask, ADM1266_GPIO_NR) { ... set_bit(gpio_nr, bits); } ret = i2c_smbus_read_block_data(data->client, ADM1266_PDIO_STATUS, ...); ... *bits = 0; for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_NR) { ... set_bit(gpio_nr, bits); } The second *bits = 0 throws away every GPIO bit the first loop just populated, so callers asking for any combination of GPIO and PDIO pins always see the GPIO portion of the returned bits as zero. Drop the redundant second assignment so both halves of the result survive. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-2-e425e4f88139@nexthop.ai Signed-off-by: Guenter Roeck commit 42734af6632ebebf90552f0e2dce4d8e72dbb9be Merge: 94e3dd6874bf04 f80d3d98d2ff78 Author: Paolo Abeni Date: Thu May 21 15:59:10 2026 +0200 Merge tag 'batadv-net-pullrequest-20260520' of https://git.open-mesh.org/batadv Simon Wunderlich says: ==================== Here are batman-adv bugfixes, all by by Sven Eckelmann. - fix batadv_skb_is_frag() kernel-doc - BATMAN V: stop OGMv2 on disabled interface - BATMAN IV: abort OGM send on tvlv append failure - BATMAN IV: reject oversized TVLV packets - tp_meter: fix race condition in send error reporting - tp_meter: avoid role confusion in tp_list - mcast: fix use-after-free in orig_node RCU release - BATMAN IV: recover OGM scheduling after forward packet error - bla: fix report_work leak on backbone_gw purge - bla: avoid double decrement of bla.num_requests - bla: avoid NULL-ptr deref for claim via dropped interface * tag 'batadv-net-pullrequest-20260520' of https://git.open-mesh.org/batadv: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface batman-adv: bla: avoid double decrement of bla.num_requests batman-adv: bla: fix report_work leak on backbone_gw purge batman-adv: iv: recover OGM scheduling after forward packet error batman-adv: mcast: fix use-after-free in orig_node RCU release batman-adv: tp_meter: avoid role confusion in tp_list batman-adv: tp_meter: fix race condition in send error reporting batman-adv: tvlv: reject oversized TVLV packets batman-adv: tvlv: abort OGM send on tvlv append failure batman-adv: v: stop OGMv2 on disabled interface batman-adv: fix batadv_skb_is_frag() kernel-doc ==================== Link: https://patch.msgid.link/20260520115422.53552-1-sw@simonwunderlich.de Signed-off-by: Paolo Abeni commit d7834d92251baade796812876e95555e2066fa9f Author: Abdurrahman Hussain Date: Mon May 18 17:52:25 2026 -0700 hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) { ... } where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR = 25. gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 217 extra bits (a handful of unsigned-long words: four on 64-bit, seven on 32-bit) of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds. Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Reviewed-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20260518-adm1266-gpio-fixes-v3-1-e425e4f88139@nexthop.ai Signed-off-by: Guenter Roeck commit 43cae21424ff8e33894a0f86c6b80b840c049fd7 Author: Abdurrahman Hussain Date: Fri May 15 15:11:51 2026 -0700 hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer adm1266_pmbus_block_xfer() copies the device-supplied block payload into the caller-provided buffer using the device-supplied length: memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]); The helper does not know how large data_r is and trusts the device to return at most one record's worth of bytes. adm1266_nvmem_read_blackbox() violates that contract: it advances read_buff inside data->dev_mem in ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns more than 64 bytes on the trailing record (read_buff offset 1984 in the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes before the post-call if (ret != ADM1266_BLACKBOX_SIZE) return -EIO; can reject the response. Contain the fix in the caller without changing the helper signature: read each record into a 255-byte local bounce buffer that matches the helper's maximum output, validate the returned length, and only then copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot. Fixes: 407dc802a9c0 ("hwmon: (pmbus/adm1266) Add Block process call") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Link: https://lore.kernel.org/r/20260515-adm1266-fixes-v1-5-1c1ea1349cfe@nexthop.ai Signed-off-by: Guenter Roeck commit b0ddda571d15528e6caee7090beff4a66dfdb1a2 Author: Abdurrahman Hussain Date: Tue May 12 11:56:28 2026 -0700 hwmon: (pmbus/adm1266) include adapter number in GPIO line label Platforms that fit more than one ADM1266 on different I2C buses at the same 7-bit slave address (a common shelf-management pattern, e.g. one device per power domain) end up with duplicate GPIO line labels because the existing format only includes the slave address. Including the adapter number disambiguates them. The adapter number is formatted as decimal to match the i2c-N convention used elsewhere in Linux (sysfs paths, dev nodes); the slave address keeps its conventional hexadecimal form. The label is purely informational (visible via gpioinfo and the gpiochip /sys/class/gpio name); no DT or ABI consumer parses it. Fixes: d98dfad35c38c ("hwmon: (pmbus/adm1266) Add support for GPIOs") Signed-off-by: Abdurrahman Hussain Link: https://lore.kernel.org/r/20260512-adm1266-v3-5-a81a479b0bb0@nexthop.ai Signed-off-by: Guenter Roeck commit 4d25342543c01310fc4e0cba7cb17c775e2421e2 Author: Shuicheng Lin Date: Thu May 14 20:32:10 2026 +0000 drm/xe/oa: Fix exec_queue leak on width check in stream open In xe_oa_stream_open_ioctl(), when param.exec_q->width > 1 the function returns -EOPNOTSUPP directly, skipping the existing err_exec_q cleanup path. The exec_queue reference obtained by xe_exec_queue_lookup() is leaked. The exec queue holds a reference on the xe_file, which is only dropped during queue teardown. The leaked lookup ref is not on the file's exec_queue xarray, so file close cannot release it. This keeps both the exec queue and the file private state pinned indefinitely. Jump to err_exec_q instead of returning directly so the reference is released. Fixes: f0ed39830e60 ("xe/oa: Fix query mode of operation for OAR/OAC") Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ashutosh Dixit Link: https://patch.msgid.link/20260514203210.593488-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit 339fa0be9e4a5d69fa47e91f4a36574224fb478f) Signed-off-by: Rodrigo Vivi commit 487566cb1ccdf3756fdd7bf8d875e612ff3169bb Author: Abdurrahman Hussain Date: Fri May 15 15:11:50 2026 -0700 hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer adm1266_pmbus_block_xfer() sets up the read transaction with .buf = data->read_buf, .len = ADM1266_PMBUS_BLOCK_MAX + 2, but read_buf in struct adm1266_data is declared as u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1]; For a max-length block response (length byte = 255 + up to 1 PEC byte), the i2c controller is told to write 257 bytes into a 256-byte buffer, putting one byte past the end of read_buf. The same response also makes the subsequent PEC compare if (crc != msgs[1].buf[msgs[1].buf[0] + 1]) read a byte beyond the array. Bump the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so the buffer can hold the length byte, up to 255 payload bytes, and the PEC byte the i2c_msg length already accounts for. Fixes: 407dc802a9c0 ("hwmon: (pmbus/adm1266) Add Block process call") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Link: https://lore.kernel.org/r/20260515-adm1266-fixes-v1-4-1c1ea1349cfe@nexthop.ai Signed-off-by: Guenter Roeck commit 4afca954622d672ea65ed961bed01cf91caa034e Author: Abdurrahman Hussain Date: Fri May 15 15:11:49 2026 -0700 hwmon: (pmbus/adm1266) reject implausible blackbox record_count adm1266_nvmem_read_blackbox() loops over a record_count that comes straight from byte 3 of the BLACKBOX_INFO response. The destination buffer is data->dev_mem, sized for the nvmem cell's declared 2048 bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64). A device that reports a record_count greater than 32 -- whether due to firmware bugs, bus corruption, or a non-responsive slave returning 0xff -- would walk read_buff past the end of the dev_mem allocation on the trailing iterations. Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here) before entering the loop and return -EIO on any larger value, so a malformed BLACKBOX_INFO response cannot drive the loop out of bounds. Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Link: https://lore.kernel.org/r/20260515-adm1266-fixes-v1-3-1c1ea1349cfe@nexthop.ai Signed-off-by: Guenter Roeck commit eee213daa1e1b402eb631bcd1b8c5aa340a6b081 Author: Abdurrahman Hussain Date: Fri May 15 15:11:48 2026 -0700 hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX adm1266_nvmem_read_blackbox() declares a 5-byte stack buffer and passes it to i2c_smbus_read_block_data() to retrieve the 4-byte BLACKBOX_INFO response. i2c_smbus_read_block_data() does not honour caller buffer sizes -- it memcpy()s data.block[0] bytes from the SMBus transaction (where data.block[0] is the length byte returned by the slave device, up to I2C_SMBUS_BLOCK_MAX = 32): memcpy(values, &data.block[1], data.block[0]); If the device returns any block length above 5, the call overflows the caller's 5-byte stack buffer before the post-call if (ret != 4) return -EIO; check has a chance to reject the response. Widen the local buffer to I2C_SMBUS_BLOCK_MAX so the helper has room for any well-formed SMBus block response, matching the convention used by the other i2c_smbus_read_block_data() callers in this driver. Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Link: https://lore.kernel.org/r/20260515-adm1266-fixes-v1-2-1c1ea1349cfe@nexthop.ai Signed-off-by: Guenter Roeck commit b86095e3d7dcf2bf80c747349a35912a87a85098 Author: Abdurrahman Hussain Date: Fri May 15 15:11:47 2026 -0700 hwmon: (pmbus/adm1266) seed timestamp from the real-time clock adm1266_set_rtc() seeds the chip's SET_RTC register from ktime_get_seconds(), which returns CLOCK_MONOTONIC -- i.e. seconds since the host last booted, not seconds since the Unix epoch. The chip stamps that value into every blackbox record it captures. Userspace reading those timestamps back expects wall-clock seconds: that's what the SET_RTC frame layout documents (datasheet Rev. D, Table 84) and what every other consumer of "seconds since epoch" assumes. Seeding from CLOCK_MONOTONIC gives blackbox records a timestamp that is only meaningful within a single boot of the host and silently resets to small values on every reboot. Switch to ktime_get_real_seconds() so the seed matches what the register is documented to hold. Fixes: 15609d189302 ("hwmon: (pmbus/adm1266) read blackbox") Cc: stable@vger.kernel.org Signed-off-by: Abdurrahman Hussain Link: https://lore.kernel.org/r/20260515-adm1266-fixes-v1-1-1c1ea1349cfe@nexthop.ai Signed-off-by: Guenter Roeck commit e6056b1f5a38bbe57ccbbba2609efecbd87ae08c Author: Kean Ren Date: Thu May 21 11:52:28 2026 +0800 hwmon: (lenovo-ec-sensors): Fix EC "MCHP" signature validation logic The EC signature check uses && instead of || between the four byte comparisons. With &&, the condition is true only when ALL four bytes fail to match simultaneously, meaning the driver accepts a device as a valid Microchip EC if ANY single byte of the 4-byte "MCHP" signature happens to match. Due to short-circuit evaluation, if the first byte reads back as 'M' (0x4D, a very common register value), the remaining three comparisons are skipped entirely and the device is accepted. Change && to || so the check rejects devices that do not fully match the expected EC signature, as originally intended. Fixes: 70118f85e6538 ("hwmon: Add EC Chip driver for Lenovo ThinkStation motherboards") Reviewed-by: Mark Pearson Signed-off-by: Kean Ren Link: https://lore.kernel.org/r/20260521035228.533317-3-rh_king@163.com Signed-off-by: Guenter Roeck commit 6c4e001cb0567b81340270d8fc3d53e39435ae70 Author: Kean Ren Date: Thu May 21 11:52:27 2026 +0800 hwmon: (lenovo-ec-sensors): Convert to devm_request_region() Replace manual request_region()/release_region() with devm_request_region(). This lets the device-managed framework handle I/O region lifetime automatically and fixes: - A double release_region() when probe fails after acquiring the I/O region: the probe error path releases it, and then lenovo_ec_init() releases it again on the same error path. - A release-after-use window in lenovo_ec_exit() where release_region() was called before platform_device_unregister(), leaving the hwmon device active with a released I/O region. - Missing release_region() in lenovo_ec_probe() if devm_hwmon_device_register_with_info() fails. Remove all four manual release_region() calls that are now handled automatically and replace request_region with devm_request_region, use dev_err replace pr_err. Also remove the now-unnecessary braces around the single-statement if body. Fixes: 70118f85e6538 ("hwmon: Add EC Chip driver for Lenovo ThinkStation motherboards") Reviewed-by: Mark Pearson Signed-off-by: Kean Ren Link: https://lore.kernel.org/r/20260521035228.533317-2-rh_king@163.com Signed-off-by: Guenter Roeck commit 2e78b21864dd6e21b76160753ea632b5e758fdbd Author: Myeonghun Pak Date: Fri Apr 24 22:21:31 2026 +0900 HID: u2fzero: free allocated URB on probe errors u2fzero_fill_in_urb() allocates dev->urb with usb_alloc_urb(), but u2fzero_probe() ignored its return value and only freed the URB from u2fzero_remove(). If LED or hwrng registration fails after the URB allocation, probe returns an error and the driver core does not call .remove(), leaking the URB. A failed URB setup was also allowed to continue probing with an unusable device. Check the URB setup result and add the missing probe-error unwind so the URB is freed before returning from later errors. Signed-off-by: Myeonghun Pak Signed-off-by: Benjamin Tissoires commit 18e7bd9f2446664053f8c34b72abd4606d22d858 Author: Richard Fitzgerald Date: Thu May 21 13:30:57 2026 +0100 ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() Use flush_work() instead of cancel_work_sync() to terminate pending IRQ work in cs35l56_sdw_remove(). And flush_work() again after masking the interrupts to flush any queueing that was racing with the masking. This is the same sequence as cs35l56_sdw_system_suspend(). cs35l56_sdw_interrupt() takes the pm_runtime to prevent the bus powering- down before the interrupt status can be read and handled. The work releases this pm_runtime. So cancelling it, instead of flushing, could leave an unbalanced pm_runtime. Signed-off-by: Richard Fitzgerald Fixes: e49611252900 ("ASoC: cs35l56: Add driver for Cirrus Logic CS35L56") Link: https://patch.msgid.link/20260521123057.988732-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 0ccc9d47cf020994097ff51827cebd04aa2b0bf4 Author: Huacai Chen Date: Thu May 21 20:58:40 2026 +0800 LoongArch: Remove unused code to avoid build warning After commit feee6b2989165631b1 ("mm/memory_hotplug: shrink zones when offlining memory"), __remove_pages() doesn't need the "zone" parameter so the "page" variable is also unused. Remove the unused code to avoid such build warning: arch/loongarch/mm/init.c: In function 'arch_remove_memory': arch/loongarch/mm/init.c:134:22: warning: variable 'page' set but not used [-Wunused-but-set-variable=] 134 | struct page *page = pfn_to_page(start_pfn); Cc: Reviewed-by: Guo Ren Signed-off-by: Huacai Chen commit 5b710aa89343c5217889b7788e279565b36e0e5e Author: WANG Rui Date: Thu May 21 20:58:36 2026 +0800 LoongArch: Avoid initrd overlap during kernel relocation Validate the relocation address against the initrd region specified via "initrd=" or "initrdmem=" on the command line. Reject relocation targets that overlap the initrd to prevent memory corruption during early boot. Acked-by: Ard Biesheuvel Signed-off-by: WANG Rui Signed-off-by: Huacai Chen commit 08ade00fbb088b8f5a1af706ee970c26cf842bf0 Author: WANG Rui Date: Thu May 21 20:58:36 2026 +0800 LoongArch: Skip relocation-time KASLR if already applied When the kernel is relocated during early boot (efistub or kexec_file), a randomized load address may has already been selected and applied. In this case, performing KASLR again in relocate.c is unnecessary. Note: strictly-defined KASLR means the kernel's final runtime address has a random offset from the kernel's load address, which is implemented in relocate.c; broadly-defined KALSR means the kernel's final runtime address has a random offset from the kernel's link address (a.k.a. VMLINUX_LOAD_ADDRESS), which also include the efistlub implementation, kexec_file implementation and QEMU direct kernel boot. kaslr_disabled() return true only means strictly-defined KASLR is disabled. Acked-by: Ard Biesheuvel Signed-off-by: WANG Rui Signed-off-by: Huacai Chen commit 03d8273542146f228c0019f08b57545fdee79704 Author: WANG Rui Date: Thu May 21 20:58:36 2026 +0800 efi/loongarch: Randomize kernel preferred address for KASLR Introduce efi_get_kimg_kaslr_address() helper to compute the preferred kernel image load address dynamically when CONFIG_RANDOMIZE_BASE is enabled. The function derives a random offset by using the EFI-provided randomness combined with the timer tick value, and constrains it within CONFIG_RANDOMIZE_BASE_MAX_OFFSET. Update EFI_KIMG_PREFERRED_ADDRESS to call this helper so that the EFI stub can select a randomized load address when KASLR is active, while preserving the original base address behavior when KASLR is disabled or "nokaslr" is specified. Note: LoongArch can't KASLR for hibernation, so set efi_nokaslr to true if "resume=" is explicitly specified in cmdline. Acked-by: Ard Biesheuvel Signed-off-by: WANG Rui Signed-off-by: Huacai Chen commit a4fa45c1d980bc2b9837f469119af24a9304a1fc Author: Bartosz Golaszewski Date: Mon May 18 11:53:19 2026 +0200 gpio: virtuser: lock device when calling device_is_bound() The kerneldoc for device_is_bound() says it must be called with the device lock taken. Add missing synchronization to this driver. Fixes: c3e2a8aef28c ("gpio: virtuser: stop using dev-sync-probe") Link: https://patch.msgid.link/20260518-gpio-dev-lock-v1-3-cc4736f3ff0b@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 598a2b3e2e0e6aa2e9f7843c96c45b5ea11e0411 Author: Bartosz Golaszewski Date: Mon May 18 11:53:18 2026 +0200 gpio: aggregator: lock device when calling device_is_bound() The kerneldoc for device_is_bound() says it must be called with the device lock taken. Add missing synchronization to this driver. Fixes: 3a27f40b4570 ("gpio: aggregator: stop using dev-sync-probe") Link: https://patch.msgid.link/20260518-gpio-dev-lock-v1-2-cc4736f3ff0b@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit e70ae40d6660c5428c790c329318c570b4d038ab Author: Bartosz Golaszewski Date: Mon May 18 11:53:17 2026 +0200 gpio: sim: lock device when calling device_is_bound() The kerneldoc for device_is_bound() says it must be called with the device lock taken. Add missing synchronization to this driver. Fixes: 7fb3287946f9 ("gpio: sim: stop using dev-sync-probe") Link: https://patch.msgid.link/20260518-gpio-dev-lock-v1-1-cc4736f3ff0b@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 057caace5214da3b457bbd295e1a2ad34d3685ea Author: Thomas Weißschuh Date: Wed May 20 20:01:55 2026 +0200 tracing: Create output file from cmd_check_undefined As the output file is currently never created, the check will run every time, even if the inputs have not changed. Create an empty output file which allows make to skip the execution when it is not necessary. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Vincent Donnefort Cc: Marc Zyngier Cc: Arnd Bergmann Link: https://patch.msgid.link/20260520-tracing-ringbuffer-check-v1-1-d979cfab1338@weissschuh.net Fixes: 1211907ac0b5 ("tracing: Generate undef symbols allowlist for simple_ring_buffer") Fixes: 58b4bd18390e ("tracing: Adjust cmd_check_undefined to show unexpected undefined symbols") Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Signed-off-by: Thomas Weißschuh Signed-off-by: Steven Rostedt commit a0a2f42a37f90b29d8c43374dd9c8bd2f3e7bdcc Author: Vincent Donnefort Date: Tue May 12 15:16:14 2026 +0100 tracing: Fix unload_page for simple_ring_buffer init rollback The unload_page callback expects the return value of load_page() as its argument: ret = load_page(va); unload(ret). Fix the rollback code in simple_ring_buffer_init_mm() where the descriptor's VA is used instead of the loaded page address. Link: https://patch.msgid.link/20260512141614.1759430-1-vdonnefort@google.com Fixes: 635923081c79 ("tracing: load/unload page callbacks for simple_ring_buffer") Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt commit c2d2856cf6c9efccdf5e0d2564162ec616ce58cf Author: David Carlier Date: Tue May 12 14:54:20 2026 +0100 tracing: Fix nr_subbufs initialization in simple_ring_buffer_init_mm() nr_subbufs in the ring buffer metadata is always initialized to zero because it is assigned from cpu_buffer->nr_pages before the page initialization loop has run. While nr_subbufs is not currently read by the kernel, it should reflect the actual buffer geometry in the meta page for correctness. Move the assignment after the page loop so that cpu_buffer->nr_pages holds the final count. Link: https://patch.msgid.link/20260512135420.99194-1-devnexen@gmail.com Fixes: 34e5b958bdad ("tracing: Introduce simple_ring_buffer") Reviewed-by: Vincent Donnefort Assisted-by: Claude:claude-opus-4-7 Signed-off-by: David Carlier Signed-off-by: Steven Rostedt commit a494d3c8d5392bcdff83c2a593df0c160ff9f322 Author: Masami Hiramatsu (Google) Date: Thu Apr 30 12:28:16 2026 +0900 ring-buffer: Flush and stop persistent ring buffer on panic On real hardware, panic and machine reboot may not flush hardware cache to memory. This means the persistent ring buffer, which relies on a coherent state of memory, may not have its events written to the buffer and they may be lost. Moreover, there may be inconsistency with the counters which are used for validation of the integrity of the persistent ring buffer which may cause all data to be discarded. To avoid this issue, stop recording of the ring buffer on panic and flush the cache of the ring buffer's memory. Fixes: e645535a954a ("tracing: Add option to use memmapped memory for trace boot instance") Cc: stable@vger.kernel.org Cc: Will Deacon Cc: Mathieu Desnoyers Cc: Ian Rogers Link: https://patch.msgid.link/177751969602.2136606.12031934362587643488.stgit@mhiramat.tok.corp.google.com Signed-off-by: Masami Hiramatsu (Google) Acked-by: Catalin Marinas Acked-by: Geert Uytterhoeven Signed-off-by: Steven Rostedt commit a254b6d13b0edd6272926674d2afc46d46e496b7 Author: Steven Rostedt Date: Wed May 20 22:08:01 2026 -0400 ring-buffer: Fix reporting of missed events in iterator When tracing is active while reading the trace file, if the iterator reading the buffer detects that the writer has passed the iterator head, it will reset and set a "missed events" flag. This flag is passed to the output processing to show the user that events were missed: CPU:4 [LOST EVENTS] The problem is that the flag is reset after it is checked in ring_buffer_iter_dropped(). But the "trace" file iterates over all the CPU ring buffers and it will check if they are dropped when figuring out which buffer to print next. This prematurely clears the missed_events flag if the CPU buffer with the missed events is not the one that is printed next. On the iteration where the CPU buffer with the missed events is printed, the check if it had missed events would return false and the output does not show that events were missed. Do not reset the missed_events flag when checking if there were missed events, but instead clear it when moving the iterator head to the next event. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260520220801.4fd09d13@fedora Fixes: c9b7a4a72ff64 ("ring-buffer/tracing: Have iterator acknowledge dropped events") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt commit 0eb307d61317b42b120ab02099b597226318358a Author: Geliang Tang Date: Mon Apr 20 17:45:28 2026 +0800 selftests: harness: fix pidfd leak in __wait_for_test Fix the pidfd leak in kselftest_harness.h's __wait_for_test() where childfd = syscall(__NR_pidfd_open, t->pid, 0) is never closed. Fixes: 73a3cde97677 ("selftests: harness: Implement test timeouts through pidfd") Signed-off-by: Geliang Tang Link: https://patch.msgid.link/a82e275ccfb2609a1984d90ab559fa3af78f1e81.1776678050.git.tanggeliang@kylinos.cn Reviewed-by: Thomas Weißschuh Signed-off-by: Christian Brauner (Amutable) commit c69439a891ccb37ede5d68539636337c6bd92fab Author: Christoph Hellwig Date: Mon May 18 08:02:05 2026 +0200 xfs: fix a buffer lookup against removal race When a buffer is freed either by LRU eviction or because it is unset, the lockref is marked as dead instantly, which prevents the buffer from being used after finding it in the buffer hash in xfs_buf_lookup and xfs_buf_find_insert. But the latter will then not add the new buffer to the hash because it already found an existing buffer. Fix this using in two places: Remove the buffer from the hash before marking the lockref dead so that that no buffer with a dead lockref can be found in the hash, but if we find one in xfs_buf_find_insert due to store reordering, handle this case correctly instead of returning an unhashed buffer. Fixes: 67fe4303972e ("xfs: don't keep a reference for buffers on the LRU") Reported-by: Andrey Albershteyn Reported-by: Carlos Maiolino Signed-off-by: Christoph Hellwig Reviewed-by: Andrey Albershteyn Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 94e3dd6874bf04d5939bc8431b9f7852f3a4a121 Merge: 0377bd2722c189 c6087c5aaad6d1 Author: Paolo Abeni Date: Thu May 21 13:14:04 2026 +0200 Merge branch 'vsock-virtio-fix-skb-overhead-accounting-to-preserve-full-buf_alloc' Stefano Garzarella says: ==================== vsock/virtio: fix skb overhead accounting to preserve full buf_alloc Patch 1 resets the connection when we can no longer queue packets, this prevents silent data loss, and both peers are notified. Patch 2 increases the total budget to `buf_alloc * 2` for payload plus skb overhead similar to how SO_RCVBUF is doubled to reserve space for sk_buff metadata. This preserves the full buf_alloc for payload under normal operation, while still bounding the skb queue growth. In the future, we plan to improve how we handle the merging of packets to minimize overhead and avoid closing connections. v3: https://lore.kernel.org/netdev/20260513105417.56761-1-sgarzare@redhat.com/ v2: https://lore.kernel.org/netdev/20260512080737.36787-1-sgarzare@redhat.com/ v1: https://lore.kernel.org/netdev/20260508092330.69690-1-sgarzare@redhat.com/ ==================== Link: https://patch.msgid.link/20260518090656.134588-1-sgarzare@redhat.com Signed-off-by: Paolo Abeni commit c6087c5aaad6d1b8be1a1a641e0a422218ade911 Author: Stefano Garzarella Date: Mon May 18 11:06:56 2026 +0200 vsock/virtio: fix skb overhead accounting to preserve full buf_alloc After commit 059b7dbd20a6 ("vsock/virtio: fix potential unbounded skb queue"), virtio_transport_inc_rx_pkt() subtracts per-skb overhead from buf_alloc when checking whether a new packet fits. This reduces the effective receive buffer below what the user configured via SO_VM_SOCKETS_BUFFER_SIZE, causing legitimate data packets to be silently dropped and applications that rely on the full buffer size to deadlock. Also, the reduced space is not communicated to the remote peer, so its credit calculation accounts more credit than the receiver will actually accept, causing data loss (there is no retransmission). With this approach we currently have failures in tools/testing/vsock/vsock_test.c. Test 18 sometimes fails, while test 22 always fails in this way: 18 - SOCK_STREAM MSG_ZEROCOPY...hash mismatch 22 - SOCK_STREAM virtio credit update + SO_RCVLOWAT...send failed: Resource temporarily unavailable Fix by allowing at most `buf_alloc * 2` as the total budget for payload plus skb overhead in virtio_transport_inc_rx_pkt(), similar to how SO_RCVBUF is doubled to reserve space for sk_buff metadata. This preserves the full buf_alloc for payload under normal operation, while still bounding the skb queue growth. With this patch, all tests in tools/testing/vsock/vsock_test.c are now passing again. Fixes: 059b7dbd20a6 ("vsock/virtio: fix potential unbounded skb queue") Cc: stable@vger.kernel.org Signed-off-by: Stefano Garzarella Link: https://patch.msgid.link/20260518090656.134588-3-sgarzare@redhat.com Signed-off-by: Paolo Abeni commit a4f0b001782b21663d10df983b4b208195bec66c Author: Stefano Garzarella Date: Mon May 18 11:06:55 2026 +0200 vsock/virtio: reset connection on receiving queue overflow When there is no more space to queue an incoming packet, the packet is silently dropped. This causes data loss without any notification to either peer, since there is no retransmission. Under normal circumstances, this should never happen. However, it could happen if the other peer doesn't respect the credit, or if the skb overhead, which we recently began to take into account with commit 059b7dbd20a6 ("vsock/virtio: fix potential unbounded skb queue"), is too high. Fix this by resetting the connection and setting the local socket error to ENOBUFS when virtio_transport_recv_enqueue() can no longer queue a packet, so both peers are explicitly notified of the failure rather than silently losing data. Fixes: ae6fcfbf5f03 ("vsock/virtio: discard packets if credit is not respected") Cc: stable@vger.kernel.org Signed-off-by: Stefano Garzarella Link: https://patch.msgid.link/20260518090656.134588-2-sgarzare@redhat.com Signed-off-by: Paolo Abeni commit 88e994c57a79f62d5338231d8d37ee8dd98baffe Author: Salman Alghamdi Date: Wed May 13 23:34:40 2026 +0300 staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction Add guards to ensure ie_length is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow. Fixes: 2038fe84b8bd ("staging: rtl8723bs: fix spacing around operators") Fixes: d3fcee1b78a5 ("staging: rtl8723bs: fix camel case in struct wlan_bssid_ex") Closes: https://lore.kernel.org/linux-staging/DI2H39EAAFBZ.3KI5NWN02AQ2S@linux.dev/ Cc: stable Signed-off-by: Salman Alghamdi Reviewed-by: Luka Gejak Link: https://patch.msgid.link/20260513203455.31792-1-me@cipherat.com Signed-off-by: Greg Kroah-Hartman commit 2b98b990404700297af4ef1ca00041a7cefddaa0 Author: Peter Ujfalusi Date: Wed May 20 17:00:01 2026 +0300 MAINTAINERS: ASoC: Intel/SOF: Remove Ranjani Sridharan as maintainer Ranjani no longer works on Intel/SOF audio drivers and her email address now bounce due to her departure from Intel. Unfortunately, she was not able to send the removal mail by herself. Thanks for the years of work and dedication, Ranjani! Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Guennadi Liakhovetski Reviewed-by: Liam Girdwood Reviewed-by: Kai Vehmanen Reviewed-by: Jyri Sarha Link: https://patch.msgid.link/20260520140001.1375-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 61fef83f239ecace1cce716135762a2d9b7b1fc6 Author: Bartosz Golaszewski Date: Wed May 20 14:16:31 2026 +0200 gpio: aggregator: remove the software node when deactivating the aggregator The dynamic software node we create for the aggregator platform device when using configfs is leaked when the device is deactivated. Destroy it as the last step in the tear-down path. Fixes: 86f162e73d2d ("gpio: aggregator: introduce basic configfs interface") Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/all/CAMuHMdVZ=XUvJTGdDAjnkxgtw7Uvnn61iOy3XN_5XNZM2anctw@mail.gmail.com/ Link: https://patch.msgid.link/20260520121631.33976-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 30c073cab97afb31901f94de9605177b6b84367e Author: Bartosz Golaszewski Date: Wed May 20 10:49:11 2026 +0200 gpio: aggregator: fix a potential use-after-free On error we free aggr->lookups->dev_id before removing the entry from the lookup table. If a concurrent thread calls gpiod_find() before we remove the entry, it could iterate over the list and call gpiod_match_lookup_table() which unconditionally dereferences dev_id when calling strcmp(). Reverse the order of cleanup. Fixes: 86f162e73d2d ("gpio: aggregator: introduce basic configfs interface") Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260520084911.27938-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 3e6ccd790ed69bedd3d9626d01dd35cf9821c121 Author: Bartosz Golaszewski Date: Thu May 21 10:42:16 2026 +0200 gpio: cdev: check if uAPI v2 config attributes are correctly zeroed We check the padding of other uAPI v2 structures but not that of line config attributes. For used attributes: check if their padding is zeroed, for unused: check if the entire structure is zeroed. Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL") Reviewed-by: Kent Gibson Link: https://patch.msgid.link/20260521-gpio-cdev-attr-padding-check-v3-1-ec3bcbe2e358@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 0377bd2722c1891754cde2bc41de21bc34c50d6c Merge: 48f6a5356a33dd c2e152f7ce3208 Author: Paolo Abeni Date: Thu May 21 11:58:18 2026 +0200 Merge branch 'net-stmmac-eic7700-fix-delay-calculation-and-initialization-ordering' Zhi Li says: ==================== net: stmmac: eic7700: fix delay calculation and initialization ordering From: Zhi Li ==================== Link: https://patch.msgid.link/20260518021919.404-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni commit c2e152f7ce3208b9333d212d41a87637ec1dd170 Author: Zhi Li Date: Mon May 18 10:22:13 2026 +0800 net: stmmac: eswin: validate RGMII delay values Validate rx-internal-delay-ps and tx-internal-delay-ps against the hardware capabilities of the EIC7700 MAC. The programmable RGMII delay supports 20 ps steps and a maximum value of 2540 ps. The driver previously accepted arbitrary values and silently truncated unsupported settings when converting them to hardware units. As a result, invalid device tree values could lead to unexpected delay programming and incorrect RGMII timing. Reject delay values that are not multiples of 20 ps or exceed the supported hardware range. Fixes: ea77dbbdbc4e ("net: stmmac: add Eswin EIC7700 glue driver") Signed-off-by: Zhi Li Link: https://patch.msgid.link/20260518022214.507-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni commit 6ffcef9bc1fc2ad8110777decd6d026e3cb468ce Author: Zhi Li Date: Mon May 18 10:21:52 2026 +0800 net: stmmac: eswin: correct RGMII delay granularity to 20 ps The EIC7700 MAC implements programmable RGMII delay adjustment with a granularity of 20 ps per hardware step. The driver previously converted rx-internal-delay-ps and tx-internal-delay-ps values using a 100 ps step size, resulting in incorrect delay programming. Update the conversion to use the correct 20 ps granularity so the programmed delay matches the values described in the device tree. Fixes: ea77dbbdbc4e ("net: stmmac: add Eswin EIC7700 glue driver") Signed-off-by: Zhi Li Link: https://patch.msgid.link/20260518022156.484-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni commit 6872fb088edc1a3c36792b301f8e4a1c35dd7c35 Author: Zhi Li Date: Mon May 18 10:21:37 2026 +0800 net: stmmac: eswin: clear TXD and RXD delay registers during initialization Clear the TXD and RXD delay control registers during EIC7700 DWMAC initialization. These registers may retain values programmed by the bootloader. If left unchanged, residual delays can alter the effective RGMII timing seen by the MAC and override the configuration described by the device tree. This may violate the expected RGMII timing model and can cause link instability or prevent the Ethernet controller from operating correctly. Explicitly clearing these registers ensures that the MAC delay settings are determined solely by the kernel configuration. The corresponding register offsets are optional, and the registers are only cleared when the offsets are provided in the device tree. Fixes: ea77dbbdbc4e ("net: stmmac: add Eswin EIC7700 glue driver") Signed-off-by: Zhi Li Link: https://patch.msgid.link/20260518022137.464-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni commit 23386defe949c0db4f746bed7098fc5e06746083 Author: Zhi Li Date: Mon May 18 10:20:55 2026 +0800 net: stmmac: eswin: fix HSP CSR init ordering after clock enable Fix the initialization ordering of the HSP CSR configuration in the EIC7700 DWMAC glue driver. The HSP CSR registers control MAC-side RGMII delay behavior and must only be accessed after the corresponding clocks are enabled. The previous implementation could trigger register access before clock enablement, leading to undefined behavior depending on boot state. Move the HSP CSR configuration into the post-clock-enable initialization path to ensure all register accesses occur under valid clock domains. This change ensures deterministic initialization and prevents clock-dependent register access failures during probe or resume. Fixes: ea77dbbdbc4e ("net: stmmac: add Eswin EIC7700 glue driver") Signed-off-by: Zhi Li Link: https://patch.msgid.link/20260518022055.444-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni commit c36069c6f46c52458bb86fa8eb4803f1e0b70fb0 Author: Zhi Li Date: Mon May 18 10:20:23 2026 +0800 dt-bindings: ethernet: eswin: add optional TXD and RXD delay register offsets Document two optional cells in eswin,hsp-sp-csr for the TXD and RXD delay control register offsets. These registers are used by the driver to clear any residual delay configuration left by the bootloader, ensuring that MAC-side RGMII delay settings are applied solely according to the kernel configuration. Add a reference to the EIC7700X SoC Technical Reference Manual for background information about the HSP CSR block. Fixes: 888bd0eca93c ("dt-bindings: ethernet: eswin: Document for EIC7700 SoC") Signed-off-by: Zhi Li Acked-by: Conor Dooley Link: https://patch.msgid.link/20260518022023.427-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni commit 96031b31a4b3b6ec836b9fe7be8f6e6ebcfe8d67 Author: Marek Szyprowski Date: Thu May 21 00:04:22 2026 +0200 irqchip/exynos-combiner: Switch to raw_spinlock The exynos-combiner driver uses a regular spinlock to protect access to the combiner interrupt status register in combiner_handle_cascade_irq(), which is invoked in hard interrupt context as a chained interrupt handler. When PREEMPT_RT is enabled on ARM, regular spinlock is converted to a sleeping lock (mutex-based), which must not be used in atomic context such as hard interrupt handlers. Switch the irq_controller_lock to raw_spinlock, which remains a true non-sleeping spinlock even under PREEMPT_RT. Fixes: a900e5d99718 ("ARM: exynos: move exynos4210-combiner to drivers/irqchip") Signed-off-by: Marek Szyprowski Signed-off-by: Thomas Gleixner commit 48f6a5356a33dd78e7144ae1faef95ffc990aae0 Author: Hyunwoo Kim Date: Sat May 16 07:28:53 2026 +0900 net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result, the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is one such writer (esp4.c, esp6.c), and a single nft 'dup to ' rule -- or any other nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray writes. Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on its own; they need no change. The same omission exists in skb_gro_receive() and skb_gro_receive_list(). The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's shinfo as the nskb -- both p and lp must carry the marker. The same omission also exists in tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but a future consumer depending on the marker would regress silently. The same omission exists in skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker. Fixes: cef401de7be8 ("net: fix possible wrong checksum generation") Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags") Suggested-by: Sabrina Dubroca Suggested-by: Sultan Alsawaf Suggested-by: Ben Hutchings Suggested-by: Lin Ma Suggested-by: Jingguo Tan Suggested-by: Aaron Esau Cc: stable@vger.kernel.org Signed-off-by: Hyunwoo Kim Tested-by: Rajat Gupta Link: https://patch.msgid.link/ageeJfJHwgzmKXbh@v4bel Signed-off-by: Paolo Abeni commit 542f5248cb481073203e0dadab5bcbd28aeae308 Author: Ian Abbott Date: Wed Apr 22 17:21:19 2026 +0100 comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() Commit 783ddaebd397 ("staging: comedi: comedi_test: support scan_begin_src == TRIG_FOLLOW") neglected to add a test that `scan_begin_src` has only one bit set. The allowed values are `TRIG_FOLLOW` and `TRIG_TIMER`, but the code incorrectly also allows `TRIG_FOLLOW | TRIG_TIMER`. Add a call to `comedi_check_trigger_is_unique()` to check that only one trigger source bit is set. Fixes: 783ddaebd397 ("staging: comedi: comedi_test: support scan_begin_src == TRIG_FOLLOW") Cc: stable Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260422162138.36003-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 8a3bee801d420be8a7a0bae4a26547b353b8fe22 Author: Ian Abbott Date: Wed Apr 22 15:46:37 2026 +0100 comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() The function checks and possibly modifies the description of an asynchronous command to be run on the analog input subdevice of a comedi device attached to the "comedi_test" driver, returning 0 if no modifications were required, or a positive value that indicates which step of the checking process it failed on. Step 4 fixes up various argument values for various trigger sources. There are two bugs in the fixing up of the `convert_arg` value to keep the `scan_begin_arg` value within the range of `unsigned int` when `scan_begin_src` and `convert_src` both have the value `TRIG_TIMER`, which indicates that the corresponding `_arg` values hold a time period in nanoseconds. The code also uses `scan_end_arg` which hold the number of "conversions" within each "scan". The goal is to end up with the scan period being less than or equal to the convert period multiplied by the number of conversions per scan. It intends to do that by clamping the `convert_arg` value to a maximum value of `UINT_MAX / scan_end_arg` rounded down to a multiple of 1000 (`NSEC_PER_USEC`). (The rounding from nanoseconds to microseconds is because the driver is modelling a device that uses a 1 MHz clock for timing. This is partly because that is a more typical timing base for real hardware devices driven by comedi, and partly because the driver used to use `struct timeval` internally.) The first bug is that the code checks if `scan_begin_arg == TRIG_TIMER` when it should be checking if `scan_begin_src == TRIG_TIMER`. The bugged check will always fail because if `scan_begin_src == TRIG_TIMER`, then `scan_begin_arg` will be at least 1000 (`NSEC_PER_USEC`), otherwise `scan_begin_src == TRIG_FOLLOW` and `scan_begin_arg` will be 0. (N.B `TRIG_TIMER` is defined as `0x10`.) The second bug is that is rounding the maximum value down to a multiple of 1000000000 (`NSEC_PER_SEC`) instead of 1000 (`NSEC_PER_USEC`), however this bug is not reached due to the first bug. This patch fixes both bugs. Fixes: 783ddaebd397 ("staging: comedi: comedi_test: support scan_begin_src == TRIG_FOLLOW") Fixes: 5afdcad2f818 ("staging: comedi: comedi_test: limit maximum convert_arg") Cc: stable Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260422144637.27692-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit be460cedb67ab803c1bebceac19b1d44acb85d30 Author: Stepan Ionichev Date: Wed May 20 16:05:04 2026 +0500 gpio: pca953x: propagate regulator_enable() error from resume pca953x_resume() returns 0 when regulator_enable() fails, dropping the real error code and masking the failure as a successful resume. The caller then proceeds as if the chip is powered, while the regulator is in fact disabled. Return ret so PM core sees the actual failure. Signed-off-by: Stepan Ionichev Link: https://patch.msgid.link/20260520110504.13969-1-sozdayvek@gmail.com Signed-off-by: Bartosz Golaszewski commit 689f2facc689c8add11d7ff69fbbad17d65ee596 Author: Wanquan Zhong Date: Wed May 20 19:32:45 2026 +0800 USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL The RW135R-GL entry added in commit 01e8d0f74222 ("USB: serial: option: add support for Rolling Wireless RW135R-GL") was missing the .driver_info = RSVD(5) flag used by other Rolling Wireless MBIM laptop modules (e.g. RW135-GL and RW350-GL). Without this flag, the option driver incorrectly binds to the reserved ADB interface (If#5) in multi-interface USB modes, causing AT/MBIM communication failures after mode switching. This matches the handling of other Rolling Wireless MBIM devices. - VID:PID 33f8:1003, RW135R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS) 0x1003: mbim, diag, AT, pipe Here are the outputs of usb-devices: T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=1003 Rev= 5.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW135R-GL Module S: SerialNumber=12345678 C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms - VID:PID 33f8:1003, RW135R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS) 0x1003: mbim, diag, AT, ADB, pipe Here are the outputs of usb-devices: T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=1003 Rev= 5.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW135R-GL Module S: SerialNumber=12345678 C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms - VID:PID 33f8:1003, RW135R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS) 0x1003: mbim, pipe Here are the outputs of usb-devices: T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=1003 Rev= 5.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW135R-GL Module S: SerialNumber=12345678 C:* #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Fixes: 01e8d0f74222 ("USB: serial: option: add support for Rolling Wireless RW135R-GL") Signed-off-by: Wanquan Zhong Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 7d2b37d3e42d19071b62f4ddbee6e16e905efbf1 Author: Jan Volckaert Date: Sun May 17 17:32:37 2026 +0200 USB: serial: option: add MeiG SRM813Q Add support for the Qualcomm Technology Snapdragon X35-based MeiG SRM813Q module. The module can be put in different modes via AT commands to enable/disable GPS functionality: MODEM - PPP mode(2dee:4d63): AT+SER=1,1 If#= 0: RMNET If#= 1: DIAG/ADB If#= 2: MODEM If#= 3: AT P: Vendor=2dee ProdID=4d63 Rev=05.15 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=1bd51f0e C: #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms NMEA mode(2dee:4d64): AT+SER=51,1 If#= 0: RMNET If#= 1: DIAG/ADB If#= 2: NMEA If#= 3: AT P: Vendor=2dee ProdID=4d64 Rev=05.15 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=1bd51f0e C: #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms Signed-off-by: Jan Volckaert Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit aee43aaf26c7f162780ab77ce952bae6a1b354bd Merge: 30afd245e24a73 b6fe4ff340560e Author: Dave Airlie Date: Thu May 21 16:29:38 2026 +1000 Merge tag 'amd-drm-fixes-7.1-2026-05-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.1-2026-05-20: amdgpu: - Userq fixes - VPE fix - SMU 15 fix - Misc fixes - VCE fixes - DC bios parsing fixes - DC aux fix - Mode1 reset fix - RAS fixes amdkfd: - Misc fixes radeon: - CS parser fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260520181359.28421-1-alexander.deucher@amd.com commit f42d01aadcedd7bbf4f9a466cabe25c1781dedad Author: Hongtao Lee Date: Wed May 20 11:01:26 2026 +0800 tools/bootconfig: Fix buf leaks in apply_xbc If data calloc failed, free the buf before return. Link: https://lore.kernel.org/all/20260520030126.147782-1-lihongtao@kylinos.cn/ Fixes: 950313ebf79c ("tools: bootconfig: Add bootconfig command") Signed-off-by: Hongtao Lee Signed-off-by: Masami Hiramatsu (Google) commit 1bbf0ced1d9db73ac7893c2187f3459288603e0d Author: Eric Dumazet Date: Tue May 19 08:46:11 2026 +0000 tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()): - min_ttl / min_hopcount check - xfrm policy check - tcp_inbound_hash() MD5/AO mismatch - tcp_filter() eBPF/SO_ATTACH_FILTER drop - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv() - tcp_checksum_complete() in tcp_v{4,6}_do_rcv() - tcp_v{4,6}_cookie_check() returning NULL When a packet is dropped on any of these paths, tcp_tw_isn is left set. The next SYN processed on the same CPU then consumes the non zero value in tcp_conn_request(), receiving a potentially predictable ISN. This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu variable. Note that tcp_v{4,6}_fill_cb() do not set it. Very litle impact on overall code size/complexity: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7) Function old new delta tcp_v6_rcv 3038 3042 +4 tcp_v4_rcv 3035 3039 +4 tcp_conn_request 2938 2923 -15 Total: Before=24436060, After=24436053, chg -0.00% Fixes: 41eecbd712b7 ("tcp: replace TCP_SKB_CB(skb)->tcp_tw_isn with a per-cpu field") Reported-by: Chris Mason Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260519084611.2485277-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 99e22ddf4edb63dc8382bc028af928056d3450cf Author: Minh Nguyen Date: Tue May 19 17:23:10 2026 +0700 vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference. This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any subsequent packet can find it. The pre-existing sk_acceptq_removed() gap on the err < 0 path of vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch. Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Cc: stable@vger.kernel.org Signed-off-by: Minh Nguyen Acked-by: Bryan Tan Link: https://patch.msgid.link/20260519102310.237181-1-minhnguyen.080505@gmail.com Signed-off-by: Jakub Kicinski commit fa997ddef508b1b37b2fe4d2dad7c4b70958335e Author: Ivan Vecera Date: Tue May 19 15:22:05 2026 +0200 dpll: zl3073x: fix memory leak on pin registration failure If zl3073x_dpll_pin_register() fails, the allocated pin is not yet added to zldpll->pins list. The error path calls zl3073x_dpll_pins_unregister() which only iterates pins on the list, so the current pin is leaked. Free the pin before jumping to the error label. Additionally move the pin->dpll_pin = NULL assignment in zl3073x_dpll_pin_register() from err_register to the common err_pin_get path. When dpll_pin_get() fails, pin->dpll_pin holds an ERR_PTR value. Without this fix the subsequent zl3073x_dpll_pin_free() would trigger a spurious WARN because it checks pin->dpll_pin for non-NULL. Fixes: 75a71ecc2412 ("dpll: zl3073x: Register DPLL devices and pins") Reviewed-by: Petr Oros Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260519132205.161847-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit e4bdef4d320b2fe73b8ebfc0cc0507fa9dc4a3b7 Author: Eric Dumazet Date: Tue May 19 19:32:48 2026 +0000 ipv4: use WARN_ON_ONCE() in ip_rt_bug() It turns out ip_rt_bug() can be called more than expected. syzbot will still panic (because of panic_on_warn=1), but non debug kernels will no longer die while repeating stack traces on the console. Fixes: c378a9c019cf ("ipv4: Give backtrace in ip_rt_bug().") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260519193248.4018872-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7eb72c1e3984150c45f77aa4299f7c2598a68e9b Author: Eric Dumazet Date: Tue May 19 20:08:36 2026 +0000 ipv4: icmp: reject broadcast/multicast routes syzbot was able to trigger ip_rt_bug() in a loop, using an IPv4 packet with a crafted IPOPT_SSRR option: options: ipv4_options { options: array[ipv4_option] { union ipv4_option { ssrr: ipv4_option_route[IPOPT_SSRR] { type: const = 0x89 (1 bytes) length: len = 0x7 (1 bytes) pointer: int8 = 0xa2 (1 bytes) data: array[ipv4_addr] { union ipv4_addr { broadcast: const = 0xffffffff (4 bytes) } } } } Change __icmp_send() to not send ICMP to broadcast/multicast destinations. Fixes: c378a9c019cf ("ipv4: Give backtrace in ip_rt_bug().") Reported-by: syzbot+c13a57c2639c2c0d03a6@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a0cc169.170a0220.1f6c2d.0004.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20260519200836.4141061-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4eb82ba543421e9e38cc14e4e82058b78850df50 Author: David Carlier Date: Tue May 19 21:35:30 2026 +0100 net: devmem: reject dma-buf bind with non-page-aligned size or SG length net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without checking: - tx_vec is sized dmabuf->size / PAGE_SIZE, and net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size before indexing tx_vec[virt_addr / PAGE_SIZE]. With size = N*PAGE_SIZE + r (1 <= r < PAGE_SIZE), sendmsg() at iov_base = N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past. - owner->area.num_niovs = len / PAGE_SIZE while gen_pool_add_owner() covers the full byte len, so a non-page-multiple non-final sg desyncs num_niovs from the gen_pool region for every later sg, on both RX and TX. dma-buf does not require page-aligned sizes, so the bind path has to enforce what its own indexing assumes. Reject both with -EINVAL. The size check is TX-only (only tx_vec is sized off dmabuf->size); the SG-length check covers both directions. Fixes: bd61848900bf ("net: devmem: Implement TX path") Cc: stable@vger.kernel.org Signed-off-by: David Carlier Reviewed-by: Bobby Eshleman Acked-by: Stanislav Fomichev Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20260519203530.66310-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski commit 30afd245e24a73dbe0451877244ef1dd5154fcf1 Merge: 5b4a47dc547f99 4703049f768fc1 Author: Dave Airlie Date: Thu May 21 11:50:27 2026 +1000 Merge tag 'drm-intel-fixes-2026-05-20' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix joiner color pipeline selection [display] (Chaitanya Kumar Borah) - Fix readback for target_rr in Adaptive Sync SDP [dp] (Ankit Nautiyal) - Apply Intel DPCD workaround when SDP on prior line used [psr] (Jouni Högander) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patch.msgid.link/ag1hKBRKwwv9JOMW@linux commit fd948c3f96b18ff9ba7d3e8eae13d196593e1aaf Author: Carlos López Date: Tue May 12 12:00:42 2026 +0200 virt: sev-guest: Explicitly leak pages in unknown state When set_memory_{encrypted,decrypted}() fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view of the caller. Since the pages may be left in an unencrypted state, they are not suitable for general use, and cannot be returned safely to the buddy allocator. Avoid the issue by never freeing the pages, and then do the proper accounting by calling snp_leak_pages(). Fixes: 3e385c0d6ce8 ("virt: sev-guest: Move SNP Guest Request data pages handling under snp_cmd_mutex") Signed-off-by: Carlos López Signed-off-by: Borislav Petkov (AMD) Cc: stable@kernel.org commit 5027c886e26cdf02b4cb114e47d922855e2e37e0 Merge: 4a2844dcc04d05 ab1513597c6cf1 Author: Jakub Kicinski Date: Wed May 20 17:26:55 2026 -0700 Merge tag 'for-net-2026-05-20' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sync: Fix not setting mask for HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE - L2CAP: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - ISO: drop ISO_END frames received without prior ISO_START - MGMT: validate Add Extended Advertising Data length - bnep: Fix UAF read of dev->name - btmtk: fix urb->setup_packet leak in error paths - btintel_pcie: Fix incorrect MAC access programming - hci_uart: fix UAFs and race conditions in close and init paths * tag 'for-net-2026-05-20' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Bluetooth: MGMT: validate Add Extended Advertising Data length Bluetooth: btmtk: fix urb->setup_packet leak in error paths Bluetooth: ISO: drop ISO_END frames received without prior ISO_START Bluetooth: btintel_pcie: Fix incorrect MAC access programming Bluetooth: hci_sync: Fix not setting mask for HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE Bluetooth: bnep: Fix UAF read of dev->name ==================== Link: https://patch.msgid.link/20260520204959.2902497-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 4a2844dcc04d05103fc108804489f9d6b3ac52a8 Merge: e7c70bf97e90d9 33644bd38aec24 Author: Jakub Kicinski Date: Wed May 20 17:23:56 2026 -0700 Merge branch 'bpf-skmsg-fix-verdict-sk_data_ready-racing-with-ktls-rx' Xingwang Xiang says: ==================== bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_verdict_data_ready() lacks the tls_sw_has_ctx_rx() guard that sk_psock_strp_data_ready() gained in e91de6afa81c. When a socket is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is configured, the missing guard causes tcp_read_skb() to drain sk_receive_queue without advancing copied_seq, leaving a dangling frag_list pointer that tls_decrypt_sg() walks — a use-after-free. Patch 1 mirrors the fix from e91de6afa81c: add the tls_sw_has_ctx_rx() check to sk_psock_verdict_data_ready() so that when a TLS RX context is present the function defers to psock->saved_data_ready (sock_def_readable) instead of calling tcp_read_skb(). Patch 2 adds a selftest that drives the vulnerable sequence end-to-end and verifies recv() returns the correct decrypted data. ==================== Link: https://patch.msgid.link/20260517145630.20521-1-v3rdant.xiang@gmail.com Signed-off-by: Jakub Kicinski commit 33644bd38aec24fe043e78ce5dca38e7156f8328 Author: Xingwang Xiang Date: Sun May 17 23:56:27 2026 +0900 selftests/bpf: add regression test for ktls+sockmap verdict UAF Test the scenario where a socket is inserted into a sockmap with a BPF_SK_SKB_VERDICT program before TLS RX is configured. Previously sk_psock_verdict_data_ready() would call tcp_read_skb() and drain the receive queue without advancing copied_seq, causing tls_decrypt_sg() to walk a dangling frag_list pointer (use-after-free). The test drives the full vulnerable sequence and verifies that after the fix recv() returns the correct decrypted data. Signed-off-by: Xingwang Xiang Link: https://patch.msgid.link/20260517145630.20521-3-v3rdant.xiang@gmail.com Signed-off-by: Jakub Kicinski commit ddf8029623a1af20e984c040e89ff918158397ab Author: Xingwang Xiang Date: Sun May 17 23:56:26 2026 +0900 bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership of the receive queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types with ktls"). sk_psock_verdict_data_ready() has no equivalent guard. When a socket is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready as rx_ctx->saved_data_ready. On data arrival: tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready -> saved_data_ready() = sk_psock_verdict_data_ready() -> tcp_read_skb() drains sk_receive_queue via __skb_unlink() without calling tcp_eat_skb(), so copied_seq is not advanced. tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned (potentially freed) skb. tls_decrypt_sg() subsequently walks that frag_list: use-after-free. Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context is present, call psock->saved_data_ready (sock_def_readable) to wake recv() waiters and return immediately, leaving the receive queue untouched. TLS retains sole ownership of the queue and decrypts the record normally through tls_sw_recvmsg(). Fixes: ef5659280eb1 ("bpf, sockmap: Allow skipping sk_skb parser program") Signed-off-by: Xingwang Xiang Link: https://patch.msgid.link/20260517145630.20521-2-v3rdant.xiang@gmail.com Signed-off-by: Jakub Kicinski commit 5b4a47dc547f999f42a29a7fe4a7dd7e09441d1e Merge: 5200f5f493f79f db339b6bc9f234 Author: Dave Airlie Date: Thu May 21 10:12:21 2026 +1000 Merge tag 'drm-msm-fixes-2026-05-17' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v7.1: Core: - Fixed bindings for SM8650, SM8750 and Eliza - Don't use UTS_RELEASE directly - Fix typo in clock-names property DPU: - Fixed CWB description on Kaanapali - Fixed scanline strides for YUV UBWC formats - Stopped DSI register dumping to access past the end of region DSI: - Fix dumping unaligned regions GPU: - Fix GMEM_BASE for a6xx gen3 - Fix userspace reachable crash on a2xx-a4xx - Fix sysprof_active for counter collection with IFPC enabled GPUs - Fix shrinker lockdep Signed-off-by: Dave Airlie From: Rob Clark Link: https://patch.msgid.link/CACSVV02cTK7h=d0uqanRE-cj35THDqFjqsTB_2zQV1Mcw77aNw@mail.gmail.com commit e7c70bf97e90d974cd575e4c90f8f9b07d056da3 Author: Rosen Penev Date: Sat May 16 14:26:16 2026 -0700 net: ag71xx: check error for platform_get_irq Complete error handling for a failed platform_get_irq() call Fixes: d51b6ce441d3 ("net: ethernet: add ag71xx driver") Signed-off-by: Rosen Penev Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20260516212616.11758-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski commit 7769d17e023a3aa4b4bc5b700532004c8d701962 Merge: b1a736f8bcb1b0 8bfab4b6ffc2fe Author: Jakub Kicinski Date: Wed May 20 16:36:47 2026 -0700 Merge branch 'rxrpc-better-fix-for-data-response-decrypt-vs-splice' David Howells says: ==================== rxrpc: Better fix for DATA/RESPONSE decrypt vs splice() Here are two patches containing better fixes for the in-place decryption of DATA and RESPONSE packets that can corrupt pagecache spliced into UDP packets and sent to an AF_RXRPC server [CVE-2026-43500], plus a patch to precheck the length of rxgk-secured DATA packets. Of the main patches, one patch fixes DATA decryption by having recvmsg unconditionally extract the data into a flat bounce buffer and, if need be, decrypt it there. It doesn't seem to cause a performance problem to do this even on unencrypted packets; for encrypted packets it makes sure the content is correctly aligned for crypto which seems to get a small performance gain. Further, it means that DATA packets are no longer copied in the I/O thread, avoiding a slowdown of the protocol engine that runs there. The other main patch fixes RESPONSE decryption by having the connection event handler worker copy the data to a flat buffer and, again, decrypt it there. This simplifies RESPONSE handling. With these two fixes, the data content of the received sk_buff no longer gets altered. ==================== Link: https://patch.msgid.link/20260515230516.2718212-1-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 8bfab4b6ffc2fe92da86300728fc8c3c7ebffb56 Author: David Howells Date: Sat May 16 00:05:15 2026 +0100 rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer This improves the fix for CVE-2026-43500. Fix the verification of RESPONSE packets to avoid the problem of overwriting a RESPONSE packet sent via splice to a local address by extracting the contents of the UDP packet into a kmalloc'd linear buffer rather than decrypting the data in place in the sk_buff (which may corrupt the original buffer). Fixes: 24481a7f5733 ("rxrpc: Fix conn-level packet handling to unshare RESPONSE packets") Reported-by: Hyunwoo Kim Closes: https://lore.kernel.org/r/afKV2zGR6rrelPC7@v4bel/ Signed-off-by: David Howells cc: Simon Horman cc: Jiayuan Chen cc: linux-afs@lists.infradead.org cc: stable@kernel.org Reviewed-by: Jeffrey Altman Tested-by: Marc Dionne Link: https://patch.msgid.link/20260515230516.2718212-4-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit d2bc90cf6c75cb96d2ce549be6c35efa3099d25b Author: David Howells Date: Sat May 16 00:05:14 2026 +0100 rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice() by getting rid of the packet sharing in the I/O thread and unconditionally extracting the packet content into a bounce buffer in which the buffer is decrypted. recvmsg() (or the kernel equivalent) then copies the data from the bounce buffer to the destination buffer. The sk_buff then remains unmodified. This has an additional advantage in that the packet is then arranged in the buffer with the correct alignment required for the crypto algorithms to process directly. The performance of the crypto does seem to be a little faster and, surprisingly, the unencrypted performance doesn't seem to change much - possibly due to removing complexity from the I/O thread. Yet another advantage is that the I/O thread doesn't have to copy packets which would slow down packet distribution, ACK generation, etc.. The buffer belongs to the call and is allocated initially at 2K, sufficiently large to hold a whole jumbo subpacket, but the buffer will be increased in size if needed. However, to take this work, MSG_PEEK may cause a later packet to be decrypted into the buffer, in which case the earlier one will need re-decrypting for a subsequent recvmsg(). Note that rx_pkt_offset may legitimately see 0 as a valid offset now, so switch to using USHRT_MAX to indicate an invalid offset. Note also that I would generally prefer to replace the buffers of the current sk_buff with a new kmalloc'd buffer of the right size, ditching the old data and frags as this makes the handling of MSG_PEEK easier and removes the re-decryption issue, but this looks like quite a complicated thing to achieve. skb_morph() looks half way to what I want, but I don't want to have to allocate a new sk_buff. Fixes: d0d5c0cd1e71 ("rxrpc: Use skb_unshare() rather than skb_cow_data()") Reported-by: Hyunwoo Kim Closes: https://lore.kernel.org/r/afKV2zGR6rrelPC7@v4bel/ Signed-off-by: David Howells cc: Simon Horman cc: Jiayuan Chen cc: linux-afs@lists.infradead.org Reviewed-by: Jeffrey Altman Tested-by: Marc Dionne Link: https://patch.msgid.link/20260515230516.2718212-3-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 2b50aceafe6606ea52ed42aadd1b4d44a188aade Author: David Howells Date: Sat May 16 00:05:13 2026 +0100 crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AF_RXRPC to make use of this to validate DATA packets secured with RxGK. Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") Closes: https://sashiko.dev/#/patchset/20260511160753.607296-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Herbert Xu cc: Simon Horman cc: Chuck Lever cc: linux-afs@lists.infradead.org Reviewed-by: Jeffrey Altman Tested-by: Marc Dionne Link: https://patch.msgid.link/20260515230516.2718212-2-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit b1a736f8bcb1b0ec4ce657f6fa9afc1f698f8f7a Merge: abe003b33223ff b8d7519352ba8c Author: Jakub Kicinski Date: Wed May 20 16:34:21 2026 -0700 Merge branch 'net-shaper-fix-valid-confusion-even-more' Jakub Kicinski says: ==================== net: shaper: fix VALID confusion even more Sashiko reported another pre-exising issue in the previous batch of fixes: https://sashiko.dev/#/patchset/20260510192904.3987113-7-kuba@kernel.org Turns out I over-esitmated the guarantees of the XArray flags. Stop using them completely. ==================== Link: https://patch.msgid.link/20260515221325.1685455-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b8d7519352ba8c6df83259295d4a3bad093cae90 Author: Jakub Kicinski Date: Fri May 15 15:13:25 2026 -0700 net: shaper: rework the VALID marking (again) Recent commit changed the semantics from NOT_VALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a race of reader observing a VALID mark for a slot, getting interrupted, writer replacing the entry with a different one, reader continuing, fetching the entry which is now a different pointer than the pointer for which VALID was meant. The biggest consequence of this is that we may see a UAF since net_shaper_rollback() assumed that entries without VALID can be freed without observing RCU. Looks like the XArray marks are buying us nothing at this point. Let's convert the code to an explicit valid field. The smp_load_acquire() / smp_store_release() barriers are marginally cleaner. Reported-by: Sashiko Fixes: 93954b40f6a4 ("net-shapers: implement NL set and delete operations") Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260515221325.1685455-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a3442936dd0523277e20aaf86207c574e755c634 Author: Jakub Kicinski Date: Fri May 15 15:13:24 2026 -0700 net: shaper: annotate the data races As previously discussed we don't care about making the shaper state fully RCU-compliant because the hierarchy itself can't be dumped in one go over Netlink. Let's annotate the reads and writes to make that clear. The field-by-field assignments will also be useful for the next commit which adds explicit "valid" field (which we don't want to override with the current full struct assignment). Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260515221325.1685455-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit abe003b33223ff33552f291644bf35d9c2f992fb Author: Prathamesh Deshpande Date: Sun May 10 23:59:00 2026 +0100 net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment. Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock. Fixes: 22239eb258bc ("net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed") Signed-off-by: Prathamesh Deshpande Reviewed-by: Simon Horman Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260510225903.13184-1-prathameshdeshpande7@gmail.com Signed-off-by: Jakub Kicinski commit 9a8e01c50093e6fc6569aa8353f856f1b6097189 Merge: dc416e32baaeb6 78effd896eee11 Author: Jakub Kicinski Date: Wed May 20 15:04:17 2026 -0700 Merge branch 'udp-gso-fix-__udp_gso_segment-after-gso_partial-udp-length-change' Gal Pressman says: ==================== udp: gso: Fix __udp_gso_segment() after GSO_PARTIAL UDP length change This series fixes two issues introduced by commit b10b446ce7ad ("udp: gso: Use single MSS length in UDP header for GSO_PARTIAL"), which switched __udp_gso_segment() to write the single MSS length into the UDP header for GSO_PARTIAL skbs. Patch 1 (from Alice) fixes the UDP checksum adjustment in __udp_gso_segment(). The patch adjusts the checksum by the correct delta, and since msslen and newlen become equivalent before the loop, drops one of the two variables to simplify the code. Patch 2 handles the case where the last segment of a GSO_PARTIAL skb is itself a GSO skb. This happens when the original packet size is an exact multiple of MSS, so the post-loop segment is not a remainder skb but a full GSO chunk and must also carry the single MSS length in its UDP header. ==================== Link: https://patch.msgid.link/20260518062250.3019914-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 78effd896eee11ac9db9bcbb53e7bbcad96073d7 Author: Gal Pressman Date: Mon May 18 09:22:50 2026 +0300 udp: Fix UDP length on last GSO_PARTIAL segment Following the cited commit, __udp_gso_segment() writes single MSS length in the UDP header. The cited patch doesn't account for the fact that the last segment could be a GSO skb by itself. This could happen when the size of the packet is a multiple of MSS, hence the first segment is also the last one (there is no need for a remainder skb). When the post-loop segment is a GSO skb, assign the single MSS length in the UDP header. Fixes: b10b446ce7ad ("udp: gso: Use single MSS length in UDP header for GSO_PARTIAL") Reported-by: Matthew Schwartz Closes: https://lore.kernel.org/all/6c3fb15e-711d-4b8d-b152-e03d9b05293f@linux.dev/ Tested-by: Matthew Schwartz Reviewed-by: Dragos Tatulea Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20260518062250.3019914-3-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 5f17ae0f595aeb560155ce98edbe44d3eacc7e40 Author: Alice Mikityanska Date: Mon May 18 09:22:49 2026 +0300 udp: gso: Fix handling checksum in __udp_gso_segment The cited commit started using msslen for uh->len, but still uses newlen to adjust uh->check. Although the checksum is ignored in most cases due to the hardware offload, __udp_gso_segment attempts to maintain the correct one. Fix uh->check and adjust it by the right value. Additionally, after the fix, newlen becomes assigned and unused before the loop. The code can be simplified a bit if mss adjustment is dropped, so that newlen becomes equal to msslen before the loop, and msslen can be also dropped, saving a few lines of code. This brings us back to one variable, drops an unneeded arithmetic for mss, and fixes the UDP checksum. Fixes: b10b446ce7ad ("udp: gso: Use single MSS length in UDP header for GSO_PARTIAL") Signed-off-by: Alice Mikityanska Reviewed-by: Willem de Bruijn Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20260518062250.3019914-2-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 44126343d58c68adaa8343fbf1c07dd20078c35e Author: Tom Lendacky Date: Wed May 20 12:00:50 2026 -0500 x86/mm: Disable broadcast TLB flush when PCID is disabled Booting with "nopcid" clears X86_FEATURE_PCID and keeps CR4.PCIDE from being set to one. On AMD CPUs that support INVLPGB, broadcast TLB flushing remains enabled. There are two checks that decide whether the global ASID code runs, mm_global_asid() and consider_global_asid(), that key off of the X86_FEATURE_INVLPGB feature. Once an mm becomes active on more than three CPUs, consider_global_asid() assigns it a global ASID, after which flush_tlb_mm_range() takes the broadcast_tlb_flush() path using a non-zero PCID. Issuing an INVLPGB with a non-zero PCID while CR4.PCIDE is not set results in a #GP: Oops: general protection fault, kernel NULL pointer dereference 0x1: 0000 [#1] SMP NOPTI CPU: 158 UID: 0 PID: 3119 Comm: snap Not tainted 7.1.0-rc3 #1 PREEMPT(full) Hardware name: ... RIP: 0010:broadcast_tlb_flush Code: ... 89 da 48 83 c8 07 <0f> 01 fe eb 08 cc cc cc ... Call Trace: flush_tlb_mm_range ptep_clear_flush wp_page_copy ? _raw_spin_unlock __handle_mm_fault handle_mm_fault do_user_addr_fault exc_page_fault asm_exc_page_fault All processors that support broadcast TLB invalidation also have PCID support, so it is only the "nopcid" scenario that is of concern. In this situation just disable the broadcast TLB support using the CPUID dependency support by making X86_FEATURE_INVLPGB dependent on X86_FEATURE_PCID. [ bp: Massage commit message. ] Fixes: 4afeb0ed1753 ("x86/mm: Enable broadcast TLB invalidation for multi-threaded processes") Suggested-by: Dave Hansen Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov (AMD) Acked-by: Rik van Riel Cc: Link: https://patch.msgid.link/b915acfd63e8b2a094fdeb8dc608738072518764.1779296450.git.thomas.lendacky@amd.com commit ab1513597c6cf17cd1ad2a21e3b045421b48e022 Author: Safa Karakuş Date: Sat May 16 21:15:04 2026 +0300 Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() bt_accept_dequeue() unlinks a not-yet-accepted child from the parent accept queue and release_sock()s it before returning, so the returned sk has no caller reference and is unlocked. l2cap_sock_cleanup_listen() walks these children on listening-socket close. A concurrent HCI disconnect drives hci_rx_work -> l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and frees the child sk and its l2cap_chan; cleanup_listen() then uses both: BUG: KASAN: slab-use-after-free in l2cap_sock_kill l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close Freed by: l2cap_conn_del -> l2cap_sock_close_cb -> l2cap_sock_kill This is distinct from the two fixes already in this area: commit e83f5e24da741 ("Bluetooth: serialize accept_q access") serialises the accept_q list/poll and takes temporary refs inside bt_accept_dequeue(), and CVE-2025-39860 serialises the userspace close()/accept() race by calling cleanup_listen() under lock_sock() in l2cap_sock_release(). Neither covers l2cap_conn_del() running from hci_rx_work, so this UAF still reproduces on current bluetooth/master. Take the reference at the source: bt_accept_dequeue() does sock_hold() while sk is still locked, before release_sock(); callers sock_put(). cleanup_listen() pins the chan with l2cap_chan_hold_unless_zero() under a brief child sk lock (serialising vs l2cap_sock_teardown_cb()), drops it before l2cap_chan_lock(), and skips a duplicate l2cap_sock_kill() on SOCK_DEAD. conn->lock is not taken here: cleanup_listen() runs under the parent sk lock and that would invert conn->lock -> chan->lock -> sk_lock (lockdep). KASAN/SMP: an unprivileged listen/close vs HCI-disconnect race produced 12 use-after-free reports per run before this change; 0, and no lockdep report, over 1600+ raced iterations after it on bluetooth/master. Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") Cc: stable@vger.kernel.org Reported-by: Siwei Zhang Reviewed-by: Siwei Zhang Signed-off-by: Safa Karakuş Signed-off-by: Luiz Augusto von Dentz commit c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b Author: Mingyu Wang <25181214217@stu.xidian.edu.cn> Date: Mon May 18 10:49:49 2026 +0800 Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities. Fixes: 3b799254cf6f ("Bluetooth: hci_uart: Cancel init work before unregistering") Cc: stable@vger.kernel.org Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> Signed-off-by: Luiz Augusto von Dentz commit d3f7d17960ed50df3a6709c5158caff989c8c905 Author: Michael Bommarito Date: Fri May 15 10:38:19 2026 -0400 Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command, with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size. The handler then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy cp->data, but it never checks that those bytes are part of the mgmt command payload. A short command can therefore make add_ext_adv_data() pass an out-of-bounds pointer into tlv_data_is_valid(). If the bytes beyond the command buffer are addressable, they can also be copied into the advertising instance as scan response data, where the caller can read them back via MGMT_OP_GET_ADV_INSTANCE. The trigger requires CAP_NET_ADMIN in the initial user namespace; KASAN reports an 8-byte slab-out-of-bounds read. Reject commands whose length does not match the fixed header plus both advertising data lengths before parsing cp->data. Fixes: 12410572833a ("Bluetooth: Break add adv into two mgmt commands") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Signed-off-by: Luiz Augusto von Dentz commit dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd Author: Jiajia Liu Date: Mon May 18 10:24:02 2026 +0800 Bluetooth: btmtk: fix urb->setup_packet leak in error paths The setup_packet of control urb is not freed if usb_submit_urb fails or the submitted urb is killed. Add free in these two paths. Fixes: a1c49c434e150 ("Bluetooth: btusb: Add protocol support for MediaTek MT7668U USB devices") Signed-off-by: Jiajia Liu Signed-off-by: Luiz Augusto von Dentz commit 84c24fb151fc1179355296d7ff29129ac7c42129 Author: David Carlier Date: Fri May 15 07:25:25 2026 +0100 Bluetooth: ISO: drop ISO_END frames received without prior ISO_START ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISO_CONT branch of iso_recv() guards against a missing ISO_START by checking conn->rx_len before touching conn->rx_skb, but ISO_END does not. If a peer sends an ISO_END as the first packet on a fresh ISO connection, conn->rx_skb is still NULL and conn->rx_len is zero, so skb_put(conn->rx_skb, ...) dereferences NULL and oopses. For BIS, where receivers sync to a broadcaster without pairing, any broadcaster on the air can trigger this. Mirror the ISO_CONT check at the top of ISO_END so a stray end fragment is logged and dropped instead of crashing the host. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: David Carlier Signed-off-by: Luiz Augusto von Dentz commit 88365d04fdc821dc4e9eb0cc00fdf6905430d172 Author: Kiran K Date: Fri May 15 00:32:48 2026 +0530 Bluetooth: btintel_pcie: Fix incorrect MAC access programming btintel_pcie_get_mac_access() and btintel_pcie_release_mac_access() were programming STOP_MAC_ACCESS_DIS and XTAL_CLK_REQ in addition to the MAC_ACCESS_REQ handshake. These bits are not part of the host MAC-access handshake on the supported parts; the driver was programming them incorrectly. Drop the writes so the register update contains only the bits the controller actually consumes. Fixes: b9465e6670a2 ("Bluetooth: btintel_pcie: Read hardware exception data") Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 23d528d817a485fe9800a66c9411bd9e3d8a6f63 Author: Luiz Augusto von Dentz Date: Thu May 14 09:42:24 2026 -0400 Bluetooth: hci_sync: Fix not setting mask for HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE This fixes not setting the bit for HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE when extended features bit is set otherwise the controller may not generate HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE causing hci_le_read_all_remote_features_sync to timeout waiting for it. Also remove dead code. Fixes: a106e50be74b ("Bluetooth: HCI: Add support for LL Extended Feature Set") Signed-off-by: Luiz Augusto von Dentz commit 59e932ded949fa6f0340bf7c6d7818f962fa4fd2 Author: Jann Horn Date: Tue May 12 22:15:39 2026 +0200 Bluetooth: bnep: Fix UAF read of dev->name bnep_add_connection() needs to keep holding the bnep_session_sem while reading dev->name (just like bnep_get_connlist() does); otherwise the bnep_session() thread can concurrently free the net_device, which can for example be triggered by a concurrent bnep_del_connection(). (This UAF is fairly uninteresting from a security perspective; calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN) check. It also requires completely tearing down a netdev during a fairly tight race window.) Cc: stable@vger.kernel.org Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jann Horn Signed-off-by: Luiz Augusto von Dentz commit 576ec047d20b368b43c4d5db98c4f2e0f3c101ec Author: David Carlier Date: Fri May 8 20:57:47 2026 +0100 tracing: Avoid NULL return from hist_field_name() on truncation hist_field_name() returns "" everywhere except the fully-qualified VAR_REF/EXPR case, where snprintf() truncation returns NULL early and bypasses the bottom NULL->"" guard. Callers don't expect NULL: strcat(expr, hist_field_name(field, 0)) at trace_events_hist.c:1758 and the strcmp() in the sort-key match loop at :4804 both deref it. system and event_name are bounded by MAX_EVENT_NAME_LEN, but the field name on a VAR_REF is kstrdup'd from a histogram variable name parsed out of the trigger string and has no length cap, so a long enough var name in a fully qualified reference can reach the truncation path. Keep the length check but leave field_name as "" on overflow. Link: https://patch.msgid.link/20260508195747.25492-1-devnexen@gmail.com Fixes: 5ec1d1e97de1 ("tracing: Rebuild full_name on each hist_field_name() call") Signed-off-by: David Carlier Signed-off-by: Steven Rostedt commit 9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90 Author: Ilya Dryomov Date: Tue May 19 23:07:26 2026 +0200 rbd: eliminate a race in lock_dwork draining on unmap Given how rbd_lock_add_request() and rbd_img_exclusive_lock() are written, lock_dwork may be (re)queued more than it's actually needed: for example in case a new I/O request comes in while we are in the middle of rbd_acquire_lock() on behalf of another I/O request. This is expected and with rbd_release_lock() preemptively canceling lock_dwork is benign under normal operation. A more problematic example is maybe_kick_acquire(): if (have_requests || delayed_work_pending(&rbd_dev->lock_dwork)) { dout("%s rbd_dev %p kicking lock_dwork\n", __func__, rbd_dev); mod_delayed_work(rbd_dev->task_wq, &rbd_dev->lock_dwork, 0); } It's not unrealistic for lock_dwork to get canceled right after delayed_work_pending() returns true and for mod_delayed_work() to requeue it right there anyway. This is a classic TOCTOU race. When it comes to unmapping the image, there is an implicit assumption of no self-initiated exclusive lock activity past the point of return from rbd_dev_image_unlock() which unlocks the lock if it happens to be held. This unlock is assumed to be final and lock_dwork (as well as all other exclusive lock tasks, really) isn't expected to get queued again. However, lock_dwork is canceled only in cancel_tasks_sync() (i.e. later in the unmap sequence) and on top of that the cancellation can get in effect nullified by maybe_kick_acquire(). This may result in rbd_acquire_lock() executing after rbd_dev_device_release() and rbd_dev_image_release() run and free and/or reset a bunch of things. One of the possible failure modes then is a violated rbd_assert(rbd_image_format_valid(rbd_dev->image_format)); in rbd_dev_header_info() which is called via rbd_dev_refresh() from rbd_post_acquire_action(). Redo exclusive lock task draining to provide saner semantics and try to meet the assumptions around rbd_dev_image_unlock(). Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov Reviewed-by: Viacheslav Dubeyko commit a67f3113331d9fb3eb0664602d9b581cb2df7294 Merge: 85cffdb21bc1a9 e4e9b7b38d5db2 Author: Rafael J. Wysocki Date: Wed May 20 22:03:41 2026 +0200 Merge tag 'amd-pstate-v7.1-2026-05-14' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux into pm-cpufreq-fixes Merge amd-pstate fixes for 7.1 (05/14/2026) from Mario Limonciello: "A number of fixes to the dynamic epp feature which was new to kernel 7.1, including making it opt in only." * tag 'amd-pstate-v7.1-2026-05-14' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: cpufreq/amd-pstate: Drop Kconfig option for dynamic EPP cpufreq/amd-pstate-ut: Drop policy reference before driver switch cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp commit 22572dbcd3486e6c4dced877125bbf50e4e24edf Author: Cunlong Li Date: Wed May 20 11:30:54 2026 +0800 cgroup: rstat: relax NMI guard after switch to try_cmpxchg Commit 36df6e3dbd7e ("cgroup: make css_rstat_updated nmi safe") used this_cpu_cmpxchg() for the lockless insertion, and therefore required both ARCH_HAVE_NMI_SAFE_CMPXCHG and ARCH_HAS_NMI_SAFE_THIS_CPU_OPS in the NMI guard: on archs without the latter, this_cpu_cmpxchg() falls back to "local_irq_save() + plain cmpxchg", and local_irq_save() cannot mask NMIs. Commit 3309b63a2281 ("cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated") later replaced this_cpu_cmpxchg() with plain try_cmpxchg() to fix cross-CPU lockless-list corruption, but left the NMI guard untouched. After that switch, css_rstat_updated() no longer performs any this_cpu_*() RMW operations and only relies on the arch having NMI-safe cmpxchg, so ARCH_HAS_NMI_SAFE_THIS_CPU_OPS is no longer required in the guard. Relax the guard accordingly so that archs which have HAVE_NMI and ARCH_HAVE_NMI_SAFE_CMPXCHG but not ARCH_HAS_NMI_SAFE_THIS_CPU_OPS (e.g. sparc, powerpc on PPC64/BOOK3S) can benefit from the existing CONFIG_MEMCG_NMI_SAFETY_REQUIRES_ATOMIC path. Without this, the css is never queued in NMI on those archs, and the atomics staged by account_{slab,kmem}_nmi_safe() are not drained by flush_nmi_stats(). Fixes: 3309b63a2281 ("cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated") Signed-off-by: Cunlong Li Signed-off-by: Tejun Heo commit 8bc67e4db64aa72732c474b44ea8622062c903f0 Merge: df685633c3dbc6 79b09c54c6563d Author: Linus Torvalds Date: Wed May 20 13:19:58 2026 -0500 Merge tag 'erofs-for-7.1-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Fix a kernel crash related to unaligned zstd extents - Fix metabuf reference leak in shared xattr initialization * tag 'erofs-for-7.1-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix metabuf leak in inode xattr initialization erofs: fix managed cache race for unaligned extents commit 3d879647fb03dab6fe6e1dd9404a2dd324096218 Author: Jens Axboe Date: Wed May 20 10:02:58 2026 -0600 io_uring/timeout: splice timed out link in timeout handler A previous commit deferred this to the task_work part of it, so it could be protected by ->uring_lock. But that's actually not necessary here, and in fact the head clearing is not enough to make that safe. For those two reasons, just re-instate the local splicing. Fixes: 49ae66eb8c27 ("io_uring: defer linked-timeout chain splice out of hrtimer context") Signed-off-by: Jens Axboe commit df685633c3dbc67441cc86f1c3fee58de4652ba2 Merge: e312f536f64715 593889c4014260 Author: Linus Torvalds Date: Wed May 20 10:15:30 2026 -0500 Merge tag 'rcu-fixes.v7.1-20260519a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU fixes from Boqun Feng: "Fix a regression introduced by commit 61bbcfb50514 ("srcu: Push srcu_node allocation to GP when non-preemptible"). SRCU may queue works on CPUs that are "possible" but never have been online. In such a case, the work callbacks may not be executed until the corresponding CPU gets online, and as the callbacks accumulates, workqueue lockups will fire. Fix this by avoiding queuing works on CPUs that have never been online" * tag 'rcu-fixes.v7.1-20260519a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: srcu: Don't queue workqueue handlers to never-online CPUs commit 237557b8a81ab948e8332f7c0058e758f081c0a3 Author: Greg Kroah-Hartman Date: Wed May 20 15:05:04 2026 +0200 sysfs: don't remove existing directory on update failure When sysfs_update_group() is called for a named group and create_files() fails (e.g. -ENOMEM), internal_create_group() calls kernfs_remove(kn) on the group directory. In the update path, kn was obtained via kernfs_find_and_get() and refers to a directory that already existed before this call. Removing it silently destroys a sysfs group that the caller did not create. Only remove the directory if we created it ourselves. On update failure the directory remains as it is left empty by remove_files() inside create_files(), but can be repopulated by a retry. Cc: Rajat Jain Fixes: c855cf2759d2 ("sysfs: Fix internal_create_group() for named group updates") Cc: stable Assisted-by: gkh_clanker_t1000 Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/2026052003-uniquely-hastily-c093@gregkh Signed-off-by: Greg Kroah-Hartman commit 9af1b6e175c82daf4b423da339a722d8e67a735a Author: Deepanshu Kartikey Date: Tue May 19 13:52:47 2026 +0530 drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its return value. The function can fail with -EINTR from dma_resv_lock_interruptible() (signal during lock wait) or with -ENOMEM from dma_resv_reserve_fences() (fence slot allocation), leaving the resv lock not held. The queue path then walks the object array and calls dma_resv_add_fence(), which requires the lock held; with lockdep enabled this trips dma_resv_assert_held(): WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840 Call Trace: virtio_gpu_array_add_fence virtio_gpu_queue_ctrl_sgs virtio_gpu_queue_fenced_ctrl_buffer virtio_gpu_cursor_plane_update drm_atomic_helper_commit_planes drm_atomic_helper_commit_tail commit_tail drm_atomic_helper_commit drm_atomic_commit drm_atomic_helper_update_plane __setplane_atomic drm_mode_cursor_universal drm_mode_cursor_common drm_mode_cursor_ioctl drm_ioctl __x64_sys_ioctl Beyond the WARN, mutating the dma_resv fence list without the lock races with concurrent readers/writers and can corrupt the list. Both call sites run inside the .atomic_update plane callback, which DRM atomic helpers do not allow to fail (by the time it runs, the commit has been signed off to userspace and there is no clean rollback path). Moving the lock acquisition to .prepare_fb was rejected because the broader lock scope deadlocks against other BO locking paths in the same atomic commit. Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses dma_resv_lock() instead of dma_resv_lock_interruptible(). This eliminates the -EINTR failure mode -- the realistic syzbot trigger -- without extending the lock hold across the commit. The helper locks a single BO and rejects nents > 1 with -EINVAL; both fix sites lock exactly one BO. Use it from virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush(); check the return value to handle the remaining -ENOMEM case from dma_resv_reserve_fences() by freeing the objs and skipping the plane update for that frame. The framebuffer BOs touched here are not shared with other contexts and lock contention is expected to be brief, so the loss of signal-interruptibility is acceptable. Other callers of virtio_gpu_array_lock_resv() (the ioctl paths) continue to use the interruptible variant. The bug was reported by syzbot, triggered via fault injection (fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the -ENOMEM branch in dma_resv_reserve_fences(). Reported-by: syzbot+72bd3dd3a5d5f39a0271@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=72bd3dd3a5d5f39a0271 Fixes: 5cfd31c5b3a3 ("drm/virtio: fix virtio_gpu_cursor_plane_update().") Cc: stable@vger.kernel.org Signed-off-by: Deepanshu Kartikey Signed-off-by: Dmitry Osipenko Link: https://patch.msgid.link/20260519082247.34470-1-kartikey406@gmail.com commit 245aba83e3c288e176ed037a1f6b618b09e92ed8 Author: Johan Hovold Date: Wed May 20 16:27:10 2026 +0200 USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data (and leaking it to user space). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 915b36d701950503c4ea0f6e314b10868e59fce3 Author: Johan Hovold Date: Wed May 20 16:27:00 2026 +0200 USB: serial: mct_u232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increase the maximum transfer size to prevent slab corruption should a malicious device report a smaller endpoint max packet size than expected. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit ab8336a7e414f018430aa1af3a46944032f7ff96 Author: Johan Hovold Date: Wed May 20 16:26:48 2026 +0200 USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data. Fixes: 0ca1268e109a ("USB Serial Keyspan: add support for USA-49WG & USA-28XG") Cc: stable@vger.kernel.org # 2.6.23 Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit cb3560e8eab1dfa1cac1ed52631adf8ec6ff2cd5 Author: Johan Hovold Date: Wed May 20 16:26:22 2026 +0200 USB: serial: digi_acceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device report smaller buffers than expected. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65 Author: Zhang Cen Date: Tue May 19 19:11:50 2026 +0800 USB: serial: belkin_sa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from endpoint wMaxPacketSize, and short interrupt transfers may complete successfully with a smaller actual_length. Check the completed interrupt packet length before parsing status fields so short interrupt endpoints and short successful packets are ignored instead of causing out-of-bounds or stale status-byte reads. KASAN report as below: BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback() Read of size 1 Call trace: belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202) __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630) dummy_timer() (?:?) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: Codex:gpt-5.5 Signed-off-by: Zhang Cen Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 60a1969fae6209644698fca91c185d153674f631 Author: Zhang Cen Date: Wed May 20 18:32:49 2026 +0800 ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_ump_client_open() and seq_ump_client_close(). The last output unuse can therefore drop opened[STR_OUT] to zero and release the rawmidi file while an in-flight event_input callback is still inside snd_rawmidi_kernel_write(). That leaves the rawmidi substream runtime exposed to teardown before the write path has taken its own buffer reference. Add a per-client rwlock for the event_input-visible output file. Publish a newly opened output file under the write side, and hold the read side from the output lookup through snd_rawmidi_kernel_write(). The last output close copies and clears the visible output file under the write side, then drops the lock and releases the saved rawmidi file. Use IRQ-safe rwlock guards because event_input can also be reached from atomic sequencer delivery. The buggy scenario involves two paths, with each column showing the order within that path: path A label: event_input path path B label: last unuse path 1. seq_ump_process_event() reads 1. seq_ump_client_close() client->out_rfile.output. drops opened[STR_OUT] to zero. 2. snd_rawmidi_kernel_write1() 2. snd_rawmidi_kernel_release() has not yet pinned runtime. closes the output file. 3. The writer continues using 3. close_substream() frees the borrowed substream. substream->runtime. This keeps the output substream and runtime alive for the full event_input write while keeping rawmidi release outside the rwlock. KASAN reproduced this as a slab-use-after-free in snd_rawmidi_kernel_write1(), with allocation through seq_ump_use()/snd_seq_port_connect() and free through seq_ump_unuse()/snd_seq_port_disconnect(). Suggested-by: Takashi Iwai Validation reproduced this kernel report: KASAN slab-use-after-free in snd_rawmidi_kernel_write1+0x9d/0x400 RIP: 0033:0x7f5528af837f Read of size 8 Call trace: dump_stack_lvl+0x73/0xb0 (?:?) print_report+0xd1/0x650 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x1a7/0x340 (?:?) kasan_complete_mode_report_info+0x64/0x200 (?:?) kasan_report+0xf7/0x130 (?:?) snd_rawmidi_kernel_write1+0x9d/0x400 (?:?) __asan_load8+0x82/0xb0 (?:?) update_stack_state+0x1ef/0x2d0 (?:?) snd_rawmidi_kernel_write+0x1a/0x20 (?:?) seq_ump_process_event+0xd4/0x120 (sound/core/seq/seq_ump_client.c:82) __snd_seq_deliver_single_event+0x8a/0xe0 (?:?) snd_seq_deliver_from_ump+0x2b2/0xd60 (?:?) lock_acquire+0x14e/0x2e0 (?:?) find_held_lock+0x31/0x90 (?:?) snd_seq_port_use_ptr+0xa6/0xe0 (?:?) __kasan_check_write+0x18/0x20 (?:?) do_raw_read_unlock+0x32/0xa0 (?:?) _raw_read_unlock+0x26/0x50 (?:?) snd_seq_deliver_single_event+0x45c/0x4b0 (?:?) snd_seq_deliver_event+0x10d/0x1b0 (?:?) snd_seq_client_enqueue_event+0x192/0x240 (?:?) snd_seq_write+0x2cd/0x450 (?:?) apparmor_file_permission+0x20/0x30 (?:?) security_file_permission+0x51/0x60 (?:?) vfs_write+0x1ce/0x850 (?:?) __fget_files+0x12b/0x220 (?:?) lock_release+0xc8/0x2a0 (?:?) __rcu_read_unlock+0x74/0x2d0 (?:?) __fget_files+0x135/0x220 (?:?) ksys_write+0x15a/0x180 (?:?) rcu_is_watching+0x24/0x60 (?:?) __x64_sys_write+0x46/0x60 (?:?) x64_sys_call+0x7d/0x20d0 (?:?) do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?) Fixes: 81fd444aa371 ("ALSA: seq: Bind UMP device") Signed-off-by: Zhang Cen Link: https://patch.msgid.link/20260520103249.3048345-1-rollkingzzc@gmail.com Signed-off-by: Takashi Iwai commit 53a8f95cbb407608ef77a864ad4a59f25ddd906c Author: Rafael J. Wysocki Date: Tue May 12 16:17:44 2026 +0200 platform/x86: wireless-hotkey: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 wireless-hotkey driver. Fixes: 8507277ef132 ("platform/x86: wireless-hotkey: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/3899916.MHq7AAxBmi@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4840f8bb3e9aad183e707950f24f829fd220eb07 Author: Rafael J. Wysocki Date: Tue May 12 16:17:00 2026 +0200 platform/x86: toshiba_haps: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 toshiba_haps driver. Fixes: 3a96c7915d93 ("platform/x86: toshiba_haps: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/2285136.Mh6RI2rZIc@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 48b06fffb16901237dc0acbb0474a54b3cc5730f Author: Rafael J. Wysocki Date: Tue May 12 16:16:18 2026 +0200 platform/x86: toshiba_bluetooth: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 toshiba_bluetooth driver. Fixes: 553b2ac59fbb ("platform/x86: toshiba_bluetooth: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/2715450.Lt9SDvczpP@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0978824a64f160f1d2e8dc821a522ad91e7b4215 Author: Rafael J. Wysocki Date: Tue May 12 16:15:31 2026 +0200 platform/x86: toshiba_acpi: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 toshiba_acpi driver. Fixes: 246d6cefe525 ("platform/x86: toshiba_acpi: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/1973170.CQOukoFCf9@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 840bcd6bd5bcbc807b679e367ae7a148a1f07370 Author: Rafael J. Wysocki Date: Tue May 12 16:14:43 2026 +0200 platform/x86: system76: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 system76 driver. Fixes: 80b8f68b94ab ("platform/x86: system76: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/2072699.usQuhbGJ8B@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f2ec69363fb52fbb2010e5edbec2b8ca0951aadf Author: Rafael J. Wysocki Date: Tue May 12 16:13:59 2026 +0200 platform/x86: sony-laptop: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add requisite ACPI_COMPANION() checks against NULL to the platform/x86 sony-laptop driver. Fixes: 138db7ee58c0 ("platform/x86: sony-laptop: Convert PIC driver to a platform one") Fixes: 14004dd31caa ("platform/x86: sony-laptop: Convert NC driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/1871155.VLH7GnMWUR@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f15b0a3043f193677903be52d7dbef3d5c8df282 Author: Rafael J. Wysocki Date: Tue May 12 16:13:13 2026 +0200 platform/x86: panasonic-laptop: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 panasonic-laptop driver. Fixes: de6837243af0 ("platform/x86: panasonic-laptop: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/3353471.5fSG56mABF@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7e169326c2263ebc4878baae536c956fa3118eff Author: Rafael J. Wysocki Date: Tue May 12 16:12:27 2026 +0200 platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 lg-laptop driver. Fixes: 2d9cb20610f7 ("platform/x86: lg-laptop: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/3706551.iIbC2pHGDl@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 922952f2bbcfe21375973d0ea0e662a1a4837b10 Author: Rafael J. Wysocki Date: Tue May 12 16:11:43 2026 +0200 platform/x86: intel/smartconnect: Check ACPI_HANDLE() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_HANDLE() check against NULL to the platform/x86 intel/smartconnect driver. Fixes: 8a44bd3ffdb2 ("platform/x86: intel/smartconnect: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/7956676.EvYhyI6sBW@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 51e91ad0a0ccb0906306c653f9e8b97a180d8608 Author: Rafael J. Wysocki Date: Tue May 12 16:11:00 2026 +0200 platform/x86: intel/rst: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 intel/rst driver. Fixes: 163a68a31f74 ("platform/x86: intel/rst: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/2051525.PYKUYFuaPT@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ab743c6d7b118235f6d48a513a6560afbc5e615a Author: Rafael J. Wysocki Date: Tue May 12 16:09:58 2026 +0200 platform/x86: fujitsu-tablet: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add requisite ACPI_COMPANION() checks against NULL to the platform/x86 fujitsu-tablet driver. Fixes: bd13b265d386 ("platform/x86: fujitsu-tablet: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/10861611.nUPlyArG6x@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e99829a15989d58ffe1ee3e283e0a5eb8e41ee8b Author: Rafael J. Wysocki Date: Tue May 12 16:08:58 2026 +0200 platform/x86: fujitsu: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add requisite ACPI_COMPANION() checks against NULL to the platform/x86 fujitsu-laptop driver. Fixes: 6da22b031a3c ("platform/x86: fujitsu: Convert laptop driver to a platform one") Fixes: d5c9212ccfaa ("platform/x86: fujitsu: Convert backlight driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Acked-by: Jonathan Woithe Link: https://patch.msgid.link/3430329.44csPzL39Z@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 814830394764cef79c506629edd55f072e0207d1 Author: Rafael J. Wysocki Date: Tue May 12 16:05:47 2026 +0200 platform/x86: eeepc-laptop: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 eeepc-laptop driver. Fixes: 079b59fd2d79 ("platform/x86: eeepc-laptop: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/3056852.e9J7NaK4W3@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8a17c62b02fc4baa02300b57a2ad882c7a06a984 Author: Rafael J. Wysocki Date: Tue May 12 16:05:07 2026 +0200 platform/x86: dell/dell-rbtn: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 dell-rbtn driver. Fixes: 19ebacfb442b ("platform/x86: dell/dell-rbtn: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/2276487.irdbgypaU6@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 08f29dc34d1cf39696d04bc1ff31538dc2d74c72 Author: Rafael J. Wysocki Date: Tue May 12 16:04:23 2026 +0200 platform/x86: asus-laptop: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 asus-laptop driver. Fixes: ba19eb10170b ("platform/x86: asus-laptop: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/5083741.GXAFRqVoOG@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dc334b9bf9d28070f7a3e413fead759abdce19ba Author: Rafael J. Wysocki Date: Tue May 12 16:03:21 2026 +0200 platform/x86: acer-wireless: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 acer-wireless driver. Fixes: f7e648027d7e ("platform/x86: acer-wireless: Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/4746824.LvFx2qVVIh@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dc14686f27df6454b13b16ad1c9203ab3e9b0375 Author: Kartik Nair Date: Mon May 11 01:54:37 2026 +0530 wifi: cfg80211: wext: validate chandef in monitor mode cfg80211_wext_siwfreq() constructs a channel definition for monitor mode but passes it to cfg80211_set_monitor_channel() without first validating it with cfg80211_chandef_valid(). This causes a WARN_ON in cfg80211_chandef_dfs_required() when it receives an invalid chandef. Add the missing cfg80211_chandef_valid() check before calling cfg80211_set_monitor_channel() to return -EINVAL early on invalid channel definitions, consistent with how other callers handle this. Reported-by: syzbot+02a1a03b8622d3c7d1c9@syzkaller.appspotmail.com Signed-off-by: Kartik Nair Link: https://patch.msgid.link/20260510202437.7857-1-contact.kartikn@gmail.com [clarify subject] Signed-off-by: Johannes Berg commit 8499d0949d6a624b830d66d480f98badbf24dc26 Merge: 2248db6dc60108 60fb2cf51e77bb Author: Johannes Berg Date: Wed May 20 11:26:14 2026 +0200 Merge tag 'ath-current-20260519' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v7.1-rc5 ath10k: - avoid sending any commands to firmware when it is wedged ath11k: - fix WMI buffer leaks on error conditions - fix UAF in RX MSDU coalesce path - allow peer ID 0 on RX path (legal for mobile devices) - reinitialize shared SRNG pointers on restart ath12k: - fix 20 MHz-only parsing of EHT-MCS map ================== Signed-off-by: Johannes Berg commit 2248db6dc60108963b77c33e8b3d5cf19b0ed2e5 Merge: a6e6ccd5bd0715 734a4e051b9767 Author: Johannes Berg Date: Wed May 20 11:25:33 2026 +0200 Merge tag 'iwlwifi-fixes-2026-05-16' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== wifi: iwlwifi: fixes - 2026-05-16 Contains: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled wifi: iwlwifi: mld: stop TX during firmware restart wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o BSS vif wifi: iwlwifi: mvm: fix driver-set TX rates on old devices wifi: iwlwifi: mld: disconnect only after 6 beacons without Rx wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it wifi: iwlwifi: use correct function to read STEP_URM register ==================== Signed-off-by: Johannes Berg commit a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea Author: Michael Bommarito Date: Fri May 15 11:17:18 2026 -0400 wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout. The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element. The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state. Advance the cursor only when the current TID has a map present. Fixes: 8f500fbc6c65 ("wifi: mac80211: process and save negotiated TID to Link mapping request") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260515151719.1317659-2-michael.bommarito@gmail.com Signed-off-by: Johannes Berg commit dd7b6a8671939708cc4b7a46786d8c11297e8f69 Author: Shitalkumar Gandhi Date: Mon May 11 09:57:32 2026 +0530 wifi: wilc1000: fix dma_buffer leak on bus acquire failure wilc_wlan_firmware_download() allocates dma_buffer with kmalloc() at the top of the function and uses a 'fail:' label to free it via kfree(dma_buffer) on error. All later error paths correctly use 'goto fail' to route through this cleanup. However, the early failure path after the first acquire_bus() call uses a bare 'return ret;', which leaks dma_buffer whenever the bus acquire fails. Replace the early return with goto fail so the existing cleanup path runs. Found via a custom Coccinelle semantic patch hunting for kmalloc'd locals leaked on early-return error paths in driver firmware-download code. Fixes: 1241c5650ff7 ("wifi: wilc1000: Fill in missing error handling") Signed-off-by: Shitalkumar Gandhi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260511042732.998311-1-shitalkumar.gandhi@cambiumnetworks.com Signed-off-by: Johannes Berg commit d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349 Author: Zhao Li Date: Sat May 9 12:34:28 2026 +0800 wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the unicast forward path, mesh_data does: info = IEEE80211_SKB_CB(fwd_skb); memset(info, 0, sizeof(*info)); on the same skb the caller still names via rx->skb, then either queues the skb for TX (success) or kfree_skb()'s it (no-route) before returning RX_QUEUED. The caller's RX_QUEUED arm then calls sta_stats_encode_rate(status) on memory that is either zeroed (success path) or freed (no-route path). The latter is KASAN slab-use-after-free in ieee80211_prepare_and_rx_handle. Fix by encoding the rate from status before invoking ieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value captured while status was still backed by valid memory. Fixes: 3468e1e0c639 ("wifi: mac80211: add mesh fast-rx support") Cc: stable@vger.kernel.org Signed-off-by: Zhao Li Link: https://patch.msgid.link/20260509043427.60322-2-enderaoelyther@gmail.com Signed-off-by: Johannes Berg commit fe2d61a5d2849ee75dd4deeb2fe35f78d80721f8 Author: Johannes Berg Date: Fri May 8 09:10:32 2026 +0200 wifi: mac80211: fix multi-link element inheritance When parsing a beacon, mac80211 erroneously inherits any reconfiguration or EPCS multi-link elements from the outer elements into the multi-BSSID profile that's requested, if connected to a non-transmitted BSS, unless that profile has a non-inheritance element. This also happens if parsing a multi-BSSID profile that doesn't have a non-inheritance element. Fix this by having an empty non-inheritance element so cfg80211_is_element_inherited() is invoked in these cases and causes the parser to skip the elements that should never be inherited. Fixes: cf36cdef10e2 ("wifi: mac80211: Add support for parsing Reconfiguration Multi Link element") Fixes: 24711d60f849 ("wifi: mac80211: Support parsing EPCS ML element") Reviewed-by: Ilan Peer Reviewed-by: Benjamin Berg Link: https://patch.msgid.link/20260508091032.92184c0a3f08.I3c43b0b63d2cef8a4ddddaef1c2faaeb1de711ad@changeid Signed-off-by: Johannes Berg commit a74e893f30db64cdce0fc7a96d3baa417bcd55f5 Author: Johannes Berg Date: Fri May 8 09:10:31 2026 +0200 wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element (MLE) is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original elements. This is incorrect for two reasons: - if the original defragmentation was needed, it will not find the correct data - if the original frame is at a higher address, the parsing will potentially overrun the heap data (though given the layout of the buffers, only into the new defragmentation buffer, and then it has to stop and fail once that's filled with copied data. Fix it by tracking the container along with the pointer and in doing so also unify the two almost identical defragmentation routines. Fixes: 4d70e9c5488d ("wifi: mac80211: defragment reconfiguration MLE when parsing") Reviewed-by: Miriam Rachel Korenblit Reviewed-by: Ilan Peer Link: https://patch.msgid.link/20260508091031.8a6c34613178.I4de16ebbce2d27f2f8f98fc49949c7a376c2fe8d@changeid Signed-off-by: Johannes Berg commit e1e83feb8eae82cc9cc676db4c70f52fedc4735d Author: Emmanuel Grumbach Date: Wed May 13 17:06:27 2026 +0300 wifi: mac80211: don't override max_amsdu_subframes In client mode, the extended capabilities are handled by the kernel looking at the association frame. When the supplicant installs the keys it calls sta_apply_parameters and it doesn't include the extended capabilities since those can't change after association. As a result, we overrode the max_amsdu_subframes that we set after association. Check that the ext_capa coming from the user space is valid before looking at it. If the ext_capa is NULL, it really means that the extended capabilities are not changed (as opposed to cleared). The default value for max_amsdu_subframes is 0, which means there is no limit. This value is valid and in case the association response frame does not have extended capabilities, this is the value we should use. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221079 Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260513170623.828dbb58c782.Ifd2bfc190c26140e919127adb02ffddd7b551499@changeid Signed-off-by: Johannes Berg commit f718506edd2d9c6a308ded9d13c632bf7b7d5a2c Author: Alexandru Hossu Date: Fri May 15 12:29:08 2026 +0200 wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15. sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14), making index 15 out-of-bounds. A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response action frame with a PER_STA_PROFILE subelement where link_id = 15. The unsolicited-notification path (dialog_token = 0) is reachable any time EPCS is already enabled, without any prior client request. sdata->link[15] reads into the first word of sdata->activate_links_work (a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD), so the NULL check on the result does not catch the invalid access. The garbage pointer is then passed to ieee80211_sta_wmm_params(), which dereferences link->sdata and crashes the kernel. The same class of bug was fixed for ieee80211_ml_reconfiguration() by commit 162d331d833d ("wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration"). Fixes: de86c5f60839 ("wifi: mac80211: Add support for EPCS configuration") Signed-off-by: Alexandru Hossu Link: https://patch.msgid.link/20260515102908.1653088-1-hossu.alexandru@gmail.com Signed-off-by: Johannes Berg commit 540f4a4f6ef806a28e794001bb4beac4840a6090 Author: Alexandra Winter Date: Wed Apr 22 16:17:16 2026 +0200 s390/topology: Use zero-based numbering for containing entities Start the numbering scheme for higher-level topology structures (like socket, book, drawer) at zero, matching the convention for other hardware identifiers like e.g. CPU numbers. Hardware documentation, the Hardware Management Console and other tools like zmemtopo also use zero-based numbering for these containing entities. Aligning the numbering in sysfs, procfs, and tools like lscpu improves user experience by making it easier to correlate topology information across different interfaces. If available, Linux on s390 derives this physical topology information from the stsi function code 15 store_topology instruction, which is defined to start at 1 for the lowest numbered container id. Subtract one, so drawer_id, book_id and socket_id in cpu_topology[] start with 0 for the lowest numbered entity; and /proc/cpuinfo and tools like 'lscpu -ye' display the expected values. Display only, no functional change intended. Example: In a partition with 3 cores in a system with 8 cores per socket; 2 sockets per book; 4 books per dawer; and 4 drawers: Before this fix: $ lscpu -ye CPU NODE DRAWER BOOK SOCKET CORE L1d:L1i:L2 ONLINE CONFIGURED POLARIZATION ADDRESS 0 0 2 4 1 0 0:0:0 yes yes vert-high 0 1 0 2 4 1 0 1:1:1 yes yes vert-high 1 2 0 2 4 1 1 2:2:2 yes yes vert-medium 2 3 0 2 4 1 1 3:3:3 yes yes vert-medium 3 4 0 2 4 2 3 4:4:4 yes yes vert-low 4 5 0 2 4 2 3 5:5:5 yes yes vert-low 5 After this fix: $ lscpu -ye CPU NODE DRAWER BOOK SOCKET CORE L1d:L1i:L2 ONLINE CONFIGURED POLARIZATION ADDRESS 0 0 1 3 0 0 0:0:0 yes yes vert-high 0 1 0 1 3 0 0 1:1:1 yes yes vert-high 1 2 0 1 3 0 1 2:2:2 yes yes vert-medium 2 3 0 1 3 0 1 3:3:3 yes yes vert-medium 3 4 0 1 3 1 3 4:4:4 yes yes vert-low 4 5 0 1 3 1 3 5:5:5 yes yes vert-low 5 For KVM guests, qemu emulates the stsi FC15 store_topology instruction. This emulation currently erroneously starts id numbering at 0. A qemu fix is proposed that makes this emulation compliant to the stsi architecture. In case a guest with this patch is running on a qemu without the other fix, it can happen that ids of 255 are displayed erroneously. z/VM currently does not provide or emulate physical topology information to its guests. So this patch does not change anything for z/VM guests. Fixes: 10d385895055 ("[S390] topology: expose core identifier") Signed-off-by: Alexandra Winter Acked-by: Heiko Carstens Acked-by: Christian Borntraeger Acked-by: Hendrik Brueckner Signed-off-by: Alexander Gordeev commit 471c18323dfdfe7844e193b896a9267ae23a1026 Author: Robertus Diawan Chris Date: Tue May 19 09:05:28 2026 +0700 tee: qcomtee: add missing va_end in early return qcomtee_object_user_init() qcomtee_object_user_init() is a variadic function and when the function return because there's no dispatch callback in QCOMTEE_OBJECT_TYPE_CB case, there's no va_end to cleanup "ap" object initialized by va_start and that can cause undefined behavior. So make sure to use va_end before returning the error code when there's no dispatch callback. This is reported by Coverity Scan as "Missing varargs init or cleanup". Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver") Signed-off-by: Robertus Diawan Chris Reviewed-by: Amirreza Zarrabi Signed-off-by: Jens Wiklander commit 1702da76e017ae0fbe1a92b07bc332972c293e89 Author: Vincent Donnefort Date: Thu May 14 17:26:24 2026 +0100 KVM: arm64: Fix nVHE/pKVM hyp tracing error on invalid desc pKVM must validate the host-provided tracing buffer descriptor. However, if an error is found, the hypervisor would just return 0 to the host. Fix the return value on validation failure. While at it, rename the function to hyp_trace_desc_is_valid() and skip validation for the nVHE mode as we trust host-provided data in that case. Signed-off-by: Vincent Donnefort Fixes: 680a04c333fa ("KVM: arm64: Add tracing capability for the nVHE/pKVM hyp") Link: https://lore.kernel.org/r/20260514162624.3477857-1-vdonnefort@google.com Signed-off-by: Marc Zyngier commit f19c354dbd457759dfcf1195ab4bdba2bb568323 Author: Michael Bommarito Date: Tue May 19 09:50:42 2026 -0400 KVM: arm64: vgic: Free private_irqs when init fails after allocation Companion to commit 250f25367b58 ("KVM: arm64: Tear down vGIC on failed vCPU creation"), which added the missing kvm_vgic_vcpu_destroy() call to the kvm_share_hyp() failure path in kvm_arch_vcpu_create(). The kvm_vgic_vcpu_init() failure path immediately above it has the same shape and still needs the same cleanup. Call kvm_vgic_vcpu_destroy() when kvm_vgic_vcpu_init() fails so private IRQs allocated before a redistributor iodev registration failure are released before the failed vCPU is freed. Fixes: 03b3d00a70b5 ("KVM: arm64: vgic: Allocate private interrupts on demand") Cc: stable@vger.kernel.org Cc: Will Deacon Reviewed-by: Yuan Yao Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Link: https://lore.kernel.org/r/20260519135042.2219239-1-michael.bommarito@gmail.com Signed-off-by: Marc Zyngier commit 9ce754ed8e7ab4e3999767ce1505f85c449ccb07 Author: Michael Bommarito Date: Tue May 19 09:25:19 2026 -0400 KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits. Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range. Fixes: 57a9a117154c ("KVM: arm64: vgic-its: Device table save/restore") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Link: https://lore.kernel.org/r/20260519132519.2142458-1-michael.bommarito@gmail.com Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit 79b09c54c6563df9846ca3094bcfd72082c3e1d7 Author: Jia Zhu Date: Wed May 20 12:46:07 2026 +0800 erofs: fix metabuf leak in inode xattr initialization commit bb88e8da0025 ("erofs: use meta buffers for xattr operations") converted xattr operations to use on-stack erofs_buf instances. erofs_init_inode_xattrs() uses such a metabuf while reading the inline xattr header and shared xattr id array. Some error paths after erofs_read_metabuf() leave through out_unlock without dropping the metabuf, so the folio reference can leak. Consolidate the cleanup at out_unlock. erofs_put_metabuf() is a no-op if no folio has been acquired, and this keeps all paths after taking EROFS_I_BL_XATTR_BIT covered by a single cleanup site. Fixes: bb88e8da0025 ("erofs: use meta buffers for xattr operations") Signed-off-by: Jia Zhu Reviewed-by: Gao Xiang Fixes: bb88e8da0025 ("erofs: use meta buffers for xattr operations") Signed-off-by: Gao Xiang commit 649932fc3815eda2f24eb4de4b3a5e94886ee0b9 Author: Gao Xiang Date: Tue Apr 28 12:34:31 2026 +0800 erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: [Thread 1] [Thread 2] (z_erofs_fill_bio_vec) ... filemap_add_folio (1) (z_erofs_bind_cache) .. .. folio_attach_private (2) filemap_add_folio (3) again Since (1) is executed but (2) hasn't been executed yet, it's possible that another thread finds the same managed folio in z_erofs_bind_cache() for a different pcluster and calls filemap_add_folio() again since folio->private is still Z_EROFS_PREALLOCATED_FOLIO. Fix this by explicitly clearing folio->private before making the folio visible in the managed cache so that another pcluster can simply wait on the locked managed folio as what we did for other shared cases [1]. This only impacts unaligned data compression (`-E48bit` with zstd, for example). [1] Commit 9e2f9d34dd12 ("erofs: handle overlapped pclusters out of crafted images properly") was originally introduced to handle crafted overlapped extents, but it addresses unaligned extents as well. Fixes: 7361d1e3763b ("erofs: support unaligned encoded data") Reported-by: Arseniy Krasnov Closes: https://lore.kernel.org/r/4a2f3801-fac1-42fe-ae75-da315822e088@salutedevices.com Tested-by: Arseniy Krasnov Signed-off-by: Gao Xiang commit 6fa9b543f6b4ed15ff72af266b29f316643de289 Author: Qihang Date: Thu May 7 23:39:17 2026 +0800 tee: fix params_from_user() error path in tee_ioctl_supp_recv params_from_user() may acquire tee_shm references for MEMREF parameters before failing after partially processing the supplied parameter array. In tee_ioctl_supp_recv(), those references are currently not released on that error path. Fix this by freeing MEMREF references before returning when params_from_user() fails. Keep the final cleanup path in tee_ioctl_supp_recv() unchanged since supp_recv() may consume and replace the supplied parameters, unlike the other TEE ioctl callback paths. Signed-off-by: Qihang Signed-off-by: Jens Wiklander commit 26682f5efc276e3ad96d102019472bfbf03833b2 Author: Georgiy Osokin Date: Wed Apr 8 18:52:03 2026 +0300 tee: shm: fix shm leak in register_shm_helper() register_shm_helper() allocates shm before calling iov_iter_npages(). If iov_iter_npages() returns 0, the function jumps to err_ctx_put and leaks shm. This can be triggered by TEE_IOC_SHM_REGISTER with struct tee_ioctl_shm_register_data where length is 0. Jump to err_free_shm instead. Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration") Cc: stable@vger.kernel.org Cc: lvc-project@linuxtesting.org Signed-off-by: Georgiy Osokin Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit c15d7a2a11ea055bcecc0b538ae8ba79475637f9 Author: Arnd Bergmann Date: Thu Dec 4 11:17:23 2025 +0100 tee: fix tee_ioctl_object_invoke_arg padding The tee_ioctl_object_invoke_arg structure has padding on some architectures but not on x86-32 and a few others: include/linux/tee.h:474:32: error: padding struct to align 'params' [-Werror=padded] I expect that all current users of this are on architectures that do have implicit padding here (arm64, arm, x86, riscv), so make the padding explicit in order to avoid surprises if this later gets used elsewhere. Fixes: d5b8b0fa1775 ("tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF") Signed-off-by: Arnd Bergmann Reviewed-by: Jens Wiklander Tested-by: Harshal Dev Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit a69b677e47a80319ce148d61cc29a2b57006e78d Author: Cássio Gabriel Date: Tue May 19 11:46:19 2026 -0300 ALSA: scarlett2: Allow flash writes ending at segment boundary scarlett2_hwdep_write() rejects writes when offset + count is greater than or equal to the selected flash segment size. That incorrectly treats a write ending exactly at the end of the segment as out of space, although the last byte written is still within the segment. Split invalid argument checks from the segment-space check, keep zero-length writes as no-ops, and compare count against the remaining segment size. This permits exact-end writes and avoids relying on offset + count before deciding whether the request is in bounds. Fixes: 1abfbd3c9527 ("ALSA: scarlett2: Add support for uploading new firmware") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260519-alsa-scarlett2-flash-write-boundary-v1-1-b550480e92da@gmail.com Signed-off-by: Takashi Iwai commit 12b1b4f5653d9a14980c0d881f4ac1af2e1d6b05 Author: Marius Hoch Date: Tue May 19 16:01:29 2026 +0200 ALSA: hda/realtek: Add LED quirk for HP ProBook 430 G6 Like the HP ProBook 440 G6, the HP ProBook 430 G6 needs the ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk for its mute and microphone mute LEDs. Tested on a HP ProBook 430 G6. Signed-off-by: Marius Hoch Link: https://patch.msgid.link/20260519140248.4211-2-mail@mariushoch.de Signed-off-by: Takashi Iwai commit 33d3b6f0d86b539680bbda3300b2581cd62a3f18 Author: Takashi Iwai Date: Tue May 19 14:11:53 2026 +0200 ALSA: hda/intel: Make sure to cancel irq-pending work at closing PCM stream The pending irq work might be still floating while the assigned stream has been already closed, which may lead to UAF, especially when another async work for fasync is involved. For addressing this, extend the hda_controller_ops for allowing the extra cleanup procedure that is specific to the controller driver, and make sure to cancel and sync the pending irq work at each PCM close before releasing the resources. Reported-by: Jake Lamberson Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260519121157.28477-2-tiwai@suse.de commit e36a88b33cbe3dcbb90ac2245ba6149dd5793370 Author: Takashi Iwai Date: Tue May 19 14:11:52 2026 +0200 ALSA: hda: Move irq pending work into hda-intel stream Currently, the delayed IRQ handling for PCM streams is managed in a single work embedded in hda_intel, but this is basically a per-stream thing. Due to the single work, we can't cancel the work properly at closing each stream, for example. For making the IRQ pending work to be stream-based, this patch changes the following: - An extended version of azx_dev (i.e. the hd-audio stream object) is defined for snd-hda-intel - The irq_pending flag and irq_pending_work are moved to hda_intel_stream, so that they can be hda-intel stream specific - The stream creation and assignment are refactored so that snd-hda-intel can handle individually; the snd-hda-intel specific workaround for stream tags is also moved to snd-hda-intel itself instead of the common code - The irq pending work is canceled properly at free / shutdown While we're at it, changed the bit field flag to bool, as the bit field doesn't help much in our case. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260519121157.28477-1-tiwai@suse.de commit 49b18315be4eecfc36b75f4aecb4d40a87d68a20 Author: KP Singh Date: Wed May 20 04:40:59 2026 +0200 bpf: Reject NULL data/sig in bpf_verify_pkcs7_signature __bpf_dynptr_data() can return NULL (FILE dynptrs, any non-contiguous backing). bpf_verify_pkcs7_signature() forwards the pointer to verify_pkcs7_signature() unchecked, causing a NULL deref in asn1_ber_decoder() reachable from a sleepable BPF LSM at lsm.s/bpf. NULL-check both pointers and reject with -EINVAL. Mirrors the guards already in kernel/bpf/crypto.c. Fixes: 865b0566d8f1 ("bpf: Add bpf_verify_pkcs7_signature() kfunc") Reported-by: Xianrui Dong Signed-off-by: KP Singh Reviewed-by: Amery Hung Acked-by: Song Liu Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20260520024059.313468-1-kpsingh@kernel.org Signed-off-by: Kumar Kartikeya Dwivedi commit dc416e32baaeb620b9809e9e25fc7b30889686e9 Author: Nikhil P. Rao Date: Fri May 15 21:29:07 2026 +0000 pds_core: fix debugfs_lookup dentry leak and error handling debugfs_lookup() returns a dentry with an elevated reference count that must be released with dput(). The current code discards the returned dentry without calling dput(), causing a reference leak on every firmware reset recovery. Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV), not NULL. The current check passes for error pointers and would call dput() on an invalid pointer, causing a crash. Fixes: bc90fbe0c318 ("pds_core: Rework teardown/setup flow to be more common") Signed-off-by: Nikhil P. Rao Link: https://patch.msgid.link/20260515212907.998028-3-nikhil.rao@amd.com Signed-off-by: Jakub Kicinski commit 0e46b6635b03d29807f810c3b415c4755a3f958d Author: Nikhil P. Rao Date: Fri May 15 21:29:05 2026 +0000 pds_core: fix error handling in pdsc_devcmd_wait Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO. 2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up. Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery. Fixes: 45d76f492938 ("pds_core: set up device and adminq") Signed-off-by: Nikhil P. Rao Link: https://patch.msgid.link/20260515212907.998028-1-nikhil.rao@amd.com Signed-off-by: Jakub Kicinski commit 0cb5a74faa3bdcfa3b18735d554e12c0f615e35d Author: Christian Marangi Date: Mon May 18 15:44:57 2026 +0200 net: airoha: Fix NPU RX DMA descriptor bits In an internal review from Airoha, it was notice that the RX DMA descriptor bits and mask are wrong. These values probably refer to an old NPU firmware never published. The previous value works correctly but it was reported that in some specific condition in mixed scenario with both Ethernet and WiFi offload it's possible that RX DMA descriptor signal wrong value with the problem to the RX ring or packets getting dropped. To handle these specific scenario, apply the new suggested bits mask from Airoha. Correct functionality of both AN7581 NPU and MT7996 variant were verified and confirmed working. Fixes: a7fc8c641cab ("net: airoha: Fix npu rx DMA definitions") Signed-off-by: Christian Marangi Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260518134530.3683-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit be309f8eae8b474a4a617eaae01324da996fc719 Author: Jann Horn Date: Mon May 18 18:51:30 2026 +0200 af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since commit 79f632c71bea ("unix/stream: fix peeking with an offset larger than data in queue"). The first consequence of this is that the pointer comparison `tail != last` can be false even if `last` semantically refers to an already-freed SKB while `tail` is a new SKB allocated at the same address; which can cause unix_stream_data_wait() to wrongly keep blocking after new data has arrived, but only in a weird scenario where a peeking recv() and a normal recv() on the same socket are racing, which is probably not a real problem. But since commit 2b514574f7e8 ("net: af_unix: implement splice for stream af_unix sockets"), `tail` is actually dereferenced, which can cause UAF in the following race scenario (where test_setup() runs single-threaded, and afterwards, test_thread1() and test_thread2() run concurrently in two threads: ``` static int socks[2]; void test_setup(void) { socketpair(AF_UNIX, SOCK_STREAM, 0, socks); send(socks[1], "A", 1, 0); int peekoff = 1; setsockopt(socks[0], SOL_SOCKET, SO_PEEK_OFF, &peekoff, sizeof(peekoff)); } void test_thread1(void) { char dummy; recv(socks[0], &dummy, 1, MSG_PEEK); } void test_thread2(void) { char dummy; recv(socks[0], &dummy, 1, 0); shutdown(socks[1], SHUT_WR); } ``` when racing like this: ``` thread1 thread2 unix_stream_read_generic mutex_lock(&u->iolock) skb_peek(&sk->sk_receive_queue) skb_peek_next(skb, &sk->sk_receive_queue) mutex_unlock(&u->iolock) unix_stream_read_generic unix_state_lock(sk) skb_peek(&sk->sk_receive_queue) unix_state_unlock(sk) unix_stream_data_wait unix_state_lock(sk) tail = skb_peek_tail(&sk->sk_receive_queue) spin_lock(&sk->sk_receive_queue.lock) __skb_unlink(skb, &sk->sk_receive_queue) spin_unlock(&sk->sk_receive_queue.lock) consume_skb(skb) [frees the SKB] `tail != last`: false `tail`: true `tail->len != last_len` ***UAF*** ``` Fix the UAF by removing the read of tail->len; checking tail->len would only make sense if SKBs in the receive queue of a UNIX socket could grow, which can no longer happen. Kuniyuki explained: > When commit 869e7c62486e ("net: af_unix: implement stream sendpage > support") added sendpage() support, data could be appended to the last > skb in the receiver's queue. > > That's why we needed to check if the length of the last skb was changed > while waiting for new data in unix_stream_data_wait(). > > However, commit a0dbf5f818f9 ("af_unix: Support MSG_SPLICE_PAGES") and > commit 57d44a354a43 ("unix: Convert unix_stream_sendpage() to use > MSG_SPLICE_PAGES") refactored sendmsg(), and now data is always added > to a new skb. That means this fix is not suitable for kernels before 6.5. Fixes: 2b514574f7e8 ("net: af_unix: implement splice for stream af_unix sockets") Cc: stable@vger.kernel.org # 6.5.x Signed-off-by: Jann Horn Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260518-b4-unix-recv-wait-hotfix-v2-1-83e29ce8ad31@google.com Signed-off-by: Jakub Kicinski commit d4ea0dfd75011b78cebf3808f98ac4c4f51a6fb9 Author: Justin Iurman Date: Sun May 17 20:30:59 2026 +0200 ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Reported by Sashiko: The function ipv6_hop_ioam() accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via RCU, __in6_dev_get() can return NULL during interface teardown, which could cause a NULL pointer dereference when processing an IOAM Hop-by-Hop option. Let's add a check and use SKB_DROP_REASON_IPV6DISABLED accordingly. Fixes: 9ee11f0fff20 ("ipv6: ioam: Data plane support for Pre-allocated Trace") Cc: stable@vger.kernel.org Signed-off-by: Justin Iurman Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260517183059.29140-1-justin.iurman@gmail.com Signed-off-by: Jakub Kicinski commit d03e6124c724e6a380b4bef22e5a1cbc5ddf4cea Merge: 960e77ce14a83e 8baa7506d793f0 Author: Jakub Kicinski Date: Tue May 19 18:45:27 2026 -0700 Merge branch 'net-phy-honor-eee_disabled_modes-when-advertising-eee' Nicolai Buchwitz says: ==================== net: phy: honor eee_disabled_modes when advertising EEE While debugging why ethtool --show-eee reports "not supported" on a Raspberry Pi CM4 with eee-broken-1000t / eee-broken-100tx set on the PHY node, I noticed two phylib helpers copy phydev->supported_eee into phydev->advertising_eee without applying phydev->eee_disabled_modes: phy_support_eee() and phy_advertise_eee_all(). That undoes the filtering phy_probe() set up after of_set_phy_eee_broken(), so the PHY ends up advertising EEE for modes that were marked broken in DT (or by the driver via eee_disabled_modes). The visible effect on MAC drivers that call phy_support_eee() after probe (bcmgenet, fec, lan743x, lan78xx, r8169) is that ethtool on the local interface reports "not supported" (because supported is masked by eee_disabled_modes and ends up empty), while the link partner happily sees EEE negotiated and active. Patch 1 fixes phy_support_eee(). Patch 2 fixes phy_advertise_eee_all(), which is also reached from genphy_c45_ethtool_set_eee() when user space passes an empty advertisement. I went through the other users of supported_eee as suggested by Andrew and they look fine: - phy_probe() already masks via eee_disabled_modes after of_set_phy_eee_broken(). - genphy_c45_ethtool_get_eee() masks supported_eee with eee_disabled_modes when reporting to user space. - genphy_c45_ethtool_set_eee() masks user-supplied adv against eee_disabled_modes, and the empty-adv path is now covered by patch 2. - genphy_c45_read_eee_abilities(), read_eee_cap1/cap2 populate supported_eee from PHY registers (source of truth). - genphy_c45_read_eee_adv(), read_eee_lpa() and write_eee_adv() use supported_eee only to gate which MMD registers to access, not to construct an advertisement. ==================== Link: https://patch.msgid.link/20260518-devel-phy-support-eee-fix-v2-0-05b52626fa68@tipi-net.de Signed-off-by: Jakub Kicinski commit 8baa7506d793f0636e3f6f01b01ef7be19674d06 Author: Nicolai Buchwitz Date: Mon May 18 10:23:10 2026 +0200 net: phy: honor eee_disabled_modes in phy_advertise_eee_all() phy_advertise_eee_all() copies supported_eee into advertising_eee unconditionally, overwriting any filtering applied during phy_probe() based on DT eee-broken-* properties or driver-populated eee_disabled_modes. genphy_c45_ethtool_set_eee() calls this helper when user space passes an empty advertisement, undoing the filtering. Apply the same eee_disabled_modes mask in phy_advertise_eee_all() so the filtering survives the copy, matching the pattern in phy_probe() and phy_support_eee(). Fixes: b64691274f5d ("net: phy: add helper phy_advertise_eee_all") Signed-off-by: Nicolai Buchwitz Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260518-devel-phy-support-eee-fix-v2-2-05b52626fa68@tipi-net.de Signed-off-by: Jakub Kicinski commit 3655063e083889ed4b79b7dda9cec65478dce09a Author: Nicolai Buchwitz Date: Mon May 18 10:23:09 2026 +0200 net: phy: honor eee_disabled_modes in phy_support_eee() phy_support_eee() copies supported_eee into advertising_eee unconditionally, overwriting any filtering applied during phy_probe() based on DT eee-broken-* properties or driver-populated eee_disabled_modes. MAC drivers that call phy_support_eee() after probe (e.g. bcmgenet, fec, lan743x, lan78xx, r8169) then cause the PHY to advertise EEE for modes the user marked as broken. The symptom is that ethtool --show-eee on the local interface reports "not supported" (supported & ~eee_disabled_modes is empty) while the link partner sees EEE negotiated and active. phy_probe() already filters advertising_eee via eee_disabled_modes after calling of_set_phy_eee_broken(). Apply the same mask in phy_support_eee() so the filtering survives the copy. Fixes: 49168d1980e2 ("net: phy: Add phy_support_eee() indicating MAC support EEE") Signed-off-by: Nicolai Buchwitz Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260518-devel-phy-support-eee-fix-v2-1-05b52626fa68@tipi-net.de Signed-off-by: Jakub Kicinski commit 960e77ce14a83ef7f226e8e4b4d75765633ba48b Author: Nerijus Bendžiūnas Date: Sat May 16 18:02:51 2026 +0300 net: phy: skip EEE advertisement write when autoneg is disabled genphy_c45_an_config_eee_aneg() writes the EEE advertisement to the auto-negotiation device's MMD register space (MDIO_MMD_AN, register MDIO_AN_EEE_ADV). These registers are read by the link partner only during auto-negotiation, so writing them while autoneg is disabled cannot influence the link. On some PHYs (e.g. Broadcom BCM54213PE) the write nevertheless reaches the chip and disturbs the receive datapath. Concretely, running ethtool -s eth0 speed 100 duplex full autoneg off ethtool --set-eee eth0 eee off leaves eth0 with TX working and RX completely silent on a Raspberry Pi 4 / CM4 board (bcmgenet + BCM54213PE in rgmii-rxid). Switching back to autoneg recovers the link. Prior to commit f26a29a038ee ("net: phy: ensure that genphy_c45_an_config_eee_aneg() sees new value of phydev->eee_cfg.eee_enabled"), the disable path was effectively a no-op because the helper read the stale eee_cfg.eee_enabled, so the underlying PHY behavior never surfaced. Bisected on rpi-6.12.y between commits 83943264 (good) and effcbc88 (bad) to f26a29a038ee. Fixes: f26a29a038ee ("net: phy: ensure that genphy_c45_an_config_eee_aneg() sees new value of phydev->eee_cfg.eee_enabled") Cc: stable@vger.kernel.org Signed-off-by: Nerijus Bendžiūnas Reviewed-by: Nicolai Buchwitz Tested-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260516150251.879680-1-nerijus.bendziunas@gmail.com Signed-off-by: Jakub Kicinski commit 90fc1a393736063b2b4077115e215a2e2eebb797 Merge: 9b244c242bec48 ae743a8ca8dbd6 Author: Jakub Kicinski Date: Tue May 19 18:15:23 2026 -0700 Merge branch 'bridge-mcast-fix-a-possible-use-after-free-when-removing-a-bridge-port' Ido Schimmel says: ==================== bridge: mcast: Fix a possible use-after-free when removing a bridge port Patch #1 fixes a possible use-after-free when removing a bridge port. Patch #2 adds a test case that triggers the problem. In net-next we can: 1. Add DEBUG_NET_WARN_ON_ONCE() when a port multicast context is de-initialized while enabled. 2. When de-initializing a port multicast context, synchronously shutdown all the timers that were initialized when the context was initialized. ==================== Link: https://patch.msgid.link/20260517121122.188333-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit ae743a8ca8dbd66fb67c461a27460b2b21c376ab Author: Ido Schimmel Date: Sun May 17 15:11:22 2026 +0300 selftests: bridge_vlan_mcast: Test toggling of multicast snooping Test toggling of multicast snooping when per-VLAN multicast snooping is enabled. The test always passes, but without "bridge: mcast: Fix possible use-after-free when removing a bridge port" it results in a splat. Acked-by: Nikolay Aleksandrov Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20260517121122.188333-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 4df78ff02629c7729168f0696a7a2123c389818d Author: Ido Schimmel Date: Sun May 17 15:11:21 2026 +0300 bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables the per-{port, VLAN} multicast contexts instead. The reverse happens when per-VLAN multicast snooping is disabled. When global multicast snooping is enabled, the bridge iterates over all the bridge ports and enables the per-port multicast context on each port. The reverse happens when multicast snooping is disabled. The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port: # ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1 # ip link add name dummy1 up master br1 type dummy # ip link set dev br1 type bridge mcast_vlan_snooping 1 # ip link set dev br1 type bridge mcast_snooping 0 # ip link set dev br1 type bridge mcast_snooping 1 This is not intended and it is a problem since the commit cited below. Prior to this commit, when removing a bridge port, br_multicast_disable_port() would disable the per-port multicast context and the per-{port, VLAN} multicast contexts would get disabled when flushing VLANs. After this commit, br_multicast_disable_port() only disables the per-port multicast context if per-VLAN multicast snooping is disabled. If both types of contexts were enabled on the port when it was removed, the per-port multicast context would remain enabled when freeing the bridge port, leading to a use-after-free [1]. Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled. [1] ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927) WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0 [...] Call Trace: __debug_check_no_obj_freed (lib/debugobjects.c:1116) kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565) kobject_cleanup (lib/kobject.c:689) rcu_do_batch (kernel/rcu/tree.c:2617) rcu_core (kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) __irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735) irq_exit_rcu (kernel/softirq.c:752) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47)) Fixes: 4b30ae9adb04 ("net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions") Reported-by: syzbot+ae231e0552fa77b26ea1@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/87qznowlfs.ffs@tglx/ Reported-by: Thomas Gleixner Acked-by: Nikolay Aleksandrov Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20260517121122.188333-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 9b244c242bec48b37e82b89787afd6a4c43457e1 Author: Dawei Feng Date: Fri May 15 23:18:26 2026 +0800 octeontx2-pf: avoid double free of pool->stack on AQ init failure otx2_pool_aq_init() frees pool->stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2_sq_aura_pool_init() unwinds the partial setup through otx2_aura_pool_free(), which frees pool->stack again. The CN20K-specific cn20k_pool_aq_init() implementation has the same bug in its corresponding error path. Set pool->stack to NULL immediately after the local free so the shared cleanup path does not free the same stack again while cleaning up partially initialized pool state. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3. Runtime validation was not performed because reproducing this path requires OcteonTX2/CN20K hardware. Fixes: caa2da34fd25 ("octeontx2-pf: Initialize and config queues") Fixes: d322fbd17203 ("octeontx2-pf: Initialize cn20k specific aura and pool contexts") Cc: stable@vger.kernel.org Signed-off-by: Zilin Guan Signed-off-by: Dawei Feng Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260515151826.1005397-1-dawei.feng@seu.edu.cn Signed-off-by: Jakub Kicinski commit 33d35975cbead3fa6b738ee57e5e45e14fbe0886 Author: Jonas Jelonek Date: Fri May 15 14:31:03 2026 +0000 net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis() of_count_phandle_with_args() returns the count on success and a negative errno on failure, including -ENOENT when the "pairsets" property is absent. The existing comparison in of_load_pse_pis() checks against ENOENT (positive 2) instead of -ENOENT, so the branch is taken for any error return: legitimate DTs that omit "pairsets" trigger a spurious "wrong number of pairsets" error and probe fails with -EINVAL. Compare against -ENOENT so a missing "pairsets" property is correctly treated as "this PI has no pairsets, continue". Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs") Cc: stable@vger.kernel.org Signed-off-by: Jonas Jelonek Acked-by: Oleksij Rempel Link: https://patch.msgid.link/20260515143103.1721888-1-jelonek.jonas@gmail.com Signed-off-by: Jakub Kicinski commit 5b74373390113fba798a76b483837029ab010fef Author: Guangshuo Li Date: Thu May 14 19:38:34 2026 +0800 RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path). kobject_put() may drop the last reference to srv_path->kobj and invoke the release callback, rtrs_srv_release(), which frees srv_path. The following call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then dereferences srv_path internally to access srv_path->srv, resulting in a use-after-free. This failure path is reached before rtrs_srv_create_path_files() returns success, so the successful-path lifetime handling is not involved. Fix this by destroying the sysfs root folders before calling kobject_put(&srv_path->kobj), so srv_path is still valid while the helper accesses it. This issue was found by a static analysis tool I am developing. Fixes: ae4c81644e91 ("RDMA/rtrs-srv: Rename rtrs_srv_sess to rtrs_srv_path") Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260514113834.865530-1-lgs201920130244@gmail.com Signed-off-by: Leon Romanovsky commit c9a40f6531b81baa9619bcc2697ff86896afcce7 Author: Shiraz Saleem Date: Tue May 12 02:42:09 2026 -0700 RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port Report max_msg_sz for mana_ib, which is 16MB. Fixes: 4bda1d5332ec ("RDMA/mana_ib: Implement port parameters") Signed-off-by: Shiraz Saleem Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/20260512094209.264955-1-kotaranov@linux.microsoft.com Reviewed-by: Long Li Signed-off-by: Leon Romanovsky commit 7122ff96068a03595bde2fbafaca82ca2ed8084e Author: Jason Gunthorpe Date: Wed May 13 12:00:16 2026 -0300 RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn() Sashiko points out the legacy write path in ib_uverbs_write() does allocate a struct uverbs_attr_bundle, but it doesn't wrap it in a bundle_priv so downcasting here isn't safe. Instead lift the method_elm out of the bundle_priv and use it for the debug function. The legacy write path will leave it set as NULL since the write method_elm uses a different type. Cc: stable@vger.kernel.org Fixes: 1de9287ece44 ("RDMA: Add ib_copy_validate_udata_in()") Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit 01f99f8c4a0adec6875f192702a57c5e88978af5 Author: Jason Gunthorpe Date: Wed May 13 14:33:23 2026 -0300 RDMA/core: Move the _ib_copy_validate_udata* functions to ib_core_uverbs It was incorrect to place them in uverbs_ioctl because that makes every driver depends on ib_uverbs.ko, which is undesired. ib_core_uverbs.c is for functions used by alot of drivers that are linked into ib_core instead. Fixes: 1de9287ece44 ("RDMA: Add ib_copy_validate_udata_in()") Link: https://patch.msgid.link/r/1-v1-045258567bd6+9fe-ib_uverbs_support_ko_jgg@nvidia.com Signed-off-by: Jason Gunthorpe commit c35cb4fc7231702d1e9952aec1a442f3e27df6f5 Author: Rafael J. Wysocki Date: Fri May 15 19:03:59 2026 +0200 ACPI: battery: Fix system wakeup on critical battery status Commit 0a869409a981 ("ACPI: battery: Convert the driver to a platform one") changed the parent of the battery wakeup source to the platform device used for driver binding, but it forgot to update the acpi_pm_wakeup_event() call in acpi_battery_update() accordingly. Do it now to unbreak waking up the system on critical battery status during suspend-to-idle and during transitions to ACPI S3/S4. Fixes: 0a869409a981 ("ACPI: battery: Convert the driver to a platform one") Signed-off-by: Rafael J. Wysocki Cc: 7.0+ # 7.0+ Link: https://patch.msgid.link/12898712.O9o76ZdvQC@rafael.j.wysocki commit e312f536f647156ac55e2f12d021cf887af274aa Merge: 27fa82620cbaa8 4a9b16541ad3fa Author: Linus Torvalds Date: Tue May 19 15:31:35 2026 -0500 Merge tag 'lsm-pr-20260519' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm fix from Paul Moore: "A single LSM patch to add a missing credential mutex lock to the lsm_set_self_attr(2) syscall so it behaves similar to the associated procfs API and avoids issues with ptrace" * tag 'lsm-pr-20260519' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: lsm: hold cred_guard_mutex for lsm_set_self_attr() commit 27fa82620cbaa89a7fc11ac3057701d598813e87 Merge: 1a2ab0feaa2314 759e8756da00aa Author: Linus Torvalds Date: Tue May 19 14:00:48 2026 -0500 Merge tag 'ata-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Niklas Cassel: - Make sure that the issuing of a deferred non-NCQ command via workqueue feature is only used when mixing NCQ and non-NCQ commands to the same link (i.e. return value ATA_DEFER_LINK), and nothing else. This way we will not incorrectly try to use the feature for e.g. PATA drivers - The deferred non-NCQ command was stored in a per-port struct. When using Port Multipliers with FIS-Based Switching, we would thus needlessly defer commands to all other links. Store the deferred QC in a per-link struct, such that Port Multipliers with FBS will get the same performance as before - The issuing of a deferred non-NCQ command via workqueue feature broke support for Port Multipliers using Command-Based Switching. The issuing of a deferred non-NCQ command via workqueue feature is not compatible with the use of ap->excl_link, which PMPs with CBS use for fairness (using implicit round robin) * tag 'ata-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-scsi: do not needlessly defer commands when using PMP with FBS ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT ata: libata-scsi: improve readability of ata_scsi_qc_issue() commit 5fcc48d521877c5d83828d715c81f4d169ef97f3 Author: Peter Zijlstra Date: Thu Apr 23 17:56:13 2026 +0200 x86/kvm/vmx: Fix VMX vs hrtimer_rearm_deferred() Vishal reported that KVM unit test 'x2apic' started failing after commit 0e98eb14814e ("entry: Prepare for deferred hrtimer rearming"). The reason is that KVM/VMX is injecting interrupts while it has interrupts disabled, for a context that will enable interrupts, this means that regs->flags.X86_EFLAGS_IF == 0 and irqentry_exit() will not do the right thing. Notably, irqentry_exit() must not call hrtimer_rearm_deferred() when the return context does not have IF set, because this will cause problems vs NMIs. Therefore, fix up the state after the injection. Fixes: 0e98eb14814e ("entry: Prepare for deferred hrtimer rearming") Reported-by: "Verma, Vishal L" Suggested-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Tested-by: "Verma, Vishal L" Tested-by: David Woodhouse Tested-by: Zhao Liu Tested-by: Sean Christopherson Reviewed-by: Binbin Wu Link: https://patch.msgid.link/20260423155936.957351833@infradead.org Closes: https://lore.kernel.org/r/70cd3e97fbb796e2eb2ff8cd4b7614ada05a5f24.camel%40intel.com commit 0701c9e17bd903d95b2ddf7dd2e1d8be5027f331 Author: Peter Zijlstra Date: Fri May 8 11:18:29 2026 +0200 x86/kvm/vmx: Move IRQ/NMI dispatch from KVM into x86 core Move the VMX interrupt dispatch magic into the x86 core code. This isolates KVM from the FRED/IDT decisions and reduces the amount of EXPORT_SYMBOL_FOR_KVM(). Suggested-by: Sean Christopherson Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Tested-by: "Verma, Vishal L" Tested-by: Zhao Liu Tested-by: Zhao Liu Tested-by: Sean Christopherson Reviewed-by: Binbin Wu Acked-by: Sean Christopherson Link: https://patch.msgid.link/20260508091829.GO3126523@noisy.programming.kicks-ass.net commit 431e40042d3599559e588b8946bb28bd440b4f65 Author: Caleb Sander Mateos Date: Wed May 13 12:29:21 2026 -0600 bio-integrity-fs: pass data iter to bio_integrity_verify() bio_integrity_verify() expects the passed struct bvec_iter to be an iterator over bio data, not integrity. So construct a separate data bvec_iter without the bio_integrity_bytes() conversion and pass it to bio_integrity_verify() instead of bip_iter. Fixes: 0bde8a12b554 ("block: add fs_bio_integrity helpers") Signed-off-by: Caleb Sander Mateos Reviewed-by: Anuj Gupta Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260513182924.1753582-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 1a2ab0feaa23147e347b4d4cb79cb3fc392118eb Merge: 0c0b282d502b1f 4b83cbc4c15f09 Author: Linus Torvalds Date: Tue May 19 09:49:32 2026 -0700 Merge tag 'v7.1-rc4-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix two null pointer dereferences and a memory leak * tag 'v7.1-rc4-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix null pointer dereference in compare_guid_key() ksmbd: fix null pointer dereference in proc_show_files() ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow commit 0c0b282d502b1fc5a67740ea1d88b90c042d5727 Merge: 650d21334c4fbb 2beaa98b46c4cc Author: Linus Torvalds Date: Tue May 19 09:47:23 2026 -0700 Merge tag 'ntfs-for-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs Pull ntfs fixes from Namjae Jeon: - Check the index depth limit via ntfs_icx_parent_inc(), avoiding context corruption from excessively deep child chains - Switch security descriptor allocation to kzalloc() to avoid leaking uninitialized memory - Prevent an inconsistent state where vol->volume_label becomes NULL on allocation failure - Validate MFT records by verifying that attrs_offset sits within bytes_in_use - Fix an off-by-one boundary comparison, correctly catching the out-of-range MFT record number - Validate the attribute name offset and length bounds prior to AT_UNUSED enumeration - Check for a valid left neighbor before runlist merges to prevent an 8byte out-of-bounds write on crafted volumes - Add the missing record comparison against $MFTMirr during mount - Fix wrong inode lookup when writing extent MFT records - Redirty folio on memory allocation failure in ntfs_write_mft_block() - Capture and propagate $MFTMirr sync errors during writeback - Ensure MFT mirror and synchronous writes wait for I/O completion - Fix buffer overflow/heap over-read in ntfs_bdev_write() when cluster size is smaller than PAGE_SIZE - Fix use-after-free in ntfs_inode_sync_filename() when parent index inode is evicted while still holding its mrec_lock - Update resident attribute length validation to match $AttrDef - Fix refcount underflow and UAF of the global upcase table - Fix two smatch warnings * tag 'ntfs-for-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: ntfs: restore $MFT mirror contents check ntfs: fix empty_buf and ra lifetime bugs in ntfs_empty_logfile() ntfs: validate attribute name bounds before returning it ntfs: fix MFT bitmap scan 2^32 boundary check ntfs: validate MFT attrs_offset against bytes_in_use ntfs: fix missing kstrdup() error check in ntfs_write_volume_label() ntfs: avoid leaking uninitialised bytes in new security descriptors ntfs: fix out-of-bounds write in ntfs_index_walk_down() ntfs: fix out-of-bounds write in ntfs_rl_collapse_range() merge path ntfs: fix variable dereferenced before check ni in ntfs_attr_open() ntfs: fix default_upcase refcount underflow and UAF on fs_context teardown ntfs: match ntfs_resident_attr_min_value_length with $AttrDef ntfs: avoid use-after-free of index inode in ntfs_inode_sync_filename() ntfs: fix copy length in ntfs_bdev_write() for non-page-aligned start ntfs: wait for sync mft writes to complete ntfs: capture mft mirror sync errors in ntfs_write_mft_block() ntfs: redirty folio when ntfs_write_mft_block() runs out of memory ntfs: use base mft_no when looking up base inode for extent record ntfs: fix variable dereferenced before check ni and attr in ntfs_attrlist_entry_add() commit 650d21334c4fbbdbf085b9f542cc530a7d5cd4fd Merge: c6e99c10fd9855 202550713128da Author: Linus Torvalds Date: Tue May 19 09:43:24 2026 -0700 Merge tag 'kbuild-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nicolas Schier: - modpost: prevent stack buffer overflow in do_input_entry() and do_dmi_entry() Defensively replace unbound sprintf() calls in file2alias to prevent silent stack overflows and detect alias name overflows with proper error message. - kbuild: pacman-pkg: make "rc" releases adhere to pacman versioning scheme Enable smooth upgrades from "rc" releases w/ pacman packages. * tag 'kbuild-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: pacman-pkg: make "rc" releases adhere to pacman versioning scheme modpost: prevent stack buffer overflow in do_input_entry() and do_dmi_entry() commit b6fe4ff340560ecf39e10733366f85832550699a Author: Christian König Date: Mon Apr 27 16:31:31 2026 +0200 drm/amdgpu: fix handling in amdgpu_userq_create Well mostly the same issues the other code had as well: 1. Memory allocation while holding the userq_mutex lock is forbidden! 2. Things were created/started/published in the wrong order. 3. The reset lock was taken in the wrong order and seems to be unecessary in the first place. 4. Error messages on invalid input parameters can spam the logs. 5. Error messages on memory allocation failures are usually superflous as well. Signed-off-by: Christian König Reviewed-by: Sunil Khatri Reviewed-by: Prike Liang Signed-off-by: Alex Deucher (cherry picked from commit 89e50de5654dbe7a137e03d78629542e17ba7202) commit d4d76c9ee1997cc8c977a63f6c43551c253c1066 Author: Jeremy Erazo Date: Fri May 15 19:31:41 2026 +0000 smb: client: use data_len for SMB2 READ encrypted folioq copy In handle_read_data() the encrypted/folioq branch (buf_len <= data_offset, reached via receive_encrypted_read for transform PDUs > CIFSMaxBufSize + MAX_HEADER_SIZE) copies the READ payload using buffer_len rather than data_len: rdata->result = cifs_copy_folioq_to_iter(buffer, buffer_len, cur_off, &rdata->subreq.io_iter); ... rdata->got_bytes = buffer_len; buffer_len comes from the SMB3 transform header OriginalMessageSize field (OriginalMessageSize - read_rsp_size); it represents the size of the decrypted message after the SMB2 header. data_len comes from the SMB2 READ response DataLength field; it represents the actual READ payload size and may be smaller than buffer_len when the decrypted message contains padding or other trailing bytes after the READ payload. The existing check `data_len > buffer_len - pad_len` only enforces an upper bound, so a server that emits OriginalMessageSize larger than read_rsp_size + pad_len + data_len passes the check and the kernel copies buffer_len bytes per response, ignoring the server-asserted DataLength. Two observable failures with a crafted server (DataLength=4, buffer_len=20000): - the kernel returns 20000 bytes per sub-request to userspace and sets got_bytes = buffer_len, even though the response claimed only 4 bytes of payload; - on a partial netfs sub-request whose iterator is sized to data_len, the over-large copy_folio_to_iter() short-reads, cifs_copy_folioq_to_iter() returns -EIO via the n != len path, and the entire netfs read collapses to -EIO even though the leading sub-requests succeeded. Use data_len for the copy length and for got_bytes so the kernel honours the server-asserted READ payload size. For well-formed servers (where buffer_len == pad_len + data_len) the change is behaviour-equivalent. Cc: stable@vger.kernel.org Signed-off-by: Jeremy Erazo Acked-by: David Howells Signed-off-by: Steve French commit d093c01d30fc32cb82458731c33fa2a787ff1e7b Author: Vitaliy Triang3l Kuzmin Date: Sat May 16 00:48:32 2026 +0300 drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check 'evergreen_surface_check' is called with a NULL warning prefix when handling potentially recoverable issues or just to compute the alignment requirements, and 'evergreen_surface_check' is called again in case of failure (with the correct prefix, as opposed to NULL), therefore, the initial check must not print a warning, because the surface may be accepted successfully after having been corrected, however if it isn't, the final check will print the warning anyway. The surface check functions specific to array modes already implement this behavior, but the 'evergreen_surface_check' function itself doesn't. This is also supposed to fix the "'%s' directive argument is null [-Werror=format-overflow=]" compiler warning. Fixes: 285484e2d55e ("drm/radeon: add support for evergreen/ni tiling informations v11") Reported-by: Arnd Bergmann Signed-off-by: Vitaliy Triang3l Kuzmin Signed-off-by: Alex Deucher (cherry picked from commit e20ea411c99f6968af35fd03e9ee21f70d799144) commit b6a28b77b88e776a8cc7739005718e03c4c9be57 Author: Sunil Khatri Date: Wed May 13 13:29:35 2026 +0530 drm/amdgpu: userq_va_mapped should remain true once done Multiple queues needs these bo_va objects belonging to the same uq_mgr. So once they are mapped lets not unmap them as at any point of time any of the queues might be using it. Also userq_va_mapped should be a boolean than atomic. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 5c02889ea22575c3bcfdf212e65fac316cbc6c6a) commit cd7cfcdb4dd45c79ef6825a3dc918782f604f5ed Author: Ce Sun Date: Mon May 11 18:04:57 2026 +0800 drm/amdgpu: avoid integer overflow in VA range check The original addition operation in 64-bit unsigned type may encounter overflow situations. To prevent such issues and safely reject invalid inputs, the check_add_overflow() function is used. Signed-off-by: Ce Sun Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher (cherry picked from commit cc768f4dd0bb9083c813683eeec44fc23921f771) commit 893fea60f8393fc99fa522f1718690421a5f9951 Author: Xiang Liu Date: Mon May 11 21:28:59 2026 +0800 drm/amd/ras: Fix UMC error address allocation leak amdgpu_umc_handle_bad_pages() allocates err_data->err_addr before querying UMC error information. In the direct and firmware query paths, the pointer is reassigned to a fresh allocation before the original buffer is released, so the initial allocation is leaked on each handled event. Free the existing buffer before replacing it in those query paths so the function exit cleanup only owns the active allocation. Signed-off-by: Xiang Liu Reviewed-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher (cherry picked from commit 911b1bdd22c3712a22b60fcc58f7b9f2d07b0803) commit 353f7430d1eccd481cc089decd1fc377d4312f4a Author: Yifan Zhang Date: Mon May 11 22:14:23 2026 +0800 drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 reset During Mode 1 reset, the ASIC undergoes a reset cycle and becomes temporarily inaccessible via PCIe. Any attempt to access framebuffer or MMIO registers during this window can result in uncompleted PCIe transactions, leading to NMI panics or system hangs. To prevent this, Unmap all of the applications mappings of the framebuffer and doorbell BARs before mode1 reset. Also prevent new mappings from coming in during the reset process. v2: remove inode in kfd_dev (Christian) v3: correct unmap offset (Felix), remove prevent new mappings part to avoid deadlock (Christian) Reviewed-by: Felix Kuehling Signed-off-by: Yifan Zhang Signed-off-by: Alex Deucher (cherry picked from commit 70cadefcc6160c575b04f763ada34c20e868d577) commit 6c92f6d9600efa3ef0d9e560a2b52776d9803c29 Author: Harry Wentland Date: Thu May 7 16:26:31 2026 -0400 drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy. Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access. Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used. Assisted-by: GitHub Copilot:Claude claude-4-opus Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881) Cc: stable@vger.kernel.org commit 86d2b20644b11d21fe52c596e6e922b4590a3e3f Author: Harry Wentland Date: Mon May 4 16:14:11 2026 -0400 drm/amd/display: Validate GPIO pin LUT table size before iterating [Why&How] The GPIO pin table parsers in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() derive an element count from the VBIOS table_header.structuresize field, then iterate over gpio_pin[] entries. However, GET_IMAGE() only validates that the table header itself fits within the BIOS image. If the VBIOS reports a structuresize larger than the actual mapped data, the loop reads past the end of the BIOS image, causing an out-of-bounds read. Fix this by calling bios_get_image() to validate that the full claimed structuresize is accessible within the BIOS image before entering the loop in both functions. Assisted-by: GitHub Copilot:claude-opus-4-6 Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit ba5e95b43b773ae1bf1f66ee6b31eb774e65afe3) Cc: stable@vger.kernel.org commit cd86529ec61474a38c3837fb7823790a7c3f8cce Author: Harry Wentland Date: Mon May 4 11:14:45 2026 -0400 drm/amd/display: Fix integer overflow in bios_get_image() [Why&How] The bounds check in bios_get_image() computes 'offset + size' using unsigned 32-bit arithmetic before comparing against bios_size. If a VBIOS image contains a near-UINT32_MAX offset the addition wraps to a small value, the comparison passes, and the function returns a wild pointer past the VBIOS mapping. Additionally, the comparison uses '<' (strict), which incorrectly rejects the valid exact-fit case where offset + size == bios_size. Fix both issues by restructuring the check to avoid the addition entirely: first reject if offset alone exceeds bios_size, then check size against the remaining space (bios_size - offset). This eliminates the overflow and correctly permits exact-fit accesses. Assisted-by: GitHub Copilot:claude-opus-4.6 Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit d40fb392af659c4a02b560319f226842f6ec1a95) Cc: stable@vger.kernel.org commit 6dc2c49a705195c89b09b134d0bc4dc5e42d1fea Author: David Francis Date: Tue May 12 15:18:18 2026 -0400 drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id allocate_sdma_queue has an option where the sdma queue id can be specified (used by CRIU). We weren't bounds-checking that value. Confirm it's less than the maximum number of queues. Signed-off-by: David Francis Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher (cherry picked from commit bfe9a7545b2a7be1c543f1741e16f2d5ec4116ae) commit 0978406224d21bd35f9230a25534849ec06bf74c Author: Sunil Khatri Date: Thu May 14 12:31:00 2026 +0530 drm/amdgpu: use atomic operation to achieve lockless serialization In amdgpu_seq64_alloc there is a possibility that two difference cores from two separate NODES can try to and could get the same free slot. So this fixes that race here using atomic test_and_set clear operations. Signed-off-by: Sunil Khatri Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 4d50a14d346141e03a7c3905e496d91e048bc30c) commit a1d4b228e3dc5134c4bd06e55e81dbb604c8cadb Author: David Francis Date: Tue May 12 15:15:33 2026 -0400 drm/amdkfd: Check bounds on allocate_doorbell allocated_doorbell has an option to set the doorbell id to a specific value (used by CRIU). This value was not bounds checked. Check to confirm it's less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS. Signed-off-by: David Francis Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher (cherry picked from commit 1f087bb8cf9e8797633da35c85435e557ef74d06) commit 0c61a9732a35b0a96213119c8212349da9cda117 Author: Timur Kristóf Date: Wed May 13 22:04:16 2026 +0200 drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access. This may fix VM faults when using VCE 3. Cc: John Olender Fixes: e98226221467 ("drm/amdgpu: recalculate VCE firmware BO size") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 15c369257bd85f47a514744f960c5a51c867716f) commit 5dc3d16cd072a3b8595f430b6683d688d1d62f37 Author: Timur Kristóf Date: Wed May 13 22:04:15 2026 +0200 drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access. Additionally, increase the VCE_V2_0_DATA_SIZE to have extra space after the VCE handles. Also increase the data size used for each VCE handle. The FW needs 23744 bytes, use 24K to be safe. This fixes VM faults when using VCE 2. Cc: John Olender Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4802 Fixes: e98226221467 ("drm/amdgpu: recalculate VCE firmware BO size") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit a20d21df625548c1738c0745f753c5d6eb823bc3) commit f5a247e0377cd30d658d52ae8a70c82978cc37df Author: Timur Kristóf Date: Wed May 13 22:04:14 2026 +0200 drm/amdgpu/vce1: Stop using amdgpu_vce_resume The VCE1 firmware works slightly differently and is already loaded by vce_v1_0_load_fw(). It doesn't actually need to call amdgpu_vce_resume(). Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 33d8951405e2dd81ac61edebc680e2dfb6b4fc9f) commit 3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3 Author: Timur Kristóf Date: Wed May 13 22:04:13 2026 +0200 drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access. Make sure the stack and data offsets are aligned to the 32K TLB size. Check that the FW microcode actually fits in the space that is reserved for it. Fixes: d4a640d4b9f3 ("drm/amdgpu/vce1: Implement VCE1 IP block (v2)") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449) commit 3ebcab11320588fd9bb17a26027dddce4419ae43 Author: Timur Kristóf Date: Wed May 13 22:04:12 2026 +0200 drm/amdgpu/vce1: Don't repeat GTT MGR node allocation Only allocate entries from the GTT manager when the VCE GTT node is not allocated yet. This prevents the possibility of allocating them multiple times, which causes issues during GPU reset and suspend/resume. Fixes: 71aec08f80e7 ("amdgpu/vce: use amdgpu_gtt_mgr_alloc_entries") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 8d2a20c1721cb17e22821e1b4ecbb02d475d91c5) commit 12b60cf345e84aa7546dd225b3ce3380c9ab97f5 Author: Timur Kristóf Date: Wed May 13 22:04:11 2026 +0200 drm/amdgpu/vce1: Check if VRAM address is lower than GART. Previously, I had assumed this was not possible so it was OK to not handle it, but now we got a report from a user who has a board that is configured this way. When the VCPU BO is already located in a low 32-bit address in VRAM (eg. when VRAM is mapped to the low address space), don't do the workaround. Fixes: 71aec08f80e7 ("amdgpu/vce: use amdgpu_gtt_mgr_alloc_entries") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit f370ec9b164698a9ca1a7b59bfbea07f70df769d) commit d993851b6db9abf0840e8b100e33df232bcc879e Author: Timur Kristóf Date: Wed May 13 22:04:10 2026 +0200 drm/amdgpu/vce1: Remove superfluous address check The same thing is already checked a few lines above. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit c1dc555e760dbfc4a4710f7270f525a03d433af8) commit 9f907adb66d8369dd45412794a04845011503fa8 Author: Timur Kristóf Date: Wed May 13 22:04:09 2026 +0200 drm/amdgpu/vce1: Check that the GPU address is < 128 MiB When ensuring the low 32-bit address, make sure it is less than 128 MiB, otherwise the VCE seems to fail to initialize. This seems to be an undocumented limitation of the firmware validation mechanism. Note that in case of VCE1 the BAR address is zero and we can't change it also due to the firmware validator. When programming the mmVCE_VCPU_CACHE_OFFSETn registers, don't AND them with a mask. This is incorrect because the register mask is actually 0x0fffffff and useless because we already ensure the addresses are below the limit. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit e729ae5f3ac73c861c062080ac8c3d666c972404) commit 4d798ea0712fddbd35b439cef32b8ac735eb76f9 Author: Timur Kristóf Date: Wed May 13 22:04:08 2026 +0200 drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti (v2) The TLB is organized in groups of 8 entries, each one is 4K. On Tahiti, the HW requires these GART entries to be 32K-aligned. This fixes a VCE 1 firmware validation failure that can happen after suspend/resume since we use amdgpu_gtt_mgr for VCE 1. v2: - Change variable declaration order - Add comment about "V bit HW bug" Fixes: 698fa62f56aa ("drm/amdgpu: Add helper to alloc GART entries") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 530411b465ef0b2c0cc18c2e3d7e38422b1117d1) commit 48b13bfbdf94e683cc5b8c5cb35b5af4221e657f Author: Sunday Clement Date: Wed May 13 11:22:19 2026 -0400 drm/amdkfd: Fix OOB memory exposure in get_wave_state() The get_wave_state() function for v9 trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read directly from the MQD, which are written by GPU microcode and fully attacker-controlled on the CRIU-restore path (via AMDKFD_IOC_RESTORE_PROCESS with H3). this leads to an unbounded copy_to_user() that can leak adjacent GTT/kernel memory. If offset > size, integer underflow produces a ~4 GiB read length, if size is set to 1 MiB against a 4 KiB allocation, we leak 1 MiB of adjacent kernel memory (other queues' MQDs, ring buffers, KASLR pointers). Fix by clamping both cp_hqd_cntl_stack_size to the actual allocated buffer size (q->ctl_stack_size) and cp_hqd_cntl_stack_offset to the clamped size before performing arithmetic and copy_to_user(). This ensures we never read beyond the allocated kernel BO regardless of attacker-supplied MQD field values. Signed-off-by: Sunday Clement Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 7ef144458f48d5589e36f1b3d83e83db2e5c5ba5) commit d796558def777f9a9cc274861e06b8b61851b409 Author: Yang Wang Date: Sat May 9 15:20:39 2026 +0800 drm/amd/pm: fix memleak of dpm_policies on smu v15 In smu_v15_0_fini_smc_tables, dpm_policies was not freed or NULLed, causing a memory leak. Add kfree() and NULL assignment to properly release memory and avoid dangling pointers. Fixes: 2beedc3a92b7 ("drm/amd/pm: Add initial support for smu v15_0_8"); Signed-off-by: Yang Wang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher (cherry picked from commit 014f329074f688b9b49383e8b70e79e9ef99359e) commit 9baf02bf88a8228248c546a3be7bbe3bfe74b7d5 Author: Lijo Lazar Date: Tue May 12 20:29:52 2026 +0530 drm/amdgpu: Fix discovery offset check under VF Discovery table may be kept at offset 0 by host driver. Remove the validation check. Fixes: 01bdc7e219c4 ("drm/amdgpu: New interface to get IP discovery binary v3") Signed-off-by: Lijo Lazar Reviewed-by: Ellen Pan Signed-off-by: Alex Deucher (cherry picked from commit d3f5bbd007133c64a20e81ef290a93e46c75df40) commit d892a6eca7a847dd57ede6e55d7494a01b43fa5f Author: Sunil Khatri Date: Tue May 12 22:29:48 2026 +0530 drm/amdgpu: remove va cursors for all mappings va_cursor struct needs to be cleaned even if the mapping has been removed already. Also simplify it by make it a void function as return value check isn't needed as its called during tear down. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 4d35a45c9b4c1ac5b6e3219f83c3db706b675fa2) commit 2c34c7b88ba4f04b3a862fac879bfd8567f06541 Author: Amir Shetaia Date: Thu May 7 13:24:55 2026 -0400 drm/amdgpu: reject non-user addresses early in GEM_USERPTR ioctl amdgpu_gem_userptr_ioctl() currently accepts any value of args->addr and only discovers an out-of-range pointer much later, inside amdgpu_gem_object_create() and the HMM mirror registration path. Userspace can drive that path with kernel-side virtual addresses; the get_user_pages() layer rejects them, but only after the driver has already allocated a GEM object and started wiring up notifier state that then has to be torn down on failure. Add an access_ok() guard at the top of the ioctl, right after the existing page-alignment check and before flag validation, so any address that does not lie within the calling task's user address range is rejected with -EFAULT before any allocation occurs. No legitimate ROCm/HSA userspace passes kernel-mode pointers through this interface, so this is defense-in-depth rather than a behaviour change for valid callers; -EFAULT matches the convention already used by other uaccess-style rejections in the kernel. Also add an explicit #include ; access_ok() is otherwise only available transitively through other headers in this translation unit. Signed-off-by: Amir Shetaia Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 7a076df36397d780d7e4fb595287b4980451a7f5) commit b6074630a461b1322a814988779005cbc43612ea Author: Alan Liu Date: Fri May 1 12:35:48 2026 +0800 drm/amdgpu/vpe: Force collaborate sync after TRAP VPE1 could possibly hang and fail to power off at the end of commands in collaboration mode. This workaround adds a COLLAB_SYNC after TRAP to force instances synchronized to avoid VPE1 fail to power off. Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alan liu Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5171 Signed-off-by: Alex Deucher (cherry picked from commit a8b749c5c5afb7e5daa2bfb95d958fb3c6b8f055) Cc: stable@vger.kernel.org commit 0be97436bf249503b2c5898e7459744962b70f15 Author: Sunil Khatri Date: Tue May 12 16:00:18 2026 +0530 drm/amdgpu/userq: update the vm task info during signal ioctl Pagefaults does not have process information correctly populated as vm->task is not set during vm_init but should be updated while real submission. So setting that up during signal_ioctl to get the correct submission process details. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit a9b14d88b4d83e21ab965f23d1fb7b07b87e0517) commit 291df3dc7d10855c26841b8f42843bc996d097cf Author: Sunil Khatri Date: Tue May 12 14:52:40 2026 +0530 drm/amdgpu/userq: cancel reset work while tear down in progress While tear down of a userq_mgr is happening when all the queues are free we should cancel any reset work if pending before exiting. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 160164609f71f774c4f661227a9b7a370a86b112) commit c8ed2de0f2ee842d108ef96c125e931ea82b453c Author: Christian König Date: Tue Apr 21 12:39:54 2026 +0200 drm/amdgpu: rework userq reset work handling It is illegal to schedule reset work from another reset work! Fix this by scheduling the userq reset work directly on the work queue of the reset domain. Not fully tested, I leave that to the IGT test cases. Signed-off-by: Christian König Reviewed-by: Prike Liang Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher (cherry picked from commit fd9200ccefab94f27877d1943761d6b0ccbd89c8) commit be045c5c8305fca1214ebdd4b8433ac80635339b Author: Sunil Khatri Date: Fri May 8 15:58:09 2026 +0530 drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction mqd and fw objects are queue core objects which should remain valid and never be unmapped and evicted for user queues to work properly. During eviction if these buffers are evicted the hw continue to use the invalid addresses and caused page faults and system hung. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit a3bbf32a336939a1d21b9561f8e53333b684b7ef) commit eb359cc314365f50272883805adfe96b1e4ecefc Author: Sunil Khatri Date: Fri May 8 12:21:20 2026 +0530 drm/amdgpu/userq: use drm_exec in amdgpu_userq_fence_read_wptr To access the bo from vm mapping first lock the root bo and then the object bo of the mapping to make sure both locks are taken safely. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 3aab50410653fe7eb35eb6f9c2b27e3549ab09e6) commit 457b046b7dfc0fd5b3437766a4ec43d16d02482c Author: Lizhi Hou Date: Mon May 18 08:57:05 2026 -0700 accel/amdxdna: Remove mmap and export support for ubuf Ubuf pages should not be mmaped or exported. Remove the ubuf mmap callback and return -EOPNOTSUPP when exporting ubuf objects. ubuf vmap is also removed for there is not a real use case yet. Fixes: bd72d4acda10 ("accel/amdxdna: Support user space allocated buffer") Reviewed-by: Christian König Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260518155706.937461-1-lizhi.hou@amd.com commit 3da1fdf4efbc490041eb4f836bf596201203f8f2 Author: Asim Viladi Oglu Manizada Date: Sat May 16 21:15:39 2026 +0000 smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. Fixes: f1d662a7d5e5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos") Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Reviewed-by: David Howells Signed-off-by: Asim Viladi Oglu Manizada Signed-off-by: Steve French commit 4d8690dace005a38e6dbde9ecce2da3ad85c7c41 Author: Henrique Carvalho Date: Thu May 14 20:18:25 2026 -0300 smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes. There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked(). Cc: stable@vger.kernel.org Fixes: 96c4af418586 ("cifs: Fix locking usage for tcon fields") Reviewed-by: Shyam Prasad N Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 00907da2126ed785451b2a2f0fef282246dad104 Author: Niranjana Vishwanathapura Date: Mon May 18 12:16:40 2026 -0700 drm/xe/multi_queue: Fix secondary queue error case If xe_lrc_create() fails, the secondary queue added to the multi-queue group list is not removed before freeing the queue. Fix error path handling for secondary queues by removing it from the multi-queue group list at the right place. Reported-by: Sebastian Österlund Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7979 Fixes: d716a5088c88 ("drm/xe/multi_queue: Handle tearing down of a multi queue") Cc: stable@vger.kernel.org # v7.0+ Signed-off-by: Niranjana Vishwanathapura Reviewed-by: Matthew Auld Link: https://patch.msgid.link/20260518191639.320890-2-niranjana.vishwanathapura@intel.com (cherry picked from commit d2d23c12789cf69eddc35b8d38cd8eaabd0168f1) Signed-off-by: Rodrigo Vivi commit d8809f6931065cbbf3554647a50a65a471ab5983 Author: Marius Hoch Date: Sun May 17 21:23:40 2026 +0200 efi: sysfb_efi: Extend quirk to cover IdeaPad Duet 3 10IGL5-LTE The LTE enabled version of the IdeaPad Duet 3 10IGL5 needs the same quirk as the non-LTE version. As these are the only two IdeaPad Duet 3 10IGL5 versions, we can safely use non exact matching. Tested on a IdeaPad Duet 3 10IGL5-LTE. Signed-off-by: Marius Hoch Signed-off-by: Ard Biesheuvel commit 8939562b16052c75b908d3c5f968bffb526fc6e9 Author: Rong Tao Date: Mon May 18 15:02:08 2026 +0800 efi: efi.h: Remove extra semicolon Remove extra semicolons from comments. Signed-off-by: Rong Tao Signed-off-by: Ard Biesheuvel commit 13c6da02e767152c9ac4330962247a5e47011035 Author: Ard Biesheuvel Date: Tue May 19 10:03:00 2026 +0200 efi: Allocate runtime workqueue before ACPI init Since commit 5894cf571e14 ("acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers") ACPI PRM calls are delegated to a workqueue which runs in a kernel thread, making it easier to detect and mitigate faulting memory accesses performed by the firmware. Rafael reports that such PRM accesses may occur before efisubsys_init() executes, which is where the workqueue is allocated, leading to NULL pointer dereferences. Since acpi_init() [which triggers the early PRM accesses] executes as a subsys_initcall() as well, and has its own dependencies that may be sensitive to initcall ordering, deferring acpi_init() is not an option. So instead, split off the workqueue allocation into its own postcore initcall, as this is the only missing piece to allow EFI runtime calls to be made. This ensures that EFI runtime call (including PRM calls) are accessible to all code running at subsys_initcall() level. Cc: Fixes: 5894cf571e14 ("acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers") Reviewed-by: Rafael J. Wysocki (Intel) Signed-off-by: Ard Biesheuvel commit 298a43b54432fbc3a32949a94c72544ee18c8c00 Author: Robertus Diawan Chris Date: Tue May 19 12:40:24 2026 +0700 ASoC: soc-utils: Add missing va_end in snd_soc_ret() The default case in snd_soc_ret() use va_start without va_end to cleanup "args" object which can cause undefined behavior. So, add missing va_end to cleanup "args" object. This is reported by Coverity Scan as "Missing varargs init or cleanup". Fixes: 943116ba2a6a ("ASoC: add common snd_soc_ret() and use it") Signed-off-by: Robertus Diawan Chris Link: https://patch.msgid.link/20260519054024.274741-1-robertusdchris@gmail.com Signed-off-by: Mark Brown commit c6e99c10fd9855082568cbd71bb2cc5dc90eda53 Merge: ab5fce87a778cb be3f38d05cc5a7 Author: Linus Torvalds Date: Tue May 19 07:49:33 2026 -0700 Merge tag 'mm-hotfixes-stable-2026-05-18-21-07' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "14 hotfixes. 9 are for MM. 10 are cc:stable and the remainder are for post-7.1 issues or aren't deemed suitable for backporting. There's a two-patch MAINTAINERS series from Mike Rapoport which updates us for the new KEXEC/KDUMP/crash/LUO/etc arrangements. And another two-patch series from Muchun Song to fix a couple of memory-hotplug issues. Otherwise singletons, please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-05-18-21-07' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/memory: fix spurious warning when unmapping device-private/exclusive pages mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special() drivers/base/memory: fix memory block reference leak in poison accounting mm/memory_hotplug: fix memory block reference leak on remove lib: kunit_iov_iter: fix test fail on powerpc mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free MAINTAINERS: add kexec@ list to LIVE UPDATE ENTRY MAINTAINERS: add tree for KDUMP and KEXEC selftests/mm: run_vmtests.sh: fix destructive tests invocation scripts/gdb: slab: update field names of struct kmem_cache scripts/gdb: mm: cast untyped symbols in x86_page_ops mm/damon: fix damos_stat tracepoint format for sz_applied mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page commit b088fe35019433541225d315263d8477899e0657 Author: Guilherme Giacomo Simoes Date: Sun May 3 16:16:09 2026 -0300 x86/vdso: Fix incorrect size in munmap() on map_vdso() failure In map_vdso(), if a failure occurs during the installation of the VVAR mappings, the error path attempts to clean up previously allocated mappings using do_munmap(). However, the cleanup for the VVAR mapping is incorrectly using image->size (the size of the vDSO text) instead of the actual size allocated for the VVAR area. Replace the incorrect do_munmap() image->size parameter with the constant VDSO_NR_PAGES * PAGE_SIZE. Ensure the unmap size exactly matches the size used during the vdso_install_vvar_mapping() phase to provide a symmetrical and complete teardown of the memory region. Fixes: e93d2521b27f ("x86/vdso: Split virtual clock pages into dedicated mapping") Signed-off-by: Guilherme Giacomo Simoes Signed-off-by: Thomas Gleixner Reviewed-by: Thomas Weißschuh Link: https://patch.msgid.link/20260503191609.551817-1-trintaeoitogc@gmail.com commit 841ff62aa5f85b13771b33e7b9c102cbaf87432f Author: Denis Benato Date: Sun May 17 22:00:05 2026 +0000 platform/x86: asus-armoury: add support for GU605CP Add TDP data for laptop model GU605CP. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260517220005.4594-5-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit df1e0b209fa09676585402d5437ee190a424302b Author: Denis Benato Date: Sun May 17 22:00:04 2026 +0000 platform/x86: asus-armoury: add support for FA401EA Add TDP data for laptop model FA401EA. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260517220005.4594-4-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 239c7acb9e3f73ada3ccce06302f6f3d2d89762d Author: Denis Benato Date: Sun May 17 22:00:03 2026 +0000 platform/x86: asus-armoury: add support for G614FR Add TDP data for laptop model G614FR. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260517220005.4594-3-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 9ac7c8dc07af88f5169f217fec431c992b4eb550 Author: Denis Benato Date: Sun May 17 22:00:02 2026 +0000 platform/x86: asus-armoury: add support for FX607VU Add TDP data for laptop model FX607VU. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260517220005.4594-2-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d2d2e7c8fb37b27301ee5c8343b2f7037efc6ea6 Author: Ahmed Yaseen Date: Sun May 17 18:30:11 2026 +0000 platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2 devices The mini-LED current_value attribute does not work on devices that use ASUS_WMI_DEVID_MINI_LED_MODE2 (2024 and newer models). Reading is broken: mini_led_mode_current_value_show() fetches the mode from the device but then decodes a literal 0 instead of the value it just read: mode = FIELD_GET(ASUS_MINI_LED_MODE_MASK, 0); So mode is always 0, and the attribute always reports the same thing regardless of the real hardware state. Writing is broken too. The number a user writes is an index; the value the firmware actually wants is looked up from that index in mini_led_mode_map[]. mini_led_mode_current_value_store() skips that lookup and passes the raw index straight to armoury_attr_uint_store(). On 2024 devices the firmware numbers its modes differently from the index, so some writes are rejected with -EINVAL and the rest send the wrong mode to the hardware. Fix both paths: decode the value actually read from the device when reading, and look up the firmware value before sending it when writing. Older (MODE1) devices were unaffected because there the index and the firmware value are the same. Fixes: f99eb098090e ("platform/x86: asus-armoury: move existing tunings to asus-armoury module") Signed-off-by: Ahmed Yaseen Reviewed-by: Denis Benato Link: https://patch.msgid.link/20260517182957.11069-1-yaseen@ghoul.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 348ccc754d8939e21ca5956ff45720b81d6e407f Author: Lukas Wunner Date: Thu May 14 07:40:42 2026 +0200 platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery After a PCIe Uncorrectable Error has been reported by a device with Intel Vendor Specific Extended Capabilities and has been recovered through a Secondary Bus Reset, its driver calls intel_vsec_pci_probe() to rescan and reinitialize VSECs. intel_vsec_pci_probe() invokes pcim_enable_device() and thereby adds another devm action which calls pcim_disable_device() on driver unbind. So once the driver unbinds, pcim_disable_device() will be called as many times as an Uncorrectable Error occurred, plus one. This will lead to an enable_cnt imbalance on driver unbind. Additionally, since commit dc957ab6aa05 ("platform/x86/intel/vsec: Add private data for per-device data"), a devm_kzalloc() allocation is leaked on every Uncorrectable Error. Avoid by splitting the VSEC rescan out of intel_vsec_pci_probe() into a separate helper and calling that on PCIe error recovery. Fixes: 936874b77dd0 ("platform/x86/intel/vsec: Add PCI error recovery support to Intel PMT") Signed-off-by: Lukas Wunner Cc: stable@vger.kernel.org # v6.0+ Link: https://patch.msgid.link/bd594d09fa866dc51dddc9a447c3b23f9b1402cc.1778736835.git.lukas@wunner.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2ccd8ff980b50e842481bae71102fa3883fc4377 Author: Vladimir Murzin Date: Fri May 15 14:37:29 2026 +0100 arm64: probes: Handle probes on hinted conditional branch instructions BC.cond instructions introduced by FEAT_HBC cannot be executed out-of-line, like other branch instructions. However, they can be simulated in the same way as B.cond instructions. Extend the B.cond decoder mask to match BC.cond instructions as well, and handle them using the existing B.cond simulation path. Fixes: 7f86d128e437 ("arm64: add HWCAP for FEAT_HBC (hinted conditional branches)") Cc: Signed-off-by: Vladimir Murzin Signed-off-by: Catalin Marinas commit 26cbe119f99c86dcb4a0136d2bc73c0c716d80e4 Author: Armin Wolf Date: Wed May 13 01:21:41 2026 +0200 platform/x86: uniwill-laptop: Do not enable the charging limit even when forced It seems that on some older models (~2020) the battery charging limit can permanently damage the battery. Prevent users from enabling this feature thru the "force" module parameter to avoid causing permanent hardware damage on such devices. Fixes: d050479693bb ("platform/x86: Add Uniwill laptop driver") Link: https://www.reddit.com/r/XMG_gg/comments/ld9yyf/battery_limit_hidden_function_discovered_on/ Reviewed-by: Werner Sembach Reviewed-by: Ilpo Järvinen Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260512232145.329260-5-W_Armin@gmx.de Signed-off-by: Ilpo Järvinen commit fb4b67c44557cb4cbb15900083d4e1af22320339 Author: Armin Wolf Date: Wed May 13 01:21:40 2026 +0200 platform/x86: uniwill-laptop: Fix behavior of "force" module param Users might want to force-enable all possible features even on machines with a valid device descriptor. Until now the "force" module param was ignored on such machines. Fix this to make it easier to test for support of new features. Fixes: d050479693bb ("platform/x86: Add Uniwill laptop driver") Reviewed-by: Werner Sembach Reviewed-by: Ilpo Järvinen Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260512232145.329260-4-W_Armin@gmx.de Signed-off-by: Ilpo Järvinen commit c16a4823cc60a32b891f7a148bb30c0f51d12cf4 Author: Armin Wolf Date: Wed May 13 01:21:39 2026 +0200 platform/x86: uniwill-laptop: Accept charging threshold of 0 The power supply sysfs ABI states that: Not all hardware is capable of setting this to an arbitrary percentage. Drivers will round written values to the nearest supported value. Reading back the value will show the actual threshold set by the driver. The driver currently violates this ABI by rejecting a charging threshold of 0. Fix this by clamping this value to 1. Fixes: d050479693bb ("platform/x86: Add Uniwill laptop driver") Reviewed-by: Werner Sembach Reviewed-by: Ilpo Järvinen Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260512232145.329260-3-W_Armin@gmx.de Signed-off-by: Ilpo Järvinen commit c12cc42dadd85dea210d5699d4f21def827382eb Author: Armin Wolf Date: Wed May 13 01:21:38 2026 +0200 platform/x86: uniwill-laptop: Properly initialize charging threshold The EC might initialize the charge threshold with 0 to signal that said threshold is uninitialized. Detect this and replace said value with 100 to signal the EC that we want to take control of battery charging. Also set the threshold to 100 if the EC-provided value is invalid. Fixes: d050479693bb ("platform/x86: Add Uniwill laptop driver") Reviewed-by: Werner Sembach Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260512232145.329260-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5798b46271e229dab05e47537ac30b76f81728da Author: Rafael J. Wysocki Date: Tue May 12 18:30:26 2026 +0200 platform/surface: surfacepro3_button: Check ACPI_COMPANION() Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the surfacepro3_button driver. Fixes: d913a5a12b40 ("platform/surface: surfacepro3_button: Convert to a platform driver") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Reviewed-by: Chen Yu Link: https://patch.msgid.link/23119222.EfDdHjke4D@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a9f305c5a355efeb240d406d378491d9eec02d07 Author: Rafael J. Wysocki Date: Tue May 12 17:16:22 2026 +0200 platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_HANDLE() check against NULL to the platform/x86 intel-vbtn driver. Fixes: 26173179fae1 ("platform/x86: intel-vbtn: Eval VBDL after registering our notifier") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/3426431.aeNJFYEL58@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2765f16c12af7c2533763e46b8113b727354012d Author: Rafael J. Wysocki Date: Tue May 12 17:15:32 2026 +0200 platform/x86: intel_sar: Check ACPI_HANDLE() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_HANDLE() check against NULL to the platform/x86 intel_sar driver. Fixes: dcfbd31ef4bc ("platform/x86: BIOS SAR driver for Intel M.2 Modem") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/14023870.uLZWGnKmhe@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5c69e090ae5dd93d910f70db0796357080707d26 Author: Rafael J. Wysocki Date: Tue May 12 17:13:28 2026 +0200 platform/x86: intel-hid: Check ACPI_HANDLE() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_HANDLE() check against NULL to the platform/x86 intel-hid driver. Fixes: ecc83e52b28c ("intel-hid: new hid event driver for hotkeys") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/1971512.tdWV9SEqCh@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit abfbe5ee8ae89f1f5449790423d5dd3e423545bd Author: Rafael J. Wysocki Date: Tue May 12 17:12:40 2026 +0200 platform/x86: hp_accel: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 hp_accel driver. Fixes: 8ebcb6c94c71 ("platform/x86: hp_accel: Convert to be a platform driver") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/2425918.ElGaqSPkdT@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e7a9a6ea40e352cd7977f6a8c80bdeadf65ad838 Author: Rafael J. Wysocki Date: Tue May 12 17:11:49 2026 +0200 platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_HANDLE() check against NULL to the platform/x86 adv_swbutton driver. Fixes: 3d904005f686 ("platform/x86: add support for Advantech software defined button") Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/5115425.31r3eYUQgx@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 00c9753435e8a800761feeeea029a83c4c4847c4 Author: Коненко Андрей Викторович Date: Tue May 19 16:37:42 2026 +0300 hp-wmi: fix support for thermal profile Omen 16-с0xxx laptops The HP Omen 16-c0xxx (board ID: 8902) has the same WMI interface as other Victus S boards, but requires additional quirks for correctly switching thermal profile. Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to the omen_v1_legacy_thermal_params quirk. Testing on board 8902 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Signed-off-by: Konenko Andrey Viktorovich Link: https://patch.msgid.link/T3DTKbKwQzOgk_0eUG-kMg@aquinas.su Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e7537735028c3ad4b0bfc02ff8fa2a1a28aa04fe Author: Heechan Kang Date: Sun May 17 15:22:32 2026 +0900 fwctl: pds: Validate RPC input size before parsing The fwctl core allocates the device-specific RPC input buffer with fwctl_rpc.in_len and passes that buffer to the driver callback. pdsfc_fw_rpc() casts the buffer to struct fwctl_rpc_pds and then calls pdsfc_validate_rpc(), which reads fields from that structure before checking that the input buffer is large enough to contain it. A short in_len can make pds_fwctl read beyond the allocation. Reject pds RPC buffers that are smaller than struct fwctl_rpc_pds before parsing any pds-specific fields. Fixes: 92c66ee829b9 ("pds_fwctl: add rpc and query support") Link: https://patch.msgid.link/r/20260517062232.1858747-1-gganji11@naver.com Cc: stable@vger.kernel.org # v6.15+ Signed-off-by: Heechan Kang Reviewed-by: Dave Jiang Signed-off-by: Jason Gunthorpe commit edc502717be153674b0b3eefb8b40734c747c138 Merge: 956aa1ec975fcd 01ff78e4b3d986 Author: Paolo Abeni Date: Tue May 19 15:36:38 2026 +0200 Merge branch 'mptcp-misc-fixes-for-v7-1-rc4' Matthieu Baerts says: ==================== mptcp: misc fixes for v7.1-rc4 Here are various unrelated fixes: - Patch 1: avoid dropping partial packets. A previous version has been sent a few week ago. A fix for 5.10. - Patches 2-3: stop ADD_ADDR timer when an ADD_ADDR can never been sent due to insufficient option space. A fix for v5.10. - Patch 4: reset rcv_wnd_sent on disconnect, just in case the next connection falls back to TCP. A fix for 5.17. - Patch 5: update window_clamp when SO_RCVBUF is set during the connection. A fix similar to a recent one on TCP side, for v6.6. - Patch 6: avoid wrong time being displayed in the selftests when using uutils 0.8.0 which contains a regression with 'date +%3N'. It doesn't fix an issue in the kernel selftests, but having the fix is helpful for those using uutils 0.8.0. Signed-off-by: Matthieu Baerts (NGI0) ==================== Link: https://patch.msgid.link/20260515-net-mptcp-misc-fixes-7-1-rc4-v2-0-701e96419f2f@kernel.org Signed-off-by: Paolo Abeni commit 01ff78e4b3d98689184c52d97f9575dfbdc3b10f Author: Matthieu Baerts (NGI0) Date: Fri May 15 06:27:37 2026 +0200 selftests: mptcp: drop nanoseconds width specifier Using the format specifier +%s%3N with GNU date is honoured, and only prints 3 digits of the nanoseconds portion of the seconds since epoch, which corresponds to the milliseconds. The uutils implementation of date currently does not honour this, and always prints all 9 digits. This is a known issue [1], but can be worked around by adapting this test to use nanoseconds instead of microseconds, and then divide it by 1e6. This fix is similar to what has been done on systemd side [2], and it is needed to run the selftests on Ubuntu 26.04, containing uutils 0.8.0. Note that the Fixes tag is there even if this patch doesn't fix an issue in the kernel selftests, but it is useful for those using uutils 0.8.0. Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp") Cc: stable@vger.kernel.org Link: https://github.com/uutils/coreutils/issues/11658 [1] Link: https://github.com/systemd/systemd/pull/41627 [2] Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260515-net-mptcp-misc-fixes-7-1-rc4-v2-6-701e96419f2f@kernel.org Signed-off-by: Paolo Abeni commit 3a543ae0e2092d5c2085d5f21f7a7dbafdffea3c Author: Gang Yan Date: Fri May 15 06:27:36 2026 +0200 mptcp: update window_clamp on subflows when SO_RCVBUF is set Add __mptcp_subflow_set_rcvbuf() helper to write the subflow sk_rcvbuf, but also to call the recently added tcp_set_rcvbuf() helper to update window_clamp. This is needed because the window clap is updated when scaling_ratio changes, in tcp_measure_rcv_mss(). Until scaling_ratio changes, the subflow is stuck with the old window clamp which may be based on a small initial buffer. Use this new helper in both mptcp_sol_socket_sync_intval() (setsockopt path) and sync_socket_options() (new subflow creation path). Note that this patch depends on commit b025461303d8 ("tcp: update window_clamp when SO_RCVBUF is set"): it fixes the issue on TCP side, but the same fix is needed on MPTCP side as well. Fixes: a2cbb1603943 ("tcp: Update window clamping condition") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/619 Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260515-net-mptcp-misc-fixes-7-1-rc4-v2-5-701e96419f2f@kernel.org Signed-off-by: Paolo Abeni commit 0981f90e1a05773a4c29c6e720f5ea1e3c8f1876 Author: Paolo Abeni Date: Fri May 15 06:27:35 2026 +0200 mptcp: reset rcv wnd on disconnect If the MPTCP socket fallback to TCP before the MP handshake completion, the IASN remain 0, and the rcv_wnd_sent field is not explicitly initialized, just incremented over time with the data transfer. At disconnect time such value is not cleared. If the next connection falls back to TCP before the MP handshake completion, the data transfer will keep incrementing the receive window end sequence starting from the last value used in the previous connection: the announced window will be unrelated from the actual receiver buffer size and likely too big. Address the issue zeroing the field at disconnect time. Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260515-net-mptcp-misc-fixes-7-1-rc4-v2-4-701e96419f2f@kernel.org Signed-off-by: Paolo Abeni commit fc5ef4331810b160427ad2d0165dff713e968e9b Author: Li Xiasong Date: Fri May 15 06:27:34 2026 +0200 selftests: mptcp: join: cover ADD_ADDR tx drop and list progress Extend add_addr_ports_tests with IPv6 signaling cases that exercise ADD_ADDR tx-space shortage when tcp_timestamps are enabled. Add one case to verify PM still progresses to later signal endpoints after the first one is dropped. This covers both failure accounting and the non-blocking behavior of the announce list after a tx-space drop on pure ACK. Signed-off-by: Li Xiasong Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260515-net-mptcp-misc-fixes-7-1-rc4-v2-3-701e96419f2f@kernel.org Signed-off-by: Paolo Abeni commit 51e398a3b8961b26a8c0a4ba9a777c5339791707 Author: Li Xiasong Date: Fri May 15 06:27:33 2026 +0200 mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient When TCP option space is insufficient (e.g., when sending ADD_ADDR with an IPv6 address and port while tcp_timestamps is enabled), the original code jumped to out_unlock without clearing the addr_signal flag. This caused mptcp_pm_add_timer to keep rescheduling indefinitely, not sending ADD_ADDR, preventing subsequent addresses in the endpoint list from being announced. Handle this case by clearing the ADD_ADDR signal and skipping the matching ADD_ADDR retransmission entry. The skip path cancels the matching timer (with id check) and advances PM state progression, preserving forward progress to subsequent PM work. This cancellation is inherently best-effort. A concurrent add_timer callback may already be running and may acquire pm.lock before the cancel path updates entry state. In that case, one final ADD_ADDR transmit attempt can still be executed. Once the cancel path sets entry->retrans_times to ADD_ADDR_RETRANS_MAX, the callback-side retrans_times check suppresses further ADD_ADDR retransmissions. Note that when an ADD_ADDR is being prepared, a pure-ACK is queued. On the output side, it means that it is fine to skip non-pure-ACK packets, when drop_other_suboptions is set: a pure-ACK will be processed soon after. Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Signed-off-by: Li Xiasong Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260515-net-mptcp-misc-fixes-7-1-rc4-v2-2-701e96419f2f@kernel.org Signed-off-by: Paolo Abeni commit 50c2d91c5dfa0e465826ec1f8dbad9cdc254bd85 Author: Shardul Bankar Date: Fri May 15 06:27:32 2026 +0200 mptcp: do not drop partial packets When a packet arrives with map_seq < ack_seq < end_seq, the beginning of the packet has already been acknowledged but the end contains new data. Currently the entire packet is dropped as "old data," forcing the sender to retransmit. Instead, skip the already-acked bytes by adjusting the skb offset and enqueue only the new portion. Update bytes_received and ack_seq to reflect the new data consumed. A previous attempt at this fix has been sent by Paolo Abeni [1], but had issues [2]: it also added a zero-window check and changed rcv_wnd_sent initialization, which caused test regressions. This version addresses only the partial packet handling without modifying receive window accounting. Fixes: ab174ad8ef76 ("mptcp: move ooo skbs into msk out of order queue.") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/c9b426a4e163aa3c4fe8b80c79f1a610f47ae7d8.1763075056.git.pabeni@redhat.com [1] Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/600 [2] Signed-off-by: Shardul Bankar [pabeni@redhat.com: update map] Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260515-net-mptcp-misc-fixes-7-1-rc4-v2-1-701e96419f2f@kernel.org Signed-off-by: Paolo Abeni commit 0488073a6c84571dd3cffe581a4a73a5fceb099d Author: Oliver White Date: Thu Apr 9 15:43:47 2026 +1200 platform/surface: aggregator_registry: omit battery & AC nodes on Surface Laptop 7 Surface Laptop 7 exposes battery and AC status via Qualcomm PMIC GLINK qcom_battmgr. Registering the standard SSAM battery and AC client devices on this platform causes duplicate power-supply devices to appear. Drop the SSAM battery and AC nodes from the Surface Laptop 7 registry group so that only the qcom_battmgr power supplies are instantiated. Fixes: b27622f13172 ("platform/surface: Add OF support") Signed-off-by: Oliver White Link: https://patch.msgid.link/20260409034347.17381-1-oliverjwhite07@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 956aa1ec975fcdcaec896d7698bdb78892bec1de Merge: 35f0f0a2536a4d 0c0dddc07d272a Author: Paolo Abeni Date: Tue May 19 13:51:08 2026 +0200 Merge tag 'ovpn-net-20260514' of https://github.com/OpenVPN/ovpn-net-next Antonio Quartulli says: ==================== Included fixes: * fix TCP selftest failures by reducing number of attempted pings * fix RCU ptr deref outside of RCU read section * fix UAF in case of TCP peer failed to be added to hashtable * fix race condition between iface teardown and new peer being added * ensure dstats are updated with BH disabled to avoid concurrency * tag 'ovpn-net-20260514' of https://github.com/OpenVPN/ovpn-net-next: ovpn: disable BHs when updating device stats ovpn: fix race between deleting interface and adding new peer ovpn: respect peer refcount in CMD_NEW_PEER error path ovpn: tcp - use cached peer pointer in ovpn_tcp_close() selftests: ovpn: reduce remaining ping flood counts ==================== Link: https://patch.msgid.link/20260514231544.795993-1-antonio@openvpn.net Signed-off-by: Paolo Abeni commit 35f0f0a2536a4d604b4dbad92c85c4a8fdebb870 Author: Erni Sri Satya Vennela Date: Thu May 14 12:41:51 2026 -0700 net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic. DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation. Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp(). Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Signed-off-by: Erni Sri Satya Vennela Link: https://patch.msgid.link/20260514194156.466823-1-ernis@linux.microsoft.com Signed-off-by: Paolo Abeni commit 023453cb7eb0f53c5dc36babed8e706c1b0b0187 Author: Wenwen Wang Date: Sat May 5 07:57:10 2018 -0500 i2c: smbus: fix a potential uninitialization bug In i2c_smbus_xfer_emulated(), there are two buffers: msgbuf0 and msgbuf1, which are used to save a series of messages, as mentioned in the comment. According to the value of the variable 'size', msgbuf0 is initialized to various values. In contrast, msgbuf1 is left uninitialized until the function i2c_transfer() is invoked. However, msgbuf1 is not always initialized on all possible execution paths (implementation) of i2c_transfer(). Thus, it is possible that msgbuf1 may still be uninitialized even after the invocation of the function i2c_transfer(), especially when the return value of i2c_transfer() is not checked properly. In the following execution, the uninitialized msgbuf1 will be used, such as for security checks. Since uninitialized values can be random and arbitrary, this will cause undefined behaviors or even check bypass. For example, it is expected that if the value of 'size' is I2C_SMBUS_BLOCK_PROC_CALL, the value of data->block[0] should not be larger than I2C_SMBUS_BLOCK_MAX. This patch initializes the first byte of msgbuf1 with 0 to avoid such undefined behaviors or security issues. Signed-off-by: Wenwen Wang [wsa: reworded commit message a little] Signed-off-by: Wolfram Sang commit 2d85ae5d0f39c715277bcf0b4e65d2eed39c34bb Merge: 2beba18b016044 4cb3cd670b2a29 Author: Paolo Abeni Date: Tue May 19 12:37:34 2026 +0200 Merge branch 'net-dsa-mt7530-assorted-fixes' Daniel Golle says: ==================== net: dsa: mt7530: assorted fixes A batch of small, independent fixes for the MediaTek MT7530 family DSA driver, addressing long-standing correctness issues that surface on hardware with bridge VLAN filtering enabled, on link-local frame reception, and during bridge join/leave transitions. ==================== Link: https://patch.msgid.link/cover.1778766629.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 4cb3cd670b2a29e52dd3cfd6463e44121674c9b8 Author: Edward Parker Date: Thu May 14 15:05:12 2026 +0100 net: dsa: mt7530: untag VLAN-aware bridge PVID With bridge VLAN filtering enabled on a port configured as untagged member of the bridge PVID, ingress untagged frames do not reach the corresponding bridge VLAN upper interface (br-lan.). ARP and similar traffic is visible on the physical port but not delivered to the VLAN sub-interface. The MT7530/MT7531 forwards frames to the CPU port with the user port's PVID tag applied even when the frame ingressed untagged on the wire, because the CPU port is set to MT7530_VLAN_EG_CONSISTENT and is a tagged member of the VLAN entry created for the bridge VLAN. The DSA core then sees a hwaccel-tagged frame whose VID matches the port's PVID, which the bridge does not treat as the untagged-on-the-wire frame that the user expects. Set ds->untag_vlan_aware_bridge_pvid in the mt7530 and mt7531 setup paths so the DSA core strips that hwaccel tag in software when the parsed VID matches the bridge port's PVID, restoring the on-the-wire frame as the bridge expects to see it. Link: https://github.com/openwrt/openwrt/issues/18576 Fixes: 83163f7dca56 ("net: dsa: mediatek: add VLAN support for MT7530") Signed-off-by: Edward Parker [daniel@makrotopia.org: improve commit message] Signed-off-by: Daniel Golle Link: https://patch.msgid.link/85d25ea1b26d3c907f815649f2e0bde6560282a3.1778766629.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 2c4c76cacc9d5553f4c3342eb332d7123a4c3f14 Author: Daniel Golle Date: Thu May 14 15:04:50 2026 +0100 net: dsa: mt7530: fix CPU port VLAN not being reset to unaware After a VLAN-aware bridge is destroyed, creating any VLAN-unaware bridge loses all connectivity. The VID 0 VLAN table entry used by VLAN-unaware ports in FALLBACK mode gets corrupted during VLAN-aware operation: mt7530_hw_vlan_add() overwrites its EG_CON flag with VTAG_EN and bridge teardown removes ports from its PORT_MEM. The cleanup code that should restore it never runs because the current port's dp->vlan_filtering flag is still true when checked (DSA updates it only after the driver callback returns). Even when restored, the deferred VLAN deletion events from the switchdev workqueue can corrupt VID 0 again after the restoration. Skip the current port in the all_user_ports_removed check, call mt7530_setup_vlan0() to restore the VID 0 entry, and protect VID 0 from being modified by bridge VLAN operations in port_vlan_add and port_vlan_del since it is managed exclusively by mt7530_setup_vlan0(). Remove the CPU port PCR and PVC register writes which were clobbering PORT_VLAN mode and VLAN_ATTR with wrong values. Fixes: 83163f7dca56 ("net: dsa: mediatek: add VLAN support for MT7530") Signed-off-by: Daniel Golle Link: https://patch.msgid.link/da8bdaf08b2427a9057e6cb33e26d41f8a8d5000.1778766629.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 3ac85bcfd404b588298c95c6fba8aad4ad334f57 Author: Daniel Golle Date: Thu May 14 15:04:35 2026 +0100 net: dsa: mt7530: preserve VLAN tags on trapped link-local frames The BPC, RGAC1 and RGAC2 registers control the handling of link-local frames with reserved MAC DAs (01:80:C2:00:00:0x). These frames are correctly trapped to the CPU port, but the egress VLAN tag attribute was set to MT7530_VLAN_EG_UNTAGGED which causes the switch to strip any VLAN tags from trapped frames before they reach the CPU. This causes VLAN-tagged link-local frames (STP BPDUs, LLDP, PTP Peer Delay Requests) to arrive at the CPU without their VLAN tag, so they are delivered to the base network interface instead of the VLAN sub-interface. The DSA local_termination selftest confirms this: all link-local protocol tests on VLAN upper interfaces fail. Set the EG_TAG attribute to MT7530_VLAN_EG_DISABLED (system default) so that the switch does not modify VLAN tags in trapped frames. This way VLAN-tagged frames retain their original tag and are delivered to the correct VLAN sub-interface, matching the behavior of non-trapped frames which pass through without VLAN tag modification. Fixes: 69ddba9d170b ("net: dsa: mt7530: fix handling of all link-local frames") Signed-off-by: Daniel Golle Acked-by: Chester A. Unal Link: https://patch.msgid.link/891e0cd34db2a5fe20ceb73283a81fb5f71427ca.1778766629.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit e824e40d0e841fab66ab7897d6c7b14dc81c66a7 Author: Daniel Golle Date: Thu May 14 15:04:21 2026 +0100 net: dsa: mt7530: fix FDB entries not aging out with short timeout The DSA forwarding selftests bridge_vlan_aware.sh and bridge_vlan_unaware.sh configure the bridge with ageing_time set to LOW_AGEING_TIME (1000 centiseconds, i.e. 10 seconds) and then run learning_test() in lib.sh, which expects a learned FDB entry to be removed after ageing_time + 10 seconds. On MT7530/MT7531 the entry persisted past the deadline and the "Found FDB record when should not" assertion failed. With msecs=10000, the algorithm in mt7530_set_ageing_time() finds AGE_CNT=0 and AGE_UNIT=9 as the first exact match (starting the search from tmp_age_count=0). The per-entry aging counter is initialized to AGE_CNT when a MAC address is learned, so with AGE_CNT=0 new entries start with a counter value of 0, which the hardware treats as "already aged" and never removes, effectively disabling aging. Fix this by starting the search from tmp_age_count=1 to ensure entries always have a non-zero initial aging counter. For a 10-second ageing time this yields AGE_CNT=1 and AGE_UNIT=4 instead: the timer ticks every 5 seconds and entries are removed after 2 ticks. Starting the search at AGE_CNT=1 raises the minimum representable ageing time from 1 to 2 seconds. Without bounds, a stale ageing_time of 1 second would now make the loop fall through without setting age_count and age_unit, leaving them uninitialized when written to the MT7530_AAC hardware register. Set ds->ageing_time_min and ds->ageing_time_max so the DSA core validates the range before the callback is invoked, and drop the now-redundant range check from mt7530_set_ageing_time(). Fixes: ea6d5c924e39 ("net: dsa: mt7530: support setting ageing time") Signed-off-by: Daniel Golle Link: https://patch.msgid.link/7788ded12dc07b1bce329ec35fa70f4b45f3f9b7.1778766629.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 202550713128da20d9381d6d2dc0f6b73839f434 Author: Viktor Jägersküpper Date: Fri May 15 23:58:45 2026 +0200 kbuild: pacman-pkg: make "rc" releases adhere to pacman versioning scheme The package versioning scheme does not enable smooth upgrades from "rc" releases to the corresponding stable releases (e.g. 7.0.0-rc7 -> 7.0.0) because pacman considers that a downgrade due to the underscore in pkgver (e.g. 7.0.0_rc7), see e.g. vercmp(8) for an explanation of the package version comparison used by pacman. Package versions which are derived from said releases (e.g. built from git revisions) are similarly affected. Fix this by modifying pkgver in order to remove the hyphen from kernel versions containing "-rcN", where N is a non-negative integer. Acked-by: Thomas Weißschuh Signed-off-by: Viktor Jägersküpper Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Link: https://patch.msgid.link/20260515215913.92481-1-viktor_jaegerskuepper@freenet.de Fixes: c8578539deba ("kbuild: add script and target to generate pacman package") Signed-off-by: Nicolas Schier commit 49f8fcde68898f5033082e8155cd344dd54ef232 Author: Hasan Basbunar Date: Tue May 5 18:11:02 2026 +0200 modpost: prevent stack buffer overflow in do_input_entry() and do_dmi_entry() Several functions in scripts/mod/file2alias.c build the module alias string by repeatedly appending into a fixed-size on-stack buffer: char alias[256] = {}; ... sprintf(alias + strlen(alias), "%X,*", i); This pattern is unbounded and silently corrupts the stack when the formatted output exceeds the destination size. Two functions in this file are realistically reachable with input that overflows their buffer: 1. do_input_entry() appends across nine bitmap classes (evbit/keybit/relbit/absbit/mscbit/ledbit/sndbit/ffbit/swbit). The keybit case alone scans bits from INPUT_DEVICE_ID_KEY_MIN_INTERESTING (0x71) to INPUT_DEVICE_ID_KEY_MAX (0x2ff), 655 iterations; if a MODULE_DEVICE_TABLE(input, ...) populates keybit[] densely, the emission reaches ~3132 bytes — overflowing the 256-byte buffer by about 12x. include/linux/mod_devicetable.h declares storage for the full bit range ("keybit[INPUT_DEVICE_ID_KEY_MAX / BITS_PER_LONG + 1]"), so the worst case is reachable per the ABI. 2. do_dmi_entry() emits one ":**" segment per matched DMI field, up to 4 matches per dmi_system_id. Each substr is sized as char[79] in struct dmi_strmatch (mod_devicetable.h:584), and dmi_ascii_filter() copies it verbatim into the alias buffer without bounds. Worst case: 4 × (1 + 3 + 1 + 79 + 1) = 336 bytes into alias[256], an 80-byte overflow. No driver in the current tree triggers either case — every in-tree INPUT_DEVICE_ID_MATCH_KEYBIT user populates keybit[] very sparsely (1-3 bits), and no in-tree dmi_system_id has four maximally-long matches. The concern is defense-in-depth: both unbounded sprintf chains are silent stack-corruption primitives in a host build tool, and the buffer sizes have not been revisited since the corresponding code was first introduced. The other do_*_entry() handlers in this file (do_usb_entry, do_cpu_entry, do_typec_entry, ...) were audited and are bounded by their input field sizes (uint16 IDs, fixed-length keys); their alias buffers do not need this treatment. Reproduced under AddressSanitizer with a stand-alone harness mirroring do_input on a fully-populated keybit: ==18319==ERROR: AddressSanitizer: stack-buffer-overflow WRITE of size 2 at offset 288 in frame [32, 288) 'alias' #6 do_input poc.c:44 Stack-canary build: Abort trap: 6 (strlen(alias)=3134, cap was 256-1) Add a small alias_append() helper around vsnprintf with a remaining- space check and call fatal() on overflow, matching the modpost style for unrecoverable build conditions. do_input() takes the buffer size as a new parameter; do_input_entry() and do_dmi_entry() pass sizeof(alias) at every call site. dmi_ascii_filter() takes the remaining buffer size as well and aborts on truncation. This bounds every write into the on-stack buffers and turns the latent overflow into a clean build error if it is ever reached. Fixes: 1d8f430c15b3 ("[PATCH] Input: add modalias support") Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Hasan Basbunar Link: https://patch.msgid.link/20260505161102.44087-1-basbunarhasan@gmail.com Signed-off-by: Nicolas Schier commit 288a81a8507052bcfbf884d39a463c44c42c5fd9 Author: Greg Kroah-Hartman Date: Wed May 13 17:52:55 2026 +0200 usb: typec: ucsi: validate connector number in ucsi_connector_change() The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsi_connector_change() uses it to index the ucsi->connector[] array without checking it against the number of connectors the PPM reported at init time, so a buggy or malicious PPM (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 / glink transports) can drive schedule_work() on memory past the end of the array. Reject connector numbers that are zero or exceed cap.num_connectors before dereferencing the array. Assisted-by: gkh_clanker_t1000 Cc: Heikki Krogerus Cc: Benson Leung Cc: Jameson Thies Cc: Nathan Rebello Cc: Johan Hovold Cc: Pooja Katiyar Cc: Hsin-Te Yuan Cc: Abel Vesa Cc: stable Reviewed-by: Abel Vesa Reviewed-by: Heikki Krogerus Reviewed-by: Benson Leung Link: https://patch.msgid.link/2026051351-truck-steadfast-df48@gregkh Signed-off-by: Greg Kroah-Hartman commit 167dd8d12226587ee554f520aed0256b7769cd5d Author: Greg Kroah-Hartman Date: Wed May 13 17:52:54 2026 +0200 usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO ucsi_displayport_vdm() handles a DP_CMD_CONFIGURE by copying the first payload VDO from data[], but unlike the equivalent handler in altmodes/displayport.c it does not check that count covers a VDO beyond the header. A header-only Configure VDM (count == 1) would read one u32 past the caller's array. In the normal UCSI path the caller controls count, so this is hardening for non-standard delivery paths. NAK and bail when no configuration VDO is present, matching the generic DP altmode driver's existing guard. Assisted-by: gkh_clanker_t1000 Cc: Pooja Katiyar Cc: Johan Hovold Cc: stable Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/2026051351-vividly-flattered-eb3d@gregkh Signed-off-by: Greg Kroah-Hartman commit 3389c149c68c3fea61910ad5d34f7bf3bff44e32 Author: Greg Kroah-Hartman Date: Wed May 13 17:52:53 2026 +0200 usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() svdm_consume_modes() checks pmdata->altmodes against the array size once before the loop over the count, but forgot to check the bound at every point in the loop. In the well-behaved SVDM discovery flow this is harmless because each of at most SVID_DISCOVERY_MAX SVIDs contributes at most MODE_DISCOVERY_MAX modes, exactly filling altmode_desc[ALTMODE_DISCOVERY_MAX]. But the CMDT_RSP_ACK handler in tcpm_pd_svdm() does not correlate an incoming ACK with any request the port actually sent. Once port->partner is set, an unsolicited Discover Modes ACK is consumed unconditionally. A broken or malicious port partner can therefore drive altmodes to ALTMODE_DISCOVERY_MAX - 1 via the normal flow, and then send one extra Discover Modes ACK with seven VDOs. Because the pre-loop check passes, the loop could then writes up to five entries past altmode_desc[]. For mode_data_prime the next field in struct tcpm_port is the partner_altmode[] pointer array, which then receives partner-chosen SVID/VDO bytes. Move the bound check inside the loop so the array can never be indexed past ALTMODE_DISCOVERY_MAX regardless of how many VDOs the partner supplies or how the function was reached. Assisted-by: gkh_clanker_t1000 Cc: Badhri Jagan Sridharan Cc: Heikki Krogerus Cc: stable Link: https://patch.msgid.link/2026051351-reshuffle-skillful-90af@gregkh Signed-off-by: Greg Kroah-Hartman commit 8fbc349e8383125dd2d8de1c1e926279d398ab17 Author: Greg Kroah-Hartman Date: Wed May 13 17:52:51 2026 +0200 usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdm_consume_identity() or svdm_consume_identity_sop_prime() as the device-controlled value could index off of the static arrays, which could leak data. Assisted-by: gkh_clanker_t1000 Cc: Heikki Krogerus Cc: stable Reviewed-by: Badhri Jagan Sridharan Link: https://patch.msgid.link/2026051350-plated-salute-0efe@gregkh Signed-off-by: Greg Kroah-Hartman commit aa2f716327be1818e1cb156da8a2844804aaec2f Author: Greg Kroah-Hartman Date: Wed May 13 17:52:50 2026 +0200 usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this, and rightfully reject the message, instead of reading from uninitialized stack memory. Assisted-by: gkh_clanker_t1000 Cc: Heikki Krogerus Cc: "André Draszik" Cc: Badhri Jagan Sridharan Cc: Amit Sunil Dhamne Cc: stable Link: https://patch.msgid.link/2026051350-sitter-canopener-9045@gregkh Signed-off-by: Greg Kroah-Hartman commit 8a18f896e667df491331371b55d4ad644dc51d60 Author: Greg Kroah-Hartman Date: Wed May 13 17:52:49 2026 +0200 usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and send it off elsewhere. Fix this up by correctly verifying the count for the update object. Assisted-by: gkh_clanker_t1000 Cc: stable Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/2026051350-reacquire-sculpture-4244@gregkh Signed-off-by: Greg Kroah-Hartman commit 4af7ad0e6d7aa4403dbb1dac7b9659b0421efcaa Author: Greg Kroah-Hartman Date: Wed May 13 17:52:48 2026 +0200 usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() wcove_read_rx_buffer() copies the PD RX FIFO into the caller's struct pd_message with for (i = 0; i < USBC_RXINFO_RXBYTES(info); i++) regmap_read(wcove->regmap, USBC_RX_DATA + i, msg + i); which has two problems: USBC_RXINFO_RXBYTES() is a 5-bit field (max 31) while struct pd_message is 30 bytes (__le16 header + __le32 payload[PD_MAX_PAYLOAD], packed). The byte count latched in RXINFO is the number of bytes the port partner put on the wire, so a malicious partner that transmits a 31-byte frame can drive the loop one byte past the destination if the WCOVE BMC receiver does not enforce the PD object-count limit in hardware. The existing FIXME flagged this as unverified. Independently, regmap_read() takes an unsigned int * and stores a full unsigned int at the destination. Passing the byte pointer msg + i means each iteration writes four bytes; the high three are zero (val_bits is 8) and are normally overwritten by the next iteration, but the final iteration's high bytes are not. With RXBYTES == 30 the i == 29 iteration already writes three zero bytes past msg, which sits on the IRQ thread's stack in wcove_typec_irq(). Clamp the loop to sizeof(struct pd_message) and read each register into a local before storing only its low byte, so the copy can never exceed the destination regardless of what RXINFO reports. Assisted-by: gkh_clanker_t1000 Cc: stable Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/2026051347-clustered-deflected-9543@gregkh Signed-off-by: Greg Kroah-Hartman commit 8320de248d79d60ff2b701bc4676a0b863025add Merge: af8c5aa7a9c6f5 928abe19fbf012 Author: Greg Kroah-Hartman Date: Tue May 19 12:23:10 2026 +0200 Merge tag 'thunderbolt-for-v7.1-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v7.1-rc5 This includes three patches that harden the XDomain property parser against possible malicious hosts. All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v7.1-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() commit ea17fc4d7dc2ba6459b1a318962960520201baf1 Author: Xiangxu Yin Date: Fri Feb 27 20:15:01 2026 +0800 phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swing_tbl and pre_emphasis_tbl are 4x4 arrays (valid indices 0-3), but the boundary check uses "> 4" instead of ">= 4", allowing index 4 to cause an out-of-bounds access. Reported-by: Dan Carpenter Fixes: 81791c45c8e0 ("phy: qcom: qmp-usbc: Add QCS615 USB/DP PHY config and DP mode support") Signed-off-by: Xiangxu Yin Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260227-master-v1-1-8d91b9407fdb@oss.qualcomm.com Signed-off-by: Vinod Koul commit d45d5c819f2cd0b6b5d76a194a537a5f4aeefecb Author: Osama Abdelkader Date: Thu Apr 30 21:56:59 2026 +0200 drm/bridge: megachips: remove bridge when irq request fails If devm_request_threaded_irq() fails after drm_bridge_add(), remove the bridge before returning. Keep drm_bridge_add() rather than devm_drm_bridge_add(): registration is tied to the STDP4028 device while ge_b850v3_register() may complete from either I2C probe; devm would not unwind the bridge if the other client's probe fails. Signed-off-by: Osama Abdelkader Fixes: fcfa0ddc18ed ("drm/bridge: Drivers for megachips-stdpxxxx-ge-b850v3-fw (LVDS-DP++)") Cc: stable@vger.kernel.org Reviewed-by: Luca Ceresoli Tested-by: Ian Ray Link: https://patch.msgid.link/20260430195700.80317-1-osama.abdelkader@gmail.com Signed-off-by: Luca Ceresoli commit f80d3d98d2ff78d9e2fe5d68b1f45948c4f7bd24 Author: Sven Eckelmann Date: Tue May 19 09:23:49 2026 +0200 batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Without rtnl_lock held, a hardif might be retrieved as primary interface of a meshif, but then (while operating on this interface) getting decoupled from the mesh interface. In this case, the meshif still exists but the pointer from the primary hardif to the meshif is set to NULL. The mesh_iface must be checked first to be non-NULL before continuing to send an ARP request using meshif. Cc: stable@kernel.org Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code") Reported-by: Ido Schimmel Reported-by: syzbot+9fdcc9f05a98a540b816@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9fdcc9f05a98a540b816 Signed-off-by: Sven Eckelmann commit 9785df3fd67083ac10f6bde83a316286044a66f1 Author: Jason Gunthorpe Date: Tue Apr 7 14:45:22 2026 +0800 iommu/vt-d: Simplify calculate_psi_aligned_address() This is doing far too much math for the simple task of finding a power of 2 that fully spans the given range. Use fls directly on the xor which computes the common binary prefix. Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/0-v2-895748900b39+5303-iommupt_inv_vtd_jgg@nvidia.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 73d01051e8040c0b1de7fd26b3b8d0c2ffa6895c Author: Osama Abdelkader Date: Thu Apr 30 21:49:42 2026 +0200 drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe Use devm_drm_bridge_add() so the bridge is released if probe fails after registration, and drop drm_bridge_remove() in chipone_i2c_probe. Signed-off-by: Osama Abdelkader Fixes: 8dde6f7452a1 ("drm: bridge: icn6211: Add I2C configuration support") Cc: stable@vger.kernel.org Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260430194944.78119-1-osama.abdelkader@gmail.com Signed-off-by: Luca Ceresoli commit 83ab69bd12b80f6ea169c8bea6977701b53a043d Author: Sven Eckelmann Date: Tue May 12 09:13:31 2026 +0200 batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests is increased when no request_sent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the request_sent is actually set to a specific state and the atomic_dec/_inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently. At the same time, it is necessary to modify request_sent (state) and bla.num_requests atomically. Otherwise batadv_bla_send_request() might set request_sent to 1 and is interrupted. batadv_handle_announce() can then set request_sent back to 0 and decrement num_requests before batadv_bla_send_request() incremented it. The two operations must therefore be locked. And since state (request_sent) and wait_periods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.num_requests is touched by a parallel running context with a valid backbone_gw reference after batadv_bla_purge_backbone_gw() ran, a third state "stopped" is required to correctly signal that a backbone_gw is in the state of being cleaned up. Cc: stable@kernel.org Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code") Signed-off-by: Sven Eckelmann commit 0459430add32ea41f3e2ef9351610e6d33627a6b Author: Sven Eckelmann Date: Sun May 10 11:43:20 2026 +0200 batman-adv: bla: fix report_work leak on backbone_gw purge batadv_bla_purge_backbone_gw() removes stale backbone gateway entries, but fails to properly handle their associated report_work: - If report_work is running, the purge must wait for it to finish before freeing the backbone_gw, otherwise the worker may access freed memory (e.g. bat_priv). - If report_work is pending, the purge must cancel it and release the reference held for that pending work item. The previous implementation called hlist_for_each_entry_safe() inside a spin_lock_bh() section, but cancel_work_sync() may sleep and therefore cannot be called from within a spinlock-protected region. Restructure the loop to handle one entry per spinlock critical section: acquire the lock, find the next entry to purge, remove it from the hash list, then release the lock before calling cancel_work_sync() and dropping the hash_entry reference. Repeat until no more entries require purging. Cc: stable@kernel.org Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code") Reviewed-by: Simon Wunderlich Signed-off-by: Sven Eckelmann commit aa3153bd139a6c48667dcd02608d3b2c80bff02c Author: Sven Eckelmann Date: Fri May 15 22:00:40 2026 +0200 batman-adv: iv: recover OGM scheduling after forward packet error When batadv_iv_ogm_schedule_buff() fails to allocate and queue a forward packet for OGM transmission, the work item that drives periodic OGM scheduling is never re-armed. This silently halts transmission of the node's own OGMs on the affected interface — only OGMs from other peers continue to be aggregated and forwarded. Fix this by tracking whether batadv_iv_ogm_queue_add() (and transitively batadv_iv_ogm_aggregate_new()) successfully scheduled a forward packet. When scheduling fails, batadv_iv_ogm_schedule_buff() falls back to queuing a dedicated recovery work item (reschedule_work) that fires after one originator interval and calls batadv_iv_ogm_schedule() again. Cc: stable@kernel.org Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Sven Eckelmann commit 4703049f768fc1c1caac754134118bee1a3af189 Author: Jouni Högander Date: Fri May 15 12:57:55 2026 +0300 drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used There is Intel specific workaround DPCD address containing workaround for case where SDP is on prior line. Apply this workaround according to values in the offset. Fixes: 61e887329e33 ("drm/i915/xelpd: Handle PSR2 SDP indication in the prior scanline") Cc: # v5.15+ Signed-off-by: Jouni Högander Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260515095756.2799483-4-jouni.hogander@intel.com (cherry picked from commit c3fe899fbeac86ea4a5ca9dd845b2cbc0da46249) Signed-off-by: Tvrtko Ursulin commit f30bece421a4ae34359254e1dc2a187a42b6af9b Author: Jouni Högander Date: Fri May 15 12:57:54 2026 +0300 drm/i915/psr: Read Intel DPCD workaround register Read Intel DPCD workaround register and store it into intel_connector->dp.psr_caps. psr_caps was chosen as currently it contains only PSR workaround for PSR2 SDP on prior scanline implementation. Signed-off-by: Jouni Högander Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260515095756.2799483-3-jouni.hogander@intel.com (cherry picked from commit c48ff24d0f4ab7ad696b2d35ad64ce7e049c668c) Signed-off-by: Tvrtko Ursulin commit fbceb39b536e40c2f7cc47ab42037bb7c2b7ced9 Author: Jouni Högander Date: Fri May 15 12:57:53 2026 +0300 drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register EDP specification says: "If either VSC SDP is unable to be transmitted 100 ns before the SU region, the Source device may optionally transmit the VSC SDP during the prior video scan line’s HBlank period There is a Intel specific drm dp register currently containing bits related how TCON can support PSR2 with SDP on prior line." Unfortunately many panels are having problems in implementing this. So there is a custom Intel specific DPCD register (INTEL_WA_REGISTER_CAPS) to figure out if this is properly implemented on a panel or if panel doesn't require that 100 ns delay before the SU region. Here are the definitions in this custom DPCD address: 0 = Panel doesn't support SDP on prior line 1 = Panel supports SDP on prior line 2 = Panel doesn't have 100ns requirement 3 = Reserved Add definitions for this new register and it's values into new header intel_dpcd.h. v2: add INTEL_DPCD_ prefix to definitions Bspec: 74741 Signed-off-by: Jouni Högander Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260515095756.2799483-2-jouni.hogander@intel.com (cherry picked from commit 1da1c9294825f08f622c473480d185680c2a3b75) Signed-off-by: Tvrtko Ursulin commit 62c4d31d78294bd61cf3403626b789e854357177 Author: Christian Brauner Date: Mon May 18 10:32:11 2026 +0200 pidfd: refuse access to tasks that have started exiting harder The recent ptrace fix closed a hole where someone could rely on task->mm becoming NULL during do_exit() to bypass dumpability checks. This api here leans on on the very same check and so inherits the fix. But there is no good reason to let it succeed at all once the target has entered do_exit(). PF_EXITING is set by exit_signals() at the very top of do_exit(), before exit_mm() and exit_files() run. Once we observe it, the task is committed to dying and exit_files() will release the fdtable shortly. Fixes: 8649c322f75c ("pid: Implement pidfd_getfd syscall") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260518-obgleich-petersilie-2d77ccccf9b9@brauner Signed-off-by: Christian Brauner (Amutable) commit f87abd0c6604fb6cc31cc86fc7ccc6a576924352 Author: Ankit Nautiyal Date: Mon May 11 18:02:15 2026 +0530 drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP Correct the bit-shift logic to properly readback the 10 bit target_rr from DB3 and DB4. v2: Align the style with readback for vtotal. (Ville) Fixes: 12ea89291603 ("drm/i915/dp: Add Read/Write support for Adaptive Sync SDP") Cc: Mitul Golani Cc: Ankit Nautiyal Signed-off-by: Ankit Nautiyal Reviewed-by: Ville Syrjälä Link: https://patch.msgid.link/20260511123218.1589830-2-ankit.k.nautiyal@intel.com (cherry picked from commit f7abc4af2b19240a145a221461dfe756cc01d74a) Signed-off-by: Tvrtko Ursulin commit 86ed2d96db1965e9008e919b1936145ae66540e3 Author: Chaitanya Kumar Borah Date: Mon May 11 11:02:10 2026 +0530 drm/i915/display: Copy color pipeline from plane in the primary joiner pipe When copying plane color state in a joiner configuration, use the plane in the primary joiner pipe since it carries the pipeline number selected by the user-space. This assumes that all pipes in the joiner are symmetric in their plane color capabilities. Cc: stable@vger.kernel.org # v6.19+ Fixes: a78f1b6baf4d ("drm/i915/color: Add framework to program CSC") Tested-by: Vidya Srinivas Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Signed-off-by: Ankit Nautiyal Link: https://patch.msgid.link/20260511053213.3122314-2-chaitanya.kumar.borah@intel.com (cherry picked from commit e8308fb5e05ca08ddfb8b46f6d947a6e3fd80cd7) Signed-off-by: Tvrtko Ursulin commit 20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc Author: Sven Eckelmann Date: Thu May 14 19:22:02 2026 +0200 batman-adv: mcast: fix use-after-free in orig_node RCU release batadv_mcast_purge_orig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU readers may still accesses references to those entries at the point of removal. RCU-protected readers trying to operate on entries like orig->mcast_want_all_ipv6_node will then access already freed memory. Fix this by moving batadv_mcast_purge_orig() to batadv_orig_node_release(), just before the call_rcu() invocation. This ensures RCU readers that were active at purge time have drained before the orig_node memory is reclaimed. Cc: stable@kernel.org Fixes: ab49886e3da7 ("batman-adv: Add IPv4 link-local/IPv6-ll-all-nodes multicast support") Acked-by: Linus Lüssing Signed-off-by: Sven Eckelmann commit ff24f2ecfd94c07a2b89bac497433e3b23271cac Author: Sven Eckelmann Date: Sat May 16 12:33:41 2026 +0200 batman-adv: tp_meter: avoid role confusion in tp_list Session lookups in tp_list matched only on destination address (and optionally session ID), leaving role validation to the caller. If two sessions with the same other_end coexisted (one as sender, one as receiver) a lookup could silently return the wrong one, causing the caller's role to bail out early, potentially skipping necessary cleanup. Move the role check into the lookup functions themselves so the correct entry is always returned, or none at all. Since batadv_tp_start() legitimately needs to detect any active session to a destination regardless of role, introduce a dedicated helper for that case rather than bending the existing lookup semantics. Cc: stable@kernel.org Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Signed-off-by: Sven Eckelmann commit 71dce47f0758537fff78fddb5fb0d4632d29b29f Author: Sven Eckelmann Date: Wed May 13 23:38:54 2026 +0200 batman-adv: tp_meter: fix race condition in send error reporting batadv_tp_sender_shutdown() previously used two separate variables to track session state: sending (an atomic flag indicating whether the session was active) and reason (a plain enum storing the stop reason). This introduced a race window between the two writes: after sending was cleared to 0, batadv_tp_send() could observe the stopped state and call batadv_tp_sender_end() before reason was written, causing the wrong stop reason to be reported to the caller. Fix this by consolidating both variables into a single atomic send_result, which holds 0 while the session is running and the stop reason once it ends. Cc: stable@kernel.org Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Signed-off-by: Sven Eckelmann commit f50487e3566358b2b982b7801945e858c78ad9ab Author: Sven Eckelmann Date: Sat May 9 21:55:29 2026 +0200 batman-adv: tvlv: reject oversized TVLV packets batadv_tvlv_container_ogm_append() builds a TVLV packet section from the tvlv.container_list. The total size of this section is computed by batadv_tvlv_container_list_size(), which sums the sizes of all registered containers. The return type and accumulator in batadv_tvlv_container_list_size() were u16. If the accumulated size exceeds U16_MAX, the value wraps around, causing the subsequent allocation in batadv_tvlv_container_ogm_append() to be undersized. The memcpy-style copy that follows would then write beyond the end of the allocated buffer, corrupting kernel memory. Fix this by widening the return type of batadv_tvlv_container_list_size() to size_t. In batadv_tvlv_container_ogm_append(), check the computed length against U16_MAX before proceeding, and bail out as if the allocation had failed when the limit is exceeded. Cc: stable@kernel.org Fixes: ef26157747d4 ("batman-adv: tvlv - basic infrastructure") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Reviewed-by: Yuan Tan Signed-off-by: Sven Eckelmann commit 501368506563e151b322c8c3f228b796e615b90d Author: Sven Eckelmann Date: Thu May 14 16:33:12 2026 +0200 batman-adv: tvlv: abort OGM send on tvlv append failure batadv_tvlv_container_ogm_append() could fail in two ways: a memory allocation failure when resizing the packet buffer, or the tvlv data exceeding U16_MAX bytes. In both cases the function previously returned the old (now stale) tvlv_value_len rather than signalling an error, causing the OGM/OGM2 send path to transmit a packet whose TVLV length field no longer matched the actual buffer contents. And because it also didn't fill in the new TVLV data, sending either uninitialized or corrupted data on the wire. All errors in batadv_tvlv_container_ogm_append() must be forwarded to the caller. And the caller must abort the send of the OGM2. For B.A.T.M.A.N. IV, it is currently not allowed to abort the send. The non-TVLV part of the OGM must be queued up instead. Cc: stable@kernel.org Fixes: ef26157747d4 ("batman-adv: tvlv - basic infrastructure") Signed-off-by: Sven Eckelmann commit f8ce8b8331a1bc44ad4905886a482214d428b253 Author: Sven Eckelmann Date: Sat May 9 22:44:12 2026 +0200 batman-adv: v: stop OGMv2 on disabled interface When a batadv_hard_iface is disabled, its mesh_iface pointer is set to NULL. However, batadv_v_ogm_send_meshif() may still dispatch OGMs via batadv_v_ogm_queue_on_if() for interfaces that have since lost their mesh_iface association. This results in a NULL pointer dereference when batadv_v_ogm_queue_on_if() unconditionally calls netdev_priv() on the now NULL hard_iface->mesh_iface to retrieve the batadv_priv. It is necessary to ensure that the batadv_v_ogm_queue_on_if() checks that it is using the same mesh_iface for which batadv_v_ogm_send_meshif() was called. Cc: stable@kernel.org Fixes: 0da0035942d4 ("batman-adv: OGMv2 - add basic infrastructure") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Reviewed-by: Yuan Tan Signed-off-by: Sven Eckelmann commit b59d5c51bb328a60749b4dd5fe7e649bfb4089b4 Author: Cássio Gabriel Date: Tue May 19 00:32:15 2026 -0300 ALSA: ua101: Reject too-short USB descriptors find_format_descriptor() walks the class-specific interface extras by advancing with bLength. It rejects descriptors that extend past the remaining buffer, but it does not reject descriptor lengths smaller than a USB descriptor header. Reject too-short descriptors before using bLength to advance the local scan. This keeps the UA-101 parser robust against malformed descriptor data and matches the usual USB descriptor walking rules. Fixes: 63978ab3e3e9 ("sound: add Edirol UA-101 support") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260519-alsa-ua101-desc-len-v1-1-4307d1a5e054@gmail.com Signed-off-by: Takashi Iwai commit 9e5fb6098d21e1f9be9982b46c3e5b8329d4e7d2 Author: Zhang Heng Date: Tue May 19 09:55:35 2026 +0800 ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X The ALC245 sound card on this machine requires the quirk `ALC245_FIXUP_HP_ENVY_X360_15_FH0XXX` to fix the mic and mute LED. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221509 Cc: Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260519015535.891156-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 92b62b7416af11fcfaab7373b15a32a471500bab Author: Maoyi Xie Date: Tue May 19 03:40:23 2026 +0800 ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() snd_seq_create_port() walks client->ports_list_head looking for the ordered insertion point and on loop fall-through passes &p->list to list_add_tail(): list_for_each_entry(p, &client->ports_list_head, list) { if (p->addr.port == port) { kfree(new_port); return -EBUSY; } if (p->addr.port > num) break; ... } list_add_tail(&new_port->list, &p->list); When the loop walks all entries without break (e.g., the new port sorts last), p is past-the-end. &p->list aliases &client->ports_list_head (the list head) via container_of offset cancellation, so the insert lands at the list tail. That is the intended behaviour, but the access is undefined per C11 even though it works in practice. Track an explicit insert_before pointer initialised to the list head and overwritten to &p->list only when the loop breaks early. The observable behaviour is unchanged. Fixes: 9244b2c3079f ("[ALSA] alsa core: convert to list_for_each_entry*") Signed-off-by: Maoyi Xie Link: https://patch.msgid.link/20260518194023.1667857-3-maoyixie.tju@gmail.com Signed-off-by: Takashi Iwai commit 34ed2395613b23f8645e320abdcab6d688dc7a80 Author: Maoyi Xie Date: Tue May 19 03:40:22 2026 +0800 ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() snd_timer_dev_register() walks snd_timer_list looking for the ordered insertion point and on loop fall-through passes &timer1->device_list to list_add_tail(): list_for_each_entry(timer1, &snd_timer_list, device_list) { ... break; /* on found-position */ ... } list_add_tail(&timer->device_list, &timer1->device_list); When the loop walks all entries without break, timer1 is past-the-end. &timer1->device_list aliases &snd_timer_list (the list head) via container_of offset cancellation, so the insert lands at the list tail. That is the intended behaviour, but the access is undefined per C11 even though it works in practice. Track an explicit insert_before pointer initialised to the list head and overwritten to &timer1->device_list only when the loop breaks early. The observable behaviour is unchanged. Fixes: 9244b2c3079f ("[ALSA] alsa core: convert to list_for_each_entry*") Signed-off-by: Maoyi Xie Link: https://patch.msgid.link/20260518194023.1667857-2-maoyixie.tju@gmail.com Signed-off-by: Takashi Iwai commit 2beba18b0160446463bf1dbd749324846db98493 Merge: 317bbe5301902f e935c37b8a94bb Author: Jakub Kicinski Date: Mon May 18 19:01:37 2026 -0700 Merge branch 'intel-wired-lan-driver-updates-2026-05-15-ice-ixgbevf-igc-e1000e' Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-05-15 (ice, ixgbevf, igc, e1000e) For ice: Jake fixes a mismatch in locking around wait queue usage. Jose Ignacio Tornos Martinez adjusts allowed lower bound for VF data buffer size to accommodate low MTU sizes. Marcin adjusts for -EEXIST to not trigger error path when the promisc filter already exists as part of adding VLAN Ids. Grzegorz fixes a few issues related to PTP. He adds locking to ice_start_phy_timer_eth56g() to protect proper register programming. Fixes the PTP lock used in 2xNAC configuration to always be the primary and restores PTP configuration on ethtool channel changes. For ixgbevf: Michael Bommarito sets freed skb pointer to NULL to prevent use-after-free. For igc: Kohei Enju resolves a couple of issues reported by Sashiko; setting buffer type for an SMD skb and freeing skb on error of igc_fpe_init_tx_descriptor(). ==================== Link: https://patch.msgid.link/20260515182419.1597859-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit e935c37b8a94bb256fada6395a5d05e1c0c6bdaf Author: Kohei Enju Date: Fri May 15 11:24:16 2026 -0700 igc: fix potential skb leak in igc_fpe_xmit_smd_frame() When igc_fpe_init_tx_descriptor() fails, no one takes care of an allocated skb, leaking it. [1] Use dev_kfree_skb_any() on failure. Tested on an I226 adapter with the following command, while injecting faults in igc_fpe_init_tx_descriptor() to trigger the error path. # ethtool --set-mm $DEV verify-enabled on tx-enabled on pmac-enabled on [1] unreferenced object 0xffff888113c6cdc0 (size 224): ... backtrace (crc be3d3fda): kmem_cache_alloc_node_noprof+0x3b1/0x410 __alloc_skb+0xde/0x830 igc_fpe_xmit_smd_frame.isra.0+0xad/0x1b0 igc_fpe_send_mpacket+0x37/0x90 ethtool_mmsv_verify_timer+0x15e/0x300 Cc: stable@vger.kernel.org Fixes: 5422570c0010 ("igc: add support for frame preemption verification") Signed-off-by: Kohei Enju Reviewed-by: Simon Horman Reviewed-by: Faizal Rahim Tested-by: Avigail Dahan Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260515182419.1597859-10-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 5acc641e590e008caaed480ed9ffae47cf7ecbdf Author: Kohei Enju Date: Fri May 15 11:24:15 2026 -0700 igc: set tx buffer type for SMD frames Sashiko pointed out that igc_fpe_init_smd_frame() initializes igc_tx_buffer fields for an SMD skb, but does not set the buffer type: https://sashiko.dev/#/patchset/20260415025226.114115-1-kohei%40enjuk.jp Since igc_tx_buffer entries are reused, a stale XDP or XSK type can remain and make TX completion use the wrong cleanup path. Set the buffer type to IGC_TX_BUFFER_TYPE_SKB. Fixes: 5422570c0010 ("igc: add support for frame preemption verification") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Avigail Dahan Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260515182419.1597859-9-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 5d49b568c188dc77199d8d2b959c91da8cc27cf1 Author: Michael Bommarito Date: Fri May 15 11:24:14 2026 -0700 ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here. I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90) QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible. Fixes: bad17234ba70 ("ixgbevf: Change receive model to use double buffered page based receives") Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260515182419.1597859-8-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 975b564d195b13ca6ee1ef5e6a9561734898eb17 Author: Grzegorz Nitka Date: Fri May 15 11:24:13 2026 -0700 ice: restore PTP Rx timestamp config after ethtool set-channels When ethtool -L changes queue counts, ice_vsi_recfg_qs() closes and rebuilds the VSI, reallocating Rx rings. The newly allocated rings have ptp_rx cleared, so RX hardware timestamps are no longer attached to skb until hwtstamp configuration is applied again. Restore timestamp mode after ice_vsi_open() in the queue reconfiguration path, matching reset/rebuild behavior and ensuring newly rebuilt Rx rings have PTP RX timestamping re-enabled. Testing hints: - run ptp4l application in client synchronization mode: ptp4l -i ethX -m -s - run PTP traffic - change queue number on ethX netdev interface: ethtool -L ethX combined new_queue_size - observe ptp4l output - expected result: no "received DELAY_REQ without timestamp" messages Fixes: 77a781155a65 ("ice: enable receive hardware timestamping") Cc: stable@vger.kernel.org Reviewed-by: Aleksandr Loktionov Signed-off-by: Grzegorz Nitka Reviewed-by: Simon Horman Tested-by: Alexander Nowlin Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260515182419.1597859-7-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 7b28523546c7e4adbb8436f2986efcfc8382985e Author: Grzegorz Nitka Date: Fri May 15 11:24:12 2026 -0700 ice: ptp: use primary NAC semaphore on E825 For E825 2xNAC configurations, PTP semaphore operations must hit the primary NAC register block so both sides coordinate on the same lock. Commit e2193f9f9ec9 ("ice: enable timesync operation on 2xNAC E825 devices") updated other primary-only PTP register accesses to use the primary NAC on non-primary functions, but left ice_ptp_lock() and ice_ptp_unlock() operating on the local NAC. As a result, secondary NAC PTP paths can take a different semaphore than the primary side. Select the primary hardware in ice_ptp_lock() and ice_ptp_unlock() when the current function is not primary, keeping semaphore operations symmetric and consistent with the rest of the 2xNAC PTP register access path. Fixes: e2193f9f9ec9 ("ice: enable timesync operation on 2xNAC E825 devices") Reviewed-by: Arkadiusz Kubalewski Signed-off-by: Grzegorz Nitka Reviewed-by: Aleksandr Loktionov Tested-by: Alexander Nowlin Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260515182419.1597859-6-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 781ff8f2d575a794a2a4f11605288ae06757f5eb Author: Grzegorz Nitka Date: Fri May 15 11:24:11 2026 -0700 ice: ptp: serialize E825 PHY timer start with PTP lock ice_start_phy_timer_eth56g() programs TIMETUS registers and issues INIT_INCVAL without holding the global PTP semaphore. This allows concurrent PTP command paths to interleave with PHY timer start, which can make the sequence fail and leave timer initialization inconsistent. Take the PTP lock around TIMETUS registers programming and INIT_INCVAL command execution, and make sure the lock is released on all error paths. Keep the subsequent sync step outside of this critical section, since ice_sync_phy_timer_eth56g() takes the same semaphore internally. Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") Reviewed-by: Arkadiusz Kubalewski Signed-off-by: Grzegorz Nitka Reviewed-by: Aleksandr Loktionov Tested-by: Alexander Nowlin Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260515182419.1597859-5-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit ebc8de716c9ec2be384abdc2dd866da26c6580d1 Author: Marcin Szycik Date: Fri May 15 11:24:10 2026 -0700 ice: fix setting promisc mode while adding VID filter There are at least two paths through which VSI promiscuous mode can be independently configured via ice_fltr_set_vsi_promisc(): - ice_vlan_rx_add_vid() (netdev op) - ice_service_task() -> ... -> ice_set_promisc() Both paths may try to program promiscuous mode concurrently. One such scenario is: 1. Add ice netdev to bond 2. Add the bond netdev to bridge 3. ice netdev enters allmulticast mode (IFF_ALLMULTI) 4. Service task programs promisc mode filter 5. Bridge -> bond calls ice_vlan_rx_add_vid() Crucially, ice_vlan_rx_add_vid() fails if ice_fltr_set_vsi_promisc() returns any error, including -EEXIST. This causes VLAN filtering setup to fail on the bond interface. ice_set_promisc() already handles -EEXIST correctly. Fix by adding the same -EEXIST check to ice_vlan_rx_add_vid(): if the promisc filter is already programmed, continue without returning error. Fixes: 1273f89578f2 ("ice: Fix broken IFF_ALLMULTI handling") Cc: stable@vger.kernel.org Signed-off-by: Marcin Szycik Signed-off-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260515182419.1597859-4-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 3ba4dd024d26372733d1c02e13e076c6016e3320 Author: Jose Ignacio Tornos Martinez Date: Fri May 15 11:24:09 2026 -0700 ice: fix VF queue configuration with low MTU values The ice driver's VF queue configuration validation rejects databuffer_size values below 1024 bytes, which prevents VFs from using MTU values below 871 bytes. The iavf driver calculates databuffer_size based on the MTU using: databuffer_size = ALIGN(MTU + LIBETH_RX_LL_LEN, 128) where LIBETH_RX_LL_LEN = 26 (ETH_HLEN + 2*VLAN_HLEN + ETH_FCS_LEN). For MTU values below 871: MTU 870: 870 + 26 = 896, aligned to 128 = 896 (< 1024, rejected) MTU 871: 871 + 26 = 897, aligned to 128 = 1024 (>= 1024, accepted) The 1024-byte minimum seems unnecessarily restrictive, because the hardware supports databuffer_size as low as 128 bytes (the alignment boundary), which should allow MTU values down to the standard minimum of 68 bytes. I haven't found the reason why the limit was configured in the commit 9c7dd7566d18 ("ice: add validation in OP_CONFIG_VSI_QUEUES VF message"), so with no more information and since it is working, change the minimum databuffer_size validation from 1024 to 128 bytes to allow standard low MTU values while still preventing invalid configurations. Fixes: 9c7dd7566d18 ("ice: add validation in OP_CONFIG_VSI_QUEUES VF message") cc: stable@vger.kernel.org Signed-off-by: Jose Ignacio Tornos Martinez Reviewed-by: Jacob Keller Reviewed-by: Michal Swiatkowski Reviewed-by: Paul Menzel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260515182419.1597859-3-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 89bbff099bfc94888eb942d5b981592bbbe0c856 Author: Jacob Keller Date: Fri May 15 11:24:08 2026 -0700 ice: fix locking around wait_event_interruptible_locked_irq Commit 50327223a8bb ("ice: add lock to protect low latency interface") introduced a wait queue used to protect the low latency timer interface. The queue is used with the wait_event_interruptible_locked_irq macro, which unlocks the wait queue lock while sleeping. The irq variant uses spin_lock_irq and spin_unlock_irq to manage this. The wait queue lock was previously locked using spin_lock_irqsave. This difference in lock variants could lead to issues, since wait_event would unlock the wait queue and restore interrupts while sleeping. The ice_read_phy_tstamp_ll_e810() function is ultimately called through ice_read_phy_tstamp, which is called from ice_ptp_process_tx_tstamp or ice_ptp_clear_unexpected_tx_ready. The former is called through the miscellaneous IRQ thread function, while the latter is called from the service task work queue thread. Neither of these functions has interrupts disabled, so use spin_lock_irq instead of spin_lock_irqsave. Fixes: 50327223a8bb ("ice: add lock to protect low latency interface") Cc: stable@vger.kernel.org Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20250109181823.77f44c69@kernel.org/ Signed-off-by: Jacob Keller Signed-off-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20260515182419.1597859-2-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit ab5fce87a778cb780a05984a2ca448f2b41aafbf Merge: 8cf8b5ae8e0931 9a424b62f771a7 Author: Linus Torvalds Date: Mon May 18 17:55:42 2026 -0700 Merge tag 'perf-tools-fixes-for-v7.1-2026-05-18' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf-tools fixes "An usual sync-up for the header files and related code: - copy headers that are used for perf trace syscall beautifier - update the beautifier scripts according to the changes - don't show differences in the headers by default" * tag 'perf-tools-fixes-for-v7.1-2026-05-18' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf trace: Update beautifier script for clone flags perf trace: Add beautifier script for fsmount flags perf build: Add make check-headers target perf trace: Sync uapi/linux/sched.h with the kernel source perf trace: Sync uapi/linux/mount.h with the kernel source perf trace: Sync uapi/linux/fs.h with the kernel source perf trace: Sync linux/socket.h with the kernel source commit 8cf8b5ae8e093132b0dce0a932af10c9ef077936 Author: David Howells Date: Mon May 18 22:13:09 2026 +0100 cifs: Fix undefined variables Fix a couple of undefined variables introduced by the patch to fix tearing on ->remote_i_size and ->zero_point. For some reason, make W=1 with gcc doesn't give undefined variable warnings (but clang does). Fixes: 2c8f4742bb76 ("netfs: Fix potential for tearing in ->remote_i_size and ->zero_point") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605031459.eX5UbO3K-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202605021450.ca5QGqLH-lkp@intel.com/ cc: Steve French cc: Paulo Alcantara cc: Matthew Wilcox cc: Christian Brauner cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Linus Torvalds commit 317bbe5301902fc2ea0cd468bbaf668f9a0215b3 Merge: aeff7e8e502d00 e196115ec330a1 Author: Jakub Kicinski Date: Mon May 18 16:59:29 2026 -0700 Merge tag 'nf-26-05-16' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter/IPVS fixes for net: 1) Fix small race windows in nf_ct_helper_log() when accessing helper, from Florian Westphal. 2) Fix potential infinite loop and race conditions in IPVS caused by frequent user-triggered service table changes, from Julia Anastasov. 3) Fix a race condition when dumping ipsets for restore, from Jozsef Kadlecsik. 4) Fix inner transport offset in IPv6 in nft_inner when extension headers come before the layer 4 transport header, from Yizhou Zhao. 5) Fix incorrect iteration over IPv4 ranges in several hash set types, from Nan Li. 6) Fix incorrect order when restoring BH in nft_inner_restore_tun_ctx(), from Florian Westphal. 7) Validate option array from ip6t_hbh checkpath() to fix an off-by-one access, from Zhengchuan Liang. 8) Fix race condition between ipset list -terse and concurrent updates, from Jozsef Kadlecisk. 9) Fix race condition when inserting elements into a hash bucket, also from Jozsef. 10) Annotate access to first free slot in hashtable, from Jozsef Kadlecsik. 11) Ensure sufficient headroom in br_netfilter neigh transmission, from Lorenzo Bianconi. 12) Hold reference on skb->dev in nfqueue exit path, bridge local input is speciall since skb->dev != state->indev, allowing for net_device to go away while packet is sitting in nfqueue. From Haoze Xie. * tag 'nf-26-05-16' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_queue: hold bridge skb->dev while queued netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() netfilter: ipset: annotate "pos" for concurrent readers/writers netfilter: ipset: Fix data race between add and dump in all hash types netfilter: ipset: Fix data race between add and list header in all hash types netfilter: ip6t_hbh: reject oversized option lists netfilter: nft_inner: release local_lock before re-enabling softirqs netfilter: ipset: stop hash:* range iteration at end netfilter: nft_inner: Fix IPv6 inner_thoff desync netfilter: ipset: fix a potential dump-destroy race ipvs: avoid possible loop in ip_vs_dst_event on resizing netfilter: nf_conntrack_helper: fix possible null deref during error log ==================== Link: https://patch.msgid.link/20260516115627.967773-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit aeff7e8e502d00392795f2ea5eed57f768e66814 Merge: 23f3b04f157cf5 d5487249a81ea6 Author: Jakub Kicinski Date: Mon May 18 16:50:03 2026 -0700 Merge tag 'batadv-net-pullrequest-20260515' of https://git.open-mesh.org/batadv Simon Wunderlich says: ==================== Here are various batman-adv bugfixes: - fix tp_meter counter underflow during shutdown, by Luxiao Xu - fix tp_meter tp_vars reference leak in receiver shutdown, by Sven Eckelmann - fix various translation table integer handling issues, by Sven Eckelmann (3 patches) - fix various translation table counter issues, by Sven Eckelmann (3 patches) - fix fragment reassembly length accounting, by Ruide Cao - clear current gateway during teardown, by Ruijie Li - handle forward allocation error in DAT, by Sven Eckelmann - tp_meter: avoid use of uninitialized sender variables in tp_meter, by Sven Eckelmann - disallow unicast fragment in fragment, by Sven Eckelmann - directly shut down tp_meter timer on cleanup, by Sven Eckelmann * tag 'batadv-net-pullrequest-20260515' of https://git.open-mesh.org/batadv: batman-adv: tp_meter: directly shut down timer on cleanup batman-adv: frag: disallow unicast fragment in fragment batman-adv: tp_meter: avoid use of uninit sender vars batman-adv: dat: handle forward allocation error batman-adv: clear current gateway during teardown batman-adv: fix fragment reassembly length accounting batman-adv: tt: prevent TVLV entry number overflow batman-adv: tt: avoid empty VLAN responses batman-adv: tt: fix TOCTOU race for reported vlans batman-adv: tt: fix negative last_changeset_len batman-adv: tt: fix negative tt_buff_len batman-adv: tt: reject oversized local TVLV buffers batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown batman-adv: fix tp_meter counter underflow during shutdown ==================== Link: https://patch.msgid.link/20260515095540.325586-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit 23f3b04f157cf58d76ea56e3be29b04778352fb5 Merge: bae3ee802c21e8 375ba748413266 Author: Jakub Kicinski Date: Mon May 18 16:40:04 2026 -0700 Merge tag 'for-net-2026-05-14' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - af_bluetooth: serialize accept_q access - L2CAP: ecred_reconfigure: send packed pdu, not stack pointer - btmtk: accept too short WMT FUNC_CTRL events - hci_qca: Convert timeout from jiffies to ms * tag 'for-net-2026-05-14' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_qca: Convert timeout from jiffies to ms Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer Bluetooth: btmtk: accept too short WMT FUNC_CTRL events Bluetooth: serialize accept_q access ==================== Link: https://patch.msgid.link/20260514172340.1515042-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit bae3ee802c21e83ad1eb805519e6f32ea528b4d2 Author: Ilya Maximets Date: Thu May 14 20:46:31 2026 +0200 openvswitch: vport: fix race between linking and the device notifier Sashiko reports that it is technically possible that we got the device reference, but by the time we're linking it to the OVS datapath, it may be already in the process of being deleted. In this case if the notifier wins the race for RTNL, it will see that the device is not yet in the OVS datapath (ovs_netdev_get_vport() will fail in the dp_device_event()) and will do nothing. Then the ovs_netdev_link() will take the RTNL and link the unregistering device to OVS datapath. Eventually, netdev_wait_allrefs_any() will re-broadcast the event and the device will be properly detached, but it will take at least a second before that happens, so it's not something we should rely on. Let's avoid linking the non-registered device in the first place. Note: As per documentation, RTNL doesn't protect the reg_state, but it actually does for all the state transitions we care about here, so it should not be necessary to use READ_ONCE or taking the instance lock. We can still do that, but we have a few more places even in this file where the reg_state is accessed without those while under RTNL, and many more places like this across the kernel code, so it might make more sense to change all of them in a more centralized fashion in the future, if necessary. Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.") Signed-off-by: Ilya Maximets Reviewed-by: Aaron Conole Acked-by: Eelco Chaudron Link: https://patch.msgid.link/20260514184702.2461435-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit d00c953a8f69921f484b629801766da68f27f658 Author: Weiming Shi Date: Thu May 14 05:25:12 2026 -0700 net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() removes the endpoint from the hash table with hlist_del_init_rcu() and then immediately frees it with kfree(). However, RCU readers on the receive path (rmnet_rx_handler -> __rmnet_map_ingress_handler) may still hold a reference to the endpoint and dereference ep->egress_dev after the memory has been freed. The endpoint is a kmalloc-32 object, and the stale read at offset 8 corresponds to the egress_dev pointer. BUG: unable to handle page fault for address: ffffffffde942eef Oops: 0002 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27) Call Trace: __rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101) rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6096) __netif_receive_skb_one_core (net/core/dev.c:6208) netif_receive_skb (net/core/dev.c:6467) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2003) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) Add an rcu_head field to struct rmnet_endpoint and replace kfree() with kfree_rcu() so the endpoint memory remains valid through the RCU grace period. Also remove the rmnet_vnd_dellink() call and inline only the nr_rmnet_devs decrement, since rmnet_vnd_dellink() would set ep->egress_dev to NULL during the grace period, creating a data race with lockless readers. Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Link: https://patch.msgid.link/20260514122511.3083479-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit 9e7f36ab5b7bf68463faa5f7b926fea8f35597bb Author: Weiming Shi Date: Thu May 14 05:38:08 2026 -0700 net: appletalk: fix NULL pointer dereference in aarp_send_ddp() aarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured (dev->atalk_ptr == NULL), this leads to a NULL pointer dereference at the at->s_net access. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2)) Call Trace: atalk_sendmsg (net/appletalk/ddp.c:1715) __sys_sendto (net/socket.c:2265 (discriminator 1)) __x64_sys_sendto (net/socket.c:2272) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Add a NULL check consistent with the other callers of atalk_find_dev_addr(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Link: https://patch.msgid.link/20260514123806.3085961-3-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit c326f9c68921e2f14dfcecb2f6b4216313d50248 Author: Dragos Tatulea Date: Wed May 13 09:46:13 2026 +0300 net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when the affinity changes and there's still XSK work to be done, we trigger an ICOSQ interrupt on the new CPU. However, this triggering on the ICOSQ is done unprotected. There are 2 such races: A) mlx5e_trigger_irq() is called while mlx5e_xsk_alloc_rx_mpwqe() is running from a different CPU due to affinity change. This can happen because IRQ triggering is done after napi_complete_done(). At this point the NAPI can be scheduled on a different CPU. Like this: CPU A (old affinity, NAPI tail) CPU B (new affinity, fresh NAPI) ------------------------------- -------------------------------- napi_complete_done() clears SCHED mlx5e_cq_arm(...) napi_schedule_prep() sets SCHED mlx5e_napi_poll() mlx5e_xsk_alloc_rx_mpwqe() mlx5e_icosq_sync_lock() // noop memcpy 640 B UMR body advance sq->pc by 10 mlx5e_trigger_irq(&c->icosq) wqe_info[pi] = {NOP, 1} mlx5e_post_nop() advances sq->pc B) mlx5e_trigger_irq() is called on the ICOSQ when mlx5e_trigger_napi_icosq() is running. The obvious fix would be to lock the ICOSQ. But ICOSQ has an optimized locking scheme that doesn't work for this scenario. Kick the async ICOSQ instead which is always locked. This issue was noticed in the wild with the following splat: netdevice: ge-0-0-1: Bad OP in ICOSQ CQE: 0xd WARNING: drivers/net/ethernet/mellanox/mlx5/core/en_rx.c:826 [...] [...] Call Trace: mlx5e_napi_poll+0x11d/0x7f0 [mlx5_core] __napi_poll+0x30/0x200 ? skb_defer_free_flush+0x9c/0xc0 net_rx_action+0x2fe/0x3f0 handle_softirqs+0xd8/0x340 __irq_exit_rcu+0xbc/0xe0 common_interrupt+0x85/0xa0 asm_common_interrupt+0x26/0x40 [...] ---[ end trace 0000000000000000 ]--- mlx5_core 0000:08:00.0 ge-0-0-1: Error cqe on cqn 0x548, ci 0x2022, qn 0x8f4, opcode 0xd, syndrome 0x2, vendor syndrome 0x68 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000030: 00 00 00 00 01 00 68 02 01 00 08 f4 de 14 59 d2 WQE DUMP: WQ size 16384 WQ cur size 0, WQE index 0x1e14, len: 64 00000000: 00 00 00 01 d9 ed 80 02 00 00 00 01 d9 ed 90 02 00000010: 00 00 00 01 d9 ed a0 02 00 00 00 01 d9 ed b0 02 00000020: 00 00 00 01 d9 ed c0 02 00 00 00 01 d9 ed d0 02 00000030: 00 00 00 01 d9 ed e0 02 00 00 00 01 d9 ed f0 02 mlx5_core 0000:08:00.0 ge-0-0-1: Error cqe on cqn 0x548, ci 0x2023, qn 0x8f4, opcode 0xd, syndrome 0x5, vendor syndrome 0xf9 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000030: 00 00 00 00 01 00 f9 05 01 00 08 f4 de 15 cf d2 Fixes: db05815b36cb ("net/mlx5e: Add XSK zero-copy support") Reported-by: Paul Saab Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260513064613.334602-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 6eb6e5acafa46854d4363e6c34981289995f3ace Author: Maíra Canal Date: Fri May 15 12:07:15 2026 -0300 drm/v3d: Release indirect CSD GEM reference on CPU job free v3d_get_cpu_indirect_csd_params() takes a reference to the indirect BO via drm_gem_object_lookup() and stashes it in cpu_job->indirect_csd.indirect, but nothing on the CPU job teardown path ever drops that reference. Drop the extra reference in v3d_cpu_job_free(). The NULL check covers ioctl errors before the lookup ran and CPU job types other than V3D_CPU_JOB_TYPE_INDIRECT_CSD, which leave the field zero-initialised. Cc: stable@vger.kernel.org Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job") Assisted-by: Claude:claude-opus-4.7 Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260515-v3d-cpu-job-leaks-v1-2-7f147cbbf935@igalia.com Signed-off-by: Maíra Canal commit b0fe80c0b9250b35e2211bf3117e7aca814a21b0 Author: Maíra Canal Date: Fri May 15 12:07:14 2026 -0300 drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. Reading cpu_job at that point is a use-after-free. Also, on the early v3d_job_init() failure path, it is a NULL dereference, since v3d_job_deallocate() zeroes the local pointer. In the success path, the arrays are released from the scheduler's .free_job callback, but on the error path, they are freed manually, as the job was never pushed to the scheduler. While the success path deals with this correctly, the fail path doesn't. On top of that, the manual kvfree() calls only free the array storage; they don't drm_syncobj_put() the per-query syncobjs that v3d_timestamp_query_info_free() and v3d_performance_query_info_free() release on the success path. So the same fail path that triggers the use-after-free also leaks one syncobj reference per query. Unify the CPU job teardown into the CPU job's kref destructor, mirroring v3d_render_job_free(). The scheduler's .free_job slot reverts to the generic v3d_sched_job_free() and the fail label drops the manual kvfree() calls, leaving a single teardown path that is reached from both the scheduler and the ioctl error path. That removes the use-after-free, the NULL dereference, and the syncobj leak by construction. Cc: stable@vger.kernel.org Fixes: 9ba0ff3e083f ("drm/v3d: Create a CPU job extension for the timestamp query job") Assisted-by: Claude:claude-opus-4.7 Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260515-v3d-cpu-job-leaks-v1-1-7f147cbbf935@igalia.com Signed-off-by: Maíra Canal commit 4d3a2a466b8d68d852a1f3bbf11204b718428dc4 Author: Nathan Chancellor Date: Sun May 17 13:51:01 2026 +0900 HID: core: Fix size_t specifier in hid_report_raw_event() When building for 32-bit platforms, for which 'size_t' is 'unsigned int', there are warnings around using the incorrect format specifier to print bsize in hid_report_raw_event(): drivers/hid/hid-core.c:2054:29: error: format specifies type 'long' but the argument has type 'size_t' (aka 'unsigned int') [-Werror,-Wformat] 2053 | hid_warn_ratelimited(hid, "Event data for report %d is incorrect (%d vs %ld)\n", | ~~~ | %zu 2054 | report->id, csize, bsize); | ^~~~~ drivers/hid/hid-core.c:2076:29: error: format specifies type 'long' but the argument has type 'size_t' (aka 'unsigned int') [-Werror,-Wformat] 2075 | hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %ld)\n", | ~~~ | %zu 2076 | report->id, rsize, bsize); | ^~~~~ Use the proper 'size_t' format specifier, '%zu', to clear up the warnings. Cc: stable@vger.kernel.org Fixes: 2c85c61d1332 ("HID: pass the buffer size to hid_report_raw_event") Reported-by: Miguel Ojeda Closes: https://lore.kernel.org/20260516020430.110135-1-ojeda@kernel.org/ Signed-off-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 9a424b62f771a759b040b9be2f3762bad0da283f Merge: 5200f5f493f79f 5a433107fab621 Author: Namhyung Kim Date: Mon May 18 12:41:38 2026 -0700 Merge branch 'perf-upstream' commit 8817005efbdfdf5d4e4814cb5dc52b53d12917d7 Author: Qing Ming Date: Sat May 16 15:08:49 2026 +0800 cgroup/rstat: validate cpu before css_rstat_cpu() access css_rstat_updated() is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a valid possible CPU. A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu == 0x7fffffff triggers: UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9 index 2147483647 is out of range for type 'long unsigned int [64]' Call Trace: css_rstat_updated bpf_iter_run_prog cgroup_iter_seq_show bpf_seq_read Add cpu validation to the BPF-facing css_rstat_updated() kfunc and move the common implementation to __css_rstat_updated() for in-kernel callers. Fixes: a319185be9f5 ("cgroup: bpf: enable bpf programs to integrate with rstat") Signed-off-by: Qing Ming Signed-off-by: Tejun Heo commit 593889c401426004bd0ea0f6d4fcece728b03420 Author: Paul E. McKenney Date: Mon May 11 19:54:41 2026 +0200 srcu: Don't queue workqueue handlers to never-online CPUs While an srcu_struct structure is in the midst of switching from CPU-0 to all-CPUs state, it can attempt to invoke callbacks for CPUs that have never been online. Worse yet, it can attempt in invoke callbacks for CPUs that never will be online, even including imaginary CPUs not in cpu_possible_mask. This can cause hangs on s390, which is not set up to deal with workqueue handlers being scheduled on such CPUs. This commit therefore causes Tree SRCU to refrain from queueing workqueue handlers on CPUs that have not yet (and might never) come online. Because callbacks are not invoked on CPUs that have not been online, it is an error to invoke call_srcu(), synchronize_srcu(), or synchronize_srcu_expedited() on a CPU that is not yet fully online. However, it turns out to be less code to redirect the callbacks from too-early invocations of call_srcu() than to warn about such invocations. This commit therefore also redirects callbacks queued on not-yet-fully-online CPUs to the boot CPU. Reported-by: Vasily Gorbik Fixes: 61bbcfb50514 ("srcu: Push srcu_node allocation to GP when non-preemptible") Signed-off-by: Paul E. McKenney Tested-by: Vasily Gorbik Tested-by: Samir Reviewed-by: Shrikanth Hegde Cc: Tejun Heo Signed-off-by: Uladzislau Rezki (Sony) Signed-off-by: Boqun Feng commit ea6ec3343e05f7937a53eb6d7617b3abdb4abc19 Author: Johan Hovold Date: Tue May 12 09:48:09 2026 +0200 spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to the released channel to the DMA engine (or trying to free the channel a second time on late probe errors or driver unbind). This issue was flagged by Sashiko when reviewing a devres allocation conversion patch. Fixes: c687c46e9e45 ("spi: spi-ti-qspi: Use bounce buffer if read buffer is not DMA'ble") Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=17 Cc: stable@vger.kernel.org # 4.12 Cc: Vignesh R Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260512074809.915084-1-johan@kernel.org Signed-off-by: Mark Brown commit 3d67fffb74267772d461c02c67f1eff893ad547d Author: Johan Hovold Date: Tue May 12 09:47:33 2026 +0200 spi: sprd: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to check the dma.enabled flag before trying to release the DMA channels also on late probe errors to avoid dereferencing an error pointer (or attempting to release a channel a second time). This issue was flagged by Sashiko when reviewing a devres allocation conversion patch. Fixes: 386119bc7be9 ("spi: sprd: spi: sprd: Add DMA mode support") Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=10 Cc: stable@vger.kernel.org # 5.1 Cc: Lanqing Liu Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260512074733.915029-1-johan@kernel.org Signed-off-by: Mark Brown commit fd3b95866d86844ae747fce9b3438d73ed5f1e7a Author: Shengjiu Wang Date: Tue May 12 14:52:52 2026 +0800 ASoC: fsl_sai: Eliminate possible interrupt storm during probe When the SAI peripheral is left in a running state by the bootloader, the driver can experience an interrupt storm during probe that prevents successful initialization. This occurs because the current code registers the IRQ handler before resetting the hardware to a known state. The issue manifests as: - Continuous interrupts firing immediately after devm_request_irq() - Driver probe failure or system hang - Error messages about unhandled interrupts This is particularly problematic on systems where U-Boot or other bootloaders enable SAI for boot-time audio feedback or diagnostics and don't properly disable it before handing control to Linux. Fix this by reordering the probe sequence: 1. Add fsl_sai_reset_hw() to clear TCSR/RCSR control registers, which disables the transmitter/receiver and all interrupt sources 2. Move devm_request_irq() to after hardware initialization This ensures the SAI is in a clean reset state before the interrupt handler can be invoked, preventing the storm while maintaining proper error handling and cleanup paths. Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260512065252.75859-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit a7e8f3efd50a165ba0189f6dc57f7e51a7d149db Author: Johan Hovold Date: Tue May 12 09:43:34 2026 +0200 spi: qup: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error pointer (or attempting to release a channel a second time) on later probe errors or driver unbind. This issue was flagged by Sashiko when reviewing a devres allocation conversion patch. Fixes: 612762e82ae6 ("spi: qup: Add DMA capabilities") Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=4 Cc: stable@vger.kernel.org # 4.1 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260512074334.914735-1-johan@kernel.org Signed-off-by: Mark Brown commit f23bf992d65a42007c517b060ca35cebdea3525a Author: Carl Lee Date: Sat May 16 19:55:18 2026 +0800 nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems Some ACPI-based platforms report incorrect IRQ trigger types (e.g. IRQF_TRIGGER_HIGH), which can lead to interrupt storms. Use the historically working rising-edge trigger on ACPI systems to avoid this regression. Device Tree-based systems continue to use the firmware-provided trigger type. Fixes: 57be33f85e36 ("nfc: nxp-nci: remove interrupt trigger type") Signed-off-by: Carl Lee Tested-by: Bartosz Golaszewski Reviewed-by: Bartosz Golaszewski Reviewed-by: Mark Pearson Tested-by: Mark Pearson Tested-by: Luca Stefani Link: https://patch.msgid.link/20260516-nfc-nxp-nci-i2c-restore-irq-trigger-fallback-v3-1-37ba4b6e9086@amd.com Signed-off-by: David Heidelberg commit 4bf5d3da79c48e1df4bab82c9680c53adeff7820 Merge: 5dfa01ef37a8b9 646ebdd3105809 Author: Linus Torvalds Date: Mon May 18 08:45:32 2026 -0700 Merge tag 'media/v7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fix from Mauro Carvalho Chehab: "Fix inverted error logic in ttusbir driver" * tag 'media/v7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: rc: ttusbir: fix inverted error logic commit cf18e36455603d65d4745de83e2d1743c54ada47 Author: Michael Bommarito Date: Sun May 17 17:30:10 2026 -0400 io_uring: propagate array_index_nospec opcode into req->opcode Commit 1e988c3fe126 ("io_uring: prevent opcode speculation") added array_index_nospec() to io_init_req(), but applied it only to a local opcode variable. req->opcode is initialized from sqe->opcode before the bounds check and remains the raw value. Keep req->opcode as the canonical opcode in io_init_req(): reject out-of-range values architecturally, then write the array_index_nospec() result back to req->opcode before any table lookup. This keeps downstream users of req->opcode from observing the raw user byte on a mispredicted path. No functional change: array_index_nospec() is a no-op for opcodes in [0, IORING_OP_LAST), and out-of-range opcodes are still rejected at the bounds check above the assignment. Fixes: 1e988c3fe126 ("io_uring: prevent opcode speculation") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260517213010.696135-1-michael.bommarito@gmail.com Signed-off-by: Jens Axboe commit b73953af9bbd5c721c9d92b805a8aea8b0db74b1 Author: Manivannan Sadhasivam Date: Thu May 14 12:20:17 2026 +0530 arm64: defconfig: Enable PCI M.2 power sequencing driver POWER_SEQUENCING_PCIE_M2 driver handles power supply to the PCIe M.2 connectors and is required on wide variety of ARM64 platforms such as Qcom Snapdragon X Elite laptops and Mediatek Dojo Chromebooks. Reviewed-by: Dmitry Baryshkov Reviewed-by: Krzysztof Kozlowski Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20260514065017.11305-1-manivannan.sadhasivam@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 06b2e78c45028aadb220db8f72554884c422a825 Merge: 0d5dc5818191b5 4ac19b36bf4108 Author: Bjorn Andersson Date: Mon May 18 09:43:38 2026 -0500 Merge branch '20260518-qcom-ice-fix-v7-0-2a595382185b@oss.qualcomm.com' into drivers-for-7.2 Merge the fixes for ICE driver race condition through a topic branch, to allow sharing it with other subsystems as well. commit 4ac19b36bf4108706238cbc4f300b17dba8b881e Author: Manivannan Sadhasivam Date: Mon May 18 19:22:21 2026 +0530 scsi: ufs: ufs-qcom: Remove NULL check from devm_of_qcom_ice_get() Now since the devm_of_qcom_ice_get() API never returns NULL, remove the NULL check and also simplify the error handling. Reviewed-by: Konrad Dybcio Acked-by: Martin K. Petersen # UFS Tested-by: Sumit Garg # OP-TEE as TZ Acked-by: Sumit Garg Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20260518-qcom-ice-fix-v7-5-2a595382185b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2ccbb3fa5cf47d05849cf6722aad1b4cc14df6d9 Author: Manivannan Sadhasivam Date: Mon May 18 19:22:20 2026 +0530 mmc: sdhci-msm: Remove NULL check from devm_of_qcom_ice_get() Now since the devm_of_qcom_ice_get() API never returns NULL, remove the NULL check and also simplify the error handling. Reviewed-by: Konrad Dybcio Acked-by: Ulf Hansson Acked-by: Adrian Hunter Tested-by: Sumit Garg # OP-TEE as TZ Acked-by: Sumit Garg Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20260518-qcom-ice-fix-v7-4-2a595382185b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b9ab7217dd7d567c50311afa94d6d6746cb77e04 Author: Manivannan Sadhasivam Date: Mon May 18 19:22:19 2026 +0530 soc: qcom: ice: Return proper error codes from devm_of_qcom_ice_get() instead of NULL devm_of_qcom_ice_get() currently returns NULL if ICE SCM is not available or "qcom,ice" property is not found in DT. But this confuses the clients since NULL doesn't convey the reason for failure. So return proper error codes instead of NULL. Reported-by: Sumit Garg Reviewed-by: Konrad Dybcio Tested-by: Sumit Garg # OP-TEE as TZ Acked-by: Sumit Garg Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20260518-qcom-ice-fix-v7-3-2a595382185b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5a4dc805a80e6fe303d6a4748cd451ea15987ffd Author: Manivannan Sadhasivam Date: Mon May 18 19:22:18 2026 +0530 soc: qcom: ice: Return -ENODEV if the ICE platform device is not found By the time the consumer driver calls devm_of_qcom_ice_get(), all the platform devices for ICE nodes would've been created by of_platform_default_populate(). So for the absence of any platform device, -ENODEV should not returned, not -EPROBE_DEFER. Fixes: 2afbf43a4aec ("soc: qcom: Make the Qualcomm UFS/SDCC ICE a dedicated driver") Tested-by: Sumit Garg # OP-TEE as TZ Acked-by: Sumit Garg Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20260518-qcom-ice-fix-v7-2-2a595382185b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d922113ef91e6e7e8065e9070f349365341ba32e Author: Manivannan Sadhasivam Date: Mon May 18 19:22:17 2026 +0530 soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() The current platform driver design causes probe ordering races with consumers (UFS, eMMC) due to ICE's dependency on SCM firmware calls. If ICE probe fails (missing ICE SCM or DT registers), devm_of_qcom_ice_get() loops with -EPROBE_DEFER, leaving consumers non-functional even when ICE should be gracefully disabled. devm_of_qcom_ice_get() doesn't know if the ICE driver probe has failed due to above reasons or it is waiting for the SCM driver. Moreover, there is no devlink dependency between ICE and consumer drivers as 'qcom,ice' is not considered as a DT 'supplier'. So the consumer drivers have no idea of when the ICE driver is going to probe. To address these issues, store the error pointer in a global xarray with ice node phandle as a key during probe in addition to the valid ice pointer and synchronize both qcom_ice_probe() and of_qcom_ice_get() using a mutex. If the xarray entry is NULL, then it implies that the driver is not probed yet, so return -EPROBE_DEFER. If it has any error pointer, return that error pointer directly. Otherwise, add the devlink as usual and return the valid pointer to the consumer. Xarray is used instead of platform drvdata, since driver core frees the drvdata during probe failure. So it cannot be used to pass the error pointer to the consumers. Note that this change only fixes the standalone ICE DT node bindings and not the ones with 'ice' range embedded in the consumer nodes, where there is no issue. Fixes: 2afbf43a4aec ("soc: qcom: Make the Qualcomm UFS/SDCC ICE a dedicated driver") Reported-by: Sumit Garg Tested-by: Sumit Garg # OP-TEE as TZ Acked-by: Sumit Garg Cc: stable@vger.kernel.org # 6.4 Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20260518-qcom-ice-fix-v7-1-2a595382185b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5dfa01ef37a8b944773aef8dee747cd76dec4234 Merge: 5200f5f493f79f 8a220d1c312c66 Author: Linus Torvalds Date: Mon May 18 07:30:31 2026 -0700 Merge tag 'vfs-7.1-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: "This contains a fixes for the current development cycle. Note that AI related review sometimes delays fixes a bit because we find more fixes for the fixes. I might try and send smaller but more fixes PRs if this trend keeps up. - Fix various netfslib bugs - Fix an out-of-bounds write when listing idmappings - Fix the return values in jfs_mkdir() and orangefs_mkdir() - Fix a writeback writeback array overflow in fuse - Fix a forced iversion increment on lazytime timestamp updates - Reject a negative timeval component in kern_select() - Fix error return when vfs_mkdir() fails in the cachefiles code - Fix wrong error code returned for pidns ioctls" * tag 'vfs-7.1-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (31 commits) cachefiles: Fix error return when vfs_mkdir() fails afs: Fix the locking used by afs_get_link() netfs, afs: Fix write skipping in dir/link writepages netfs: Fix netfs_read_folio() to wait on writeback netfs: Fix folio->private handling in netfs_perform_write() netfs: Fix partial invalidation of streaming-write folio netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs: Fix leak of request in netfs_write_begin() error handling netfs: Fix early put of sink folio in netfs_read_gaps() netfs: Fix write streaming disablement if fd open O_RDWR netfs: Fix read-gaps to remove netfs_folio from filled folio netfs: Fix potential deadlock in write-through mode netfs: Fix streaming write being overwritten netfs: Defer the emission of trace_netfs_folio() netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone netfs: Fix overrun check in netfs_extract_user_iter() netfs: fix error handling in netfs_extract_user_iter() netfs: Fix potential uninitialised var in netfs_extract_user_iter() netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call netfs: Fix zeropoint update where i_size > remote_i_size ... commit 87ed4e845d5a90bba1a56c0a5c580a13982e8648 Author: Louis-Alexis Eyraud Date: Wed Apr 29 11:59:02 2026 +0200 drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable The struct 'mtk_hdmi_ddc_driver' is not used outside of the mtk_hdmi_ddc.c file, so make it static to silence sparse warning: ``` drivers/gpu/drm/mediatek/mtk_hdmi_ddc.c:331:24: sparse: warning: symbol 'mtk_hdmi_ddc_driver' was not declared. Should it be static? ``` Fixes: c241118b6216 ("drm/mediatek: mtk_hdmi_ddc: Switch to register as module_platform_driver") Signed-off-by: Louis-Alexis Eyraud Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20260429-mediatek-drm-fix-sparse-warnings-v1-4-d95c4d118b83@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 571f00a5fb725984049bd532ee8193cc34ff2994 Author: Louis-Alexis Eyraud Date: Wed Apr 29 11:59:01 2026 +0200 drm/mediatek: mtk_cec: Fix non-static global variable The struct 'mtk_cec_driver' is not used outside of the mtk_cec.c file, so make it static to silence sparse warning: ``` drivers/gpu/drm/mediatek/mtk_cec.c:243:24: sparse: warning: symbol 'mtk_cec_driver' was not declared. Should it be static? ``` Fixes: 1e914a89ab7e ("drm/mediatek: mtk_cec: Switch to register as module_platform_driver") Signed-off-by: Louis-Alexis Eyraud Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20260429-mediatek-drm-fix-sparse-warnings-v1-3-d95c4d118b83@collabora.com/ Signed-off-by: Chun-Kuang Hu commit dc245d9a7f1b06f86271d4e524d6e5634c5ce312 Author: Louis-Alexis Eyraud Date: Wed Apr 29 11:59:00 2026 +0200 drm/mediatek: mtk_hdmi_v2: Fix non-static global variable The struct 'mtk_hdmi_v2_clk_names' is not used outside of the mtk_hdmi_v2.c file, so make it static to silence sparse warning: ``` drivers/gpu/drm/mediatek/mtk_hdmi_v2.c:53:12: sparse: warning: symbol 'mtk_hdmi_v2_clk_names' was not declared. Should it be static? ``` Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604132044.fcYjEcU8-lkp@intel.com/ Signed-off-by: Louis-Alexis Eyraud Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20260429-mediatek-drm-fix-sparse-warnings-v1-2-d95c4d118b83@collabora.com/ Signed-off-by: Chun-Kuang Hu commit e9f5e8da29762df1111a58ae0b4a83091595d834 Author: Louis-Alexis Eyraud Date: Wed Apr 29 11:58:59 2026 +0200 drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable The struct 'mtk_hdmi_ddc_v2_driver' is not used outside of the mtk_hdmi_ddc_v2.c file, so make it static to silence sparse warning: ``` drivers/gpu/drm/mediatek/mtk_hdmi_ddc_v2.c:392:24: sparse: warning: symbol 'mtk_hdmi_ddc_v2_driver' was not declared. Should it be static? ``` Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604132044.fcYjEcU8-lkp@intel.com/ Signed-off-by: Louis-Alexis Eyraud Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20260429-mediatek-drm-fix-sparse-warnings-v1-1-d95c4d118b83@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 60fb2cf51e77bb1c0261160b4be44209d68956b1 Author: Baochen Qiang Date: Thu May 14 11:32:51 2026 +0800 wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only parsing When connecting to an AP configured for EHT 20 MHz with a full EHT MCS/NSS map (supporting MCS 0-13) Supported EHT-MCS and NSS Set EHT-MCS Map (BW <= 80MHz): 0x444444 .... .... .... .... .... 0100 = Rx Max Nss That Supports EHT-MCS 0-9: 4 .... .... .... .... 0100 .... = Tx Max Nss That Supports EHT-MCS 0-9: 4 .... .... .... 0100 .... .... = Rx Max Nss That Supports EHT-MCS 10-11: 4 .... .... 0100 .... .... .... = Tx Max Nss That Supports EHT-MCS 10-11: 4 .... 0100 .... .... .... .... = Rx Max Nss That Supports EHT-MCS 12-13: 4 0100 .... .... .... .... .... = Tx Max Nss That Supports EHT-MCS 12-13: 4 TX throughput is observed to be significantly lower than expected. Investigation shows that TX rates are limited to EHT MCS 11, even though the AP advertises support for EHT MCS 12/13. The root cause is an incorrect parsing of the Supported EHT-MCS and NSS Set element in ath12k_peer_assoc_h_eht(). IEEE Std 802.11be-2024 Figure 9-1074as describes the format for 20 MHz-Only Non-AP STAs. IEEE Std 802.11be-2024 Figure 9-1074at describes the format for all other AP and non-AP STAs. Currently the first format is parsed when the peer advertises no wider HE channel width support, without considering whether it is an AP or a non-AP STA. This is incorrect: the peer AP's capabilities must be parsed using Figure 9-1074at even when it operates on 20 MHz only. Parsing it as Figure 9-1074as causes rx_tx_mcs13_max_nss to be interpreted as zero, which is then passed to firmware, leading firmware to assume the peer does not support MCS 13 and to limit TX rates at MCS 11. Fix this by parsing the Figure 9-1074as format only when the peer is a 20 MHz-Only non-AP STA, i.e. when the local interface operates as AP or mesh point. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 6c95151e2e77 ("wifi: ath12k: Add EHT MCS/NSS rates to Peer Assoc") Signed-off-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260514-ath12k-fix-20mhz-only-mcs-map-v1-1-a38d4a9b21a2@oss.qualcomm.com Signed-off-by: Jeff Johnson commit f51e4b3b5574ad8cb5b16b11f8a1452147ece87a Author: Kyle Farnung Date: Wed May 13 21:52:12 2026 -0700 wifi: ath11k: clear shared SRNG pointer state on restart LMAC rings reuse the shared rdp/wrp pointer buffers without going through the normal SRNG hw-init path that zeros non-LMAC ring pointers. After restart, ath11k_hal_srng_clear() can therefore hand stale hp/tp state from the previous firmware instance back to the new one. Clear the shared pointer buffers while keeping the allocations in place so restart still avoids reallocating SRNG DMA memory, but starts with fresh ring-pointer state. Fixes: 32be3ca4cf78b ("wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again") Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/CAOPSVF04q6uvVdq8GTRLHBrVMdpt9=o9wVcFMc6f-yhmSBcZqQ@mail.gmail.com/ Signed-off-by: Kyle Farnung Reviewed-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260513-kfarnung-ath11k-srng-clear-pointer-state-v1-1-bc700dd8b333@gmail.com Signed-off-by: Jeff Johnson commit 72b8654e3b83548f64524add2e9145e9b6c8a852 Author: Willmar Knikker Date: Tue May 5 17:17:43 2026 +0000 wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() In ath11k_dp_rx_msdu_coalesce() the loop uses ->is_continuation after the dev_kfree_skb_any(). This can cause a use after free kfence. Use flag for caching is_continuation for use after the dev_kfree_skb_any(). Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Willmar Knikker Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260505171709.547274-1-willmar@met-dubbel-l.nl Signed-off-by: Jeff Johnson commit 2a2451a34afdf563b3102d36a4b6cf335cf813e2 Author: Matthew Leach Date: Fri Apr 24 10:50:35 2026 +0100 wifi: ath11k: fix peer resolution on rx path when peer_id=0 It has been observed that on certain chipsets a peer can be assigned peer_id=0. For reception of non-aggregated MPDUs this is fine as ath11k_dp_rx_h_find_peer() has a fallback case where it locates the peer based upon the source MAC address. On an aggregated link, the mpdu_start header is only populated by hardware on the first sub-MSDU. This causes the peer resolution to be skipped for the subsequent MSDUs and the encryption type of these frames to be set to an incorrect value, resulting in these MSDUs being dropped by ieee80211. ath11k_pci 0000:03:00.0: data rx skb 000000002f4b704d len 1534 peer xx:xx:xx:xx:xx:xx 0 ucast sn 3063 he160 rate_idx 9 vht_nss 2 freq 5240 band 1 flag 0x40d1a fcs-err 0 mic-err 0 amsdu-more 0 peer_id 0 first_msdu 1 last_msdu 0 ath11k_pci 0000:03:00.0: data rx skb 0000000038acd580 len 1534 peer (null) 0 ucast sn 3063 he160 rate_idx 9 vht_nss 2 freq 5240 band 1 flag 0x40d00 fcs-err 0 mic-err 0 amsdu-more 0 peer_id 0 first_msdu 0 last_msdu 1 Remove the null peer_id checks in ath11k_dp_rx_h_find_peer() and ath11k_hal_rx_parse_mon_status_tlv(), allowing peers with an assigned ID of 0 to be resolved. Tested-on: QCA2066 hw2.1 PCI WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 Fixes: 2167fa606c0f ("ath11k: Add support for RX decapsulation offload") Reviewed-by: Baochen Qiang Signed-off-by: Matthew Leach Reviewed-by: P Praneesh Link: https://patch.msgid.link/20260424-ath11k-null-peerid-workaround-v4-1-252b224d3cf6@collabora.com Signed-off-by: Jeff Johnson commit 6df5678b6a94ac80e31e847074c4b30c21025b1f Author: Gustavo Sousa Date: Thu May 14 18:44:46 2026 -0300 drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4 The register COMMON_SLICE_CHICKEN4 is a MCR register on both Xe2 and Xe3. Let's make sure to define a MCR version of it and use it for the relevant IP versions. Use XEHP_ as prefix for the register name, since it is MCR as of Xe_HP. v2: - Also change for one entry in lrc_tunnings, which was caught by manual testing and add corresponging Fixes tag in commit message. (Gustavo) Fixes: 8d6f16f1f082 ("drm/xe: Extend Wa_22021007897 to Xe3 platforms") Fixes: e5c13e2c505b ("drm/xe/xe2hpg: Add Wa_22021007897") Fixes: 8ccf5f6b2295 ("drm/xe/tuning: Apply windower hardware filtering setting on Xe3 and Xe3p") Bspec: 66534, 71185, 74417 Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260514-rtp-mcr-check-v3-3-30dd47855fee@intel.com Signed-off-by: Gustavo Sousa (cherry picked from commit 75f65f1a4c06da1d87f28570a9d4cdad28f13360) Signed-off-by: Rodrigo Vivi commit a4660bd949733fd6ea621fdb50fabac2608155e9 Author: Gustavo Sousa Date: Thu May 14 18:44:45 2026 -0300 drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1 The register COMMON_SLICE_CHICKEN1 is a MCR register on Xe2. Let's make sure to define a MCR version of it and use it for the relevant IP versions. Use XEHP_ as prefix for the register name, since it is MCR as of Xe_HP. Fixes: a5d221924e13 ("drm/xe/xe2_hpg: Add set of workarounds") Fixes: 9f18b55b6d3f ("drm/xe/xe2: Add workaround 18033852989") Bspec: 66534, 71185 Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260514-rtp-mcr-check-v3-2-30dd47855fee@intel.com Signed-off-by: Gustavo Sousa (cherry picked from commit a672725fdbfc3ea430130039d677c7dc98d59df8) Signed-off-by: Rodrigo Vivi commit 16be14eec5fdaea9477368856a85173246c41454 Author: Gustavo Sousa Date: Thu May 14 18:44:44 2026 -0300 drm/xe: Define CACHE_MODE_1 as MCR register CACHE_MODE_1 is a MCR register for all platforms that currently use it in the Xe driver. Use XE_REG_MCR() when defining it. Fixes: 8cd7e9759766 ("drm/xe: Add missing DG2 lrc workarounds") Fixes: ff063430caa8 ("drm/xe/mtl: Add some initial MTL workarounds") Bspec: 66534, 67788 Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260514-rtp-mcr-check-v3-1-30dd47855fee@intel.com Signed-off-by: Gustavo Sousa (cherry picked from commit 8f765f0c054e0fb39980a76b4c899b027395929d) Signed-off-by: Rodrigo Vivi commit 96bf49b526e2d03a2b7f6e861925a08f46ed0d28 Author: Mohanram Meenakshisundaram Date: Thu May 14 23:19:18 2026 +0530 drm/xe/pf: Fix CFI failure in debugfs access Reading debugfs file (/sys/kernel/debug/dri/0/gt*/pf/adverse_events) with CFI (Control Flow Integrity) enabled, the kernel panics at xe_gt_debugfs_simple_show+0x82/0xc0. xe_gt_debugfs_simple_show() declare a function pointer expecting int return type, but xe_gt_sriov_pf_monitor_print_events() is void return type, leading to CFI failure and kernel panic. [507620.973657] CFI failure at xe_gt_debugfs_simple_show+0x82/0xc0 [xe] (target: xe_gt_sriov_pf_monitor_print_events+0x0/0x130 [xe]; expected type: 0xd72c7139) Fix xe_gt_sriov_pf_monitor_print_events() function by updating to return an int type. Fixes: 1c99d3d3edab ("drm/xe/pf: Expose PF monitor details via debugfs") Signed-off-by: Mohanram Meenakshisundaram Reviewed-by: Michal Wajdeczko Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260514174918.1556357-2-mohanram.meenakshisundaram@intel.com (cherry picked from commit ff1d386a8359746d9699ac30336e3b0684c68958) Signed-off-by: Rodrigo Vivi commit 9bb2f1d7e6e58b8e434ddc2048c661bf87ccdf2a Author: Michal Wajdeczko Date: Thu May 14 17:57:26 2026 +0200 drm/xe/vf: Fix signature of print functions We have plugged-in existing VF print functions into our GT debugfs show helper as-is, but we missed that the helper expects functions to return int, while they were defined as void. This can lead to errors being reported when CFI is enabled. Fixes: 63d8cb8fe3dd ("drm/xe/vf: Expose SR-IOV VF attributes to GT debugfs") Signed-off-by: Michal Wajdeczko Cc: Mohanram Meenakshisundaram Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260514155726.7165-1-michal.wajdeczko@intel.com (cherry picked from commit 314e31c9a8a1c421ee4f7f755b9348aefbbca090) Signed-off-by: Rodrigo Vivi commit d3ded53fab90996e7d94a39049e11962dd066725 Author: Shuicheng Lin Date: Mon May 11 15:41:34 2026 +0000 drm/xe/gsc: Fix double-free of managed BO in error path The error path in xe_gsc_init_post_hwconfig() explicitly frees a BO allocated with xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm cleanup action registered, this causes a double-free when devm unwinds during probe failure. Remove the explicit free and let devm handle it, consistent with all other xe_managed_bo_create_pin_map() callers. Fixes: 2e5d47fe7839 ("drm/xe/uc: Use managed bo for HuC and GSC objects") Reviewed-by: Daniele Ceraolo Spurio Assisted-by: Claude:claude-opus-4.6 Link: https://patch.msgid.link/20260511154134.223696-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit 71d61e3e299a17139e47f980a4d6f425b2c59bf7) Signed-off-by: Rodrigo Vivi commit 6eb0168d091404bee11d1f0712515d77b8d01579 Author: Michal Wajdeczko Date: Mon May 11 19:28:37 2026 +0200 drm/xe/memirq: Update interrupt handler logic To workaround some corner case hardware limitations, new programming note for the memory based interrupt handler suggests to assume that some status bytes, like GT_MI_USER_INTERRUPT and GUC_INTR_GUC2HOST, are always set. Update our interrupt handler to follow the new rules. Bspec: 53672 Fixes: a6581ebe7685 ("drm/xe/vf: Introduce Memory Based Interrupts Handler") Signed-off-by: Michal Wajdeczko Cc: Rodrigo Vivi Cc: Matthew Brost Reviewed-by: Michał Winiarski Link: https://patch.msgid.link/20260511172838.2299-2-michal.wajdeczko@intel.com (cherry picked from commit 284f4cae4579eed9dd4406f18a6c1becc69f8931) Signed-off-by: Rodrigo Vivi commit af8c5aa7a9c6f503d81f103d7ab4f8d759521de3 Author: Michal Pecio Date: Mon May 18 07:32:58 2026 +0200 usb: core: Clean up SuperSpeed/eUSB2 descriptor validation logging Core usually prints endpoint addresses with 0x%X format. Change this code to use it too, instead of just %d. Particularly for IN, 0x83 seems more readable than 131. While at that, fix checkpatch warnings about multi-line quoted strings, as well as missing or doubled whitespace in those strings. Signed-off-by: Michal Pecio Link: https://patch.msgid.link/20260518073258.6532bdd5.michal.pecio@gmail.com Signed-off-by: Greg Kroah-Hartman commit 727d045d064b7c9a24db3bce9c0485a382cb768b Author: Michal Pecio Date: Mon May 18 07:32:07 2026 +0200 usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval Tao Xue found that some common devices violate USB 3.x section 9.6.7 by reporting wBytesPerInterval lower than the size of packets they actually send. I confirmed that AX88179 may set it to 0 and RTL8153 CDC configuration sets it to 8 but sends both 8 and 16 byte packets: S Ii:11:007:3 -115:128 16 < C Ii:11:007:3 0:128 8 = a1000000 01000000 S Ii:11:007:3 -115:128 16 < C Ii:11:007:3 0:128 16 = a12a0000 01000800 00000000 00000000 Most xHCI host controllers neglect interrupt bandwidth reservations and let such devices exceed theirs, some fail the URB with EOVERFLOW. Assume that wBytesPerInterval lower than wMaxPacketSize is bogus and increase it to the worst case maximum on interrupt IN endpoints. This solves xHCI problems and appears to have no other effect. Interrupt transfers are not limited to one interval and drivers submit URBs of class defined size without looking at wBytesPerInterval. Any multi- interval transfer is considered terminated by a packet shorter than wMaxPacketSize regardless of wBytesPerInterval - see USB3 8.10.3. Stay in spec on OUT endpoints and isochronous. No buggy devices are known and we don't want to risk sending more data than the device is prepared to handle or confusing isoc drivers regarding altsetting capacities guaranteed by the device itself. And don't complain when wMaxPacketSize <= wBytesPerInterval < wMaxPacketSize * (bMaxBurst+1) because enabling this seems to be the exact goal of the spec. Reported-and-tested-by: Tao Xue Closes: https://lore.kernel.org/linux-usb/20260402021400.28853-1-xuetao09@huawei.com/ Cc: stable@vger.kernel.org Signed-off-by: Michal Pecio Link: https://patch.msgid.link/20260518073207.5b7d26e7.michal.pecio@gmail.com Signed-off-by: Greg Kroah-Hartman commit d1e280334b7f0a1df441e08bd1f6a1bcc36b3bbb Author: Michal Pecio Date: Mon May 18 07:31:21 2026 +0200 usb: core: Fix SuperSpeed root hub wMaxPacketSize There is no good reason to have wBytesPerInterval < wMaxPacketSize - either one is too low or the other too high, and we may want to warn about such descriptors. Start with cleaning up our own root hubs. USB 3.2 section 10.15.1 sets wMaxPacketSize and wBytesPerInterval of SuperSpeed hub status endpoints at 2 bytes, so reduce wMaxPacketSize from its former value of 4, which was derived from USB 2.0 spec and the kernel's USB_MAXCHILDREN limit. They don't apply because USB 3.2 10.15.2.1 specifies SuperSpeed hubs to have up to 15 ports. Suggested-by: Mathias Nyman Signed-off-by: Michal Pecio Link: https://patch.msgid.link/20260518073121.7bc1da0f.michal.pecio@gmail.com Signed-off-by: Greg Kroah-Hartman commit 379e8f1ca5e919b130b40d8115d92a536e5f8d7a Author: Boris Brezillon Date: Mon May 18 13:41:45 2026 +0200 drm/gem: Make the GEM LRU lock part of drm_device Recently, a few races have been discovered in the GEM LRU logic, all of them caused by the fact the LRU lock is accessed through gem->lru->lock, and that very same lock also protects changes to gem->lru, leading to situations where gem->lru needs to first be accessed without the lock held, to then get the lru to access the lock through and finally take the lock and do the expected operation. Currently, the only driver making use of this API (MSM) declares a device-wide lock, and the user we're about to add (panthor) will do the same. There's no evidence that we will ever have a driver that wants different pools of LRUs protected by different locks under the same drm_device. So we're better off moving this lock to drm_device and always locking it through obj->dev->gem_lru_mutex, or directly through dev->gem_lru_mutex. If anyone ever needs more fine-grained locking, this can be revisited to pass some drm_gem_lru_pool object representing the pool of LRUs under a specific lock, but for now, the per-device lock seems to be enough. Fixes: e7c2af13f811 ("drm/gem: Add LRU/shrinker helper") Reported-by: Chia-I Wu Closes: https://gitlab.freedesktop.org/panfrost/linux/-/work_items/86 Reviewed-by: Rob Clark Reviewed-by: Liviu Dudau Reviewed-by: Steven Price Reviewed-by: Chia-I Wu Link: https://patch.msgid.link/20260518-panthor-shrinker-fixes-v4-1-1920234470d5@collabora.com Signed-off-by: Boris Brezillon commit d7486952bf74e546ee3748fb14b2d07881fa6273 Author: Greg Kroah-Hartman Date: Thu May 14 19:10:06 2026 +0200 usb: typec: ucsi: ccg: reject firmware images without a ':' record header do_flash() locates the first .cyacd record with p = strnchr(fw->data, fw->size, ':'); while (p < eof) { s = strnchr(p + 1, eof - p - 1, ':'); ... } If the firmware image contains no ':' byte, strnchr() returns NULL. NULL compares less than the valid kernel pointer eof, so the loop body runs and strnchr() is called with p + 1 == (void *)1 and a length of roughly (unsigned long)eof, causing a wonderful crash. The not_signed_fw fallthrough earlier in do_flash() and the chip-state branches in ccg_fw_update_needed() allow an unsigned blob to reach this loop, so a root user who can place a crafted file under /lib/firmware and write the do_flash sysfs attribute can trigger the oops. Bail out with -EINVAL when the initial strnchr() returns NULL. Assisted-by: gkh_clanker_t1000 Cc: stable Cc: Heikki Krogerus Reviewed-by: Heikki Krogerus Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026051405-posture-shrill-7884@gregkh Signed-off-by: Greg Kroah-Hartman commit 6c5dbc104dadd79fc2923497c20bae759a18758c Author: Jeremy Erazo Date: Tue May 12 16:05:30 2026 +0000 usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling The WebUSB GET_URL handler in composite_setup() narrows landing_page_length to fit the host-supplied wLength using landing_page_length = w_length - WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset; If wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the unsigned subtraction wraps, and the subsequent memcpy(url_descriptor->URL, cdev->landing_page + landing_page_offset, landing_page_length - landing_page_offset); ends up copying close to UINT_MAX bytes from cdev->landing_page into cdev->req->buf. KASAN reports a slab-out-of-bounds in composite_setup on the kmalloc-2k gadget_info allocation, and FORTIFY_SOURCE traps the memcpy as a 4294967293-byte field-spanning write into url_descriptor->URL (size 252). A USB host can reach this from a single SETUP packet against any gadget that has webusb/use=1 and a landingPage configured. Handle the small-wLength case before the math: when the host requested fewer bytes than the URL descriptor header, only the header is meaningful and no URL bytes need to be copied. Setting landing_page_length to landing_page_offset makes the existing memcpy a no-op and leaves the descriptor returned to the host unchanged for all larger wLength values. Fixes: 93c473948c58 ("usb: gadget: add WebUSB landing page support") Cc: stable Signed-off-by: Jeremy Erazo Link: https://patch.msgid.link/20260512160530.352318-1-mendozayt13@gmail.com Signed-off-by: Greg Kroah-Hartman commit b02900c85a6423cf9b3dcc6b47bf060c85075e69 Author: Dan Carpenter Date: Tue May 12 13:14:59 2026 +0300 usb: typec: tipd: Fix error code in tps6598x_probe() Set the error code on these two error paths. The existing code returns success. Fixes: 77ed2f4538da ("usb: typec: tipd: Use read_power_status function in probe") Fixes: 04041fd7d6ec ("usb: typec: tipd: Read data status in probe and cache its value") Cc: stable Signed-off-by: Dan Carpenter Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/agL9o7wUK1dOVBTy@stanley.mountain Signed-off-by: Greg Kroah-Hartman commit 1711b6ed6953cee5940ca4c3a6e77f1b3798cee2 Author: Nirmoy Das Date: Thu May 14 07:42:57 2026 -0700 ovl: keep err zero after successful ovl_cache_get() ovl_iterate_merged() stores PTR_ERR(cache) in err before checking IS_ERR(cache). On success err holds the truncated cache pointer and can be returned as a bogus non-zero error. The syzbot reproducer reaches this through overlay-on-overlay readdir: getdents64 iterate_dir(outer overlay file) ovl_iterate_merged() ovl_cache_get() ovl_dir_read_merged() ovl_dir_read() iterate_dir(inner overlay file) ovl_iterate_merged() Only compute PTR_ERR(cache) on the error path. Fixes: d25e4b739f83 ("ovl: refactor ovl_iterate() and port to cred guard") Reported-by: syzbot+a16fb0cce329a320661c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a16fb0cce329a320661c Cc: stable@vger.kernel.org Signed-off-by: Nirmoy Das Link: https://patch.msgid.link/20260514144258.3068715-1-nirmoyd@nvidia.com Signed-off-by: Christian Brauner commit 759e8756da00aa115d504a18155b1d1ee1cc12e8 Author: Niklas Cassel Date: Thu May 14 09:39:02 2026 +0200 ata: libata-scsi: do not needlessly defer commands when using PMP with FBS The ACS specification does not allow a non-NCQ command to be issued while an NCQ command is outstanding. Commit 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") introduced a feature where a deferred non-NCQ command gets issued from a workqueue. The design stores a single non-NCQ command per port. However, when using Port Multipliers (PMPs), specifically PMPs that support FIS-Based Switching (FBS), non-NCQ and NCQ commands can be mixed on the same port, just not for the same link, see e.g. ata_std_qc_defer() which is, and always has operated on a per-link basis. Therefore, move the deferred_qc from struct ata_port to struct ata_link. This way, when using a PMP with FBS, we will not needlessly defer commands to all other links, just because one link issued a non-NCQ command while having an NCQ command outstanding. Only commands for that specific link will be deferred. This is in line with how PMPs with FBS worked before commit 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation"). Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") Tested-by: Tommy Kelly Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit f233124fb36cd57ef09f96d517a38ab4b902e15e Author: Niklas Cassel Date: Thu May 14 09:39:01 2026 +0200 ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS When using Port Multipliers (PMPs) with Command-Based Switching (CBS), you can only issue commands to one link at a time. For PMPs with CBS, there is already code to handle commands being sent to different links in sata_pmp_qc_defer_cmd_switch() using ap->excl_link. sata_sil24 also makes use of ap->excl_link. A user on the list reported that commit 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") broke PMPs with CBS. The commit introduced code that stores a deferred qc in ap->deferred_qc, to later be issued via a workqueue. It turns out that this change is incompatible with the existing ap->excl_link handling used by PMPs with CBS. Thus, modify sata_pmp_qc_defer_cmd_switch() and sil24_qc_defer() to return ATA_DEFER_LINK_EXCL, and make sure that the deferred QC handling via workqueue is not used for this return value. This way, PMPs with CBS will work once again. Note that the starvation referenced in commit 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") can only happen on libsas ports, and libsas does not support Port Multipliers, thus there is no harm of reverting back to the previous way of deferring commands for PMPs with CBS. Non-libsas ports connected to anything but a PMP with CBS (e.g. a normal drive or a PMP with FBS) will continue using the deferred workqueue, since it does result in lower completion latencies for non-NCQ commands, even though the workqueue is not strictly needed to avoid starvation for non-libsas ports. If we want to modify the scope of the workqueue issuing to also handle PMPs with CBS, then we should ensure that we can save both NCQ and non-NCQ commands in ap->deferred_qc, while also removing the existing PMP CBS handling using ap->excl_link, such that we don't duplicate features. While at it, also add a comment explaining how the ap->excl_link mechanism works. Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") Tested-by: Tommy Kelly Reported-by: Tommy Kelly Closes: https://lore.kernel.org/linux-ide/ce09cc21-a8e9-4845-b205-35411e22fba9@tkel.ly/ Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit ce4548807d2e4ae48fd0dbe38865467369877913 Author: Niklas Cassel Date: Thu May 14 09:39:00 2026 +0200 ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT The deferred QC feature was meant to handle mixed NCQ and non-NCQ commands, i.e. for return value ATA_DEFER_LINK. ATA_DEFER_PORT is returned by PATA drivers, but also certain SATA drivers like sata_mv and sata_sil24 that uses ap->excl_link to workaround hardware bugs in these HBAs. Regardless of the reason, using the deferred QC feature for ATA_DEFER_PORT is always wrong, and will break the ap->excl_link usage of the SATA drivers that rely on that feature. Modify ata_scsi_qc_issue() to only use the deferred QC feature when mixing NCQ and non-NCQ commands, i.e. ATA_DEFER_LINK. Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") Tested-by: Tommy Kelly Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit 360190bd965f93794d5f5685a6de22ce6da2b672 Author: Niklas Cassel Date: Thu May 14 09:38:59 2026 +0200 ata: libata-scsi: improve readability of ata_scsi_qc_issue() Improve readability of ata_scsi_qc_issue(). No functional changes. Tested-by: Tommy Kelly Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit f9b2d3b703d13df50c630997dfdc25648e96db0d Author: Alexander Sverdlin Date: Mon May 18 10:31:11 2026 +0200 regulator: tps65219: fix irq_data.rdev not being assigned Commit 64a6b577490c ("regulator: tps65219: Remove debugging helper function") removed the tps65219_get_rdev_by_name() helper along with the irq_data.rdev assignment that depended on it. This left irq_data.rdev uninitialized for all IRQs, causing undefined behavior when regulator_notifier_call_chain() is called from the IRQ handler: Internal error: Oops: 0000000096000004 pc : regulator_notifier_call_chain lr : tps65219_regulator_irq_handler Call trace: regulator_notifier_call_chain tps65219_regulator_irq_handler handle_nested_irq regmap_irq_thread irq_thread_fn irq_thread kthread ret_from_fork Instead of restoring a dedicated lookup array, restructure the probe function to combine regulator registration with IRQ registration in the same loop. This way the rdev returned by devm_regulator_register() is naturally available for assigning to irq_data.rdev without any auxiliary data structure. Non-regulator IRQs (SENSOR, TIMEOUT) that don't correspond to any registered regulator are registered with rdev=NULL, and the IRQ handler is protected with a NULL check to avoid crashing. Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/aBDSTxALaOc-PD7X@gaggiata.pivistrello.it/ Reported-by: Francesco Dolcini Fixes: 64a6b577490c ("regulator: tps65219: Remove debugging helper function") Signed-off-by: Alexander Sverdlin Link: https://patch.msgid.link/20260518083113.2063368-1-alexander.sverdlin@siemens.com Signed-off-by: Mark Brown commit e02b5262fd288cc235f14e12233ea54e78c04611 Author: Julien Chauveau Date: Tue Mar 24 20:30:11 2026 +0100 drm/bridge: it66121: acquire reset GPIO in probe The it66121_ctx structure has a gpio_reset field, and it66121_hw_reset() calls gpiod_set_value() on it. However, the GPIO descriptor is never acquired via devm_gpiod_get(), leaving gpio_reset as NULL throughout the driver lifetime. gpiod_set_value() silently returns when passed a NULL descriptor, so the hardware reset sequence in it66121_hw_reset() is a no-op. This leaves the chip in an undefined state at probe time, which can prevent it from responding on the I2C bus. The DT binding marks reset-gpios as a required property, so all compliant device trees provide this GPIO. Add the missing devm_gpiod_get() call after enabling power supplies and before the hardware reset, so the chip is properly reset with power applied. Fixes: 988156dc2fc9 ("drm: bridge: add it66121 driver") Cc: stable@vger.kernel.org Signed-off-by: Julien Chauveau Reviewed-by: Javier Martinez Canillas Tested-by: Javier Martinez Canillas Link: https://patch.msgid.link/20260324193011.16583-1-chauveau.julien@gmail.com Signed-off-by: Javier Martinez Canillas commit 5f41161059fd0f1bbf18c90f3180e38cc45a14eb Author: Helen Koike Date: Mon May 11 18:53:05 2026 -0300 debugobjects: Do not fill_pool() if pi_blocked_on On RT enabled kernels, fill_pool() ends up calling rtlock_lock(), which asserts if current::pi_blocked_on is set, because a task can obviously only block on one lock as otherwise the priority inheritenace chain gets corrupted. Prevent this by expanding the conditional to take current::pi_blocked_on into account. Fixes: 4bedcc28469a ("debugobjects: Make them PREEMPT_RT aware") Reported-by: syzbot+b8ca586b9fc235f0c0df@syzkaller.appspotmail.com Signed-off-by: Helen Koike Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260511215359.3351259-1-koike@igalia.com Closes: https://syzkaller.appspot.com/bug?extid=b8ca586b9fc235f0c0df commit af0c3f05866237f7592219bfe05387bc3bfc99b5 Author: Jianpeng Chang Date: Wed May 13 15:22:09 2026 +0800 dma-mapping: move dma_map_resource() sanity check into debug code dma_map_resource() uses pfn_valid() to ensure the range is not RAM. However, pfn_valid() only checks for availability of the memory map for a PFN but it does not ensure that the PFN is actually backed by RAM. On ARM64 with SPARSEMEM (128MB section granularity), MMIO addresses that share a section with RAM will falsely trigger the WARN_ON_ONCE and cause dma_map_resource() to return DMA_MAPPING_ERROR. This causes a WARNING on Raspberry Pi 4 during spi_bcm2835 probe because the SPI FIFO register (0xfe204004) falls in the same sparsemem section as the end of RAM (0xf8000000-0xfbffffff), both in section 31 (0xf8000000-0xffffffff). Move the sanity check from dma_map_resource() into debug_dma_map_phys() and replace the unreliable pfn_valid() with pfn_valid() && !PageReserved(), which correctly identifies actual usable RAM without false positives for MMIO regions that happen to have struct pages. Since dma_map_resource() is dma_map_phys(DMA_ATTR_MMIO), the check applies equally to both APIs. Any non-reserved page represents kernel memory to a sufficient degree that using DMA_ATTR_MMIO on it is almost certainly wrong and risks breaking coherency on non-coherent platforms. ZONE_DEVICE pages used for PCI P2P DMA (MEMORY_DEVICE_PCI_P2PDMA) have PageReserved set, so they will not trigger a false positive. The check no longer blocks the mapping and uses err_printk() to integrate with dma-debug filtering. Fixes: f7326196a781 ("dma-mapping: export new dma_*map_phys() interface") Reviewed-by: Robin Murphy Signed-off-by: Jianpeng Chang Reviewed-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260513072209.1486986-1-jianpeng.chang.cn@windriver.com commit 24214ad405d18efa14597d79ea737cc55c507517 Merge: 5200f5f493f79f 30792d12842901 Author: Wolfram Sang Date: Mon May 18 08:09:34 2026 +0200 Merge tag 'i2c-host-fixes-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v7.1-rc4 - tegra: - drop runtime PM reference when exiting on mutex_lock failure - preserve transfer errors when releasing the mutex commit 532d06c646a6ed5c8701eb483dd64c7002c87f71 Author: Minxi Hou Date: Mon May 18 11:15:42 2026 +0800 ALSA: hda/realtek: Add quirk for HP Z66 G6 14 laptop The HP Z66 G6 14 inch laptop uses the ALC236 codec with subsystem ID 0x103c:8df7. Without a quirk entry, the PCI SSID falls back to the generic 0x103c:0000 fixup, which does not configure the mute/micmute LED GPIOs correctly. Add the SND_PCI_QUIRK entry for this model using ALC236_FIXUP_HP_GPIO_LED, matching the surrounding HP EliteBook G12 entries (0x8dec-0x8dfe) which share the same ALC236 codec and GPIO LED layout. Signed-off-by: Minxi Hou Link: https://patch.msgid.link/20260518031542.2899188-1-houminxi@gmail.com Signed-off-by: Takashi Iwai commit c7832534a8160276cccb9a8cc8cafb5614c579d0 Author: Jiakai Xu Date: Thu May 14 08:17:51 2026 +0000 RISC-V: KVM: Fix sign extension for MMIO loads The kvm_riscv_vcpu_mmio_return() function handles MMIO read results by writing the data back to the guest register. For signed load instructions (LB, LH, LW on RV64), the value needs sign-extension from a smaller integer to unsigned long. The current code uses: (ulong)data << shift >> shift but (ulong) makes the right shift a logical shift (zero-extend) rather than an arithmetic shift (sign-extend), causing incorrect results when the MMIO device returns a negative value. For example, LB reading 0x80 would return 128 instead of -128. Fix this by casting to (long) after the left shift so that the subsequent right shift is arithmetic and correctly propagates the sign bit: (long)((ulong)data << shift) >> shift Additionally, remove the unnecessary shift assignment for LBU (unsigned byte load) since it does not need sign extension. This makes LBU consistent with LHU and LWU which already keep shift = 0. Fixes: b91f0e4cb8a3 ("RISC-V: KVM: Factor-out instruction emulation into separate sources") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Assisted-by: OpenClaw:DeepSeek-V3.2 Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260514081752.472987-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit fdb69d401967fd88d27982a7e4984b2a3a4f0314 Author: Jiakai Xu Date: Sun May 17 12:44:14 2026 +0000 RISC-V: KVM: Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler The SBI v0.1 SEND_IPI handler iterates over the hart mask and calls kvm_get_vcpu_by_id() to find the target vcpu for each set bit. When a guest provides a hart mask containing bits for non-existent vcpu_ids, kvm_get_vcpu_by_id() returns NULL, which is then unconditionally dereferenced by kvm_riscv_vcpu_set_interrupt(), causing a kernel crash. Fix this by adding a NULL check before dereferencing the return value. If the target vcpu is not found, skip it and continue processing the remaining valid harts. Fixes: a046c2d8578c ("RISC-V: KVM: Reorganize SBI code by moving SBI v0.1 to its own file") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Assisted-by: OpenClaw:DeepSeek-V3.2 Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260517124414.420919-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 0e9d0e7a7c78db7aa1c13796c65cfe0aefa54a5b Author: Osama Abdelkader Date: Thu May 14 19:36:41 2026 +0200 riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when OOM kvm_riscv_vcpu_pmu_event_info() returned -ENOMEM from the SBI extension handler, which caused kvm_riscv_vcpu_sbi_ecall() to abort KVM_RUN and surface the error to userspace instead of completing the ECALL with a negative SBI error in a0. Use SBI_ERR_FAILURE and the normal retdata path, matching other PMU handlers and kvm_sbi_ext_pmu_handler comment. Fixes: e309fd113b9f ("RISC-V: KVM: Implement get event info function") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260514173642.41448-2-osama.abdelkader@gmail.com Signed-off-by: Anup Patel commit 0835ee26938e15eccd70f7d33da386b6490f9449 Author: Osama Abdelkader Date: Thu May 14 19:36:40 2026 +0200 riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM kvm_riscv_vcpu_pmu_snapshot_set_shmem() returned -ENOMEM from the SBI extension handler, which caused kvm_riscv_vcpu_sbi_ecall() to abort KVM_RUN and surface the error to userspace instead of ompleting the ECALL with a negative SBI error in a0. Use SBI_ERR_FAILURE and the normal retdata path, matching other PMU handlers and kvm_sbi_ext_pmu_handler comment. Fixes: c2f41ddbcdd7 ("RISC-V: KVM: Implement SBI PMU Snapshot feature") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260514173642.41448-1-osama.abdelkader@gmail.com Signed-off-by: Anup Patel commit 653f17c742601004774e3f8fb79d387d5ae6103e Author: Jiakai Xu Date: Wed Apr 15 07:52:16 2026 +0000 RISC-V: KVM: Fix invalid HVA warning in steal-time recording kvm_riscv_vcpu_record_steal_time() assumes that the steal-time shared memory GPA (vcpu->arch.sta.shmem) is always backed by a valid guest memory slot. However, this assumption is not guaranteed by the KVM userspace ABI. A malicious or buggy userspace can set the STA shared memory GPA via KVM_SET_ONE_REG without establishing a corresponding memory region via KVM_SET_USER_MEMORY_REGION. In such cases, the GPA cannot be translated to a valid HVA and kvm_vcpu_gfn_to_hva() returns an error address. The current implementation incorrectly treats this as a kernel warning using WARN_ON(), which may escalate to a kernel panic when panic_on_warn is enabled. This is not a kernel bug condition but a normal invalid configuration from userspace, and should be handled gracefully. Fix it by removing WARN_ON() and treating invalid HVA as a normal failure case, resetting the STA shared memory state. Fixes: e9f12b5fff8ad0 ("RISC-V: KVM: Implement SBI STA extension") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Assisted-by: OpenClaw:DeepSeek-V3.2 Reviewed-by: Nutty Liu Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20260415075216.2757427-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 5200f5f493f79f14bbdc349e402a40dfb32f23c8 Author: Linus Torvalds Date: Sun May 17 13:59:58 2026 -0700 Linux 7.1-rc4 commit e4d3386b74fba8e01280484b67ee481ece00201e Author: Takashi Iwai Date: Sun May 17 18:51:20 2026 +0200 ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference. Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes. Reported-by: Jiakai Xu Closes: https://lore.kernel.org/20260515051516.3103036-1-xujiakai24@mails.ucas.ac.cn Fixes: cf393babb37a ("ALSA: pcm: Add copy ops with iov_iter") Cc: Link: https://patch.msgid.link/20260517165121.31399-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 608d76ec371406045c7686677870a54ccbf83eb6 Author: Aryan Kushwaha Date: Sat May 16 20:14:36 2026 +0530 ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Plus 14 The HP Pavilion Plus 14-eh0xxx with subsystem ID 103c:8a36 needs the ALC245 COEF bit mute LED quirk for the mute LED to follow the audio mute state. Add the missing quirk entry. Signed-off-by: Aryan Kushwaha Link: https://patch.msgid.link/20260516144436.35022-1-aryankushwaha3101@gmail.com Signed-off-by: Takashi Iwai commit 515e3996a4c26e7f955c13b3b19522a2c8642af9 Author: Tejun Heo Date: Sun May 17 07:43:16 2026 -1000 sched_ext: Fix deadlock between scx_root_disable() and concurrent forks scx_root_disable() enters SCX_DISABLING before it grabs scx_enable_mutex to clear __scx_switched_all and scx_switching_all. task_should_scx() short-circuits on DISABLING, so forks in that window land on fair while next_active_class() still skips fair - the new tasks stall. This can deadlock the disable path itself: scx_alloc_and_add_sched() runs under scx_enable_mutex and creates a helper kthread; if that new kthread is one of the stalled fair tasks, the mutex holder waits forever and scx_root_disable() can never make progress. Only sub-sched support exposes this, since sub-sched enables are the only path where scx_alloc_and_add_sched() can race the root's disable. Move the DISABLING check after @scx_switching_all. @scx_switching_all serves as a proxy for __scx_switched_all, so while it's set, forks keep going to scx. Once cleared, DISABLING applies normally. v2: Reword in-source comment and description. (Andrea) Fixes: 337ec00b1d9c ("sched_ext: Implement cgroup sub-sched enabling and disabling") Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit e5d505e3664bb31f59776b7b3873965228fe944f Merge: 23e6a1ca04ae44 55a0005518195f Author: Linus Torvalds Date: Sun May 17 12:02:31 2026 -0700 Merge tag 'trace-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Add more functions to the remote allowed list randconfig found more functions that are allowed for the remote code for s390 and arm. Add them to the allowed list. - Fix remote_test error path If one of the simple ring buffers fails to load, the code is supposed to rollback its initialized buffers. Instead of rolling back the buffers for the failed load, it uses the global variable and rolls back all the successfully loaded buffers. * tag 'trace-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix desc in error path for the trace remote test module ring-buffer remote: Avoid unexpected symbol warnings (arm, s390) commit 23e6a1ca04ae44806439a5a446e62e4d42e80bb4 Author: Carlos López Date: Tue May 12 12:00:41 2026 +0200 virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer to retrieve a certificate blob from the host, keeping track of its size in report_req->certs_len. However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating an invalid buffer size, as well as the expected length of such buffer. get_ext_report() subsequently updates report_req->certs_len with the host-controlled value, and cleans up the buffer by computing a page order from such value. This is incorrect, as the host-provided length may not match the page order of the original allocation, potentially resulting in corruption in the page allocator. Fix this by using alloc_pages_exact() instead, and reusing @npages to compute the size passed to free_pages_exact(). For consistency, also use @npages to compute the size when allocating the pages, even though this last change has no functional effect. Fixes: 3e385c0d6ce8 ("virt: sev-guest: Move SNP Guest Request data pages handling under snp_cmd_mutex") Signed-off-by: Carlos López Signed-off-by: Borislav Petkov (AMD) Tested-by: Michael Roth Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit e7f24a388e703e505a7f8d014a428308b35e8f94 Merge: 46cd5b22e58805 786a45757dcdf8 Author: Linus Torvalds Date: Sun May 17 11:40:18 2026 -0700 Merge tag 'x86-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: - Fix x86 boot crash for non-kjump kexecs (David Woodhouse) * tag 'x86-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kexec: Push kjump return address even for non-kjump kexec commit 201166d79fc01b607eccdddd4e1a7189f231904b Merge: a828abbb897657 511a5db3c9ec55 Author: Alexei Starovoitov Date: Sun May 17 11:15:05 2026 -0700 Merge branch 'fix-bpf_throw-global-subprogs-interaction' Kumar Kartikeya Dwivedi says: ==================== Fix bpf_throw() vs global subprogs interaction There is a bug where bpf_throw()'s reachability across global subprogs is missed by the verifier, leading to successful verification when any kernel resource or lock is held across global subprog call boundary. Fix this by effect summarization like other related side effects and propagate exception reachability into callees. Changelog: ---------- v1 -> v2 v1: https://lore.kernel.org/bpf/20260516022426.2109698-1-memxor@gmail.com * Reorder might_throw bit to avoid bpf-next conflicts. (Alexei) ==================== Link: https://patch.msgid.link/20260517075530.3461166-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 511a5db3c9ec55dd5393b8639000df080c296ef4 Author: Kumar Kartikeya Dwivedi Date: Sun May 17 09:55:29 2026 +0200 selftests/bpf: Cover global subprog exception leaks Add a verifier failure case where the caller holds a reference across a global subprog call that may throw. The program must be rejected because the exceptional path would skip the caller's reference release. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260517075530.3461166-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 3d562d35a044ae798cab421c65a116f8cedfa5d4 Author: Kumar Kartikeya Dwivedi Date: Sun May 17 09:55:28 2026 +0200 bpf: Check global subprog exception paths Global subprogs are verified independently and are not descended into when their callers are symbolically executed. This means a caller can hold references or locks across a global subprog call that may throw, while the verifier only checks the non-exceptional return path at the call site. Record whether a subprog might throw in the CFG summary pass, alongside the existing might_sleep and packet-data-changing summaries, and propagate that effect through reachable callees. When a global subprog is marked as possibly throwing, push the normal continuation and validate the exceptional path immediately at the call site, avoiding a synthetic exception state and associated special case in the pruning checks. Fixes: f18b03fabaa9 ("bpf: Implement BPF exceptions") Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260517075530.3461166-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 46cd5b22e58805b5651dfc732cd23615e940ac8d Merge: c97481ab7973ef 602d60ebae0f10 Author: Linus Torvalds Date: Sun May 17 11:07:09 2026 -0700 Merge tag 'timers-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: - Fix potential garbage reads in the vDSO gettimeofday code (Thomas Weißschuh) * tag 'timers-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: vdso/gettimeofday: Reload sequence counter after switch to time page in do_aux() commit c97481ab7973ef21084e71b8e965b51e69b574df Merge: daa3de23f9e8a6 411c1cf430392c Author: Linus Torvalds Date: Sun May 17 10:59:32 2026 -0700 Merge tag 'sched-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: - Fix ARM64-specific rseq regressions (Mark Rutland) * tag 'sched-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: arm64/entry: Fix arm64-specific rseq brokenness commit daa3de23f9e8a60cc817b0b714f6ba3b70799de2 Merge: ec296ebf6d6dff ea324444ece9f3 Author: Linus Torvalds Date: Sun May 17 10:50:13 2026 -0700 Merge tag 'ras-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull MCE fix from Ingo Molnar: - Fix an MCE polling interval adjustment regression (Borislav Petkov) * tag 'ras-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Restore MCA polling interval halving commit ec296ebf6d6dffef27ab1f01b7fd8bdd9d097a4f Merge: f7c79949bef47f 91840be8f71037 Author: Linus Torvalds Date: Sun May 17 10:34:15 2026 -0700 Merge tag 'irq-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull IRQ fixes from Ingo Molnar: - Fix use-after-free in irq_work_single() on PREEMPT_RT (Jiayuan Chen) - Don't call add_interrupt_randomness() for NMIs in handle_percpu_devid_irq() (Mark Rutland) - Remove unused function in the ath79-cpu irqchip driver causing LKP CI build warnings (Rosen Penev) - Fix IRQ allocation/teardown leakage regressions in the GICv5 irqchip driver (Sascha Bischoff) - Fix an IRQ trigger type regression in the Meson S4 SoC irqchip driver (Xianwei Zhao) - Fix CPU offlining regression in the RiscV IMSIC irqchip driver (Yong-Xuan Wang) * tag 'irq-urgent-2026-05-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT irqchip/riscv-imsic: Clear interrupt move state during CPU offlining irqchip/meson-gpio: Use the correct register in meson_s4_gpio_irq_set_type() irqchip/ath79-cpu: Remove unused function genirq/chip: Don't call add_interrupt_randomness() for NMIs irqchip/gic-v5: Allocate ITS parent LPIs as a range irqchip/gic-v5: Support range allocation for LPIs irqchip/gic-v5: Move LPI allocation into the LPI domain commit f7c79949bef47ff93167c8ae85a07ac006ed7139 Merge: 1405a07192a3c5 b69bcb13ed7024 Author: Linus Torvalds Date: Sun May 17 09:33:49 2026 -0700 Merge tag 'riscv-for-linus-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "Relatively low-impact fixes. Probably the most notable one is that we no longer ask the monitor-mode firmware to delegate misaligned access handling to the kernel by default, since the kernel code needs significant improvement to match the functionality of the firmware. This change avoids functional problems at some cost in performance, but shouldn't affect any system with misaligned access handling in hardware. - Disable satp register probing when no5lvl is specified on the kernel command line - Fix a CFI-related issue with the misaligned access speed measurement code - Reduce the CFI shadow stack size limit from 4GB to 2GB (following ARM64 GCS) - Prevent the kernel from requesting delegation of misaligned access faults unless a new Kconfig option, RISCV_SBI_FWFT_DELEGATE_MISALIGNED, is enabled. This will depend on CONFIG_NONPORTABLE until the deficiencies of the kernel misaligned access fixup code are fixed - Fix some potential uninitialized memory accesses in error paths in compat_riscv_gpr_set() and compat_restore_sigcontext() - Fix a bug in the RISC-V MIPS vendor errata patching code where a logical-and was used in place of a bitwise-and - Drop some unnecessary code in riscv_fill_hwcap_from_isa_string() - Use macros for isa2hwcap indices in riscv_fill_hwcap(), rather than open-coding them - Fix some documentation typos (one affecting 'make htmldocs')" * tag 'riscv-for-linus-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: misaligned: Make enabling delegation depend on NONPORTABLE riscv: Docs: fix unmatched quote warning riscv: cfi: reduce shadow stack size limit from 4GB to 2GB riscv: cpufeature: Use pre-defined ISA ext macros to index isa2hwcap riscv: mm: Fixup no5lvl failure when vaddr is invalid riscv: Fix register corruption from uninitialized cregs on error riscv: errata: Fix bitwise vs logical AND in MIPS errata patching Documentation: riscv: cmodx: fix typos riscv: cpufeature: Drop this_hwcap clear in T-Head vector workaround riscv: Define __riscv_copy_{,vec_}{words,bytes}_unaligned() using SYM_TYPED_FUNC_START commit 1405a07192a3c5420c5fd7437f7945ebe1e71ad7 Merge: fe6f8e913df931 873e919e310106 Author: Linus Torvalds Date: Sun May 17 09:23:28 2026 -0700 Merge tag 'hwmon-for-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - asus_atk0110, acpi_power_meter: Add missing NULL pointer checks - lm90: Fix locking and UAF issues - sy7636a: Fix sysfs attribute name in documentation * tag 'hwmon-for-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (lm90) Add lock protection to lm90_alert hwmon: (lm90) Stop work before releasing hwmon device docs: hwmon: sy7636a: fix temperature sysfs attribute name hwmon: (asus_atk0110) Check ACPI_COMPANION() against NULL hwmon: (acpi_power_meter) Check ACPI_COMPANION() against NULL commit db339b6bc9f234b4883eb02946ea01d8d9faa11c Author: Lad Prabhakar Date: Tue Apr 28 11:03:38 2026 +0100 dt-bindings: display/msm: Fix typo in clock-names property Fix the typo "clocks-names" to "clock-names" in the allOf/if conditional blocks. Fixes: 9be5c47908e66 ("dt-bindings: display/msm: expand to support MST") Fixes: 7403e87c13847 ("dt-bindings: display: msm: Fix reg ranges and clocks on Glymur") Signed-off-by: Lad Prabhakar Reviewed-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/721682/ Message-ID: <20260428100338.3179722-1-prabhakar.mahadev-lad.rj@bp.renesas.com> Signed-off-by: Rob Clark commit 4dc76c305a73bacaf330bebf723a181427bb4540 Author: Stepan Ionichev Date: Fri May 15 18:30:04 2026 +0500 auxdisplay: Kconfig: drop unneeded quotes in PANEL_BOOT_MESSAGE dep The PANEL_BOOT_MESSAGE dependency uses a quoted-string comparison against the PANEL_CHANGE_MESSAGE bool symbol: depends on PANEL_CHANGE_MESSAGE="y" This is the only such pattern under drivers/auxdisplay/ (grep shows no other Kconfig file in the tree uses depends on FOO="y" with quotes for a plain bool symbol). The quoted form is parsed by Kconfig but is not idiomatic; the common form for the same intent is the unquoted tristate-style dependency: depends on PANEL_CHANGE_MESSAGE which evaluates true when PANEL_CHANGE_MESSAGE is y or m. Since PANEL_CHANGE_MESSAGE is declared as bool (not tristate), there is no behaviour change in practice: y is the only enabled value either form can match. Drop the quoted comparison so the dependency matches the prevailing kernel Kconfig style and so it is obvious to readers that the comparison works. Suggested-by: Andy Shevchenko Link: https://lore.kernel.org/r/CAHp75VfsA_LsbEKjxoeMdbhPbWj7OHZ7=0SYNA3c=ZLj_M94Bw@mail.gmail.com Signed-off-by: Stepan Ionichev Signed-off-by: Andy Shevchenko commit a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6 Author: Stepan Ionichev Date: Thu May 14 22:43:42 2026 +0500 auxdisplay: line-display: fix OOB read on zero-length message_store() linedisp_display() unconditionally reads msg[count - 1] before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg[-1]: write(fd, "", 0); -> message_store(..., buf, count=0) -> linedisp_display(linedisp, buf, count=0) -> msg[count - 1] == '\n' ; OOB read The kernfs write buffer for that store is a 1-byte allocation (kernfs_fop_write_iter() does kmalloc(len + 1) with len == 0), so msg[-1] is a 1-byte read before the slab object. On a KASAN-enabled kernel this trips an out-of-bounds report and panics; on stock kernels it silently reads adjacent slab data and, if that byte happens to be '\n', the following count-- wraps ssize_t 0 to -1 and is then passed to kmemdup_nul(). linedisp_display() is reached from the message_store() sysfs callback (drivers/auxdisplay/line-display.c message attribute, mode 0644) and from the in-tree initial-message setup with count == -1, so the OOB path is only userspace-triggerable via zero-byte writes; vfs_write() does not short-circuit on count == 0 and kernfs_fop_write_iter() dispatches the store callback regardless. Guard the trailing-newline trim with a count check. The existing if (!count) block then takes the clear-display path unchanged. Affects every auxdisplay driver that registers via linedisp_register() / linedisp_attach(): ht16k33, max6959, img-ascii-lcd, seg-led-gpio. Fixes: 7e76aece6f03 ("auxdisplay: Extract character line display core support") Signed-off-by: Stepan Ionichev Signed-off-by: Andy Shevchenko commit 734a4e051b9767f439137940095d63afbfed0745 Author: Emmanuel Grumbach Date: Fri May 15 15:15:00 2026 +0300 wifi: iwlwifi: mld: disconnect only after 6 beacons without Rx After 4 missed beacons since last Rx, the firmware will send an NDP to the AP. If the NDP is ACK'ed, it'll reset the missed_beacons_since_last_rx counter. Disconnecting after 4 beacons doesn't give enough time to the firmware to send the NDP. Wait until we get 6 missed beacons since last Rx before disconnecting. Signed-off-by: Emmanuel Grumbach Link: https://patch.msgid.link/20260515151352.c4ed0d849f98.Iefa2e8be9edfc74683997eea60bb53c2002f31f0@changeid Signed-off-by: Miri Korenblit commit b753b3334bad7c4735b6e5face0c331d4be11dda Author: Johannes Berg Date: Fri May 15 15:14:59 2026 +0300 wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o BSS vif Clearly, from a user perspective, it must be valid to configure WoWLAN (which can include network detection) and then suspend while not connected to a network, or even without an interface at all (WoWLAN config is handled on a per-wiphy basis). Since mac80211 doesn't distinguish these cases and simply calls the driver to suspend whenever WoWLAN is configured, the driver has to cleanly handle the case where it's called for WoWLAN but no (BSS) interface exists. Remove the WARN_ON(), move the print so it doesn't get done in this case, and keep returning 1 to disconnect everything. Signed-off-by: Johannes Berg Link: https://patch.msgid.link/20260515151352.0c55d1135409.I54f8be0e2aa28cfb1cb1dcf3b2d2d8fe75b4397b@changeid Signed-off-by: Miri Korenblit commit 25e416f148f3f948638ca7c6ff63fd842d9c07ad Author: Moriya Itzchaki Date: Fri May 15 15:14:58 2026 +0300 wifi: iwlwifi: use correct function to read STEP_URM register CNVI_PMU_STEP_FLOW is a PRPH register, not a UMAC PRPH register. Use iwl_read_prph() instead of iwl_read_umac_prph() to read it correctly. Signed-off-by: Moriya Itzchaki Reviewed-by: Johannes Berg Link: https://patch.msgid.link/20260515151352.3a69fa2dbda7.I8d96635a9c06a835b05a10b6d66c8a9299676246@changeid Signed-off-by: Miri Korenblit commit fb84b5cbcaab3ca0f4e961d92a40ed7f3aac483b Author: Johannes Berg Date: Fri May 15 15:14:57 2026 +0300 wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP value (e.g. 10 for 1 Mbps CCK rate.) While introducing v3 rates, I changed the driver from internally handling v1 rates and converting to v2, to internally handling v3 and converting to v1 or v2 according to the firmware. I accordingly changed the code in iwl_mvm_mac80211_idx_to_hwrate() to no longer have different values for different APIs. This was correct. However, I later reverted this part of the change, because it was reported that I had broken beacon rates, causing a FW assert/crash. This caused TX_CMD rates to be set incorrectly, potentially causing a warning when reported back from the device as having been used. Fix this (hopefully correctly now) by handling beacon rates in the TX_CMD that's embedded in the beacon template command separately. Restore iwl_mvm_mac80211_idx_to_hwrate() to return only the rate index, not PLCP value, fixing the real TX_CMD. Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg Link: https://patch.msgid.link/20260515151351.7407e293dff7.I4ea1a17f8fe99c933d3f3e30d077cf4246125c3e@changeid Signed-off-by: Miri Korenblit commit d733ed481fd20a8e7bfe5119c4e77761ba3f87ee Author: Miri Korenblit Date: Fri May 15 15:14:56 2026 +0300 wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwl_mld_remove_link, the link->fw_id is saved at the beginning of the function so we have it after we freed the link. But the link pointer can be NULL, and is not checked when the fw_id is stored. Fix it by simply freeing the link at the end of the function. fFixes: 0e66a39f4f0e ("wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()") Reviewed-by: Johannes Berg Link: https://patch.msgid.link/20260515151351.371f40fc6711.I6a82cfe9655564e9c5731af91c36493b26b1208e@changeid Signed-off-by: Miri Korenblit commit 2becb38a3e217ef2b2f42fddd7db7a25905ec291 Author: Sheroz Juraev Date: Sun Mar 15 13:12:21 2026 +0500 wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iwl_mld_tx_from_txq() does not check this flag before dequeuing frames from mac80211 and pushing them to the transport layer. Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame, which then gets freed immediately. Under high-throughput conditions (e.g., Tailscale UDP traffic or active SSH sessions), this creates a tight dequeue-send-fail-free loop that wastes CPU cycles and generates rapid skb allocation churn, leading to memory pressure from slab fragmentation. The RX path already has this guard (iwl_mld_rx_mpdu checks in_hw_restart at rx.c:1906), and so does the TXQ allocation worker (iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to iwl_mld_tx_from_txq() to stop all TX during firmware restart. Frames left in mac80211's TXQs are naturally drained after restart completes, when queue reallocation triggers iwl_mld_tx_from_txq() via iwl_mld_add_txq_list(), or when new upper-layer traffic invokes wake_tx_queue. Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on kernel 6.19.5 where the firmware crashes approximately every 10-15 minutes under Tailscale traffic. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Cc: stable@vger.kernel.org Signed-off-by: Sheroz Juraev Link: https://patch.msgid.link/20260315081221.2678478-1-goodmartiandev@gmail.com Signed-off-by: Miri Korenblit commit 92cee08dc4f00e77fd1317e4343c5d458b0abab7 Author: Cole Leavitt Date: Sat Apr 4 22:41:44 2026 -0700 wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled When the TLC notification disables AMSDU for a TID, the MLD driver sets max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in iwl_mld_tx_tso_segment() checks for zero but not for this sentinel, allowing it to reach the num_subframes calculation: num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad) = (1 + 2) / (1534 + 2) = 0 This zero propagates to iwl_tx_tso_segment() which sets: gso_size = num_subframes * mss = 0 Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny segments from a single GSO skb. This floods the TX ring with ~1024 micro-frames (the rest are purged), creating a massive burst of TX completion events that can lead to memory corruption and a subsequent use-after-free in TCP's retransmit queue (refcount underflow in tcp_shifted_skb, NULL deref in tcp_rack_detect_loss). The MVM driver is immune because it checks mvmsta->amsdu_enabled before reaching the num_subframes calculation. The MLD driver has no equivalent bitmap check and relies solely on max_tid_amsdu_len, which does not catch the sentinel value. Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the existing check and falling back to non-AMSDU TSO segmentation. Also add a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth to catch any future code paths that produce zero through a different mechanism. Suggested-by: Miriam Rachel Korenblit Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Signed-off-by: Cole Leavitt Link: https://patch.msgid.link/20260405054145.1064152-3-cole@unwrap.rs Signed-off-by: Miri Korenblit commit 0039ac8305064e455f04d412ec3896c4fe41d04f Author: Sven Eckelmann Date: Sat May 16 22:10:08 2026 +0200 batman-adv: fix batadv_skb_is_frag() kernel-doc The kernel-doc comment for batadv_skb_is_frag() contained two errors: * the function description referred to "gain a unicast packet" instead of "contains unicast fragment". * the Return section omitted "merged" from "newly skb", leaving the description grammatically incorrect and inconsistent with the function description. Fixes: bc62216dc8e2 ("batman-adv: frag: disallow unicast fragment in fragment") Signed-off-by: Sven Eckelmann commit 55a0005518195fdea1fd2991b07644f8dc97ea8e Author: Vincent Donnefort Date: Fri May 15 21:16:16 2026 +0100 tracing: Fix desc in error path for the trace remote test module During initialisation in remote_test_load(), if one of the simple_ring_buffer fails to initialise, the error path attempts to rollback initialised buffers. However, the rollback incorrectly uses the global pointer to the trace descriptor, which is only set upon successful load completion. Fix the error path by using the local pointer to the descriptor. Link: https://patch.msgid.link/20260515201616.337469-1-vdonnefort@google.com Fixes: ea908a2b79c8 ("tracing: Add a trace remote module for testing") Reported-by: Sashiko Signed-off-by: Vincent Donnefort base-commit: 5d6919055dec134de3c40167a490f33c74c12581 Signed-off-by: Steven Rostedt commit 93d93f5f8da791e98159795c6ef683f45bd95d13 Author: Heechan Kang Date: Sun May 17 03:47:09 2026 +0900 io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it does not initialize info itself. If the wait operation completes without reporting a child event, the common wait code can return without writing wo_info. In that case io_waitid_finish() still copies iw->info to userspace, exposing stale bytes from the reused io_kiocb command storage. Clear the result storage during prep so the io_uring path matches the regular waitid syscall, which uses a zero-initialized struct waitid_info. Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support") Cc: stable@vger.kernel.org # 6.7+ Signed-off-by: Heechan Kang Link: https://patch.msgid.link/20260516184709.852814-1-gganji11@naver.com Signed-off-by: Jens Axboe commit fe6f8e913df9319db03fd107671ff02f104ca38c Merge: b6a08b017f8c77 31467b23823ffe Author: Linus Torvalds Date: Sat May 16 09:53:14 2026 -0700 Merge tag 'powerpc-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Fix preempt count leak in sysfs show paths - Fix error handling in pika_dtm_thread - Remove pmac_low_i2c_{lock,unlock}() - Enable all windfarms by default - Fix dead default for GUEST_STATE_BUFFER_TEST - Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() Thanks to Aboorva Devarajan, Ally Heev, Amit Machhiwal, Bart Van Assche, Christophe Leroy, Christophe Leroy (CS GROUP), Dan Carpenter, Gautam Menghani, Harsh Prateek Bora, Julian Braha, Krzysztof Kozlowski, Linus Walleij, Ma Ke, Ritesh Harjani (IBM), and Sayali Patil * tag 'powerpc-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() powerpc/hv-gpci: fix preempt count leak in sysfs show paths powerpc: fix dead default for GUEST_STATE_BUFFER_TEST powerpc/powermac: Remove pmac_low_i2c_{lock,unlock}() powerpc/warp: Fix error handling in pika_dtm_thread powerpc: 82xx: fix uninitialized pointers with free attribute powerpc/g5: Enable all windfarms by default commit 765aaba18413a66f6c8fe8416336ca9b3dd98a79 Author: Mihai Sain Date: Mon Mar 9 09:53:29 2026 +0200 ARM: dts: microchip: sam9x7: fix GMAC clock configuration The GMAC node incorrectly listed four clocks, including a separate tx_clk and a TSU GCK clock sourced from ID 67. According to the SAM9X7 clocking scheme, the GMAC uses only three clocks: HCLK, PCLK, and the TSU GCK derived from the GMAC peripheral clock (ID 24). Remove the unused tx_clk, update the clock-names accordingly, and correct the assigned clock to use GCK 24 instead of GCK 67. This aligns the device tree with the actual hardware clock topology and prevents misconfiguration of the GMAC clock tree. [root@SAM9X75 ~]$ cat /sys/kernel/debug/clk/clk_summary | grep gmac gmac_gclk 1 1 1 266666666 0 0 50000 Y f802c000.ethernet tsu_clk f802c000.ethernet tsu_clk gmac_clk 2 2 0 266666666 0 0 50000 Y f802c000.ethernet hclk f802c000.ethernet pclk Fixes: 41af45af8bc3 ("ARM: dts: at91: sam9x7: add device tree for SoC") Signed-off-by: Mihai Sain Link: https://lore.kernel.org/r/20260309075329.1528-5-mihai.sain@microchip.com [claudiu.beznea: massaged the patch description] Signed-off-by: Claudiu Beznea commit b6a08b017f8c7723c7e4c3fc460a3a7bf5870b2c Merge: 6916d5703ddf9a 6fd9f6e870ea28 Author: Linus Torvalds Date: Sat May 16 09:32:30 2026 -0700 Merge tag 'sound-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. All device-specific small changes: HD-audio: - Fix NULL pointer dereference in snd_hda_ctl_add() - ACPI and Kconfig fixes for Cirrus drivers - A regression fix CA0132 codec - Various device-specific quirks for HP, Lenovo, Samsung, Framework etc - Documentation path fix USB-audio: - Boundary checks for MIDI endpoint descriptors - Offload mapping error handling for Qualcomm - A new device quirk for TTGK Technology USB-C Audio - A fix for Focusrite Scarlett2 mixer" * tag 'sound-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/ca0132: Disable auto-detect on manual output select ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone ALSA: hda/cs35l56: Drop malformed default N from Kconfig ALSA: hda/realtek: fix mic boost on Framework PTL ALSA: hda/realtek: Limit mic boost on Positivo DN50E ALSA: doc: cs35l56: Update path to HDA driver source ALSA: usb-audio: qcom: Check offload mapping failures ALSA: hda/realtek: Fix Legion 7 16ITHG6 speaker amp binding ALSA: usb-audio: Add iface reset and delay quirk for TTGK Technology USB-C Audio ALSA: scarlett2: Add missing error check when initialise Autogain Status ALSA: hda: cs35l41: Put ACPI device on missing physical node ALSA: hda: cs35l56: Put ACPI device after setting companion ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans ALSA: usb-audio: Bound MIDI endpoint descriptor scans ALSA: hda/realtek: Add codec SSID quirk for Lenovo Yoga Pro 9 16IMH9 (17aa:38d5) commit 873e919e3101063a7a75989510ccfc125a4391cf Author: Guenter Roeck Date: Thu May 14 14:41:00 2026 -0700 hwmon: (lm90) Add lock protection to lm90_alert Sashiko reports: lm90_alert() executes in the smbus alert context and calls lm90_update_confreg() to disable the hardware alert line, without acquiring hwmon_lock. Concurrently, sysfs write operations (such as lm90_write_convrate) hold the hwmon_lock, temporarily modify data->config, and then restore it. If an alert interrupt occurs concurrently with a sysfs write, the sysfs path will overwrite the alert handler's modifications to data->config and the hardware register. This unintentionally re-enables the hardware alert line while the alarm is still active, causing an interrupt storm. Add the missing lock to lm90_alert() to solve the problem. Fixes: 7a1d220ccb0cc ("hwmon: (lm90) Introduce function to update configuration register") Reported-by: Sashiko Signed-off-by: Guenter Roeck commit b09a45601094c7f4ec4db8090b825fa61e169d93 Author: Guenter Roeck Date: Thu May 14 14:31:49 2026 -0700 hwmon: (lm90) Stop work before releasing hwmon device Sashiko reports: In lm90_probe(), the devm action to cancel the alert_work and report_work (lm90_restore_conf) is registered in lm90_init_client() before devm_hwmon_device_register_with_info() is called. Because devm executes cleanup actions in reverse order during module unbind or probe failure, the hwmon device is unregistered and freed first. If lm90_alert_work() or lm90_report_alarms() runs in the window between the hwmon device being freed and the delayed works being cancelled, lm90_update_alarms() will dereference the freed data->hwmon_dev here. Fix the problem by canceling the workers separately after registering the hwmon device and before registering the interrupt handler. This ensures that the workers are canceled after interrupts are disabled and before the hwmon device is released. Add "shutdown" flag to indicate that device shutdown is in progress to prevent workers from being re-armed. Fixes: f6d0775119fb9 ("hwmon: (lm90) Rework alarm/status handling") Reported-by: Sashiko Signed-off-by: Guenter Roeck commit d04a0047d619ddbc50e023aa76e4dddf86e5da3f Author: Francesco Saverio Pavone Date: Sat May 16 16:12:44 2026 +0200 ALSA: pcm_drm_eld: rate-limit ELD parsing errors Mirror of Mark Brown's ASoC: hdac_hdmi rate-limit patch (commit [lkml.kernel.org/lkml/2025/6/13/1380]) for the generic snd_parse_eld() helper used by ASoC hdmi-codec. When a HDMI sink is disconnected (e.g. a board with two HDMI outputs and only one cable), userspace audio servers like PipeWire keep probing the disconnected card and trigger: HDMI: Unknown ELD version 0 at every probe — easily 30+ messages per burst on rk3588. The same applies to malformed ELD (MNL out of range). Both conditions are expected when no sink is attached; rate-limit the dev_info() so the kernel ring buffer does not fill up. Signed-off-by: Francesco Saverio Pavone Link: https://patch.msgid.link/20260516141244.21801-1-pavone.lawyer@gmail.com Signed-off-by: Takashi Iwai commit 76824d2467feb1828b745d6add2541918d7be3da Author: Dmitry Baryshkov Date: Sat May 16 14:53:45 2026 +0300 drm/msm/snapshot: fix dumping of the unaligned regions The snapshotting code internally aligns data segment to 16 bytes. This works fine for DPU code (where most of the regions are aligned), but fails for snapshotting of the DSI data (because DSI data region is shifted by 4 bytes). Fix the code by removing length alignment and by accurately printing last registers in the region. While reworking the code also fix the 16x memory overallocation in msm_disp_state_dump_regs(). Fixes: 98659487b845 ("drm/msm: add support to take dpu snapshot") Reported-by: Salendarsingh Gaud Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/725449/ Message-ID: <20260516-msm-fix-dsi-dump-2-v2-1-9e49fb2d240e@oss.qualcomm.com> Signed-off-by: Rob Clark commit 0aacce7c32e4631c3634df5d19d30c72a3614ec9 Author: Takashi Iwai Date: Fri May 15 12:56:59 2026 +0200 ALSA: hda: Avoid quirk matching with zero PCI SSID Heiko reported that BIOS on some recent machines doesn't set up PCI SSID properly but leave with zero (e.g. on HP Dragonfly Folio 13.5 inch G3 with SSID 103c:8a05/8a06), which confuses the quirk table matching and results in the non-functional state. Fix it by skipping the PCI SSID matching when either vendor or device ID is zero and falling back to the codec SSID that is supposed to be more stable for those cases. Reported-by: Heiko Schmid Tested-by: Heiko Schmid Closes: https://lore.kernel.org/20260514133110.12302-1-heiko@future-machines.org Link: https://patch.msgid.link/20260515105700.276420-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit d0afd2cd356a2c337589ef8dfa2a224636600575 Author: Sergio Boglione Date: Sat May 16 10:16:50 2026 -0300 ALSA: hda/realtek: Add quirk for HP 250 G10 (103c:8b34) HP 250 15.6 inch G10 Notebook PC uses the same ALC236 codec as the HP 255 15.6 inch G10 (103c:8b2f) and requires the same fixup to enable the internal speaker EAPD and microphone routing. Signed-off-by: Sergio Boglione Link: https://patch.msgid.link/20260516131651.143109-1-sboglione@gmail.com Signed-off-by: Takashi Iwai commit 4372286ac774536e8e68bc6dfa0f0b0152b31fce Author: Eric Naim Date: Sat May 16 19:15:31 2026 +0800 ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS Strix Gxx5 These devices were incorrectly using the ALC287_FIXUP_TAS2781_I2C quirk leading to errors: [ 18.765990] Serial bus multi instantiate pseudo device driver TXNW2781:00: error -ENXIO: IRQ index 0 not found [ 18.768153] Serial bus multi instantiate pseudo device driver TXNW2781:00: error -ENXIO: IRQ index 0 not found [ 18.768476] Serial bus multi instantiate pseudo device driver TXNW2781:00: error -ENXIO: IRQ index 0 not found [ 18.768899] Serial bus multi instantiate pseudo device driver TXNW2781:00: Instantiated 3 I2C devices. Use the ALC287_FIXUP_TXNW2781_I2C quirk instead to fix this and restore speaker audio on affected devices. Fixes: 1e9c708dc3ae ("ALSA: hda/tas2781: Add new quirk for Lenovo, ASUS, Dell projects") Link: https://lore.kernel.org/59fd4aa4-76b9-4984-8db9-a60e55ec6e80@losource.net/ Closes: https://lore.kernel.org/CACB9z7kjs8rhLstEc8fV29BCTb5dd881JwGozoKdO5cwCb=YwQ@mail.gmail.com Signed-off-by: Eric Naim Link: https://patch.msgid.link/20260516111532.111463-1-dnaim@cachyos.org Signed-off-by: Takashi Iwai commit 7b7d6572145c1dab2dd9bfb550b188e5f0ff3c3f Author: Takashi Iwai Date: Fri May 15 10:55:58 2026 +0200 ALSA: asihpi: Fix potential OOB array access at reading cache find_control() to retrieve a cached info accesses the array with the given index blindly, which may lead to an OOB array access. Add a sanity check for avoiding it. Link: https://sashiko.dev/#/patchset/20260511230121.28606-1-rosenp%40gmail.com Cc: Link: https://patch.msgid.link/20260515085606.242284-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit e196115ec330a18de415bdb9f5071aa9f08e53ce Author: Haoze Xie Date: Fri May 15 11:19:02 2026 +0800 netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only holds references on state.in/out and bridge physdevs, so a queued bridge packet can retain a freed bridge master in skb->dev until reinjection. When the verdict is reinjected later, br_netif_receive_skb() re-enters the receive path with skb->dev still pointing at the freed bridge master, triggering a use-after-free. Store skb->dev in the queue entry, hold a reference on it for the queue lifetime, and use the saved device when dropping queued packets during NETDEV_DOWN handling. Fixes: ac2863445686 ("netfilter: bridge: add nf_afinfo to enable queuing to userspace") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Haoze Xie Signed-off-by: Ren Wei Signed-off-by: Pablo Neira Ayuso commit b2870fc21601db9133bc70c48c603b487614fa3b Author: Lorenzo Bianconi Date: Thu May 14 16:46:38 2026 +0200 netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() neigh_hh_bridge() assumes the skb always has sufficient headroom to copy the aligned L2 header. This assumption can trigger the crash reported below using the following netfilter setup: $modprobe br_netfilter $sysctl -w net.bridge.bridge-nf-call-iptables=1 $root@OpenWrt:~# nft list ruleset table ip nat { chain prerouting { type nat hook prerouting priority dstnat; policy accept; ip daddr 192.168.83.123 dnat to 192.168.83.120 } } - iperf3 client (192.168.83.119) --> bridge (192.168.83.118) --> iperf3 server (192.168.83.120) the iperf3 client is sending packet for 192.168.83.123 to the bridge device. [ 1579.036575] Unable to handle kernel write to read-only memory at virtual address ffffff8004d76ffe [ 1579.045482] Mem abort info: [ 1579.048273] ESR = 0x000000009600004f [ 1579.052024] EC = 0x25: DABT (current EL), IL = 32 bits [ 1579.057363] SET = 0, FnV = 0 [ 1579.060417] EA = 0, S1PTW = 0 [ 1579.063550] FSC = 0x0f: level 3 permission fault [ 1579.068345] Data abort info: [ 1579.071224] ISV = 0, ISS = 0x0000004f, ISS2 = 0x00000000 [ 1579.076720] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 1579.081770] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1579.087092] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000080dc4000 [ 1579.093794] [ffffff8004d76ffe] pgd=180000009ffff003, p4d=180000009ffff003, pud=180000009ffff003, pmd=180000009ffe3003, pte=0060000084d76787 [ 1579.106343] Internal error: Oops: 000000009600004f [#1] SMP [ 1579.193824] CPU: 0 UID: 0 PID: 235 Comm: napi/qdma_eth-3 Tainted: G O 6.12.57 #0 [ 1579.202614] Tainted: [O]=OOT_MODULE [ 1579.206102] Hardware name: Airoha AN7581 Evaluation Board (DT) [ 1579.211929] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1579.218889] pc : br_nf_pre_routing_finish_bridge+0x1ac/0xcc8 [br_netfilter] [ 1579.225859] lr : br_nf_pre_routing_finish_bridge+0x18c/0xcc8 [br_netfilter] [ 1579.232822] sp : ffffffc0817cba20 [ 1579.236128] x29: ffffffc0817cba20 x28: 0000000000000000 x27: ffffff8002b89000 [ 1579.243273] x26: ffffff8004d7700e x25: 0000000000000008 x24: 0000000000000000 [ 1579.250416] x23: ffffffc08179d4c0 x22: 0000000000000000 x21: ffffffc08179d4c0 [ 1579.257561] x20: ffffff8004d9b800 x19: ffffff8015010000 x18: 0000000000000014 [ 1579.264704] x17: ffffffbf9e930000 x16: ffffffc0817c8000 x15: 0000000000000070 [ 1579.271848] x14: 0000000000000080 x13: 0000000000000001 x12: 0000000000000000 [ 1579.278993] x11: ffffffc0798caae0 x10: ffffff8014db6fd8 x9 : 0000000000000000 [ 1579.286136] x8 : 0000000000000003 x7 : ffffffc08171f628 x6 : 000000001a3b83d3 [ 1579.293281] x5 : 0000000000000000 x4 : 1beb76f22fee0000 x3 : ffffff8004d7700e [ 1579.300425] x2 : 0000000000000000 x1 : ffffff8004d9b8bc x0 : ffffff80026ed000 [ 1579.307570] Call trace: [ 1579.310018] br_nf_pre_routing_finish_bridge+0x1ac/0xcc8 [br_netfilter] [ 1579.316632] br_nf_hook_thresh+0xd4/0x14bc [br_netfilter] [ 1579.322032] br_nf_hook_thresh+0x250/0x14bc [br_netfilter] [ 1579.327517] br_nf_hook_thresh+0x76c/0x14bc [br_netfilter] [ 1579.333003] br_handle_frame+0x180/0x480 [ 1579.336935] __netif_receive_skb_core.constprop.0+0x540/0xf40 [ 1579.342682] __netif_receive_skb_one_core+0x28/0x50 [ 1579.347561] process_backlog+0x98/0x1e0 [ 1579.351398] __napi_poll+0x34/0x1c4 [ 1579.354887] net_rx_action+0x178/0x330 [ 1579.358638] handle_softirqs+0x108/0x2d4 [ 1579.362560] __do_softirq+0x10/0x18 [ 1579.366051] ____do_softirq+0xc/0x20 [ 1579.369627] call_on_irq_stack+0x30/0x4c [ 1579.373550] do_softirq_own_stack+0x18/0x20 [ 1579.377734] do_softirq+0x4c/0x60 [ 1579.381050] __local_bh_enable_ip+0x88/0x98 [ 1579.385234] napi_threaded_poll_loop+0x188/0x21c [ 1579.389853] napi_threaded_poll+0x70/0x80 [ 1579.393863] kthread+0xd8/0xdc [ 1579.396918] ret_from_fork+0x10/0x20 [ 1579.400499] Code: 88dffc22 3707ffc2 f9406663 f9406684 (f81f0064) [ 1579.406589] ---[ end trace 0000000000000000 ]--- [ 1579.411209] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 1579.418083] SMP: stopping secondary CPUs [ 1579.422012] Kernel Offset: disabled Fix the issue reallocating the skb headroom if necessary in neigh_hh_bridge routine. Fixes: e179e6322ac33 ("netfilter: bridge-netfilter: Fix MAC header handling with IP DNAT") Reviewed-by: Ido Schimmel Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso commit 7f7445840b7771338618930e45ee641104b38ed8 Author: Jozsef Kadlecsik Date: Thu May 14 10:55:13 2026 +0200 netfilter: ipset: annotate "pos" for concurrent readers/writers The "pos" structure member of struct hbucket stores the first free slot in the hash bucket of a hash type of set and there are concurrent readers/writers. Annotate accesses properly. Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 2358f7427ccd6ec8867a48205d8fcec973683a3f Author: Jozsef Kadlecsik Date: Fri May 8 22:58:58 2026 +0200 netfilter: ipset: Fix data race between add and dump in all hash types When adding a new entry to the next position in the existing hash bucket, the position index was incremented too early and parallel dump could read it before the entry was populated with the value. Move the setting of the position index after populating the entry. v2: Position counting fixed, noticed by Florian Westphal. Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Reported-by: syzbot+786c889f046e8b003ca6@syzkaller.appspotmail.com Reported-by: syzbot+1da17e4b41d795df059e@syzkaller.appspotmail.com Reported-by: syzbot+421c5f3ff8e9493084d9@syzkaller.appspotmail.com Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit c0c42a0fb27144c1cd7509f94bec0d3bcca98c72 Author: Jozsef Kadlecsik Date: Thu May 14 10:55:11 2026 +0200 netfilter: ipset: Fix data race between add and list header in all hash types The "ipset list -terse" command is actually a dump operation which may run parallel with "ipset add" commands, which can trigger an internal resizing of the hash type of sets just being dumped. However, dumping just the header part of the set was not protected against underlying resizing. Fix it by protecting the header dumping part as well. Fixes: c4c997839cf9 ("netfilter: ipset: Fix parallel resizing and listing of the same set") Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 4322dcde6b4173c2d8e8e6118ed290794263bcc8 Author: Zhengchuan Liang Date: Wed May 13 15:57:17 2026 +0800 netfilter: ip6t_hbh: reject oversized option lists struct ip6t_opts stores at most IP6T_OPTS_OPTSNR option descriptors, but hbh_mt6_check() does not reject larger optsnr values supplied from userspace. Validate optsnr in the rule setup path so only match data that fits the fixed-size opts array can be installed. This follows the existing xtables pattern of rejecting invalid user-provided counts in checkentry() and keeps the packet matching path unchanged. `struct ip6t_opts` has a fixed `opts[IP6T_OPTS_OPTSNR]` array, where `IP6T_OPTS_OPTSNR` is 16, then off-by-one array access is possible: [ 137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c:110:29 [ 137.926167][ T8692] index 16 is out of range for type '__u16 [16]' Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Zhengchuan Liang Signed-off-by: Ren Wei Signed-off-by: Pablo Neira Ayuso commit a6cb3ff979855f7f0ee9450a947fe8f96c2ba37a Author: Florian Westphal Date: Tue May 12 11:30:49 2026 +0200 netfilter: nft_inner: release local_lock before re-enabling softirqs Quoting sashiko: In the error path, local_bh_enable() is called before local_unlock_nested_bh(). Fixes: ba36fada9ab4 ("netfilter: nft_inner: Use nested-BH locking for nft_pcpu_tun_ctx") Signed-off-by: Florian Westphal Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 0d3a282ab5f165fc207ff49ea5b6ad8f54616bd6 Author: Nan Li Date: Tue May 12 16:50:01 2026 +0800 netfilter: ipset: stop hash:* range iteration at end The following hash set variants: hash:ip,mark hash:ip,port hash:ip,port,ip hash:ip,port,net iterate IPv4 ranges with a 32-bit iterator. The iterator must stop once the last address in the requested range has been processed. Advancing it once more can move the traversal state past the end of the request, so a later retry may continue from an unintended position. Handle the iterator increment explicitly at the end of the loop and stop once the upper bound has been processed. This keeps the existing retry behaviour intact for valid ranges while preventing traversal from continuing past the original boundary. Fixes: 48596a8ddc46 ("netfilter: ipset: Fix adding an IPv4 range containing more than 2^31 addresses") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Nan Li Signed-off-by: Ren Wei Signed-off-by: Pablo Neira Ayuso commit b6a91f68ebfed9c38e0e9150f58a9b85da07181c Author: Yizhou Zhao Date: Tue May 12 01:30:41 2026 +0800 netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base header. This creates a desync between inner_thoff (wrong — points to extension header start) and l4proto (correct — e.g., IPPROTO_TCP), enabling transport header forgery and potential firewall bypass. This issue affects stable versions from Linux 6.2. For comparison, the normal (non-inner) IPv6 path correctly preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite ensures that ipv6_find_hdr()'s calculated transport header offset is preserved, thereby fixing the desynchronization. Fixes: 3a07327d10a0 ("netfilter: nft_inner: support for inner tunnel header matching") Cc: stable@vger.kernel.org Reported-by: Yizhou Zhao Reported-by: Yuxiang Yang Reported-by: Xuewei Feng Reported-by: Qi Li Reported-by: Ke Xu Assisted-by: GLM:5.1 Z.ai Signed-off-by: Yizhou Zhao Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 53d7fd878c28b28e03769071d1f28ef031a060ad Author: Jozsef Kadlecsik Date: Thu May 14 10:55:10 2026 +0200 netfilter: ipset: fix a potential dump-destroy race When dumping sets in order to create the proper order for restore, the list type of sets dumped last. Therefore internally we run the dumping loop twice: first with all non-list type of sets and skipping the list type ones and then secondly for the list type of sets. Sashiko noticed that there's a potential race between dump and destroy if in the first loop the last set was a list type of set: its pointer remains unreferenced and a concurrent destroy can free it. Fix the issue by resetting the variable holding the pointer. Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso commit 5522d65d81a711c60a9969d37a485d48d0ad1496 Author: Julian Anastasov Date: Sun May 10 13:46:05 2026 +0300 ipvs: avoid possible loop in ip_vs_dst_event on resizing Sashiko points out that unprivileged user can frequently call ip_vs_flush() or ip_vs_del_service() to trigger svc_table_changes updates that can lead to infinite loop in ip_vs_dst_event(). This can also happen if the user triggers frequent table resizing without deleting all services. We should also consider the possible effects if the user triggers many NETDEV_DOWN events. One way to solve it is to hold svc_resize_sem in ip_vs_dst_event() but this can block the dev notifier during the whole resizing process. Instead, use new rw_semaphore svc_replace_sem to protect just the svc_table replacement which is a short code section. Then hold svc_replace_sem in ip_vs_dst_event() to serialize with replacing the svc_table. As result, loop is avoided as there is no need to repeat the table walking from the start. By this way changes in svc_table_changes can happen only when all services are removed and all dev references dropped which allows us to abort the table walking. As IP_VS_WORK_SVC_NORESIZE is the flag used to stop the svc_resize_work under service_mutex, we should check only this flag often but not while under service_mutex. To remove the mutex_trylock() for service_mutex in the second phase where the resizer installs the new table after rehashing, we will avoid holding the service_mutex there. As result, the code in configuration context which is under service_mutex should access ipvs->svc_table under RCU because it can be replaced at anytime and released after a RCU grace period. As for ip_vs_zero_all(), it needs different solution as a table walker which can escape single RCU read-side critical section: to hold the svc_replace_sem to prevent table to be replaced. In ip_vs_status_show() prefer to hold svc_replace_sem to avoid many loops, just detect if the svc_table is removed. Prefer the newly attached table for the u_thresh/l_thresh checks to know when to grow/shrink while adding or deleting services because the new table size is based on the latest parameters. Link: https://sashiko.dev/#/patchset/20260505001648.360569-1-pablo%40netfilter.org Fixes: 840aac3d900d ("ipvs: use resizable hash table for services") Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit 1afc25ae75288b3ce59e9e5a4b448bd354c9e565 Author: Florian Westphal Date: Sat May 9 10:27:06 2026 +0200 netfilter: nf_conntrack_helper: fix possible null deref during error log Reported by sashiko: there is a small race window. If a helper module is unloaded or a userspace-defined helper is removed, nf_conntrack_helper_unregister() sets ->helper to NULL. Handle this safely. This needs a second patch to close related race during nf_conntrack_helper_unregister(). Fixes: b20ab9cc63ca ("netfilter: nf_ct_helper: better logging for dropped packets") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 79d8be262377f7112cfa3088dfc4142d5a2533f3 Author: Michael Bommarito Date: Fri May 15 11:45:31 2026 -0400 xfrm: ah: use skb_to_full_sk in async output callbacks When AH output is offloaded to an asynchronous crypto provider (hardware accelerators such as AMD CCP, or a forced-async software shim used for testing), the digest completion fires ah_output_done() / ah6_output_done() on a workqueue. The egress skb at that point may have been originated by a TCP listener sending a SYN-ACK, which sets skb->sk to a request_sock via skb_set_owner_edemux(); it may also have been originated by an inet_timewait_sock retransmit. Neither is a full struct sock, and passing the raw skb->sk to xfrm_output_resume() then forwards a non-full socket through the rest of the xfrm output chain. xfrm_output_resume() and its downstream consumers expect a full sk where they dereference at all. The natural egress path through ah_output_done() does not crash today because the consumers that read past sock_common are either gated by sk_fullsock() or short-circuit on flags that are clear on a fresh request_sock; an exhaustive walk of the 50 most plausible consumers under sch_fq, dev_queue_xmit, netfilter, tc-egress and cgroup-egress BPF found no current unguarded deref. The bug is still a real type confusion that future consumer changes could turn into a memory-corruption primitive. This is the same bug class fixed for ESP in commit 1620c88887b1 ("xfrm: Fix the usage of skb->sk"). Apply the analogous fix to AH: convert skb->sk to a full socket pointer (or NULL) via skb_to_full_sk() before handing it to xfrm_output_resume(). The same async AH callbacks were touched recently for an independent ESN-related ICV layout bug in commit ec54093e6a8f ("xfrm: ah: account for ESN high bits in async callbacks"); the sk type-confusion addressed here is orthogonal. This patch is part of an ongoing audit of the AH callback paths; an ah_output ihl-validation hardening series is also currently under review on netdev. Reproduced under UML + KASAN + lockdep with a forced-async hmac(sha1) shim that registers at priority 9999 and wraps the sync in-tree hmac-sha1-lib. With the shim loaded, ah_output_done runs on every SYN-ACK egress through a transport-mode AH SA and skb->sk arrives as a request_sock (TCP_NEW_SYN_RECV); after this patch, xfrm_output_resume() receives the listener (the result of sk_to_full_sk()) and consumer derefs land on full-sock fields as intended. Fixes: 9ab1265d5231 ("xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Signed-off-by: Steffen Klassert commit 6e4bfd9da8851f562f04503d8e43221957f96eeb Author: Jasper Smet Date: Wed May 13 07:21:37 2026 +0200 ASoC: amd: acp: Add DMI quirk for ASUS Zenbook S16 UM5606GA The ASUS Zenbook S16 (UM5606GA) with AMD Ryzen AI 9 465 (Strix Point, ACP 7.0) has a BIOS that incorrectly sets the ACPI property 'acp-audio-config-flag' to 0x10 (FLAG_AMD_LEGACY_ONLY_DMIC) for the ACP device. This prevents snd_pci_ps from probing the SoundWire bus, resulting in no internal audio (dummy output only). The hardware uses a Cirrus Logic CS42L43 (headphone/jack) and four CS35L56 smart amplifiers (speakers), all on SoundWire link 1. The corresponding machine table entry (acp70_cs42l43_l1u0_cs35l56x4_l1u0123) already exists in amd-acp70-acpi-match.c and correctly describes this topology. Add a DMI quirk to override the flag to 0, consistent with the existing entry for the HN7306EA. Signed-off-by: Jasper Smet Link: https://patch.msgid.link/20260513052137.56703-1-josbeir@gmail.com Signed-off-by: Mark Brown commit 496ba79b9496b8b3747cbc764ebd33ee7325e806 Author: Felix Gu Date: Sun May 10 01:55:37 2026 +0800 spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() When DMA read times out in mtk_snand_read_page_cache(), the original code erroneously jumped to cleanup label which skips DMA unmapping and ECC disable, causing a resource leak. Fixes: 764f1b748164 ("spi: add driver for MTK SPI NAND Flash Interface") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260510-snfi-v1-1-bc375cf1af8e@gmail.com Signed-off-by: Mark Brown commit 1afd8f06dcb1d561af3b239c5b14a88b87c13454 Author: Cássio Gabriel Date: Mon May 11 13:42:02 2026 -0300 ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging devm_kasprintf() can fail and return NULL. The legacy AMD SoundWire machine driver logs cpus->dai_name before checking the allocation result. Move the debug print after the NULL check, matching the ordering used by the SOF AMD SoundWire path after commit 5726b68473f7 ("ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails"). Fixes: 2981d9b0789c ("ASoC: amd: acp: add soundwire machine driver for legacy stack") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260511-asoc-amd-acp-sdw-legacy-dai-name-null-v1-1-dc6151b6da8a@gmail.com Signed-off-by: Mark Brown commit 7e68ba282165b8880d11eac8a816d54d449b7d80 Author: Srinivas Kandagatla Date: Thu May 14 09:06:07 2026 +0000 ASoC: qcom: q6apm-dai: Allocate an extra page for PCM buffers Some Old DSP firmware versions use 32-bit address arithmetic and size for validating the PCM buffer address range. If a buffer is allocated near the top of the 32-bit address space, arithmetic calculations involving the end address can overflow and fail checks. Work around this by increasing the preallocated PCM buffer size by one page. The DSP is still passed the usable buffer size, excluding the extra page, which prevents the firmware from seeing an end address that crosses the 32-bit boundary. This was not hit before because PCM buffer allocation and DSP-side mapping happened at different points, and the size mapped on the DSP was usually nperiods * period_size. Therefore the mapped size was unlikely to match the full preallocated buffer size exactly, although the issue was still possible. With early buffer mapping on the DSP, the full preallocated buffer is mapped during PCM creation, making the failure reproducible at boot. Fixes: 8ea6e25c8536 ("ASoC: qcom: q6apm: Add support for early buffer mapping on DSP") Cc: Stable@vger.kernel.org Reported-by: Jens Glathe Closes: https://lore.kernel.org/all/7f10abbd-fb78-4c3a-ab90-7ca78239891a@oldschoolsolutions.biz/ Signed-off-by: Srinivas Kandagatla Tested-by: Jens Glathe Link: https://patch.msgid.link/20260514090607.2435484-1-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit aaec7096f9961eb223b5b149abe9495525c205d9 Author: Michael Bommarito Date: Wed May 13 19:38:38 2026 -0400 net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately. That lets a generic-netlink reader hold a struct hsr_node pointer across hsr_dellink(). In a KASAN build, widening the reader window after hsr_get_next_node() obtains the node reproduces a slab-use-after-free when the reader copies node->macaddress_A; the freeing stack is hsr_del_nodes() from hsr_dellink(). Use list_del_rcu() and defer the free through the existing hsr_free_node_rcu() callback. This matches the lifetime rule used by the HSR prune paths, which already delete nodes with list_del_rcu() and call_rcu(). Fixes: b9a1e627405d ("hsr: implement dellink to clean up resources") Cc: stable@vger.kernel.org # v5.3+ Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260513233838.3064715-2-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski commit f13342e15deafb7538a7a8577ed5f4c33c56f64e Author: Boris Burkov Date: Tue May 12 09:55:28 2026 -0700 btrfs: swallow btrfs_record_squota_delta() ENOENT I thought that it was likely I could harden squota deletion to the point that it was impossible to end up with an extent accounted to a qgroup outliving its qgroup. Several recent bugs have made me re-consider that position. Ultimately, this is a tradeoff between short term stability and long term strictness, but I think given that there could be another layer of bugs behind the 2-3 I just fixed, I would feel much more confident in people using squotas if the risk was "your values can get a bit out of whack which you can fix by deleting stuff or disabling/re-enabling/repairing" vs "it will abort your filesystem". As the final nail in the coffin, the Meta production kernel was lacking earlier fixes from me and Qu regarding subvol qgroup lifetime, so this is what we have been testing at scale, so I think at least for now upstream should have the same extra layer of protection. Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 99aacd195141ff77295c535388888f072ec89e82 Author: Boris Burkov Date: Mon May 11 13:06:24 2026 -0700 btrfs: clamp to avoid squota underflow Simple quota accounting can undercount metadata tree block allocations in certain scenarios. When an undercounted subvolume is deleted and its tree blocks freed, the free deltas decrement rfer/excl past zero, wrapping the u64 to a value near U64_MAX. Once wrapped, can_delete_squota_qgroup() sees non-zero rfer and refuses to delete the qgroup. The qgroup becomes permanently orphaned in the quota tree, since there is no subvolume left to generate frees that would bring the counter back to zero. While we ultimately want to fix any mis-accounting at the source, it is also helpful and worthwhile to mitigate the damage by clamping rfer and excl to zero on underflow rather than allowing the u64 to wrap. This at least allows us to clean up the messed up qgroups on subvol deletion. Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit d7c600554816b8ef70adffe078a0e360c055d82b Author: Boris Burkov Date: Mon May 11 19:53:46 2026 -0700 btrfs: fix squota accounting during enable generation The first transaction that enables squotas is special and a bit tricky. We have to set BTRFS_FS_QUOTA_ENABLED after the transaction to avoid a deadlock, so any delayed refs that run before we set the bit are not squota accounted. For data this is fine, we don't get an owner_ref, so there is no real harm, it's as if the extent predated squotas. However for metadata, the tree block will have gen == enable_gen so when we free it later, we will decrement the squota accounting, which can result in an underflow. Before it is freed, btrfs check shows errors, as we have mismatched usage between the node generations/owners and the squota values. There are two angles to this fix: 1. For extents that come in delayed_refs that run during the enable_gen transaction, we must actually set enable_gen to the *next* transaction. That is the first transaction that we can really properly account in any way. 2. For extents that come in between the end of our transaction handle and the time we set the BTRFS_FS_QUOTA_ENABLED bit, we need an additional bit, BTRFS_FS_SQUOTA_ENABLING which only affects recording squota deltas, so we do pick up those extents. Otherwise, we would miss them, even for enable_gen + 1. Fixes: bd7c1ea3a302 ("btrfs: qgroup: check generation when recording simple quota delta") Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1e92637722ae4bd417f7a37e8d1485dc23b93935 Author: Boris Burkov Date: Mon May 11 13:07:11 2026 -0700 btrfs: check for subvolume before deleting squota qgroup The invariant that we want to maintain with subvolume qgroups is that the qgroup can only be deleted if there is no root. With squotas, we thought that it was sufficient to just check the usage, because we assumed that deleting a subvolume will drive it's qgroups usage to 0, and thus 0 usage implies no subvolume. However, this is false, for two reasons: - A subvol whose extents are all from before squotas was enabled. - A subvol that was created in this transaction and for which we have not yet run any delayed refs. In both cases, deleting the qgroup breaks the desired invariant and we are left with a subvolume with no qgroup but squotas are enabled. Fix this by unifying the deletion check logic between full qgroups and squotas. Squotas do all the same checks *and* the additional usage == 0 check, which is the one extra rule peculiar to squotas. Link: https://lore.kernel.org/linux-btrfs/adnBhWfJQ1n3hZC8@merlins.org/ Fixes: a8df35619948 ("btrfs: forbid deleting live subvol qgroup") Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 975e63c7a8074d83e195577b7f76dadc9a3d14b7 Author: Boris Burkov Date: Fri May 8 13:11:26 2026 -0700 btrfs: always drop root->inodes lock before cond_resched() find_first_inode() and find_first_inode_to_shrink() lock root->inodes, then loop over them, occasionally skipping some inodes. When they skip an inode, they attempt to share the cpu/lock with cond_resched_lock(). However, that has a subtle problem associated with it. cond_resched_lock() only drops the lock if it needs to actually call schedule(). With CONFIG_PREEMPT_NONE, this means the full timeslice as detected at ticks. With 8+ cpus and default tunables, this is 2.8ms. So regardless of HZ, we will run for at least 2.8ms in this loop without dropping the lock, assuming it finds no suitable inodes. If HZ is small enough, it might be even worse as the tick granularity becomes bigger than the timeslice. The knock-on effect of this is that callers to btrfs_del_inode_from_root() like kswapd trying to shrink the inode slab or userspace threads calling evict() will spin on xa_lock(&root->inodes) for 2.8ms, so the extent map shrinker dominates the lock even though ostensibly it is intending to share it. This produces memory pressure as there is only one kswapd and it runs sequentially so it can get stuck in the inode slab shrinking. To fix it, simply replace cond_resched_lock() with an open coded variant which unconditionally does unlock/lock around cond_resched. Sharing the lock is decoupled from sharing the CPU, and all the users of the lock now share it fairly. I was able to reproduce this on test systems by producing a lot of empty files (to make a big root->inodes xarray), then producing memory pressure by reading large files larger than ram, triggering kswapd and the extent_map shrinker. The lock contention is visible with perf or lockstat. This patch also relieved a user-apparent bottleneck on a production system from the original report. Tested-by: Rik van Riel Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 080ecbd05432970a8df1f70586b925a18b5ea6f4 Author: Robbie Ko Date: Fri May 8 21:42:11 2026 +0800 btrfs: mark file extent range dirty after converting prealloc extents When writing into a preallocated extent, ordered extent completion calls btrfs_mark_extent_written() to convert the file extent item from the BTRFS_FILE_EXTENT_PREALLOC type to the BTRFS_FILE_EXTENT_REG type. If the preallocated extent was created beyond i_size with fallocate keep-size, and the inode is evicted and loaded again before the write, the inode's file_extent_tree is initialized only up to i_size. The beyond i_size prealloc extent is therefore not tracked there. After a write into that extent extends i_size, btrfs_mark_extent_written() updates the file extent item, but the corresponding range is not marked dirty in the inode's file_extent_tree. This can leave disk_i_size stale when the filesystem does not use the no-holes feature, so after remount the file size can go back to the old value. The following reproducer triggers the problem: $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi mkfs.btrfs -f -O ^no-holes $DEV mount $DEV $MNT touch $MNT/file fallocate -n -l 2M $MNT/file umount $MNT mount $DEV $MNT dd if=/dev/zero of=$MNT/file bs=1M count=1 conv=notrunc ls -lh $MNT/file umount $MNT mount $DEV $MNT ls -lh $MNT/file umount $MNT Running the reproducer gives the following result: $ ./test.sh (...) 1048576 bytes (1.0 MB, 1.0 MiB) copied, 0.000596024 s, 1.8 GB/s -rw-rw-r-- 1 root root 1.0M May 8 16:34 /mnt/sdi/file -rw-rw-r-- 1 root root 0 May 8 16:34 /mnt/sdi/file Fix this by marking the written range dirty in the inode's file_extent_tree after successfully converting the prealloc extent to a regular extent. Fixes: 9ddc959e802b ("btrfs: use the file extent tree infrastructure") Reviewed-by: Filipe Manana Signed-off-by: Robbie Ko [ Minor change log updates ] Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit ae38d9179190a956e2a87a69ef1dd6f451b51c4d Author: Stefano Garzarella Date: Thu May 14 11:29:48 2026 +0200 vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. Non-final skbs carry pinned user pages with no completion tracking, so the kernel has no way to notify userspace when those pages are safe to reuse. If the loop breaks early the uarg is never allocated at all, leaking pinned pages with no completion notification. Fix this by following the approach used by TCP: allocate the zerocopy uarg (if not provided by the caller) before the send loop and attach it to every skb via skb_zcopy_set(), which takes a reference per skb. Each skb's completion properly decrements the refcount, and the notification only fires after the last skb is freed. On failure, if no data was sent, the uarg is cleanly aborted via net_zcopy_put_abort(). This issue was initially discovered by sashiko while reviewing commit 1cb36e252211 ("vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting") but was pre-existing. Fixes: 581512a6dc93 ("vsock/virtio: MSG_ZEROCOPY flag support") Closes: https://sashiko.dev/#/patchset/20260420132051.217589-1-sgarzare%40redhat.com Reported-by: Maher Azzouzi Signed-off-by: Stefano Garzarella Acked-by: Michael S. Tsirkin Acked-by: Arseniy Krasnov Link: https://patch.msgid.link/20260514092948.268720-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542 Author: Sam Daly Date: Wed May 13 18:42:53 2026 +0200 octeontx2-af: CGX: add bounds check to cgx_speed_mbps index cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values 0-15. If it returns a value >= 13, this causes an out-of-bounds array access. Add a bounds check and default to speed 0 if the index is out of range. Fixes: 61071a871ea6 ("octeontx2-af: Forward CGX link notifications to PFs") Cc: Sunil Goutham Cc: Linu Cherian Cc: Geetha sowjanya Cc: hariprasad Cc: Subbaraya Sundeep Cc: Andrew Lunn Cc: stable Signed-off-by: Sam Daly Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026051352-refined-demise-e88d@gregkh Signed-off-by: Jakub Kicinski commit cfd08f09723c5408eb3025b945fff08a99343911 Author: Dragos Tatulea Date: Wed May 13 15:45:18 2026 +0300 IB/IPoIB: ndo_set_rx_mode_async conversion The commit in the fixes tag added a warning for devices that are netdev ops locked that they should be converted to .ndo_set_rx_mode_async. IPoIB for mlx5 is such a driver which was missed during the conversion because the flow is more complex: - mlx5 part of IPoIB device was converted to ops-lock in commit [1]. - ipoib_intf_init() then overrides netdev_ops with ipoib_netdev_ops_{pf,vf}, which still wired ndo_set_rx_mode to the legacy sync path -- tripping the new warning on every probe. So now we have the following splat: netdevice: ib0 (uninitialized): ops-locked drivers should use ndo_set_rx_mode_async WARNING: net/core/dev.c:11366 at register_netdevice+0x83c/0x21d0 ... register_netdev+0x1f/0x40 ipoib_add_one+0x35c/0x880 [ib_ipoib] This patch implements .ndo_set_rx_mode_async but it simply schedules the multicast restart task like before. This is done to maintain the assumption that this task and others [2] must run on the same order workqueue to avoid racing with themselves. The race between ipoib_mcast_join_task() and ipoib_mcast_restart_task() would be the most obvious example. [1] 8f7b00307bf1, "net/mlx5e: Convert mlx5 netdevs to instance locking") [2] ipoib_mcast_join_task, ipoib_mcast_restart_task, ipoib_mcast_carrier_on_task, ipoib_reap_ah, ipoib_reap_neigh Fixes: 3cbd22938877 ("net: warn ops-locked drivers still using ndo_set_rx_mode") Signed-off-by: Dragos Tatulea Reviewed-by: Cosmin Ratiu Acked-by: Jason Gunthorpe Link: https://patch.msgid.link/20260513124519.3357165-1-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski commit 6916d5703ddf9a38f1f6c2cc793381a24ee914c6 Merge: 36343a8ff328ef dc366607c41c45 Author: Linus Torvalds Date: Fri May 15 17:00:45 2026 -0700 Merge tag 'drm-fixes-2026-05-16' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes pull, small and all over fixes, mostly xe and amdgpu, with some ttm and a core fix for the handle change pain. core: - fix for the fix for the handle change race ttm: - avoid infinite loop in swap out - avoid infinite loop in BO shrinking - convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC bridge: - imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup i915: - Skip __i915_request_skip() for already signaled requests - Fix VSC dynamic range signaling for RGB formats [dp] xe: - Madvise fix around purgeability tracking - Restore engine mask for specific blitter style - Couple UAF fixes - Drop unused ggtt_balloon field amdgpu: - Userq fixes - DCN 3.2 fix - RAS fix - GC 12 fix gma500: - oaktrail_lvds: fix i2c handling loongson: - use managed cleanup for connector polling panfrost: - handle results from reservation locking correctly qaic: - check for integer overflows in mmap logic rocket: - handle results from reservation locking correctly" * tag 'drm-fixes-2026-05-16' of https://gitlab.freedesktop.org/drm/kernel: (26 commits) drm: Replace old pointer to new idr drm/loongson: Use managed KMS polling drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init drm/gma500/oaktrail_lvds: fix hang on init failure drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup drm/xe: Drop unused ggtt_balloon field accel/qaic: Add overflow check to remap_pfn_range during mmap drm/i915/dp: Fix VSC dynamic range signaling for RGB formats drm/i915: skip __i915_request_skip() for already signaled requests drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup drm/amdgpu/gfx_v12_0: set gfx.rs64_enable from PFP header on GFX12 drm/amd/ras: Fix CPER ring debugfs read overflow drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED drm/amdgpu: fix userq hang detection and reset drm/amdgpu: remove almost all calls to amdgpu_userq_detect_and_reset_queues drm/amdgpu: rework amdgpu_userq_signal_ioctl v3 drm/amdgpu: remove deadlocks from amdgpu_userq_pre_reset drm/xe/dma-buf: fix UAF with retry loop ... commit dc366607c41c45fd0ae6f3db090f31dd611b644a Author: Edward Adam Davis Date: Wed May 13 12:30:50 2026 +0800 drm: Replace old pointer to new idr Commit 5e28b7b94408 introduced a logical error by failing to replace the newly generated IDR pointer to old id's pointer at the correct location within the "change handle" logic; this resulted in the issue reported by syzbot [1]. Specifically, the new IDR object pointer is intended to replace the original id's pointer during the normal execution flow. Additionally, an unnecessary conditional check for the ret exit path has been removed. [1] !RB_EMPTY_ROOT(&prime_fpriv->dmabufs) WARNING: drivers/gpu/drm/drm_prime.c:224 at drm_prime_destroy_file_private+0x48/0x60 drivers/gpu/drm/drm_prime.c:224, CPU#0: syz.0.17/5833 Call Trace: drm_file_free.part.0+0x7e6/0xcc0 drivers/gpu/drm/drm_file.c:269 drm_file_free drivers/gpu/drm/drm_file.c:237 [inline] drm_close_helper.isra.0+0x186/0x200 drivers/gpu/drm/drm_file.c:290 drm_release+0x1ab/0x360 drivers/gpu/drm/drm_file.c:438 Fixes: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") Reported-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d7c9eed171647e421013 Cc: stable@vger.kernel.org Tested-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Signed-off-by: Dave Airlie Link: https://patch.msgid.link/tencent_C267296443AAA4567771176886DFF364A305@qq.com commit 915fab69823a14c170dbaa3b41978768e0fe62fc Author: Michael Bommarito Date: Tue May 12 16:51:14 2026 -0400 ipv4: raw: reject IP_HDRINCL packets with ihl < 5 raw_send_hdrinc() validates that the caller-supplied IPv4 header fits within the message length: iphlen = iph->ihl * 4; err = -EINVAL; if (iphlen > length) goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ } It does not, however, reject ihl < 5. For such a packet the "if (iphlen >= sizeof(*iph))" branch is skipped, leaving the crafted iphdr untouched, but the packet is still handed to __ip_local_out() and onward. Downstream consumers that read iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4 and passes the (signed-int-negative, then cast to size_t) result to memcpy(), producing an OOB access of length close to SIZE_MAX and a host kernel panic. An IPv4 header with ihl < 5 is malformed by definition (RFC 791: "Internet Header Length is the length of the internet header in 32 bit words ... Note that the minimum value for a correct header is 5."). The kernel should not be willing to inject such a packet into its own output path. Reject "iphlen < sizeof(*iph)" alongside the existing "iphlen > length" check. This matches the principle that locally constructed packets that re-enter the IP stack must pass the same basic sanity tests that a foreign packet would be subjected to. Once this lands, the "if (iphlen >= sizeof(*iph))" wrapper around the fixup branch becomes redundant; left in place to keep the patch minimal and backport-friendly. A follow-up can unwrap it. Note that commit 86f4c90a1c5c ("ipv4, ipv6: ensure raw socket message is big enough to hold an IP header") ensures the message buffer is large enough to hold an iphdr, but does not constrain the self-reported iph->ihl. Reachability: the malformed packet source is any caller with CAP_NET_RAW, including an unprivileged process in a user+net namespace on a kernel with CONFIG_USER_NS=y. The reproduced AH crash also requires a matching xfrm AH policy on the outgoing route; a container granted CAP_NET_ADMIN can install that state and policy in its netns. Loopback bypasses xfrm_output, so the trigger uses a real netdev. Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with memcpy_orig at the crash site. Same shape reproduces inside a rootless Docker container with --cap-add NET_ADMIN on a stock distro kernel. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Suggested-by: Herbert Xu Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/77ec2b5e8111961c2c39883c92e8aa2709039c17.1778614451.git.michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski commit 36343a8ff328efd3eb5604e3567d63e6c7906deb Merge: 30e0ff6d6a8358 6ccbb613b42a1f Author: Linus Torvalds Date: Fri May 15 15:40:25 2026 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 MPAM fixes from Catalin Marinas: - Fix NULL dereference and a false-positive warning when the driver probes hardware with surprising version numbers - Fix writing values to the wrong registers when probing cache-utilisation counters. Replace 'NRDY' probing with a version that is robust for platforms where the bit is writeable by both hardware and software * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm_mpam: Check whether the config array is allocated before destroying it arm_mpam: Fix false positive assert failure during mpam_disable() arm_mpam: Improve check for whether or not NRDY is hardware managed arm_mpam: Pretend that NRDY is always hardware managed arm_mpam: Fix monitor instance selection when checking for hardware NRDY commit 30e0ff6d6a83586486674c343db5e9d933bd92e0 Merge: 3bf83e47b497d2 1bb54043ff3097 Author: Linus Torvalds Date: Fri May 15 15:22:26 2026 -0700 Merge tag 'iommu-fixes-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: "This is probably the largest fixes pull-request ever sent for IOMMU. I partially blame it on AI code review which found some issues but there is also some rework in here to fix issues in the iommu parts of PCI device reset. AMD-Vi: - Add bounds checks to debugfs and table lookups Intel VT-d: - Apply an existing quirk for Q35 graphic device - Skip dev_pasid teardown for the blocked domain to avoid out-of-bounds access - Return early if dev_pasid is missing to prevent NULL dereference or UAF Core: - Fix bugs and corner cases in pci_dev_reset_iommu_prepare/done() - Fix various issues found by AI in iommupt code MAINTAINERS email address update for RISCV IOMMU" * tag 'iommu-fixes-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: MAINTAINERS: update Tomasz Jeznach's email address iommupt: Fix the end_index calculation in __map_range_leaf() iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap iommu: Handle unmap error when iommu_debug is enabled iommu: Fix up map/unmap debugging for iommupt domains iommu: Fix loss of errno on map failure for classic ops iommu/vt-d: Avoid NULL pointer dereference or refcount corruption iommu/vt-d: Fix oops due to out of scope access iommu/vt-d: Disable DMAR for Intel Q35 IGFX iommu: Warn on premature unblock during DMA aliased sibling reset iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid() iommu: Fix nested pci_dev_reset_iommu_prepare/done() iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done() iommu: Replace per-group resetting_domain with per-gdev blocked flag iommu: Fix kdocs of pci_dev_reset_iommu_done() iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done() iommu/amd: Bounds-check devid in __rlookup_amd_iommu() iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs commit 3bf83e47b497d2630d2dcb408ec14ad95050cead Merge: b0662be9131d87 702809dabdecca Author: Linus Torvalds Date: Fri May 15 15:13:02 2026 -0700 Merge tag 'vfio-v7.1-rc4' of https://github.com/awilliam/linux-vfio Pull VFIO fixes from Alex Williamson: - Convert vfio-pci BAR resource requests and iomaps initialization from a lazy, on-demand model to an eager pre-allocation model to avoid races while preserving legacy error behavior. Fix unchecked barmap access in dma-buf export path (Matt Evans) - Introduce an implicit unsigned cast in converting vfio-pci device offsets to region indexes, closing a potential out-of-bounds access through the vfio_pci_ioeventfd() interface (Matt Evans) - Fix a dma-buf kref underflow and stuck wait_for_completion() when closing a previously revoked dma-buf (Alex Williamson) * tag 'vfio-v7.1-rc4' of https://github.com/awilliam/linux-vfio: vfio/pci: Check BAR resources before exporting a DMABUF vfio/pci: Set up BAR resources and maps in vfio_pci_core_enable() vfio/pci: Make VFIO_PCI_OFFSET_TO_INDEX() return unsigned vfio/pci: fix dma-buf kref underflow after revoke commit 396db75a1f7fb7b34b0b6101e3802bc418c4e868 Merge: 96f34d185cce4d 0a9c56dd387605 Author: Dave Airlie Date: Sat May 16 07:55:49 2026 +1000 Merge tag 'drm-misc-fixes-2026-05-15' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: bridge: - imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup gma500: - oaktrail_lvds: fix i2c handling loongson: - use managed cleanup for connector polling panfrost: - handle results from reservation locking correctly qaic: - check for integer overflows in mmap logic rocket: - handle results from reservation locking correctly ttm: - avoid infinite loop in swap out - avoid infinite loop in BO shrinking - convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260515070816.GA88575@2a02-2455-9062-2500-7dec-552d-233d-9fe0.dyn6.pyur.net commit b0662be9131d87d8858d34d6134500e109dff958 Merge: fcbf68d32ff732 c207f1d7850446 Author: Linus Torvalds Date: Fri May 15 14:52:17 2026 -0700 Merge tag 'v7.1-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix integer overflow in read - Fix smbdirect error cleanup - Multichannel reconnect fix - Add some missing defines and correct some references to protocol spec - Fix oob symlink read * tag 'v7.1-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smbdirect: Fix error cleanup in smbdirect_map_sges_from_iter() smb: client: avoid integer overflow in SMB2 READ length check cifs: client: stage smb3_reconfigure() updates and restore ctx on failure smb/client: fix possible infinite loop and oob read in symlink_data() SMB3.1.1: add missing QUERY_DIR info levels commit fcbf68d32ff732b78122690e862d260b000e19e2 Merge: a8b0b72255d09b 28b0a2ab8c82d0 Author: Linus Torvalds Date: Fri May 15 14:48:09 2026 -0700 Merge tag 'ceph-for-7.1-rc4' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "An important patch from Hristo that squashes a folio reference leak that could lead to OOM kills in CephFS and a number of miscellaneous fixes from Raphael and Slava. All but two are marked for stable" * tag 'ceph-for-7.1-rc4' of https://github.com/ceph/ceph-client: libceph: Fix potential null-ptr-deref in decode_choose_args() libceph: handle rbtree insertion error in decode_choose_args() libceph: Fix potential out-of-bounds access in osdmap_decode() ceph: put folios not suitable for writeback ceph: add ceph_has_realms_with_quotas() check to ceph_quota_update_statfs() libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size ceph: fix a buffer leak in __ceph_setxattr() libceph: Fix unnecessarily high ceph_decode_need() for uniform bucket libceph: Fix potential out-of-bounds access in crush_decode() commit 96f34d185cce4dd0967acce8830775374821f9bc Merge: 68055b285428a0 8fb70afe671cc8 Author: Dave Airlie Date: Sat May 16 07:47:06 2026 +1000 Merge tag 'drm-xe-fixes-2026-05-14' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Madvise fix around purgeability tracking (Arvind) - Restore engine mask for specific blitter style (Roper) - Couple UAF fixes (Auld) - Drop unused ggtt_balloon field (Wajdeczko) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/agXWkM3Y98bqt6TG@intel.com commit a8b0b72255d09bb12ada5620cd6ced91adde5ac8 Merge: 663ea69540c8d7 c562ba61fc5e11 Author: Linus Torvalds Date: Fri May 15 13:22:07 2026 -0700 Merge tag 'for-7.1-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fixup warning when allocating memory for readahead, __GFP_NOWARN was accidentally dropped when setting mapping constraints - in tracepoint of file sync, fix sleeping in atomic context when handling dentries - harden initial loading of block group on crafted/fuzzed images, iterate all chunk mapping entries unconditionally - fix freeing pages of submitted io after checking for errors - fix incorrect inode size after remount when using fallocate KEEP_SIZE mode (also requires disabled 'no-holes' feature) * tag 'for-7.1-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix incorrect i_size after remount caused by KEEP_SIZE prealloc gap btrfs: only release the dirty pages io tree after successful writes btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() btrfs: always pass __GFP_NOWARN from add_ra_bio_pages() btrfs: fix check_chunk_block_group_mappings() to iterate all chunk maps commit 663ea69540c8d7ba332c9a3129d7f3cf5de50d9b Merge: 56ec2b646de634 509fdeb3326be0 Author: Linus Torvalds Date: Fri May 15 13:17:46 2026 -0700 Merge tag 'xfs-fixes-7.1-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "A few bug fixes, nothing really special stands out" * tag 'xfs-fixes-7.1-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: Fix typo in comment xfs: fix the "limiting open zones" message xfs: flush delalloc blocks on ENOSPC in xfs_trans_alloc_icreate xfs: check da node block pad field during scrub xfs: fix memory leak for data allocated by xfs_zone_gc_data_alloc() xfs: fix memory leak on error in xfs_alloc_zone_info() xfs: check directory data block header padding in scrub xfs: zero directory data block padding on write verification xfs: zero entire directory data block header region at init xfs: remove the meaningless XFS_ALLOC_FLAG_FREEING commit 56ec2b646de6349c8c8c05c8df17b4d8998c467a Merge: d458a240344c43 4f8ef58c10bfe5 Author: Linus Torvalds Date: Fri May 15 13:11:41 2026 -0700 Merge tag 'nfsd-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Fixes for this release: - Correctness fix for the new sunrpc cache netlink protocol Marked for stable: - Correctness fixes for delegated attributes - Prevent an infinite loop when revoking layouts" * tag 'nfsd-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: Fix infinite loop in layout state revocation sunrpc: start cache request seqno at 1 to fix netlink GET_REQS nfsd: update mtime/ctime on COPY in presence of delegated attributes nfsd: update mtime/ctime on CLONE in presense of delegated attributes nfsd: fix file change detection in CB_GETATTR nfsd: fix GET_DIR_DELEGATION when VFS leases are disabled commit d458a240344c4369bf6f3da203f2779515177738 Merge: ee7226b2ae3bef 4141f46daa4cf1 Author: Linus Torvalds Date: Fri May 15 12:47:00 2026 -0700 Merge tag 'block-7.1-20260515' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - NVMe merge request via Keith: - Fix memory leak on a passthrough integrity mapping failure (Keith) - Hide secrets behind debug option (Hannes) - Fix pci use-after-free for host memory buffer (Chia-Lin Kao) - Fix tcp taregt use-after-free for data digest (Sagi) - Revert a mistaken quirk (Alan Cui) - Fix uevent and controller state race condition (Maurizio) - Fix apple submission queue re-initialization (Nick Chan) - Three fixes for blk-integrity, fixing an issue with the user data mapping and two problems with recomputing number of segments - Two fixes for the iov_iter bounce buffering - Fix for the handling of dead zoned write plugs - ublk max_sectors validation fix, with associated selftest addition * tag 'block-7.1-20260515' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: nvme-apple: Reset q->sq_tail during queue init block: align down bounces bios block: pass a minsize argument to bio_iov_iter_bounce selftests: ublk: cap nthreads to kernel's actual nr_hw_queues block: fix handling of dead zone write plugs block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() block: recompute nr_integrity_segments in blk_insert_cloned_request block: don't overwrite bip_vcnt in bio_integrity_copy_user() nvme: fix race condition between connected uevent and STARTED_ONCE flag Revert "nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808" nvmet-tcp: Fix potential UAF when ddgst mismatch nvme-pci: fix use-after-free in nvme_free_host_mem() nvmet-auth: Do not print DH-HMAC-CHAP secrets nvme: fix bio leak on mapping failure nvme: make prp passthrough usage less scary ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation commit ee7226b2ae3beff5d8feffa94e5fd06af6965e52 Merge: 78e8370033bfe0 f44d38a31f1802 Author: Linus Torvalds Date: Fri May 15 12:34:02 2026 -0700 Merge tag 'io_uring-7.1-20260515' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Small series sanitizing the locking done for either modifying or reading a chain of requests - If the application has a pid namespace, ensure that the sqthread pid is correctly printed in fdinfo - Fix for a hashing issue in the io-wq thread pool, which could lead to a use-after-free - Kill dead argument from io_prep_rw_pi() - Fix for a missed validation of the CQ ring head, affecting CQE refill * tag 'io_uring-7.1-20260515' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: validate user-controlled cq.head in io_cqe_cache_refill() io-wq: check that the predecessor is hashed in io_wq_remove_pending() io_uring/rw: drop unused attr_type_mask from io_prep_rw_pi() io_uring: hold uring_lock across io_kill_timeouts() in cancel path io_uring: defer linked-timeout chain splice out of hrtimer context io_uring: hold uring_lock when walking link chain in io_wq_free_work() io_uring/fdinfo: translate SqThread PID through caller's pid_ns commit 78e8370033bfe08481212ceead113ccb668b83cb Merge: 36d49bba19f2c1 905c559e51497b Author: Linus Torvalds Date: Fri May 15 12:27:03 2026 -0700 Merge tag 'hardening-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fix from Kees Cook: - gcc-plugins: Fix GCC 16 removal of CONST_CAST macros * tag 'hardening-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE commit 36d49bba19f2c19c933d13b25dcf4eb607a030b3 Merge: 4844e7c4c2697a f2e65e4e5b4b4b Author: Linus Torvalds Date: Fri May 15 12:24:09 2026 -0700 Merge tag 'docs-7.1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux Pull documentation fixes from Jonathan Corbet: "This is Willy Tarreau's new document clarifying the definition and handling of security-related bugs, which we're trying to get out there quickly on the theory that some of the bug reporters might actually read and pay attention to it" * tag 'docs-7.1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: docs: threat-model: don't limit root capabilities to CAP_SYS_ADMIN docs: security-bugs: add a link to the threat-model documentation Documentation: security-bugs: clarify requirements for AI-assisted reports Documentation: security-bugs: explain what is and is not a security bug Documentation: security-bugs: do not systematically Cc the security team commit 96350db80e0acd733e9b9ef61c0d910790b27289 Author: Arnd Bergmann Date: Fri May 15 12:57:09 2026 +0200 ring-buffer remote: Avoid unexpected symbol warnings (arm, s390) The now more verbose check found more architecture specific symbol missing from the whitelist, during randconfig testing on s390 and 32-bit arm: Unexpected symbols in kernel/trace/simple_ring_buffer.o: U __aeabi_unwind_cpp_pr1 Unexpected symbols in kernel/trace/simple_ring_buffer.o: U __s390_indirect_jump_r1 U __s390_indirect_jump_r10 U __s390_indirect_jump_r14 U __s390_indirect_jump_r2 U __s390_indirect_jump_r5 U __s390_indirect_jump_r7 U __s390_indirect_jump_r8 U __s390_indirect_jump_r9 make[6]: *** [/home/arnd/arm-soc/kernel/trace/Makefile:160: kernel/trace/simple_ring_buffer.o.checked] Error 1 Add these to the list and keep it roughly sorted into sanitizer and architecture symbols. Cc: Masami Hiramatsu Cc: Marc Zyngier Cc: Nathan Chancellor Cc: Vincent Donnefort Cc: Mathieu Desnoyers Cc: Paolo Bonzini Link: https://patch.msgid.link/20260515105717.1023007-1-arnd@kernel.org Fixes: 1211907ac0b5 ("tracing: Generate undef symbols allowlist for simple_ring_buffer") Signed-off-by: Arnd Bergmann Signed-off-by: Steven Rostedt commit 4844e7c4c2697afe63f2b925e2384e0c724cb2be Merge: 4c2cd91bff6371 4594437880ce34 Author: Linus Torvalds Date: Fri May 15 11:24:51 2026 -0700 Merge tag 'for-linus-7.1b-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - one simple cleanup - a fix for a corner case when running as Xen PV dom0 - a fix of a regression for Xen PV guests, introduced in 7.0 * tag 'for-linus-7.1b-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: x86/xen: Tolerate nested XEN_LAZY_MMU entering/leaving x86/xen: Fix xen_e820_swap_entry_with_ram() xen/arm: Replace __ASSEMBLY__ with __ASSEMBLER__ in interface.h commit 4c2cd91bff6371b58e672e8791c3bfa70c1b821f Merge: fd6b56615696c2 2997606dd17729 Author: Linus Torvalds Date: Fri May 15 11:12:54 2026 -0700 Merge tag 'platform-drivers-x86-v7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - asus-nb-wmi: - Use existing keyboard quirk for ASUS Zenbook Duo UX8407AA - hp-wmi: - Add support for Victus 16-r0xxx (8BC2) - intel/vsec_tpmi: - Move debugfs register before creating devices - Prevent fault during unbind - lenovo-wmi-*: - Fix memory leak in lwmi_dev_evaluate_int() - Balance IDA id allocation and free - Balance component bind and unbind - Prevent sending uninitialized WMI arguments to the device - Decouple lenovo-wmi-gamezone and lenovo-wmi-other to simplify module dependency graph - Limit adding attributes to supported devices - samsung-galaxybook: - Handle kbd backlight, mic mute and camera block hotkeys * tag 'platform-drivers-x86-v7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8407AA platform/x86: lenovo-wmi-other: Limit adding attributes to supported devices platform/x86: lenovo-wmi-other: Add Attribute ID helper functions platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers platform/x86: lenovo: Decouple lenovo-wmi-gamezone and lenovo-wmi-other platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members platform/x86: lenovo-wmi-other: Zero initialize WMI arguments platform/x86: lenovo-wmi-other: Balance component bind and unbind platform/x86: lenovo-wmi-other: Balance IDA id allocation and free platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() platform/x86: hp-wmi: Add support for Victus 16-r0xxx (8BC2) platform/x86/intel/tpmi/plr: Prevent fault during unbind platform/x86: intel: Add notifiers support platform/x86: intel: Move debugfs register before creating devices platform/x86: samsung-galaxybook: Handle ACPI hotkey notifications platform/x86: samsung-galaxybook: Refactor camera lens cover input device commit ed831e7ea1a860bdbab3eadeb95f7f73e9d212df Author: Florian Fainelli Date: Wed May 6 09:45:37 2026 -0700 PCI: brcmstb: Assign pcie->gen from of_pci_get_max_link_speed() After commit 03f920936977 ("PCI: controller: Validate max-link-speed"), pcie->gen stopped being assigned and as a result the established PCIe link would stop supporting Gen3 speeds on 2712 since pcie->gen is used to populate LnkCntl2 and LnkCap in brcm_pcie_set_gen(). If the 'max-link-speed' property is not specified, or it exceeds Gen3, resort to the HW defaults. Link: https://github.com/raspberrypi/linux/issues/7343 Reported-by: Dom Cobley Reported-by: Phil Elwell Fixes: 03f920936977 ("PCI: controller: Validate max-link-speed") Signed-off-by: Florian Fainelli Signed-off-by: Bjorn Helgaas Reviewed-by: Hans Zhang <18255117159@163.com> Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260506164537.103196-1-florian.fainelli@broadcom.com commit fd6b56615696c2addca7b43c862b21a9a386c116 Merge: 70eda68668d147 d1fa83ecac3109 Author: Linus Torvalds Date: Fri May 15 10:38:37 2026 -0700 Merge tag 'v7.1-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix potential dead-lock in rhashtable when used by xattr - Avoid calling kvfree on atomic path in rhashtable * tag 'v7.1-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: rhashtable: Add bucket_table_free_atomic() helper mm/slab: Add kvfree_atomic() helper rhashtable: drop ht->mutex in rhashtable_free_and_destroy() commit ccd25890f73c082fe2657ed227b497d6ac5fdc40 Author: Jens Axboe Date: Fri May 15 10:19:09 2026 -0600 io_uring/net: punt IORING_OP_BIND async if it needs file create For two reasons: 1) An opcode cannot block inside io_uring_enter() doing submissions, as it'll stall the submission side pipeline. 2) Ending up in sb_start_write() -> __sb_start_write() -> percpu_down_read_freezable() introduces a new lockdep edge, which it correctly complains about. Check if the socket type is AF_UNIX and has a non-empty pathname. If it does, mark it REQ_F_FORCE_ASYNC to punt the submission to io-wq rather than attempt to do it inline. Fixes: 7481fd93fa0a ("io_uring: Introduce IORING_OP_BIND") Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit a828abbb897657451d96ad7bf20f1893ac983bb9 Author: Arnd Bergmann Date: Fri May 15 13:32:32 2026 +0200 bpf: make bpf_session_is_return() reference optional Building without CONFIG_BPF_EVENTS produces a build-time warning: WARN: resolve_btfids: unresolved symbol bpf_session_is_return The function is actually defined in kernel/trace/bpf_trace.o, which is built conditionally based on configuration. Make the reference to this function conditional as well, as is already done in the bpf verifier for other functions. Fixes: 8fe4dc4f6456 ("bpf: change prototype of bpf_session_{cookie,is_return}") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20260515113242.2706303-1-arnd@kernel.org Signed-off-by: Alexei Starovoitov commit 3392291fc509d8ad6e4ad90f15b0a193f721cbc9 Author: Daniel J Blueman Date: Fri May 8 14:57:21 2026 +0800 drm/msm: Fix shrinker deadlock With PROVE_LOCKING on an Snapdragon X1 and VM reclaim pressure, we see: ====================================================== WARNING: possible circular locking dependency detected 7.0.0-debug+ #43 Tainted: G W ------------------------------------------------------ kswapd0/82 is trying to acquire lock: ffff800080ec3870 (reservation_ww_class_acquire){+.+.}-{0:0}, at: msm_gem_shrinker_scan+0x17c/0x400 [msm] but task is already holding lock: ffffc31709b263b8 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x88/0x988 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (fs_reclaim){+.+.}-{0:0}: __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 fs_reclaim_acquire+0xd0/0xf0 dma_resv_lockdep+0x224/0x348 do_one_initcall+0x84/0x5d0 do_initcalls+0x194/0x1d8 kernel_init_freeable+0x128/0x180 kernel_init+0x2c/0x160 ret_from_fork+0x10/0x20 -> #1 (reservation_ww_class_mutex){+.+.}-{4:4}: __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 dma_resv_lockdep+0x1a8/0x348 do_one_initcall+0x84/0x5d0 do_initcalls+0x194/0x1d8 kernel_init_freeable+0x128/0x180 kernel_init+0x2c/0x160 ret_from_fork+0x10/0x20 -> #0 (reservation_ww_class_acquire){+.+.}-{0:0}: check_prev_add+0x114/0x790 validate_chain+0x594/0x6f0 __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 drm_gem_lru_scan+0x1ac/0x440 msm_gem_shrinker_scan+0x17c/0x400 [msm] do_shrink_slab+0x150/0x4a0 shrink_slab+0x144/0x460 shrink_one+0x9c/0x1b0 shrink_many+0x27c/0x5c0 shrink_node+0x344/0x550 balance_pgdat+0x2c0/0x988 kswapd+0x11c/0x318 kthread+0x10c/0x128 ret_from_fork+0x10/0x20 other info that might help us debug this: Chain exists of: reservation_ww_class_acquire --> reservation_ww_class_mutex --> fs_reclaim Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(reservation_ww_class_mutex); lock(fs_reclaim); lock(reservation_ww_class_acquire); *** DEADLOCK *** 1 lock held by kswapd0/82: #0: ffffc31709b263b8 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x88/0x988 stack backtrace: CPU: 4 UID: 0 PID: 82 Comm: kswapd0 Tainted: G W 7.0.0-debug+ #43 PREEMPT(full) Tainted: [W]=WARN Hardware name: LENOVO 21BX0016US/21BX0016US, BIOS N3HET94W (1.66 ) 09/15/2025 Call trace: show_stack+0x20/0x40 (C) dump_stack_lvl+0x9c/0xd0 dump_stack+0x18/0x30 print_circular_bug+0x114/0x120 check_noncircular+0x178/0x198 check_prev_add+0x114/0x790 validate_chain+0x594/0x6f0 __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 drm_gem_lru_scan+0x1ac/0x440 msm_gem_shrinker_scan+0x17c/0x400 [msm] do_shrink_slab+0x150/0x4a0 shrink_slab+0x144/0x460 shrink_one+0x9c/0x1b0 shrink_many+0x27c/0x5c0 shrink_node+0x344/0x550 balance_pgdat+0x2c0/0x988 kswapd+0x11c/0x318 kthread+0x10c/0x128 ret_from_fork+0x10/0x20 kswapd0 holding fs_reclaim calls the MSM shrinker, which calls dma_resv_lock. This in turn acquires fs_reclaim. Fix this deadlock by using dma_resv_trylock() instead, dropping the subsequently unused passed wait-wound lock 'ticket'. Cc: stable@vger.kernel.org Signed-off-by: Daniel J Blueman Fixes: fe4952b5f27c ("drm/msm: Convert vm locking") Patchwork: https://patchwork.freedesktop.org/patch/723564/ Message-ID: <20260508065722.18785-1-daniel@quora.org> [rob: fixup compile errors, replace lockdep splat with something legible] Signed-off-by: Rob Clark commit 439e16c91aeeff2c7b503b317ccce2458a021191 Author: Hans Zhang <18255117159@163.com> Date: Fri May 15 23:36:35 2026 +0800 MAINTAINERS: Remove Jianjun Wang as PCIe mediatek maintainer Email to Jianjun Wang bounces with error: "550 Relaying mail to jianjun.wang@mediatek.com is not allowed". Remove the address to avoid sending future kernel maintenance queries to an unreachable destination. The MediaTek PCIe driver remains supported by Ryder Lee. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260515153635.136054-1-18255117159@163.com commit 3f9ed5f5aa9ecffd284218fffd6abc29617f51d5 Author: Uwe Kleine-König (The Capable Hub) Date: Tue Apr 28 16:45:53 2026 +0200 drm/msm: Don't use UTS_RELEASE directly UTS_RELEASE evaluates to a static string and changes quite easily (e.g. uncommitted changes in the source tree or new commits). So when checking if a patch introduces changes to the resulting binary each usage of UTS_RELEASE is source of annoyance. Instead of using UTS_RELEASE directly use init_utsname()->release which evaluates to the same string but with that a change of UTS_RELEASE doesn't affect msm_disp_snapshot_util.o or msm_gpu.o. Signed-off-by: Uwe Kleine-König (The Capable Hub) Patchwork: https://patchwork.freedesktop.org/patch/721948/ Message-ID: <20260428144553.1103785-2-u.kleine-koenig@baylibre.com> Signed-off-by: Rob Clark commit 8a220d1c312c66194f4a33dd52d1fba42bc2b341 Author: Hongling Zeng Date: Wed May 13 18:34:06 2026 +0800 cachefiles: Fix error return when vfs_mkdir() fails When vfs_mkdir() fails, the error code is not extracted from the returned error pointer. This causes mkdir_error to be reached with ret=0, which leads to returning ERR_PTR(0) (NULL) instead of a proper error pointer. Fix this by extracting the error code from the error pointer when vfs_mkdir() fails. Fixes: 406fad7698f5 ("cachefiles: Fix oops in vfs_mkdir from cachefiles_get_directory") Signed-off-by: Hongling Zeng Link: https://patch.msgid.link/20260513103406.202320-1-zenghongling@kylinos.cn Signed-off-by: Christian Brauner commit 329db447f8f02e82ff3acf130c892e1a4063d493 Merge: b27bb2bf7711b0 422b5bbf333f75 Author: Greg Kroah-Hartman Date: Fri May 15 13:45:33 2026 +0200 Merge tag 'iio-fixes-for-7.1a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: iio-fixes-for-7.a IIO: 1st set of fixes for the 7.1 cycle Usual mixed bag of ancient issues and more recent. Lots of new contributors this cycle and some of that work has uncovered bugs in the code they were looking at. core,buffer - Add missing dma_fence_put() - hw-consumer - Fix a use after free in cleaning up a list. core,inkern - Fix return value handling in iio_read_channel_processed_scale() that meant a correct result was treated as an error. adi,ad3530r - Fix powerdown mode strings for AD3531 and AD3531R. adi,ad4695 - Fix ordering so by the time device transitions to offload mode all setup transfers are done. This avoids issues with offload controllers that cannot handle normal transfers after offload has begun. adi,ad5686 - Fix wrong initialization of reference bit for single channel parts. - Fix off by one in check on input raw value adi,adis16260 - Fix division by zero triggerable from sysfs. adi,adis16550 - Fix a stack leak to userspace. amlogic,meson-adc - Fix a buffer allocation leak in an error path. bosch,bmp280 - Fix a stack leak to userspace. capella,cm3323 - Fix wrong return value rather than register value being written data->reg_conf on write. maxim,max5821 - Check correct length i2c_master_send() in max5821_sync_powerdown_mode(). mediatek,mt6359 - Fix potential uninitialized value. nuvoton,npcm_adc - Fix unbalance clk_disable_unprepare() nxp,sar-adc - Avoid a division by zero if the common clock framework is disabled. - Fix a division by zero triggerable from sysfs. - Ensure all of struct dma_slave_config is initialized. qcom,spmi-adc-gen3 - Fix an off by one that leads to an out of bounds array read. samsung,ssp_sensors - Ensure work is cancelled during remove to avoid use after free. sensiron,scd30 - Fix a division by zero triggerable from sysfs. st,lsm6dsx - Fix a stack leak to userspace. st,magn - Fix default value for data ready pin selection for devices that have no data ready pin selection. vishay,veml6070 - Close a resource leak in an error path. winsen,mhz19b - Reject over-sized serial messages from device. xilinx,xadc - Fix sequencer handling for dual MUX cases * tag 'iio-fixes-for-7.1a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (31 commits) iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw iio: gyro: itg3200: fix i2c read into the wrong stack location iio: dac: ad5686: fix powerdown control on dual-channel devices iio: dac: ad5686: acquire lock when doing powerdown control iio: temperature: tsys01: fix broken PROM checksum validation iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings iio: buffer: hw-consumer: fix use-after-free in error path iio: dac: ad5686: fix input raw value check iio: dac: ad5686: fix ref bit initialization for single-channel parts iio: ssp_sensors: cancel delayed work_refresh on remove iio: adc: meson-saradc: fix calibration buffer leak on error iio: dac: max5821: fix return value check in powerdown sync iio: adc: mt6359: fix unchecked return value in mt6358_read_imp iio: adc: qcom-spmi-adc5-gen3: Fix off by one in adc5_gen3_get_fw_channel_data() iio: imu: adis16550: fix stack leak in trigger handler iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer iio: pressure: bmp280: fix stack leak in bmp580 trigger handler iio: adc: nxp-sar-adc: zero-initialize dma_slave_config iio: light: cm3323: fix reg_conf not being initialized correctly iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL ... commit 422b5bbf333f75fb486855ad0eedc23cf21f3277 Author: Salah Triki Date: Thu May 7 20:07:51 2026 +0100 iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw The driver proceeds to the reception phase even if the preceding transmission fails. This uses a goto error label for an early bail out and ensures the mutex is properly unlocked in case of failure. Fixes: ffd8a6e7a778 ("iio: adc: Add viperboard adc driver") Signed-off-by: Salah Triki Reviewed-by: Joshua Crofts Reviewed-by: Maxwell Doose Reviewed-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit 6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae Author: David Carlier Date: Tue May 5 14:37:48 2026 +0100 iio: gyro: itg3200: fix i2c read into the wrong stack location itg3200_read_all_channels() takes `__be16 *buf' as a parameter and fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the parameter (a pointer), `&buf' is the address of the local pointer slot on the stack of itg3200_read_all_channels(), not the address of the caller's scan buffer. The (char *) cast hides the type mismatch. i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16) = 8 bytes into the parameter's stack slot, which is discarded when the function returns. The caller's scan buffer in itg3200_trigger_handler() is never written to, so iio_push_to_buffers_with_timestamp() pushes uninitialised stack contents to userspace via /dev/iio:deviceX every scan -- both a functional bug (no actual gyroscope or temperature data is delivered through the triggered buffer) and an information leak. The non-buffered read_raw() path is unaffected: it goes through itg3200_read_reg_s16() which uses `&out' on a local s16 value, where that is correct. Drop the spurious `&' so the i2c read writes into the caller's buffer. Fixes: 9dbf091da080 ("iio: gyro: Add itg3200") Cc: stable@vger.kernel.org Signed-off-by: David Carlier Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 8aeaf25a85263a7a43357e16ad78ab969f6f8aeb Author: Rodrigo Alencar Date: Tue May 5 13:35:05 2026 +0100 iio: dac: ad5686: fix powerdown control on dual-channel devices Fix powerdown control by using a proper bit shift for the powerdown mask values. During initialization, powerdown bits are initialized so that unused bits are set to 1 and the correct bit shift is used. Dual-channel devices use one-hot encoding in the address and that reflects on the position of the powerdown bits, which are not channel-index based for that case. Quad-channel devices also use one-hot encoding for the channel address but the result of log2(address) coincides with the channel index value. Mask as 0x3U is used rather than 0x3, because shift can reach value of 30 (last channel of a 16-channel device), which would mess with the sign bit. The issue was introduced when first adding support for dual-channel devices, which overlooked powerdown control differences. Fixes: 7dc8faeab3e3 ("iio: dac: ad5686: add support for AD5338R") Signed-off-by: Rodrigo Alencar Cc: Signed-off-by: Jonathan Cameron commit 5237c3175cae5ab05f18878cec3301a04403859e Author: Rodrigo Alencar Date: Tue May 5 13:35:04 2026 +0100 iio: dac: ad5686: acquire lock when doing powerdown control Protect access of pwr_down_mode and pwr_down_mask fields with existing mutex lock. Each channel exposes their own attributes for controlling powerdown modes and powerdown state. This fixes potential race conditions as those the write functions perform non-atomic read-modify-write operations to those pwr_down_* fields. This issue exists since the ad5686 driver was first introduced. Fixes: c2f37c8dcadc ("iio: dac: New driver for AD5686R, AD5685R, AD5684R Digital to analog converters") Signed-off-by: Rodrigo Alencar Cc: Signed-off-by: Jonathan Cameron commit 4701e471c16866e7aa8f5e6a3a6b0d31e097e2c9 Author: Salah Triki Date: Tue May 5 08:10:24 2026 +0100 iio: temperature: tsys01: fix broken PROM checksum validation The current implementation of tsys01_crc_valid() incorrectly sums the first word (n_prom[0]) repeatedly instead of iterating over the 8 words retrieved from the PROM. This leads to a checksum mismatch and probe failure on hardware. According to the TSYS01 datasheet, the PROM consists of 8 words. A valid check must iterate through all 8 words to verify the integrity of the calibration data. The current driver only checks the first word 8 times. Note: This fix was identified during a code audit and is based on datasheet specifications. It has not been tested on real hardware. Fixes: 43e53407f680 ("Add tsys01 meas-spec driver support") Signed-off-by: Salah Triki Cc: Signed-off-by: Jonathan Cameron commit ebd250c2581ec46c64c73fdfa918c9a7f757505e Author: Kim Seer Paller Date: Tue May 5 12:34:32 2026 +0800 iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings The AD3531/AD3531R has different output operating modes from the AD3530/AD3530R. According to the AD3531/AD3531R datasheet, the powerdown modes are: 01: 500 Ohm output impedance 10: 3.85 kOhm output impedance 11: 16 kOhm output impedance The driver currently uses the AD3530R modes (1k, 7.7k, 32k) for all variants, which is incorrect for AD3531/AD3531R. Add AD3531R-specific powerdown mode strings and assign them to the AD3531/AD3531R chip variants. Fixes: 93583174a3df ("iio: dac: ad3530r: Add driver for AD3530R and AD3531R") Signed-off-by: Kim Seer Paller Cc: Signed-off-by: Jonathan Cameron commit 6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4 Author: Felix Gu Date: Thu Apr 30 21:29:06 2026 +0800 iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer. Fix this by using list_for_each_entry_safe(). Fixes: 48b66f8f936f ("iio: Add hardware consumer buffer support") Reported-by: sashiko Closes: https://sashiko.dev/#/patchset/20260427-iio_buf-v1-1-2bbdac844647%40gmail.com Signed-off-by: Felix Gu Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Reviewed-by: Maxwell Doose Cc: Signed-off-by: Jonathan Cameron commit d01220ee5e43c65a206df827b39bf5cf5f7b9dce Author: Rodrigo Alencar Date: Fri May 1 10:14:55 2026 +0100 iio: dac: ad5686: fix input raw value check Fix range check for input raw value, which is off by one, i.e., for a 10-bit DAC the max valid value is 1023, but 1 << 10 equals 1024, which passes the previous check, allowing an out-of-range write. The issue exists since the ad5686 driver was first introduced. Fixes: c2f37c8dcadc ("iio: dac: New driver for AD5686R, AD5685R, AD5684R Digital to analog converters") Reviewed-by: Andy Shevchenko Signed-off-by: Rodrigo Alencar Cc: Signed-off-by: Jonathan Cameron commit ecae2ae606d493cf11457946436335bd0e726663 Author: Rodrigo Alencar Date: Fri May 1 10:14:54 2026 +0100 iio: dac: ad5686: fix ref bit initialization for single-channel parts The reference bit position was ignored when writing the register at the probe() function (!!val was used). When such bit is 1, internal voltage reference is disabled so that an external one can be used. For multi-channel devices, bit 0 of the Internal Reference Setup command behaves the same way, so AD5686_REF_BIT_MSK is created. The issue exists since support for single-channel devices were first introduced. Fixes: be1b24d24541 ("iio:dac:ad5686: Add AD5691R/AD5692R/AD5693/AD5693R support") Reviewed-by: Andy Shevchenko Signed-off-by: Rodrigo Alencar Cc: Signed-off-by: Jonathan Cameron commit eedf7602fbd929e97e0c480da501dc7a34beb2a8 Author: Sanjay Chitroda Date: Sun Apr 26 14:47:04 2026 +0530 iio: ssp_sensors: cancel delayed work_refresh on remove The work_refresh may still be pending or running when the device is removed, cancel the delayed work_refresh in remove path. Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver") Signed-off-by: Sanjay Chitroda Cc: Signed-off-by: Jonathan Cameron commit ba121d7582361fe74405f32724976aeff5c35177 Author: Felix Gu Date: Mon Apr 27 19:26:31 2026 +0800 iio: adc: meson-saradc: fix calibration buffer leak on error meson_sar_adc_temp_sensor_init() allocates a buffer with nvmem_cell_read(), but the old code leaked it if syscon_regmap_lookup_by_phandle() failed. Fix this by adding missing kfree(buf). Fixes: d6f2eac64403 ("iio: adc: meson: no devm for nvmem_cell_get") Signed-off-by: Felix Gu Signed-off-by: Jonathan Cameron commit d0a228d903425e653f18a4341e60c0538afb6d41 Author: Salah Triki Date: Mon Apr 27 22:33:19 2026 +0100 iio: dac: max5821: fix return value check in powerdown sync The function max5821_sync_powerdown_mode() returned the result of i2c_master_send() directly. If a partial transfer occurred, it would be incorrectly treated as a success by the caller. While the caller currently handles the positive return value of 2 as success, this patch refactors the function to return 0 on full success and -EIO on short writes. This ensures robust error handling for incomplete transfers and improves code maintainability by using sizeof(outbuf). Fixes: 472988972737 ("iio: add support of the max5821") Signed-off-by: Salah Triki Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit f9bbd943c34a9ad60e593a4b99ce2394e4e2381b Author: Salah Triki Date: Mon Apr 27 21:12:38 2026 +0100 iio: adc: mt6359: fix unchecked return value in mt6358_read_imp In mt6358_read_imp(), the variable val_v is passed to regmap_read() but the return value is not checked. If the read fails, val_v remains uninitialized and its random stack content is subsequently reported as a measurement result. Initialize val_v to zero to ensure a predictable value is reported in case of bus failure and to prevent potential stack data leakage. This also satisfies static analyzers that might otherwise flag the variable as used uninitialized. Fixes: 3587914bf61d ("iio: adc: Add support for MediaTek MT6357/8/9 Auxiliary ADC") Signed-off-by: Salah Triki Cc: Signed-off-by: Jonathan Cameron commit 5ace794c3ded38038a1f97f9ea26b9a8c835c111 Author: Dan Carpenter Date: Fri Apr 10 13:12:13 2026 +0300 iio: adc: qcom-spmi-adc5-gen3: Fix off by one in adc5_gen3_get_fw_channel_data() The > in "if (chan > ADC5_MAX_CHANNEL)" should be >= to prevent an out of bound read of the adc->data->adc_chans[] array. Fixes: baff45179e90 ("iio: adc: Add support for QCOM PMIC5 Gen3 ADC") Signed-off-by: Dan Carpenter Reviewed-by: Konrad Dybcio Signed-off-by: Jonathan Cameron commit 474f8928d50b09f7dcf507049f08732640b88b49 Author: Greg Kroah-Hartman Date: Thu Apr 9 15:40:49 2026 +0200 iio: imu: adis16550: fix stack leak in trigger handler adis16550_trigger_handler() declares the scan data array on the stack without initializing it. The memcpy() at the bottom fills only the first 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and iio_push_to_buffers_with_timestamp() writes the s64 timestamp at the 8-byte-aligned offset 32. Bytes 28-31 remain uninitialized stack data which leaks to userspace on ever trigger. Fix this all by just zero-initializing the structure on the stack. Cc: Lars-Peter Clausen Cc: Michael Hennerich Cc: Jonathan Cameron Cc: David Lechner Cc: "Nuno Sá" Cc: Andy Shevchenko Fixes: e4570f4bb231 ("iio: imu: adis16550: align buffers for timestamp") Cc: stable Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit c9d8e9adaa63150ef7e833480b799d0bab83a276 Author: Greg Kroah-Hartman Date: Thu Apr 9 15:40:48 2026 +0200 iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer The tagged FIFO path declares iio_buff on the stack with __aligned(8) but no initializer, but there is a hole in the structure, which will then leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be copied, but the space between that and the timestamp are not initialized. Commit c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak issues") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan, but for the tagged path it only added the alignment qualifier and not the initializer :( Fix this by just zero-initializing the structure on the stack. Cc: Lorenzo Bianconi Cc: Jonathan Cameron Cc: David Lechner Cc: "Nuno Sá" Cc: Andy Shevchenko Fixes: c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak issues") Cc: stable Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit 387c86b582e0782ab332e7bfcd4e6e3f93922961 Author: Greg Kroah-Hartman Date: Thu Apr 9 15:40:47 2026 +0200 iio: pressure: bmp280: fix stack leak in bmp580 trigger handler bmp580_trigger_handler() declares its scan buffer on the stack without an initializer and then memcpy()s 3 bytes of 24-bit sensor data into each 4-byte __le32 field. The high byte of comp_temp and comp_press is left uninitialized, and the channel storagebits is 32, so two bytes of stack are pushed to userspace per scan. This is a regression from when the buffer lived in the private data, the move to a stack-local struct dropped the implicit zeroing. bme280_trigger_handler() was fixed up to handle this bug, but this driver was not fixed because there was no padding hole, but rather a short-fill issue. Fix this all by just zero-initializing the structure on the stack. Cc: Jonathan Cameron Cc: David Lechner Cc: "Nuno Sá" Cc: Andy Shevchenko Fixes: 872c8014e05e ("iio: pressure: bmp280: drop sensor_data array") Cc: stable Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit 8ce176501f836634f9c0419c0820140f968e9dc5 Author: Shuvam Pandey Date: Mon Apr 6 15:38:24 2026 +0545 iio: adc: nxp-sar-adc: zero-initialize dma_slave_config nxp_sar_adc_start_cyclic_dma() only fills the RX-side members of dma_slave_config before passing it to dmaengine_slave_config(). Zero-initialize the structure so unused members do not contain stack garbage. Some DMA engines consult optional dma_slave_config fields, so leaving them uninitialized can cause DMA setup failures. Fixes: 4434072a893e ("iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms") Signed-off-by: Shuvam Pandey Reviewed-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit 1f4f0bcc5255dec5c4c3a1551bf49d8c33b69b20 Author: Aldo Conte Date: Tue Apr 7 17:17:01 2026 +0200 iio: light: cm3323: fix reg_conf not being initialized correctly The code stores the return value of i2c_smbus_write_word_data() in data->reg_conf; however, this value represents the result of the write operation and not the value actually written to the configuration register. This meant that the contents of data->reg_conf did not truly reflect the contents of the hardware register. Instead, save the value of the register before the write and use this value in the I2C write. The bug was found by code inspection: i2c_smbus_write_word_data() returns 0 on success, not the value written to the register. Tested using i2c-stub on a Raspberry Pi 3B running a custom 6.19.10 kernel. Before loading the driver, the configuration register 0x00 CM3323_CMD_CONF was populated with 0x0030 using `i2cset -y 11 0x10 0x00 0x0030 w`, encoding an integration time of 320ms in bits[6:4]. Due to incorrect initialization of data->reg_conf in cm3323_init(), the print of integration_time returns 0.040000 instead of the expected 0.320000. This happens because the read of the integration_time depends on cm3323_get_it_bits() that is based on the value of data->reg_conf, which is erroneously set to 0. With this fix applied, data->reg_conf correctly saves 0x0030 after init and the successive integration_time reports 0.320000 as expected. Fixes: 8b0544263761 ("iio: light: Add support for Capella CM3323 color sensor") Cc: stable@vger.kernel.org Signed-off-by: Aldo Conte Signed-off-by: Jonathan Cameron commit 49f79cd28f1e3333cbe0d616ce59ead0b24bf34e Author: Advait Dhamorikar Date: Tue Apr 7 12:50:59 2026 +0530 iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL The device tree binding for st,lis2mdl does not support st,drdy-int-pin property. However, when no platform data is provided and the property is absent, the driver falls back to default_magn_pdata which hardcodes drdy_int_pin = 2. This causes `st_sensors_set_drdy_int_pin` to fail with -EINVAL because the LIS2MDL sensor settings have no INT2 DRDY mask defined. Fix this by checking the sensor's INT2 DRDY mask availability at probe time and selecting the appropriate default pin. Sensors that do not support INT2 DRDY will default to INT1, while all others retain the existing default of INT2. Fixes: 38934daf7b5c ("iio: magnetometer: st_magn: Provide default platform data") Signed-off-by: Advait Dhamorikar Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit a093999355084bdbfe6e97f1dd232e58a1525f0b Author: Benoît Monin Date: Wed Apr 1 17:24:58 2026 +0200 iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() iio_buffer_enqueue_dmabuf() allocates a struct iio_dma_fence (104 bytes, kmalloc-128) via kmalloc_obj()+dma_fence_init(), which sets the initial kref to 1. It then calls dma_resv_add_fence() which takes a second reference (kref=2), and stores a raw pointer in block->fence. On the success path the function returns without calling dma_fence_put() to release the initial reference, so every buffer enqueue permanently leaks one kmalloc-128 allocation. The iio_buffer_cleanup() work item only releases the temporary reference taken during completion signalling by iio_buffer_signal_dmabuf_done(); the initial reference from dma_fence_init() is never released. With four iio_rwdev instances at 240kHz and 512 samples per buffer, this produces ~1875 kmalloc-128 allocations per second matching the observed slab growth exactly. A test with ftrace confirmed that the dma_fence_destroy event was never triggered. Fix by calling dma_fence_put() after dma_resv_add_fence(), transferring ownership of the fence to the DMA reservation object. The DMA fence then gets properly discarded after being signalled. Fixes: 3e26d9f08fbe0 ("iio: core: Add new DMABUF interface infrastructure") Originally-by: James Nuss Signed-off-by: Benoît Monin Reviewed-by: Paul Cercueil Cc: Signed-off-by: Jonathan Cameron commit a9aba21a539c668a66b58eeb08ad3909e5a54c2a Author: Antoniu Miclaus Date: Wed Apr 1 18:29:24 2026 +0300 iio: adc: nxp-sar-adc: fix division by zero in write_raw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero or a negative value to the sampling_frequency sysfs attribute triggers a division by zero in the kernel. Also prevent unsigned integer underflow when the computed cycle count is smaller than NXP_SAR_ADC_CONV_TIME, which would wrap the u32 inpsamp to a huge value. Fixes: 4434072a893e ("iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms") Signed-off-by: Antoniu Miclaus Cc: Signed-off-by: Jonathan Cameron commit 6fd9f6e870ea285f05102e8e00e6a7f4495a9a02 Author: Matt DeVillier Date: Thu May 7 09:58:41 2026 -0500 ALSA: hda/ca0132: Disable auto-detect on manual output select Commit 778031e1658d ("ALSA: hda/ca0132: Set HP/Speaker auto-detect default from headphone pin verb") enables HP/Speaker auto-detect by default when the headphone pin supports presence detect. With auto-detect enabled, ca0132_select_out() and ca0132_alt_select_out() choose the output from jack presence instead of the manual HP/Speaker selection. This means selecting speaker output while headphones are plugged in updates the control state, but audio still routes to the headphones. Treat an explicit manual output selection as a request to leave auto-detect mode. Clear the HP/Speaker auto-detect switch before applying the manual selection, and notify userspace so the auto-detect control state is updated in mixers. Do this for both the normal HP/Speaker Playback Switch and the alternate Output Select control used by desktop cards. This keeps auto-detect enabled by default for devices with jack presence detection, while preserving the expected behavior that a manual output choice takes effect immediately. Fixes: 778031e1658d ("ALSA: hda/ca0132: Set HP/Speaker auto-detect default from headphone pin verb") Signed-off-by: Matt DeVillier Link: https://lore.kernel.org/CAFTm+6AfeXKf=b2frG4xC5yC4jjM9TkD6c8+dOWWFw6BDjDESw@mail.gmail.com Signed-off-by: Takashi Iwai commit d5487249a81ea658717614009c8f46acc5b7101a Author: Sven Eckelmann Date: Wed May 13 10:43:54 2026 +0200 batman-adv: tp_meter: directly shut down timer on cleanup batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by timer_delete() to guard against the timer handler re-arming itself between the two calls. This double-deletion hack relied on the sending status being set to 0 to suppress re-arming. Replace both calls with a single timer_shutdown_sync(). This function both waits for any running timer callback to complete (like timer_delete_sync()) and permanently disarms the timer so it cannot be re-armed afterwards, making re-arming prevention unconditional and self-documenting. The re-arming property is also required because otherwise: 1. context 0 (batadv_tp_recv_ack()) checks in batadv_tp_reset_sender_timer() if sending is still 1 -> it is 2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in this process forces the kthread to stop timer in batadv_tp_sender_cleanup() 3. context 0 continues in batadv_tp_reset_sender_timer() and rearms the timer -> but the reference for it is already gone Cc: stable@kernel.org Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Signed-off-by: Sven Eckelmann commit bc62216dc8e221e3781afa14430f45208bfa9af9 Author: Sven Eckelmann Date: Wed May 13 09:01:36 2026 +0200 batman-adv: frag: disallow unicast fragment in fragment batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a BATADV_UNICAST_FRAG packet is received. Once all fragments are collected and the packet is reassembled, batadv_recv_frag_packet() calls batadv_batman_skb_recv() again to process the defragmented payload. A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting). Each nesting level recurses through batadv_batman_skb_recv() without bound, growing the kernel stack until it is exhausted. Since refragmentation or fragments in fragments are not actually allowed, discard all packets which are still BATADV_UNICAST_FRAG packets after the defragmentation process. Cc: stable@kernel.org Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Reviewed-by: Yuan Tan Signed-off-by: Sven Eckelmann commit b27bb2bf7711b028a86c2cfff4ac7a9b48b425c8 Merge: 5d6919055dec13 d9eeb0ea0d2de6 Author: Greg Kroah-Hartman Date: Fri May 15 09:34:30 2026 +0200 Merge tag 'counter-fixes-for-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus William writes: Counter fixes for 7.1 A fix to plug a refcount leak in counter_alloc() if dev_set_name() fails and the error path is taken. * tag 'counter-fixes-for-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: Fix refcount leak in counter_alloc() error path commit 7d1051ad68df3d584b5f24bfa1fb19f3a24db278 Author: Adrien Burnett Date: Thu May 14 18:59:05 2026 +0200 ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx Add a SND_PCI_QUIRK entry for the HP Pavilion Laptop 16-ag0xxx (subsystem 0x103c:0x8cbc, Realtek ALC245). The ALC245_FIXUP_HP_X360_MUTE_LEDS fixup is already used by the neighbouring HP Pavilion Aero Laptop 13-bg0xxx (0x103c:0x8cbd); it chains the master-mute COEF handler with the GPIO mic-mute LED handler, which is what this machine needs. Tested on the affected hardware: both the mute and mic-mute key LEDs respond correctly to the keyboard hotkeys after this change. Cc: Signed-off-by: Adrien Burnett Link: https://patch.msgid.link/20260514165905.21175-1-an.arctic.pigeon@gmail.com Signed-off-by: Takashi Iwai commit 83dca2530fb3ba63f47bad339d890bc30aa06ab5 Author: Jackie Dong Date: Thu May 14 23:39:40 2026 +0800 ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio Volume control for the speakers on the Lenovo Yoga Pro 7 15ASH11 laptop doesn't work. The DAC routing is the same as on the ThinkPad X1 Gen7 function, so reuse the alc285_fixup_thinkpad_x1_gen7 to get it working. Signed-off-by: Jackie Dong Link: https://patch.msgid.link/20260514153940.7320-1-xy-jackie@139.com Signed-off-by: Takashi Iwai commit 9921941929ab014038c357b30567d93d20393a94 Author: Quan Sun <2022090917019@std.uestc.edu.cn> Date: Thu May 14 21:22:45 2026 +0800 ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() snd_hda_ctl_add() dereferences kctl->id.subdevice without checking whether kctl is NULL. Multiple callers in sound/hda/codecs/ca0132.c pass the return value of snd_ctl_new1() directly to snd_hda_ctl_add() without a NULL check: return snd_hda_ctl_add(codec, nid, snd_ctl_new1(&knew, codec)); snd_ctl_new1() returns NULL when the underlying snd_ctl_new() fails on memory allocation (kzalloc_flex),which can occur under memory pressure or via fault injection. Add a NULL check at the entry of snd_hda_ctl_add(), matching the pattern already used by snd_ctl_add_replace() at the same call path (sound/core/control.c:515). Return -EINVAL to let callers handle the error gracefully. Fixes: 44f0c9782cc6 ("ALSA: hda/ca0132: Add tuning controls") Signed-off-by: Quan Sun <2022090917019@std.uestc.edu.cn> Link: https://patch.msgid.link/20260514132245.3062884-1-2022090917019@std.uestc.edu.cn Signed-off-by: Takashi Iwai commit fd87b510f5f543125ecf51e7c706a9f4bc3352be Author: Markus Kramer Date: Thu May 14 00:28:18 2026 +0200 ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone The Samsung Galaxy Book5 360 (NP750QHA, PCI subsystem ID 0x144d:0xc902) has severe audio distortion on the 3.5mm headphone jack. Applying ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET corrects the output path configuration, consistent with fixes already applied to other Samsung Galaxy Book models using the same ALC256 codec. Cc: stable@vger.kernel.org Link: https://github.com/thesofproject/linux/issues/5648 Signed-off-by: Markus Kramer Link: https://patch.msgid.link/20260513222818.14351-1-linux@markus-kramer.de Signed-off-by: Takashi Iwai commit 2891bb13ef158281736b6314b1ceaef6d08d57f4 Author: Andy Shevchenko Date: Wed May 13 18:27:58 2026 +0200 ALSA: hda/cs35l56: Drop malformed default N from Kconfig First of all, it has to be 'default n' (small letter n), otherwise it looks for CONFIG_N which is absent and in case of appearance will enable something unrelated. Second and most important is that 'n' *is* the default 'default' already. Hence just drop malformed line. Signed-off-by: Andy Shevchenko Reviewed-by: Richard Fitzgerald Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260513162758.365972-1-andriy.shevchenko@linux.intel.com commit 67c73815220784074ff13ec07df955911caf1b73 Author: Daniel Schaefer Date: Wed May 13 23:55:13 2026 +0800 ALSA: hda/realtek: fix mic boost on Framework PTL In addition to the mic jack fix, also need to avoid boosting the internal mic too much, otherwise >50% input volume clips a lot. Also add a second SSID. We have one for the classic chassis/speaker and one for the new Pro chassis/speaker. To: Jaroslav Kysela To: Takashi Iwai To: linux-sound@vger.kernel.org Cc: Dustin L. Howett Cc: linux@frame.work Signed-off-by: Daniel Schaefer Link: https://patch.msgid.link/20260513155513.11683-1-dhs@frame.work Signed-off-by: Takashi Iwai commit d02d2d51a50d1bbf44a50eda094aa2b10fecf023 Author: Edson Juliano Drosdeck Date: Mon May 11 15:15:58 2026 -0300 ALSA: hda/realtek: Limit mic boost on Positivo DN50E The internal mic boost on the Positivo DN50E is too high. Fix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain. Signed-off-by: Edson Juliano Drosdeck Link: https://patch.msgid.link/20260511181558.670563-1-edson.drosdeck@gmail.com Signed-off-by: Takashi Iwai commit 74e8409821ac8cda70bf23eb593f2c7f6e3b5a2f Author: Richard Fitzgerald Date: Mon May 11 11:41:48 2026 +0100 ALSA: doc: cs35l56: Update path to HDA driver source The HDA drivers were moved to sound/hda/... so update a Documentation reference that still pointed to the old location. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260511104148.36382-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 814b2c9b30e56074e11fc0a6e5419b3fee0639bc Author: Cássio Gabriel Date: Mon May 11 01:36:37 2026 -0300 ALSA: usb-audio: qcom: Check offload mapping failures uaudio_transfer_buffer_setup() calls dma_get_sgtable() and then passes the sg_table to uaudio_iommu_map_xfer_buf() without checking whether sg table construction succeeded. If dma_get_sgtable() fails, the sg_table contents are not valid. uaudio_iommu_map_pa() also ignores iommu_map() failures for the event and transfer rings and still returns the allocated IOVA to the QMI response. That can expose an unmapped IOVA to the audio DSP. For transfer rings, the failed mapping also leaves the IOVA allocator state marked in use. Check both operations. Free the coherent transfer buffer when sg table construction fails, free the sg table when transfer-buffer IOMMU mapping fails, and release the transfer-ring IOVA if iommu_map() fails. Also return the existing event-ring IOVA when the event ring is already mapped, matching the pre-split helper behavior. Fixes: 326bbc348298 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Fixes: 44499ecb4f28 ("ALSA: usb: qcom: Fix false-positive address space check") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260511-alsa-usb-qcom-offload-map-errors-v1-1-6502695e58bc@gmail.com Signed-off-by: Takashi Iwai commit 0a9c56dd387605d17dabeedd9fdd2c4c1d0bab7b Author: Myeonghun Pak Date: Wed May 13 15:57:00 2026 +0900 drm/loongson: Use managed KMS polling lsdc_pci_probe() initializes KMS polling before setting up vblank support, requesting the IRQ and registering the DRM device. If any of those later steps fails, probe returns without finalizing polling. The driver also never finalizes polling on regular removal. Use drmm_kms_helper_poll_init() so polling is tied to the DRM device lifetime and automatically finalized on probe failure and device removal. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: f39db26c5428 ("drm: Add kms driver for loongson display controller") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Reviewed-by: Thomas Zimmermann Acked-by: Jianmin Lv Reviewed-by: Huacai Chen Signed-off-by: Myeonghun Pak Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260513065706.23803-1-mhun512@gmail.com commit dd074f04e04648d89d9d10ae9846cd057c97b385 Author: Nicholas Bonello Date: Fri May 8 18:55:07 2026 -0400 ALSA: hda/realtek: Fix Legion 7 16ITHG6 speaker amp binding The Lenovo Legion 7 16ITHG6 uses codec SSID 17aa:3855, but its PCI SSID is 17aa:3811. The latter is now also used by the Legion S7 15IMH05 quirk, which is matched before codec SSID fallback and incorrectly routes Legion 7 16ITHG6 machines to ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS. That fixup does not bind the CLSA0101 CS35L41 companion amplifiers, making the built-in speakers silent even though playback appears to be active. Add a codec SSID quirk for 17aa:3855 before the conflicting PCI SSID quirk so that the Legion 7 16ITHG6 uses ALC287_FIXUP_LEGION_16ITHG6. This restores CS35L41 firmware loading and binds both speaker amplifiers. Fixes: 67f4c61a73e9 ("ALSA: hda/realtek: Add quirk for Legion S7 15IMH") Cc: stable@vger.kernel.org Tested-by: Nicholas Bonello Assisted-by: Codex:GPT-5 Signed-off-by: Nicholas Bonello Link: https://patch.msgid.link/20260508225507.47667-1-hadobedo@gmail.com Signed-off-by: Takashi Iwai commit 2149c011510cbdcf183a13b26756e4a02071f0f2 Author: Lianqin Hu Date: Fri May 8 12:49:34 2026 +0000 ALSA: usb-audio: Add iface reset and delay quirk for TTGK Technology USB-C Audio Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: new full-speed USB device number 2 using xhci-hcd usb 1-1: New USB device found, idVendor=3302, idProduct=17c2 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: USB-C Audio usb 1-1: Manufacturer: TTGK Technology usb 1-1: SerialNumber: 170120210706 Signed-off-by: Lianqin Hu Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/TYUPR06MB621720E4E8F99A42E162FD51D23D2@TYUPR06MB6217.apcprd06.prod.outlook.com commit c0e4fffc0f474b7ed10adee4ab2bc1a66d36fc72 Author: Robertus Diawan Chris Date: Fri May 8 10:39:14 2026 +0700 ALSA: scarlett2: Add missing error check when initialise Autogain Status When initialise new control with scarlett2_add_new_ctl() function for Autogain Status, scarlett2_add_new_ctl() might throw an error. So, add error check after initialise new control for Autogain Status. This is reported by Coverity Scan with CID 1598781 as UNUSED_VALUE. Fixes: 0a995e38dc44 ("ALSA: scarlett2: Add support for software-controllable input gain") Signed-off-by: Robertus Diawan Chris Link: https://patch.msgid.link/20260508033914.111596-1-robertusdchris@gmail.com Signed-off-by: Takashi Iwai commit 1bb54043ff309795c90ccadd8a6e6b13ac40ec4e Author: Tomasz Jeznach Date: Tue May 12 10:37:44 2026 -0700 MAINTAINERS: update Tomasz Jeznach's email address Switch from the previous work address to a linux.dev account, as the work address is no longer actively monitored. Signed-off-by: Tomasz Jeznach Signed-off-by: Joerg Roedel commit 58829512ad461af8f35941069c209941e3a97b65 Author: Jason Gunthorpe Date: Tue May 12 13:46:17 2026 -0300 iommupt: Fix the end_index calculation in __map_range_leaf() Sashiko noticed a mismatch of units in this math: num_leaves is actually the number of leaf *entries* (so a 16-item contiguous leaf is one num_leaves), while index is in items. The mismatch in maths causes __map_range_leaf() to exit early instead of efficiently filling a larger range of contiguous PTEs. The early exit is caught by the functions above and then __map_range_leaf() is re-invoked, so there is no functional issue. Correct the misuse of units by adjusting num_leaves with the leaf size and avoid the performance cost of looping externally. There are also some mismatched types for num_leaves; simplify things to remove the duplicated calculations. Fixes: d6c65b0fd621 ("iommupt: Avoid rewalking during map") Signed-off-by: Jason Gunthorpe Reviewed-by: Samiullah Khawaja Reviewd-by: Pranjal Shrivastava Tested-by: Josua Mayer Signed-off-by: Joerg Roedel commit 8ef3f77c440005c7f04229a75976bfc078364247 Author: Jason Gunthorpe Date: Tue May 12 13:46:16 2026 -0300 iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap Sashiko pointed out that the driver could drop PAGE_SIZE from the pgsize_bitmap. That is technically allowed but nothing does it, and such an iommu_domain would not be used with the DMA API today. Still, it is against the design and it is trivial to fix up. Lift the PT_WARN_ON to the if branch and just skip the fast path. Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op") Signed-off-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Reviewed-by: Samiullah Khawaja Tested-by: Josua Mayer Signed-off-by: Joerg Roedel commit 0735c54804c709d1b292f3b6947cfb560b2ce552 Author: Jason Gunthorpe Date: Tue May 12 13:46:15 2026 -0300 iommu: Handle unmap error when iommu_debug is enabled Sashiko noticed a latent bug where the map error flow called iommu_unmap() which calls iommu_debug_unmap_begin()/iommu_debug_unmap_end() however since this is an error path the map flow never actually established the original iommu_debug_map() it will malfunction. Lift the unmap error handling into iommu_map_nosync() and reorder it so the trace_map()/iommu_debug_map() records the partial mapping and then immediately unmaps it. This avoid creating the unbalanced tracking and provides saner tracing instead of a unmap unmatched to any map. Fixes: ccc21213f013 ("iommu: Add calls for IOMMU_DEBUG_PAGEALLOC") Signed-off-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Reviewed-by: Samiullah Khawaja Reviewed-by: Mostafa Saleh Tested-by: Josua Mayer Signed-off-by: Joerg Roedel commit b948a87228482235afbaf5f4d8037860b5c470fd Author: Jason Gunthorpe Date: Tue May 12 13:46:14 2026 -0300 iommu: Fix up map/unmap debugging for iommupt domains Sashiko noticed a few issues in this path, and a few more were found on review. Tidy them up further. These are intertwined because the debug code depends on some of the WARN_ONs to function right: Lift into iommu_map_nosync(): - The might_sleep_if() - 0 pgsize_bitmap WARN_ON - Promote the illegal domain->type to a WARN_ON - WARN_ON for illegal gfp flags Then remove the return 0 since it is now safe to call iommu_debug_map(). Lift into __iommu_unmap(): - 0 pgsize_bitmap WARN_ON - Promote the illegal domain->type to a WARN_ON - iommu_debug_unmap_begin() This now pairs with the unconditional iommu_debug_map() on the mapping side. Thus iommu debugging now works for iommupt along with some of the other debugging features. Fixes: 99fb8afa16ad ("iommupt: Directly call iommupt's unmap_range()") Fixes: d6c65b0fd621 ("iommupt: Avoid rewalking during map") Signed-off-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Reviewed-by: Samiullah Khawaja Reviewed-by: Mostafa Saleh Tested-by: Josua Mayer Signed-off-by: Joerg Roedel commit 6fc7e8a3b8115294f60f5c89de27330bf1b9c98e Author: Jason Gunthorpe Date: Tue May 12 13:46:13 2026 -0300 iommu: Fix loss of errno on map failure for classic ops A typo, likely from a rebase, inverted the condition and caused errors to be lost. Fix it to be "if (ret)". This was breaking iommu_create_device_direct_mappings() on drivers that don't use iommupt and don't fully set up their domain in alloc_pages() (i.e., SMMUv2). In this case the first call of iommu_create_device_direct_mappings() should fail due to the incompletely initialized domain. Since it wrongly returns success, the second call to iommu_create_device_direct_mappings() doesn't happen and IOMMU_RESV_DIRECT is never set up. Cc: stable@vger.kernel.org Fixes: d6c65b0fd621 ("iommupt: Avoid rewalking during map") Reported-by: Josua Mayer Closes: https://lore.kernel.org/all/321c2e57-6a17-4aef-ba42-d2ebd577e472@solid-run.com/ Signed-off-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Reviewed-by: Samiullah Khawaja Reviewed-by: Mostafa Saleh Tested-by: Josua Mayer Signed-off-by: Joerg Roedel commit b71cb088b2e3427924a470fc43e7aedb8a40d2e3 Author: Guixin Liu Date: Fri Apr 24 09:39:23 2026 +0800 scsi: target: tcm_loop: Fix NULL ptr dereference The TCM_LOOP LUN creation process calls device_register() to create the device, which in turn invokes tcm_loop_driver_probe() registered with the TCM_LOOP bus to create and register the scsi_host. However, if the scsi_host memory allocation fails or scsi_add_host() fails, the device_register() process still returns success. Subsequently, when the user binds the LUN to a specific backend device, it accesses the NULL or freed scsi_host. Crash Call Trace: RIP: 0010:scsi_is_host_device+0x7/0x20 scsi_alloc_target+0x32/0x2c0 __scsi_add_device+0x41/0xf0 scsi_add_device+0xd/0x30 tcm_loop_port_link+0x25/0x50 [tcm_loop] target_fabric_port_link+0x9c/0xb0 [target_core_mod] ... This issue is fixed by: 1. Setting the tcm_loop_hba's scsi_host to NULL, if scsi_add_host() fails. 2. Checking the tcm_loop_hba's scsi_host after device_register(). 3. Checking the tcm_loop_hba's scsi_host in tcm_loop_driver_remove(). Fixes: 3703b2c5d041 ("[SCSI] tcm_loop: Add multi-fabric Linux/SCSI LLD fabric module") Signed-off-by: Guixin Liu Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260424013923.25998-1-kanie@linux.alibaba.com Signed-off-by: Martin K. Petersen commit 0d435a7ebcd4e97e47673c1ab6fb27f973a053ec Author: Alexander A. Klimov Date: Wed May 13 21:08:52 2026 +0200 ASoC: codecs: fs210x: fix possible buffer overflow In fs210x_effect_scene_info(), a string was copied like this: strscpy(DST, SRC, strlen(SRC) + 1); A buffer overflow would happen if strlen(SRC) >= sizeof(DST). Actually, strscpy() must be used this way: strscpy(DST, SRC, sizeof(DST)); strscpy(DST, SRC); // defaults to sizeof(DST) Fixes: 756117701779 ("ASoC: codecs: Add FourSemi FS2104/5S audio amplifier driver") Signed-off-by: Alexander A. Klimov Link: https://patch.msgid.link/20260513190852.196723-2-grandmaster@al2klimov.de Signed-off-by: Mark Brown commit b52a8d52c3125ec9a93106ed816582368de34426 Author: Michael Bommarito Date: Sun Apr 19 17:04:20 2026 -0400 scsi: isci: Fix use-after-free in device removal path The ISCI completion tasklet is initialized in isci_host_alloc() (drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy interrupt handlers (drivers/scsi/isci/host.c:223,613). isci_host_deinit() stops the controller and waits for stop completion, but it never kills completion_tasklet before teardown continues. A top-of-function tasklet_kill() is not sufficient here: interrupts are only disabled when isci_host_stop_complete() runs, so until wait_for_stop() returns the IRQ handlers can still requeue the tasklet. The tasklet callback also re-enables interrupts after draining completions, so killing the tasklet before the source is quiesced leaves the same race open. Once wait_for_stop() returns, no further IRQ-driven scheduling can occur. Kill completion_tasklet there so teardown cannot race a queued tasklet running on a dead ihost. On remove or unload, the stale callback can otherwise dereference ihost and touch ihost->smu_registers after the host lifetime ends. A UML + KASAN analogue reproduced the failure class both with no tasklet_kill() and with tasklet_kill() placed before source quiesce, and stayed clean once the kill happened after quiescing the scheduling source. This mirrors commit f6ab594672d4 ("scsi: aic94xx: fix use-after-free in device removal path"), but ISCI needs the kill after wait_for_stop(). Fixes: 6f231dda6808 ("isci: Intel(R) C600 Series Chipset Storage Control Unit Driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260419210420.2134639-1-michael.bommarito@gmail.com Signed-off-by: Martin K. Petersen commit 6ea68a8dc7d2711504d944811981a5304af7d7a9 Author: Mike Christie Date: Mon May 11 12:53:17 2026 -0500 scsi: sd: Fix return code handling in sd_spinup_disk() As found by smatch-ci, scsi_execute_cmd() can return negative or positve values so we should use a int instead of unsigned int. Fixes: b4d0c33a32c3 ("scsi: sd: Fix sshdr use in sd_spinup_disk") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-scsi/agFbI7E6JQwd3wGW@stanley.mountain/T/#u Signed-off-by: Mike Christie Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260511175317.114007-1-michael.christie@oracle.com Signed-off-by: Martin K. Petersen commit 9c0f5bbff146f09f449dd528addeabfb68aef997 Author: Simon Trimmer Date: Thu May 14 16:18:54 2026 +0100 ASoC: cs35l56: Log SoundWire status updates only on changes The SoundWire slave update_status() callback can be invoked when the status has not changed. To prevent large amounts of log noise with debug enabled, log them only when the status changes. This also helps with understanding them, because they now log an actual change in state. Signed-off-by: Simon Trimmer Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260514151854.695145-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit c996a4418dd4ee45cd086586c04a1103e8160308 Author: Ingyu Jang Date: Fri May 15 03:52:15 2026 +0900 ASoC: ti: omap-dmic: Fix IS_ERR() vs NULL check bug in omap_dmic_select_fclk() clk_get_parent() returns NULL when the clock has no parent (or when the input clk is NULL); it never returns an ERR_PTR. The current IS_ERR(mux) check therefore never triggers - a NULL return falls through silently to clk_set_parent(NULL, parent_clk), which simply fails with -EINVAL. Use a NULL check so the dedicated error path runs and the prior clk_get() reference is released via clk_put(). Signed-off-by: Ingyu Jang Acked-by: Sen Wang Link: https://patch.msgid.link/20260514185215.3753998-1-ingyujang25@korea.ac.kr Signed-off-by: Mark Brown commit 5db89c99566fc4728cc92e941d8e1975711e24b5 Author: Michael Bommarito Date: Wed May 13 21:37:39 2026 -0400 net: ifb: report ethtool stats over num_tx_queues ifb_dev_init() allocates dp->tx_private to dev->num_tx_queues entries via kzalloc_objs(*txp, dev->num_tx_queues). Both IFB per-queue RX and TX stats live in those entries: ifb_xmit() updates txp->rx_stats using the skb queue mapping, ifb_ri_tasklet() updates txp->tx_stats, and ifb_stats64() aggregates both over dev->num_tx_queues. The ethtool stats callbacks instead size and walk the per-queue stats with dev->real_num_rx_queues and dev->real_num_tx_queues. With an asymmetric device where the RX queue count exceeds the TX queue count, for example: ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb ethtool -S ifb10 ifb_get_ethtool_stats() indexes past the tx_private allocation and copies adjacent slab data through ETHTOOL_GSTATS. Use dev->num_tx_queues consistently for the stats strings, the stats count, and the stats data walks. This reports one RX stats group and one TX stats group for each backing ifb_q_private entry, which is the queue set IFB can actually populate. Reproduced under UML+KASAN at v7.1-rc2: BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c/0xae Read of size 8 at addr 0000000062dbd228 by task ethtool/36 ifb_fill_stats_data+0x3c/0xae ifb_get_ethtool_stats+0xc0/0x129 __dev_ethtool+0x1ca5/0x363c dev_ethtool+0x123/0x1b3 dev_ioctl+0x56c/0x744 sock_do_ioctl+0x15f/0x1b2 sock_ioctl+0x4d5/0x50a sys_ioctl+0xd8b/0xde9 With the patch applied, the same UML+KASAN repro is silent and ethtool -S ifb10 reports only the stats backed by the single allocated tx_private entry. Fixes: a21ee5b2fcb8 ("net: ifb: support ethtools stats") Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260514013739.3549624-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski commit c6df9a65cbb0fe7808a4b2872095f4c849b3196a Author: Or Har-Toov Date: Wed May 13 09:36:40 2026 +0300 net/mlx5: Skip disabled vports when setting max TX speed When setting vports max TX speed during LAG activation or bond state changes, the code iterates over all eswitch vports. However, some vports may not be enabled yet. Skip vports that are not enabled to avoid sending FW commands for uninitialized vports. Save the LAG aggregated speed in the vport struct so it can be applied when the vport is enabled later. Fixes: 50f1d188c580 ("net/mlx5: Propagate LAG effective max_tx_speed to vports") Signed-off-by: Or Har-Toov Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260513063640.334132-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 8d0a5af8b1ba598e7340761729801624e7a9330e Author: Jeroen Massar Date: Wed May 13 09:33:02 2026 +0300 net/mlx5: Do not restore destination-less TC rules After IPsec policy/state TX rules are added, any TC flow rule, which forwards packets to uplink, is modified to forward to IPsec TX tables. As these tables are destroyed dynamically, whenever there is no reference to them, the destinations of this kind of rules must be restored to uplink, unless there is no destination for that rule. The flow rules FLOW_ACTION_ACCEPT, DROP, TRAP, GOTO and SAMPLE do not have a destination port, and thus out_count = 0. At cleanup time of the rules in mlx5_esw_ipsec_modify_flow_dests we call mlx5_eswitch_restore_ipsec_rule but as the above types do not have a destination we get an underflow of out_count, as the port is passed, which is esw_attr->out_count - 1. This change avoids calling mlx5_eswitch_restore_ipsec_rule when there are no output destinations and thus avoids the underflow. Fixes: d1569537a837 ("net/mlx5e: Modify and restore TC rules for IPSec TX rules") Signed-off-by: Jeroen Massar Reviewed-by: Jianbo Liu Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260513063302.333761-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit c9d08c8c4c5006d71b3c3c3c0dc41ebc46931951 Author: Gal Pressman Date: Wed May 13 09:27:37 2026 +0300 net/mlx5e: Don't leak RSS context in case of error If mlx5e_rx_res_rss_set_rxfh() fails during mlx5e_create_rxfh_context(), the RSS context is not cleaned up. This leaves a stale entry in 'res->rss[rss_idx]' that occupies a context slot. Destroy the RSS context before returning the error. Fixes: 6c2509d44636 ("net/mlx5e: Add error flow for ethtool -X command") Signed-off-by: Gal Pressman Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260513062737.333259-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit b96fe527935b0671194bc436d7d78d3b0f87b2e1 Author: Andy Shevchenko Date: Wed May 13 18:26:12 2026 +0200 ASoC: cs35l56: Drop malformed default N from Kconfig First of all, it has to be 'default n' (small letter n), otherwise it looks for CONFIG_N which is absent and in case of appearance will enable something unrelated. Second and most important is that 'n' *is* the default 'default' already. Hence just drop malformed line. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260513162612.365729-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit f508262ae9f21fe0e6c0749948b9dc7dd5a62a70 Author: Chuck Lever Date: Wed May 13 08:58:25 2026 -0400 tls: Preserve sk_err across recvmsg() when data has been copied The sk_err check in tls_rx_rec_wait() consumes the error via sock_error(), which clears sk_err atomically. When the caller (tls_sw_recvmsg, tls_sw_splice_read, or tls_sw_read_sock) already has bytes copied to userspace, it returns those bytes and discards the error from this call. sk_err is now zero on the socket, so the next read syscall observes only RCV_SHUTDOWN and reports a clean EOF instead of the actual error (typically -ECONNRESET). The race is reachable when tls_read_flush_backlog()'s periodic sk_flush_backlog() triggers tcp_reset() in the middle of a multi-record read. Pass a has_copied flag to tls_rx_rec_wait(). When has_copied is false, consume sk_err via sock_error() as before. When has_copied is true, report the error from READ_ONCE() but leave sk_err set: the caller returns the byte count and discards the err from this call, and the next read syscall surfaces the preserved sk_err. This mirrors the tcp_recvmsg() preserve-and-surface pattern. The decrypt-abort path is unaffected: tls_err_abort() raises sk_err to EBADMSG after tls_rx_rec_wait() returns, and nothing on the caller's return path consumes it, so the EBADMSG surfaces on the next read. tls_sw_splice_read() passes has_copied=false: it processes one record per call, so no bytes have been copied within the function when tls_rx_rec_wait() runs. A reset that arrives between iterations of splice_direct_to_actor() (the sendfile() path) is still consumed by sock_error() in the later call, and the outer loop returns the prior iterations' byte count and drops the error. tcp_splice_read() exhibits the same pattern at the iteration boundary; addressing it belongs at the splice_direct_to_actor() layer and is out of scope here. Fixes: c46b01839f7a ("tls: rx: periodically flush socket backlog") Suggested-by: Jakub Kicinski Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260513125825.205189-1-cel@kernel.org Signed-off-by: Jakub Kicinski commit e8fb3de2a8effcaf62bec2c56b93d8bb480371d1 Author: Dawei Feng Date: Wed May 13 23:13:20 2026 +0800 octeontx2-pf: fix double free in rvu_rep_rsrc_init() rvu_rep_rsrc_init() allocates queue memory before calling otx2_init_hw_resources(). When hardware resource setup fails, otx2_init_hw_resources() already unwinds the partially initialized SQ, CQ, and aura state before returning an error. The representor error path then calls otx2_free_hw_resources() again and can free the same resources a second time. Fix this by splitting the cleanup labels so that a failure from otx2_init_hw_resources() only releases queue memory. Keep the otx2_free_hw_resources() call for failures that happen after hardware resource initialization completed successfully. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc3. Runtime validation was not performed because reproducing this path requires OcteonTX2 representor hardware. Fixes: 3937b7308d4f ("octeontx2-pf: Create representor netdev") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Zilin Guan Signed-off-by: Dawei Feng Reviewed-by: Geetha sowjanya Link: https://patch.msgid.link/20260513151320.213260-1-dawei.feng@seu.edu.cn Signed-off-by: Jakub Kicinski commit 4141f46daa4cf1f8caa14129f8b6db86f17452f5 Merge: e7b8b3c5b2a655 a6ab75639e2316 Author: Jens Axboe Date: Thu May 14 19:14:33 2026 -0600 Merge tag 'nvme-7.1-2026-05-14' of git://git.infradead.org/nvme into block-7.1 Pull NVMe fixes from Keith: "- Fix memory leak on a passthrough integrity mapping failure (Keith) - Hide secrets behind debug option (Hannes) - Fix pci use-after-free for host memory buffer (Chia-Lin Kao) - Fix tcp taregt use-after-free for data digest (Sagi) - Revert a mistaken quirk (Alan Cui) - Fix uevent and controller state race condition (Maurizio) - Fix apple submission queue re-initialization (Nick Chan)" * tag 'nvme-7.1-2026-05-14' of git://git.infradead.org/nvme: nvme-apple: Reset q->sq_tail during queue init nvme: fix race condition between connected uevent and STARTED_ONCE flag Revert "nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808" nvmet-tcp: Fix potential UAF when ddgst mismatch nvme-pci: fix use-after-free in nvme_free_host_mem() nvmet-auth: Do not print DH-HMAC-CHAP secrets nvme: fix bio leak on mapping failure nvme: make prp passthrough usage less scary commit f84eca5817390257cef78013d0112481c503b4a3 Author: William Bowling Date: Wed May 13 04:16:35 2026 +0000 net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors. Fixes: cef401de7be8 ("net: fix possible wrong checksum generation") Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags") Signed-off-by: William Bowling Reviewed-by: Eric Dumazet Tested-by: Jiayuan Chen Link: https://patch.msgid.link/20260513041635.1289541-1-vakzz@zellic.io Signed-off-by: Jakub Kicinski commit 7d260c5d2d89eb2c8c528d54b576b3aae3e20231 Author: Matt Fleming Date: Wed May 13 12:22:26 2026 +0100 net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover mlx5e_tx_reporter_timeout_recover() accesses sq->netdev after mlx5e_safe_reopen_channels() has torn down and freed the channel (and its embedded SQs). Replace the three sq->netdev references with priv->netdev which is safe because priv outlives channel teardown. The netdev_err() call already used priv->netdev for this reason; make the trylock/unlock and health_channel_eq_recover calls consistent. This fixes the following KASAN splat: BUG: KASAN: use-after-free in mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core] Read of size 8 at addr ffff889860ed0b28 by task kworker/u113:2/5277 Call Trace: mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core] devlink_health_reporter_recover+0xa2/0x150 devlink_health_report+0x254/0x7c0 mlx5e_reporter_tx_timeout+0x297/0x380 [mlx5_core] mlx5e_tx_timeout_work+0x109/0x170 [mlx5_core] process_one_work+0x677/0xf20 worker_thread+0x51f/0xd90 kthread+0x3a5/0x810 ret_from_fork+0x208/0x400 ret_from_fork_asm+0x1a/0x30 Fixes: 83ac0304a2d7 ("net/mlx5e: Fix deadlocks between devlink and netdev instance locks") Cc: stable@vger.kernel.org Reviewed-by: Cosmin Ratiu Reviewed-by: Tariq Toukan Signed-off-by: Matt Fleming Link: https://patch.msgid.link/20260513112226.140512-1-matt@readmodwrite.com Signed-off-by: Jakub Kicinski commit d2bfdbb69cf87676981b1043010b6224d84c6d3a Author: Maoyi Xie Date: Tue May 12 22:28:07 2026 +0800 rds_tcp: close NULL deref window in rds_tcp_set_callbacks rds_tcp_set_callbacks() links a new rds_tcp_connection onto rds_tcp_tc_list under rds_tcp_tc_list_lock. It releases the lock, then assigns tc->t_sock = sock outside the lock. rds_tcp_tc_info() and rds6_tcp_tc_info() walk rds_tcp_tc_list under the same lock. Both dereference tc->t_sock->sk without a NULL check. A reader can acquire rds_tcp_tc_list_lock between the writer's spin_unlock and the t_sock store. It then sees a list entry whose t_sock is NULL. The dereference of tc->t_sock->sk is a NULL access. Move tc->t_sock = sock inside rds_tcp_tc_list_lock, before list_add_tail. A reader holding the lock then observes the linkage and the t_sock store together. The restore path is safe. rds_tcp_restore_callbacks() does list_del_init inside the lock. The matching tc->t_sock = NULL after unlink is harmless to readers holding the lock. Fixes: 70041088e3b9 ("RDS: Add TCP transport to RDS") Suggested-by: Simon Horman Signed-off-by: Maoyi Xie Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20260512142807.1855619-1-maoyi.xie@ntu.edu.sg Signed-off-by: Jakub Kicinski commit 84a0f7caafc679f763d3868635837e22bb89651a Author: Nathan Chancellor Date: Mon May 11 17:02:44 2026 +0900 ARM: Do not select HAVE_RUST when KASAN is enabled When KASAN is enabled, such as with allmodconfig, the build fails when building the Rust code with: error: kernel-address sanitizer is not supported for this target error: aborting due to 1 previous error make[4]: *** [rust/Makefile:654: rust/core.o] Error 1 The arm-unknown-linux-gnueabi target does not support KASAN, so avoid saying Rust is supported when it is enabled. Cc: stable@vger.kernel.org Fixes: ccb8ce526807 ("ARM: 9441/1: rust: Enable Rust support for ARMv7") Link: https://github.com/Rust-for-Linux/linux/issues/1234 Signed-off-by: Nathan Chancellor Reviewed-by: Christian Schrefl Link: https://patch.msgid.link/20260511-arm-avoid-rust-with-kasan-v1-1-24d55f4a900b@kernel.org Signed-off-by: Miguel Ojeda commit 51f57607e30bee282a1d40845f89a311cbb26481 Author: Chen-Shi-Hong Date: Thu May 14 23:39:13 2026 +0800 docs: hwmon: sy7636a: fix temperature sysfs attribute name The hwmon sysfs naming convention uses temp[1-*]_input for temperature channels. Documentation/hwmon/sy7636a-hwmon.rst currently documents temp0_input, while the driver uses the standard hwmon temperature channel interface. Update the documentation to use temp1_input. Signed-off-by: Chen-Shi-Hong Link: https://lore.kernel.org/r/20260514154108.1937-1-eric039eric@gmail.com Signed-off-by: Guenter Roeck commit 0c0dddc07d272a8d25922e48041e8e4d2434df7e Author: Ralf Lici Date: Wed May 13 15:26:10 2026 +0200 ovpn: disable BHs when updating device stats ovpn updates dev->dstats from both process and softirq contexts. In particular, TCP paths may run from socket callbacks, workqueues or strparser work, while UDP receive and ovpn's ndo_start_xmit path may update the same per-device dstats from BH context. Add ovpn device drop-stat helpers that disable BHs around dev_dstats_rx_dropped() and dev_dstats_tx_dropped(), and use them for drop accounting. The successful RX dev_dstats_rx_add() update is already covered by the BH-disabled section around gro_cells_receive(). For the successful TCP TX dev_dstats_tx_add() update, replace the existing preempt-disabled section with a BH-disabled one. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit 5a433107fab621f4e7379ccba6e52b5b1601046c Author: Namhyung Kim Date: Sun May 10 13:23:46 2026 -0700 perf trace: Update beautifier script for clone flags According to the change in the sched.h, update the script to generate the flags array like below. Note that '+1' is needed to detect bitmask pattern at index 0. $ cat tools/perf/trace/beauty/generated/clone_flags_array.c static const char *clone_flags[] = { [ilog2(0x00000100) + 1] = "VM", [ilog2(0x00000200) + 1] = "FS", [ilog2(0x00000400) + 1] = "FILES", [ilog2(0x00000800) + 1] = "SIGHAND", [ilog2(0x00001000) + 1] = "PIDFD", [ilog2(0x00002000) + 1] = "PTRACE", [ilog2(0x00004000) + 1] = "VFORK", [ilog2(0x00008000) + 1] = "PARENT", [ilog2(0x00010000) + 1] = "THREAD", [ilog2(0x00020000) + 1] = "NEWNS", [ilog2(0x00040000) + 1] = "SYSVSEM", [ilog2(0x00080000) + 1] = "SETTLS", [ilog2(0x00100000) + 1] = "PARENT_SETTID", [ilog2(0x00200000) + 1] = "CHILD_CLEARTID", [ilog2(0x00400000) + 1] = "DETACHED", [ilog2(0x00800000) + 1] = "UNTRACED", [ilog2(0x01000000) + 1] = "CHILD_SETTID", [ilog2(0x02000000) + 1] = "NEWCGROUP", [ilog2(0x04000000) + 1] = "NEWUTS", [ilog2(0x08000000) + 1] = "NEWIPC", [ilog2(0x10000000) + 1] = "NEWUSER", [ilog2(0x20000000) + 1] = "NEWPID", [ilog2(0x40000000) + 1] = "NEWNET", [ilog2(0x80000000) + 1] = "IO", [ilog2(0x00000080) + 1] = "NEWTIME", [32 + 1] = "CLEAR_SIGHAND", [33 + 1] = "INTO_CGROUP", [34 + 1] = "AUTOREAP", [35 + 1] = "NNP", [36 + 1] = "PIDFD_AUTOKILL", [37 + 1] = "EMPTY_MNTNS", }; This was found by Sashiko during review. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 552636b9317c8a843dd4496d77e56976ab48c76b Author: Namhyung Kim Date: Sun May 10 13:23:45 2026 -0700 perf trace: Add beautifier script for fsmount flags And move the existing one to fsmount_attr.sh to be more precise. Now the fsmount_flags[] is generated from the mount.h like below. The ilog2() + 1 is an existing pattern to handle bit flags. $ cat tools/perf/trace/beauty/generated/fsmount_arrays.c static const char *fsmount_flags[] = { [ilog2(0x00000001) + 1] = "CLOEXEC", [ilog2(0x00000002) + 1] = "NAMESPACE", }; It was found by Sashiko during the review. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit be81aed3f7492caa522493f7c67b9c4d3c8924a6 Author: Namhyung Kim Date: Sun May 10 13:23:44 2026 -0700 perf build: Add make check-headers target Don't print header differences during the perf build as it's noisy. Mostly people won't care and find it annoying. As it's to improve perf trace beautifier to catch up new changes mostly in UAPIs, we can make it a separate build target and call it occasionally. Make it and build-test related targets phony. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit ad2cd6f9def4899591a75a96f71752e3aadb7579 Author: Namhyung Kim Date: Sun May 10 13:23:43 2026 -0700 perf trace: Sync uapi/linux/sched.h with the kernel source To pick up changes from: 9d4e752a24f740b3 ("namespace: allow creating empty mount namespaces") c8134b5f13ae959d ("pidfd: add CLONE_PIDFD_AUTOKILL") 24baca56fafc33d4 ("clone: add CLONE_NNP") 12ae2c81b21cfaa1 ("clone: add CLONE_AUTOREAP") 2e7af192697ef2a7 ("sched/deadline: Add reporting of runtime left & ...") This would be used to beautify scheduler syscall arguments and not to affect builds of other tools (e.g. objtool). Please see tools/include/uapi/README. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit ca706027b5bdb37337e1b99752134d592f42f0ea Author: Namhyung Kim Date: Sun May 10 13:23:42 2026 -0700 perf trace: Sync uapi/linux/mount.h with the kernel source To pick up changes from: 5e8969bd19271241 ("mount: add FSMOUNT_NAMESPACE") This would be used to beautify mount syscall arguments and not to affect builds of other tools (e.g. objtool). Please see tools/include/uapi/README. Reviewed-by: Ian Rogers Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Namhyung Kim commit b30e1493e3e27b6795244a472f0bbd07d0dc58fd Author: Namhyung Kim Date: Sun May 10 13:23:41 2026 -0700 perf trace: Sync uapi/linux/fs.h with the kernel source To pick up changes from: 1f662195dbc07a66 ("fs: add generic FS_IOC_SHUTDOWN definitions") This would be used to beautify filesystem syscall arguments and not to affect builds of other tools (e.g. objtool). Please see tools/include/uapi/README. Reviewed-by: Ian Rogers Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Namhyung Kim commit aa13e4b120f9cf238ad141d8419851f3a7a3fb5f Author: Namhyung Kim Date: Sun May 10 13:23:40 2026 -0700 perf trace: Sync linux/socket.h with the kernel source To pick up changes from: c66e0f453d1afa82 ("net: use ktime_t in struct scm_timestamping_internal") This would be used to beautify networking syscall arguments and not to affect builds of other tools (e.g. objtool). Please see tools/include/uapi/README. Reviewed-by: Ian Rogers Cc: netdev@vger.kernel.org Signed-off-by: Namhyung Kim commit 70eda68668d1476b459b64e69b8f36659fa9dfa8 Merge: 48f76a12713253 64ffa2e5e02ff5 Author: Linus Torvalds Date: Thu May 14 14:30:01 2026 -0700 Merge tag 'hid-for-linus-2026051401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fixes for a few OOB/UAF in several HID drivers (Florian Pradines, Lee Jones, Michael Zaidman, Rosalie Wanders, Sangyun Kim and Tomasz Pakuła) - more general sanitation of input data, dealing with potentially malicious hardware in hid-core (Benjamin Tissoires) - a few device-specific quirks and fixups * tag 'hid-for-linus-2026051401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (22 commits) HID: logitech-hidpp: Add support for newer Bluetooth keyboards HID: pidff: Fix integer overflow in pidff_rescale HID: i2c-hid: add reset quirk for BLTP7853 touchpad HID: core: introduce hid_safe_input_report() HID: pass the buffer size to hid_report_raw_event HID: google: hammer: stop hardware on devres action failure HID: appletb-kbd: run inactivity autodim from workqueues HID: appletb-kbd: fix UAF in inactivity-timer cleanup path HID: playstation: Clamp num_touch_reports HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID HID: mcp2221: fix OOB write in mcp2221_raw_event() HID: quirks: really enable the intended work around for appledisplay HID: hid-sjoy: race between init and usage HID: uclogic: Fix regression of input name assignment HID: intel-thc-hid: Intel-quickspi: Fix some error codes HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle HID: elan: Add support for ELAN SB974D touchpad HID: sony: add missing size validation for Rock Band 3 Pro instruments HID: sony: add missing size validation for SMK-Link remotes HID: sony: remove unneeded WARN_ON() in sony_leds_init() ... commit 48f76a12713253f3abaa39c4ff7606d6fed05a7e Merge: 66182ca873a4e8 af149b667b9472 Author: Linus Torvalds Date: Thu May 14 14:06:31 2026 -0700 Merge tag 'acpi-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fixes from Rafael Wysocki: "These fix several platform drivers that use the ACPI companion of the given platform device without checking its presence, which may lead to a NULL pointer dereference or other kind of malfunction if the driver is forced to match a device without an ACPI companion via driver override, and restore debug log level for some messages in the ACPI CPPC library: - Check ACPI_COMPANION() against NULL during probe in several core ACPI device drivers (Rafael Wysocki) - Restore log level of messages in amd_set_max_freq_ratio() (Mario Limonciello)" * tag 'acpi-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PAD: xen: Check ACPI_COMPANION() against NULL ACPI: driver: Check ACPI_COMPANION() against NULL during probe Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn" commit 4a9b16541ad3faf8bccb398532bf3f8b6bbf1188 Author: Stephen Smalley Date: Wed May 13 14:05:06 2026 -0400 lsm: hold cred_guard_mutex for lsm_set_self_attr() Just as proc_pid_attr_write() already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allow the transition. Cc: stable@vger.kernel.org Signed-off-by: Stephen Smalley Acked-by: Casey Schaufler Signed-off-by: Paul Moore commit af149b667b9472bf981591a6d27efdecd331005a Merge: b7cdd59de5ae80 db5dadb562cabb Author: Rafael J. Wysocki Date: Thu May 14 22:46:33 2026 +0200 Merge branch 'acpi-cppc' Merge a revert of an ACPI CPPC commit that increased the log level of some debug messages which turned out to be a bad idea: - Restore log level of messages in amd_set_max_freq_ratio() (Mario Limonciello) * acpi-cppc: Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn" commit 75ef233975589d9a8c88bc8822a7c725c71ff650 Author: Felix Gu Date: Wed May 6 19:29:02 2026 +0800 soc: microchip: mpfs-sys-controller: fix resource leak on probe error In mpfs_sys_controller_probe(), when device_get_match_data() returns NULL, it returns -EINVAL directly without freeing the mbox channel or the allocated sys_controller memory, causing a resource leak. Fixes: 63b5305ad84d ("soc: microchip: mpfs-sys-controller: add support for pic64gx") Signed-off-by: Felix Gu Signed-off-by: Conor Dooley commit 0ce1bc9e46ecabe84772bb561e373c0d9876d6f2 Author: Michael Bommarito Date: Wed May 13 13:53:24 2026 -0400 RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to siw_check_mem() as an int len (whose interval check addr + len > mem->va + mem->len is satisfied for a valid base when len is negative), and reaches siw_rx_data() -> siw_rx_kva() / siw_rx_umem() -> skb_copy_bits() as a signed copy length. The header copy branch in skb_copy_bits() promotes that to size_t, producing a multi-gigabyte read. KASAN under a KUnit harness that drives the real kernel TCP receive path -- a loopback AF_INET socketpair, the malformed FPDU written via kernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock dispatching to siw_tcp_rx_data -- reports: BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480 Read of size 4294967295 at addr ffff888... Call Trace: skb_copy_bits siw_rx_kva siw_rx_data siw_check_mem siw_proc_write siw_tcp_rx_data __tcp_read_sock siw_qp_llp_data_ready tcp_data_ready tcp_data_queue Add the missing invariant at the earliest point where the peer header is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly the value the siw transmitter uses as the minimum mpa_len for each opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the protocol contract. Out-of-range FPDUs terminate the connection with TERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which is RFC 5044 Section 8 error code 3 ("Marker and ULPDU Length fields do not agree on the start of an FPDU"), the correct framing-error class for this inconsistency. Fixes: 8b6a361b8c48 ("rdma/siw: receive path") Link: https://patch.msgid.link/r/20260513175325.2042630-2-michael.bommarito@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-7 Acked-by: Bernard Metzler Signed-off-by: Jason Gunthorpe commit c207f1d785044667f87cc8c72355e33f3981f2d6 Author: David Howells Date: Wed May 13 19:50:02 2026 +0100 smbdirect: Fix error cleanup in smbdirect_map_sges_from_iter() Fix smbdirect_map_sges_from_iter() to use pre-decrement, not post-decrement so that it cleans up the correct slots. Fixes: e5fbdde43017 ("cifs: Add a function to build an RDMA SGE list from an iterator") Closes: https://sashiko.dev/#/patchset/20260326104544.509518-1-dhowells%40redhat.com Signed-off-by: David Howells Reviewed-by: Stefan Metzmacher cc: Paulo Alcantara cc: Tom Talpey cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 6c65cf23d4c6170fcf5714c32aa64689718cb142 Author: Sven Eckelmann Date: Wed May 13 09:01:35 2026 +0200 batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed. Cc: stable@kernel.org Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Reviewed-by: Yuan Tan Signed-off-by: Sven Eckelmann commit 2d8826a2d3657cea66fb0370f9e521575a673871 Author: Sven Eckelmann Date: Wed May 13 09:01:34 2026 +0200 batman-adv: dat: handle forward allocation error batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb for each DHT candidate, but does not check the return value before passing it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences the skb unconditionally, so a failed allocation triggers a NULL pointer dereference. Skip forwarding to the current DHT candidate on allocation failure. Cc: stable@kernel.org Fixes: 785ea1144182 ("batman-adv: Distributed ARP Table - create DHT helper functions") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Reviewed-by: Yuan Tan Signed-off-by: Sven Eckelmann commit 702809dabdecca807bdd50cfdcc1c980feb2ba62 Author: Matt Evans Date: Mon May 11 07:58:24 2026 -0700 vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's possible to access unreserved resources through the export. Add a check to the DMABUF-creation path. Fixes: 5d74781ebc86c ("vfio/pci: Add dma-buf export support for MMIO regions") Signed-off-by: Matt Evans Link: https://lore.kernel.org/r/20260511145829.2993601-3-mattev@meta.com Signed-off-by: Alex Williamson commit 05f2a68b407a6817fe141dd64972c6ab8725312d Author: Matt Evans Date: Mon May 11 07:58:23 2026 -0700 vfio/pci: Set up BAR resources and maps in vfio_pci_core_enable() Previously BAR resource requests and the corresponding pci_iomap() were performed on-demand and without synchronisation, which was racy. Rather than add synchronisation, it's simplest to address this by doing both activities from vfio_pci_core_enable(). The resource allocation and/or pci_iomap() can still fail; their status is tracked and existing calls to vfio_pci_core_setup_barmap() will fail in a similar way to before. This keeps the point of failure as observed by userspace the same, i.e. failures to request/map unused BARs are benign. Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver") Signed-off-by: Matt Evans Link: https://lore.kernel.org/r/20260511145829.2993601-2-mattev@meta.com [ERR_PTR -> IOMEM_ERR_PTR per lkp report] Signed-off-by: Alex Williamson commit b66829b17f6385cc9ffbcbe2476d532d2e3121ad Author: Tudor Ambarus Date: Tue May 5 13:12:59 2026 +0000 firmware: samsung: acpm: Fix mailbox channel leak on probe error Sashiko identified the leak at [1]. The ACPM driver allocates hardware mailbox channels using `mbox_request_channel()` during `acpm_channels_init()`. However, the driver lacked a `.remove` callback and did not free these channels on subsequent error paths inside `acpm_probe()`. Additionally, if `acpm_achan_alloc_cmds()` failed during the channel initialization loop, the function returned immediately, bypassing the manual cleanup and permanently leaking any channels successfully requested in previous loop iterations. Fix this by modifying `acpm_free_mbox_chans()` to match the `devres` action signature and registering it via `devm_add_action_or_reset()`. Cc: stable@vger.kernel.org Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org [1] Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-2-43b5ee7f1674@linaro.org Signed-off-by: Krzysztof Kozlowski commit f133bd4b5daf71bccdde0ad1a4f47fac76a6bfb1 Author: Tudor Ambarus Date: Tue May 5 13:12:58 2026 +0000 firmware: samsung: acpm: Fix cross-thread RX length corruption Sashiko identified a cross-thread RX length corruption bug when reviewing the thermal addition to ACPM [1]. When multiple threads concurrently send IPC requests, the ACPM polling mechanism can encounter responses belonging to other threads. To drain the queue, the driver saves these concurrent responses into an internal cache (`rx_data->cmd`) to be retrieved later by the owning thread. Previously, the driver incorrectly used `xfer->rxcnt` (the expected receive length of the *current* polling thread) when copying data for *other* threads into this cache. If the threads expected responses of different lengths, this resulted in buffer underflows (leading to reads of uninitialized memory) or potential buffer overflows. Fix this by replacing the boolean `response` flag in `struct acpm_rx_data` with `rxcnt`, caching the exact expected receive length for each specific transaction during transfer preparation. Use this cached length when saving concurrent responses. Consequently, ensure that `xfer->rxcnt` is explicitly zeroed in driver helpers (e.g., `acpm_dvfs_set_xfer`) for fire-and-forget messages to prevent uninitialized stack garbage from being interpreted as a massive expected receive length. Cc: stable@vger.kernel.org Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org [1] Reported-by: Titouan Ameline de Cadeville Closes: https://lore.kernel.org/r/20260426210255.73674-1-titouan.ameline@gmail.com/ Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-1-43b5ee7f1674@linaro.org Signed-off-by: Krzysztof Kozlowski commit a340a51ed801eab7bb454150c226323b865263cc Author: Ruijie Li Date: Thu May 14 16:13:25 2026 +0800 batman-adv: clear current gateway during teardown batadv_gw_node_free() removes the gateway list entries during mesh teardown, but it does not clear the currently selected gateway. This leaves stale gateway state behind across cleanup and can break a later mesh recreation. Clear bat_priv->gw.curr_gw before walking the gateway list so the selected gateway reference is dropped as part of teardown. Fixes: 2265c1410864 ("batman-adv: gateway election code refactoring") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Ruijie Li Signed-off-by: Zhanpeng Li Signed-off-by: Ren Wei Signed-off-by: Sven Eckelmann commit 78ee734b36284d82454e87a92094fdb926985b47 Author: Kuan-Wei Chiu Date: Tue May 5 17:14:57 2026 +0000 clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs In the peric0_clk_regs array, the divider register offset for USI6 was accidentally listed twice, while the divider for USI7 was omitted. Missing this DIV register causes the USI7 clock divider setting to be lost and reset to its hardware default value during a suspend/resume cycle. Replace the duplicated USI6 DIV entry with the correct USI7 DIV register. Fixes: 893f133a040b ("clk: samsung: gs101: add support for cmu_peric0") Signed-off-by: Kuan-Wei Chiu Reviewed-by: Peter Griffin Reviewed-by: Tudor Ambarus Link: https://patch.msgid.link/20260505171457.1960837-1-visitorckw@gmail.com Signed-off-by: Krzysztof Kozlowski commit 9cd3f16c320bfdadd4509358122368deb56a5741 Author: Ruide Cao Date: Wed May 13 11:58:15 2026 +0800 batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths. Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Ruide Cao Tested-by: Ren Wei Signed-off-by: Ren Wei Signed-off-by: Sven Eckelmann commit 4594437880ce347ac8438758fd91543f70da1aa9 Author: Juergen Gross Date: Fri May 8 16:39:33 2026 +0200 x86/xen: Tolerate nested XEN_LAZY_MMU entering/leaving With the support of nested lazy mmu sections it can happen that arch_enter_lazy_mmu_mode() is being called twice without a call of arch_leave_lazy_mmu_mode() in between, as the lazy_mmu_*() helpers are not disabling preemption when checking for nested lazy mmu sections. This is a problem when running as a Xen PV guest, as xen_enter_lazy_mmu() and xen_leave_lazy_mmu() don't tolerate this case. Fix that in xen_enter_lazy_mmu() and xen_leave_lazy_mmu() in order not to hurt all other lazy mmu mode users. Fixes: 291b3abed657 ("x86/xen: use lazy_mmu_state when context-switching") Tested-by: Marek Marczykowski-Górecki Signed-off-by: Juergen Gross Message-ID: <20260508143933.493013-1-jgross@suse.com> commit 28e03f78e69cf6628b81f24777799778528a84c1 Author: Juergen Gross Date: Tue May 5 12:24:17 2026 +0200 x86/xen: Fix xen_e820_swap_entry_with_ram() When swapping a not page-aligned E820 map entry with RAM, the start address of the modified entry is calculated wrong (the offset into the page is subtracted instead of being added to the page address). Fixes: be35d91c8880 ("xen: tolerate ACPI NVS memory overlapping with Xen allocated memory") Reported-by: Jan Beulich Reviewed-by: Jan Beulich Signed-off-by: Juergen Gross Message-ID: <20260505102417.208138-1-jgross@suse.com> commit 905c559e51497b8bfdbb68df8be56d2f70f0de8e Author: Kees Cook Date: Sat Mar 14 14:24:56 2026 +0100 gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE For gcc-16, the CONST_CAST macro family was removed. Add back what we were using in gcc-common.h, as they are simple wrappers. See GCC commits: c3d96ff9e916c02584aa081f03ab999292efbb50 458c7926d48959abcb2c1adaa22458e27459a551 Suggested-by: Ingo Saitz Link: https://lore.kernel.org/lkml/ab6OKoay0OWkywjK@spatz.zoo Fixes: 6b90bd4ba40b ("GCC plugin infrastructure") Tested-by: Ivan Bulatovic Tested-by: Christopher Cradock Signed-off-by: Kees Cook commit 66182ca873a4e87b3496eca79d57f86b76d7f52d Merge: eb5441518fba29 c78bdba7b96660 Author: Linus Torvalds Date: Thu May 14 08:57:43 2026 -0700 Merge tag 'net-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter. Previous releases - regressions: - ethtool: fix NULL pointer dereference in phy_reply_size - netfilter: - allocate hook ops while under mutex - close dangling table module init race - restore nf_conntrack helper propagation via expectation - tcp: - fix potential UAF in reqsk_timer_handler(). - fix out-of-bounds access for twsk in tcp_ao_established_key(). - vsock: fix empty payload in tap skb for non-linear buffers - hsr: fix NULL pointer dereference in hsr_get_node_data() - eth: - cortina: fix RX drop accounting - ice: fix locking in ice_dcb_rebuild() Previous releases - always broken: - napi: avoid gro timer misfiring at end of busypoll - sched: - dualpi2: initialize timer earlier in dualpi2_init() - sch_cbs: Call qdisc_reset for child qdisc - shaper: - fix ordering issue in net_shaper_commit() - reject handle IDs exceeding internal bit-width - ipv6: flowlabel: enforce per-netns limit for unprivileged callers - tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - batman-adv: - reject new tp_meter sessions during teardown - purge non-released claims - eth: - i40e: cleanup PTP registration on probe failure - idpf: fix double free and use-after-free in aux device error paths - ena: fix potential use-after-free in get_timestamp" * tag 'net-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (88 commits) net: phy: DP83TC811: add reading of abilities net: tls: prevent chain-after-chain in plain text SG net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot macsec: use rcu_work to defer TX SA crypto cleanup out of softirq macsec: use rcu_work to defer RX SA crypto cleanup out of softirq macsec: introduce dedicated workqueue for SA crypto cleanup net: net_failover: Fix the deadlock in slave register MAINTAINERS: update atlantic driver maintainer selftests/tc-testing: Add QFQ/CBS qlen underflow test net/sched: sch_cbs: Call qdisc_reset for child qdisc FDDI: defza: Sanitise the reset safety timer net: ethernet: ravb: Do not check URAM suspension when WoL is active ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS net: atm: fix skb leak in sigd_send() default branch net: ethtool: phy: avoid NULL deref when PHY driver is unbound net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled net: shaper: reject QUEUE scope handle with missing id ... commit 81a874233c305d29e37fdb70b691ff4254294c0b Author: Jeremy Erazo Date: Thu May 14 12:03:34 2026 +0000 smb: client: avoid integer overflow in SMB2 READ length check SMB2 READ response validation in cifs_readv_receive() and handle_read_data() checks data_offset + data_len against the received buffer length. Both values are attacker-controlled fields from the server response and are stored as unsigned int, so the addition can wrap before the bounds check: fs/smb/client/transport.c:1259 if (!use_rdma_mr && (data_offset + data_len > buflen)) fs/smb/client/smb2ops.c:4839 else if (buf_len >= data_offset + data_len) A malicious SMB server can use this to bypass validation. In the non-encrypted receive path the client attempts an oversized socket read and stalls for the SMB response timeout (180 seconds) before reconnecting. In the SMB3 encrypted path, runtime testing shows the malformed length can reach copy_to_iter() in handle_read_data() with attacker-controlled size, where usercopy hardening stops the oversized copy before bytes reach userspace. Guard both call sites with check_add_overflow(), which is already used elsewhere in this subsystem (smb2pdu.c). On overflow, treat the response as malformed and reject with -EIO. Signed-off-by: Jeremy Erazo Signed-off-by: Steve French commit eb5441518fba295bd97b59dc54914f89dfaa107d Merge: 31e62c2ebbfdc3 f9e1c1324b4d98 Author: Linus Torvalds Date: Thu May 14 08:53:24 2026 -0700 Merge tag 'audit-pr-20260513' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit fixes from Paul Moore: - Correctly log the inheritable capabilities - Honor AUDIT_LOCKED in the AUDIT_TRIM and AUDIT_MAKE_EQUIV commands * tag 'audit-pr-20260513' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV audit: fix incorrect inheritable capability in CAPSET records commit 1854082fe0ddb81bc93d1f8e8a00554217fd09d1 Author: David Carlier Date: Fri May 8 21:19:58 2026 +0100 phy: apple: atc: Fix typec switch/mux leak on unbind atcphy_probe_switch() and atcphy_probe_mux() discard the pointers returned by typec_switch_register() and typec_mux_register(). The platform driver has no .remove callback, so when the driver unbinds (e.g. via sysfs unbind) neither typec_switch_unregister() nor typec_mux_unregister() is called. The framework reference taken in typec_switch_register() (device_initialize() + device_add() in drivers/usb/typec/mux.c) is therefore never dropped and the typec_switch_dev / typec_mux_dev objects stay live forever, with their sysfs entries under the typec_mux class also left behind. A subsequent rebind cannot recreate them with the same fwnode-derived name. Save the registered handles and unregister them through devm_add_action_or_reset() so framework registration is torn down in step with the driver's other devm-managed state. While here, drop struct apple_atcphy::sw and ::mux: they were declared with the consumer-side types (typec_switch *, typec_mux *) instead of the provider-side types and were never assigned. Scope of the fix ================ This patch fixes the registration leak only. It does not close the use-after-free window that arises when a consumer that obtained a reference via fwnode_typec_switch_get() / fwnode_typec_mux_get() outlives the provider unbind: such consumers keep the underlying typec_switch_dev / typec_mux_dev alive past device_unregister(), and a later typec_switch_set() / typec_mux_set() still invokes the registered atcphy_sw_set() / atcphy_mux_set(), which dereferences the freed apple_atcphy through typec_{switch,mux}_get_drvdata(). On Apple Silicon the relevant consumers are the typec port and the cd321x controller registered by drivers/usb/typec/tipd/core.c. Cable plug / orientation events and alt-mode transitions trigger the .set callbacks via: tps6598x_interrupt() drivers/usb/typec/tipd/core.c tps6598x_handle_plug_event() tps6598x_connect()/_disconnect() typec_set_orientation() drivers/usb/typec/class.c typec_switch_set(port->sw) drivers/usb/typec/mux.c atcphy_sw_set() drivers/phy/apple/atc.c cd321x_update_work() drivers/usb/typec/tipd/core.c cd321x_typec_update_mode() typec_mux_set(cd321x->mux) drivers/usb/typec/mux.c atcphy_mux_set() drivers/phy/apple/atc.c Closing that window requires framework support for invalidating consumer-held references on provider unbind. The same consumer-survives-provider pattern has been discussed for the PHY framework [1] and is out of scope here. [1] https://lore.kernel.org/linux-phy/aZejMSJ9qqRWb2pX@google.com/ Fixes: 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY") Signed-off-by: David Carlier Reviewed-by: Vladimir Oltean Tested-by: Joshua Peisach Link: https://lkml.kernel.org/r/6ec1ed08328340db42655287afd5fa4067316b11.camel@perches.com Link: https://patch.msgid.link/20260508201958.30060-1-devnexen@gmail.com Signed-off-by: Vinod Koul commit 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a Author: Linus Torvalds Date: Wed May 13 11:37:18 2026 -0700 ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you don't have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses 'dumpable' to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). It's not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional "drop capabilities" model doesn't make any difference for this all. Make it all make a *bit* more sense by saying that if you don't have a MM pointer, we'll use a cached "last dumpability" flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override. Reported-by: Qualys Security Advisory Cc: Oleg Nesterov Cc: Kees Cook Signed-off-by: Linus Torvalds commit 593980175389a05793f6060aa20e626330960395 Author: Guannan Wang Date: Thu May 14 15:44:54 2026 +0800 bpf: Use array_map_meta_equal for percpu array inner map replacement percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not compare max_entries. When a percpu array serves as an inner map, replacing it with one that has fewer max_entries bypasses the check. Since percpu_array_map_gen_lookup() inlines the original template's index_mask as a JIT immediate, a lookup on the replacement map can access pptrs[] out of bounds. Point percpu_array_map_ops.map_meta_equal to array_map_meta_equal(), which already enforces the max_entries equality check. Add a selftest to verify that replacing a percpu array inner map with a differently-sized one is rejected. Fixes: db69718b8efa ("bpf: inline bpf_map_lookup_elem() for PERCPU_ARRAY maps") Signed-off-by: Guannan Wang Acked-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260514074454.77491-1-wgnbuaa@gmail.com Signed-off-by: Alexei Starovoitov commit ab26dfeba278b0efbcea012f1698cf524d9b5695 Author: DaeMyung Kang Date: Wed May 13 22:26:22 2026 +0900 cifs: client: stage smb3_reconfigure() updates and restore ctx on failure smb3_reconfigure() moves strings out of cifs_sb->ctx before the multichannel update, so a later failure can leave the live context with NULL strings or options that do not match the session. Stage the new ctx separately, commit it only on success, and restore the snapshot on failure. Also make smb3_sync_session_ctx_passwords() all-or-nothing. Commit session passwords before channel updates so newly added channels authenticate with the staged credentials. Fixes: ef529f655a2c ("cifs: client: allow changing multichannel mount options on remount") Reported-by: RAJASI MANDAL Closes: https://lore.kernel.org/lkml/CAEY6_V1+dzW3OD5zqXhsWyXwrDTrg5tAMGZ1AJ7_GAuRE+aevA@mail.gmail.com/ Link: https://lore.kernel.org/lkml/xkr2dlvgibq5j6gkcxd3yhhnj4atgxw2uy4eug2pxm7wy7nbms@iq6cf5taa65v/ Reviewed-by: Henrique Carvalho Signed-off-by: DaeMyung Kang Signed-off-by: Steve French commit a6ab75639e23169a741b0b2e12191fd8acb32c73 Author: Nick Chan Date: Thu May 14 21:16:01 2026 +0800 nvme-apple: Reset q->sq_tail during queue init Fixes a "duplicate tag error for tag 0" firmware crash during controller reset while setting up a queue on Apple A11 / T8015 caused by stale entries in the submission queue due to an invalid sq_tail offset after reset. Fixes: 04d8ecf37b5e ("nvme: apple: Add Apple A11 support") Cc: stable@vger.kernel.org Suggested-by: Yuriy Havrylyuk Reviewed-by: Sven Peter Signed-off-by: Nick Chan Signed-off-by: Keith Busch commit 7d9a7f1f96cd617ee9e75bb22217c709038e26b8 Author: Ye Bin Date: Thu May 14 21:14:18 2026 +0800 smb/client: fix possible infinite loop and oob read in symlink_data() On 32-bit architectures, the infinite loop is as follows: len = p->ErrorDataLength == 0xfffffff8 u8 *next = p->ErrorContextData + len next == p On 32-bit architectures, the out-of-bounds read is as follows: len = p->ErrorDataLength == 0xfffffff0 u8 *next = p->ErrorContextData + len next == (u8 *)p - 8 Reported-by: ChenXiaoSong Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+") Cc: stable@vger.kernel.org Signed-off-by: Ye Bin Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 982422b11e6f95f766a8cd2c2b1cbdb77e234a61 Author: Antonio Quartulli Date: Tue Mar 17 14:47:56 2026 +0100 ovpn: fix race between deleting interface and adding new peer While deleting an existing ovpn interface, there is a very narrow window where adding a new peer via netlink may cause the netdevice to hang and prevent its unregistration. It may happen during ovpn_dellink(), when all existing peers are freed and the device is queued for deregistration, but a CMD_PEER_NEW message comes in adding a new peer that takes again a reference to the netdev. At this point there is no way to release the device because we are under the assumption that all peers were already released. Fix the race condition by releasing all peers in ndo_uninit(), when the netdevice has already been removed from the netdev list. Also ovpn_peer_add() has now an extra check that forces the function to bail out if the device reg_state is not REGISTERED. This way any incoming CMD_PEER_NEW racing with the interface deletion routine will simply stop before adding the peer. Note that the above check happens while holding the netdev_lock to prevent racing netdev state changes. ovpn_dellink() is now empty and can be removed. Reported-by: Hyunwoo Kim Closes: https://lore.kernel.org/netdev/aaVgJ16edTfQkYbx@v4bel/ Suggested-by: Sabrina Dubroca Fixes: 80747caef33d ("ovpn: introduce the ovpn_peer object") Reviewed-by: Sabrina Dubroca Signed-off-by: Antonio Quartulli commit 1fef6614673ff0846d30acdeeaf3cf98bb5f6116 Author: David Carlier Date: Wed May 13 11:55:21 2026 +0100 ovpn: respect peer refcount in CMD_NEW_PEER error path ovpn_nl_peer_new_doit()'s error path calls ovpn_peer_release() directly rather than ovpn_peer_put(), bypassing the kref. The accompanying comment ("peer was not yet hashed, thus it is not used in any context") holds for UDP but not for TCP. For UDP, the ovpn_socket union uses the .ovpn arm and never points back at a peer; UDP encap_recv looks up peers via the not-yet-populated hashtables, so the new peer is unreachable until ovpn_peer_add() publishes it. For TCP, ovpn_socket_new() sets ovpn_sock->peer and ovpn_tcp_socket_attach() publishes ovpn_sock via rcu_assign_sk_user_data(). From that moment until ovpn_socket_release() detaches in the error path, the TCP fd is fully wired: userspace recvmsg / sendmsg / close / poll on the fd, as well as the strparser-driven ovpn_tcp_rcv() path, can reach the peer through sk_user_data -> ovpn_sock->peer and bump its refcount via ovpn_peer_hold(). ovpn_tcp_socket_wait_finish() (called inside ovpn_socket_release()) drains strparser and the tx work, but does not synchronize with userspace syscall callers that already hold a peer reference. If ovpn_nl_peer_modify() or ovpn_peer_add() returns an error while such a caller is in flight - notably an ovpn_tcp_recvmsg() blocked in __skb_recv_datagram() on peer->tcp.user_queue - the direct ovpn_peer_release() destroys the peer while the caller still holds the reference, and the eventual ovpn_peer_put() from that caller operates on freed memory. Replace the direct destructor call with ovpn_peer_put() so the kref correctly defers destruction until the last reference is dropped. In the common case where no concurrent user is present, behaviour is unchanged: the kref hits zero immediately and ovpn_peer_release_kref() runs the same destructor. With this conversion ovpn_peer_release() has no callers outside peer.c - ovpn_peer_release_kref() in the same translation unit is the only remaining user - so make it static and drop its declaration from peer.h. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Reviewed-by: Sabrina Dubroca Assisted-by: Claude:claude-opus-4-7 Signed-off-by: David Carlier Signed-off-by: Antonio Quartulli commit 775d8d7ad02aa345e1588424a6a8b9ae49fb9012 Author: David Carlier Date: Wed May 13 11:55:20 2026 +0100 ovpn: tcp - use cached peer pointer in ovpn_tcp_close() ovpn_tcp_close() loads the ovpn_socket via rcu_dereference_sk_user_data() under rcu_read_lock(), takes a reference on sock->peer, caches the peer pointer in a local, and drops the read lock. It then passes sock->peer (rather than the cached local) to ovpn_peer_del(), re-dereferencing the ovpn_socket after the RCU read section has ended. Unlike ovpn_tcp_sendmsg(), which uses the same "load under RCU, use after unlock" pattern but is protected by lock_sock() held across the function, ovpn_tcp_close() runs without the socket lock: inet_release() invokes sk_prot->close() without taking lock_sock first. ovpn_socket_release() can therefore complete its kref_put -> detach -> synchronize_rcu -> kfree(sock) sequence concurrently, in the window after ovpn_tcp_close() drops rcu_read_lock() but before it dereferences sock->peer. The synchronize_rcu() in ovpn_socket_release() protects readers that use the dereferenced pointer inside the RCU read section, not those that escape the pointer to a local and use it afterwards. A reproducer follows the pattern of commit 94560267d6c4 ("ovpn: tcp - don't deref NULL sk_socket member after tcp_close()"): trigger a peer removal (keepalive expiration or netlink OVPN_CMD_DEL_PEER) at the same moment userspace closes the TCP fd. That commit fixed the detach-side of the same race window; this one fixes the close-side at a different victim. Tighten the entry block to read sock->peer exactly once into the cached peer local, and route all subsequent uses (the hold check, the ovpn_peer_del() call, and the prot->close() invocation) through that local. sock->peer is only ever written once in ovpn_socket_new() under lock_sock(), before rcu_assign_sk_user_data() publishes the ovpn_socket, and is never reassigned afterwards - but the previous multi-read pattern made that invariant implicit rather than explicit. The same multi-read shape exists in ovpn_tcp_recvmsg(), ovpn_tcp_sendmsg(), ovpn_tcp_data_ready() and ovpn_tcp_write_space(); those will be cleaned up via a dedicated helper in a follow-up net-next series. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Reviewed-by: Sabrina Dubroca Assisted-by: Claude:claude-opus-4-7 Signed-off-by: David Carlier Signed-off-by: Antonio Quartulli commit 7f114497784661b887f1097c440221b18e2914e9 Author: Ralf Lici Date: Wed May 13 13:10:49 2026 +0200 selftests: ovpn: reduce remaining ping flood counts Commit 201ba706318d ("selftests: ovpn: reduce ping count in test.sh") lowered the baseline traffic flood ping count to avoid flakes on slower CI instances, however some instances were left out. Apply the same limit to the remaining ovpn selftest flood pings that still request 500 packets. Fixes: 201ba706318d ("selftests: ovpn: reduce ping count in test.sh") Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit 375ba7484132662a4a8c7547d088fb6275c00282 Author: Shuai Zhang Date: Mon May 11 21:58:37 2026 +0800 Bluetooth: hci_qca: Convert timeout from jiffies to ms Since the timer uses jiffies as its unit rather than ms, the timeout value must be converted from ms to jiffies when configuring the timer. Otherwise, the intended 8s timeout is incorrectly set to approximately 33s. To improve readability, embed msecs_to_jiffies() directly in the macro definitions and drop the _MS suffix from macros that now yield jiffies values: MEMDUMP_TIMEOUT, FW_DOWNLOAD_TIMEOUT, IBS_DISABLE_SSR_TIMEOUT, CMD_TRANS_TIMEOUT, and IBS_BTSOC_TX_IDLE_TIMEOUT. IBS_WAKE_RETRANS_TIMEOUT_MS and IBS_HOST_TX_IDLE_TIMEOUT_MS are intentionally left unchanged. Their values are stored in the struct fields wake_retrans and tx_idle_delay, which hold ms values at runtime and can be modified via debugfs. The msecs_to_jiffies() conversion happens at each call site against the field value, so it cannot be embedded in the macro. Wake timer depends on commit c347ca17d62a Cc: stable@vger.kernel.org Fixes: d841502c79e3 ("Bluetooth: hci_qca: Collect controller memory dump during SSR") Reviewed-by: Paul Menzel Acked-by: Bartosz Golaszewski Signed-off-by: Shuai Zhang Signed-off-by: Luiz Augusto von Dentz commit 3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d Author: Michael Bommarito Date: Mon May 11 08:26:41 2026 -0400 Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings") converted the on-stack request PDU in l2cap_ecred_reconfigure() from an explicit packed struct to DEFINE_RAW_FLEX(), but did not adjust the size and source-pointer arguments to l2cap_send_cmd(): - struct { - struct l2cap_ecred_reconf_req req; - __le16 scid; - } pdu; + DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1); ... l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ, sizeof(pdu), &pdu); After the conversion, DEFINE_RAW_FLEX() expands to declare an anonymous union pdu_u plus a local pointer "pdu" pointing at it. Therefore: - sizeof(pdu) is now sizeof(struct l2cap_ecred_reconf_req *) = 8 on 64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]). - &pdu is the address of the local pointer's stack storage, not the address of the request payload. l2cap_send_cmd() forwards (data, count) to l2cap_build_cmd(), which calls skb_put_data(skb, data, count). The L2CAP_ECRED_RECONFIGURE_REQ packet body therefore contains 8 bytes copied from the kernel stack starting at &pdu -- the 8 bytes overlap the pdu pointer's value, leaking a kernel stack address to the paired Bluetooth peer. The intended (mtu, mps, scid) fields are not transmitted at all, so the peer rejects the request as malformed and the L2CAP_ECRED_RECONFIGURE feature itself has been broken for the local-side initiator since the introducing commit landed. The sibling site l2cap_ecred_conn_req() in the same commit was converted correctly (sizeof(*pdu) + len, pdu); only this site was missed. Restore the original semantics: pass the full flex-struct size via struct_size(pdu, scid, 1) and the pdu pointer (the struct address) as the source. Validated on a stock 7.0-based host kernel via the real call path: setsockopt(SOL_BLUETOOTH, BT_RCVMTU, ...) on a BT_CONNECTED L2CAP_MODE_EXT_FLOWCTL socket emits an L2CAP_ECRED_RECONFIGURE_REQ whose body is 8 bytes (the on-stack pdu local's value) rather than the expected 6. Three captures from fresh socket / fresh hciemu peer on the same host -- low bytes vary per call, high 0xffff confirms a kernel virtual address (KASLR-randomised stack slot, not a fixed string): RECONF_REQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff RECONF_REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff After this patch the body is 6 bytes carrying the expected little-endian (mtu, mps, scid). Cc: stable@vger.kernel.org Fixes: 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Signed-off-by: Luiz Augusto von Dentz commit e3ac0d9f1a205f33a43fba3b79ef74d2f604c78b Author: Pauli Virtanen Date: Fri Apr 24 22:24:29 2026 +0300 Bluetooth: btmtk: accept too short WMT FUNC_CTRL events MT7925 (USB ID 0e8d:e025) on fw version 20260106153314 sends WMT FUNC_CTRL events that are missing the status field. Prior to commit 006b9943b982 ("Bluetooth: btmtk: validate WMT event SKB length before struct access") the status was read from out-of-bounds of SKB data, which usually would result to success with BTMTK_WMT_ON_UNDONE, although I don't know the intent here. The bounds check added in that commit returns with error instead, producing "Bluetooth: hci0: Failed to send wmt func ctrl (-22)" and makes the device unusable. Fix the regression by interpreting too short packet as status BTMTK_WMT_ON_UNDONE, which makes the device work normally again. Fixes: 634a4408c061 ("Bluetooth: btmtk: validate WMT event SKB length before struct access") Signed-off-by: Pauli Virtanen Tested-by: Mikhail Gavrilov # MT7922 (0489:e0e2) Signed-off-by: Luiz Augusto von Dentz commit e83f5e24da741fa9405aeeff00b08c5ee7c37b88 Author: Jiexun Wang Date: Wed May 6 19:43:30 2026 +0800 Bluetooth: serialize accept_q access bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import. Protect accept_q with a dedicated lock for queue updates and polling. Also rework bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking the child socket. Fixes: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Jann Horn Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Jiexun Wang Signed-off-by: Ren Wei Signed-off-by: Jiexun Wang Reviewed-by: Jann Horn Signed-off-by: Luiz Augusto von Dentz commit e4e9b7b38d5db2cc6a8770bc0596bb8b36b92b1f Author: Mario Limonciello Date: Tue May 12 17:19:47 2026 -0500 cpufreq/amd-pstate: Drop Kconfig option for dynamic EPP There are some performance issues being identified by dynamic EPP and we don't want to have distributions turning it on by default exposing them to users at this time. Drop the kconfig option, and require an explicit opt in from kernel command line or runtime sysfs option to turn it on. Reported-by: Viktor Jägersküpper Closes: https://lore.kernel.org/linux-pm/14a87c99-785c-4b16-bfce-35ecbf053448@freenet.de/ Reported-by: Stuart Meckle Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221473 Signed-off-by: Mario Limonciello Reviewed-by: K Prateek Nayak Link: https://lore.kernel.org/r/20260512221947.1652988-1-mario.limonciello@amd.com (fix sysfs file path) Signed-off-by: Mario Limonciello (AMD) commit 1d59f36e95f7f7134db0e313c9d787cb0adb2153 Author: Thomas Hellström Date: Mon May 11 18:24:43 2026 +0200 drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure Apply the same fix as b2ed01e7ad ("drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure") to the ttm_bo_shrink() path. Move del_bulk_move from before the backup to after success only, using ttm_resource_del_bulk_move_unevictable() since the resource is now unevictable once fully backed up. Fixes: 70d645deac98 ("drm/ttm: Add helpers for shrinking") Cc: Christian König Cc: Huang Rui Cc: Matthew Auld Cc: Matthew Brost Cc: Dave Airlie Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v6.15+ Assisted-by: GitHub_Copilot:claude-opus-4.6 Reviewed-by: Matthew Auld Link: https://patch.msgid.link/20260511162443.24352-1-thomas.hellstrom@linux.intel.com Signed-off-by: Thomas Hellström commit c78bdba7b9666020c0832150a4fc4c0aebc7c6ac Author: Sven Schuchmann Date: Tue May 12 09:19:47 2026 +0200 net: phy: DP83TC811: add reading of abilities At this time the driver is not listing any speeds it supports. This should be ETHTOOL_LINK_MODE_100baseT1_Full_BIT for DP83TC811. Add the missing call for phylib to read the abilities. Fixes: b753a9faaf9a ("net: phy: DP83TC811: Introduce support for the DP83TC811 phy") Suggested-by: Andrew Lunn Signed-off-by: Sven Schuchmann Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260512071949.6218-1-schuchmann@schleissheimer.de [pabeni@redhat.com: dropped revision history] Signed-off-by: Paolo Abeni commit 67ea9d353d0ba12bdbc9183ff568dead9e949b80 Author: Qing Wang Date: Tue May 12 11:50:35 2026 +0800 mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache() flush_rcu_sheaves_on_cache() calls queue_work_on() in a for_each_online_cpu() loop, which requires the cpu to stay online. But cpus_read_lock() is not held in kvfree_rcu_barrier_on_cache() and the set of "online cpus" is subject to change. There are two paths that call flush_rcu_sheaves_on_cache(): // has cpus_read_lock() flush_all_rcu_sheaves() -> flush_rcu_sheaves_on_cache() // no cpus_read_lock() kvfree_rcu_barrier_on_cache() -> flush_rcu_sheaves_on_cache() Fix this by holding cpus_read_lock() in kvfree_rcu_barrier_on_cache(). Why not move cpus_read_lock() from flush_all_rcu_sheaves() into flush_rcu_sheaves_on_cache()? The reason is it would introduce a new lock order (slab_mutex -> cpu_hotplug_lock). The reverse order (cpu_hotplug_lock -> slab_mutex) is established by - cpuhp_setup_state_nocalls(..., slub_cpu_setup, ...) - kmem_cache_destroy() The two orders together would form an AB-BA deadlock. Finally, add lockdep_assert_cpus_held() in flush_rcu_sheaves_on_cache() to catch the same problem in the future. Fixes: 0f35040de593 ("mm/slab: introduce kvfree_rcu_barrier_on_cache() for cache destruction") Cc: Signed-off-by: Qing Wang Link: https://patch.msgid.link/20260512035035.762317-1-wangqing7171@gmail.com Signed-off-by: Vlastimil Babka (SUSE) commit f2e65e4e5b4b4b9ecf43f03c3fdbe8c9a8a43a9e Author: Jonathan Corbet Date: Wed May 13 14:58:53 2026 -0600 docs: threat-model: don't limit root capabilities to CAP_SYS_ADMIN The threat-model document says that only users with CAP_SYS_ADMIN can carry out a number of admin-level tasks, but there are numerous capabilities that can confer that sort of power. Generalize the text slightly to make it clear that CAP_SYS_ADMIN is not the only all-powerful capability. Acked-by: Willy Tarreau Signed-off-by: Jonathan Corbet commit 561458db0d6b08b4e4956c6e4456d7781b18676f Author: Jonathan Corbet Date: Wed May 13 14:51:29 2026 -0600 docs: security-bugs: add a link to the threat-model documentation Rather than make readers search for this document, just a link to it where it is referenced. (While I was at it, I removed the unused and unneeded _threatmodel label from the top of threat-model.rst). Acked-by: Willy Tarreau Reviewed-by: Greg Kroah-Hartman Signed-off-by: Jonathan Corbet commit ff26a0e8377dec07e4a7230db7675bed1b9a6d03 Author: Jakub Kicinski Date: Mon May 11 10:49:18 2026 -0700 net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 (start != 0) the current code will create a chain link to content type right after the wrap link: This would create a chain where the wrap link points directly to another chain link. The scatterlist API sg_next iterator does not recursively resolve consecutive chain links. meaning this is illegal input to crypto. The wrapping link is unnecessary if end = 0. end is the entry after the last one used so end = 0 means there's nothing pushed after the wrap: end start i v v v [ ]...[ ][ d ][ d ][ d ][ d ][rsv for wrap] Skip the wrapping in this case. TLS 1.3 can use the "wrapping slot" for it's chaining if end = 0. This avoids the chain-after-chain. Move the wrap chaining before marking END and chaining off content type, that feels like more logical ordering to me, but should not matter from functional perspective. Reported-by: Sashiko Fixes: 9aaaa56845a0 ("bpf: Sockmap/tls, skmsg can have wrapped skmsg that needs extra chaining") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260511174920.433155-3-kuba@kernel.org Signed-off-by: Paolo Abeni commit 285943c6e7ca309bbea84b253745154241d9788a Author: Jakub Kicinski Date: Mon May 11 10:49:17 2026 -0700 net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring When an sk_msg scatterlist ring wraps (sg.end < sg.start), tls_push_record() chains the tail portion of the ring to the head using sg_chain(). An extra entry in the sg array is reserved for this: struct sk_msg_sg { [...] /* The extra two elements: * 1) used for chaining the front and sections when the list becomes * partitioned (e.g. end < start). The crypto APIs require the * chaining; * 2) to chain tailer SG entries after the message. */ struct scatterlist data[MAX_MSG_FRAGS + 2]; The current code uses MAX_SKB_FRAGS + 1 as the ring size: sg_chain(&msg_pl->sg.data[msg_pl->sg.start], MAX_SKB_FRAGS - msg_pl->sg.start + 1, msg_pl->sg.data); This places the chain pointer at sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. = &data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 = data[start + (MAX_SKB_FRAGS - start + 1) - 1] = data[MAX_SKB_FRAGS] instead of the true last entry. This is likely due to a "race" of the commit under Fixes landing close to commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down") Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested by Sabrina). Reported-by: 钱一铭 Fixes: 9aaaa56845a0 ("bpf: Sockmap/tls, skmsg can have wrapped skmsg that needs extra chaining") Signed-off-by: Jakub Kicinski Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260511174920.433155-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit 591711b32681a04b57d00c2a404658f8419a081c Author: Thomas Hellström Date: Fri May 8 18:09:20 2026 +0200 drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC dmem_cgroup_try_charge() returns -EAGAIN when the cgroup limit is hit and the charge fails. TTM has no concept of -EAGAIN from resource allocation; -ENOSPC is the canonical error meaning "no space, try eviction". Convert at the source in ttm_resource_alloc() so no caller needs to handle an unexpected error code, and clean up the now-redundant -EAGAIN check in ttm_bo_alloc_resource(). Without this, -EAGAIN escaping ttm_resource_alloc() during an eviction walk causes the walk to terminate early instead of continuing to the next candidate. Cc: Friedrich Vock Cc: Maarten Lankhorst Cc: Tejun Heo Cc: Maxime Ripard Cc: Christian Koenig Cc: dri-devel@lists.freedesktop.org Cc: # v6.14+ Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in TTM") Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström Reviewed-by: Maarten Lankhorst Link: https://patch.msgid.link/20260508160920.230339-1-thomas.hellstrom@linux.intel.com commit 602d60ebae0f10bfbc7ba90eee026fdbd0203df3 Author: Thomas Weißschuh Date: Wed Apr 22 11:42:32 2026 +0200 vdso/gettimeofday: Reload sequence counter after switch to time page in do_aux() After switching to the real data pages, the sequence counter needs to be reloaded from there. The code using vdso_read_begin_timens() assumed this worked by 'continue' jumping to the *beginning* of the do-while retry loop. However the 'continue' jumps to the *end* of said loop, evaluating the exit condition. If the data page has a sequence counter of '1' it will match the one from the time namespace page and prematurely exit the retry loop. This would result in garbage returned to the caller. Reload the sequence counter after switching the pages by using an inner while loop again, which will loop at most once. The loop generates slightly better code than an explicit reload through 'seq = vdso_read_begin()'. Fixes: ed78b7b2c5ae ("vdso/gettimeofday: Add a helper to read the sequence lock of a time namespace aware clock") Reported-by: Ricardo Ribalda Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Ricardo Ribalda Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260422-vdso-aux-timens-loop-v1-1-e2dd8c7164cc@linutronix.de Closes: https://lore.kernel.org/lkml/CANiDSCsOy0P1if-gJZqOM5pTJ0RDcwVfru1B7KFbTOEMqjPKJw@mail.gmail.com/ commit 277740023def559a4a2ddc3e8e784ee37a0f16a9 Author: Xiang Mei Date: Sun May 10 23:21:38 2026 -0700 net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0. smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68: BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64 Require ism_dev[i] to be non-NULL before accepting a CHID match. Fixes: a7c9c5f4af7f ("net/smc: CLC accept / confirm V2") Reported-by: Weiming Shi Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Xiang Mei Link: https://patch.msgid.link/20260511062138.2839584-1-xmei5@asu.edu Signed-off-by: Paolo Abeni commit 6ccbb613b42a1f1ba7bfd547a148f644a902a25c Author: James Morse Date: Fri May 8 17:23:39 2026 +0100 arm_mpam: Check whether the config array is allocated before destroying it __destroy_component_cfg() is called to free the configuration array. It uses the embedded 'garbage' structure, which means the array has to be allocated. If __destroy_component_cfg() is called from mpam_disable() before the configuration was ever allocated, then a NULL pointer is dereferenced. Check for this case and return early if the configuration is not allocated. __destroy_component_cfg() also frees the mbwu_state as this is allocated by __allocate_component_cfg(). As the mbwu_state is allocated after comp->cfg is set, and is also under mpam_list_lock, only the first pointer needs checking. Fixes: 3bd04fe7d807 ("arm_mpam: Extend reset logic to allow devices to be reset any time") Cc: Signed-off-by: James Morse Reviewed-by: Ben Horgan Signed-off-by: Catalin Marinas commit f1caff3335ea6eab88cdc84ec8f2e3c45ca05486 Author: James Morse Date: Fri May 8 17:23:38 2026 +0100 arm_mpam: Fix false positive assert failure during mpam_disable() mpam_assert_partid_sizes_fixed() is used to document that the caller doesn't expect the discovered PARTID size to change while it is walking a list sized by PARTID. Typically the MSC state is not written to until all the MSC have been discovered and this value is set. However, if discovering the MSC fails and schedules mpam_disable(), then the MSC state is written to reset it. In this case the discovered PARTID size may be become smaller - but only PARTID 0 will be used once resctrl_exit() has been called. Skip the WARN_ON_ONCE() if mpam_disable_reason has been set. Fixes: 3bd04fe7d807 ("arm_mpam: Extend reset logic to allow devices to be reset any time") Cc: Signed-off-by: James Morse Reviewed-by: Ben Horgan Signed-off-by: Catalin Marinas commit ccad6001be5c38426ccf45790c411467ad3c03c6 Author: Ben Horgan Date: Thu May 7 16:28:14 2026 +0100 arm_mpam: Improve check for whether or not NRDY is hardware managed mpam_ris_hw_probe_csu_nrdy() sets and clears MSMON_CSU.NRDY and checks whether it's configuration sticks. However, hardware isn't given a chance to disagree. Based on rule LRTGP, in MPAM specification IHI0099 version B.b, the hardware will set NRDY if it needs time to establish a count after a configuration change. Enable the monitor so that NRDY becomes relevant and change the configuration after clearing NRDY to try and coax the hardware into setting it. Fixes: 8c90dc68a5de ("arm_mpam: Probe the hardware features resctrl supports") Cc: Signed-off-by: Ben Horgan Reviewed-by: James Morse Signed-off-by: Catalin Marinas commit 4387970bbd84fd14e0c49c3089c5061ccd86b98a Author: Ben Horgan Date: Thu May 7 16:28:13 2026 +0100 arm_mpam: Pretend that NRDY is always hardware managed Rule ZTXDS of the MPAM specification, IHI009 version B.b, states: "If a monitor does not support automatic updates of NRDY, software can use that bit for any purpose." As software is not reliably informed whether or not the monitor supports automatic updates of NRDY always assume that hardware may manage NRDY but don't rely on it. When NRDY is truly untouched by hardware then, as it is written to 0 on configuration, it will always read 0. At probe it's checked if MSMON_CSU.NRDY and MSMON_MBWU.NRDY are hardware managed but not MSMON_MBWU_L.NDRY. Specialize the checking for hardware managed NRDY to CSU counters as this is the only case where hardware management makes sense. Continue to inform the user if MSMON_CSU.NRDY appears to be hardware managed but the firmware doesn't provide the associated time limit for the automatic clearing of NRDY. Remove the NRDY feature flags as they are now unused. Fixes: 8c90dc68a5de ("arm_mpam: Probe the hardware features resctrl supports") Cc: Signed-off-by: Ben Horgan Reviewed-by: James Morse Signed-off-by: Catalin Marinas commit 1ef2a89584b7b788b2603590d886db076b2f24cc Author: Ben Horgan Date: Thu May 7 16:28:12 2026 +0100 arm_mpam: Fix monitor instance selection when checking for hardware NRDY In _mpam_ris_hw_probe_hw_nrdy() a new register value to select the first monitor and relevant RIS is prepared in mon_sel. However, it is written to the monitor value register, e.g. MSMON_CSU, rather than MSMON_CFG_MON_SEL. As MSMON_CFG_MON_SEL is a 32 bit register update the type of mon_sel to u32. Write mon_sel to the intended register, MSMON_CFG_MON_SEL. Fixes: 8c90dc68a5de ("arm_mpam: Probe the hardware features resctrl supports") Cc: Signed-off-by: Ben Horgan Reviewed-by: James Morse Signed-off-by: Catalin Marinas commit 742b04d0550b0ec89dcbc99537ec88653bd1ad90 Author: David Ahern Date: Wed May 13 10:49:14 2026 -0600 xfrm: Check for underflow in xfrm_state_mtu Leo Lin reported OOB write issue in esp component: xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "header_len + authsize + net_adj" subtracted from a small "mtu" argument. A nobody user can install an IPv4 ESP tunnel SA with a large authentication key (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc), configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a large value. When a single UDP datagram is then sent through the tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and esp_output() consumes it as a signed int via: padto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached)) esp.tfclen = padto - skb->len (assigned to int) esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t when passed to memset() inside esp_output_fill_trailer(), producing a ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as "Write of size 18446744073709551537 at addr ffff888...". Check for underflow and return 1. This causes the sendmsg attempt to fail with ENETUNREACH. Fixes: c5c252389374 ("[XFRM]: Optimize MTU calculation") Reported-by: Leo Lin Assisted-by: Codex:26.506.31004 Signed-off-by: David Ahern Signed-off-by: Steffen Klassert commit 31467b23823ffec1f6fff407f8e3ca9af8b7491a Author: Sayali Patil Date: Wed May 13 13:44:13 2026 +0530 powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() A kernel panic is observed when handling machine check exceptions from real mode. BUG: Unable to handle kernel data access on read at 0xc00000006be21300 Oops: Kernel access of bad area, sig: 11 [#1] MSR: 8000000000001003 CR: 88222248 XER: 00000005 CFAR: c00000000003ffc4 DAR: c00000006be21300 DSISR: 40000000 IRQMASK: 0 NIP [c000000000029e40] arch_irq_work_raise+0x10/0x70 LR [c00000000003ffc8] machine_check_queue_event+0xa8/0x150 Call Trace: [c0000000179d3c70] [c00000000003ff64] machine_check_queue_event+0x44/0x150 [c0000000179d3d30] [c0000000000084e0] machine_check_early_common+0x1f0/0x2c0 The crash occurs because arch_irq_work_raise() calls preempt_disable() from machine check exception (MCE) handlers running in real mode. In this context, accessing the preempt_count can fault, leading to the panic. The preempt_disable()/preempt_enable() pair in arch_irq_work_raise() was originally added by commit 0fe1ac48bef0 ("powerpc/perf_event: Fix oops due to perf_event_do_pending call") to avoid races while raising irq work from exception context. Later, commit 471ba0e686cb ("irq_work: Do not raise an IPI when queueing work on the local CPU") added preemption protection in irq_work_queue() path, while commit 20b876918c06 ("irq_work: Use per cpu atomics instead of regular atomics") added equivalent protection in irq_work_queue_on() before reaching arch_irq_work_raise(): irq_work_queue() / irq_work_queue_on() -> preempt_disable() -> __irq_work_queue_local() -> irq_work_raise() -> arch_irq_work_raise() As a result, callers other than mce_irq_work_raise() already execute with preemption disabled, making the additional preempt_disable()/preempt_enable() pair in arch_irq_work_raise() redundant. The arch_irq_work_raise() function executes in NMI context when called from MCE handler. Hence we will not be preempted or scheduled out since we are in NMI context with MSR[EE]=0. Therefore, it is safe to remove the preempt_disable()/preempt_enable() calls from here. Remove it to avoid accessing preempt_count from real mode context. Fixes: cc15ff327569 ("powerpc/mce: Avoid using irq_work_queue() in realmode") Suggested-by: Mahesh Salgaonkar Acked-by: Shrikanth Hegde Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Sayali Patil [Maddy: Fixed the commit title] Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260513081413.222490-1-sayalip@linux.ibm.com commit 16ca52bc209fa4bf9239cd9e5643e95533476b58 Author: Nicolás Bazaes Date: Wed May 13 21:35:49 2026 -0400 Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 The Lenovo ThinkPad E490 (PNP ID: LEN2058) has a Synaptics TM3471-020 touchpad that supports SMBus/RMI4 mode but is not listed in smbus_pnp_ids[]. Without this entry, RMI4 over SMBus is not enabled by default, and the touchpad falls back to PS/2 mode. Adding LEN2058 to the passlist enables automatic RMI4 detection without requiring the psmouse.synaptics_intertouch parameter, and matches the behavior of similar ThinkPad models already in the list (E480/LEN2054, E580/LEN2055). Tested on ThinkPad E490 with kernel 7.0.5-zen1 and Arch Linux. RMI4 over SMBus is confirmed working without any kernel parameters. Signed-off-by: Nicolás Bazaes Assisted-by: Claude:claude-sonnet-4-6 Link: https://patch.msgid.link/20260514013552.14234-1-contacto@bazaes.cl Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit b69bcb13ed7024a84d6cd8ad330f1e32782fcf28 Author: Vivian Wang Date: Wed Apr 1 09:53:17 2026 +0800 riscv: misaligned: Make enabling delegation depend on NONPORTABLE The unaligned access emulation code in Linux has various deficiencies. For example, it doesn't emulate vector instructions [1] [2], and doesn't emulate KVM guest accesses. Therefore, requesting misaligned exception delegation with SBI FWFT actually regresses vector instructions' and KVM guests' behavior. Until Linux can handle it properly, guard these sbi_fwft_set() calls behind RISCV_SBI_FWFT_DELEGATE_MISALIGNED, which in turn depends on NONPORTABLE. Those who are sure that this wouldn't be a problem can enable this option, perhaps getting better performance. The rest of the existing code proceeds as before, except as if SBI_FWFT_MISALIGNED_EXC_DELEG is not available, to handle any remaining address misaligned exceptions on a best-effort basis. The KVM SBI FWFT implementation is also not touched, but it is disabled if the firmware emulates unaligned accesses. Cc: stable@vger.kernel.org Fixes: cf5a8abc6560 ("riscv: misaligned: request misaligned exception from SBI") Reported-by: Songsong Zhang # KVM Link: https://lore.kernel.org/linux-riscv/38ce44c1-08cf-4e3f-8ade-20da224f529c@iscas.ac.cn/ [1] Link: https://lore.kernel.org/linux-riscv/b3cfcdac-0337-4db0-a611-258f2868855f@iscas.ac.cn/ [2] Signed-off-by: Vivian Wang Acked-by: Conor Dooley Link: https://patch.msgid.link/20260401-riscv-misaligned-dont-delegate-v2-1-5014a288c097@iscas.ac.cn Signed-off-by: Paul Walmsley commit 50da1c9ccb70fc5250c37ac474b54ee072732ea3 Author: Randy Dunlap Date: Mon Apr 6 16:23:04 2026 -0700 riscv: Docs: fix unmatched quote warning 'make htmldocs' complains about ``prctrl` -- so add a second '`' to avoid the warning. Documentation/arch/riscv/zicfilp.rst:79: WARNING: Inline literal start-string without end-string. [docutils] Fixes: 08ee1559052b ("prctl: cfi: change the branch landing pad prctl()s to be more descriptive") Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260406232304.1892528-1-rdunlap@infradead.org Signed-off-by: Paul Walmsley commit f44d38a31f1802b7222adaea9ee69f9d280f698a Author: Zizhi Wo Date: Thu May 14 10:18:47 2026 +0800 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() A fuzzing run reproduced an unkillable io_uring task stuck at ~100% CPU: [root@fedora io_uring_stress]# ps -ef | grep io_uring root 1240 1 99 13:36 ? 00:01:35 [io_uring_stress] The task loops inside io_cqring_wait() and never returns to userspace, and SIGKILL has no effect. This is caused by the CQ ring exposing rings->cq.head to userspace as writable, while the authoritative tail lives in kernel-private ctx->cached_cq_tail. io_cqe_cache_refill() computes free space as an unsigned subtraction: free = ctx->cq_entries - min(tail - head, ctx->cq_entries); If userspace keeps head within [0, tail], the subtraction is well defined and min() just acts as a defensive clamp. But if userspace advances head past tail, (tail - head) wraps to a huge value, free becomes 0, and io_cqe_cache_refill() fails. The CQE is pushed onto the overflow list and IO_CHECK_CQ_OVERFLOW_BIT is set. The wait loop in io_cqring_wait() relies on an invariant: refill() only fails when the CQ is *physically* full, in which case rings->cq.tail has been advanced to iowq->cq_tail and io_should_wake() returns true. The tampered head breaks this: refill() fails while the ring is not full, no OCQE is copied in, rings->cq.tail never catches up, io_should_wake() stays false, and io_cqring_wait_schedule() keeps returning early because IO_CHECK_CQ_OVERFLOW_BIT is still set. The result is a tight retry loop that never returns to userspace. Introduce io_cqring_queued() as the single point that converts the (tail, head) pair into a trustworthy queued count. Since the real head/tail distance is bounded by cq_entries (far below 2^31), a signed comparison reliably detects userspace moving head past tail; in that case treat the queue as empty so callers see the full cache as free and forward progress is preserved. Suggested-by: Jens Axboe Signed-off-by: Zizhi Wo Link: https://patch.msgid.link/20260514021847.4062782-1-wozizhi@huaweicloud.com [axboe: fixup commit message, kill 'queued' var, and keep it all in io_uring.c] Signed-off-by: Jens Axboe commit 68055b285428a09f098861a702024e9d8f1370c8 Merge: 9e20b4b8ff099e 5d08559c910cc3 Author: Dave Airlie Date: Thu May 14 12:04:08 2026 +1000 Merge tag 'amd-drm-fixes-7.1-2026-05-13' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.1-2026-05-13: amdgpu: - Userq fixes - DCN 3.2 fix - RAS fix - GC 12 fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260513224053.40670-1-alexander.deucher@amd.com commit cc21150cdea8813fc9677ff61a3cbe9995801aa0 Merge: b84c5632c7b31f 552cc2306c3d87 Author: Jakub Kicinski Date: Wed May 13 19:03:07 2026 -0700 Merge branch 'macsec-use-rcu_work-to-fix-crypto-cleanup-in-softirq-context' Jinliang Zheng says: ==================== macsec: use rcu_work to fix crypto cleanup in softirq context From: Jinliang Zheng crypto_free_aead() can internally call vunmap() (e.g. via dma_free_attrs() in hardware crypto drivers like hisi_sec2), which must not be invoked from softirq context. Both free_rxsa() and free_txsa() are RCU callbacks that run in softirq, causing a kernel crash on affected hardware. This series fixes the issue by deferring the actual cleanup to a workqueue using rcu_work, which combines the RCU grace period and workqueue dispatch into a single primitive. Two design decisions worth noting: 1. rcu_work instead of schedule_work() + synchronize_rcu() An alternative would be to call schedule_work() directly from macsec_rxsa_put()/macsec_txsa_put(), then call synchronize_rcu() at the start of the work handler to replace the grace period previously provided by call_rcu(). However, synchronize_rcu() blocks the worker thread for the duration of a full RCU grace period. Under high SA churn (e.g. tearing down an interface with many SAs), each SA would occupy a worker thread while waiting, and multiple concurrent calls cannot share the same grace period — leading to unnecessary latency and resource waste. rcu_work uses call_rcu_hurry() internally, which is fully asynchronous: the worker thread is only dispatched after the grace period has elapsed, and multiple concurrent queue_rcu_work() calls naturally batch under the same grace period via the RCU subsystem's existing coalescing mechanism. 2. Dedicated workqueue instead of system_wq Using a dedicated workqueue (macsec_wq) allows macsec_exit() to drain exactly the work items belonging to this module — by calling destroy_workqueue() after rcu_barrier(). If system_wq were used, flush_scheduled_work() would drain all pending work items across the entire system, creating unnecessary coupling with unrelated subsystems and potentially causing unexpected delays. The dedicated workqueue provides a clean, contained teardown path. ==================== Link: https://patch.msgid.link/20260511153102.2640368-1-alexjlzheng@tencent.com Signed-off-by: Jakub Kicinski commit 552cc2306c3d87632f44a655737d1d367c2a3295 Author: Jinliang Zheng Date: Mon May 11 23:31:00 2026 +0800 macsec: use rcu_work to defer TX SA crypto cleanup out of softirq free_txsa() is an RCU callback running in softirq context, but calls crypto_free_aead() which can invoke vunmap() internally on hardware crypto drivers (e.g. hisi_sec2), triggering a kernel crash. Use rcu_work to defer the cleanup to a workqueue, for the same reasons as the analogous fix to free_rxsa() in the previous patch. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Jinliang Zheng Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260511153102.2640368-4-alexjlzheng@tencent.com Signed-off-by: Jakub Kicinski commit 6624bba469a325ecd699feae400b77cd11c76b98 Author: Jinliang Zheng Date: Mon May 11 23:30:59 2026 +0800 macsec: use rcu_work to defer RX SA crypto cleanup out of softirq crypto_free_aead() can internally invoke vunmap() (e.g. via dma_free_attrs() in hardware crypto drivers such as hisi_sec2). vunmap() must not be called from softirq context, but free_rxsa() is an RCU callback that runs in softirq, leading to a kernel crash: vunmap+0x4c/0x70 __iommu_dma_free+0xd0/0x138 dma_free_attrs+0xf4/0x100 sec_aead_exit+0x64/0xb8 [hisi_sec2] crypto_destroy_tfm+0x98/0x110 free_rxsa+0x28/0x50 [macsec] rcu_do_batch+0x184/0x460 rcu_core+0xf4/0x1f8 handle_softirqs+0x118/0x330 Use rcu_work to defer the cleanup to a workqueue. rcu_work dispatches the worker asynchronously after the RCU grace period, so no thread blocks waiting, and concurrent releases of multiple SAs naturally share the same grace period. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Jinliang Zheng Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260511153102.2640368-3-alexjlzheng@tencent.com Signed-off-by: Jakub Kicinski commit c6690a9030d784d3f099850800b6d5323771ca37 Author: Jinliang Zheng Date: Mon May 11 23:30:58 2026 +0800 macsec: introduce dedicated workqueue for SA crypto cleanup Introduce a dedicated ordered workqueue, macsec_wq, which will be used by subsequent patches to defer SA crypto cleanup (crypto_free_aead and related teardown) out of softirq context. Using a dedicated workqueue instead of system_wq allows macsec_exit() to drain exactly the work items belonging to this module via destroy_workqueue(), without interfering with unrelated work items on system_wq or causing unexpected delays elsewhere. rcu_barrier() in macsec_exit() ensures all in-flight rcu_work callbacks have enqueued their work items before destroy_workqueue() drains and destroys the queue, making the two-step teardown correct and complete. The same sequence is kept in the error path of macsec_init() as a precaution, to mirror macsec_exit() and stay safe if work ever becomes queueable before this point in the future. While at it, rename the error labels in macsec_init() from the resource-named style (rtnl:, notifier:, wq:) to the err_xxx: style (err_rtnl:, err_notifier:, err_destroy_wq:) to align with the broader kernel convention. Signed-off-by: Jinliang Zheng Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260511153102.2640368-2-alexjlzheng@tencent.com Signed-off-by: Jakub Kicinski commit b84c5632c7b31f8910167075a8128cfb9e50fcfe Author: Faicker Mo Date: Mon May 11 22:05:51 2026 +0800 net: net_failover: Fix the deadlock in slave register There is netdev_lock_ops() before the NETDEV_REGISTER notifier in register_netdevice(), so use the non-locking functions in net_failover_slave_register(). failover_slave_register() in failover_existing_slave_register() adds lock and unlock ops too. Call Trace: __schedule+0x30d/0x7a0 schedule+0x27/0x90 schedule_preempt_disabled+0x15/0x30 __mutex_lock.constprop.0+0x538/0x9e0 __mutex_lock_slowpath+0x13/0x20 mutex_lock+0x3b/0x50 dev_set_mtu+0x40/0xe0 net_failover_slave_register+0x24/0x280 failover_slave_register+0x103/0x1b0 failover_event+0x15e/0x210 ? dropmon_net_event+0xac/0xe0 notifier_call_chain+0x5e/0xe0 raw_notifier_call_chain+0x16/0x30 call_netdevice_notifiers_info+0x52/0xa0 register_netdevice+0x5f4/0x7c0 register_netdev+0x1e/0x40 _mlx5e_probe+0xe2/0x370 [mlx5_core] mlx5e_probe+0x59/0x70 [mlx5_core] ? __pfx_mlx5e_probe+0x10/0x10 [mlx5_core] Fixes: 4c975fd70002 ("net: hold instance lock during NETDEV_REGISTER/UP") Signed-off-by: Faicker Mo Signed-off-by: Jakub Kicinski commit 9e20b4b8ff099e63a8e8d83de62d6e40a7b84be5 Merge: 5d6919055dec13 1ae15b6c7965d1 Author: Dave Airlie Date: Thu May 14 11:53:09 2026 +1000 Merge tag 'drm-intel-fixes-2026-05-13' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Skip __i915_request_skip() for already signaled requests (Sebastian Brzezinka) - Fix VSC dynamic range signaling for RGB formats [dp] (Chaitanya Kumar Borah) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patch.msgid.link/agSVZmNC_qV4G6jQ@linux commit 9a390d34d55cb4ecbca4981c660dd95440827c70 Author: Sukhdeep Singh Date: Tue May 12 18:27:11 2026 +0530 MAINTAINERS: update atlantic driver maintainer Igor Russkikh and Egor Pomozov have left Marvell. Take over maintenance of the atlantic driver and its PTP subsystem. Signed-off-by: Sukhdeep Singh Signed-off-by: Jakub Kicinski commit 6c7674b5b7ae513cecae22aa9dcdcf533862cf5c Author: Zong Li Date: Mon Apr 27 19:41:05 2026 -0700 riscv: cfi: reduce shadow stack size limit from 4GB to 2GB Follow the ARM64 GCS (Guarded Control Stack) implementation approach by reducing the shadow stack size allocation from min(RLIMIT_STACK, 4GB) to min(RLIMIT_STACK/2, 2GB). See commit 506496bcbb42 ("arm64/gcs: Ensure that new threads have a GCS") Rationale: 1. Shadow stacks only store return addresses (8 bytes per entry), not local variables, function parameters, or saved registers. A 2GB shadow stack is far more than sufficient for any practical application, even with extremely deep recursion. Using half the size maintains adequate margin while being more resource-efficient. 2. On memory-constrained systems (e.g., platforms with only 4GB of physical memory, which is a common configuration), allocating 4GB of virtual address space for shadow stack per process/thread can lead to virtual memory allocation failures when the overcommit mode is set to OVERCOMMIT_GUESS or OVERCOMMIT_NEVER: Error: "__vm_enough_memory: not enough memory for the allocation" This reduces virtual address space consumption by 50% while maintaining more than adequate space for return address storage. Signed-off-by: Zong Li Link: https://patch.msgid.link/20260428024105.645162-1-zong.li@sifive.com [pjw@kernel.org: clean up patch description] Signed-off-by: Paul Walmsley commit 59afae20080a9681014bdc87897cbfd30bedd261 Author: Victor Nogueira Date: Mon May 11 14:30:58 2026 -0400 selftests/tc-testing: Add QFQ/CBS qlen underflow test Since CBS was not calling reset for its child qdisc, there are scenarios where it could cause an underflow on its parent's qlen/backlog. When the parent is QFQ, a null-ptr deref could occur. Add a test case that reproduces the underflow followed by a null-ptr deref scenario. Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira Signed-off-by: Jakub Kicinski commit 320fb29ea23cfa1aeef32563da8748247db896ea Author: Jamal Hadi Salim Date: Mon May 11 14:30:57 2026 -0400 net/sched: sch_cbs: Call qdisc_reset for child qdisc During a reset, CBS is not calling reset on its child qdisc, which might cause qlen/backlog accounting issues. For example, if we have CBS with a QFQ parent and a netem child with delay, we can create a scenario where the parent's qlen underflows. QFQ, specifically, uses qlen to check whether it should deference a pointer, so this scenario may cause a null-ptr deref in QFQ: [ 43.875639][ T319] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI [ 43.876124][ T319] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f] [ 43.876417][ T319] CPU: 10 UID: 0 PID: 319 Comm: ping Not tainted 7.0.0-13039-ge728258debd5 #773 PREEMPT(full) [ 43.876751][ T319] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 43.876949][ T319] RIP: 0010:qfq_dequeue+0x35c/0x1650 [ 43.877123][ T319] Code: 00 fc ff df 80 3c 02 00 0f 85 17 0e 00 00 4c 8d 73 48 48 89 9d b8 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 76 0c 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b [ 43.877648][ T319] RSP: 0018:ffff8881017ef4f0 EFLAGS: 00010216 [ 43.877845][ T319] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000 [ 43.878073][ T319] RDX: 0000000000000009 RSI: 0000000c40000000 RDI: ffff88810eef02b0 [ 43.878306][ T319] RBP: ffff88810eef0000 R08: ffff88810eef0280 R09: 1ffff1102120fd63 [ 43.878523][ T319] R10: 1ffff1102120fd66 R11: 1ffff1102120fd67 R12: 0000000c40000000 [ 43.878742][ T319] R13: ffff88810eef02b8 R14: 0000000000000048 R15: 0000000020000000 [ 43.878959][ T319] FS: 00007f9c51c47c40(0000) GS:ffff88817a0be000(0000) knlGS:0000000000000000 [ 43.879214][ T319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.879403][ T319] CR2: 000055e69a2230a8 CR3: 000000010c07a000 CR4: 0000000000750ef0 [ 43.879621][ T319] PKRU: 55555554 [ 43.879735][ T319] Call Trace: [ 43.879844][ T319] [ 43.879924][ T319] __qdisc_run+0x169/0x1900 [ 43.880075][ T319] ? dev_qdisc_enqueue+0x8b/0x210 [ 43.880222][ T319] __dev_queue_xmit+0x2346/0x37a0 [ 43.880376][ T319] ? register_lock_class+0x3f/0x800 [ 43.880531][ T319] ? srso_alias_return_thunk+0x5/0xfbef5 [ 43.880684][ T319] ? __pfx___dev_queue_xmit+0x10/0x10 [ 43.880834][ T319] ? srso_alias_return_thunk+0x5/0xfbef5 [ 43.880977][ T319] ? __lock_acquire+0x819/0x1df0 [ 43.881124][ T319] ? srso_alias_return_thunk+0x5/0xfbef5 [ 43.881275][ T319] ? srso_alias_return_thunk+0x5/0xfbef5 [ 43.881418][ T319] ? __asan_memcpy+0x3c/0x60 [ 43.881563][ T319] ? srso_alias_return_thunk+0x5/0xfbef5 [ 43.881708][ T319] ? eth_header+0x165/0x1a0 [ 43.881853][ T319] ? lockdep_hardirqs_on_prepare+0xdb/0x1a0 [ 43.882031][ T319] ? srso_alias_return_thunk+0x5/0xfbef5 [ 43.882174][ T319] ? neigh_resolve_output+0x3cc/0x7e0 [ 43.882325][ T319] ? srso_alias_return_thunk+0x5/0xfbef5 [ 43.882471][ T319] ip_finish_output2+0x6b6/0x1e10 Fix this by calling qdisc_reset for CBS' child qdisc. Sashiko caught an issue which could result in a null ptr deref if qdisc_create_dflt() is invoked on an unitialised cbs qdisc which is exposed by this patch. We add an early return if the qdisc is null to address this. This is a similar approach used by two other fixes[1][2]. The proper fix for this specific issue elucidated by sashiko is to remove the call to qdisc_reset when qdisc_create_dflt fails. Since the dflt qdisc isn't attached anywhere yet at that point, calling the reset callback doesn't make much sense (and as stated has been a source of two other bugs). We plan on submitting this fix in a later patch. [1] https://lore.kernel.org/netdev/20221018063201.306474-2-shaozhengchao@huawei.com/ [2] https://lore.kernel.org/netdev/20221018063201.306474-4-shaozhengchao@huawei.com/ Fixes: 585d763af09c ("net/sched: Introduce Credit Based Shaper (CBS) qdisc") Reported-by: Junyoung Jang Tested-by: Junyoung Jang Tested-by: Victor Nogueira Acked-by: Vinicius Costa Gomes Signed-off-by: Jamal Hadi Salim Signed-off-by: Jakub Kicinski commit 5a30862dec5a70da0a9d259de3f87a7542cc95b2 Author: Cássio Gabriel Date: Tue May 12 11:03:53 2026 -0300 ASoC: sdw_utils: Check speaker component string allocation devm_kasprintf() can fail while building the temporary speaker component string. If that happens, spk_components is set to NULL, but the current code can still pass it to strlen() on a later loop iteration or after the loop when appending the speaker component list to card->components. Use NULL to represent the initial "no speaker components" state, and return -ENOMEM immediately if building spk_components fails. Fixes: 0f60ecffbfe3 ("ASoC: sdw_utils: generate combined spk components string") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260512-asoc-sdw-utils-spk-components-alloc-v1-1-c9bbd6d2e123@gmail.com Signed-off-by: Mark Brown commit be3f38d05cc5a7c3f13e51994c5dd043ab604d28 Author: Alistair Popple Date: Fri May 1 16:51:16 2026 +1000 mm/memory: fix spurious warning when unmapping device-private/exclusive pages Device private and exclusive entries are only supported for anonymous folios. This condition is tested in __migrate_device_pages() and make_device_exclusive() using folio_test_anon(). However the unmap path tests this assumption using vma_is_anonymous(). This is wrong because whilst anonymous VMAs can only contain folios where folio_test_anon() is true the opposite relation does not hold. A folio for which folio_test_anon() is true does not imply vma_is_anonymous() is true. Such a condition can occur if for example a folio is part of a private filebacked mapping. In this case vma_is_anonymous() is false as the mapping is filebacked, but folio_test_anon() may be true, thus permitting devices to migrate the folio to device private memory. This can lead to the following spurious warnings during process teardown: [ 772.737706] ------------[ cut here ]------------ [ 772.739201] WARNING: mm/memory.c:1754 at unmap_page_range.cold+0x26/0x18a, CPU#17: hmm-tests/2041 [ 772.742050] Modules linked in: test_hmm nvidia_uvm(O) nvidia(O) [ 772.743959] CPU: 17 UID: 0 PID: 2041 Comm: hmm-tests Tainted: G W O 7.0.0+ #387 PREEMPT(full) [ 772.747104] Tainted: [W]=WARN, [O]=OOT_MODULE [ 772.748509] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 772.752117] RIP: 0010:unmap_page_range.cold+0x26/0x18a [ 772.753780] Code: 7e fe ff ff 48 89 4c 24 78 4c 89 44 24 38 e8 f2 ff b1 00 48 8b 4c 24 78 4c 8b 44 24 38 48 8b 44 24 18 48 83 78 48 00 74 04 90 <0f> 0b 90 48 89 ca b8 ff ff 37 00 48 c1 ea 03 48 c1 e0 2a 80 3c 02 [ 772.759602] RSP: 0018:ffff888112607550 EFLAGS: 00010286 [ 772.761310] RAX: ffff88811bbf4dc0 RBX: dffffc0000000000 RCX: ffffea03e9bfffd8 [ 772.763583] RDX: 1ffff1102377e9c1 RSI: 0000000000000008 RDI: ffff88811bbf4e08 [ 772.765914] RBP: 0000000000000006 R08: ffff8881059f7448 R09: ffffed10224c0e68 [ 772.768184] R10: ffff888112607347 R11: 0000000000000001 R12: 0000000000000001 [ 772.770461] R13: ffffea03e9bfffc0 R14: ffff888112607908 R15: ffffea03e9bfffc0 [ 772.772782] FS: 00007f327caa2780(0000) GS:ffff888427b7d000(0000) knlGS:0000000000000000 [ 772.775328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 772.777187] CR2: 00007f327ca89000 CR3: 00000001994d5000 CR4: 00000000000006f0 [ 772.779135] Call Trace: [ 772.779792] [ 772.780317] ? dmirror_interval_invalidate+0x1a3/0x290 [test_hmm] [ 772.781873] ? vm_normal_page_pud+0x2b0/0x2b0 [ 772.782992] ? __rwlock_init+0x150/0x150 [ 772.784006] ? lock_release+0x216/0x2b0 [ 772.785008] ? __mmu_notifier_invalidate_range_start+0x505/0x6e0 [ 772.786522] ? lock_release+0x216/0x2b0 [ 772.787498] ? unmap_single_vma+0xb6/0x210 [ 772.788573] unmap_vmas+0x27d/0x520 [ 772.789506] ? unmap_single_vma+0x210/0x210 [ 772.790607] ? mas_update_gap.part.0+0x620/0x620 [ 772.791834] unmap_region+0x19e/0x350 [ 772.792769] ? remove_vma+0x130/0x130 [ 772.793684] ? mas_alloc_nodes+0x1f2/0x300 [ 772.794730] vms_complete_munmap_vmas+0x8c1/0xe20 [ 772.795926] ? unmap_region+0x350/0x350 [ 772.796917] do_vmi_align_munmap+0x36a/0x4e0 [ 772.798018] ? lock_release+0x216/0x2b0 [ 772.799024] ? vma_shrink+0x620/0x620 [ 772.799983] do_vmi_munmap+0x150/0x2c0 [ 772.800939] __vm_munmap+0x161/0x2c0 [ 772.801872] ? expand_downwards+0xd60/0xd60 [ 772.802948] ? clockevents_program_event+0x1ef/0x540 [ 772.804217] ? lock_release+0x216/0x2b0 [ 772.805158] __x64_sys_munmap+0x59/0x80 [ 772.805776] do_syscall_64+0xfc/0x670 [ 772.806336] ? irqentry_exit+0xda/0x580 [ 772.806976] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 772.807772] RIP: 0033:0x7f327cbb2717 [ 772.808323] Code: 73 01 c3 48 8b 0d f9 76 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c9 76 0d 00 f7 d8 64 89 01 48 [ 772.811337] RSP: 002b:00007ffde7f57d38 EFLAGS: 00000202 ORIG_RAX: 000000000000000b [ 772.812564] RAX: ffffffffffffffda RBX: 00007f327cc9c000 RCX: 00007f327cbb2717 [ 772.813733] RDX: 0000000000000000 RSI: 0000000000400000 RDI: 00007f327c289000 [ 772.814867] RBP: 0000000000421360 R08: 000000000000001a R09: 0000000000000000 [ 772.815991] R10: 0000000000000003 R11: 0000000000000202 R12: 00007ffde7f57d74 [ 772.817121] R13: 00007f327c689010 R14: 0000000000100000 R15: 00007f327c289000 [ 772.818272] [ 772.818614] irq event stamp: 0 [ 772.819159] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 772.820174] hardirqs last disabled at (0): [] copy_process+0x19f3/0x6440 [ 772.821511] softirqs last enabled at (0): [] copy_process+0x1a40/0x6440 [ 772.822869] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 772.823871] ---[ end trace 0000000000000000 ]--- Fix this by using the same check for folio_test_anon() in zap_nonpresent_ptes(). Also add a hmm-test case for this. Link: https://lore.kernel.org/20260501065116.2057242-1-apopple@nvidia.com Fixes: 999dad824c39 ("mm/shmem: persist uffd-wp bit across zapping for file-backed") Signed-off-by: Alistair Popple Reported-by: Arsen Arsenović Reviewed-by: Balbir Singh Cc: David Hildenbrand Cc: Jason Gunthorpe Cc: John Hubbard Cc: Leon Romanovsky Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Peter Xu Cc: Matthew Brost Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Thomas Hellström Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit c0c6ccd9828c3a1950623b546fa57292a77b5c73 Author: David Hildenbrand (Arm) Date: Thu Apr 30 13:31:22 2026 +0200 mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special() On x86 32-bit with THP enabled, zap_huge_pmd() is seen to generate a "WARNING: mm/memory.c:735 at __vm_normal_page+0x6a/0x7d", from the VM_WARN_ON_ONCE(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)); followed by "BUG: Bad rss-counter state"s, then later "BUG: Bad page state"s when reclaim gets to call shrink_huge_zero_folio_scan(). It's as if the _PAGE_SPECIAL bit never got set in the huge_zero pmd: and indeed, whereas pte_special() and pte_mkspecial() are subject to a dedicated CONFIG_ARCH_HAS_PTE_SPECIAL, pmd_special() and pmd_mkspecial() are subject to CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never enabled on any 32-bit architecture. While the problem was exposed through commit d80a9cb1a64a ("mm/huge_memory: add and use normal_or_softleaf_folio_pmd()"), it was an oversight in commit af38538801c6 ("mm/memory: factor out common code from vm_normal_page_*()") and would result in other problems: * huge zero folio accounted in smaps, pagemap (PAGE_IS_FILE) and numamaps as file-backed THP * folio_walk_start() returning the folio even without FW_ZEROPAGE set. Callers seem to tolerate that, though. ... and triggering the VM_WARN_ON_ONE(), although never reported so far. To fix it, teach vm_normal_page_pmd()/vm_normal_page_pud() to consider whether pmd_special/pud_special is actually implemented. Link: https://lore.kernel.org/20260430-pmd_special-v1-1-dbcbcfd72c20@kernel.org Fixes: af38538801c6 ("mm/memory: factor out common code from vm_normal_page_*()") Signed-off-by: David Hildenbrand (Arm) Reported-by: Hugh Dickins Closes: https://lore.kernel.org/r/74a75b59-2e13-3985-ee99-d5521f39df2a@google.com Reported-by: Bibo Mao Closes: https://lore.kernel.org/r/20260430041121.2839350-1-maobibo@loongson.cn Debugged-by: Hugh Dickins Reviewed-by: Lance Yang Tested-by: Bibo Mao Reviewed-by: Baolin Wang Reviewed-by: Oscar Salvador Reviewed-by: Lorenzo Stoakes Cc: Liam R. Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 03a2cc1756a0570f887d624cd6c535ea0cbd4951 Author: Muchun Song Date: Tue Apr 28 16:52:18 2026 +0800 drivers/base/memory: fix memory block reference leak in poison accounting memblk_nr_poison_inc() and memblk_nr_poison_sub() look up a memory block via find_memory_block_by_id(), which acquires a reference to the memory block device. Both helpers use the returned memory block without dropping that reference, leaking the device reference on each successful lookup. Drop the reference after updating nr_hwpoison. Link: https://lore.kernel.org/20260428085219.1316047-3-songmuchun@bytedance.com Fixes: 5033091de814 ("mm/hwpoison: introduce per-memory_block hwpoison counter") Signed-off-by: Muchun Song Reviewed-by: Miaohe Lin Acked-by: Oscar Salvador Acked-by: David Hildenbrand (Arm) Cc: Danilo Krummrich Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Naoya Horiguchi Cc: "Rafael J. Wysocki" Cc: Vishal Verma Cc: Signed-off-by: Andrew Morton commit 93866f55f7e292fe3d47d36c9efe5ee10213a06b Author: Muchun Song Date: Tue Apr 28 16:52:17 2026 +0800 mm/memory_hotplug: fix memory block reference leak on remove Patch series "mm: Fix memory block leaks and locking", v2. This series fixes two memory block device reference leaks and one locking issue around the per-memory_block hwpoison counter. This patch (of 2): remove_memory_blocks_and_altmaps() looks up each memory block with find_memory_block(), which acquires a reference to the memory block device. That reference is never dropped on this path, resulting in a leaked device reference when removing memory blocks and their altmaps. Drop the reference after retrieving mem->altmap and clearing mem->altmap, before removing the memory block device. Link: https://lore.kernel.org/20260428085219.1316047-1-songmuchun@bytedance.com Link: https://lore.kernel.org/20260428085219.1316047-2-songmuchun@bytedance.com Fixes: 6b8f0798b85a ("mm/memory_hotplug: split memmap_on_memory requests across memblocks") Signed-off-by: Muchun Song Acked-by: Oscar Salvador Acked-by: David Hildenbrand (Arm) Cc: Danilo Krummrich Cc: Greg Kroah-Hartman Cc: "Huang, Ying" Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: "Rafael J. Wysocki" Cc: Vishal Verma Cc: Signed-off-by: Andrew Morton commit efdadbc180e53fe257a6e85f6bc706cb58088653 Author: Christian A. Ehrhardt Date: Tue Apr 21 09:07:07 2026 +0200 lib: kunit_iov_iter: fix test fail on powerpc Increase buffer size to accommodate machines with 64K PAGE_SIZE. Link: https://lore.kernel.org/20260421070707.992873-1-lk@c--e.de Fixes: 0913b7554726 ("lib: kunit_iov_iter: add tests for extract_iter_to_sg") Signed-off-by: Christian A. Ehrhardt Reported-by: David Gow Closes: https://lore.kernel.org/34a81ec2-af84-465d-9b5e-7bb5bf01680f@davidgow.net Tested-by: David Gow Tested-by: Josh Law Reviewed-by: Josh Law Signed-off-by: Andrew Morton commit 6a288a4ddb4a994490505ab5f41c445f8e6b6467 Author: David Hildenbrand (Arm) Date: Tue Apr 21 17:39:07 2026 +0200 mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free __GFP_ZEROTAGS semantics are currently a bit weird, but effectively this flag is only ever set alongside __GFP_ZERO and __GFP_SKIP_KASAN. If we run with init_on_free, we will zero out pages during __free_pages_prepare(), to skip zeroing on the allocation path. However, when allocating with __GFP_ZEROTAG set, post_alloc_hook() will consequently not only skip clearing page content, but also skip clearing tag memory. Not clearing tags through __GFP_ZEROTAGS is irrelevant for most pages that will get mapped to user space through set_pte_at() later: set_pte_at() and friends will detect that the tags have not been initialized yet (PG_mte_tagged not set), and initialize them. However, for the huge zero folio, which will be mapped through a PMD marked as special, this initialization will not be performed, ending up exposing whatever tags were still set for the pages. The docs (Documentation/arch/arm64/memory-tagging-extension.rst) state that allocation tags are set to 0 when a page is first mapped to user space. That no longer holds with the huge zero folio when init_on_free is enabled. Fix it by decoupling __GFP_ZEROTAGS from __GFP_ZERO, passing to tag_clear_highpages() whether we want to also clear page content. Invert the meaning of the tag_clear_highpages() return value to have clearer semantics. Reproduced with the huge zero folio by modifying the check_buffer_fill arm64/mte selftest to use a 2 MiB area, after making sure that pages have a non-0 tag set when freeing (note that, during boot, we will not actually initialize tags, but only set KASAN_TAG_KERNEL in the page flags). $ ./check_buffer_fill 1..20 ... not ok 17 Check initial tags with private mapping, sync error mode and mmap memory not ok 18 Check initial tags with private mapping, sync error mode and mmap/mprotect memory ... This code needs more cleanups; we'll tackle that next, like decoupling __GFP_ZEROTAGS from __GFP_SKIP_KASAN. [akpm@linux-foundation.org: s/__GPF_ZERO/__GFP_ZERO/, per David] Link: https://lore.kernel.org/20260421-zerotags-v2-1-05cb1035482e@kernel.org Fixes: adfb6609c680 ("mm/huge_memory: initialise the tags of the huge zero folio") Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Catalin Marinas Tested-by: Lance Yang Cc: Brendan Jackman Cc: Dev Jain Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Mark Brown Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Will Deacon Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit ec9f2ee9a4046b2d5e5a6b6fa6a2ed1542250e73 Author: Mike Rapoport (Microsoft) Date: Tue Apr 28 15:48:33 2026 +0300 MAINTAINERS: add kexec@ list to LIVE UPDATE ENTRY Link: https://lore.kernel.org/20260428124833.1903302-3-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Pasha Tatashin Acked-by: Baoquan He Cc: Dave Young Cc: Eric W. Biederman Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit 77dcdff56d0b52947f110e9e43a1fc846ee8d94a Author: Mike Rapoport (Microsoft) Date: Tue Apr 28 15:48:32 2026 +0300 MAINTAINERS: add tree for KDUMP and KEXEC Patch series "MAINTAINERS: update KEXEC, KDUMP and LIVE UPDATE". KHO and LiveUpdate team is going to pick kdump and kexec patches to their tree at https://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux.git Update MAINTAINERS to reflect this change and add kexec@ list to LIVE UPDATE entry. This patch (of 2): KHO and LiveUpdate team is going to pick kdump and kexec patches to their tree at https://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux.git Update MAINTAINERS to reflect it. Link: https://lore.kernel.org/20260428124833.1903302-1-rppt@kernel.org Link: https://lore.kernel.org/20260428124833.1903302-2-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Pasha Tatashin Acked-by: Baoquan He Acked-by: Pratyush Yadav Cc: Mike Rapoport Cc: Dave Young Cc: Eric W. Biederman Signed-off-by: Andrew Morton commit 3432cbb291aabf85f8af4b9d1ec37179168ff999 Author: Luiz Capitulino Date: Mon Apr 27 12:03:51 2026 -0400 selftests/mm: run_vmtests.sh: fix destructive tests invocation Destructive tests should be invoked with -d command-line option, but this won't work today since 'd' is missing in getopts command-line. This commit fixes it. Link: https://lore.kernel.org/214fd9e4-5398-4c26-859e-c982c2e277c3@redhat.com Fixes: f16ff3b692ad ("selftests/mm: run_vmtests.sh: add missing tests") Signed-off-by: Luiz Capitulino Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 228e25e33325865ebe589da5366449a8ecf7d0da Author: Illia Ostapyshyn Date: Mon Apr 27 16:24:48 2026 +0200 scripts/gdb: slab: update field names of struct kmem_cache The commit 5ba6bc27b1f9 ("slab: decouple pointer to barn from kmem_cache_node") reorganized the struct kmem_cache to factor out the per-node fields to the new struct kmem_cache_per_node_ptrs. This causes the gdb scripts for lx-slabinfo and lx-slabtrace fail as they still reference the old structure. Adjust the gdb scripts to match the current state of struct kmem_cache. Link: https://lore.kernel.org/20260427142448.666117-3-illia@yshyn.com Fixes: 5ba6bc27b1f9 ("slab: decouple pointer to barn from kmem_cache_node") Signed-off-by: Illia Ostapyshyn Acked-by: Harry Yoo (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Florian Fainelli Cc: Hao Li Cc: Jan Kiszka Cc: Kieran Bingham Cc: Seongjun Hong Signed-off-by: Andrew Morton commit c416aee7e7d04fec2d2d30786b3c8393108b85d2 Author: Illia Ostapyshyn Date: Mon Apr 27 16:24:47 2026 +0200 scripts/gdb: mm: cast untyped symbols in x86_page_ops The symbols phys_base, _text, and _end, used in x86_page_ops are either defined in assembly or implicitly by the linker. Thus, they lack type information and cause a conversion error after gdb.parse_and_eval. Explicitly cast these expressions to unsigned long. Link: https://lore.kernel.org/20260427142448.666117-2-illia@yshyn.com Fixes: 55f8b4518d14 ("scripts/gdb: implement x86_page_ops in mm.py") Signed-off-by: Illia Ostapyshyn Cc: Florian Fainelli Cc: Jan Kiszka Cc: Kieran Bingham Cc: Vlastimil Babka Cc: Hao Li Cc: Harry Yoo Cc: Seongjun Hong Cc: Signed-off-by: Andrew Morton commit 620072fd783290ad92c2d445a47b0a61b161f352 Author: SeongJae Park Date: Sun Apr 26 12:31:17 2026 -0700 mm/damon: fix damos_stat tracepoint format for sz_applied The print format is wrongly marking sz_applied as sz_tried. Fix it. Link: https://lore.kernel.org/20260426193119.88095-1-sj@kernel.org Fixes: 804c26b961da ("mm/damon/core: add trace point for damos stat per apply interval") Signed-off-by: SeongJae Park Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: # 7.0.x Signed-off-by: Andrew Morton commit d4e7b5c4cc353f154d5ab8bb2e1ce7714d77a6e9 Author: SeongJae Park Date: Sun Apr 26 10:36:12 2026 -0700 mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() damon_sysfs_memcg_path_to_id() breaks mem_cgroup_iter() loop without calling mem_cgroup_iter_break(). This leaks the cgroup reference. Fix the issue by calling mem_cgroup_iter_break() before the break. The issue was discovered [1] by Sashiko. Link: https://lore.kernel.org/20260426173625.86521-1-sj@kernel.org Link: https://lore.kernel.org/20260423004148.74722-1-sj@kernel.org [1] Fixes: 29cbb9a13f05 ("mm/damon/sysfs-schemes: implement scheme filters") Signed-off-by: SeongJae Park Cc: # 6.3.x Signed-off-by: Andrew Morton commit 63451de16e0a08be40f9ab5e7c5c8f5c79676fb1 Author: Sunny Patel Date: Sat Apr 25 19:05:27 2026 +0530 mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page When check_stable_address_space() fails after the PMD spinlock has been acquired via pmd_lock(), the code jumps directly to the abort label, bypassing the spin_unlock() call in unlock_abort. This causes the PMD spinlock to be permanently held, leading to a deadlock. Change the goto target from abort to unlock_abort to ensure the spinlock is always released on this error path. Link: https://lore.kernel.org/20260425133537.17463-1-nueralspacetech@gmail.com Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages") Signed-off-by: Sunny Patel Reviewed-by: Andrew Morton Acked-by: Zi Yan Acked-by: Balbir Singh Acked-by: David Hildenbrand (Arm) Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Joshua Hahn Cc: Matthew Brost Cc: Rakie Kim Cc: Signed-off-by: Andrew Morton commit 4694efc4164123580f19467141cdcfb73f7a740a Author: Maciej W. Rozycki Date: Sat May 9 22:04:50 2026 +0100 FDDI: defza: Sanitise the reset safety timer The reset actions of the DEFZA adapters are exceedingly slow, taking up to 30 seconds to complete by the device spec and typically in the range of 10 seconds in reality, as required for the device RTOS to boot, still quite a lot. Therefore a state machine is used that's interrupt driven, however a safety mechanism is required in case of adapter malfunction, so that if no state change interrupt has arrived in time, then the situation is taken care of. The safety mechanism depends on the origin of the reset. For regular adapter initialisation at the device probe time a sleep is requested. However a reset is also required by the device spec when the adapter has transitioned into the halted state, such as in response to a PC Trace event in the course of ring fault recovery, possibly a common network event. In that case no sleep is possible as a device halt is reported at the hardirq level. A timer is therefore set up to ensure progress in case no adapter state change interrupt has arrived in time, but as from commit 168f6b6ffbee ("timers: Use del_timer_sync() even on UP") a warning is issued as the timer is deleted in the hardirq handler upon an expected state change: defza: v.1.1.4 Oct 6 2018 Maciej W. Rozycki tc2: DEC FDDIcontroller 700 or 700-C at 0x18000000, irq 4 tc2: resetting the board... ------------[ cut here ]------------ WARNING: kernel/time/timer.c:1611 at __timer_delete_sync+0x104/0x120, CPU#0: swapper/0/0 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.0.0-dirty #2 VOLUNTARY Stack : 9800000002027d08 00000000140120e0 0000000000000000 ffffffff8089d468 0000000000000000 0000000000000000 ffffffff807ed6b8 ffffffff80897458 ffffffff80897400 9800000002027b88 0000000000000000 7070617773203a6d 0000000000000000 9800000002027ba4 0000000000001000 6465746e69617420 0000000000000000 ffffffff807ed6b8 00000000140120e0 0000000000000009 000000000000064b ffffffff800dd14c 0000000000000036 9800000002184000 0000000000000000 0000000000000020 0000000000000000 ffffffff80910000 ffffffff8085c000 9800000002027c70 0000000000000001 ffffffff80045fa0 0000000000000000 0000000000000000 0000000000000000 0000000000000009 000000000000064b ffffffff800502b8 ffffffff807ed6b8 ffffffff80045fa0 ... Call Trace: [] show_stack+0x28/0xf0 [] dump_stack_lvl+0x48/0x7c [] __warn+0xa0/0x128 [] warn_slowpath_fmt+0x64/0xa4 [] __timer_delete_sync+0x104/0x120 [] fza_interrupt+0xc74/0xeb8 [] __handle_irq_event_percpu+0x70/0x228 [] handle_irq_event_percpu+0x18/0x78 [] handle_percpu_irq+0x50/0x80 [] generic_handle_irq+0x90/0xd0 [] do_IRQ+0x1c/0x30 [] handle_int+0x148/0x154 [] do_idle+0x40/0x108 [] cpu_startup_entry+0x2c/0x38 [] kernel_init+0x0/0x108 ---[ end trace 0000000000000000 ]--- tc2: OK tc2: model 700 (DEFZA-AA), MMF PMD, address 08-00-2b-xx-xx-xx tc2: ROM rev. 1.0, firmware rev. 1.2, RMC rev. A, SMT ver. 1 tc2: link unavailable ------------[ cut here ]------------ WARNING: kernel/time/timer.c:1611 at __timer_delete_sync+0x104/0x120, CPU#0: swapper/0/0 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G W 7.0.0-dirty #2 VOLUNTARY Tainted: [W]=WARN Stack : 9800000002027d08 00000000140120e0 0000000000000000 ffffffff8089d468 0000000000000000 0000000000000000 ffffffff807ed6b8 ffffffff80897458 ffffffff80897400 9800000002027b88 0000000000000000 0000000000000000 0000000000000000 9800000002027ba4 0000000000001000 0000000000000000 0000000000000000 ffffffff807ed6b8 00000000140120e0 0000000000000009 000000000000064b ffffffff800dd14c 0000000000000036 9800000002184000 0000000000000000 0000000000000020 0000000000000000 ffffffff80910000 ffffffff8085c000 9800000002027c70 0000000000000001 ffffffff80045fa0 0000000000000000 0000000000000000 0000000000000000 0000000000000009 000000000000064b ffffffff800502b8 ffffffff807ed6b8 ffffffff80045fa0 ... Call Trace: [] show_stack+0x28/0xf0 [] dump_stack_lvl+0x48/0x7c [] __warn+0xa0/0x128 [] warn_slowpath_fmt+0x64/0xa4 [] __timer_delete_sync+0x104/0x120 [] fza_interrupt+0xc74/0xeb8 [] __handle_irq_event_percpu+0x70/0x228 [] handle_irq_event_percpu+0x18/0x78 [] handle_percpu_irq+0x50/0x80 [] generic_handle_irq+0x90/0xd0 [] do_IRQ+0x1c/0x30 [] handle_int+0x148/0x154 [] arch_local_irq_disable+0x4/0x28 [] do_idle+0x50/0x108 [] cpu_startup_entry+0x2c/0x38 [] kernel_init+0x0/0x108 ---[ end trace 0000000000000000 ]--- tc2: registered as fddi0 The immediate origin of the new warning is the switch away from aliasing del_timer_sync() to del_timer() (timer_delete_sync() to timer_delete() in terms of current function names) for UP configurations, which however is the only choice for this driver anyway as no SMP hardware supports the TURBOchannel bus this device interfaces to. Therefore there is a very remote issue only this is a sign of. Specifically if an adapter reset issued upon a transition to the halted state times out and first triggers fza_reset_timer() for another reset assertion, which then schedules fza_reset_timer() for reset deassertion and then that second call is pre-empted after poking at the hardware, but before the timer has been rearmed and owing to high system load causing exceedingly high scheduling latency control is not handed back before a transition to the uninitialised state has caused the timer to be deleted even before it has been started, then fza_reset_timer() will be called yet again and issue another reset even though by then the adapter has already recovered. Prevent this situation from happening by switching to timer_delete() for the transition to the halted state and protect the code region affected with a spinlock, also to make sure add_timer() has not been called twice in a row due to an execution race between the interrupt handler and the timer handler (though it could only happen on SMP, but let's keep the driver clean). It's a very unlikely sequence of events to happen and therefore there's no point in trying to be overly clever about it, such as by placing printk() calls outside the protection. For the transition to the uninitialised state switch to timer_delete_sync_try() instead, so that a timer isn't deleted that's just been rearmed by the timer handler and needs to watch for the device to come out of reset again (again, an SMP scenario only). Retain timer_delete_sync() invocations outside the hardirq context for a stray timer not to fire once device structures have been released. Fixes: 61414f5ec9834 ("FDDI: defza: Add support for DEC FDDIcontroller 700 TURBOchannel adapter") Signed-off-by: Maciej W. Rozycki Signed-off-by: Jakub Kicinski commit 8b35874f56ded0cc1a90a25b87411249a86246cd Author: Michael Kelley Date: Tue Feb 17 10:23:35 2026 -0800 drm/hyperv: During panic do VMBus unload after frame buffer is flushed In a VM, Linux panic information (reason for the panic, stack trace, etc.) may be written to a serial console and/or a virtual frame buffer for a graphics console. The latter may need to be flushed back to the host hypervisor for display. The current Hyper-V DRM driver for the frame buffer does the flushing *after* the VMBus connection has been unloaded, such that panic messages are not displayed on the graphics console. A user with a Hyper-V graphics console is left with just a hung empty screen after a panic. The enhanced control that DRM provides over the panic display in the graphics console is similarly non-functional. Commit 3671f3777758 ("drm/hyperv: Add support for drm_panic") added the Hyper-V DRM driver support to flush the virtual frame buffer. It provided necessary functionality but did not handle the sequencing problem with VMBus unload. Fix the full problem by using VMBus functions to suppress the VMBus unload that is normally done by the VMBus driver in the panic path. Then after the frame buffer has been flushed, do the VMBus unload so that a kdump kernel can start cleanly. As expected, CONFIG_DRM_PANIC must be selected for these changes to have effect. As a side benefit, the enhanced features of the DRM panic path are also functional. Fixes: 3671f3777758 ("drm/hyperv: Add support for drm_panic") Signed-off-by: Michael Kelley Reviewed-by: Jocelyn Falempe Signed-off-by: Wei Liu commit c5c3ef8d49e15d2fc1cec4ad7c91d81b99977440 Author: Michael Kelley Date: Tue Feb 17 10:23:34 2026 -0800 Drivers: hv: vmbus: Provide option to skip VMBus unload on panic Currently, VMBus code initiates a VMBus unload in the panic path so that if a kdump kernel is loaded, it can start fresh in setting up its own VMBus connection. However, a driver for the VMBus virtual frame buffer may need to flush dirty portions of the frame buffer back to the Hyper-V host so that panic information is visible in the graphics console. To support such flushing, provide exported functions for the frame buffer driver to specify that the VMBus unload should not be done by the VMBus driver, and to initiate the VMBus unload itself. Together these allow a frame buffer driver to delay the VMBus unload until after it has completed the flush. Ideally, the VMBus driver could use its own panic-path callback to do the unload after all frame buffer drivers have finished. But DRM frame buffer drivers use the kmsg dump callback, and there are no callbacks after that in the panic path. Hence this somewhat messy approach to properly sequencing the frame buffer flush and the VMBus unload. Fixes: 3671f3777758 ("drm/hyperv: Add support for drm_panic") Signed-off-by: Michael Kelley Reviewed-by: Long Li Signed-off-by: Wei Liu commit 30792d12842901f5276f466a960962d5bfa15cc8 Author: Saurav Sachidanand Date: Thu May 7 22:11:45 2026 +0000 i2c: tegra: make tegra_i2c_mutex_unlock() return void tegra_i2c_mutex_unlock() returning an error that overwrites the transfer result causes silent loss of I2C transfer errors. If the transfer failed but the unlock succeeded, the error was lost and the function incorrectly reported success. Rather than propagating the unlock error (which is not actionable by the caller - the I2C message may have been sent regardless), convert the function to return void and WARN on the unexpected condition. If the unlock fails, subsequent lock attempts will fail anyway, making the error visible on the next transfer. Fixes: 6077cfd716fb ("i2c: tegra: Add support for SW mutex register") Signed-off-by: Saurav Sachidanand Cc: # v7.0+ Reviewed-by: Jon Hunter Acked-by: Thierry Reding Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260507221145.62183-3-sauravsc@amazon.com commit 57cf4e8d6a57dc2ef5810f4852a23ba4c71b74bb Author: Saurav Sachidanand Date: Thu May 7 22:11:44 2026 +0000 i2c: tegra: fix pm_runtime leak on mutex_lock failure If tegra_i2c_mutex_lock() fails, the function returns without calling pm_runtime_put(), leaking the runtime PM reference acquired by the preceding pm_runtime_get_sync(). This prevents the device from ever entering runtime suspend. Add the missing pm_runtime_put() before returning on lock failure. Fixes: 6077cfd716fb ("i2c: tegra: Add support for SW mutex register") Signed-off-by: Saurav Sachidanand Cc: # v7.0+ Reviewed-by: Jon Hunter Acked-by: Thierry Reding Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260507221145.62183-2-sauravsc@amazon.com commit 50030d63b4d3deda4cbea85bb43cfc1785267621 Author: Bartosz Golaszewski Date: Wed May 13 17:04:48 2026 +0200 driver core: platform: remove software node on release() If we pass a software node to a newly created device using struct platform_device_info, it will not be removed when the device is released. This may happen when a module creating the device is removed or on failure in platform_device_add(). When we try to reuse that software node in a subsequent call to platform_device_register_full(), it will fail with -EBUSY. Provide a wrapper around the existing platform_device_release() that additionally calls device_remove_software_node() and use it to replace the former if we end up adding a software node. While at it: check all three possible situations in which two software nodes for a single platform device can be created/assigned in platform_device_register_full() and bail-out early. Fixes: 0fc434bc2c45 ("driver core: platform: allow attaching software nodes when creating devices") Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260513-swnode-remove-on-dev-unreg-v6-1-f9c58939df27@oss.qualcomm.com Signed-off-by: Danilo Krummrich commit 59a62ea4583e0f740bb3576ec210b23f39754327 Merge: 0913b580f8490c 6ae315d3792443 Author: Linus Torvalds Date: Wed May 13 15:00:40 2026 -0700 Merge tag 'sched_ext-for-7.1-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: "The bulk of this is hardening of the new sub-scheduler infrastructure. - UAFs and lifecycle bugs on the sub-sched attach/detach paths: parent sub_kset freed under a racing child, list_del_rcu on an uninitialized list head, ops->priv stomped by concurrent attach/detach, and a UAF in the init-failure error path - Task state-machine reorg closing concurrent enable-vs-dead races: a task exiting during the unlocked init window could trip NULL ops derefs or skip exit_task() cleanup - A scx_link_sched() self-deadlock on scx_sched_lock - isolcpus: stop dereferencing the now-RCU-protected HK_TYPE_DOMAIN cpumask without RCU, and stop rejecting BPF schedulers when only cpuset isolated partitions are active - PREEMPT_RT: disable irq_work runs in hardirq context so dumps show the failing task rather than the irq_work kthread - Assorted !CONFIG_EXT_SUB_SCHED, randconfig, and selftest build fixes" * tag 'sched_ext-for-7.1-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation sched_ext: Defer sub_kset base put to scx_sched_free_rcu_work sched_ext: INIT_LIST_HEAD() &sch->all in scx_alloc_and_add_sched() sched_ext: Drop NONE early return in scx_disable_and_exit_task() sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path sched_ext: Clear ops->priv on scx_alloc_and_add_sched() error paths sched_ext: Fix ops->priv clobber on concurrent attach/detach selftests/sched_ext: Fix build error in dequeue selftest sched_ext: Handle SCX_TASK_NONE in disable/switched_from paths sched_ext: Close sub-sched init race with post-init DEAD recheck sched_ext: Close root-enable vs sched_ext_dead() race with SCX_TASK_INIT_BEGIN sched_ext: Replace SCX_TASK_OFF_TASKS flag with SCX_TASK_DEAD state sched_ext: Inline scx_init_task() and move RESET_RUNNABLE_AT into scx_set_task_state() sched_ext: Cleanups in preparation for the SCX_TASK_INIT_BEGIN/DEAD work sched_ext: Use IRQ_WORK_INIT_HARD() to initialize sch->disable_irq_work sched_ext: Fix !CONFIG_EXT_SUB_SCHED build warnings sched_ext: Drop unused scx_find_sub_sched() stub sched_ext: Move scx_error() out of scx_link_sched()'s lock region commit 0913b580f8490caaaf08dd1591e0bc07ac2720cb Merge: 50599e4c68eeea 345f40166694e6 Author: Linus Torvalds Date: Wed May 13 14:56:31 2026 -0700 Merge tag 'cgroup-for-7.1-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - cpuset fixes: - Partition invalidation could return CPUs still in use by sibling partitions, producing overlapping effective_cpus - cpuset_can_attach() over-reserved DL bandwidth on moves that stayed within the same root domain - Pending DL migration state leaked into later attaches when a later can_attach() check failed - Reorder PF_EXITING and __GFP_HARDWALL checks so dying tasks can allocate from any node and exit quickly - dmem: propagate -ENOMEM instead of spinning forever when the fallback pool allocation also fails - selftests/cgroup: percpu test error-path leak, bogus numeric comparison of cpuset strings, and a zero-length read() that silently passed OOM-kill tests * tag 'cgroup-for-7.1-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/cpuset: Return only actually allocated CPUs during partition invalidation selftests/cgroup: Fix error path leaks in test_percpu_basic cgroup/cpuset: Reserve DL bandwidth only for root-domain moves cgroup/cpuset: Reset DL migration state on can_attach() failure selftests/cgroup: Fix string comparison in write_test selftests/cgroup: Fix cg_read_strcmp() empty string comparison cgroup/dmem: Return -ENOMEM on failed pool preallocation cgroup/cpuset: move PF_EXITING check before __GFP_HARDWALL in cpuset_current_node_allowed() commit 50599e4c68eeea2cb635e763c9c5befa6dc9ab6d Merge: e1914add279922 0143033dc22cdf Author: Linus Torvalds Date: Wed May 13 14:49:13 2026 -0700 Merge tag 'wq-for-7.1-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fixes from Tejun Heo: - Plug a wq->cpu_pwq leak on the WQ_UNBOUND allocation failure path - Fix a cancel_delayed_work_sync() livelock against drain_workqueue() caused by the drain/destroy reject path leaving WORK_STRUCT_PENDING set with no owner * tag 'wq-for-7.1-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path workqueue: Release PENDING in __queue_work() drain/destroy reject path commit b5c7a7f452b885bfbe102bd3a057a5f496802f8b Author: Chen Ni Date: Tue Apr 28 15:35:58 2026 +0800 drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table Check the return value of kzalloc() to prevent a NULL pointer dereference on allocation failure. Fixes: 06cfbca0e1c6 ("drm/msm/a6xx: Share dependency vote table with GMU") Signed-off-by: Chen Ni Reviewed-by: Dmitry Baryshkov Reviewed-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/721342/ Message-ID: <20260428073558.1234238-1-nichen@iscas.ac.cn> Signed-off-by: Rob Clark commit 55e0f0d1c1a4ee1e46da7da4d443eb3044fb3851 Author: Mikko Perttunen Date: Tue Apr 21 13:02:38 2026 +0900 drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN Commit "iommu: return full error code from iommu_map_sg[_atomic]()" changed iommu_map_sgtable() to return an ssize_t and negative values in error cases, rather than a size_t and a zero. Store the return value in the appropriate type and in case of error, return it rather than WARNing. Fixes: ad8f36e4b6b1 ("iommu: return full error code from iommu_map_sg[_atomic]()") Signed-off-by: Mikko Perttunen Patchwork: https://patchwork.freedesktop.org/patch/719685/ Message-ID: <20260421-iommu_map_sgtable-return-v1-3-fb484c07d2a1@nvidia.com> Signed-off-by: Rob Clark commit 78d79c614aaa172ae1ddaea19a3885a9ff3ba857 Author: Rob Clark Date: Sat Apr 18 08:08:47 2026 -0700 drm/msm: Correct modparam description Preemption is enabled for gen8 as well. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/719256/ Message-ID: <20260418150847.157246-1-robin.clark@oss.qualcomm.com> commit 7a529ff48b99011c946e6d8addd071c06d3ccdae Author: Rob Clark Date: Sat Apr 11 08:03:12 2026 -0700 drm/msm/a6xx: Restore sysprof_active This got lost in the shuffle somehow when moving the vfunc table to catalogue. Fixes inhibiting IFPC when userspace is collecting perfcntr data. Fixes: 491fadb2b818 ("drm/msm/adreno: Move adreno_gpu_func to catalogue") Signed-off-by: Rob Clark Reviewed-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/717780/ Message-ID: <20260411150312.257937-1-robin.clark@oss.qualcomm.com> commit 2b4abf879360ea00a9e2b46d2d15dcdbc0687eed Author: Dmitry Baryshkov Date: Sat Apr 11 17:59:15 2026 +0300 drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params (because those generations didn't support UBWC anyway), however it's still possible to query UBWC-related params from the userspace, triggering possible NULL pointer dereference. Check for UBWC config in adreno_get_param() and return sane defaults if there is none. Fixes: a452510aad53 ("drm/msm/adreno: Switch to the common UBWC config struct") Signed-off-by: Dmitry Baryshkov Reviewed-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/717778/ Message-ID: <20260411-adreno-fix-ubwc-v3-1-4983156f3f80@oss.qualcomm.com> Signed-off-by: Rob Clark commit 4b83cbc4c15f09b000cc06f033f64b0824b6dc87 Author: Jeremy Laratro Date: Wed May 13 08:26:16 2026 +0900 ksmbd: fix null pointer dereference in compare_guid_key() session_fd_check() walks the per-inode m_op_list during durable-handle session teardown and sets op->conn = NULL for every opinfo whose conn matched the closing session's connection. The matching opinfo, however, stays linked in its per-ClientGuid lease_table_list entry's lb->lease_list because destroy_lease_table() only runs on full TCP-connection teardown, not on SESSION_LOGOFF. If the same TCP connection then negotiates a fresh session with the same ClientGuid (ClientGuid is bound to NEGOTIATE, not the session, and is unchanged across LOGOFF + SETUP) and issues a SMB2 CREATE with a lease context on a different inode, find_same_lease_key() walks lb->lease_list, reaches the stale opinfo, and calls compare_guid_key(), which unconditionally dereferences opinfo->conn->ClientGUID. The conn pointer is NULL and the kernel panics. Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194: general protection fault, probably for non-canonical address 0xdffffc0000000069: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000348-0x000000000000034f] Workqueue: ksmbd-io handle_ksmbd_work RIP: 0010:bcmp+0x5b/0x230 Call Trace: compare_guid_key+0x4b/0xd0 find_same_lease_key+0x324/0x690 smb2_open+0x6aea/0x8e60 handle_ksmbd_work+0x796/0xee0 ... Faulting address 0x348 is the offset of ClientGUID within struct ksmbd_conn, confirming opinfo->conn was NULL. Read opinfo->conn once and bail out if it has been cleared by a concurrent session_fd_check(). A half-detached opinfo cannot be the owner of an active lease, so returning 0 is the correct match result. Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2") Cc: stable@vger.kernel.org Signed-off-by: Jeremy Laratro Acked-by: Namjae Jeon Signed-off-by: Steve French commit 904901561e61a2b559070b20c74a8c95491f30aa Author: Jeremy Laratro Date: Wed May 13 08:23:26 2026 +0900 ksmbd: fix null pointer dereference in proc_show_files() When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the reconnectable file pointer but leaves the fp registered in global_ft.idr until the durable scavenger fires (up to fp->durable_timeout seconds later). During that window any read of /proc/fs/ksmbd/files (mode 0400) panics the kernel because proc_show_files() walks global_ft.idr and unconditionally dereferences fp->tcon->id with no NULL guard. Reproducer requires only a successful SMB2 SESSION_SETUP and a share configured with 'durable handles = yes'. KASAN report on mainline 70390501d194: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:proc_show_files+0x118/0x740 Call Trace: proc_show_files+0x118/0x740 seq_read_iter+0x4ef/0xe10 proc_reg_read_iter+0x1b7/0x280 ... Guard the dereference. A durable-disconnected fp legitimately has no tcon; report its tree id as 0 rather than oopsing. Fixes: b38f99c1217a ("ksmbd: add procfs interface for runtime monitoring and statistics") Cc: stable@vger.kernel.org Signed-off-by: Jeremy Laratro Acked-by: Namjae Jeon Signed-off-by: Steve French commit af92ee994cc7f7e83a41c2025f32257a2f82a7ef Author: Ferry Meng Date: Mon May 11 21:18:16 2026 +0800 ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow Commit 299f962c0b02 ("ksmbd: use check_add_overflow() to prevent u16 DACL size overflow") added check_add_overflow() guards that break out of the ACE-building loops in set_posix_acl_entries_dacl() when the accumulated DACL size would wrap past 65535. However, each iteration allocates a struct smb_sid via kmalloc_obj() at the top of the loop and relies on the kfree(sid) call at the end of the loop body (the 'pass_same_sid' label in the first loop, and the explicit kfree at the tail of the second loop) to release it. The newly introduced 'break' statements bypass those kfree() calls, leaking the sid buffer every time an overflow is detected. A malicious or malformed file with enough POSIX ACL entries to trip the overflow check will leak one or more struct smb_sid allocations on every request that touches the file's DACL, providing a trivial kernel memory exhaustion vector. Free sid before breaking out of the loops to plug the leak. Fixes: 299f962c0b02 ("ksmbd: use check_add_overflow() to prevent u16 DACL size overflow") Cc: stable@vger.kernel.org Signed-off-by: Ferry Meng Acked-by: Namjae Jeon Signed-off-by: Steve French commit e64bca63647db1d5518198d6c5ca2dbcc66b182b Author: Felix Gu Date: Sat Jan 24 00:37:38 2026 +0800 drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() In a6xx_gpu_init(), node is obtained via of_parse_phandle(). While there was a manual of_node_put() at the end of the common path, several early error returns would bypass this call, resulting in a reference leak. Fix this by using the __free(device_node) cleanup handler to release the reference when the variable goes out of scope. Fixes: 5a903a44a984 ("drm/msm/a6xx: Introduce GMU wrapper support") Signed-off-by: Felix Gu Patchwork: https://patchwork.freedesktop.org/patch/700661/ Message-ID: <20260124-a6xx_gpu-v1-1-fa0c8b2dcfb1@gmail.com> Signed-off-by: Rob Clark commit 46e351e84853dda726072bb3d38ba7bd63e7532b Author: Alexander Koskovich Date: Sat Mar 14 04:14:50 2026 +0000 drm/msm: Fix GMEM_BASE for A650 Commit dc220915ddb2 ("drm/msm: Fix GMEM_BASE for gen8") changed the GMEM_BASE check from adreno_is_a650_family() & adreno_is_a740_family() to family >= ADRENO_6XX_GEN4. This inadvertently excluded A650 (ADRENO_6XX_GEN3), causing it to report an incorrect GMEM_BASE which results in severe rendering corruption. Update check to also include ADRENO_6XX_GEN3 to fix A650. Fixes: dc220915ddb2 ("drm/msm: Fix GMEM_BASE for gen8") Signed-off-by: Alexander Koskovich Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/711880/ Message-ID: <20260314-fix-gmem-base-a650-v1-1-3308f60cf74c@pm.me> Signed-off-by: Rob Clark commit df733ddc263dbe5f471e7c80c8b669532f56bf76 Author: Matt Evans Date: Mon May 11 07:46:42 2026 -0700 vfio/pci: Make VFIO_PCI_OFFSET_TO_INDEX() return unsigned VFIO_PCI_OFFSET_TO_INDEX() is used in several places with a signed parameter (e.g. loff_t). Because it makes no sense for a BAR/resource index to be negative, enforce this in the macro. This fixes at least one current issue, where vfio_pci_ioeventfd() uses this macro with an unvalidated signed loff_t returned into a signed type, leading to a possible negative array access. This instance does test against an out-of-bounds positive value, so treating the index as unsigned fixes this issue. Fixes: 89e1f7d4c66d8 ("vfio: Add PCI device driver") Signed-off-by: Matt Evans Link: https://lore.kernel.org/r/20260511144642.2926799-1-mattev@meta.com Signed-off-by: Alex Williamson commit 6ae315d37924435516d697ea7dde0b799a5928e0 Author: Andrea Righi Date: Wed May 13 13:24:38 2026 +0200 sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation scx_enable() refuses to attach a BPF scheduler when isolcpus=domain is in effect by comparing housekeeping_cpumask(HK_TYPE_DOMAIN) against cpu_possible_mask. Since commit 27c3a5967f05 ("sched/isolation: Convert housekeeping cpumasks to rcu pointers"), HK_TYPE_DOMAIN's cpumask is RCU protected and dereferencing it requires either RCU read lock, the cpu_hotplug write lock, or the cpuset lock; scx_enable() holds none of these, so booting with isolcpus=domain and attaching any BPF scheduler triggers the following lockdep splat: ============================= WARNING: suspicious RCU usage ----------------------------- kernel/sched/isolation.c:60 suspicious rcu_dereference_check() usage! 1 lock held by scx_flash/281: #0: ffffffff8379fce0 (update_mutex){+.+.}-{4:4}, at: bpf_struct_ops_link_create+0x134/0x1c0 Call Trace: dump_stack_lvl+0x6f/0xb0 lockdep_rcu_suspicious.cold+0x37/0x70 housekeeping_cpumask+0xcd/0xe0 scx_enable.isra.0+0x17/0x120 bpf_scx_reg+0x5e/0x80 bpf_struct_ops_link_create+0x151/0x1c0 __sys_bpf+0x1e4b/0x33c0 __x64_sys_bpf+0x21/0x30 do_syscall_64+0x117/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f In addition, commit 03ff73510169 ("cpuset: Update HK_TYPE_DOMAIN cpumask from cpuset") made HK_TYPE_DOMAIN include cpuset isolated partitions as well, which means the current check also rejects BPF schedulers when a cpuset partition is active. That contradicts the original intent of commit 9f391f94a173 ("sched_ext: Disallow loading BPF scheduler if isolcpus= domain isolation is in effect"), which explicitly noted that cpuset partitions are honored through per-task cpumasks and should not be rejected. Switch to housekeeping_enabled(HK_TYPE_DOMAIN_BOOT), which reads only the housekeeping flag bit (no RCU dereference) and reflects exactly the boot-time isolcpus= configuration that the error message refers to. Fixes: 27c3a5967f05 ("sched/isolation: Convert housekeeping cpumasks to rcu pointers") Cc: stable@vger.kernel.org # v7.0+ Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo Acked-by: Frederic Weisbecker commit c64a647c84f30be368404f50f9052ed6c75c0f17 Author: Alex Williamson Date: Thu May 7 08:35:46 2026 -0600 vfio/pci: fix dma-buf kref underflow after revoke vfio_pci_dma_buf_move(revoked=true) and vfio_pci_dma_buf_cleanup() ran the same drain sequence: set priv->revoked, invalidate mappings, wait for fences, drop the registered kref, wait for completion. When the VFIO device fd was closed after PCI_COMMAND_MEMORY had been cleared, both ran in turn -- the second kref_put underflowed and the subsequent wait_for_completion() blocked on a completion that the first run had already consumed: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x59/0x90 Call Trace: vfio_pci_dma_buf_cleanup+0x163/0x168 [vfio_pci_core] vfio_pci_core_close_device+0x67/0xe0 [vfio_pci_core] vfio_df_close+0x4c/0x80 [vfio] vfio_df_group_close+0x36/0x80 [vfio] vfio_device_fops_release+0x21/0x40 [vfio] __fput+0xe6/0x2b0 __x64_sys_close+0x3d/0x80 Collapse the duplication: vfio_pci_dma_buf_cleanup() now delegates the drain to vfio_pci_dma_buf_move(true), which is idempotent for already-revoked dma-bufs. cleanup retains only list removal and the device registration drop; the dma_resv_lock that bracketed those is dropped along with the in-line drain that required it, memory_lock continues to protect them. Re-arm the kref and the completion at the end of move()'s revoke branch so post-revoke state matches post-creation (kref == 1, completion ready). This keeps cleanup's call into move() a no-op when revoke already ran, and replaces the explicit kref_init() that the un-revoke branch used to perform for the un-revoke -> remap path. Fixes: 1a8a5227f229 ("vfio: Wait for dma-buf invalidation to complete") Reported-by: Joonas Kylmälä Closes: https://lore.kernel.org/all/GVXPR02MB12019AA6014F27EF5D773E89BFB372@GVXPR02MB12019.eurprd02.prod.outlook.com/ Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Reviewed-by: Leon Romanovsky Signed-off-by: Alex Williamson Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260507143548.1018405-1-alex.williamson@nvidia.com Signed-off-by: Alex Williamson commit e7b8b3c5b2a65595d506ffedafac66f0a11fbdc2 Author: Christoph Hellwig Date: Thu May 7 07:01:48 2026 +0200 block: align down bounces bios Just like for the extract user pages path, we need to align down the size to the supported boundary. Fixes: 8dd5e7c75d7b ("block: add helpers to bounce buffer an iov_iter into bios") Signed-off-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260507050153.1298375-3-hch@lst.de Signed-off-by: Jens Axboe commit 32d5019ed3b6ff4439cb075fb275f655c8a2059c Author: Christoph Hellwig Date: Thu May 7 07:01:47 2026 +0200 block: pass a minsize argument to bio_iov_iter_bounce When bouncing for block size > PAGE_SIZE file systems that require file system block size alignment (e.g. zoned XFS), the bio needs to be big enough to fit an entire block. Fixes: 8dd5e7c75d7b ("block: add helpers to bounce buffer an iov_iter into bios") Signed-off-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260507050153.1298375-2-hch@lst.de Signed-off-by: Jens Axboe commit 85cffdb21bc1a928f4c89f88dcdf42a460b04e70 Author: Henry Tseng Date: Wed May 13 18:28:46 2026 +0800 cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake Bartlett Lake P-core only SKUs (e.g. Intel Core 9 273PE) do not report X86_FEATURE_HYBRID_CPU and are not in intel_hybrid_scaling_factor[]. In hwp_get_cpu_scaling(), the non-hybrid fallback then applies core_get_scaling() (100000), producing cpuinfo_max_freq values that exceed the documented Max Turbo Frequency: intel_pstate: CPU0: PERF_CTL turbo = 57 intel_pstate: CPU0: HWP_CAP guaranteed = 30 intel_pstate: CPU0: HWP_CAP highest = 70 intel_pstate: CPU0: HWP-to-frequency scaling factor: 100000 intel_pstate: set_policy cpuinfo.max 7000000 policy->max 7000000 ... intel_pstate: CPU12: PERF_CTL turbo = 57 intel_pstate: CPU12: HWP_CAP guaranteed = 30 intel_pstate: CPU12: HWP_CAP highest = 73 intel_pstate: CPU12: HWP-to-frequency scaling factor: 100000 intel_pstate: set_policy cpuinfo.max 7300000 policy->max 7300000 ... Per the Intel datasheet [1], the Intel Core 9 273PE specifies: Performance-cores: 12 Efficient-cores: 0 Max Turbo Frequency: 5.7 GHz Intel Thermal Velocity Boost Frequency: 5.7 GHz Intel Turbo Boost Max Technology 3.0 Frequency: 5.6 GHz Performance-core Max Turbo Frequency: 5.4 GHz Performance-core Base Frequency: 2.3 GHz Bartlett Lake P-cores are Raptor Cove cores, per commit d466304c4322 ("x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores"). The Alder Lake and Raptor Lake P-core entries in intel_hybrid_scaling_factor[] use HYBRID_SCALING_FACTOR_ADL (78741). The same factor applies to Bartlett Lake. Add Bartlett Lake to intel_hybrid_scaling_factor[] with HYBRID_SCALING_FACTOR_ADL so HWP performance levels map to the correct CPU frequencies matching the datasheet's Max Turbo Frequency. Link: https://www.intel.com/content/www/us/en/products/sku/245717/intel-core-9-processor-273pe-36m-cache-up-to-5-70-ghz/specifications.html [1] Signed-off-by: Henry Tseng [ rjw: Changelog tweak ] Link: https://patch.msgid.link/20260513102847.75179-1-henrytseng@qnap.com Signed-off-by: Rafael J. Wysocki commit 0e7c710478b3089cdfe8669347f77b163e836c4f Author: Rafael J. Wysocki Date: Tue May 12 21:20:30 2026 +0200 cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E Raptor Lake-E has the same processor ID as Raptor Lake-S, so there is an entry in intel_hybrid_scaling_factor[] for it. It does not contain E-cores though and hybrid_get_cpu_type() returns 0 for its P-cores, so they get the default "core" scaling factor. However, the original Raptor Lake scaling factor for P-cores still needs to be used for mapping the HWP performance levels of the P-cores in Raptor Lake-E to frequency, as though they were part of a real hybrid system. To address this, update hwp_get_cpu_scaling() to return hybrid_scaling_factor, which is the P-core scaling factor retrieved from intel_hybrid_scaling_factor[], for all CPUs that are not enumerated as E-cores. Fixes: 9b18d536b124 ("cpufreq: intel_pstate: Use CPPC to get scaling factors") Link: https://lore.kernel.org/all/20260511235328.2018458-1-srinivas.pandruvada@linux.intel.com/ Reported-by: Henry Tseng Closes: https://lore.kernel.org/linux-pm/20260508063032.3248602-1-henrytseng@qnap.com/ Signed-off-by: Rafael J. Wysocki Cc: All applicable Link: https://patch.msgid.link/4523296.ejJDZkT8p0@rafael.j.wysocki commit ee047fc7a2da90554410128195058c409a391d43 Author: Ricardo Neri Date: Fri Apr 24 14:41:13 2026 -0700 Documentation: intel_pstate: Fix description of asymmetric packing with SMT Patchset [1], including commits 046a5a95c3b0 ("x86/sched/itmt: Give all SMT siblings of a core the same priority") 995998ebdebd ("x86/sched: Remove SD_ASYM_PACKING from the SMT domain flags") overhauled asym_packing handling in the scheduler on x86 hybrid processors with SMT. It removed SD_ASYM_PACKING from the x86 SMT scheduling domain and made all SMT siblings of a core share the same priority. As a result, asym_packing operates only across physical cores, spreading tasks among them and only using idle SMT siblings once all physical cores are busy. Fix the documentation to reflect this behavior. Fixes: f20af84c29b2 ("cpufreq: intel_pstate: Document hybrid processor support") Link: https://lore.kernel.org/r/20230406203148.19182-1-ricardo.neri-calderon@linux.intel.com [1] Signed-off-by: Ricardo Neri [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260424-rneri-fix-intel-pstate-doc-smt-asym-packing-v1-1-317bf7d5c362@linux.intel.com Signed-off-by: Rafael J. Wysocki commit d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc Author: Nicholas Carlini Date: Mon May 11 18:02:16 2026 +0000 io-wq: check that the predecessor is hashed in io_wq_remove_pending() io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled work was the tail of its hash bucket. When doing this, it checks whether the preceding entry in acct->work_list has the same hash value, but never checks that the predecessor is hashed at all. io_get_work_hash() is simply atomic_read(&work->flags) >> IO_WQ_HASH_SHIFT, and the hash bits are never set for non-hashed work, so it returns 0. Thus, when a hashed bucket-0 work is cancelled while a non-hashed work is its list predecessor, the check spuriously passes and a pointer to the non-hashed io_kiocb is stored in wq->hash_tail[0]. Because non-hashed work is dequeued via the fast path in io_get_next_work(), which never touches hash_tail[], the stale pointer is never cleared. Therefore, after the non-hashed io_kiocb completes and is freed back to req_cachep, wq->hash_tail[0] is a dangling pointer. The io_wq is per-task (tctx->io_wq) and survives ring open/close, so the dangling pointer persists for the lifetime of the task; the next hashed bucket-0 enqueue dereferences it in io_wq_insert_work() and wq_list_add_after() writes through freed memory. Add the missing io_wq_is_hashed() check so a non-hashed predecessor never inherits a hash_tail[] slot. Cc: stable@vger.kernel.org Fixes: 204361a77f40 ("io-wq: fix hang after cancelling pending hashed work") Signed-off-by: Nicholas Carlini Signed-off-by: Jens Axboe commit 345f40166694e60db6d5cf02233814bb27ac5dec Author: sunshaojie Date: Wed May 13 18:37:38 2026 +0800 cgroup/cpuset: Return only actually allocated CPUs during partition invalidation In update_parent_effective_cpumask() with partcmd_invalidate, the CPUs to return to the parent are computed as: adding = cpumask_and(tmp->addmask, xcpus, parent->effective_xcpus); where xcpus = user_xcpus(cs) which returns cs->exclusive_cpus (if set) or cs->cpus_allowed. When exclusive_cpus is not set, user_xcpus(cs) can contain CPUs that were never actually granted to the partition due to sibling exclusion in compute_excpus(). Consequently, the invalidation may return CPUs to the parent that remain in use by sibling partitions, causing overlapping effective_cpus and triggering the WARN_ON_ONCE(1) in generate_sched_domains(). Use cs->effective_xcpus instead, which reflects the CPUs actually granted to this partition. Reproducer (on a 4-CPU machine): cd /sys/fs/cgroup mkdir a1 b1 # a1 becomes partition root with CPUs 0-1 echo "0-1" > a1/cpuset.cpus echo "root" > a1/cpuset.cpus.partition # b1 becomes partition root with CPUs 1-2, but sibling exclusion # reduces its effective_xcpus to CPU 2 only echo "1-2" > b1/cpuset.cpus echo "root" > b1/cpuset.cpus.partition # b1 changes cpus_allowed to 0-1 -> partition invalidation echo "0-1" > b1/cpuset.cpus # Expected: CPUs 2-3 (only CPU 2 returned from b1) # Actual: CPUs 1-3 (CPU 0-1 returned, overlapping with a1) cat cpuset.cpus.effective dmesg will also show a WARNING from generate_sched_domains() reporting overlapping partition root effective_cpus. Fixes: 2a3602030d80 ("cgroup/cpuset: Don't invalidate sibling partitions on cpuset.cpus conflict") Cc: stable@vger.kernel.org # v7.0+ Signed-off-by: sunshaojie Tested-by: Chen Ridong Reviewed-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit e1914add2799225a87502051415fc5c32aeb02ae Merge: 1f63dd8ca0dc05 2d5d3fc593c9b7 Author: Linus Torvalds Date: Wed May 13 11:53:51 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "arm64: - Add the pKVM side of the workaround for ARM's erratum 4193714, provided that the EL3 firmware does its part of the job. KVM will refuse to initialise otherwise - Correctly handle 52bit VAs for guest EL2 stage-1 translations when running under NV with E2H==0 - Correctly deal with permission faults in guest_memfd memslots - Fix the steal-time selftest after the infrastructure was reworked - Make sure the host cannot pass a non-sensical clock update to the EL2 tracing infrastructure - Appoint Steffen Eiden as a reviewer in anticipation of the KVM/s390 ability to run arm64 guests, which will inevitably lead to arm64 code being directly used on s390 - Make sure that EL2 is configured with both exception entry and exit being Context Synchronization Events - Handle the current vcpu being NULL on EL2 panic - Fix the selftest_vcpu memcache being empty at the point of donation or sharing - Check that the memcache has enough capacity before engaging on the share/donate path - Fix __deactivate_fgt() to use its parameter rather than a variable in the macro context s390: - Fix array overrun with large amounts of PCI devices x86: - Never use L0's PAUSE loop exiting while L2 is running, since it's unlikely that a nested guest will help solving the hypervisor's spinlock contention - Fix emulation of MOVNTDQA - Fix typo in Xen hypercall tracepoint - Add back an optimization that was left behind when recently fixing a bug - Add module parameter to disable CET, whose implementation seems to have issues. For now it remains enabled by default Generic: - Reject offset causing an unsigned overflow in kvm_reset_dirty_gfn() Documentation: - Update stale links Selftests: - Fix guest_memfd_test with host page size > guest page size" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (22 commits) KVM: VMX: introduce module parameter to disable CET KVM: x86: Swap the dst and src operand for MOVNTDQA KVM: x86: use again the flush argument of __link_shadow_page() KVM: selftests: Ensure gmem file sizes are multiple of host page size Documentation: kvm: update links in the references section of AMD Memory Encryption KVM: nSVM: Never use L0's PAUSE loop exiting while L2 is running KVM: x86: Fix Xen hypercall tracepoint argument assignment KVM: Reject wrapped offset in kvm_reset_dirty_gfn() KVM: arm64: Pre-check vcpu memcache for host->guest donate KVM: arm64: Pre-check vcpu memcache for host->guest share KVM: arm64: Seed pkvm_ownership_selftest vcpu memcache KVM: arm64: Fix __deactivate_fgt macro parameter typo KVM: arm64: Guard against NULL vcpu on VHE hyp panic path KVM: arm64: Make EL2 exception entry and exit context-synchronization events MAINTAINERS: Add Steffen as reviewer for KVM/arm64 KVM: arm64: Remove potential UB on nvhe tracing clock update KVM: selftests: arm64: Fix steal_time test after UAPI refactoring KVM: arm64: Handle permission faults with guest_memfd KVM: arm64: nv: Consider the DS bit when translating TCR_EL2 KVM: arm64: Work around C1-Pro erratum 4193714 for protected guests ... commit 7d8f3158a51cb40fc710d2a781549141a139b796 Author: Yu Miao Date: Wed May 13 10:39:07 2026 +0800 selftests/cgroup: Fix error path leaks in test_percpu_basic When cg_name_indexed() returns NULL partway through the child creation loop, the code returned -1 without running cleanup_children and cleanup. That left the `parent` pathname allocation unreleased and did not remove child cgroup directories already created under the parent. Fix by jumping to cleanup_children instead of returning. When cg_create() fails, `child` (the pathname from cg_name_indexed()) was not freed before cleanup_children. Fix by freeing `child` before branching to cleanup_children. Fixes: 90631e1dea55 ("kselftests: cgroup: add perpcu memory accounting test") Signed-off-by: Yu Miao Signed-off-by: Tejun Heo commit f6b079629becfa977f9c51fe53ad2e6dcc55ef44 Author: Lord Ulf Henrik Holmberg Date: Sat May 9 10:40:11 2026 +0200 RDMA/bnxt_re: zero shared page before exposing to userspace bnxt_re_alloc_ucontext() allocates uctx->shpg via __get_free_page(GFP_KERNEL). The buddy allocator does not zero pages without __GFP_ZERO, so the page contains stale kernel data from whatever object most recently freed it. The page is then mapped into userspace via vm_insert_page() under BNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). The driver only ever writes 4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) inside bnxt_re_create_ah(); the remaining 4092 bytes of the page are exposed to userspace unsanitised, leaking kernel memory contents. Any user with access to /dev/infiniband/uverbsX on a host with a bnxt_re device (typically rdma group membership) can read this data via a single mmap() at pgoff 0 after IB_USER_VERBS_CMD_GET_CONTEXT. Other shared pages in the same file already use get_zeroed_page() correctly: drivers/infiniband/hw/bnxt_re/ib_verbs.c srq->uctx_srq_page = (void *)get_zeroed_page(GFP_KERNEL); cq->uctx_cq_page = (void *)get_zeroed_page(GFP_KERNEL); uctx->shpg is the only outlier. Bring it in line with the existing convention by switching to get_zeroed_page(). Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Lord Ulf Henrik Holmberg Link: https://patch.msgid.link/20260509084011.11971-1-pomzm67@gmail.com Signed-off-by: Leon Romanovsky commit 0bf1b4dda2d0c89980eab816778722cf51aa404c Author: Yi Lai Date: Thu May 7 20:51:06 2026 +0800 selftests/rdma: explicitly skip tests when required modules are missing Currently, the rdma rxe selftests fail with an exit code of 1 when required kernel modules are not present. This causes spurious failures in environments where these modules might not be compiled or available. Include the standard kselftest 'ktap_helpers.sh' and replace the hardcoded error exits with '$KSFT_SKIP'. This ensures the tests are properly marked as skipped rather than failed. Fixes: e01027cab38a ("RDMA/rxe: Add testcase for net namespace rxe") Signed-off-by: Yi Lai Link: https://patch.msgid.link/20260507125106.3114167-1-yi1.lai@intel.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 0b28000b64f40dd29a730507aa0447231960cfb8 Author: Edward Adam Davis Date: Thu May 7 20:50:10 2026 +0800 RDMA/nldev: Add mutual exclusion in nldev_dellink() We must serialize calls to nldev_dellink() or risk a crash as syzbot reported: KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] Call Trace: udp_tunnel_sock_release+0x6d/0x80 net/ipv4/udp_tunnel_core.c:197 rxe_release_udp_tunnel drivers/infiniband/sw/rxe/rxe_net.c:294 [inline] rxe_sock_put drivers/infiniband/sw/rxe/rxe_net.c:639 [inline] rxe_net_del+0xfb/0x290 drivers/infiniband/sw/rxe/rxe_net.c:660 rxe_dellink+0x15/0x20 drivers/infiniband/sw/rxe/rxe.c:254 Fixes: a60e3f3d6fba ("RDMA/nldev: Add dellink function pointer") Reported-by: syzbot+d8f76778263ab65c2b21@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d8f76778263ab65c2b21 Tested-by: syzbot+d8f76778263ab65c2b21@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Link: https://patch.msgid.link/tencent_611BEB4B141B1A2526BAA3BBB2335F9E9108@qq.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 84d1c9b416d54afe760ca4c378bd95c89261254c Author: Johan Hovold Date: Fri May 8 16:44:46 2026 +0200 drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init The LVDS init code looks up an I2C adapter using i2c_get_adapter() and tries to read the EDID before falling back to allocating and registering its own adapter. Make sure to drop the references taken by i2c_get_adapter() when falling back to allocating an adapter as well as on late errors to allow the looked up adapter to be deregistered. Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support") Cc: stable@vger.kernel.org # 3.3 Signed-off-by: Johan Hovold Signed-off-by: Patrik Jakobsson Link: https://patch.msgid.link/20260508144446.59722-4-johan@kernel.org commit 657a091ab6d01d0091b77660c75cfed573c9a53e Author: Johan Hovold Date: Fri May 8 16:44:45 2026 +0200 drm/gma500/oaktrail_lvds: fix hang on init failure The LVDS init code looks up an I2C adapter using i2c_get_adapter() and tries to read the EDID before falling back to allocating and registering its own adapter. The error handling does not separate these cases so on a late init failure it will try to deregister and free also an adapter that had previously been registered. Since i2c_get_adapter() takes another reference to the adapter, deregistration hangs indefinitely while waiting for the reference to be released. Fix this by only destroying adapters allocated during LVDS init on errors. Fixes: a57ebfc0b4da ("drm/gma500: Make oaktrail lvds use ddc adapter from drm_connector") Cc: stable@vger.kernel.org # 6.0 Cc: Patrik Jakobsson Signed-off-by: Johan Hovold Signed-off-by: Patrik Jakobsson Link: https://patch.msgid.link/20260508144446.59722-3-johan@kernel.org commit 950953f774b3f69da6f413e045ef075e1f3da2df Author: Johan Hovold Date: Fri May 8 16:44:44 2026 +0200 drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup Make sure to drop the reference taken to the I2C adapter (and its module) when setting up HDMI to allow the adapter to be deregistered. Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support") Cc: stable@vger.kernel.org # 3.3 Signed-off-by: Johan Hovold Signed-off-by: Patrik Jakobsson Link: https://patch.msgid.link/20260508144446.59722-2-johan@kernel.org commit 34065a5f3cf94886e59e2a8b5db00515f32d6cf2 Author: Hisam Mehboob Date: Thu Apr 9 20:38:47 2026 +0500 KVM: selftests: Guard execinfo.h inclusion for non-glibc builds The backtrace() function and execinfo.h are GNU extensions available in glibc but not in non-glibc C libraries such as musl. Building KVM selftests with musl-gcc fails with: lib/assert.c:9:10: fatal error: execinfo.h: No such file or directory Fix this by guarding the inclusion of execinfo.h and the stack dumping logic under #ifdef __GLIBC__. For non-glibc builds, provide a local stub for test_dump_stack(). Suggested-by: Aqib Faruqui Suggested-by: Sean Christopherson Signed-off-by: Hisam Mehboob Link: https://patch.msgid.link/20260409153846.1502656-2-hisamshar@gmail.com Signed-off-by: Sean Christopherson commit 8fe2e698fce4a95a3ac2c25fe59832a3c22534c6 Author: Lei Chen Date: Thu Apr 9 22:22:26 2026 +0800 KVM: x86: Rate-limit global clock updates on vCPU load commit 446fcce2a52b ("Revert "x86: kvm: rate-limit global clock updates"") dropped the rate limiting for KVM_REQ_GLOBAL_CLOCK_UPDATE. As a result, kvm_arch_vcpu_load() can queue global clock update requests every time a vCPU is scheduled when the master clock is disabled or when the vCPU is loaded for the first time. Restore the throttling with a per-VM ratelimit state and gate KVM_REQ_GLOBAL_CLOCK_UPDATE through __ratelimit(), so frequent vCPU scheduling does not generate a steady stream of redundant clock update requests. Fixes: 446fcce2a52b ("Revert "x86: kvm: rate-limit global clock updates"") Signed-off-by: Lei Chen Reported-by: Jaroslav Pulchart Closes: https://lore.kernel.org/all/CAK8fFZ5gY8_Mw2A=iZVFNVKQNrXQzVsn-HTd+Me9K6ZfmdgA+Q@mail.gmail.com/ Link: https://patch.msgid.link/20260409142226.2581-1-lei.chen@smartx.com Signed-off-by: Sean Christopherson commit fff82ea9d900b6bbebc58d34b7a63789de1ad10d Author: Mikhail Gavrilov Date: Tue May 5 04:54:35 2026 +0500 x86/virt: Silence RCU lockdep splat in emergency virt callback path x86_virt_invoke_kvm_emergency_callback() reaches rcu_dereference() through machine_crash_shutdown() with IRQs disabled but with RCU not necessarily watching the crashing CPU, which triggers a suspicious RCU usage splat on debug kernels (CONFIG_PROVE_RCU=y) during panic/kdump: WARNING: suspicious RCU usage arch/x86/virt/hw.c:52 suspicious rcu_dereference_check() usage! rcu_scheduler_active = 2, debug_locks = 1 1 lock held by tee/11119: #0: ffff8881fa32c440 (sb_writers#3){.+.+}-{0:0}, at: ksys_write Call Trace: dump_stack_lvl+0x84/0xd0 lockdep_rcu_suspicious.cold+0x37/0x8f x86_virt_invoke_kvm_emergency_callback+0x5f/0x70 x86_svm_emergency_disable_virtualization_cpu+0x2a/0x30 x86_virt_emergency_disable_virtualization_cpu+0x6b/0x90 native_machine_crash_shutdown+0x72/0x170 __crash_kexec+0x137/0x280 panic+0xce/0xd0 sysrq_handle_crash+0x1f/0x20 __handle_sysrq.cold+0x192/0x335 write_sysrq_trigger+0x8c/0xc0 proc_reg_write+0x1c3/0x3c0 vfs_write+0x1d0/0xf80 ksys_write+0x116/0x250 do_syscall_64+0x11c/0x1480 entry_SYSCALL_64_after_hwframe+0x76/0x7e A truly correct fix is non-trivial: the RCU usage genuinely is wrong in panic context (RCU may ignore the crashing CPU during synchronization), and a concurrent KVM module unload could in principle race with the callback read; see commit 2baa33a8ddd6 ("KVM: x86: Leave user-return notifier registered on reboot/shutdown") which notes that nothing prevents module unload during panic/reboot. However, the alternatives are worse: - smp_store_release()/smp_load_acquire() handles ordering but not liveness; the kernel still needs to keep the module text alive while the callback is in flight. - Taking a lock in the panic path is risky — any lock could be held by a CPU that has already been NMI'd to a halt. Use rcu_dereference_raw() to silence the splat and accept the vanishingly small remaining race. Panic context inherently cannot guarantee complete correctness; the goal here is to keep debug builds quiet on the kdump path so the splat doesn't obscure the actual kernel state being captured. Reproducible on a debug kernel (CONFIG_PROVE_LOCKING=y, CONFIG_PROVE_RCU=y) with kvm_amd or kvm_intel loaded by triggering kdump: echo c > /proc/sysrq-trigger Suggested-by: Sean Christopherson Fixes: 428afac5a8ea ("KVM: x86: Move bulk of emergency virtualizaton logic to virt subsystem") Signed-off-by: Mikhail Gavrilov Acked-by: Sean Christopherson Link: https://patch.msgid.link/20260504235435.90957-1-mikhail.v.gavrilov@gmail.com Signed-off-by: Sean Christopherson commit 6d3790bc689de9f18fae01c21f02e7d6d425534c Author: Sean Christopherson Date: Mon Apr 27 18:25:03 2026 -0700 KVM: selftests: Include sys/mman.h *and* linux/mman.h, via kvm_syscalls.h Include both linux/mman.h (the kernel provided version) and sys/mman.h (the libc provided version) throughout KVM selftests, by way of kvm_syscalls.h (which should have been including sys/mman.h anyways). Pulling in the kernel's version fixes compilation errors with the guest_memfd test on older versions of libc due to a recent commit adding MADV_COLLAPSE testing. In file included from include/kvm_util.h:8, from guest_memfd_test.c:21: guest_memfd_test.c: In function ‘test_collapse’: guest_memfd_test.c:219:47: error: ‘MADV_COLLAPSE’ undeclared (first use in this function); did you mean ‘MADV_COLD’? 219 | TEST_ASSERT_EQ(madvise(mem, pmd_size, MADV_COLLAPSE), -1); | ^~~~~~~~~~~~~ include/test_util.h:62:16: note: in definition of macro ‘TEST_ASSERT_EQ’ 62 | typeof(a) __a = (a); \ | ^ guest_memfd_test.c:219:47: note: each undeclared identifier is reported only once for each function it appears in 219 | TEST_ASSERT_EQ(madvise(mem, pmd_size, MADV_COLLAPSE), -1); | ^~~~~~~~~~~~~ include/test_util.h:62:16: note: in definition of macro ‘TEST_ASSERT_EQ’ 62 | typeof(a) __a = (a); \ | ^ Route the includes through kvm_syscalls.h to try and avoid a future game of whack-a-mole, i.e. so that future expansion of test coverage doesn't run into the same problem. To discourage use of sys/mman.h, opportunistically include the kernel's version of mman.h in test_util.h as it only needs MAP_SHARED, i.e. only needs the full set of kernel defs, not the libc syscall wrappers. Fixes: 9830209b4ae8 ("KVM: selftests: Test MADV_COLLAPSE on guest_memfd") Reported-by: Rick Edgecombe Closes: https://lore.kernel.org/all/20260427204313.50741-1-rick.p.edgecombe@intel.com Link: https://patch.msgid.link/20260428012503.1213654-1-seanjc@google.com Signed-off-by: Sean Christopherson commit ea324444ece9f301b5c4ff71b258cc68990c4d61 Author: Borislav Petkov (AMD) Date: Mon Mar 16 16:12:00 2026 +0100 x86/mce: Restore MCA polling interval halving RongQing reported that the MCA polling interval doesn't halve when an error gets logged. It was traced down to the commit in Fixes:, because: mce_timer_fn() |-> mce_poll_banks() |-> machine_check_poll() |-> mce_log() which will queue the work and return. Now, back in mce_timer_fn(): /* * Alert userspace if needed. If we logged an MCE, reduce the polling * interval, otherwise increase the polling interval. */ if (mce_notify_irq()) <--- here we haven't ran the notifier chain yet so mce_need_notify is not set yet so this won't hit and we won't halve the interval iv. Now the notifier chain runs. mce_early_notifier() sets the bit, does mce_notify_irq(), that clears the bit and then the notifier chain a little later logs the error. So this is a silly timing issue. But, that's all unnecessary. All it needs to happen here is, the "should we notify of a logged MCE" mce_notify_irq() asks, should be simply a question to the mce gen pool: "Are you empty?" And that then turns into a simple yes or no answer and it all JustWorks(tm). So do that and also distribute the functionality where it belongs: - Print that MCE events have been logged in mce_log() - Trigger the mcelog tool specific work in the first notifier As a result, mce_notify_irq() can go now. Fixes: 011d82611172 ("RAS: Add a Corrected Errors Collector") Reported-by: Li RongQing Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Qiuxu Zhuo Tested-by: Qiuxu Zhuo Link: https://lore.kernel.org/r/20260112082747.2842-1-lirongqing@baidu.com commit 1f63dd8ca0dc05a8272bb8155f643c691d29bb11 Merge: 1d5dcaa3bd65f2 7b0b68b2b95606 Author: Linus Torvalds Date: Wed May 13 08:24:50 2026 -0700 Merge tag 'fixes-2026-05-13' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux Pull liveupdate fixes from Mike Rapoport: "A few fixes for kexec handover and liveupdate: - make sure KHO is skipped for crash kernel - fix error reporting in memfd preservation if it fails mid-loop - don't allow preserving memfds whose page count exceeds UINT_MAX - fix documentation of memfd seals preservation to match the code" * tag 'fixes-2026-05-13' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: mm/memfd_luo: document preservation of file seals mm/memfd_luo: reject memfds whose page count exceeds UINT_MAX mm/memfd_luo: report error when restoring a folio fails mid-loop kho: skip KHO for crash kernel commit 8fb70afe671cc8c1f6237a39aabd50714fcd1189 Author: Michal Wajdeczko Date: Sun May 10 22:56:05 2026 +0200 drm/xe: Drop unused ggtt_balloon field During recent GGTT refactoring we missed to drop now unused field from the xe_tile. Drop it now. Fixes: e904c56ba6e0 ("drm/xe: Rewrite GGTT VF initialization") Signed-off-by: Michal Wajdeczko Reviewed-by: Maarten Lankhorst Link: https://patch.msgid.link/20260510205605.642-1-michal.wajdeczko@intel.com (cherry picked from commit 21d5a871f57909dc4d8e4f5d3bf92f9ccf2597b2) Signed-off-by: Rodrigo Vivi commit 87d0740b7c4cc847be1b6f307ab6d8547cb1a726 Author: Ming Lei Date: Wed May 13 18:19:40 2026 +0800 selftests: ublk: cap nthreads to kernel's actual nr_hw_queues dev->nthreads is derived from the user-requested queue count before the ADD command, but the kernel may reduce nr_hw_queues (capped to nr_cpu_ids). When the VM has fewer CPUs than requested queues, the daemon creates more handler threads than there are kernel queues. In non-batch mode, the extra threads access uninitialized queues (q_depth=0), submit zero io_uring SQEs, and block forever in io_cqring_wait. In batch mode, the extra threads cause similar hangs during device removal. In both cases, the stuck threads prevent the daemon from closing the char device, holding the last ublk_device reference and causing ublk_ctrl_del_dev() to hang in wait_event_interruptible(). Fix by capping dev->nthreads to the kernel-returned nr_hw_queues after the ADD command completes. per_io_tasks mode is excluded because threads interleave across all queues, so nthreads > nr_hw_queues is valid. Fixes: abe54c160346 ("selftests: ublk: kublk: decouple ublk_queues from ublk server threads") Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260513101941.1373998-1-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 836efd35c472d89c838d7b17ef339ddb3286ffc5 Author: Damien Le Moal Date: Wed May 13 20:11:29 2026 +0900 block: fix handling of dead zone write plugs Shin'ichiro reported hard to reproduce unaligned write errors with zoned block devices. Under normal operation conditions (e.g. running XFS on an SMR disk), these errors are nearly impossible to trigger. But using a "slow" kernel with many debug options enables and some specific use cases (e.g. fio zbd test case 46), the errors can be reproduced fairly easily. The unaligned write errors come from mishandling a valid reference counting pattern of zone write plugs. Such pattern triggers for instance if a process A writes a zone (not necessarilly to the full state), another process B immediately resets the zone and immediately following the completion of the zone reset, starts issuing writes to the zone. With such pattern, in some cases, the zone write plugs worker thread of the device may still be holding a reference to the zone write plug of the zone taken when process A was writing to the zone. The following zone reset from process B marks the zone as dead but does not remove the zone write plug from the device hash table as a reference to the plug still exist. Once process B starts issuing new writes, the zone write plug is seen as dead and the writes from process B are immediately failed, despite this write pattern being perfectly legal. Fix this by allowing restoring a dead zone write plug to a live state if a write is issued to the zone when the zone is: marked as dead, empty and the write sector corresponds to the first sector of the zone (that is, the write is aligned to the zone write pointer). This is done with the new helper function disk_check_zone_wplug_dead(), which restores a dead zone write plug to a live state by clearing the BLK_ZONE_WPLUG_DEAD flag and restoring the initial reference to the zone write plug taken when the plug was added to the device hash table. Reported-by: Shin'ichiro Kawasaki Fixes: b7d4ffb51037 ("block: fix zone write plug removal") Signed-off-by: Damien Le Moal Tested-by: Shin'ichiro Kawasaki Link: https://patch.msgid.link/20260513111129.108809-1-dlemoal@kernel.org Signed-off-by: Jens Axboe commit 2d5d3fc593c9b7e41bee86175d7b9e11f470072e Author: Paolo Bonzini Date: Tue May 12 16:58:48 2026 +0200 KVM: VMX: introduce module parameter to disable CET There have been reports of host hangs caused by CET virtualization. Until these are analyzed further, introduce a module parameter that makes it possible to easily disable it. Link: https://lore.kernel.org/all/85548beb-1486-40f9-beb4-632c78e3360b@proxmox.com/ Cc: David Riley Signed-off-by: Paolo Bonzini commit c0c70a11365cba7fba25a77463582bcec0f7846e Author: Dmitry Baryshkov Date: Tue May 5 03:24:58 2026 +0300 drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed because of the use of devm_kzalloc()), while the usersoace still can try interacting with the WB connector (which uses drmm_ functions). Change dpu_writeback_init() to use drmm_. Fixes: 0b37ac63fc9d ("drm/msm/dpu: use drmm_writeback_connector_init()") Reported-by: Christophe JAILLET Closes: https://lore.kernel.org/r/78c764b8-44cf-4db5-88e7-807a85954518@wanadoo.fr Signed-off-by: Dmitry Baryshkov Reviewed-by: John.Harrison@Igalia.com Patchwork: https://patchwork.freedesktop.org/patch/722656/ Link: https://lore.kernel.org/r/20260505-wb-drop-encoder-v5-1-42567b7c7af2@oss.qualcomm.com commit 5b49a46baa853b26dbefa65c6c75dd9ff69f63d4 Author: Dmitry Baryshkov Date: Tue Apr 28 20:21:38 2026 +0300 drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by io_offset. Later this adjusted address might be used for memory dumping. However the size that is used for memory dumping isn't adjusted to account for the io_offset, leading to the potential access to the unmapped region. Lower ctrl_size by the io_offset value to prevent access past the mapped area. msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P) msm_dsi_host_snapshot+0x4c/0x78 [msm] msm_dsi_snapshot+0x28/0x50 [msm] msm_disp_snapshot_capture_state+0x74/0x140 [msm] msm_disp_snapshot_state_sync+0x60/0x90 [msm] _msm_disp_snapshot_work+0x30/0x90 [msm] kthread_worker_fn+0xdc/0x460 kthread+0x120/0x140 Fixes: bac2c6a62ed9 ("drm/msm: get rid of msm_iomap_size") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/721747/ Link: https://lore.kernel.org/r/20260428-msm-fix-dsi-dump-v1-1-5d4cb5ccfac7@oss.qualcomm.com commit d03279f0d9fdbe6f6761f191a76093c395930018 Author: Mahadevan P Date: Tue Apr 28 17:14:25 2026 +0530 drm/msm/dpu: Fix Kaanapali CWB register configuration The Kaanapali DPU catalog defines kaanapali_cwb[] with the correct CWB base addresses for this platform (0x169200, 0x169600, 0x16a200, 0x16a600), but the dpu_kaanapali_cfg struct was mistakenly pointing to sm8650_cwb instead. The SM8650 CWB blocks sit at completely different offsets (0x66200, 0x66600, 0x7E200, 0x7E600), so using them on Kaanapali would program CWB registers at wrong addresses, corrupting unrelated hardware blocks and breaking writeback capture. Fix this by pointing .cwb to the correct kaanapali_cwb array. Fixes: 83fe2cd56b1d ("drm/msm/dpu: Add support for Kaanapali DPU") Signed-off-by: Mahadevan P Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/721444/ Link: https://lore.kernel.org/r/20260428-kaanapali_cwb-v1-1-51fdb2c65498@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 933430f1709b089a0bf0b23ef0f047014ef899e7 Author: Neil Armstrong Date: Tue Apr 14 17:14:30 2026 +0200 drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats The UV scanlines is calculated with (height + 1) / 2 unlike the Y scanlines, add back the correct scanlines calculation for UBWC YUV formats. Fixes: 2f3ff6ab8f5c ("drm/msm/dpu: use standard functions in _dpu_format_populate_plane_sizes_ubwc()") Fixes: ada4a19ed21c ("drm/msm/dpu: rewrite _dpu_format_populate_plane_sizes_ubwc()") Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/718309/ Link: https://lore.kernel.org/r/20260414-topic-sm8x50-msm-dpu1-formats-qc10c-v1-1-0b62325b9030@linaro.org Signed-off-by: Dmitry Baryshkov commit 795b19cbcf43414748261b9dcc783bebfbceb89a Author: Krzysztof Kozlowski Date: Sun Apr 5 16:34:01 2026 +0200 dt-bindings: display/msm: qcom,eliza-mdss: Correct DPU and DP ranges in example VBIF register range is 0x3000 long. DisplayPort block has few too short ranges and misses four more address spaces. Similarly first part of DSI space should be 0x300 long. No practical impact, except when existing code is being re-used in new contributions. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/716460/ Link: https://lore.kernel.org/r/20260405-dts-qcom-display-regs-v2-5-34f4024c65dc@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 399f7748789ced4d8bf6a3f9aa550d007283d005 Author: Krzysztof Kozlowski Date: Sun Apr 5 16:34:00 2026 +0200 dt-bindings: display/msm: sm8750-mdss: Correct DPU and DP ranges in example VBIF register range is 0x3000 long. DisplayPort block has few too short ranges and misses four more address spaces. No practical impact, except when existing code is being re-used in new contributions. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/716453/ Link: https://lore.kernel.org/r/20260405-dts-qcom-display-regs-v2-4-34f4024c65dc@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit bef8a15a6ee2b6c5940add7ef6bf61379905a783 Author: Krzysztof Kozlowski Date: Sun Apr 5 16:33:59 2026 +0200 dt-bindings: display/msm: sm8650: Correct VBIF range in example VBIF register range is 0x3000 long, so correct the example. No practical impact, except when existing code is being re-used in new contributions. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/716454/ Link: https://lore.kernel.org/r/20260405-dts-qcom-display-regs-v2-3-34f4024c65dc@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 557226acef41c0b651588dc9f8911ec950f39101 Author: Krzysztof Kozlowski Date: Sun Apr 5 16:33:58 2026 +0200 dt-bindings: display/msm: dp-controller: Allow DAI on SM8650 and others DisplayPort on Qualcomm SoCs like SM8650 and compatible SM8750 supports audio and there is already DTS having cells and sound-name-prefix. The "else:" clause for non-EDP and non-aux-bus cases already requires '#sound-dai-cells', so it should actually reference the dai-common.yaml for other properties, as pointed out by dtbs_check warnings like: sm8650-hdk-display-card-rear-camera-card.dtb: displayport-controller@af54000 (qcom,sm8650-dp): Unevaluated properties are not allowed ('sound-name-prefix' was unexpected) Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/716452/ Link: https://lore.kernel.org/r/20260405-dts-qcom-display-regs-v2-2-34f4024c65dc@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit cb6f19552b49be16db5d50d5d59c0ec2b5c38f13 Author: Krzysztof Kozlowski Date: Sun Apr 5 16:33:57 2026 +0200 dt-bindings: display/msm: dp-controller: Correct SM8650 IO range DP on Qualcomm SM8650 come with nine address ranges, so describe the remaining ones as optional to keep ABI backwards compatible. Driver also does not need them to operate correctly. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/716450/ Link: https://lore.kernel.org/r/20260405-dts-qcom-display-regs-v2-1-34f4024c65dc@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 5f7c7c63ffb1a187eb90c80864469db45f3bd2a8 Author: Yang Xiuwei Date: Wed May 13 17:43:03 2026 +0800 io_uring/rw: drop unused attr_type_mask from io_prep_rw_pi() io_prep_rw_pi() never used the attr_type_mask argument. Callers already validate sqe->attr_type_mask before invoking the helper (only IORING_RW_ATTR_FLAG_PI is supported today). Remove the dead parameter to avoid implying further interpretation happens here. Signed-off-by: Yang Xiuwei Link: https://patch.msgid.link/20260513094303.866533-1-yangxiuwei@kylinos.cn Signed-off-by: Jens Axboe commit 3812a9e84265a5cdd90d29fe8d97a023e91fb945 Author: Hardik Prakash Date: Tue May 12 13:01:38 2026 +0530 pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11 On Lenovo Yoga 7 14AGP11 (83TD), the WACF2200 touchscreen controller is wired via I2C2 (AMDI0010:02) with its interrupt on GPIO pin 157 (confirmed via ACPI _CRS GpioInt decode). After amd_gpio_irq_init() clears all GPIO interrupts at boot, pin 157 is never re-enabled, preventing the touchscreen from signalling the driver. Windows keeps GPIO 157 INTERRUPT_ENABLE (bit 11) and INTERRUPT_MASK (bit 12) set after initialisation. Add a DMI quirk to restore these bits after amd_gpio_irq_init() on this hardware. Assisted-by: Claude:claude-sonnet-4-6 Assisted-by: GPT-Codex:gpt-5.2-codex Signed-off-by: Hardik Prakash Acked-by: Andy Shevchenko Signed-off-by: Linus Walleij commit f5b2772d14884f4be9e718644f1203d4d0e6f0d6 Author: Niklas Söderlund Date: Sun May 10 12:30:17 2026 +0200 net: ethernet: ravb: Do not check URAM suspension when WoL is active When updating the driver to match latest datasheet to suspend access to URAM when suspending DMA transfers a corner-case was missed, URAM access will not be suspended if WoL is enabled. This lead to the error message (correctly) being triggered as URAM access is not suspended even tho it's requested as part of stopping DMA. Avoid checking if URAM access is suspended and printing the error message if WoL is enabled when we suspend the system, as we know it will not be. Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/all/CAMuHMdWnjV%3DHGE1o08zLhUfTgOSene5fYx1J5GG10mB%2BToq8qg@mail.gmail.com/ Fixes: 353d8e7989b6 ("net: ethernet: ravb: Suspend and resume the transmission flow") Signed-off-by: Niklas Söderlund Reviewed-by: Sai Krishna Tested-by: Geert Uytterhoeven Signed-off-by: Jakub Kicinski commit 3d042592ebd4c7e44974d556de0b727cb7db4dab Author: Chenguang Zhao Date: Mon May 11 09:43:43 2026 +0800 ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics ethnl_bitmap32_not_zero() should return true if some bit in [start, end) is set: - Fix inverted memchr_inv() sense: return true when the scan finds a non-zero byte, not when the middle words are all zero. - Return false for an empty interval (end <= start). - When end is 32-bit aligned, indices in [start, end) do not include any bits from map[end_word]; return false after earlier checks found no non-zero data. Fixes: 10b518d4e6dd ("ethtool: netlink bitset handling") Signed-off-by: Chenguang Zhao Signed-off-by: Jakub Kicinski commit 7bf563badd37cb796df5477d2b78bb64148a1268 Author: Xiang Mei Date: Sun May 10 15:26:40 2026 -0700 net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint The smc_msg_event tracepoint class, shared by smc_tx_sendmsg and smc_rx_recvmsg, unconditionally dereferences smc->conn.lnk: __string(name, smc->conn.lnk->ibname) conn->lnk is only set for SMC-R; for SMC-D it is NULL. Other code on these paths already handles this (e.g. !conn->lnk in SMC_STAT_RMB_TX_SIZE_SMALL()). With the tracepoint enabled, the first sendmsg()/recvmsg() on an SMC-D socket crashes: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [...] RIP: 0010:strlen+0x1e/0xa0 Call Trace: trace_event_raw_event_smc_msg_event (net/smc/smc_tracepoint.h:44) smc_rx_recvmsg (net/smc/smc_rx.c:515) smc_recvmsg (net/smc/af_smc.c:2859) __sys_recvfrom (net/socket.c:2315) __x64_sys_recvfrom (net/socket.c:2326) do_syscall_64 The faulting address 0x3e0 is offsetof(struct smc_link, ibname), confirming the NULL ->lnk deref. Enabling the tracepoint requires root, but the trigger itself is unprivileged: socket(AF_SMC, ...) has no capability check, and SMC-D negotiation needs no admin step on s390 or on x86 with the loopback ISM device loaded. Log an empty device name for SMC-D instead of dereferencing NULL. Fixes: aff3083f10bf ("net/smc: Introduce tracepoints for tx and rx msg") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Reviewed-by: Dust Li Reviewed-by: Sidraya Jayagond Signed-off-by: Jakub Kicinski commit a3fdd924d88c30b9f488636ce0e4696012cf5511 Author: Nicolò Coccia Date: Sun May 10 12:34:13 2026 -0400 net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS A logic flaw in __smc_setsockopt() allows a local unprivileged user to cause a Denial of Service (DoS) by holding the socket lock indefinitely. The function __smc_setsockopt() calls copy_from_sockptr() while holding lock_sock(sk). By passing a userfaultfd-monitored memory page (or FUSE-backed memory on systems where unprivileged userfaultfd is disabled) as the optval, an attacker can halt execution during the copy operation, keeping the lock held. Combined with asynchronous tear-down operations like shutdown(), this exhausts the kernel wq (kworkers) and triggers the hung task watchdog. [ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds. [ 240.123489] Call Trace: [ 240.123501] smc_shutdown+... [ 240.123512] lock_sock_nested+... This patch moves the user-space copy outside the lock_sock() critical section to prevent the issue. Fixes: a6a6fe27bab4 ("net/smc: Dynamic control handshake limitation by socket options") Signed-off-by: Nicolò Coccia Reviewed-by: Dust Li Tested-by: Dust Li Signed-off-by: Jakub Kicinski commit f9e2342046ef1560d35bcd4a4b1197648ffd151d Author: Wei Yang Date: Sat May 9 20:23:58 2026 +0800 net: atm: fix skb leak in sigd_send() default branch The default branch in sigd_send() calls sock_put() and returns -EINVAL without freeing the skb, while all other exit paths do so. Add the missing dev_kfree_skb() before sock_put() to fix the leak. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wei Yang Link: https://patch.msgid.link/20260509122358.1102997-1-albin_yang@163.com Signed-off-by: Jakub Kicinski commit e3adf69f8eb121a9128c2b0029efd050d3649153 Author: David Carlier Date: Sat May 9 22:50:46 2026 +0100 net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev->drv can become NULL while the phy_device is still attached to its net_device, namely after the PHY driver is unbound via sysfs: echo > /sys/bus/mdio_bus/drivers//unbind phy_remove() clears phydev->drv but doesn't call phy_detach(), so the phy_device stays in the link topology xarray and ethnl_req_get_phydev() still hands it back. ETHTOOL_MSG_PHY_GET then oopses on: rep_data->drvname = kstrdup(phydev->drv->name, GFP_KERNEL); drvname is already treated as optional by phy_reply_size(), phy_fill_reply() and phy_cleanup_data(), so just skip the allocation when there is no driver bound. Fixes: 9dd2ad5e92b9 ("net: ethtool: phy: Convert the PHY_GET command to generic phy dump") Cc: stable@vger.kernel.org # 6.13.x Signed-off-by: David Carlier Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/20260509215046.107157-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski commit 2c308cf34284420963607d677d576a2b4124d8bd Author: Zoran Ilievski Date: Mon May 11 08:40:02 2026 +0200 net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled The shutdown handler aq_pci_shutdown() unconditionally calls pci_wake_from_d3(pdev, false), clearing the PCI PME_En bit even when wake-on-LAN has been configured. While aq_nic_shutdown() correctly programs the NIC firmware via aq_nic_set_power() to listen for magic packets, the PCI subsystem will not propagate the resulting PME wake event from D3, so the system never wakes after poweroff. WOL from suspend (S3) is unaffected because aq_suspend_common() does not touch pci_wake_from_d3() and relies on the PM core's wake configuration via device_may_wakeup(). This affects all atlantic-supported NICs (AQC107/108/111/112/113); users have reported that WOL works if the atlantic driver is never loaded, but breaks once it has run its shutdown path. Pass the configured WOL state to pci_wake_from_d3() instead of a literal false, so the PCI PME_En bit is preserved when the user has armed WOL via ethtool. Fixes: 90869ddfefeb ("net: aquantia: Implement pci shutdown callback") Cc: stable@vger.kernel.org Signed-off-by: Zoran Ilievski Reviewed-by: Sukhdeep Singh Link: https://patch.msgid.link/20260511064002.1857-1-goodboy@rexbytes.com Signed-off-by: Jakub Kicinski commit cceb874eee46fe4b3d3c6c496f19125d9a3a9a8f Author: Tejun Heo Date: Mon May 11 13:18:23 2026 -1000 sched_ext: Defer sub_kset base put to scx_sched_free_rcu_work scx_sub_enable_workfn() pins parent->kobj before dropping scx_sched_lock, but that does not pin parent->sub_kset. Concurrent disable can kset_unregister and free sub_kset before scx_alloc_and_add_sched() dereferences it. Split sub_kset teardown: kobject_del() at disable keeps sysfs removal; defer kobject_put() to scx_sched_free_rcu_work so the memory survives. A racing child sees state_in_sysfs=0 with valid memory, sysfs_create_dir() fails, and the existing exit_kind gate in scx_link_sched() turns it away with -ENOENT. Fixes: 411d3ef1a705 ("sched_ext: Unregister sub_kset on scheduler disable") Signed-off-by: Tejun Heo commit b273b75b8d677aea06dd06d80b61b3bb06e94680 Author: Tejun Heo Date: Mon May 11 13:18:19 2026 -1000 sched_ext: INIT_LIST_HEAD() &sch->all in scx_alloc_and_add_sched() On scx_link_sched() error paths (parent disabled, hash insert failure), &sch->all is never added to scx_sched_all. The cleanup path runs scx_unlink_sched() unconditionally, which calls list_del_rcu(&sch->all) on a list_head that was never initialized triggering a corruption warning. Initialize &sch->all. Fixes: 54be8de4236a ("sched_ext: Factor out scx_link_sched() and scx_unlink_sched()") Signed-off-by: Tejun Heo commit ef7e0c51d9c4b029d2f9b20bee1a94ba1b3356d5 Merge: 3098c076c83ea2 0cfe660559e857 Author: Paolo Bonzini Date: Tue May 12 23:15:29 2026 +0200 Merge tag 'kvm-s390-master-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: pci: fix array indexing For large amounts of PCI devices its possible to overrun the arrays as the index was miscalculated in 2 places. commit 39e25a2100604320e8d9df54c6c31258f7a3df29 Author: Tejun Heo Date: Tue May 12 10:30:00 2026 -1000 sched_ext: Drop NONE early return in scx_disable_and_exit_task() d3e73a0808dd ("sched_ext: Handle SCX_TASK_NONE in disable/switched_from paths") skipped the trailing scx_set_task_sched(p, NULL) on NONE tasks. After scx_fail_parent() parks a task at NONE/sched=parent and the parent is later freed via queue_rcu_work() during root_disable, the preserved p->scx.sched dangles - print_scx_info() from sched_show_task() reads sch->ops.name from freed memory. Drop the early return. __scx_disable_and_exit_task() already short- circuits on NONE and the SUB_INIT block was cleared by scx_fail_parent()'s earlier call, so clearing p->scx.sched is the only work left - and the one thing the path actually needs. v2: Extend the SUB_INIT block comment to note that the flag is only set on the sub-enable path, so it's always clear on the NONE re-entry (Andrea). Fixes: d3e73a0808dd ("sched_ext: Handle SCX_TASK_NONE in disable/switched_from paths") Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 3098c076c83ea2913245cb915cdcba98eb24214c Author: Sean Christopherson Date: Wed May 6 14:35:14 2026 -0700 KVM: x86: Swap the dst and src operand for MOVNTDQA Swap the MOVNTDQA operands, as MOVNTDQA does NOT in fact have "the same characteristics as 0F E7 (MOVNTDQ)"; MOVNTDQA loads from memory and stores to registers, while MOVNTDQ loads from registers and stores to memory. Per the SDM: MOVNTDQ - Move packed integer values in xmm1 to m128 using non-temporal hint. MOVNTDQA - Move double quadword from m128 to xmm1 using non-temporal hint if WC memory type. Reported-by: Josh Eads Fixes: c57d9bafbd0b ("KVM: x86: Add support for emulating MOVNTDQA") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-ID: <20260506213514.2781948-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 6b72d0578ca6f77b835d773d7c77c2f872d3e924 Author: Paolo Bonzini Date: Sun May 3 23:09:17 2026 +0200 KVM: x86: use again the flush argument of __link_shadow_page() Except in the case of parentless nested-TDP pages, mmu_page_zap_pte() clears the SPTE but leaves the invalid_list empty. In this case, using kvm_flush_remote_tlbs() as kvm_mmu_remote_flush_or_zap() does is overkill. Avoid flushing the entirety of the remote TLBs unless the invalid_list was populated: instead, use a more efficient gfn-targeting flush (if available) and skip it altogether if the caller guarantees that a TLB flush is not necessary. Based-on: <20260503201029.106481-1-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini Message-ID: <20260503210917.121840-1-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini commit 4b15b03166cc5d28e9912287b1f9b6607c8710ec Author: Val Packett Date: Wed Mar 11 21:53:37 2026 -0300 arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins i2c20 is used by the battmgr service on the ADSP to communicate with the SBS interface of the battery. Initializing it from Linux would break the battmgr functionality when booted in EL2. Mark those pins as reserved. Fixes: e7733b42111c ("arm64: dts: qcom: Add support for Dell Inspiron 7441 / Latitude 7455") Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Signed-off-by: Val Packett Link: https://lore.kernel.org/r/20260312005731.12488-2-val@packett.cool Signed-off-by: Bjorn Andersson commit 87c810160ed738cd983e4a65ebe9709927c702c9 Author: Sean Christopherson Date: Tue May 12 08:56:34 2026 -0700 KVM: selftests: Ensure gmem file sizes are multiple of host page size When creating a guest_memfd file and associated memslot to validate shared guest memory, size the file+memslot to the maximum of the host or guest page size. Attempting to allocate a single guest page will fail if the host page size is greater than the guest page size, as KVM requires that the size of memslots and guest_memfd files are a multiple of the host page size. For simplicity, verify the entire file can be shared between guest and host, e.g. instead of trying to validate "partial" mappings. Fixes: 42188667be38 ("KVM: selftests: Add guest_memfd testcase to fault-in on !mmap()'d memory") Reported-by: Zenghui Yu Closes: https://lore.kernel.org/all/0064952b-048c-455d-ad89-e27e5cb82591@linux.dev Signed-off-by: Sean Christopherson Message-ID: <20260512155634.772602-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 4a9ee4fc795389d6919d52a0cce490f9712e4f8c Merge: 80f4a7b8ce7513 effc0a39b8e0f3 Author: Paolo Bonzini Date: Tue May 12 22:19:20 2026 +0200 Merge tag 'kvmarm-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.1, take #2 - Add the pKVM side of the workaround for ARM's erratum 4193714, provided that the EL3 firmware does its part of the job. KVM will refuse to initialise otherwise. - Correctly handle 52bit VAs for guest EL2 stage-1 translations when running under NV with E2H==0. - Correctly deal with permission faults in guest_memfd memslots. - Fix the steal-time selftest after the infrastructure was reworked. - Make sure the host cannot pass a non-sensical clock update to the EL2 tracing infrastructure. - Appoint Steffen Eiden as a reviewer in anticipation of the KVM/s390 ability to run arm64 guests, which will inevitably lead to arm64 code being directly used on s390. - Make sure that EL2 is configured with both exception entry and exit being Context Synchronization Events. - Handle the current vcpu being NULL on EL2 panic. - Fix the selftest_vcpu memcache being empty at the point of donation or sharing. - Check that the memcache has enough capacity before engaging on the share/donate path. - Fix __deactivate_fgt() to use its parameter rather than a variable in the macro context. commit 80f4a7b8ce7513c203562191426e4d4cc635b095 Author: Ninad Naik Date: Mon May 11 23:13:02 2026 +0530 Documentation: kvm: update links in the references section of AMD Memory Encryption Replace non-working links in the reference section with the working ones. Signed-off-by: Ninad Naik Link: https://patch.msgid.link/20260511174302.811918-1-ninadnaik07@gmail.com/ Reviewed-by: Liam Merwick Signed-off-by: Paolo Bonzini commit 5bd1ddb7911ba7e94b61cf429970963f1b22dd76 Author: Sean Christopherson Date: Fri May 8 14:33:21 2026 -0700 KVM: nSVM: Never use L0's PAUSE loop exiting while L2 is running Never use L0's (KVM's) PAUSE loop exiting controls while L2 is running, and instead always configure vmcb02 according to L1's exact capabilities and desires. The purpose of intercepting PAUSE after N attempts is to detect when the vCPU may be stuck waiting on a lock, so that KVM can schedule in a different vCPU that may be holding said lock. Barring a very interesting setup, L1 and L2 do not share locks, and it's extremely unlikely that an L1 vCPU would hold a spinlock while running L2. I.e. having a vCPU executing in L1 yield to a vCPU running in L2 will not allow the L1 vCPU to make forward progress, and vice versa. While teaching KVM's "on spin" logic to only yield to other vCPUs in L2 is doable, in all likelihood it would do more harm than good for most setups. KVM has limited visibility into which L2 "vCPUs" belong to the same VM, and thus share a locking domain. And even if L2 vCPUs are in the same VM, KVM has no visilibity into L2 vCPU's that are scheduled out by the L1 hypervisor. Furthermore, KVM doesn't actually steal PAUSE exits from L1. If L1 is intercepting PAUSE, KVM will route PAUSE exits to L1, not L0, as nested_svm_intercept() gives priority to the vmcb12 intercept. As such, overriding the count/threshold fields in vmcb02 with vmcb01's values is nonsensical, as doing so clobbers all the training/learning that has been done in L1. Even worse, if L1 is not intercepting PAUSE, i.e. KVM is handling PAUSE exits, then KVM will adjust the PLE knobs based on L2 behavior, which could very well be detrimental to L1, e.g. due to essentially poisoning L1 PLE training with bad data. And copying the count from vmcb02 to vmcb01 on a nested VM-Exit makes even less sense, because again, the purpose of PLE is to detect spinning vCPUs. Whether or not a vCPU is spinning in L2 at the time of a nested VM-Exit has no relevance as to the behavior of the vCPU when it executes in L1. The only scenarios where any of this actually works is if at least one of KVM or L1 is NOT intercepting PAUSE for the guest. Per the original changelog, those were the only scenarios considered to be supported. Disabling KVM's use of PLE makes it so the VM is always in a "supported" mode. Last, but certainly not least, using KVM's count/threshold instead of the values provided by L1 is a blatant violation of the SVM architecture. Fixes: 74fd41ed16fd ("KVM: x86: nSVM: support PAUSE filtering when L0 doesn't intercept PAUSE") Cc: Maxim Levitsky Tested-by: David Kaplan Signed-off-by: Sean Christopherson Link: https://patch.msgid.link/20260508213321.373309-1-seanjc@google.com/ Signed-off-by: Paolo Bonzini commit 2b72f1674e427c56e3772c5ccf785fdda2138820 Author: Qiang Ma Date: Tue May 12 09:53:13 2026 +0800 KVM: x86: Fix Xen hypercall tracepoint argument assignment TRACE_EVENT(kvm_xen_hypercall) stores a5 in __entry->a4 instead of __entry->a5. That overwrites the recorded a4 argument and leaves a5 unset in the trace entry. Fix the typo so both arguments are captured correctly. Signed-off-by: Qiang Ma Link: https://patch.msgid.link/20260512015313.1685784-1-maqianga@uniontech.com/ Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit 577a8d3bae0531f0e5ccfac919cd8192f920a804 Author: Aaron Sacks Date: Tue May 12 02:07:42 2026 -0400 KVM: Reject wrapped offset in kvm_reset_dirty_gfn() kvm_reset_dirty_gfn() guards the gfn range with if (!memslot || (offset + __fls(mask)) >= memslot->npages) return; but offset is u64 and the addition is unchecked. The check can be silently bypassed by a u64 wrap. The dirty ring backing those entries is MAP_SHARED at KVM_DIRTY_LOG_PAGE_OFFSET of the vcpu fd, so the VMM can rewrite the slot and offset fields of any entry between when the kernel pushes them and when KVM_RESET_DIRTY_RINGS consumes them. On reset, kvm_dirty_ring_reset() re-reads the values via READ_ONCE() and feeds them straight back into this check; only the flags handshake is treated as the handover, the slot/offset payload is taken on trust. Crafting two entries entry[i].offset = 0xffffffffffffffc1 entry[i+1].offset = 0 makes the coalescing loop in kvm_dirty_ring_reset() compute delta = (s64)(0 - 0xffffffffffffffc1) = 63 which falls in [0, BITS_PER_LONG), so it folds entry[i+1] into the existing mask by setting bit 63. The trailing kvm_reset_dirty_gfn() call then sees offset = 0xffffffffffffffc1 and __fls(mask) = 63; the sum is 0 in u64 and the bounds check passes. That offset propagates into kvm_arch_mmu_enable_log_dirty_pt_masked() unchanged. On the legacy MMU path -- kvm_memslots_have_rmaps() == true, i.e. shadow paging, any VM that has allocated shadow roots, or a write-tracked slot -- it reaches gfn_to_rmap(), which indexes slot->arch.rmap[0][] with a near-U64_MAX gfn. That is an out-of-bounds load of a kvm_rmap_head, followed by a conditional clear of PT_WRITABLE_MASK in whatever the loaded pointer points at. The path is reachable from any process holding /dev/kvm. Range-check offset on its own first, so the addition cannot wrap. memslot->npages is bounded well below U64_MAX, so once offset < npages holds, offset + __fls(mask) (with __fls(mask) < BITS_PER_LONG) stays in range. Fixes: fb04a1eddb1a ("KVM: X86: Implement ring-based dirty memory tracking") Cc: stable@vger.kernel.org Signed-off-by: Aaron Sacks Link: https://patch.msgid.link/20260512060742.1628959-1-contact@xchglabs.com/ Signed-off-by: Paolo Bonzini commit f9e1c1324b4d98d591a6f7568fdebf5cf456dfc2 Author: Sergio Correia Date: Tue May 12 14:28:59 2026 +0100 audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV AUDIT_ADD_RULE and AUDIT_DEL_RULE correctly check for AUDIT_LOCKED and return -EPERM, but AUDIT_TRIM and AUDIT_MAKE_EQUIV do not. This allows a process with CAP_AUDIT_CONTROL to modify directory tree watches and equivalence mappings even when the audit configuration has been locked, undermining the purpose of the lock. Add AUDIT_LOCKED checks to both commands. Cc: stable@vger.kernel.org Reviewed-by: Ricardo Robaina Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Sergio Correia Signed-off-by: Paul Moore commit e4a640475e43f406fdfd56d370b1f34b0cbbc18d Author: Sergio Correia Date: Tue May 12 14:28:33 2026 +0100 audit: fix incorrect inheritable capability in CAPSET records __audit_log_capset() records the effective capability set into the inheritable field due to a copy-paste error. Every CAPSET audit record therefore reports cap_pi (process inheritable) with the value of cap_effective instead of cap_inheritable. This silently corrupts audit data used for compliance and forensic analysis: an attacker who modifies inheritable capabilities to prepare for a privilege-escalating exec would have the change masked in the audit trail. The bug has been present since the original introduction of CAPSET audit records in 2008. Cc: stable@vger.kernel.org Fixes: e68b75a027bb ("When the capset syscall is used it is not possible for audit to record the actual capbilities being added/removed. This patch adds a new record type which emits the target pid and the eff, inh, and perm cap sets.") Reviewed-by: Ricardo Robaina Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Sergio Correia Signed-off-by: Paul Moore commit 28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf Author: Raphael Zimmer Date: Tue May 12 18:16:40 2026 +0200 libceph: Fix potential null-ptr-deref in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an array of max_buckets CRUSH buckets is decoded, where some indices may not refer to actual buckets and are therefore set to NULL. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). When decoding a crush_choose_arg_map, a series of choose_args for different buckets is decoded, with the bucket_index being read from the incoming message. It is only checked that the bucket index does not exceed max_buckets, but not that it doesn't point to an index with a NULL bucket. If a (potentially corrupted) message contains a crush_choose_arg_map including such a bucket_index, a null pointer dereference may occur in the subsequent processing when attempting to access the bucket with the given index. This patch fixes the issue by extending the affected check. Now, it is only attempted to access the bucket if it is not NULL. Cc: stable@vger.kernel.org Signed-off-by: Raphael Zimmer Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit d289478cfc0bcf81c7914200d6abdcb78bd04ded Author: Raphael Zimmer Date: Tue May 12 09:29:30 2026 +0200 libceph: handle rbtree insertion error in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). In this function, num_choose_arg_maps is read from the message, and a corresponding number of crush_choose_arg_maps gets decoded afterwards. Each crush_choose_arg_map has a choose_args_index, which serves as the key when inserting it into the choose_args rbtree of the decoded crush_map. If a (potentially corrupted) message contains two crush_choose_arg_maps with the same index, the assertion in insert_choose_arg_map() triggers a kernel BUG when trying to insert the second crush_choose_arg_map. This patch fixes the issue by switching to the non-asserting rbtree insertion function and rejecting the message if the insertion fails. [ idryomov: changelog ] Cc: stable@vger.kernel.org Signed-off-by: Raphael Zimmer Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit f06035ab324e52a845079c2e5f2380fa3cebde9b Author: Rafael J. Wysocki Date: Mon May 11 21:56:14 2026 +0200 hwmon: (asus_atk0110) Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_HANDLE() check against NULL to the asus_atk0110 hwmon driver. Fixes: ee1752590733 ("hwmon: (asus_atk0110) Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/2261594.irdbgypaU6@rafael.j.wysocki Signed-off-by: Guenter Roeck commit 793d2a057f7e7bc647c5401413f7bf7d4f08b969 Author: Rafael J. Wysocki Date: Mon May 11 21:54:51 2026 +0200 hwmon: (acpi_power_meter) Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the acpi_power_meter hwmon driver. Fixes: afc6c4aedea5 ("hwmon: (acpi_power_meter) Convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/5068745.GXAFRqVoOG@rafael.j.wysocki Signed-off-by: Guenter Roeck commit 6f89d96fff65aec1ff12bc566fca0eb1bb59e16e Author: Rafael J. Wysocki Date: Tue May 12 18:26:54 2026 +0200 Input: atlas - check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the atlas_btns driver. Fixes: b8303880b641 ("Input: atlas - convert ACPI driver to a platform one") Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/8696590.T7Z3S40VBb@rafael.j.wysocki Signed-off-by: Dmitry Torokhov commit 1d5dcaa3bd65f2e8c9baa14a393d3a2dc5db7524 Merge: c21b90f7768707 657b594b2084b3 Author: Linus Torvalds Date: Tue May 12 10:18:02 2026 -0700 Merge tag 'probes-fixes-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fixes from Masami Hiramatsu: - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() Since the ftrace adds its NOPs at .kprobes.text section (which stores an array), a wrong entry is added when loading a module which uses "__kprobes" attribute. To solve this, add "notrace" to __kprobes functions - test_kprobes: clear kprobes between test runs Clear all kprobes in the test program after running a test set, because Kunit test can run several times - fprobe: Fix unregister_fprobe() to wait for RCU grace period Since the fprobe data structure is removed with hlist_del_rcu(), it should wait for the RCU grace period. If the caller waits for RCU, we can use the async variant (e.g. eBPF) * tag 'probes-fixes-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: fprobe: Fix unregister_fprobe() to wait for RCU grace period test_kprobes: clear kprobes between test runs kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() commit 4bf85afb9f3ecd7c3b5d15a85b0902f8e725cd06 Author: Willy Tarreau Date: Sat May 9 11:47:55 2026 +0200 Documentation: security-bugs: clarify requirements for AI-assisted reports AI tools are increasingly used to assist in bug discovery. While these tools can identify valid issues, reports that are submitted without manual verification often lack context, contain speculative impact assessments, or include unnecessary formatting. Such reports increase triage effort, waste maintainers' time and may be ignored. Reports where the reporter has verified the issue and the proposed fix typically meet quality standards. This documentation outlines specific requirements for length, formatting, and impact evaluation to reduce the effort needed to deal with these reports. Cc: Greg KH Acked-by: Greg Kroah-Hartman Reviewed-by: Leon Romanovsky Signed-off-by: Willy Tarreau Signed-off-by: Jonathan Corbet Message-ID: <20260509094755.2838-4-w@1wt.eu> commit a03ef333fbd6cd861c8457c3d055ee3643a9baad Author: Willy Tarreau Date: Sat May 9 11:47:54 2026 +0200 Documentation: security-bugs: explain what is and is not a security bug The use of automated tools to find bugs in random locations of the kernel induces a raise of security reports even if most of them should just be reported as regular bugs. This patch is an attempt at drawing a line between what qualifies as a security bug and what does not, hoping to improve the situation and ease decision on the reporter's side. It defers the enumeration to a new file, threat-model.rst, that tries to enumerate various classes of issues that are and are not security bugs. This should permit to more easily update this file for various subsystem-specific rules without having to revisit the security bug reporting guide. Cc: Greg KH Cc: Leon Romanovsky Suggested-by: Leon Romanovsky Suggested-by: Greg KH Reviewed-by: Leon Romanovsky Reviewed-by: Shuah Khan Signed-off-by: Willy Tarreau Reviewed-by: Greg Kroah-Hartman Signed-off-by: Jonathan Corbet Message-ID: <20260509094755.2838-3-w@1wt.eu> commit aed3c3346765e4317bb2ec6ff872e1c952e128ab Author: Willy Tarreau Date: Sat May 9 11:47:53 2026 +0200 Documentation: security-bugs: do not systematically Cc the security team With the increase of automated reports, the security team is dealing with way more messages than really needed. The reporting process works well with most teams so there is no need to systematically involve the security team in reports. Let's suggest to keep it for small lists of recipients and new reporters only. This should continue to cover the risk of lost messages while reducing the volume from prolific reporters. Cc: Greg KH Cc: Leon Romanovsky Reviewed-by: Leon Romanovsky Reviewed-by: Greg Kroah-Hartman Signed-off-by: Willy Tarreau Signed-off-by: Jonathan Corbet Message-ID: <20260509094755.2838-2-w@1wt.eu> commit b7cdd59de5ae8062d2cb0121c429a271eb70daec Author: Rafael J. Wysocki Date: Tue May 12 18:25:17 2026 +0200 ACPI: PAD: xen: Check ACPI_COMPANION() against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence. Accordingly, add a requisite ACPI_COMPANION() check against NULL to the Xen variant of the ACPI processor aggregator device (PAD) driver. Fixes: 112b2f978afe ("ACPI: PAD: xen: Convert to a platform driver") Signed-off-by: Rafael J. Wysocki Acked-by: Juergen Gross Link: https://patch.msgid.link/3427762.aeNJFYEL58@rafael.j.wysocki commit aa16b2bc0f02709919e2435f531406531e5bcc69 Author: Zack McKevitt Date: Thu Apr 30 12:39:01 2026 -0700 accel/qaic: Add overflow check to remap_pfn_range during mmap The call to remap_pfn_range in qaic_gem_object_mmap is susceptible to (re)mapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap() unmaps only the VMA region and not the additional mappings. To prevent this, check the remaining size of the VMA before remapping and truncate the remapped length if sg->length is too large. Reported-by: Lukas Maar Fixes: ff13be830333 ("accel/qaic: Add datapath") Reviewed-by: Karol Wachowski Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo [jhugo: fix braces from checkpatch --strict] Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20260430193858.1178641-1-zachary.mckevitt@oss.qualcomm.com commit 64ffa2e5e02ff54b23221d0282155f37283fabea Author: Alain Michaud Date: Tue May 12 13:22:44 2026 +0000 HID: logitech-hidpp: Add support for newer Bluetooth keyboards Add product IDs (PIDs) for several newer Logitech Bluetooth keyboards to the hidpp_devices matching table, enabling full HID++ support for them. The added keyboards are: - Logitech Signature K650 & B2B - Logitech Pebble Keys 2 K380S - Logitech Casa Pop-Up Desk & B2B - Logitech Wave Keys & B2B - Logitech Signature Slim K950 & B2B - Logitech MX Keys S & B2B - Logitech Keys-To-Go 2 - Logitech Pop Icon Keys - Logitech MX Keys Mini & B2B - Logitech Signature Slim Solar+ K980 B2B - Logitech Bluetooth Keyboard K250/K251 - Logitech Signature Comfort K880 & B2B Signed-off-by: Alain Michaud Reviewed-by: Olivier Gay Signed-off-by: Jiri Kosina commit 48d1677779ad6816978ad4a4f7588aec5ec960fe Author: Tomasz Pakuła Date: Sun May 10 14:23:52 2026 +0200 HID: pidff: Fix integer overflow in pidff_rescale Rescaling values close to the max (U16_MAX) temporarily creates values that exceed the s32 range. This caused value overflow in case when, for example, a periodic effect phase was higer than 180 degrees. In turn, rescale function could return values outised of the logical range of the HID field. Fix by using 64 bit signed integer to store the value during calculation but still return only 32 bit integer. Closes: https://github.com/JacKeTUs/universal-pidff/issues/116 Fixes: 224ee88fe395 ("Input: add force feedback driver for PID devices") Cc: stable@vger.kernel.org Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit a991aa5e89365ba1959fae6847fd288125b209e5 Author: Xu Rao Date: Sat May 9 16:21:32 2026 +0800 HID: i2c-hid: add reset quirk for BLTP7853 touchpad The BLTP7853 I2C HID touchpad may fail to probe after reboot or reprobe because reset completion is not signalled to the host. The driver then waits for the reset-complete interrupt until it times out and the device probe fails: i2c_hid i2c-BLTP7853:00: failed to reset device. i2c_hid i2c-BLTP7853:00: can't add hid device: -61 i2c_hid: probe of i2c-BLTP7853:00 failed with error -61 Add I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for the device so i2c-hid does not wait for a reset interrupt that may never arrive. Signed-off-by: Xu Rao Signed-off-by: Jiri Kosina commit 206342541fc887ae919774a43942dc883161fece Author: Benjamin Tissoires Date: Mon May 4 10:47:23 2026 +0200 HID: core: introduce hid_safe_input_report() hid_input_report() is used in too many places to have a commit that doesn't cross subsystem borders. Instead of changing the API, introduce a new one when things matters in the transport layers: - usbhid - i2chid This effectively revert to the old behavior for those two transport layers. Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 2c85c61d1332e1e16f020d76951baf167dcb6f7a Author: Benjamin Tissoires Date: Mon May 4 10:47:22 2026 +0200 HID: pass the buffer size to hid_report_raw_event commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()") enforced the provided data to be at least the size of the declared buffer in the report descriptor to prevent a buffer overflow. However, we can try to be smarter by providing both the buffer size and the data size, meaning that hid_report_raw_event() can make better decision whether we should plaining reject the buffer (buffer overflow attempt) or if we can safely memset it to 0 and pass it to the rest of the stack. Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires Acked-by: Johan Hovold Reviewed-by: Greg Kroah-Hartman Signed-off-by: Jiri Kosina commit b08665fe80fab0956e64741c07d9bbcec635c34d Author: Myeonghun Pak Date: Fri Apr 24 21:50:41 2026 +0900 HID: google: hammer: stop hardware on devres action failure hammer_probe() starts the HID hardware before registering the devres action that stops it. If devm_add_action() fails, probe returns an error with the hardware still started because the cleanup action was never registered and the driver's remove callback is not called after a failed probe. Use devm_add_action_or_reset() so the stop action runs immediately on registration failure while preserving the existing devres-managed cleanup path for later probe failures and remove. Signed-off-by: Myeonghun Pak Signed-off-by: Jiri Kosina commit 1654e53349d4e657b331de354313461f401f5063 Author: Sangyun Kim Date: Mon Apr 20 14:13:18 2026 +0900 HID: appletb-kbd: run inactivity autodim from workqueues The autodim code in hid-appletb-kbd takes backlight_device->ops_lock via backlight_device_set_brightness() -> mutex_lock() from two different atomic contexts: * appletb_inactivity_timer() is a struct timer_list callback, so it runs in softirq context. Every expiry triggers BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591 Call Trace: __might_resched __mutex_lock backlight_device_set_brightness appletb_inactivity_timer call_timer_fn run_timer_softirq * reset_inactivity_timer() is called from appletb_kbd_hid_event() and appletb_kbd_inp_event(). On real USB hardware these run in softirq/IRQ context (URB completion and input-event dispatch). When the Touch Bar has already been dimmed or turned off, the reset path calls backlight_device_set_brightness() directly to restore brightness, producing the same warning. Both call sites hit the same mutex_lock()-from-atomic bug. Fix them together by moving the blocking work onto the system workqueue: * Convert the inactivity timer from struct timer_list to struct delayed_work; the callback (appletb_inactivity_work) now runs in process context where mutex_lock() is legal. * Add a dedicated struct work_struct restore_brightness_work and have reset_inactivity_timer() schedule it instead of calling backlight_device_set_brightness() directly. Cancel both works synchronously during driver tear-down alongside the existing backlight reference drop. The semantics are unchanged (same delays, same state transitions on dim, turn-off and user activity); only the execution context of the sleeping call changes. The timer field and callback are renamed to match their new type; reset_inactivity_timer() keeps its name because it is invoked from input event paths that read naturally as "reset the inactivity timer". Fixes: 93a0fc489481 ("HID: hid-appletb-kbd: add support for automatic brightness control while using the touchbar") Cc: stable@vger.kernel.org Signed-off-by: Sangyun Kim Signed-off-by: Jiri Kosina commit 4db2af929279c799b5653a39eb0795c72baffca4 Author: Sangyun Kim Date: Mon Apr 20 14:13:17 2026 +0900 HID: appletb-kbd: fix UAF in inactivity-timer cleanup path Commit 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe") added timer_delete_sync(&kbd->inactivity_timer) to both the probe close_hw error path and appletb_kbd_remove(), but the way it was wired in left the inactivity timer reachable during driver tear-down via two distinct windows. Window A -- put_device() before timer_delete_sync(): put_device(&kbd->backlight_dev->dev); timer_delete_sync(&kbd->inactivity_timer); The inactivity_timer softirq reads kbd->backlight_dev and calls backlight_device_set_brightness() -> mutex_lock(&ops_lock). If a concurrent hid_appletb_bl unbind drops the last devm reference between these two calls, the backlight_device is freed and the mutex_lock() touches freed memory. Window B -- backlight cleanup before hid_hw_stop(): if (kbd->backlight_dev) { timer_delete_sync(...); put_device(...); } hid_hw_close(hdev); hid_hw_stop(hdev); Even after Window A is closed, hid_hw_close()/hid_hw_stop() still run afterwards, so a late ".event" callback from the HID core (USB URB completion on real Apple hardware) can arrive after timer_delete_sync() drained the softirq but before put_device() drops the reference. That callback reaches reset_inactivity_timer(), which calls mod_timer() and re-arms the timer. The freshly re-armed timer can then fire on the about-to-be-freed backlight_device. Both windows produce the same KASAN slab-use-after-free: BUG: KASAN: slab-use-after-free in __mutex_lock+0x1aab/0x21c0 Read of size 8 at addr ffff88803ee9a108 by task swapper/0/0 Call Trace: __mutex_lock backlight_device_set_brightness appletb_inactivity_timer call_timer_fn run_timer_softirq handle_softirqs Allocated by task N: devm_backlight_device_register appletb_bl_probe Freed by task M: (concurrent hid_appletb_bl unbind path) Close both windows at once by reworking the tear-down in appletb_kbd_remove() and in the probe close_hw error path so that 1) hid_hw_close()/hid_hw_stop() run before the backlight cleanup, guaranteeing no further .event callback can fire and re-arm the timer, and 2) inside the "if (kbd->backlight_dev)" block, timer_delete_sync() runs before put_device(), so the softirq is drained before the final reference is dropped. Fixes: 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe") Cc: stable@vger.kernel.org Signed-off-by: Sangyun Kim Signed-off-by: Jiri Kosina commit cac61b58a3b6340c52afa06bb15eac033158db2f Author: T.J. Mercier Date: Fri Apr 17 08:47:02 2026 -0700 HID: playstation: Clamp num_touch_reports A device would never lie about the number of touch reports would it? If it does the loop in dualshock4_parse_report will read off the end of the touch_reports array, up to about 2 KiB for the maximum number of 256 loop iteraions. The data that is read is emitted via evdev if the DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by clamping the num_touch_reports value provided by the device to the maximum size of the touch_reports array. Fixes: 752038248808 ("HID: playstation: add DualShock4 touchpad support.") Cc: stable@vger.kernel.org Reported-by: Xingyu Jin Signed-off-by: T.J. Mercier Signed-off-by: Jiri Kosina commit d93ba918a185aca2594da63e92fdc5495b559c0f Author: Lee Jones Date: Thu Apr 16 14:16:54 2026 +0100 HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID It is currently possible for a malicious or misconfigured USB device to cause an out-of-bounds (OOB) read when submitting reports using DOUBLE_REPORT_ID by specifying a large report length and providing a smaller one. Let's prevent that by comparing the specified report length with the actual size of the data read in from userspace. If the actual data length ends up being smaller than specified, we'll politely warn the user and prevent any further processing. Signed-off-by: Lee Jones Reviewed-by: Günther Noack Signed-off-by: Jiri Kosina commit f097d246677b03db814c5862f368cea341b76a00 Author: Florian Pradines Date: Sat May 9 09:45:17 2026 +0000 HID: mcp2221: fix OOB write in mcp2221_raw_event() mcp2221_raw_event() copies device-supplied data into mcp->rxbuf at offset rxbuf_idx without checking that the copy fits within the destination buffer. A device responding with up to 60 bytes to a small I2C/SMBus read can overflow the buffer. Add a rxbuf_size field to struct mcp2221, set it alongside rxbuf in mcp_i2c_smbus_read(), and check rxbuf_idx + data[3] <= rxbuf_size before the memcpy. Reported-by: Benoît Sevens Signed-off-by: Florian Pradines Signed-off-by: Jiri Kosina commit 11f152c0acaa924d93339000cb785d34e003aff5 Author: Thomas Huth Date: Tue Apr 21 16:27:01 2026 +0200 xen/arm: Replace __ASSEMBLY__ with __ASSEMBLER__ in interface.h While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize now on the __ASSEMBLER__ macro that is provided by the compilers. Signed-off-by: Thomas Huth Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20260421142701.548978-1-thuth@redhat.com> commit 8582792cf23b3d94674d4d838f7cde9a28d0fcaf Author: Sungwoo Kim Date: Tue May 12 01:09:29 2026 -0400 block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() pin_user_pages_fast() can partially succeed and return the number of pages that were actually pinned. However, the bio_integrity_map_user() does not handle this partial pinning. This leads to a general protection fault since bvec_from_pages() dereferences an unpinned page address, which is 0. To fix this, add a check to verify that all requested memory is pinned. If partial pinning occurs, unpin the memory and return -EFAULT. Kernel Oops: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 UID: 0 PID: 1061 Comm: nvme-passthroug Not tainted 7.0.0-11783-g90957f9314e8-dirty #16 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 RIP: 0010:bio_integrity_map_user.cold+0x1b0/0x9d6 Fixes: 492c5d455969 ("block: bio-integrity: directly map user buffers") Acked-by: Chao Shi Acked-by: Weidong Zhu Acked-by: Dave Tian Signed-off-by: Sungwoo Kim Tested-by: Shin'ichiro Kawasaki Link: https://github.com/linux-blktests/blktests/pull/244 Link: https://patch.msgid.link/20260512050929.541397-2-iam@sung-woo.kim Signed-off-by: Jens Axboe commit 5f90dcfa8dc32a488581b78e575cdd7808ba5c78 Author: Lukas Bulwahn Date: Thu Feb 5 09:11:31 2026 +0100 HID: quirks: really enable the intended work around for appledisplay Commit c7fabe4ad921 ("HID: quirks: work around VID/PID conflict for appledisplay") intends to add a quirk for kernels built with Apple Cinema Display support, but it refers to the non-existing config option CONFIG_APPLEDISPLAY, whereas the config option for Apple Cinema Display support is named CONFIG_USB_APPLEDISPLAY. Refer to the intended config option CONFIG_USB_APPLEDISPLAY in the ifdef directive. Fixes: c7fabe4ad921 ("HID: quirks: work around VID/PID conflict for appledisplay") Signed-off-by: Lukas Bulwahn Signed-off-by: Jiri Kosina commit 2c6e6a18a37b905cb584eb0dda3ae482162a81ca Author: Casey Chen Date: Mon May 11 15:22:30 2026 -0600 block: recompute nr_integrity_segments in blk_insert_cloned_request blk_insert_cloned_request() already recomputes nr_phys_segments against the bottom queue, because "the queue settings related to segment counting may differ from the original queue." The exact same reasoning applies to integrity segments: a stacked driver's underlying queue can have tighter virt_boundary_mask, seg_boundary_mask, or max_segment_size than the top queue, in which case blk_rq_count_integrity_sg() against the bottom queue produces a different count than the cached rq->nr_integrity_segments inherited from the source request by blk_rq_prep_clone(). When the cached count is lower than the bottom queue's actual count, blk_rq_map_integrity_sg() trips BUG_ON(segments > rq->nr_integrity_segments); on dispatch. The same families of stacked setups that motivated the existing nr_phys_segments recompute -- dm-multipath fanning out to nvme-rdma in particular -- can produce this. Mirror the nr_phys_segments handling: when the request carries integrity, recompute nr_integrity_segments against the bottom queue and reject the request if it exceeds the bottom queue's max_integrity_segments. blk_rq_count_integrity_sg() and queue_max_integrity_segments() are both already available via , which blk-mq.c includes. This closes a latent gap in the stacking contract and brings the integrity-segment accounting in line with the existing phys-segment accounting. Fixes: 76c313f658d2 ("blk-integrity: improved sg segment mapping") Signed-off-by: Casey Chen Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260511212230.27511-1-cachen@purestorage.com Signed-off-by: Jens Axboe commit 637ad3a56a3b889527d1dacea6fea2a8bd648140 Author: David Carlier Date: Mon May 11 22:51:51 2026 +0100 block: don't overwrite bip_vcnt in bio_integrity_copy_user() bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h read past the bip_vec[] flex array. On READ the read is in bounds but lands on a saved user bvec instead of the bounce. The line was added for split propagation, but bio_integrity_clone() doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER. Fixes: 3991657ae707 ("block: set bip_vcnt correctly") Signed-off-by: David Carlier Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260511215151.346228-1-devnexen@gmail.com Signed-off-by: Jens Axboe commit 17ee873dba04d05090dfc5b2b9e08cfc8e4f147f Author: Oliver Neukum Date: Tue Mar 3 10:48:54 2026 +0100 HID: hid-sjoy: race between init and usage The driver uses an initial IO to set the device to a default state. That initialization is currently being done after the device node has been created. That means that the single buffer used for output can be altered while IO is in progress. Move the intialization before announcement to user space. Fixes: fac733f029251 ("HID: force feedback support for SmartJoy PLUS PS2/USB adapter") Signed-off-by: Oliver Neukum Signed-off-by: Jiri Kosina commit 603ab5ea6482c723216b59cb733e8ba248619ee9 Author: Steve French Date: Mon May 11 21:55:23 2026 -0500 SMB3.1.1: add missing QUERY_DIR info levels New Infolevels for QUERY_DIR (and QUERY_INFO) levels 78 through 81 are now being used by Windows clients and were added to the documentation. Add defines for them (and correct some typos in documentation). See MS-SMB2 2.2.33 and MS-FSCC 2.4 Signed-off-by: Steve French commit 9988931df99cf5d68af360e1f23b9c674a0b1b4f Merge: 36a8d04a8293af ce372e869f9f49 Author: Paolo Abeni Date: Tue May 12 16:15:03 2026 +0200 Merge branch 'net-shaper-fix-various-minor-bugs' Jakub Kicinski says: ==================== net: shaper: fix various minor bugs Fix various minor bugs in the net shaper API. First 2 patches deal with ordering issues around inserting and publishing new shapers. Shapers are inserted "tentatively" and marked valid only after HW op succeeded, this used to be slightly racy. Only other patch of note is patch 8. We want to add a Netlink policy check on the handle ID. This necessitates patch 7. The rest are simple and self-explanatory. v1: https://lore.kernel.org/20260506000628.1501691-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20260510192904.3987113-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit ce372e869f9f492f3d5aa9a0ae75ed52c61d2d6f Author: Jakub Kicinski Date: Sun May 10 12:29:04 2026 -0700 net: shaper: reject QUEUE scope handle with missing id net_shaper_parse_handle() does not enforce that the user provides the handle ID. For NODE the ID defaults to UNSPEC for all other cases it defaults to 0. For NETDEV 0 is the only option. For QUEUE defaulting to 0 makes less intuitive sense. Specifically because the behavior should (IMHO) be the same for all cases where there may be more than one ID (QUEUE and NODE). We should either document this as intentional or reject. I picked the latter with no strong conviction. Fixes: 4b623f9f0f59 ("net-shapers: implement NL get operation") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-11-kuba@kernel.org Signed-off-by: Paolo Abeni commit b62b29e6de6711f5918940aa6ff2bbab6d6af502 Author: Jakub Kicinski Date: Sun May 10 12:29:03 2026 -0700 net: shaper: enforce singleton NETDEV scope with id 0 The NETDEV scope represents a singleton root shaper in the per-device hierarchy. All code assumes NETDEV shapers have id 0: net_shaper_default_parent() hardcodes parent->id = 0 when returning the NETDEV parent for QUEUE/NODE children, and the UAPI documentation describes NETDEV scope as "the main shaper" (singular, not plural). Make sure we reject non-0 IDs. Fixes: 4b623f9f0f59 ("net-shapers: implement NL get operation") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-10-kuba@kernel.org Signed-off-by: Paolo Abeni commit 8d5806c600fddb907ebe378f9c366d4b52ac3a39 Author: Jakub Kicinski Date: Sun May 10 12:29:02 2026 -0700 net: shaper: reject handle IDs exceeding internal bit-width net_shaper_parse_handle() reads the user-supplied handle ID via nla_get_u32(), accepting the full u32 range. However, the xarray key is built by net_shaper_handle_to_index() using FIELD_PREP(NET_SHAPER_ID_MASK, handle->id), where NET_SHAPER_ID_MASK is GENMASK(25, 0) - only 26 bits wide. FIELD_PREP silently masks off the upper bits at runtime. A user-supplied NODE id like 0x04000123 becomes id 0x123. Additionally, a user-supplied id equal to NET_SHAPER_ID_UNSPEC (0x03FFFFFF, which is NET_SHAPER_ID_MASK itself) would collide with the sentinel used internally by the group operation to signal "allocate a new NODE id". Reject user-supplied IDs >= NET_SHAPER_ID_MASK (i.e., >= 0x03FFFFFF) in the policy. Fixes: 4b623f9f0f59 ("net-shapers: implement NL get operation") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-9-kuba@kernel.org Signed-off-by: Paolo Abeni commit fbf5df34a4dbcd09d433dd4f0916bf9b2ddb16de Author: Jakub Kicinski Date: Sun May 10 12:29:01 2026 -0700 tools: ynl: add scope qualifier for definitions Using definitions in kernel policies is awkward right now. On one hand we want defines for max values and such. On the other we don't have a way of adding kernel-only defines. Adding unnecessary defines to uAPI is a bad idea, we won't be able to delete them. And when it comes to policy user space should just query it via the policy dump, not use hard coded defines. Add a "scope" property to definitions, which will let us tell the codegen that a definition is for kernel use only. Support following values: - uapi: render into the uAPI header (default, today's behavior) - kernel: render to kernel header only - user: same as kernel but for the user-side generated header Definitions may have a header property (definition is "external", provided by existing header). Extend the scope to headers, too. If definition has both scope and header properties we will only generate the includes in the right scope. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-8-kuba@kernel.org Signed-off-by: Paolo Abeni commit 0f9a857e34d0f8c018a3e4435c6f0e92e8d2f38c Author: Jakub Kicinski Date: Sun May 10 12:29:00 2026 -0700 net: shaper: fix undersized reply skb allocation in GROUP command net_shaper_group_send_reply() writes both the NET_SHAPER_A_IFINDEX attribute (via net_shaper_fill_binding()) and the nested NET_SHAPER_A_HANDLE attribute (via net_shaper_fill_handle()), but the reply skb at the call site in net_shaper_nl_group_doit() is allocated using net_shaper_handle_size(), which only accounts for the nested handle. The allocation is therefore short by nla_total_size(sizeof(u32)) (8 bytes) for the IFINDEX attribute. In practice the slab allocator rounds up the small allocation so the bug is latent, but the size accounting is wrong and could bite if the reply grew further. Introduce net_shaper_group_reply_size() that accounts for the full reply payload and use it both at the genlmsg_new() call site and in the defensive WARN_ONCE message. Fixes: 5d5d4700e75d ("net-shapers: implement NL group operation") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-7-kuba@kernel.org Signed-off-by: Paolo Abeni commit 8054f85b83f42a37d482fc77ea7c9ff06a9407d9 Author: Jakub Kicinski Date: Sun May 10 12:28:59 2026 -0700 net: shaper: set ret to -ENOMEM when genlmsg_new() fails in group_doit genlmsg_new() alloc failure path in net_shaper_nl_group_doit() forgets to set ret before jumping to error handling. Fixes: 5d5d4700e75d ("net-shapers: implement NL group operation") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-6-kuba@kernel.org Signed-off-by: Paolo Abeni commit 6e8ae9d805d4b9ecec49bb9e457d9bae0b21b540 Author: Jakub Kicinski Date: Sun May 10 12:28:58 2026 -0700 selftests: drv-net: add shaper test for duplicate leaves Add test exercising duplicate leaves. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-5-kuba@kernel.org Signed-off-by: Paolo Abeni commit a9a2fa1da619f276580b0d4c5d12efac89e8642b Author: Jakub Kicinski Date: Sun May 10 12:28:57 2026 -0700 net: shaper: reject duplicate leaves in GROUP request net_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in old_nodes[]. The cleanup loop double frees the parent. Of course the same parent may still be in old_nodes[] twice if we are moving multiple of its leaves. Note that this patch also implicitly fixes the fact that the i >= leaves_count path forgets to set ret. Fixes: 5d5d4700e75d ("net-shapers: implement NL group operation") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-4-kuba@kernel.org Signed-off-by: Paolo Abeni commit 235fb5376139c3419f2218349f1fa2f06f24f7ad Author: Jakub Kicinski Date: Sun May 10 12:28:56 2026 -0700 net: shaper: fix trivial ordering issue in net_shaper_commit() We should update the entry before we mark it as valid. Fixes: 93954b40f6a4 ("net-shapers: implement NL set and delete operations") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-3-kuba@kernel.org Signed-off-by: Paolo Abeni commit 7cee43fcb0c3f71441d2faaa8c2202b6a88b6bef Author: Jakub Kicinski Date: Sun May 10 12:28:55 2026 -0700 net: shaper: flip the polarity of the valid flag The usual way of inserting entries which are not yet fully ready into XArray is to have a VALID flag. The shaper code has a NOT_VALID flag. Since XArray code does not let us create entries with marks already set - the creation of entries is currently not atomic. Flip the polarity of the VALID flag. This closes the tiny race in net_shaper_pre_insert() of entries being created without the NOT_VALID flag. Fixes: 93954b40f6a4 ("net-shapers: implement NL set and delete operations") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit 54a5b38e4396530e5b2f12b54d3844e860ab6784 Author: Kang Yang Date: Tue Apr 28 14:17:37 2026 +0800 wifi: ath10k: skip WMI and beacon transmission when device is wedged In ath10k_wmi_cmd_send(), the current code detects ATH10K_STATE_WEDGED and sets ret to -ESHUTDOWN, but still proceeds to transmit pending beacons and calls ath10k_wmi_cmd_send_nowait(). This can lead to incorrect behavior, as WMI commands and beacons are still sent after the device has been marked as wedged, and the original -ESHUTDOWN return value may be overwritten by the result of the send path. The wedged state indicates the hardware is already unreliable, and no further interaction with firmware is expected or meaningful in this state. Fix this by skipping beacon transmission and the WMI send path entirely once ATH10K_STATE_WEDGED is detected, ensuring consistent return values and avoiding unnecessary firmware interaction. Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1 Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189 Fixes: c256a94d1b1b ("wifi: ath10k: shutdown driver when hardware is unreliable") Signed-off-by: Kang Yang Reviewed-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260428061737.37-1-kang.yang@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 7320d6eb861e9913193a7801834c661381756a79 Author: Nicolas Escande Date: Wed May 6 15:42:40 2026 +0200 wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() This is similar to what was fixed by previous patches. We have a call to ath11k_wmi_cmd_send() which does check the return value, but forgot to free the related skb on error. Fixes: b43310e44edc ("wifi: ath11k: factory test mode support") Signed-off-by: Nicolas Escande Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260506134240.2284016-4-nico.escande@gmail.com Signed-off-by: Jeff Johnson commit ebad0b48996fd4919c36bbcb07289d37d046de74 Author: Nicolas Escande Date: Wed May 6 15:42:39 2026 +0200 wifi: ath11k: fix error path leaks in some WMI calls This is the same pattern that was previously identified as problematic: direct 'return ath11k_wmi_cmd_send(...)' will leak the skb in the error path if it is not explicitly handled. Fixes: c417b247ba04 ("ath11k: implement hardware data filter") Fixes: 9cbd7fc9be82 ("ath11k: support MAC address randomization in scan") Fixes: ba9177fcef21 ("ath11k: Add basic WoW functionalities") Fixes: fec4b898f369 ("ath11k: Add WoW net-detect functionality") Fixes: c3c36bfe998b ("ath11k: support ARP and NS offload") Fixes: a16d9b50cfba ("ath11k: support GTK rekey offload") Fixes: 652f69ed9c1b ("ath11k: Add support for SAR") Fixes: 0f84a156aa3b ("ath11k: Handle keepalive during WoWLAN suspend and resume") Signed-off-by: Nicolas Escande Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260506134240.2284016-3-nico.escande@gmail.com Signed-off-by: Jeff Johnson commit 55dda532bbc261aef495e403c8900c5e2ab5fa34 Author: Nicolas Escande Date: Wed May 6 15:42:38 2026 +0200 wifi: ath11k: fix error path leaks in some WMI WOW calls Fix two instances where we used to directly return the result of ath11k_wmi_cmd_send(...). Because we did not check the return value, we also did not free the skb in the error path. Fixes: 79802b13a492 ("ath11k: implement WoW enable and wakeup commands") Signed-off-by: Nicolas Escande Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260506134240.2284016-2-nico.escande@gmail.com Signed-off-by: Jeff Johnson commit 36a8d04a8293afcb9304cf0cd3741f67698f2a1a Author: Ethan Nelson-Moore Date: Fri May 8 19:37:28 2026 -0700 net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference The legacy ARM board file for MACH_MX31ADS was removed in commit c93197b0041d ("ARM: imx: Remove i.MX31 board files"), but a reference to it remained in the cs89x0 driver. Drop this unused code. Signed-off-by: Ethan Nelson-Moore Fixes: c93197b0041d ("ARM: imx: Remove i.MX31 board files") Link: https://patch.msgid.link/20260509023732.42256-1-enelsonmoore@gmail.com Signed-off-by: Paolo Abeni commit 2cc8f499713bee5d8053772fe5ebdee980727a3a Merge: 93d809adc13001 ebd8ec2b309e3a Author: Paolo Abeni Date: Tue May 12 15:20:21 2026 +0200 Merge branch 'net-ethernet-cortina-fix-various-rx-bugs' Linus Walleij says: ==================== net: ethernet: cortina: Fix various RX bugs During review of a minor patch for a bug in the Cortina ethernet driver, Sashiko jumped in and pointed out a number of nasty bugs. This series hopefully fixes all of them. Signed-off-by: Linus Walleij ==================== Link: https://patch.msgid.link/20260509-gemini-ethernet-fixes-v1-0-6c5d20ddc35b@kernel.org Signed-off-by: Paolo Abeni commit ebd8ec2b309e3a447851b456ccaf8fb39f3661e7 Author: Linus Walleij Date: Sat May 9 00:13:38 2026 +0200 net: ethernet: cortina: Carry over frag counter The gmac_rx() NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmac_rx(), but the packet is not yet completely assembled in the SKB, yet the fragment counter frag_nr is reset to zero on the next invocation. Solve this by making the RX fragment counter a part of the port struct, and carry it over between invocations. Reset the fragment counter only right after calling napi_gro_frags(), on error (after calling napi_free_frags()) or if stopping the port. Reset it in some place where not strictly necessary just to emphasize what is going on. This was found by Sashiko during normal patch review. Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Link: https://sashiko.dev/#/patchset/20260505-gemini-ethernet-fix-v2-1-997c31d06079%40kernel.org Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260509-gemini-ethernet-fixes-v1-3-6c5d20ddc35b@kernel.org Signed-off-by: Paolo Abeni commit 06937db21ee311ed07eba47954447245041a982d Author: Linus Walleij Date: Sat May 9 00:13:37 2026 +0200 net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmac_rx() is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device is using both. Make the RX SKB a per-port variable and carry it over between invocations in the port struct instead. Zero the pointer once we call napi_gro_frags(), on error (after calling napi_free_frags()) or if the port is stopped. Zero it in some place where not strictly necessary just to emphasize what is going on. This was found by Sashiko during normal patch review. Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Link: https://sashiko.dev/#/patchset/20260505-gemini-ethernet-fix-v2-1-997c31d06079%40kernel.org Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260509-gemini-ethernet-fixes-v1-2-6c5d20ddc35b@kernel.org Signed-off-by: Paolo Abeni commit 2cb156213093a62b80cf40b1ec71738e93491971 Author: Linus Walleij Date: Sat May 9 00:13:36 2026 +0200 net: ethernet: cortina: No mapping is a dropped rx Increase stats.rx_dropped++ even if this is the first fragment (skb == NULL) so we are doing proper accounting. Fixes: b266bacba796 ("net: ethernet: cortina: Drop half-assembled SKB") Link: https://sashiko.dev/#/patchset/20260505-gemini-ethernet-fix-v2-1-997c31d06079%40kernel.org Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260509-gemini-ethernet-fixes-v1-1-6c5d20ddc35b@kernel.org Signed-off-by: Paolo Abeni commit 5e121a81667a83e9a01d62b429e340f5a4a84abc Author: Johan Hovold Date: Tue May 12 09:48:49 2026 +0200 spi: ep93xx: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error pointer on later probe errors or driver unbind. This issue was flagged by Sashiko when reviewing a devres allocation conversion patch. Fixes: e79e7c2df627 ("spi: ep93xx: add DT support for Cirrus EP93xx") Link: https://sashiko.dev/#/patchset/20260429091333.165363-1-johan%40kernel.org?part=10 Cc: stable@vger.kernel.org # 6.12 Cc: Nikita Shubin Signed-off-by: Johan Hovold Acked-by: Nikita Shubin Link: https://patch.msgid.link/20260512074849.915143-1-johan@kernel.org Signed-off-by: Mark Brown commit 45205929a3a3310e4978f4097d8ed4fca36b2c32 Merge: 859c199bb3a90e c0410adf3da6db Author: Christian Brauner Date: Tue May 12 14:42:38 2026 +0200 Merge patch series "netfs: Miscellaneous fixes" David Howells says: Here are the outstanding miscellaneous fixes for netfslib gathered together and with some fixes-to-fixes folded down and one rearrangement. Various Sashiko review comments[1][2][3][4][5] are addressed: (1) Fix subrequest cancellation cleanup in DIO read and single-read. (2) Fix missing locking around retry adding new subrequests. (3) Fix read and write result collection to use barriering correctly to access a request's subrequest lists without taking a lock. This adds list_add_tail_release() and list_first_entry_or_null_acquire() to appropriate incorporate barriering into some list functions. (4) Fix netfs_read_to_pagecache() to pause on subrequest I/O failure. (5) Fix the potential for 64-bit tearing on a 32-bit machine when reading netfs_inode->remote_i_size and ->zero_point by using much the same mechanism as is used for ->i_size. (6) Fix the calculation of zero_point in netfs_release_folio() to limit it to ->remote_i_size, not ->i_size. (7) Fix triggering of a VM_BUG_ON_FOLIO() in netfs_write_begin(). (8) Fix a potentially uninitialised error value in netfs_extract_user_iter(). (9) Fix error handling in netfs_extract_user_iter(). (10) Fix overrun checking in netfs_extract_user_iter(). (11) Fix netfs_invalidate_folio() to clear the folio dirty bit if all dirty data removed. (12) Defer the emission of trace_netfs_folio() in netfs_perform_write(). This allows the next patch to emit the correct traces. (13) Fix the handling of a partially failed copy (ie. EFAULT) into a streaming write folio. Also remove the netfs_folio if a streaming write folio is entirely overwritten. (14) Fix a potential deadlock in writethrough writing. (15) Fix netfs_read_gaps() to remove the netfs_folio from a filled folio. (16) Fix netfs_perform_write() to not disable streaming writes when writing to an fd that's open O_RDWR. (17) Fix an early put of the sink page used in netfs_read_gaps(), before the request has completed. (18) Fix request leak in netfs_write_begin() error handling. (19) Fix a potential UAF in netfs_unlock_abandoned_read_pages() due to trying to check index of each folio we're abandoning to see if that folio is actually owned by the caller (in which case, we're not actually allowed to dereference it). (20) Fix incorrect adjustment of dirty region when partially invalidating a streaming write folio. (21) Fix the handling of folio->private in netfs_perform_write() and the attached netfs_folio and/or group when a streaming write folio is modified. (22) Fix netfs_read_folio() to wait on writeback first (it holds the folio lock) otherwise we aren't allowed to look at the netfs_folio struct as that could be modified at any time by the writeback collector. (23) Fix write skipping in dir/symlink writepages. (24) Fix the locking used by afs_get_link(). [1] https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com [2] https://sashiko.dev/#/patchset/20260326104544.509518-1-dhowells%40redhat.com [3] https://sashiko.dev/#/patchset/20260425125426.3855807-1-dhowells%40redhat.com [4] https://sashiko.dev/#/patchset/20260427154639.180684-1-dhowells%40redhat.com [5] https://sashiko.dev/#/patchset/20260428131756.922303-1-dhowells%40redhat.com * patches from https://patch.msgid.link/20260512123404.719402-1-dhowells@redhat.com: (24 commits) afs: Fix the locking used by afs_get_link() netfs, afs: Fix write skipping in dir/link writepages netfs: Fix netfs_read_folio() to wait on writeback netfs: Fix folio->private handling in netfs_perform_write() netfs: Fix partial invalidation of streaming-write folio netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs: Fix leak of request in netfs_write_begin() error handling netfs: Fix early put of sink folio in netfs_read_gaps() netfs: Fix write streaming disablement if fd open O_RDWR netfs: Fix read-gaps to remove netfs_folio from filled folio netfs: Fix potential deadlock in write-through mode netfs: Fix streaming write being overwritten netfs: Defer the emission of trace_netfs_folio() netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone netfs: Fix overrun check in netfs_extract_user_iter() netfs: fix error handling in netfs_extract_user_iter() netfs: Fix potential uninitialised var in netfs_extract_user_iter() netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call netfs: Fix zeropoint update where i_size > remote_i_size netfs: Fix potential for tearing in ->remote_i_size and ->zero_point ... Link: https://patch.msgid.link/20260512123404.719402-1-dhowells@redhat.com Signed-off-by: Christian Brauner commit c0410adf3da6db46f3513411fcf95e63c2f1d1ad Author: David Howells Date: Tue May 12 13:34:01 2026 +0100 afs: Fix the locking used by afs_get_link() The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: (1) It doesn't do any locking around afs_read_single() to prevent races between multiple ->get_link() calls, thereby allowing the possibility of leaks. (2) It doesn't use RCU barriering when accessing the buffer pointers during RCU pathwalk. (3) It can race with another thread updating the contents of the symlink if a third party updated it on the server. Fix this by the following means: (0) Move symlink handling into its own file as this makes it more complicated. (1) Take the validate_lock around afs_read_single() to prevent races between multiple ->get_link() calls. (2) Keep a separate copy of the symlink contents with an rcu_head. This is always going to be a lot smaller than a page, so it can be kmalloc'd and save quite a bit of memory. It also needs a refcount for non-RCU pathwalk. (3) Split the symlink read and write-to-cache routines in afs from those for directories. (4) Discard the I/O buffer as soon as the write-to-cache completes as this is a full page (plus a folio_queue). (5) If there's no cache, discard the I/O buffer immediately after reading and copying if there is no cache. Fixes: eae9e78951bb ("afs: Use netfslib for symlinks, allowing them to be cached") Fixes: 6698c02d64b2 ("afs: Locally initialise the contents of a new symlink on creation") Closes: https://sashiko.dev/#/patchset/20260326104544.509518-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-25-dhowells@redhat.com cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 9871938f99cc6cb266a77265491660e2375271f5 Author: David Howells Date: Tue May 12 13:34:00 2026 +0100 netfs, afs: Fix write skipping in dir/link writepages Fix netfs_write_single() and afs_single_writepages() to better handle a write that would be skipped due to lock contention and WB_SYNC_NONE by returning 1 from netfs_write_single() if it skipped and making afs_single_writepages() skip also. If a skip occurs, the inode must be re-marked as the VFS may have cleared the mark. This is really only theoretical for directories in netfs_write_single() as the only path to that is through afs_single_writepages() that takes the ->validate_lock around it, thereby serialising it. Fixes: 6dd80936618c ("afs: Use netfslib for directories") Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-24-dhowells@redhat.com cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit ded0c6f1606061148c202825f7e53d711f9f84cf Author: David Howells Date: Tue May 12 13:33:59 2026 +0100 netfs: Fix netfs_read_folio() to wait on writeback Fix netfs_read_folio() to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever is attached to folio->private (folio->private may get cleaned up by the collector before it clears the writeback flag). Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-23-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit ccde2ac757c713535b224233a296de40efe5212d Author: David Howells Date: Tue May 12 13:33:58 2026 +0100 netfs: Fix folio->private handling in netfs_perform_write() Under some circumstances, netfs_perform_write() doesn't correctly manipulate folio->private between NULL, NETFS_FOLIO_COPY_TO_CACHE, pointing to a group and pointing to a netfs_folio struct, leading to potential multiple attachments of private data with associated folio ref leaks and also leaks of netfs_folio structs or netfs_group refs. Fix this by consolidating the place at which a folio is marked uptodate in one place and having that look at what's attached to folio->private and decide how to clean it up and then set the new group. Also, the content shouldn't be flushed if group is NULL, even if a group is specified in the netfs_group parameter, as that would be the case for a new folio. A filesystem should always specify netfs_group or never specify netfs_group. The Sashiko auto-review tool noted that it was theoretically possible that the fpos >= ctx->zero_point section might leak if it modified a streaming write folio. This is unlikely, but with a network filesystem, third party changes can happen. It also pointed out that __netfs_set_group() would leak if called multiple times on the same folio from the "whole folio modify section". Fixes: 8f52de0077ba ("netfs: Reduce number of conditional branches in netfs_perform_write()") Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-22-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 6d91acc7fb85d33ea58fca9b964a32a453937f4b Author: David Howells Date: Tue May 12 13:33:57 2026 +0100 netfs: Fix partial invalidation of streaming-write folio In netfs_invalidate_folio(), if the region of a partial invalidation overlaps the front (but not all) of a dirty write cached in a streaming write page (dirty, but not uptodate, with the dirty region tracked by a netfs_folio struct), the function modifies the dirty region - but incorrectly as it moves the region forward by setting the start to the start, not the end, of the invalidation region. Fix this by setting finfo->dirty_offset to the end of the invalidation region (iend). Fixes: cce6bfa6ca0e ("netfs: Fix trimming of streaming-write folios in netfs_inval_folio()") Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-21-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit dbe556972100fabb8e5a1b3d2163831ff07b1e8e Author: David Howells Date: Tue May 12 13:33:56 2026 +0100 netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no_unlock_folio so that it doesn't unlock a folio being read for netfs_perform_write() or netfs_write_begin(). However, given that netfs_unlock_abandoned_read_pages() is called _after_ NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->no_unlock_folio as ownership immediately reverts to the caller. Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfs_unlock_read_folio() where the same applies. Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-20-dhowells@redhat.com cc: Paulo Alcantara cc: Viacheslav Dubeyko cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 5046a34f0643441f05b0253ea64e1a3af87efe14 Author: David Howells Date: Tue May 12 13:33:55 2026 +0100 netfs: Fix leak of request in netfs_write_begin() error handling Fix netfs_write_begin() to not leak our ref on the request in the event that we get an error from netfs_wait_for_read(). Fixes: 4090b31422a6 ("netfs: Add a function to consolidate beginning a read") Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-19-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 3e5dd91b87a8b1450217b56a336bee315f40da7d Author: David Howells Date: Tue May 12 13:33:54 2026 +0100 netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to release the sink page it uses after waiting for the request to complete. The way the sink page is used is that an ITER_BVEC-class iterator is created that has the gaps from the target folio at either end, but has the sink page tiled over the middle so that a single read op can fill in both gaps. The bug was found by KASAN detecting a UAF on the generic/075 xfstest in the cifsd kernel thread that handles reception of data from the TCP socket: BUG: KASAN: use-after-free in _copy_to_iter+0x48a/0xa20 Write of size 885 at addr ffff888107f92000 by task cifsd/1285 CPU: 2 UID: 0 PID: 1285 Comm: cifsd Not tainted 7.0.0 #6 PREEMPT(lazy) Call Trace: dump_stack_lvl+0x5d/0x80 print_report+0x17f/0x4f1 kasan_report+0x100/0x1e0 kasan_check_range+0x10f/0x1e0 __asan_memcpy+0x3c/0x60 _copy_to_iter+0x48a/0xa20 __skb_datagram_iter+0x2c9/0x430 skb_copy_datagram_iter+0x6e/0x160 tcp_recvmsg_locked+0xce0/0x1130 tcp_recvmsg+0xeb/0x300 inet_recvmsg+0xcf/0x3a0 sock_recvmsg+0xea/0x100 cifs_readv_from_socket+0x3a6/0x4d0 [cifs] cifs_read_iter_from_socket+0xdd/0x130 [cifs] cifs_readv_receive+0xaad/0xb10 [cifs] cifs_demultiplex_thread+0x1148/0x1740 [cifs] kthread+0x1cf/0x210 Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Reported-by: Steve French Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-18-dhowells@redhat.com Reviewed-by: Paulo Alcantara (Red Hat) cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 70a7b9193bbbfceaab5974de66834c64ccc875dd Author: David Howells Date: Tue May 12 13:33:53 2026 +0100 netfs: Fix write streaming disablement if fd open O_RDWR In netfs_perform_write(), "write streaming" (the caching of dirty data in dirty but !uptodate folios) is performed to avoid the need to read data that is just going to get immediately overwritten. However, this is/will be disabled in three circumstances: if the fd is open O_RDWR, if fscache is in use (as we need to round out the blocks for DIO) or if content encryption is enabled (again for rounding out purposes). The idea behind disabling it if the fd is open O_RDWR is that we'd need to flush the write-streaming page before we could read the data, particularly through mmap. But netfs now fills in the gaps if ->read_folio() is called on the page, so that is unnecessary. Further, this doesn't actually work if a separate fd is open for reading. Fix this by removing the check for O_RDWR, thereby allowing streaming writes even when we might read. This caused a number of problems with the generic/522 xfstest, but those are now fixed. Fixes: c38f4e96e605 ("netfs: Provide func to copy data to pagecache for buffered write") Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-17-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit a41168aef634356a9b87ec44349e3c82835700a5 Author: David Howells Date: Tue May 12 13:33:52 2026 +0100 netfs: Fix read-gaps to remove netfs_folio from filled folio Fix netfs_read_gaps() to remove the netfs_folio record from the folio record before marking the folio uptodate if it successfully fills the gaps around the dirty data in a streaming write folio (dirty, but not uptodate). Found with: fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \ /xfstest.test/junk --replay-ops=junk.fsxops using the following as junk.fsxops: truncate 0x0 0x138b1 0x8b15d * write 0x507ee 0x10df7 0x927c0 write 0x19993 0x10e04 0x927c0 * mapwrite 0x66214 0x1a253 0x927c0 copy_range 0xb704 0x89b9 0x24429 0x79380 write 0x2402b 0x144a2 0x90660 * mapwrite 0x204d5 0x140a0 0x927c0 * copy_range 0x1f72c 0x137d0 0x7a906 0x927c0 * read 0 0x9157c 0x9157c on cifs with the default cache option. It shows folio 0x24 misbehaving if the FMODE_READ check is commented out in netfs_perform_write(): if (//(file->f_mode & FMODE_READ) || netfs_is_cache_enabled(ctx)) { and no fscache. This was initially found with the generic/522 xfstest. Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-16-dhowells@redhat.com Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit b6a4ae1634b3ad2aaa05222e53d36da532852faf Author: David Howells Date: Tue May 12 13:33:51 2026 +0100 netfs: Fix potential deadlock in write-through mode Fix netfs_advance_writethrough() to always unlock the supplied folio and to mark it dirty if it isn't yet written to the end. Unfortunately, it can't be marked for writeback until the folio is done with as that may cause a deadlock against mmapped reads and writes. Even though it has been marked dirty, premature writeback can't occur as the caller is holding both inode->i_rwsem (which will prevent concurrent truncation, fallocation, DIO and other writes) and ictx->wb_lock (which will cause flushing to wait and writeback to skip or wait). Note that this may be easier to deal with once the queuing of folios is split from the generation of subrequests. Fixes: 288ace2f57c9 ("netfs: New writeback implementation") Closes: https://sashiko.dev/#/patchset/20260427154639.180684-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-15-dhowells@redhat.com cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 7b4dcf1b9455a6e52ac7478b4057dbe10359576d Author: David Howells Date: Tue May 12 13:33:50 2026 +0100 netfs: Fix streaming write being overwritten In order to avoid reading whilst writing, netfslib will allow "streaming writes" in which dirty data is stored directly into folios without reading them first. Such folios are marked dirty but may not be marked uptodate. If a folio is entirely written by a streaming write, uptodate will be set, otherwise it will have a netfs_folio struct attached to ->private recording the dirty region. In the event that a partially written streaming write page is to be overwritten entirely by a single write(), netfs_perform_write() will try to copy over it, but doesn't discard the netfs_folio if it succeeds; further, it doesn't correctly handle a partial copy that overwrites some of the dirty data. Fix this by the following: (1) If the folio is successfully overwritten, free the netfs_folio struct before marking the page uptodate. (2) If the copy to the folio partially fails, but short of the dirty data, just ignore the copy. (3) If the copy partially fails and overwrites some of the dirty data, accept the copy, update the netfs_folio struct to record the new data. If the folio is now filled, free the netfs_folio and set uptodate, otherwise return a partial write. Found with: fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \ /xfstest.test/junk --replay-ops=junk.fsxops using the following as junk.fsxops: truncate 0x0 0 0x927c0 write 0x63fb8 0x53c8 0 copy_range 0xb704 0x19b9 0x24429 0x79380 write 0x2402b 0x144a2 0x90660 * write 0x204d5 0x140a0 0x927c0 * copy_range 0x1f72c 0x137d0 0x7a906 0x927c0 * read 0x00000 0x20000 0x9157c read 0x20000 0x20000 0x9157c read 0x40000 0x20000 0x9157c read 0x60000 0x20000 0x9157c read 0x7e1a0 0xcfb9 0x9157c on cifs with the default cache option. It shows folio 0x24 misbehaving if the FMODE_READ check is commented out in netfs_perform_write(): if (//(file->f_mode & FMODE_READ) || netfs_is_cache_enabled(ctx)) { and no fscache. This was initially found with the generic/522 xfstest. Fixes: 8f52de0077ba ("netfs: Reduce number of conditional branches in netfs_perform_write()") Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-14-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit daeb443b92817021c1234e8eded219e164b7c35d Author: David Howells Date: Tue May 12 13:33:49 2026 +0100 netfs: Defer the emission of trace_netfs_folio() Change netfs_perform_write() to keep the netfs_folio trace value in a variable and emit it later to make it easier to choose the value displayed. This is a prerequisite for a subsequent patch. Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-13-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 156ac2ec2ee77c44c4eb7439d6d165247ba12247 Author: David Howells Date: Tue May 12 13:33:48 2026 +0100 netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfs_folio struct hung off of folio->private indicating the dirty range. Subsequently truncating the file such that the dirty data in the folio is removed, but the first part of the folio theoretically remains will cause the netfs_folio struct to be discarded... but will leave the dirty flag set. If the folio is then read via mmap(), netfs_read_folio() will see that the page is dirty and jump to netfs_read_gaps() to fill in the missing bits. netfs_read_gaps(), however, expects there to be a netfs_folio struct present and can oops because truncate removed it. Fix this by calling folio_cancel_dirty() in netfs_invalidate_folio() in the event that all the dirty data in the folio is erased (as nfs does). Also add some tracepoints to log modifications to a dirty page. This can be reproduced with something like: dd if=/dev/zero of=/xfstest.test/foo bs=1M count=1 umount /xfstest.test mount /xfstest.test xfs_io -c "w 0xbbbf 0xf96c" \ -c "truncate 0xbbbf" \ -c "mmap -r 0xb000 0x11000" \ -c "mr 0xb000 0x11000" \ /xfstest.test/foo with fscaching disabled (otherwise streaming writes are suppressed) and a change to netfs_perform_write() to disallow streaming writes if the fd is open O_RDWR: if (//(file->f_mode & FMODE_READ) || <--- comment this out netfs_is_cache_enabled(ctx)) { It should be reproducible even without this change, but if prevents the above trivial xfs_io command from reproducing it. Note that the initial dd is important: the file must start out sufficiently large that the zero-point logic doesn't just clear the gaps because it knows there's nothing in the file to read yet. Unmounting and mounting is needed to clear the pagecache (there are other ways to do that that may also work). This was initially reproduced with the generic/522 xfstest on some patches that remove the FMODE_READ restriction. Fixes: 9ebff83e6481 ("netfs: Prep to use folio->private for write grouping and streaming write") Reported-by: Marc Dionne Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-12-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 0ef37eef83fad3542ee06db2940433ae1a92b39d Author: David Howells Date: Tue May 12 13:33:47 2026 +0100 netfs: Fix overrun check in netfs_extract_user_iter() Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills pages[], then those pages don't get included in the iterator constructed at the end of the function. If there was an overfill, memory corruption has already happened. Fixes: 85dd2c8ff368 ("netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator") Closes: https://sashiko.dev/#/patchset/20260427154639.180684-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-11-dhowells@redhat.com cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 0aad5704c6b4d14007d4eab15883e8524e4310f4 Author: Paulo Alcantara Date: Tue May 12 13:33:46 2026 +0100 netfs: fix error handling in netfs_extract_user_iter() In netfs_extract_user_iter(), if iov_iter_extract_pages() failed to extract user pages, bail out on -ENOMEM, otherwise return the error code only if @npages == 0, allowing short DIO reads and writes to be issued. This fixes mmapstress02 from LTP tests against CIFS. Fixes: 85dd2c8ff368 ("netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator") Reported-by: Xiaoli Feng Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-10-dhowells@redhat.com Cc: netfs@lists.linux.dev Cc: stable@vger.kernel.org Cc: linux-cifs@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 7e3d8db899d54af39fafb2eb3392b0cdae9973b5 Author: David Howells Date: Tue May 12 13:33:45 2026 +0100 netfs: Fix potential uninitialised var in netfs_extract_user_iter() In netfs_extract_user_iter(), if it's given a zero-length iterator, it will fall through the loop without setting ret, and so the error handling behaviour will be undefined, depending on whether ret happens to be negative. The value of ret then propagates back up the callstack. Fix this by presetting ret to 0. Fixes: 85dd2c8ff368 ("netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator") Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-9-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit dc7832d05deb4d632e8035e3299e31a3528fa0d0 Author: Viacheslav Dubeyko Date: Tue May 12 13:33:44 2026 +0100 netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call The multiple runs of generic/013 test-case is capable to reproduce a kernel BUG at mm/filemap.c:1504 with probability of 30%. while true; do sudo ./check generic/013 done [ 9849.452376] page: refcount:3 mapcount:0 mapping:00000000e58ff252 index:0x10781 pfn:0x1c322 [ 9849.452412] memcg:ffff8881a1915800 [ 9849.452417] aops:ceph_aops ino:1000058db9e dentry name(?):"f9XXXXXX" [ 9849.452432] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ 9849.452441] raw: 0017ffffc0000000 0000000000000000 dead000000000122 ffff88816110d248 [ 9849.452445] raw: 0000000000010781 0000000000000000 00000003ffffffff ffff8881a1915800 [ 9849.452447] page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio)) [ 9849.452474] ------------[ cut here ]------------ [ 9849.452476] kernel BUG at mm/filemap.c:1504! [ 9849.478635] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 9849.481772] CPU: 2 UID: 0 PID: 84223 Comm: fsstress Not tainted 7.0.0-rc1+ #18 PREEMPT(full) [ 9849.482881] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/1 0/2025 [ 9849.484539] RIP: 0010:folio_unlock+0x85/0xa0 [ 9849.485076] Code: 89 df 31 f6 e8 1c f3 ff ff 48 8b 5d f8 c9 31 c0 31 d2 31 f6 31 ff c3 cc cc cc cc 48 c7 c6 80 6c d9 a7 48 89 df e8 4b b3 10 00 <0f> 0b 48 89 df e8 21 e6 2c 00 eb 9d 0f 1f 40 00 66 66 2e 0f 1f 84 [ 9849.493818] RSP: 0018:ffff8881bb8076b0 EFLAGS: 00010246 [ 9849.495740] RAX: 0000000000000000 RBX: ffffea00070c8980 RCX: 0000000000000000 [ 9849.498678] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 9849.500559] RBP: ffff8881bb8076b8 R08: 0000000000000000 R09: 0000000000000000 [ 9849.501097] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000010782000 [ 9849.502108] R13: ffff8881935de738 R14: ffff88816110d010 R15: 0000000000001000 [ 9849.502516] FS: 00007e36cbe94740(0000) GS:ffff88824a899000(0000) knlGS:0000000000000000 [ 9849.502996] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9849.503810] CR2: 000000c0002b0000 CR3: 000000011bbf6004 CR4: 0000000000772ef0 [ 9849.504459] PKRU: 55555554 [ 9849.504626] Call Trace: [ 9849.505242] [ 9849.505379] netfs_write_begin+0x7c8/0x10a0 [ 9849.505877] ? __kasan_check_read+0x11/0x20 [ 9849.506384] ? __pfx_netfs_write_begin+0x10/0x10 [ 9849.507178] ceph_write_begin+0x8c/0x1c0 [ 9849.507934] generic_perform_write+0x391/0x8f0 [ 9849.508503] ? __pfx_generic_perform_write+0x10/0x10 [ 9849.509062] ? file_update_time_flags+0x19a/0x4b0 [ 9849.509581] ? ceph_get_caps+0x63/0xf0 [ 9849.510259] ? ceph_get_caps+0x63/0xf0 [ 9849.510530] ceph_write_iter+0xe79/0x1ae0 [ 9849.511282] ? __pfx_ceph_write_iter+0x10/0x10 [ 9849.511839] ? lock_acquire+0x1ad/0x310 [ 9849.512334] ? ksys_write+0xf9/0x230 [ 9849.512582] ? lock_is_held_type+0xaa/0x140 [ 9849.513128] vfs_write+0x512/0x1110 [ 9849.513634] ? __fget_files+0x33/0x350 [ 9849.513893] ? __pfx_vfs_write+0x10/0x10 [ 9849.514143] ? mutex_lock_nested+0x1b/0x30 [ 9849.514394] ksys_write+0xf9/0x230 [ 9849.514621] ? __pfx_ksys_write+0x10/0x10 [ 9849.514887] ? do_syscall_64+0x25e/0x1520 [ 9849.515122] ? __kasan_check_read+0x11/0x20 [ 9849.515366] ? trace_hardirqs_on_prepare+0x178/0x1c0 [ 9849.515655] __x64_sys_write+0x72/0xd0 [ 9849.515885] ? trace_hardirqs_on+0x24/0x1c0 [ 9849.516130] x64_sys_call+0x22f/0x2390 [ 9849.516341] do_syscall_64+0x12b/0x1520 [ 9849.516545] ? do_syscall_64+0x27c/0x1520 [ 9849.516783] ? do_syscall_64+0x27c/0x1520 [ 9849.517003] ? lock_release+0x318/0x480 [ 9849.517220] ? __x64_sys_io_getevents+0x143/0x2d0 [ 9849.517479] ? percpu_ref_put_many.constprop.0+0x8f/0x210 [ 9849.517779] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 9849.518073] ? do_syscall_64+0x25e/0x1520 [ 9849.518291] ? __kasan_check_read+0x11/0x20 [ 9849.518519] ? trace_hardirqs_on_prepare+0x178/0x1c0 [ 9849.518799] ? do_syscall_64+0x27c/0x1520 [ 9849.519024] ? local_clock_noinstr+0xf/0x120 [ 9849.519262] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 9849.519544] ? do_syscall_64+0x25e/0x1520 [ 9849.519781] ? __kasan_check_read+0x11/0x20 [ 9849.520008] ? trace_hardirqs_on_prepare+0x178/0x1c0 [ 9849.520273] ? do_syscall_64+0x27c/0x1520 [ 9849.520491] ? trace_hardirqs_on_prepare+0x178/0x1c0 [ 9849.520767] ? irqentry_exit+0x10c/0x6c0 [ 9849.520984] ? trace_hardirqs_off+0x86/0x1b0 [ 9849.521224] ? exc_page_fault+0xab/0x130 [ 9849.521472] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 9849.521766] RIP: 0033:0x7e36cbd14907 [ 9849.521989] Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 [ 9849.523057] RSP: 002b:00007ffff2d2a968 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 9849.523484] RAX: ffffffffffffffda RBX: 000000000000e549 RCX: 00007e36cbd14907 [ 9849.523885] RDX: 000000000000e549 RSI: 00005bd797ec6370 RDI: 0000000000000004 [ 9849.524277] RBP: 0000000000000004 R08: 0000000000000047 R09: 00005bd797ec6370 [ 9849.524652] R10: 0000000000000078 R11: 0000000000000246 R12: 0000000000000049 [ 9849.525062] R13: 0000000010781a37 R14: 00005bd797ec6370 R15: 0000000000000000 [ 9849.525447] [ 9849.525574] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass ghash_clmulni_intel aesni_intel input_leds rapl mac_hid psmouse vga16fb serio_raw vgastate floppy i2c_piix4 bochs qemu_fw_cfg i2c_smbus pata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore [ 9849.529150] ---[ end trace 0000000000000000 ]--- [ 9849.529502] RIP: 0010:folio_unlock+0x85/0xa0 [ 9849.530813] Code: 89 df 31 f6 e8 1c f3 ff ff 48 8b 5d f8 c9 31 c0 31 d2 31 f6 31 ff c3 cc cc cc cc 48 c7 c6 80 6c d9 a7 48 89 df e8 4b b3 10 00 <0f> 0b 48 89 df e8 21 e6 2c 00 eb 9d 0f 1f 40 00 66 66 2e 0f 1f 84 [ 9849.534986] RSP: 0018:ffff8881bb8076b0 EFLAGS: 00010246 [ 9849.536198] RAX: 0000000000000000 RBX: ffffea00070c8980 RCX: 0000000000000000 [ 9849.537718] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 9849.539321] RBP: ffff8881bb8076b8 R08: 0000000000000000 R09: 0000000000000000 [ 9849.540862] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000010782000 [ 9849.542438] R13: ffff8881935de738 R14: ffff88816110d010 R15: 0000000000001000 [ 9849.543996] FS: 00007e36cbe94740(0000) GS:ffff88824b899000(0000) knlGS:0000000000000000 [ 9849.545854] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9849.547092] CR2: 00007e36cb3ff000 CR3: 000000011bbf6006 CR4: 0000000000772ef0 [ 9849.548679] PKRU: 55555554 The race sequence: 1. Read completes -> netfs_read_collection() runs 2. netfs_wake_rreq_flag(rreq, NETFS_RREQ_IN_PROGRESS, ...) 3. netfs_wait_for_read() returns -EFAULT to netfs_write_begin() 4. The netfs_unlock_abandoned_read_pages() unlocks the folio 5. netfs_write_begin() calls folio_unlock(folio) -> VM_BUG_ON_FOLIO() The key reason of the issue that netfs_unlock_abandoned_read_pages() doesn't check the flag NETFS_RREQ_NO_UNLOCK_FOLIO and executes folio_unlock() unconditionally. This patch implements in netfs_unlock_abandoned_read_pages() logic similar to netfs_unlock_read_folio(). Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Signed-off-by: Viacheslav Dubeyko Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-8-dhowells@redhat.com Reviewed-by: Paulo Alcantara (Red Hat) cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org cc: Ceph Development Signed-off-by: Christian Brauner commit 4543a4d737944134a1394afe797622546fbcc98a Author: David Howells Date: Tue May 12 13:33:43 2026 +0100 netfs: Fix zeropoint update where i_size > remote_i_size Fix the update of the zero point[*] by netfs_release_folio() when there is uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio (ie. i_size > remote_i_size). The update needs to limit zero_point to remote_i_size, not i_size as i_size is a local phenomenon reflecting updates made locally to the pagecache, not stuff written to the server. remote_i_size tracks the server's i_size. [*] The zero point is the file position from which we can assume that the server will just return zeros, so we can avoid generating reads. Note that netfs_invalidate_folio() probably doesn't need fixing as zero_point should be updated by setattr after truncation or fallocate. Found with: fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \ /xfstest.test/junk --replay-ops=junk.fsxops using the following as junk.fsxops: truncate 0x0 0x1bbae 0x82864 write 0x3ef2e 0xf9c8 0x1bbae write 0x67e05 0xcb5a 0x4e8f6 mapread 0x57781 0x85b6 0x7495f copy_range 0x5d3d 0x10329 0x54fac 0x7495f write 0x64710 0x1c2b 0x7495f mapread 0x64000 0x1000 0x7495f on cifs with the default cache option. It shows read-gaps on folio 0x64 failing with a short read (ie. it hits EOF) if the FMODE_READ check is commented out in netfs_perform_write(): if (//(file->f_mode & FMODE_READ) || netfs_is_cache_enabled(ctx)) { and no fscache. This was initially found with the generic/522 xfstest. Fixes: cce6bfa6ca0e ("netfs: Fix trimming of streaming-write folios in netfs_inval_folio()") Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-7-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 2c8f4742bb76117d735f92a3932d85239b16c494 Author: David Howells Date: Tue May 12 13:33:42 2026 +0100 netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size. We need to make sure that netfslib and the filesystems that use it always hold i_lock whilst updating any of the sizes to prevent i_size_seqcount from getting corrupted. Fixes: 4058f742105e ("netfs: Keep track of the actual remote file size") Fixes: 100ccd18bb41 ("netfs: Optimise away reads above the point at which there can be no data") Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-6-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4 Author: David Howells Date: Tue May 12 13:33:41 2026 +0100 netfs: Fix netfs_read_to_pagecache() to pause on subreq failure Fix netfs_read_to_pagecache() so that it pauses the generation of new subrequests if an already-issued subrequest fails. Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Closes: https://sashiko.dev/#/patchset/20260425125426.3855807-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-5-dhowells@redhat.com cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit b5782e2d462c028096f922abca46318cec890670 Author: David Howells Date: Tue May 12 13:33:40 2026 +0100 netfs: Fix missing barriers when accessing stream->subrequests locklessly The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_write_results(), and then they access subreq->flags without taking a barrier after getting the subreq pointer from the list. Relatedly, the functions that build the list don't use any sort of write barrier when constructing the list to make sure that the NETFS_SREQ_IN_PROGRESS flag is perceived to be set first if no lock is taken. Fix this by: (1) Add a new list_add_tail_release() function that uses a release barrier to set the pointer to the new member of the list. (2) Add a new list_first_entry_or_null_acquire() function that uses an acquire barrier to read the pointer to the first member in a list (or return NULL). (3) Use list_add_tail_release() when adding a subreq to ->subrequests. (4) Use list_first_entry_or_null_acquire() when initially accessing the front of the list (when an item is removed, the pointer to the new front iterm is obtained under the same lock). Fixes: e2d46f2ec332 ("netfs: Change the read result collector to only use one work item") Fixes: 288ace2f57c9 ("netfs: New writeback implementation") Link: https://sashiko.dev/#/patchset/20260326104544.509518-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-4-dhowells@redhat.com cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit cce18c263e9623872327ba3c956012f73c1179cc Author: David Howells Date: Tue May 12 13:33:39 2026 +0100 netfs: Fix missing locking around retry adding new subreqs Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take the appropriate lock when adding extra subrequests into stream->subrequests. Fixes: e2d46f2ec332 ("netfs: Change the read result collector to only use one work item") Fixes: 288ace2f57c9 ("netfs: New writeback implementation") Closes: https://sashiko.dev/#/patchset/20260425125426.3855807-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-3-dhowells@redhat.com cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 6f0f7ac1915abc0d202f0eb4b003a6548a5ba60d Author: David Howells Date: Tue May 12 13:33:38 2026 +0100 netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream->subrequests list, it can't simply be put and abandoned as the collector may see it. Also, if it hasn't been queued yet, it has two outstanding refs that both need to be put. Both DIO read and single-read dispatch fail at this; further, both differ in the order they do things to the way buffered read works. Fix cancellation of both DIO-read and single-read subrequests that failed preparation by the following steps: (1) Harmonise all three reads (buffered, dio, single) to queue the subreq before prepping it. (2) Make all three call netfs_queue_read() to do the queuing. (3) Set NETFS_RREQ_ALL_QUEUED independently of the queuing as we don't know the length of the subreq at this point. (4) In all cases, set the error and NETFS_SREQ_FAILED flag on the subreq and then call netfs_read_subreq_terminated() to deal with it. This will pass responsibility off to the collector for dealing with it. Fixes: e2d46f2ec332 ("netfs: Change the read result collector to only use one work item") Closes: https://sashiko.dev/#/patchset/20260425125426.3855807-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-2-dhowells@redhat.com cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 859c199bb3a90ec49a678cc0846694b06703bdde Author: Breno Leitao Date: Wed Apr 29 06:09:37 2026 -0700 fs/select: reject negative timeval components in kern_select() kern_select() normalises the user-supplied struct __kernel_old_timeval with tv.tv_sec + (tv.tv_usec / USEC_PER_SEC) (tv.tv_usec % USEC_PER_SEC) * NSEC_PER_USEC before calling poll_select_set_timeout() -> timespec64_valid(). Both operands of the seconds sum are unbounded user-controlled signed long. A crafted pair where tv_usec is a negative multiple of USEC_PER_SEC drives the sum across the wrap boundary - e.g. { .tv_sec = LONG_MIN, .tv_usec = -1000000 } yields sec = LONG_MAX, nsec = 0, which passes timespec64_valid() and then flows through timespec64_add_safe(), which saturates the absolute deadline to TIME64_MAX (clamped further to KTIME_MAX downstream). select(2) therefore blocks effectively forever instead of returning -EINVAL as POSIX requires for a negative timeout. Only the legacy __NR_select syscall takes this path. pselect6, ppoll, poll and epoll_pwait2 all hand the user's two fields directly to poll_select_set_timeout(), which validates *before* doing any arithmetic: /* fs/select.c:271 -- the validator */ int poll_select_set_timeout(struct timespec64 *to, time64_t sec, long nsec) { struct timespec64 ts = {.tv_sec = sec, .tv_nsec = nsec}; if (!timespec64_valid(&ts)) return -EINVAL; ... } /* include/linux/time64.h:97 -- timespec64_valid */ if (ts->tv_sec < 0) return false; if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC) return false; /* fs/select.c:744 do_pselect() (pselect6, pselect6_time32) */ if (get_timespec64(&ts, tsp)) return -EFAULT; if (poll_select_set_timeout(to, ts.tv_sec, ts.tv_nsec)) return -EINVAL; /* fs/select.c:1097 ppoll */ if (get_timespec64(&ts, tsp)) return -EFAULT; if (poll_select_set_timeout(to, ts.tv_sec, ts.tv_nsec)) return -EINVAL; /* fs/select.c:1065 poll -- timeout_msecs is int; >= 0 gates the math */ if (timeout_msecs >= 0) poll_select_set_timeout(to, timeout_msecs / MSEC_PER_SEC, NSEC_PER_MSEC * (timeout_msecs % MSEC_PER_SEC)); /* fs/eventpoll.c:2512 epoll_pwait2 */ if (get_timespec64(&ts, timeout)) return -EFAULT; if (poll_select_set_timeout(to, ts.tv_sec, ts.tv_nsec)) return -EINVAL; In every one of these the wrap-prone arithmetic from kern_select() simply does not exist; the user fields reach timespec64_valid() unmodified. glibc routes the C-library select() through pselect6, so the bug is reachable only via a direct syscall(__NR_select, ...). The pre-validation negative check that used to live here was lost when the syscall was switched to the poll_select_set_timeout() helper. Restore it: reject tv_sec < 0 || tv_usec < 0 up front, mirroring what glibc does in userspace. do_compat_select() has the same arithmetic pattern but is only reachable on 32-bit compat and from a different syscall entry; left for a follow-up so this change stays minimal. Reproducer (returns -1/EINVAL on a fixed kernel; blocks indefinitely on an unfixed one): struct timeval tv = { .tv_sec = LONG_MIN, .tv_usec = -1000000 }; fd_set r; int pfd[2]; pipe(pfd); FD_ZERO(&r); FD_SET(pfd[0], &r); syscall(__NR_select, pfd[0] + 1, &r, NULL, NULL, &tv); Fixes: 4d36a9e65d49 ("select: deal with math overflow from borderline valid userland data") Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260429-timeval-v1-1-4448e2588bbf@debian.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 93d809adc13001e9d3a3ceb8d1e60fae2fb740d6 Merge: 911f54771ca979 3a3e3d90cbc796 Author: Paolo Abeni Date: Tue May 12 12:52:17 2026 +0200 Merge branch 'vsock-virtio-fix-vsockmon-tap-skb-construction' Stefano Garzarella says: ==================== vsock/virtio: fix vsockmon tap skb construction While reviewing the patch posted by Yiqi Sun [1] to fix an issue in virtio_transport_build_skb(), I discovered another issue related to the offset and length of the payload to be copied in the new skb. This was introduced when we did the skb conversion, and fixed by patch 1. Patch 2 fixes the issue found by Yiqi Sun in a different way: using iov_iter_kvec() to properly initialize all the iov_iter fields and removing the linear vs non-linear split like we alredy do in vhost-vsock. It could have been a single patch, but since there were two affected commits, I decided to keep the fixes separate. [1] https://lore.kernel.org/netdev/20260430071110.380509-1-sunyiqixm@gmail.com/ ==================== Link: https://patch.msgid.link/20260508164411.261440-1-sgarzare@redhat.com Signed-off-by: Paolo Abeni commit 3a3e3d90cbc79600544536723911657730759af3 Author: Stefano Garzarella Date: Fri May 8 18:44:11 2026 +0200 vsock/virtio: fix empty payload in tap skb for non-linear buffers For non-linear skbs, virtio_transport_build_skb() goes through virtio_transport_copy_nonlinear_skb() to copy the original payload in the new skb to be delivered to the vsockmon tap device. This manually initializes an iov_iter but does not set iov_iter.count. Since the iov_iter is zero-initialized, the copy length is zero and no payload is actually copied to the monitor interface, leaving data un-initialized. Fix this by removing the linear vs non-linear split and using skb_copy_datagram_iter() with iov_iter_kvec() for all cases, as vhost-vsock already does. This handles both linear and non-linear skbs, properly initializes the iov_iter, and removes the now unused virtio_transport_copy_nonlinear_skb(). While touching this code, let's also check the return value of skb_copy_datagram_iter(), even though it's unlikely to fail. Fixes: 4b0bf10eb077 ("vsock/virtio: non-linear skb handling for tap") Reported-by: Yiqi Sun Signed-off-by: Stefano Garzarella Reviewed-by: Bobby Eshleman Reviewed-by: Arseniy Krasnov Link: https://patch.msgid.link/20260508164411.261440-3-sgarzare@redhat.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 5f344d809e015fba3709e5219428c00b8ac5d7df Author: Stefano Garzarella Date: Fri May 8 18:44:10 2026 +0200 vsock/virtio: fix length and offset in tap skb for split packets virtio_transport_build_skb() builds a new skb to be delivered to the vsockmon tap device. To build the new skb, it uses the original skb data length as payload length, but as the comment notes, the original packet stored in the skb may have been split in multiple packets, so we need to use the length in the header, which is correctly updated before the packet is delivered to the tap, and the offset for the data. This was also similar to what we did before commit 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") where we probably missed something during the skb conversion. Also update the comment above, which was left stale by the skb conversion and still mentioned a buffer pointer that no longer exists. Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") Signed-off-by: Stefano Garzarella Reviewed-by: Bobby Eshleman Reviewed-by: Arseniy Krasnov Link: https://patch.msgid.link/20260508164411.261440-2-sgarzare@redhat.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 911f54771ca97947cfdca360e9e9b4147a330740 Author: Quan Sun <2022090917019@std.uestc.edu.cn> Date: Fri May 8 20:46:36 2026 +0800 net: hsr: fix NULL pointer dereference in hsr_get_node_data() In the HSR (High-availability Seamless Redundancy) protocol, node information is maintained in the node_db. When a supervision frame is received, node->addr_B_port is updated to track the receiving port type (e.g., HSR_PT_SLAVE_B). If the underlying physical interface associated with this slave port is removed (e.g., via `ip link del`), hsr_del_port() frees the hsr_port object. However, the stale node->addr_B_port reference is kept in the node_db until the node ages out. Subsequently, if userspace queries the node status via the Netlink command HSR_C_GET_NODE_STATUS, the kernel calls hsr_get_node_data(). This function unconditionally dereferences the pointer returned by hsr_port_get_hsr(): if (node->addr_B_port != HSR_PT_NONE) { port = hsr_port_get_hsr(hsr, node->addr_B_port); *addr_b_ifindex = port->dev->ifindex; // <-- NULL deref } If the slave port has been deleted, hsr_port_get_hsr() returns NULL, resulting in a kernel panic. Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:hsr_get_node_data+0x7b6/0x9e0 Call Trace: hsr_get_node_status+0x445/0xa40 Fix this by adding a proper NULL pointer check. If the port lookup fails due to a stale port type, gracefully treat it as if no valid port exists and assign -1 to the interface index. Steps to reproduce: 1. Create an HSR interface with two slave devices. 2. Receive a supervision frame to populate node_db with addr_B_port assigned to SLAVE_B. 3. Delete the underlying slave device B. 4. Send an HSR_C_GET_NODE_STATUS Netlink message. Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.") Signed-off-by: Quan Sun <2022090917019@std.uestc.edu.cn> Link: https://patch.msgid.link/20260508124636.1462346-1-2022090917019@std.uestc.edu.cn Signed-off-by: Paolo Abeni commit 1ae15b6c7965d137eef21f2cc7d367b29cb88369 Author: Chaitanya Kumar Borah Date: Tue May 5 14:39:20 2026 +0530 drm/i915/dp: Fix VSC dynamic range signaling for RGB formats For RGB, set dynamic_range to CTA or VESA based on crtc_state->limited_color_range so sinks apply correct quantization. YCbCr remains limited (CTA) range. (DP v1.4, Table 5-1) v2: - Added Reported-by and Tested-by tags v3: - Add back YCbCr comment(Suraj) Cc: stable@vger.kernel.org #v5.8+ Reported-by: DeepChirp Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/15874 Tested-by: DeepChirp Fixes: 9799c4c3b76e ("drm/i915/dp: Add compute routine for DP VSC SDP") Assisted-by: GitHub-Copilot:GPT-5.4 Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Suraj Kandpal Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260505090920.2479112-1-chaitanya.kumar.borah@intel.com (cherry picked from commit 38e10ddae6f8d42a2e8437fcd25a1cac51106c64) Signed-off-by: Tvrtko Ursulin commit 4cfe4c0efbdcde742a47813180cc69b132d7598e Author: Sebastian Brzezinka Date: Thu Apr 16 13:31:18 2026 +0200 drm/i915: skip __i915_request_skip() for already signaled requests After a GPU reset the HWSP is zeroed, so previously completed requests appear incomplete. If such a request is picked up during reset_rewind() and marked guilty, i915_request_set_error_once() returns early (fence already signaled), leaving fence.error without a fatal error code. The subsequent __i915_request_skip() then hits: ``` GEM_BUG_ON(!fatal_error(rq->fence.error)) ``` Fixes a kernel BUG observed on Sandy Bridge (Gen6) during heartbeat-triggered engine resets. ``` kernel BUG at drivers/gpu/drm/i915/i915_request.c:556! RIP: __i915_request_skip+0x15e/0x1d0 [i915] ... __i915_request_reset+0x212/0xa70 [i915] reset_rewind+0xe4/0x280 [i915] intel_gt_reset+0x30d/0x5b0 [i915] heartbeat+0x516/0x530 [i915] ``` Guard __i915_request_skip() with i915_request_signaled(), if the fence is already signaled, the ring content is committed and there is nothing left to skip. Fixes: 36e191f0644b ("drm/i915: Apply i915_request_skip() on submission") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/13729 Signed-off-by: Sebastian Brzezinka Cc: stable@vger.kernel.org # v5.7+ Reviewed-by: Krzysztof Karas Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/fe76921d35b6ae85aa651822726d0d9815aa5362.1776339012.git.sebastian.brzezinka@intel.com (cherry picked from commit 5ba54393dcd7adf75a9f39f5a933b1538349cad5) Signed-off-by: Tvrtko Ursulin commit 99d9958fa10fb684b2a8e2c48a8d704122721420 Author: Sven Eckelmann Date: Sat May 2 21:25:19 2026 +0200 batman-adv: tt: prevent TVLV entry number overflow The helpers to prepare the buffers for the local and global TT based replies are trying to sum up all TT entries which can be found for each VLAN. In theory, this sum can be too big for an u16 and therefore overflow. A too small buffer would then be allocated for the TVLV. The too small buffer will be handled gracefully by batadv_tt_tvlv_generate() and is not causing a buffer overflow - just a truncated reply. But this overflow shouldn't have happened in the first and the too small buffer should never have been allocated when an overflow was detected. Cc: stable@kernel.org Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") Signed-off-by: Sven Eckelmann commit fa1bd704940b5bcbc32c0b28db9167405c8ee5e0 Author: Sven Eckelmann Date: Sat May 2 20:47:34 2026 +0200 batman-adv: tt: avoid empty VLAN responses The commit 16116dac2339 ("batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs") added checks to the local (direct) TT response code. But the response can also be done indirectly by another node using the global TT state. To avoid such inconsistency states reported in the original fix, also avoid sending empty VLANs for replies from the global TT state. Cc: stable@kernel.org Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") Signed-off-by: Sven Eckelmann commit 94d27005016be15ffc638b2ecbc4d58805ad7b48 Author: Sven Eckelmann Date: Sat May 2 19:47:11 2026 +0200 batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated. Only then, the list of VLANs s used to fill the VLAN entries in the buffer. During this time, the meshif_vlan_list_lock is held. But the actual number of TT entries of each VLAN can still increase during this time - just not the number of VLANs in the list. But the prefilter used in the buffer size calculation might still cause an increase of the number of VLANs which need to be stored. Simply because a VLAN might now suddenly have at least one entry when it had none in the pre-alloc check - and then needs to occupy space which was not allocated. It is better to overestimate the buffer size at the beginning and then fill the buffer only with the VLANs which are not empty. Cc: stable@kernel.org Fixes: 16116dac2339 ("batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs") Signed-off-by: Sven Eckelmann commit fc92cdfcb295cefa4344d71a527d61b638b7bfc4 Author: Sven Eckelmann Date: Sat May 2 19:53:21 2026 +0200 batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response(). Cc: stable@kernel.org Fixes: a73105b8d4c7 ("batman-adv: improved client announcement mechanism") Signed-off-by: Sven Eckelmann commit b64963a2ceeb7529310b6cf253a1e540784422f4 Author: Sven Eckelmann Date: Sat May 2 19:53:21 2026 +0200 batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_other_tt_response(). Cc: stable@kernel.org Fixes: a73105b8d4c7 ("batman-adv: improved client announcement mechanism") Signed-off-by: Sven Eckelmann commit 1e9fab756f8395096d5bba7be0c373c4c8f5d165 Author: Sven Eckelmann Date: Sat May 2 19:08:37 2026 +0200 batman-adv: tt: reject oversized local TVLV buffers The commit 3a359bf5c61d ("batman-adv: reject oversized global TT response buffers") added a check to ensure that a global return buffer size can be stored in an u16. The same buffer handling also exists for the local data buffer but was not touched. A similar check should be also be in place for the local TVLV buffer. It doesn't have the similar attack surface because it is only generated from locally discovered MAC addresses but the dynamic nature could still cause temporarily to large buffers. Cc: stable@kernel.org Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") Signed-off-by: Sven Eckelmann commit dbc30a57bd8e026995e9fa8e8c31cffd18542c01 Author: Aboorva Devarajan Date: Fri May 8 09:42:56 2026 +0530 powerpc/hv-gpci: fix preempt count leak in sysfs show paths Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb) (which calls preempt_disable()) but only call the matching put_cpu_var() on the error path under the 'out:' label. Every successful read leaks one preempt_disable(): processor_bus_topology_show() processor_config_show() affinity_domain_via_virtual_processor_show() affinity_domain_via_domain_show() (affinity_domain_via_partition_show() was already correct.) On a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and eventually return to userspace with preemption still disabled. The next user-mode page fault then hits faulthandler_disabled() == 1, gets forced to SIGSEGV, and the resulting coredump trips 'BUG: scheduling while atomic' in call_usermodehelper_exec -> wait_for_completion_state -> schedule: BUG: scheduling while atomic: //0x00000004 ... __schedule_bug+0x6c/0x90 __schedule+0x58c/0x13a0 schedule+0x48/0x1a0 schedule_timeout+0x104/0x170 wait_for_completion_state+0x16c/0x330 call_usermodehelper_exec+0x254/0x2d0 vfs_coredump+0x1050/0x2590 get_signal+0xb9c/0xc80 do_notify_resume+0xf8/0x470 Add an out_success label that calls put_cpu_var() before returning the byte count, mirroring affinity_domain_via_partition_show(). Fixes: 71f1c39647d8 ("powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show processor bus topology information") Fixes: 1a160c2a13c6 ("powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show processor config information") Fixes: 71a7ccb478fc ("powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show affinity domain via virtual processor information") Fixes: a69a57cac1ec ("powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show affinity domain via domain information") Signed-off-by: Aboorva Devarajan Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260508041256.3447113-1-aboorvad@linux.ibm.com commit aef656a0e6c01796190bb5bd2bdba1c644ed7811 Author: Julian Braha Date: Sun Apr 5 17:15:45 2026 +0100 powerpc: fix dead default for GUEST_STATE_BUFFER_TEST The GUEST_STATE_BUFFER_TEST config option should default to KUNIT_ALL_TESTS so that if all tests are enabled then it is included, but currently the 'default KUNIT_ALL_TESTS' statement is shadowed by 'def_tristate n', meaning that this second default statement is currently dead code. It looks to me like the commit 6ccbbc33f06a ("KVM: PPC: Add helper library for Guest State Buffers") intended to set the default to KUNIT_ALL_TESTS, but mistakenly missed the def_tristate. This dead code was found by kconfirm, a static analysis tool for Kconfig. Fixes: 6ccbbc33f06a ("KVM: PPC: Add helper library for Guest State Buffers") Signed-off-by: Julian Braha Tested-by: Gautam Menghani Reviewed-by: Amit Machhiwal Reviewed-by: Harsh Prateek Bora Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260405161545.161006-1-julianbraha@gmail.com commit f98020c22ad9be07d6feefd0496e70f9f36a2f63 Author: Bart Van Assche Date: Mon Mar 16 10:47:42 2026 -0700 powerpc/powermac: Remove pmac_low_i2c_{lock,unlock}() Commit a28d3af2a26c ("[PATCH] 2/5 powerpc: Rework PowerMac i2c part 2") removed the last calls to the pmac_low_i2c_{lock,unlock}() functions. Hence, remove these two functions. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Bart Van Assche Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260316174747.3871924-1-bvanassche@acm.org commit 108d7f951271cbd36ca36efc5e5d106966f5180c Author: Ma Ke Date: Sun Nov 16 10:44:11 2025 +0800 powerpc/warp: Fix error handling in pika_dtm_thread pika_dtm_thread() acquires client through of_find_i2c_device_by_node() but fails to release it in error handling path. This could result in a reference count leak, preventing proper cleanup and potentially leading to resource exhaustion. Add put_device() to release the reference in the error handling path. Found by code review. Cc: stable@vger.kernel.org Fixes: 3984114f0562 ("powerpc/warp: Platform fix for i2c change") Signed-off-by: Ma Ke Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251116024411.21968-1-make24@iscas.ac.cn commit acd1e47db03d4b528fd5efb8565dd0de1c79f62a Author: Ally Heev Date: Sun Nov 16 19:55:44 2025 +0530 powerpc: 82xx: fix uninitialized pointers with free attribute Uninitialized pointers with `__free` attribute can cause undefined behavior as the memory allocated to the pointer is freed automatically when the pointer goes out of scope. powerpc/km82xx doesn't have any bugs related to this as of now, but, it is better to initialize and assign pointers with `__free` attribute in one statement to ensure proper scope-based cleanup Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/ Signed-off-by: Ally Heev Fixes: 4aa5cc1e0012 ("powerpc-km82xx.c: replace of_node_put() with __free") Reviewed-by: Christophe Leroy (CS GROUP) Reviewed-by: Krzysztof Kozlowski Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251116-aheev-uninitialized-free-attr-km82xx-v2-1-4307e2b5300d@gmail.com commit 8d57bb61734b23f6342e9de781173f1d83f90d3a Author: Linus Walleij Date: Tue May 5 20:47:56 2026 +0200 powerpc/g5: Enable all windfarms by default The G5 defconfig is clearly intended for the G5 Powermac series, and that should enable all the available windfarm drivers, or the machine will overheat a short while after booting and shut itself down, which is annoying. Signed-off-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260505-powermac-g5-config-v3-1-7747bf72f874@kernel.org commit c21b90f77687075115d989e53a8ec5e2bb427ab1 Author: Prathyushi Nangia Date: Tue Dec 9 10:01:33 2025 -0600 x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Make sure resources are not improperly shared in the op cache and cause instruction corruption this way. Signed-off-by: Prathyushi Nangia Co-developed-by: Borislav Petkov (AMD) Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds commit 53597deca0e38c30e6cd4ba2114fa42d2bcd85bb Author: Guangshuo Li Date: Thu May 7 18:06:03 2026 +0800 drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup imx8qxp_pxl2dpi_get_available_ep_from_port() returns ERR_PTR() on errors. imx8qxp_pxl2dpi_find_next_bridge() stores its return value in a __free(device_node) variable before checking IS_ERR(). When the function returns on the error path, the cleanup action calls of_node_put() on the ERR_PTR() value. Do not let a device_node cleanup variable hold error pointers. Change imx8qxp_pxl2dpi_get_available_ep_from_port() to return an int and pass the endpoint node through an output argument. Initialize the output argument to NULL so callers hold either NULL on error paths or a valid device_node pointer on successful path. Fixes: ceea3f7806a10 ("drm/bridge: imx8qxp-pxl2dpi: simplify put of device_node pointers") Cc: stable@vger.kernel.org Reviewed-by: Liu Ying Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260507100604.667731-1-lgs201920130244@gmail.com Signed-off-by: Liu Ying commit 8b7c5cc7f6e655087164eb902131de356f6d5984 Author: Richard Fitzgerald Date: Mon May 11 12:42:39 2026 +0100 ASoC: cs35l56: Check for successful runtime-resume in cs35l56_dsp_work() In cs35l56_dsp_work() check that the request for runtime-resume was successful instead of assuming that it can't fail. We may as well do this using the new PM_RUNTIME_ACQUIRE*() macros and remove the manual pm_runtime_put_autosuspend() and associated gotos. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260511114239.44970-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 2c7b1227e582e88db7917412dca4e752c1aff691 Author: Mario Limonciello Date: Mon May 11 10:36:36 2026 -0500 ASoC: SOF: amd: Fix error code handling in psp_send_cmd() The smn_read_register() helper returns negative error codes on failure or the register value on success. When used with read_poll_timeout(), the return value is stored in the 'data' variable. Currently 'data' is declared as u32, which causes negative error codes to be cast to large positive values. This makes the condition 'data > 0' incorrectly treat errors as success. Fix by changing 'data' from u32 to int, matching the pattern used in psp_mbox_ready() which correctly handles the same helper function. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-sound/agGES8vWrLOrBu28@stanley.mountain/ Fixes: f120cf33d232 ("ASoC: SOF: amd: Use AMD_NODE") Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20260511153638.724810-1-mario.limonciello@amd.com Signed-off-by: Mark Brown commit be48e5fe51a5864566307998286a699d6b986934 Author: Evgenii Burenchev Date: Thu May 7 17:55:17 2026 +0300 qed: fix division by zero in qed_init_wfq_param when all vports are configured In qed_init_wfq_param(), variable non_requested_count can become zero when the number of vports with the configured flag set (including the current vport being configured) equals total num_vports. This happens when configuring the last unconfigured vport or when re-configuring an already configured vport. The function then calculates left_rate_per_vp = total_left_rate / non_requested_count, which causes division by zero. Fix this by skipping the division when non_requested_count is zero. In that case, there is no remaining bandwidth to distribute, so just record the configuration for the current vport and return success. Fixes: bcd197c81f63 ("qed: Add vport WFQ configuration APIs") Signed-off-by: Evgenii Burenchev Link: https://patch.msgid.link/20260507145520.23106-1-evg28bur@yandex.ru Signed-off-by: Jakub Kicinski commit f8e64e956a635b054227f56e9586a1997add0646 Author: Davide Caratti Date: Fri May 8 19:05:10 2026 +0200 net/sched: dualpi2: initialize timer earlier in dualpi2_init() 'pi2_timer' needs to be initialized in all error paths of dualpi2_init(): otherwise, a failure in qdisc_create_dflt() causes the following crash in dualpi2_destroy(): # tc qdisc add dev crash0 handle 1: root dualpi2 BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 4 UID: 0 PID: 471 Comm: tc Tainted: G E 7.1.0-rc1-virtme #2 PREEMPT(full) Tainted: [E]=UNSIGNED_MODULE Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 RIP: 0010:hrtimer_active+0x39/0x60 Code: f9 eb 23 0f b6 41 38 3c 01 0f 87 87 64 c0 ff 83 e0 01 75 33 48 39 4a 50 74 28 44 3b 42 10 75 06 48 3b 51 30 74 21 48 8b 51 30 <44> 8b 42 10 41 f6 c0 01 74 cf f3 90 44 8b 42 10 41 f6 c0 01 74 c3 RSP: 0018:ffffd0db80b93620 EFLAGS: 00010282 RAX: ffffffffc0400320 RBX: ffff8cf24a4c86b8 RCX: ffff8cf24a4c86b8 RDX: 0000000000000000 RSI: ffff8cf2429c2ab0 RDI: ffff8cf24a4c86b8 RBP: 00000000fffffff4 R08: 0000000000000003 R09: 0000000000000000 R10: 0000000000000001 R11: ffff8cf24a39c500 R12: ffff8cf24822c000 R13: ffffd0db80b936c0 R14: ffffffffc02cf360 R15: 00000000ffffffff FS: 00007fbc01706580(0000) GS:ffff8cf2dc759000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 0000000008e02003 CR4: 0000000000172ef0 Call Trace: hrtimer_cancel+0x15/0x40 dualpi2_destroy+0x20/0x40 [sch_dualpi2] qdisc_create+0x230/0x570 tc_modify_qdisc+0x716/0xc10 rtnetlink_rcv_msg+0x188/0x780 netlink_rcv_skb+0xcd/0x150 netlink_unicast+0x1ba/0x290 netlink_sendmsg+0x242/0x4d0 ____sys_sendmsg+0x39e/0x3e0 ___sys_sendmsg+0xe1/0x130 __sys_sendmsg+0xad/0x110 do_syscall_64+0x14f/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fbc0188b08e Code: 4d 89 d8 e8 94 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa RSP: 002b:00007fff593260e0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbc0188b08e RDX: 0000000000000000 RSI: 00007fff59326190 RDI: 0000000000000003 RBP: 00007fff593260f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000055f06124f260 R13: 0000000069fca043 R14: 000055f061255640 R15: 000055f06124d3f8 Modules linked in: sch_dualpi2(E) CR2: 0000000000000010 [1] https://lore.kernel.org/netdev/2e78e01c504c633ebdff18d041833cf2e079a3a4.1607020450.git.dcaratti@redhat.com/ [2] https://lore.kernel.org/netdev/20200725201707.16909-1-xiyou.wangcong@gmail.com/ v2: - rebased on top of latest net.git Fixes: 320d031ad6e4 ("sched: Struct definition and parsing of dualpi2 qdisc") Signed-off-by: Davide Caratti Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/1faca91179702b31da5d87653e1e036543e32722.1778259798.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 12c97d1c15f926cd430bf5cdf8ffe878cb478165 Author: Abel Vesa Date: Tue Apr 14 20:05:51 2026 +0300 arm64: dts: qcom: glymur: Drop RPMh CXO clocks from QMP PHYs On Glymur, all QMP PHYs except the one used by USB SS0 take their reference clock from the TCSR clock controller. Since these TCSR clocks already derive from RPMH_CXO_CLK as their sole parent, there is no need to provide an extra `clkref` clock to the PHY nodes. Drop the extra RPMh CXO clock inputs and use the TCSR clocks as the PHY reference clocks instead. This also fixes the devicetree schema validation, as the bindings do not allow a separate `clkref` clock. Fixes: 4eee57dd4df9 ("arm64: dts: qcom: glymur: Add USB related nodes") Reported-by: Krzysztof Kozlowski Reported-by: Rob Herring Closes: https://lore.kernel.org/r/20260410145205.GA554754-robh@kernel.org/ Signed-off-by: Abel Vesa Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260414-dts-glymur-drop-rpmh-cxo-clk-from-qmpphys-v1-1-ab12d77c4aec@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 03cb001ef87b3f8d859cf7f96329acf3d6235d29 Author: Kuniyuki Iwashima Date: Fri May 8 12:08:46 2026 +0000 tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). lockdep_sock_is_held() was added in tcp_ao_established_key() by the cited commit. It can be called from tcp_v[46]_timewait_ack() with twsk. Since it does not have sk->sk_lock, the lockdep annotation results in out-of-bound access. $ pahole -C tcp_timewait_sock vmlinux | grep size /* size: 288, cachelines: 5, members: 8 */ $ pahole -C sock vmlinux | grep sk_lock socket_lock_t sk_lock; /* 440 192 */ Let's not use lockdep_sock_is_held() for TCP_TIME_WAIT. Fixes: 6b2d11e2d8fc ("net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals") Reported-by: Damiano Melotti Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260508120853.4098365-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 24a08d7d6218d60c033015cf4870b6096446e734 Author: Arthur Kiyanovski Date: Thu May 7 00:35:15 2026 +0000 net: ena: PHC: Check return code before setting timestamp output ena_phc_gettimex64() is setting the output parameter regardless of whether ena_com_phc_get_timestamp() succeeded or failed. When ena_com_phc_get_timestamp() returns an error, the timestamp parameter may contain uninitialized stack memory (e.g., when PHC is disabled or in blocked state) or invalid hardware values. Passing these to userspace via the PTP ioctl is both a security issue (information leak) and a correctness bug. Fix by checking the return code after releasing the lock and only setting the output timestamp on success. Fixes: e0ea34158ee8 ("net: ena: Add PHC support in the ENA driver") Cc: stable@vger.kernel.org Signed-off-by: Arthur Kiyanovski Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260507003518.22554-1-akiyano@amazon.com Signed-off-by: Jakub Kicinski commit e174929793195e0cd6a4adb0cad731b39f9019b4 Author: Allison Henderson Date: Tue May 5 16:43:36 2026 -0700 net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user(). Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.") Signed-off-by: Allison Henderson Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260505234336.2132721-1-achender@kernel.org Signed-off-by: Jakub Kicinski commit 83dd9effefa2e9da58ccd37059a11820fc05caf4 Author: Florian Eckert Date: Fri Apr 17 10:35:45 2026 +0200 MAINTAINERS: Remove Chuanhua Lei as PCIe intel-gw maintainer Chuanhua Lei's email address has been bouncing for months. Remove the entry and mark the PCI intel-gw driver as orphaned. Signed-off-by: Florian Eckert Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260417-pcie-intel-gw-v5-1-0a2b933fe04f@dev.tdt.de commit 3a8389d42bdf4213730f4067f8bfa78bae6564ef Author: Johannes Thumshirn Date: Wed Apr 29 22:58:15 2026 +0200 zonefs: handle integer overflow in zonefs_fname_to_fno In zonefs the file name in one of the two directories corresponds to the zone number. Here Alexey reported a possible integer overflow in zonefs_fname_to_fno(), where the parsing of the zone number from the file name can overflow the 'long' data type. Add a check for integer overflows and if the fno 'long' did overflow return -ENOENT. Reported-by: Alexey Dobriyan Fixes: d207794ababe ("zonefs: Dynamically create file inodes when needed") Signed-off-by: Johannes Thumshirn Signed-off-by: Damien Le Moal commit 50897c955902c93ae71c38698abb910525ebdc89 Merge: c1fa0bb633e4a6 8f80b5b227ef9e Author: Linus Torvalds Date: Mon May 11 15:38:49 2026 -0700 Merge tag 'linux_kselftest-kunit-fixes-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit fixes from Shuah Khan: "Fix to decouple KUNIT_DEBUGFS and KUNIT_ALL_TESTS options and fix KUNIT_DEBUGFS dependencies so it depends on DEBUG_FS without which it will not be useful" * tag 'linux_kselftest-kunit-fixes-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS kunit: config: Enable KUNIT_DEBUGFS by default commit 9a415cc53711f2238e0f0ca8a6bcc796c003b127 Author: Tejun Heo Date: Mon May 11 12:05:48 2026 -1000 sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is the last drop, the task is freed synchronously and the deref becomes a UAF. Move put_task_struct() past scx_error(). Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260511214031.AF5E9C2BCB0@smtp.kernel.org/ Fixes: f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class") Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: Tejun Heo commit 5d08559c910cc37673b965a0d4e8d004444d0332 Author: Jesse Zhang Date: Fri Apr 3 15:58:31 2026 +0800 drm/amdgpu/gfx_v12_0: set gfx.rs64_enable from PFP header on GFX12 gfx_v12_0_init_microcode() always loads RS64 CP ucode but never set adev->gfx.rs64_enable, so it stayed false and code that branches on it (e.g. MEC pipe reset) used the legacy CP_MEC_CNTL path incorrectly. Match GFX11: derive RS64 mode from the PFP firmware header (v2.0) via amdgpu_ucode_hdr_version(). Log at debug when RS64 is enabled. Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit b03d53598b0d2048e8fa7303b8d0784768ec4fa6) commit 6bbede02dc62a1021aeeae87ab243bd7a93c61d2 Author: Xiang Liu Date: Thu May 7 20:56:15 2026 +0800 drm/amd/ras: Fix CPER ring debugfs read overflow The legacy CPER debugfs reader can reach the payload path without a valid pointer snapshot. The remaining user byte count is also treated as the ring occupancy in dwords, so reads past the header can copy more than requested. Take the CPER lock before sampling pointers. Resample rptr/wptr for payload reads, bound the payload copy by available dwords and the remaining user size, and advance the file position for each dword copied. Signed-off-by: Xiang Liu Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher (cherry picked from commit 1e40ef87ffdc291e05ccdade8b9170cc9c1c4249) commit 183182235f6d53bac62c6c39014738a54a68dfa6 Author: Mikhail Gavrilov Date: Tue May 5 09:05:37 2026 +0800 drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED [Why] dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(), which disables local softirqs. The DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to allocate ~335 KiB for dc_plane_state. This triggers the vmalloc path, which calls BUG_ON(in_interrupt()) because it's invoked within the FPU-enabled (softirq disabled) region, leading to a kernel crash. [How] Wrap the dc_state_create_phantom_plane() call with the DC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during this memory allocation. Fixes: 235c67634230 ("drm/amd/display: add DCN32/321 specific files for Display Core") Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4470 Reviewed-by: Aurabindo Pillai Signed-off-by: Mikhail Gavrilov Signed-off-by: James Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11) Cc: stable@vger.kernel.org commit 0071e01c61aa73f22edd5252f0a3e2c2eff744d6 Author: Christian König Date: Mon Apr 20 16:08:35 2026 +0200 drm/amdgpu: fix userq hang detection and reset Fix lock inversions pointed out by Prike and Sunil. The hang detection timeout *CAN'T* grab locks under which we wait for fences, especially not the userq_mutex lock. Then instead of this completely broken handling with the hang_detect_fence just cancel the work when fences are processed and re-start if necessary. Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher (cherry picked from commit 1b62077f045ac6ffde7c97005c6659569ac5c1ec) commit d0053441ad7eaf7920b71e2263097ece53c5af34 Author: Christian König Date: Mon Apr 20 15:13:57 2026 +0200 drm/amdgpu: remove almost all calls to amdgpu_userq_detect_and_reset_queues Well the reset handling seems broken on multiple levels. As first step of fixing this remove most calls to the hang detection. That function should only be called after we run into a timeout! And *NOT* as random check spread over the code in multiple places. Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher (cherry picked from commit 71bea36b54ccfb14cbc90f94267af6369af4e702) commit 44e5bc73bdcbec115cfe1c4b4394d25eb3deaff2 Author: Christian König Date: Thu Apr 16 15:32:11 2026 +0200 drm/amdgpu: rework amdgpu_userq_signal_ioctl v3 This one was fortunately not looking so bad as the wait ioctl path, but there were still a few things which could be fixed/improved: 1. Allocating with GFP_ATOMIC was quite unnecessary, we can do that before taking the userq_lock. 2. Use a new mutex as protection for the fence_drv_xa so that we can do memory allocations while holding it. 3. Starting the reset timer is unnecessary when the fence is already signaled when we create it. 4. Cleanup error handling, avoid trying to free the queue when we don't even got one. v2: fix incorrect usage of xa_find, destroy the new mutex on error v3: cleanup ref ordering Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher (cherry picked from commit 1609eb0f81a609d350169839128cecf298c84e7a) commit d5971c5c34303a00bf841a902ca00a703602c500 Author: Christian König Date: Mon Apr 20 20:18:43 2026 +0200 drm/amdgpu: remove deadlocks from amdgpu_userq_pre_reset The purpose of a GPU reset is to make sure that fence can be signaled again and the signal and resume workers can make progress again. So waiting for the resume worker or any fence in the GPU reset path is just utterly nonsense. Signed-off-by: Christian König Reviewed-by: Prike Liang Signed-off-by: Alex Deucher (cherry picked from commit fcd5f065eab46993af43442fd77ee8d9eb9c5bdf) commit 155a372a1cc50fa93387c5d3cdfd614a61e1afd1 Author: Matthew Auld Date: Fri May 8 11:26:37 2026 +0100 drm/xe/dma-buf: fix UAF with retry loop Retry doesn't work here, since bo will be freed on error, leading to UAF. However, now that we do the alloc & init before the attach, we can now combine this as one unit and have the init do the alloc for us. This should make the retry safe. Reported by Sashiko. v2: Fix up the error unwind (CI) Closes: https://sashiko.dev/#/patchset/20260506184332.86743-2-matthew.auld%40intel.com Fixes: eb289a5f6cc6 ("drm/xe: Convert xe_dma_buf.c for exhaustive eviction") Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Cc: # v6.18+ Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20260508102635.149172-4-matthew.auld@intel.com (cherry picked from commit 479669418253e0f27f8cf5db01a731352ea592e7) Signed-off-by: Rodrigo Vivi commit 981bedbbe61364fcc3a3b87ebaf648a66cd07108 Author: Matthew Auld Date: Fri May 8 11:26:36 2026 +0100 drm/xe/dma-buf: handle empty bo and UAF races There look to be some nasty races here when triggering the invalidate_mappings hook: 1) We do xe_bo_alloc() followed by the attach, before the actual full bo init step in xe_dma_buf_init_obj(). However the bo is visible on the attachments list after the attach. This is bad since exporter driver, say amdgpu, can at any time call back into our invalidate_mappings hook, with an empty/bogus bo, leading to potential bugs/crashes. 2) Similar to 1) but here we get a UAF, when the invalidate_mappings hook is triggered. For example, we get as far as xe_bo_init_locked() but this fails in some way. But here the bo will be freed on error, but we still have it attached from dma-buf pov, so if the invalidate_mappings is now triggered then the bo we access is gone and we trigger UAF and more bugs/crashes. To fix this, move the attach step until after we actually have a fully set up buffer object. Note that the bo is not published to userspace until later, so not sure what the comment "Don't publish the bo until we have a valid attachment", is referring to. We have at least two different customers reporting hitting a NULL ptr deref in evict_flags when importing something from amdgpu, followed by triggering the evict flow. Hit rate is also pretty low, which would hint at some kind of race, so something like 1) or 2) might explain this. v2: - Shuffle the order of the ops slightly (no functional change) - Improve the comment to better explain the ordering (Matt B) Assisted-by: Gemini:gemini-3 #debug Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7903 Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/4055 Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Cc: # v6.8+ Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Link: https://patch.msgid.link/20260508102635.149172-3-matthew.auld@intel.com (cherry picked from commit af1f2ad0c59fe4e2f924c526f66e968289d77971) Signed-off-by: Rodrigo Vivi commit 4568dfbb8363a153e7cef384d23cc6d6563ff316 Author: Matt Roper Date: Thu May 7 14:00:15 2026 -0700 drm/xe: Make decision to use Xe2-style blitter instructions a feature flag The blitter engines' MEM_COPY and MEM_SET instructions were added as part of the same hardware change that introduced service copy engines (i.e., BCS1-BCS8) which is why the driver checks for service copy engine presence when deciding whether to use these instructions or the older XY_* instructions. However when making this decision the driver should consider which engines are part of the hardware architecture, not which engines are present/usable on the current device. For graphics IP versions that architecturally include service copy engines (i.e., everything Xe2 and later, plus PVC's Xe_HPC) we should use MEM_SET and MEM_COPY even in if all of the service copy engines wind up getting fused off. I.e., we need to decide based on whether the platform's graphics descriptor contains these engines, rather than whether the usable engine mask contains them. This logic got broken when gt->info.__engine_mask was removed, although in practice that mistake has been harmless so far because there haven't been any hardware SKUs that fuse off all of the service copy engines yet. Replace the incorrect has_service_copy_support() function with a GT feature flag that tracks more accurately whether the new blitter instructions are usable. In addition to fixing incorrect logic if all service copies are fused off, the flag also makes it more obvious what the calling code is trying to do; previously it wasn't terribly obvious why "has service copy engines" was being used as the condition for using different instructions on all copy engine types. The new feature flag is named 'has_xe2_blt_instructions' because we expect this flag to be set for all Xe2 and later platforms (i.e., everything officially supported by the Xe driver). Technically there's also one Xe1-era platform (PVC) that supports these engines/instructions and will set this flag, but this still seems to be the most clear and understandable name for the flag. Fixes: 61549a2ee594 ("drm/xe: Drop __engine_mask") Cc: Balasubramani Vivekanandan Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260507-xe2_copy-v1-1-26506381b821@intel.com Signed-off-by: Matt Roper (cherry picked from commit 09b399842907565a64e351fb22da790b4c673ffb) Signed-off-by: Rodrigo Vivi commit 92f3403a7ca5d186b2bad342603410cc6adc95a3 Author: Arvind Yadav Date: Wed May 6 18:50:27 2026 +0530 drm/xe/madvise: Track purgeability with BO-local counters xe_bo_recompute_purgeable_state() walks all VMAs of a BO to determine whether the BO can be made purgeable. This makes VMA create/destroy and madvise updates O(n) in the number of mappings. Replace the walk with BO-local counters protected by the BO dma-resv lock: - vma_count tracks the number of VMAs mapping the BO. - willneed_count tracks active WILLNEED holders, including WILLNEED VMAs and active dma-buf exports for non-imported BOs. A DONTNEED BO is promoted back to WILLNEED on a 0->1 transition of willneed_count. A BO is demoted to DONTNEED on a 1->0 transition only when it still has VMAs, preserving the previous behaviour where a BO with no mappings keeps its current madvise state. PURGED remains terminal, preserving the existing "once purged, always purged" rule. Fixes: 4f44961eab84 ("drm/xe/vm: Prevent binding of purged buffer objects") v2: - Use early return for imported BOs in all four helpers to avoid nesting (Matt B). - Group purgeability state into a purgeable sub-struct on struct xe_bo (Matt B). - Reword xe_bo_willneed_put_locked() kernel-doc to explain that a 1->0 transition means all remaining active VMAs are DONTNEED (Matt B). v3: - Move DONTNEED/PURGED reject from vma_lock_and_validate() into xe_vma_create(), gated on attr->purgeable_state == WILLNEED. Fixes vm_bind bypass and partial-unbind rejection on DONTNEED BOs (Matt B). - Drop .check_purged from MAP and REMAP; keep it for PREFETCH and add a comment why (Matt B). - Skip BO validation in vma_lock_and_validate() for non-WILLNEED VMA remnants so cleanup/remap paths do not repopulate DONTNEED/PURGED BOs. Suggested-by: Thomas Hellström Cc: Matthew Brost Cc: Thomas Hellström Cc: Himal Prasad Ghimiray Signed-off-by: Arvind Yadav Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260506132027.2556046-1-arvind.yadav@intel.com Signed-off-by: Himal Prasad Ghimiray (cherry picked from commit 23fb2ea56cb4fa2587bc072b04e4e698687a48e4) Signed-off-by: Rodrigo Vivi commit 5dd74441cbf42c22e874450eb6a6bbb19390a216 Author: Guopeng Zhang Date: Sat May 9 18:20:31 2026 +0800 cgroup/cpuset: Reserve DL bandwidth only for root-domain moves cpuset_can_attach() currently adds the bandwidth of all migrating SCHED_DEADLINE tasks to sum_migrate_dl_bw. If the source and destination cpuset effective CPU masks do not overlap, the whole sum is then reserved in the destination root domain. set_cpus_allowed_dl(), however, subtracts bandwidth from the source root domain only when the affinity change really moves the task between root domains. A DL task can move between cpusets that are still in the same root domain, so including that task in sum_migrate_dl_bw can reserve destination bandwidth without a matching source-side subtraction. Share the root-domain move test with set_cpus_allowed_dl(). Keep nr_migrate_dl_tasks counting all migrating deadline tasks for cpuset DL task accounting, but add to sum_migrate_dl_bw only for tasks that need a root-domain bandwidth move. Keep using the destination cpuset effective CPU mask and leave the broader can_attach()/attach() transaction model unchanged. Fixes: 2ef269ef1ac0 ("cgroup/cpuset: Free DL BW in case can_attach() fails") Cc: stable@vger.kernel.org # v6.10+ Signed-off-by: Guopeng Zhang Reviewed-by: Waiman Long Acked-by: Juri Lelli Tested-by: Juri Lelli Signed-off-by: Tejun Heo commit 63d2059cd665c4e5e4ca6cfbc58c6f171e7939b1 Author: Frank Li Date: Tue May 5 12:09:02 2026 -0400 pinctrl: imx1: Allow parsing DT without function nodes The old format to define pinctrl settings for imx in DT has two hierarchy levels. The first level are function device nodes. The second level are pingroups which contain a property fsl,pins. The original ntention was to define all pin functions in a single dtsi file and just reference the correct ones in the board files. The commit ("5fcdf6a7ed95e pinctrl: imx: Allow parsing DT without function nodes") already make moden i.MX chip support flatten layout. Make legacy chipes (more than 15 years) support this flatten layout also. Fixes: e948cbdc41d6f ("ARM: dts: imx: remove redundant intermediate node in pinmux hierarchy") Tested-by: Sébastien Szymanski Signed-off-by: Frank Li Signed-off-by: Linus Walleij commit 35d0ed82d03e5ee77ea4f31f20e29562a7721649 Author: Raphael Zimmer Date: Tue May 5 11:08:12 2026 +0200 libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This can potentially result in an out-of-bounds memory access if the incoming message is corrupted such that the max_osd value exceeds the actual content of the osdmap message. This patch fixes the issue by changing the corresponding part in the ceph_decode_need() check to account for map->max_osd*sizeof(*map->osd_weight). Cc: stable@vger.kernel.org Fixes: dcbc919a5dc8 ("libceph: switch osdmap decoding to use ceph_decode_entity_addr") Signed-off-by: Raphael Zimmer Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 77098e4bea37af51d3962efa88a5af2ea5e1ac57 Author: Sven Eckelmann Date: Sun May 10 11:31:03 2026 +0200 batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown The receiver shutdown timer handler, batadv_tp_receiver_shutdown(), is responsible for releasing the tp_vars reference it holds. However, the existing logic for coordinating this release with batadv_tp_stop_all() was flawed. timer_shutdown_sync() guarantees the timer will not fire again after it returns, but it returns non-zero only when the timer was pending at the time of the call. If the timer had already expired (and batadv_tp_stop_all() would unsucessfully try to rearm itself), batadv_tp_stop_all() skips its batadv_tp_vars_put(), and batadv_tp_receiver_shutdown() fails to put its own reference as well. Fix this by introducing a new atomic variable receiving that is set to 1 when the receiver is initialized and cleared atomically with atomic_xchg() by whichever side claims it first. Only the side that observes the transition from 1 to 0 is responsible for releasing the tp_vars timer reference, eliminating the uncertainty. Cc: stable@kernel.org Fixes: 3d3cf6a7314a ("batman-adv: stop tp_meter sessions during mesh teardown") Signed-off-by: Sven Eckelmann commit 94f3b133168d1c49895e7cc6afbcf1cc0b354602 Author: Luxiao Xu Date: Mon May 11 18:52:09 2026 +0200 batman-adv: fix tp_meter counter underflow during shutdown batadv_tp_sender_shutdown() unconditionally decrements the "sending" atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1. Since the sender logic treats any non-zero value as "still sending", a negative value causes the sender kthread to loop indefinitely. This leads to a use-after-free when the interface is removed while the zombie thread is still active. Fix this by using atomic_xchg() to ensure the counter only transitions from 1 to 0 once. Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Luxiao Xu Signed-off-by: Ren Wei [sven: added missing change in batadv_tp_send] Signed-off-by: Sven Eckelmann commit a65855ec34aed84e1e5b4aea0323cc1745f83a5c Author: Jens Axboe Date: Mon May 11 10:58:56 2026 -0600 io_uring: hold uring_lock across io_kill_timeouts() in cancel path io_uring_try_cancel_requests() dropped ctx->uring_lock before calling io_kill_timeouts(), which walks each timeout's link chain via io_match_task() to test REQ_F_INFLIGHT. With chain mutation now serialized by ctx->uring_lock, that walk needs the lock too. Signed-off-by: Jens Axboe commit 49ae66eb8c27375075ffa308cfd4bf25af335d41 Author: Jens Axboe Date: Mon May 11 10:58:50 2026 -0600 io_uring: defer linked-timeout chain splice out of hrtimer context io_link_timeout_fn() is the hrtimer callback that fires when a linked timeout expires. It currently calls io_remove_next_linked(prev) under ctx->timeout_lock to splice the timeout request out of the link chain. This is the only chain-mutation site that runs without ctx->uring_lock, because hrtimer callbacks cannot take a mutex. Defer the splicing until the task_work callback. Signed-off-by: Jens Axboe commit 20c39819a27646573dfa0ac0d01c38895298a6f6 Author: Jens Axboe Date: Mon May 11 10:58:38 2026 -0600 io_uring: hold uring_lock when walking link chain in io_wq_free_work() io_wq_free_work() calls io_req_find_next() from io-wq worker context, which reads and clears req->link without holding any lock. This can potentially race with other paths that mutate the same chain under ctx->uring_lock. Take ctx->uring_lock around the io_req_find_next() call. Only requests with IO_REQ_LINK_FLAGS reach this path, which is not the hot path. Signed-off-by: Jens Axboe commit 37953cec775ed34e59cf9a7d7bb9b0610daa3f3e Author: Maurizio Lombardi Date: Fri May 8 15:33:29 2026 +0200 nvme: fix race condition between connected uevent and STARTED_ONCE flag When a controller connects, nvme_start_ctrl() emits the "NVME_EVENT=connected" uevent and sets the NVME_CTRL_STARTED_ONCE flag. Currently, the uevent is emitted before the flag is set. This creates a race condition for userspace tools (like udev rules) that might rely on the "connected" event to configure other attributes. Swap the order of operations in nvme_start_ctrl() so that the NVME_CTRL_STARTED_ONCE flag is set before the uevent is sent. This guarantees that the admin_timeout can already be changed when userspace is notified. Reviewed-by: Sagi Grimberg Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Reviewed-by: Daniel Wagner Signed-off-by: Maurizio Lombardi Signed-off-by: Keith Busch commit e4865a56d013e86e46ea6acea15bb6eae01898ff Author: Rafael J. Wysocki Date: Fri May 8 20:04:33 2026 +0200 ACPI: driver: Check ACPI_COMPANION() against NULL during probe Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), platform drivers that rely on the existence of a device's ACPI companion object should verify its presence. Accordingly, add requisite ACPI_COMPANION() or ACPI_HANDLE() checks against NULL to 13 platform drivers handling core ACPI devices. Also change the value returned by the ACPI thermal zone driver when the device's ACPI companion is not present to -ENODEV for consistency with the other drivers. Signed-off-by: Rafael J. Wysocki Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/4516068.ejJDZkT8p0@rafael.j.wysocki Cc: 7.0+ # 7.0+ commit c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891 Author: Jann Horn Date: Mon May 11 08:55:11 2026 -0700 exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dead() calls __schedule(), which has a comment saying "WARNING: must be called with preemption disabled!". If an oopsing task is preempted in do_task_dead(), between becoming TASK_DEAD and entering the scheduler explicitly, bad things happen: finish_task_switch() assumes that once the scheduler has switched away from a TASK_DEAD task, the task can never run again and its stack is no longer needed; but that assumption apparently doesn't hold if the dead task was preempted (the SM_PREEMPT case). This means that the scheduler ends up repeatedly dropping references on the dead task's stack, which can lead to use-after-free or double-free of the entire task stack; in other words, two tasks can end up running on the same stack, resulting in various kinds of memory corruption. (This does not just affect "recursively oopsing" tasks; it is enough to oops once during task exit, for example in a file_operations::release handler) Fixes: 7f80a2fd7db9 ("exit: Stop poorly open coding do_task_dead in make_task_dead") Cc: stable@kernel.org Signed-off-by: Jann Horn Acked-by: Peter Zijlstra Signed-off-by: Linus Torvalds commit d25e65a8b89725e9745bfc3acd738cdec3818a07 Merge: 5d6919055dec13 344a00712ce1bc Author: Alexei Starovoitov Date: Mon May 11 08:27:02 2026 -0700 Merge branch 'bpf-fix-call-offset-truncation-and-oob-read-in-bpf_patch_call_args' Yazhou Tang says: ==================== bpf: Fix call offset truncation and OOB read in bpf_patch_call_args() From: Yazhou Tang This patchset addresses a silent truncation bug in the BPF verifier that occurs when a bpf-to-bpf call involves a massive relative jump offset. Additionally, it fixes a pre-existing out-of-bounds (OOB) read issue in the interpreter fallback path. Because the BPF instruction set utilizes a 32-bit imm field for bpf-to-bpf calls, implicitly downcasting it to the 16-bit insn->off in bpf_patch_call_args() causes incorrect call targets or subprog ID resolution for large BPF programs. While fixing this by swapping the imm and off fields, it was discovered that the original code also had a load-time OOB read vulnerability when the stack depth exceeds MAX_BPF_STACK during JIT fallback. Patch 1/3 fixes the pre-existing OOB read in bpf_patch_call_args(). It changes the function to return an int and explicitly rejects the JIT fallback if the stack depth exceeds MAX_BPF_STACK, preventing a potential stack buffer overflow. Patch 2/3 fixes the s16 truncation bug. 1. Keep the original imm field unchanged and use the off field to store the interpreter function index. 2. Adjust the JMP_CALL_ARGS case in ___bpf_prog_run() accordingly. 3. Restore the legacy xlated dump layout in bpf_insn_prepare_dump(). Patch 3/3 introduces a selftest for this fix. --- Change log: v10: 1. Make the error log in patch 1/3 more clear. (Kuohai) 2. Drop bpftool and disasm_helpers.c changes, and instead restore the legacy xlated dump layout in bpf_insn_prepare_dump(). This avoids requiring bpftool compatibility handling. (Quentin and Alexei) v9: https://lore.kernel.org/bpf/20260429171904.107244-1-tangyazhou@zju.edu.cn/ 1. Modify the selftest in patch 3/3: use __clobber_all in inline asm. (Sashiko AI reviewer) v8: https://lore.kernel.org/bpf/20260429105608.92741-1-tangyazhou@zju.edu.cn/ 1. Update cfg_partition_funcs() in bpftool to use insn->imm for call target calculation. (Sashiko AI reviewer) 2. Modify the selftest in patch 3/3: add a large padding before the call instruction, preventing the kernel panic on kernel without the fix. (Sashiko AI reviewer) 3. Modify the selftest in patch 3/3: make it more clear. v7: https://lore.kernel.org/bpf/20260421144504.823756-1-tangyazhou@zju.edu.cn/ 1. Rebase the patchset to the bpf-next tree to resolve the apply conflict. (Alexei) 2. Add Patch 1/3 to properly fix a pre-existing OOB read in bpf_patch_call_args(). (Sashiko AI reviewer) v6: https://lore.kernel.org/bpf/20260412170334.716778-1-tangyazhou@zju.edu.cn/ 1. Use a different but clearer approach to resolve this issue: keeping the original imm field unchanged and using the off field to store the interpreter function index. (Kuohai) 2. Update the related dumper code and remove a previous workaround in the selftests disasm helpers, which is no longer needed after this fix. v5: https://lore.kernel.org/bpf/20260326090133.221957-1-tangyazhou@zju.edu.cn/ 1. Some minor changes in commit messages. (AI Reviewer) v4: https://lore.kernel.org/bpf/20260326063329.10031-1-tangyazhou@zju.edu.cn/ 1. Remove some redundant commit messages of patch 2/3. (Emil) 2. Change the number of instructions in padding_subprog() from 200,000 to 32,765, which is the minimum number of instructions required to trigger the verifier failure. (Emil) v3: https://lore.kernel.org/bpf/20260323122254.98540-1-tangyazhou@zju.edu.cn/ 1. Resend to fix a typo in v2 and add "Fixes" tag. The rest of the changes are identical to v2. v2 (incorrect): https://lore.kernel.org/bpf/20260323081748.106603-1-tangyazhou@zju.edu.cn/ 1. Move the s16 boundary check from fixup_call_args() to bpf_patch_call_args(), and change the return type of bpf_patch_call_args() to int. (Emil) 2. Add Patch 3/3 to fix the incorrect subprog ID in dumped bpf_pseudo_call instructions, which is caused by the same truncation issue. (Puranjay) 3. Refine the new selftest for clarity and add detailed comments explaining the test design. (Emil) v1: https://lore.kernel.org/bpf/20260316190220.113417-1-tangyazhou@zju.edu.cn/ ==================== Link: https://patch.msgid.link/20260506094714.419842-1-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov commit 344a00712ce1bce8db72b0eadc1595dede31565a Author: Yazhou Tang Date: Wed May 6 17:47:14 2026 +0800 selftests/bpf: Add test for large offset bpf-to-bpf call Add a selftest to verify the verifier and JIT behavior when handling bpf-to-bpf calls with relative jump offsets exceeding the s16 boundary. The test utilizes an inline assembly block with ".rept 32765" to generate a massive dummy subprogram. By placing this padding between the main program and the target subprogram, it forces the verifier to process a bpf-to-bpf call where the imm field exceeds the s16 range. - When JIT is enabled, it asserts that the program is successfully loaded and executes correctly to return the expected value. Since the fix does not change the JIT behavior, the test passes whether the fix is applied or not. - When JIT is disabled, it also asserts that the program is successfully loaded and executes correctly to return the expected value 3. - Before the fix, the verifier rewrites the call instruction with a truncated offset (here 32768 -> -32768) and lets it pass. When the program is executed, the call instruction will go to a wrong target (the landing pad) instead of the intended subprogram, then return -1 and fail. - After the fix, the verifier correctly handles the large offset and allows it to pass. The program then executes correctly to return the expected value 3. Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Signed-off-by: Yazhou Tang Acked-by: Xu Kuohai Link: https://lore.kernel.org/r/20260506094714.419842-4-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov commit 58a8f3e2501dc14b8e00e883d6aaf0600a239da7 Author: Yazhou Tang Date: Wed May 6 17:47:13 2026 +0800 bpf: Fix s16 truncation for large bpf-to-bpf call offsets Currently, the BPF instruction set allows bpf-to-bpf calls (or internal calls, pseudo calls) to use a 32-bit imm field to represent the relative jump offset. However, when JIT is disabled or falls back to the interpreter, the verifier invokes bpf_patch_call_args() to rewrite the call instruction. In this function, the 32-bit imm is downcast to s16 and stored in the off field. void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth) { stack_depth = max_t(u32, stack_depth, 1); insn->off = (s16) insn->imm; insn->imm = interpreters_args[(round_up(stack_depth, 32) / 32) - 1] - __bpf_call_base_args; insn->code = BPF_JMP | BPF_CALL_ARGS; } If the original imm exceeds the s16 range (i.e., a jump offset greater than 32767 instructions), this downcast silently truncates the offset, resulting in an incorrect call target. Fix this by: 1. In bpf_patch_call_args(), keeping the imm field unchanged and using the off field to store the index of the interpreter function. 2. In ___bpf_prog_run() for the JMP_CALL_ARGS case, retrieving the interpreter function pointer from the interpreters_args array using the off field as the index, and passing the original imm to calculate the last argument of the interpreter function. After these changes, the truncation issue is resolved, and __bpf_call_base_args is also no longer needed and can be removed, which makes the code cleaner. Performance: In ___bpf_prog_run() for the JMP_CALL_ARGS case, changing the retrieval of the interpreter function pointer from pointer addition to direct array indexing improves performance. The possible reason is that the latter has better instruction-level parallelism. See the v5 discussion [1] for more details. [1] https://lore.kernel.org/bpf/f120c3c4-6999-414a-b514-518bb64b4758@zju.edu.cn/ To avoid requiring bpftool changes, keep the new imm/off encoding internal and restore the legacy xlated dump layout in bpf_insn_prepare_dump(). For bpf-to-bpf call offsets that do not fit in s16, export off as 0 instead of a truncated and misleading value. Fixes: 1ea47e01ad6e ("bpf: add support for bpf_call to interpreter") Fixes: 7105e828c087 ("bpf: allow for correlation of maps and helpers in dump") Suggested-by: Xu Kuohai Suggested-by: Puranjay Mohan Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Signed-off-by: Yazhou Tang Link: https://lore.kernel.org/r/20260506094714.419842-3-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov commit 4314a44564eb1565349fed7a4192344c5f46fc85 Author: Yazhou Tang Date: Wed May 6 17:47:12 2026 +0800 bpf: Fix out-of-bounds read in bpf_patch_call_args() The interpreters_args array only accommodates stack depths up to MAX_BPF_STACK (512 bytes). However, do_misc_fixups() may allow a larger stack depth if JIT is requested. If JIT compilation later fails and falls back to the interpreter, the verifier invokes bpf_patch_call_args() with this oversized stack depth. This causes a load-time out-of-bounds (OOB) read when calculating the interpreter function pointer index. Fix this by changing bpf_patch_call_args() to return an int and explicitly rejecting the JIT fallback (returning -EINVAL) if the stack depth exceeds MAX_BPF_STACK. Fixes: 1ea47e01ad6e ("bpf: add support for bpf_call to interpreter") Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Signed-off-by: Yazhou Tang Acked-by: Xu Kuohai Link: https://lore.kernel.org/r/20260506094714.419842-2-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov commit 452d6fa37ae9b021f4f6d397dbae077f7296f6f4 Author: Viken Dadhaniya Date: Wed May 6 10:15:21 2026 +0530 serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ When uart_flush_buffer() runs before the DMA completion IRQ is delivered, the following race can occur (all steps serialized by uart_port_lock): 1. DMA starts: tx_remaining = N, kfifo contains N bytes 2. DMA completes in hardware; IRQ is pending but not yet delivered 3. uart_flush_buffer() acquires the port lock and calls kfifo_reset(), making kfifo_len() = 0 while tx_remaining remains N 4. uart_flush_buffer() releases the port lock 5. DMA IRQ fires; handle_tx_dma() acquires the port lock and calls uart_xmit_advance(uport, tx_remaining) on an empty kfifo uart_xmit_advance() increments kfifo->out by tx_remaining. Since kfifo_reset() already set both in and out to 0, out wraps past in, causing kfifo_len() to return UART_XMIT_SIZE - tx_remaining. The next start_tx_dma() call then submits a DMA transfer of stale buffer data. Fix this by snapshotting kfifo_len() at the start of handle_tx_dma() and skipping uart_xmit_advance() when fifo_len < tx_remaining, which indicates the kfifo was reset by a preceding flush. Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA") Cc: stable Signed-off-by: Viken Dadhaniya Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260506-serial-dma-stale-tx-buf-v1-1-e3ccb360d719@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 9a9254c4a2a3ca2b3da16d173f3b0dd01f397ff6 Author: Shitalkumar Gandhi Date: Mon Apr 20 19:29:03 2026 +0530 serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma lpuart_start_rx_dma() allocates sport->rx_ring.buf with kzalloc() and then maps a scatterlist via dma_map_sg(). On three subsequent error paths the function returns directly without releasing those resources: - when dma_map_sg() returns 0 (-EINVAL): ring->buf is leaked. - when dmaengine_slave_config() fails: ring->buf and the DMA mapping are leaked. - when dmaengine_prep_dma_cyclic() returns NULL: ring->buf and the DMA mapping are leaked. The sole cleanup path, lpuart_dma_rx_free(), is only reached when lpuart_dma_rx_use is set, and the caller lpuart_rx_dma_startup() clears that flag on failure of lpuart_start_rx_dma(). So these resources are permanently leaked on every failure in this function. Repeated port open/close or termios changes under error conditions will slowly consume memory and leave stale streaming DMA mappings behind. Fix it by introducing two error labels that unmap the scatterlist and free the ring buffer as appropriate. While here, replace the misleading -EFAULT (bad userspace pointer) returned when dmaengine_prep_dma_cyclic() fails with the more accurate -ENOMEM, matching how other dmaengine users in the tree treat this failure. No functional change on the success path. Fixes: 5887ad43ee02 ("tty: serial: fsl_lpuart: Use cyclic DMA for Rx") Cc: stable Signed-off-by: Shitalkumar Gandhi Reviewed-by: Frank Li Link: https://patch.msgid.link/20260420135903.2062024-1-shitalkumar.gandhi@cambiumnetworks.com Signed-off-by: Greg Kroah-Hartman commit 40df2172853ffc0f84cca3906f5c4d9a6131195d Author: AlanCui4080 Date: Fri May 8 17:59:12 2026 +0800 Revert "nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808" This reverts commit 7f991e3f9b8f044640bcb5fa8570350a68932843 ("nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808") The incorrect implementations of SUBNQN is a known issue in a massive number of NVMe units. However, the warning "nvme nvmex: missing or invalid SUBNQN field." is usually appropriate and will not affect performance or behavior etc. That is because the support for SUBNQN is mandatory if the controller supports NVMe revision 1.2.1 or greater, and it reported itself without a SUBNQN field which breaks compliance with the specification. It should be not quirked by the Linux Kernel. Signed-off-by: Alan Cui Signed-off-by: Keith Busch commit dbbd07d0a7020b80f6a7028e561908f7b83b3d5a Author: Sagi Grimberg Date: Sun May 10 23:30:29 2026 +0300 nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which performs percpu_ref_put() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command — a double percpu_ref_put against a single percpu_ref_get. Reported-by: Shivam Kumar Reviewed-by: Christoph Hellwig Signed-off-by: Sagi Grimberg Signed-off-by: Keith Busch commit b35a13036755c5803168a7cb93bc66035c3e65b8 Author: Chia-Lin Kao (AceLan) Date: Wed Apr 29 16:11:16 2026 +0800 nvme-pci: fix use-after-free in nvme_free_host_mem() nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous() but never clears the pointer afterward. This leads to a use-after-free if nvme_free_host_mem() is called twice in the same error path. This can happen during nvme_probe() when nvme_setup_host_mem() succeeds in allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem() fails with an I/O error: nvme_setup_host_mem() nvme_alloc_host_mem_single() -> sets dev->hmb_sgt nvme_set_host_mem() -> fails with -EIO nvme_free_host_mem() -> frees hmb_sgt, but does NOT NULL it return error nvme_probe() error path: nvme_free_host_mem() -> dev->hmb_sgt is stale, use-after-free The second call dereferences the freed sgt, causing a NULL pointer dereference in iommu_dma_free_noncontiguous() when it accesses sgt->sgl->dma_address (the backing memory has been freed and zeroed). This is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC Envoy Express behind a Dell WD22TB4 dock) where the device intermittently returns I/O errors during HMB setup due to PCIe link instability. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80 Call Trace: dma_free_noncontiguous+0x3b/0x130 nvme_free_host_mem+0x30/0xf0 [nvme] nvme_probe.cold+0xcc/0x275 [nvme] local_pci_probe+0x43/0xa0 pci_device_probe+0xeea/0x290 really_probe+0xf9/0x3b0 __driver_probe_device+0x8b/0x170 driver_probe_device+0x24/0xd0 __driver_attach_async_helper+0x6b/0x110 async_run_entry_fn+0x37/0x170 process_one_work+0x1ac/0x3d0 worker_thread+0x1b8/0x360 kthread+0xf7/0x130 ret_from_fork+0x2d8/0x3a0 ret_from_fork_asm+0x1a/0x30 Fix this by setting dev->hmb_sgt to NULL after freeing it, so the second call takes the multi-descriptor path which safely handles the already-cleaned-up state. Fixes: 63a5c7a4b4c4 ("nvme-pci: use dma_alloc_noncontigous if possible") Signed-off-by: Chia-Lin Kao (AceLan) Signed-off-by: Keith Busch commit a891962ae5e48fb5476c23631df759482e62ab16 Author: Hannes Reinecke Date: Thu Apr 30 15:22:32 2026 +0200 nvmet-auth: Do not print DH-HMAC-CHAP secrets From a security standpoint we should not allow to print out the DH-HMAC-CHAP secrets, but at the same time having them is useful for debugging authentication failures. So add a Kconfig option NVME_TARGET_AUTH_DEBUG to only enable debugging if explictly requested at build time. Reviewed-by: Sagi Grimberg Signed-off-by: Hannes Reinecke Signed-off-by: Keith Busch commit 2279cd9c61a330e5de4d6eb0bc422820dd6fdf36 Author: Keith Busch Date: Wed May 6 06:16:02 2026 -0700 nvme: fix bio leak on mapping failure The local bio is always NULL, so we'd leak the bio if the integrity mapping failed. Just get it directly from the request. Fixes: d0d1d522316e91f ("blk-map: provide the bdev to bio if one exists") Reviewed-by: Sagi Grimberg Reviewed-by: John Garry Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit ce28b772c3c28fb1c62a81533045ae90ed3b496c Author: Keith Busch Date: Wed May 6 06:05:14 2026 -0700 nvme: make prp passthrough usage less scary The warning is a bit alarming, and it only prints for the very first non-sgl capable device that receives a passthrough command. Just log an informational message on initial discovery for every device. Reviewed-by: Jens Axboe Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 1e5b50c78d10119be08bf8f7a11d8ea333dd113a Author: Johan Hovold Date: Wed May 6 14:43:23 2026 +0200 tty: add missing tty_driver include to tty_port.h Include the definition of struct tty_driver in tty_port.h to keep the header self-contained and avoid build breakage in case anyone includes it before tty_driver.h. Fixes: eb3b0d92c9c3 ("tty: tty_port: add workqueue to flip TTY buffer") Cc: Xin Zhao Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260506124323.186703-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit ca2584d841b69391ffc4144840563d2e1a0018df Author: Prasanna S Date: Tue Apr 28 09:56:13 2026 +0530 serial: qcom-geni: fix UART_RX_PAR_EN bit position UART_RX_PAR_EN is incorrectly defined as bit 3, which triggers false framing errors (S_GP_IRQ_1_EN) and causes received data to be dropped when parity is enabled and the parity bit is 0. Define UART_RX_PAR_EN as bit 4 of the SE_UART_RX_TRANS_CFG register, as specified in the reference manual. Fixes: c4f528795d1a ("tty: serial: msm_geni_serial: Add serial driver support for GENI based QUP") Cc: stable Signed-off-by: Prasanna S Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260428-serial-bit-correct-v1-1-9131ad5b97d8@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 92b1ea22454b08a39baef3a7290fb3ec50366616 Author: Hongling Zeng Date: Tue Apr 21 14:57:37 2026 +0800 serial: sh-sci: fix memory region release in error path The sci_request_port() function uses request_mem_region() to reserve I/O memory, but in the error path when sci_remap_port() fails, it incorrectly calls release_resource() instead of release_mem_region(). This mismatch can cause resource accounting issues. Fix it by using the correct release function, consistent with sci_release_port(). Fixes: e2651647080930a1 ("serial: sh-sci: Handle port memory region reservations.") Cc: stable Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202604032356.SzEjYkBC-lkp@intel.com/ Signed-off-by: Hongling Zeng Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260421065737.724187-1-zenghongling@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit 6fe472c1bbbe238e91141f7cabc1226e96a60d43 Author: Zhaoyang Yu <2426767509@qq.com> Date: Thu Apr 9 13:41:58 2026 +0800 tty: serial: pch_uart: add check for dma_alloc_coherent() Add a check for dma_alloc_coherent() failure to prevent a potential NULL pointer dereference in dma_handle_rx(). Properly release DMA channels and the PCI device reference using a goto ladder if the allocation fails. Fixes: 3c6a483275f4 ("Serial: EG20T: add PCH_UART driver") Cc: stable Signed-off-by: Zhaoyang Yu <2426767509@qq.com> Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/tencent_E328416B7CFD436F6029F2DF02AD7ED89C08@qq.com Signed-off-by: Greg Kroah-Hartman commit d15cd40cb1858f75846eaafa9a6bca841b790a92 Author: Maciej W. Rozycki Date: Fri Apr 10 18:19:31 2026 +0100 serial: zs: Fix swapped RI/DSR modem line transition counting Fix a thinko in the status interrupt handler that has caused counters for the RI and DSR modem line transitions to be used for the other line each. Fixes: 8b4a40809e53 ("zs: move to the serial subsystem") Cc: stable Signed-off-by: Maciej W. Rozycki Link: https://patch.msgid.link/alpine.DEB.2.21.2604101747110.29980@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman commit 5a52c5701a67d5176eb1afbf1bdaf7d6dfeec597 Author: Kamal Dasu Date: Thu Apr 23 15:18:55 2026 -0400 mmc: core: Fix host controller programming for fixed driver type When using the fixed-emmc-driver-type device tree property, the MMC core correctly selects the driver strength for the card but fails to program the host controller accordingly. This causes a mismatch where the card uses the specified driver type while the host controller defaults to Type B (since ios->drv_type remains zero). Split the driver type programming logic to handle both fixed and dynamic driver type selection paths. For fixed driver types, program the host controller with the selected drive_strength value. For dynamic selection, use the existing drv_type as before. This ensures both the eMMC device and host controller use matching driver strengths, preventing potential signal integrity issues. Fixes: 6186d06c519e ("mmc: parse new binding for eMMC fixed driver type") Signed-off-by: Kamal Dasu Reviewed-by: Shawn Lin Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 2beaa98b46c4cc90ed8a674f27a586d7f547bbe5 Author: DaeMyung Kang Date: Mon May 11 02:11:14 2026 +0900 ntfs: restore $MFT mirror contents check check_mft_mirror() still computes the number of bytes to validate in each mirrored MFT record, but the actual comparison against $MFTMirr was dropped when the superblock code was updated. As a result, mount misses a stale or inconsistent $MFTMirr as long as both records pass the structural baad-record checks. Restore the comparison and log an error when the primary $MFT record differs from its mirror copy. Returning false lets the existing mount error handling mark the volume as having NTFS errors and, with on_errors=remount-ro, continue read-only. The default on_errors=continue mount policy still allows the mount to proceed. Fixes: 6251f0b0de7d ("ntfs: update super block operations") Signed-off-by: DaeMyung Kang Signed-off-by: Namjae Jeon commit 91840be8f710370607f949a627e070896faeddb8 Author: Jiayuan Chen Date: Mon Mar 30 15:32:29 2026 +0800 irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0. After irq_work_single() clears BUSY via atomic_cmpxchg(), it still dereferences @work for irq_work_is_hard() and rcuwait_wake_up(). An irq_work_sync() caller on another CPU that enters after BUSY is cleared can observe BUSY==0 immediately, return, and free the work before those accesses complete — causing a use-after-free. Fix this by wrapping run_irq_workd() in guard(rcu)() so that the entire irq_work_single() execution is within an RCU read-side critical section. Then add synchronize_rcu() in irq_work_sync() after rcuwait_wait_event() to ensure the caller waits for the RCU grace period before returning, preventing premature frees. Fixes: 810979682ccc ("irq_work: Allow irq_work_sync() to sleep if irq_work() no IRQ support.") Suggested-by: Sebastian Andrzej Siewior Suggested-by: Steven Rostedt Signed-off-by: Jiayuan Chen Signed-off-by: Thomas Gleixner Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20260330073234.303732-1-jiayuan.chen@linux.dev commit ea34567db0a6b3a7ce78ba421592344315c8f90e Author: Peter Oberparleiter Date: Thu May 7 16:27:08 2026 +0200 s390/cio: Restore GFP_DMA for CHSC allocation Re-add GFP_DMA when allocating memory for CHSC control blocks. On some supported machines, CHSC cannot access memory outside the DMA zone, causing CHSC command failures. Cc: stable@vger.kernel.org Fixes: a3a64a4def8d ("s390/cio: remove unneeded DMA zone allocation") Signed-off-by: Peter Oberparleiter Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 2997606dd17729404cef9821ce66dd037b6019eb Author: Paolo Pisati Date: Fri May 8 09:09:56 2026 +0200 platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8407AA Use the existing zenbook duo keyboard quirk for the UX8407AA model too. Signed-off-by: Paolo Pisati Reviewed-by: Denis Benato Link: https://patch.msgid.link/20260508070956.62201-1-p.pisati@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0d5dc5818191b55e4364d04b1b898a14a2ccac38 Author: Harshal Dev Date: Thu Apr 16 17:29:19 2026 +0530 soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE Since Qualcomm inline-crypto engine (ICE) is now a dedicated driver de-coupled from the QCOM UFS driver, it explicitly votes for its required clocks during probe. For scenarios where the 'clk_ignore_unused' flag is not passed on the kernel command line, to avoid potential unclocked ICE hardware register access during probe the ICE driver should additionally vote on the 'iface' clock. Also update the suspend and resume callbacks to handle un-voting and voting on the 'iface' clock. Fixes: 2afbf43a4aec6 ("soc: qcom: Make the Qualcomm UFS/SDCC ICE a dedicated driver") Reviewed-by: Manivannan Sadhasivam Reviewed-by: Kuldeep Singh Reviewed-by: Konrad Dybcio Signed-off-by: Harshal Dev Link: https://lore.kernel.org/r/20260416-qcom_ice_power_and_clk_vote-v5-2-5ccf5d7e2846@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e13617b59472fa2590e1bf0d1acbb781dd7dd7f1 Merge: 254f49634ee16a e27264daac7d9c Author: Bjorn Andersson Date: Mon May 11 09:05:50 2026 -0500 Merge branch '20260416-qcom_ice_power_and_clk_vote-v5-1-5ccf5d7e2846@oss.qualcomm.com' into drivers-fixes-for-7.1 Merge the qcom,ice DeviceTree binding update through a topic branch to allow sharing it with the DeviceTree branch. commit e27264daac7d9ce892a2a5b4a864d6d9a3c9276a Author: Harshal Dev Date: Thu Apr 16 17:29:18 2026 +0530 dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk The DT bindings for inline-crypto engine do not specify the UFS_PHY_GDSC power-domain and iface clock. Without enabling the iface clock and the associated power-domain the ICE hardware cannot function correctly and leads to unclocked hardware accesses being observed during probe. Fix the DT bindings for inline-crypto engine to require the UFS_PHY_GDSC power-domain and iface clock for new devices (Eliza and Milos) introduced in the current release (7.1) with yet-to-stabilize ABI, while preserving backward compatibility for older devices. Fixes: 618195a7ac3df ("dt-bindings: crypto: qcom,inline-crypto-engine: Document the Eliza ICE") Fixes: 85faec1e85555 ("dt-bindings: crypto: qcom,inline-crypto-engine: document the Milos ICE") Reviewed-by: Kuldeep Singh Reviewed-by: Krzysztof Kozlowski Signed-off-by: Harshal Dev Link: https://lore.kernel.org/r/20260416-qcom_ice_power_and_clk_vote-v5-1-5ccf5d7e2846@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 99269799bf2448aebccee164df56c22a7b85b02c Author: Thomas Richter Date: Tue May 5 12:34:33 2026 +0200 s390/pai: Fix missing PAI counter increments under heavy load Machines with a larger number of CPUs and under heavy load sometimes loose PAI counter increments during recording using events -e CRYPTO_ÂLL or -e NNPA_ALL. Counting is not affected. This happens when several PAI crypto counters are incremented during the same cryptographic operation. During schedule out the functions paiXXX_sched_task() (with XXX either crypt or ext) +--> pai_have_samples() +--> pai_have_sample() +--> pai_copy() +--> pai_push_sample() are called to read out PAI counter values. In pai_copy() the current values of PAI counters are read from the PMU memory mapped page and compared to the values read during last schedule out operation, which have been saved in a backup page named PAI_SAVE_AREA(event). For each PAI counter a delta is calculated and when the delta is positive, that PAI counter was incremented by hardware. This positve delta is reported as raw data record attached to a sample. After all deltas have been calculated, the new PAI counter values are saved in the backup page PAI_SAVE_AREA(event). However this is done in pai_push_sample(), leaving a small window for missing hardware triggered updates. Here is one scenario: PAI counter idx: 0 1 2 3 4 5 6 7 .... N +---+---+---+---+---+---+---+---+ +---+ PAI counter page:| | | X | | | | | |....| Y | +---+---+---+---+---+---+---+---+ +---+ In pai_copy() each PAI counter value is read and compared to its old value. This is done in a loop. When PAI counter indexed N is read, the hardware might increment PAI counter indexed 2 again, updating its value from X to X+1. Later pai_push_sample() simply mem-copies the complete PAI counter page to a backup page and the increment of X+1 is lost, because the backup page now contains the new value. Read each PAI counter and save this value in the backup page when there is a positive delta. This omits any time window between read and store. This also reduced the work load as only modified PAI counters are saved. Cc: stable@vger.kernel.org Fixes: fe861b0c8d06 ("s390/pai: save PAI counter value page in event structure") Signed-off-by: Thomas Richter Reviewed-by: Sumanth Korikkar Signed-off-by: Alexander Gordeev commit 725ecd80688bf3c57ca9205431f2c06174ff0756 Author: Zhihao Cheng Date: Thu May 7 19:23:01 2026 +0800 nsfs: fix wrong error code returned for pidns ioctls When executing NS_GET_PID_FROM_PIDNS (or similar pidns ioctls), if the target task cannot be found in the corresponding pid_ns, the error code should be ESRCH instead of ENOTTY. This bug was introduced when the extensible ioctl handling was added. Without proper return, ret would be overwritten by the default case in the extensible ioctl switch statement. Fixes: a1d220d9dafa8 ("nsfs: iterate through mount namespaces") Signed-off-by: Zhihao Cheng Link: https://patch.msgid.link/20260507112301.1042757-1-chengzhihao1@huawei.com Reviewed-by: Yang Erkun Signed-off-by: Christian Brauner commit 1860c2f85922917d8a46f16a6f4bd2298ffa0fb5 Author: Ming Lei Date: Sun May 10 22:48:43 2026 +0800 ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation blk_validate_limits() requires max_hw_sectors >= PAGE_SECTORS and fires a WARN_ON_ONCE if this invariant is violated. ublk_validate_params() only checked the upper bound of max_sectors against max_io_buf_bytes, allowing userspace to pass small values (including zero) that trigger the warning when blk_mq_alloc_disk() is called from ublk_ctrl_start_dev(). Before 494ea040bcb5, ublk used blk_queue_max_hw_sectors() which silently clamped small values up to PAGE_SECTORS. The conversion to passing queue_limits directly to blk_mq_alloc_disk() lost that clamping and now hits blk_validate_limits()'s WARN_ON_ONCE instead. Validate that max_sectors is at least PAGE_SECTORS in ublk_validate_params() so invalid values are rejected early with -EINVAL instead of reaching the block layer. Fixes: 494ea040bcb5 ("ublk: pass queue_limits to blk_mq_alloc_disk") Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260510144843.769031-1-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 3799c2570982577551023ae035f5a786cf39a76e Author: Maoyi Xie Date: Sun May 10 16:41:19 2026 +0800 io_uring/fdinfo: translate SqThread PID through caller's pid_ns SQPOLL stores current->pid (init_pid_ns view) in sqd->task_pid at thread creation. fdinfo prints it raw via seq_printf("SqThread:\t%d\n", sq_pid). A reader inside a non-initial pid_ns sees the host PID, not the kthread's PID in the reader's own pid_ns. The SQPOLL kthread is created with CLONE_THREAD and no CLONE_NEW*, so it lives in the submitter's pid_ns. An unprivileged user_ns + pid_ns submitter can read fdinfo and learn the host PID of a kthread whose in-namespace PID is different. Reproducer (mainline 7.0, KASAN): unshare CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNS, mount a private /proc, then have a grandchild that is pid 1 in the new pid_ns open an io_uring ring with IORING_SETUP_SQPOLL. /proc/self/task lists {1, 2}; the SQPOLL kthread is pid 2. Before: fdinfo prints SqThread = . After: SqThread = 2. Use task_pid_nr_ns() against the proc inode's pid_ns to compute sq_pid, instead of reading the stored sq->task_pid (which holds the init_pid_ns view). pidfd_show_fdinfo() in kernel/pid.c follows the same pattern. Signed-off-by: Maoyi Xie Link: https://patch.msgid.link/20260510084119.457578-1-maoyi.xie@ntu.edu.sg Signed-off-by: Jens Axboe commit 834e98acb748025c04fed3cac9c8954454f4b520 Author: Pankaj Raghav Date: Mon May 11 13:19:18 2026 +0200 fs: fix forced iversion increment on lazytime timestamp updates When updating timestamps with lazytime enabled, if only I_DIRTY_TIME is set (pure lazytime update), inode_maybe_inc_iversion() should not be forced to increment i_version. The force parameter should only be true when actual data or metadata changes require an iversion bump. The current code uses "!!dirty" which evaluates to true whenever dirty has any bits set, including the I_DIRTY_TIME bit alone. This forces an iversion increment on every lazytime timestamp update, which then sets I_DIRTY_SYNC, triggering expensive log flushes on subsequent fdatasync calls. Andres reported this issue when he noticed a perf regression[1]. Fix this by using "dirty != I_DIRTY_TIME" as the force parameter. This passes false for pure lazytime updates (allowing the I_VERSION_QUERIED optimization to work), while still forcing the increment when dirty contains other flags indicating real changes that require iversion updates. [1] https://lore.kernel.org/linux-xfs/7ys6erh3nnyeerv2nybyfvp7dmaknuxrlxv74wx56ocdothkc6@ekfiadtkfn2r/ Fixes: 85c871a02b03 ("fs: add support for non-blocking timestamp updates") Signed-off-by: Pankaj Raghav Link: https://patch.msgid.link/20260511111918.1793689-1-p.raghav@samsung.com Reviewed-by: Jeff Layton Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Christian Brauner commit cefafbd561402b0fe6447449364a30315b9b1570 Author: Yong-Xuan Wang Date: Fri May 8 02:31:21 2026 -0700 irqchip/riscv-imsic: Clear interrupt move state during CPU offlining Affinity changes of IMSIC interrupts have to be careful to not lose an interrupt in the process. Each vector keeps track of an affinity change in progress with two pointers in struct imsic_vector. imsic_vector::move_prev points to the previous CPU target data and imsic_vector::move_next to the designated new CPU target data. imsic_vector::move_prev on the new CPU can only be cleared after the previous CPU has cleared imsic_vector::move_next, which ususally happens in __imsic_remote_sync(). In case of CPU hot-unplug __imsic_remote_sync() is not invoked because the CPU is already marked offline. That means imsic_vector::move_prev becomes stale until the CPU is onlined again. The stale pointer prevents further affinity changes for the affected interrupts. Solve this by clearing the imsic_vector::move_prev pointers in the CPU hotplug offline path. [ tglx: Replace word salad in change log ] Fixes: 0f67911e821c ("irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector") Signed-off-by: Yong-Xuan Wang Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260508-imsic-v2-1-e9f08dd46cf5@sifive.com commit 5363b67ac8ebcc3e227dbf59fc8061949109841d Author: Xianwei Zhao Date: Fri May 8 07:36:54 2026 +0000 irqchip/meson-gpio: Use the correct register in meson_s4_gpio_irq_set_type() meson_s4_gpio_irq_set_type() uses the both-edge trigger register for configuring level type and single edge mode interrupts, which is not correct. Use REG_EDGE_POL instead. Fixes: bbd6fcc76b39 ("irqchip: Add support for Amlogic A4 and A5 SoCs") Signed-off-by: Xianwei Zhao Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260508-a9-gpio-irqchip-v1-1-9dc5f3e022e0@amlogic.com commit 0fa10fb77069fb67aa51384868ef3702b7791465 Author: Rosen Penev Date: Wed May 6 01:55:22 2026 -0700 irqchip/ath79-cpu: Remove unused function ath79_cpu_irq_init() was part of the legacy pre-OF code that got removed a while back. Remove it to get rid of a missing prototype warning, reported by the kernel test robot. [ tglx: Fix the subject prefix. Sigh ... ] Fixes: 51fa4f8912c0 ("MIPS: ath79: drop legacy IRQ code") Reported-by: kernel test robot Signed-off-by: Rosen Penev Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260506085522.1210143-1-rosenp@gmail.com Closes: https://lore.kernel.org/oe-kbuild-all/202412011509.kGQkDr1y-lkp@intel.com/ commit 512718bbc51b851140380b7068ec7365bd039cba Author: Mark Rutland Date: Thu May 7 12:05:18 2026 +0100 genirq/chip: Don't call add_interrupt_randomness() for NMIs Recently handle_percpu_devid_irq() was changed to call add_interrupt_randomness(). This introduced a potential deadlock when handle_percpu_devid_irq() is used to handle an NMI, which can be detected with lockdep, e.g. ================================ WARNING: inconsistent lock state 7.1.0-rc2-pnmi #465 Not tainted -------------------------------- inconsistent {INITIAL USE} -> {IN-NMI} usage. perf/695 [HC1[1]:SC0[0]:HE0:SE1] takes: ffff00837dfd3a18 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x6c/0xac {INITIAL USE} state was registered at: _raw_spin_lock_irqsave+0x68/0xb0 lock_timer_base+0x6c/0xac __mod_timer+0x100/0x32c add_timer_global+0x2c/0x40 __queue_delayed_work+0xf0/0x140 queue_delayed_work_on+0x134/0x138 mem_cgroup_css_online+0x30c/0x310 online_css+0x34/0x10c cgroup_init_subsys+0x158/0x1c8 cgroup_init+0x440/0x524 start_kernel+0x888/0x998 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&base->lock); lock(&base->lock); *** DEADLOCK *** Call trace: _raw_spin_lock_irqsave+0x68/0xb0 lock_timer_base+0x6c/0xac add_timer_on+0x78/0x16c add_interrupt_randomness+0x124/0x134 handle_percpu_devid_irq+0xd4/0x16c handle_irq_desc+0x40/0x58 generic_handle_domain_nmi+0x28/0x50 __gic_handle_nmi.isra.0+0x4c/0xa0 gic_handle_irq+0x38/0x2bc call_on_irq_stack+0x30/0x48 do_interrupt_handler+0x80/0x98 el1_interrupt+0x90/0xac el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x80/0x84 [...] During review, Thomas pointed out it wouldn't be safe for handle_percpu_devid_irq() to call add_interrupt_randomness() if it was used to handle NMIs: https://lore.kernel.org/lkml/87bjgik042.ffs@tglx/ ... but evidently people missed that handle_percpu_devid_irq() *is* used for NMIs. While it might seem that NMIs should be handled with a separate handle_percpu_devid_nmi() function, for various structural reasons this was impractical, and handle_percpu_devid_irq() has been expected to be used for NMIs since commits: 21bbbc50f398f ("irqchip/gic-v3: Switch high priority PPIs over to handle_percpu_devid_irq()") 5ff78c8de9d83 ("genirq: Kill handle_percpu_devid_fasteoi_nmi()") Taking the above into account, avoid the deadlock by not calling add_interrupt_randomness() when handle_percpu_devid_irq() is called in an NMI context. This is consistent with other NNI handling flows, which do not call add_interrupt_randomness(). At the same time, update the kernel-doc comment to make it clear that handle_percpu_devid_irq() can be called in NMI context. The rest of handle_percpu_devid_irq() is currently NMI safe and doesn't need to change. Fixes: fd7400cfcbaa ("genirq/chip: Invoke add_interrupt_randomness() in handle_percpu_devid_irq()") Reported-by: Ada Couprie Diaz Signed-off-by: Mark Rutland Signed-off-by: Thomas Gleixner Reviewed-by: Jinjie Ruan Reviewed-by: Marc Zyngier Link: https://patch.msgid.link/20260507110518.3128248-1-mark.rutland@arm.com commit a7c7e42654b6a8676610ee09d22901432c4851af Author: Sascha Bischoff Date: Wed May 6 09:37:43 2026 +0000 irqchip/gic-v5: Allocate ITS parent LPIs as a range The ITS MSI domain no longer manages LPI allocation directly. LPIs are allocated and freed by the parent LPI domain, which can now handle a full range of interrupts and unwind partial allocations internally. Make the ITS domain request and release the parent IRQs as a single range instead of iterating over each interrupt. The ITS allocation path then only needs to reserve EventIDs, allocate the parent range, and fill in the ITS irq_data for each MSI. Since no operation in the per-MSI loop can fail, the partial parent-free unwind becomes unnecessary. On teardown, reset the ITS irq_data for the range and then release the parent range in one call, leaving LPI teardown to the LPI domain. Fixes: 0f0101325876 ("irqchip/gic-v5: Add GICv5 LPI/IPI support") Signed-off-by: Sascha Bischoff Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Reviewed-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260506093634.382062-4-sascha.bischoff@arm.com commit eb6f6d523813ead9dc2799194a2839d42c049734 Author: Sascha Bischoff Date: Wed May 6 09:37:23 2026 +0000 irqchip/gic-v5: Support range allocation for LPIs The per-IPI parent allocation loop returns immediately on failure and leaks any parent interrupts allocated by earlier iterations. The GICv5 LPI domain now owns LPI allocation and teardown internally, but its irq_domain callbacks still reject requests where nr_irqs is greater than one. This forces child domains to allocate and free LPIs one at a time even when the interrupt core requests a contiguous range. Handle multi-interrupt allocation and teardown in the LPI domain by iterating over the requested range and unwinding any partially allocated state on failure. Allocate the parent LPIs for the IPI domain with a single range request as well, which cures the leakage problem. Fixes: 0f0101325876 ("irqchip/gic-v5: Add GICv5 LPI/IPI support") Signed-off-by: Sascha Bischoff Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Reviewed-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260506093634.382062-3-sascha.bischoff@arm.com commit dec85d2fbd20de3711a71e65397dfdb40c3fa953 Author: Sascha Bischoff Date: Wed May 6 09:37:02 2026 +0000 irqchip/gic-v5: Move LPI allocation into the LPI domain The IPI and ITS MSI domains currently allocate and release LPIs directly, then pass the selected LPI ID to the parent LPI domain. This leaks the LPI domain's allocation policy into its child domains and forces each child to duplicate part of the parent domain's teardown. Make the LPI domain allocate LPIs in its .alloc() callback and release them in a matching .free() callback. Child domains can then request a parent interrupt without passing an implementation-specific LPI ID, and the LPI lifetime is tied to the domain that owns the LPI namespace. Remove the gicv5_alloc_lpi() and gicv5_free_lpi() wrappers now that no external caller needs to manage LPIs directly. This is a preparatory change for an actual leakage problem in the allocation code and therefore tagged with the same Fixes tag. Fixes: 0f0101325876 ("irqchip/gic-v5: Add GICv5 LPI/IPI support") Signed-off-by: Sascha Bischoff Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Reviewed-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260506093634.382062-2-sascha.bischoff@arm.com commit 514ab98364595007d4557ecc85d7e5f012c504d3 Author: Salman Alghamdi Date: Sat May 9 01:26:14 2026 +0300 staging: rtl8723bs: fix buffer over-read in rtw_update_protection rtw_update_protection() is called with a pointer offset into the ies buffer but the full ie_length is passed, causing a potential buffer over-read. Fixes: e945c43df60b ("Staging: rtl8723bs: Delete dead code from update_current_network()") Fixes: d3fcee1b78a5 ("staging: rtl8723bs: fix camel case in struct wlan_bssid_ex") Reported-by: Luka Gejak Closes: https://lore.kernel.org/linux-staging/DI2H39EAAFBZ.3KI5NWN02AQ2S@linux.dev Cc: stable@vger.kernel.org Signed-off-by: Salman Alghamdi Reviewed-by: Luka Gejak Link: https://patch.msgid.link/20260508222649.23989-1-me@cipherat.com Signed-off-by: Greg Kroah-Hartman commit c3880a7b10e487e033dc6f388bda118436566f7a Author: Junxi Qian Date: Wed May 6 20:24:15 2026 +0800 fuse: fix writeback array overflow when max_pages is one fuse_iomap_writeback_range() appends one folio pointer and one fuse_folio_desc for every dirty range that is merged into the current writeback request. The merge decision checks the byte budget against fc->max_pages and fc->max_write, but it does not check whether the folio and descriptor arrays still have another free slot. This is not sufficient for fuseblk, where the filesystem block size can be smaller than PAGE_SIZE. With writeback cache enabled and max_pages negotiated as one, contiguous sub-page dirty ranges can fit within the byte budget while spanning more than one folio. The next append can then write past the one-slot folios and descs arrays. Split the request when the number of already attached folios has reached fc->max_pages. This keeps the folio/descriptor slot accounting in sync with the send decision. Fixes: ef7e7cbb323f ("fuse: use iomap for writeback") Cc: stable@vger.kernel.org Reviewed-by: Joanne Koong Signed-off-by: Junxi Qian Link: https://patch.msgid.link/20260506122415.205340-1-qjx1298677004@gmail.com Acked-by: Miklos Szeredi Signed-off-by: Christian Brauner commit a7cf1da7ac016490d6a1106f2aa6b602d34e9a12 Author: Hongling Zeng Date: Fri May 1 15:10:58 2026 +0800 fs: Fix return in jfs_mkdir and orangefs_mkdir Return NULL instead of passing to ERR_PTR while err is zero Fixes these smatch warnings: - fs/jfs/namei.c:311 jfs_mkdir() warn: passing zero to 'ERR_PTR' - fs/orangefs/namei.c:369 orangefs_mkdir() warn: passing zero to 'ERR_PTR' Fixes: 88d5baf69082 ("Change inode_operations.mkdir to return struct dentry *") Signed-off-by: Hongling Zeng Link: https://patch.msgid.link/20260501071058.1243245-1-zenghongling@kylinos.cn Reviewed-by: Jori Koolstra Signed-off-by: Christian Brauner commit a3bf0f28d4ba16e1f35f8c983bb04426b87e2a78 Author: Junyoung Jang Date: Mon May 4 20:26:49 2026 +0900 fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap statmount_mnt_idmap() writes one mapping with seq_printf() and then manually advances seq->count to include the NUL separator. If seq_printf() overflows, seq_set_overflow() sets seq->count to seq->size. The manual seq->count++ changes this to seq->size + 1. seq_has_overflowed() then no longer detects the overflow. The corrupted count returns to statmount_string(), which later executes: seq->buf[seq->count++] = '\0'; This causes a 1-byte NULL out-of-bounds write on the dynamically allocated seq buffer. Fix this by checking for overflow immediately after seq_printf(). Fixes: 37c4a9590e1e ("statmount: allow to retrieve idmappings") Signed-off-by: Junyoung Jang Link: https://patch.msgid.link/20260504112649.1862936-1-graypanda.inzag@gmail.com Signed-off-by: Christian Brauner commit 03bb5147da083cb91e5c8c2599fcb2f8fd05cb8f Author: Derek J. Clark Date: Sun May 10 04:25:39 2026 +0000 platform/x86: lenovo-wmi-other: Limit adding attributes to supported devices Adds lwmi_is_attr_01_supported, and only creates the attribute subfolder if the attribute is supported by the hardware. Due to some poorly implemented BIOS this is a multi-step sequence of events. This is because: - Some BIOS support getting the capability data from custom mode (0xff), while others only support it in no-mode (0x00). - Some BIOS support get/set for the current value from custom mode (0xff), while others only support it in no-mode (0x00). - Some BIOS report capability data for a method that is not fully implemented. - Some BIOS have methods fully implemented, but no complimentary capability data. To ensure we only expose fully implemented methods with corresponding capability data, we check each outcome before reporting that an attribute can be supported. Checking for lwmi_is_attr_01_supported during remove is not done to ensure that we don't attempt to call cd01 or send WMI events if one of the interfaces being removed was the cause of the driver unloading. Fixes: edc4b183b794 ("platform/x86: Add Lenovo Other Mode WMI Driver") Reported-by: Kurt Borja Closes: https://lore.kernel.org/platform-driver-x86/DG60P3SHXR8H.3NSEHMZ6J7XRC@gmail.com/ Cc: stable@vger.kernel.org Reviewed-by: Rong Zhang Tested-by: Rong Zhang Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Link: https://patch.msgid.link/20260510042546.436874-10-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 30a4ad208a7f7bdb790cd31d368595890045334f Author: Derek J. Clark Date: Sun May 10 04:25:38 2026 +0000 platform/x86: lenovo-wmi-other: Add Attribute ID helper functions Adds lwmi_attr_id() function. In the same vein as LWMI_ATTR_ID_FAN_RPM(), but as a generic, to de-duplicate attribute_id assignment boilerplate. Adds tunable_attr_01_id() function that breaks out the members of a tunable_attr_01 struct and passes them to lwmi_attr_id(). No functional change intended. Cc: stable@vger.kernel.org Reviewed-by: Rong Zhang Tested-by: Rong Zhang Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Link: https://patch.msgid.link/20260510042546.436874-9-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7e27896e16a1c450085c3fe020eeb1b223880f37 Author: Derek J. Clark Date: Sun May 10 04:25:37 2026 +0000 platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers In a later patch in the series the thermal mode enum will be accessed across three separate drivers (wmi-capdata, wmi-gamezonem and wmi-other). An additional patch in the series will also add a function prototype that needs to reference this enum in wmi-helpers.h. To avoid having all these drivers begin to import each others headers, and to avoid declaring an opaque enum to hande the second case, move the thermal mode enum to helpers where it can be safely accessed by everything that needs it from a single import. While at it, since the gamezone_events_type enum is the only remaining item in the header, move that as well and remove the gamezone header entirely. Cc: stable@vger.kernel.org Reviewed-by: Mark Pearson Reviewed-by: Rong Zhang Tested-by: Rong Zhang Signed-off-by: Derek J. Clark Link: https://patch.msgid.link/20260510042546.436874-8-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e8d5460ad3fd22409f2566ecbe2c82d94aabc246 Author: Rong Zhang Date: Sun May 10 04:25:36 2026 +0000 platform/x86: lenovo: Decouple lenovo-wmi-gamezone and lenovo-wmi-other Currently, lenovo-wmi-gamezone depends on lenovo-wmi-other as the former imports symbols from the latter. The imported symbols are just used to register a notifier block. However, there is no runtime dependency between both drivers, and either of them can run without the other, which is the major purpose of using the notifier framework. Such a link-time dependency is non-optimal. A previous attempt to "fix" it made LENOVO_WMI_GAMEZONE select LENOVO_WMI_TUNING, which was fundamentally broken and resulted in undefined Kconfig behavior, as `select' cannot be used on a symbol with potentially unmet dependencies. Decouple both drivers by moving the thermal mode notifier chain to lenovo-wmi-helpers. Methods for notifier block (un)registration are exported for lenovo-wmi-gamezone, while a method for querying the current thermal mode are exported for lenovo-wmi-other. This turns the dependency graph from +------------ lenovo-wmi-gamezone | | v | lenovo-wmi-helpers | ^ | | V +------------ lenovo-wmi-other into +------------ lenovo-wmi-gamezone | v lenovo-wmi-helpers ^ | +------------ lenovo-wmi-other To make it clear, the name of the notifier chain is also renamed from `om_chain_head' to `tm_chain_head', indicating that it's used to query the current thermal mode. No functional change intended. Reviewed-by: Mark Pearson Fixes: 6e38b9fcbfa3 ("platform/x86: lenovo: gamezone needs "other mode"") Cc: stable@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603252259.gHvJDyh3-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202603260302.X0NjQOda-lkp@intel.com/ Signed-off-by: Rong Zhang Signed-off-by: Derek J. Clark Link: https://patch.msgid.link/20260510042546.436874-7-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 71f3843e0f81e3c097a088c1121154bb9a44da0a Author: Derek J. Clark Date: Sun May 10 04:25:35 2026 +0000 platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members In struct tunable_attr_01 the capdata pointer is unused and the size of the id members is u32 when it should be u8. Fix these prior to adding additional members. No functional change intended. Reviewed-by: Mark Pearson Cc: stable@vger.kernel.org Reviewed-by: Rong Zhang Tested-by: Rong Zhang Signed-off-by: Derek J. Clark Link: https://patch.msgid.link/20260510042546.436874-6-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 816fbd5dacee977ca56bab79bf97f71f2f7ac24e Author: Derek J. Clark Date: Sun May 10 04:25:34 2026 +0000 platform/x86: lenovo-wmi-other: Zero initialize WMI arguments Adds explicit initialization of wmi_method_args_32 declarations with zero values to prevent uninitialized data from being sent to the device BIOS when passed. No functional change intended. Reviewed-by: Mark Pearson Fixes: 22024ac5366f ("platform/x86: Add Lenovo Gamezone WMI Driver") Fixes: edc4b183b794 ("platform/x86: Add Lenovo Other Mode WMI Driver") Reported-by: Rong Zhang Closes: https://lore.kernel.org/platform-driver-x86/95c7e7b539dd0af41189c754fcd35cec5b6fe182.camel@rong.moe/ Cc: stable@vger.kernel.org Reviewed-by: Rong Zhang Tested-by: Rong Zhang Signed-off-by: Derek J. Clark Link: https://patch.msgid.link/20260510042546.436874-5-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2fe2504abcfa4f82a4208e8d0c21ec0f22baca43 Author: Rong Zhang Date: Sun May 10 04:25:33 2026 +0000 platform/x86: lenovo-wmi-other: Balance component bind and unbind When lwmi_om_master_bind() fails, the master device's components are left bound, with the aggregate device destroyed due to the failure (found by sashiko.dev [1]). Balance calls to component_bind_all() and component_unbind_all() when an error is propagated to the component framework. No functional change intended. Reviewed-by: Mark Pearson Reviewed-by: Ilpo Järvinen Fixes: edc4b183b794 ("platform/x86: Add Lenovo Other Mode WMI Driver") Cc: stable@vger.kernel.org Link: https://sashiko.dev/#/patchset/20260331181208.421552-1-derekjohn.clark%40gmail.com [1] Signed-off-by: Rong Zhang Signed-off-by: Derek J. Clark Link: https://patch.msgid.link/20260510042546.436874-4-derekjohn.clark@gmail.com Signed-off-by: Ilpo Järvinen commit 55a279ae819adaea99a94c609f31970b70e0ec0c Author: Rong Zhang Date: Sun May 10 04:25:32 2026 +0000 platform/x86: lenovo-wmi-other: Balance IDA id allocation and free Currently, the IDA id is only freed on wmi-other device removal or failure to create firmware-attributes device, kset, or attributes. It leaks IDA ids if the wmi-other device is bound multiple times, as the unbind callback never frees the previously allocated IDA id. Additionally, if the wmi-other device has failed to create a firmware-attributes device before it gets removed, the wmi-device removal callback double frees the same IDA id. These bugs were found by sashiko.dev [1]. Fix them by moving ida_free() into lwmi_om_fw_attr_remove() so it is balanced with ida_alloc() in lwmi_om_fw_attr_add(). With them fixed, properly set and utilize the validity of priv->ida_id to balance firmware-attributes registration and removal, without relying on propagating the registration error to the component framework, which is more reliable and aligns with the hwmon device registration and removal sequences. No functional change intended. Reviewed-by: Mark Pearson Fixes: edc4b183b794 ("platform/x86: Add Lenovo Other Mode WMI Driver") Cc: stable@vger.kernel.org Link: https://sashiko.dev/#/patchset/20260331181208.421552-1-derekjohn.clark%40gmail.com [1] Signed-off-by: Rong Zhang Signed-off-by: Derek J. Clark Link: https://patch.msgid.link/20260510042546.436874-3-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0c3887a134f191723b53e2a47e501b534c8723ee Author: Rong Zhang Date: Sun May 10 04:25:31 2026 +0000 platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() lwmi_dev_evaluate_int() leaks output.pointer when retval == NULL (found by sashiko.dev [1]). Fix it by moving `ret_obj = output.pointer' outside of the `if (retval)' block so that it is always freed by the __free cleanup callback. No functional change intended. Reviewed-by: Mark Pearson Fixes: e521d16e76cd ("platform/x86: Add lenovo-wmi-helpers") Cc: stable@vger.kernel.org Link: https://sashiko.dev/#/patchset/20260331181208.421552-1-derekjohn.clark%40gmail.com [1] Signed-off-by: Rong Zhang Signed-off-by: Derek J. Clark Link: https://patch.msgid.link/20260510042546.436874-2-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 509fdeb3326be0db055e88d0f689a3888f147f90 Author: Md Shofiqul Islam Date: Wed May 6 19:36:58 2026 +0300 xfs: Fix typo in comment Fix spelling mistake in comment: - occured -> occurred Reviewed-by: Darrick J. Wong Signed-off-by: Md Shofiqul Islam Signed-off-by: Carlos Maiolino commit 5082d8835070fe63f3c61fe574cbb5319bd94575 Author: Christoph Hellwig Date: Thu May 7 07:24:57 2026 +0200 xfs: fix the "limiting open zones" message The xfs logging macros include a newline, remove the \n, which adds an extra one. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Andrey Albershteyn Signed-off-by: Carlos Maiolino commit 657b594b2084b39a4bc6d8493aa2140cb00cea49 Author: Masami Hiramatsu (Google) Date: Thu May 7 16:46:29 2026 +0900 fprobe: Fix unregister_fprobe() to wait for RCU grace period Commit 4346ba1604093 ("fprobe: Rewrite fprobe on function-graph tracer") changed fprobe to register struct fprobe to an rcu-hlist, but it forgot to wait for RCU GP. Thus there can be use-after-free if the fprobe is released right after unregistering. This can be happened on fprobe event and sample module code. To fix this issue, add synchronize_rcu() in unregister_fprobe(). Note that BPF is OK because fprobe is used as a part of bpf_kprobe_multi_link. This unregisters its fprobe in bpf_kprobe_multi_link_release() and it is deallocated via bpf_kprobe_multi_link_dealloc(), which is invoked from bpf_link_defer_dealloc_rcu_gp() RCU callback. For BPF, this also introduced unregister_fprobe_async() which does NOT wait for RCU grace priod. Link: https://lore.kernel.org/all/177813998919.256460.2809243930741138224.stgit@mhiramat.tok.corp.google.com/ Fixes: 4346ba1604093 ("fprobe: Rewrite fprobe on function-graph tracer") Signed-off-by: Masami Hiramatsu (Google) commit 928abe19fbf0127003abcb1ea69cabc1c897d0ab Author: Michael Bommarito Date: Sun May 10 19:16:58 2026 -0400 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Signed-off-by: Mika Westerberg commit de21b59c29e31c5108ddc04210631bbfab81b997 Author: Michael Bommarito Date: Sun May 10 19:16:57 2026 -0400 thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow On the non-root path, __tb_property_parse_dir() takes dir_len from entry->length (u16 widened to size_t). Two distinct OOB conditions follow when entry->length < 4: 1. The non-root path begins with kmemdup(&block[dir_offset], sizeof(*dir->uuid), ...) which always reads 4 dwords from dir_offset. tb_property_entry_valid() only enforces dir_offset + entry->length <= block_len, so a crafted entry with dir_offset close to the end of the property block and entry->length in 0..3 passes that gate but lets the UUID copy run off the block (e.g. dir_offset = 497, dir_len = 3 in a 500-dword block reads block[497..501]). 2. After the kmemdup, content_len = dir_len - 4 underflows size_t to ~SIZE_MAX, nentries becomes SIZE_MAX / 4, and the entry walk runs OOB on each iteration until an entry fails validation or the kernel oopses on an unmapped page. Reject dir_len < 4 on the non-root path *before* the UUID kmemdup, which closes both holes. Also move INIT_LIST_HEAD(&dir->properties) up to immediately after the dir allocation so the new error-return path (and the existing uuid-alloc failure path) calling tb_property_free_dir() sees a walkable list rather than the zero-initialized NULL next/prev that list_for_each_entry_safe() would oops on. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Signed-off-by: Mika Westerberg commit 01deda0152066c6c955f0619114ea6afa070aaec Author: Michael Bommarito Date: Sun May 10 19:16:56 2026 -0400 thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() entry->value is u32 and entry->length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum 0x100000000 wraps to 0 and passes the > block_len check. tb_property_parse() then passes entry->value to parse_dwdata() as a dword offset into the property block, reading attacker-directed memory far past the allocation. For TEXT-typed entries with the "deviceid" or "vendorid" keys this lands in xd->device_name / xd->vendor_name and is readable back via the per-XDomain device_name / vendor_name sysfs attributes; the leak is NUL-bounded (kstrdup() stops at the first zero byte) and untargeted (the attacker picks a delta, not an absolute address). DATA-typed entries are parsed into property->value.data but not generically surfaced to userspace. Use check_add_overflow() so a wrapped sum is rejected. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Signed-off-by: Mika Westerberg commit 86ecb1c1a1f5c1bf4a45b91f54f8220c3121bd3b Author: Andrea Righi Date: Mon May 11 10:31:30 2026 +0200 sched_ext: Clear ops->priv on scx_alloc_and_add_sched() error paths scx_alloc_and_add_sched() can fail after @sch has been assigned to ops->priv. In those cases @sch is torn down (either via kfree() through the err_free_* chain or via kobject_put() -> scx_kobj_release() -> RCU work), but @ops->priv is left pointing at the about-to-be-freed pointer. With the recent -EBUSY gate in scx_root_enable_workfn() and scx_sub_enable_workfn() that rejects an attach when @ops->priv is still non-NULL, see commit bbf30b383cf6 ("sched_ext: Fix ops->priv clobber on concurrent attach/detach"), a dangling @ops->priv permanently locks the kdata out: every future attach attempt sees a stale binding and returns -EBUSY even though no scheduler is actually attached. Clear @ops->priv on the post-assign failure paths so that the kdata returns to its pre-attach state when the function returns ERR_PTR(). Fixes: bbf30b383cf6 ("sched_ext: Fix ops->priv clobber on concurrent attach/detach") Suggested-by: Tejun Heo Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 544576f0f05c4a759806acddfaaeb686f14fb4b0 Author: Hristo Venev Date: Mon May 4 18:54:45 2026 +0300 ceph: put folios not suitable for writeback The batch holds references to the folios (see `filemap_get_folios`, `folio_batch_release`), so we need to `folio_put` the folios we remove. Tested on v6.18. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/74156 Signed-off-by: Hristo Venev Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 10d9be401108a0fc8b3bc99ba07bdee8fff875ac Author: Viacheslav Dubeyko Date: Thu Apr 9 11:33:23 2026 -0700 ceph: add ceph_has_realms_with_quotas() check to ceph_quota_update_statfs() When MDS rejects a session, remove_session_caps() -> __ceph_remove_cap() -> ceph_change_snap_realm() clears i_snap_realm for every inode that loses its last cap. The realm is restored once caps are re-granted after reconnect. It is not a real error and this patch changes pr_err_ratelimited_client() on doutc(). Every quota methods ceph_quota_is_max_files_exceeded(), ceph_quota_is_max_bytes_exceeded(), ceph_quota_is_max_bytes_approaching() calls ceph_has_realms_with_quotas() check. This patch adds the missing ceph_has_realms_with_quotas() call into ceph_quota_update_statfs(). [ idryomov: add braces around both arms of multiline ifs ] Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 821365487aa58d06bda65c676ba215d506ba9768 Author: Raphael Zimmer Date: Tue Apr 28 14:15:46 2026 +0200 libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() In __ceph_x_decrypt(), a part of the buffer p is interpreted as a ceph_x_encrypt_header, and the magic field of this struct is accessed. This happens without any guarantee that the buffer is large enough to hold this struct. The function parameter ciphertext_len represents the length of the ciphertext to decrypt and is guaranteed to be at most the remaining size of the allocated buffer p. However, this value is not necessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message frame of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold the ciphertext at its end with a ciphertext_len of 8 or less, can trigger an out-of-bounds memory access when accessing hdr->magic. This patch fixes the issue by adding a check to ensure that the decrypted plaintext in the buffer is large enough to represent at least the ceph_x_encrypt_header. Cc: stable@vger.kernel.org Signed-off-by: Raphael Zimmer Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 0c22d9511cbde746622f8e4c11aaa63fe76d45f9 Author: Viacheslav Dubeyko Date: Thu Apr 9 12:43:40 2026 -0700 ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size The generic/642 test-case can reproduce the kernel crash: [40243.605254] ------------[ cut here ]------------ [40243.605956] kernel BUG at fs/ceph/xattr.c:918! [40243.607142] Oops: invalid opcode: 0000 [#1] SMP PTI [40243.608067] CPU: 7 UID: 0 PID: 498762 Comm: kworker/7:1 Not tainted 7.0.0-rc7+ #3 PREEMPT(full) [40243.609700] Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [40243.611820] Workqueue: ceph-msgr ceph_con_workfn [40243.612715] RIP: 0010:__ceph_build_xattrs_blob+0x1b8/0x1e0 [40243.613731] Code: 0f 84 82 fe ff ff e9 cf 8e 56 ff 48 8d 65 e8 31 c0 5b 41 5c 41 5d 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 c3 cc cc cc cc <0f> 0b 4c 8b 62 08 41 8b 85 24 07 00 00 49 83 c4 04 41 89 44 24 fc [40243.616888] RSP: 0018:ffffcc80c4d4b688 EFLAGS: 00010287 [40243.617773] RAX: 0000000000010026 RBX: 0000000000000001 RCX: 0000000000000000 [40243.618928] RDX: ffff8a773798dee0 RSI: 0000000000000000 RDI: 0000000000000000 [40243.620158] RBP: ffffcc80c4d4b6a0 R08: 0000000000000000 R09: 0000000000000000 [40243.621573] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a75f3b58000 [40243.622907] R13: ffff8a75f3b58000 R14: 0000000000000080 R15: 000000000000bffd [40243.624054] FS: 0000000000000000(0000) GS:ffff8a787d1b4000(0000) knlGS:0000000000000000 [40243.625331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [40243.626269] CR2: 000072f390b623c0 CR3: 000000011c02a003 CR4: 0000000000372ef0 [40243.627408] Call Trace: [40243.627839] [40243.628188] __prep_cap+0x3fd/0x4a0 [40243.628789] ? do_raw_spin_unlock+0x4e/0xe0 [40243.629474] ceph_check_caps+0x46a/0xc80 [40243.630094] ? __lock_acquire+0x4a2/0x2650 [40243.630773] ? find_held_lock+0x31/0x90 [40243.631347] ? handle_cap_grant+0x79f/0x1060 [40243.632068] ? lock_release+0xd9/0x300 [40243.632696] ? __mutex_unlock_slowpath+0x3e/0x340 [40243.633429] ? lock_release+0xd9/0x300 [40243.634052] handle_cap_grant+0xcf6/0x1060 [40243.634745] ceph_handle_caps+0x122b/0x2110 [40243.635415] mds_dispatch+0x5bd/0x2160 [40243.636034] ? ceph_con_process_message+0x65/0x190 [40243.636828] ? lock_release+0xd9/0x300 [40243.637431] ceph_con_process_message+0x7a/0x190 [40243.638184] ? kfree+0x311/0x4f0 [40243.638749] ? kfree+0x311/0x4f0 [40243.639268] process_message+0x16/0x1a0 [40243.639915] ? sg_free_table+0x39/0x90 [40243.640572] ceph_con_v2_try_read+0xf58/0x2120 [40243.641255] ? lock_acquire+0xc8/0x300 [40243.641863] ceph_con_workfn+0x151/0x820 [40243.642493] process_one_work+0x22f/0x630 [40243.643093] ? process_one_work+0x254/0x630 [40243.643770] worker_thread+0x1e2/0x400 [40243.644332] ? __pfx_worker_thread+0x10/0x10 [40243.645020] kthread+0x109/0x140 [40243.645560] ? __pfx_kthread+0x10/0x10 [40243.646125] ret_from_fork+0x3f8/0x480 [40243.646752] ? __pfx_kthread+0x10/0x10 [40243.647316] ? __pfx_kthread+0x10/0x10 [40243.647919] ret_from_fork_asm+0x1a/0x30 [40243.648556] [40243.648902] Modules linked in: overlay hctr2 libpolyval chacha libchacha adiantum libnh libpoly1305 essiv intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit kvm_intel kvm irqbypass joydev ghash_clmulni_intel aesni_intel rapl input_leds mac_hid psmouse vga16fb serio_raw vgastate floppy i2c_piix4 pata_acpi bochs qemu_fw_cfg i2c_smbus sch_fq_codel rbd dm_crypt msr parport_pc ppdev lp parport efi_pstore [40243.654766] ---[ end trace 0000000000000000 ]--- Commit d93231a6bc8a ("ceph: prevent a client from exceeding the MDS maximum xattr size") moved the required_blob_size computation to before the __build_xattrs() call, introducing a race. __build_xattrs() releases and reacquires i_ceph_lock during execution. In that window, handle_cap_grant() may update i_xattrs.blob with a newer MDS-provided blob and bump i_xattrs.version. When __build_xattrs() detects that index_version < version, it destroys and rebuilds the entire xattr rb-tree from the new blob, potentially increasing count, names_size, and vals_size. The prealloc_blob size check that follows still uses the stale required_blob_size computed before the rebuild, so it passes even when prealloc_blob is too small for the now-larger tree. After __set_xattr() adds one more xattr on top, __ceph_build_xattrs_blob() is called from the cap flush path and hits: BUG_ON(need > ci->i_xattrs.prealloc_blob->alloc_len); Fix this by recomputing required_blob_size after __build_xattrs() returns, using the current tree state. Also re-validate against m_max_xattr_size to fall back to the sync path if the rebuilt tree now exceeds the MDS limit. Cc: stable@vger.kernel.org Fixes: d93231a6bc8a ("ceph: prevent a client from exceeding the MDS maximum xattr size") Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e Author: Viacheslav Dubeyko Date: Thu Apr 9 12:26:02 2026 -0700 ceph: fix a buffer leak in __ceph_setxattr() The old_blob in __ceph_setxattr() can store ci->i_xattrs.prealloc_blob value during the retry. However, it is never called the ceph_buffer_put() for the old_blob object. This patch fixes the issue of the buffer leak. Cc: stable@vger.kernel.org Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 596f91294b351866956808b1ecb8dfae15382a6d Author: Raphael Zimmer Date: Fri Apr 24 15:37:37 2026 +0200 libceph: Fix unnecessarily high ceph_decode_need() for uniform bucket In crush_decode_uniform_bucket(), the item_weight field of the bucket is set. This is a single field of type u32 since the uniform bucket uses the same weight for all items. The value in ceph_decode_need() is set to (1+b->h.size) * sizeof(u32), which is higher than actually needed. This patch removes the call to ceph_decode_need() with the unnecessarily high value and switches the subsequent operation from ceph_decode_32() to ceph_decode_32_safe(), which already includes the correct bounds check. Signed-off-by: Raphael Zimmer Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 4c79fc2d598694bda845b46229c9d48b65042970 Author: Raphael Zimmer Date: Wed Apr 22 10:47:13 2026 +0200 libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket(). Cc: stable@vger.kernel.org Signed-off-by: Raphael Zimmer Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 7dbac7680eb629b3b4dc7e98c34f943b8814c0c8 Author: Herbert Xu Date: Wed May 6 21:23:28 2026 +0800 xfrm: ipcomp: Free destination pages on acomp errors Move the out_free_req label up by a couple of lines so that the allocated dst SG list gets freed on error as well as success. Fixes: eb2953d26971 ("xfrm: ipcomp: Use crypto_acomp interface") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Reported-by: Yilin Zhu Signed-off-by: Herbert Xu Signed-off-by: Steffen Klassert commit 79ea2feb917b05366b49d85573c9c5331f043b2c Author: Zhenzhong Duan Date: Sat May 9 10:43:46 2026 +0800 iommu/vt-d: Avoid NULL pointer dereference or refcount corruption Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE") fixed a NULL pointer dereference in an unlikely situation partly. If dev_pasid is not found in the dev_pasids list, it remains NULL. However, the teardown operations are executed unconditionally, this lead to a NULL pointer dereference or refcount corruption. If the domain was never attached to this IOMMU, info will be NULL, which would cause an immediate dereference when checking --info->refcnt. Even if info is not NULL, decrementing the refcount without having removed a valid PASID might unbalance the count. This could lead to premature dropping of the refcount to 0, potentially causing a use-after-free for the remaining active devices sharing the domain. Fix it by returning early if dev_pasid is NULL, before executing the teardown operations. Issue found by AI review and suggested by Kevin Tian. https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com Fixes: 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE") Cc: stable@vger.kernel.org Suggested-by: Kevin Tian Signed-off-by: Zhenzhong Duan Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260422033538.95000-1-zhenzhong.duan@intel.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit a6dea58d8625c06b9654c0555f101742481335c3 Author: Zhenzhong Duan Date: Sat May 9 10:43:45 2026 +0800 iommu/vt-d: Fix oops due to out of scope access Below oops triggers when kill QEMU process: Oops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 [#1] SMP NOPTI Call Trace: do_raw_spin_lock+0xaa/0xc0 _raw_spin_lock_irqsave+0x21/0x40 domain_remove_dev_pasid+0x52/0x160 intel_nested_set_dev_pasid+0x1b9/0x1e0 __iommu_set_group_pasid+0x56/0x120 pci_dev_reset_iommu_done+0xe3/0x180 pcie_flr+0x65/0x160 __pci_reset_function_locked+0x5b/0x120 vfio_pci_core_close_device+0x63/0xe0 [vfio_pci_core] vfio_df_close+0x4f/0xa0 vfio_df_unbind_iommufd+0x2d/0x60 vfio_device_fops_release+0x3e/0x40 __fput+0xe5/0x2c0 task_work_run+0x58/0xa0 do_exit+0x2c8/0x600 do_group_exit+0x2f/0xa0 get_signal+0x863/0x8c0 arch_do_signal_or_restart+0x24/0x100 exit_to_user_mode_loop+0x87/0x380 do_syscall_64+0x2ff/0x11e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The global static blocked domain is a dummy domain without corresponding dmar_domain structure, accessing beyond iommu_domain structure triggers oops easily. Fix it by return early in domain_remove_dev_pasid() like identity domain. Fixes: 7d0c9da6c150 ("iommu/vt-d: Add set_dev_pasid callback for dma domain") Cc: stable@vger.kernel.org Signed-off-by: Zhenzhong Duan Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260421031347.1408890-1-zhenzhong.duan@intel.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 2cda2e10dc8343ae01eae9e999a876b7e7d37861 Author: Naval Alcalá Date: Sat May 9 10:43:44 2026 +0800 iommu/vt-d: Disable DMAR for Intel Q35 IGFX Intel Q35 integrated graphics (8086:29b2) exhibits broken DMAR behaviour similar to other G4x/GM45 devices for which DMAR is already disabled via quirks. When DMAR is enabled, the system may hard lock up during boot or early device initialization, requiring a reset. Add the missing PCI ID to the existing quirk list to disable DMAR for this device. Fixes: 1f76249cc3be ("iommu/vt-d: Declare Broadwell igfx dmar support snafu") Cc: stable@vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=201185 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=216064 Signed-off-by: Naval Alcalá Link: https://lore.kernel.org/r/20260410161622.13549-1-ari@naval.cat Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 4a39eda5fdd867fc39f3c039714dd432cee00268 Author: Guopeng Zhang Date: Sat May 9 18:20:30 2026 +0800 cgroup/cpuset: Reset DL migration state on can_attach() failure cpuset_can_attach() accumulates temporary SCHED_DEADLINE migration state in the destination cpuset while walking the taskset. If a later task_can_attach() or security_task_setscheduler() check fails, cgroup_migrate_execute() treats cpuset as the failing subsystem and does not call cpuset_cancel_attach() for it. The partially accumulated state is then left behind and can be consumed by a later attach, corrupting cpuset DL task accounting and pending DL bandwidth accounting. Reset the pending DL migration state from the common error exit when ret is non-zero. Successful can_attach() keeps the state for cpuset_attach() or cpuset_cancel_attach(). Fixes: 2ef269ef1ac0 ("cgroup/cpuset: Free DL BW in case can_attach() fails") Cc: stable@vger.kernel.org # v6.10+ Signed-off-by: Guopeng Zhang Signed-off-by: Tejun Heo Reviewed-by: Chen Ridong Reviewed-by: Waiman Long commit 15dd29ca620648a18a0334a3f6b26af181154a23 Author: Nicolin Chen Date: Fri Apr 24 18:15:27 2026 -0700 iommu: Warn on premature unblock during DMA aliased sibling reset When two aliased siblings are in the same iommu_group, they might share the same RID. The reset functions don't support this case, though it is unclear whether there is a real case of having an ATS capable device on a PCI/PCI-X bus. Theoretically, however, if two aliased devices are resetting concurrently, one might be unblocked prematurely in the middle of the reset by the other sibling who completes the reset first. This isn't a regression from this series but it's better to spit a warning, so we can know if such use case is common enough for us to make subsequent patches for its coverage. Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Signed-off-by: Joerg Roedel commit 5474e6e17a262db45c60575c73f70210f5c7001f Author: Nicolin Chen Date: Fri Apr 24 18:15:26 2026 -0700 iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset In __iommu_group_set_domain_internal(), concurrent domain attachments are rejected when any device in the group is recovering. This is necessary to fence concurrent attachments to a multi-device group where devices might share the same RID due to PCI DMA alias quirks, but triggers the WARN_ON in __iommu_group_set_domain_nofail(). Other IOMMU_SET_DOMAIN_MUST_SUCCEED callers in detach/teardown paths, such as __iommu_group_set_core_domain and __iommu_release_dma_ownership, should not be rejected, as the domain would be freed anyway in these nofail paths while group->domain is still pointing to it. So pci_dev_reset_iommu_done() could trigger a UAF when re-attaching group->domain. Honor the IOMMU_SET_DOMAIN_MUST_SUCCEED flag, allowing the callers through the group->recovery_cnt fence, so as to update the group->domain pointer. Instead add a gdev->blocked check in the device iteration loop, to prevent any concurrent per-device detachment. Fixes: c279e83953d9 ("iommu: Introduce pci_dev_reset_iommu_prepare/done()") Cc: stable@vger.kernel.org Closes: https://sashiko.dev/#/patchset/20260407194644.171304-1-nicolinc%40nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Lu Baolu Signed-off-by: Nicolin Chen Signed-off-by: Joerg Roedel commit fc3523b16d2b4b88e61e69504b0ae0b18b869c8f Author: Nicolin Chen Date: Fri Apr 24 18:15:25 2026 -0700 iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid() If a device is blocked, its PASID domains are already detached. Repeating iommu_remove_dev_pasid() is unnecessary and might trigger ATS invalidation timeouts. Skip the iommu_remove_dev_pasid() call upon gdev->blocked. Fixes: c279e83953d9 ("iommu: Introduce pci_dev_reset_iommu_prepare/done()") Cc: stable@vger.kernel.org Closes: https://sashiko.dev/#/patchset/20260407194644.171304-1-nicolinc%40nvidia.com Reviewed-by: Kevin Tian Signed-off-by: Nicolin Chen Reviewed-by: Lu Baolu Signed-off-by: Joerg Roedel commit 0d5fd7a9323ce6bedd170e21e1e90b8904917c75 Author: Nicolin Chen Date: Fri Apr 24 18:15:24 2026 -0700 iommu: Fix nested pci_dev_reset_iommu_prepare/done() Shuai found that cxl_reset_bus_function() calls pci_reset_bus_function() internally while both are calling pci_dev_reset_iommu_prepare/done(). As pci_dev_reset_iommu_prepare() doesn't support re-entry, the inner call will trigger a WARN_ON and return -EBUSY, resulting in failing the entire device reset. On the other hand, removing the outer calls in the PCI callers is unsafe. As pointed out by Kevin, device-specific quirks like reset_hinic_vf_dev() execute custom firmware waits after their inner pcie_flr() completes. If the IOMMU protection relies solely on the inner reset, the IOMMU will be unblocked prematurely while the device is still resetting. Instead, fix this by making pci_dev_reset_iommu_prepare/done() reentrant. Introduce gdev->reset_depth to handle the re-entries on the same device. Fixes: c279e83953d9 ("iommu: Introduce pci_dev_reset_iommu_prepare/done()") Cc: stable@vger.kernel.org Reported-by: Shuai Xue Closes: https://lore.kernel.org/all/absKsk7qQOwzhpzv@Asurada-Nvidia/ Suggested-by: Kevin Tian Reviewed-by: Shuai Xue Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Lu Baolu Signed-off-by: Nicolin Chen Signed-off-by: Joerg Roedel commit 1615e8896a8f6d7b2adf6495e538a81bf6cea3e0 Author: Nicolin Chen Date: Fri Apr 24 18:15:23 2026 -0700 iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done() Now the helpers handle per-gdev resets. Replace __iommu_set_group_pasid() with set_dev_pasid() accordingly, in the pci_dev_reset_iommu_done(). Also add max_pasids check as other callers. Fixes: c279e83953d9 ("iommu: Introduce pci_dev_reset_iommu_prepare/done()") Cc: stable@vger.kernel.org Reported-by: Shuai Xue Closes: https://lore.kernel.org/all/ad858513-09fc-455e-bbc5-fe38a225cc78@linux.alibaba.com/ Reviewed-by: Shuai Xue Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Signed-off-by: Nicolin Chen Reviewed-by: Lu Baolu Signed-off-by: Joerg Roedel commit b296ca1fb43aa435edd86131f5230f70c03b2829 Author: Nicolin Chen Date: Fri Apr 24 18:15:22 2026 -0700 iommu: Replace per-group resetting_domain with per-gdev blocked flag The core tracks device resetting states with a per-group resetting_domain, while a reset is actually per group-device. Such a mismatch might lead to confusion and even difficulty to untangle per-gdev handling requirement. Shuai found that cxl_reset_bus_function() calls pci_reset_bus_function() internally while both are calling pci_dev_reset_iommu_prepare/done(). And the solution requires the core to track at the group_device level as well. Introduce a 'blocked' flag to struct group_device, to allow a multi-device group to isolate concurrent device resets independently. As the reset routine is per gdev, it cannot clear group->resetting_domain without iterating over the device list to ensure no other device is being reset. Simplify it by replacing the resetting_domain with a 'recovery_cnt' in the struct iommu_group. No functional change. But this is essential to apply following bug fixes. Fixes: c279e83953d9 ("iommu: Introduce pci_dev_reset_iommu_prepare/done()") Cc: stable@vger.kernel.org Reported-by: Shuai Xue Closes: https://lore.kernel.org/all/absKsk7qQOwzhpzv@Asurada-Nvidia/ Reviewed-by: Shuai Xue Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Lu Baolu Signed-off-by: Nicolin Chen Signed-off-by: Joerg Roedel commit 834ab85aa96656f87bb215a8285d34af870f4b66 Author: Nicolin Chen Date: Fri Apr 24 18:15:21 2026 -0700 iommu: Fix kdocs of pci_dev_reset_iommu_done() Remove the duplicated word. No functional change. Fixes: c279e83953d9 ("iommu: Introduce pci_dev_reset_iommu_prepare/done()") Reviewed-by: Shuai Xue Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Lu Baolu Signed-off-by: Nicolin Chen Signed-off-by: Joerg Roedel commit d769711fcddd005f1e654b3bde547140917fe696 Author: Nicolin Chen Date: Fri Apr 24 18:15:20 2026 -0700 iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done() Local sashiko review pointed it out that group->domain could be NULL when a default domain fails to allocate during the first probe, which can crash at domain->ops->attach_dev dereference in __iommu_attach_device() invoked by pci_dev_reset_iommu_done(). pci_dev_reset_iommu_prepare() is fine as an old_domain pointer can be NULL. Skip the re-attach in pci_dev_reset_iommu_done() to fix the bug. Fixes: c279e83953d9 ("iommu: Introduce pci_dev_reset_iommu_prepare/done()") Cc: stable@vger.kernel.org Signed-off-by: Nicolin Chen Reviewed-by: Lu Baolu Signed-off-by: Joerg Roedel commit 07d0f496fe7ec5abe3bee7e38be709521567bb33 Author: Jose Fernandez (Anthropic) Date: Tue Apr 21 19:26:13 2026 +0000 iommu/amd: Bounds-check devid in __rlookup_amd_iommu() iommu_device_register() walks every device on the PCI bus via bus_for_each_dev() and calls amd_iommu_probe_device() for each. The inlined check_device() path computes the device's sbdf, calls rlookup_amd_iommu() to find the owning IOMMU, and only afterwards verifies devid <= pci_seg->last_bdf. __rlookup_amd_iommu() indexes rlookup_table[devid] with no bounds check of its own, so for a PCI device whose BDF is not described by the IVRS, the lookup reads past the end of the allocation before the caller's bounds check can run. This was harmless before commit e874c666b15b ("iommu/amd: Change rlookup, irq_lookup, and alias to use kvalloc()"): the table was a zeroed page-order allocation, so the over-read returned NULL and the caller's NULL check skipped the device. After that commit the table is a tight kvcalloc() and the over-read returns adjacent slab contents, which check_device() then dereferences as a struct amd_iommu *, causing a boot-time GPF. Seen on Google Compute Engine ct6e VMs, where the virtualized IVRS describes only the four TPU endpoints 00:04.0-07.0; the gVNIC at 00:08.0 (devid 0x40) indexes 56 bytes past the 456-byte allocation, into the adjacent kmalloc-512 slab object: pci 0000:00:04.0: Adding to iommu group 0 pci 0000:00:05.0: Adding to iommu group 1 pci 0000:00:06.0: Adding to iommu group 2 pci 0000:00:07.0: Adding to iommu group 3 Oops: general protection fault, probably for non-canonical address 0x3a64695f78746382: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.22 #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/06/2025 RIP: 0010:amd_iommu_probe_device+0x54/0x3a0 Call Trace: __iommu_probe_device+0x107/0x520 probe_iommu_group+0x29/0x50 bus_for_each_dev+0x7e/0xe0 iommu_device_register+0xc9/0x240 iommu_go_to_state+0x9c0/0x1c60 amd_iommu_init+0x14/0x40 pci_iommu_init+0x16/0x60 do_one_initcall+0x47/0x2f0 Guard the array access in __rlookup_amd_iommu(). With the fix applied on 6.18.22, the gVNIC at 00:08.0 is skipped cleanly and the VM boots. Fixes: e874c666b15b ("iommu/amd: Change rlookup, irq_lookup, and alias to use kvalloc()") Cc: stable@vger.kernel.org Reported-by: Ziyuan Chen Tested-by: Ziyuan Chen Reviewed-by: Josef Bacik Assisted-by: Claude:unspecified Signed-off-by: Jose Fernandez (Anthropic) Signed-off-by: Joerg Roedel commit 8dfd3d8d74435344ee8dc9237596959c8b2a6cbe Author: Eder Zulian Date: Fri Apr 10 14:55:50 2026 +0200 iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommu_mmio_write() and iommu_capability_write(), the variables dbg_mmio_offset and dbg_cap_offset are declared as int. However, they are populated using kstrtou32_from_user(). If a user provides a sufficiently large value, it can become a negative integer. Prior to this patch, the AMD IOMMU debugfs implementation was already protected by different mechanisms. 1. #define OFS_IN_SZ 8 ensures the user string <= 8 bytes, so e.g. 0xffffffff isn't a valid input. if (cnt > OFS_IN_SZ) return -EINVAL; 2. Implicit type promotion in iommu_mmio_write(), dbg_mmio_offset is int and iommu->mmio_phys_end is u64 if (dbg_mmio_offset > iommu->mmio_phys_end - sizeof(u64)) return -EINVAL; 3. The show handlers would currently catch the negative number and refuse to perform the read. Replace kstrtou32_from_user() with kstrtos32_from_user() to parse the input, and check for negative values to explicitly prevent out-of-bounds memory accesses directly in iommu_mmio_write() and iommu_capability_write(). Signed-off-by: Eder Zulian Fixes: 7a4ee419e8c1 ("iommu/amd: Add debugfs support to dump IOMMU MMIO registers") Cc: stable@vger.kernel.org Signed-off-by: Joerg Roedel commit bbf30b383cf6e87f2fe57c292fbd640b1d88b4c3 Author: Andrea Righi Date: Mon May 11 08:18:12 2026 +0200 sched_ext: Fix ops->priv clobber on concurrent attach/detach Under heavy concurrent attach/detach operations, scx_claim_exit() can trigger a NULL pointer dereference. This can be reproduced running the reload_loop kselftests inside a virtme-ng session: $ vng -v -- ./tools/testing/selftests/sched_ext/runner -t reload_loop ... BUG: kernel NULL pointer dereference, address: 0000000000000400 RIP: 0010:scx_claim_exit+0x3b/0x120 Call Trace: bpf_scx_unreg+0x45/0xb0 bpf_struct_ops_map_link_dealloc+0x39/0x50 bpf_link_release+0x18/0x20 __fput+0x10b/0x2e0 __x64_sys_close+0x47/0xa0 The underlying race (diagnosed by Tejun Heo) is a stomp of @ops->priv, not a missing NULL check: T2 unreg(K) T1 reg(K) ----------- --------- sch = ops->priv = sch_b800 scx_disable; flush_disable_work [scx_root_disable: scx_root=NULL, mutex_unlock, state=DISABLED] mutex_lock; state ok scx_alloc_and_add_sched: ops->priv = sch_a800 scx_root = sch_a800; init=0 state=ENABLED; mutex_unlock [flush returns] RCU_INIT_POINTER(ops->priv, NULL) <-- clobbers sch_a800 kobject_put(sch_b800) T1 acquires scx_enable_mutex inside scx_root_disable()'s mutex_unlock window and starts a fresh attach on the same kdata, assigning sch_a800 to @ops->priv. T2 then continues out of scx_disable()/flush_disable_work and clobbers @ops->priv to NULL, leaking sch_a800; the bpf_link is gone but state stays SCX_ENABLED, so all future attaches fail with -EBUSY permanently. The next bpf_scx_unreg() on that kdata then reads NULL @ops->priv and dereferences it in scx_claim_exit(). Make @ops->priv the lifecycle binding: in scx_root_enable_workfn() and scx_sub_enable_workfn(), after the existing state check and still under scx_enable_mutex, refuse with -EBUSY if @ops->priv is non-NULL. This rejects an attempt to reuse a kdata that is still bound to a previous scheduler instance, closing the race without changing the unreg side. Fixes: 105dcd005be2 ("sched_ext: Introduce scx_prog_sched()") Suggested-by: Tejun Heo Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 3788e32516530dee66cf9186f846480a16799b05 Author: Andrea Righi Date: Sun May 10 19:52:11 2026 +0200 selftests/sched_ext: Fix build error in dequeue selftest Building the dequeue selftest with newer compilers (e.g., gcc 16) triggers the following error: dequeue.c:28:22: error: variable 'sum' set but not used The 'volatile' qualifier prevents the writes from being optimized away, but does not silence the unused variable 'sum' is indeed only written and never read. Consume 'sum' via an empty asm() with a register input constraint. This forces the compiler to keep the accumulated value (preserving the CPU stress loop) and avoiding the build error. Fixes: 658ad2259b3e ("selftests/sched_ext: Add test to validate ops.dequeue() semantics") Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 2a3d7256faf06d1a15bb5b07e851ac4e1680c26d Author: Hongfu Li Date: Mon May 11 09:39:57 2026 +0800 selftests/cgroup: Fix string comparison in write_test Use string comparison (!=) instead of numeric comparison (-ne) for cpuset values like "0-1". For example: $ [[ "0-1" != "2-3" ]] && echo "true" || echo "false" true $ [[ "0-1" -ne "2-3" ]] && echo "true" || echo "false" false Signed-off-by: Hongfu Li Signed-off-by: Tejun Heo commit e32e6f02168f2ad7991eb5d160d312d2001520c8 Author: Hongfu Li Date: Sat May 9 16:03:28 2026 +0800 selftests/cgroup: Fix cg_read_strcmp() empty string comparison cg_read_strcmp() allocated a buffer sized to strlen(expected) + 1, then passed it to read_text() which calls read(fd, buf, size-1). When comparing against an empty string (""), strlen("") = 0 gives a 1-byte buffer, and read() is asked to read 0 bytes. The file content is never actually read, so strcmp("", buf) always returns 0 regardless of the real content. This caused cg_test_proc_killed() to always report the cgroup as empty immediately, making OOM tests pass without verifying that processes were killed. Signed-off-by: Hongfu Li Signed-off-by: Tejun Heo commit 796ad622040f7f955ccc3973085e953415920496 Author: Guopeng Zhang Date: Mon May 11 09:31:50 2026 +0800 cgroup/dmem: Return -ENOMEM on failed pool preallocation get_cg_pool_unlocked() handles allocation failures under dmemcg_lock by dropping the lock, preallocating a pool with GFP_KERNEL, and retrying the locked lookup and creation path. If the fallback allocation fails too, pool remains NULL. Since the loop condition is while (!pool), the function can keep retrying instead of propagating the allocation failure to the caller. Set pool to ERR_PTR(-ENOMEM) when the fallback allocation fails so the loop exits through the existing common return path. The callers already handle ERR_PTR() from get_cg_pool_unlocked(), so this restores the expected error path. Fixes: b168ed458dde ("kernel/cgroup: Add "dmem" memory accounting cgroup") Cc: stable@vger.kernel.org # v6.14+ Signed-off-by: Guopeng Zhang Signed-off-by: Tejun Heo commit d743974248e8aa45d88fcbc7b0bf13064d286f63 Merge: d714913b61d55b fa749a77bdc50f Author: Mark Brown Date: Mon May 11 10:04:02 2026 +0900 ASoC: sdw_utils: make RT712/RT721 CODEC_MIC be optional Bard Liao says: The RT712 and RT721 codec mic are optional and are not used on some products. Add a quirk to make it optional and skip the codec mic DAI when it is not present in DisCo table. Link: https://patch.msgid.link/20260508093224.1246282-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit fa749a77bdc50f0d695aaf81f1bd55967d77d10f Author: Mac Chiang Date: Fri May 8 17:32:24 2026 +0800 ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC Add a quirk to skip the CODEC_MIC DAI when it is not present. This ensures PCH_DMIC is used as the fallback; otherwise, CODEC_MIC remains the default. Fixes: 846a8d3cf3ba ("ASoC: Intel: soc-acpi-intel-ptl-match: Add rt721 support") Signed-off-by: Mac Chiang Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260508093224.1246282-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 9c37daee7c17fa17e8d41089ee1f658b06cb672a Author: Mac Chiang Date: Fri May 8 17:32:23 2026 +0800 ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC Some devices do not use CODEC_MIC but use the host PCH_DMIC instead. Add a quirk to skip the CODEC_MIC DAI when it is not present in disco table, ensuring the correct capture device is used. If CODEC_MIC is present, it continues to be used as default. Fixes: 9489db97f6f0 ("ASoC: sdw_utils: add SmartMic DAI for RT712 VB") Signed-off-by: Mac Chiang Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260508093224.1246282-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit d714913b61d55b936e9060e51e7b78216d34f6b1 Author: Jang Pyohwan Date: Sat May 9 17:53:10 2026 +0900 ASoC: Intel: soc-acpi: add LG Gram 16Z90U RT713 + single RT1320 quirk Add a SoundWire machine table entry for the LG Gram Pro 2026 (16Z90U-KU7BK), which has an unusual configuration: sdw:0:1:025d:1320:01 single stereo RT1320 SmartAmp on link 1 sdw:0:3:025d:0713:01 RT713 jack/headset codec on link 3 Existing rt713-rt1320 boards have two RT1320 amps on different links ("link_mask = BIT(1) | BIT(2) | BIT(3)"). The LG Gram uses a single stereo RT1320 chip, so the new entry uses "link_mask = BIT(1) | BIT(3)" with the existing rt1320_1_group2_adr structure, leaving the two-channel routing to the topology. The RT713 on this board does not expose a SMART_MIC function in ACPI, so the .machine_check callback used by the existing entries (snd_soc_acpi_intel_sdca_is_device_rt712_vb) would reject this board. Drop machine_check for the new entry; speaker output and the headset jack do not depend on the SMART_MIC presence check. The corresponding topology source has been submitted to the SOF project at https://github.com/thesofproject/sof/pull/10760 . The generated sof-ptl-rt713-l3-rt1320-l1-2ch.tplg and nhlt-sof-ptl-rt713-l3-rt1320-l1.bin will follow in linux-firmware once that lands. Tested on Ubuntu 26.04 with kernel 7.0.0-15: speaker (RT1320 stereo), headphone jack with auto-routing, headset mic, and the internal NHLT DMIC array all work via the UCM HiFi profile. Signed-off-by: Jang Pyohwan Link: https://patch.msgid.link/20260509175317.DnhjxHczQay7kkp5z6t4lg@vhgksl.daum.net Signed-off-by: Mark Brown commit d55bf7ce1e62d1d88f4687e8591561809ea0d6ab Merge: 422bd00b71ab42 242200c297030d Author: Mark Brown Date: Mon May 11 10:02:29 2026 +0900 ASoC: soc-acpi-intel-arl-match: add rt712_l0_rt1320_l3 support Bard Liao says: Add rt712_l0_rt1320_l3 support for ARL. commit 242200c297030d9bab62c0ea65f2094981bcf013 Author: Gary C Wang Date: Fri May 8 18:42:38 2026 +0800 ASoC: soc-acpi-intel-arl-match: add rt712_l0_rt1320_l3 support Add support for using the rt712 multi-function codec on link 0 and the rt1320 amplifier on link 3 on ARL platforms. Signed-off-by: Gary C Wang Co-developed-by: Mac Chiang Signed-off-by: Mac Chiang Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260508104239.1247525-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit ac2f21ceddeec5553285e9fc4837a1f23d5e6a37 Author: Mac Chiang Date: Fri May 8 18:42:37 2026 +0800 ASoC: Intel: soc-acpi-intel-arl-match: Reorder ACPI machine tables When the SOF device driver enumerates the machine tables, it selects the entry with the most numbers of matched links in ascending order. Align the ordering with commit 08095e20995ad6e3648af7416c90163627fe7e44 ("ASoC: Intel: soc-acpi-intel-ptl-match: Sort ACPI link/machine tables"). Signed-off-by: Mac Chiang Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260508104239.1247525-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit cbdbfba9e8907bea923874d05d6a35ff429a5544 Author: Ihor Matushchak Date: Fri May 8 10:49:33 2026 +0200 regulator: Kconfig: fix a typo in help Fixes a typo in Kconfig, 'protectorvia' -> 'protector via'. Signed-off-by: Ihor Matushchak Link: https://patch.msgid.link/20260508084933.4076-1-ihor.matushchak@foobox.net Signed-off-by: Mark Brown commit 422bd00b71ab42163aa3b8f8370276fe4c1581e7 Author: Krishnamoorthi M Date: Thu May 7 23:30:51 2026 +0530 spi: amd: Set correct bus number in ACPI probe path On platforms where the HID2 SPI controller (AMDI0063) is enumerated via ACPI instead of PCI, amd_spi_probe() unconditionally sets bus_num to 0, while the PCI probe path assigns bus_num 2 for HID2 controller. Align the ACPI probe path to use the same bus number so that userspace and SPI client drivers see a consistent bus assignment regardless of the enumeration method. Fixes: b644c2776652 ("spi: spi_amd: Add PCI-based driver for AMD HID2 SPI controller") Cc: stable@vger.kernel.org # v6.16+ Signed-off-by: Krishnamoorthi M Link: https://patch.msgid.link/20260507180051.4158674-1-krishnamoorthi.m@amd.com Signed-off-by: Mark Brown commit cb196d50a78ddae227f09b3cd0b145f74a70d241 Author: Rob Herring (Arm) Date: Fri May 8 13:24:37 2026 -0500 ASoC; dt-bindings: mediatek,mt8173-rt5650-rt5514: Fix mediatek,audio-codec constraints A phandle-array is really a matrix and needs constraints on the number of elements for both the inner and outer dimensions. Add the missing inner constraints. Fixes: 472d77bdc511 ("ASoC: dt-bindings: mediatek,mt8173-rt5650-rt5514: convert to DT schema") Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260508182438.1757394-1-robh@kernel.org Signed-off-by: Mark Brown commit b9d16482bebdeded6e61891a5158b51f4ef04f5f Author: Peter Ujfalusi Date: Tue May 5 19:47:44 2026 +0300 MAINTAINERS: ASoC/ti: Remove myself and add Sen Wang as maintainer As I cannot spend adequate time to fulfill my role as maintainer for the TI ASoC drivers, it is for the better if I resign and hand over the role to Sen Wang. Signed-off-by: Peter Ujfalusi Acked-by: Nishanth Menon Link: https://patch.msgid.link/20260505164744.16134-1-peter.ujfalusi@gmail.com Signed-off-by: Mark Brown commit 5d6919055dec134de3c40167a490f33c74c12581 Author: Linus Torvalds Date: Sun May 10 14:08:09 2026 -0700 Linux 7.1-rc3 commit d3e73a0808ddfb91ac36cd548643cbbeb00ad4db Author: Tejun Heo Date: Sun May 10 10:08:16 2026 -1000 sched_ext: Handle SCX_TASK_NONE in disable/switched_from paths scx_fail_parent() leaves cgroup tasks at (state=NONE, sched=parent, sched_class=ext) until the parent itself is torn down by the scx_error() it raised. When the later root_disable iterates them, two paths trip on NONE. scx_disable_and_exit_task() re-enters the wrapper at NONE: the inner switch returns early but the trailing scx_set_task_sched(p, NULL) clobbers the parent sched left by scx_fail_parent(), and scx_set_task_state(p, NONE) wastes a write on an already-NONE task. switched_from_scx() then calls scx_disable_task(), which WARNs on non-ENABLED state and writes state=READY, producing a NONE -> READY transition the validation matrix rejects. Treat NONE as "nothing to do" in both paths. Add a NONE early-return at the top of scx_disable_and_exit_task() and a parallel NONE check in switched_from_scx() next to task_dead_and_done(). Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit cd6aab736702f981ac4d128e04a4e33105ea797d Author: Tejun Heo Date: Sun May 10 10:08:16 2026 -1000 sched_ext: Close sub-sched init race with post-init DEAD recheck scx_sub_enable_workfn()'s init pass and scx_sub_disable() migration both drop the rq lock to call __scx_init_task() against the other sched. A TASK_DEAD @p can fall through sched_ext_dead() in that window. sched_ext_dead() runs ops.exit_task() on the sched @p was attached to, not on the sched whose init just completed, so the new allocation leaks. Reuse the DEAD signal set by sched_ext_dead(). After __scx_init_task() returns, take task_rq_lock(p) and check for DEAD; on hit, call scx_sub_init_cancel_task() against the sub sched the init ran for and drop @p; on miss, proceed as before. Reported-by: zhidao su Link: https://lore.kernel.org/all/20260429133155.3825247-1-suzhidao@xiaomi.com/ Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit c941d7391f258d5d06e0f7e962a52f99a547a83e Author: Tejun Heo Date: Sun May 10 10:08:16 2026 -1000 sched_ext: Close root-enable vs sched_ext_dead() race with SCX_TASK_INIT_BEGIN scx_root_enable_workfn() drops the iter rq lock for ops.init_task() and a TASK_DEAD @p can fall through sched_ext_dead() in that window. The race hits when sched_ext_dead() observes SCX_TASK_INIT (the intermediate state before @p->scx.sched is published) and dereferences NULL via SCX_HAS_OP(NULL, exit_task), or observes SCX_TASK_NONE during the unlocked init window and skips cleanup so exit_task() never runs. Add SCX_TASK_INIT_BEGIN. The enable path writes NONE -> INIT_BEGIN under the iter rq lock, then takes the rq lock again after init to walk INIT_BEGIN -> INIT -> READY. sched_ext_dead() that wins the rq-lock race observes INIT_BEGIN and sets DEAD without calling into ops; the post-init recheck unwinds via scx_sub_init_cancel_task(). scx_fork() runs single-threaded against sched_ext_dead() (the task is not on scx_tasks until scx_post_fork() adds it) so its INIT_BEGIN -> INIT walk needs no rq-lock pairing; it rolls back to NONE on ops.init_task() failure. The validation matrix grows the INIT_BEGIN row and the INIT_BEGIN -> DEAD edge; INIT now requires INIT_BEGIN as the predecessor. scx_sub_disable()'s migration writes INIT_BEGIN as a synthetic predecessor to satisfy the tightened verification. The sub-sched paths still race with sched_ext_dead() during the unlocked init window. This will be fixed by the next patch. Reported-by: zhidao su Link: https://lore.kernel.org/all/20260429133155.3825247-1-suzhidao@xiaomi.com/ Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit cceb8fa9cb2cf98e31d81ecf6353b6ba5ac57744 Author: Tejun Heo Date: Sun May 10 10:08:16 2026 -1000 sched_ext: Replace SCX_TASK_OFF_TASKS flag with SCX_TASK_DEAD state SCX_TASK_OFF_TASKS marked tasks already through sched_ext_dead() so cgroup task iteration would skip them. This can be expressed better with a task state. Replace the flag with SCX_TASK_DEAD. scx_disable_and_exit_task() resets state to NONE on its way out, so sched_ext_dead() now sets DEAD after the wrapper returns. The validation matrix grows NONE -> DEAD, warns on DEAD -> NONE, and tightens READY's predecessor to INIT or ENABLED so the new DEAD value cannot silently transition to READY. Prepares for the following enable vs dead race fix. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 938dd9ab2bd7df0a7e58ce4249794156be9530b4 Author: Tejun Heo Date: Sun May 10 10:08:16 2026 -1000 sched_ext: Inline scx_init_task() and move RESET_RUNNABLE_AT into scx_set_task_state() Prepare for the SCX_TASK_INIT_BEGIN/DEAD work that follows by collapsing the scx_init_task() helper. Move the SCX_TASK_RESET_RUNNABLE_AT setting into scx_set_task_state() on the INIT transition (it was set unconditionally at every INIT site through the scx_init_task() helper), inline scx_init_task() into scx_fork() and scx_root_enable_workfn(), and drop the helper. As a side effect, scx_sub_disable() migration sequence now also sets RESET_RUNNABLE_AT (it previously wrote INIT directly without going through scx_init_task()). The flag triggers a runnable_at reset on the next set_task_runnable(), which is harmless on a task that has just been moved between scheds. On root-enable, p->scx.flags is written without the task's rq lock. The task isn't visible to scx yet, and a follow-up patch restores the lock-held write. v2: Note p->scx.flags rq-lock relaxation on root-enable path. (Andrea) Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 6947bea4b79115f50138882512f85fa9c93b2827 Author: Tejun Heo Date: Sun May 10 10:08:16 2026 -1000 sched_ext: Cleanups in preparation for the SCX_TASK_INIT_BEGIN/DEAD work Cleanups in preparation for the state-machine work that follows: - Convert three sub-sched call sites that open-code rcu_assign_pointer(p->scx.sched, ...) to scx_set_task_sched(). - Move scx_get_task_state()/scx_set_task_state() above the SCX task iter section so scx_task_iter_next_locked() can use them without a forward declaration. No functional change. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit afaa0a477099cb7256e26fe11289c753a225ac97 Merge: aa54b1d27fe0c2 8cf5dd235eff60 Author: Linus Torvalds Date: Sun May 10 12:21:57 2026 -0700 Merge tag 'edac_urgent_for_v7.1_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Fix a string leak in the versalnet driver * tag 'edac_urgent_for_v7.1_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/versalnet: Fix device name memory leak commit a450063ef86b9967234ca1f896c0d77400c74f11 Author: Shitalkumar Gandhi Date: Thu May 7 19:50:24 2026 +0530 net: xgene: fix mdio_np leak in xgene_mdiobus_register() The for_each_child_of_node() loop captures mdio_np via break, holding the refcount. of_mdiobus_register() does not consume the reference, so it leaks on success. Put it after registration. Fixes: e6ad767305eb ("drivers: net: Add APM X-Gene SoC ethernet driver support.") Signed-off-by: Shitalkumar Gandhi Link: https://patch.msgid.link/20260507142024.811543-1-shitalkumar.gandhi@cambiumnetworks.com Signed-off-by: Jakub Kicinski commit 69754da484bdd9a6fc223d939298d656d7e13489 Merge: e42c755582f096 ba9d20ee9076da Author: Jakub Kicinski Date: Sun May 10 10:07:37 2026 -0700 Merge tag 'batadv-net-pullrequest-20260508' of https://git.open-mesh.org/batadv Simon Wunderlich says: ==================== Here are some batman-adv bugfixes: - fix integer overflow on buff_pos, by Lyes Bourennani - fix invalid tp_meter access during teardown, by Jiexun Wang (2 patches) - stop caching unowned originator pointers in BAT IV, by Jiexun Wang - tp_meter: fix tp_num leak on kmalloc failure, by Sven Eckelmann - fix BLA refcounting issues, by Sven Eckelmann (3 patches) * tag 'batadv-net-pullrequest-20260508' of https://git.open-mesh.org/batadv: batman-adv: bla: put backbone reference on failed claim hash insert batman-adv: bla: only purge non-released claims batman-adv: bla: prevent use-after-free when deleting claims batman-adv: tp_meter: fix tp_num leak on kmalloc failure batman-adv: stop caching unowned originator pointers in BAT IV batman-adv: stop tp_meter sessions during mesh teardown batman-adv: reject new tp_meter sessions during teardown batman-adv: fix integer overflow on buff_pos ==================== Link: https://patch.msgid.link/20260508154314.12817-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit e42c755582f0960e684298762f0ab927b3778376 Author: Arthur Kiyanovski Date: Fri May 8 06:21:21 2026 +0000 net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked without holding the lock, and resp was cached from ena_dev->phc.virt_addr before the lock was acquired. If ena_com_phc_destroy() runs between the lockless active check and the lock acquisition, it sets active=false, releases the lock, frees the DMA memory, and sets virt_addr=NULL. The get_timestamp path would then read a NULL virt_addr and dereference it. With both the active check and the pointer read under the lock, destroy cannot free the memory while get_timestamp is using it. Fixes: e0ea34158ee8 ("net: ena: Add PHC support in the ENA driver") Cc: stable@vger.kernel.org Signed-off-by: Arthur Kiyanovski Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260508062126.7273-1-akiyano@amazon.com Signed-off-by: Jakub Kicinski commit 4f8ef58c10bfe5f86a643c7c8331b37e69e3dae1 Author: Chuck Lever Date: Sun Apr 19 14:52:59 2026 -0400 NFSD: Fix infinite loop in layout state revocation find_one_sb_stid() skips stids whose sc_status is non-zero, but the SC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status before calling nfsd4_close_layout(). The retry loop therefore finds the same layout stid on every iteration, hanging the revoker indefinitely. Fixes: 1e33e1414bec ("nfsd: allow layout state to be admin-revoked.") Reported-by: Dai Ngo Reviewed-by: Jeff Layton Tested-by: Dai Ngo Signed-off-by: Chuck Lever commit c00b472a1322d4f5424cd7b6c7d00270eae673bd Author: Jeff Layton Date: Sat Apr 11 17:12:16 2026 -0400 sunrpc: start cache request seqno at 1 to fix netlink GET_REQS sunrpc_cache_requests_snapshot() filters requests with crq->seqno <= min_seqno. The min_seqno for the first netlink dump call is cb->args[0] which is 0. Since next_seqno was initialized to 0, the very first cache request got seqno=0 and was silently skipped by the snapshot (0 <= 0 is true). This caused netlink-based GET_REQS to return 0 pending requests even when a request was queued, preventing mountd from resolving cache entries (particularly expkey/nfsd.fh). The unresolved CACHE_PENDING state blocked all further notifications for the entry, leading to permanent NFS4ERR_DELAY hangs. Start next_seqno at 1 so all requests have seqno >= 1 and pass the snapshot filter when min_seqno is 0. Fixes: facc4e3c8042 ("sunrpc: split cache_detail queue into request and reader lists") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 4183cf383b6faec17a0882b84cd2d901dba62b16 Author: Olga Kornievskaia Date: Fri Apr 10 12:09:20 2026 -0400 nfsd: update mtime/ctime on COPY in presence of delegated attributes When delegated attributes are given on open, the file is opened with NOCMTIME and modifying operations do not update mtime/ctime as to not get out-of-sync with the client's delegated view. However, for COPY operation, the server should update its view of mtime/ctime and reflect that in any GETATTR queries. Fixes: e5e9b24ab8fa ("nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit 2863bac7f49c4acd80a048ce52506a2b9c8db015 Author: Olga Kornievskaia Date: Fri Apr 10 12:09:19 2026 -0400 nfsd: update mtime/ctime on CLONE in presense of delegated attributes When delegated attributes are given on open, the file is opened with NOCMTIME and modifying operations do not update mtime/ctime as to not get out-of-sync with the client's delegated view. However, for CLONE operation, the server should update its view of mtime/ctime and reflect that in any GETATTR queries. Fixes: e5e9b24ab8fa ("nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit 304d81a2fbf2b454def4debcb38ea173911b72cd Author: Scott Mayhew Date: Tue Apr 7 18:08:57 2026 -0400 nfsd: fix file change detection in CB_GETATTR RFC 8881, section 10.4.3 doesn't say anything about caching the file size in the delegation record, nor does it say anything about comparing a cached file size with the size reported by the client in the CB_GETATTR reply for the purpose of determining if the client holds modified data for the file. What section 10.4.3 of RFC 8881 does say is that the server should compare the *current* file size with the size reported by the client holding the delegation in the CB_GETATTR reply, and if they differ to treat it as a modification regardless of the change attribute retrieved via the CB_GETATTR. Doing otherwise would cause the server to believe the client holding the delegation has a modified version of the file, even if the client flushed the modifications to the server prior to the CB_GETATTR. This would have the added side effect of subsequent CB_GETATTRs causing updates to the mtime, ctime, and change attribute even if the client holding the delegation makes no further updates to the file. Modify nfsd4_deleg_getattr_conflict() to obtain the current file size via i_size_read(). Retain the ncf_cur_fsize field, since it's a convenient way to return the file size back to nfsd4_encode_fattr4(), but don't use it for the purpose of detecting file changes. Remove the unnecessary initialization of ncf_cur_fsize in nfs4_open_delegation(). Also, if we recall the delegation (because the client didn't respond to the CB_GETATTR), then skip the logic that checks the nfs4_cb_fattr fields. Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation") Cc: stable@vger.kernel.org Signed-off-by: Scott Mayhew Signed-off-by: Chuck Lever commit 46e9b0224475abc739612ef72c35b7c90211a0c1 Author: Stanislav Fomichev Date: Fri May 8 13:41:13 2026 -0700 tools/ynl: add missing uapi header deps in Makefile.deps ethtool.h includes linux/typelimits.h which is a relatively new header not yet shipped in most distro kernel-header packages. Without the explicit entry, the build silently falls through to -idirafter. dev_energymodel.h is a new YNL family whose uapi header is not in system paths at all and was missing a CFLAGS entry entirely. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260508204114.205896-2-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 Author: Hyunwoo Kim Date: Fri May 8 17:53:09 2026 +0900 rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused. Fixes: d0d5c0cd1e71 ("rxrpc: Use skb_unshare() rather than skb_cow_data()") Cc: stable@vger.kernel.org Signed-off-by: Hyunwoo Kim Reviewed-by: Jiayuan Chen Acked-by: David Howells Signed-off-by: Linus Torvalds commit a1a10cdbc6551ba359169a3033f193b7f8c1b95d Merge: 515186b7be488f de019f203b0d47 Author: Linus Torvalds Date: Sun May 10 08:10:47 2026 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk driver fixes from Stephen Boyd: - Mark the DDR bus clk critical in the SpaceMiT driver so that boot doesn't fail - Fix boot on Mobile EyeQ by creating the auxiliary device for the ethernet PHY - Plug an OF node leak in Rockchip rk808 clk driver * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: rk808: fix OF node reference imbalance MAINTAINERS: add myself as a reviewer for the clk subsystem reset: eyeq: drop device_set_of_node_from_dev() done by parent clk: eyeq: add EyeQ5 children auxiliary device for generic PHYs clk: eyeq: use the auxiliary device creation helper clk: spacemit: k3: mark top_dclk as CLK_IS_CRITICAL commit a4058c09dd6e28ec33316fd6eb45ddae4cab1f31 Author: Felix Gu Date: Thu Mar 26 00:23:58 2026 +0800 phy: spacemit: Remove incorrect clk_disable() in spacemit_usb2phy_init() When clk_enable() fails, the clock was never enabled. Calling clk_disable() in this error path is incorrect. Remove the spurious clk_disable() call from the error handling in spacemit_usb2phy_init(). Fixes: fe4bc1a08638 ("phy: spacemit: support K1 USB2.0 PHY controller") Signed-off-by: Felix Gu Reviewed-by: Ze Huang Link: https://patch.msgid.link/20260326-k1-usb3-v1-1-0c2b6adf5185@gmail.com Signed-off-by: Vinod Koul commit c2cd08e8f150738515c8df415ad7ecfa3d38124a Author: Yulin Lu Date: Mon Apr 13 15:00:33 2026 +0800 phy: eswin: Fix incorrect error check in probe() devm_ioremap() returns NULL on failure, not an ERR_PTR. Using IS_ERR() to check the return value is incorrect. Fix this by checking for NULL and returning -ENOMEM. Fixes: 67ee9ccaa34a ("phy: eswin: Create eswin directory and add EIC7700 SATA PHY driver") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-phy/adjNbuWoc1B-3Ok1@stanley.mountain/ Signed-off-by: Yulin Lu Link: https://patch.msgid.link/20260413070033.128-1-luyulin@eswincomputing.com Signed-off-by: Vinod Koul commit 80305760d7a55b884fb9023c490b75568d1ea0b1 Author: Nitin Rawat Date: Wed Apr 15 16:18:51 2026 +0530 phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4 fix Commit 81af9e40e2e4 ("phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4") moved QPHY_V6_PCS_UFS_PLL_CNTL register configuration from the shared sm8650_ufsphy_g5_pcs table to the SM8650-specific sm8650_ufsphy_pcs base table to fix Gear 4 operation on SM8650. However, this change inadvertently broke kaanapali and SM8750 SoCs which also rely on the shared sm8650_ufsphy_g5_pcs table for Gear 5 configuration but use their own sm8750_ufsphy_pcs base table. After the change, kaanapali PHYs are left without the required PLL_CNTL = 0x33 setting, causing the PHY PLL to remain at its hardware reset default value, preventing PLL lock and resulting in DME_LINKSTARTUP timeouts. Fix this by adding the missing QPHY_V6_PCS_UFS_PLL_CNTL = 0x33 entry to the sm8750_ufsphy_pcs table, mirroring what the original commit already did for sm8650_ufsphy_pcs. Cc: stable@vger.kernel.org # v6.19.12 Fixes: 81af9e40e2e4 ("phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4") Signed-off-by: Nitin Rawat Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260415104851.2763238-1-nitin.rawat@oss.qualcomm.com Signed-off-by: Vinod Koul commit 5a759b120e31aa3ed914d98b51eb1755235250f2 Author: Łukasz Lebiedziński Date: Mon Apr 6 15:56:27 2026 +0200 phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870 The existing PHYPARAM0 tuning values for Exynos7870 are incorrect, causing the USB 2.0 PHY to fail high-speed negotiation and fall back to full-speed (12Mbps) operation. Fix TXVREFTUNE (transmitter voltage reference) from 14 to 3, TXRESTUNE (transmitter impedance) from 3 to 2, and SQRXTUNE (squelch threshold) from 6 to 5. Also explicitly set TXPREEMPPULSETUNE to 0, which was previously missing from the tuning table despite being included in the register mask. All values are derived from the vendor kernel for the Samsung Galaxy A6 (SM-A600FN), as no public hardware documentation is available for the Exynos7870 USB DRD PHY. With these corrections, the PHY successfully negotiates high-speed (480Mbps) operation. Fixes: 588d5d20ca8d ("phy: exynos5-usbdrd: add exynos7870 USBDRD support") Cc: stable@vger.kernel.org Tested-by: Kaustabh Chakraborty Reviewed-by: Krzysztof Kozlowski Signed-off-by: Łukasz Lebiedziński Link: https://patch.msgid.link/20260406135627.234835-1-kernel@lvkasz.us Signed-off-by: Vinod Koul commit da110228b54f2e2143d97ea7151e0dc22e539d67 Author: Wayne Chang Date: Mon May 4 11:33:05 2026 +0800 phy: tegra: xusb: Fix per-pad high-speed termination calibration The existing code reads a single hs_term_range_adj value from bit field [10:7] of FUSE_SKU_CALIB_0 and applies it to all USB2 pads uniformly. However, on SoCs that support per-pad termination, each pad has its own hs_term_range_adj field: pad 0 in FUSE_SKU_CALIB_0[10:7], and pads 1-3 in FUSE_USB_CALIB_EXT_0 at bit offsets [8:5], [12:9], and [16:13] respectively. Fix the calibration by reading per-pad values from the appropriate fuse registers. For SoCs that do not support per-pad termination, replicate pad 0's value to all pads to maintain existing behavior. Add a has_per_pad_term flag to the SoC data to indicate whether per-pad termination values are available in FUSE_USB_CALIB_EXT_0. Fixes: 1ef535c6ba8e ("phy: tegra: xusb: Add Tegra194 support") Cc: stable@vger.kernel.org Signed-off-by: Wayne Chang Signed-off-by: Wei-Cheng Chen Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20260504033305.2283145-1-weichengc@nvidia.com Signed-off-by: Vinod Koul commit 91ddf6f722084383fb05be731c0107814b055c0c Author: Gabor Juhos Date: Sat Mar 21 15:42:32 2026 +0100 phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access The mvebu_a3700_utmi_phy_power_off() function tries to modify the USB2_PHY_CTRL register by using the IO address of the PHY IP block along with the readl/writel IO accessors. However, the register exist in the USB miscellaneous register space, and as such it must be accessed via regmap like it is done in the mvebu_a3700_utmi_phy_power_on() function. Change the code to use regmap_update_bits() for modífying the register to fix this. Fixes: cc8b7a0ae866 ("phy: add A3700 UTMI PHY driver") Signed-off-by: Gabor Juhos Reviewed-by: Miquel Raynal Link: https://patch.msgid.link/20260321-a3700-utmi-fix-usb2_phy_ctrl-access-v1-1-6005ff4b5058@gmail.com Signed-off-by: Vinod Koul commit 8c16c1c00167134f15ca8e9defdf38b1cac08c36 Author: DaeMyung Kang Date: Sun May 10 11:13:11 2026 +0900 ntfs: fix empty_buf and ra lifetime bugs in ntfs_empty_logfile() ntfs_empty_logfile() has three related allocator bugs around the @empty_buf and @ra buffers it uses inside the per-cluster loop. When the loop encounters a runlist entry with LCN_RL_NOT_MAPPED, the function kvfrees @empty_buf and goes to map_vcn to remap. @empty_buf is not cleared. If ntfs_map_runlist_nolock() fails on re-entry, control jumps to the err label which kvfrees @empty_buf a second time. In the same branch, @ra is left allocated. When the remap succeeds the function falls through the @empty_buf re-allocation and the @ra re-allocation, overwriting the previous @ra pointer and leaking it. The success path frees @empty_buf with kfree() instead of kvfree(). kvzalloc() may fall back to vmalloc(), in which case kfree() does not correctly release the memory. A KASAN-enabled QEMU harness mirroring this control flow reports "BUG: KASAN: double-free" when the second ntfs_map_runlist_nolock() fails. Clear both @empty_buf and @ra after the in-loop releases so the err path is a no-op when the buffers have already been freed and so the remap-success path does not leak the previous @ra. Switch the success path to kvfree() to match the @empty_buf allocator. Fixes: 5218cd102aec ("ntfs: update misc operations") Signed-off-by: DaeMyung Kang Signed-off-by: Namjae Jeon commit bc27dbefae6ed11376d991a2921eff806ffef67c Author: Hans de Goede Date: Sat Apr 25 14:33:51 2026 +0200 clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked Parking disp_cc_mdss_mdp_clk_src at 19.2MHz causing the EFI GOP framebuffer to stop functioning. The EFI GOP framebuffer should keep working until the msm display driver loads, to help with boot debugging and to ensure display output when the msm module is not in the initramfs. Switch disp_cc_mdss_mdp_clk_src over to clk_rcg2_shared_no_init_park_ops to keep the EFI GOP working after binding the x1e80100-dispcc driver. Suggested-by: Dmitry Baryshkov Signed-off-by: Hans de Goede Reviewed-by: Dmitry Baryshkov Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") Link: https://lore.kernel.org/r/20260425123351.6292-1-johannes.goede@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 515186b7be488f37c63c2436fc2d1a160ef9bb95 Merge: 1bfaee9d3351b9 3ac1a467e37683 Author: Linus Torvalds Date: Sat May 9 18:42:54 2026 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix sk_local_storage diag dump via netlink (Amery Hung) - Fix off-by-one in arena direct-value access (Junyoung Jang) - Reject TCP_NODELAY in bpf-tcp congestion control (KaFai Wan) - Fix type confusion in bpf_*_sock() (Kuniyuki Iwashima) - Reject TX-only AF_XDP sockets (Linpu Yu) - Don't run arg-tracking analysis twice on main subprog (Paul Chaignon) - Fix NULL pointer dereference in bpf_sk_storage_clone and fib lookup (Weiming Shi) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix off-by-one boundary validation in arena direct-value access xskmap: reject TX-only AF_XDP sockets bpf: Don't run arg-tracking analysis twice on main subprog bpf: Free reuseport cBPF prog after RCU grace period. bpf: tcp: Fix type confusion in sol_tcp_sockopt(). bpf: tcp: Fix type confusion in bpf_skc_to_tcp6_sock(). bpf: tcp: Fix type confusion in bpf_skc_to_tcp_sock(). mptcp: bpf: Fix type confusion in bpf_mptcp_sock_from_subflow() selftest: bpf: Add test for bpf_tcp_sock() and RAW socket. bpf: tcp: Fix type confusion in bpf_tcp_sock(). tools/headers: Regenerate stddef.h to fix BPF selftests bpf: Fix sk_local_storage diag dumping uninitialized special fields bpf: Fix NULL pointer dereference in bpf_skb_fib_lookup() sockmap: Fix sk_psock_drop() race vs sock_map_{unhash,close,destroy}(). bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths selftests/bpf: Verify bpf-tcp-cc rejects TCP_NODELAY selftests/bpf: Test TCP_NODELAY in TCP hdr opt callbacks bpf: Reject TCP_NODELAY in bpf-tcp-cc bpf: Reject TCP_NODELAY in TCP header option callbacks commit 3ac1a467e37683f602221e243fa3c59b0de81165 Author: Junyoung Jang Date: Mon Apr 27 02:25:05 2026 +0900 bpf: Fix off-by-one boundary validation in arena direct-value access BPF_MAP_TYPE_ARENA accepts BPF_PSEUDO_MAP_VALUE offsets at exactly the end of the arena mapping (off == arena_size). The boundary check in arena_map_direct_value_addr() uses `>` instead of `>=`, which incorrectly allows a one-past-end pointer to be accepted. Change the condition to `>=` to correctly reject offsets that fall outside the valid arena user_vm range. Fixes: 317460317a02 ("bpf: Introduce bpf_arena.") Signed-off-by: Junyoung Jang Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260426172505.1947915-1-graypanda.inzag@gmail.com Signed-off-by: Alexei Starovoitov commit bf6d507f7e3c65751d52fd8caf1ea4e003922624 Author: Linpu Yu Date: Fri May 8 22:43:43 2026 +0800 xskmap: reject TX-only AF_XDP sockets XSKMAP entries are used as redirect targets for incoming XDP frames. A TX-only AF_XDP socket lacks an Rx ring and cannot handle redirected traffic, but xsk_map_update_elem() currently allows such sockets to be inserted into the map. Redirecting packets to such a socket on the veth generic-XDP path causes a kernel crash in xsk_generic_rcv(). This became possible after xsk_is_setup_for_bpf_map() was removed from the XSKMAP update path, which allowed bound TX-only sockets to be inserted into the map. Reject TX-only sockets during XSKMAP updates to avoid the crash. They remain fully operational for pure Tx purposes outside XSKMAP. Fixes: 968be23ceaca ("xsk: Fix possible segfault at xskmap entry insertion") Reported-by: Juefei Pu Reported-by: Yuan Tan Reported-by: Xin Liu Signed-off-by: Yifan Wu Signed-off-by: Linpu Yu Reviewed-by: Jason Xing Link: https://lore.kernel.org/r/20260508144344.694-1-linpu5433@gmail.com Signed-off-by: Alexei Starovoitov commit 512809bb8a370d071f66fc53abe67368e171dec5 Author: Paul Chaignon Date: Thu May 7 20:22:06 2026 +0200 bpf: Don't run arg-tracking analysis twice on main subprog Because subprog 0, the main subprog, is considered a global function, we end up running the arg-tracking dataflow analysis twice on it. That results in slightly longer verification but mostly in more verbose verifier logs. This patch fixes it by keeping only the iteration over global subprogs. When running over all of Cilium's programs with BPF_LOG_LEVEL2, this reduces verbosity by ~20% on average. Fixes: bf0c571f7feb6 ("bpf: introduce forward arg-tracking dataflow analysis") Signed-off-by: Paul Chaignon Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/e4d7b53d4963ef520541a782f5fc8108a168877c.1778176504.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 1bfaee9d3351b9b32a99766bbfb1f5baed60ddef Merge: e92b2872d0b198 0c8c88b8eb82a2 Author: Linus Torvalds Date: Sat May 9 11:47:39 2026 -0700 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull fsverity fix from Eric Biggers: "Fix a regression in overlayfs caused by an fsverity API change" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: ovl: fix verity lazy-load guard broken by fsverity_active() semantic change commit e92b2872d0b198a77c0a438c5cdb1c5510762c1b Merge: ec89572766744e 2adc8664018c1c Author: Linus Torvalds Date: Sat May 9 11:24:02 2026 -0700 Merge tag 'rust-fixes-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Add 'bindgen' target to make UML 32-bit builds work with GCC - Disable two Clippy warnings ('collapsible_{if,match}') 'pin-init' crate: - Fix unsoundness issue that created &'static references" * tag 'rust-fixes-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: allow `clippy::collapsible_if` globally rust: allow `clippy::collapsible_match` globally rust: pin-init: fix incorrect accessor reference lifetime rust: pin-init: internal: move alignment check to `make_field_check` rust: arch: um: Fix building 32-bit UML with GCC commit b64f0ae5d47c0bd9581eb9cd59375a87f748dc00 Author: DaeMyung Kang Date: Sat May 9 15:12:37 2026 +0900 ntfs: validate attribute name bounds before returning it ntfs_attr_find() validates a named attribute before comparing it with the requested name, but that check is currently after the AT_UNUSED handling. When callers enumerate attributes with AT_UNUSED, ntfs_attr_find() can return a malformed named attribute before checking whether name_offset and name_length stay within the attribute record. Some enumeration callers use the returned attribute name pointer directly. For example, one path passes (attr + name_offset, name_length) to ntfs_attr_iget(), where the name can later be copied according to name_length. A malformed on-disk name_offset/name_length pair should not be exposed to those callers. Move the existing name bounds validation before returning attributes during AT_UNUSED enumeration, and write it as an offset/remaining-size check so the subtraction cannot underflow. Extract the converted values into local variables (name_offset, attr_len, name_size) to make the intent explicit and avoid repeating the endian conversions inside the bounds check. This keeps matching attributes on the same checked path while also covering attribute enumeration. A small userspace ASAN model with attr length=32, name_offset=124 and name_length=8 reproduces a heap-buffer-overflow read in the old enumeration path. With this change the same malformed attribute is rejected before the name pointer is returned to the caller. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: DaeMyung Kang Signed-off-by: Namjae Jeon commit 679ee5afd5b4764911656b4d4b83b9abee2b5572 Author: DaeMyung Kang Date: Sat May 9 15:12:36 2026 +0900 ntfs: fix MFT bitmap scan 2^32 boundary check NTFS MFT record numbers are limited to the 32-bit range, and ntfs_mft_record_layout() rejects mft_no >= 2^32. The free-MFT-record bitmap scan in ntfs_mft_bitmap_find_and_alloc_free_rec_nolock() also guards against this overflow but uses a strict greater than comparison, allowing record number 2^32 itself through this earlier check. Every other 2^32 boundary check in fs/ntfs/mft.c uses '>=', so the strict greater than here is both a real off-by-one and an internal inconsistency. A model with ll == 2^32 confirms the current check accepts the value while the corrected check rejects it. Use '>=' so the boundary matches the layout-time rejection and the surrounding bitmap-scan checks. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: DaeMyung Kang Signed-off-by: Namjae Jeon commit 6098790c403d5e95a35bb6bf938591ca8c8e224f Author: DaeMyung Kang Date: Sat May 9 15:12:35 2026 +0900 ntfs: validate MFT attrs_offset against bytes_in_use ntfs_mft_record_check() verifies that attrs_offset is aligned and that the resulting pointer stays within the allocated MFT record buffer, but it does not check that the first attribute header starts within the bytes_in_use area. A malformed record with attrs_offset greater than bytes_in_use can pass this check as long as attrs_offset is still within bytes_allocated. The attribute parser then computes the remaining record space by subtracting the attribute pointer from bytes_in_use. Because that value is unsigned, the subtraction can underflow and allow bytes after bytes_in_use to be interpreted as an attribute. Reject records where attrs_offset is outside bytes_in_use or where the used area does not even contain the four-byte attribute type/AT_END terminator at attrs_offset. A small userspace model with attrs_offset=128 and bytes_in_use=64 shows the current check accepts the record and the parser space calculation underflows to 0xffffffc0. With this change the same malformed record is rejected before the attribute walker is entered. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: DaeMyung Kang Signed-off-by: Namjae Jeon commit ec89572766744e844df24c27d31c97b4c00f4e07 Merge: 234d72ae02e48c 99076a17a112ac Author: Linus Torvalds Date: Sat May 9 08:32:50 2026 -0700 Merge tag 'hwmon-for-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - ads7871: Fix endianness bug in 16-bit register reads - lm75: Fix configuration register writes and AS6200/TMP112 setup and alarm handling - lm63: Fix TOCTOU problems - corsair-psu: Close HID device on probe errors - ltc2992: Fix overflow and threshold range - Documentation: fix link to ideapad-laptop.c file - Remove stale CONFIG_SENSORS_SBRMI Makefile reference * tag 'hwmon-for-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ads7871) Fix endianness bug in 16-bit register reads hwmon: (lm75) Fix configuration register writes. hwmon: (lm75) Fix AS6200 and TMP112 setup and alarm handling hwmon: (lm63) Add locking to avoid TOCTOU hwmon: (corsair-psu) Close HID device on probe errors hwmon: Remove stale CONFIG_SENSORS_SBRMI Makefile reference Documentation: hwmon: fix link to ideapad-laptop.c file hwmon: (ltc2992) Fix u32 overflow in power read path hwmon: (ltc2992) Clamp threshold writes to hardware range commit 234d72ae02e48cd0cf0f6e8f8f7d57c0cf7bcc66 Merge: fe3e5bc9e3c280 bc851db06045a4 Author: Linus Torvalds Date: Sat May 9 08:26:08 2026 -0700 Merge tag 'staging-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are two small staging driver fixes for 7.1-rc3. They are: - vme_user root device leak fix - NULL dereference bugfix in the rtl8723bs driver Both of these have been in linux-next all this week with no reported issues" * tag 'staging-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc staging: vme_user: fix root device leak on init failure commit fe3e5bc9e3c280017d4ba05d7fcc8997029e53cd Merge: 656a95c4a0faf9 4fd44d47e8ab76 Author: Linus Torvalds Date: Sat May 9 08:16:24 2026 -0700 Merge tag 'usb-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB driver fixes from Greg KH: "Here are some small USB driver fixes for 7.1-rc3 to resolve some reported issues, and a new device id. These are: - usblp driver heap leak fixes - ulpi driver memory leak fix - typec driver fixes - dwc3 driver fix - omap dma driver fix - new option driver device id addition All of these have been in linux-next for over a week with no reported issues" * tag 'usb-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: serial: option: add Telit Cinterion LE910Cx compositions usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl usb: usblp: fix heap leak in IEEE 1284 device ID via short response usb: dwc3: Move GUID programming after PHY initialization usb: typec: tcpm: fix debug accessory mode detection for sink ports usb: typec: tcpm: reset internal port states on soft reset AMS usb: ulpi: fix memory leak on ulpi_register() error paths USB: omap_udc: DMA: Don't enable burst 4 mode commit 656a95c4a0faf9ebb8e15e7e38ade41164018c99 Merge: bf0e022821fa51 3051cd060fa496 Author: Linus Torvalds Date: Sat May 9 08:10:07 2026 -0700 Merge tag 'i2c-for-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - sanitize more input parameters in the core (found by syzkaller) - usual set of driver fixes (proper completion handling, applying quirks, correct workqueue selection...) - ID additions to simplify dependency handling - new email address for Peter Rosin * tag 'i2c-for-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: smbus: reject oversized block transfers in the common path MAINTAINERS: Update mail for Peter Rosin i2c: stub: Reject I2C block transfers with invalid length i2c: Compare the return value of gpiod_get_direction against GPIO_LINE_DIRECTION_OUT i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl i2c: acpi: Add ELAN0678 to i2c_acpi_force_100khz_device_ids dt-bindings: i2c: apple,i2c: Add t8122 compatible i2c: stm32f7: reinit_completion() per transfer not per msg dt-bindings: i2c: amlogic: Add compatible for T7 SOC i2c: testunit: Replace system_long_wq with system_dfl_long_wq commit bf0e022821fa516cd6eb0292fcb4ccdd4e201c9f Merge: 70390501d1944d f583bd5f64d40e Author: Linus Torvalds Date: Sat May 9 08:03:21 2026 -0700 Merge tag 'powerpc-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Fix KASAN sanitization flag for core_$(BITS).o - Fixes for handling offset values in pseries htmdump - Fix interrupt mask in cpm1_gpiochip_add16() - ps3/pasemi fixes to drop redundant result assignment - Fixes in papr-hvpipe code path - powerpc/perf: Update check for PERF_SAMPLE_DATA_SRC marked events Thanks to Aboorva Devarajan, Athira Rajeev, Christophe Leroy (CS GROUP), Geert Uytterhoeven, Haren Myneni, Krzysztof Kozlowski, Mukesh Kumar Chaurasiya (IBM), Nathan Chancellor, Ritesh Harjani (IBM), Shivani Nittor, Sourabh Jain, Thomas Zimmermann, and Venkat Rao Bagalkote. * tag 'powerpc-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (21 commits) powerpc/pasemi: Drop redundant res assignment powerpc/ps3: Drop redundant result assignment powerpc/vdso: Drop -DCC_USING_PATCHABLE_FUNCTION_ENTRY from 32-bit flags with clang arch/powerpc: Drop CONFIG_FIRMWARE_EDID from defconfig files powerpc/perf: Update check for PERF_SAMPLE_DATA_SRC marked events powerpc/8xx: Fix interrupt mask in cpm1_gpiochip_add16() powerpc/vmx: avoid KASAN instrumentation in enter_vmx_ops() for kexec powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o pseries/papr-hvpipe: Fix style and checkpatch issues in enable_hvpipe_IRQ() pseries/papr-hvpipe: Refactor and simplify hvpipe_rtas_recv_msg() pseries/papr-hvpipe: Kill task_struct pointer from struct hvpipe_source_info pseries/papr-hvpipe: Simplify spin unlock usage in papr_hvpipe_handle_release() pseries/papr-hvpipe: Fix the usage of copy_to_user() pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace pseries/papr-hvpipe: Fix race with interrupt handler powerpc/pseries/htmdump: Add memory configuration dump support to htmdump module powerpc/pseries/htmdump: Fix the offset value used in htm status dump powerpc/pseries/htmdump: Fix the offset value used in processor configuration dump ... commit 70390501d1944d4e5b8f7352be180fceb3a44132 Merge: 6e1e5a33e80910 5772f6535227eb Author: Linus Torvalds Date: Fri May 8 20:28:45 2026 -0700 Merge tag 'x86-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Fix memory map enumeration bug in the Xen e820 parsing code (Juergen Gross) - Re-enable e820 BIOS fallback if e820 table is empty (David Gow) * tag 'x86-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot/e820: Re-enable BIOS fallback if e820 table is empty x86/xen: Fix a potential problem in xen_e820_resolve_conflicts() commit d1aabc2132d29224caa3c994dadd8224dc473ed9 Author: Zhan Xusheng Date: Fri May 8 15:29:34 2026 +0800 ntfs: fix missing kstrdup() error check in ntfs_write_volume_label() ntfs_write_volume_label() does not check the return value of kstrdup(). If the allocation fails, vol->volume_label is set to NULL while the function returns success. A subsequent FS_IOC_GETFSLABEL then returns an empty string even though the on-disk label was updated correctly. Fix by allocating the new label before taking vol_ni->mrec_lock and updating any on-disk metadata, so an -ENOMEM from kstrdup() leaves both the in-memory and on-disk labels untouched and consistent. On success the preallocated copy replaces the old vol->volume_label. Also move mark_inode_dirty_sync() into the success path so that it is not called when no metadata was actually modified. Fixes: 6251f0b0de7d ("ntfs: update super block operations") Suggested-by: Hyunchul Lee Signed-off-by: Zhan Xusheng Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 6e1e5a33e809105f44401b6a962a2c63e360f561 Merge: 7f002321526222 bd3c45dd01283a Author: Linus Torvalds Date: Fri May 8 20:03:39 2026 -0700 Merge tag 'timers-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix CPU hotplug activation race in the timer migration code, by Frederic Weisbecker" * tag 'timers-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timers/migration: Fix another hotplug activation race commit 7f0023215262221ca08d56be2203e8a4770be033 Merge: e5cf0260a7472b 9f6d929ee2c6f0 Author: Linus Torvalds Date: Fri May 8 19:42:10 2026 -0700 Merge tag 'sched-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: - Fix spurious failures in rseq self-tests (Mark Brown) - Fix rseq rseq::cpu_id_start ABI regression due to TCMalloc's creative use of the supposedly read-only field The fix is to introduce a new ABI variant based on a new (larger) rseq area registration size, to keep the TCMalloc use of rseq backwards compatible on new kernels (Thomas Gleixner) - Fix wakeup_preempt_fair() for not waking up task (Vincent Guittot) - Fix s64 mult overflow in vruntime_eligible() (Zhan Xusheng) * tag 'sched-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix wakeup_preempt_fair() for not waking up task sched/fair: Fix overflow in vruntime_eligible() selftests/rseq: Expand for optimized RSEQ ABI v2 rseq: Reenable performance optimizations conditionally rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode selftests/rseq: Validate legacy behavior selftests/rseq: Make registration flexible for legacy and optimized mode selftests/rseq: Skip tests if time slice extensions are not available rseq: Revert to historical performance killing behaviour rseq: Don't advertise time slice extensions if disabled rseq: Protect rseq_reset() against interrupts rseq: Set rseq::cpu_id_start to 0 on unregistration selftests/rseq: Don't run tests with runner scripts outside of the scripts commit e5cf0260a7472b4f34a46c418c14bec272aac404 Merge: 27a26ccfd528da aa4384bc8f4360 Author: Linus Torvalds Date: Fri May 8 19:39:18 2026 -0700 Merge tag 'perf-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events fixes from Ingo Molnar: - Fix deadlock in the perf_mmap() failure path (Peter Zijlstra) - Intel ACR (Auto Counter Reload) fixes (Dapeng Mi): - Fix validation and configuration of ACR masks - Fix ACR rescheduling bug causing stale masks - Disable the PMI on ACR-enabled hardware - Enable ACR on Panther Cover uarch too * tag 'perf-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Enable auto counter reload for DMR perf/x86/intel: Disable PMI for self-reloaded ACR events perf/x86/intel: Always reprogram ACR events to prevent stale masks perf/x86/intel: Improve validation and configuration of ACR masks perf/core: Fix deadlock in perf_mmap() failure path commit 496c0c4c53bbe1bad97e82cd12103df61a6e459d Author: Holger Brunck Date: Thu May 7 17:53:32 2026 +0200 net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean When the device is removed all allocated resources should be freed. In uhdlc_memclean the netdev transmit queue was already stopped. But at this point we may have pending skb in the transmit queue which must be freed. Therefore iterate over the tx_skbuff pointers and free all pending skb. The issue was discovered by sashiko. Tested on a ls1043a board running HDLC in bus mode on kernel 6.12. https: //sashiko.dev/#/patchset/20260429114208.941011-1-holger.brunck%40hitachienergy.com Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC") Signed-off-by: Holger Brunck Link: https://patch.msgid.link/20260507155332.3452319-1-holger.brunck@hitachienergy.com Signed-off-by: Jakub Kicinski commit 28d006063253bf055291f62b0a48934cd5872dc0 Merge: abb5f36771cc4c 19f94b6fee75b3 Author: Jakub Kicinski Date: Fri May 8 18:28:26 2026 -0700 Merge tag 'nf-26-05-08' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following batch contains Netfilter fixes for net: 1) Allow initial x_tables table replacement without emitting an audit log message. Delay the register message until after hooks are wired up to avoid unnecessary unregister logs during error unwinding. 2) Fix a NULL dereference by allocating hook ops before adding the table to the per-netns list. Use `synchronize_rcu()` during error unwinding to ensure the table stops processing packets before teardown. Defer audit log register message until all operations succeed. 3) Refactor xtables to use a single `xt_unregister_table_pre_exit` function. Eliminate code duplication by centralizing table unregistration logic within the xtables core. ebtables cannot be changed due to incompatibility. 4) Unregister xtables templates before module removal. This prevents a race condition where userspace instantiates a new table after the pernet unreg removed the current table. 5) Add `xtables_unregister_table_exit` to fully unregister netfilter tables during module removal. Unlink the table from dying lists, then free hook operations. 6) Implement a two-stage removal scheme for ebtables following the x_tables pattern. Assign table->ops while holding the ebt mutex to prevent exposing partially-filled structures. 7) Fix ebtables module initialization race. Register the template last in table initialization functions. Prevent table instantiation before pernet operations are available. 8) Fix a race condition in x_tables module initialization. Ensure pernet ops are fully set up before exposing the table to userspace. 9) Fix a race condition in ebtables module initialization, similar to previous patch. 10) Restore propagation of helper to expected connection, this is a fix-for-recent-fix. 11) Validate that the expectation tuple and mask netlink attributes are present when adding expectation via nfqueue, this fixes a possible null-ptr-deref. 12) Fix possible rare memleak in the SIP helper in case helper has been detached from conntrack entry, from Li Xiasong. 13) Fix refcount leak in nft_ct when creating custom expectation, also from Li Xiason. Patches 1-9 from Florian Westphal. 10) Restore propagation of helper to expected connection, this is a fix-for-recent-fix. 11) Check that tuple and mask netlink attributes are set when creating an expectation via nfqueue. * tag 'nf-26-05-08' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_ct: fix missing expect put in obj eval netfilter: nf_conntrack_sip: get helper before allocating expectation netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue netfilter: nf_conntrack_expect: restore helper propagation via expectation netfilter: bridge: eb_tables: close module init race netfilter: x_tables: close dangling table module init race netfilter: ebtables: close dangling table module init race netfilter: ebtables: move to two-stage removal scheme netfilter: x_tables: add and use xtables_unregister_table_exit netfilter: x_tables: unregister the templates first netfilter: x_tables: add and use xt_unregister_table_pre_exit netfilter: x_tables: allocate hook ops while under mutex netfilter: x_tables: allow initial table replace without emitting audit log message ==================== Link: https://patch.msgid.link/20260507234509.603182-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit abb5f36771cc4c05899b34000829a787572a8817 Author: Ben Morris Date: Thu May 7 17:14:55 2026 -0700 sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may drop the socket lock inside sctp_wait_for_sndbuf(). While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the association cached in @tmp, migrating it to a new endpoint via sctp_sock_migrate() (list_del_init() + list_add_tail() to newep->asocs), and optionally close the new socket which frees the association via kfree_rcu(). The cached @tmp can also be freed by a network ABORT for that association, processed in softirq while the lock is dropped. sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock via the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothing revalidates @tmp. After a successful return, the iterator advances to the stale @tmp, yielding either a use-after-free (if the peeled socket was closed) or a list-walk onto the new endpoint's list head (type confusion of &newep->asocs as a struct sctp_association *). Both are reachable from CapEff=0; the type-confusion path gives controlled indirect call via the outqueue.sched->init_sid pointer. Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc() returns. @asoc is known to still be on ep->asocs at that point: the only callers that list_del an association from ep->asocs are sctp_association_free() (which sets asoc->base.dead) and sctp_assoc_migrate() (which changes asoc->base.sk), and sctp_wait_for_sndbuf() checks both under the lock before any successful return; a tripped check propagates as err < 0 and the loop bails before the re-derive. The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the loop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so the @tmp cached by list_for_each_entry_safe() still covers the lock-held free that ba59fb027307 ("sctp: walk the list of asoc safely") was added for. Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg") Cc: stable@vger.kernel.org Signed-off-by: Ben Morris Acked-by: Xin Long Link: https://patch.msgid.link/20260508001455.3137-1-joycathacker@gmail.com Signed-off-by: Jakub Kicinski commit 6635fa84403c3a59455b66007c019a7cc632db30 Author: Shitalkumar Gandhi Date: Thu May 7 01:28:13 2026 +0530 net: ti: icssm-prueth: fix eth_ports_node leak in probe The error path on of_property_read_u32() failure inside icssm_prueth_probe() returns without putting eth_ports_node, which was acquired before the for_each_child_of_node() loop. Drop it before returning. Fixes: 511f6c1ae093 ("net: ti: icssm-prueth: Adds ICSSM Ethernet driver") Signed-off-by: Shitalkumar Gandhi Link: https://patch.msgid.link/20260506195813.641610-1-shitalkumar.gandhi@cambiumnetworks.com Signed-off-by: Jakub Kicinski commit c4f3d6eb1fcf6cd9ce4644f604d5aad1ce594dfc Author: Myeonghun Pak Date: Wed May 6 21:43:11 2026 +0900 net: lan966x: avoid unregistering netdev on register failure lan966x_probe_port() stores the newly allocated net_device in the port before calling register_netdev(). If register_netdev() fails, the probe error path calls lan966x_cleanup_ports(), which sees port->dev and calls unregister_netdev() for a device that was never registered. Destroy the phylink instance created for this port and clear port->dev before returning the registration error. The common cleanup path now skips ports without port->dev before reaching the registered netdev cleanup, so it only handles ports that reached the registered-netdev lifetime. This also avoids treating an uninitialized FDMA netdev and the failed port as a NULL == NULL match in the common cleanup path. Fixes: d28d6d2e37d1 ("net: lan966x: add port module support") Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Link: https://patch.msgid.link/20260506124331.31945-1-mhun512@gmail.com Signed-off-by: Jakub Kicinski commit 27a26ccfd528da725a999ea1e3102503c61eb655 Merge: 678ede852f9185 5cbb61bf416885 Author: Linus Torvalds Date: Fri May 8 16:18:35 2026 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Catalin Marinas: - ptrace(PTRACE_SETREGSET) fix to zero the target's fpsimd_state rather than the tracer's * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's commit 678ede852f918581fbc43c61f4c4737a3df99cac Merge: cbf457c584b5cb 9ef40a09c5de18 Author: Linus Torvalds Date: Fri May 8 16:08:58 2026 -0700 Merge tag 'pci-v7.1-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Don't fallback to bus reset after failed slot reset; a bus reset isn't safe if the .reset_slot() callback is implemented (Keith Busch) - Update saved_config_space upon resource assignment to fix passthrough regressions when x86 pcibios_assign_resources() updates BARs (Lukas Wunner) - Initialize a temporary pci_dev->dev in sysfs 'new_id' attribute to fix a lockdep regression after driver_override was moved from PCI to device core (Samiullah Khawaja) - Update MAINTAINERS email addresses (Marek Vasut, Hans Zhang) - Add MAINTAINERS reviewer for PCIe Cadence IP (Aksh Garg) * tag 'pci-v7.1-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: MAINTAINERS: Add Aksh Garg as PCIe CADENCE reviewer MAINTAINERS: Update Hans Zhang email for PCIe CIX Sky1 MAINTAINERS: Update Marek Vasut email for PCIe R-Car PCI: Initialize temporary device in new_id_store() PCI: Update saved_config_space upon resource assignment PCI: Don't fallback to bus reset after failed slot reset commit f149471f4e9aa7b5d4ee0220e57262bd81b42db0 Merge: a77d5a069d959d 30f1658fc53873 Author: Jakub Kicinski Date: Fri May 8 16:01:11 2026 -0700 Merge branch 'intel-wired-lan-driver-updates-2026-05-04-i40e-ice-idpf' Jacob Keller says: ==================== Intel Wired LAN Driver Updates 2026-05-04 (i40e, ice, idpf) Matt Volrath fixes two issues with the i40e driver probe routine, ensuring that PTP is properly cleaned up if the probe fails. Emil corrects the initialization of the read_dev_clk_lock spinlock in idpf_ptp_init, ensuring it is initialized prior to when the ptp_schedule_worker() is called. Greg KH fixes a double free and use-after free in the idpf auxiliary device error paths. Marcin fixes ice_set_rss_hfunc() to use the correct q_opt_flags field, correcting the assignment and preventing submission of invalid data to the firmware. Bart corrects the locking in ice_dcb_rebuild(), ensuring that the tc_mutex is held over the entire operation. Ivan fixes the rclk pin state get for E810 devices, ensuring the index is properly offset by the base_rclk_idx value. This ensures that the correct pin index is used to look up recovered clock state. He additionally adds bounds checking to prevent attempting to access pins outside of the pin state array. Ivan also moves the CGU register macros to the top of ice_dpll.h, inside the header guard to avoid duplicate macro definitions should the ice_dpll.h header is included multiple times. ==================== Link: https://patch.msgid.link/20260506-jk-iwl-net-2026-05-04-v2-0-a5ea4dc837a9@intel.com Signed-off-by: Jakub Kicinski commit 30f1658fc5387384c7a60b9d15c79cb959512c1a Author: Ivan Vecera Date: Wed May 6 14:48:17 2026 -0700 ice: dpll: fix misplaced header macros The CGU register definitions (ICE_CGU_R10, ICE_CGU_R11 and related field masks) were placed after the #endif of the _ICE_DPLL_H_ include guard, leaving them unprotected. Move them inside the guard. Fixes: ad1df4f2d591 ("ice: dpll: Support E825-C SyncE and dynamic pin discovery") Signed-off-by: Ivan Vecera Reviewed-by: Aleksandr Loktionov Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260506-jk-iwl-net-2026-05-04-v2-8-a5ea4dc837a9@intel.com Signed-off-by: Jakub Kicinski commit cce709d8df6ba6d2a0a0dbf34acc2cdd9e23bd46 Author: Ivan Vecera Date: Wed May 6 14:48:16 2026 -0700 ice: dpll: fix rclk pin state get for E810 The refactoring of ice_dpll_rclk_state_on_pin_get() to use ice_dpll_pin_get_parent_idx() omitted the base_rclk_idx adjustment that was correctly added in the ice_dpll_rclk_state_on_pin_set() path. This breaks E810 devices where base_rclk_idx is non-zero, causing the wrong hardware index to be used for pin state lookup and incorrect recovered clock state to be reported via the DPLL subsystem. E825C is unaffected as its base_rclk_idx is 0. While at it, add bounds check against ICE_DPLL_RCLK_NUM_MAX on hw_idx after the base_rclk_idx subtraction in both ice_dpll_rclk_state_on_pin_{get,set}() to prevent out-of-bounds access on the pin state array. Fixes: ad1df4f2d591 ("ice: dpll: Support E825-C SyncE and dynamic pin discovery") Signed-off-by: Ivan Vecera Reviewed-by: Aleksandr Loktionov Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260506-jk-iwl-net-2026-05-04-v2-7-a5ea4dc837a9@intel.com Signed-off-by: Jakub Kicinski commit 0ded1f36ba4021cba50513e80be6b6e173710168 Author: Bart Van Assche Date: Wed May 6 14:48:15 2026 -0700 ice: fix locking in ice_dcb_rebuild() Move the mutex_lock() call up to prevent that DCB settings change after the first ice_query_port_ets() call. The second ice_query_port_ets() call in ice_dcb_rebuild() is already protected by pf->tc_mutex. This also fixes a bug in an error path, as before taking the first "goto dcb_error" in the function jumped over mutex_lock() to mutex_unlock(). This bug has been detected by the clang thread-safety analyzer. Cc: intel-wired-lan@lists.osuosl.org Fixes: 242b5e068b25 ("ice: Fix DCB rebuild after reset") Signed-off-by: Bart Van Assche Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Tested-by: Arpana Arland Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260506-jk-iwl-net-2026-05-04-v2-6-a5ea4dc837a9@intel.com Signed-off-by: Jakub Kicinski commit b3cda96feb60d91fe88d52b974ff110dcfa91239 Author: Marcin Szycik Date: Wed May 6 14:48:14 2026 -0700 ice: fix setting RSS VSI hash for E830 ice_set_rss_hfunc() performs a VSI update, in which it sets hashing function, leaving other VSI options unchanged. However, ::q_opt_flags is mistakenly set to the value of another field, instead of its original value, probably due to a typo. What happens next is hardware-dependent: On E810, only the first bit is meaningful (see ICE_AQ_VSI_Q_OPT_PE_FLTR_EN) and can potentially end up in a different state than before VSI update. On E830, some of the remaining bits are not reserved. Setting them to some unrelated values can cause the firmware to reject the update because of invalid settings, or worse - succeed. Reproducer: sudo ethtool -X $PF1 equal 8 Output in dmesg: Failed to configure RSS hash for VSI 6, error -5 Fixes: 352e9bf23813 ("ice: enable symmetric-xor RSS for Toeplitz hash function") Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Signed-off-by: Marcin Szycik Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260506-jk-iwl-net-2026-05-04-v2-5-a5ea4dc837a9@intel.com Signed-off-by: Jakub Kicinski commit 6c77b9510829a424d1b74409b7db9456e3522871 Author: Greg Kroah-Hartman Date: Wed May 6 14:48:13 2026 -0700 idpf: fix double free and use-after-free in aux device error paths When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or idpf_plug_core_aux_dev(), the err_aux_dev_add label calls auxiliary_device_uninit() and falls through to err_aux_dev_init. The uninit call will trigger put_device(), which invokes the release callback (idpf_vport_adev_release / idpf_core_adev_release) that frees iadev. The fall-through then reads adev->id from the freed iadev for ida_free() and double-frees iadev with kfree(). Free the IDA slot and clear the back-pointer before uninit, while adev is still valid, then return immediately. Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization") fixed the same use-after-free in the matching unplug path in this file but missed both probe error paths. Cc: Tony Nguyen Cc: Przemek Kitszel Cc: Andrew Lunn Cc: stable@kernel.org Fixes: be91128c579c ("idpf: implement RDMA vport auxiliary dev create, init, and destroy") Fixes: f4312e6bfa2a ("idpf: implement core RDMA auxiliary dev create, init, and destroy") Signed-off-by: Greg Kroah-Hartman Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260506-jk-iwl-net-2026-05-04-v2-4-a5ea4dc837a9@intel.com Signed-off-by: Jakub Kicinski commit da4f76b6a84ede14a71282ef841768299ead0221 Author: Emil Tantilov Date: Wed May 6 14:48:12 2026 -0700 idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker() had already been called (and after idpf_ptp_settime64() could reach the lock). The PTP aux worker fires immediately upon scheduling and can call into idpf_ptp_read_src_clk_reg_direct(), which takes spin_lock(&ptp->read_dev_clk_lock) on an uninitialized lock, triggering the lockdep "non-static key" warning: [12973.796587] idpf 0000:83:00.0: Device HW Reset initiated [12974.094507] INFO: trying to register non-static key. ... [12974.097208] Call Trace: [12974.097213] [12974.097218] dump_stack_lvl+0x93/0xe0 [12974.097234] register_lock_class+0x4c4/0x4e0 [12974.097249] ? __lock_acquire+0x427/0x2290 [12974.097259] __lock_acquire+0x98/0x2290 [12974.097272] lock_acquire+0xc6/0x310 [12974.097281] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097311] ? lockdep_hardirqs_on_prepare+0xde/0x190 [12974.097318] ? finish_task_switch.isra.0+0xd2/0x350 [12974.097330] ? __pfx_ptp_aux_kworker+0x10/0x10 [ptp] [12974.097343] _raw_spin_lock+0x30/0x40 [12974.097353] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097373] idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097391] ? kthread_worker_fn+0x88/0x3d0 [12974.097404] ? kthread_worker_fn+0x4e/0x3d0 [12974.097411] idpf_ptp_update_cached_phctime+0x26/0x120 [idpf] [12974.097428] ? _raw_spin_unlock_irq+0x28/0x50 [12974.097436] idpf_ptp_do_aux_work+0x15/0x20 [idpf] [12974.097454] ptp_aux_kworker+0x20/0x40 [ptp] [12974.097464] kthread_worker_fn+0xd5/0x3d0 [12974.097474] ? __pfx_kthread_worker_fn+0x10/0x10 [12974.097482] kthread+0xf4/0x130 [12974.097489] ? __pfx_kthread+0x10/0x10 [12974.097498] ret_from_fork+0x32c/0x410 [12974.097512] ? __pfx_kthread+0x10/0x10 [12974.097519] ret_from_fork_asm+0x1a/0x30 [12974.097540] Move the call to spin_lock_init() up a bit to make sure read_dev_clk_lock is not touched before it's been initialized. Fixes: 5cb8805d2366 ("idpf: negotiate PTP capabilities and get PTP clock") Signed-off-by: Emil Tantilov Reviewed-by: Madhu Chittim Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Samuel Salin Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260506-jk-iwl-net-2026-05-04-v2-3-a5ea4dc837a9@intel.com Signed-off-by: Jakub Kicinski commit 678b713ece1e853f11e670a84cb887c35e1381b7 Author: Matt Vollrath Date: Wed May 6 14:48:11 2026 -0700 i40e: Cleanup PTP pins on probe failure PTP pin structs are allocated early in probe, but never cleaned up. Fix this by calling i40e_ptp_free_pins in the error path. To support this, i40e_ptp_free_pins is added to the header and pin_config is correctly nullified after being freed. This has been an issue since i40e_ptp_alloc_pins was introduced. Fixes: 1050713026a08 ("i40e: add support for PTP external synchronization clock") Reported-by: Kohei Enju Cc: stable@vger.kernel.org Signed-off-by: Matt Vollrath Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Reviewed-by: Kohei Enju Tested-by: Sunitha Mekala Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260506-jk-iwl-net-2026-05-04-v2-2-a5ea4dc837a9@intel.com Signed-off-by: Jakub Kicinski commit 1619553b0a6ba7a966b17b0226f3acb9dd4d5380 Author: Matt Vollrath Date: Wed May 6 14:48:10 2026 -0700 i40e: Cleanup PTP registration on probe failure Fix two conditions which would leak PTP registration on probe failure: 1. i40e_setup_pf_switch can encounter an error in i40e_setup_pf_filter_control, call i40e_ptp_init, then return non-zero, sending i40e_probe to err_vsis. 2. i40e_setup_misc_vector can return non-zero, sending i40e_probe to err_vsis. Both of these conditions have been present since PTP was introduced in this driver. Found with coccinelle. Fixes: beb0dff1251db ("i40e: enable PTP") Signed-off-by: Matt Vollrath Tested-by: Sunitha Mekala Reviewed-by: Aleksandr Loktionov Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260506-jk-iwl-net-2026-05-04-v2-1-a5ea4dc837a9@intel.com Signed-off-by: Jakub Kicinski commit a77d5a069d959dc45f5f472d48cba37d8cba0f1c Author: Mohsin Bashir Date: Wed May 6 16:37:45 2026 -0700 net: shaper: Reject reparenting of existing nodes When an existing node-scope shaper is moved to a different parent via the group operation, the framework fails to update the leaves count on both the old and new parent shapers. Only newly created nodes (handle.id == NET_SHAPER_ID_UNSPEC) trigger the parent leaves increment at line 1039. This causes the parent's leaves counter to diverge from the actual number of children in the xarray. When the node is later deleted, pre_del_node() allocates an array sized by the stale leaves count, but the xarray iteration finds more children than expected, hitting the WARN_ON_ONCE guard and returning -EINVAL. Rather than adding reparenting support with complex leaves count bookkeeping, reject group calls that attempt to change an existing node's parent. Updates to an existing node's rate or leaves under the same parent remain permitted. We expect that for any modification of the topology user should always create new groups and let the kernel garbage collect the leaf-less nodes. Fixes: 5d5d4700e75d ("net-shapers: implement NL group operation") Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260506233745.111895-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit efda25ee84325385f859d10872590e90ce837243 Author: Alice Ryhl Date: Wed May 6 20:07:13 2026 +0000 genetlink: free the skb on 'group >= family->n_mcgrps' These methods generally consume ownership of the provided skb, so even if an error path is encountered, the skb is freed. This is because the very first thing they do after some initial setup is to unconditionally consume the skb via consume_skb(skb). Any subsequent errors lead to the core netlink layer freeing the skb. However, there is one check that occurs before ownership is passed, which is the check for the group index. So if this error condition is encountered, then the skb is leaked. This error condition is generally considered a violation of the netlink API, so it's not expected to occur under normal circumstances. For the same reason, no callers check for this error condition, and no callers need to be adjusted. However, we should still follow the same ownership semantics of the rest of the function. Thus, free the skb in this codepath. Suggested-by: Andrew Lunn Suggested-by: Matthew Maurer Fixes: 2a94fe48f32c ("genetlink: make multicast groups const, prevent abuse") Link: https://lore.kernel.org/r/845b36ba-7b3a-41f2-acb2-b284f253e2ca@lunn.ch Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260506-genlmsg-return-v2-1-a63ee2a055d6@google.com Signed-off-by: Jakub Kicinski commit f2ab4fd02777c4081be38c35f939e4dc529b8952 Author: Ilya Maximets Date: Thu May 7 14:04:26 2026 +0200 net: nsh: fix incorrect header length macros NSH header length is a 6-bit field that encodes the total length of the header in 4-byte words. So the maximum length is 0b111111 * 4, which is 252 and not 256. The maximum context length is the same number minus the length of the base header (8), so 244. These macros are used to validate push_nsh() action in openvswitch. Miscalculation here doesn't cause any real issues. In the worst case the oversized context is truncated while building the header, so we'll construct and send a broken packet, which is not a big problem, as any receiver should validate the fields. No invalid memory accesses will happen during the header push. But we should fix the macros to reject the incorrect actions in the first place. Using previously defined values and calculating the length instead of defining numbers directly, so it's easier to understand where they come from and harder to make a mistake. Fixes: 1f0b7744c505 ("net: add NSH header structures and helpers") Signed-off-by: Ilya Maximets Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20260507120434.2962505-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 4908f1395fb1b832ceec11584af649874a2732ea Author: Quan Sun <2022090917019@std.uestc.edu.cn> Date: Thu May 7 21:17:38 2026 +0800 net: ethtool: fix NULL pointer dereference in phy_reply_size In phy_prepare_data(), several strings such as 'name', 'drvname', 'upstream_sfp_name', and 'downstream_sfp_name' are allocated using kstrdup(). However, these allocations were not checked for failure. If kstrdup() fails for 'name', it returns NULL while the function continues. This leads to a kernel NULL pointer dereference and panic later in phy_reply_size() when it unconditionally calls strlen() on the NULL pointer. While other strings like 'upstream_sfp_name' might be checked before access in certain code paths, failing to handle these allocations consistently can lead to incomplete data reporting or hidden bugs. Fix this by adding proper NULL checks for all kstrdup() calls in phy_prepare_data() and implement a centralized error handling path using goto labels to ensure all previously allocated resources are freed on failure. Fixes: 9dd2ad5e92b9 ("net: ethtool: phy: Convert the PHY_GET command to generic phy dump") Signed-off-by: Quan Sun <2022090917019@std.uestc.edu.cn> Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260507131738.1173835-1-2022090917019@std.uestc.edu.cn Signed-off-by: Jakub Kicinski commit 0a549298f452a83ae57e6582e6ca389357f9355d Author: Nicolas Ferre Date: Thu May 7 14:04:44 2026 +0200 MAINTAINERS: change maintainers for macb Ethernet driver I would like to hand over the macb maintenance to Théo, as I'm unable to keep up with the recent flow of patches for this driver. After speaking with Claudiu, he indicated that he is in the same position as me. To help with this work, Conor has agreed to act as a reviewer. I was given responsibility for this driver years ago, and I'm glad to see it continue with talented developers. Signed-off-by: Nicolas Ferre Acked-by: Claudiu Beznea Acked-by: Conor Dooley Link: https://patch.msgid.link/20260507120444.9733-1-nicolas.ferre@microchip.com Signed-off-by: Jakub Kicinski commit 58e2330bd45572a6e3d46ea94cf7a9641f43591a Author: Dragos Tatulea Date: Wed May 6 09:08:08 2026 +0000 net: napi: Avoid gro timer misfiring at end of busypoll When in irq deferral mode (defer-hard-irqs > 0), a short enough gro-flush timeout can trigger before NAPI_STATE_SCHED is cleared if the last poll in busy_poll_stop() takes too long. This can have the effect of leaving the queue stuck with interrupts disabled and no timer armed which results in a tx timeout if there is no subsequent busypoll cycle. To prevent this, defer the gro-flush timer arm after the last poll. Fixes: 7fd3253a7de6 ("net: Introduce preferred busy-polling") Co-developed-by: Martin Karsten Signed-off-by: Martin Karsten Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Reviewed-by: Cosmin Ratiu Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260506090808.820559-2-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski commit dffddaa0cea5849e2bd1f357d166a86c2f6cded4 Merge: e539acf9f9c255 e68eadffb724b3 Author: Jakub Kicinski Date: Fri May 8 14:59:17 2026 -0700 Merge branch 'ipv6-flowlabel-per-netns-budget-for-unprivileged-callers' Maoyi Xie says: ==================== ipv6: flowlabel: per-netns budget for unprivileged callers From: Maoyi Xie This series fixes the cross-tenant DoS in net/ipv6/ip6_flowlabel.c. v1 through v6 were single-patch postings, each in its own thread. v6 review pointed out that the existing fl_size read in mem_check() and the corresponding write in fl_intern() are not in the same critical section. v7 split the work into 2 patches. Patch 1/2 is a prerequisite. It moves spin_lock_bh(&ip6_fl_lock) and the matching unlock from fl_intern() into its only caller ipv6_flowlabel_get(), so the mem_check() call runs under the same critical section as the fl_intern() insert. With all writers and the read of fl_size under the lock, fl_size is converted from atomic_t to plain int. This is independent of the per-netns budget. It also makes 2/2 backportable without conflicts. Patch 2/2 is the v6 patch, rebased on 1/2. - flowlabel_count is plain int rather than atomic_t, since the previous patch put all writers and readers under ip6_fl_lock. - In ip6_fl_gc(), fl_free() is now placed below the fl_size and flowlabel_count decrements, removing the v6 cache of fl->fl_net. - In ip6_fl_purge(), fl_free() stays in its original position. The function argument net is used for flowlabel_count. - mem_check() uses spaces around the / operator on all four expressions, addressing the checkpatch note in v6 review. Numeric budget (preserved from v6): pre-patch: global non-CAP_NET_ADMIN budget = FL_MAX_SIZE - FL_MAX_SIZE/4 = 4096 - 1024 = 3072 per-actor reach = 3072 post-patch: FL_MAX_SIZE doubled to 8192 global non-CAP_NET_ADMIN budget = 8192 - 2048 = 6144 per-netns ceiling = 6144 / 2 = 3072 per-actor reach = 3072 (preserved) CAP_NET_ADMIN against init_user_ns still bypasses both caps. Reproducer (KASAN VM, 4 cores, qemu): unprivileged netns A holds 3072 flowlabels via 100 procs. Fresh unprivileged netns B then allocates 32 flowlabels (the FL_MAX_PER_SOCK ceiling for one socket), the same as a clean baseline. Without the per-netns ceiling, netns A could push fl_size past FL_MAX_SIZE - FL_MAX_SIZE / 4 and netns B would see allocations denied. ==================== Link: https://patch.msgid.link/20260506082416.2259567-1-maoyixie.tju@gmail.com Signed-off-by: Jakub Kicinski commit e68eadffb724b36ffd3d5619e0efcaf29ec2a175 Author: Maoyi Xie Date: Wed May 6 16:24:16 2026 +0800 ipv6: flowlabel: enforce per-netns limit for unprivileged callers fl_size, fl_ht and ip6_fl_lock in net/ipv6/ip6_flowlabel.c are file scope and shared across netns. mem_check() reads fl_size to decide whether to deny non-CAP_NET_ADMIN callers. capable() runs against init_user_ns, so an unprivileged user in any non-init userns can push fl_size past FL_MAX_SIZE - FL_MAX_SIZE / 4 and starve every other unprivileged userns on the host. Add struct netns_ipv6::flowlabel_count, bumped and decremented next to fl_size in fl_intern, ip6_fl_gc and ip6_fl_purge. The new field fills the existing 4-byte hole after ipmr_seq, so struct netns_ipv6 stays the same size on 64-bit builds. Bump FL_MAX_SIZE from 4096 to 8192. It has been 4096 since the file was added. Machines and connection counts have grown. mem_check() folds an extra per-netns ceiling into the existing non-CAP_NET_ADMIN conditional. The ceiling is half of the total budget that unprivileged callers have ever been able to use, i.e. (FL_MAX_SIZE - FL_MAX_SIZE / 4) / 2 = 3072 entries. With FL_MAX_SIZE doubled, this preserves the original per-user reach of 3K (what an unprivileged caller could already obtain before this change), while forcing an attacker to spread allocations across at least two netns to exhaust the global non-CAP_NET_ADMIN budget. CAP_NET_ADMIN against init_user_ns still bypasses both caps. The previous patch took ip6_fl_lock across mem_check and fl_intern, so the new flowlabel_count read in mem_check and the new flowlabel_count++ in fl_intern run under the same critical section. flowlabel_count is therefore plain int, like fl_size. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Willem de Bruijn Reviewed-by: Willem de Bruijn Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Maoyi Xie Link: https://patch.msgid.link/20260506082416.2259567-3-maoyixie.tju@gmail.com Signed-off-by: Jakub Kicinski commit 7ce5556f255a680d80daa31b1cedecf7f89e2c22 Author: Maoyi Xie Date: Wed May 6 16:24:15 2026 +0800 ipv6: flowlabel: take ip6_fl_lock across mem_check and fl_intern mem_check() in net/ipv6/ip6_flowlabel.c reads fl_size without holding ip6_fl_lock. fl_intern() takes the lock immediately afterwards. The two checks therefore race against concurrent fl_intern, ip6_fl_gc and ip6_fl_purge writers, which makes the mem_check budget check approximate. Move spin_lock_bh(&ip6_fl_lock) and the matching unlock from fl_intern() into its only caller ipv6_flowlabel_get(). The mem_check() call now runs under the same critical section as the fl_intern() insert, so the budget check is exact. With all writers and the read of fl_size under ip6_fl_lock, convert fl_size from atomic_t to plain int. The four sites that update or read fl_size are fl_intern (insert path), ip6_fl_gc (garbage collector, the !sched check and the per-entry decrement), ip6_fl_purge (per-netns purge), and mem_check (budget check), and all four now run under ip6_fl_lock. This is a prerequisite for adding a per-netns budget alongside fl_size. The follow-up patch adds netns_ipv6::flowlabel_count and folds it into mem_check(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Willem de Bruijn Reviewed-by: Willem de Bruijn Signed-off-by: Maoyi Xie Link: https://patch.msgid.link/20260506082416.2259567-2-maoyixie.tju@gmail.com Signed-off-by: Jakub Kicinski commit e539acf9f9c2550452914fb85aeb8fda67dd762f Author: Maciej W. Rozycki Date: Mon Apr 27 11:23:17 2026 +0100 MAINTAINERS: Add self for the 3c509 network driver It appears there's a need for a maintainer for the 3Com EtherLink III family of Ethernet network adapters. There is documentation available and the driver is very mature so the task ought to be of little hassle, so I think I should be able to squeeze in any issues to be addressed. Signed-off-by: Maciej W. Rozycki Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/alpine.DEB.2.21.2604271056460.28583@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit 4378bf612482c24731b661c544ce178965fb3422 Merge: fcee7d82f27d6a 7eca3292cac7c2 Author: Jakub Kicinski Date: Fri May 8 14:54:55 2026 -0700 Merge branch 'tcp-two-fixes-for-socket-migration-in-reqsk_timer_handler' Kuniyuki Iwashima says: ==================== tcp: Two fixes for socket migration in reqsk_timer_handler(). The series fixes two bugs in the error path of socket migration in reqsk_timer_handler(). Patch 1 fixes a potential UAF in reqsk_timer_handler(). Patch 2 fixes imbalanced icsk_accept_queue count. ==================== Link: https://patch.msgid.link/20260506035954.1563147-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 7eca3292cac7c26dad4c236f51ba225c39a0523f Author: Kuniyuki Iwashima Date: Wed May 6 03:59:19 2026 +0000 tcp: Fix imbalanced icsk_accept_queue count. When TCP socket migration happens in reqsk_timer_handler(), @sk_listener will be updated with the new listener. When we call __inet_csk_reqsk_queue_drop(), the listener must be the one stored in req->rsk_listener. The cited commit accidentally replaced oreq->rsk_listener with sk_listener, leading to imbalanced icsk_accept_queue count. Let's pass the correct listener to __inet_csk_reqsk_queue_drop(). Fixes: e8c526f2bdf1 ("tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().") Reported-by: Damiano Melotti Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260506035954.1563147-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 97c8a3c1f73d828de43a5a88e8a9a143efb2b661 Author: Kuniyuki Iwashima Date: Wed May 6 03:59:18 2026 +0000 tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk. Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer. Fixes: 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") Reported-by: Damiano Melotti Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260506035954.1563147-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 9ef40a09c5de18f0d275a451f5c2a7fd4f07158b Author: Aksh Garg Date: Fri May 8 11:39:51 2026 +0530 MAINTAINERS: Add Aksh Garg as PCIe CADENCE reviewer I wish to contribute to the review process for Cadence PCIe IP drivers, hence add myself as a reviewer. Signed-off-by: Aksh Garg Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260508060951.840233-1-a-garg7@ti.com commit 78e115d806b0eea83a0e4df182a689823aa80511 Author: Hans Zhang <18255117159@163.com> Date: Fri May 8 10:30:06 2026 +0800 MAINTAINERS: Update Hans Zhang email for PCIe CIX Sky1 Update my email address as my work email account is no longer in use. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260508023006.1787674-1-18255117159@163.com commit bf5421b3d8d3d9216d045af89d4f7e2f75375554 Author: Marek Vasut Date: Tue Apr 28 07:19:54 2026 +0200 MAINTAINERS: Update Marek Vasut email for PCIe R-Car Use up to date address. No functional change. Signed-off-by: Marek Vasut Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260428052030.51101-1-marek.vasut+renesas@mailbox.org commit f45a49a2380a47332817b7248c61a0ebbc6f0d00 Author: Samiullah Khawaja Date: Tue May 5 23:43:27 2026 +0000 PCI: Initialize temporary device in new_id_store() When setting new_id of a PCI device driver using sysfs a lockdep splat occurs. This is because new_id_store() builds a temporary pci_dev for pci_match_device(), which calls device_match_driver_override(). That depends on the driver_override.lock added by cb3d1049f4ea ("driver core: generalize driver_override in struct device"). The new driver_override.lock was not initialized in the temporary pci_dev, resulting in this lockdep splat. Initialize the temporary pci_dev to fix this. Repro: Build with CONFIG_LOCKDEP=y, boot with QEMU, and add a new ID: # echo "8086 10f5" > /sys/bus/pci/drivers/e1000e/new_id INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 2 UID: 0 PID: 177 Comm: liveupdate-iomm Not tainted 7.0.0+ #9 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x5d/0x80 register_lock_class+0x77e/0x790 lock_acquire+0xbf/0x2e0 pci_match_device+0x24/0x180 new_id_store+0x189/0x1d0 kernfs_fop_write_iter+0x14f/0x210 vfs_write+0x263/0x5e0 ksys_write+0x79/0xf0 do_syscall_64+0x117/0xf80 Fixes: 10a4206a2401 ("PCI: use generic driver_override infrastructure") Fixes: 8895d3bcb8ba ("PCI: Fail new_id for vendor/device values already built into driver") Signed-off-by: Samiullah Khawaja [bhelgaas: add commit log details and repro, trim backtrace] Signed-off-by: Bjorn Helgaas Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260505234327.716630-1-skhawaja@google.com commit 909f7bf9b080c10df3c3b38533906dbf09ff1d8b Author: Lukas Wunner Date: Wed Apr 15 17:56:06 2026 +0200 PCI: Update saved_config_space upon resource assignment Bernd reports passthrough failure of a Digital Devices Cine S2 V6 DVB adapter plugged into an ASRock X570S PG Riptide board with BIOS version P5.41 (09/07/2023): ddbridge 0000:05:00.0: detected Digital Devices Cine S2 V6 DVB adapter ddbridge 0000:05:00.0: cannot read registers ddbridge 0000:05:00.0: fail BIOS assigns an incorrect BAR to the DVB adapter which doesn't fit into the upstream bridge window. The kernel corrects the BAR assignment: pci 0000:07:00.0: BAR 0 [mem 0xfffffffffc500000-0xfffffffffc50ffff 64bit]: can't claim; no compatible bridge window pci 0000:07:00.0: BAR 0 [mem 0xfc500000-0xfc50ffff 64bit]: assigned Correction of the BAR assignment happens in an x86-specific fs_initcall, pcibios_assign_resources(), after device enumeration in a subsys_initcall. This order was introduced at the behest of Linus in 2004: https://git.kernel.org/tglx/history/c/a06a30144bbc No other architecture performs such a late BAR correction. Bernd bisected the issue to commit a2f1e22390ac ("PCI/ERR: Ensure error recoverability at all times"), but it only occurs in the absence of commit 4d4c10f763d7 ("PCI: Explicitly put devices into D0 when initializing"). This combination exists in stable kernel v6.12.70, but not in mainline, hence Bernd cannot reproduce the issue with mainline. Since a2f1e22390ac, config space is saved on enumeration, prior to BAR correction. Upon passthrough, the corrected BAR is overwritten with the incorrect saved value by: vfio_pci_core_register_device() vfio_pci_set_power_state() pci_restore_state() But only if the device's current_state is PCI_UNKNOWN, as it was prior to commit 4d4c10f763d7. Since the commit, it is PCI_D0, which changes the behavior of vfio_pci_set_power_state() to no longer restore the state without saving it first. Alexandre is reporting the same issue as Bernd, but in his case, mainline is affected as well. The difference is that on Alexandre's system, the host kernel binds a driver to the device which is unbound prior to passthrough, whereas on Bernd's system no driver gets bound by the host kernel. Unbinding sets current_state to PCI_UNKNOWN in pci_device_remove(), so when vfio-pci is subsequently bound to the device, pci_restore_state() is once again called without invoking pci_save_state() first. To robustly fix the issue, always update saved_config_space upon resource assignment. Reported-by: Bernd Schumacher Closes: https://lore.kernel.org/r/acfZrlP0Ua_5D3U4@eldamar.lan/ Reported-by: Alexandre N. Closes: https://lore.kernel.org/r/dd3c3358-de0f-4a56-9c81-04aceaab4058@mailo.com/ Fixes: a2f1e22390ac ("PCI/ERR: Ensure error recoverability at all times") Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Tested-by: Bernd Schumacher Tested-by: Alexandre N. Cc: stable@vger.kernel.org # v6.12+ Link: https://patch.msgid.link/febc3f354e0c1f5a9f5b3ee9ffddaa44caccf651.1776268054.git.lukas@wunner.de commit 18fc650ccd7fe3376eca89203668cfb8268f60df Author: Kuniyuki Iwashima Date: Sun Apr 26 01:26:43 2026 +0000 bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below with a repro. [0] The repro sets up a UDP reuseport group with a cBPF prog and replaces it with a new one while another thread is sending a UDP packet to the group. The reuseport prog is freed by sk_reuseport_prog_free(). bpf_prog_put() is called for "e"BPF prog to destruct through multiple stages while cBPF prog is freed immediately by bpf_release_orig_filter() and bpf_prog_free(). If a reuseport prog is detached from the setsockopt() path (reuseport_attach_prog() or reuseport_detach_prog()), sk_reuseport_prog_free() is called without waiting for RCU readers to complete, resulting in various bugs. Let's defer freeing the reuseport cBPF prog after one RCU grace period. Note "e"BPF prog is safe as is unless the fast path starts to touch fields destroyed in bpf_prog_put_deferred() and __bpf_prog_put_noref(). [0]: BUG: KASAN: vmalloc-out-of-bounds in reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596 Read of size 4 at addr ffffc9000051e004 by task slowme/10208 CPU: 6 UID: 1000 PID: 10208 Comm: slowme Not tainted 7.0.0-geb7ac95ff75e #32 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596 udp4_lib_lookup2+0x3bc/0x950 net/ipv4/udp.c:495 __udp4_lib_lookup+0x768/0xe20 net/ipv4/udp.c:723 __udp4_lib_lookup_skb+0x297/0x390 net/ipv4/udp.c:752 __udp4_lib_rcv+0x1312/0x2620 net/ipv4/udp.c:2752 ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6181 [inline] __netif_receive_skb net/core/dev.c:6294 [inline] process_backlog+0xaa4/0x1960 net/core/dev.c:6645 __napi_poll+0xae/0x340 net/core/dev.c:7709 napi_poll net/core/dev.c:7772 [inline] net_rx_action+0x5d7/0xf50 net/core/dev.c:7929 handle_softirqs+0x22b/0x870 kernel/softirq.c:622 do_softirq+0x76/0xd0 kernel/softirq.c:523 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline] __dev_queue_xmit+0x1dd7/0x3710 net/core/dev.c:4890 neigh_output include/net/neighbour.h:556 [inline] ip_finish_output2+0xca9/0x1070 net/ipv4/ip_output.c:237 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip_output+0x29f/0x450 net/ipv4/ip_output.c:438 ip_send_skb+0x45/0xc0 net/ipv4/ip_output.c:1508 udp_send_skb+0xb04/0x1510 net/ipv4/udp.c:1195 udp_sendmsg+0x1a71/0x2350 net/ipv4/udp.c:1485 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] __sys_sendto+0x554/0x680 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x160/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x415a2d Code: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6bc31e41e8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f6bc31e4cdc RCX: 0000000000415a2d RDX: 0000000000000001 RSI: 00007f6bc31e421f RDI: 0000000000000003 RBP: 00007f6bc31e4240 R08: 00007f6bc31e4220 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000212 R12: 00007f6bc31e46c0 R13: ffffffffffffffb8 R14: 0000000000000000 R15: 00007ffc9b0d70b0 Fixes: 538950a1b752 ("soreuseport: setsockopt SO_ATTACH_REUSEPORT_[CE]BPF") Reported-by: Eulgyu Kim Reported-by: Taeyang Lee <0wn@theori.io> Signed-off-by: Kuniyuki Iwashima Signed-off-by: Daniel Borkmann Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20260426012647.3233119-1-kuniyu@google.com commit cbf457c584b5cbd0d44e8f05edaf3e189e894a68 Merge: 8be01e1280912a f7700a4415afb3 Author: Linus Torvalds Date: Fri May 8 13:18:13 2026 -0700 Merge tag 'block-7.1-20260508' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fix for ublk not doing an actual issue from the task_work fallback path. Any request hitting that should be canceled automatically - Fix for uring_cmd prep side handling, for the block side uring_cmd discard handling - Fix for missing validation of the io and physical block size shifts - Fix for a use-after-free in ublk's cancel command handling * tag 'block-7.1-20260508' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: ublk: fix use-after-free in ublk_cancel_cmd() ublk: validate physical_bs_shift, io_min_shift and io_opt_shift block: only read from sqe on initial invocation of blkdev_uring_cmd() ublk: don't issue uring_cmd from fallback task work commit 8be01e1280912a84f6bcf963ceed6c9f13ba1986 Merge: 81d6f7807536a0 45d2b37a37ab98 Author: Linus Torvalds Date: Fri May 8 13:12:48 2026 -0700 Merge tag 'io_uring-7.1-20260508' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Ensure that the absolute timeouts for both the command side and the waiting side honor the callers time namespace - Ensure tracked NAPI entries are cleared at unregistration time, as the NAPI polling loop checks the list state rather than the general NAPI state. This can lead to NAPI polling even after unregistration has been done. If unregistered, all NAPI polling should be disabled - Fix for eventfd recursive invocation handling * tag 'io_uring-7.1-20260508' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS io_uring/eventfd: reset deferred signal state io_uring/napi: clear tracked NAPI entries on unregister commit db5dadb562cabb6da49959b473ed0d9645b6f2da Author: Mario Limonciello Date: Mon May 4 18:01:37 2026 -0500 Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn" Some older systems don't support CPPC in the firmware and this just makes noise for them when booting. Drop back to debug. This reverts commit 21fb59ab4b9767085f4fe1edbdbe3177fbb9ec97. Fixes: 21fb59ab4b976 ("ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn") Suggested-by: Kim Phillips Signed-off-by: Mario Limonciello Tested-by: Kim Phillips Cc: All applicable Link: https://patch.msgid.link/20260504230141.484743-2-mario.limonciello@amd.com Signed-off-by: Rafael J. Wysocki commit f3b8c28135c339e6993ffb79579447a109537a11 Merge: 0c7ae130698e70 1c2958e4ab1ed4 Author: Martin KaFai Lau Date: Fri May 8 09:55:33 2026 -0700 Merge branch 'bpf-tcp-fix-type-confusion-in-bpf-helper-functions' Kuniyuki Iwashima says: ==================== bpf: tcp: Fix type confusion in bpf helper functions. bpf_tcp_sock() only check if sk->sk_protocol is IPPROTO_TCP, but RAW socket can bypass it: socket(AF_INET, SOCK_RAW, IPPROTO_TCP) The same issues exist in other bpf functions: * bpf_mptcp_sock_from_subflow() * bpf_skc_to_tcp_sock() * bpf_skc_to_tcp6_sock() * sol_tcp_sockopt() Patch 1 fixes bpf_tcp_sock() and Patch 2 adds a test for it. Patch 3 ~ 6 fix the rest of the functions above. Changes: v2: * Inverse if (err) to if (!err) in the selftest * Add patch 3 ~ 6 v1: https://lore.kernel.org/bpf/20260430184405.1227386-1-kuniyu@google.com/ https://lore.kernel.org/mptcp/20260430-mptcp-bpf-mptcp-sock-type-v1-1-d2ed5cda7da9@kernel.org/ ==================== Link: https://patch.msgid.link/20260504210610.180150-1-kuniyu@google.com Signed-off-by: Martin KaFai Lau commit 1c2958e4ab1ed4594db16425dbcab33c56ea8330 Author: Kuniyuki Iwashima Date: Mon May 4 21:04:53 2026 +0000 bpf: tcp: Fix type confusion in sol_tcp_sockopt(). sol_tcp_sockopt() only checks if sk->sk_protocol is IPPROTO_TCP, but RAW socket can bypass it: socket(AF_INET, SOCK_RAW, IPPROTO_TCP) Let's use sk_is_tcp(). Note that initially sol_tcp_sockopt() checked sk->sk_prot->setsockopt. Fixes: 2ab42c7b871f ("bpf: Check the protocol of a sock to agree the calls to bpf_setsockopt().") Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260504210610.180150-7-kuniyu@google.com commit 843064b0a77eed3d6d63ffc53aeaa359672b4e12 Author: Kuniyuki Iwashima Date: Mon May 4 21:04:52 2026 +0000 bpf: tcp: Fix type confusion in bpf_skc_to_tcp6_sock(). bpf_skc_to_tcp6_sock() only checks if sk->sk_protocol is IPPROTO_TCP and sk->sk_family is AF_INET6, but RAW socket can bypass it: socket(AF_INET6, SOCK_RAW, IPPROTO_TCP) Let's check sk->sk_type too. Fixes: af7ec1383361 ("bpf: Add bpf_skc_to_tcp6_sock() helper") Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260504210610.180150-6-kuniyu@google.com commit decb84b8383ab7acff94db208ef7ed19f9c55e1f Author: Kuniyuki Iwashima Date: Mon May 4 21:04:51 2026 +0000 bpf: tcp: Fix type confusion in bpf_skc_to_tcp_sock(). bpf_skc_to_tcp_sock() only checks if sk->sk_protocol is IPPROTO_TCP, but RAW socket can bypass it: socket(AF_INET, SOCK_RAW, IPPROTO_TCP) Let's use sk_is_tcp(). Fixes: 478cfbdf5f13 ("bpf: Add bpf_skc_to_{tcp, tcp_timewait, tcp_request}_sock() helpers") Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260504210610.180150-5-kuniyu@google.com commit 7995b216a731db657f356f6ae37a42f445b9a0ec Author: Matthieu Baerts (NGI0) Date: Mon May 4 21:04:50 2026 +0000 mptcp: bpf: Fix type confusion in bpf_mptcp_sock_from_subflow() bpf_mptcp_sock_from_subflow() only checks if sk->sk_protocol is IPPROTO_TCP, but RAW socket can bypass it: socket(AF_INET, SOCK_RAW, IPPROTO_TCP) In this case, it would NOT be valid to call sk_is_mptcp() which will assume sk is a pointer to a struct tcp_sock, and wrongly checks for: tcp_sk(sk)->is_mptcp. Fixes: 3bc253c2e652 ("bpf: Add bpf_skc_to_mptcp_sock_proto") Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260504210610.180150-4-kuniyu@google.com commit d73549b8bb7fa6147666c579d66f72bf076f719f Author: Kuniyuki Iwashima Date: Mon May 4 21:04:49 2026 +0000 selftest: bpf: Add test for bpf_tcp_sock() and RAW socket. Let's extend sockopt_sk.c to cover bpf_tcp_sock() for the wrong socket type. Before: # ./test_progs -t sockopt_sk [ 151.948613] ================================================================== [ 151.951376] BUG: KASAN: slab-out-of-bounds in sol_tcp_sockopt+0xc7/0x8e0 [ 151.954159] Read of size 8 at addr ffff88801083d760 by task test_progs/1259 ... run_test:FAIL:getsetsockopt unexpected error: -1 (errno 0) #427 sockopt_sk:FAIL After: #427 sockopt_sk:OK While at it, missing free() is fixed up. Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260504210610.180150-3-kuniyu@google.com commit 0143033dc22cdff912cfc13419f5db92fea3b4cb Author: Breno Leitao Date: Fri May 8 09:22:03 2026 -0700 workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path For WQ_UNBOUND workqueues, alloc_and_link_pwqs() allocates wq->cpu_pwq via alloc_percpu() and then calls apply_workqueue_attrs_locked(). On failure it returns the error directly, bypassing the enomem: label which holds the only free_percpu(wq->cpu_pwq) in this function. The caller's error path kfree()s wq without touching wq->cpu_pwq, leaking one percpu pointer table (nr_cpu_ids * sizeof(void *) bytes) per failed call. If kmemleak is enabled, we can see: unreferenced object (percpu) 0xc0fffa5b121048 (size 8): comm "insmod", pid 776, jiffies 4294682844 backtrace (crc 0): pcpu_alloc_noprof+0x665/0xac0 __alloc_workqueue+0x33f/0xa20 alloc_workqueue_noprof+0x60/0x100 Route the error through the existing enomem: cleanup and any error before this one. Cc: stable@kernel.org Fixes: 636b927eba5b ("workqueue: Make unbound workqueues to use per-cpu pool_workqueues") Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit a7488f089bdfa87c4fef1744d4dca9f4f8b46f8b Author: Breno Leitao Date: Thu May 7 04:04:46 2026 -0700 workqueue: Release PENDING in __queue_work() drain/destroy reject path The caller of __queue_work() owns WORK_STRUCT_PENDING, won via test_and_set_bit() in queue_work_on()/__queue_delayed_work(). The state machine documented above __queue_work() requires that owner to either hand the token to a pwq (insert_work() -> set_work_pwq()), hand it to a timer, or release it via set_work_pool_and_clear_pending(). try_to_grab_pending() relies on this: when it observes "PENDING && off-queue" it busy-loops, trusting the current owner to make progress. The (__WQ_DESTROYING | __WQ_DRAINING) early-return path violates that contract. It WARN_ONCE()s and bare-returns, leaving work->data with PENDING set, WORK_STRUCT_PWQ clear, and work->entry empty. The path is reachable without explicit API abuse: queue_delayed_work() arms a timer with PENDING set; if drain_workqueue() runs while the timer is still pending, delayed_work_timer_fn() -> __queue_work() in softirq context hits the WARN, current is not a wq worker so is_chained_work() is false, and the work is silently dropped with PENDING leaked. Mirror what clear_pending_if_disabled() already does on its analogous reject path: unpack the off-queue data and call set_work_pool_and_clear_pending() to release the token before returning. I was able to reproduce this by queueing several slow works on a max_active=1 wq, arm a delayed_work whose timer fires while drain_workqueue() is blocked, then call cancel_delayed_work_sync(). Without this patch the cancel livelocks at 100% CPU; with it the cancel returns immediately. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 81d6f7807536a0436dfada07e9292e3702d2bed4 Merge: 8bb44576c5ec0e f98b48151cc502 Author: Linus Torvalds Date: Fri May 8 10:24:35 2026 -0700 Merge tag 'v7.1-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix for two ACL issues (security fix to validate dacloffset better and chmod fix) - Fix out of bounds reads (in check_wsl_eas and smb2_check_msg for symlinks) - Two Kerberos fixes including an important one when AES-256 encryption chosen - Fix open_cached_dir problem when directory leases disabled * tag 'v7.1-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: validate dacloffset before building DACL pointers smb/client: fix out-of-bounds read in smb2_compound_op() smb/client: fix out-of-bounds read in symlink_data() smb: client: Zero-pad short GSS session keys per MS-SMB2 smb: client: Use FullSessionKey for AES-256 encryption key derivation smb: client: use kzalloc to zero-initialize security descriptor buffer cifs: abort open_cached_dir if we don't request leases commit 8bb44576c5ec0e6b29ee048b88235f6f407b6979 Merge: 4bdbce450f4273 4bacec2317527b Author: Linus Torvalds Date: Fri May 8 10:14:51 2026 -0700 Merge tag 'spi-fix-v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "There's two main series here, fixing issues that came up in the Microchip QSPI and Freescale i.MX drivers. Both of those could result in some quite noticable issues if they were encountered in production. We also have one minor documentation fix in the ch341 driver" * tag 'spi-fix-v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: ch341: correct company name in MODULE_DESCRIPTION spi: microchip-core-qspi: remove some inline markings spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations spi: microchip-core-qspi: control built-in cs manually spi: imx: Propagate prepare_transfer() error from spi_imx_setupxfer() spi: imx: Fix UAF on package-1 prepare failure in spi_imx_dma_data_prepare() spi: imx: Fix precedence bug in spi_imx_dma_max_wml_find() commit 4bdbce450f4273fcda6d5c2e22df7083421332cf Merge: 51d24842acb9b8 628497e6d925d4 Author: Linus Torvalds Date: Fri May 8 10:07:59 2026 -0700 Merge tag 'regulator-fix-v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A straightforward fix for an incorrect description of one of the regulators on the Qualcomm PMH0101" * tag 'regulator-fix-v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: qcom-rpmh: Fix index for pmh0101 ldo16 commit 481c2265286ef302327c93403a8cf7b3fe4506d0 Author: Kuniyuki Iwashima Date: Mon May 4 21:04:48 2026 +0000 bpf: tcp: Fix type confusion in bpf_tcp_sock(). bpf_tcp_sock() only checks if sk->sk_protocol is IPPROTO_TCP, but RAW socket can bypass it: socket(AF_INET, SOCK_RAW, IPPROTO_TCP) Calling bpf_setsockopt() in SOCKOPT prog triggers out-of-bounds access to another slab object. [0] Let's use sk_is_tcp(). [0]: BUG: KASAN: slab-out-of-bounds in sol_tcp_sockopt (net/core/filter.c:5519) Read of size 8 at addr ffff88801083d760 by task test_progs/1259 CPU: 1 UID: 0 PID: 1259 Comm: test_progs Tainted: G OE 7.0.0-11175-gb5c111f4967b #1 PREEMPT(full) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 Call Trace: dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) sol_tcp_sockopt (net/core/filter.c:5519) __bpf_getsockopt (net/core/filter.c:5633) bpf_sk_getsockopt (net/core/filter.c:5654) bpf_prog_629ba00a1601e9f2__setsockopt+0x86/0x22c __cgroup_bpf_run_filter_setsockopt (./include/linux/bpf.h:1402 ./include/linux/filter.h:722 ./include/linux/filter.h:729 kernel/bpf/cgroup.c:81 kernel/bpf/cgroup.c:2026) do_sock_setsockopt (net/socket.c:2363) __x64_sys_setsockopt (net/socket.c:2406) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) RIP: 0033:0x7f85f82fe7de Code: 55 48 63 c9 48 63 ff 45 89 c9 48 89 e5 48 83 ec 08 6a 2c e8 34 69 f7 ff c9 c3 66 90 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 e1 RSP: 002b:00007ffe59dcecd8 EFLAGS: 00000202 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f85f82fe7de RDX: 000000000000001c RSI: 0000000000000006 RDI: 000000000000000d RBP: 00007ffe59dcef20 R08: 000000000000003c R09: 0000000000000000 R10: 00007ffe59dcef00 R11: 0000000000000202 R12: 00007ffe59dcf268 R13: 0000000000000003 R14: 00007f85f9da5000 R15: 000055b2f3201400 The buggy address belongs to the object at ffff88801083d280 which belongs to the cache RAW of size 1792 The buggy address is located 1248 bytes inside of allocated 1792-byte region [ffff88801083d280, ffff88801083d980) Fixes: 655a51e536c0 ("bpf: Add struct bpf_tcp_sock and BPF_FUNC_tcp_sock") Reported-by: Damiano Melotti Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20260504210610.180150-2-kuniyu@google.com commit 51d24842acb9b8d643046c71314cc3d7a846a3cf Merge: fa7431eb99245e 5e28b7b9440889 Author: Linus Torvalds Date: Fri May 8 08:23:06 2026 -0700 Merge tag 'drm-fixes-2026-05-08-1' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes, lots of them but all pretty small, amdgpu and xe are the usual but then a large amount of fixes all over. core: - fix race condition in handle change ioctl fb-helper: - fix clipping rust: - fix unsound initialization - fix GEM state cleanup - fix wrong ARef import ttm: - update GPU MM stats on pool shrinking i915: - Re-enable ccs modifiers on dg2 nova: - fix mailing list xe: - Add NULL check for media_gt in intel_hdcp_gsc_check_status - Fix EAGAIN sign in pf_migration_consume - Fix MMIO access using PF view instead of VF view during migration - Exclude indirect ring state page from ADS engine state size amdgpu: - GFX9 fixes - Hawaii SMU fixes - SDMA4 fix - GART fix - Userq fixes amdkfd: - GPUVM TLB flush fix - Hotplug fix radeon: - Hawaii SMU fixes bochs: - fix managed cleanup bridge: - tda998x: fix sparse warnings on type correctness etnaviv: - schedule armed jobs exynos: - managed bridge cleanup ivpu: - disallow reexport of GEM buffer objects noveau: - revert support for GA100 panel: - boe-tv101wum-nl16: use correct MIPI_DSI mode - feyjang-fy07024di26a30d: fix error reporting - himax-hx83102: use correct MIPI_DSI mode - himax-hx83121a: fix error checks - himax-hx83121a: select DRM_DISPLAY_DSC_HELPER qaic: - fix RAS message handling qxl: - clean up polling sti: - managed bridge cleanup * tag 'drm-fixes-2026-05-08-1' of https://gitlab.freedesktop.org/drm/kernel: (37 commits) drm: Set old handle to NULL before prime swap in change_handle drm/bochs: Drop manual put on probe error path drm/xe/guc: Exclude indirect ring state page from ADS engine state size drm/xe/pf: Fix MMIO access using PF view instead of VF view during migration drm/xe/pf: Fix EAGAIN sign in pf_migration_consume() drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() drm/exynos: remove bridge when component_add fails drm/amdgpu: nuke amdgpu_userq_fence_slab v2 drm/amdgpu/userq: fix access to stale wptr mapping drm/amdkfd: Check if there are kfd porcesses using adev by kfd_processes_count drm/amdgpu: zero-initialize GART table on allocation drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission drm/radeon: add missing revision check for CI drm/amdgpu/pm: align Hawaii mclk workaround with radeon drm/amdgpu/pm: add missing revision check for CI drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ drm/amdkfd: Make all TLB-flushes heavy-weight drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds drm/panel: feiyang-fy07024di26a30d: return display-on error ... commit b2ed01e7ad3de80333e9b962a44024b094bc0b2b Author: Thomas Hellström Date: Tue Apr 28 11:44:42 2026 +0200 drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure When ttm_tt_swapout() fails, the current code calls ttm_resource_add_bulk_move() followed by ttm_resource_move_to_lru_tail() to restore the resource's bulk_move membership. However, ttm_resource_move_to_lru_tail() places the resource at the tail of the LRU list which, relative to the walk cursor's hitch node (placed immediately after the resource when it was yielded), puts the resource *in front of the* the hitch. The next list_for_each_entry_continue() from the hitch finds the same resource again, causing an infinite loop. Fix by deferring del_bulk_move to the success path only. On the success path, TTM_TT_FLAG_SWAPPED has just been set by ttm_tt_swapout() but the resource is still tracked in the bulk_move range, so ttm_resource_del_bulk_move()'s !ttm_resource_unevictable() guard would incorrectly skip the removal. Introduce ttm_resource_del_bulk_move_unevictable() which bypasses that guard. Reported-by: Jatin Kataria Fixes: fc5d96670eb2 ("drm/ttm: Move swapped objects off the manager's LRU list") Cc: Christian König Cc: Matthew Brost Cc: Cc: # v6.13+ Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström Reviewed-by: Christian König Tested-by: Boqun Feng Link: https://patch.msgid.link/20260428094442.16985-1-thomas.hellstrom@linux.intel.com commit 4fd44d47e8ab760eef11968d093200cce6752d95 Merge: b38e53cbfb9d84 100201d349edd2 Author: Greg Kroah-Hartman Date: Fri May 8 17:18:43 2026 +0200 Merge tag 'usb-serial-7.1-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial device ids for 7.1-rc3 Here are some new modem device ids. This one has been in linux-next with no reported issues. * tag 'usb-serial-7.1-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Telit Cinterion LE910Cx compositions commit fa7431eb99245e0a283d470101e44be1d2c2aeb3 Merge: 917719c412c486 10161b4a791d5c Author: Linus Torvalds Date: Fri May 8 08:16:07 2026 -0700 Merge tag 'iommu-fixes-v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: "Core: - Cache-flushing fix for non-x86 platforms AMD-Vi: - Security fix when SEV-SNP is enabled - Operator precedence fix in DTE setting" * tag 'iommu-fixes-v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/amd: Fix precedence order in set_dte_passthrough() iommu/pages: Fix iommu_pages_flush_incoherent() for non-x86 iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19 iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 commit ab28a0673daabe7f0fcbd7a5e36334f2f003f02f Author: Zqiang Date: Fri May 8 19:50:45 2026 +0800 sched_ext: Use IRQ_WORK_INIT_HARD() to initialize sch->disable_irq_work For built with PREEMPT_RT kernels, the scx_disable_irq_workfn() is called from per-cpu irq_work kthreads context, this means that when call the scx_dump_state() in the scx_disable_irq_workfn() to output current->comm/pid, it always output current irq_work kthread's comm/pid. this commit therefore use the IRQ_WORK_INIT_HARD() to initialize sch->disable_irq_work to make scx_disable_irq_workfn() is called from hardirq context. Fixes: f4a6c506d118 ("sched_ext: Always bounce scx_disable() through irq_work") Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit 411c1cf430392c905e39f12bc305dd994da0b426 Author: Mark Rutland Date: Fri May 8 15:20:23 2026 +0100 arm64/entry: Fix arm64-specific rseq brokenness Mathias Stearn reports that since v6.19, there are two big issues affecting rseq: (1) On arm64 specifically, rseq critical sections aren't aborted when they should be. (2) The 'cpu_id_start' field is no longer written by the kernel in all cases it used to be, including some cases where TCMalloc depends on the kernel clobbering the field. This patch fixes issue #1. This patch DOES NOT fix issue #2, which will need to be addressed by other patches. The arm64-specific brokenness is a result of commits: 2fc0e4b4126c ("rseq: Record interrupt from user space") 39a167560a61 ("rseq: Optimize event setting") The first commit failed to add a call to rseq_note_user_irq_entry() on arm64. Thus arm64 never sets rseq_event::user_irq to record that it may be necessary to abort an active rseq critical section upon return to userspace. On its own, this commit had no functional impact as the value of rseq_event::user_irq was not consumed. The second commit relied upon rseq_event::user_irq to determine whether or not to bother to perform rseq work when returning to userspace. As rseq_event::user_irq wasn't set on arm64, this work would be skipped, and consequently an active rseq critical section would not be aborted. Fix this by giving arm64 syscall-specific entry/exit paths, and performing the relevant logic in syscall and non-syscall paths, including calling rseq_note_user_irq_entry() for non-syscall entry. Currently arm64 cannot use syscall_enter_from_user_mode(), syscall_exit_to_user_mode(), and irqentry_exit_to_user_mode(), due to ordering constraints with exception masking, and risk of ABI breakage for syscall tracing/audit/etc. For the moment the entry/exit logic is left as arm64-specific, directly using enter_from_user_mode() and exit_to_user_mode(), but mirroring the generic code. I intend to follow up with refactoring/cleanup, as we did for kernel mode entry paths in commit: 041aa7a85390 ("entry: Split preemption from irqentry_exit_to_kernel_mode()") ... which will allow arm64 to use the GENERIC_IRQ_ENTRY functions directly. Fixes: 39a167560a61 ("rseq: Optimize event setting") Reported-by: Mathias Stearn Signed-off-by: Mark Rutland Signed-off-by: Peter Zijlstra (Intel) Acked-by: Catalin Marinas Link: https://lore.kernel.org/regressions/CAHnCjA25b+nO2n5CeifknSKHssJpPrjnf+dtr7UgzRw4Zgu=oA@mail.gmail.com/ Link: https://patch.msgid.link/20260508142023.3268622-1-mark.rutland@arm.com commit 786a45757dcdf8f2beb9d4a6db605db16c18b2b4 Author: David Woodhouse Date: Tue Apr 28 21:59:52 2026 +0100 x86/kexec: Push kjump return address even for non-kjump kexec The version of purgatory code shipped by kexec-tools attempts to look above the top of its stack to find a return address for a kjump, even in a non-kjump kexec. After the commit in Fixes: the word above the stack might not be there, leading to a fault (which is at least now caught by my exception-handling code in kexec). That commit fixed things for the actual kjump path, but no longer "gratuitously" pushes the unused return address to the stack in the non-kjump path. Put that *back* in the non-kjump path, to prevent purgatory from crashing when trying to access it. Fixes: 2cacf7f23a02 ("x86/kexec: Fix stack and handling of re-entry point for ::preserve_context") Reported-by: Rohan Kakulawaram Signed-off-by: David Woodhouse Signed-off-by: Borislav Petkov (AMD) Acked-by: Dave Hansen Tested-by: Rohan Kakulawaram Cc: Link: https://patch.msgid.link/32d627134143ffd957891cb697138e839c623211.camel@infradead.org commit 3086c49a075f144536db0268ad307e63a8e1dbdb Author: DaeMyung Kang Date: Fri May 8 00:48:52 2026 +0900 ntfs: avoid leaking uninitialised bytes in new security descriptors ntfs_sd_add_everyone() builds the on-disk security descriptor for a newly created file by kmalloc()'ing a buffer and then partially filling it in: sd = kmalloc(sd_len, GFP_NOFS); ... sd->revision = 1; sd->control = SE_DACL_PRESENT | SE_SELF_RELATIVE; ... The buffer is then handed to ntfs_attr_add() and persisted as the SECURITY_DESCRIPTOR attribute of the new MFT record. The descriptor covers a relative security descriptor header, two SIDs (owner and group), an ACL header, and a single ACE, but several fields inside those structures are never written before the buffer is committed to disk: - struct security_descriptor_relative @alignment (1 byte) @sacl (4 bytes; SE_SACL_PRESENT is not set but the offset still reaches disk) - struct ntfs_sid (3 instances: owner, group, ACE.sid) identifier_authority.value[0..4] (5 bytes per SID, 15 total - only value[5] is set) - struct ntfs_acl @alignment1 (1 byte) @alignment2 (2 bytes) That is 23 bytes of uninitialised slab memory persisted to disk for every new file or directory the legacy ntfs driver creates. The "+ 4" trailing accounting in sd_len holds ace->sid.sub_authority[0], which the existing code does explicitly write to zero, so it is not part of the leak. Anything later able to read the SECURITY_DESCRIPTOR attribute - the same NTFS volume mounted on Windows or by another NTFS reader, an offline forensics tool, an unprivileged user that ends up with read access to the volume - can recover those bytes. The leak persists for the lifetime of the file on disk, not just the lifetime of the kernel that wrote it. Switch the allocation to kzalloc() so every byte the on-disk descriptor covers is zero before the explicit initialisations run. While there, replace the bare "return -1" allocation-failure path with a proper -ENOMEM so the error reaches userspace as a meaningful errno instead of an unrelated -EPERM. Found by inspection while auditing fs/ntfs new-inode paths. Fixes: af0db57d4293 ("ntfs: update inode operations") Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 79629b748ae2f7c19a562b83e8055499765dea89 Author: DaeMyung Kang Date: Thu May 7 11:18:31 2026 +0900 ntfs: fix out-of-bounds write in ntfs_index_walk_down() ntfs_index_walk_down() used to update the index traversal depth directly before writing parent_pos[] and parent_vcn[]. A malformed directory index with too many child-node levels can therefore advance pindex past MAX_PARENT_VCN and write past the fixed arrays in struct ntfs_index_context, corrupting context state used by later index traversal. Use ntfs_icx_parent_inc() for walk-down transitions so the existing depth limit is enforced before the arrays are updated. Make the helper check the limit before incrementing pindex so failed callers do not leave the context at an out-of-range depth. This is reachable by iterating a crafted NTFS directory after the volume has been mounted, including read-only mounts. The reproducer uses getdents64() on an index root that points to an excessively deep chain of child index blocks. A crafted directory index with a chain of child-node entries reproduced UBSAN array-index-out-of-bounds reports in ntfs_index_walk_down() and subsequent KASAN reports in ntfs_index_walk_up(). With this change, the same image is rejected with "Index is over 32 level deep" and no KASAN or UBSAN report is emitted. Fixes: 0a8ac0c1fa0b ("ntfs: update directory operations") Suggested-by: Namjae Jeon Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 11816f7131c876b911605a8dc8b0a8835ed0d715 Author: DaeMyung Kang Date: Wed May 6 18:24:48 2026 +0900 ntfs: fix out-of-bounds write in ntfs_rl_collapse_range() merge path ntfs_rl_collapse_range() merges the run on the left of the collapsed region with the run on its right when they are contiguous. The contiguous check chooses a clamped index when @new_1st_cnt is 0: i = new_1st_cnt == 0 ? 1 : new_1st_cnt; if (ntfs_rle_lcn_contiguous(&new_rl[i - 1], &new_rl[i])) { but the merge itself uses the unclamped value: s_rl = &new_rl[new_1st_cnt - 1]; s_rl->length += s_rl[1].length; When @new_1st_cnt is 0 this computes &new_rl[-1] and writes 8 bytes before the kvcalloc() runlist buffer. The path is reachable through fallocate(FALLOC_FL_COLLAPSE_RANGE) starting at vcn 0 against an attribute whose first run after the collapsed region and the following run are holes. In that case ntfs_rle_lcn_contiguous() returns true because both checked entries are LCN_HOLE, so the merge path is entered with @new_1st_cnt still 0. Such consecutive holes do not occur on a well-formed runlist (NTFS keeps runlists coalesced in memory), so this OOB path is only reachable from a crafted volume. A normal runlist has no element to the left of vcn 0, so the left/right merge is not valid when @new_1st_cnt is 0. Require @new_1st_cnt to be positive before checking or performing the merge. This skips the merge entirely in that case instead of clamping the merge target. The out-of-bounds write can corrupt an adjacent slab object. On a non-KASAN kernel, it is reachable after a crafted NTFS volume has been mounted read-write with the legacy fs/ntfs driver, by a local user that has write access to the crafted file. Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator") Suggested-by: Hyunchul Lee Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit c37d9e68b6766f5e28057ee2ea3251b7ffe88e54 Author: Namjae Jeon Date: Wed May 6 20:36:37 2026 +0900 ntfs: fix variable dereferenced before check ni in ntfs_attr_open() Smatch warnings: ntfs_attr_open() warn: variable dereferenced before check 'ni' Moves the ntfs_debug() call after the NULL pointer checks to ensure safe access to the structure members. Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Namjae Jeon commit 11f7a6d9d722aeb889f6363e4d07e9f0c54f1be1 Author: DaeMyung Kang Date: Tue May 5 22:07:52 2026 +0900 ntfs: fix default_upcase refcount underflow and UAF on fs_context teardown ntfs_init_fs_context() allocates a fresh ntfs_volume with vol->upcase left as NULL. ntfs_free_fs_context() unconditionally calls ntfs_volume_free() during fs_context teardown, even when ntfs_fill_super() never ran or already cleaned up. ntfs_volume_free() then executes: mutex_lock(&ntfs_lock); if (vol->upcase == default_upcase) { ntfs_nr_upcase_users--; vol->upcase = NULL; } When the global default_upcase is also NULL (very first mount attempt, or all prior mounts have released the table), the comparison is NULL == NULL, and ntfs_nr_upcase_users is decremented even though this volume never claimed a reference. ntfs_nr_upcase_users is unsigned long, so the decrement wraps to ULONG_MAX. A subsequent successful mount can then free the shared table while the mounted volume still points at it: 1. ntfs_fill_super() does the temporary ntfs_nr_upcase_users++ at the "Generate the global default upcase table if necessary" block. With the prior wraparound this brings the counter back to 0. 2. If the volume's $UpCase matches the default, the match path does ntfs_nr_upcase_users++ and sets vol->upcase = default_upcase. The counter is now 1. 3. On the success path, !--ntfs_nr_upcase_users evaluates true and default_upcase is kvfree()'d while vol->upcase still points at it. Subsequent upcase comparisons through that mount touch freed memory. This was reproduced with KASAN by closing a fresh fsopen("ntfs") context, then mounting an NTFS image whose $UpCase table matches generate_default_upcase(), and finally doing a case-insensitive lookup. KASAN reports the dangling vol->upcase access: BUG: KASAN: use-after-free in ntfs_collate_names+0x3b4/0x420 Read of size 2 at addr ffff888008d40048 by task init/1 ntfs_collate_names+0x3b4/0x420 ntfs_lookup_inode_by_name+0x1921/0x3130 ntfs_lookup+0x193/0xc40 vfs_statx+0xc7/0x190 vfs_fstatat+0x4b/0xa0 __do_sys_newfstatat+0x92/0xf0 The same QEMU reproducer was rerun after this change with KASAN enabled. It reached "reproducer finished", and the log contained no KASAN, use-after-free, Oops, or panic signatures. Guard each comparison with an explicit vol->upcase non-NULL check so a volume that never took a reference cannot decrement the global users counter. Apply the same guard to the other default_upcase release sites so all cleanup paths follow the same ownership rule: only volumes that actually hold a default_upcase reference may drop one. Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"") Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit de08874bae7db49d77085a34b62ebb491ea68e2e Author: Hyunchul Lee Date: Mon May 4 20:03:14 2026 +0900 ntfs: match ntfs_resident_attr_min_value_length with $AttrDef Update ntfs_resident_attr_min_value_length() to align with $AttrDef. The $VOLUME_NAME is allowed to have the size of 0. The Windows 11 $AttrDef values are as follows: Attribute Name (ID) Size (Min-Max) Flags $STANDARD_INFORMATION (16) 48-72 Resident $ATTRIBUTE_LIST (32) No Limit Non-resident $FILE_NAME (48) 68-578 Resident, Index $OBJECT_ID (64) 0-256 Resident $SECURITY_DESCRIPTOR (80) No Limit Non-resident $VOLUME_NAME (96) 2-256 Resident $VOLUME_INFORMATION (112) 12-12 Resident $DATA (128) No Limit (None) $INDEX_ROOT (144) No Limit Resident $INDEX_ALLOCATION (160) No Limit Non-resident $BITMAP (176) No Limit Non-resident $REPARSE_POINT (192) 0-16384 Non-resident $EA_INFORMATION (208) 8-8 Resident $EA (224) 0-65536 (None) $LOGGED_UTILITY_STREAM (256) 0-65536 Non-resident Reported-by: woot000 Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 6c30af0b203e7d7f63f70df1f2c4694c1e5ed589 Author: DaeMyung Kang Date: Sat May 2 09:49:16 2026 +0900 ntfs: avoid use-after-free of index inode in ntfs_inode_sync_filename() ntfs_inode_sync_filename() walks every FILE_NAME attribute and, for each one that points at a different parent, opens the parent index inode with ntfs_iget() and locks index_ni->mrec_lock. All three error branches (NInoBeingDeleted, ntfs_index_ctx_get failure, ntfs_index_lookup failure) drop the parent reference before unlocking: iput(index_vi); mutex_unlock(&index_ni->mrec_lock); continue; index_ni is NTFS_I(index_vi), so the ntfs_inode (and its mrec_lock) is embedded in the inode allocation. If the parent directory is not held outside the icache - no open dentry, recently evicted from dcache, no other concurrent lookup - ntfs_iget() returns with i_count == 1 and our iput() drops the last reference. evict_inode() then runs and destroy_inode() schedules the slab object for RCU free, while mutex_unlock() on the next line is still touching index_ni->mrec_lock. Swap the order so the mutex is dropped while index_vi is still alive, matching the success path at the bottom of the loop which already unlocks before iput(). Reproduced under KASAN with a debug build that forces ntfs_index_ctx_get() to fail when the parent index inode has been opened with i_count == 1. KASAN reports a slab-use-after-free read on the parent's mrec_lock from mutex_unlock() on the writeback worker: BUG: KASAN: slab-use-after-free in __mutex_unlock_slowpath+0xb5/0x970 Read of size 8 at addr ffff8880014b7598 by task kworker/u8:0/12 Workqueue: writeback wb_workfn (flush-253:0) Call Trace: mutex_unlock ntfs_inode_sync_filename __ntfs_write_inode ntfs_write_inode __writeback_single_inode Allocated by task 103: ntfs_alloc_big_inode ntfs_iget ntfs_lookup __x64_sys_mkdir Freed by task 12: ntfs_free_big_inode i_callback rcu_do_batch Last potentially related work creation: call_rcu destroy_inode evict dispose_list evict_inodes ntfs_inode_sync_filename __ntfs_write_inode The buggy address belongs to the object at ffff8880014b7440 which belongs to the cache ntfs_big_inode_cache of size 1800 The freed object is the parent directory inode itself: allocated by mkdir(2) via ntfs_iget(), then released through call_rcu(i_callback) that destroy_inode() scheduled when evict_inodes() ran from inside ntfs_inode_sync_filename(). Re-running the same workload with mutex_unlock() moved before iput() runs cleanly under KASAN. Fixes: af0db57d4293 ("ntfs: update inode operations") Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit f3c8cd8a63683f53a4e0247ef2b3cdc5132e97fa Author: DaeMyung Kang Date: Sat May 2 09:48:52 2026 +0900 ntfs: fix copy length in ntfs_bdev_write() for non-page-aligned start This is not a normal data I/O hot path. The single in-tree caller is the $LogFile emptying path used during read-write mount/remount, and the bug only becomes visible on NTFS volumes whose cluster_size is strictly smaller than the kernel's PAGE_SIZE (typically 4 KiB on x86_64). Per Microsoft's format command documentation, NTFS supports allocation unit sizes starting at 512 bytes, so 512 B, 1 KiB and 2 KiB clusters are uncommon but valid on-disk configurations. When cluster_size >= PAGE_SIZE every "start" passed in is page-aligned and the buggy "from != 0" path is never taken. ntfs_bdev_write() splits the write across one or more block-device folios. Inside the loop, "to" is computed as the *end byte offset* within the current page (0..PAGE_SIZE), and "from" is the start byte offset within the page (reset to 0 from the second iteration onward). The copy length should therefore be "to - from", but the current code uses "to" directly: to = min_t(u32, end - offset, PAGE_SIZE); memcpy_to_folio(folio, from, buf + buf_off, to); buf_off += to; When "from != 0" (i.e. "start" is not page-aligned) memcpy_to_folio() copies "from" extra bytes: - it reads "from" bytes past the source buffer into kernel heap; - it writes "from" bytes past the requested range into the next part of the block-device page (or, if "from + to > PAGE_SIZE", past the folio boundary entirely, which trips the VM_BUG_ON inside memcpy_to_folio() on CONFIG_DEBUG_VM=y kernels). "buf_off" is then advanced by the wrong amount, so every subsequent iteration also reads the source buffer at the wrong offset and writes the wrong content to disk. ntfs_empty_logfile() calls ntfs_bdev_write(sb, empty_buf, NTFS_CLU_TO_B(vol, lcn), vol->cluster_size); with empty_buf sized to vol->cluster_size. On a sub-PAGE_SIZE-cluster volume, any $LogFile run whose LCN is not aligned to PAGE_SIZE / cluster_size reaches the non-page-aligned path. The over-copy can read beyond empty_buf and overwrite the sectors following the requested cluster in the block-device page with unrelated kernel heap contents while $LogFile is being emptied. A userspace reducer of the same arithmetic and copy loop confirms the bug under AddressSanitizer: ASan reports a heap-buffer-overflow read past the source buffer for the buggy length, and the fixed version is ASan-clean. Compute the copy length as "to - from" and advance buf_off by the same amount. Fixes: 5218cd102aec ("ntfs: update misc operations") Link: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/format Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 563d0d4c2c1dc1f3f84104c78b388d0490c0086f Author: DaeMyung Kang Date: Fri May 1 02:20:53 2026 +0900 ntfs: wait for sync mft writes to complete ntfs_sync_mft_mirror() and write_mft_record_nolock() with @sync set are both documented as synchronous, but neither actually waits for the bio they submit nor inspects bi_status. write_inode() can return success while dirty mft record bytes are still in flight, and bio errors are silently dropped: the volume is not marked with errors and the inode is not redirtied. This breaks fsync()/sync metadata durability. Switch ntfs_sync_mft_mirror() and the @sync path of write_mft_record_nolock() to submit_bio_wait() and propagate the returned error to the caller. Capture ntfs_sync_mft_mirror()'s return value at its call sites in write_mft_record_nolock() so a mirror write failure surfaces too. The @sync parameter only controls the main MFT bio. The !@sync main submission is therefore unchanged and still uses ntfs_bio_end_io() to drop the folio reference taken before submission. The mirror call has always been documented as performing synchronous I/O regardless of @sync, so making it actually block restores the originally intended contract for both @sync and !@sync callers. Note this only fixes the synchronous mirror/main paths reachable from write_mft_record_nolock(). The main MFT write submitted from ntfs_write_mft_block() (the .writepages path) still does not wait for completion or check bi_status; that requires a larger restructuring and is left to a follow-up patch. Fixes: 115380f9a2f9 ("ntfs: update mft operations") Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 618c991cdf031925b09cbb1117f613abdb068680 Author: DaeMyung Kang Date: Fri May 1 02:20:55 2026 +0900 ntfs: capture mft mirror sync errors in ntfs_write_mft_block() After ntfs_sync_mft_mirror() became able to return real I/O errors, ntfs_write_mft_block() still discards its return value at the call site inside the per-record loop. A failed $MFTMirr write therefore leaves the volume looking clean from the writeback path even though the on-disk mirror is now stale. Capture the return value and feed it into the function's existing @err variable using the same "first error wins" pattern already used on other failure paths. The error is propagated to the caller and, via the existing tail of the function, sets NVolErrors so umount and chkdsk see the volume as inconsistent. Fixes: 115380f9a2f9 ("ntfs: update mft operations") Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 49c12bee2bb2604e82a997521175b85ca5421685 Author: DaeMyung Kang Date: Fri May 1 02:20:54 2026 +0900 ntfs: redirty folio when ntfs_write_mft_block() runs out of memory ntfs_write_mft_block() is called by writeback_iter() with the folio locked. When the per-call allocations for @locked_nis or @ref_inos fail, the function returns -ENOMEM directly without unlocking the folio. Any later task that needs the folio's lock then stalls, and the folio's dirty state is silently lost from the writeback iterator's point of view. Use folio_redirty_for_writepage() so the folio remains dirty for a subsequent writeback pass, unlock it, and only then return -ENOMEM so the caller can propagate the error to fsync()/sync_filesystem(). Fixes: f462fdf3d6a4 ("ntfs: reduce stack usage in ntfs_write_mft_block()") Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 47773fa85e470e9896a22a99ccd5b5930d469680 Author: DaeMyung Kang Date: Thu Apr 30 20:54:47 2026 +0900 ntfs: use base mft_no when looking up base inode for extent record When the mft record is an extent record, ntfs_may_write_mft_record() looks up its base inode in the icache. The hash key passed to find_inode_nowait() must be the base inode's mft number (na.mft_no, set just above to MREF_LE(m->base_mft_record)), but the code passes @mft_no, the extent record's own number. find_inode_nowait() uses its second argument as the hashval, so the lookup lands in the wrong bucket and almost always returns NULL. ntfs_may_write_mft_record() then returns false and the writeback path (ntfs_write_mft_block()) skips that extent record, leaving the on-disk copy permanently out of sync with the in-memory one. The original ilookup5_nowait() call this conversion replaced used na.mft_no. Restore that. Fixes: 115380f9a2f9 ("ntfs: update mft operations") Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 1fcf4149418e7a8f8253dd74059d56340795503f Merge: 7602c0ec0bbfd3 0df8aa2b9aec5c Author: Arnd Bergmann Date: Fri May 8 15:33:30 2026 +0200 Merge tag 'riscv-dt-fixes-for-v7.1-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes RISC-V devicetrees fixes for v7.1-rc3 Microchip: Fix a pinctrl misconfiguration caused by a erratum fixed between engineering sample and production silicon, that causes settings for one to not apply to the other. Starfive: Remove nodes relating to the "camss" video device that has been deleted entirely from staging. Signed-off-by: Conor Dooley * tag 'riscv-dt-fixes-for-v7.1-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: microchip: fix icicle i2c pinctrl configuration riscv: dts: starfive: jh7110: Drop CAMSS node Signed-off-by: Arnd Bergmann commit f7700a4415afb3ac1767a556094e4ef8bd440e41 Author: Ming Lei Date: Fri May 8 20:37:46 2026 +0800 ublk: fix use-after-free in ublk_cancel_cmd() When ublk_reset_ch_dev() clears io->cmd via ublk_queue_reinit() concurrently with ublk_cancel_cmd(), ublk_cancel_cmd() can read a stale pointer and pass it to io_uring_cmd_done(), causing a use-after-free. Fix by synchronizing the two paths with ubq->cancel_lock: - ublk_cancel_cmd(): read and clear io->cmd under cancel_lock, then call io_uring_cmd_done() on the saved local copy outside the lock. - ublk_reset_ch_dev(): hold cancel_lock across ublk_queue_reinit() so that io->cmd and io->flags are cleared atomically with respect to ublk_cancel_cmd(). Fixes: 216c8f5ef0f2 ("ublk: replace monitor with cancelable uring_cmd") Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260508123746.242018-1-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit ba9d20ee9076dac32c371116bacbe72480eb356c Author: Sven Eckelmann Date: Wed May 6 22:20:52 2026 +0200 batman-adv: bla: put backbone reference on failed claim hash insert When batadv_bla_add_claim() fails to insert a new claim into the hash, it leaked a reference to the backbone_gw for which the claim was intended. Call batadv_backbone_gw_put() on the error path to release the reference and avoid leaking the backbone_gw object. Cc: stable@kernel.org Fixes: 3db0decf1185 ("batman-adv: Fix non-atomic bla_claim::backbone_gw access") Signed-off-by: Sven Eckelmann commit cf6b604011591865ae39ac82de8978c1120d17af Author: Sven Eckelmann Date: Wed May 6 22:20:51 2026 +0200 batman-adv: bla: only purge non-released claims When batadv_bla_purge_claims() goes through the list of claims, it is only traversing the hash list with an rcu_read_lock(). Due to a potential parallel batadv_claim_put(), it can happen that it encounters a claim which was actually in the process of being released+freed by batadv_claim_release(). In this case, backbone_gw is set to NULL before the delayed RCU kfree is started. Calling batadv_bla_claim_get_backbone_gw() is then no longer allowed because it would cause a NULL-ptr derefence. To avoid this, only claims with a valid reference counter must be purged. All others are already taken care of. Cc: stable@kernel.org Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code") Signed-off-by: Sven Eckelmann commit 4ae1709a314060a196981b344610d023ea841e57 Author: Sven Eckelmann Date: Wed May 6 22:20:50 2026 +0200 batman-adv: bla: prevent use-after-free when deleting claims When batadv_bla_del_backbone_claims() removes all claims for a backbone, it does this by dropping the link entry in the hash list. This list entry itself was one of the references which need to be dropped at the same time via batadv_claim_put(). But the batadv_claim_put() must not be done before the last access to the claim object in this function. Otherwise the claim might be freed already by the batadv_claim_release() function before the list entry was dropped. Cc: stable@kernel.org Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code") Signed-off-by: Sven Eckelmann commit ce425dd05d0fe7594930a0fb103634f35ac47bb6 Author: Sven Eckelmann Date: Wed May 6 22:20:49 2026 +0200 batman-adv: tp_meter: fix tp_num leak on kmalloc failure When batadv_tp_start() or batadv_tp_init_recv() fail to allocate a new tp_vars object, the previously incremented bat_priv->tp_num counter is never decremented. This causes tp_num to drift upward on each allocation failure. Since only BATADV_TP_MAX_NUM sessions can be started and the count is never reduced for these failed allocations, it causes to an exhaustion of throughput meter sessions. In worst case, no new throughput meter session can be started until the mesh interface is removed. The error handling must decrement tp_num releasing the lock and aborting the creation of an throughput meter session Cc: stable@kernel.org Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Signed-off-by: Sven Eckelmann commit f03e8583532941b07761c5429de7d50766fa3110 Author: Jiexun Wang Date: Sun May 3 12:28:58 2026 +0800 batman-adv: stop caching unowned originator pointers in BAT IV BAT IV keeps the last-hop neighbor address in each neigh_node, but some paths also cache an originator pointer derived from a temporary lookup. That pointer is not owned by the neigh_node and may no longer refer to a live originator entry after purge handling runs. Stop storing the auxiliary originator pointer in the BAT IV neighbor state. When BAT IV needs the neighbor originator data, resolve it from the stored neighbor address and drop the reference again after use. Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Jiexun Wang Signed-off-by: Ren Wei [sven: avoid bonding logic for outgoing OGM] Signed-off-by: Sven Eckelmann commit 5e28b7b94408897e41c63477aabc9e1db439bc8c Author: Francis, David Date: Tue Apr 28 19:25:50 2026 +0000 drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could delete the object and remove one of the handles while leaving the other one dangling, which could subsequently be dereferenced for a use-after-free. To fix this, do the same dance that gem_close itself does. (f6cd7daecff5 drm: Release driver references to handle before making it available again) First idr_replace the old handle to NULL. Later, if the prime operations are successful, actually close it. create_tail required a similar dance to avoid a similar problem. (bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail()) It idr_allocs the new handle with NULL, then swaps in the correct object later to avoid races. We don't need to do that here, since the only operations that could race are drm_prime, and change_handle holds the prime lock for the entire duration. v2: cleanups of error paths Signed-off-by: David Francis Co-authored-by: Dave Airlie Reported-by: Puttimet Thammasaeng Tested-by: Vitaly Prosyak Cc: Simona Vetter Cc: stable@vger.kernel.org Cc: Christian Koenig Fixes: 53096728b8910 ("drm: Add DRM prime interface to reassign GEM handle") Signed-off-by: Dave Airlie commit d8a70292c3e1759804dcc1a60e53ead86b466a3a Merge: 765e717dfb751f 4e02e0afa95f69 Author: Dave Airlie Date: Fri May 8 16:13:07 2026 +1000 Merge tag 'amd-drm-fixes-7.1-2026-05-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.1-2026-05-06: amdgpu: - GFX9 fixes - Hawaii SMU fixes - SDMA4 fix - GART fix - Userq fixes amdkfd: - GPUVM TLB flush fix - Hotplug fix radeon: - Hawaii SMU fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260506154631.1733034-1-alexander.deucher@amd.com commit 7666dbb1bacc4ba522b96740cba7283d243d16e1 Author: John Walker Date: Thu May 7 17:07:20 2026 -0600 wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem) but never advances mbssid_elem or sub_elem inside the body. Each iteration therefore searches for a continuation that follows the same fixed pair; the helper returns the same next_mbssid; and the same next_sub bytes are memcpy()'d into merged_ie at a growing offset until the buffer fills. Advance both mbssid_elem and sub_elem to the just-consumed continuation so the next call to cfg80211_get_profile_continuation() searches for a further continuation beyond it (or returns NULL when none exists). A specially-crafted malicious beacon can take advantage of this bug to cause the kernel to spend an excessive amount of time in cfg80211_merge_profile (up to as much as 2ms per beacon received), which could theoretically be abused in some way. Cc: stable@vger.kernel.org Fixes: fe806e4992c9 ("cfg80211: support profile split between elements") Signed-off-by: John Walker Link: https://patch.msgid.link/20260507230720.64783-1-johnwalker0@gmail.com Signed-off-by: Johannes Berg commit f9f16835d4dc46113c0a72625ffbf61f1aa95e5c Author: K Prateek Nayak Date: Fri May 8 05:17:48 2026 +0000 cpufreq/amd-pstate-ut: Drop policy reference before driver switch Recent changes to the EPP unit test tries to perform a driver switch with a cpufreq_policy reference held when the driver is loaded into anything but the active mode which leads to a circular dependency and the unit test hanging indefinitely. Drop the reference before driver switch and grab it back once the driver mode is stabilized for the test. The EPP writes are only possible with CPUFREQ_POLICY_POWERSAVE policy. Temporarily switch the cpudata->policy (while holding the write end of the policy->rwsem) to CPUFREQ_POLICY_POWERSAVE and restore the original policy once tests are done. To ensure the final EPP is correct in case the driver started with CPUFREQ_POLICY_PERFORMANCE, EPP performance is tested last. The __free() based cleanup for cpufreq_policy is lost in the process. Reported-by: Kalpana Shetty Fixes: 7e173bc310d2b ("cpufreq/amd-pstate-ut: Add a unit test for raw EPP") Reviewed-by: Mario Limonciello Signed-off-by: K Prateek Nayak Link: https://lore.kernel.org/r/20260508051748.10484-7-kprateek.nayak@amd.com Signed-off-by: Mario Limonciello (AMD) commit caa822d312be54e3fe1a3b52c887e0888e149c12 Author: K Prateek Nayak Date: Fri May 8 05:17:47 2026 +0000 cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled If "dynamic_epp" is disabled, the driver initialization and the default EPP selection from sysfs currently sets the EPP based on the power supply state of the system at that time but there is no power supply callbacks registered to toggle it when the power supply state changes. This can lead to faster battery drain on platforms that start off while being plugged to the wall but later move to battery power since the EPP stays at AMD_CPPC_EPP_PERFORMANCE. Use "epp_default_dc" as the default EPP selection when dynamic_epp is disabled, restoring older behavior. On servers, this defaults to AMD_CPPC_EPP_PERFORMANCE and on other platforms, it defaults to AMD_CPPC_EPP_BALANCE_PERFORMANCE. Fixes: e30ca6dd5345 ("cpufreq/amd-pstate: Add dynamic energy performance preference") Reviewed-by: Mario Limonciello Signed-off-by: K Prateek Nayak Link: https://lore.kernel.org/r/20260508051748.10484-6-kprateek.nayak@amd.com Signed-off-by: Mario Limonciello (AMD) commit f3acf7ff113007557538b278ccb0e4ab7ae513ea Author: K Prateek Nayak Date: Fri May 8 05:17:46 2026 +0000 cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset An active power supply notifier can race with amd_pstate_epp_cpu_exit() trying to reset the floor perf and can overwrite the floor perf set in MSR_AMD_CPPC_REQ. Unregister the notifier before setting the floor perf to prevent the rare race. Fixes: e30ca6dd5345 ("cpufreq/amd-pstate: Add dynamic energy performance preference") Reviewed-by: Mario Limonciello Signed-off-by: K Prateek Nayak Link: https://lore.kernel.org/r/20260508051748.10484-5-kprateek.nayak@amd.com Signed-off-by: Mario Limonciello (AMD) commit c5eed6ddc757e477f52b3d99bfde9e59975c72ca Author: K Prateek Nayak Date: Fri May 8 05:17:45 2026 +0000 cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified Writing the current "dynamic_epp" state to sysfs fails with -EINVAL even though the desired result was achieved. Allow writes to "dynamic_epp" that does not modify the state. Fixes: e30ca6dd5345 ("cpufreq/amd-pstate: Add dynamic energy performance preference") Reviewed-by: Mario Limonciello Signed-off-by: K Prateek Nayak Link: https://lore.kernel.org/r/20260508051748.10484-4-kprateek.nayak@amd.com Signed-off-by: Mario Limonciello (AMD) commit 87d2a8dec0f02b200eb3527da0ab11ba4d4e7deb Author: K Prateek Nayak Date: Fri May 8 05:17:44 2026 +0000 cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name Failure to allocate profile name will return -EINVAL from platform_profile_register() while in fact, it is a failure to allocate memory for the profile_name string. Return -ENOMEM when kasprintf() fails to allocate profile_name string. Fixes: e30ca6dd5345 ("cpufreq/amd-pstate: Add dynamic energy performance preference") Reviewed-by: Mario Limonciello Signed-off-by: K Prateek Nayak Link: https://lore.kernel.org/r/20260508051748.10484-3-kprateek.nayak@amd.com Signed-off-by: Mario Limonciello (AMD) commit 9228169d2ae055ed09a163887fc59a710a5eb73b Author: K Prateek Nayak Date: Fri May 8 05:17:43 2026 +0000 cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp Concurrently changing driver mode and dynamic_epp with: echo passive > /sys/devices/system/cpu/amd_pstate/status& echo disable > /sys/devices/system/cpu/amd_pstate/dynamic_epp& hits the WARN_ON_ONCE() in static_key_disable_cpuslocked() and hangs the system since both sysfs writes are trying to do amd_pstate_change_driver_mode() without any synchronization. Grab the "amd_pstate_driver_lock" mutex when modifying "dynamic_epp" to prevent the two paths from racing with each other. Add a lockdep assertion for "amd_pstate_driver_lock" in amd_pstate_change_driver_mode() to formalize the dependency. Since "cppc_mode" is stable under "amd_pstate_driver_lock", only reload the driver when in "AMD_PSTATE_ACTIVE" mode and reject all writes when in passive or guided mode, or if the driver is not loaded, since only active mode operates on EPP. Fixes: e30ca6dd5345 ("cpufreq/amd-pstate: Add dynamic energy performance preference") Reviewed-by: Mario Limonciello Signed-off-by: K Prateek Nayak Link: https://lore.kernel.org/r/20260508051748.10484-2-kprateek.nayak@amd.com Signed-off-by: Mario Limonciello (AMD) commit 765e717dfb751f9ccebb35fdb0773f929d50cb6f Merge: 22e170e9a37ea2 b15838b03cd0c6 Author: Dave Airlie Date: Fri May 8 12:03:01 2026 +1000 Merge tag 'drm-misc-fixes-2026-05-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: bochs: - fix managed cleanup bridge: - tda998x: fix sparse warnings on type correctness etnaviv: - schedule armed jobs exynos: - managed bridge cleanup fb-helper: - fix clipping ivpu: - disallow reexport of GEM buffer objects noveau: - revert support for GA100 panel: - boe-tv101wum-nl16: use correct MIPI_DSI mode - feyjang-fy07024di26a30d: fix error reporting - himax-hx83102: use correct MIPI_DSI mode - himax-hx83121a: fix error checks - himax-hx83121a: select DRM_DISPLAY_DSC_HELPER qaic: - fix RAS message handling qxl: - clean up polling sti: - managed bridge cleanup ttm: - update GPU MM stats on pool shrinking Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260507115213.GA206508@linux.fritz.box commit 41337097f2823e99478d7cbe68d4893582ed0b18 Author: Hui Wang Date: Wed May 6 21:21:52 2026 +0800 riscv: cpufeature: Use pre-defined ISA ext macros to index isa2hwcap We have pre-defined ISA extension macros, here use those macros to replace a magic number for isa2hwcap definition and some array indexing for isa2hwcap access. This doesn't change the original functionality, just improve the code maintainability and readability. Signed-off-by: Hui Wang Link: https://patch.msgid.link/20260506132152.53239-1-hui.wang@canonical.com Signed-off-by: Paul Walmsley commit ef5581bb30efb939cc2bf093475c6cc85258e5cd Author: Martin Kaiser Date: Fri May 8 09:56:36 2026 +0900 test_kprobes: clear kprobes between test runs Running the kprobes sanity tests twice makes all tests fail and eventually crashes the kernel. [root@martin-riscv-1 ~]# echo 1 > /sys/kernel/debug/kunit/kprobes_test/run ... # Totals: pass:5 fail:0 skip:0 total:5 ok 1 kprobes_test [root@martin-riscv-1 ~]# echo 1 > /sys/kernel/debug/kunit/kprobes_test/run ... # test_kprobe: EXPECTATION FAILED at lib/tests/test_kprobes.c:64 Expected 0 == register_kprobe(&kp), but register_kprobe(&kp) == -22 (0xffffffffffffffea) ... Unable to handle kernel paging request ... The testsuite defines several kprobes and kretprobes as static variables that are preserved across test runs. After register_kprobe and unregister_kprobe, a kprobe contains some leftover data that must be cleared before the kprobe can be registered again. The tests are setting symbol_name to define the probe location. Address and flags must be cleared. The existing code clears some of the probes between subsequent tests, but not between two test runs. The leftover data from a previous test run makes the registrations fail in the next run. Move the cleanups for all kprobes into kprobes_test_init, this function is called before each single test (including the first test of a test run). Link: https://lore.kernel.org/all/20260507134615.1010905-1-martin@kaiser.cx/ Fixes: e44e81c5b90f ("kprobes: convert tests to kunit") Signed-off-by: Martin Kaiser Signed-off-by: Masami Hiramatsu (Google) commit 307abfac04a254c09c5705d816b33354acee97a0 Author: Jianpeng Chang Date: Fri May 8 09:56:36 2026 +0900 kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() When kprobe_add_area_blacklist() iterates through a section like .kprobes.text, the start address may not correspond to a named symbol. On ARM64 with CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS=y (introduced by commit baaf553d3bc3 ("arm64: Implement HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS")), the compiler flag -fpatchable-function-entry=4,2 inserts 2 NOPs before each function entry point for ftrace call_ops. These pre-function NOPs sit at the section base address, before the first named function symbol. The compiler emits a $x mapping symbol at offset 0x00 to mark the start of code, but find_kallsyms_symbol() ignores mapping symbols. Without CONFIG_DYNAMIC_FTRACE_WITH_CALL_OPS (e.g. defconfig), no pre-function NOPs are inserted, the first function starts at offset 0x00, and the bug does not trigger. This only affects modules that have a .kprobes.text section (i.e. those using the __kprobes annotation). Modules using NOKPROBE_SYMBOL() instead (like kretprobe_example.ko) blacklist exact function addresses via the _kprobe_blacklist section and are not affected. For kprobe_example.ko on ARM64 with -fpatchable-function-entry=4,2, the .kprobes.text section layout is: offset 0x00: $x + 2 NOPs (mapping symbol + ftrace preamble) offset 0x08: handler_post (64 bytes) offset 0x50: handler_pre (68 bytes) kprobe_add_area_blacklist() starts iterating from the section base address (offset 0x00), which only has the $x mapping symbol. kprobe_add_ksym_blacklist() then calls kallsyms_lookup_size_offset() for this address, which goes through: kallsyms_lookup_size_offset() -> module_address_lookup() -> find_kallsyms_symbol() find_kallsyms_symbol() scans all module symbols to find the closest preceding symbol. Since no named text symbol exists at offset 0x00, find_kallsyms_symbol() picks __UNIQUE_ID_vermagic (a .modinfo symbol whose address is in the temporary image) as the "best" match. The computed "size" = next_text_symbol - modinfo_symbol spans across these two unrelated memory regions, creating a blacklist entry with a bogus range of tens of terabytes. Whether this causes a visible failure depends on address randomization, here is what happens on Raspberry Pi 4/5: - On RPi5, the bogus size was ~35 TB. start + size stayed within 64-bit range, so the blacklist entry covered the entire kernel text. register_kprobe() in the module's own init function failed with -EINVAL. - On RPi4, the bogus size was ~75 TB. start + size overflowed 64 bits and wrapped to a small address near zero. The range check (addr >= start && addr < end) then failed because end wrapped around, so the bogus entry was accidentally harmless and kprobes worked by luck. The same bug exists on both machines, but randomization determines whether the integer overflow masks it or not. Fix this by adding notrace to the __kprobes macro. Functions in .kprobes.text are kprobe infrastructure handlers that should never be traced by ftrace. With notrace, the compiler stops inserting them and the non-symbol gap at the section start disappears entirely. Link: https://lore.kernel.org/all/20260506012706.2785785-1-jianpeng.chang.cn@windriver.com/ Fixes: baaf553d3bc3 ("arm64: Implement HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS") Signed-off-by: Jianpeng Chang Signed-off-by: Masami Hiramatsu (Google) commit 917719c412c48687d4a176965d1fa35320ec457c Merge: fcee7d82f27d6a 868f31e4061eca Author: Linus Torvalds Date: Thu May 7 17:26:43 2026 -0700 Merge tag 'selinux-pr-20260507' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fixes from Paul Moore: - Allow for multiple opens of /sys/fs/selinux/policy Prevent a single process from blocking others from reading the SELinux policy loaded in the kernel. This does have the side effect of potentially allowing userspace to trigger additional kernel memory allocations as part of the open/read operation, but this is mitigated by requiring the SELinux security/read_policy permission. - Reduce the critical sections where the SELinux policy mutex is held This includes the patch to the policy loader code where we move the permission checks and an allocation outside the mutex as well as the the patch to checkreqprot which drops the code/lock entirely. While the checkreqprot code had effectively been dropped in an earlier release, portions of the code still remained that would have triggered the mutex to perform an IMA measurement. This finally drops all of that while preserving the user visible behavior. - Eliminate potential sources of log spamming There were a few areas where processes could flood the system logs and hide other, more critical events. The previously disabled checkreqprot and runtime disable knobs in selinuxfs were two such areas that have now been greatly simplified and a pr_err() replaced with a pr_err_once(). The third such place is the /sys/fs/selinux/user file, which hasn't been used by a userspace release since 2020 and was scheduled for removal after 2025; this effectively disables this functionality, but similar to checkreqprot, it is done in a way that should not break old userspace. * tag 'selinux-pr-20260507' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: shrink critical section in sel_write_load() selinux: allow multiple opens of /sys/fs/selinux/policy selinux: prune /sys/fs/selinux/user selinux: prune /sys/fs/selinux/disable selinux: prune /sys/fs/selinux/checkreqprot commit 1f91d0d5827512816789f74f4d72d16269bde1ec Author: Tejun Heo Date: Thu May 7 14:16:59 2026 -1000 sched_ext: Fix !CONFIG_EXT_SUB_SCHED build warnings W=1 with CONFIG_EXT_SUB_SCHED=n flags 'err_msg' uninitialized and 'err_free_lb_resched' unused. Initialize err_msg and gate the label. Signed-off-by: Tejun Heo commit 19f94b6fee75b3ef7fbc06f3745b9a771a8a19a4 Author: Li Xiasong Date: Thu May 7 22:04:23 2026 +0800 netfilter: nft_ct: fix missing expect put in obj eval nft_ct_expect_obj_eval() allocates an expectation and may call nf_ct_expect_related(), but never drops its local reference. Add nf_ct_expect_put(exp) before return to balance allocation. Fixes: 857b46027d6f ("netfilter: nft_ct: add ct expectations support") Cc: stable@vger.kernel.org Signed-off-by: Li Xiasong Signed-off-by: Pablo Neira Ayuso commit eb6317739b1ea3ab28791e1f91b24781905fa815 Author: Li Xiasong Date: Thu May 7 22:04:22 2026 +0800 netfilter: nf_conntrack_sip: get helper before allocating expectation process_register_request() allocates an expectation and then checks whether a conntrack helper is available. If helper lookup fails, the function returns early and the allocated expectation is left behind. Reorder the code to fetch and validate helper before calling nf_ct_expect_alloc(). This keeps the logic simpler and removes the leak path while preserving existing behavior. Fixes: e14575fa7529 ("netfilter: nf_conntrack: use rcu accessors where needed") Cc: stable@vger.kernel.org Signed-off-by: Li Xiasong Signed-off-by: Pablo Neira Ayuso commit d8ef54c83ad70b81735b506431affadd2f720aa1 Author: Pablo Neira Ayuso Date: Thu May 7 23:57:55 2026 +0200 netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue Ensure the expectation tuple and mask attributes are present in netlink message, otherwise null-ptr-deref is possible. Fixes: bd0779370588 ("netfilter: nfnetlink_queue: allow to attach expectations to conntracks") Signed-off-by: Pablo Neira Ayuso commit dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a Author: Pablo Neira Ayuso Date: Thu May 7 13:00:28 2026 +0200 netfilter: nf_conntrack_expect: restore helper propagation via expectation A recent series to fix expectations broke helper propagation via expectation, this mechanism is used by the sip and h323 helper. This also propagates the conntrack helper to expected connections. I changed semantics of exp->helper which now tells us the actual helper that created the expectation. Add an explicit assign_helper field to expectations for this purpose and update helpers to use it. Restore this feature for userspace conntrack helper via ctnetlink nfqueue integration so it is again possible to attach a helper to an expectation, where it makes sense. This is not restored via ctnetlink expectation creation as there is no client for such feature. Use the expectation layer 4 protocol number for the helper lookup for consistency. Make sure the expectation using this helper propagation mechanism also go away when the helper is unregistered. Fixes: 9c42bc9db90a ("netfilter: nf_conntrack_expect: honor expectation helper field") Fixes: 917b61fa2042 ("netfilter: ctnetlink: ignore explicit helper on new expectations") Reported-by: Ilya Maximets Tested-by: Ilya Maximets Signed-off-by: Pablo Neira Ayuso commit 27414ff1b287ea9a2a11675149ec28e05539f3cc Author: Florian Westphal Date: Thu May 7 11:19:22 2026 +0200 netfilter: bridge: eb_tables: close module init race sashiko reports for unrelated patch: Does the core ebtables initialization in ebtables.c suffer from a similar race? Once nf_register_sockopt() completes, the sockopts are exposed globally. sockopt has to be registered last, just like in ip/ip6/arptables. Fixes: 5b53951cfc85 ("netfilter: ebtables: use net_generic infra") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 16bc4b6686b2c112c10e67d6b493adc3607256d3 Author: Florian Westphal Date: Wed May 6 12:07:20 2026 +0200 netfilter: x_tables: close dangling table module init race Similar to the previous ebtables patch: template add exposes the table to userspace, we must do this last to rnsure the pernet ops are set up (contain the destructors). Fixes: fdacd57c79b7 ("netfilter: x_tables: never register tables by default") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 92c603fa07bc0d6a17345de3ad7954730b8de44b Author: Florian Westphal Date: Wed May 6 12:07:19 2026 +0200 netfilter: ebtables: close dangling table module init race sashiko reported for a related patch: In modules like iptable_raw.c, [..], if register_pernet_subsys() fails, the rollback might call kfree(rawtable_ops) before [..] During this window, could a concurrent userspace process find the globally visible template, trigger table_init(), [..] The table init functions must always register the template last. Otherwise, set/getsockopt can instantiate a table in a namespace while the required pernet ops (contain the destructor) isn't available. This change is also required in x_tables, handled in followup change. Fixes: 87663c39f898 ("netfilter: ebtables: do not hook tables by default") Reviewed-by: Tristan Madani Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit b7f0544d86d439cb946515d2ef6a0a75e8626710 Author: Florian Westphal Date: Wed May 6 12:07:18 2026 +0200 netfilter: ebtables: move to two-stage removal scheme Like previous patches for x_tables, follow same pattern in ebtables. We can't reuse xt helpers: ebt_table struct layout is incompatible. table->ops assignment is now done while still holding the ebt mutex to make sure we never expose partially-filled table struct. Fixes: 87663c39f898 ("netfilter: ebtables: do not hook tables by default") Reviewed-by: Tristan Madani Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit b4597d5fd7d2f8cebfffd40dffb5e003cc78964c Author: Florian Westphal Date: Wed May 6 12:07:17 2026 +0200 netfilter: x_tables: add and use xtables_unregister_table_exit Previous change added xtables_unregister_table_pre_exit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that is doing set/getsockopt for this table will not be able to re-instantiate the table: 1. The larval table has been removed already 2. existing instantiated table is no longer on the xt pernet table list. This adds the second stage helper: unlink the table from the dying list, free the hook ops (if any) and do the audit notification. It replaces xt_unregister_table(). Fixes: fdacd57c79b7 ("netfilter: x_tables: never register tables by default") Reported-by: Tristan Madani Reviewed-by: Tristan Madani Closes: https://lore.kernel.org/netfilter-devel/20260429175613.1459342-1-tristmd@gmail.com/ Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d338693d778579b676a61346849bebd892427158 Author: Florian Westphal Date: Wed May 6 12:07:16 2026 +0200 netfilter: x_tables: unregister the templates first When the module is going away we need to zap the template first. Else there is a small race window where userspace could instantiate a new table after the pernet exit function has removed the current table. Fixes: fdacd57c79b7 ("netfilter: x_tables: never register tables by default") Reported-by: Tristan Madani Reviewed-by: Tristan Madani Closes: https://lore.kernel.org/netfilter-devel/20260429175613.1459342-1-tristmd@gmail.com/ Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 527d6931473b75d90e38942aae6537d1a527f1fd Author: Florian Westphal Date: Wed May 6 12:07:15 2026 +0200 netfilter: x_tables: add and use xt_unregister_table_pre_exit Remove the copypasted variants of _pre_exit and add one single function in the xtables core. ebtables is not compatible with x_tables and therefore unchanged. This is a preparation patch to reduce noise in the followup bug fixes. Reviewed-by: Tristan Madani Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit b62eb8dcf2c47d4d676a434efbd57c4f776f7829 Author: Florian Westphal Date: Wed May 6 12:07:14 2026 +0200 netfilter: x_tables: allocate hook ops while under mutex arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL. If the pernet exit happens runs concurrently the pre_exit callback finds the table via xt_find_table() and passes the NULL ops pointer to nf_unregister_net_hooks(), causing a NULL dereference: general protection fault in nf_unregister_net_hooks+0xbc/0x150 RIP: nf_unregister_net_hooks (net/netfilter/core.c:613) Call Trace: ipt_unregister_table_pre_exit iptable_mangle_net_pre_exit ops_pre_exit_list cleanup_net Fix by moving the ops allocation into the xtables core so the table is never in the list without valid ops. Also ensure the table is no longer processing packets before its torn down on error unwind. nf_register_net_hooks might have published at least one hook; call synchronize_rcu() if there was an error. audit log register message gets deferred until all operations have passed, this avoids need to emit another ureg message in case of error unwinding. Based on earlier patch by Tristan Madani. Fixes: f9006acc8dfe5 ("netfilter: arp_tables: pass table pointer via nf_hook_ops") Fixes: ee177a54413a ("netfilter: ip6_tables: pass table pointer via nf_hook_ops") Fixes: ae689334225f ("netfilter: ip_tables: pass table pointer via nf_hook_ops") Link: https://lore.kernel.org/netfilter-devel/20260429175613.1459342-1-tristmd@gmail.com/ Signed-off-by: Tristan Madani Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 8e72510db9fa2d41f2b06d5c01fe9020e076fee4 Author: Florian Westphal Date: Wed May 6 12:07:13 2026 +0200 netfilter: x_tables: allow initial table replace without emitting audit log message At the moment we emit the audit log a bit too early, which makes it necessary to also emit an unregister log in case we have to unwind errors after possible hook register failure. Followup patch will be slightly simpler if we can delay the register message until after the hooks have been wired up. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 99076a17a112ac43cbd37f6883898ae649166303 Author: Tabrez Ahmed Date: Sat May 2 07:38:42 2026 +0530 hwmon: (ads7871) Fix endianness bug in 16-bit register reads The ads7871_read_reg16() function relies on spi_w8r16() to read the 16-bit sensor output. The ADS7871 device transmits the Least Significant Byte (LSB) first. On Little-Endian architectures, spi_w8r16() correctly reconstructs the 16-bit value. However, on Big-Endian architectures, the byte swapping causes the first received byte (LSB) to be placed in the most significant byte of the u16, resulting in corrupted voltage readings. To fix this, cast the integer result of spi_w8r16() to a restricted __le16 type and convert it to the host CPU's native byte order using le16_to_cpu(). Negative error codes returned by the SPI core are caught and returned prior to the conversion to avoid mangling the error status. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260418034601.90226-1-tabreztalks@gmail.com Fixes: e0c70b8078629 ("hwmon: add TI ads7871 a/d converter driver") Suggested-by: David Laight Signed-off-by: Tabrez Ahmed Link: https://lore.kernel.org/r/20260502020844.110038-2-tabreztalks@gmail.com Signed-off-by: Guenter Roeck commit 05aaac8746c5786eaa779b163fae4ddcd5172707 Author: Markus Stockhausen Date: Sat May 2 19:32:07 2026 +0200 hwmon: (lm75) Fix configuration register writes. Sensors configurations are defined by set and clear masks. These do not follow a consistent "clear mask is a superset of set mask" rule. This relaxed definition breaks lm75_write_config() static inline int lm75_write_config(struct lm75_data *data, u16 set_mask, u16 clr_mask) { return regmap_update_bits(data->regmap, LM75_REG_CONF, clr_mask | LM75_SHUTDOWN, set_mask); } Basically all bits from set_mask that are not defined in clr_mask are dropped. Fix that by enhancing the helper to always combine clr_mask and set_mask into the mask bits of regmap_update_bits(). Fixes: 6da24a25f766 ("hwmon: (lm75) Hide register size differences in regmap access functions") Suggested-by: Guenter Roeck Signed-off-by: Markus Stockhausen Link: https://lore.kernel.org/r/20260502173207.3567876-3-markus.stockhausen@gmx.de Signed-off-by: Guenter Roeck commit 3607422cdeebd1f0c259964bf33aaa9792e21930 Author: Markus Stockhausen Date: Sat May 2 19:32:06 2026 +0200 hwmon: (lm75) Fix AS6200 and TMP112 setup and alarm handling The initialization of the AS6200 has two shortcomings - The device-add-commit states "Conversion mode: continuous" but the the lm75_params structure uses set_mask = 0x94c0. This activates single shot mode (bit 15). According to the datasheet "The device features a single shot measurement mode if the device is in sleep mode (SM=1)". This is quite contradictionary. - It is the only device that activates polarity active-high (bit 10) All this is paired with a undefined clear mask bug in function lm75_write_config() that was introduced with a later refactoring commit. [as6200] = { .config_reg_16bits = true, .set_mask = 0x94C0, -> .clr_mask not defined here .default_resolution = 12, ... static inline int lm75_write_config(struct lm75_data *data, u16 set_mask, u16 clr_mask) { return regmap_update_bits(data->regmap, LM75_REG_CONF, clr_mask | LM75_SHUTDOWN, set_mask); } regmap_update_bits() requires clr_mask to be a superset of set_mask. So basically all sensors with "wrong" masks like the AS6200 are not initialized as intended. Fix that by - Change the set_mask to 0xc010 to reflect the current active-low setup properly and to drive the sensor in continous mode. This takes into account that the config register is little endian and the first byte sent to the chip is the LSB. - Adapt the alarm handling so it can report the alarm correctly even if it is high active. This is done by comparing config register bit 5 and 10 (translated to 2 and 13). This commit does not introduce any ABI breakage as the mutliple bugs effectly drive the AS6200 in standard active-low mode. Fixes: 4b6358e1fe46 ("hwmon: (lm75) Add AMS AS6200 temperature sensor") Suggested-by: Guenter Roeck Signed-off-by: Markus Stockhausen Link: https://lore.kernel.org/r/20260502173207.3567876-2-markus.stockhausen@gmx.de [groeck: Update set_mask for as6200 further: As modeled, the upper bits contain the conversion rate, so the config register needs to be set to 0xc010 instead of 0x10c0 to reflect 8 samples/s and 4 consecutive faults. Fix the same problem for TMP112.] Signed-off-by: Guenter Roeck commit 22e170e9a37ea2155bdf0bb743483f2d455160ba Merge: 17dd4d44e99046 b29987dfd943e6 Author: Dave Airlie Date: Fri May 8 08:51:01 2026 +1000 Merge tag 'drm-xe-fixes-2026-05-07' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes UAPI Changes: Cross-subsystem Changes: Core Changes: Driver Changes: - Add NULL check for media_gt in intel_hdcp_gsc_check_status (Gustavo) - Fix EAGAIN sign in pf_migration_consume (Shuicheng) - Fix MMIO access using PF view instead of VF view during migration (Shuicheng) - Exclude indirect ring state page from ADS engine state size (Satya) Signed-off-by: Dave Airlie From: Matthew Brost Link: https://patch.msgid.link/afw5lsrjE4pStEml@gsse-cloud1.jf.intel.com commit 17dd4d44e99046a6e1676be8cef13ce85adc0750 Merge: 2c5d5ecda5f165 0a69ac25bd596d Author: Dave Airlie Date: Fri May 8 08:34:34 2026 +1000 Merge tag 'drm-rust-fixes-2026-05-07' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-fixes DRM Rust fixes for v7.1-rc3 - Fix unsound initialization in drm::Device::new(); if pinned initialization of drm::Device::Data fails, make sure drm::Device::release() isn't called, so we don't run the data's destructor - Fix missing GEM state cleanup in the init failure case; call drm_gem_private_object_fini() if drm_gem_object_init() fails - Fix wrong ARef import in the DRM shmem GEM helper abstraction - Replace the nouveau mailing list with the new nova-gpu mailing list for both nova-core and nova-drm, and remove unused patchwork entries Signed-off-by: Dave Airlie From: "Danilo Krummrich" Link: https://patch.msgid.link/DIBZJ40ZC4J3.Y1DLA7JTS2PC@kernel.org commit c562ba61fc5e11798720acc1b172862158f1fa0b Author: Robbie Ko Date: Fri May 1 10:41:56 2026 +0800 btrfs: fix incorrect i_size after remount caused by KEEP_SIZE prealloc gap When fallocate() with FALLOC_FL_KEEP_SIZE preallocates an extent past the current i_size, the file_extent_tree of the inode is updated to cover that range. However, on the next mount, btrfs_read_locked_inode() only re-populates file_extent_tree with [0, round_up(i_size, sectorsize)), losing the marks that belonged to the KEEP_SIZE prealloc extent beyond i_size. Later, when a non-KEEP_SIZE fallocate() extends i_size into / past that old prealloc extent, the reservation loop in btrfs_fallocate() skips already-prealloc segments and does not call into the path that marks the file_extent_tree, so a gap remains inside the file_extent_tree across [old_aligned_i_size, start_of_new_alloc). Then __btrfs_prealloc_file_range() calls btrfs_inode_safe_disk_i_size_write(), which uses find_contiguous_extent_bit() starting at offset 0 to derive disk_i_size. The walk stops at the gap, so disk_i_size ends up smaller than i_size and gets persisted. After the next mount, the file shows the wrong (smaller) size. The following reproducer triggers the problem: $ cat test.sh MNT=/mnt/sdi DEV=/dev/sdi mkdir -p $MNT mkfs.btrfs -f -O ^no-holes $DEV mount $DEV $MNT touch $MNT/file1 # KEEP_SIZE prealloc beyond i_size (i_size stays 0) fallocate -n -o 4M -l 4M $MNT/file1 umount $MNT mount $DEV $MNT # non-KEEP_SIZE fallocate that overlaps the previous prealloc tail # and extends past it fallocate -o 7M -l 2M $MNT/file1 ls -lh $MNT/file1 umount $MNT mount $DEV $MNT ls -lh $MNT/file1 umount $MNT Running the reproducer gives the following result: $ ./test.sh (...) -rw-rw-r-- 1 root root 9.0M May 4 16:35 /mnt/sdi/file1 -rw-rw-r-- 1 root root 7.0M May 4 16:35 /mnt/sdi/file1 The size before the second mount is correct (9M), but after the remount it drops to 7M, i.e. the start of the gap inside file_extent_tree. Fix this in __btrfs_prealloc_file_range() by marking the entire range [round_down(old_i_size, sectorsize), round_up(new_i_size, sectorsize)) in file_extent_tree before updating i_size and calling btrfs_inode_safe_disk_i_size_write(). This ensures the contiguous bit search starting from 0 is not truncated by a stale gap left behind by a previous KEEP_SIZE prealloc that was not restored on inode load. The fix has no effect when the NO_HOLES feature is enabled because btrfs_inode_safe_disk_i_size_write() and btrfs_inode_set_file_extent_range() both take the fast path that directly tracks disk_i_size without consulting file_extent_tree. Fixes: 9ddc959e802b ("btrfs: use the file extent tree infrastructure") Reviewed-by: Filipe Manana Signed-off-by: Robbie Ko [ Minor updates to the change log ] Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 4066c55e109475a06d18a1f127c939d551211956 Author: Qu Wenruo Date: Thu Apr 30 10:37:22 2026 +0930 btrfs: only release the dirty pages io tree after successful writes [WARNING] With extra warning on dirty extent buffers at umount (aka, the next patch in the series), test case generic/388 can trigger the following warning about dirty extent buffers at unmount time: BTRFS critical (device dm-2 state E): emergency shutdown BTRFS error (device dm-2 state E): error while writing out transaction: -30 BTRFS warning (device dm-2 state E): Skipping commit of aborted transaction. BTRFS error (device dm-2 state EA): Transaction 9 aborted (error -30) BTRFS: error (device dm-2 state EA) in cleanup_transaction:2068: errno=-30 Readonly filesystem BTRFS info (device dm-2 state EA): forced readonly BTRFS info (device dm-2 state EA): last unmount of filesystem 4fbf2e15-f941-49a0-bc7c-716315d2777c ------------[ cut here ]------------ WARNING: disk-io.c:3311 at invalidate_and_check_btree_folios+0xfd/0x1ca [btrfs], CPU#8: umount/914368 CPU: 8 UID: 0 PID: 914368 Comm: umount Tainted: G OE 7.1.0-rc1-custom+ #372 PREEMPT(full) 2de38db8d1deae71fde295430a0ff3ab98ccf596 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:invalidate_and_check_btree_folios+0xfd/0x1ca [btrfs] Call Trace: close_ctree+0x52e/0x574 [btrfs d2f0b1cd330d1287e7a9919d112eadfc0e914efd] generic_shutdown_super+0x89/0x1a0 kill_anon_super+0x16/0x40 btrfs_kill_super+0x16/0x20 [btrfs d2f0b1cd330d1287e7a9919d112eadfc0e914efd] deactivate_locked_super+0x2d/0xb0 cleanup_mnt+0xdc/0x140 task_work_run+0x5a/0xa0 exit_to_user_mode_loop+0x123/0x4b0 do_syscall_64+0x243/0x7c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ---[ end trace 0000000000000000 ]--- BTRFS warning (device dm-2 state EA): unable to release extent buffer 30539776 owner 9 gen 9 refs 2 flags 0x7 BTRFS warning (device dm-2 state EA): unable to release extent buffer 30621696 owner 257 gen 9 refs 2 flags 0x7 BTRFS warning (device dm-2 state EA): unable to release extent buffer 30638080 owner 258 gen 9 refs 2 flags 0x7 BTRFS warning (device dm-2 state EA): unable to release extent buffer 30654464 owner 7 gen 9 refs 2 flags 0x7 BTRFS warning (device dm-2 state EA): unable to release extent buffer 30703616 owner 2 gen 9 refs 2 flags 0x7 BTRFS warning (device dm-2 state EA): unable to release extent buffer 30720000 owner 10 gen 9 refs 2 flags 0x7 BTRFS warning (device dm-2 state EA): unable to release extent buffer 30736384 owner 4 gen 9 refs 2 flags 0x7 BTRFS warning (device dm-2 state EA): unable to release extent buffer 30752768 owner 11 gen 9 refs 2 flags 0x7 I'm using a stripped down version, which seems to trigger the warning more reliably: _fsstress_pid="" workload() { dmesg -C mkfs.btrfs -f -K $dev > /dev/null echo 1 > /sys/kernel/debug/clear_warn_once mount $dev $mnt $fsstress -w -n 1024 -p 4 -d $mnt & _fsstress_pid=$! sleep 0 $godown $mnt pkill --echo -PIPE fsstress > /dev/null wait $_fsstress_pid unset _fsstress_pid umount $mnt if dmesg | grep -q "WARNING"; then fail fi } for (( i = 0; i < $runtime; i++ )); do echo "=== $i/$runtime ===" workload done [CAUSE] Inside btrfs_write_and_wait_transaction(), we first try to write all dirty ebs, then wait for them to finish. After that we call btrfs_extent_io_tree_release() to free all extent states from dirty_pages io tree. However if we hit an error from btrfs_write_marked_extent(), then we still call btrfs_extent_io_tree_release() to clear that dirty_pages io tree, which may contain dirty records that we haven't yet submitted. Furthermore, the later transaction cleanup path will utilize that dirty_pages io tree to properly cleanup those dirty ebs, but since it's already empty, no dirty ebs are properly cleaned up, thus will later trigger the warnings inside invalidate_btree_folios(). [FIX] Normally such dirty ebs won't cause problems, as when the iput() is called on the btree inode, the dirty ebs will be forcibly written back, and since the fs is already in an error status, such writeback will not reach disk and finish immediately. But it's still better to get rid of such dirty ebs, if we ended up with dirty ebs but the fs is not in an error status, then such writeback at iput() time will be too late, as all workers are already stopped but writeback will utilize workers, which will lead to NULL pointer dereferences. Instead of unconditionally calling btrfs_extent_io_tree_release(), only call it if btrfs_write_and_wait_transaction() finished successfully, so that @dirty_pages extent io tree is kept untouched for transaction cleanup. CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit c73370c677646e86fc4b1780fb07027bdf847375 Author: Filipe Manana Date: Tue Apr 28 16:58:56 2026 +0100 btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Fixes: a85b46db143f ("btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()") Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4822703b150fc25f7bdb8cf266a482619881a97e Author: Calvin Owens Date: Wed Apr 29 00:10:25 2026 -0700 btrfs: always pass __GFP_NOWARN from add_ra_bio_pages() A build workload newly prints order-0 allocation failures on 7.1-rc1: sh: page allocation failure: order:0 mode:0x14084a(__GFP_HIGHMEM|__GFP_MOVABLE|__GFP_IO|__GFP_KSWAPD_RECLAIM| __GFP_COMP|__GFP_HARDWALL) CPU: 27 UID: 1000 PID: 855540 Comm: sh Not tainted 7.1.0-rc1-llvm-00058-gdca922e019dd #1 PREEMPTLAZY Call Trace: dump_stack_lvl+0x50/0x70 warn_alloc+0xeb/0x100 __alloc_pages_slowpath+0x567/0x5a0 ? filemap_get_entry+0x11a/0x140 __alloc_frozen_pages_noprof+0x249/0x2d0 alloc_pages_mpol+0xe4/0x180 folio_alloc_noprof+0x80/0xa0 add_ra_bio_pages+0x13c/0x4b0 btrfs_submit_compressed_read+0x229/0x300 submit_one_bio+0x9e/0xe0 btrfs_readahead+0x185/0x1a0 [...] (lldb) source list -a add_ra_bio_pages+0x13c .../vmlinux.unstripped add_ra_bio_pages + 316 at .../fs/btrfs/compression.c:454:8 451 452 folio = filemap_alloc_folio(mapping_gfp_constraint(mapping, constraint_gfp), 453 0, NULL); -> 454 if (!folio) 455 break; I can reproduce this consistently by running a memory hog concurrently with a buffered writer on a machine with a very large amount of swap. Commit 7ae37b2c94ed ("btrfs: prevent direct reclaim during compressed readahead") clearly intended to suppress these warnings. But because the mask set in the address_space with mapping_set_gfp_mask() doesn't include __GFP_NOWARN, mapping_gfp_constraint() removes it from constraint_gfp before it is passed to filemap_alloc_folio(). Fix by refactoring the code to add __GFP_NOWARN after the call to mapping_gfp_constraint(). Fixes: 7ae37b2c94ed ("btrfs: prevent direct reclaim during compressed readahead") Signed-off-by: Calvin Owens Reviewed-by: David Sterba Signed-off-by: David Sterba commit fc51cba3ebae67f967120e27162e94cfb8594479 Author: ZhengYuan Huang Date: Wed Mar 25 08:43:39 2026 +0800 btrfs: fix check_chunk_block_group_mappings() to iterate all chunk maps [BUG] A corrupted image with a chunk present in the chunk tree but whose corresponding block group item is missing from the extent tree can be mounted successfully, even though check_chunk_block_group_mappings() is supposed to catch exactly this corruption at mount time. Once mounted, running btrfs balance with a usage filter (-dusage=N or -dusage=min..max) triggers a null-ptr-deref: KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] RIP: 0010:chunk_usage_filter fs/btrfs/volumes.c:3874 [inline] RIP: 0010:should_balance_chunk fs/btrfs/volumes.c:4018 [inline] RIP: 0010:__btrfs_balance fs/btrfs/volumes.c:4172 [inline] RIP: 0010:btrfs_balance+0x2024/0x42b0 fs/btrfs/volumes.c:4604 [CAUSE] The crash occurs because __btrfs_balance() iterates the on-disk chunk tree, finds the orphaned chunk, calls chunk_usage_filter() (or chunk_usage_range_filter()), which queries the in-memory block group cache via btrfs_lookup_block_group(). Since no block group was ever inserted for this chunk, the lookup returns NULL, and the subsequent dereference of cache->used crashes. check_chunk_block_group_mappings() uses btrfs_find_chunk_map() to iterate the in-memory chunk map (fs_info->mapping_tree): map = btrfs_find_chunk_map(fs_info, start, 1); With @start = 0 and @length = 1, btrfs_find_chunk_map() looks for a chunk map that *contains* the logical address 0. If no chunk contains logical address 0, btrfs_find_chunk_map(fs_info, 0, 1) returns NULL immediately and the loop breaks after the very first iteration, having checked zero chunks. The entire verification function is therefore a no-op, and the corrupted image passes the mount-time check undetected. [FIX] Replace the btrfs_find_chunk_map() based loop with a direct in-order walk of fs_info->mapping_tree using rb_first_cached() + rb_next(). This guarantees that every chunk map in the tree is visited regardless of the logical addresses involved. No lock is taken around the traversal. This function is called during mount from btrfs_read_block_groups(), which is invoked from open_ctree() before any background threads (cleaner, transaction kthread, etc.) are started. There are therefore no concurrent writers that could modify mapping_tree at this point. An analogous lockless direct traversal of mapping_tree already exists in fill_dummy_bgs() in the same file. Since we walk the rb-tree directly via rb_entry() without going through btrfs_find_chunk_map(), no reference is taken on each map entry, so the btrfs_free_chunk_map() calls are also removed. Signed-off-by: ZhengYuan Huang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2c5d5ecda5f165c0c064f24b736d585db10098c6 Merge: 7fd2df204f342f aab3d205a08623 Author: Dave Airlie Date: Fri May 8 08:21:32 2026 +1000 Merge tag 'drm-intel-fixes-2026-05-06' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Re-enable ccs modifiers on dg2 (Juha-Pekka Heikkila) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patch.msgid.link/aftSjG1D0-hKISDy@linux commit 363a53749cc483409498e8f6e1525fe081f1d9d2 Author: Tejun Heo Date: Thu May 7 12:09:21 2026 -1000 sched_ext: Drop unused scx_find_sub_sched() stub scx_find_sub_sched()'s only caller, scx_bpf_sub_dispatch(), is gated on CONFIG_EXT_SUB_SCHED. When CONFIG_EXT_SUB_SCHED=n the caller compiles out and the stub becomes dead code, tripping -Wunused-function on randconfigs. Drop the stub. Fixes: 25037af712eb ("sched_ext: Add rhashtable lookup for sub-schedulers") Reported-by: kernel test robot Closes: https://lore.kernel.org/all/202605080556.42PXw8U9-lkp@intel.com/ Signed-off-by: Tejun Heo commit dde2f938d02f2c740d49bb5113dea941f941026a Author: Chen Wandun Date: Thu May 7 18:54:34 2026 +0800 cgroup/cpuset: move PF_EXITING check before __GFP_HARDWALL in cpuset_current_node_allowed() Since prepare_alloc_pages() unconditionally adds __GFP_HARDWALL for the fast path when cpusets are enabled, the __GFP_HARDWALL check in cpuset_current_node_allowed() causes the PF_EXITING escape path to be skipped on the first allocation attempt. This makes it unreachable in the common case, so dying tasks can get stuck in direct reclaim or even trigger OOM while trying to exit, despite being allowed to allocate from any node. Move the PF_EXITING check before __GFP_HARDWALL so that dying tasks can allocate memory from any node to exit quickly, even when cpusets are enabled. Also update the function comment to reflect the actual behavior of prepare_alloc_pages() and the corrected check ordering. Signed-off-by: Chen Wandun Acked-by: Michal Koutný Acked-by: Waiman Long Signed-off-by: Tejun Heo commit 4616a9c36be7e2e051ef53b0e8fd729da0277abf Author: Tejun Heo Date: Thu May 7 11:05:31 2026 -1000 sched_ext: Move scx_error() out of scx_link_sched()'s lock region scx_link_sched() holds scx_sched_lock. The scx_error() calls inside take the same lock through scx_claim_exit() and deadlock. Move them out of the guard. Fixes: 6b4576b09714 ("sched_ext: Reject sub-sched attachment to a disabled parent") Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit f98b48151cc502ada59d9778f0112d21f2586ca3 Author: Michael Bommarito Date: Mon Apr 20 10:47:47 2026 -0400 smb: client: validate dacloffset before building DACL pointers parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd before proving a DACL header fits inside the returned security descriptor. On 32-bit builds a malicious server can return dacloffset near U32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip past the later pointer-based bounds checks. build_sec_desc() and id_mode_to_cifs_acl() can then dereference DACL fields from the wrapped pointer in the chmod/chown rewrite paths. Validate dacloffset numerically before building any DACL pointer and reuse the same helper at the three DACL entry points. Fixes: bc3e9dd9d104 ("cifs: Change SIDs in ACEs while transferring file ownership.") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Michael Bommarito Signed-off-by: Steve French commit 8d09328dfda089675e4c049f3f256064a1d1996b Author: Zisen Ye Date: Wed May 6 11:49:08 2026 +0800 smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory. Link: https://lore.kernel.org/linux-cifs/d998240c-aca9-420d-9dbd-f5ba24af19e0@chenxiaosong.com/ Fixes: ea41367b2a60 ("smb: client: introduce SMB2_OP_QUERY_WSL_EA") Cc: stable@vger.kernel.org Signed-off-by: Zisen Ye Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit d62b8d236fab503c6fec1d3e9a38bea71feaca20 Author: Zisen Ye Date: Sat May 2 18:48:36 2026 +0800 smb/client: fix out-of-bounds read in symlink_data() Since smb2_check_message() returns success without length validation for the symlink error response, in symlink_data() it is possible for iov->iov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer only contains the base SMB2 header (64 bytes), accessing err->ErrorContextCount (at offset 66) or err->ByteCount later in symlink_data() will cause an out-of-bounds read. Link: https://lore.kernel.org/linux-cifs/297d8d9b-adf7-42fd-a1c2-5b1f230032bc@chenxiaosong.com/ Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+") Cc: Stable@vger.kernel.org Signed-off-by: Zisen Ye Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 8cb6fc3231500233ddaf63cb7fd5435008d9ed5f Author: Piyush Sachdeva Date: Thu May 7 22:22:14 2026 +0530 smb: client: Zero-pad short GSS session keys per MS-SMB2 Per MS-SMB2 section 3.2.5.3, Session.SessionKey is the first 16 bytes of the GSS cryptographic key, right-padded with zero bytes if the key is shorter than 16 bytes. SMB2_auth_kerberos() copies the GSS session key from the cifs.upcall response using kmemdup(msg->data, msg->sesskey_len, ...) and stores the GSS-reported length verbatim in ses->auth_key.len. generate_key() reads SMB2_NTLMV2_SESSKEY_SIZE bytes from this buffer when feeding the HMAC-SHA256 KDF for signing key derivation. If a GSS mechanism returns a session key shorter than 16 bytes (e.g. a deprecated single-DES Kerberos enctype with an 8-byte session key), the KDF call performs an out-of-bounds slab read and derives keys that do not match the server, which pads per the spec. Modern KDCs disable short-key enctypes by default, so this is latent rather than reachable in production, but it is still a kernel heap over-read. Allocate auth_key.response with kzalloc() at a length of max(msg->sesskey_len, SMB2_NTLMV2_SESSKEY_SIZE), copy the GSS key in, and rely on kzalloc()'s zero initialization for the spec-mandated padding. Set ses->auth_key.len to the padded length. Larger GSS keys (e.g. the 32-byte aes256-cts-hmac-sha1-96 session key) continue to be stored at their natural length, preserving the FullSessionKey path. Emit a cifs_dbg(VFS, ...) message when a short key is encountered to surface deprecated-enctype usage. NTLMv2 and NTLMSSP code paths produce a 16-byte session key by construction and are unaffected. Signed-off-by: Piyush Sachdeva Signed-off-by: Piyush Sachdeva Signed-off-by: Steve French commit 5be7a0cef3229fb3b63a07c0d289daf752545424 Author: Piyush Sachdeva Date: Thu May 7 22:22:13 2026 +0530 smb: client: Use FullSessionKey for AES-256 encryption key derivation When Kerberos authentication is used with AES-256 encryption (AES-256-CCM or AES-256-GCM), the SMB3 encryption and decryption keys must be derived using the full session key (Session.FullSessionKey) rather than just the first 16 bytes (Session.SessionKey). Per MS-SMB2 section 3.2.5.3.1, when Connection.Dialect is "3.1.1" and Connection.CipherId is AES-256-CCM or AES-256-GCM, Session.FullSessionKey must be set to the full cryptographic key from the GSS authentication context. The encryption and decryption key derivation (SMBC2SCipherKey, SMBS2CCipherKey) must use this FullSessionKey as the KDF input. The signing key derivation continues to use Session.SessionKey (first 16 bytes) in all cases. Previously, generate_key() hardcoded SMB2_NTLMV2_SESSKEY_SIZE (16) as the HMAC-SHA256 key input length for all derivations. When Kerberos with AES-256 provides a 32-byte session key, the KDF for encryption/decryption was using only the first 16 bytes, producing keys that did not match the server's, causing mount failures with sec=krb5 and require_gcm_256=1. Add a full_key_size parameter to generate_key() and pass the appropriate size from generate_smb3signingkey(): - Signing: always SMB2_NTLMV2_SESSKEY_SIZE (16 bytes) - Encryption/Decryption: ses->auth_key.len when AES-256, otherwise 16 Also fix cifs_dump_full_key() to report the actual session key length for AES-256 instead of hardcoded CIFS_SESS_KEY_SIZE, so that userspace tools like Wireshark receive the correct key for decryption. Cc: Reviewed-by: Bharath SM Signed-off-by: Piyush Sachdeva Signed-off-by: Piyush Sachdeva Signed-off-by: Steve French commit fcee7d82f27d6a8b1ddc5bbefda59b4e441e9bc0 Merge: 19cbc75c56c0ed 41ae14071cd7f6 Author: Linus Torvalds Date: Thu May 7 10:32:03 2026 -0700 Merge tag 'net-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from Netfilter, IPsec, Bluetooth and WiFi. Current release - fix to a fix: - ipmr: add __rcu to netns_ipv4.mrt, make sure we hold the RCU lock in all relevant places Current release - new code bugs: - fixes for the recently added resizable hash tables - ipv6: make sure we default IPv6 tunnel drivers to =m now that IPv6 itself is built in - drv: octeontx2-af: fixes for parser/CAM fixes Previous releases - regressions: - phy: micrel: fix LAN8814 QSGMII soft reset - wifi: - cw1200: revert "Fix locking in error paths" - ath12k: fix crash on WCN7850, due to adding the same queue buffer to a list multiple times Previous releases - always broken: - number of info leak fixes - ipv6: implement limits on extension header parsing - wifi: number of fixes for missing bound checks in the drivers - Bluetooth: fixes for races and locking issues - af_unix: - fix an issue between garbage collection and PEEK - fix yet another issue with OOB data - xfrm: esp: avoid in-place decrypt on shared skb frags - netfilter: replace skb_try_make_writable() by skb_ensure_writable() - openvswitch: vport: fix race between tunnel creation and linking leading to invalid memory accesses (type confusion) - drv: amd-xgbe: fix PTP addend overflow causing frozen clock Misc: - sched/isolation: make HK_TYPE_KTHREAD an alias of HK_TYPE_DOMAIN (for relevant IPVS change)" * tag 'net-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (190 commits) net: sparx5: configure serdes for 1000BASE-X in sparx5_port_init() net: sparx5: fix wrong chip ids for TSN SKUs net: stmmac: dwmac-nuvoton: fix NULL pointer dereference in nvt_set_phy_intf_sel() tcp: Fix dst leak in tcp_v6_connect(). ipmr: Call ipmr_fib_lookup() under RCU. net: phy: broadcom: Save PHY counters during suspend net/smc: fix missing sk_err when TCP handshake fails af_unix: Reject SIOCATMARK on non-stream sockets veth: fix OOB txq access in veth_poll() with asymmetric queue counts eth: fbnic: fix double-free of PCS on phylink creation failure net: ethernet: cortina: Drop half-assembled SKB selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl selftests: mptcp: check output: catch cmd errors mptcp: pm: prio: skip closed subflows mptcp: pm: ADD_ADDR rtx: return early if no retrans mptcp: pm: ADD_ADDR rtx: skip inactive subflows mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker mptcp: pm: ADD_ADDR rtx: free sk if last mptcp: pm: ADD_ADDR rtx: always decrease sk refcount mptcp: pm: ADD_ADDR rtx: fix potential data-race ... commit a5fd88a5d63f812422e69682f3cb663d9d7f3e9c Author: Dmitry Torokhov Date: Mon May 4 11:54:46 2026 -0700 Input: atmel_mxt_ts - check mem_size before calculating config memory size In mxt_update_cfg(), the driver calculates the memory size needed to store the configuration as data->mem_size - cfg.start_ofs. If data->mem_size is less than or equal to cfg.start_ofs, this calculation will underflow or result in a zero-size buffer, neither of which is valid for a configuration update. Add a check to return -EINVAL if data->mem_size is too small. While at it, change the types of start_ofs and mem_size in struct mxt_cfg to u16 to match the device address space. Assisted-by: Gemini:gemini-3.1-pro Link: https://patch.msgid.link/20260504185448.4055973-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit baa0210fb6a9dc3882509a9411b6d284d88fe30e Author: Dmitry Torokhov Date: Mon May 4 11:54:45 2026 -0700 Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem When a configuration file provides an object size that is larger than the driver's known mxt_obj_size(object), the driver intends to discard the extra bytes. The loop iterates using for (i = 0; i < size; i++). Inside the loop, the condition to skip processing extra bytes is: if (i > mxt_obj_size(object)) continue; Since i is a 0-based index, the valid indices for the object are 0 through mxt_obj_size(object) - 1. When i == mxt_obj_size(object), the condition evaluates to false, and the code processes the byte instead of discarding it. This causes the code to calculate byte_offset = reg + i - cfg->start_ofs and writes the byte there, overwriting exactly one byte of the adjacent instance or object. Update the boundary check to skip extra bytes correctly by using >=. Fixes: 50a77c658b80 ("Input: atmel_mxt_ts - download device config using firmware loader") Cc: stable@vger.kernel.org Assisted-by: Gemini:gemini-3.1-pro Reviewed-by: Ricardo Ribalda Link: https://patch.msgid.link/20260504185448.4055973-1-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 74d695fd6f9d70df849c555f358ddfd26e2d85bf Author: Uwe Kleine-König (The Capable Hub) Date: Thu May 7 18:00:51 2026 +0200 Input: fm801-gp - simplify initialisation of pci_device_id array Instead of assigning the pci_device_id members using a list (which is hard to read as you need to look at the order of the members in that struct in parallel) use the PCI_VDEVICE() convenience macro to compact the initialisation while improving readability. Also drop trailing zeros that the compiler will care about then. The change doesn't introduce binary changes to the compiled driver, verified on both ARCH=x86 and ARCH=arm64. Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/20260507160051.3315630-2-u.kleine-koenig@baylibre.com Signed-off-by: Dmitry Torokhov commit 41ae14071cd7f6a7770e2fe1f8a0859d4c2c6ba4 Author: Daniel Machon Date: Wed May 6 09:25:39 2026 +0200 net: sparx5: configure serdes for 1000BASE-X in sparx5_port_init() sparx5_port_init() only invokes sparx5_serdes_set() and the associated shadow-device enable and low-speed device switch for SGMII and QSGMII. On any port with a high-speed primary device (DEV5G/DEV10G/DEV25G) configured for 1000BASE-X the serdes is therefore left uninitialized, the DEV2G5 shadow is never enabled, and the port stays pointed at its high-speed device rather than the DEV2G5. The PCS1G block looks healthy in isolation, but no frames reach the link partner. Add 1000BASE-X to the check so the same three steps run. Note: the same issue might apply to 2500BASE-X, but that will, eventually, be addressed in a separate commit. Reported-by: Andrew Lunn Fixes: 946e7fd5053a ("net: sparx5: add port module support") Signed-off-by: Daniel Machon Link: https://patch.msgid.link/20260506-misc-fixes-sparx5-lan969x-v2-4-fb236aa96908@microchip.com Signed-off-by: Jakub Kicinski commit b131dc93f7bf1b1461f5bde0c06c4c2384aa5b58 Author: Daniel Machon Date: Wed May 6 09:25:38 2026 +0200 net: sparx5: fix wrong chip ids for TSN SKUs The TSN SKUs in enum spx5_target_chiptype have incorrect IDs: SPX5_TARGET_CT_7546TSN = 0x47546, SPX5_TARGET_CT_7549TSN = 0x47549, SPX5_TARGET_CT_7552TSN = 0x47552, SPX5_TARGET_CT_7556TSN = 0x47556, SPX5_TARGET_CT_7558TSN = 0x47558, The value read back from the chip is GCB_CHIP_ID_PART_ID, which is a GENMASK(27, 12) field, i.e. at most 16 bits wide. It can never match these IDs, so probing a TSN part fails with a "Target not supported" error. Fix the enum to use the actual 16-bit part IDs returned by the hardware: 0x0546, 0x0549, 0x0552, 0x0556 and 0x0558. Reported-by: Andrew Lunn Fixes: 3cfa11bac9bb ("net: sparx5: add the basic sparx5 driver") Signed-off-by: Daniel Machon Link: https://patch.msgid.link/20260506-misc-fixes-sparx5-lan969x-v2-3-fb236aa96908@microchip.com Signed-off-by: Jakub Kicinski commit 19cbc75c56c0ed4fa3f637e3c41a98895a68dfae Merge: 1e38f888f9f070 06bc7ff0a1e0f2 Author: Linus Torvalds Date: Thu May 7 08:55:15 2026 -0700 Merge tag 'sound-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Again a collection of small fixes, mostly for device-specific ones. The only big LOC is about the removal of pretty old dead code in ab8500 codec driver, while the rest all nice small changes. Core / API: - Fix race in deferred fasync state checks - Fix UMP group filtering in sequencer ASoC: - cs35l56: fixes for driver cleanup and error paths - tas2764/2770: workaround for bogus temperature readings - wm_adsp: fixes for firmware unit tests - amd-yc: more DMI quirks for laptops - Minor fixes for fsl_xcvr and spacemit HD-Audio: - Mute LED and speaker quirks for HP, Lenovo, and Xiaomi laptops USB-audio: - New device-specific quirks (Motu, JBL, AlphaTheta, Razer) - Fix of MIDI2 playback on resume Others: - Firewire-tascam control event fix - Minor cleanups and fixes for sparc/dbri and pcmtest" * tag 'sound-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (28 commits) ASoC: cs35l56: Destroy workqueue in probe error path ASoC: cs35l56: Don't use devres to unregister component ALSA: sparc/dbri: add missing fallthrough ALSA: core: Serialize deferred fasync state checks ALSA: hda/realtek: Add mute LED fixup for HP Pavilion 15-cs1xxx ALSA: seq: Fix UMP group 16 filtering ASoC: wm_adsp_fw_find_test: Clear searched_fw_files in find-by-index test ASoC: wm_adsp_fw_find_test: Redirect wm_adsp_release_firmware_files() ASoC: tas2770: Deal with bogus initial temperature value ASoC: tas2764: Deal with bogus initial temperature register value ALSA: usb-audio: add clock quirk for Motu 1248 ALSA: usb-audio: midi2: Restart output URBs on resume ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx ALSA: usb-audio: Add quirk flags for JBL Pebbles ALSA: firewire-tascam: Do not drop unread control events ALSA: usb-audio: Add quirk flags for AlphaTheta EUPHONIA ASoC: fsl_xcvr: Fix event generation for cached controls ASoC: sdw_utils: avoid the SDCA companion function not supported failure ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table ASoC: cs35l56: Fix out-of-bounds in dev_err() in cs35l56_read_onchip_spkid() ... commit 1e38f888f9f070591e54c690e78f2ff8affa8881 Merge: b3737eac0a0f70 863810d4985ad2 Author: Linus Torvalds Date: Thu May 7 08:46:27 2026 -0700 Merge tag 'platform-drivers-x86-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - Silence unknown board warning for 8D41 (hp-wmi) - Fix uninitialized variable in fan RPM handling (lenovo/wmi-other) - Check min_size also when ACPI does not return an out object (wmi) * tag 'platform-drivers-x86-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: lenovo: wmi-other: Fix uninitialized variable in lwmi_om_hwmon_write() platform/x86: hp-wmi: silence unknown board warning for 8D41 platform/wmi: Fix unchecked min_size in wmidev_invoke_method() commit 2c6821657ce3b3c85f92719ea81ec9f9ff27df11 Author: Peng Fan Date: Mon Apr 27 09:01:48 2026 +0800 soc: imx8m: Fix match data lookup for soc device The i.MX8M soc device is registered via platform_device_register_simple(), so it is not associated with a Device Tree node and the imx8m_soc_driver has no of_match_table. As a result, device_get_match_data() always returns NULL when probing the soc device. Retrieve the match data directly from the machine compatible using of_machine_get_match_data(imx8_soc_match), which provides the correct SoC data. Fixes: 2524b293a59e5 ("soc: imx8m: don't access of_root directly") Signed-off-by: Peng Fan Reviewed-by: Lucas Stach Signed-off-by: Frank Li commit b3737eac0a0f70b2a6b6a872213f0f235624e487 Merge: 8ab992f815d673 ec1fcddb3117d9 Author: Linus Torvalds Date: Thu May 7 08:43:25 2026 -0700 Merge tag 'pmdomain-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - Fix detach procedure for virtual devices in genpd - mediatek: Fix use-after-free in scpsys_get_bus_protection_legacy() * tag 'pmdomain-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() pmdomain: core: Fix detach procedure for virtual devices in genpd commit dedf6c90386d99b878763c183a08b61d3ce4824e Author: Joey Lu Date: Wed May 6 16:46:13 2026 +0800 net: stmmac: dwmac-nuvoton: fix NULL pointer dereference in nvt_set_phy_intf_sel() priv->dev was never initialized after devm_kzalloc() allocates the private data structure. When nvt_set_phy_intf_sel() is later invoked via the phylink interface_select callback, it calls nvt_gmac_get_delay(priv->dev, ...) which dereferences the NULL pointer. Fix this by assigning priv->dev = dev immediately after allocation. Fixes: 4d7c557f58ef ("net: stmmac: dwmac-nuvoton: Add dwmac glue for Nuvoton MA35 family") Signed-off-by: Joey Lu Link: https://patch.msgid.link/20260506084614.192894-2-a0987203069@gmail.com Signed-off-by: Jakub Kicinski commit ecddc523cfdb85b3e132f13e293224ebfdfab564 Author: Kuniyuki Iwashima Date: Wed May 6 07:04:42 2026 +0000 tcp: Fix dst leak in tcp_v6_connect(). If a socket is bound to a wildcard address, tcp_v[46]_connect() updates it with a non-wildcard address based on the route lookup. After bhash2 was introduced in the cited commit, we must call inet_bhash2_update_saddr() to update the bhash2 entry as well. If inet_bhash2_update_saddr() fails, we must release the refcount for dst by ip_route_connect() or ip6_dst_lookup_flow(). While tcp_v4_connect() calls ip_rt_put() in the error path, tcp_v6_connect() does not call dst_release(). Let's call dst_release() when inet_bhash2_update_saddr() fails in tcp_v6_connect(). Fixes: 28044fc1d495 ("net: Add a bhash2 table hashed by port and address") Reported-by: Damiano Melotti Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260506070443.1699879-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 019c892e46544af0ae94ec833f79aa903c837666 Author: Kuniyuki Iwashima Date: Wed May 6 06:59:53 2026 +0000 ipmr: Call ipmr_fib_lookup() under RCU. Yi Lai reported RCU splat in reg_vif_xmit() below. [0] When CONFIG_IP_MROUTE_MULTIPLE_TABLES=n, ipmr_fib_lookup() uses rcu_dereference() without explicit rcu_read_lock(). Although rcu_read_lock_bh() is already held by the caller __dev_queue_xmit(), lockdep requires explicit rcu_read_lock() for rcu_dereference(). Let's move up rcu_read_lock() in reg_vif_xmit() to cover ipmr_fib_lookup(). [0]: WARNING: suspicious RCU usage 7.1.0-rc2-next-20260504-9d0d467c3572 #1 Not tainted ----------------------------- net/ipv4/ipmr.c:329 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz.2.17/1779: #0: ffffffff87896440 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #0: ffffffff87896440 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline] #0: ffffffff87896440 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x239/0x4140 net/core/dev.c:4792 #1: ffff88801a199d18 (_xmit_PIMREG#2){+...}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline] #1: ffff88801a199d18 (_xmit_PIMREG#2){+...}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4795 [inline] #1: ffff88801a199d18 (_xmit_PIMREG#2){+...}-{3:3}, at: __dev_queue_xmit+0x1d5d/0x4140 net/core/dev.c:4865 stack backtrace: CPU: 1 UID: 0 PID: 1779 Comm: syz.2.17 Not tainted 7.1.0-rc2-next-20260504-9d0d467c3572 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x121/0x150 lib/dump_stack.c:120 dump_stack+0x19/0x20 lib/dump_stack.c:129 lockdep_rcu_suspicious+0x15b/0x1f0 kernel/locking/lockdep.c:6878 ipmr_fib_lookup net/ipv4/ipmr.c:329 [inline] reg_vif_xmit+0x2ee/0x3c0 net/ipv4/ipmr.c:540 __netdev_start_xmit include/linux/netdevice.h:5382 [inline] netdev_start_xmit include/linux/netdevice.h:5391 [inline] xmit_one net/core/dev.c:3889 [inline] dev_hard_start_xmit+0x170/0x700 net/core/dev.c:3905 __dev_queue_xmit+0x1df1/0x4140 net/core/dev.c:4871 dev_queue_xmit include/linux/netdevice.h:3423 [inline] packet_xmit+0x252/0x370 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3082 [inline] packet_sendmsg+0x39ad/0x5650 net/packet/af_packet.c:3114 sock_sendmsg_nosec net/socket.c:797 [inline] __sock_sendmsg net/socket.c:812 [inline] ____sys_sendmsg+0xa21/0xba0 net/socket.c:2716 ___sys_sendmsg+0x121/0x1c0 net/socket.c:2770 __sys_sendmsg+0x177/0x220 net/socket.c:2802 __do_sys_sendmsg net/socket.c:2807 [inline] __se_sys_sendmsg net/socket.c:2805 [inline] __x64_sys_sendmsg+0x80/0xc0 net/socket.c:2805 x64_sys_call+0x1d9c/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc1/0x1020 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f37e563ee5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 93 af 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe5caa7fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000005c5fa0 RCX: 00007f37e563ee5d RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 RBP: 00000000005c5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00000000005c5fac R15: 00000000005c5fa0 Fixes: b3b6babf4751 ("ipmr: Free mr_table after RCU grace period.") Reported-by: syzkaller Reported-by: Yi Lai Closes: https://lore.kernel.org/netdev/afrY34dLXNUboevf@ly-workstation/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260506065955.1695753-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 32cd651d14fc72a93703ea2384cb5cd8998523a8 Author: Justin Chen Date: Tue May 5 10:39:26 2026 -0700 net: phy: broadcom: Save PHY counters during suspend The PHY counters can be lost if the PHY is reset during suspend. We need to save the values into the shadow counters or the accounting will be incorrect over multiple suspend and resume cycles. Fixes: 820ee17b8d3b ("net: phy: broadcom: Add support code for reading PHY counters") Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260505173926.2870069-1-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 9032f7676935a13fd402608223d326c5f62da9c0 Author: D. Wythe Date: Wed May 6 09:41:05 2026 +0800 net/smc: fix missing sk_err when TCP handshake fails In smc_connect_work(), when the underlying TCP handshake fails, the error code (rc) must be propagated to sk_err to ensure userspace can correctly retrieve the error status via SO_ERROR. Currently, the code only handles a restricted set of error codes (e.g., EPIPE, ECONNREFUSED). If other errors occurs, such as EHOSTUNREACH, sk_err remains unset (zero). This affects applications that rely on SO_ERROR to determine connect outcome. For example, higher versions of Go's netpoller treats SO_ERROR == 0 combined with a failed getpeername() as a spurious wakeup and re-enters epoll_wait(). Under ET mode, no further edge will be generated since the socket is already in a terminal state, causing the connect to hang indefinitely or until a user-specified timeout, if one is set. Fixes: 50717a37db03 ("net/smc: nonblocking connect rework") Signed-off-by: D. Wythe Reviewed-by: Dust Li Link: https://patch.msgid.link/20260506014105.27093-1-alibuda@linux.alibaba.com Signed-off-by: Jakub Kicinski commit d119775f2bad827edc28071c061fdd4a91f889a5 Author: Jiexun Wang Date: Wed May 6 22:08:23 2026 +0800 af_unix: Reject SIOCATMARK on non-stream sockets SIOCATMARK reports whether the receive queue is at the urgent mark for MSG_OOB. In AF_UNIX, MSG_OOB is supported only for SOCK_STREAM sockets. SOCK_DGRAM and SOCK_SEQPACKET reject MSG_OOB in sendmsg() and recvmsg(), so they should not support SIOCATMARK either. Return -EOPNOTSUPP for non-stream sockets before checking the receive queue. Fixes: 314001f0bf92 ("af_unix: Add OOB support") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Suggested-by: Kuniyuki Iwashima Signed-off-by: Jiexun Wang Signed-off-by: Ren Wei Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260506140825.2987635-1-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski commit fca7401fe37f7abc6e54147ea560f37279231137 Author: Shuhao Fu Date: Tue Apr 28 16:12:38 2026 +0800 ALSA: hda: cs35l41: Put ACPI device on missing physical node acpi_dev_get_first_match_dev() returns a refcounted ACPI device and callers must balance it with acpi_dev_put(). cs35l41_hda_read_acpi() stores the returned ACPI device in cs35l41->dacpi. That reference is normally released by the later probe cleanup or the remove path, but the NULL-check on physdev exits before either of those paths can run. Drop the lookup reference before returning -ENODEV. Fixes: c34b04cc6178 ("ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()") Signed-off-by: Shuhao Fu Tested-by: Simon Trimmer Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260428081238.GA1659932@chcpu16 commit aa2fbece1b07954ef26488c800d126a36a8ab93e Author: Shuhao Fu Date: Tue Apr 28 16:01:39 2026 +0800 ALSA: hda: cs35l56: Put ACPI device after setting companion acpi_dev_get_first_match_dev() returns a refcounted ACPI device and callers are expected to balance it with acpi_dev_put(). When no companion is already attached, cs35l56_hda_read_acpi() looks up an ACPI device and sets it with ACPI_COMPANION_SET(), but leaves the lookup reference held. ACPI_COMPANION_SET() does not take ownership of that reference, so drop it with acpi_dev_put() after attaching the companion. Fixes: 73cfbfa9caea ("ALSA: hda/cs35l56: Add driver for Cirrus Logic CS35L56 amplifier") Signed-off-by: Shuhao Fu Tested-by: Simon Trimmer Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260428080139.GA1649104@chcpu16 commit 08f566e8f83bb70f04ad5aba5be352c490a01c8a Author: Jesper Dangaard Brouer Date: Tue May 5 15:21:53 2026 +0200 veth: fix OOB txq access in veth_poll() with asymmetric queue counts XDP redirect into a veth device (via bpf_redirect()) calls veth_xdp_xmit(), which enqueues frames into the peer's ptr_ring using smp_processor_id() % peer->real_num_rx_queues as the ring index. With an asymmetric veth pair where the peer has fewer TX queues than RX queues, that index can exceed peer->real_num_tx_queues. veth_poll() then resolves peer_txq for the ring via: peer_txq = peer_dev ? netdev_get_tx_queue(peer_dev, queue_idx) : NULL; where queue_idx = rq->xdp_rxq.queue_index. When queue_idx exceeds peer_dev->real_num_tx_queues this is an out-of-bounds (OOB) access into the peer's netdev_queue array, triggering DEBUG_NET_WARN_ON_ONCE in netdev_get_tx_queue(). The normal ndo_start_xmit path is not affected: the stack clamps skb->queue_mapping via netdev_cap_txqueue() before invoking ndo_start_xmit, so rxq in veth_xmit() never exceeds real_num_tx_queues. Fix veth_poll() by clamping: only dereference peer_txq when queue_idx is within bounds, otherwise set it to NULL. The out-of-range rings are fed exclusively via XDP redirect (veth_xdp_xmit), never via ndo_start_xmit (veth_xmit), so the peer txq was never stopped and there is nothing to wake; NULL is the correct fallback. Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260502071828.616C3C19425@smtp.kernel.org/ Fixes: dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops") Signed-off-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/20260505132159.241305-2-hawk@kernel.org Signed-off-by: Paolo Abeni commit a59e45221df82e8a6246c617615c1ccc12e3545d Author: Haichen Feng <2806891994@qq.com> Date: Thu May 7 22:02:42 2026 +0800 platform/x86: hp-wmi: Add support for Victus 16-r0xxx (8BC2) The HP Victus 16-r0xxx (board ID: 8BC2) has the same WMI as other Victus S boards, but requires quirks for correctly switching thermal profile. Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_thermal_params. Testing on board 8BC2 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Signed-off-by: Haichen Feng <2806891994@qq.com> Link: https://patch.msgid.link/tencent_8E29805D8DC7B6005244C3433C62DD9DF606@qq.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 459d75523b71c0ec254d153d8850d0b7008af396 Author: Gyeyoung Baek Date: Sun Apr 19 16:17:16 2026 +0900 drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() dma_resv_wait_timeout() returns a positive 'remaining jiffies' value on success, 0 on timeout, and -errno on failure. panfrost_ioctl_wait_bo() returns this 'long' result from an int-typed ioctl handler, so positive values reach userspace as bogus errors. Explicitly set ret to 0 on the success path. Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver") Cc: stable@vger.kernel.org Signed-off-by: Gyeyoung Baek Reviewed-by: Adrián Larumbe Reviewed-by: Boris Brezillon Reviewed-by: Steven Price Link: https://patch.msgid.link/fe33f82fded7be1c18e2e0eb2db451d5a738cf39.1776581974.git.gye976@gmail.com Signed-off-by: Steven Price commit 74570e12b4705ea11dcdfbfbd0a0b0fdaeff3059 Author: Gyeyoung Baek Date: Sun Apr 19 16:17:15 2026 +0900 accel/rocket: Fix prep_bo ioctl leaking positive return from dma_resv_wait_timeout() dma_resv_wait_timeout() returns a positive 'remaining jiffies' value on success, 0 on timeout, and -errno on failure. rocket_ioctl_prep_bo() returns this 'long' result from an int-typed ioctl handler, so positive values reach userspace as bogus errors. Explicitly set ret to 0 on the success path. Fixes: 525ad89dd904 ("accel/rocket: Add IOCTLs for synchronizing memory accesses") Cc: stable@vger.kernel.org Signed-off-by: Gyeyoung Baek Reviewed-by: Tomeu Vizoso Link: https://patch.msgid.link/c0ebf83b345721701b22d8f5bc41c52c0ecf5e16.1776581974.git.gye976@gmail.com Signed-off-by: Steven Price commit effc0a39b8e0f30670fe24f51e44329d4324e566 Author: Fuad Tabba Date: Fri May 1 12:21:49 2026 +0100 KVM: arm64: Pre-check vcpu memcache for host->guest donate __pkvm_host_donate_guest() flips the host stage-2 PTE for the donated page to a non-valid annotation via host_stage2_set_owner_metadata_locked() and then calls kvm_pgtable_stage2_map() to install the matching guest stage-2 mapping. The map's return value is wrapped in WARN_ON() and otherwise discarded, asserting that the call cannot fail. WARN_ON() at nVHE EL2 panics, so this assertion is only correct if the call genuinely cannot fail. kvm_pgtable_stage2_map() can fail with -ENOMEM even at PAGE_SIZE granularity: the donate path verifies PKVM_NOPAGE for the guest IPA before the map, so the walker must allocate fresh page-table pages from the vcpu memcache, and the host controls the vcpu memcache via the topup interface. An under-provisioned donation request would otherwise turn a recoverable -ENOMEM into a fatal hyp panic. Bound the worst-case walker allocation alongside the existing __host_check_page_state_range() / __guest_check_page_state_range() pre-checks, using the helper introduced for host->guest share. If the vcpu memcache holds fewer pages than kvm_mmu_cache_min_pages(), return -ENOMEM before any state mutation. Fixes: 1e579adca177 ("KVM: arm64: Introduce __pkvm_host_donate_guest()") Assisted-by: Gemini:gemini-3.1-pro review-prompts Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260501112149.2824881-7-tabba@google.com Signed-off-by: Marc Zyngier commit 8234409ffb656970e2f5b29e416f041419980bef Author: Fuad Tabba Date: Fri May 1 12:21:48 2026 +0100 KVM: arm64: Pre-check vcpu memcache for host->guest share __pkvm_host_share_guest() ends with kvm_pgtable_stage2_map() to install the guest stage-2 mapping, after a forward pass that mutates the host vmemmap (sets PKVM_PAGE_SHARED_OWNED and increments host_share_guest_count) for every page in the range. The map's return value is wrapped in WARN_ON() and otherwise discarded, asserting that the call cannot fail. WARN_ON() at nVHE EL2 panics, so this assertion is only correct if the call genuinely cannot fail. kvm_pgtable_stage2_map() can fail with -ENOMEM when the stage-2 walker exhausts the caller's memcache, and the host controls the vcpu memcache via the topup interface, so an under-provisioned share request would otherwise turn a recoverable -ENOMEM into a fatal hyp panic. Bound the worst-case walker allocation in the existing pre-check pass so that kvm_pgtable_stage2_map() cannot fail at the call site, using kvm_mmu_cache_min_pages() -- the same bound host EL1 uses for its own stage-2 maps. If the vcpu memcache holds fewer pages, return -ENOMEM before any state mutation. Fixes: d0bd3e6570ae ("KVM: arm64: Introduce __pkvm_host_share_guest()") Assisted-by: Gemini:gemini-3.1-pro review-prompts Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260501112149.2824881-6-tabba@google.com Signed-off-by: Marc Zyngier commit 5130d450d1488e62e1b5310f41910a3c7320e827 Author: Fuad Tabba Date: Fri May 1 12:21:47 2026 +0100 KVM: arm64: Seed pkvm_ownership_selftest vcpu memcache The hypercall handlers call pkvm_refill_memcache() to top up the hyp_vcpu memcache before invoking __pkvm_host_{share,donate}_guest(). pkvm_ownership_selftest invokes those functions directly with a static selftest_vcpu that has an empty memcache. Seed selftest_vcpu's memcache from the prepopulated selftest pages, leaving the remainder for selftest_vm.pool. Required by the memcache-sufficiency pre-check added in the following patches. Assisted-by: Gemini:gemini-3.1-pro review-prompts Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260501112149.2824881-5-tabba@google.com Signed-off-by: Marc Zyngier commit d4d215e5b81ba5acb17752cab12c514a8062bada Author: Fuad Tabba Date: Fri May 1 12:21:46 2026 +0100 KVM: arm64: Fix __deactivate_fgt macro parameter typo __deactivate_fgt() declares its first parameter as "htcxt" but the body references "hctxt". The parameter is unused; the macro silently captures "hctxt" from the enclosing scope. Both existing callers (__deactivate_traps_hfgxtr() and __deactivate_traps_ich_hfgxtr()) happen to define a local "struct kvm_cpu_context *hctxt", so the macro works by coincidence. A future caller without an "hctxt" local in scope, or naming it differently, would compile but bind to the wrong context. Align the parameter name with the sibling __activate_fgt() macro. The "vcpu" parameter remains unused in the body, kept for API symmetry with __activate_fgt() (which uses it). Fixes: f5a5a406b4b8 ("KVM: arm64: Propagate and handle Fine-Grained UNDEF bits") Assisted-by: Gemini:gemini-3.1-pro review-prompts Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260501112149.2824881-4-tabba@google.com Signed-off-by: Marc Zyngier commit 300fac4cc266b7782d88602b6b6a7faf31ce6405 Author: Fuad Tabba Date: Fri May 1 12:21:45 2026 +0100 KVM: arm64: Guard against NULL vcpu on VHE hyp panic path On VHE, __hyp_call_panic() unconditionally calls __deactivate_traps(vcpu) on the vcpu pointer read from host_ctxt->__hyp_running_vcpu. That pointer is cleared after every guest exit (and is never set when no guest is running), so an unexpected EL2 exception landing in _guest_exit_panic, e.g. via the el2t*_invalid / el2h_irq_invalid vectors - reaches this function with vcpu == NULL. __deactivate_traps() then dereferences vcpu via ___deactivate_traps() -> vserror_state_is_nested() -> vcpu_has_nv() -> vcpu->arch.features, faulting inside the panic handler and obscuring the original failure. The nVHE counterpart (hyp_panic() in arch/arm64/kvm/hyp/nvhe/switch.c) already guards its vcpu-using cleanup with "if (vcpu)"; mirror that here. sysreg_restore_host_state_vhe() does not depend on vcpu and continues to run unconditionally, preserving panic forensics. The trailing panic("...VCPU:%p", vcpu) prints "(null)" safely via printk's %p handling. Fixes: 6a0259ed29bb ("KVM: arm64: Remove hyp_panic arguments") Assisted-by: Gemini:gemini-3.1-pro review-prompts Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260501112149.2824881-3-tabba@google.com Signed-off-by: Marc Zyngier commit d7396a72eae795d7f968fb451237b6ac1616d712 Author: Fuad Tabba Date: Fri May 1 12:21:44 2026 +0100 KVM: arm64: Make EL2 exception entry and exit context-synchronization events SCTLR_EL2.EIS and SCTLR_EL2.EOS control whether exception entry and exit at EL2 are Context Synchronisation Events (CSEs). Per ARM DDI 0487 M.b D24.2.175 (p. D24-9754): - !FEAT_ExS: the bit is RES1, so the entry/exit is unconditionally a CSE. - FEAT_ExS: the reset value is architecturally UNKNOWN; software must set the bit to make the entry/exit a CSE. INIT_SCTLR_EL2_MMU_ON in arch/arm64/include/asm/sysreg.h sets neither bit. KVM/arm64 hot paths rely on ERET from EL2 being a CSE, and on synchronous EL1->EL2 entry being a CSE, to elide explicit ISBs after MSRs to context-switching system registers (HCR_EL2, ZCR_EL2, ptrauth keys, etc.). On FEAT_ExS hardware those reliances are not architecturally backed unless EOS=1 (and, for entry, EIS=1). Until commit 0a35bd285f43 ("arm64: Convert SCTLR_EL2 to sysreg infrastructure"), SCTLR_EL2_RES1 was a hand-rolled mask that included BIT(11) (EOS) and BIT(22) (EIS), so INIT_SCTLR_EL2_MMU_ON was setting both unconditionally. The conversion made SCTLR_EL2_RES1 auto-generated; because the sysreg tooling only models unconditionally-RES1 fields and EIS/EOS are RES1 only when FEAT_ExS is absent, the auto-generated mask is UL(0). The seven other bits dropped from the old mask (positions 4, 5, 16, 18, 23, 28, 29) are unconditionally RES1 in the E2H=0 SCTLR_EL2 layout per DDI 0487 M.b D24.2.175, so dropping them is harmless. EIS and EOS are the only bits whose semantics changed for FEAT_ExS hardware and where the kernel relies on the value being 1. Make the guarantee explicit: include SCTLR_ELx_EIS | SCTLR_ELx_EOS in INIT_SCTLR_EL2_MMU_ON so that EL2 exception entry and exit are unconditionally CSEs regardless of whether FEAT_ExS is implemented. This matches the pairing in arch/arm64/kvm/config.c which treats EIS and EOS together as RES1 under !FEAT_ExS. Fixes: 0a35bd285f43 ("arm64: Convert SCTLR_EL2 to sysreg infrastructure") Reviewed-by: Yuan Yao Assisted-by: Gemini:gemini-3.1-pro review-prompts Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260501112149.2824881-2-tabba@google.com Signed-off-by: Marc Zyngier commit 14473e8c4e97d51eff9b2f384ae696f7a32f182b Author: Srinivas Pandruvada Date: Thu Apr 30 08:11:03 2026 -0700 platform/x86/intel/tpmi/plr: Prevent fault during unbind This driver faults when intel vsec driver is unbound from PCI driver interface. For example: echo 0000:00:03.1 > /sys/bus/pci/drivers/intel_vsec/unbind This is caused by accessing plr->dbgfs_dir after vsec_tpmi driver is removed. Here vsec_tpmi driver is the parent. On unbind, the parent device remove callback is called first which here will remove debugfs interface. Hence plr->dbgfs_dir is no longer valid. Register notifier for TPMI_CORE_EXIT and make this pointer to NULL, so that debugfs_remove_recursive() is not called with bad plr->dbgfs_dir pointer. After notifier is returned the vsec_tpmi driver will call remove debugfs by calling debugfs_remove_recursive(). Fixes: 811f67c51636 ("platform/x86/intel/tpmi: Add new auxiliary driver for performance limits") Signed-off-by: Srinivas Pandruvada Cc: Stable@vger.kernel.org Link: https://patch.msgid.link/20260430151103.1549733-4-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 57c347a2e2473bfb5c1f1132a3209c55efbe640b Author: Srinivas Pandruvada Date: Thu Apr 30 08:11:02 2026 -0700 platform/x86: intel: Add notifiers support In some cases a driver using services of vsec_tpmi driver requires some processing before vsec_tpmi exits. For example a children using debugfs can't use debugfs as this will be deleted by the vsec_tpmi driver. This is the case when unbind using PCI driver interface. In this case the remove callback of vsec_tpmi driver is called first, then remove callback of its children. Add support of blocking chain notifiers support. Notify on successful probe and before clean up in the remove callback. Fixes: 811f67c51636 ("platform/x86/intel/tpmi: Add new auxiliary driver for performance limits") Signed-off-by: Srinivas Pandruvada Cc: Stable@vger.kernel.org Link: https://patch.msgid.link/20260430151103.1549733-3-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ad3bff944c0f4f2e913298a9664391af32f87491 Author: Srinivas Pandruvada Date: Thu Apr 30 08:11:01 2026 -0700 platform/x86: intel: Move debugfs register before creating devices It is possible that the driver handling device is enumerated before registering debugfs. If the driver wants to access debugfs by calling tpmi_get_debugfs_dir(), this will return error in this case. Hence register debugfs before creating devices. Fixes: 811f67c51636 ("platform/x86/intel/tpmi: Add new auxiliary driver for performance limits") Signed-off-by: Srinivas Pandruvada Cc: Stable@vger.kernel.org Link: https://patch.msgid.link/20260430151103.1549733-2-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7602c0ec0bbfd3985d49f4f0cad281c1414008c9 Author: Konrad Dybcio Date: Wed Dec 31 21:51:26 2025 +0530 firmware: psci: Set pm_set_resume/suspend_via_firmware() for SYSTEM_SUSPEND PSCI specification defines the SYSTEM_SUSPEND feature which enables the firmware to implement the suspend to RAM (S2RAM) functionality by transitioning the system to a deeper low power state. When the system enters such state, the power to the peripheral devices might be removed. So the respective device drivers must prepare for the possible removal of the power by performing actions such as shutting down or resetting the device in their system suspend callbacks. The Linux PM framework allows the platform drivers to convey this info to device drivers by calling the pm_set_suspend_via_firmware() and pm_set_resume_via_firmware() APIs. Hence, if the PSCI firmware supports SYSTEM_SUSPEND feature, call the above mentioned APIs in the psci_system_suspend_begin() and psci_system_suspend_enter() callbacks. Signed-off-by: Konrad Dybcio Reviewed-by: Sudeep Holla [mani: reworded the description to be more elaborative] Signed-off-by: Manivannan Sadhasivam Tested-by: Jon Hunter Acked-by: Jon Hunter Acked-by: Lorenzo Pieralisi Signed-off-by: Arnd Bergmann commit d1f29ea139b50c779422db49790f2fd6c0e128f1 Merge: 79524bed532bc7 a6848a50404eef Author: Arnd Bergmann Date: Thu May 7 14:06:53 2026 +0200 Merge tag 'ffa-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm FF-A fixes for v7.1 The updates fix several robustness issues in the FF-A bus and core driver, mostly around notification handling, RxTx buffer sizing, firmware-provided bounds, and cleanup paths. The notification fixes make per-CPU notification work truly per-CPU, avoid running per-vCPU notification handling from IPI context, keep RX buffer release serialized under rx_lock, validate framework notification payload layout before copying from the shared RX buffer, and avoid dereferencing notifier entries after they may have been unregistered. The remaining fixes reject FF-A drivers without an ID table at registration time, avoid freeing an unallocated RX buffer after allocation failure, unregister the FF-A v1.0 bus notifier on teardown, bound register-based PARTITION_INFO_GET descriptor copies, align the stored RxTx buffer size with the size mapped to firmware, and fix sched-recv callback partition lookup on the circular partition list. * tag 'ffa-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Fix sched-recv callback partition lookup firmware: arm_ffa: Snapshot notifier callbacks under lock firmware: arm_ffa: Align RxTx buffer size before mapping firmware: arm_ffa: Validate framework notification message layout firmware: arm_ffa: Keep framework RX release under lock firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0 firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue firmware: arm_ffa: Avoid collapsing NPI work from different CPUs firmware: arm_ffa: Skip free_pages on RX buffer alloc failure firmware: arm_ffa: Check for NULL FF-A ID table while driver registration Signed-off-by: Arnd Bergmann commit 79524bed532bc7acd7d5209a6cdd0a17dbb8e65b Author: Krzysztof Kozlowski Date: Tue May 5 18:58:37 2026 +0800 ARM: realtek: MAINTAINERS: Include pin controller drivers No dedicated maintainers are shown for Realtek SoC pin controllers, except pinctrl subsystem maintainer, which means reduced review and impression of abandoned drivers. Pin controller drivers are essential part of an SoC, so in case of lack of dedicated entry at least cover it by the SoC platform maintainers. Acked-by: Yu-Chun Lin Signed-off-by: Krzysztof Kozlowski Signed-off-by: Yu-Chun Lin Link: https://lore.kernel.org/r/20260505105838.1014771-2-eleanor.lin@realtek.com Signed-off-by: Arnd Bergmann commit 856540ac9b441a8c0e39f1f1787277edc4097c9b Author: Yu-Chun Lin Date: Tue May 5 18:39:53 2026 +0800 MAINTAINERS: Add maintainers for ARM/REALTEK ARCHITECTURE Add James Tai and Yu-Chun Lin as co-maintainers for the ARM/REALTEK ARCHITECTURE to continue supporting Realtek SoCs. Additionally, based on the discussion, move Andreas Färber to a reviewer role and update his email address accordingly. Link: https://lore.kernel.org/lkml/bbabf0f1-99fa-4822-85c8-df76ce89da01@suse.com/ Reviewed-by: Krzysztof Kozlowski Acked-by: James Tai Signed-off-by: Yu-Chun Lin Link: https://lore.kernel.org/r/20260505103955.1010130-2-eleanor.lin@realtek.com Signed-off-by: Arnd Bergmann commit 90d77b30a666049ad24df463f52e5d529c44e8cd Author: Guenter Roeck Date: Tue May 5 21:15:37 2026 +0200 ARM: integrator: Fix early initialization Starting with commit bdb249fce9ad4 ("ARM: integrator: read counter using syscon/regmap"), intcp_init_early calls syscon_regmap_lookup_by_compatible which in turn calls of_syscon_register. This function allocates memory. Since the memory management code has not been initialized at that time, the call always fails. It either returns -ENOMEM or crashes as follows. Unable to handle kernel NULL pointer dereference at virtual address 0000000c when read [0000000c] *pgd=00000000 Internal error: Oops: 5 [#1] ARM Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.15.0-rc5-00026-g5fcc9bf84ee5 #1 PREEMPT Hardware name: ARM Integrator/CP (Device Tree) PC is at __kmalloc_cache_noprof+0xec/0x39c LR is at __kmalloc_cache_noprof+0x34/0x39c ... Call trace: __kmalloc_cache_noprof from of_syscon_register+0x7c/0x310 of_syscon_register from device_node_get_regmap+0xa4/0xb0 device_node_get_regmap from intcp_init_early+0xc/0x40 intcp_init_early from start_kernel+0x60/0x688 start_kernel from 0x0 The crash is seen due to a dereferenced pointer which is not supposed to be NULL but is NULL if the memory management subsystem has not been initialized. The crash is not seen with all versions of gcc. Some versions such as gcc 9.x apparently do not dereference the pointer, presumably if tracing is disabled. The problem has been reproduced with gcc 10.x, 11.x, and 13.x. Either case, if the crash is not seen, the call to syscon_regmap_lookup_by_compatible returns -ENOMEM, and sched_clock_register is never called. Fix the problem by moving the early initialization code into the standard machine initialization code. Fixes: bdb249fce9ad4 ("ARM: integrator: read counter using syscon/regmap") Cc: Linus Walleij Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/20250518164118.3859567-1-linux@roeck-us.net Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20260505-integrator-fixes-v1-1-56ab9aac59db@kernel.org Signed-off-by: Arnd Bergmann commit b94e0e37d1f165a6c991915a8a87365d71281ee5 Merge: 7fd2df204f342f 7e070a14beaf03 Author: Arnd Bergmann Date: Thu May 7 14:00:11 2026 +0200 Merge tag 'renesas-fixes-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes Renesas fixes for v7.1 - Fix SCIF (serial port) clocks on R-Car X5H, - Fix various dtc and dtbs_check warnings. * tag 'renesas-fixes-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: r9a09g056: Add #mux-state-cells to usb20phyrst arm64: dts: renesas: r9a09g057: Add #mux-state-cells to usb2{0,1}phyrst ARM: dts: renesas: rskrza1: Drop superfluous cells ARM: dts: renesas: genmai: Drop superfluous cells ARM: dts: renesas: r7s72100: Add missing unit address to bus node ARM: dts: renesas: r8a7792: Add missing unit address to bus node ARM: dts: renesas: r8a7779: Add missing unit address to bus node ARM: dts: renesas: r8a7778: Add missing unit address to bus node arm64: dts: renesas: rz-smarc-du-adv7513-smarc: Fix missing cells and reg in DU subnode arm64: dts: renesas: rz-smarc-cru-csi-ov5645: Fix missing cells and reg in CSI2 subnode arm64: dts: renesas: salvator-panel: Fix missing cells and reg in DTO arm64: dts: renesas: draak/ebisu-panel: Fix missing cells and reg in DTO arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks Signed-off-by: Arnd Bergmann commit 90dc96c61be35a1f81b56dfc5dcb80d50debbf89 Author: Ayaan Mirza Baig Date: Sat Apr 18 00:46:14 2026 +0000 platform/x86: samsung-galaxybook: Handle ACPI hotkey notifications On Samsung Galaxy Book 5 (SAM0430), the keyboard backlight, microphone mute, and camera block hotkeys do not generate i8042 scancodes. Instead they arrive as ACPI notifications 0x7d, 0x6e, and 0x6f respectively, all of which previously fell through to the default "unknown" warning in galaxybook_acpi_notify(). Add handling for these three events: - 0x7d (Fn+F9, keyboard backlight): schedule the existing kbd_backlight_hotkey_work which cycles brightness. - 0x6e (Fn+F10, microphone mute): emit KEY_MICMUTE via the driver's input device. - 0x6f (Fn+F11, camera block): if block_recording is active use the existing block_recording_hotkey_work; otherwise emit a toggle of SW_CAMERA_LENS_COVER via the driver's input device on models where the block_recording ACPI feature is not supported. Tested on Samsung Galaxy Book 5 (SAM0430) and Samsung Galaxy Book2 Pro (SAM0429). Signed-off-by: Ayaan Mirza Baig Co-developed-by: Joshua Grisham Signed-off-by: Joshua Grisham Link: https://patch.msgid.link/20260418004613.93981-3-ayaanmirzabaig85@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 72d52bac023b376b73277804b24315ea2a49ad1e Author: Ayaan Mirza Baig Date: Sat Apr 18 00:46:13 2026 +0000 platform/x86: samsung-galaxybook: Refactor camera lens cover input device Rename the camera_lens_cover_switch input device to a generic input device which can be used for multiple input events. Move input device allocation and registration into a dedicated galaxybook_input_init() helper which is called early in probe so that the device is available to all features. No functional change. Signed-off-by: Ayaan Mirza Baig Link: https://patch.msgid.link/20260418004613.93981-2-ayaanmirzabaig85@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 918be519c7876329e1b6e2ea1c59f0b75e792dca Author: Cássio Gabriel Date: Thu May 7 00:40:52 2026 -0300 ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans The USB MIDI 2.0 endpoint parser has the same descriptor walking pattern as the legacy MIDI parser. It validates bLength against bNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the remaining bytes in the endpoint-extra scan. A malformed device can therefore make later baAssoGrpTrmBlkID[] reads consume bytes past the walked descriptor. Reject zero-length and overlong descriptors while walking endpoint extras. Fixes: ff49d1df79ae ("ALSA: usb-audio: USB MIDI 2.0 UMP support") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260507-usb-midi-endpoint-scan-bounds-v1-2-329d7348160e@gmail.com Signed-off-by: Takashi Iwai commit d6854daa67be623860f4e1873fd3d3c275aba4ed Author: Cássio Gabriel Date: Thu May 7 00:40:51 2026 -0300 ALSA: usb-audio: Bound MIDI endpoint descriptor scans snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID[], but the descriptor walker can still return a class-specific endpoint descriptor whose bLength exceeds the remaining bytes in the endpoint-extra scan. That leaves later flexible-array reads bounded by bLength, but not by the remaining bytes in the endpoint-extra scan. Stop walking when bLength is zero or extends past the remaining endpoint-extra scan. Fixes: 5c6cd7021a05 ("ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint descriptor") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260507-usb-midi-endpoint-scan-bounds-v1-1-329d7348160e@gmail.com Signed-off-by: Takashi Iwai commit 91892231ae5e638326e7eaa0174de86fac9aa5fd Author: Rámon van Raaij Date: Wed May 6 20:31:18 2026 +0200 ALSA: hda/realtek: Add codec SSID quirk for Lenovo Yoga Pro 9 16IMH9 (17aa:38d5) Some Lenovo Yoga Pro 9 16IMH9 units carry codec SSID 17aa:38d5 instead of 17aa:38d6, which was added in commit 56722cfbb78d ("ALSA: hda/realtek: Add codec SSID quirk for Lenovo Yoga Pro 9 16IMH9"). The corresponding firmware blob TAS2XXX38D5.bin already ships in linux-firmware, and the hardware is otherwise identical: same PCI subsystem ID 17aa:3811 shared with the Legion S7 15IMH05, same TI TAS2781 amplifiers behind ACPI HID TIAS2781, same ALC287_FIXUP_TAS2781_I2C requirement. Add a second HDA_CODEC_QUIRK entry directly above the existing 17aa:38d6 entry so both variants resolve to the correct fixup. Reported and verified on hardware by GitHub user 0xEthamin. Link: https://github.com/ramonvanraaij/yoga9-tas2781-hda/issues/1 Signed-off-by: Rámon van Raaij Link: https://patch.msgid.link/20260506183118.patch1-ramon@vanraaij.eu Signed-off-by: Takashi Iwai commit f040e590c035bfd9553fe79ee9585caf1b14d67b Author: Ashutosh Desai Date: Tue May 5 17:07:12 2026 +0000 nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc_hci_recv_from_llc() and nci_hci_data_received_cb() read packet->header from skb->data at function entry without first checking that the buffer holds at least one byte. A malicious NFC peer can send a 0-byte HCP frame that passes through the SHDLC layer and reaches these functions, causing an out-of-bounds heap read of packet->header. The same 0-byte frame, if queued as a non-final fragment, also causes the reassembly loop to underflow msg_len to UINT_MAX, triggering skb_over_panic() when the reassembled skb is written. Fix this by adding a pskb_may_pull() check at the entry of each function before packet->header is first accessed. The existing pskb_may_pull() checks before the reassembled hcp_skb is cast to struct hcp_packet remain in place to guard the 2-byte HCP message header. Fixes: 8b8d2e08bf0d ("NFC: HCI support") Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support") Cc: stable@vger.kernel.org Reviewed-by: Simon Horman Signed-off-by: Ashutosh Desai Link: https://patch.msgid.link/20260505170712.96560-1-ashutoshdesai993@gmail.com Signed-off-by: David Heidelberg commit 593dfd40a94ca0ab20297ea4629d94268deed0ed Author: Bobby Eshleman Date: Mon May 4 18:42:11 2026 -0700 eth: fbnic: fix double-free of PCS on phylink creation failure fbnic_phylink_create() stores the newly allocated PCS in fbn->pcs and then calls phylink_create(). When phylink_create() fails, the error path correctly destroys the PCS via xpcs_destroy_pcs(), but the caller, fbnic_netdev_alloc(), responds by invoking fbnic_netdev_free() which calls fbnic_phylink_destroy(). That function finds fbn->pcs non-NULL and calls xpcs_destroy_pcs() a second time on the already-freed object, triggering a refcount underflow use-after-free: [ 1.934973] fbnic 0000:01:00.0: Failed to create Phylink interface, err: -22 [ 1.935103] ------------[ cut here ]------------ [ 1.935179] refcount_t: underflow; use-after-free. [ 1.935252] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x59/0x90, CPU#0: swapper/0/1 [ 1.935389] Modules linked in: [ 1.935484] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-virtme-04244-g1f5ffc672165-dirty #1 PREEMPT(lazy) [ 1.935661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 1.935826] RIP: 0010:refcount_warn_saturate+0x59/0x90 [ 1.935931] Code: 44 48 8d 3d 49 f9 a7 01 67 48 0f b9 3a e9 bf 1e 96 00 48 8d 3d 48 f9 a7 01 67 48 0f b9 3a c3 cc cc cc cc 48 8d 3d 47 f9 a7 01 <67> 48 0f b9 3a c3 cc cc cc cc 48 8d 3d 46 f9 a7 01 67 48 0f b9 3a [ 1.936274] RSP: 0000:ffffd0d440013c58 EFLAGS: 00010246 [ 1.936376] RAX: 0000000000000000 RBX: ffff8f39c188c278 RCX: 000000000000002b [ 1.936524] RDX: ffff8f39c004f000 RSI: 0000000000000003 RDI: ffffffff96abab00 [ 1.936692] RBP: ffff8f39c188c240 R08: ffffffff96988e88 R09: 00000000ffffdfff [ 1.936835] R10: ffffffff96878ea0 R11: 0000000000000187 R12: 0000000000000000 [ 1.936970] R13: ffff8f39c0cef0c8 R14: ffff8f39c1ac01c0 R15: 0000000000000000 [ 1.937114] FS: 0000000000000000(0000) GS:ffff8f3ba08b4000(0000) knlGS:0000000000000000 [ 1.937273] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.937382] CR2: ffff8f3b3ffff000 CR3: 0000000172642001 CR4: 0000000000372ef0 [ 1.937540] Call Trace: [ 1.937619] [ 1.937698] xpcs_destroy_pcs+0x25/0x40 [ 1.937783] fbnic_netdev_alloc+0x1e5/0x200 [ 1.937859] fbnic_probe+0x230/0x370 [ 1.937939] local_pci_probe+0x3e/0x90 [ 1.938013] pci_device_probe+0xbb/0x1e0 [ 1.938091] ? sysfs_do_create_link_sd+0x6d/0xe0 [ 1.938188] really_probe+0xc1/0x2b0 [ 1.938282] __driver_probe_device+0x73/0x120 [ 1.938371] driver_probe_device+0x1e/0xe0 [ 1.938466] __driver_attach+0x8d/0x190 [ 1.938560] ? __pfx___driver_attach+0x10/0x10 [ 1.938663] bus_for_each_dev+0x7b/0xd0 [ 1.938758] bus_add_driver+0xe8/0x210 [ 1.938854] driver_register+0x60/0x120 [ 1.938929] ? __pfx_fbnic_init_module+0x10/0x10 [ 1.939026] fbnic_init_module+0x25/0x60 [ 1.939109] do_one_initcall+0x49/0x220 [ 1.939202] ? rdinit_setup+0x20/0x40 [ 1.939304] kernel_init_freeable+0x1b0/0x310 [ 1.939449] ? __pfx_kernel_init+0x10/0x10 [ 1.939560] kernel_init+0x1a/0x1c0 [ 1.939640] ret_from_fork+0x1ed/0x240 [ 1.939730] ? __pfx_kernel_init+0x10/0x10 [ 1.939805] ret_from_fork_asm+0x1a/0x30 [ 1.939886] [ 1.939927] ---[ end trace 0000000000000000 ]--- [ 1.940184] fbnic 0000:01:00.0: Netdev allocation failed Instead of calling fbnic_phylink_destroy(), the prior initialization of netdev should just be unrolled with free_netdev() and clearing fbd->netdev. Clearing fbd->netdev to NULL avoids UAF in init_failure_mode where callers guard by checking !fbd->netdev, such as fbnic_mdio_read_pmd(). These callers remain active even after a failed probe, so fdb->netdev still needs to be cleared. Fixes: d0fe7104c795 ("fbnic: Replace use of internal PCS w/ Designware XPCS") Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260504-fbnic-pcs-fix-v2-1-de45192821d9@meta.com Signed-off-by: Paolo Abeni commit 3051cd060fa496df42954291fa2306ed2eab4ecc Author: Weiming Shi Date: Wed May 6 01:55:11 2026 +0800 i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data->block[0] is validated in i2c_smbus_xfer_emulated() but that check runs too late for tracepoints and is skipped entirely when the adapter provides a native smbus_xfer implementation. This allows user-controlled oversized block lengths to reach tracepoint memcpy calls and driver callbacks unchecked. Add an early validation in __i2c_smbus_xfer() that rejects block transfers whose caller-supplied length is zero or exceeds I2C_SMBUS_BLOCK_MAX before any tracepoint fires or driver callback runs. data->block[0] is filled in by the device on SMBus block reads, so the check is scoped to operations where the length is actually supplied by the caller. This is consistent with the existing -EINVAL convention in the emulated path and protects all downstream consumers at once: the smbus_write tracepoint, all native smbus_xfer driver implementations, and the emulated path. Two distinct bugs are fixed by this change: Bug 1: smbus_write tracepoint OOB (include/trace/events/smbus.h) trace_smbus_write() fires before any validation and copies data->block[0]+1 bytes into a 34-byte event buffer. With block[0]=0xfe the tracepoint copies 255 bytes, overflowing by 221. BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_smbus_write+0x27c/0x530 Read of size 255 at addr ffff88800d98fcf8 by task poc_smbus/91 Call Trace: __asan_memcpy+0x23/0x80 trace_event_raw_event_smbus_write+0x27c/0x530 __i2c_smbus_xfer+0x43a/0xa40 i2c_smbus_xfer+0x19e/0x340 i2cdev_ioctl_smbus+0x38f/0x7f0 i2cdev_ioctl+0x35e/0x680 __x64_sys_ioctl+0x147/0x1e0 do_syscall_64+0xcf/0x15a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Bug 2: i2c-stub I2C_SMBUS_I2C_BLOCK_DATA OOB (drivers/i2c/i2c-stub.c) stub_xfer() implements .smbus_xfer directly and only clamps block[0] against 256-command, not I2C_SMBUS_BLOCK_MAX. With block[0]=0xff and command=0 the loop accesses block[1+i] for i up to 254, far past the 34-byte union. UBSAN: array-index-out-of-bounds in drivers/i2c/i2c-stub.c:223:44 index 34 is out of range for type '__u8 [34]' Call Trace: __ubsan_handle_out_of_bounds+0xd7/0x120 stub_xfer+0x1971/0x198f [i2c_stub] __i2c_smbus_xfer+0x306/0xa40 i2c_smbus_xfer+0x19e/0x340 i2cdev_ioctl_smbus+0x38f/0x7f0 i2cdev_ioctl+0x35e/0x680 __x64_sys_ioctl+0x147/0x1e0 do_syscall_64+0xcf/0x15a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Both traces reproduced on v7.0-rc6+i2c/for-current with KASAN+UBSAN. Fixes: 8a325997d95d ("i2c: Add message transfer tracepoints for SMBUS [ver #2]") Fixes: 4710317891e4 ("i2c-stub: Implement I2C block support") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Signed-off-by: Wolfram Sang commit b15838b03cd0c6cf35651cfde62d17f14bb1d566 Author: Myeonghun Pak Date: Fri Apr 24 21:34:28 2026 +0900 drm/bochs: Drop manual put on probe error path bochs_pci_probe() allocates the DRM device with devm_drm_dev_alloc(), which registers a devres action to drop the initial DRM device reference on driver detach or probe failure. The error path currently calls drm_dev_put() manually. If probe then returns an error, devres will run the registered release action and put the same device again, after the first put may already have released it. Return the probe error directly and let devres own the final put. Signed-off-by: Myeonghun Pak Fixes: 04826f588682 ("drm/bochs: Allocate DRM device in struct bochs_device") Signed-off-by: Thomas Zimmermann Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260424123506.32275-1-mhun512@gmail.com commit 5772f6535227ebd104065d80afa8ed3478d34c5c Author: David Gow Date: Thu Apr 16 14:57:43 2026 +0800 x86/boot/e820: Re-enable BIOS fallback if e820 table is empty In commit: 157266edcc56 ("x86/boot/e820: Simplify append_e820_table() and remove restriction on single-entry tables") the check on the number of entries in the e820 table was removed. The intention was to support single-entry maps, but by removing the check entirely, we also skip the fallback (to, e.g., the BIOS 88h function). This means that if no E820 map is passed in from the bootloader (which is the case on some bootloaders, like linld), we end up with an empty memory map, and the kernel fails to boot (either by deadlocking on OOM, or by failing to allocate the real mode trampoline, or similar). Re-instate the check in append_e820_table(), but only check that nr_entries is non-zero. This allows e820__memory_setup_default() to fall back to other memory size sources, and doesn't affect e820__memory_setup_extended(), as the latter ignores the return value from append_e820_table(). In doing so, we also update the return values to be proper error codes, with -ENOENT for this case (there are no entries), and -EINVAL for the case where an entry appears invalid. Given none of the callers check the actual value -- just whether it's nonzero -- this is largely aesthetic in practice. Tested against linld, and the kernel boots again fine. [ mingo: Readability edits to the comment and the changelog. ] Fixes: 157266edcc56 ("x86/boot/e820: Simplify append_e820_table() and remove restriction on single-entry tables") Signed-off-by: David Gow Signed-off-by: Ingo Molnar Reviewed-by: Andy Shevchenko Cc: stable@vger.kernel.org Cc: Arnd Bergmann Cc: "H. Peter Anvin" Link: https://patch.msgid.link/20260416065746.1896647-1-david@davidgow.net commit 7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4 Author: Maoyi Xie Date: Mon May 4 22:27:36 2026 +0800 xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate() in net/key/af_key.c both hardcode &init_net for the multicast that announces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE. XFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the rest of the xfrm/af_key netlink path was made netns-aware in 2008. The other 14 multicast paths in xfrm_user.c route their event using xs_net(x), xp_net(xp) or sock_net(skb->sk); only the migrate path was missed. Two consequences of the init_net hardcoding: 1. The notification (selector, old/new endpoint addresses, and the km_address) is delivered to listeners on init_net's XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups rather than on the issuing netns. An IKE daemon running in init_net therefore receives migration notifications originating from any other netns on the host. 2. An IKE daemon running inside a non-init netns and subscribed to its own XFRMNLGRP_MIGRATE / pfkey groups never receives the notification of its own migration. IKEv2 MOBIKE / address-update handling inside a netns is silently broken. Thread struct net through km_migrate() and the xfrm_mgr.migrate function pointer, drop the &init_net override in xfrm_send_migrate() and pfkey_send_migrate(), and pass the caller's net (already in scope in xfrm_migrate() via sock_net(skb->sk)) all the way down. struct xfrm_mgr is in-tree only and not exported as a stable API, so the function-pointer signature change is internal. pfkey_broadcast() is already netns-aware via net_generic(net, pfkey_net_id) since the pernet conversion. The five other pfkey_broadcast() callers in af_key.c already pass xs_net(x), sock_net(sk) or a per-netns net, so this only removes the &init_net outlier. Fixes: 5c79de6e79cd ("[XFRM]: User interface for handling XFRM_MSG_MIGRATE") Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Maoyi Xie Signed-off-by: Steffen Klassert commit 8ab992f815d6736b5c7a6f5fd7bfe7bc106bb3dc Merge: b625e47f042745 996454bc0da84d Author: Linus Torvalds Date: Wed May 6 22:02:28 2026 -0700 Merge tag 'v7.1-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix memory leak in connection free - Fix inherited ACL ACE validation - Minor cleanup - Fix for share config - Fix durable handle cleanup race - Fix close_file_table_ids in session teardown - smbdirect fixes: - Fix memory region registration - Two fixes for out-of-tree builds * tag 'v7.1-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: validate inherited ACE SID length ksmbd: fix kernel-doc warnings from ksmbd_conn_get/put() ksmbd: fail share config requests when path allocation fails ksmbd: close durable scavenger races against m_fp_list lookups ksmbd: harden file lifetime during session teardown ksmbd: centralize ksmbd_conn final release to plug transport leak smb: smbdirect: fix MR registration for coalesced SG lists smb: smbdirect: introduce and use include/linux/smbdirect.h smb: smbdirect: make use of DEFAULT_SYMBOL_NAMESPACE and EXPORT_SYMBOL_GPL commit b625e47f04274538e32e99fe6d3dc01edc93d280 Merge: 5862221fddede6 525cb7ba666107 Author: Linus Torvalds Date: Wed May 6 20:44:03 2026 -0700 Merge tag 'chrome-platform-fixes-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome-platform fix from Tzung-Bi Shih: - Fix a NULL dereference in cros_ec_typec * tag 'chrome-platform-fixes-v7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration commit b266bacba796ff5c4dcd2ae2fc08aacf7ab39153 Author: Andreas Haarmann-Thiemann Date: Tue May 5 23:52:17 2026 +0200 net: ethernet: cortina: Drop half-assembled SKB In gmac_rx() (drivers/net/ethernet/cortina/gemini.c), when gmac_get_queue_page() returns NULL for the second page of a multi-page fragment, the driver logs an error and continues — but does not free the partially assembled skb that was being assembled via napi_build_skb() / napi_get_frags(). Free the in-progress partially assembled skb via napi_free_frags() and increase the number of dropped frames appropriately and assign the skb pointer NULL to make sure it is not lingering around, matching the pattern already used elsewhere in the driver. Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Signed-off-by: Andreas Haarmann-Thiemann Signed-off-by: Linus Walleij Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20260505-gemini-ethernet-fix-v2-1-997c31d06079@kernel.org Signed-off-by: Jakub Kicinski commit 2b1f48cc0f31abd1115a8c4b74b6425aba46eae4 Merge: c8f7244c8cccaa 53705ddfa18408 Author: Jakub Kicinski Date: Wed May 6 18:16:49 2026 -0700 Merge branch 'mptcp-pm-misc-fixes-for-v7-1-rc3' Matthieu Baerts says: ==================== mptcp: pm: misc. fixes for v7.1-rc3 Here are various fixes, mainly related to ADD_ADDRs: - Patch 1: save ADD_ADDR for rtx with ID0 when needed. A fix for v6.1. - Patch 2: remove unneeded exception for ID 0. A fix for v5.10. - Patches 3-5: fix potential data-race and leaks during ADD_ADDR rtx. A fix for v5.10. - Patch 6: resched blocked ADD_ADDR rtx after a more appropriated timeout, not after 15 seconds. A fix for v5.10. - Patch 7: skip inactive subflows when when looking at the max RTO. A fix for v6.18. - Patch 8: avoid iterating over all subflows when there is no need to. A fix for v6.18. - Patch 9: skip closed subflows when looking at sending MP_PRIO. A fix for v5.17. - Patch 10: properly catch errors when using check_output() in the selftests. A fix for v6.9. - Patch 11: skip the 'unknown' flag test when 'ip mptcp' is used. A fix for v6.10. ==================== Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-0-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit 53705ddfa18408f8e1f064331b6387509fa19f7f Author: Matthieu Baerts (NGI0) Date: Tue May 5 17:00:59 2026 +0200 selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl When pm_netlink.sh is executed with '-i', 'ip mptcp' is used instead of 'pm_nl_ctl'. IPRoute2 doesn't support the 'unknown' flag, which has only been added to 'pm_nl_ctl' for this specific check: to ensure that the kernel ignores such unsupported flag. No reason to add this flag to 'ip mptcp'. Then, this check should be skipped when 'ip mptcp' is used. Fixes: 0cef6fcac24d ("selftests: mptcp: ip_mptcp option for more scripts") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-11-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit 65db7b27b90e2ea8d4966935aa9a50b6a60c31ac Author: Matthieu Baerts (NGI0) Date: Tue May 5 17:00:58 2026 +0200 selftests: mptcp: check output: catch cmd errors Using '${?}' inside the if-statement to check the returned value from the command that was evaluated as part of the if-statement is not correct: here, '${?}' will be linked to the previous instruction, not the one that is expected here (${cmd}). Instead, simply mark the error, except if an error is expected. If that's the case, 1 can be passed as the 4th argument of this helper. Three checks from pm_netlink.sh expect an error. While at it, improve the error message when the command unexpectedly fails or succeeds. Note that we could expect a specific returned value, but the checks currently expecting an error can be used with 'ip mptcp' or 'pm_nl_ctl', and these two tools don't return the same error code. Fixes: 2d0c1d27ea4e ("selftests: mptcp: add mptcp_lib_check_output helper") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-10-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit 166b78344031bf7ac9f55cb5282776cfd85f220e Author: Matthieu Baerts (NGI0) Date: Tue May 5 17:00:57 2026 +0200 mptcp: pm: prio: skip closed subflows When sending an MP_PRIO, closed subflows need to be skipped. This fixes the case where the initial subflow got closed, re-opened later, then an MP_PRIO is needed for the same local address. Note that explicit MP_PRIO cannot be sent during the 3WHS, so it is fine to use __mptcp_subflow_active(). Fixes: 067065422fcd ("mptcp: add the outgoing MP_PRIO support") Cc: stable@vger.kernel.org Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation") Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-9-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit 62a9b19dce77e72426f049fb99b9d1d032b9a8ea Author: Matthieu Baerts (NGI0) Date: Tue May 5 17:00:56 2026 +0200 mptcp: pm: ADD_ADDR rtx: return early if no retrans No need to iterate over all subflows if there is no retransmission needed. Exit early in this case then. Fixes: 30549eebc4d8 ("mptcp: make ADD_ADDR retransmission timeout adaptive") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-8-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit c6d395e2de1306b5fef0344a3c3835fbbfaa18be Author: Matthieu Baerts (NGI0) Date: Tue May 5 17:00:55 2026 +0200 mptcp: pm: ADD_ADDR rtx: skip inactive subflows When looking at the maximum RTO amongst the subflows, inactive subflows were taken into account: that includes stale ones, and the initial one if it has been already been closed. Unusable subflows are now simply skipped. Stale ones are used as an alternative: if there are only stale ones, to take their maximum RTO and avoid to eventually fallback to net.mptcp.add_addr_timeout, which is set to 2 minutes by default. Fixes: 30549eebc4d8 ("mptcp: make ADD_ADDR retransmission timeout adaptive") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-7-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit 3cf12492891c4b5ff54dda404a2de4ec54c9e1b5 Author: Matthieu Baerts (NGI0) Date: Tue May 5 17:00:54 2026 +0200 mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker When an ADD_ADDR needs to be retransmitted and another one has already been prepared -- e.g. multiple ADD_ADDRs have been sent in a row and need to be retransmitted later -- this additional retransmission will need to wait. In this case, the timer was reset to TCP_RTO_MAX / 8, which is ~15 seconds. This delay is unnecessary long: it should just be rescheduled at the next opportunity, e.g. after the retransmission timeout. Without this modification, some issues can be seen from time to time in the selftests when multiple ADD_ADDRs are sent, and the host takes time to process them, e.g. the "signal addresses, ADD_ADDR timeout" MPTCP Join selftest, especially with a debug kernel config. Note that on older kernels, 'timeout' is not available. It should be enough to replace it by one second (HZ). Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-6-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit b7b9a461569734d33d3259d58d2507adfac107ed Author: Matthieu Baerts (NGI0) Date: Tue May 5 17:00:53 2026 +0200 mptcp: pm: ADD_ADDR rtx: free sk if last When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on "itself". Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-5-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit 9634cb35af17019baec21ca648516ce376fa10e6 Author: Matthieu Baerts (NGI0) Date: Tue May 5 17:00:52 2026 +0200 mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as "unlikely". Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-4-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit 5cd6e0ad79d2615264f63929f8b457ad97ae550d Author: Matthieu Baerts (NGI0) Date: Tue May 5 17:00:51 2026 +0200 mptcp: pm: ADD_ADDR rtx: fix potential data-race This mptcp_pm_add_timer() helper is executed as a timer callback in softirq context. To avoid any data races, the socket lock needs to be held with bh_lock_sock(). If the socket is in use, retry again soon after, similar to what is done with the keepalive timer. Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-3-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit 03f324f3f1f7619a47b9c91282cb12775ab0a2f1 Author: Matthieu Baerts (NGI0) Date: Tue May 5 17:00:50 2026 +0200 mptcp: pm: ADD_ADDR rtx: allow ID 0 ADD_ADDR can be sent for the ID 0, which corresponds to the local address and port linked to the initial subflow. Indeed, this address could be removed, and re-added later on, e.g. what is done in the "delete re-add signal" MPTCP Join selftests. So no reason to ignore it. Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-2-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit b12014d2d36eaed4e4bec5f1ac7e91110eeb100d Author: Matthieu Baerts (NGI0) Date: Tue May 5 17:00:49 2026 +0200 mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 When adding the ADD_ADDR to the list, the address including the IP, port and ID are copied. On the other hand, when the endpoint corresponds to the one from the initial subflow, the ID is set to 0, as specified by the MPTCP protocol. The issue is that the ID was reset after having copied the ID in the ADD_ADDR entry. So the retransmission was done, but using a different ID than the initial one. Fixes: 8b8ed1b429f8 ("mptcp: pm: reuse ID 0 after delete and re-add") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-1-fca8091060a4@kernel.org Signed-off-by: Jakub Kicinski commit c8f7244c8cccaaed4e6c9fe4b8a07e101d0423e5 Author: Eric Dumazet Date: Tue May 5 15:39:27 2026 +0000 tcp: tcp_child_process() related UAF tcp_child_process( .. child ...) currently calls sock_put(child). Unfortunately @child (named @nsk in callers) can be used after this point to send a RST packet. To fix this UAF, I remove the sock_put() from tcp_child_process() and let the callers handle this after it is safe. Remove @rsk variable in tcp_v4_do_rcv() and change tcp_v6_do_rcv() so that both functions look the same. Fixes: cfb6eeb4c860 ("[TCP]: MD5 Signature Option (RFC2385) support.") Reported-by: Damiano Melotti Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260505153927.3435532-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 770b136ff9bf3e319d19875da59c4f7f4853da3a Author: Eric Dumazet Date: Tue May 5 09:11:33 2026 +0000 net/sched: sch_sfq: annotate data-races from sfq_dump_class_stats() sfq_dump_class_stats() runs locklessly, add needed READ_ONCE() and WRITE_ONCE() annotations. Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260505091133.2452510-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 67ef49047d312be692c8c439145f4514174e517f Author: Eric Dumazet Date: Tue May 5 13:32:33 2026 +0000 inetpeer: add a missing read_seqretry() in inet_getpeer() When performing a lockless lookup over the inet_peer rbtree, if a matching node is found, inet_getpeer() returns it immediately without validating the seqlock sequence. This missing check introduces a race condition: Trigger Path: When a host receives an incoming fragmented IPv4 packet, ip4_frag_init() (in net/ipv4/ip_fragment.c) calls inet_getpeer_v4() to track the peer. The Race: If the packet is from a new source IP, CPU A acquires the write_seqlock, allocates a new inet_peer node (p), sets its IP address (daddr), and links it to the rbtree (rb_link_node). Uninitialized Access: Due to the lack of memory barriers between rb_link_node and the initialization of the rest of the struct (like refcount_set(&p->refcnt, 1)), CPU A can make the node visible to readers before its refcnt is initialized. This is especially true on weakly-ordered architectures like ARM64 where the CPU can reorder the memory stores. Lockless Reader: Concurrently, CPU B processes a second fragmented packet from the same source IP. CPU B does a lockless lookup, finds the newly inserted node, and returns it immediately. Use-After-Free (UAF): CPU B reads p->refcnt as uninitialized garbage (left over from previous kmalloc-128/192 allocations). If the garbage is > 0, refcount_inc_not_zero(&p->refcnt) succeeds. CPU A then executes refcount_set(&p->refcnt, 1), overwriting CPU B's increment. When CPU B finishes with the fragment queue, it calls inet_putpeer(), which drops the refcount to 0 and frees the node via RCU. The node is now freed but remains linked in the rbtree, resulting in a Use-After-Free in the rbtree. Fixes: b145425f269a ("inetpeer: remove AVL implementation in favor of RB tree") Reported-by: Damiano Melotti Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260505133233.3039575-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 701ea57feaabdea403cf299ee5cd0445083bc0ac Author: Shitalkumar Gandhi Date: Tue May 5 18:02:36 2026 +0530 net: rtsn: fix mdio_node leak in rtsn_mdio_alloc() of_get_child_by_name() takes a reference. The rtsn_reset() and rtsn_change_mode() failure paths jump to out_free_bus and leak mdio_node. Add out_put_node to drop it before falling through. Fixes: b0d3969d2b4d ("net: ethernet: rtsn: Add support for Renesas Ethernet-TSN") Signed-off-by: Shitalkumar Gandhi Reviewed-by: Geert Uytterhoeven Reviewed-by: Andrew Lunn Reviewed-by: Niklas Söderlund Link: https://patch.msgid.link/20260505123236.406000-1-shitalkumar.gandhi@cambiumnetworks.com Signed-off-by: Jakub Kicinski commit e4182739363b32c33012daf3b77a8cab3cd160be Merge: 7aaa8f5e45a926 07bdec3fc737aa Author: Jakub Kicinski Date: Wed May 6 17:39:22 2026 -0700 Merge branch 'netdevsim-psp-fix-init-and-uninit-bugs' Daniel Zahka says: ==================== netdevsim: psp: fix init and uninit bugs This series has three fixes. The first is a straightforward NULL pointer dereference that is reachable by creating and destroying some vfs on a kernel with INET_PSP enabled. The last two patches deal with nsim_psp_rereg_write(), which is a debugfs handler that reregisters netdevsim's psp_dev without aquiescing and disabling tx/rx processing. This was added to enable some tests in psp.py where a psp device is unregistered while it still referenced by tcp socket state. There are two issues with this code: 1. Calls to nsim_psp_uninit() are not properly serialized 2. netdevsim's psp_dev refcount can be released while nsim_do_psp() is reading from it. ==================== Link: https://patch.msgid.link/20260505-psd-rcu-v1-0-a8f69ec1ab96@gmail.com Signed-off-by: Jakub Kicinski commit 07bdec3fc737aac7f4c273aafa803d353174c43e Author: Daniel Zahka Date: Tue May 5 03:42:25 2026 -0700 netdevsim: psp: rcu protect psp_dev reference There are two issues with the way psp_dev is used in nsim_do_psp(): 1. There is no check for IS_ERR() on the peers psp_dev, before dereferencing. 2. The refcount on this psp_dev can be dropped by nsim_psp_rereg_write() To fix this, we can make netdevsim's reference to its psp_dev an rcu reference, and then nsim_do_psp() can read the fields it needs from an rcu critical section. Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation") Signed-off-by: Daniel Zahka Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260505-psd-rcu-v1-3-a8f69ec1ab96@gmail.com Signed-off-by: Jakub Kicinski commit 24c96a42006ee27a078ec8c631c906dea8a3ca6d Author: Daniel Zahka Date: Tue May 5 03:42:24 2026 -0700 netdevsim: psp: serialize calls to nsim_psp_uninit() The debugfs write handler, nsim_psp_rereg_write(), can race against nsim_destroy() and against itself, causing nsim_psp_uninit() to run more than once concurrently. Two complementary changes serialize all callers: 1. Delete the psp_rereg debugfs file from nsim_psp_uninit() before doing the actual teardown. debugfs_remove() drains any in-flight writers and prevents new ones from starting. 2. Add a mutex around the body of nsim_psp_rereg_write() so that two concurrent userspace writers cannot both enter the teardown path at once. The teardown work itself is moved into a new __nsim_psp_uninit() that the rereg handler calls under the mutex, while the public nsim_psp_uninit() wraps it with the debugfs_remove()/mutex_destroy() pair so nsim_destroy() doesn't have to know about the psp internals. Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation") Signed-off-by: Daniel Zahka Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260505-psd-rcu-v1-2-a8f69ec1ab96@gmail.com Signed-off-by: Jakub Kicinski commit 7ce3f1bedaac88880594720ba0f687da3bd7fc8a Author: Daniel Zahka Date: Tue May 5 03:42:23 2026 -0700 netdevsim: psp: only call nsim_psp_uninit() on PFs VFs go through nsim_init_netdevsim_vf() which never calls nsim_psp_init(), so ns->psp.dev stays NULL. nsim_psp_uninit() guards with !IS_ERR(ns->psp.dev), so destroying a VF reaches psp_dev_unregister(NULL) and dereferences NULL on the first mutex_lock(&psd->lock): BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:mutex_lock+0x1c/0x30 Call Trace: psp_dev_unregister+0x2a/0x1a0 nsim_psp_uninit+0x1f/0x40 [netdevsim] nsim_destroy+0x61/0x1e0 [netdevsim] __nsim_dev_port_del+0x47/0x90 [netdevsim] nsim_drv_configure_vfs+0xc9/0x130 [netdevsim] nsim_bus_dev_numvfs_store+0x79/0xb0 [netdevsim] Gate nsim_psp_uninit() on nsim_dev_port_is_pf(), matching the pattern already used for nsim_exit_netdevsim() and the bpf/ipsec/macsec/queue teardowns. Reproducer: modprobe netdevsim echo "10 1" > /sys/bus/netdevsim/new_device echo 1 > /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs devlink dev eswitch set netdevsim/netdevsim10 mode switchdev echo 0 > /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation") Signed-off-by: Daniel Zahka Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260505-psd-rcu-v1-1-a8f69ec1ab96@gmail.com Signed-off-by: Jakub Kicinski commit 7aaa8f5e45a92678256c1e17f1fa2c2f45c61dd1 Author: Eric Dumazet Date: Tue May 5 13:00:56 2026 +0000 ipv6: fix potential UAF caused by ip6_forward_proxy_check() ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate skb->head. Reload ipv6_hdr() after the pskb_may_pull() call to avoid using the freed memory. Fixes: e21e0b5f19ac ("[IPV6] NDISC: Handle NDP messages to proxied addresses.") Reported-by: Damiano Melotti Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260505130056.2927197-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 0e1368a28dd5231ae0dbe240dfe0ff2657de5647 Author: Jakub Kicinski Date: Wed May 6 17:22:05 2026 -0700 selftests: drv-net: fix sort order of makefile and config Recent changes added configs and tests in the wrong spot. Link: https://lore.kernel.org/20260506170435.34984dfc@kernel.org Signed-off-by: Jakub Kicinski commit dc61989e37726e0ff3d669e6ad94e62b97149329 Merge: f4eac70d1e0c1f f4c50a4034e62a Author: Jakub Kicinski Date: Wed May 6 16:49:41 2026 -0700 Merge tag 'ipsec-2026-05-05' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2026-05-05 1. Fix an IPv6 encapsulation error path that leaked route references when UDPv6 ESP decapsulation resolved to an error route. From Yilin Zhu. 2. Fix AH with ESN on async crypto paths by accounting for the extra high-order sequence number when reconstructing the temporary authentication layout in the completion callbacks. From Michael Bomarito. 3. Fix XFRM output so it does not overwrite already-correct inner header pointers when a tunnel layer such as VXLAN has already saved them. The fix comes with new selftests. From Cosmin Ratiu. 4. Add the missing native payload size entry for XFRM_MSG_MAPPING in the compat translation path. From Ruijie Li. 5. Harden __xfrm_state_delete() against repeated or inconsistent unhashing of state list nodes by keying the removal on actual list membership and using delete-and-init helpers. From Michal Kosiorek. 6. Prevent ESP from decrypting shared splice-backed skb fragments in place by marking UDP splice frags as shared and forcing copy-on-write in ESP input when needed. From Kuan-Ting Chen. * tag 'ipsec-2026-05-05' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: esp: avoid in-place decrypt on shared skb frags xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete xfrm: provide message size for XFRM_MSG_MAPPING xfrm: Don't clobber inner headers when already set tools/selftests: Add a VXLAN+IPsec traffic test tools/selftests: Use a sensible timeout value for iperf3 client xfrm: ah: account for ESN high bits in async callbacks ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() ==================== Link: https://patch.msgid.link/20260505132326.1362733-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit f4eac70d1e0c1fb6b3b4743ff12753c9fedb88e4 Merge: bd75e1003d3ec2 201ba706318d46 Author: Jakub Kicinski Date: Wed May 6 16:10:02 2026 -0700 Merge tag 'ovpn-net-20260504' of https://github.com/OpenVPN/ovpn-net-next Antonio Quartulli says: ==================== Includes changes: * ensure MAC header offset is reset before delivering packet * ensure gro_cells_receive() and dstats_dev_add() are called with BH disabled * reduce ping count in selftest to ensure it completes within timeout * tag 'ovpn-net-20260504' of https://github.com/OpenVPN/ovpn-net-next: selftests: ovpn: reduce ping count in test.sh ovpn: ensure packet delivery happens with BH disabled ovpn: reset MAC header before passing skb up ==================== Link: https://patch.msgid.link/20260504230305.2681646-1-antonio@openvpn.net Signed-off-by: Jakub Kicinski commit bd75e1003d3ec295fcadca62ee5a4280a22c7e29 Merge: b89e0100a5f688 c5d415596cb6fb Author: Jakub Kicinski Date: Wed May 6 15:43:33 2026 -0700 Merge tag 'for-net-2026-05-06' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_conn: fix potential UAF in create_big_sync - hci_event: fix memset typo - hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt - L2CAP: fix MPS check in l2cap_ecred_reconf_req - L2CAP: defer conn param update to avoid conn->lock/hdev->lock inversion - L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() - L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - RFCOMM: pull credit byte with skb_pull_data() - SCO: fix sleeping under spinlock in sco_conn_ready - SCO: hold sk properly in sco_conn_ready - ISO: Fix data-race on dst in iso_sock_connect() - ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths - bnep: fix incorrect length parsing in bnep_rx_frame() extension handling - hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized - virtio_bt: clamp rx length before skb_put - virtio_bt: validate rx pkt_type header length - HIDP: serialise l2cap_unregister_user via hidp_session_sem - btintel_pcie: treat boot stage bit 12 as warning - btmtk: validate WMT event SKB length before struct access * tag 'for-net-2026-05-06' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem Bluetooth: hci_event: fix memset typo Bluetooth: RFCOMM: pull credit byte with skb_pull_data() Bluetooth: virtio_bt: validate rx pkt_type header length Bluetooth: virtio_bt: clamp rx length before skb_put Bluetooth: btmtk: validate WMT event SKB length before struct access Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized Bluetooth: btintel_pcie: treat boot stage bit 12 as warning Bluetooth: SCO: hold sk properly in sco_conn_ready Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Bluetooth: l2cap: defer conn param update to avoid conn->lock/hdev->lock inversion Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Bluetooth: hci_conn: fix potential UAF in create_big_sync Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready ==================== Link: https://patch.msgid.link/20260506204553.58686-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit c5d415596cb6fbdf6334b06cc87a1a5a268d8725 Author: Michael Bommarito Date: Sat May 2 12:43:03 2026 -0400 Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem Commit dbf666e4fc9b ("Bluetooth: HIDP: Fix possible UAF") made hidp_session_remove() drop the L2CAP reference and set session->conn = NULL once the session is considered removed, and added a bare if (session->conn) guard around the kthread-exit l2cap_unregister_user() call in hidp_session_thread(). The sibling ioctl site in hidp_connection_del() still reads session->conn unlocked and unguarded, and the kthread-exit guard itself is a lockless double-read. hidp_session_find() drops hidp_session_sem before returning, so hidp_session_remove() can null session->conn between the lookup and the call in hidp_connection_del(). Worse, since commit 752a6c9596dd ("Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user") takes mutex_lock(&conn->lock) inside l2cap_unregister_user(), a stale non-NULL snapshot also UAFs on conn->lock. v1 only added an if (session->conn) guard at the ioctl site, which doesn't address either race; Luiz suggested snapshotting session->conn under the sem and clearing it before the call. Taking hidp_session_sem across l2cap_unregister_user() would be wrong: l2cap_conn_del() already establishes the lock order conn->lock -> hidp_session_sem via l2cap_unregister_all_users() -> user->remove == hidp_session_remove(), so taking hidp_session_sem before conn->lock would AB/BA deadlock. Factor a helper hidp_session_unregister_conn() that under down_write(&hidp_session_sem) snapshots session->conn and clears the member, then outside the sem calls l2cap_unregister_user() and l2cap_conn_put() on the snapshot. Call it from both hidp_connection_del() and hidp_session_thread()'s exit path. At most one consumer wins the write-sem; later callers observe session->conn == NULL and skip the unregister and put, so the reference hidp_session_new() took via l2cap_conn_get() is consumed exactly once. session_free() already tolerates a NULL session->conn. Fixes: dbf666e4fc9b ("Bluetooth: HIDP: Fix possible UAF") Suggested-by: Luiz Augusto von Dentz Link: https://lore.kernel.org/all/20260422011437.176643-1-michael.bommarito@gmail.com/ Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Luiz Augusto von Dentz commit 72d97cae2a83cecf6f47208646675ecd066d0a3e Author: Jann Horn Date: Wed Apr 29 15:40:46 2026 +0200 Bluetooth: hci_event: fix memset typo hci_le_big_sync_established_evt() currently does: conn->num_bis = 0; memset(conn->bis, 0, sizeof(conn->num_bis)); sizeof(conn->num_bis) is wrong - it would make sense to either use conn->num_bis (before setting that to 0) or sizeof(conn->bis). Fix it by using sizeof(conn->bis), the least intrusive change. Luckily, nothing actually depends on this memset() working properly: Nothing seems to ever read from conn->bis beyond conn->num_bis, and when conn->num_bis is increased, the corresponding elements of conn->bis are initialized. So I think this line could also just be removed. This is a purely theoretical fix and should have no impact on actual behavior. Fixes: 42ecf1947135 ("Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending") Signed-off-by: Jann Horn Signed-off-by: Luiz Augusto von Dentz commit 8f59d17b18a78fdfdbb67d693b3d3eb03db184e0 Author: Pengpeng Hou Date: Thu Apr 23 23:31:00 2026 +0800 Bluetooth: RFCOMM: pull credit byte with skb_pull_data() rfcomm_recv_data() treats the first payload byte as a credit field when the UIH frame carries PF and credit-based flow control is enabled. After the header has been stripped, the PF/CFC path consumes that byte with a direct skb->data dereference followed by skb_pull(). A malformed short frame can reach this path without a byte available. Use skb_pull_data() so the length check and pull happen together before the returned credit byte is consumed. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Pengpeng Hou Signed-off-by: Luiz Augusto von Dentz commit daf23014e5d975e72ea9c02b5160d3fcf070ea47 Author: Michael Bommarito Date: Tue Apr 21 13:08:45 2026 -0400 Bluetooth: virtio_bt: validate rx pkt_type header length virtbt_rx_handle() reads the leading pkt_type byte from the RX skb and forwards the remainder to hci_recv_frame() for every event/ACL/SCO/ISO type, without checking that the remaining payload is at least the fixed HCI header for that type. After the preceding patch bounds the backend-supplied used.len to [1, VIRTBT_RX_BUF_SIZE], a one-byte completion still reaches hci_recv_frame() with skb->len already pulled to 0. If the byte happened to be HCI_ACLDATA_PKT, the ACL-vs-ISO classification fast-path in hci_dev_classify_pkt_type() dereferences hci_acl_hdr(skb)->handle whenever the HCI device has an active CIS_LINK, BIS_LINK, or PA_LINK connection, reading two bytes of uninitialized RX-buffer data. The same hazard exists for every packet type the driver accepts because none of the switch cases in virtbt_rx_handle() check skb->len against the per-type minimum HCI header size before handing the frame to the core. After stripping pkt_type, require skb->len to cover the fixed header size for the selected type (event 2, ACL 4, SCO 3, ISO 4) before calling hci_recv_frame(); drop ratelimited otherwise. Unknown pkt_type values still take the original kfree_skb() default path. Use bt_dev_err_ratelimited() because both the length and pkt_type values come from an untrusted backend that can otherwise flood the kernel log. Fixes: 160fbcf3bfb9 ("Bluetooth: virtio_bt: Use skb_put to set length") Cc: stable@vger.kernel.org Cc: Soenke Huster Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Luiz Augusto von Dentz commit 21bd244b6de5d2fe1063c23acc93fbdd2b20d112 Author: Michael Bommarito Date: Tue Apr 21 13:08:44 2026 -0400 Bluetooth: virtio_bt: clamp rx length before skb_put virtbt_rx_work() calls skb_put(skb, len) where len comes directly from virtqueue_get_buf() with no validation against the buffer we posted to the device. The RX skb is allocated in virtbt_add_inbuf() and exposed to virtio as exactly 1000 bytes via sg_init_one(). Checking len against skb_tailroom(skb) is not sufficient because alloc_skb() can leave more tailroom than the 1000 bytes actually handed to the device. A malicious or buggy backend can therefore report used.len between 1001 and skb_tailroom(skb), causing skb_put() to include uninitialized kernel heap bytes that were never written by the device. The same path also accepts len == 0, in which case skb_put(skb, 0) leaves the skb empty but virtbt_rx_handle() still reads the pkt_type byte from skb->data, consuming uninitialized memory. Define VIRTBT_RX_BUF_SIZE once and reuse it in alloc_skb() and sg_init_one(), and gate virtbt_rx_work() on that same constant so the bound checked matches the buffer actually exposed to the device. Reject used.len == 0 in the same gate so an empty completion can no longer reach virtbt_rx_handle(). Use bt_dev_err_ratelimited() because the length value comes from an untrusted backend that can otherwise flood the kernel log. Same class of bug as commit c04db81cd028 ("net/9p: Fix buffer overflow in USB transport layer"), which hardened the USB 9p transport against unchecked device-reported length. Fixes: 160fbcf3bfb9 ("Bluetooth: virtio_bt: Use skb_put to set length") Cc: stable@vger.kernel.org Cc: Soenke Huster Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Luiz Augusto von Dentz commit 634a4408c0615c523cf7531790f4f14a422b9206 Author: Tristan Madani Date: Tue Apr 21 11:14:54 2026 +0000 Bluetooth: btmtk: validate WMT event SKB length before struct access btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc (9 bytes) without first checking that the SKB contains enough data. A short firmware response causes out-of-bounds reads from SKB tailroom. Use skb_pull_data() to validate and advance past the base WMT event header. For the FUNC_CTRL case, pull the additional status field bytes before accessing them. Fixes: d019930b0049 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani Signed-off-by: Luiz Augusto von Dentz commit f958c7805b18e9d69f6b322b231ecee46ec6f331 Author: SeungJu Cheon Date: Tue Apr 21 11:51:22 2026 +0900 Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths Several iso_pi(sk) fields (qos, qos_user_set, bc_sid, base, base_len, sync_handle, bc_num_bis) are written under lock_sock in iso_sock_setsockopt() and iso_sock_bind(), but read and written under hci_dev_lock only in two other paths: - iso_connect_bis() / iso_connect_cis(), invoked from connect(2), read qos/base/bc_sid and reset qos to default_qos on the qos_user_set validation failure -- all without lock_sock. - iso_connect_ind(), invoked from hci_rx_work, writes sync_handle, bc_sid, qos.bcast.encryption, bc_num_bis, base and base_len on PA_SYNC_ESTABLISHED / PAST_RECEIVED / BIG_INFO_ADV_REPORT / PER_ADV_REPORT events. The BIG_INFO handler additionally passes &iso_pi(sk)->qos together with sync_handle / bc_num_bis / bc_bis to hci_conn_big_create_sync() while setsockopt may be mutating them. Acquire lock_sock around the affected accesses in both paths. The locking order hci_dev_lock -> lock_sock matches the existing iso_conn_big_sync() precedent, whose comment documents the same requirement for hci_conn_big_create_sync(). The HCI connect/bind helpers do not wait for command completion -- they enqueue work via hci_cmd_sync_queue{,_once}() / hci_le_create_cis_pending() and return -- so the added hold time is comparable to iso_conn_big_sync(). KCSAN report: BUG: KCSAN: data-race in iso_connect_cis / iso_sock_setsockopt read to 0xffffa3ae8ce3cdc8 of 1 bytes by task 335 on cpu 0: iso_connect_cis+0x49f/0xa20 iso_sock_connect+0x60e/0xb40 __sys_connect_file+0xbd/0xe0 __sys_connect+0xe0/0x110 __x64_sys_connect+0x40/0x50 x64_sys_call+0xcad/0x1c60 do_syscall_64+0x133/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f write to 0xffffa3ae8ce3cdc8 of 60 bytes by task 334 on cpu 1: iso_sock_setsockopt+0x69a/0x930 do_sock_setsockopt+0xc3/0x170 __sys_setsockopt+0xd1/0x130 __x64_sys_setsockopt+0x64/0x80 x64_sys_call+0x1547/0x1c60 do_syscall_64+0x133/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 334 Comm: iso_setup_race Not tainted 7.0.0-10949-g8541d8f725c6 #44 PREEMPT(lazy) The iso_connect_ind() races were found by inspection. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: SeungJu Cheon Signed-off-by: Luiz Augusto von Dentz commit ca40d481079c05c6891a14a798c79596fd2d5f0c Author: SeungJu Cheon Date: Tue Apr 21 11:51:21 2026 +0900 Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() iso_sock_connect() copies the destination address into iso_pi(sk)->dst under lock_sock, then releases the lock and reads it back with bacmp() to decide between the CIS and BIS connect paths: lock_sock(sk); bacpy(&iso_pi(sk)->dst, &sa->iso_bdaddr); iso_pi(sk)->dst_type = sa->iso_bdaddr_type; release_sock(sk); if (bacmp(&iso_pi(sk)->dst, BDADDR_ANY)) // <- no lock held This read after release_sock() races with any concurrent write to iso_pi(sk)->dst on the same socket. Fix by reading the destination address directly from the local sockaddr argument (sa->iso_bdaddr) instead of iso_pi(sk)->dst. Since sa is a function-local argument, reading it requires no locking and avoids the race. This patch addresses only the bacmp() race in iso_sock_connect(); other unprotected iso_pi(sk) accesses are fixed separately in the next patch. KCSAN report: BUG: KCSAN: data-race in memcmp+0x39/0xb0 race at unknown origin, with read to 0xffff8f96ea66dde3 of 1 bytes by task 549 on cpu 1: memcmp+0x39/0xb0 iso_sock_connect+0x275/0xb40 __sys_connect_file+0xbd/0xe0 __sys_connect+0xe0/0x110 __x64_sys_connect+0x40/0x50 x64_sys_call+0xcad/0x1c60 do_syscall_64+0x133/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00 -> 0xee Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 549 Comm: iso_race_combin Not tainted 7.0.0-08391-g1d51b370a0f8 #40 PREEMPT(lazy) Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: SeungJu Cheon Signed-off-by: Luiz Augusto von Dentz commit 902fe40bce7059722f7ffa1c378e577675cf1918 Author: Aurelien DESBRIERES Date: Tue Apr 21 15:53:31 2026 +0200 Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized When a fault is injected during hci_uart line discipline setup, the proto open() callback may fail leaving hu->priv as NULL. A subsequent TIOCSTI ioctl can trigger the recv() callback before priv is initialized, causing a NULL pointer dereference. Fix all four affected HCI UART protocol drivers by adding a NULL check on hu->priv at the start of their recv() callbacks: h4, h5, ath and bcsp. Reported-by: syzbot+ff30eeab8e07b37d524e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ff30eeab8e07b37d524e Signed-off-by: Aurelien DESBRIERES Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Luiz Augusto von Dentz commit 5917dd39db2bfc8b1b4c6ea8ed99adb4badef707 Author: Sai Teja Aluvala Date: Mon Apr 20 23:07:35 2026 +0530 Bluetooth: btintel_pcie: treat boot stage bit 12 as warning CSR boot stage register bit 12 is documented as a device warning, not a fatal error. Rename the bit definition accordingly and stop including it in btintel_pcie_in_error(). This keeps warning-only boot stage values from being classified as errors while preserving abort-handler state as the actual error condition. Fixes: 190377500fde ("Bluetooth: btintel_pcie: Dump debug registers on error") Signed-off-by: Kiran K Signed-off-by: Sai Teja Aluvala Signed-off-by: Luiz Augusto von Dentz commit 4e37f6452d586b95c346a9abdd2fb80b67794f39 Author: Pauli Virtanen Date: Sat Apr 18 18:41:12 2026 +0300 Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is currently accessed without either, and without checking parent->sk_state: [Task 1] [Task 2] sco_sock_release sco_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) sco_sock_kill(sk) UAF on sk deref and similarly for access to sco_get_sock_listen() return value. Fix possible UAF by holding sk refcount in sco_conn_ready() and making sco_get_sock_listen() increase refcount. Also recheck after lock_sock that the socket is still valid. Adjust conn->sk locking so it's protected also by lock_sock() of the associated socket if any. Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 0a120d96166301d7a95be75b52f843837dbd1219 Author: Siwei Zhang Date: Wed Apr 15 16:49:59 2026 -0400 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb(). Fixes: 80808e431e1e ("Bluetooth: Add l2cap_chan_ops abstraction") Cc: stable@kernel.org Signed-off-by: Siwei Zhang Signed-off-by: Luiz Augusto von Dentz commit 78a88d43dab8d23aeef934ed8ce34d40e6b3d613 Author: Siwei Zhang Date: Wed Apr 15 16:53:36 2026 -0400 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb(). Fixes: 8d836d71e222 ("Bluetooth: Access sk_sndtimeo indirectly in l2cap_core.c") Cc: stable@kernel.org Signed-off-by: Siwei Zhang Signed-off-by: Luiz Augusto von Dentz commit 2ff1a41a912de8517b4482e946dd951b7d80edbf Author: Siwei Zhang Date: Wed Apr 15 16:51:36 2026 -0400 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb(). Fixes: 89bc500e41fc ("Bluetooth: Add state tracking to struct l2cap_chan") Cc: stable@kernel.org Signed-off-by: Siwei Zhang Signed-off-by: Luiz Augusto von Dentz commit 91b5a598b5285da794b72619f31777b62dd336f8 Author: Mikhail Gavrilov Date: Wed Apr 15 02:52:37 2026 +0500 Bluetooth: l2cap: defer conn param update to avoid conn->lock/hdev->lock inversion When a BLE peripheral sends an L2CAP Connection Parameter Update Request the processing path is: process_pending_rx() [takes conn->lock] l2cap_le_sig_channel() l2cap_conn_param_update_req() hci_le_conn_update() [takes hdev->lock] Meanwhile other code paths take the locks in the opposite order: l2cap_chan_connect() [takes hdev->lock] ... mutex_lock(&conn->lock) l2cap_conn_ready() [hdev->lock via hci_cb_list_lock] ... mutex_lock(&conn->lock) This is a classic AB/BA deadlock which lockdep reports as a circular locking dependency when connecting a BLE MIDI keyboard (Carry-On FC-49). Fix this by making hci_le_conn_update() defer the HCI command through hci_cmd_sync_queue() so it no longer needs to take hdev->lock in the caller context. The sync callback uses __hci_cmd_sync_status_sk() to wait for the HCI_EV_LE_CONN_UPDATE_COMPLETE event, then updates the stored connection parameters (hci_conn_params) and notifies userspace (mgmt_new_conn_param) only after the controller has confirmed the update. A reference on hci_conn is held via hci_conn_get()/hci_conn_put() for the lifetime of the queued work to prevent use-after-free, and hci_conn_valid() is checked before proceeding in case the connection was removed while the work was pending. The hci_dev_lock is held across hci_conn_valid() and all conn field accesses to prevent a concurrent disconnect from invalidating the connection mid-use. Fixes: f044eb0524a0 ("Bluetooth: Store latency and supervision timeout in connection params") Signed-off-by: Mikhail Gavrilov Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 4f42363c814f28fe3f59847c35acf1ed033bedd4 Author: Dudu Lu Date: Wed Apr 15 18:43:55 2026 +0800 Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req The L2CAP specification states that if more than one channel is being reconfigured, the MPS shall not be decreased. The current check has two issues: 1) The comparison uses >= (greater-than-or-equal), which incorrectly rejects reconfiguration requests where the MPS stays the same. Since the spec says MPS "shall be greater than or equal to the current MPS", only a strict decrease (remote_mps > mps) should be rejected. Keeping the same MPS is valid. 2) The multi-channel guard uses `&& i` (loop index) to approximate "more than one channel", but this incorrectly allows MPS decrease for the first channel (i==0) even when multiple channels are being reconfigured. Replace with `&& num_scid > 1` which correctly checks whether the request covers more than one channel. Fixes: 7accb1c4321a ("Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ") Signed-off-by: Dudu Lu Signed-off-by: Luiz Augusto von Dentz commit 72b8deccff17a7644e0367e1aaf1a36cfb014324 Author: Dudu Lu Date: Wed Apr 15 17:39:53 2026 +0800 Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling In bnep_rx_frame(), the BNEP_FILTER_NET_TYPE_SET and BNEP_FILTER_MULTI_ADDR_SET extension header parsing has two bugs: 1) The 2-byte length field is read with *(u16 *)(skb->data + 1), which performs a native-endian read. The BNEP protocol specifies this field in big-endian (network byte order), and the same file correctly uses get_unaligned_be16() for the identical fields in bnep_ctrl_set_netfilter() and bnep_ctrl_set_mcfilter(). 2) The length is multiplied by 2, but unlike BNEP_SETUP_CONN_REQ where the length byte counts UUID pairs (requiring * 2 for two UUIDs per entry), the filter extension length field already represents the total data size in bytes. This is confirmed by bnep_ctrl_set_netfilter() which reads the same field as a byte count and divides by 4 to get the number of filter entries. The bogus * 2 means skb_pull advances twice as far as it should, either dropping valid data from the next header or causing the pull to fail entirely when the doubled length exceeds the remaining skb. Fix by splitting the pull into two steps: first use skb_pull_data() to safely pull and validate the 3-byte fixed header (ctrl type + length), then pull the variable-length data using the properly decoded length. Fixes: bf8b9a9cb77b ("Bluetooth: bnep: Add support to extended headers of control frames") Signed-off-by: Dudu Lu Signed-off-by: Luiz Augusto von Dentz commit 5ddb8014261137cadaf83ab5617a588d80a22586 Author: Luiz Augusto von Dentz Date: Fri Apr 10 15:29:52 2026 -0400 Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt hci_le_create_big_complete_evt() iterates over BT_BOUND connections for a BIG handle using a while loop, accessing ev->bis_handle[i++] on each iteration. However, there is no check that i stays within ev->num_bis before the array access. When a controller sends a LE_Create_BIG_Complete event with fewer bis_handle entries than there are BT_BOUND connections for that BIG, or with num_bis=0, the loop reads beyond the valid bis_handle[] flex array into adjacent heap memory. Since the out-of-bounds values typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle() rejects them and the connection remains in BT_BOUND state. The same connection is then found again by hci_conn_hash_lookup_big_state(), creating an infinite loop with hci_dev_lock held. Fix this by terminating the BIG if in case not all BIS could be setup properly. Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes") Cc: stable@vger.kernel.org Signed-off-by: ZhiTao Ou Signed-off-by: Luiz Augusto von Dentz commit 0beddb0c380bed5f5b8e61ddbe14635bb73d0b41 Author: David Carlier Date: Sun Apr 12 21:29:16 2026 +0100 Bluetooth: hci_conn: fix potential UAF in create_big_sync Add hci_conn_valid() check in create_big_sync() to detect stale connections before proceeding with BIG creation. Handle the resulting -ECANCELED in create_big_complete() and re-validate the connection under hci_dev_lock() before dereferencing, matching the pattern used by create_le_conn_complete() and create_pa_complete(). Keep the hci_conn object alive across the async boundary by taking a reference via hci_conn_get() when queueing create_big_sync(), and dropping it in the completion callback. The refcount and the lock are complementary: the refcount keeps the object allocated, while hci_dev_lock() serializes hci_conn_hash_del()'s list_del_rcu() on hdev->conn_hash, as required by hci_conn_del(). hci_conn_put() is called outside hci_dev_unlock() so the final put (which resolves to kfree() via bt_link_release) does not run under hdev->lock, though the release path would be safe either way. Without this, create_big_complete() would unconditionally dereference the conn pointer on error, causing a use-after-free via hci_connect_cfm() and hci_conn_del(). Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") Cc: stable@vger.kernel.org Co-developed-by: Luiz Augusto von Dentz Signed-off-by: Luiz Augusto von Dentz Signed-off-by: David Carlier Signed-off-by: Luiz Augusto von Dentz commit b819db93d73f4593636299e229914052b89e3ef2 Author: Pauli Virtanen Date: Sun Apr 12 21:47:42 2026 +0300 Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready sco_conn_ready calls sleeping functions under conn->lock spinlock. The critical section can be reduced: conn->hcon is modified only with hdev->lock held. It is guaranteed to be held in sco_conn_ready, so conn->lock is not needed to guard it. Move taking conn->lock after lock_sock(parent). This also follows the lock ordering lock_sock() > conn->lock elsewhere in the file. Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 5862221fddede6bb15566ab3c1f23a3c353da5e1 Merge: adc1e5c6203cf1 37b0dc5e279f35 Author: Linus Torvalds Date: Wed May 6 12:51:07 2026 -0700 Merge tag 'parisc-for-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: - Revert "parisc: led: fix reference leak on failed device registration" - Fix build failures introduced when allowing to build 32-/64-bit only VDSO - Switch to dynamic parisc root device to avoid upcoming warnings - Fix IRQ leak in LASI driver * tag 'parisc-for-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix IRQ leak in LASI driver parisc: Fix 64-bit kernel build when CONFIG_COMPAT=n parisc: Fix build failure for 32-bit kernel with PA2.0 instruction set parisc: drivers: switch to dynamic root device Revert "parisc: led: fix reference leak on failed device registration" commit 54ea22273eef67196f238263bc79f27da04d2114 Author: Steffen Eiden Date: Tue Apr 28 18:05:12 2026 +0200 MAINTAINERS: Add Steffen as reviewer for KVM/arm64 KVM/arm64 and KVM/s390 will eventually share some code. Add me as a cross-reviewer from the s390 team to arm64 to help to keep both architectures in sync. Signed-off-by: Steffen Eiden Link: https://patch.msgid.link/20260428160527.1378085-16-seiden@linux.ibm.com [maz: rephrase commit message to use future tense, since this is merged ahead of the code] Signed-off-by: Marc Zyngier commit 9a624ea3f26f40c76bd2c7f77cde30659d42efbd Author: Mostafa Saleh Date: Thu Apr 30 10:37:24 2026 +0000 KVM: arm64: Remove potential UB on nvhe tracing clock update Sashiko(locally) reports possiblity of division by zero and out-of-bounds bitwise shift in trace_clock_update(). Although the clock update is untrusted, we should at least have some basic checks to avoid undefined behaviours. Reviewed-by: Vincent Donnefort Signed-off-by: Mostafa Saleh Link: https://patch.msgid.link/20260430103724.2151625-1-smostafa@google.com Signed-off-by: Marc Zyngier commit fc240715fc5003538ff530e3cfb985e7769b7171 Author: Sebastian Ott Date: Mon May 4 13:28:08 2026 +0200 KVM: selftests: arm64: Fix steal_time test after UAPI refactoring Fix the following failure to the steal_time test on arm64 by making the timer address known to the guest. ==== Test Assertion Failure ==== steal_time.c:229: !ret pid=18514 tid=18514 errno=22 - Invalid argument 1 0x000000000040252f: check_steal_time_uapi at steal_time.c:229 (discriminator 20) 2 (inlined by) main at steal_time.c:537 (discriminator 20) 3 0x0000ffffa23d621b: ?? ??:0 4 0x0000ffffa23d62fb: ?? ??:0 5 0x0000000000402b6f: _start at ??:? KVM_SET_DEVICE_ATTR failed, rc: -1 errno: 22 (Invalid argument) Fixes: 40351ed924dd ("KVM: selftests: Refactor UAPI tests into dedicated function") Signed-off-by: Sebastian Ott Link: https://patch.msgid.link/20260504112808.21276-1-sebott@redhat.com Signed-off-by: Marc Zyngier commit 9be19df816dea9eb7dfe1661b3690bed6a2cb146 Author: Alexandru Elisei Date: Tue May 5 10:49:13 2026 +0100 KVM: arm64: Handle permission faults with guest_memfd gmem_abort() calls kvm_pgtable_stage2_map() to make changes to stage 2. It does this for both relaxing permissions on an existing mapping and to install a missing mapping. kvm_pgtable_stage2_map() doesn't make changes to stage 2 if there is an existing, valid entry and the new entry modifies only the permissions. This is checked in: kvm_pgtable_stage2_map() stage2_map_walk_leaf() stage2_map_walker_try_leaf() stage2_pte_needs_update() and if only the permissions differ, kvm_pgtable_stage2_map() returns -EAGAIN and KVM returns to the guest to replay the instruction. The assumption is that a concurrent fault on a different VCPU already mapped the faulting IPA, and replaying the instruction will either succeed, or cause a permission fault, which should be handled with kvm_pgtable_stage2_relax_perms(). gmem_abort(), on a read or write fault on a system without DIC (instruction cache invalidation required for data to instruction coherence), installs a valid entry with read and write permissions, but without executable permissions. On an execution fault on the same page, gmem_abort() attempts to relax the permissions to allow execution, but calls kvm_pgtable_stage2_map() to change the existing, valid, entry. kvm_pgtable_stage2_map() returns -EAGAIN and KVM resumes execution from the faulting instruction, which leads to an infinite loop of permission faults on the same instruction. Allow the guest to make progress by using kvm_pgtable_stage2_relax_perms() to relax permissions. Fixes: a7b57e099592 ("KVM: arm64: Handle guest_memfd-backed guest page faults") Signed-off-by: Alexandru Elisei Reviewed-by: Fuad Tabba Link: https://patch.msgid.link/20260505094913.75317-1-alexandru.elisei@arm.com Signed-off-by: Marc Zyngier commit 8d9b9d985ad3a81c751a6b97edaf1d3c0780af7c Author: Wei-Lin Chang Date: Tue May 5 15:47:35 2026 +0100 KVM: arm64: nv: Consider the DS bit when translating TCR_EL2 When running an nVHE L1, TCR_EL2 is mapped to TCR_EL1. Writes to the register are trapped and written to TCR_EL1 after a translation. Booting an nVHE L1 with 52-bit VA isn't working because the translation was ignoring the DS bit set by the guest, hence causing repeating level 0 faults. Add it in the translation function. Signed-off-by: Wei-Lin Chang Link: https://patch.msgid.link/20260505144735.1496530-1-weilin.chang@arm.com Signed-off-by: Marc Zyngier commit 1f7305d87aa23db2579df222eba504a333c2c978 Author: James Morse Date: Tue May 5 17:52:03 2026 +0100 KVM: arm64: Work around C1-Pro erratum 4193714 for protected guests C1-Pro cores with SME have an erratum where TLBI+DSB does not complete all outstanding SME accesses. Instead a DSB needs to be executed on the affected CPUs. The implication is that pages cannot be unmapped from the host Stage 2 and then provided to a protected guest or to the hypervisor. Host SME accesses may still complete after this point. This erratum breaks pKVM's guarantees, and the workaround is hard to implement as EL2 and EL1 share a security state meaning EL1 can mask IPIs sent by EL2, leading to interrupt blackouts. Instead, do this in EL3. This has the advantage of a separate security state, meaning lower EL cannot mask the IPI. It is also simpler for EL3 to know about CPUs that are off or in PSCI's CPU_SUSPEND. Add the needed hook to host_stage2_set_owner_metadata_locked(). This covers the cases where the host loses access to a page: __pkvm_host_donate_guest() __pkvm_guest_unshare_host() host_stage2_set_owner_locked() when owner_id == PKVM_ID_HYP Since pKVM relies on the firmware call for correctness, check for the firmware counterpart during protected KVM initialisation and fail the pKVM initialisation if it is missing. Signed-off-by: James Morse Co-developed-by: Catalin Marinas Signed-off-by: Catalin Marinas Cc: Mark Rutland Cc: Marc Zyngier Cc: Oliver Upton Cc: Will Deacon Cc: Vincent Donnefort Cc: Lorenzo Pieralisi Cc: Sudeep Holla Link: https://patch.msgid.link/20260505165205.2690919-1-catalin.marinas@arm.com Signed-off-by: Marc Zyngier commit 9f6d929ee2c6f0266edb564bcd2bd47fd6e884a8 Author: Vincent Guittot Date: Sun May 3 12:45:03 2026 +0200 sched/fair: Fix wakeup_preempt_fair() for not waking up task Make sure to only call pick_next_entity() on an non-empty cfs_rq. The assumption that p is always enqueued and not delayed, is only true for wakeup. If p was moved while delayed, pick_next_entity() will dequeue it and the cfs might become empty. Test if there are still queued tasks before trying again to determine if p could be the next one to be picked. There are at least 2 cases: When cfs becomes idle, it tries to pull tasks but if those pulled tasks are delayed, they will be dequeued when attached to cfs. attach_tasks() -> attach_task() -> wakeup_preempt(rq, p, 0); A misfit task running on cfs A triggers a load balance to be pulled on a better cpu, the load balance on cfs B starts an active load balance to pulled the running misfit task. If there is a delayed dequeue task on cfs A, it can be pulled instead of the previously running misfit task. attach_one_task() -> attach_task() -> wakeup_preempt(rq, p, 0); Fixes: ac8e69e69363 ("sched/fair: Fix wakeup_preempt_fair() vs delayed dequeue") Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260503104503.1732682-1-vincent.guittot@linaro.org commit b6eee96843e8d088200f01b035da98e72067c5fe Author: Zhan Xusheng Date: Fri May 1 12:40:06 2026 +0200 sched/fair: Fix overflow in vruntime_eligible() Zhan Xusheng reported running into sporadic a s64 mult overflow in vruntime_eligible(). When constructing a worst case scenario: If you have cgroups, then you can have an entity of weight 2 (per calc_group_shares()), and its vlag should then be bounded by: (slice+TICK_NSEC) * NICE_0_LOAD, which is around 44 bits as per the comment on entity_key(). The other extreme is 100*NICE_0_LOAD, thus you get: {key, weight}[] := { puny: { (slice + TICK_NSEC) * NICE_0_LOAD, 2 }, max: { 0, 100*NICE_0_LOAD }, } The avg_vruntime() would end up being very close to 0 (which is zero_vruntime), so no real help making that more accurate. vruntime_eligible(puny) ends up with: avg = 2 * puny.key (+ 0) load = 2 + 100 * NICE_0_LOAD avg >= puny.key * load And that is: (slice + TICK_NSEC) * NICE_0_LOAD * NICE_0_LOAD * 100, which will overflow s64. Zhan suggested using __builtin_mul_overflow(), however after staring at compiler output for various architectures using godbolt, it seems that using an __int128 multiplication often results in better code. Specifically, a number of architectures already compute the __int128 product to determine the overflow. Eg. arm64 already has the 'smulh' instruction used. By explicitly doing an __int128 multiply, it will emit the 'mul; smulh' pattern, which modern cores can fuse (armv8-a clang-22.1.0). x86_64 has less branches (no OF handling). Since Linux has ARCH_SUPPORTS_INT128 to gate __int128 usage, also provide the __builtin_mul_overflow() variant as a fallback. [peterz: Changelog and __int128 bits] Fixes: 556146ce5e94 ("sched/fair: Avoid overflow in enqueue_entity()") Reported-by: Zhan Xusheng Closes: https://patch.msgid.link/20260415145742.10359-1-zhanxusheng%40xiaomi.com Signed-off-by: Zhan Xusheng Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260505103155.GN3102924%40noisy.programming.kicks-ass.net commit e744060076871eebc2647b24420b550ff44b2b65 Author: Thomas Gleixner Date: Sat Apr 25 14:48:23 2026 +0200 selftests/rseq: Expand for optimized RSEQ ABI v2 Update the selftests so they are executed for legacy (32 bytes RSEQ region) and optimized RSEQ ABI v2 mode. Fixes: d6200245c75e ("rseq: Allow registering RSEQ with slice extension") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Link: https://patch.msgid.link/20260428224428.009121296%40kernel.org Cc: stable@vger.kernel.org commit 99428157dcf32fdac97355aa1cc1364dbc9e073c Author: Thomas Gleixner Date: Sun Apr 26 10:01:56 2026 +0200 rseq: Reenable performance optimizations conditionally Due to the incompatibility with TCMalloc the RSEQ optimizations and extended features (time slice extensions) have been disabled and made run-time conditional. The original RSEQ implementation, which TCMalloc depends on, registers a 32 byte region (ORIG_RSEG_SIZE). This region has a 32 byte alignment requirement. The extension safe newer variant exposes the kernel RSEQ feature size via getauxval(AT_RSEQ_FEATURE_SIZE) and the alignment requirement via getauxval(AT_RSEQ_ALIGN). The alignment requirement is that the registered RSEQ region is aligned to the next power of two of the feature size. The kernel currently has a feature size of 33 bytes, which means the alignment requirement is 64 bytes. The TCMalloc RSEQ region is embedded into a cache line aligned data structure starting at offset 32 bytes so that bytes 28-31 and the cpu_id_start field at bytes 32-35 form a 64-bit little endian pointer with the top-most bit (63 set) to check whether the kernel has overwritten cpu_id_start with an actual CPU id value, which is guaranteed to not have the top most bit set. As this is part of their performance tuned magic, it's a pretty safe assumption, that TCMalloc won't use a larger RSEQ size. This allows the kernel to declare that registrations with a size greater than the original size of 32 bytes, which is the cases since time slice extensions got introduced, as RSEQ ABI v2 with the following differences to the original behaviour: 1) Unconditional updates of the user read only fields (CPU, node, MMCID) are removed. Those fields are only updated on registration, task migration and MMCID changes. 2) Unconditional evaluation of the criticial section pointer is removed. It's only evaluated when user space was interrupted and was scheduled out or before delivering a signal in the interrupted context. 3) The read/only requirement of the ID fields is enforced. When the kernel detects that userspace manipulated the fields, the process is terminated. This ensures that multiple entities (libraries) can utilize RSEQ without interfering. 4) Todays extended RSEQ feature (time slice extensions) and future extensions are only enabled in the v2 enabled mode. Registrations with the original size of 32 bytes operate in backwards compatible legacy mode without performance improvements and extended features. Unfortunately that also affects users of older GLIBC versions which register the original size of 32 bytes and do not evaluate the kernel required size in the auxiliary vector AT_RSEQ_FEATURE_SIZE. That's the result of the lack of enforcement in the original implementation and the unwillingness of a single entity to cooperate with the larger ecosystem for many years. Implement the required registration changes by restructuring the spaghetti code and adding the size/version check. Also add documentation about the differences of legacy and optimized RSEQ V2 mode. Thanks to Mathieu for pointing out the ORIG_RSEQ_SIZE constraints! Fixes: d6200245c75e ("rseq: Allow registering RSEQ with slice extension") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Link: https://patch.msgid.link/20260428224427.927160119%40kernel.org Cc: stable@vger.kernel.org commit 82f572449cfe75f12ea985986da60e11f308f77d Author: Thomas Gleixner Date: Sun Apr 26 16:21:02 2026 +0200 rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode The optimized RSEQ V2 mode requires that user space adheres to the ABI specification and does not modify the read-only fields cpu_id_start, cpu_id, node_id and mm_cid behind the kernel's back. While the kernel does not rely on these fields, the adherence to this is a fundamental prerequisite to allow multiple entities, e.g. libraries, in an application to utilize the full potential of RSEQ without stepping on each other toes. Validate this adherence on every update of these fields. If the kernel detects that user space modified the fields, the application is force terminated. Fixes: d6200245c75e ("rseq: Allow registering RSEQ with slice extension") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Link: https://patch.msgid.link/20260428224427.845230956%40kernel.org Cc: stable@vger.kernel.org commit fdf4eb632683bfc2840acebe62716cb468d43e10 Author: Thomas Gleixner Date: Sun Apr 26 17:51:07 2026 +0200 selftests/rseq: Validate legacy behavior The RSEQ legacy mode behavior requires that the ID fields in the rseq region are unconditionally updated on every context switch and before signal delivery even if not required by the ABI specification. To ensure that this behavior is preserved for legacy users in the future, add a test which validates that with a sleep() and a signal sent to self. Provide a run script which prevents GLIBC from registering a RSEQ region, so that the test can register it's own legacy sized region. Fixes: 566d8015f7ee ("rseq: Avoid CPU/MM CID updates when no event pending") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Link: https://patch.msgid.link/20260428224427.764705536%40kernel.org Cc: stable@vger.kernel.org commit 0c8c88b8eb82a2a41bec5f17c076d6312dc40316 Author: Colin Walters Date: Tue May 5 15:42:57 2026 -0700 ovl: fix verity lazy-load guard broken by fsverity_active() semantic change Commit f77f281b6118 ("fsverity: use a hashtable to find the fsverity_info") made fsverity_active() check whether the inode has the verity flag, rather than whether the inode's fsverity_info is loaded. This broke ovl_ensure_verity_loaded(), which wants to load the fsverity_info for any verity inodes that haven't had it loaded yet. Therefore, to check that the fsverity_info hasn't yet been loaded, use fsverity_get_info(inode) == NULL instead of !fsverity_active(inode). Also, since fsverity_get_info() now involves a hash table lookup, put the more lightweight IS_VERITY() flag check first. Fixes: f77f281b6118 ("fsverity: use a hashtable to find the fsverity_info") Cc: stable@vger.kernel.org Link: https://github.com/bootc-dev/bootc/issues/2174 Signed-off-by: Colin Walters Acked-by: Amir Goldstein Link: https://patch.msgid.link/20260505224257.23213-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b89e0100a5f6885f9748bbacc3f4e3bcff654e4c Merge: 3e8ec3440b3731 79240f3f6d766b Author: Jakub Kicinski Date: Wed May 6 07:29:31 2026 -0700 Merge tag 'wireless-2026-05-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Quite a number of fixes now: - mac80211 - remove HT NSS validation to work with broken APs (with a kunit fix now) - remove 'static' that could cause races - check station link lookup before further processing - fix use-after-free due to delete in list iteration - remove AP station on assoc failures to fix crashes - ath12k - fix OF node refcount imbalance - fix queue flush ("REO update") in MLO - fix RCU assert - ath12k: - fix Kconfig with POWER_SEQUENCING - fix WMI buffer leaks on error conditions - don't use uninitialized stack data when processing RSSI events - fix logic for determining the peer ID in the RX path - ath5k: fix a potential stack buffer overwrite - rsi: fix thread lifetime race - brcmfmac: fix potential UAF - nl80211: - stricter permissions/checks for PMK and netns - fix netlink policy vs. code type confusion - cw1200: revert a broken locking change - various fixes to not trust values from firmware * tag 'wireless-2026-05-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (25 commits) wifi: nl80211: re-check wiphy netns in nl80211_prepare_wdev_dump() continuation wifi: nl80211: require CAP_NET_ADMIN over the target netns in SET_WIPHY_NETNS wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage wifi: mac80211: remove station if connection prep fails wifi: mac80211: use safe list iteration in radar detect work wifi: libertas: notify firmware load wait on disconnect wifi: ath5k: do not access array OOB wifi: ath12k: fix peer_id usage in normal RX path wifi: ath12k: initialize RSSI dBm conversion event state wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions wifi: cw1200: Revert "Fix locking in error paths" wifi: mac80211: tests: mark HT check strict wifi: rsi: fix kthread lifetime race between self-exit and external-stop wifi: mac80211: drop stray 'static' from fast-RX rx_result wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path wifi: nl80211: require admin perm on SET_PMK / DEL_PMK wifi: libertas: fix integer underflow in process_cmdrequest() wifi: b43legacy: enforce bounds check on firmware key index in RX path wifi: b43: enforce bounds check on firmware key index in b43_rx() wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task ... ==================== Link: https://patch.msgid.link/20260506110325.219675-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit adc1e5c6203cf13fe05a1ead08edcb3d3a3baae8 Merge: e80948062dcfff 2c340aab5485eb Author: Linus Torvalds Date: Wed May 6 07:27:30 2026 -0700 Merge tag 'efi-fixes-for-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - Fix issues in EFI graceful recovery on x86 introduced by changes to the kernel mode FPU APIs - I-cache coherency fixes for the LoongArch EFI stub - Locking fix for EFI pstore - Code tweak for efivarfs * tag 'efi-fixes-for-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: x86/efi: Restore IRQ state in EFI page fault handler x86/efi: Fix graceful fault handling after FPU softirq changes efi/libstub: Synchronize instruction cache after kernel relocation efi/loongarch: Implement efi_cache_sync_image() efi/libstub: Move efi_relocate_kernel() into its only remaining user efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error efivarfs: use QSTR() in efivarfs_alloc_dentry commit 06bc7ff0a1e0f2b0102e1314e3527a7ec0997851 Merge: 2bcbb163162789 5776bcdf4dccac Author: Takashi Iwai Date: Wed May 6 16:10:00 2026 +0200 Merge tag 'asoc-fix-v7.1-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.1 Another batch of fixes, plus a couple of quirks (mostly AMD ones, as has been the case recently). All driver changes, including fixes for the KUnit tests for the Cirrus drivers that could cause memory corruption. commit 4bacec2317527ba04b7172145848f1c206999ea1 Author: Jiawei Liu Date: Wed May 6 14:24:12 2026 +0800 spi: ch341: correct company name in MODULE_DESCRIPTION The company name "QiHeng Electronics" is incorrect. The correct legal name is "Nanjing Qinheng Microelectronics Co., Ltd.". Update the module description accordingly. Signed-off-by: Jiawei Liu Link: https://patch.msgid.link/20260506062412.371034-1-ljw@wch.cn Signed-off-by: Mark Brown commit 628497e6d925d43efb56e3ffecef0a9d217926b3 Author: Fenglin Wu Date: Wed May 6 02:28:51 2026 -0700 regulator: qcom-rpmh: Fix index for pmh0101 ldo16 The wrong index is assigned to pmh0101 ldo16, which results incorrect rpmh resource being used when the regulator device is voted. Fix it. Fixes: 65efe5404d15 ("regulator: rpmh-regulator: Add RPMH regulator support for Glymur") Signed-off-by: Fenglin Wu Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260506-fix_pmh0101_ldo16_index-v1-1-cdc8708b01f4@oss.qualcomm.com Signed-off-by: Mark Brown commit 5776bcdf4dccac8edc1160482792b512da5c08b4 Merge: 027ef9a9297c6a fd4d83e1437d63 Author: Mark Brown Date: Wed May 6 21:22:53 2026 +0900 ASoC: cs35l56: Fixes for driver cleanup Richard Fitzgerald says: Two patches to fix cleanup during driver remove() and the error path of probe(). The main purpose is to fix cleanup of the workqueue. commit fd4d83e1437d6395021b21531e187c8a67ac21b0 Author: Richard Fitzgerald Date: Tue May 5 17:11:24 2026 +0100 ASoC: cs35l56: Destroy workqueue in probe error path The error path in cs35l56_common_probe() should call destroy_workqueue() on the workqueue that was created by cs35l56_dsp_init(). Fixes: e49611252900 ("ASoC: cs35l56: Add driver for Cirrus Logic CS35L56") Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260505161124.3621000-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit bee87cf0f1248c0f20710d7a79df41fe892d9f88 Author: Richard Fitzgerald Date: Tue May 5 17:11:23 2026 +0100 ASoC: cs35l56: Don't use devres to unregister component Manually call snd_soc_unregister_component() from cs35l56_remove() instead of using devres cleanup. This ensures that the component is destroyed before cs35l56_remove() starts cleanup of anything the component code could be using. Devres cleanup happens after the driver remove() callback, so if snd_soc_register_component() is used, it will not be destroyed until after cs35l56_remove() has returned. But there is some cleanup that must be done in cs35l56_remove(), or wrapped in a custom devres cleanup handler to ensure correct ordering. The simplest option is to call snd_soc_unregister_component() at the start of cs35l56_remove(). Fixes: e49611252900 ("ASoC: cs35l56: Add driver for Cirrus Logic CS35L56") Closes: https://sashiko.dev/#/patchset/20260501103002.2843735-1-rf%40opensource.cirrus.com Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260505161124.3621000-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 5cbb61bf4168859d97c068d88d364f4f1f440325 Author: Breno Leitao Date: Tue May 5 09:02:13 2026 -0700 arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's sve_set_common() is the backend for PTRACE_SETREGSET(NT_ARM_SVE) and PTRACE_SETREGSET(NT_ARM_SSVE). Every write in the function operates on the tracee (target) - except a single memset that uses current instead, zeroing the tracer's saved V0-V31 / FPSR / FPCR shadow on every ptrace SETREGSET call. The memset is meant to give the tracee a defined zero register image before the user-supplied payload is copied in (for partial writes, header-only writes, and FPSIMD<->SVE format switches). Aiming it at current both denies the tracee that clean slate and silently corrupts the tracer. The corruption of the tracer's saved FPSIMD state is not always observable. Where the tracer's state is live on a CPU, this may be reused without loading the corrupted state from memory, and will eventually be written back over the corrupted state. Where the tracer's state is saved in SVE_PT_REGS_SVE format, only the FPSR and FPCR are clobbered, and the effective copy of the vectors is in the task's sve_state. Reproducible on an arm64 kernel with SVE: a single-threaded tracer that loads a known pattern into V0-V31, issues PTRACE_SETREGSET(NT_ARM_SVE) on a child, and reads V0-V31 back observes them all zeroed within tens of thousands of iterations when a sibling thread keeps stealing the FPSIMD CPU binding. Fixes: 316283f276eb ("arm64/fpsimd: ptrace: Consistently handle partial writes to NT_ARM_(S)SVE") Cc: Signed-off-by: Breno Leitao Acked-by: Mark Rutland Signed-off-by: Catalin Marinas commit 45d2b37a37ab98484693533496395c610a2cab96 Author: Maoyi Xie Date: Mon May 4 23:37:55 2026 +0800 io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER io_uring_enter() with IORING_ENTER_ABS_TIMER takes an absolute timespec from the caller via ext_arg->ts. It arms an ABS mode hrtimer in __io_cqring_wait_schedule(). The conversion path in io_uring/wait.c parses ext_arg->ts inline rather than going through io_parse_user_time(). It therefore does not pick up the time namespace conversion added by the previous patch. Apply timens_ktime_to_host() to the parsed time on the IORING_ENTER_ABS_TIMER branch. This mirrors the IORING_TIMEOUT_ABS fix in io_parse_user_time(). Use ctx->clockid as the clock id. ctx->clockid is set either at ring creation or via IORING_REGISTER_CLOCK. timens_ktime_to_host() is a no-op for clocks not affected by time namespaces. It is also a no-op for callers in the initial time namespace. The fast path is unchanged. Reproducer: in unshare --user --time, with a -10s monotonic offset, call io_uring_enter with min_complete=1, IORING_ENTER_ABS_TIMER, and ts = now + 1s. The call returns -ETIME after <1ms instead of after the expected ~1s. Suggested-by: Pavel Begunkov Suggested-by: Jens Axboe Signed-off-by: Maoyi Xie Link: https://patch.msgid.link/20260504153755.1293932-3-maoyi.xie@ntu.edu.sg Signed-off-by: Jens Axboe commit 9cc6bac1bebf8310d2950d1411a91479e86d69a1 Author: Maoyi Xie Date: Mon May 4 23:37:54 2026 +0800 io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS io_uring's IORING_OP_TIMEOUT and IORING_OP_LINK_TIMEOUT accept a timespec from the caller via io_parse_user_time(). With IORING_TIMEOUT_ABS, the timestamp is an absolute deadline on the selected clock. The clock is CLOCK_MONOTONIC by default. CLOCK_BOOTTIME and CLOCK_REALTIME are also selectable. A submitter inside a CLONE_NEWTIME time namespace observes CLOCK_MONOTONIC and CLOCK_BOOTTIME shifted by the namespace's offsets relative to the host. Every other ABS timer interface in the kernel converts the caller's absolute time to host view via timens_ktime_to_host() before arming an hrtimer: kernel/time/posix-timers.c -- timer_settime(TIMER_ABSTIME) kernel/time/posix-stubs.c -- clock_nanosleep(TIMER_ABSTIME) kernel/time/alarmtimer.c -- alarm_timer_nsleep(TIMER_ABSTIME) fs/timerfd.c -- timerfd_settime(TFD_TIMER_ABSTIME) io_parse_user_time() does not. As a result, an absolute timeout submitted from within a time namespace is interpreted in host view. That is generally a different point in time. It may already be in the past, causing the timer to fire immediately, or far in the future, causing the timer not to fire when expected. Reproducer: in unshare --user --time, with a -10s monotonic offset, submit IORING_OP_TIMEOUT with IORING_TIMEOUT_ABS and deadline = now + 1s. The CQE is delivered after <1ms instead of the expected ~1s. Apply timens_ktime_to_host() to the parsed time when IORING_TIMEOUT_ABS is set. Split the existing clock id resolver in io_timeout_get_clock() into a flags only helper io_flags_to_clock(), so io_parse_user_time() can resolve the clock without a struct io_timeout_data. timens_ktime_to_host() is a no-op for clocks not affected by time namespaces, e.g. CLOCK_REALTIME. It is also a no-op for callers in the initial time namespace. The fast path is unchanged. SQPOLL is also covered. The SQPOLL kernel thread is created via create_io_thread() with CLONE_THREAD and no CLONE_NEW* flag. copy_namespaces() therefore shares the submitter's nsproxy by reference. Inside the SQPOLL kthread, current->nsproxy->time_ns is the submitter's time_ns. timens_ktime_to_host() resolves correctly. Suggested-by: Pavel Begunkov Suggested-by: Jens Axboe Signed-off-by: Maoyi Xie Link: https://patch.msgid.link/20260504153755.1293932-2-maoyi.xie@ntu.edu.sg Signed-off-by: Jens Axboe commit 86f33ca9bea30cf011f2b1edad4593faea9c6e98 Author: Ming Lei Date: Wed May 6 16:22:38 2026 +0800 ublk: validate physical_bs_shift, io_min_shift and io_opt_shift ublk_validate_params() checks logical_bs_shift is within [9, PAGE_SHIFT] but has no upper bound for physical_bs_shift, io_min_shift, or io_opt_shift. A malicious userspace can set any of these to a large value (e.g., 44), causing undefined behavior from `1 << shift` in ublk_ctrl_start_dev() since the result is stored in 32-bit unsigned int. Cap all three at ilog2(SZ_256M) (28). 256M is big enough to cover all practical block sizes, and originates from the maximum physical block size possible in NVMe (lba_size * (1 + npwg), where npwg is 16-bit). Also zero out ub->params with memset() when copy_from_user() fails or ublk_validate_params() returns error, so that no stale or partial params survive for a subsequent START_DEV to consume. Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260506082238.22363-1-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 79240f3f6d766b342b57c32397d643e1cfa26b81 Author: Maoyi Xie Date: Wed May 6 14:48:54 2026 +0800 wifi: nl80211: re-check wiphy netns in nl80211_prepare_wdev_dump() continuation NL80211_CMD_GET_SCAN is implemented as a multi-call dumpit. The first invocation of nl80211_prepare_wdev_dump() validates the requested wdev against the caller's netns via __cfg80211_wdev_from_attrs(). Subsequent invocations look up the same wiphy by its global index and do not check that the wiphy is still in the caller's netns. Add the same filter to the continuation path. If the wiphy's netns no longer matches the caller's, return -ENODEV and the netlink dump machinery terminates the walk cleanly. Signed-off-by: Maoyi Xie Link: https://patch.msgid.link/20260506064854.2207105-3-maoyixie.tju@gmail.com Signed-off-by: Johannes Berg commit 15994bb0cbb8fc4879da7552ddd08c1896261c39 Author: Maoyi Xie Date: Wed May 6 14:48:53 2026 +0800 wifi: nl80211: require CAP_NET_ADMIN over the target netns in SET_WIPHY_NETNS NL80211_CMD_SET_WIPHY_NETNS dispatches with GENL_UNS_ADMIN_PERM, which verifies that the caller has CAP_NET_ADMIN for the source netns. It doesn't verify that the caller has CAP_NET_ADMIN over the target netns selected by NL80211_ATTR_NETNS_FD or NL80211_ATTR_PID. This diverges from the convention enforced in net/core/rtnetlink.c::rtnl_get_net_ns_capable(): /* For now, the caller is required to have CAP_NET_ADMIN in * the user namespace owning the target net ns. */ if (!sk_ns_capable(sk, net->user_ns, CAP_NET_ADMIN)) return ERR_PTR(-EACCES); A user with CAP_NET_ADMIN in their own user namespace can therefore push a wiphy into an arbitrary netns (including init_net) over which they have no privilege. Mirror the rtnetlink convention by requiring CAP_NET_ADMIN in the target netns before calling cfg80211_switch_netns(). Signed-off-by: Maoyi Xie Link: https://patch.msgid.link/20260506064854.2207105-2-maoyixie.tju@gmail.com Signed-off-by: Johannes Berg commit 0f3c0a197309717d74729568f88957d448847937 Author: Johannes Berg Date: Tue May 5 13:38:37 2026 +0200 wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage This is documented as a u8 and has a policy of NLA_U8, but uses nla_get_u32() which means it's completely broken on big-endian. Fix it to use nla_get_u8(). Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API") Link: https://patch.msgid.link/20260505113837.260159-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg commit 283fc9e44ff5b5ac967439b4951b80bd4299f4e4 Author: Johannes Berg Date: Tue May 5 15:15:34 2026 +0200 wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since it's related to the link of the vif being removed. Delete an existing station. Any "new_sta" is already being removed, so that doesn't need changes. This fixes a use-after-free/double-free in debugfs if that's enabled, because a vif going from MLD (and to MLD, but that's not relevant here) recreates its entire debugfs. Cc: stable@vger.kernel.org Fixes: 81151ce462e5 ("wifi: mac80211: support MLO authentication/association with one link") Reviewed-by: Miriam Rachel Korenblit Link: https://patch.msgid.link/20260505151533.c4e52deb06ad.Iafe56cec7de8512626169496b134bce3a6c17010@changeid Signed-off-by: Johannes Berg commit 2bcbb163162789d3488562073dbb99d9bd71a762 Author: Rosen Penev Date: Tue May 5 20:18:54 2026 -0700 ALSA: sparc/dbri: add missing fallthrough Fixes compiler error with probably newer compilers: sound/sparc/dbri.c:595:2: error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough] 595 | case 1: | ^ sound/sparc/dbri.c:595:2: note: insert 'break;' to avoid fall-through 595 | case 1: | ^ | break; Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260506031854.780411-1-rosenp@gmail.com Signed-off-by: Takashi Iwai commit 5337213381df578058e2e41da93cbd0e4639935f Author: Cássio Gabriel Date: Wed May 6 00:34:47 2026 -0300 ALSA: core: Serialize deferred fasync state checks snd_fasync_helper() updates fasync->on under snd_fasync_lock, and snd_fasync_work_fn() now also evaluates fasync->on under the same lock. snd_kill_fasync() still tests the flag before taking the lock, leaving an unsynchronized read against FASYNC enable/disable updates. Move the enabled-state check into the locked section. Also clear fasync->on under snd_fasync_lock in snd_fasync_free() before unlinking the pending entry. Together with the locked sender-side check, this publishes teardown before flushing the deferred work and prevents a racing sender from requeueing the entry after free has started. Fixes: ef34a0ae7a26 ("ALSA: core: Add async signal helpers") Fixes: 8146cd333d23 ("ALSA: core: Fix potential data race at fasync handling") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260506-alsa-core-fasync-on-lock-v1-1-ea48c77d6ca4@gmail.com Signed-off-by: Takashi Iwai commit 01801e20d69346e1e6cec0d908f1cea3a49e51b5 Author: Rodrigo Faria Date: Tue May 5 19:55:18 2026 +0100 ALSA: hda/realtek: Add mute LED fixup for HP Pavilion 15-cs1xxx Add a new fixup for the mute LED on the HP Pavilion 15-cs1xxx series using the VREF on NID 0x1b. The BIOS on these models (tested up to F.32) incorrectly reports the mute LED on NID 0x18 via DMI OEM strings, which lacks VREF capabilities. This fixup overrides the LED pin to the correct NID 0x1b. Signed-off-by: Rodrigo Faria Link: https://patch.msgid.link/20260505185518.23625-1-rodrigofilipefaria@gmail.com Signed-off-by: Takashi Iwai commit 92429ca999db99febced82f23362a71b2ba4c1d8 Author: Cássio Gabriel Date: Wed May 6 00:15:48 2026 -0300 ALSA: seq: Fix UMP group 16 filtering The sequencer UAPI defines group_filter as an unsigned int bitmap. Bit 0 filters groupless messages and bits 1-16 filter UMP groups 1-16. The internal snd_seq_client storage is only unsigned short, so bit 16 is truncated when userspace sets the filter. The same truncation affects the automatic UMP client filter used to avoid delivery to inactive groups, so events for group 16 cannot be filtered. Store the internal bitmap as unsigned int and keep both userspace-provided and automatically generated values limited to the defined UAPI bits. Fixes: d2b706077792 ("ALSA: seq: Add UMP group filter") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260506-alsa-seq-ump-group16-filter-v1-1-b75160bf6993@gmail.com Signed-off-by: Takashi Iwai commit bd3c45dd01283ada23b0a388c578dcf5600deb8a Author: Frederic Weisbecker Date: Thu Apr 23 18:53:49 2026 +0200 timers/migration: Fix another hotplug activation race The hotplug control CPU is assumed to be active in the hierarchy but that doesn't imply that the root is active. If the current CPU is not the one that activated the current hierarchy, and the CPU performing this duty is still halfway through the tree, the root may still be observed inactive. And this can break the activation of a new root as in the following scenario: 1) Initially, the whole system has 64 CPUs and only CPU 63 is awake. [GRP1:0] active / | \ / | \ [GRP0:0] [...] [GRP0:7] idle idle active / | \ | CPU 0 CPU 1 ... CPU 63 idle idle active 2) CPU 63 goes idle _but_ due to a #VMEXIT it hasn't yet reached the [GRP1:0]->parent dereference (that would be NULL and stop the walk) in __walk_groups_from(). [GRP1:0] idle / | \ / | \ [GRP0:0] [...] [GRP0:7] idle idle idle / | \ | CPU 0 CPU 1 ... CPU 63 idle idle idle 3) CPU 1 wakes up, activates GRP0:0 but didn't yet manage to propagate up to GRP1:0 due to yet another #VMEXIT. [GRP1:0] idle / | \ / | \ [GRP0:0] [...] [GRP0:7] active idle idle / | \ | CPU 0 CPU 1 ... CPU 63 idle active idle 3) CPU 0 wakes up and doesn't need to walk above GRP0:0 as it's CPU 1 role. [GRP1:0] idle / | \ / | \ [GRP0:0] [...] [GRP0:7] active idle idle / | \ | CPU 0 CPU 1 ... CPU 63 active active idle 4) CPU 0 boots CPU 64. It creates a new root for it. [GRP2:0] idle / \ / \ [GRP1:0] [GRP1:1] idle idle / | \ \ / | \ \ [GRP0:0] [...] [GRP0:7] [GRP0:8] active idle idle idle / | \ | | CPU 0 CPU 1 ... CPU 63 CPU 64 active active idle offline 5) CPU 0 activates the new root, but note that GRP1:0 is still idle, waiting for CPU 1 to resume from #VMEXIT and activate it. [GRP2:0] active / \ / \ [GRP1:0] [GRP1:1] idle idle / | \ \ / | \ \ [GRP0:0] [...] [GRP0:7] [GRP0:8] active idle idle idle / | \ | | CPU 0 CPU 1 ... CPU 63 CPU 64 active active idle offline 6) CPU 63 resumes after #VMEXIT and sees the new GRP1:0 parent. Therefore it propagates the stale inactive state of GRP1:0 up to GRP2:0. [GRP2:0] idle / \ / \ [GRP1:0] [GRP1:1] idle idle / | \ \ / | \ \ [GRP0:0] [...] [GRP0:7] [GRP0:8] active idle idle idle / | \ | | CPU 0 CPU 1 ... CPU 63 CPU 64 active active idle offline 7) CPU 1 resumes after #VMEXIT and finally activates GRP1:0. But it doesn't observe its parent link because no ordering enforced that. Therefore GRP2:0 is spuriously left idle. [GRP2:0] idle / \ / \ [GRP1:0] [GRP1:1] active idle / | \ \ / | \ \ [GRP0:0] [...] [GRP0:7] [GRP0:8] active idle idle idle / | \ | | CPU 0 CPU 1 ... CPU 63 CPU 64 active active idle offline Such races are highly theoretical and the problem would solve itself once the old root ever becomes idle again. But it still leaves a taste of discomfort. Fix it with enforcing a fully ordered atomic read of the old root state before propagating the activate state up to the new root. It has a two directions ordering effect: * Acquire + release of the latest old root state: If the hotplug control CPU is not the one that woke up the old root, make sure to acquire its active state and propagate it upwards through the ordered chain of activation (the acquire pairs with the cmpxchg() in tmigr_active_up() and subsequent releases will pair with atomic_read_acquire() and smp_mb__after_atomic() in tmigr_inactive_up()). * Release: If the hotplug control CPU is not the one that must wake up the old root, but the CPU covering that is lagging behind its duty, publish the links from the old root to the new parents. This way the lagging CPU will propagate the active state itself. Fixes: 7ee988770326 ("timers: Implement the hierarchical pull model") Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260423165354.95152-2-frederic@kernel.org commit e80948062dcfff0543c5c60ba8654e825bf73b5a Merge: 74fe02ce122a61 5a873d77ba7924 Author: Linus Torvalds Date: Tue May 5 19:44:46 2026 -0700 Merge tag 'loongarch-fixes-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Fix some build and runtime issues after 32BIT Kconfig option enabled, improve the platform-specific PCI controller compatibility, drop custom __arch_vdso_hres_capable(), and fix a lot of KVM bugs" * tag 'loongarch-fixes-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Move unconditional delay into timer clear scenery LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software LoongArch: KVM: Move AVEC interrupt injection into switch loop LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry LoongArch: KVM: Compile switch.S directly into the kernel LoongArch: vDSO: Drop custom __arch_vdso_hres_capable() LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT LoongArch: Specify -m32/-m64 explicitly for 32BIT/64BIT LoongArch: Make CONFIG_64BIT as the default option commit 3e8ec3440b3731576f0e71a01121445e66c26bfd Merge: 22675f07260ca2 203cee647f551a Author: Jakub Kicinski Date: Tue May 5 19:27:54 2026 -0700 Merge branch 'xsk-fix-bugs-around-xsk-skb-allocation' Jason Xing says: ==================== xsk: fix bugs around xsk skb allocation There are rare issues around xsk_build_skb(). Some of them were founded by Sashiko[1][2]. [1]: https://lore.kernel.org/all/20260415082654.21026-1-kerneljasonxing@gmail.com/ [2]: https://lore.kernel.org/all/20260418045644.28612-1-kerneljasonxing@gmail.com/ ==================== Link: https://patch.msgid.link/20260502200722.53960-1-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 203cee647f551abc87b992045cd920b117ff990a Author: Jason Xing Date: Sat May 2 23:07:22 2026 +0300 xsk: fix u64 descriptor address truncation on 32-bit architectures In copy mode TX, xsk_skb_destructor_set_addr() stores the 64-bit descriptor address into skb_shinfo(skb)->destructor_arg (void *) via a uintptr_t cast: skb_shinfo(skb)->destructor_arg = (void *)((uintptr_t)addr | 0x1UL); On 32-bit architectures uintptr_t is 32 bits, so the upper 32 bits of the descriptor address are silently dropped. In XDP_ZEROCOPY unaligned mode the chunk offset is encoded in bits 48-63 of the descriptor address (XSK_UNALIGNED_BUF_OFFSET_SHIFT = 48), meaning the offset is lost entirely. The completion queue then returns a truncated address to userspace, making buffer recycling impossible. Fix this by handling the 32-bit case directly in xsk_skb_destructor_set_addr(): when !CONFIG_64BIT, allocate an xsk_addrs struct (the same path already used for multi-descriptor SKBs) to store the full u64 address. The existing tagged-pointer logic in xsk_skb_destructor_is_addr() stays unchanged: slab pointers returned from kmem_cache_zalloc() are always word-aligned and therefore have bit 0 clear, which correctly identifies them as a struct pointer rather than an inline tagged address on every architecture. Factor the shared kmem_cache_zalloc + destructor_arg assignment into __xsk_addrs_alloc() and add a wrapper xsk_addrs_alloc() that handles the inline-to-list upgrade (is_addr check + get_addr + num_descs = 1). The three former open-coded kmem_cache_zalloc call sites now reduce to a single call each. Propagate the -ENOMEM from xsk_skb_destructor_set_addr() through xsk_skb_init_misc() so the caller can clean up the skb via kfree_skb() before skb->destructor is installed. The overhead is one extra kmem_cache_zalloc per first descriptor on 32-bit only; 64-bit builds are completely unchanged. Closes: https://lore.kernel.org/all/20260419045824.D9E5EC2BCAF@smtp.kernel.org/ Fixes: 0ebc27a4c67d ("xsk: avoid data corruption on cq descriptor number") Signed-off-by: Jason Xing Acked-by: Stanislav Fomichev Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20260502200722.53960-9-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit e0f229025a8e774a695017a376c4a01279c0e66e Author: Jason Xing Date: Sat May 2 23:07:21 2026 +0300 xsk: fix xsk_addrs slab leak on multi-buffer error path When xsk_build_skb() / xsk_build_skb_zerocopy() sees the first continuation descriptor, it promotes destructor_arg from an inlined address to a freshly allocated xsk_addrs (num_descs = 1). The counter is bumped to >= 2 only at the very end of a successful build (by calling xsk_inc_num_desc()). If the build fails in between (e.g. alloc_page() returns NULL with -EAGAIN, or the MAX_SKB_FRAGS overflow hits), we jump to free_err, skip calling xsk_inc_num_desc() to increment num_descs and leave the half-built skb attached to xs->skb for the app to retry. The skb now has 1) destructor_arg = a real xsk_addrs pointer, 2) num_descs = 1 If the app never retries and just close()s the socket, xsk_release() calls xsk_drop_skb() -> xsk_consume_skb(), which decides whether to free xsk_addrs by testing num_descs > 1: if (unlikely(num_descs > 1)) kmem_cache_free(xsk_tx_generic_cache, destructor_arg); Because num_descs is exactly 1 the branch is skipped and the xsk_addrs object is leaked to the xsk_tx_generic_cache slab. Fix it by directly testing if destructor_arg is still addr. Or else it is modified and used to store the newly allocated memory from xsk_tx_generic_cache regardless of increment of num_desc, which we need to handle. Closes: https://lore.kernel.org/all/20260419045824.D9E5EC2BCAF@smtp.kernel.org/ Fixes: 0ebc27a4c67d ("xsk: avoid data corruption on cq descriptor number") Acked-by: Stanislav Fomichev Signed-off-by: Jason Xing Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20260502200722.53960-8-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 8c2cff50afdd2b53c7cc2ca2297301c0ffd3e802 Author: Jason Xing Date: Sat May 2 23:07:20 2026 +0300 xsk: avoid skb leak in XDP_TX_METADATA case Fix it by explicitly adding kfree_skb() before returning back to its caller. How to reproduce it in virtio_net: 1. the current skb is the first one (which means no frag and xs->skb is NULL) and users enable metadata feature. 2. xsk_skb_metadata() returns a error code. 3. the caller xsk_build_skb() clears skb by using 'skb = NULL;'. 4. there is no chance to free this skb anymore. Closes: https://lore.kernel.org/all/20260415085204.3F87AC19424@smtp.kernel.org/ Fixes: 30c3055f9c0d ("xsk: wrap generic metadata handling onto separate function") Acked-by: Stanislav Fomichev Signed-off-by: Jason Xing Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20260502200722.53960-7-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 3dec153ae484e3b2ddac841156e197ba54c8df94 Author: Jason Xing Date: Sat May 2 23:07:19 2026 +0300 xsk: prevent CQ desync when freeing half-built skbs in xsk_build_skb() Once xsk_skb_init_misc() has been called on an skb, its destructor is set to xsk_destruct_skb(), which submits the descriptor address(es) to the completion queue and advances the CQ producer. If such an skb is subsequently freed via kfree_skb() along an error path - before the skb has ever been handed to the driver - the destructor still runs and submits a bogus, half-initialized address to the CQ. Postpone the init phase when we believe the allocation of first frag is successfully completed. Before this init, skb can be safely freed by kfree_skb(). Closes: https://lore.kernel.org/all/20260419045822.843BFC2BCAF@smtp.kernel.org/ Fixes: c30d084960cf ("xsk: avoid overwriting skb fields for multi-buffer traffic") Acked-by: Stanislav Fomichev Signed-off-by: Jason Xing Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20260502200722.53960-6-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 0f3776583d282550dbafe6082a914efcf9094d59 Author: Jason Xing Date: Sat May 2 23:07:18 2026 +0300 xsk: fix use-after-free of xs->skb in xsk_build_skb() free_err path When xsk_build_skb() processes multi-buffer packets in copy mode, the first descriptor stores data into the skb linear area without adding any frags, so nr_frags stays at 0. The caller then sets xs->skb = skb to accumulate subsequent descriptors. If a continuation descriptor fails (e.g. alloc_page returns NULL with -EAGAIN), we jump to free_err where the condition: if (skb && !skb_shinfo(skb)->nr_frags) kfree_skb(skb); evaluates to true because nr_frags is still 0 (the first descriptor used the linear area, not frags). This frees the skb while xs->skb still points to it, creating a dangling pointer. On the next transmit attempt or socket close, xs->skb is dereferenced, causing a use-after-free or double-free. Fix by using a !xs->skb check to handle first frag situation, ensuring we only free skbs that were freshly allocated in this call (xs->skb is NULL) and never free an in-progress multi-buffer skb that the caller still references. Closes: https://lore.kernel.org/all/20260415082654.21026-4-kerneljasonxing@gmail.com/ Fixes: 6b9c129c2f93 ("xsk: remove @first_frag from xsk_build_skb()") Acked-by: Stanislav Fomichev Signed-off-by: Jason Xing Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20260502200722.53960-5-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 8cd3c1c6e7d9a1f0954159ec5f2fdaa7f6a48bd8 Author: Jason Xing Date: Sat May 2 23:07:17 2026 +0300 xsk: handle NULL dereference of the skb without frags issue When a first descriptor (xs->skb == NULL) triggers -EOVERFLOW in xsk_build_skb_zerocopy() (e.g., MAX_SKB_FRAGS exceeded), the free_err -EOVERFLOW handler unconditionally dereferences xs->skb via xsk_inc_num_desc(xs->skb) and xsk_drop_skb(xs->skb), causing a NULL pointer dereference. Fix this by guarding the existing xsk_inc_num_desc()/xsk_drop_skb() calls with an xs->skb check (for the continuation case), and add an else branch for the first-descriptor case that manually cancels the one reserved CQ slot and increments invalid_descs by one to account for the single invalid descriptor. Fixes: cf24f5a5feea ("xsk: add support for AF_XDP multi-buffer on Tx path") Acked-by: Stanislav Fomichev Signed-off-by: Jason Xing Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20260502200722.53960-4-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 0bb7a9caf5c1d6e25ba376ea6b39261ad28550f4 Author: Jason Xing Date: Sat May 2 23:07:16 2026 +0300 xsk: free the skb when hitting the upper bound MAX_SKB_FRAGS Fix it by explicitly adding kfree_skb() before returning back to its caller. How to reproduce it in virtio_net: 1. the current skb is the first one (which means xs->skb is NULL) and hit the limit MAX_SKB_FRAGS. 2. xsk_build_skb_zerocopy() returns -EOVERFLOW. 3. the caller xsk_build_skb() clears skb by using 'skb = NULL;'. This is why bug can be triggered. 4. there is no chance to free this skb anymore. Note that if in this case the xs->skb is not NULL, xsk_build_skb() will call xsk_drop_skb(xs->skb) to do the right thing. Fixes: cf24f5a5feea ("xsk: add support for AF_XDP multi-buffer on Tx path") Acked-by: Stanislav Fomichev Signed-off-by: Jason Xing Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20260502200722.53960-3-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit d73a9a63f9f7f7c17637731fd28daf3665992d1e Author: Jason Xing Date: Sat May 2 23:07:15 2026 +0300 xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devices skb_checksum_help() is a common helper that writes the folded 16-bit checksum back via skb->data + csum_start + csum_offset, i.e. it relies on the skb's linear head and fails (with WARN_ONCE and -EINVAL) when skb_headlen() is 0. AF_XDP generic xmit takes two very different paths depending on the netdev. Drivers that advertise IFF_TX_SKB_NO_LINEAR (e.g. virtio_net) skip the "copy payload into a linear head" step on purpose as a performance optimisation: xsk_build_skb_zerocopy() only attaches UMEM pages as frags and never calls skb_put(), so skb_headlen() stays 0 for the whole skb. For these skbs there is simply no linear area for skb_checksum_help() to write the csum into - the sw-csum fallback is structurally inapplicable. The patch tries to catch this and reject the combination with error at setup time. Rejecting at bind() converts this silent per-packet failure into a synchronous, actionable -EOPNOTSUPP at setup time. HW csum and launch_time metadata on IFF_TX_SKB_NO_LINEAR drivers are unaffected because they do not call skb_checksum_help(). Without the patch, every descriptor carrying 'XDP_TX_METADATA | XDP_TXMD_FLAGS_CHECKSUM' produces: 1) a WARN_ONCE "offset (N) >= skb_headlen() (0)" from skb_checksum_help(), 2) sendmsg() returning -EINVAL without consuming the descriptor (invalid_descs is not incremented), 3) a wedged TX ring: __xsk_generic_xmit() does not advance the consumer on non-EOVERFLOW errors, so the next sendmsg() re-reads the same descriptor and re-hits the same WARN until the socket is closed. Closes: https://lore.kernel.org/all/20260419045822.843BFC2BCAF@smtp.kernel.org/#t Acked-by: Stanislav Fomichev Signed-off-by: Jason Xing Acked-by: Stanislav Fomichev Signed-off-by: Jason Xing Reviewed-by: Alexander Lobakin Fixes: 30c3055f9c0d ("xsk: wrap generic metadata handling onto separate function") Link: https://patch.msgid.link/20260502200722.53960-2-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit f583bd5f64d40e083dde5bb22846c4d93e59d471 Author: Krzysztof Kozlowski Date: Tue Mar 17 14:08:25 2026 +0100 powerpc/pasemi: Drop redundant res assignment Return value of pas_add_bridge() is not used, so code can be simplified to fix W=1 clang warnings: arch/powerpc/platforms/pasemi/pci.c:275:6: error: variable 'res' set but not used [-Werror,-Wunused-but-set-variable] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260317130823.240279-4-krzysztof.kozlowski@oss.qualcomm.com commit 8333e4916040e529bd5b56b82d573aba51e88a14 Author: Krzysztof Kozlowski Date: Tue Mar 17 14:08:24 2026 +0100 powerpc/ps3: Drop redundant result assignment Return value of ps3_start_probe_thread() is not used, so code can be simplified to fix W=1 clang warnings: arch/powerpc/platforms/ps3/device-init.c:953:6: error: variable 'result' set but not used [-Werror,-Wunused-but-set-variable] Signed-off-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260317130823.240279-3-krzysztof.kozlowski@oss.qualcomm.com commit 60c71369ee356d11ad845ddeb28ceb70ec6cd70e Author: Nathan Chancellor Date: Wed Mar 11 17:39:56 2026 -0700 powerpc/vdso: Drop -DCC_USING_PATCHABLE_FUNCTION_ENTRY from 32-bit flags with clang After commit 73cdf24e81e4 ("powerpc64: make clang cross-build friendly"), building 64-bit little endian + CONFIG_COMPAT=y with clang results in many warnings along the lines of: $ cat arch/powerpc/configs/compat.config CONFIG_COMPAT=y $ make -skj"$(nproc)" ARCH=powerpc LLVM=1 ppc64le_defconfig compat.config arch/powerpc/kernel/vdso/ ... In file included from :4: In file included from lib/vdso/gettimeofday.c:6: In file included from include/vdso/datapage.h:15: In file included from include/vdso/cache.h:5: arch/powerpc/include/asm/cache.h:77:8: warning: unknown attribute 'patchable_function_entry' ignored [-Wunknown-attributes] 77 | static inline u32 l1_icache_bytes(void) | ^~~~~~ include/linux/compiler_types.h:235:58: note: expanded from macro 'inline' 235 | #define inline inline __gnu_inline __inline_maybe_unused notrace | ^~~~~~~ include/linux/compiler_types.h:215:34: note: expanded from macro 'notrace' 215 | #define notrace __attribute__((patchable_function_entry(0, 0))) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... arch/powerpc/Makefile adds -DCC_USING_PATCHABLE_FUNCTION_ENTRY to KBUILD_CPPFLAGS, which is inherited by the 32-bit vDSO. However, the 32-bit little endian target does not support '-fpatchable-function-entry', resulting in the warnings above. Remove -DCC_USING_PATCHABLE_FUNCTION_ENTRY from the 32-bit vDSO flags when building with clang to avoid the warnings. Fixes: 73cdf24e81e4 ("powerpc64: make clang cross-build friendly") Signed-off-by: Nathan Chancellor Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260311-ppc-vdso-drop-cc-using-pfe-define-clang-v1-1-66c790e22650@kernel.org commit 525cb7ba6661074c1c5cc3772bccc6afab6791ef Author: Tzung-Bi Shih Date: Tue May 5 05:34:03 2026 +0000 platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration cros_typec_register_thunderbolt() missed initializing the `adata->lock` mutex. This leads to a NULL dereference when the mutex is later acquired (e.g. in cros_typec_altmode_work()). Initialize the mutex in cros_typec_register_thunderbolt() to fix the issue. Cc: stable@vger.kernel.org Fixes: 3b00be26b16a ("platform/chrome: cros_ec_typec: Thunderbolt support") Reviewed-by: Benson Leung Reviewed-by: Abhishek Pandit-Subedi Link: https://lore.kernel.org/r/20260505053403.3335740-1-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih commit 22675f07260ca26423851a42b553b0ea669228d1 Merge: af0e9b26b9667d d466ddda5500b6 Author: Jakub Kicinski Date: Tue May 5 19:13:12 2026 -0700 Merge branch 'net-mlx5-fixes-for-socket-direct' Tariq Toukan says: ==================== net/mlx5: Fixes for Socket-Direct This series fixes several race conditions and bugs in the mlx5 Socket-Direct (SD) single netdev flow. Patch 1 serializes mlx5_sd_init()/mlx5_sd_cleanup() with mlx5_devcom_comp_lock() and tracks the SD group state on the primary device, preventing concurrent or duplicate bring-up/tear-down. Patch 2 fixes the debugfs "multi-pf" directory being stored on the calling device's sd struct instead of the primary's, which caused memory leaks and recreation errors when cleanup ran from a different PF. Patch 3 fixes a race where a secondary PF could access the primary's auxiliary device after it had been unbound, by holding the primary's device lock while operating on its auxiliary device. Patch 4 fixes missing cleanup on ETH probe errors. The analogous gap on the resume path requires introducing sd_suspend/resume APIs that only destroy FW resources and is left for a follow-up series. ==================== Link: https://patch.msgid.link/20260504180206.268568-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d466ddda5500b6b8ae060909d2317811f2c32a6a Author: Shay Drory Date: Mon May 4 21:02:06 2026 +0300 net/mlx5e: SD, Fix race condition in secondary device probe/remove When utilizing Socket-Direct single netdev functionality the driver resolves the actual auxiliary device using mlx5_sd_get_adev(). However, the current implementation returns the primary ETH auxiliary device without holding the device lock, leading to a potential race condition where the ETH device could be unbound or removed concurrently during probe, suspend, resume, or remove operations.[1] Fix this by introducing mlx5_sd_put_adev() and updating mlx5_sd_get_adev() so that secondaries devices would get a ref and acquire the device lock of the returned auxiliary device. After the lock is acquired, a second devcom check is needed[2]. In addition, update The callers to pair the get operation with the new put operation, ensuring the lock is held while the auxiliary device is being operated on and released afterwards. The "primary" designation is determined once in sd_register(). It's set before devcom is marked ready, and it never changes after that. In Addition, The primary path never locks a secondary: When the primary device invoke mlx5_sd_get_adev(), it sees dev == primary and returns. no additional lock is taken. Therefore lock ordering is always: secondary_lock -> primary_lock. The reverse never happens, so ABBA deadlock is impossible. [1] for example: BUG: kernel NULL pointer dereference, address: 0000000000000370 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP CPU: 4 UID: 0 PID: 3945 Comm: bash Not tainted 6.19.0-rc3+ #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_dcbnl_dscp_app+0x23/0x100 [mlx5_core] Call Trace: mlx5e_remove+0x82/0x12a [mlx5_core] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x140 device_del+0x159/0x3c0 ? devl_param_driverinit_value_get+0x29/0x80 mlx5_rescan_drivers_locked+0x92/0x160 [mlx5_core] mlx5_unregister_device+0x34/0x50 [mlx5_core] mlx5_uninit_one+0x43/0xb0 [mlx5_core] remove_one+0x4e/0xc0 [mlx5_core] pci_device_remove+0x39/0xa0 device_release_driver_internal+0x194/0x1f0 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x55/0xe90 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] CPU0 (primary) CPU1 (secondary) ========================================================================== mlx5e_remove() (device_lock held) mlx5e_remove() (2nd device_lock held) mlx5_sd_get_adev() mlx5_devcom_comp_is_ready() => true device_lock(primary) mlx5_sd_get_adev() ==> ret adev _mlx5e_remove() mlx5_sd_cleanup() // mlx5e_remove finished // releasing device_lock //need another check here... mlx5_devcom_comp_is_ready() => false Fixes: 381978d28317 ("net/mlx5e: Create single netdev per SD group") Signed-off-by: Shay Drory Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260504180206.268568-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 3564222cfdde83a2d760b80192155a3ada1c9bdd Author: Shay Drory Date: Mon May 4 21:02:05 2026 +0300 net/mlx5e: SD, Fix missing cleanup on probe error When _mlx5e_probe() fails, the preceding successful mlx5_sd_init() is not undone. Auxiliary bus probe failure skips binding, so mlx5e_remove() is never called for that adev and the matching mlx5_sd_cleanup() never runs - leaking the per-dev SD struct. Call mlx5_sd_cleanup() on the probe error path to balance mlx5_sd_init(). A similar gap exists on the resume path: mlx5_sd_init() and mlx5_sd_cleanup() are currently bundled with both probe/remove and suspend/resume, even though only the FW alias state actually needs to follow the suspend/resume lifecycle - the sd struct allocation and devcom membership are software state that should track the full bound lifetime. As a result, a failed resume can leave a still-bound device with sd == NULL, which mlx5_sd_get_adev() can't distinguish from a non-SD device. Fixing this requires sd_suspend/resume APIs which will only destroy FW resources and is left for a follow-up series. Fixes: 381978d28317 ("net/mlx5e: Create single netdev per SD group") Signed-off-by: Shay Drory Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260504180206.268568-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 05217e4ffbb229e7218cf318e0033780abadb624 Author: Shay Drory Date: Mon May 4 21:02:04 2026 +0300 net/mlx5: SD, Keep multi-pf debugfs entries on primary mlx5_sd_init() creates the "multi-pf" debugfs directory under the primary device debugfs root, but stored the dentry in the calling device's sd struct. When sd_cleanup() run on a different PF, this leads to using the wrong sd->dfs for removing entries, which results in memory leak and an error in when re-creating the SD.[1] Fix it by explicitly storing the debugfs dentry in the primary device sd struct and use it for all per-group files. [1] debugfs: 'multi-pf' already exists in '0000:08:00.1' Fixes: 4375130bf527 ("net/mlx5: SD, Add debugfs") Signed-off-by: Shay Drory Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260504180206.268568-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 3abcedfdfd3125431ed404fa75724118beac630b Author: Shay Drory Date: Mon May 4 21:02:03 2026 +0300 net/mlx5: SD: Serialize init/cleanup mlx5_sd_init() / mlx5_sd_cleanup() may run from multiple PFs in the same Socket-Direct group. This can cause the SD bring-up/tear-down sequence to be executed more than once or interleaved across PFs. Protect SD init/cleanup with mlx5_devcom_comp_lock() and track the SD group state on the primary device. Skip init if the primary is already UP, and skip cleanup unless the primary is UP. The state check on cleanup is needed because sd_register() drops the devcom comp lock between marking the comp ready and assigning primary_dev on each peer. A concurrent cleanup that acquires the lock in this window would observe devcom_is_ready==true while primary_dev is still NULL (causing mlx5_sd_get_primary() to return NULL) or while the FW alias setup performed by mlx5_sd_init()'s body has not yet run (causing sd_cmd_unset_primary() to dereference a NULL tx_ft). Gate the cleanup body on primary_sd->state == MLX5_SD_STATE_UP, which is set only at the very end of mlx5_sd_init() under the same comp lock - so observing UP guarantees primary_dev, secondaries[], tx_ft, and dfs are all populated. Also bail explicitly if mlx5_sd_get_primary() returns NULL, in case state is checked on a peer whose primary_dev hasn't been assigned yet. In addition, move mlx5_devcom_comp_set_ready(false) from sd_unregister() into the cleanup's locked section, including the !primary and state != UP early-exit paths, so the device cannot unregister and free its struct mlx5_sd while devcom is still marked ready. A concurrent init acquiring the devcom lock will now observe devcom is no longer ready and bail out immediately. Fixes: 381978d28317 ("net/mlx5e: Create single netdev per SD group") Signed-off-by: Shay Drory Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260504180206.268568-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 4052b932041614675fa2dbf48f725557c23ebf05 Author: Thomas Zimmermann Date: Wed Apr 1 10:30:03 2026 +0200 arch/powerpc: Drop CONFIG_FIRMWARE_EDID from defconfig files CONFIG_FIRMWARE_EDID=y depends on X86 or EFI_GENERIC_STUB. Neither is true here, so drop the lines from the defconfig files. Signed-off-by: Thomas Zimmermann Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260401083023.214426-1-tzimmermann@suse.de commit af0e9b26b9667d765d71a7f53b7ed242eb1ba671 Merge: 0e7c074cfcd9bd c4a5c46199b5ad Author: Jakub Kicinski Date: Tue May 5 19:09:07 2026 -0700 Merge branch 'net-mlx5e-psp-fixes' Tariq Toukan says: ==================== net/mlx5e: PSP fixes This patchset provides bug fixes from Cosmin to the mlx5e PSP feature. ==================== Link: https://patch.msgid.link/20260504181100.269334-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit c4a5c46199b5addf0157934da3aa89c33eb02a6d Author: Cosmin Ratiu Date: Mon May 4 21:11:00 2026 +0300 net/mlx5e: psp: Hook PSP dev reg/unreg to profile enable/disable devlink reload while PSP connections are active does: mlx5_unload_one_devl_locked() -> mlx5_detach_device() -> _mlx5e_suspend() -> mlx5e_detach_netdev() -> profile->cleanup_rx -> profile->cleanup_tx -> mlx5e_destroy_mdev_resources() -> mlx5_core_dealloc_pd() fails: ... mlx5_core 0000:08:00.0: mlx5_cmd_out_err:821:(pid 19722): DEALLOC_PD(0x801) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0xef0c8a), err(-22) ... The reason for failure is the existence of TX keys, which are removed by the PSP dev unregistration happening in: profile->cleanup() -> mlx5e_psp_unregister() -> mlx5e_psp_cleanup() -> psp_dev_unregister() ...but this isn't invoked in the devlink reload flow, only when changing the NIC profile (e.g. when transitioning to switchdev mode) or on dev teardown. Move PSP device registration into mlx5e_nic_enable(), and unregistration into the corresponding mlx5e_nic_disable(). These functions are called during netdev attach/detach after RX & TX are set up. This ensures that the keys will be gone by the time the PD is destroyed. Fixes: 89ee2d92f66c ("net/mlx5e: Support PSP offload functionality") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260504181100.269334-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 50690733db59fbb3de9fa811b606af324eeb4e37 Author: Cosmin Ratiu Date: Mon May 4 21:10:59 2026 +0300 net/mlx5e: psp: Expose only a fully initialized priv->psp Currently, during PSP init, priv->psp is initialized to an incompletely built psp struct. Additionally, on fs init failure priv->psp is reset to NULL. Change this so that only a fully initialized priv->psp is set, which makes the code easier to reason about in failure scenarios. Fixes: af2196f49480 ("net/mlx5e: Implement PSP operations .assoc_add and .assoc_del") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260504181100.269334-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ae9582cd0b9ccc4a121af300df68fd27f72e9822 Author: Cosmin Ratiu Date: Mon May 4 21:10:58 2026 +0300 net/mlx5e: psp: Fix invalid access on PSP dev registration fail priv->psp->psp is initialized with the PSP device as returned by psp_dev_create(). This could also return an error, in which case a future psp_dev_unregister() will result in unpleasantness. Avoid that by using a local variable and only saving the PSP device when registration succeeds. In case psp_dev_create() fails, priv->psp and steering structs are left in place, but they will be inert. The unchecked access of priv->psp in mlx5e_psp_offload_handle_rx_skb() won't happen because without a PSP device, there can be no SAs added and therefore no packets will be successfully decrypted and be handed off to the SW handler. Fixes: 89ee2d92f66c ("net/mlx5e: Support PSP offload functionality") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260504181100.269334-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 131717e656b379addb95af2dcb2d90c723bae24b Author: Shivani Nittor Date: Tue Apr 21 20:36:28 2026 +0530 powerpc/perf: Update check for PERF_SAMPLE_DATA_SRC marked events The core-book3s PMU sampling code validates the SIER TYPE field when PERF_SAMPLE_DATA_SRC is requested. The SIER TYPE field indicates the instruction type and is only valid for random sampling (marked events). To handle cases observed where SIER TYPE could be zero even for marked events,validation was added to drop such samples and increment event->lost_samples. However, this validation was applied to all samples, including continuous sampling. In continuous sampling mode, the PMU does not set the SIER TYPE field, so it remains zero. As a result, valid continuous samples were incorrectly treated as invalid and dropped. Fixed this by gating the SIER TYPE validation with mark_event, so the check runs only for marked (random) events. Continuous samples now skip this check and are recorded normally in the final data recording path. Fixes: 2ffb26afa642 ("arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src") Signed-off-by: Shivani Nittor Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Reviewed-by: Athira Rajeev [Maddy: Fixed reviewed-by tag] Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260421150628.96500-1-shivani@linux.ibm.com commit da107152c43915211e1fc0319b9526f4241abca2 Author: Christophe Leroy (CS GROUP) Date: Tue Apr 21 08:26:08 2026 +0200 powerpc/8xx: Fix interrupt mask in cpm1_gpiochip_add16() Allthough fsl,cpm1-gpio-irq-mask always contains a 16 bits value, it is a standard u32 OF property as documented in Documentation/devicetree/bindings/soc/fsl/cpm_qe/gpio.txt The driver erroneously uses of_property_read_u16() leading to a mask which is always 0. Fix it by using of_property_read_u32() instead. Fixes: 726bd223105c ("powerpc/8xx: Adding support of IRQ in MPC8xx GPIO") Signed-off-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/bb0b6d6c4543238c38d5d29a776d0674a8c0c180.1776752750.git.chleroy@kernel.org commit 0e7c074cfcd9bd93765505f9eb8b42f03ed2a744 Author: Pavitra Jha Date: Fri May 1 07:07:12 2026 -0400 net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler t7xx_port_enum_msg_handler() uses the modem-supplied port_count field as a loop bound over port_msg->data[] without checking that the message buffer contains sufficient data. A modem sending port_count=65535 in a 12-byte buffer triggers a slab-out-of-bounds read of up to 262140 bytes. Add a sizeof(*port_msg) check before accessing the port message header fields to guard against undersized messages. Add a struct_size() check after extracting port_count and before the loop. In t7xx_parse_host_rt_data(), guard the rt_feature header read with a remaining-buffer check before accessing data_len, validate feat_data_len against the actual remaining buffer to prevent OOB reads and signed integer overflow on offset. Pass msg_len from both call sites: skb->len at the DPMAIF path after skb_pull(), and the validated feat_data_len at the handshake path. Fixes: da45d2566a1d ("net: wwan: t7xx: Add control port") Cc: stable@vger.kernel.org Signed-off-by: Pavitra Jha Link: https://patch.msgid.link/20260501110713.145563-1-jhapavitra98@gmail.com Signed-off-by: Jakub Kicinski commit 38e989d504fc52900a3786b7144fb53cd67e0389 Author: Sourabh Jain Date: Tue Apr 7 18:13:45 2026 +0530 powerpc/vmx: avoid KASAN instrumentation in enter_vmx_ops() for kexec The kexec sequence invokes enter_vmx_ops() via copy_page() with the MMU disabled. In this context, code must not rely on normal virtual address translations or trigger page faults. With KASAN enabled, functions get instrumented and may access shadow memory using regular address translation. When executed with the MMU off, this can lead to page faults (bad_page_fault) from which the kernel cannot recover in the kexec path, resulting in a hang. The kexec path sets preempt_count to HARDIRQ_OFFSET before entering the MMU-off copy sequence. current_thread_info()->preempt_count = HARDIRQ_OFFSET kexec_sequence(..., copy_with_mmu_off = 1) -> kexec_copy_flush(image) copy_segments() -> copy_page(dest, addr) bl enter_vmx_ops() if (in_interrupt()) return 0 beq .Lnonvmx_copy Since kexec sets preempt_count to HARDIRQ_OFFSET, in_interrupt() evaluates to true and enter_vmx_ops() returns early. As in_interrupt() (and preempt_count()) are always inlined, mark enter_vmx_ops() with __no_sanitize_address to avoid KASAN instrumentation and shadow memory access with MMU disabled, helping kexec boot fine with KASAN enabled. Reported-by: Aboorva Devarajan Reviewed-by: Aboorva Devarajan Tested-by: Aboorva Devarajan Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260407124349.1698552-2-sourabhjain@linux.ibm.com commit b3a97f9484080c6e71db9e803e3cc1bb372a9bc7 Author: Sourabh Jain Date: Tue Apr 7 18:13:44 2026 +0530 powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o KASAN instrumentation is intended to be disabled for the kexec core code, but the existing Makefile entry misses the object suffix. As a result, the flag is not applied correctly to core_$(BITS).o. So when KASAN is enabled, kexec_copy_flush and copy_segments in kexec/core_64.c are instrumented, which can result in accesses to shadow memory via normal address translation paths. Since these run with the MMU disabled, such accesses may trigger page faults (bad_page_fault) that cannot be handled in the kdump path, ultimately causing a hang and preventing the kdump kernel from booting. The same is true for kexec as well, since the same functions are used there. Update the entry to include the “.o” suffix so that KASAN instrumentation is properly disabled for this object file. Fixes: 2ab2d5794f14 ("powerpc/kasan: Disable address sanitization in kexec paths") Reported-by: Venkat Rao Bagalkote Closes: https://lore.kernel.org/all/1dee8891-8bcc-46b4-93f3-fc3a774abd5b@linux.ibm.com/ Cc: stable@vger.kernel.org Reviewed-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Acked-by: Mahesh Salgaonkar Reviewed-by: Aboorva Devarajan Tested-by: Aboorva Devarajan Signed-off-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260407124349.1698552-1-sourabhjain@linux.ibm.com commit 629d1a901de57490d29a495273df11e64993ec04 Author: Ritesh Harjani (IBM) Date: Fri May 1 09:41:48 2026 +0530 pseries/papr-hvpipe: Fix style and checkpatch issues in enable_hvpipe_IRQ() While at it let's also fix the similar style issue in enable_hvpipe_IRQ() function. This also fixes a minor checkpatch warning which I got due to an extra space before " ==". Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/1174f60d0ae128e773dbefd11dd8d46d69e7f50e.1777606826.git.ritesh.list@gmail.com commit fe53d2ae82c06aa2d6402624af01e8f8ddfcd5b3 Author: Ritesh Harjani (IBM) Date: Fri May 1 09:41:47 2026 +0530 pseries/papr-hvpipe: Refactor and simplify hvpipe_rtas_recv_msg() Simplify hvpipe_rtas_recv_msg() by removing three levels of nesting... if (!ret) if (buf) if (size < bytes_written) ... this refactoring of the function bails out to "out:" label first, in case of any error. This simplifies the init flow. Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/bbe7ddf8b8e25c9be8fc5e2c4aea9e5fca128bf4.1777606826.git.ritesh.list@gmail.com commit 4e2d83c80495a9327141e8636f25dde13155f14f Author: Ritesh Harjani (IBM) Date: Fri May 1 09:41:46 2026 +0530 pseries/papr-hvpipe: Kill task_struct pointer from struct hvpipe_source_info We don't really use task_struct pointer for anything meaningful. So just kill it for now, and we can bring back later if we need this for any future debug purposes. Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/895e061e45cdc95db36fa7f27aa1922b81eed867.1777606826.git.ritesh.list@gmail.com commit 2eeac577480848801b35885b3a8201aa35f46236 Author: Ritesh Harjani (IBM) Date: Fri May 1 09:41:45 2026 +0530 pseries/papr-hvpipe: Simplify spin unlock usage in papr_hvpipe_handle_release() Once the src_info is removed from the global list, no one can access it. This simplies the usage of spin_unlock_irqrestore() in papr_hvpipe_handle_release() Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/4a980331557af3d10aada8576aaa16cddc691c65.1777606826.git.ritesh.list@gmail.com commit d48654bd8b1a75f662e224d257db54de475120dc Author: Ritesh Harjani (IBM) Date: Fri May 1 09:41:44 2026 +0530 pseries/papr-hvpipe: Fix the usage of copy_to_user() copy_to_user() return bytes_not_copied to the user buffer. If there was an error writing bytes into the user buffer, i.e. if copy_to_user returns a non-zero value, then we should simply return -EFAULT from the ->read() call. Otherwise, in the non-patched version, we may end up mixing "bytes_not_copied + bytes_copied (HVPIPE_HDR_LEN)" as the return value to the user in ->read() call Also let's make sure we clear the hvpipe_status flag, if we have consumed the hvpipe msg by making the rtas call. ret = -EFAULT means copy_to_user has failed but that still means that the msg was read from the hvpipe, hence for both cases, success & -EFAULT, we should clear the HVPIPE_MSG_AVAILABLE flag in hvpipe_status. Cc: stable@vger.kernel.org Fixes: cebdb522fd3edd1 ("powerpc/pseries: Receive payload with ibm,receive-hvpipe-msg RTAS") Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/8fda3212a1ad48879c174e92f67472d9b9f1c3b7.1777606826.git.ritesh.list@gmail.com commit 713e468cdbc2277db6ce949c32c1acbd83501733 Author: Ritesh Harjani (IBM) Date: Fri May 1 09:41:43 2026 +0530 pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Remove such 3 levels of nesting patterns to check success return values from function calls. ret = enable_hvpipe_IRQ() if (!ret) ret = set_hvpipe_sys_param(1) if (!ret) ret = misc_register() Instead just bail out to "out*:" labels, in case of any error. This simplifies the init flow. While at it let's also fix the following error handling logic: We have already enabled interrupt sources and enabled hvpipe to received interrupts, if misc_register() fails, we will destroy the workqueue, but the HMC might send us a msg via hvpipe which will call, queue work on the workqueue which might be destroyed. So instead, let's reverse the order of enabling set_hvpipe_sys_param(1) and in case of an error let's remove the misc dev by calling misc_deregister(). Cc: stable@vger.kernel.org Fixes: 39a08a4f94980 ("powerpc/pseries: Enable hvpipe with ibm,set-system-parameter RTAS") Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/f2141eafb80e7780395e03aa9a22e8a37be80513.1777606826.git.ritesh.list@gmail.com commit 1b9f7aafa44f5ce852c00509104d10fd9eb0f402 Author: Ritesh Harjani (IBM) Date: Fri May 1 09:41:42 2026 +0530 pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() commit 6d3789d347a7 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()"), changed the create handle to FD_PREPARE(), but it caused kernel null-ptr-deref because after call to retain_and_null_ptr(src_info), src_info is re-used for adding it to the global list. Getting the following kernel panic in papr_hvpipe_dev_create_handle() when trying to add src_info to the list. Kernel attempted to write user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on write at 0x00000000 Faulting instruction address: 0xc0000000001b44a0 Oops: Kernel access of bad area, sig: 11 [#1] ... Call Trace: papr_hvpipe_dev_ioctl+0x1f4/0x48c (unreliable) sys_ioctl+0x528/0x1064 system_call_exception+0x128/0x360 system_call_vectored_common+0x15c/0x2ec Now, the error handling with FD_PREPARE's file cleanup and __free(kfree) auto cleanup is getting too convoluted. This is mainly because we need to ensure only 1 user get the srcID handle. To simplify this, we allocate prepare the src_info in the beginning and add it to the global list under a spinlock after checking that no duplicates exist. This simplify the error handling where if the FD_ADD fails, we can simply remove the src_info from the list and consume any pending msg in hvpipe to be cleared, after src_info became visible in the global list. Cc: stable@vger.kernel.org Fixes: 6d3789d347a7 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()") Reported-by: Haren Myneni Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/31ad94bc89d44156ee700c5bd006cb47a748e3cb.1777606826.git.ritesh.list@gmail.com commit cefeed44296261173a806bef988b26bc565da4be Author: Ritesh Harjani (IBM) Date: Fri May 1 09:41:41 2026 +0530 pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace The hdr variable is allocated on the stack and only hdr.version and hdr.flags are initialized explicitly. Because the struct papr_hvpipe_hdr contains reserved padding bytes (reserved[3] and reserved2[40]), these could leak the uninitialized bytes to userspace after copy_to_user(). This patch fixes that by initializing the whole struct to 0. Cc: stable@vger.kernel.org Fixes: cebdb522fd3ed ("powerpc/pseries: Receive payload with ibm,receive-hvpipe-msg RTAS") Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/7bfe03b65a282c856ed8182d1871bb973c0b78f2.1777606826.git.ritesh.list@gmail.com commit 7a4f0846ee6cc8cf44ae0046ed42e3259d1dd45b Author: Ritesh Harjani (IBM) Date: Fri May 1 09:41:40 2026 +0530 pseries/papr-hvpipe: Fix race with interrupt handler While executing ->ioctl handler or ->release handler, if an interrupt fires on the same cpu, then we can enter into a deadlock. This patch fixes both these handlers to take spin_lock_irq{save|restore} versions of the lock to prevent this deadlock. Cc: stable@vger.kernel.org Fixes: 814ef095f12c9 ("powerpc/pseries: Add papr-hvpipe char driver for HVPIPE interfaces") Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/e4ed435c44fc191f2eb23c7907ba6f72f193e6aa.1777606826.git.ritesh.list@gmail.com commit 0342545a29bc2edfbe132c68c68b51c92a12444c Author: Athira Rajeev Date: Sat Mar 14 18:59:53 2026 +0530 powerpc/pseries/htmdump: Add memory configuration dump support to htmdump module H_HTM (Hardware Trace Macro) hypervisor call has capability to capture SystemMemory Configuration. This information helps to understand the address mapping for the partitions in the system. Support dumping system memory configuration from Hardware Trace Macro (HTM) function via debugfs interface. Under debugfs folder "/sys/kernel/debug/powerpc/htmdump", add file "htmsystem_mem". The interface allows only read of this file which will present the content of HTM buffer from the hcall. The 16th offset of HTM buffer has value for the number of entries for array of processors. Use this information to copy data to the debugfs file Signed-off-by: Athira Rajeev Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260314132953.27269-1-atrajeev@linux.ibm.com commit 0031424cbc0a6eafc56a8f9201a4a69d3649981e Author: Athira Rajeev Date: Sat Mar 14 18:54:32 2026 +0530 powerpc/pseries/htmdump: Fix the offset value used in htm status dump H_HTM call is invoked using three parameters specifying the address of the buffer, size of the buffer and offset where to read from. offset used was always zero. "offset" is value from output buffer header that points to next entry to dump. zero is the first entry to dump. next entry is read from the output bufferbyte offset 0x8. Update htmstatus_read() function to use right offset. Return when offset points to -1 Fixes: 627cf584f4c3 ("powerpc/pseries/htmdump: Add htm status support to htmdump module") Signed-off-by: Athira Rajeev Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260314132432.25581-3-atrajeev@linux.ibm.com commit 4ec6ade73f1626a74d46e61ff247cf2b1b96446b Author: Athira Rajeev Date: Sat Mar 14 18:54:31 2026 +0530 powerpc/pseries/htmdump: Fix the offset value used in processor configuration dump H_HTM call is invoked using three parameters specifying the address of the buffer, size of the buffer and offset where to read from. offset used was always zero. "offset" is value from output buffer header that points to next entry to dump. zero is the first entry to dump. next entry is read from the output bufferbyte offset 0x8. Update htminfo_read() function to use right offset. Return when offset points to -1 Fixes: dea7384e14e7 ("powerpc/pseries/htmdump: Add htm info support to htmdump module") Signed-off-by: Athira Rajeev Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260314132432.25581-2-atrajeev@linux.ibm.com commit 54d54f33813d7911555226b4220737177a2ba8d6 Author: Athira Rajeev Date: Sat Mar 14 18:54:30 2026 +0530 powerpc/pseries/htmdump: Free the global buffers in htmdump module exit htmdump modules uses global memory buffers to capture details like capabilities, status of specified HTM, read the trace buffer. These are initialized during module init and hence needs to be freed in module exit. Patch adds freeing of the memory in module exit. The change also includes minor clean up for the variable name. The read call back for the debugfs interface file saves filp->private_data to local variable name which is same as global variable name for the memory buffers. Rename these local variable names. Signed-off-by: Athira Rajeev Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260314132432.25581-1-atrajeev@linux.ibm.com commit f83e07b29246f468bc7c99f98ca1897843fa8167 Author: Eric Dumazet Date: Mon May 4 16:38:42 2026 +0000 net/sched: sch_fq_codel: annotate data-races from fq_codel_dump_class_stats() fq_codel_dump_class_stats() acquires qdisc spinlock only when requested to follow flow->head chain. As we did in sch_cake recently, add the missing READ_ONCE()/WRITE_ONCE() annotations. Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260504163842.1162001-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 40aa9fcea0721f5b885eec2fb9aa526145e83797 Merge: 561a22d979a42f 8f78b749f3da0f Author: Jakub Kicinski Date: Tue May 5 17:55:25 2026 -0700 Merge tag 'nf-26-05-05' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== IPVS fixes for net The following batch contains IPVS fixes for net to address issues from the latest net-next pull request. Julian Anastasov made the following summary: 1-3) Fixes for the recently added resizable hash tables 4) dest from trash can be leaked if ip_vs_start_estimator() fails 5) fixed races and locking for the estimation kthreads 6) fix for wrong roundup_pow_of_two() usage in the resizable hash tables 7-8) v2 of the changes from Waiman Long to properly guard against the housekeeping_cpumask() updates: https://lore.kernel.org/netfilter-devel/20260331165015.2777765-1-longman@redhat.com/ I added missing Fixes tag. The original description: Since commit 041ee6f3727a ("kthread: Rely on HK_TYPE_DOMAIN for preferred affinity management"), the HK_TYPE_KTHREAD housekeeping cpumask may no longer be correct in showing the actual CPU affinity of kthreads that have no predefined CPU affinity. As the ipvs networking code is still using HK_TYPE_KTHREAD, we need to make HK_TYPE_KTHREAD reflect the reality. This patch series makes HK_TYPE_KTHREAD an alias of HK_TYPE_DOMAIN and uses RCU to protect access to the HK_TYPE_KTHREAD housekeeping cpumask. Julian plans to post a nf-next patch to limit the connections by using "conn_max" sysctl. With Simon Horman, they agreed that this is an old problem that we do not have a limit of connections and it is not a stopper for this patchset. * tag 'nf-26-05-05' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: sched/isolation: Make HK_TYPE_KTHREAD an alias of HK_TYPE_DOMAIN ipvs: Guard access of HK_TYPE_KTHREAD cpumask with RCU ipvs: fix shift-out-of-bounds in ip_vs_rht_desired_size ipvs: fix races around est_mutex and est_cpulist ipvs: do not leak dest after get from dest trash ipvs: fix the spin_lock usage for RT build ipvs: fix races around the conn_lfactor and svc_lfactor sysctl vars ipvs: fixes for the new ip_vs_status info ==================== Link: https://patch.msgid.link/20260505001648.360569-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 561a22d979a42f8c58f7757145e06d30bc2fa4ae Merge: 5ad509c1fdad4b bd279e104e5f54 Author: Jakub Kicinski Date: Tue May 5 17:36:16 2026 -0700 Merge branch 'bnxt_en-bug-fixes' Pavan Chebbi says: ==================== bnxt_en: Bug fixes This patchset adds the following fixes for bnxt: Patch #1 fixes DPC AER handling to make it more reliable Patch #2 fixes incorrect capping bp->max_tpa based on what the FW supports Patch #3 fixes ignoring of VNIC configuration result when RDMA driver is loading Patch #4 fixes logic to make phase adjustment on the PPS OUT signal ==================== Link: https://patch.msgid.link/20260504083611.1383776-1-pavan.chebbi@broadcom.com Signed-off-by: Jakub Kicinski commit bd279e104e5f5400307d56116a36756b35ab345a Author: Pavan Chebbi Date: Mon May 4 14:06:11 2026 +0530 bnxt_en: Use absolute target ns from ptp_clock_request There is no need to calculate the target PHC cycles required to make phase adjustment on the PPS OUT signal. This is because the application supplies absolute n_sec value in the future and is already the actual desired target value. Remove the unnecessary code. Fixes: 9e518f25802c ("bnxt_en: 1PPS functions to configure TSIO pins") Reviewed-by: Kalesh AP Cc: Richard Cochran Signed-off-by: Pavan Chebbi Reviewed-by: Vadim Fedorenko Tested-by: Vadim Fedorenko Link: https://patch.msgid.link/20260504083611.1383776-5-pavan.chebbi@broadcom.com Signed-off-by: Jakub Kicinski commit 16517bc98a56004274472cc9949194cb4d2ad0b7 Author: Kalesh AP Date: Mon May 4 14:06:10 2026 +0530 bnxt_en: Check return value of bnxt_hwrm_vnic_cfg When the bnxt RDMA driver is loaded, it calls bnxt_register_dev(). As part of this, driver sends HWRM_VNIC_CFG firmware command to configure the VNIC to operate in dual VNIC mode. Currently the driver ignores the result of this firmware command. The RDMA driver must know the result since it affects its functioning. Check return value of call to bnxt_hwrm_vnic_cfg() in bnxt_register_dev() and return failure on error. Fixes: a588e4580a7e ("bnxt_en: Add interface to support RDMA driver.") Reviewed-by: Michael Chan Signed-off-by: Kalesh AP Signed-off-by: Pavan Chebbi Link: https://patch.msgid.link/20260504083611.1383776-4-pavan.chebbi@broadcom.com Signed-off-by: Jakub Kicinski commit 54c28fab2fa5afd681c9c4b10f4f6da1efdd397a Author: Michael Chan Date: Mon May 4 14:06:09 2026 +0530 bnxt_en: Set bp->max_tpa according to what the FW supports Fix the logic to set bp->max_tpa no higher than what the FW supports. On P5 chips, some older FW sets max_tpa very low so we override it to prevent performance regressions with the older FW. Fixes: 79632e9ba386 ("bnxt_en: Expand bnxt_tpa_info struct to support 57500 chips.") Reviewed-by: Kalesh AP Reviewed-by: Colin Winegarden Reviewed-by: Rukhsana Ansari Signed-off-by: Michael Chan Signed-off-by: Pavan Chebbi Link: https://patch.msgid.link/20260504083611.1383776-3-pavan.chebbi@broadcom.com Signed-off-by: Jakub Kicinski commit 07f44433355f70fa97d4c44b4c0d2e86adc082fb Author: Michael Chan Date: Mon May 4 14:06:08 2026 +0530 bnxt_en: Delay for 5 seconds after AER DPC for all chips The FW on all chips is requiring a 5-second delay after Downstream Port Containment (DPC) AER. The previously added 900 msec delay was not long enough in all cases because the chip's CRS (Configuration Request Retry Status) mechanism is not always reliable. Fixes: d5ab32e9b02d ("bnxt_en: Add delay to handle Downstream Port Containment (DPC) AER") Reviewed-by: Kalesh AP Signed-off-by: Michael Chan Signed-off-by: Pavan Chebbi Link: https://patch.msgid.link/20260504083611.1383776-2-pavan.chebbi@broadcom.com Signed-off-by: Jakub Kicinski commit 5ad509c1fdad4bf0993b72d1b3d462f036d8a0d8 Author: Kuniyuki Iwashima Date: Mon May 4 06:43:13 2026 +0000 ipv6: Fix null-ptr-deref in fib6_mtu(). syzbot reported null-ptr-deref in fib6_mtu(). [0] When res->f6i->fib6_pmtu is 0 in fib6_mtu(), it fetches MTU from __in6_dev_get(nh->fib_nh_dev)->cnf.mtu6. However, __in6_dev_get() could return NULL when the device is being unregistered. Let's return 0 MTU if __in6_dev_get() returns NULL in fib6_mtu(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7] CPU: 0 UID: 0 PID: 7890 Comm: syz.2.502 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:fib6_mtu net/ipv6/route.c:1648 [inline] RIP: 0010:rt6_insert_exception+0x9eb/0x10a0 net/ipv6/route.c:1753 Code: 3b 14 cf f7 45 85 f6 0f 85 1d 02 00 00 e8 7d 19 cf f7 48 8d bb e0 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 89 RSP: 0000:ffffc9000610f120 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000c001000 RDX: 00000000000000bc RSI: ffffffff8a38bc83 RDI: 00000000000005e0 RBP: ffff888052f06000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888042d16c00 R13: ffff888042d16cc8 R14: 0000000000000001 R15: 0000000000000500 FS: 0000000000000000(0000) GS:ffff88809717d000(0063) knlGS:00000000f540db40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f73c6d50 CR3: 000000006eff0000 CR4: 0000000000352ef0 Call Trace: __ip6_rt_update_pmtu+0x555/0xd60 net/ipv6/route.c:2982 ip6_update_pmtu+0x34f/0x3b0 net/ipv6/route.c:3014 icmpv6_err+0x2a2/0x3f0 net/ipv6/icmp.c:82 icmpv6_notify+0x35e/0x820 net/ipv6/icmp.c:1087 icmpv6_rcv+0x10bf/0x1ae0 net/ipv6/icmp.c:1228 ip6_protocol_deliver_rcu+0xf97/0x1500 net/ipv6/ip6_input.c:478 ip6_input_finish+0x1e4/0x4a0 net/ipv6/ip6_input.c:529 NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ip6_input+0x105/0x2f0 net/ipv6/ip6_input.c:540 ip6_mc_input+0x513/0xf50 net/ipv6/ip6_input.c:630 dst_input include/net/dst.h:480 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:119 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x34c/0x3d0 net/ipv6/ip6_input.c:351 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6202 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6315 netif_receive_skb_internal net/core/dev.c:6401 [inline] netif_receive_skb+0x13b/0x7f0 net/core/dev.c:6460 tun_rx_batched.isra.0+0x3f6/0x750 drivers/net/tun.c:1511 tun_get_user+0x1e31/0x3c20 drivers/net/tun.c:1955 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1070 fs/read_write.c:688 ksys_write+0x12a/0x250 fs/read_write.c:740 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] do_int80_emulation+0x141/0x700 arch/x86/entry/syscall_32.c:172 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:621 RIP: 0023:0xf715616b Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 RSP: 002b:00000000f540d44c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000640 RDX: 000000000000007a RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Fixes: dcd1f572954f ("net/ipv6: Remove fib6_idev") Reported-by: syzbot+01f005f9c6387ca6f6dd@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69f83f22.170a0220.13cc2.0004.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260504064316.3820775-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 901a7d9e2f280a9e76e6c58406a519cb11ad5ff8 Author: Alyssa Ross Date: Sun May 3 21:25:16 2026 +0200 ipv6: default IPV6_SIT to m This basically defaulted to m until recently, since IPV6 defaulted to m. Since IPV6 was changed to a boolean with a default of y, IPV6_SIT started defaulting to built-in as well. This results in a surprise sit0 device by default for defconfig (and defconfig-derived config) users at boot. For me, this broke an (admittedly non-robust) script. Preserve the behaviour of most configs by avoiding building this module, that's probably overall seldom used compared to IPv6 as a whole, into the kernel. Fixes: 309b905deee59 ("ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs") Signed-off-by: Alyssa Ross Reviewed-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260503192515.290900-2-hi@alyssa.is Signed-off-by: Jakub Kicinski commit b29987dfd943e655df6e3b641ecffad5cc1509c2 Author: Satyanarayana K V P Date: Mon May 4 09:49:26 2026 +0000 drm/xe/guc: Exclude indirect ring state page from ADS engine state size The engine state size reported to GuC via ADS should only include the engine state portion and should not include the indirect ring state page that comes after it in the context image. The GuC uses this size to overwrite the engine state in the LRC on watchdog resets and we don't want it to overwrite the indirect ring state as well. Fixes: d6219e1cd5e3 ("drm/xe: Add Indirect Ring State support") Suggested-by: Daniele Ceraolo Spurio Signed-off-by: Satyanarayana K V P Cc: Michal Wajdeczko Cc: Matthew Brost Reviewed-by: Matthew Brost Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260504094924.3760713-4-satyanarayana.k.v.p@intel.com (cherry picked from commit 3ec5f003f6c377beda8bd5438941f5a7795e1848) Signed-off-by: Matthew Brost commit b87951a0ae9f95ca6590bf0939edced7d36929dd Author: Shuicheng Lin Date: Wed Apr 29 19:22:59 2026 +0000 drm/xe/pf: Fix MMIO access using PF view instead of VF view during migration pf_migration_mmio_save() and pf_migration_mmio_restore() initialize a local VF-specific MMIO view via xe_mmio_init_vf_view() but then pass >->mmio (the PF base) to all xe_mmio_read32()/xe_mmio_write32() calls instead of the local &mmio. This causes the PF own SW flag registers to be saved/restored rather than the target VF registers, silently corrupting migration state. Use the VF MMIO view for all register accesses, matching the correct pattern used in pf_clear_vf_scratch_regs(). Fixes: b7c1b990f719 ("drm/xe/pf: Handle MMIO migration data as part of PF control") Cc: Michał Winiarski Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Michal Wajdeczko Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20260429192259.4009211-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit 7d9c39cfb31ff389490ca1308767c2807a9829a6) Signed-off-by: Matthew Brost commit d01012c740bbb298b957e30cc0848e482c6f486f Author: Shuicheng Lin Date: Tue Apr 28 20:14:48 2026 +0000 drm/xe/pf: Fix EAGAIN sign in pf_migration_consume() PTR_ERR() returns a negative value, so comparing against the positive EAGAIN is always true for ERR_PTR(-EAGAIN), causing pf_migration_consume() to bail out instead of continuing to the remaining GTs. On multi-GT platforms this can skip GTs that already have data ready. Compare against -EAGAIN to match the intent (and the following line that correctly uses -EAGAIN). While at it, gate PTR_ERR() with IS_ERR(). v2: add IS_ERR() guard before PTR_ERR(). (Gustavo) Fixes: 67df4a5cbc58 ("drm/xe/pf: Add data structures and handlers for migration rings") Cc: Michał Winiarski Reviewed-by: Gustavo Sousa Link: https://patch.msgid.link/20260428201448.3999428-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit 9d770e72e1edb54beacfce5f402edb51632811e3) Signed-off-by: Matthew Brost commit 60a1e131a811b68703da58fd805ab359b704ab03 Author: Gustavo Sousa Date: Thu Apr 16 15:17:19 2026 -0300 drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() When media GT is disabled via configfs, there is no allocation for media_gt, which is kept as NULL. In such scenario, intel_hdcp_gsc_check_status() results in a kernel pagefault error due to >->uc.gsc being evaluated as an invalid memory address. Fix that by introducing a NULL check on media_gt and bailing out early if so. While at it, also drop the NULL check for gsc, since it can't be NULL if media_gt is not NULL. v2: - Get address for gsc only after checking that gt is not NULL. (Shuicheng) - Drop the NULL check for gsc. (Shuicheng) v3: - Add "Fixes" and "Cc: " tags. (Matt) Fixes: 4af50beb4e0f ("drm/xe: Use gsc_proxy_init_done to check proxy status") Cc: # v6.10+ Reviewed-by: Matt Roper Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260416-check-for-null-media_gt-in-intel_hdcp_gsc_check_status-v2-1-9adb9fd3b621@intel.com Signed-off-by: Gustavo Sousa (cherry picked from commit bfaf87e84ca3ca3f6e275f9ae56da47a8b55ffd1) Signed-off-by: Matthew Brost commit 74fe02ce122a6103f207d29fafc8b3a53de6abaf Merge: 11f00074f72a97 20e81c64c905bd Author: Linus Torvalds Date: Tue May 5 16:09:31 2026 -0700 Merge tag 'wq-for-7.1-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fixes from Tejun Heo: - Fix devm_alloc_workqueue() passing a va_list as a positional arg to the variadic alloc_workqueue() macro, which garbled wq->name and skipped lockdep init on the devm path. Fold both noprof entry points onto a va_list helper. Also, annotate it using __printf(1, 0) * tag 'wq-for-7.1-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Annotate alloc_workqueue_va() with __printf(1, 0) workqueue: fix devm_alloc_workqueue() va_list misuse commit 11f00074f72a977274c64c100372764eb04e6a3f Merge: de95ad90fb19e4 d8769544bde51b Author: Linus Torvalds Date: Tue May 5 15:43:32 2026 -0700 Merge tag 'cgroup-for-7.1-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - During v6.19, cgroup task unlink was moved from do_exit() to after the final task switch to satisfy a controller invariant. That left the kernel seeing tasks past exit_signals() longer than userspace expected, and several v7.0 follow-ups tried to bridge the gap by making rmdir wait for the kernel side. None held up. The latest is an A-A deadlock when rmdir is invoked by the reaper of zombies whose pidns teardown the rmdir itself is waiting on, which points at the synchronizing approach being fundamentally wrong. Take a different approach: drop the wait, leave rmdir's user-visible side returning as soon as cgroup.procs is empty, and defer the css percpu_ref kill that drives ->css_offline() until the cgroup is fully depopulated. Tagged for stable. Somewhat invasive but contained. The hope is that fixing forward sticks. If not, the fallback is to revert the entire chain and rework on the development branch. Note that this doesn't plug a pre-existing analogous race in cgroup_apply_control_disable() (controller disable via subtree_control). Not a regression. The development branch will do the more invasive restructuring needed for that. - Documentation update for cgroup-v1 charge-commit section that still referenced functions removed when the memcg hugetlb try-commit-cancel protocol was retired. * tag 'cgroup-for-7.1-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: docs: cgroup-v1: Update charge-commit section cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated commit de95ad90fb19e4b7778a0c27115a4639c7c8b186 Merge: 50fb0bcc9d7da2 b34c82777a2c06 Author: Linus Torvalds Date: Tue May 5 15:22:04 2026 -0700 Merge tag 'sched_ext-for-7.1-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix idle CPU selection returning prev_cpu outside the task's cpus_ptr when the BPF caller's allowed mask was wider. Stable backport. - Two opposite-direction gaps in scx_task_iter's cgroup-scoped mode versus the global mode: - Tasks past exit_signals() are filtered by the cgroup walk but kept by global. Sub-scheduler enable abort leaked __scx_init_task() state. Add a CSS_TASK_ITER_WITH_DEAD flag to cgroup's task iterator (scx_task_iter is its only user) and use it. - Tasks past sched_ext_dead() are still returned, tripping WARN_ON_ONCE() in callers or making them touch torn-down state. Mark and skip under the per-task rq lock. * tag 'sched_ext-for-7.1-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: idle: Recheck prev_cpu after narrowing allowed mask sched_ext: Skip past-sched_ext_dead() tasks in scx_task_iter_next_locked() cgroup, sched_ext: Include exiting tasks in cgroup iter commit 50fb0bcc9d7da23e0f0fd5359b4f9ceb0aa337d2 Merge: 13ad98eaabef61 98f69975d4c043 Author: Linus Torvalds Date: Tue May 5 14:38:31 2026 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "All in drivers. The largest change is the ufs one which has to introduce a new function to check the power state before doing the update and the most widely encountered one is the obvious change to sg to not use GFP_ATOMIC" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: target: iscsi: reject invalid size Extended CDB AHS scsi: ufs: core: Fix bRefClkFreq write failure in HS-LSS mode scsi: hisi_sas: Fix sparse warnings in prep_ata_v3_hw() scsi: pmcraid: Fix typo in comments scsi: scsi_dh_alua: Increase default ALUA timeout to maximum spec value scsi: smartpqi: Silence a recursive lock warning scsi: mpt3sas: Limit NVMe request size to 2 MiB scsi: sg: Don't use GFP_ATOMIC in sg_start_req() scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() commit 13ad98eaabef611f042d49a9077be060ad03284d Merge: 9207d47f966be9 8de779dc40d35d Author: Linus Torvalds Date: Tue May 5 14:25:44 2026 -0700 Merge tag 'fbdev-for-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: "Four small patches for fbdev, of which two are important: One fixes the bitmap font generation and the other prevents a possible use-after-free in udlfb: - Fix rotating fonts by 180 degrees (Thomas Zimmermann) - Drop duplicate include of linux/module.h in fb_defio (Chen Ni) - Add vm_ops in udlfb to prevent use-after-free (Rajat Gupta) - ipu-v3: clean up kernel-doc warnings (Randy Dunlap)" * tag 'fbdev-for-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free lib/fonts: Fix bit position when rotating by 180 degrees fbdev: defio: Remove duplicate include of linux/module.h fbdev: ipu-v3: clean up kernel-doc warnings commit 868f31e4061eca8c3cd607d79d954d5e54f204aa Author: Stephen Smalley Date: Thu Apr 30 14:36:52 2026 -0400 selinux: shrink critical section in sel_write_load() Currently sel_write_load() takes the policy mutex earlier than necessary. Move the taking of the mutex later. This avoids holding it unnecessarily across the vmalloc() and copy_from_user() of the policy data. Cc: stable@vger.kernel.org Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore commit a02cd6805562305f936e807da83e253b719dd965 Author: Stephen Smalley Date: Tue May 5 10:06:38 2026 -0400 selinux: allow multiple opens of /sys/fs/selinux/policy Currently there can only be a single open of /sys/fs/selinux/policy at any time. This allows any process to block any other process from reading the kernel policy. The original motivation seems to have been a mix of preventing an inconsistent view of the policy size and preventing userspace from allocating kernel memory without bound, but this is arguably equally bad. Eliminate the policy_opened flag and shrink the critical section that the policy mutex is held. While we are making changes here, drop a couple of extraneous BUG_ONs. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/selinux/20100726193414.19538.64028.stgit@paris.rdu.redhat.com/ Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore commit ad1ac3d740cc6b858a99ab9c45c8c0574be7d1d3 Author: Stephen Smalley Date: Tue May 5 08:49:50 2026 -0400 selinux: prune /sys/fs/selinux/user Remove the previously deprecated /sys/fs/selinux/user interface aside from a residual stub for userspace compatibility. Commit d7b6918e22c7 ("selinux: Deprecate /sys/fs/selinux/user") started the deprecation process for /sys/fs/selinux/user: The selinuxfs "user" node allows userspace to request a list of security contexts that can be reached for a given SELinux user from a given starting context. This was used by libselinux when various login-style programs requested contexts for users, but libselinux stopped using it in 2020. Kernel support will be removed no sooner than Dec 2025. A pr_warn() message has been in place since Linux v6.13, and a 5 second sleep was introduced since Linux v6.17 to help make it more noticeable. We are now past the stated deadline of Dec 2025, so remove the underlying functionality and replace it with a stub that returns a '0\0' buffer to avoid breaking userspace. This also avoids a local DoS from logspam and an uninterruptible sleep delay. Cc: stable@vger.kernel.org Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore commit 19cfa0099024bb9cd40f6d950caa7f47ff8e77f6 Author: Stephen Smalley Date: Tue May 5 08:49:49 2026 -0400 selinux: prune /sys/fs/selinux/disable Commit f22f9aaf6c3d ("selinux: remove the runtime disable functionality") removed the underlying SELinux runtime disable functionality but left everything else intact and started logging an error message to warn any residual users. Prune it to just log an error message once and to return count (i.e. all bytes written successfully) to avoid breaking userspace. This also fixes a local DoS from logspam. Cc: stable@vger.kernel.org Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore commit 644132a48f4e28a1d949d162160869286f3e75de Author: Stephen Smalley Date: Tue May 5 08:49:48 2026 -0400 selinux: prune /sys/fs/selinux/checkreqprot commit a7e4676e8e2cb ("selinux: remove the 'checkreqprot' functionality") removed the ability to modify the checkreqprot setting but left everything except the updating of the checkreqprot value intact. Aside from unnecessary processing, this could produce a local DoS from log spam and incorrectly calls selinux_ima_measure_state() on each write even though no state has changed. Prune it to just log an error message once and return count (i.e. all bytes written successfully) so that userspace never breaks. Cc: stable@vger.kernel.org Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore commit 9207d47f966be9f4d52e7e0119ac2b7a7e366f3e Merge: 4e386547138864 0c99acbc8b6c6d Author: Linus Torvalds Date: Tue May 5 09:11:52 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: - Several error unwind misses on system calls in mlx5, mana, ocrdma, vmw_pvrdma, mlx4, and hns - More rxe bugs processing network packets - User triggerable races in mlx5 when destroying and creating the same same object when the FW returns the same object ID - Incorrect passing of an IPv6 address through netlink RDMA_NL_LS_OP_IP_RESOLVE - Add memory ordering for mlx5's lock avoidance pattenr - Protect mana from kernel memory overflow - Use safe patterns for xarray/radix_tree look up in mlx5 and hns * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (24 commits) RDMA/hns: Fix unlocked call to hns_roce_qp_remove() RDMA/hns: Fix xarray race in hns_roce_create_qp_common() RDMA/hns: Fix xarray race in hns_roce_create_srq() RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() RDMA/ocrdma: Clarify the mm_head searching RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() RDMA/mana: Validate rx_hash_key_len RDMA/mlx5: Add missing store/release for lock elision pattern RDMA/mlx5: Restore zero-init to mlx5_ib_modify_qp() ucmd RDMA/ionic: Fix typo in format string RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation RDMA/core: Fix rereg_mr use-after-free race IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg() RDMA/mlx5: Fix UAF in DCT destroy due to race with create RDMA/mlx5: Fix UAF in SRQ destroy due to race with create ... commit ac8eb3e18f41e2cc8492cc1d358bcb786c850270 Author: Benjamin Berg Date: Tue May 5 15:15:40 2026 +0200 wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error. Cc: stable@vger.kernel.org Fixes: bca8bc0399ac ("wifi: mac80211: handle ieee80211_radar_detected() for MLO") Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20260505151539.236d63a1b736.I35dbb9e96a2d4a480be208770fdd99ba3b817b79@changeid Signed-off-by: Johannes Berg commit 714ae274e869e197fef21c037156fe6e37ce9e7a Merge: 4a142520d166f9 d748603f12baff Author: Johannes Berg Date: Tue May 5 17:52:32 2026 +0200 Merge tag 'ath-current-20260505' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v7.1-rc3 Fix an ath5k potential stack buffer overwrite. Fix several issues in ath12k: - WMI buffer leaks on error conditions - use of uninitialized stack data when processing RSSI events - incorrect logic for determining the peer ID in the RX path ================== Signed-off-by: Johannes Berg commit 4e386547138864d4ded1c39ff75517b89e187964 Merge: a293ec25d59dd9 23c39cb598977f Author: Linus Torvalds Date: Tue May 5 08:45:41 2026 -0700 Merge tag 'media/v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - rc: ttusbir: fix inverted error logic - Venus/Iris fixes: - Kconfig cross compile build testing for x86 - Use-after-free fix for internal buffers - dma_free_attrs size fix - Switch to hardware mode clocks - Use-after-free fix for a concurrency path - Fix H265D_MAX_SLICE size for sc7280 devices - camoss: fix some clock-related issues * tag 'media/v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: qcom: camss: avoid format string warning media: qcom: camss: Add missing clocks for VFE lite on sa8775p media: qcom: camss: Fix csid clock configuration for sa8775p media: qcom: camss: Fix csid IRQ offset for sa8775p media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 media: iris: fix use-after-free of fmt_src during MBPF check media: iris: switch to hardware mode after firmware boot media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() media: iris: Fix use-after-free in iris_release_internal_buffers() media: iris: fix QCOM_MDT_LOADER dependency media: venus: fix QCOM_MDT_LOADER dependency commit a6848a50404eefb6f0b131c21881a2d8d21b31a9 Author: Sudeep Holla Date: Tue Apr 28 19:33:35 2026 +0100 firmware: arm_ffa: Fix sched-recv callback partition lookup ffa_sched_recv_cb_update() used list_for_each_entry_safe() to search for a matching partition and then tested the iterator against NULL. That is not a valid end-of-list check for circular lists and can fall through with an invalid pointer. Use a normal iterator and detect the not-found case correctly before touching the partition state. Fixes: be61da938576 ("firmware: arm_ffa: Allow multiple UUIDs per partition to register SRI callback") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-11-8595ae450034@kernel.org Signed-off-by: Sudeep Holla commit 38290b180a4d5746baed796d49f88d56d2f336cd Author: Sudeep Holla Date: Tue Apr 28 19:33:34 2026 +0100 firmware: arm_ffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notify_lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory. Copy the callback pointer and callback data while notify_lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths. Fixes: 285a5ea0f542 ("firmware: arm_ffa: Add support for handling framework notifications") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-10-8595ae450034@kernel.org Signed-off-by: Sudeep Holla commit 0399e3f872ca3d78044bb715a73ea645806d2c7b Author: Sudeep Holla Date: Tue Apr 28 19:33:33 2026 +0100 firmware: arm_ffa: Align RxTx buffer size before mapping Commit 83210251fd70 ("firmware: arm_ffa: Use the correct buffer size during RXTX_MAP") advertises PAGE_ALIGN(rxtx_bufsz) to firmware when mapping the buffers but the driver continues to stores the minimum FF-A buffer size in drv_info->rxtx_bufsz which is used elsewhere in the driver. Align the size before storing it so that the allocation, validation and FFA_RXTX_MAP all use the same buffer size. Fixes: 83210251fd70 ("firmware: arm_ffa: Use the correct buffer size during RXTX_MAP") Cc: Sebastian Ene Link: https://sashiko.dev/#/patchset/20260402113939.930221-1-sebastianene@google.com Reviewed-by: Sebastian Ene Link: https://patch.msgid.link/20260428-ffa_fixes-v2-9-8595ae450034@kernel.org Signed-off-by: Sudeep Holla commit 4a1cc9e96b311d2609a6f963a5e35bd4ae730d97 Author: Sudeep Holla Date: Tue Apr 28 19:33:32 2026 +0100 firmware: arm_ffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and ensure that any non-header payload starts at the UUID field rather than in the middle of the message header. Use the validated offset and size values for both kmemdup() and the UUID parsing path so malformed firmware data cannot drive an out-of-bounds read or an oversized allocation. Fixes: 285a5ea0f542 ("firmware: arm_ffa: Add support for handling framework notifications") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-8-8595ae450034@kernel.org Signed-off-by: Sudeep Holla commit 2af18f8e36b277730527cacc2256b1332f56aa28 Author: Sudeep Holla Date: Tue Apr 28 19:33:31 2026 +0100 firmware: arm_ffa: Keep framework RX release under lock The framework notification handler drops rx_lock before issuing FFA_RX_RELEASE, leaving a window where another RX-buffer user can start a new FF-A transaction before ownership has actually been returned to firmware. Move the FFA_RX_RELEASE calls so they execute while rx_lock is still held on both the kmemdup() failure path and the normal success path. While doing that, switch the handler to scoped_guard() to keep the critical section explicit. Fixes: 285a5ea0f542 ("firmware: arm_ffa: Add support for handling framework notifications") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-7-8595ae450034@kernel.org Signed-off-by: Sudeep Holla commit 3974ea1938406f9bfa7c1f48d4e43533f447bb08 Author: Sudeep Holla Date: Tue Apr 28 19:33:30 2026 +0100 firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies The register-based PARTITION_INFO_GET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index progressions so the copy loop cannot write past the allocated array. Fixes: ba85c644ac8d ("firmware: arm_ffa: Add support for FFA_PARTITION_INFO_GET_REGS") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-6-8595ae450034@kernel.org (fixed cur_idx when exactly one descriptor in the first fragment) Signed-off-by: Sudeep Holla commit 26f6654a9a60eb4d241f42a0ec85412e8821480b Author: Osama Abdelkader Date: Thu Apr 23 22:06:20 2026 +0200 drm/exynos: remove bridge when component_add fails Use devm_drm_bridge_add() so the bridge is released if probe fails after registration, and drop the manual drm_bridge_remove() in remove(). Check the return value of devm_drm_bridge_add(). Signed-off-by: Osama Abdelkader Fixes: 576d72fbfb45 ("drm/exynos: mic: add a bridge at probe") Cc: stable@vger.kernel.org Reviewed-by: Raphaël Gallais-Pou Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260423200622.325076-2-osama.abdelkader@gmail.com Signed-off-by: Luca Ceresoli commit 4e02e0afa95f691dc7cc17538cdd648089a843f0 Author: Christian König Date: Mon Oct 13 15:26:02 2025 +0200 drm/amdgpu: nuke amdgpu_userq_fence_slab v2 As preparation for independent fences remove the extra slab, kmalloc should do just fine. v2: use GFP_KERNEL instead of GFP_ATOMIC Signed-off-by: Christian König Reviewed-by: Prike Liang Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher (cherry picked from commit 0d831487b5be0ae59cac865a0aa87b0acc3dc717) commit 6da7b1242da4455b11c24ce667d1cab1a348c8ea Author: Sunil Khatri Date: Mon May 4 18:21:17 2026 +0530 drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while a queue creation is in progress and passing other bo at same address. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 1fc6c8ab45dbee096469c08c13f6099d57a52d6c) Cc: stable@vger.kernel.org commit 81665e35f143d93adef654f3be1360def9196e72 Author: Xiaogang Chen Date: Fri Apr 24 13:47:01 2026 -0500 drm/amdkfd: Check if there are kfd porcesses using adev by kfd_processes_count During gpu hot-unplug need check if there are kfd porcesses still using the being removed gpu before clean resources of the device. Current driver checks if kfd_processes_table is empty. kfd processes are not terminated after removed from kfd_processes_table immediately. They are still alive and may access the device until kfd_process_wq work queue got ran. Check kfd->kfd_processes_count value that is updated after kfd process got uninitialized when its ref becomes zero. Fixes: 6cca686dfce7 ("drm/amdkfd: kfd driver supports hot unplug/replug amdgpu devices") Signed-off-by: Xiaogang Chen Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher (cherry picked from commit d12d05c4bc4c15585130af43e897923ff292df7b) commit e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741 Author: Philip Yang Date: Mon Apr 27 09:30:23 2026 -0400 drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a single PTE is written the TLB may speculatively load other uninitialized entries from the same cacheline. Those garbage entries can appear valid, and a subsequent write to another PTE in the same cacheline may cause the GPU to use a stale garbage PTE from the TLB. Fix this by calling memset_io() to zero-initialize the GART table with gart_pte_flags immediately after allocation. Using AMDGPU_GEM_CREATE_VRAM_CLEARED, SDMA-based clear will not work since SDMA needs GART to be initialized to work. Suggested-by: Felix Kuehling Signed-off-by: Philip Yang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit d9af8263b82b6eaa60c5718e0c6631c5037e4b24) Cc: stable@vger.kernel.org commit 78d2e624fa073c14970aa097adcf3ea31c157a66 Author: John B. Moore Date: Mon Apr 27 16:06:28 2026 -0500 drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions that verify fence writeback addresses are dword-aligned. These assertions can be reached from unprivileged userspace via crafted DRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a scheduler worker thread. Replace both BUG_ON() calls with WARN_ON() to log the condition without crashing the kernel. A misaligned fence address at this point indicates a driver bug, but crashing the kernel is never the correct response when the assertion is reachable from userspace. The CS IOCTL path is the correct place to filter invalid submissions; the ring emission callback is too late to do anything about it. Fixes: 2130f89ced2c ("drm/amdgpu: add SDMA v4.0 implementation (v2)") Reviewed-by: Christian König Signed-off-by: John B. Moore Signed-off-by: Alex Deucher (cherry picked from commit b90250bd933afd1ba94d86d6b13821997b22b18e) Cc: stable@vger.kernel.org commit 17223816498f7b117d138d18eb0eba63604dc74e Author: Alex Deucher Date: Mon Apr 27 11:40:25 2026 -0400 drm/radeon: add missing revision check for CI The memory level workarounds only apply to revision 0 SKUs. Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816 Fixes: 127e056e2a82 ("drm/radeon: fix mclk vddc configuration for cards for hawaii") Fixes: 21b8a369046f ("drm/radeon: fix dram timing for certain hawaii boards") Fixes: 90b2fee35cb9 ("drm/radeon: fix dpm mc init for certain hawaii boards") Reviewed-by: Timur Kristóf Reviewed-by: Kent Russell Signed-off-by: Alex Deucher (cherry picked from commit 4d8dcc14311515077062b5740f39f427075de5c9) Cc: stable@vger.kernel.org commit 1987c79b4fe5789dfa14423e78b5c25f6acf3e9d Author: Alex Deucher Date: Tue Apr 28 10:42:49 2026 -0400 drm/amdgpu/pm: align Hawaii mclk workaround with radeon Align the hawaii mclk workaround with radeon and windows. Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816 Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)") Reviewed-by: Timur Kristóf Reviewed-by: Kent Russell Signed-off-by: Alex Deucher (cherry picked from commit 9649528b637f668c5af9f2b83ca4ad8576ae2121) Cc: stable@vger.kernel.org commit 2a561b361b7681509710f3cfc3d95d54c87ac69f Author: Alex Deucher Date: Mon Apr 27 11:38:58 2026 -0400 drm/amdgpu/pm: add missing revision check for CI The ci_populate_all_memory_levels() workaround only applies to revision 0 SKUs. Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816 Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)") Reviewed-by: Timur Kristóf Reviewed-by: Kent Russell Signed-off-by: Alex Deucher (cherry picked from commit 1db15ba8f72f400bbad8ae0ce24fafc43429d4bd) Cc: stable@vger.kernel.org commit 7bbfb2559bcec39d1a4e1182d931a2046112c352 Author: John B. Moore Date: Tue Apr 28 11:35:12 2026 -0500 drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Remove the BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT) assertion from gfx_v9_0_ring_emit_fence_kiq(). The KIQ hardware supports 64-bit fence writes; the 32-bit writeback address constraint is an upper-layer convention, not a hardware limitation. The check serves no purpose and should not be present. Found by code inspection while investigating related BUG_ON assertions in the GFX and compute ring emission paths. Reviewed-by: Christian König Signed-off-by: John B. Moore Signed-off-by: Alex Deucher (cherry picked from commit 1b1101a46a426bb4328116bb5273c326a2780389) Cc: stable@vger.kernel.org commit 9b4e3495d1bd2469bf94b74930c153c2d534ddb7 Author: Felix Kuehling Date: Mon Apr 20 11:55:57 2026 -0400 drm/amdkfd: Make all TLB-flushes heavy-weight With only one sequence number we cannot track the need for legacy vs heavy-weight flushes reliably. Always use heavy-weight. Signed-off-by: Felix Kuehling Reviewed-by: Philip Yang Signed-off-by: Alex Deucher (cherry picked from commit c1a3ff1d327820cd9a52bc1056b98681fc088949) Cc: stable@vger.kernel.org commit d97cb2ef0b221b068e90b6058aa97faa0626bdab Author: Thomas Gleixner Date: Sun Apr 26 18:13:54 2026 +0200 selftests/rseq: Make registration flexible for legacy and optimized mode rseq_register_current_thread() either uses the glibc registered RSEQ region or registers it's own region with the legacy size of 32 bytes. That worked so far, but becomes a problem when the kernel implements a distinction between legacy and performance optimized behavior based on the registration size as that does not allow to test both modes with the self test suite. Add two arguments to the function. One to enforce that the registration is not using libc provided mode and one to tell the registration to use the legacy size and not the kernel advertised size. Rename it and make the original one a inline wrapper which preserves the existing behavior. Fixes: 566d8015f7ee ("rseq: Avoid CPU/MM CID updates when no event pending") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Link: https://patch.msgid.link/20260428224427.677889423%40kernel.org Cc: stable@vger.kernel.org commit 02b44d943b3adddc3a15c1da97045e205b7d14c1 Author: Thomas Gleixner Date: Sat Apr 25 15:46:06 2026 +0200 selftests/rseq: Skip tests if time slice extensions are not available Don't fail, skip the test if the extensions are not enabled at compile or runtime. Fixes: 830969e7821a ("selftests/rseq: Implement time slice extension test") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Link: https://patch.msgid.link/20260428224427.597838491%40kernel.org Cc: stable@vger.kernel.org commit b9eac6a9d93c952c4b7775a24d5c7a1bbf4c3c00 Author: Thomas Gleixner Date: Sat Apr 25 00:47:54 2026 +0200 rseq: Revert to historical performance killing behaviour The recent RSEQ optimization work broke the TCMalloc abuse of the RSEQ ABI as it not longer unconditionally updates the CPU, node, mm_cid fields, which are documented as read only for user space. Due to the observed behavior of the kernel it was possible for TCMalloc to overwrite the cpu_id_start field for their own purposes and rely on the kernel to update it unconditionally after each context switch and before signal delivery. The RSEQ ABI only guarantees that these fields are updated when the data changes, i.e. the task is migrated or the MMCID of the task changes due to switching from or to per CPU ownership mode. The optimization work eliminated the unconditional updates and reduced them to the documented ABI guarantees, which results in a massive performance win for syscall, scheduling heavy work loads, which in turn breaks the TCMalloc expectations. There have been several options discussed to restore the TCMalloc functionality while preserving the optimization benefits. They all end up in a series of hard to maintain workarounds, which in the worst case introduce overhead for everyone, e.g. in the scheduler. The requirements of TCMalloc and the optimization work are diametral and the required work arounds are a maintainence burden. They end up as fragile constructs, which are blocking further optimization work and are pretty much guaranteed to cause more subtle issues down the road. The optimization work heavily depends on the generic entry code, which is not used by all architectures yet. So the rework preserved the original mechanism moslty unmodified to keep the support for architectures, which handle rseq in their own exit to user space loop. That code is currently optimized out by the compiler on architectures which use the generic entry code. This allows to revert back to the original behaviour by replacing the compile time constant conditions with a runtime condition where required, which disables the optimization and the dependend time slice extension feature until the run-time condition can be enabled in the RSEQ registration code on a per task basis again. The following changes are required to restore the original behavior, which makes TCMalloc work again: 1) Replace the compile time constant conditionals with runtime conditionals where appropriate to prevent the compiler from optimizing the legacy mode out 2) Enforce unconditional update of IDs on context switch for the non-optimized v1 mode 3) Enforce update of IDs in the pre signal delivery path for the non-optimized v1 mode 4) Enforce update of IDs in the membarrier(RSEQ) IPI for the non-optimized v1 mode 5) Make time slice and future extensions depend on optimized v2 mode This brings back the full performance problems, but preserves the v2 optimization code and for generic entry code using architectures also the TIF_RSEQ optimization which avoids a full evaluation of the exit to user mode loop in many cases. Fixes: 566d8015f7ee ("rseq: Avoid CPU/MM CID updates when no event pending") Reported-by: Mathias Stearn Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Closes: https://lore.kernel.org/CAHnCjA25b+nO2n5CeifknSKHssJpPrjnf+dtr7UgzRw4Zgu=oA@mail.gmail.com Link: https://patch.msgid.link/20260428224427.517051752%40kernel.org Cc: stable@vger.kernel.org commit 95084f1883a760e0d4290698346759d58e2b944a Author: Dipayaan Roy Date: Thu Apr 30 19:47:12 2026 -0700 net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR During Function Level Reset recovery, the MANA driver reads hardware BAR0 registers that may temporarily contain garbage values. The SHM (Shared Memory) offset read from GDMA_REG_SHM_OFFSET is used to compute gc->shm_base, which is later dereferenced via readl() in mana_smc_poll_register(). If the hardware returns an unaligned or out-of-range value, the driver must not blindly use it, as this would propagate the hardware error into a kernel crash. The following crash was observed on an arm64 Hyper-V guest running kernel 6.17.0-3013-azure during VF reset recovery triggered by HWC timeout. [13291.785274] Unable to handle kernel paging request at virtual address ffff8000a200001b [13291.785311] Mem abort info: [13291.785332] ESR = 0x0000000096000021 [13291.785343] EC = 0x25: DABT (current EL), IL = 32 bits [13291.785355] SET = 0, FnV = 0 [13291.785363] EA = 0, S1PTW = 0 [13291.785372] FSC = 0x21: alignment fault [13291.785382] Data abort info: [13291.785391] ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000 [13291.785404] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [13291.785412] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [13291.785421] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000014df3a1000 [13291.785432] [ffff8000a200001b] pgd=1000000100438403, p4d=1000000100438403, pud=1000000100439403, pmd=0068000fc2000711 [13291.785703] Internal error: Oops: 0000000096000021 [#1] SMP [13291.830975] Modules linked in: tls qrtr mana_ib ib_uverbs ib_core xt_owner xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat nf_tables cfg80211 8021q garp mrp stp llc binfmt_misc joydev serio_raw nls_iso8859_1 hid_generic aes_ce_blk aes_ce_cipher polyval_ce ghash_ce sm4_ce_gcm sm4_ce_ccm sm4_ce sm4_ce_cipher hid_hyperv sm4 sm3_ce sha3_ce hv_netvsc hid vmgenid hyperv_keyboard hyperv_drm sch_fq_codel nvme_fabrics efi_pstore dm_multipath nfnetlink vsock_loopback vmw_vsock_virtio_transport_common hv_sock vmw_vsock_vmci_transport vmw_vmci vsock dmi_sysfs ip_tables x_tables autofs4 [13291.862630] CPU: 122 UID: 0 PID: 61796 Comm: kworker/122:2 Tainted: G W 6.17.0-3013-azure #13-Ubuntu VOLUNTARY [13291.869902] Tainted: [W]=WARN [13291.871901] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 01/08/2026 [13291.878086] Workqueue: events mana_serv_func [13291.880718] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [13291.884835] pc : mana_smc_poll_register+0x48/0xb0 [13291.887902] lr : mana_smc_setup_hwc+0x70/0x1c0 [13291.890493] sp : ffff8000ab79bbb0 [13291.892364] x29: ffff8000ab79bbb0 x28: ffff00410c8b5900 x27: ffff00410d630680 [13291.896252] x26: ffff004171f9fd80 x25: 000000016ed55000 x24: 000000017f37e000 [13291.899990] x23: 0000000000000000 x22: 000000016ed55000 x21: 0000000000000000 [13291.904497] x20: ffff8000a200001b x19: 0000000000004e20 x18: ffff8000a6183050 [13291.908308] x17: 0000000000000000 x16: 0000000000000000 x15: 000000000000000a [13291.912542] x14: 0000000000000004 x13: 0000000000000000 x12: 0000000000000000 [13291.916298] x11: 0000000000000000 x10: 0000000000000001 x9 : ffffc45006af1bd8 [13291.920945] x8 : ffff000151129000 x7 : 0000000000000000 x6 : 0000000000000000 [13291.925293] x5 : 000000015f214000 x4 : 000000017217a000 x3 : 000000016ed50000 [13291.930436] x2 : 000000016ed55000 x1 : 0000000000000000 x0 : ffff8000a1ffffff [13291.934342] Call trace: [13291.935736] mana_smc_poll_register+0x48/0xb0 (P) [13291.938611] mana_smc_setup_hwc+0x70/0x1c0 [13291.941113] mana_hwc_create_channel+0x1a0/0x3a0 [13291.944283] mana_gd_setup+0x16c/0x398 [13291.946584] mana_gd_resume+0x24/0x70 [13291.948917] mana_do_service+0x13c/0x1d0 [13291.951583] mana_serv_func+0x34/0x68 [13291.953732] process_one_work+0x168/0x3d0 [13291.956745] worker_thread+0x2ac/0x480 [13291.959104] kthread+0xf8/0x110 [13291.961026] ret_from_fork+0x10/0x20 [13291.963560] Code: d2807d00 9417c551 71000673 54000220 (b9400281) [13291.967299] ---[ end trace 0000000000000000 ]--- Disassembly of mana_smc_poll_register() around the crash site: Disassembly of section .text: 00000000000047c8 : 47c8: d503201f nop 47cc: d503201f nop 47d0: d503233f paciasp 47d4: f800865e str x30, [x18], #8 47d8: a9bd7bfd stp x29, x30, [sp, #-48]! 47dc: 910003fd mov x29, sp 47e0: a90153f3 stp x19, x20, [sp, #16] 47e4: 91007014 add x20, x0, #0x1c 47e8: 5289c413 mov w19, #0x4e20 47ec: f90013f5 str x21, [sp, #32] 47f0: 12001c35 and w21, w1, #0xff 47f4: 14000008 b 4814 47f8: 36f801e1 tbz w1, #31, 4834 47fc: 52800042 mov w2, #0x2 4800: d280fa01 mov x1, #0x7d0 4804: d2807d00 mov x0, #0x3e8 4808: 94000000 bl 0 480c: 71000673 subs w19, w19, #0x1 4810: 54000200 b.eq 4850 4814: b9400281 ldr w1, [x20] <-- **** CRASHED HERE ***** 4818: d50331bf dmb oshld 481c: 2a0103e2 mov w2, w1 ... From the crash signature x20 = ffff8000a200001b, this address ends in 0x1b which is not 4-byte aligned, so the 'ldr w1, [x20]' instruction (readl) triggers the arm64 alignment fault (FSC = 0x21). The root cause is in mana_gd_init_vf_regs(), which computes: gc->shm_base = gc->bar0_va + mana_gd_r64(gc, GDMA_REG_SHM_OFFSET); The offset is used without any validation. The same problem exists in mana_gd_init_pf_regs() for sriov_base_off and sriov_shm_off. Fix this by validating all offsets before use: - VF: check shm_off is within BAR0, properly aligned to 4 bytes (readl requirement), and leaves room for the full 256-bit (32-byte) SMC aperture. - PF: check sriov_base_off is within BAR0, aligned to 8 bytes (readq requirement), and leaves room to safely read the sriov_shm_off register at sriov_base_off + GDMA_PF_REG_SHM_OFF. Then check sriov_shm_off leaves room for the full SMC aperture. All arithmetic uses subtraction rather than addition to avoid integer overflow on garbage values. Define SMC_APERTURE_SIZE (32 bytes, derived from the 256-bit aperture width) Return -EPROTO on invalid values. The existing recovery path in mana_serv_reset() already handles -EPROTO by falling through to PCI device rescan, giving the hardware another chance to present valid register values after reset. Fixes: 9bf66036d686 ("net: mana: Handle hardware recovery events when probing the device") Signed-off-by: Dipayaan Roy Link: https://patch.msgid.link/afQUMClyjmBVfD+u@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Paolo Abeni commit 44b550d88b267320459d518c0743a241ab2108fa Author: Nan Li Date: Fri May 1 09:08:44 2026 +0800 net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue. Capture op_mmp_znotifier up front in rds_message_purge() and use it as the cleanup discriminator. If the message is already associated with a socket, keep the existing completion path. Otherwise, drop the pinned page accounting directly and release the notifier before putting the payload pages. This keeps early send failure cleanup consistent with the zerocopy lifetime rules without changing the normal queued completion path. Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Co-developed-by: Xiao Liu Signed-off-by: Xiao Liu Signed-off-by: Nan Li Signed-off-by: Ren Wei Reviewed-by: Allison Henderson Link: https://patch.msgid.link/d2ea98a6313d5467bac00f7c9fef8c7acddb9258.1777550074.git.tonanli66@gmail.com Signed-off-by: Paolo Abeni commit 0c21517ac8287678c6adc038882826d9a4b9c566 Merge: 83861c48ba122f 05416ada37aa4e Author: Paolo Abeni Date: Tue May 5 15:19:39 2026 +0200 Merge branch 'openvswitch-fix-self-deadlock-on-release-of-tunnel-vports' Ilya Maximets says: ==================== openvswitch: fix self-deadlock on release of tunnel vports Two patches - the fix for the actual bug and the selftest that reproduces it. I missed the self-deadlock in the original patch that introduced the issue, because testing required code modification in the ovs-vswitchd to force it to use legacy tunnel ports. I thought I made the change correctly, but apparently something went wrong and the tests were run with the standard LWT infra instead. The selftest added in this patch set will at least prevent this kind of mistakes in the future. I mentioned, however, that these tunnel vports are legacy and not actually used by ovs-vswitchd. RTM_NEWLINK + COLLECT_METADATA is used in conjunction with the standard OVS_VPORT_TYPE_NETDEV instead since 2017. The code to use the legacy tunnels still exists in ovs-vswitchd however, but only as a fallback for older kernels and we're planning to remove it in the next release. I'll be sending an RFC to remove support for these legacy tunnel types from the kernel, as they serve no real purpose today and only increase the uAPI surface for CVEs, but we need to fix the known bugs for stable versions. v1: https://lore.kernel.org/netdev/20260429151756.4157670-1-i.maximets@ovn.org/ ==================== Link: https://patch.msgid.link/20260430233848.440994-1-i.maximets@ovn.org Signed-off-by: Paolo Abeni commit 05416ada37aa4efe93f25b0532f551d424fb7b3d Author: Ilya Maximets Date: Fri May 1 01:38:38 2026 +0200 selftests: openvswitch: add tests for tunnel vport refcounting There were a few issues found with the tunnel vport types around the vport destruction code. Add some basic tests, so at least we know that they can be properly added and removed without obvious issues. The test creates OVS datapath, adds a non-LWT tunnel port, makes sure they are created, and then removes the datapath and waits for all the ports to be gone. The dpctl script had a few bugs in the none-lwt tunnel creation code, so fixing them as well to make the testing possible: - The type of the --lwt option changed in order to properly disable it. - Removed byte order conversion for the port numbers, as the value supposed to be in the host order. - Added missing 'gre' choice for the tunnel type. Signed-off-by: Ilya Maximets Acked-by: Eelco Chaudron Acked-by: Aaron Conole Link: https://patch.msgid.link/20260430233848.440994-3-i.maximets@ovn.org Signed-off-by: Paolo Abeni commit aa69918bd418e700309fdd08509dba324fb24296 Author: Ilya Maximets Date: Fri May 1 01:38:37 2026 +0200 openvswitch: vport: fix self-deadlock on release of tunnel ports vports are used concurrently and protected by RCU, so netdev_put() must happen after the RCU grace period. So, either in an RCU call or after the synchronize_net(). The rtnl_delete_link() must happen under RTNL and so can't be executed in RCU context. Calling synchronize_net() while holding RTNL is not a good idea for performance and system stability under load in general, so calling netdev_put() in RCU call is the right solution here. However, when the device is deleted, rtnl_unlock() will call netdev_run_todo() and block until all the references are gone. In the current code this means that we never reach the call_rcu() and the vport is never freed and the reference is never released, causing a self-deadlock on device removal. Fix that by moving the rcu_call() before the rtnl_unlock(), so the scheduled RCU callback will be executed when synchronize_net() is called from the rtnl_unlock()->netdev_run_todo() while the RTNL itself is already released. Fixes: 6931d21f87bc ("openvswitch: defer tunnel netdev_put to RCU release") Cc: stable@vger.kernel.org Acked-by: Eelco Chaudron Signed-off-by: Ilya Maximets Acked-by: Aaron Conole Link: https://patch.msgid.link/20260430233848.440994-2-i.maximets@ovn.org Signed-off-by: Paolo Abeni commit 83861c48ba122f85cc8384780764b3a791341678 Author: Ilya Maximets Date: Thu Apr 30 23:32:50 2026 +0200 openvswitch: vport: fix race between tunnel creation and linking When a tunnel vport is created it first creates the tunnel device, e.g., with geneve_dev_create_fb(), then it calls ovs_netdev_link() to take a reference and link it to the device that represents openvswitch datapath. The creation of the device is happening under RTNL, but then RTNL is released and re-acquired to find the device by name. It is technically possible for the tunnel device to be re-named or deleted within that window while RTNL is not held, and some other device created in its place. This will cause a non-tunnel device to be referenced in the vport and tunnel-specific functions used on it, e.g. vxlan_get_options() that directly casts the private netdev data into a struct vxlan_dev causing an invalid memory access: BUG: KASAN: slab-use-after-free in vxlan_get_options+0x323/0x3a0 vxlan_get_options+0x323/0x3a0 ovs_vport_cmd_new+0x6e3/0xd30 Fix that by taking a reference to the just created device before releasing RTNL. This ensures that the device in the vport is always the one that was just created. The search by name is only needed for a standard vport-netdev that links pre-existing devices, so that functionality and device type checks are moved to netdev_create(). It is also awkward that ovs_netdev_link() takes ownership of the vport and destroys it on failure. It doesn't know the type of the port it is dealing with, so we need to pass down the indicator that it's a tunnel, so the link can be properly deleted on failure. It's possible to refactor the logic to make the ovs_netdev_link() do only the linking part and let the callers perform a proper destruction, but it will be much more code for each legacy tunnel port type, so it is not worth it for the bug fix. Fixes: 614732eaa12d ("openvswitch: Use regular VXLAN net_device device") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Reported-by: Yang Yang Signed-off-by: Ilya Maximets Acked-by: Eelco Chaudron Link: https://patch.msgid.link/20260430213349.407991-1-i.maximets@ovn.org Signed-off-by: Paolo Abeni commit 8cf5dd235eff6008cb04c3d8064d2acfa90616f1 Author: Prasanna Kumar T S M Date: Wed Apr 1 04:18:56 2026 -0700 EDAC/versalnet: Fix device name memory leak The device name allocated via kzalloc() in init_one_mc() is assigned to dev->init_name but never freed on the normal removal path. device_register() copies init_name and then sets dev->init_name to NULL, so the name pointer becomes unreachable from the device. Thus leaking memory. Use a stack-local char array instead of using kzalloc() for name. Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller") Signed-off-by: Prasanna Kumar T S M Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260401111856.2342975-1-ptsm@linux.microsoft.com commit 2d4e80271f784aa0c7b17676e9762c7e8156be1c Author: Icenowy Zheng Date: Sun Apr 26 00:57:51 2026 +0800 drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds When preparing the panel, it seems that it always expects commands to be transferred in LP mode. However, the disable function removes the MIPI_DSI_MODE_LPM flag, and no other function re-adds it. As the unprepare function contains no DSI commands, re-adding the flag just after disabling the panel should be safe. Add the code re-adding the flag after the two commands for disabling the panel are sent. This fixes screen unblanking (after blanking once) on mt8188-geralt-ciri-sku1 device. Cc: stable@vger.kernel.org # 6.11+ Fixes: 0ef94554dc40 ("drm/panel: himax-hx83102: Break out as separate driver") Signed-off-by: Icenowy Zheng Reviewed-by: Neil Armstrong Reviewed-by: Douglas Anderson Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260425165751.1716569-1-zhengxingda@iscas.ac.cn commit 570cf799e87ae805eacfab3b4ba66676b5fccdb6 Author: Icenowy Zheng Date: Sun May 3 17:17:08 2026 +0800 drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds When preparing the panel, it seems that it always expects commands to be transferred in LP mode. However, the disable function removes the MIPI_DSI_MODE_LPM flag, and no other function re-adds it. As the unprepare function contains no DSI commands, re-adding the flag just after disabling the panel should be safe. Add the code re-adding the flag after the two commands for disabling the panel are sent. This fixes error messages shown in kernel log when unblanking on mt8183-kukui-kodama-sku32 device. Cc: stable@vger.kernel.org Fixes: a869b9db7adf ("drm/panel: support for boe tv101wum-nl6 wuxga dsi video mode panel") Signed-off-by: Icenowy Zheng Reviewed-by: Neil Armstrong Reviewed-by: Douglas Anderson Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260503091708.1079962-1-zhengxingda@iscas.ac.cn commit c67e8787f6743101c90c7a9c4bb7cf6f1f739f83 Author: Christian Van Date: Sat Apr 25 01:39:48 2026 -0400 drm/panel: feiyang-fy07024di26a30d: return display-on error mipi_dsi_dcs_set_display_on() returns an error code, but feiyang_enable() currently ignores it and always reports success. Return the DCS command result so callers can observe enable failures. Signed-off-by: Christian Van Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260425053948.117714-1-cvan20191@gmail.com commit defab7b01e0848e004077d7d8dcc04d305ea1a27 Author: Arnd Bergmann Date: Mon Apr 13 09:10:19 2026 +0200 drm/panel: hx83121a: select DRM_DISPLAY_DSC_HELPER Like a number of other panel drivers, this newly merged driver needs DRM_DISPLAY_DSC_HELPER to be enabled: arm-linux-gnueabi-ld: drivers/gpu/drm/panel/panel-himax-hx83121a.o: in function `himax_prepare': panel-himax-hx83121a.c:(.text+0x1024): undefined reference to `drm_dsc_pps_payload_pack' Fixes: a7c61963b727 ("drm/panel: Add Himax HX83121A panel driver") Signed-off-by: Arnd Bergmann Reviewed-by: Neil Armstrong Reviewed-by: David Heidelberg Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260413071043.3829868-1-arnd@kernel.org commit 50987d4e6c55929aa2d4d3976e74ccbae22d5017 Author: Chen Ni Date: Fri Mar 27 10:17:28 2026 +0800 drm/panel: himax-hx83121a: Fix incorrect error check for devm_drm_panel_alloc() Check devm_drm_panel_alloc() return value for ERR_PTR instead of NULL. devm_drm_panel_alloc() returns an ERR_PTR on failure, never NULL. Using a NULL check skips the error path and may cause a NULL pointer dereference. Fixes: a7c61963b727 ("drm/panel: Add Himax HX83121A panel driver") Signed-off-by: Chen Ni Reviewed-by: Pengyu Luo Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260327021728.647182-1-nichen@iscas.ac.cn commit 7cf4846a2a5b7408440584cbbc97dc476b1c52d3 Merge: 52ac35b8a15144 c88ab940798683 Author: Linus Walleij Date: Tue May 5 14:38:45 2026 +0200 Merge tag 'renesas-pinctrl-fixes-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into fixes pinctrl: renesas: Fixes for v7.1 - Fix pin bias suspend/resume handling on the RZ/G2L family, - Fix Schmitt-trigger suspend/resume handling on RZ/V2H(P), RZ/V2N, and RZ/G3E. Signed-off-by: Linus Walleij commit 027ef9a9297c6ae8be11681e0fa485c1829d0572 Merge: d0771f4995d328 af64f790969973 Author: Mark Brown Date: Tue May 5 21:23:10 2026 +0900 ASoC: wm_adsp_fw_find_test: Fix a couple of bugs Richard Fitzgerald says: This short series fixes two bugs in wm_adsp_fw_find_test. commit af64f790969973b325efda7264d6860167623cdd Author: Richard Fitzgerald Date: Tue May 5 11:51:23 2026 +0100 ASoC: wm_adsp_fw_find_test: Clear searched_fw_files in find-by-index test In wm_adsp_fw_find_test_find_firmware_byindex() the content of priv->searched_fw_files must be cleared before starting the next iteration. The files searched for are appended to priv->searched_fw_files, so if it is not cleared on each iteration it will still contain the searches from the previous iteration. Fixes: bf2d44d07de7 ("ASoC: wm_adsp: Add kunit test for firmware file search") Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260505105123.3539778-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 78538047717bdeabe8481ef611c9131e455e61df Author: Richard Fitzgerald Date: Tue May 5 11:51:22 2026 +0100 ASoC: wm_adsp_fw_find_test: Redirect wm_adsp_release_firmware_files() Redirect wm_adsp_release_firmware_files() to a replacement function that handles the dummy firmware created by the tests. Use the same cleanup function to cleanup in the test exit() function. Also call it on each loop in wm_adsp_fw_find_test_find_firmware_byindex() to free the created strings before reusing priv->found_fw on the next loop. wm_adsp_release_firmware_files() will pass the struct firmware* pointers to release_firmware(). But the pointers created by the tests are dummies and must not be passed to release_firmware(). The test never invokes wm_adsp_release_firmware_files() so it wasn't redirected. But the error handling in wm_adsp_request_firmware_files() calls wm_adsp_release_firmware_files(). The redirected function makes this safe. Using the same cleanup function to perform cleanup from the test exit() handler and wm_adsp_fw_find_test_find_firmware_byindex() avoids the risk of duplicate cleanup code that all needs updating if there is any change to the cleanup requirements. This problem was found by https://sashiko.dev. Fixes: bf2d44d07de7 ("ASoC: wm_adsp: Add kunit test for firmware file search") Closes: https://sashiko.dev/#/patchset/20260326100853.1582886-1-rf%40opensource.cirrus.com Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260505105123.3539778-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit aa4384bc8f4360167f3c3d5322121fe892289ea2 Author: Dapeng Mi Date: Thu Apr 30 08:25:57 2026 +0800 perf/x86/intel: Enable auto counter reload for DMR Panther cove µarch starts to support auto counter reload (ACR), but the static_call intel_pmu_enable_acr_event() is not updated for the Panther Cove µarch used by DMR. It leads to the auto counter reload is not really enabled on DMR. Update static_call intel_pmu_enable_acr_event() in intel_pmu_init_pnc(). Fixes: d345b6bb8860 ("perf/x86/intel: Add core PMU support for DMR") Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260430002558.712334-5-dapeng1.mi@linux.intel.com commit 1271aeccc307066315b2d3b0d5af2510e27018b5 Author: Dapeng Mi Date: Thu Apr 30 08:25:56 2026 +0800 perf/x86/intel: Disable PMI for self-reloaded ACR events On platforms with Auto Counter Reload (ACR) support, such as NVL, a "NMI received for unknown reason 30" warning is observed when running multiple events in a group with ACR enabled: $ perf record -e '{instructions/period=20000,acr_mask=0x2/u,\ cycles/period=40000,acr_mask=0x3/u}' ./test The warning occurs because the Performance Monitoring Interrupt (PMI) is enabled for the self-reloaded event (the cycles event in this case). According to the Intel SDM, the overflow bit (IA32_PERF_GLOBAL_STATUS.PMCn_OVF) is never set for self-reloaded events. Since the bit is not set, the perf NMI handler cannot identify the source of the interrupt, leading to the "unknown reason" message. Furthermore, enabling PMI for self-reloaded events is unnecessary and can lead to extraneous records that pollute the user's requested data. Disable the interrupt bit for all events configured with ACR self-reload. Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload") Reported-by: Andi Kleen Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260430002558.712334-4-dapeng1.mi@linux.intel.com commit 8ba0b706a485b1e607594cf4210786d517ad1611 Author: Dapeng Mi Date: Thu Apr 30 08:25:55 2026 +0800 perf/x86/intel: Always reprogram ACR events to prevent stale masks Members of an ACR group are logically linked via a bitmask of their hardware counter indices. If some members of the group are assigned new hardware counters during rescheduling, even events that keep their original counter index must be updated with a new mask. Without this, an event will continue to use a stale acr_mask that references the old indices of its group peers. Ensure all ACR events are reprogrammed during the scheduling path to maintain consistency across the group. Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload") Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260430002558.712334-3-dapeng1.mi@linux.intel.com commit 5ad732a56be46aabf158c16aa0c095291727aaef Author: Dapeng Mi Date: Thu Apr 30 08:25:54 2026 +0800 perf/x86/intel: Improve validation and configuration of ACR masks Currently there are several issues on the user space ACR mask validation and configuration. - The validation for user space ACR mask (attr.config2) is incomplete, e.g., the ACR mask could include the index which belongs to another ACR events group, but it's not validated. - An early return on an invalid ACR mask caused all subsequent ACR groups to be skipped. - The stale hardware ACR mask (hw.config1) is not cleared before setting new hardware ACR mask. The following changes address all of the above issues. - Figure out the event index group of an ACR group. Any bits in the user-space mask not present in the index group are now dropped. - Instead of an early return on invalid bits, drop only the invalid portions and continue iterating through all ACR events to ensure full configuration. - Explicitly clear the stale hardware ACR mask for each event prior to writing the new configuration. Besides, a non-leader event member of ACR group could be disabled in theory. This could cause bit-shifting errors in the acr_mask of remaining group members. But since ACR sampling requires all events to be active, this should not be a big concern in real use case. Add a "FIXME" comment to notice this risk. Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload") Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260430002558.712334-2-dapeng1.mi@linux.intel.com commit c69df06e4e26e50611190ce04eab92c5cc261b61 Author: Peter Zijlstra Date: Thu Mar 26 12:28:21 2026 +0100 perf/core: Fix deadlock in perf_mmap() failure path Ian noted that commit 77de62ad3de3 ("perf/core: Fix refcount bug and potential UAF in perf_mmap") would cause a deadlock due to event->mmap_mutex recursion. This happens because we're now calling perf_mmap_close() under mmap_mutex, while that function itself can also take mmap_mutex. Solve this by noting that perf_mmap_close() is far more complicated than we need at this particular point, since it deals with scenarios that cannot happen in this particular case. Replace the call to perf_mmap_close() with a very narrow undo for the case of first-exposure. If this is not the first mmap(), there is no race and it is fine to drop the lock and call perf_mmap_close() to handle to more complicated scenarios. Note: move the rb->mmap_user (namespace) handling into the rb init/free code such that it does not complicate the mmap handling. Fixes: 77de62ad3de3 ("perf/core: Fix refcount bug and potential UAF in perf_mmap") Reported-by: Ian Rogers Closes: https://patch.msgid.link/CAP-5%3DfVJyVMZw%3DDqP53Kxg58nUmJ_0bxoaeOKAbC03BVc11HaA%40mail.gmail.com Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260326112821.GK3738786@noisy.programming.kicks-ass.net commit 6bdcbd79ad12944ad46f42f0bdeb4e5b53d852d7 Merge: 07d99587396024 3985c9a56da49a Author: Paolo Abeni Date: Tue May 5 12:16:25 2026 +0200 Merge branch 'net-mana-fix-mana_destroy_rxq-cleanup-for-partial-rxq-init' Dipayaan Roy says: ==================== net: mana: Fix mana_destroy_rxq() cleanup for partial RXQ init When mana_create_rxq() fails partway through initialization (e.g. the hardware rejects the WQ object creation), the error path calls mana_destroy_rxq() to tear down a partially-initialized RXQ. This exposed multiple issues in mana_destroy_rxq() path, as it assumed the RXQ was always fully initialized, leading to multiple issues: 1. xdp_rxq_info_unreg() was called on an unregistered xdp_rxq, triggering a WARN_ON ("Driver BUG") in net/core/xdp.c. 2. mana_destroy_wq_obj() was called with INVALID_MANA_HANDLE, sending a bogus destroy command to the hardware. 3. mana_deinit_cq() was called twice — once inside mana_destroy_rxq() and again in mana_create_rxq()'s error path — causing a use-after-free since mana_destroy_rxq() frees the rxq first. This was observed during ethtool ring parameter changes when the hardware returned an error creating the RXQ. This series makes mana_destroy_rxq() safe to call at any stage of RXQ initialization by guarding each teardown step, and removes the redundant cleanup in mana_create_rxq(). ==================== Link: https://patch.msgid.link/20260430035935.1859220-1-dipayanroy@linux.microsoft.com Signed-off-by: Paolo Abeni commit 3985c9a56da49af8b2e45cb1fa55c03c89b1d471 Author: Dipayaan Roy Date: Wed Apr 29 20:57:54 2026 -0700 net: mana: remove double CQ cleanup in mana_create_rxq error path In mana_create_rxq(), the error cleanup path calls mana_destroy_rxq() followed by mana_deinit_cq(). This is incorrect for two reasons: 1. mana_destroy_rxq() already calls mana_deinit_cq() internally, so the CQ's GDMA queue is destroyed twice. 2. mana_destroy_rxq() frees the rxq via kfree(rxq) before returning. The subsequent mana_deinit_cq(apc, cq) then operates on freed memory since cq points to &rxq->rx_cq, which is embedded in the already-freed rxq structure — a use-after-free. Remove the redundant mana_deinit_cq() call from the error path since mana_destroy_rxq() already handles CQ cleanup. mana_deinit_cq() is itself safe for an uninitialized CQ as it checks for a NULL gdma_cq before proceeding. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy Reviewed-by: Aditya Garg Link: https://patch.msgid.link/20260430035935.1859220-4-dipayanroy@linux.microsoft.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit 2a1c691182823a5c149d502ac153e249ee697b4a Author: Dipayaan Roy Date: Wed Apr 29 20:57:53 2026 -0700 net: mana: Skip WQ object destruction for uninitialized RXQ In mana_destroy_rxq(), mana_destroy_wq_obj() is called unconditionally even when the WQ object was never created (rxobj is still INVALID_MANA_HANDLE). When mana_create_rxq() fails before mana_create_wq_obj() succeeds, the error path calls mana_destroy_rxq() which sends a bogus destroy command to the hardware: mana 7870:00:00.0: HWC: Failed hw_channel req: 0x1d mana 7870:00:00.0: Failed to send mana message: -71, 0x1d mana 7870:00:00.0 eth7: Failed to destroy WQ object: -71 Guard mana_destroy_wq_obj() with an INVALID_MANA_HANDLE check so that mana_destroy_rxq() is safe to call at any stage of RXQ initialization. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy Link: https://patch.msgid.link/20260430035935.1859220-3-dipayanroy@linux.microsoft.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit e9e334f8063a991b4f648b8dbb8dac44cf810540 Author: Dipayaan Roy Date: Wed Apr 29 20:57:52 2026 -0700 net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() When mana_create_rxq() fails at mana_create_wq_obj() or any step before xdp_rxq_info_reg() is called, the error path jumps to `out:` which calls mana_destroy_rxq(). mana_destroy_rxq() unconditionally calls xdp_rxq_info_unreg() on xilinx xdp_rxq that was never registered, triggering a WARN_ON in net/core/xdp.c: mana 7870:00:00.0: HWC: Failed hw_channel req: 0xc000009a mana 7870:00:00.0 eth7: Failed to create RXQ: err = -71 Driver BUG WARNING: CPU: 442 PID: 491615 at ../net/core/xdp.c:150 xdp_rxq_info_unreg+0x44/0x70 Modules linked in: tcp_bbr xsk_diag udp_diag raw_diag unix_diag af_packet_diag netlink_diag nf_tables nfnetlink tcp_diag inet_diag binfmt_misc rpcsec_gss_krb5 nfsv3 nfs_acl auth_rpcgss nfsv4 dns_resolver nfs lockd ext4 grace crc16 iscsi_tcp mbcache fscache libiscsi_tcp jbd2 netfs rpcrdma af_packet sunrpc rdma_ucm ib_iser rdma_cm iw_cm iscsi_ibft ib_cm iscsi_boot_sysfs libiscsi rfkill scsi_transport_iscsi mana_ib ib_uverbs ib_core mana hyperv_drm(X) drm_shmem_helper intel_rapl_msr drm_kms_helper intel_rapl_common syscopyarea nls_iso8859_1 sysfillrect intel_uncore_frequency_common nls_cp437 vfat fat nfit sysimgblt libnvdimm hv_netvsc(X) hv_utils(X) fb_sys_fops hv_balloon(X) joydev fuse drm dm_mod configfs ip_tables x_tables xfs libcrc32c sd_mod nvme nvme_core nvme_common t10_pi crc64_rocksoft_generic crc64_rocksoft crc64 hid_generic serio_raw pci_hyperv(X) hv_storvsc(X) scsi_transport_fc hyperv_keyboard(X) hid_hyperv(X) pci_hyperv_intf(X) crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd hv_vmbus(X) softdog sg scsi_mod efivarfs Supported: Yes, External CPU: 442 PID: 491615 Comm: ethtool Kdump: loaded Tainted: G X 5.14.21-150500.55.136-default #1 SLE15-SP5 a627be1b53abbfd64ad16b2685e4308c52847f42 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 07/25/2025 RIP: 0010:xdp_rxq_info_unreg+0x44/0x70 Code: e8 91 fe ff ff c7 43 0c 02 00 00 00 48 c7 03 00 00 00 00 5b c3 cc cc cc cc e9 58 3a 1c 00 48 c7 c7 f6 5f 19 97 e8 5c a4 7e ff <0f> 0b 83 7b 0c 01 74 ca 48 c7 c7 d9 5f 19 97 e8 48 a4 7e ff 0f 0b RSP: 0018:ff3df6c8f7207818 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ff30d89f94808a80 RCX: 0000000000000027 RDX: 0000000000000000 RSI: 0000000000000002 RDI: ff30d94bdcca2908 RBP: 0000000000080000 R08: ffffffff98ed11a0 R09: ff3df6c8f72077a0 R10: dead000000000100 R11: 000000000000000a R12: 0000000000000000 R13: 0000000000002000 R14: 0000000000040000 R15: ff30d89f94800000 FS: 00007fe6d8432b80(0000) GS:ff30d94bdcc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe6d81a89b1 CR3: 00000b3b6d578001 CR4: 0000000000371ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 Call Trace: mana_destroy_rxq+0x5b/0x2f0 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] mana_create_rxq.isra.55+0x3db/0x720 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] ? simple_lookup+0x36/0x50 ? current_time+0x42/0x80 ? __d_free_external+0x30/0x30 mana_alloc_queues+0x32a/0x470 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] ? _raw_spin_unlock+0xa/0x30 ? d_instantiate.part.29+0x2e/0x40 ? _raw_spin_unlock+0xa/0x30 ? debugfs_create_dir+0xe4/0x140 mana_attach+0x5c/0xf0 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] mana_set_ringparam+0xd5/0x1a0 [mana 267acf7006bcb696095bba4d810643d1db3b9e94] ethnl_set_rings+0x292/0x320 genl_family_rcv_msg_doit.isra.15+0x11b/0x150 genl_rcv_msg+0xe3/0x1e0 ? rings_prepare_data+0x80/0x80 ? genl_family_rcv_msg_doit.isra.15+0x150/0x150 netlink_rcv_skb+0x50/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1b6/0x280 netlink_sendmsg+0x365/0x4d0 sock_sendmsg+0x5f/0x70 __sys_sendto+0x112/0x140 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x5b/0x80 ? handle_mm_fault+0xd7/0x290 ? do_user_addr_fault+0x2d8/0x740 ? exc_page_fault+0x67/0x150 entry_SYSCALL_64_after_hwframe+0x6b/0xd5 RIP: 0033:0x7fe6d8122f06 Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 72 f3 c3 41 57 41 56 4d 89 c7 41 55 41 54 41 RSP: 002b:00007fff2b66b068 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055771123d2a0 RCX: 00007fe6d8122f06 RDX: 0000000000000034 RSI: 000055771123d3b0 RDI: 0000000000000003 RBP: 00007fff2b66b100 R08: 00007fe6d8203360 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 000055771123d350 R13: 000055771123d340 R14: 0000000000000000 R15: 00007fff2b66b2b0 Guard the xdp_rxq_info_unreg() call with xdp_rxq_info_is_reg() so that mana_destroy_rxq() is safe to call regardless of how far initialization progressed. Fixes: ed5356b53f07 ("net: mana: Add XDP support") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy Link: https://patch.msgid.link/20260430035935.1859220-2-dipayanroy@linux.microsoft.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit 4a142520d166f91627f27a7017525a228137c808 Author: Jakov Novak Date: Mon May 4 18:23:57 2026 +0200 wifi: libertas: notify firmware load wait on disconnect Currently, when the firmware is not fully loaded and if_usb_disconnect is called, if_usb_prog_firmware gets stuck waiting for cardp->surprise_removed or cardp->fwdnldover while lbs_remove_card also waits for the firmware loading to be completed, which never happens. This caused the reported syzbot bug. To address this, the wake_up function call can be added in the if_usb_disconnect function which notifies the if_usb_prog_firmware thread and resolves the firmware loading. Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence") Reported-and-tested-by: syzbot+c99d17aa44dbdba16ad2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c99d17aa44dbdba16ad2 Signed-off-by: Jakov Novak Link: https://patch.msgid.link/20260504162356.17250-2-jakovnovak30@gmail.com [fix subject] Signed-off-by: Johannes Berg commit 3780c41460a9ad6d5d4c09a416765c6cc285033b Author: Maíra Canal Date: Thu Apr 2 16:32:35 2026 -0300 drm/etnaviv: Fix armed job not being pushed to the DRM scheduler When xa_alloc_cyclic() failed in etnaviv_sched_push_job(), the error path skipped drm_sched_entity_push_job(). This is a violation of the DRM scheduler contract, as once a job has been armed with drm_sched_job_arm(), it must be pushed with drm_sched_entity_push_job(). From the DRM scheduler documentation, """ drm_sched_job_arm() is a point of no return since it initializes the fences and their sequence number etc. Once that function has been called, you *must* submit it with drm_sched_entity_push_job() and cannot simply abort it by calling drm_sched_job_cleanup(). """ Fix this by splitting the fence ID allocation into two phases: first, alloc an xarray slot before arming the job (which can fail), then fill in the actual fence with xa_store() after arming. This way, allocation failures are handled before the job is armed, and once armed, the job is always pushed to the scheduler. This also fixes a double call to drm_sched_job_cleanup(), as both etnaviv_sched_push_job() and its caller would call it on failure. Fixes: 764be12345c3 ("drm/etnaviv: convert user fence tracking to XArray") Signed-off-by: Maíra Canal Link: https://patch.msgid.link/20260402193424.2023318-1-mcanal@igalia.com Signed-off-by: Christian Gmeiner commit b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77 Author: Lee Jones Date: Wed Apr 29 13:40:42 2026 +0000 nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet (CC) can be processed concurrently with socket release. This can lead to a use-after-free of the socket object. When nfc_llcp_recv_cc() moves the socket from the connecting_sockets list to the sockets list, it does so without holding the socket lock. If llcp_sock_release() is executing concurrently, it might have already unlinked the socket and dropped its references, which can result in nfc_llcp_recv_cc() linking a freed socket into the live list. Fix this by holding lock_sock() during the state transition and list movement in nfc_llcp_recv_cc(). After acquiring the lock, check if the socket is still hashed to ensure it hasn't already been unlinked and marked for destruction by the release path. This aligns the locking pattern with recv_hdlc() and recv_disc(). Fixes: a69f32af86e3 ("NFC: Socket linked list") Signed-off-by: Lee Jones Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260429134115.3558604-2-lee@kernel.org Signed-off-by: David Heidelberg commit f4268b466190dae95a7585f69b4f1f8ad097632c Author: Lee Jones Date: Wed Apr 29 13:40:41 2026 +0000 nfc: llcp: Fix use-after-free in llcp_sock_release() llcp_sock_release() unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by checking the socket state and unlinking from the correct list. Fixes: b4011239a08e ("NFC: llcp: Fix non blocking sockets connections") Signed-off-by: Lee Jones Link: https://patch.msgid.link/20260429134115.3558604-1-lee@kernel.org Signed-off-by: David Heidelberg commit 52ac35b8a151446481496404af3a8e5e889b3c5a Author: Maulik Shah Date: Tue Apr 28 17:44:58 2026 +0530 pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 PDC interrupts 122-125 were meant for ibi_i3c wakeup but sm8150 do not support i3c. GPIOs 39,51,88 and 144 are also connected to different PDC pin and already reflected in the wake irq map. Remove the unsupported wakeup interrupts from the map. Fixes: 90337380c809 ("pinctrl: qcom: sm8150: Specify PDC map") Reviewed-by: Konrad Dybcio Signed-off-by: Maulik Shah Signed-off-by: Navya Malempati Signed-off-by: Linus Walleij commit d25e5cbac4e2287c843fc8b45c50dd8e57e3a696 Author: Andy Shevchenko Date: Mon May 4 12:00:28 2026 +0200 auxdisplay: max6959: use regmap_assign_bits() in max6959_enable() Replace the ternary with a direct call to the regmap_assign_bits() helper and save a couple lines of code. Signed-off-by: Andy Shevchenko commit 5f8719945244dd65b5fa06195f4600db62581610 Author: Juergen Gross Date: Tue May 5 10:06:53 2026 +0200 x86/xen: Fix a potential problem in xen_e820_resolve_conflicts() When fixing a conflict in xen_e820_resolve_conflicts(), the loop over the E820 map entries needs to be restarted, as the E820 map will have been modified by the fix. Otherwise entries might be skipped by accident. Fixes: be35d91c8880 ("xen: tolerate ACPI NVS memory overlapping with Xen allocated memory") Signed-off-by: Juergen Gross Signed-off-by: Ingo Molnar Cc: xen-devel@lists.xenproject.org Link: https://patch.msgid.link/20260505080653.197775-1-jgross@suse.com commit d1fa83ecac31093a550534a79a33bc7f4ba8fc10 Author: Uladzislau Rezki (Sony) Date: Tue Apr 28 18:14:19 2026 +0200 rhashtable: Add bucket_table_free_atomic() helper rhashtable_insert_rehash() allocates a new bucket table with GFP_ATOMIC, as it is called from an RCU read-side critical section. If rhashtable_rehash_attach() then fails, the new table is freed via kvfree(). This is unsafe, since kvfree() may fall back to vfree() for vmalloc-backed allocations, which can sleep and trigger: BUG: sleeping function called from invalid context Add bucket_table_free_atomic(), which uses kvfree_atomic() so the table can be freed safely from non-sleeping context. Signed-off-by: Uladzislau Rezki (Sony) Signed-off-by: Herbert Xu commit dad0d91cc2c3e6b6fb285ccfe7ddf71525797198 Author: Uladzislau Rezki (Sony) Date: Tue Apr 28 18:14:18 2026 +0200 mm/slab: Add kvfree_atomic() helper kvmalloc() now supports non-sleeping GFP flags, including the vmalloc fallback path. This means it may return vmalloc memory even for GFP_ATOMIC and GFP_NOWAIT allocations. Freeing such memory with kvfree() may then end up calling vfree(), which is not safe for non-sleeping contexts. Introduce kvfree_atomic() helper for such cases. It mirrors kvfree(), but uses vfree_atomic() for vmalloced memory. Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Vlastimil Babka (SUSE) Acked-by: Harry Yoo (Oracle) Signed-off-by: Herbert Xu commit 09ae540e1d5c02210795911bf5459282d7af04e9 Author: Mikhail Gavrilov Date: Thu Apr 23 02:33:49 2026 +0500 rhashtable: drop ht->mutex in rhashtable_free_and_destroy() rhashtable_free_and_destroy() is a single-shot teardown routine: cancel_work_sync() has already quiesced the deferred rehash worker, and the function's documented contract requires the caller to guarantee no other concurrent access to the rhashtable. Under those conditions ht->mutex is not protecting anything -- taking it is a leftover from the original teardown path. That leftover is actively harmful: it closes a circular lock-class dependency with fs_reclaim. The deferred rehash worker takes ht->mutex and then allocates GFP_KERNEL memory in bucket_table_alloc(), establishing &ht->mutex -> fs_reclaim After commit b32c4a213698 ("xattr: add rhashtable-based simple_xattr infrastructure") introduced simple_xattr_ht_free(), which calls rhashtable_free_and_destroy(), the simple_xattrs teardown became reachable from evict() under the dcache shrinker. The subsequent per-subsystem adaptations made the reverse edge concrete in three independent code paths: * commit 52b364fed6e1 ("shmem: adapt to rhashtable-based simple_xattrs with lazy allocation") * commit 5bd97f5c5f24 ("kernfs: adapt to rhashtable-based simple_xattrs with lazy allocation") * commit 50704c391fbf ("pidfs: adapt to rhashtable-based simple_xattrs") Any of the three closes the cycle fs_reclaim -> &ht->mutex which lockdep reports as follows. This particular splat was observed organically on a workstation kernel built from vfs-7.1-rc1.xattr at ~35h uptime under normal mixed workload, with CONFIG_PROVE_LOCKING=y. The path happens to go through kernfs: WARNING: possible circular locking dependency detected 7.0.0-faeab166167f-with-fixes-v1+ #191 Tainted: G U kswapd0/243 is trying to acquire lock: ffff8882e475c0f8 (&ht->mutex){+.+.}-{4:4}, at: rhashtable_free_and_destroy+0x36/0x740 but task is already holding lock: ffffffffa8ad1d00 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x995/0x1600 the existing dependency chain (in reverse order) is: -> #1 (fs_reclaim){+.+.}-{0:0}: __lock_acquire+0x506/0xbf0 lock_acquire.part.0+0xc7/0x280 fs_reclaim_acquire+0xd9/0x130 __kvmalloc_node_noprof+0xcd/0xb40 bucket_table_alloc.isra.0+0x5a/0x440 rhashtable_rehash_alloc+0x4e/0xd0 rht_deferred_worker+0x14b/0x440 process_one_work+0x8fd/0x16a0 worker_thread+0x601/0xff0 kthread+0x36b/0x470 ret_from_fork+0x5bf/0x910 ret_from_fork_asm+0x1a/0x30 -> #0 (&ht->mutex){+.+.}-{4:4}: check_prev_add+0xdb/0xce0 validate_chain+0x554/0x780 __lock_acquire+0x506/0xbf0 lock_acquire.part.0+0xc7/0x280 __mutex_lock+0x1b2/0x2550 rhashtable_free_and_destroy+0x36/0x740 kernfs_put.part.0+0x119/0x570 evict+0x3b6/0x9c0 __dentry_kill+0x181/0x540 shrink_dentry_list+0x135/0x440 prune_dcache_sb+0xdb/0x150 super_cache_scan+0x2ff/0x520 do_shrink_slab+0x35a/0xee0 shrink_slab_memcg+0x457/0x950 shrink_slab+0x43b/0x550 shrink_one+0x31a/0x6f0 shrink_many+0x31e/0xc80 shrink_node+0xeb3/0x14a0 balance_pgdat+0x8ed/0x1600 kswapd+0x2f3/0x530 kthread+0x36b/0x470 ret_from_fork+0x5bf/0x910 ret_from_fork_asm+0x1a/0x30 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(&ht->mutex); lock(fs_reclaim); lock(&ht->mutex); Note that lockdep tracks lock classes, not instances: the two &ht->mutex sites are on different rhashtable objects (the deferred worker was triggered by some unrelated rhashtable growth), but because rhashtable_init() uses a single static lockdep key for all rhashtables, this is a real class-level cycle. Once reported, lockdep disables itself for the remainder of the boot, masking any subsequent locking bugs. Drop the mutex. After cancel_work_sync() the rehash worker is quiesced and, per this function's contract, no other concurrent access is possible; the tables are therefore owned exclusively by this function and can be walked without any lock held. Switch the table walks from rht_dereference() (which requires ht->mutex to be held under CONFIG_PROVE_RCU) to rcu_dereference_raw(), which has no lockdep annotation. rht_ptr_exclusive() already uses rcu_dereference_protected(p, 1) and needs no change. This is the only place in lib/rhashtable.c where &ht->mutex is acquired from a path reachable under fs_reclaim; the deferred worker is the only other site and it is the forward edge. Removing the acquisition here therefore eliminates the class cycle for all three subsystems that use simple_xattrs, not just the one in the splat above. No locking-semantics change is introduced for correct users; incorrect users would already be racing with rehash worker completion regardless of the mutex. Synthetic reproduction of the splat within a few-minute window was unsuccessful across several attempts (tmpfs and kernfs zombies via cgroupfs with open-fd-through-rmdir, with and without swap, up to ~60k reclaim-path executions of simple_xattr_ht_free() in a single run), consistent with the rare coincidence-of-edges profile of the bug: the forward edge is already registered in /proc/lockdep on any idle system via rht_deferred_worker, but the reverse edge requires evict() to complete kernfs_put()'s final release inside the fs_reclaim critical section, which in my attempts was ordered against rather than interleaved with the worker. Fixes: b32c4a213698 ("xattr: add rhashtable-based simple_xattr infrastructure") Signed-off-by: Mikhail Gavrilov Signed-off-by: Herbert Xu commit 212ec34e4e726e8cd4af7bea4740db24de8a9dab Author: Jens Axboe Date: Mon May 4 08:34:32 2026 -0600 block: only read from sqe on initial invocation of blkdev_uring_cmd() This passthrough helper currently only supports discards. Part of that command is the start and length, which is read from the SQE. It does so on every invocation, where it really should just make it stable on the first invocation. This avoids needing to copy the SQE upfront, as we only really need those two 8b values stored in our per-req payload. Cc: stable@vger.kernel.org # 6.17+ Signed-off-by: Jens Axboe commit 2c340aab5485ebe9e33c01437dd4815ef33c8df5 Author: Ard Biesheuvel Date: Fri May 1 09:16:38 2026 +0200 x86/efi: Restore IRQ state in EFI page fault handler The kernel's softirq API does not permit re-enabling softirqs while IRQs are disabled. The reason for this is that local_bh_enable() will not only re-enable delivery of softirqs over the back of IRQs, it will also handle any pending softirqs immediately, regardless of whether IRQs are enabled at that point. For this reason, commit d02198550423 ("x86/fpu: Improve crypto performance by making kernel-mode FPU reliably usable in softirqs") disables softirqs only when IRQs are enabled, as it is not permitted otherwise, but also unnecessary, given that asynchronous softirq delivery never happens to begin with while IRQs are disabled. However, this does mean that entering a kernel mode FPU section with IRQs enabled and leaving it with IRQs disabled leads to problems, as identified by Sashiko [0]: the EFI page fault handler is called from page_fault_oops() with IRQs disabled, and thus ends the kernel mode FPU section with IRQs disabled as well, regardless of whether IRQs were enabled when it was started. This may result in schedule() being called with a non-zero preempt_count, causing a BUG(). So take care to re-enable IRQs when handling any EFI page faults if they were taken with IRQs enabled. [0] https://sashiko.dev/#/patchset/20260430074107.27051-1-ivan.hu%40canonical.com Cc: Eric Biggers Cc: Ivan Hu Cc: x86@kernel.org Cc: Fixes: d02198550423 ("x86/fpu: Improve crypto performance by making kernel-mode FPU reliably usable in softirqs") Reviewed-by: Eric Biggers Signed-off-by: Ard Biesheuvel commit aab3d205a086233c612fee86009265451793e0c2 Author: Juha-Pekka Heikkila Date: Mon Apr 27 19:57:15 2026 +0300 drm/i915/display: enable ccs modifiers on dg2 Since Xe driver aux ccs enablement dg2 ccs modifiers have been disabled on i915 driver. Here allow dg2 to use ccs again for framebuffers. Fixes: 6a99e91a6ca8 ("drm/i915/display: Detect AuxCCS support via display parent interface") Signed-off-by: Juha-Pekka Heikkila Reviewed-by: Ville Syrjälä Signed-off-by: Mika Kahola Link: https://patch.msgid.link/20260427165715.864721-1-juhapekka.heikkila@gmail.com (cherry picked from commit aee13ba1448213975f36942ba5d1ce693eb5c002) Signed-off-by: Tvrtko Ursulin commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 Author: Kuan-Ting Chen Date: Mon May 4 23:27:12 2026 +0800 xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data(). Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES") Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES") Reported-by: Hyunwoo Kim Reported-by: Kuan-Ting Chen Tested-by: Hyunwoo Kim Cc: stable@vger.kernel.org Signed-off-by: Kuan-Ting Chen Signed-off-by: Steffen Klassert commit 07d99587396024932e02474c3a5bede71d108454 Author: Daniel Golle Date: Sat May 2 11:55:02 2026 +0100 net: dsa: mt7530: fix .get_stats64 sleeping in atomic context The .get_stats64 callback runs in atomic context, but on MDIO-connected switches every register read acquires the MDIO bus mutex, which can sleep: [ 12.645973] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:609 [ 12.654442] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 759, name: grep [ 12.663377] preempt_count: 0, expected: 0 [ 12.667410] RCU nest depth: 1, expected: 0 [ 12.671511] INFO: lockdep is turned off. [ 12.675441] CPU: 0 UID: 0 PID: 759 Comm: grep Tainted: G S W 7.0.0+ #0 PREEMPT [ 12.675453] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN [ 12.675456] Hardware name: Bananapi BPI-R64 (DT) [ 12.675459] Call trace: [ 12.675462] show_stack+0x14/0x1c (C) [ 12.675477] dump_stack_lvl+0x68/0x8c [ 12.675487] dump_stack+0x14/0x1c [ 12.675495] __might_resched+0x14c/0x220 [ 12.675504] __might_sleep+0x44/0x80 [ 12.675511] __mutex_lock+0x50/0xb10 [ 12.675523] mutex_lock_nested+0x20/0x30 [ 12.675532] mt7530_get_stats64+0x40/0x2ac [ 12.675542] dsa_user_get_stats64+0x2c/0x40 [ 12.675553] dev_get_stats+0x44/0x1e0 [ 12.675564] dev_seq_printf_stats+0x24/0xe0 [ 12.675575] dev_seq_show+0x14/0x3c [ 12.675583] seq_read_iter+0x37c/0x480 [ 12.675595] seq_read+0xd0/0xec [ 12.675605] proc_reg_read+0x94/0xe4 [ 12.675615] vfs_read+0x98/0x29c [ 12.675625] ksys_read+0x54/0xdc [ 12.675633] __arm64_sys_read+0x18/0x20 [ 12.675642] invoke_syscall.constprop.0+0x54/0xec [ 12.675653] do_el0_svc+0x3c/0xb4 [ 12.675662] el0_svc+0x38/0x200 [ 12.675670] el0t_64_sync_handler+0x98/0xdc [ 12.675679] el0t_64_sync+0x158/0x15c For MDIO-connected switches, poll MIB counters asynchronously using a delayed workqueue every second and let .get_stats64 return the cached values under a spinlock. A mod_delayed_work() call on each read triggers an immediate refresh so counters stay responsive when queried more frequently. MMIO-connected switches (MT7988, EN7581, AN7583) are not affected because their regmap does not sleep, so they continue to read MIB counters directly in .get_stats64. Fixes: 88c810f35ed5 ("net: dsa: mt7530: implement .get_stats64") Signed-off-by: Daniel Golle Acked-by: Chester A. Unal Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/6940b913da2c29156f0feff74b678d3c526ee84c.1777719253.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit a6039776c7994dd0b9a4acce23a3f897d1688cbf Author: Kuniyuki Iwashima Date: Sat May 2 18:07:47 2026 +0000 ipmr: Add __rcu to netns_ipv4.mrt. kernel test robot reported this Sparse warning: $ make C=1 net/ipv4/ipmr.o net/ipv4/ipmr.c:312:24: error: incompatible types in comparison expression (different address spaces): net/ipv4/ipmr.c:312:24: struct mr_table [noderef] __rcu * net/ipv4/ipmr.c:312:24: struct mr_table * Let's add __rcu annotation to netns_ipv4.mrt. Fixes: b3b6babf4751 ("ipmr: Free mr_table after RCU grace period.") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605030032.glNApko7-lkp@intel.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502180755.359554-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 30cb24f97d44f6b81c14b85c5323de62eef1fb7f Author: David Carlier Date: Sat May 2 15:19:45 2026 +0100 psp: strip variable-length PSP header in psp_dev_rcv() psp_dev_rcv() unconditionally removes a fixed PSP_ENCAP_HLEN, even when psph->hdrlen indicates that the PSP header carries optional fields. A frame whose PSP header advertises a non-zero VC or any extension would therefore be silently mis-decapsulated: option bytes would spill into the inner packet head and downstream parsing would fail on a corrupted skb. Compute the full PSP header length from psph->hdrlen, pull the optional bytes into the linear region, and strip the whole header when decapsulating. Optional fields (VC, ...) are still ignored, just discarded with the rest of the header instead of leaking. crypt_offset and the VIRT flag are intentionally not validated here - callers know their device's PSP implementation and can decide. Both in-tree callers gate on hardware-validated PSP, so this is a correctness fix rather than a reachable corruption path under current configurations. Fixes: 0eddb8023cee ("psp: provide decapsulation and receive helper for drivers") Reviewed-by: Willem de Bruijn Reviewed-by: Daniel Zahka Cc: stable@vger.kernel.org Signed-off-by: David Carlier Link: https://patch.msgid.link/20260502141945.14484-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski commit ac0841d7d202073415c808bda7848502163b87dd Author: Eric Dumazet Date: Sat May 2 12:41:02 2026 +0000 net: prevent possible UAF in rtnl_prop_list_size() I was mistaken by synchronize_rcu() [1] call in netdev_name_node_alt_destroy(), giving a false sense of RCU safety at delete times. We have to use list_del_rcu() to not confuse potential readers in rtnl_prop_list_size(). [1] This synchronize_rcu() call was later removed in commit 723de3ebef03 ("net: free altname using an RCU callback"). Fixes: 9f30831390ed ("net: add rcu safety to rtnl_prop_list_size()") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260502124102.499204-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9d7ebff0c3d90ff7abdb7a77c5906b3c870f70cf Merge: 059b7dbd20a6f0 70ece9d7021c54 Author: Jakub Kicinski Date: Mon May 4 19:20:52 2026 -0700 Merge branch 'mptcp-misc-fixes-for-v7-1-rc3' Matthieu Baerts says: ==================== mptcp: misc fixes for v7.1-rc3 Here are various unrelated fixes: - Patch 1: increment the right MIB counter. A fix for v5.7. - Patch 2: set the right MPTCP reset reason. A fix for v5.9. - Patch 3: fix rx timestamp corruption when on MPTCP passive fastopen. A fix for v6.2. - Patch 4: increase sockopt seq after having set TCP_MAXSEG to propagate it to newer subflows later. A fix for 6.17. ==================== Link: https://patch.msgid.link/20260501-net-mptcp-misc-fixes-7-1-rc3-v1-0-b70118df778e@kernel.org Signed-off-by: Jakub Kicinski commit 70ece9d7021c54cf40c72b31b066e9088f5f75f5 Author: Matthieu Baerts (NGI0) Date: Fri May 1 21:35:37 2026 +0200 mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf mptcp_setsockopt_all_sf() was missing a call to sockopt_seq_inc(). This is required not to cause missing synchronization for newer subflows created later on. This helper is called each time a socket option is set on subflows, and future ones will need to inherit this option after their creation. Fixes: 51c5fd09e1b4 ("mptcp: add TCP_MAXSEG sockopt support") Cc: stable@vger.kernel.org Suggested-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260501-net-mptcp-misc-fixes-7-1-rc3-v1-4-b70118df778e@kernel.org Signed-off-by: Jakub Kicinski commit 6254a16d6f0c672e3809ca5d7c9a28a55d71f764 Author: Paolo Abeni Date: Fri May 1 21:35:36 2026 +0200 mptcp: fix rx timestamp corruption on fastopen The skb cb offset containing the timestamp presence flag is cleared before loading such information. Cache such value before MPTCP CB initialization. Fixes: 36b122baf6a8 ("mptcp: add subflow_v(4,6)_send_synack()") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260501-net-mptcp-misc-fixes-7-1-rc3-v1-3-b70118df778e@kernel.org Signed-off-by: Jakub Kicinski commit a6da02d4c00fdda2417e42ad2b762a9209e6cc49 Author: Shardul Bankar Date: Fri May 1 21:35:35 2026 +0200 mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure When HMAC validation fails on a received ACK + MP_JOIN in subflow_syn_recv_sock(), the subflow is reset with reason MPTCP_RST_EPROHIBIT ("Administratively prohibited"). This is incorrect: HMAC validation failure is an MPTCP protocol-level error, not an administrative policy denial. The mirror site on the client, in subflow_finish_connect(), already uses MPTCP_RST_EMPTCP ("MPTCP-specific error") for the same kind of HMAC failure on the SYN/ACK + MP_JOIN. Use the same reason on the server side for symmetry and accuracy. Suggested-by: Matthieu Baerts (NGI0) Fixes: 443041deb5ef ("mptcp: fix NULL pointer in can_accept_new_subflow") Cc: stable@vger.kernel.org Signed-off-by: Shardul Bankar Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260501-net-mptcp-misc-fixes-7-1-rc3-v1-2-b70118df778e@kernel.org Signed-off-by: Jakub Kicinski commit c4a99a921949cddc590b22bb14eeb23dffcc3ba6 Author: Shardul Bankar Date: Fri May 1 21:35:34 2026 +0200 mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure In subflow_finish_connect(), HMAC validation of the server's HMAC in SYN/ACK + MP_JOIN increments MPTCP_MIB_JOINACKMAC ("HMAC was wrong on ACK + MP_JOIN") on failure. The function processes the SYN/ACK, not the ACK; the matching MPTCP_MIB_JOINSYNACKMAC counter ("HMAC was wrong on SYN/ACK + MP_JOIN") exists but is not incremented anywhere in the tree. The mirror site on the server, subflow_syn_recv_sock(), already uses JOINACKMAC correctly for ACK HMAC failure. Use JOINSYNACKMAC at the SYN/ACK validation site so each counter reflects the packet whose HMAC actually failed. Suggested-by: Matthieu Baerts (NGI0) Fixes: fc518953bc9c ("mptcp: add and use MIB counter infrastructure") Cc: stable@vger.kernel.org Signed-off-by: Shardul Bankar Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260501-net-mptcp-misc-fixes-7-1-rc3-v1-1-b70118df778e@kernel.org Signed-off-by: Jakub Kicinski commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5 Author: Eric Dumazet Date: Thu Apr 30 12:26:52 2026 +0000 vsock/virtio: fix potential unbounded skb queue virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. virtio_transport_recv_enqueue() skips coalescing for packets with VIRTIO_VSOCK_SEQ_EOM. If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, a very large number of packets can be queued because vvs->rx_bytes stays at 0. Fix this by estimating the skb metadata size: (Number of skbs in the queue) * SKB_TRUESIZE(0) Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit") Signed-off-by: Eric Dumazet Cc: Arseniy Krasnov Cc: Stefan Hajnoczi Cc: Stefano Garzarella Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: Xuan Zhuo Cc: "Eugenio Pérez" Cc: virtualization@lists.linux.dev Link: https://patch.msgid.link/20260430122653.554058-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 36bdc0e815b4e8a05b9028d8ef8a25e1ead35cc1 Author: Markus Baier Date: Fri May 1 18:39:41 2026 +0200 net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks Commit e0bffe3e6894 ("net: asix: ax88772: migrate to phylink") replaced the asix_adjust_link() PHY callback with phylink's mac_link_up() and mac_link_down() handlers, but did not carry over the usbnet_link_change() notification that commit 805206e66fab ("net: asix: fix "can't send until first packet is send" issue") had added. As a result, the original symptom returns: when the link comes up, usbnet is never notified, so the RX URB submission stays dormant until some other event (e.g. a transmitted packet triggering the status endpoint interrupt) wakes it up. This is reproducible with the Apple A1277 USB Ethernet Adapter (05ac:1402, AX88772A based) on a Banana Pro using a static IPv4 configuration. After bringing the interface up, no incoming packets are received until the first outgoing frame triggers usbnet's RX path. Restore the link change notification, gated on a carrier transition so the call remains idempotent if the status endpoint also reports the change later. Fixes: e0bffe3e6894 ("net: asix: ax88772: migrate to phylink") Signed-off-by: Markus Baier Tested-by: Oleksij Rempel Link: https://patch.msgid.link/20260501163941.107668-1-Markus.Baier@soslab.tu-darmstadt.de Signed-off-by: Jakub Kicinski commit d0771f4995d3285756bf496cf6e346df99481f83 Author: James Calligeros Date: Sun May 3 22:23:24 2026 +1000 ASoC: tas2770: Deal with bogus initial temperature value TAS2770 initialises the temperature readout registers to 0. This value persists until the chip is fully powered up and the ADC starts sampling. The ADC then persists the last sampled temperature during software shutdown. The ADC should therefore never return 0 in normal operating conditions, so return -ENODATA and mark it as a fault condition using HWMON_T_FAULT. Fixes: ff73e2780169 ("ASoC: tas2770: expose die temp to hwmon") Signed-off-by: James Calligeros Signed-off-by: Mark Brown commit 915f9860fe1c9f7eb6c48c299b2db64fd57ef32f Author: James Calligeros Date: Sun May 3 22:23:23 2026 +1000 ASoC: tas2764: Deal with bogus initial temperature register value The TAS2764 datasheet specifies that the chip initialises the temperature register such that the temperature reading is 2.6 *C, ostensibly to prevent tripping the chip's protection circuitry. The chip is not capable of representing 2.6 *C however, and the register is actually initialised to 0. The ADC does not start sampling until the chip is powered up, and the last sampled temperature persists in the register during software shutdown. Therefore, any reading returning 0 is almost certain to be from before the ADC has actually started sampling, meaning that it is invalid. Return -ENODATA early if the temperature has not yet been sampled by the chip, and indicate a fault condition using HWMON_T_FAULT. Fixes: 186dfc85f9a8 ("ASoC: tas2764: expose die temp to hwmon") Signed-off-by: James Calligeros Signed-off-by: Mark Brown commit 76b93a8107574006b25495664304ea9237494d70 Author: Breno Leitao Date: Fri May 1 02:58:41 2026 -0700 netpoll: pass buffer size to egress_dev() to avoid MAC truncation egress_dev() formats np->dev_mac via snprintf() but receives buf as a bare char *, so it cannot derive the buffer size from the pointer. The size argument was hardcoded to MAC_ADDR_STR_LEN (3 * ETH_ALEN - 1 = 17), which is silly wrong in two ways: 1) misleading kernel log output on the MAC-selected target path (np->dev_name[0] == '\0'); for example "aa:bb:cc:dd:ee:ff doesn't exist, aborting" was logged as "aa:bb:cc:dd:ee:f doesn't exist, aborting". 2) the second argument of snprintf is the size of the buffer, not the size of what you want to write. Add a bufsz parameter to egress_dev() and pass sizeof(buf) from each caller, matching the standard snprintf() idiom and removing the hardcoded size from the helper. Every caller already declares "char buf[MAC_ADDR_STR_LEN + 1]" so the formatted MAC continues to fit. Tested by booting with netconsole=6665@/aa:bb:cc:dd:ee:ff,6666@10.0.0.1/00:11:22:33:44:55 on a kernel without a matching device. Pre-fix dmesg shows "aa:bb:cc:dd:ee:f doesn't exist, aborting"; post-fix shows the full "aa:bb:cc:dd:ee:ff doesn't exist, aborting". Fixes: f8a10bed32f5 ("netconsole: allow selection of egress interface via MAC address") Cc: stable@vger.kernel.org Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260501-netpoll_snprintf_fix-v1-1-84b0566e6597@debian.org Signed-off-by: Jakub Kicinski commit d82ba05263c69fa2437fe93e4e561cc40f4c03af Author: Kuniyuki Iwashima Date: Fri May 1 07:39:41 2026 +0000 af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc(). Fixes: 8b90a9f819dc ("af_unix: Run GC on only one CPU.") Reported-by: Igor Ushakov Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260501073945.1884564-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 8f78b749f3da0f43990490b4c1193b5ede3eec0a Author: Waiman Long Date: Thu Apr 30 10:44:20 2026 +0300 sched/isolation: Make HK_TYPE_KTHREAD an alias of HK_TYPE_DOMAIN Since commit 041ee6f3727a ("kthread: Rely on HK_TYPE_DOMAIN for preferred affinity management"), kthreads default to use the HK_TYPE_DOMAIN cpumask. IOW, it is no longer affected by the setting of the nohz_full boot kernel parameter. That means HK_TYPE_KTHREAD should now be an alias of HK_TYPE_DOMAIN instead of HK_TYPE_KERNEL_NOISE to correctly reflect the current kthread behavior. Make the change as HK_TYPE_KTHREAD is still being used in some networking code. Fixes: 041ee6f3727a ("kthread: Rely on HK_TYPE_DOMAIN for preferred affinity management") Signed-off-by: Waiman Long Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit aa6065206987278291c09d0c6aebed687114c925 Author: Waiman Long Date: Thu Apr 30 10:44:19 2026 +0300 ipvs: Guard access of HK_TYPE_KTHREAD cpumask with RCU The ip_vs_ctl.c file and the associated ip_vs.h file are the only places in the kernel where HK_TYPE_KTHREAD cpumask is being retrieved and used. Now that HK_TYPE_KTHREAD/HK_TYPE_DOMAIN cpumask can be changed at run time. We need to use RCU to guard access to this cpumask to avoid a potential UAF problem as the returned cpumask may be freed before it is being used. We can replace HK_TYPE_KTHREAD by HK_TYPE_DOMAIN as they are aliases of each other, but keeping the HK_TYPE_KTHREAD name can highlight the fact that it is the kthread initiated by ipvs that is being controlled. Fixes: 03ff73510169 ("cpuset: Update HK_TYPE_DOMAIN cpumask from cpuset") Signed-off-by: Waiman Long Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit 4ee52b7021a7cb9356f8b9aff5631c68512a9e1b Author: Julian Anastasov Date: Thu Apr 30 10:44:18 2026 +0300 ipvs: fix shift-out-of-bounds in ip_vs_rht_desired_size Calling roundup_pow_of_two() with 0 has undefined result: UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13 shift exponent 64 is too large for 64-bit type 'unsigned long' CPU: 1 UID: 0 PID: 77 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: events_unbound conn_resize_work_handler Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233 __ubsan_handle_shift_out_of_bounds+0x385/0x410 lib/ubsan.c:494 __roundup_pow_of_two include/linux/log2.h:57 [inline] ip_vs_rht_desired_size+0x2cf/0x410 net/netfilter/ipvs/ip_vs_core.c:240 ip_vs_conn_desired_size net/netfilter/ipvs/ip_vs_conn.c:765 [inline] conn_resize_work_handler+0x1b6/0x14c0 net/netfilter/ipvs/ip_vs_conn.c:822 process_one_work kernel/workqueue.c:3302 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3385 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3466 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Reported-by: syzbot+217f1db9c791e27fe54a@syzkaller.appspotmail.com Fixes: b655388111cf ("ipvs: add resizable hash tables") Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit 2fd109238925d53c44ea409df0558844af7877b8 Author: Julian Anastasov Date: Thu Apr 30 10:44:17 2026 +0300 ipvs: fix races around est_mutex and est_cpulist Sashiko reports for races and possible crash around the usage of est_cpulist_valid and sysctl_est_cpulist. The problem is that we do not lock est_mutex in some places which can lead to wrong write ordering and as result problems when calling cpumask_weight() and cpumask_empty(). Fix them by moving the est_max_threads read/write under locked est_mutex. Do the same for one ip_vs_est_reload_start() call to protect the cpumask_empty() usage of sysctl_est_cpulist. To remove the chance of deadlock while stopping the estimation kthreads, keep the data structure for kthread 0 even after last estimator is removed and do not hold mutexes while stopping this task. Now we will use a new flag 'needed' to know when kthread 0 should run. The kthreads above 0 do not use mutexes, so stop them under est_mutex because their kthread data still can be destroyed if they do not serve estimators. Now all kthreads will be started by the est_reload_work to properly serialize the stop/start for kthread 0. Reduce the use of service_mutex in ip_vs_est_calc_phase() because under est_mutex we can safely walk est_kt_arr to stop the kthreads above slot 0. As ip_vs_stop_estimator() for tot_stats should be called under service_mutex, do it early in the netns exit path in ip_vs_flush() to avoid locking the mutex again later. It still should be called in ip_vs_control_net_cleanup_sysctl() when we are called during netns init error. Use -2 for ktid as indicator if estimator was already stopped. Finally, fix use-after-free for kd->est_row in ip_vs_est_calc_phase(). est->ktrow should simply switch to a delay value while estimator is linked to est_temp_list. Link: https://sashiko.dev/#/patchset/20260331165015.2777765-1-longman%40redhat.com Link: https://sashiko.dev/#/patchset/20260420171308.87192-1-ja%40ssi.bg Link: https://sashiko.dev/#/patchset/20260422125123.40658-1-ja%40ssi.bg Link: https://sashiko.dev/#/patchset/20260424175858.54752-1-ja%40ssi.bg Link: https://sashiko.dev/#/patchset/20260425103918.7447-1-ja%40ssi.bg Fixes: f0be83d54217 ("ipvs: add est_cpulist and est_nice sysctl vars") Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit fbe1e01e818ee6db86ff947599bf0bea96de7e71 Author: Julian Anastasov Date: Thu Apr 30 10:44:16 2026 +0300 ipvs: do not leak dest after get from dest trash Sashiko warns about leaked dest if ip_vs_start_estimator() fails in ip_vs_add_dest(). Add ip_vs_trash_put_dest() to put back the dest into dest trash. Link: https://sashiko.dev/#/patchset/20260428175725.72050-1-ja%40ssi.bg Fixes: 705dd3444081 ("ipvs: use kthreads for stats estimation") Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit d493d9de1c21313cf62be0f6e1a4d48385fa7beb Author: Julian Anastasov Date: Thu Apr 30 10:44:15 2026 +0300 ipvs: fix the spin_lock usage for RT build syzbot reports for sleeping function called from invalid context [1]. The recently added code for resizable hash tables uses hlist_bl bit locks in combination with spin_lock for the connection fields (cp->lock). Fix the following problems: * avoid using spin_lock(&cp->lock) under locked bit lock because it sleeps on PREEMPT_RT * as the recent changes call ip_vs_conn_hash() only for newly allocated connection, the spin_lock can be removed there because the connection is still not linked to table and does not need cp->lock protection. * the lock can be removed also from ip_vs_conn_unlink() where we are the last connection user. * the last place that is fixed is ip_vs_conn_fill_cport() where now the cp->lock is locked before the other locks to ensure other packets do not modify the cp->flags in non-atomic way. Here we make sure cport and flags are changed only once if two or more packets race to fill the cport. Also, we fill cport early, so that if we race with resizing there will be valid cport key for the hashing. Add a warning if too many hash table changes occur for our RCU read-side critical section which is error condition but minor because the connection still can expire gracefully. Still, restore the cport to 0 to allow retransmitted packet to properly fill the cport. Problems reported by Sashiko. [1]: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 16, name: ktimers/0 preempt_count: 2, expected: 0 RCU nest depth: 3, expected: 3 8 locks held by ktimers/0/16: #0: ffffffff8de5f260 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #1: ffffffff8dfc80c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #2: ffff8880b8826360 (&base->expiry_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #2: ffff8880b8826360 (&base->expiry_lock){+...}-{3:3}, at: timer_base_lock_expiry kernel/time/timer.c:1502 [inline] #2: ffff8880b8826360 (&base->expiry_lock){+...}-{3:3}, at: __run_timer_base+0x120/0x9f0 kernel/time/timer.c:2384 #3: ffffffff8dfc80c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #3: ffffffff8dfc80c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #3: ffffffff8dfc80c0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #3: ffffffff8dfc80c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57 #4: ffffc90000157a80 ((&cp->timer)){+...}-{0:0}, at: call_timer_fn+0xd4/0x5e0 kernel/time/timer.c:1745 #5: ffffffff8dfc80c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #5: ffffffff8dfc80c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #5: ffffffff8dfc80c0 (rcu_read_lock){....}-{1:3}, at: ip_vs_conn_unlink net/netfilter/ipvs/ip_vs_conn.c:315 [inline] #5: ffffffff8dfc80c0 (rcu_read_lock){....}-{1:3}, at: ip_vs_conn_expire+0x257/0x2390 net/netfilter/ipvs/ip_vs_conn.c:1260 #6: ffffffff8de5f260 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #7: ffff888068d4c3f0 (&cp->lock#2){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #7: ffff888068d4c3f0 (&cp->lock#2){+...}-{3:3}, at: ip_vs_conn_unlink net/netfilter/ipvs/ip_vs_conn.c:324 [inline] #7: ffff888068d4c3f0 (&cp->lock#2){+...}-{3:3}, at: ip_vs_conn_expire+0xd4a/0x2390 net/netfilter/ipvs/ip_vs_conn.c:1260 Preemption disabled at: [] bit_spin_lock include/linux/bit_spinlock.h:38 [inline] [] hlist_bl_lock+0x18/0x110 include/linux/list_bl.h:149 CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G W L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 __might_resched+0x329/0x480 kernel/sched/core.c:9162 __rt_spin_lock kernel/locking/spinlock_rt.c:48 [inline] rt_spin_lock+0xc2/0x400 kernel/locking/spinlock_rt.c:57 spin_lock include/linux/spinlock_rt.h:45 [inline] ip_vs_conn_unlink net/netfilter/ipvs/ip_vs_conn.c:324 [inline] ip_vs_conn_expire+0xd4a/0x2390 net/netfilter/ipvs/ip_vs_conn.c:1260 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Reported-by: syzbot+504e778ddaecd36fdd17@syzkaller.appspotmail.com Link: https://sashiko.dev/#/patchset/20260415200216.79699-1-ja%40ssi.bg Link: https://sashiko.dev/#/patchset/20260420165539.85174-4-ja%40ssi.bg Link: https://sashiko.dev/#/patchset/20260422135823.50489-4-ja%40ssi.bg Fixes: 2fa7cc9c7025 ("ipvs: switch to per-net connection table") Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit f2da9a96abb4b7a64626e931cedd85f05d5498ca Author: Julian Anastasov Date: Thu Apr 30 10:44:14 2026 +0300 ipvs: fix races around the conn_lfactor and svc_lfactor sysctl vars Sashiko warns that the new sysctls vars can be changed after the hash tables are destroyed and their respective resizing works canceled, leading to mod_delayed_work() being called for canceled works. Solve this in different ways. conn_tab can be present even without services and is destroyed only on netns exit, so use disable_delayed_work_sync() to disable the work instead of adding more synchronization mechanisms. As for the svc_table, it is destroyed when the services are deleted, so we must be sure that netns exit is not called yet (the check for 'enable') and the work is not canceled by checking all under same mutex lock. Also, use WRITE_ONCE when updating the sysctl vars as we already read them with READ_ONCE. Link: https://sashiko.dev/#/patchset/20260410112352.23599-1-fw%40strlen.de Fixes: 8d7de5477e47 ("ipvs: add conn_lfactor and svc_lfactor sysctl vars") Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit afbd961305eb483515650ccfcb7743608e7add78 Author: Julian Anastasov Date: Thu Apr 30 10:44:13 2026 +0300 ipvs: fixes for the new ip_vs_status info Sashiko reports some problems for the recently added /proc/net/ip_vs_status: * ip_vs_status_show() as a table reader may run long after the conn_tab and svc_table table are released. While ip_vs_conn_flush() properly changes the conn_tab_changes counter when conn_tab is removed, ip_vs_del_service() and ip_vs_flush() were missing such change for the svc_table_changes counter. As result, readers like ip_vs_dst_event() and ip_vs_status_show() may continue to use a freed table after a cond_resched_rcu() call. * While counting the buckets in ip_vs_status_show() make sure we traverse only the needed number of entries in the chain. This also prevents possible overflow of the 'count' variable. * Add check for 'loops' to prevent infinite loops while restarting the traversal on table change. * While IP_VS_CONN_TAB_MAX_BITS is 20 on 32-bit platforms and there is no risk to overflow when multiplying the number of conn_tab buckets to 100, prefer the div_u64() helper to make the following dividing safer. * Use 0440 permissions for ip_vs_status to restrict the info only to root due to the exported information for hash distribution. Link: https://sashiko.dev/#/patchset/20260410112352.23599-1-fw%40strlen.de Fixes: 9a9ccef907a7 ("ipvs: add ip_vs_status info") Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit a293ec25d59dd96309058c70df5a4dd0f889a1e4 Merge: c7e4e4d5f7dc2d 465b05bae5ac55 Author: Linus Torvalds Date: Mon May 4 16:02:53 2026 -0700 Merge tag 'linux_kselftest-fixes-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: - Fix extra test number increment in ksft_exit_skip() that results in incorrect KTAP result - Fix regression introduced by addition of explicit constructor orders for fixture tests. This addition broke the ordering of those relative to non-fixture tests and the reverse-constructor-order detection * tag 'linux_kselftest-fixes-7.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: harness: Restore order of test functions selftests: kselftest: fix wrong test number in ksft_exit_skip commit 201ba706318d460a2ea660e3652610be62532a70 Author: Ralf Lici Date: Wed Apr 29 10:00:16 2026 +0200 selftests: ovpn: reduce ping count in test.sh The second stage of test.sh ("run baseline data traffic") performs a basic connectivity check with ping -qfc 500 -w 3. On slower CI instances this is too strict for TCP: the RTT is high enough that 500 echo requests do not reliably complete within 3 seconds, so the stage flakes and the test fails even though the ovpn setup is healthy. Reduce the packet count to 100 for both the plain and 3000-byte pings in that stage. This still verifies peer setup, key exchange, routing, and data-path traffic, without making the basic connectivity check depend on timing out under load. Fixes: 959bc330a439 ("testing/selftests: add test tool and scripts for ovpn module") Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit c539cb30f93f119566f2ae9d016cce11f188d780 Author: Ralf Lici Date: Wed Mar 25 17:49:18 2026 +0100 ovpn: ensure packet delivery happens with BH disabled ovpn injects decrypted packets into the netdev RX path through ovpn_netdev_write() which invokes gro_cells_receive() and dev_dstats_rx_add(). ovpn_netdev_write() is normally called in softirq context, however, in case of TCP connections it may also be invoked process context. When this happens gro_cells_receive() will throw a warning: [ 230.183747][ T12] WARNING: net/core/gro_cells.c:30 at gro_cells_receive+0x708/0xaa0, CPU#1: kworker/u16:0/12 and lockdep will also report a potential inconsistent lock state: WARNING: inconsistent lock state 7.0.0-rc4+ #246 Tainted: G W -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. because attempts to acquire gro_cells->bh_lock by both contexts may lead to a deadlock. At the same time, dev_dstats_rx_add() does not expect to race with a softirq (which may happen when invoked in process context), because the latter may access its per-cpu state and corrupt it. Fix all this by invoking local_bh_disable/enable() around gro_cells_receive() and dev_dstats_rx_add() to ensure that bottom halves are always disabled before calling both of them. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit a200cdbf95932631ec338d08a6e9e31b34c4e8a6 Author: Qingfang Deng Date: Mon Apr 27 12:00:11 2026 +0800 ovpn: reset MAC header before passing skb up After decapsulating a packet, the skb->mac_header still points to the outer transport header. Fix this by calling skb_reset_mac_header() in ovpn_netdev_write() to ensure the MAC header points to the beginning of the inner IP/network packet, as expected by the rest of the stack. Reported-by: Minqiang Chen Fixes: 8534731dbf2d ("ovpn: implement packet processing") Signed-off-by: Qingfang Deng Signed-off-by: Antonio Quartulli commit d8769544bde51b0ac980d10f8fe9f9fed6c95995 Author: T.J. Mercier Date: Thu Apr 30 13:11:42 2026 -0700 docs: cgroup-v1: Update charge-commit section Commit 1d8f136a421f ("memcg/hugetlb: remove memcg hugetlb try-commit-cancel protocol") removed mem_cgroup_commit_charge() and mem_cgroup_cancel_charge(), but the docs still refer to those functions. There is no longer any charge cancellation. Update the docs to match the code. Signed-off-by: T.J. Mercier Signed-off-by: Tejun Heo commit b34c82777a2c0648ee053595f4b290fd5249b093 Author: David Carlier Date: Thu Apr 30 10:27:47 2026 +0100 sched_ext: idle: Recheck prev_cpu after narrowing allowed mask scx_select_cpu_dfl() narrows @allowed to @cpus_allowed & @p->cpus_ptr when the BPF caller supplies a @cpus_allowed that differs from @p->cpus_ptr and @p doesn't have full affinity. However, @is_prev_allowed was computed against the original (wider) @cpus_allowed, so the prev_cpu fast paths could pick a @prev_cpu that is in @cpus_allowed but not in @p->cpus_ptr, violating the intended invariant that the returned CPU is always usable by @p. The kernel masks this via the SCX_EV_SELECT_CPU_FALLBACK fallback, but the behavior contradicts the documented contract. Move the @is_prev_allowed evaluation past the narrowing block so it tests against the final @allowed mask. Fixes: ee9a4e92799d ("sched_ext: idle: Properly handle invalid prev_cpu during idle selection") Cc: stable@vger.kernel.org # v6.16+ Assisted-by: Claude Signed-off-by: David Carlier Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 84ae1840260fece9b6b70d3872b79384bbe5a90b Author: Osama Abdelkader Date: Thu Apr 23 22:06:19 2026 +0200 drm/sti: remove bridge when sti_hda component_add fails Use devm_drm_bridge_add() so the bridge is released if probe fails after registration, and drop the manual drm_bridge_remove() in remove(). Check the return value of devm_drm_bridge_add(). Signed-off-by: Osama Abdelkader Fixes: d28726efc637 ("drm/sti: hda: add bridge before attaching") Cc: stable@vger.kernel.org Reviewed-by: Luca Ceresoli Acked-by: Raphaël Gallais-Pou Link: https://patch.msgid.link/20260423200622.325076-1-osama.abdelkader@gmail.com Signed-off-by: Raphael Gallais-Pou commit c7e4e4d5f7dc2daa439303d1b5bf6bdfaa249f49 Merge: 6d35786de28116 a8aebe93a4938c Author: Linus Torvalds Date: Mon May 4 12:48:30 2026 -0700 Merge tag 'for-linus-7.1-2' of https://github.com/cminyard/linux-ipmi Pull IPMI fixes from Corey Minyard: "Fix a number of issues that came up recently The first two fixes are workarounds for buggy IPMI hardware. The hardware says it has data for the IPMI driver to read constantly, so the driver reads the data constantly, causing any new requests to be blocked. The first fix was to check for invalid data right when the data was read from the device and stop the operation there (there was a later check for invalid data, but it could not stop the operation at that point). It turned out the device was providing good data, so that didn't fix the issue, but it's still a good check. The second fix stops fetching this data after a few fetches and allows other operations to occur. The driver won't work very well, but at least it won't wedge. This seems to fix the issue. The third issue is a problem I spotted while working on the previous issue where if a certain memory allocation failed the driver would stop working. The fourth issue is a problem was a missing set to NULL on a PTR_ERR() return, introduced in the previous series for 7.1" * tag 'for-linus-7.1-2' of https://github.com/cminyard/linux-ipmi: ipmi:ssif: NULL thread on error ipmi:si: Return state to normal if message allocation fails ipmi: Add limits to event and receive message requests ipmi: Check event message buffer response for bad data commit ff9eda4ea906b1f02fc260ddc42d2d9bd736a49c Author: Tejun Heo Date: Mon Apr 27 14:16:35 2026 -1000 sched_ext: Skip past-sched_ext_dead() tasks in scx_task_iter_next_locked() scx_task_iter's cgroup-scoped mode can return tasks whose sched_ext_dead() has already completed: cgroup_task_dead() removes from cset->tasks after sched_ext_dead() in finish_task_switch() and is irq-work deferred on PREEMPT_RT. The global mode is fine - sched_ext_dead() removes from scx_tasks via list_del_init() first. Callers (sub-sched enable prep/abort/apply, scx_sub_disable(), scx_fail_parent()) assume returned tasks are still on @sch and trip WARN_ON_ONCE() or operate on torn-down state otherwise. Set %SCX_TASK_OFF_TASKS in sched_ext_dead() under @p's rq lock and have scx_task_iter_next_locked() skip flagged tasks under the same lock. Setter and reader serialize on the per-task rq lock - no race. Signed-off-by: Tejun Heo commit 60f21a2649308bbd84919ba6656d5ccd660953cf Author: Tejun Heo Date: Mon Apr 27 14:16:34 2026 -1000 cgroup, sched_ext: Include exiting tasks in cgroup iter a72f73c4dd9b ("cgroup: Don't expose dead tasks in cgroup") made css_task_iter_advance() skip exiting tasks so cgroup.procs stays consistent with waitpid() visibility. Unfortunately, this broke scx_task_iter. scx_task_iter walks either scx_tasks (global) or a cgroup subtree via css_task_iter() and the two modes are expected to cover the same set of tasks. After the above change the cgroup-scoped mode silently skips tasks past exit_signals() that are still on scx_tasks. scx_sub_enable_workfn()'s abort path is one of the symptoms: an exiting SCX_TASK_SUB_INIT task can race past the cgroup iter leaking __scx_init_task() state. Other iterations share the same gap. Add CSS_TASK_ITER_WITH_DEAD to opt out of the skip and use it from scx_task_iter(). Fixes: b0e4c2f8a0f0 ("sched_ext: Implement cgroup subtree iteration for scx_task_iter") Reported-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 360f61bc29085d65a24dbaaf707c802553a239fd Author: Peter Rosin Date: Thu Apr 30 06:09:58 2026 +0200 MAINTAINERS: Update mail for Peter Rosin I'm resigning from my position at Axentia. Signed-off-by: Peter Rosin Signed-off-by: Wolfram Sang commit 93618edf753838a727dbff63c7c291dee22d656b Author: Tejun Heo Date: Fri May 1 08:31:22 2026 -1000 cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated A chain of commits going back to v7.0 reworked rmdir to satisfy the controller invariant that a subsystem's ->css_offline() must not run while tasks are still doing kernel-side work in the cgroup. [1] d245698d727a ("cgroup: Defer task cgroup unlink until after the task is done switching out") [2] a72f73c4dd9b ("cgroup: Don't expose dead tasks in cgroup") [3] 1b164b876c36 ("cgroup: Wait for dying tasks to leave on rmdir") [4] 4c56a8ac6869 ("cgroup: Fix cgroup_drain_dying() testing the wrong condition") [5] 13e786b64bd3 ("cgroup: Increment nr_dying_subsys_* from rmdir context") [1] moved task cset unlink from do_exit() to finish_task_switch() so a task's cset link drops only after the task has fully stopped scheduling. That made tasks past exit_signals() linger on cset->tasks until their final context switch, which led to a series of problems as what userspace expected to see after rmdir diverged from what the kernel needs to wait for. [2]-[5] tried to bridge that divergence: [2] filtered the exiting tasks from cgroup.procs; [3] had rmdir(2) sleep in TASK_UNINTERRUPTIBLE for them; [4] fixed the wait's condition; [5] made nr_dying_subsys_* visible synchronously. The cgroup_drain_dying() wait in [3] turned out to be a dead end. When the rmdir caller is also the reaper of a zombie that pins a pidns teardown (e.g. host PID 1 systemd reaping orphan pids that were re-parented to it during the same teardown), rmdir blocks in TASK_UNINTERRUPTIBLE waiting for those pids to free, the pids can't free because PID 1 is the reaper and it's stuck in rmdir, and the system A-A deadlocks. No internal lock ordering breaks this; the wait itself is the bug. The css killing side that drove the original reorder, however, can be made cleanly asynchronous: ->css_offline() is already async, run from css_killed_work_fn() driven by percpu_ref_kill_and_confirm(). The fix is to make that chain start only after all tasks have left the cgroup. rmdir's user-visible side then returns as soon as cgroup.procs and friends are empty, while ->css_offline() still runs only after the cgroup is fully drained. Verified by the original reproducer (pidns teardown + zombie reaper, runs under vng) which hangs vanilla and succeeds here, and by per-commit deterministic repros for [2], [3], [4], [5] with a boot parameter that widens the post-exit_signals() window so each state is reliably reachable. Some stress tests on top of that. cgroup_apply_control_disable() has the same shape of pre-existing race: when a controller is disabled via subtree_control, kill_css() ran synchronously while tasks past exit_signals() could still be linked to the cgroup's csets, and ->css_offline() could fire before they drained. This patch preserves the existing synchronous behavior at that call site (kill_css_sync() + kill_css_finish() back-to-back) and a follow-up patch will defer kill_css_finish() there using a per-css trigger. This seems like the right approach and I don't see problems with it. The changes are somewhat invasive but not excessively so, so backporting to -stable should be okay. If something does turn out to be wrong, the fallback is to revert the entire chain ([1]-[5]) and rework in the development branch instead. v2: Pin cgrp across the deferred destroy work with explicit cgroup_get()/cgroup_put() around queue_work() and the work_fn. v1 wasn't actually broken (ordered cgroup_offline_wq + queue_work order in cgroup_task_dead() saved it) but the explicit ref removes the dependency on those non-obvious invariants. Also note the pre-existing cgroup_apply_control_disable() race in the description; a follow-up will defer kill_css_finish() there. Fixes: 1b164b876c36 ("cgroup: Wait for dying tasks to leave on rmdir") Cc: stable@vger.kernel.org # v7.0+ Reported-and-tested-by: Martin Pitt Link: https://lore.kernel.org/all/afHNg2VX2jy9bW7y@piware.de/ Link: https://lore.kernel.org/all/35e0670adb4abeab13da2c321582af9f@kernel.org/ Signed-off-by: Tejun Heo Acked-by: Sebastian Andrzej Siewior commit 8f80b5b227ef9ea422080487715c841856339aed Author: David Gow Date: Sat Apr 25 11:41:54 2026 +0800 kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS CONFIG_KUNIT_DEBUGFS is totally useless without debugfs, so it should depend on CONFIG_DEBUG_FS. Link: https://lore.kernel.org/r/20260425034155.53913-2-david@davidgow.net Fixes: e2219db280e3 ("kunit: add debugfs /sys/kernel/debug/kunit//results display") Signed-off-by: David Gow Signed-off-by: Shuah Khan commit 17e4c68ff35090d8cb743e3c82c09f92fda1ebda Author: David Gow Date: Sat Apr 25 11:41:53 2026 +0800 kunit: config: Enable KUNIT_DEBUGFS by default The KUNIT_DEBUGFS option is currently enabled based on the value of KUNIT_ALL_TESTS, but it really doesn't have anything to do with the set of enabled tests, so just enable it by default anyway. In particular, this shouldn't be only visible if KUNIT_ALL_TESTS is set, which is quite confusing. Link: https://lore.kernel.org/r/20260425034155.53913-1-david@davidgow.net Fixes: beaed42c427d ("kunit: default KUNIT_* fragments to KUNIT_ALL_TESTS") Signed-off-by: David Gow Signed-off-by: Shuah Khan commit 754d60ad1c91895be0bc7d771fbf9fb3c9448640 Author: Alexander Dahl Date: Wed Apr 29 14:59:30 2026 +0200 memory: atmel-ebi: Allow deferred probing After removing of_platform_default_populate() calls the atmel-ebi driver was affected by deferred probing. platform_driver_probe() is incompatible with deferred probing. This led to atmel-ebi driver eventually not being probed on at91 sam9x60-curiosity and other sam9x60 based boards. Subsequently the nand-controller driver (nand-controller being a child node of ebi) on that platform was not probed and thus raw NAND flash was inaccessible, preventing devices to boot with rootfs on raw NAND flash (e.g. with UBI/UBIFS). Fixes: 0b0f7e6539a7 ("ARM: at91: remove unnecessary of_platform_default_populate calls") Cc: stable@vger.kernel.org Suggested-by: Miquel Raynal Signed-off-by: Alexander Dahl Link: https://patch.msgid.link/20260429125930.844790-1-ada@thorsis.com Signed-off-by: Krzysztof Kozlowski commit 320e55722ca466a7d40dd69e1aea982cb6189006 Author: Nicola Lunghi Date: Mon May 4 16:45:20 2026 +0200 ALSA: usb-audio: add clock quirk for Motu 1248 The Motu 1248 (and probably other older Motu AVB interfaces) take more than 2 seconds to switch clock. During the clock switching process the device return that the clock is not valid. This is similar to what already implemented for the Microbook II interface. Add the Motu 1248 usb id to the existing Motu quirk. Signed-off-by: Nicola Lunghi Link: https://patch.msgid.link/20260504144520.699522-2-nick83ola@gmail.com Signed-off-by: Takashi Iwai commit f3c57c9c2a49a21d784b7c04a2c883bffc070659 Author: Cássio Gabriel Date: Mon May 4 11:08:45 2026 -0300 ALSA: usb-audio: midi2: Restart output URBs on resume USB MIDI 2.0 suspend saves the endpoint running state, clears it and kills all endpoint URBs. Resume restores the running state, but only restarts input endpoints. For a running output endpoint, this leaves the endpoint marked running with an empty URB queue. Output transfer progress depends on either the rawmidi trigger path starting the queue or an output completion refilling it. After suspend there is no completion left, and output data that remains queued in the raw UMP or legacy rawmidi buffer can stay stalled until userspace happens to trigger the stream again. Restore the saved state with atomic accessors, keep input endpoints restarted as before, and restart output endpoints that were running before suspend. Clear the saved suspend state after restoring it. Fixes: ff49d1df79ae ("ALSA: usb-audio: USB MIDI 2.0 UMP support") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260504-usb-midi2-output-resume-v1-1-c089cc8ad3c6@gmail.com Signed-off-by: Takashi Iwai commit dc1e0172be54e742bccb28d5f14c0c395e28c098 Author: Fernando Antunez Antonio Date: Mon May 4 07:33:26 2026 -0600 ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx This enables the mute and mic-mute LEDs on the HP Envy X360 15-fh0xxx 2-in-1 laptops. The quirk 'ALC245_FIXUP_HP_ENVY_X360_15_FH0XXX' has been created and is now enabled for this device. This is my first patch, and I'm still getting to grips with the code, so there's probably a better way to implement this fix. I apologize for any inconvenience caused by the constant release of new versions of this patch. Signed-off-by: Fernando Antunez Antonio Link: https://patch.msgid.link/20260504-hpenvy-muteled-fix-v3-1-5567fd9b3d25@gmail.com Signed-off-by: Takashi Iwai commit db4cd7d6c571c5ec6b52a6e80ec59ad99c4aa1d6 Author: Rong Zhang Date: Mon May 4 19:38:05 2026 +0800 ALSA: usb-audio: Add quirk flags for JBL Pebbles JBL Pebbles is a pair of desktop speakers with UAC interface. Its Playback and Capture mixers use linear volume with val = 0/999/1 and 0/3996/4. Meanwhile, the reported sample rates are truncated to multiples of 0x100 (i.e., 44100 => 44032), resulting in noisy kmsg, as a warning message is printed each time a stream is opened. Add a quirk table entry matching VID/PID=0x05fc/0x0231 and applying linear volume and sample rate quirk flags, so that it can work properly. Also note that the volume control knob on device is an incremental encoder. It does nothing but sends KEY_VOLUMEUP and KEY_VOLUMEDOWN per rotation, controlling the UAC Playback volume mixer indirectly. Hence, the linear volume quirk flags also enable the volume control knob to function properly. Quirky device sample: usb 5-1.1: new full-speed USB device number 12 using xhci_hcd usb 5-1.1: New USB device found, idVendor=05fc, idProduct=0231, bcdDevice= 1.00 usb 5-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 5-1.1: Product: JBL Pebbles usb 5-1.1: Manufacturer: Harman International Industries usb 5-1.1: SerialNumber: 1.0.0 usb-storage 5-1.1:1.0: USB Mass Storage device detected scsi host0: usb-storage 5-1.1:1.0 usb 5-1.1: Found last interface = 1 usb 5-1.1: 2:1: add audio endpoint 0x5 usb 5-1.1: Creating new data endpoint #5 usb 5-1.1: 2:1 Set sample rate 44100, clock 0 usb 5-1.1: current rate 44032 is different from the runtime rate 44100 usb 5-1.1: 3:1: add audio endpoint 0x84 usb 5-1.1: Creating new data endpoint #84 usb 5-1.1: 3:1 Set sample rate 44100, clock 0 usb 5-1.1: current rate 44032 is different from the runtime rate 44100 usb 5-1.1: [2] FU [PCM Playback Switch] ch = 1, val = 0/1/1 usb 5-1.1: Warning! Unlikely big volume step count (=999), linear volume or wrong cval->res? usb 5-1.1: [2] FU [PCM Playback Volume] ch = 2, val = 0/999/1 usb 5-1.1: [5] FU [Mic Capture Switch] ch = 1, val = 0/1/1 usb 5-1.1: Warning! Unlikely big volume step count (=999), linear volume or wrong cval->res? usb 5-1.1: [5] FU [Mic Capture Volume] ch = 2, val = 0/3996/4 input: Harman International Industries JBL Pebbles as /devices/pci0000:00/0000:00:08.3/0000:67:00.3/usb5/5-1/5-1.1/5-1.1:1.4/0003:05FC:0231.0018/input/input55 hid-generic 0003:05FC:0231.0018: input,hidraw2: USB HID v2.01 Device [Harman International Industries JBL Pebbles] on usb-0000:67:00.3-1.1/input4 Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20260504-uac-jbl-pebbles-v1-1-c888d592a286@rong.moe Signed-off-by: Takashi Iwai commit 0749daa8eb5ab90334aaad3b0671efd7150d43b1 Author: Cássio Gabriel Date: Sun May 3 21:55:52 2026 -0300 ALSA: firewire-tascam: Do not drop unread control events tscm_hwdep_read_queue() copies as many queued control events as fit in the userspace buffer. When the buffer is smaller than the current contiguous queue segment, length is rounded down to the number of bytes that can be copied. However, after copying that shortened length, the code advances pull_pos to the original tail_pos, marking the whole contiguous segment as consumed. Any events between the copied portion and tail_pos are lost. Limit tail_pos to the position after the entries actually copied before updating pull_pos. When the whole segment fits, this is equivalent to the old tail_pos update; when the buffer is smaller, the remaining events stay queued for the next read. Fixes: a8c0d13267a4 ("ALSA: firewire-tascam: notify events of change of state for userspace applications") Cc: stable@vger.kernel.org Suggested-by: Takashi Sakamoto Signed-off-by: Cássio Gabriel Reviewed-by: Takashi Sakamoto Co-developed-by: Takashi Sakamoto Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260503-alsa-firewire-tascam-read-queue-v2-1-126c6efd7642@gmail.com commit f80785888f7c0980a49545b87a80e3817c9ed7c6 Author: Anton Swart Date: Sun May 3 23:15:17 2026 +0200 ALSA: usb-audio: Add quirk flags for AlphaTheta EUPHONIA The AlphaTheta EUPHONIA (VID 0x2b73, PID 0x0047) is a USB Audio Class 2 DJ mixer that requires implicit feedback for full-duplex operation. The capture endpoint (0x83 IN, interface 2) acts as the implicit feedback source for the playback endpoint (0x03 OUT, interface 1), and the device firmware does not send isochronous data on the capture endpoint unless the host is simultaneously sending data on the playback endpoint, i.e. playback must be started first. Without QUIRK_FLAG_PLAYBACK_FIRST the kernel waits for capture URBs before submitting playback URBs, creating a deadlock: the device waits for playback data and the host waits for capture data. Without QUIRK_FLAG_GENERIC_IMPLICIT_FB the kernel does not detect the implicit feedback relationship between the two interfaces. The same flag combination is already used for the Behringer UMC202HD, UMC204HD and UMC404HD (0x1397:0x0507/0x0508/0x0509), which exhibit the identical implicit-feedback topology. Tested on Raspberry Pi 5 with kernel 6.12.75; continuous full-duplex streaming at 96 kHz / 24-bit, zero XRUNs. Signed-off-by: Anton Swart Link: https://patch.msgid.link/20260503211517.14332-1-anton.swart.jhb@gmail.com Signed-off-by: Takashi Iwai commit b5d0ad616ca8dd8c7b6b24dc13012e342278a085 Author: Kory Maincent (TI) Date: Fri Apr 17 17:54:45 2026 +0200 drm/bridge: tda998x: Return NULL instead of 0 in tda998x_edid_read() tda998x_edid_read() returns a const struct drm_edid pointer, but when tda998x_edid_delay_wait() fails (process killed while waiting for the HPD timeout), the integer literal 0 is returned instead of NULL, triggering a sparse warning: "Using plain integer as NULL pointer" Replace 0 with NULL to fix the sparse warning. Fixes: c76a8be4feec ("drm/bridge: tda998x: Add support for DRM_BRIDGE_ATTACH_NO_CONNECTOR") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604172257.Imo6GOH9-lkp@intel.com/ Signed-off-by: Kory Maincent (TI) Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260417155446.1068893-1-kory.maincent@bootlin.com Signed-off-by: Luca Ceresoli commit 2a46a9356ba7b1bdd741c8b41e5374edcd960557 Author: Kory Maincent (TI) Date: Tue Apr 28 11:04:56 2026 +0200 drm/bridge: tda998x: Use __be32 for audio port OF property pointer of_get_property() returns a pointer to big-endian (__be32) data, but port_data in tda998x_get_audio_ports() was declared as const u32 *, causing a sparse endianness type mismatch warning. Fix the declaration to use const __be32 *. Fixes: 7e567624dc5a4 ("drm/i2c: tda998x: Register ASoC hdmi-codec and add audio DT binding") Cc: stable@vger.kernel.org Signed-off-by: Kory Maincent (TI) Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260428090457.121894-1-kory.maincent@bootlin.com Signed-off-by: Luca Ceresoli commit d748603f12baff112caa3ab7d39f50100f010dbd Author: Jiri Slaby (SUSE) Date: Tue Dec 9 11:04:59 2025 +0100 wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: > > dump_stack_lvl+0x5d/0x80 > ubsan_epilogue+0x5/0x2b > __ubsan_handle_out_of_bounds.cold+0x46/0x4b > ath5k_tasklet_tx+0x4e0/0x560 [ath5k] > tasklet_action_common+0xb5/0x1c0 It is real. 'ts->ts_final_idx' can be 3 on 5212, so: info->status.rates[ts->ts_final_idx + 1].idx = -1; with the array defined as: struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES]; while the size is: #define IEEE80211_TX_MAX_RATES 4 is indeed bogus. Set this 'idx = -1' sentinel only if the array index is less than the array size. As mac80211 will not look at rates beyond the size (IEEE80211_TX_MAX_RATES). Note: The effect of the OOB write is negligible. It just overwrites the next member of info->status, i.e. ack_signal. Signed-off-by: Jiri Slaby (SUSE) Reported-by: Vincent Danjean Link: https://lore.kernel.org/all/aQYUkIaT87ccDCin@eldamar.lan Closes: https://bugs.debian.org/1119093 Fixes: 6d7b97b23e11 ("ath5k: fix tx status reporting issues") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251209100459.2253198-1-jirislaby@kernel.org Signed-off-by: Jeff Johnson commit 0e1308803d2c3fd365a6d21e6be355ec1e28eaaf Author: Baochen Qiang Date: Mon Apr 27 13:51:41 2026 +0800 wifi: ath12k: fix peer_id usage in normal RX path ath12k_dp_rx_deliver_msdu() currently uses hal_rx_desc_data::peer_id parsed from mpdu_start descriptor to do peer lookup. However In an A-MSDU aggregation scenario, hardware only populates mpdu_start descriptor for the first sub-msdu, but not the following ones. In that case peer_id could be invalid, leading to peer lookup failure: ath12k_wifi7_pci 0000:06:00.0: rx skb 00000000c391c041 len 1532 peer (null) 0 ucast sn 0 eht320 rate_idx 12 vht_nss 2 freq 6105 band 3 flag 0x40d1a fcs-err 0 mic-err 0 amsdu-more 0 As a result pubsta is NULL and parts of ieee80211_rx_status structure are left uninitialized, which may cause unexpected behavior. Fix it by switching the normal RX path to use ath12k_skb_rxcb::peer_id which is parsed from REO ring's rx_mpdu_desc and is always valid. hal_rx_desc_data::peer_id is still used in ath12k_wifi7_dp_rx_frag_h_mpdu(), which is safe since A-MSDU aggregation does not occur for fragmented frames. Similarly, ath12k_skb_rxcb::peer_id may be overwritten by hal_rx_desc_data::peer_id in ath12k_wifi7_dp_rx_h_mpdu(), which only handles non-aggregated multicast/broadcast traffic. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 11157e0910fd ("wifi: ath12k: Use ath12k_dp_peer in per packet Tx & Rx paths") Signed-off-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260427-ath12k-fix-peer-id-source-v1-1-b5f701fb8e88@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 81594a12d5cecb3ab35b603a00037c7c3ee87ab2 Author: Rameshkumar Sundaram Date: Mon Apr 27 16:00:11 2026 +0530 wifi: ath12k: initialize RSSI dBm conversion event state Currently, the RSSI dBm conversion event handler leaves struct ath12k_wmi_rssi_dbm_conv_info_arg uninitialized on the stack before calling the TLV parser. If one of the optional sub-TLVs is absent, the corresponding *_present flag retains stack garbage and later gets read in ath12k_wmi_update_rssi_offsets(). With UBSAN enabled this triggers an invalid-load report for _Bool: UBSAN: invalid-load in drivers/net/wireless/ath/ath12k/wmi.c:9682:15 load of value 9 is not a valid value for type '_Bool' Call Trace: ath12k_wmi_rssi_dbm_conversion_params_info_event.cold+0x72/0x85 [ath12k] ath12k_wmi_op_rx+0x1871/0x2ab0 [ath12k] ath12k_htc_rx_completion_handler+0x44b/0x810 [ath12k] ath12k_ce_recv_process_cb+0x554/0x9f0 [ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] Initialize the parsed event state to zero before passing it to the TLV parser so missing sub-TLVs correctly leave the presence flags false. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: 0314ee81a91d ("wifi: ath12k: handle WMI event for real noise floor calculation") Signed-off-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260427103011.2983269-1-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 05c5078de822148e7cb84968a8783ddfcb6c9ef1 Author: Nicolas Escande Date: Wed Apr 22 18:32:58 2026 +0200 wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions Some wmi functions were using plain 'return ath12k_wmi_cmd_send(...)' without explicitly handling the error code. This leads to leaking the skb in case of error. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00218-QCAHKSWPL_SILICONZ-1 Fixes: 66a9448b1b89 ("wifi: ath12k: implement hardware data filter") Fixes: 593174170919 ("wifi: ath12k: implement WoW enable and wakeup commands") Fixes: 4a3c212eee0e ("wifi: ath12k: add basic WoW functionalities") Fixes: 16f474d6d49d ("wifi: ath12k: add WoW net-detect functionality") Fixes: 1666108c74c4 ("wifi: ath12k: support ARP and NS offload") Fixes: aab4ae566fa1 ("wifi: ath12k: support GTK rekey offload") Fixes: 7af01e569529 ("wifi: ath12k: handle keepalive during WoWLAN suspend and resume") Signed-off-by: Nicolas Escande Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260422163258.3013872-1-nico.escande@gmail.com Signed-off-by: Jeff Johnson commit 7b0b68b2b95606e65594958686833e53423f58f2 Author: David Carlier Date: Thu Apr 23 13:56:48 2026 +0100 mm/memfd_luo: document preservation of file seals Commit 8a552d68a86e ("mm: memfd_luo: preserve file seals") started preserving file seals across live update and restoring them via memfd_add_seals() on retrieve, but the DOC header was not updated and still listed seals under "Non-Preserved Properties" as being unsealed on restore. Move the Seals entry to the "Preserved Properties" section and describe the actual behavior, including the MEMFD_LUO_ALL_SEALS restriction that both preserve and retrieve enforce. Fixes: 8a552d68a86e ("mm: memfd_luo: preserve file seals") Signed-off-by: David Carlier Reviewed-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Link: https://patch.msgid.link/20260423125648.152113-2-devnexen@gmail.com Signed-off-by: Pasha Tatashin commit d581fc99d3b958cb6e363104e9aab57f36aee6f3 Author: David Carlier Date: Thu Apr 23 13:56:47 2026 +0100 mm/memfd_luo: reject memfds whose page count exceeds UINT_MAX memfd_luo_preserve_folios() declares max_folios as unsigned int and computes it from the inode size, then passes it to memfd_pin_folios() which itself caps max_folios at unsigned int. For files whose base-page count exceeds UINT_MAX (larger than 16 TiB with 4 KiB pages), the assignment truncates silently: only a prefix of the file gets pinned and preserved, while memfd_luo_preserve() still records the full inode size in ser->size. On retrieve the inode is restored to the full size but only the preserved prefix repopulates the page cache, so the tail comes back as holes and user data is silently lost across the live update. Reject such files at preserve time with -EFBIG rather than chunk the pin loop, which would also require enlarging the preserved folios array well beyond what is practical. Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") Signed-off-by: David Carlier Reviewed-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Link: https://patch.msgid.link/20260423125648.152113-1-devnexen@gmail.com Signed-off-by: Pasha Tatashin commit 4b50e6cc2aff1688b66da3847c85f3ce9786ff40 Merge: 5b33b756aba923 0b2eb1f8473edd Author: Mark Brown Date: Mon May 4 22:23:04 2026 +0900 spi: microchip core-qspi gpio-cs fixes + cleanup Conor Dooley says: v3 with the review comment about the core handing CS_HIGH dealt with. I noticed that in the same function there was a "raw" BIT(1), which I replaced with a macro that the patch was already adding for use in the setup function... commit 0b2eb1f8473eddeff5317e521498329581432f89 Author: Conor Dooley Date: Thu Apr 30 11:10:20 2026 +0100 spi: microchip-core-qspi: remove some inline markings Remove inline markings from a number of functions that are called as part of mem ops callbacks. None of them are either particularly trivial or sensitive to overhead of a function call. Just let the compiler decide what to do with them. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260430-serpent-stimulate-59fb860ef429@spud Signed-off-by: Mark Brown commit eb56deaabf127e8985fc91fa6c97bf8a3b062844 Author: Conor Dooley Date: Thu Apr 30 11:10:19 2026 +0100 spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations The core will deal with reads by creating clock cycles itself, there's no need to generate clock cycles by transmitting garbage data at the driver level. Further, transmitting garbage data just bricks the transfer since QSPI doesn't have a dedicated master-out line like MOSI in regular SPI. I'm not entirely sure if the transfer is bricked because of the garbage data being transmitted on the bus or because the core loses track of whether it is supposed to be sending or receiving data. Fixes: 8f9cf02c88528 ("spi: microchip-core-qspi: Add regular transfers") CC: stable@vger.kernel.org Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260430-freezing-saloon-95b1f3d9dad0@spud Signed-off-by: Mark Brown commit 7672749e1496215e8683ce57cf323119033954cf Author: Conor Dooley Date: Thu Apr 30 11:10:18 2026 +0100 spi: microchip-core-qspi: control built-in cs manually The coreQSPI IP supports only a single chip select, which is automagically operated by the hardware - set low when the transmit buffer first gets written to and set high when the number of bytes written to the TOTALBYTES field of the FRAMES register have been sent on the bus. Additional devices must use GPIOs for their chip selects. It was reported to me that if there are two devices attached to this QSPI controller that the in-built chip select is set low while linux tries to access the device attached to the GPIO. This went undetected as the boards that connected multiple devices to the SPI controller all exclusively used GPIOs for chip selects, not relying on the built-in chip select at all. It turns out that this was because the built-in chip select, when controlled automagically, is set low when active and high when inactive, thereby ruling out its use for active-high devices or devices that need to transmit with the chip select disabled. Modify the driver so that it controls chip select directly, retaining the behaviour for mem_ops of setting the chip select active for the entire duration of the transfer in the exec_op callback. For regular transfers, implement the set_cs callback for the core to use. As part of this, the existing setup callback, mchp_coreqspi_setup_op(), is removed. Modifying the CLKIDLE field is not safe to do during operation when there are multiple devices, so this code is removed entirely. Setting the MASTER and ENABLE fields is something that can be done once at probe, it doesn't need to be re-run for each device. Instead the new setup callback sets the built-in chip select to its inactive state for active-low devices, as the reset value of the chip select in software controlled mode is low. Fixes: 8f9cf02c88528 ("spi: microchip-core-qspi: Add regular transfers") Fixes: 8596124c4c1bc ("spi: microchip-core-qspi: Add support for microchip fpga qspi controllers") CC: stable@vger.kernel.org Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260430-hamstring-busload-f941d0347b5e@spud Signed-off-by: Mark Brown commit 5b33b756aba9237813216476538abcc8afe8af8b Merge: 7fd2df204f342f 894e04b7116297 Author: Mark Brown Date: Mon May 4 22:22:18 2026 +0900 spi: imx: Three fixes for the i.MX SPI driver John Madieu says: This series independent fixes found in the i.MX SPI driver. These are: 1/3 fixes a precedence bug in spi_imx_dma_max_wml_find() that makes the watermark-finding logic effectively dead code. The function currently always returns wml = 1 because of how the !-operator binds to the modulo expression. 2/3 fixes a missing return on the package-1 failure path in spi_imx_dma_data_prepare(). The error path frees the dma_data array and the package-0 buffers, then falls through to "return 0" - the caller proceeds with a freed pointer. 3/3 makes spi_imx_setupxfer() propagate the prepare_transfer() return value. Currently a -EINVAL from mx51_ecspi_prepare_transfer (e.g. on a word_delay overflow) is silently swallowed and the transfer proceeds with a partially-configured controller. commit 894e04b7116297a6529e0c4ed90e3eb160939805 Author: John Madieu Date: Fri May 1 13:59:51 2026 +0000 spi: imx: Propagate prepare_transfer() error from spi_imx_setupxfer() spi_imx_setupxfer() calls the per-variant prepare_transfer() callback and returns 0 unconditionally: spi_imx->devtype_data->prepare_transfer(spi_imx, spi, t); return 0; mx51_ecspi_prepare_transfer() can return -EINVAL when the requested word_delay does not fit in MX51_ECSPI_PERIOD_MASK. The error is detected after a partial set of register writes (CTRL: BL, clkdiv, SMC), so the controller is left in a partially-configured state and the transfer is then submitted as if setup succeeded. Propagate the return value. The other variants' prepare_transfer callbacks all return 0, so this is a no-op for them. Fixes: a3bb4e663df3 ("spi: imx: support word delay") Signed-off-by: John Madieu Reviewed-by: Frank Li Link: https://patch.msgid.link/20260501135951.2416527-4-john.madieu@gmail.com Signed-off-by: Mark Brown commit f5b5548255040ec3bef05bcb1e9c9c3614dfa7db Author: John Madieu Date: Fri May 1 13:59:50 2026 +0000 spi: imx: Fix UAF on package-1 prepare failure in spi_imx_dma_data_prepare() When transfer->len exceeds MX51_ECSPI_CTRL_MAX_BURST and is not a multiple of it, spi_imx_dma_data_prepare() splits the transfer into two DMA packages. If preparing the second package fails: ret = spi_imx_dma_tx_data_handle(spi_imx, &spi_imx->dma_data[1], transfer->tx_buf + spi_imx->dma_data[0].data_len, false); if (ret) { kfree(spi_imx->dma_data[0].dma_tx_buf); kfree(spi_imx->dma_data[0].dma_rx_buf); kfree(spi_imx->dma_data); } } return 0; the function frees the package-0 buffers and the dma_data array, then falls through to `return 0`, telling the caller the prepare succeeded. The caller then dereferences the freed dma_data array, producing a use-after-free. Return the error from the failure path so the caller takes its existing failure branch. Fixes: faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode") Signed-off-by: John Madieu Reviewed-by: Frank Li Link: https://patch.msgid.link/20260501135951.2416527-3-john.madieu@gmail.com Signed-off-by: Mark Brown commit 24e0fd8b852062d5e8a740f7945eaa26818adce8 Author: John Madieu Date: Fri May 1 13:59:49 2026 +0000 spi: imx: Fix precedence bug in spi_imx_dma_max_wml_find() The watermark search in spi_imx_dma_max_wml_find() reads: if (!dma_data->dma_len % (i * bytes_per_word)) break; The unary ! binds tighter than %, so this parses as: if ((!dma_data->dma_len) % (i * bytes_per_word)) break; !dma_data->dma_len is 0 or 1, and `0 % x == 0` for any x; `1 % x` is 0 unless x == 1. The condition is therefore false in every case except dma_len != 0 with i * bytes_per_word == 1, i.e. i == 1 and bytes_per_word == 1. The loop almost always falls through to its end, leaving i == 0, which the post-loop fallback rewrites to 1: if (i == 0) i = 1; So spi_imx->wml ends up at 1 for essentially every DMA transfer, defeating the entire purpose of the function. The DMA engine then requests service after every single FIFO word instead of using multi-word bursts, hurting throughput on every DMA-capable variant. Add the missing parentheses so the modulo is computed first, then negated: if (!(dma_data->dma_len % (i * bytes_per_word))) break; Fixes: faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode") Signed-off-by: John Madieu Reviewed-by: Frank Li Link: https://patch.msgid.link/20260501135951.2416527-2-john.madieu@gmail.com Signed-off-by: Mark Brown commit e8446a4a574d19f0fb39c06af15dbc5165079474 Author: Cássio Gabriel Date: Tue Apr 28 00:07:08 2026 -0300 ASoC: fsl_xcvr: Fix event generation for cached controls ALSA controls should return 1 from a put callback when the control value changes. fsl_xcvr_capds_put() and fsl_xcvr_tx_cs_put() both update cached control data but always return 0, so ALSA suppresses change notifications for the Capabilities Data Structure and playback IEC958 channel status controls. Compare the old and new cached values before copying the new data, and return whether the control value changed. Fixes: 28564486866f ("ASoC: fsl_xcvr: Add XCVR ASoC CPU DAI driver") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260428-asoc-fsl-xcvr-event-generation-v1-1-f21cf0812c4f@gmail.com Signed-off-by: Mark Brown commit 56d5a9eaf60af5c824a33a83e1468aa143627a62 Author: Derek Fang Date: Thu Apr 30 20:10:43 2026 +0800 ASoC: sdw_utils: avoid the SDCA companion function not supported failure Treat the companion amp as generic AMP until full support for companion amp is added. Signed-off-by: Derek Fang Reviewed-by: Charles Keepax Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260430121043.552241-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit d63c219b7ff39f897da10c160a2edef76320f16c Author: Tommaso Soncin Date: Wed Apr 29 18:08:57 2026 +0200 ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Add a DMI quirk for the HP OMEN Gaming Laptop 16-ap0xxx line fixing the issue where the internal microphone was not detected. Cc: stable@vger.kernel.org Signed-off-by: Tommaso Soncin Link: https://patch.msgid.link/20260429160858.538986-1-soncintommaso@gmail.com Signed-off-by: Mark Brown commit 0f9bfb84b3f0fe1406b2555fc11b45283ea21644 Author: Richard Fitzgerald Date: Thu Apr 30 11:11:34 2026 +0100 ASoC: cs35l56: Fix out-of-bounds in dev_err() in cs35l56_read_onchip_spkid() Remove the incorrect use of onchip_spkid_gpios[i] in the dev_err() after regmap_read() of CS35L56_GPIO_STATUS1 returns an error. This dev_err() was incorrectly copy-pasted from one inside the for-loop, where i was valid. The read of CS35L56_GPIO_STATUS1 isn't for a specific GPIO register, so the use of onchip_spkid_gpios[i] in the error message is both irrelevant and out-of-bounds here. Fixes: 4d1e3e2c404d ("ASoC: cs35l56: Support for reading speaker ID from on-chip GPIOs") Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260430101134.2655938-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 0e60d96616640ffcf51b81a87c71e30d92385a93 Author: Bob Song Date: Thu Apr 30 09:49:20 2026 +0800 ASoC: amd: yc: Add DMI quirk for MSI Bravo 15 C7VE The laptop requires a quirk ID to enable its internal microphone. Add it to the DMI quirk table. Reported-by: gannovera Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218402 Signed-off-by: Bob Song Link: https://patch.msgid.link/20260430014920.141276-1-songxiebing@kylinos.cn Signed-off-by: Mark Brown commit c64e77490b7e5d9dec738850f18878edb07e0f13 Author: Richard Fitzgerald Date: Wed Apr 29 11:53:15 2026 +0100 ASoC: cs35l56: Fix hibernate write in runtime resume error path The error path of cs35l56_runtime_resume_common() should only write the hibernation sequence if can_hibernate is true. Something has already gone badly wrong if we ever reach the error path. But triggering hibernate on hardware that does not support it is likely to make the situation unrecoverable without a full reboot because there might not be any hardware signal to exit hibernate. Fixes: a47cf4dac7dc ("ASoC: cs35l56: Change hibernate sequence to use allow auto hibernate") Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260429105315.2438298-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit ec0611868f2fcf29e4c2bebdc6702d3e1f272fec Author: Troy Mitchell Date: Wed Apr 29 17:00:50 2026 +0800 ASoC: spacemit: fix RX DMA params not set when TX is running When TX is already running (SSCR_SSE is set), the hw_params callback returns early before setting up DMA parameters for the RX stream. This prevents the capture path from configuring its DMA data properly. Move the SSCR_SSE check after DMA parameter setup and format constraints, so both TX and RX streams get their DMA configuration regardless of whether the hardware is already enabled. The early return now only skips the register writes that would disrupt an active stream. Fixes: fce217449075 ("ASoC: spacemit: add i2s support for K1 SoC") Signed-off-by: Troy Mitchell Link: https://patch.msgid.link/20260429-k1-i2s-fix-v2-1-8d67835aaddc@linux.spacemit.com Signed-off-by: Mark Brown commit fb7415f2ab0e3c818254cbf5fb0afda71bef4333 Author: Bruce Johnston Date: Tue Apr 28 14:39:31 2026 -0400 dm vdo: use GFP_NOIO for blkdev_issue_zeroout on format path GFP_NOWAIT is inappropriate when blkdev_issue_zeroout may sleep and bio_alloc can fail under pressure; use GFP_NOIO for clear_partition and vdo_clear_layout zeroout calls. Signed-off-by: Bruce Johnston Signed-off-by: Matthew Sakai Signed-off-by: Mikulas Patocka Fixes: fc1d43826702 ("dm vdo: save the formatted metadata to disk") commit c28c22c8cfbd43f2ad71a157324d9fbebc0d0f2e Author: Francesco Lavra Date: Tue Feb 10 18:35:45 2026 +0100 drm/fb-helper: Fix clipping when damage area spans a single scanline When the damage area resulting from a dirty memory range spans a single scanline, the width of the rectangle is calculated dynamically because it may not coincide with the framebuffer width. If the dirty range ends exactly at the end of the scanline, the `bit_end` variable is incorrectly assigned a 0 value, which results in a bogus clip rectangle where the x2 coordinate is 0. This prevents the dirty scanline from being flushed to the hardware. Change the calculation of the `bit_end` value to fix the x2 coordinate value in the above edge case. Fixes: ded74cafeea9 ("drm/fb-helper: Clip damage area horizontally") Signed-off-by: Francesco Lavra Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260210173545.733937-1-flavra@baylibre.com commit 8acd2d7e0889ac62bc102bd7b648cd7bee04f902 Author: Myeonghun Pak Date: Fri Apr 24 20:25:18 2026 +0900 drm/qxl: Fix missing KMS poll cleanup drm_kms_helper_poll_init() initializes the output polling work and enables polling for the DRM device. qxl enables polling before calling drm_dev_register(), but the drm_dev_register() failure path tears down the modeset and device state without disabling the polling helper. The remove path also unregisters and shuts down the DRM device without first disabling the polling helper. Add matching drm_kms_helper_poll_fini() calls in both paths so the delayed polling work is cancelled before qxl tears down the associated modeset/device state. Signed-off-by: Myeonghun Pak Reviewed-by: Thomas Zimmermann Fixes: 5ff91e442652 ("qxl: use drm helper hotplug support") Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260424112543.57819-1-mhun512@gmail.com commit e366ce8b22ec68189ffea2bb8009f7b20d549b0f Author: Uwe Kleine-König (The Capable Hub) Date: Thu Apr 30 17:45:24 2026 +0200 ASoC: codecs: ab8500: Remove suspicious code anc_configure() passed values from drvdata->anc_fir_values[], drvdata->anc_iir_values[] and drvdata->sid_fir_values[] as register offset to snd_soc_component_read(). The content of these arrays are user controllable via the component controls "ANC FIR Coefficients", "ANC IIR Coefficients" and "Sidetone FIR Coefficients" which I assume are supposed to hold register values, not register offsets. Without a datasheet for that component and given that before commit a201aef1a88b ("ASoC: codecs: ab8500: Fix casting of private data") the arrays overlapped with driver control structures and thus didn't work properly since 2012, drop that functionality and let someone repair it who has an actual need for it. With the core functionally removed several code parts become essentially unused and are removed, too. Reported-by: Sashiko (gemini/gemini-3.1-pro-preview) Link: https://sashiko.dev/#/patchset/20260428192255.2294705-2-u.kleine-koenig%40baylibre.com Fixes: 679d7abdc754 ("ASoC: codecs: Add AB8500 codec-driver") Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/20260430154524.338912-2-u.kleine-koenig@baylibre.com Signed-off-by: Mark Brown commit 359b626d362127451dbe8a687ac5c240f896ae2e Author: Cássio Gabriel Date: Fri May 1 14:45:14 2026 -0300 ALSA: pcmtest: Return -EFAULT on pattern read copy failure pattern_write() reports -EFAULT when copy_from_user() fails, but pattern_read() converts copy_to_user() failures into a zero-length read. That makes a userspace buffer fault look like EOF instead of reporting the actual error. Return -EFAULT from pattern_read() when copying the pattern data to userspace fails, and update the file offset only after a successful copy. Fixes: 315a3d57c64c ("ALSA: Implement the new Virtual PCM Test Driver") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260501-alsa-pcmtest-pattern-read-efault-v1-1-53e1e8c11dda@gmail.com Signed-off-by: Takashi Iwai commit 6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e Author: Weiming Shi Date: Wed Apr 15 01:23:39 2026 +0800 i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avoid overrunning the chip->words[256] register array, but does not validate it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union i2c_smbus_data.block buffer (34 bytes total). The driver is a development/test tool (CONFIG_I2C_STUB=m, not built by default) that must be loaded with a chip_addr= parameter. A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing stub_xfer() to read or write past the end of the union i2c_smbus_data.block buffer: BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223) Read of size 1 at addr ffff88800abcfd92 by task exploit/81 Call Trace: stub_xfer (drivers/i2c/i2c-stub.c:223) __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593) i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536) i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391) i2cdev_ioctl (drivers/i2c/i2c-dev.c:478) __x64_sys_ioctl (fs/ioctl.c:583) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) The bug exists because i2c-stub implements .smbus_xfer directly, bypassing the I2C_SMBUS_BLOCK_MAX validation in i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same function correctly validates against I2C_SMBUS_BLOCK_MAX, but the I2C_SMBUS_I2C_BLOCK_DATA case does not. Fix by rejecting transfers with data->block[0] == 0 or data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with both the I2C_SMBUS_BLOCK_DATA case in the same function and the I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated(). Fixes: 4710317891e4 ("i2c-stub: Implement I2C block support") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 088f65e206087bf903743bd18417261d7a4c9644 Author: Ivan Hu Date: Thu Apr 30 15:41:07 2026 +0800 x86/efi: Fix graceful fault handling after FPU softirq changes Since commit d02198550423 ("x86/fpu: Improve crypto performance by making kernel-mode FPU reliably usable in softirqs"), kernel_fpu_begin() calls fpregs_lock() which uses local_bh_disable() instead of the previous preempt_disable(). This sets SOFTIRQ_OFFSET in preempt_count during the entire EFI runtime service call, causing in_interrupt() to return true in normal task context. The graceful page fault handler efi_crash_gracefully_on_page_fault() uses in_interrupt() to bail out for faults in real interrupt context. With SOFTIRQ_OFFSET now set, the handler always bails out, leaving EFI firmware page faults unhandled. This escalates to die() which also sees in_interrupt() as true and calls panic("Fatal exception in interrupt"), resulting in a hard system freeze. On systems with buggy firmware that triggers page faults during EFI runtime calls (e.g., accessing unmapped memory in GetTime()), this causes an unrecoverable hang instead of the expected graceful EFI_ABORTED recovery. Fix by replacing in_interrupt() with !in_task(). This preserves the original intent of bailing for interrupts or NMI faults, while no longer falsely triggering from the FPU code path's local_bh_disable(). Fixes: d02198550423 ("x86/fpu: Improve crypto performance by making kernel-mode FPU reliably usable in softirqs") Cc: Signed-off-by: Ivan Hu [ardb: Sashiko spotted that using 'in_hardirq() || in_nmi()' leaves a window where a softirq may be taken before fpregs_lock() is called, but after efi_rts_work.efi_rts_id has been assigned, and any page faults occurring in that window will then be misidentified as having been caused by the firmware. Instead, use !in_task(), which incorporates in_serving_softirq(). ] Signed-off-by: Ard Biesheuvel commit b47bc7c022ddab7c79a84dd5f3f0d07fe09ec786 Author: Nikola Z. Ivanov Date: Wed Apr 15 23:50:21 2026 +0300 i2c: Compare the return value of gpiod_get_direction against GPIO_LINE_DIRECTION_OUT The GPIO_LINE_DIRECTION_* definitions have just recently been exposed to gpio consumers.h by breaking them out in a separate defs.h file. Use this to validate the gpio direction instead of the hard-coded literal. Signed-off-by: Nikola Z. Ivanov Signed-off-by: Wolfram Sang commit 37b0dc5e279f35036fb638d1e187197b6c05a76d Author: Hongling Zeng Date: Sun May 3 12:17:44 2026 +0800 parisc: Fix IRQ leak in LASI driver When request_irq() succeeds but gsc_common_setup() fails later, the IRQ is never released. Fix this by adding proper error handling with goto labels to ensure resources are released in LIFO order. Detected by Smatch: drivers/parisc/lasi.c:216 lasi_init_chip() warn: 'lasi->gsc_irq.irq' from request_irq() not released on lines: 207. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202604180957.4QdAIxP6-lkp@intel.com/ Signed-off-by: Hongling Zeng Cc: stable@vger.kernel.org Signed-off-by: Helge Deller commit bc851db06045a40c18233dd76ef0562d7f8bb6db Author: Shyam Sunder Reddy Padira Date: Tue Apr 14 12:43:06 2026 +0530 staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc The return value of kzalloc_flex() is used without ensuring that the allocation succeeded, and the pointer is dereferenced unconditionally. Guard the access to the allocated structure to avoid a potential NULL pointer dereference if the allocation fails. Fixes: 980cd426a257 ("staging: rtl8723bs: replace rtw_zmalloc() with kzalloc()") Cc: stable Signed-off-by: Shyam Sunder Reddy Padira Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260414071308.4781-2-shyamsunderreddypadira@gmail.com Signed-off-by: Greg Kroah-Hartman commit 617eb7c0961a8dfcfc811844a6396e406b2923ea Author: Mingyu Wang <25181214217@stu.xidian.edu.cn> Date: Mon Apr 27 10:57:45 2026 +0800 i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl While fuzzing with Syzkaller, a persistent `schedule_timeout: wrong timeout value` warning was observed, accompanied by SMBus controller state machine corruption. The I2C_TIMEOUT ioctl accepts a user-provided timeout in multiples of 10 ms. The user argument is checked against INT_MAX, but it is subsequently multiplied by 10 before being passed to msecs_to_jiffies(). A malicious user can pass a large value (e.g., 429496729) that passes the `arg > INT_MAX` check but overflows when multiplied by 10. This results in a truncated 32-bit unsigned value that bypasses the internal `(int)m < 0` check in `msecs_to_jiffies()`. The truncated value is then assigned to `client->adapter->timeout` (a signed 32-bit int), which is reinterpreted as a negative number. When passed to wait_for_completion_timeout(), this negative value undergoes sign extension to a 64-bit unsigned long, triggering the `schedule_timeout` warning and causing premature returns. This leaves the SMBus state machine in an unrecoverable state, constituting a local Denial of Service (DoS). Fix this by bounding the user argument to `INT_MAX / 10`. Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> [wsa: move the comment as well] Signed-off-by: Wolfram Sang commit 32c91e8ee039777d0b95b914633fc6a42607959c Author: Johan Hovold Date: Fri Apr 24 12:49:10 2026 +0200 staging: vme_user: fix root device leak on init failure Make sure to deregister and free the root device in case module initialisation fails. Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver") Cc: stable@vger.kernel.org # 4.9 Cc: Martyn Welch Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260424104910.2619349-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9998e388be9930c106eb5904c23ecf2162407527 Author: Niels Franke Date: Sat Apr 18 07:37:19 2026 +0200 i2c: acpi: Add ELAN0678 to i2c_acpi_force_100khz_device_ids The ELAN0678 touchpad (04F3:3195) found in the Lenovo ThinkPad X13 exhibits excessive smoothing when the I2C bus runs at 400KHz, making the touchpad feel sluggish when plugged into AC power. This is the same issue previously fixed for ELAN06FA. The device's ACPI table (Lenovo TP-R22) specifies 0x00061A80 (400KHz) for the I2cSerialBusV2 descriptor. Forcing the bus to 100KHz eliminates the sluggish behavior. Signed-off-by: Niels Franke Acked-by: Mika Westerberg [wsa: kept the sorting] Signed-off-by: Wolfram Sang commit 8de779dc40d35d39fa07387b6f921eb11df0f511 Author: Rajat Gupta Date: Sun May 3 20:51:10 2026 -0700 fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages to userspace but sets no vm_ops on the VMA. This means the kernel cannot track active mmaps. When dlfb_realloc_framebuffer() replaces the backing buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated. On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages while userspace PTEs still reference them, resulting in a use-after-free: the process retains read/write access to freed kernel pages. Add vm_operations_struct with open/close callbacks that maintain an atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(), check mmap_count and return -EBUSY if the buffer is currently mapped, preventing buffer replacement while userspace holds stale PTEs. Tested with PoC using dummy_hcd + raw_gadget USB device emulation. Signed-off-by: Rajat Gupta Acked-by: Greg Kroah-Hartman Cc: stable@vger.kernel.org Signed-off-by: Helge Deller commit c5f25f5800f56f1754d9eeb3ced7c1e08c29119a Author: Janne Grunau Date: Fri Mar 20 13:23:24 2026 +0100 dt-bindings: i2c: apple,i2c: Add t8122 compatible The i2c block on the Apple silicon t8122 (M3) SoC is compatible with the existing driver. Add "apple,t8122-i2c" as SoC specific compatible under "apple,t8103-i2c" used by the deriver. Signed-off-by: Janne Grunau Acked-by: Andi Shyti Acked-by: Rob Herring (Arm) Signed-off-by: Wolfram Sang commit 10161b4a791d5c4b7ea16512c1ddb133c3f8f953 Author: Weinan Liu Date: Thu Apr 30 23:28:51 2026 +0000 iommu/amd: Fix precedence order in set_dte_passthrough() Bitwise OR | operator has a higher precedence than the ternary ?: operatior. It will be incorrectly evaluated as: new->data[1] |= (FIELD_PREP(...) | dev_data->ats_enabled) ? DTE_FLAG_IOTLB : 0; Wrap the conditional operation in parentheses to enforce the correct evaluation order. Fixes: 93eee2a49c1b ("iommu/amd: Refactor logic to program the host page table in DTE") Signed-off-by: Weinan Liu Reviewed-by: Jason Gunthorpe Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel commit 02b7cd683892d8d8464815d69a3a76579909a726 Author: Marek Vasut Date: Sat May 2 17:31:54 2026 +0200 i2c: stm32f7: reinit_completion() per transfer not per msg Currently, the driver may repeatedly call reinit_completion() during transfer which contains multiple messages, while another thread is waiting for the completion. This happens during transfer with more than 1 message, invoked via stm32f7_i2c_xfer_core() -> stm32f7_i2c_xfer_msg(). After invoking the stm32f7_i2c_xfer_msg() to start transfer, stm32f7_i2c_xfer_core() calls wait_for_completion_timeout() to wait for completion of the transfer of all messages. When the first message transfer completes, the hard IRQ handler triggers, and detects transfer completion, which leads to stm32f7_i2c_isr_event_thread() IRQ thread being started. The stm32f7_i2c_isr_event_thread() calls stm32f7_i2c_xfer_msg() in case there are more messages. Without this change, the second and later stm32f7_i2c_xfer_msg() would call reinit_completion() on the completion which is still being waited for in stm32f7_i2c_xfer_core(). Fix this by moving the reinit_completion() into stm32f7_i2c_xfer_core(), together with wait_for_completion_timeout(). Since stm32f7_i2c_xfer_core() now waits for completion of the entire transfer, increase the default timeout. This fixes sporadic transfer timeouts on STM32MP25xx during kernel boot. Fixes: aeb068c57214 ("i2c: i2c-stm32f7: add driver") Signed-off-by: Marek Vasut [wsa: reworded commit subject] Signed-off-by: Wolfram Sang commit 9a937ca22741eebe2bf10b18657b8b9aed9c009b Author: Ronald Claveau Date: Fri Apr 24 16:17:33 2026 +0200 dt-bindings: i2c: amlogic: Add compatible for T7 SOC Add the T7 SOC compatible which fallback to AXG compatible. Acked-by: Rob Herring (Arm) Signed-off-by: Ronald Claveau Signed-off-by: Wolfram Sang commit 8bc6b14aab669f0c301febcf4aa5249b9393bf51 Author: Marco Crivellari Date: Thu Apr 30 11:08:10 2026 +0200 i2c: testunit: Replace system_long_wq with system_dfl_long_wq Currently the code enqueue work items using {queue|mod}_delayed_work(), using system_long_wq. This workqueue should be used when long works are expected, but it is a per-cpu workqueue. This is important because queue_delayed_work() queue the work using: queue_delayed_work_on(WORK_CPU_UNBOUND, ...); Note that WORK_CPU_UNBOUND = NR_CPUS. This would end up calling __queue_delayed_work() that does: if (housekeeping_enabled(HK_TYPE_TIMER)) { // [....] } else { if (likely(cpu == WORK_CPU_UNBOUND)) add_timer_global(timer); else add_timer_on(timer, cpu); } So when cpu == WORK_CPU_UNBOUND the timer is global and is not using a specific CPU. Later, when __queue_work() is called: if (req_cpu == WORK_CPU_UNBOUND) { if (wq->flags & WQ_UNBOUND) cpu = wq_select_unbound_cpu(raw_smp_processor_id()); else cpu = raw_smp_processor_id(); } Because the wq is not unbound, it takes the CPU where the timer fired and enqueue the work on that CPU. The consequence of all of this is that the work can run anywhere, depending on where the timer fired. Recently, a new unbound workqueue specific for long running work has been added: c116737e972e ("workqueue: Add system_dfl_long_wq for long unbound works") So change system_long_wq with system_dfl_long_wq so that the work may benefit from scheduler task placement. Signed-off-by: Marco Crivellari [wsa: remove FIXME as well] Signed-off-by: Wolfram Sang commit 65493f27a6008bf84bd11bd41c5e1ea6b0bf3c3d Author: Bart Van Assche Date: Thu Apr 30 10:44:15 2026 -0700 wifi: cw1200: Revert "Fix locking in error paths" Revert commit d98c24617a83 ("wifi: cw1200: Fix locking in error paths") because it introduces a locking bug instead of fixing a locking bug. cw1200_wow_resume() unlocks priv->conf_mutex. Hence, adding mutex_unlock(&priv->conf_mutex) just after cw1200_wow_resume() is wrong. Reported-by: Ben Hutchings Closes: https://lore.kernel.org/all/408661f69f263266b028713e1412ba36d457e63d.camel@decadent.org.uk/ Fixes: d98c24617a83 ("wifi: cw1200: Fix locking in error paths") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260430174418.1845431-1-bvanassche@acm.org Signed-off-by: Johannes Berg commit 0cfff13c94cb5fa818bb374945ff280e08dc1bb9 Author: Johannes Berg Date: Mon May 4 08:54:27 2026 +0200 wifi: mac80211: tests: mark HT check strict The HT check now only applies in strict mode since APs were found to be broken. Mark it as such. Fixes: 711a9c018ad2 ("wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode") Signed-off-by: Johannes Berg commit 646ebdd3105809d84ed04aa9e92e47e89cc44502 Author: Oliver Neukum Date: Fri Apr 10 23:03:09 2026 +0200 media: rc: ttusbir: fix inverted error logic We have to report ENOMEM if no buffer is allocated. Typo dropped a "!". Restore it. Fixes: 50acaad3d202 ("media: rc: ttusbir: respect DMA coherency rules") Cc: stable@vger.kernel.org Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 04fe9aeb4f3c0999e6715385664c677469dfd8f4 Author: Yufan Chen Date: Mon May 4 01:57:10 2026 +0800 io_uring/eventfd: reset deferred signal state Recursive eventfd wakeups must defer io_uring eventfd signaling because eventfd_signal_mask() rejects reentry from eventfd wakeup handlers. The io_ev_fd ops bit tracks an outstanding deferred signal so that the same rcu_head is not queued twice. That bit is only set today. Once the first deferred callback runs, later recursive notifications still see the bit set and skip queueing another deferred signal. This can leave new completions without a matching eventfd wake after the first recursive deferral. Clear the pending bit before issuing the deferred signal. If the wakeup path recurses while the callback runs, a new signal can be queued for the next RCU grace period while the current callback keeps its reference until it returns. Signed-off-by: Yufan Chen Fixes: 60b6c075e8eb ("io_uring/eventfd: move to more idiomatic RCU free usage") Link: https://patch.msgid.link/20260503175710.37209-1-yufan.chen@linux.dev Signed-off-by: Jens Axboe commit b8c2e9e27636b92dc96c12f16894cbc60c58a306 Author: Yufan Chen Date: Mon May 4 01:56:10 2026 +0800 io_uring/napi: clear tracked NAPI entries on unregister IORING_UNREGISTER_NAPI disables NAPI busy polling, but it currently leaves any previously tracked NAPI IDs on the ring context. The normal wait path only checks whether the list is empty before entering the busy poll helper, so an unregistered ring can still observe stale entries and run an unexpected busy poll pass. Make unregister switch the context to inactive and free the tracked entries. Do the same inactive transition while changing the tracking strategy, and recheck the expected tracking mode under napi_lock before inserting a newly learned NAPI ID. This prevents a racing poll path from repopulating the list after unregister or reconfiguration. Also make the busy poll dispatcher ignore inactive mode explicitly. Signed-off-by: Yufan Chen Fixes: 6bf90bd8c58a ("io_uring/napi: add static napi tracking strategy") Link: https://patch.msgid.link/20260503175610.35521-1-yufan.chen@linux.dev Signed-off-by: Jens Axboe commit 84d5d76c4e8e2750fa17869b7272f189d2bdd40b Author: Matthew Brost Date: Fri May 1 23:53:38 2026 -0700 drm/ttm: Fix GPU MM stats during pool shrinking TTM pool shrinking frees pages by calling __free_pages() directly, which bypasses updates to NR_GPU_ACTIVE and leaves GPU MM accounting out of sync. Introduce a helper, __free_pages_gpu_account(), and use it for all page frees in ttm_pool.c so GPU MM statistics are updated consistently. Reported-by: Kenneth Crudup Fixes: ae80122f3896 ("drm/ttm: use gpu mm stats to track gpu memory allocations. (v4)") Cc: Christian Koenig Cc: Huang Rui Cc: Matthew Auld Cc: David Airlie Cc: dri-devel@lists.freedesktop.org Signed-off-by: Matthew Brost Tested-by: Kenneth Crudup Reviewed-by: Dave Airlie Link: https://patch.msgid.link/20260502065338.2720646-1-matthew.brost@intel.com commit 5e489c6c47a2ac15edbaca153b9348e42c1eacab Author: Bjoern Doebel Date: Thu Apr 30 08:57:17 2026 +0000 smb: client: use kzalloc to zero-initialize security descriptor buffer Commit 62e7dd0a39c2d ("smb: common: change the data type of num_aces to le16") split struct smb_acl's __le32 num_aces field into __le16 num_aces and __le16 reserved. The reserved field corresponds to Sbz2 in the MS-DTYP ACL wire format, which must be zero [1]. When building an ACL descriptor in build_sec_desc(), we are using a kmalloc()'ed descriptor buffer and writing the fields explicitly using le16() writes now. This never writes to the 2 byte reserved field, leaving it as uninitialized heap data. When the reserved field happens to contain non-zero slab garbage, Samba rejects the security descriptor with "ndr_pull_security_descriptor failed: Range Error", causing chmod to fail with EINVAL. Change kmalloc() to kzalloc() to ensure the entire buffer is zero-initialized. Fixes: 62e7dd0a39c2d ("smb: common: change the data type of num_aces to le16") Cc: stable@vger.kernel.org Signed-off-by: Bjoern Doebel Assisted-by: Kiro:claude-opus-4.6 [1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/20233ed8-a6c6-4097-aafa-dd545ed24428 Signed-off-by: Steve French commit d68ce834f8cf6cb2e77f3331df65166b35466b53 Author: Shyam Prasad N Date: Tue Apr 28 21:37:47 2026 +0530 cifs: abort open_cached_dir if we don't request leases It is possible that SMB2_open_init may not set lease context based on the requested oplock level. This can happen when leases have been temporarily or permanently disabled. When this happens, we will have open_cached_dir making an open without lease context and the response will anyway be rejected by open_cached_dir (thereby forcing a close to discard this open). That's unnecessary two round-trips to the server. This change adds a check before making the open request to the server to make sure that SMB2_open_init did add the expected lease context to the open in open_cached_dir. Cc: Reviewed-by: Bharath SM Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 5a873d77ba792410a796595a917be6a440f9b7d2 Author: Bibo Mao Date: Mon May 4 09:00:48 2026 +0800 LoongArch: KVM: Move unconditional delay into timer clear scenery When timer interrupt arrives in guest kernel, guest kernel clears the timer interrupt and program timer with the next incoming event. During this stage, timer tick is -1 and timer interrupt status is disabled in ESTAT register. KVM hypervisor need write zero with timer tick register and wait timer interrupt injection from HW side, and then clear timer interrupt. So there is 2 cycle delay in KVM hypervisor to emulate such scenery, and the delay is unnecessary if there is no need to clear the timer interrupt. Here move 2 cycle delay into timer clear scenery and add timer ESTAT checking after delay, and set max timer expire value if timer interrupt does not arrive still. Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 2433f3f5724b3af569d9fb411ba728629524738b Author: Bibo Mao Date: Mon May 4 09:00:48 2026 +0800 LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software With passthrough HW timer, timer interrupt is injected by HW. When inject emulated CPU interrupt by software such SIP0/SIP1/IPI, HW timer interrupt may be lost. Here check whether there is timer tick value inversion before and after injecting emulated CPU interrupt by software, timer enabling by reading timer cfg register is skipped. If the timer tick value is detected with changing, then timer should be enabled. And inject a timer interrupt by software if there is. Cc: Fixes: f45ad5b8aa93 ("LoongArch: KVM: Implement vcpu interrupt operations"). Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 6debfff78584f0adedf7355fe5263198a3fc6b19 Author: Bibo Mao Date: Mon May 4 09:00:48 2026 +0800 LoongArch: KVM: Move AVEC interrupt injection into switch loop When AVEC interrupt controller is emulated in user space, AVEC interrupt is injected by software like SIP0/SIP1/TI/IPI interrupts. Here also move the AVEC interrupt injection in switch loop. Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 81e18777d61440511451866c7c80b34a8bdd6b33 Author: Tao Cui Date: Mon May 4 09:00:38 2026 +0800 LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() kvm_flush_pte() is the only caller that directly assigns *pte instead of using the kvm_set_pte() wrapper. Use the wrapper for consistency with the rest of the file. No functional change intended. Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao Signed-off-by: Tao Cui Signed-off-by: Huacai Chen commit f26faae96c411a70641e4d21b759475caa6122d5 Author: Tao Cui Date: Mon May 4 09:00:38 2026 +0800 LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() In the ldptr (0x24...0x27) opcode decoding path, the default case only breaks out but without setting "ret" value to EMULATE_FAIL. This leaves run->mmio.len uninitialized (stale from a previous MMIO operation) while "ret" value remains EMULATE_DO_MMIO, causing the code to proceed with an incorrect MMIO length. Add "ret = EMULATE_FAIL" to match the other default branches in the same function (e.g. the 0x28...0x2e and 0x38 cases). Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao Signed-off-by: Tao Cui Signed-off-by: Huacai Chen commit b3e31a6650d4cab63f0814c37c0b360372c6ee9e Author: Qiang Ma Date: Mon May 4 09:00:37 2026 +0800 LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS It doesn't make sense to return the recommended maximum number of vCPUs which exceeds the maximum possible number of vCPUs. Other architectures have already done this, such as commit 57a2e13ebdda ("KVM: MIPS: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS") Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao Signed-off-by: Qiang Ma Signed-off-by: Huacai Chen commit b323a441da602dfdfc24f30d3190cac786ffebf2 Author: Xianglai Li Date: Mon May 4 09:00:37 2026 +0800 LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Insert the appropriate UNWIND hint into the kvm_exc_entry assembly function to guide the generation of correct ORC table entries, thereby solving the timeout problem ("unreliable stack") while loading the livepatch-sample module on a physical machine running virtual machines with multiple vcpus. Cc: stable@vger.kernel.org Signed-off-by: Xianglai Li Signed-off-by: Huacai Chen commit 5203012fa6045aac4b69d4e7c212e16dcf38ef10 Author: Xianglai Li Date: Mon May 4 09:00:37 2026 +0800 LoongArch: KVM: Compile switch.S directly into the kernel If we directly compile the switch.S file into the kernel, the address of the kvm_exc_entry function will definitely be within the DMW memory area. Therefore, we will no longer need to perform a copy relocation of the kvm_exc_entry. So this patch compiles switch.S directly into the kernel, and then remove the copy relocation execution logic for the kvm_exc_entry function. Cc: stable@vger.kernel.org Signed-off-by: Xianglai Li Signed-off-by: Huacai Chen commit 7e2c41bc62e436f465ee1ff7ebc14e35c99d95fb Author: Thomas Weißschuh Date: Mon May 4 09:00:20 2026 +0800 LoongArch: vDSO: Drop custom __arch_vdso_hres_capable() The custom definition is identical to the generic fallback one. So remove it. Signed-off-by: Thomas Weißschuh Signed-off-by: Huacai Chen commit 8dfa2f8780e486d05b9a0ffce70b8f5fbd62053e Author: Wentao Guan Date: Mon May 4 09:00:20 2026 +0800 LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() The switch case in loongson_gpu_fixup_dma_hang() may not DC2 or DC3, and readl(crtc_reg) will access with random address, because the "device" is from "base+PCI_DEVICE_ID", "base" is from "pdev->devfn+1". This is wrong when my platform inserts a discrete GPU: lspci -tv -[0000:00]-+-00.0 Loongson Technology LLC Hyper Transport Bridge Controller ... +-06.0 Loongson Technology LLC LG100 GPU +-06.2 Loongson Technology LLC Device 7a37 ... Add a default switch case to fix the panic as below: Kernel ade access[#1]: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.136-loong64-desktop-hwe+ #4 pc 90000000017e5534 ra 90000000017e54c0 tp 90000001002f8000 sp 90000001002fb6c0 a0 80000efe00003100 a1 0000000000003100 a2 0000000000000000 a3 0000000000000002 a4 90000001002fb6b4 a5 900000087cdb58fd a6 90000000027af000 a7 0000000000000001 t0 00000000000085b9 t1 000000000000ffff t2 0000000000000000 t3 0000000000000000 t4 fffffffffffffffd t5 00000000fffb6d9c t6 0000000000083b00 t7 00000000000070c0 t8 900000087cdb4d94 u0 900000087cdb58fd s9 90000001002fb826 s0 90000000031c12c8 s1 7fffffffffffff00 s2 90000000031c12d0 s3 0000000000002710 s4 0000000000000000 s5 0000000000000000 s6 9000000100053000 s7 7fffffffffffff00 s8 90000000030d4000 ra: 90000000017e54c0 loongson_gpu_fixup_dma_hang+0x40/0x210 ERA: 90000000017e5534 loongson_gpu_fixup_dma_hang+0xb4/0x210 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD: 00000004 (PPLV0 +PIE -PWE) EUEN: 00000000 (-FPE -SXE -ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 00480000 [ADEM] (IS= ECode=8 EsubCode=1) BADV: 7fffffffffffff00 PRID: 0014d000 (Loongson-64bit, Loongson-3A6000-HV) Modules linked in: Process swapper/0 (pid: 1, threadinfo=(____ptrval____), task=(____ptrval____)) Stack : 0000000000000006 90000001002fb778 90000001002fb704 0000000000000007 0000000016a65700 90000000017e5690 000000000000ffff ffffffffffffffff 900000000209f7c0 9000000100053000 900000000209f7a8 9000000000eebc08 0000000000000000 0000000000000000 0000000000000006 90000001002fb778 90000001000530b8 90000000027af000 0000000000000000 9000000100054000 9000000100053000 9000000000ebb70c 9000000100004c00 9000000004000001 90000001002fb7e4 bae765461f31cb12 0000000000000000 0000000000000000 0000000000000006 90000000027af000 0000000000000030 90000000027af000 900000087cd6f800 9000000100053000 0000000000000000 9000000000ebc560 7a2500147cdaf720 bae765461f31cb12 0000000000000001 0000000000000030 ... Call Trace: [<90000000017e5534>] loongson_gpu_fixup_dma_hang+0xb4/0x210 [<9000000000eebc08>] pci_fixup_device+0x108/0x280 [<9000000000ebb70c>] pci_setup_device+0x24c/0x690 [<9000000000ebc560>] pci_scan_single_device+0xe0/0x140 [<9000000000ebc684>] pci_scan_slot+0xc4/0x280 [<9000000000ebdd00>] pci_scan_child_bus_extend+0x60/0x3f0 [<9000000000f5bc94>] acpi_pci_root_create+0x2b4/0x420 [<90000000017e5e74>] pci_acpi_scan_root+0x2d4/0x440 [<9000000000f5b02c>] acpi_pci_root_add+0x21c/0x3a0 [<9000000000f4ee54>] acpi_bus_attach+0x1a4/0x3c0 [<90000000010e200c>] device_for_each_child+0x6c/0xe0 [<9000000000f4bbf4>] acpi_dev_for_each_child+0x44/0x70 [<9000000000f4ef40>] acpi_bus_attach+0x290/0x3c0 [<90000000010e200c>] device_for_each_child+0x6c/0xe0 [<9000000000f4bbf4>] acpi_dev_for_each_child+0x44/0x70 [<9000000000f4ef40>] acpi_bus_attach+0x290/0x3c0 [<9000000000f5211c>] acpi_bus_scan+0x6c/0x280 [<900000000189c028>] acpi_scan_init+0x194/0x310 [<900000000189bc6c>] acpi_init+0xcc/0x140 [<9000000000220cdc>] do_one_initcall+0x4c/0x310 [<90000000018618fc>] kernel_init_freeable+0x258/0x2d4 [<900000000184326c>] kernel_init+0x28/0x13c [<9000000000222008>] ret_from_kernel_thread+0xc/0xa4 Cc: stable@vger.kernel.org Fixes: 95db0c9f526d ("LoongArch: Workaround LS2K/LS7A GPU DMA hang bug") Link: https://gist.github.com/opsiff/ebf2dac51b4013d22462f2124c55f807 Link: https://gist.github.com/opsiff/a62f2a73db0492b3c49bf223a339b133 Signed-off-by: Wentao Guan Signed-off-by: Huacai Chen commit 49f33840dcc907d21313d369e34872880846b61c Author: Huacai Chen Date: Mon May 4 09:00:20 2026 +0800 LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup When firmware enables 64-bit PCI host bridge support, some root bridges already provide valid 64-bit mem resource windows through ACPI. In this case, the LoongArch-specific mem resource high-bits fixup in acpi_prepare_root_resources() should not be applied unconditionally. Otherwise, the kernel may override the native resource layout derived from firmware, and later BAR assignment can fail to place device BARs into the intended 64-bit address space correctly. Add a per-root-bridge ACPI flag, PCIH, and evaluate it from the current root bridge device scope. When PCIH is set, skip the mem resource high- bits fixup path and let the kernel use the firmware-provided resource description directly. When PCIH is absent or cleared, keep the existing behavior and continue filling the high address bits from the host bridge address. This makes the behavior per-root-bridge configurable and avoids breaking valid 64-bit BAR space allocation on bridges whose 64-bit windows have already been fully described by firmware. Cc: stable@vger.kernel.org Suggested-by: Chao Li Tested-by: Dongyan Qian Signed-off-by: Dongyan Qian Signed-off-by: Huacai Chen commit 98b8aebb14fdc0133939fd8fe07d0d98333dc976 Author: Huacai Chen Date: Mon May 4 09:00:01 2026 +0800 LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT The SYM_SIGFUNC_START definition should match sigcontext that the length of GPRs are 8 bytes for both 32BIT and 64BIT. So replace SZREG with 8 to fix it. Cc: stable@vger.kernel.org Fixes: e4878c37f6679fde ("LoongArch: vDSO: Emit GNU_EH_FRAME correctly") Suggested-by: Xi Ruoyao Signed-off-by: Huacai Chen commit 5643c6b2c8308b206cb01cbfd0e6ac80f9f1bc9a Author: Huacai Chen Date: Mon May 4 09:00:01 2026 +0800 LoongArch: Specify -m32/-m64 explicitly for 32BIT/64BIT Clang/LLVM build needs -m32/-m64 to switch triple variants (i.e. the --target=xxx parameter). Otherwise we get build errors for CONFIG_32BIT. GCC doesn't support -m32/-m64 now, but maybe support in future, so use cc-option to specify them. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604232041.ESJDwVG4-lkp@intel.com/ Suggested-by: Nathan Chancellor Signed-off-by: Huacai Chen commit 4808e5cc4fe1f40c4d690d0ce5df0f413fb02938 Author: Huacai Chen Date: Mon May 4 09:00:00 2026 +0800 LoongArch: Make CONFIG_64BIT as the default option CONFIG_64BIT is the mandatory option before v7.0, but in v7.1-rc1 both CONFIG_32BIT and CONFIG_64BIT are selectable and CONFIG_32BIT became the default option. This breaks existing configurations, so explicitly make CONFIG_64BIT as the default option to keep existing behavior. Signed-off-by: Huacai Chen commit 6d35786de28116ecf78797a62b84e6bf3c45aa5a Merge: 7fd2df204f342f 0cb2af2ea66ad8 Author: Linus Torvalds Date: Sun May 3 15:25:47 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Three bug fixes for x86: - Check that nEPT/nNPT is enabled in slow flush hypercalls. If it is not, the hypercalls can be processed as usual even while running a nested guest - Fix shadow paging use-after-free due to page tables changing outside execution of the guest. A bug that is 16 years old and stems from an imprecision in the very first KVM series - Scan IRR whenever PID.ON is true, even if PIR is empty, which avoids a somewhat rare WARN" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN KVM: x86: Fix misleading variable names and add more comments for PIR=>IRR flow KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty KVM: x86: check for nEPT/nNPT in slow flush hypercalls commit 7fd2df204f342fc17d1a0bfcd474b24232fb0f32 Author: Linus Torvalds Date: Sun May 3 14:21:25 2026 -0700 Linux 7.1-rc2 commit 0cb2af2ea66ad8ff195c156ea690f11216285bdf Author: Sean Christopherson Date: Wed Apr 15 00:52:34 2026 +0000 KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries (similar to commit aad885e77496, "KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE", 2026-03-27). The flow is as follows: - a PDE is installed for a 2MB mapping, and a page in that area is accessed. KVM creates a kvm_mmu_page consisting of 512 4KB pages; the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because the guest's mapping is a huge page (and thus contiguous). - the PDE mapping is changed from outside the guest. - the guest accesses another page in the same 2MB area. KVM installs a new leaf SPTE and rmap entry; the SPTE uses the "correct" GFN (i.e. based on the new mapping, as changed in the previous step) but that GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore the rmap entry cannot be found and removed when the kvm_mmu_page is zapped. - the memslot that covers the first 2MB mapping is deleted, and the kvm_mmu_page for the now-invalid GPA is zapped. However, rmap_remove() only looks at the [sp->gfn, sp->gfn + 511] range established in step 1, and fails to find the rmap entry that was recorded by step 3. - any operation that causes an rmap walk for the same page accessed by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page. This includes dirty logging or MMU notifier invalidations (e.g., from MADV_DONTNEED). The underlying issue is that KVM's walking of shadow PTEs assumes that if a SPTE is present when KVM wants to install a non-leaf SPTE, then the existing kvm_mmu_page must be for the correct gfn. Because the only way for the gfn to be wrong is if KVM messed up and failed to zap a SPTE... which shouldn't happen, but *actually* only happens in response to a guest write. That bug dates back literally forever, as even the first version of KVM assumes that the GFN matches and walks into the "wrong" shadow page. However, that was only an imprecision until 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") came along. Fix it by checking for a target gfn mismatch and zapping the existing SPTE. That way the old SP and rmap entries are gone, KVM installs the rmap in the right location, and everyone is happy. Fixes: 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") Fixes: 6aa8b732ca01 ("kvm: userspace interface") Reported-by: Alexander Bulekov Reported-by: Fred Griffoul Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Link: https://patch.msgid.link/20260503201029.106481-1-pbonzini@redhat.com/ Signed-off-by: Paolo Bonzini commit 0aec99f9bf0213f7910688472e1ccf517c0e8b5a Author: Sean Christopherson Date: Tue Apr 28 08:50:43 2026 -0700 KVM: x86: Fix misleading variable names and add more comments for PIR=>IRR flow Rename kvm_apic_update_irr()'s "irr_updated" and vmx_sync_pir_to_irr()'s "got_posted_interrupt" to a more accurate "max_irr_is_from_pir", as neither "irr_updated" nor "got_posted_interrupt" is accurate. __kvm_apic_update_irr() and thus kvm_apic_update_irr() specifically return true if and only if the highest priority IRQ, i.e. max_irr, is a "new" pending IRQ from the PIR. I.e. it's possible for the IRR to be updated, i.e. for a posted IRQ to be "got", *without* the APIs returning true. Expand vmx_sync_pir_to_irr()'s comment to explain why it's necessary to set KVM_REQ_EVENT only if a "new" IRQ was found, and to explain why it's safe to do so only if a new IRQ is also the highest priority pending IRQ. No functional change intended. Signed-off-by: Sean Christopherson Link: https://patch.msgid.link/20260503201703.108231-3-pbonzini@redhat.com/ Signed-off-by: Paolo Bonzini commit 33fd0ccd2590b470b65adcca288615ad3b5e3e06 Author: Paolo Bonzini Date: Sun May 3 19:19:32 2026 +0200 KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Fall back to apic_find_highest_vector() when PID.ON is set but PIR turns out to be empty, to correctly report the highest pending interrupt from the existing IRR. In a nested VM stress test, the following WARNING fires in vmx_check_nested_events() when kvm_cpu_has_interrupt() reports a pending interrupt but the subsequent kvm_apic_has_interrupt() (which invokes vmx_sync_pir_to_irr() again) returns -1: WARNING: CPU: 99 PID: 57767 at arch/x86/kvm/vmx/nested.c:4449 vmx_check_nested_events+0x6bf/0x6e0 [kvm_intel] Call Trace: kvm_check_and_inject_events vcpu_enter_guest.constprop.0 vcpu_run kvm_arch_vcpu_ioctl_run kvm_vcpu_ioctl __x64_sys_ioctl do_syscall_64 entry_SYSCALL_64_after_hwframe The root cause is a race between vmx_sync_pir_to_irr() on the target vCPU and __vmx_deliver_posted_interrupt() on a sender vCPU. The sender performs two individually-atomic operations that are not a single transaction: 1. pi_test_and_set_pir(vector) -- sets the PIR bit 2. pi_test_and_set_on() -- sets PID.ON The following interleaving triggers the bug: Sender vCPU (IPI): Target vCPU (1st sync_pir_to_irr): B1: set PIR[vector] A1: pi_clear_on() A2: pi_harvest_pir() -> sees B1 bit A3: xchg() -> consumes bit, PIR=0 (1st sync returns correct max_irr) B2: set PID.ON = 1 Target vCPU (2nd sync_pir_to_irr): C1: pi_test_on() -> TRUE (from B2) C2: pi_clear_on() -> ON=0 C3: pi_harvest_pir() -> PIR empty C4: *max_irr = -1, early return IRR NOT SCANNED The interrupt is not lost (it resides in the IRR from the first sync and is recovered on the next vcpu_enter_guest() iteration), but the incorrect max_irr causes a spurious WARNING and a wasted L2 VM-Enter/VM-Exit cycle. Fixes: b41f8638b9d3 ("KVM: VMX: Isolate pure loads from atomic XCHG when processing PIR") Reported-by: Farrah Chen Analyzed-by: Chenyi Qiang Cc: stable@vger.kernel.org Reviewed-by: Sean Christopherson Link: https://lore.kernel.org/kvm/20260428070349.1633238-1-chenyi.qiang@intel.com/T/ Link: https://patch.msgid.link/20260503201703.108231-2-pbonzini@redhat.com/ Signed-off-by: Paolo Bonzini commit 464af6fc2b1dcc74005b7f58ee3812b17777efee Author: Paolo Bonzini Date: Mon Apr 27 14:25:40 2026 +0200 KVM: x86: check for nEPT/nNPT in slow flush hypercalls Checking is_guest_mode(vcpu) is incorrect, because translate_nested_gpa() is only valid if an L2 guest is running *with nested EPT/NPT enabled*. Instead use the same condition as translate_nested_gpa() itself. Cc: stable@vger.kernel.org Reviewed-by: Sean Christopherson Fixes: aee738236dca ("KVM: x86: Prepare kvm_hv_flush_tlb() to handle L2's GPAs", 2022-11-18) Link: https://patch.msgid.link/20260503200905.106077-1-pbonzini@redhat.com/ Signed-off-by: Paolo Bonzini commit 519a228ee40d1be3453d1da339b4577c3785e333 Author: Yongxing Mou Date: Mon Apr 27 14:35:23 2026 +0800 phy: qcom: edp: Add PHY-specific LDO config for eDP low vdiff For eDP low vdiff, the LDO setting depends on the PHY version rather than being a simple 0x0 or 0x1 value. Introduce a PHY callback to program the correct LDO setting according to the HPG. Since SC7280/SC8180X uses different LDO settings from SA8775P/SC8280XP, introduce qcom_edp_phy_ops_v3 to keep the LDO setting correct. Cc: stable@vger.kernel.org Fixes: f199223cb490 ("phy: qcom: Introduce new eDP PHY driver") Signed-off-by: Yongxing Mou Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Tested-by: Konrad Dybcio # SC8280XP X13s Link: https://patch.msgid.link/20260427-edp_phy-v5-5-3bb876824475@oss.qualcomm.com Signed-off-by: Vinod Koul commit bf237a9fcbbf9d658522f7315ffc04bf2d49be42 Author: Yongxing Mou Date: Mon Apr 27 14:35:22 2026 +0800 phy: qcom: edp: Fix AUX_CFG8 programming for DP mode AUX_CFG8 depends on whether the PHY is operating in eDP or DP mode, not the selected swing/pre-emphasis table. All supported platforms already have the proper tables, so remove the unnecessary check. Cc: stable@vger.kernel.org Fixes: 6078b8ce070c ("phy: qcom: edp: Add set_mode op for configuring eDP/DP submode") Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Yongxing Mou Link: https://patch.msgid.link/20260427-edp_phy-v5-4-3bb876824475@oss.qualcomm.com Signed-off-by: Vinod Koul commit 3d22594d6f842814b7718600486fe3ce9453abf0 Author: Yongxing Mou Date: Mon Apr 27 14:35:21 2026 +0800 phy: qcom: edp: Add SC7280/SC8180X swing/pre-emphasis tables SC7280 and SC8180X previously shared the same cfg because they did not use swing/pre-emphasis tables. Add the corresponding tables for these platforms. Since they have different PHY sub-versions, their eDP/DP mode tables also differ, so move SC8180X to its own cfg instead of reusing the SC7280 one. Signed-off-by: Yongxing Mou Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260427-edp_phy-v5-3-3bb876824475@oss.qualcomm.com Signed-off-by: Vinod Koul commit 3011c365a329cf2db6d55e8d684550dc88350436 Author: Yongxing Mou Date: Mon Apr 27 14:35:20 2026 +0800 phy: qcom: edp: Add eDP/DP mode switch support The eDP PHY supports both eDP/DP modes, each requiring a different swing/pre-emphasis table. However, the driver currently uses a fixed static table for eDP programming rather than selecting the appropriate table based on the current mode. Add separate tables for eDP and DP modes, and select the appropriate table dynamically based on the current mode. Glymur's DP mode table differs from the other platforms, add a dedicated table for it. This also fixes the table mismatch for X1E80100 (eDP) and SA8775P (DP). Cc: stable@vger.kernel.org Fixes: 3f12bf16213c ("phy: qcom: edp: Add support for eDP PHY on SA8775P") Reviewed-by: Konrad Dybcio Signed-off-by: Yongxing Mou Link: https://patch.msgid.link/20260427-edp_phy-v5-2-3bb876824475@oss.qualcomm.com Signed-off-by: Vinod Koul commit fd672888cccd6b855154efe0ac78e7ce3e8ab088 Author: Yongxing Mou Date: Mon Apr 27 14:35:19 2026 +0800 phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis tables The current eDP and DP swing/pre-emphasis tables do not match the HPG requirements for the supported platforms, correct the table accordingly. The generic tables which can be shared as follows: DP mode： -sa8775p/sc7280/sc8280xp/x1e80100 -glymur -sc8180x eDP mode(low vdiff): -glymur/sa8775p/sc8280xp/x1e80100 -sc7280 -sc8180x The proper tables for SC8180X and SC7280 will be added in a later patch, since they need separate table. Cc: stable@vger.kernel.org Fixes: f199223cb490 ("phy: qcom: Introduce new eDP PHY driver") Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Yongxing Mou Link: https://patch.msgid.link/20260427-edp_phy-v5-1-3bb876824475@oss.qualcomm.com Signed-off-by: Vinod Koul commit f377d0025eb00c0590466f5be9f50decf9b9180e Merge: 811129272de4f9 b0aa5e4b087b68 Author: Linus Torvalds Date: Sun May 3 08:58:42 2026 -0700 Merge tag 'sh-for-v7.1-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux Pull sh fix from John Paul Adrian Glaubitz: "The ZERO_PAGE consolidation in v7.1, introduced a regression on sh which made these systems unbootable. The problem was that on sh, the initial boot parameters were previously referenced as an array and after 6215d9f4470f ("arch, mm: consolidate empty_zero_page"), they were referenced as a pointer which caused wrong code generation and boot hang. This changes the declaration back to being an array which fixes the boot hang" * tag 'sh-for-v7.1-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux: sh: Fix fallout from ZERO_PAGE consolidation commit 811129272de4f91da34f869ae1a1dd1fe608f64f Merge: cffcf520fd69fe 5b31044e649e3e Author: Linus Torvalds Date: Sun May 3 08:19:57 2026 -0700 Merge tag 'slab-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Stable fixes for CONFIG_SMP=n where _nolock() allocations in NMI both at kmalloc and page allocator levels are not properly protected by the spin_trylock() semantics on !SMP (Harry Yoo) * tag 'slab-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab: return NULL early from kmalloc_nolock() in NMI on UP mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP commit cffcf520fd69fe5a93b519cf0c7ccc5e467fcb1c Merge: c3cba36b394ba4 bc7304f3ae2097 Author: Linus Torvalds Date: Sun May 3 08:17:09 2026 -0700 Merge tag 'locking-urgent-2026-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Ingo Molnar: "Fix lockup in requeue-PI during signal/timeout wakeups, by Sebastian Andrzej Siewior" * tag 'locking-urgent-2026-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup commit c3cba36b394ba48b7920dcb99c46cee8ee59a116 Merge: 66edb901bf874d 3da56dc063cd77 Author: Linus Torvalds Date: Sun May 3 08:05:23 2026 -0700 Merge tag 'sched-urgent-2026-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: - Fix the delayed dequeue negative lag increase fix in the fair scheduler (Peter Zijlstra) - Fix wakeup_preempt_fair() to do proper delayed dequeue (Vincent Guittot) - Clear sched_entity::rel_deadline when initializing forked entities, which bug can cause all tasks to be EEVDF-ineligible, causing a NULL pointer dereference crash in pick_next_entity() (Zicheng Qu) * tag 'sched-urgent-2026-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Clear rel_deadline when initializing forked entities sched/fair: Fix wakeup_preempt_fair() vs delayed dequeue sched/fair: Fix the negative lag increase fix commit b0aa5e4b087b686575f1b31ce54048b4d059b7b8 Author: Mike Rapoport (Microsoft) Date: Fri Apr 17 13:32:07 2026 +0300 sh: Fix fallout from ZERO_PAGE consolidation Consolidation of empty_zero_page declarations broke boot on sh. sh stores its initial boot parameters in a page reserved in arch/sh/kernel/head_32.S. Before commit 6215d9f4470f ("arch, mm: consolidate empty_zero_page") this page was referenced in C code as an array and after that commit it is referenced as a pointer. This causes wrong code generation and boot hang. Declare boot_params_page as an array to fix the issue. Reported-by: Thomas Weißschuh Tested-by: Thomas Weißschuh Fixes: 6215d9f4470f ("arch, mm: consolidate empty_zero_page") Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: John Paul Adrian Glaubitz Tested-by: Geert Uytterhoeven Tested-by: Artur Rojek Signed-off-by: John Paul Adrian Glaubitz commit 0a69ac25bd596d50823d530d0a2004336668c0df Author: Eliot Courtney Date: Fri May 1 19:49:37 2026 +0900 rust: drm: fix unsound initialization in drm::Device::new If pinned initialization of drm::Device::Data fails, it calls drm::Device::release via drm_dev_put. This materializes a reference to &drm::Device, but it's not fully constructed yet, because initializing `data` failed. It should not be dropped either. Instead, if pinned initialization fails, make sure drm::Device::release isn't called. Fixes: 2e9fdbe5ec7a ("rust: drm: device: drop_in_place() the drm::Device in release()") Signed-off-by: Eliot Courtney Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260501-fix-drm-1-v2-1-5c4f681837bc@nvidia.com Signed-off-by: Danilo Krummrich commit d9eeb0ea0d2de658663bfaa9c26eccdd8fd64440 Author: Guangshuo Li Date: Mon Apr 13 21:46:04 2026 +0800 counter: Fix refcount leak in counter_alloc() error path After device_initialize(), the lifetime of the embedded struct device is expected to be managed through the device core reference counting. In counter_alloc(), if dev_set_name() fails after device_initialize(), the error path removes the chrdev, frees the ID, and frees the backing allocation directly instead of releasing the device reference with put_device(). This bypasses the normal device lifetime rules and may leave the reference count of the embedded struct device unbalanced, resulting in a refcount leak. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device() in the dev_set_name() failure path and let counter_device_release() handle the final cleanup. Fixes: 4da08477ea1f ("counter: Set counter device name") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Link: https://lore.kernel.org/r/20260413134604.2861772-1-lgs201920130244@gmail.com Signed-off-by: William Breathitt Gray commit d3894e4e09085bc6450aae6e3d30d13f1b1c8691 Author: Namjae Jeon Date: Fri May 1 21:10:38 2026 +0900 ntfs: fix variable dereferenced before check ni and attr in ntfs_attrlist_entry_add() Smatch warnings: ntfs_attrlist_entry_add() warn: variable dereferenced before check 'ni' ntfs_attrlist_entry_add() warn: variable dereferenced before check 'attr' Moves the ntfs_debug() call after the NULL pointer checks to ensure safe access to the structure members. Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Namjae Jeon commit bd3a4795d5744f59a1f485379f1303e5e606f377 Author: Jakub Kicinski Date: Wed Apr 29 15:29:39 2026 -0700 selftests: tls: add test for data loss on small pipe Add selftest for data loss on short splice. Link: https://patch.msgid.link/20260429222944.2139041-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7e7be31bfdb066c1c780dcd6b1224078fc54063f Author: Jakub Kicinski Date: Wed Apr 29 15:29:38 2026 -0700 net: tls: fix silent data drop under pipe back-pressure tls_sw_splice_read() uses len when advancing rxm->offset / rxm->full_len after skb_splice_bits(), rather than copied (the actual number of bytes successfully spliced into the pipe). When the destination pipe cannot accept all the requested bytes, splice_to_pipe() returns fewer bytes than len, and 'len - copied' of data is effectively skipped over. Fixes: e062fe99cccd ("tls: splice_read: fix accessing pre-processed records") Link: https://patch.msgid.link/20260429222944.2139041-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b42f68cf04260ae5b3e24cda7835d792ff35ac79 Merge: 1d324c2f43f70c 67dc6c56b87161 Author: Jakub Kicinski Date: Sat May 2 16:59:11 2026 -0700 Merge branch 'net-sched-sch_cake-annotate-data-races-in-cake_dump_class_stats-series' Eric Dumazet says: ==================== net/sched: sch_cake: annotate data-races in cake_dump_class_stats (series) cake_dump_class_stats() runs without qdisc spinlock being held. In this series (of two), I add READ_ONCE()/WRITE_ONCE() annotations for: - flow->head - flow->dropped - b->backlogs[] - flow->deficit - flow->cvars.dropping - flow->cvars.count - flow->cvars.p_drop - flow->cvars.blue_timer - flow->cvars.drop_next ==================== Link: https://patch.msgid.link/20260430061610.3503483-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 67dc6c56b871617deac85b9f72500b69b1fdf835 Author: Eric Dumazet Date: Thu Apr 30 06:16:10 2026 +0000 net/sched: sch_cake: annotate data-races in cake_dump_class_stats (II) cake_dump_class_stats() runs without qdisc spinlock being held. In this second patch, I add READ_ONCE()/WRITE_ONCE() annotations for: - flow->deficit - flow->cvars.dropping - flow->cvars.count - flow->cvars.p_drop - flow->cvars.blue_timer - flow->cvars.drop_next Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") Signed-off-by: Eric Dumazet Acked-by: Toke Høiland-Jørgensen Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260430061610.3503483-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 046111a1a35a1720748f254377d3d1663664ea61 Author: Eric Dumazet Date: Thu Apr 30 06:16:09 2026 +0000 net/sched: sch_cake: annotate data-races in cake_dump_class_stats (I) cake_dump_class_stats() runs without qdisc spinlock being held. In this first patch, I add READ_ONCE()/WRITE_ONCE() annotations for: - flow->head - flow->dropped - b->backlogs[] Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") Signed-off-by: Eric Dumazet Acked-by: Toke Høiland-Jørgensen Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260430061610.3503483-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3d3cf6a7314aca4df0a6dde28ce784a2a30d0166 Author: Jiexun Wang Date: Mon Apr 27 14:43:34 2026 +0800 batman-adv: stop tp_meter sessions during mesh teardown TP meter sessions remain linked on bat_priv->tp_list after the netlink request has already finished. When the mesh interface is removed, batadv_mesh_free() currently tears down the mesh without first draining these sessions. A running sender thread or a late incoming tp_meter packet can then keep processing against a mesh instance which is already shutting down. Synchronize tp_meter with the mesh lifetime by stopping all active sessions from batadv_mesh_free() and waiting for sender threads to exit before teardown continues. Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Co-developed-by: Luxing Yin Signed-off-by: Luxing Yin Signed-off-by: Jiexun Wang Signed-off-by: Ren Wei Signed-off-by: Sven Eckelmann commit 3243543592425beec83d453793e9d27caa0d8e66 Author: Jiexun Wang Date: Mon Apr 27 14:43:33 2026 +0800 batman-adv: reject new tp_meter sessions during teardown Prevent tp_meter from starting new sender or receiver sessions after mesh_state has left BATADV_MESH_ACTIVE. Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Co-developed-by: Luxing Yin Signed-off-by: Luxing Yin Signed-off-by: Jiexun Wang Signed-off-by: Ren Wei Signed-off-by: Sven Eckelmann commit 0799e5943611006b346b8813c7daf7dd5aa26bfd Author: Lyes Bourennani Date: Wed Apr 22 00:20:22 2026 +0200 batman-adv: fix integer overflow on buff_pos Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size check is done using the int type in batadv_iv_ogm_aggr_packet whereas the buff_pos variable uses the s16 type. This could lead to an out-of-bound read. Cc: stable@vger.kernel.org Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Lyes Bourennani Signed-off-by: Alexis Pinson Signed-off-by: Sven Eckelmann commit 66edb901bf874d9e0787326ba12d3548b2da8700 Merge: 4c2ed2a3dbda5c 5db6ef98477173 Author: Linus Torvalds Date: Sat May 2 12:31:43 2026 -0700 Merge tag 'v7.1-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: - Reject algorithms with authsizes that are too short in authencesn * tag 'v7.1-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: authencesn - reject short ahash digests during instance creation commit 4c2ed2a3dbda5cad4d7b2f5f394c91522abbaa92 Merge: f1a5e78a55ebf2 9e9354075d5a15 Author: Linus Torvalds Date: Sat May 2 12:25:57 2026 -0700 Merge tag 'ntfs-for-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs Pull ntfs fixes from Namjae Jeon: - Fix a NULL pointer dereference in ntfs_index_walk_down() by validating index block allocation - Fix a memory leak of the symlink target string in ntfs_reparse_set_wsl_symlink() during error paths - Prevent VCN overflow and validate lowest_vcn in ntfs_mapping_pairs_decompress() to avoid runlist corruption - Fix a page reference leak in ntfs_write_iomap_end_resident() when attribute search context allocation fails - Fix an invalid PTR_ERR() usage on a valid folio pointer in __ntfs_bitmap_set_bits_in_run() - Correct directory link counting by dropping nlink only when the MFT record link count reaches zero for WIN32/DOS aliases - Fix an uninitialized variable in ntfs_mapping_pairs_decompress() by returning an error pointer directly * tag 'ntfs-for-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: ntfs: Use return instead of goto in ntfs_mapping_pairs_decompress() ntfs: drop nlink once for WIN32/DOS aliases ntfs: fix invalid PTR_ERR() usage in __ntfs_bitmap_set_bits_in_run() ntfs: fix error handling in ntfs_write_iomap_end_resident() ntfs: fix VCN overflow in ntfs_mapping_pairs_decompress() ntfs: fix WSL symlink target leak on reparse failure ntfs: fix NULL dereference in ntfs_index_walk_down() commit 0c99acbc8b6c6dd526ae475a48ee1897b61072fb Author: Jason Gunthorpe Date: Tue Apr 28 13:17:48 2026 -0300 RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Sashiko points out that hns_roce_qp_remove() requires the caller to hold locks. The error flow in hns_roce_create_qp_common() doesn't hold those locks for the error unwind so it risks corrupting memory. Grab the same locks the other two callers use. Cc: stable@vger.kernel.org Fixes: e088a685eae9 ("RDMA/hns: Support rq record doorbell for the user space") Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=9 Link: https://patch.msgid.link/r/15-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Reviewed-by: Junxian Huang Signed-off-by: Jason Gunthorpe commit 7d51783d82fea000a9ce96fa1dcf3e0a8cedc4fb Author: Jason Gunthorpe Date: Tue Apr 28 13:17:47 2026 -0300 RDMA/hns: Fix xarray race in hns_roce_create_qp_common() Similar to the SRQ case the hr_qp is stored in the xarray before it is fully initialized. Unlike the SRQ case the error unwinds do not wait for the completion so keep the refcount 0 until the function succeeds. Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Link: https://patch.msgid.link/r/14-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Suggested-by: Junxian Huang Reviewed-by: Junxian Huang Signed-off-by: Jason Gunthorpe commit 48973c6c938737bb900d15dc82b91dfe3586cb0f Author: Jason Gunthorpe Date: Tue Apr 28 13:17:46 2026 -0300 RDMA/hns: Fix xarray race in hns_roce_create_srq() Sashiko points out that once the srq memory is stored into the xarray by alloc_srqc() it can immediately be looked up by: xa_lock(&srq_table->xa); srq = xa_load(&srq_table->xa, srqn & (hr_dev->caps.num_srqs - 1)); if (srq) refcount_inc(&srq->refcount); xa_unlock(&srq_table->xa); Which will fail refcount debug because the refcount is 0 and then crash: srq->event(srq, event_type); Because event is NULL. Use refcount_inc_not_zero() instead to ensure a partially prepared srq is never retrieved from the event handler and fix the ordering of the initialization so refcount becomes 1 only after it is fully ready. All the initialization must be done before calling free_srqc() since it depends on the completion and refcount. Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Link: https://sashiko.dev/#/patchset/0-v1-e911b76a94d1%2B65d95-rdma_udata_rep_jgg%40nvidia.com?part=3 Link: https://patch.msgid.link/r/13-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Reviewed-by: Junxian Huang Signed-off-by: Jason Gunthorpe commit c9341307ea16b9395c2e4c9c94d8499d91fe31d0 Author: Jason Gunthorpe Date: Tue Apr 28 13:17:45 2026 -0300 RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within the RCU critical section. It also will crash if an event is delivered before the srq object is finished initializing. Use the spinlock since it isn't easy to make RCU work, use refcount_inc_not_zero() to protect against partially initialized objects, and order the refcount_set() to be after the srq is fully initialized. Cc: stable@vger.kernel.org Fixes: 30353bfc43a1 ("net/mlx4_core: Use RCU to perform radix tree lookup for SRQ") Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=5 Link: https://patch.msgid.link/r/12-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Signed-off-by: Jason Gunthorpe commit c54c7e4cb679c0aaa1cb489b9c3f2cd98e63a44c Author: Jason Gunthorpe Date: Tue Apr 28 13:17:44 2026 -0300 RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Sashiko points out that mlx4_srq_alloc() was not undone during error unwind, add the missing call to mlx4_srq_free(). Cc: stable@vger.kernel.org Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters") Link: https://sashiko.dev/#/patchset/0-v1-e911b76a94d1%2B65d95-rdma_udata_rep_jgg%40nvidia.com?part=8 Link: https://patch.msgid.link/r/11-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Signed-off-by: Jason Gunthorpe commit e38e86995df27f1f854063dab1f0c6a513db3faf Author: Jason Gunthorpe Date: Tue Apr 28 13:17:43 2026 -0300 RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before triggers a double free. Cc: stable@vger.kernel.org Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver") Link: https://sashiko.dev/#/patchset/0-v1-e911b76a94d1%2B65d95-rdma_udata_rep_jgg%40nvidia.com?part=4 Link: https://patch.msgid.link/r/10-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Signed-off-by: Jason Gunthorpe commit 34fbf48cf3b410d2a6e8c586fa952a36331ca5ba Author: Jason Gunthorpe Date: Tue Apr 28 13:17:42 2026 -0300 RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Sashiko points out that pd->uctx isn't initialized until late in the function so all these error flow references are NULL and will crash. Use the uctx that isn't NULL. Cc: stable@vger.kernel.org Fixes: fe2caefcdf58 ("RDMA/ocrdma: Add driver for Emulex OneConnect IBoE RDMA adapter") Link: https://sashiko.dev/#/patchset/0-v1-e911b76a94d1%2B65d95-rdma_udata_rep_jgg%40nvidia.com?part=4 Link: https://patch.msgid.link/r/9-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Signed-off-by: Jason Gunthorpe commit ea4e4b168a531c522d2850719816b6f583b1738b Author: Jason Gunthorpe Date: Tue Apr 28 13:17:41 2026 -0300 RDMA/ocrdma: Clarify the mm_head searching The intention of this code is to find matching entries exactly, the driver never creates phys_addr's with different lens so the current expression is not a bug, but it doesn't make sense and confuses review tooling. Search for exact match instead. Link: https://sashiko.dev/#/patchset/0-v1-e911b76a94d1%2B65d95-rdma_udata_rep_jgg%40nvidia.com?part=4 Link: https://patch.msgid.link/r/8-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Signed-off-by: Jason Gunthorpe commit 6aaa978c6b6218cfac15fe1dab17c76fe229ce3f Author: Jason Gunthorpe Date: Tue Apr 28 13:17:40 2026 -0300 RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Sashiko points out that mana_ib_cfg_vport_steering() is leaked, the normal destroy path cleans it up. Cc: stable@vger.kernel.org Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") Link: https://sashiko.dev/#/patchset/0-v1-e911b76a94d1%2B65d95-rdma_udata_rep_jgg%40nvidia.com?part=4 Link: https://patch.msgid.link/r/7-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Reviewed-by: Long Li Signed-off-by: Jason Gunthorpe commit 34ecf795692ee57c393109f4a24ccc313091e137 Author: Jason Gunthorpe Date: Tue Apr 28 13:17:39 2026 -0300 RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Sashiko points out there are two bugs here in the error unwind flow, both related to how the WQ table is unwound. First there is a double i-- on the first failure path due to the while loop having a i--, remove it. Second if mana_ib_install_cq_cb() fails then mana_create_wq_obj() is not undone due to the above i--. Cc: stable@vger.kernel.org Fixes: c15d7802a424 ("RDMA/mana_ib: Add CQ interrupt support for RAW QP") Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=1 Link: https://patch.msgid.link/r/6-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Reviewed-by: Long Li Signed-off-by: Jason Gunthorpe commit 159f2efabc89d3f931d38f2d35876535d4abf0a3 Author: Jason Gunthorpe Date: Tue Apr 28 13:17:38 2026 -0300 RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WARN_ON() then go on to corrupt the kernel. Just reject it outright and fail the QP creation. Cc: stable@vger.kernel.org Fixes: c15d7802a424 ("RDMA/mana_ib: Add CQ interrupt support for RAW QP") Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=1 Link: https://patch.msgid.link/r/5-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Reviewed-by: Long Li Signed-off-by: Jason Gunthorpe commit 6dd2d4ad9c8429523b1c220c5132bd551c006425 Author: Jason Gunthorpe Date: Tue Apr 28 13:17:37 2026 -0300 RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds check it so the memcpy cannot overflow. Cc: stable@vger.kernel.org Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=1 Link: https://patch.msgid.link/r/4-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Reviewed-by: Long Li Signed-off-by: Jason Gunthorpe commit 45e8ebc9ede73543c55d597bb53b6bbb7e8b7327 Author: Jason Gunthorpe Date: Tue Apr 28 13:17:36 2026 -0300 RDMA/mlx5: Add missing store/release for lock elision pattern mlx5 has a common pattern implementing a device-global singleton resource where it checks the resource pointer for !NULL and then skips obtaining the lock. This is not ordered properly as observing !NULL doesn't mean that all the data under that pointer is also visible on this CPU when the lock is not taken. Use a release/acquire pairing to explicitly manage this. Pointed out by sashiko, Codex found more cases. Fixes: 5895e70f2e6e ("IB/mlx5: Allocate resources just before first QP/SRQ is created") Fixes: 638420115cc4 ("IB/mlx5: Create UMR QP just before first reg_mr occurs") Link: https://sashiko.dev/#/patchset/SYBPR01MB7881E1E0970268BD69C0BA75AF2B2%40SYBPR01MB7881.ausprd01.prod.outlook.com Link: https://patch.msgid.link/r/3-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Assisted-by: Codex:GPT-5.5 Signed-off-by: Jason Gunthorpe commit 641858d52f2372124d9312a407e2124915d846ee Author: Jason Gunthorpe Date: Tue Apr 28 13:17:35 2026 -0300 RDMA/mlx5: Restore zero-init to mlx5_ib_modify_qp() ucmd Sashiko points out the check for inlen==0 got missed, the ={} was not redundant, put it back. Fixes: a9cd442a5347 ("RDMA: Remove redundant = {} for udata req structs") Link: https://patch.msgid.link/r/2-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Signed-off-by: Jason Gunthorpe commit 70f780edcd1e86350202d8a409de026b2d2e2067 Author: Jason Gunthorpe Date: Tue Apr 28 13:17:34 2026 -0300 RDMA/ionic: Fix typo in format string Applying the corrupted patch by hand mangled the format string, put the s in the right place. Cc: stable@vger.kernel.org Fixes: 654a27f25530 ("RDMA/ionic: bound node_desc sysfs read with %.64s") Link: https://patch.msgid.link/r/1-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Reported-by: Brad Spengler Signed-off-by: Jason Gunthorpe commit 1d324c2f43f70c965f25c58cc3611c779adbe47e Author: Maoyi Xie Date: Thu Apr 30 18:33:18 2026 +0800 ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns ip6gre hash via link_net. ip6erspan_changelink() was not converted in that series and still uses dev_net(dev), which diverges from the device's creation netns after IFLA_NET_NS_FD migration. This re-inserts the tunnel into the wrong per-netns hash. The original netns keeps a stale entry. When that netns is later destroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a slab-use-after-free reported by KASAN, followed by a kernel BUG at net/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify(). Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). ip6gre_changelink() earlier in the same file already uses the cached t->net; only ip6erspan_changelink() has the wrong shape. Fixes: 2d665034f239 ("net: ip6_gre: Fix ip6erspan hlen calculation") Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Maoyi Xie Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260430103318.3206018-1-maoyi.xie@ntu.edu.sg Signed-off-by: Jakub Kicinski commit 386829cd895b985b410f85253b1a7247a38148c2 Merge: 383d0fb8946921 3a3a30c14d7f04 Author: Jakub Kicinski Date: Sat May 2 10:20:58 2026 -0700 Merge branch 'replace-direct-dequeue-call-with-qdisc_dequeue_peeked' Jamal Hadi Salim says: ==================== Replace direct dequeue call with qdisc_dequeue_peeked When sfb and red qdiscs have children (eg qfq qdisc) whose peek() callback is qdisc_peek_dequeued(), we could get a kernel panic. When the parent of such qdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from its child (red/sfb in this case), it will do the following: 1a. do a peek() - and when sensing there's an skb the child can offer, then - the child in this case(red/sfb) calls its child's (qfq) peek. qfq does the right thing and will return the gso_skb queue packet. Note: if there wasnt a gso_skb entry then qfq will store it there. 1b. invoke a dequeue() on the child (red/sfb). And herein lies the problem. - red/sfb will call the child's dequeue() which will essentially just try to grab something of qfq's queue. The right thing to do in #1b is to grab the skb off gso_skb queue. This patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked() method instead. Patch 1 fixes the issue for red qdisc. Patch 2 fixes it for sfb. Patch 3 adds testcases for the two setups. ==================== Link: https://patch.msgid.link/20260430152957.194015-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 3a3a30c14d7f04206916824a79878cfefac6c8e2 Author: Victor Nogueira Date: Thu Apr 30 11:29:57 2026 -0400 selftests/tc-testing: Add tests that force red and sfb to dequeue from child's gso_skb Create 4 test cases: - Force red to dequeue from its child's gso_skb with qfq leaf - Force sfb to dequeue from its child's gso_skb with qfq leaf - Force red to dequeue from its child's gso_skb with dualpi2 leaf - Force sfb to dequeue from its child's gso_skb with dualpi2 leaf All of them have tbf followed by red (or sfb) followed by qfq (or dualpi2). Since tbf calls its child's peek followed by qdisc_dequeue_peeked, it will force red/sfb to call their child's peek. In this case, since the child (qfq/dualpi2) has qdisc_peek_dequeued as its peek callback, the packet will be stored in its gso_skb queue. During the subsequent call to qdisc_dequeue_peeked, red/sfb will have to dequeue from the child's gso_skb to retrieve the packet. Not doing so will cause a NULL ptr deref which was happening before a recent fix. Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20260430152957.194015-4-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 1b9bc71153b01dbde8045b9edede4240f4f5520e Author: Victor Nogueria Date: Thu Apr 30 11:29:56 2026 -0400 net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked When sfb has children (eg qfq qdisc) whose peek() callback is qdisc_peek_dequeued(), we could get a kernel panic. When the parent of such qdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from its child (sfb in this case), it will do the following: 1a. do a peek() - and when sensing there's an skb the child can offer, then - the child in this case(sfb) calls its child's (qfq) peek. qfq does the right thing and will return the gso_skb queue packet. Note: if there wasnt a gso_skb entry then qfq will store it there. 1b. invoke a dequeue() on the child (sfb). And herein lies the problem. - sfb will call the child's dequeue() which will essentially just try to grab something of qfq's queue. [ 127.594489][ T453] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f] [ 127.594741][ T453] CPU: 2 UID: 0 PID: 453 Comm: ping Not tainted 7.1.0-rc1-00035-gac961974495b-dirty #793 PREEMPT(full) [ 127.595059][ T453] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 127.595254][ T453] RIP: 0010:qfq_dequeue+0x35c/0x1650 [sch_qfq] [ 127.595461][ T453] Code: 00 fc ff df 80 3c 02 00 0f 85 17 0e 00 00 4c 8d 73 48 48 89 9d b8 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 76 0c 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b [ 127.596081][ T453] RSP: 0018:ffff88810e5af440 EFLAGS: 00010216 [ 127.596337][ T453] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000 [ 127.596623][ T453] RDX: 0000000000000009 RSI: 0000001880000000 RDI: ffff888104fd82b0 [ 127.596917][ T453] RBP: ffff888104fd8000 R08: ffff888104fd8280 R09: 1ffff110211893a3 [ 127.597165][ T453] R10: 1ffff110211893a6 R11: 1ffff110211893a7 R12: 0000001880000000 [ 127.597404][ T453] R13: ffff888104fd82b8 R14: 0000000000000048 R15: 0000000040000000 [ 127.597644][ T453] FS: 00007fc380cbfc40(0000) GS:ffff88816f2a8000(0000) knlGS:0000000000000000 [ 127.597956][ T453] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 127.598160][ T453] CR2: 00005610aa9890a8 CR3: 000000010369e000 CR4: 0000000000750ef0 [ 127.598390][ T453] PKRU: 55555554 [ 127.598509][ T453] Call Trace: [ 127.598629][ T453] [ 127.598718][ T453] ? mark_held_locks+0x40/0x70 [ 127.598890][ T453] ? srso_alias_return_thunk+0x5/0xfbef5 [ 127.599053][ T453] sfb_dequeue+0x88/0x4d0 [ 127.599174][ T453] ? ktime_get+0x137/0x230 [ 127.599328][ T453] ? srso_alias_return_thunk+0x5/0xfbef5 [ 127.599480][ T453] ? qdisc_peek_dequeued+0x7b/0x350 [sch_qfq] [ 127.599670][ T453] ? srso_alias_return_thunk+0x5/0xfbef5 [ 127.599831][ T453] tbf_dequeue+0x6b1/0x1098 [sch_tbf] [ 127.599988][ T453] __qdisc_run+0x169/0x1900 The right thing to do in #1b is to grab the skb off gso_skb queue. This patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked() method instead. Fixes: e13e02a3c68d ("net_sched: SFB flow scheduler") Signed-off-by: Victor Nogueria Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260430152957.194015-3-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 458d5615272d3de535748342eb68ca492343048c Author: Jamal Hadi Salim Date: Thu Apr 30 11:29:55 2026 -0400 net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked When red qdisc has children (eg qfq qdisc) whose peek() callback is qdisc_peek_dequeued(), we could get a kernel panic. When the parent of such qdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from its child (red in this case), it will do the following: 1a. do a peek() - and when sensing there's an skb the child can offer, then - the child in this case(red) calls its child's (qfq) peek. qfq does the right thing and will return the gso_skb queue packet. Note: if there wasnt a gso_skb entry then qfq will store it there. 1b. invoke a dequeue() on the child (red). And herein lies the problem. - red will call the child's dequeue() which will essentially just try to grab something of qfq's queue. [ 78.667668][ T363] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f] [ 78.667927][ T363] CPU: 1 UID: 0 PID: 363 Comm: ping Not tainted 7.1.0-rc1-00033-g46f74a3f7d57-dirty #790 PREEMPT(full) [ 78.668263][ T363] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 78.668486][ T363] RIP: 0010:qfq_dequeue+0x446/0xc90 [sch_qfq] [ 78.668718][ T363] Code: 54 c0 e8 dd 90 00 f1 48 c7 c7 e0 03 54 c0 48 89 de e8 ce 90 00 f1 48 8d 7b 48 b8 ff ff 37 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 <80> 3c 02 00 74 05 e8 ef a1 e1 f1 48 8b 7b 48 48 8d 54 24 58 48 8d [ 78.669312][ T363] RSP: 0018:ffff88810de573e0 EFLAGS: 00010216 [ 78.669533][ T363] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 78.669790][ T363] RDX: 0000000000000009 RSI: 0000000000000004 RDI: 0000000000000048 [ 78.670044][ T363] RBP: ffff888110dc4000 R08: ffffffffb1b0885a R09: fffffbfff6ba9078 [ 78.670297][ T363] R10: 0000000000000003 R11: ffff888110e31c80 R12: 0000001880000000 [ 78.670560][ T363] R13: ffff888110dc4150 R14: ffff888110dc42b8 R15: 0000000000000200 [ 78.670814][ T363] FS: 00007f66a8f09c40(0000) GS:ffff888163428000(0000) knlGS:0000000000000000 [ 78.671110][ T363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 78.671324][ T363] CR2: 000055db4c6a30a8 CR3: 000000010da67000 CR4: 0000000000750ef0 [ 78.671585][ T363] PKRU: 55555554 [ 78.671713][ T363] Call Trace: [ 78.671843][ T363] [ 78.671936][ T363] ? __pfx_qfq_dequeue+0x10/0x10 [sch_qfq] [ 78.672148][ T363] ? __pfx__printk+0x10/0x10 [ 78.672322][ T363] ? srso_alias_return_thunk+0x5/0xfbef5 [ 78.672496][ T363] ? lockdep_hardirqs_on_prepare+0xa8/0x1a0 [ 78.672706][ T363] ? srso_alias_return_thunk+0x5/0xfbef5 [ 78.672875][ T363] ? trace_hardirqs_on+0x19/0x1a0 [ 78.673047][ T363] red_dequeue+0x65/0x270 [sch_red] [ 78.673217][ T363] ? srso_alias_return_thunk+0x5/0xfbef5 [ 78.673385][ T363] tbf_dequeue.cold+0xb0/0x70c [sch_tbf] [ 78.673566][ T363] __qdisc_run+0x169/0x1900 The right thing to do in #1b is to grab the skb off gso_skb queue. This patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked() method instead. Fixes: 77be155cba4e ("pkt_sched: Add peek emulation for non-work-conserving qdiscs.") Reported-by: Manas Reported-by: Rakshit Awasthi Signed-off-by: Jamal Hadi Salim Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260430152957.194015-2-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 383d0fb8946921b4914ea0f360342e221d419d40 Author: Gregory Fuchedgi Date: Wed Apr 29 14:54:14 2026 -0700 amd-xgbe: fix PTP addend overflow causing frozen clock XGBE_PTP_ACT_CLK_FREQ and XGBE_V2_PTP_ACT_CLK_FREQ were 10x too large (500MHz/1GHz instead of 50MHz/100MHz), causing the computed addend to overflow the 32-bit tstamp_addend. In the general case this would result in the clock advancing at the wrong rate. For v2 (PCI), ptpclk_rate is hardcoded to 125MHz, so the addend formula (ACT_CLK_FREQ << 32) / ptpclk_rate yields exactly 8 * 2^32, and when stored to the 32-bit tstamp_addend the value is zero. With addend = 0 the hardware accumulator never overflows and the PTP clock is fully stopped. For v1 (platform), ptpclk_rate is read from ACPI/DT so the exact overflow behavior depends on the firmware-reported frequency. Define the constants as NSEC_PER_SEC / SSINC so the relationship is explicit and cannot drift out of sync. Fixes: fbd47be098b5 ("amd-xgbe: add hardware PTP timestamping support") Tested-by: Gregory Fuchedgi Signed-off-by: Gregory Fuchedgi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260429-fix-xgbe-ptp-addend-v1-1-fca5b0ca5e62@gmail.com Signed-off-by: Jakub Kicinski commit 851bba8068d15f5a386da544096f7ed6bc16e551 Author: Holger Brunck Date: Wed Apr 29 13:42:08 2026 +0200 net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove If the driver is used in a non tdm mode priv->utdm is a NULL pointer. Therefore we need to check this pointer first before checking si_regs. Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC") Signed-off-by: Holger Brunck Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 1a57efe250a13906396c2a4792f0090f142f9844 Author: Holger Brunck Date: Wed Apr 29 13:42:07 2026 +0200 net: wan: fsl_ucc_hdlc: fix uhdlc_memclean Unmapping of uf_regs is done from ucc_fast_free and doesn't need to be done explicitly. If already unmapped ucc_fast_free will crash. Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC") Signed-off-by: Holger Brunck Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit ddca6da148b8ced3e6d3d7fb3b2e5b4ed6359dc2 Author: Maciej W. Rozycki Date: Mon Apr 27 11:23:35 2026 +0100 MAINTAINERS: Add self for the DEC LANCE network driver Like with the rest of DECstation and TURBOchannel hardware I have been handling the DEC LANCE network driver for some 25 years now anyway. Signed-off-by: Maciej W. Rozycki Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/alpine.DEB.2.21.2604271113520.28583@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit 0c7ae130698e70107430254e79fbe996b4d37ab5 Author: Paul Chaignon Date: Sat May 2 12:12:40 2026 +0200 tools/headers: Regenerate stddef.h to fix BPF selftests With commit dacbfc167808 ("crypto: af_alg - Annotate struct af_alg_iv with __counted_by"), two selftests, test_tag and crypto_sanity, now indirectly rely on the __counted_by macro. On systems with commit dacbfc167808 in the installed UAPI headers, the selftests build fails with: In file included from tools/testing/selftests/bpf/prog_tests/crypto_sanity.c:7: /usr/include/linux/if_alg.h:45:22: error: expected ‘:’, ‘,’, ‘;’, ‘}’ or ‘__attribute__’ before ‘__counted_by’ 45 | __u8 iv[] __counted_by(ivlen); | ^~~~~~~~~~~~ This patch fixes it by regenerating stddef.h in tools/include using the instructions from commit a778f5d46b62 ("tools/headers: Pull in stddef.h to uapi to fix BPF selftests build in CI"). Fixes: dacbfc167808 ("crypto: af_alg - Annotate struct af_alg_iv with __counted_by") Signed-off-by: Paul Chaignon Reviewed-by: Alan Maguire Tested-by: Ihor Solodrai Link: https://lore.kernel.org/r/8da8ef16055aa452d940668ed5359ce54adc6b0b.1777715500.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit db909bd7986c10da074917af3dae83a60fa65093 Author: Guo Ren (Alibaba DAMO Academy) Date: Sun Jan 25 00:52:12 2026 -0500 riscv: mm: Fixup no5lvl failure when vaddr is invalid Unlike no4lvl, no5lvl still continues to detect satp, which requires va=pa mapping. When pa=0x800000000000, no5lvl would fail in Sv48 mode due to an illegal VA value of 0x800000000000. So, prevent detecting the satp flow for no5lvl, when vaddr is invalid. Add the is_vaddr_valid() function for checking. Fixes: 26e7aacb83df ("riscv: Allow to downgrade paging mode from the command line") Cc: Alexandre Ghiti Cc: Björn Töpel Signed-off-by: Guo Ren (Alibaba DAMO Academy) Tested-by: Fangyu Yu Link: https://patch.msgid.link/20260125055212.433163-1-guoren@kernel.org [pjw@kernel.org: cleaned up commit message] Signed-off-by: Paul Walmsley commit 6ebcbb53fc9bc30843054ed99fd60b8e542628f4 Author: Michael Neuling Date: Fri May 1 06:23:20 2026 +0000 riscv: Fix register corruption from uninitialized cregs on error compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its register state and potentially leaking kernel stack contents. compat_restore_sigcontext() has the same issue: it calls cregs_to_regs() even when __copy_from_user() fails, leading to the same corruption of the signal-returning task's register state on error. Only call cregs_to_regs() when the user copy succeeds. Fixes: 4608c159594f ("riscv: compat: ptrace: Add compat_arch_ptrace implement") Fixes: 7383ee05314b ("riscv: compat: signal: Add rt_frame implementation") Signed-off-by: Michael Neuling Assisted-by: Cursor:claude-4.6-opus-high-thinking Link: https://patch.msgid.link/20260501062320.2339562-1-mikey@neuling.org Signed-off-by: Paul Walmsley commit 996454bc0da84d5a1dedb1a7861823087e01a7ae Author: Shota Zaizen Date: Tue Apr 28 19:02:55 2026 +0900 ksmbd: validate inherited ACE SID length smb_inherit_dacl() walks the parent directory DACL loaded from the security descriptor xattr. It verifies that each ACE contains the fixed SID header before using it, but does not verify that the variable-length SID described by sid.num_subauth is fully contained in the ACE. A malformed inheritable ACE can advertise more subauthorities than are present in the ACE. compare_sids() may then read past the ACE. smb_set_ace() also clamps the copied destination SID, but used the unchecked source SID count to compute the inherited ACE size. That could advance the temporary inherited ACE buffer pointer and nt_size accounting past the allocated buffer. Fix this by validating the parent ACE SID count and SID length before using the SID during inheritance. Compute the inherited ACE size from the copied SID so the size matches the bounded destination SID. Reject the inherited DACL if size accumulation would overflow smb_acl.size or the security descriptor allocation size. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: Shota Zaizen Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6fd7dd4e44d7840cb1ba0c3a895e9f576af3fe5c Author: Namjae Jeon Date: Fri May 1 08:34:55 2026 +0900 ksmbd: fix kernel-doc warnings from ksmbd_conn_get/put() The kernel test robot reported W=1 build warnings for ksmbd_conn_get() and ksmbd_conn_put() due to missing parameter descriptions. Add the @conn description to fix these warnings. Reported-by: kernel test robot Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit a74668eb2c0b866d7ac4823be6006ab2e227bc03 Author: Shuhao Fu Date: Wed Apr 29 16:59:56 2026 +0800 ksmbd: fail share config requests when path allocation fails Non-pipe shares must have a duplicated backing path before they can be published. share_config_request() currently calls kstrndup() for that path, but if the allocation fails it leaves ret unchanged. If veto list parsing succeeds and share->name exists, the partially built share is still inserted into the global share table with share->path left NULL. A later share-root SMB2 create uses tree_conn->share_conf->path as the lookup root. If the share was published with path == NULL, that request passes a NULL pathname into do_getname_kernel()/strlen() and can crash the ksmbd worker. Set ret = -ENOMEM when path duplication fails so the incomplete share is destroyed before publication. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: Shuhao Fu Acked-by: Namjae Jeon Signed-off-by: Steve French commit bf736184d063da1a552ffeff0481813599a182cc Author: DaeMyung Kang Date: Tue Apr 28 23:08:56 2026 +0900 ksmbd: close durable scavenger races against m_fp_list lookups ksmbd_durable_scavenger() has two related races against any walker that iterates f_ci->m_fp_list, including ksmbd_lookup_fd_inode() (used by ksmbd_vfs_rename) and the share-mode checks in fs/smb/server/smb_common.c. (1) fp->node list-head reuse. Durable-preserved handles can remain linked on f_ci->m_fp_list after session teardown so share-mode checks still see them while the handle is reconnectable. The scavenger collected expired handles by adding fp->node to a local scavenger_list after removing them from the global durable idr. Because fp->node is the same list_head used by m_fp_list, list_add(&fp->node, &scavenger_list) overwrites the m_fp_list links and corrupts both lists. CONFIG_DEBUG_LIST can report this on the share-mode walk path. (2) Refcount race against m_fp_list walkers. The scavenger qualifies an expired durable handle with atomic_read(&fp->refcount) > 1 and fp->conn under global_ft.lock, removes fp from global_ft, then drops global_ft.lock before unlinking fp from m_fp_list and freeing it. During that gap fp is still linked on m_fp_list with f_state == FP_INITED. ksmbd_lookup_fd_inode() under m_lock read calls ksmbd_fp_get() (atomic_inc_not_zero on refcount that is still 1) and takes a live reference; the scavenger then unlinks and frees fp while the holder owns a reference, leading to UAF on the holder's subsequent ksmbd_fd_put() and on any field reads performed by a concurrent share-mode walker that iterates m_fp_list without taking ksmbd_fp_get() (smb_check_perm_dleases-like paths). Fix both: * Stop reusing fp->node as a scavenger-private list node. Remove one expired handle from global_ft under global_ft.lock, take an explicit transient reference, drop the lock, unlink fp->node from m_fp_list under f_ci->m_lock, then drop both the durable lifetime and transient references with atomic_sub_and_test(2, &fp->refcount). If the scavenger is the last putter the close runs there; otherwise an in-flight holder that already raced through the m_fp_list lookup owns the final close via its ksmbd_fd_put() path. The one-at-a-time disposal can rescan the durable idr when multiple handles expire in the same pass, but durable scavenging is a background expiration path and the final full scan recomputes min_timeout before the next wait. * Clear fp->persistent_id inside __ksmbd_remove_durable_fd() right after idr_remove(), so a delayed final close from a holder that snatched fp does not re-issue idr_remove() on a persistent id that idr_alloc_cyclic() in ksmbd_open_durable_fd() may have already handed out to a brand-new durable handle. * Bypass the per-conn open_files_count decrement in __put_fd_final() when fp is detached from any session table (fp->conn cleared by session_fd_check() at durable preserve -- paired with the volatile_id clear at unpublish, so checking fp->conn alone is sufficient). The walker that owns the final close runs from an unrelated work->conn whose stats.open_files_count never tracked this durable fp; without this guard the holder would underflow that unrelated counter. The two races are folded into one patch because patch (1) alone cleans up the corrupted list but leaves a deterministic UAF window for m_fp_list walkers that the transient-reference and persistent_id discipline in (2) close; bisecting onto an intermediate state would land on a UAF that pre-patch chaos merely made less reproducible. Validation: * CONFIG_DEBUG_LIST coverage for the list_head reuse path. * KASAN-enabled direct SMB2 durable-handle coverage that exercised ksmbd_durable_scavenger() and non-NULL ksmbd_lookup_fd_inode() returns while durable handles expired under concurrent rename lookups, with no KASAN, UAF, list-corruption, ODEBUG, or WARNING reports. * checkpatch --strict * make -j$(nproc) M=fs/smb/server Fixes: d484d621d40f ("ksmbd: add durable scavenger timer") Signed-off-by: DaeMyung Kang Acked-by: Namjae Jeon Signed-off-by: Steve French commit a42896bebfcc287ed1e61d820a888e33b1eb80ce Author: DaeMyung Kang Date: Tue Apr 28 23:08:55 2026 +0900 ksmbd: harden file lifetime during session teardown __close_file_table_ids() is the per-session teardown that closes every fp belonging to a session (or to one tree connect on that session) by walking the session's volatile-id idr. The current loop has three related problems on busy or racing workloads: * Sleeping under ft->lock. The session-teardown skip callback, session_fd_check(), already sleeps in ksmbd_vfs_copy_durable_owner() -> kstrdup(GFP_KERNEL) and down_write(&fp->f_ci->m_lock) (a rw_semaphore). Running the callback inside write_lock(&ft->lock) trips CONFIG_DEBUG_ATOMIC_SLEEP / CONFIG_PROVE_LOCKING on a durable-fd workload. * Refcount accounting blind to f_state. The unconditional atomic_dec_and_test(&fp->refcount) does not distinguish FP_INITED (idr-owned reference still intact) from FP_CLOSED (an earlier ksmbd_close_fd() already consumed the idr-owned reference while leaving fp in the idr because a holder kept refcount non-zero). When the latter races with teardown the same path over-decrements into a holder reference and ksmbd_fd_put() later UAFs that holder. * FP_NEW window. Between __open_id() publishing fp into the session idr and ksmbd_update_fstate(..., FP_INITED) committing the transition at the end of smb2_open(), an fp is in FP_NEW and an intervening teardown that takes a transient reference and unpublishes the volatile id leaves the original idr-owned reference orphaned -- the opener is unaware that fp has been unpublished, returns success to the client, and the fp leaks at refcount = 1. Refactor __close_file_table_ids() to take a transient reference on fp and unpublish fp from the session idr *under ft->lock* before calling skip() outside the lock. A transient ref protects lifetime but not concurrent field mutation, so the idr_remove() is what keeps __ksmbd_lookup_fd() through this session's idr from granting a new ksmbd_fp_get() reference to an fp whose fp->conn / fp->tcon / fp->volatile_id / op->conn / lock_list links are about to be rewritten by session_fd_check(). Durable reconnect is unaffected because it reaches fp through the global durable table (ksmbd_lookup_durable_fd -> global_ft). Decide n_to_drop together with any FP_INITED -> FP_CLOSED transition under ft->lock so teardown and ksmbd_close_fd() never both consume the idr-owned reference. See ksmbd_mark_fp_closed() for the per-state accounting. For the FP_NEW path to be safe, the opener has to learn that fp was unpublished: ksmbd_update_fstate() now returns -ENOENT when an FP_NEW -> FP_INITED transition finds f_state already advanced or the volatile id cleared (both committed by teardown under ft->lock); smb2_open() propagates that as STATUS_OBJECT_NAME_INVALID and drops the original reference via ksmbd_fd_put(). The list removal cannot be left for a deferred final putter because fp->volatile_id has already been cleared and __ksmbd_remove_fd() will intentionally skip both idr_remove() and list_del_init(). Move the m_fp_list unlink in __ksmbd_remove_fd() above the volatile-id check so that an FP_NEW fp that happened to be added to m_fp_list (smb2_open() adds fp->node before ksmbd_update_fstate() runs) is still cleaned up on the deferred putter path; list_del_init() on an empty node is a no-op and remains safe for fps that were never added. Add a defensive guard in session_fd_check() that refuses non-FP_INITED fps so that even if a teardown reaches an FP_NEW fp it falls into the close branch (where the n_to_drop = 1 accounting keeps the opener's reference alive) instead of the durable-preserve branch (which mutates fp->conn / fp->tcon). Validation on a debug kernel additionally built with CONFIG_DEBUG_LIST and CONFIG_DEBUG_OBJECTS_WORK used a same-session two-tcon workload (open/write storm on one tcon, 50 tree disconnects on the other) and reported no list-corruption, work_struct ODEBUG, sleep-in-atomic, lockdep or kmemleak reports. Reverting only the __close_file_table_ids() hunk while keeping a forced-is_reconnectable() harness produced the expected sleep-in-atomic at vfs_cache.c:1095, confirming the ft->lock-out-of-sleepable-skip discipline. KASAN-enabled direct SMB2 coverage with durable handles enabled exercised ksmbd_close_tree_conn_fds(), ksmbd_close_session_fds(), the FP_NEW failure path, tree_conn_fd_check(), and a non-zero session_fd_check() durable-preserve return. This produced no KASAN, DEBUG_LIST, ODEBUG, or WARNING reports. Fixes: f44158485826 ("cifsd: add file operations") Signed-off-by: DaeMyung Kang Acked-by: Namjae Jeon Signed-off-by: Steve French commit b1f1e80620deb49daf63c2e677046599b693dc1f Author: DaeMyung Kang Date: Tue Apr 28 23:08:54 2026 +0900 ksmbd: centralize ksmbd_conn final release to plug transport leak ksmbd_conn_free() is one of four sites that can observe the last refcount drop of a struct ksmbd_conn. The other three fs/smb/server/connection.c ksmbd_conn_r_count_dec() fs/smb/server/oplock.c __free_opinfo() fs/smb/server/vfs_cache.c session_fd_check() end the conn with a bare kfree(), skipping ida_destroy(&conn->async_ida) and conn->transport->ops->free_transport(conn->transport). Whenever one of them is the last putter, the embedded async_ida and the entire transport struct leak -- for TCP, that is also the struct socket and the kvec iov. __free_opinfo() being a final putter is not theoretical. opinfo_put() queues the callback via call_rcu(&opinfo->rcu, free_opinfo_rcu), so ksmbd_server_terminate_conn() can deposit N opinfo releases in RCU and have ksmbd_conn_free() run in the handler thread before any of them fire. ksmbd_conn_free() then observes refcnt > 0 and short-circuits; the last RCU-delivered __free_opinfo() falls onto its bare kfree(conn) branch and the transport is lost. A/B validation in a QEMU/virtme guest, mounting //127.0.0.1/testshare: each iteration holds 8 files open via sleep processes, force-closes TCP with "ss -K sport = :445", kills the holders, lazy-umounts; repeated 10 times, then ksmbd shutdown and kmemleak scan. state conn_alloc conn_free tcp_free opi_rcu kmemleak ---------- ---------- --------- -------- ------- -------- pre-patch 20 20 10 160 7 with patch 20 20 20 160 0 Pre-patch conn_free=20 with tcp_free=10 directly demonstrates the bare-kfree paths skipping transport cleanup; kmemleak backtraces point into struct tcp_transport / iov. With this patch tcp_free matches conn_free at 20/20 and kmemleak is clean. Move the per-struct final release into __ksmbd_conn_release_work() and route the three bare-kfree final-put sites through a new ksmbd_conn_put(). Those sites now pair ida_destroy() and free_transport() with kfree(conn) regardless of which holder happens to release the last reference. stop_sessions() only triggers the transport shutdown and does not itself drop the last conn reference, so it is unaffected. The centralized release reaches sock_release() -> tcp_close() -> lock_sock_nested() (might_sleep) from every final putter, including __free_opinfo() invoked from an RCU softirq callback, which trips CONFIG_DEBUG_ATOMIC_SLEEP. Defer the release to a dedicated ksmbd_conn_wq workqueue so ksmbd_conn_put() is safe from any non-sleeping context. Make ksmbd_file own a strong connection reference while fp->conn is non-NULL so durable-preserve and final-close paths cannot dereference a stale connection. ksmbd_open_fd() and ksmbd_reopen_durable_fd() take the reference via ksmbd_conn_get() (the latter also reorders the fp->conn / fp->tcon assignments before __open_id() so the published fp is never observed with fp->conn == NULL); session_fd_check() and __ksmbd_close_fd() drop it via ksmbd_conn_put(). With that invariant, session_fd_check() can take a local conn pointer once and use it across the m_op_list and lock_list iterations even though op->conn puts may otherwise drop the last reference. At module exit the workqueue is flushed and destroyed after rcu_barrier(), so any release queued by a trailing RCU callback is drained before the inode hash and module text go away. Fixes: ee426bfb9d09 ("ksmbd: add refcnt to ksmbd_conn struct") Signed-off-by: DaeMyung Kang Acked-by: Namjae Jeon Signed-off-by: Steve French commit ebb639024ebd47a13a511cce6ae630c15e4b3126 Merge: 6d4106e8df94c0 d1ae37dc6881a6 Author: Jakub Kicinski Date: Fri May 1 17:58:45 2026 -0700 Merge branch 'ipv6-fix-ecmp-route-failover-on-carrier-loss' Sagarika Sharma says: ==================== ipv6: fix ECMP route failover on carrier loss This patchset resolves an issue where established IPv6 connections are unable to transition to alternative ECMP nexthops upon carrier loss. Unlike IPv4, the IPv6 routing subsystem does not actively invalidate cached destinations during a NETDEV_CHANGE event. Sockets persist with dead routes, leading to stalled traffic or connection drops. This series introduces a fix to trigger route invalidation by updating the route serial number on link carrier loss and provides a corresponding selftest to validate the failover behavior for IPv4 and IPv6. ==================== Link: https://patch.msgid.link/20260430200909.527827-1-sharmasagarika@google.com Signed-off-by: Jakub Kicinski commit d1ae37dc6881a6a9113c8545cdbba731393d8dcd Author: Kuniyuki Iwashima Date: Thu Apr 30 20:09:01 2026 +0000 selftest: net: Add test for TCP flow failover with ECMP routes. Without the previous commit, TCP failed to switch to alternative IPv6 routes immediately upon carrier loss. It would persist with the dead route until reaching the threshold net.ipv4.tcp_retries1, leading to unnecessary delays in failover. Let's add a selftest for this scenario to ensure TCP fails over immediately upon a carrier loss event. Before: TEST: TCP IPv4 failover [ OK ] TEST: TCP IPv6 failover [FAIL] After: TEST: TCP IPv4 failover [ OK ] TEST: TCP IPv6 failover [ OK ] Signed-off-by: Kuniyuki Iwashima Signed-off-by: Sagarika Sharma Link: https://patch.msgid.link/20260430200909.527827-3-sharmasagarika@google.com Signed-off-by: Jakub Kicinski commit 4bc852006b62eae8ea77e797192d089367e854ff Author: Sagarika Sharma Date: Thu Apr 30 20:09:00 2026 +0000 ipv6: update route serial number on NETDEV_CHANGE When using IPv6 ECMP routes, if a netdev listed as a nexthop experiences a carrier change event (e.g., a bond device generating a NETDEV_CHANGE event after its slaves go linkdown), established connections utilizing that nexthop fail to fail over to other available nexthops. Instead, these connections stall or drop. This happens because the IPv6 FIB code does not invalidate the socket's cached destination when a NETDEV_CHANGE event occurs. While fib6_ifdown() correctly marks the nexthop with RTNH_F_LINKDOWN, it leaves the route's serial number unchanged. As a result, sockets with a previously cached dst do not realize the route is no longer viable and continue to try using the non-functional nexthop. This behavior contrasts with IPv4, which actively flushes cached destinations on a NETDEV_CHANGE event (see fib_netdev_event() in net/ipv4/fib_frontend.c). Fix this by updating the route serial number in fib6_ifdown() when setting RTNH_F_LINKDOWN. This invalidates stale cached destinations, forcing sockets to perform a new route lookup and fail over to a functioning nexthop. Fixes: 51ebd3181572 ("ipv6: add support of equal cost multipath (ECMP)") Signed-off-by: Sagarika Sharma Reviewed-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260430200909.527827-2-sharmasagarika@google.com Signed-off-by: Jakub Kicinski commit 6d4106e8df94c0c52cf3ca6a6a0d01567fb3844e Author: Eric Dumazet Date: Thu Apr 30 08:00:56 2026 +0000 net/sched: sch_pie: annotate more data-races in pie_dump_stats() My prior patch missed few READ_ONCE()/WRITE_ONCE() annotations. Fixes: 5154561d9b11 ("net/sched: sch_pie: annotate data-races in pie_dump_stats()") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260430080056.35104-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a5148bc2fa27092862ac4b9e7b5c8340d60cff34 Author: Alex Cheema Date: Wed Apr 29 18:57:39 2026 +0100 net: usb: cdc_ncm: add Apple Mac USB-C direct networking quirk Apple Silicon Macs expose two CDC NCM "private" data interfaces over USB-C with VID:PID 0x05ac:0x1905 and product string "Mac". This is the same protocol Apple already ships on iPhone (0x05ac:0x12a8) and iPad (0x05ac:0x12ab) for RemoteXPC since iOS 17 -- both data interfaces lack an interrupt status endpoint, so they rely on the FLAG_LINK_INTR- conditional bind path introduced in commit 3ec8d7572a69 ("CDC-NCM: add support for Apple's private interface"). The id_table currently has entries for iPhone and iPad but not for the Mac. Without a match, cdc_ncm falls through to the generic CDC NCM class-match entry, which uses the FLAG_LINK_INTR-having cdc_ncm_info struct, so bind_common() fails on the missing status endpoint and no netdev appears. Add id_table entries for both interface numbers (0 and 2) of the Mac, bound to the existing apple_private_interface_info driver_info. Verified empirically on a Mac Studio M3 Ultra running macOS 26.5: when a Mac is connected via USB-C, ioreg shows VID 0x05ac, PID 0x1905, product string "Mac", with two NCM data interfaces at numbers 0 and 2. The same PID is presented by all current Apple Silicon Mac models (MacBook Pro/Air, Mac mini, Mac Studio across the M-series), mirroring Apple's single-PID-per-family pattern from iPhone/iPad. After this patch, plugging a Mac into a Linux host running the patched kernel produces two enx... interfaces (one per data interface), "ip -br link" lists them as UP, and standard userspace networking (DHCP, NetworkManager shared mode, etc.) works without any modprobe overrides or out-of-tree modules. Signed-off-by: Alex Cheema Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260429175739.34426-1-alex@exolabs.net Signed-off-by: Jakub Kicinski commit c6bebaa744f7579eb72800a262fbfeb93e40db04 Author: Eric Dumazet Date: Thu Apr 30 16:48:36 2026 +0000 ipv4: igmp: annotate data-races in igmp_heard_query() Multiple cpus can run igmp_heard_query() concurrently. Add missing READ_ONCE()/WRITE_ONCE() over following in_dev fields. - mr_qrv - mr_qi - mr_qri - mr_v1_seen - mr_v2_seen Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+ae9a171f239b14485310@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69f38675.050a0220.3cbe47.0002.GAE@google.com Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260430164836.872079-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4b9e327991815e128ad3af75c3a04630a63ce3e0 Author: Kai Zen Date: Thu Apr 30 18:26:48 2026 +0300 net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo rtnl_fill_vfinfo() declares struct ifla_vf_broadcast on the stack without initialisation: struct ifla_vf_broadcast vf_broadcast; The struct contains a single fixed 32-byte field: /* include/uapi/linux/if_link.h */ struct ifla_vf_broadcast { __u8 broadcast[32]; }; The function then copies dev->broadcast into it using dev->addr_len as the length: memcpy(vf_broadcast.broadcast, dev->broadcast, dev->addr_len); On Ethernet devices (the overwhelming majority of SR-IOV NICs) dev->addr_len is 6, so only the first 6 bytes of broadcast[] are written. The remaining 26 bytes retain whatever was previously on the kernel stack. The full struct is then handed to userspace via: nla_put(skb, IFLA_VF_BROADCAST, sizeof(vf_broadcast), &vf_broadcast) leaking up to 26 bytes of uninitialised kernel stack per VF per RTM_GETLINK request, repeatable. The other vf_* structs in the same function are explicitly zeroed for exactly this reason - see the memset() calls for ivi, vf_vlan_info, node_guid and port_guid a few lines above. vf_broadcast was simply missed when it was added. Reachability: any unprivileged local process can open AF_NETLINK / NETLINK_ROUTE without capabilities and send RTM_GETLINK with an IFLA_EXT_MASK attribute carrying RTEXT_FILTER_VF. The kernel walks each VF and emits IFLA_VF_BROADCAST, leaking 26 bytes of stack per VF per request. Stack residue at this call site can include return addresses and transient sensitive data; KASAN with stack instrumentation, or KMSAN, will flag the nla_put() when reproduced. Zero the on-stack struct before the partial memcpy, matching the existing pattern used for the other vf_* structs in the same function. Fixes: 75345f888f70 ("ipoib: show VF broadcast address") Cc: stable@vger.kernel.org Signed-off-by: Kai Zen Link: https://patch.msgid.link/3c506e8f936e52b57620269b55c348af05d413a2.1777557228.git.kai.aizen.dev@gmail.com Signed-off-by: Jakub Kicinski commit 4f34002e2e37639133693c13a2a9977fab86880d Author: Eric Dumazet Date: Thu Apr 30 07:06:11 2026 +0000 ipmr: prevent info-leak in pmr_cache_report() Yiming Qian reported: ipmr_cache_report()` allocates a report skb with `alloc_skb(128, GFP_ATOMIC)` and appends a `struct igmphdr` using `skb_put()`. In the non-`IGMPMSG_WHOLEPKT` path it initializes only: - `igmp->type` - `igmp->code` but does not initialize: - `igmp->csum` - `igmp->group` Later, `igmpmsg_netlink_event()` copies the bytes after `sizeof(struct igmpmsg)` into the `IPMRA_CREPORT_PKT` netlink attribute and emits `RTM_NEWCACHEREPORT` on `RTNLGRP_IPV4_MROUTE_R`. As a result, 6 bytes of stale heap data from the skb head are disclosed to userspace. Let's use skb_put_zero() instead of skb_put() to fix this bug. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Yiming Qian Signed-off-by: Eric Dumazet Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260430070611.4004529-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit f1a5e78a55ebf2b05777fd5eb738038ddae609d6 Merge: cd546f7ae2fce8 f0997a06e3e328 Author: Linus Torvalds Date: Fri May 1 16:56:08 2026 -0700 Merge tag 'drm-fixes-2026-05-02' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Fixes for rc2, the usual amdgpu/xe double header, I think xe had a couple of weeks combined due to some maintainer access issues, otherwise there's just a few misc fixes and documentation fixups. core and helpers: - calculate framebuffer geometry with format helpers - fix docs amdgpu: - GFX12 fix for CONFIG_DRM_DEBUG_MM configs - Fix DC analog support - Userq fixes - GART placement fix - Aldebaran SMU fixes - AMDGPU_INFO_READ_MMR_REG fix - UVD 3.1 fix - GC 6 TCC fix - Fix root reservation in amdgpu_vm_handle_fault() - RAS fix - Module reload fix for APUs - Fix build for CONFIG_DRM_FBDEV_EMULATION=n - IGT DWB regression fix - GC 11.5.4 fix - VCN user fence fixes - JPEG user fence fixes - SMU 13.0.6 fix - VCN 3/4 IB parser fixes - NV3x+ dGPU vblank fix - DCE6/8 fixes for LVDS/eDP panels without an EDID amdkfd: - Fix for when CONFIG_HSA_AMD is not set - SVM fixes xe: - uapi: Add missing pad and extensions check - uapi: Reject unsafe PAT indices for CPU cached memory - Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge - Xe3p tuning and workaround fixes - USE drm mm instead of drm SA for CCS read/write - Fix leaks and null derefs - Fix Wa_18022495364 appletbdrm: - allocate protocol buffers with kvzalloc() dma-buf: - fix docs imagination: - avoid segfault in debugfs ofdrm: - put PCI device reference on errors udl: - increase USB timeout" * tag 'drm-fixes-2026-05-02' of https://gitlab.freedesktop.org/drm/kernel: (77 commits) drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise drm/xe/xelp: Fix Wa_18022495364 drm/xe/gsc: Fix BO leak on error in query_compatibility_version() drm/xe/eustall: Fix drm_dev_put called before stream disable in close drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked drm/xe/vf: Use drm mm instead of drm sa for CCS read/write drm/xe: Add memory pool with shadow support drm/xe/debugfs: Correct printing of register whitelist ranges drm/xe: Mark ROW_CHICKEN5 as a masked register drm/xe/tuning: Use proper register offset for GAMSTLB_CTRL drm/xe/xe3p_lpg: Add missing indirect ring state feature flag drm/xe: Drop redundant rtp entries for Wa_14019988906 & Wa_14019877138 drm/xe/vm: Add missing pad and extensions check drm/xe: Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge() ... commit f93836b236773862e9ee268a82e3614caf77ea01 Author: Aleksander Jan Bajkowski Date: Thu Apr 30 23:34:33 2026 +0200 net: usb: r8152: add TRENDnet TUC-ET2G v2.0 The TRENDnet TUC-ET2G V2.0 is an RTL8156B based 2.5G Ethernet controller. Add the vendor and product ID values to the driver. This makes Ethernet work with the adapter. Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Andrew Lunn Reviewed-by: Birger Koblitz Link: https://patch.msgid.link/20260430213435.21821-1-olek2@wp.pl Signed-off-by: Jakub Kicinski commit 2ab02ac411a0bbcd2884b30f591f4e4a25c489a4 Merge: 85da3965df5e6f baa3c65435fb3f Author: Jakub Kicinski Date: Fri May 1 16:45:41 2026 -0700 Merge tag 'nf-26-05-01' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following batch contains Netfilter fixes for net: 1) Replace skb_try_make_writable() by skb_ensure_writable() in nft_fwd_netdev and the flowtable to deal with uncloned packets having their network header in paged fragments. 2) Drop packet if output device does not exist and ensure sufficient headroom in nft_fwd_netdev before transmitting the skb. 3) Use the existing dup recursion counter in nft_fwd_netdev for the neigh_xmit variant, from Weiming Shi. 4) Add .check_hooks interface to x_tables to detach the control plane hook check based on the match/target configuration. Then, update nft_compat to use .check_hooks from .validate path, this fixes a lack of hook validation for several match/targets. 5) Fix incorrect .usersize in xt_CT, from Florian Westphal. 6) Fix a memleak with netdev tables in dormant state, from Florian Westphal. 7) Several patches to check if the packet is a fragment, then skip layer 4 inspection, for x_tables and nf_tables; as well as common nf_socket infrastructure. The xt_hashlimit match drops fragments to stay consistent with the existing approach when failing to parse the layer 4 protocol header. 8) Ensure sufficient headroom in the flowtable before transmitting the skb. 9) Fix the flowtable inline vlan approach for double-tagged vlan: Reverse the iteration over .encap[] since it represents the encapsulation as seen from the ingress path. Postpone pushing layer 2 header so output device is available to calculate needed headroom. Finally, add and use nf_flow_vlan_push() to fix it. 10) Fix flowtable inline pppoe with GSO packets. Moreover, use FLOW_OFFLOAD_XMIT_DIRECT to fill up destination hardware address since neighbour cache does not exist in pppoe. 11) Use skb_pull_rcsum() to decapsulate vlan and pppoe headers, for double-tagged vlan in particular this should provide some benefits in certain scenarios. More notes regarding 9-11): - sashiko is also signalling to use it for IPIP headers, but that needs more adjustments such setting skb->protocol after removing the IPIP header, will follow up in a separated patch. - I plan to submit selftests to cover double-tagged-vlan. As for pppoe, it should be possible but that would mandate a few userspace dependencies. This has been semi-automatically tested by me and reporters describing broken double-vlan-tagged and pppoe currently in the flowtable. * tag 'nf-26-05-01' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: flowtable: use skb_pull_rcsum() to pop vlan/pppoe header netfilter: flowtable: fix inline pppoe encapsulation in xmit path netfilter: flowtable: fix inline vlan encapsulation in xmit path netfilter: flowtable: ensure sufficient headroom in xmit path netfilter: xtables: fix L4 header parsing for non-first fragments netfilter: nf_tables: skip L4 header parsing for non-first fragments netfilter: nf_socket: skip socket lookup for non-first fragments netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables netfilter: xt_CT: fix usersize for v1 and v2 revision netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate netfilter: x_tables: add .check_hooks to matches and targets netfilter: nft_fwd_netdev: use recursion counter in neigh egress path netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding netfilter: replace skb_try_make_writable() by skb_ensure_writable() ==================== Link: https://patch.msgid.link/20260501122237.296262-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit cd546f7ae2fce8b695c834143b50e712d62ebed8 Merge: ef5f46b630235b 030e8a40fff65c Author: Linus Torvalds Date: Fri May 1 16:32:42 2026 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Avoid writing an uninitialised stack variable to POR_EL0 on sigreturn if the poe_context record is absent - Reserve one more page for the early 4K-page kernel mapping to cover the extra [_text, _stext) split introduced by the non-executable read-only mapping - Force the arch_local_irq_*() wrappers to be __always_inline so that noinstr entry and idle paths cannot call out-of-line, instrumentable copies - Fix potential sign extension in the arm64 SCS unwinder's DWARF advance_loc4 decoding - Tolerate arm64 ACPI platforms with only WFI and no deeper PSCI idle states, restoring cpuidle registration on such systems - Include the UAPI header in the arm64 GCS libc test rather than carrying a duplicate struct user_gcs definition (the original #ifdef NT_ARM_GCS was wrong to cover the structure definition as it would be masked out if the toolchain defined it) * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: signal: Preserve POR_EL0 if poe_context is missing arm64: Reserve an extra page for early kernel mapping kselftest/arm64: Include for user_gcs definition ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states arm64/irqflags: __always_inline the arch_local_irq_*() helpers arm64/scs: Fix potential sign extension issue of advance_loc4 commit 9900b9fee5a0e0f72d7c744b37c7c851d5785ac6 Author: Yi Kuo Date: Wed Apr 29 18:00:11 2026 +0800 smb: smbdirect: fix MR registration for coalesced SG lists ib_dma_map_sg() modifies the provided scatterlist and returns the number of mapped entries, which can be fewer than the requested mr->sgt.nents if the DMA controller coalesces contiguous memory segments. Passing the original, uncoalesced count to ib_map_mr_sg() causes memory registration failures if coalescing actually occurs. Capture the actual mapped count returned by ib_dma_map_sg() and pass it to ib_map_mr_sg() to ensure correct MR registration. Also update the ib_dma_map_sg() error logging to drop the error pointer formatting, since the return value is an integer count rather than an error code. Ensure a proper error code (-EIO) is assigned when DMA mapping or MR registration fails. Fixes: de5ef8ec3c46 ("smb: smbdirect: introduce smbdirect_mr.c with client mr code") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221408 Reviewed-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Yi Kuo Signed-off-by: Steve French commit e768103cfbac30a49860aca08a7710d39dbdd470 Author: Stefan Metzmacher Date: Wed Apr 29 15:43:36 2026 +0200 smb: smbdirect: introduce and use include/linux/smbdirect.h This makes it easier to rebuild cifs.ko and ksmbd.ko against a running kernel. Suggested-by: Christoph Hellwig Link: https://lore.kernel.org/linux-cifs/aehrPuY60VMcYGU8@infradead.org/ Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Christoph Hellwig Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5234094c0150338c35280a75cc7842015f76b725 Author: Stefan Metzmacher Date: Wed Apr 29 15:43:35 2026 +0200 smb: smbdirect: make use of DEFAULT_SYMBOL_NAMESPACE and EXPORT_SYMBOL_GPL This is a better solution than EXPORT_SYMBOL_FOR_MODULES(__sym, "cifs,ksmbd") as it makes it possible to rebuild smbdirect.ko against a running kernel and then load the existing cifs.ko and ksmbd.ko from the running kernel. Suggested-by: Christoph Hellwig Link: https://lore.kernel.org/linux-cifs/aehrPuY60VMcYGU8@infradead.org/ Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Christoph Hellwig Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 01eb80b767430ae868c48ad106c60eb61a508c85 Author: Alok Tiwari Date: Fri Apr 10 04:20:12 2026 -0700 accel/qaic: fix incorrect counter check in RAS message decode The UE and UE_NF cases check ce_count against UINT_MAX before incrementing their respective counters. This is logically incorrect and prevents ue_count and ue_nf_count from incrementing when ce_count reaches UINT_MAX. Fixes: c11a50b170e7 ("accel/qaic: Add Reliability, Accessibility, Serviceability (RAS)") Signed-off-by: Alok Tiwari Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20260410112015.592546-1-alok.a.tiwari@oracle.com commit ef5f46b630235b75beec43174348c3d01d6fc49a Merge: ee9dce44362b2d f92d542577db87 Author: Linus Torvalds Date: Fri May 1 13:19:14 2026 -0700 Merge tag 'selinux-pr-20260501' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fixes from Paul Moore: - Ensure SELinux is always properly accessing its own sock LSM state - Only reserve an xattr slot for SELinux if it will be used - Fix a SELinux auditing regression in the directory avdcache * tag 'selinux-pr-20260501' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix avdcache auditing selinux: don't reserve xattr slot when we won't fill it selinux: use sk blob accessor in socket permission helpers commit ee9dce44362b2d8132c32964656ab6dff7dfbc6a Author: Davidlohr Bueso Date: Fri May 1 12:41:23 2026 -0700 futex: Drop CLONE_THREAD requirement for private default hash alloc Currently need_futex_hash_allocate_default() depends on strict pthread semantics, abusing CLONE_THREAD. This breaks the non-concurrency assumptions when doing the mm->futex_ref pcpu allocations, leading to bugs[0] when sharing the mm in other ways; ie: BUG: KASAN: slab-use-after-free in futex_hash_put ... where the +1 bias can end up on a percpu counter that mm->futex_ref no longer points at. Loosen the check to cover any CLONE_VM clone, except vfork(). Excluding vfork keeps the existing paths untouched (no overhead), and we can't race in the first place: either the parent is suspended and the child runs alone, or mm->futex_ref is already allocated from an earlier CLONE_VM. Link: https://lore.kernel.org/all/CAL_bE8LsmCQ-FAtYDuwbJhOkt9p2wwYQwAbMh=PifC=VsiBM6A@mail.gmail.com/ [0] Fixes: d9b05321e21e ("futex: Move futex_hash_free() back to __mmput()") Reported-by: Yiming Qian Signed-off-by: Davidlohr Bueso Signed-off-by: Linus Torvalds commit bb1d73f2cddccf717307e88c24cae619a9a80295 Merge: 227c3d546e9638 b95e0e792822ba Author: Linus Torvalds Date: Fri May 1 12:58:02 2026 -0700 Merge tag 's390-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - Reject zero-length writes from userspace that corrupt Debug Facility buffers - Replace one s390 PCI maintainer - Remove SCLP_OFB Kconfig option and enable the guarded code unconditionally - Replace incorrect use of phys_to_folio() to virt_to_folio() in do_secure_storage_access() * tag 's390-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() s390/sclp: Remove SCLP_OFB Kconfig option MAINTAINERS: Replace one of the maintainers for s390/pci s390/debug: Reject zero-length input in debug_input_flush_fn() s390/debug: Reject zero-length input before trimming a newline commit 010b7723c0a3b9ad58f50b715dbe2e7781d29400 Author: Thomas Gleixner Date: Tue Apr 28 09:34:45 2026 +0200 rseq: Don't advertise time slice extensions if disabled If time slice extensions have been disabled on the kernel command line, then advertising them in RSEQ flags is wrong. Adjust the conditionals to reflect reality, fixup the misleading comments about the gap of these flags and the rseq::flags field. Fixes: d6200245c75e ("rseq: Allow registering RSEQ with slice extension") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Link: https://patch.msgid.link/20260428224427.437059375%40kernel.org Cc: stable@vger.kernel.org commit e9766e6f7d330dce7530918d8c6e3ec96d6c6e24 Author: Thomas Gleixner Date: Tue Apr 28 10:14:41 2026 +0200 rseq: Protect rseq_reset() against interrupts rseq_reset() uses memset() to clear the tasks rseq data. That's racy against membarrier() and preemption. Guard it with irqsave to cure this. Fixes: faba9d250eae ("rseq: Introduce struct rseq_data") Reported-by: Dmitry Vyukov Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Link: https://patch.msgid.link/20260428224427.353887714%40kernel.org Cc: stable@vger.kernel.org commit 2cb68e45120dfc66404c7547d95b8ac6ff0b25ce Author: Thomas Gleixner Date: Tue Apr 28 10:10:19 2026 +0200 rseq: Set rseq::cpu_id_start to 0 on unregistration The RSEQ rework changed that to RSEQ_CPU_UNINITILIZED, which is obviously incompatible. Revert back to the original behavior. Fixes: 0f085b41880e ("rseq: Provide and use rseq_set_ids()") Reported-by: Dmitry Vyukov Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Link: https://patch.msgid.link/20260428224427.271566313%40kernel.org Cc: stable@vger.kernel.org commit cb48828f06afa232cc330f0f4d6be101067810b3 Author: Mark Brown Date: Thu Apr 23 20:17:45 2026 +0100 selftests/rseq: Don't run tests with runner scripts outside of the scripts The rseq selftests include two runner scripts run_param_test.sh and run_syscall_errors_test.sh which set up the environment for test binaries and run them with various parameters. Currently we list these test binaries in TEST_GEN_PROGS but this results in the kselftest framework running them directly as well as via the runners, resulting in duplication and spurious failures when the environment is not correctly set up (eg, if glibc tries to use rseq). Move the binaries the runners invoke to TEST_GEN_PROGS_EXTENDED, binaries listed there are built but not run by the framework. The param_test benchmarks are not moved since they are not run by run_param_test.sh. Fixes: 830969e7821a ("selftests/rseq: Implement time slice extension test") Signed-off-by: Mark Brown Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260423-selftests-rseq-use-runner-v1-1-e13a133754c1@kernel.org Cc: stable@vger.kernel.org commit 227c3d546e963874198aafc0cae8c3e8c24ae4ee Merge: 6fe0be6dc7faf9 c444139cb747bf Author: Linus Torvalds Date: Fri May 1 12:16:42 2026 -0700 Merge tag 'v7.1-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix shutdown (stop sessions) - Fix readdir unsupported info level * tag 'v7.1-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: rewrite stop_sessions() with restartable iteration smb: server: handle readdir_info_level_struct_sz() error commit 6fe0be6dc7faf984599b1e356ead1c49b64ed3ca Merge: 9d88bb929aa119 7e36e03d192a55 Author: Linus Torvalds Date: Fri May 1 11:26:15 2026 -0700 Merge tag 'block-7.1-20260430' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - MD pull request via Yu: - Fix a raid5 UAF on IO across the reshape position - Avoid failing RAID1/RAID10 devices for invalid IO errors - Fix RAID10 divide-by-zero when far_copies is zero - Restore bitmap grow through sysfs - Use mddev_is_dm() instead of open-coding gendisk checks - Use ATTRIBUTE_GROUPS() for md default sysfs attributes - Replace open-coded wait loops with wait_event helpers - NVMe pull request via Keith: - Target data transfer size configuation (Aurelien) - Enable P2P for RDMA (Shivaji Kant) - TCP target updates (Maurizio, Alistair, Chaitanya, Shivam Kumar) - TCP host updates (Alistair, Chaitanya) - Authentication updates (Alistair, Daniel, Chris Leech) - Multipath fixes (John Garry) - New quirks (Alan Cui, Tao Jiang) - Apple driver fix (Fedor Pchelkin) - PCI admin doorbell update fix (Keith) - Properly propagate CDROM read-only state to the block layer * tag 'block-7.1-20260430' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (35 commits) md: use ATTRIBUTE_GROUPS() for md default sysfs attributes md: use mddev_is_dm() instead of open-coding gendisk checks md/raid1: replace wait loop with wait_event_idle() in raid1_write_request() md/md-bitmap: add a none backend for bitmap grow md/md-bitmap: split bitmap sysfs groups md: factor bitmap creation away from sysfs handling md: use mddev_lock_nointr() in mddev_suspend_and_lock_nointr() md: replace wait loop with wait_event() in md_handle_request() md/raid10: fix divide-by-zero in setup_geo() with zero far_copies md/raid1,raid10: don't fail devices for invalid IO errors MAINTAINERS: Add Xiao Ni as md/raid reviewer md/raid5: Fix UAF on IO across the reshape position cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() nvme-auth: Hash DH shared secret to create session key nvme-pci: fix missed admin queue sq doorbell write nvme-auth: Include SC_C in RVAL controller hash nvme-tcp: teardown circular locking fixes nvmet-tcp: Don't clear tls_key when freeing sq Revert "nvmet-tcp: Don't free SQ on authentication success" nvme: skip trace completion for host path errors ... commit 9d88bb929aa1193f9c0b9595a0c46930d6699647 Merge: 33d0c9c5f0945f 17666e2d7592c3 Author: Linus Torvalds Date: Fri May 1 11:01:31 2026 -0700 Merge tag 'io_uring-7.1-20260430' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Remove dead struct io_buffer_list member - Fix for incrementally consumed buffers with recvmsg multishot, which requires a minimum value left in a buffer for any receive for the headers. If there's still a bit of buffer left but it's smaller than that value, then userspace will see a spurious -EFAULT returned in the CQE - Locking fix for the DEFER_TASKRUN retry list, which otherwise could race with fallback cancelations. If the task is exiting with task_work left in both the normal and retry list AND the exit cleanup races with the task running task work, then entries could either be doubly completed or lost - Cap NAPI busy poll timeout to something sane, to avoid syzbot running into excessive polling and triggering warnings around that * tag 'io_uring-7.1-20260430' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/tw: serialize ctx->retry_llist with ->uring_lock io_uring/napi: cap busy_poll_to 10 msec io_uring/kbuf: support min length left for incremental buffers io_uring/kbuf: kill dead struct io_buffer_list 'nr_entries' member commit 41ca998fbe30755191342b58e4f642cf3052ef2b Author: Helge Deller Date: Fri May 1 19:07:19 2026 +0200 parisc: Fix 64-bit kernel build when CONFIG_COMPAT=n VDSO32_SYMBOL() is used in signal.c, defining the value to zero avoids liker issues when CONFIG_COMPAT=n. Signed-off-by: Helge Deller commit 33d0c9c5f0945fc93a08d7ab20c4fb6d6976ed3b Merge: d8b0e2ef75076a 8c0f9cd1df41ee Author: Linus Torvalds Date: Fri May 1 09:51:38 2026 -0700 Merge tag 'spi-fix-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "There are a couple of nasty issues fixed here in the axiado and rockchip drivers. We've also got more of the fixes from Johan here, this time for the two Cadence drivers, plus a couple of other similar fixes from John and Felix" * tag 'spi-fix-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: amlogic-spisg: initialize completion before requesting IRQ spi: axiado: replace usleep_range() with udelay() in IRQ path spi: cadence-quadspi: fix runtime pm and clock imbalance on unbind spi: cadence-quadspi: fix unclocked access on unbind spi: cadence-quadspi: fix clock imbalance on probe failure spi: cadence-quadspi: fix runtime pm disable imbalance on probe failure spi: cadence: fix clock imbalance on probe failure spi: cadence: fix unclocked access on unbind spi: rockchip: Drop unused and broken CR0 macros spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ spi: rzv2h-rspi: Fix silent failure in clock setup error path commit 030e8a40fff65ca6ac1c04a4d3c08afe72438922 Author: Kevin Brodsky Date: Mon Apr 27 13:03:33 2026 +0100 arm64: signal: Preserve POR_EL0 if poe_context is missing Commit 2e8a1acea859 ("arm64: signal: Improve POR_EL0 handling to avoid uaccess failures") delayed the write to POR_EL0 in rt_sigreturn to avoid spurious uaccess failures. This change however relies on the poe_context frame record being present: on a system supporting POE, calling sigreturn without a poe_context record now results in writing arbitrary data from the kernel stack into POR_EL0. Fix this by adding a __valid_fields member to struct user_access_state, and zeroing the struct on allocation. restore_poe_context() then indicates that the por_el0 field is valid by setting the corresponding bit in __valid_fields, and restore_user_access_state() only touches POR_EL0 if there is a valid value to set it to. This is in line with how POR_EL0 was originally handled; all frame records are currently optional, except fpsimd_context. To ensure that __valid_fields is kept in sync, fields (currently just por_el0) are now accessed via accessors and prefixed with __ to discourage direct access. Fixes: 2e8a1acea859 ("arm64: signal: Improve POR_EL0 handling to avoid uaccess failures") Cc: Reported-by: Will Deacon Signed-off-by: Kevin Brodsky Signed-off-by: Catalin Marinas commit d8b0e2ef75076a706631a53a347e1944747de6f3 Merge: a973736a287157 7dfc0063022078 Author: Linus Torvalds Date: Fri May 1 09:25:12 2026 -0700 Merge tag 'regulator-fix-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A fix from Arnd re-adding a dependency on gpiolib which was implicitly pulled in via an OF specific route which got removed as part of a cleanup" * tag 'regulator-fix-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: rpi-panel-attiny: add back GPIOLIB dependency commit a973736a287157ddd55a5fbc793a6f644c3374be Merge: 2b4d0215bec0f0 4b7774eeab8d66 Author: Linus Torvalds Date: Fri May 1 09:15:00 2026 -0700 Merge tag 'regmap-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "A fix from Colin for a spelling mistake in a dev_warn() message" * tag 'regmap-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: sdw-mbq: Fix spelling mistake "undeferable" -> "undeferrable" commit 2b4d0215bec0f09bfb872e9a8aa1e1943a42d5e7 Merge: 26fd6bff2c0501 99ebc509eef526 Author: Linus Torvalds Date: Fri May 1 08:45:23 2026 -0700 Merge tag 'mm-hotfixes-stable-2026-04-30-15-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: "20 hotfixes. All are for MM (and for MMish maintainers). 9 are cc:stable and the remainder are for post-7.0 issues or aren't deemed suitable for backporting. There are two DAMON series from SeongJae Park which address races which could lead to use-after-free errors, and avoid the possibility of presenting stale parameter values to users" * tag 'mm-hotfixes-stable-2026-04-30-15-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm: memcontrol: fix rcu unbalance in get_non_dying_memcg_end() mm/userfaultfd: detect VMA type change after copy retry in mfill_copy_folio_retry() MAINTAINERS: remove stale kdump project URL mm/damon/stat: detect and use fresh enabled value mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values selftests/mm: specify requirement for PROC_MEM_ALWAYS_FORCE=y mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock MAINTAINERS: update Li Wang's email address MAINTAINERS, mailmap: update email address for Qi Zheng MAINTAINERS: update Liam's email address mm/hugetlb_cma: round up per_node before logging it MAINTAINERS: fix regex pattern in CORE MM category mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap() mm: start background writeback based on per-wb threshold for strictlimit BDIs kho: fix error handling in kho_add_subtree() liveupdate: fix return value on session allocation failure mailmap: update entry for Dan Carpenter vmalloc: fix buffer overflow in vrealloc_node_align() commit 4d8e74ad4585672489da6145b3328d415f50db82 Author: Zhaoyang Huang Date: Thu Apr 30 16:58:08 2026 +0800 arm64: Reserve an extra page for early kernel mapping The final part of [data, end) segment may overflow into the next page of init_pg_end[1] which is the gap page before early_init_stack[2]: [1] crash_arm64_v9.0.1> vtop ffffffed00601000 VIRTUAL PHYSICAL ffffffed00601000 83401000 PAGE DIRECTORY: ffffffecffd62000 PGD: ffffffecffd62da0 => 10000000833fb003 PMD: ffffff80033fb018 => 10000000833fe003 PTE: ffffff80033fe008 => 68000083401f03 PAGE: 83401000 PTE PHYSICAL FLAGS 68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN) PAGE PHYSICAL MAPPING INDEX CNT FLAGS fffffffec00d0040 83401000 0 0 1 4000 reserved [2] ffffffed002c8000 (r) __pi__data ffffffed0054e000 (d) __pi___bss_start ffffffed005f5000 (b) __pi_init_pg_dir ffffffed005fe000 (b) __pi_init_pg_end ffffffed005ff000 (B) early_init_stack ffffffed00608000 (b) __pi__end For 4K pages, the early kernel mapping may use 2MB block entries but the kernel segments are only 64KB aligned. Segment boundaries that fall within a 2MB block therefore require a PTE table so that different attributes can be applied on either side of the boundary. KERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel VMAs registered by declare_kernel_vmas(). However, since commit 5973a62efa34 ("arm64: map [_text, _stext) virtual address range non-executable+read-only"), the early mapper also maps [_text, _stext) separately from [_stext, _etext). This adds one more early-only split and can require one more page-table page than the existing EARLY_SEGMENT_EXTRA_PAGES allowance reserves. Increase the 4K-page early mapping allowance by one page to cover that additional split. Fixes: 5973a62efa34 ("arm64: map [_text, _stext) virtual address range non-executable+read-only") Assisted-by: TRAE:GLM-5.1 Suggested-by: Ard Biesheuvel Signed-off-by: Zhaoyang Huang [catalin.marinas@arm.com: rewrote part of the commit log] [catalin.marinas@arm.com: expanded the code comment] Signed-off-by: Catalin Marinas commit 2e42a17b8f6bc3c0cd69d7556b588011d3ec2394 Author: Eliot Courtney Date: Thu Apr 23 21:36:52 2026 +0900 rust: drm: gem: clean up GEM state in init failure case Currently, if `drm_gem_object_init` fails, the object is freed without any cleanup. Perform the cleanup in that case. Cc: stable@vger.kernel.org Fixes: c284d3e42338 ("rust: drm: gem: Add GEM object abstraction") Signed-off-by: Eliot Courtney Reviewed-by: Alice Ryhl Reviewed-by: Onur Özkan Link: https://patch.msgid.link/20260423-fix-gem-1-v1-1-e12e35f7bba9@nvidia.com [ Move safety comment closer to unsafe block to avoid a clippy warning. - Danilo ] Signed-off-by: Danilo Krummrich commit bb7235e226888607e6aac1288062fcb1ac105589 Author: Leo Yan Date: Wed Apr 29 15:30:10 2026 +0100 kselftest/arm64: Include for user_gcs definition kselftest includes kernel uAPI headers with option: -isystem $(top_srcdir)/usr/include Include in libc-gcs.c for the definition of struct user_gcs from the uAPI headers, and remove the redundant definition in gcs-util.h. This fixes a compilation error on systems where the toolchain defines NT_ARM_GCS. Fixes: a505a52b4e29 ("kselftest/arm64: Add a GCS test program built with the system libc") Signed-off-by: Leo Yan Reviewed-by: Mark Brown Signed-off-by: Catalin Marinas commit ad39a189bfebb3de580f390bc000f9e121c6aca3 Author: Pauli Virtanen Date: Thu Apr 30 23:49:50 2026 +0300 ALSA: usb-audio: add min_mute quirk for Razer Nommo V2 X ID 1532:055e Razer USA, Ltd Razer Nommo V2 X is tested to have muted min playback volume. Apply quirk for that. Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/work_items/5235 Signed-off-by: Pauli Virtanen Link: https://patch.msgid.link/94449577332d14d7974864903825f27e5824ddbc.1777579951.git.pav@iki.fi Signed-off-by: Takashi Iwai commit 56722cfbb78d7eb41756cd78dc5192d08bd14f3d Author: Rámon van Raaij Date: Thu Apr 30 21:12:24 2026 +0200 ALSA: hda/realtek: Add codec SSID quirk for Lenovo Yoga Pro 9 16IMH9 The Yoga Pro 9 16IMH9 (codec SSID 17aa:38d6) shares PCI audio device subsystem ID 17aa:3811 with the Legion S7 15IMH05. The existing SND_PCI_QUIRK entry for the Legion routes both machines to ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS, which does not bind the TAS2781 smart amplifiers, resulting in near-silent built-in speakers. Add an HDA_CODEC_QUIRK entry immediately before the conflicting PCI quirk that matches the Yoga Pro 9's unique codec SSID and routes it to ALC287_FIXUP_TAS2781_I2C. Codec quirks are evaluated after PCI quirks and take precedence, leaving the Legion S7 15IMH05 entry unaffected. This follows the same pattern used to disambiguate PCI SSID 17aa:3847 (shared between Yoga Pro 7 14IMH9 and Legion 7 16ACHG6), where a HDA_CODEC_QUIRK for codec SSID 17aa:38cf resolves the conflict. Signed-off-by: Rámon van Raaij Link: https://patch.msgid.link/20260430191224.patch1-ramon@vanraaij.eu Signed-off-by: Takashi Iwai commit 845db023a8aeba8b14315a846dcfba31ee727fb1 Author: Jens Axboe Date: Fri May 1 19:23:12 2026 +0800 ublk: don't issue uring_cmd from fallback task work When ublk_ch_uring_cmd_cb() runs as fallback task work (e.g., because the submitting task is exiting), the command should not be issued as current is a kworker, not the daemon task. This can cause io->task to capture the wrong task in __ublk_fetch(), leading to a task mismatch warning in ublk_uring_cmd_cancel_fn(). Check tw.cancel and return -ECANCELED instead of issuing the command from fallback context. Fixes: 3421c7f68bba ("ublk: make sure io cmd handled in submitter task context") Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260501112312.947327-1-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit baa3c65435fb3f450b262672bc06db887a92d397 Author: Pablo Neira Ayuso Date: Thu Apr 30 21:55:01 2026 +0200 netfilter: flowtable: use skb_pull_rcsum() to pop vlan/pppoe header This adjusts the checksum, if required, after pulling the layer 2 header, either the pppoe header or the inner vlan header in the double-tagged vlan packets. Fixes: 4cd91f7c290f ("netfilter: flowtable: add vlan support") Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support") Signed-off-by: Pablo Neira Ayuso commit 1f6ac0f8441c48c4cc250141e1da8486c13512ba Author: Qbeliw Tanaka Date: Thu Apr 30 21:44:12 2026 -0700 Input: xpad - add "Nova 2 Lite" from GameSir Add support for the gamepad "Nova 2 Lite" from GameSir, compatible with the Xbox 360 gamepad. Signed-off-by: Qbeliw Tanaka Link: https://patch.msgid.link/20260429.162040.930225048583399359.q.tanaka@gmx.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit c897cf120696b94f56ed0f3197ba9a77071a59ec Author: Dmitriy Zharov Date: Thu Apr 30 22:35:22 2026 +0400 Input: xpad - add support for ASUS ROG RAIKIRI II Add the VID/PIDs for the ASUS ROG RAIKIRI II controller to xpad_device and the VID to xpad_table. The controller has a physical PC/XBOX toggle which switches between XBOX360 and XBOXONE protocols. Signed-off-by: Dmitriy Zharov Link: https://patch.msgid.link/20260430183522.122151-1-contact@zharov.dev Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit f0997a06e3e32898bcae667d6807fc46ebfd0eec Merge: b006ef5fd64389 662f9ddc807779 Author: Dave Airlie Date: Fri May 1 12:49:22 2026 +1000 Merge tag 'drm-xe-fixes-2026-04-30' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes API Fixes: - Add missing pad and extensions check (Jonathan) - Reject unsafe PAT indices for CPU cached memory (Jia) Driver Fixes: - Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge (Brost) - Xe3p tuning and workaround fixes (Roper, Gustavo) - USE drm mm instead of drm SA for CCS read/write (Satya) - Fix leaks and null derefs (Shuicheng) - Fix Wa_18022495364 (Tvrtko) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/afO05KvmFMn_7qcY@intel.com commit b006ef5fd643898b7cf77091a786d98544b95f4a Merge: 39436e1d91ec50 019155e2bd3e2c Author: Dave Airlie Date: Fri May 1 11:00:33 2026 +1000 Merge tag 'amd-drm-fixes-7.1-2026-04-30' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.1-2026-04-30: amdgpu: - GFX12 fix for CONFIG_DRM_DEBUG_MM configs - Fix DC analog support - Userq fixes - GART placement fix - Aldebaran SMU fixes - AMDGPU_INFO_READ_MMR_REG fix - UVD 3.1 fix - GC 6 TCC fix - Fix root reservation in amdgpu_vm_handle_fault() - RAS fix - Module reload fix for APUs - Fix build for CONFIG_DRM_FBDEV_EMULATION=n - IGT DWB regression fix - GC 11.5.4 fix - VCN user fence fixes - JPEG user fence fixes - SMU 13.0.6 fix - VCN 3/4 IB parser fixes - NV3x+ dGPU vblank fix - DCE6/8 fixes for LVDS/eDP panels without an EDID amdkfd: - Fix for when CONFIG_HSA_AMD is not set - SVM fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260430135619.3929877-1-alexander.deucher@amd.com commit 4d2b03699460b8fd5df34408a03a84a1a7ff8aa1 Author: Michael Neuling Date: Thu Apr 9 09:11:39 2026 +0000 riscv: errata: Fix bitwise vs logical AND in MIPS errata patching The condition checking whether a specific errata needs patching uses logical AND (&&) instead of bitwise AND (&). Since logical AND only checks that both operands are non-zero, this causes all errata patches to be applied whenever any single errata is detected, rather than only applying the matching one. The SiFive errata implementation correctly uses bitwise AND for the same check. Fixes: 0b0ca959d206 ("riscv: errata: Fix the PAUSE Opcode for MIPS P8700") Signed-off-by: Michael Neuling Assisted-by: Cursor:claude-4.6-opus-high-thinking Link: https://patch.msgid.link/20260409091143.1348853-2-mikey@neuling.org [pjw@kernel.org: fixed checkpatch warning] Signed-off-by: Paul Walmsley commit a2e5b58811c7bb7d63f366f586cc7317f20e62e7 Author: Avi Radinsky Date: Wed Apr 29 18:35:23 2026 -0400 Documentation: riscv: cmodx: fix typos Fix typos in the dynamic ftrace section: atmoic -> atomic (twice), pacthable -> patchable, derect -> directed. Signed-off-by: Avi Radinsky Acked-by: Randy Dunlap Link: https://patch.msgid.link/391d16fb-5f11-45fa-8f3b-1debe095695e@tennr.com Signed-off-by: Paul Walmsley commit 85da3965df5e6f1e1c48d2c435e140c5b66625ef Merge: 75df490c9e8457 bc968f61bf0ad4 Author: Jakub Kicinski Date: Thu Apr 30 18:50:19 2026 -0700 Merge branch 'octeontx2-af-npc-cn20k-mcam-fixes' Ratheesh Kannoth says: ==================== octeontx2-af: npc: cn20k: MCAM fixes This series tightens Marvell OcteonTX2 AF NPC support for CN20K silicon around MCAM key typing, optional debugfs setup, defrag allocation rollback, defrag entry relocation bookkeeping, logical MCAM clear and programming, default-rule index handling with explicit teardown, and NIXLF reserved-slot lookup when default rules are missing. Patches 1 through 3 focus on AF error handling: propagate npc_mcam_idx_2_key_type() failures through cn20k MCAM enable, config, copy, and read paths; treat cn20k NPC debugfs nodes as optional so probe does not fail when debugfs is unavailable; and fix defrag MCAM allocation rollback so allocation errno is not overwritten during subbank index resolution. Patch 4 fixes npc_defrag_move_vdx_to_free(): when an MCAM line is moved to a new physical index, move entry2target_pffunc[] association to the new slot, clear the old slot, and retarget the matching mcam_rules entry so software state matches hardware after defrag. Patches 5 through 7 refine cn20k MCAM programming: clear entries using the logical MCAM index and resolved key width, fix bank/CFG sequencing in npc_cn20k_config_mcam_entry(), and read action metadata from the correct bank in npc_cn20k_read_mcam_entry(). Patches 8 through 10 complete default-rule lifecycle handling: initialize default-rule index outputs eagerly, tear down reserved default MCAM rules explicitly (coordinated with npc_mcam_free_all_entries()), and reject USHRT_MAX sentinel indices from npc_get_nixlf_mcam_index() on cn20k. ==================== Link: https://patch.msgid.link/20260429022722.1110289-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit bc968f61bf0ad4f085559e5e3d168105fdf88204 Author: Ratheesh Kannoth Date: Wed Apr 29 07:57:22 2026 +0530 octeontx2-af: npc: cn20k: Reject missing default-rule MCAM indices When cn20k default L2 rules are not installed, npc_cn20k_dft_rules_idx_get() leaves broadcast, multicast, promiscuous, and unicast slots at USHRT_MAX. npc_get_nixlf_mcam_index() previously returned that sentinel as a valid MCAM index, so callers could program hardware with an invalid index. Return -EINVAL from the cn20k branches of npc_get_nixlf_mcam_index() when the requested slot is still USHRT_MAX. Harden cn20k NPC MCAM entry helpers to reject out-of-range indices before touching hardware. Drop the early bounds check in npc_enable_mcam_entry() for cn20k so invalid indices are validated inside npc_cn20k_enable_mcam_entry() instead of being silently ignored. In rvu_npc_update_flowkey_alg_idx(), treat negative MCAM indices like out-of-range values, and only update RSS actions for promiscuous and all-multi paths when the resolved index is non-negative. Cc: Suman Ghosh Fixes: 6d1e70282f76 ("octeontx2-af: npc: cn20k: Use common APIs") Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260429022722.1110289-11-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 013717353c03b65f5b00a5cefa1515b6b45777b7 Author: Ratheesh Kannoth Date: Wed Apr 29 07:57:21 2026 +0530 octeontx2-af: npc: cn20k: Tear down default MCAM rules explicitly on free npc_cn20k_dft_rules_free() used the NPC MCAM mbox "free all" path, which does not match how cn20k tracks default-rule MCAM slots indexes. Resolve the default-rule indices, then for each valid slot clear the bitmap entry, drop the PF/VF map, disable the MCAM line, clear the target function, and npc_cn20k_idx_free(). Remove any matching software mcam_rules nodes. On hard failure from idx_free, WARN and stop so the box stays up for analysis. In npc_mcam_free_all_entries(), prefetch the same default-rule indices and, on cn20k, skip bitmap clear and idx_free when the scanned entry is one of those reserved defaults (they are released by npc_cn20k_dft_rules_free). Fixes: 09d3b7a1403f ("octeontx2-af: npc: cn20k: Allocate default MCAM indexes") Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260429022722.1110289-10-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit afb474bd4ffc314de766afc295ac64b42856f48e Author: Ratheesh Kannoth Date: Wed Apr 29 07:57:20 2026 +0530 octeontx2-af: npc: cn20k: Initialize default-rule index outputs up front npc_cn20k_dft_rules_idx_get() wrote USHRT_MAX into individual outputs only on some error paths (lbk promisc lookup, VF ucast lookup, and the PF rule walk), which could leave other caller slots stale across retries. Set every non-NULL bcast/mcast/promisc/ucast pointer to USHRT_MAX once at entry, then drop the duplicate assignments on failure. Successful lookups still overwrite the relevant slot before returning. Fixes: 09d3b7a1403f ("octeontx2-af: npc: cn20k: Allocate default MCAM indexes") Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260429022722.1110289-9-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit f6803eb070bfb9a5114d16ae15053106bc7842ae Author: Ratheesh Kannoth Date: Wed Apr 29 07:57:19 2026 +0530 octeontx2-af: npc: cn20k: Fix MCAM actions read npc_cn20k_read_mcam_entry() always reloaded action and vtag_action from bank 0 after programming the CAM words. Use the bank returned by npc_get_bank() for the ACTION reads as well, and read those registers once up front so both X2 and X4 paths share the same metadata. Return directly from the X2 keyword path now that the action fields are already populated. Cc: Suman Ghosh Fixes: 6d1e70282f76 ("octeontx2-af: npc: cn20k: Use common APIs") Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260429022722.1110289-8-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 2b6d6bb7282c34dd8c04ee782393231acf5a26e2 Author: Ratheesh Kannoth Date: Wed Apr 29 07:57:18 2026 +0530 octeontx2-af: npc: cn20k: Fix bank value For X4 keys its loop reused the bank parameter as the loop counter, so bank no longer reflected the caller's bank after the loop and the control flow was hard to follow. Program NPC_AF_CN20K_MCAMEX_BANKX_CFG_EXT directly in npc_cn20k_config_mcam_entry(): one CFG write for X2 using the computed bank, and one CFG write per bank inside the X4 action loop. Enable the entry at the end with npc_cn20k_enable_mcam_entry(..., true) instead of embedding the enable bit in bank_cfg via the removed helper. Cc: Suman Ghosh Fixes: 4e527f1e5c15 ("octeontx2-af: npc: cn20k: Add new mailboxes for CN20K silicon") Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260429022722.1110289-7-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit d2dabf09632c84b7acdc0fb2eeb6b6fe9c0f9106 Author: Ratheesh Kannoth Date: Wed Apr 29 07:57:17 2026 +0530 octeontx2-af: npc: cn20k: Clear MCAM entries by index and key width Replace the old four-argument CN20K MCAM clear with a per-bank static helper and npc_cn20k_clear_mcam_entry() that takes a logical MCAM index, resolves the key width via npc_mcam_idx_2_key_type(), and clears either one bank (X2) or every bank (X4). Call it from npc_clear_mcam_entry() on cn20k and log when key-type lookup fails. Use the per-bank helper from npc_cn20k_config_mcam_entry() for pre-program clears. For loopback VFs, use the promisc MCAM index as ucast_idx when copying RSS action for promisc, matching cn20k default-rule layout. Cc: Suman Ghosh Fixes: 6d1e70282f76 ("octeontx2-af: npc: cn20k: Use common APIs") Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260429022722.1110289-6-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit d7e5940c4c508df73b15d9bc29628a83b3674fff Author: Ratheesh Kannoth Date: Wed Apr 29 07:57:16 2026 +0530 octeontx2-af: npc: cn20k: Fix target map and rule npc_defrag_move_vdx_to_free() disables, copies, and enables the MCAM entry at a new index but previously left entry2target_pffunc[] and the mcam_rules list still keyed to the old index. Copy the target PF association to the new slot, clear the old one, and retarget the rule entry so software state matches the relocated hardware context. Fixes: 645c6e3c1999 ("octeontx2-af: npc: cn20k: virtual index support") Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260429022722.1110289-5-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit adb5ff41efbc0a9d86fabf880076973379db6e49 Author: Ratheesh Kannoth Date: Wed Apr 29 07:57:15 2026 +0530 octeontx2-af: npc: cn20k: Propagate errors in defrag MCAM alloc rollback npc_defrag_alloc_free_slots() allocates MCAM indexes in up to two passes on bank0 then bank1. On failure it rolls back by freeing entries already placed in save[]. __npc_subbank_alloc() can return a negative errno while only part of the indexes are valid. The rollback loop used rc for npc_mcam_idx_2_subbank_idx() as well, so a successful lookup stored zero in rc and a later __npc_subbank_free() failure could still end with return 0 when the allocation path had also left rc at zero (for example shortfall after zero return values from the alloc helpers). Jump to the rollback path immediately when either __npc_subbank_alloc() call fails, preserving its errno. If both calls succeed but the total allocated count is still less than cnt, set rc to -ENOSPC before rollback. Use a separate err variable for npc_mcam_idx_2_subbank_idx() so a successful lookup no longer clears a non-zero rc from the allocation phase. Cc: Dan Carpenter Fixes: 645c6e3c1999 ("octeontx2-af: npc: cn20k: virtual index support") Link: https://lore.kernel.org/netdev/adjNJEpILRZATB2N@stanley.mountain/ Reviewed-by: Simon Horman Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260429022722.1110289-4-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 1100af13fd14b523f1b0634c14be497b41c78958 Author: Ratheesh Kannoth Date: Wed Apr 29 07:57:14 2026 +0530 octeontx2-af: npc: cn20k: Drop debugfs_create_file() error checks in init debugfs is not intended to be checked for allocation failures the way other kernel APIs are: callers should not fail probe or subsystem init because a debugfs node could not be created, including when debugfs is disabled in Kconfig. Replacing NULL checks with IS_ERR() checks is similarly wrong for optional debugfs. Remove dentry checks and -EFAULT returns from npc_cn20k_debugfs_init(). See: https://staticthinking.wordpress.com/2023/07/24/ debugfs-functions-are-not-supposed-to-be-checked/ Cc: Dan Carpenter Fixes: 528530dff56b ("octeontx2-af: npc: cn20k: add debugfs support") Link: https://lore.kernel.org/netdev/adjNGPWKMOk3KgWL@stanley.mountain/ Reviewed-by: Simon Horman Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260429022722.1110289-3-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit aaadccde312f1f6c752461e015adcaa25d463cbc Author: Ratheesh Kannoth Date: Wed Apr 29 07:57:13 2026 +0530 octeontx2-af: npc: cn20k: Propagate MCAM key-type errors on cn20k npc_mcam_idx_2_key_type() can fail; callers used to ignore it and still used kw_type when enabling, configuring, copying, and reading MCAM entries. That could program or decode hardware with an undefined key type. Return -EINVAL when key-type lookup fails. Return -EINVAL from npc_cn20k_copy_mcam_entry() when src and dest key types differ instead of failing silently. Change npc_cn20k_{enable,config,copy,read}_mcam_entry() to return int on success or error. Thread those errors through the cn20k MCAM write and read mbox handlers, the cn20k baseline steer read path, NPC defrag move (disable/copy/enable with dev_err and -EFAULT), and the DMAC update path in rvu_npc_fs.c. Make npc_copy_mcam_entry() return int so the cn20k branch can return npc_cn20k_copy_mcam_entry() without a void/int mismatch, and fail NPC_MCAM_SHIFT_ENTRY when copy fails. Cc: Suman Ghosh Cc: Dan Carpenter Fixes: 6d1e70282f76 ("octeontx2-af: npc: cn20k: Use common APIs") Link: https://lore.kernel.org/netdev/adiQJvuKlEhq2ILx@stanley.mountain/ Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260429022722.1110289-2-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 8c0f9cd1df41ee029711baca839b99d9592c5dd4 Merge: 4f12ee0a4d06ba ecea4f0e9db2fb Author: Mark Brown Date: Fri May 1 10:14:39 2026 +0900 spi: cadence: Probe and unbind fixes Several fixes from Johan for issues with unbind and error handling in probe. commit 4f12ee0a4d06ba777adc840b22350020dfd35fcf Merge: 8d0189c1ea98b5 5e8bb0cc72f1d5 Author: Mark Brown Date: Fri May 1 10:12:57 2026 +0900 spi: cadence-quadspi: Probe and unbind fixes Several fixes from Johan for probe failure and unbind issues in the cadence-quadspi driver. commit 75df490c9e8457990c8b227650f6491218ce018b Author: Lorenzo Bianconi Date: Wed Apr 29 14:02:31 2026 +0200 net: airoha: Move entries to queue head in case of DMA mapping failure in airoha_dev_xmit() In order to respect the original descriptor order and avoid any potential IOMMU fault or memory corruption, move pending queue entries to the head of hw queue tx_list if the DMA mapping of current inflight packet fails in airoha_dev_xmit routine. Fixes: 3f47e67dff1f7 ("net: airoha: Add the capability to consume out-of-order DMA tx descriptors") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260429-airoha-xmit-unmap-error-path-v2-1-32e43b7c6d25@kernel.org Signed-off-by: Jakub Kicinski commit 7a33345153eeeda195c55f15be27074e4c3b5109 Author: Jiawen Wu Date: Wed Apr 29 16:37:43 2026 +0800 net: libwx: use request_irq for VF misc interrupt Currently, request_threaded_irq() is used with a primary handler but a NULL threaded handler, while also setting the IRQF_ONESHOT flag. This specific combination triggers a WARNING since the commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler"). WARNING: kernel/irq/manage.c:1502 at __setup_irq+0x4fa/0x760 Fix the issue by switching to request_irq(), which is the appropriate interface or a non-threaded interrupt handler, and removing the unnecessary IRQF_ONESHOT flag. Fixes: eb4898fde1de ("net: libwx: add wangxun vf common api") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/786DDC7D5CCA6D0A+20260429083743.88961-2-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 694de316f607fe2473d52ca0707e3918e72c1562 Author: Jiawen Wu Date: Wed Apr 29 16:37:42 2026 +0800 net: libwx: fix VF illegal register access Register WX_CFG_PORT_ST is a PF restricted register. When a VF is initialized, attempting to read this register triggers an illegal register access, which lead to a system hang. When the device is VF, the bus function ID can be obtained directly from the PCI_FUNC(pdev->devfn). Fixes: a04ea57aae37 ("net: libwx: fix device bus LAN ID") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/4D1F4452D21DE107+20260429083743.88961-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 26fd6bff2c050196005312d1d306889220952a99 Merge: cae4ef6f9a3ac7 135ac3b84bceda Author: Linus Torvalds Date: Thu Apr 30 17:36:48 2026 -0700 Merge tag 'mtd/fixes-for-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd fixes from Miquel Raynal: "Besides an out-of-bound bug, this is about properly supporting Winbond octal SPI NAND chips which use a specific pattern for stuffing more address bits in some operations. This uses the spi-mem flag in SPI NAND that was added to the spi-mem layer just before the merge window through the spi tree" * tag 'mtd/fixes-for-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: spinand: winbond: Fix ODTR write VCR on W35NxxJW mtd: spinand: winbond: Set the packed page read flag to W35N02/04JW mtd: spinand: Add support for packed read data ODTR commands mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() commit 26ebd12e67bfc3543d77ce586c33ef29fcafab20 Author: Wei Fang Date: Wed Apr 29 16:19:30 2026 +0800 net: enetc: fix VSI mailbox timeout handling and DMA lifecycle In the current VSI mailbox implementation, the VSI allocates a DMA buffer to store the message sent to the PSI. When the PSI receives the message request from the VSI, the hardware copies the message data from this DMA buffer to PSI's DMA buffer for processing. When enetc_msg_vsi_send() times out, two scenarios can occur: 1) Use-after-free: If the hardware hasn't completed message copying when the VSI frees the buffer, the hardware may subsequently copy the data from freed memory to PSI's DMA buffer. 2) Message race: If PSI hasn't processed the previous message when the next message is sent, the VSI may receive the previous message's reply, leading to incorrect handling. To address these issues, implement the following changes: - Check the mailbox busy status before sending a new message. If the mailbox is in busy state, it indicates the previous message is still being processed, so return an error immediately. - Add the 'msg' field to struct enetc_si to preserve the DMA buffer information. The caller of enetc_msg_vsi_send() no longer frees the DMA buffer. Instead, defer freeing until it is safe to do so (when mailbox is not busy on next send). - Add cleanup in enetc_vf_remove() to free the last message buffer. This ensures the DMA buffer remains valid during message copying and prevents message reply mismatches. Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260429081930.3259824-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 3744b0964d5267c0b651bcd8f8c25db6bf4ccbac Author: Daniel Borkmann Date: Wed Apr 29 17:46:48 2026 +0200 ipv6: Implement limits on extension header parsing ipv6_{skip_exthdr,find_hdr}() and ip6_{tnl_parse_tlv_enc_lim, protocol_deliver_rcu}() iterate over IPv6 extension headers until they find a non-extension-header protocol or run out of packet data. The loops have no iteration counter, relying solely on the packet length to bound them. For a crafted packet with 8-byte extension headers filling a 64KB jumbogram, this means a worst case of up to ~8k iterations with a skb_header_pointer call each. ipv6_skip_exthdr(), for example, is used where it parses the inner quoted packet inside an incoming ICMPv6 error: - icmpv6_rcv - checksum validation - case ICMPV6_DEST_UNREACH - icmpv6_notify - pskb_may_pull() <- pull inner IPv6 header - ipv6_skip_exthdr() <- iterates here - pskb_may_pull() - ipprot->err_handler() <- sk lookup The per-iteration cost of ipv6_skip_exthdr itself is generally light, but skb_header_pointer becomes more costly on reassembled packets: the first ~1232 bytes of the inner packet are in the skb's linear area, but the remaining ~63KB are in the frag_list where skb_copy_bits is needed to read data. Initially, the idea was to add a configurable limit via a new sysctl knob with default 8, in line with knobs from commit 47d3d7ac656a ("ipv6: Implement limits on Hop-by-Hop and Destination options"), but two reasons eventually argued against it: - It adds to UAPI that needs to be maintained forever, and upcoming work is restricting extension header ordering anyway, leaving little reason for another sysctl knob - exthdrs_core.c is always built-in even when CONFIG_IPV6=n, where struct net has no .ipv6 member, so the read site would need an ifdef'd fallback to a constant anyway Therefore, just use a constant (IP6_MAX_EXT_HDRS_CNT). All four extension header walking functions are now bound by this limit. Note that the check in ip6_protocol_deliver_rcu() happens right before the goto resubmit, such that we don't have to have a test for ipv6_ext_hdr() in the fast-path. There's an ongoing IETF draft-iurman-6man-eh-occurrences to enforce IPv6 extension headers ordering and occurrence. The latter also discusses security implications. As per RFC8200 section 4.1, the occurrence rules for extension headers provide a practical upper bound which is 8. In order to be conservative, let's define IP6_MAX_EXT_HDRS_CNT as 12 to leave enough room for quirky setups. In the unlikely event that this is still not enough, then we might need to reconsider a sysctl. Signed-off-by: Daniel Borkmann Reviewed-by: Ido Schimmel Reviewed-by: Eric Dumazet Reviewed-by: Justin Iurman Link: https://patch.msgid.link/20260429154648.809751-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit cae4ef6f9a3ac71094da2b1083f6e2db699a2c1e Merge: 74b54e9b1084cc 36a96eda15bf66 Author: Linus Torvalds Date: Thu Apr 30 17:20:45 2026 -0700 Merge tag 'acpi-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fixes from Rafael Wysocki: "These fix leftover issues in the ACPI Time and Alarm Device (TAD) driver on top of the recently merged updates of it and address assorted issues in the ACPI support code: - Fix removal code ordering in the ACPI TAD driver, refine timer value computations and checks in its RTC class device interface, make it use the __ATTRIBUTE_GROUPS() macro, and fix a comment in it (Rafael Wysocki) - Fix EINJV2 memory error injection in APEI (Tony Luck) - Add missing notifier_block structure forward declaration to acpi_bus.h (Bartosz Golaszewski) - Fix related_cpus inconsistency during CPU hotplug in the ACPI CPPC library (Jinjie Ruan) - Add a quirk to force native backlight on HP OMEN 16 (8A44) in the ACPI video bus driver (Shivam Kalra)" * tag 'acpi-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: bus: add missing forward declaration to acpi_bus.h ACPI: video: force native backlight on HP OMEN 16 (8A44) ACPI: TAD: Fix up a comment in acpi_tad_probe() ACPI: TAD: RTC: Refine timer value computations and checks ACPI: TAD: Use devres for all driver cleanup ACPI: TAD: Use __ATTRIBUTE_GROUPS() macro ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug ACPI: APEI: EINJ: Fix EINJV2 memory error injection ACPICA: Provide #defines for EINJV2 error types commit 74b54e9b1084cc51e2b655500a174214d3c38c0e Merge: 08d0d346666400 c208a2b95811d6 Author: Linus Torvalds Date: Thu Apr 30 17:07:21 2026 -0700 Merge tag 'v7.1-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - multichannel crediting fix - memory allocation improvement for smb2_compound_op - remove some dead code * tag 'v7.1-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: change_conf needs to be called for session setup smb: client: change allocation requirements in smb2_compound_op smb/client: remove unused smb3_parse_opt() commit e027c218c482c6a0ae1948129ccda3b0a2033368 Author: Robert Marko Date: Tue Apr 28 15:41:01 2026 +0200 net: phy: micrel: fix LAN8814 QSGMII soft reset LAN8814 QSGMII soft reset was moved into the probe function to avoid triggering it for each of 4 PHY-s in the package. However, that broke QSGMII link between the MAC and PHY on most LAN8814 PHY-s, specificaly for us on the Microchip LAN969x switch. Reading the QSGMII status registers it was visible that lanes were only partially synced. It looks like the reset timing is crucial, so lets move the reset back into the .config_init function but guard it with phy_package_init_once() to avoid it being triggered on each of 4 PHY-s in the package. Change the probe function to use phy_package_probe_once() for coma and PtP setup. Fixes: 96a9178a29a6 ("net: phy: micrel: lan8814 fix reset of the QSGMII interface") Signed-off-by: Robert Marko Link: https://patch.msgid.link/20260428134138.1741253-1-robert.marko@sartura.hr Signed-off-by: Jakub Kicinski commit 69c54f80f4a7072b51b5b5939185ca5e572be982 Author: Pablo Neira Ayuso Date: Thu Apr 30 16:49:53 2026 +0200 netfilter: flowtable: fix inline pppoe encapsulation in xmit path Address two issues in the inline pppoe encapsulation: - Add needs_gso_segment flag to segment PPPoE packets in software given that there is no GSO support for this. - Use FLOW_OFFLOAD_XMIT_DIRECT since neighbour cache is not available in point-to-point device, use the hardware address that is obtained via flowtable path discovery (ie. fill_forward_path). Fixes: 18d27bed0880 ("netfilter: flowtable: inline pppoe encapsulation in xmit path") Signed-off-by: Pablo Neira Ayuso commit a177ae30f78688f75ef9c6277a152c5d6979b10e Author: Pablo Neira Ayuso Date: Thu Apr 30 16:49:51 2026 +0200 netfilter: flowtable: fix inline vlan encapsulation in xmit path Several issues in the inline vlan support: - The layer 2 encapsulation representation in the tuple takes encap[0] as the outer header and encap[1] as the inner header as seen from the ingress path. Reverse the encap loop to push first the inner then the outer vlan header. - Postpone pushing the layer 2 header once destination device is known. This allows to calculate the needed hearoom via LL_RESERVED_SPACE to accommodate the layer 2 headers. - Add and use nf_flow_vlan_push() as suggested by Eric Woudstra, this is a simplified version of skb_vlan_push() for egress path only. Fixes: c653d5a78f34 ("netfilter: flowtable: inline vlan encapsulation in xmit path") Signed-off-by: Pablo Neira Ayuso commit c9e3878ae2f57fd6786279cf5d9dc6e6e1b52f5a Author: Timur Tabi Date: Thu Apr 30 17:38:29 2026 -0500 Revert "drm/nouveau/gsp: add support for GA100" This reverts commit 20e0c197802c545db220157fafd567a10f2b7672. Despite claiming to add GA100 support, that commit actually has quite a few problems. It falsely claims that there is no VBIOS. GA100 does have a VBIOS, but it has no display engine, so it cannot use the PRAMIN method the read VBIOS and must fall back to using PROM. For whatever reason, the VBIOS on GA100 has an "Init-from-ROM" (IFR) header where the PCI Expansion ROM would normally be found. So to find that ROM, Nouveau needs to parse the IFR header. The commit also falsely claimed that there is no graphics (GR) engine. So rather than try to fix that commit, just revert it and start over from scratch. Signed-off-by: Timur Tabi Link: https://patch.msgid.link/20260430223838.2530778-2-ttabi@nvidia.com Signed-off-by: Danilo Krummrich commit dff205550e714f1cb65f27409586e2612905fa88 Author: Gui-Dong Han Date: Thu Apr 16 21:57:03 2026 +0800 hwmon: (lm63) Add locking to avoid TOCTOU The functions show_fan(), show_pwm1(), show_temp11(), temp2_crit_hyst_show(), and show_lut_temp_hyst() access shared cached data without holding the update lock. This can cause TOCTOU races if the cached values change between the checks and the later calculations. Those cached values are updated in lm63_update_device(). In the general case, the affected functions combine multiple cached values without locking and can therefore observe a mixed old/new snapshot. In addition, show_fan() reads data->fan[nr] locklessly while lm63_update_device() updates data->fan[0] in two steps, which can expose an intermediate torn value and potentially trigger a divide-by-zero error. This means that converting the macro to a function is not sufficient to fix show_fan(). Hold the update lock across the whole read and calculation sequence so that the values remain stable. Check the other functions in the driver as well. Keep them unchanged because they either do not access shared cached values multiple times or already do so under lock. Link: https://lore.kernel.org/linux-hwmon/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: e872c91e726e ("hwmon: (lm63) Add support for unsigned upper temperature limits") Fixes: d216f6809eb6 ("hwmon: (lm63) Expose automatic fan speed control lookup table") Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20260416135703.53262-1-hanguidong02@gmail.com [groeck: Use lm63_update_device() to get driver data in temp2_crit_hyst_store] Signed-off-by: Guenter Roeck commit 39436e1d91ec5000df9de4c681bdadac37ff0e36 Merge: 254f49634ee16a ac2c996675755c Author: Dave Airlie Date: Fri May 1 08:16:33 2026 +1000 Merge tag 'drm-misc-fixes-2026-04-30' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: DRM core and helpers: - calculate framebuffer geometry with format helpers - fix docs appletbdrm: - allocate protocol buffers with kvzalloc() dma-buf: - fix docs imagination: - avoid segfault in debugfs ofdrm: - put PCI device reference on errors udl: - increase USB timeout Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260430064521.GA14957@linux.fritz.box commit 2adc8664018c1cc595c7c0c98474a33c7fe32a85 Author: Miguel Ojeda Date: Sun Apr 26 16:42:01 2026 +0200 rust: allow `clippy::collapsible_if` globally Similar to `clippy::collapsible_match` (globally allowed in the previous commit), the `clippy::collapsible_if` lint [1] can make code harder to read in certain cases. Thus just let developers decide on their own. In addition, remove the existing `expect` we had. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Suggested-by: Gary Guo Link: https://lore.kernel.org/rust-for-linux/DGROP5CHU1QZ.1OKJRAUZXE9WC@garyguo.net/ Link: https://rust-lang.github.io/rust-clippy/master/index.html#collapsible_if [1] Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260426144201.227108-2-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 838d852da8503372f3a1779bfbd1ccb93153ab4e Author: Miguel Ojeda Date: Sun Apr 26 16:42:00 2026 +0200 rust: allow `clippy::collapsible_match` globally The `clippy::collapsible_match` lint [1] can make code harder to read in certain cases [2], e.g. CLIPPY P rust/libmacros.so - due to command line change warning: this `if` can be collapsed into the outer `match` --> rust/pin-init/internal/src/helpers.rs:91:17 | 91 | / if nesting == 1 { 92 | | impl_generics.push(tt.clone()); 93 | | impl_generics.push(tt); 94 | | skip_until_comma = false; 95 | | } | |_________________^ | = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#collapsible_match = note: `-W clippy::collapsible-match` implied by `-W clippy::all` = help: to override `-W clippy::all` add `#[allow(clippy::collapsible_match)]` help: collapse nested if block | 90 ~ TokenTree::Punct(p) if skip_until_comma && p.as_char() == ',' 91 ~ && nesting == 1 => { 92 | impl_generics.push(tt.clone()); 93 | impl_generics.push(tt); 94 | skip_until_comma = false; 95 ~ } | The lint does not have much upside -- when the suggestion may be a good one, it would still read fine when nested anyway. And it is the kind of lint that may easily bias people to just apply the suggestion instead of allowing it. [ In addition, as Gary points out [3], the suggestion is also wrong [4] and in the process of being fixed [5], possibly for Rust 1.97.0: Link: https://lore.kernel.org/rust-for-linux/DI3YV94TH9I3.1SOHW51552497@garyguo.net/ [3] Link: https://github.com/rust-lang/rust-clippy/issues/16875 [4] Link: https://github.com/rust-lang/rust-clippy/pull/16878 [5] - Miguel ] Thus just let developers decide on their own. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Link: https://rust-lang.github.io/rust-clippy/master/index.html#collapsible_match [1] Link: https://lore.kernel.org/rust-for-linux/CANiq72nWYJna_hdFxjQCQZK6yJBrr1Mb86iKavivV0U0BgufeA@mail.gmail.com/ [2] Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260426144201.227108-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 68bf102226cf2199dc609b67c1e847cad4de4b57 Author: Gary Guo Date: Mon Apr 27 16:43:01 2026 +0100 rust: pin-init: fix incorrect accessor reference lifetime When a field has been initialized, `init!`/`pin_init!` create a reference or pinned reference to the field so it can be accessed later during the initialization of other fields. However, the reference it created is incorrectly `&'static` rather than just the scope of the initializer. This means that you can do init!(Foo { a: 1, _: { let b: &'static u32 = a; } }) which is unsound. This is caused by `&mut (*#slot).#ident`, which actually allows arbitrary lifetime, so this is effectively `'static`. Somewhat ironically, the safety justification of creating the accessor is.. "SAFETY: TODO". Fix it by adding `let_binding` method on `DropGuard` to shorten lifetime. This results in exactly what we want for these accessors. The safety and invariant comments of `DropGuard` have been reworked; instead of reasoning about what caller can do with the guard, express it in a way that the ownership is transferred to the guard and `forget` takes it back, so the unsafe operations within the `DropGuard` can be more easily justified. Fixes: 42415d163e5d ("rust: pin-init: add references to previously initialized fields") Cc: stable@vger.kernel.org Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260427-pin-init-fix-v3-2-496a699674dd@garyguo.net [ Reworded for missing word. - Miguel ] Signed-off-by: Miguel Ojeda commit 83ac2870310b694775ab7e8f0244fdd94fc21926 Author: Gary Guo Date: Mon Apr 27 16:43:00 2026 +0100 rust: pin-init: internal: move alignment check to `make_field_check` Instead of having the reference creation serving dual-purpose as both for let bindings and alignment check, detangle them so that the alignment check is done explicitly in `make_field_check`. This is more robust against refactors that may change the way let bindings are created. Cc: stable@vger.kernel.org Reviewed-by: Alice Ryhl Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260427-pin-init-fix-v3-1-496a699674dd@garyguo.net [ Reworded for typo. - Miguel ] Signed-off-by: Miguel Ojeda commit ba6b328588f7cb7cf4aca33bae565c2914d74786 Author: David Gow Date: Sat Apr 25 11:41:23 2026 +0800 rust: arch: um: Fix building 32-bit UML with GCC 32-bit UML builds can be configured either by setting CONFIG_64BIT=n or with SUBARCH=i386. Both work with Rust-for-Linux when clang is the compiler, but when SUBARCH=i386, we don't set a bindgen target correctly if gcc is the compiler. Add the appropriate bindgen target configuration for i386, as is done in Makefile.clang. [ For reference, the errors look like: BINDGEN rust/bindings/bindings_generated.rs error: unsupported option '-mno-sse' for target '' ... error: unknown target triple 'unknown' panicked at .../bindgen-0.72.1/ir/context.rs:562:15: libclang error; possible causes include: ... - Miguel ] Fixes: ab0f4cedc355 ("arch: um: rust: Add i386 support for Rust") Signed-off-by: David Gow Link: https://patch.msgid.link/20260425034125.53866-1-david@davidgow.net [ Added space in title. - Miguel ] Signed-off-by: Miguel Ojeda commit a54c9a13cfc17943afb46f74ccb412666e8967f5 Merge: 08d0d346666400 76872971064133 Author: Jakub Kicinski Date: Thu Apr 30 13:36:49 2026 -0700 Merge branch 'net-mctp-test-minor-kunit-test-fixes' Jeremy Kerr says: ==================== net: mctp: test: minor kunit test fixes This series provides two fixes in the MCTP kunit tests - one exposed by ktr, and one found while debugging the former on different VM configs. ==================== Link: https://patch.msgid.link/20260429-dev-mctp-test-fixes-v1-0-1127b7425809@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit 76872971064133474d9b891da05db8f7586fcc11 Author: Jeremy Kerr Date: Wed Apr 29 16:21:42 2026 +0800 net: mctp: test: Use dev_direct_xmit for TX to our test device In our test cases, we typically feed a packet sequence into the routing code, then inspect the device's TXed skbs to assert specific behaviours. Using dev_queue_xmit() for our TX path introduces a fair bit of complexity between the test packet sequence and the test device's ndo_start_xmit callback; which may mean that the skbs have not hit the device at the point we're inspecting the TXed skb list. Use dev_direct_xmit instead, as we want a direct a path as possible here, and the test dev does not need any queueing, scheduling or flow control. Fixes: 6ab578739a4c ("net: mctp: test: move TX packetqueue from dst to dev") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202604281320.525eee17-lkp@intel.com Signed-off-by: Jeremy Kerr Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260429-dev-mctp-test-fixes-v1-2-1127b7425809@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit 18ed60e33e6c77d62409c1343dec1c61bae3d2e7 Author: Jeremy Kerr Date: Wed Apr 29 16:21:41 2026 +0800 net: mctp: test: use a zeroed struct sockaddr_mctp Invalid sockaddr padding will cause bind() to fail; ensure we have a zeroed address in the testcase. Fixes: 0d8647bc74cb ("net: mctp: don't require a route for null-EID ingress") Signed-off-by: Jeremy Kerr Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260429-dev-mctp-test-fixes-v1-1-1127b7425809@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit d272b8d2dd132de8579e3f79a77bc6ae58214a93 Author: Hui Wang Date: Thu Apr 30 12:53:50 2026 +0800 riscv: cpufeature: Drop this_hwcap clear in T-Head vector workaround The variable this_hwcap is initialized to 0 for each loop, it is not necessary to do the bit clearance since this_hwcap is still 0 at this point, clearing the source_isa is enough here. Signed-off-by: Hui Wang Link: https://patch.msgid.link/20260430045350.22213-1-hui.wang@canonical.com Signed-off-by: Paul Walmsley commit 36a96eda15bf66a18ca472aef9242e57551016ab Merge: ad034486ada586 0c00cfbcfcffa7 ea216d3ae7305a 75141a770f4f82 4b506ea5351a1f Author: Rafael J. Wysocki Date: Thu Apr 30 21:07:06 2026 +0200 Merge branches 'acpi-apei', 'acpi-bus', 'acpi-cppc' and 'acpi-video' Merge assorted ACPI support fixes for 7.1-rc2: - Fix EINJV2 memory error injection in APEI (Tony Luck) - Add missing notifier_block structure forward declaration to acpi_bus.h (Bartosz Golaszewski) - Fix related_cpus inconsistency during CPU hotplug in the ACPI CPPC library (Jinjie Ruan) - Add a quirk to force native backlight on HP OMEN 16 (8A44) in the ACPI video bus driver (Shivam Kalra) * acpi-apei: ACPI: APEI: EINJ: Fix EINJV2 memory error injection ACPICA: Provide #defines for EINJV2 error types * acpi-bus: ACPI: bus: add missing forward declaration to acpi_bus.h * acpi-cppc: ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug * acpi-video: ACPI: video: force native backlight on HP OMEN 16 (8A44) commit 174606451fbb17db506ebaacdd5e203e57773d5f Author: Myeonghun Pak Date: Fri Apr 24 22:50:51 2026 +0900 hwmon: (corsair-psu) Close HID device on probe errors corsairpsu_probe() opens the HID device before sending the device init and firmware-info commands. If either command fails, the error path jumps directly to fail_and_stop and skips hid_hw_close(). Use the existing fail_and_close label for those post-open failures so the open count and low-level close callback are balanced before hid_hw_stop(). Fixes: d115b51e0e56 ("hwmon: add Corsair PSU HID controller driver") Cc: stable@vger.kernel.org Signed-off-by: Myeonghun Pak Reviewed-by: Wilken Gottwalt Link: https://lore.kernel.org/r/20260424135107.13720-1-mhun512@gmail.com Signed-off-by: Guenter Roeck commit 1a1414c675ee1b637bbe3840241555a49c61b123 Author: Sasha Levin Date: Sat Apr 25 20:03:19 2026 -0400 hwmon: Remove stale CONFIG_SENSORS_SBRMI Makefile reference kconfiglint reports: X001: CONFIG_SENSORS_SBRMI referenced in Makefile but not defined in any Kconfig The SB-RMI hardware monitoring driver was originally introduced in commit 5a0f50d110b3 ("hwmon: Add support for SB-RMI power module") with both a Kconfig entry (CONFIG_SENSORS_SBRMI) and a Makefile line (obj-$(CONFIG_SENSORS_SBRMI) += sbrmi.o) in drivers/hwmon/. Commit e156586764050 ("hwmon/misc: amd-sbi: Move core sbrmi from hwmon to misc") moved the driver to drivers/misc/amd-sbi/ to support additional functionality beyond hardware monitoring. That commit correctly removed the Kconfig entry from drivers/hwmon/Kconfig, moved the source file drivers/hwmon/sbrmi.c to drivers/misc/amd-sbi/sbrmi.c, and created new Kconfig/Makefile entries in drivers/misc/amd-sbi/ with a renamed symbol (CONFIG_AMD_SBRMI_I2C). However, the Makefile line in drivers/hwmon/Makefile was not removed in that commit. The orphaned line references a CONFIG symbol that no longer exists and a source file that is no longer present, so it has no effect on the build — but it is dead code that should be cleaned up. Remove the stale Makefile reference. Assisted-by: Claude:claude-opus-4-6 kconfiglint Signed-off-by: Sasha Levin Link: https://lore.kernel.org/r/20260426000319.55908-1-sashal@kernel.org Signed-off-by: Guenter Roeck commit 5ed26ffe57ffca054b7a141ff0c1a07bf3a80f6c Author: Ninad Naik Date: Sat Apr 18 00:44:11 2026 +0530 Documentation: hwmon: fix link to ideapad-laptop.c file The ideapad-laptop.c file now exists inside drivers/platform/x86/lenovo/ directory. Updating the GitHub link to the correct path. Signed-off-by: Ninad Naik Link: https://lore.kernel.org/r/20260417191411.713958-1-ninadnaik07@gmail.com Signed-off-by: Guenter Roeck commit 2da0c1fd01dbd6b22844e8676585153dfc660cbe Author: Sanman Pradhan Date: Thu Apr 16 21:59:40 2026 +0000 hwmon: (ltc2992) Fix u32 overflow in power read path ltc2992_get_power() computes the divisor for mul_u64_u32_div() as r_sense_uohm * 1000. This multiplication overflows u32 when r_sense_uohm exceeds about 4.29 ohms (4294967 micro-ohms), producing a truncated divisor and an incorrect power reading. Cancel the factor of 1000 from both the numerator (VADC_UV_LSB * IADC_NANOV_LSB = 312500000) and the divisor (r_sense_uohm * 1000), giving (VADC_UV_LSB / 1000) * IADC_NANOV_LSB = 312500 as the numerator and plain r_sense_uohm as the divisor. The cancellation is exact because LTC2992_VADC_UV_LSB (25000) is divisible by 1000. This is the read-path counterpart of the write-path fix applied in the preceding patch. Fixes: b0bd407e94b03 ("hwmon: (ltc2992) Add support") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260416215904.101969-3-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit d6cc7c99bf1f73eda7d565d224d791d16239bb41 Author: Sanman Pradhan Date: Thu Apr 16 21:59:30 2026 +0000 hwmon: (ltc2992) Clamp threshold writes to hardware range ltc2992_set_voltage(), ltc2992_set_current(), and ltc2992_set_power() do not validate the user-supplied value before converting it to a register value. This can result in: 1. Negative input values wrapping to large positive register values. For power, the negative long is implicitly cast to u64 in mul_u64_u32_div(), producing an incorrect value. For voltage and current, the negative converted value wraps when passed to ltc2992_write_reg() as a u32. 2. Intermediate arithmetic exceeding the range representable in u64 on 64-bit platforms. In ltc2992_set_voltage(), (u64)val * 1000 can exceed U64_MAX when val is a large positive long. In ltc2992_set_current(), (u64)val * r_sense_uohm can overflow similarly. In ltc2992_set_power(), the computed value may not fit in u64. 3. Register values exceeding the hardware field width. Voltage and current threshold registers are 12-bit (stored left-justified in 16 bits), and power threshold registers are 24-bit. Without clamping, bits above the field width are truncated in ltc2992_write_reg(). Fix by clamping negative values to zero, clamping positive values to the rounded hardware-representable maximum (the value returned by the read path for a full-scale register) to prevent intermediate overflow, and clamping the converted register value to the hardware field width before writing. The existing conversion formula and rounding behavior are preserved. In the power write path, cancel the factor of 1000 from both the numerator (r_sense_uohm * 1000) and the denominator (VADC_UV_LSB * IADC_NANOV_LSB) to also eliminate a u32 overflow of r_sense_uohm * 1000 when r_sense_uohm exceeds about 4.29 ohms. Fixes: b0bd407e94b03 ("hwmon: (ltc2992) Add support") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260416215904.101969-2-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit 3fe7ecab1a0856aafe1026a35af1621a5c18d53f Author: Thomas Richter Date: Mon Apr 27 07:17:19 2026 +0200 s390/pai: Disable duplicate read of kernel PAI counter value The PAI crypto counter design allows for user space and kernel space PAI counter increment recording. This is achieved by splitting the recording page in half. The upper part of the 4KB page records user space increments of PAI crypto counter and the lower half records kernel space increments. The page itself looks like: lowcore ptr ---> ++++++++++++++++++++++++ |user space area | +----------------------+ |kernel space area | ++++++++++++++++++++++++ User space and kernel space entries are handled via a kernel_offset value when wrting. For PAI crypto counters this offset is 2048 or half of a page size. For PAI NNPA counter design this distinction was not needed. There is no user and kernel space part for the page pointed to by lowcore. The set up is: lowcore ptr ---> ++++++++++++++++++++++++ |user + kernel space | |area | | | ++++++++++++++++++++++++ There is always only one counter value recorded and saved. Depending on number of CPUs and machine load, the number of PAI NNPA counter increment differs between counting (perf stat) and recording (perf record). The number reported by sampling was double the number shown by counting. This was caused by a double read of the PAI NNPA values in function pai_copy(). The first part of that function reads the kernel space part. The offset into the kernel page part must be larger than zero. The second part of that function reads the user space part, which begins of offset zero. This works fine for PAI crypto counters. It fails for PAI NNPA counters because the PMU device driver does not support that feature and has a kernel_offset value of 0x0. Executing both user and kernel space read out might end up reading user space value twice. For the PAI NNPA PMU prohibit the kernel space part read out. Cc: stable@vger.kernel.org Fixes: f12473541356 ("s390/pai_crypto: Rename paicrypt_copy() to pai_copy()") Signed-off-by: Thomas Richter Reviewed-by: Sumanth Korikkar Signed-off-by: Alexander Gordeev commit ef4f741e8627512cb8c82f59a1fc7aacd854aadf Author: Pablo Neira Ayuso Date: Thu Apr 30 16:49:48 2026 +0200 netfilter: flowtable: ensure sufficient headroom in xmit path Check for headroom and call skb_expand_head() like in the IP output path to ensure there is sufficient headroom for the mac header when forwarding this packet as suggested by sashiko. Fixes: b5964aac51e0 ("netfilter: flowtable: consolidate xmit path") Signed-off-by: Pablo Neira Ayuso commit 952e121c96137c73bd3e59bb20a93ef659376947 Author: Fernando Fernandez Mancera Date: Tue Apr 28 12:25:48 2026 +0200 netfilter: xtables: fix L4 header parsing for non-first fragments Multiple targets and matches relies on L4 header to operate. For fragmented packets, every fragment carries the transport protocol identifier, but only the first fragment contains the L4 header. As the 'raw' table can be configured to run at priority -450 (before defragmentation at -400), the target/match can be reached before reassembly. In this case, non-first fragments have their payload incorrectly parsed as a TCP/UDP header. This would be of course a misconfiguration scenario. In most of the cases this just lead to a unreliable behavior for fragmented traffic. Add a fragment check to ensure target/match only evaluates unfragmented packets or the first fragment in the stream. Fixes: 902d6a4c2a4f ("netfilter: nf_defrag: Skip defrag if NOTRACK is set") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 009d203e56dbe8db2589455b9e3644955f30313a Author: Fernando Fernandez Mancera Date: Tue Apr 28 12:25:47 2026 +0200 netfilter: nf_tables: skip L4 header parsing for non-first fragments The tproxy, osf and exthdr (SCTP) expressions rely on the presence of transport layer headers to perform socket lookups, fingerprint matching, or chunk extraction. For fragmented packets, while the IP protocol remains constant across all fragments, only the first fragment contains the actual L4 header. The expressions could be attached to a chain with a priority lower than -400, bypassing defragmentation. Or could be used in stateless environments where defragmentation is not happening at all. This could result in garbage data being used for the matching. Add a check for pkt->fragoff so only unfragmented packets or the first fragment is processed. Fixes: 133dc203d77d ("netfilter: nft_exthdr: Support SCTP chunks") Fixes: 4ed8eb6570a4 ("netfilter: nf_tables: Add native tproxy support") Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 0bf00859d7a5ab685901c36f29df063b825cfaaa Author: Fernando Fernandez Mancera Date: Tue Apr 28 12:25:46 2026 +0200 netfilter: nf_socket: skip socket lookup for non-first fragments Both nft_socket and xt_socket relies on L4 headers to perform socket lookup in the slow path. For fragmented packets, while the IP protocol remains constant across all fragments, only the first fragment contains the actual L4 header. As the expression/match could be attached to a chain with a priority lower than -400, it could bypass defragmentation. Add a check for fragmentation in the lookup functions directly so the problem is handled for both nft_socket and xt_socket at the same time. In addition, future users of the functions would not need to care about this. Fixes: 902d6a4c2a4f ("netfilter: nf_defrag: Skip defrag if NOTRACK is set") Fixes: 554ced0a6e29 ("netfilter: nf_tables: add support for native socket matching") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 08d0d3466664000ba0670e0ef0d447f23459e0d4 Merge: 6cd70263a6c6ce 1e01abec856593 Author: Linus Torvalds Date: Thu Apr 30 08:45:43 2026 -0700 Merge tag 'net-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter. Current release - regressions: - ipmr: free mr_table after RCU grace period. Previous releases - regressions: - core: add net_iov_init() and use it to initialize ->page_type - sched: taprio: fix NULL pointer dereference in class dump - netfilter: nf_tables: - use list_del_rcu for netlink hooks - fix strict mode inbound policy matching - tcp: make probe0 timer handle expired user timeout - vrf: fix a potential NPD when removing a port from a VRF - eth: ice: - fix NULL pointer dereference in ice_reset_all_vfs() - fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw Previous releases - always broken: - page_pool: fix memory-provider leak in error path - sched: sch_cake: annotate data-races in cake_dump_stats() - mptcp: fix scheduling with atomic in timestamp sockopt - psp: check for device unregister when creating assoc - tls: fix strparser anchor skb leak on offload RX setup failure - eth: - stmmac: prevent NULL deref when RX memory exhausted - airoha: do not read uninitialized fragment address - rtl8150: fix use-after-free in rtl8150_start_xmit() Misc: - add Ido Schimmel as IPv4/IPv6 maintainer - add David Heidelberg as NFC subsystem maintainer" * tag 'net-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (79 commits) net/sched: cls_flower: revert unintended changes sfc: fix error code in efx_devlink_info_running_versions() net: tls: fix strparser anchor skb leak on offload RX setup failure ice: add dpll peer notification for paired SMA and U.FL pins ice: fix missing dpll notifications for SW pins dpll: export __dpll_pin_change_ntf() for use under dpll_lock ice: fix SMA and U.FL pin state changes affecting paired pin ice: fix missing SMA pin initialization in DPLL subsystem ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw ice: fix NULL pointer dereference in ice_reset_all_vfs() iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler iavf: wait for PF confirmation before removing VLAN filters iavf: stop removing VLAN filters from PF on interface down iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING page_pool: fix memory-provider leak in page_pool_create_percpu() error path bonding: 3ad: implement proper RCU rules for port->aggregator net: airoha: Do not return err in ndo_stop() callback hv_sock: fix ARM64 support MAINTAINERS: update the IPv4/IPv6 entry and add Ido Schimmel selftests: drv-net: clarify linters and frameworks in README ... commit 6cd70263a6c6ceb677a679eba61a0a798d2338d5 Merge: 2aa0a369171125 163f6494233e16 Author: Linus Torvalds Date: Thu Apr 30 08:35:36 2026 -0700 Merge tag 'ata-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fix from Niklas Cassel: - Fix a reference leak on device_register() failure in pata_parport * tag 'ata-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: pata_parport: switch to dynamic root device commit 2aa0a3691711257b888d6024a492eb9fd1e8f52a Merge: e75a43c7cec459 e052a1f7199260 Author: Linus Torvalds Date: Thu Apr 30 08:29:56 2026 -0700 Merge tag 'sound-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A bunch of small fixes. One minor fix is found in the core side for data race in PCM OSS layer, while remaining changes are various device-specific fixes and quirks. - Core: PCM OSS data race fix - HD-audio: Fixes for TAS2781, CS35L56, and Realtek/Conexant quirks; avoidance of a WARN_ON for HDMI channel mapping - USB-audio: Improvements in UAC3 parsing robustness (leaks, size checks) and fixes for potential endless loops - ASoC: Driver-specific fixes for CS35L56, Intel bytcr_wm5102, Spacemit, AW88395, and others, plus a new quirk for Steam Deck OLED - Misc: A UAF fix in aloop driver, division by zero fix in ua101 driver and leak fixes in caiaq driver" * tag 'sound-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (32 commits) ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0 pages >1 ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi() ALSA: hda/conexant: Fix missing error check for jack detection ALSA: hda: Avoid WARN_ON() for HDMI chmap slot checks ALSA: usb-audio: Fix quirk entry placement for PreSonus AudioBox USB ASoC: spacemit: adjust FIFO trigger threshold to half FIFO size ASoC: spacemit: move hw constraints from hw_params to startup ASoC: codecs: ab8500: Fix casting of private data ASoC: cs35l56: Fix illegal writes to OTP_MEM registers ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams ALSA: caiaq: Don't abort when no input device is available ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path ASoC: aw88395: Fix kernel panic caused by invalid GPIO error pointer ALSA: caiaq: fix usb_dev refcount leak on probe failure sound: ua101: fix division by zero at probe ALSA: usb-audio: apply quirk for Playstation PDP Riffmaster ALSA: hda: Remove duplicate cmedia entries in codecs Makefile ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A315-44P ... commit 92a8b5e2eff6920bf815cd6a80b088ec3fdf01a3 Author: Yuriy Padlyak Date: Thu Apr 30 01:09:03 2026 +0300 ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 The Xiaomi Mi Laptop Pro 15 (TM1905, subsystem 1d72:1905) ships with the Realtek ALC256 codec on Intel Comet Lake PCH-LP. After S3 resume the codec sets coefficient register 0x10 to 0x0220 instead of 0x0020 — bit 9 is erroneously set, which silences the internal speaker. Bluetooth and HDMI audio are unaffected because they use different paths. This is the same mechanism fixed for Clevo NJ51CU by commit edca7cc4b0ac ("ALSA: hda/realtek: Fix quirk for Clevo NJ51CU"), but the existing ALC256_FIXUP_MIC_NO_PRESENCE_AND_RESUME also reconfigures pin 0x19 as a front mic, which is wrong for this Xiaomi where pin 0x19 default is 0x411111f0 (disabled). Add a minimal fixup that only clears the stuck coef bit, and add the Xiaomi SSID to the quirk table. Verified by reading coef 0x10 with hda-verb after resume (returns 0x0220), writing 0x0020, and confirming the internal speaker resumes output. With this fixup applied the bit is cleared on every codec init, including post-resume. Signed-off-by: Yuriy Padlyak Cc: Tested-by: Yuriy Padlyak Link: https://patch.msgid.link/20260429220903.14918-1-yuriypadlyak@gmail.com Signed-off-by: Takashi Iwai commit 99ebc509eef52675ae5bae86aa2a53e15594e4a3 Author: Qi Zheng Date: Wed Apr 29 15:31:05 2026 +0800 mm: memcontrol: fix rcu unbalance in get_non_dying_memcg_end() Currently, get_non_dying_memcg_start() and get_non_dying_memcg_end() both evaluate cgroup_subsys_on_dfl(memory_cgrp_subsys) independently to determine whether to acquire or release the RCU read lock. However, the result of cgroup_subsys_on_dfl() can change dynamically at runtime due to cgroup hierarchy rebinding (e.g., when the memory controller is moved between cgroup v1 and v2 hierarchies). This can cause the following warning: ===================================== WARNING: bad unlock balance detected! 7.0.0-next-20260420+ #83 Tainted: G W ------------------------------------- memcg-repro/270 is trying to release lock (rcu_read_lock) at: [] rcu_read_unlock+0x17/0x60 but there are no more locks to release! other info that might help us debug this: 1 lock held by memcg-repro/270: #0: ffff888102fa2088 (vm_lock){++++}-{0:0}, at: do_user_addr_fault+0x285/0x880 stack backtrace: CPU: 0 UID: 0 PID: 270 Comm: memcg-repro Tainted: G W 7.0.0-next-20260420+ # Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: ? rcu_read_unlock+0x17/0x60 dump_stack_lvl+0x77/0xb0 print_unlock_imbalance_bug+0xe0/0xf0 ? rcu_read_unlock+0x17/0x60 lock_release+0x21d/0x2a0 rcu_read_unlock+0x1c/0x60 do_pte_missing+0x233/0xb40 __handle_mm_fault+0x80e/0xcd0 handle_mm_fault+0x146/0x310 do_user_addr_fault+0x303/0x880 exc_page_fault+0x9b/0x270 asm_exc_page_fault+0x26/0x30 RIP: 0033:0x5590e4eb41ea Code: 61 cc 66 0f 6f e0 66 0f 61 c2 66 0f db cd 66 0f 69 e2 66 0f 6f d0 66 0f 69 d4 66 0f 61 0 RSP: 002b:00007ffcad25f030 EFLAGS: 00010202 RAX: 00005590e4eb8010 RBX: 00007ffcad260f7d RCX: 00007f73c474d44d RDX: 00005590e4eb80a0 RSI: 00005590e4eb503c RDI: 000000000000000f RBP: 00005590e4eb70a0 R08: 0000000000000000 R09: 00007f73c483a680 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffcad25f180 R14: 00005590e4eb6dd8 R15: 00007f73c4869020 ------------[ cut here ]------------ Fix this by explicitly tracking the RCU lock state, ensuring that rcu_read_unlock() in get_non_dying_memcg_end() is strictly paired with the lock acquisition, regardless of any runtime rebinding events. Link: https://lore.kernel.org/20260429073105.44472-1-qi.zheng@linux.dev Fixes: 8285917d6f38 ("mm: memcontrol: prepare for reparenting non-hierarchical stats") Signed-off-by: Qi Zheng Acked-by: Shakeel Butt Reviewed-by: Muchun Song Cc: Johannes Weiner Cc: Michal Hocko Cc: Qi Zheng Cc: Roman Gushchin Signed-off-by: Andrew Morton commit 17666e2d7592c3e85260cafd3950121524acc2c5 Author: Jens Axboe Date: Mon Apr 27 14:29:02 2026 -0600 io_uring/tw: serialize ctx->retry_llist with ->uring_lock The DEFER_TASKRUN local task work paths all run under ctx->uring_lock, which serializes them with each other and with the rest of the ring's hot paths. io_move_task_work_from_local() is the exception - it's called from io_ring_exit_work() on a kworker without holding the lock and from the iopoll cancelation side right after dropping it. ->work_llist is fine with this, as it's only ever updated via the expected paths. But the ->retry_llist is updated while runing, and hence it could potentially race between normal task_work running and the task-has-exited shutdown path. Simply grab ->uring_lock while moving the local work to the fallback list for exit purposes, which nicely serializes it across both the normal additions and the exit prune path. Cc: stable@vger.kernel.org Fixes: f46b9cdb22f7 ("io_uring: limit local tw done") Reported-by: Robert Femmer Reported-by: Christian Reitter Reported-by: Michael Rodler Signed-off-by: Jens Axboe commit 863810d4985ad214f70c1623f24384ccc850f2a2 Author: Yufei CHENG Date: Mon Apr 27 00:50:34 2026 +0800 platform/x86: lenovo: wmi-other: Fix uninitialized variable in lwmi_om_hwmon_write() When the flag relax_fan_constraint is set, local variable 'raw' is never assigned, and lwmi_om_hwmon_write() will pass uninitialized value to lwmi_om_fan_get_set() resulting in undefined behavior. This flag allows user to bypass minimum fan RPM divisor rounding, but assignment to 'raw' only happens in the non-relaxed path. Fix by defaulting 'raw' to user provided 'val' in the else branch. Fixes: 51ed34282f63 ("platform/x86: lenovo-wmi-other: Add HWMON for fan reporting/tuning") Reviewed-by: Rong Zhang Signed-off-by: Yufei CHENG Link: https://patch.msgid.link/20260426165034.9073-1-cd345al@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c2d4b76458c9ebf81eae2916970320f1f61ad002 Author: Krishna Chomal Date: Wed Apr 29 23:39:53 2026 +0530 platform/x86: hp-wmi: silence unknown board warning for 8D41 The HP Omen Max 16-ah0xxx, DMI board ID 8D41 is currently marked with victus_s_thermal_params in the victus_s_thermal_profile_boards[] list. This disables thermal profile readback and adds a dmesg warning during driver init for "unknown board". After testing we know that (similar to another HP Omen Max 16 device, board ID 8D87), the embedded controller on this board does not expose thermal profile which means we have to intentionally disable EC readback. Changing its driver_data to omen_v1_no_ec_thermal_params is sufficient to silence the warning. Tested-by: Benjamin Y Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20260429180953.129885-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d3b7a868f1aeb6a43de880a3709ef3a0341f2c2a Author: Kurt Borja Date: Wed Apr 29 08:20:56 2026 -0500 platform/wmi: Fix unchecked min_size in wmidev_invoke_method() After calling wmidev_evaluate_method(), if the ACPI core does not return an out object, then wmidev_invoke_method() bypasses the min_size check and returns 0. Add a check for min_size if there is not an out object. Fixes: 1aeded2f55f0 ("platform/wmi: Extend wmidev_query_block() to reject undersized data") Closes: https://sashiko.dev/#/patchset/20260406203237.2970-1-W_Armin%40gmx.de Signed-off-by: Kurt Borja Reviewed-by: Armin Wolf Link: https://patch.msgid.link/20260429-invoke-fix-v1-1-ce938eb80cd3@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7dd57d7a6350770dfc283287125c409e995200e0 Author: Karol Wachowski Date: Thu Apr 30 11:56:44 2026 +0200 accel/ivpu: Disallow re-exporting imported GEM objects Prevent re-exporting of imported GEM buffers by adding a custom prime_handle_to_fd callback that checks if the object is imported and returns -EOPNOTSUPP if so. Re-exporting imported GEM buffers causes loss of buffer flags settings, leading to incorrect device access and data corruption. Reported-by: Yametsu Fixes: 57557964b582 ("accel/ivpu: Add support for userptr buffer objects") Reviewed-by: Andrzej Kacprowski Signed-off-by: Karol Wachowski Cc: # v6.19+ commit 1e01abec856593e02cd69fd95b784c10dd46880c Author: Paolo Abeni Date: Wed Apr 29 09:39:11 2026 +0200 net/sched: cls_flower: revert unintended changes While applying the blamed commit 4ca07b9239bd ("net: mctp i2c: check length before marking flow active"), I unintentionally included unrelated and unacceptable changes. Revert them. Fixes: 4ca07b9239bd ("net: mctp i2c: check length before marking flow active") Reported-by: Jeremy Kerr Closes: https://lore.kernel.org/netdev/bd8704fe0bd53e278add5cde4873256656623e2e.camel@codeconstruct.com.au/ Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/043026a53ff84da88b17648c4b0d17f0331749cb.1777447863.git.pabeni@redhat.com Signed-off-by: Paolo Abeni commit 051ffb001b8a232cfa6e72f38bb5f51c4270a60b Author: Dan Carpenter Date: Wed Apr 29 09:48:17 2026 +0300 sfc: fix error code in efx_devlink_info_running_versions() Return -EIO if efx_mcdi_rpc() doesn't return enough space. Fixes: 14743ddd2495 ("sfc: add devlink info support for ef100") Signed-off-by: Dan Carpenter Reviewed-by: Edward Cree Link: https://patch.msgid.link/afGpsbLRHL4_H0KS@stanley.mountain Signed-off-by: Paolo Abeni commit 58689498ca3384851145a754dbb1d8ed1cf9fb54 Author: Jakub Kicinski Date: Tue Apr 28 16:15:59 2026 -0700 net: tls: fix strparser anchor skb leak on offload RX setup failure When tls_set_device_offload_rx() fails at tls_dev_add(), the error path calls tls_sw_free_resources_rx() to clean up the SW context that was initialized by tls_set_sw_offload(). This function calls tls_sw_release_resources_rx() (which stops the strparser via tls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context), but never frees the anchor skb that was allocated by alloc_skb(0) in tls_strp_init(). Note that tls_sw_free_resources_rx() is exclusively used for this "failed to start offload" code path, there's no other caller. The leak did not exist before commit 84c61fe1a75b ("tls: rx: do not use the standard strparser"), because the standard strparser doesn't try to pre-allocate an skb. The normal close path in tls_sk_proto_close() handles cleanup by calling tls_sw_strparser_done() (which calls tls_strp_done()) after dropping the socket lock, because tls_strp_done() does cancel_work_sync() and the strparser work handler takes the socket lock. Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Signed-off-by: Jakub Kicinski Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260428231559.1358502-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 47888597a3b41b5088e758ab8ca36bf624d46327 Merge: 5ef343614db766 9e5dead140af10 Author: Paolo Abeni Date: Thu Apr 30 11:37:42 2026 +0200 Merge branch 'intel-wired-lan-update-2026-04-27-ice-iavf' Jacob Keller says: ==================== Intel Wired LAN Update 2026-04-27 (ice, iavf) Petr Oros from RedHat has accumulated a number of fixes for the Intel ice and iavf drivers, bundled together in this series. First, a series of 4 fixes to resolve issues with the iavf driver logic for handling VLAN filters. This includes keeping VLAN filters while the interface is brought down, waiting for confirmation on filter deletion before deleting filters from the driver tracking structures, and handling the VIRTCHNL_OP_ADD_VLAN for the old v1 VLAN_ADD command. A fix for a crash in ice_reset_all_vfs(), properly checking for errors when ice_vf_rebuild_vsi() fails. A fix for a possible infinite recursion in ice_cfg_tx_topo() that occurs when trying to apply invalid Tx topology configuration. A fix to initialize the SMA pins in the DPLL subsystem properly. A fix to change the SMA and U.FL pin state for paired pins, ensuring that all flows changing one pin will also update its shared pin appropriately. A preparatory patch to export __dpll_pin_change_ntf() so that drivers can notify pin changes while already holding the dpll_lock. A fix to ensure DPLL notifications are sent for the software-controlled pins which wrap the physical CGU input/output pins. A fix to add DPLL notifications for peer pins when changing the SMA or U.FL pins, ensuring DPLL subsystem is notified about the paired connected pins. Signed-off-by: Jacob Keller ==================== Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-0-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit 9e5dead140af10e8b5f975b8f04e46197d48d274 Author: Petr Oros Date: Mon Apr 27 22:22:23 2026 -0700 ice: add dpll peer notification for paired SMA and U.FL pins SMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and SMA2/U.FL2). When one pin's state changes via a PCA9575 GPIO write, the paired pin's state also changes, but no notification is sent for the peer pin. Userspace consumers monitoring the peer via dpll netlink subscribe never learn about the update. Add ice_dpll_sw_pin_notify_peer() which sends a change notification for the paired SW pin. Call it from ice_dpll_pin_sma_direction_set(), ice_dpll_sma_pin_state_set(), and ice_dpll_ufl_pin_state_set() after pf->dplls.lock is released. Use __dpll_pin_change_ntf() because dpll_lock is still held by the dpll netlink layer (dpll_pin_pre_doit). Fixes: 2dd5d03c77e2 ("ice: redesign dpll sma/u.fl pins control") Signed-off-by: Petr Oros Tested-by: Alexander Nowlin Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Aleksandr Loktionov Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-11-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit 1a41b58fd4dc80dca16c717e6e77c88b9d4e83a7 Author: Petr Oros Date: Mon Apr 27 22:22:22 2026 -0700 ice: fix missing dpll notifications for SW pins The SMA/U.FL pin redesign (commit 2dd5d03c77e2 ("ice: redesign dpll sma/u.fl pins control")) introduced software-controlled pins that wrap backing CGU input/output pins, but never updated the notification and data paths to propagate pin events to these SW wrappers. The periodic work sends dpll_pin_change_ntf() only for direct CGU input pins. SW pins that wrap these inputs never receive change or phase offset notifications, so userspace consumers such as synce4l monitoring SMA pins via dpll netlink never learn about state transitions or phase offset updates. Similarly, ice_dpll_phase_offset_get() reads the SW pin's own phase_offset field which is never updated; the PPS monitor writes to the backing CGU input's field instead. Fix by introducing ice_dpll_pin_ntf(), a wrapper around dpll_pin_change_ntf() that also notifies any registered SMA/U.FL pin whose backing CGU input matches. Replace all direct dpll_pin_change_ntf() calls in the periodic notification paths with this wrapper. Fix ice_dpll_phase_offset_get() to return the backing CGU input's phase_offset for input-direction SW pins. Fixes: 2dd5d03c77e2 ("ice: redesign dpll sma/u.fl pins control") Signed-off-by: Petr Oros Tested-by: Alexander Nowlin Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Aleksandr Loktionov Reviewed-by: Ivan Vecera Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-10-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit 620055cb1036a6125fd912e7a14b47a6572b809b Author: Ivan Vecera Date: Mon Apr 27 22:22:21 2026 -0700 dpll: export __dpll_pin_change_ntf() for use under dpll_lock Export __dpll_pin_change_ntf() so that drivers can send pin change notifications from within pin callbacks, which are already called under dpll_lock. Using dpll_pin_change_ntf() in that context would deadlock. Add lockdep_assert_held() to catch misuse without the lock held. Acked-by: Vadim Fedorenko Signed-off-by: Ivan Vecera Signed-off-by: Petr Oros Tested-by: Alexander Nowlin Reviewed-by: Arkadiusz Kubalewski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-9-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit 6f9d8393c9f50fbc68b9c9e99f78ca5a7b43ff44 Author: Petr Oros Date: Mon Apr 27 22:22:20 2026 -0700 ice: fix SMA and U.FL pin state changes affecting paired pin SMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and SMA2/U.FL2) controlled by the PCA9575 GPIO expander. Each pair can only have one active pin at a time: SMA1 output and U.FL1 output share the same CGU output, SMA2 input and U.FL2 input share the same CGU input. The PCA9575 register bits determine which connector in each pair owns the signal path. The driver does not account for this pairing in two places: ice_dpll_ufl_pin_state_set() modifies PCA9575 bits and disables the backing CGU pin without checking whether the U.FL pin is currently active. Disconnecting an already inactive U.FL pin flips bits that the paired SMA pin relies on, breaking its connection. ice_dpll_sma_direction_set() does not propagate direction changes to the paired U.FL pin. For SMA2/U.FL2 the ICE_SMA2_UFL2_RX_DIS bit is never managed, so U.FL2 stays disconnected after SMA2 switches to output. For both pairs the backing CGU pin of the U.FL side is never enabled when a direction change activates it, so userspace sees the pin as disconnected even though the routing is correct. Fix by guarding the U.FL disconnect path against inactive pins and by updating the paired U.FL pin fully on SMA direction changes: manage ICE_SMA2_UFL2_RX_DIS for the SMA2/U.FL2 pair and enable the backing CGU pin whenever the peer becomes active. Fixes: 2dd5d03c77e2 ("ice: redesign dpll sma/u.fl pins control") Signed-off-by: Petr Oros Tested-by: Alexander Nowlin Reviewed-by: Arkadiusz Kubalewski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-8-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit 56a643aed0f0af5c29ebb4593d4917b78344dd48 Author: Petr Oros Date: Mon Apr 27 22:22:19 2026 -0700 ice: fix missing SMA pin initialization in DPLL subsystem The DPLL SMA/U.FL pin redesign introduced ice_dpll_sw_pin_frequency_get() which gates frequency reporting on the pin's active flag. This flag is determined by ice_dpll_sw_pins_update() from the PCA9575 GPIO expander state. Before the redesign, SMA pins were exposed as direct HW input/output pins and ice_dpll_frequency_get() returned the CGU frequency unconditionally — the PCA9575 state was never consulted. The PCA9575 powers on with all outputs high, setting ICE_SMA1_DIR_EN, ICE_SMA1_TX_EN, ICE_SMA2_DIR_EN and ICE_SMA2_TX_EN. Nothing in the driver writes the register during initialization, so ice_dpll_sw_pins_update() sees all pins as inactive and ice_dpll_sw_pin_frequency_get() permanently returns 0 Hz for every SW pin. Fix this by writing a default SMA configuration in ice_dpll_init_info_sw_pins(): clear all SMA bits, then set SMA1 and SMA2 as active inputs (DIR_EN=0) with U.FL1 output and U.FL2 input disabled. Each SMA/U.FL pair shares a physical signal path so only one pin per pair can be active at a time. U.FL pins still report frequency 0 after this fix: U.FL1 (output-only) is disabled by ICE_SMA1_TX_EN which keeps the TX output buffer off, and U.FL2 (input-only) is disabled by ICE_SMA2_UFL2_RX_DIS. They can be activated by changing the corresponding SMA pin direction via dpll netlink. Fixes: 2dd5d03c77e2 ("ice: redesign dpll sma/u.fl pins control") Signed-off-by: Petr Oros Reviewed-by: Ivan Vecera Reviewed-by: Arkadiusz Kubalewski Tested-by: Alexander Nowlin Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-7-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit 70ad216411e030f67b1743774e245601194aee6a Author: Petr Oros Date: Mon Apr 27 22:22:18 2026 -0700 ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw On certain E810 configurations where firmware supports Tx scheduler topology switching (tx_sched_topo_comp_mode_en), ice_cfg_tx_topo() may need to apply a new 5-layer or 9-layer topology from the DDP package. If the AQ command to set the topology fails (e.g. due to invalid DDP data or firmware limitations), the global configuration lock must still be cleared via a CORER reset. Commit 86aae43f21cf ("ice: don't leave device non-functional if Tx scheduler config fails") correctly fixed this by refactoring ice_cfg_tx_topo() to always trigger CORER after acquiring the global lock and re-initialize hardware via ice_init_hw() afterwards. However, commit 8a37f9e2ff40 ("ice: move ice_deinit_dev() to the end of deinit paths") later moved ice_init_dev_hw() into ice_init_hw(), breaking the reinit path introduced by 86aae43f21cf. This creates an infinite recursive call chain: ice_init_hw() ice_init_dev_hw() ice_cfg_tx_topo() # topology change needed ice_deinit_hw() ice_init_hw() # reinit after CORER ice_init_dev_hw() # recurse ice_cfg_tx_topo() ... # stack overflow Fix by moving ice_init_dev_hw() back out of ice_init_hw() and calling it explicitly from ice_probe() and ice_devlink_reinit_up(). The third caller, ice_cfg_tx_topo(), intentionally does not need ice_init_dev_hw() during its reinit, it only needs the core HW reinitialization. This breaks the recursion cleanly without adding flags or guards. The deinit ordering changes from commit 8a37f9e2ff40 ("ice: move ice_deinit_dev() to the end of deinit paths") which fixed slow rmmod are preserved, only the init-side placement of ice_init_dev_hw() is reverted. Fixes: 8a37f9e2ff40 ("ice: move ice_deinit_dev() to the end of deinit paths") Signed-off-by: Petr Oros Reviewed-by: Paul Menzel Reviewed-by: Jacob Keller Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Tested-by: Alexander Nowlin Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-6-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit 54ef02487914c24170c7e1c061e45212dc55365e Author: Petr Oros Date: Mon Apr 27 22:22:17 2026 -0700 ice: fix NULL pointer dereference in ice_reset_all_vfs() ice_reset_all_vfs() ignores the return value of ice_vf_rebuild_vsi(). When the VSI rebuild fails (e.g. during NVM firmware update via nvmupdate64e), ice_vsi_rebuild() tears down the VSI on its error path, leaving txq_map and rxq_map as NULL. The subsequent unconditional call to ice_vf_post_vsi_rebuild() leads to a NULL pointer dereference in ice_ena_vf_q_mappings() when it accesses vsi->txq_map[0]. The single-VF reset path in ice_reset_vf() already handles this correctly by checking the return value of ice_vf_reconfig_vsi() and skipping ice_vf_post_vsi_rebuild() on failure. Apply the same pattern to ice_reset_all_vfs(): check the return value of ice_vf_rebuild_vsi() and skip ice_vf_post_vsi_rebuild() and ice_eswitch_attach_vf() on failure. The VF is left safely disabled (ICE_VF_STATE_INIT not set, VFGEN_RSTAT not set to VFACTIVE) and can be recovered via a VFLR triggered by a PCI reset of the VF (sysfs reset or driver rebind). Note that this patch does not prevent the VF VSI rebuild from failing during NVM update — the underlying cause is firmware being in a transitional state while the EMP reset is processed, which can cause Admin Queue commands (ice_add_vsi, ice_cfg_vsi_lan) to fail. This patch only prevents the subsequent NULL pointer dereference that crashes the kernel when the rebuild does fail. crash> bt PID: 50795 TASK: ff34c9ee708dc680 CPU: 1 COMMAND: "kworker/u512:5" #0 [ff72159bcfe5bb50] machine_kexec at ffffffffaa8850ee #1 [ff72159bcfe5bba8] __crash_kexec at ffffffffaaa15fba #2 [ff72159bcfe5bc68] crash_kexec at ffffffffaaa16540 #3 [ff72159bcfe5bc70] oops_end at ffffffffaa837eda #4 [ff72159bcfe5bc90] page_fault_oops at ffffffffaa893997 #5 [ff72159bcfe5bce8] exc_page_fault at ffffffffab528595 #6 [ff72159bcfe5bd10] asm_exc_page_fault at ffffffffab600bb2 [exception RIP: ice_ena_vf_q_mappings+0x79] RIP: ffffffffc0a85b29 RSP: ff72159bcfe5bdc8 RFLAGS: 00010206 RAX: 00000000000f0000 RBX: ff34c9efc9c00000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff34c9efc9c00000 RBP: ff34c9efc27d4828 R8: 0000000000000093 R9: 0000000000000040 R10: ff34c9efc27d4828 R11: 0000000000000040 R12: 0000000000100000 R13: 0000000000000010 R14: R15: ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ff72159bcfe5bdf8] ice_sriov_post_vsi_rebuild at ffffffffc0a85e2e [ice] #8 [ff72159bcfe5be08] ice_reset_all_vfs at ffffffffc0a920b4 [ice] #9 [ff72159bcfe5be48] ice_service_task at ffffffffc0a31519 [ice] #10 [ff72159bcfe5be88] process_one_work at ffffffffaa93dca4 #11 [ff72159bcfe5bec8] worker_thread at ffffffffaa93e9de #12 [ff72159bcfe5bf18] kthread at ffffffffaa946663 #13 [ff72159bcfe5bf50] ret_from_fork at ffffffffaa8086b9 The panic occurs attempting to dereference the NULL pointer in RDX at ice_sriov.c:294, which loads vsi->txq_map (offset 0x4b8 in ice_vsi). The faulting VSI is an allocated slab object but not fully initialized after a failed ice_vsi_rebuild(): crash> struct ice_vsi 0xff34c9efc27d4828 netdev = 0x0, rx_rings = 0x0, tx_rings = 0x0, q_vectors = 0x0, txq_map = 0x0, rxq_map = 0x0, alloc_txq = 0x10, num_txq = 0x10, alloc_rxq = 0x10, num_rxq = 0x10, The nvmupdate64e process was performing NVM firmware update: crash> bt 0xff34c9edd1a30000 PID: 49858 TASK: ff34c9edd1a30000 CPU: 1 COMMAND: "nvmupdate64e" #0 [ff72159bcd617618] __schedule at ffffffffab5333f8 #4 [ff72159bcd617750] ice_sq_send_cmd at ffffffffc0a35347 [ice] #5 [ff72159bcd6177a8] ice_sq_send_cmd_retry at ffffffffc0a35b47 [ice] #6 [ff72159bcd617810] ice_aq_send_cmd at ffffffffc0a38018 [ice] #7 [ff72159bcd617848] ice_aq_read_nvm at ffffffffc0a40254 [ice] #8 [ff72159bcd6178b8] ice_read_flat_nvm at ffffffffc0a4034c [ice] #9 [ff72159bcd617918] ice_devlink_nvm_snapshot at ffffffffc0a6ffa5 [ice] dmesg: ice 0000:13:00.0: firmware recommends not updating fw.mgmt, as it may result in a downgrade. continuing anyways ice 0000:13:00.1: ice_init_nvm failed -5 ice 0000:13:00.1: Rebuild failed, unload and reload driver Fixes: 12bb018c538c ("ice: Refactor VF reset") Signed-off-by: Petr Oros Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-5-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit 34d33313b52eeac3a97ad2e3176d523ec70d9283 Author: Petr Oros Date: Mon Apr 27 22:22:16 2026 -0700 iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler The V1 ADD_VLAN opcode had no success handler; filters sent via V1 stayed in ADDING state permanently. Add a fallthrough case so V1 filters also transition ADDING -> ACTIVE on PF confirmation. Critically, add an `if (v_retval) break` guard: the error switch in iavf_virtchnl_completion() does NOT return after handling errors, it falls through to the success switch. Without this guard, a PF-rejected ADD would incorrectly mark ADDING filters as ACTIVE, creating a driver/HW mismatch where the driver believes the filter is installed but the PF never accepted it. For V2, this is harmless: iavf_vlan_add_reject() in the error block already kfree'd all ADDING filters, so the success handler finds nothing to transition. Fixes: 968996c070ef ("iavf: Fix VLAN_V2 addition/rejection") Signed-off-by: Petr Oros Reviewed-by: Aleksandr Loktionov Tested-by: Rafal Romanowski Reviewed-by: Przemek Kitszel Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-4-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit bbcbe4ed70dea948849549af7edf44bd42bbd695 Author: Petr Oros Date: Mon Apr 27 22:22:15 2026 -0700 iavf: wait for PF confirmation before removing VLAN filters The VLAN filter DELETE path was asymmetric with the ADD path: ADD waits for PF confirmation (ADD -> ADDING -> ACTIVE), but DELETE immediately frees the filter struct after sending the DEL message without waiting for the PF response. This is problematic because: - If the PF rejects the DEL, the filter remains in HW but the driver has already freed the tracking structure, losing sync. - Race conditions between DEL pending and other operations (add, reset) cannot be properly resolved if the filter struct is already gone. Add IAVF_VLAN_REMOVING state to make the DELETE path symmetric: REMOVE -> REMOVING (send DEL) -> PF confirms -> kfree -> PF rejects -> ACTIVE In iavf_del_vlans(), transition filters from REMOVE to REMOVING instead of immediately freeing them. The new DEL completion handler in iavf_virtchnl_completion() frees filters on success or reverts them to ACTIVE on error. Update iavf_add_vlan() to handle the REMOVING state: if a DEL is pending and the user re-adds the same VLAN, queue it for ADD so it gets re-programmed after the PF processes the DEL. The !VLAN_FILTERING_ALLOWED early-exit path still frees filters directly since no PF message is sent in that case. Also update iavf_del_vlan() to skip filters already in REMOVING state: DEL has been sent to PF and the completion handler will free the filter when PF confirms. Without this guard, the sequence DEL(pending) -> user-del -> second DEL could cause the PF to return an error for the second DEL (filter already gone), causing the completion handler to incorrectly revert a deleted filter back to ACTIVE. Fixes: 968996c070ef ("iavf: Fix VLAN_V2 addition/rejection") Signed-off-by: Petr Oros Reviewed-by: Aleksandr Loktionov Tested-by: Rafal Romanowski Reviewed-by: Przemek Kitszel Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-3-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit f2ce65b9b917474a1a6ce68d357e15fac2aca0f2 Author: Petr Oros Date: Mon Apr 27 22:22:14 2026 -0700 iavf: stop removing VLAN filters from PF on interface down When a VF goes down, the driver currently sends DEL_VLAN to the PF for every VLAN filter (ACTIVE -> DISABLE -> send DEL -> INACTIVE), then re-adds them all on UP (INACTIVE -> ADD -> send ADD -> ADDING -> ACTIVE). This round-trip is unnecessary because: 1. The PF disables the VF's queues via VIRTCHNL_OP_DISABLE_QUEUES, which already prevents all RX/TX traffic regardless of VLAN filter state. 2. The VLAN filters remaining in PF HW while the VF is down is harmless - packets matching those filters have nowhere to go with queues disabled. 3. The DEL+ADD cycle during down/up creates race windows where the VLAN filter list is incomplete. With spoofcheck enabled, the PF enables TX VLAN filtering on the first non-zero VLAN add, blocking traffic for any VLANs not yet re-added. Remove the entire DISABLE/INACTIVE state machinery: - Remove IAVF_VLAN_DISABLE and IAVF_VLAN_INACTIVE enum values - Remove iavf_restore_filters() and its call from iavf_open() - Remove VLAN filter handling from iavf_clear_mac_vlan_filters(), rename it to iavf_clear_mac_filters() - Remove DEL_VLAN_FILTER scheduling from iavf_down() - Remove all DISABLE/INACTIVE handling from iavf_del_vlans() VLAN filters now stay ACTIVE across down/up cycles. Only explicit user removal (ndo_vlan_rx_kill_vid) or PF/VF reset triggers VLAN filter deletion/re-addition. Fixes: ed1f5b58ea01 ("i40evf: remove VLAN filters on close") Signed-off-by: Petr Oros Reviewed-by: Aleksandr Loktionov Tested-by: Rafal Romanowski Reviewed-by: Simon Horman Reviewed-by: Przemek Kitszel Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-2-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit 70d62b669f1f9080a25278fc90b64309f4ae8959 Author: Petr Oros Date: Mon Apr 27 22:22:13 2026 -0700 iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING Rename the IAVF_VLAN_IS_NEW state to IAVF_VLAN_ADDING to better describe what the state represents: an ADD request has been sent to the PF and is waiting for a response. This is a pure rename with no behavioral change, preparing for a cleanup of the VLAN filter state machine. Signed-off-by: Petr Oros Reviewed-by: Aleksandr Loktionov Tested-by: Rafal Romanowski Reviewed-by: Simon Horman Reviewed-by: Przemek Kitszel Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-1-cdcb48303fd8@intel.com Signed-off-by: Paolo Abeni commit 100201d349edd226ca3470c894c92dccc67ee7a8 Author: Fabio Porcedda Date: Mon Apr 27 11:17:46 2026 +0200 USB: serial: option: add Telit Cinterion LE910Cx compositions Add the following Telit Cinterion LE910Cx compositions: 0x1251: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (SAP) T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=108 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1251 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=ff Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms 0x1253: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (SAP) T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=121 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1253 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms 0x1254: tty (AT) + tty (AT) T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=122 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1254 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms 0x1255: tty (AT/NMEA) + tty (AT) + tty (AT) + tty (SAP) T: Bus=01 Lev=01 Prnt=21 Port=06 Cnt=01 Dev#=123 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1255 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms Cc: stable@vger.kernel.org Signed-off-by: Fabio Porcedda Signed-off-by: Johan Hovold commit e6a650acbd991bba279f2580853aed9a8d166e6f Author: Helge Deller Date: Wed Apr 29 21:18:25 2026 +0200 parisc: Fix build failure for 32-bit kernel with PA2.0 instruction set The CONFIG_PA11 option can not be used as a reliable check if we build a 32-bit kernel which needs the 32-bit VDSO. Instead depend on CONFIG_64BIT and CONFIG_COMPAT only. Reported-by: Christoph Biedl Tested-by: Christoph Biedl Signed-off-by: Helge Deller commit 22d0213e55fbb723c2c00dd5aa855a6eaad95b23 Author: Petr Tesarik Date: Fri Apr 10 13:35:06 2026 +0200 dma-direct: fix use of max_pfn Calculate the correct physical address of the last byte of memory. Since max_pfn is in fact "the PFN of the first page after the highest system RAM in physical address space", the highest address that might be used for a DMA buffer is one byte below max_pfn << PAGE_SHIFT. This fix is unlikely to make any difference in practice. It's just that the current formula is slightly confusing. Signed-off-by: Petr Tesarik Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260410113506.262579-1-ptesarik@suse.com commit 63bac027860308d1344f761cb47aabb3b30973fd Author: Florian Westphal Date: Wed Apr 29 08:21:35 2026 +0200 netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables sashiko says: could the related code in __nf_tables_abort() leak the struct nft_hook objects when the table is dormant? In __nf_tables_abort(), when rolling back a NEWCHAIN transaction that updates hooks, the code conditionally unregisters and frees the hooks only if the table is not dormant [..] if (!(table->flags & NFT_TABLE_F_DORMANT)) { nft_netdev_unregister_hooks(net, &nft_trans_chain_hooks(trans), true); } ... nft_trans_destroy(trans); Unfortunately netdev family mixes hook registration and allocation. Push table struct down and only check for the flag to unregister. Fixes: 216e7bf7402c ("netfilter: nf_tables: skip netdev hook unregistration if table is dormant") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 8bedb6c46945752a688d9b0cf2021e0e68b1876c Author: Florian Westphal Date: Tue Apr 28 19:37:57 2026 +0200 netfilter: xt_CT: fix usersize for v1 and v2 revision While resurrecting the conntrack-tool test cases I found following bug: In: iptables -I OUTPUT -t raw -p 13 -j CT --timeout test-generic Out: [0:0] -A OUTPUT -p 13 -j CT --timeout test Data after first four bytes of the timeout policy name is never copied to userspace because its treated as kernel-only. Fixes: ec2318904965 ("xtables: extend matches and targets with .usersize") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 2f768d638d977eff824f64dcc9639e3fea32da8f Author: Pablo Neira Ayuso Date: Tue Apr 28 19:04:07 2026 +0200 netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate Several matches and one target check that the hook is correct from checkentry(), however, the basechain is only available from nft_table_validate(). This patch uses xt_check_hooks_{match,target}() from the nft_compat expression .validate path. This patch sets the table in the nft_ctx struct in nft_table_validate() which is required by this patch. Based on patch from Florian Westphal. Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") Reported-by: Xiang Mei Signed-off-by: Pablo Neira Ayuso commit 6813985ca456d1f5677ad9554f55805cbf27e16f Author: Pablo Neira Ayuso Date: Tue Apr 28 17:35:18 2026 +0200 netfilter: x_tables: add .check_hooks to matches and targets Add a new .check_hooks interface for checking if the match/target is used from the validate hook according to its configuration. Move existing conditional hook check based on the match/target configuration from .checkentry to .check_hooks for the following matches/targets: - addrtype - devgroup - physdev - policy - set - TCPMSS - SET This is a preparation patch to fix nft_compat, not functional changes are intended. Based on patch from Florian Westphal. Signed-off-by: Pablo Neira Ayuso commit e75a43c7cec459a07d91ed17de4de13ede2b7758 Merge: 57b8e2d666a31f b2aa3b4d64e460 Author: Linus Torvalds Date: Wed Apr 29 22:21:44 2026 -0700 Merge tag 'trace-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix inverted check of registering the stats for branch tracing When calling register_stat_tracer() which returns zero on success and negative on error, the callers were checking the return of zero as an error and printing a warning message. Because this was just a normal printk() message and not a WARN(), it wasn't caught in any testing. Fix the check to print the warning message when an error actually happens. - Fix a typo in a comment in tracepoint.h - Limit the size of event probes to 3K in size It is possible to create a dynamic event probe via the tracefs system that is greater than the max size of an event that the ring buffer can hold. This basically causes the event to become useless. Limit the size of an event probe to be 3K as that should be large enough to handle any dynamic events being created, and fits within the PAGE_SIZE sub-buffers of the ring buffer. * tag 'trace-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/probes: Limit size of event probe to 3K tracepoint: Fix typo in tracepoint.h comment tracing: branch: Fix inverted check on stat tracer registration commit 7dfc0063022078a80fe5774815723c185e4b7b57 Author: Arnd Bergmann Date: Wed Apr 29 15:57:34 2026 +0200 regulator: rpi-panel-attiny: add back GPIOLIB dependency This driver provides a gpio chip, which is only possible when GPIOLIB is enabled, which was previously guaranteed by the CONFIG_OF_GPIO dependency that is now gone: ERROR: modpost: "gpiochip_get_data" [drivers/regulator/rpi-panel-attiny-regulator.ko] undefined! ERROR: modpost: "devm_gpiochip_add_data_with_key" [drivers/regulator/rpi-panel-attiny-regulator.ko] undefined! Add an explicit GPIOLIB dependency instead. Fixes: bf017304fce1 ("regulator: drop unneeded dependencies on OF_GPIO") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260429135812.112514-1-arnd@kernel.org Signed-off-by: Mark Brown commit f2abc305aa93f5b12d5c929d7a9c1cf7d7fee8af Author: Nathan Chancellor Date: Wed Apr 29 20:38:17 2026 -0600 riscv: Define __riscv_copy_{,vec_}{words,bytes}_unaligned() using SYM_TYPED_FUNC_START After commit 67bdd7b01387 ("riscv: Split out measure_cycles() for reuse") and commit c03ad15f7cf6 ("riscv: Reuse measure_cycles() in check_vector_unaligned_access()"), there are CFI failure when booting kernels with CONFIG_CFI=y: CFI failure at measure_cycles+0x38/0xe0 (target: __riscv_copy_words_unaligned+0x0/0x50; expected type: ...) CFI failure at measure_cycles+0x38/0xe0 (target: __riscv_copy_vec_words_unaligned+0x0/0x24; expected type: ...) The __riscv_copy_*_unaligned() functions are now called indirectly but they are not defined with SYM_TYPED_FUNC_START, which is required for assembly functions called indirectly from C to pass CFI checking. Switch to SYM_TYPED_FUNC_START to clear up the CFI failures. Fixes: 67bdd7b01387 ("riscv: Split out measure_cycles() for reuse") Fixes: c03ad15f7cf6 ("riscv: Reuse measure_cycles() in check_vector_unaligned_access()") Signed-off-by: Nathan Chancellor Reviewed-by: Sami Tolvanen Reviewed-by: Nam Cao Link: https://patch.msgid.link/20260406-measure_cycles-cfi-failure-v1-1-03e0234ae02f@kernel.org Signed-off-by: Paul Walmsley commit 5ef343614db766acdc01c56d66e780a1b43c6ac6 Author: Hasan Basbunar Date: Tue Apr 28 19:07:39 2026 +0200 page_pool: fix memory-provider leak in page_pool_create_percpu() error path When page_pool_create_percpu() fails on page_pool_list(), it falls through to its err_uninit: label, which calls page_pool_uninit(). At that point page_pool_init() has already taken two references when the user requested PP_FLAG_ALLOW_UNREADABLE_NETMEM: pool->mp_ops->init(pool) static_branch_inc(&page_pool_mem_providers); Neither is undone by page_pool_uninit(); both are only undone by __page_pool_destroy() (success-side teardown). The error path therefore leaks the per-provider reference taken by mp_ops->init (io_zcrx_ifq->refs in the io_uring zcrx provider, the dmabuf binding refcount in the devmem provider) plus one increment of the page_pool_mem_providers static branch on every failure of xa_alloc_cyclic() inside page_pool_list(). The leaked io_zcrx_ifq->refs in turn pins everything io_zcrx_ifq_free() would release on cleanup: ifq->user (uid), ifq->mm_account (mmdrop), ifq->dev (device refcount), ifq->netdev_tracker (netdev refcount), and the rbuf region. The leaked static branch increment forces all subsequent page_pool_alloc_netmems() and page_pool_return_page() callers to take the slow mp_ops branch for the lifetime of the kernel. Reachable via the io_uring zcrx path: io_uring_register(IORING_REGISTER_ZCRX_IFQ) /* CAP_NET_ADMIN */ -> __io_uring_register -> io_register_zcrx -> zcrx_register_netdev -> netif_mp_open_rxq -> driver ndo_queue_mem_alloc -> page_pool_create_percpu -> page_pool_init succeeds (mp_ops->init runs, branch++) -> page_pool_list fails (xa_alloc_cyclic -ENOMEM) -> goto err_uninit <-- leak The same shape applies to the devmem dmabuf provider via mp_dmabuf_devmem_init()/mp_dmabuf_devmem_destroy(). Restore the cleanup symmetry by moving the mp_ops->destroy() and static_branch_dec() calls out of __page_pool_destroy() and into page_pool_uninit(), so page_pool_uninit() is again the strict inverse of page_pool_init(). page_pool_uninit() has only two callers (the err_uninit: path and __page_pool_destroy()), so this preserves the single-call invariant on the success path while fixing the err path. The error path of page_pool_init() itself still skips the mp_ops cleanup correctly: mp_ops->init is the last action that takes a reference before page_pool_init() returns 0, so when it returns an error neither the refcount nor the static branch has been touched. Triggering the bug requires xa_alloc_cyclic() to fail with -ENOMEM, which under normal GFP_KERNEL retry behaviour is rare. It is deterministic under CONFIG_FAULT_INJECTION with fail_page_alloc / xa fault injection, or under sustained memory pressure. The leak is silent: there is no warning, and the released kernel build continues running with a permanently-incremented static branch. Fixes: 0f9214046893 ("memory-provider: dmabuf devmem memory provider") Signed-off-by: Hasan Basbunar Link: https://patch.msgid.link/20260428170739.34881-1-basbunarhasan@gmail.com Signed-off-by: Jakub Kicinski commit c4f050ce06c56cfb5993268af4a5cb66ed1cd04e Author: Eric Dumazet Date: Tue Apr 28 12:32:07 2026 +0000 bonding: 3ad: implement proper RCU rules for port->aggregator syzbot found a data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler [1] which hints at lack of proper RCU implementation. Add __rcu qualifier to port->aggregator, and add proper RCU API. [1] BUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler write to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0: ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline] bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569 process_one_work kernel/workqueue.c:3302 [inline] process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385 worker_thread+0x58a/0x780 kernel/workqueue.c:3466 kthread+0x22a/0x280 kernel/kthread.c:436 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 read to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1: __bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline] bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881 bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853 rtnl_link_info_fill net/core/rtnetlink.c:906 [inline] rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927 rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168 rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453 rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline] rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495 __dev_notify_flags+0x76/0x390 net/core/dev.c:9790 netif_change_flags+0xac/0xd0 net/core/dev.c:9823 do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180 rtnl_group_changelink net/core/rtnetlink.c:3813 [inline] __rtnl_newlink net/core/rtnetlink.c:3981 [inline] rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109 rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995 netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:787 [inline] __sock_sendmsg net/socket.c:802 [inline] ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752 __sys_sendmsg net/socket.c:2784 [inline] __do_sys_sendmsg net/socket.c:2789 [inline] __se_sys_sendmsg net/socket.c:2787 [inline] __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787 x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x0000000000000000 -> 0xffff88813cf5c400 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Fixes: 47e91f56008b ("bonding: use RCU protection for 3ad xmit path") Reported-by: syzbot+9bb2ff2a4ab9e17307e1@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69f0a82f.050a0220.3aadc4.0000.GAE@google.com/ Signed-off-by: Eric Dumazet Cc: Jay Vosburgh Cc: Andrew Lunn Link: https://patch.msgid.link/20260428123207.3809211-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4ca01292ea2f2363660610a65ba0285d7c3309ed Author: Lorenzo Bianconi Date: Tue Apr 28 08:53:16 2026 +0200 net: airoha: Do not return err in ndo_stop() callback Always complete the airoha_dev_stop() routine regardless of the airoha_set_vip_for_gdm_port() return value, since errors from ndo_stop() are ignored by the networking stack and the interface is always considered down after the call. Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260428-airoha-ndo-stop-not-err-v1-1-674506d29a91@kernel.org Signed-off-by: Jakub Kicinski commit b31681206e3f527970a7c7ed807fbf6a028fc25b Author: Hamza Mahfooz Date: Tue Apr 28 08:53:39 2026 -0400 hv_sock: fix ARM64 support VMBUS ring buffers must be page aligned. Therefore, the current value of 24K presents a challenge on ARM64 kernels (with 64K pages). So, use VMBUS_RING_SIZE() to ensure they are always aligned and large enough to hold all of the relevant data. Cc: stable@vger.kernel.org Fixes: 77ffe33363c0 ("hv_sock: use HV_HYP_PAGE_SIZE for Hyper-V communication") Tested-by: Dexuan Cui Reviewed-by: Dexuan Cui Signed-off-by: Hamza Mahfooz Acked-by: Stefano Garzarella Link: https://patch.msgid.link/20260428125339.13963-1-hamzamahfooz@linux.microsoft.com Signed-off-by: Jakub Kicinski commit e73cafaf4acea5445df2e5ee021a335d717c1697 Author: Jakub Kicinski Date: Tue Apr 28 13:39:24 2026 -0700 MAINTAINERS: update the IPv4/IPv6 entry and add Ido Schimmel The IPv4/IPv6 and routing code is not very well separated from the TCP/UDP code. Scope it down properly by providing a more accurate file list, instead of net/ipv4/ and net/ipv6/ Now that the entry is more accurately representing layer 3 and routing merge in the nexthop entry into it. Add Ido Schimmel as a co-maintainer, Ido's git history speaks for itself. Reviewed-by: David Ahern Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260428203924.1229169-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 72e9647e2b20c31b4f2febf981566e3c5cdef90e Author: Jakub Kicinski Date: Tue Apr 28 13:33:57 2026 -0700 selftests: drv-net: clarify linters and frameworks in README Minor clarifications in the README: - call out what linters we expect to be clean - make it clear that by "frameworks" we mean code under lib/ not just factoring code out in the same file Signed-off-by: Jakub Kicinski commit c3388f8c1cbb5aae3731749b586499ed126b4156 Author: David Heidelberg Date: Tue Apr 28 16:24:38 2026 +0200 MAINTAINERS: Add myself as NFC subsystem maintainer Add myself and update the mailing list. Signed-off-by: David Heidelberg Signed-off-by: Jakub Kicinski commit 735a309b4bfb9e1e26636ff4a3e8a146f53c54f9 Author: Jakub Kicinski Date: Mon Apr 27 19:53:20 2026 -0700 net: add net_iov_init() and use it to initialize ->page_type Commit db359fccf212 ("mm: introduce a new page type for page pool in page type") added a page_type field to struct net_iov at the same offset as struct page::page_type, so that page_pool_set_pp_info() can call __SetPageNetpp() uniformly on both pages and net_iovs. The page-type API requires the field to hold the UINT_MAX "no type" sentinel before a type can be set; for real struct page that invariant is established by the page allocator on free. struct net_iov is not allocated through the page allocator, so the field is left as zero (io_uring zcrx, which uses __GFP_ZERO) or as slab garbage (devmem, which uses kvmalloc_objs() without zeroing). When the page pool then calls page_pool_set_pp_info() on a freshly-bound niov, __SetPageNetpp()'s VM_BUG_ON_PAGE(page->page_type != UINT_MAX) fires and the kernel BUGs. Triggered in selftests by io_uring zcrx setup through the fbnic queue restart path: kernel BUG at ./include/linux/page-flags.h:1062! RIP: 0010:page_pool_set_pp_info (./include/linux/page-flags.h:1062 net/core/page_pool.c:716) Call Trace: net_mp_niov_set_page_pool (net/core/page_pool.c:1360) io_pp_zc_alloc_netmems (io_uring/zcrx.c:1089 io_uring/zcrx.c:1110) fbnic_fill_bdq (./include/net/page_pool/helpers.h:160 drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:906) __fbnic_nv_restart (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2470 drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2874) fbnic_queue_start (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2903) netdev_rx_queue_reconfig (net/core/netdev_rx_queue.c:137) __netif_mp_open_rxq (net/core/netdev_rx_queue.c:234) io_register_zcrx (io_uring/zcrx.c:818 io_uring/zcrx.c:903) __io_uring_register (io_uring/register.c:931) __do_sys_io_uring_register (io_uring/register.c:1029) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) The same path is reachable through devmem dmabuf binding via netdev_nl_bind_rx_doit() -> net_devmem_bind_dmabuf_to_queue(). Add a net_iov_init() helper that stamps ->owner, ->type and the ->page_type sentinel, and use it from both the devmem and io_uring zcrx niov init loops. Fixes: db359fccf212 ("mm: introduce a new page type for page pool in page type") Acked-by: Vlastimil Babka (SUSE) Acked-by: Byungchul Park Reviewed-by: Jens Axboe Acked-by: Pavel Begunkov Link: https://patch.msgid.link/20260428025320.853452-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1d47b55b36d2ec73fe6901212c8b28a593c3b27c Author: Weiming Shi Date: Mon Apr 27 14:34:50 2026 +0200 netfilter: nft_fwd_netdev: use recursion counter in neigh egress path nft_fwd_neigh can be used in egress chains (NF_NETDEV_EGRESS). When the forwarding rule targets the same device or two devices forward to each other, neigh_xmit() triggers dev_queue_xmit() which re-enters nf_hook_egress(), causing infinite recursion and stack overflow. Move the nf_get_nf_dup_skb_recursion() accessor and NF_RECURSION_LIMIT to the shared header nf_dup_netdev.h as a static inline, so that nft_fwd_netdev can use the recursion counter directly without exported function call overhead. Guard neigh_xmit() with the same recursion limit already used in nf_do_netdev_egress(). [ Updated to cache the nf_get_nf_dup_skb_recursion pointer. --pablo ] Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Signed-off-by: Pablo Neira Ayuso commit 0a0b35f0bf10b4c2be607465f5c9c12c8681305b Author: Pablo Neira Ayuso Date: Mon Apr 27 14:34:48 2026 +0200 netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding The ttl field has been decremented already and evaluation of this rule would proceed, just drop this packet instead if there is no destination device to forwards this packet. This is exactly what nf_dup already does in this case. Moreover, check for headroom and call skb_expand_head() like in the IP output path to ensure there is sufficient headroom when forwarding this via neigh_xmit(). Fixes: d32de98ea70f ("netfilter: nft_fwd_netdev: allow to forward packets via neighbour layer") Signed-off-by: Pablo Neira Ayuso commit 1049970d7583194eedc30e45a3c898b2cb1c30ba Author: Pablo Neira Ayuso Date: Mon Apr 27 14:34:45 2026 +0200 netfilter: replace skb_try_make_writable() by skb_ensure_writable() skb_try_make_writable() only works on clones and uncloned packets might have their network header in paged fragments. nft_fwd needs to work for the ingress and egress hooks, but the egress hook where skb->data points to the mac header, use skb_network_offset() to include the mac header. The flowtable is fine since it already uses the transport offset. Fixes: d32de98ea70f ("netfilter: nft_fwd_netdev: allow to forward packets via neighbour layer") Fixes: 7d2086871762 ("netfilter: nf_flow_table: move ipv4 offload hook code to nf_flow_table") Signed-off-by: Pablo Neira Ayuso commit 6e55a8d9f21bcb238596bdd8092c92e74c698a3d Author: Jork Loeser Date: Mon Apr 27 14:38:54 2026 -0700 mshv: unmap debugfs stats pages on kexec On L1VH, debugfs stats pages are overlay pages: the kernel allocates them and registers the GPAs with the hypervisor via HVCALL_MAP_STATS_PAGE2. These overlay mappings persist in the hypervisor across kexec. If the kexec'd kernel reuses those physical pages, the hypervisor's overlay semantics cause a machine check exception. Fix this by calling mshv_debugfs_exit() from the reboot notifier, which issues HVCALL_UNMAP_STATS_PAGE for each mapped stats page before kexec. This releases the overlay bindings so the physical pages can be safely reused. Guard mshv_debugfs_exit() against being called when init failed. Signed-off-by: Jork Loeser Reviewed-by: Anirudh Rayabharam (Microsoft) Reviewed-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit efe0fb8c3fe2b996522f7418fd311eeff43c1148 Author: Jork Loeser Date: Mon Apr 27 14:38:53 2026 -0700 mshv: clean up SynIC state on kexec for L1VH The reboot notifier that tears down the SynIC cpuhp state guards the cleanup with hv_root_partition(), so on L1VH (where hv_root_partition() is false) SINT0, SINT5, and SIRBP are never cleaned up before kexec. The kexec'd kernel then inherits stale unmasked SINTs and an enabled SIRBP pointing to freed memory. Remove the hv_root_partition() guard so the cleanup runs for all parent partitions. Signed-off-by: Jork Loeser Reviewed-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam (Microsoft) Signed-off-by: Wei Liu commit f1a9e67c11388965802a61922c313bfc43272afe Author: Jork Loeser Date: Mon Apr 27 14:38:52 2026 -0700 mshv: limit SynIC management to MSHV-owned resources The SynIC is shared between VMBus and MSHV. VMBus owns the message page (SIMP), event flags page (SIEFP), global enable (SCONTROL), and SINT2. MSHV adds SINT0, SINT5, and the event ring page (SIRBP). Currently mshv_synic_cpu_init() redundantly enables SIMP, SIEFP, and SCONTROL that VMBus already configured, and mshv_synic_cpu_exit() disables all of them. This is wrong because MSHV can be torn down while VMBus is still active. In particular, a kexec reboot notifier tears down MSHV first. Disabling SCONTROL, SIMP, and SIEFP out from under VMBus causes its later cleanup to write SynIC MSRs while SynIC is disabled, which the hypervisor does not tolerate. Restrict MSHV to managing only the resources it owns: - SINT0, SINT5: mask on cleanup, unmask on init - SIRBP: enable/disable as before - SIMP, SIEFP, SCONTROL: leave to VMBus when it is active (L1VH and nested root partition); on a non-nested root partition VMBus does not run, so MSHV must enable/disable them While here, fix the SIEFP and SIRBP memremap() and virt_to_phys() calls to use HV_HYP_PAGE_SHIFT/HV_HYP_PAGE_SIZE instead of PAGE_SHIFT/PAGE_SIZE. The hypervisor always uses 4K pages for SynIC register GPAs regardless of the kernel page size, so using PAGE_SHIFT produces wrong addresses on ARM64 with 64K pages. Note that initialization order matters - VMBUS first, MSHV second, and the reverse on de-init. Ideally, we would want a dedicated SYNIC driver that replaces the cross-dependencies with a clear API and dynamic tracking. Such refactor should go into its own dedicated series, outside of this kexec fix series. Signed-off-by: Jork Loeser Reviewed-by: Anirudh Rayabharam (Microsoft) Reviewed-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit c208a2b95811d6e1ebae65d0d2fc13f73707f8e7 Author: Shyam Prasad N Date: Mon Mar 30 16:19:59 2026 +0530 cifs: change_conf needs to be called for session setup Today we skip calling change_conf for negotiates and session setup requests. This can be a problem for mchan as the immediate next call after session setup could be due to an I/O that is made on the mount point. For single channel, this is not a problem as there will be several calls after setting up session. This change enforces calling change_conf when the total credits contain enough for reservations for echoes and oplocks. We expect this to happen during the last session setup response. This way, echoes and oplocks are not disabled before the first request to the server. So if that first request is an open, it does not need to disable requesting leases. Cc: Reviewed-by: Bharath SM Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 8e13b1b4093e0cbcb3dc2906c13b1fdc95cdf0a0 Author: Fredric Cover Date: Wed Apr 29 14:34:53 2026 -0700 smb: client: change allocation requirements in smb2_compound_op Currently, smb2_compound_op() allocates struct smb2_compound_vars *vars using GFP_ATOMIC, although smb2_compound_op() can sleep when it calls compound_send_recv() before vars is freed. Allocate vars using GFP_KERNEL. Signed-off-by: Fredric Cover Signed-off-by: Steve French commit 3f8c8497b4fc249e27cb335c627114d8412e584d Author: Thorsten Blum Date: Tue Apr 28 19:11:05 2026 +0200 hv: utils: replace deprecated strcpy with strscpy in kvp_register strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. While the current code works correctly, replace strcpy() with the safer strscpy() to follow secure coding best practices. Use ->body.kvp_register.version directly as the destination buffer and remove the local variable. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy Signed-off-by: Thorsten Blum Signed-off-by: Wei Liu commit 9e9354075d5a15cfc0aba965f3d0d77b7d4303e9 Author: Nathan Chancellor Date: Tue Apr 28 15:21:38 2026 -0400 ntfs: Use return instead of goto in ntfs_mapping_pairs_decompress() Clang warns (or errors with CONFIG_WERROR=y / W=e): fs/ntfs/runlist.c:755:6: error: variable 'rl' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] 755 | if (overflows_type(lowest_vcn, vcn)) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... fs/ntfs/runlist.c:971:9: note: uninitialized use occurs here 971 | kvfree(rl); | ^~ ... rl has not been allocated at this point so the 'goto err_out' should really just be a return of the error pointer -EIO. Signed-off-by: Nathan Chancellor Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 4ebcf3f94924d54706de0d2492c80944d85410fd Author: Hyunchul Lee Date: Tue Apr 28 10:34:10 2026 +0900 ntfs: drop nlink once for WIN32/DOS aliases NTFS could store a filename as paired WIN32 and DOS $FILE_NAME attributes for directories. But ntfs_delete() deleted both attributes for unlinking a directory, but it also called drop_nlink() for each attributes. This could trigger warnings when unlinking directories. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 3fcf923302a8f5c0dc3af3d2ca2657cb5fae4297 Author: Thorsten Blum Date: Tue Apr 14 13:10:08 2026 +0200 hv: utils: handle and propagate errors in kvp_register Make kvp_register() return an error code instead of silently ignoring failures, and propagate the error from kvp_handle_handshake() instead of returning success. This propagates both kzalloc_obj() and hvutil_transport_send() failures to kvp_handle_handshake() and thus to kvp_on_msg(). Fixes: 245ba56a52a3 ("Staging: hv: Implement key/value pair (KVP)") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum Reviewed-by: Long Li Signed-off-by: Wei Liu commit 48fcc895403cc97aa6c776cb65e6aa11290c0b44 Author: Wei Liu Date: Thu Apr 23 17:26:26 2026 +0000 mshv: add a missing padding field That was missed when importing the header. Reported-by: Doru Blânzeanu Reported-by: Magnus Kulke Fixes: e68bda71a2384 ("hyperv: Add new Hyper-V headers in include/hyperv") Cc: stable@kernel.org Reviewed-by: Easwar Hariharan Signed-off-by: Wei Liu commit b2aa3b4d64e460ac606f386c24e7d8a873ce6f1a Author: Steven Rostedt Date: Tue Apr 28 12:23:02 2026 -0400 tracing/probes: Limit size of event probe to 3K There currently isn't a max limit an event probe can be. One could make an event greater than PAGE_SIZE, which makes the event useless because if it's bigger than the max event that can be recorded into the ring buffer, then it will never be recorded. A event probe should never need to be greater than 3K, so make that the max size. As long as the max is less than the max that can be recorded onto the ring buffer, it should be fine. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Acked-by: Masami Hiramatsu (Google) Fixes: 93ccae7a22274 ("tracing/kprobes: Support basic types on dynamic events") Link: https://patch.msgid.link/20260428122302.706610ba@gandalf.local.home Signed-off-by: Steven Rostedt commit 20e81c64c905bd765e69ef07920d2b1130dc79b6 Author: Tejun Heo Date: Wed Apr 29 09:44:16 2026 -1000 workqueue: Annotate alloc_workqueue_va() with __printf(1, 0) alloc_workqueue_va() forwards its va_list to __alloc_workqueue() which ultimately feeds vsnprintf(). __alloc_workqueue() already carries __printf(1, 0); the new wrapper needs the same annotation so format string checking propagates through the forwarding. Fixes: 0de4cb473aed ("workqueue: fix devm_alloc_workqueue() va_list misuse") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604300347.2LgXyteh-lkp@intel.com/ Signed-off-by: Tejun Heo commit 6009cca96fcb01182cede725ad61e9e3810f3932 Author: Michael Guralnik Date: Mon Apr 27 14:02:36 2026 +0300 RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation Raw Packet QPs are unique in that they support separate send and receive queues, using 2 different user-provided buffers. They can also be created with one of the queues having size 0, allowing a send-only or receive-only QP. The Raw Packet RQ umem is created in the common user QP creation path, which allows zero-length queues. Add a later validation of the RQ umem in Raw Packet QP creation path when an RQ was requested. This prevents possible null-ptr dereference crashes, as seen in the below trace: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 6 UID: 0 PID: 3539 Comm: raw_packet_umem Not tainted 6.19.0-rc1+ #166 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:__mlx5_umem_find_best_quantized_pgoff+0x37/0x280 [mlx5_ib] Code: ff df 41 57 49 89 ff 41 56 41 55 41 89 d5 41 54 4d 89 cc 4c 8d 4f 30 55 4c 89 ca 48 89 f5 53 48 c1 ea 03 48 89 cb 48 83 ec 18 <80> 3c 02 00 44 89 04 24 0f 85 01 02 00 00 48 ba 00 00 00 00 00 fc RSP: 0018:ff1100013966f4e0 EFLAGS: 00010282 RAX: dffffc0000000000 RBX: 00000000ffffffc0 RCX: 00000000ffffffc0 RDX: 0000000000000006 RSI: 00000ffffffff000 RDI: 0000000000000000 RBP: 00000ffffffff000 R08: 0000000000000040 R09: 0000000000000030 R10: 0000000000000000 R11: 0000000000000000 R12: ff1100013966f648 R13: 0000000000000005 R14: ff1100013966f980 R15: 0000000000000000 FS: 00007fae6c82f740(0000) GS:ff11000898ba1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000000 CR3: 000000010f96c005 CR4: 0000000000373eb0 Call Trace: create_qp+0x747d/0xc740 [mlx5_ib] ? is_module_address+0x18/0x110 ? _create_user_qp.constprop.0+0x18e0/0x18e0 [mlx5_ib] ? __module_address+0x49/0x210 ? is_module_address+0x68/0x110 ? static_obj+0x67/0x90 ? lockdep_init_map_type+0x58/0x200 mlx5_ib_create_qp+0xc85/0x2620 [mlx5_ib] ? find_held_lock+0x2b/0x80 ? create_qp+0xc740/0xc740 [mlx5_ib] ? lock_release+0xcb/0x260 ? lockdep_init_map_type+0x58/0x200 ? __init_swait_queue_head+0xcb/0x150 create_qp.part.0+0x558/0x7c0 [ib_core] ib_create_qp_user+0xa0/0x4f0 [ib_core] ? rdma_lookup_get_uobject+0x1e4/0x400 [ib_uverbs] create_qp+0xe4f/0x1d10 [ib_uverbs] ? ib_uverbs_rereg_mr+0xd40/0xd40 [ib_uverbs] ? ib_uverbs_cq_event_handler+0x120/0x120 [ib_uverbs] ? __might_fault+0x81/0x100 ? lock_release+0xcb/0x260 ? _copy_from_user+0x3e/0x90 ib_uverbs_create_qp+0x10a/0x150 [ib_uverbs] ? ib_uverbs_ex_create_qp+0xe0/0xe0 [ib_uverbs] ? __might_fault+0x81/0x100 ? lock_release+0xcb/0x260 ib_uverbs_write+0x7e5/0xc90 [ib_uverbs] ? uverbs_devnode+0xc0/0xc0 [ib_uverbs] ? lock_acquire+0xfa/0x2b0 ? find_held_lock+0x2b/0x80 ? finish_task_switch.isra.0+0x189/0x6c0 vfs_write+0x1c0/0xf70 ? lockdep_hardirqs_on_prepare+0xde/0x170 ? kernel_write+0x5a0/0x5a0 ? __switch_to+0x527/0xe60 ? __schedule+0x10a3/0x3950 ? io_schedule_timeout+0x110/0x110 ksys_write+0x170/0x1c0 ? __x64_sys_read+0xb0/0xb0 ? trace_hardirqs_off.part.0+0x4e/0xe0 do_syscall_64+0x70/0x1360 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fae6ca3118d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5b cc 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe678ca308 EFLAGS: 00000213 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007ffe678ca448 RCX: 00007fae6ca3118d RDX: 0000000000000070 RSI: 0000200000000280 RDI: 0000000000000003 RBP: 00007ffe678ca320 R08: 00000000ffffffff R09: 00007fae6c8ec5b8 R10: 0000000000000064 R11: 0000000000000213 R12: 0000000000000001 R13: 0000000000000000 R14: 00007fae6cb71000 R15: 0000000000404df0 Modules linked in: mlx5_ib mlx5_fwctl mlx5_core bonding ip6_gre ip6_tunnel tunnel6 ip_gre gre rdma_ucm ib_uverbs rdma_cm iw_cm ib_ipoib ib_cm ib_umad ib_core rpcsec_gss_krb5 auth_rpcgss oid_registry overlay nfnetlink zram zsmalloc fuse scsi_transport_iscsi [last unloaded: mlx5_core] ---[ end trace 0000000000000000 ]--- RIP: 0010:__mlx5_umem_find_best_quantized_pgoff+0x37/0x280 [mlx5_ib] Fixes: 0fb2ed66a14c ("IB/mlx5: Add create and destroy functionality for Raw Packet QP") Link: https://patch.msgid.link/r/20260427-security-bug-fixes-v3-5-4621fa52de0e@nvidia.com Signed-off-by: Michael Guralnik Reviewed-by: Maher Sanalla Signed-off-by: Edward Srouji Signed-off-by: Jason Gunthorpe commit 1f3b337af2231b1e83c9052f771b201f5cbb9997 Author: Michael Guralnik Date: Mon Apr 27 14:02:35 2026 +0300 RDMA/core: Fix rereg_mr use-after-free race When a driver creates a new MR during rereg_user_mr, a race window exists between rdma_alloc_commit_uobject() for the new MR and the point where the code reads that MR to populate the response keys. A concurrent rereg_mr or destroy_mr could destroy the MR in this window and cause UAF in the first thread. Racing flow between two rereg_mr calls: CPU0 CPU1 ---- ---- rereg_user_mr(mr_handle) uobj_get_write(mr_handle) -> mr0 mr1 = driver→rereg() rdma_alloc_commit_uobject(mr1) // mr1 replaced mr0 and is unlocked uobj_put_destroy(mr0) rereg_user_mr(mr_handle) uobj_get_write(mr_handle) -> mr1 mr2 = driver→rereg() rdma_alloc_commit_uobject(mr2) // mr2 replaced mr1 and is unlocked uobj_put_destroy(mr1) // Destroys mr1! resp.lkey = mr1->lkey; // UAF - mr1 was freed! resp.rkey = mr1->rkey; // UAF - mr1 was freed! Fix by storing lkey/rkey in local variables before the new MR is unlocked and using the local variables to set the user response. Fixes: 6e0954b11c05 ("RDMA/uverbs: Allow drivers to create a new HW object during rereg_mr") Link: https://patch.msgid.link/r/20260427-security-bug-fixes-v3-4-4621fa52de0e@nvidia.com Signed-off-by: Michael Guralnik Reviewed-by: Maher Sanalla Signed-off-by: Edward Srouji Signed-off-by: Jason Gunthorpe commit 610771c62e2ac5bca851fc5a6f8af1cdd83f189a Author: Maher Sanalla Date: Mon Apr 27 14:02:34 2026 +0300 IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg() When resolving an RDMA-CM IPv6 address, ib_nl_ip_send_msg() sends a netlink request to the userspace daemon to perform IP-to-GID resolution in certain cases. The function allocates the netlink message buffer using nla_total_size(sizeof(size)), which passes 8 bytes (the size of size_t) instead of 16 bytes (the size of an IPv6 address). This results in an 8-byte under-allocation. This is currently masked by nlmsg_new() over-allocation of the skb in its internal logic. However, the code remains incorrect. Fix the issue by supplying the proper IPv6 address length to nla_total_size(). Fixes: ae43f8286730 ("IB/core: Add IP to GID netlink offload") Link: https://patch.msgid.link/r/20260427-security-bug-fixes-v3-3-4621fa52de0e@nvidia.com Signed-off-by: Maher Sanalla Reviewed-by: Patrisious Haddad Signed-off-by: Edward Srouji Signed-off-by: Jason Gunthorpe commit 9bee81cc5e8811c8bbe67fbf5214a7998457324b Author: Edward Srouji Date: Mon Apr 27 14:02:33 2026 +0300 RDMA/mlx5: Fix UAF in DCT destroy due to race with create A potential race condition exists between mlx5_core_destroy_dct() and mlx5_core_create_dct() that can lead to a use-after-free. After _mlx5_core_destroy_dct() releases the DCT to firmware, the DCTN can be immediately reallocated for a new DCT being created concurrently. If the create path stores the new DCT in the xarray before the destroy path erases it, the destroy will incorrectly delete the new DCT's entry. Later accesses then hit freed memory. Fix by replacing the unconditional xa_erase_irq() with xa_cmpxchg_irq() that only erases the entry if it hasn't already been replaced (still contains XA_ZERO_ENTRY), preserving any newly created DCT. Fixes: afff24899846 ("RDMA/mlx5: Handle DCT QP logic separately from low level QP interface") Link: https://patch.msgid.link/r/20260427-security-bug-fixes-v3-2-4621fa52de0e@nvidia.com Signed-off-by: Edward Srouji Reviewed-by: Michael Guralnik Signed-off-by: Jason Gunthorpe commit 38694f4639c45599161860e828dc4ac77abf8cea Author: Edward Srouji Date: Mon Apr 27 14:02:32 2026 +0300 RDMA/mlx5: Fix UAF in SRQ destroy due to race with create A race condition exists between mlx5_cmd_destroy_srq() and mlx5_cmd_create_srq() that can lead to a use-after-free (UAF) [1]. After destroy_srq_split() releases the SRQ to firmware, the SRQN can be immediately reallocated for a new SRQ being created concurrently. If the create path stores the new SRQ in the xarray before the destroy path erases it, the destroy will incorrectly delete the new SRQ's entry. Later accesses then hit freed memory. Fix by replacing the unconditional xa_erase_irq() with xa_cmpxchg_irq() that only erases the entry if it hasn't already been replaced (still contains XA_ZERO_ENTRY), preserving any newly created SRQ. [1] RIP: 0010:mlx5_cmd_destroy_srq+0xd8/0x110 [mlx5_ib] Code: 89 e1 ba 06 04 00 00 4c 89 f6 48 89 ef e8 80 19 70 e1 c6 83 a0 0f 00 00 00 fb 5b 44 89 e8 5d 41 5c 41 5d 41 5e c3 cc cc cc cc <0f> 0b 48 89 c2 83 e2 03 48 83 fa 02 75 08 48 3d 05 c0 ff ff 77 08 RSP: 0018:ff110001037b7d08 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ff1100010bb9c000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ff110001037b7c90 RBP: ff1100010bb9cfa0 R08: 0000000000000000 R09: 0000000000000000 R10: ff110001037b7da0 R11: ff11000104f29580 R12: ff1100010e2ac090 R13: 000000000000000d R14: 0000000000000001 R15: ff11000105336300 FS: 00007fa24787c740(0000) GS:ff1100046eb8d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa247984e90 CR3: 0000000109d59005 CR4: 0000000000373eb0 Call Trace: mlx5_ib_destroy_srq+0x25/0xa0 [mlx5_ib] ib_destroy_srq_user+0x21/0x90 [ib_core] uverbs_free_srq+0x1b/0x50 [ib_uverbs] destroy_hw_idr_uobject+0x1e/0x50 [ib_uverbs] uverbs_destroy_uobject+0x35/0x180 [ib_uverbs] __uverbs_cleanup_ufile+0xdd/0x140 [ib_uverbs] uverbs_destroy_ufile_hw+0x38/0xf0 [ib_uverbs] ib_uverbs_close+0x17/0xa0 [ib_uverbs] __fput+0xe0/0x2a0 __x64_sys_close+0x3a/0x80 do_syscall_64+0x55/0xac0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa247984ea4 Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d a5 51 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d RSP: 002b:00007ffecfa79498 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 0000200000000080 RCX: 00007fa247984ea4 RDX: 0000000000000040 RSI: 0000200000000200 RDI: 0000000000000003 RBP: 00007ffecfa794e0 R08: 00007ffecfa794e0 R09: 00007ffecfa794e0 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 R13: 0000000000000000 R14: 0000200000000000 R15: 0000200000000009 ---[ end trace 0000000000000000 ]--- Fixes: fd89099d635e ("RDMA/mlx5: Issue FW command to destroy SRQ on reentry") Link: https://patch.msgid.link/r/20260427-security-bug-fixes-v3-1-4621fa52de0e@nvidia.com Signed-off-by: Edward Srouji Reviewed-by: Michael Guralnik Signed-off-by: Jason Gunthorpe commit 76b0d0baa9ae9c60e726bbe1b6ff0bec2c993634 Author: Dmitry Torokhov Date: Sat Apr 25 22:07:06 2026 -0700 Input: elan_i2c - validate firmware size before use Ensure that the firmware file is large enough to contain the expected number of pages and the signature (which resides at the end of the firmware blob) before accessing them to prevent potential out-of-bounds reads. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/ae2dOgiFvXRm4BHo@google.com Signed-off-by: Dmitry Torokhov commit 662f9ddc8077792129440d05cbef2f944a07777a Author: Jia Yao Date: Fri Apr 17 05:59:17 2026 +0000 drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR Add validation in xe_vm_bind_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when used with DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR. CPU address mirror mappings use system memory that is CPU cached, which makes them incompatible with COH_NONE PAT indices. Allowing COH_NONE with CPU cached buffers is a security risk, as the GPU may bypass CPU caches and read stale sensitive data from DRAM. Although CPU_ADDR_MIRROR does not create an immediate mapping, the backing system memory is still CPU cached. Apply the same PAT coherency restrictions as DRM_XE_VM_BIND_OP_MAP_USERPTR. v2: - Correct fix tag v6: - No change v7: - Correct fix tag v8: - Rebase v9: - Limit the restrictions to iGPU v10: - Just add the iGPU logic but keep dGPU logic Fixes: b43e864af0d4 ("drm/xe/uapi: Add DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR") Cc: # v6.15+ Cc: Shuicheng Lin Cc: Mathew Alwin Cc: Michal Mrozek Cc: Matthew Brost Cc: Matthew Auld Signed-off-by: Jia Yao Reviewed-by: Matthew Auld Acked-by: Michal Mrozek Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260417055917.2027459-3-jia.yao@intel.com (cherry picked from commit 4d58d7535e826a3175527b6174502f0db319d7f6) Signed-off-by: Rodrigo Vivi commit 4e5591c2fc1b30f4ea5e2eab4c3a695acc404e39 Author: Jia Yao Date: Fri Apr 17 05:59:16 2026 +0000 drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cached memory. Using coh_none with CPU cached buffers is a security issue. When the kernel clears pages before reallocation, the clear operation stays in CPU cache (dirty). GPU with coh_none can bypass CPU caches and read stale sensitive data directly from DRAM, potentially leaking data from previously freed pages of other processes. This aligns with the existing validation in vm_bind path (xe_vm_bind_ioctl_validate_bo). v2(Matthew brost) - Add fixes - Move one debug print to better place v3(Matthew Auld) - Should be drm/xe/uapi - More Cc v4(Shuicheng Lin) - Fix kmem leak issues by the way v5 - Remove kmem leak because it has been merged by another patch v6 - Remove the fix which is not related to current fix v7 - No change v8 - Rebase v9 - Limit the restrictions to iGPU v10 - No change Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe") Cc: # v6.18+ Cc: Shuicheng Lin Cc: Mathew Alwin Cc: Michal Mrozek Cc: Matthew Brost Cc: Matthew Auld Signed-off-by: Jia Yao Reviewed-by: Matthew Auld Acked-by: Michal Mrozek Acked-by: José Roberto de Souza Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260417055917.2027459-2-jia.yao@intel.com (cherry picked from commit 016ccdb674b8c899940b3944952c96a6a490d10a) Signed-off-by: Rodrigo Vivi commit 0df99689eb790bcad3ad82b38fa4ce1cbf3cffa3 Author: Tvrtko Ursulin Date: Mon Apr 20 14:16:03 2026 +0100 drm/xe/xelp: Fix Wa_18022495364 Command parser relative MMIO addressing needs to be enabled when writing to the register. Signed-off-by: Tvrtko Ursulin Fixes: ca33cd271ef9 ("drm/xe/xelp: Add Wa_18022495364") Cc: Matt Roper Cc: Matthew Brost Cc: Thomas Hellström Cc: Rodrigo Vivi Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260420131603.70357-1-tvrtko.ursulin@igalia.com Signed-off-by: Matt Roper (cherry picked from commit 5627392001802a98ed6cf8cf79a303abd00d1c0f) Signed-off-by: Rodrigo Vivi commit 3762d6c36549accea7068c4a175483fafdd03657 Author: Shuicheng Lin Date: Fri Apr 17 16:33:08 2026 +0000 drm/xe/gsc: Fix BO leak on error in query_compatibility_version() When xe_gsc_read_out_header() fails, query_compatibility_version() returns directly instead of jumping to the out_bo label. This skips the xe_bo_unpin_map_no_vm() call, leaving the BO pinned and mapped with no remaining reference to free it. Fix by using goto out_bo so the error path properly cleans up the BO, consistent with the other error handling in the same function. Fixes: 0881cbe04077 ("drm/xe/gsc: Query GSC compatibility version") Cc: Daniele Ceraolo Spurio Reviewed-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260417163308.3416147-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit 8de86d0a843c32ca9d36864bdb92f0376a830bce) Signed-off-by: Rodrigo Vivi commit dc2d9842c67d883d3200ae33b9c3859dd9492408 Author: Shuicheng Lin Date: Wed Apr 15 22:54:28 2026 +0000 drm/xe/eustall: Fix drm_dev_put called before stream disable in close In xe_eu_stall_stream_close(), drm_dev_put() is called before the stream is disabled and its resources are freed. If this drops the last reference, the device structures could be freed while the subsequent cleanup code still accesses them, leading to a use-after-free. Fix this by moving drm_dev_put() after all device accesses are complete. This matches the ordering in xe_oa_release(). Fixes: 9a0b11d4cf3b ("drm/xe/eustall: Add support to init, enable and disable EU stall sampling") Cc: Harish Chegondi Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Shuicheng Lin Reviewed-by: Harish Chegondi Link: https://patch.msgid.link/20260415225428.3399934-1-shuicheng.lin@intel.com Signed-off-by: Matt Roper (cherry picked from commit 35aff528f7297e949e5e19c9cd7fd748cf1cf21c) Signed-off-by: Rodrigo Vivi commit f3cc22d4df3ed58439ea7e21daa54c3608e03b78 Author: Shuicheng Lin Date: Wed Apr 8 02:06:47 2026 +0000 drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist in xe_exec_queue_create_ioctl(): 1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in preempt fence mode, xe_vm_add_compute_exec_queue() has already added the queue to the VM's compute exec queue list. Skipping the kill leaves the queue on that list, leading to a dangling pointer after the queue is freed. 2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has succeeded, the error path does not call xe_hw_engine_group_del_exec_queue() to remove the queue from the hw engine group list. The queue is then freed while still linked into the hw engine group, causing a use-after-free. Fix both by: - Changing the xe_hw_engine_group_add_exec_queue() failure path to jump to kill_exec_queue so that xe_exec_queue_kill() properly removes the queue from the VM's compute list. - Adding a del_hw_engine_group label before kill_exec_queue for the xa_alloc() failure path, which removes the queue from the hw engine group before proceeding with the rest of the cleanup. Fixes: 7970cb36966c ("'drm/xe/hw_engine_group: Register hw engine group's exec queues") Cc: Francois Dugast Cc: Matthew Brost Cc: Niranjana Vishwanathapura Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260408020647.3397933-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8) Signed-off-by: Rodrigo Vivi commit 111ab678471bf1f90d078d5513bb086b70596c3c Author: Shuicheng Lin Date: Wed Apr 8 17:52:55 2026 +0000 drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() When xe_dma_buf_init_obj() fails, the attachment from dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before returning the error. Note: we cannot use goto out_err here because xe_dma_buf_init_obj() already frees bo on failure, and out_err would double-free it. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Mattheq Brost Link: https://patch.msgid.link/20260408175255.3402838-5-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51) Signed-off-by: Rodrigo Vivi commit 93a528f67ce5095bcab46a69839eca97f43dd352 Author: Shuicheng Lin Date: Wed Apr 8 17:52:54 2026 +0000 drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure When drm_gpuvm_resv_object_alloc() fails, the pre-allocated storage bo is not freed. Add xe_bo_free(storage) before returning the error. xe_dma_buf_init_obj() calls xe_bo_init_locked(), which frees the bo on error. Therefore, xe_dma_buf_init_obj() must also free the bo on its own error paths. Otherwise, since xe_gem_prime_import() cannot distinguish whether the failure originated from xe_dma_buf_init_obj() or from xe_bo_init_locked(), it cannot safely decide whether the bo should be freed. Add comments documenting the ownership semantics: on success, ownership of storage is transferred to the returned drm_gem_object; on failure, storage is freed before returning. v2: Add comments to explain the free logic. Fixes: eb289a5f6cc6 ("drm/xe: Convert xe_dma_buf.c for exhaustive eviction") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260408175255.3402838-4-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit 78a6c5f899f22338bbf48b44fb8950409c5a69b9) Signed-off-by: Rodrigo Vivi commit 1d0adf2fd94fb0c0037c643fadd8f2cf3cffc009 Author: Shuicheng Lin Date: Wed Apr 8 17:52:53 2026 +0000 drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() When XE_BO_FLAG_GGTT_ALL is set without XE_BO_FLAG_GGTT, the function returns an error without freeing a caller-provided bo, violating the documented contract that bo is freed on failure. Add xe_bo_free(bo) before returning the error. Fixes: 5a3b0df25d6a ("drm/xe: Allow bo mapping on multiple ggtts") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260408175255.3402838-3-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit 3fbd6cf43cac7b60757f3ce3d95195d3843a902c) Signed-off-by: Rodrigo Vivi commit 09a8f3c1c11977a6e10c167f26dd298790b31c32 Author: Shuicheng Lin Date: Wed Apr 8 17:52:52 2026 +0000 drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() When type is ttm_bo_type_device and aligned_size != size, the function returns an error without freeing a caller-provided bo, violating the documented contract that bo is freed on failure. Add xe_bo_free(bo) before returning the error. Fixes: 4e03b584143e ("drm/xe/uapi: Reject bo creation of unaligned size") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260408175255.3402838-2-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit 601c2aa087b6f21014300a3f107a08ee4dde7bdf) Signed-off-by: Rodrigo Vivi commit f8c4151d50b12923b67819ebf03c1c6782c984c1 Author: Shuicheng Lin Date: Thu Apr 9 00:34:49 2026 +0000 drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked xe_exec_queue_tlb_inval_last_fence_put_unlocked() uses q->vm->xe as the first argument to xe_assert(). This function is called unconditionally from xe_exec_queue_destroy() for all queues, including kernel queues that have q->vm == NULL (e.g., queues created during GT init in xe_gt_record_default_lrcs() with vm=NULL). While current compilers optimize away the q->vm->xe dereference (even in CONFIG_DRM_XE_DEBUG=y builds, the compiler pushes the dereference into the WARN branch that is only taken when the assert condition is false), the code is semantically incorrect and constitutes undefined behavior in the C abstract machine for the NULL pointer case. Use gt_to_xe(q->gt) instead, which is always valid for any exec queue. This is consistent with how xe_exec_queue_destroy() itself obtains the xe_device pointer in its own xe_assert at the top of the function. Fixes: b2d7ec41f2a3 ("drm/xe: Attach last fence to TLB invalidation job queues") Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260409003449.3405767-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin (cherry picked from commit 96078a1c68bf97f17fd1d08c3f58f5c5cc9ccd65) Signed-off-by: Rodrigo Vivi commit 1460eae74fbbb27d5c5b159dba021e41c6ace4c1 Author: Satyanarayana K V P Date: Wed Apr 8 11:01:48 2026 +0000 drm/xe/vf: Use drm mm instead of drm sa for CCS read/write The suballocator algorithm tracks a hole cursor at the last allocation and tries to allocate after it. This is optimized for fence-ordered progress, where older allocations are expected to become reusable first. In fence-enabled mode, that ordering assumption holds. In fence-disabled mode, allocations may be freed in arbitrary order, so limiting allocation to the current hole window can miss valid free space and fail allocations despite sufficient total space. Use DRM memory manager instead of sub-allocator to get rid of this issue as CCS read/write operations do not use fences. Fixes: 864690cf4dd6 ("drm/xe/vf: Attach and detach CCS copy commands with BO") Signed-off-by: Satyanarayana K V P Cc: Matthew Brost Cc: Thomas Hellström Cc: Maarten Lankhorst Cc: Michal Wajdeczko Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260408110145.1639937-6-satyanarayana.k.v.p@intel.com (cherry picked from commit 6c84b493012aeb05dec29c709377bf0e17ac6815) Signed-off-by: Rodrigo Vivi commit 36c6bac158816ede655f298a3f76e5a350eaa90e Author: Satyanarayana K V P Date: Wed Apr 8 11:01:47 2026 +0000 drm/xe: Add memory pool with shadow support Add a memory pool to allocate sub-ranges from a BO-backed pool using drm_mm. Signed-off-by: Satyanarayana K V P Cc: Matthew Brost Cc: Thomas Hellström Cc: Maarten Lankhorst Cc: Michal Wajdeczko Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260408110145.1639937-5-satyanarayana.k.v.p@intel.com (cherry picked from commit 1ce3229f8f269a245ff3b8c65ffae36b4d6afb93) Signed-off-by: Rodrigo Vivi commit 6d3daa9b8d313f42d52e75590310f26a29b61b44 Author: Sudeep Holla Date: Tue Apr 28 19:33:29 2026 +0100 firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0 For FF-A v1.0 the driver registers a bus notifier to backfill UUID matching, but the notifier was never unregistered on cleanup paths. Track the registration state and unregister it during teardown and early partition-setup failure. Fixes: 9dd15934f60d ("firmware: arm_ffa: Move the FF-A v1.0 NULL UUID workaround to bus notifier") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-5-8595ae450034@kernel.org Signed-off-by: Sudeep Holla commit 9985d5357ed93af0d1933969c247e966957730e1 Author: Sudeep Holla Date: Tue Apr 28 19:33:28 2026 +0100 firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue Per-vcpu notification handling already runs from a per-cpu work item on the target cpu. Routing that path back through smp_call_function_single() re-enters the call-function IPI path and executes the notification handler with interrupts disabled. That makes the framework path unsafe, since it takes a mutex, allocates memory with GFP_KERNEL, and invokes client callbacks. Handle per-vcpu self notifications directly from the existing per-cpu work item instead. This keeps the per-vcpu path in task context and avoids the extra IPI hop entirely. Fixes: 3a3e2b83e805 ("firmware: arm_ffa: Avoid queuing work when running on the worker queue") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-4-8595ae450034@kernel.org Signed-off-by: Sudeep Holla commit 9b5597af8bc51c25342ab11896532644b181d302 Author: Sudeep Holla Date: Tue Apr 28 19:33:27 2026 +0100 firmware: arm_ffa: Avoid collapsing NPI work from different CPUs Notification pending interrupts are registered as per-CPU IRQs, but the driver queues all NPI handling through a single shared work_struct. That allows queue_work_on() calls from different CPUs to collapse onto a single pending work item even though the work function uses the CPU it runs on to fetch and handle per-CPU notifications. Move notif_pcpu_work into the per-CPU ffa_pcpu_irq state and initialize one work item per CPU. This keeps NPI handling independent per CPU and avoids losing notifications when multiple CPUs queue work concurrently. Link: https://patch.msgid.link/20260428-ffa_fixes-v2-3-8595ae450034@kernel.org Signed-off-by: Sudeep Holla commit 09527e2c534911619d7e098729711100290bc3e1 Author: Sudeep Holla Date: Tue Apr 28 19:33:26 2026 +0100 firmware: arm_ffa: Skip free_pages on RX buffer alloc failure If the RX buffer allocation fails in ffa_init(), the error path jumps to free_pages even though no buffer has been allocated yet. Route that case directly to free_drv_info so the cleanup path is only used after at least one RX/TX buffer allocation has succeeded. Fixes: 3bbfe9871005 ("firmware: arm_ffa: Add initial Arm FFA driver support") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-2-8595ae450034@kernel.org Signed-off-by: Sudeep Holla commit 0a5e695095c557d2380131b613dea4e8d90371be Author: Sudeep Holla Date: Tue Apr 28 19:33:25 2026 +0100 firmware: arm_ffa: Check for NULL FF-A ID table while driver registration The bus match callback assumes that every FF-A driver provides an id_table and dereferences it unconditionally. Enforce that contract at registration time so a buggy client driver cannot crash the bus during match. Fixes: 92743071464f ("firmware: arm_ffa: Ensure drivers provide a probe function") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-1-8595ae450034@kernel.org Signed-off-by: Sudeep Holla commit 03f2499c51dffce611b065b2894406beb9f2ebe0 Author: Matt Roper Date: Wed Apr 8 15:27:44 2026 -0700 drm/xe/debugfs: Correct printing of register whitelist ranges The register-save-restore debugfs prints whitelist entries as offset ranges. E.g., REG[0x39319c-0x39319f]: allow read access for a single dword-sized register. However the GENMASK value used to set the lower bits to '1' for the upper bound of the whitelist range incorrectly included one more bit than it should have, causing the whitelist ranges to sometimes appear twice as large as they really were. For example, REG[0x6210-0x6217]: allow rw access was also intended to be a single dword-sized register whitelist (with a range 0x6210-0x6213) but was printed incorrectly as a qword-sized range because one too many bits was flipped on. Similar 'off by one' logic was applied when printing 4-dword register ranges and 64-dword register ranges as well. Correct the GENMASK logic to print these ranges in debugfs correctly. No impact outside of correcting the misleading debugfs output. Fixes: d855d2246ea6 ("drm/xe: Print whitelist while applying") Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20260408-regsr_wl_range-v1-1-e9a28c8b4264@intel.com Signed-off-by: Matt Roper (cherry picked from commit 1a2a722ff96749734a5585dfe7f0bea7719caa8b) Signed-off-by: Rodrigo Vivi commit 9407936237c98104873550219efedc286f28bbe9 Author: Matt Roper Date: Fri Apr 10 15:50:30 2026 -0700 drm/xe: Mark ROW_CHICKEN5 as a masked register ROW_CHICKEN5 is a masked register (i.e., to adjust the value of any of the lower 16 bits, the corresponding bit in the upper 16 bits must also be set). Add the XE_REG_OPTION_MASKED to its definition; failure to do so will cause workaround updates of this register to not apply properly. Bspec: 56853 Fixes: 835cd6cbb0d0 ("drm/xe/xe3p_lpg: Add initial workarounds for graphics version 35.10") Reviewed-by: Gustavo Sousa Link: https://patch.msgid.link/20260410-xe3p_tuning-v1-3-e206a62ee38f@intel.com Signed-off-by: Matt Roper (cherry picked from commit cd84bfbba7feb4c1e72356f14de026dfda1a9e2a) Signed-off-by: Rodrigo Vivi commit 2299d73562e68e85e358289438924572b01cfe19 Author: Matt Roper Date: Fri Apr 10 15:50:29 2026 -0700 drm/xe/tuning: Use proper register offset for GAMSTLB_CTRL From Xe2 onward (i.e., all platforms officially supported by the Xe driver), the GAMSTLB_CTRL register is located at offset 0x477C and represented by the macro "GAMSTLB_CTRL" in code. However the register formerly resided at offset 0xCF4C on Xe1-era platforms, and we also have macro XEHP_GAMSTLB_CTRL that represents this old offset in the unofficial/developer-only Xe1 code. When tuning for the register was added for Xe3p_LPG, the old Xe1-era macro was accidentally used instead of the proper macro for Xe2 and beyond, causing the tuning to not be applied properly. Use the proper definition so that the correct offset is written to. Bspec: 59298 Fixes: 377c89bfaa5d ("drm/xe/xe3p_lpg: Set STLB bank hash mode to 4KB") Reviewed-by: Gustavo Sousa Link: https://patch.msgid.link/20260410-xe3p_tuning-v1-2-e206a62ee38f@intel.com Signed-off-by: Matt Roper (cherry picked from commit 0b1676eafdd1ba5a5436bdca0d2a25ce56699783) Signed-off-by: Rodrigo Vivi commit 68fdf2c943bbba75d4f3a5c5546bc764f5886c13 Author: Gustavo Sousa Date: Wed Apr 1 19:10:51 2026 -0300 drm/xe/xe3p_lpg: Add missing indirect ring state feature flag Even though commit 8fcb7dfb8bbf ("drm/xe/xe3p_lpg: Add support for graphics IP 35.10") mentions that the support for Indirect Ring State exists for Xe3p_LPG, it missed actually setting the feature flag in graphics_xe3p_lpg. Fix that by adding the missing member. Fixes: 8fcb7dfb8bbf ("drm/xe/xe3p_lpg: Add support for graphics IP 35.10") Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260401-xe3p_lpg-indirect-ring-state-v1-1-0e4b5edf6898@intel.com Signed-off-by: Gustavo Sousa (cherry picked from commit ec4f4970eb744fd7d6d135f40f5c83bd05982e72) Signed-off-by: Rodrigo Vivi commit 9d7ca81b3019905c36c8cae9c306827325ba5878 Author: Matt Roper Date: Wed Apr 1 13:12:44 2026 -0700 drm/xe: Drop redundant rtp entries for Wa_14019988906 & Wa_14019877138 There appears to have been a silent merge conflict between some commits updating the workaround tables on Xe's -fixes and -next branches: - Commit bc6387a2e0c1 ("drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138") from the fixes branch moved the Xe2_HPG instance of two workarounds touching the PSS_CHICKEN register from the engine_was[] table to the lrc_was[] table; the equivalent implementation for all other platforms/IPs were already properly located on lrc_was[]. This commit on the fixes branch is a cherry-pick of commit e04c609eedf4 ("drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138") that already existed on the next branch. - Commit 55b19abb6c44 ("drm/xe: Consolidate workaround entries for Wa_14019877138") and commit c2142a1a8415 ("drm/xe: Consolidate workaround entries for Wa_14019988906") consolidated the individual entries per IP generation for each workaround into single, larger range-based entries. During merge conflict resolution the Xe2_HPG-specific entries (i.e., those with rule "GRAPHICS_VERSION_RANGE(2001, 2002)") were accidentally resurrected, even though the table already contains the consolidated entries that match a superset of thse ranges. These redundant entries don't cause any build failures but do trigger a dmesg error during probe on BMG-G21 devices: xe 0000:03:00.0: [drm] *ERROR* Tile0: GT0: discarding save-restore reg 7044 (clear: 00000400, set: 00000400, masked: yes, mcr: yes): ret=-22 xe 0000:03:00.0: [drm] *ERROR* Tile0: GT0: discarding save-restore reg 7044 (clear: 00000020, set: 00000020, masked: yes, mcr: yes): ret=-22 Re-drop the Xe2_HPG-specific table entries to eliminate the error. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7433 Fixes: 17b95278ae6a ("Merge tag 'drm-xe-next-2026-03-02' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next") Cc: Dave Airlie Signed-off-by: Matt Roper Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260401-wa_merge_conflict-v1-1-b477ab53fedc@intel.com Signed-off-by: Maarten Lankhorst (cherry picked from commit c79bc999442ff3c0908ab8bce92b2a3cb7d59861) Signed-off-by: Rodrigo Vivi commit 2bc0cce2724f74dde914d11fabb35b3a912c8329 Author: Jonathan Cavitt Date: Tue Mar 31 18:12:17 2026 +0000 drm/xe/vm: Add missing pad and extensions check Add missing pad and extensions check to xe_vm_get_property_ioctl v2: - Combine with other check (Auld) Fixes: 50c577eab051 ("drm/xe/xe_vm: Implement xe_vm_get_property_ioctl") Suggested-by: Matthew Auld Signed-off-by: Jonathan Cavitt Reviewed-by: Matthew Auld Reviewed-by: Matthew Brost Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260331181216.37775-2-jonathan.cavitt@intel.com (cherry picked from commit 896070686b16cc45cca7854be2049923b2b303d3) Signed-off-by: Rodrigo Vivi commit a0fc362f095330f7b3f68ac0c55ef8da18290c87 Author: Matthew Brost Date: Thu Mar 26 14:01:16 2026 -0700 drm/xe: Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge() xe_guc_submit_wedge() runs in the DMA-fence signaling path, where GFP_KERNEL memory allocations are not permitted. However, registering guc_submit_wedged_fini via drmm_add_action_or_reset() triggers such an allocation. Avoid this by moving the logic from guc_submit_wedged_fini() into guc_submit_fini(), where wedged exec queue references are dropped during normal teardown. Fixes: 8ed9aaae39f3 ("drm/xe: Force wedged state and block GT reset upon any GPU hang") Signed-off-by: Matthew Brost Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260326210116.202585-3-matthew.brost@intel.com (cherry picked from commit 4a706bd93c4fb156a13477e26ffdf2e633edeb10) Signed-off-by: Rodrigo Vivi commit c444139cb747bf6de1922b39900fdf02281490f4 Author: DaeMyung Kang Date: Sat Apr 25 18:38:28 2026 +0900 ksmbd: rewrite stop_sessions() with restartable iteration stop_sessions() walks conn_list with hash_for_each() and, for every entry, drops conn_list_lock across the transport ->shutdown() call before re-acquiring the read lock to continue the loop. The hash walk relies on cross-iteration state (the current bucket and the hlist position), which is not preserved across unlock/relock: if another thread performs a list mutation during the unlocked window, the ongoing iteration becomes unreliable and can re-visit connections that have already been handled or skip connections that have not. The outer `if (!hash_empty(conn_list)) goto again;` retry masks the symptom in the common case but does not address the unsafe iteration itself. Reframe the loop so it never relies on iterator state across unlock/relock. Under conn_list_lock held for read, pick the first connection whose ->shutdown() has not yet been issued by this path, pin it by taking an extra reference, record that fact on the connection and mark it EXITING while still inside the locked walk, then drop the lock. Then call ->shutdown() outside the lock, drop the pin (freeing the connection if the handler already released its reference), and restart from the top. Use a new per-connection flag, conn->stop_called, as the "shutdown issued from stop_sessions()" marker rather than reusing the status state. ksmbd_conn_set_exiting() is also invoked by ksmbd_sessions_deregister() on sibling channels of a multichannel session without issuing a transport shutdown, so treating KSMBD_SESS_EXITING as "already handled here" would skip connections that still need shutdown() to wake their handler out of recv(), leaving the outer retry waiting indefinitely for the hash to drain. stop_sessions() is serialised by init_lock in ksmbd_conn_transport_destroy(), so writing stop_called under the read lock has no other writer. Set EXITING inside the locked walk so the selection, the stop_called marker, and the status transition all happen together, and guard against regressing a connection that has already advanced to KSMBD_SESS_RELEASING on its own (for example, if the handler exited its receive loop for an unrelated reason between teardown steps). When the pin drop is the last put, release the transport and pair ida_destroy(&target->async_ida) with the ida_init() done in ksmbd_conn_alloc(), so stop_sessions() retiring a connection on its own does not leak the xarray backing of the embedded async_ida. The outer retry with msleep() is kept to wait for handler threads to reach ksmbd_conn_free() and drain the hash. Observed with an instrumented build that logs one line per visit and widens the unlocked window before ->shutdown() by 200 ms, under five concurrent cifs mounts (nosharesock, one connection each): * Current code: the same connection address is revisited many times during a single stop_sessions() call and ->shutdown() is invoked well beyond the number of live connections before the hash finally drains. * Rewritten code: each live connection produces exactly one ->shutdown() call; the function returns as soon as the hash is empty. Functional teardown via `ksmbd.control --shutdown` with the same five mounts completes cleanly on the rewritten path. Performance is observably unchanged. Tearing down N concurrent nosharesock cifs connections with `ksmbd.control --shutdown` + `rmmod ksmbd` takes essentially the same wall time before and after the rewrite: N before after 10 4.93s 5.34s 30 7.34s 7.03s 50 7.31s 7.01s (3-run avg: 7.04s vs 7.25s) 100 6.98s 6.78s 200 6.77s 6.89s and the number of ->shutdown() calls equals the number of live connections on both paths when the race is not widened. The teardown is dominated by the msleep(100)-based outer retry waiting for handler threads to run ksmbd_conn_free(), not by the iteration itself; the restartable loop's worst-case O(N^2) visit cost is in the microseconds even at N=200 and sits far below the msleep(100) granularity. Applied alone on top of ksmbd-for-next-next, this patch does not introduce a new leak site. Under the same reproducer (10x concurrent-holders + ss -K + ksmbd.control --shutdown + rmmod), the tree still shows the pre-existing per-connection transport leak count that arises when the last refcount drop lands in one of ksmbd_conn_r_count_dec(), __free_opinfo() or session_fd_check() - all of which end with a bare kfree() today. kmemleak backtraces for the unreferenced objects point into the TCP accept path (sk_clone -> inet_csk_clone_lock, sock_alloc_inode) and none involve stop_sessions(). Plugging those bare-kfree sites is the responsibility of the follow-up patch. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: DaeMyung Kang Acked-by: Namjae Jeon Signed-off-by: Steve French commit ab4ad35e58a74c0fc51e5b0bcfb56523e97ff65f Author: Marios Makassikis Date: Wed Apr 22 12:49:00 2026 +0200 smb: server: handle readdir_info_level_struct_sz() error early exit in smb2_populate_readdir_entry() if the requested info_level is unknown. Signed-off-by: Marios Makassikis Acked-by: Namjae Jeon Signed-off-by: Steve French commit 019155e2bd3e2cec425553195e9f9bc76bb0f848 Author: Timur Kristóf Date: Tue Apr 28 13:40:45 2026 +0200 drm/amd/display: Use EDID from VBIOS embedded panel info When an embedded panel has no DDC, read the EDID from the VBIOS embedded panel info and use that. Fixes: 7c7f5b15be65 ("drm/amd/display: Refactor edid read.") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 399b9abc353c62f6e37d38325edbdb6c2c00411c) commit 9ea16f64189bf7b6ba50fc7f0325b3c1f836d105 Author: Timur Kristóf Date: Tue Apr 28 13:40:44 2026 +0200 drm/amd/display: Read EDID from VBIOS embedded panel info Some board manufacturers hardcode the EDID for the embedded panel in the VBIOS. This EDID should be used when the panel doesn't have a DDC. For reference, see the legacy non-DC display code: amdgpu_atombios_encoder_get_lcd_info() This is necessary to support embedded connectors without DDC. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit eb105e63b474c11ef6a84a1c6b18100d851ff364) commit 60af4605ef35ecb7ad649a8534b83a2f7c69576d Author: Timur Kristóf Date: Tue Apr 28 13:40:43 2026 +0200 drm/amd/display: Allow constructing DCE8 link encoder without DDC When the DDC channel ID is set to CHANNEL_ID_UNKNOWN, pass NULL to the AUX regs array. This is necessary to support embedded connectors without DDC. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 155baf3038c1af50b602723022ed869b38e86a99) commit 880498a1943f865529819f778df3b9945ca57262 Author: Timur Kristóf Date: Tue Apr 28 13:40:42 2026 +0200 drm/amd/display: Allow constructing DCE6 link encoder without DDC When the DDC channel ID is set to CHANNEL_ID_UNKNOWN, pass NULL to the AUX regs array. This is necessary to support embedded connectors without DDC. Fixes: 7c15fd86aaec ("drm/amd/display: dc/dce: add initial DCE6 support (v10)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 38a70e50b22a188ff601740d64dd75f46213121f) commit ac27e3f99035f132f23bc0409d0e57f11f054c70 Author: Timur Kristóf Date: Tue Apr 28 13:40:41 2026 +0200 drm/amd/display: Allow DCE link encoder without AUX registers Allow constructing the DCE link encoder without DDC, which means the AUX registers array will be NULL. This is necessary to support embedded connectors without DDC. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 87f30b101af62590faf6020d106da07efdda199b) commit 494941aa772dab79251543764db6cd14bd337e43 Author: Timur Kristóf Date: Tue Apr 28 13:40:40 2026 +0200 drm/amd/display: Allow embedded connectors without DDC On some laptops, the embedded panel may not have a DDC (display data channel) available. On these, the EDID may be hardcoded in ACPI or the VBIOS. In this case, use GPIO_DDC_LINE_UNKNOWN and don't fail. Fixes: def3488eb0fd ("drm/amd/display: refactor HPD to increase flexibility") Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192 Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 75b8a6ca0e8bc3ce24572f854e95f8721b321179) commit a1fc7bf6677eb547167cb72b3bcafdc34b976692 Author: Leo Li Date: Wed Apr 22 12:29:56 2026 -0400 drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs [Why] Rapid vblank off is causing flip-done timeouts for NV3x and newer family of GPUs that support more idle optimization features. A proper fix requires further investigation. In lieu of it, let's workaround it for now. [How] For NV3x and newer family of DGPUs, restore the old 5s vblank off timer. Fixes: 9b47278cec98 ("drm/amd/display: temp w/a for dGPU to enter idle optimizations") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3787 Link: https://lore.kernel.org/amd-gfx/20260217191632.1243826-1-sysdadmin@m1k.cloud/ Tested-by: Michele Palazzi Reviewed-by: Mario Limonciello Signed-off-by: Leo Li Signed-off-by: Alex Deucher (cherry picked from commit df482c2d441b090161633566b7a0755f1bbd55c2) commit 57b8e2d666a31fa201432d58f5fe3469a0dd83ba Merge: 664f0f6be37ce4 39f1c201b93f4f Author: Linus Torvalds Date: Wed Apr 29 06:56:50 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "On top of a lot of Arm fixes, this includes a massive rename of types and variables in tools/testing/selftests/kvm - these were unnecessarily different from what the kernel uses, so they're being made consistent. arm64: - Allow tracing for non-pKVM, which was accidentally disabled when the series was merged - Rationalise the way the pKVM hypercall ranges are defined by using the same mechanism as already used for the vcpu_sysreg enum - Enforce that SMCCC function numbers relayed by the pKVM proxy are actually compliant with the specification - Fix a couple of feature to idreg mappings which resulted in the wrong sanitisation being applied - Fix the GICD_IIDR revision number field that could never been written correctly by userspace - Make kvm_vcpu_initialized() correctly use its parameter instead of relying on the surrounding context - Enforce correct ordering in __pkvm_init_vcpu(), plugging a potential pin leak at the same time - Move __pkvm_init_finalise() to a less dangerous spot, avoiding future problems - Restore functional userspace irqchip support after a four year breakage (last functional kernel was 5.18...) - Spelling fixes Selftests: - Rename types across all KVM selftests to more closely align with types used in the kernel: vm_vaddr_t -> gva_t vm_paddr_t -> gpa_t uint64_t -> u64 uint32_t -> u32 uint16_t -> u16 uint8_t -> u8 int64_t -> s64 int32_t -> s32 int16_t -> s16 int8_t -> s8 - Fix Loongarch compilation" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (31 commits) KVM: selftests: Add check_steal_time_uapi() implementation for LoongArch KVM: arm64: Wake-up from WFI when iqrchip is in userspace KVM: arm64: Fix initialisation order in __pkvm_init_finalise() KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() KVM: arm64: Fix kvm_vcpu_initialized() macro parameter KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer KVM: arm64: Fix typo in feature check comments KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer KVM: arm64: Reject non compliant SMCCC function calls in pKVM KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value KVM: selftests: Replace "paddr" with "gpa" throughout KVM: selftests: Replace "u64 nested_paddr" with "gpa_t l2_gpa" KVM: selftests: Replace "u64 gpa" with "gpa_t" throughout KVM: selftests: Replace "vaddr" with "gva" throughout KVM: selftests: Clarify that arm64's inject_uer() takes a host PA, not a guest PA KVM: selftests: Rename translate_to_host_paddr() => translate_hva_to_hpa() KVM: selftests: Rename vm_vaddr_populate_bitmap() => vm_populate_gva_bitmap() KVM: selftests: Rename vm_vaddr_unused_gap() => vm_unused_gva_gap() KVM: selftests: Drop "vaddr_" from APIs that allocate memory for a given VM KVM: selftests: Use u8 instead of uint8_t ... commit 14acf9652e5690de3c7486c6db5fb8dafd0a32a3 Author: Michal Kosiorek Date: Wed Apr 29 10:54:51 2026 +0200 xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on 6.12.47, also reachable via the same code path on torvalds/master and on the ipsec tree). Nine unique signatures cluster in the xfrm_state lifecycle, the load-bearing one being: BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline] BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline] BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435 Workqueue: netns cleanup_net Call Trace: __hlist_del / hlist_del_rcu __xfrm_state_delete xfrm_state_delete xfrm_state_flush xfrm_state_fini ops_exit_list cleanup_net The other observed signatures hit the same slab object from __xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB write variant of __xfrm_state_delete, all on the byseq/byspi hash chains. __xfrm_state_delete() guards its byseq and byspi unhashes with value-based predicates: if (x->km.seq) hlist_del_rcu(&x->byseq); if (x->id.spi) hlist_del_rcu(&x->byspi); while everywhere else in the file (e.g. state_cache, state_cache_input) the safer hlist_unhashed() check is used. xfrm_alloc_spi() sets x->id.spi = newspi inside xfrm_state_lock and then immediately inserts into byspi, but a path that observes x->id.spi != 0 outside of xfrm_state_lock can still skip-or-hit the byspi unhash inconsistently with whether x is actually on the list. The same holds for x->km.seq versus byseq, and the bydst/bysrc unhashes have no predicate at all, so a second __xfrm_state_delete() on the same object writes through LIST_POISON pprev. The defensive change here: - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst, bysrc, byseq and byspi so a second deletion is a no-op rather than a write through LIST_POISON pprev. The byseq/byspi nodes are already initialised in xfrm_state_alloc(). - Test hlist_unhashed() rather than the value predicate for byseq/byspi, so the unhash decision tracks list state rather than mutable scalar fields. Empirical verification: applied this patch on top of v6.12.47, rebuilt, and re-ran the same syzkaller harness for 1h16m on a previously-crashy configuration that produced ~100 hits each of slab-use-after-free Read in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in __xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at ~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo confirms the xfrm_state slab is actively allocated and freed during the run (~143 KiB resident), so the fuzzer is still exercising those code paths -- they just no longer crash. Reproduction: - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal - 9 unique signatures collected in ~9h, all within xfrm_state lifecycle Fixes: fe9f1d8779cb ("xfrm: add state hashtable keyed by seq") Fixes: 7b4dc3600e48 ("[XFRM]: Do not add a state whose SPI is zero to the SPI hash.") Reported-by: Michal Kosiorek Tested-by: Michal Kosiorek Cc: stable@vger.kernel.org Signed-off-by: Michal Kosiorek Signed-off-by: Steffen Klassert commit 28465227c80fe417b4013c432be1f3737cb9f9a3 Author: Ruijie Li Date: Wed Apr 29 00:41:43 2026 +0800 xfrm: provide message size for XFRM_MSG_MAPPING The compat 64=>32 translation path handles XFRM_MSG_MAPPING, but xfrm_msg_min[] does not provide the native payload size for this message type. Add the missing XFRM_MSG_MAPPING entry so compat translation can size and translate mapping notifications correctly. Fixes: 5461fc0c8d9f ("xfrm/compat: Add 64=>32-bit messages translator") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Ruijie Li Signed-off-by: Ren Wei Signed-off-by: Steffen Klassert commit bc7304f3ae20972d11db6e0b1b541c63feda5f05 Author: Sebastian Andrzej Siewior Date: Tue Apr 28 12:34:25 2026 +0200 futex: Prevent lockup in requeue-PI during signal/ timeout wakeup During wait-requeue-pi (task A) and requeue-PI (task B) the following race can happen: Task A Task B futex_wait_requeue_pi() futex_setup_timer() futex_do_wait() futex_requeue() CLASS(hb, hb1)(&key1); CLASS(hb, hb2)(&key2); *timeout* futex_requeue_pi_wakeup_sync() requeue_state = Q_REQUEUE_PI_IGNORE *blocks on hb->lock* futex_proxy_trylock_atomic() futex_requeue_pi_prepare() Q_REQUEUE_PI_IGNORE => -EAGAIN double_unlock_hb(hb1, hb2) *retry* Task B acquires both hb locks and attempts to acquire the PI-lock of the top most waiter (task B). Task A is leaving early due to a signal/ timeout and started removing itself from the queue. It updates its requeue_state but can not remove it from the list because this requires the hb lock which is owned by task B. Usually task A is able to swoop the lock after task B unlocked it. However if task B is of higher priority then task A may not be able to wake up in time and acquire the lock before task B gets it again. Especially on a UP system where A is never scheduled. As a result task A blocks on the lock and task B busy loops, trying to make progress but live locks the system instead. Tragic. This can be fixed by removing the top most waiter from the list in this case. This allows task B to grab the next top waiter (if any) in the next iteration and make progress. Remove the top most waiter if futex_requeue_pi_prepare() fails. Let the waiter conditionally remove itself from the list in handle_early_requeue_pi_wakeup(). Fixes: 07d91ef510fb1 ("futex: Prevent requeue_pi() lock nesting issue on RT") Reported-by: Moritz Klammler Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260428103425.dywXyPd3@linutronix.de Closes: https://lore.kernel.org/all/VE1PR06MB6894BE61C173D802365BE19DFF4CA@VE1PR06MB6894.eurprd06.prod.outlook.com commit cda92ac47c024d84f6b8294e462d6272039a10ac Author: WANG Rui Date: Mon Apr 27 16:47:21 2026 +0800 efi/libstub: Synchronize instruction cache after kernel relocation The relocated kernel image is copied to its new location using memcpy(). On architectures with separate instruction and data caches, the copied instructions may remain stale in the instruction cache, leading to the execution of outdated contents. Call efi_cache_sync_image() after the relocation copy to ensure the instruction cache is synchronized with the updated memory contents before control is transferred to the relocated kernel. Signed-off-by: WANG Rui Reviewed-by: Huacai Chen Signed-off-by: Ard Biesheuvel commit ad6f4f3ea72f866176f9dd6031c8778da088c686 Author: WANG Rui Date: Mon Apr 27 16:47:20 2026 +0800 efi/loongarch: Implement efi_cache_sync_image() Provide a LoongArch implementation of efi_cache_sync_image() to ensure instruction cache coherency after the kernel image is relocated. Signed-off-by: WANG Rui Reviewed-by: Huacai Chen Signed-off-by: Ard Biesheuvel commit 883a32793c86091ea37bb84f88cc697d019e7a5d Author: Ard Biesheuvel Date: Tue Apr 28 12:38:47 2026 +0200 efi/libstub: Move efi_relocate_kernel() into its only remaining user LoongArch is the only arch that still uses efi_relocate_kernel(), so before making changes to it that LoongArch needs, turn it into a private function. Move efi_low_alloc_above() into mem.c while at it, and drop the relocate.c source file altogether. Tested-by: WANG Rui Reviewed-by: Thomas Huth Signed-off-by: Ard Biesheuvel commit e052a1f7199260eda4d6ca08a59c3b98738f8491 Author: Shenghao Ding Date: Wed Apr 29 13:42:06 2026 +0800 ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0 pages >1 In TAS2781 SPI mode, when accessing non-book-zero or page numbers greater than 1 in book 0, an additional byte must be read. The first byte in such cases is a dummy byte and should be ignored. Fixes: 9fa6a693ad8d ("ALSA: hda/tas2781: Remove tas2781_spi_fwlib.c and leverage SND_SOC_TAS2781_FMWLIB") Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20260429054206.429-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai commit 90df4957a3271adf391b3432cd76a40887cf3273 Author: Richard Fitzgerald Date: Tue Apr 28 14:05:31 2026 +0100 ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi() Eliminate the uninitialized 'nval' in cs35l56_hda_read_acpi() if a system-specific quirk overrides processing of the dev-index property. The value is now stored in a new 'num_amps' member of struct cs35l56_hda so that the quirk handler can set the value. The quirk for the Lenovo Yoga Book 9i GenX replaces the values from the dev-index property with hardcoded indexes. So cs35l56_hda_read_acpi() would then skip reading the property. But this left the 'nval' local variable uninitialized when it is later passed to cirrus_scodec_get_speaker_id(). Fixes: 40b1c2f9b299 ("ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-sound/aenFesLAStjrVNy8@stanley.mountain/T/#u Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260428130531.169600-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai commit b0e2333a231107adedd38c6fcfe1adc6162716fc Author: wangdicheng Date: Tue Apr 28 16:04:50 2026 +0800 ALSA: hda/conexant: Fix missing error check for jack detection In cx_probe(), the return value of snd_hda_jack_detect_enable_callback() is ignored. This function returns a pointer, and if it fails (e.g., due to memory allocation failure), it returns an error pointer which must be checked using IS_ERR(). If the registration fails, the driver continues to probe, but the jack detection callback will not be registered. This can lead to a kernel crash later when the driver attempts to handle jack events or accesses the uninitialized structure. Check the return value using IS_ERR() and propagate the error via PTR_ERR() to the probe caller. Fixes: 7aeb25908648 ("ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140") Signed-off-by: wangdicheng Link: https://patch.msgid.link/20260428080450.108801-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit 077c593dacf7ee33511468e4f29417d795cf07a4 Author: Takashi Iwai Date: Tue Apr 28 08:17:56 2026 +0200 ALSA: hda: Avoid WARN_ON() for HDMI chmap slot checks At parsing the channel mapping for HDMI, the current code may spew WARN_ON() unnecessarily for the case where only invalid (zero) channel maps are given from the hardware. Drop WARN_ON() and reorganize the code a bit for avoiding the hdmi_slot over the array size. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221390 Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260428061800.80527-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 2d80392a97cf205a766d75539b4c814a4f5e7490 Author: Abhinav Mahadevan Date: Tue Apr 28 21:20:00 2026 +0530 ALSA: usb-audio: Fix quirk entry placement for PreSonus AudioBox USB The quirk entry for PreSonus AudioBox USB was mistakenly placed inside a disabled #if 0 block. Move it to the correct position after the Fixes: 34fe4a9df247 ("ALSA: usb-audio: Add quirk for PreSonus AudioBox USB") Signed-off-by: Abhinav Mahadevan Link: https://patch.msgid.link/20260428155117.5170-1-abhi220204@gmail.com Signed-off-by: Takashi Iwai commit a7b75a11c6f16c049a2ea17cf9d1aaaa57201cf3 Merge: 6e7247d8f5fefe 03dcb5b68a96b5 Author: Takashi Iwai Date: Wed Apr 29 07:46:33 2026 +0200 Merge tag 'asoc-fix-v7.1-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.1 We've had quite a lot of fixes come in this past week, all driver stuff rather than any broad systematic issue. All quite routine stuff. commit de019f203b0d472c98ead4081ad4f05d92c9b826 Author: Johan Hovold Date: Tue Apr 7 11:50:27 2026 +0200 clk: rk808: fix OF node reference imbalance The driver reuses the OF node of the parent multi-function device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices. Fix this by using the intended helper for reusing OF nodes. Fixes: 2dc51ca822e4 ("clk: RK808: Reduce 'struct rk808' usage") Cc: stable@vger.kernel.org # 6.5 Cc: Sebastian Reichel Signed-off-by: Johan Hovold Reviewed-by: Sebastian Reichel Reviewed-by: Brian Masney Reviewed-by: Heiko Stuebner Signed-off-by: Stephen Boyd commit 69056753231f483cc1e40db52228aac42fd4c93d Author: Brian Masney Date: Wed Apr 15 16:30:49 2026 -0400 MAINTAINERS: add myself as a reviewer for the clk subsystem I've reviewed a lot clk patches for parts of the subsystem that typically doesn't get much review. Add myself as a reviewer so that I don't miss anything. Link: https://lore.kernel.org/linux-clk/?q=f%3Abmasney%40redhat.com Signed-off-by: Brian Masney Signed-off-by: Stephen Boyd commit 03dcb5b68a96b51157ec2d17042fa2f0106828ae Author: Troy Mitchell Date: Wed Apr 29 09:38:48 2026 +0800 ASoC: spacemit: adjust FIFO trigger threshold to half FIFO size Set both TX and RX FIFO trigger thresholds (TFT/RFT) to 0xF (half of the 32-entry FIFO) instead of 5. This provides better DMA efficiency by allowing more data to accumulate before triggering a DMA request, reducing the number of DMA transactions needed. Signed-off-by: Troy Mitchell Link: https://patch.msgid.link/20260429-k3-i2s-v1-3-2fe99db11ecb@linux.spacemit.com Signed-off-by: Mark Brown commit 6b4afbaaa342eaa52172e0be5ef8d1fcbf9ff460 Author: Troy Mitchell Date: Wed Apr 29 09:38:47 2026 +0800 ASoC: spacemit: move hw constraints from hw_params to startup Hardware constraints should be applied in the startup callback rather than hw_params, as hw_params may be called too late for the constraints to take effect properly. Move the channel count and format constraints for I2S and DSP_A/DSP_B modes into a new startup callback. This also tightens the I2S mode channel constraint from 1-2 to exactly 2, matching the actual hardware behavior. Signed-off-by: Troy Mitchell Link: https://patch.msgid.link/20260429-k3-i2s-v1-2-2fe99db11ecb@linux.spacemit.com Signed-off-by: Mark Brown commit 4ac170432cf74b753cf59bcd0d449dced48585da Author: Théo Lebrun Date: Wed Feb 25 17:55:07 2026 +0100 reset: eyeq: drop device_set_of_node_from_dev() done by parent Our parent driver (clk-eyeq) now does the device_set_of_node_from_dev(dev, dev->parent) call through the newly introduced devm_auxiliary_device_create() helper. Doing it again in the reset-eyeq probe would be redundant. Drop both the WARN_ON() and the device_set_of_node_from_dev() call. Also fix the following comment that talks about "our newfound OF node". Signed-off-by: Jerome Brunet Reviewed-by: Philipp Zabel Acked-by: Philipp Zabel Signed-off-by: Théo Lebrun Signed-off-by: Stephen Boyd commit a25ab518f355e1f0dcbea24ee26418dfcd6944b5 Author: Théo Lebrun Date: Wed Feb 25 17:55:06 2026 +0100 clk: eyeq: add EyeQ5 children auxiliary device for generic PHYs Grow our clk-eyeq family; it knows how to spawn reset provider and pin controller children. Expand with a generic PHY driver on EyeQ5. Reviewed-by: Luca Ceresoli Signed-off-by: Théo Lebrun Signed-off-by: Stephen Boyd commit 79a1886be1564a009cd2a003bada15ed6153f819 Author: Jerome Brunet Date: Wed Feb 25 17:55:05 2026 +0100 clk: eyeq: use the auxiliary device creation helper The auxiliary device creation of this driver is simple enough to use the available auxiliary device creation helper. Use it and remove some boilerplate code. Tested-by: Théo Lebrun # On Mobileye EyeQ5 Signed-off-by: Jerome Brunet Reviewed-by: Luca Ceresoli Signed-off-by: Théo Lebrun Signed-off-by: Stephen Boyd commit 3e75021f615ceee8562e6455c335936b39929ffb Author: Troy Mitchell Date: Fri Apr 24 16:20:32 2026 +0800 clk: spacemit: k3: mark top_dclk as CLK_IS_CRITICAL top_dclk is the DDR bus clock. If it is gated by clk_disable_unused, all memory-mapped bus transactions cease to function, causing DMA engines to hang and general system instability. Mark it CLK_IS_CRITICAL so the CCF never gates it during the unused clock sweep. Fixes: e371a77255b8 ("clk: spacemit: k3: add the clock tree") Reviewed-by: Brian Masney Signed-off-by: Troy Mitchell Signed-off-by: Stephen Boyd commit 0c7a5ba011d336df4fcd1f667fcc16ea5549be12 Merge: 21a7bb5cde5585 1774d3cf3cf17b Author: Jakub Kicinski Date: Tue Apr 28 18:36:29 2026 -0700 Merge branch 'mptcp-misc-fixes-for-v7-1-rc2' Matthieu Baerts says: ==================== mptcp: misc fixes for v7.1-rc2 Here are various unrelated fixes: - Patches 1-2: set timestamp flags on 'ssk', not 'sk' (typo); Plus do that with sleepable lock_sock/release_sock. A fix for v5.14. - Patch 3: respect SO_LINGER(1, 0) by sending MP_FASTCLOSE at close time as expected. A fix for v6.1. - Patch 4: reset fullmesh counter after a flush. A fix for v6.19. ==================== Link: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-0-7432b7f279fa@kernel.org Signed-off-by: Jakub Kicinski commit 1774d3cf3cf17baaf30c095606cda496268283b3 Author: Matthieu Baerts (NGI0) Date: Mon Apr 27 21:54:36 2026 +0200 mptcp: pm: kernel: reset fullmesh counter after flush This variable counts how many MPTCP endpoints have a 'fullmesh' flag set. After having flushed all MPTCP endpoints, it is then needed to reset this counter. Without this reset, this counter exposed to the userspace is wrong, but also non-fullmesh endpoints added after the flush will not be taken into account to create subflows in reaction to ADD_ADDRs. Fixes: f88191c7f361 ("mptcp: pm: in-kernel: record fullmesh endp nb") Cc: stable@vger.kernel.org Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260422-mptcp-inc-limits-v6-0-903181771530%40kernel.org?part=15 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-4-7432b7f279fa@kernel.org Signed-off-by: Jakub Kicinski commit f14d6e9c3678a067f304abba561e0c5446c7e845 Author: Matthieu Baerts (NGI0) Date: Mon Apr 27 21:54:35 2026 +0200 mptcp: fastclose msk when linger time is 0 The SO_LINGER socket option has been supported for a while with MPTCP sockets [1], but it didn't cause the equivalent of a TCP reset as expected when enabled and its time was set to 0. This was causing some behavioural differences with TCP where some connections were not promptly stopped as expected. To fix that, an extra condition is checked at close() time before sending an MP_FASTCLOSE, the MPTCP equivalent of a TCP reset. Note that backporting up to [1] will be difficult as more changes are needed to be able to send MP_FASTCLOSE. It seems better to stop at [2], which was supposed to already imitate TCP. Validated with MPTCP packetdrill tests [3]. Fixes: 268b12387460 ("mptcp: setsockopt: support SO_LINGER") [1] Fixes: d21f83485518 ("mptcp: use fastclose on more edge scenarios") [2] Cc: stable@vger.kernel.org Reported-by: Lance Tuller Closes: https://github.com/lance0/xfr/pull/67 Link: https://github.com/multipath-tcp/packetdrill/pull/196 [3] Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-3-7432b7f279fa@kernel.org Signed-off-by: Jakub Kicinski commit b5c52908d52c6c8eb8933264aa6087a0600fd892 Author: Gang Yan Date: Mon Apr 27 21:54:34 2026 +0200 mptcp: fix scheduling with atomic in timestamp sockopt Using lock_sock_fast() (atomic context) around sock_set_timestamp() and sock_set_timestamping() is unsafe, as both helpers can sleep. Replace lock_sock_fast() with sleepable lock_sock()/release_sock() to avoid scheduling while atomic panic. Fixes: 9061f24bf82e ("mptcp: sockopt: propagate timestamp request to subflows") Cc: stable@vger.kernel.org Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260420093343.16443-1-gang.yan@linux.dev Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-2-7432b7f279fa@kernel.org Signed-off-by: Jakub Kicinski commit 5f95c21fc23a7ef22b4d27d1ed9bb55557ffb926 Author: Gang Yan Date: Mon Apr 27 21:54:33 2026 +0200 mptcp: sockopt: set timestamp flags on subflow socket, not msk Both mptcp_setsockopt_sol_socket_tstamp() and mptcp_setsockopt_sol_socket_timestamping() iterate over subflows, acquire the subflow socket lock, but then erroneously pass the MPTCP msk socket to sock_set_timestamp() / sock_set_timestamping() instead of the subflow ssk. As a result, the timestamp flags are set on the wrong socket and have no effect on the actual subflows. Pass ssk instead of sk to both helpers. Fixes: 9061f24bf82e ("mptcp: sockopt: propagate timestamp request to subflows") Cc: stable@vger.kernel.org Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-1-7432b7f279fa@kernel.org Signed-off-by: Jakub Kicinski commit 21a7bb5cde5585aded53a47f21d6534d7da2ae48 Merge: 403e7e34cc2ea7 869cd6490fafe0 Author: Jakub Kicinski Date: Tue Apr 28 18:28:14 2026 -0700 Merge branch 'netconsole-configfs-store-callback-fixes' Breno Leitao says: ==================== netconsole: configfs store callback fixes There are still some changes I want to make, such as, having the dynamic lock when reading from configfs (_show() callbacks), wich will solve other issues, but I will keep it for later. ==================== Link: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-0-59965f29d9cc@debian.org Signed-off-by: Jakub Kicinski commit 869cd6490fafe09c89a15d01610e8a03932d79f0 Author: Breno Leitao Date: Mon Apr 27 07:30:38 2026 -0700 netconsole: restore userdatum value on update_userdata() failure userdatum_value_store() updates udm->value first and only then calls update_userdata() to rebuild the on-the-wire payload. If update_userdata() fails (e.g. -ENOMEM from kmalloc), the function returns the error to userspace, but udm->value already holds the new string while the live nt->userdata buffer still reflects the old one. The next successful write to any sibling userdatum on the same target will call update_userdata() again, which walks every entry and packs the now-stale udm->value into the payload. The failed write is thus silently activated later, with no indication to userspace that the value it tried to set was rejected. Snapshot the previous value before overwriting udm->value and restore it if update_userdata() fails so the visible state and the active payload stay consistent. Fixes: eb83801af2dc ("netconsole: Dynamic allocation of userdata buffer") Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-4-59965f29d9cc@debian.org Signed-off-by: Jakub Kicinski commit 92ceb7bff62c2606f664c204750eca0b85d44112 Author: Breno Leitao Date: Mon Apr 27 07:30:37 2026 -0700 netconsole: propagate device name truncation in dev_name_store() dev_name_store() calls strscpy(nt->np.dev_name, buf, IFNAMSIZ) without checking the return value. If userspace writes an interface name longer than IFNAMSIZ - 1, strscpy() silently truncates and returns -E2BIG, but the function ignores it and reports a fully successful write back to userspace. If a real interface happens to match the truncated name, netconsole will bind to the wrong device on the next enable, sending kernel logs and panic output to an unintended network segment with no indication to userspace that anything was rewritten. Reject writes whose length cannot fit in nt->np.dev_name up front: if (count >= IFNAMSIZ) return -ENAMETOOLONG; This is not a big deal of a problem, but, it is still the correct approach. Fixes: 0bcc1816188e57 ("[NET] netconsole: Support dynamic reconfiguration using configfs") Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-3-59965f29d9cc@debian.org Signed-off-by: Jakub Kicinski commit e6dd94252b0fa7b4fcc00577c6898432c5d97a08 Author: Breno Leitao Date: Mon Apr 27 07:30:36 2026 -0700 netconsole: avoid clobbering userdatum value on truncated write userdatum_value_store() bounds count by MAX_EXTRADATA_VALUE_LEN (200) and then copies straight into udm->value, which is itself 200 bytes: if (count > MAX_EXTRADATA_VALUE_LEN) return -EMSGSIZE; ... ret = strscpy(udm->value, buf, sizeof(udm->value)); if (ret < 0) goto out_unlock; If userspace writes exactly MAX_EXTRADATA_VALUE_LEN bytes with no NUL within them, strscpy() copies 199 bytes plus a NUL into udm->value and returns -E2BIG. The function jumps to out_unlock and reports the error to userspace, but udm->value has already been overwritten with the truncated string and update_userdata() is skipped, so the corruption is not yet visible on the wire. The next successful write to any userdatum entry under the same target calls update_userdata(), which packs udm->value into the active netconsole payload. From that point on, every netconsole message carries the silently truncated value, and userspace has no indication that a previous, error-returning write left state behind. Tighten the entry check from "count > MAX_EXTRADATA_VALUE_LEN" to "count >= MAX_EXTRADATA_VALUE_LEN". With count strictly less than sizeof(udm->value), strscpy() can no longer return -E2BIG here, so the corrupting truncation path is removed entirely. Fixes: 8a6d5fec6c7f ("net: netconsole: add a userdata config_group member to netconsole_target") Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-2-59965f29d9cc@debian.org Signed-off-by: Jakub Kicinski commit d62c6f2df5c0e1390b9a1f45b1b52689e3f234f0 Author: Breno Leitao Date: Mon Apr 27 07:30:35 2026 -0700 netconsole: return count instead of strnlen(buf, count) from store callbacks Several configfs store callbacks in netconsole end with: ret = strnlen(buf, count); This under-reports the number of bytes consumed when the input contains an embedded NUL within count, telling the VFS that fewer bytes were written than userspace actually handed in. A conformant partial-write loop would then retry the trailing bytes against a callback that has already accepted them. Every other configfs driver in the tree returns count directly from its store callbacks once parsing has succeeded, including drivers/nvme/target/configfs.c, drivers/gpio/gpio-sim.c, drivers/most/configfs.c, drivers/block/null_blk/main.c, drivers/pci/endpoint/pci-ep-cfs.c, and the rest of the configfs users. netconsole was the outlier (along with drivers/infiniband/core/cma_configfs.c, which has the same latent issue). Align netconsole with the rest of the configfs ecosystem: return count once the parser/validator has accepted the input. The numeric and boolean parsers (kstrtobool, kstrtou16, mac_pton, netpoll_parse_ip_addr) have already validated the meaningful prefix; any trailing bytes are padding and should simply be reported as consumed. Fixes: 0bcc1816188e ("[NET] netconsole: Support dynamic reconfiguration using configfs") Reviewed-by: Simon Horman Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-1-59965f29d9cc@debian.org Signed-off-by: Jakub Kicinski commit 403e7e34cc2ea75a2546c94176271591211b3334 Merge: aa6c6d9ee064aa a6c95b833dc17e Author: Jakub Kicinski Date: Tue Apr 28 18:27:53 2026 -0700 Merge branch 'net-sched-sch_cake-annotate-data-races-in-cake_dump_stats-series' Eric Dumazet says: ==================== net/sched: sch_cake: annotate data-races in cake_dump_stats() (series) cake_dump_stats() runs without qdisc spinlock being held. This mini series adds missing READ_ONCE()/WRITE_ONCE() annotations. Original patch was too big, splitting it eases code review. ==================== Link: https://patch.msgid.link/20260427083606.459355-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a6c95b833dc17e84d16a8ac0f40fd0931616a52d Author: Eric Dumazet Date: Mon Apr 27 08:36:06 2026 +0000 net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) cake_dump_stats() runs without qdisc spinlock being held. In this final patch, I add READ_ONCE()/WRITE_ONCE() annotations for cparams.target and cparams.interval. Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") Signed-off-by: Eric Dumazet Acked-by: "Toke Høiland-Jørgensen" Link: https://patch.msgid.link/20260427083606.459355-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8fab48d87745a6ab1cec594b8d5865d9ae2db879 Author: Eric Dumazet Date: Mon Apr 27 08:36:05 2026 +0000 net/sched: sch_cake: annotate data-races in cake_dump_stats() (IV) cake_dump_stats() runs without qdisc spinlock being held. In this fourth patch, I add READ_ONCE()/WRITE_ONCE() annotations for the following fields: - avg_peak_bandwidth - buffer_limit - buffer_max_used - avg_netoff - max_netlen - max_adjlen - min_netlen - min_adjlen - active_queues - tin_rate_bps - bytes - tin_backlog Other annotations are added in following patch, to ease code review. Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") Signed-off-by: Eric Dumazet Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260427083606.459355-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 276a98a434964088fccd4745db5b34d6e831e358 Author: Eric Dumazet Date: Mon Apr 27 08:36:04 2026 +0000 net/sched: sch_cake: annotate data-races in cake_dump_stats() (III) cake_dump_stats() runs without qdisc spinlock being held. In this third patch, I add READ_ONCE()/WRITE_ONCE() annotations for the following fields: - packets - tin_dropped - tin_ecn_mark - ack_drops - peak_delay - avge_delay - base_delay Other annotations are added in following patches, to ease code review. Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") Signed-off-by: Eric Dumazet Acked-by: "Toke Høiland-Jørgensen" Link: https://patch.msgid.link/20260427083606.459355-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 91a96427b93b9ba27413077b7e825d2fefbfa134 Author: Eric Dumazet Date: Mon Apr 27 08:36:03 2026 +0000 net/sched: sch_cake: annotate data-races in cake_dump_stats() (II) cake_dump_stats() runs without qdisc spinlock being held. In this second patch, I add READ_ONCE()/WRITE_ONCE() annotations for the following fields: - bulk_flow_count - unresponsive_flow_count - max_skblen - flow_quantum Other annotations are added in following patches, to ease code review. Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") Signed-off-by: Eric Dumazet Acked-by: "Toke Høiland-Jørgensen" Link: https://patch.msgid.link/20260427083606.459355-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 44967ac3785ebef6442377708925181d4a0eb1c8 Author: Eric Dumazet Date: Mon Apr 27 08:36:02 2026 +0000 net/sched: sch_cake: annotate data-races in cake_dump_stats() (I) cake_dump_stats() runs without qdisc spinlock being held. In this first patch, I add READ_ONCE()/WRITE_ONCE() annotations for the following fields: - way_hits - way_misses - way_collisions - sparse_flow_count - decaying_flow_count Other annotations are added in following patches, to ease code review. Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") Signed-off-by: Eric Dumazet Acked-by: "Toke Høiland-Jørgensen" Link: https://patch.msgid.link/20260427083606.459355-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit aa6c6d9ee064aabfede4402fd1283424e649ca19 Author: Weiming Shi Date: Sun Apr 26 09:53:51 2026 -0700 bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() bareudp_fill_metadata_dst() passes bareudp->sock to udp_tunnel6_dst_lookup() in the IPv6 path without a NULL check. The socket is only created in bareudp_open() and NULLed in bareudp_stop(), so calling this function while the device is down triggers a NULL dereference via sock->sk. BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160) Call Trace: bareudp_fill_metadata_dst (drivers/net/bareudp.c:532) do_execute_actions (net/openvswitch/actions.c:901) ovs_execute_actions (net/openvswitch/actions.c:1589) ovs_packet_cmd_execute (net/openvswitch/datapath.c:700) genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1209) netlink_rcv_skb (net/netlink/af_netlink.c:2550) Add a NULL check returning -ESHUTDOWN, consistent with the xmit paths in the same driver. Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260426165350.1663137-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit dfb7e3b9a925262603867a4f1210717b347fb234 Merge: b718342a7fbaa2 8a92cb475ca90d Author: Jakub Kicinski Date: Tue Apr 28 17:52:22 2026 -0700 Merge branch 'sctp-fix-a-vtag-verification-failure-caused-by-stale-inits' Xin Long says: ==================== sctp: fix a vtag verification failure caused by stale INITs Similar to Scenario B in commit 8e56b063c865 ( netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp"): Scenario B: INIT_ACK is delayed until the peer completes its own handshake 192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408] 192.168.1.1 > 192.168.1.2: sctp (1) [INIT] [init tag: 144230885] 192.168.1.2 > 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408] 192.168.1.1 > 192.168.1.2: sctp (1) [COOKIE ECHO] 192.168.1.2 > 192.168.1.1: sctp (1) [COOKIE ACK] 192.168.1.1 > 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] * There is another case: Scenario F: INIT is delayed until the peer completes its own handshake 192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408] (OVS upcall) 192.168.1.1 > 192.168.1.2: sctp (1) [INIT] [init tag: 144230885] 192.168.1.2 > 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408] 192.168.1.1 > 192.168.1.2: sctp (1) [COOKIE ECHO] 192.168.1.2 > 192.168.1.1: sctp (1) [COOKIE ACK] 192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408] (delayed) 192.168.1.1 > 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] * In this case, the delayed INIT (e.g. due to OVS upcall) is recorded by conntrack, which prevents vtag verification from dropping the unexpected INIT-ACK in nf_conntrack_sctp_packet(): vtag = ct->proto.sctp.vtag[!dir]; if (!ct->proto.sctp.init[!dir] && vtag && vtag != ih->init_tag) goto out_unlock; This happens because ct->proto.sctp.init[!dir] is set by the delayed INIT, even though it is stale. Fix this in two parts: - In netfilter: Do not record INITs whose init_tag matches the peer vtag, as they carry no new handshake state in the 1st patch. - In SCTP: Prevent endpoints from responding to such INITs with INIT-ACK, ensuring correctness even when middleboxes lack the netfilter fix in the 2nd patch. A follow-up selftest for this scenario will be posted in a separate patch by Yi Chen. ==================== Link: https://patch.msgid.link/cover.1777214801.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 8a92cb475ca90d84db769e4d4383e631ace0d6e5 Author: Xin Long Date: Sun Apr 26 10:46:41 2026 -0400 sctp: discard stale INIT after handshake completion After an association reaches ESTABLISHED, the peer’s init_tag is already known from the handshake. Any subsequent INIT with the same init_tag is not a valid restart, but a delayed or duplicate INIT. Drop such INIT chunks in sctp_sf_do_unexpected_init() instead of processing them as new association attempts. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Link: https://patch.msgid.link/5788c76c1ee122a3ed00189e88dcf9df1fba226c.1777214801.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 576a5d2bad4814c881a829576b1261b9b8159d2b Author: Xin Long Date: Sun Apr 26 10:46:40 2026 -0400 netfilter: skip recording stale or retransmitted INIT An INIT whose init_tag matches the peer's vtag does not provide new state information. It indicates either: - a stale INIT (after INIT-ACK has already been seen on the same side), or - a retransmitted INIT (after INIT has already been recorded on the same side). In both cases, the INIT must not update ct->proto.sctp.init[] state, since it does not advance the handshake tracking and may otherwise corrupt INIT/INIT-ACK validation logic. Allow INIT processing only when the conntrack entry is newly created (SCTP_CONNTRACK_NONE), or when the init_tag differs from the stored peer vtag. Note it skips the check for the ct with old_state SCTP_CONNTRACK_NONE in nf_conntrack_sctp_packet(), as it is just created in sctp_new() where it set ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = ih->init_tag. Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") Signed-off-by: Xin Long Reviewed-by: Marcelo Ricardo Leitner Acked-by: Florian Westphal Link: https://patch.msgid.link/ee56c3e416452b2a40589a2a85245ac2ad5e9f4b.1777214801.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit a201aef1a88b675e9eb8487e27d14e2eef3cef80 Author: Christian A. Ehrhardt Date: Tue Apr 28 21:22:49 2026 +0200 ASoC: codecs: ab8500: Fix casting of private data ab8500_filter_controls[i].private_value is initialized using .private_value = (unsigned long)&(struct filter_control) {.count = xcount, .min = xmin, .max = xmax} thus it's a pointer to a struct filter_control casted to unsigned long. So to get back that pointer .private_data must be cast back, not its address. Fixes: 679d7abdc754 ("ASoC: codecs: Add AB8500 codec-driver") Signed-off-by: Christian A. Ehrhardt Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/20260428192255.2294705-2-u.kleine-koenig@baylibre.com Signed-off-by: Mark Brown commit b718342a7fbaa2dff5fefc31988c07af8c6cbc21 Author: Jakub Kicinski Date: Mon Apr 27 12:58:56 2026 -0700 net: psp: require admin permission for dev-set and key-rotate The dev-set and key-rotate netlink operations modify shared device state (PSP version configuration and cryptographic key material, respectively) but do not require CAP_NET_ADMIN. The only access control is psp_dev_check_access() which merely verifies netns membership. Fixes: 00c94ca2b99e ("psp: base PSP device support") Reviewed-by: Daniel Zahka Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260427195856.401223-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b89769f936a8fa9e66de72ddc1b71a9745a488e6 Author: Jakub Kicinski Date: Mon Apr 27 12:06:06 2026 -0700 net: psp: check for device unregister when creating assoc psp_assoc_device_get_locked() obtains a psp_dev reference via psp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU); it then acquires psd->lock and drops the reference. Before the lock is taken, psp_dev_unregister() can run to completion: take psd->lock, clear out state, unlock, drop the registration reference. The expectation is that the lock prevents device unregistration, but much like with netdevs special care has to be taken when "upgrading" a reference to a locked device. Add the missing check if device is still alive. psp_dev_is_registered() exists already but had no callers, which makes me wonder if I either forgot to add this or lost the check during refactoring... Reported-by: Yiming Qian Fixes: 6b46ca260e22 ("net: psp: add socket security association code") Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260427190606.366101-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 67d7ae3340cae0a18ec1d53a2fce198c31a211b8 Merge: 46f74a3f7d57d9 8cf6809cddcbe3 Author: Jakub Kicinski Date: Tue Apr 28 17:41:05 2026 -0700 Merge tag 'nf-26-04-28' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) IEEE1394 ARP payload contains no target hardware address in the ARP packet. Apparently, arp_tables was never updated to deal with IEEE1394 ARP properly. To deal with this, return no match in case the target hardware address selector is used, either for inverse or normal match. Moreover, arpt_mangle disallows mangling of the target hardware and IP address because, it is not worth to adjust the offset calculation to fix this, we suspect no users of arp_tables for this family. 2) Use list_del_rcu() to delete device hooks in nf_tables, this hook list is RCU protected, concurrent netlink dump readers can be walking on this list, fix it by adding a helper function and use it for consistency. From Florian Westphal. 3) Add list_splice_rcu(), this is useful for joining the local list of new device hooks to the RCU protected hook list in chain and flowtable. Reviewed by Paul E. McKenney. 4) Use list_splice_rcu() to publish the new device hooks in chain and flowtable to fix concurrent netlink dump traversal. 5) Add a new hook transaction object to track device hook deletions. The current approach moves device hooks to be deleted around during the preparation phase, this breaks concurrent RCU reader via netlink dump. This new hook transaction is combined with NFT_HOOK_REMOVE flag to annotate hooks for removal in the preparation phase. 6) xt_policy inbound policy check in strict mode can lead to out-of-bound access of the secpath array due to incorrect. The iteration over the secpath needs to be reversed in the inbound to check for the human readable policy, expecting inner in first position and outer in second position, the secpath from inbound actually stores outer in first position then in second position. From Jiexun Wang. 7) Fix possible zero shift in nft_bitwise triggering UBSAN splat, reject zero shift from control plane, from Kai Ma. 8) Replace simple_strtoul() in the conntrack SIP helper since it relies on nul-terminated strings. From Florian Westphal. * tag 'nf-26-04-28' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_conntrack_sip: don't use simple_strtoul netfilter: reject zero shift in nft_bitwise netfilter: xt_policy: fix strict mode inbound policy matching netfilter: nf_tables: add hook transactions for device deletions netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase rculist: add list_splice_rcu() for private lists netfilter: nf_tables: use list_del_rcu for netlink hooks netfilter: arp_tables: fix IEEE1394 ARP payload parsing ==================== Link: https://patch.msgid.link/20260428095840.51961-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit be102efb832ef7e30e4cd4c2edf22bbf64ddf35a Author: Richard Fitzgerald Date: Tue Apr 28 12:52:28 2026 +0100 ASoC: cs35l56: Fix illegal writes to OTP_MEM registers Mark the OTP_MEM registers as volatile so that regcache_sync() will not attempt to write to them. These registers hold a constant, and originally they were marked as readable non-volatile so that this value would be read into the regmap cache. The problem with this is regcache_sync() issues a write for any cached register that does not have a reg_default. Though these registers are constants and writing them in normal use cannot change OTP, it is illegal for the host to write to them. Fixes: e1830f66f6c6 ("ASoC: cs35l56: Add helper functions for amp calibration") Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260428115228.158252-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 664f0f6be37ce4ef80992cf2ed74761cd5bbe207 Merge: dca922e019dd75 d99f7a32f09dcc Author: Linus Torvalds Date: Tue Apr 28 16:26:11 2026 -0700 Merge tag 'sched_ext-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: "The merge window pulled in the cgroup sub-scheduler infrastructure, and new AI reviews are accelerating bug reporting and fixing - hence the larger than usual fixes batch: - Use-after-frees during scheduler load/unload: - The disable path could free the BPF scheduler while deferred irq_work / kthread work was still in flight - cgroup setter callbacks read the active scheduler outside the rwsem that synchronizes against teardown Fix both, and reuse the disable drain in the enable error paths so the BPF JIT page can't be freed under live callbacks. - Several BPF op invocations didn't tell the framework which runqueue was already locked, so helper kfuncs that re-acquire the runqueue by CPU could deadlock on the held lock Fix the affected callsites, including recursive parent-into-child dispatch. - The hardlockup notifier ran from NMI but eventually took a non-NMI-safe lock. Bounce it through irq_work. - A handful of bugs in the new sub-scheduler hierarchy: - helper kfuncs hard-coded the root instead of resolving the caller's scheduler - the enable error path tried to disable per-task state that had never been initialized, and leaked cpus_read_lock on the way out - a sysfs object was leaked on every load/unload - the dispatch fast-path used the root scheduler instead of the task's - a couple of CONFIG #ifdef guards were misclassified - Verifier-time hardening: BPF programs of unrelated struct_ops types (e.g. tcp_congestion_ops) could call sched_ext kfuncs - a semantic bug and, once sub-sched was enabled, a KASAN out-of-bounds read. Now rejected at load. Plus a few NULL and cross-task argument checks on sched_ext kfuncs, and a selftest covering the new deny. - rhashtable (Herbert): restore the insecure_elasticity toggle and bounce the deferred-resize kick through irq_work to break a lock-order cycle observable from raw-spinlock callers. sched_ext's scheduler-instance hash is the first user of both. - The bypass-mode load balancer used file-scope cpumasks; with multiple scheduler instances now possible, those raced. Move to per-instance cpumasks, plus a follow-up to skip tasks whose recorded CPU is stale relative to the new owning runqueue. - Smaller fixes: - a dispatch queue's first-task tracking misbehaved when a parked iterator cursor sat in the list - the runqueue's next-class wasn't promoted on local-queue enqueue, leaving an SCX task behind RT in edge cases - the reference qmap scheduler stopped erroring on legitimate cross-scheduler task-storage misses" * tag 'sched_ext-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (26 commits) sched_ext: Fix scx_flush_disable_work() UAF race sched_ext: Call wakeup_preempt() in local_dsq_post_enq() sched_ext: Release cpus_read_lock on scx_link_sched() failure in root enable sched_ext: Reject NULL-sch callers in scx_bpf_task_set_slice/dsq_vtime sched_ext: Refuse cross-task select_cpu_from_kfunc calls sched_ext: Align cgroup #ifdef guards with SUB_SCHED vs GROUP_SCHED sched_ext: Make bypass LB cpumasks per-scheduler sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before sched_ext: Pass held rq to SCX_CALL_OP() for dump_cpu/dump_task sched_ext: Save and restore scx_locked_rq across SCX_CALL_OP sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail sched_ext: Resolve caller's scheduler in scx_bpf_destroy_dsq() / scx_bpf_dsq_nr_queued() sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters sched_ext: Don't disable tasks in scx_sub_enable_workfn() abort path sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu() sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed iter_new sched_ext: Unregister sub_kset on scheduler disable sched_ext: Defer scx_hardlockup() out of NMI sched_ext: sync disable_irq_work in bpf_scx_unreg() sched_ext: Fix local_dsq_post_enq() to use task's scheduler in sub-sched ... commit f92d542577db878acfd21cc18dab23d03023b217 Author: Stephen Smalley Date: Fri Apr 10 15:29:50 2026 -0400 selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing the audited vector computed by avc_audit_required() rather than recomputing based on the currently requested permissions and distinguishing the denied versus allowed cases. As a result, some permission checks were not being audited, e.g. directory write checks after a previously cached directory search check. Cc: stable@vger.kernel.org Fixes: dde3a5d0f4dce ("selinux: move avdcache to per-task security struct") Signed-off-by: Stephen Smalley [PM: line wrap tweaks] Signed-off-by: Paul Moore commit df8599ee18c0e5fe343ffe0b4c379636b8bb839a Author: Jens Axboe Date: Mon Apr 27 14:42:18 2026 -0600 io_uring/napi: cap busy_poll_to 10 msec Currently there's no cap on the maximum amount of time that napi is allowed to poll if no events are found, which can lead to kernel complaints on a task being stuck as there's no conditional rescheduling done within that loop. Just cap it to 10 msec in total, that's already way above any kind of sane value that will reap any benefits, yet low enough that it's nowhere near being able to trigger preemption complaints. Fixes: 8d0c12a80cde ("io-uring: add napi busy poll support") Signed-off-by: Jens Axboe commit 7deba791ad495ce1d7921683f4f7d1190fa210d1 Author: Martin Michaelis Date: Thu Apr 23 15:54:11 2026 -0600 io_uring/kbuf: support min length left for incremental buffers Incrementally consumed buffer rings are generally fully consumed, but it's quite possible that the application has a minimum size it needs to meet to avoid truncation. Currently that minimum limit is 1 byte, but this should be a setting that is the hands of the application. For recvmsg multishot, a prime use case for incrementally consumed buffers, the application may get spurious -EFAULT returned at the end of an incrementally consumed buffer, as less space is available than the headers need. Grab a u32 field in struct io_uring_buf_reg, which the application can use to inform the kernel of the minimum size that should be available in an incrementally consumed buffer. If less than that is available, the current buffer is fully processed and the next one will be picked. Cc: stable@vger.kernel.org Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption") Link: https://github.com/axboe/liburing/issues/1433 Signed-off-by: Martin Michaelis [axboe: write commit message, change io_buffer_list member name] Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit 55ea968389172306341a6600a2acb759862d366a Author: Jens Axboe Date: Fri Apr 24 07:30:56 2026 -0600 io_uring/kbuf: kill dead struct io_buffer_list 'nr_entries' member This is only ever assigned, never used. The only used part is the calculated mask, which is used for indexing. Kill 'nr_entries'. Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit 65bce27ea6192320448c30267ffc17ffa094e713 Author: Benjamin Cheng Date: Mon Apr 13 09:22:15 2026 -0400 drm/amdgpu/vcn4: Avoid overflow on msg bound check As pointed out by SDL, the previous condition may be vulnerable to overflow. Fixes: 0a78f2bac142 ("drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg") Cc: SDL Signed-off-by: Benjamin Cheng Reviewed-by: Ruijing Dong Signed-off-by: Alex Deucher (cherry picked from commit 3c5367d950140d4ec7af830b2268a5a6fdaa3885) commit e6e9faba8100628990cccd13f0f044a648c303cf Author: Benjamin Cheng Date: Mon Apr 13 09:22:15 2026 -0400 drm/amdgpu/vcn3: Avoid overflow on msg bound check As pointed out by SDL, the previous condition may be vulnerable to overflow. Fixes: b193019860d6 ("drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg") Cc: SDL Signed-off-by: Benjamin Cheng Reviewed-by: Ruijing Dong Signed-off-by: Alex Deucher (cherry picked from commit db00257ac9e4a51eb2515aaea161a019f7125e10) commit 47a5dfc8add4e60ff1ddc312f79998e70cbb0c09 Author: Lijo Lazar Date: Mon Apr 27 12:53:30 2026 +0530 drm/amd/pm: Add fine grained flag to SMU v13.0.6 Gfx clock is fine grained on SMU v13.0.6/12 SOCs. Add the flag to report clock frequencies correctly. Fixes: 7380228401c4 ("drm/amd/pm: Use generic dpm table for SMUv13 SOCs") Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher (cherry picked from commit d4871d837bbf70173f63426a84fa80b39e408b9e) commit 8f935acbc18ff7ad09cb812528b28c59c78f10f9 Author: Prike Liang Date: Mon Apr 27 20:06:57 2026 +0800 drm/amdgpu: clean up the userq unmap error handler amdgpu_userq_unmap_helper() already handles the unmap error case. Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 66cb6579990b633ccc7300c27011d837b9a58da0) commit 3b0ea2021351b6b813b34fac940957f1f4fad85b Author: Yinjie Yao Date: Mon Apr 27 11:46:11 2026 -0400 drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: 4aeaf3cbfa9f ("drm/amdgpu/jpeg: Add jpeg 5.3.0 support") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 86ac011ae234c03fb872f4945913391ea1d8862e) commit 8068519c7e78819f88e1c08fe027efd5e468609d Author: Yinjie Yao Date: Mon Apr 27 11:46:11 2026 -0400 drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.2 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: 855e3e19f69c ("drm/amdgpu: Add JPEG_v5_0_2 IP block") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 4ec1c402fb0fb39511136c5fc874788542c476bc) commit 2f8e3da71a1b469b6e157aa3972f1448b3157840 Author: Yinjie Yao Date: Mon Apr 27 11:46:11 2026 -0400 drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: b8f57b69942b ("drm/amdgpu: Add JPEG5_0_1 support") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 742a98e2e81702df8fe1b1eccee5223220a03dc2) commit ea7c61c5f895e8f9ea0ffffa180498ef9c740152 Author: Yinjie Yao Date: Mon Apr 27 11:46:11 2026 -0400 drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: dfad65c65728 ("drm/amdgpu: Add JPEG5 support") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 0f43893d3cd478fa57836697525b338817c9c23d) commit b65b7f3f3c18f797f81a2af7c97e2079900ad6db Author: Yinjie Yao Date: Mon Apr 27 11:46:11 2026 -0400 drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: 8f98a715da8e ("drm/amdgpu/jpeg: add jpeg support for VCN4_0_5") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit f05d0a4f21fc720116d6e238f23308b199891058) commit 83e37c0987ca92f9e87789b46dd311dcf5a4a6c8 Author: Yinjie Yao Date: Mon Apr 27 11:46:11 2026 -0400 drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: e684e654eba9 ("drm/amdgpu/jpeg: add jpeg support for VCN4_0_3") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 2f6afc97d259d530f4f86c7743efbc573a8da927) commit e7e90b5839aeb8805ec83bb4da610b8dab8e184d Author: Yinjie Yao Date: Mon Apr 27 11:46:11 2026 -0400 drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: b13111de32a9 ("drm/amdgpu/jpeg: add jpeg support for VCN4_0_0") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 8d0cac9478a3f046279c657d6a2545de49ae675a) commit a2baf12eec41f246689e6a3f8619af1200031576 Author: Yinjie Yao Date: Mon Apr 27 11:46:10 2026 -0400 drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: dfd57dbf44dd ("drm/amdgpu: add JPEG3.0 support for Sienna_Cichlid") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 4d7d774f100efb5089c86a1fb8c5bf47c63fc9ef) commit 79405e774ede411c6b47ed41c651e40b92de64a2 Author: Yinjie Yao Date: Mon Apr 27 11:46:10 2026 -0400 drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: 14f43e8f88c5 ("drm/amdgpu: move JPEG2.5 out from VCN2.5") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 3216a7f4e2642bda5fd14f57586e835ae9202587) commit e5f612dc91650561fe2b5b76dd6d2898ec9ad480 Author: Yinjie Yao Date: Mon Apr 27 11:46:10 2026 -0400 drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: 6ac27241106b ("drm/amdgpu: add JPEG v2.0 function supports") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 96179da0c6b059eb31706a0abe8dd6381c533143) commit ed9d2832b09eecfe6055833c925d586ce0dda70a Author: Yinjie Yao Date: Mon Apr 27 11:45:36 2026 -0400 drm/amdgpu/vcn: set no_user_fence for VCN v5.0.2 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: 8433398c789c ("drm/amdgpu: Add VCN v5_0_2") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 48fc78c31ea7fec63100a772f863cf51b2f8cd0a) commit 8f4954722eab88e10c4ea0c0d3b1269c31421d3a Author: Yinjie Yao Date: Mon Apr 27 11:45:36 2026 -0400 drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: 346492f30ce3 ("drm/amdgpu: Add VCN_5_0_1 support") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit e16be95a2c3ee712b142cb27d2dca0b461181359) commit 8cae0ce77de492d7c31c1532a2e80c0c6e7e58cb Author: Yinjie Yao Date: Mon Apr 27 11:45:36 2026 -0400 drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: b6d1a0632051 ("drm/amdgpu: add VCN_5_0_0 IP block support") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 49b1fbbb5a071197ee71e2d70959b1cb29bdc317) commit 589a254bf3e88204c8402b9cbccd5e23a0af990f Author: Yinjie Yao Date: Mon Apr 27 11:45:36 2026 -0400 drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: 547aad32edac ("drm/amdgpu: add VCN4 ip block support") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 084d94ac93707bdda07efb5cee786f632de4219b) commit 4532b52b34e4e4310386e6fdf6a643368599f522 Author: Yinjie Yao Date: Mon Apr 27 11:45:36 2026 -0400 drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: b889ef4ac988 ("drm/amdgpu/vcn: add vcn support for VCN4_0_3") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit ff1a5a125c5a70c328806b9bc01d7d942cf3f9aa) commit 51f694221047c84fa185be98210eb2c354ffb8c6 Author: Yinjie Yao Date: Mon Apr 27 11:45:36 2026 -0400 drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: 8da1170a16e4 ("drm/amdgpu: add VCN4 ip block support") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit fd852c048b46f9825e904a4f3f4538fe9d8827d9) commit f1e5a6660d7cbf006079126d9babbf0ccf538c6b Author: Yinjie Yao Date: Mon Apr 27 11:45:35 2026 -0400 drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: cf14826cdfb5 ("drm/amdgpu: add VCN3.0 support for Sienna_Cichlid") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit 663bed3c7b8b9a7624b0d95d300ddae034ad0614) commit 4f317863a3ab212a027d8c8c3cc3af4e3fb95704 Author: Yinjie Yao Date: Mon Apr 27 11:45:35 2026 -0400 drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: 28c17d72072b ("drm/amdgpu: add VCN2.5 basic supports") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit efc9dd5590894109bce9a0bfe1fa5592dd6b20b1) commit 8d80b293b41fcb5e9396db93e788b0f4ebcbafb7 Author: Yinjie Yao Date: Mon Apr 27 11:45:35 2026 -0400 drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. Fixes: 1b61de45dfaf ("drm/amdgpu: add initial VCN2.0 support (v2)") Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Yinjie Yao Signed-off-by: Alex Deucher (cherry picked from commit e2b5499fca55f1a32960a311bbb62e35891eaf73) commit 31bc64e87f5f3d9ccbb7e625d570cfd8f52c77fc Author: Alex Deucher Date: Thu Apr 23 12:29:03 2026 -0400 drm/amd/display: properly handle family setting for early GC 11.5.4 Early variants need an override. Fixes: 57d00816c6a9 ("drm/amdgpu: set family for GC 11.5.4") Cc: Pratik Vishwakarma Cc: Roman Li Cc: Mario Limonciello Reviewed-by: Mario Limonciello (AMD) Tested-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher (cherry picked from commit 922fccc2d3f8186008c19ba08a49ae8a9463cb50) commit d6b99885b122528651d554a7bd907211a81579c2 Author: Lijo Lazar Date: Mon Apr 27 17:17:41 2026 +0530 drm/amd/pm: Update emit clock logic If only one level is enabled in clock table, there is no need to follow the fine grained clock logic which expects a minimum of two levels (min/max). Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher (cherry picked from commit 7f19097af1496dd908a044ca95862f32d05f02df) commit ec3e3976f626d9845a228d78d8a371ddc18edec8 Author: Gaghik Khachatrian Date: Mon Apr 13 11:11:52 2026 -0400 drm/amd/display: Update MCIF_ADDR macro to address IGT DWB regression [Why] A previous warning-fix commit updated type casts in the DCN3 mmhubbub code but missed updating the MCIF_ADDR macro to the correct, fully parenthesized and casted version. This caused a regression during DWB tests, where address values could be misinterpreted, potentially leading to incorrect hardware programming. [How] Updated the MCIF_ADDR macro in dcn30_mmhubbub.c to use the proper parenthesization and type casting, ensuring correct address handling. Removed redundant casts from REG_UPDATE calls for improved clarity and consistency with current coding standards. Fixes: f4cdbb5d5405 ("drm/amd/display: Fix implicit narrowing conversion warnings") Reviewed-by: Clayton King Signed-off-by: Gaghik Khachatrian Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 4f251a5e9f2297023b00b7cab606de111931cfa3) commit d2f272a36e1b4b857165021cfb2689a92efff2f5 Author: Christian König Date: Mon Apr 20 16:08:35 2026 +0200 drm/amdgpu: rework userq fence signal processing Move more code into a common userq function. Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher (cherry picked from commit 12f52fab11500d0dce7d23c71909eaf0cf9aa701) commit 927011b65a875302d08709bbe82eaf4d0d96c5d5 Author: Yury Norov Date: Mon Apr 27 22:49:41 2026 -0400 drm/amdgpu: fix build for CONFIG_DRM_FBDEV_EMULATION=n The merge-commit 02e778f12359 ("Merge tag 'amd-drm-next-7.1-2026-03-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-next") removes the stub for drm_fb_helper_gem_is_fb(), so the buld gets broken if DRM_FBDEV_EMULATION is not set. ‘drm_fb_helper_gem_is_fb’; did you mean ‘drm_fb_helper_from_client’? [-Wimplicit-function-declaration] 1777 | if (!drm_fb_helper_gem_is_fb(dev->fb_helper, fb->obj[0])) { | ^~~~~~~~~~~~~~~~~~~~~~~ | drm_fb_helper_from_client Restore it. Fixes: 02e778f12359 ("Merge tag 'amd-drm-next-7.1-2026-03-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-next") Reviewed-by: Thomas Zimmermann Signed-off-by: Yury Norov Signed-off-by: Alex Deucher (cherry picked from commit 7b81bc38e92c2522484c42671401eaa023ae8831) commit 5ec07d5204b4544271f32f6261ee097fe53cb081 Author: Sheng Che Peng Date: Wed Apr 22 10:18:19 2026 +0800 tracepoint: Fix typo in tracepoint.h comment Change "my" to "may" in the description of subsystem configurations. Link: https://patch.msgid.link/20260422021819.1788091-1-synte4028@gmail.com Signed-off-by: Sheng Che Peng Signed-off-by: Steven Rostedt commit 3b75dd76e64a04771861bb5647951c264919e563 Author: Breno Leitao Date: Mon Apr 20 06:25:09 2026 -0700 tracing: branch: Fix inverted check on stat tracer registration init_annotated_branch_stats() and all_annotated_branch_stats() check the return value of register_stat_tracer() with "if (!ret)", but register_stat_tracer() returns 0 on success and a negative errno on failure. The inverted check causes the warning to be printed on every successful registration, e.g.: Warning: could not register annotated branches stats while leaving real failures silent. The initcall also returned a hard-coded 1 instead of the actual error. Invert the check and propagate ret so that the warning fires on real errors and the initcall reports the correct status. Cc: Mathieu Desnoyers Cc: Ingo Molnar Cc: Frederic Weisbecker Link: https://patch.msgid.link/20260420-tracing-v1-1-d8f4cd0d6af1@debian.org Fixes: 002bb86d8d42 ("tracing/ftrace: separate events tracing and stats tracing engine") Signed-off-by: Breno Leitao Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt commit a8aebe93a4938c0ca1941eeaae821738f869be3d Author: Corey Minyard Date: Tue Apr 21 06:50:22 2026 -0500 ipmi:ssif: NULL thread on error Cleanup code was checking the thread for NULL, but it was possibly a PTR_ERR() in one spot. Spotted with static analysis. Link: https://sourceforge.net/p/openipmi/mailman/message/59324676/ Fixes: 75c486cb1bca ("ipmi:ssif: Clean up kthread on errors") Cc: # 91eb7ec72612: ipmi:ssif: Remove unnecessary indention Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard commit 09dd798270ff582d7309f285d4aaf5dbebae01cb Author: Corey Minyard Date: Mon Apr 20 13:02:18 2026 -0500 ipmi:si: Return state to normal if message allocation fails There were places where nothing would get started if a message allocation failed, so the driver needs to return to normal state. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: Signed-off-by: Corey Minyard commit c4cca236968683eb0d59abfb12d5c7e4d8514227 Author: Corey Minyard Date: Mon Apr 20 12:39:51 2026 -0500 ipmi: Add limits to event and receive message requests The driver would just fetch events and receive messages until the BMC said it was done. To avoid issues with BMCs that never say they are done, add a limit of 10 fetches at a time. In addition, an si interface has an attn state it can return from the hardware which is supposed to cause a flag fetch to see if the driver needs to fetch events or message or a few other things. If the attn bit gets stuck, it's a similar problem. So allow messages in between flag fetches so the driver itself doesn't get stuck. This is a more general fix than the previous fix for the specific bad BMC, but should fix the more general issue of a BMC that won't stop saying it has data. This has been there from the beginning of the driver. It's not a bug per-se, but it is accounting for bugs in BMCs. Reported-by: Matt Fleming Closes: https://lore.kernel.org/lkml/20260415115930.3428942-1-matt@readmodwrite.com/ Fixes: <1da177e4c3f4> ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard commit d99f7a32f09dccbe396187370ec1a74a31b73d7e Author: Cheng-Yang Chou Date: Wed Apr 29 01:36:12 2026 +0800 sched_ext: Fix scx_flush_disable_work() UAF race scx_flush_disable_work() calls irq_work_sync() followed by kthread_flush_work() to ensure that the disable kthread work has fully completed before bpf_scx_unreg() frees the SCX scheduler. However, a concurrent scx_vexit() (e.g., triggered by a watchdog stall) creates a race window between scx_claim_exit() and irq_work_queue(): CPU A (scx_vexit (watchdog)) CPU B (bpf_scx_unreg) ---- ---- scx_claim_exit() atomic_try_cmpxchg(NONE->kind) stack_trace_save() vscnprintf() scx_disable() scx_claim_exit() -> FAIL scx_flush_disable_work() irq_work_sync() // no-op: not queued yet kthread_flush_work() // no-op: not queued yet kobject_put(&sch->kobj) -> free %sch irq_work_queue() -> UAF on %sch scx_disable_irq_workfn() kthread_queue_work() -> UAF The root cause is that CPU B's scx_flush_disable_work() returns after syncing an irq_work that has not yet been queued, while CPU A is still executing the code between scx_claim_exit() and irq_work_queue(). Loop until exit_kind reaches SCX_EXIT_DONE or SCX_EXIT_NONE, draining disable_irq_work and disable_work in each pass. This ensures that any work queued after the previous check is caught, while also correctly handling cases where no disable was triggered (e.g., the scx_sub_enable_workfn() abort path). Fixes: 510a27055446 ("sched_ext: sync disable_irq_work in bpf_scx_unreg()") Reported-by: https://sashiko.dev/#/patchset/20260424100221.32407-1-icheng%40nvidia.com Suggested-by: Tejun Heo Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 487359284509a6745e14b8c0518768bc277809b0 Author: Takashi Iwai Date: Tue Apr 28 10:33:16 2026 +0200 HID: uclogic: Fix regression of input name assignment The previous fix for adding the devm_kasprintf() return check in the commit bd07f751208b ("HID: uclogic: Add NULL check in uclogic_input_configured()") changed the condition of hi->input->name assignment, and it resulted in missing the proper input device name when no custom suffix is defined. Restore the conditional to the original content to address the regression. Fixes: bd07f751208b ("HID: uclogic: Add NULL check in uclogic_input_configured()") Signed-off-by: Takashi Iwai Signed-off-by: Jiri Kosina commit ae4ac077332ea3341a0f4c0973556c6b7ac5b7a1 Author: Dan Carpenter Date: Thu Apr 23 10:10:02 2026 +0300 HID: intel-thc-hid: Intel-quickspi: Fix some error codes If we have a partial read that is supposed to be treated as failure but in this code we forgot to set the error code. Return -EINVAL. Fixes: 9d8d51735a3a ("HID: intel-thc-hid: intel-quickspi: Add HIDSPI protocol implementation") Signed-off-by: Dan Carpenter Reviewed-by: Even Xu Reviewed-by: Mark Pearson Signed-off-by: Jiri Kosina commit 3524900cc571bd922a1a6b6a0eb0c2705cdb3559 Author: Matthew Schwartz Date: Mon Apr 20 11:15:22 2026 -0700 HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle The controller MCU does not persist OS_TYPE across power cycles. During s2idle resume, the USB device may be power-cycled, causing the OS_TYPE setting to revert to the default Windows value. Add a reset_resume callback so that this is correctly restored after resume. Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver") Reviewed-by: Derek J. Clark Signed-off-by: Matthew Schwartz Signed-off-by: Jiri Kosina commit 55ce1858848132ed074fe907f00b5ce1ccab0ce1 Author: Damien Dejean Date: Tue Apr 14 13:38:58 2026 +0000 HID: elan: Add support for ELAN SB974D touchpad Elan SB974D touchpad uses ELAN_MT_I2C format to send HID reports. Add an entry to match for the device and parse its vendor specific format. Signed-off-by: Damien Dejean Signed-off-by: Kornel Dulęba Signed-off-by: Jiri Kosina commit 163f8b7f9a84086c67c76aeadc04e6d43e32df6e Author: Kuba Piecuch Date: Tue Apr 28 12:46:01 2026 +0000 sched_ext: Call wakeup_preempt() in local_dsq_post_enq() There are several edge cases (see linked thread) where an IMMED task can be left lingering on a local DSQ if an RT task swoops in at the wrong time. All of these edge cases are due to rq->next_class being idle even after dispatching a task to rq's local DSQ. We should bump rq->next_class to &ext_sched_class as soon as we've inserted a task into the local DSQ. To optimize the common case of rq->next_class == &ext_sched_class, only call wakeup_preempt() if rq->next_class is below EXT. If next_class is EXT or above, wakeup_preempt() is a no-op anyway. This lets us also simplify the preempt_curr() logic a bit since wakeup_preempt() will call preempt_curr() for us if next_class is below EXT. Link: https://lore.kernel.org/all/DHZPHUFXB4N3.2RY28MUEWBNYK@google.com/ Signed-off-by: Kuba Piecuch Signed-off-by: Tejun Heo commit 12bd440b66ed8968afffc46928233967b5b79b98 Author: Rosalie Wanders Date: Sun Apr 12 03:12:03 2026 +0200 HID: sony: add missing size validation for Rock Band 3 Pro instruments This commit adds the missing size validation for Rock Band 3 PS3 Pro instruments in sony_raw_event(), this prevents a malicious device from allowing hid-sony to read out of bounds of the provided buffer. Signed-off-by: Rosalie Wanders Signed-off-by: Jiri Kosina commit a4170b63eda999d20ad6dc39ddc3ce5c1ac619e6 Author: Rosalie Wanders Date: Sun Apr 12 03:08:06 2026 +0200 HID: sony: add missing size validation for SMK-Link remotes This commit adds the missing size validation for SMK-Link remotes in sony_raw_event(), this prevents a malicious device from allowing hid-sony to read out of bounds of the provided buffer. I do not own these devices so the size check only forces that the buffer is large enough for nsg_mrxu_parse_report(). Signed-off-by: Rosalie Wanders Signed-off-by: Jiri Kosina commit 0f2b8466fb744a8b3313a9c1e2008f8cd53b2db7 Author: Rosalie Wanders Date: Sat Apr 11 17:32:48 2026 +0200 HID: sony: remove unneeded WARN_ON() in sony_leds_init() This commit removes the unneeded WARN_ON() macro usage in sony_leds_init(), this is unneeded because the sony_leds_init() function call is already gated behind a SONY_LED_SUPPORT check in sony_input_configured() Signed-off-by: Rosalie Wanders Signed-off-by: Jiri Kosina commit 80c4bbb2b38513e9c3d84805fa61a0ee16d79c45 Author: Michael Zaidman Date: Sat Apr 11 09:24:37 2026 +0300 HID: ft260: validate i2c input report length Add two checks to ft260_raw_event() to prevent out-of-bounds reads from malicious or malfunctioning devices: First, reject reports shorter than the 2-byte header (report ID + length fields). Without this, even accessing xfer->length on a 1-byte report is an OOB read. Second, validate xfer->length against the actual data capacity of the received HID report. Each I2C data report ID (0xD0 through 0xDE) defines a different report size in the HID descriptor, so the available payload varies per report. A corrupted length field could cause memcpy to read beyond the report buffer. Reported-by: Sebastián Josué Alba Vives Signed-off-by: Michael Zaidman Signed-off-by: Jiri Kosina commit 278dd0487907112de8e34e1a97ac6145a8081523 Author: Rosalie Wanders Date: Fri Apr 10 21:53:54 2026 +0200 HID: sony: fix incorrect force-feedback check in sony_suspend() This commit fixes the incorrect force-feedback check in sony_suspend(), without this the check will always be true due to checking a constant define that is never 0. Signed-off-by: Rosalie Wanders Signed-off-by: Jiri Kosina commit 0de4cb473aed57ee4ba7e0551ad27bddc19fc519 Author: Breno Leitao Date: Tue Apr 28 08:10:43 2026 -0700 workqueue: fix devm_alloc_workqueue() va_list misuse devm_alloc_workqueue() built a va_list and passed it as a single positional argument to the variadic alloc_workqueue() macro: va_start(args, max_active); wq = alloc_workqueue(fmt, flags, max_active, args); va_end(args); C does not allow forwarding a va_list through a ... parameter. alloc_workqueue() expands to alloc_workqueue_noprof(), which runs its own va_start() over its ... params, so the inner vsnprintf(wq->name, sizeof(wq->name), fmt, args) in __alloc_workqueue() received the outer va_list object as the first variadic slot rather than the caller's actual format arguments. Add a new static helper alloc_workqueue_va() that wraps __alloc_workqueue() and runs wq_init_lockdep() on success, and fold both alloc_workqueue_noprof() and devm_alloc_workqueue_noprof() onto it as suggested by Tejun. The wq_init_lockdep() step is required on the devm path too, otherwise __flush_workqueue()'s on-stack COMPLETION_INITIALIZER_ONSTACK_MAP would NULL-deref wq->lockdep_map. No caller changes are required. devm_alloc_ordered_workqueue() is a macro forwarding to devm_alloc_workqueue() and inherits the fix. Two in-tree callers actively trigger the broken path on every probe: drivers/power/supply/mt6370-charger.c:889 drivers/power/supply/max77705_charger.c:649 both of which use devm_alloc_ordered_workqueue(dev, "%s", 0, dev_name(dev)). A standalone reproducer module is available at[1]. Link: https://github.com/leitao/debug/blob/main/workqueue/valist/wq_va_test.c [1] Fixes: 1dfc9d60a69e ("workqueue: devres: Add device-managed allocate workqueue") Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 5aba4f94b225617a55fed442a70329b2ee19c0a5 Author: Antoniu Miclaus Date: Wed Apr 1 14:08:29 2026 +0300 iio: chemical: scd30: fix division by zero in write_raw Add a zero check for val2 before using it as a divisor when setting the sampling frequency. A user writing a zero fractional part to the sampling_frequency sysfs attribute triggers a division by zero in the kernel. Fixes: 64b3d8b1b0f5 ("iio: chemical: scd30: add core driver") Signed-off-by: Antoniu Miclaus Cc: Signed-off-by: Jonathan Cameron commit 0d42e2c0bd6ceb89e44c6e065f9bdf9b1df3ef0c Author: David Carlier Date: Tue Apr 14 13:30:06 2026 +0100 iio: adc: npcm: fix unbalanced clk_disable_unprepare() The driver acquired the ADC clock with devm_clk_get() and read its rate, but never called clk_prepare_enable(). The probe error path and npcm_adc_remove() both called clk_disable_unprepare() unconditionally, causing the clk framework's enable/prepare counts to underflow on probe failure or module unbind. The issue went unnoticed because NPCM BMC firmware leaves the ADC clock enabled at boot, so the driver happened to work in practice. Switch to devm_clk_get_enabled() so the clock is properly enabled during probe and automatically released by the device-managed cleanup, and drop the now-redundant clk_disable_unprepare() from both the probe error path and remove(). While at it, drop the duplicate error message on devm_request_irq() failure since the IRQ core already logs it. Fixes: 9bf85fbc9d8f ("iio: adc: add NPCM ADC driver") Signed-off-by: David Carlier Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 7e5c0f97c66ad538b87c04a640573371fb434b4f Author: Andy Shevchenko Date: Thu Apr 16 11:01:22 2026 +0200 iio: adc: nxp-sar-adc: Avoid division by zero When Common Clock Framework is disabled, clk_get_rate() returns 0. This is used as part of the divisor to perform nanosecond delays with help of ndelay(). When the above condition occurs the compiler, due to unspecified behaviour, is free to do what it wants to. Here it saturates the value, which is logical from mathematics point of view. However, the ndelay() implementation has set a reasonable upper threshold and refuses to provide anything for such a long delay. That's why code may not be linked under these circumstances. To solve the issue, provide a wrapper that calls ndelay() when the value is known not to be zero. Fixes: 4434072a893e ("iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603311958.ly6uROit-lkp@intel.com/ Signed-off-by: Andy Shevchenko Acked-by: Daniel Lezcano Cc: Signed-off-by: Jonathan Cameron commit bb21ee31f5753a7972148798fd7dfb841dd33bdb Author: Svyatoslav Ryhel Date: Thu Apr 16 14:14:42 2026 +0300 iio: Fix iio_multiply_value use in iio_read_channel_processed_scale The function iio_multiply_value returns IIO_VAL_INT (1) on success or a negative error number on failure, while iio_read_channel_processed_scale should return an error code or 0. This creates a situation where the expected result is treated as an error. Fix this by checking the iio_multiply_value result separately, instead of passing it as a return value. Fixes: 05f958d003c9 ("iio: Improve iio_read_channel_processed_scale() precision") Signed-off-by: Svyatoslav Ryhel Reviewed-by: Hans de Goede Cc: Signed-off-by: Jonathan Cameron commit 761e8b489e6cf166c574034b70637f8a7eadd0ee Author: Antoniu Miclaus Date: Tue Mar 31 13:13:00 2026 +0300 iio: gyro: adis16260: fix division by zero in write_raw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero to the sampling_frequency sysfs attribute triggers a division by zero in the kernel. Fixes: 089a41985c6c ("staging: iio: adis16260 digital gyro driver") Signed-off-by: Antoniu Miclaus Reviewed-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit 1a772719318c11e146f6fbe621fffd230a6f456a Author: Radu Sabau Date: Wed Apr 8 13:32:13 2026 +0300 iio: adc: ad4695: Fix call ordering in offload buffer postenable ad4695_enter_advanced_sequencer_mode() was called after spi_offload_trigger_enable(). That is wrong because ad4695_enter_advanced_sequencer_mode() issues regular SPI transfers to put the ADC into advanced sequencer mode, and not all SPI offload capable controllers support regular SPI transfers while offloading is enabled. Fix this by calling ad4695_enter_advanced_sequencer_mode() before spi_offload_trigger_enable(), so the ADC is fully configured before the first CNV pulse can occur. This is consistent with the same constraint that already applies to the BUSY_GP_EN write above it. Update the error unwind labels accordingly: add err_exit_conversion_mode so that a failure of spi_offload_trigger_enable() correctly exits conversion mode before clearing BUSY_GP_EN. Fixes: f09f140e3ea8 ("iio: adc: ad4695: Add support for SPI offload") Reviewed-by: Nuno Sá Reviewed-by: David Lechner Signed-off-by: Radu Sabau Cc: Stable@vger.kernel.org Signed-off-by: Jonathan Cameron commit b66f922f6a4fa92840f662fbcfeb4f8a0f774bcc Author: Felix Gu Date: Fri Mar 27 20:27:54 2026 +0800 iio: light: veml6070: Fix resource leak in probe error path The driver calls i2c_new_dummy_device() to create a dummy device, then calls i2c_smbus_write_byte(). If i2c_smbus_write_byte() fails and returns, the cleanup via devm_add_action_or_reset() was never registered, so the dummy device leaks. Switch to devm_i2c_new_dummy_device() which registers cleanup atomically with device creation, eliminating the error-path window. Fixes: 7501bff87c3e ("iio: light: veml6070: add action for i2c_unregister_device") Reviewed-by: Andy Shevchenko Signed-off-by: Felix Gu Cc: Signed-off-by: Jonathan Cameron commit 673478bc29cf72010faaf293c1c8c667393335a0 Author: Pengpeng Hou Date: Thu Apr 2 13:40:15 2026 +0800 iio: chemical: mhz19b: reject oversized serial replies mhz19b_receive_buf() appends each serdev chunk into the fixed MHZ19B_CMD_SIZE receive buffer and advances buf_idx by len without checking that the chunk fits in the remaining space. A large callback can therefore overflow st->buf before the command path validates the reply. Reset the reply state before each command and reject oversized serial replies before copying them into the fixed buffer. When an oversized reply is detected, wake the waiter and report -EMSGSIZE instead of overwriting st->buf. Fixes: 4572a70b3681 ("iio: chemical: Add support for Winsen MHZ19B CO2 sensor") Cc: stable@vger.kernel.org Signed-off-by: Pengpeng Hou Acked-by: Gyeyoung Baek Signed-off-by: Jonathan Cameron commit 852534744c2d35626a604f128ff0b8ec12805591 Author: Christofer Jonason Date: Wed Mar 4 10:07:27 2026 +0100 iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux xadc_postdisable() unconditionally sets the sequencer to continuous mode. For dual external multiplexer configurations this is incorrect: simultaneous sampling mode is required so that ADC-A samples through the mux on VAUX[0-7] while ADC-B simultaneously samples through the mux on VAUX[8-15]. In continuous mode only ADC-A is active, so VAUX[8-15] channels return incorrect data. Since postdisable is also called from xadc_probe() to set the initial idle state, the wrong sequencer mode is active from the moment the driver loads. The preenable path already uses xadc_get_seq_mode() which returns SIMULTANEOUS for dual mux. Fix postdisable to do the same. Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") Cc: stable@vger.kernel.org Signed-off-by: Christofer Jonason Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Reviewed-by: Salih Erim Signed-off-by: Jonathan Cameron commit b8425ceefee5df2b8490fa70a07e4e402c752492 Author: Johan Hovold Date: Fri Apr 24 12:32:11 2026 +0200 parisc: drivers: switch to dynamic root device Driver core expects devices to be dynamically allocated and will, for example, complain loudly if a device that lacks a release function is ever freed. Use root_device_register() to allocate and register the root device instead of open coding using a static device. While at it, drop the redundant additional reference taken at init. Signed-off-by: Johan Hovold Signed-off-by: Helge Deller commit 8135b89a376ab2c20db3921c9c38cf83994b1f1c Author: Helge Deller Date: Thu Apr 23 09:10:52 2026 +0200 Revert "parisc: led: fix reference leak on failed device registration" This reverts commit 707610bcccbd0327530938e33f3f33211a640a4e. platform_device_register() is going to be fixed instead. Signed-off-by: Helge Deller commit c488df06bd552bb8b6e14fa0cfd5ad986c6e9525 Author: Junrui Luo Date: Fri Apr 24 13:51:02 2026 +0800 RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When ib_create_srq() fails for s1, the error branch destroys s0 but falls through and unconditionally assigns the freed s0 and the ERR_PTR s1 to devr->s0 and devr->s1. This leads to several problems: the lock-free fast path checks "if (devr->s1) return 0;" and treats the ERR_PTR as already initialised; users in mlx5_ib_create_qp() dereference the freed SRQ or ERR_PTR via to_msrq(devr->s0)->msrq.srqn; and mlx5_ib_dev_res_cleanup() dereferences the ERR_PTR and double-frees s0 on teardown. Fix by adding the same `goto unlock` in the s1 failure path. Cc: stable@vger.kernel.org Fixes: 5895e70f2e6e ("IB/mlx5: Allocate resources just before first QP/SRQ is created") Link: https://patch.msgid.link/r/SYBPR01MB7881E1E0970268BD69C0BA75AF2B2@SYBPR01MB7881.ausprd01.prod.outlook.com Reported-by: Yuhao Jiang Signed-off-by: Junrui Luo Signed-off-by: Jason Gunthorpe commit 1114c87aa6f195cf07da55a27b2122ae26557b26 Author: Michael Bommarito Date: Sat Apr 18 12:21:41 2026 -0400 RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c unconditionally dereferences 8 bytes at payload_addr(pkt): value = *(u64 *)payload_addr(pkt); check_rkey() previously accepted an ATOMIC_WRITE request with pktlen == resid == 0 because the length validation only compared pktlen against resid. A remote initiator that sets the RETH length to 0 therefore reaches atomic_write_reply() with a zero-byte logical payload, and the responder reads sizeof(u64) bytes from past the logical end of the packet into skb->head tailroom, then writes those 8 bytes into the attacker's MR via rxe_mr_do_atomic_write(). That is a remote disclosure of 4 bytes of kernel tailroom per probe (the other 4 bytes are the packet's own trailing ICRC). IBA oA19-28 defines ATOMIC_WRITE as exactly 8 bytes. Anything else is protocol-invalid. Hoist a strict length check into check_rkey() so the responder never reaches the unchecked dereference, and keep the existing WRITE-family length logic for the normal RDMA WRITE path. Reproduced on mainline with an unmodified rxe driver: a sustained zero-length ATOMIC_WRITE probe repeatedly leaks adjacent skb head-buffer bytes into the attacker's MR, including recognisable kernel strings and partial kernel-direct-map pointer words. With this patch applied the responder rejects the PDU and the MR stays all-zero. Cc: stable@vger.kernel.org Fixes: 034e285f8b99 ("RDMA/rxe: Make responder support atomic write on RC service") Link: https://patch.msgid.link/r/20260418162141.3610201-1-michael.bommarito@gmail.com Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Reviewed-by: Zhu Yanjun Signed-off-by: Jason Gunthorpe commit 4c6f86d85d03cdb33addce86aa69aa795ca6c47a Author: Michael Bommarito Date: Tue Apr 14 07:15:55 2026 -0400 RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated UDP packet can still trigger panic. That patch handled payload_size() underflow only for valid opcodes with short packets, not for packets carrying an unknown opcode. The unknown-opcode OOB read described below predates that commit and reaches back to the initial Soft RoCE driver. The check added there reads pkt->paylen < header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE where header_size(pkt) expands to rxe_opcode[pkt->opcode].length. The rxe_opcode[] array has 256 entries but is only populated for defined IB opcodes; any other entry (for example opcode 0xff) is zero-initialized, so length == 0 and the check degenerates to pkt->paylen < 0 + bth_pad(pkt) + RXE_ICRC_SIZE which does not constrain pkt->paylen enough. rxe_icrc_hdr() then computes rxe_opcode[pkt->opcode].length - RXE_BTH_BYTES which underflows when length == 0 and passes a huge value to rxe_crc32(), causing an out-of-bounds read of the skb payload. Reproduced on v7.0-rc7 with that fix applied, QEMU/KVM with CONFIG_RDMA_RXE=y and CONFIG_KASAN=y, after rdma link add rxe0 type rxe netdev eth0 A single 48-byte UDP packet to port 4791 with BTH opcode=0xff and QPN=IB_MULTICAST_QPN triggers: BUG: KASAN: slab-out-of-bounds in crc32_le+0x115/0x170 Read of size 1 at addr ... The buggy address is located 0 bytes to the right of allocated 704-byte region Call Trace: crc32_le+0x115/0x170 rxe_icrc_hdr.isra.0+0x226/0x300 rxe_icrc_check+0x13f/0x3a0 rxe_rcv+0x6e1/0x16e0 rxe_udp_encap_recv+0x20a/0x320 udp_queue_rcv_one_skb+0x7ed/0x12c0 Subsequent packets with the same shape fault on unmapped memory and panic the kernel. The trigger requires only module load and "rdma link add"; no QP, no connection, and no authentication. Fix this by rejecting packets whose opcode has no rxe_opcode[] entry, detected via the zero mask or zero length, before any length arithmetic runs. Cc: stable@vger.kernel.org Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://patch.msgid.link/r/20260414111555.3386793-1-michael.bommarito@gmail.com Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Michael Bommarito Reviewed-by: Zhu Yanjun Signed-off-by: Jason Gunthorpe commit 7e36e03d192a5547757bd8f9d9052a60f64e6d17 Merge: 0898a817621a2f 3b2f70eab5a2cd Author: Jens Axboe Date: Tue Apr 28 08:36:26 2026 -0600 Merge tag 'md-7.1-20260428' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into block-7.1 Pull MD fixes from Yu Kuai: "Bug Fixes: - Fix a raid5 UAF on IO across the reshape position. - Avoid failing RAID1/RAID10 devices for invalid IO errors. - Fix RAID10 divide-by-zero when far_copies is zero. - Restore bitmap grow through sysfs. Cleanups: - Use mddev_is_dm() instead of open-coding gendisk checks. - Use ATTRIBUTE_GROUPS() for md default sysfs attributes. - Replace open-coded wait loops with wait_event helpers." * tag 'md-7.1-20260428' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: md: use ATTRIBUTE_GROUPS() for md default sysfs attributes md: use mddev_is_dm() instead of open-coding gendisk checks md/raid1: replace wait loop with wait_event_idle() in raid1_write_request() md/md-bitmap: add a none backend for bitmap grow md/md-bitmap: split bitmap sysfs groups md: factor bitmap creation away from sysfs handling md: use mddev_lock_nointr() in mddev_suspend_and_lock_nointr() md: replace wait loop with wait_event() in md_handle_request() md/raid10: fix divide-by-zero in setup_geo() with zero far_copies md/raid1,raid10: don't fail devices for invalid IO errors MAINTAINERS: Add Xiao Ni as md/raid reviewer md/raid5: Fix UAF on IO across the reshape position commit 76b48a70b16b4036814964b039cde413e0164416 Author: Li RongQing Date: Fri Feb 6 00:08:36 2026 -0500 IB/hfi1: Fix potential use-after-free in PIO and SDMA map teardown The current teardown logic for dd->pio_map and dd->sdma_map frees the structures while they might still be accessed by RCU readers. Although the pointer is nulled under a spinlock, the memory is reclaimed before waiting for the grace period to end. This patch fixes the sequence by: 1. Extracting the pointer under the lock. 2. Clearing the RCU-protected pointer. 3. Waiting for readers to finish with synchronize_rcu(). 4. Finally freeing the memory. Fixes: 7724105686e7 ("IB/hfi1: add driver files") Link: https://patch.msgid.link/r/20260206050836.5890-1-lirongqing@baidu.com Signed-off-by: Li RongQing Signed-off-by: Jason Gunthorpe commit 46f74a3f7d57d9cc0110b09cbc8163fa0a01afa2 Author: Heiko Schocher Date: Sat Apr 25 05:13:39 2026 +0200 net: phy: dp83869: fix setting CLK_O_SEL field. Table 7-121 in datasheet says we have to set register 0xc6 to value 0x10 before CLK_O_SEL can be modified. No more infos about this field found in datasheet. With this fix, setting of CLK_O_SEL field in IO_MUX_CFG register worked through dts property "ti,clk-output-sel" on a DP83869HMRGZR. Signed-off-by: Heiko Schocher Reviewed-by: Simon Horman Fixes: 01db923e8377 ("net: phy: dp83869: Add TI dp83869 phy") Link: https://patch.msgid.link/20260425031339.3318-1-hs@nabladev.com Signed-off-by: Paolo Abeni commit 0fb1daf0b78d0e23b63b6b65de56d4a3fd83bc14 Author: David Carlier Date: Wed Apr 15 06:23:00 2026 +0100 mm/memfd_luo: report error when restoring a folio fails mid-loop memfd_luo_retrieve_folios() initialises err to -EIO, but the per-iteration calls to mem_cgroup_charge(), shmem_add_to_page_cache() and shmem_inode_acct_blocks() reuse and overwrite err. Once any iteration completes successfully, err becomes zero. If a later iteration's kho_restore_folio() returns NULL, the failure path jumps to put_folios without resetting err, so the function returns 0. The caller memfd_luo_retrieve() then takes the success path, sets args->file and reports the restore as successful, leaving userspace with a partially populated memfd and no indication that anything went wrong. Set err to -EIO in the kho_restore_folio() failure branch so the error is propagated to the caller. Signed-off-by: David Carlier Reviewed-by: Pratyush Yadav Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") Link: https://patch.msgid.link/20260415052300.362539-1-devnexen@gmail.com Signed-off-by: Mike Rapoport (Microsoft) commit a6715d7ec472a476db17787697a4abda62962284 Author: Evangelos Petrongonas Date: Fri Apr 10 01:16:05 2026 +0000 kho: skip KHO for crash kernel kho_fill_kimage() unconditionally populates the kimage with KHO metadata for every kexec image type. When the image is a crash kernel, this can be problematic as the crash kernel can run in a small reserved region and the KHO scratch areas can sit outside it. The crash kernel then faults during kho_memory_init() when it tries phys_to_virt() on the KHO FDT address: Unable to handle kernel paging request at virtual address xxxxxxxx ... fdt_offset_ptr+... fdt_check_node_offset_+... fdt_first_property_offset+... fdt_get_property_namelen_+... fdt_getprop+... kho_memory_init+... mm_core_init+... start_kernel+... kho_locate_mem_hole() already skips KHO logic for KEXEC_TYPE_CRASH images, but kho_fill_kimage() was missing the same guard. As kho_fill_kimage() is the single point that populates image->kho.fdt and image->kho.scratch, fixing it here is sufficient for both arm64 and x86 as the FDT and boot_params path are bailing out when these fields are unset. Fixes: d7255959b69a ("kho: allow kexec load before KHO finalization") Signed-off-by: Evangelos Petrongonas Reviewed-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260410011609.1103-1-epetron@amazon.de Signed-off-by: Mike Rapoport (Microsoft) commit d986ba0329dcca102e227995371135c9bbcefb6b Author: Namjae Jeon Date: Tue Apr 28 21:59:30 2026 +0900 ntfs: fix invalid PTR_ERR() usage in __ntfs_bitmap_set_bits_in_run() The Smatch reported a warning in __ntfs_bitmap_set_bits_in_run(): "warn: passing a valid pointer to 'PTR_ERR'" This occurs because the 'folio' variable might contain a valid pointer when jumping to the 'rollback' label, specifically when 'cnt <= 0' is detected during the subsequent page mapping loop. In such cases, calling PTR_ERR(folio) is incorrect as it does not contain an error code. Fix this by introducing an explicit 'err' variable to track the error status. This ensures that the rollback logic and the return value consistently use a proper error code regardless of the state of the folio pointer. Reported-by: Dan Carpenter Signed-off-by: Namjae Jeon commit b95e0e792822bad8fc9eb33ea3a90005e29e75e9 Author: Heiko Carstens Date: Tue Apr 21 07:52:44 2026 +0200 s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() In case of a Secure-Storage-Access exception the effective aka virtual address which caused the exception is contained within the TEID. do_secure_storage_access() incorrectly uses phys_to_folio() instead of virt_to_folio() to translate the virtual address to the corresponding folio. Fix this by using virt_to_folio() instead of phys_to_folio(). Fixes: 084ea4d611a3 ("s390/mm: add (non)secure page access exceptions handlers") Reviewed-by: Christian Borntraeger Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 8587af9cff43aa114ee69b401b8ac3e2c5aea4d3 Author: Heiko Carstens Date: Mon Apr 20 16:19:42 2026 +0200 s390/sclp: Remove SCLP_OFB Kconfig option Remove the SCLP_OFB Kconfig option and enable the guarded code unconditionally. This guards only a few lines of code, so the impact is very low while at the same time this reduces the large number of Kconfig options. Acked-by: Christian Borntraeger Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 77aba6accd9e26f069ab81bdcb941681d5f7a0a7 Author: Gerd Bayer Date: Mon Mar 9 11:12:30 2026 +0100 MAINTAINERS: Replace one of the maintainers for s390/pci Add myself as co-maintainer for s390/pci, replacing Gerald Schaefer who has moved his focus to s390/mm. Thank you Gerald! Signed-off-by: Gerd Bayer Acked-by: Niklas Schnelle Acked-by: Gerald Schaefer Signed-off-by: Vasily Gorbik Signed-off-by: Alexander Gordeev commit e14622a7584f9608927c59a7d6ae4a0999dc545e Author: Vasily Gorbik Date: Fri Apr 17 14:33:43 2026 +0200 s390/debug: Reject zero-length input in debug_input_flush_fn() debug_input_flush_fn() always copies one byte from the userspace buffer with copy_from_user() regardless of the supplied write length. A zero-length write therefore reads one byte beyond the caller's buffer. If the stale byte happens to be '-' or a digit the debug log is silently flushed. With an unmapped buffer the call returns -EFAULT. Reject zero-length writes before copying from userspace. Cc: stable@vger.kernel.org # v5.10+ Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Alexander Gordeev commit c366a7b5ed7564e41345c380285bd3f6cb98971b Author: Pengpeng Hou Date: Fri Apr 17 15:35:30 2026 +0800 s390/debug: Reject zero-length input before trimming a newline debug_get_user_string() duplicates the userspace buffer with memdup_user_nul() and then unconditionally looks at buffer[user_len - 1] to strip a trailing newline. A zero-length write reaches this helper unchanged, so the newline trim reads before the start of the allocated buffer. Reject empty writes before accessing the last input byte. Fixes: 66a464dbc8e0 ("[PATCH] s390: debug feature changes") Cc: stable@vger.kernel.org Signed-off-by: Pengpeng Hou Reviewed-by: Benjamin Block Reviewed-by: Vasily Gorbik Tested-by: Vasily Gorbik Link: https://lore.kernel.org/r/20260417073530.96002-1-pengpeng@iscas.ac.cn Signed-off-by: Vasily Gorbik Signed-off-by: Alexander Gordeev commit 3b2f70eab5a2cd15e27b1447e66e45302b28ff2c Author: Abd-Alrhman Masalkhi Date: Thu Apr 23 12:13:03 2026 +0200 md: use ATTRIBUTE_GROUPS() for md default sysfs attributes Replace the md_default_group and md_attr_groups with ATTRIBUTE_GROUPS(). Signed-off-by: Abd-Alrhman Masalkhi Link: https://lore.kernel.org/linux-raid/20260423101303.48196-4-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai commit 408434a3245cc6ea981df4edd7fbf0be49856727 Author: Abd-Alrhman Masalkhi Date: Thu Apr 23 12:13:02 2026 +0200 md: use mddev_is_dm() instead of open-coding gendisk checks Replace direct checks on mddev->gendisk with mddev_is_dm() in md_handle_request() and md_run(). Signed-off-by: Abd-Alrhman Masalkhi Link: https://lore.kernel.org/linux-raid/20260423101303.48196-3-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai commit c1a3cdb0b49fff28d90e2c33114a7c0058261f60 Author: Abd-Alrhman Masalkhi Date: Thu Apr 23 12:13:01 2026 +0200 md/raid1: replace wait loop with wait_event_idle() in raid1_write_request() The wait loop is equivalent to wait_event_idle(); use it to improve readability. Signed-off-by: Abd-Alrhman Masalkhi Link: https://lore.kernel.org/linux-raid/20260423101303.48196-2-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai commit f2926a533d03fe70d753b512b713e06a2aa174af Author: Yu Kuai Date: Sat Apr 25 10:46:15 2026 +0800 md/md-bitmap: add a none backend for bitmap grow Add a real none bitmap backend that exposes the common bitmap sysfs group and use it to keep bitmap/location available when an array has no bitmap. Then switch the bitmap location sysfs path to move only between none and the classic bitmap backend, using the no-sysfs bitmap helpers while merging or unmerging the internal bitmap sysfs group. This restores mdadm --grow bitmap addition through bitmap/location. Fixes: fb8cc3b0d9db ("md/md-bitmap: delay registration of bitmap_ops until creating bitmap") Reviewed-by: Su Yue Link: https://lore.kernel.org/r/20260425024615.1696892-4-yukuai@fnnas.com Signed-off-by: Yu Kuai commit aba3d6d6cb55c6e1116d1215140559dd7ecdf9a9 Author: Yu Kuai Date: Sat Apr 25 10:46:14 2026 +0800 md/md-bitmap: split bitmap sysfs groups Split the classic bitmap sysfs files into a common bitmap group with the location attribute and a separate internal bitmap group for the remaining files. At the same time, convert bitmap operations from a single sysfs group to a sysfs group array so backends can share part of their sysfs layout while adding backend-specific attributes separately. Switch the bitmap sysfs helpers to use sysfs_update_groups() for the add and update path, and remove groups in reverse order so shared named groups are unmerged before the last group removes the directory. Also make bitmap operation lookup depend only on the currently selected bitmap id matching the installed backend. This prepares the lookup path for a later registered none backend. Reviewed-by: Su Yue Link: https://lore.kernel.org/r/20260425024615.1696892-3-yukuai@fnnas.com Signed-off-by: Yu Kuai commit 8776d342cf8fa0b98ca5e6fb2d956966fb5ca364 Author: Yu Kuai Date: Sat Apr 25 10:46:13 2026 +0800 md: factor bitmap creation away from sysfs handling Factor bitmap creation and destruction into helpers that do not touch bitmap sysfs registration. This prepares the bitmap sysfs rework so callers such as the sysfs bitmap location path can create or destroy a bitmap backend without coupling that to sysfs group lifetime management. Reviewed-by: Su Yue Link: https://lore.kernel.org/r/20260425024615.1696892-2-yukuai@fnnas.com Signed-off-by: Yu Kuai commit 4d8c53c130f17902a7e76326cf867721cf768590 Author: Abd-Alrhman Masalkhi Date: Wed Apr 15 16:03:19 2026 +0200 md: use mddev_lock_nointr() in mddev_suspend_and_lock_nointr() This keeps mddev locking consistent and ensures that any future changes to locking behavior are done through the wrapper. Signed-off-by: Abd-Alrhman Masalkhi Link: https://lore.kernel.org/r/20260415140319.376578-3-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai commit 8e8278ac702e2d5d44211b4b10599aa3b2cb0555 Author: Abd-Alrhman Masalkhi Date: Wed Apr 15 16:03:18 2026 +0200 md: replace wait loop with wait_event() in md_handle_request() The wait loop is equivalent to wait_event() and can be simplified by usaing it for improving readability. Signed-off-by: Abd-Alrhman Masalkhi Link: https://lore.kernel.org/r/20260415140319.376578-2-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai commit 9aa6d860b0930e2f72795665c42c44252a558a0c Author: Junrui Luo Date: Thu Apr 16 11:39:56 2026 +0800 md/raid10: fix divide-by-zero in setup_geo() with zero far_copies setup_geo() extracts near_copies (nc) and far_copies (fc) from the user-provided layout parameter without checking for zero. When fc=0 with the "improved" far set layout selected, 'geo->far_set_size = disks / fc' triggers a divide-by-zero. Validate nc and fc immediately after extraction, returning -1 if either is zero. Fixes: 475901aff158 ("MD RAID10: Improve redundancy for 'far' and 'offset' algorithms (part 1)") Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Link: https://lore.kernel.org/linux-raid/SYBPR01MB7881A5E2556806CC1D318582AF232@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Yu Kuai commit f7b24c7b41f23b5f9caa8b913afe79cd4c397d39 Author: Keith Busch Date: Thu Apr 16 07:03:45 2026 -0700 md/raid1,raid10: don't fail devices for invalid IO errors BLK_STS_INVAL indicates the IO request itself was invalid, not that the device has failed. When raid1 treats this as a device error, it retries on alternate mirrors which fail the same way, eventually exceeding the read error threshold and removing the device from the array. This happens when stacking configurations bypass bio_split_to_limits() in the IO path: dm-raid calls md_handle_request() directly without going through md_submit_bio(), skipping the alignment validation that would otherwise reject invalid bios early. The invalid bio reaches the lower block layers, which fail the bio with BLK_STS_INVAL, and raid1 wrongly interprets this as a device failure. Add BLK_STS_INVAL to raid1_should_handle_error() so that invalid IO errors are propagated back to the caller rather than triggering device removal. This is consistent with the previous kernel behavior when alignment checks were done earlier in the direct-io path. Fixes: 5ff3f74e145adc7 ("block: simplify direct io validity check") Reported-by: Tomáš Trnka Closes: https://lore.kernel.org/linux-block/2982107.4sosBPzcNG@electra/ Signed-off-by: Keith Busch Tested-by: Tomáš Trnka Link: https://lore.kernel.org/r/20260416140345.3872265-1-kbusch@meta.com Signed-off-by: Yu Kuai commit 45f96d758d0b34bcabc22ce781eaf4103d286cd0 Author: Xiao Ni Date: Tue Apr 14 10:29:56 2026 +0800 MAINTAINERS: Add Xiao Ni as md/raid reviewer I've been actively involved in the md subsystem, contributing bug fixes, performance improvements, and participating in code reviews. I will help improve patch review coverage and response time. Signed-off-by: Xiao Ni Link: https://lore.kernel.org/r/20260414022956.48271-1-xiaoraid25@gmail.com Signed-off-by: Yu Kuai commit 418b3e64e4459feb3f75979de9ec89e085745343 Author: Benjamin Marzinski Date: Wed Apr 8 00:35:48 2026 -0400 md/raid5: Fix UAF on IO across the reshape position If make_stripe_request() returns STRIPE_WAIT_RESHAPE, raid5_make_request() will free the cloned bio. But raid5_make_request() can call make_stripe_request() multiple times, writing to the various stripes. If that bio got added to the toread or towrite lists of a stripe disk in an earlier call to make_stripe_request(), then it's not safe to just free the bio if a later part of it is found to cross the reshape position. Doing so can lead to a UAF error, when bio_endio() is called on the bio for the earlier stripes. Instead, raid5_make_request() needs to wait until all parts of the bio have called bio_endio(). To do this, bios that cross the reshape position while the reshape can't make progress are flagged as needing to wait for all parts to complete. When raid5_make_request() has a bio that failed make_stripe_request() with STRIPE_WAIT_RESHAPE, it sets bi->bi_private to a completion struct and waits for completion after ending the bio. When the bio_endio() is called for the last time on a clone bio with bi->bi_private set, it wakes up the waiter. This guarantees that raid5_make_request() doesn't return until the cloned bio needing a retry for io across the reshape boundary is safely cleaned up. There is a simple reproducer available at [1]. Compile the kernel with KASAN for more useful reporting when the error is triggered (this is not necessary to see the bug). [1] https://gist.github.com/bmarzins/e48598824305cf2171289e47d7241fa5 Signed-off-by: Benjamin Marzinski Reviewed-by: Xiao Ni Link: https://lore.kernel.org/r/20260408043548.1695157-1-bmarzins@redhat.com Signed-off-by: Yu Kuai commit d237f719b2726c0e6d62bfa1543f53b624471929 Author: Thomas Zimmermann Date: Tue Apr 28 10:28:43 2026 +0200 lib/fonts: Fix bit position when rotating by 180 degrees Fix the horizontal bit position when rotating a glyph by 180°. The original code in rotate_ud() rounded the value in width up to a multiple of 8, aka the bit pitch, and calculated the rotated pixel from that value. The new code stores the glyph's pitch in bit_pitch, but fails to update the rotated pixel's output accordingly. Simply replacing the variable does this. The bug can be reproduced by setting a font with an unaligned width, such as sun12x22, like this: setfont sun12x22 echo 2 > /sys/class/graphics/fbcon/rotate Without the fix, the font looks distorted. Fixes: a30e9e6b018f ("lib/fonts: Refactor glyph-rotation helpers") Closes: https://lore.gitlab.freedesktop.org/drm-ai-reviews/review-patch7-20260407092555.58816-8-tzimmermann@suse.de/ Cc: dri-devel@lists.freedesktop.org Cc: linux-fbdev@vger.kernel.org Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 0b996ae54d876b41c52dd7cfc512eb008a47d781 Author: Chen Ni Date: Tue Apr 28 11:17:25 2026 +0800 fbdev: defio: Remove duplicate include of linux/module.h Remove duplicate inclusion of linux/module.h in fb_defio.c to clean up redundant code. Signed-off-by: Chen Ni Signed-off-by: Helge Deller commit f1fb23a0a0fcbdb66672da51d7d63a259f6396ca Author: Randy Dunlap Date: Mon Apr 27 11:32:36 2026 -0700 fbdev: ipu-v3: clean up kernel-doc warnings Correct all kernel-doc warnings: - fix a typedef kernel-doc comment - mark a list_head as private - use Returns: for function return values Warning: include/video/imx-ipu-image-convert.h:31 struct member 'list' not described in 'ipu_image_convert_run' Warning: include/video/imx-ipu-image-convert.h:40 function parameter 'ipu_image_convert_cb_t' not described in 'void' Warning: include/video/imx-ipu-image-convert.h:40 expecting prototype for ipu_image_convert_cb_t(). Prototype was for void() instead Warning: include/video/imx-ipu-image-convert.h:66 No description found for return value of 'ipu_image_convert_verify' Warning: include/video/imx-ipu-image-convert.h:90 No description found for return value of 'ipu_image_convert_prepare' Warning: include/video/imx-ipu-image-convert.h:125 No description found for return value of 'ipu_image_convert_queue' Warning: include/video/imx-ipu-image-convert.h:163 No description found for return value of 'ipu_image_convert' Signed-off-by: Randy Dunlap Reviewed-by: Philipp Zabel Signed-off-by: Helge Deller commit 4ca07b9239bd0478ae586632a2ed72be37ed8407 Author: William A. Kennington III Date: Thu Apr 23 00:46:52 2026 -0700 net: mctp i2c: check length before marking flow active Currently, mctp_i2c_get_tx_flow_state() is called before the packet length sanity check. This function marks a new flow as active in the MCTP core. If the sanity check fails, mctp_i2c_xmit() returns early without calling mctp_i2c_lock_nest(). This results in a mismatched locking state: the flow is active, but the I2C bus lock was never acquired for it. When the flow is later released, mctp_i2c_release_flow() will see the active state and queue an unlock marker. The TX thread will then decrement midev->i2c_lock_count from 0, causing it to underflow to -1. This underflow permanently breaks the driver's locking logic, allowing future transmissions to occur without holding the I2C bus lock, leading to bus collisions and potential hardware hangs. Move the mctp_i2c_get_tx_flow_state() call to after the length sanity check to ensure we only transition the flow state if we are actually going to proceed with the transmission and locking. Fixes: f5b8abf9fc3d ("mctp i2c: MCTP I2C binding driver") Signed-off-by: William A. Kennington III Acked-by: Jeremy Kerr Link: https://patch.msgid.link/20260423074741.201460-1-william@wkennington.com Signed-off-by: Paolo Abeni commit b336e40c62fbdc4b8a1f09a4ada31f4a90c69eb1 Author: Thomas Huth Date: Mon Apr 27 17:56:30 2026 +0200 efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error If kzalloc fails, the function returns -ENOMEM without calling efivar_unlock(). Since open() returned an error, the calling site in pstore_get_backend_records() won't call the close() function, so the lock is never released. Thus drop the lock in case of errors here. Fixes: 859748255b434 ("efi: pstore: Omit efivars caching EFI varstore access layer") Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Thomas Huth Signed-off-by: Ard Biesheuvel commit a9e8765fd206388d5672db229784982bf559f097 Author: Thorsten Blum Date: Wed Apr 22 14:25:27 2026 +0200 efivarfs: use QSTR() in efivarfs_alloc_dentry Use QSTR() and drop strlen() in efivarfs_alloc_dentry(). Signed-off-by: Thorsten Blum Signed-off-by: Ard Biesheuvel commit 0bb05e6adfa99a2ea1fee1125cc0953409f83ed8 Author: Sam Edwards Date: Tue Apr 21 21:45:03 2026 -0700 net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the MAC through conventional DMA: the CPU allocates buffers for the MAC, then the MAC fills them and returns ownership to the CPU. For each hardware RX queue, the CPU and MAC coordinate through a shared ring array of DMA descriptors: one descriptor per DMA buffer. Each descriptor includes the buffer's physical address and a status flag ("OWN") indicating which side owns the buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to set the flag and the MAC is only allowed to clear it, and both must move through the ring in sequence: thus the ring is used for both "submissions" and "completions." In the stmmac driver, stmmac_rx() bookmarks its position in the ring with the `cur_rx` index. The main receive loop in that function checks for rx_descs[cur_rx].own=0, gives the corresponding buffer to the network stack (NULLing the pointer), and increments `cur_rx` modulo the ring size. After the loop exits, stmmac_rx_refill(), which bookmarks its position with `dirty_rx`, allocates fresh buffers and rearms the descriptors (setting OWN=1). If it fails any allocation, it simply stops early (leaving OWN=0) and will retry where it left off when next called. This means descriptors have a three-stage lifecycle (terms my own): - `empty` (OWN=1, buffer valid) - `full` (OWN=0, buffer valid and populated) - `dirty` (OWN=0, buffer NULL) But because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. In the past (see 'Fixes:'), there was a bug where the loop could cycle `cur_rx` all the way back to the first descriptor it dirtied, resulting in a NULL dereference when mistaken for `full`. The aforementioned commit resolved that *specific* failure by capping the loop's iteration limit at `dma_rx_size - 1`, but this is only a partial fix: if the previous stmmac_rx_refill() didn't complete, then there are leftover `dirty` descriptors that the loop might encounter without needing to cycle fully around. The current code therefore panics (see 'Closes:') when stmmac_rx_refill() is memory-starved long enough for `cur_rx` to catch up to `dirty_rx`. Fix this by explicitly checking, before advancing `cur_rx`, if the next entry is dirty; exit the loop if so. This prevents processing of the final, used descriptor until stmmac_rx_refill() succeeds, but fully prevents the `cur_rx == dirty_rx` ambiguity as the previous bugfix intended: so remove the clamp as well. Since stmmac_rx_zc() is a copy-paste-and-tweak of stmmac_rx() and the code structure is identical, any fix to stmmac_rx() will also need a corresponding fix for stmmac_rx_zc(). Therefore, apply the same check there. In stmmac_rx() (not stmmac_rx_zc()), a related bug remains: after the MAC sets OWN=0 on the final descriptor, it will be unable to send any further DMA-complete IRQs until it's given more `empty` descriptors. Currently, the driver simply *hopes* that the next stmmac_rx_refill() succeeds, risking an indefinite stall of the receive process if not. But this is not a regression, so it can be addressed in a future change. Fixes: b6cb4541853c7 ("net: stmmac: avoid rx queue overrun") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221010 Cc: stable@vger.kernel.org Suggested-by: Russell King Signed-off-by: Sam Edwards Link: https://patch.msgid.link/20260422044503.5349-1-CFSworks@gmail.com Signed-off-by: Paolo Abeni commit 9d69033ad967b6e09b1e5b30d1a32c6c4876465d Author: Maulik Shah Date: Thu Apr 23 16:55:24 2026 +0530 pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615 PDC interrupts 122-125 were meant for ibi_i3c wakeup but qcs615 do not support i3c. GPIOs 39,51,88 and 89 are also connected to different PDC pin to support non-ibi wakeup. Update the wakeirq map to reflect same. Fixes: b698f36a9d40 ("pinctrl: qcom: add the tlmm driver for QCS615 platform") Signed-off-by: Maulik Shah Signed-off-by: Navya Malempati Reviewed-by: Konrad Dybcio Signed-off-by: Linus Walleij commit e72ce029810390eb987a036fb2c8a5da9a23b685 Author: Xianwei Zhao Date: Wed Apr 22 11:44:13 2026 +0000 pinctrl: meson: amlogic-a4: fix deadlock issue Accessing the pinconf-pins sysfs node may deadlock. pinconf_pins_show() holds pctldev->mutex, and the platform driver calls pinctrl_find_gpio_range_from_pin(), which tries to acquire the same mutex again, leading to a deadlock. Use pinctrl_find_gpio_range_from_pin_nolock() to fix this issue. Fixes: 6e9be3abb78c ("pinctrl: Add driver support for Amlogic SoCs") Signed-off-by: Xianwei Zhao Reviewed-by: Neil Armstrong Signed-off-by: Linus Walleij commit d743c1ba6c66a7dcb2bfd93fd36b7185e8a4766b Author: Alexander Koskovich Date: Thu Apr 23 04:51:45 2026 +0000 pinctrl: qcom: eliza: Fix QDSS trace clock/control pingroup names Fix a few typos for these in their respective pingroups, the groups already exist they just weren't referenced. Signed-off-by: Alexander Koskovich Fixes: 6f26989e15fb ("pinctrl: qcom: Add Eliza pinctrl driver") Reviewed-by: Konrad Dybcio Signed-off-by: Linus Walleij commit f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e Author: Andrea Mayer Date: Tue Apr 21 11:47:35 2026 +0200 net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking dst_hold() unconditionally. On PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can release the underlying pcpu_rt between the lookup and the caching through a concurrent FIB lookup on a shared nexthop. Simplified race sequence: ksoftirqd/X higher-prio task (same CPU X) ----------- -------------------------------- seg6_input_core(,skb)/rpl_input(skb) dst_cache_get() -> miss ip6_route_input(skb) -> ip6_pol_route(,skb,flags) [RT6_LOOKUP_F_DST_NOREF in flags] -> FIB lookup resolves fib6_nh [nhid=N route] -> rt6_make_pcpu_route() [creates pcpu_rt, refcount=1] pcpu_rt->sernum = fib6_sernum [fib6_sernum=W] -> cmpxchg(fib6_nh.rt6i_pcpu, NULL, pcpu_rt) [slot was empty, store succeeds] -> skb_dst_set_noref(skb, dst) [dst is pcpu_rt, refcount still 1] rt_genid_bump_ipv6() -> bumps fib6_sernum [fib6_sernum from W to Z] ip6_route_output() -> ip6_pol_route() -> FIB lookup resolves fib6_nh [nhid=N] -> rt6_get_pcpu_route() pcpu_rt->sernum != fib6_sernum [W <> Z, stale] -> prev = xchg(rt6i_pcpu, NULL) -> dst_release(prev) [prev is pcpu_rt, refcount 1->0, dead] dst = skb_dst(skb) [dst is the dead pcpu_rt] dst_cache_set_ip6(dst) -> dst_hold() on dead dst -> WARN / use-after-free For the race to occur, ksoftirqd must be preemptible (PREEMPT_RT without PREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to release the pcpu_rt. Shared nexthop objects provide such a path, as two routes pointing to the same nhid share the same fib6_nh and its rt6i_pcpu entry. Fix seg6_input_core() and rpl_input() by calling skb_dst_force() after ip6_route_input() to force the NOREF dst into a refcounted one before caching. The output path is not affected as ip6_route_output() already returns a refcounted dst. Fixes: af4a2209b134 ("ipv6: sr: use dst_cache in seg6_input") Fixes: a7a29f9c361f ("net: ipv6: add rpl sr tunnel") Cc: stable@vger.kernel.org Signed-off-by: Andrea Mayer Reviewed-by: Simon Horman Reviewed-by: Justin Iurman Link: https://patch.msgid.link/20260421094735.20997-1-andrea.mayer@uniroma2.it Signed-off-by: Paolo Abeni commit ac2c996675755c725a0065dbe3e2ebffded9080b Author: Shixiong Ou Date: Fri Apr 24 20:44:27 2026 +0800 drm/udl: Increase GET_URB_TIMEOUT [WHY] A situation has occurred where udl_handle_damage() executed successfully and the kernel log appears normal, but the display fails to show any output. This is because the call to udl_get_urb() in udl_crtc_helper_atomic_enable() failed without generating any error message. [HOW] 1. Increase timeout of getting urb. 2. Add error messages when calling udl_get_urb() failed in udl_crtc_helper_atomic_enable(). Signed-off-by: Shixiong Ou Reviewed-by: Thomas Zimmermann Fixes: 5320918b9a87 ("drm/udl: initial UDL driver (v4)") Signed-off-by: Thomas Zimmermann Cc: # v3.4+ Link: https://patch.msgid.link/20260424124427.657-1-oushixiong1025@163.com commit 13d30682e8dee191ac04e93642f0372a723e8b0c Author: Cássio Gabriel Date: Mon Apr 27 23:38:41 2026 -0300 ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error If byt_wm5102_prepare_and_enable_pll1() fails in the SND_SOC_DAPM_EVENT_ON() path, platform_clock_control() returns after clk_prepare_enable(priv->mclk) without disabling the clock again. This leaks an MCLK enable reference on failed power-up attempts. Add the missing clk_disable_unprepare() on the error path, matching the unwind used by the other Intel platform_clock_control() implementations. Fixes: 9a87fc1e0619 ("ASoC: Intel: bytcr_wm5102: Add machine driver for BYT/WM5102") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Reviewed-by: Cezary Rojewski Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260427-bytcr-wm5102-mclk-leak-v1-1-02b96d08e99c@gmail.com Signed-off-by: Mark Brown commit d997c32157d2ca06e9f3f00ba6c4bf06593b49e7 Merge: db57a1aa54ff68 4498664e2d5888 Author: Johannes Berg Date: Tue Apr 28 10:41:29 2026 +0200 Merge tag 'ath-current-20260427' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v7.1-rc2 Fix an ath10k build dependency issue along with a few ath12k bugs. ================== Signed-off-by: Johannes Berg commit db57a1aa54ff68669781976e4edb045e09e2b65b Author: Jeongjun Park Date: Thu Apr 23 02:38:46 2026 +0900 wifi: rsi: fix kthread lifetime race between self-exit and external-stop RSI driver use both self-exit(kthread_complete_and_exit) and external-stop (kthread_stop) when killing a kthread. Generally, kthread_stop() is called first, and in this case, no particular issues occur. However, in rare instances where kthread_complete_and_exit() is called first and then kthread_stop() is called, a UAF occurs because the kthread object, which has already exited and been freed, is accessed again. Therefore, to prevent this with minimal modification, you must remove kthread_stop() and change the code to wait until the self-exit operation is completed. Cc: Reported-by: syzbot+5de83f57cd8531f55596@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69e5d03b.a00a0220.1bd0ca.0064.GAE@google.com/ Fixes: 4c62764d0fc2 ("rsi: improve kernel thread handling to fix kernel panic") Signed-off-by: Jeongjun Park Link: https://patch.msgid.link/20260422173846.37640-1-aha310510@gmail.com Signed-off-by: Johannes Berg commit 3da56dc063cd77b9c0b40add930767fab4e389f3 Author: Zicheng Qu Date: Fri Apr 24 07:11:13 2026 +0000 sched/fair: Clear rel_deadline when initializing forked entities A yield-triggered crash can happen when a newly forked sched_entity enters the fair class with se->rel_deadline unexpectedly set. The failing sequence is: 1. A task is forked while se->rel_deadline is still set. 2. __sched_fork() initializes vruntime, vlag and other sched_entity state, but does not clear rel_deadline. 3. On the first enqueue, enqueue_entity() calls place_entity(). 4. Because se->rel_deadline is set, place_entity() treats se->deadline as a relative deadline and converts it to an absolute deadline by adding the current vruntime. 5. However, the forked entity's deadline is not a valid inherited relative deadline for this new scheduling instance, so the conversion produces an abnormally large deadline. 6. If the task later calls sched_yield(), yield_task_fair() advances se->vruntime to se->deadline. 7. The inflated vruntime is then used by the following enqueue path, where the vruntime-derived key can overflow when multiplied by the entity weight. 8. This corrupts cfs_rq->sum_w_vruntime, breaks EEVDF eligibility calculation, and can eventually make all entities appear ineligible. pick_next_entity() may then return NULL unexpectedly, leading to a later NULL dereference. A captured trace shows the effect clearly. Before yield, the entity's vruntime was around: 9834017729983308 After yield_task_fair() executed: se->vruntime = se->deadline the vruntime jumped to: 19668035460670230 and the deadline was later advanced further to: 19668035463470230 This shows that the deadline had already become abnormally large before yield_task_fair() copied it into vruntime. rel_deadline is only meaningful when se->deadline really carries a relative deadline that still needs to be placed against vruntime. A freshly forked sched_entity should not inherit or retain this state. Clear se->rel_deadline in __sched_fork(), together with the other sched_entity runtime state, so that the first enqueue does not interpret the new entity's deadline as a stale relative deadline. Fixes: 82e9d0456e06 ("sched/fair: Avoid re-setting virtual deadline on 'migrations'") Analyzed-by: Hui Tang Analyzed-by: Zhang Qiao Signed-off-by: Zicheng Qu Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260424071113.1199600-1-quzicheng@huawei.com commit ac8e69e693631689d74d8f1ebee6f84f737f797f Author: Vincent Guittot Date: Wed Apr 22 11:34:00 2026 +0200 sched/fair: Fix wakeup_preempt_fair() vs delayed dequeue Similar to how pick_next_entity() must dequeue delayed entities, so too must wakeup_preempt_fair(). Any delayed task being found means it is eligible and hence past the 0-lag point, ready for removal. Worse, by not removing delayed entities from consideration, it can skew the preemption decision, with the end result that a short slice wakeup will not result in a preemption. tip/sched/core tip/sched/core +this patch cyclictest slice (ms) (default)2.8 8 8 hackbench slice (ms) (default)2.8 20 20 Total Samples | 22559 22595 22683 Average (us) | 157 64( 59%) 59( 8%) Median (P50) (us) | 57 57( 0%) 58(- 2%) 90th Percentile (us) | 64 60( 6%) 60( 0%) 99th Percentile (us) | 2407 67( 97%) 67( 0%) 99.9th Percentile (us) | 3400 2288( 33%) 727( 68%) Maximum (us) | 5037 9252(-84%) 7461( 19%) Fixes: f12e148892ed ("sched/fair: Prepare pick_next_task() for delayed dequeue") Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260422093400.319251-1-vincent.guittot@linaro.org commit c5cd6fd75b6a55761337c9e965dd5ad02485d00d Author: Peter Zijlstra Date: Thu Apr 23 13:22:22 2026 +0200 sched/fair: Fix the negative lag increase fix Vincent reported that my rework of his original patch lost a little something. Specifically it got the return value wrong; it should not compare against the old se->vlag, but rather against the current value. Since the thing that matters is if the effective vruntime of an entity is affected and the thing needs repositioning or not. Fixes: 059258b0d424 ("sched/fair: Prevent negative lag increase during delayed dequeue") Reported-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Tested-by: Vincent Guittot Link: https://patch.msgid.link/20260423094107.GT3102624%40noisy.programming.kicks-ass.net commit 6e7247d8f5fefeceb0bb9cc80a5388a636b219cd Author: Takashi Iwai Date: Mon Apr 27 17:22:15 2026 +0200 ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() The convert_chmap_v3() has a loop with its increment size of cs_desc->wLength, but we forgot to validate cs_desc->wLength itself, which may lead to potential endless loop by a malformed descriptor. Add a proper size check to abort the loop for plugging the hole. Fixes: ecfd41166b72 ("ALSA: usb-audio: Validate UAC3 cluster segment descriptors") Cc: Link: https://patch.msgid.link/20260427152224.15276-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit c39f0bc03f84ba64c9144c95714df1dc36150f6d Author: Takashi Iwai Date: Mon Apr 27 17:15:04 2026 +0200 ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams At parsing UAC3 streams, we allocate a PD object at each time, and either assign or free it. But there is a case where the PD object may be leaked; namely, in __snd_usb_parse_audio_interface() loop, when an audioformat shares the same endpoint with others, it's put to a link and returns from snd_usb_add_audio_stream(), but the PD is forgotten afterwards. Overall, the treatment of PD object in the parser code is a bit flaky, and we should be more careful about the object ownership. This patch tries to fix the above case and improve the code a bit. The pd object is now managed with the auto-cleanup in the loop, and the ownership is updated when the pd object gets assigned to the stream, which guarantees the release of the leftover object. Fixes: 7edf3b5e6a45 ("ALSA: usb-audio: AudioStreaming Power Domain parsing") Link: https://patch.msgid.link/20260427151508.12544-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit b32ae47a2b0a1fb4bd4942242847966d9b178222 Author: Takashi Iwai Date: Mon Apr 27 16:56:15 2026 +0200 ALSA: caiaq: Don't abort when no input device is available The previous fix to handle the error from setup_card() caused a regression for the models that have no dedicated input device; snd_usb_caiaq_input_init() just returns -EINVAL, and we treat it as a fatal error although it should be ignored. As a regression fix, change the error code to -ENODEV, and ignore this error in the callee, to continue probing. Fixes: 28abd224db4a ("ALSA: caiaq: Handle probe errors properly") Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=221423 Link: https://patch.msgid.link/20260427145642.6637-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 0a7b5221b5b51cc798fcfc3be00d02eade149d69 Author: Takashi Iwai Date: Mon Apr 27 14:37:53 2026 +0200 ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path The previous fix for handling the error from setup_card() missed that an internal URB cdev->ep1_in_urb might have been already submitted beforehand. In the normal case, this URB gets killed at the disconnection, but in the error path, we didn't do it, hence there can be a potential leak. Fix it in the error path for setup_card(), too. Fixes: 28abd224db4a ("ALSA: caiaq: Handle probe errors properly") Cc: Link: https://patch.msgid.link/20260427123819.890185-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit fa90a3145c0340c3f624206a81637c542254ea1d Author: Cosmin Ratiu Date: Wed Apr 22 17:06:48 2026 +0300 xfrm: Don't clobber inner headers when already set On VXLAN over IPsec egress, xfrm{4,6}_transport_output() blindly overwrite inner_transport_header (== the inner TCP header saved in VXLAN iptunnel_handle_offloads() -> skb_reset_inner_headers()) with the current transport_header (== the VXLAN outer UDP header set by udp_tunnel_xmit_skb()). This was a latent bug, harmless until commit [1] added a doff validation check in qdisc_pkt_len_segs_init() for encapsulated GSO packets. With the wrong inner_transport_header set by xfrm, qdisc_pkt_len_segs_init() interprets inner_transport_header as a TCP header, reads doff=0 from the upper byte of the VNI and drops the packet with DROP_REASON_SKB_BAD_GSO. Besides the use in GSO to determine the header size of segmented packets, inner_transport_header might be used by drivers to set up inner checksum offloading by pointing the HW to the inner transport header. A quick browse through available drivers shows that mlx5 uses skb->csum_start specifically for this scenario, while others either don't support VXLAN over IPsec crypto offload (ixgbe) or the HW is capable of parsing the packets itself (nfp, Chelsio). But in all cases, it is more correct to let the inner_transport_header point to the innermost header instead of overwriting it in xfrm. So fix this by guarding all four inner header save sites in xfrm_output.c (xfrm{4,6}_transport_output, xfrm{4,6}_tunnel_encap_add) with a check for skb->inner_protocol. When inner_protocol is set, a tunnel layer (VXLAN, Geneve, GRE, etc.) has already saved the correct inner header offsets and they must not be overwritten. When inner_protocol is zero, no prior tunnel encapsulation exists and xfrm must save the inner headers itself. The tunnel mode checks are only added for completion, since they aren't strictly required, as xfrm_output() forces software GSO in tunnel mode before encap. This makes the previously added test pass: # ./tools/testing/selftests/drivers/net/hw/ipsec_vxlan.py TAP version 13 1..4 ok 1 ipsec_vxlan.test_vxlan_ipsec_crypto_offload.outer_v4_inner_v4 ok 2 ipsec_vxlan.test_vxlan_ipsec_crypto_offload.outer_v4_inner_v6 ok 3 ipsec_vxlan.test_vxlan_ipsec_crypto_offload.outer_v6_inner_v4 ok 4 ipsec_vxlan.test_vxlan_ipsec_crypto_offload.outer_v6_inner_v6 # Totals: pass:4 fail:0 xfail:0 xpass:0 skip:0 error:0 [1] commit 7fb4c1967011 ("net: pull headers in qdisc_pkt_len_segs_init()") Fixes: f1bd7d659ef0 ("xfrm: Add encapsulation header offsets while SKB is not encrypted") Signed-off-by: Cosmin Ratiu Signed-off-by: Steffen Klassert commit e64e03b478e2da7093564819e903932fca2ddfa1 Author: Cosmin Ratiu Date: Wed Apr 22 17:06:47 2026 +0300 tools/selftests: Add a VXLAN+IPsec traffic test There are VXLAN tests and IPsec tests, but there is no test that combines the two protocols and exercises the tunnel-over-ipsec code paths. Fix that by adding a traffic test with VXLAN and IPsec using crypto offload. This is runnable on HW which supports ESP offload (so no nsim unfortunately). Traffic is done with iperf3 and the test validates that there are no packet drops and iperf3 can get to at least 100 Mbps (a very conservative value on today's crypto offload HW, as it can typically reach multi-Gbps rates). Ran right now, the test fails due to a recently exposed bug in xfrm, which will be fixed in the next patch: # ./tools/testing/selftests/drivers/net/hw/ipsec_vxlan.py TAP version 13 1..4 # Check| At ./tools/testing/selftests/drivers/net/hw/ipsec_vxlan.py, # line 161, in test_vxlan_ipsec_crypto_offload: # Check| ksft_eq(drops_after - drops_before, 0, # Check failed 189 != 0 TX drops during VXLAN+IPsec # Check| At ./tools/testing/selftests/drivers/net/hw/ipsec_vxlan.py, # line 163, in test_vxlan_ipsec_crypto_offload: # Check| ksft_ge(bw_gbps, 0.1, # Check failed 0.0015058278404812596 < 0.1 Minimum 100Mbps over # VXLAN+IPsec not ok 1 ipsec_vxlan.test_vxlan_ipsec_crypto_offload.outer_v4_inner_v4 ... Signed-off-by: Cosmin Ratiu Signed-off-by: Steffen Klassert commit ada95e5e603bc6e353ee029f2ba7a7d9a42ad018 Author: Cosmin Ratiu Date: Wed Apr 22 17:06:46 2026 +0300 tools/selftests: Use a sensible timeout value for iperf3 client The default timeout of cmd() is 5 seconds and Iperf3Runner requests the iperf3 client to run for 10 seconds, which clearly doesn't work since commit [1] enforced the timeout parameter. Use a value derived from duration as timeout (+5 seconds for startup/teardown/various other overhead). [1] commit f0bd19316663 ("selftests: net: fix timeout passed as positional argument to communicate()") Signed-off-by: Cosmin Ratiu Signed-off-by: Steffen Klassert commit 241ee17ecb6be210f7b231b2a81bfb68871950d0 Author: wangdicheng Date: Tue Apr 28 10:34:08 2026 +0800 ASoC: aw88395: Fix kernel panic caused by invalid GPIO error pointer In aw88395_i2c_probe(), if `devm_gpiod_get_optional()` fails, it returns an ERR_PTR() error pointer. The current code only prints a message and continues execution, leaving `aw88395->reset_gpio` as an invalid pointer. Later, in `aw88395_hw_reset()`, this invalid pointer is passed to `gpiod_set_value_cansleep()`, which dereferences it and causes a kernel panic. For optional GPIOs, `devm_gpiod_get_optional()` returns NULL if the GPIO is not defined in the DT, which is safe. If it returns an ERR_PTR, it means a real error occurred (e.g., -EPROBE_DEFER) and the probe must be aborted. Also, since the GPIO is optional, remove the dev_err() log in aw88395_hw_reset() when the GPIO is missing to match the optional semantics. This also fixes a potential NULL pointer dereference as aw_pa is not initialized when aw88395_hw_reset() is called. Signed-off-by: wangdicheng Link: https://patch.msgid.link/20260428023408.46420-1-wangdich9700@163.com Signed-off-by: Mark Brown commit 3bc179bc7146c26c9dff75d2943d10528274e301 Author: Breno Leitao Date: Fri Apr 24 08:31:16 2026 -0700 netpoll: fix IPv6 local-address corruption netpoll_setup() decides whether to auto-populate the local source address by testing np->local_ip.ip, which only inspects the first 4 bytes of the union inet_addr storage. For an IPv6 netpoll whose caller-supplied local address has a zero high-32 bits (::1, ::, IPv4-mapped ::ffff:a.b.c.d, etc.), this misdetects the address as unset (which they are not, but the first 4 bytes are empty), calls netpoll_take_ipv6() and overwrites it with whatever matching link-local/global address the device happens to expose first. Introduce a helper netpoll_local_ip_unset() that picks the correct family-aware test (ipv6_addr_any() for IPv6, !.ip for IPv4) and use it from netpoll_setup(). Reproducer is something like: echo "::2" > local_ip echo 1 > enabled cat local_ip # before this fix: 2001:db8::1 (caller-supplied ::2 was clobbered) # after this fix: ::2 Fixes: b7394d2429c1 ("netpoll: prepare for ipv6") Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260424-netpoll_fix-v1-1-3a55348c625f@debian.org Signed-off-by: Jakub Kicinski commit 2b9f6f7065d4cfb65ba19126e0b35ac4544c3f3a Author: Altan Hacigumus Date: Thu Apr 23 18:46:38 2026 -0700 tcp: make probe0 timer handle expired user timeout tcp_clamp_probe0_to_user_timeout() computes remaining time in jiffies using subtraction with an unsigned lvalue. If elapsed probing time exceeds the configured TCP_USER_TIMEOUT, the underflow yields a large value. This ends up re-arming the probe timer for a full backoff interval instead of expiring immediately, delaying connection teardown beyond the configured timeout. Fix this by preventing underflow so user-set timeout expiration is handled correctly without extending the probe timer. Fixes: 344db93ae3ee ("tcp: make TCP_USER_TIMEOUT accurate for zero window probes") Link: https://lore.kernel.org/r/20260414013634.43997-1-ahacigu.linux@gmail.com Signed-off-by: Altan Hacigumus Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260424014639.54110-1-ahacigu.linux@gmail.com Signed-off-by: Jakub Kicinski commit cc427d24ac6442ffdeafd157a63c7c5b73ed4de4 Author: Mingming Cao Date: Fri Apr 24 09:29:17 2026 -0700 ibmveth: Disable GSO for packets with small MSS Some physical adapters on Power systems do not support segmentation offload when the MSS is less than 224 bytes. Attempting to send such packets causes the adapter to freeze, stopping all traffic until manually reset. Implement ndo_features_check to disable GSO for packets with small MSS values. The network stack will perform software segmentation instead. The 224-byte minimum matches ibmvnic commit ("ibmvnic: Enforce stronger sanity checks on GSO packets") which uses the same physical adapters in SEA configurations. The issue occurs specifically when the hardware attempts to perform segmentation (gso_segs > 1) with a small MSS. Single-segment GSO packets (gso_segs == 1) do not trigger the problematic LSO code path and are transmitted normally without segmentation. Add an ndo_features_check callback to disable GSO when MSS < 224 bytes. Also call vlan_features_check() to ensure proper handling of VLAN packets, particularly QinQ (802.1ad) configurations where the hardware parser may not support certain offload features. Validated using iptables to force small MSS values. Without the fix, the adapter freezes. With the fix, packets are segmented in software and transmission succeeds. Comprehensive regression testing completedd (MSS tests, performance, stability). Fixes: 8641dd85799f ("ibmveth: Add support for TSO") Cc: stable@vger.kernel.org Reviewed-by: Brian King Tested-by: Shaik Abdulla Tested-by: Naveed Ahmed Signed-off-by: Mingming Cao Link: https://patch.msgid.link/20260424162917.65725-1-mmc@linux.ibm.com Signed-off-by: Jakub Kicinski commit 4438113be604ee67a7bf4f81da6e1cca41332ce4 Author: Florian Westphal Date: Fri Apr 24 16:58:38 2026 +0200 neigh: let neigh_xmit take skb ownership neigh_xmit always releases the skb, except when no neighbour table is found. But even the first added user of neigh_xmit (mpls) relied on neigh_xmit to release the skb (or queue it for tx). sashiko reported: If neigh_xmit() is called with an uninitialized neighbor table (for example, NEIGH_ND_TABLE when IPv6 is disabled), it returns -EAFNOSUPPORT and bypasses its internal out_kfree_skb error path. Because the return value of neigh_xmit() is ignored here, does this leak the SKB? Assume full ownership and remove the last code path that doesn't xmit or free skb. Fixes: 4fd3d7d9e868 ("neigh: Add helper function neigh_xmit") Signed-off-by: Florian Westphal Reviewed-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260424145843.74055-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit b3b6babf47517fde6b6de2493dea28e8831b9347 Author: Kuniyuki Iwashima Date: Thu Apr 23 05:34:54 2026 +0000 ipmr: Free mr_table after RCU grace period. With CONFIG_IP_MROUTE_MULTIPLE_TABLES=n, ipmr_fib_lookup() does not check if net->ipv4.mrt is NULL. Since default_device_exit_batch() is called after ->exit_rtnl(), a device could receive IGMP packets and access net->ipv4.mrt during/after ipmr_rules_exit_rtnl(). If ipmr_rules_exit_rtnl() had already cleared it and freed the memory, the access would trigger null-ptr-deref or use-after-free. Let's fix it by using RCU helper and free mrt after RCU grace period. In addition, check_net(net) is added to mroute_clean_tables() and ipmr_cache_unresolved() to synchronise via mfc_unres_lock. This prevents ipmr_cache_unresolved() from putting skb into c->_c.mfc_un.unres.unresolved after mroute_clean_tables() purges it. For the same reason, timer_shutdown_sync() is moved after mroute_clean_tables(). Since rhltable_destroy() holds mutex internally, rcu_work is used, and it is placed as the first member because rcu_head must be placed within <4K offset. mr_table is alraedy 3864 bytes without rcu_work. Note that IP6MR is not yet converted to ->exit_rtnl(), so this change is not needed for now but will be. Fixes: b22b01867406 ("ipmr: Convert ipmr_net_exit_batch() to ->exit_rtnl().") Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260423053456.4097409-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 5b0c911bcdbd982f7748d11c0b39ec5808eae2de Author: Morduan Zang Date: Thu Apr 23 09:05:57 2026 +0800 net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind syzbot reported a kernel BUG triggered from pn_socket_sendmsg() via pn_socket_autobind(): kernel BUG at net/phonet/socket.c:213! RIP: 0010:pn_socket_autobind net/phonet/socket.c:213 [inline] RIP: 0010:pn_socket_sendmsg+0x240/0x250 net/phonet/socket.c:421 Call Trace: sock_sendmsg_nosec+0x112/0x150 net/socket.c:797 __sock_sendmsg net/socket.c:812 [inline] __sys_sendto+0x402/0x590 net/socket.c:2280 ... pn_socket_autobind() calls pn_socket_bind() with port 0 and, on -EINVAL, assumes the socket was already bound and asserts that the port is non-zero: err = pn_socket_bind(sock, ..., sizeof(struct sockaddr_pn)); if (err != -EINVAL) return err; BUG_ON(!pn_port(pn_sk(sock->sk)->sobject)); return 0; /* socket was already bound */ However pn_socket_bind() also returns -EINVAL when sk->sk_state is not TCP_CLOSE, even when the socket has never been bound and pn_port() is still 0. In that case the BUG_ON() fires and panics the kernel from a user-triggerable path. Treat the "bind returned -EINVAL but pn_port() is still 0" case as a regular error and propagate -EINVAL to the caller instead of crashing. Existing callers already translate a non-zero return from pn_socket_autobind() into -ENOBUFS/-EAGAIN, so returning -EINVAL here only changes behaviour from panic to a normal errno. Fixes: ba113a94b750 ("Phonet: common socket glue") Reported-by: syzbot+706f5eb79044e686c794@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=706f5eb79044e686c794 Suggested-by: Remi Denis-Courmont Signed-off-by: Morduan Zang Signed-off-by: zhanjun Acked-by: Rémi Denis-Courmont Link: https://patch.msgid.link/87A8960A2045AF3C+20260423010557.138124-1-zhangdandan@uniontech.com Signed-off-by: Jakub Kicinski commit c4047e7075b303b952a595f901b0f022c2403206 Merge: a9bc28aa4e6432 a469feed399da7 Author: Jakub Kicinski Date: Mon Apr 27 18:41:37 2026 -0700 Merge branch 'net-sched-taprio-fix-null-pointer-dereference-in-class-dump' Weiming Shi says: ==================== net/sched: taprio: fix NULL pointer dereference in class dump Patch 1/2 is the fix: replace NULL entries in q->qdiscs[] with the global &noop_qdisc singleton so that control-plane dump paths, as well as the existing NULL guards in the data-plane enqueue/dequeue paths, cannot deref a NULL child qdisc. Patch 2/2 is a tdc regression test that drives the graft + delete + class-dump sequence on a multi-queue netdevsim device. It panics the vulnerable kernel and passes on the fixed one. ==================== Link: https://patch.msgid.link/20260422161958.2517539-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit a469feed399da791f890b3448622121e97a07f3b Author: Weiming Shi Date: Thu Apr 23 00:19:59 2026 +0800 selftests/tc-testing: add taprio test for class dump after child delete Add a regression test for the NULL pointer dereference fixed in the previous commit. Before the fix, taprio_graft() stored NULL into q->qdiscs[cl - 1] when an explicitly grafted child qdisc was deleted via RTM_DELQDISC; the next RTM_GETTCLASS dump then crashed the kernel in taprio_dump_class() while reading child->handle. The test installs a taprio root qdisc on a multi-queue netdevsim device, grafts a pfifo child onto class 8001:1, deletes that child, and then performs a class dump. On a fixed kernel the dump succeeds and all eight taprio classes are listed; on an unpatched kernel the class dump crashes, which surfaces as a test failure. Signed-off-by: Weiming Shi Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260422161958.2517539-4-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit 3d07ca5c0fae311226f737963984bd94bb159a87 Author: Weiming Shi Date: Thu Apr 23 00:19:58 2026 +0800 net/sched: taprio: fix NULL pointer dereference in class dump When a TAPRIO child qdisc is deleted via RTM_DELQDISC, taprio_graft() is called with new == NULL and stores NULL into q->qdiscs[cl - 1]. Subsequent RTM_GETTCLASS dump operations walk all classes via taprio_walk() and call taprio_dump_class(), which calls taprio_leaf() returning the NULL pointer, then dereferences it to read child->handle, causing a kernel NULL pointer dereference. The bug is reachable with namespace-scoped CAP_NET_ADMIN on any kernel with CONFIG_NET_SCH_TAPRIO enabled. On systems with unprivileged user namespaces enabled, an unprivileged local user can trigger a kernel panic by creating a taprio qdisc inside a new network namespace, grafting an explicit child qdisc, deleting it, and requesting a class dump. The RTM_GETTCLASS dump itself requires no capability. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000007: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:taprio_dump_class (net/sched/sch_taprio.c:2478) Call Trace: tc_fill_tclass (net/sched/sch_api.c:1966) qdisc_class_dump (net/sched/sch_api.c:2326) taprio_walk (net/sched/sch_taprio.c:2514) tc_dump_tclass_qdisc (net/sched/sch_api.c:2352) tc_dump_tclass_root (net/sched/sch_api.c:2370) tc_dump_tclass (net/sched/sch_api.c:2431) rtnl_dumpit (net/core/rtnetlink.c:6864) netlink_dump (net/netlink/af_netlink.c:2325) rtnetlink_rcv_msg (net/core/rtnetlink.c:6959) netlink_rcv_skb (net/netlink/af_netlink.c:2550) Fix this by substituting &noop_qdisc when new is NULL in taprio_graft(), a common pattern used by other qdiscs (e.g., multiq_graft()) to ensure the q->qdiscs[] slots are never NULL. This makes control-plane dump paths safe without requiring individual NULL checks. Since the data-plane paths (taprio_enqueue and taprio_dequeue_from_txq) previously had explicit NULL guards that would drop/skip the packet cleanly, update those checks to test for &noop_qdisc instead. Without this, packets would reach taprio_enqueue_one() which increments the root qdisc's qlen and backlog before calling the child's enqueue; noop_qdisc drops the packet but those counters are never rolled back, permanently inflating the root qdisc's statistics. After this change *old can be a valid qdisc, NULL, or &noop_qdisc. Only call qdisc_put(*old) in the first case to avoid decreasing noop_qdisc's refcount, which was never increased. Fixes: 665338b2a7a0 ("net/sched: taprio: dump class stats for the actual q->qdiscs[]") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Acked-by: Jamal Hadi Salim Tested-by: Weiming Shi Link: https://patch.msgid.link/20260422161958.2517539-3-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit dca922e019dd758b4c1b4bec8f1d509efddeaab4 Merge: 3b3bea6d4b9c16 24daca4fc07f3f Author: Linus Torvalds Date: Mon Apr 27 18:36:47 2026 -0700 Merge tag 'xsa48x-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "XSA-485 and XSA-487 security patches" * tag 'xsa48x-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/privcmd: fix double free via VMA splitting Buffer overflow in drivers/xen/sys-hypervisor.c commit a9bc28aa4e64320668131349436a650bf42591a5 Author: Paul Geurts Date: Wed Apr 22 12:09:30 2026 +0200 NFC: trf7970a: Ignore antenna noise when checking for RF field The main channel Received Signal Strength Indicator (RSSI) measurement is used to determine whether an RF field is present or not. RSSI != 0 is interpreted as an RF Field is present. This does not take RF noise and measurement inaccuracy into account, and results in false positives in the field. Define a noise level and make sure the RF field is only interpreted as present when the RSSI is above the noise level. Fixes: 851ee3cbf850 ("NFC: trf7970a: Don't turn on RF if there is already an RF field") Signed-off-by: Paul Geurts Reviewed-by: Krzysztof Kozlowski Reviewed-by: Mark Greer Link: https://patch.msgid.link/20260422100930.581237-1-paul.geurts@prodrive-technologies.com Signed-off-by: Jakub Kicinski commit 8d0189c1ea98b56481eb809e3d1bdbf85557e819 Author: Felix Gu Date: Tue Apr 28 01:42:00 2026 +0800 spi: amlogic-spisg: initialize completion before requesting IRQ Move init_completion(&spisg->completion) to before devm_request_irq() to avoid a potential race condition where an interrupt could fire before the completion structure is initialized. Fixes: cef9991e04ae ("spi: Add Amlogic SPISG driver") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260428-amlogic-spisg-v1-1-8eecc3b446d6@gmail.com Signed-off-by: Mark Brown commit adbe2cdf75461891e50dbe11896ac78e9af1f874 Author: Morduan Zang Date: Fri Apr 24 09:55:17 2026 +0800 net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit When rtl8150_start_xmit() fails to submit the tx URB, the URB is never handed to the USB core and write_bulk_callback() will not run. The driver returns NETDEV_TX_OK, which tells the networking stack that the skb has been consumed, but nothing actually frees the skb on this error path: dev->tx_skb = skb; ... if ((res = usb_submit_urb(dev->tx_urb, GFP_ATOMIC))) { ... /* no kfree_skb here */ } return NETDEV_TX_OK; This leaks the skb on every submit failure and also leaves dev->tx_skb pointing at memory that the driver itself may later free, which is fragile. Free the skb with dev_kfree_skb_any() in the error path and clear dev->tx_skb so no stale pointer is left behind. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reviewed-by: Andrew Lunn Signed-off-by: Morduan Zang Link: https://patch.msgid.link/E7D3E1C013C5A859+20260424015517.9574-1-zhangdandan@uniontech.com Signed-off-by: Jakub Kicinski commit 23f0e34c64acba15cad4d23e50f41f533da195fa Author: Zhan Jun Date: Thu Apr 23 08:49:12 2026 +0800 net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit() when accessing skb->len for tx statistics after usb_submit_urb() has been called: BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760 drivers/net/usb/rtl8150.c:712 Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226 The URB completion handler write_bulk_callback() frees the skb via dev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU in softirq context before usb_submit_urb() returns in the submitter, so by the time the submitter reads skb->len the skb has already been queued to the per-CPU completion_queue and freed by net_tx_action(): CPU A (xmit) CPU B (USB completion softirq) ------------ ------------------------------ dev->tx_skb = skb; usb_submit_urb() --+ |-------> write_bulk_callback() | dev_kfree_skb_irq(dev->tx_skb) | net_tx_action() | napi_skb_cache_put() <-- free netdev->stats.tx_bytes | += skb->len; <-- UAF read Fix it by caching skb->len before submitting the URB and using the cached value when updating the tx_bytes counter. The pre-existing tx_bytes semantics are preserved: the counter tracks the original frame length (skb->len), not the ETH_ZLEN/USB-alignment padded "count" value that is handed to the device. Changing that would be a user-visible accounting change and is out of scope for this UAF fix. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+3f46c095ac0ca048cb71@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69e69ee7.050a0220.24bfd3.002b.GAE@google.com/ Closes: https://syzkaller.appspot.com/bug?extid=3f46c095ac0ca048cb71 Reviewed-by: Andrew Lunn Signed-off-by: Zhan Jun Link: https://patch.msgid.link/809895186B866C10+20260423004913.136655-1-zhangdandan@uniontech.com Signed-off-by: Jakub Kicinski commit 9e6bf146b55999a095bb14f73a843942456d1adc Author: Greg Kroah-Hartman Date: Tue Apr 21 15:16:33 2026 +0200 ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, then pulls the old header and pushes the new one plus the IPv6 header back. The recompressed header can be larger than the received one when the swap reduces the common-prefix length the segments share with daddr (CmprI=0, CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes). pskb_expand_head() was gated on segments_left == 0, so on earlier segments the push consumed unchecked headroom. Once skb_push() leaves fewer than skb->mac_len bytes in front of data, skb_mac_header_rebuild()'s call to: skb_set_mac_header(skb, -skb->mac_len); will store (data - head) - mac_len into the u16 mac_header field, which wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB past skb->head. A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv. Fix this by expanding the head whenever the remaining room is less than the push size plus mac_len, and request that much extra so the rebuilt MAC header fits afterwards. Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr") Cc: stable Reported-by: Anthropic Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026042133-gout-unvented-1bd9@gregkh Signed-off-by: Jakub Kicinski commit 2674d603a9e6970463b2b9ebcf8e31e90beae169 Author: Ido Schimmel Date: Thu Apr 23 09:36:07 2026 +0300 vrf: Fix a potential NPD when removing a port from a VRF RCU readers that identified a net device as a VRF port using netif_is_l3_slave() assume that a subsequent call to netdev_master_upper_dev_get_rcu() will return a VRF device. They then continue to dereference its l3mdev operations. This assumption is not always correct and can result in a NPD [1]. There is no RCU synchronization when removing a port from a VRF, so it is possible for an RCU reader to see a new master device (e.g., a bridge) that does not have l3mdev operations. Fix by adding RCU synchronization after clearing the IFF_L3MDEV_SLAVE flag. Skip this synchronization when a net device is removed from a VRF as part of its deletion and when the VRF device itself is deleted. In the latter case an RCU grace period will pass by the time RTNL is released. [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:l3mdev_fib_table_rcu (net/l3mdev/l3mdev.c:181) [...] Call Trace: l3mdev_fib_table_by_index (net/l3mdev/l3mdev.c:201 net/l3mdev/l3mdev.c:189) __inet_bind (net/ipv4/af_inet.c:499 (discriminator 3)) inet_bind_sk (net/ipv4/af_inet.c:469) __sys_bind (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:1951 (discriminator 1)) __x64_sys_bind (net/socket.c:1969 (discriminator 1) net/socket.c:1967 (discriminator 1) net/socket.c:1967 (discriminator 1)) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Fixes: fdeea7be88b1 ("net: vrf: Set slave's private flag before linking") Reported-by: Haoze Xie Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Yuan Tan Closes: https://lore.kernel.org/netdev/20260419145332.3988923-1-n05ec@lzu.edu.cn/ Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20260423063607.1208202-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 59b145771c7982cfe9020d4e9e22da92d6b5ae31 Author: Eric Dumazet Date: Thu Apr 23 06:35:27 2026 +0000 net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() fq_codel_dump_stats() acquires the qdisc spinlock a bit too late. Move this acquisition before we fill tc_fq_pie_xstats with live data. Alternative would be to add READ_ONCE() and WRITE_ONCE() annotations, but the spinlock is needed anyway to scan q->new_flows and q->old_flows. Fixes: ec97ecf1ebe4 ("net: sched: add Flow Queue PIE packet scheduler") Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260423063527.2568262-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d3aeb889dcbd78e95f500d383799a23d949796e0 Author: Eric Dumazet Date: Thu Apr 23 06:28:39 2026 +0000 net/sched: sch_choke: annotate data-races in choke_dump_stats() choke_dump_stats() only runs with RTNL held. It reads fields that can be changed in qdisc fast path. Add READ_ONCE()/WRITE_ONCE() annotations. Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260423062839.2524324-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit bde34e84edc8b5571fbde7e941e175a4293ee1eb Author: Lorenzo Bianconi Date: Fri Apr 24 11:00:28 2026 +0200 net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb until the final descriptor is processed. Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260424-airoha-xmit-fix-read-frag-v1-1-fdc0a83c79e8@kernel.org Signed-off-by: Jakub Kicinski commit e070aac63b42bf81f4dc565f9f841ff47e6c992f Author: Lorenzo Bianconi Date: Tue Apr 21 10:53:33 2026 +0200 net: airoha: Do not wake all netdev TX queues in airoha_qdma_wake_netdev_txqs() Do not wake every netdev TX queue across all ports sharing the QDMA running netif_tx_wake_all_queues routine in airoha_qdma_wake_netdev_txqs() but only the ones that are mapped the specific QDMA stopped hw TX queue. This patch can potentially avoid waking already stopped netdev TX queues that are mapped to a different QDMA hw TX queue. Introduce airoha_qdma_get_txq utility routine. Fixes: b94769eb2f30 ("net: airoha: Fix possible TX queue stall in airoha_qdma_tx_napi_poll()") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260421-airoha-wake_netdev_txqs-optmization-v1-1-e0be95115d53@kernel.org Signed-off-by: Jakub Kicinski commit 3854de7b38be742cf7558476956d12414cb274f2 Author: Lorenzo Bianconi Date: Tue Apr 21 08:43:07 2026 +0200 net: airoha: stop net_device TX queue before updating CPU index Currently, airoha_eth driver updates the CPU index register prior of verifying whether the number of free descriptors has fallen below the threshold. Move net_device TX queue length check before updating the TX CPU index in order to update TX CPU index even if there are more packets to be transmitted but the net_device TX queue is going to be stopped accounting the inflight packets. Fixes: 1d304174106c ("net: airoha: Implement BQL support") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260421-airoha-xmit-stop-condition-v1-1-e670d6a48467@kernel.org Signed-off-by: Jakub Kicinski commit 2d9f5a118205da2683ffcec78b9347f1f01a820e Author: Lorenzo Bianconi Date: Tue Apr 21 08:35:11 2026 +0200 net: airoha: fix BQL imbalance in TX path Fix a possible BQL imbalance in airoha_dev_xmit(), where inflight packets are accounted only for the AIROHA_NUM_TX_RING netdev TX queues. The queue index is computed as: qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx) txq = netdev_get_tx_queue(dev, qid); However, airoha_qdma_tx_napi_poll() accounts completions across all netdev TX queues (num_tx_queues), leading to inconsistent BQL accounting. Also reset all netdev TX queues in the ndo_stop callback. Fixes: 1d304174106c ("net: airoha: Implement BQL support") Fixes: c9f947769b77 ("net: airoha: Reset BQL stopping the netdevice") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260421-airoha-fix-bql-v1-1-f135afe4275b@kernel.org Signed-off-by: Jakub Kicinski commit 5bd6252b9df1030b31095f9f5d34f92a0ea5db78 Merge: 35eaa6d8d6c2ee 90be9fedb218ee Author: Jakub Kicinski Date: Mon Apr 27 17:30:48 2026 -0700 Merge branch 'netem-bug-fixes' Stephen Hemminger says: ==================== netem: bug fixes These bugs were found when doing AI-assisted review of sch_netem.c during investigation of the packet duplication recursion problem addressed in Jamal's series. The fixes cover: - probability gaps in the 4-state Markov loss model - queue limit not accounting for reordered packets - PRNG reseeded on every tc change, breaking reproducibility - slot configuration not validated (inverted ranges, negative delays, negative limits) - slot delay arithmetic overflow for ranges above ~2.1 seconds - negative latency and jitter wrapping to huge time_to_send values via u64 arithmetic ==================== Link: https://patch.msgid.link/20260418032027.900913-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski commit 90be9fedb218ee95a1cf59050d1306fbfb0e8b87 Author: Stephen Hemminger Date: Fri Apr 17 20:19:44 2026 -0700 net/sched: netem: check for negative latency and jitter Reject requests with negative latency or jitter. A negative value added to current timestamp (u64) wraps to an enormous time_to_send, disabling dequeue. The original UAPI used u32 for these values; the conversion to 64-bit time values via TCA_NETEM_LATENCY64 and TCA_NETEM_JITTER64 allowed signed values to reach the kernel without validation. Jitter is already silently clamped by an abs() in netem_change(); that abs() can be removed in a follow-up once this rejection is in place. Fixes: 99803171ef04 ("netem: add uapi to express delay and jitter in nanoseconds") Signed-off-by: Stephen Hemminger Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260418032027.900913-7-stephen@networkplumber.org Signed-off-by: Jakub Kicinski commit 51e94e1e2fef351c74d69eb53666df808d26af95 Author: Stephen Hemminger Date: Fri Apr 17 20:19:43 2026 -0700 net/sched: netem: fix slot delay calculation overflow get_slot_next() computes a random delay between min_delay and max_delay using: get_random_u32() * (max_delay - min_delay) >> 32 This overflows signed 64-bit arithmetic when the delay range exceeds approximately 2.1 seconds (2^31 nanoseconds), producing a negative result that effectively disables slot-based pacing. This is a realistic configuration for WAN emulation (e.g., slot 1s 5s). Use mul_u64_u32_shr() which handles the widening multiply without overflow. Fixes: 0a9fe5c375b5 ("netem: slotting with non-uniform distribution") Signed-off-by: Stephen Hemminger Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260418032027.900913-6-stephen@networkplumber.org Signed-off-by: Jakub Kicinski commit 01801c359a74737b9b1aa28568b60374d857241a Author: Stephen Hemminger Date: Fri Apr 17 20:19:42 2026 -0700 net/sched: netem: validate slot configuration Reject slot configurations that have no defensible meaning: - negative min_delay or max_delay - min_delay greater than max_delay - negative dist_delay or dist_jitter - negative max_packets or max_bytes Negative or out-of-order delays underflow in get_slot_next(), producing garbage intervals. Negative limits trip the per-slot accounting (packets_left/bytes_left <= 0) on the first packet of every slot, defeating the rate-limiting half of the slot feature. Note that dist_jitter has been silently coerced to its absolute value by get_slot() since the feature was introduced; rejecting negatives here converts that silent coercion into -EINVAL. The abs() can be removed in a follow-up. Fixes: 836af83b54e3 ("netem: support delivering packets in delayed time slots") Signed-off-by: Stephen Hemminger Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260418032027.900913-5-stephen@networkplumber.org Signed-off-by: Jakub Kicinski commit 986afaf809940577224a99c3a08d97a15eb37e93 Author: Stephen Hemminger Date: Fri Apr 17 20:19:41 2026 -0700 net/sched: netem: only reseed PRNG when seed is explicitly provided netem_change() unconditionally reseeds the PRNG on every tc change command. If TCA_NETEM_PRNG_SEED is not specified, a new random seed is generated, destroying reproducibility for users who set a deterministic seed on a previous change. Move the initial random seed generation to netem_init() and only reseed in netem_change() when TCA_NETEM_PRNG_SEED is explicitly provided by the user. Fixes: 4072d97ddc44 ("netem: add prng attribute to netem_sched_data") Signed-off-by: Stephen Hemminger Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260418032027.900913-4-stephen@networkplumber.org Signed-off-by: Jakub Kicinski commit 4185701fcce6b426b6c3630b25330dddd9c47b0d Author: Stephen Hemminger Date: Fri Apr 17 20:19:40 2026 -0700 net/sched: netem: fix queue limit check to include reordered packets The queue limit check in netem_enqueue() uses q->t_len which only counts packets in the internal tfifo. Packets placed in sch->q by the reorder path (__qdisc_enqueue_head) are not counted, allowing the total queue occupancy to exceed sch->limit under reordering. Include sch->q.qlen in the limit check. Fixes: f8d4bc455047 ("net/sched: netem: account for backlog updates from child qdisc") Signed-off-by: Stephen Hemminger Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260418032027.900913-3-stephen@networkplumber.org Signed-off-by: Jakub Kicinski commit 732b463449fd0ef90acd13cda68eab1c91adb00c Author: Stephen Hemminger Date: Fri Apr 17 20:19:39 2026 -0700 net/sched: netem: fix probability gaps in 4-state loss model The 4-state Markov chain in loss_4state() has gaps at the boundaries between transition probability ranges. The comparisons use: if (rnd < a4) else if (a4 < rnd && rnd < a1 + a4) When rnd equals a boundary value exactly, neither branch matches and no state transition occurs. The redundant lower-bound check (a4 < rnd) is already implied by being in the else branch. Remove the unnecessary lower-bound comparisons so the ranges are contiguous and every random value produces a transition, matching the GI (General and Intuitive) loss model specification. This bug goes back to original implementation of this model. Fixes: 661b79725fea ("netem: revised correlated loss generator") Signed-off-by: Stephen Hemminger Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260418032027.900913-2-stephen@networkplumber.org Signed-off-by: Jakub Kicinski commit 35eaa6d8d6c2ee65e96f507add856e0eacf24591 Author: Nikola Z. Ivanov Date: Sun Apr 26 23:14:34 2026 +0300 netdevsim: zero initialize struct iphdr in dummy sk_buff Syzbot reports a KMSAN uninit-value originating from nsim_dev_trap_skb_build, with the allocation also being performed in the same function. Fix this by calling skb_put_zero instead of skb_put to guarantee zero initialization of the whole IP header. Closes: https://syzkaller.appspot.com/bug?extid=23d7fcd204e3837866ff Fixes: da58f90f11f5 ("netdevsim: Add devlink-trap support") Signed-off-by: Nikola Z. Ivanov Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260426201434.742030-1-zlatistiv@gmail.com Signed-off-by: Jakub Kicinski commit 3b3bea6d4b9c162f9e555905d96b8c1da67ecd5b Merge: a1a671092d2945 981cd338614c96 Author: Linus Torvalds Date: Mon Apr 27 16:51:27 2026 -0700 Merge tag 'cgroup-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - Fix UAF race in psi pressure_write() against cgroup file release by extending cgroup_mutex coverage and ordering of->priv access after cgroup_kn_lock_live() - Fix integer overflow in rdmacg_try_charge() when usage equals INT_MAX by performing the increment in s64 - Fix asymmetric DL bandwidth accounting on cpuset attach rollback by recording the CPU used by dl_bw_alloc() so cancel_attach() returns the reservation to the same root domain - Fix nr_dying_subsys_* race that briefly showed 0 in cgroup.stat after rmdir by incrementing from kill_css() instead of offline_css() - Typo fix in cgroup-v2 documentation * tag 'cgroup-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: docs: cgroup: fix typo 'protetion' -> 'protection' cgroup: Increment nr_dying_subsys_* from rmdir context cgroup/cpuset: record DL BW alloc CPU for attach rollback cgroup/rdma: fix integer overflow in rdmacg_try_charge() sched/psi: fix race between file release and pressure write commit a1a671092d29455a890af272f0702925adafdf59 Merge: 53b6156308e5ec 13917f71a95a6e Author: Linus Torvalds Date: Mon Apr 27 16:45:39 2026 -0700 Merge tag 'fs_for_v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull isofs and udf fixes from Jan Kara: "Several isofs and udf fixes" * tag 'fs_for_v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: docs: isofs: replace dead ECMA-119 FTP link udf: reject descriptors with oversized CRC length isofs: use QSTR_LEN() in isofs_cmp isofs: validate block number from NFS file handle in isofs_export_iget isofs: validate Rock Ridge CE continuation extent against volume size commit 53b6156308e5ec9f4440e7cd3e84c6d1775167b1 Merge: 73082fbdb10aba 4aca914ac152f5 Author: Linus Torvalds Date: Mon Apr 27 16:40:24 2026 -0700 Merge tag 'fsnotify_for_v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify fixes from Jan Kara: "Three fixes for fsnotify / fanotify" * tag 'fsnotify_for_v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fsnotify: fix inode reference leak in fsnotify_recalc_mask() fanotify: Fix spelling mistake "enforecement" -> "enforcement" fanotify: fix false positive on permission events commit f5c6a272b699b9a0698535e1a56e683207e50030 Author: Felix Gu Date: Tue Apr 28 00:33:04 2026 +0800 spi: axiado: replace usleep_range() with udelay() in IRQ path ax_spi_fill_tx_fifo() can be called from ax_spi_irq() which is a hard irq handler. Replace usleep_range(10, 10) with udelay(10) in atomic context. Fixes: e75a6b00ad79 ("spi: axiado: Add driver for Axiado SPI DB controller") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260428-axiado-v1-1-cd767500af72@gmail.com Signed-off-by: Mark Brown commit 73082fbdb10aba317e8469f51e3411814f2e65b4 Merge: d762a96e3dc2c8 82323b1a7088b7 Author: Linus Torvalds Date: Mon Apr 27 16:35:44 2026 -0700 Merge tag 'for-7.1-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - space reservation fixes: - correctly undo 'may_use' accounting for remap tree - avoid double decrement of 'may_use' when submitting async io - actually enable the shutdown ioctl callback (not just the superblock ops) - raid stripe tree fixes when deleting extents - add missing error handling - fix various incorrect values set - fix transaction state when removing a directory, possibly leading to EIO during log replay - additional b-tree node key checks during metadata readahead - error handling and transaction abort updates * tag 'for-7.1-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() btrfs: check return value of btrfs_partially_delete_raid_extent() btrfs: handle -EAGAIN from btrfs_duplicate_item and refresh stale leaf pointer btrfs: replace ASSERT with proper error handling in stripe lookup fallback btrfs: fix wrong min_objectid in btrfs_previous_item() call btrfs: fix raid stripe search missing entries at leaf boundaries btrfs: copy devid in btrfs_partially_delete_raid_extent() btrfs: handle unexpected free-space-tree key types btrfs: fix missing last_unlink_trans update when removing a directory btrfs: don't clobber errors in add_remap_tree_entries() btrfs: enable shutdown ioctl for non-experimental builds btrfs: apply first key check for readahead when possible btrfs: abort transaction in do_remap_reloc_trans() on failure btrfs: fix bytes_may_use leak in do_remap_reloc_trans() btrfs: fix bytes_may_use leak in move_existing_remap() commit d762a96e3dc2c82b551f0cc3506e89c904880cf9 Merge: a7cc308da5f78e 09a65adc7d8bbf Author: Linus Torvalds Date: Mon Apr 27 16:33:23 2026 -0700 Merge tag 'for-7.1/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fix from Mikulas Patocka: - fix metadata corruption in dm-thin * tag 'for-7.1/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-thin: fix metadata refcount underflow commit 1e5a8eed7821e7a43a31b4c1b3675a91be6bc6f6 Author: David Windsor Date: Sun Apr 26 19:23:49 2026 -0400 selinux: don't reserve xattr slot when we won't fill it Move lsm_get_xattr_slot() below the SBLABEL_MNT check so we don't leave a NULL-named slot in the array when returning -EOPNOTSUPP; filesystem initxattrs() callbacks stop iterating at the first NULL ->name, silently dropping xattrs installed by later LSMs. Cc: stable@vger.kernel.org Signed-off-by: David Windsor Signed-off-by: Paul Moore commit 3618442d54f366eeee8f6c83a47861ca22918dfe Author: Jakub Kicinski Date: Thu Apr 23 15:08:57 2026 -0700 MAINTAINERS: add pcnet_cs to PCMCIA Per discussion under the Link make sure Dominik can help with the patches to drivers/net/ethernet/8390/pcnet_cs.c cc: linux@dominikbrodowski.net Link: https://lore.kernel.org/aeomUh5JqFvkLTH7@scops.dominikbrodowski.net Acked-by: Dominik Brodowski Link: https://patch.msgid.link/20260423220857.3490118-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 032e70aff025d7c519af9ab791cd084380619263 Author: Zongyao Chen Date: Fri Apr 24 15:37:53 2026 +0800 selinux: use sk blob accessor in socket permission helpers SELinux socket state lives in the composite LSM socket blob. sock_has_perm() and nlmsg_sock_has_extended_perms() currently dereference sk->sk_security directly, which assumes the SELinux socket blob is at offset zero. In stacked configurations that assumption does not hold. If another LSM allocates socket blob storage before SELinux, these helpers may read the wrong blob and feed invalid SID and class values into AVC checks. Use selinux_sock() instead of accessing sk->sk_security directly. Fixes: d1d991efaf34 ("selinux: Add netlink xperm support") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Zongyao Chen Signed-off-by: Paul Moore commit cfcbfe5cb11650d53f7cafd7adfd556690b77114 Author: Keith Busch Date: Tue Apr 21 08:06:44 2026 -0700 PCI: Don't fallback to bus reset after failed slot reset If a bus has hotplug slots that implement the slot's reset_slot callback, it is not safe to do the non-slot specific bus reset, so don't fallback to it. If a slot reset does fail, the subsequent bus reset will attempt a 2nd link reset on top of previous and fail to handle the hotplug events. Fixes: 8238cb69c01fe ("PCI: Make reset_subordinate hotplug safe") Signed-off-by: Keith Busch Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260421150644.3543733-1-kbusch@meta.com commit a7cc308da5f78eee8d94bf666c026671a180d7e5 Merge: 254f49634ee16a 6e937f4e769e60 Author: Linus Torvalds Date: Mon Apr 27 15:21:18 2026 -0700 Merge tag 'mailbox-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: - core: fix NULL message handling and add API to query TX queue slots - test: resolve concurrency bugs, dangling IRQs, and memory leaks - dt-bindings: qcom: add Eliza IPCC - mtk: fix address calculation and pointer handling bugs - cix: resolve SCMI suspend timeouts - misc memory allocation optimizations and cleanups * tag 'mailbox-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: mailbox: mailbox-test: make data_ready a per-instance variable mailbox: mailbox-test: initialize struct earlier mailbox: mailbox-test: don't free the reused channel mailbox: mailbox-test: handle channel errors consistently mailbox: update kdoc for struct mbox_controller mailbox: add sanity check for channel array mailbox: mailbox-test: free channels on probe error mailbox: prefix new constants with MBOX_ dt-bindings: mailbox: qcom-ipcc: Document the Eliza Inter-Processor Communication Controller mailbox: cix: Add IRQF_NO_SUSPEND to mailbox interrupt mailbox: Fix NULL message support in mbox_send_message() mailbox: remove superfluous internal header mailbox: correct kdoc title for mbox_bind_client mailbox: test: really ignore optional memory resources mailbox: exynos: drop superfluous mbox setting per channel mailbox: mtk-cmdq: Fix CURR and END addr for task insert case mailbox: mtk-vcp-mailbox: Fix the return value in mtk_vcp_mbox_xlate() mailbox: hi6220: kzalloc + kcalloc to kzalloc mailbox: rockchip: kzalloc + kcalloc to kzalloc mailbox: add API to query available TX queue slots commit 0898a817621a2f0cddca8122d9b974003fe5036d Author: Daan De Meyer Date: Mon Apr 27 22:01:39 2026 +0100 cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() The cdrom core never calls set_disk_ro() for a registered device, so BLKROGET on a CD-ROM device always returns 0 (writable), even when the drive has no write capabilities and writes will inevitably fail. This causes problems for userspace that relies on BLKROGET to determine whether a block device is read-only. For example, systemd's loop device setup uses BLKROGET to decide whether to create a loop device with LO_FLAGS_READ_ONLY. Without the read-only flag, writes pass through the loop device to the CD-ROM and fail with I/O errors. systemd-fsck similarly checks BLKROGET to decide whether to run fsck in no-repair mode (-n). The write-capability bits in cdi->mask come from two different sources: CDC_DVD_RAM and CDC_CD_RW are populated by the driver from the MODE SENSE capabilities page (page 0x2A) before register_cdrom() is called, while CDC_MRW_W and CDC_RAM require the MMC GET CONFIGURATION command and were only probed by cdrom_open_write() at device open time. This meant that any attempt to compute the writable state from the full mask at probe time was incorrect, because the GET CONFIGURATION bits were still unset (and cdi->mask is initialized such that capabilities are assumed present). Fix this by factoring the GET CONFIGURATION probing out of cdrom_open_write() into a new exported helper, cdrom_probe_write_features(), and having sr call it from sr_probe() right after get_capabilities() has populated the MODE SENSE bits. register_cdrom() then calls set_disk_ro() based on the full write-capability mask (CDC_DVD_RAM | CDC_MRW_W | CDC_RAM | CDC_CD_RW) so the block layer reflects the drive's actual write support. The feature queries used (CDF_MRW and CDF_RWRT via GET CONFIGURATION with RT=00) report drive-level capabilities that are persistent across media, so a single probe before register_cdrom() is sufficient and the redundant probe at open time is dropped. With set_disk_ro() now accurate, the long-vestigial cd->writeable flag in sr can go: get_capabilities() used to set cd->writeable based on the same four mask bits, but because CDC_MRW_W and CDC_RAM default to "capability present" in cdi->mask and aren't touched by MODE SENSE, the condition that gated cd->writeable was always true, making it unconditionally 1. Replace the corresponding gate in sr_init_command() with get_disk_ro(cd->disk), which turns a previously no-op check into a real one and also catches kernel-internal bio writers that bypass blkdev_write_iter()'s bdev_read_only() check. The sd driver (SCSI disks) does not have this problem because it checks the MODE SENSE Write Protect bit and calls set_disk_ro() accordingly. The sr driver cannot use the same approach because the MMC specification does not define the WP bit in the MODE SENSE device-specific parameter byte for CD-ROM devices. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Daan De Meyer Reviewed-by: Phillip Potter Reviewed-by: Martin K. Petersen Signed-off-by: Phillip Potter Link: https://patch.msgid.link/20260427210139.1400-2-phil@philpotter.co.uk Signed-off-by: Jens Axboe commit aa03cfe9dbf487f065d0b38b95edc25c386e3d40 Merge: 254f49634ee16a bd7b7ce96db448 Author: Jens Axboe Date: Mon Apr 27 15:47:21 2026 -0600 Merge tag 'nvme-7.1-2026-04-24' of git://git.infradead.org/nvme into block-7.1 Pull NVMe fixes from Keith: "- Target data transfer size confiruation (Aurelien) - Enable P2P for RDMA (Shivaji Kant) - TCP target updates (Maurizio, Alistair, Chaitanya, Shivam Kumar) - TCP host updates (Alistair, Chaitanya) - Authentication updates (Alistair, Daniel, Chris Leech) - Multipath fixes (John Garry) - New quirks (Alan Cui, Tao Jiang) - Apple driver fix (Fedor Pchelkin) - PCI admin doorbell update fix (Keith)" * tag 'nvme-7.1-2026-04-24' of git://git.infradead.org/nvme: (22 commits) nvme-auth: Hash DH shared secret to create session key nvme-pci: fix missed admin queue sq doorbell write nvme-auth: Include SC_C in RVAL controller hash nvme-tcp: teardown circular locking fixes nvmet-tcp: Don't clear tls_key when freeing sq Revert "nvmet-tcp: Don't free SQ on authentication success" nvme: skip trace completion for host path errors nvme-pci: add quirk for Memblaze Pblaze5 (0x1c5f:0x0555) nvme-multipath: put module reference when delayed removal work is canceled nvme: expose TLS mode nvme-apple: drop invalid put of admin queue reference count nvme-core: fix parameter name in comment nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvme-multipath: drop head pointer check in nvme_mpath_clear_current_path() nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808 (Samsung PM981/983/970 EVO Plus ) nvmet-tcp: fix race between ICReq handling and queue teardown nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers nvme: enable PCI P2PDMA support for RDMA transport nvmet: introduce new mdts configuration entry ... commit ea216d3ae7305ad2c8256524e65b7219492d8685 Author: Bartosz Golaszewski Date: Mon Apr 27 13:22:38 2026 +0200 ACPI: bus: add missing forward declaration to acpi_bus.h The header references struct notifier_block but neither includes linux/notifier.h nor contains the relevant forward declaration. Add the latter for correctness. Signed-off-by: Bartosz Golaszewski [ rjw: Subject tweak ] Link: https://patch.msgid.link/20260427112238.132419-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Rafael J. Wysocki commit 4b506ea5351a1f5937ac632a4a5c35f6f796cc41 Author: Shivam Kalra Date: Sun Apr 26 19:38:41 2026 +0530 ACPI: video: force native backlight on HP OMEN 16 (8A44) The HP OMEN 16 Gaming Laptop (board name 8A44) has a mux-less hybrid GPU configuration with AMD Rembrandt (Radeon 680M) and NVIDIA GA104 (RTX 3070 Ti). The internal eDP panel is wired to the AMD iGPU. When Nouveau loads without GSP firmware, the ACPI video backlight device (acpi_video0) gets registered alongside the native AMD backlight (amdgpu_bl2). In this state, writes to amdgpu_bl2 update the software brightness value but fail to change the physical panel brightness. Force native backlight to prevent acpi_video0 from registering. Confirmed that booting with acpi_backlight=native resolves the issue. Cc: All applicable Signed-off-by: Shivam Kalra Link: https://patch.msgid.link/20260426-omen-16-backlight-fix-v1-1-62364f268ea6@zohomail.in Signed-off-by: Rafael J. Wysocki commit ad034486ada5860081565e2d7a2e41aa91c302c2 Author: Rafael J. Wysocki Date: Wed Apr 22 17:27:32 2026 +0200 ACPI: TAD: Fix up a comment in acpi_tad_probe() Fix grammar in the comment preceding the pm_runtime_set_active() call in acpi_tad_probe(). Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/8678306.T7Z3S40VBb@rafael.j.wysocki commit e0d219010477fb19d23b60970b2c03fe5985717c Author: Rafael J. Wysocki Date: Wed Apr 22 17:26:49 2026 +0200 ACPI: TAD: RTC: Refine timer value computations and checks Since rtc_tm_to_ktime() may overflow for large RTC time values and full second granularity is sufficient in timer value computations in acpi_tad_rtc_set_alarm() and acpi_tad_rtc_read_alarm(), use rtc_tm_to_time64() instead of that function, which also allows the computations to be simplified. Moreover, U32_MAX is a special "timer disabled" value, so make acpi_tad_rtc_set_alarm() reject it when attempting to program the alarm timers. Fixes: 7572dcabe38d ("ACPI: TAD: Add alarm support to the RTC class device interface") Signed-off-by: Rafael J. Wysocki Reviewed-by: Alexandre Belloni Link: https://patch.msgid.link/3414608.aeNJFYEL58@rafael.j.wysocki commit 77dd14ab1b575328745644136ba758d394e10fbc Author: Rafael J. Wysocki Date: Wed Apr 22 17:25:46 2026 +0200 ACPI: TAD: Use devres for all driver cleanup The code in acpi_tad_remove() needs to run after the unregistration of the devres-managed RTC class device so that it doesn't race with the class callbacks of the latter. To make that happen, pass it to devm_add_action_or_reset() before registering the RTC class device. Fixes: 7572dcabe38d ("ACPI: TAD: Add alarm support to the RTC class device interface") Fixes: 8a1e7f4b1764 ("ACPI: TAD: Add RTC class device interface") Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/14001754.uLZWGnKmhe@rafael.j.wysocki commit 88b2670ea6505c6cfd1478ba34b041c60c4281dc Author: Rafael J. Wysocki Date: Wed Apr 22 17:24:08 2026 +0200 ACPI: TAD: Use __ATTRIBUTE_GROUPS() macro Recent commit 93afe8ba9b01 ("ACPI: TAD: Use dev_groups in struct device_driver") switched over the ACPI TAD driver to using device attribute groups instead of creating and removing the device sysfs attributes directly, but it might go one step farther and use the __ATTRIBUTE_GROUPS() macro which would reduce the code size slightly. Do it now. Signed-off-by: Rafael J. Wysocki [ rjw: Fixed typo in the changelog ] Link: https://patch.msgid.link/1961102.tdWV9SEqCh@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit 75141a770f4f8225d316f6c7e146723a32e9720e Author: Jinjie Ruan Date: Fri Apr 17 12:01:12 2026 +0800 ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug When concurrently bringing up and down two SMT threads of a physical core, many warning call traces occur as below: The issue timeline is as follows: 1. When the system starts, cpufreq: CPU: 220, policy->related_cpus: 220-221, policy->cpus: 220-221 2. Offline CPU 220 and CPU 221. 3. Online CPU 220 - CPU 221 is now offline, as acpi_get_psd_map() use for_each_online_cpu(), so the cpu_data->shared_cpu_map, policy->cpus, and related_cpus has only CPU 220. cpufreq: CPU: 220, policy->related_cpus: 220, policy->cpus: 220 4. Offline CPU 220 5. Online CPU 221, the below call trace occurs: - Since CPU 220 and CPU 221 share one policy, and policy->related_cpus = 220 after step 3, so CPU 221 is not in policy->related_cpus but per_cpu(cpufreq_cpu_data, cpu221) is not NULL. After reverting commit 56eb0c0ed345 ("ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs"), the issue disappeared. The _PSD (P-State Dependency) defines the hardware-level dependency of frequency control across CPU cores. Since this relationship is a physical attribute of the hardware topology, it remains constant regardless of the online or offline status of the CPUs. Using for_each_online_cpu() in acpi_get_psd_map() is problematic. If a CPU is offline, it will be excluded from the shared_cpu_map. Consequently, if that CPU is brought online later, the kernel will fail to recognize it as part of any shared frequency domain. Switch back to for_each_possible_cpu() to ensure that all cores defined in the ACPI tables are correctly mapped into their respective performance domains from the start. This aligns with the logic of policy->related_cpus, which must encompass all potentially available cores in the domain to prevent logic gaps during CPU hotplug operations. To resolve the original issue regarding the "nosmt" or "nosmt=force" boot parameter, as send_pcc_cmd() function already does if (!desc) continue, so reverting that loop back to for_each_possible_cpu() is ok, only need to change the match_cpc_ptr NULL case in acpi_get_psd_map() to continue as Sean suggested. How to reproduce, on arm64 machine with SMT support which use acpi cppc cpufreq driver: bash test.sh 220 & bash test.sh 221 & The test.sh is as below: while true do echo 0 > /sys/devices/system/cpu/cpu${1}/online sleep 0.5 cat /sys/devices/system/cpu/cpu${1}/cpufreq/related_cpus echo 1 > /sys/devices/system/cpu/cpu${1}/online cat /sys/devices/system/cpu/cpu${1}/cpufreq/related_cpus done CPU: 221 PID: 1119 Comm: cpuhp/221 Kdump: loaded Not tainted 6.6.0debug+ #5 Hardware name: To be filled by O.E.M. S920X20/BC83AMDA01-7270Z, BIOS 20.39 09/04/2024 pstate: a1400009 (NzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : cpufreq_online+0x8ac/0xa90 lr : cpuhp_cpufreq_online+0x18/0x30 sp : ffff80008739bce0 x29: ffff80008739bce0 x28: 0000000000000000 x27: ffff28400ca32200 x26: 0000000000000000 x25: 0000000000000003 x24: ffffd483503ff000 x23: ffffd483504051a0 x22: ffffd48350024a00 x21: 00000000000000dd x20: 000000000000001d x19: ffff28400ca32000 x18: 0000000000000000 x17: 0000000000000020 x16: ffffd4834e6a3fc8 x15: 0000000000000020 x14: 0000000000000008 x13: 0000000000000001 x12: 00000000ffffffff x11: 0000000000000040 x10: ffffd48350430728 x9 : ffffd4834f087c78 x8 : 0000000000000001 x7 : ffff2840092bdf00 x6 : ffffd483504264f0 x5 : ffffd48350405000 x4 : ffff283f7f95cc60 x3 : 0000000000000000 x2 : ffff53bc2f94b000 x1 : 00000000000000dd x0 : 0000000000000000 Call trace: cpufreq_online+0x8ac/0xa90 cpuhp_cpufreq_online+0x18/0x30 cpuhp_invoke_callback+0x128/0x580 cpuhp_thread_fun+0x110/0x1b0 smpboot_thread_fn+0x140/0x190 kthread+0xec/0x100 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- Cc: All applicable Fixes: 56eb0c0ed345 ("ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs") Co-developed-by: Sean Kelley Signed-off-by: Sean Kelley Signed-off-by: Jinjie Ruan [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260417040112.3727756-1-ruanjinjie@huawei.com Signed-off-by: Rafael J. Wysocki commit 0c00cfbcfcffa7085e4f0c7fd7a4caada4e7a90f Author: Tony Luck Date: Tue Apr 21 08:02:16 2026 -0700 ACPI: APEI: EINJ: Fix EINJV2 memory error injection Error types in EINJV2 use different bit positions for each flavor of injection from legacy EINJ. Two issues: 1) The address sanity checks in einj_error_inject() were skipped for EINJV2 injections. Noted by sashiko[1] 2) __einj_error_trigger() failed to drop the entry of the target physical address from the list of resources that need to be requested. Add a helper function that checks if an injection is to memory and use it to solve each of these issues. Note that the old test in __einj_error_trigger() checked that param2 was not zero. This isn't needed because the sanity checks in einj_error_inject() reject memory injections with param2 == 0. Fixes: b47610296d17 ("ACPI: APEI: EINJ: Enable EINJv2 error injections") Reported-by: sashiko Reported-by: Herman Li Signed-off-by: Tony Luck Tested-by: "Lai, Yi1" Link: https://sashiko.dev/#/patchset/20260415163620.12957-1-tony.luck%40intel.com # [1] Reviewed-by: Jiaqi Yan Reviewed-by: Zaid Alali Link: https://patch.msgid.link/20260421150216.11666-3-tony.luck@intel.com Signed-off-by: Rafael J. Wysocki commit 1f6008538384453eb4c13a3d7ff9e37ee8aee6b9 Author: Tony Luck Date: Tue Apr 21 08:02:15 2026 -0700 ACPICA: Provide #defines for EINJV2 error types EINJV2 defined new error types by moving the severity (correctable, uncorrectable non-fatal, uncorrectable fatal) out of the "type". ACPI 6.5 introduced EINJV2 and defined a vendor defined error type using bit 31. This was dropped in ACPI 6.6. Link: https://github.com/acpica/acpica/commit/e82d2d2fd145 Signed-off-by: Tony Luck Link: https://patch.msgid.link/20260421150216.11666-2-tony.luck@intel.com Signed-off-by: Rafael J. Wysocki commit 0df8aa2b9aec5cd21e8c71d9cc1227e57bea43b3 Author: Conor Dooley Date: Mon Apr 20 12:14:31 2026 +0100 riscv: dts: microchip: fix icicle i2c pinctrl configuration Unfortunately, an erratum with engineering sample that I was not aware of was exposed by adding pinctrl configuration to the icicle kit. When routed to MSS IOs, i2c signals are never anything other than tied low. Being an FPGA, a Libero workaround for this problem was created, that involves routing i2c signals to the FPGA fabric when the MSS IO option is selected in the configurator and then back to the intended pin using the debug "fabric test" capability. This is invisible to user facing information in the tooling and not mentioned in reference designs documentation. It manifests solely in the .xml output from the MSS configuration that the HSS firmware uses to configure the device, which Linux now overwrites using the pinctrl information. As a result, I never noticed this. My original submission had the engineering sample configuration, but I modified it on application after I was told it didn't work, not realising that the report came from a colleague with a production device, where the erratum was fixed and the workaround not automatically implemented by Libero when creating a design. Move this part of the pinctrl configuration out of the shared portion of the icicle device trees, into the portions that are specific to engineering sample and production devices so that the different settings for i2c pins can be dealt with. Although the reference design only has this workaround in place for i2c1, as i2c0 is genuinely fabric routed, move it too since the erratum affects both controllers. Link: https://ww1.microchip.com/downloads/aemDocuments/documents/FPGA/ProductDocuments/Errata/polarfiresoc/microsemi_polarfire_soc_fpga_egineering_samples_errata_er0219_v1.pdf [3.3] Fixes: 123f4276b521a ("riscv: dts: microchip: add pinctrl nodes for mpfs/icicle kit") Signed-off-by: Conor Dooley commit 3e256d4c40742e98132c0ef830b8cad4d50502d0 Author: Jai Luthra Date: Mon Apr 20 18:48:07 2026 +0530 riscv: dts: starfive: jh7110: Drop CAMSS node The starfive-camss driver and bindings were dropped, as they were no longer being worked upon for destaging. Drop the relevant node as well to avoid the following build warning: "failed to match any schema with compatible: ['starfive,jh7110-camss']" Reported-by: Conor Dooley Closes: https://lore.kernel.org/all/20260420-very-cartel-645595ffd1c7@spud/ Signed-off-by: Jai Luthra Reviewed-by: Changhuang Liang Reviewed-by: Laurent Pinchart Signed-off-by: Conor Dooley commit 981cd338614c96070cf9854679014fd027c1fb1d Author: Petr Vaněk Date: Sat Apr 25 10:03:54 2026 +0200 docs: cgroup: fix typo 'protetion' -> 'protection' Fix a small typo in the description of the memory_hugetlb_accounting mount option. Signed-off-by: Petr Vaněk Signed-off-by: Tejun Heo commit 465b05bae5ac553c13315681c1490dc565337771 Author: Thomas Weißschuh Date: Wed Apr 22 14:32:33 2026 +0200 selftests: harness: Restore order of test functions The recent addition of explicit constructor orders for fixture tests broke the ordering of those relative to non-fixture tests and the reverse-constructor-order detection. Restore the ordering of the test functions relative to each other by using the same explicit test order for all test registrations and __constructor_order_first(). Rename the constant, as it is not specific to TEST_F() anymore. Link: https://lore.kernel.org/r/20260422-kselftests-harness-order-v2-1-93ea980ea3ac@linutronix.de Fixes: 6be268151426 ("selftests/harness: order TEST_F and XFAIL_ADD constructors") Signed-off-by: Thomas Weißschuh Reviewed-by: Kees Cook Signed-off-by: Shuah Khan commit 74f192205c48333de054620a79d7ce9f4515fb0b Author: Sarthak Sharma Date: Mon Apr 27 16:54:47 2026 +0530 selftests: kselftest: fix wrong test number in ksft_exit_skip ksft_exit_skip() increments ksft_xskip before printing the KTAP result. As a result, ksft_test_num() already includes the skipped test. Adding 1 to ksft_test_num() increments the printed test number again, producing an incorrect test number and wrong KTAP output. Drop the extra increment and print ksft_test_num() directly. Link: https://lore.kernel.org/r/20260427112447.147985-1-sarthak.sharma@arm.com Fixes: b85d387c9b09 ("kselftest: fix TAP output for skipped tests") Signed-off-by: Sarthak Sharma Signed-off-by: Shuah Khan commit b38e53cbfb9d84732e5984fbd73e128d592415c5 Author: Greg Kroah-Hartman Date: Mon Apr 20 18:11:04 2026 +0200 usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Just like in a previous problem in this driver, usblp_ctrl_msg() will collapse the usb_control_msg() return value to 0/-errno, discarding the actual number of bytes transferred. Ideally that short command should be detected and error out, but many printers are known to send "incorrect" responses back so we can't just do that. statusbuf is kmalloc(8) at probe time and never filled before the first LPGETSTATUS ioctl. usblp_read_status() requests 1 byte. If a malicious printer responds with zero bytes, *statusbuf is one byte of stale kmalloc heap, sign-extended into the local int status, which the LPGETSTATUS path then copy_to_user()s directly to the ioctl caller. Fix this all by just zapping out the memory buffer when allocated at probe time. If a later call does a short read, the data will be identical to what the device sent it the last time, so there is no "leak" of information happening. Cc: Pete Zaitcev Assisted-by: gkh_clanker_t1000 Cc: stable Link: https://patch.msgid.link/2026042011-shredder-savage-48c6@gregkh Signed-off-by: Greg Kroah-Hartman commit 7a400c6fe3617e31e690e3f7ca37bb335e0498f3 Author: Greg Kroah-Hartman Date: Mon Apr 20 18:11:03 2026 +0200 usb: usblp: fix heap leak in IEEE 1284 device ID via short response usblp_ctrl_msg() collapses the usb_control_msg() return value to 0/-errno, discarding the actual number of bytes transferred. A broken printer can complete the GET_DEVICE_ID control transfer short and the driver has no way to know. usblp_cache_device_id_string() reads the 2-byte big-endian length prefix from the response and trusts it (clamped only to the buffer bounds). The buffer is kmalloc(1024) at probe time. A device that sends exactly two bytes (e.g. 0x03 0xFF, claiming a 1023-byte ID) leaves device_id_string[2..1022] holding stale kmalloc heap. That stale data is then exposed: - via the ieee1284_id sysfs attribute (sprintf("%s", buf+2), truncated at the first NUL in the stale heap), and - via the IOCNR_GET_DEVICE_ID ioctl, which copy_to_user()s the full claimed length regardless of NULs, up to 1021 bytes of uninitialized heap, with the leak size chosen by the device. Fix this up by just zapping the buffer with zeros before each request sent to the device. Cc: Pete Zaitcev Assisted-by: gkh_clanker_t1000 Cc: stable Link: https://patch.msgid.link/2026042002-unicorn-greedily-3c63@gregkh Signed-off-by: Greg Kroah-Hartman commit aad35f9c926ec220b0742af1ada45666ae667956 Author: Selvarasu Ganesan Date: Fri Apr 17 12:03:11 2026 +0530 usb: dwc3: Move GUID programming after PHY initialization The Linux Version Code is currently written to the GUID register before PHY initialization. Certain PHY implementations (such as Synopsys eUSB PHY performing link_sw_reset) clear the GUID register to its default value during initialization, causing the kernel version information to be lost. Move the GUID register programming to occur after PHY initialization completes to ensure the Linux version information persists. Fixes: fa0ea13e9f1c ("usb: dwc3: core: write LINUX_VERSION_CODE to our GUID register") Cc: stable Reported-by: Pritam Manohar Sutar Signed-off-by: Selvarasu Ganesan Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260417063314.2359-1-selvarasu.g@samsung.com Signed-off-by: Greg Kroah-Hartman commit f6ec9bb4acc7182b25a793ad094a764e1cb819a7 Author: Xu Yang Date: Fri Apr 24 15:40:09 2026 +0800 usb: typec: tcpm: fix debug accessory mode detection for sink ports The port in debug accessory mode can be either a source or sink. The previous tcpm_port_is_debug() function only checked for source port. Commit 8db73e6a42b6 ("usb: typec: tcpm: allow sink (ufp) to toggle into accessory mode debug") changed the detection logic to support both roles, but left some logic in _tcpm_cc_change() unchanged, This causes the state machine to transition to an incorrect state when operating as a sink in debug accessory mode. Log as below: [ 978.637541] CC1: 0 -> 5, CC2: 0 -> 5 [state TOGGLING, polarity 0, connected] [ 978.637567] state change TOGGLING -> SRC_ATTACH_WAIT [rev1 NONE_AMS] [ 978.637596] pending state change SRC_ATTACH_WAIT -> DEBUG_ACC_ATTACHED @ 180 ms [rev1 NONE_AMS] [ 978.647098] CC1: 5 -> 0, CC2: 5 -> 5 [state SRC_ATTACH_WAIT, polarity 0, connected] [ 978.647115] state change SRC_ATTACH_WAIT -> SRC_ATTACH_WAIT [rev1 NONE_AMS] It should go to SNK_ATTACH_WAIT instead of SRC_ATTACH_WAIT state. To fix this, add tcpm_port_is_debug_source() and tcpm_port_is_debug_sink() helper to explicitly identify the power mode in debug accessory mode. Update the state transition logic in _tcpm_cc_change() to ensure the state machine transitions comply with Type-C specification. Also update the logic in run_state_machine() to keep consistency. Fixes: 8db73e6a42b6 ("usb: typec: tcpm: allow sink (ufp) to toggle into accessory mode debug") Cc: stable Signed-off-by: Xu Yang Acked-by: Heikki Krogerus Reviewed-by: Amit Sunil Dhamne Link: https://patch.msgid.link/20260424074009.2979266-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 2909f0d4994fb4306bf116df5ccee797791fce2c Author: Amit Sunil Dhamne Date: Tue Apr 14 00:58:32 2026 +0000 usb: typec: tcpm: reset internal port states on soft reset AMS Reset internal port states (such as vdm_sm_running and explicit_contract) on soft reset AMS as the port needs to negotiate a new contract. The consequence of leaving the states in as-is cond are as follows: * port is in SRC power role and an explicit contract is negotiated with the port partner (in sink role) * port partner sends a Soft Reset AMS while VDM State Machine is running * port accepts the Soft Reset request and the port advertises src caps * port partner sends a Request message but since the explicit_contract and vdm_sm_running are true from previous negotiation, the port ends up sending Soft Reset instead of Accept msg. Stub Log: [ 203.653942] AMS DISCOVER_IDENTITY start [ 203.653947] PD TX, header: 0x176f [ 203.655901] PD TX complete, status: 0 [ 203.657470] PD RX, header: 0x124f [1] [ 203.657477] Rx VDM cmd 0xff008081 type 2 cmd 1 len 1 [ 203.657482] AMS DISCOVER_IDENTITY finished [ 203.657484] cc:=4 [ 204.155698] PD RX, header: 0x144f [1] [ 204.155718] Rx VDM cmd 0xeeee8001 type 0 cmd 1 len 1 [ 204.155741] PD TX, header: 0x196f [ 204.157622] PD TX complete, status: 0 [ 204.160060] PD RX, header: 0x4d [1] [ 204.160066] state change SRC_READY -> SOFT_RESET [rev2 SOFT_RESET_AMS] [ 204.160076] PD TX, header: 0x163 [ 204.162486] PD TX complete, status: 0 [ 204.162832] AMS SOFT_RESET_AMS finished [ 204.162840] cc:=4 [ 204.162891] AMS POWER_NEGOTIATION start [ 204.162896] state change SOFT_RESET -> AMS_START [rev2 POWER_NEGOTIATION] [ 204.162908] state change AMS_START -> SRC_SEND_CAPABILITIES [rev2 POWER_NEGOTIATION] [ 204.162913] PD TX, header: 0x1361 [ 204.165529] PD TX complete, status: 0 [ 204.165571] pending state change SRC_SEND_CAPABILITIES -> SRC_SEND_CAPABILITIES_TIMEOUT @ 60 ms [rev2 POWER_NEGOTIATION] [ 204.166996] PD RX, header: 0x1242 [1] [ 204.167009] state change SRC_SEND_CAPABILITIES -> SRC_SOFT_RESET_WAIT_SNK_TX [rev2 POWER_NEGOTIATION] [ 204.167019] AMS POWER_NEGOTIATION finished [ 204.167020] cc:=4 [ 204.167083] AMS SOFT_RESET_AMS start [ 204.167086] state change SRC_SOFT_RESET_WAIT_SNK_TX -> SOFT_RESET_SEND [rev2 SOFT_RESET_AMS] [ 204.167092] PD TX, header: 0x16d [ 204.168824] PD TX complete, status: 0 [ 204.168854] pending state change SOFT_RESET_SEND -> HARD_RESET_SEND @ 60 ms [rev2 SOFT_RESET_AMS] [ 204.171876] PD RX, header: 0x43 [1] [ 204.171879] AMS SOFT_RESET_AMS finished This causes COMMON.PROC.PD.11.2 check failure for TEST.PD.VDM.SRC.2_Rev2Src test on the PD compliance tester. Signed-off-by: Amit Sunil Dhamne Fixes: 8d3a0578ad1a ("usb: typec: tcpm: Respond Wait if VDM state machine is running") Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)") Cc: stable Reviewed-by: Badhri Jagan Sridharan Acked-by: Heikki Krogerus Link: https://patch.msgid.link/20260414-fix-soft-reset-v1-1-01d7cb9764e2@google.com Signed-off-by: Greg Kroah-Hartman commit 0b9fcab1b8608d429e5f239afb197de928d4de7d Author: Felix Gu Date: Tue Apr 7 21:21:22 2026 +0800 usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01af542392b5 ("usb: ulpi: fix double free in ulpi_register_interface() error path") removed kfree(ulpi) from ulpi_register_interface() to fix a double-free when device_register() fails. But when ulpi_of_register() or ulpi_read_id() fail before device_register() is called, the ulpi allocation is leaked. Add kfree(ulpi) on both error paths to properly clean up the allocation. Fixes: 01af542392b5 ("usb: ulpi: fix double free in ulpi_register_interface() error path") Cc: stable Signed-off-by: Felix Gu Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260407-ulpi-v1-1-f3fafe53f7b2@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3f91484f6c13c434bd573ca6b6779c26adb0ddab Author: Aaro Koskinen Date: Mon Apr 13 21:49:12 2026 +0300 USB: omap_udc: DMA: Don't enable burst 4 mode Commit 65111084c63d7 ("USB: more omap_udc updates (dma and omap1710)") added setting for DMA burst 4 mode. But I think this should be undone for two reasons: - It breaks DMA on 15xx boards - transfers just silently stall. - On newer OMAP1 boards, like Nokia 770 (omap1710), there is no measurable performance impact when testing TCP throughput with g_ether with large 15000 byte MTU size. It's also worth noting that when the original change was made, the OMAP_DMA_DATA_BURST_4 handling in arch/arm/plat-omap/dma.c was broken, and actually resulted in the same as the OMAP_DMA_DATA_BURST_DIS i.e. burst disabled. This was fixed not until a couple kernel releases later in an unrelated commit 1a8bfa1eb998a ("[ARM] 3142/1: OMAP 2/5: Update files common to omap1 and omap2"). So based on this it seems there was never really a very good reason to enable this burst mode in omap_udc, so remove it now to allow 15xx DMA to work again (it provides 2x throughput compared to PIO mode). Fixes: 65111084c63d ("[PATCH] USB: more omap_udc updates (dma and omap1710)") Cc: stable Signed-off-by: Aaro Koskinen Link: https://patch.msgid.link/ad06qHLclWHeSGnV@darkstar.musicnaut.iki.fi Signed-off-by: Greg Kroah-Hartman commit 785bc568161d96fdbd4326294d427a48e66fe60f Author: Namjae Jeon Date: Mon Apr 27 22:58:52 2026 +0900 ntfs: fix error handling in ntfs_write_iomap_end_resident() When ntfs_attr_get_search_ctx() fails and returns NULL, the function returned early without calling put_page(ipage). Fix this by jumping to err_out label on error. The err_out path now properly releases the page and the mutex, with a NULL check for the search context. Reported-by: DaeMyung Kang Signed-off-by: Namjae Jeon commit cad7c6f0a5147680dd2081256cf8da54fb445d94 Author: Zhan Xusheng Date: Thu Apr 23 12:52:26 2026 +0800 ntfs: fix VCN overflow in ntfs_mapping_pairs_decompress() In ntfs_mapping_pairs_decompress(), lowest_vcn is read from on-disk metadata and used as the initial vcn without validation. A malformed value can introduce an invalid (e.g. negative) vcn, corrupting the runlist from the start. Additionally, the accumulation vcn += deltaxcn does not check for s64 overflow. A crafted mapping pairs array can wrap vcn to a negative value, breaking the monotonically- increasing invariant relied upon by ntfs_rl_vcn_to_lcn() and related helpers. Fix this by validating lowest_vcn and using check_add_overflow() for vcn accumulation. Signed-off-by: Zhan Xusheng Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 2dd8c1662e38f7bb68a102f1acad9b518c09aeab Author: DaeMyung Kang Date: Sun Apr 26 13:02:32 2026 +0900 ntfs: fix WSL symlink target leak on reparse failure ntfs_reparse_set_wsl_symlink() converts the symlink target into an allocated NLS string and transfers ownership to ni->target only after ntfs_set_ntfs_reparse_data() succeeds. If setting the reparse data fails, the converted target is left unreferenced and leaks. Free the converted target on the reparse update failure path. Use kfree() for the other local failure path as well, matching the ntfs_ucstonls() allocation contract. Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit b5198fcdc195fa531adff7bbfbe40dd27c8d0e89 Author: DaeMyung Kang Date: Sun Apr 26 13:02:31 2026 +0900 ntfs: fix NULL dereference in ntfs_index_walk_down() ntfs_index_walk_down() allocates ictx->ib when descending from the root into an index allocation block. If that allocation fails, the old code still passes the NULL buffer to ntfs_ib_read(), which can write through it via ntfs_inode_attr_pread(). Allocate the index block into a temporary pointer and return -ENOMEM before changing the index context on allocation failure. Also propagate ERR_PTR() through ntfs_index_next() and ntfs_readdir() so walk-down allocation or index block read failures are not mistaken for normal index iteration inside the filesystem. ntfs_readdir() keeps the existing userspace-visible behavior of suppressing readdir errors after marking end_in_iterate; this change only prevents the walk-down failure path from dereferencing NULL internally. The failure was reproduced with failslab fail-nth injection on getdents64; the original module hits a NULL pointer dereference in memcpy_orig through ntfs_ib_read(), while the patched module reaches the same ntfs_index_walk_down() allocation failure without crashing. Fixes: 0a8ac0c1fa0b ("ntfs: update directory operations") Signed-off-by: DaeMyung Kang Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 5dfd429591f8d7185bf63a08b5c30863fb605611 Author: Brajesh Gupta Date: Mon Apr 27 11:01:37 2026 +0530 drm/imagination: Fix segfault when updating ftrace mask Fix invalid data access by passing right data for debugfs entry. [ 171.549793] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 171.559248] Mem abort info: [ 171.562173] ESR = 0x0000000096000044 [ 171.566227] EC = 0x25: DABT (current EL), IL = 32 bits [ 171.573108] SET = 0, FnV = 0 [ 171.576448] EA = 0, S1PTW = 0 [ 171.579745] FSC = 0x04: level 0 translation fault [ 171.584760] Data abort info: [ 171.588012] ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000 [ 171.593734] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 171.598962] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 171.604471] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000083837000 [ 171.611358] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 171.618500] Internal error: Oops: 0000000096000044 [#1] SMP [ 171.624222] Modules linked in: powervr drm_shmem_helper drm_gpuvm... [ 171.656580] CPU: 0 UID: 0 PID: 549 Comm: bash Not tainted 7.0.0-rc2-g730b257ba723-dirty #13 PREEMPT [ 171.665773] Hardware name: BeagleBoard.org BeaglePlay (DT) [ 171.671296] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 171.678306] pc : pvr_fw_trace_mask_set+0x78/0x154 [powervr] [ 171.683959] lr : pvr_fw_trace_mask_set+0x4c/0x154 [powervr] [ 171.689593] sp : ffff8000835ebb90 [ 171.692929] x29: ffff8000835ebc00 x28: ffff000005c60f80 x27: 0000000000000000 [ 171.700130] x26: 0000000000000000 x25: ffff00000504af28 x24: 0000000000000000 [ 171.707324] x23: ffff00000504af50 x22: 0000000000000203 x21: 0000000000000000 [ 171.714518] x20: ffff000005c44a80 x19: ffff000005c457b8 x18: 0000000000000000 [ 171.721715] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaae8887580 [ 171.728908] x14: 0000000000000000 x13: 0000000000000000 x12: ffff8000835ebc30 [ 171.736095] x11: ffff00000504af2a x10: ffff00008504af29 x9 : 0fffffffffffffff [ 171.743286] x8 : ffff8000835ebbf8 x7 : 0000000000000000 x6 : 000000000000002a [ 171.750479] x5 : ffff00000504af2e x4 : 0000000000000000 x3 : 0000000000000010 [ 171.757674] x2 : 0000000000000203 x1 : 0000000000000000 x0 : ffff8000835ebba0 [ 171.764871] Call trace: [ 171.767342] pvr_fw_trace_mask_set+0x78/0x154 [powervr] (P) [ 171.772984] simple_attr_write_xsigned.isra.0+0xe0/0x19c [ 171.778341] simple_attr_write+0x18/0x24 [ 171.782296] debugfs_attr_write+0x50/0x98 [ 171.786341] full_proxy_write+0x6c/0xa8 [ 171.790208] vfs_write+0xd4/0x350 [ 171.793561] ksys_write+0x70/0x108 [ 171.796995] __arm64_sys_write+0x1c/0x28 [ 171.800952] invoke_syscall+0x48/0x10c [ 171.804740] el0_svc_common.constprop.0+0x40/0xe0 [ 171.809487] do_el0_svc+0x1c/0x28 [ 171.812834] el0_svc+0x34/0x108 [ 171.816013] el0t_64_sync_handler+0xa0/0xe4 [ 171.820237] el0t_64_sync+0x198/0x19c [ 171.823939] Code: 32000262 b90ac293 1a931056 9134e293 (b9000036) [ 171.830073] ---[ end trace 0000000000000000 ]--- Fixes: a331631496a0 ("drm/imagination: Simplify module parameters") Signed-off-by: Brajesh Gupta Reviewed-by: Alessio Belle Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260427-ftrace_fix-v3-1-e081530759a8@imgtec.com Signed-off-by: Matt Coster commit 135ac3b84bcedae1860e7a9512d63166f42b736e Author: Miquel Raynal Date: Fri Apr 10 19:41:05 2026 +0200 mtd: spinand: winbond: Fix ODTR write VCR on W35NxxJW In most scenarios this variant is actually unused (VCR is written in SSDR mode), but we need to provide an octal variant. The address is 24 bits but is sent over 4 bytes MSB first. This means we need to shift the register address by one extra byte for the address to be correct. I didn't catch this initially because the volatile register region is 256 bytes wide, so the write-then-read procedure did work with the small register addresses I was using at that time: 0 and 1. Fixes: 44a2f49b9bdc ("mtd: spinand: winbond: W35N octal DTR support") Signed-off-by: Miquel Raynal commit 8d655748aba1b603c54053a20322401dc1e5d782 Author: Miquel Raynal Date: Fri Apr 10 19:41:04 2026 +0200 mtd: spinand: winbond: Set the packed page read flag to W35N02/04JW Both W35N02JW and W35N04JW diverge from W35N01JW when it comes to the "data read" operation in ODTR mode. In order to stuff more address bits (up to 18), the second command byte is replaced by the most significant address bits, keeping the number of address bytes to 2. Fixes: 44a2f49b9bdc ("mtd: spinand: winbond: W35N octal DTR support") Signed-off-by: Miquel Raynal commit 5e25407b68f460142539536e31fa20338db6146f Author: Miquel Raynal Date: Fri Apr 10 19:41:03 2026 +0200 mtd: spinand: Add support for packed read data ODTR commands Some devices stuff address bits in the double byte opcode (in place of the repeated byte) in order to be able to increase the size of the devices, without adding extra address bytes. Create a flag to identify those devices. When the flag is set, use the "packed" variant for the read data operation. Signed-off-by: Miquel Raynal commit e47029b977e747cb3a9174308fd55762cce70147 Author: Tudor Ambarus Date: Fri Apr 17 15:24:39 2026 +0000 mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Sashiko noticed an out-of-bounds read [1]. In spi_nor_params_show(), the snor_f_names array is passed to spi_nor_print_flags() using sizeof(snor_f_names). Since snor_f_names is an array of pointers, sizeof() returns the total number of bytes occupied by the pointers (element_count * sizeof(void *)) rather than the element count itself. On 64-bit systems, this makes the passed length 8x larger than intended. Inside spi_nor_print_flags(), the 'names_len' argument is used to bounds-check the 'names' array access. An out-of-bounds read occurs if a flag bit is set that exceeds the array's actual element count but is within the inflated byte-size count. Correct this by using ARRAY_SIZE() to pass the actual number of string pointers in the array. Cc: stable@vger.kernel.org Fixes: 0257be79fc4a ("mtd: spi-nor: expose internal parameters via debugfs") Closes: https://sashiko.dev/#/patchset/20260417-die-erase-fix-v2-1-73bb7004ebad%40infineon.com [1] Signed-off-by: Tudor Ambarus Reviewed-by: Takahiro Kuwano Reviewed-by: Michael Walle Reviewed-by: Pratyush Yadav Signed-off-by: Miquel Raynal commit 292411fda25bdcb8cd0cb513fa5583a36dd36354 Author: David Carlier Date: Fri Apr 24 19:36:38 2026 +0100 mm/userfaultfd: detect VMA type change after copy retry in mfill_copy_folio_retry() mfill_copy_folio_retry() drops mmap_lock for the copy_from_user() call. During this window, the VMA can be replaced with a different type (e.g. hugetlb), making the caller's ops pointer stale. Subsequent use of the stale ops would dispatch into the wrong per-vma handlers. Capture the VMA's ops via vma_uffd_ops() before dropping the lock and compare against the current vma_uffd_ops() after re-acquiring it. Return -EAGAIN if they differ so the operation can be retried. This avoids comparing against the caller's ops which may have been overridden to anon_uffd_ops for MAP_PRIVATE file-backed mappings. Link: https://lore.kernel.org/20260424183638.196227-1-devnexen@gmail.com Fixes: 6ab703034f14 ("userfaultfd: mfill_atomic(): remove retry logic") Reported-by: Usama Arif Closes: https://lore.kernel.org/all/20260410114809.3592720-1-usama.arif@linux.dev/ Signed-off-by: David Carlier Acked-by: Mike Rapoport (Microsoft) Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Peter Xu Signed-off-by: Andrew Morton commit ba13b28decbb09ce5296a3303e85235e120147f2 Author: Sourabh Jain Date: Sat Apr 18 13:32:26 2026 +0530 MAINTAINERS: remove stale kdump project URL The kdump project URL in MAINTAINERS points to http://lse.sourceforge.net/kdump/, but it is no longer maintained. Remove this outdated link to avoid confusion and keep the file up to date. Discussion to remove this link: https://lore.kernel.org/all/e1e9e200-17d7-4ae9-b0eb-71300f4eb1ac@linux.ibm.com/ Link: https://lore.kernel.org/20260418080226.40415-1-sourabhjain@linux.ibm.com Signed-off-by: Sourabh Jain Acked-by: Baoquan He Cc: Dave Young Cc: Vivek Goyal Cc: Mike Rapoport Cc: Pasha Tatashin Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit f98590bc08d4aea435e1c2213e38bae0d9e9a7bb Author: SeongJae Park Date: Sun Apr 19 09:10:02 2026 -0700 mm/damon/stat: detect and use fresh enabled value DAMON_STAT updates 'enabled' parameter value, which represents the running status of its kdamond, when the user explicitly requests start/stop of the kdamond. The kdamond can, however, be stopped even if the user explicitly requested the stop, if ctx->regions_score_histogram allocation failure at beginning of the execution of the kdamond. Hence, if the kdamond is stopped by the allocation failure, the value of the parameter can be stale. Users could show the stale value and be confused. The problem will only rarely happen in real and common setups because the allocation is arguably too small to fail. Also, unlike the similar bugs that are now fixed in DAMON_RECLAIM and DAMON_LRU_SORT, kdamond can be restarted in this case, because DAMON_STAT force-updates the enabled parameter value for user inputs. The bug is a bug, though. The issue stems from the fact that there are multiple events that can change the status, and following all the events is challenging. Dynamically detect and use the fresh status for the parameters when those are requested. The issue was dicovered [1] by Sashiko. Link: https://lore.kernel.org/20260419161003.79176-4-sj@kernel.org Link: https://lore.kernel.org/20260416040602.88665-1-sj@kernel.org [1] Fixes: 369c415e6073 ("mm/damon: introduce DAMON_STAT module") Signed-off-by: SeongJae Park Cc: Liew Rui Yan Cc: # 6.17.x Signed-off-by: Andrew Morton commit b98b7ff6025ae82570d4915e083f0cbd8d48b3cf Author: SeongJae Park Date: Sun Apr 19 09:10:01 2026 -0700 mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values DAMON_LRU_SORT updates 'enabled' and 'kdamond_pid' parameter values, which represents the running status of its kdamond, when the user explicitly requests start/stop of the kdamond. The kdamond can, however, be stopped in events other than the explicit user request in the following three events. 1. ctx->regions_score_histogram allocation failure at beginning of the execution, 2. damon_commit_ctx() failure due to invalid user input, and 3. damon_commit_ctx() failure due to its internal allocation failures. Hence, if the kdamond is stopped by the above three events, the values of the status parameters can be stale. Users could show the stale values and be confused. This is already bad, but the real consequence is worse. DAMON_LRU_SORT avoids unnecessary damon_start() and damon_stop() calls based on the 'enabled' parameter value. And the update of 'enabled' parameter value depends on the damon_start() and damon_stop() call results. Hence, once the kdamond has stopped by the unintentional events, the user cannot restart the kdamond before the system reboot. For example, the issue can be reproduced via below steps. # cd /sys/module/damon_lru_sort/parameters # # # start DAMON_LRU_SORT # echo Y > enabled # ps -ef | grep kdamond root 806 2 0 17:53 ? 00:00:00 [kdamond.0] root 808 803 0 17:53 pts/4 00:00:00 grep kdamond # # # commit wrong input to stop kdamond withou explicit stop request # echo 3 > addr_unit # echo Y > commit_inputs bash: echo: write error: Invalid argument # # # confirm kdamond is stopped # ps -ef | grep kdamond root 811 803 0 17:53 pts/4 00:00:00 grep kdamond # # # users casn now show stable status # cat enabled Y # cat kdamond_pid 806 # # # even after fixing the wrong parameter, # # kdamond cannot be restarted. # echo 1 > addr_unit # echo Y > enabled # ps -ef | grep kdamond root 815 803 0 17:54 pts/4 00:00:00 grep kdamond The problem will only rarely happen in real and common setups for the following reasons. The allocation failures are unlikely in such setups since those allocations are arguably too small to fail. Also sane users on real production environments may not commit wrong input parameters. But once it happens, the consequence is quite bad. And the bug is a bug. The issue stems from the fact that there are multiple events that can change the status, and following all the events is challenging. Dynamically detect and use the fresh status for the parameters when those are requested. Link: https://lore.kernel.org/20260419161003.79176-3-sj@kernel.org Fixes: 40e983cca927 ("mm/damon: introduce DAMON-based LRU-lists Sorting") Co-developed-by: Liew Rui Yan Signed-off-by: Liew Rui Yan Signed-off-by: SeongJae Park Cc: # 6.0.x Signed-off-by: Andrew Morton commit 64a140afa5ed1c6f5ba6d451512cbdbbab1ba339 Author: SeongJae Park Date: Sun Apr 19 09:10:00 2026 -0700 mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values Patch series "mm/damon/modules: detect and use fresh status", v3. DAMON modules including DAMON_RECLAIM, DAMON_LRU_SORT and DAMON_STAT commonly expose the kdamond running status via their parameters. Under certain scenarios including wrong user inputs and memory allocation failures, those parameter values can be stale. It can confuse users. For DAMON_RECLAIM and DAMON_LRU_SORT, it even makes the kdamond unable to be restarted before the system reboot. The problem comes from the fact that there are multiple events for the status changes and it is difficult to follow up all the scenarios. Fix the issue by detecting and using the status on demand, instead of using a cached status that is difficult to be updated. Patches 1-3 fix the bugs in DAMON_RECLAIM, DAMON_LRU_SORT and DAMON_STAT in the order. This patch (of 3): DAMON_RECLAIM updates 'enabled' and 'kdamond_pid' parameter values, which represents the running status of its kdamond, when the user explicitly requests start/stop of the kdamond. The kdamond can, however, be stopped in events other than the explicit user request in the following three events. 1. ctx->regions_score_histogram allocation failure at beginning of the execution, 2. damon_commit_ctx() failure due to invalid user input, and 3. damon_commit_ctx() failure due to its internal allocation failures. Hence, if the kdamond is stopped by the above three events, the values of the status parameters can be stale. Users could show the stale values and be confused. This is already bad, but the real consequence is worse. DAMON_RECLAIM avoids unnecessary damon_start() and damon_stop() calls based on the 'enabled' parameter value. And the update of 'enabled' parameter value depends on the damon_start() and damon_stop() call results. Hence, once the kdamond has stopped by the unintentional events, the user cannot restart the kdamond before the system reboot. For example, the issue can be reproduced via below steps. # cd /sys/module/damon_reclaim/parameters # # # start DAMON_RECLAIM # echo Y > enabled # ps -ef | grep kdamond root 806 2 0 17:53 ? 00:00:00 [kdamond.0] root 808 803 0 17:53 pts/4 00:00:00 grep kdamond # # # commit wrong input to stop kdamond withou explicit stop request # echo 3 > addr_unit # echo Y > commit_inputs bash: echo: write error: Invalid argument # # # confirm kdamond is stopped # ps -ef | grep kdamond root 811 803 0 17:53 pts/4 00:00:00 grep kdamond # # # users casn now show stable status # cat enabled Y # cat kdamond_pid 806 # # # even after fixing the wrong parameter, # # kdamond cannot be restarted. # echo 1 > addr_unit # echo Y > enabled # ps -ef | grep kdamond root 815 803 0 17:54 pts/4 00:00:00 grep kdamond The problem will only rarely happen in real and common setups for the following reasons. The allocation failures are unlikely in such setups since those allocations are arguably too small to fail. Also sane users on real production environments may not commit wrong input parameters. But once it happens, the consequence is quite bad. And the bug is a bug. The issue stems from the fact that there are multiple events that can change the status, and following all the events is challenging. Dynamically detect and use the fresh status for the parameters when those are requested. Link: https://lore.kernel.org/20260419161003.79176-1-sj@kernel.org Link: https://lore.kernel.org/20260419161003.79176-2-sj@kernel.org Fixes: e035c280f6df ("mm/damon/reclaim: support online inputs update") Co-developed-by: Liew Rui Yan Signed-off-by: Liew Rui Yan Signed-off-by: SeongJae Park Cc: # 5.19.x Signed-off-by: Andrew Morton commit a3907a3169d09ebaeef9631ab6a4534314545ef7 Author: Mark Brown Date: Thu Apr 16 19:40:56 2026 +0100 selftests/mm: specify requirement for PROC_MEM_ALWAYS_FORCE=y Several of the mm selftests made use of /proc/pid/mem as part of their operation but we do not specify this in the config fragment for them, at least mkdirty and ksm_functional_tests have this requirement. This has been working fine in practice since PROC_MEM_ALWAYS_FORCE was the default setting but commit 599bbba5a36f ("proc: make PROC_MEM_FORCE_PTRACE the Kconfig default") that is no longer the case, meaning that tests run on kernels built based on defconfigs have started having the new more restrictive default and failing. Add PROC_MEM_ALWAYS_FORCE to the config fragment for the mm selftests. Thanks to Aishwarya TCV for spotting the issue and identifying the commit that introduced it. Link: https://lore.kernel.org/20260416-selftests-mm-proc-mem-always-force-v1-1-3f5865153c67@kernel.org Fixes: 599bbba5a36f ("proc: make PROC_MEM_FORCE_PTRACE the Kconfig default") Signed-off-by: Mark Brown Reported-by: Aishwarya TCV Reviewed-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand (Arm) Reviewed-by: Anshuman Khandual Reviewed-by: Dev Jain Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit cf3b71421ca00807328c6d9cd242f9de3b77a4bf Author: SeongJae Park Date: Thu Apr 23 08:02:52 2026 -0700 mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock damon_sysfs_quot_goal->path can be read and written by users, via DAMON sysfs 'path' file. It can also be indirectly read, for the parameters {on,off}line committing to DAMON. The reads for parameters committing are protected by damon_sysfs_lock to avoid the sysfs files being destroyed while any of the parameters are being read. But the user-driven direct reads and writes are not protected by any lock, while the write is deallocating the path-pointing buffer. As a result, the readers could read the already freed buffer (user-after-free). Note that the user-reads don't race when the same open file is used by the writer, due to kernfs's open file locking. Nonetheless, doing the reads and writes with separate open files would be common. Fix it by protecting both the user-direct reads and writes with damon_sysfs_lock. Link: https://lore.kernel.org/20260423150253.111520-3-sj@kernel.org Fixes: c41e253a411e ("mm/damon/sysfs-schemes: implement path file under quota goal directory") Co-developed-by: Junxi Qian Signed-off-by: Junxi Qian Signed-off-by: SeongJae Park Cc: # 6.19.x Signed-off-by: Andrew Morton commit 1e68eb96e8beb1abefd12dd22c5637795d8a877e Author: SeongJae Park Date: Thu Apr 23 08:02:51 2026 -0700 mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Patch series "mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path". Reads of 'memcg_path' and 'path' files in DAMON sysfs interface could race with their writes, results in use-after-free. Fix those. This patch (of 2): damon_sysfs_scheme_filter->mmecg_path can be read and written by users, via DAMON sysfs memcg_path file. It can also be indirectly read, for the parameters {on,off}line committing to DAMON. The reads for parameters committing are protected by damon_sysfs_lock to avoid the sysfs files being destroyed while any of the parameters are being read. But the user-driven direct reads and writes are not protected by any lock, while the write is deallocating the memcg_path-pointing buffer. As a result, the readers could read the already freed buffer (user-after-free). Note that the user-reads don't race when the same open file is used by the writer, due to kernfs's open file locking. Nonetheless, doing the reads and writes with separate open files would be common. Fix it by protecting both the user-direct reads and writes with damon_sysfs_lock. Link: https://lore.kernel.org/20260423150253.111520-1-sj@kernel.org Link: https://lore.kernel.org/20260423150253.111520-2-sj@kernel.org Fixes: 4f489fe6afb3 ("mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write") Co-developed-by: Junxi Qian Signed-off-by: Junxi Qian Signed-off-by: SeongJae Park Cc: # 6.16.x Signed-off-by: Andrew Morton commit 2aeb64a2b90da8ed1bb71d1a6dce61a11f69f3cf Author: Li Wang Date: Thu Apr 23 21:26:49 2026 +0800 MAINTAINERS: update Li Wang's email address Update my email address as my work email account is no longer in use. Also update .mailmap. Link: https://lore.kernel.org/20260423132649.31126-1-li.wang@linux.dev Signed-off-by: Li Wang Reviewed-by: Cyril Hrubis Reviewed-by: Petr Vorel Cc: Arnd Bergmann Cc: Jakub Kacinski Cc: Li Wang Cc: Martin Kepplinger Cc: Shannon Nelson Signed-off-by: Andrew Morton commit adeeacf696b2b2e8e4a42089f09c76578b42d92f Author: Qi Zheng Date: Thu Apr 23 15:16:28 2026 +0800 MAINTAINERS, mailmap: update email address for Qi Zheng Update my email address to qi.zheng@linux.dev. Link: https://lore.kernel.org/20260423071628.44044-1-qi.zheng@linux.dev Signed-off-by: Qi Zheng Signed-off-by: Andrew Morton commit 77a50e9652ac3c669c6690088bce97d960f5fd17 Author: Liam R. Howlett Date: Wed Apr 22 14:43:10 2026 -0400 MAINTAINERS: update Liam's email address Switching to private email address. Update all contact information Add an entry to mailmap at the same time. Link: https://lore.kernel.org/20260422184310.2682901-1-liam@infradead.org Signed-off-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 8f5ce56b76303c55b78a87af996e2e0f8535f979 Author: Sang-Heon Jeon Date: Wed Apr 22 23:33:53 2026 +0900 mm/hugetlb_cma: round up per_node before logging it When the user requests a total hugetlb CMA size without per-node specification, hugetlb_cma_reserve() computes per_node from hugetlb_cma_size and the number of nodes that have memory per_node = DIV_ROUND_UP(hugetlb_cma_size, nodes_weight(hugetlb_bootmem_nodes)); The reservation loop later computes size = round_up(min(per_node, hugetlb_cma_size - reserved), PAGE_SIZE << order); So the actually reserved per_node size is multiple of (PAGE_SIZE << order), but the logged per_node is not rounded up, so it may be smaller than the actual reserved size. For example, as the existing comment describes, if a 3 GB area is requested on a machine with 4 NUMA nodes that have memory, 1 GB is allocated on the first three nodes, but the printed log is hugetlb_cma: reserve 3072 MiB, up to 768 MiB per node Round per_node up to (PAGE_SIZE << order) before logging so that the printed log always matches the actual reserved size. No functional change to the actual reservation size, as the following case analysis shows 1. remaining (hugetlb_cma_size - reserved) >= rounded per_node - AS-IS: min() picks unrounded per_node; round_up() returns rounded per_node - TO-BE: min() picks rounded per_node; round_up() returns rounded per_node (no-op) 2. remaining < unrounded per_node - AS-IS: min() picks remaining; round_up() returns round_up(remaining) - TO-BE: min() picks remaining; round_up() returns round_up(remaining) 3. unrounded per_node <= remaining < rounded per_node - AS-IS: min() picks unrounded per_node; round_up() returns rounded per_node - TO-BE: min() picks remaining; round_up() returns round_up(remaining) equals rounded per_node Link: https://lore.kernel.org/20260422143353.852257-1-ekffu200098@gmail.com Fixes: cf11e85fc08c ("mm: hugetlb: optionally allocate gigantic hugepages using cma") # 5.7 Signed-off-by: Sang-Heon Jeon Reviewed-by: Muchun Song Cc: David Hildenbrand Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton commit 69df7cda05bebbf790f6eb0f2fda5b89f596bd59 Author: Pedro Falcato Date: Wed Apr 22 13:37:26 2026 +0100 MAINTAINERS: fix regex pattern in CORE MM category The pattern "include/linux/page[-_]*" matches every file that starts with "page", because it's a regex and not a glob (so it has the meaning of include/linux/page + match [-_] 0+ times). Fix it up into a more regex-correct expression. Doing so reduces CC's drastically in patches that touch pagemap.h (which is maintained as part of PAGE CACHE). As a side-effect, move linux/pageblock-flags.h explicitly under PAGE ALLOCATOR. Link: https://lore.kernel.org/linux-mm/20260422005608.342028-1-fmayle@google.com/ Link: https://lore.kernel.org/20260422123726.517220-1-pfalcato@suse.de Signed-off-by: Pedro Falcato Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Arm) Acked-by: Vlastimil Babka (SUSE) Reviewed-by: SeongJae Park Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 619eab23e1ce7c97e54bfc5a417306d94b3f6f13 Author: Lorenzo Stoakes Date: Tue Apr 21 11:21:50 2026 +0100 mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap() The mmap_prepare hook functionality includes the ability to invoke mmap_prepare() from the mmap() hook of existing 'stacked' drivers, that is ones which are capable of calling the mmap hooks of other drivers/file systems (e.g. overlayfs, shm). As part of the mmap_prepare action functionality, we deal with errors by unmapping the VMA should one arise. This works in the usual mmap_prepare case, as we invoke this action at the last moment, when the VMA is established in the maple tree. However, the mmap() hook passes a not-fully-established VMA pointer to the caller (which is the motivation behind the mmap_prepare() work), which is detached. So attempting to unmap a VMA in this state will be problematic, with the most obvious symptom being a warning in vma_mark_detached(), because the VMA is already detached. It's also unncessary - the mmap() handler will clean up the VMA on error. So to fix this issue, this patch propagates whether or not an mmap action is being completed via the compatibility layer or directly. If the former, then we do not attempt VMA cleanup, if the latter, then we do. This patch also updates the userland VMA tests to reflect the change. Link: https://lore.kernel.org/20260421102150.189982-1-ljs@kernel.org Fixes: ac0a3fc9c07d ("mm: add ability to take further action in vm_area_desc") Signed-off-by: Lorenzo Stoakes Reported-by: syzbot+db390288d141a1dccf96@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69e69734.050a0220.24bfd3.0027.GAE@google.com/ Cc: David Hildenbrand Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit 0437906841d0448121a7907b71b73c6cf2fc7afb Author: Joanne Koong Date: Thu Mar 26 16:46:29 2026 -0700 mm: start background writeback based on per-wb threshold for strictlimit BDIs The proactive nr_dirty > gdtc->bg_thresh check in balance_dirty_pages() only checks the global dirty threshold to start background writeback while the writer is still free-running, but for strictlimit BDIs (eg fuse), the per-wb dirty count can exceed the per-wb background threshold while the global threshold is not yet exceeded, so background writeback for this case never gets proactively started. Add a per-wb threshold check for strictlimit BDIs so that background writeback is started when wb_dirty exceeds wb_bg_thresh, which drains dirty pages before the writer hits the throttle wall, matching the proactive behavior that the global check provides for non-strictlimit BDIs. fio runs on fuse show about a 3-4% improvement in perf for buffered writes: fio --name=writeback_test --ioengine=psync --rw=write --bs=128k \ --size=2G --numjobs=4 --ramp_time=10 --runtime=20 \ --time_based --group_reporting=1 --direct=0 Link: https://lore.kernel.org/20260326234629.840938-2-joannelkoong@gmail.com Signed-off-by: Joanne Koong Reviewed-by: Jan Kara Cc: Matthew Wilcox (Oracle) Cc: Miklos Szeredi Cc: Christoph Hellwig Cc: Johannes Weiner Signed-off-by: Andrew Morton commit 9ec95329894864170a1a7685b9a11b739393131a Author: Breno Leitao Date: Fri Apr 10 02:03:03 2026 -0700 kho: fix error handling in kho_add_subtree() Fix two error handling issues in kho_add_subtree(), where it doesn't handle the error path correctly. 1. If fdt_setprop() fails after the subnode has been created, the subnode is not removed. This leaves an incomplete node in the FDT (missing "preserved-data" or "blob-size" properties). 2. The fdt_setprop() return value (an FDT error code) is stored directly in err and returned to the caller, which expects -errno. Fix both by storing fdt_setprop() results in fdt_err, jumping to a new out_del_node label that removes the subnode on failure, and only setting err = 0 on the success path, otherwise returning -ENOMEM (instead of FDT_ERR_ errors that would come from fdt_setprop). No user-visible changes. This patch fixes error handling in the KHO (Kexec HandOver) subsystem, which is used to preserve data across kexec reboots. The fix only affects a rare failure path during kexec preparation — specifically when the kernel runs out of space in the Flattened Device Tree buffer while registering preserved memory regions. In the unlikely event that this error path was triggered, the old code would leave a malformed node in the device tree and return an incorrect error code to the calling subsystem, which could lead to confusing log messages or incorrect recovery decisions. With this fix, the incomplete node is properly cleaned up and the appropriate errno value is propagated, this error code is not returned to the user. Link: https://lore.kernel.org/20260410-kho_fix_send-v2-1-1b4debf7ee08@debian.org Fixes: 3dc92c311498 ("kexec: add Kexec HandOver (KHO) generation helpers") Signed-off-by: Breno Leitao Suggested-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Breno Leitao Cc: Pasha Tatashin Cc: Signed-off-by: Andrew Morton commit 0562b572ce591858749fc2f9477567e7e5c5d99f Author: Pasha Tatashin Date: Wed Apr 15 19:37:38 2026 +0000 liveupdate: fix return value on session allocation failure When session allocation fails during deserialization, the global 'err' variable was not updated before returning. This caused subsequent calls to luo_session_deserialize() to incorrectly report success. Ensure 'err' is set to the error code from PTR_ERR(session). This ensures that an error is correctly returned to userspace when it attempts to open /dev/liveupdate in the new kernel if deserialization failed. Link: https://lore.kernel.org/20260415193738.515491-1-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav (Google) Cc: David Matlack Cc: Mike Rapoport Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 602655067e25030cb68c32a355ba1007a76a0c5a Author: Dan Carpenter Date: Mon Apr 20 18:15:50 2026 +0300 mailmap: update entry for Dan Carpenter Update my mailmap entry to point to my current email address. Link: https://lore.kernel.org/ab2d502542c24491c191a76494717c340afb9a9b.1776691831.git.error27@gmail.com Signed-off-by: Dan Carpenter Signed-off-by: Andrew Morton commit 82d1f01292d3f09bf063f829f8ab8de12b4280a1 Author: Marco Elver Date: Mon Apr 20 13:47:26 2026 +0200 vmalloc: fix buffer overflow in vrealloc_node_align() Commit 4c5d3365882d ("mm/vmalloc: allow to set node and align in vrealloc") added the ability to force a new allocation if the current pointer is on the wrong NUMA node, or if an alignment constraint is not met, even if the user is shrinking the allocation. On this path (need_realloc), the code allocates a new object of 'size' bytes and then memcpy()s 'old_size' bytes into it. If the request is to shrink the object (size < old_size), this results in an out-of-bounds write on the new buffer. Fix this by bounding the copy length by the new allocation size. Link: https://lore.kernel.org/20260420114805.3572606-2-elver@google.com Fixes: 4c5d3365882d ("mm/vmalloc: allow to set node and align in vrealloc") Signed-off-by: Marco Elver Reported-by: Harry Yoo (Oracle) Reviewed-by: Uladzislau Rezki (Sony) Acked-by: Vlastimil Babka (SUSE) Reviewed-by: Harry Yoo (Oracle) Cc: Signed-off-by: Andrew Morton commit ec1fcddb3117d9452210e838fd37389ee61e10e8 Author: Wentao Liang Date: Wed Apr 8 14:11:21 2026 +0000 pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() In scpsys_get_bus_protection_legacy(), of_find_node_with_property() returns a device node with its reference count incremented. The function then calls of_node_put(node) before checking whether syscon_regmap_lookup_by_phandle() returns an error. If an error occurs, dev_err_probe() dereferences the node pointer to print diagnostic information, but the node memory may have already been freed due to the earlier of_node_put(), leading to a use-after-free vulnerability. Fix this by moving the of_node_put() call after the error check, ensuring the node is still valid when accessed in the error path. Fixes: c29345fa5f66 ("pmdomain: mediatek: Refactor bus protection regmaps retrieval") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Signed-off-by: Ulf Hansson commit 3ea4415015d690a51a3fb1f98dfc9a02f88f7bc4 Author: Breno Leitao Date: Mon Apr 20 02:27:13 2026 -0700 ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states Commit cac173bea57d ("ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe()") moved the acpi_processor_ffh_lpi_probe() call from acpi_processor_setup_cpuidle_dev(), where its return value was ignored, to acpi_processor_get_power_info(), where it is now treated as a hard failure. As a result, platforms where psci_acpi_cpu_init_idle() returned -ENODEV stopped registering any cpuidle states, forcing CPUs to busy-poll when idle. On NVIDIA Grace (aarch64) systems with PSCIv1.1, pr->power.count is 1 (only WFI, no deep PSCI states beyond it), so the previous "count = pr->power.count - 1; if (count <= 0) return -ENODEV;" check returned -ENODEV for all 72 CPUs and disabled cpuidle entirely. The lpi_states count is already validated in acpi_processor_get_lpi_info(), so the check here is redundant. Simplify the loop to iterate over lpi_states[1..power.count). When only WFI is present, the loop body simply does not execute and the function returns 0, which is the correct outcome: there is nothing to validate for FFH and no error to report. Suggested-by: Huisong Li Cc: stable@vger.kernel.org Fixes: cac173bea57d ("ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe()") Signed-off-by: Breno Leitao Reviewed-by: Sudeep Holla Signed-off-by: Catalin Marinas commit 7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b Author: Deepanshu Kartikey Date: Sun Apr 26 05:49:34 2026 +0530 ALSA: caiaq: fix usb_dev refcount leak on probe failure create_card() takes a reference on the USB device with usb_get_dev() and stores the matching usb_put_dev() in card_free(), which is installed as the snd_card's ->private_free destructor. However, ->private_free is only assigned near the end of init_card(), after several failure points (usb_set_interface(), EP type checks, usb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its timeout). When any of those fail, init_card() returns an error to snd_probe(), which calls snd_card_free(card). Because ->private_free is still NULL, card_free() never runs, the usb_get_dev() reference is not dropped, and the struct usb_device leaks along with its descriptor allocations and device_private. syzbot reproduces this with a malformed UAC3 device whose only valid altsetting is 0; init_card()'s usb_set_interface(usb_dev, 0, 1) call fails with -EIO and triggers the leak. Move the ->private_free assignment into create_card(), immediately after usb_get_dev(), so that every error path reaching snd_card_free() balances the reference. card_free()'s callees (snd_usb_caiaq_input_free, free_urbs, kfree) already tolerate the partially-initialized state because the chip private area is zero-initialized by snd_card_new(). Fixes: 80bb50e2d459 ("ALSA: caiaq: take a reference on the USB device in create_card()") Reported-by: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2afd7e71155c7e241560 Tested-by: syzbot+2afd7e71155c7e241560@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260426001934.70813-1-kartikey406@gmail.com Signed-off-by: Takashi Iwai commit 26735dfdd8930d9ef1fa92e590a9bf77726efdf6 Author: Ulf Hansson Date: Fri Apr 17 13:13:31 2026 +0200 pmdomain: core: Fix detach procedure for virtual devices in genpd If a device is attached to a PM domain through genpd_dev_pm_attach_by_id(), genpd calls pm_runtime_enable() for the corresponding virtual device that it registers. While this avoids boilerplate code in drivers, there is no corresponding call to pm_runtime_disable() in genpd_dev_pm_detach(). This means these virtual devices are typically detached from its genpd, while runtime PM remains enabled for them, which is not how things are designed to work. In worst cases it may lead to critical errors, like a NULL pointer dereference bug in genpd_runtime_suspend(), which was recently reported. For another case, we may end up keeping an unnecessary vote for a performance state for the device. To fix these problems, let's add this missing call to pm_runtime_disable() in genpd_dev_pm_detach(). Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/all/CAMuHMdWapT40hV3c+CSBqFOW05aWcV1a6v_NiJYgoYi0i9_PDQ@mail.gmail.com/ Fixes: 3c095f32a92b ("PM / Domains: Add support for multi PM domains per device to genpd") Cc: stable@vger.kernel.org Tested-by: Geert Uytterhoeven Signed-off-by: Ulf Hansson commit d1f73f169c1014463b5060e3f60813e13ddc7b87 Author: SeungJu Cheon Date: Sun Apr 26 20:12:39 2026 +0900 sound: ua101: fix division by zero at probe Add a missing sanity check for bNrChannels in detect_usb_format() to prevent a division by zero in playback_urb_complete() and capture_urb_complete(). USB core does not validate class-specific descriptor fields such as bNrChannels, so drivers must verify them before use. If a device provides bNrChannels = 0, frame_bytes becomes zero and is later used as a divisor in the URB completion handlers, leading to a kernel crash. Fixes: 63978ab3e3e9 ("sound: add Edirol UA-101 support") Cc: stable@vger.kernel.org Signed-off-by: SeungJu Cheon Link: https://patch.msgid.link/20260426111239.103296-1-suunj1331@gmail.com Signed-off-by: Takashi Iwai commit 110189f0268d0eb85895721526328cac5804a739 Author: Rosalie Wanders Date: Sun Apr 26 04:55:19 2026 +0200 ALSA: usb-audio: apply quirk for Playstation PDP Riffmaster This device, just like the Playstation 5's DualSense, has a volume that's too low, hid-playstation solves this by raising the minimum volume on the device itself by sending an output report, third party PS5 controllers/accessories do not support this output report format, so we apply a quirk to raise the minimum volume by 6dB. Signed-off-by: Rosalie Wanders Link: https://patch.msgid.link/20260426025520.3985-2-rosalie@mailbox.org Signed-off-by: Takashi Iwai commit b795666e1ee4101a949248bfff6074a6dce91824 Author: Sasha Levin Date: Sat Apr 25 20:03:27 2026 -0400 ALSA: hda: Remove duplicate cmedia entries in codecs Makefile kconfiglint reports: M004: 'snd-hda-codec-cmedia-y' assigned with ':=' but was already assigned at line 5; previous value is overwritten sound/hda/codecs/Makefile contains duplicate entries for the C-Media codec driver — both the composite module definition and the obj-* build target appear twice: Line 5: snd-hda-codec-cmedia-y := cmedia.o Line 10: snd-hda-codec-cmedia-y := cmedia.o (duplicate) Line 24: obj-$(CONFIG_SND_HDA_CODEC_CMEDIA) += snd-hda-codec-cmedia.o Line 29: obj-$(CONFIG_SND_HDA_CODEC_CMEDIA) += snd-hda-codec-cmedia.o (duplicate) This file was created by commit 6014e9021b28 ("ALSA: hda: Move codec drivers into sound/hda/codecs directory") which moved codec drivers from sound/pci/hda/ to sound/hda/codecs/. In that initial file, cmedia appeared once in each section. Immediately after, commit aeeb85f26c3b ("ALSA: hda: Split Realtek HD-audio codec driver") reordered the entries and inserted cmedia at new positions near the top of each section, as part of splitting out the Realtek driver. However, the original cmedia entries were not removed during this reordering, creating duplicates of both lines. The second assignment harmlessly overwrites the first with the same value, and the second obj-* line causes the module to be listed twice — neither causes a build failure, but both are dead code. Remove the duplicate entries (second occurrence of each). Assisted-by: Claude:claude-opus-4-6 kconfiglint Signed-off-by: Sasha Levin Link: https://patch.msgid.link/20260426000327.56079-1-sashal@kernel.org Signed-off-by: Takashi Iwai commit d830631a128b394793811d9de61550d4518906cd Author: Naser Al-Asbahi Date: Sat Apr 25 17:40:14 2026 +0200 ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A315-44P The mic-mute LED on the Acer Aspire A315-44P (subsystem ID 0x10251640) does not light up when the microphone is muted. The LED is connected to GPIO3 of the Realtek ALC256 codec. Add a quirk entry using ALC256_FIXUP_ACER_SFG16_MICMUTE_LED, which configures GPIO3 (bitmask 0x04) as the micmute LED, identical to the Acer Swift SFG16. Tested by manually sending HDA verb commands directly to the codec and verifying that GPIO3 drives the LED while GPIO1 and GPIO2 do not. Signed-off-by: Naser Al-Asbahi Link: https://patch.msgid.link/20260425154014.83982-1-nasserqahtan0@gmail.com Signed-off-by: Takashi Iwai commit caecde119e341acd9819cbc1c54edf6caa6c6389 Author: Breno Leitao Date: Tue Apr 21 08:58:57 2026 -0700 arm64/irqflags: __always_inline the arch_local_irq_*() helpers The arch_local_irq_*() wrappers in dispatch between two underlying primitives: the __daif_* path on most systems, and the __pmr_* path on builds that use GIC PMR-based masking (Pseudo-NMI). The leaf primitives are already __always_inline, but the wrappers themselves are plain "static inline". That is unsafe for noinstr callers: nothing prevents the compiler from emitting an out-of-line copy of e.g. arch_local_irq_disable(), and an out-of-line copy can be instrumented (ftrace, kcov, sanitizers), which breaks the noinstr contract on the entry/idle paths that rely on these helpers. x86 hit and fixed exactly this class of bug in commit 7a745be1cc90 ("x86/entry: __always_inline irqflags for noinstr"). Force-inline all of the arch_local_irq_*() wrappers so they cannot be emitted out-of-line: - arch_local_irq_enable() - arch_local_irq_disable() - arch_local_save_flags() - arch_irqs_disabled_flags() - arch_irqs_disabled() - arch_local_irq_save() - arch_local_irq_restore() The primary motivation is noinstr safety. There is a useful side effect for fleet-wide profiling: when the wrapper is emitted out-of-line, samples taken inside it during the post-WFI IRQ unmask in default_idle_call() are attributed to arch_local_irq_enable rather than default_idle_call(), and the FP-unwinder loses default_idle_call() from the chain. Signed-off-by: Breno Leitao Reviewed-by: Leonardo Bras Signed-off-by: Catalin Marinas commit 597aa74b0e73f5e0c915b5d0c95cb296774589bd Author: Yuxuan Qiu Date: Fri Apr 24 19:21:07 2026 +0800 ALSA: hda/realtek: enable mute LED support on ThinkBook 16p On ThinkBook 16p systems the platform mute LED is present and bound to the audio-mute trigger, but it does not react to Master mute changes. The affected fixup chain sets up the DAC routing, but does not enable vmaster mute LED handling. Because of that, the generic HDA code does not mark Master Playback Switch with SNDRV_CTL_ELEM_ACCESS_SPK_LED, and the audio-mute trigger never receives speaker mute updates. Add a ThinkBook-specific wrapper around alc287_fixup_bind_dacs() and enable spec->gen.vmaster_mute_led during PRE_PROBE. This keeps the existing DAC binding logic unchanged while allowing the normal generic LED path to drive the mute LED. Signed-off-by: Yuxuan Qiu Link: https://patch.msgid.link/20260424112107.22206-1-yuxuanqiu596@gmail.com Signed-off-by: Takashi Iwai commit f9471dc1a7177f594acf8106cc4a6ab33bf0bcb6 Author: Mostafa Saleh Date: Fri Apr 24 11:50:51 2026 +0000 iommu/pages: Fix iommu_pages_flush_incoherent() for non-x86 The dma_sync_single_for_device() function expects a dma_addr_t, but iommu_pages_flush_incoherent() was incorrectly passing a virtual address. Since iommu_pages_start_incoherent() enforces a 1:1 mapping between DMA addresses and physical addresses (checked via WARN_ON), we can convert the virtual address to a physical address before passing it to the DMA API. This also matches the behaviour of the other non-x86 in iommu_pages_free_incoherent(), which uses virt_to_phys(virt); Fixes: 36ae67b13976 ("iommu/pages: Add support for incoherent IOMMU page table walkers") Signed-off-by: Mostafa Saleh Reviewed-by: Lu Baolu Reviewed-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 26265dd69da32d88a88d21987853cec899d9e21f Author: Cássio Gabriel Date: Fri Apr 24 18:50:10 2026 -0300 ALSA: usb-audio: Fix UAC3 cluster descriptor size check The UAC3 cluster descriptor length check in snd_usb_get_audioformat_uac3()was added to make sure that the buffer is large enough for a struct uac3_cluster_header_descriptor before the returned data is cast and used. However, the check uses sizeof(cluster), where cluster is a pointer, not the size of the descriptor header. This makes the validation depend on the architecture pointer size and does not match the intended object size. Check against sizeof(*cluster) instead. Fixes: fb4e2a6e8f28 ("ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260424-alsa-usb-uac3-cluster-size-v1-1-99a5808898a3@gmail.com Signed-off-by: Takashi Iwai commit e5c33cdc6f402eab8abd36ecf436b22c9d3a8aff Author: Cássio Gabriel Date: Fri Apr 24 09:48:41 2026 -0300 ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved the peer lookup under cable->lock, but the actual snd_pcm_stop() still runs after dropping that lock. A concurrent close can clear the capture entry from cable->streams[] and detach or free its runtime while the playback trigger path still holds a stale peer substream pointer. Keep a per-cable count of in-flight peer stops before dropping cable->lock, and make free_cable() wait for those stops before detaching the runtime. This preserves the existing behavior while making the peer runtime lifetime explicit. Reported-by: syzbot+8fa95c41eafbc9d2ff6f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8fa95c41eafbc9d2ff6f Fixes: 597603d615d2 ("ALSA: introduce the snd-aloop module for the PCM loopback") Cc: stable@vger.kernel.org Suggested-by: Takashi Iwai Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260424-alsa-aloop-peer-stop-uaf-v2-1-94e68101db8a@gmail.com Signed-off-by: Takashi Iwai commit 901ac0ff15edf9503162e2cf6579bd11a30f1ed4 Author: Takashi Iwai Date: Fri Apr 24 13:21:55 2026 +0200 ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Currently the runtime.oss.trigger field may be accessed concurrently without protection, which may lead to the data race. And, in this case, it may lead to more severe problem because it's a bit field; as writing the data, it may overwrite other bit fields as well, which confuses the operation completely, as spotted by fuzzing. Fix it by covering runtime.oss.trigger bit fled also with the existing params_lock mutex in both snd_pcm_oss_get_trigger() and snd_pcm_oss_poll(). Reported-and-tested-by: Jaeyoung Chung Closes: https://lore.kernel.org/20260423145330.210035-1-jjy600901@snu.ac.kr Cc: Link: https://patch.msgid.link/20260424112205.123703-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 1f44aab79bac31f459422dfb213e907bb386509c Author: Vasant Hegde Date: Mon Apr 20 08:42:04 2026 +0000 iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19 Due to CVE-2023-20585, the PPR log buffer must use the maximum supported size (512K) on Genoa (Family 0x19, model >= 0x10) systems when SNP is enabled, to mitigate a potential security vulnerability. Note that Family 0x19 models below 0x10 (Milan) do not support PPR when SNP is enabled. Hence the PPR log size increase is only applied for model >= 0x10. All other systems continue to use the default PPR log buffer size (8K). Apply the errata fix by making the following changes: - Introduce global new variable (amd_iommu_pprlog_size) to have PPR log buffer size. Adjust variable size for Genoa family. - Extend 'amd_iommu_apply_erratum_snp()' to also set the PPR log buffer size to maximum for Family 0x19 model >= 0x10 when SNP is enabled. - Rename PPR_* macros to make it more readable. Link: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3016.html Cc: Borislav Petkov Cc: Suravee Suthikulpanit Cc: Joerg Roedel Signed-off-by: Vasant Hegde Tested-by: Dheeraj Kumar Srivastava Signed-off-by: Joerg Roedel commit 58c0ac6125d89bf6ec65a521eaeb52a0e8e20a9f Author: Vasant Hegde Date: Mon Apr 20 08:42:03 2026 +0000 iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 Due to CVE-2023-20585, the Event log buffer must use the maximum supported size (512K) on Milan/Genoa (Family 0x19) systems when SNP is enabled, to mitigate a potential security vulnerability. All other systems continue to use the default Event log buffer size (8K). Apply the errata fix by making the following changes: * Introduce new global variable (amd_iommu_evtlog_size) to have event log buffer size. Adjust variable size for family 0x19. * Since 'iommu_snp_enable()' must be called after the core IOMMU subsystem is initialized, it cannot be moved to the early init stage. The SNP errata must also be applied after the 'iommu_snp_enable()' check. Therefore, 'alloc_event_buffer()' and 'iommu_enable_event_buffer()' are now called in the IOMMU_ENABLED state, after the errata is applied. * Adjust alloc_event_buffer() and iommu_enable_event_buffer() to handle all IOMMU instances. * Also rename EVT_* macros to make it more readable. Link: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3016.html Cc: Borislav Petkov Cc: Suravee Suthikulpanit Cc: Joerg Roedel Signed-off-by: Vasant Hegde Tested-by: Dheeraj Kumar Srivastava Signed-off-by: Joerg Roedel commit 0faacc0841d66f3cf51989c10a83f3a82d52ff2c Author: Cássio Gabriel Date: Thu Apr 23 10:11:31 2026 -0300 ALSA: hda: cs35l56: Propagate ASP TX source control errors cs35l56_hda_mixer_get() ignores regmap_read() and cs35l56_hda_mixer_put() ignores regmap_update_bits_check(). This makes the ASP TX source controls report success when a regmap access fails. The write path returns no change instead of an error, and the read path continues after a failed read instead of aborting the control callback. Propagate the regmap errors, matching the posture and volume controls in this driver. Fixes: 73cfbfa9caea ("ALSA: hda/cs35l56: Add driver for Cirrus Logic CS35L56 amplifier") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Reviewed-by: Richard Fitzgerald Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260423-alsa-cs35l56-asp-tx-source-errors-v1-1-17ea7c62ec31@gmail.com commit 4023b7424ecd5d38cc75b650d6c1bf630ef8cb40 Author: Wentao Guan Date: Mon Apr 13 17:54:59 2026 +0800 arm64/scs: Fix potential sign extension issue of advance_loc4 The expression (*opcode++ << 24) and exp * code_alignment_factor may overflow signed int and becomes negative. Fix this by casting each byte to u64 before shifting. Also fix the misaligned break statement while we are here. Example of the result can be seen here: Link: https://godbolt.org/z/zhY8d3595 It maybe not a real problem, but could be a issue in future. Fixes: d499e9627d70 ("arm64/scs: Fix handling of advance_loc4") Signed-off-by: Wentao Guan Signed-off-by: Catalin Marinas commit 13917f71a95a6ee6132ecb9a544cd5bc7197c68d Author: Ziran Zhang Date: Sat Apr 25 22:29:43 2026 +0800 docs: isofs: replace dead ECMA-119 FTP link The original link is no longer valid. Replace it with the official PDF of the 2nd edition. The new link points to the exact 2nd edition that the existing comment in isofs.rst refers to. Signed-off-by: Ziran Zhang Link: https://patch.msgid.link/20260425142943.6809-1-zhangcoder@yeah.net Signed-off-by: Jan Kara commit 7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba Author: Catherine Date: Fri Apr 24 21:14:36 2026 +0800 wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share one instance and can overwrite each other's result between ieee80211_rx_mesh_data() and the switch on res. That can make a packet that was queued or consumed by ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make a packet that should continue return as queued. Make res an automatic variable so each invocation keeps its own result. Fixes: 3468e1e0c639 ("wifi: mac80211: add mesh fast-rx support") Cc: stable@vger.kernel.org Signed-off-by: Catherine Link: https://patch.msgid.link/20260424131435.83212-2-enderaoelyther@gmail.com Signed-off-by: Johannes Berg commit 9b55d5c1f5e481e391957f9096d798ca331c461b Author: Michael Bommarito Date: Tue Apr 21 20:06:51 2026 -0400 wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path __ieee80211_rx_handle_packet() resolves the link via ieee80211_rx_data_set_link() on the pubsta->mlo path but ignores the helper's return value. Inside the helper, rx->link = rcu_dereference(rx->sdata->link[link_id]); can leave rx->link NULL if link_id references a slot already cleared by ieee80211_vif_set_links() during station-initiated ML reconfiguration (see mlme.c's ieee80211_ml_reconfiguration(), which invalidates sdata->link[] before the matching ieee80211_sta_remove_link() loop walks the link-sta hash). RX dispatch still resolves a link_sta from the hash and then drops into ieee80211_prepare_and_rx_handle(), which dereferences link->conf->addr. Every other user site of ieee80211_rx_data_set_link() checks the return and bails on failure; only this branch did not. Mirror the safe pattern. Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260422000651.4184602-1-michael.bommarito@gmail.com Signed-off-by: Johannes Berg commit 381cd547bc6e35a610c5dfebe554d891eea40f03 Author: Michael Bommarito Date: Tue Apr 21 18:45:52 2026 -0400 wifi: nl80211: require admin perm on SET_PMK / DEL_PMK NL80211_CMD_SET_PMK and NL80211_CMD_DEL_PMK manage the offloaded 4-way-handshake PMK state used by drivers advertising NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X. The only in-tree driver that wires up both ->set_pmk / ->del_pmk and advertises the feature today is brcmfmac, so the practical reach of this patch is narrow. Both ops were introduced without a .flags gate, so the generic netlink layer dispatches them to an unprivileged caller instead of rejecting with -EPERM at the permission check. Every other connection-state op in the adjacent block (CONNECT, ASSOCIATE, AUTHENTICATE, SET_KEY, ...) carries GENL_UNS_ADMIN_PERM; SET_PMK / DEL_PMK were introduced without the flag in 2017 and left unchanged by later refactors. Johannes checked the original Intel submission history and confirmed there is no admin check in any prior revision either, so this seems likely to be a simple oversight rather than an intentional carve-out. Require GENL_UNS_ADMIN_PERM so the genl layer performs the same capable(CAP_NET_ADMIN) check as its siblings. wpa_supplicant already needs CAP_NET_ADMIN for every other nl80211 op it issues, so supplicant operation is unaffected. The worst case the missing gate enables today is an unprivileged local process on a multi-user system invalidating the offloaded PMK state of another user's 4-way-handshake session, forcing a full EAP re-auth on the next reconnect. Verified in UML: an unprivileged probe (uid=1000) sees SET_MULTICAST_TO_UNICAST (sibling op with GENL_UNS_ADMIN_PERM) return -EPERM on both pre- and post-fix kernels, while SET_PMK / DEL_PMK return -ENODEV from nl80211_pre_doit()'s wdev lookup pre- fix (proving dispatch crossed the genl permission check) and -EPERM post-fix (rejected at the genl layer as intended). Suggested-by: Johannes Berg Fixes: 3a00df5707b6 ("cfg80211: support 4-way handshake offloading for 802.1X") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260421224552.4044147-1-michael.bommarito@gmail.com Signed-off-by: Johannes Berg commit 3994b4afd521d60e47e012fe2ed7b606aaec370b Author: Amir Mohammad Jahangirzad Date: Sat Apr 18 04:12:47 2026 +0330 wifi: libertas: fix integer underflow in process_cmdrequest() The existing validation only checks if recvlength exceeds LBS_CMD_BUFFER_SIZE, but doesn't check the lower bound. When a USB device sends a response shorter than MESSAGE_HEADER_LEN, the subtraction (recvlength - MESSAGE_HEADER_LEN) wraps to a huge value, causing memcpy to corrupt the heap. Add the same lower bound check that libertas_tf already has. Signed-off-by: Amir Mohammad Jahangirzad Link: https://patch.msgid.link/20260418004247.368944-1-a.jahangirzad@gmail.com Signed-off-by: Johannes Berg commit a035766f970bde2d4298346a31a80685be5c0205 Author: Tristan Madani Date: Fri Apr 17 11:11:45 2026 +0000 wifi: b43legacy: enforce bounds check on firmware key index in RX path Same fix as b43: the firmware-controlled key index in b43legacy_rx() can exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read of dev->key[]. Make the check enforcing by dropping the frame for invalid indices. Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani Link: https://patch.msgid.link/20260417111145.2694196-2-tristmd@gmail.com Signed-off-by: Johannes Berg commit 1f4f78bf8549e6ac4f04fba4176854f3a6e0c332 Author: Tristan Madani Date: Fri Apr 17 11:11:44 2026 +0000 wifi: b43: enforce bounds check on firmware key index in b43_rx() The firmware-controlled key index in b43_rx() can exceed the dev->key[] array size (58 entries). The existing B43_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read. Make the B43_WARN_ON check enforcing by dropping the frame when the firmware returns an invalid key index. Suggested-by: Jonas Gorski Acked-by: Michael Büsch Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani Link: https://patch.msgid.link/20260417111145.2694196-1-tristmd@gmail.com Signed-off-by: Johannes Berg commit c623b63580880cc742255eaed3d79804c1b91143 Author: Marek Szyprowski Date: Thu Apr 16 11:33:39 2026 +0200 wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Watchdog task might end between send_sig() and kthread_stop() calls, what results in the use-after-free issue. Fix this by increasing watchdog task reference count before calling send_sig() and dropping it by switching to kthread_stop_put(). Cc: stable@vger.kernel.org Fixes: 373c83a801f1 ("brcmfmac: stop watchdog before detach and free everything") Fixes: a9ffda88be74 ("brcm80211: fmac: abstract bus_stop interface function pointer") Signed-off-by: Marek Szyprowski Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260416093339.2066829-1-m.szyprowski@samsung.com Signed-off-by: Johannes Berg commit 711a9c018ad252b2807f85d44e1267b595644f9b Author: Rio Liu Date: Wed Apr 15 16:57:13 2026 +0000 wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode Some Xfinity XB8 firmware advertises >1 spatial stream MCS indexes in their basic HT-MCS set. On cards with lower spatial streams, the check would fail, and we'd be stuck with no HT when in fact work fine with its own supported rate. This change makes it so the check is only performed in strict mode. Fixes: 574faa0e936d ("wifi: mac80211: add HT and VHT basic set verification") Signed-off-by: Rio Liu Link: https://patch.msgid.link/99Mv9QEceyPrQhSP52MtAVmz0_kWJmzqotJjD9YW6LGLqk-AZloAueUyHCURilFkuqOh6Ecv8i2KKdSE1ujP3AnbU5QEouVisT1w_V3xdfc=@r26.me Signed-off-by: Johannes Berg commit 2454bd74cb989365edda476c4bd1c4e90eacf568 Author: Aditya Garg Date: Fri Apr 24 17:59:14 2026 +0000 MAINTAINERS, mailmap: update Aditya Garg's email address My Outlook email address often sends emails from kernel devs to the junk folder. Also, emails from some addresses (eg suse.de) are not received at all. Update the email to my alternate Proton Mail address. Signed-off-by: Aditya Garg Acked-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260424175846.15103-1-gargaditya08@proton.me commit 163f6494233e1679ec6fa6a4803f74ae7b1c94db Author: Johan Hovold Date: Fri Apr 24 12:38:30 2026 +0200 ata: pata_parport: switch to dynamic root device Driver core expects devices to be dynamically allocated and will, for example, complain loudly when no release function has been provided. Use root_device_register() to allocate and register the root device instead of open coding using a static device. Note that this also fixes a reference leak in the unlikely event that device_register() ever fails. Signed-off-by: Johan Hovold Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit 9d5a2b8f6281f6090002517fb9272ea07038afe8 Author: Geert Uytterhoeven Date: Tue Apr 21 09:48:32 2026 +0200 drm/color-mgmt: Typo s/R332/RGB332/ Fix a typo of "RGB332" in kerneldoc for the drm_crtc_fill_palette_332() helper. Fixes: 7ff61177b7116825 ("drm/color-mgmt: Prepare for RGB332 palettes") Signed-off-by: Geert Uytterhoeven Reviewed-by: Javier Martinez Canillas Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/c413e45c8f752a532a4ff377f7a8b9eaab4a082a.1776757681.git.geert+renesas@glider.be commit aaaa684bab1f6d9ecfc49db328facb1771fd0eb2 Author: Sasha Finkelstein Date: Mon Apr 20 14:17:43 2026 +0200 drm/appletbdrm: Use kvzalloc for big allocations This driver is attached to a ~2000x80 screen, which is a lot more than a single page. This causes out of memory errors in some rare cases. Reported-by: soopyc Closes: https://github.com/t2linux/fedora/issues/51 Signed-off-by: Sasha Finkelstein Signed-off-by: Thomas Zimmermann Reviewed-by: Aditya Garg Reviewed-by: Thomas Zimmermann Fixes: 0670c2f56e45 ("drm/tiny: add driver for Apple Touch Bars in x86 Macs") Cc: # v6.15+ Link: https://patch.msgid.link/20260420-x86-tb-vmalloc-v1-1-7757ff657223@chaosmail.tech commit 87e63466c9fc30c3d95b8741c3df1f1ff01d7f23 Author: Ravi Singh Date: Wed Apr 22 07:39:59 2026 +0000 xfs: flush delalloc blocks on ENOSPC in xfs_trans_alloc_icreate xfs_trans_alloc_icreate() can fail with ENOSPC when delalloc reservations have consumed most of the available block count (fdblocks). xfs_trans_alloc() already retries internally with xfs_blockgc_flush_all(), but that only trims post-EOF speculative preallocation and may not free enough space for the transaction reservation. Add a retry with xfs_flush_inodes() when xfs_trans_alloc() returns ENOSPC. This forces writeback of all dirty inodes via sync_inodes_sb(), converting delalloc reservations to real allocations and freeing the over-reserved portion back to fdblocks. This fixes all callers of xfs_trans_alloc_icreate() and removes the existing caller-level retry from xfs_create(), which is now handled centrally. Signed-off-by: Ravi Singh Reviewed-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 4aa8110000b0d215deef8eed283565dd0c1def88 Author: Yuho Choi Date: Sun Apr 19 20:25:13 2026 -0400 drm/sysfb: ofdrm: fix PCI device reference leaks display_get_pci_dev_of() gets a referenced PCI device via pci_get_device(). Drop that reference when pci_enable_device() fails and release it during the managed teardown path after pci_disable_device(). Without that, ofdrm leaks the pci_dev reference on both the error path and the normal cleanup path. Fixes: c8a17756c425 ("drm/ofdrm: Add ofdrm for Open Firmware framebuffers") Co-developed-by: Myeonghun Pak Signed-off-by: Myeonghun Pak Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Co-developed-by: Taegyu Kim Signed-off-by: Taegyu Kim Signed-off-by: Yuho Choi Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260420002513.216-1-dbgh9129@gmail.com commit 3d4c2268bd7243c3780fe32bf24ff876da272acf Author: Ashutosh Desai Date: Mon Apr 20 01:36:37 2026 +0000 drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mode_cmd->width / (i ? info->hsub : 1); unsigned int height = mode_cmd->height / (i ? info->vsub : 1); However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses drm_format_info_plane_width/height() which round up dimensions via DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object size check for certain pixel format and dimension combinations. For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the GEM size validation path sees height=0 instead of height=1. The expression (height - 1) then wraps to UINT_MAX as an unsigned int, causing min_size to overflow and wrap back to a small value. A tiny GEM object therefore passes the size guard, yet when the GPU accesses the chroma plane it will read or write memory beyond the object's bounds. Fix by replacing the open-coded divisions with drm_format_info_plane_width() and drm_format_info_plane_height(), which use DIV_ROUND_UP() and match the calculation already used in framebuffer_check(). Fixes: 4c3dbb2c312c ("drm: Add GEM backed framebuffer library") Cc: stable@vger.kernel.org # v4.14+ Reviewed-by: Thomas Zimmermann Signed-off-by: Ashutosh Desai Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260420013637.457751-1-ashutoshdesai993@gmail.com commit c88ab9407986836820848128ce1f90f2fa49da95 Author: Lad Prabhakar Date: Mon Apr 13 19:24:51 2026 +0100 pinctrl: renesas: rzg2l: Fix SMT register cache handling Store SMT register cache per bank instead of using a single array. On RZ/V2H(P), RZ/V2N, and RZ/G3E, the SMT register is split across two 32-bit registers: bits 0/8/16/24 control pins 0-3, while pins 4-7 are controlled by the corresponding bits in the next register. The previous implementation cached only a single SMT register, leading to incomplete save/restore of SMT state. Convert cache->smt to a per-bank array and allocate storage for both halves. Update suspend/resume handling to save and restore both SMT registers when present. Fixes: 837afa592c623 ("pinctrl: renesas: rzg2l: Add suspend/resume support for Schmitt control registers") Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260413182456.811543-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 6dba9b7268cc50166bce47608670192fd874e363 Author: Biju Das Date: Sat Mar 28 09:05:45 2026 +0000 pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume When saving/restoring pull-up/down register state during suspend/resume, the second PUPD register access was incorrectly using the same base offset as the first, effectively reading/writing the same register twice instead of the adjacent one. Add the correct + 4 byte offset to the second RZG2L_PCTRL_REG_ACCESS32 call so that pupd[1][port] is properly saved and restored from the next 32-bit register in the PUPD register pair, covering pins 4–7 of ports with 4 or more pins. Fixes: b2bd65fbb617 ("pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down") Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260328090548.84124-1-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 0cfe660559e857d7c00ab86c73e4510ce069086f Author: Matthew Rosato Date: Fri Apr 24 15:39:00 2026 -0400 KVM: s390: pci: Fix aisb calculation The current implementation of aisb calculation will erroneously index via an unsigned long * as well as multiply by 8B for every 64-bits in the offset; only one or the other is required. This throws off aisb calculations once the number of devices exceeds 64, and can result in out-of-bounds access as well as failure to indicate summary bits associated with those devices in guests. Fix this by converting to a physical address before applying the offset, as is already done in arch/s390/pci/pci_irq.c. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding") Signed-off-by: Matthew Rosato Reviewed-by: Niklas Schnelle Signed-off-by: Christian Borntraeger commit 7e070a14beaf036588f164575bbaf7011dd26285 Author: Tommaso Merciai Date: Tue Apr 7 17:34:29 2026 +0200 arm64: dts: renesas: r9a09g056: Add #mux-state-cells to usb20phyrst The renesas,rzv2h-usb2phy-reset binding schema defines #mux-state-cells as a required property. Add it to the usb20phyrst node to fix the following warnings: arch/arm64/boot/dts/renesas/r9a09g056n48-rzv2n-evk.dtb: usb20phy-reset@15830000 (renesas,r9a09g056-usb2phy-reset): '#mux-state-cells' is a required property arch/arm64/boot/dts/renesas/r9a09g056n48-rzv2n-evk-cn15-emmc.dtb: usb20phy-reset@15830000 (renesas,r9a09g056-usb2phy-reset): '#mux-state-cells' is a required property arch/arm64/boot/dts/renesas/r9a09g056n48-rzv2n-evk-cn15-sd.dtb: usb20phy-reset@15830000 (renesas,r9a09g056-usb2phy-reset): '#mux-state-cells' is a required property Fixes: 6a1b6f7e56dc ("dt-bindings: reset: renesas,rzv2h-usb2phy: Add '#mux-state-cells' property") Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/31210e05f7189b466b30eedbdda3d11726dac279.1775575276.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit d6cdab742c0548b5ce3309da108bbf7a1fc6f68e Author: Tommaso Merciai Date: Tue Apr 7 17:34:28 2026 +0200 arm64: dts: renesas: r9a09g057: Add #mux-state-cells to usb2{0,1}phyrst The renesas,rzv2h-usb2phy-reset binding schema defines #mux-state-cells as a required property. Add it to the usb20phyrst and usb21phyrst nodes to fix the following warnings: arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk.dtb: usb20phy-reset@15830000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk.dtb: usb21phy-reset@15840000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk-cn15-emmc.dtb: usb20phy-reset@15830000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk-cn15-emmc.dtb: usb21phy-reset@15840000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk-cn15-sd.dtb: usb20phy-reset@15830000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk-cn15-sd.dtb: usb21phy-reset@15840000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property Fixes: 6a1b6f7e56dc ("dt-bindings: reset: renesas,rzv2h-usb2phy: Add '#mux-state-cells' property") Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/22fb9a500cdbc3272dc23cd5e36bca5fbbec75fc.1775575276.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit ab83176d3cf1cf1c1f6e604432905bda4515d17f Author: Marek Vasut Date: Sat Mar 28 00:42:11 2026 +0100 ARM: dts: renesas: rskrza1: Drop superfluous cells Drop superfluous address-cells and size-cells to fix DTC W=1 warning: arch/arm/boot/dts/renesas/r7s72100-rskrza1.dts:32.17-72.4: Warning (avoid_unnecessary_addr_size): /flash@18000000: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" or "ranges" property Signed-off-by: Marek Vasut Fixes: 98537eb77d3ef185 ("ARM: dts: renesas: rskrza1: Add FLASH nodes") Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260327234244.91707-7-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 714e1d6bba0e0abe5c87c8e189a35fa690540df4 Author: Marek Vasut Date: Sat Mar 28 00:42:10 2026 +0100 ARM: dts: renesas: genmai: Drop superfluous cells Drop superfluous address-cells and size-cells to fix DTC W=1 warning: arch/arm/boot/dts/renesas/r7s72100-genmai.dts:28.17-55.4: Warning (avoid_unnecessary_addr_size): /flash@18000000: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" or "ranges" property Signed-off-by: Marek Vasut Fixes: 30e0a8cf886cb459 ("ARM: dts: renesas: genmai: Add FLASH nodes") Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260327234244.91707-6-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit c5f21e57e7582572dbb2eed4eaa041cad5694c90 Author: Marek Vasut Date: Sat Mar 28 00:42:09 2026 +0100 ARM: dts: renesas: r7s72100: Add missing unit address to bus node Add missing unit address to bus node to fix the following DTC W=1 warning: arch/arm/boot/dts/renesas/r7s72100.dtsi:40.11-46.4: Warning (unit_address_vs_reg): /bus: node has a reg or ranges property, but no unit name Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260327234244.91707-5-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 78c459d057e970401f59781c73e1523bc1dec51f Author: Marek Vasut Date: Sat Mar 28 00:42:08 2026 +0100 ARM: dts: renesas: r8a7792: Add missing unit address to bus node Add missing unit address to bus node to fix the following DTC W=1 warning: arch/arm/boot/dts/renesas/r8a7792.dtsi:89.12-94.4: Warning (unit_address_vs_reg): /bus: node has a reg or ranges property, but no unit name Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260327234244.91707-4-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit fd62c046cdc8fb8b1b3e358e791317b70bbc1269 Author: Marek Vasut Date: Sat Mar 28 00:42:07 2026 +0100 ARM: dts: renesas: r8a7779: Add missing unit address to bus node Add missing unit address to bus node to fix the following DTC W=1 warning: arch/arm/boot/dts/renesas/r8a7779.dtsi:707.12-712.4: Warning (unit_address_vs_reg): /bus: node has a reg or ranges property, but no unit name Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260327234244.91707-3-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 1ca2d1af3826a6de6fd300f9b122d10d21a64266 Author: Marek Vasut Date: Sat Mar 28 00:42:06 2026 +0100 ARM: dts: renesas: r8a7778: Add missing unit address to bus node Add missing unit address to bus node to fix the following DTC W=1 warning: arch/arm/boot/dts/renesas/r8a7778.dtsi:43.12-48.4: Warning (unit_address_vs_reg): /bus: node has a reg or ranges property, but no unit name Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260327234244.91707-2-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit ca743e8ac2b41c295d5ee12ed231fccb52161a0b Author: Marek Vasut Date: Thu Mar 26 05:24:01 2026 +0100 arm64: dts: renesas: rz-smarc-du-adv7513-smarc: Fix missing cells and reg in DU subnode Add missing cells and reg DT property in the DU subnode to fix the following DTC W=1 warning: arch/arm64/boot/dts/renesas/rz-smarc-du-adv7513.dtsi:29.10-33.5: Warning (unit_address_vs_reg): /fragment@1/__overlay__/ports/port@0: node has a unit name, but no reg or ranges property Signed-off-by: Marek Vasut Reviewed-by: Laurent Pinchart Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260326042411.215241-5-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 25b113f187bf07f8caa3f40a96e7ec6de850767e Author: Marek Vasut Date: Thu Mar 26 05:24:00 2026 +0100 arm64: dts: renesas: rz-smarc-cru-csi-ov5645: Fix missing cells and reg in CSI2 subnode Add missing cells and reg DT property in the CSI2 subnode to fix the following DTC W=1 warning: arch/arm64/boot/dts/renesas/rz-smarc-cru-csi-ov5645.dtsi:49.10-55.5: Warning (unit_address_vs_reg): /fragment@2/__overlay__/ports/port@0: node has a unit name, but no reg or ranges property Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260326042411.215241-4-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 2016dde0685a091002851df8005757150a0e9350 Author: Marek Vasut Date: Thu Mar 26 05:23:59 2026 +0100 arm64: dts: renesas: salvator-panel: Fix missing cells and reg in DTO Add missing cells and reg DT property in the Salvator-X panel DTO to fix the following DTC W=1 warning: arch/arm64/boot/dts/renesas/salvator-panel-aa104xd12.dtso:30.10-34.5: Warning (unit_address_vs_reg): /fragment@2/__overlay__/ports/port@1: node has a unit name, but no reg or ranges property Signed-off-by: Marek Vasut Reviewed-by: Laurent Pinchart Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260326042411.215241-3-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit d289b5f56ab7fe939dc5bfc87c856b46fe5def38 Author: Marek Vasut Date: Thu Mar 26 05:23:58 2026 +0100 arm64: dts: renesas: draak/ebisu-panel: Fix missing cells and reg in DTO Add missing cells and reg DT property in the Draak/Ebisu panel DTO to fix the following DTC W=1 warning: arch/arm64/boot/dts/renesas/draak-ebisu-panel-aa104xd12.dtso:30.10-34.5: Warning (unit_address_vs_reg): /fragment@2/__overlay__/ports/port@1: node has a unit name, but no reg or ranges property Signed-off-by: Marek Vasut Reviewed-by: Laurent Pinchart Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260326042411.215241-2-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 86637727c11a105499e9faa38f3422dfcf4d211d Author: Geert Uytterhoeven Date: Tue Jan 6 18:09:51 2026 +0100 arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks According to the documentation, the internal clock input for the BRG is SGASYNCD4_PERW_BUSφ. Fixes: c13a643e2c491f5b ("arm64: dts: renesas: Add R8A78000 SoC support") Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/459d360a8332f92b3766b30814e7e1c76169aaf7.1767719254.git.geert+renesas@glider.be commit fca20fcb76a20655daf18738f4a88c638a6bb64c Author: Yuto Ohnuki Date: Fri Apr 10 18:06:15 2026 +0100 xfs: check da node block pad field during scrub The da node block header (xfs_da3_node_hdr) contains a __pad32 field that should always be zero. Add a check for this during directory and attribute btree scrubbing. Since old kernels may have written non-zero padding without issues, flag this as an optimization opportunity (preen) rather than corruption. Signed-off-by: Yuto Ohnuki Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit af47a4be6a90c8bfc874f9994ac9c15813b9718b Author: Wilfred Mallawa Date: Fri Apr 17 12:16:30 2026 +1000 xfs: fix memory leak for data allocated by xfs_zone_gc_data_alloc() In xfs_zone_gc_mount(), on error, a struct xfs_zone_gc_data allocated with xfs_zone_gc_data_alloc() is freed with kfree(), however, this doesn't free the underlying folios or the rmap_irecs. Use xfs_zone_gc_data_free() to correctly free this memory. Fixes: 080d01c41d44 ("xfs: implement zoned garbage collection") Cc: stable@vger.kernel.org # v6.15 Signed-off-by: Wilfred Mallawa Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 592975da8c3ca87b043077e6eafa37665eae7936 Author: Wilfred Mallawa Date: Wed Apr 15 09:45:14 2026 +1000 xfs: fix memory leak on error in xfs_alloc_zone_info() Currently, the 0th index of the zi_used_bucket_bitmap array is not freed on error due to the pre-decrement then evaluate semantic of the while loop used in xfs_alloc_zone_info(). Fix it by allowing for the i == 0 case to be covered. Fixes: 080d01c41d44 ("xfs: implement zoned garbage collection") Cc: stable@vger.kernel.org # v6.15 Reviewed-by: Damien Le Moal Reviewed-by: Carlos Maiolino Signed-off-by: Wilfred Mallawa Reviewed-by: Hans Holmberg Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 939919ccddfcc379bb82b1f90f732d9a5cb32cc8 Author: Yuto Ohnuki Date: Sat Apr 11 15:24:15 2026 +0100 xfs: check directory data block header padding in scrub Add the missing scrub check for the pad field in directory data block headers. Old kernels may have written non-zero padding without issue, and the write path now self-heals stale padding on modification. Flag non-zero padding as an optimization opportunity (preen) rather than corruption. Add xchk_fblock_set_preen helper for reporting file fork block issues that could be optimized. The trace event xchk_fblock_preen already exists. Signed-off-by: Yuto Ohnuki Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 8fbb1877dfa5e26bda1baf8cc6abd3f805098486 Author: Yuto Ohnuki Date: Sat Apr 11 15:24:14 2026 +0100 xfs: zero directory data block padding on write verification Old kernels did not zero the pad field in xfs_dir3_data_hdr when initializing directory data blocks, so existing filesystems may have non-zero padding on disk. Zero the pad field in xfs_dir3_data_write_verify alongside the existing LSN and checksum updates. The pad field is pure alignment padding with no runtime meaning, so zeroing it during write verification is safe and has no additional I/O cost. This lets filesystems gradually self-heal stale non-zero padding as directories are modified, without requiring an explicit repair pass. Suggested-by: Dave Chinner Signed-off-by: Yuto Ohnuki Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 00dd8d7ec5253c6273023a0fd6dc08683e0bdfef Author: Yuto Ohnuki Date: Sat Apr 11 15:24:13 2026 +0100 xfs: zero entire directory data block header region at init xfs_dir3_data_init currently zeroes only the xfs_dir3_blk_hdr portion of the directory data block header, then manually initializes the bestfree entries in a loop. This leaves the pad field in xfs_dir3_data_hdr uninitialized and requires explicit zeroing of each bestfree slot. Zero the entire header region (geo->data_entry_offset bytes) unconditionally before setting individual fields. This covers all current and future header fields, all padding (implicit and explicit), and the bestfree array, so the manual zeroing loop for bestfree can be removed. Suggested-by: Dave Chinner Signed-off-by: Yuto Ohnuki Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit bfb4dc533d0abaca07013dd71e6b5c6f182232b3 Author: Jinliang Zheng Date: Fri Apr 10 18:11:06 2026 +0800 xfs: remove the meaningless XFS_ALLOC_FLAG_FREEING In xfs_refcount_finish_one(), there's no need to pass XFS_ALLOC_FLAG_FREEING to xfs_alloc_read_agf(). So remove it. Signed-off-by: Jinliang Zheng Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit b51d33ea8a164bb5f0eec8ad817fa9730ac2b577 Author: Til Kaiser Date: Mon Apr 13 15:52:34 2026 +0200 pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function The qcom pinctrl core supports marking functions that represent GPIO mode via PINCTRL_GPIO_PINFUNCTION(), so that strict pinmuxing does not reject GPIO requests for pins that are muxed to the GPIO function. ipq4019 still describes its gpio function with QCA_PIN_FUNCTION(gpio), so it is not treated as a GPIO pin function. As a result, GPIO consumers can still conflict with pinctrl states that select the "gpio" function. Add a QCA_GPIO_PIN_FUNCTION() helper and use it for the ipq4019 gpio function, matching how the msm-based qcom drivers handle this. This allows ipq4019 to keep the GPIO-related pin configuration in DTS without tripping over strict pinmux ownership checks. Fixes: cc85cb96e2e4 ("pinctrl: qcom: make the pinmuxing strict") Signed-off-by: Til Kaiser Reviewed-by: Dmitry Baryshkov Signed-off-by: Linus Walleij commit b560d414239232c6ed7205d3795d3f588034d69b Author: Bartosz Golaszewski Date: Fri Apr 10 09:09:35 2026 +0200 pinctrl: mediatek: moore: implement gpio_chip::get_direction() If the gpio_chip::get_direction() callback is not implemented by the GPIO controller driver, GPIOLIB emits a warning. Implement get_direction() for the GPIO part of pinctrl-moore. Fixes: 471e998c0e31 ("gpiolib: remove redundant callback check") Fixes: e623c4303ed1 ("gpiolib: sanitize the return value of gpio_chip::get_direction()") Reported-by: Frank Wunderlich Closes: https://lore.kernel.org/all/20260409132724.126258-1-linux@fw-web.de/ Signed-off-by: Bartosz Golaszewski Tested-By: Frank Wunderlich Signed-off-by: Linus Walleij commit 0fc8f6200d2313278fbf4539bbab74677c685531 Merge: d13e855ee923c2 254f49634ee16a Author: Thomas Zimmermann Date: Mon Apr 27 10:26:49 2026 +0200 Merge drm/drm-fixes into drm-misc-fixes Getting fixes and updates from v7.1-rc1. Signed-off-by: Thomas Zimmermann commit 39f1c201b93f4ff71631bac72cff6eb155f976a4 Merge: 909eac682c984c dfd2a8b07c6cc9 Author: Paolo Bonzini Date: Mon Apr 27 04:24:41 2026 -0400 Merge tag 'kvm-x86-selftests_kernel_types-7.1' of https://github.com/kvm-x86/linux into HEAD KVM selftests type renames for 7.1 Renames types across all KVM selftests to more closely align with types used in the kernel: vm_vaddr_t -> gva_t vm_paddr_t -> gpa_t uint64_t -> u64 uint32_t -> u32 uint16_t -> u16 uint8_t -> u8 int64_t -> s64 int32_t -> s32 int16_t -> s16 int8_t -> s8 Using the kernel's preferred types eliminates a source of friction for many contributors, as the majority of KVM selftests contributions come from kernel developers. The kernel names are also shorter, which allows for more concise code, and in any many cases eliminates newlines thanks to shorter types and parameter names. Rename variables and parameters as well as types, e.g. gpa instead of paddr, to again align with the kernel, and in a few cases to remove ambiguity, e.g. where paddr is used to refer to a _host_ physical address. commit 909eac682c984c3cb02485d5950c2a8d573c1667 Merge: 1101baca986698 4ce98bf0865c34 Author: Paolo Bonzini Date: Mon Apr 27 04:24:34 2026 -0400 Merge tag 'kvmarm-fixes-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.1, take #1 - Allow tracing for non-pKVM, which was accidentally disabled when the series was merged - Rationalise the way the pKVM hypercall ranges are defined by using the same mechanism as already used for the vcpu_sysreg enum - Enforce that SMCCC function numbers relayed by the pKVM proxy are actually compliant with the specification - Fix a couple of feature to idreg mappings which resulted in the wrong sanitisation being applied - Fix the GICD_IIDR revision number field that could never been written correctly by userspace - Make kvm_vcpu_initialized() correctly use its parameter instead of relying on the surrounding context - Enforce correct ordering in __pkvm_init_vcpu(), plugging a potential pin leak at the same time - Move __pkvm_init_finalise() to a less dangerous spot, avoiding future problems - Restore functional userspace irqchip support after a four year breakage (last functional kernel was 5.18...). This is obviously ripe for garbage collection. - ... and the usual lot of spelling fixes commit 1101baca98669833fb3ad2dcd24bc06f9e70e66b Author: Sean Christopherson Date: Mon Apr 20 12:26:44 2026 -0700 KVM: selftests: Add check_steal_time_uapi() implementation for LoongArch Define check_steal_time_uapi() for LoongArch so that the steal_time test builds. Note, while LoongArch's steal_time_init() has some funky asserts, none of the code is uniquely verifying KVM's uAPI. Cc: Jiakai Xu Cc: Jiakai Xu Cc: Andrew Jones Cc: Anup Patel Cc: Tianrui Zhao Cc: Bibo Mao Cc: Huacai Chen Fixes: 40351ed924dd ("KVM: selftests: Refactor UAPI tests into dedicated function") Signed-off-by: Sean Christopherson Message-ID: <20260420192644.3892050-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 5b31044e649e3e54c2caef135c09b371c2fbcd08 Author: Harry Yoo (Oracle) Date: Mon Apr 27 16:09:53 2026 +0900 mm/slab: return NULL early from kmalloc_nolock() in NMI on UP On UP kernels (!CONFIG_SMP), spin_trylock() is a no-op that unconditionally succeeds even when the lock is already held. As a result, kmalloc_nolock() called from NMI context can re-enter the slab allocator and acquire n->list_lock that the interrupted context is already holding, corrupting slab state. With CONFIG_DEBUG_SPINLOCK on UP, the following BUG is triggered with the slub_kunit test module: BUG: spinlock trylock failure on UP on CPU#0, kunit_try_catch/243 [...] Call Trace: dump_stack_lvl+0x3f/0x60 do_raw_spin_trylock+0x41/0x50 _raw_spin_trylock+0x24/0x50 get_from_partial_node+0x120/0x4d0 ___slab_alloc+0x8a/0x4c0 kmalloc_nolock_noprof+0x164/0x310 [...] Fix this by returning NULL early when invoked from NMI on a UP kernel. Link: https://lore.kernel.org/linux-mm/ad_cqe51pvr1WaDg@hyeyoo Cc: stable@vger.kernel.org Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Signed-off-by: Harry Yoo (Oracle) Link: https://patch.msgid.link/20260427-nolock-api-fix-v2-2-a6b83a92d9a4@kernel.org Signed-off-by: Vlastimil Babka (SUSE) commit 620b46ed6ae17c8438d889c8c0cfddab36a1476c Author: Harry Yoo (Oracle) Date: Mon Apr 27 16:09:52 2026 +0900 mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP On UP kernels (!CONFIG_SMP), spin_trylock() is a no-op that unconditionally succeeds even when the lock is already held. As a result, alloc_frozen_pages_nolock() called from NMI context can re-enter rmqueue() and acquire the zone lock that the interrupted context is already holding, corrupting the freelists. With CONFIG_DEBUG_SPINLOCK on UP, the following BUG is triggered with the slub_kunit test module: BUG: spinlock trylock failure on UP on CPU#0, kunit_try_catch/243 [...] Call Trace: dump_stack_lvl+0x3f/0x60 do_raw_spin_trylock+0x41/0x50 _raw_spin_trylock+0x24/0x50 rmqueue.isra.0+0x2a9/0xa70 get_page_from_freelist+0xeb/0x450 alloc_frozen_pages_nolock_noprof+0x111/0x1e0 allocate_slab+0x42a/0x500 ___slab_alloc+0xa7/0x4c0 kmalloc_nolock_noprof+0x164/0x310 [...] Fix this by returning NULL early when invoked from NMI on a UP kernel. Link: https://lore.kernel.org/linux-mm/ad_cqe51pvr1WaDg@hyeyoo Cc: stable@vger.kernel.org Fixes: d7242af86434 ("mm: Introduce alloc_frozen_pages_nolock()") Signed-off-by: Harry Yoo (Oracle) Link: https://patch.msgid.link/20260427-nolock-api-fix-v2-1-a6b83a92d9a4@kernel.org Signed-off-by: Vlastimil Babka (SUSE) commit 23c39cb598977f10909a2387c5e5f34afc1d6933 Author: Arnd Bergmann Date: Fri Mar 20 16:18:24 2026 +0100 media: qcom: camss: avoid format string warning clang-22 warns about csiphy_match_clock_name() taking a variable format string that is not checked against the 'int index' argument: drivers/media/platform/qcom/camss/camss-csiphy.c:566:44: error: diagnostic behavior may be improved by adding the 'format(printf, 2, 3)' attribute to the declaration of 'csiphy_match_clock_name' [-Werror,-Wmissing-format-attribute] 561 | static bool csiphy_match_clock_name(const char *clock_name, const char *format, | __attribute__((format(printf, 2, 3))) 562 | int index) 563 | { 564 | char name[16]; /* csiphyXXX_timer\0 */ 565 | 566 | snprintf(name, sizeof(name), format, index); | ^ drivers/media/platform/qcom/camss/camss-csiphy.c:561:13: note: 'csiphy_match_clock_name' declared here 561 | static bool csiphy_match_clock_name(const char *clock_name, const char *format, | ^ Change the function to use a snprintf() style format string that allows this to be checked at the call site. Signed-off-by: Arnd Bergmann Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit d31fac47b39f5e1ed85a587688ca70b793e421b4 Author: Wenmeng Liu Date: Fri Mar 13 18:13:04 2026 +0800 media: qcom: camss: Add missing clocks for VFE lite on sa8775p Add missing required clocks (cpas_ahb and camnoc_axi) for VFE lite instances on sa8775p platform. These clocks are necessary for proper VFE lite operation: Reviewed-by: Bryan O'Donoghue Signed-off-by: Wenmeng Liu Fixes: e7b59e1d06fb ("media: qcom: camss: Add support for VFE 690") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit fe56c674118aa46da1a3e65aa22ca709ebd7d812 Author: Wenmeng Liu Date: Fri Mar 13 18:13:03 2026 +0800 media: qcom: camss: Fix csid clock configuration for sa8775p Fix the mismatch between clock list and clock rate table for CSID lite instances. The current implementation has 5 clocks defined but only 2 are actually needed (vfe_lite_csid and vfe_lite_cphy_rx), while the clock rate table doesn't match this configuration. Update both clock list and rate table to maintain consistency: - Remove unused clocks: cpas_vfe_lite, vfe_lite_ahb, vfe_lite - Update clock rate table to match the remaining two clocks Signed-off-by: Wenmeng Liu Reviewed-by: Bryan O'Donoghue Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit dd1b373941079cc102cc18bc68884e18245f5912 Author: Wenmeng Liu Date: Fri Mar 13 18:13:02 2026 +0800 media: qcom: camss: Fix csid IRQ offset for sa8775p Fix BUF_DONE_IRQ_STATUS_RDI_OFFSET calculation for csid lite on sa8775p platform. The offset should be 0 for csid lite on sa8775p, Signed-off-by: Wenmeng Liu Reviewed-by: Bryan O'Donoghue Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 3e0b2053751657ed2924adfe3ff25b1450231e33 Author: Dmitry Baryshkov Date: Fri Mar 27 22:19:55 2026 +0200 media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 Follow the commit bfe1326573ff ("venus: Fix for H265 decoding failure.") and increase H265D_MAX_SLICE following firmware requirements on that platform. Otherwise decoding of the H.265 streams fails with the "insufficient scratch_1 buffer size" from the firmware. Signed-off-by: Dmitry Baryshkov Reviewed-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Reviewed-by: Konrad Dybcio [bod: Fixed commit log withthe => with the] Fixes: e1f5d32608ec ("media: iris: Add internal buffer calculation for HEVC and VP9 decoders") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 3d9593ad1a58c5acc3e5fa2a48222bb7632e6812 Author: Vishnu Reddy Date: Thu Mar 5 18:58:31 2026 +0530 media: iris: fix use-after-free of fmt_src during MBPF check During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst->lock while the core->lock protects the list of active instances. The race happens because these locks cover different scopes, inst->lock protects only the internals of a single instance, while the Macro Blocks Per Frame (MBPF) checker walks the core list under core->lock and reads fields like fmt_src->width and fmt_src->height. At the same time, iris_close() may free fmt_src and fmt_dst under inst->lock while the instance is still present in the core list. This allows a situation where the MBPF checker, still iterating through the core list, reaches an instance whose fmt_src was already freed by another thread and ends up dereferencing a dangling pointer, resulting in a use-after-free. This happens because the MBPF checker assumes that any instance in the core list is fully valid, but the freeing of fmt_src and fmt_dst without removing the instance from the core list is not correct. The correct ordering is to defer freeing fmt_src and fmt_dst until after the instance has been removed from the core list and all teardown under the core lock has completed, ensuring that no dangling pointers are ever exposed during MBPF checks. Reviewed-by: Vikash Garodia Signed-off-by: Vishnu Reddy Reviewed-by: Dikshita Agarwal Fixes: 5ad964ad5656 ("media: iris: Initialize and deinitialize encoder instance structure") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 95a337f92f0a602d4f935315bfbc8bf07f475e65 Author: Vikash Garodia Date: Fri Mar 13 18:49:36 2026 +0530 media: iris: switch to hardware mode after firmware boot Currently the driver switches the vcodec GDSC to hardware (HW) mode before firmware load and boot sequence. GDSC can be powered off, keeping in hw mode, thereby the vcodec registers programmed in TrustZone (TZ) carry default (reset) values. Move the transition to HW mode after firmware load and boot sequence. The bug was exposed with driver configuring different stream ids to different devices via iommu-map. With registers carrying reset values, VPU would not generate desired stream-id, thereby leading to SMMU fault. For vpu4, when GDSC is switched to HW mode, there is a need to perform the reset operation. Without reset, there are occasional issues of register corruption observed. Hence the vpu GDSC switch also involves the reset. Co-developed-by: Vishnu Reddy Signed-off-by: Vishnu Reddy Signed-off-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Reviewed-by: Dmitry Baryshkov [bod: occassional => occasional] Fixes: dde659d37036 ("media: iris: Introduce vpu ops for vpu4 with necessary hooks") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 4a49ae56b0e4268d48fd96babe0cc68596bc301a Author: Thomas Fourier Date: Fri Feb 13 10:13:27 2026 +0100 media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() The core->iface_q_table_vaddr buffer is alloc'd with size queue_size but freed with sizeof(*q_tbl_hdr) which is different. Change the dma_free_attrs() size. Signed-off-by: Thomas Fourier Reviewed-by: Dikshita Agarwal Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit f27cfdcfc916bb59297825805f4c3499f89f9e76 Author: Dikshita Agarwal Date: Mon Feb 16 12:37:42 2026 +0530 media: iris: Fix use-after-free in iris_release_internal_buffers() The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where session_release_buf() may free the buffer. The caller, iris_release_internal_buffers(), continued to access `buffer` after the call, leading to a potential use-after-free. Fix this by setting BUF_ATTR_PENDING_RELEASE before calling session_release_buf(), and reverting the flag if the call fails. This ensures no dereference occurs after potential freeing. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit a297c5165f91366cbc3490e630aabd1c0f70efb8 Author: Arnd Bergmann Date: Thu Feb 5 15:56:19 2026 +0100 media: iris: fix QCOM_MDT_LOADER dependency When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_IRIS=y, the kernel fails to link: x86_64-linux-ld: drivers/media/platform/qcom/iris/iris_firmware.o: in function `iris_fw_load': iris_firmware.c:(.text+0xb0): undefined reference to `qcom_mdt_get_size' iris_firmware.c:(.text+0xfd): undefined reference to `qcom_mdt_load' The problem is the conditional 'select' statement. Change this to make the driver built-in here regardless of CONFIG_ARCH_QCOM. Signed-off-by: Arnd Bergmann Reviewed-by: Konrad Dybcio Reviewed-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit aa23c94cc433b145d1ce93820ecdfe16d8940e28 Author: Arnd Bergmann Date: Mon Mar 30 12:08:21 2026 +0100 media: venus: fix QCOM_MDT_LOADER dependency When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_VENUS=y, the kernel fails to link: x86_64-linux-ld: drivers/media/platform/qcom/venus/firmware.o: in function `venus_boot': firmware.c:(.text+0x1e3): undefined reference to `qcom_mdt_get_size' firmware.c:(.text+0x25a): undefined reference to `qcom_mdt_load' firmware.c:(.text+0x272): undefined reference to `qcom_mdt_load_no_init' The problem is the conditional 'select' statement. Change this to make the driver built-in here regardless of CONFIG_ARCH_QCOM, same as for the similar IRIS driver. Signed-off-by: Arnd Bergmann Reviewed-by: Konrad Dybcio Reviewed-by: Dikshita Agarwal Fixes: 0399b696f7f4 ("media: venus: fix compile-test build on non-qcom ARM platform") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 6cdc46b38cf146ce81d4831b6472dbf7731849a2 Author: Dmitry Torokhov Date: Sun Apr 26 21:09:33 2026 -0700 Input: xpad - fix out-of-bounds access for Share button xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array. Fix this by calculating the offset and checking bounds against the packet length. Reported-by: Greg Kroah-Hartman Fixes: 4ef46367073b ("Input: xpad - fix Share button on Xbox One controllers") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 2905281cbda52ec9df540113b35b835feb5fafd3 Author: Greg Kroah-Hartman Date: Mon Apr 20 18:00:27 2026 +0200 Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size nexio_read_data() pulls data_len and x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len) and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the buffer's data[] capacity and x_len to data_len. Cc: Dmitry Torokhov Fixes: 5197424cdccc ("Input: usbtouchscreen - add NEXIO (or iNexio) support") Cc: stable Assisted-by: gkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026042026-chlorine-epidermis-fd6d@gregkh Signed-off-by: Dmitry Torokhov commit 98f69975d4c0434ca2e6e8cfa1d8d51647a20593 Merge: 254f49634ee16a 2f3835771dff51 Author: Martin K. Petersen Date: Sun Apr 26 21:15:04 2026 -0400 Merge branch '7.1/scsi-queue' into 7.1/scsi-fixes Pull in remaining commits from 7.1/scsi-queue. Signed-off-by: Martin K. Petersen commit 0cbc300257d9b399491909806777f504ec687c1d Author: David Disseldorp Date: Sun Apr 26 21:39:37 2026 +1000 smb/client: remove unused smb3_parse_opt() Commit abdb1742a3123 ("cifs: get rid of mount options string parsing") removed the last caller. Signed-off-by: David Disseldorp Signed-off-by: Steve French commit b0bf14546bcefa4ea49f5efcd7db2a99f0cabde9 Author: Olga Kornievskaia Date: Fri Apr 3 11:20:55 2026 -0400 nfsd: fix GET_DIR_DELEGATION when VFS leases are disabled When leases are disabled on the server, running xfstest generic/309 leads to an error because GET_DIR_DELEGATION returns EINVAL. nfsd_get_dir_deleg() can fail in several ways: like memory allocation and unable to get a lease because either leases are disable or it's already held. Currently only the condition "already held" is translated to returning directory-delegation-is-unavailable error. However, other failure conditions are likely temporary and thus should result in the same kind of error. Fixes: 8b99f6a8c116 ("nfsd: wire up GET_DIR_DELEGATION handling") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit 15e8bae5d930c91b8739a87d75db0a6efca3cb32 Author: Danilo Krummrich Date: Thu Apr 23 14:46:35 2026 +0200 MAINTAINERS: nova: update mailing list The nouveau mailing list has some issues (e.g. with stripping Cc entries from replies when using notmuch + b4 based workflows). Besides that, having a separate mailing list for nova also helps to better distinguish nova from nouveau and makes it easier to track nova-specific discussions. Replace the nouveau mailing list with the new nova-gpu@lists.linux.dev mailing list for both nova-core and nova-drm, and remove the patchwork entries, since those are bound to the nouveau mailing list and not used by nova anyway. Link: https://lore.kernel.org/all/bc2517c2-6772-4cbd-8fd7-6dbdcdd13eab@nvidia.com/ Reviewed-by: Joel Fernandes Reviewed-by: John Hubbard Acked-by: Alexandre Courbot Link: https://patch.msgid.link/20260423124649.38793-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 5f69165b7e4215f02247b0c64052c71b2f66d73a Author: Mukesh Kumar Chaurasiya (IBM) Date: Sun Apr 26 15:17:25 2026 +0530 rust/drm: import ARef from sync crate ARef is defined in sync and is getting used from types causing the build to fail. Fix this by using ARef from sync module. Fixes: 80df573af9ef ("rust: drm: gem: shmem: Add DRM shmem helper abstraction") Signed-off-by: Mukesh Kumar Chaurasiya (IBM) Link: https://patch.msgid.link/20260426094725.2188668-2-mkchauras@gmail.com [ Add missing Fixes: tag. - Danilo ] Signed-off-by: Danilo Krummrich commit 8ed3311131077712cdd0b3afec6909b9388ad3e4 Author: Li Jian Date: Fri Apr 17 18:53:14 2026 +0800 ASoC: ES8389: convert to devm_clk_get_optional() to get clock When enabling ES8390 via ACPI description, es8389 would fail to obtain a clock source, causing the driver to fail to initialize. This was not an issue with older kernels, but since commit abae8e57e49a ("clk: generalize devm_clk_get() a bit"), devm_clk_get() would return an error pointer when a clock source was not detected (instead of falling back to a static clock), causing the driver to fail early. Use devm_clk_get_optional() instead to return to the previous behaviour, allowing the use of a static clock source. Cc: stable@vger.kernel.org Signed-off-by: Li Jian Link: https://patch.msgid.link/tencent_7C78374FB9F4B3A37101E5C719715D8BC40A@qq.com Signed-off-by: Mark Brown commit 5e8bb0cc72f1d52d8ac2a88f4c952e2e98056aed Author: Johan Hovold Date: Tue Apr 21 14:53:52 2026 +0200 spi: cadence-quadspi: fix runtime pm and clock imbalance on unbind Make sure to balance the runtime PM usage count before returning on probe failure (to allow the controller to suspend after a probe deferral) and to only drop the usage count on driver unbind to avoid a clock disable imbalance. Also restore the autosuspend setting. Fixes: 0578a6dbfe75 ("spi: spi-cadence-quadspi: add runtime pm support") Cc: stable@vger.kernel.org # 6.7 Cc: Dhruva Gole Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421125354.1534871-5-johan@kernel.org Signed-off-by: Mark Brown commit 233db2cb14db8b1935dda52a6affd97276462b82 Author: Johan Hovold Date: Tue Apr 21 14:53:51 2026 +0200 spi: cadence-quadspi: fix unclocked access on unbind Make sure that the controller is runtime resumed before disabling it during driver unbind to avoid an unclocked register access. This issue was flagged by Sashiko when reviewing a controller deregistration fix. Fixes: 0578a6dbfe75 ("spi: spi-cadence-quadspi: add runtime pm support") Cc: stable@vger.kernel.org # 6.7 Cc: Dhruva Gole Link: https://sashiko.dev/#/patchset/20260414134319.978196-1-johan%40kernel.org?part=2 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421125354.1534871-4-johan@kernel.org Signed-off-by: Mark Brown commit cba53fe20c18688c17ca668ad0e4ec05e31c70d3 Author: Johan Hovold Date: Tue Apr 21 14:53:50 2026 +0200 spi: cadence-quadspi: fix clock imbalance on probe failure Drop the bogus runtime PM get on probe failures that was never needed and that leaks a usage count reference while preventing the clocks from being disabled (as runtime PM has not yet been enabled). Fixes: 1889dd208197 ("spi: cadence-quadspi: Fix clock disable on probe failure path") Cc: stable@vger.kernel.org # 6.19 Cc: Anurag Dutta Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421125354.1534871-3-johan@kernel.org Signed-off-by: Mark Brown commit 5ff4d5d1af0c7517bd8db83c95c4247a9729a548 Author: Johan Hovold Date: Tue Apr 21 14:53:49 2026 +0200 spi: cadence-quadspi: fix runtime pm disable imbalance on probe failure A recent attempt to fix the probe error handling introduced a runtime PM disable depth imbalance by incorrectly disabling runtime PM on early failures (e.g. probe deferral). Fixes: f18c8cfa4f1a ("spi: cadence-qspi: Fix probe error path and remove") Cc: stable@vger.kernel.org # 7.0 Cc: Miquel Raynal (Schneider Electric) Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421125354.1534871-2-johan@kernel.org Signed-off-by: Mark Brown commit ecea4f0e9db2fb6ab4a68a59c5aba0d8f59a9566 Author: Johan Hovold Date: Tue Apr 21 14:36:13 2026 +0200 spi: cadence: fix clock imbalance on probe failure Make sure that the controller is active before disabling clocks on probe failure to avoid unbalanced clock disable. Also drop the usage count before returning (so that the controller can be suspended after a probe deferral) and restore the autosuspend setting. Fixes: d36ccd9f7ea4 ("spi: cadence: Runtime pm adaptation") Cc: stable@vger.kernel.org # 4.7 Cc: Shubhrajyoti Datta Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421123615.1533617-3-johan@kernel.org Signed-off-by: Mark Brown commit 5b1689a41f02955c5361944f748a4812a6ff9307 Author: Johan Hovold Date: Tue Apr 21 14:36:12 2026 +0200 spi: cadence: fix unclocked access on unbind Make sure that the controller is runtime resumed before disabling it during driver unbind to avoid unclocked register access and unbalanced clock disable. Also restore the autosuspend setting. This issue was flagged by Sashiko when reviewing a controller deregistration fix. Fixes: d36ccd9f7ea4 ("spi: cadence: Runtime pm adaptation") Cc: stable@vger.kernel.org # 4.7 Cc: Shubhrajyoti Datta Link: https://sashiko.dev/#/patchset/20260414134319.978196-1-johan%40kernel.org?part=1 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421123615.1533617-2-johan@kernel.org Signed-off-by: Mark Brown commit 74c876bfd71b1023029a483d7213015201f62b53 Author: Ajay Kumar Nandam Date: Mon Apr 20 23:32:21 2026 +0530 ASoC: codecs: wcd937x: fix AUX PA sequencing and mixer controls Enable AUX PA sequencing during AUX DAC DAPM events and keep the AUX-specific RX supplies enabled while the path is active. Add the missing AUX-related mixer controls, including CLSH PA and DSD left/right switches, so AUX playback can be routed from userspace. Signed-off-by: Ajay Kumar Nandam Link: https://patch.msgid.link/20260420180221.785113-1-ajay.nandam@oss.qualcomm.com Signed-off-by: Mark Brown commit dad701bdb74368e6da30177b1d9e5529e3381591 Author: Sasha Levin Date: Sat Apr 25 20:02:49 2026 -0400 ASoC: tegra: Remove stale snd-soc-tegra-utils composite module definition kconfiglint reports two warnings for sound/soc/tegra/Makefile: M002: composite module 'snd-soc-tegra-utils' defined but not in any obj-* M008: composite module 'snd-soc-tegra-utils': tegra_asoc_utils.o has no source file The composite module definition `snd-soc-tegra-utils-y += tegra_asoc_utils.o` references a source file that no longer exists and defines a module that is never included in any obj-* target. The tegra_asoc_utils module was originally introduced in commit a3cd50deef7b ("ASoC: Tegra: Move utilities to separate module") by Stephen Warren in 2011 to provide shared clock/rate utility functions for Tegra machine drivers. At that time, the Makefile had both the composite definition (`snd-soc-tegra-utils-objs`) and the build target (`obj-$(CONFIG_SND_TEGRA_SOC) += snd-soc-tegra-utils.o`). In 2021, commit 8c1b3b159300 ("ASoC: tegra: Squash utils into common machine driver") by Dmitry Osipenko merged tegra_asoc_utils.c into tegra_asoc_machine.c, deleting both the .c and .h files. That commit correctly removed the obj-* build target line but overlooked the composite module definition line (`snd-soc-tegra-utils-objs += tegra_asoc_utils.o`). The orphaned line persisted unnoticed and was even mechanically updated in 2024 by commit 51a50d6ad727 ("ASoC: tegra: Use *-y instead of *-objs in Makefile") by Takashi Iwai, which converted it from `-objs` to `-y` syntax as part of a treewide cleanup — inadvertently refreshing a stale definition. Remove the orphaned composite module definition since it serves no purpose: the source file was deleted, the obj-* target was already removed, and the functionality now lives in tegra_asoc_machine.c. Assisted-by: Claude:claude-opus-4-6 kconfiglint Signed-off-by: Sasha Levin Link: https://patch.msgid.link/20260426000249.54799-1-sashal@kernel.org Signed-off-by: Mark Brown commit c7ecb6a61908c2604dda6e42da66724d256de7b9 Author: James Calligeros Date: Sat Apr 25 10:44:05 2026 +1000 ASoC: tas2770: Fix order of operations for temperature calculation The order of operations to derive the temperature from the temp register values was wrong, since 1000 / 16 is not an integer. This resulted in the calculated temperature value deviating from the value represented by the registers slightly, which was most obvious when the registers were zeroed (-92.265 *C vs the expected -93.000 *C). Scale the reading before dividing the whole thing by 16 to correct this. Fixes: ff73e2780169 ("ASoC: tas2770: expose die temp to hwmon") Signed-off-by: James Calligeros Link: https://patch.msgid.link/20260425-tas27xx-hwmon-fixes-v1-3-83c13b8e8f54@gmail.com Signed-off-by: Mark Brown commit 4cfb5971c2fbfac061c23fb4224a3a008199de81 Author: James Calligeros Date: Sat Apr 25 10:44:03 2026 +1000 ASoC: tas2764: Mark die temp register as volatile Reading the temperature register always returns the first value read from the chip due to regcache. Mark TAS2764_TEMP as volatile to prevent returning stale, cached values when reading the die temp. Fixes: 186dfc85f9a8 ("ASoC: tas2764: expose die temp to hwmon") Signed-off-by: James Calligeros Link: https://patch.msgid.link/20260425-tas27xx-hwmon-fixes-v1-1-83c13b8e8f54@gmail.com Signed-off-by: Mark Brown commit 7643978722aac3a012783ce12dc534eba7c51698 Author: John Madieu Date: Sat Apr 25 09:29:35 2026 +0000 spi: rockchip: Drop unused and broken CR0 macros Two CTRLR0 macros are defined but never referenced, and both are wrong: - CR0_XFM_MASK shifts by SPI_XFM_OFFSET, which does not exist anywhere in the tree. The intended symbol is CR0_XFM_OFFSET. - CR0_MTM_OFFSET is defined as 0x21, i.e. bit 33 of a 32-bit register. The value is meaningless and the macro is unused. Drop both. They can be re-introduced correctly when an actual user appears. Signed-off-by: John Madieu Link: https://patch.msgid.link/20260425092936.2590132-3-john.madieu@gmail.com Signed-off-by: Mark Brown commit b4683a239a409d65f88052f5630c748a8ba070cd Author: John Madieu Date: Sat Apr 25 09:29:34 2026 +0000 spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ rockchip_spi_isr() decides whether the current interrupt was the cs-inactive event by reading IMR: if (rs->cs_inactive && readl_relaxed(rs->regs + ROCKCHIP_SPI_IMR) & INT_CS_INACTIVE) ctlr->target_abort(ctlr); IMR is the interrupt mask register: it tells which sources are enabled, not which one fired. In the PIO path, rockchip_spi_prepare_irq() enables both INT_RF_FULL and INT_CS_INACTIVE in IMR when rs->cs_inactive is true: if (rs->cs_inactive) writel_relaxed(INT_RF_FULL | INT_CS_INACTIVE, rs->regs + ROCKCHIP_SPI_IMR); so the IMR check is always true once cs_inactive is enabled, and every PIO interrupt - including normal RF_FULL completions - is dispatched to ctlr->target_abort(), aborting the transfer. The bug is reachable on ROCKCHIP_SPI_VER2_TYPE2 in target mode with a DMA-capable controller when the transfer is short enough to fall back to PIO (rockchip_spi_can_dma() returns false below fifo_len). Read ISR (which is RISR masked by IMR) so the check actually reflects which interrupt fired, and parenthesise the expression for clarity while at it. Fixes: 869f2c94db92 ("spi: rockchip: Stop spi slave dma receiver when cs inactive") Signed-off-by: John Madieu Link: https://patch.msgid.link/20260425092936.2590132-2-john.madieu@gmail.com Signed-off-by: Mark Brown commit 3c6f06a200796ae7b2b1065e8a6499b138e27a50 Author: Bard Liao Date: Fri Apr 24 18:50:31 2026 +0800 ASoC: SOF: Intel: add an empty adr_link An empty adr_link is expected to terminate the for (adr_link = mach_params->links; adr_link->num_adr; adr_link++) loop. Allocate link_num + 1 links to add an empty adr_link. Fixes: 5226d19d4cae5 ("ASoC: SOF: Intel: use sof_sdw as default SDW machine driver") Signed-off-by: Bard Liao Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260424105031.114053-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit b0f6f4ac7d5d04fe2adcdd63ed1cd1ad505b8958 Author: Guilherme G. Piccoli Date: Thu Apr 23 15:30:58 2026 -0300 ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED Commit 671dd2ffbd8b ("ASoC: amd: acp: Add new cpu dai and dailink creation for I2S BT instance") introduced a change that "broke" Steam Deck's audio probe, in the OLED model, as observed in the following dmesg snippet: [...] snd_sof_amd_vangogh 0000:04:00.5: Topology: ABI 3:26:0 Kernel ABI 3:23:1 sof_mach nau8821-max: ASoC: physical link acp-bt-codec (id 2) not exist sof_mach nau8821-max: ASoC: topology: could not load header: -22 snd_sof_amd_vangogh 0000:04:00.5: tplg amd/sof-tplg/sof-vangogh-nau8821-max.tplg component load failed -22 snd_sof_amd_vangogh 0000:04:00.5: error: failed to load DSP topology -22 snd_sof_amd_vangogh 0000:04:00.5: ASoC error (-22): at snd_soc_component_probe() on 0000:04:00.5 sof_mach nau8821-max: ASoC: failed to instantiate card -22 sof_mach nau8821-max: error -EINVAL: Failed to register card(sof-nau8821-max) sof_mach nau8821-max: probe with driver sof_mach failed with error -22 [...] Notice the quotes in "broke": it's not really a bug in such commit, but instead a problem with a topology file from Steam Deck OLED. This was discussed to great extent in [1], and Cristian proposed a pretty simple and functional change that resolved the issue for the Deck's issue. That change, though, would break other devices, so it wasn't accepted upstream. And the proper suggested solution (fix the topology) was never implemented, so Valve's kernel (and anyone that wants to boot the mainline on Steam Deck OLED) is carrying that fix downstream. So, we propose hereby a different approach: a DMI quirk, as many already present in the sound drivers, to address this issue solely on Steam Deck OLED, not breaking other devices and as a bonus, allowing simple patch up in case eventually the topology file gets fixed (we'd just need to check against any DMI info reflecting that or the topology/FW versions). The motivation of such upstream quirk is related to users that want to test latest kernel trees on their devices and get no only non-working sound device, but seems some games (like Ori and the Blind Forest) can't properly work without a proper functional audio device. Example of such report can be seen at [2]. Cc: Mark Brown Cc: Robert Beckett Cc: Umang Jain Fixes: 671dd2ffbd8b ("ASoC: amd: acp: Add new cpu dai and dailink creation for I2S BT instance") Link: https://lore.kernel.org/r/20231209205351.880797-11-cristian.ciocaltea@collabora.com/ [1] Link: https://bugzilla.kernel.org/show_bug.cgi?id=218677 [2] Reviewed-by: Cristian Ciocaltea Reviewed-by: Mario Limonciello Tested-by: Melissa Wen Signed-off-by: Guilherme G. Piccoli Link: https://patch.msgid.link/20260423183505.116445-1-gpiccoli@igalia.com Signed-off-by: Mark Brown commit 4b7774eeab8d66c22f02f5c120602df154a87e12 Author: Colin Ian King Date: Fri Apr 24 12:24:25 2026 +0100 regmap: sdw-mbq: Fix spelling mistake "undeferable" -> "undeferrable" There is a spelling mistake in a dev_warn message. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20260424112425.32129-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit 54900126ae0a2671f8790a7f95706b9ea95fac4e Author: John Madieu Date: Sat Apr 25 02:47:25 2026 +0000 spi: rzv2h-rspi: Fix silent failure in clock setup error path rzv2h_rspi_setup_clock() is declared to return u32 but returns -EINVAL when no valid clock parameters are found. Cast to u32, -EINVAL becomes 0xffffffea, which is a non-zero value. The caller in rzv2h_rspi_prepare_message() guards against failure with: rspi->freq = rzv2h_rspi_setup_clock(rspi, speed_hz); if (!rspi->freq) return -EINVAL; Because 0xffffffea is non-zero, the check is bypassed and the controller proceeds to program SPBR/SPCMD with stale values, leading to an unknown bit rate. Return 0 on the failed-search path, consistent with the existing clk_set_rate() failure path which already returns 0. Fixes: 77d931584dd3 ("spi: rzv2h-rspi: make transfer clock rate finding chip-specific") Signed-off-by: John Madieu Reviewed-by: Biju Das Reviewed-by: Cosmin Tanislav Link: https://patch.msgid.link/20260425024725.2393632-1-john.madieu.xa@bp.renesas.com Signed-off-by: Mark Brown commit 254f49634ee16a731174d2ae34bc50bd5f45e731 Author: Linus Torvalds Date: Sun Apr 26 14:19:00 2026 -0700 Linux 7.1-rc1 commit 14479877c1ec9667edb4a7c20a8d7a704e7249ca Merge: 20b64cf8705a0f 522567362b6340 Author: Linus Torvalds Date: Sun Apr 26 14:03:20 2026 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fix from Stephen Boyd: "One more fix for the merge window to avoid a boot hang on Raspberry Pi 3B by marking the VEC clk critical so that it doesn't get turned off and hang the bus" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: bcm: rpi: Mark VEC clock as CLK_IGNORE_UNUSED commit 20b64cf8705a0f6268bb9a320eb6b4c425f3ec6c Merge: b935117fe6d1af 3177779ae17db4 Author: Linus Torvalds Date: Sun Apr 26 09:51:29 2026 -0700 Merge tag 'tsm-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm Pull PCIe TSP update from Dan Williams: "A small update for the TSM core. It is arguably a fix and coming in late as I have been offline the past few weeks: - Drop class_create() for the 'tsm' class" * tag 'tsm-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm: virt: coco: change tsm_class to a const struct commit b935117fe6d1af576e39b1f18c9e875f44bd146f Merge: 2ff1bc41ef9133 75f7c47ccd78c9 Author: Linus Torvalds Date: Sat Apr 25 17:04:15 2026 -0700 Merge tag 'kbuild-fixes-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nicolas Schier: - builddeb - avoid recompiles for non-cross-compiles Avoid triggering complete rebuilds for non-cross-compile Debian package builds by only triggering the rebuild of host tools for actual cross-compile builds - Never respect CONFIG_WERROR / W=e to fixdep Avoid spurious rebuilds of fixdep w/ and w/o -Werror during a single kbuild invocation by never respecting CONFIG_WERROR for fixdep * tag 'kbuild-fixes-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: Never respect CONFIG_WERROR / W=e to fixdep kbuild: builddeb - avoid recompiles for non-cross-compiles commit 2ff1bc41ef9133a52c116b36e5e88430353a8ba5 Merge: 211d5933141197 6112da1ea4a7cf Author: Linus Torvalds Date: Sat Apr 25 16:58:34 2026 -0700 Merge tag 'power-utilities-2026.04.25' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull power utility updates from Len Brown: "x86_energy_perf_policy: - Initial SoC Slider support turbostat: - Display HT siblings in cpu# order - Add Module-ID column - Print Core-ID and APIC-ID in hex - Fix misc bugs" * tag 'power-utilities-2026.04.25' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power x86_energy_perf_policy: Version 2026.04.25 tools/power x86_energy_perf_policy.8: Document SoC Slider Options tools/power x86_energy_perf_policy: Enhances SoC Slider related checks tools/power turbostat: v2026.04.21 tools/power turbostat: Process HT siblings in CPU order tools/power turbostat: Show module_id column tools/power turbostat: Print core_id and apic_id in hex tools/power turbostat: Cleanup print helper functions tools/power turbostat: Fix --cpu-set 1 regression on HT systems tools/power turbostat: Fix --cpu-set 0 regression on HT systems tools/power turbostat: Fix unrecognized option '-P' tools/power turbostat: Fix AMD RAPL regression on big systems tools/power/x86: Add SOC slider and platform profile support commit 211d5933141197b37a7501271e49e4b88540615f Merge: 1d9f1b5e4374c6 0fedce7244e4b8 Author: Linus Torvalds Date: Sat Apr 25 16:39:03 2026 -0700 Merge tag 'rtc-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "Subsystem: - add data_race() in rtc_dev_poll() Drivers: - remove i2c_match_id usage - abx80x: Disable alarm feature if no interrupt attached - ti-k3: support resuming from IO DDR low power mode" * tag 'rtc-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: abx80x: Disable alarm feature if no interrupt attached rtc: ntxec: fix OF node reference imbalance rtc: pic32: allow driver to be compiled with COMPILE_TEST rtc: ti-k3: Add support to resume from IO DDR low power mode rtc: cmos: Use platform_get_irq_optional() in cmos_platform_probe() dt-bindings: rtc: add olpc,xo1-rtc to trivial-rtc dt-bindings: rtc: sc2731: Add compatible for SC2730 rtc: add data_race() in rtc_dev_poll() rtc: armada38x: zalloc + calloc to single allocation dt-bindings: rtc: isl12026: convert to YAML schema dt-bindings: rtc: microcrystal,rv3028: Allow to specify vdd-supply rtc: max77686: convert to i2c_new_ancillary_device dt-bindings: rtc: mpfs-rtc: permit resets rtc: rx8025: Remove use of i2c_match_id() rtc: rv8803: Remove use of i2c_match_id() rtc: rs5c372: Remove use of i2c_match_id() rtc: pcf2127: Remove use of i2c_match_id() rtc: m41t80: Remove use of i2c_match_id() rtc: abx80x: Remove use of i2c_match_id() commit 1d9f1b5e4374c6b40df1a56b35901312ec98c9af Merge: 897d54018cc9aa 949692da721157 Author: Linus Torvalds Date: Sat Apr 25 16:20:52 2026 -0700 Merge tag 'for-next-tpm-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "Here are the accumulated fixes for 7.1-rc1 and a single structural change worth mentioning separately: Rafael's commit converting tpm_crb from ACPI driver to a platform driver" * tag 'for-next-tpm-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: tpm_tis: stop transmit if retries are exhausted tpm: tpm_tis: add error logging for data transfer tpm: avoid -Wunused-but-set-variable tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() tpm: Fix auth session leak in tpm2_get_random() error path tpm: i2c: atmel: fix block comment formatting tpm_crb: Convert ACPI driver to a platform one tpm: Make tcpci_pm_ops variable static const commit 6112da1ea4a7cfac35e51a20d17ca9cdf946c368 Merge: b488997b9cb006 f1c35c73191b7d Author: Len Brown Date: Sat Apr 25 14:26:32 2026 -0400 Merge branches 'turbostat' and 'x86_energy_perf_policy' into power-utilities commit f1c35c73191b7d23ed4bbc660a7b9ed5b32614e0 Author: Len Brown Date: Sat Apr 25 13:26:16 2026 -0400 tools/power x86_energy_perf_policy: Version 2026.04.25 Since v2025.11.22: Initial SoC Slider support SoC Slider is an SoC-wide power/performance policy setting. On SoC Slider systems, EPP plays a diminished role. Whitespace cleanup via: indent -npro -kr -i8 -ts8 -sob -l160 -ss -ncs -cp1 No functional changes Signed-off-by: Len Brown commit 18c5b9ea4ea4be5ed9b5b6add30a2a7911326224 Author: Len Brown Date: Sat Apr 25 12:10:54 2026 -0400 tools/power x86_energy_perf_policy.8: Document SoC Slider Options x86_energy_perf_policy accesses the SoC Slider via standard user/kernel APIs to the processor_thermal_soc_slider driver. Machines that support SoC Slider largely use it instead of EPP, which may continue to exist in a diminished role, or vanish entirely. Signed-off-by: Len Brown commit 25ff5848c05bc660739089cf9c6de4a166bd7932 Author: Len Brown Date: Wed Apr 15 15:12:29 2026 -0400 tools/power x86_energy_perf_policy: Enhances SoC Slider related checks When processor_thermal_soc_slider is loaded, its slider and offset modparams are visible. Check that the driver actually registered the profile named "SoC Slider" before reading or writing these modparams. n.b. This utility allows writing the Slider and Offset modparams even if the driver policy is not "balanced". Currently the processor_thermal_soc_slider consults those modparams only in "balanced" mode. Signed-off-by: Len Brown commit 522567362b634015ca85b5460482ee0843feb105 Author: Maíra Canal Date: Fri Apr 24 16:34:52 2026 +0100 clk: bcm: rpi: Mark VEC clock as CLK_IGNORE_UNUSED On Raspberry Pi 3B, the VEC clock is used by the VideoCore firmware display driver, which remains active until the vc4 driver loads and sends NOTIFY_DISPLAY_DONE. If this clock is disabled during boot, a bus lockup happens and the firmware becomes unresponsive, causing a complete system lockup. Mark the VEC clock with CLK_IGNORE_UNUSED so it survives the unused clock disablement and remains available until the vc4 driver takes over display management. Fixes: 672299736af6 ("clk: bcm: rpi: Manage clock rate in prepare/unprepare callbacks") Reported-by: Mark Brown Closes: https://lore.kernel.org/r/5f0bec08-f458-4fba-8bf3-06817a100c4c@sirena.org.uk Signed-off-by: Maíra Canal Link: https://patch.msgid.link/20260401111416.562279-2-mcanal@igalia.com Tested-by: Mark Brown Signed-off-by: Mark Brown Acked-by: Brian Masney # Active contributor to clk Reviewed-by: Stefan Wahren Signed-off-by: Stephen Boyd commit 897d54018cc9aa97fd1529ca08a53b429d05a566 Merge: 129d6eb266e084 448aaf54d3ae1b Author: Linus Torvalds Date: Sat Apr 25 07:48:33 2026 -0700 Merge tag 'fbdev-for-7.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: - request memory region before use (cobalt_lcdfb, clps711x-fb, hgafb) - reference cleanups in failure path (offb, savage) - a spelling fix (atyfb) * tag 'fbdev-for-7.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: hgafb: Request memory region before ioremap fbdev: clps711x-fb: Request memory region for MMIO fbdev: cobalt_lcdfb: Request memory region fbdev: atyfb: Fix spelling mistake "enfore" -> "enforce" fbdev: savage: fix probe-path EDID cleanup leaks fbdev: offb: fix PCI device reference leak on probe failure commit 129d6eb266e0848c9bf45da6e30291688c12b5ad Merge: 27d128c1cff64c c6e61c06d60617 Author: Linus Torvalds Date: Sat Apr 25 07:44:26 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM updates from Russell King: - fix a race condition handling PG_dcache_clean - further cleanups for the fault handling, allowing RT to be enabled - fixing nzones validation in adfs filesystem driver - fix for module unwinding * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9463/1: Allow to enable RT ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache() ARM: 9471/1: module: fix unwind section relocation out of range error fs/adfs: validate nzones in adfs_validate_bblk() ARM: provide individual is_translation_fault() and is_permission_fault() ARM: move FSR fault status definitions before fsr_fs() ARM: use BIT() and GENMASK() for fault status register fields ARM: move is_permission_fault() and is_translation_fault() to fault.h ARM: move vmalloc() lazy-page table population ARM: ensure interrupts are enabled in __do_user_fault() commit deb7b2f93d0129b79425f830a1e5e7e1bb2c4973 Author: Tejun Heo Date: Fri Apr 24 14:31:36 2026 -1000 sched_ext: Release cpus_read_lock on scx_link_sched() failure in root enable scx_root_enable_workfn() takes cpus_read_lock() before scx_link_sched(sch), but the `if (ret) goto err_disable` on failure skips the matching cpus_read_unlock() - all other err_disable gotos along this path drop the lock first. scx_link_sched() only returns non-zero on the sub-sched path (parent != NULL), so the leak path is unreachable via the root caller today. Still, the unwind is out of line with the surrounding paths. Drop cpus_read_lock() before goto err_disable. v2: Correct Fixes: tag (Andrea Righi). Fixes: 25037af712eb ("sched_ext: Add rhashtable lookup for sub-schedulers") Reported-by: Chris Mason Signed-off-by: Tejun Heo commit 05b4a9a9bc37f1fa289a8f07b4fbfc3ae681b650 Author: Tejun Heo Date: Fri Apr 24 14:31:36 2026 -1000 sched_ext: Reject NULL-sch callers in scx_bpf_task_set_slice/dsq_vtime scx_prog_sched(aux) returns NULL for TRACING / SYSCALL BPF progs that have no struct_ops association when the root scheduler has sub_attach set. scx_bpf_task_set_slice() and scx_bpf_task_set_dsq_vtime() pass that NULL into scx_task_on_sched(sch, p), which under CONFIG_EXT_SUB_SCHED is rcu_access_pointer(p->scx.sched) == sch. For any non-scx task p->scx.sched is NULL, so NULL == NULL returns true and the authority gate is bypassed - a privileged but non-struct_ops-associated prog can poke p->scx.slice / p->scx.dsq_vtime on arbitrary tasks. Reject !sch up front so the gate only admits callers with a resolved scheduler. Fixes: 245d09c594ea ("sched_ext: Enforce scheduler ownership when updating slice and dsq_vtime") Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit ea7c716a24aebe887e0990649ab697bd698cc325 Author: Tejun Heo Date: Fri Apr 24 14:31:36 2026 -1000 sched_ext: Refuse cross-task select_cpu_from_kfunc calls select_cpu_from_kfunc() skipped pi_lock for @p when called from ops.select_cpu() or another rq-locked SCX op, assuming the held lock protects @p. scx_bpf_select_cpu_dfl() / __scx_bpf_select_cpu_and() accept an arbitrary KF_RCU task_struct, so a caller in e.g. ops.select_cpu(p1) or ops.enqueue(p1) can pass some other p2 - the held pi_lock / rq lock is p1's, not p2's - and reading p2->cpus_ptr / nr_cpus_allowed races with set_cpus_allowed_ptr() and migrate_disable_switch() on another CPU. Abort the scheduler on cross-task calls in both branches: for ops.select_cpu() use scx_kf_arg_task_ok() to verify @p is the wake-up task recorded in current->scx.kf_tasks[] by SCX_CALL_OP_TASK_RET(); for other rq-locked SCX ops compare task_rq(p) against scx_locked_rq(). v2: Switch the in_select_cpu cross-task check from direct_dispatch_task comparison to scx_kf_arg_task_ok(). The former spuriously rejects when ops.select_cpu() calls scx_bpf_dsq_insert() first, then calls scx_bpf_select_cpu_*() on the same task. (Andrea Righi) Fixes: 0022b328504d ("sched_ext: Decouple kfunc unlocked-context check from kf_mask") Reported-by: Chris Mason Signed-off-by: Tejun Heo Cc: Andrea Righi commit c0e8ddc76d54402171787414b1b8eb387812f1f6 Author: Tejun Heo Date: Fri Apr 24 14:31:36 2026 -1000 sched_ext: Align cgroup #ifdef guards with SUB_SCHED vs GROUP_SCHED Two EXT_GROUP_SCHED/SUB_SCHED guards are misclassified: - scx_root_enable_workfn()'s cgroup_get(cgrp) and the err_put_cgrp unwind in scx_alloc_and_add_sched() are under `#if GROUP || SUB`, but the matching cgroup_put() in scx_sched_free_rcu_work() is inside `#ifdef SUB` only (via sch->cgrp, stored only under SUB). GROUP-only would leak a reference on every root-sched enable. - sch_cgroup() / set_cgroup_sched() live under `#if GROUP || SUB` but touch SUB-only fields (sch->cgrp, cgroup->scx_sched). GROUP-only wouldn't compile. GROUP needs CGROUP_SCHED; SUB needs only CGROUPS. CGROUPS=y/CGROUP_SCHED=n gives the reachable GROUP=n, SUB=y combination; GROUP=y, SUB=n isn't reachable today (SUB is def_bool y under CGROUPS). Neither miscategorization triggers a real bug in any reachable config, but keep the guards honest: - Narrow cgroup_get and err_put_cgrp to `#ifdef SUB` (matches the free-side put). - Move sch_cgroup() and set_cgroup_sched() to a separate `#ifdef SUB` block with no-op stubs for the !SUB case; keep root_cgroup() and scx_cgroup_{ lock,unlock}() under `#if GROUP || SUB` since those only need cgroup core. Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit d292aa00de1aea72961f94c0db43f6b5c72684c9 Author: Tejun Heo Date: Fri Apr 24 14:31:36 2026 -1000 sched_ext: Make bypass LB cpumasks per-scheduler scx_bypass_lb_{donee,resched}_cpumask were file-scope statics shared by all scheduler instances. With CONFIG_EXT_SUB_SCHED, multiple sched instances each arm their own bypass_lb_timer; concurrent bypass_lb_node() calls RMW the global cpumasks with no lock, corrupting donee/resched decisions. Move the cpumasks into struct scx_sched, allocate them alongside the timer in scx_alloc_and_add_sched(), free them in scx_sched_free_rcu_work(). Fixes: 95d1df610cdc ("sched_ext: Implement load balancer for bypass mode") Cc: stable@vger.kernel.org # v6.19+ Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 4155fb489fa175ec74eedde7d02219cf2fe74303 Author: Tejun Heo Date: Fri Apr 24 14:31:36 2026 -1000 sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before scx_prio_less() runs from core-sched's pick_next_task() path with rq locked but invokes ops.core_sched_before() with NULL locked_rq, leaving scx_locked_rq_state NULL. If the BPF callback calls a kfunc that re-acquires rq based on scx_locked_rq() - e.g. scx_bpf_cpuperf_set(cpu) - it re-acquires the already-held rq. Pass task_rq(a). Fixes: 7b0888b7cc19 ("sched_ext: Implement core-sched support") Cc: stable@vger.kernel.org # v6.12+ Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 207d76a372fb1bb324eadc8cb5bcaa0a8da7cefd Author: Tejun Heo Date: Fri Apr 24 14:31:36 2026 -1000 sched_ext: Pass held rq to SCX_CALL_OP() for dump_cpu/dump_task scx_dump_state() walks CPUs with rq_lock_irqsave() held and invokes ops.dump_cpu / ops.dump_task with NULL locked_rq, leaving scx_locked_rq_state NULL. If the BPF callback calls a kfunc that re-acquires rq based on scx_locked_rq() - e.g. scx_bpf_cpuperf_set(cpu) - it re-acquires the already-held rq. Pass the held rq to SCX_CALL_OP(). Thread it into scx_dump_task() too. The pre-loop ops.dump call runs before rq_lock_irqsave() so keeps rq=NULL. Fixes: 07814a9439a3 ("sched_ext: Print debug dump after an error exit") Cc: stable@vger.kernel.org # v6.12+ Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 7fb39e4eb4c3db52e4707a6a1cd45362f7e803f5 Author: Tejun Heo Date: Fri Apr 24 14:31:36 2026 -1000 sched_ext: Save and restore scx_locked_rq across SCX_CALL_OP SCX_CALL_OP{,_RET}() unconditionally clears scx_locked_rq_state to NULL on exit. Correct at the top level, but ops can recurse via scx_bpf_sub_dispatch(): a parent's ops.dispatch calls the helper, which invokes the child's ops.dispatch under another SCX_CALL_OP. When the inner call returns, the NULL clobbers the outer's state. The parent's BPF then calls kfuncs like scx_bpf_cpuperf_set() which read scx_locked_rq()==NULL and re-acquire the already-held rq. Snapshot scx_locked_rq_state on entry and restore on exit. Rename the rq parameter to locked_rq across all SCX_CALL_OP* macros so the snapshot local can be typed as 'struct rq *' without colliding with the parameter token in the expansion. SCX_CALL_OP_TASK{,_RET}() and SCX_CALL_OP_2TASKS_RET() funnel through the two base macros and inherit the fix. Fixes: 4f8b122848db ("sched_ext: Add basic building blocks for nested sub-scheduler dispatching") Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 2f2ea77092660b53bfcbc4acc590b57ce9ab5dce Author: Tejun Heo Date: Fri Apr 24 14:31:35 2026 -1000 sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail dispatch_enqueue()'s FIFO-tail path used list_empty(&dsq->list) to decide whether to set dsq->first_task on enqueue. dsq->list can contain parked BPF iterator cursors (SCX_DSQ_LNODE_ITER_CURSOR), so list_empty() is not a reliable "no real task" check. If the last real task is unlinked while a cursor is parked, first_task becomes NULL; the next FIFO-tail enqueue then sees list_empty() == false and skips the first_task update, leaving scx_bpf_dsq_peek() returning NULL for a non-empty DSQ. Test dsq->first_task directly, which already tracks only real tasks and is maintained under dsq->lock. Fixes: 44f5c8ec5b9a ("sched_ext: Add lockless peek operation for DSQs") Cc: stable@vger.kernel.org # v6.19+ Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi Cc: Ryan Newton commit cc2a387d330d1fc51a9b7f211a7e5d39c9f0ab94 Author: Tejun Heo Date: Fri Apr 24 14:31:35 2026 -1000 sched_ext: Resolve caller's scheduler in scx_bpf_destroy_dsq() / scx_bpf_dsq_nr_queued() scx_bpf_create_dsq() resolves the calling scheduler via scx_prog_sched(aux) and inserts the new DSQ into that scheduler's dsq_hash. Its inverse scx_bpf_destroy_dsq() and the query helper scx_bpf_dsq_nr_queued() were hard-coded to rcu_dereference(scx_root), so a sub-scheduler could only destroy or query DSQs in the root scheduler's hash - never its own. If the root had a DSQ with the same id, the sub-sched silently destroyed it and the root aborted on the next dispatch ("invalid DSQ ID 0x0.."). Take a const struct bpf_prog_aux *aux via KF_IMPLICIT_ARGS and resolve the scheduler with scx_prog_sched(aux), matching scx_bpf_create_dsq(). Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 80afd4c84bc8f5e80145ce35279f5ce53f6043db Author: Tejun Heo Date: Fri Apr 24 14:31:35 2026 -1000 sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters scx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring scx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs. If the loaded scheduler is disabled and freed (via RCU work) and another is enabled between the naked load and the rwsem acquire, the reader sees scx_cgroup_enabled=true (the new scheduler's) but dereferences the freed one - UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...). scx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write (scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section correlates @sch with the enabled snapshot. Fixes: a5bd6ba30b33 ("sched_ext: Use cgroup_lock/unlock() to synchronize against cgroup operations") Cc: stable@vger.kernel.org # v6.18+ Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 21a5a97ba47842ef0c52d6c89e501dce27806550 Author: Tejun Heo Date: Fri Apr 24 14:31:35 2026 -1000 sched_ext: Don't disable tasks in scx_sub_enable_workfn() abort path scx_sub_enable_workfn()'s prep loop calls __scx_init_task(sch, p, false) without transitioning task state, then sets SCX_TASK_SUB_INIT. If prep fails partway, the abort path runs __scx_disable_and_exit_task(sch, p) on the marked tasks. Task state is still the parent's ENABLED, so that dispatches to the SCX_TASK_ENABLED arm and calls scx_disable_task(sch, p) - i.e. child->ops.disable() - for tasks on which child->ops.enable() never ran. A BPF sub-scheduler allocating per-task state in enable/freeing in disable would operate on uninitialized state. The dying-task branch in scx_disable_and_exit_task() has the same problem, and scx_enabling_sub_sched was cleared before the abort cleanup loop - a task exiting during cleanup tripped the WARN and skipped both ops.exit_task and the SCX_TASK_SUB_INIT clear, leaking per-task resources and leaving the task stuck. Introduce scx_sub_init_cancel_task() that calls ops.exit_task with cancelled=true - matching what the top-level init path does when init_task itself returns -errno. Use it in the abort loop and in the dying-task branch. scx_enabling_sub_sched now stays set until the abort loop finishes clearing SUB_INIT, so concurrent exits hitting the dying-task branch can still find @sch. That branch also clears SCX_TASK_SUB_INIT unconditionally when seen, leaving the task unmarked even if the WARN fires. Fixes: 337ec00b1d9c ("sched_ext: Implement cgroup sub-sched enabling and disabling") Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit da2d81b4118a74e65d2335e221a38d665902a98c Author: Tejun Heo Date: Fri Apr 24 14:31:35 2026 -1000 sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu() bypass_lb_cpu() transfers tasks between per-CPU bypass DSQs without migrating them - task_cpu() only updates when the donee later consumes the task via move_remote_task_to_local_dsq(). If the LB timer fires again before consumption and the new DSQ becomes a donor, @p is still on the previous CPU and task_rq(@p) != donor_rq. @p can't be moved without its own rq locked. Skip such tasks. Fixes: 95d1df610cdc ("sched_ext: Implement load balancer for bypass mode") Cc: stable@vger.kernel.org # v6.19+ Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 4fda9f0e7c950da4fe03cedeb2ac818edf5d03e9 Author: Tejun Heo Date: Fri Apr 24 14:31:35 2026 -1000 sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed iter_new bpf_iter_scx_dsq_new() clears kit->dsq on failure and bpf_iter_scx_dsq_{next,destroy}() guard against that. scx_dsq_move() doesn't - it dereferences kit->dsq immediately, so a BPF program that calls scx_bpf_dsq_move[_vtime]() after a failed iter_new oopses the kernel. Return false if kit->dsq is NULL. Fixes: 4c30f5ce4f7a ("sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq()") Cc: stable@vger.kernel.org # v6.12+ Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 411d3ef1a70589755e3beed2f5bf1f8aa0c27d1a Author: Tejun Heo Date: Fri Apr 24 14:31:35 2026 -1000 sched_ext: Unregister sub_kset on scheduler disable When ops.sub_attach is set, scx_alloc_and_add_sched() creates sub_kset as a child of &sch->kobj, which pins the parent with its own reference. The disable paths never call kset_unregister(), so the final kobject_put() in bpf_scx_unreg() leaves a stale reference and scx_kobj_release() never runs, leaking the whole struct scx_sched on every load/unload cycle. Unregister sub_kset in scx_root_disable() and scx_sub_disable() before kobject_del(&sch->kobj). Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit bd2d76455b65aab77652823919db128a8e585825 Author: Tejun Heo Date: Fri Apr 24 10:14:32 2026 -1000 sched_ext: Defer scx_hardlockup() out of NMI scx_hardlockup() runs from NMI and eventually calls scx_claim_exit(), which takes scx_sched_lock. scx_sched_lock isn't NMI-safe and grabbing it from NMI context can lead to deadlocks. The hardlockup handler is best-effort recovery and the disable path it triggers runs off of irq_work anyway. Move the handle_lockup() call into an irq_work so it runs in IRQ context. Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 27d128c1cff64c3b8012cc56dd5a1391bb4f1821 Merge: f3e3dbcea15e20 92d5a606721f75 Author: Linus Torvalds Date: Fri Apr 24 15:17:23 2026 -0700 Merge tag 'trace-ring-buffer-v7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ring-buffer fix from Steven Rostedt: - Fix accounting of persistent ring buffer rewind On boot up, the head page is moved back to the earliest point of the saved ring buffer. This is because the ring buffer being read by user space on a crash may not save the part it read. Rewinding the head page back to the earliest saved position helps keep those events from being lost. The number of events is also read during boot up and displayed in the stats file in the tracefs directory. It's also used for other accounting as well. On boot up, the "reader page" is accounted for but a rewind may put it back into the buffer and then the reader page may be accounted for again. Save off the original reader page and skip accounting it when scanning the pages in the ring buffer. * tag 'trace-ring-buffer-v7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Do not double count the reader_page commit f3e3dbcea15e20f7413afd8c791a496f0b80e80b Merge: fa58e6e9000c1c 895a9b37917d27 Author: Linus Torvalds Date: Fri Apr 24 15:06:55 2026 -0700 Merge tag 'block-7.1-20260424' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Series for zloop, fixing a variety of issues - t10-pi code cleanup - Fix for a merge window regression with the bio memory allocation mask - Fix for a merge window regression in ublk, caused by an issue with the maple tree iteration code at teardown - ublk self tests additions - Zoned device pgmap fixes - Various little cleanups and fixes * tag 'block-7.1-20260424' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (21 commits) Revert "floppy: fix reference leak on platform_device_register() failure" ublk: avoid unpinning pages under maple tree spinlock ublk: refactor common helper ublk_shmem_remove_ranges() ublk: fix maple tree lockdep warning in ublk_buf_cleanup selftests: ublk: add ublk auto integrity test selftests: ublk: enable test_integrity_02.sh on fio 3.42 selftests: ublk: remove unused argument to _cleanup block: only restrict bio allocation gfp mask asked to block block/blk-throttle: Add WQ_PERCPU to alloc_workqueue users block: Add WQ_PERCPU to alloc_workqueue users block: relax pgmap check in bio_add_page for compatible zone device pages block: add pgmap check to biovec_phys_mergeable floppy: fix reference leak on platform_device_register() failure ublk: use unchecked copy helpers for bio page data t10-pi: reduce ref tag code duplication zloop: remove irq-safe locking zloop: factor out zloop_mark_{full,empty} helpers zloop: set RQF_QUIET when completing requests on deleted devices zloop: improve the unaligned write pointer warning zloop: use vfs_truncate ... commit fa58e6e9000c1cc76a7a0c06ea3e68d728cc4247 Merge: b85900e91c8402 d0be8884f56b0b Author: Linus Torvalds Date: Fri Apr 24 15:00:54 2026 -0700 Merge tag 'io_uring-7.1-20260424' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix for a NOMMU bug with io_uring, where NOMMU doesn't grab page refs at mmap time. NOMMU also has entirely broken FOLL_PIN support, yet here we are - A few fixes covering minor issues introduced in this merge window - data race annotation to shut up KCSAN for when io-wq limits are applied - A nospec addition for direct descriptor file updating. Rest of the direct descriptor path already had this, but for some reason the update did not. Now they are all the same - Various minor defensive changes that claude identified and suggested terrible fixes for, turned into actually useful cleanups: - Use kvfree() for the imu cache. These can come from kmalloc or vmalloc depending on size, but the in-cache ones are capped where it's always kmalloc based. Change to kvfree() in the cleanup path, making future changes unlikely to mess that up - Negative kbuf consumption lengths. Can't happen right now, but cqe->res is used directly, which if other codes changes could then be an error value - Fix for an issue with the futex code, where partial wakes on a vectored fuxes would potentially wake the same futex twice, rather than move on to the next one. This could confuse an application as it would've expected the next futex to have been woken - Fix for a bug with ring resizing, where SQEs or CQEs might not have been copied correctly if large SQEs or CQEs are used in the ring. Application side issue, where SQEs or CQEs might have been lost during resize - Fix for a bug where EPOLL_URING_WAKE might have been lost, causing a multishot poll to not be terminated when it's nested, like it should have been - Fix for an issue with signed comparison of poll references for the slow path - Fix for a user struct UAF in the zcrx code - Two minor zcrx cleanups * tag 'io_uring-7.1-20260424' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: take page references for NOMMU pbuf_ring mmaps io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE io_uring/zcrx: warn on freelist violations io_uring/zcrx: clear RQ headers on init io_uring/zcrx: fix user_struct uaf io_uring/register: fix ring resizing with mixed/large SQEs/CQEs io_uring/futex: ensure partial wakes are appropriately dequeued io_uring/rw: add defensive hardening for negative kbuf lengths io_uring/rsrc: use kvfree() for the imu cache io_uring/rsrc: unify nospec indexing for direct descriptors io_uring: fix spurious fput in registered ring path io_uring: fix iowq_limits data race in tctx node addition io_uring/tctx: mark io_wq as exiting before error path teardown io_uring/tctx: check for setup tctx->io_wq before teardown io_uring/poll: fix signed comparison in io_poll_get_ownership() commit b85900e91c8402bedc1db14e6d293e26f25d30d4 Merge: ac2dc6d57425ff e6614b88d59d11 Author: Linus Torvalds Date: Fri Apr 24 14:20:03 2026 -0700 Merge tag 'nfs-for-7.1-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client updates from Trond Myklebust: "Bugfixes: - Fix handling of ENOSPC so that if we have to resend writes, they are written synchronously - SUNRPC RDMA transport fixes from Chuck - Several fixes for delegated timestamps in NFSv4.2 - Failure to obtain a directory delegation should not cause stat() to fail with NFSv4 - Rename was failing to update timestamps when a directory delegation is held on NFSv4 - Ensure we check rsize/wsize after crossing a NFSv4 filesystem boundary - NFSv4/pnfs: - If the server is down, retry the layout returns on reboot - Fallback to MDS could result in a short write being incorrectly logged Cleanups: - Use memcpy_and_pad in decode_fh" * tag 'nfs-for-7.1-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (21 commits) NFS: Fix RCU dereference of cl_xprt in nfs_compare_super_address NFS: remove redundant __private attribute from nfs_page_class NFSv4.2: fix CLONE/COPY attrs in presence of delegated attributes NFS: fix writeback in presence of errors nfs: use memcpy_and_pad in decode_fh NFSv4.1: Apply session size limits on clone path NFSv4: retry GETATTR if GET_DIR_DELEGATION failed NFS: fix RENAME attr in presence of directory delegations pnfs/flexfiles: validate ds_versions_cnt is non-zero NFS/blocklayout: print each device used for SCSI layouts xprtrdma: Post receive buffers after RPC completion xprtrdma: Scale receive batch size with credit window xprtrdma: Replace rpcrdma_mr_seg with xdr_buf cursor xprtrdma: Decouple frwr_wp_create from frwr_map xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot xprtrdma: Avoid 250 ms delay on backlog wakeup xprtrdma: Close sendctx get/put race that can block a transport nfs: update inode ctime after removexattr operation nfs: fix utimensat() for atime with delegated timestamps NFS: improve "Server wrote zero bytes" error ... commit ac2dc6d57425ffa9629941d7c9d7c0e51082cb5a Merge: ff9726d7a0068e b1137e0b3d4bad Author: Linus Torvalds Date: Fri Apr 24 13:47:19 2026 -0700 Merge tag 'ceph-for-7.1-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "We have a series from Alex which extends CephFS client metrics with support for per-subvolume data I/O performance and latency tracking (metadata operations aren't included) and a good variety of fixes and cleanups across RBD and CephFS" * tag 'ceph-for-7.1-rc1' of https://github.com/ceph/ceph-client: ceph: add subvolume metrics collection and reporting ceph: parse subvolume_id from InodeStat v9 and store in inode ceph: handle InodeStat v8 versioned field in reply parsing libceph: Fix slab-out-of-bounds access in auth message processing rbd: fix null-ptr-deref when device_add_disk() fails crush: cleanup in crush_do_rule() method ceph: clear s_cap_reconnect when ceph_pagelist_encode_32() fails ceph: only d_add() negative dentries when they are unhashed libceph: update outdated comment in ceph_sock_write_space() libceph: Remove obsolete session key alignment logic ceph: fix num_ops off-by-one when crypto allocation fails libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() commit ff9726d7a0068e6c2ae1969415285d12ef4d5c6f Merge: bdcb864c719f7c 36ee1313199b7f Author: Linus Torvalds Date: Fri Apr 24 13:40:25 2026 -0700 Merge tag 'ntfs-for-7.1-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs Pull ntfs updates from Namjae Jeon: - Fix potential data leakage by zeroing the portion of the straddle block beyond initialized_size when reading non-resident attributes - Remove unnecessary zeroing in ntfs_punch_hole() for ranges beyond initialized_size, as they are already returned as zeros on read - Fix writable check in ntfs_file_mmap_prepare() to correctly handle shared mappings using VMA_SHARED_BIT | VMA_MAYWRITE_BIT - Use page allocation instead of kmemdup() for IOMAP_INLINE data to ensure page-aligned address and avoid BUG trap in iomap_inline_data_valid() caused by the page boundary check - Add a size check before memory allocation in ntfs_attr_readall() and reject overly large attributes - Remove unneeded noop_direct_IO from ntfs_aops as it is no longer required following the FMODE_CAN_ODIRECT flag - Fix seven static analysis warnings reported by Smatch * tag 'ntfs-for-7.1-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: ntfs: use page allocation for resident attribute inline data ntfs: fix mmap_prepare writable check for shared mappings ntfs: fix potential 32-bit truncation in ntfs_write_cb() ntfs: fix uninitialized variable in ntfs_map_runlist_nolock ntfs: delete dead code ntfs: add missing error code in ntfs_mft_record_alloc() ntfs: fix uninitialized variables in ntfs_ea_set_wsl_inode() ntfs: fix uninitialized pointer in ntfs_write_mft_block ntfs: fix uninitialized variable in ntfs_write_simple_iomap_begin_non_resident ntfs: remove noop_direct_IO from address_space_operations ntfs: limit memory allocation in ntfs_attr_readall ntfs: not zero out range beyond init in punch_hole ntfs: zero out stale data in straddle block beyond initialized_size commit bdcb864c719f7cf8629ada18450fd4efbb16afe8 Merge: f9569c6ce4a4bb 8fc518e489c138 Author: Linus Torvalds Date: Fri Apr 24 13:37:26 2026 -0700 Merge tag '9p-for-7.1-rc1' of https://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: - 9p access flag fix (cannot change access flag since new mount API implem) - some minor cleanup * tag '9p-for-7.1-rc1' of https://github.com/martinetd/linux: 9p/trans_xen: replace simple_strto* with kstrtouint 9p/trans_xen: make cleanup idempotent after dataring alloc errors 9p: document missing enum values in kernel-doc comments 9p: fix access mode flags being ORed instead of replaced 9p: fix memory leak in v9fs_init_fs_context error path commit f9569c6ce4a4bbad0876ca7bd1e04fbfbbc1641f Merge: cb4eb6771c0f8f ebf1bafd090790 Author: Linus Torvalds Date: Fri Apr 24 13:30:54 2026 -0700 Merge tag 'spdx-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx Pull SPDX update from Greg KH: "Here is a single SPDX-like change for 7.1-rc1. It explicitly allows the use of SPDX-FileCopyrightText which has been used already in many files. At the same time, update checkpatch to catch any "non allowed" spdx identifiers as we don't want to go overboard here. This has been in linux-next for a long time with no reported problems" * tag 'spdx-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx: LICENSES: Explicitly allow SPDX-FileCopyrightText commit cb4eb6771c0f8fd1c52a8f6fdec7762fb087380a Merge: b2680ba4a2ad25 1c0220a61508d6 Author: Linus Torvalds Date: Fri Apr 24 13:23:50 2026 -0700 Merge tag 'char-misc-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc / IIO / and others driver updates from Greg KH: "Here is the char/misc/iio and other smaller driver subsystem updates for 7.1-rc1. Lots of stuff in here, all tiny, but relevant for the different drivers they touch. Major points in here is: - the usual large set of new IIO drivers and updates for that subsystem (the large majority of this diffstat) - lots of comedi driver updates and bugfixes - coresight driver updates - interconnect driver updates and additions - mei driver updates - binder (both rust and C versions) updates and fixes - lots of other smaller driver subsystem updates and additions All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (405 commits) coresight: tpdm: fix invalid MMIO access issue mei: me: add nova lake point H DID mei: lb: add late binding version 2 mei: bus: add mei_cldev_uuid w1: ds2490: drop redundant device reference bus: mhi: host: pci_generic: Add Telit FE912C04 modem support mei: csc: wake device while reading firmware status mei: csc: support controller with separate PCI device mei: convert PCI error to common errno mei: trace: print return value of pci_cfg_read mei: me: move trace into firmware status read mei: fix idle print specifiers mei: me: use PCI_DEVICE_DATA macro sonypi: Convert ACPI driver to a platform one misc: apds990x: fix all kernel-doc warnings most: usb: Use kzalloc_objs for endpoint address array hpet: Convert ACPI driver to a platform one misc: vmw_vmci: Fix spelling mistakes in comments parport: Remove completed item from to-do list char: remove unnecessary module_init/exit functions ... commit b2680ba4a2ad259c7bbd856ed830b459e11d88ba Merge: f64399836125c8 16ab65df5d8679 Author: Linus Torvalds Date: Fri Apr 24 13:16:36 2026 -0700 Merge tag 'spi-fix-v7.1-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "This is quite a big set of fixes, almost all from Johan Hovold who is on an ongoing quest to clean up issues with probe and removal handling in drivers. There isn't anything too concerning here especially with the deregistration stuff which will very rarely get run in production systems since this is all platform devices in the SoC on embedded hardware, but it's all real issues which should be fixed. There's more in flight here. We also have a few other minor fixes, one from Felix Gu along the same lines as Johan's work and a couple of documentation things" * tag 'spi-fix-v7.1-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (23 commits) spi: fix controller cleanup() documentation spi: fix resource leaks on device setup failure spi: axiado: clean up probe return value spi: axiado: rename probe error labels spi: axiado: fix runtime pm imbalance on probe failure spi: orion: clean up probe return value spi: orion: fix clock imbalance on registration failure spi: orion: fix runtime pm leak on unbind spi: imx: fix runtime pm leak on probe deferral spi: mpc52xx: fix use-after-free on registration failure spi: Fix the error description in the `ptp_sts_word_post` comment spi: topcliff-pch: fix use-after-free on unbind spi: topcliff-pch: fix controller deregistration spi: orion: fix controller deregistration spi: mxic: fix controller deregistration spi: mpc52xx: fix use-after-free on unbind spi: mpc52xx: fix controller deregistration spi: cadence-quadspi: fix controller deregistration spi: cadence: fix controller deregistration spi: mtk-snfi: fix memory leak in probe ... commit f64399836125c8512f8a3fe72c1719795a9c5812 Merge: 6e2d43100c906c 2af72ec297d1d4 Author: Linus Torvalds Date: Fri Apr 24 13:06:25 2026 -0700 Merge tag 'regulator-fix-v7.1-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "Just one trivial cleanup of the user visible prompts in Kconfig here, standardising how we describe Qualcomm" * tag 'regulator-fix-v7.1-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: qcom: Unify user-visible "Qualcomm" name commit 92d5a606721f759ebebf448b3bd2b7a781d50bd0 Author: Masami Hiramatsu (Google) Date: Fri Apr 24 15:52:10 2026 +0900 ring-buffer: Do not double count the reader_page Since the cpu_buffer->reader_page is updated if there are unwound pages. After that update, we should skip the page if it is the original reader_page, because the original reader_page is already checked. Cc: stable@vger.kernel.org Cc: Catalin Marinas Cc: Will Deacon Cc: Mathieu Desnoyers Cc: Ian Rogers Link: https://patch.msgid.link/177701353063.2223789.1471163147644103306.stgit@mhiramat.tok.corp.google.com Fixes: ca296d32ece3 ("tracing: ring_buffer: Rewind persistent ring buffer on reboot") Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt commit 6e2d43100c906c6f3d68c45fd2a08ea4be92285c Merge: d0fc5bf9fe9b89 7e555fcae40ab2 Author: Linus Torvalds Date: Fri Apr 24 12:11:26 2026 -0700 Merge tag 'regmap-fix-v7.1-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "There's couple of patches here that came in since my pull request: - What is effectively a quirk for shoehorning support for a wider range of I2C regmaps on weirdly restricted SMBus controllers - One minor fix for a memory leak on in error handling in the dummy driver used by the KUnit tests" * tag 'regmap-fix-v7.1-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: ram: fix memory leaks in __regmap_init_ram() on error regmap-i2c: add SMBus byte/word reg16 bus for adapters lacking I2C_FUNC_I2C commit d0fc5bf9fe9b89389287846f13cc4e462a89954d Merge: 1fe93b2a2ace9b e31eee4a961077 Author: Linus Torvalds Date: Fri Apr 24 11:59:46 2026 -0700 Merge tag 'gpio-fixes-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix a regression in gpio-rockchip introduced on older chips during the merge window when converting to dynamic GPIO base - fix AST2700 debounce selector bit definitions in gpio-aspeed * tag 'gpio-fixes-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: aspeed: fix AST2700 debounce selector bit definitions gpio: rockchip: Fix GPIO regression after conversion to dynamic base allocation commit 1fe93b2a2ace9bba2cb90920f9300834e537665c Merge: cf950766e96e36 2724fbc90e5c13 Author: Linus Torvalds Date: Fri Apr 24 11:49:20 2026 -0700 Merge tag 'sound-fix-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Here are the rest of small updates for 7.1-rc1. All small fixes mostly for device-specific issues or regressions. Core: - Fix a potential data race in fasync handling USB-audio: - New device support: Line6 POD HD PRO, NexiGo N930W webcam - Fixes for Audio Advantage Micro II SPDIF switch and E-MU sample rates - Limit UAC2 rate parsing to prevent potential overflows HD-Audio: - Device-specific quirks for HP, Acer, and Honor laptops - Fix for TAS2781 SPI device abnormal sound - Move Intel firmware loading into probe work to avoid stalling ASoC: - New support for TI TAS5832 - Fixes for SoundWire SDCA/DisCo boolean parsing - Driver-specific fixes for Intel SOF, ES8311, RT1320, and PXA2xx Misc: - Fixes for resource leaks and data races in 6fire, caiaq, als4000, and pcmtest drivers" * tag 'sound-fix-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (41 commits) Revert "ALSA: pcmtest: fix reference leak on failed device registration" ASoC: tas2781: Add tas5832 support ASoC: dt-bindings: ti,tas2781: Add TAS5832 support ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch ALSA: usb-audio: Avoid false E-MU sample-rate notifications ASoC: sdw_utils: cs42l43: allow spk component names to be combined ASoC: qcom: x1e80100: limit speaker volumes ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx ALSA: pcmtest: Fix resource leaks in module init error paths ALSA: usb-audio/line6: Add support for POD HD PRO ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2a Laptops ASoC: SDCA: Fix reading of mipi-sdca-control-deferrable regmap: sdw-mbq: Allow defers on undeferrable controls Revert "ALSA: usb-audio: Add quirk for SmartlinkTechnology M01" ALSA: als4000: Fix capture trigger chip->mode race ALSA: core: Fix potential data race at fasync handling ALSA: hda/tas2781: Fix sound abnormal issue on some SPI device ALSA: hda/realtek: add quirk for Acer Nitro 16 AN16-41 ALSA: caiaq: Fix control_put() result and cache rollback ALSA: pcmtest: fix reference leak on failed device registration ... commit cf950766e96e36c90871d955cfd2a2c1feddba37 Merge: 92c4c9fdc838d3 56d0a0b38faa13 Author: Linus Torvalds Date: Fri Apr 24 11:44:52 2026 -0700 Merge tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel Pull more drm fixes from Dave Airlie: "These are the regular fixes that have built up over last couple of weeks, all pretty minor and spread all over. atomic: - raise the vblank timeout to avoid it on virtual drivers - fix colorop duplication bridge: - stm_lvds: state check fix - dw-mipi-dsi: bridge reference leak fix panel: - visionx-rm69299: init fix dma-fence: - fix sparse warning dma-buf: - UAF fix panthor: - mapping fix arcgpu: - device_node reference leak fix nouveau: - memory leak in error path fix - overflow in reloc path for old hw fix hv: - Kconfig fix v3d: - infinite loop fix" * tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel: drm/nouveau: fix u32 overflow in pushbuf reloc bounds check MAINTAINERS: split hisilicon maintenance and add Yongbang Shi for hibmc-drm matainers drm/v3d: Reject empty multisync extension to prevent infinite loop drm/panel: visionox-rm69299: Make use of prepare_prev_first drm/drm_atomic: duplicate colorop states if plane color pipeline in use drm/nouveau: fix nvkm_device leak on aperture removal failure hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS dma-fence: Silence sparse warning in dma_fence_describe drm/bridge: dw-mipi-dsi: Fix bridge leak when host attach fails drm/arcpgu: fix device node leak drm/panthor: Fix outdated function documentation drm/panthor: Extend VM locked region for remap case to be a superset dma-buf: fix UAF in dma_buf_put() tracepoint drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector drm/atomic: Increase timeout in drm_atomic_helper_wait_for_vblanks() commit 92c4c9fdc838d3b41a996bb700ea64b9e78fc7ea Merge: 892c894b4ba4e4 e49712ef03dbc4 Author: Linus Torvalds Date: Fri Apr 24 11:33:23 2026 -0700 Merge tag 'drm-next-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel Pull drm next fixes from Dave Airlie: "This is the first of two fixes for the merge PRs, the other is based on 7.0 branch. This mostly AMD fixes, a couple of weeks of backlog built up and this weeks. The main complaint I've seen is some boot warnings around the FP code handling which this should fix. Otherwise a single rcar-du and a single i915 fix. amdgpu: - SMU 14 fixes - Partition fixes - SMUIO 15.x fix - SR-IOV fixes - JPEG fix - PSP 15.x fix - NBIF fix - Devcoredump fixes - DPC fix - RAS fixes - Aldebaran smu fix - IP discovery fix - SDMA 7.1 fix - Runtime pm fix - MES 12.1 fix - DML2 fixes - DCN 4.2 fixes - YCbCr fixes - Freesync fixes - ISM fixes - Overlay cursor fix - DC FP fixes - UserQ locking fixes - DC idle state manager fix - ASPM fix - GPUVM SVM fix - DCE 6 fix amdkfd: - Fix memory clear handling - num_of_nodes bounds check fix i915: - Fix uninitialized variable in the alignment loop [psr] rcar-du: - fix NULL-ptr crash" * tag 'drm-next-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel: (75 commits) drm/amdkfd: Add upper bound check for num_of_nodes drm: rcar-du: Fix crash when no CMM is available drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x drm/amdgpu: OR init_pte_flags into invalid leaf PTE updates drm/amd: Adjust ASPM support quirk to cover more Intel hosts drm/amd/display: Undo accidental fix revert in amdgpu_dm_ism.c drm/i915/psr: Init variable to avoid early exit from et alignment loop drm/amdgpu: drop userq fence driver refs out of fence process() drm/amdgpu/userq: unpin and unref doorbell and wptr outside mutex drm/amdgpu/userq: use pm_runtime_resume_and_get and fix err handling drm/amdgpu/userq: unmap_helper dont return the queue state drm/amdgpu/userq: unmap is to be called before freeing doorbell/wptr bo drm/amdgpu/userq: hold root bo lock in caller of input_va_validate drm/amdgpu/userq: caller to take reserv lock for vas_list_cleanup drm/amdgpu/userq: create_mqd does not need userq_mutex drm/amdgpu/userq: dont lock root bo with userq_mutex held drm/amdgpu/userq: fix kerneldoc for amdgpu_userq_ensure_ev_fence drm/amdgpu/userq: clean the VA mapping list for failed queue creation drm/amdgpu/userq: avoid uneccessary locking in amdgpu_userq_create drm/amd/display: Fix ISM teardown crash from NULL dc dereference ... commit b5c111f4967ba4fdecdd318923ec7b081e9ef95f Author: Amery Hung Date: Thu Apr 23 15:23:55 2026 -0700 bpf: Fix sk_local_storage diag dumping uninitialized special fields Call check_and_init_map_value() after the copy_map_value() to zero out special field regions. diag_get() copies sk_local_storage map values into a netlink message using copy_map_value{_locked}(), which intentionally skip special fields. However, the destination buffer from nla_reserve_64bit() is not zeroed and the skipped regions contain uninitialized skb data can be sent to userspace. Fixes: 1ed4d92458a9 ("bpf: INET_DIAG support in bpf_sk_storage") Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260423222356.155387-1-ameryhung@gmail.com commit 8cf6809cddcbe301aedfc6b51bcd4944d45795f6 Author: Florian Westphal Date: Thu Apr 23 02:19:11 2026 +0200 netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with a new sip_parse_port() helper that validates each digit against the buffer limit, eliminating the use of simple_strtoul() which assumes NUL-terminated strings. The previous code dereferenced pointers without bounds checks after sip_parse_addr() and relied on simple_strtoul() on non-NUL-terminated skb data. A port that reaches the buffer limit without a trailing character is also rejected as malformed. Also get rid of all simple_strtoul() usage in conntrack, prefer a stricter version instead. There are intentional changes: - Bail out if number is > UINT_MAX and indicate a failure, same for too long sequences. While we do accept 05535 as port 5535, we will not accept e.g. 'sip:10.0.0.1:005060'. While its syntactically valid under RFC 3261, we should restrict this to not waste cycles when presented with malformed packets with 64k '0' characters. - Force base 10 in ct_sip_parse_numerical_param(). This is used to fetch 'expire=' and 'rports='; both are expected to use base-10. - In nf_nat_sip.c, only accept the parsed value if its within the 1k-64k range. - epaddr_len now returns 0 if the port is invalid, as it already does for invalid ip addresses. This is intentional. nf_conntrack_sip performs lots of guesswork to find the right parts of the message to parse. Being stricter could break existing setups. Connection tracking helpers are designed to allow traffic to pass, not to block it. Based on an earlier patch from Jenny Guanni Qu . Fixes: 05e3ced297fe ("[NETFILTER]: nf_conntrack_sip: introduce SIP-URI parsing helper") Reported-by: Klaudia Kloc Reported-by: Dawid Moczadło Reported-by: Jenny Guanni Qu . Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit fe11e5c40817b84abaa5d83bfb6586d8412bfd07 Author: Kai Ma Date: Wed Apr 22 22:54:18 2026 +0800 netfilter: reject zero shift in nft_bitwise Reject zero shift operands for nft_bitwise left and right shift expressions during initialization. The carry propagation logic computes the carry from the adjacent 32-bit word using BITS_PER_TYPE(u32) - shift. A zero shift operand turns this into a 32-bit shift, which is undefined behaviour. Reject zero shift operands in the control plane, alongside the existing check for values greater than or equal to 32, so malformed rules never reach the packet path. Fixes: 567d746b55bc ("netfilter: bitwise: add support for shifts.") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Kai Ma Signed-off-by: Ren Wei Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 4b2b4d7d4e203c92db8966b163edfacb1f0e1e29 Author: Jiexun Wang Date: Fri Apr 17 20:25:06 2026 +0800 netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume info->pol[] in the same forward order as the rule layout. Derive the strict-match policy position from the number of transforms already consumed so that multi-element inbound rules are matched consistently. Fixes: c4b885139203 ("[NETFILTER]: x_tables: replace IPv4/IPv6 policy match by address family independant version") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Jiexun Wang Signed-off-by: Ren Wei Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 510a27055446b8f0d29487ca8b8d2033dc2b6ca6 Author: Richard Cheng Date: Fri Apr 24 18:02:21 2026 +0800 sched_ext: sync disable_irq_work in bpf_scx_unreg() When unregistered my self-written scx scheduler, the following panic occurs. [ 229.923133] Kernel text patching generated an invalid instruction at 0xffff80009bc2c1f8! [ 229.923146] Internal error: Oops - BRK: 00000000f2000100 [#1] SMP [ 230.077871] CPU: 48 UID: 0 PID: 1760 Comm: kworker/u583:7 Not tainted 7.0.0+ #3 PREEMPT(full) [ 230.086677] Hardware name: NVIDIA GB200 NVL/P3809-BMC, BIOS 02.05.12 20251107 [ 230.093972] Workqueue: events_unbound bpf_map_free_deferred [ 230.099675] Sched_ext: invariant_0.1.0_aarch64_unknown_linux_gnu_debug (disabling), task: runnable_at=-174ms [ 230.116843] pc : 0xffff80009bc2c1f8 [ 230.120406] lr : dequeue_task_scx+0x270/0x2d0 [ 230.217749] Call trace: [ 230.228515] 0xffff80009bc2c1f8 (P) [ 230.232077] dequeue_task+0x84/0x188 [ 230.235728] sched_change_begin+0x1dc/0x250 [ 230.240000] __set_cpus_allowed_ptr_locked+0x17c/0x240 [ 230.245250] __set_cpus_allowed_ptr+0x74/0xf0 [ 230.249701] ___migrate_enable+0x4c/0xa0 [ 230.253707] bpf_map_free_deferred+0x1a4/0x1b0 [ 230.258246] process_one_work+0x184/0x540 [ 230.262342] worker_thread+0x19c/0x348 [ 230.266170] kthread+0x13c/0x150 [ 230.269465] ret_from_fork+0x10/0x20 [ 230.281393] Code: d4202000 d4202000 d4202000 d4202000 (d4202000) [ 230.287621] ---[ end trace 0000000000000000 ]--- [ 231.160046] Kernel panic - not syncing: Oops - BRK: Fatal exception in interrupt The root cause is that the JIT page backing ops->quiescent() is freed before all callers of that function have stopped. The expected ordering during teardown is: bitmap_zero(sch->has_op) + synchronize_rcu() -> guarantees no CPU will ever call sch->ops.* again -> only THEN free the BPF struct_ops JIT page bpf_scx_unreg() is supposed to enforce the order, but after commit f4a6c506d118 ("sched_ext: Always bounce scx_disable() through irq_work"), disable_work is no longer queued directly, causing kthread_flush_work() to be a noop. Thus, the caller drops the struct_ops map too early and poisoned with AARCH64_BREAK_FAULT before disable_workfn ever execute. So the subsequent dequeue_task() still sees SCX_HAS_OP(sch, quiescent) as true and calls ops.quiescent, which hit on the poisoned page and BRK panic. Add a helper scx_flush_disable_work() so the future use cases that want to flush disable_work can use it. Also amend the call for scx_root_enable_workfn() and scx_sub_enable_workfn() which have similar pattern in the error path. Fixes: f4a6c506d118 ("sched_ext: Always bounce scx_disable() through irq_work") Signed-off-by: Richard Cheng Reviewed-by: Andrea Righi Reviewed-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 892c894b4ba4e4eb835f99de6fe7c41871e6d4f8 Merge: 8f4e8687c8f9a3 0adc92b910b3d6 Author: Linus Torvalds Date: Fri Apr 24 10:14:29 2026 -0700 Merge tag 'locking-urgent-2026-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Ingo Molnar: - Fix ww_mutex regression, which caused hangs/pauses in some DRM drivers - Fix rtmutex proxy-rollback bug * tag 'locking-urgent-2026-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/mutex: Fix ww_mutex wait_list operations rtmutex: Use waiter::task instead of current in remove_waiter() commit 8f4e8687c8f9a3387f51cd534d80b383000d7776 Merge: feff82eb5f4075 a39a7014825bd8 Author: Linus Torvalds Date: Fri Apr 24 10:05:42 2026 -0700 Merge tag 'x86-urgent-2026-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Prevent deadlock during shstk sigreturn (Rick Edgecombe) - Disable FRED when PTI is forced on (Dave Hansen) - Revert a CPA INVLPGB optimization that did not properly handle discontiguous virtual addresses (Dave Hansen) * tag 'x86-urgent-2026-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Revert INVLPGB optimization for set_memory code x86/cpu: Disable FRED when PTI is forced on x86/shstk: Prevent deadlock during shstk sigreturn commit feff82eb5f4075d541990d0ba60dad14ea83ea9b Merge: ff57d59200baad 9b3a2be84803cf Author: Linus Torvalds Date: Fri Apr 24 10:00:37 2026 -0700 Merge tag 'riscv-for-linus-7.1-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: "There is one significant change outside arch/riscv in this pull request: the addition of a set of KUnit tests for strlen(), strnlen(), and strrchr(). Otherwise, the most notable changes are to add some RISC-V-specific string function implementations, to remove XIP kernel support, to add hardware error exception handling, and to optimize our runtime unaligned access speed testing. A few comments on the motivation for removing XIP support. It's been broken in the RISC-V kernel for months. The code is not easy to maintain. Furthermore, for XIP support to truly be useful for RISC-V, we think that compile-time feature switches would need to be added for many of the RISC-V ISA features and microarchitectural properties that are currently implemented with runtime patching. No one has stepped forward to take responsibility for that work, so many of us think it's best to remove it until clear use cases and champions emerge. Summary: - Add Kunit correctness testing and microbenchmarks for strlen(), strnlen(), and strrchr() - Add RISC-V-specific strnlen(), strchr(), strrchr() implementations - Add hardware error exception handling - Clean up and optimize our unaligned access probe code - Enable HAVE_IOREMAP_PROT to be able to use generic_access_phys() - Remove XIP kernel support - Warn when addresses outside the vmemmap range are passed to vmemmap_populate() - Update the ACPI FADT revision check to warn if it's not at least ACPI v6.6, which is when key RISC-V-specific tables were added to the specification - Increase COMMAND_LINE_SIZE to 2048 to match ARM64, x86, PowerPC, etc. - Make kaslr_offset() a static inline function, since there's no need for it to show up in the symbol table - Add KASLR offset and SATP to the VMCOREINFO ELF notes to improve kdump support - Add Makefile cleanup rule for vdso_cfi copied source files, and add a .gitignore for the build artifacts in that directory - Remove some redundant ifdefs that check Kconfig macros - Add missing SPDX license tag to the CFI selftest - Simplify UTS_MACHINE assignment in the RISC-V Makefile - Clarify some unclear comments and remove some superfluous comments - Fix various English typos across the RISC-V codebase" * tag 'riscv-for-linus-7.1-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (31 commits) riscv: Remove support for XIP kernel riscv: Reuse compare_unaligned_access() in check_vector_unaligned_access() riscv: Split out compare_unaligned_access() riscv: Reuse measure_cycles() in check_vector_unaligned_access() riscv: Split out measure_cycles() for reuse riscv: Clean up & optimize unaligned scalar access probe riscv: lib: add strrchr() implementation riscv: lib: add strchr() implementation riscv: lib: add strnlen() implementation lib/string_kunit: extend benchmarks to strnlen() and chr searches lib/string_kunit: add performance benchmark for strlen() lib/string_kunit: add correctness test for strrchr() lib/string_kunit: add correctness test for strnlen() lib/string_kunit: add correctness test for strlen() riscv: vdso_cfi: Add .gitignore for build artifacts riscv: vdso_cfi: Add clean rule for copied sources riscv: enable HAVE_IOREMAP_PROT riscv: mm: WARN_ON() for bad addresses in vmemmap_populate() riscv: acpi: update FADT revision check to 6.6 riscv: add hardware error trap handler support ... commit ff57d59200baadfdb41f94a49fed7d161a9a8124 Merge: 64edfa65062dc4 7939f96f26e96b Author: Linus Torvalds Date: Fri Apr 24 09:54:45 2026 -0700 Merge tag 'loongarch-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Adjust build infrastructure for 32BIT/64BIT - Add HIGHMEM (PKMAP and FIX_KMAP) support - Show and handle CPU vulnerabilites correctly - Batch the icache maintenance for jump_label - Add more atomic instructions support for BPF JIT - Add more features (e.g. fsession) support for BPF trampoline - Some bug fixes and other small changes * tag 'loongarch-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (21 commits) selftests/bpf: Enable CAN_USE_LOAD_ACQ_STORE_REL for LoongArch LoongArch: BPF: Add fsession support for trampolines LoongArch: BPF: Introduce emit_store_stack_imm64() helper LoongArch: BPF: Support up to 12 function arguments for trampoline LoongArch: BPF: Support small struct arguments for trampoline LoongArch: BPF: Open code and remove invoke_bpf_mod_ret() LoongArch: BPF: Support load-acquire and store-release instructions LoongArch: BPF: Support 8 and 16 bit read-modify-write instructions LoongArch: BPF: Add the default case in emit_atomic() and rename it LoongArch: Define instruction formats for AM{SWAP/ADD}.{B/H} and DBAR LoongArch: Batch the icache maintenance for jump_label LoongArch: Add flush_icache_all()/local_flush_icache_all() LoongArch: Add spectre boundry for syscall dispatch table LoongArch: Show CPU vulnerabilites correctly LoongArch: Make arch_irq_work_has_interrupt() true only if IPI HW exist LoongArch: Use get_random_canary() for stack canary init LoongArch: Improve the logging of disabling KASLR LoongArch: Align FPU register state to 32 bytes LoongArch: Handle CONFIG_32BIT in syscall_get_arch() LoongArch: Add HIGHMEM (PKMAP and FIX_KMAP) support ... commit 64edfa65062dc4509ba75978116b2f6d392346f5 Merge: 82138f0183b40e 0c22ed0fadcad6 Author: Linus Torvalds Date: Fri Apr 24 09:41:58 2026 -0700 Merge tag 'net-deletions' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking deletions from Jakub Kicinski: "Delete some obsolete networking code Old code like amateur radio and NFC have long been a burden to core networking developers. syzbot loves to find bugs in BKL-era code, and noobs try to fix them. If we want to have a fighting chance of surviving the LLM-pocalypse this code needs to find a dedicated owner or get deleted. We've talked about these deletions multiple times in the past and every time someone wanted the code to stay. It is never very clear to me how many of those people actually use the code vs are just nostalgic to see it go. Amateur radio did have occasional users (or so I think) but most users switched to user space implementations since its all super slow stuff. Nobody stepped up to maintain the kernel code. We were lucky enough to find someone who wants to help with NFC so we're giving that a chance. Let's try to put the rest of this code behind us" * tag 'net-deletions' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: drivers: net: 8390: wd80x3: Remove this driver drivers: net: 8390: ultra: Remove this driver drivers: net: 8390: AX88190: Remove this driver drivers: net: fujitsu: fmvj18x: Remove this driver drivers: net: smsc: smc91c92: Remove this driver drivers: net: smsc: smc9194: Remove this driver drivers: net: amd: nmclan: Remove this driver drivers: net: amd: lance: Remove this driver drivers: net: 3com: 3c589: Remove this driver drivers: net: 3com: 3c574: Remove this driver drivers: net: 3com: 3c515: Remove this driver drivers: net: 3com: 3c509: Remove this driver net: packetengines: remove obsolete yellowfin driver and vendor dir net: packetengines: remove obsolete hamachi driver net: remove unused ATM protocols and legacy ATM device drivers net: remove ax25 and amateur radio (hamradio) subsystem net: remove ISDN subsystem and Bluetooth CMTP caif: remove CAIF NETWORK LAYER commit 82138f0183b40e76affa427bb59c57f079d41ec1 Merge: bbc4af7ad94c45 082a6d03a2d685 Author: Linus Torvalds Date: Fri Apr 24 09:39:03 2026 -0700 Merge tag 'slab-for-7.1-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - A stable fix for k(v)ealloc() where reallocating on a different node or shrinking the object can result in either losing the original data or a buffer overflow (Marco Elver) * tag 'slab-for-7.1-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slub: fix data loss and overflow in krealloc() commit bbc4af7ad94c452c00e64fc400fc1317351969b4 Merge: eefe0b9dee5db6 4f96b7c68a9904 Author: Linus Torvalds Date: Fri Apr 24 09:29:51 2026 -0700 Merge tag 'clang-fixes-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux Pull Clang build fix from Nathan Chancellor: - Wrap declaration and assignment of key_pass in certs/extract-cert.c with '#ifdef' that matches its only usage to clear up an instance of a new clang subwarning, -Wunused-but-set-global. * tag 'clang-fixes-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux: extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' commit eefe0b9dee5db64ec87707c8e44f31851f257389 Merge: dd6c438c3e64a5 11b7df0952663f Author: Linus Torvalds Date: Fri Apr 24 09:22:21 2026 -0700 Merge tag 'apparmor-pr-2026-04-23' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull apparmor updates from John Johansen: "Cleanups - Use sysfs_emit in param_get_{audit,mode} - Remove redundant if check in sk_peer_get_label - Replace memcpy + NUL termination with kmemdup_nul in do_setattr Bug Fixes: - Fix aa_dfa_unpack's error handling in aa_setup_dfa_engine - Fix string overrun due to missing termination - Fix wrong dentry in RENAME_EXCHANGE uid check - fix unpack_tags to properly return error in failure cases - fix dfa size check - return error on namespace mismatch in verify_header - use target task's context in apparmor_getprocattr()" * tag 'apparmor-pr-2026-04-23' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: apparmor/lsm: Fix aa_dfa_unpack's error handling in aa_setup_dfa_engine apparmor: Fix string overrun due to missing termination apparmor: Fix wrong dentry in RENAME_EXCHANGE uid check apparmor: fix unpack_tags to properly return error in failure cases apparmor: fix dfa size check apparmor: Use sysfs_emit in param_get_{audit,mode} apparmor: Remove redundant if check in sk_peer_get_label apparmor: Replace memcpy + NUL termination with kmemdup_nul in do_setattr apparmor: return error on namespace mismatch in verify_header apparmor: use target task's context in apparmor_getprocattr() commit d0f5711fa14a09c010537375cf34893cd33bc2ee Author: YuanShang Date: Thu Mar 26 18:27:30 2026 +0800 drm/amdkfd: check if vm ready in svm map and unmap to gpu Don't map or unmap svm range to gpu if vm is not ready for updates. Why: DRM entity may already be killed when the svm worker try to update gpu vm. Signed-off-by: YuanShang Reviewed-by: Philip Yang Signed-off-by: Alex Deucher (cherry picked from commit 55f8e366c326980174a4f2b9501b524d8eb25135) commit 045e0ff208f0838a246c10204105126611b267a1 Author: Alysa Liu Date: Tue Apr 21 10:18:28 2026 -0400 drm/amdkfd: validate SVM ioctl nattr against buffer size Validate nattr field against the buffer size, preventing out-of-bounds buffer access via user-controlled attribute count. Reviewed-by: Amir Shetaia Signed-off-by: Alysa Liu Signed-off-by: Alex Deucher (cherry picked from commit 5eca8bfdfa456c3304ca77523718fe24254c172f) Cc: stable@vger.kernel.org commit 47776ac1e3f4a2aefcf7fe7c7e4a11151b676222 Author: Shubhankar Milind Sardeshpande Date: Tue Apr 21 17:01:21 2026 +0530 drm/amdgpu: Avoid reset in AMDGPU unload path for APUs with GFX V11 and higher. GFX V11 has GC block as default off IP. Every time AMDGPU driver sends a request to PMFW to unload MP1, PMFW will put GC in reset and power down the voltage.Hence, skipping reset for APUs with GFX V11 or later to avoid reset related failures. Fixes: 34355e61835e ("drm/amdgpu: Fix GFX hang on SteamDeck when amdgpu is reloaded") Reviewed-by: Alex Deucher Signed-off-by: Shubhankar Milind Sardeshpande Signed-off-by: Alex Deucher (cherry picked from commit d0a8cadffc818f51d05bc234d8da1af228bc59a3) Cc: stable@vger.kernel.org commit b56922fc37454633b831a2a04a1537616742977d Author: Kent Russell Date: Wed Apr 22 09:34:04 2026 -0400 drm/amdgpu: Only send RMA CPER when threshold is exceeded According to our documentation, the RMA should only occur when the threshold has been exceeded, not met. Fixes: 5028a24aa89a ("drm/amdgpu: Send applicable RMA CPERs at end of RAS init") Signed-off-by: Kent Russell Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher (cherry picked from commit 8bc09a7d0e90ec45a0b4865661cf45cbbce1c3d7) commit 686e5985d9f5ba29e2fd43d618548039727adee2 Author: Pierre-Eric Pelloux-Prayer Date: Mon Apr 20 10:23:39 2026 +0200 drm/amdgpu: fix root reservation in amdgpu_vm_handle_fault svm_range_restore_pages might reserve the root bo so it must be called after unreserving it. Fixes: 1b135c6da061 ("drm/amdgpu: extract amdgpu_vm_lock_by_pasid from amdgpu_vm_handle_fault") Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 5cdc219fe86a1720aa4b5b4f42f11913146e6a93) commit fe2b84f9228e2a0903221a4d0d8c350b018e9c0c Author: Timur Kristóf Date: Sat Apr 18 23:49:33 2026 +0200 drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) This commit fixes amdgpu to work on the Radeon HD 7870 XT which has never worked with the Linux open source drivers before. Some boards have "harvested" chips, meaning that some parts of the chip are disabled and fused, and it's sold for cheaper and under a different marketing name. On a harvested chip, any of the following can be disabled: - CUs (Compute Units) - RBs (Render Backend, aka. ROP) - Memory channels (ie. the chip has a lower bandwidth) - TCCs (ie. less L2 cache) Handle chips with harvested TCCs by patching the registers that configure how TCCs are mapped. If some TCCs are disabled, we need to make sure that the disabled TCCs are not used, and the remaining TCCs are used optimally. TCP_CHAN_STEER_LO/HI control which TCC is used by TCP channels. TCP_ADDR_CONFIG.NUM_TCC_BANKS controls how many channels are used. Note that the TCC configuration is highly relevant to performance. Suboptimal configuration (eg. CHAN_STEER=0) can significantly reduce gaming performance. For optimal performance: - Rely on the CHAN_STEER from the golden registers table, only skip disabled TCCs but keep the mapping order. - Limit NUM_TCC_BANKS to number of active TCCs to avoid thrashing, which performs better than using the same TCC twice. v2: - Also consider CGTS_USER_TCC_DISABLE for disabled TCCs. Link: https://bugs.freedesktop.org/show_bug.cgi?id=60879 Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/2664 Fixes: 2cd46ad22383 ("drm/amdgpu: add graphic pipeline implementation for si v8") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 00218d15528fab9f6b31241fe5904eea4fcaa30d) commit 13e4cf116dbf7a1fb8123a59bea2c098f30d3736 Author: Timur Kristóf Date: Sat Apr 18 23:49:31 2026 +0200 drm/amdgpu/uvd3.1: Don't validate the firmware when already validated UVD 3.1 firmware validation seems to always fail after attempting it when it had already been validated. (This works similarly with the VCE 1.0 as well.) Don't attempt repeating the validation when it's already done. This caused issues in situations when the system isn't able to suspend the GPU properly and so the GPU isn't actually powered down. Then amdgpu would fail when calling the IP block resume function. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/2887 Fixes: bb7978111dd3 ("drm/amdgpu: fix SI UVD firmware validate resume fail") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 889a2cfd889c4a4dd9d0c89ce9a8e60b78be71dd) commit 0ef196a208385b7d7da79f411c161b04e97283e2 Author: Christian König Date: Fri Apr 17 15:52:45 2026 +0200 drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG There were multiple issues in that code. First of all the order between the reset semaphore and the mm_lock was wrong (e.g. copy_to_user) was called while holding the lock. Then we allocated memory while holding the reset semaphore which is also a pretty big bug and can deadlock. Then we used down_read_trylock() instead of waiting for the reset to finish. Signed-off-by: Christian König Fixes: 9e823f307074 ("drm/amdgpu: Block MMR_READ IOCTL in reset") Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 361b6e6b303d4b691f6c5974d3eaab67ca6dd90e) commit ccf8932ed8cf4fbfdcd4df2c6b524913691ee700 Author: Yang Wang Date: Wed Apr 22 18:41:42 2026 +0800 drm/amd/pm: fix missing fine-grained dpm table flag on aldebaran Add the missing SMU_DPM_TABLE_FINE_GRAINED flag to aldebaran DPM table. This fixes the pp_dpm_sclk node issue caused by missing flag configuration. Fixes: 7ea1c722fe1d ("drm/amd/pm: Use common helper for aldebaran dpm table") Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 3427dea3a48ebddb491a26093f3627384b3cb2c2) commit 36d65da7570bf72ce28504fa9a81abfc728e6d96 Author: Timur Kristóf Date: Sat Apr 18 23:49:30 2026 +0200 drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM When the GART placement is set to AMDGPU_GART_PLACEMENT_LOW: Make sure that GART does not overlap with VRAM when VRAM is configured to be in the low address space. Solve this according to the following logic: - When GART fits before VRAM, use zero address for GART - Otherwise, put GART after the end of VRAM, aligned to 4 GiB Previously, I had assumed this was not possible so it was OK to not handle it, but now we got a report from a user who has a board that is configured this way. Fixes: 917f91d8d8e8 ("drm/amdgpu/gmc: add a way to force a particular placement for GART") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 3d9de5d86a1658cadb311461b001eb1df67263ad) commit 87612bab9656a63affa0e2788e0d7a4a1dffa89e Author: Mario Limonciello (AMD) Date: Wed Dec 10 14:15:08 2025 -0600 amdkfd: Only ignore -ENOENT for KFD init failuires When compiled without CONFIG_HSA_AMD KFD will return -ENOENT. As other errors will cause KFD functionality issues this is the only error code that should be ignored at init. Reviewed-by: Kent Russell Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher (cherry picked from commit 4259a25341abf77939767215706f4e3cfd4b73b8) commit 508babf310365f1107a2e8831c267c292a286818 Author: Hongyan Xu Date: Wed Apr 22 20:38:17 2026 +0800 drm/amdgpu: avoid double drm_exec_fini() in userq validate When new_addition is true, amdgpu_userq_vm_validate() calls drm_exec_fini(&exec) before iterating over the collected HMM ranges and calling amdgpu_ttm_tt_get_user_pages(). If amdgpu_ttm_tt_get_user_pages() fails in that path, the code jumps to unlock_all and calls drm_exec_fini(&exec) a second time on the same exec object. drm_exec_fini() is not idempotent: it frees exec->objects and may also drop exec->contended and finalize the ww acquire context. Route that error path directly to the range cleanup once exec has already been finalized. Fixes: 42f148788469 ("drm/amdgpu/userqueue: validate userptrs for userqueues") Issue found using a prototype static analysis tool and confirmed by code review. Reviewed-by: Christian König Signed-off-by: Hongyan Xu Signed-off-by: Slavin Liu <220245772@seu.edu.cn> Signed-off-by: Alex Deucher (cherry picked from commit 2802952e4a07306da6ebe813ff1acacc5691851a) commit 4867cef03b58ca53651593842efcfd0587a707f2 Author: Roman Li Date: Wed Apr 15 17:45:10 2026 -0400 drm/amd/display: Restore analog connector support [Why] The analog connector support was accidentally removed, causing a crash when connecting an analog monitor. [How] This patch restores the functions and pointers required for proper analog and DP bridge encoder support on legacy GPUs. V2: Restore the external encoder control functions. V3: - Restore BIOS parser external encoder DAC load detection - Restore stream initialization and source selection changes Fixes: e56e3cff2a1b ("drm/amd/display: Sync dcn42 with DC 3.2.373") Cc: Timur Kristóf Signed-off-by: Roman Li Reviewed-by: Alex Hung Reviewed-by: Timur Kristóf Tested-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit cea8349e4494d2892ea57eef3fe4a8987464a876) commit 095a8b0ad3c3b5cdc3850d961adb8a8f735220bb Author: Arjan van de Ven Date: Mon Apr 20 14:57:15 2026 -0700 drm/amdgpu: fix zero-size GDS range init on RDNA4 RDNA4 (GFX 12) hardware removes the GDS, GWS, and OA on-chip memory resources. The gfx_v12_0 initialisation code correctly leaves adev->gds.gds_size, adev->gds.gws_size, and adev->gds.oa_size at zero to reflect this. amdgpu_ttm_init() unconditionally calls amdgpu_ttm_init_on_chip() for each of these resources regardless of size. When the size is zero, amdgpu_ttm_init_on_chip() forwards the call to ttm_range_man_init(), which calls drm_mm_init(mm, 0, 0). drm_mm_init() immediately fires DRM_MM_BUG_ON(start + size <= start) -- trivially true when size is zero -- crashing the kernel during modprobe of amdgpu on an RX 9070 XT. Guard against this by returning 0 early from amdgpu_ttm_init_on_chip() when size_in_page is zero. This skips TTM resource manager registration for hardware resources that are absent, without affecting any other GPU type. DRM_MM_BUG_ON() only asserts if CONFIG_DRM_DEBUG_MM is enabled in the kernel config. This is apparently rarely enabled as these chips have been in the market for over a year and this issue was only reported now. Link: https://lore.kernel.org/all/bug-221376-2300@https.bugzilla.kernel.org%2F/ Link: https://bugzilla.kernel.org/show_bug.cgi?id=221376 Oops-Analysis: http://oops.fenrus.org/reports/bugzilla.korg/221376/report.html Assisted-by: GitHub Copilot:Claude Sonnet 4.6 linux-kernel-oops-x86. Signed-off-by: Arjan van de Ven Cc: Alex Deucher Cc: "Christian König" Cc: amd-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Alex Deucher (cherry picked from commit 5719ce5865279cad4fd5f01011fe037168503f2d) Cc: stable@vger.kernel.org commit c6e61c06d6061750597e79c598acb5dead44c35b Author: Sebastian Andrzej Siewior Date: Tue Nov 11 16:54:38 2025 +0100 ARM: 9463/1: Allow to enable RT All known issues have been adressed. Allow to select RT. Acked-by: Linus Walleij Reviewed-by: Arnd Bergmann Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Russell King (Oracle) commit 6f685f12fd8327c9da19ae5b1875acaaa9297494 Merge: dd9d3e16c2d5fa d1fed2d600905e 75f9a484e817ad 5a21253b3073df Author: Russell King (Oracle) Date: Fri Apr 24 15:14:07 2026 +0100 Merge branches 'adfs', 'arm-fault-handling', 'fixes' and 'misc' commit 75f9a484e817adea211c73f89ed938a2b2f90953 Author: Brian Ruley Date: Wed Apr 15 18:12:48 2026 +0100 ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache() This bug was already discovered and fixed for arm64 in commit 588a513d3425 ("arm64: Fix race condition on PG_dcache_clean in __sync_icache_dcache()"). Verified with added instrumentation to track dcache flushes in a ring buffer, as shown by the (distilled) output: kernel: SIGILL at b6b80ac0 cpu 1 pid 32663 linux_pte=8eff659f hw_pte=8eff6e7e young=1 exec=1 kernel: dcache flush START cpu0 pfn=8eff6 ts=48629557020154 kernel: dcache flush SKIPPED cpu1 pfn=8eff6 ts=48629557020154 kernel: dcache flush FINISH cpu0 pfn=8eff6 ts=48629557036154 audisp-syslog: comm="journalctl" exe="/usr/bin/journalctl" sig=4 [...] Discussions in the mailing list mentioned that arch/arm is also affected but the fix was never applied to it [1][2]. Apply the change now, since the race condition can cause sporadic SIGILL's and SEGV's especially while under high memory pressure. Link: https://lore.kernel.org/all/adzMOdySgMIePcue@willie-the-truck [1] Link: https://lore.kernel.org/all/20210514095001.13236-1-catalin.marinas@arm.com [2] Signed-off-by: Brian Ruley Reviewed-by: Will Deacon Cc: Fixes: 6012191aa9c6 ("ARM: 6380/1: Introduce __sync_icache_dcache() for VIPT caches") Signed-off-by: Will Deacon Signed-off-by: Russell King (Oracle) commit a39a7014825bd8d10b94fa4f953141b9473c25b4 Author: Dave Hansen Date: Tue Apr 21 08:19:09 2026 -0700 x86/mm: Revert INVLPGB optimization for set_memory code tl;dr: Revert an INVLPGB optimization that did not properly handle discontiguous virtual addresses. Full story: I got a report from some graphics (i915) folks that bisected a regression in their test suite to 86e6815b316e ("x86/mm: Change cpa_flush() to call flush_kernel_range() directly"). There was a bit of flip-flopping on the exact bisect, but the code here does seem wrong to me. The i915 folks were calling set_pages_array_wc(), so using the CPA_PAGES_ARRAY mode. Basically, the 'struct cpa_data' can wrap up all kinds of page table changes. Some of these are virtually contiguous, but some are very much not which is one reason why there are ->vaddr and ->pages arrays. 86e6815b316e made the mistake of assuming that the virtual addresses in the cpa_data are always contiguous. It got things right when neither CPA_ARRAY/CPA_PAGES_ARRAY is used, but theoretically wrong when either of those is used. In the i915 case, it probably failed to flush some WB TLB entries and install WC ones, leaving some data in the caches and not flushing it out to where the device could see it. That eventually caused graphics problems. Revert the INVLPGB optimization. It can be reintroduced later, but it will need to be a bit careful about the array modes. Fixes: 86e6815b316ec ("x86/mm: Change cpa_flush() to call flush_kernel_range()") Reported-by: Cui, Ling Signed-off-by: Dave Hansen Signed-off-by: Ingo Molnar Reviewed-by: Rick Edgecombe Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20260421151909.6B3281C6@davehans-spike.ostc.intel.com commit 75f7c47ccd78c947cf1b6ddb18ea453ff0555716 Author: Thomas Weißschuh Date: Wed Apr 22 17:10:27 2026 +0200 kbuild: Never respect CONFIG_WERROR / W=e to fixdep The fixdep hostprog may be built multiple times during a single build. Once during the configuration phase and later during the regular phase. As only the regular build phase respects CONFIG_WERROR / W=e, the compiler flags might change between the phases, leading to rebuilds. Example, the rebuilds will happen twice on each invocation of the build: $ make allyesconfig prepare make[1]: Entering directory '/tmp/deleteme' HOSTCC scripts/basic/fixdep # # No change to .config # HOSTCC scripts/basic/fixdep DESCEND objtool INSTALL libsubcmd_headers make[1]: Leaving directory '/tmp/deleteme' Fix the compilation flags used for scripts/basic/ before scripts/Makefile.warn is evaluated to stop CONFIG_WERROR / W=e influencing the fixdep build to avoid the spurious rebuilds. Fixes: 7ded7d37e5f5 ("scripts/Makefile.extrawarn: Respect CONFIG_WERROR / W=e for hostprogs") Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260422-kbuild-scripts-basic-werror-v1-1-8c6912ff22e0@weissschuh.net Signed-off-by: Nicolas Schier commit 4ce98bf0865c349e7026ad9c14f48da264920953 Author: Marc Zyngier Date: Thu Apr 23 17:36:07 2026 +0100 KVM: arm64: Wake-up from WFI when iqrchip is in userspace It appears that there is nothing in the wake-up path that evaluates whether the in-kernel interrupts are pending unless we have a vgic. This means that the userspace irqchip support has been broken for about four years, and nobody noticed. It was also broken before as we wouldn't wake-up on a PMU interrupt, but hey, who cares... It is probably time to remove the feature altogether, because it was a terrible idea 10 years ago, and it still is. Fixes: b57de4ffd7c6d ("KVM: arm64: Simplify kvm_cpu_has_pending_timer()") Link: https://patch.msgid.link/20260423163607.486345-1-maz@kernel.org Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit 5bb0aed57ba944f8c201e4e82ec066e0187e0f85 Author: Quentin Perret Date: Fri Apr 24 09:49:08 2026 +0100 KVM: arm64: Fix initialisation order in __pkvm_init_finalise() fix_host_ownership() walks the hypervisor's stage-1 page-table to adjust the host's stage-2 accordingly. Any such adjustment that requires cache maintenance operations depends on the per-CPU hyp fixmap being present. However, fix_host_ownership() is currently called before fix_hyp_pgtable_refcnt() and hyp_create_fixmap(), so the fixmap does not yet exist when it runs. This is benign today because the host stage-2 starts empty and no CMOs are needed, but it becomes a latent crash as soon as fix_host_ownership() is extended to operate on a non-empty page-table. Reorder the calls so that fix_hyp_pgtable_refcnt() and hyp_create_fixmap() complete before fix_host_ownership() is invoked. Fixes: 0d16d12eb26e ("KVM: arm64: Fix-up hyp stage-1 refcounts for all pages mapped at EL2") Signed-off-by: Quentin Perret Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260424084908.370776-7-tabba@google.com Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit 73b9c1e5da84cd69b1a86e374e450817cd051371 Author: Fuad Tabba Date: Fri Apr 24 09:49:07 2026 +0100 KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Two bugs exist in the vCPU initialisation path: 1. If a check fails after hyp_pin_shared_mem() succeeds, the cleanup path jumps to 'unlock' without calling unpin_host_vcpu() or unpin_host_sve_state(), permanently leaking pin references on the host vCPU and SVE state pages. Extract a register_hyp_vcpu() helper that performs the checks and the store. When register_hyp_vcpu() returns an error, call unpin_host_vcpu() and unpin_host_sve_state() inline before falling through to the existing 'unlock' label. 2. register_hyp_vcpu() publishes the new vCPU pointer into 'hyp_vm->vcpus[]' with a bare store, allowing a concurrent caller of pkvm_load_hyp_vcpu() to observe a partially initialised vCPU object. Ensure the store uses smp_store_release() and the load uses smp_load_acquire(). While 'vm_table_lock' currently serialises the store and the load, these barriers ensure the reader sees the fully initialised 'hyp_vcpu' object even if there were a lockless path or if the lock's own ordering guarantees were insufficient for nested object initialization. Fixes: 49af6ddb8e5c ("KVM: arm64: Add infrastructure to create and track pKVM instances at EL2") Reported-by: Ben Simner Co-developed-by: Will Deacon Signed-off-by: Will Deacon Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260424084908.370776-6-tabba@google.com Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit d89fdda7dd8a488f922e1175e6782f781ba8a23b Author: Fuad Tabba Date: Fri Apr 24 09:49:06 2026 +0100 KVM: arm64: Fix kvm_vcpu_initialized() macro parameter The macro is defined with parameter 'v' but the body references the literal token 'vcpu' instead, causing it to silently operate on whatever 'vcpu' resolves to in the caller's scope rather than the value passed by the caller. All current call sites happen to use a variable named 'vcpu', so the bug is latent. Fixes: e016333745c7 ("KVM: arm64: Only reset vCPU-scoped feature ID regs once") Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260424084908.370776-5-tabba@google.com Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit 08d715338287a1affb4c7ad5733decef4558a5c8 Author: Fuad Tabba Date: Fri Apr 24 09:49:05 2026 +0100 KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer FEAT_SPE_FnE is architecturally detected via PMSIDR_EL1.FnE [6], not ID_AA64DFR0_EL1.PMSVer. The FEAT_X macro form (register, field, value) cannot encode a PMSIDR_EL1-based feature, so FEAT_SPE_FnE was defined identically to FEAT_SPEv1p2 (ID_AA64DFR0_EL1, PMSVer, V1P2), producing a duplicate that used PMSVer >= V1P2 as a proxy. Replace the macro with feat_spe_fne(), following the same pattern as the sibling feat_spe_fds(): guard on FEAT_SPEv1p2 and read PMSIDR_EL1.FnE [6] directly. Wire the two NEEDS_FEAT consumers to use the new function. Remove the now-unused FEAT_SPE_FnE macro. Fixes: 63d423a7635b ("KVM: arm64: Switch to table-driven FGU configuration") Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260424084908.370776-4-tabba@google.com Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit 2a623408112626d2625a6f00aed665861d59665c Author: Fuad Tabba Date: Fri Apr 24 09:49:04 2026 +0100 KVM: arm64: Fix typo in feature check comments Revists -> Revisit. The following patch will add another similar line. No functional change intended. Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260424084908.370776-3-tabba@google.com Signed-off-by: Marc Zyngier commit 7fe2cd4e1a3ad230d8fcc00cc99c4bcce4412a75 Author: Fuad Tabba Date: Fri Apr 24 09:49:03 2026 +0100 KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer FEAT_Debugv8p9 is incorrectly defined against ID_AA64DFR0_EL1.PMUVer instead of ID_AA64DFR0_EL1.DebugVer. All three consumers of the macro gate features that are architecturally tied to FEAT_Debugv8p9 (DebugVer = 0b1011, DDI0487 M.b A2.2.10): - HDFGRTR2_EL2.nMDSELR_EL1, HDFGWTR2_EL2.nMDSELR_EL1: MDSELR_EL1 is present only when FEAT_Debugv8p9 is implemented (D24.3.21). - MDCR_EL2.EBWE: the Extended Breakpoint and Watchpoint Enable bit is RES0 unless FEAT_Debugv8p9 is implemented (D24.3.17). Neither register has any dependency on PMUVer. FEAT_Debugv8p9 and FEAT_PMUv3p9 are independent. Per DDI0487 M.b A2.2.10, FEAT_Debugv8p9 is unconditionally mandatory from Armv8.9, whereas FEAT_PMUv3p9 is mandatory only when FEAT_PMUv3 is implemented. An Armv8.9 CPU without a PMU has DebugVer = 0b1011 but PMUVer = 0b0000, so the wrong field check would cause KVM to incorrectly treat EBWE and MDSELR_EL1 as RES0 on such hardware. Fixes: 4bc0fe089840 ("KVM: arm64: Add sanitisation for FEAT_FGT2 registers") Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260424084908.370776-2-tabba@google.com Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit 480ea48cad873b49a1fabd07c0847c3cf1c32286 Author: Sebastian Ene Date: Wed Apr 8 11:41:18 2026 +0000 KVM: arm64: Reject non compliant SMCCC function calls in pKVM Prevent the propagation of a function-id that has the top bits set since this is not compliant with the SMCCC spec and can overlap with the already known function-id decoders. (eg. if we invoke an smc with 0xffffffffc4000012 it will be decoded as a PSCI reset call). Instead, make it clear that we don't support it and return an error. Signed-off-by: Sebastian Ene Link: https://patch.msgid.link/20260408114118.422604-1-sebastianene@google.com Signed-off-by: Marc Zyngier commit a0e6ae45af17e8b27958830595799c702ffbab8d Author: David Woodhouse Date: Tue Apr 7 21:27:02 2026 +0100 KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value The uaccess write handlers for GICD_IIDR in both GICv2 and GICv3 extract the revision field from 'reg' (the current IIDR value read back from the emulated distributor) instead of 'val' (the value userspace is trying to write). This means userspace can never actually change the implementation revision — the extracted value is always the current one. Fix the FIELD_GET to use 'val' so that userspace can select a different revision for migration compatibility. Fixes: 49a1a2c70a7f ("KVM: arm64: vgic-v3: Advertise GICR_CTLR.{IR, CES} as a new GICD_IIDR revision") Signed-off-by: David Woodhouse Link: https://patch.msgid.link/20260407210949.2076251-2-dwmw2@infradead.org Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit 56d0a0b38faa13836568d425f6ea806e27f3a69e Merge: 028ef9c96e9619 2fc87d37be1b73 Author: Dave Airlie Date: Fri Apr 24 13:17:50 2026 +1000 Merge tag 'drm-misc-fixes-2026-04-23' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes This week in drm-misc-fixes, we have: - A patch to raise the vblank timeout to avoid it on virtual drivers - a state check fix for stm_lvds - a use-after-free fix for dma-buf - a mapping fix for panthor - a device_node reference leak fix for arcgpu - a bridge reference leak fix for dw-mipi-dsi - a sparse warning fix for dma-fence - a kconfig fix for hv - a memory leak fix for nouveau - a fix to duplicate colorop when duplicating states - a panel initialisation order fix for visionox-rm69299 - a fix to prevent an infinite loop for v3d - an overflow fix for nouveau Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260423-realistic-eager-reindeer-4dacf7@houat commit 1081de1accb2b224516cca7071122c59532d0b22 Author: Weiming Shi Date: Thu Apr 23 11:38:32 2026 -0700 bpf: Fix NULL pointer dereference in bpf_skb_fib_lookup() When tot_len is not provided by the user, bpf_skb_fib_lookup() resolves the FIB result's output device via dev_get_by_index_rcu() to check skb forwardability and fill in mtu_result. The returned pointer is dereferenced without a NULL check. If the device is concurrently unregistered, dev_get_by_index_rcu() returns NULL and is_skb_forwardable() crashes at dev->flags: KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7] Call Trace: is_skb_forwardable (include/linux/netdevice.h:4365) bpf_skb_fib_lookup (net/core/filter.c:6446) bpf_prog_test_run_skb (net/bpf/test_run.c) __sys_bpf (kernel/bpf/syscall.c) Add the missing NULL check, returning -ENODEV to be consistent with how bpf_ipv4_fib_lookup() and bpf_ipv6_fib_lookup() handle the same condition. Fixes: 4f74fede40df ("bpf: Add mtu checking to FIB forwarding helper") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Signed-off-by: Martin KaFai Lau Acked-by: Paul Chaignon Link: https://patch.msgid.link/20260423183831.1325480-2-bestswngs@gmail.com commit 6451d58a355642b612f2bf948ad39108c998ac2a Author: Kuniyuki Iwashima Date: Mon Apr 20 19:48:41 2026 +0000 sockmap: Fix sk_psock_drop() race vs sock_map_{unhash,close,destroy}(). syzbot reported a splat in sock_map_destroy() [0], where psock was NULL even though sk->sk_prot still pointed to tcp_bpf_prots[][]. The stack trace shows how badly the path was excercised, see inet_release() calls tcp_close(), not sock_map_close() yet, but finally reaching sock_map_destroy(). The root cause is a lack of synchronisation. Even if sk_psock_get() fails to bump psock->refcnt, it does not guarantee that sk_psock_drop() has finished, and thus sk->sk_prot might not have been restored to the original one. Commit 4b4647add7d3 ("sock_map: avoid race between sock_map_close and sk_psock_put") attempted to address this, but it was insufficient for two reasons. It did not cover sock_map_unhash() and sock_map_destroy(), and it missed the corner case where sk_psock() is NULL. On non-x86 platforms, sk_psock_restore_proto(sk, psock) and rcu_assign_sk_user_data(sk, NULL) can be reordered because there is no address dependency between sk->sk_prot and sk->sk_user_data. sk_psock_get() returning NULL implies nothing about sk->sk_prot. Let's simply retry sk_psock_get() in the unlikely case. Note that we cannot avoid loop even if we added memory barrier in sk_psock_drop() and sock_map_psock_get_checked(). Also note that sock_map_destroy() cannot be called from softirq while sock_map_close() has also been running. It is because sock_map_destroy() requires SOCK_DEAD, so sock_map_destroy() cannot happen until sock_map_close() has finished the saved_close() (which is tcp_close()). [0]: WARNING: CPU: 1 PID: 8459 at net/core/sock_map.c:1667 sock_map_destroy+0x28b/0x2b0 net/core/sock_map.c:1667 Modules linked in: CPU: 1 UID: 0 PID: 8459 Comm: syz.0.1109 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:sock_map_destroy+0x28b/0x2b0 net/core/sock_map.c:1667 Code: 8b 36 49 83 c6 38 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 93 62 22 f9 4d 8b 3e e9 79 ff ff ff e8 a6 2b c3 f8 90 <0f> 0b 90 eb 9c e8 9b 2b c3 f8 4c 89 e7 be 03 00 00 00 e8 0e 4e bc RSP: 0018:ffffc9000d067be8 EFLAGS: 00010293 RAX: ffffffff88fb30aa RBX: ffff888024832000 RCX: ffff888024283b80 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed100862e946 R12: dffffc0000000000 R13: ffff888024832000 R14: ffffffff995b2208 R15: ffffffff88fb2e20 FS: 0000555579a7d500(0000) GS:ffff8881269c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00002000000048c0 CR3: 000000003713a000 CR4: 00000000003526f0 Call Trace: inet_csk_destroy_sock+0x166/0x3a0 net/ipv4/inet_connection_sock.c:1294 __tcp_close+0xcc1/0xfd0 net/ipv4/tcp.c:3262 tcp_close+0x28/0x110 net/ipv4/tcp.c:3274 inet_release+0x144/0x190 net/ipv4/af_inet.c:435 __sock_release net/socket.c:649 [inline] sock_close+0xc0/0x240 net/socket.c:1439 __fput+0x45b/0xa80 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f265847ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd158dfbd8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 000000000002ddb0 RCX: 00007f265847ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f26586a7da0 R08: 0000000000000001 R09: 0000000e158dfecf R10: 0000001b30a20000 R11: 0000000000000246 R12: 00007f26586a5fac R13: 00007f26586a5fa0 R14: ffffffffffffffff R15: 00007ffd158dfcf0 Fixes: 1aa12bdf1bfb ("bpf: sockmap, add sock close() hook to remove socks") Fixes: b05545e15e1f ("bpf: sockmap, fix transition through disconnect without close") Fixes: d8616ee2affc ("bpf, sockmap: Fix sk->sk_forward_alloc warn_on in sk_stream_kill_queues") Reported-by: syzbot+b0842d38af58376d1fdc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/bpf/69cec5ef.050a0220.2dbe29.0009.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260420194846.1089595-1-kuniyu@google.com commit 375e4e33c18dfa05c5dfd5f3dfffeb29343dd4c7 Author: Weiming Shi Date: Tue Apr 21 23:54:12 2026 -0700 bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get(). Fixes: 5d800f87d0a5 ("bpf: Support lockless unlink when freeing map or local storage") Reported-by: Xiang Mei Acked-by: Amery Hung Signed-off-by: Weiming Shi Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260422065411.1007737-2-bestswngs@gmail.com commit dd6c438c3e64a5ff0b5d7e78f7f9be547803ef1b Merge: bd1886d6e4ca6b ac8777cc36224b Author: Linus Torvalds Date: Thu Apr 23 17:08:04 2026 -0700 Merge tag 'vfs-7.1-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - eventpoll: fix ep_remove() UAF and follow-up cleanup - fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error - writeback: Fix use after free in inode_switch_wbs_work_fn() - fuse: reject oversized dirents in page cache - fs: aio: reject partial mremap to avoid Null-pointer-dereference error - nstree: fix func. parameter kernel-doc warnings - fs: Handle multiply claimed blocks more gracefully with mmb * tag 'vfs-7.1-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: eventpoll: drop vestigial epi->dying flag eventpoll: drop dead bool return from ep_remove_epi() eventpoll: refresh eventpoll_release() fast-path comment eventpoll: move f_lock acquisition into ep_remove_file() eventpoll: fix ep_remove struct eventpoll / struct file UAF eventpoll: move epi_fget() up eventpoll: rename ep_remove_safe() back to ep_remove() eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() eventpoll: kill __ep_remove() eventpoll: split __ep_remove() eventpoll: use hlist_is_singular_node() in __ep_remove() fs: Handle multiply claimed blocks more gracefully with mmb nstree: fix func. parameter kernel-doc warnings fs: aio: reject partial mremap to avoid Null-pointer-dereference error fuse: reject oversized dirents in page cache writeback: Fix use after free in inode_switch_wbs_work_fn() fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error commit bd1886d6e4ca6b84041d17ba6e11d0f85f7ee1a4 Merge: d0ed69f3e38027 1249c01aa42160 Author: Linus Torvalds Date: Thu Apr 23 17:04:18 2026 -0700 Merge tag 'v7.1-rc-part2-ksmbd-fixes' of git://git.samba.org/ksmbd Pull more smb server updates from Steve French: - move fs/smb/common/smbdirect to fs/smb/smbdirect - change signature calc to use AES-CMAC library, simpler and faster - invalid signature fix - multichannel fix - open create options fix - fix durable handle leak - cap maximum lock count to avoid potential denial of service - four connection fixes: connection free and session destroy IDA fixes, refcount fix, connection leak fix, max_connections off by one fix - IPC validation fix - fix out of bounds write in getting xattrs - fix use after free in durable handle reconnect - three ACL fixes: fix potential ACL overflow, harden num_aces check, and fix minimum ACE size check * tag 'v7.1-rc-part2-ksmbd-fixes' of git://git.samba.org/ksmbd: smb: smbdirect: move fs/smb/common/smbdirect/ to fs/smb/smbdirect/ smb: server: stop sending fake security descriptors ksmbd: scope conn->binding slowpath to bound sessions only ksmbd: fix CreateOptions sanitization clobbering the whole field ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open ksmbd: fix O(N^2) DoS in smb2_lock via unbounded LockCount ksmbd: destroy async_ida in ksmbd_conn_free() ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() ksmbd: Use AES-CMAC library for SMB3 signature calculation ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment ksmbd: use check_add_overflow() to prevent u16 DACL size overflow ksmbd: fix use-after-free in smb2_open during durable reconnect ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() smb: server: fix max_connections off-by-one in tcp accept path ksmbd: require minimum ACE size in smb_check_perm_dacl() ksmbd: validate response sizes in ipc_validate_msg() smb: server: fix active_num_conn leak on transport allocation failure commit d0ed69f3e380276e7ab36f1a3f19702c5e993915 Merge: e728258debd553 a83307f34e0bd9 Author: Linus Torvalds Date: Thu Apr 23 16:59:55 2026 -0700 Merge tag 'v7.1-rc1-part3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Four bug fixes: OOB read in ioctl query info, 3 ACL fixes - SMB1 Unix extensions mount fix - Four crypto improvements: move to AES-CMAC library, simpler and faster - Remove drop_dir_cache to avoid potential crash, and move to /procfs - Seven SMB3.1.1 compression fixes * tag 'v7.1-rc1-part3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: Drop 'allocate_crypto' arg from smb*_calc_signature() smb: client: Make generate_key() return void smb: client: Remove obsolete cmac(aes) allocation smb: client: Use AES-CMAC library for SMB3 signature calculation smb: common: add SMB3_COMPRESS_MAX_ALGS smb: client: compress: add code docs to lz77.c smb: client: compress: LZ77 optimizations smb: client: compress: increase LZ77_MATCH_MAX_DIST smb: client: compress: fix counting in LZ77 match finding smb: client: compress: fix buffer overrun in lz77_compress() smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl smb: client: fix (remove) drop_dir_cache module parameter smb: client: require a full NFS mode SID before reading mode bits smb: client: validate the whole DACL before rewriting it in cifsacl smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path cifs: update internal module version number smb: client: compress: fix bad encoding on last LZ77 flag smb: client: fix dir separator in SMB1 UNIX mounts commit e728258debd553c95d2e70f9cd97c9fde27c7130 Merge: e8df5a0c0d0415 5e6391da4539c3 Author: Linus Torvalds Date: Thu Apr 23 16:50:42 2026 -0700 Merge tag 'net-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from Netfilter. Steady stream of fixes. Last two weeks feel comparable to the two weeks before the merge window. Lots of AI-aided bug discovery. A newer big source is Sashiko/Gemini (Roman Gushchin's system), which points out issues in existing code during patch review (maybe 25% of fixes here likely originating from Sashiko). Nice thing is these are often fixed by the respective maintainers, not drive-bys. Current release - new code bugs: - kconfig: MDIO_PIC64HPSC should depend on ARCH_MICROCHIP Previous releases - regressions: - add async ndo_set_rx_mode and switch drivers which we promised to be called under the per-netdev mutex to it - dsa: remove duplicate netdev_lock_ops() for conduit ethtool ops - hv_sock: report EOF instead of -EIO for FIN - vsock/virtio: fix MSG_PEEK calculation on bytes to copy Previous releases - always broken: - ipv6: fix possible UAF in icmpv6_rcv() - icmp: validate reply type before using icmp_pointers - af_unix: drop all SCM attributes for SOCKMAP - netfilter: fix a number of bugs in the osf (OS fingerprinting) - eth: intel: fix timestamp interrupt configuration for E825C Misc: - bunch of data-race annotations" * tag 'net-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (148 commits) rxrpc: Fix error handling in rxgk_extract_token() rxrpc: Fix re-decryption of RESPONSE packets rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets rxrpc: Fix missing validation of ticket length in non-XDR key preparsing rxgk: Fix potential integer overflow in length check rxrpc: Fix conn-level packet handling to unshare RESPONSE packets rxrpc: Fix potential UAF after skb_unshare() failure rxrpc: Fix rxkad crypto unalignment handling rxrpc: Fix memory leaks in rxkad_verify_response() net: rds: fix MR cleanup on copy error m68k: mvme147: Make me the maintainer net: txgbe: fix firmware version check selftests/bpf: check epoll readiness during reuseport migration tcp: call sk_data_ready() after listener migration vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() ipv6: Cap TLV scan in ip6_tnl_parse_tlv_enc_lim tipc: fix double-free in tipc_buf_append() llc: Return -EINPROGRESS from llc_ui_connect() ipv4: icmp: validate reply type before using icmp_pointers selftests/net: packetdrill: cover RFC 5961 5.2 challenge ACK on both edges ... commit e8df5a0c0d041588e7f02781822d637d226cdbe8 Merge: 5fb4fde3b287fd 79fc229e8a4713 Author: Linus Torvalds Date: Thu Apr 23 16:45:17 2026 -0700 Merge tag 'i2c-for-7.1-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: - cx92755: convert I2C bindings to DT schema - mediatek: add optional bus power management during transfers - pxa: handle early bus busy condition - MAINTAINERS: update I2C RUST entry * tag 'i2c-for-7.1-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: MAINTAINERS: add Rust I2C tree and update Igor Korotin's email i2c: mediatek: add bus regulator control for power saving dt-bindings: i2c: cnxt,cx92755-i2c: Convert to DT schema i2c: pxa: handle 'Early Bus Busy' condition on Armada 3700 commit 5fb4fde3b287fdd9097c53fee7126c2f74698073 Merge: 9c59b464517c6e aa5903b47d4bc0 Author: Linus Torvalds Date: Thu Apr 23 16:40:03 2026 -0700 Merge tag 'xtensa-20260422' of https://github.com/jcmvbkbc/linux-xtensa Pull Xtensa updates from Max Filippov: - use register_sys_off_handler(SYS_OFF_MODE_RESTART) instead of the deprecated register_restart_handler() - drop custom ucontext.h and reuse asm-generic ucontext.h * tag 'xtensa-20260422' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: uapi: Reuse asm-generic ucontext.h xtensa: xtfpga: Use register_sys_off_handler(SYS_OFF_MODE_RESTART) xtensa: xt2000: Use register_sys_off_handler(SYS_OFF_MODE_RESTART) xtensa: ISS: Use register_sys_off_handler(SYS_OFF_MODE_RESTART) commit e49712ef03dbc4e282dd0e76469642279c2811e5 Merge: 52edde745dde8f 74b73fa56a395d Author: Dave Airlie Date: Fri Apr 24 09:17:31 2026 +1000 Merge tag 'amd-drm-fixes-7.1-2026-04-23' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-7.1-2026-04-23: amdgpu: - DC idle state manager fix - ASPM fix - GPUVM SVM fix - DCE 6 fix amdkfd: - num_of_nodes bounds check fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260423170129.2345978-1-alexander.deucher@amd.com commit 52edde745dde8fff44e9f0eeeb77a4e38ef9eef6 Merge: a6fe8bd56f7344 f6c73e7156b54d Author: Dave Airlie Date: Fri Apr 24 09:16:33 2026 +1000 Merge tag 'drm-misc-next-fixes-2026-04-23' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Short summary of fixes pull: rcar-du: - fix NULL-ptr crash Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260423130852.GA114622@linux.fritz.box commit 0c22ed0fadcad620277a56c0ba2867d4850d053a Merge: fc5f996bfb7576 15d07f9ef4af71 Author: Jakub Kicinski Date: Thu Apr 23 14:54:20 2026 -0700 Merge branch 'remove-a-number-of-isa-and-pcmcia-ethernet-drivers' Andrew Lunn says: ==================== Remove a number of ISA and PCMCIA Ethernet drivers These old drivers have not been much of a Maintenance burden until recently. Now there are more newbies using AI and fuzzers finding issues, resulting in more work for Maintainers. Fixing these old drivers make little sense, if it is not clear they have users. These mostly ISA and PCMCIA Ethernet devices, mostly from the last century, a couple from 2001 or 2002. It seems unlikely they are still used. However, remove them one patch at a time so they can be brought back if somebody still has the hardware, runs modern kernels and wants to take up the roll of driver Maintainer. ==================== Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-0-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit 15d07f9ef4af71e454cde4eebfbf7676ac0d972e Author: Andrew Lunn Date: Wed Apr 22 13:01:58 2026 -0500 drivers: net: 8390: wd80x3: Remove this driver The wd80x3 was written by Donald Becker 1993 to 1994. It is an ISA device, so unlikely to be used with modern kernels. Acked-by: Dominik Brodowski Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-15-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit b0b807aa78d213ee08759130ba6a2e92fb5a3b76 Author: Andrew Lunn Date: Wed Apr 22 13:01:57 2026 -0500 drivers: net: 8390: ultra: Remove this driver The ultra was written by Donald Becker 1993 to 1998. It is an ISA device, so unlikely to be used with modern kernels. Acked-by: Dominik Brodowski Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-14-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit 57835223486216bc8b4187269e03dba1dc62168b Author: Andrew Lunn Date: Wed Apr 22 13:01:55 2026 -0500 drivers: net: 8390: AX88190: Remove this driver The ax88190 was written by David A. Hinds in 2001. It is an PCMCIA device, so unlikely to be used with modern kernels. Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-12-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit 51c1c88b64354a1c535799a7751cad20fa32f779 Author: Andrew Lunn Date: Wed Apr 22 13:01:54 2026 -0500 drivers: net: fujitsu: fmvj18x: Remove this driver The fmvj18x was written by Shingo Fujimoto in 2002. It is an PCMCIA device, so unlikely to be used with modern kernels. Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-11-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit a3fb9a5bf66071e21f51696816f79bb0c051908c Author: Andrew Lunn Date: Wed Apr 22 13:01:51 2026 -0500 drivers: net: smsc: smc91c92: Remove this driver The smc91c92 was written by David A Hinds in 1999. It is an PCMCIA device, so unlikely to be used with modern kernels. Remove the Documentation as well, since it refers to kernel versions 1.2.13 until 1.3.71 and FTP sites which no longer exist. Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-8-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit 9fdf9f61fa6d3cb31ba501f65522fcd9f5c8acd4 Author: Andrew Lunn Date: Wed Apr 22 13:01:50 2026 -0500 drivers: net: smsc: smc9194: Remove this driver The smc9194 was written by Erik Stahlman in 1996. It is an ISA device, so unlikely to be used with modern kernels. Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-7-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit 29103588d74d95d7cb0847450fe3a2c39dd4d829 Author: Andrew Lunn Date: Wed Apr 22 13:01:49 2026 -0500 drivers: net: amd: nmclan: Remove this driver The nmclan was written by Roger C Pao in 1995. It is an PCMCIA device, so unlikely to be used with modern kernels. Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-6-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit 2fbd04dc74cef371895ae2a17c99eb7c82a02984 Author: Andrew Lunn Date: Wed Apr 22 13:01:48 2026 -0500 drivers: net: amd: lance: Remove this driver The lance was written by Donald Becker between 1993-1998. It is an ISA device, so unlikely to be used with modern kernels. Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-5-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit 4ff8d0672d99a80785a3051dc47a9f8b0684ebff Author: Andrew Lunn Date: Wed Apr 22 13:01:47 2026 -0500 drivers: net: 3com: 3c589: Remove this driver The 3c589 was written by David A. Hinds 2001. It is an PCMCIA device, so unlikely to be used with modern kernels. Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-4-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit a7fbf27d77b1c993cbe097f35bb44f98a54a6b09 Author: Andrew Lunn Date: Wed Apr 22 13:01:46 2026 -0500 drivers: net: 3com: 3c574: Remove this driver The 3c574 was written by Donald Becker between 1993-1998. It is an PCMCIA device, so unlikely to be used with modern kernels. Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-3-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit 082b2e07ccd84af2ed88ccc3316033ac64942008 Author: Andrew Lunn Date: Wed Apr 22 13:01:45 2026 -0500 drivers: net: 3com: 3c515: Remove this driver The 3c515 was written by Donald Becker between 1997-1998. It is an ISA device, so unlikely to be used with modern kernels. Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-2-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit 91f3a27ae9f66d81a5906461762c37c8a2bcab06 Author: Andrew Lunn Date: Wed Apr 22 13:01:44 2026 -0500 drivers: net: 3com: 3c509: Remove this driver The 3c509 was written by Donald Becker between 1993-2000. It is an ISA device, so unlikely to be used with modern kernels. Signed-off-by: Andrew Lunn Link: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-1-08a5b59784d5@lunn.ch Signed-off-by: Jakub Kicinski commit ac8777cc36224b4705d2c6efb10c56135d479b21 Merge: 9a466382c5e1ab 07422c948f4bdf Author: Christian Brauner Date: Fri Apr 24 00:29:48 2026 +0200 Merge patch series "eventpoll: fix ep_remove() UAF and follow-up cleanup" Christian Brauner says: ep_remove() (via __ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file in the same critical section: is_file_epoll(), hlist_del_rcu() through the head, spin_unlock. A concurrent __fput() on the watched eventpoll caught the transient NULL in eventpoll_release()'s lockless fast path, skipped eventpoll_release_file() entirely, and ran to ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(). That kfree()s the struct eventpoll whose embedded ->refs hlist_head is exactly where epi->fllink.pprev points and the subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed kmalloc-192 memory, which is the slab-use-after-free KASAN caught. struct file is SLAB_TYPESAFE_BY_RCU on top of that so the same window also lets the slot recycle while ep_remove() is still nominally inside file->f_lock. The upshot is an attacker-influencable kmem_cache_free() against the wrong slab cache. The comment on eventpoll_release()'s fast path - "False positives simply cannot happen because the file in on the way to be removed and nobody ( but eventpoll ) has still a reference to this file" - was itself the wrong invariant this race exploits. The fix pins @file via epi_fget() at the top of ep_remove() and gates the f_ep clear / hlist_del_rcu() on the pin succeeding. With the pin held __fput() cannot start which transitively keeps the watched struct eventpoll alive across the critical section and also prevents the struct file slot from recycling. Both UAFs are closed. If the pin fails __fput() is already in flight on @file. Because we bail before clearing f_ep that path takes eventpoll_release()'s slow path into eventpoll_release_file() which blocks on ep->mtx until ep_clear_and_put() drops it and then cleans up the orphaned epi. The bailed epi's share of ep->refcount stays intact so ep_clear_and_put()'s trailing ep_refcount_dec_and_test() cannot free the eventpoll out from under eventpoll_release_file(). With epi_fget() now gating every ep_remove() call the epi->dying flag becomes vestigial. epi->dying == true always coincides with file_ref_get() == false because __fput() is reachable only once the refcount hits zero and the refcount is monotone there. The last patch drops the flag and leaves a single coordination mechanism instead of two. * patches from https://patch.msgid.link/20260423-work-epoll-uaf-v1-0-2470f9eec0f5@kernel.org: eventpoll: drop vestigial epi->dying flag eventpoll: drop dead bool return from __ep_remove_epi() eventpoll: refresh eventpoll_release() fast-path comment eventpoll: move f_lock acquisition into __ep_remove_file() eventpoll: fix ep_remove struct eventpoll / struct file UAF eventpoll: move epi_fget() up eventpoll: rename ep_remove_safe() back to ep_remove() eventpoll: kill __ep_remove() eventpoll: split __ep_remove() eventpoll: use hlist_is_singular_node() in __ep_remove() Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-0-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner commit 07422c948f4bdf15567a129a0983f7c12e57ba8e Author: Christian Brauner Date: Thu Apr 23 11:56:13 2026 +0200 eventpoll: drop vestigial epi->dying flag With ep_remove() now pinning @file via epi_fget() across the f_ep clear and hlist_del_rcu(), the dying flag no longer orchestrates anything: it was set in eventpoll_release_file() (which only runs from __fput(), i.e. after @file's refcount has reached zero) and read in __ep_remove() / ep_remove() as a cheap bail before attempting the same synchronization epi_fget() now provides unconditionally. The implication is simple: epi->dying == true always coincides with file_ref_get(&file->f_ref) == false, because __fput() is reachable only once the refcount hits zero and the refcount is monotone in that state. The READ_ONCE(epi->dying) in ep_remove() therefore selects exactly the same callers that epi_fget() would reject, just one atomic cheaper. That's not worth a struct field, a second coordination mechanism, and the comments on both. Refresh the eventpoll_release_file() comment to describe what actually makes the path race-free now (the pin in ep_remove()). No functional change: the correctness argument is unchanged, only the mechanism is now a single one instead of two. Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-10-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner (Amutable) commit 3a4551ea9c042502019b1d8a986e962cb9015366 Author: Christian Brauner Date: Thu Apr 23 11:56:12 2026 +0200 eventpoll: drop dead bool return from ep_remove_epi() ep_remove_epi() always returns true -- the "can be disposed" answer was meaningful back when the dying-check lived inside the pre-split __ep_remove(), but after that check moved to ep_remove() the return value is just noise. Both callers gate on it unconditionally: if (ep_remove_epi(ep, epi)) WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); dispose = ep_remove_epi(ep, epi); ... if (dispose && ep_refcount_dec_and_test(ep)) ep_free(ep); Make ep_remove_epi() return void, drop the dispose local in eventpoll_release_file(), and the useless conditionals at both callers. No functional change. Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-9-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner (Amutable) commit 33e92e9ecf48c08cb4807e9a36f9eb01619c1a1e Author: Christian Brauner Date: Thu Apr 23 11:56:11 2026 +0200 eventpoll: refresh eventpoll_release() fast-path comment The old comment justified the lockless READ_ONCE(file->f_ep) check with "False positives simply cannot happen because the file is on the way to be removed and nobody ( but eventpoll ) has still a reference to this file." That reasoning was the root of the UAF fixed in "eventpoll: fix ep_remove struct eventpoll / struct file UAF": __ep_remove() could clear f_ep while another close raced past the fast path and freed the watched eventpoll / recycled the struct file slot. With ep_remove() now pinning @file via epi_fget() across the f_ep clear and hlist_del_rcu(), the invariant is re-established for the right reason: anyone who might clear f_ep holds @file alive for the duration, so a NULL observation really does mean no concurrent eventpoll path has work left on this file. Refresh the comment accordingly so the next reader doesn't inherit the broken model. Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-8-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner (Amutable) commit d30deeb8b0cf6259785c1fb79b87905d281b0a5a Author: Christian Brauner Date: Thu Apr 23 11:56:10 2026 +0200 eventpoll: move f_lock acquisition into ep_remove_file() Let the helper own its critical section end-to-end: take &file->f_lock at the top, read file->f_ep inside the lock, release on exit. Callers (ep_remove() and eventpoll_release_file()) no longer need to wrap the call, and the function-comment lock-handoff contract is gone. Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-7-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner (Amutable) commit a6dc643c69311677c574a0f17a3f4d66a5f3744b Author: Christian Brauner Date: Thu Apr 23 11:56:09 2026 +0200 eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays. Fixes: 58c9b016e128 ("epoll: use refcount to reduce ep_mutex contention") Reported-by: Jaeyoung Chung Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-6-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner (Amutable) commit 86e87059e6d1fd5115a31949726450ed03c1073b Author: Christian Brauner Date: Thu Apr 23 11:56:08 2026 +0200 eventpoll: move epi_fget() up We'll need it when removing files so move it up. No functional change. Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-5-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner (Amutable) commit 0bade234723e40e4937be912e105785d6a51464e Author: Christian Brauner Date: Thu Apr 23 11:56:07 2026 +0200 eventpoll: rename ep_remove_safe() back to ep_remove() The current name is just confusing and doesn't clarify anything. Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-4-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner (Amutable) commit 0feaf644f7180c4a91b6b405a881afbfd958f1cf Author: Christian Brauner Date: Fri Apr 24 00:23:18 2026 +0200 eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() With __ep_remove() gone, the double-underscore on __ep_remove_file() and __ep_remove_epi() no longer contrasts with a __-less parent and just reads as noise. Rename both to ep_remove_file() and ep_remove_epi(). No functional change. Signed-off-by: Christian Brauner (Amutable) commit e9e5cd40d7c403e19f21d0f7b8b8ba3a76b58330 Author: Christian Brauner Date: Thu Apr 23 11:56:06 2026 +0200 eventpoll: kill __ep_remove() Remove the boolean conditional in __ep_remove() and restructure the code so the check for racing with eventpoll_release_file() are only done in the ep_remove_safe() path where they belong. Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-3-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner (Amutable) commit 0f7bdfd413000985de09fc39eb9efa1e091a3ce0 Author: Christian Brauner Date: Thu Apr 23 11:56:05 2026 +0200 eventpoll: split __ep_remove() Split __ep_remove() to delineate file removal from epoll item removal. Suggested-by: Linus Torvalds Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-2-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner (Amutable) commit 3d9fd0abc94d8cd430cc7cd7d37ce5e5aae2cd2b Author: Christian Brauner Date: Thu Apr 23 11:56:04 2026 +0200 eventpoll: use hlist_is_singular_node() in __ep_remove() Replace the open-coded "epi is the only entry in file->f_ep" check with hlist_is_singular_node(). Same semantics, and the helper avoids the head-cacheline access in the common false case. Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-1-2470f9eec0f5@kernel.org Signed-off-by: Christian Brauner (Amutable) commit 9a466382c5e1ab706e155914e5532c80c2f3f76c Author: Jan Kara Date: Thu Apr 23 11:03:12 2026 +0200 fs: Handle multiply claimed blocks more gracefully with mmb When a metadata block is referenced by multiple inodes and tracked by metadata bh infrastructure (which is forbidden and generally indicates filesystem corruption), it can happen that mmb_mark_buffer_dirty() is called for two different mmb structures in parallel. This can lead to a corruption of mmb linked list. Handle that situation gracefully (at least from mmb POV) by serializing on setting bh->b_mmb. Reported-by: Ruikai Peng Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260423090311.10955-2-jack@suse.cz Signed-off-by: Christian Brauner commit 43eb354ecb471426e97b0ce6a0c922ec20f82027 Author: Randy Dunlap Date: Thu Apr 16 14:54:29 2026 -0700 nstree: fix func. parameter kernel-doc warnings Use the correct parameter name ("__ns") for function parameter kernel-doc to avoid 3 warnings: Warning: include/linux/nstree.h:68 function parameter '__ns' not described in 'ns_tree_add_raw' Warning: include/linux/nstree.h:77 function parameter '__ns' not described in 'ns_tree_add' Warning: include/linux/nstree.h:88 function parameter '__ns' not described in 'ns_tree_remove' Fixes: 885fc8ac0a4d ("nstree: make iterator generic") Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260416215429.948898-1-rdunlap@infradead.org Signed-off-by: Christian Brauner commit 3adf7ae18bf42601246031002287c103a27df307 Author: Zizhi Wo Date: Sat Apr 18 14:06:34 2026 +0800 fs: aio: reject partial mremap to avoid Null-pointer-dereference error [BUG] Recently, our internal syzkaller testing uncovered a null pointer dereference issue: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... [ 51.111664] filemap_read_folio+0x25/0xe0 [ 51.112410] filemap_fault+0xad7/0x1250 [ 51.113112] __do_fault+0x4b/0x460 [ 51.113699] do_pte_missing+0x5bc/0x1db0 [ 51.114250] ? __pte_offset_map+0x23/0x170 [ 51.114822] __handle_mm_fault+0x9f8/0x1680 ... Crash analysis showed the file involved was an AIO ring file. The phenomenon triggered is the same as the issue described in [1]. [CAUSE] Consider the following scenario: userspace sets up an AIO context via io_setup(), which creates a VMA covering the entire ring buffer. Then userspace calls mremap() with the AIO ring address as the source, a smaller old_len (less than the full ring size), MREMAP_MAYMOVE set, and without MREMAP_DONTUNMAP. The kernel will relocate the requested portion to a new destination address. During this move, __split_vma() splits the original AIO ring VMA. The requested portion is unmapped from the source and re-established at the destination, while the remainder stays at the original source address as an orphan VMA. The aio_ring_mremap() callback fires on the new destination VMA, updating ctx->mmap_base to the destination address. But the callback is unaware that only a partial region was moved and that an orphan VMA still exists at the source: source(AIO): +-------------------+---------------------+ | moved to dest | orphan VMA (AIO) | +-------------------+---------------------+ A A+partial_len A+ctx->mmap_size dest: +-------------------+ | moved VMA (AIO) | +-------------------+ B B+partial_len Later, io_destroy() calls vm_munmap(ctx->mmap_base, ctx->mmap_size), which unmaps the destination. This not only fails to unmap the orphan VMA at the source, but also overshoots the destination VMA and may unmap unrelated mappings adjacent to it! After put_aio_ring_file() calls truncate_setsize() to remove all pages from the pagecache, any subsequent access to the orphan VMA triggers filemap_fault(), which calls a_ops->read_folio(). Since aio does not implement read_folio, this results in a NULL pointer dereference. [FIX] Note that expanding mremap (new_len > old_len) is already rejected because AIO ring VMAs are created with VM_DONTEXPAND. The only problematic case is a partial move where "old_len == new_len" but both are smaller than the full ring size. Fix this by checking in aio_ring_mremap() that the new VMA covers the entire ring. This ensures the AIO ring is always moved as a whole, preventing orphan VMAs and the subsequent crash. [1]: https://lore.kernel.org/all/20260413010814.548568-1-wozizhi@huawei.com/ Signed-off-by: Zizhi Wo Link: https://patch.msgid.link/20260418060634.3713620-1-wozizhi@huaweicloud.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 51a8de6c50bf947c8f534cd73da4c8f0a13e7bed Author: Samuel Page Date: Mon Apr 20 11:01:37 2026 +0200 fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks whether the dirent fits in the remaining space of the current page and advances to a fresh page if not. It never checks whether the dirent itself exceeds PAGE_SIZE. As a result, a malicious FUSE server can return a dirent with namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB page systems this causes memcpy() to overflow the cache page by 24 bytes into the following kernel page. Reject dirents that cannot fit in a single page before copying them into the readdir cache. Fixes: 69e34551152a ("fuse: allow caching readdir") Cc: stable@vger.kernel.org # v6.16+ Assisted-by: Bynario AI Signed-off-by: Samuel Page Reported-by: Qi Tang Reported-by: Zijun Hu Signed-off-by: Miklos Szeredi Link: https://patch.msgid.link/20260420090139.662772-1-mszeredi@redhat.com Signed-off-by: Christian Brauner commit 6689f01d6740cf358932b3e97ee968c6099800d9 Author: Jan Kara Date: Mon Apr 13 11:36:19 2026 +0200 writeback: Fix use after free in inode_switch_wbs_work_fn() inode_switch_wbs_work_fn() has a loop like: wb_get(new_wb); while (1) { list = llist_del_all(&new_wb->switch_wbs_ctxs); /* Nothing to do? */ if (!list) break; ... process the items ... } Now adding of items to the list looks like: wb_queue_isw() if (llist_add(&isw->list, &wb->switch_wbs_ctxs)) queue_work(isw_wq, &wb->switch_work); Because inode_switch_wbs_work_fn() loops when processing isw items, it can happen that wb->switch_work is pending while wb->switch_wbs_ctxs is empty. This is a problem because in that case wb can get freed (no isw items -> no wb reference) while the work is still pending causing use-after-free issues. We cannot just fix this by cancelling work when freeing wb because that could still trigger problematic 0 -> 1 transitions on wb refcount due to wb_get() in inode_switch_wbs_work_fn(). It could be all handled with more careful code but that seems unnecessarily complex so let's avoid that until it is proven that the looping actually brings practical benefit. Just remove the loop from inode_switch_wbs_work_fn() instead. That way when wb_queue_isw() queues work, we are guaranteed we have added the first item to wb->switch_wbs_ctxs and nobody is going to remove it (and drop the wb reference it holds) until the queued work runs. Fixes: e1b849cfa6b6 ("writeback: Avoid contention on wb->list_lock when switching inodes") CC: stable@vger.kernel.org Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260413093618.17244-2-jack@suse.cz Acked-by: Tejun Heo Signed-off-by: Christian Brauner commit c03ce4173c7bffe1e7477f905a09b015d4000d3c Author: Zizhi Wo Date: Mon Apr 13 09:08:14 2026 +0800 fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error [BUG] Recently, our internal syzkaller testing uncovered a null pointer dereference issue: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... [ 51.111664] filemap_read_folio+0x25/0xe0 [ 51.112410] filemap_fault+0xad7/0x1250 [ 51.113112] __do_fault+0x4b/0x460 [ 51.113699] do_pte_missing+0x5bc/0x1db0 [ 51.114250] ? __pte_offset_map+0x23/0x170 [ 51.114822] __handle_mm_fault+0x9f8/0x1680 [ 51.115408] handle_mm_fault+0x24c/0x570 [ 51.115958] do_user_addr_fault+0x226/0xa50 ... Crash analysis showed the file involved was an AIO ring file. [CAUSE] PARENT process CHILD process t=0 io_setup(1, &ctx) [access ctx addr] fork() io_destroy vm_munmap // not affect child vma percpu_ref_put ... put_aio_ring_file t=1 [access ctx addr] // pagefault ... __do_fault filemap_fault max_idx = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE) t=2 truncate_setsize truncate_pagecache t=3 filemap_get_folio // no folio, create folio __filemap_get_folio(..., FGP_CREAT, ...) // page_not_uptodate filemap_read_folio(file, mapping->a_ops->read_folio, folio) // oops! At t=0, the parent process calls io_setup and then fork. The child process gets its own VMA but without any PTEs. The parent then calls io_destroy. Before i_size is truncated to 0, at t=1 the child process accesses this AIO ctx address and triggers a pagefault. After the max_idx check passes, at t=2 the parent calls truncate_setsize and truncate_pagecache. At t=3 the child fails to obtain the folio, falls into the "page_not_uptodate" path, and hits this problem because AIO does not implement "read_folio". [Fix] Fix this by marking the AIO ring buffer VMA with VM_DONTCOPY so that fork()'s dup_mmap() skips it entirely. This is the correct semantic because: 1) The child's ioctx_table is already reset to NULL by mm_init_aio() during fork(), so the child has no AIO context and no way to perform any AIO operations on this mapping. 2) The AIO ring VMA is only meaningful in conjunction with its associated kioctx, which is never inherited across fork(). So child process with no AIO context has no legitimate reason to access the ring buffer. Delivering SIGSEGV on such an erroneous access is preferable to a kernel crash. Signed-off-by: Zizhi Wo Link: https://patch.msgid.link/20260413010814.548568-1-wozizhi@huawei.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit fc5f996bfb7576f8cffbba09cb02432622ffea61 Merge: 6deb53595092b1 aec3202247b4ab Author: Jakub Kicinski Date: Thu Apr 23 14:49:18 2026 -0700 Merge branch 'net-packetengines-remove-obsolete-pci-drivers' Mingyu Wang says: ==================== net: packetengines: remove obsolete PCI drivers As discussed with Andrew Lunn, this patch series removes the obsolete hamachi and yellowfin PCI drivers. Both drivers support hardware that is over two decades old and no longer in active use. Removing them eliminates dead code and reduces the overall maintenance burden on the netdev subsystem. ==================== Jakub: trim defconfigs appropriately Link: https://patch.msgid.link/20260422044820.485660-1-25181214217@stu.xidian.edu.cn Signed-off-by: Jakub Kicinski commit aec3202247b4ab41c5bf3b9f704a2d9a323a051b Author: Mingyu Wang <25181214217@stu.xidian.edu.cn> Date: Wed Apr 22 12:48:20 2026 +0800 net: packetengines: remove obsolete yellowfin driver and vendor dir Similar to the hamachi driver, the yellowfin driver supports hardware that is over two decades old and no longer in active use. Since yellowfin was the last remaining driver in the packetengines vendor directory, we can now safely remove the entire directory and drop its associated references from the parent Kconfig and Makefile. This eliminates dead code and reduces the overall maintenance burden on the netdev subsystem. Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260422044820.485660-3-25181214217@stu.xidian.edu.cn Signed-off-by: Jakub Kicinski commit 4cf42f9c3e3624fedf4f6c38c3d81d80c8b3cbd6 Author: Mingyu Wang <25181214217@stu.xidian.edu.cn> Date: Wed Apr 22 12:48:19 2026 +0800 net: packetengines: remove obsolete hamachi driver The PacketEngine Hamachi driver is for PCI hardware that has been obsolete for over two decades. It recently triggered arithmetic exceptions during automated fuzzing. As suggested by maintainers, remove the driver entirely to eliminate dead code and reduce the maintenance burden. Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260422044820.485660-2-25181214217@stu.xidian.edu.cn Signed-off-by: Jakub Kicinski commit 5e6391da4539c35422c0df1d1d2d9a9bb97cd736 Merge: 27ae4bcf4df480 3476c8bb960f48 Author: Jakub Kicinski Date: Thu Apr 23 14:29:17 2026 -0700 Merge branch 'rxrpc-miscellaneous-fixes' David Howells says: ==================== rxrpc: Miscellaneous fixes Here are some fixes for rxrpc, as found by Sashiko[1]: (1) Fix rxrpc_input_call_event() to only unshare DATA packets. (2) Fix re-decryption of RESPONSE packets where a partially decrypted skbuff gets requeued if there was a failure due to ENOMEM. (3) Fix error handling in rxgk_extract_token() where the ENOMEM case is unhandled. Link: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com [1] ==================== Link: https://patch.msgid.link/20260423200909.3049438-1-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 3476c8bb960f48e49355d6f93fb7673211e0163f Author: David Howells Date: Thu Apr 23 21:09:08 2026 +0100 rxrpc: Fix error handling in rxgk_extract_token() Fix a missing bit of error handling in rxgk_extract_token(): in the event that rxgk_decrypt_skb() returns -ENOMEM, it should just return that rather than continuing on (for anything else, it generates an abort). Fixes: 64863f4ca494 ("rxrpc: Fix unhandled errors in rxgk_verify_packet_integrity()") Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260423200909.3049438-4-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 0422e7a4883f25101903f3e8105c0808aa5f4ce9 Author: David Howells Date: Thu Apr 23 21:09:07 2026 +0100 rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet gets a temporary failure during processing, it may end up in a partially decrypted state - and then get requeued for a retry. Fix this by just discarding the packet; we will send another CHALLENGE packet and thereby elicit a further response. Similarly, discard an incoming CHALLENGE packet if we get an error whilst generating a RESPONSE; the server will send another CHALLENGE. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260423200909.3049438-3-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 55b2984c96c37f909bbfe8851f13152693951382 Author: David Howells Date: Thu Apr 23 21:09:06 2026 +0100 rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets Fix rxrpc_input_call_event() to only unshare DATA packets and not ACK, ABORT, etc.. And with that, rxrpc_input_packet() doesn't need to take a pointer to the pointer to the packet, so change that to just a pointer. Fixes: 1f2740150f90 ("rxrpc: Fix potential UAF after skb_unshare() failure") Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260423200909.3049438-2-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 27ae4bcf4df480eb7588e01de8f3c4fb74b11d30 Merge: 8141a2dc70080e ac33733b10b484 Author: Jakub Kicinski Date: Thu Apr 23 12:40:54 2026 -0700 Merge branch 'rxrpc-miscellaneous-fixes' David Howells says: ==================== rxrpc: Miscellaneous fixes Here are some fixes for rxrpc, as found by Sashiko[1]: (1) Fix leaks in rxkad_verify_response(). (2) Fix handling of rxkad-encrypted packets with crypto-misaligned lengths. (3) Fix problem with unsharing DATA packets potentially causing a crash in the caller. (4) Fix lack of unsharing of RESPONSE packets. (5) Fix integer overflow in RxGK ticket length check. (6) Fix missing length check in RxKAD tickets. ==================== Link: https://patch.msgid.link/20260422161438.2593376-1-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit ac33733b10b484d666f97688561670afd5861383 Author: Anderson Nascimento Date: Wed Apr 22 17:14:35 2026 +0100 rxrpc: Fix missing validation of ticket length in non-XDR key preparsing In rxrpc_preparse(), there are two paths for parsing key payloads: the XDR path (for large payloads) and the non-XDR path (for payloads <= 28 bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly validates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR path fails to do so. This allows an unprivileged user to provide a very large ticket length. When this key is later read via rxrpc_read(), the total token size (toksize) calculation results in a value that exceeds AFSTOKEN_LENGTH_MAX, triggering a WARN_ON(). [ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc] Fix this by adding a check in the non-XDR parsing path of rxrpc_preparse() to ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX, bringing it into parity with the XDR parsing logic. Fixes: 8a7a3eb4ddbe ("KEYS: RxRPC: Use key preparsing") Fixes: 84924aac08a4 ("rxrpc: Fix checker warning") Reported-by: Anderson Nascimento Signed-off-by: Anderson Nascimento Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260422161438.2593376-7-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 6929350080f4da292d111a3b33e53138fee51cec Author: David Howells Date: Wed Apr 22 17:14:34 2026 +0100 rxgk: Fix potential integer overflow in length check Fix potential integer overflow in rxgk_extract_token() when checking the length of the ticket. Rather than rounding up the value to be tested (which might overflow), round down the size of the available data. Fixes: 2429a1976481 ("rxrpc: Fix untrusted unsigned subtract") Closes: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260422161438.2593376-6-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 24481a7f573305706054c59e275371f8d0fe919f Author: David Howells Date: Wed Apr 22 17:14:33 2026 +0100 rxrpc: Fix conn-level packet handling to unshare RESPONSE packets The security operations that verify the RESPONSE packets decrypt bits of it in place - however, the sk_buff may be shared with a packet sniffer, which would lead to the sniffer seeing an apparently corrupt packet (actually decrypted). Fix this by handing a copy of the packet off to the specific security handler if the packet was cloned. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Closes: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260422161438.2593376-5-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 1f2740150f904bfa60e4bad74d65add3ccb5e7f8 Author: David Howells Date: Wed Apr 22 17:14:32 2026 +0100 rxrpc: Fix potential UAF after skb_unshare() failure If skb_unshare() fails to unshare a packet due to allocation failure in rxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thread()) will be NULL'd out. This will likely cause the call to trace_rxrpc_rx_done() to oops. Fix this by moving the unsharing down to where rxrpc_input_call_event() calls rxrpc_input_call_packet(). There are a number of places prior to that where we ignore DATA packets for a variety of reasons (such as the call already being complete) for which an unshare is then avoided. And with that, rxrpc_input_packet() doesn't need to take a pointer to the pointer to the packet, so change that to just a pointer. Fixes: 2d1faf7a0ca3 ("rxrpc: Simplify skbuff accounting in receive path") Closes: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260422161438.2593376-4-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit def304aae2edf321d2671fd6ca766a93c21f877e Author: David Howells Date: Wed Apr 22 17:14:31 2026 +0100 rxrpc: Fix rxkad crypto unalignment handling Fix handling of a packet with a misaligned crypto length. Also handle non-ENOMEM errors from decryption by aborting. Further, remove the WARN_ON_ONCE() so that it can't be remotely triggered (a trace line can still be emitted). Fixes: f93af41b9f5f ("rxrpc: Fix missing error checks for rxkad encryption/decryption failure") Closes: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260422161438.2593376-3-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 34f61a07e0cdefaecd3ec03bb5fb22215643678f Author: David Howells Date: Wed Apr 22 17:14:30 2026 +0100 rxrpc: Fix memory leaks in rxkad_verify_response() Fix rxkad_verify_response() to free the ticket and the server key under all circumstances by initialising the ticket pointer to NULL and then making all paths through the function after the first allocation has been done go through a single common epilogue that just releases everything - where all the releases skip on a NULL pointer. Fixes: 57af281e5389 ("rxrpc: Tidy up abort generation infrastructure") Fixes: ec832bd06d6f ("rxrpc: Don't retain the server key in the connection") Closes: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260422161438.2593376-2-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 9c59b464517c6ef0302ffa7d993a979a4cb50bf7 Merge: 45dcf5e2881395 beca8264d502bb Author: Linus Torvalds Date: Thu Apr 23 12:29:22 2026 -0700 Merge tag 'acpi-7.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fixes from Rafael Wysocki: "These fix two potential refcount leaks in error code paths in the ACPI core code, address a recently introduced build breakage related to the CPU UID handling consolidation, fix up a recently added MAINTAINERS entry, fix the quirk list in the ACPI video bus driver, and add a new quirk to it: - Add an acpi_get_cpu_uid() stub helper to address an x86 Xen support build breakage (Arnd Bergmann) - Use acpi_dev_put() in object add error paths in the ACPI core to avoid refcount leaks (Guangshuo Li) - Adjust the file entry in the recently added NVIDIA GHES HANDLER entry in MAINTAINERS to the actual existing file (Lukas Bulwahn) - Add backlight=native quirk for Dell OptiPlex 7770 AIO to the ACPI video bus driver (Jan Schär) - Move Lenovo Legion S7 15ACH6 quirk to the right section of the quirk list in the ACPI video bus driver (Hans de Goede)" * tag 'acpi-7.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO ACPI: add acpi_get_cpu_uid() stub helper MAINTAINERS: adjust file entry in NVIDIA GHES HANDLER ACPI: scan: Use acpi_dev_put() in object add error paths commit 6deb53595092b1426885f6503d93eedc1e3ece77 Author: Jakub Kicinski Date: Mon Apr 20 13:42:28 2026 -0700 net: remove unused ATM protocols and legacy ATM device drivers Remove the ATM protocol modules and PCI/SBUS ATM device drivers that are no longer in active use. The ATM core protocol stack, PPPoATM, BR2684, and USB DSL modem drivers (drivers/usb/atm/) are retained in-tree to maintain PPP over ATM (PPPoA) and PPPoE-over-BR2684 support for DSL connections. The Solos ADSL2+ PCI driver is also retained. Removed ATM protocol modules: - net/atm/clip.c - Classical IP over ATM (RFC 2225) - net/atm/lec.c - LAN Emulation Client (LANE) - net/atm/mpc.c, mpoa_caches.c, mpoa_proc.c - Multi-Protocol Over ATM Removed PCI/SBUS ATM device drivers (drivers/atm/): - adummy, atmtcp - software/testing ATM devices - eni - Efficient Networks ENI155P (OC-3, ~1995) - fore200e - FORE Systems 200E PCI/SBUS (OC-3, ~1999) - he - ForeRunner HE (OC-3/OC-12, ~2000) - idt77105 - IDT 77105 25 Mbps ATM PHY - idt77252 - IDT 77252 NICStAR II (OC-3, ~2000) - iphase - Interphase ATM PCI (OC-3/DS3/E3) - lanai - Efficient Networks Speedstream 3010 - nicstar - IDT 77201 NICStAR (155/25 Mbps, ~1999) - suni - PMC S/UNI SONET PHY library Also clean up references in: - net/bridge/ - remove ATM LANE hook (br_fdb_test_addr_hook, br_fdb_test_addr) - net/core/dev.c - remove br_fdb_test_addr_hook export - defconfig files - remove ATM driver config options The removed code is moved to an out-of-tree module package (mod-orphan). Acked-by: Andy Shevchenko Reviewed-by: Simon Horman Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260422041846.2035118-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8141a2dc70080eda1aedc0389ed2db2b292af5bd Author: Ao Zhou Date: Wed Apr 22 22:52:07 2026 +0800 net: rds: fix MR cleanup on copy error __rds_rdma_map() hands sg/pages ownership to the transport after get_mr() succeeds. If copying the generated cookie back to user space fails after that point, the error path must not free those resources again before dropping the MR reference. Remove the duplicate unpin/free from the put_user() failure branch so that MR teardown is handled only through the existing final cleanup path. Fixes: 0d4597c8c5ab ("net/rds: Track user mapped pages through special API") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Ao Zhou Signed-off-by: Ren Wei Reviewed-by: Allison Henderson Link: https://patch.msgid.link/79c8ef73ec8e5844d71038983940cc2943099baf.1776764247.git.draw51280@163.com Signed-off-by: Jakub Kicinski commit 7256eb3e0909fd77902d6d6ff086fd430cff3a58 Author: Daniel Palmer Date: Wed Apr 22 22:27:10 2026 +0900 m68k: mvme147: Make me the maintainer I'm actively using mainline + patches on this board as a bootloader for another VME board and as a terminal server using a multiport serial board in the same VME backplane. I even have mainline u-boot on real EPROMs. Make me the maintainer of its ethernet, scsi and arch code so I get an email before one or more of them get deleted. Signed-off-by: Daniel Palmer Link: https://patch.msgid.link/20260422132710.2855826-1-daniel@thingy.jp Signed-off-by: Jakub Kicinski commit c263f644add3d6ad81f9d62a99284fde408f0caa Author: Jiawen Wu Date: Wed Apr 22 15:18:37 2026 +0800 net: txgbe: fix firmware version check For the device SP, the firmware version is a 32-bit value where the lower 20 bits represent the base version number. And the customized firmware version populates the upper 12 bits with a specific identification number. For other devices AML 25G and 40G, the upper 12 bits of the firmware version is always non-zero, and they have other naming conventions. Only SP devices need to check this to tell if XPCS will work properly. So the judgement of MAC type is added here. And the original logic compared the entire 32-bit value against 0x20010, which caused the outdated base firmwares bypass the version check without a warning. Apply a mask 0xfffff to isolate the lower 20 bits for an accurate base version comparison. Fixes: ab928c24e6cd ("net: txgbe: add FW version warning") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Jacob Keller Link: https://patch.msgid.link/C787AA5C07598B13+20260422071837.372731-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit beca8264d502bbe8509141432c73ab7a816a4076 Merge: fbd5d52ebf4959 9c0acc169ac715 02c78abe1b373e 61b00c0ad209a7 Author: Rafael J. Wysocki Date: Thu Apr 23 20:59:48 2026 +0200 Merge branches 'acpi-scan', 'acpi-apei' and 'acpi-video' Merge an ACPI core fix, a fix for the new NVIDIA GHES HANDLER entry in MAINTAINERS, a new quirk for the ACPI video bus driver and a quirk list fix for that driver for 7.1-rc1: - Use acpi_dev_put() in object add error paths in the ACPI core to avoid refcount leaks (Guangshuo Li) - Adjust the file entry in the recently added NVIDIA GHES HANDLER entry in MAINTAINERS to the actual existing file (Lukas Bulwahn) - Add backlight=native quirk for Dell OptiPlex 7770 AIO to the ACPI video bus driver (Jan Schär) - Move Lenovo Legion S7 15ACH6 quirk to the right section of the quirk list in the ACPI video bus driver (Hans de Goede) * acpi-scan: ACPI: scan: Use acpi_dev_put() in object add error paths * acpi-apei: MAINTAINERS: adjust file entry in NVIDIA GHES HANDLER * acpi-video: ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO commit 07811361a3d0c59e741a02c8d4613258044a8750 Merge: e08a9fac5cf8c3 c01cfc4886752c Author: Jakub Kicinski Date: Thu Apr 23 11:54:45 2026 -0700 Merge branch 'tcp-fix-listener-wakeup-after-reuseport-migration' Zhenzhong Wu says: ==================== tcp: fix listener wakeup after reuseport migration This series fixes a missing wakeup when inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group after the child has already been queued for accept. The target listener receives the migrated accept-queue entry via inet_csk_reqsk_queue_add(), but its waiters are not notified. Nonblocking accept() still succeeds because it checks the accept queue directly, but readiness-based waiters can remain asleep until another connection generates a wakeup. Patch 1 notifies the target listener after a successful migration in inet_csk_listen_stop() and protects the post-queue_add() nsk accesses with rcu_read_lock()/rcu_read_unlock(). Patch 2 extends the existing migrate_reuseport BPF selftest with epoll readiness checks inside migrate_dance(), around shutdown() where the migration happens. The test now verifies that the target listener is not ready before migration and becomes ready immediately after it, for both TCP_ESTABLISHED and TCP_SYN_RECV. TCP_NEW_SYN_RECV remains excluded because it still depends on later handshake completion. Testing: - On a local unpatched kernel, the focused migrate_reuseport test fails for the listener-migration cases and passes for the TCP_NEW_SYN_RECV cases: not ok 1 IPv4 TCP_ESTABLISHED inet_csk_listen_stop not ok 2 IPv4 TCP_SYN_RECV inet_csk_listen_stop ok 3 IPv4 TCP_NEW_SYN_RECV reqsk_timer_handler ok 4 IPv4 TCP_NEW_SYN_RECV inet_csk_complete_hashdance not ok 5 IPv6 TCP_ESTABLISHED inet_csk_listen_stop not ok 6 IPv6 TCP_SYN_RECV inet_csk_listen_stop ok 7 IPv6 TCP_NEW_SYN_RECV reqsk_timer_handler ok 8 IPv6 TCP_NEW_SYN_RECV inet_csk_complete_hashdance - On a patched kernel booted under QEMU, the full migrate_reuseport selftest passes: ok 1 IPv4 TCP_ESTABLISHED inet_csk_listen_stop ok 2 IPv4 TCP_SYN_RECV inet_csk_listen_stop ok 3 IPv4 TCP_NEW_SYN_RECV reqsk_timer_handler ok 4 IPv4 TCP_NEW_SYN_RECV inet_csk_complete_hashdance ok 5 IPv6 TCP_ESTABLISHED inet_csk_listen_stop ok 6 IPv6 TCP_SYN_RECV inet_csk_listen_stop ok 7 IPv6 TCP_NEW_SYN_RECV reqsk_timer_handler ok 8 IPv6 TCP_NEW_SYN_RECV inet_csk_complete_hashdance SELFTEST_RC=0 ==================== Link: https://patch.msgid.link/20260422024554.130346-1-jt26wzz@gmail.com Signed-off-by: Jakub Kicinski commit c01cfc4886752c86f6d48c58f7b103a01b0caeca Author: Zhenzhong Wu Date: Wed Apr 22 10:45:54 2026 +0800 selftests/bpf: check epoll readiness during reuseport migration Inside migrate_dance(), add epoll checks around shutdown() to verify that the target listener is not ready before shutdown() and becomes ready immediately after shutdown() triggers migration. Cover TCP_ESTABLISHED and TCP_SYN_RECV. Exclude TCP_NEW_SYN_RECV as it depends on later handshake completion. Suggested-by: Kuniyuki Iwashima Reviewed-by: Kuniyuki Iwashima Signed-off-by: Zhenzhong Wu Link: https://patch.msgid.link/20260422024554.130346-3-jt26wzz@gmail.com Signed-off-by: Jakub Kicinski commit 3864c6ba1e041bc75342353a70fa2a2c6f909923 Author: Zhenzhong Wu Date: Wed Apr 22 10:45:53 2026 +0800 tcp: call sk_data_ready() after listener migration When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, the target listener gets a new accept-queue entry via inet_csk_reqsk_queue_add(), but that path never notifies the target listener's waiters. A nonblocking accept() still works because it checks the queue directly, but poll()/epoll_wait() waiters and blocking accept() callers can also remain asleep indefinitely. Call READ_ONCE(nsk->sk_data_ready)(nsk) after a successful migration in inet_csk_listen_stop(). However, after inet_csk_reqsk_queue_add() succeeds, the ref acquired in reuseport_migrate_sock() is effectively transferred to nreq->rsk_listener. Another CPU can then dequeue nreq via accept() or listener shutdown, hit reqsk_put(), and drop that listener ref. Since listeners are SOCK_RCU_FREE, wrap the post-queue_add() dereferences of nsk in rcu_read_lock()/rcu_read_unlock(), which also covers the existing sock_net(nsk) access in that path. The reqsk_timer_handler() path does not need the same changes for two reasons: half-open requests become readable only after the final ACK, where tcp_child_process() already wakes the listener; and once nreq is visible via inet_ehash_insert(), the success path no longer touches nsk directly. Fixes: 54b92e841937 ("tcp: Migrate TCP_ESTABLISHED/TCP_SYN_RECV sockets in accept queues.") Cc: stable@vger.kernel.org Suggested-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Signed-off-by: Zhenzhong Wu Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260422024554.130346-2-jt26wzz@gmail.com Signed-off-by: Jakub Kicinski commit e08a9fac5cf8c3fecf4755e7e3ac059f78b8f83d Author: Kohei Enju Date: Wed Apr 22 02:30:24 2026 +0000 vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() syzbot reported "sleeping function called from invalid context" in vhost_net_busy_poll(). Commit 030881372460 ("vhost_net: basic polling support") introduced a busy-poll loop and preempt_{disable,enable}() around it, where each iteration calls a sleepable function inside the loop. The purpose of disabling preemption was to keep local_clock()-based timeout accounting on a single CPU, rather than as a requirement of busy-poll itself: https://lore.kernel.org/1448435489-5949-4-git-send-email-jasowang@redhat.com From this perspective, migrate_disable() is sufficient here, so replace preempt_disable() with migrate_disable(), avoiding sleepable accesses from a preempt-disabled context. Fixes: 030881372460 ("vhost_net: basic polling support") Tested-by: syzbot+6985cb8e543ea90ba8ee@syzkaller.appspotmail.com Reported-by: syzbot+6985cb8e543ea90ba8ee@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69e6a414.050a0220.24bfd3.002d.GAE@google.com/T/ Signed-off-by: Kohei Enju Acked-by: Michael S. Tsirkin Signed-off-by: Jakub Kicinski commit 076b8cad77aa96557719fb5effe8703bfb64df00 Author: Daniel Borkmann Date: Tue Apr 21 22:24:06 2026 +0200 ipv6: Cap TLV scan in ip6_tnl_parse_tlv_enc_lim Commit 47d3d7ac656a ("ipv6: Implement limits on Hop-by-Hop and Destination options") added net.ipv6.max_{hbh,dst}_opts_{cnt,len} and applied them in ip6_parse_tlv(), the generic TLV walker invoked from ipv6_destopt_rcv() and ipv6_parse_hopopts(). ip6_tnl_parse_tlv_enc_lim() does not go through ip6_parse_tlv(); it has its own hand-rolled TLV scanner inside its NEXTHDR_DEST branch which looks for IPV6_TLV_TNL_ENCAP_LIMIT. That inner loop is bounded only by optlen, which can be up to 2048 bytes. Stuffing the Destination Options header with 2046 Pad1 (type=0) entries advances the scanner a single byte at a time, yielding ~2000 TLV iterations per extension header. Reusing max_dst_opts_cnt to bound the TLV iterations, matching the semantics from 47d3d7ac656a, would require duplicating ip6_parse_tlv() to also validate Pad1/PadN payload. It would also mandate enforcing max_dst_opts_len, since otherwise an attacker shifts the axis to few options with a giant PadN and recovers the original DoS. Allowing up to 8 options before the tunnel encapsulation limit TLV is liberal enough; in practice encap limit is the first TLV. Thus, go with a hard-coded limit IP6_TUNNEL_MAX_DEST_TLVS (8). Signed-off-by: Daniel Borkmann Reviewed-by: Ido Schimmel Reviewed-by: Justin Iurman Signed-off-by: Jakub Kicinski commit d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a Author: Lee Jones Date: Tue Apr 21 13:45:26 2026 +0100 tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the error handling path would free the original skb pointer, which had already been freed, leading to double-free. Fix this by checking if head now points to a newly allocated reassembled skb. If it does, reassign *headbuf for later freeing operations. Fixes: d618d09a68e4 ("tipc: enforce valid ratio between skb truesize and contents") Suggested-by: Tung Nguyen Signed-off-by: Lee Jones Reviewed-by: Tung Nguyen Signed-off-by: Jakub Kicinski commit 864ba40c80edae2b98f47d46f2c39399126aa3d6 Author: Ernestas Kulik Date: Tue Apr 21 09:02:26 2026 +0300 llc: Return -EINPROGRESS from llc_ui_connect() Given a zero sk_sndtimeo, llc_ui_connect() skips waiting for state change and returns 0, confusing userspace applications that will assume the socket is connected, making e.g. getpeername() calls error out. More specifically, the issue was discovered in libcoap, where newly-added AF_LLC socket support was behaving differently from AF_INET connections due to EINPROGRESS handling being skipped. Set rc to -EINPROGRESS if connect() would not block, akin to AF_INET sockets. Signed-off-by: Ernestas Kulik Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260421060304.285419-1-ernestas.k@iconn-networks.com Signed-off-by: Jakub Kicinski commit 67bf002a2d7387a6312138210d0bd06e3cf4879b Author: Ruide Cao Date: Tue Apr 21 12:16:31 2026 +0800 ipv4: icmp: validate reply type before using icmp_pointers Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type. That value is outside the range covered by icmp_pointers[], which only describes the traditional ICMP types up to NR_ICMP_TYPES. Avoid consulting icmp_pointers[] for reply types outside that range, and use array_index_nospec() for the remaining in-range lookup. Normal ICMP replies keep their existing behavior unchanged. Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Ruide Cao Signed-off-by: Ren Wei Reviewed-by: Simon Horman Link: https://patch.msgid.link/0dace90c01a5978e829ca741ef684dbd7304ce62.1776628519.git.caoruide123@gmail.com Signed-off-by: Jakub Kicinski commit 45dcf5e28813954da4150e7260ccb61e95856176 Merge: 507bd4b66c85d5 b3c26ea81ccc52 Author: Linus Torvalds Date: Thu Apr 23 11:22:16 2026 -0700 Merge tag 'pcmcia-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux Pull PCMCIA updates from Dominik Brodowski: "A number of minor PCMCIA bugfixes and cleanups, and a patch removing obsolete host controller drivers" * tag 'pcmcia-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux: pcmcia: remove obsolete host controller drivers pcmcia: Convert to use less arguments in pci_bus_for_each_resource() PCMCIA: Fix garbled log messages for KERN_CONT commit 7ebc650474bad55573eebe16854ed935ab262350 Merge: 4078c5611d7585 cf94b3c0f052c2 Author: Jakub Kicinski Date: Thu Apr 23 11:04:05 2026 -0700 Merge branch 'tcp-symmetric-challenge-ack-for-seg-ack-snd-nxt' Jiayuan Chen says: ==================== tcp: symmetric challenge ACK for SEG.ACK > SND.NXT Commit 354e4aa391ed ("tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation") quotes RFC 5961 Section 5.2 in full, which requires that any incoming segment whose ACK value falls outside [SND.UNA - MAX.SND.WND, SND.NXT] MUST be discarded and an ACK sent back. Linux currently sends that challenge ACK only on the lower edge (SEG.ACK < SND.UNA - MAX.SND.WND); on the symmetric upper edge (SEG.ACK > SND.NXT) the segment is silently dropped with SKB_DROP_REASON_TCP_ACK_UNSENT_DATA. Patch 1 completes the mitigation by emitting a rate-limited challenge ACK on that branch, reusing tcp_send_challenge_ack() and honouring FLAG_NO_CHALLENGE_ACK for consistency with the lower-edge case. It also updates the existing tcp_ts_recent_invalid_ack.pkt selftest, which drives this exact path, to consume the new challenge ACK so bisect stays clean. Patch 2 adds a new packetdrill selftest that exercises RFC 5961 Section 5.2 on both edges of the acceptable window, filling a gap in the selftests tree (neither edge had dedicated coverage before). ==================== Link: https://patch.msgid.link/20260422123605.320000-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit cf94b3c0f052c2674328b330309604af2dedd3a0 Author: Jiayuan Chen Date: Wed Apr 22 20:35:39 2026 +0800 selftests/net: packetdrill: cover RFC 5961 5.2 challenge ACK on both edges RFC 5961 Section 5.2 / RFC 793 Section 3.9 require a challenge ACK whenever an incoming SEG.ACK falls outside [SND.UNA - MAX.SND.WND, SND.NXT]. There is currently no packetdrill coverage for either edge. Add tcp_rfc5961_ack-out-of-window.pkt, which in a single passive-open connection exercises: - Upper edge (SEG.ACK > SND.NXT): peer ACKs data that was never sent before the server has transmitted anything. - Lower edge (SEG.ACK < SND.UNA - MAX.SND.WND): after the server has sent 2000 bytes (the peer-advertised rwnd forces two 1000-byte segments, both acknowledged), peer sends an ACK that is older than the acceptable window. Both cases must elicit a challenge ACK . The per-socket RFC 5961 Section 7 rate limit is disabled for the duration of the test so that both challenge ACKs can fire back-to-back. Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260422123605.320000-3-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 42726ec644cbdde0035c3e0417fee8ed9547e120 Author: Jiayuan Chen Date: Wed Apr 22 20:35:38 2026 +0800 tcp: send a challenge ACK on SEG.ACK > SND.NXT RFC 5961 Section 5.2 validates an incoming segment's ACK value against the range [SND.UNA - MAX.SND.WND, SND.NXT] and states: "All incoming segments whose ACK value doesn't satisfy the above condition MUST be discarded and an ACK sent back." Commit 354e4aa391ed ("tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation") opted Linux into this mitigation and implements the challenge ACK on the lower side (SEG.ACK < SND.UNA - MAX.SND.WND), but the symmetric upper side (SEG.ACK > SND.NXT) still takes the pre-RFC-5961 path and silently returns SKB_DROP_REASON_TCP_ACK_UNSENT_DATA, even though RFC 793 Section 3.9 (now RFC 9293 Section 3.10.7.4) has always required: "If the ACK acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an ACK, drop the segment, and return." Complete the mitigation by sending a challenge ACK on that branch, reusing the existing tcp_send_challenge_ack() path which already enforces the per-socket RFC 5961 Section 7 rate limit via __tcp_oow_rate_limited(). FLAG_NO_CHALLENGE_ACK is honoured for symmetry with the lower-edge case. Update the existing tcp_ts_recent_invalid_ack.pkt selftest, which drives this exact path, to consume the new challenge ACK. Fixes: 354e4aa391ed ("tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation") Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260422123605.320000-2-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 4078c5611d7585548b249377ebd60c272e410490 Author: Alexey Kodanev Date: Wed Apr 22 16:05:36 2026 +0000 nfp: fix swapped arguments in nfp_encode_basic_qdr() calls There is a mismatch between the passed arguments and the actual nfp_encode_basic_qdr() function parameter names: static int nfp_encode_basic_qdr(u64 addr, int dest_island, int cpp_tgt, int mode, bool addr40, int isld1, int isld0) { ... But "dest_island" and "cpp_tgt" are swapped at every call-site. For example: return nfp_encode_basic_qdr(*addr, cpp_tgt, dest_island, mode, addr40, isld1, isld0); As a result, nfp_encode_basic_qdr() receives "dest_island" as CPP target type, which is always NFP_CPP_TARGET_QDR(2) for these calls, and "cpp_tgt" as the destination island ID, which can accidentally match or be outside the valid NFP_CPP_TARGET_* types (e.g. '-1' for any destination). Since code already worked for years, also add extra pr_warn() to error paths in nfp_encode_basic_qdr() to help identify any potential address verification failures. Detected using the static analysis tool - Svace. Fixes: 4cb584e0ee7d ("nfp: add CPP access core") Signed-off-by: Alexey Kodanev Link: https://patch.msgid.link/20260422160536.61855-1-aleksei.kodanev@bell-sw.com Signed-off-by: Jakub Kicinski commit 5a8db80f721deee8e916c2cfdee78decda02ce4f Author: Ruijie Li Date: Wed Apr 22 23:40:18 2026 +0800 net/smc: avoid early lgr access in smc_clc_wait_msg A CLC decline can be received while the handshake is still in an early stage, before the connection has been associated with a link group. The decline handling in smc_clc_wait_msg() updates link-group level sync state for first-contact declines, but that state only exists after link group setup has completed. Guard the link-group update accordingly and keep the per-socket peer diagnosis handling unchanged. This preserves the existing sync_err handling for established link-group contexts and avoids touching link-group state before it is available. Fixes: 0cfdd8f92cac ("smc: connection and link group creation") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Ruijie Li Signed-off-by: Ren Wei Reviewed-by: Dust Li Link: https://patch.msgid.link/08c68a5c817acf198cce63d22517e232e8d60718.1776850759.git.ruijieli51@gmail.com Signed-off-by: Jakub Kicinski commit 4498664e2d5888efabb96428196a926acdaa25ed Author: Yu-Hsiang Tseng Date: Thu Apr 23 02:08:14 2026 +0800 wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions Two functions in ath12k assert that the caller holds an RCU read lock: ath12k_mac_get_arvif() and ath12k_p2p_noa_update_vdev_iter(). Both use: WARN_ON(!rcu_read_lock_any_held()); On kernels using preemptible RCU (CONFIG_PREEMPT=y or CONFIG_PREEMPT_RT=y) without CONFIG_DEBUG_LOCK_ALLOC, this produces a false positive splat whenever these functions are invoked from paths that do hold the RCU read lock (e.g. firmware stats processing or mac80211 interface iteration). Root cause: - Without CONFIG_DEBUG_LOCK_ALLOC, rcu_read_lock_any_held() is a static inline that returns !preemptible() as a proxy for "in an RCU read section". - With preemptible RCU, rcu_read_lock() does not disable preemption. A task can therefore be preemptible while legitimately holding an RCU read lock, making the proxy unreliable. - Callers such as ath12k_wmi_tlv_rssi_chain_parse() (via guard(rcu)()) and ieee80211_iterate_active_interfaces_atomic() do hold the RCU read lock, so these warnings are incorrect. Typical splat seen on a WCN7850 station with periodic fw stats processing: WARNING: drivers/net/wireless/ath/ath12k/mac.c:791 at ath12k_mac_get_arvif+0x9e/0xd0 [ath12k] Tainted: G W O 6.19.13-rt #1 PREEMPT_RT Call Trace: ath12k_wmi_tlv_rssi_chain_parse+0x69/0x170 [ath12k] ath12k_wmi_tlv_iter+0x7f/0x120 [ath12k] ath12k_wmi_tlv_fw_stats_parse+0x342/0x6b0 [ath12k] ath12k_wmi_op_rx+0xe9e/0x3150 [ath12k] ath12k_htc_rx_completion_handler+0x3df/0x5b0 [ath12k] ath12k_ce_per_engine_service+0x325/0x3e0 [ath12k] ath12k_pci_ce_workqueue+0x20/0x40 [ath12k] Replace WARN_ON(!rcu_read_lock_any_held()) with lockdep_assert_in_rcu_read_lock(), which is gated on CONFIG_PROVE_RCU and therefore compiles out entirely when PROVE_RCU is disabled. PROVE_RCU kernels continue to get the full lockdep-based check, and the new helper precisely checks for rcu_read_lock() rather than any RCU variant, which better matches the callers' expectations. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 3dd2c68f206e ("wifi: ath12k: prepare vif data structure for MLO handling") Suggested-by: Baochen Qiang Suggested-by: Sebastian Andrzej Siewior Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Signed-off-by: Yu-Hsiang Tseng Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20260422180814.1938317-1-asas1asas200@gmail.com Signed-off-by: Jeff Johnson commit c4b6ad0e14f5df942eed5ebadaff84b468bd2496 Author: Dmitry Baryshkov Date: Sat Apr 18 22:37:00 2026 +0300 wifi: ath10k: snoc: select POWER_SEQUENCING The commit afcf3ec615c9 ("wifi: ath10k: snoc: support powering on the device via pwrseq") made ath10k SNOC driver use devm_pwrseq_get(). Select the corresponding Kconfig symbol to make sure that API call is always available and doesn't return an error per se. Fixes: afcf3ec615c9 ("wifi: ath10k: snoc: support powering on the device via pwrseq") Reported-by: Luca Weiss Closes: https://lore.kernel.org/r/DHUHU7UIT487.139L3KIVRVREU@fairphone.com Signed-off-by: Dmitry Baryshkov Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260418-ath10k-snoc-pwrseq-v1-1-832594ba3294@oss.qualcomm.com Signed-off-by: Jeff Johnson commit f3ba9e05cc7b65f41f58bb4808f6c3a8f7894bb1 Author: Aaradhana Sahu Date: Fri Apr 10 12:43:00 2026 +0530 wifi: ath12k: fix OF node refcount imbalance in WSI graph traversal ath12k_core_get_wsi_info() traverses the WSI (Wired Serial Interface) device graph starting from dev->of_node. The current code uses dev->of_node directly as the local traversal pointer and calls of_node_put() on error. Since the driver does not own a reference to dev->of_node, dropping it during traversal results in the following OF refcount underflow: OF: ERROR: of_node_release() detected bad of_node_put() on /soc@0/wifi@c000000 CPU: 1 UID: 0 PID: 210 Comm: insmod Not tainted 6.19.0-rc4-next-20260109-00023-g797dd36dc178 #26 PREEMPT Hardware name: Qualcomm Technologies, Inc. IPQ5332 MI01.2 (DT) Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x60/0x80 dump_stack+0x18/0x24 of_node_release+0x164/0x1a0 kobject_put+0xb4/0x278 of_node_put+0x18/0x28 ath12k_core_init+0x29c/0x5d4 [ath12k] ath12k_ahb_probe+0x950/0xc14 [ath12k] platform_probe+0x5c/0xa4 really_probe+0xc0/0x3ec __driver_probe_device+0x80/0x170 driver_probe_device+0x3c/0x120 __driver_attach+0xc4/0x218 OF: ERROR: next of_node_put() on this node will result in a kobject warning 'refcount_t: underflow; use-after-free.' Fix this by explicitly acquiring a reference to the starting node using of_node_get() and attaching automatic cleanup via __free(device_node). Each discovered WSI node is stored in ag->wsi_node[] with its own of_node_get() reference. These references are later released in ath12k_core_free_wsi_info() during driver teardown. Also remove unnecessary memset() of wsi_node array since cleanup now explicitly sets pointers to NULL. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Fixes: 908c10c860e0 ("wifi: ath12k: parse multiple device information from Device Tree") Signed-off-by: Aaradhana Sahu Reviewed-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260410071300.2323603-1-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 4a1b534177395627579c1fb9e7f9100ee88955dd Author: Baochen Qiang Date: Tue Feb 10 11:07:31 2026 +0800 wifi: ath12k: prepare REO update element only for primary link Commit [1] introduces dp->reo_cmd_update_rx_queue_list for the purpose of tracking all pending REO queue flush commands. The helper ath12k_dp_prepare_reo_update_elem() allocates an element and populates it with REO queue information, then add it to the list. The element would be helpful during clean up stage to finally unmap/free the corresponding REO queue buffer. In MLO scenarios with more than one links, for non dp_primary_link_only chips like WCN7850, that helper is called for each link peer. This results in multiple elements added to the list but all of them pointing to the same REO queue buffer. Consequently the same buffer gets unmap/freed multiple times: BUG kmalloc-2k (Tainted: G B W O ): Object already free ----------------------------------------------------------------------------- Allocated in ath12k_wifi7_dp_rx_assign_reoq+0xce/0x280 [ath12k_wifi7] age=7436 cpu=10 pid=16130 __kmalloc_noprof ath12k_wifi7_dp_rx_assign_reoq ath12k_dp_rx_peer_tid_setup ath12k_dp_peer_setup ath12k_mac_station_add ath12k_mac_op_sta_state [...] Freed in ath12k_dp_rx_tid_cleanup.part.0+0x25/0x40 [ath12k] age=1 cpu=27 pid=16137 kfree ath12k_dp_rx_tid_cleanup.part.0 ath12k_dp_rx_reo_cmd_list_cleanup ath12k_dp_cmn_device_deinit ath12k_core_stop ath12k_core_hw_group_cleanup ath12k_pci_remove Fix this by allowing list addition for primary link only. Note dp_primary_link_only chips like QCN9274 are not affected by this change, because that's what they were doing in the first place. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 3bf2e57e7d6c ("wifi: ath12k: Add Retry Mechanism for REO RX Queue Update Failures") # [1] Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221011 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260210-ath12k-rxtid-double-free-v1-1-8b523fb2886d@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 3d1f20727a635811f6b77801a7b57b8995268abd Author: Dexuan Cui Date: Wed Apr 22 23:48:11 2026 -0700 hv_sock: Return -EIO for malformed/short packets Commit f63152958994 fixes a regression, however it fails to report an error for malformed/short packets -- normally we should never see such packets, but let's report an error for them just in case. Fixes: f63152958994 ("hv_sock: Report EOF instead of -EIO for FIN") Cc: stable@vger.kernel.org Signed-off-by: Dexuan Cui Acked-by: Stefano Garzarella Link: https://patch.msgid.link/20260423064811.1371749-1-decui@microsoft.com Signed-off-by: Jakub Kicinski commit 13e786b64bd3fd81c7eb22aa32bf8305c32f2ccf Author: Petr Malat Date: Thu Apr 23 04:48:26 2026 -0500 cgroup: Increment nr_dying_subsys_* from rmdir context Incrementing nr_dying_subsys_* in offline_css(), which is executed by cgroup_offline_wq worker, leads to a race where user can see the value to be 0 if he reads cgroup.stat after calling rmdir and before the worker executes. This makes the user wrongly expect resources released by the removed cgroup to be available for a new assignment. Increment nr_dying_subsys_* from kill_css(), which is called from the cgroup_rmdir() context. Fixes: ab0312526867 ("cgroup: Show # of subsystem CSSes in cgroup.stat") Signed-off-by: Petr Malat Signed-off-by: Tejun Heo commit 8f9d6cd6d3916add4c47a9dd1622e4fc057f877b Author: Jingle Wu 吳金國 Date: Tue Apr 21 07:02:33 2026 +0000 Input: elan_i2c - increase device reset wait timeout after update FW Extend wait_for_completion_timeout from 300ms to 700ms to ensure sufficient time for device reset after firmware update. Signed-off-by: Jingle Wu Link: https://patch.msgid.link/KL1PR01MB5116031986614B3214EF2F30DC2C2@KL1PR01MB5116.apcprd01.prod.exchangelabs.com Signed-off-by: Dmitry Torokhov commit 96fe420bebc159599fb8da1080e9ff207bdb650a Author: Jingle Wu 吳金國 Date: Tue Apr 21 07:00:10 2026 +0000 Input: elan_i2c - add ic type 0x19 The 0x19 is valid 3000 serial ic type too. Signed-off-by: Jingle Wu Link: https://patch.msgid.link/KL1PR01MB511699853D1B66D137C06806DC2C2@KL1PR01MB5116.apcprd01.prod.exchangelabs.com Signed-off-by: Dmitry Torokhov commit dd8d4bc28ad7252610d8e79c1313a2d1e3499a51 Author: Jakub Kicinski Date: Mon Apr 20 19:18:23 2026 -0700 net: remove ax25 and amateur radio (hamradio) subsystem Remove the amateur radio (AX.25, NET/ROM, ROSE) protocol implementation and all associated hamradio device drivers from the kernel tree. This set of protocols has long been a huge bug/syzbot magnet, and since nobody stepped up to help us deal with the influx of the AI-generated bug reports we need to move it out of tree to protect our sanity. The code is moved to an out-of-tree repo: https://github.com/linux-netdev/mod-orphan if it's cleaned up and reworked there we can accept it back. Minimal stub headers are kept for include/net/ax25.h (AX25_P_IP, AX25_ADDR_LEN, ax25_address) and include/net/rose.h (ROSE_ADDR_LEN) so that the conditional integration code in arp.c and tun.c continues to compile and work when the out-of-tree modules are loaded. Signed-off-by: Jakub Kicinski Acked-by: Greg Kroah-Hartman Acked-by: Stephen Hemminger Acked-by: Carlos Bilbao Reviewed-by: Simon Horman Reviewed-by: Kuniyuki Iwashima Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260421021824.1293976-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 4f10f1dfb235a28bd86cf0b00d86a59696ddbe5b Author: Jakub Kicinski Date: Mon Apr 20 19:21:07 2026 -0700 net: remove ISDN subsystem and Bluetooth CMTP Remove the ISDN (mISDN, CAPI) subsystem and Bluetooth CMTP protocol from the kernel tree. ISDN is a pretty old technology and it's unclear whether anyone still uses it. I went over the last few years of git history and all the commits are either tree-wide conversions or syzbot/static analyzer fixes. When we discussed removal in the past IIRC there were some concerns about ISDN still being used in parts of Germany. Unfortunately, the code base is quite old, none of the current maintainers are familiar with it and AI tools will have a field day finding bugs here. Delete this code and preserve it in an out-of-tree repository for any remaining users: https://github.com/linux-netdev/mod-orphan UAPI constants AF_ISDN/PF_ISDN and the SELinux isdn_socket class are preserved for ABI stability, but the rest of uAPI is removed. Signed-off-by: Jakub Kicinski Acked-by: Greg Kroah-Hartman Acked-by: Stephen Hemminger Acked-by: Luiz Augusto von Dentz Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260421022108.1299678-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 6d5431555de032f5ad9e08a7fb372f37bf493903 Author: Jakub Kicinski Date: Thu Apr 16 11:28:28 2026 -0700 caif: remove CAIF NETWORK LAYER Remove CAIF (Communication CPU to Application CPU Interface), the ST-Ericsson modem protocol. The subsystem has been orphaned since 2013. The last meaningful changes from the maintainers were in March 2013: a8c7687bf216 ("caif_virtio: Check that vringh_config is not null") b2273be8d2df ("caif_virtio: Use vringh_notify_enable correctly") 0d2e1a2926b1 ("caif_virtio: Introduce caif over virtio") Not-so-coincidentally, according to "the Internet" ST-Ericsson officially shut down its modem joint venture in Aug 2013. If anyone is using this code please yell! In the 13 years since, the code has accumulated 200 non-merge commits, of which 71 were cross-tree API changes, 21 carried Fixes: tags, and the remaining ~110 were cleanups, doc conversions, treewide refactors, and one partial removal (caif_hsi, ca75bcf0a83b). We are still getting fixes to this code, in the last 10 days there were 3 reports on security@ about CAIF that I have been CCed on. UAPI constants (AF_CAIF, ARPHRD_CAIF, N_CAIF, VIRTIO_ID_CAIF) and the SELinux classmap entry are intentionally kept for ABI stability. Acked-by: Michael S. Tsirkin Acked-by: Greg Kroah-Hartman Reviewed-by: Linus Walleij Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260416182829.1440262-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 74b73fa56a395d46745e4f245225963e9f8be7f1 Author: Alysa Liu Date: Mon Mar 30 10:50:07 2026 -0400 drm/amdkfd: Add upper bound check for num_of_nodes drm/amdkfd: Add upper bound check for num_of_nodes in kfd_ioctl_get_process_apertures_new. Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alysa Liu Signed-off-by: Alex Deucher (cherry picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f) Cc: stable@vger.kernel.org commit 4e3d7c89e15ac5dbf45b7d7a49bb374650c03339 Author: zhidao su Date: Thu Apr 23 10:58:32 2026 +0800 sched_ext: Fix local_dsq_post_enq() to use task's scheduler in sub-sched local_dsq_post_enq() calls call_task_dequeue() with scx_root instead of the scheduler instance actually managing the task. When CONFIG_EXT_SUB_SCHED is enabled, tasks may be managed by a sub-scheduler whose ops.dequeue() callback differs from root's. Using scx_root causes the wrong scheduler's ops.dequeue() to be consulted: sub-sched tasks dispatched to a local DSQ via scx_bpf_dsq_move_to_local() will have SCX_TASK_IN_CUSTODY cleared but the sub-scheduler's ops.dequeue() is never invoked, violating the custody exit semantics. Fix by adding a 'struct scx_sched *sch' parameter to local_dsq_post_enq() and move_local_task_to_local_dsq(), and propagating the correct scheduler from their callers dispatch_enqueue(), move_task_between_dsqs(), and consume_dispatch_q(). This is consistent with dispatch_enqueue()'s non-local path which already passes 'sch' directly to call_task_dequeue() for global/bypass DSQs. Fixes: ebf1ccff79c4 ("sched_ext: Fix ops.dequeue() semantics") Signed-off-by: zhidao su Signed-off-by: Tejun Heo commit 3bc06da858ef17cfe94b49efc0d9713727012835 Author: Brett Creeley Date: Thu Apr 16 14:21:21 2026 -0700 virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via VQ_PAIRS_SET When netif_is_rxfh_configured() is true (i.e., the user has explicitly configured the RSS indirection table), virtnet_set_queues() skips the RSS update path and falls through to the VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command to change the number of queue pairs. However, it does not update vi->rss_trailer.max_tx_vq to reflect the new queue_pairs value. This causes a mismatch between vi->curr_queue_pairs and vi->rss_trailer.max_tx_vq. Any subsequent RSS reconfiguration (e.g., via ethtool -X) calls virtnet_commit_rss_command(), which sends the stale max_tx_vq to the device, silently reverting the queue count. Reproduction: 1. User configured RSS ethtool -X eth0 equal 8 2. VQ_PAIRS_SET path; max_tx_vq stays 16 ethtool -L eth0 combined 12 3. RSS commit uses max_tx_vq=16 instead of 12 ethtool -X eth0 equal 4 Fix this by updating vi->rss_trailer.max_tx_vq after a successful VQ_PAIRS_SET command when RSS is enabled, keeping it in sync with curr_queue_pairs. Fixes: 50bfcaedd78e ("virtio_net: Update rss when set queue") Signed-off-by: Brett Creeley Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260416212121.29073-1-brett.creeley@amd.com Signed-off-by: Jakub Kicinski commit 507bd4b66c85d5b65696150cc16d31ac0b2ab151 Merge: 8841842cc9be68 dd5dc1917473f3 Author: Linus Torvalds Date: Thu Apr 23 08:57:24 2026 -0700 Merge tag 'soc-late-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull more SoC updates from Arnd Bergmann: "These are the contents that arrived during the easter vacation and didn't make it into the last 7.0 bugfixes or the first set of branches for the merge window. Aside from a reset controller bugfix and an update to the MAINTAINERS entry, this is all devicetree changes. The Marvell devicetree updates contain the usual minor updates and bugfixes, along with a two larger but trivial patches to drop unused dtsi files, the single broadcom fix addresses a build time warning introduced during the merge window. The freescale, amlogic, and apple changes missed the last fixes branch for 7.0" * tag 'soc-late-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (38 commits) arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number arm64: dts: amlogic: meson-axg: Add missing cache information to cpu0 arm64: dts: amlogic: t7: khadas-vim4: fix board model name arm64: dts: amlogic: Fix GIC register ranges for Amlogic T7 arm64: dts: amlogic: t7: khadas-vim4: fix memory layout for 8GB RAM arm64: dts: amlogic: s6: Drop CPU masks from GICv3 PPI interrupts Documentation/process: maintainer-soc: Document purpose of defconfigs Documentation/process: maintainer-soc: Trim from trivial ask-DT ARM: dts: bcm4709: fix bus range assignment arm64: dts: apple: Fix spelling error dt-bindings: Update Sasha Finkelstein's email address mailmap: Update Sasha Finkelstein's email address arm64: dts: marvell: armada-37xx: swap PHYs' order in USB3 controller node arm64: dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's phy-names arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT reset: amlogic: t7: Fix null reset ops arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT ... commit 8841842cc9be68e0f670323e697c9b3214831d6a Merge: df7bf834a135e1 68637b68afcc3c Author: Linus Torvalds Date: Thu Apr 23 08:37:07 2026 -0700 Merge tag 'pwm/fixes-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm fixes from Uwe Kleine-König: "Two driver fixes After having added some more code to libpwm checking the pwm rounding rules for the userspace interface I spotted an issue in the pwm-stm32 driver where in some cases involving inverted polarity the wrong hardware settings for the duty offset are chosen. I think it has little practical effect because the duty offset is in most cases an artificial property of the output waveform. Still it's relevant to get this fixed because this driver serves as a reference implementation for the still young waveform API. The second fix addresses a sleep-in-atomic issue in the pwm-atmel-tcb driver" * tag 'pwm/fixes-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: atmel-tcb: Cache clock rates and mark chip as atomic pwm: stm32: Fix rounding issue for requests with inverted polarity commit 24daca4fc07f3ff8cd0e3f629cd982187f48436a Author: Juergen Gross Date: Fri Apr 10 09:20:04 2026 +0200 xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, the kernel splits the VMA via __split_vma(). Since may_split is NULL, the split is allowed. vm_area_dup() copies vm_private_data (a pages array allocated in alloc_empty_pages()) into the new VMA without any fixup, because there is no .open callback. Both VMAs now point to the same pages array. When the unmapped portion is closed, privcmd_close() calls: - xen_unmap_domain_gfn_range() - xen_free_unpopulated_pages() - kvfree(pages) The surviving VMA still holds the dangling pointer. When it is later destroyed, the same sequence runs again, which leads to a double free. Fix this issue by adding a .may_split callback denying the VMA split. This is XSA-487 / CVE-2026-31787 Fixes: d71f513985c2 ("xen: privcmd: support autotranslated physmap guests.") Reported-by: Atharva Vartak Suggested-by: Atharva Vartak Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich commit 27fdbab4221b375de54bf91919798d88520c6e28 Author: Juergen Gross Date: Fri Mar 27 14:13:38 2026 +0100 Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as sprintf in buildid_show will read and copy till it finds a NUL. 00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P| 00000010 b9 a8 01 42 6f 2e 32 |...Bo.2| 00000017 So use a memcpy instead of sprintf to have the correct value: 00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P| 00000010 b9 a8 01 42 |...B| 00000014 (the above have a hack to embed a zero inside and check it's returned correctly). This is XSA-485 / CVE-2026-31786 Fixes: 84b7625728ea ("xen: add sysfs node for hypervisor build id") Signed-off-by: Frediano Ziglio Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross commit f6c73e7156b54d8b9ddf1a27f4e93d3a1e49a73e Author: Laurent Pinchart Date: Wed Apr 8 15:42:05 2026 +0300 drm: rcar-du: Fix crash when no CMM is available Commit 3bce3fdd1ff2 ("drm: rcar-du: Don't leak device_link to CMM") refactored CMM handling, and introduced an incorrect test for CMM availability. When no CMM is present, the rcrtc->cmm field is NULL, testing rcrtc->cmm->dev causes a NULL pointer dereference. This slipped through testing as all tests were run with the CMM present. Fix this issue by correctly testing for rcrtc->cmm. Fixes: 3bce3fdd1ff2 ("drm: rcar-du: Don't leak device_link to CMM") Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/dri-devel/CAMuHMdXomz9GFDqkBjGX9Sda_GLccPcrihvFbOz0GAitDVNTbw@mail.gmail.com Signed-off-by: Laurent Pinchart Tested-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260408124205.1962448-1-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Tomi Valkeinen (cherry picked from commit 3e9a1da270ddff449b1ad9eadc958f43bc204bd2) Signed-off-by: Tomi Valkeinen commit d13e855ee923c2ae78307bf6c354305f1406b9e2 Merge: 0b13173d27fa15 028ef9c96e9619 Author: Maxime Ripard Date: Thu Apr 23 14:43:06 2026 +0200 Merge drm/drm-fixes into drm-misc-fixes Tomi needs 7.0 to apply a patch from drm-misc-fixes. Signed-off-by: Maxime Ripard commit d40831b016b4986e70d20d0ad14e6a0c62318986 Merge: 1cb36e25221150 d0576eb8508e68 Author: Paolo Abeni Date: Thu Apr 23 13:20:24 2026 +0200 Merge branch 'mptcp-sync-the-msk-sndbuf-at-accept-time' Matthieu Baerts says: ==================== mptcp: sync the msk->sndbuf at accept() time On passive MPTCP connections, the MPTCP socket send buffer doesn't have the expected size at accept() time. Patch 1 fixes the regression introduced in v6.7, while the following one validates the fix in the selftests. Signed-off-by: Matthieu Baerts (NGI0) ==================== Link: https://patch.msgid.link/20260420-net-mptcp-sync-sndbuf-accept-v1-0-e3523e3aeb44@kernel.org Signed-off-by: Paolo Abeni commit d0576eb8508e68b950ee9d2820116a6fc205fd07 Author: Gang Yan Date: Mon Apr 20 18:19:24 2026 +0200 selftests: mptcp: add a check for sndbuf of S/C Add a new chk_sndbuf() helper to diag.sh that extracts the sndbuf (the 'tb' field from 'ss -m' skmem output) for both server and client MPTCP sockets, and verifies they are equal. Without the previous patch, it will fail: ''' 07 ....chk sndbuf server/client [FAIL] sndbuf S=20480 != C=2630656 ''' Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260420-net-mptcp-sync-sndbuf-accept-v1-2-e3523e3aeb44@kernel.org Signed-off-by: Paolo Abeni commit fcf04b14334641f4b0b8647824480935e9416d52 Author: Gang Yan Date: Mon Apr 20 18:19:23 2026 +0200 mptcp: sync the msk->sndbuf at accept() time On passive MPTCP connections, the msk sndbuf is not updated correctly. The root cause is an order issue in the accept path: - tcp_check_req() -> subflow_syn_recv_sock() -> mptcp_sk_clone_init() calls __mptcp_propagate_sndbuf() to copy the ssk sndbuf into msk - Later, tcp_child_process() -> tcp_init_transfer() -> tcp_sndbuf_expand() grows the ssk sndbuf. So __mptcp_propagate_sndbuf() runs before the ssk sndbuf has been expanded and the msk ends up with a much smaller sndbuf than the subflow: MPTCP: msk->sndbuf:20480, msk->first->sndbuf:2626560 Fix this by moving the __mptcp_propagate_sndbuf() call from mptcp_sk_clone_init() -- the ssk sndbuf is not yet finalized there -- to __mptcp_propagate_sndbuf() at accept() time, when the ssk sndbuf has been fully expanded by tcp_sndbuf_expand(). Fixes: 8005184fd1ca ("mptcp: refactor sndbuf auto-tuning") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/602 Signed-off-by: Gang Yan Acked-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260420-net-mptcp-sync-sndbuf-accept-v1-1-e3523e3aeb44@kernel.org Signed-off-by: Paolo Abeni commit 895a9b37917d2718ef2240a7ead7458c22f1f011 Author: Jens Axboe Date: Thu Apr 23 05:06:43 2026 -0600 Revert "floppy: fix reference leak on platform_device_register() failure" This reverts commit e784f2ea0b4fd0e7b70028ff8218f22456c5dcf8. Jiri says the patch is buggy, and it looks like he is right revert it for now. Link: https://lore.kernel.org/linux-block/897f442d-4e04-4b70-b716-38fd10b8af36@kernel.org/ Reported-by: Jiri Slaby Signed-off-by: Jens Axboe commit 1cb36e252211506f51095fe7ced8286cc77b4c80 Author: Stefano Garzarella Date: Mon Apr 20 15:20:51 2026 +0200 vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting virtio_transport_init_zcopy_skb() uses iter->count as the size argument for msg_zerocopy_realloc(), which in turn passes it to mm_account_pinned_pages() for RLIMIT_MEMLOCK accounting. However, this function is called after virtio_transport_fill_skb() has already consumed the iterator via __zerocopy_sg_from_iter(), so on the last skb, iter->count will be 0, skipping the RLIMIT_MEMLOCK enforcement. Pass pkt_len (the total bytes being sent) as an explicit parameter to virtio_transport_init_zcopy_skb() instead of reading the already-consumed iter->count. This matches TCP and UDP, which both call msg_zerocopy_realloc() with the original message size. Fixes: 581512a6dc93 ("vsock/virtio: MSG_ZEROCOPY flag support") Reported-by: Yiming Qian Signed-off-by: Stefano Garzarella Reviewed-by: Bobby Eshleman Link: https://patch.msgid.link/20260420132051.217589-1-sgarzare@redhat.com Signed-off-by: Paolo Abeni commit 309e02dccf64e1b7bd2067abedc270e33b0aadf3 Author: Ming Lei Date: Thu Apr 23 11:30:58 2026 +0800 ublk: avoid unpinning pages under maple tree spinlock ublk_shmem_remove_ranges() calls unpin_user_pages() while holding the maple tree spinlock (mas_lock). Although unpin_user_pages() is safe in atomic context, holding the spinlock across potentially many page unpinning operations is not ideal. Split into __ublk_shmem_remove_ranges() which erases up to 64 ranges under mas_lock, collecting base_pfn and nr_pages into a temporary xarray. Then drop the lock and unpin pages outside spinlock context. ublk_shmem_remove_ranges() loops until all matching ranges are processed. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260423033058.2805135-4-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit ea1db795de5fe9ea6844f3152483c4d3a02c0480 Author: Ming Lei Date: Thu Apr 23 11:30:57 2026 +0800 ublk: refactor common helper ublk_shmem_remove_ranges() Extract the shared walk+erase+unpin+kfree loop into ublk_shmem_remove_ranges(). When buf_index >= 0, only ranges matching that index are removed; when buf_index < 0, all ranges are removed. Also extract ublk_unpin_range_pages() to share the page unpinning loop. Convert both __ublk_ctrl_unreg_buf() and ublk_buf_cleanup() to use the new helper. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260423033058.2805135-3-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 47903faa5c6f814f1e79b5d03708e05ca7975f6b Author: Ming Lei Date: Thu Apr 23 11:30:56 2026 +0800 ublk: fix maple tree lockdep warning in ublk_buf_cleanup ublk_buf_cleanup() iterates the maple tree with mas_for_each() without holding mas_lock, triggering a lockdep splat on CONFIG_PROVE_RCU kernels since mas_find() internally uses rcu_dereference_check() which requires either RCU or the tree lock. Fix by holding mas_lock around the iteration, and call mas_erase() before freeing each range to avoid dangling pointers in the tree. Fixes: 5e864438e285 ("ublk: replace xarray with IDA for shmem buffer index allocation") Reported-by: Jens Axboe Closes: https://lore.kernel.org/linux-block/0349d72d-dff8-4f9f-b448-919fa5ae96da@kernel.dk/ Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260423033058.2805135-2-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 1cdf3b28f46dd82caca39d72e401250ee43130ba Author: Caleb Sander Mateos Date: Tue Apr 21 14:09:01 2026 -0600 selftests: ublk: add ublk auto integrity test The end-to-end integrity ublk selftest test_integrity_02 requires a relatively recent fio version to support I/O with integrity buffers. Add a version test_integrity_03 that uses the block layer's auto integrity path instead. The auto integrity code doesn't check the application tag, and doesn't indicate the bad guard/ref tag (just returns EILSEQ). But it's a good smoke-test of the ublk integrity code and provides coverage of the auto integrity path as well. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://patch.msgid.link/20260421200901.1528842-4-csander@purestorage.com Signed-off-by: Jens Axboe commit eb3d1922120605e8934c75fde06b6ab85fc8699d Author: Caleb Sander Mateos Date: Tue Apr 21 14:09:00 2026 -0600 selftests: ublk: enable test_integrity_02.sh on fio 3.42 fio 3.42 was released with the needed fix for test_integrity_02.sh. Allow 3.42 and newer in the fio version check. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://patch.msgid.link/20260421200901.1528842-3-csander@purestorage.com Signed-off-by: Jens Axboe commit eac857a12a95de69daae7fb657108d048db9b46d Author: Caleb Sander Mateos Date: Tue Apr 21 14:08:59 2026 -0600 selftests: ublk: remove unused argument to _cleanup The _cleanup helper function doesn't take any arguments, so drop them from its callers. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://patch.msgid.link/20260421200901.1528842-2-csander@purestorage.com Signed-off-by: Jens Axboe commit 42ea37b07742dc2d70aba6da13e104b911db0c8a Merge: 7079c8c13f2d33 65267c9c4f2819 Author: Paolo Abeni Date: Thu Apr 23 12:49:16 2026 +0200 Merge branch 'net-mana-fix-probe-remove-error-path-bugs' Erni Sri Satya Vennela says: ==================== net: mana: Fix probe/remove error path bugs Fix five bugs in mana_probe()/mana_remove() error handling that can cause warnings on uninitialized work structs, NULL pointer dereferences, masked errors, and resource leaks when early probe steps fail. Patches 1-2 move work struct initialization (link_change_work and gf_stats_work) to before any error path that could trigger mana_remove(), preventing WARN_ON in __flush_work() or debug object warnings when sync cancellation runs on uninitialized work structs. Patch 3 guards mana_remove() against double invocation. If PM resume fails, mana_probe() calls mana_remove() which sets gdma_context and driver_data to NULL. A failed resume does not unbind the driver, so when the device is eventually unbound, mana_remove() is called again and dereferences NULL, causing a kernel panic. An early return on NULL gdma_context or driver_data makes the second call harmless. Patch 4 prevents add_adev() from overwriting a port probe error, which could leave the driver in a broken state with NULL ports while reporting success. Patch 5 changes 'goto out' to 'break' in mana_remove()'s port loop so that mana_destroy_eq() is always reached, preventing EQ leaks when a NULL port is encountered. ==================== Link: https://patch.msgid.link/20260420124741.1056179-1-ernis@linux.microsoft.com Signed-off-by: Paolo Abeni commit 65267c9c4f28199985505977bc2c628c82fc50ef Author: Erni Sri Satya Vennela Date: Mon Apr 20 05:47:39 2026 -0700 net: mana: Fix EQ leak in mana_remove on NULL port In mana_remove(), when a NULL port is encountered in the port iteration loop, 'goto out' skips the mana_destroy_eq(ac) call, leaking the event queues allocated earlier by mana_create_eq(). This can happen when mana_probe_port() fails for port 0, leaving ac->ports[0] as NULL. On driver unload or error cleanup, mana_remove() hits the NULL entry and jumps past mana_destroy_eq(). Change 'goto out' to 'break' so the for-loop exits normally and mana_destroy_eq() is always reached. Remove the now-unreferenced out: label. Fixes: 1e2d0824a9c3 ("net: mana: Add support for EQ sharing") Signed-off-by: Erni Sri Satya Vennela Link: https://patch.msgid.link/20260420124741.1056179-6-ernis@linux.microsoft.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit a7fdaf069bd031fcc234581fa6a580be11bf2175 Author: Erni Sri Satya Vennela Date: Mon Apr 20 05:47:38 2026 -0700 net: mana: Don't overwrite port probe error with add_adev result In mana_probe(), if mana_probe_port() fails for any port, the error is stored in 'err' and the loop breaks. However, the subsequent unconditional 'err = add_adev(gd, "eth")' overwrites this error. If add_adev() succeeds, mana_probe() returns success despite ports being left in a partially initialized state (ac->ports[i] == NULL). Only call add_adev() when there is no prior error, so the probe correctly fails and triggers mana_remove() cleanup. Fixes: a69839d4327d ("net: mana: Add support for auxiliary device") Signed-off-by: Erni Sri Satya Vennela Link: https://patch.msgid.link/20260420124741.1056179-5-ernis@linux.microsoft.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit 50271d7ec95144d26808025b508f463780517d3c Author: Erni Sri Satya Vennela Date: Mon Apr 20 05:47:37 2026 -0700 net: mana: Guard mana_remove against double invocation If PM resume fails (e.g., mana_attach() returns an error), mana_probe() calls mana_remove(), which tears down the device and sets gd->gdma_context = NULL and gd->driver_data = NULL. However, a failed resume callback does not automatically unbind the driver. When the device is eventually unbound, mana_remove() is invoked a second time. Without a NULL check, it dereferences gc->dev with gc == NULL, causing a kernel panic. Add an early return if gdma_context or driver_data is NULL so the second invocation is harmless. Move the dev = gc->dev assignment after the guard so it cannot dereference NULL. Fixes: 635096a86edb ("net: mana: Support hibernation and kexec") Signed-off-by: Erni Sri Satya Vennela Link: https://patch.msgid.link/20260420124741.1056179-4-ernis@linux.microsoft.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit 6e8bc03349fe4f09567fa76235abf52bdaf83082 Author: Erni Sri Satya Vennela Date: Mon Apr 20 05:47:36 2026 -0700 net: mana: Init gf_stats_work before potential error paths in probe Move INIT_DELAYED_WORK(gf_stats_work) to before mana_create_eq(), while keeping schedule_delayed_work() at its original location. Previously, if any function between mana_create_eq() and the INIT_DELAYED_WORK call failed, mana_probe() would call mana_remove() which unconditionally calls cancel_delayed_work_sync(gf_stats_work) in __flush_work() or debug object warnings with CONFIG_DEBUG_OBJECTS_WORK enabled. Fixes: be4f1d67ec56 ("net: mana: Add standard counter rx_missed_errors") Signed-off-by: Erni Sri Satya Vennela Link: https://patch.msgid.link/20260420124741.1056179-3-ernis@linux.microsoft.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit cb4a90744bcd1adf12f0d0c7c4f0dd2647444ec5 Author: Erni Sri Satya Vennela Date: Mon Apr 20 05:47:35 2026 -0700 net: mana: Init link_change_work before potential error paths in probe Move INIT_WORK(link_change_work) to right after the mana_context allocation, before any error path that could reach mana_remove(). Previously, if mana_create_eq() or mana_query_device_cfg() failed, mana_probe() would jump to the error path which calls mana_remove(). mana_remove() unconditionally calls disable_work_sync(link_change_work), but the work struct had not been initialized yet. This can trigger CONFIG_DEBUG_OBJECTS_WORK enabled. Fixes: 54133f9b4b53 ("net: mana: Support HW link state events") Signed-off-by: Erni Sri Satya Vennela Link: https://patch.msgid.link/20260420124741.1056179-2-ernis@linux.microsoft.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit 7079c8c13f2d33992bc846240517d88f4ab07781 Author: Breno Leitao Date: Mon Apr 20 03:18:36 2026 -0700 netconsole: avoid out-of-bounds access on empty string in trim_newline() trim_newline() unconditionally dereferences s[len - 1] after computing len = strnlen(s, maxlen). When the string is empty, len is 0 and the expression underflows to s[(size_t)-1], reading (and potentially writing) one byte before the buffer. The two callers feed trim_newline() with the result of strscpy() from configfs store callbacks (dev_name_store, userdatum_value_store). configfs guarantees count >= 1 reaches the callback, but the byte itself can be NUL: a userspace write(fd, "\0", 1) leaves the destination empty after strscpy() and triggers the underflow. The OOB write only fires if the adjacent byte happens to be '\n', so this is not a security issue, but the access is undefined behaviour either way. This pattern is commonly flagged by LLM-based code reviewers. While it is not a security fix, the underlying access is undefined behaviour and the change is small and self-contained, so it is a reasonable candidate for the stable trees. Guard the dereference on a non-zero length. Fixes: ae001dc67907 ("net: netconsole: move newline trimming to function") Cc: stable@vger.kernel.org Signed-off-by: Breno Leitao Reviewed-by: Gustavo Luiz Duarte Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260420-netcons_trim_newline-v1-1-dc35889aeedf@debian.org Signed-off-by: Paolo Abeni commit 063571ab9f80bed51e5ebf888b949827348f2b92 Merge: 7dddc74af36947 4b91cb65789b79 Author: Paolo Abeni Date: Thu Apr 23 12:21:12 2026 +0200 Merge branch 'net-airoha-fix-null-pointer-derefrences-in-airoha_qdma_cleanup' Lorenzo Bianconi says: ==================== net: airoha: Fix NULL pointer derefrences in airoha_qdma_cleanup() Fix two possible NULL pointer derefrences in airoha_qdma_cleanup routine if airoha_qdma_init() fails. v1: https://lore.kernel.org/r/20260417-airoha_qdma_init_rx_queue-fix-v1-0-db9fa5e468e5@kernel.org ==================== Link: https://patch.msgid.link/20260420-airoha_qdma_init_rx_queue-fix-v2-0-d99347e5c18d@kernel.org Signed-off-by: Paolo Abeni commit 4b91cb65789b794bfc8d50554b8994f8e0f16309 Author: Lorenzo Bianconi Date: Mon Apr 20 10:07:48 2026 +0200 net: airoha: Add size check for TX NAPIs in airoha_qdma_cleanup() If airoha_qdma_init routine fails before airoha_qdma_tx_irq_init() runs successfully for all TX NAPIs, airoha_qdma_cleanup() will unconditionally runs netif_napi_del() on TX NAPIs, triggering a NULL pointer dereference. Fix the issue relying on q_tx_irq size value to check if the TX NAPIs is properly initialized in airoha_qdma_cleanup(). Moreover, run netif_napi_add_tx() just if irq_q queue is properly allocated. Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260420-airoha_qdma_init_rx_queue-fix-v2-2-d99347e5c18d@kernel.org Signed-off-by: Paolo Abeni commit 379050947a1828826ad7ea50c95245a56929b35a Author: Lorenzo Bianconi Date: Mon Apr 20 10:07:47 2026 +0200 net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue() If queue entry or DMA descriptor list allocation fails in airoha_qdma_init_rx_queue routine, airoha_qdma_cleanup() will trigger a NULL pointer dereference running netif_napi_del() for RX queue NAPIs since netif_napi_add() has never been executed to this particular RX NAPI. The issue is due to the early ndesc initialization in airoha_qdma_init_rx_queue() since airoha_qdma_cleanup() relies on ndesc value to check if the queue is properly initialized. Fix the issue moving ndesc initialization at end of airoha_qdma_init_tx routine. Move page_pool allocation after descriptor list allocation in order to avoid memory leaks if desc allocation fails. Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260420-airoha_qdma_init_rx_queue-fix-v2-1-d99347e5c18d@kernel.org Signed-off-by: Paolo Abeni commit 7dddc74af369478ba7f9bc136d0fc1dc4570cb66 Author: Longxuan Yu Date: Mon Apr 20 11:18:46 2026 +0800 8021q: delete cleared egress QoS mappings vlan_dev_set_egress_priority() currently keeps cleared egress priority mappings in the hash as tombstones. Repeated set/clear cycles with distinct skb priorities therefore accumulate mapping nodes until device teardown and leak memory. Delete mappings when vlan_prio is cleared instead of keeping tombstones. Now that the egress mapping lists are RCU protected, the node can be unlinked safely and freed after a grace period. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Signed-off-by: Longxuan Yu Signed-off-by: Ren Wei Link: https://patch.msgid.link/ecfa6f6ce2467a42647ff4c5221238ae85b79a59.1776647968.git.yuantan098@gmail.com Signed-off-by: Paolo Abeni commit fc69decc811b155a0ed8eef17ee940f28c4f6dbc Author: Longxuan Yu Date: Mon Apr 20 11:18:45 2026 +0800 8021q: use RCU for egress QoS mappings The TX fast path and reporting paths walk egress QoS mappings without RTNL. Convert the mapping lists to RCU-protected pointers, use RCU reader annotations in readers, and defer freeing mapping nodes with an embedded rcu_head. This prepares the egress QoS mapping code for safe removal of mapping nodes in a follow-up change while preserving the current behavior. Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Signed-off-by: Longxuan Yu Signed-off-by: Ren Wei Link: https://patch.msgid.link/9136768189f8c6d3f824f476c62d2fa1111688e8.1776647968.git.yuantan098@gmail.com Signed-off-by: Paolo Abeni commit 5a5db99c344810d8b4612873a8a4153bebf5776f Merge: 0c078021d38619 711987ba281fd8 Author: Paolo Abeni Date: Thu Apr 23 11:20:38 2026 +0200 Merge tag 'nf-26-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following batch contains Netfilter/IPVS fixes for net: 1) nft_osf actually only supports IPv4, restrict it. 2) Address possible division by zero in nfnetlink_osf, from Xiang Mei. 3) Remove unsafe use of sprintf to fix possible buffer overflow in the SIP NAT helper, from Florian Westphal. 4) Restrict xt_mac, xt_owner and xt_physdev to inet families only; xt_realm is only for ipv4, otherwise null-pointer-deref is possible. 5) Use kfree_rcu() in nat core to release hooks, this can be an issue once nfnetlink_hook gets support to dump NAT hook information, not currently a real issue but better fix it now. From Florian Westphal. 6) Fix MTU checks in IPVS, from Yingnan Zhang. 7) Fix possible out-of-bounds when matching TCP options in nfnetlink_osf, from Fernando Fernandez Mancera. 8) Fix potential nul-ptr-deref in ttl check in nfnetlink_osf, remove useless loop to fix this, also from Fernando. This is a smaller batch, there are more patches pending in the queue to arm another pull request as soon as this is considered good enough. AI might complain again about one more issue regarding osf and big-endian arches in osf but this batch is targetting crash fixes for osf at this stage. netfilter pull request 26-04-20 * tag 'nf-26-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check netfilter: nfnetlink_osf: fix out-of-bounds read on option matching ipvs: fix MTU check for GSO packets in tunnel mode netfilter: nat: use kfree_rcu to release ops netfilter: xtables: restrict several matches to inet family netfilter: conntrack: remove sprintf usage netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO netfilter: nft_osf: restrict it to ipv4 ==================== Link: https://patch.msgid.link/20260420220215.111510-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 2724fbc90e5c133fbbd030e72fe8a3869a20df08 Author: Takashi Iwai Date: Thu Apr 23 09:52:05 2026 +0200 Revert "ALSA: pcmtest: fix reference leak on failed device registration" We'd like to address the problem rather in the error code path of platform_device_register() itself instead of leaving it all callers, since less than 1% of all callers of over 100 platform_device_register() do call platform_device_put() properly as of now. For making the work easier, revert the previous change commit 4ff036f95238 ("ALSA: pcmtest: fix reference leak on failed device registration") again. Link: https://lore.kernel.org/20260415193138.3861297-1-lgs201920130244@gmail.com Link: https://patch.msgid.link/20260423075211.3977366-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 0c078021d3861966614d5e594ee03587f0c9e74d Author: Mieczyslaw Nalewaj Date: Sun Apr 19 21:37:07 2026 +0200 net: dsa: realtek: rtl8365mb: fix mode mask calculation The RTL8365MB_DIGITAL_INTERFACE_SELECT_MODE_MASK macro was shifting the 4-bit mask (0xF) by only (_extint % 2) bits instead of (_extint % 2) * 4. This caused the mask to overlap with the adjacent nibble when configuring odd-numbered external interfaces, selecting the wrong bits entirely. Align the shift calculation with the existing ...MODE_OFFSET macro. Fixes: 4af2950c50c8 ("net: dsa: realtek-smi: add rtl8365mb subdriver for RTL8365MB-VC") Signed-off-by: Abdulkader Alrezej Signed-off-by: Mieczyslaw Nalewaj Reviewed-by: Luiz Angelo Daros de Luca Link: https://patch.msgid.link/400a6387-a444-4576-af6d-26be5410bce3@yahoo.com Signed-off-by: Paolo Abeni commit 0adc92b910b3d6bf4913d79869365d553154a070 Author: Peter Zijlstra Date: Wed Apr 22 10:38:41 2026 +0200 locking/mutex: Fix ww_mutex wait_list operations Chaitanya, John and Mikhail reported commit 25500ba7e77c ("locking/mutex: Remove the list_head from struct mutex") wrecked ww_mutex. Specifically there were 2 issues: - __ww_waiter_prev() had the termination condition wrong; it would terminate when the previous entry was the first, which results in a truncated iteration: W3, W2, (no W1). - __mutex_add_waiter(@pos != NULL), as used by __ww_waiter_add() / __ww_mutex_add_waiter(); this inserts @waiter before @pos (which is what list_add_tail() does). But this should then also update lock->first_waiter. Much thanks to Prateek for spotting the __mutex_add_waiter() issue! Fixes: 25500ba7e77c ("locking/mutex: Remove the list_head from struct mutex") Reported-by: "Borah, Chaitanya Kumar" Closes: https://lore.kernel.org/r/af005996-05e9-4336-8450-d14ca652ba5d%40intel.com Reported-by: John Stultz Closes: https://lore.kernel.org/r/CANDhNCq%3Doizzud3hH3oqGzTrcjB8OwGeineJ3mwZuGdDWG8fRQ%40mail.gmail.com Reported-by: Mikhail Gavrilov Closes: https://lore.kernel.org/r/CABXGCsO5fKq2nD9nO8yO1z50ZzgCPWqueNXHANjntaswoOh2Dg@mail.gmail.com Debugged-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Tested-by: K Prateek Nayak Tested-by: Mikhail Gavrilov Link: https://patch.msgid.link/20260422092335.GH3102924%40noisy.programming.kicks-ass.net commit dd5dc1917473f398949b95f6b77c60d4d8eb1d97 Merge: d21877ac276661 174a0ef3b33434 Author: Arnd Bergmann Date: Thu Apr 23 10:02:23 2026 +0200 Merge tag 'amlogic-fixes-v7.1-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/late2 Amlogic DT Fixes for v7.1: - Fix ethernet PHY interrupt number for P230 reference board - Add missing cache information to cpu0 for Amlogic AXG - Fix Khadas VIM4 board model name - Fix GIC register ranges for Amlogic T7 - Fix Khadas VIM4 memory layout for 8GB RAM - Drop CPU masks from GICv3 PPI interrupts for Amlogic S6 * tag 'amlogic-fixes-v7.1-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number arm64: dts: amlogic: meson-axg: Add missing cache information to cpu0 arm64: dts: amlogic: t7: khadas-vim4: fix board model name arm64: dts: amlogic: Fix GIC register ranges for Amlogic T7 arm64: dts: amlogic: t7: khadas-vim4: fix memory layout for 8GB RAM arm64: dts: amlogic: s6: Drop CPU masks from GICv3 PPI interrupts Signed-off-by: Arnd Bergmann commit 0b13173d27fa15679463b62a10cfa8b3d6c3a71c Author: Xiang Gao Date: Wed Apr 15 13:41:01 2026 +0800 dma-buf: fix stale @lock references in struct dma_buf documentation The kernel-doc comments for vmapping_counter and vmap_ptr in struct dma_buf reference "@lock" as the protecting lock, but struct dma_buf no longer has a "lock" member. The mutex was removed in favor of using the dma_resv lock exclusively. The implementation correctly uses dma_resv_assert_held(dmabuf->resv) in dma_buf_vmap() and dma_buf_vunmap(), so update the documentation to reference @resv instead. Signed-off-by: gaoxiang17 Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260415054101.535520-1-gxxa03070307@gmail.com commit 2699bc6d062735f9fc430fe6dcf05b82ae8b2ab9 Merge: a9224f26b754b5 24fcdc81dd7e15 Author: Takashi Iwai Date: Thu Apr 23 09:34:28 2026 +0200 Merge tag 'asoc-fix-v7.1-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.1 A fairly small collection of fixes, device IDs and quirks that came in during the merge window, the most remarkable of which is one for SDCA boolean firmware flags which is remarkable mainly because it is partially in regmap. commit 084a39af974b137ff7cc4223285e2c144afc1ddc Merge: 1ada03fdef82d3 3309965fe44c00 Author: Paolo Abeni Date: Thu Apr 23 09:08:00 2026 +0200 Merge branch 'net-airoha-fix-airoha_qdma_cleanup_tx_queue-processing' Lorenzo Bianconi says: ==================== net: airoha: Fix airoha_qdma_cleanup_tx_queue() processing Add missing bits in airoha_qdma_cleanup_tx_queue routine. Fix airoha_qdma_cleanup_tx_queue processing errors intorduced in commit '3f47e67dff1f7 ("net: airoha: Add the capability to consume out-of-order DMA tx descriptors")'. v3: https://lore.kernel.org/r/20260416-airoha_qdma_cleanup_tx_queue-fix-net-v3-0-2b69f5788580@kernel.org v2: https://lore.kernel.org/r/20260414-airoha_qdma_cleanup_tx_queue-fix-net-v2-1-875de57cc022@kernel.org v1: https://lore.kernel.org/r/20260410-airoha_qdma_cleanup_tx_queue-fix-net-v1-1-b7171c8f1e78@kernel.org ==================== Link: https://patch.msgid.link/20260417-airoha_qdma_cleanup_tx_queue-fix-net-v4-0-e04bcc2c9642@kernel.org Signed-off-by: Paolo Abeni commit 3309965fe44c00fd65af7cef5016e9e782c021a7 Author: Lorenzo Bianconi Date: Fri Apr 17 08:36:32 2026 +0200 net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() Similar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in airoha_qdma_cleanup_tx_queue routine. Moreover, reset TX_DMA_IDX to TX_CPU_IDX to notify the NIC the QDMA TX ring is empty. Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260417-airoha_qdma_cleanup_tx_queue-fix-net-v4-2-e04bcc2c9642@kernel.org Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit f329924bb49458c65297f1361f545816a5b90998 Author: Lorenzo Bianconi Date: Fri Apr 17 08:36:31 2026 +0200 net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx() If queue entry list allocation fails in airoha_qdma_init_tx_queue routine, airoha_qdma_cleanup_tx_queue() will trigger a NULL pointer dereference accessing the queue entry array. The issue is due to the early ndesc initialization in airoha_qdma_init_tx_queue(). Fix the issue moving ndesc initialization at end of airoha_qdma_init_tx routine. Fixes: 3f47e67dff1f7 ("net: airoha: Add the capability to consume out-of-order DMA tx descriptors") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260417-airoha_qdma_cleanup_tx_queue-fix-net-v4-1-e04bcc2c9642@kernel.org Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit a6fe8bd56f7344b0c42f287c4b744d4d43e31ebe Merge: 0389aa700912ad 314f6179e37098 Author: Dave Airlie Date: Thu Apr 23 16:01:08 2026 +1000 Merge tag 'drm-intel-next-fixes-2026-04-22' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Fix uninitialized variable in the alignment loop [psr] (Jouni Högander) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patch.msgid.link/aeh-dKTow5Fl4Iv4@linux commit 5db6ef9847717329f12c5ea8aba7e9f588a980c0 Author: Yucheng Lu Date: Wed Apr 22 21:45:04 2026 +0800 crypto: authencesn - reject short ahash digests during instance creation authencesn requires either a zero authsize or an authsize of at least 4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of high-order sequence number data at the end of the authenticated data. While crypto_authenc_esn_setauthsize() already rejects explicit non-zero authsizes in the range 1..3, crypto_authenc_esn_create() still copied auth->digestsize into inst->alg.maxauthsize without validating it. The AEAD core then initialized the tfm's default authsize from that value. As a result, selecting an ahash with digest size 1..3, such as cbcmac(cipher_null), exposed authencesn instances whose default authsize was invalid even though setauthsize() would have rejected the same value. AF_ALG could then trigger the ESN tail handling with a too-short tag and hit an out-of-bounds access. Reject authencesn instances whose ahash digest size is in the invalid non-zero range 1..3 so that no tfm can inherit an unsupported default authsize. Fixes: f15f05b0a5de ("crypto: ccm - switch to separate cbcmac driver") Cc: stable@kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Yuhang Zheng Reviewed-by: Eric Biggers Signed-off-by: Yucheng Lu Signed-off-by: Ren Wei Signed-off-by: Herbert Xu commit 7939f96f26e96b69db1fe4e7c18537a679696358 Author: Tiezhu Yang Date: Thu Apr 23 12:49:46 2026 +0800 selftests/bpf: Enable CAN_USE_LOAD_ACQ_STORE_REL for LoongArch In order to do the following load-acquire and store-release tests on LoongArch: sudo ./test_progs -t verifier_load_acquire sudo ./test_progs -t verifier_store_release sudo ./test_progs -t verifier_precision/bpf_load_acquire sudo ./test_progs -t verifier_precision/bpf_store_release sudo ./test_progs -t compute_live_registers/atomic_load_acq_store_rel It needs to enable CAN_USE_LOAD_ACQ_STORE_REL for LoongArch. Acked-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit e815df29b6a5e59293500085a010d5882374cb3e Author: Hengqi Chen Date: Thu Apr 23 12:49:36 2026 +0800 LoongArch: BPF: Add fsession support for trampolines Implement BPF_TRACE_FSESSION support in LoongArch BPF JIT. The logic here is almost identical to what has been done in RISC-V JIT. The key changes are: - Allocate stack space for function meta and session cookies - Introduce invoke_bpf() as a wrapper around invoke_bpf_prog() that populates session cookies before each invocation - Implement bpf_jit_supports_fsession() callback Tested-by: Vincent Li Reviewed-by: Menglong Dong Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit 6ef04707e8eee09360f70812c0ac63c712460bd0 Author: Hengqi Chen Date: Thu Apr 23 12:49:36 2026 +0800 LoongArch: BPF: Introduce emit_store_stack_imm64() helper Introduce a helper to store 64-bit immediate on the trampoline stack. The helper will be used in the next patch. Also refactor the existing code to use this helper. Tested-by: Vincent Li Reviewed-by: Menglong Dong Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit 1ada03fdef82d3d7d2edb9dcd3acc91917675e48 Author: Eric Dumazet Date: Tue Apr 21 14:16:55 2026 +0000 net/sched: sch_sfb: annotate data-races in sfb_dump_stats() sfb_dump_stats() only runs with RTNL held, reading fields that can be changed in qdisc fast path. Add READ_ONCE()/WRITE_ONCE() annotations. Alternative would be to acquire the qdisc spinlock, but our long-term goal is to make qdisc dump operations lockless as much as we can. tc_sfb_xstats fields don't need to be latched atomically, otherwise this bug would have been caught earlier. Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260421141655.3953721-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a8f5192809caf636d05ba47c144f282cfd0e3839 Author: Eric Dumazet Date: Tue Apr 21 14:23:09 2026 +0000 net/sched: sch_red: annotate data-races in red_dump_stats() red_dump_stats() only runs with RTNL held, reading fields that can be changed in qdisc fast path. Add READ_ONCE()/WRITE_ONCE() annotations. Alternative would be to acquire the qdisc spinlock, but our long-term goal is to make qdisc dump operations lockless as much as we can. tc_red_xstats fields don't need to be latched atomically, otherwise this bug would have been caught earlier. Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260421142309.3964322-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit bbfaa73ea6871db03dc05d7f05f00557a8981f25 Author: Eric Dumazet Date: Tue Apr 21 14:25:09 2026 +0000 net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() fq_codel_dump_stats() acquires the qdisc spinlock a bit too late. Move this acquisition before we fill st.qdisc_stats with live data. Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260421142509.3967231-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5154561d9b119f781249f8e845fecf059b38b483 Author: Eric Dumazet Date: Tue Apr 21 14:29:44 2026 +0000 net/sched: sch_pie: annotate data-races in pie_dump_stats() pie_dump_stats() only runs with RTNL held, reading fields that can be changed in qdisc fast path. Add READ_ONCE()/WRITE_ONCE() annotations. Alternative would be to acquire the qdisc spinlock, but our long-term goal is to make qdisc dump operations lockless as much as we can. tc_pie_xstats fields don't need to be latched atomically, otherwise this bug would have been caught earlier. Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260421142944.4009941-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a6edf2cd4156b71e07258876b7626692e158f7e8 Author: Eric Dumazet Date: Tue Apr 21 14:33:49 2026 +0000 net_sched: sch_hhf: annotate data-races in hhf_dump_stats() hhf_dump_stats() only runs with RTNL held, reading fields that can be changed in qdisc fast path. Add READ_ONCE()/WRITE_ONCE() annotations. Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260421143349.4052215-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9d146a5d10685ab19e15bbedc5107c5b94d45ebe Merge: c88eb7e8d8397a 1f75dbc53f68f0 Author: Jakub Kicinski Date: Wed Apr 22 21:10:12 2026 -0700 Merge branch 'intel-wired-lan-driver-updates-2026-04-20-ice' Jacob Keller says: ==================== Intel Wired LAN Driver Updates 2026-04-20 (ice) Since this is a set of related fixes for just the ice driver, Jake provides the following description for the series: We recently ran into a nasty corner case issue with a customer operating E825C cards seeing some strange behavior with missing Tx timestamps. During the course of debugging. This series contains a few fixes found during this debugging process. The primary issue discovered in the investigation is a misconfiguration of the E825C PHY timestamp interrupt register, PHY_REG_TS_INT_CONFIG. This register is responsible for programming the Tx timestamp behavior of a PHY port. The driver programs two values here: a threshold for when to interrupt and whether the interrupt is enabled. The threshold value is used by hardware to determine when to trigger a Tx timestamp interrupt. The interrupt cause for the port is raised when the number of outstanding timestamps in the PHY port timestamp memory meets the threshold. The interrupt cause is not cleared until the number of outstanding timestamps drops *below* the threshold. It is considered a misconfiguration if the threshold is programmed to 0. If the interrupt is enabled while the threshold is zero, hardware will raise the interrupt cause at the next time it checks. Once raised, the interrupt cause for the port will never lower, since you cannot have fewer than zero outstanding timestamps. Worse, the timestamp status for the port will remain high even if the PHY_REG_TS_INT_CONFIG is reprogrammed with a new threshold. The PHY is a separate hardware block from the MAC, and thus the interrupt status for the port will remain high even if you reset the device MAC with a PF reset, CORE reset, or GLOBAL reset. PHY ports are connected together into quads. Each quad muxes the PHY interrupt status for the 4 ports on the quad together before connecting that to the MACs miscellaneous interrupt vector. As a result, if a single PHY port in the quad is stuck, no timestamp interrupts will be generated for any timestamp on any port on that quad. The ice driver never directly writes a value of 0 for the threshold. Indeed, the desired behavior is to set the threshold to 1, so that interrupts are generated as soon as a single timestamp is captured. Unfortunately, it turns out that for the E825C PHY, programming the threshold and enable bit in the same write may cause a race in the PHY timestamp block. The PHY may "see" the interrupt as enabled first before it sees the threshold value. If the previous threshold value is zero (such as when the register is initialized to zero at a cold power on), the hardware may race with programming the threshold and set the PHY interrupt status to high as described above. The first patch in this series corrects that programming order, ensuring that the threshold is always written first in a separate transaction from enabling the interrupt bit. Additionally, an explicit check against writing a 0 is added to make it clear to future readers that writing 0 to the threshold while enabling the interrupt is not safe. The PHY timestamp block does not reset with the MAC, and seems to only reset during cold power on. This makes recovery from the faulty configuration difficult. To address this, perform an explicit reset of the PHY PTP block during initialization. This is achieved by writing the PHY_REG_GLOBAL register. This performs a PHY soft reset, which completely resets the timestamp block. This includes clearing the timestamp memory, the PHY timestamp interrupt status, and the PHY PTP counter. A soft reset of all ports on the device is done as part of ice_ptp_init_phc() during early initialization of the PTP functionality by the PTP clock owner, prior to programming each PHY. The ice_ptp_init_phc() function is called at driver init and during reinitialization after all forms of device reset. This ensures that the driver begins operation at a clean slate, rather than carrying over the stale and potentially buggy configuration of a previous driver. While attempting to root cause the issue with the PHY timestamp interrupt, we also discovered that the driver incorrectly assumes that it is operating on E822 hardware when reading the PHY timestamp memory status registers in a few places. This includes the check at the end of the interrupt handler, as well as the check done inside the PTP auxiliary function. This prevented the driver from detecting waiting timestamps on ports other than the first two. Finally, the ice_ptp_read_tx_hwstamp_status_eth56g() function was discovered to only read the timestamp interrupt status value from the first quad due to mistaking the port index for a PHY quad index. This resulted in reporting the timestamp status for the second quad as identical to the first quad instead of properly reporting its value. This is a minor fix since the function currently is only used for diagnostic purposes and does not impact driver decision logic. ==================== Link: https://patch.msgid.link/20260420-jk-iwl-net-2026-04-20-ptp-e825c-phy-interrupt-fixes-v1-0-bc2240f42251@intel.com Signed-off-by: Jakub Kicinski commit 1f75dbc53f68f0fb2acd99f92315e426a3d0b446 Author: Jacob Keller Date: Mon Apr 20 17:51:28 2026 -0700 ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g The ice_ptp_read_tx_hwtstamp_status_eth56g function calls ice_read_phy_eth56g with a PHY index. However the function actually expects a port index. This causes the function to read the wrong PHY_PTP_INT_STATUS registers, and effectively makes the status wrong for the second set of ports from 4 to 7. The ice_read_phy_eth56g function uses the provided port index to determine which PHY device to read. We could refactor the entire chain to take a PHY index, but this would impact many code sites. Instead, multiply the PHY index by the number of ports, so that we read from the first port of each PHY. Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") Reviewed-by: Aleksandr Loktionov Reviewed-by: Petr Oros Tested-by: Sunitha Mekala Signed-off-by: Jacob Keller Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260420-jk-iwl-net-2026-04-20-ptp-e825c-phy-interrupt-fixes-v1-4-bc2240f42251@intel.com Signed-off-by: Jakub Kicinski commit 359dc1d41358c88955eeff1b75aee55da7a415d3 Author: Jacob Keller Date: Mon Apr 20 17:51:27 2026 -0700 ice: fix ready bitmap check for non-E822 devices The E800 hardware (apart from E810) has a ready bitmap for the PHY indicating which timestamp slots currently have an outstanding timestamp waiting to be read by software. This bitmap is checked in multiple places using the ice_get_phy_tx_tstamp_ready(): * ice_ptp_process_tx_tstamp() calls it to determine which timestamps to attempt reading from the PHY * ice_ptp_tx_tstamps_pending() calls it in a loop at the end of the miscellaneous IRQ to check if new timestamps came in while the interrupt handler was executing. * ice_ptp_maybe_trigger_tx_interrupt() calls it in the auxiliary work task to trigger a software interrupt in the event that the hardware logic gets stuck. For E82X devices, multiple PHYs share the same block, and the parameter passed to the ready bitmap is a block number associated with the given port. For E825-C devices, the PHYs have their own independent blocks and do not share, so the parameter passed needs to be the port number. For E810 devices, the ice_get_phy_tx_tstamp_ready() always returns all 1s regardless of what port, since this hardware does not have a ready bitmap. Finally, for E830 devices, each PF has its own ready bitmap accessible via register, and the block parameter is unused. The first call correctly uses the Tx timestamp tracker block parameter to check the appropriate timestamp block. This works because the tracker is setup correctly for each timestamp device type. The second two callers behave incorrectly for all device types other than the older E822 devices. They both iterate in a loop using ICE_GET_QUAD_NUM() which is a macro only used by E822 devices. This logic is incorrect for devices other than the E822 devices. For E810 the calls would always return true, causing E810 devices to always attempt to trigger a software interrupt even when they have no reason to. For E830, this results in duplicate work as the ready bitmap is checked once per number of quads. Finally, for E825-C, this results in the pending checks failing to detect timestamps on ports other than the first two. Fix this by introducing a new hardware API function to ice_ptp_hw.c, ice_check_phy_tx_tstamp_ready(). This function will check if any timestamps are available and returns a positive value if any timestamps are pending. For E810, the function always returns false, so that the re-trigger checks never happen. For E830, check the ready bitmap just once. For E82x hardware, check each quad. Finally, for E825-C, check every port. The interface function returns an integer to enable reporting of error code if the driver is unable read the ready bitmap. This enables callers to handle this case properly. The previous implementation assumed that timestamps are available if they failed to read the bitmap. This is problematic as it could lead to continuous software IRQ triggering if the PHY timestamp registers somehow become inaccessible. This change is especially important for E825-C devices, as the missing checks could leave a window open where a new timestamp could arrive while the existing timestamps aren't completed. As a result, the hardware threshold logic would not trigger a new interrupt. Without the check, the timestamp is left unhandled, and new timestamps will not cause an interrupt again until the timestamp is handled. Since both the interrupt check and the backup check in the auxiliary task do not function properly, the device may have Tx timestamps permanently stuck failing on a given port. The faulty checks originate from commit d938a8cca88a ("ice: Auxbus devices & driver for E822 TS") and commit 712e876371f8 ("ice: periodically kick Tx timestamp interrupt"), however at the time of the original coding, both functions only operated on E822 hardware. This is no longer the case, and hasn't been since the introduction of the ETH56G PHY model in commit 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") Reviewed-by: Aleksandr Loktionov Reviewed-by: Petr Oros Tested-by: Sunitha Mekala Signed-off-by: Jacob Keller Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260420-jk-iwl-net-2026-04-20-ptp-e825c-phy-interrupt-fixes-v1-3-bc2240f42251@intel.com Signed-off-by: Jakub Kicinski commit 3ec46e157c7fa420c77dfc23f7030e61f2f3fd55 Author: Grzegorz Nitka Date: Mon Apr 20 17:51:26 2026 -0700 ice: perform PHY soft reset for E825C ports at initialization In some cases the PHY timestamp block of the E825C can become stuck. This is known to occur if the software writes 0 to the Tx timestamp threshold, and with older versions of the ice driver the threshold configuration is buggy and can race in such that hardware briefly operates with a zero threshold enabled. There are no other known ways to trigger this behavior, but once it occurs, the hardware is not recovered by normal reset, a driver reload, or even a warm power cycle of the system. A cold power cycle is sufficient to recover hardware, but this is extremely invasive and can result in significant downtime on customer deployments. The PHY for each port has a timestamping block which has its own reset functionality accessible by programming the PHY_REG_GLOBAL register. Writing to the PHY_REG_GLOBAL_SOFT_RESET_BIT triggers the hardware to perform a complete reset of the timestamping block of the PHY. This includes clearing the timestamp status for the port, clearing all outstanding timestamps in the memory bank, and resetting the PHY timer. The new ice_ptp_phy_soft_reset_eth56g() function toggles the PHY_REG_GLOBAL soft reset bit with the required delays, ensuring the PHY is properly reinitialized without requiring a full device reset. The sequence clears the reset bit, asserts it, then clears it again, with short waits between transitions to allow hardware stabilization. Call this function in the new ice_ptp_init_phc_e825c(), implementing the E825C device specific variant of the ice_ptp_init_phc(). Note that if ice_ptp_init_phc() fails, PTP functionality may be disabled, but the driver will still load to allow basic functionality to continue. This causes the clock owning PF driver to perform a PHY soft reset for every port during initialization. This ensures the driver begins life in a known functional state regardless of how it was previously programmed. This ensures that we properly reconfigure the hardware after a device reset or when loading the driver, even if it was previously misconfigured with an out-of-date or modified driver. Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") Signed-off-by: Timothy Miskell Signed-off-by: Grzegorz Nitka Reviewed-by: Aleksandr Loktionov Reviewed-by: Petr Oros Tested-by: Sunitha Mekala Signed-off-by: Jacob Keller Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260420-jk-iwl-net-2026-04-20-ptp-e825c-phy-interrupt-fixes-v1-2-bc2240f42251@intel.com Signed-off-by: Jakub Kicinski commit c0a575a801a2040eb1e0db54b488f8c548c8458a Author: Grzegorz Nitka Date: Mon Apr 20 17:51:25 2026 -0700 ice: fix timestamp interrupt configuration for E825C The E825C ice_phy_cfg_intr_eth56g() function is responsible for programming the PHY interrupt for a given port. This function writes to the PHY_REG_TS_INT_CONFIG register of the port. The register is responsible for configuring whether the port interrupt logic is enabled, as well as programming the threshold of waiting timestamps that will trigger an interrupt from this port. This threshold value must not be programmed to zero while the interrupt is enabled. Doing so puts the port in a misconfigured state where the PHY timestamp interrupt for the quad of connected ports will become stuck. This occurs, because a threshold of zero results in the timestamp interrupt status for the port becoming stuck high. The four ports in the connected quad have their timestamp status indicators muxed together. A new interrupt cannot be generated until the timestamp status indicators return low for all four ports. Normally, the timestamp status for a port will clear once there are fewer timestamps in that ports timestamp memory bank than the threshold. A threshold of zero makes this impossible, so the timestamp status for the port does not clear. The ice driver never intentionally programs the threshold to zero, indeed the driver always programs it to a value of 1, intending to get an interrupt immediately as soon as even a single packet is waiting for a timestamp. However, there is a subtle flaw in the programming logic in the ice_phy_cfg_intr_eth56g() function. Due to the way that the hardware handles enabling the PHY interrupt. If the threshold value is modified at the same time as the interrupt is enabled, the HW PHY state machine might enable the interrupt before the new threshold value is actually updated. This leaves a potential race condition caused by the hardware logic where a PHY timestamp interrupt might be triggered before the non-zero threshold is written, resulting in the PHY timestamp logic becoming stuck. Once the PHY timestamp status is stuck high, it will remain stuck even after attempting to reprogram the PHY block by changing its threshold or disabling the interrupt. Even a typical PF or CORE reset will not reset the particular block of the PHY that becomes stuck. Even a warm power cycle is not guaranteed to cause the PHY block to reset, and a cold power cycle is required. Prevent this by always writing the PHY_REG_TS_INT_CONFIG in two stages. First write the threshold value with the interrupt disabled, and only write the enable bit after the threshold has been programmed. When disabling the interrupt, leave the threshold unchanged. Additionally, re-read the register after writing it to guarantee that the write to the PHY has been flushed upon exit of the function. While we're modifying this function implementation, explicitly reject programming a threshold of 0 when enabling the interrupt. No caller does this today, but the consequences of doing so are significant. An explicit rejection in the code makes this clear. Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") Signed-off-by: Grzegorz Nitka Reviewed-by: Aleksandr Loktionov Reviewed-by: Petr Oros Tested-by: Sunitha Mekala Signed-off-by: Jacob Keller Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260420-jk-iwl-net-2026-04-20-ptp-e825c-phy-interrupt-fixes-v1-1-bc2240f42251@intel.com Signed-off-by: Jakub Kicinski commit c88eb7e8d8397a8c1db59c425332c5a30b2a1682 Author: Michael Bommarito Date: Sat Apr 18 10:10:47 2026 -0400 net/rds: zero per-item info buffer before handing it to visitors rds_for_each_conn_info() and rds_walk_conn_path_info() both hand a caller-allocated on-stack u64 buffer to a per-connection visitor and then copy the full item_len bytes back to user space via rds_info_copy() regardless of how much of the buffer the visitor actually wrote. rds_ib_conn_info_visitor() and rds6_ib_conn_info_visitor() only write a subset of their output struct when the underlying rds_connection is not in state RDS_CONN_UP (src/dst addr, tos, sl and the two GIDs via explicit memsets). Several u32 fields (max_send_wr, max_recv_wr, max_send_sge, rdma_mr_max, rdma_mr_size, cache_allocs) and the 2-byte alignment hole between sl and cache_allocs remain as whatever stack contents preceded the visitor call and are then memcpy_to_user()'d out to user space. struct rds_info_rdma_connection and struct rds6_info_rdma_connection are the only rds_info_* structs in include/uapi/linux/rds.h that are not marked __attribute__((packed)), so they have a real alignment hole. The other info visitors (rds_conn_info_visitor, rds6_conn_info_visitor, rds_tcp_tc_info, ...) write all fields of their packed output struct today and are not known to be vulnerable, but a future visitor that adds a conditional write-path would have the same bug. Reproduction on a kernel built without CONFIG_INIT_STACK_ALL_ZERO=y: a local unprivileged user opens AF_RDS, sets SO_RDS_TRANSPORT=IB, binds to a local address on an RDMA-capable netdev (rxe soft-RoCE on any netdev is sufficient), sendto()'s any peer on the same subnet (fails cleanly but installs an rds_connection in the global hash in RDS_CONN_CONNECTING), then calls getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS). The returned 68-byte item contains 26 bytes of stack garbage including kernel text/data pointers: 0..7 0a 63 00 01 0a 63 00 02 src=10.99.0.1 dst=10.99.0.2 8..39 00 ... gids (memset-zeroed) 40..47 e0 92 a3 81 ff ff ff ff kernel pointer (max_send_wr) 48..55 7f 37 b5 81 ff ff ff ff kernel pointer (rdma_mr_max) 56..59 01 00 08 00 rdma_mr_size (garbage) 60..61 00 00 tos, sl 62..63 00 00 alignment padding 64..67 18 00 00 00 cache_allocs (garbage) Fix by zeroing the per-item buffer in both rds_for_each_conn_info() and rds_walk_conn_path_info() before invoking the visitor. This covers the IPv4/IPv6 IB visitors and hardens all current and future visitors against the same class of bug. No functional change for visitors that fully populate their output. Changes in v2: - retarget at the net tree (subject prefix "[PATCH net v2]", net/rds: prefix in the title) - pick up Reviewed-by tags from Sharath Srinivasan and Allison Henderson Fixes: ec16227e1414 ("RDS/IB: Infiniband transport") Signed-off-by: Michael Bommarito Reviewed-by: Sharath Srinivasan Reviewed-by: Allison Henderson Assisted-by: Claude:claude-opus-4-7 Link: https://patch.msgid.link/20260418141047.3398203-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski commit ade67d5f588832c7ba131aadd4215a94ce0a15c8 Author: Andrea Mayer Date: Sat Apr 18 18:28:38 2026 +0200 seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode When SEG6_IPTUN_MODE_L2ENCAP_RED (L2ENCAP_RED) was introduced, the condition in seg6_build_state() that excludes L2 encap modes from setting LWTUNNEL_STATE_OUTPUT_REDIRECT was not updated to account for the new mode. As a consequence, L2ENCAP_RED routes incorrectly trigger seg6_output() on the output path, where the packet is silently dropped because skb_mac_header_was_set() fails on L3 packets. Extend the check to also exclude L2ENCAP_RED, consistent with L2ENCAP. Fixes: 13f0296be8ec ("seg6: add support for SRv6 H.L2Encaps.Red behavior") Cc: stable@vger.kernel.org Signed-off-by: Andrea Mayer Reviewed-by: Justin Iurman Link: https://patch.msgid.link/20260418162838.31979-1-andrea.mayer@uniroma2.it Signed-off-by: Jakub Kicinski commit 7c9b012d6367a335f1e91da28401a7c612305a46 Author: Xin Long Date: Fri Apr 17 17:09:40 2026 -0400 sctp: fix sockets_allocated imbalance after sk_clone() sk_clone() increments sockets_allocated and sets the socket refcount to 2. SCTP performs additional accounting in sctp_clone_sock(), so the clone-time increment must be undone to avoid double counting. Note we cannot simply remove the SCTP-side increment, because the SCTP destroy path in sctp_destroy_sock() only decrements sockets_allocated when sp->ep is set, which may not be true for all failure paths in sctp_clone_sock(). Fixes: 16942cf4d3e3 ("sctp: Use sk_clone() in sctp_accept().") Signed-off-by: Xin Long Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/af8d66f928dec3e9fcbee8d4a85b7d5a6b86f515.1776460180.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 0db1688072218bfbbfc0bbdee48bc7820da9e3cd Merge: 645d044d7e5c99 c6b34add67a540 Author: Jakub Kicinski Date: Wed Apr 22 20:30:49 2026 -0700 Merge branch 'bnge-fixes' Vikas Gupta says: ==================== bnge fixes Patch-1: Due to wrong HWRM sequence, driver do not get the correct information regarding resources and capabilities. The patch fixes the initial HWRM sequence. Patch-2: Remove the unsupported backing store type initialization, which is not supported in Thor Ultra devices. ==================== Link: https://patch.msgid.link/20260418023438.1597876-1-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit c6b34add67a5402f53359580956b5c318965a893 Author: Vikas Gupta Date: Sat Apr 18 08:04:38 2026 +0530 bnge: remove unsupported backing store type The backing store type, BNGE_CTX_MRAV, is not applicable in Thor Ultra devices. Remove it from the backing store configuration, as the firmware will not populate entities in this backing store type, due to which the driver load fails. Fixes: 29c5b358f385 ("bng_en: Add backing store support") Signed-off-by: Vikas Gupta Reviewed-by: Dharmender Garg Link: https://patch.msgid.link/20260418023438.1597876-3-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 70d7c905a07ae8415b955569620bf2bf77423553 Author: Vikas Gupta Date: Sat Apr 18 08:04:37 2026 +0530 bnge: fix initial HWRM sequence Firmware may not advertize correct resources if backing store is not enabled before resource information is queried. Fix the initial sequence of HWRMs so that driver gets capabilities and resource information correctly. Fixes: 3fa9e977a0cd ("bng_en: Initialize default configuration") Signed-off-by: Vikas Gupta Reviewed-by: Rahul Gupta Link: https://patch.msgid.link/20260418023438.1597876-2-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 645d044d7e5c99079ff2b134bd35d3301be2ec79 Author: Ariful Islam Shoikot Date: Mon Apr 20 17:45:53 2026 +0600 docs: maintainer-netdev: fix typo in "targeting" Fix spelling mistake "targgeting" -> "targeting" in maintainer-netdev.rst No functional change. Signed-off-by: Ariful Islam Shoikot Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260420114554.1026-1-islamarifulshoikat@gmail.com Signed-off-by: Jakub Kicinski commit 2c054e17d9d41f1020376806c7f750834ced4dc5 Author: Bingquan Chen Date: Sat Apr 18 19:20:06 2026 +0800 net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points directly into the mmap'd TX ring buffer shared with userspace. The kernel validates the header via __packet_snd_vnet_parse() but then re-reads all fields later in virtio_net_hdr_to_skb(). A concurrent userspace thread can modify the vnet_hdr fields between validation and use, bypassing all safety checks. The non-TPACKET path (packet_snd()) already correctly copies vnet_hdr to a stack-local variable. All other vnet_hdr consumers in the kernel (tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX path is the only caller of virtio_net_hdr_to_skb() that reads directly from user-controlled shared memory. Fix this by copying vnet_hdr from the mmap'd ring buffer to a stack-local variable before validation and use, consistent with the approach used in packet_snd() and all other callers. Fixes: 1d036d25e560 ("packet: tpacket_snd gso and checksum offload") Signed-off-by: Bingquan Chen Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260418112006.78823-1-patzilla007@gmail.com Signed-off-by: Jakub Kicinski commit 3bfcf396081ace536733b454ff128d53116581e5 Author: Kohei Enju Date: Mon Apr 20 10:54:23 2026 +0000 net: validate skb->napi_id in RX tracepoints Since commit 2bd82484bb4c ("xps: fix xps for stacked devices"), skb->napi_id shares storage with sender_cpu. RX tracepoints using net_dev_rx_verbose_template read skb->napi_id directly and can therefore report sender_cpu values as if they were NAPI IDs. For example, on the loopback path this can report 1 as napi_id, where 1 comes from raw_smp_processor_id() + 1 in the XPS path: # bpftrace -e 'tracepoint:net:netif_rx_entry{ print(args->napi_id); }' # taskset -c 0 ping -c 1 ::1 Report only valid NAPI IDs in these tracepoints and use 0 otherwise. Fixes: 2bd82484bb4c ("xps: fix xps for stacked devices") Signed-off-by: Kohei Enju Reviewed-by: Simon Horman Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260420105427.162816-1-kohei@enjuk.jp Signed-off-by: Jakub Kicinski commit 11b7df0952663f20ce72c9a22a3cf9278cf84db7 Author: GONG Ruiqi Date: Thu Apr 23 11:10:56 2026 +0800 apparmor/lsm: Fix aa_dfa_unpack's error handling in aa_setup_dfa_engine aa_dfa_unpack returns ERR_PTR not NULL when it fails, but aa_put_dfa only checks NULL for its input, which would cause invalid memory access in aa_put_dfa. Set nulldfa to NULL explicitly to fix that. Fixes: 98b824ff8984 ("apparmor: refcount the pdb") Signed-off-by: GONG Ruiqi Signed-off-by: John Johansen commit 828bf7929bedcb79b560b5b4e44f22abee07d31b Author: Daniel J Blueman Date: Fri Mar 27 19:58:32 2026 +0800 apparmor: Fix string overrun due to missing termination When booting Ubuntu 26.04 with Linux 7.0-rc4 on an ARM64 Qualcomm Snapdragon X1 we see a string buffer overrun: BUG: KASAN: slab-out-of-bounds in aa_dfa_match (security/apparmor/match.c:535) Read of size 1 at addr ffff0008901cc000 by task snap-update-ns/2120 CPU: 5 UID: 60578 PID: 2120 Comm: snap-update-ns Not tainted 7.0.0-rc4+ #22 PREEMPTLAZY Hardware name: LENOVO 83ED/LNVNB161216, BIOS NHCN60WW 09/11/2025 Call trace: show_stack (arch/arm64/kernel/stacktrace.c:501) (C) dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) __asan_report_load1_noabort (mm/kasan/report_generic.c:378) aa_dfa_match (security/apparmor/match.c:535) match_mnt_path_str (security/apparmor/mount.c:244 security/apparmor/mount.c:336) match_mnt (security/apparmor/mount.c:371) aa_bind_mount (security/apparmor/mount.c:447 (discriminator 4)) apparmor_sb_mount (security/apparmor/lsm.c:719 (discriminator 1)) security_sb_mount (security/security.c:1062 (discriminator 31)) path_mount (fs/namespace.c:4101) __arm64_sys_mount (fs/namespace.c:4172 fs/namespace.c:4361 fs/namespace.c:4338 fs/namespace.c:4338) invoke_syscall.constprop.0 (arch/arm64/kernel/syscall.c:35 arch/arm64/kernel/syscall.c:49) el0_svc_common.constprop.0 (./include/linux/thread_info.h:142 (discriminator 2) arch/arm64/kernel/syscall.c:140 (discriminator 2)) do_el0_svc (arch/arm64/kernel/syscall.c:152) el0_svc (arch/arm64/kernel/entry-common.c:80 arch/arm64/kernel/entry-common.c:725) el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:744) el0t_64_sync (arch/arm64/kernel/entry.S:596) Allocated by task 2120: kasan_save_stack (mm/kasan/common.c:58) kasan_save_track (./arch/arm64/include/asm/current.h:19 mm/kasan/common.c:70 mm/kasan/common.c:79) kasan_save_alloc_info (mm/kasan/generic.c:571) __kasan_kmalloc (mm/kasan/common.c:419) __kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5260 mm/slub.c:5272) aa_get_buffer (security/apparmor/lsm.c:2201) aa_bind_mount (security/apparmor/mount.c:442) apparmor_sb_mount (security/apparmor/lsm.c:719 (discriminator 1)) security_sb_mount (security/security.c:1062 (discriminator 31)) path_mount (fs/namespace.c:4101) __arm64_sys_mount (fs/namespace.c:4172 fs/namespace.c:4361 fs/namespace.c:4338 fs/namespace.c:4338) invoke_syscall.constprop.0 (arch/arm64/kernel/syscall.c:35 arch/arm64/kernel/syscall.c:49) el0_svc_common.constprop.0 (./include/linux/thread_info.h:142 (discriminator 2) arch/arm64/kernel/syscall.c:140 (discriminator 2)) do_el0_svc (arch/arm64/kernel/syscall.c:152) el0_svc (arch/arm64/kernel/entry-common.c:80 arch/arm64/kernel/entry-common.c:725) el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:744) el0t_64_sync (arch/arm64/kernel/entry.S:596) The buggy address belongs to the object at ffff0008901ca000 which belongs to the cache kmalloc-rnd-06-8k of size 8192 The buggy address is located 0 bytes to the right of allocated 8192-byte region [ffff0008901ca000, ffff0008901cc000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9101c8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:-1 pincount:0 flags: 0x8000000000000040(head|zone=2) page_type: f5(slab) raw: 8000000000000040 ffff000800016c40 fffffdffe2d14e10 ffff000800015c70 raw: 0000000000000000 0000000800010001 00000000f5000000 0000000000000000 head: 8000000000000040 ffff000800016c40 fffffdffe2d14e10 ffff000800015c70 head: 0000000000000000 0000000800010001 00000000f5000000 0000000000000000 head: 8000000000000003 fffffdffe2407201 fffffdffffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0008901cbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0008901cbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff0008901cc000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff0008901cc080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0008901cc100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc This was introduced by previous incorrect conversion from strcpy(). Fix it by adding the missing terminator. Cc: stable@vger.kernel.org Reviewed-by: Georgia Garcia Signed-off-by: Daniel J Blueman Fixes: 93d4dbdc8da0 ("apparmor: Replace deprecated strcpy in d_namespace_path") Signed-off-by: John Johansen commit ef78fdc4724190fbd4e66d80bcdf4d08045f5e98 Author: Dudu Lu Date: Mon Apr 13 17:03:13 2026 +0800 apparmor: Fix wrong dentry in RENAME_EXCHANGE uid check In apparmor_path_rename(), when handling RENAME_EXCHANGE, the cond_exchange structure is supposed to carry the attributes of the *new* dentry (since it is used to authorize moving new_dentry to the old location). However, line 412 reads: vfsuid = i_uid_into_vfsuid(idmap, d_backing_inode(old_dentry)); This fetches the uid of old_dentry instead of new_dentry. As a result, the RENAME_EXCHANGE permission check uses the wrong file owner, which can allow a rename that should be denied (if old_dentry's owner has more privileges) or deny one that should be allowed. Note that cond_exchange.mode on the line above correctly uses new_dentry. Only the uid lookup is wrong. Fix by changing old_dentry to new_dentry in the i_uid_into_vfsuid call. Fixes: 5e26a01e56fd ("apparmor: use type safe idmapping helpers") Reviewed-by: Georgia Garcia Signed-off-by: Dudu Lu Signed-off-by: John Johansen commit 72971e6f745ad5c366629b0affbe3a6b619dcd8b Author: John Johansen Date: Mon Apr 13 19:56:26 2026 -0700 apparmor: fix unpack_tags to properly return error in failure cases error is initialized to -EPROTO but set by some of the internal functions, unfortunately the last two checks assume error is set to -EPROTO already for the failure case. Ensure it is by setting it before these checks. Fixes: 3d28e2397af7a ("apparmor: add support loading per permission tagging") Reported-by: Dan Carpenter Signed-off-by: John Johansen commit f17b68f0c33ff184713c356cd024035d437bac8c Author: John Johansen Date: Wed Mar 4 19:24:01 2026 -0700 apparmor: fix dfa size check AppArmor dfas need a minimum of two states to be valid. State 0 is the default trap state, and State 1 the default start state. When verifying the dfa ensure that this is the case. Fixes: c27c6bd2c4d6b ("apparmor: ensure that dfa state tables have entries") Signed-off-by: John Johansen commit df7bf834a135e1f5bcbeecbec07605fa5d92f0bd Merge: 429e6c7f90d12a 30471982cd6679 Author: Linus Torvalds Date: Wed Apr 22 18:41:27 2026 -0700 Merge tag 'vfio-v7.1-rc1-pt2' of https://github.com/awilliam/linux-vfio Pull more VFIO updates from Alex Williamson: - Fix ordering of dma-buf cleanup versus device disabling in vfio-pci (Matt Evans) - Resolve an inconsistent and incorrect use of spinlock-irq in the virtio vfio-pci variant by conversion to mutex and proceed to modernize and simplify driver with use of guards (Alex Williamson) - Resurrect the removal of the remaining class_create() call in vfio, replacing with const struct class and class_register() (Jori Koolstra, Alex Williamson) - Fix NULL pointer dereference, properly serialize interrupt setup, and cleanup interrupt state tracking in the cdx vfio bus driver (Prasanna Kumar T S M, Alex Williamson) * tag 'vfio-v7.1-rc1-pt2' of https://github.com/awilliam/linux-vfio: vfio/cdx: Consolidate MSI configured state onto cdx_irqs vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex vfio/cdx: Fix NULL pointer dereference in interrupt trigger path vfio: replace vfio->device_class with a const struct class vfio/virtio: Use guard() for bar_mutex in legacy I/O vfio/virtio: Use guard() for migf->lock where applicable vfio/virtio: Use guard() for list_lock where applicable vfio/virtio: Convert list_lock from spinlock to mutex vfio/pci: Clean up DMABUFs before disabling function commit 429e6c7f90d12a8551b3eaa9faca7cfaefd99b1d Merge: 2e68039281932e f4b369c6fe0cea Author: Linus Torvalds Date: Wed Apr 22 18:36:40 2026 -0700 Merge tag 'input-for-v7.1-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a new charlieplex GPIO keypad driver - an update to aw86927 driver to support 86938 chip - an update for Chrome OS EC keyboard driver to support Fn- keymap extension - an UAF fix in debugfs teardown in EDT touchscreen driver - a number of conversions for input drivers to use guard() and __free() cleanup primitives - several drivers for bus mice (inport, logibm) and other very old devices have been removed - OLPC HGPK PS/2 protocol has been removed as it's been broken and inactive for 10 something years - dedicated kpsmoused has been removed from psmouse driver - other assorted cleanups and fixups * tag 'input-for-v7.1-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (101 commits) Input: charlieplex_keypad - add GPIO charlieplex keypad dt-bindings: input: add GPIO charlieplex keypad dt-bindings: input: add settling-time-us common property dt-bindings: input: add debounce-delay-ms common property Input: imx_keypad - fix spelling mistake "Colums" -> "Columns" Input: edt-ft5x06 - fix use-after-free in debugfs teardown Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Input: ct82c710 - remove driver Input: mk712 - remove driver Input: logibm - remove driver Input: inport - remove driver Input: qt1070 - inline i2c_check_functionality check Input: qt1050 - inline i2c_check_functionality check Input: aiptek - validate raw macro indices before updating state Input: gf2k - skip invalid hat lookup values Input: xpad - add RedOctane Games vendor id Input: xpad - remove stale TODO and changelog header Input: usbtouchscreen - refactor endpoint lookup Input: aw86927 - add support for Awinic AW86938 dt-bindings: input: awinic,aw86927: Add Awinic AW86938 ... commit 1249c01aa42160e40bc765ba5a3cde751491ff0a Author: Stefan Metzmacher Date: Sun Apr 19 21:20:18 2026 +0200 smb: smbdirect: move fs/smb/common/smbdirect/ to fs/smb/smbdirect/ This also removes the smbdirect_ prefix from the files. Suggested-by: Linus Torvalds Link: https://lore.kernel.org/linux-cifs/CAHk-=whmue3PVi88K0UZLZO0at22QhQZ-yu+qO2TOKyZpGqecw@mail.gmail.com/ Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Linus Torvalds Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2e68039281932e6dc37718a1ea7cbb8e2cda42e6 Merge: 66a7974a395fe0 07004a8c4b5721 Author: Linus Torvalds Date: Wed Apr 22 15:09:01 2026 -0700 Merge tag 'tracefs-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracefs fixes from Steven Rostedt: - Use list_add_tail_rcu() for walking eventfs children The linked list of children is protected by SRCU and list walkers can walk the list with only using SRCU. Using just list_add_tail() on weakly ordered architectures can cause issues. Instead use list_add_tail_rcu(). - Hold eventfs_mutex and SRCU for remount walk events The trace_apply_options() walks the tracefs_inodes where some are eventfs inodes and eventfs_remount() is called which in turn calls eventfs_set_attr(). This walk only holds normal RCU read locks, but the eventfs_mutex and SRCU should be held. Add a eventfs_remount_(un)lock() helpers to take the necessary locks before iterating the list. * tag 'tracefs-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: eventfs: Hold eventfs_mutex and SRCU when remount walks events eventfs: Use list_add_tail_rcu() for SRCU-protected children list commit 66a7974a395fe0ab8fb9f6acd013343bc6bad83a Merge: 1e18ed5727e827 932cdaf3e273a2 Author: Linus Torvalds Date: Wed Apr 22 15:06:40 2026 -0700 Merge tag 'ktest-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest Pull ktest updates from Steven Rostedt: - Fix month in date timestamp used to create failure directories On failure, a directory is created to store the logs and config file to analyze the failure. The Perl function localtime is used to create the data timestamp of the directory. The month passed back from that function starts at 0 and not 1, but the timestamp used does not account for that. Thus for April 20, 2026, the timestamp of 20260320 is used, instead of 20260420. - Save the logfile to the failure directory Just the test log was saved to the directory on failure, but there's useful information in the full logfile that can be helpful to analyzing the failure. Save the logfile as well. * tag 'ktest-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest: ktest: Add logfile to failure directory ktest: Fix the month in the name of the failure directory commit 1e18ed5727e827d627e4897bfed9d001d5d51d65 Merge: 38ee6e1fb6f66c 5335e318ad3cf1 Author: Linus Torvalds Date: Wed Apr 22 14:47:52 2026 -0700 Merge tag 'trace-ring-buffer-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ring-buffer fix from Steven Rostedt: - Make undefsyms_base.c into a real file The file undefsyms_base.c is used to catch any symbols used by a remote ring buffer that is made for use of a pKVM hypervisor. As it doesn't share the same text as the rest of the kernel, referencing any symbols within the kernel will make it fail to be built for the standalone hypervisor. A file was created by the Makefile that checked for any symbols that could cause issues. There's no reason to have this file created by the Makefile, just create it as a normal file instead. * tag 'trace-ring-buffer-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Make undefsyms_base.c a first-class citizen commit 38ee6e1fb6f66ca6c82ad638a3c622feeaa488f2 Merge: 87d03777eb5dff 256e5254efff48 Author: Linus Torvalds Date: Wed Apr 22 14:26:58 2026 -0700 Merge tag 'kgdb-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb update from Daniel Thompson: "Only a very small update for kgdb this cycle: a single patch from Kexin Sun that fixes some outdated comments" * tag 'kgdb-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: kgdb: update outdated references to kgdb_wait() commit 87d03777eb5dff5ea03802933e9045e64ebf004d Merge: 2a4c0c11c01938 8fc1ad90075f54 Author: Linus Torvalds Date: Wed Apr 22 14:22:26 2026 -0700 Merge tag 'tomoyo-pr-20260422' of git://git.code.sf.net/p/tomoyo/tomoyo Pull tomoyo update from Tetsuo Handa: "Handle 64-bit inode numbers" * tag 'tomoyo-pr-20260422' of git://git.code.sf.net/p/tomoyo/tomoyo: tomoyo: use u64 for holding inode->i_ino value commit 24fcdc81dd7e1560e57eff75b618e5b00054b714 Merge: 87a3f5c8ac2096 1f95fdef685ee7 Author: Mark Brown Date: Wed Apr 22 21:15:55 2026 +0100 ASoC: dt-bindings: ti,tas2781: Add TAS5832 support Baojun Xu says: Link: https://patch.msgid.link/20260414015441.2439-1-baojun.xu@ti.com Signed-off-by: Mark Brown commit 1f95fdef685ee76393981de062e6b26210d88a9c Author: Baojun Xu Date: Tue Apr 14 09:54:41 2026 +0800 ASoC: tas2781: Add tas5832 support TAS5832 is in same family with TAS5827/28/30. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20260414015441.2439-2-baojun.xu@ti.com Signed-off-by: Mark Brown commit 6d619f73970397e13d2d3f830b183fcd9f58e749 Author: Baojun Xu Date: Tue Apr 14 09:54:40 2026 +0800 ASoC: dt-bindings: ti,tas2781: Add TAS5832 support TAS5832 is in same family with TAS5827/28/30. Signed-off-by: Baojun Xu Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260414015441.2439-1-baojun.xu@ti.com Signed-off-by: Mark Brown commit bd7b7ce96db4487bb77692a85ee4489fd2c395df Author: Chris Leech Date: Wed Apr 22 12:06:36 2026 -0700 nvme-auth: Hash DH shared secret to create session key The NVMe Base Specification 8.3.5.5.9 states that the session key Ks shall be computed from the ephemeral DH key by applying the hash function selected by the HashID parameter. The current implementation stores the raw DH shared secret as the session key without hashing it. This causes redundant hash operations: 1. Augmented challenge computation (section 8.3.5.5.4) requires Ca = HMAC(H(g^xy mod p), C). The code compensates by hashing the unhashed session key in nvme_auth_augmented_challenge() to produce the correct result. 2. PSK generation (section 8.3.5.5.9) requires PSK = HMAC(Ks, C1 || C2) where Ks should already be H(g^xy mod p). As the DH shared secret is always larger than the HMAC block size, HMAC internally hashes it before use, accidentally producing the correct result. When using secure channel concatenation with bidirectional authentication, this results in hashing the DH value three times: twice for augmented challenge calculations and once during PSK generation. Fix this by: - Modifying nvme_auth_gen_shared_secret() to hash the DH shared secret once after computation: Ks = H(g^xy mod p) - Removing the hash operation from nvme_auth_augmented_challenge() as the session key is now already hashed - Updating session key buffer size from DH key size to hash output size - Adding specification references in comments This avoid storing the raw DH shared secret and reduces the number of hash operations from three to one when using secure channel concatenation. Reviewed-by: Hannes Reinecke Reviewed-by: Eric Biggers Signed-off-by: Chris Leech Signed-off-by: Keith Busch commit cd0eb48b38e42ce77955137f633fb78621933870 Merge: eb5249b1250724 2c7e33f1fc2e75 Author: Martin KaFai Lau Date: Wed Apr 22 12:00:23 2026 -0700 Merge branch 'bpf-reject-tcp_nodelay-in-tcp-header-option' KaFai Wan says: ==================== bpf: Reject TCP_NODELAY in TCP header option This small patchset is about avoid infinite recursion in TCP header option callbacks and bpf-tcp-cc callbacks via TCP_NODELAY setsockopt. v4: - Fix the test case for TCP header option callbacks (Martin and Jiayuan) - Reject TCP_NODELAY in bpf-tcp-cc callbacks (AI and Martin) - Add a test case for bpf-tcp-cc v3: - Remove CONFIG_INET check and add comment (Martin and Jiayuan) - Fix the test case (Martin) https://lore.kernel.org/bpf/20260417092035.2299913-1-kafai.wan@linux.dev/ v2: - Reject TCP_NODELAY in bpf_sock_ops_setsockopt() (AI and Martin) https://lore.kernel.org/bpf/20260416112308.1820332-1-kafai.wan@linux.dev/ v1: https://lore.kernel.org/bpf/20260414112310.1285783-1-kafai.wan@linux.dev/ ==================== Link: https://patch.msgid.link/20260421155804.135786-1-kafai.wan@linux.dev Signed-off-by: Martin KaFai Lau commit 2c7e33f1fc2e75fcfb4aa5d840bcd2e8b53c1847 Author: KaFai Wan Date: Tue Apr 21 23:58:04 2026 +0800 selftests/bpf: Verify bpf-tcp-cc rejects TCP_NODELAY Add a bpf_tcp_ca selftest for the TCP_NODELAY restriction in bpf-tcp-cc. Update bpf_cubic to exercise init() and cwnd_event_tx_start(), and check that both callbacks reject bpf_setsockopt(TCP_NODELAY) with -EOPNOTSUPP. Signed-off-by: KaFai Wan Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260421155804.135786-5-kafai.wan@linux.dev commit 52b6b5334924d8f083a2abe8edeface9206e13ee Author: KaFai Wan Date: Tue Apr 21 23:58:03 2026 +0800 selftests/bpf: Test TCP_NODELAY in TCP hdr opt callbacks Add a sockops selftest for the TCP_NODELAY restriction in BPF_SOCK_OPS_HDR_OPT_LEN_CB and BPF_SOCK_OPS_WRITE_HDR_OPT_CB. With BPF_SOCK_OPS_WRITE_HDR_OPT_CB_FLAG enabled, bpf_setsockopt(TCP_NODELAY) returns -EOPNOTSUPP from BPF_SOCK_OPS_HDR_OPT_LEN_CB and BPF_SOCK_OPS_WRITE_HDR_OPT_CB, avoiding unbounded recursion and kernel stack overflow. Other cases continue to work as before, including BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB. Signed-off-by: KaFai Wan Signed-off-by: Martin KaFai Lau Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260421155804.135786-4-kafai.wan@linux.dev commit 54377fcab51f6f1f8807827d3751be42279e1a6a Author: KaFai Wan Date: Tue Apr 21 23:58:02 2026 +0800 bpf: Reject TCP_NODELAY in bpf-tcp-cc A BPF TCP congestion control program can call bpf_setsockopt() from its callbacks. In current kernels, if it calls bpf_setsockopt(TCP_NODELAY) from cwnd_event_tx_start(), the call can re-enter the TCP transmit path before the outer tcp_transmit_skb() has completed and advanced the send head. This can re-trigger CA_EVENT_TX_START and lead to unbounded recursion: tcp_transmit_skb() -> tcp_event_data_sent() -> tcp_ca_event(sk, CA_EVENT_TX_START) -> cwnd_event_tx_start() -> bpf_setsockopt(TCP_NODELAY) -> tcp_push_pending_frames() -> tcp_write_xmit() -> tcp_transmit_skb() This leads to unbounded recursion and can overflow the kernel stack. Reject TCP_NODELAY with -EOPNOTSUPP for bpf-tcp-cc by introducing a dedicated setsockopt proto for BPF_PROG_TYPE_STRUCT_OPS TCP congestion control programs. To keep it simple, all tcp-cc ops is rejected for TCP_NODELAY. Fixes: 7e41df5dbba2 ("bpf: Add a few optnames to bpf_setsockopt") Suggested-by: Martin KaFai Lau Signed-off-by: KaFai Wan Signed-off-by: Martin KaFai Lau Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260421155804.135786-3-kafai.wan@linux.dev commit 846c76ecc02973b05ae909dd4248c11bfa277fc1 Author: KaFai Wan Date: Tue Apr 21 23:58:01 2026 +0800 bpf: Reject TCP_NODELAY in TCP header option callbacks A BPF_SOCK_OPS program can enable BPF_SOCK_OPS_WRITE_HDR_OPT_CB_FLAG and then call bpf_setsockopt(TCP_NODELAY) from BPF_SOCK_OPS_HDR_OPT_LEN_CB or BPF_SOCK_OPS_WRITE_HDR_OPT_CB. In these callbacks, bpf_setsockopt(TCP_NODELAY) can reach __tcp_sock_set_nodelay(), which can call tcp_push_pending_frames(). >From BPF_SOCK_OPS_HDR_OPT_LEN_CB, tcp_push_pending_frames() can call tcp_current_mss(), which calls tcp_established_options() and re-enters bpf_skops_hdr_opt_len(). BPF_SOCK_OPS_HDR_OPT_LEN_CB -> bpf_setsockopt(TCP_NODELAY) -> tcp_push_pending_frames() -> tcp_current_mss() -> tcp_established_options() -> bpf_skops_hdr_opt_len() -> BPF_SOCK_OPS_HDR_OPT_LEN_CB >From BPF_SOCK_OPS_WRITE_HDR_OPT_CB, tcp_push_pending_frames() can call tcp_write_xmit(), which calls tcp_transmit_skb(). That path recomputes header option length through tcp_established_options() and bpf_skops_hdr_opt_len() before re-entering bpf_skops_write_hdr_opt(). BPF_SOCK_OPS_WRITE_HDR_OPT_CB -> bpf_setsockopt(TCP_NODELAY) -> tcp_push_pending_frames() -> tcp_write_xmit() -> tcp_transmit_skb() -> tcp_established_options() -> bpf_skops_hdr_opt_len() -> bpf_skops_write_hdr_opt() -> BPF_SOCK_OPS_WRITE_HDR_OPT_CB This leads to unbounded recursion and can overflow the kernel stack. Reject TCP_NODELAY with -EOPNOTSUPP in bpf_sock_ops_setsockopt() when bpf_setsockopt() is called from BPF_SOCK_OPS_HDR_OPT_LEN_CB or BPF_SOCK_OPS_WRITE_HDR_OPT_CB. Fixes: 7e41df5dbba2 ("bpf: Add a few optnames to bpf_setsockopt") Closes: https://lore.kernel.org/bpf/d1d523c9-6901-4454-a183-94462b8f3e4e@std.uestc.edu.cn/ Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn> Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Signed-off-by: KaFai Wan Signed-off-by: Martin KaFai Lau Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260421155804.135786-2-kafai.wan@linux.dev commit 2a4c0c11c0193889446cdb6f1540cc2b9aff97dd Merge: 8fd12b03c7c888 8d7ea40011551c Author: Linus Torvalds Date: Wed Apr 22 11:13:45 2026 -0700 Merge tag 's390-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Add support for CONFIG_PAGE_TABLE_CHECK and enable it in debug_defconfig. s390 can only tell user from kernel PTEs via the mm, so mm_struct is now passed into pxx_user_accessible_page() callbacks - Expose the PCI function UID as an arch-specific slot attribute in sysfs so a function can be identified by its user-defined id while still in standby. Introduces a generic ARCH_PCI_SLOT_GROUPS hook in drivers/pci/slot.c - Refresh s390 PCI documentation to reflect current behavior and cover previously undocumented sysfs attributes - zcrypt device driver cleanup series: consistent field types, clearer variable naming, a kernel-doc warning fix, and a comment explaining the intentional synchronize_rcu() in pkey_handler_register() - Provide an s390 arch_raw_cpu_ptr() that avoids the detour via get_lowcore() using alternatives, shrinking defconfig by ~27 kB - Guard identity-base randomization with kaslr_enabled() so nokaslr keeps the identity mapping at 0 even with RANDOMIZE_IDENTITY_BASE=y - Build S390_MODULES_SANITY_TEST as a module only by requiring KUNIT && m, since built-in would not exercise module loading - Remove the permanently commented-out HMCDRV_DEV_CLASS create_class() code in the hmcdrv driver - Drop stale ident_map_size extern conflicting with asm/page.h * tag 's390-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Fix warning about wrong kernel doc comment PCI: s390: Expose the UID as an arch specific PCI slot attribute docs: s390/pci: Improve and update PCI documentation s390/pkey: Add comment about synchronize_rcu() to pkey base s390/hmcdrv: Remove commented out code s390/zcrypt: Slight rework on the agent_id field s390/zcrypt: Explicitly use a card variable in _zcrypt_send_cprb s390/zcrypt: Rework MKVP fields and handling s390/zcrypt: Make apfs a real unsigned int field s390/zcrypt: Rework domain processing within zcrypt device driver s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code s390/percpu: Provide arch_raw_cpu_ptr() s390: Enable page table check for debug_defconfig s390/pgtable: Add s390 support for page table check s390/pgtable: Use set_pmd_bit() to invalidate PMD entry mm/page_table_check: Pass mm_struct to pxx_user_accessible_page() s390/boot: Respect kaslr_enabled() for identity randomization s390/Kconfig: Make modules sanity test a module-only option s390/setup: Drop stale ident_map_size declaration commit 497ad4be355b70a6786dd9344710d98b14b92848 Author: Thorsten Blum Date: Sun Feb 22 22:40:38 2026 +0100 apparmor: Use sysfs_emit in param_get_{audit,mode} Replace sprintf() with sysfs_emit() in param_get_audit() and param_get_mode(). sysfs_emit() is preferred for formatting sysfs output because it provides safer bounds checking. Add terminating newlines as suggested by checkpatch. Signed-off-by: Thorsten Blum Signed-off-by: John Johansen commit e6a522c5b4803b8f5632d5ce8f27431a1ae73222 Author: Thorsten Blum Date: Wed Feb 4 23:07:35 2026 +0100 apparmor: Remove redundant if check in sk_peer_get_label Remove the redundant if check in sk_peer_get_label() and return ERR_PTR(-ENOPROTOOPT) directly. Signed-off-by: Thorsten Blum Signed-off-by: John Johansen commit 46401cc99c6237ba825cfd65ef023955ce2a6316 Author: Thorsten Blum Date: Sun Jan 25 22:00:15 2026 +0100 apparmor: Replace memcpy + NUL termination with kmemdup_nul in do_setattr Use kmemdup_nul() to copy 'value' instead of using memcpy() followed by a manual NUL termination. No functional changes. Reviewed-by: Serge Hallyn Signed-off-by: Thorsten Blum Signed-off-by: John Johansen commit 1cc4cdae2a3b7730d462d69e30f213fd2efe7807 Author: Keith Busch Date: Tue Apr 21 09:14:02 2026 -0700 nvme-pci: fix missed admin queue sq doorbell write We can batch admin commands submitted through io_uring_cmd passthrough, which means bd->last may be false and skips the doorbell write to aggregate multiple commands per write. If a subsequent command can't be dispatched for whatever reason, we have to provide the blk-mq ops' commit_rqs callback in order to ensure we properly update the doorbell. Fixes: 58e5bdeb9c2b ("nvme: enable uring-passthrough for admin commands") Reviewed-by: Christoph Hellwig Reviewed-by: Kanchan Joshi Signed-off-by: Keith Busch commit 5d10069e1a1691a0d8642e1fa65f4c1869210299 Author: Alistair Francis Date: Fri Apr 17 10:50:48 2026 +1000 nvme-auth: Include SC_C in RVAL controller hash Section 8.3.4.5.5 of the NVMe Base Specification 2.1 describes what is included in the Response Value (RVAL) hash and SC_C should be included. Currently we are hardcoding 0 instead of using the correct SC_C value. Update the host and target code to use the SC_C when calculating the RVAL instead of using 0. Fixes: e88a7595b57f2 ("nvme-tcp: request secure channel concatenation") Reviewed-by: Chris Leech Reviewed-by: Hannes Reinecke Signed-off-by: Alistair Francis Signed-off-by: Keith Busch commit 26bb12b9caafa2e62d638104bf2732f610cdbb0b Author: Chaitanya Kulkarni Date: Mon Apr 13 10:16:28 2026 -0700 nvme-tcp: teardown circular locking fixes When a controller reset is triggered via sysfs (by writing to /sys/class/nvme//reset_controller), the reset work tears down and re-establishes all queues. The socket release using fput() defers the actual cleanup to task_work delayed_fput workqueue. This deferred cleanup can race with the subsequent queue re-allocation during reset, potentially leading to use-after-free or resource conflicts. Replace fput() with __fput_sync() to ensure synchronous socket release, guaranteeing that all socket resources are fully cleaned up before the function returns. This prevents races during controller reset where new queue setup may begin before the old socket is fully released. * Call chain during reset: nvme_reset_ctrl_work() -> nvme_tcp_teardown_ctrl() -> nvme_tcp_teardown_io_queues() -> nvme_tcp_free_io_queues() -> nvme_tcp_free_queue() <-- fput() -> __fput_sync() -> nvme_tcp_teardown_admin_queue() -> nvme_tcp_free_admin_queue() -> nvme_tcp_free_queue() <-- fput() -> __fput_sync() -> nvme_tcp_setup_ctrl() <-- race with deferred fput memalloc_noreclaim_save() sets PF_MEMALLOC which is intended for tasks performing memory reclaim work that need reserve access. While PF_MEMALLOC prevents the task from entering direct reclaim (causing __need_reclaim() to return false), it does not strip __GFP_IO from gfp flags. The allocator can therefore still trigger writeback I/O when __GFP_IO remains set, which is unsafe when the caller holds block layer locks. Switch to memalloc_noio_save() which sets PF_MEMALLOC_NOIO. This causes current_gfp_context() to strip __GFP_IO|__GFP_FS from every allocation in the scope, making it safe to allocate memory while holding elevator_lock and set->srcu. * The issue can be reproduced using blktests: nvme_trtype=tcp ./check nvme/005 blktests (master) # nvme_trtype=tcp ./check nvme/005 nvme/005 (tr=tcp) (reset local loopback target) [failed] runtime 0.725s ... 0.798s something found in dmesg: [ 108.473940] run blktests nvme/005 at 2025-11-22 16:12:20 [...] ... (See '/root/blktests/results/nodev_tr_tcp/nvme/005.dmesg' for the entire message) blktests (master) # cat /root/blktests/results/nodev_tr_tcp/nvme/005.dmesg [ 108.473940] run blktests nvme/005 at 2025-11-22 16:12:20 [ 108.526983] loop0: detected capacity change from 0 to 2097152 [ 108.555606] nvmet: adding nsid 1 to subsystem blktests-subsystem-1 [ 108.572531] nvmet_tcp: enabling port 0 (127.0.0.1:4420) [ 108.613061] nvmet: Created nvm controller 1 for subsystem blktests-subsystem-1 for NQN nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349. [ 108.616832] nvme nvme0: creating 48 I/O queues. [ 108.630791] nvme nvme0: mapped 48/0/0 default/read/poll queues. [ 108.661892] nvme nvme0: new ctrl: NQN "blktests-subsystem-1", addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349 [ 108.746639] nvmet: Created nvm controller 2 for subsystem blktests-subsystem-1 for NQN nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349. [ 108.748466] nvme nvme0: creating 48 I/O queues. [ 108.802984] nvme nvme0: mapped 48/0/0 default/read/poll queues. [ 108.829983] nvme nvme0: Removing ctrl: NQN "blktests-subsystem-1" [ 108.854288] block nvme0n1: no available path - failing I/O [ 108.854344] block nvme0n1: no available path - failing I/O [ 108.854373] Buffer I/O error on dev nvme0n1, logical block 1, async page read [ 108.891693] ====================================================== [ 108.895912] WARNING: possible circular locking dependency detected [ 108.900184] 6.17.0nvme+ #3 Tainted: G N [ 108.903913] ------------------------------------------------------ [ 108.908171] nvme/2734 is trying to acquire lock: [ 108.911957] ffff88810210e610 (set->srcu){.+.+}-{0:0}, at: __synchronize_srcu+0x17/0x170 [ 108.917587] but task is already holding lock: [ 108.921570] ffff88813abea198 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0xa8/0x1c0 [ 108.927361] which lock already depends on the new lock. [ 108.933018] the existing dependency chain (in reverse order) is: [ 108.938223] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 108.942988] __mutex_lock+0xa2/0x1150 [ 108.945873] elevator_change+0xa8/0x1c0 [ 108.948925] elv_iosched_store+0xdf/0x140 [ 108.952043] kernfs_fop_write_iter+0x16a/0x220 [ 108.955367] vfs_write+0x378/0x520 [ 108.957598] ksys_write+0x67/0xe0 [ 108.959721] do_syscall_64+0x76/0xbb0 [ 108.962052] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 108.965145] -> #3 (&q->q_usage_counter(io)){++++}-{0:0}: [ 108.968923] blk_alloc_queue+0x30e/0x350 [ 108.972117] blk_mq_alloc_queue+0x61/0xd0 [ 108.974677] scsi_alloc_sdev+0x2a0/0x3e0 [ 108.977092] scsi_probe_and_add_lun+0x1bd/0x430 [ 108.979921] __scsi_add_device+0x109/0x120 [ 108.982504] ata_scsi_scan_host+0x97/0x1c0 [ 108.984365] async_run_entry_fn+0x2d/0x130 [ 108.986109] process_one_work+0x20e/0x630 [ 108.987830] worker_thread+0x184/0x330 [ 108.989473] kthread+0x10a/0x250 [ 108.990852] ret_from_fork+0x297/0x300 [ 108.992491] ret_from_fork_asm+0x1a/0x30 [ 108.994159] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 108.996320] fs_reclaim_acquire+0x99/0xd0 [ 108.998058] kmem_cache_alloc_node_noprof+0x4e/0x3c0 [ 109.000123] __alloc_skb+0x15f/0x190 [ 109.002195] tcp_send_active_reset+0x3f/0x1e0 [ 109.004038] tcp_disconnect+0x50b/0x720 [ 109.005695] __tcp_close+0x2b8/0x4b0 [ 109.007227] tcp_close+0x20/0x80 [ 109.008663] inet_release+0x31/0x60 [ 109.010175] __sock_release+0x3a/0xc0 [ 109.011778] sock_close+0x14/0x20 [ 109.013263] __fput+0xee/0x2c0 [ 109.014673] delayed_fput+0x31/0x50 [ 109.016183] process_one_work+0x20e/0x630 [ 109.017897] worker_thread+0x184/0x330 [ 109.019543] kthread+0x10a/0x250 [ 109.020929] ret_from_fork+0x297/0x300 [ 109.022565] ret_from_fork_asm+0x1a/0x30 [ 109.024194] -> #1 (sk_lock-AF_INET-NVME){+.+.}-{0:0}: [ 109.026634] lock_sock_nested+0x2e/0x70 [ 109.028251] tcp_sendmsg+0x1a/0x40 [ 109.029783] sock_sendmsg+0xed/0x110 [ 109.031321] nvme_tcp_try_send_cmd_pdu+0x13e/0x260 [nvme_tcp] [ 109.034263] nvme_tcp_try_send+0xb3/0x330 [nvme_tcp] [ 109.036375] nvme_tcp_queue_rq+0x342/0x3d0 [nvme_tcp] [ 109.038528] blk_mq_dispatch_rq_list+0x297/0x800 [ 109.040448] __blk_mq_sched_dispatch_requests+0x3db/0x5f0 [ 109.042677] blk_mq_sched_dispatch_requests+0x29/0x70 [ 109.044787] blk_mq_run_work_fn+0x76/0x1b0 [ 109.046535] process_one_work+0x20e/0x630 [ 109.048245] worker_thread+0x184/0x330 [ 109.049890] kthread+0x10a/0x250 [ 109.051331] ret_from_fork+0x297/0x300 [ 109.053024] ret_from_fork_asm+0x1a/0x30 [ 109.054740] -> #0 (set->srcu){.+.+}-{0:0}: [ 109.056850] __lock_acquire+0x1468/0x2210 [ 109.058614] lock_sync+0xa5/0x110 [ 109.060048] __synchronize_srcu+0x49/0x170 [ 109.061802] elevator_switch+0xc9/0x330 [ 109.063950] elevator_change+0x128/0x1c0 [ 109.065675] elevator_set_none+0x4c/0x90 [ 109.067316] blk_unregister_queue+0xa8/0x110 [ 109.069165] __del_gendisk+0x14e/0x3c0 [ 109.070824] del_gendisk+0x75/0xa0 [ 109.072328] nvme_ns_remove+0xf2/0x230 [nvme_core] [ 109.074365] nvme_remove_namespaces+0xf2/0x150 [nvme_core] [ 109.076652] nvme_do_delete_ctrl+0x71/0x90 [nvme_core] [ 109.078775] nvme_delete_ctrl_sync+0x3b/0x50 [nvme_core] [ 109.081009] nvme_sysfs_delete+0x34/0x40 [nvme_core] [ 109.083082] kernfs_fop_write_iter+0x16a/0x220 [ 109.085009] vfs_write+0x378/0x520 [ 109.086539] ksys_write+0x67/0xe0 [ 109.087982] do_syscall_64+0x76/0xbb0 [ 109.089577] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 109.091665] other info that might help us debug this: [ 109.095478] Chain exists of: set->srcu --> &q->q_usage_counter(io) --> &q->elevator_lock [ 109.099544] Possible unsafe locking scenario: [ 109.101708] CPU0 CPU1 [ 109.103402] ---- ---- [ 109.105103] lock(&q->elevator_lock); [ 109.106530] lock(&q->q_usage_counter(io)); [ 109.109022] lock(&q->elevator_lock); [ 109.111391] sync(set->srcu); [ 109.112586] *** DEADLOCK *** [ 109.114772] 5 locks held by nvme/2734: [ 109.116189] #0: ffff888101925410 (sb_writers#4){.+.+}-{0:0}, at: ksys_write+0x67/0xe0 [ 109.119143] #1: ffff88817a914e88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x10f/0x220 [ 109.123141] #2: ffff8881046313f8 (kn->active#185){++++}-{0:0}, at: sysfs_remove_file_self+0x26/0x50 [ 109.126543] #3: ffff88810470e1d0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: del_gendisk+0x6d/0xa0 [ 109.129891] #4: ffff88813abea198 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0xa8/0x1c0 [ 109.133149] stack backtrace: [ 109.134817] CPU: 6 UID: 0 PID: 2734 Comm: nvme Tainted: G N 6.17.0nvme+ #3 PREEMPT(voluntary) [ 109.134819] Tainted: [N]=TEST [ 109.134820] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 109.134821] Call Trace: [ 109.134823] [ 109.134824] dump_stack_lvl+0x75/0xb0 [ 109.134828] print_circular_bug+0x26a/0x330 [ 109.134831] check_noncircular+0x12f/0x150 [ 109.134834] __lock_acquire+0x1468/0x2210 [ 109.134837] ? __synchronize_srcu+0x17/0x170 [ 109.134838] lock_sync+0xa5/0x110 [ 109.134840] ? __synchronize_srcu+0x17/0x170 [ 109.134842] __synchronize_srcu+0x49/0x170 [ 109.134843] ? mark_held_locks+0x49/0x80 [ 109.134845] ? _raw_spin_unlock_irqrestore+0x2d/0x60 [ 109.134847] ? kvm_clock_get_cycles+0x14/0x30 [ 109.134853] ? ktime_get_mono_fast_ns+0x36/0xb0 [ 109.134858] elevator_switch+0xc9/0x330 [ 109.134860] elevator_change+0x128/0x1c0 [ 109.134862] ? kernfs_put.part.0+0x86/0x290 [ 109.134864] elevator_set_none+0x4c/0x90 [ 109.134866] blk_unregister_queue+0xa8/0x110 [ 109.134868] __del_gendisk+0x14e/0x3c0 [ 109.134870] del_gendisk+0x75/0xa0 [ 109.134872] nvme_ns_remove+0xf2/0x230 [nvme_core] [ 109.134879] nvme_remove_namespaces+0xf2/0x150 [nvme_core] [ 109.134887] nvme_do_delete_ctrl+0x71/0x90 [nvme_core] [ 109.134893] nvme_delete_ctrl_sync+0x3b/0x50 [nvme_core] [ 109.134899] nvme_sysfs_delete+0x34/0x40 [nvme_core] [ 109.134905] kernfs_fop_write_iter+0x16a/0x220 [ 109.134908] vfs_write+0x378/0x520 [ 109.134911] ksys_write+0x67/0xe0 [ 109.134913] do_syscall_64+0x76/0xbb0 [ 109.134915] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 109.134916] RIP: 0033:0x7fd68a737317 [ 109.134917] Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 [ 109.134919] RSP: 002b:00007ffded1546d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 109.134920] RAX: ffffffffffffffda RBX: 000000000054f7e0 RCX: 00007fd68a737317 [ 109.134921] RDX: 0000000000000001 RSI: 00007fd68a855719 RDI: 0000000000000003 [ 109.134921] RBP: 0000000000000003 R08: 0000000030407850 R09: 00007fd68a7cd4e0 [ 109.134922] R10: 00007fd68a65b130 R11: 0000000000000246 R12: 00007fd68a855719 [ 109.134923] R13: 00000000304074c0 R14: 00000000304074c0 R15: 0000000030408660 [ 109.134926] [ 109.962756] Key type psk unregistered Reviewed-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Hannes Reinecke Signed-off-by: Chaitanya Kulkarni Signed-off-by: Keith Busch commit 5fc422951c962cc01e654950fc043ebd8fadd865 Author: Alistair Francis Date: Fri Apr 17 10:48:09 2026 +1000 nvmet-tcp: Don't clear tls_key when freeing sq Curently after the host sends a REPLACETLSPSK we free the TLS keys as part of calling nvmet_auth_sq_free() on success. This means when the host sends a follow up REPLACETLSPSK we return CONCAT_MISMATCH as the check for !nvmet_queue_tls_keyid(req->sq) fails. A previous attempt to fix this involed not calling nvmet_auth_sq_free() on successful connections, but that results in memory leaks. Instead we should not clear `tls_key` in nvmet_auth_sq_free(), as that was incorrectly wiping the tls keys which are used for the session. This patch ensures we correctly free the ephemeral session key on connection, yet we don't free the TLS key unless closing the connection. Reviewed-by: Chris Leech Reviewed-by: Hannes Reinecke Signed-off-by: Alistair Francis Signed-off-by: Keith Busch commit f920ebd03cd13eb0976d18de77adf325b5461361 Author: Alistair Francis Date: Fri Apr 17 10:48:08 2026 +1000 Revert "nvmet-tcp: Don't free SQ on authentication success" In an attempt to fix REPLACETLSPSK we stopped freeing the secrets on successful connections. This resulted in memory leaks in the kernel, so let's revert the commit. A improved fix is being developed to just avoid clearing the tls_key variable. This reverts commit 2e6eb6b277f593b98f151ea8eff1beb558bbea3b. Closes: https://lore.kernel.org/linux-nvme/CAHj4cs-u3MWQR4idywptMfjEYi4YwObWFx4KVib35dZ5HMBDdw@mail.gmail.com Reviewed-by: Chris Leech Reviewed-by: Hannes Reinecke Signed-off-by: Alistair Francis Signed-off-by: Keith Busch commit bddb911d28d4412a9462e73766a706ff0d74fa77 Author: Keith Busch Date: Mon Apr 20 09:02:28 2026 -0700 nvme: skip trace completion for host path errors The command was never dispatched for the driver's "host path error", so the command was never actually initialized and there's no corresponding submit trace for the completion. Reported-by: Minsik Jeon Signed-off-by: Keith Busch commit 8fd12b03c7c888303c3c45559d8c3e270a916f9f Merge: beaba8bfbb91e3 5170a82e89211d Author: Linus Torvalds Date: Wed Apr 22 09:50:46 2026 -0700 Merge tag 'hyperv-next-signed-20260421' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V updates from Wei Liu: - Fix cross-compilation for hv tools (Aditya Garg) - Fix vmemmap_shift exceeding MAX_FOLIO_ORDER in mshv_vtl (Naman Jain) - Limit channel interrupt scan to relid high water mark (Michael Kelley) - Export hv_vmbus_exists() and use it in pci-hyperv (Dexuan Cui) - Fix cleanup and shutdown issues for MSHV (Jork Loeser) - Introduce more tracing support for MSHV (Stanislav Kinsburskii) * tag 'hyperv-next-signed-20260421' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: x86/hyperv: Skip LP/VP creation on kexec x86/hyperv: move stimer cleanup to hv_machine_shutdown() Drivers: hv: vmbus: fix hyperv_cpuhp_online variable shadowing mshv: Add tracepoint for GPA intercept handling mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER tools: hv: Fix cross-compilation Drivers: hv: vmbus: Export hv_vmbus_exists() and use it in pci-hyperv mshv: Introduce tracing support Drivers: hv: vmbus: Limit channel interrupt scan to relid high water mark commit a9224f26b754b5034719248891ff3c2ea0d11144 Author: Cássio Gabriel Date: Tue Apr 21 22:07:41 2026 -0300 ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch snd_microii_spdif_switch_put() returns 0 when the requested vendor register value differs from the cached one. This comparison was inverted by the resume-support conversion, so real SPDIF switch toggles are ignored while no-op writes still issue SET_CUR and report success. Return early only when the requested value matches the cached one. Fixes: 288673beae6c ("ALSA: usb-audio: Add resume support for MicroII SPDIF ctls") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260421-microii-spdif-switch-fix-v1-1-5c50dc28b88f@gmail.com Signed-off-by: Takashi Iwai commit fca9c850042a7ab4828ce3a9caa8bc40ea09856a Author: Cássio Gabriel Date: Tue Apr 21 21:53:52 2026 -0300 ALSA: usb-audio: Avoid false E-MU sample-rate notifications snd_emuusb_set_samplerate() unconditionally notifies the E-MU SampleRate Extension Unit control after issuing SET_CUR. If snd_usb_mixer_set_ctl_value() fails, the control value has not changed, yet snd_usb_mixer_notify_id() still invalidates the cache and emits a value-change event to userspace. Notify the control only after a successful write. Fixes: 7d2b451e65d2 ("ALSA: usb-audio - Added functionality for E-mu 0404USB/0202USB/TrackerPre") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260421-alsa-emuusb-samplerate-notify-v1-1-8b63bbc1d7f1@gmail.com Signed-off-by: Takashi Iwai commit b488997b9cb006e175908b70fc0a2f3601a763d1 Author: Len Brown Date: Tue Apr 21 18:39:20 2026 -0400 tools/power turbostat: v2026.04.21 Since v2026.02.14 Display HT siblings in cpu# order. Add Module-ID column. Print Core-ID and APIC-ID in hex. Fix misc bugs. Signed-off-by: Len Brown commit 58839fdbd441dc079800f2575013f2c438159d5a Author: Len Brown Date: Wed Apr 22 11:13:00 2026 -0400 tools/power turbostat: Process HT siblings in CPU order On large systems with HT sibling cpu#'s more than 32 apart, HT siblings were processed and displayed in reverse order. This was due to how set_thread_siblings() parsed the sibling-bit-mask. Update set_thread_siblings to instead parse the sibling-list, like other cpu lists, and to thus order HT siblings by ascending CPU number, no matter the size of the system. Signed-off-by: Len Brown commit aea40f1e2d77a5581539d1ec6366c7dc7566321d Author: Len Brown Date: Tue Apr 21 18:36:31 2026 -0400 tools/power turbostat: Show module_id column Get the "module_id" from the Linux topology "cluster_id". If the there is more than one id, show it by default. Module joins Die etc. in the "topology" group. Display in hex, as it is usually based mask of the APIC-id Signed-off-by: Len Brown commit da828b6cafc103119b971290d44db5f33af7924e Author: Len Brown Date: Tue Mar 24 19:31:50 2026 -0400 tools/power turbostat: Print core_id and apic_id in hex The core_id is based on a mask of the apic_id. Print them both in hex, rather than decimal, to make this relationship visibly clear. Signed-off-by: Len Brown commit 092b76a3253fdd476e6d0626a094bf7b632f8eef Author: Artem Bityutskiy Date: Wed Mar 11 11:00:35 2026 +0200 tools/power turbostat: Cleanup print helper functions Make printer helper functions more readable by factoring out a local 'sep' variable. Remove the redundant parentheses around sprintf() calls. Remove an unnecessary cast to "unsigned int" by using the '%08llx' instead of '%08x'. No functional changes. [lenb: fix typos, simplify] Signed-off-by: Artem Bityutskiy Signed-off-by: Len Brown commit 08e11edd0e63b72651ed5eb9142430d1ca764923 Author: Len Brown Date: Tue Apr 21 18:35:15 2026 -0400 tools/power turbostat: Fix --cpu-set 1 regression on HT systems When the "--cpu-set" option limits turbostat to run on a higher numbered HT sibling, it exits upon dividing by zero. This is because the HT support handles higher numbered siblings at the same time as lower numbered siblings. But when that lower number sibling is dis-allowed, the higher numbered sibling is never processed. The result is a time delta of 0, which results in a divide by 0 for any of the "per-second" metrics. Enhance the HT enumeration code to record all siblings (up to SMT4). Consult this complete HT sibling list to determine when to process an HT sibling, and when to skip it. Fixes: a2b4d0f8bf07 ("tools/power turbostat: Favor cpu# over core#") Signed-off-by: Len Brown commit 2c52f942fcf21c8e09c7dac669fca591cec2692b Author: Len Brown Date: Thu Apr 16 16:17:31 2026 -0400 tools/power turbostat: Fix --cpu-set 0 regression on HT systems "turbostat --cpu-set 0" appears to hang if cpu0 has an HT sibling. This is because the initialization code recognizes that it does not have to open perf files for the HT sibling, but the HT support in the collection code sees the HT sibling and tries to read from an uninitialized file descriptor, 0 (standard input). Access HT siblings only when they are in the allowed set. Fixes: a2b4d0f8bf07 ("tools/power turbostat: Favor cpu# over core#") Signed-off-by: Len Brown Reported-by: Artem Bityutskiy commit ce012c966b518c53475ba9a4e979242d7322d819 Author: David Arcari Date: Tue Apr 21 10:32:17 2026 -0400 tools/power turbostat: Fix unrecognized option '-P' The '-P' short option (shorthand for --no-perf) is not present in the optstring of the second call to getopt_long_only(). This results in the "unrecognized option" error when the tool reaches the main parsing loop. Add 'P' to the second getopt_long_only() call to ensure it is consistently recognized. Fixes: a0e86c90b83c ("tools/power turbostat: Add --no-perf option") Signed-off-by: David Arcari Signed-off-by: Len Brown commit 5335e318ad3cf12d905de27e3be4e7fd7b1c6746 Author: Paolo Bonzini Date: Tue Apr 21 11:04:55 2026 +0100 tracing: Make undefsyms_base.c a first-class citizen Linus points out that dumping undefsyms_base.c form the Makefile is rather ugly, and that a much better course of action would be to have this file as a first-class citizen in the git tree. This allows some extra cleanup in the Makefile, and the removal of the .gitignore file in kernel/trace. Cc: Marc Zyngier Cc: Arnd Bergmann Link: https://lore.kernel.org/r/CAHk-=wieqGd_XKpu8UxDoyADZx8TDe8CF3RmkUXt5N_9t5Pf_w@mail.gmail.com Link: https://lore.kernel.org/all/20260421095446.2951646-1-maz@kernel.org/ Link: https://patch.msgid.link/20260421100455.324333-1-pbonzini@redhat.com Reported-by: Linus Torvalds Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Signed-off-by: Paolo Bonzini Signed-off-by: Steven Rostedt commit 55d41b0a20128e86b9e960dd2e3f0a2d69a18df7 Author: Michael Bommarito Date: Mon Apr 13 17:12:40 2026 -0400 udf: reject descriptors with oversized CRC length udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, which is trivially recomputable. Reject such descriptors instead of silently accepting them. A legitimate single-block descriptor should never have a CRC length that exceeds the block. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260413211240.853662-1-michael.bommarito@gmail.com Signed-off-by: Jan Kara commit 448aaf54d3ae1b73dfcf723c9f8a02c2116f3358 Author: Hardik Phalet Date: Tue Mar 10 12:30:27 2026 +0000 fbdev: hgafb: Request memory region before ioremap The driver calls ioremap() on the HGA video memory at 0xb0000 without first reserving the physical address range. This leaves the kernel resource tree incomplete and can cause silent conflicts with other drivers claiming the same range. Add a devm_request_mem_region() call before ioremap() in hga_card_detect() to reserve the memory region. Signed-off-by: Hardik Phalet Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 87a3f5c8ac2096e9406ce2ed3bf5b9bc1589a92d Author: Maciej Strozek Date: Mon Apr 20 12:48:17 2026 +0100 ASoC: sdw_utils: cs42l43: allow spk component names to be combined Move handling of cs42l43-spk component string into SOF mechanism [1] which will allow it to be aggregated with other speakers. Likewise handle the cs35l56-bridge special case which should not be combined to keep compatibility with UCM. Link: https://github.com/thesofproject/linux/pull/5445 [1] Link: https://github.com/alsa-project/alsa-ucm-conf/pull/747 Reviewed-by: Bard Liao Signed-off-by: Maciej Strozek Suggested-by: Aaron Ma Tested-by: Aaron Ma Link: https://patch.msgid.link/20260420114823.194226-1-mstrozek@opensource.cirrus.com Signed-off-by: Mark Brown commit a83307f34e0bd9b0e595b1074dc8fbcc1b7f3172 Author: Eric Biggers Date: Sat Apr 18 15:13:11 2026 -0700 smb: client: Drop 'allocate_crypto' arg from smb*_calc_signature() Since the crypto library API is now being used instead of crypto_shash, all structs for MAC computation are now just fixed-size structs allocated on the stack; no dynamic allocations are ever required. Besides being much more efficient, this also means that the 'allocate_crypto' argument to smb2_calc_signature() and smb3_calc_signature() is no longer used. Remove this unused argument. Acked-by: Steve French Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit dd1c537beca3b60a66783377fd03d60a5a409efe Author: Eric Biggers Date: Sat Apr 18 15:13:10 2026 -0700 smb: client: Make generate_key() return void Since the crypto library API is now being used instead of crypto_shash, generate_key() can no longer fail. Make it return void and simplify the callers accordingly. Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 4c1c07820a0e4d82076be254814ff84ce0aae212 Author: Eric Biggers Date: Sat Apr 18 15:13:09 2026 -0700 smb: client: Remove obsolete cmac(aes) allocation Since the crypto library API is now being used instead of crypto_shash, the "cmac(aes)" crypto_shash that is being allocated and stored in 'struct cifs_secmech' is no longer used. Remove it. That makes the kconfig selection of CRYPTO_CMAC and the module softdep on "cmac" unnecessary. So remove those too. Finally, since this removes the last use of crypto_shash from the smb client, also remove the remaining crypto_shash-related helper functions. Note: cifs_unicode.c was relying on being included transitively via . Since the latter include is removed, make cifs_unicode.c include explicitly. Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 3a4580e71371dc5d323ac1fb4af80316838aca14 Author: Eric Biggers Date: Sat Apr 18 15:13:08 2026 -0700 smb: client: Use AES-CMAC library for SMB3 signature calculation Convert smb3_calc_signature() to use the AES-CMAC library instead of a "cmac(aes)" crypto_shash. The result is simpler and faster code. With the library there's no need to allocate memory, no need to handle errors except for key preparation, and the AES-CMAC code is accessed directly without inefficient indirect calls and other unnecessary API overhead. For now a "cmac(aes)" crypto_shash is still being allocated in 'struct cifs_secmech'. Later commits will remove that, simplifying the code even further. Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 44ccf4162adc8a33520112be598a6fba5b318e51 Author: Enzo Matsumiya Date: Mon Apr 13 16:07:13 2026 -0300 smb: common: add SMB3_COMPRESS_MAX_ALGS Set it to number of currently defined algorithms (6 as of now). Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 71179a5ee916d6168bdf71e3533f71c36e5ab32c Author: Enzo Matsumiya Date: Mon Apr 13 16:07:11 2026 -0300 smb: client: compress: add code docs to lz77.c Document parts of the code, especially the apparently non-sense parts. Other: - change pointer increment constants to sizeof() values Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 4460e9c68d1a8d1bd5b892c01f10f2cd06b1fd8b Author: Enzo Matsumiya Date: Mon Apr 13 16:07:10 2026 -0300 smb: client: compress: LZ77 optimizations This patch implements several micro-optimizations on lz77_compress() with the goal of reducing the number of instructions per [input] byte (a.k.a. IPB). Changes: - change hashtable to be u32 (instead of u64) -- change the hash function to reflect that (adds lz77_hash() and lz77_read32() helpers) - batch-write literals instead of 1 by 1 -- now that we have a well defined hot path (match finding) and a cold path (encode literals + match), batch writing makes a significant difference - implement adaptive skipping of input bytes -- skip input bytes more aggressively if too few matches are being found - name some constants for more meaningful context Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit fca46b0e68c5d4f37c1dffb854ab125f702fa9e9 Author: Enzo Matsumiya Date: Mon Apr 13 16:07:09 2026 -0300 smb: client: compress: increase LZ77_MATCH_MAX_DIST Increase max distance (i.e. window size) from 1k to 8k. This allows better compression and is just as fast. Other: - drop LZ77_MATCH_MIN_DIST as it's nused -- main loop already checks if dist > 0 Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 20d4f9efe008be1b673f43d38d3d99fb1fd4cd68 Author: Enzo Matsumiya Date: Mon Apr 13 16:07:08 2026 -0300 smb: client: compress: fix counting in LZ77 match finding - lz77_match_len() increments @cur before checking for equality, leading to off-by-one match len in some cases. Fix by moving pointers increment to inside the loop. Also rename @wnd arg to @match (more accurate name). - both lz77_match_len() and lz77_compress() checked for "buf + step < end" when the correct is "<=" for such cases. Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 4c221711b23745e2fb961ee517e9ed96ce76f9cb Author: Enzo Matsumiya Date: Mon Apr 13 16:07:06 2026 -0300 smb: client: compress: fix buffer overrun in lz77_compress() @dst buffer is allocated with same size as @src, which, for good compression cases, works fine. However, when compression goes bad (e.g. random bytes payloads), the compressed size can increase significantly, and even by stopping the main loop at 7/8 of @slen, writing leftover literals could write past the end of @dst because of LZ77 metadata. To fix this, add lz77_compressed_alloc_size() helper to compute the correct allocation size for @dst, accounting for metadata and worst cast scenario (all literals). While this is overprovisioning memory, it's not only correct, but also allows lz77_compress() main loop to run without ever checking @dst limits (i.e. a perf improvement). Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit a55a60886e612bedb0e9a402ba0dca544c4c6a51 Author: Michael Bommarito Date: Tue Apr 21 19:40:22 2026 -0400 smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl After validate_dacl() was factored out in commit 149822e5541c, the local end_of_dacl in parse_dacl() is only read by the dump_ace() call under #ifdef CONFIG_CIFS_DEBUG2. With CIFS_DEBUG2 off the variable is assigned but never used, which gcc -W=1 flags as -Wunused-but-set-variable. Remove the local and compute the end-of-dacl pointer inline at the single call site inside the existing CIFS_DEBUG2 guard. No functional change: when CIFS_DEBUG2 is enabled the argument value is identical to what the removed local carried; when CIFS_DEBUG2 is disabled the code was already dead. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604220046.tGkRxVtS-lkp@intel.com/ Fixes: 149822e5541c ("smb: client: validate the whole DACL before rewriting it in cifsacl") Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Steve French commit 17d912d54f23058b0d21ccf85e785b9601dc6959 Author: Enzo Matsumiya Date: Wed Apr 22 09:31:49 2026 +0200 smb: client: fix (remove) drop_dir_cache module parameter Being a module parameter, it's possible to do: # modprobe cifs drop_dir_cache=1 Which will lead to a crash, because cifs_tcp_ses_list hasn't been initialized yet: [ 168.242624] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 168.242952] #PF: supervisor read access in kernel mode [ 168.243175] #PF: error_code(0x0000) - not-present page [ 168.243394] PGD 0 P4D 0 [ 168.243524] Oops: Oops: 0000 [#1] SMP NOPTI [ 168.243703] CPU: 2 UID: 0 PID: 1105 Comm: modprobe Not tainted 7.0.0-lku #5 PREEMPT(lazy) [ 168.244054] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-2-g4f253b9b-prebuilt.qemu.org 04/01/2014 [ 168.244557] RIP: 0010:cifs_param_set_drop_dir_cache+0x7c/0x100 [cifs] ... [ 168.248785] Call Trace: [ 168.248915] [ 168.249023] parse_args+0x285/0x3a0 [ 168.249204] ? __pfx_unknown_module_param_cb+0x10/0x10 [ 168.249448] load_module+0x192b/0x1bb0 [ 168.249637] ? __pfx_unknown_module_param_cb+0x10/0x10 [ 168.249882] ? kernel_read_file+0x27d/0x2b0 [ 168.250088] init_module_from_file+0xce/0xf0 [ 168.250291] idempotent_init_module+0xfb/0x2f0 [ 168.250496] __x64_sys_finit_module+0x5a/0xa0 [ 168.250694] do_syscall_64+0xe0/0x5a0 [ 168.250863] ? exc_page_fault+0x65/0x160 [ 168.251050] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.251284] RIP: 0033:0x7fcaa12b774d Instead of fixing this with some kind of "is module initialized" approach, this patch instead moves that functionality to procfs, setting a write op for the existing open_dirs entry, where writing a 0 to it will drop the cached directory entries. Also make it available only when CONFIG_CIFS_DEBUG=y. A small change needed now is to not call flush_delayed_work() on invalidate_all_cached_dirs() when called from procfs (can't sleep in that context). So add a @sync arg to invalidate_all_cached_dirs() to control when to flush the delayed works. Fixes: dde6667fa3c8 ("smb: client: add drop_dir_cache module parameter to invalidate cached dirents") Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 2757ad3e4b6f9e0fed4c7739594e702abc5cab21 Author: Michael Bommarito Date: Mon Apr 20 09:50:58 2026 -0400 smb: client: require a full NFS mode SID before reading mode bits parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS mode SID and reads sid.sub_auth[2] to recover the mode bits. That assumes the ACE carries three subauthorities, but compare_sids() only compares min(a, b) subauthorities. A malicious server can return an ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still matches sid_unix_NFS_mode and then drives the sub_auth[2] read four bytes past the end of the ACE. Require num_subauth >= 3 before treating the ACE as an NFS mode SID. This keeps the fix local to the special-SID mode path without changing compare_sids() semantics for the rest of cifsacl. Fixes: e2f8fbfb8d09 ("cifs: get mode bits from special sid on stat") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Michael Bommarito Signed-off-by: Steve French commit 0a8cf165566ba55a39fd0f4de172119dd646d39a Author: Michael Bommarito Date: Sun Apr 19 20:11:31 2026 -0400 smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor. The original fix only checked that the struct smb_acl header fits before reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate header-field OOB read, but the rewrite helpers still walk ACEs based on pdacl->num_aces with no structural validation of the incoming DACL body. A malicious server can return a truncated DACL that still contains a header, claims one or more ACEs, and then drive replace_sids_and_copy_aces() or set_chmod_dacl() past the validated extent while they compare or copy attacker-controlled ACEs. Factor the DACL structural checks into validate_dacl(), extend them to validate each ACE against the DACL bounds, and use the shared validator before the chmod/chown rebuild paths. parse_dacl() reuses the same validator so the read-side parser and write-side rewrite paths agree on what constitutes a well-formed incoming DACL. Fixes: bc3e9dd9d104 ("cifs: Change SIDs in ACEs while transferring file ownership.") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Signed-off-by: Steve French commit a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e Author: Michael Bommarito Date: Sun Apr 19 19:35:19 2026 -0400 smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL and the default QUERY_INFO path. The QUERY_INFO branch clamps qi.input_buffer_length to the server-reported OutputBufferLength and then copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but it never verifies that the flexible-array payload actually fits within rsp_iov[1].iov_len. A malicious server can return OutputBufferLength larger than the actual QUERY_INFO response, causing copy_to_user() to walk past the response buffer and expose adjacent kernel heap to userspace. Guard the QUERY_INFO copy with a bounds check on the actual Buffer payload. Use struct_size(qi_rsp, Buffer, qi.input_buffer_length) rather than an open-coded addition so the guard cannot overflow on 32-bit builds. Fixes: f5778c398713 ("SMB3: Allow SMB3 FSCTL queries to be sent to server from tools") Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Steve French commit a40c0e815962b1f691d7ea12f7ddd42063c49f08 Author: Amit Barzilai Date: Mon Apr 20 16:44:23 2026 +0300 fbdev: clps711x-fb: Request memory region for MMIO Use devm_platform_get_and_ioremap_resource() for resource 0 (the MMIO control register range) instead of open-coding platform_get_resource() and devm_ioremap() separately. The helper requests the memory region before mapping it, which registers the range in /proc/iomem and prevents another driver from mapping the same registers. This makes resource 0 consistent with resource 1 (the framebuffer), which already uses devm_platform_get_and_ioremap_resource(). Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Amit Barzilai Signed-off-by: Helge Deller commit d2386d9e3eb4c12f55f6131ab69cc65f13b5af80 Author: Amit Barzilai Date: Mon Apr 20 16:44:22 2026 +0300 fbdev: cobalt_lcdfb: Request memory region Use devm_platform_get_and_ioremap_resource() instead of open-coding platform_get_resource() and devm_ioremap() separately. The helper requests the memory region before mapping it, which registers the range in /proc/iomem and prevents another driver from mapping the same registers. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Amit Barzilai Signed-off-by: Helge Deller commit 0a5ee0e520eff98ee2b4568194562870877b050f Author: Tobias Heider Date: Wed Apr 22 15:30:59 2026 +0200 ASoC: qcom: x1e80100: limit speaker volumes Limit the digital gain and PA volumes to a combined -3 dB in the machine driver to reduce the risk of speaker damage until we have active speaker protection in place (or higher safe levels have been established). Based on commit c481016bb4f8 ("ASoC: qcom: sc8280xp: limit speaker volumes") which addressed the same issue on the sc8280x SoC with some minor changes as explained below. The Digital Volume behaves almost identical to sc8280x since both use the same lpass-wsa-macro, but x1e80100 has two sets of controls prefixed with WSA and WSA2. For PA x1e80100 machines use wsa884x amplifiers which expose a linear scale from -9 dB to 9 dB with a 1.5 dB step size giving us 0 dB = -9 dB + 6 * 1.5 dB. On x1e80100 there are two different speaker topologies we need to handle: 2-Speakers: SpkrLeft, Spkr Right 4-Speakers: WooferLeft, WooferRight, TweeterLeft, TweeterRight Signed-off-by: Tobias Heider Tested-by: Srinivas Kandagatla Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260422-x1e80100-audio-limit-v2-1-333258b97697@canonical.com Signed-off-by: Mark Brown commit 16ab65df5d867961a79cef366cdb33f09ebda603 Merge: ad50f7bc5afefa a6e23843e94908 Author: Mark Brown Date: Wed Apr 22 15:10:22 2026 +0100 spi: fix resource leaks on device setup failure Johan Hovold says: Make sure to call controller cleanup() if spi_setup() fails while registering a device to avoid leaking any resources allocated by setup(). commit a6e23843e949081b417b6078f02074074a190499 Author: Johan Hovold Date: Fri Apr 10 17:49:07 2026 +0200 spi: fix controller cleanup() documentation The controller cleanup() callback is no longer called when releasing a device, but rather when deregistering it (and on registration failures). Fixes: c7299fea6769 ("spi: Fix spi device unregister flow") Cc: Saravana Kannan Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410154907.129248-3-johan@kernel.org Signed-off-by: Mark Brown commit db357034f7e0cf23f233f414a8508312dfe8fbbe Author: Johan Hovold Date: Fri Apr 10 17:49:06 2026 +0200 spi: fix resource leaks on device setup failure Make sure to call controller cleanup() if spi_setup() fails while registering a device to avoid leaking any resources allocated by setup(). Fixes: c7299fea6769 ("spi: Fix spi device unregister flow") Cc: stable@vger.kernel.org # 5.13 Cc: Saravana Kannan Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410154907.129248-2-johan@kernel.org Signed-off-by: Mark Brown commit ad50f7bc5afefa3c2e013ae98511ead815b8f392 Merge: 8370f1bd64d12a 2b20e674244248 Author: Mark Brown Date: Wed Apr 22 15:05:57 2026 +0100 spi: axiado: spi: axiado: fix runtime pm imbalance on probe failure Johan Hovold says: The series fixes some runtime PM related issues in the axiado driver. Included is also a couple of related cleanups. commit 2b20e674244248cdd3e33eee34eebd7408ff134f Author: Johan Hovold Date: Tue Apr 21 16:39:25 2026 +0200 spi: axiado: clean up probe return value Drop the redundant initialisation and return explicit zero on successful probe to make the code more readable. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421143925.1551781-4-johan@kernel.org Signed-off-by: Mark Brown commit 821f0951b20880bd5976f73e202c2fa637c812f6 Author: Johan Hovold Date: Tue Apr 21 16:39:24 2026 +0200 spi: axiado: rename probe error labels Rename the probe error labels after what they do. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421143925.1551781-3-johan@kernel.org Signed-off-by: Mark Brown commit cde1a784e4d55068d8dd7ee9bf4794898a2ac410 Author: Johan Hovold Date: Tue Apr 21 16:39:23 2026 +0200 spi: axiado: fix runtime pm imbalance on probe failure Make sure that the controller is active before disabling clocks on late probe failure and on driver unbind to avoid a clock disable imbalance. Also make sure that the usage count is balanced on probe failure (e.g. probe deferral) so that the controller can be suspended when a driver is later bound. Note that the runtime PM state can only be set when runtime PM is disabled. Fixes: e75a6b00ad79 ("spi: axiado: Add driver for Axiado SPI DB controller") Cc: stable@vger.kernel.org # 7.0 Cc: Vladimir Moravcevic Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421143925.1551781-2-johan@kernel.org Signed-off-by: Mark Brown commit b1aaf1110107dd17bee3618379cd35a816141c6c Author: Ethan Carter Edwards Date: Sat Apr 18 20:45:50 2026 -0400 fbdev: atyfb: Fix spelling mistake "enfore" -> "enforce" Signed-off-by: Ethan Carter Edwards Signed-off-by: Helge Deller commit 9b8a9a3a6f57edd02b7c8db14a316e6fab7fa772 Author: Yuho Choi Date: Mon Apr 20 01:19:26 2026 -0400 fbdev: savage: fix probe-path EDID cleanup leaks When CONFIG_FB_SAVAGE_I2C is enabled, savagefb_probe() can build both an EDID-derived monspecs.modedb and a modelist from it before later failing. The normal success path frees monspecs.modedb after the initial mode selection, but the probe error path only deletes the I2C busses and misses the EDID-derived allocations. Free both the modelist and monspecs.modedb on the failed: unwind path. Co-developed-by: Myeonghun Pak Signed-off-by: Myeonghun Pak Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Co-developed-by: Taegyu Kim Signed-off-by: Taegyu Kim Signed-off-by: Yuho Choi Signed-off-by: Helge Deller commit 869b93ba04088713596e68453c1146f52f713290 Author: Yuho Choi Date: Sun Apr 19 21:01:18 2026 -0400 fbdev: offb: fix PCI device reference leak on probe failure offb_init_nodriver() gets a referenced PCI device with pci_get_device(). If pci_enable_device() fails, the function returns without dropping that reference. Release the PCI device reference before returning from the pci_enable_device() failure path. Fixes: 5bda8f7b5468 ("video: fbdev: offb: Call pci_enable_device() before using the PCI VGA device") Co-developed-by: Myeonghun Pak Signed-off-by: Myeonghun Pak Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Co-developed-by: Taegyu Kim Signed-off-by: Taegyu Kim Signed-off-by: Yuho Choi Signed-off-by: Helge Deller commit 5efb579e0d1ee02b85e3ce2da691c88c93111060 Author: Marios Makassikis Date: Wed Apr 22 10:14:50 2026 +0900 smb: server: stop sending fake security descriptors in smb2_get_info_sec, a dummy security descriptor (SD) is returned if the requested information is not supported. the code is currently wrong, as DACL_PROTECTED is set in the type field, but there is no DACL is present. instead of faking a security, report a STATUS_NOT_SUPPORTED error. this seems to fix a "Error 0x80090006: Invalid Signature" on file transfers with Windows 11 clients (25H2, build 26200.8246). capturing traffic shows that the client is sending a GET_INFO/SEC_INFO request, with the additional_info field set to 0x20 (ATTRIBUTE_SECURITY_INFORMATION). Returning an empty SD (with only SELF_RELATIVE set) does not fix the error. Signed-off-by: Marios Makassikis Acked-by: Namjae Jeon Signed-off-by: Steve French commit b0da97c034b6107d14e537e212d4ce8b22109a58 Author: Hyunwoo Kim Date: Tue Apr 21 00:31:47 2026 +0900 ksmbd: scope conn->binding slowpath to bound sessions only When the binding SESSION_SETUP sets conn->binding = true, the flag stays set after the call so that the global session lookup in ksmbd_session_lookup_all() can find the session, which was not added to conn->sessions. Because the flag is connection-wide, the global lookup path will also resolve any other session by id if asked. Tighten the global lookup so that the returned session must have this connection registered in its channel xarray (sess->ksmbd_chann_list). The channel entry is installed by the existing binding_session path in ntlm_authenticate()/krb5_authenticate() when a SESSION_SETUP completes successfully, so this condition is a strict equivalent of "this connection has been accepted as a channel of this session". Connections that have not bound to a given session cannot reach it via the global table. The existing conn->binding gate for entering the slowpath is preserved so that non-binding connections keep the fast-path-only behavior, and the session->state check is unchanged. Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Signed-off-by: Hyunwoo Kim Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5d115fa84027e4b999c3d3c7b1294849cf35cdb2 Author: DaeMyung Kang Date: Tue Apr 21 02:51:25 2026 +0900 ksmbd: fix CreateOptions sanitization clobbering the whole field smb2_open() attempts to clear conflicting CreateOptions bits (FILE_SEQUENTIAL_ONLY_LE together with FILE_RANDOM_ACCESS_LE, and FILE_NO_COMPRESSION_LE on a directory open), but uses a plain assignment of the bitwise negation of the target flag: req->CreateOptions = ~(FILE_SEQUENTIAL_ONLY_LE); req->CreateOptions = ~(FILE_NO_COMPRESSION_LE); This replaces the entire field with 0xFFFFFFFB / 0xFFFFFFEF rather than clearing a single bit. With the SEQUENTIAL/RANDOM case, the next check for FILE_OPEN_BY_FILE_ID_LE | CREATE_TREE_CONNECTION | FILE_RESERVE_OPFILTER_LE then trivially matches and a legitimate request is rejected with -EOPNOTSUPP. With the NO_COMPRESSION case, every downstream test (FILE_DELETE_ON_CLOSE, etc.) operates on a corrupted CreateOptions value. Use &= ~FLAG to clear only the intended bit in both places. Signed-off-by: DaeMyung Kang Acked-by: Namjae Jeon Signed-off-by: Steve French commit 804054d19886ac6628883d82410f6ee42a818664 Author: DaeMyung Kang Date: Tue Apr 21 03:45:11 2026 +0900 ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open ksmbd_lookup_fd_cguid() returns a ksmbd_file with its refcount incremented via ksmbd_fp_get(). parse_durable_handle_context() in the DURABLE_REQ_V2 case properly releases this reference on every path inside the ClientGUID-match branch, either by calling ksmbd_put_durable_fd() or by transferring ownership to dh_info->fp for a successful reconnect. However, when an entry exists in the global file table with the same CreateGuid but a different ClientGUID, the code simply falls through to the new-open path without dropping the reference obtained from ksmbd_lookup_fd_cguid(). Per MS-SMB2 section 3.3.5.9.10 ("Handling the SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 Create Context"), the server MUST locate an Open whose Open.CreateGuid matches the request's CreateGuid AND whose Open.ClientGuid matches the ClientGuid of the connection that received the request. If no such Open is found, the server MUST continue with the normal open execution phase. A CreateGuid hit with a ClientGUID mismatch is therefore the "Open not found" case: proceeding with a new open is correct, but the reference obtained purely as a side effect of the lookup must not be leaked. Repeated requests that hit this mismatch pin global_ft entries, prevent __ksmbd_close_fd() from ever running for the corresponding files, and defeat the durable scavenger, leading to long-lived resource leaks. Release the reference in the mismatch path and clear dh_info->fp so subsequent logic does not mistake a non-matching lookup result for a reconnect target. Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2") Signed-off-by: DaeMyung Kang Acked-by: Namjae Jeon Signed-off-by: Steve French commit bd0a1ca52b6da64b1a163f103b28b488b20497fe Author: Akif Sait Date: Mon Apr 20 10:58:26 2026 +0900 ksmbd: fix O(N^2) DoS in smb2_lock via unbounded LockCount smb2_lock() performs O(N^2) conflict detection with no cap on LockCount. Cap lock_count at 64 to prevent CPU exhaustion from a single request. Signed-off-by: Akif Sait Acked-by: Namjae Jeon Signed-off-by: Steve French commit b32c8db48212a34998c36d0bbc05b29d5c407ef5 Author: DaeMyung Kang Date: Sun Apr 19 20:02:55 2026 +0900 ksmbd: destroy async_ida in ksmbd_conn_free() When per-connection async_ida was converted from a dynamically allocated ksmbd_ida to an embedded struct ida, ksmbd_ida_free() was removed from the connection teardown path but no matching ida_destroy() was added. The connection is therefore freed with the IDA's backing xarray still intact. The kernel IDA API expects ida_init() and ida_destroy() to be paired over an object's lifetime, so add the missing cleanup before the connection is freed. No leak has been observed in testing; this is a pairing fix to match the IDA lifetime rules, not a response to a reproduced regression. Fixes: d40012a83f87 ("cifsd: declare ida statically") Signed-off-by: DaeMyung Kang Acked-by: Namjae Jeon Signed-off-by: Steve French commit c049ee14eb4343b69b6f7755563f961f5e153423 Author: DaeMyung Kang Date: Sun Apr 19 20:02:54 2026 +0900 ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() When per-session tree_conn_ida was converted from a dynamically allocated ksmbd_ida to an embedded struct ida, ksmbd_ida_free() was removed from ksmbd_session_destroy() but no matching ida_destroy() was added. The session is therefore freed with the IDA's backing xarray still intact. The kernel IDA API expects ida_init() and ida_destroy() to be paired over an object's lifetime, so add the missing cleanup before the enclosing session is freed. Also move ida_init() to right after the session is allocated so that it is always paired with the destroy call even on the early error paths of __session_create() (ksmbd_init_file_table() or __init_smb2_session() failures), both of which jump to the error label and invoke ksmbd_session_destroy() on a partially initialised session. No leak has been observed in testing; this is a pairing fix to match the IDA lifetime rules, not a response to a reproduced regression. Fixes: d40012a83f87 ("cifsd: declare ida statically") Signed-off-by: DaeMyung Kang Acked-by: Namjae Jeon Signed-off-by: Steve French commit cc92b479b6ed1d7d1a6eb13aba472badb836a832 Author: Eric Biggers Date: Sat Apr 18 15:17:07 2026 -0700 ksmbd: Use AES-CMAC library for SMB3 signature calculation Now that AES-CMAC has a library API, convert ksmbd_sign_smb3_pdu() to use it instead of a "cmac(aes)" crypto_shash. The result is simpler and faster code. With the library there's no need to dynamically allocate memory, no need to handle errors, and the AES-CMAC code is accessed directly without inefficient indirect calls and other unnecessary API overhead. Acked-by: Namjae Jeon Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit def036ef87f8641c1c525d5ae17438d7a1006491 Author: DaeMyung Kang Date: Sun Apr 19 02:28:44 2026 +0900 ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() rcount is intended to be connection-specific: 2 for curr_conn, 1 for every other connection sharing the same session. However, it is initialised only once before the hash iteration and is never reset. After the loop visits curr_conn, later sibling connections are also checked against rcount == 2, so a sibling with req_running == 1 is incorrectly treated as idle. This makes the outcome depend on the hash iteration order: whether a given sibling is checked against the loose (< 2) or the strict (< 1) threshold is decided by whether it happens to be visited before or after curr_conn. The function's contract is "wait until every connection sharing this session is idle" so that destroy_previous_session() can safely tear the session down. The latched rcount violates that contract and reopens the teardown race window the wait logic was meant to close: destroy_previous_session() may proceed before sibling channels have actually quiesced, overlapping session teardown with in-flight work on those connections. Recompute rcount inside the loop so each connection is compared against its own threshold regardless of iteration order. This is a code-inspection fix for an iteration-order-dependent logic error; a targeted reproducer would require SMB3 multichannel with in-flight work on a sibling channel landing after curr_conn in hash order, which is not something that can be triggered reliably. Fixes: 76e98a158b20 ("ksmbd: fix race condition between destroy_previous_session() and smb2 operations()") Cc: stable@vger.kernel.org Signed-off-by: DaeMyung Kang Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2af72ec297d1d4928d0522b45c8ee87cb0d5f5ff Author: Krzysztof Kozlowski Date: Wed Apr 22 10:33:39 2026 +0200 regulator: qcom: Unify user-visible "Qualcomm" name Various names for Qualcomm as a company are used in user-visible config options: QCOM, Qualcomm and Qualcomm Technologies. Switch to unified "Qualcomm" so it will be easier for users to identify the options when for example running menuconfig. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260422083338.84343-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown commit e6614b88d59d110ee1a80ed0826e34f24dd35c96 Author: Sean Chang Date: Mon Apr 20 00:31:38 2026 +0800 NFS: Fix RCU dereference of cl_xprt in nfs_compare_super_address The cl_xprt pointer in struct rpc_clnt is marked as __rcu. Accessing it directly in nfs_compare_super_address() is unsafe and triggers Sparse warnings. Fix this by using rcu_dereference() within an RCU read-side critical section to retrieve the transport pointer. This addresses the sparse warning and ensures atomic access to the pointer, as the transport can be updated via transport switching even while the superblock remains active under sb_lock. Fixes: 7e3fcf61abde ("nfs: don't share mounts between network namespaces") Signed-off-by: Sean Chang Signed-off-by: Trond Myklebust commit e8a44ae87b553b0851a20bebf3d2634a45c5e316 Author: Sean Chang Date: Mon Apr 20 00:31:37 2026 +0800 NFS: remove redundant __private attribute from nfs_page_class The nfs_page_class tracepoint uses a pointer for the 'req' field marked with the __private attribute. This causes Sparse to complain about dereferencing a private pointer within the trace ring buffer context, specifically during the TP_fast_assign() operation. This fixes a Sparse warning introduced in commit b6ef079fd984 ("nfs: more in-depth tracing of writepage events") by removing the redundant __private attribute from the 'req' field. Reviewed-by: Benjamin Coddington Signed-off-by: Sean Chang Signed-off-by: Trond Myklebust commit 6e7daa3dad299080a9429522a98ac1ae1116ecc3 Author: Olga Kornievskaia Date: Fri Apr 17 16:35:43 2026 -0400 NFSv4.2: fix CLONE/COPY attrs in presence of delegated attributes xfstest generic/407 is failing in 2 ways. It detects that after doing a clone the client does not update it's mtime and it's ctime. CLONE always sends a GETATTR operation and then calls nfs_post_op_update_inode() based on the returned attributes. Because of the delegated attributes the client ignores updating the mtime. Then also, when delegated attributes are present, for the change_attr the server replies with the same values as what the client cached before and thus the generic/407 would flag that. Instead, make sure we invalidate the blocks attr. By adding updating delegated attributes in nfs42_copy_dest_done() both COPY and CLONE would update mtime appropriately. Fixes: e12912d94137 ("NFSv4: Add support for delegated atime and mtime attributes") Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit 5d3869a41f3608101c00ff9c9c7c2364c555fa65 Author: Olga Kornievskaia Date: Mon Apr 13 18:24:23 2026 -0400 NFS: fix writeback in presence of errors After running xfstest generic/751, in certain conditions, can have a writeback IO stuck while experiencing one of the two patterns. Pattern#1: writeback IO experiences ENOSPC on an offset smaller than the filesize. Example, write offset=0 len=4096 how=unstable OK write offset=8192 len=4096 how=unstable OK write offset=12288 len=4096 how=unstable ENOSPC write offset=4096 len=4096 how=unstable ENOSPC client sends a commit and receives a verifier which is different from the last successful write. It marks pages dirty and writeback retries. But it again send writes unstable and gets into the same pattern, running into the ENOSPC error and sending a commit because writes were sent at unstable. Pattern#2: an unstable write followed by a short write and ENOSPC. write offset=0 len=4096 how=unstable OK write offset=4096 len=4096 how=unstable returns OK but count=100 write offset=4197 len=3996 how=stable returns ENOSPC client send a commit and receives a verifier different from the last unstable write. The same behaviour is retried in a loop. Instead, this patch proposes to identify those conditions and mark requests to be done synchronously instead. Previous solution tried to mark it in the nfs_page, however that's not persistent thus instead mark it in the nfs_open_context. Furthermore, the same problem occurs during localio code path so recognize that IO needs to be done sync in that case as well. Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit 43ea7036ee50b5368b1c361e8a3591aa0f1455d9 Author: Thorsten Blum Date: Sun Apr 5 12:32:14 2026 +0200 nfs: use memcpy_and_pad in decode_fh Use memcpy_and_pad() instead of memcpy() followed by memset() to simplify decode_fh(). Signed-off-by: Thorsten Blum Signed-off-by: Trond Myklebust commit 8370f1bd64d12a01a6c19e91d1dbe9bfbdb614f0 Merge: a1d50a37d3b1df fa5061daffe841 Author: Mark Brown Date: Wed Apr 22 13:49:21 2026 +0100 spi: orion: runtime PM fixes Johan Hovold says: This series fixes some runtime PM related issues in the orion driver. Included is also a related clean up. commit fa5061daffe841c2577c987c4f3515c45e53b775 Author: Johan Hovold Date: Tue Apr 21 15:02:11 2026 +0200 spi: orion: clean up probe return value Drop the redundant initialisation and return explicit zero on successful probe to make the code more readable. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421130211.1537628-4-johan@kernel.org Signed-off-by: Mark Brown commit 443cde0dc59c5d154156ac9f27a7dadef8ebc0c2 Author: Johan Hovold Date: Tue Apr 21 15:02:10 2026 +0200 spi: orion: fix clock imbalance on registration failure Make sure that the controller is not runtime suspended before disabling clocks on probe failure. Also restore the autosuspend setting. Fixes: 5c6786945b4e ("spi: spi-orion: add runtime PM support") Cc: stable@vger.kernel.org # 3.17 Cc: Russell King Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421130211.1537628-3-johan@kernel.org Signed-off-by: Mark Brown commit 97b17dd8266d2e26d9ee3c75a0fa34ecde6944f0 Author: Johan Hovold Date: Tue Apr 21 15:02:09 2026 +0200 spi: orion: fix runtime pm leak on unbind Make sure to balance the runtime PM usage count on driver unbind so that the controller can be suspended when a driver is rebound. Also restore the autosuspend setting. This issue was flagged by Sashiko when reviewing a controller deregistration fix. Fixes: 5c6786945b4e ("spi: spi-orion: add runtime PM support") Cc: stable@vger.kernel.org # 3.17 Cc: Russell King Link: https://sashiko.dev/#/patchset/20260414134319.978196-1-johan%40kernel.org?part=6 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421130211.1537628-2-johan@kernel.org Signed-off-by: Mark Brown commit a1d50a37d3b1df84f536a982f692371039df4a48 Author: Johan Hovold Date: Tue Apr 21 14:56:32 2026 +0200 spi: imx: fix runtime pm leak on probe deferral Make sure to balance the runtime PM usage count before returning on probe failure (e.g. probe deferral) so that the controller can be suspended when a driver is later bound. Fixes: 43b6bf406cd0 ("spi: imx: fix runtime pm support for !CONFIG_PM") Cc: stable@vger.kernel.org # 5.10 Cc: Sascha Hauer Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421125632.1537235-1-johan@kernel.org Signed-off-by: Mark Brown commit f62c060272b9d7423b1650b844e8e4e7b8f9f925 Author: Johan Hovold Date: Tue Apr 21 14:58:00 2026 +0200 spi: mpc52xx: fix use-after-free on registration failure Make sure to disable and free the interrupts in case controller registration fails to avoid a potential use-after-free and resource leak. This issue was flagged by Sashiko when reviewing a controller deregistration fix. Fixes: 42bbb70980f3 ("powerpc/5200: Add mpc5200-spi (non-PSC) device driver") Cc: stable@vger.kernel.org # 2.6.33 Cc: Grant Likely Link: https://sashiko.dev/#/patchset/20260414134319.978196-1-johan%40kernel.org?part=3 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260421125800.1537361-1-johan@kernel.org Signed-off-by: Mark Brown commit 36ee1313199b7f16bf963c6ac0241861585125d9 Author: Namjae Jeon Date: Wed Apr 22 11:56:12 2026 +0900 ntfs: use page allocation for resident attribute inline data The current kmemdup() based allocation for IOMAP_INLINE can result in inline_data pointer having a non-zero page offset. This causes iomap_inline_data_valid() to fail the check: iomap->length <= PAGE_SIZE - offset_in_page(iomap->inline_data) and triggers the kernel BUG at fs/iomap/buffered-io.c:1061. This particularly affects workloads with frequent small file access (e.g. Firefox Nightly profile on NTFS with bind mount) when using the new ntfs. This fix this by allocating a full page with alloc_page() so that page_address() always returns a page-aligned address. Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 6e0152c75d70725add4cef3b1cb10abc6efa6ad9 Author: Namjae Jeon Date: Tue Apr 21 08:13:57 2026 +0900 ntfs: fix mmap_prepare writable check for shared mappings Linus pointed out that checking only VMA_WRITE_BIT is incorrect. Private writable mappings (MAP_PRIVATE) set VM_WRITE but do not write back to the filesystem. Also, mappings that can become writable via mprotect() (VM_MAYWRITE) must be handled. Use vma_desc_test_all(VMA_SHARED_BIT, VMA_MAYWRITE_BIT) instead, which matches what other filesystems do. Suggested-by: Linus Torvalds Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit c9ebe2016de967b47ce99d5af9bc791939c955f4 Author: Tiezhu Yang Date: Wed Apr 22 15:45:34 2026 +0800 LoongArch: BPF: Support up to 12 function arguments for trampoline Currently, LoongArch bpf trampoline supports up to 8 function arguments. According to the statistics from commit 473e3150e30a ("bpf, x86: allow function arguments up to 12 for TRACING"), there are over 200 functions accept 9 to 12 arguments, so add 12 arguments support for trampoline. With this patch, the following related testcases passed: sudo ./test_progs -a tracing_struct/struct_many_args sudo ./test_progs -a fentry_test/fentry_many_args sudo ./test_progs -a fexit_test/fexit_many_args Acked-by: Hengqi Chen Tested-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 0ef8b96051555aaded204c9e65edbd3656d9613f Author: Tiezhu Yang Date: Wed Apr 22 15:45:34 2026 +0800 LoongArch: BPF: Support small struct arguments for trampoline In the current BPF code, the struct argument size is at most 16 bytes, enforced by the verifier. According to the Procedure Call Standard for LoongArch, the struct argument size below 16 bytes are provided as part of the 8 argument registers, that is to say, the struct argument may be passed in a pair of registers if its size is more than 8 bytes and no more than 16 bytes. Extend the BPF trampoline JIT to support attachment to functions that take small structures (up to 16 bytes) as argument, save and restore a number of "argument registers" rather than a number of arguments. With this patch, the following related testcases passed: sudo ./test_progs -a tracing_struct/struct_args sudo ./test_progs -a tracing_struct/union_args Link: https://github.com/loongson/la-abi-specs/blob/release/lapcs.adoc#structures Acked-by: Hengqi Chen Tested-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 4653682c6f6559e3209586f7bb30183f36375f00 Author: Tiezhu Yang Date: Wed Apr 22 15:45:34 2026 +0800 LoongArch: BPF: Open code and remove invoke_bpf_mod_ret() invoke_bpf_mod_ret() is a small wrapper over invoke_bpf_prog(), it should check the return value of invoke_bpf_prog() and then return immediately if invoke_bpf_prog() failed, just open code and remove it due to it is called only once. Acked-by: Hengqi Chen Tested-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit ee823fe7c12f92bac5e5b1ea6dd0ac8b267dd464 Author: Tiezhu Yang Date: Wed Apr 22 15:45:34 2026 +0800 LoongArch: BPF: Support load-acquire and store-release instructions Use the LoongArch common memory access instructions with the barrier 'dbar' to support the BPF load-acquire and store-release instructions. With this patch, the following testcases passed on LoongArch if the macro CAN_USE_LOAD_ACQ_STORE_REL is usable in bpf selftests: sudo ./test_progs -t verifier_load_acquire sudo ./test_progs -t verifier_store_release sudo ./test_progs -t verifier_precision/bpf_load_acquire sudo ./test_progs -t verifier_precision/bpf_store_release sudo ./test_progs -t compute_live_registers/atomic_load_acq_store_rel Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit fc935c190c7967070506a2795575adc7f9f501ef Author: Tiezhu Yang Date: Wed Apr 22 15:45:34 2026 +0800 LoongArch: BPF: Support 8 and 16 bit read-modify-write instructions The 8 and 16 bit read-modify-write instructions {amadd/amswap}.{b/h} were newly added in the latest LoongArch Reference Manual, use them to avoid the error of unknown opcode if possible. Acked-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 534768410598539712e0097e060331c85f2d0c9d Author: Tiezhu Yang Date: Wed Apr 22 15:45:34 2026 +0800 LoongArch: BPF: Add the default case in emit_atomic() and rename it Like the other archs such as x86 and riscv, add the default case in emit_atomic() to print an error message for the invalid opcode and return -EINVAL, then make its return type as int. While at it, given that all of the instructions in emit_atomic() are only read-modify-write instructions, rename emit_atomic() to emit_atomic_rmw() to make it clear, because there will be a new function emit_atomic_ld_st() for load-acquire and store-release instructions in the later patch. Acked-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 1dd3e8a8eeb4059fb34b07578362380cf35b7ed5 Author: Tiezhu Yang Date: Wed Apr 22 15:45:13 2026 +0800 LoongArch: Define instruction formats for AM{SWAP/ADD}.{B/H} and DBAR The 8 and 16 bit read-modify-write atomic instructions amadd.{b/h} and amswap.{b/h} were newly added in the latest LoongArch Reference Manual, define the instruction format and check whether support via CPUCFG. Furthermore, define the instruction format for DBAR which will be used to support BPF load-acquire and store-release instructions. This is preparation for later patches. Acked-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 2c749f734ebfe350da55bf40ea55444fb85d4055 Author: Youling Tang Date: Wed Apr 22 15:45:13 2026 +0800 LoongArch: Batch the icache maintenance for jump_label Switch to the batched version of the jump label update functions so instruction cache maintenance is deferred until the end of the update. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit adf346e500647d91d115e1319f04c3c7972620d9 Author: Youling Tang Date: Wed Apr 22 15:45:12 2026 +0800 LoongArch: Add flush_icache_all()/local_flush_icache_all() LoongArch maintains ICache/DCache coherency by hardware, so we just need "ibar 0" to avoid instruction hazard here. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 0c965d2784fbbd7f8e3b96d875c9cfdf7c00da3d Author: Greg Kroah-Hartman Date: Wed Apr 22 15:45:12 2026 +0800 LoongArch: Add spectre boundry for syscall dispatch table The LoongArch syscall number is directly controlled by userspace, but does not have a array_index_nospec() boundry to prevent access past the syscall function pointer tables. Cc: stable@vger.kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Signed-off-by: Huacai Chen commit 37e57e8ad96cdec4a57b55fd10bef50f7370a954 Author: Huacai Chen Date: Wed Apr 22 15:45:12 2026 +0800 LoongArch: Show CPU vulnerabilites correctly Most LoongArch processors are vulnerable to Spectre-V1 Proof-of-Concept (PoC). And the generic mechanism, __user pointer sanitization, can be used as a mitigation. This means to use array_index_nospec() to prevent out of boundry access in syscall and other critical paths. Implement the arch-specific cpu_show_spectre_v1() to show CPU Spectre-V1 vulnerabilites correctly. Cc: stable@vger.kernel.org Link: https://cc-sw.com/chinese-loongarch-architecture-evaluation-part-3-of-3/ Signed-off-by: Huacai Chen commit 02a6a1f9d77a816fbac01de9bfcd0e0914552f2f Author: Huacai Chen Date: Wed Apr 22 15:45:12 2026 +0800 LoongArch: Make arch_irq_work_has_interrupt() true only if IPI HW exist After commit 7c405fb3279b3924 ("rcu: Use an intermediate irq_work to start process_srcu()"), Loongson-2K0300/2K0500 fail to boot. Because IRQ_WORK need IPI but Loongson-2K0300/2K0500 don't have IPI HW. So make arch_irq_work_has_interrupt() return true only if IPI HW exist. Cc: stable@vger.kernel.org Reported-by: Binbin Zhou Signed-off-by: Huacai Chen commit a28547576b3b3c95f2261cd5374c1e459f36d9dc Author: Luo Qiu Date: Wed Apr 22 15:45:12 2026 +0800 LoongArch: Use get_random_canary() for stack canary init Like others, replace the custom stack canary initialization with the get_random_canary() helper, following the pattern established in commit 622754e84b10 ("stackprotector: actually use get_random_canary()"). Signed-off-by: Luo Qiu Signed-off-by: Huacai Chen commit 847634955b0810d0b93382a588312f745a5947be Author: Yuqian Yang Date: Wed Apr 22 15:45:11 2026 +0800 LoongArch: Improve the logging of disabling KASLR Whether KASLR is disabled is not handled in nokaslr() which is the early param "nokaslr" setup function, but in kaslr_disabled(). However, the logging was previously done in nokaslr() and lack detail. So we move the logging to the right place and add more specific infomation about why it is disabled. Suggested-by: Wentao Guan Signed-off-by: Yuqian Yang Signed-off-by: Huacai Chen commit e3f4591f7920ce169f2f78fa5a89639ada7d7058 Author: Lisa Robinson Date: Wed Apr 22 15:45:11 2026 +0800 LoongArch: Align FPU register state to 32 bytes Move fpr to the beginning of struct loongarch_fpu so it is naturally aligned to FPU_ALIGN (32 bytes), improving 256-bit SIMD (LASX) context switch performance. Also adjust process.c and fpu.S to work well with the new loongarch_fpu layout. Signed-off-by: Lisa Robinson Signed-off-by: Huacai Chen commit 1829419bc3b291ad9547abe70053c2620832ac41 Author: Tiezhu Yang Date: Wed Apr 22 15:45:11 2026 +0800 LoongArch: Handle CONFIG_32BIT in syscall_get_arch() If CONFIG_32BIT is set, it should return AUDIT_ARCH_LOONGARCH32 instead of AUDIT_ARCH_LOONGARCH64 in syscall_get_arch(). Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 8b81576c16c0681b0c0148200a8c3ce33ad5f6fa Author: Huacai Chen Date: Wed Apr 22 15:44:54 2026 +0800 LoongArch: Add HIGHMEM (PKMAP and FIX_KMAP) support Add HIGHMEM (High Memory) support for LoongArch, mostly needed by 32BIT kernel because the size of kernel virtual memory space is only 512MB and the size of usable physical memory is only 256MB in this case. HIGHMEM adds permanent kernel mapping (PKMAP) and fixed kernel mapping (FIX_KMAP), which increase usable physical memory up to 2.25GB (2304MB). We can just use the generic copy_user_highpage(), so remove the custom version. Signed-off-by: Huacai Chen commit 3d9aba6618d115750729bba2d1f8af180bd7d3bd Author: Huacai Chen Date: Wed Apr 22 15:44:26 2026 +0800 LoongArch: Adjust build infrastructure for 32BIT/64BIT Adjust build infrastructure (Kconfig, Makefile and ld scripts) to let us enable both 32BIT/64BIT kernel build. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 5170a82e89211d876af17bf3d94a511fb2bb4921 Author: Jork Loeser Date: Tue Apr 7 18:36:40 2026 -0700 x86/hyperv: Skip LP/VP creation on kexec After a kexec the logical processors and virtual processors already exist in the hypervisor because they were created by the previous kernel. Attempting to add them again causes either a BUG_ON or corrupted VP state leading to MCEs in the new kernel. Add hv_lp_exists() to probe whether an LP is already present by calling HVCALL_GET_LOGICAL_PROCESSOR_RUN_TIME. When it succeeds the LP exists and we skip the add-LP and create-VP loops entirely. Also add hv_call_notify_all_processors_started() which informs the hypervisor that all processors are online. This is required after adding LPs (fresh boot) and is a no-op on kexec since we skip that path. Co-developed-by: Anirudh Rayabharam Signed-off-by: Anirudh Rayabharam Co-developed-by: Stanislav Kinsburskii Signed-off-by: Stanislav Kinsburskii Co-developed-by: Mukesh Rathor Signed-off-by: Mukesh Rathor Signed-off-by: Jork Loeser Reviewed-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit f7ce370b525a02127527b0f54ee877413705a709 Author: Jork Loeser Date: Tue Apr 7 18:36:39 2026 -0700 x86/hyperv: move stimer cleanup to hv_machine_shutdown() Move hv_stimer_global_cleanup() from vmbus's hv_kexec_handler() to hv_machine_shutdown() in the platform code. This ensures stimer cleanup happens before the vmbus unload, which is required for root partition kexec to work correctly. Co-developed-by: Anirudh Rayabharam Signed-off-by: Anirudh Rayabharam Signed-off-by: Jork Loeser Reviewed-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit 3c42b33433796b73ddecd8f60bda419b1648d997 Author: Jork Loeser Date: Tue Apr 7 18:36:38 2026 -0700 Drivers: hv: vmbus: fix hyperv_cpuhp_online variable shadowing vmbus_alloc_synic_and_connect() declares a local 'int hyperv_cpuhp_online' that shadows the file-scope global of the same name. The cpuhp state returned by cpuhp_setup_state() is stored in the local, leaving the global at 0 (CPUHP_OFFLINE). When hv_kexec_handler() or hv_machine_shutdown() later call cpuhp_remove_state(hyperv_cpuhp_online) they pass 0, which hits the BUG_ON in __cpuhp_remove_state_cpuslocked(). Remove the local declaration so the cpuhp state is stored in the file-scope global where hv_kexec_handler() and hv_machine_shutdown() expect it. Fixes: 2647c96649ba ("Drivers: hv: Support establishing the confidential VMBus connection") Signed-off-by: Jork Loeser Reviewed-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam (Microsoft) Signed-off-by: Wei Liu commit cfc42685e5700e33bb25911d556b2727479de97c Author: Stanislav Kinsburskii Date: Tue Mar 24 23:59:59 2026 +0000 mshv: Add tracepoint for GPA intercept handling Provide visibility into GPA intercept operations for debugging and performance analysis of Microsoft Hypervisor guest memory management. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam (Microsoft) Signed-off-by: Wei Liu commit 68637b68afcc3cb4d56aca14a3a1d1b47b879369 Author: Sangyun Kim Date: Sun Apr 19 17:08:38 2026 +0900 pwm: atmel-tcb: Cache clock rates and mark chip as atomic atmel_tcb_pwm_apply() holds tcbpwmc->lock as a spinlock via guard(spinlock)() and then calls atmel_tcb_pwm_config(), which calls clk_get_rate() twice. clk_get_rate() acquires clk_prepare_lock (a mutex), so this is a sleep-in-atomic-context violation. On CONFIG_DEBUG_ATOMIC_SLEEP kernels every pwm_apply_state() that enables or reconfigures the PWM triggers a "BUG: sleeping function called from invalid context" warning. Acquire exclusive control over the clock rates with clk_rate_exclusive_get() at probe time and cache the rates in struct atmel_tcb_pwm_chip, then read the cached rates from atmel_tcb_pwm_config(). This keeps the spinlock-based mutual exclusion introduced in commit 37f7707077f5 ("pwm: atmel-tcb: Fix race condition and convert to guards") and removes the sleeping calls from the atomic section. With no sleeping calls left in .apply() and the regmap-mmio bus already running with fast_io=true, also mark the chip as atomic so consumers can use pwm_apply_atomic() from atomic context. Fixes: 37f7707077f5 ("pwm: atmel-tcb: Fix race condition and convert to guards") Signed-off-by: Sangyun Kim Link: https://patch.msgid.link/20260419080838.3192357-1-sangyun.kim@snu.ac.kr [ukleinek: Ensure .clk is enabled before calling clk_get_rate on it.] Signed-off-by: Uwe Kleine-König commit d0be8884f56b0b800cd8966e37ce23417cd5044e Author: Greg Kroah-Hartman Date: Tue Apr 21 15:46:16 2026 +0200 io_uring: take page references for NOMMU pbuf_ring mmaps Under !CONFIG_MMU, io_uring_get_unmapped_area() returns the kernel virtual address of the io_mapped_region's backing pages directly; the user's VMA aliases the kernel allocation. io_uring_mmap() then just returns 0 -- it takes no page references. The CONFIG_MMU path uses vm_insert_pages(), which takes a reference on each inserted page. Those references are released when the VMA is torn down (zap_pte_range -> put_page). io_free_region() -> release_pages() drops the io_uring-side references, but the pages survive until munmap drops the VMA-side references. Under NOMMU there are no VMA-side references. io_unregister_pbuf_ring -> io_put_bl -> io_free_region -> release_pages drops the only references and the pages return to the buddy allocator while the user's VMA still has vm_start pointing into them. The user can then write into whatever the allocator hands out next. Mirror the MMU lifetime: take get_page references in io_uring_mmap() and release them via vm_ops->close. NOMMU's delete_vma() calls vma_close() which runs ->close on munmap. This also incidentally addresses the duplicate-vm_start case: two mmaps of SQ_RING and CQ_RING resolve to the same ctx->ring_region pointer. With page refs taken per mmap, the second mmap takes its own refs and the pages survive until both mmaps are closed. The nommu rb-tree BUG_ON on duplicate vm_start is a separate mm/nommu.c concern (it should share the existing region rather than BUG), but the page lifetime is now correct. Cc: Jens Axboe Reported-by: Anthropic Assisted-by: gkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026042115-body-attention-d15b@gregkh [axboe: get rid of region lookup, just iterate pages in vma] Signed-off-by: Jens Axboe commit beaba8bfbb91e3bb3133eacacd62fd6fea515e34 Merge: 6596a02b207886 453553e1ed53ca Author: Linus Torvalds Date: Tue Apr 21 19:05:09 2026 -0700 Merge tag 'probes-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fixes from Masami Hiramatsu: "fprobe bug fixes: - Prevent re-registration Add an earlier check to reject re-registering an already active fprobe before its state is modified during the initialization phase - Robustness in failure paths: - Ensure fprobes are correctly removed from all internal tables and properly RCU-freed during registration failure - Make unregister_fprobe() proceed with unregistration even if temporary memory allocation fails - RCU safety in module unloading Avoid a potential "sleep in RCU" warning by removing a kcalloc() call in the module notifier path. This also tries to remove fprobe_hash_node even if memory allocation fails. - Type-aware unregistration Fix a bug where unregistering an fprobe did not account for different types (entry-only vs entry-exit) at the same address, which previously left "junk" entries in the underlying ftrace/fgraph ops - Unregistration of empty ftrace_ops Avoid unneeded performance overhead due to making registered ftrace_ops empty - which means 'trace all functions'. This counts remaining entries and unregister ftrace_ops when it becomes empty. Two new selftests to check above fixes: - Module Unloading Test: Specifically verifies that fprobe events on a module are correctly cleaned up and do not trigger 'trace-all' behavior when the module is removed. - Multiple Fprobe Events Test: Ensure that having multiple fprobes on the same function correctly manages the ftrace hash map during removal" * tag 'probes-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: selftests/ftrace: Add a testcase for multiple fprobe events selftests/ftrace: Add a testcase for fprobe events on module tracing/fprobe: Fix to unregister ftrace_ops if it is empty on module unloading tracing/fprobe: Check the same type fprobe on table as the unregistered one tracing/fprobe: Avoid kcalloc() in rcu_read_lock section tracing/fprobe: Remove fprobe from hash in failure path tracing/fprobe: Unregister fprobe even if memory allocation fails tracing/fprobe: Reject registration of a registered fprobe before init commit 1967f0b1cafdde37aa9e08e6021c14bcc484b7a5 Author: Jens Axboe Date: Tue Apr 21 13:24:33 2026 -0600 io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Commit: aacf2f9f382c ("io_uring: fix req->apoll_events") fixed an issue where poll->events and req->apoll_events weren't synchronized, but then when the commit referenced in Fixes got added, it didn't ensure the same thing. If we mask in EPOLLONESHOT in the regular EPOLL_URING_WAKE path, then ensure it's done for both. Including a link to the original report below, even though it's mostly nonsense. But it includes a reproducer that does show that IORING_CQE_F_MORE is set in the previous CQE, while no more CQEs will be generated for this request. Just ignore anything that pretends this is security related in any way, it's just the typical AI nonsense. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/io-uring/CAM0zi7yQzF3eKncgHo4iVM5yFLAjsiob_ucqyWKs=hyd_GqiMg@mail.gmail.com/ Reported-by: Azizcan Daştan Fixes: 4464853277d0 ("io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups") Signed-off-by: Jens Axboe commit 0389aa700912ad14c43b8cfbabd707dfce22de6a Merge: a7756371e57f69 dd88d42d9ca0dd Author: Dave Airlie Date: Wed Apr 22 11:14:46 2026 +1000 Merge tag 'amd-drm-next-7.1-2026-04-17' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-7.1-2026-04-17: amdgpu: - SMU 14 fixes - Partition fixes - SMUIO 15.x fix - SR-IOV fixes - JPEG fix - PSP 15.x fix - NBIF fix - Devcoredump fixes - DPC fix - RAS fixes - Aldebaran smu fix - IP discovery fix - SDMA 7.1 fix - Runtime pm fix - MES 12.1 fix - DML2 fixes - DCN 4.2 fixes - YCbCr fixes - Freesync fixes - ISM fixes - Overlay cursor fix - DC FP fixes - UserQ locking fixes amdkfd: - Fix memory clear handling Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260417225351.8714-1-alexander.deucher@amd.com commit 2f3835771dff512750205aa5f5f61aec0f2b8cb7 Author: Carlos Bilbao Date: Tue Apr 14 21:07:28 2026 -0700 scsi: target: iscsi: reject invalid size Extended CDB AHS If ecdb_ahdr->ahslength is zero, two bugs follow: kmalloc(be16_to_cpu(ecdb_ahdr->ahslength) + 15, ...) allocates 15 bytes, but the immediately following memcpy writes ISCSI_CDB_SIZE (16) bytes into it, a one-byte heap overflow. Also: memcpy(cdb + ISCSI_CDB_SIZE, ecdb_ahdr->ecdb, be16_to_cpu(ecdb_ahdr->ahslength) - 1); (u16)0 - 1 promotes to (int)-1 which converts to SIZE_MAX as size_t, causing a massive out-of-bounds write. Reject ahslength == 0 with ISCSI_REASON_PROTOCOL_ERROR before the kmalloc. Also reject ahslength values that exceed the actual AHS buffer advertised. Fixes: 8f1f7d297bce ("scsi: target: iscsi: Add support for extended CDB AHS") Signed-off-by: Carlos Bilbao Reviewed-by: Dmitry Bogdanov Link: https://patch.msgid.link/20260415040728.187680-1-carlos.bilbao@kernel.org Signed-off-by: Martin K. Petersen commit b06cf63d83d3b3744d3aefdd2f3ced25e99d7ec1 Author: Wang Shuaiwei Date: Tue Apr 14 11:37:18 2026 +0800 scsi: ufs: core: Fix bRefClkFreq write failure in HS-LSS mode According to the UFS spec, the bRefClkFreq attribute can only be written when both sub-links are in LS-MODE. However, in HS LSS mode with resetmode = HS_MODE, if the UFS device's default bRefClkFreq value differs from the host controller's dev_ref_clk_freq setting, the write operation will fail. To fix this issue, introduce ufshcd_get_op_mode() function to detect the current link operational mode. Call ufshcd_set_dev_ref_clk() only when both sub-links are in LS-MODE to ensure the attribute can be written successfully. Signed-off-by: Wang Shuaiwei Link: https://patch.msgid.link/20260414033718.1459540-1-wangshuaiwei1@xiaomi.com Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit 6596a02b207886e9e00bb0161c7fd59fea53c081 Merge: d46dd0d88341e4 a7756371e57f69 Author: Linus Torvalds Date: Tue Apr 21 17:39:21 2026 -0700 Merge tag 'drm-next-2026-04-22' of https://gitlab.freedesktop.org/drm/kernel Pull more drm updates from Dave Airlie: "This is a followup which is mostly next material with some fixes. Alex pointed out I missed one of his AMD MRs from last week, so I added that, then Jani sent the pipe reordering stuff, otherwise it's just some minor i915 fixes and a dma-buf fix. drm: - Add support for AMD VSDB parsing to drm_edid dma-buf: - fix documentation formatting i915: - add support for reordered pipes to support joined pipes better - Fix VESA backlight possible check condition - Verify the correct plane DDB entry amdgpu: - Audio regression fix - Use drm edid parser for AMD VSDB - Misc cleanups - VCE cs parse fixes - VCN cs parse fixes - RAS fixes - Clean up and unify vram reservation handling - GPU Partition updates - system_wq cleanups - Add CONFIG_GCOV_PROFILE_AMDGPU kconfig option - SMU vram copy updates - SMU 13/14/15 fixes - UserQ fixes - Replace pasid idr with an xarray - Dither handling fix - Enable amdgpu by default for CIK APUs - Add IBs to devcoredump amdkfd: - system_wq cleanups radeon: - system_wq cleanups" * tag 'drm-next-2026-04-22' of https://gitlab.freedesktop.org/drm/kernel: (62 commits) drm/i915/display: change pipe allocation order for discrete platforms drm/i915/wm: Verify the correct plane DDB entry drm/i915/backlight: Fix VESA backlight possible check condition drm/i915: Walk crtcs in pipe order drm/i915/joiner: Make joiner "nomodeset" state copy independent of pipe order dma-buf: fix htmldocs error for dma_buf_attach_revocable drm/amdgpu: dump job ibs in the devcoredump drm/amdgpu: store ib info for devcoredump drm/amdgpu: extract amdgpu_vm_lock_by_pasid from amdgpu_vm_handle_fault drm/amdgpu: Use amdgpu by default for CIK APUs too drm/amd/display: Remove unused NUM_ELEMENTS macros drm/amd/display: Replace inline NUM_ELEMENTS macro with ARRAY_SIZE drm/amdgpu: save ring content before resetting the device drm/amdgpu: make userq fence_drv drop explicit in queue destroy drm/amdgpu: rework userq fence driver alloc/destroy drm/amdgpu/userq: use dma_fence_wait_timeout without test for signalled drm/amdgpu/userq: call dma_resv_wait_timeout without test for signalled drm/amdgpu/userq: add the return code too in error condition drm/amdgpu/userq: fence wait for max time in amdgpu_userq_wait_for_signal drm/amd/display: Change dither policy for 10 bpc output back to dithering ... commit 453553e1ed53ca364454e155ba33e110d02c75cd Author: Masami Hiramatsu (Google) Date: Mon Apr 20 23:01:43 2026 +0900 selftests/ftrace: Add a testcase for multiple fprobe events Add a testcase for multiple fprobe events on the same function so that it clears ftrace hash map correctly when removing the events. Link: https://lore.kernel.org/all/177669370353.132053.16801520791509406141.stgit@mhiramat.tok.corp.google.com/ Signed-off-by: Masami Hiramatsu (Google) commit 132001e9f90e577d002e0ba613205340c579921f Author: Masami Hiramatsu (Google) Date: Mon Apr 20 23:01:35 2026 +0900 selftests/ftrace: Add a testcase for fprobe events on module Add a testcase for fprobe events on module, which unloads a kernel module on which fprobe events are probing and ensure the ftrace hash map is cleared correctly. Link: https://lore.kernel.org/all/177669369564.132053.623527664540176496.stgit@mhiramat.tok.corp.google.com/ Signed-off-by: Masami Hiramatsu (Google) commit 476c5bbae65c9ab60b61fca9abd72df75a077183 Author: Masami Hiramatsu (Google) Date: Mon Apr 20 23:01:27 2026 +0900 tracing/fprobe: Fix to unregister ftrace_ops if it is empty on module unloading Fix fprobe to unregister ftrace_ops if corresponding type of fprobe does not exist on the fprobe_ip_table and it is expected to be empty when unloading modules. Since ftrace thinks that the empty hash means everything to be traced, if we set fprobes only on the unloaded module, all functions are traced unexpectedly after unloading module. e.g. # modprobe xt_LOG.ko # echo 'f:test log_tg*' > dynamic_events # echo 1 > events/fprobes/test/enable # cat enabled_functions log_tg [xt_LOG] (1) tramp: 0xffffffffa0004000 (fprobe_ftrace_entry+0x0/0x490) ->fprobe_ftrace_entry+0x0/0x490 log_tg_check [xt_LOG] (1) tramp: 0xffffffffa0004000 (fprobe_ftrace_entry+0x0/0x490) ->fprobe_ftrace_entry+0x0/0x490 log_tg_destroy [xt_LOG] (1) tramp: 0xffffffffa0004000 (fprobe_ftrace_entry+0x0/0x490) ->fprobe_ftrace_entry+0x0/0x490 # rmmod xt_LOG # wc -l enabled_functions 34085 enabled_functions Link: https://lore.kernel.org/all/177669368776.132053.10042301916765771279.stgit@mhiramat.tok.corp.google.com/ Signed-off-by: Masami Hiramatsu (Google) commit b1137e0b3d4bad1cad73fa9bac763c74ddd1813d Author: Alex Markuze Date: Tue Feb 10 09:06:26 2026 +0000 ceph: add subvolume metrics collection and reporting Add complete infrastructure for per-subvolume I/O metrics collection and reporting to the MDS. This enables administrators to monitor I/O patterns at the subvolume granularity, which is useful for multi-tenant CephFS deployments. This patch adds: - CEPHFS_FEATURE_SUBVOLUME_METRICS feature flag for MDS negotiation - CEPH_SUBVOLUME_ID_NONE constant (0) for unknown/unset state - Red-black tree based metrics tracker for efficient per-subvolume aggregation with kmem_cache for entry allocations - Wire format encoding matching the MDS C++ AggregatedIOMetrics struct - Integration with the existing CLIENT_METRICS message - Recording of I/O operations from file read/write and writeback paths - Debugfs interfaces for monitoring (metrics/subvolumes, metrics/metric_features) Metrics tracked per subvolume include: - Read/write operation counts - Read/write byte counts - Read/write latency sums (for average calculation) The metrics are periodically sent to the MDS as part of the existing metrics reporting infrastructure when the MDS advertises support for the SUBVOLUME_METRICS feature. CEPH_SUBVOLUME_ID_NONE enforces subvolume_id immutability. Following the FUSE client convention, 0 means unknown/unset. Once an inode has a valid (non-zero) subvolume_id, it should not change during the inode's lifetime. Signed-off-by: Alex Markuze Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 4a1c5434792df72c4df6225fb697494a2405a137 Author: Alex Markuze Date: Tue Feb 10 09:06:25 2026 +0000 ceph: parse subvolume_id from InodeStat v9 and store in inode Add support for parsing the subvolume_id field from InodeStat v9 and storing it in the inode for later use by subvolume metrics tracking. The subvolume_id identifies which CephFS subvolume an inode belongs to, enabling per-subvolume I/O metrics collection and reporting. This patch: - Adds subvolume_id field to struct ceph_mds_reply_info_in - Adds i_subvolume_id field to struct ceph_inode_info - Parses subvolume_id from v9 InodeStat in parse_reply_info_in() - Adds ceph_inode_set_subvolume() helper to propagate the ID to inodes - Initializes i_subvolume_id in inode allocation and clears on destroy Signed-off-by: Alex Markuze Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit e58103cafff2e3ee2196d6d3347fc47d6e0a047a Author: Alex Markuze Date: Tue Feb 10 09:06:24 2026 +0000 ceph: handle InodeStat v8 versioned field in reply parsing Add forward-compatible handling for the new versioned field introduced in InodeStat v8. This patch only skips the field without using it, preparing for future protocol extensions. The v8 encoding adds a versioned sub-structure that needs to be properly decoded and skipped to maintain compatibility with newer MDS versions. Signed-off-by: Alex Markuze Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 1c439de70b1c3eb3c6bffa8245c16b9fc318f114 Author: Raphael Zimmer Date: Tue Apr 21 10:27:01 2026 +0200 libceph: Fix slab-out-of-bounds access in auth message processing If a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY contains a positive value in its result field, it is treated as an error code by ceph_handle_auth_reply() and returned to handle_auth_reply(). Thereafter, an attempt is made to send the preallocated message of type CEPH_MSG_AUTH, where the returned value is interpreted as the size of the front segment to send. If the result value in the message is greater than the size of the memory buffer allocated for the front segment, an out-of-bounds access occurs, and the content of the memory region beyond this buffer is sent out. This patch fixes the issue by treating only negative values in the result field as errors. Positive values are therefore treated as success in the same way as a zero value. Additionally, a BUG_ON is added to __send_prepared_auth_request() comparing the len parameter to front_alloc_len to prevent sending the message if it exceeds the bounds of the allocation and to make it easier to catch any logic flaws leading to this. Cc: stable@vger.kernel.org Signed-off-by: Raphael Zimmer Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit d1fef92e414433ca7b89abf85cb0df42b8d475eb Author: Dawei Feng Date: Sun Apr 19 17:03:48 2026 +0800 rbd: fix null-ptr-deref when device_add_disk() fails do_rbd_add() publishes the device with device_add() before calling device_add_disk(). If device_add_disk() fails after device_add() succeeds, the error path calls rbd_free_disk() directly and then later falls through to rbd_dev_device_release(), which calls rbd_free_disk() again. This double teardown can leave blk-mq cleanup operating on invalid state and trigger a null-ptr-deref in __blk_mq_free_map_and_rqs(), reached from blk_mq_free_tag_set(). Fix this by following the normal remove ordering: call device_del() before rbd_dev_device_release() when device_add_disk() fails after device_add(). That keeps the teardown sequence consistent and avoids re-entering disk cleanup through the wrong path. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. We reproduced the bug on v7.0 with a real Ceph backend and a QEMU x86_64 guest booted with KASAN and CONFIG_FAILSLAB enabled. The reproducer confines failslab injections to the __add_disk() range and injects fail-nth while mapping an RBD image through /sys/bus/rbd/add_single_major. On the unpatched kernel, fail-nth=4 reliably triggered the fault: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 273 Comm: bash Not tainted 7.0.0-01247-gd60bc1401583 #6 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:__blk_mq_free_map_and_rqs+0x8c/0x240 Code: 00 00 48 8b 6b 60 41 89 f4 49 c1 e4 03 4c 01 e5 45 85 ed 0f 85 0a 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 e9 48 c1 e9 03 <80> 3c 01 00 0f 85 31 01 00 00 4c 8b 6d 00 4d 85 ed 0f 84 e2 00 00 RSP: 0018:ff1100000ab0fac8 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ff1100000c4806a0 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000000 RDI: ff1100000c4806f4 RBP: 0000000000000000 R08: 0000000000000001 R09: ffe21c000189001b R10: ff1100000c4800df R11: ff1100006cf37be0 R12: 0000000000000000 R13: 0000000000000000 R14: ff1100000c480700 R15: ff1100000c480004 FS: 00007f0fbe8fe740(0000) GS:ff110000e5851000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe53473b2e0 CR3: 0000000012eef000 CR4: 00000000007516f0 PKRU: 55555554 Call Trace: blk_mq_free_tag_set+0x77/0x460 do_rbd_add+0x1446/0x2b80 ? __pfx_do_rbd_add+0x10/0x10 ? lock_acquire+0x18c/0x300 ? find_held_lock+0x2b/0x80 ? sysfs_file_kobj+0xb6/0x1b0 ? __pfx_sysfs_kf_write+0x10/0x10 kernfs_fop_write_iter+0x2f4/0x4a0 vfs_write+0x98e/0x1000 ? expand_files+0x51f/0x850 ? __pfx_vfs_write+0x10/0x10 ksys_write+0xf2/0x1d0 ? __pfx_ksys_write+0x10/0x10 do_syscall_64+0x115/0x690 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0fbea15907 Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007ffe22346ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f0fbea15907 RDX: 0000000000000058 RSI: 0000563ace6c0ef0 RDI: 0000000000000001 RBP: 0000563ace6c0ef0 R08: 0000563ace6c0ef0 R09: 6b6435726d694141 R10: 5250337279762f78 R11: 0000000000000246 R12: 0000000000000058 R13: 00007f0fbeb1c780 R14: ff1100000c480700 R15: ff1100000c480004 With this fix applied, rerunning the reproducer over fail-nth=1..256 yields no KASAN reports. [ idryomov: rename err_out_device_del -> err_out_device ] Cc: stable@vger.kernel.org Fixes: 27c97abc30e2 ("rbd: add add_disk() error handling") Signed-off-by: Zilin Guan Signed-off-by: Dawei Feng Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 3a2e519cd4332576989c0985b3e61ac08eb2b458 Author: Viacheslav Dubeyko Date: Mon Mar 30 13:46:53 2026 -0700 crush: cleanup in crush_do_rule() method Commit 41ebcc0907c5 ("crush: remove forcefeed functionality") from May 7, 2012 (linux-next), leads to the following Smatch static checker warning: net/ceph/crush/mapper.c:1015 crush_do_rule() warn: iterator 'j' not incremented Before commit 41ebcc0907c5 ("crush: remove forcefeed functionality"), we had this logic: j = 0; if (osize == 0 && force_pos >= 0) { o[osize] = force_context[force_pos]; if (recurse_to_leaf) c[osize] = force_context[0]; j++; /* <-- this was the only increment, now gone */ force_pos--; } /* then crush_choose_*(..., o+osize, j, ...) */ Now, the variable j is dead code — a variable that is set and never meaningfully varied. This patch simply removes the dead code. Reported-by: Dan Carpenter Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit cc5643095419d45927a1dee9cb3da7c2f9e779f6 Author: Max Kellermann Date: Mon Mar 30 10:43:19 2026 +0200 ceph: clear s_cap_reconnect when ceph_pagelist_encode_32() fails This MDS reconnect error path leaves s_cap_reconnect set. send_mds_reconnect() sets the bit at the beginning of the reconnect, but the first failing operation after that, ceph_pagelist_encode_32(), can jump to `fail:` without clearing it. __ceph_remove_cap() consults that flag to decide whether cap releases should be queued. A reconnect-preparation failure therefore leaves the session in reconnect mode from the cap-release path's point of view and can strand release work until some later state transition repairs it. Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 803447f93d75ab6e40c85e6d12b5630d281d70d6 Author: Max Kellermann Date: Fri Mar 27 17:23:08 2026 +0100 ceph: only d_add() negative dentries when they are unhashed Ceph can call d_add(dentry, NULL) on a negative dentry that is already present in the primary dcache hash. In the current VFS that is not safe. d_add() goes through __d_add() to __d_rehash(), which unconditionally reinserts dentry->d_hash into the hlist_bl bucket. If the dentry is already hashed, reinserting the same node can corrupt the bucket, including creating a self-loop. Once that happens, __d_lookup() can spin forever in the hlist_bl walk, typically looping only on the d_name.hash mismatch check and eventually triggering RCU stall reports like this one: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829 rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192) CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023 RIP: 0010:__d_lookup+0x46/0xb0 Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f RSP: 0018:ff745a70c8253898 EFLAGS: 00000282 RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966 RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0 RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89 R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0 R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0 PKRU: 55555554 Call Trace: lookup_fast+0x9f/0x100 walk_component+0x1f/0x150 link_path_walk+0x20e/0x3d0 path_lookupat+0x68/0x180 filename_lookup+0xdc/0x1e0 vfs_statx+0x6c/0x140 vfs_fstatat+0x67/0xa0 __do_sys_newfstatat+0x24/0x60 do_syscall_64+0x6a/0x230 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is reachable with reused cached negative dentries. A Ceph lookup or atomic_open can be handed a negative dentry that is already hashed, and fs/ceph/dir.c then hits one of two paths that incorrectly assume "negative" also means "unhashed": - ceph_finish_lookup(): MDS reply is -ENOENT with no trace -> d_add(dentry, NULL) - ceph_lookup(): local ENOENT fast path for a complete directory with shared caps -> d_add(dentry, NULL) Both paths can therefore re-add an already-hashed negative dentry. Ceph already uses the correct pattern elsewhere: ceph_fill_trace() only calls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn) is true. Fix both fs/ceph/dir.c sites the same way: only call d_add() for a negative dentry when it is actually unhashed. If the negative dentry is already hashed, leave it in place and reuse it as-is. This preserves the existing behavior for unhashed dentries while avoiding d_hash list corruption for reused hashed negatives. Cc: stable@vger.kernel.org Fixes: 2817b000b02c ("ceph: directory operations") Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit eff0e55f90b0c4a005b04fd0598fe70260ed4e7d Author: kexinsun Date: Mon Feb 23 21:15:07 2026 +0800 libceph: update outdated comment in ceph_sock_write_space() The function try_write() was renamed to ceph_con_v1_try_write() in commit 566050e17e53 ("libceph: separate msgr1 protocol implementation") and subsequently moved to net/ceph/messenger_v1.c in commit 2f713615ddd9 ("libceph: move msgr1 protocol implementation to its own file"). Update the comment in ceph_sock_write_space() accordingly. [ idryomov: account for msgr2 in the updated comment as well ] Signed-off-by: kexinsun Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit c7aac00c2c1dc8f6cb66ce10c730e0cd871408bf Author: Eric Biggers Date: Sat Mar 14 14:25:19 2026 -0700 libceph: Remove obsolete session key alignment logic Since the call to crypto_shash_setkey() was replaced with hmac_sha256_preparekey() which doesn't allocate memory regardless of the alignment of the input key, remove the session key alignment logic from process_auth_done(). Also remove the inclusion of crypto/hash.h, which is no longer needed since crypto_shash is no longer used. [ idryomov: rewrap comment ] Signed-off-by: Eric Biggers Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit a0d9555bf9eaeba34fe6b6bb86f442fe08ba3842 Author: Sam Edwards Date: Tue Mar 17 19:37:33 2026 -0700 ceph: fix num_ops off-by-one when crypto allocation fails move_dirty_folio_in_page_array() may fail if the file is encrypted, the dirty folio is not the first in the batch, and it fails to allocate a bounce buffer to hold the ciphertext. When that happens, ceph_process_folio_batch() simply redirties the folio and flushes the current batch -- it can retry that folio in a future batch. However, if this failed folio is not contiguous with the last folio that did make it into the batch, then ceph_process_folio_batch() has already incremented `ceph_wbc->num_ops`; because it doesn't follow through and add the discontiguous folio to the array, ceph_submit_write() -- which expects that `ceph_wbc->num_ops` accurately reflects the number of contiguous ranges (and therefore the required number of "write extent" ops) in the writeback -- will panic the kernel: BUG_ON(ceph_wbc->op_idx + 1 != req->r_num_ops); This issue can be reproduced on affected kernels by writing to fscrypt-enabled CephFS file(s) with a 4KiB-written/4KiB-skipped/repeat pattern (total filesize should not matter) and gradually increasing the system's memory pressure until a bounce buffer allocation fails. Fix this crash by decrementing `ceph_wbc->num_ops` back to the correct value when move_dirty_folio_in_page_array() fails, but the folio already started counting a new (i.e. still-empty) extent. The defect corrected by this patch has existed since 2022 (see first `Fixes:`), but another bug blocked multi-folio encrypted writeback until recently (see second `Fixes:`). The second commit made it into 6.18.16, 6.19.6, and 7.0-rc1, unmasking the panic in those versions. This patch therefore fixes a regression (panic) introduced by cac190c7674f. Cc: stable@vger.kernel.org Fixes: d55207717ded ("ceph: add encryption support to writepage and writepages") Fixes: cac190c7674f ("ceph: fix write storm on fscrypted files") Signed-off-by: Sam Edwards Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 5199c125d25aeae8615c4fc31652cc0fe624338e Author: Raphael Zimmer Date: Wed Mar 18 18:09:03 2026 +0100 libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() If a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both protocol and result, this is currently not treated as an error. In case of ac->negotiating == true and ac->protocol > 0, this leads to setting ac->protocol = 0 and ac->ops = NULL. Thereafter, the check for ac->protocol != protocol returns false, and init_protocol() is not called. Subsequently, ac->ops->handle_reply() is called, which leads to a null pointer dereference, because ac->ops is still NULL. This patch changes the check for ac->protocol != protocol to !ac->protocol, as this also includes the case when the protocol was set to zero in the message. This causes the message to be treated as containing a bad auth protocol. Cc: stable@vger.kernel.org Signed-off-by: Raphael Zimmer Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 932d922285ef4d0d655a6f5def2779ae86ca0d73 Author: Dave Hansen Date: Tue Apr 21 09:31:36 2026 -0700 x86/cpu: Disable FRED when PTI is forced on FRED and PTI were never intended to work together. No FRED hardware is vulnerable to Meltdown and all of it should have LASS anyway. Nevertheless, if you boot a system with pti=on and fred=on, the kernel tries to do what is asked of it and dies a horrible death on the first attempt to run userspace (since it never switches to the user page tables). Disable FRED when PTI is forced on, and print a warning about it. A quick brain dump about what a FRED+PTI implementation would look like is below. I'm not sure it would make any sense to do it, but never say never. All I know is that it's way too complicated to be worth it today. The SWITCH_TO_USER/KERNEL_CR3 bits are simple to fix (or at least we have the assembly tools to do it already), as is sticking the FRED entry text in .entry.text (it's not in there today). The nasty part is the stacks. Today, the CPU pops into the kernel on MSR_IA32_FRED_RSP0 which is normal old kernel memory and not mapped to userspace. The hardware pushes gunk on to MSR_IA32_FRED_RSP0, which is currently the task stacks. MSR_IA32_FRED_RSP0 would need to point elsewhere, probably cpu_entry_stack(). Then, start playing games with stacks on entry/exit, including copying gunk to and from the task stack. While I'd *like* to have PTI everywhere, I'm not sure it's worth mucking up the FRED code with PTI kludges. If a user wants fast entry/exit, they use FRED. If you want PTI (and sekuritay), you certainly don't care about fast entry and FRED isn't going to help you *all* that much, so you can just stay with the IDT. Plus, FRED hardware should have LASS which gives you a similar security profile to PTI without the CR3 munging. Reported-by: Gayatri Kammela Signed-off-by: Dave Hansen Reviewed-by: Borislav Petkov (AMD) Tested-by: Maciej Wieczor-Retman Cc:stable@vger.kernel.org Link: https://patch.msgid.link/20260421163136.E7C6788A@davehans-spike.ostc.intel.com commit d46dd0d88341e45f8e0226fdef5462f5270898fc Merge: bb0bc49a1cef57 cb8ff3ead9a3fc Author: Linus Torvalds Date: Tue Apr 21 14:50:04 2026 -0700 Merge tag 'f2fs-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this round, the changes primarily focus on resolving race conditions, memory safety issues (UAF), and improving the robustness of garbage collection (GC), and folio management. Enhancements: - add page-order information for large folio reads in iostat - add defrag_blocks sysfs node Bug fixes: - fix uninitialized kobject put in f2fs_init_sysfs() - disallow setting an extension to both cold and hot - fix node_cnt race between extent node destroy and writeback - preserve previous reserve_{blocks,node} value when remount - freeze GC and discard threads quickly - fix false alarm of lockdep on cp_global_sem lock - fix data loss caused by incorrect use of nat_entry flag - skip empty sections in f2fs_get_victim - fix inline data not being written to disk in writeback path - fix fsck inconsistency caused by FGGC of node block - fix fsck inconsistency caused by incorrect nat_entry flag usage - call f2fs_handle_critical_error() to set cp_error flag - fix fiemap boundary handling when read extent cache is incomplete - fix use-after-free of sbi in f2fs_compress_write_end_io() - fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - fix incorrect file address mapping when inline inode is unwritten - fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled - avoid memory leak in f2fs_rename()" * tag 'f2fs-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (35 commits) f2fs: add page-order information for large folio reads in iostat f2fs: do not support mmap write for large folio f2fs: fix uninitialized kobject put in f2fs_init_sysfs() f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() f2fs: disallow setting an extension to both cold and hot f2fs: fix node_cnt race between extent node destroy and writeback f2fs: allow empty mount string for Opt_usr|grp|projjquota f2fs: fix to preserve previous reserve_{blocks,node} value when remount f2fs: invalidate block device page cache on umount f2fs: fix to freeze GC and discard threads quickly f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer f2fs: fix false alarm of lockdep on cp_global_sem lock f2fs: fix data loss caused by incorrect use of nat_entry flag f2fs: fix to skip empty sections in f2fs_get_victim f2fs: fix inline data not being written to disk in writeback path f2fs: fix fsck inconsistency caused by FGGC of node block f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally f2fs: refactor node footer flag setting related code f2fs: refactor f2fs_move_node_folio function ... commit 3ae6bafa104d93ddc525b8de547bf66b43fcaf10 Author: Len Brown Date: Tue Apr 21 17:26:33 2026 -0400 tools/power turbostat: Fix AMD RAPL regression on big systems turbostat.c:8688: rapl_perf_init: Assertion `next_domain < num_domains' failed. The initial fix for this regression was incomplete, as it did not handle multi-package systems with sparse core ids. Fixes: ef0e60083f76 ("tools/power turbostat: Fix AMD RAPL regression") Signed-off-by: Len Brown commit bb0bc49a1cef574646eb25d74709c5ff200903a8 Merge: c94faa7cc41469 45df9111692c62 Author: Linus Torvalds Date: Tue Apr 21 14:12:01 2026 -0700 Merge tag 'libnvdimm-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull dax updates from Ira Weiny: "The series adds DAX support required for the upcoming fuse/famfs file system.[1] The support here is required because famfs is backed by devdax rather than pmem. This all lays the groundwork for using shared memory as a file system" Link: https://lore.kernel.org/all/0100019d43e5f632-f5862a3e-361c-4b54-a9a6-96c242a8f17a-000000@email.amazonses.com/ [1] * tag 'libnvdimm-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: dax/fsdev: fix uninitialized kaddr in fsdev_dax_zero_page_range() dax: export dax_dev_get() dax: Add fs_dax_get() func to prepare dax for fs-dax usage dax: Add dax_set_ops() for setting dax_operations at bind time dax: Add dax_operations for use by fs-dax on fsdev dax dax: Save the kva from memremap dax: add fsdev.c driver for fs-dax on character dax dax: Factor out dax_folio_reset_order() helper dax: move dax_pgoff_to_phys from [drivers/dax/] device.c to bus.c commit 11b31549b6d6ccf9861787de5606d1b9384a8a58 Author: Timur Kristóf Date: Tue Apr 21 01:55:04 2026 +0200 drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x DCE 6.x doesn't support 10-bit truncation and 10-bit dithering because the following fields are 1-bit only: FMT_TEMPORAL_DITHER_DEPTH FMT_SPATIAL_DITHER_DEPTH FMT_TRUNCATE_DEPTH Programming these fields to "2" will program them as if the dithering option was 6-bit, resulting in sub-par picture quality and an ugly "color banding" effect. Note that a recent commit changed the default 10-bit dithering option to DITHER_OPTION_SPATIAL10 which improves the picture quality because it happens to look better, but is still not actually supported by DCE 6.x versions. When the color depth is 10-bit or more, just disable any kind of dithering options on DCE 6.x. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5151 Fixes: 529cad0f945c ("drm/amd/display: Add function to set dither option") Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 6be8ced880dfe29ce38c2d5e74489822da5c250e) commit 778bf584f2fb0a2b09594f568faf400bf6858091 Author: Siwei He Date: Tue Apr 14 14:46:54 2026 -0400 drm/amdgpu: OR init_pte_flags into invalid leaf PTE updates Invalid leaf clears that only set AMDGPU_PTE_EXECUTABLE match the old GMC9 fault-priority workaround but omit adev->gmc.init_pte_flags. On GFX12 that includes AMDGPU_PTE_IS_PTE; without it, some cleared PTEs can fault as no-retry and bypass the SVM/XNACK handler when a VA is reused after a BO unmap. Apply init_pte_flags in amdgpu_vm_pte_update_flags() alongside EXECUTABLE so range-driven clears (e.g. amdgpu_vm_clear_freed) match amdgpu_vm_pt_clear() for leaf templates. Signed-off-by: Siwei He Reviewed-by: Philip Yang Signed-off-by: Alex Deucher (cherry picked from commit 9d47b2c36b9a6c6b844c33cab407a5d7ad102234) commit c94faa7cc414698d7c32cd43b7d02f34709a71f6 Merge: e2683c8868d033 e252ed8988578f Author: Linus Torvalds Date: Tue Apr 21 14:03:10 2026 -0700 Merge tag 'pull-coda' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull coda dcache updates from Al Viro: "Coda dcache-related cleanups and fixes" * tag 'pull-coda' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: coda_flag_children(): fix a UAF sanitize coda_dentry_delete() coda: is_bad_inode() is always false there commit 0e48f27d139ecb5a3ea9123243558abb3f022765 Author: Mario Limonciello Date: Sat Apr 18 23:16:52 2026 -0500 drm/amd: Adjust ASPM support quirk to cover more Intel hosts Some of the same issues identified in commit c770ef19673fb ("drm/amd/amdgpu: disable ASPM in some situations") also affect Tiger Lake systems with GFX11 connected over USB4. Widen the net to also match these hosts. Fixes: d9b3a066dfcd ("drm/amd: Exclude dGPUs in eGPU enclosures from DPM quirks") Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5145 Reviewed-by: Yang Wang Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 0a214d888485b9f35fe03882a92962e6d5697849) commit 49ed6f45402ddefc630ebe5d553cf32fe93e1d4c Author: Leo Li Date: Fri Apr 17 13:54:30 2026 -0400 drm/amd/display: Undo accidental fix revert in amdgpu_dm_ism.c [Why] Pausing DPM power profiles during static screen caused a bunch of audio/performance/clock issues that were addressed in this fix: 'commit 1412482b7143 ("Revert "drm/amd/display: pause the workload setting in dm"")' This logic in function amdgpu_dm_crtc_vblank_control_worker() was moved to amdgpu_dm_ism.c, but the fix was lost in the process. [How] Reapply the fix to amdgpu_dm_ism.c Fixes: 754003486c3c ("drm/amd/display: Add Idle state manager(ISM)") Reviewed-by: Alex Deucher Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Leo Li Signed-off-by: Alex Deucher (cherry picked from commit bc621e91d6fc004cfae9148c5a91acad19ada3e4) commit e2683c8868d03382da7e1ce8453b543a043066d1 Merge: 6fdca3c5ab55d6 e9af4f47d4a036 Author: Linus Torvalds Date: Tue Apr 21 11:46:22 2026 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull more crypto library updates from Eric Biggers: "Crypto library fix and documentation update: - Fix an integer underflow in the mpi library - Improve the crypto library documentation" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: docs: Add rst documentation to Documentation/crypto/ docs: kdoc: Expand 'at_least' when creating parameter list lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() commit 770594e78c3964cf23cf5287f849437cdde9b7d0 Author: Pavel Begunkov Date: Tue Apr 21 09:45:29 2026 +0100 io_uring/zcrx: warn on freelist violations The freelist is appropriately sized to always be able to take a free niov, but let's be more defensive and check the invariant with a warning. That should help to catch any double-free issues. Suggested-by: Kai Aizen Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/2f3cea363b04649755e3b6bb9ab66485a95936d5.1776760901.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 4f02cc4071a18c78bfff571d796edef055d57daa Author: Pavel Begunkov Date: Tue Apr 21 09:46:44 2026 +0100 io_uring/zcrx: clear RQ headers on init It might be unexpected to users if the RQ head/tail after a ring creation are not zeroed, fix that. Cc: stable@vger.kernel.org Fixes: 6f377873cb239 ("io_uring/zcrx: add interface queue and refill queue") Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/331f94663c3e8f021ffa3cb770ca2844a07d4855.1776760911.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 0fcccfd87152f957fa8312b841f6efef42a05a20 Author: Pavel Begunkov Date: Tue Apr 21 09:47:04 2026 +0100 io_uring/zcrx: fix user_struct uaf io_free_rbuf_ring() usees a struct user_struct, which io_zcrx_ifq_free() puts it down before destroying the ring. Cc: stable@vger.kernel.org Fixes: 5c686456a4e83 ("io_uring/zcrx: add user_struct and mm_struct to io_zcrx_ifq") Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/e560ae00960d27a810522a7efc0e201c82dff351.1776760917.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 45cd95763e198d74d369ede43aef0b1955b8dea4 Author: Jens Axboe Date: Mon Apr 20 13:41:38 2026 -0600 io_uring/register: fix ring resizing with mixed/large SQEs/CQEs The ring resizing only properly handles "normal" sized SQEs or CQEs, if there are pending entries around a resize. This normally should not be the case, but the code is supposed to handle this regardless. For the mixed SQE/CQE cases, the current copying works fine as they are indexed in the same way. Each half is just copied separately. But for fixed large SQEs and CQEs, the iteration and copy need to take that into account. Cc: stable@kernel.org Fixes: 79cfe9e59c2a ("io_uring/register: add IORING_REGISTER_RESIZE_RINGS") Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit 7faaa6812aba550c24bffdfd9399568223c8a477 Author: Jens Axboe Date: Mon Apr 20 14:24:50 2026 -0600 io_uring/futex: ensure partial wakes are appropriately dequeued If a FUTEX_WAITV vectored operation is only partially woken, we should call __futex_wake_mark() on the queue to account for that. If not, then a later wakeup will wake the same entry, rather than the next one in line. Fixes: 8f350194d5cfd ("io_uring: add support for vectored futex waits") Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit 79968834558774bdc5de4b5503d412df632646aa Author: Jens Axboe Date: Mon Apr 20 13:16:19 2026 -0600 io_uring/rw: add defensive hardening for negative kbuf lengths No real bug here, just being a bit defensive in ensuring that whatever gets passed into io_put_kbuf() is always >= 0 and not some random error value. Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit 02b8d41c17630493f63c7785c873e327fa9b76a6 Author: Jens Axboe Date: Mon Apr 20 13:15:41 2026 -0600 io_uring/rsrc: use kvfree() for the imu cache Currently anything that requires kvmalloc_flex() for allocations will not get re-cached, and hence the cache freeing path is correct in that it always uses kfree() to free the allocated memory. But this seems a bit fragile as it's something that could get mix should that situation change, so switch io_free_imu() and io_alloc_cache_free() to use kvfree as the desctructor. Signed-off-by: Jens Axboe commit 53262c91f7b81f96495ff24e9d1fa8b1632e69c8 Author: Jens Axboe Date: Mon Apr 20 13:14:54 2026 -0600 io_uring/rsrc: unify nospec indexing for direct descriptors For file updates, the node reset isn't capping the value via array_index_nospec() like the other paths do. Ensure it's all sane and have the update path do the proper capping as well. Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit 8e1f412b5bc690cb72b3303a1ae0d42955e5e2b3 Author: Jens Axboe Date: Mon Apr 20 14:06:00 2026 +0000 io_uring: fix spurious fput in registered ring path Fix an issue with io_uring_ctx_get_file() not gating fput() on whether or not the file descriptor is a registered/direct one or not. Fixes: c5e9f6a96bf7 ("io_uring: unify getting ctx from passed in file descriptor") Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit 6fdca3c5ab55d6a74277efcae2db9828f567a06a Merge: 4ee64205ffaa58 2d8c7edcb66181 Author: Linus Torvalds Date: Tue Apr 21 11:16:04 2026 -0700 Merge tag 'erofs-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Fix dirent nameoff handling to avoid out-of-bound reads out of crafted images - Fix two type truncation issues on 32-bit platforms * tag 'erofs-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: unify lcn as u64 for 32-bit platforms erofs: fix offset truncation when shifting pgoff on 32-bit platforms erofs: fix the out-of-bounds nameoff handling for trailing dirents commit 30471982cd667972ba93ce894765d4b8544958e6 Author: Alex Williamson Date: Fri Apr 17 14:27:58 2026 -0600 vfio/cdx: Consolidate MSI configured state onto cdx_irqs struct vfio_cdx_device carries three fields that track whether MSI has been configured: vdev->cdx_irqs (the allocated vector array), vdev-> msi_count (the array length), and vdev->config_msi (a boolean flag). The three are set together when vfio_cdx_msi_enable() succeeds and cleared together by vfio_cdx_msi_disable(). However, the error paths in vfio_cdx_msi_enable() free the cdx_irqs allocation on failure without resetting the pointer, leaving it stale and skewed from the other two fields until the next enable call overwrites it. Clear vdev->cdx_irqs to NULL alongside the kfree() in both error paths so the pointer consistently reflects the configured state. With that invariant restored and access to the MSI state serialized by cdx_irqs_lock, vdev->config_msi is fully redundant with (vdev->cdx_irqs != NULL). Drop the config_msi field and switch all readers to test cdx_irqs directly. Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Alex Williamson Acked-by: Nikhil Agarwal Link: https://lore.kernel.org/r/20260417202800.88287-4-alex.williamson@nvidia.com Signed-off-by: Alex Williamson commit 670e8864b1a218d72f08db40d0103adf38fa1d9b Author: Alex Williamson Date: Fri Apr 17 14:27:57 2026 -0600 vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex vfio_cdx_set_msi_trigger() reads vdev->config_msi and operates on the vdev->cdx_irqs array based on its value, but provides no serialization against concurrent VFIO_DEVICE_SET_IRQS ioctls. Two callers can race such that one observes config_msi as set while another clears it and frees cdx_irqs via vfio_cdx_msi_disable(), resulting in a use-after-free of the cdx_irqs array. Add a cdx_irqs_lock mutex to struct vfio_cdx_device and acquire it in vfio_cdx_set_msi_trigger(), which is the single chokepoint through which all updates to config_msi, cdx_irqs, and msi_count flow, covering both the ioctl path and the close-device cleanup path. This keeps the test of config_msi atomic with the subsequent enable, disable, or trigger operations. Drop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() as part of this change: the optimization it provided is redundant with the !config_msi early-return inside vfio_cdx_msi_disable(), and leaving the test in place would be an unsynchronized read of state the new lock is meant to protect. Fixes: 848e447e000c ("vfio/cdx: add interrupt support") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Alex Williamson Acked-by: Nikhil Agarwal Link: https://lore.kernel.org/r/20260417202800.88287-3-alex.williamson@nvidia.com Signed-off-by: Alex Williamson commit 5ea5880764cbb164afb17a62e76ca75dc371409d Author: Prasanna Kumar T S M Date: Fri Apr 17 14:27:56 2026 -0600 vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Add validation to ensure MSI is configured before accessing cdx_irqs array in vfio_cdx_set_msi_trigger(). Without this check, userspace can trigger a NULL pointer dereference by calling VFIO_DEVICE_SET_IRQS with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before ever setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD. The vfio_cdx_msi_enable() function allocates the cdx_irqs array and sets config_msi to 1 only when called through the EVENTFD path. The trigger loop (for DATA_BOOL/DATA_NONE) assumed this had already been done, but there was no enforcement of this call ordering. This matches the protection used in the PCI VFIO driver where vfio_pci_set_msi_trigger() checks irq_is() before the trigger loop. Fixes: 848e447e000c ("vfio/cdx: add interrupt support") Cc: stable@vger.kernel.org Signed-off-by: Prasanna Kumar T S M Acked-by: Nipun Gupta Signed-off-by: Alex Williamson Acked-by: Nikhil Agarwal Link: https://lore.kernel.org/r/20260417202800.88287-2-alex.williamson@nvidia.com Signed-off-by: Alex Williamson commit 64965b8a4274b82330433fe8888d999506a81a94 Author: Alex Williamson Date: Fri Apr 17 09:28:12 2026 -0600 vfio: replace vfio->device_class with a const struct class The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Replace vfio->device_class with a const struct class and drop the class_create() call. Compile tested with both CONFIG_VFIO_DEVICE_CDEV on and off (and CONFIG_VFIO on); found no errors/warns in dmesg. Link: https://lore.kernel.org/all/2023040244-duffel-pushpin-f738@gregkh/ Suggested-by: Greg Kroah-Hartman Signed-off-by: Jori Koolstra [Remove unused vfio_cdev_init() args] Signed-off-by: Alex Williamson Link: https://lore.kernel.org/r/20260417152814.18026-1-alex.williamson@nvidia.com Signed-off-by: Alex Williamson commit b0eab97305ae97190a605117095d84f12ecef187 Author: Alex Williamson Date: Tue Apr 14 14:06:22 2026 -0600 vfio/virtio: Use guard() for bar_mutex in legacy I/O Convert the bar_mutex acquisition in virtiovf_issue_legacy_rw_cmd() to use guard(), eliminating the out label and goto-based error paths in favor of direct returns. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Alex Williamson Reviewed-by: Yishai Hadas Link: https://lore.kernel.org/r/20260414200625.3601509-5-alex.williamson@nvidia.com Signed-off-by: Alex Williamson commit b5b268cb7868b598e53eeebd36174c8b27d4cd86 Author: Alex Williamson Date: Tue Apr 14 14:06:21 2026 -0600 vfio/virtio: Use guard() for migf->lock where applicable Convert migf->lock acquisitions in virtiovf_disable_fd() and virtiovf_save_read() to use guard(). In virtiovf_save_read() this eliminates the out_unlock label and multiple goto paths by allowing direct returns, and removes the need for the done variable to double as an error carrier. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Alex Williamson Reviewed-by: Yishai Hadas Link: https://lore.kernel.org/r/20260414200625.3601509-4-alex.williamson@nvidia.com Signed-off-by: Alex Williamson commit 61fcb51fc9d576ec367e8aea9c03dc6a746e395e Author: Alex Williamson Date: Tue Apr 14 14:06:20 2026 -0600 vfio/virtio: Use guard() for list_lock where applicable Convert list_lock mutex acquisitions to use guard() and scoped_guard() where the lock scope aligns with the function or block scope. This simplifies virtiovf_get_data_buff_from_pos() by replacing goto-based unwinding with direct returns. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Alex Williamson Reviewed-by: Yishai Hadas Link: https://lore.kernel.org/r/20260414200625.3601509-3-alex.williamson@nvidia.com Signed-off-by: Alex Williamson commit 903570835f12b7436ca0edb0a9ed351c0349121e Author: Alex Williamson Date: Tue Apr 14 14:06:19 2026 -0600 vfio/virtio: Convert list_lock from spinlock to mutex The list_lock spinlock with IRQ disabling was copied from the mlx5 vfio-pci variant driver, where it is justified by a hardirq async command completion callback that accesses the protected lists. The virtio driver has no such interrupt context usage; all list_lock acquisitions occur in process context via file read/write operations or state transitions under state_mutex. Convert list_lock to a mutex to be consistent with peer vfio-pci variant drivers (hisilicon, pds, qat, xe) which all use mutexes for equivalent migration data protection. This also fixes a mismatched spin_lock()/spin_unlock_irq() pair in virtiovf_read_device_context_chunk() that could incorrectly enable interrupts. Reported-by: Jinhui Guo Closes: https://lore.kernel.org/all/20260413073603.30538-1-guojinhui.liam@bytedance.com Fixes: 0bbc82e4ec79 ("vfio/virtio: Add support for the basic live migration functionality") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Alex Williamson Reviewed-by: Yishai Hadas Link: https://lore.kernel.org/r/20260414200625.3601509-2-alex.williamson@nvidia.com Signed-off-by: Alex Williamson commit d97708701434ce72968e771976aaf9d3438fcafd Author: Matt Evans Date: Wed Apr 15 11:17:52 2026 -0700 vfio/pci: Clean up DMABUFs before disabling function On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs become inaccessible. This fixes an issue where, if the function is disabled first, a tiny window exists in which the function's MSE is cleared and yet BARs could still be accessed via the DMABUF. The resources would also be freed and up for grabs by a different driver. Fixes: 5d74781ebc86c ("vfio/pci: Add dma-buf export support for MMIO regions") Signed-off-by: Matt Evans Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20260415181752.1027604-1-mattev@meta.com Signed-off-by: Alex Williamson commit b5129bda5bbcceea5b2589c8248d39f77660aa19 Author: Christoph Hellwig Date: Wed Apr 15 08:08:07 2026 +0200 block: only restrict bio allocation gfp mask asked to block If the caller is asking for a non-blocking allocation, we should not further restrict the gfp mask, which just increases the likelihood of failures. Fixes: b520c4eef83d ("block: split bio_alloc_bioset more clearly into a fast and slowpath") Reported-by: Shin'ichiro Kawasaki Signed-off-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260415060813.807659-3-hch@lst.de Signed-off-by: Jens Axboe commit eacda758e3c01db98b5c231f56cf9a6e05ced75c Author: Spencer Payton Date: Tue Apr 21 10:49:18 2026 +0200 ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx The mute LED on this laptop uses ALC245 but requires a quirk to work. This patch enables the existing ALC245_FIXUP_HP_MUTE_LED_COEFBIT quirk for the device. Tested my Victus 15-fa2xxx (PCI SSID 103c:8dcd). The LED behaviour works as intended. Cc: stable@vger.kernel.org Signed-off-by: Spencer Payton Link: https://patch.msgid.link/20260421084918.14685-1-spayton681@gmail.com Signed-off-by: Takashi Iwai commit 05909810a946222aca5d0611d37be82d18f95228 Author: Tejun Heo Date: Mon Apr 20 21:17:11 2026 -1000 tools/sched_ext: scx_qmap: Silence task_ctx lookup miss scx_fork() dispatches ops.init_task to exactly one scheduler - the one owning the forking task's cgroup. A task forked inside a sub-scheduler's cgroup is init'd into the sub only; the root scheduler has no task_ctx entry for it. When that task later appears as @prev in the root's qmap_dispatch() (or flows through core-sched comparison via task_qdist), the bpf_task_storage_get() legitimately misses. qmap treated those misses as fatal via scx_bpf_error("task_ctx lookup failed") and aborted the scheduler as soon as the first cross-sched task hit the root. Drop the error in the sites where the miss is legitimate: lookup_task_ctx() (helper; callers already check for NULL), qmap_dispatch()'s @prev branch (bookkeeping-only), task_qdist() (returns 0 which makes the comparison a no-op), and qmap_select_cpu() (returns prev_cpu as a no-op fallback instead of -ESRCH). The existing scx_error was a paranoid guard from the pre-sub-sched world where every task was owned by the one and only scheduler. v2: qmap_select_cpu() returns prev_cpu on NULL instead of -ESRCH, so the root scheduler doesn't error on cross-sched tasks that pass through it (Andrea Righi). Fixes: 4f8b122848db ("sched_ext: Add basic building blocks for nested sub-scheduler dispatching") Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi Reviewed-by: Zhao Mengmeng commit d5d5f80416a3a749906c04d56575e2290792654b Author: Cássio Gabriel Date: Tue Apr 21 10:03:06 2026 -0300 ALSA: pcmtest: Fix resource leaks in module init error paths pcmtest allocates its pattern buffers and creates its debugfs tree before registering the platform device and driver, but mod_init() does not release those resources when a later init step fails. As a result, a debugfs directory creation failure leaks the pattern buffers, while platform_device_register() and platform_driver_register() failures leave both the pattern buffers and the debugfs tree behind. The recent fix for failed device registration only dropped the embedded device reference. Add the missing cleanup for the debugfs tree and pattern buffers in the remaining module init error paths. Fixes: 315a3d57c64c ("ALSA: Implement the new Virtual PCM Test Driver") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260421-alsa-pcmtest-init-unwind-v1-1-03fe0c423dbb@gmail.com Signed-off-by: Takashi Iwai commit 949692da7211572fac419b2986b6abc0cd1aeb76 Author: Jacqueline Wong Date: Wed Apr 15 16:00:06 2026 +0000 tpm: tpm_tis: stop transmit if retries are exhausted tpm_tis_send_main() will attempt to retry sending data TPM_RETRY times. Currently, if those retries are exhausted, the driver will attempt to call execute. The TPM will be in the wrong state, leading to the operation simply timing out. Instead, if there is still an error after retries are exhausted, return that error immediately. Cc: stable@vger.kernel.org # v6.6+ Fixes: 280db21e153d8 ("tpm_tis: Resend command to recover from data transfer errors") Signed-off-by: Jacqueline Wong Signed-off-by: Jordan Hand Link: https://lore.kernel.org/r/20260415160006.2275325-3-jacqwong@google.com Signed-off-by: Jarkko Sakkinen commit 0471921e2d1043dcc6de5cffb49dd37709521abe Author: Jacqueline Wong Date: Wed Apr 15 16:00:05 2026 +0000 tpm: tpm_tis: add error logging for data transfer Add logging to more easily determine reason for transmit failure Cc: stable@vger.kernel.org # v6.6+ Fixes: 280db21e153d8 ("tpm_tis: Resend command to recover from data transfer errors") Signed-off-by: Jacqueline Wong Signed-off-by: Jordan Hand Link: https://lore.kernel.org/r/20260415160006.2275325-2-jacqwong@google.com Signed-off-by: Jarkko Sakkinen commit 6f1d4d2ecfcd1b577dc87350ea965fe81f272e83 Author: Arnd Bergmann Date: Fri Mar 22 14:22:48 2024 +0100 tpm: avoid -Wunused-but-set-variable Outside of the EFI tpm code, the TPM_MEMREMAP()/TPM_MEMUNMAP functions are defined as trivial macros, leading to the mapping_size variable ending up unused: In file included from drivers/char/tpm/tpm-sysfs.c:16: In file included from drivers/char/tpm/tpm.h:28: include/linux/tpm_eventlog.h:167:6: error: variable 'mapping_size' set but not used [-Werror,-Wunused-but-set-variable] 167 | int mapping_size; Turn the stubs into inline functions to avoid this warning. Cc: stable@vger.kernel.org # v5.3+ Fixes: c46f3405692d ("tpm: Reserve the TPM final events table") Signed-off-by: Arnd Bergmann Reviewed-by: Thorsten Blum Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit c424d2664f08c77f08b4580b5f0cbaabf7c229b2 Author: Gunnar Kudrjavets Date: Thu Apr 9 17:20:54 2026 +0000 tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() tpm_dev_release() uses plain kfree() to free chip->auth, which contains sensitive cryptographic material including HMAC session keys, nonces, and passphrase data (struct tpm2_auth). Every other code path that frees this structure uses kfree_sensitive() to zero the memory before releasing it: both tpm2_end_auth_session() and tpm_buf_check_hmac_response() do so. The tpm_dev_release() path is the only one that does not, leaving key material in freed slab memory until it is eventually overwritten. Use kfree_sensitive() for consistency with the rest of the driver and to ensure session keys are scrubbed during device teardown. Cc: stable@vger.kernel.org # v6.10+ Fixes: 699e3efd6c64 ("tpm: Add HMAC session start and end functions") Signed-off-by: Gunnar Kudrjavets Reviewed-by: Justinien Bouron Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit f0f75a3d98b7959a8677b6363e23190f3018636b Author: Gunnar Kudrjavets Date: Wed Apr 15 03:00:03 2026 +0300 tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() tpm2_read_public() calls tpm_buf_init() but fails to call tpm_buf_destroy() on two exit paths, leaking a page allocation: 1. When name_size() returns an error (unrecognized hash algorithm), the function returns directly without destroying the buffer. 2. On the success path, the buffer is never destroyed before returning. All other error paths in the function correctly call tpm_buf_destroy() before returning. Fix both by adding the missing tpm_buf_destroy() calls. Cc: stable@vger.kernel.org # v6.19+ Fixes: bda1cbf73c6e ("tpm2-sessions: Fix tpm2_read_public range checks") Signed-off-by: Gunnar Kudrjavets Reviewed-by: Justinien Bouron Reviewed-by: Paul Menzel Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 666c1a2ca603d8314231200bf8bbb3a81bd64c6b Author: Gunnar Kudrjavets Date: Wed Apr 8 12:00:27 2026 +0300 tpm: Fix auth session leak in tpm2_get_random() error path When tpm_buf_fill_hmac_session() fails inside the do-while loop in tpm2_get_random(), the function returns directly after destroying the buffer, without ending the auth session via tpm2_end_auth_session(). This leaks the TPM auth session resource. All other error paths within the loop correctly reach the 'out' label which calls both tpm_buf_destroy() and tpm2_end_auth_session(). Fix this by replacing the early return with a goto to the existing 'out' label, which already handles both cleanup operations. The redundant tpm_buf_destroy() call is removed since 'out' takes care of it. Cc: stable@vger.kernel.org # v6.19+ Fixes: 6e9722e9a7bf ("tpm2-sessions: Fix out of range indexing in name_size") Signed-off-by: Gunnar Kudrjavets Reviewed-by: Justinien Bouron Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit bb7a4e3b5f96d75756dab6459f073d4b2eedc7a0 Author: Ethan Luna Date: Wed Apr 8 11:37:47 2026 +0300 tpm: i2c: atmel: fix block comment formatting Multiple block comments in tpm_i2c_atmel.c placed the closing '*/' on the same line as the comment text. This violates the kernel's preferred comment style, which requires the closing delimiter to appear on its line. Fix the formatting to improve readability and resolve checkpatch warnings. Signed-off-by: Ethan Luna Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 48fe2cddc85c7849463bd01ae8b8c6b575ff508b Author: Rafael J. Wysocki Date: Mon Feb 23 16:55:21 2026 +0100 tpm_crb: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the tpm_crb ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit e6ffe09488e2010a04eb11e884cfee630e8c56a6 Author: Krzysztof Kozlowski Date: Mon Feb 16 12:04:59 2026 +0100 tpm: Make tcpci_pm_ops variable static const File-scope 'tcpci_pm_ops' is not used outside of this unit and is not modified anywhere, so make it static const to silence sparse warning: tcpci.c:1002:1: warning: symbol 'tcpci_pm_ops' was not declared. Should it be static? Signed-off-by: Krzysztof Kozlowski Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 256e5254efff48d6de97e314dc17d55504c55164 Author: Kexin Sun Date: Tue Mar 24 11:23:44 2026 +0800 kgdb: update outdated references to kgdb_wait() The function kgdb_wait() was folded into the static function kgdb_cpu_enter() by commit 62fae312197a ("kgdb: eliminate kgdb_wait(), all cpus enter the same way"). Update the four stale references accordingly: - include/linux/kgdb.h and arch/x86/kernel/kgdb.c: the kgdb_roundup_cpus() kdoc describes what other CPUs are rounded up to call. Because kgdb_cpu_enter() is static, the correct public entry point is kgdb_handle_exception(); also fix a pre-existing grammar error ("get them be" -> "get them into") and reflow the text. - kernel/debug/debug_core.c: replace with the generic description "the debug trap handler", since the actual entry path is architecture-specific. - kernel/debug/gdbstub.c: kgdb_cpu_enter() is correct here (it describes internal state, not a call target); add the missing parentheses. Suggested-by: Daniel Thompson Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun commit 4ee64205ffaa587e8114d84a67ac721399ccb369 Merge: a85d6ff99411eb 6b701fde9b31f0 Author: Linus Torvalds Date: Tue Apr 21 08:33:26 2026 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "We've finally gotten rid of the struct clk_ops::round_rate() code after months of effort from Brian Masney. Now the only option is to use determine_rate(), which is good because that takes a struct argument instead of just a couple unsigned longs, allowing us to easily modify the way we determine and set rates in the clk tree. Beyond that core framework change we've got the typical pile of new SoC clk driver additions, fixes for clk data and/or adding missing clks because the consumer driver using those clks wasn't ready, etc. The usual suspects are all here: Qualcomm, Samsung, Mediatek, and Rockchip along with some newcomers making RISC-V SoCs like ESWIN's eic700 and Tenstorrent's Atlantis. The clk driver side of this looks pretty normal. Core: - Remove the round_rate() clk op (yay!) New Drivers: - ESWIN eic700 SoC clk support - Econet EN751221 SoC clock/reset support - Global TCSR, RPMh, and display clock controller support for the Qualcomm Eliza platform - TCSR, the multiple global, and the RPMh clock controller support for the Qualcomm Nord platform - GPU clock controller support for Qualcomm SM8750 - Video and GPU clock controller support for Qualcomm Glymur - Global clock controller support for Qualcomm IPQ5210 - Axis ARTPEC-9: Add new PLL clocks and new drivers for eight clock controllers on the SoC - ExynosAutov920: Add G3D (GPU) clock controller - Clock driver for the Rockchip RV1103B SoC - Initial support for the Renesas RZ/G3L (R9A08G046) SoC - Clock and reset controllers (e.g. PRCM) in the Tenstorrent Atlantis SoC" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (132 commits) clk: visconti: pll: initialize clk_init_data to zero clk: fsl-sai: Add MCLK generation support clk: fsl-sai: Extract clock setup into fsl_sai_clk_register() dt-bindings: clock: fsl-sai: Document clock-cells = <1> support clk: fsl-sai: Add i.MX8M support with 8 byte register offset clk: fsl-sai: Sort the headers dt-bindings: clock: fsl-sai: Document i.MX8M support clk: qcom: gcc: Add multiple global clock controller driver for Nord SoC clk: qcom: rpmh: Add support for Nord rpmh clocks clk: qcom: Add TCSR clock driver for Nord SoC dt-bindings: clock: qcom: Add Nord Global Clock Controller dt-bindings: clock: qcom-rpmhcc: Add support for Nord SoCs dt-bindings: clock: qcom: Document the Nord SoC TCSR Clock Controller clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON clk: qcom: Constify list of critical CBCR registers clk: qcom: Constify qcom_cc_driver_data clk: qcom: videocc-glymur: Constify qcom_cc_desc clk: qcom: Add a driver for SM8750 GPU clocks dt-bindings: clock: qcom: Add SM8750 GPU clocks clk: qcom: ipq-cmn-pll: Add IPQ8074 SoC support ... commit a85d6ff99411eb21536a750ad02205e8a97894c6 Merge: 6e286940e2259a 070ec6f691411f Author: Linus Torvalds Date: Tue Apr 21 08:22:18 2026 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Usual driver updates (ufs, lpfc, fnic, target, mpi3mr). The substantive core changes are adding a 'serial' sysfs attribute and getting sd to support > PAGE_SIZE sectors" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (98 commits) scsi: target: Don't validate ignored fields in PROUT PREEMPT scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation scsi: ufs: core: Disable timestamp for Kioxia THGJFJT0E25BAIP scsi: mpi3mr: Fix typo scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails scsi: libsas: Delete unused to_dom_device() and to_dev_attr() scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC scsi: iscsi_tcp: Remove unneeded selections of CRYPTO and CRYPTO_MD5 scsi: lpfc: Update lpfc version to 15.0.0.0 scsi: lpfc: Add PCI ID support for LPe42100 series adapters scsi: lpfc: Introduce 128G link speed selection and support scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates scsi: lpfc: Update construction of SGL when XPSGL is enabled scsi: lpfc: Remove deprecated PBDE feature scsi: lpfc: Add REG_VFI mailbox cmd error handling scsi: lpfc: Log MCQE contents for mbox commands with no context scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids scsi: ufs: core: Make the header files self-contained scsi: ufs: core: Remove an include directive from ufshcd-crypto.h ... commit 6e286940e2259a8aa72d2055efad0226dd72ce38 Merge: 292a2bcd172662 3bfbf5f0a99c99 Author: Linus Torvalds Date: Tue Apr 21 08:06:43 2026 -0700 Merge tag 'v7.1-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix IPsec ESN regression in authencesn - Fix hmac setkey failure in eip93 - Guard against IV changing in algif_aead - Fix async completion handling in krb5enc - Fix fallback async completion in acomp - Fix handling of MAY_BACKLOG requests in pcrypt - Fix issues with firmware-returned values in ccp * tag 'v7.1-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: krb5enc - fix async decrypt skipping hash verification crypto: algif_aead - snapshot IV for async AEAD requests crypto: acomp - fix wrong pointer stored by acomp_save_req() crypto: ccp - copy IV using skcipher ivsize crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed crypto: pcrypt - Fix handling of MAY_BACKLOG requests crypto: sa2ul - Fix AEAD fallback algorithm names crypto: authencesn - Fix src offset when decrypting in-place crypto: eip93 - fix hmac setkey algo selection commit 0ac0058a74ac5765c7ce09ea630f4fdeaf4d80fa Author: Masami Hiramatsu (Google) Date: Mon Apr 20 23:01:20 2026 +0900 tracing/fprobe: Check the same type fprobe on table as the unregistered one Commit 2c67dc457bc6 ("tracing: fprobe: optimization for entry only case") introduced a different ftrace_ops for entry-only fprobes. However, when unregistering an fprobe, the kernel only checks if another fprobe exists at the same address, without checking which type of fprobe it is. If different fprobes are registered at the same address, the same address will be registered in both fgraph_ops and ftrace_ops, but only one of them will be deleted when unregistering. (the one removed first will not be deleted from the ops). This results in junk entries remaining in either fgraph_ops or ftrace_ops. For example: ======= cd /sys/kernel/tracing # 'Add entry and exit events on the same place' echo 'f:event1 vfs_read' >> dynamic_events echo 'f:event2 vfs_read%return' >> dynamic_events # 'Enable both of them' echo 1 > events/fprobes/enable cat enabled_functions vfs_read (2) ->arch_ftrace_ops_list_func+0x0/0x210 # 'Disable and remove exit event' echo 0 > events/fprobes/event2/enable echo -:event2 >> dynamic_events # 'Disable and remove all events' echo 0 > events/fprobes/enable echo > dynamic_events # 'Add another event' echo 'f:event3 vfs_open%return' > dynamic_events cat dynamic_events f:fprobes/event3 vfs_open%return echo 1 > events/fprobes/enable cat enabled_functions vfs_open (1) tramp: 0xffffffffa0001000 (ftrace_graph_func+0x0/0x60) ->ftrace_graph_func+0x0/0x60 subops: {ent:fprobe_fgraph_entry+0x0/0x620 ret:fprobe_return+0x0/0x150} vfs_read (1) tramp: 0xffffffffa0001000 (ftrace_graph_func+0x0/0x60) ->ftrace_graph_func+0x0/0x60 subops: {ent:fprobe_fgraph_entry+0x0/0x620 ret:fprobe_return+0x0/0x150} ======= As you can see, an entry for the vfs_read remains. To fix this issue, when unregistering, the kernel should also check if there is the same type of fprobes still exist at the same address, and if not, delete its entry from either fgraph_ops or ftrace_ops. Link: https://lore.kernel.org/all/177669367993.132053.10553046138528674802.stgit@mhiramat.tok.corp.google.com/ Fixes: 2c67dc457bc6 ("tracing: fprobe: optimization for entry only case") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) commit aa72812b49104bb5a38272fc9541feb62ca6fd32 Author: Masami Hiramatsu (Google) Date: Mon Apr 20 23:01:12 2026 +0900 tracing/fprobe: Avoid kcalloc() in rcu_read_lock section fprobe_remove_node_in_module() is called under RCU read locked, but this invokes kcalloc() if there are more than 8 fprobes installed on the module. Sashiko warns it because kcalloc() can sleep [1]. [1] https://sashiko.dev/#/patchset/177552432201.853249.5125045538812833325.stgit%40mhiramat.tok.corp.google.com To fix this issue, expand the batch size to 128 and do not expand the fprobe_addr_list, but just cancel walking on fprobe_ip_table, update fgraph/ftrace_ops and retry the loop again. Link: https://lore.kernel.org/all/177669367206.132053.1493637946869032744.stgit@mhiramat.tok.corp.google.com/ Fixes: 0de4c70d04a4 ("tracing: fprobe: use rhltable for fprobe_ip_table") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) commit 922f8c28811f266fe5fc52a6d2852871e40ce098 Author: Dewei Meng Date: Tue Apr 21 10:58:08 2026 +0800 spi: Fix the error description in the `ptp_sts_word_post` comment Based on the comment information, the description within the `ptp_sts_word_post` section should be changed to "See @ptp_sts_word_pre". Signed-off-by: Dewei Meng Link: https://patch.msgid.link/20260421025808.6572-1-mengdewei@cqsoftware.com.cn Signed-off-by: Mark Brown commit 845947aca6814f5723ed65e556eb5ee09493f05b Author: Masami Hiramatsu (Google) Date: Mon Apr 20 23:01:04 2026 +0900 tracing/fprobe: Remove fprobe from hash in failure path When register_fprobe_ips() fails, it tries to remove a list of fprobe_hash_node from fprobe_ip_table, but it missed to remove fprobe itself from fprobe_table. Moreover, when removing the fprobe_hash_node which is added to rhltable once, it must use kfree_rcu() after removing from rhltable. To fix these issues, this reuses unregister_fprobe() internal code to rollback the half-way registered fprobe. Link: https://lore.kernel.org/all/177669366417.132053.17874946321744910456.stgit@mhiramat.tok.corp.google.com/ Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) commit 1aec9e5c3e31ce1e28f914427fb7f90b91d310df Author: Masami Hiramatsu (Google) Date: Mon Apr 20 23:00:56 2026 +0900 tracing/fprobe: Unregister fprobe even if memory allocation fails unregister_fprobe() can fail under memory pressure because of memory allocation failure, but this maybe called from module unloading, and usually there is no way to retry it. Moreover. trace_fprobe does not check the return value. To fix this problem, unregister fprobe and fprobe_hash_node even if working memory allocation fails. Anyway, if the last fprobe is removed, the filter will be freed. Link: https://lore.kernel.org/all/177669365629.132053.8433032896213721288.stgit@mhiramat.tok.corp.google.com/ Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) commit 6ad51ada17ed80c9a5f205b4c01c424cac8b0d46 Author: Masami Hiramatsu (Google) Date: Mon Apr 20 23:00:48 2026 +0900 tracing/fprobe: Reject registration of a registered fprobe before init Reject registration of a registered fprobe which is on the fprobe hash table before initializing fprobe. The add_fprobe_hash() checks this re-register fprobe, but since fprobe_init() clears hlist_array field, it is too late to check it. It has to check the re-registration before touncing fprobe. Link: https://lore.kernel.org/all/177669364845.132053.18375367916162315835.stgit@mhiramat.tok.corp.google.com/ Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) commit 292a2bcd172662c7f281a7d79b095c91101c2e32 Merge: b4e07588e743c9 14a51045e10d30 Author: Linus Torvalds Date: Tue Apr 21 07:30:44 2026 -0700 Merge tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull dcache busy loop updates from Al Viro: "Fix livelocks in shrink_dcache_tree() If shrink_dcache_tree() finds a dentry in the middle of being killed by another thread, it has to wait until the victim finishes dying, gets detached from the tree and ceases to pin its parent. The way we used to deal with that amounted to busy-wait; unfortunately, it's not just inefficient but can lead to reliably reproducible hard livelocks. Solved by having shrink_dentry_tree() attach a completion to such dentry, with dentry_unlist() calling complete() on all objects attached to it. With a bit of care it can be done without growing struct dentry or adding overhead in normal case" * tag 'pull-dcache-busy-wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: get rid of busy-waiting in shrink_dcache_tree() dcache.c: more idiomatic "positives are not allowed" sanity checks struct dentry: make ->d_u anonymous for_each_alias(): helper macro for iterating through dentries of given inode commit 174a0ef3b33434f475c87e66f37980e39b73805a Author: Jun Yan Date: Mon Mar 30 22:51:11 2026 +0800 arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number Correct the interrupt number assigned to the Realtek PHY in the p230 following the same logic as commit 3106507e1004 ("ARM64: dts: meson-gxm: fix q200 interrupt number"),as reported in [PATCH 0/2] Ethernet PHY interrupt improvements [1]. [1] https://lore.kernel.org/all/20171202214037.17017-1-martin.blumenstingl@googlemail.com/ Fixes: b94d22d94ad2 ("ARM64: dts: meson-gx: add external PHY interrupt on some platforms") Signed-off-by: Jun Yan Reviewed-by: Martin Blumenstingl Link: https://patch.msgid.link/20260330145111.115318-1-jerrysteve1101@gmail.com Signed-off-by: Neil Armstrong commit 918273be0885362a9a00615b46e03f15f8b55667 Author: Anand Moon Date: Thu Feb 19 16:05:46 2026 +0530 arm64: dts: amlogic: meson-axg: Add missing cache information to cpu0 Add missing L1 data and instruction cache parameters to the CPU node 0 for the Cortex-A53 caches on the Meson AXG SoC. Fixes: 3b6ad2a43367 ("arm64: dts: amlogic: Add cache information to the Amlogic AXG SoCS") Signed-off-by: Anand Moon Link: https://patch.msgid.link/20260219103548.18392-1-linux.amoon@gmail.com Signed-off-by: Neil Armstrong commit 28e4a49a28b339b3d14564dd763d109799782687 Author: Nick Xie Date: Fri Mar 6 11:07:56 2026 +0800 arm64: dts: amlogic: t7: khadas-vim4: fix board model name Update the model property to "Khadas VIM4" to match the official product branding and maintain consistency with other Khadas boards (e.g., VIM1, VIM2, VIM3) in the kernel tree. Signed-off-by: Nick Xie Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260306030756.2421841-1-nick@khadas.com Signed-off-by: Neil Armstrong commit 232eb5dc61ef5a29aa92259b12ab4cb9b87deeb3 Author: Ronald Claveau Date: Thu Mar 5 23:11:25 2026 +0100 arm64: dts: amlogic: Fix GIC register ranges for Amlogic T7 This patch aims to fix the GIC register ranges for Amlogic T7 SoC family. - Context Kernel log shows a warning about GIC [ 0.000000] GIC: GICv2 detected, but range too small and irqchip.gicv2_force_probe not set Using cat /proc/interrupts command shows GIC as GIC-0 Adding some peripherals sometimes causes hangs on interrupts. - According to the GIC-400 ARM doc, the memory map is like: 0x1000-0x1FFF Distributor 0x2000-0x3FFF CPU interfaces 0x4000-0x5FFF Virtual interface control block 0x6000-0x7FFF Virtual CPU interfaces - Identify GIC model from distributor register Offset | Name | Type | Reset 0x008 | GICD_IIDR | RO | 0x0200143B kvim4# md.l 0xFFF01008 1 fff01008: 0200143b - Identify CPU interface from CPU interface register Offset | Name | Type | Reset 0x00FC | GICC_IIDR | RO | 0x0202143B kvim4# md.l 0xFFF020FC 1 fff020fc: 0202143b - Virtual interface control register check Offset | Name | Type | Reset 0x004 | GICH_VTR | RO | 0x90000003 kvim4# md.l 0xFFF04004 1 fff04004: 90000003 - Virtual CPU interfaces check Offset | Name | Type | Reset 0x00FC | GICV_IIDR | RO | 0x0202143B kvim4# md.l 0xFFF060FC 1 fff060fc: 0202143b - After this patch there is no warning anymore. GICv2 is correctly identified. [ 0.000000] GIC: Using split EOI/Deactivate mode Using cat /proc/interrupts command shows GIC as GICv2 Signed-off-by: Ronald Claveau Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260305-fix-amlt7-gic-dts-v1-1-5944415c74bf@aliel.fr Signed-off-by: Neil Armstrong commit 124d5e138ab5629118ebc30a59139d5498e6ee4c Author: Nick Xie Date: Thu Mar 19 10:34:46 2026 +0800 arm64: dts: amlogic: t7: khadas-vim4: fix memory layout for 8GB RAM The Khadas VIM4 features 8GB of LPDDR4X RAM. The previous memory node mapped a single incorrect region. This caused the kernel to map MMIO and secure firmware (ATF/TrustZone) memory holes as standard RAM, leading to an Asynchronous SError Interrupt during early boot (paging_init) when the kernel attempted to clear those pages. Fix this by splitting the 8GB memory layout into three separate regions to properly avoid the memory holes (e.g., 0xe0000000 - 0xffffffff): - 3.5GB @ 0x000000000 - 3.5GB @ 0x100000000 - 1.0GB @ 0x200000000 Signed-off-by: Nick Xie Suggested-by: Ronald Claveau Link: https://patch.msgid.link/20260319023446.3422695-1-nick@khadas.com Signed-off-by: Neil Armstrong commit 5ecee47dc9fc5959c04826a227135a03bc0d0267 Author: Geert Uytterhoeven Date: Wed Mar 4 18:10:58 2026 +0100 arm64: dts: amlogic: s6: Drop CPU masks from GICv3 PPI interrupts Unlike older GIC variants, the GICv3 DT bindings do not support specifying a CPU mask in PPI interrupt specifiers. Drop the masks. While at it, replace the magic number for IRQ_TYPE_LEVEL_HIGH by its symbolic definition. Signed-off-by: Geert Uytterhoeven Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/f9c6eddebebcd2e128edd2dbc51706e23589f9e8.1772643434.git.geert+renesas@glider.be Signed-off-by: Neil Armstrong commit 478ed6b7d2577439c610f91fa8759a4c878a4264 Author: Chia-Yu Chang Date: Fri Apr 17 17:25:51 2026 +0200 net/sched: sch_dualpi2: drain both C-queue and L-queue in dualpi2_change() Fix dualpi2_change() to correctly enforce updated limit and memlimit values after a configuration change of the dualpi2 qdisc. Before this patch, dualpi2_change() always attempted to dequeue packets via the root qdisc (C-queue) when reducing backlog or memory usage, and unconditionally assumed that a valid skb will be returned. When traffic classification results in packets being queued in the L-queue while the C-queue is empty, this leads to a NULL skb dereference during limit or memlimit enforcement. This is fixed by first dequeuing from the C-queue path if it is non-empty. Once the C-queue is empty, packets are dequeued directly from the L-queue. Return values from qdisc_dequeue_internal() are checked for both queues. When dequeuing from the L-queue, the parent qdisc qlen and backlog counters are updated explicitly to keep overall qdisc statistics consistent. Fixes: 320d031ad6e4 ("sched: Struct definition and parsing of dualpi2 qdisc") Reported-by: "Kito Xu (veritas501)" Closes: https://lore.kernel.org/netdev/20260413075740.2234828-1-hxzene@gmail.com/ Signed-off-by: Chia-Yu Chang Link: https://patch.msgid.link/20260417152551.71648-1-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit d647f2545219754603b2064de948425cdfd93fba Author: Lorenzo Bianconi Date: Fri Apr 17 17:24:41 2026 +0200 net: airoha: Fix PPE cpu port configuration for GDM2 loopback path When QoS loopback is enabled for GDM3 or GDM4, incoming packets are forwarded to GDM2. However, the PPE cpu port for GDM2 is not configured in this path, causing traffic originating from GDM3/GDM4, which may be set up as WAN ports backed by QDMA1, to be incorrectly directed to QDMA0 instead. Configure the PPE cpu port for GDM2 when QoS loopback is active on GDM3 or GDM4 to ensure traffic is routed to the correct QDMA instance. Fixes: 9cd451d414f6 ("net: airoha: Add loopback support for GDM2") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260417-airoha-ppe-cpu-port-for-gdm2-loopback-v1-1-c7a9de0f6f57@kernel.org Signed-off-by: Paolo Abeni commit 36920f30e78e69df01f9691c470b6f3ba8aebf98 Author: Corey Minyard Date: Mon Apr 20 12:50:09 2026 -0500 ipmi: Check event message buffer response for bad data The event message buffer response data size got checked later when processing, but check it right after the response comes back. It appears some BMCs may return an empty message instead of an error when fetching events. There are apparently some new BMCs that make this error, so we need to compensate. Reported-by: Matt Fleming Closes: https://lore.kernel.org/lkml/20260415115930.3428942-1-matt@readmodwrite.com/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: Signed-off-by: Corey Minyard commit edaa48dc2c071cf2ab0611ee504bbd4c544fc178 Merge: 4c1367a2d7aad6 c4dde411bc366f Author: Paolo Abeni Date: Tue Apr 21 12:50:26 2026 +0200 Merge branch 'net-sleepable-ndo_set_rx_mode' Stanislav Fomichev says: ==================== net: sleepable ndo_set_rx_mode This series adds a new ndo_set_rx_mode_async callback that enables drivers to handle address list updates in a sleepable context. The current ndo_set_rx_mode is called under the netif_addr_lock spinlock with BHs disabled, which prevents drivers from sleeping. This is problematic for ops-locked drivers that need to sleep. The approach: 1. Add snapshot/reconcile infrastructure for address lists 2. Introduce dev_rx_mode_work that takes snapshots under the lock, drops the lock, calls the driver, then reconciles changes back 3. Move promiscuity handling into the scheduled work as well 4. Convert existing ops-locked drivers to ndo_set_rx_mode_async 5. Add a warning for ops-locked drivers still using ndo_set_rx_mode 6. Add a selftest exercising the team+bridge+macvlan topology that triggers the addr_lock -> ops_lock ordering issue ==================== Link: https://patch.msgid.link/20260416185712.2155425-1-sdf@fomichev.me Signed-off-by: Paolo Abeni commit c4dde411bc366f568dbe33366253bbfea049e8ea Author: Stanislav Fomichev Date: Thu Apr 16 11:57:12 2026 -0700 selftests: net: use ip commands instead of teamd in team rx_mode test Replace teamd daemon usage with ip link commands for team device setup. teamd -d daemonizes and returns to the shell before port addition completes, creating a race: the test may create the macvlan (and check for its address on a slave) before teamd has finished adding ports. This makes the test inherently dependent on scheduling timing. Using ip commands makes port addition synchronous, removing the race and making the test deterministic. Cc: Jiri Pirko Cc: Jay Vosburgh Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-16-sdf@fomichev.me Signed-off-by: Paolo Abeni commit ee514cdb07b330b2a9012e5373d26959fbbc4f81 Author: Stanislav Fomichev Date: Thu Apr 16 11:57:11 2026 -0700 selftests: net: add team_bridge_macvlan rx_mode test Add a test that exercises the ndo_change_rx_flags path through a macvlan -> bridge -> team -> dummy stack. This triggers dev_uc_add under addr_list_lock which flips promiscuity on the lower device. With the new work queue approach, this must not deadlock. Link: https://lore.kernel.org/netdev/20260214033859.43857-1-jiayuan.chen@linux.dev/ Reviewed-by: Breno Leitao Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-15-sdf@fomichev.me Signed-off-by: Paolo Abeni commit 3cbd22938877e0c0c7c193a91d5a6d5149c39490 Author: Stanislav Fomichev Date: Thu Apr 16 11:57:10 2026 -0700 net: warn ops-locked drivers still using ndo_set_rx_mode Now that all in-tree ops-locked drivers have been converted to ndo_set_rx_mode_async, add a warning in register_netdevice to catch any remaining or newly added drivers that use ndo_set_rx_mode with ops locking. This ensures future driver authors are guided toward the async path. Also route ops-locked devices through netdev_rx_mode_work even if they lack rx_mode NDOs, to ensure netdev_ops_assert_locked() does not fire on the legacy path where only RTNL is held. Reviewed-by: Aleksandr Loktionov Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-14-sdf@fomichev.me Signed-off-by: Paolo Abeni commit 754b7e1169a7190760dd66cea026f1b4bd7acc54 Author: Stanislav Fomichev Date: Thu Apr 16 11:57:09 2026 -0700 netkit: convert to ndo_set_rx_mode_async Convert netkit driver from ndo_set_rx_mode to ndo_set_rx_mode_async. The netkit driver's set_multicast_list is a no-op, presumably for the same reason as the one in dummy? (fake multicast ability) Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-13-sdf@fomichev.me Signed-off-by: Paolo Abeni commit 4d157e89bde4bec79c0aaf91347691310c4b2a11 Author: Stanislav Fomichev Date: Thu Apr 16 11:57:08 2026 -0700 dummy: convert to ndo_set_rx_mode_async Convert dummy driver from ndo_set_rx_mode to ndo_set_rx_mode_async. The dummy driver's set_multicast_list is a no-op, so the conversion is straightforward: update the signature and the ops assignment. Reviewed-by: Aleksandr Loktionov Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-12-sdf@fomichev.me Signed-off-by: Paolo Abeni commit 8a5df09e70c2260ad05125a6199229faf20f8671 Author: Stanislav Fomichev Date: Thu Apr 16 11:57:07 2026 -0700 netdevsim: convert to ndo_set_rx_mode_async Convert netdevsim from ndo_set_rx_mode to ndo_set_rx_mode_async. The callback is a no-op stub so just update the signature and ops struct wiring. Reviewed-by: Breno Leitao Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-11-sdf@fomichev.me Signed-off-by: Paolo Abeni commit d071c15b43e9a58c1ee774ac94f2a635423371d4 Author: Stanislav Fomichev Date: Thu Apr 16 11:57:06 2026 -0700 iavf: convert to ndo_set_rx_mode_async Convert iavf from ndo_set_rx_mode to ndo_set_rx_mode_async. iavf_set_rx_mode now takes explicit uc/mc list parameters and uses __hw_addr_sync_dev on the snapshots instead of __dev_uc_sync and __dev_mc_sync. The iavf_configure internal caller passes the real lists directly. Cc: Tony Nguyen Cc: Przemek Kitszel Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-10-sdf@fomichev.me Signed-off-by: Paolo Abeni commit a453b5d9b3eda72dc93f0934194c2ebad4615e1f Author: Stanislav Fomichev Date: Thu Apr 16 11:57:05 2026 -0700 bnxt: use snapshot in bnxt_cfg_rx_mode With the introduction of ndo_set_rx_mode_async (as discussed in [1]) we can call bnxt_cfg_rx_mode directly. Convert bnxt_cfg_rx_mode to use uc/mc snapshots and move its call in bnxt_sp_task to the section that resets BNXT_STATE_IN_SP_TASK. Switch to direct call in bnxt_set_rx_mode. Link: https://lore.kernel.org/netdev/CACKFLi=5vj8hPqEUKDd8RTw3au5G+zRgQEqjF+6NZnyoNm90KA@mail.gmail.com/ [1] Cc: Michael Chan Cc: Pavan Chebbi Reviewed-by: Michael Chan Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-9-sdf@fomichev.me Signed-off-by: Paolo Abeni commit f6c53cfa1217b651065cf6ff2173b2ce257f3a3f Author: Stanislav Fomichev Date: Thu Apr 16 11:57:04 2026 -0700 bnxt: convert to ndo_set_rx_mode_async Convert bnxt from ndo_set_rx_mode to ndo_set_rx_mode_async. bnxt_set_rx_mode, bnxt_mc_list_updated and bnxt_uc_list_updated now take explicit uc/mc list parameters and iterate with netdev_hw_addr_list_for_each instead of netdev_for_each_{uc,mc}_addr. The bnxt_cfg_rx_mode internal caller passes the real lists under netif_addr_lock_bh. BNXT_RX_MASK_SP_EVENT is still used here, next patch converts to the direct call. Cc: Michael Chan Cc: Pavan Chebbi Reviewed-by: Michael Chan Reviewed-by: Aleksandr Loktionov Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-8-sdf@fomichev.me Signed-off-by: Paolo Abeni commit 5cf06fbdaf024f1b256dc4fc18f49f09ca26d16d Author: Stanislav Fomichev Date: Thu Apr 16 11:57:03 2026 -0700 mlx5: convert to ndo_set_rx_mode_async Convert mlx5 from ndo_set_rx_mode to ndo_set_rx_mode_async. The driver's mlx5e_set_rx_mode now receives uc/mc snapshots and calls mlx5e_fs_set_rx_mode_work directly instead of queueing work. mlx5e_sync_netdev_addr and mlx5e_handle_netdev_addr now take explicit uc/mc list parameters and iterate with netdev_hw_addr_list_for_each instead of netdev_for_each_{uc,mc}_addr. Fallback to netdev's uc/mc in a few places and grab addr lock. Cc: Saeed Mahameed Cc: Tariq Toukan Cc: Cosmin Ratiu Reviewed-by: Aleksandr Loktionov Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-7-sdf@fomichev.me Signed-off-by: Paolo Abeni commit 60dd9781e9b890fa4de3e8ab01f63f0fd4e332e7 Author: Stanislav Fomichev Date: Thu Apr 16 11:57:02 2026 -0700 fbnic: convert to ndo_set_rx_mode_async Convert fbnic from ndo_set_rx_mode to ndo_set_rx_mode_async. The driver's __fbnic_set_rx_mode() now takes explicit uc/mc list parameters and uses __hw_addr_sync_dev() on the snapshots instead of __dev_uc_sync/__dev_mc_sync on the netdev directly. Update callers in fbnic_up, fbnic_fw_config_after_crash, fbnic_bmc_rpc_check and fbnic_set_mac to pass the real address lists calling __fbnic_set_rx_mode outside the async work path. Cc: Alexander Duyck Cc: kernel-team@meta.com Reviewed-by: Aleksandr Loktionov Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-6-sdf@fomichev.me Signed-off-by: Paolo Abeni commit 7ef83bf1712b5c441a21d5df844202433f6b0b05 Author: Stanislav Fomichev Date: Thu Apr 16 11:57:01 2026 -0700 net: move promiscuity handling into netdev_rx_mode_work Move unicast promiscuity tracking into netdev_rx_mode_work so it runs under netdev_ops_lock instead of under the addr_lock spinlock. This is required because __dev_set_promiscuity calls dev_change_rx_flags and __dev_notify_flags, both of which may need to sleep. Change ASSERT_RTNL() to netdev_ops_assert_locked() in __dev_set_promiscuity, netif_set_allmulti and __dev_change_flags since these are now called from the work queue under the ops lock. Link: https://lore.kernel.org/netdev/20260214033859.43857-1-jiayuan.chen@linux.dev/ Fixes: 78cd408356fe ("net: add missing instance lock to dev_set_promiscuity") Reported-by: syzbot+2b3391f44313b3983e91@syzkaller.appspotmail.com Reviewed-by: Aleksandr Loktionov Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-5-sdf@fomichev.me Signed-off-by: Paolo Abeni commit a4c833278144917982510ca43a3438155756122a Author: Stanislav Fomichev Date: Thu Apr 16 11:57:00 2026 -0700 net: cache snapshot entries for ndo_set_rx_mode_async Add a per-device netdev_hw_addr_list cache (rx_mode_addr_cache) that allows __hw_addr_list_snapshot() and __hw_addr_list_reconcile() to reuse previously allocated entries instead of hitting GFP_ATOMIC on every snapshot cycle. snapshot pops entries from the cache when available, falling back to __hw_addr_create(). reconcile splices both snapshot lists back into the cache via __hw_addr_splice(). The cache is flushed in free_netdev(). Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-4-sdf@fomichev.me Signed-off-by: Paolo Abeni commit 3554b4345d855089ab7af5e3557f5dc3262d14c9 Author: Stanislav Fomichev Date: Thu Apr 16 11:56:59 2026 -0700 net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work Add ndo_set_rx_mode_async callback that drivers can implement instead of the legacy ndo_set_rx_mode. The legacy callback runs under the netif_addr_lock spinlock with BHs disabled, preventing drivers from sleeping. The async variant runs from a work queue with rtnl_lock and netdev_lock_ops held, in fully sleepable context. When __dev_set_rx_mode() sees ndo_set_rx_mode_async, it schedules netdev_rx_mode_work instead of calling the driver inline. The work function takes two snapshots of each address list (uc/mc) under the addr_lock, then drops the lock and calls the driver with the work copies. After the driver returns, it reconciles the snapshots back to the real lists under the lock. Add netif_rx_mode_sync() to opportunistically execute the pending workqueue update inline, so that rx mode changes are committed before returning to userspace: - dev_change_flags (SIOCSIFFLAGS / RTM_NEWLINK) - dev_set_promiscuity - dev_set_allmulti - dev_ifsioc SIOCADDMULTI / SIOCDELMULTI - do_setlink (RTM_SETLINK) Note that some deep hierarchies still do skip the lower updates via: - dev_uc_sync - dev_mc_sync If we do end up hitting user-visible issues, we can add more calls to netif_rx_mode_sync in specific places. But hopefully we should not, the actual user-visible lists are still synced, it's that just HW state that might be lagging. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-3-sdf@fomichev.me Signed-off-by: Paolo Abeni commit db9e726525e45dbd713c07897a4d20bc18333ccc Author: Stanislav Fomichev Date: Thu Apr 16 11:56:58 2026 -0700 net: add address list snapshot and reconciliation infrastructure Introduce __hw_addr_list_snapshot() and __hw_addr_list_reconcile() for use by the upcoming ndo_set_rx_mode_async callback. The async rx_mode path needs to snapshot the device's unicast and multicast address lists under the addr_lock, hand those snapshots to the driver (which may sleep), and then propagate any sync_cnt changes back to the real lists. Two identical snapshots are taken: a work copy for the driver to pass to __hw_addr_sync_dev() and a reference copy to compute deltas against. __hw_addr_list_reconcile() walks the reference snapshot comparing each entry against the work snapshot to determine what the driver synced or unsynced. It then applies those deltas to the real list, handling concurrent modifications: - If the real entry was concurrently removed but the driver synced it to hardware (delta > 0), re-insert a stale entry so the next work run properly unsyncs it from hardware. - If the entry still exists, apply the delta normally. An entry whose refcount drops to zero is removed. # dev_addr_test_snapshot_benchmark: 1024 addrs x 1000 snapshots: 89872802 ns total, 89872 ns/iter # dev_addr_test_snapshot_benchmark.speed: slow Reviewed-by: Aleksandr Loktionov Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260416185712.2155425-2-sdf@fomichev.me Signed-off-by: Paolo Abeni commit 10f79dbd7719d1da9f5884d13060322d8729f091 Author: Pablo Neira Ayuso Date: Wed Apr 15 22:58:23 2026 +0200 netfilter: nf_tables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks without altering the basechain/flowtable hook_list during the preparation phase. The existing approach that moves the hook from the basechain/flowtable hook_list to transaction hook_list breaks netlink dump path readers of this RCU-protected list. It should be possible use an array for nft_trans_hook to store the deleted hooks to compact the representation but I am not expecting many hook object, specially now that wildcard support for devices is in place. Note that the nft_trans_chain_hooks() list contains a list of struct nft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while this list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE. Note that new commands can be updated to use nft_trans_hook for consistency. This patch also adapts the event notification path to deal with the list of hook transactions. Fixes: 7d937b107108 ("netfilter: nf_tables: support for deleting devices in an existing netdev chain") Fixes: b6d9014a3335 ("netfilter: nf_tables: delete flowtable hooks via transaction list") Reported-by: Xiang Mei Signed-off-by: Pablo Neira Ayuso commit a6134e62dba2ea4f760b29d5226907f447c92400 Author: Pablo Neira Ayuso Date: Wed Apr 15 17:56:14 2026 +0200 netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase Publish new hooks in the list into the basechain/flowtable using splice_list_rcu() to ensure netlink dump list traversal via rcu is safe while concurrent ruleset update is going on. Fixes: 78d9f48f7f44 ("netfilter: nf_tables: add devices to existing flowtable") Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain") Signed-off-by: Pablo Neira Ayuso commit f902877b635551513729bdf9a8d1422c4aab7741 Author: Pablo Neira Ayuso Date: Wed Apr 15 17:56:02 2026 +0200 rculist: add list_splice_rcu() for private lists This patch adds a helper function, list_splice_rcu(), to safely splice a private (non-RCU-protected) list into an RCU-protected list. The function ensures that only the pointer visible to RCU readers (prev->next) is updated using rcu_assign_pointer(), while the rest of the list manipulations are performed with regular assignments, as the source list is private and not visible to concurrent RCU readers. This is useful for moving elements from a private list into a global RCU-protected list, ensuring safe publication for RCU readers. Subsystems with some sort of batching mechanism from userspace can benefit from this new function. The function __list_splice_rcu() has been added for clarity and to follow the same pattern as in the existing list_splice*() interfaces, where there is a check to ensure that the list to splice is not empty. Note that __list_splice_rcu() has no documentation for this reason. Reviewed-by: Paul E. McKenney Signed-off-by: Pablo Neira Ayuso commit f3224ee463f8f6f6ced7dcdf6081add4f8128527 Author: Florian Westphal Date: Thu Apr 16 15:14:51 2026 +0200 netfilter: nf_tables: use list_del_rcu for netlink hooks nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need to use list_del_rcu(), this list can be walked by concurrent dumpers. Add a new helper and use it consistently. Fixes: f9a43007d3f7 ("netfilter: nf_tables: double hook unregistration in netns path") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 1e8e3f449b1e73b73a843257635b9c50f0cc0f0a Author: Pablo Neira Ayuso Date: Mon Apr 20 23:15:32 2026 +0200 netfilter: arp_tables: fix IEEE1394 ARP payload parsing Weiming Shi says: "arp_packet_match() unconditionally parses the ARP payload assuming two hardware addresses are present (source and target). However, IPv4-over-IEEE1394 ARP (RFC 2734) omits the target hardware address field, and arp_hdr_len() already accounts for this by returning a shorter length for ARPHRD_IEEE1394 devices. As a result, on IEEE1394 interfaces arp_packet_match() advances past a nonexistent target hardware address and reads the wrong bytes for both the target device address comparison and the target IP address. This causes arptables rules to match against garbage data, leading to incorrect filtering decisions: packets that should be accepted may be dropped and vice versa. The ARP stack in net/ipv4/arp.c (arp_create and arp_process) already handles this correctly by skipping the target hardware address for ARPHRD_IEEE1394. Apply the same pattern to arp_packet_match()." Mangle the original patch to always return 0 (no match) in case user matches on the target hardware address which is never present in IEEE1394. Note that this returns 0 (no match) for either normal and inverse match because matching in the target hardware address in ARPHRD_IEEE1394 has never been supported by arptables. This is intentional, matching on the target hardware address should never evaluate true for ARPHRD_IEEE1394. Moreover, adjust arpt_mangle to drop the packet too as AI suggests: In arpt_mangle, the logic assumes a standard ARP layout. Because IEEE1394 (FireWire) omits the target hardware address, the linear pointer arithmetic miscalculates the offset for the target IP address. This causes mangling operations to write to the wrong location, leading to packet corruption. To ensure safety, this patch drops packets (NF_DROP) when mangling is requested for these fields on IEEE1394 devices, as the current implementation cannot correctly map the FireWire ARP payload. This omits both mangling target hardware and IP address. Even if IP address mangling should be possible in IEEE1394, this would require to adjust arpt_mangle offset calculation, which has never been supported. Based on patch from Weiming Shi . Fixes: 6752c8db8e0c ("firewire net, ipv4 arp: Extend hardware address and remove driver-level packet inspection.") Reported-by: Xiang Mei Signed-off-by: Pablo Neira Ayuso commit 2d8c7edcb661812249469f4a5b62e9339118846f Author: Gao Xiang Date: Mon Apr 20 18:11:42 2026 +0800 erofs: unify lcn as u64 for 32-bit platforms As sashiko reported [1], `lcn` was typed as `unsigned long` (or `unsigned int` sometimes), which is only 32 bits wide on 32-bit platforms, which causes `(lcn << lclusterbits)` to be truncated at 4 GiB. In order to consolidate the logic, just use `u64` consistently around the codebase. [1] https://sashiko.dev/r/20260420034612.1899973-1-hsiangkao%40linux.alibaba.com Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support") Signed-off-by: Gao Xiang commit c99493ce409c3b98fec1616dbcf24c102e006deb Author: Gao Xiang Date: Mon Apr 20 11:46:12 2026 +0800 erofs: fix offset truncation when shifting pgoff on 32-bit platforms On 32-bit platforms, pgoff_t is 32 bits wide, so left-shifting large arbitrary pgoff_t values by PAGE_SHIFT performs 32-bit arithmetic and silently truncates the result for pages beyond the 4 GiB boundary. Cast the page index to loff_t before shifting to produce a correct 64-bit byte offset. Fixes: 386292919c25 ("erofs: introduce readmore decompression strategy") Fixes: 307210c262a2 ("erofs: verify metadata accesses for file-backed mounts") Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit d18a3b5d337fa412a38e776e6b4b857a58836575 Author: Gao Xiang Date: Tue Apr 21 15:59:52 2026 +0800 erofs: fix the out-of-bounds nameoff handling for trailing dirents Currently we already have boundary-checks for nameoffs, but the trailing dirents are special since the namelens are calculated with strnlen() with unchecked nameoffs. If a crafted EROFS has a trailing dirent with nameoff >= maxsize, maxsize - nameoff can underflow, causing strnlen() to read past the directory block. nameoff0 should also be verified to be a multiple of `sizeof(struct erofs_dirent)` as well [1]. [1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com Fixes: 3aa8ec716e52 ("staging: erofs: add directory operations") Fixes: 33bac912840f ("staging: erofs: keep corrupted fs from crashing kernel in erofs_readdir()") Reported-by: Yuhao Jiang Reported-by: Junrui Luo Closes: https://lore.kernel.org/r/A0FD7E0F-7558-49B0-8BC8-EB1ECDB2479A@outlook.com Cc: stable@vger.kernel.org Signed-off-by: Gao Xiang Reviewed-by: Chao Yu commit 4c1367a2d7aad643a6f87c6931b13cc1a25e8ca7 Author: Weiming Shi Date: Thu Apr 16 18:01:51 2026 +0800 slip: bound decode() reads against the compressed packet length slhc_uncompress() parses a VJ-compressed TCP header by advancing a pointer through the packet via decode() and pull16(). Neither helper bounds-checks against isize, and decode() masks its return with & 0xffff so it can never return the -1 that callers test for -- those error paths are dead code. A short compressed frame whose change byte requests optional fields lets decode() read past the end of the packet. The over-read bytes are folded into the cached cstate and reflected into subsequent reconstructed packets. Make decode() and pull16() take the packet end pointer and return -1 when exhausted. Add a bounds check before the TCP-checksum read. The existing == -1 tests now do what they were always meant to. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Simon Horman Closes: https://lore.kernel.org/netdev/20260414134126.758795-2-horms@kernel.org/ Signed-off-by: Weiming Shi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260416100147.531855-5-bestswngs@gmail.com Signed-off-by: Paolo Abeni commit 12c1c672d46dba62bad1293977780c98e29315b4 Author: Phil Willoughby Date: Mon Apr 20 16:23:49 2026 +0100 ALSA: usb-audio/line6: Add support for POD HD PRO The POD HD PRO is the rackmount version of the POD 500, with most of the same behaviors. As with some of the other rackmount POD devices it will not send captured audio to the host unless the host is sending playback audio, so it has LINE6_CAP_IN_NEEDS_OUT in addition to the POD 500 flags. Tested-By: Phil Willoughby Signed-off-by: Phil Willoughby Link: https://patch.msgid.link/20260420152405.7230-1-willerz@gmail.com Signed-off-by: Takashi Iwai commit cb78517e60cf4829c7ddaae6a21a8bdf8c9da0e4 Author: Chris Chiu Date: Tue Apr 21 02:34:28 2026 +0000 ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2a Laptops The HP EliteBook 6 G2a laptops requires specific LED control method ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF to work. Signed-off-by: Chris Chiu Link: https://patch.msgid.link/20260421023429.3723154-1-chris.chiu@canonical.com Signed-off-by: Takashi Iwai commit e76607442d5b73e1ba6768f501ef815bb58c2c0e Author: Weiming Shi Date: Thu Apr 16 04:41:31 2026 +0800 slip: reject VJ receive packets on instances with no rstate array slhc_init() accepts rslots == 0 as a valid configuration, with the documented meaning of 'no receive compression'. In that case the allocation loop in slhc_init() is skipped, so comp->rstate stays NULL and comp->rslot_limit stays 0 (from the kzalloc of struct slcompress). The receive helpers do not defend against that configuration. slhc_uncompress() dereferences comp->rstate[x] when the VJ header carries an explicit connection ID, and slhc_remember() later assigns cs = &comp->rstate[...] after only comparing the packet's slot number to comp->rslot_limit. Because rslot_limit is 0, slot 0 passes the range check, and the code dereferences a NULL rstate. The configuration is reachable in-tree through PPP. PPPIOCSMAXCID stores its argument in a signed int, and (val >> 16) uses arithmetic shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1 is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because /dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole path is reachable from an unprivileged user namespace. Once the malformed VJ state is installed, any inbound VJ-compressed or VJ-uncompressed frame that selects slot 0 crashes the kernel in softirq context: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519) Call Trace: ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466) ppp_input (drivers/net/ppp/ppp_generic.c:2359) ppp_async_process (drivers/net/ppp/ppp_async.c:492) tasklet_action_common (kernel/softirq.c:926) handle_softirqs (kernel/softirq.c:623) run_ksoftirqd (kernel/softirq.c:1055) smpboot_thread_fn (kernel/smpboot.c:160) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) Reject the receive side on such instances instead of touching rstate. slhc_uncompress() falls through to its existing 'bad' label, which bumps sls_i_error and enters the toss state. slhc_remember() mirrors that with an explicit sls_i_error increment followed by slhc_toss(); the sls_i_runt counter is not used here because a missing rstate is an internal configuration state, not a runt packet. The transmit path is unaffected: the only in-tree caller that picks rslots from userspace (ppp_generic.c) still supplies tslots >= 1, and slip.c always calls slhc_init(16, 16), so comp->tstate remains valid and slhc_compress() continues to work. Fixes: 4ab42d78e37a ("ppp, slip: Validate VJ compression slot parameters completely") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260415204130.258866-2-bestswngs@gmail.com Signed-off-by: Paolo Abeni commit 4fe985292709eeb6a4653c71660f893e26c2f2dd Author: Tejun Heo Date: Mon Apr 20 20:03:26 2026 -1000 rhashtable: Bounce deferred worker kick through irq_work Inserts past 75% load call schedule_work(&ht->run_work) to kick an async resize. If a caller holds a raw spinlock (e.g. an insecure_elasticity user), schedule_work() under that lock records caller_lock -> pool->lock -> pi_lock -> rq->__lock A cycle forms if any of these locks is acquired in the reverse direction elsewhere. sched_ext, the only current insecure_elasticity user, hits this: it holds scx_sched_lock across rhashtable inserts of sub-schedulers, while scx_bypass() takes rq->__lock -> scx_sched_lock. Exercising the resize path produces: Chain exists of: &pool->lock --> &rq->__lock --> scx_sched_lock Bounce the kick from the insert paths through irq_work so schedule_work() runs from hard IRQ context with the caller's lock no longer held. rht_deferred_worker()'s self-rearm on error stays on schedule_work(&ht->run_work) - the worker runs in process context with no caller lock held, and keeping the self-requeue on @run_work lets cancel_work_sync() in rhashtable_free_and_destroy() drain it. v3: Keep rht_deferred_worker()'s self-rearm on schedule_work(&run_work). Routing it through irq_work in v2 broke cancel_work_sync()'s self-requeue handling - an irq_work queued after irq_work_sync() returned but while cancel_work_sync() was still waiting could fire post-teardown. v2: Bounce unconditionally instead of gating on insecure_elasticity, as suggested by Herbert. Signed-off-by: Tejun Heo Acked-by: Herbert Xu commit 47e66bec3edaebd7c52d8ee981065a4c83b3072f Author: Yihang Li Date: Mon Apr 20 10:10:44 2026 +0800 scsi: hisi_sas: Fix sparse warnings in prep_ata_v3_hw() In prep_ata_v3_hw(), add cpu_to_le32() to fix warning: drivers/scsi/hisi_sas/hisi_sas_v3_hw.c:1448:26: sparse: sparse: invalid assignment: |= drivers/scsi/hisi_sas/hisi_sas_v3_hw.c:1448:26: sparse: left side has type restricted __le32 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c:1448:26: sparse: right side has type unsigned int Fixes: 8aa580cd9284 ("scsi: hisi_sas: Enable force phy when SATA disk directly connected") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604191850.IVYPTaML-lkp@intel.com/ Signed-off-by: Yihang Li Link: https://patch.msgid.link/20260420021044.3339459-1-liyihang9@huawei.com Signed-off-by: Martin K. Petersen commit 1dc39ed655750d6c679d3ada4adf4a937f2a63fc Author: Hugo Villeneuve Date: Fri Apr 17 16:07:31 2026 -0400 scsi: pmcraid: Fix typo in comments Fix typo in structure comment. Signed-off-by: Hugo Villeneuve Link: https://patch.msgid.link/20260417200738.3920001-1-hugo@hugovil.com Signed-off-by: Martin K. Petersen commit 68c3a65a5a8e85643745fdde02cb63904e165620 Author: Brian Bunker Date: Thu Apr 16 09:55:12 2026 -0700 scsi: scsi_dh_alua: Increase default ALUA timeout to maximum spec value The ALUA handler maps a 0 value (no implicit transition timeout provided by the target) to the ALUA_FAILOVER_TIMEOUT constant, currently 60 seconds. This means the kernel already does not accept an infinite transition time. However, 60 seconds is insufficient for some arrays that may take longer to complete ALUA transitions. Since the highest value allowed by the SCSI specification for the implicit transition timeout is a single byte (255 seconds), change the default to 255. This way, when a target does not provide an explicit transition timeout, we default to the maximum value the spec allows rather than an arbitrary 60 second limit. Co-developed-by: Krishna Kant Signed-off-by: Krishna Kant Co-developed-by: Riya Savla Signed-off-by: Riya Savla Signed-off-by: Brian Bunker Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260416165512.26497-2-brian@purestorage.com Signed-off-by: Martin K. Petersen commit d65efdf467ff935e35dfe6aa9a7ab93f17ac07ee Author: Tomas Henzl Date: Tue Apr 14 14:41:18 2026 +0200 scsi: smartpqi: Silence a recursive lock warning On systems with multiple controllers debug kernel shows WARNING: possible recursive locking detected during shutdown. Each controller does have its own ctrl_info (and mutex) and that isn't correctly recognized by debug kernel. Suppress the warning by releasing the mutex at the end of pqi_shutdown(). Signed-off-by: Tomas Henzl Acked-by: Don Brace Link: https://patch.msgid.link/20260414124118.23661-1-thenzl@redhat.com Signed-off-by: Martin K. Petersen commit 04631f55afc543d5431a2bdee7f6cc0f2c0debe7 Author: Ranjan Kumar Date: Tue Apr 14 16:38:11 2026 +0530 scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values based on the underlying drive capability. However, because the driver allocates a fixed 4K buffer for the PRP list, accommodating at most 512 entries, the driver supports a maximum I/O transfer size of 2 MiB. Limit max_hw_sectors to the smaller of the reported MDTS and the 2 MiB driver limit to prevent issuing oversized I/O that may lead to a kernel oops. Cc: stable@vger.kernel.org Fixes: 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") Reported-by: Mira Limbeck Closes: https://lore.kernel.org/r/291f78bf-4b4a-40dd-867d-053b36c564b3@proxmox.com Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9b8b84879d4a Suggested-by: Keith Busch Signed-off-by: Ranjan Kumar Tested-by: Mira Limbeck Link: https://patch.msgid.link/20260414110811.85156-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 7b03c93d2beb91c6abae322a1f25447b5b3bb9e6 Author: Christoph Hellwig Date: Wed Apr 15 08:08:06 2026 +0200 scsi: sg: Don't use GFP_ATOMIC in sg_start_req() sg_start_req() is called from normal user context and can sleep when waiting for memory. Switch it to use GFP_KERNEL, which fixes allocation failures seen with the bio_alloc rework. Fixes: b520c4eef83d ("block: split bio_alloc_bioset more clearly into a fast and slowpath") Reported-by: Shin'ichiro Kawasaki Signed-off-by: Christoph Hellwig Tested-by: Shin'ichiro Kawasaki Reviewed-by: John Garry Reviewed-by: Hannes Reinecke Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260415060813.807659-2-hch@lst.de Signed-off-by: Martin K. Petersen commit 82323b1a7088b7a5c3e528a5d634bff447fa286f Author: Mark Harmstone Date: Thu Apr 16 18:15:23 2026 +0100 btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() submit_one_async_extent() calls btrfs_reserve_extent(), which decrements bytes_may_use. If the call btrfs_create_io_em() fails, we jump to out_free_reserve, which calls extent_clear_unlock_delalloc(). Because we're specifying EXTENT_DO_ACCOUNTING, i.e. EXTENT_CLEAR_META_RESV | EXTENT_CLEAR_DATA_RESV, this decreases bytes_may_use again. This can lead to problems later on, as an initial write can fail only for the writeback to silently ENOSPC. Fix this by replacing EXTENT_DO_ACCOUNTING with EXTENT_CLEAR_META_RESV. This parallels a4fe134fc1d8eb ("btrfs: fix a double release on reserved extents in cow_one_range()"), which is the same fix in cow_one_range(). Fixes: 151a41bc46df ("Btrfs: fix what bits we clear when erroring out from delalloc") Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit a8d58a7c0200904ff24ca7f0d7c147017e25aa99 Author: robbieko Date: Mon Apr 13 14:52:37 2026 +0800 btrfs: check return value of btrfs_partially_delete_raid_extent() btrfs_partially_delete_raid_extent() returns an error code (e.g. -ENOMEM from kzalloc(), or errors from btrfs_del_item/btrfs_insert_item()), but all three call sites in btrfs_delete_raid_extent() discard the return value, silently losing errors and potentially leaving the stripe tree in an inconsistent state. Fix by capturing the return value into ret at all three call sites and breaking out of the loop on error where appropriate. Reviewed-by: Johannes Thumshirn Signed-off-by: robbieko Signed-off-by: David Sterba commit fe0cdfd7118d8b40a21bfac221bb4982c5e10e10 Author: robbieko Date: Mon Apr 13 14:52:36 2026 +0800 btrfs: handle -EAGAIN from btrfs_duplicate_item and refresh stale leaf pointer In the 'punch a hole' case of btrfs_delete_raid_extent(), btrfs_duplicate_item() can return -EAGAIN when the leaf needs to be split and the path becomes invalid. The old code treats any error as fatal and breaks out of the loop. Additionally, btrfs_duplicate_item() may trigger setup_leaf_for_split() which can reallocate the leaf node. The code continues using the old leaf pointer, leading to use-after-free or stale data access. Fix both issues by: - Handling -EAGAIN specifically: release the path and retry the loop. - Refreshing leaf = path->nodes[0] after successful duplication. Reviewed-by: Johannes Thumshirn Signed-off-by: robbieko Reviewed-by: David Sterba Signed-off-by: David Sterba commit 653361585d251fbca0e19ac58b04ba95dd01e378 Author: robbieko Date: Mon Apr 13 14:52:35 2026 +0800 btrfs: replace ASSERT with proper error handling in stripe lookup fallback After falling back to the previous item in btrfs_delete_raid_extent(), the code uses ASSERT(found_start <= start) to verify the found extent actually precedes our target range. If the B-tree state is unexpected (e.g. no overlapping extent exists), this triggers a kernel BUG/panic in debug builds, or silently continues with wrong data otherwise. Replace the ASSERT with a proper bounds check that returns -ENOENT if the found extent does not actually overlap with the start position. Signed-off-by: robbieko Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1871ae78ffa5ce7c0458e9ba5867958c1753e425 Author: robbieko Date: Mon Apr 13 14:52:34 2026 +0800 btrfs: fix wrong min_objectid in btrfs_previous_item() call When found_start > start and slot == 0, btrfs_previous_item() is called with min_objectid=start to find the previous stripe extent. However, the previous stripe extent we are looking for has objectid < start (it starts before our deletion range), so passing start as min_objectid prevents finding it. Fix by passing 0 as min_objectid to allow finding any preceding stripe extent regardless of its objectid. Reviewed-by: Johannes Thumshirn Signed-off-by: robbieko Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2aef5cb1dcf9b3e1be3895a6477dc065e618aab8 Author: robbieko Date: Mon Apr 13 14:52:33 2026 +0800 btrfs: fix raid stripe search missing entries at leaf boundaries In btrfs_delete_raid_extent(), the search key uses offset=0. When the target stripe entry is the first item on a leaf, btrfs_search_slot() may land on the previous leaf and decrementing the slot from nritems still points to the wrong entry, causing the stripe extent to be silently missed. Fix this by searching with offset=(u64)-1 instead. Since no real stripe entry has this offset, btrfs_search_slot() always returns 1 with the slot pointing past the last matching objectid entry. Then unconditionally decrement the slot with a proper slots[0]==0 early-exit check to handle the case where no matching entry exists. Reviewed-by: Johannes Thumshirn Signed-off-by: robbieko Signed-off-by: David Sterba commit 513f8a52eed880ea525dbb139b2127bd9bb793f1 Author: robbieko Date: Mon Apr 13 14:52:32 2026 +0800 btrfs: copy devid in btrfs_partially_delete_raid_extent() When btrfs_partially_delete_raid_extent() rebuilds a truncated/shifted stripe extent into newitem, the loop copies the physical address for each stride but forgets to copy the devid. The resulting item written back to the stripe tree has zeroed-out devids, corrupting the stripe mapping. Fix this by reading the devid with btrfs_raid_stride_devid() and writing it into the new item with btrfs_set_stack_raid_stride_devid() before copying the physical address. Reviewed-by: Johannes Thumshirn Signed-off-by: robbieko Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4d95b9efd783adca472e957b2f576983e789b839 Author: David Sterba Date: Tue Apr 14 17:30:31 2026 +0200 btrfs: handle unexpected free-space-tree key types Replace the conditional assertions with proper error handling and transaction abort if we find an unexpected key type in the free space tree. Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit 999757231c49376cd1a37308d2c8c4c9932571e1 Author: Filipe Manana Date: Thu Apr 9 15:46:51 2026 +0100 btrfs: fix missing last_unlink_trans update when removing a directory When removing a directory we are not updating its last_unlink_trans field, which can result in incorrect fsync behaviour in case some one fsyncs the directory after it was removed because it's holding a file descriptor on it. Example scenario: mkdir /mnt/dir1 mkdir /mnt/dir1/dir2 mkdir /mnt/dir3 sync -f /mnt # Do some change to the directory and fsync it. chmod 700 /mnt/dir1 xfs_io -c fsync /mnt/dir1 # Move dir2 out of dir1 so that dir1 becomes empty. mv /mnt/dir1/dir2 /mnt/dir3/ open fd on /mnt/dir1 call rmdir(2) on path "/mnt/dir1" fsync fd When attempting to mount the filesystem, the log replay will fail with an -EIO error and dmesg/syslog has the following: [445771.626482] BTRFS info (device dm-0): first mount of filesystem 0368bbea-6c5e-44b5-b409-09abe496e650 [445771.626486] BTRFS info (device dm-0): using crc32c checksum algorithm [445771.627912] BTRFS info (device dm-0): start tree-log replay [445771.628335] page: refcount:2 mapcount:0 mapping:0000000061443ddc index:0x1d00 pfn:0x7072a5 [445771.629453] memcg:ffff89f400351b00 [445771.629892] aops:btree_aops [btrfs] ino:1 [445771.630737] flags: 0x17fffc00000402a(uptodate|lru|private|writeback|node=0|zone=2|lastcpupid=0x1ffff) [445771.632359] raw: 017fffc00000402a fffff47284d950c8 fffff472907b7c08 ffff89f458e412b8 [445771.633713] raw: 0000000000001d00 ffff89f6c51d1a90 00000002ffffffff ffff89f400351b00 [445771.635029] page dumped because: eb page dump [445771.635825] BTRFS critical (device dm-0): corrupt leaf: root=5 block=30408704 slot=10 ino=258, invalid nlink: has 2 expect no more than 1 for dir [445771.638088] BTRFS info (device dm-0): leaf 30408704 gen 10 total ptrs 17 free space 14878 owner 5 [445771.638091] BTRFS info (device dm-0): refs 4 lock_owner 0 current 3581087 [445771.638094] item 0 key (256 INODE_ITEM 0) itemoff 16123 itemsize 160 [445771.638097] inode generation 3 transid 9 size 16 nbytes 16384 [445771.638098] block group 0 mode 40755 links 1 uid 0 gid 0 [445771.638100] rdev 0 sequence 2 flags 0x0 [445771.638102] atime 1775744884.0 [445771.660056] ctime 1775744885.645502983 [445771.660058] mtime 1775744885.645502983 [445771.660060] otime 1775744884.0 [445771.660062] item 1 key (256 INODE_REF 256) itemoff 16111 itemsize 12 [445771.660064] index 0 name_len 2 [445771.660066] item 2 key (256 DIR_ITEM 1843588421) itemoff 16077 itemsize 34 [445771.660068] location key (259 1 0) type 2 [445771.660070] transid 9 data_len 0 name_len 4 [445771.660075] item 3 key (256 DIR_ITEM 2363071922) itemoff 16043 itemsize 34 [445771.660076] location key (257 1 0) type 2 [445771.660077] transid 9 data_len 0 name_len 4 [445771.660078] item 4 key (256 DIR_INDEX 2) itemoff 16009 itemsize 34 [445771.660079] location key (257 1 0) type 2 [445771.660080] transid 9 data_len 0 name_len 4 [445771.660081] item 5 key (256 DIR_INDEX 3) itemoff 15975 itemsize 34 [445771.660082] location key (259 1 0) type 2 [445771.660083] transid 9 data_len 0 name_len 4 [445771.660084] item 6 key (257 INODE_ITEM 0) itemoff 15815 itemsize 160 [445771.660086] inode generation 9 transid 9 size 8 nbytes 0 [445771.660087] block group 0 mode 40777 links 1 uid 0 gid 0 [445771.660088] rdev 0 sequence 2 flags 0x0 [445771.660089] atime 1775744885.641174097 [445771.660090] ctime 1775744885.645502983 [445771.660091] mtime 1775744885.645502983 [445771.660105] otime 1775744885.641174097 [445771.660106] item 7 key (257 INODE_REF 256) itemoff 15801 itemsize 14 [445771.660107] index 2 name_len 4 [445771.660108] item 8 key (257 DIR_ITEM 2676584006) itemoff 15767 itemsize 34 [445771.660109] location key (258 1 0) type 2 [445771.660110] transid 9 data_len 0 name_len 4 [445771.660111] item 9 key (257 DIR_INDEX 2) itemoff 15733 itemsize 34 [445771.660112] location key (258 1 0) type 2 [445771.660113] transid 9 data_len 0 name_len 4 [445771.660114] item 10 key (258 INODE_ITEM 0) itemoff 15573 itemsize 160 [445771.660115] inode generation 9 transid 10 size 0 nbytes 0 [445771.660116] block group 0 mode 40755 links 2 uid 0 gid 0 [445771.660117] rdev 0 sequence 0 flags 0x0 [445771.660118] atime 1775744885.645502983 [445771.660119] ctime 1775744885.645502983 [445771.660120] mtime 1775744885.645502983 [445771.660121] otime 1775744885.645502983 [445771.660122] item 11 key (258 INODE_REF 257) itemoff 15559 itemsize 14 [445771.660123] index 2 name_len 4 [445771.660124] item 12 key (258 INODE_REF 259) itemoff 15545 itemsize 14 [445771.660125] index 2 name_len 4 [445771.660126] item 13 key (259 INODE_ITEM 0) itemoff 15385 itemsize 160 [445771.660127] inode generation 9 transid 10 size 8 nbytes 0 [445771.660128] block group 0 mode 40755 links 1 uid 0 gid 0 [445771.660129] rdev 0 sequence 1 flags 0x0 [445771.660130] atime 1775744885.645502983 [445771.660130] ctime 1775744885.645502983 [445771.660131] mtime 1775744885.645502983 [445771.660132] otime 1775744885.645502983 [445771.660133] item 14 key (259 INODE_REF 256) itemoff 15371 itemsize 14 [445771.660134] index 3 name_len 4 [445771.660135] item 15 key (259 DIR_ITEM 2676584006) itemoff 15337 itemsize 34 [445771.660136] location key (258 1 0) type 2 [445771.660137] transid 10 data_len 0 name_len 4 [445771.660138] item 16 key (259 DIR_INDEX 2) itemoff 15303 itemsize 34 [445771.660139] location key (258 1 0) type 2 [445771.660140] transid 10 data_len 0 name_len 4 [445771.660144] BTRFS error (device dm-0): block=30408704 write time tree block corruption detected [445771.661650] ------------[ cut here ]------------ [445771.662358] WARNING: fs/btrfs/disk-io.c:326 at btree_csum_one_bio+0x217/0x230 [btrfs], CPU#8: mount/3581087 [445771.663588] Modules linked in: btrfs f2fs xfs (...) [445771.671229] CPU: 8 UID: 0 PID: 3581087 Comm: mount Tainted: G W 7.0.0-rc6-btrfs-next-230+ #2 PREEMPT(full) [445771.672575] Tainted: [W]=WARN [445771.672987] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [445771.674460] RIP: 0010:btree_csum_one_bio+0x217/0x230 [btrfs] [445771.675222] Code: 89 44 24 (...) [445771.677364] RSP: 0018:ffffd23882247660 EFLAGS: 00010246 [445771.678029] RAX: 0000000000000000 RBX: ffff89f6c51d1a90 RCX: 0000000000000000 [445771.678975] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff89f406020000 [445771.679983] RBP: ffff89f821204000 R08: 0000000000000000 R09: 00000000ffefffff [445771.680905] R10: ffffd23882247448 R11: 0000000000000003 R12: ffffd23882247668 [445771.681978] R13: ffff89f458e40fc0 R14: ffff89f737f4f500 R15: ffff89f737f4f500 [445771.682912] FS: 00007f0447a98840(0000) GS:ffff89fb9771d000(0000) knlGS:0000000000000000 [445771.684393] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [445771.685230] CR2: 00007f0447bf1330 CR3: 000000017cb02002 CR4: 0000000000370ef0 [445771.686273] Call Trace: [445771.686646] [445771.686969] btrfs_submit_bbio+0x83f/0x860 [btrfs] [445771.687750] ? write_one_eb+0x28f/0x340 [btrfs] [445771.688428] btree_writepages+0x2e3/0x550 [btrfs] [445771.689180] ? kmem_cache_alloc_noprof+0x12a/0x490 [445771.689963] ? alloc_extent_state+0x19/0x120 [btrfs] [445771.690801] ? kmem_cache_free+0x135/0x380 [445771.691328] ? preempt_count_add+0x69/0xa0 [445771.691831] ? set_extent_bit+0x252/0x8e0 [btrfs] [445771.692468] ? xas_load+0x9/0xc0 [445771.692873] ? xas_find+0x14d/0x1a0 [445771.693304] do_writepages+0xc6/0x160 [445771.693756] filemap_writeback+0xb8/0xe0 [445771.694274] btrfs_write_marked_extents+0x61/0x170 [btrfs] [445771.694999] btrfs_write_and_wait_transaction+0x4e/0xc0 [btrfs] [445771.695818] btrfs_commit_transaction+0x5c8/0xd10 [btrfs] [445771.696530] ? kmem_cache_free+0x135/0x380 [445771.697120] ? release_extent_buffer+0x34/0x160 [btrfs] [445771.697786] btrfs_recover_log_trees+0x7be/0x7e0 [btrfs] [445771.698525] ? __pfx_replay_one_buffer+0x10/0x10 [btrfs] [445771.699206] open_ctree+0x11e5/0x1810 [btrfs] [445771.699776] btrfs_get_tree.cold+0xb/0x162 [btrfs] [445771.700463] ? fscontext_read+0x165/0x180 [445771.701146] ? rw_verify_area+0x50/0x180 [445771.701866] vfs_get_tree+0x25/0xd0 [445771.702491] vfs_cmd_create+0x59/0xe0 [445771.703125] __do_sys_fsconfig+0x303/0x610 [445771.703603] do_syscall_64+0xe9/0xf20 [445771.703974] entry_SYSCALL_64_after_hwframe+0x76/0x7e [445771.704700] RIP: 0033:0x7f0447cbd4aa [445771.705108] Code: 73 01 c3 (...) [445771.707263] RSP: 002b:00007ffc4e528318 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [445771.708107] RAX: ffffffffffffffda RBX: 00005561585d8c20 RCX: 00007f0447cbd4aa [445771.708931] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [445771.709744] RBP: 00005561585d9120 R08: 0000000000000000 R09: 0000000000000000 [445771.710674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [445771.711477] R13: 00007f0447e4f580 R14: 00007f0447e5126c R15: 00007f0447e36a23 [445771.712277] [445771.712541] ---[ end trace 0000000000000000 ]--- [445771.713382] BTRFS error (device dm-0): error while writing out transaction: -5 [445771.714679] BTRFS warning (device dm-0): Skipping commit of aborted transaction. [445771.715562] BTRFS error (device dm-0 state A): Transaction aborted (error -5) [445771.716459] BTRFS: error (device dm-0 state A) in cleanup_transaction:2068: errno=-5 IO failure [445771.717936] BTRFS error (device dm-0 state EA): failed to recover log trees with error: -5 [445771.719681] BTRFS error (device dm-0 state EA): open_ctree failed: -5 The problem is that such a fsync should have result in a fallback to a transaction commit, but that did not happen because through the btrfs_rmdir() we never update the directory's last_unlink_trans field. Any inode that had a link removed must have its last_unlink_trans updated to the ID of transaction used for the operation, otherwise fsync and log replay will not work correctly. btrfs_rmdir() calls btrfs_unlink_inode() and through that call chain we never call btrfs_record_unlink_dir() in order to update last_unlink_trans. However btrfs_unlink(), which is used for unlinking regular files, calls btrfs_record_unlink_dir() and then calls btrfs_unlink_inode(). So fix this by moving the call to btrfs_record_unlink_dir() from btrfs_unlink() to btrfs_unlink_inode(). A test case for fstests will follow soon. Reported-by: Slava0135 Link: https://lore.kernel.org/linux-btrfs/CAAJYhww5ov62Hm+n+tmhcL-e_4cBobg+OWogKjOJxVUXivC=MQ@mail.gmail.com/ CC: stable@vger.kernel.org Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 44366af74061793ee5ceef455a4f0e465892d0de Author: Mark Harmstone Date: Mon Mar 23 17:17:01 2026 +0000 btrfs: don't clobber errors in add_remap_tree_entries() In add_remap_tree_entries(), we only process a certain number of entries at a time, meaning we may need to loop. But because we weren't checking the return value of btrfs_insert_empty_items() within the loop, this meant that if the last iteration of the loop succeeded but a previous iteration failed, we were erroneously returning 0. Fix this by breaking the loop early if btrfs_insert_empty_items() fails. Fixes: b56f35560b82 ("btrfs: handle setting up relocation of block group with remap-tree") Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 41e706c07ef9f752a08f0b9567176ac79441895f Author: Qu Wenruo Date: Tue Apr 14 11:51:15 2026 +0930 btrfs: enable shutdown ioctl for non-experimental builds Although commit 304076527c38 ("btrfs: move shutdown and remove_bdev callbacks out of experimental features") tries to move both shutdown and remove_bdev out of experimental features, that commit has only addressed the super block operation callback, the ioctl one is left untouched. Fix that missing aspect by also moving shutdown ioctl out of experimental features. Since we're here, also add unknown flag detection to reject any unsupported shutdown flags. Fixes: 304076527c38 ("btrfs: move shutdown and remove_bdev callbacks out of experimental features") Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit a86a283430e1a44907b142c4f53e1f3ad24e87ae Author: Qu Wenruo Date: Sun Apr 12 20:31:05 2026 +0930 btrfs: apply first key check for readahead when possible Currently for tree block readahead we never pass a btrfs_tree_parent_check with @has_first_key set. Without @has_first_key set, btrfs will skip the following extra checks: - Header generation check This is a minor one. - Empty leaf/node checks This is more serious, for certain trees like the csum tree, they are allowed to be empty, thus an empty leaf can pass the tree checker. But if there is a parent node for such an empty leaf, it indicates corruption. Without @has_first_key set, we can no longer detect such a problem. In fact there is already a fuzzed image report that a corrupted csum leaf which has zero nritems but still has a parent node can trigger a BUG_ON() during csum deletion. However there are only two call sites of btrfs_readahead_tree_block(): - Inside relocate_tree_blocks() At this call site we are trying to grab the first key of the tree block, thus we are not able to pass a @first_key parameter. - Inside btrfs_readahead_node_child() This is the more common call site, where we have the parent node and want to readahead the child tree blocks. In this case we can easily grab the node key and pass it for checks. Add a new parameter @first_key to btrfs_readahead_tree_block() and pass the node key to it inside btrfs_readahead_node_child(). This should plug the gap in empty leaf detection during readahead. Link: https://lore.kernel.org/linux-btrfs/20260409071255.3358044-1-gality369@gmail.com/ Reviewed-by: David Sterba Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 73db0fad673af844772de964eebecae60eda0496 Author: Mark Harmstone Date: Mon Mar 23 17:16:43 2026 +0000 btrfs: abort transaction in do_remap_reloc_trans() on failure If one of the calls made by do_remap_reloc_trans() fails, we can leave the remap tree in an inconsistent state. Abort the transaction if this happens, to prevent the corrupt state from reaching the disk. Reviewed-by: Johannes Thumshirn Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit 9b8824533d75fb199a3fb0f6147ffcca64b5caf8 Author: Mark Harmstone Date: Mon Mar 23 12:59:57 2026 +0000 btrfs: fix bytes_may_use leak in do_remap_reloc_trans() If the call to btrfs_reserve_extent() in do_remap_reloc_trans() returns a smaller extent than we asked for, currently we're not undoing the bytes_may_use change that we made. Fix this by calling btrfs_space_info_update_bytes_may_use() again for the difference. Fixes: fd6594b1446c ("btrfs: replace identity remaps with actual remaps when doing relocations") Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit 68a135013bf73dfd6a277f76fc4e088b0f3dfa79 Author: Mark Harmstone Date: Mon Mar 23 12:59:47 2026 +0000 btrfs: fix bytes_may_use leak in move_existing_remap() If the call to btrfs_reserve_extent() in move_existing_remap() returns a smaller extent than we asked for, currently we're not undoing the bytes_may_use change that we made. Fix this by calling btrfs_space_info_update_bytes_may_use() again for the difference. Fixes: bbea42dfb91f ("btrfs: move existing remaps before relocating block group") Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit b4e07588e743c989499ca24d49e752c074924a9a Author: Linus Torvalds Date: Mon Apr 20 17:25:56 2026 -0700 tracing: tell git to ignore the generated 'undefsyms_base.c' file This odd file was added to automatically figure out tool-generated symbols. Honestly, it *should* have been just a real honest-to-goodness regular file in git, instead of having strange code to generate it in the Makefile, but that is not how that silly thing works. So now we need to ignore it explicitly. Fixes: 1211907ac0b5 ("tracing: Generate undef symbols allowlist for simple_ring_buffer") Cc: Vincent Donnefort Cc: Nathan Chancellor Cc: Steven Rostedt (Google) Cc: Arnd Bergmann Cc: Marc Zyngier Signed-off-by: Linus Torvalds commit f154634e42f724a3444694273e396f0a62fef3f1 Merge: 13f24586a292e3 83ef26f911432d Author: Linus Torvalds Date: Mon Apr 20 17:19:30 2026 -0700 Merge tag 'linux_kselftest-next-7.1-next-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: "Fix regressions in non-bash shells and busybox support, and revert a commit that regressed in build and installation when one or more tests fail to build. Fix duplicated test number reporting introduced in ktap support patch" * tag 'linux_kselftest-next-7.1-next-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: Fix duplicated test number reporting selftests: Fix runner.sh for non-bash shells selftests: Fix runner.sh busybox support selftests: Deescalate error reporting commit 13f24586a292e35c9cc71e649dc4e4ea1895c5e5 Merge: ce9e93383ad71d 858fbd7248bd84 Author: Linus Torvalds Date: Mon Apr 20 16:46:22 2026 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull more arm64 updates from Catalin Marinas: "The main 'feature' is a workaround for C1-Pro erratum 4193714 requiring IPIs during TLB maintenance if a process is running in user space with SME enabled. The hardware acknowledges the DVMSync messages before completing in-flight SME accesses, with security implications. The workaround makes use of the mm_cpumask() to track the cores that need interrupting (arm64 hasn't used this mask before). The rest are fixes for MPAM, CCA and generated header that turned up during the merging window or shortly before. Summary: Core features: - Add workaround for C1-Pro erratum 4193714 - early CME (SME unit) DVMSync acknowledgement. The fix consists of sending IPIs on TLB maintenance to those CPUs running in user space with SME enabled - Include kernel-hwcap.h in list of generated files (missed in a recent commit generating the KERNEL_HWCAP_* macros) CCA: - Fix RSI_INCOMPLETE error check in arm-cca-guest MPAM: - Fix an unmount->remount problem with the CDP emulation, uninitialised variable and checker warnings" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm_mpam: resctrl: Make resctrl_mon_ctx_waiters static arm_mpam: resctrl: Fix the check for no monitor components found arm_mpam: resctrl: Fix MBA CDP alloc_capable handling on unmount virt: arm-cca-guest: fix error check for RSI_INCOMPLETE arm64/hwcap: Include kernel-hwcap.h in list of generated files arm64: errata: Work around early CME DVMSync acknowledgement arm64: cputype: Add C1-Pro definitions arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish() arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance commit ce9e93383ad71da468dafb9944a539808bf91c06 Merge: 065c4e67cc2c40 647b43f6535767 Author: Linus Torvalds Date: Mon Apr 20 16:41:19 2026 -0700 Merge tag 'sh-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux Pull sh updates from John Paul Adrian Glaubitz: "Two patches from Thomas Zimmermann, one by Tim Bird and one by Thomas Weißschuh. The first patch by Thomas Zimmermann adds a missing include in dac.h for SH-3 which became necessary after 243ce64b2b37 ("backlight: Do not include in header file") which made __raw_readb() and __raw_writeb() inaccessible in dac.h. Thomas' second patch drops CONFIG_FIRMWARE_EDID for SH as it depends on X86 or EFI_GENERIC_STUB which are not defined on SH for obvious reasons. The patch by Tim Bird fixes just a small typo in two SPDX ID lines which he stumbled over by accident. And, least but not last, the patch by Thomas Weißschuh removes the CONFIG_VSYSCALL reference from UAPI. This was necessary as the definition of AT_SYSINFO_EHDR was gated between CONFIG_VSYSCALL to avoid a default gate VMA to be created. However that default gate VMA was removed entirely in commit a6c19dfe3994 (arm64,ia64,ppc,s390, sh,tile,um,x86,mm: remove default gate area)" * tag 'sh-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux: sh: Drop CONFIG_FIRMWARE_EDID from defconfig files sh: Remove CONFIG_VSYSCALL reference from UAPI sh: Fix typo in SPDX license ID lines sh: Include in dac.h commit 065c4e67cc2c40e6dd94649e8e720096fbabd4ee Merge: b66cb4f156fe47 6522fe5c1b007c Author: Linus Torvalds Date: Mon Apr 20 16:36:46 2026 -0700 Merge tag 'uml-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull uml updates from Johannes Berg: "Mostly cleanups and small things, notably: - musl libc compatibility - vDSO installation fix - TLB sync race fix for recent SMP support - build fix for 32-bit with Clang 20/21" * tag 'uml-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: Disable GCOV_PROFILE_ALL on 32-bit UML with Clang 20/21 um: drivers: call kernel_strrchr() explicitly in cow_user.c um: Replace strncpy() with strnlen()+memcpy_and_pad() in strncpy_chunk_from_user() x86/um: fix vDSO installation um: Remove CONFIG_FRAME_WARN from x86_64_defconfig um: Fix pte_read() and pte_exec() for kernel mappings um: Fix potential race condition in TLB sync um: time-travel: clean up kernel-doc warnings um: avoid struct sigcontext redefinition with musl um: fix address-of CMSG_DATA() rvalue in stub commit b66cb4f156fe47f52065e70eb1b2f12ccd0c2884 Merge: ccbc9fdb327d16 add9d911be9b14 Author: Linus Torvalds Date: Mon Apr 20 15:42:18 2026 -0700 Merge tag 'printk-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Fix printk ring buffer initialization and sanity checks - Workaround printf kunit test compilation with gcc < 12.1 - Add IPv6 address printf format tests - Misc code and documentation cleanup * tag 'printk-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printf: Compile the kunit test with DISABLE_BRANCH_PROFILING DISABLE_BRANCH_PROFILING lib/vsprintf: use bool for local decode variable lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() printk: ringbuffer: fix errors in comments printk_ringbuffer: Add sanity check for 0-size data printk_ringbuffer: Fix get_data() size sanity check printf: add IPv6 address format tests printk: Fix _DESCS_COUNT type for 64-bit systems commit ccbc9fdb327d164f2a0f423e93499058e8add68c Merge: 65e9974ae2678c 4096fd0e8eaea1 Author: Linus Torvalds Date: Mon Apr 20 15:30:08 2026 -0700 Merge tag 'timers-urgent-2026-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix timer stalls caused by incorrect handling of the dev->next_event_forced flag" * tag 'timers-urgent-2026-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clockevents: Add missing resets of the next_event_forced flag commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 Author: Keenan Dong Date: Wed Apr 8 16:46:00 2026 +0800 rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ] Fixes: 8161239a8bcc ("rtmutex: Simplify PI algorithm and make highest prio task get lock") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Keenan Dong Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org commit 65e9974ae2678c218804d30a1b5f7c60532705d2 Merge: da6b5aae84beb0 7b41ff29c8d386 Author: Linus Torvalds Date: Mon Apr 20 15:07:28 2026 -0700 Merge tag 'core-urgent-2026-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull entry cleanup from Ingo Molnar: "Remove the unused ARCH_SYSCALL_WORK_{ENTER,EXIT} flags" * tag 'core-urgent-2026-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: entry: Kill ARCH_SYSCALL_WORK_{ENTER,EXIT} commit dfd2a8b07c6cc94145e11d87d2f11137d6444854 Author: Sean Christopherson Date: Mon Apr 20 14:20:04 2026 -0700 KVM: selftests: Replace "paddr" with "gpa" throughout Replace all variations of "paddr" variables in KVM selftests with "gpa", with the exception of the ELF structures, as those fields are not specific to guest virtual addresses, to complete the conversion from vm_paddr_t to gpa_t. No functional change intended. Link: https://patch.msgid.link/20260420212004.3938325-20-seanjc@google.com Signed-off-by: Sean Christopherson commit abc374191dc22c4b36d01c699d9122588ce80101 Author: Sean Christopherson Date: Mon Apr 20 14:20:03 2026 -0700 KVM: selftests: Replace "u64 nested_paddr" with "gpa_t l2_gpa" In x86's nested TDP APIs, use the appropriate gpa_t typedef and rename variables from nested_paddr to l2_gpa to match KVM x86's nomenclature. No functional change intended. Link: https://patch.msgid.link/20260420212004.3938325-19-seanjc@google.com Signed-off-by: Sean Christopherson commit df079910f9814ddb4239b4f9f70a2272a7e4116a Author: Sean Christopherson Date: Mon Apr 20 14:20:02 2026 -0700 KVM: selftests: Replace "u64 gpa" with "gpa_t" throughout Use gpa_t instead of u64 for obvious declarations of GPA variables. No functional change intended. Link: https://patch.msgid.link/20260420212004.3938325-18-seanjc@google.com Signed-off-by: Sean Christopherson commit 014dfb7b9bf3ff49261b47fbe56b42fc8ed06fc5 Author: Sean Christopherson Date: Mon Apr 20 14:20:01 2026 -0700 KVM: selftests: Replace "vaddr" with "gva" throughout Replace all variations of "vaddr" variables in KVM selftests with "gva", with the exception of the ELF structures, as those fields are not specific to guest virtual addresses, to complete the conversion from vm_vaddr_t to gva_t. Opportunistically use gva_t instead of u64 for relevant variables, and fixup indentation as appropriate. No functional change intended. Link: https://patch.msgid.link/20260420212004.3938325-17-seanjc@google.com Signed-off-by: Sean Christopherson commit a662c4e03853304ff0967c756659366efdc9ea49 Author: Sean Christopherson Date: Mon Apr 20 14:20:00 2026 -0700 KVM: selftests: Clarify that arm64's inject_uer() takes a host PA, not a guest PA Rename inject_uer()'s @paddr to @hpa to make it more obvious that it injects an error using a host PA, not a guest PA. No functional change intended. Link: https://patch.msgid.link/20260420212004.3938325-16-seanjc@google.com Signed-off-by: Sean Christopherson commit 4babae4ca10a6ba642373c45734d9df93852e6ed Author: Sean Christopherson Date: Mon Apr 20 14:19:59 2026 -0700 KVM: selftests: Rename translate_to_host_paddr() => translate_hva_to_hpa() Rename arm64's translate_to_host_paddr() to translate_hva_to_hpa() and update variable names to match, as using "vaddr" and "paddr" terminology is super confusing due to selftests using those exact names for *guest* addresses. Opportunisitically drop superfluous local page_addr and paddr variables. No functional change intended. Link: https://patch.msgid.link/20260420212004.3938325-15-seanjc@google.com Signed-off-by: Sean Christopherson commit 3fd995905b71dac9bd77a4cc770524bdc5606212 Author: Sean Christopherson Date: Mon Apr 20 14:19:58 2026 -0700 KVM: selftests: Rename vm_vaddr_populate_bitmap() => vm_populate_gva_bitmap() Now that KVM selftests use gva_t instead of vm_vaddr_t, rename the helper for populating the initial GVA bitmap to drop the defunct terminology and use "vm" for the scope. Opportunistically fixup the declaration of the API, which has been broken since day 1. The flaw went unnoticed because the sole caller is defined after the weak version, i.e. can see the prototype without a previous declaration. No functional change intended. Fixes: e8b9a055fa04 ("KVM: arm64: selftests: Align VA space allocator with TTBR0") Link: https://patch.msgid.link/20260420212004.3938325-14-seanjc@google.com Signed-off-by: Sean Christopherson commit 48321f609a73e37c26e29e0b38e38741263e7e7d Author: Sean Christopherson Date: Mon Apr 20 14:19:57 2026 -0700 KVM: selftests: Rename vm_vaddr_unused_gap() => vm_unused_gva_gap() Now that KVM selftests use gva_t instead of vm_vaddr_t, rename the API for finding an unused range of virtual memory to drop the defunct terminology and use "vm" for the scope. Opportunistically clean up the function comment to drop superfluous and redundant information. No functional change intended. Link: https://patch.msgid.link/20260420212004.3938325-13-seanjc@google.com Signed-off-by: Sean Christopherson commit 85819fa0e3b98682b8c57c6d8ba57e7a9c6032ea Author: Sean Christopherson Date: Mon Apr 20 14:19:56 2026 -0700 KVM: selftests: Drop "vaddr_" from APIs that allocate memory for a given VM Now that KVM selftests use gva_t instead of vm_vaddr_t, drop "vaddr_" from the core memory allocation APIs as the information is extraneous and does more harm than good. E.g. the APIs don't _just_ allocate virtual memory, they allocate backing physical memory and install mappings in the guest page tables. And as proven by kmalloc() and malloc(), developers generally expect that allocations come with a working virtual address. Opportunistically clean up the function comment for vm_alloc(), and drop the misleading and superfluous comments for its wrappers. No functional change intended. Link: https://patch.msgid.link/20260420212004.3938325-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 6ec982b5a2c7c9f0f956fd955416ac11f52bf50a Author: David Matlack Date: Mon Apr 20 14:19:55 2026 -0700 KVM: selftests: Use u8 instead of uint8_t Use u8 instead of uint8_t to make the KVM selftests code more concise and more similar to the kernel (since selftests are primarily developed by kernel developers). This commit was generated with the following command: git ls-files tools/testing/selftests/kvm | xargs sed -i 's/uint8_t/u8/g' Then by manually adjusting whitespace to make checkpatch.pl happy. No functional change intended. Signed-off-by: David Matlack Link: https://patch.msgid.link/20260420212004.3938325-11-seanjc@google.com Signed-off-by: Sean Christopherson commit 2540ebd60349b7c0194abdd6f13c1ab6db3b9909 Author: David Matlack Date: Mon Apr 20 14:19:54 2026 -0700 KVM: selftests: Use s16 instead of int16_t Use s16 instead of int16_t to make the KVM selftests code more concise and more similar to the kernel (since selftests are primarily developed by kernel developers). This commit was generated with the following command: git ls-files tools/testing/selftests/kvm | xargs sed -i 's/int16_t/s16/g' Then by manually adjusting whitespace to make checkpatch.pl happy. No functional change intended. Signed-off-by: David Matlack Link: https://patch.msgid.link/20260420212004.3938325-10-seanjc@google.com Signed-off-by: Sean Christopherson commit 19d0914920042139097f74159d812a1584bdc5a4 Author: David Matlack Date: Mon Apr 20 14:19:53 2026 -0700 KVM: selftests: Use u16 instead of uint16_t Use u16 instead of uint16_t to make the KVM selftests code more concise and more similar to the kernel (since selftests are primarily developed by kernel developers). This commit was generated with the following command: git ls-files tools/testing/selftests/kvm | xargs sed -i 's/uint16_t/u16/g' Then by manually adjusting whitespace to make checkpatch.pl happy. No functional change intended. Signed-off-by: David Matlack Link: https://patch.msgid.link/20260420212004.3938325-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 7b609187684db646d4854ada6f7e19a6420b4621 Author: David Matlack Date: Mon Apr 20 14:19:52 2026 -0700 KVM: selftests: Use s32 instead of int32_t Use s32 instead of int32_t to make the KVM selftests code more concise and more similar to the kernel (since selftests are primarily developed by kernel developers). This commit was generated with the following command: git ls-files tools/testing/selftests/kvm | xargs sed -i 's/int32_t/s32/g' Then by manually adjusting whitespace to make checkpatch.pl happy. No functional change intended. Signed-off-by: David Matlack Link: https://patch.msgid.link/20260420212004.3938325-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 0c3a8774692aaf211b6916aaa9ecc5ca1a72c451 Author: David Matlack Date: Mon Apr 20 14:19:51 2026 -0700 KVM: selftests: Use u32 instead of uint32_t Use u32 instead of uint32_t to make the KVM selftests code more concise and more similar to the kernel (since selftests are primarily developed by kernel developers). This commit was generated with the following command: git ls-files tools/testing/selftests/kvm | xargs sed -i 's/uint32_t/u32/g' Then by manually adjusting whitespace to make checkpatch.pl happy. No functional change intended. Signed-off-by: David Matlack Link: https://patch.msgid.link/20260420212004.3938325-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 286e8903aed14cc4f64be8e72d5b28ab2b8982aa Author: David Matlack Date: Mon Apr 20 14:19:50 2026 -0700 KVM: selftests: Use s64 instead of int64_t Use s64 instead of int64_t to make the KVM selftests code more concise and more similar to the kernel (since selftests are primarily developed by kernel developers). This commit was generated with the following command: git ls-files tools/testing/selftests/kvm | xargs sed -i 's/int64_t/s64/g' Then by manually adjusting whitespace to make checkpatch.pl happy. No functional change intended. Signed-off-by: David Matlack Link: https://patch.msgid.link/20260420212004.3938325-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 26f8453288d4c1fb8c96802eae15ddc988f5e068 Author: David Matlack Date: Mon Apr 20 14:19:49 2026 -0700 KVM: selftests: Use u64 instead of uint64_t Use u64 instead of uint64_t to make the KVM selftests code more concise and more similar to the kernel (since selftests are primarily developed by kernel developers). This commit was generated with the following command: git ls-files tools/testing/selftests/kvm | xargs sed -i 's/uint64_t/u64/g' Then by manually adjusting whitespace to make checkpatch.pl happy. Include in include/kvm_util_types.h, iinclude/test_util.h, and include/x86/pmu.h to pick up the tools-defined u64. Arguably, all headers (especially kvm_util_types.h) should have already been including stdint.h to get uint64_t from the libc headers, but the missing dependency only rears its head once KVM uses u64 instead of uint64_t. No functional change intended. Signed-off-by: David Matlack [sean: rename pread_uint64() => pread_u64, expand on types.h include] Link: https://patch.msgid.link/20260420212004.3938325-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 6d3494255ac0180d3047ea632367718e0625bd2c Author: David Matlack Date: Mon Apr 20 14:19:48 2026 -0700 KVM: selftests: Use gpa_t for GPAs in Hyper-V selftests Fix various Hyper-V selftests to use gpa_t for variables that contain guest physical addresses, rather than gva_t. In practice, the bugs are benign as both gva_t and gpa_t are u64 typedefs, i.e. gpa_t and gva_t are interchangeable from a functional perspective, the code is just confusing. No functional change intended. Signed-off-by: David Matlack [sean: call out that both are u64 typedefs] Link: https://patch.msgid.link/20260420212004.3938325-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 97dcda3fdce5f4f0d689a097f1ff13e1f76f8f49 Author: David Matlack Date: Mon Apr 20 14:19:47 2026 -0700 KVM: selftests: Use gpa_t instead of vm_paddr_t Replace all occurrences of vm_paddr_t with gpa_t to align with KVM code and with the conversion helpers (e.g. addr_hva2gpa()). This commit was generated with the following command: git ls-files tools/testing/selftests/kvm | xargs sed -i 's/vm_paddr_/gpa_/g' Then by manually adjusting whitespace to make checkpatch.pl happy. No functional change intended. Signed-off-by: David Matlack [sean: drop bogus changelog blurb about renaming functions] Link: https://patch.msgid.link/20260420212004.3938325-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 5567fc9dcd7ed46678cd68e6ca0662331d42f0ac Author: David Matlack Date: Mon Apr 20 14:19:46 2026 -0700 KVM: selftests: Use gva_t instead of vm_vaddr_t Replace all occurrences of vm_vaddr_t with gva_t to align with KVM code and with the conversion helpers (e.g. addr_gva2hva()). This commit was generated with the following command: git ls-files tools/testing/selftests/kvm | xargs sed -i 's/vm_vaddr_/gva_/g' Then by manually adjusting whitespace to make checkpatch.pl happy, and dropping renames of functions that allocate memory within a given VM. No functional change intended. Signed-off-by: David Matlack [sean: drop renames of allocator APIs] Link: https://patch.msgid.link/20260420212004.3938325-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 711987ba281fd806322a7cd244e98e2a81903114 Author: Fernando Fernandez Mancera Date: Fri Apr 17 18:20:57 2026 +0200 netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check The nf_osf_ttl() function accessed skb->dev to perform a local interface address lookup without verifying that the device pointer was valid. Additionally, the implementation utilized an in_dev_for_each_ifa_rcu loop to match the packet source address against local interface addresses. It assumed that packets from the same subnet should not see a decrement on the initial TTL. A packet might appear it is from the same subnet but it actually isn't especially in modern environments with containers and virtual switching. Remove the device dereference and interface loop. Replace the logic with a switch statement that evaluates the TTL according to the ttl_check. Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match") Reported-by: Kito Xu (veritas501) Closes: https://lore.kernel.org/netfilter-devel/20260414074556.2512750-1-hxzene@gmail.com/ Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Pablo Neira Ayuso Signed-off-by: Pablo Neira Ayuso commit f5ca450087c3baf3651055e7a6de92600f827af3 Author: Fernando Fernandez Mancera Date: Fri Apr 17 18:20:56 2026 +0200 netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once and passed by reference to nf_osf_match_one() for each fingerprint checked. During TCP option parsing, nf_osf_match_one() advances the shared ctx->optp pointer. If a fingerprint perfectly matches, the function returns early without restoring ctx->optp to its initial state. If the user has configured NF_OSF_LOGLEVEL_ALL, the loop continues to the next fingerprint. However, because ctx->optp was not restored, the next call to nf_osf_match_one() starts parsing from the end of the options buffer. This causes subsequent matches to read garbage data and fail immediately, making it impossible to log more than one match or logging incorrect matches. Instead of using a shared ctx->optp pointer, pass the context as a constant pointer and use a local pointer (optp) for TCP option traversal. This makes nf_osf_match_one() strictly stateless from the caller's perspective, ensuring every fingerprint check starts at the correct option offset. Fixes: 1a6a0951fc00 ("netfilter: nfnetlink_osf: add missing fmatch check") Suggested-by: Florian Westphal Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Pablo Neira Ayuso Signed-off-by: Pablo Neira Ayuso commit 67bf42cae41d847fd6e5749eb68278ca5d748b25 Author: Yingnan Zhang <342144303@qq.com> Date: Wed Apr 15 22:40:29 2026 +0800 ipvs: fix MTU check for GSO packets in tunnel mode Currently, IPVS skips MTU checks for GSO packets by excluding them with the !skb_is_gso(skb) condition. This creates problems when IPVS tunnel mode encapsulates GSO packets with IPIP headers. The issue manifests in two ways: 1. MTU violation after encapsulation: When a GSO packet passes through IPVS tunnel mode, the original MTU check is bypassed. After adding the IPIP tunnel header, the packet size may exceed the outgoing interface MTU, leading to unexpected fragmentation at the IP layer. 2. Fragmentation with problematic IP IDs: When net.ipv4.vs.pmtu_disc=1 and a GSO packet with multiple segments is fragmented after encapsulation, each segment gets a sequentially incremented IP ID (0, 1, 2, ...). This happens because: a) The GSO packet bypasses MTU check and gets encapsulated b) At __ip_finish_output, the oversized GSO packet is split into separate SKBs (one per segment), with IP IDs incrementing c) Each SKB is then fragmented again based on the actual MTU This sequential IP ID allocation differs from the expected behavior and can cause issues with fragment reassembly and packet tracking. Fix this by properly validating GSO packets using skb_gso_validate_network_len(). This function correctly validates whether the GSO segments will fit within the MTU after segmentation. If validation fails, send an ICMP Fragmentation Needed message to enable proper PMTU discovery. Fixes: 4cdd34084d53 ("netfilter: nf_conntrack_ipv6: improve fragmentation handling") Signed-off-by: Yingnan Zhang <342144303@qq.com> Acked-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit 6eda0d771f94267f73f57c94630aa47e90957915 Author: Pablo Neira Ayuso Date: Wed Apr 15 17:29:45 2026 +0200 netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register the callbacks. However, in v5.14 I added the ability to dump the active netfilter hooks from userspace. This code will peek back into the nf_hook_ops that are available at the tail of the pointer-array blob used by the datapath. The nat hooks are special, because they are called indirectly from the central nat dispatcher hook. They are currently invisible to the nfnl hook dump subsystem though. But once that changes the nat ops structures have to be deferred too." Update nf_nat_register_fn() to deal with partial exposition of the hooks from error path which can be also an issue for nfnetlink_hook. Fixes: e2cf17d3774c ("netfilter: add new hook nfnl subsystem") Signed-off-by: Pablo Neira Ayuso commit b6fe26f86a1649f84e057f3f15605b08eda15497 Author: Pablo Neira Ayuso Date: Wed Apr 15 12:21:00 2026 +0200 netfilter: xtables: restrict several matches to inet family This is a partial revert of: commit ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions") to allow ipv4 and ipv6 only. - xt_mac - xt_owner - xt_physdev These extensions are not used by ebtables in userspace. Moreover, xt_realm is only for ipv4, since dst->tclassid is ipv4 specific. Fixes: ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions") Reported-by: "Kito Xu (veritas501)" Signed-off-by: Pablo Neira Ayuso commit 6e7066bdb481a87fe88c4fa563e348c03b2d373d Author: Florian Westphal Date: Tue Apr 14 19:13:46 2026 +0200 netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer size in mangle_content_len() while at it. BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnprintf+0xea5/0x1270 sprintf+0xb1/0xe0 mangle_content_len+0x1ac/0x280 nf_nat_sdp_session+0x1cc/0x240 process_sdp+0x8f8/0xb80 process_invite_request+0x108/0x2b0 process_sip_msg+0x5da/0xf50 sip_help_tcp+0x45e/0x780 nf_confirm+0x34d/0x990 [..] Fixes: 9fafcd7b2032 ("[NETFILTER]: nf_conntrack/nf_nat: add SIP helper port") Reported-by: Yiming Qian Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 2195574dc6d9017d32ac346987e12659f931d932 Author: Xiang Mei Date: Tue Apr 14 15:14:01 2026 -0700 netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO nf_osf_match_one() computes ctx->window % f->wss.val in the OSF_WSS_MODULO branch with no guard for f->wss.val == 0. A CAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a subsequent matching TCP SYN divides by zero and panics the kernel. Reject the bogus fingerprint in nfnl_osf_add_callback() above the per-option for-loop. f->wss is per-fingerprint, not per-option, so the check must run regardless of f->opt_num (including 0). Also reject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that as "should not happen". Crash: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98) Call Trace: nf_osf_match (net/netfilter/nfnetlink_osf.c:220) xt_osf_match_packet (net/netfilter/xt_osf.c:32) ipt_do_table (net/ipv4/netfilter/ip_tables.c:348) nf_hook_slow (net/netfilter/core.c:622) ip_local_deliver (net/ipv4/ip_input.c:265) ip_rcv (include/linux/skbuff.h:1162) __netif_receive_skb_one_core (net/core/dev.c:6181) process_backlog (net/core/dev.c:6642) __napi_poll (net/core/dev.c:7710) net_rx_action (net/core/dev.c:7945) handle_softirqs (kernel/softirq.c:622) Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match") Reported-by: Weiming Shi Suggested-by: Florian Westphal Suggested-by: Pablo Neira Ayuso Signed-off-by: Xiang Mei Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit b336fdbb7103fb1484e1dcb6741151d4b5a41e35 Author: Pablo Neira Ayuso Date: Tue Apr 14 13:06:38 2026 +0200 netfilter: nft_osf: restrict it to ipv4 This expression only supports for ipv4, restrict it. Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf") Acked-by: Florian Westphal Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 42a702aaedf54aa8056fc429fc757a600182e5f7 Author: Jens Axboe Date: Mon Apr 20 14:04:00 2026 +0000 io_uring: fix iowq_limits data race in tctx node addition __io_uring_add_tctx_node() reads ctx->int_flags and ctx->iowq_limits[0..1] without holding ctx->uring_lock, while io_register_iowq_max_workers() writes these same fields under the lock. Mostly an application problem if you try and make these race, but let's silence KCSAN by just grabbing the ->uring_lock around the operation. This is a slow path operation anyway, and ->uring_lock will be grabbed by submission right after anyway. Fixes: 2e480058ddc2 ("io-wq: provide a way to limit max number of workers") Signed-off-by: Jens Axboe commit 9874b2917b9fbc30956fee209d3c4aa47201c64e Author: Rick Edgecombe Date: Thu Apr 9 11:43:30 2026 -0700 x86/shstk: Prevent deadlock during shstk sigreturn During sigreturn the shadow stack signal frame is popped. The kernel does this by reading the shadow stack using normal read accesses. When it can't assume the memory is shadow stack, it takes extra steps to makes sure it is reading actual shadow stack memory and not other normal readable memory. It does this by holding the mmap read lock while doing the access and checking the flags of the VMA. Unfortunately that is not safe. If the read of the shadow stack sigframe hits a page fault, the fault handler will try to recursively grab another mmap read lock. This normally works ok, but if a writer on another CPU is also waiting, the second read lock could fail and cause a deadlock. Fix this by not holding mmap lock during the read access to userspace. Instead use mmap_lock_speculate_...() to watch for changes between dropping mmap lock and the userspace access. Retry if anything grabbed an mmap write lock in between and could have changed the VMA. These mmap_lock_speculate_...() helpers use mm::mm_lock_seq, which is only available when PER_VMA_LOCK is configured. So make X86_USER_SHADOW_STACK depend on it. On x86, PER_VMA_LOCK is a default configuration for SMP kernels. So drop support for the other configs under the assumption that the !SMP shadow stack user base does not exist. Currently there is a check that skips the lookup work when the SSP can be assumed to be on a shadow stack. While reorganizing the function, remove the optimization to make the tricky code flows more common, such that issues like this cannot escape detection for so long. Fixes: 7fad2a432cd3 ("x86/shstk: Check that signal frame is shadow stack mem") Suggested-by: Linus Torvalds Signed-off-by: Rick Edgecombe Signed-off-by: Thomas Gleixner Reviewed-by: Dave Hansen Reviewed-by: Thomas Gleixner Cc: stable@vger.kernel.org commit 41859843f27dd5c8d3bc43489ad9196c96d39f2b Author: Jens Axboe Date: Thu Apr 16 10:05:41 2026 -0600 io_uring/tctx: mark io_wq as exiting before error path teardown syzbot reports that it's hitting the below condition for exiting an io_wq context: WARN_ON_ONCE(!test_bit(IO_WQ_BIT_EXIT, &wq->state)) in io_wq_put_and_exit(), which can be triggered with memory allocation fault injection. Ensure that the io_wq is marked as exiting to silence this warning trigger. Reported-by: syzbot+79a4cc863a8db58cd92b@syzkaller.appspotmail.com Fixes: 7880174e1e5e ("io_uring/tctx: clean up __io_uring_add_tctx_node() error handling") Reviewed-by: Clément Léger Signed-off-by: Jens Axboe commit ee5417fd02cabb6235a89daf5142ffde9aa957fd Author: Jens Axboe Date: Wed Apr 15 14:22:16 2026 -0600 io_uring/tctx: check for setup tctx->io_wq before teardown As with the idling code before it, the error exit path should check for a NULL tctx->io_wq before calling io_wq_put_and_exit(). Fixes: 7880174e1e5e ("io_uring/tctx: clean up __io_uring_add_tctx_node() error handling") Reported-by: Dan Carpenter Reviewed-by: Clément Léger Signed-off-by: Jens Axboe commit 2fc87d37be1b730a149b035f9375fdb8cc5333a5 Author: Greg Kroah-Hartman Date: Mon Apr 20 21:16:09 2026 +0200 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check nouveau_gem_pushbuf_reloc_apply() validates each relocation with if (r->reloc_bo_offset + 4 > nvbo->bo.base.size) but reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer literal 4 promotes to unsigned int, so the addition is performed in 32 bits and wraps before the comparison against the size_t bo size. Cast to u64 so the addition happens in 64-bit arithmetic. Cc: Lyude Paul Cc: Danilo Krummrich Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Simona Vetter Reported-by: Anthropic Cc: stable Assisted-by: gkh_clanker_t1000 Fixes: a1606a9596e5 ("drm/nouveau: new gem pushbuf interface, bump to 0.0.16") Signed-off-by: Greg Kroah-Hartman [ Add Fixes: tag. - Danilo ] Signed-off-by: Danilo Krummrich commit 932cdaf3e273a2727e77af97f79f12577174c5a0 Author: Steven Rostedt Date: Mon Apr 20 14:23:25 2026 -0400 ktest: Add logfile to failure directory The logfile contains a lot of useful information about the tests being run. Add it to the stored failure directory when the test fails. Cc: John 'Warthog9' Hawley Link: https://patch.msgid.link/20260420142315.7bbc3624@fedora Signed-off-by: Steven Rostedt commit 768059ede35f197575a38b10797b52402d9d4d2f Author: Steven Rostedt Date: Mon Apr 20 14:24:26 2026 -0400 ktest: Fix the month in the name of the failure directory The Perl localtime() function returns the month starting at 0 not 1. This caused the date produced to create the directory for saving files of a failed run to have the month off by one. machine-test-useconfig-fail-20260314073628 The above happened in April, not March. The correct name should have been: machine-test-useconfig-fail-20260414073628 This was somewhat confusing. Cc: stable@vger.kernel.org Cc: John 'Warthog9' Hawley Link: https://patch.msgid.link/20260420142426.33ad0293@fedora Fixes: 7faafbd69639b ("ktest: Add open and close console and start stop monitor") Signed-off-by: Steven Rostedt commit da6b5aae84beb0917ecb0c9fbc71169d145397ff Merge: b69e478512080f 344bf523d441d4 Author: Linus Torvalds Date: Mon Apr 20 12:02:24 2026 -0700 Merge tag 'platform-drivers-x86-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen: "asus-wmi: - Retain battery charge threshold during boot which avoids unsolicited change to 100%. Return -ENODATA when the limit is not yet known - Improve screenpad power/brightness handling consistency - Fix screenpad brightness range barco-p50-gpio: - Normalize gpio_get return values bitland-mifs-wmi: - Add driver for Bitland laptops (supports platform profile, hwmon, kbd backlight, gpu mode, hotkeys, and fan boost) dell_rbu: - Fix using uninitialized value in sysfs write function dell-wmi-sysman: - Respect destination length when constructing enum strings hp-wmi: - Propagate fan setting apply failures and log an error - Fix sysfs write vs work handler cancel_delayed_work_sync() deadlock - Correct keepalive schedule_delayed_work() to mod_delayed_work() - Fix u8 underflows in GPU delta calculation - Use mutex to protect fan pwm/mode - Ignore kbd backlight and FnLock key events that are handled by FW - Fix fan table parsing (use correct field) - Add support for Omen 14-fb0xxx, 16-n0xxx, 16-wf1xxx, and Omen MAX 16-ak0xxxx input: trackpoint & thinkpad_acpi: - Enable doubletap by default and add sysfs enable/disable int3472: - Add support for GPIO type 0x02 (IR flood LED) intel-speed-select: (updated to v1.26) - Avoid using current base frequency as maximum - Fix CPU extended family ID decoding - Fix exit code - Improve error reporting intel/vsec: - Refactor to support ACPI-enumerated PMT endpoints. pcengines-apuv2: - Attach software node to the gpiochip uniwill: - Refactor hwmon to smaller parts to accomodate HW diversity - Support USB-C power/performance priority switch through sysfs - Add another XMG Fusion 15 (L19) DMI vendor - Enable fine-grained features to device lineup mapping wmi: - Perform output size check within WMI core to allow simpler WMI drivers misc: - acpi_driver -> platform driver conversions (a large number of changes from Rafael J. Wysocki) - cleanups / refactoring / improvements" * tag 'platform-drivers-x86-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (106 commits) platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C77) platform/x86: hp-wmi: Add support for Omen 16-n0xxx (8A44) platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8D87) platform/x86: hp-wmi: fix fan table parsing platform/x86: hp-wmi: add Omen 14-fb0xxx (board 8C58) support platform/wmi: Replace .no_notify_data with .min_event_size platform/wmi: Extend wmidev_query_block() to reject undersized data platform/wmi: Extend wmidev_invoke_method() to reject undersized data platform/wmi: Prepare to reject undersized unmarshalling results platform/wmi: Convert drivers to use wmidev_invoke_procedure() platform/wmi: Add wmidev_invoke_procedure() platform/x86: int3472: Add support for GPIO type 0x02 (IR flood LED) platform/x86: int3472: Parameterize LED con_id in registration platform/x86: int3472: Rename pled to led in LED registration code platform/x86: int3472: Use local variable for LED struct access platform/x86: thinkpad_acpi: remove obsolete TODO comment platform/x86: dell-wmi-sysman: bound enumeration string aggregation platform/x86: hp-wmi: Ignore backlight and FnLock events platform/x86: uniwill-laptop: Fix signedness bug platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() ... commit b69e478512080f9bb03ed3e812b759bb73e2837b Merge: d884efd3401e72 04d8f3fd0b52ea Author: Linus Torvalds Date: Mon Apr 20 11:49:38 2026 -0700 Merge tag 'backlight-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Apple Backlight: - Convert the Apple Backlight ACPI driver to a proper platform driver, aligning with current ACPI binding practices Skyworks SKY81452: - Check the return value of `devm_gpiod_get_optional()` to properly handle GPIO acquisition errors" * tag 'backlight-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: apple_bl: Convert to a platform driver backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() commit a663bac71a2f0b3ac6c373168ca57b2a6e6381aa Author: Yuan Zhaoming Date: Fri Apr 17 22:13:40 2026 +0800 net: mctp: fix don't require received header reserved bits to be zero From the MCTP Base specification (DSP0236 v1.2.1), the first byte of the MCTP header contains a 4 bit reserved field, and 4 bit version. On our current receive path, we require those 4 reserved bits to be zero, but the 9500-8i card is non-conformant, and may set these reserved bits. DSP0236 states that the reserved bits must be written as zero, and ignored when read. While the device might not conform to the former, we should accept these message to conform to the latter. Relax our check on the MCTP version byte to allow non-zero bits in the reserved field. Fixes: 889b7da23abf ("mctp: Add initial routing framework") Signed-off-by: Yuan Zhaoming Cc: stable@vger.kernel.org Acked-by: Jeremy Kerr Link: https://patch.msgid.link/20260417141340.5306-1-yuanzhaoming901030@126.com Signed-off-by: Jakub Kicinski commit 5638504a2aa9e1b9d72af9060df1a160cce2d379 Author: David Carlier Date: Fri Apr 17 06:54:08 2026 +0100 gtp: disable BH before calling udp_tunnel_xmit_skb() gtp_genl_send_echo_req() runs as a generic netlink doit handler in process context with BH not disabled. It calls udp_tunnel_xmit_skb(), which eventually invokes iptunnel_xmit() — that uses __this_cpu_inc/dec on softnet_data.xmit.recursion to track the tunnel xmit recursion level. Without local_bh_disable(), the task may migrate between dev_xmit_recursion_inc() and dev_xmit_recursion_dec(), breaking the per-CPU counter pairing. The result is stale or negative recursion levels that can later produce false-positive SKB_DROP_REASON_RECURSION_LIMIT drops on either CPU. The other udp_tunnel_xmit_skb() call sites in gtp.c are unaffected: the data path runs under ndo_start_xmit and the echo response handlers run from the UDP encap rx softirq, both with BH already disabled. Fix it by disabling BH around the udp_tunnel_xmit_skb() call, mirroring commit 2cd7e6971fc2 ("sctp: disable BH before calling udp_tunnel_xmit_skb()"). Fixes: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions") Cc: stable@vger.kernel.org Signed-off-by: David Carlier Link: https://patch.msgid.link/20260417055408.4667-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski commit f6315295899415f1ddcf39f7c9cb46d25e2c6c6a Author: Dexuan Cui Date: Thu Apr 16 12:14:33 2026 -0700 hv_sock: Report EOF instead of -EIO for FIN Commit f0c5827d07cb unluckily causes a regression for the FIN packet, and the final read syscall gets an error rather than 0. Ideally, we would want to fix hvs_channel_readable_payload() so that it could return 0 in the FIN scenario, but it's not good for the hv_sock driver to use the VMBus ringbuffer's cached priv_read_index, which is internal data in the VMBus driver. Fix the regression in hv_sock by returning 0 rather than -EIO. Fixes: f0c5827d07cb ("hv_sock: Return the readable bytes in hvs_stream_has_data()") Cc: stable@vger.kernel.org Reported-by: Ben Hillis Reported-by: Mitchell Levy Signed-off-by: Dexuan Cui Acked-by: Stefano Garzarella Link: https://patch.msgid.link/20260416191433.840637-1-decui@microsoft.com Signed-off-by: Jakub Kicinski commit d884efd3401e72d069b678e6353f27f0553615ab Merge: 25c456dab5e7bf 7a43ccf85dfe06 Author: Linus Torvalds Date: Mon Apr 20 11:43:40 2026 -0700 Merge tag 'leds-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: Core: - Implement fallback to software node name for LED names - Fix formatting issues in `led-core.c` reported by checkpatch.pl - Make `led_remove_lookup()` NULL-aware - Switch from `class_find_device_by_of_node()` to `class_find_device_by_fwnode()` - Drop the unneeded dependency on `OF_GPIO` from `LEDS_NETXBIG` in Kconfig Kinetic KTD2692: - Make the `ktd2692_timing` variable static to resolve a sparse warning LGM SSO: - Fix a typo in the `GET_SRC_OFFSET` macro - Remove a duplicate assignment of `priv->mmap` in `intel_sso_led_probe()` Multicolor: - Fix a signedness error by changing the `intensity_value` type to `unsigned int` Qualcomm LPG: - Prevent array overflow when selecting high-resolution values Spreadtrum SC2731: - Add a compatible string for the SC2730 PMIC LED controller TI LM3642: - Use `guard(mutex)` to simplify locking and avoid manual `mutex_unlock()` calls TI LP5569: - Use `sysfs_emit()` instead of `sprintf()` for sysfs outputs TI LP5860: - Add the `enable-gpios` property for the `VIO_EN` pin" TI LP8860: - Do not unconditionally program the EEPROM on probe - Hold the mutex lock for the entirety of the EEPROM programming process - Return directly from `lp8860_init()` instead of using empty `goto` statements - Use a single regmap table and an access table instead of separate maps for normal and EEPROM registers - Remove an unused read of the `STATUS` register during EEPROM programming TTY Trigger: - Prefer `IS_ERR_OR_NULL()` over manual NULL checks" * tag 'leds-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: leds: class: Make led_remove_lookup() NULL-aware leds: led-class: Switch to using class_find_device_by_fwnode() leds: Kconfig: Drop unneeded dependency on OF_GPIO leds: lm3642: Use guard to simplify locking leds: core: Fix formatting issues leds: core: Implement fallback to software node name for LED names leds: lgm-sso: Fix typo in macro for src offset dt-bindings: leds: lp5860: add enable-gpio leds: Prefer IS_ERR_OR_NULL over manual NULL check dt-bindings: leds: sc2731: Add compatible for SC2730 leds: lp8860: Do not always program EEPROM on probe leds: lp8860: Remove unused read of STATUS register leds: lp8860: Hold lock for all of EEPROM programming leds: lp8860: Return directly from lp8860_init leds: lp8860: Use a single regmap table leds: lgm-sso: Remove duplicate assignments for priv->mmap leds: qcom-lpg: Check for array overflow when selecting the high resolution leds: ktd2692: Make ktd2692_timing variable static leds: lp5569: Use sysfs_emit instead of sprintf() leds: multicolor: Change intensity_value to unsigned int commit b94769eb2f30e61e86cd8551c084c34134290d89 Author: Lorenzo Bianconi Date: Thu Apr 16 12:30:12 2026 +0200 net: airoha: Fix possible TX queue stall in airoha_qdma_tx_napi_poll() Since multiple net_device TX queues can share the same hw QDMA TX queue, there is no guarantee we have inflight packets queued in hw belonging to a net_device TX queue stopped in the xmit path because hw QDMA TX queue can be full. In this corner case the net_device TX queue will never be re-activated. In order to avoid any potential net_device TX queue stall, we need to wake all the net_device TX queues feeding the same hw QDMA TX queue in airoha_qdma_tx_napi_poll routine. Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260416-airoha-txq-potential-stall-v2-1-42c732074540@kernel.org Signed-off-by: Jakub Kicinski commit 2091c6aa0df6aba47deb5c8ab232b1cb60af3519 Author: Weiming Shi Date: Wed Apr 15 19:46:54 2026 -0700 openvswitch: cap upcall PID array size and pre-size vport replies The vport netlink reply helpers allocate a fixed-size skb with nlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PID array via ovs_vport_get_upcall_portids(). Since ovs_vport_set_upcall_portids() accepts any non-zero multiple of sizeof(u32) with no upper bound, a CAP_NET_ADMIN user can install a PID array large enough to overflow the reply buffer, causing nla_put() to fail with -EMSGSIZE and hitting BUG_ON(err < 0). On systems with unprivileged user namespaces enabled (e.g., Ubuntu default), this is reachable via unshare -Urn since OVS vport mutation operations use GENL_UNS_ADMIN_PERM. kernel BUG at net/openvswitch/datapath.c:2414! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 65 Comm: poc Not tainted 7.0.0-rc7-00195-geb216e422044 #1 RIP: 0010:ovs_vport_cmd_set+0x34c/0x400 Call Trace: genl_family_rcv_msg_doit (net/netlink/genetlink.c:1116) genl_rcv_msg (net/netlink/genetlink.c:1194) netlink_rcv_skb (net/netlink/af_netlink.c:2550) genl_rcv (net/netlink/genetlink.c:1219) netlink_unicast (net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sys_sendto (net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Kernel panic - not syncing: Fatal exception Reject attempts to set more PIDs than nr_cpu_ids in ovs_vport_set_upcall_portids(), and pre-compute the worst-case reply size in ovs_vport_cmd_msg_size() based on that bound, similar to the existing ovs_dp_cmd_msg_size(). nr_cpu_ids matches the cap already used by the per-CPU dispatch configuration on the datapath side (ovs_dp_cmd_fill_info() serialises at most nr_cpu_ids PIDs), so the two sides stay consistent. Fixes: 5cd667b0a456 ("openvswitch: Allow each vport to have an array of 'port_id's.") Reported-by: Xiang Mei Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Weiming Shi Reviewed-by: Ilya Maximets Link: https://patch.msgid.link/20260416024653.153456-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit d03fc81a57956248383efec99967d0ae627390a8 Author: Prathamesh Deshpande Date: Wed Apr 15 01:49:37 2026 +0100 net/mlx5: Fix HCA caps leak on notifier init failure mlx5_mdev_init() allocates HCA caps via mlx5_hca_caps_alloc() before calling mlx5_notifiers_init(). If notifier initialization fails, the error path jumps to err_hca_caps and skips mlx5_hca_caps_free(), leaking allocated caps. Add a dedicated unwind label for notifier-init failure that frees HCA caps before continuing the existing cleanup sequence. Fixes: b6b03097f982 ("net/mlx5: Initialize events outside devlink lock") Signed-off-by: Prathamesh Deshpande Reviewed-by: Cosmin Ratiu Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260415005022.34764-1-prathameshdeshpande7@gmail.com Signed-off-by: Jakub Kicinski commit cc1ff87bce1ccd38410ab10960f576dcd17db679 Author: Qingfang Deng Date: Wed Apr 15 10:24:51 2026 +0800 pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function ppp_input() is not aware of the negotiation result, and still accepts PFC frames. If a peer with a broken implementation or an attacker sends a frame with a compressed (1-byte) protocol field, the subsequent PPP payload is shifted by one byte. This causes the network header to be 4-byte misaligned, which may trigger unaligned access exceptions on some architectures. To reduce the attack surface, drop PPPoE PFC frames. Introduce ppp_skb_is_compressed_proto() helper function to be used in both ppp_generic.c and pppoe.c to avoid open-coding. Fixes: 7fb1b8ca8fa1 ("ppp: Move PFC decompression to PPP generic layer") Signed-off-by: Qingfang Deng Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260415022456.141758-2-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski commit d6c19b31a3c1d519fabdcf0aa239e6b6109b9473 Author: Qingfang Deng Date: Wed Apr 15 10:24:50 2026 +0800 flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow dissector driver has assumed an uncompressed frame until the blamed commit. During the review process of that commit [1], support for PFC is suggested. However, having a compressed (1-byte) protocol field means the subsequent PPP payload is shifted by one byte, causing 4-byte misalignment for the network header and an unaligned access exception on some architectures. The exception can be reproduced by sending a PPPoE PFC frame to an ethernet interface of a MIPS board, with RPS enabled, even if no PPPoE session is active on that interface: $ 0 : 00000000 80c40000 00000000 85144817 $ 4 : 00000008 00000100 80a75758 81dc9bb8 $ 8 : 00000010 8087ae2c 0000003d 00000000 $12 : 000000e0 00000039 00000000 00000000 $16 : 85043240 80a75758 81dc9bb8 00006488 $20 : 0000002f 00000007 85144810 80a70000 $24 : 81d1bda0 00000000 $28 : 81dc8000 81dc9aa8 00000000 805ead08 Hi : 00009d51 Lo : 2163358a epc : 805e91f0 __skb_flow_dissect+0x1b0/0x1b50 ra : 805ead08 __skb_get_hash_net+0x74/0x12c Status: 11000403 KERNEL EXL IE Cause : 40800010 (ExcCode 04) BadVA : 85144817 PrId : 0001992f (MIPS 1004Kc) Call Trace: [<805e91f0>] __skb_flow_dissect+0x1b0/0x1b50 [<805ead08>] __skb_get_hash_net+0x74/0x12c [<805ef330>] get_rps_cpu+0x1b8/0x3fc [<805fca70>] netif_receive_skb_list_internal+0x324/0x364 [<805fd120>] napi_complete_done+0x68/0x2a4 [<8058de5c>] mtk_napi_rx+0x228/0xfec [<805fd398>] __napi_poll+0x3c/0x1c4 [<805fd754>] napi_threaded_poll_loop+0x234/0x29c [<805fd848>] napi_threaded_poll+0x8c/0xb0 [<80053544>] kthread+0x104/0x12c [<80002bd8>] ret_from_kernel_thread+0x14/0x1c Code: 02d51821 1060045b 00000000 <8c640000> 3084000f 2c820005 144001a2 00042080 8e220000 To reduce the attack surface and maintain performance, do not process PPPoE PFC frames. [1] https://lore.kernel.org/r/20220630231016.GA392@debian.home Fixes: 46126db9c861 ("flow_dissector: Add PPPoE dissectors") Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260415022456.141758-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski commit 25c456dab5e7bf3ed39155ccbc8465928137c0be Merge: 4b0b946019e737 caa5a5d44d8ae4 Author: Linus Torvalds Date: Mon Apr 20 11:31:01 2026 -0700 Merge tag 'mfd-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "Core: - Add a resource-managed version of alloc_workqueue() (`devm_alloc_workqueue()`) - Preserve the Open Firmware (OF) node when an ACPI handle is present Apple SMC: - Wire up the Apple SMC power driver by adding a new MFD cell Atmel HLCDC: - Fetch the LVDS PLL clock as a fallback if the generic sys_clk is unavailable Broadcom BCM2835 PM: - Add support for the BCM2712 power management device - Introduce a hardware type identifier to distinguish SoC variants Congatec CGBC, KEMPLD, RSMU, Si476x: - Fix various kernel-doc warnings and correct struct member names DLN2: - Drop redundant USB device references and switch to managed resource allocations - Update bare 'unsigned' types to 'unsigned int' ENE KB3930: - Use the of_device_is_system_power_controller() wrapper EZX PCAP: - Avoid rescheduling after destroying the workqueue by switching to a device-managed workqueue - Drop redundant memory allocation error messages - Return directly instead of using empty goto statements Freescale i.MX25 TSADC: - Convert devicetree bindings from TXT to YAML format Freescale MC13xxx: - Fix a memory leak in subdevice platform data allocation by using devm_kmemdup() Intel LPC ICH: - Expose a software node for the GPIO controller cell to fix GPIO lookups Intel LPSS: - Add PCI IDs for the Intel Nova Lake-H platform Maxim MAX77620: - Convert devicetree bindings from TXT to YAML format - Document an optional I2C address for the MAX77663 RTC device Maxim MAX77705: - Make the max77705_pm_ops variable static to resolve a sparse warning MediaTek MT6397: - Correct the hardware CIDs for the MT6328, MT6331, and MT6332 PMICs to allow proper driver binding ROHM BD71828: - Enable system wakeup via the power button ROHM BD72720: - Add a new compatible string for the ROHM BD73900 PMIC SpacemiT P1: - Drop the deprecated "vin-supply" property from the devicetree bindings - Add individual regulator supply properties to match actual hardware topology STMicroelectronics STPMIC1: - Attempt system shutdown a second time to handle transient I2C communication failures Viperboard: - Drop redundant USB device references" * tag 'mfd-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (28 commits) mfd: core: Preserve OF node when ACPI handle is present mfd: ene-kb3930: Use of_device_is_system_power_controller() wrapper mfd: intel-lpss: Add Intel Nova Lake-H PCI IDs dt-bindings: mfd: max77620: Document optional RTC address for MAX77663 dt-bindings: mfd: max77620: Convert to DT schema mfd: ezx-pcap: Avoid rescheduling after destroying workqueue mfd: ezx-pcap: Return directly instead of empty gotos mfd: ezx-pcap: Drop memory allocation error message mfd: bcm2835-pm: Add BCM2712 PM device support mfd: bcm2835-pm: Introduce SoC-specific type identifier dt-bindings: mfd: bd72720: Add ROHM BD73900 mfd: si476x: Fix kernel-doc warnings mfd: rsmu: Remove a empty kernel-doc line mfd: kempld: Fix kernel-doc struct member names mfd: congatec: Fix kernel-doc struct member names dt-bindings: mfd: Convert fsl-imx25-tsadc.txt to yaml format mfd: viperboard: Drop redundant device reference mfd: dln2: Switch to managed resources and fix bare unsigned types mfd: macsmc: Wire up Apple SMC power driver mfd: mt6397: Properly fix CID of MT6328, MT6331 and MT6332 ... commit 4b0b946019e7376752456380b67e54eea2f10a7c Merge: a5d1079c28a5bc 9091e3b59f2bef Author: Linus Torvalds Date: Mon Apr 20 11:20:35 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "The usual collection of driver changes, more core infrastructure updates that typical this cycle: - Minor cleanups and kernel-doc fixes in bnxt_re, hns, rdmavt, efa, ocrdma, erdma, rtrs, hfi1, ionic, and pvrdma - New udata validation framework and driver updates - Modernize CQ creation interface in mlx4 and mlx5, manage CQ umem in core - Promote UMEM to a core component, split out DMA block iterator logic - Introduce FRMR pools with aging, statistics, pinned handles, and netlink control and use it in mlx5 - Add PCIe TLP emulation support in mlx5 - Extend umem to work with revocable pinned dmabuf's and use it in irdma - More net namespace improvements for rxe - GEN4 hardware support in irdma - First steps to MW and UC support in mana_ib - Support for CQ umem and doorbells in bnxt_re - Drop opa_vnic driver from hfi1 Fixes: - IB/core zero dmac neighbor resolution race - GID table memory free - rxe pad/ICRC validation and r_key async errors - mlx4 external umem for CQ - umem DMA attributes on unmap - mana_ib RX steering on RSS QP destroy" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (116 commits) RDMA/core: Fix user CQ creation for drivers without create_cq RDMA/ionic: bound node_desc sysfs read with %.64s IB/core: Fix zero dmac race in neighbor resolution RDMA/mana_ib: Support memory windows RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv RDMA/core: Prefer NLA_NUL_STRING RDMA/core: Fix memory free for GID table RDMA/hns: Remove the duplicate calls to ib_copy_validate_udata_in() RDMA: Remove redundant = {} for udata req structs RDMA/irdma: Add missing comp_mask check in alloc_ucontext RDMA/hns: Add missing comp_mask check in create_qp RDMA/mlx5: Pull comp_mask validation into ib_copy_validate_udata_in_cm() RDMA: Use ib_copy_validate_udata_in_cm() for zero comp_mask RDMA/hns: Use ib_copy_validate_udata_in() RDMA/mlx4: Use ib_copy_validate_udata_in() for QP RDMA/mlx4: Use ib_copy_validate_udata_in() RDMA/mlx5: Use ib_copy_validate_udata_in() for MW RDMA/mlx5: Use ib_copy_validate_udata_in() for SRQ RDMA/pvrdma: Use ib_copy_validate_udata_in() for srq RDMA: Use ib_copy_validate_udata_in() for implicit full structs ... commit a5d1079c28a5bc6caa30ef4099ef04ed17d2c6aa Merge: a5e1c3b6093b13 819bd270abf9de Author: Linus Torvalds Date: Mon Apr 20 10:59:47 2026 -0700 Merge tag 'ntfs3_for_7.1' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: "New: - reject inodes with zero non-DOS link count - return folios from ntfs_lock_new_page() - subset of W=1 warnings for stricter checks - work around -Wmaybe-uninitialized warnings - buffer boundary checks to run_unpack() - terminate the cached volume label after UTF-8 conversion Fixes: - check return value of indx_find to avoid infinite loop - prevent uninitialized lcn caused by zero len - increase CLIENT_REC name field size to prevent buffer overflow - missing run load for vcn0 in attr_data_get_block_locked() - memory leak in indx_create_allocate() - OOB write in attr_wof_frame_info() - mount failure on volumes with fragmented MFT bitmap - integer overflow in run_unpack() volume boundary check - validate rec->used in journal-replay file record check Updates: - resolve compare function in public index APIs - $LXDEV xattr lookup - potential double iput on d_make_root() failure - initialize err in ni_allocate_da_blocks_locked() - correct the pre_alloc condition in attr_allocate_clusters()" * tag 'ntfs3_for_7.1' of https://github.com/Paragon-Software-Group/linux-ntfs3: fs/ntfs3: fix Smatch warnings fs/ntfs3: validate rec->used in journal-replay file record check fs/ntfs3: terminate the cached volume label after UTF-8 conversion fs/ntfs3: fix potential double iput on d_make_root() failure ntfs3: fix integer overflow in run_unpack() volume boundary check ntfs3: add buffer boundary checks to run_unpack() ntfs3: fix mount failure on volumes with fragmented MFT bitmap fs/ntfs3: fix $LXDEV xattr lookup ntfs3: fix OOB write in attr_wof_frame_info() ntfs3: fix memory leak in indx_create_allocate() ntfs3: work around false-postive -Wmaybe-uninitialized warnings fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() fs/ntfs3: increase CLIENT_REC name field size fs/ntfs3: prevent uninitialized lcn caused by zero len fs/ntfs3: add a subset of W=1 warnings for stricter checks fs/ntfs3: return folios from ntfs_lock_new_page() fs/ntfs3: resolve compare function in public index APIs ntfs3: reject inodes with zero non-DOS link count commit 5897ca15d2c444af95eaae5f0a384401765afa00 Author: Cheng-Yang Chou Date: Mon Apr 20 17:28:48 2026 +0800 selftests/sched_ext: Add non_scx_kfunc_deny test Verify that the BPF verifier rejects a non-SCX struct_ops program (tcp_congestion_ops) that attempts to call an SCX kfunc (scx_bpf_kick_cpu). The test expects the load to fail with -EACCES from scx_kfunc_context_filter. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 2d2b026c3ea792a0c91d4acf4430d8b65bedf271 Author: Cheng-Yang Chou Date: Mon Apr 20 17:28:47 2026 +0800 sched_ext: Deny SCX kfuncs to non-SCX struct_ops programs scx_kfunc_context_filter() currently allows non-SCX struct_ops programs (e.g. tcp_congestion_ops) to call SCX unlocked kfuncs. This is wrong for two reasons: - It is semantically incorrect: a TCP congestion control program has no business calling SCX kfuncs such as scx_bpf_kick_cpu(). - With CONFIG_EXT_SUB_SCHED=y, kfuncs like scx_bpf_kick_cpu() call scx_prog_sched(aux), which invokes bpf_prog_get_assoc_struct_ops(aux) and casts the result to struct sched_ext_ops * before reading ops->priv. For a non-SCX struct_ops program the returned pointer is the kdata of that struct_ops type, which is far smaller than sched_ext_ops, making the read an out-of-bounds access (confirmed with KASAN). Extend the filter to cover scx_kfunc_set_any and scx_kfunc_set_idle as well, and deny all SCX kfuncs for any struct_ops program that is not the SCX struct_ops. This addresses both issues: the semantic contract is enforced at the verifier level, and the runtime out-of-bounds access becomes unreachable. Fixes: d1d3c1c6ae36 ("sched_ext: Add verifier-time kfunc context filter") Suggested-by: Tejun Heo Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 09a65adc7d8bbfce06392cb6d375468e2728ead5 Author: Mikulas Patocka Date: Mon Apr 20 19:56:44 2026 +0200 dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared. Signed-off-by: Mikulas Patocka Fixes: 3241b1d3e0aa ("dm: add persistent data library") Cc: stable@vger.kernel.org commit a5e1c3b6093b13c3ae1c5517c694cad7e55e9ed1 Merge: 36d179fd6bea35 e836ec1819b0cc Author: Linus Torvalds Date: Mon Apr 20 10:54:17 2026 -0700 Merge tag 'ecryptfs-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs Pull eCryptfs updates from Tyler Hicks: - avoid unnecessary eCryptfs inode timestamp truncation by re-using the lower filesystem's time granularity - various small code cleanups - reorganize the setattr hook inode resizing to improve style and readability, remove an unnecessary memory allocation when shrinking, and to support an upcoming rework of the VFS interfaces involved in truncation * tag 'ecryptfs-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs: ecryptfs: keep the lower iattr contained in truncate_upper ecryptfs: factor out a ecryptfs_iattr_to_lower helper ecryptfs: merge ecryptfs_inode_newsize_ok into truncate_upper ecryptfs: combine the two ATTR_SIZE blocks in ecryptfs_setattr ecryptfs: use ZERO_PAGE instead of allocating zeroed memory in truncate_upper ecryptfs: streamline truncate_upper ecryptfs: cleanup ecryptfs_setattr ecryptfs: Drop TODO comment in ecryptfs_derive_iv ecryptfs: Fix typo in ecryptfs_derive_iv function comment ecryptfs: Log function name only once in decode_and_decrypt_filename ecryptfs: Remove redundant if checks in encrypt_and_encode_filename ecryptfs: Fix tag number in encrypt_filename() error message ecryptfs: Use struct_size to improve process_response + send_miscdev ecryptfs: Replace memcpy + manual NUL termination with strscpy ecryptfs: Set s_time_gran to get correct time granularity commit 36d179fd6bea35698d53444b7bd3025fa3788266 Merge: c1f49dea2b8f33 d644a698de12e9 Author: Linus Torvalds Date: Mon Apr 20 10:44:02 2026 -0700 Merge tag 'nfsd-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: - filehandle signing to defend against filehandle-guessing attacks (Benjamin Coddington) The server now appends a SipHash-2-4 MAC to each filehandle when the new "sign_fh" export option is enabled. NFSD then verifies filehandles received from clients against the expected MAC; mismatches return NFS error STALE - convert the entire NLMv4 server-side XDR layer from hand-written C to xdrgen-generated code, spanning roughly thirty patches (Chuck Lever) XDR functions are generally boilerplate code and are easy to get wrong. The goals of this conversion are improved memory safety, lower maintenance burden, and groundwork for eventual Rust code generation for these functions. - improve pNFS block/SCSI layout robustness with two related changes (Dai Ngo) SCSI persistent reservation fencing is now tracked per client and per device via an xarray, to avoid both redundant preempt operations on devices already fenced and a potential NFSD deadlock when all nfsd threads are waiting for a layout return. - scalability and infrastructure improvements Sincere thanks to all contributors, reviewers, testers, and bug reporters who participated in the v7.1 NFSD development cycle. * tag 'nfsd-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (83 commits) NFSD: Docs: clean up pnfs server timeout docs nfsd: fix comment typo in nfsxdr nfsd: fix comment typo in nfs3xdr NFSD: convert callback RPC program to per-net namespace NFSD: use per-operation statidx for callback procedures svcrdma: Use contiguous pages for RDMA Read sink buffers SUNRPC: Add svc_rqst_page_release() helper SUNRPC: xdr.h: fix all kernel-doc warnings svcrdma: Factor out WR chain linking into helper svcrdma: Add Write chunk WRs to the RPC's Send WR chain svcrdma: Clean up use of rdma->sc_pd->device svcrdma: Clean up use of rdma->sc_pd->device in Receive paths svcrdma: Add fair queuing for Send Queue access SUNRPC: Optimize rq_respages allocation in svc_alloc_arg SUNRPC: Track consumed rq_pages entries svcrdma: preserve rq_next_page in svc_rdma_save_io_pages SUNRPC: Handle NULL entries in svc_rqst_release_pages SUNRPC: Allocate a separate Reply page array SUNRPC: Tighten bounds checking in svc_rqst_replace_page NFSD: Sign filehandles ... commit cec9d64c09c505c818e9a8093a012234051c2d14 Merge: c15bc1681045f1 956c032be7ca3f Author: Mark Brown Date: Mon Apr 20 18:40:07 2026 +0100 ASoC: Correct bug parsing DisCo booleans Charles Keepax says: MIPI DisCo uses the unfortunate convention of allowing boolean properties to be present but having a zero value. Opposed to the normal convention of simply not specifying the property. Fix an issue in the SDCA code where mipi-sdca-control-deferrable is not parsed correctly. However, we also have some shipping ACPIs where these properties are not specified correctly. Update the MBQ regmap to attempt defers albeit with a warning in the case where a control attempts to defer but is not marked at such. There is little down side to this as if defer is genuinely not supported then the control will just return the same error again. commit 956c032be7ca3f440d4786ea37e941bf862bb170 Author: Charles Keepax Date: Mon Apr 13 13:46:21 2026 +0100 ASoC: SDCA: Fix reading of mipi-sdca-control-deferrable The discussion in [1] highlighted that the SDCA code shouldn't be using fwnode_property_read_bool() for DisCo controls, as the spec allows setting the value to zero meaning the property should not be used. Correct a small bug in the SDCA code that will mark such controls as deferrable. Link: https://lore.kernel.org/linux-sound/20260311142153.2201761-1-rf@opensource.cirrus.com/ [1] Fixes: 42b144cb6a2d ("ASoC: SDCA: Add SDCA Control parsing") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260413124621.1345315-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit ca1b11b36d8231a748c77e4732e40de9998fa9d8 Author: Charles Keepax Date: Mon Apr 13 13:46:20 2026 +0100 regmap: sdw-mbq: Allow defers on undeferrable controls It is a fairly common DisCo issue to have the deferrability of controls marked incorrectly and Windows seems very permissive in this regard. As there isn't really any down side to trying a defer even if the control isn't deferrable, allow this but add a warning message. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260413124621.1345315-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 4aca914ac152f5d055ddcb36704d1e539ac08977 Author: Amir Goldstein Date: Mon Apr 20 14:58:00 2026 +0200 fsnotify: fix inode reference leak in fsnotify_recalc_mask() fsnotify_recalc_mask() fails to handle the return value of __fsnotify_recalc_mask(), which may return an inode pointer that needs to be released via fsnotify_drop_object() when the connector's HAS_IREF flag transitions from set to cleared. This manifests as a hung task with the following call trace: INFO: task umount:1234 blocked for more than 120 seconds. Call Trace: __schedule schedule fsnotify_sb_delete generic_shutdown_super kill_anon_super cleanup_mnt task_work_run do_exit do_group_exit The race window that triggers the iref leak: Thread A (adding mark) Thread B (removing mark) ────────────────────── ──────────────────────── fsnotify_add_mark_locked(): fsnotify_add_mark_list(): spin_lock(conn->lock) add mark_B(evictable) to list spin_unlock(conn->lock) return /* ---- gap: no lock held ---- */ fsnotify_detach_mark(mark_A): spin_lock(mark_A->lock) clear ATTACHED flag on mark_A spin_unlock(mark_A->lock) fsnotify_put_mark(mark_A) fsnotify_recalc_mask(): spin_lock(conn->lock) __fsnotify_recalc_mask(): /* mark_A skipped: ATTACHED cleared */ /* only mark_B(evictable) remains */ want_iref = false has_iref = true /* not yet cleared */ -> HAS_IREF transitions true -> false -> returns inode pointer spin_unlock(conn->lock) /* BUG: return value discarded! * iput() and fsnotify_put_sb_watched_objects() * are never called */ Fix this by deferring the transition true -> false of HAS_IREF flag from fsnotify_recalc_mask() (Thread A) to fsnotify_put_mark() (thread B). Fixes: c3638b5b1374 ("fsnotify: allow adding an inode mark without pinning inode") Signed-off-by: Xin Yin Signed-off-by: Amir Goldstein Link: https://patch.msgid.link/CAOQ4uxiPsbHb0o5voUKyPFMvBsDkG914FYDcs4C5UpBMNm0Vcg@mail.gmail.com Signed-off-by: Jan Kara commit 314665e67b3e27ff442d8e0879f1c1df8d63ccbd Author: Takashi Iwai Date: Mon Apr 20 18:00:13 2026 +0200 Revert "ALSA: usb-audio: Add quirk for SmartlinkTechnology M01" This reverts commit d1aa2b9aad696c0434a5e0ac1d07810ce264e686. Juan reported that the patch didn't work as expected at the later check, failing to create PCM capture devices that has worked beforehand. Drop the change again for addressing the regression, and we'll continue developing a proper fix later. Reported-by: Juan Pablo Fuentealba Bizama Closes: https://lore.kernel.org/20260417150748.6684-1-jpfuentealbabizama@gmail.com Signed-off-by: Takashi Iwai commit 4cc3ec3d8b3536f2293a5a984c28ba2a09e8b22d Author: Cássio Gabriel Date: Fri Apr 17 17:30:18 2026 -0300 ALSA: als4000: Fix capture trigger chip->mode race snd_als4000_capture_trigger() updates chip->mode under mixer_lock, while snd_als4000_set_rate() and snd_als4000_playback_trigger() serialize the same rate-lock state with reg_lock. The PCM core serializes callbacks only per acted-on substream, or for an explicitly linked group, so unlinked playback and capture streams can run concurrently. That leaves two races on ALS4000 rate-lock state: - playback and capture trigger callbacks can concurrently update chip->mode and lose one of the SB_RATE_LOCK bits - snd_als4000_set_rate() can observe chip->mode without the capture lock bit set and reprogram the shared sample rate while capture is being started Fix this by taking reg_lock as the outer lock in snd_als4000_capture_trigger() and nesting mixer_lock only for the CR1E write. This keeps chip->mode serialized with the rest of the ALS4000 rate-lock users while preserving the existing CR1E programming sequence. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260417-als4000-capture-trigger-race-v1-1-daeffc2feb67@gmail.com Signed-off-by: Takashi Iwai commit 8146cd333d235ed32d48bb803fdf743472d7c783 Author: Takashi Iwai Date: Mon Apr 20 08:17:20 2026 +0200 ALSA: core: Fix potential data race at fasync handling In snd_fasync_work_fn(), which is the offload work for traversing and processing the pending fasync list, the call of kill_fasync() is done outside the snd_fasync_lock for avoiding deadlocks. The problem is that its the references of fasync->on, fasync->signal and fasync->poll are done there also outside the lock. Since these may be modified by snd_kill_fasync() call concurrently from other process, inconsistent values might be passed to kill_fasync(). Although there shouldn't be critical UAF, it's still better to be addressed. This patch moves the kill_fasync() argument evaluations inside the snd_fasync_lock for avoiding the data races above. The handling in fasync->on flag is optimized in the loop to skip directly. Also, for more clarity, snd_fasync_free() takes the lock and unlink the pending entry more directly instead of clearing fasync->on flag. Reported-by: Jake Lamberson Fixes: ef34a0ae7a26 ("ALSA: core: Add async signal helpers") Cc: Link: https://patch.msgid.link/20260420061721.3253644-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 93985110329d9a66101c3de37aa7232f8c0bc3c9 Author: Baojun Xu Date: Sat Apr 18 13:50:30 2026 +0800 ALSA: hda/tas2781: Fix sound abnormal issue on some SPI device In the SPI driver probe, the chip ID must be set to TAS2781. Without this initialization, calibration data fails to load correctly, causing audio abnormalities on some devices. And update the register bulk read API to handle the distinct requirements of SPI and I2C devices. Fixes: 05ac3846ffe5 ("ALSA: hda/tas2781: A workaround solution to lower-vol issue among lower calibrated-impedance micro-speaker on TAS2781") Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20260418055030.765-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit 8a7be65e7e9a95c7776f997b50a4893c9315e710 Author: Bob Song Date: Mon Apr 20 13:33:51 2026 +0800 ALSA: hda/realtek: add quirk for Acer Nitro 16 AN16-41 The combo jack microphone is not detected/working on the laptop featuring the Realtek ALC245 codec, and mic pincfg is the default value. So here, add quirk for it and test good. Reported-by: Yenilmez99 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221344 Signed-off-by: Bob Song Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260420053351.547352-1-songxiebing@kylinos.cn commit cc85e337278001c325afecfbc9a739a3b1b205f2 Author: Thorsten Blum Date: Mon Apr 20 12:25:46 2026 +0200 isofs: use QSTR_LEN() in isofs_cmp Use QSTR_LEN() and inline the code in isofs_cmp(). Remove the stale function comment while at it. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260420102544.8924-3-thorsten.blum@linux.dev Signed-off-by: Jan Kara commit d21877ac2766611d7a072a1dd7e1b66f5e26e3d3 Merge: 8b0beb45840ac4 c7ff53ef45b2f8 Author: Arnd Bergmann Date: Mon Apr 20 17:26:41 2026 +0200 Merge tag 'apple-soc-fixes-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/late2 Apple SoC fixes for 7.0 Two commits without any functional changes that arrived just before the merge window opened: - Update Sasha's email address in all dt-bindings, MAINTAINERS and add him to mailmap - Fix a typo in spi1-nvram.dtsi * tag 'apple-soc-fixes-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: arm64: dts: apple: Fix spelling error dt-bindings: Update Sasha Finkelstein's email address mailmap: Update Sasha Finkelstein's email address Signed-off-by: Arnd Bergmann commit 8b0beb45840ac40654100fd8497bd9dfd0d2a54c Author: Krzysztof Kozlowski Date: Mon Apr 13 09:44:03 2026 +0200 Documentation/process: maintainer-soc: Document purpose of defconfigs Common mistake in commit messages of patches on mailing list adding CONFIG options to arm/multi_v7 or arm64/defconfig is saying what that patch is doing, e.g. "Enable driver foo". That is obvious from the diff part, thus explaining it does not bring any value. What brings value is to understand why "driver foo" should be in a shared, upstream defconfig, especially considering that distros have their own defconfigs and we do not care about non-upstream trees. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260413074401.27282-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Arnd Bergmann commit f325b239a7bb42fc85c85b89c2c9b8e127410151 Author: Krzysztof Kozlowski Date: Mon Apr 13 09:44:02 2026 +0200 Documentation/process: maintainer-soc: Trim from trivial ask-DT It is obvious that one can ask DT maintainers of something, just like one can ask anyone, so just drop the sentence. Concise documents with rules have bigger chances of actually being read by people. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260413074401.27282-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Arnd Bergmann commit b1bf0efcd9a5f04ce154083637deafc754ef3c0f Author: Arnd Bergmann Date: Tue Apr 14 08:47:46 2026 +0200 ARM: dts: bcm4709: fix bus range assignment The netgear r8000 dts file limits the bus range for the first host bridge to exclude bus 0, but the two devices on the first bus are explicitly assigned to bus 0, causing a build time warning: /home/arnd/arm-soc/arch/arm/boot/dts/broadcom/bcm4709-netgear-r8000.dts:142.3-27: Warning (pci_device_bus_num): /axi@18000000/pcie@13000/pcie@0/pcie@0,0/pcie@1,0:bus-range: PCI bus number 0 out of range, expected (1 - 255) /home/arnd/arm-soc/arch/arm/boot/dts/broadcom/bcm4709-netgear-r8000.dts:142.3-27: Warning (pci_device_bus_num): /axi@18000000/pcie@13000/pcie@0/pcie@0,0/pcie@2,0:bus-range: PCI bus number 0 out of range, expected (1 - 255) As Rosen mentioned, the bus-range property was a mistake, so just remove it and keep the reg values pointing to bus 0, which is allowed by the default bus range of the SoC. Fixes: 893faf67438c ("ARM: dts: BCM5301X: add root pcie bridges") Suggested-by: Rosen Penev Link: https://lore.kernel.org/r/20260414064754.3129667-1-arnd@kernel.org Signed-off-by: Arnd Bergmann commit de65fe9160d27166045291b9cdf7bffdb7d1c815 Merge: 7b82df336809ef 00e6d608fe80b0 Author: Arnd Bergmann Date: Mon Apr 20 17:03:06 2026 +0200 Merge tag 'mvebu-dt64-7.1-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/late2 mvebu dt64 for 7.1 (part 1) - Armada 37xx/3720 device tree fixes: - Reorder USB PHYs, standardize names, drop undocumented properties, fix schema alignment - Add Marvell 7k COMe board bindings and uDPU ethernet aliases - Cleanup: drop unused .dtsi files * tag 'mvebu-dt64-7.1-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: arm64: dts: marvell: armada-37xx: swap PHYs' order in USB3 controller node arm64: dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's phy-names arm64: dts: marvell: armada-37xx: drop 'marvell,usb-misc-reg' from USB host nodes arm64: dts: marvell: armada-37xx: drop redundant status property arm64: dts: marvell: armada-37xx: align 'phy-names' of EHCI node with DT schema dt-bindings: arm64: add Marvell 7k COMe boards arm64: dts: marvell: armada-3720: drop 'marvell,xenon-emmc' properties arm64: dts: marvell: uDPU: add ethernet aliases arm/arm64: dts: marvell: Drop unused .dtsi arm64: dts: a7k: use phy handle Signed-off-by: Arnd Bergmann commit 7b82df336809eff5a2fdea1452c37cc45b448ec5 Merge: 8242c709d4ba85 3e2444044d160e Author: Arnd Bergmann Date: Mon Apr 20 17:02:56 2026 +0200 Merge branch 'arm/fixes' into soc/late2 * arm/fixes: arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT reset: amlogic: t7: Fix null reset ops arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-ultra-mach-sbc: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-sr-som: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-nitrogen-som: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-aristainetos3a-som-v1: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-edm-g: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT dt-bindings: arm64: add Marvell 7k COMe boards commit 24376458138387fb251e782e624c7776e9826796 Author: Michael Bommarito Date: Sun Apr 19 17:21:55 2026 -0400 isofs: validate block number from NFS file handle in isofs_export_iget isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker- controlled block number (ifid->block or ifid->parent_block) from the NFS file handle to isofs_export_iget(), which only rejects block == 0 before calling isofs_iget() and ultimately sb_bread(). A crafted file handle with fh_len sufficient to pass the check added by commit 0405d4b63d08 ("isofs: Prevent the use of too small fid") can still drive the server to read any in-range block on the backing device as if it were an iso_directory_record. That earlier fix was assigned CVE-2025-37780. sb_bread() on an out-of-range block returns NULL cleanly via the EIO path, so there is no memory-safety violation. For in-range reads of adjacent-partition data on the same block device, the unrelated bytes end up in iso_inode_info fields that reach the NFS client as dentry metadata. The deployment surface (isofs exported over NFS from loop-mounted images) is narrow and requires an authenticated NFS peer, but the malformed-file-handle class is reportable as hardening next to the existing CVE-2025-37780 fix. Reject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() so the check covers both isofs_fh_to_dentry() and isofs_fh_to_parent() call sites with a single line. Fixes: 0405d4b63d08 ("isofs: Prevent the use of too small fid") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260419212155.2169382-3-michael.bommarito@gmail.com Signed-off-by: Jan Kara commit a36d990f591320e9dd379ab30063ebfe91d47e1f Author: Michael Bommarito Date: Sun Apr 19 17:21:54 2026 -0400 isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offset/size rejection, printing the same corrupted-directory-entry notice. Fixes: f54e18f1b831 ("isofs: Fix infinite looping over CE entries") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260419212155.2169382-2-michael.bommarito@gmail.com Signed-off-by: Jan Kara commit 15d649a3e5eab779a08a30fc2093116de16b2e3e Author: Yongbang Shi Date: Thu Mar 19 21:11:32 2026 +0800 MAINTAINERS: split hisilicon maintenance and add Yongbang Shi for hibmc-drm matainers To improve maintainability, split the maintainer information for the hibmc and kirin drivers under the drivers/gpu/drm/hisilicon directory. drivers/gpu/drm/hisilicon/hibmc driver has almost completed feature development based on the new generation HiSilicon BMC chip. It was co-developed by Yongbang Shi, Baihan Li and Lin He. Going forward, this module will be maintained by Yongbang Shi. Signed-off-by: Yongbang Shi Acked-by: Tao Tian Acked-by: Xinliang Liu Acked-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260319131132.722033-1-shiyongbang@huawei.com commit 858fbd7248bd84b2899fb2c29bc7bc2634296edf Merge: 818f644ec6cbe0 0baba94a9779c1 Author: Catalin Marinas Date: Mon Apr 20 13:12:35 2026 +0100 Merge branch 'for-next/c1-pro-erratum-4193714' into for-next/core * for-next/c1-pro-erratum-4193714: : Work around C1-Pro erratum 4193714 (CVE-2026-0995) arm64: errata: Work around early CME DVMSync acknowledgement arm64: cputype: Add C1-Pro definitions arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish() arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance commit 818f644ec6cbe00a3cddc767b6316e2f527ae865 Merge: 480a9e57cceaf4 e534e9d13d0b7b 4d5bbbafc170eb Author: Catalin Marinas Date: Mon Apr 20 13:11:50 2026 +0100 Merge branches 'for-next/misc' and 'for-next/mpam' into for-next/core * for-next/misc: : Miscellaneous cleanups/fixes virt: arm-cca-guest: fix error check for RSI_INCOMPLETE arm64/hwcap: Include kernel-hwcap.h in list of generated files * for-next/mpam: : Fix an unmount->remount problem with the CDP emulation, uninitialised : variable and checker warnings arm_mpam: resctrl: Make resctrl_mon_ctx_waiters static arm_mpam: resctrl: Fix the check for no monitor components found arm_mpam: resctrl: Fix MBA CDP alloc_capable handling on unmount commit add9d911be9b141706ccf41d17b4043ed1bc12a1 Merge: 3e9e952bb3139a bf56987c111372 Author: Petr Mladek Date: Mon Apr 20 13:42:01 2026 +0200 Merge branch 'rework/prb-fixes' into for-linus commit 3e9e952bb3139ad1e08f3e1960239c2988ab90c9 Merge: aea645c02f1acc 8901ac9d2c7eb8 Author: Petr Mladek Date: Mon Apr 20 13:41:28 2026 +0200 Merge branch 'for-7.1-printf-kunit-build' into for-linus commit ce76a36223b853dcb6e76da6f1c4f745c3f3f7ba Merge: 51942b77f443ac 9d72732fe70c11 Author: Mark Brown Date: Mon Apr 20 12:39:35 2026 +0100 spi: fix explicit controller deregistration Johan Hovold says: Turns out we have a few drivers that get the tear down ordering wrong also when not using device managed registration (cf. [1] and [2]). Fix this to avoid issues like system errors due to unclocked accesses, NULL-pointer dereferences, hangs or failed I/O during during deregistration (e.g. when powering down devices). Johan [1] https://lore.kernel.org/lkml/20260409120419.388546-2-johan@kernel.org/ [2] https://lore.kernel.org/lkml/20260410081757.503099-1-johan@kernel.org/ commit 9d72732fe70c11424bc90ed466c7ccfa58b42a9a Author: Johan Hovold Date: Tue Apr 14 15:43:19 2026 +0200 spi: topcliff-pch: fix use-after-free on unbind Give the driver a chance to flush its queue before releasing the DMA buffers on driver unbind Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support") Cc: stable@vger.kernel.org # 3.1 Cc: Tomoya MORINAGA Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260414134319.978196-9-johan@kernel.org Signed-off-by: Mark Brown commit 5d6f477d6fc0767c57c5e1e6f55a1662820eef87 Author: Johan Hovold Date: Tue Apr 14 15:43:18 2026 +0200 spi: topcliff-pch: fix controller deregistration Make sure to deregister the controller before disabling and releasing underlying resources like interrupts and DMA during driver unbind. Fixes: e8b17b5b3f30 ("spi/topcliff: Add topcliff platform controller hub (PCH) spi bus driver") Cc: stable@vger.kernel.org # 2.6.37 Cc: Masayuki Ohtake Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260414134319.978196-8-johan@kernel.org Signed-off-by: Mark Brown commit 220f4f11104a7f83b71543ef0e48dde1da2bc5d3 Author: Johan Hovold Date: Tue Apr 14 15:43:17 2026 +0200 spi: orion: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: 60cadec9da7b ("spi: new orion_spi driver") Cc: stable@vger.kernel.org # 2.6.27 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260414134319.978196-7-johan@kernel.org Signed-off-by: Mark Brown commit adbc595e272052181d40ec307a4c5ba98571b0fe Author: Johan Hovold Date: Tue Apr 14 15:43:16 2026 +0200 spi: mxic: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks (via runtime pm) during driver unbind. Fixes: b942d80b0a39 ("spi: Add MXIC controller driver") Cc: stable@vger.kernel.org # 5.0: cc53711b2191 Cc: stable@vger.kernel.org # 5.0 Cc: Mason Yang Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260414134319.978196-6-johan@kernel.org Signed-off-by: Mark Brown commit 706b3dc2ac7a998c55e14b3fd2e8f934c367e6e0 Author: Johan Hovold Date: Tue Apr 14 15:43:15 2026 +0200 spi: mpc52xx: fix use-after-free on unbind The state machine work is scheduled by the interrupt handler and therefore needs to be cancelled after disabling interrupts to avoid a potential use-after-free. Fixes: 984836621aad ("spi: mpc52xx: Add cancel_work_sync before module remove") Cc: stable@vger.kernel.org Cc: Pei Xiao Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260414134319.978196-5-johan@kernel.org Signed-off-by: Mark Brown commit 0f997fdae819a8c2cc83bd4ff7d935ad76c727c9 Author: Johan Hovold Date: Tue Apr 14 15:43:14 2026 +0200 spi: mpc52xx: fix controller deregistration Make sure to deregister the controller before disabling and releasing underlying resources like interrupts and gpios during driver unbind. Fixes: 42bbb70980f3 ("powerpc/5200: Add mpc5200-spi (non-PSC) device driver") Fixes: b8d4e2ce60b6 ("mpc52xx_spi: add gpio chipselect") Cc: stable@vger.kernel.org # 2.6.33 Cc: Grant Likely Cc: Luotao Fu Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260414134319.978196-4-johan@kernel.org Signed-off-by: Mark Brown commit 964ee9793760e825b5c011741b4e3cfe06c87efc Author: Johan Hovold Date: Tue Apr 14 15:43:13 2026 +0200 spi: cadence-quadspi: fix controller deregistration Make sure to deregister the controller before dropping the reference count that allows new operations to start to allow SPI drivers to do I/O during deregistration. Fixes: 7446284023e8 ("spi: cadence-quadspi: Implement refcount to handle unbind during busy") Cc: stable@vger.kernel.org # 6.17 Cc: Khairul Anuar Romli Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260414134319.978196-3-johan@kernel.org Signed-off-by: Mark Brown commit 666fa7e9ca98e71c880086ca24147ae843f1ed6e Author: Johan Hovold Date: Tue Apr 14 15:43:12 2026 +0200 spi: cadence: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: c474b3866546 ("spi: Add driver for Cadence SPI controller") Cc: stable@vger.kernel.org # 3.16 Cc: Harini Katakam Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260414134319.978196-2-johan@kernel.org Signed-off-by: Mark Brown commit 314f6179e370988ac00dadf373a4f6166eb3db15 Author: Jouni Högander Date: Mon Apr 13 14:23:45 2026 +0300 drm/i915/psr: Init variable to avoid early exit from et alignment loop Uninitialized boolean variable may cause unwanted exit from et alignment loop. Fix this by initializing it as false. Fixes: 1be2fca84f52 ("drm/i915/psr: Repeat Selective Update area alignment") Cc: # v6.9+ Signed-off-by: Jouni Högander Reviewed-by: Nemesa Garg Reported-by: Dan Carpenter Reviewed-by: Andi Shyti Link: https://patch.msgid.link/20260413112345.88853-1-jouni.hogander@intel.com (cherry picked from commit 289678a90b8cf81e3514c9d6c667235cd39c7acf) Signed-off-by: Tvrtko Ursulin commit e31eee4a961077d60ef2362507240c6743c1c2ae Author: Billy Tsai Date: Wed Apr 15 18:24:42 2026 +0800 gpio: aspeed: fix AST2700 debounce selector bit definitions The AST2700 datasheet defines reg_debounce_sel1 as the low bit and reg_debounce_sel2 as the high bit. The current driver uses the AST2600 mapping instead, where sel1 is the high bit and sel2 is the low bit. As a result, the debounce selector bits are programmed in reverse on AST2700. Swap the G7 sel1/sel2 bit definitions so the driver matches the hardware definition. Fixes: b2e861bd1eaf ("gpio: aspeed: Support G7 Aspeed gpio controller") Signed-off-by: Billy Tsai Link: https://patch.msgid.link/20260415-gpio-fix-v1-1-b08a89b31e6f@aspeedtech.com Signed-off-by: Bartosz Golaszewski commit 5cd9c6d332f46d1de8b68117fe2a3f1b08ee80ff Author: Jonas Karlman Date: Thu Apr 16 15:49:28 2026 +0000 gpio: rockchip: Fix GPIO regression after conversion to dynamic base allocation The commit c8079f83e0bf ("gpio: rockchip: convert to dynamic GPIO base allocation") broke GPIO on devices using device trees which don't set the gpio-ranges property, something only Rockchip RK35xx SoC DTs do. On a Rockchip RK3399 device something like following is now observed: [ 0.082771] rockchip-gpio ff720000.gpio: probed /pinctrl/gpio@ff720000 [ 0.083531] rockchip-gpio ff730000.gpio: probed /pinctrl/gpio@ff730000 [ 0.084110] rockchip-gpio ff780000.gpio: probed /pinctrl/gpio@ff780000 [ 0.084746] rockchip-gpio ff788000.gpio: probed /pinctrl/gpio@ff788000 [ 0.085389] rockchip-gpio ff790000.gpio: probed /pinctrl/gpio@ff790000 -- [ 0.212208] rockchip-pinctrl pinctrl: pin 637 is not registered so it cannot be requested [ 0.212271] rockchip-pinctrl pinctrl: error -EINVAL: pin-637 (gpio3:637) [ 0.212344] leds-gpio leds: error -EINVAL: Failed to get GPIO '/leds/led-0' [ 0.212389] leds-gpio leds: probe with driver leds-gpio failed with error -22 -- [ 0.607545] rockchip-pinctrl pinctrl: pin 519 is not registered so it cannot be requested [ 0.608775] rockchip-pinctrl pinctrl: error -EINVAL: pin-519 (gpio0:519) [ 0.610003] dwmmc_rockchip fe320000.mmc: probe with driver dwmmc_rockchip failed with error -22 -- [ 0.805882] rockchip-pinctrl pinctrl: pin 547 is not registered so it cannot be requested [ 0.806672] rockchip-pinctrl pinctrl: error -EINVAL: pin-547 (gpio1:547) [ 0.807301] reg-fixed-voltage regulator-vbus-typec: error -EINVAL: can't get GPIO [ 0.807307] rockchip-pinctrl pinctrl: pin 602 is not registered so it cannot be requested [ 0.807970] reg-fixed-voltage regulator-vbus-typec: probe with driver reg-fixed-voltage failed with error -22 [ 0.808692] rockchip-pinctrl pinctrl: error -EINVAL: pin-602 (gpio2:602) [ 0.810279] reg-fixed-voltage regulator-vcc3v3-pcie: error -EINVAL: can't get GPIO [ 0.810284] rockchip-pinctrl pinctrl: pin 665 is not registered so it cannot be requested [ 0.810299] rockchip-pinctrl pinctrl: error -EINVAL: pin-665 (gpio4:665) [ 0.810960] reg-fixed-voltage regulator-vcc3v3-pcie: probe with driver reg-fixed-voltage failed with error -22 [ 0.811679] reg-fixed-voltage regulator-vcc5v0-host: error -EINVAL: can't get GPIO [ 0.813943] reg-fixed-voltage regulator-vcc5v0-host: probe with driver reg-fixed-voltage failed with error -22 -- [ 0.867788] rockchip-pinctrl pinctrl: pin 522 is not registered so it cannot be requested [ 0.868537] rockchip-pinctrl pinctrl: error -EINVAL: pin-522 (gpio0:522) [ 0.869166] pwrseq_simple sdio-pwrseq: error -EINVAL: reset GPIOs not ready [ 0.869798] pwrseq_simple sdio-pwrseq: probe with driver pwrseq_simple failed with error -22 -- [ 0.940365] rockchip-pinctrl pinctrl: pin 623 is not registered so it cannot be requested [ 0.941084] rockchip-pinctrl pinctrl: error -EINVAL: pin-623 (gpio3:623) [ 0.941823] rk_gmac-dwmac fe300000.ethernet: error -EINVAL: Cannot register the MDIO bus [ 0.942542] rk_gmac-dwmac fe300000.ethernet: error -EINVAL: MDIO bus (id: 0) registration failed [ 0.943772] rk_gmac-dwmac fe300000.ethernet: probe with driver rk_gmac-dwmac failed with error -22 Restore GPIO to a working state on devices using older Rockchip SoCs and/or DTs not having the gpio-ranges property set by restoring prior use of bank->pin_base as the pin_offset value. Also change to use bank->nr_pins as the npins value to align and prevent a possible future breakage if gc->ngpio is ever changed to match the 32 GPIOs each controller theoretically can handle. Fixes: c8079f83e0bf ("gpio: rockchip: convert to dynamic GPIO base allocation") Signed-off-by: Jonas Karlman Reviewed-by: Linus Walleij Acked-by: Heiko Stuebner Link: https://patch.msgid.link/20260416154928.2103388-1-jonas@kwiboo.se Signed-off-by: Bartosz Golaszewski commit 3bfbf5f0a99c991769ec562721285df7ab69240b Author: Dudu Lu Date: Mon Apr 20 12:40:27 2026 +0800 crypto: krb5enc - fix async decrypt skipping hash verification krb5enc_dispatch_decrypt() sets req->base.complete as the skcipher callback, which is the caller's own completion handler. When the skcipher completes asynchronously, this signals "done" to the caller without executing krb5enc_dispatch_decrypt_hash(), completely bypassing the integrity verification (hash check). Compare with the encrypt path which correctly uses krb5enc_encrypt_done as an intermediate callback to chain into the hash computation on async completion. Fix by adding krb5enc_decrypt_done as an intermediate callback that chains into krb5enc_dispatch_decrypt_hash() upon async skcipher completion, matching the encrypt path's callback pattern. Also fix EBUSY/EINPROGRESS handling throughout: remove krb5enc_request_complete() which incorrectly swallowed EINPROGRESS notifications that must be passed up to callers waiting on backlogged requests, and add missing EBUSY checks in krb5enc_encrypt_ahash_done for the dispatch_encrypt return value. Fixes: d1775a177f7f ("crypto: Add 'krb5enc' hash and cipher AEAD algorithm") Signed-off-by: Dudu Lu Unset MAY_BACKLOG on the async completion path so the user won't see back-to-back EINPROGRESS notifications. Signed-off-by: Herbert Xu commit 5aa58c3a572b3e3b6c786953339f7978b845cc52 Author: Douya Le Date: Sun Apr 19 16:52:59 2026 +0800 crypto: algif_aead - snapshot IV for async AEAD requests AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during request processing. For async requests, later socket activity can update that shared state before the original request has fully completed, which can lead to inconsistent IV handling. Snapshot the IV into per-request storage when preparing the AEAD request, so in-flight operations no longer depend on mutable socket state. Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Co-developed-by: Luxing Yin Signed-off-by: Luxing Yin Tested-by: Yucheng Lu Signed-off-by: Douya Le Signed-off-by: Ren Wei Signed-off-by: Herbert Xu commit ae974ca6f0f3138a835d0ed38bedc87dec85b3b2 Author: Ethan Carter Edwards Date: Sat Apr 18 20:42:30 2026 -0400 fanotify: Fix spelling mistake "enforecement" -> "enforcement" There is a spelling mistake in a comment. Fix it. Signed-off-by: Ethan Carter Edwards Link: https://patch.msgid.link/20260418-fanotify-typo-v1-1-03ea48cb44ba@ethancedwards.com Signed-off-by: Jan Kara commit ec54093e6a8f87e800bb6aa15eb7fc1e33faa524 Author: Michael Bommarito Date: Sun Apr 19 18:35:42 2026 -0400 xfrm: ah: account for ESN high bits in async callbacks AH allocates its temporary auth/ICV layout differently when ESN is enabled: the async ahash setup appends a 4-byte seqhi slot before the ICV or auth_data area, but the async completion callbacks still reconstruct the temporary layout as if seqhi were absent. With an async AH implementation selected, that makes AH copy or compare the wrong bytes on both the IPv4 and IPv6 paths. In UML repro on IPv4 AH with ESN and forced async hmac(sha1), ping fails with 100% packet loss, and the callback logs show the pre-fix drift: ah4 output_done: esn=1 err=0 icv_off=20 expected_off=24 ah4 input_done: esn=1 auth_off=20 expected_auth_off=24 icv_off=32 expected_icv_off=36 Reconstruct the callback-side layout the same way the setup path built it by skipping the ESN seqhi slot before locating the saved auth_data or ICV. Per RFC 4302, the ESN high-order 32 bits participate in the AH ICV computation, so the async callbacks must account for the seqhi slot. Post-fix, the same IPv4 AH+ESN+forced-async-hmac(sha1) UML repro shows the corrected offset (ah4 output_done: esn=1 err=0 icv_off=24 expected_off=24) and ping succeeds; net/ipv4/ah4.o and net/ipv6/ah6.o build clean at W=1. IPv6 AH+ESN was not exercised at runtime, and the change has not been tested against a real async hardware AH engine. Fixes: d4d573d0334d ("{IPv4,xfrm} Add ESN support for AH egress part") Fixes: d8b2a8600b0e ("{IPv4,xfrm} Add ESN support for AH ingress part") Fixes: 26dd70c3fad3 ("{IPv6,xfrm} Add ESN support for AH egress part") Fixes: 8d6da6f32557 ("{IPv6,xfrm} Add ESN support for AH ingress part") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5-4 Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Signed-off-by: Steffen Klassert commit f4b369c6fe0ceaba2da2daff8c9eb415f85926dd Merge: ff14dafde15c11 2ca45e57ea027f Author: Dmitry Torokhov Date: Sun Apr 19 18:28:57 2026 -0700 Merge branch 'next' into for-linus Prepare input updates for 7.1 merge window. commit 2ca45e57ea027fffe3350ae5e21ad9cecb0dce74 Author: Hugo Villeneuve Date: Sat Apr 18 22:18:54 2026 -0700 Input: charlieplex_keypad - add GPIO charlieplex keypad Add support for GPIO-based charlieplex keypad, allowing to control N^2-N keys using N GPIO lines. Reuse matrix keypad keymap to simplify, even if there is no concept of rows and columns in this type of keyboard. Signed-off-by: Hugo Villeneuve Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260312180304.3865850-5-hugo@hugovil.com Signed-off-by: Dmitry Torokhov commit 0d64bee764847a488ac33be8ec61b4ae7828f8f1 Author: Hugo Villeneuve Date: Sat Apr 18 22:18:30 2026 -0700 dt-bindings: input: add GPIO charlieplex keypad Add DT bindings for GPIO charlieplex keypad. Reviewed-by: Rob Herring (Arm) Signed-off-by: Hugo Villeneuve Link: https://patch.msgid.link/20260312180304.3865850-4-hugo@hugovil.com Signed-off-by: Dmitry Torokhov commit 906a37ba5481ac1b6f6a51c25eba88e43749d428 Author: Hugo Villeneuve Date: Sat Apr 18 22:17:43 2026 -0700 dt-bindings: input: add settling-time-us common property Add common property that can be reused by other bindings. Reviewed-by: Rob Herring (Arm) Signed-off-by: Hugo Villeneuve Link: https://patch.msgid.link/20260312180304.3865850-3-hugo@hugovil.com Signed-off-by: Dmitry Torokhov commit cf1f976aee444af0143c3a2fa6cf0f8bf9bd938e Author: Hugo Villeneuve Date: Sat Apr 18 22:16:38 2026 -0700 dt-bindings: input: add debounce-delay-ms common property A few bindings are already defining a debounce-delay-ms property, so add it to the input binding to reduce redundant redefines. Reviewed-by: Rob Herring (Arm) Signed-off-by: Hugo Villeneuve Link: https://patch.msgid.link/20260312180304.3865850-2-hugo@hugovil.com Signed-off-by: Dmitry Torokhov commit 2e32d2ba1797578115bf0b91071791abaf302649 Author: Ethan Carter Edwards Date: Sat Apr 18 20:58:32 2026 -0400 Input: imx_keypad - fix spelling mistake "Colums" -> "Columns" There is a spelling mistake in two comments. Fix them. Signed-off-by: Ethan Carter Edwards Link: https://patch.msgid.link/20260418-imx-typo-v1-1-2a15e54ad4e7@ethancedwards.com Signed-off-by: Dmitry Torokhov commit f5f9e07060519e2287e99019a6de1eb3ebb65c37 Author: Dmitry Torokhov Date: Fri Apr 10 21:13:43 2026 -0700 Input: edt-ft5x06 - fix use-after-free in debugfs teardown The commit 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") removed the manual debugfs teardown, relying on the I2C core to handle it. However, this creates a window where debugfs files are still accessible after edt_ft5x06_ts_teardown_debugfs() frees tsdata->raw_buffer. To prevent a use-after-free, protect the freeing of raw_buffer with the device mutex and set raw_buffer to NULL. The debugfs read function already checks if raw_buffer is NULL under the same mutex, so this safely avoids the use-after-free. Fixes: 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/adnJicDh-bTUaWXP@google.com Signed-off-by: Dmitry Torokhov commit fb44d589bf3148e13452185a6e772a7efbf2d684 Author: Ashutosh Desai Date: Wed Apr 15 05:00:00 2026 +0000 drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can craft a self-referential extension (ext->next == &ext) with zero in_sync_count and out_sync_count, which bypasses the existing duplicate- extension guard: if (se->in_sync_count || se->out_sync_count) return -EINVAL; The guard never fires because v3d_get_multisync_post_deps() returns immediately when count is zero, leaving both fields at zero on every iteration. The result is an infinite loop in kernel context, blocking the calling thread and pegging a CPU core indefinitely. Fix this by rejecting a multisync extension where both in_sync_count and out_sync_count are zero in v3d_get_multisync_submit_deps(). An empty multisync carries no synchronization information and serves no useful purpose, so returning -EINVAL for such an extension is the correct defense against this attack vector. Fixes: e4165ae8304e ("drm/v3d: add multiple syncobjs support") Cc: stable@vger.kernel.org Signed-off-by: Ashutosh Desai Link: https://patch.msgid.link/20260415050000.3816128-1-ashutoshdesai993@gmail.com Signed-off-by: Maíra Canal commit 79fc229e8a471356ddfea225f42e02f4fb73c469 Author: Igor Korotin Date: Thu Apr 9 19:41:00 2026 +0100 MAINTAINERS: add Rust I2C tree and update Igor Korotin's email Add a git tree entry for Rust I2C development and update the e-mail address. The tree will be used to collect patches and provide a basis for integration and testing, including linux-next. Signed-off-by: Igor Korotin Signed-off-by: Wolfram Sang commit d891635322fbb49559ce9da4cad8643331600519 Merge: c1f49dea2b8f33 faed986de5250e Author: Wolfram Sang Date: Mon Apr 20 00:03:38 2026 +0200 Merge tag 'i2c-host-7.1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host for v7.1, part 2 - cx92755: convert I2C bindings to DT schema - mediatek: add optional bus power management during transfers - pxa: handle early bus busy condition commit c1f49dea2b8f335813d3b348fd39117fb8efb428 Merge: 8c2bf4a2e5cb4b 95093e5cb4c5b5 Author: Linus Torvalds Date: Sun Apr 19 14:45:37 2026 -0700 Merge tag 'mm-hotfixes-stable-2026-04-19-00-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: "7 hotfixes. 6 are cc:stable and all are for MM. Please see the individual changelogs for details" * tag 'mm-hotfixes-stable-2026-04-19-00-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/damon/core: disallow non-power of two min_region_sz on damon_start() mm/vmalloc: take vmap_purge_lock in shrinker mm: call ->free_folio() directly in folio_unmap_invalidate() mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() mm/zone_device: do not touch device folio after calling ->folio_free() mm/damon/core: disallow time-quota setting zero esz mm/mempolicy: fix weighted interleave auto sysfs name commit 8c2bf4a2e5cb4b325e328cc8808858a68616067c Merge: bea8d77e45a8b7 5b484311507b5d Author: Linus Torvalds Date: Sun Apr 19 12:58:08 2026 -0700 Merge tag 'driver-core-7.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Prevent a device from being probed before device_add() has finished initializing it; gate probe with a "ready_to_probe" device flag to avoid races with concurrent driver_register() calls - Fix a kernel-doc warning for DEV_FLAG_COUNT introduced by the above - Return -ENOTCONN from software_node_get_reference_args() when a referenced software node is known but not yet registered, allowing callers to defer probe - In sysfs_group_attrs_change_owner(), also check is_visible_const(); missed when the const variant was introduced * tag 'driver-core-7.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: driver core: Add kernel-doc for DEV_FLAG_COUNT enum value sysfs: attribute_group: Respect is_visible_const() when changing owner software node: return -ENOTCONN when referenced swnode is not registered yet driver core: Don't let a device probe until it's ready commit bea8d77e45a8b77f2beca1affc9aa7ed28f39b17 Merge: 99ef60d119f3b2 bf9c95f3eeefb7 Author: Linus Torvalds Date: Sun Apr 19 08:51:32 2026 -0700 Merge tag 'staging-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the "big" set of staging driver changes for 7.1-rc1. Nothing major in here at all, just lots of little cleanups for the staging drivers, driven by new developers getting their feet wet in kernel development. "Largest" thing in here is the change of some of the octeon variable types into proper kernel ones. Full details are in the shortlog. All of these have been in linux-next for a while with no reported issues" * tag 'staging-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (154 commits) staging: rtl8723bs: remove redundant & parentheses staging: most: dim2: replace BUG_ON() in poison_channel() staging: most: dim2: replace BUG_ON() in enqueue() staging: most: dim2: replace BUG_ON() in configure_channel() staging: most: dim2: replace BUG_ON() in service_done_flag() staging: most: dim2: replace BUG_ON() in try_start_dim_transfer() staging: rtl8723bs: remove unused RTL8188E antenna selection macros staging: rtl8723bs: remove redundant blank lines in basic_types.h staging: rtl8723bs: wrap complex macros with parentheses staging: rtl8723bs: remove unused WRITEEF/READEF byte macros staging: rtl8723bs: rename camelCase variable staging: greybus: audio: fix error message for BTN_3 button staging: rtl8723bs: rename variables to snake_case staging: rtl8723bs: fix spelling in comment staging: rtl8723bs: cleanup return in sdio_init() staging: rtl8723bs: use direct returns in sdio_dvobj_init() staging: rtl8723bs: remove unused arg at odm_interface.h greybus: raw: fix use-after-free if write is called after disconnect greybus: raw: fix use-after-free on cdev close staging: rtl8723bs: fix logical continuations in xmit_linux.c ... commit 99ef60d119f3b2621067dd5fc1ea4a37360709e4 Merge: 73398c2772d04e 87117347a0e77f Author: Linus Torvalds Date: Sun Apr 19 08:47:40 2026 -0700 Merge tag 'usb-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt changes for 7.1-rc1. Lots of little things in here, nothing major, just constant improvements, updates, and new features. Highlights are: - new USB power supply driver support. These changes did touch outside of drivers/usb/ but got acks from the relevant mantainers for them. - dts file updates and conversions - string function conversions into "safer" ones - new device quirks - xhci driver updates - usb gadget driver minor fixes - typec driver additions and updates - small number of thunderbolt driver changes - dwc3 driver updates and additions of new hardware support - other minor driver updates All of these have been in the linux-next tree for a while with no reported issues" * tag 'usb-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (176 commits) usb: dwc3: starfive: Add JHB100 USB 2.0 DRD controller dt-bindings: usb: dwc3: add support for StarFive JHB100 dt-bindings: usb: atmel,at91sam9rl-udc: convert to DT schema dt-bindings: usb: atmel,at91rm9200-udc: convert to DT schema dt-bindings: usb: generic-ehci: fix schema structure and add at91sam9g45 constraints dt-bindings: usb: generic-ohci: add AT91RM9200 OHCI binding support arm: dts: at91: remove unused #address-cells/#size-cells from sam9x60 udc node drivers/usb/host: Fix spelling error 'seperate' -> 'separate' usbip: tools: add hint when no exported devices are found USB: serial: iuu_phoenix: fix iuutool author name usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() usb: gadget: f_hid: Add missing error code usb: typec: cros_ec_ucsi: Load driver from OF and ACPI definitions dt-bindings: chrome: Add cros-ec-ucsi compatibility to typec binding USB: of: Simplify with scoped for each OF child loop usbip: validate number_of_packets in usbip_pack_ret_submit() usb: gadget: renesas_usb3: validate endpoint index in standard request handlers usb: core: config: reverse the size check of the SSP isoc endpoint descriptor usb: typec: ucsi: Set usb mode on partner change ... commit 87019cb6c26178cef8fb9f9265b6ab7c4bda5262 Author: Tejun Heo Date: Sun Apr 19 05:33:41 2026 -1000 sched_ext: Mark scx_sched_hash insecure_elasticity scx_sched_hash is inserted into under scx_sched_lock (raw_spinlock_irq) in scx_link_sched(). rhashtable's sync grow path calls get_random_u32() and does a GFP_ATOMIC allocation; both acquire regular spinlocks, which is unsafe under raw_spinlock_t. Set insecure_elasticity to skip the sync grow. v2: - Dropped dsq_hash changes. Insertion is not under raw_spin_lock. - Switched from no_sync_grow flag to insecure_elasticity. Fixes: 25037af712eb ("sched_ext: Add rhashtable lookup for sub-schedulers") Signed-off-by: Tejun Heo commit 73bd1227787bfe73eea3d04c63a89cb55db9c23e Author: Herbert Xu Date: Sat Apr 18 09:41:21 2026 +0800 rhashtable: Restore insecure_elasticity toggle Some users of rhashtable cannot handle insertion failures, and are happy to accept the consequences of a hash table that having very long chains. Restore the insecure_elasticity toggle for these users. In addition to disabling the chain length checks, this also removes the emergency resize that would otherwise occur when the hash table occupancy hits 100% (an async resize is still scheduled at 75%). Signed-off-by: Herbert Xu Signed-off-by: Tejun Heo commit 73398c2772d04ee656a654c63db85851381cd147 Merge: 40735a683bf844 a1a81aef99e853 Author: Linus Torvalds Date: Sun Apr 19 08:44:41 2026 -0700 Merge tag 'tty-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial updates from Greg KH: "Here is the set of tty and serial driver changes for 7.1-rc1. Not much here this cycle, biggest thing is the removal of an old driver that never got any actual hardware support (esp32), and the second try to moving the tty ports to their own workqueues (first try was in 7.0-rc1 but was reverted due to problems) Otherwise it's just a small set of driver updates and some vt modifier key enhancements. All have been in linux-next for a while with no reported issues" * tag 'tty-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (35 commits) tty: serial: ip22zilog: Fix section mispatch warning hvc/xen: Check console connection flag serial: sh-sci: Add support for RZ/G3L RSCI dt-bindings: serial: renesas,rsci: Document RZ/G3L SoC tty: atmel_serial: update outdated reference to atmel_tasklet_func() serial: xilinx_uartps: Drop unused include serial: qcom-geni: drop stray newline format specifier serial: 8250: loongson: Enable building on MIPS Loongson64 dt-bindings: serial: 8250: Add Loongson 3A4000 uart compatible serial: 8250_fintek: Add support for F81214E tty: tty_port: add workqueue to flip TTY buffer vt: support ITU-T T.416 color subparameters serial: qcom-geni: Fix RTS behavior with flow control tty: serial: imx: keep dma request disabled before dma transfer setup tty: serial: 8250: Add SystemBase Multi I/O cards serial: pic32_uart: allow driver to be compiled on all architectures with COMPILE_TEST serial: tegra: remove Kconfig dependency on APB DMA controller dt-bindings: serial: amlogic,meson-uart: Add compatible string for A9 dt-bindings: serial: atmel,at91-usart: add microchip,lan9691-usart serial: auart: check clk_enable() return in console write ... commit 40735a683bf844a453d7a0f91e5e3daa0abc659b Merge: faeab166167f57 0b5e8d7999076a Author: Linus Torvalds Date: Sun Apr 19 08:01:17 2026 -0700 Merge tag 'mm-stable-2026-04-18-02-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: - "Eliminate Dying Memory Cgroup" (Qi Zheng and Muchun Song) Address the longstanding "dying memcg problem". A situation wherein a no-longer-used memory control group will hang around for an extended period pointlessly consuming memory - "fix unexpected type conversions and potential overflows" (Qi Zheng) Fix a couple of potential 32-bit/64-bit issues which were identified during review of the "Eliminate Dying Memory Cgroup" series - "kho: history: track previous kernel version and kexec boot count" (Breno Leitao) Use Kexec Handover (KHO) to pass the previous kernel's version string and the number of kexec reboots since the last cold boot to the next kernel, and print it at boot time - "liveupdate: prevent double preservation" (Pasha Tatashin) Teach LUO to avoid managing the same file across different active sessions - "liveupdate: Fix module unloading and unregister API" (Pasha Tatashin) Address an issue with how LUO handles module reference counting and unregistration during module unloading - "zswap pool per-CPU acomp_ctx simplifications" (Kanchana Sridhar) Simplify and clean up the zswap crypto compression handling and improve the lifecycle management of zswap pool's per-CPU acomp_ctx resources - "mm/damon/core: fix damon_call()/damos_walk() vs kdmond exit race" (SeongJae Park) Address unlikely but possible leaks and deadlocks in damon_call() and damon_walk() - "mm/damon/core: validate damos_quota_goal->nid" (SeongJae Park) Fix a couple of root-only wild pointer dereferences - "Docs/admin-guide/mm/damon: warn commit_inputs vs other params race" (SeongJae Park) Update the DAMON documentation to warn operators about potential races which can occur if the commit_inputs parameter is altered at the wrong time - "Minor hmm_test fixes and cleanups" (Alistair Popple) Bugfixes and a cleanup for the HMM kernel selftests - "Modify memfd_luo code" (Chenghao Duan) Cleanups, simplifications and speedups to the memfd_lou code - "mm, kvm: allow uffd support in guest_memfd" (Mike Rapoport) Support for userfaultfd in guest_memfd - "selftests/mm: skip several tests when thp is not available" (Chunyu Hu) Fix several issues in the selftests code which were causing breakage when the tests were run on CONFIG_THP=n kernels - "mm/mprotect: micro-optimization work" (Pedro Falcato) A couple of nice speedups for mprotect() - "MAINTAINERS: update KHO and LIVE UPDATE entries" (Pratyush Yadav) Document upcoming changes in the maintenance of KHO, LUO, memfd_luo, kexec, crash, kdump and probably other kexec-based things - they are being moved out of mm.git and into a new git tree * tag 'mm-stable-2026-04-18-02-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (121 commits) MAINTAINERS: add page cache reviewer mm/vmscan: avoid false-positive -Wuninitialized warning MAINTAINERS: update Dave's kdump reviewer email address MAINTAINERS: drop include/linux/liveupdate from LIVE UPDATE MAINTAINERS: drop include/linux/kho/abi/ from KHO MAINTAINERS: update KHO and LIVE UPDATE maintainers MAINTAINERS: update kexec/kdump maintainers entries mm/migrate_device: remove dead migration entry check in migrate_vma_collect_huge_pmd() selftests: mm: skip charge_reserved_hugetlb without killall userfaultfd: allow registration of ranges below mmap_min_addr mm/vmstat: fix vmstat_shepherd double-scheduling vmstat_update mm/hugetlb: fix early boot crash on parameters without '=' separator zram: reject unrecognized type= values in recompress_store() docs: proc: document ProtectionKey in smaps mm/mprotect: special-case small folios when applying permissions mm/mprotect: move softleaf code out of the main function mm: remove '!root_reclaim' checking in should_abort_scan() mm/sparse: fix comment for section map alignment mm/page_io: use sio->len for PSWPIN accounting in sio_read_complete() selftests/mm: transhuge_stress: skip the test when thp not available ... commit 90ea1d02f4031640dae6d6c18c45d9722c9b2243 Author: Steve French Date: Thu Apr 16 23:26:08 2026 -0500 cifs: update internal module version number to 2.60 Signed-off-by: Steve French commit a13e942a03feea211c67a97bc6a57f82aa56e4b6 Author: Enzo Matsumiya Date: Mon Apr 13 16:07:07 2026 -0300 smb: client: compress: fix bad encoding on last LZ77 flag End-of-stream flag could lead to UB because of int promotion (overwriting signed bit). Fix it by changing operand from '1' to '1UL'. Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 95093e5cb4c5b50a5b1a4b79f2942b62744bd66a Author: SeongJae Park Date: Sat Apr 11 14:36:36 2026 -0700 mm/damon/core: disallow non-power of two min_region_sz on damon_start() Commit d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region") introduced a bug that allows unaligned DAMON region address ranges. Commit c80f46ac228b ("mm/damon/core: disallow non-power of two min_region_sz") fixed it, but only for damon_commit_ctx() use case. Still, DAMON sysfs interface can emit non-power of two min_region_sz via damon_start(). Fix the path by adding the is_power_of_2() check on damon_start(). The issue was discovered by sashiko [1]. Link: https://lore.kernel.org/20260411213638.77768-1-sj@kernel.org Link: https://lore.kernel.org/20260403155530.64647-1-sj@kernel.org [1] Fixes: d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region") Signed-off-by: SeongJae Park Cc: # 6.18.x Signed-off-by: Andrew Morton commit ec05f51f1e65bce95528543eb73fda56fd201d94 Author: Uladzislau Rezki (Sony) Date: Mon Apr 13 21:26:46 2026 +0200 mm/vmalloc: take vmap_purge_lock in shrinker decay_va_pool_node() can be invoked concurrently from two paths: __purge_vmap_area_lazy() when pools are being purged, and the shrinker via vmap_node_shrink_scan(). However, decay_va_pool_node() is not safe to run concurrently, and the shrinker path currently lacks serialization, leading to races and possible leaks. Protect decay_va_pool_node() by taking vmap_purge_lock in the shrinker path to ensure serialization with purge users. Link: https://lore.kernel.org/20260413192646.14683-1-urezki@gmail.com Fixes: 7679ba6b36db ("mm: vmalloc: add a shrinker to drain vmap pools") Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Baoquan He Cc: chenyichong Cc: Signed-off-by: Andrew Morton commit 615d9bb2ccad42f9e21d837431e401db2e471195 Author: Matthew Wilcox (Oracle) Date: Mon Apr 13 19:43:11 2026 +0100 mm: call ->free_folio() directly in folio_unmap_invalidate() We can only call filemap_free_folio() if we have a reference to (or hold a lock on) the mapping. Otherwise, we've already removed the folio from the mapping so it no longer pins the mapping and the mapping can be removed, causing a use-after-free when accessing mapping->a_ops. Follow the same pattern as __remove_mapping() and load the free_folio function pointer before dropping the lock on the mapping. That lets us make filemap_free_folio() static as this was the only caller outside filemap.c. Link: https://lore.kernel.org/20260413184314.3419945-1-willy@infradead.org Fixes: fb7d3bc41493 ("mm/filemap: drop streaming/uncached pages when writeback completes") Signed-off-by: Matthew Wilcox (Oracle) Reported-by: Google Big Sleep Cc: Jens Axboe Cc: Jan Kara Cc: Signed-off-by: Andrew Morton commit 8f5857be99f1ed1fa80991c72449541f634626ee Author: Breno Leitao Date: Mon Apr 13 03:09:19 2026 -0700 mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last reference, the blkcg can be freed asynchronously (css_free_rwork_fn -> blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the pointer to access blkcg->online_pin, resulting in a use-after-free: BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwb_release cgwb_release_workfn Call Trace: blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwb_release_workfn (mm/backing-dev.c:629) process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385) Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) css_free_rwork_fn (kernel/cgroup/cgroup.c:5542) process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385) ** Stack based on commit 66672af7a095 ("Add linux-next specific files for 20260410") I am seeing this crash sporadically in Meta fleet across multiple kernel versions. A full reproducer is available at: https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh (The race window is narrow. To make it easily reproducible, inject a msleep(100) between css_put() and blkcg_unpin_online() in cgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the reproducer triggers the splat reliably in less than a second.) Fix this by moving blkcg_unpin_online() before css_put(), so the cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online() accesses it. Link: https://lore.kernel.org/20260413-blkcg-v1-1-35b72622d16c@debian.org Fixes: 59b57717fff8 ("blkcg: delay blkg destruction until after writeback has finished") Signed-off-by: Breno Leitao Reviewed-by: Dennis Zhou Reviewed-by: Shakeel Butt Cc: David Hildenbrand Cc: Jens Axboe Cc: Johannes Weiner Cc: Josef Bacik Cc: JP Kobryn Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Martin KaFai Lau Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton commit 39928984956037cabd304321cb8f342e47421db5 Author: Matthew Brost Date: Fri Apr 10 16:03:46 2026 -0700 mm/zone_device: do not touch device folio after calling ->folio_free() The contents of a device folio can immediately change after calling ->folio_free(), as the folio may be reallocated by a driver with a different order. Instead of touching the folio again to extract the pgmap, use the local stack variable when calling percpu_ref_put_many(). Link: https://lore.kernel.org/20260410230346.4009855-1-matthew.brost@intel.com Fixes: d245f9b4ab80 ("mm/zone_device: support large zone device private folios") Signed-off-by: Matthew Brost Reviewed-by: Balbir Singh Reviewed-by: Vishal Moola Reviewed-by: Alistair Popple Cc: David Hildenbrand Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton commit 8bbde987c2b84f80da0853f739f0a920386f8b99 Author: SeongJae Park Date: Mon Apr 6 17:31:52 2026 -0700 mm/damon/core: disallow time-quota setting zero esz When the throughput of a DAMOS scheme is very slow, DAMOS time quota can make the effective size quota smaller than damon_ctx->min_region_sz. In the case, damos_apply_scheme() will skip applying the action, because the action is tried at region level, which requires >=min_region_sz size. That is, the quota is effectively exceeded for the quota charge window. Because no action will be applied, the total_charged_sz and total_charged_ns are also not updated. damos_set_effective_quota() will try to update the effective size quota before starting the next charge window. However, because the total_charged_sz and total_charged_ns have not updated, the throughput and effective size quota are also not changed. Since effective size quota can only be decreased, other effective size quota update factors including DAMOS quota goals and size quota cannot make any change, either. As a result, the scheme is unexpectedly deactivated until the user notices and mitigates the situation. The users can mitigate this situation by changing the time quota online or re-install the scheme. While the mitigation is somewhat straightforward, finding the situation would be challenging, because DAMON is not providing good observabilities for that. Even if such observability is provided, doing the additional monitoring and the mitigation is somewhat cumbersome and not aligned to the intention of the time quota. The time quota was intended to help reduce the user's administration overhead. Fix the problem by setting time quota-modified effective size quota be at least min_region_sz always. The issue was discovered [1] by sashiko. Link: https://lore.kernel.org/20260407003153.79589-1-sj@kernel.org Link: https://lore.kernel.org/20260405192504.110014-1-sj@kernel.org [1] Fixes: 1cd243030059 ("mm/damon/schemes: implement time quota") Signed-off-by: SeongJae Park Cc: # 5.16.x Signed-off-by: Andrew Morton commit 8fedac321fb0fb368d4c14674e2a64852b4f225e Author: Joshua Hahn Date: Tue Apr 7 07:14:14 2026 -0700 mm/mempolicy: fix weighted interleave auto sysfs name The __ATTR macro is a utility that makes defining kobj_attributes easier by stringfying the name, verifying the mode, and setting the show/store fields in a single initializer. It takes a raw token as the first value, rather than a string, so that __ATTR family macros like __ATTR_RW can token-paste it for inferring the _show / _store function names. Commit e341f9c3c841 ("mm/mempolicy: Weighted Interleave Auto-tuning") used the __ATTR macro to define the "auto" sysfs for weighted interleave. A few months later, commit 2fb6915fa22d ("compiler_types.h: add "auto" as a macro for "__auto_type"") introduced a #define macro which expanded auto into __auto_type. This led to the "auto" token passed into __ATTR to be expanded out into __auto_type, and the sysfs entry to be displayed as __auto_type as well. Expand out the __ATTR macro and directly pass a string "auto" instead of the raw token 'auto' to prevent it from being expanded out. Also bypass the VERIFY_OCTAL_PERMISSIONS check by triple checking that 0664 is indeed the intended permissions for this sysfs file. Before: $ ls /sys/kernel/mm/mempolicy/weighted_interleave __auto_type node0 After: $ ls /sys/kernel/mm/mempolicy/weighted_interleave/ auto node0 Link: https://lore.kernel.org/20260407141415.3080960-1-joshua.hahnjy@gmail.com Fixes: 2fb6915fa22d ("compiler_types.h: add "auto" as a macro for "__auto_type"") Signed-off-by: Joshua Hahn Reviewed-by: Gregory Price Reviewed-by: Rakie Kim Acked-by: David Hildenbrand (Arm) Acked-by: Zi Yan Cc: Alistair Popple Cc: Byungchul Park Cc: "Huang, Ying" Cc: Matthew Brost Cc: Rakie Kim Cc: Ying Huang Signed-off-by: Andrew Morton commit e9af4f47d4a036b4be67e4be361f62e05081f7bf Author: Eric Biggers Date: Sat Apr 18 12:21:38 2026 -0700 lib/crypto: docs: Add rst documentation to Documentation/crypto/ Add a documentation file Documentation/crypto/libcrypto.rst which provides a high-level overview of lib/crypto/. Also add several sub-pages which include the kernel-doc for the algorithms that have it. This makes the existing, quite extensive kernel-doc start being included in the HTML and PDF documentation. Note that the intent is very much *not* that everyone has to read these Documentation/ files. The library is intended to be straightforward and use familiar conventions; generally it should be possible to dive right into the kernel-doc. You shouldn't need to read a lot of documentation to just call `sha256()`, for example, or to run the unit tests if you're already familiar with KUnit. (This differs from the traditional crypto API which has a larger barrier to entry.) Nevertheless, this seems worth adding. Hopefully it is useful and makes LWN no longer consider the library to be "meticulously undocumented". Reviewed-by: Ard Biesheuvel Tested-by: Randy Dunlap Reviewed-by: Randy Dunlap Link: https://lore.kernel.org/r/20260418192138.15556-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6fa6b5cb60490db2591bb93872b95f72315e5f53 Author: Eric Biggers Date: Sat Apr 18 12:21:37 2026 -0700 docs: kdoc: Expand 'at_least' when creating parameter list sphinx doesn't know that the kernel headers do: #define at_least static Do this replacement before declarations are passed to it. This prevents errors like the following from appearing once the lib/crypto/ kernel-doc is wired up to the sphinx build: linux/Documentation/crypto/libcrypto:128: ./include/crypto/sha2.h:773: WARNING: Error in declarator or parameters Error in declarator or parameters Invalid C declaration: Expected ']' in end of array operator. [error at 59] void sha512_final (struct sha512_ctx *ctx, u8 out[at_least SHA512_DIGEST_SIZE]) Acked-by: Jonathan Corbet Reviewed-by: Ard Biesheuvel Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20260418192138.15556-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit faeab166167f5787719eb8683661fd41a3bb1514 Merge: 401b0e0bc96543 90700e10d2ad61 Author: Linus Torvalds Date: Sat Apr 18 16:59:09 2026 -0700 Merge tag 'pinctrl-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Core changes: - Perform basic checks on pin config properties so as not to allow directly contradictory settings such as setting a pin to more than one bias or drive mode - Handle input-threshold-voltage-microvolt property - Introduce pinctrl_gpio_get_config() handling in the core for SCMI GPIO using pin control New drivers: - GPIO-by-pin control driver (also appearing in the GPIO pull request) fulfilling a promise on a comment from Grant Likely many years ago: "can't GPIO just be a front-end for pin control?" it turns out it can, if and only if you design something new from scratch, such as SCMI - Broadcom BCM7038 as a pinctrl-single delegate - Mobileye EyeQ6Lplus OLB pin controller - Qualcomm Eliza and Hawi families TLMM pin controllers - Qualcomm SDM670 and Milos family LPASS LPI pin controllers - Qualcomm IPQ5210 pin controller - Realtek RTD1625 pin controller support - Rockchip RV1103B pin controller support - Texas Instruments AM62L as a pinctrl-single delegate Improvements: - Set config implementation for the Spacemit K1 pin controller" * tag 'pinctrl-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (84 commits) pinctrl: qcom: Add Hawi pinctrl driver dt-bindings: pinctrl: qcom: Describe Hawi TLMM block dt-bindings: pinctrl: pinctrl-max77620: convert to DT schema pinctrl: single: Add bcm7038-padconf compatible matching dt-bindings: pinctrl: pinctrl-single: Add brcm,bcm7038-padconf dt-bindings: pinctrl: apple,pinctrl: Add t8122 compatible pinctrl: qcom: sdm670-lpass-lpi: label variables as static pinctrl: sophgo: pinctrl-sg2044: Fix wrong module description pinctrl: sophgo: pinctrl-sg2042: Fix wrong module description pinctrl: qcom: add sdm670 lpi tlmm dt-bindings: pinctrl: qcom: Add SDM670 LPASS LPI pinctrl dt-bindings: qcom: lpass-lpi-common: add reserved GPIOs property pinctrl: qcom: Introduce IPQ5210 TLMM driver dt-bindings: pinctrl: qcom: add IPQ5210 pinctrl pinctrl: qcom: Drop redundant intr_target_reg on modern SoCs pinctrl: qcom: eliza: Fix interrupt target bit pinctrl: core: Don't use "proxy" headers pinctrl: amd: Support new ACPI ID AMDI0033 pinctrl: renesas: rzg2l: Drop superfluous blank line pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers ... commit 401b0e0bc96543881924d623388a9472b3331b3f Merge: eb5249b1250724 d35a6db887eeae Author: Linus Torvalds Date: Sat Apr 18 16:48:13 2026 -0700 Merge tag 'i3c/for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "Subsystem: - add sysfs option to rescan bus via entdaa - fix error code handling for send_ccc_cmd Drivers: - mipi-i3c-hci-pci: Intel Nova Lake-H I3C support" * tag 'i3c/for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (22 commits) i3c: mipi-i3c-hci: fix IBI payload length calculation for final status i3c: master: adi: Fix error propagation for CCCs i3c: master: Fix error codes at send_ccc_cmd i3c: master: Move bus_init error suppression i3c: master: Move entdaa error suppression i3c: master: Move rstdaa error suppression i3c: dw: Simplify xfer cleanup with __free(kfree) i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() i3c: master: renesas: Use __free(kfree) for xfer cleanup in renesas_i3c_send_ccc_cmd() i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers() i3c: master: dw-i3c: Balance PM runtime usage count on probe failure i3c: master: dw-i3c: Fix missing reset assertion in remove() callback i3c: mipi-i3c-hci-pci: Enable IBI while runtime suspended for Intel controllers i3c: mipi-i3c-hci-pci: Add optional ability to manage child runtime PM i3c: mipi-i3c-hci: Allow parent to manage runtime PM i3c: mipi-i3c-hci: Add quirk to allow IBI while runtime suspended i3c: mipi-i3c-hci-pci: Set d3hot_delay to 0 for Intel controllers i3c: fix missing newline in dev_err messages i3c: master: use kzalloc_flex i3c: mipi-i3c-hci-pci: Add support for Intel Nova Lake-H I3C ... commit 07004a8c4b572171934390148ee48c4175c77eed Author: David Carlier Date: Sat Apr 18 20:17:37 2026 +0100 eventfs: Hold eventfs_mutex and SRCU when remount walks events Commit 340f0c7067a9 ("eventfs: Update all the eventfs_inodes from the events descriptor") had eventfs_set_attrs() recurse through ei->children on remount. The walk only holds the rcu_read_lock() taken by tracefs_apply_options() over tracefs_inodes, which is wrong: - list_for_each_entry over ei->children races with the list_del_rcu() in eventfs_remove_rec() -- LIST_POISON1 deref, same shape as d2603279c7d6. - eventfs_inodes are freed via call_srcu(&eventfs_srcu, ...). rcu_read_lock() does not extend an SRCU grace period, so ti->private can be reclaimed under the walk. - The writes to ei->attr race with eventfs_set_attr(), which holds eventfs_mutex. Reproducer: while :; do mount -o remount,uid=$((RANDOM%1000)) /sys/kernel/tracing; done & while :; do echo "p:kp submit_bio" > /sys/kernel/tracing/kprobe_events echo > /sys/kernel/tracing/kprobe_events done Wrap the events portion of tracefs_apply_options() in eventfs_remount_lock()/_unlock() that take eventfs_mutex and srcu_read_lock(&eventfs_srcu). eventfs_set_attrs() doesn't sleep so the nested rcu_read_lock() is fine; lockdep_assert_held() pins the contract. Comment in tracefs_drop_inode() said "RCU cycle" -- it is SRCU. Fixes: 340f0c7067a9 ("eventfs: Update all the eventfs_inodes from the events descriptor") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260418191737.10289-1-devnexen@gmail.com Signed-off-by: David Carlier Signed-off-by: Steven Rostedt commit f67950b2887fa10df50c4317a1fe98a65bc6875b Author: David Carlier Date: Sat Apr 18 16:22:50 2026 +0100 eventfs: Use list_add_tail_rcu() for SRCU-protected children list Commit d2603279c7d6 ("eventfs: Use list_del_rcu() for SRCU protected list variable") converted the removal side to pair with the list_for_each_entry_srcu() walker in eventfs_iterate(). The insertion in eventfs_create_dir() was left as a plain list_add_tail(), which on weakly-ordered architectures can expose a new entry to the SRCU reader before its list pointers and fields are observable. Use list_add_tail_rcu() so the publication pairs with the existing list_del_rcu() and list_for_each_entry_srcu(). Fixes: 43aa6f97c2d0 ("eventfs: Get rid of dentry pointers without refcounts") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260418152251.199343-1-devnexen@gmail.com Signed-off-by: David Carlier Signed-off-by: Steven Rostedt commit cb8ff3ead9a3fc43727980be58c7099506f65261 Author: Daniel Lee Date: Fri Apr 17 10:50:40 2026 -0700 f2fs: add page-order information for large folio reads in iostat Track read folio counts by order in F2FS iostat sysfs and tracepoints. Signed-off-by: Daniel Lee Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 0cf004ffb61cd32d140531c3a84afe975f9fc7ea Author: Michael Bommarito Date: Wed Apr 15 23:19:03 2026 -0400 sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks sctp_getsockopt_peer_auth_chunks() checks that the caller's optval buffer is large enough for the peer AUTH chunk list with if (len < num_chunks) return -EINVAL; but then writes num_chunks bytes to p->gauth_chunks, which lives at offset offsetof(struct sctp_authchunks, gauth_chunks) == 8 inside optval. The check is missing the sizeof(struct sctp_authchunks) = 8-byte header. When the caller supplies len == num_chunks (for any num_chunks > 0) the test passes but copy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes past the declared buffer. The sibling function sctp_getsockopt_local_auth_chunks() at the next line already has the correct check: if (len < sizeof(struct sctp_authchunks) + num_chunks) return -EINVAL; Align the peer variant with its sibling. Reproducer confirms on v7.0-13-generic: an unprivileged userspace caller that opens a loopback SCTP association with AUTH enabled, queries num_chunks with a short optval, then issues the real getsockopt with len == num_chunks and sentinel bytes painted past the buffer observes those sentinel bytes overwritten with the peer's AUTH chunk type. The bytes written are under the peer's control but land in the caller's own userspace; this is not a kernel memory corruption, but it is a kernel-side contract violation that can silently corrupt adjacent userspace data. Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH extensions.") Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Michael Bommarito Acked-by: Xin Long Link: https://patch.msgid.link/20260416031903.1447072-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski commit 22230e68b2cf1ab6b027be8cf1198164a949c4fa Author: Marek Vasut Date: Thu Apr 16 01:09:45 2026 +0200 net: ks8851: Avoid excess softirq scheduling The code injects a packet into netif_rx() repeatedly, which will add it to its internal NAPI and schedule a softirq, and process it. It is more efficient to queue multiple packets and process them all at the local_bh_enable() time. Reviewed-by: Sebastian Andrzej Siewior Fixes: e0863634bf9f ("net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs") Cc: stable@vger.kernel.org Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260415231020.455298-2-marex@nabladev.com Signed-off-by: Jakub Kicinski commit 5c9fcac3c872224316714d0d8914d9af16c76a6d Author: Marek Vasut Date: Thu Apr 16 01:09:44 2026 +0200 net: ks8851: Reinstate disabling of BHs around IRQ handler If the driver executes ks8851_irq() AND a TX packet has been sent, then the driver enables TX queue via netif_wake_queue() which schedules TX softirq to queue packets for this device. If CONFIG_PREEMPT_RT=y is set AND a packet has also been received by the MAC, then ks8851_rx_pkts() calls netdev_alloc_skb_ip_align() to allocate SKBs for the received packets. If netdev_alloc_skb_ip_align() is called with BH enabled, then local_bh_enable() at the end of netdev_alloc_skb_ip_align() will trigger the pending softirq processing, which may ultimately call the .xmit callback ks8851_start_xmit_par(). The ks8851_start_xmit_par() will try to lock struct ks8851_net_par .lock spinlock, which is already locked by ks8851_irq() from which ks8851_start_xmit_par() was called. This leads to a deadlock, which is reported by the kernel, including a trace listed below. If CONFIG_PREEMPT_RT is not set, then since commit 0913ec336a6c0 ("net: ks8851: Fix deadlock with the SPI chip variant") the deadlock can also be triggered without received packet in the RX FIFO. The pending softirqs will be processed on return from spin_unlock_bh(&ks->statelock) in ks8851_irq(), which triggers the deadlock as well. Fix the problem by disabling BH around critical sections, including the IRQ handler, thus preventing the net_tx_action() softirq from triggering during these critical sections. The net_tx_action() softirq is triggered once BH are re-enabled and at the end of the IRQ handler, once all the other IRQ handler actions have been completed. __schedule from schedule_rtlock+0x1c/0x34 schedule_rtlock from rtlock_slowlock_locked+0x548/0x904 rtlock_slowlock_locked from rt_spin_lock+0x60/0x9c rt_spin_lock from ks8851_start_xmit_par+0x74/0x1a8 ks8851_start_xmit_par from netdev_start_xmit+0x20/0x44 netdev_start_xmit from dev_hard_start_xmit+0xd0/0x188 dev_hard_start_xmit from sch_direct_xmit+0xb8/0x25c sch_direct_xmit from __qdisc_run+0x1f8/0x4ec __qdisc_run from qdisc_run+0x1c/0x28 qdisc_run from net_tx_action+0x1f0/0x268 net_tx_action from handle_softirqs+0x1a4/0x270 handle_softirqs from __local_bh_enable_ip+0xcc/0xe0 __local_bh_enable_ip from __alloc_skb+0xd8/0x128 __alloc_skb from __netdev_alloc_skb+0x3c/0x19c __netdev_alloc_skb from ks8851_irq+0x388/0x4d4 ks8851_irq from irq_thread_fn+0x24/0x64 irq_thread_fn from irq_thread+0x178/0x28c irq_thread from kthread+0x12c/0x138 kthread from ret_from_fork+0x14/0x28 Reviewed-by: Sebastian Andrzej Siewior Fixes: e0863634bf9f ("net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs") Cc: stable@vger.kernel.org Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260415231020.455298-1-marex@nabladev.com Signed-off-by: Jakub Kicinski commit 965dc93481d1b80d341bdd16c27b16fe197175ee Author: Kuniyuki Iwashima Date: Wed Apr 15 18:48:29 2026 +0000 af_unix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AF_UNIX GC. When a socket in SOCKMAP receives skb with inflight fd, sk_psock_verdict_data_ready() looks up the mapped socket and enqueue skb to its psock->ingress_skb. Since neither the old nor the new GC can inspect the psock queue, the hidden skb leaks the inflight sockets. Note that this cannot be detected via kmemleak because inflight sockets are linked to a global list. In addition, SOCKMAP redirect breaks the Tarjan-based GC's assumption that unix_edge.successor is always alive, which is no longer true once skb is redirected, resulting in use-after-free below. [0] Moreover, SOCKMAP does not call scm_stat_del() properly, so unix_show_fdinfo() could report an incorrect fd count. sk_msg_recvmsg() does not support any SCM attributes in the first place. Let's drop all SCM attributes before passing skb to the SOCKMAP layer. [0]: BUG: KASAN: slab-use-after-free in unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251) Read of size 8 at addr ffff888125362670 by task kworker/56:1/496 CPU: 56 UID: 0 PID: 496 Comm: kworker/56:1 Not tainted 7.0.0-rc7-00263-gb9d8b856689d #3 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 Workqueue: events sk_psock_backlog Call Trace: dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:379) kasan_report (mm/kasan/report.c:597) unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251) unix_destroy_fpl (net/unix/garbage.c:317) unix_destruct_scm (./include/net/scm.h:80 ./include/net/scm.h:86 net/unix/af_unix.c:1976) sk_psock_backlog (./include/linux/skbuff.h:?) process_scheduled_works (kernel/workqueue.c:?) worker_thread (kernel/workqueue.c:?) kthread (kernel/kthread.c:438) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:258) Allocated by task 955: kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78) __kasan_slab_alloc (mm/kasan/common.c:369) kmem_cache_alloc_noprof (mm/slub.c:4539) sk_prot_alloc (net/core/sock.c:2240) sk_alloc (net/core/sock.c:2301) unix_create1 (net/unix/af_unix.c:1099) unix_create (net/unix/af_unix.c:1169) __sock_create (net/socket.c:1606) __sys_socketpair (net/socket.c:1811) __x64_sys_socketpair (net/socket.c:1863 net/socket.c:1860 net/socket.c:1860) do_syscall_64 (arch/x86/entry/syscall_64.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Freed by task 496: kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:587) __kasan_slab_free (mm/kasan/common.c:287) kmem_cache_free (mm/slub.c:6165) __sk_destruct (net/core/sock.c:2282 net/core/sock.c:2384) sk_psock_destroy (./include/net/sock.h:?) process_scheduled_works (kernel/workqueue.c:?) worker_thread (kernel/workqueue.c:?) kthread (kernel/kthread.c:438) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:258) Fixes: c63829182c37 ("af_unix: Implement ->psock_update_sk_prot()") Fixes: 77462de14a43 ("af_unix: Add read_sock for stream socket types") Reported-by: Xingyu Jin Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260415184830.3988432-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 8cff9dbe89d8bd44d9a5e631c9394dd3901ffd79 Author: KhaiWenTan Date: Thu Apr 16 18:26:09 2026 +0800 net: stmmac: Update default_an_inband before passing value to phylink_config get_interfaces() will update both the plat->phy_interfaces and mdio_bus_data->default_an_inband based on reading a SERDES register. As get_interfaces() will be called after default_an_inband had already been read, dwmac-intel regressed as a result with incorrect default_an_inband value in phylink_config. Therefore, we moved the priv->plat->get_interfaces() to be executed first before assigning priv->plat->default_an_inband to config->default_an_inband to ensure default_an_inband is in correct value. Fixes: d3836052fe09 ("net: stmmac: intel: convert speed_mode_2500() to get_interfaces()") Signed-off-by: KhaiWenTan Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260416102609.7953-1-khai.wen.tan@intel.com Signed-off-by: Jakub Kicinski commit f996edd7615e686ada141b7f3395025729ff8ccb Author: Eric Dumazet Date: Thu Apr 16 10:35:05 2026 +0000 ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr when net_dbg_ratelimited() is called in the slow path. - Avoid potential future misuse after pskb_pull() call. Fixes: 4b3418fba0fe ("ipv6: icmp: include addresses in debug messages") Signed-off-by: Eric Dumazet Reviewed-by: Fernando Fernandez Mancera Reviewed-by: Joe Damato Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260416103505.2380753-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit dcf6d5e629db8f85bdea5c6c102f5bfd4b05bf44 Merge: 0916664f99381c aa3f7fe4093508 Author: Jakub Kicinski Date: Sat Apr 18 12:01:41 2026 -0700 Merge branch 'intel-wired-lan-driver-updates-2026-04-14-ice-i40e-iavf-idpf-e1000e' Jacob Keller says: ==================== Intel Wired LAN Driver Updates 2026-04-14 (ice, i40e, iavf, e1000e) Grzegorz updates the logic for adjusting the PTP hardware clock on E830, fixing a bug that prevented adjustments below S32_MAX/MIN nanoseconds. Grzegorz and Zoli update the PCS latency settings for E825 devices at 10GbE and 25GbE, improving the accuracy of timestamps based on data from production hardware. Michal Schmidt fixes a double-free that could happen if a particular error path is taken in ice_xmit_frame_ring(). Guangshuo fixes a double-free that could happen during error paths in the ice_sf_eth_activate() function. Paul Greenwalt fixes the PHY link configuration when the link-down-on-close driver parameter is enabled and new media is inserted. Paul Greenwalt fixes the ICE_AQ_LINK_SPEED_M macro for 200G, enabling 200G link speed advertisement. Keita Morisaki fixes a race condition in the ice Tx timestamp ring cleanup, preventing a possible NULL pointer dereference. Kohei Enju fixes a potential NULL pointer dereference in ice_set_ring_param(). Kohei Enju fixes i40e to stop advertising IFF_SUPP_NOFCS, when the driver does not actually support the feature. Petr fixes the VLAN L2TAG2 mask when the iAVF VF and a PF negotiate use of the legacy Rx descriptor format. Matt fixes the unrolling logic for PTP when the e1000e probe fails after the PTP clock has been registered. **A note to stable backports** The patches [7/12] ("ice: fix race condition in TX timestamp ring cleanup") and [8/12] ("ice: fix potential NULL pointer deref in error path of ice_set_ringparam()") must be backported together. Otherwise the fix in patch 8 will not work properly. ==================== Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-0-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit aa3f7fe409350857c25d050482a2eef2cfd69b58 Author: Matt Vollrath Date: Thu Apr 16 17:53:36 2026 -0700 e1000e: Unroll PTP in probe error handling If probe fails after registering the PTP clock and its delayed work, these resources must be released. This was not an issue until a 2016 fix moved the e1000e_ptp_init() call before the jump to err_register. Fixes: aa524b66c5ef ("e1000e: don't modify SYSTIM registers during SIOCSHWTSTAMP ioctl") Signed-off-by: Matt Vollrath Tested-by: Avigail Dahan Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-12-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit 496d9f91062fa07956702e0f234c5203f03a974d Author: Petr Oros Date: Thu Apr 16 17:53:34 2026 -0700 iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 The IAVF_RXD_LEGACY_L2TAG2_M mask was incorrectly defined as GENMASK_ULL(63, 32), extracting 32 bits from qw2 instead of the 16-bit VLAN tag. In the legacy Rx descriptor layout, the 2nd L2TAG2 (VLAN tag) occupies bits 63:48 of qw2, not 63:32. The oversized mask causes FIELD_GET to return a 32-bit value where the actual VLAN tag sits in bits 31:16. When this value is passed to iavf_receive_skb() as a u16 parameter, it gets truncated to the lower 16 bits (which contain the 1st L2TAG2, typically zero). As a result, __vlan_hwaccel_put_tag() is never called and software VLAN interfaces on VFs receive no traffic. This affects VFs behind ice PF (VIRTCHNL VLAN v2) when the PF advertises VLAN stripping into L2TAG2_2 and legacy descriptors are used. The flex descriptor path already uses the correct mask (IAVF_RXD_FLEX_L2TAG2_2_M = GENMASK_ULL(63, 48)). Reproducer: 1. Create 2 VFs on ice PF (echo 2 > sriov_numvfs) 2. Disable spoofchk on both VFs 3. Move each VF into a separate network namespace 4. On each VF: create VLAN interface (e.g. vlan 198), assign IP, bring up 5. Set rx-vlan-offload OFF on both VFs 6. Ping between VLAN interfaces -> expect PASS (VLAN tag stays in packet data, kernel matches in-band) 7. Set rx-vlan-offload ON on both VFs 8. Ping between VLAN interfaces -> expect FAIL if bug present (HW strips VLAN tag into descriptor L2TAG2 field, wrong mask extracts bits 47:32 instead of 63:48, truncated to u16 -> zero, __vlan_hwaccel_put_tag() never called, packet delivered to parent interface, not VLAN interface) The reproducer requires legacy Rx descriptors. On modern ice + iavf with full PTP support, flex descriptors are always negotiated and the buggy legacy path is never reached. Flex descriptors require all of: - CONFIG_PTP_1588_CLOCK enabled - VIRTCHNL_VF_OFFLOAD_RX_FLEX_DESC granted by PF - PTP capabilities negotiated (VIRTCHNL_VF_CAP_PTP) - VIRTCHNL_1588_PTP_CAP_RX_TSTAMP supported - VIRTCHNL_RXDID_2_FLEX_SQ_NIC present in DDP profile If any condition is not met, iavf_select_rx_desc_format() falls back to legacy descriptors (RXDID=1) and the wrong L2TAG2 mask is hit. Fixes: 2dc8e7c36d80 ("iavf: refactor iavf_clean_rx_irq to support legacy and flex descriptors") Signed-off-by: Petr Oros Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Reviewed-by: Jacob Keller Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-10-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit a24162f18825684ad04e3a5d0531f8a50d679347 Author: Kohei Enju Date: Thu Apr 16 17:53:33 2026 -0700 i40e: don't advertise IFF_SUPP_NOFCS i40e advertises IFF_SUPP_NOFCS, allowing users to use the SO_NOFCS socket option. However, this option is silently ignored, as the driver does not check skb->no_fcs, and always enables FCS insertion offload. Fix this by removing the advertisement of IFF_SUPP_NOFCS. This behavior can be reproduced with a simple AF_PACKET socket: import socket s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW) s.setsockopt(socket.SOL_SOCKET, 43, 1) # SO_NOFCS s.bind(("eth0", 0)) s.send(b'\xff' * 64) Previously, send() succeeds but the driver ignores SO_NOFCS. With this change, send() fails with -EPROTONOSUPPORT, as expected. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Tested-by: Sunitha Mekala Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-9-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit fa28351f970fa5138c7c5dedfe5dea480a0ee065 Author: Kohei Enju Date: Thu Apr 16 17:53:32 2026 -0700 ice: fix potential NULL pointer deref in error path of ice_set_ringparam() ice_set_ringparam nullifies tstamp_ring of temporary tx_rings, without clearing ICE_TX_RING_FLAGS_TXTIME bit. When ICE_TX_RING_FLAGS_TXTIME is set and the subsequent ice_setup_tx_ring() call fails, a NULL pointer dereference could happen in the unwinding sequence: ice_clean_tx_ring() -> ice_is_txtime_cfg() == true (ICE_TX_RING_FLAGS_TXTIME is set) -> ice_free_tx_tstamp_ring() -> ice_free_tstamp_ring() -> tstamp_ring->desc (NULL deref) Clear ICE_TX_RING_FLAGS_TXTIME bit to avoid the potential issue. Note that this potential issue is found by manual code review. Compile test only since unfortunately I don't have E830 devices. Fixes: ccde82e90946 ("ice: add E830 Earliest TxTime First Offload support") Signed-off-by: Kohei Enju Reviewed-by: Paul Greenwalt Tested-by: Rinitha S Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-8-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit 7c72ec18c2a4111204c2e915f8e4f6d849ce9398 Author: Keita Morisaki Date: Thu Apr 16 17:53:31 2026 -0700 ice: fix race condition in TX timestamp ring cleanup Fix a race condition between ice_free_tx_tstamp_ring() and ice_tx_map() that can cause a NULL pointer dereference. ice_free_tx_tstamp_ring currently clears the ICE_TX_FLAGS_TXTIME flag after NULLing the tstamp_ring. This could allow a concurrent ice_tx_map call on another CPU to dereference the tstamp_ring, which could lead to a NULL pointer dereference. CPU A:ice_free_tx_tstamp_ring() | CPU B:ice_tx_map() --------------------------------|--------------------------------- tx_ring->tstamp_ring = NULL | | ice_is_txtime_cfg() -> true | tstamp_ring = tx_ring->tstamp_ring | tstamp_ring->count // NULL deref! flags &= ~ICE_TX_FLAGS_TXTIME | Fix by: 1. Reordering ice_free_tx_tstamp_ring() to clear the flag before NULLing the pointer, with smp_wmb() to ensure proper ordering. 2. Adding smp_rmb() in ice_tx_map() after the flag check to order the flag read before the pointer read, using READ_ONCE() for the pointer, and adding a NULL check as a safety net. 3. Converting tx_ring->flags from u8 to DECLARE_BITMAP() and using atomic bitops (set_bit(), clear_bit(), test_bit()) for all flag operations throughout the driver: - ICE_TX_RING_FLAGS_XDP - ICE_TX_RING_FLAGS_VLAN_L2TAG1 - ICE_TX_RING_FLAGS_VLAN_L2TAG2 - ICE_TX_RING_FLAGS_TXTIME Fixes: ccde82e909467 ("ice: add E830 Earliest TxTime First Offload support") Signed-off-by: Keita Morisaki Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-7-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit 4a3a940059e98539de293a6e36e464094c2e875b Author: Paul Greenwalt Date: Thu Apr 16 17:53:30 2026 -0700 ice: fix ICE_AQ_LINK_SPEED_M for 200G When setting PHY configuration during driver initialization, 200G link speed is not being advertised even when the PHY is capable. This is because the get PHY capabilities link speed response is being masked by ICE_AQ_LINK_SPEED_M, which does not include the 200G link speed bit. ICE_AQ_LINK_SPEED_200GB is defined as BIT(11), but the mask 0x7FF only covers bits 0-10. Fix ICE_AQ_LINK_SPEED_M to use GENMASK(11, 0) so that it covers all defined link speed bits including 200G. Fixes: 24407a01e57c ("ice: Add 200G speed/phy type use") Signed-off-by: Paul Greenwalt Signed-off-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Sunitha Mekala Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-6-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit 55e74f9ea7fea3d3da1cb6d5cacdaf8cf0fe3516 Author: Paul Greenwalt Date: Thu Apr 16 17:53:29 2026 -0700 ice: fix PHY config on media change with link-down-on-close Commit 1a3571b5938c ("ice: restore PHY settings on media insertion") introduced separate flows for setting PHY configuration on media present: ice_configure_phy() when link-down-on-close is disabled, and ice_force_phys_link_state() when enabled. The latter incorrectly uses the previous configuration even after module change, causing link issues such as wrong speed or no link. Unify PHY configuration into a single ice_phy_cfg() function with a link_en parameter, ensuring PHY capabilities are always fetched fresh from hardware. Fixes: 1a3571b5938c ("ice: restore PHY settings on media insertion") Reviewed-by: Przemek Kitszel Signed-off-by: Paul Greenwalt Reviewed-by: Aleksandr Loktionov Tested-by: Sunitha Mekala Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-5-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit 1a303baa715e6b78d6a406aaf335f87ff35acfcd Author: Michal Schmidt Date: Thu Apr 16 17:53:28 2026 -0700 ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time. The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path. The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch. I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN. I looked for similar bugs in related Intel drivers and did not find any. Fixes: d76a60ba7afb ("ice: Add support for VLANs and offloads") Assisted-by: Claude:claude-4.6-opus-high Cursor Signed-off-by: Michal Schmidt Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-4-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit 9aab1c3d7299285e2569cbc0ed5892d631a241b2 Author: Guangshuo Li Date: Thu Apr 16 17:53:27 2026 -0700 ice: fix double free in ice_sf_eth_activate() error path When auxiliary_device_add() fails, ice_sf_eth_activate() jumps to aux_dev_uninit and calls auxiliary_device_uninit(&sf_dev->adev). The device release callback ice_sf_dev_release() frees sf_dev, but the current error path falls through to sf_dev_free and calls kfree(sf_dev) again, causing a double free. Keep kfree(sf_dev) for the auxiliary_device_init() failure path, but avoid falling through to sf_dev_free after auxiliary_device_uninit(). Fixes: 13acc5c4cdbe ("ice: subfunction activation and base devlink ops") Cc: stable@vger.kernel.org Reviewed-by: Aleksandr Loktionov Signed-off-by: Guangshuo Li Reviewed-by: Simon Horman Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-3-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit 05567e4052732d70c7ff9655217b3d14d25f639a Author: Grzegorz Nitka Date: Thu Apr 16 17:53:26 2026 -0700 ice: update PCS latency settings for E825 10G/25Gb modes Update MAC Rx/Tx offset registers settings (PHY_MAC_[RX|TX]_OFFSET registers) with the data obtained with the latest research. It applies to PCS latency settings for the following speeds/modes: * 10Gb NO-FEC - TX latency changed from 71.25 ns to 73 ns - RX latency changed from -25.6 ns to -28 ns * 25Gb NO-FEC - TX latency changed from 28.17 ns to 33 ns - RX latency changed from -12.45 ns to -12 ns * 25Gb RS-FEC - TX latency changed from 64.5 ns to 69 ns - RX latency changed from -3.6 ns to -3 ns The original data came from simulation and pre-production hardware. The new data measures the actual delays and as such is more accurate. Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") Co-developed-by: Zoltan Fodor Signed-off-by: Zoltan Fodor Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Signed-off-by: Grzegorz Nitka Tested-by: Sunitha Mekala Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-2-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit 885c5e57924dc040b23d0ad0d8388f0e35772159 Author: Grzegorz Nitka Date: Thu Apr 16 17:53:25 2026 -0700 ice: fix 'adjust' timer programming for E830 devices Fix incorrect 'adjust the timer' programming sequence for E830 devices series. Only shadow registers GLTSYN_SHADJ were programmed in the current implementation. According to the specification [1], write to command GLTSYN_CMD register is also required with CMD field set to "Adjust the Time" value, for the timer adjustment to take the effect. The flow was broken for the adjustment less than S32_MAX/MIN range (around +/- 2 seconds). For bigger adjustment, non-atomic programming flow is used, involving set timer programming. Non-atomic flow is implemented correctly. Testing hints: Run command: phc_ctl /dev/ptpX get adj 2 get Expected result: Returned timestamps differ at least by 2 seconds [1] Intel® Ethernet Controller E830 Datasheet rev 1.3, chapter 9.7.5.4 https://cdrdv2.intel.com/v1/dl/getContent/787353?explicitVersion=true Fixes: f00307522786 ("ice: Implement PTP support for E830 devices") Reviewed-by: Aleksandr Loktionov Signed-off-by: Grzegorz Nitka Reviewed-by: Simon Horman Tested-by: Rinitha S Reviewed-by: Jacob Keller Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-1-686c33c9828d@intel.com Signed-off-by: Jakub Kicinski commit 0916664f99381c0cecbf69d7951b2ca529b8fabb Merge: f3a0e90d4deb63 6c9b1dc218fea8 Author: Jakub Kicinski Date: Sat Apr 18 11:44:11 2026 -0700 Merge tag 'ovpn-net-20260417' of https://github.com/OpenVPN/ovpn-net-next Antonio Quartulli says: ==================== This batch includes only fixes to the selftest harness: * switch to TAP test orchestration * parse slurped notifications as returned by jq -s * add ovpn_ prefix to helpers and global variables to avoid clashes * fail test in case of netlink notification mismatch * add missing kernel config dependencies * add delay when launching multiple ynl/cli.py listeners * tag 'ovpn-net-20260417' of https://github.com/OpenVPN/ovpn-net-next: selftests: ovpn: serialize YNL listener startup selftests: ovpn: align command flow with TAP selftests: ovpn: add prefix to helpers and shared variables selftests: ovpn: flatten slurped notification JSON before filtering selftests: ovpn: fail notification check on mismatch selftests: ovpn: add nftables config dependencies for test-mark ==================== Link: https://patch.msgid.link/20260417090305.2775723-1-antonio@openvpn.net Signed-off-by: Jakub Kicinski commit eb5249b12507246dc959945454cd1be8d7dc3795 Merge: 9055c64567e9fc 707610bcccbd03 Author: Linus Torvalds Date: Sat Apr 18 11:37:36 2026 -0700 Merge tag 'parisc-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture updates from Helge Deller: - A fix to make modules on 32-bit parisc architecture work again - Drop ip_fast_csum() inline assembly to avoid unaligned memory accesses - Allow to build kernel without 32-bit VDSO - Reference leak fix in error path in LED driver * tag 'parisc-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: led: fix reference leak on failed device registration module.lds.S: Fix modules on 32-bit parisc architecture parisc: Allow to build without VDSO32 parisc: Include 32-bit VDSO only when building for 32-bit or compat mode parisc: Allow to disable COMPAT mode on 64-bit kernel parisc: Fix default stack size when COMPAT=n parisc: Fix signal code to depend on CONFIG_COMPAT instead of CONFIG_64BIT parisc: is_compat_task() shall return false for COMPAT=n parisc: Avoid compat syscalls when COMPAT=n parisc: _llseek syscall is only available for 32-bit userspace parisc: Drop ip_fast_csum() inline assembly implementation parisc: update outdated comments for renamed ccio_alloc_consistent() commit 9055c64567e9fc2a58d9382205bf3082f7bea141 Merge: fba676bd2919ce d5759519805c54 Author: Linus Torvalds Date: Sat Apr 18 11:29:14 2026 -0700 Merge tag 'memblock-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock updates from Mike Rapoport: - improve debuggability of reserve_mem kernel parameter handling with print outs in case of a failure and debugfs info showing what was actually reserved - Make memblock_free_late() and free_reserved_area() use the same core logic for freeing the memory to buddy and ensure it takes care of updating memblock arrays when ARCH_KEEP_MEMBLOCK is enabled. * tag 'memblock-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: x86/alternative: delay freeing of smp_locks section memblock: warn when freeing reserved memory before memory map is initialized memblock, treewide: make memblock_free() handle late freeing memblock: make free_reserved_area() update memblock if ARCH_KEEP_MEMBLOCK=y memblock: extract page freeing from free_reserved_area() into a helper memblock: make free_reserved_area() more robust mm: move free_reserved_area() to mm/memblock.c powerpc: opal-core: pair alloc_pages_exact() with free_pages_exact() powerpc: fadump: pair alloc_pages_exact() with free_pages_exact() memblock: reserve_mem: fix end caclulation in reserve_mem_release_by_name() memblock: move reserve_bootmem_range() to memblock.c and make it static memblock: Add reserve_mem debugfs info memblock: Print out errors on reserve_mem parser commit f3a0e90d4deb6386b90a9d5233028259c441cbc1 Merge: 82c21069028c5d 9e89b9d03a2d2e Author: Jakub Kicinski Date: Sat Apr 18 11:10:15 2026 -0700 Merge branch 'tcp-take-care-of-tcp_get_timestamping_opt_stats-races' Eric Dumazet says: ==================== tcp: take care of tcp_get_timestamping_opt_stats() races tcp_get_timestamping_opt_stats() does not own the socket lock, this is intentional. It calls tcp_get_info_chrono_stats() while other threads could change chrono fields in tcp_chrono_set(). It also reads many tcp socket fields that can be modified by other cpus/threads. I do not think we need coherent TCP socket state snapshot in tcp_get_timestamping_opt_stats(). Add READ_ONCE()/WRITE_ONCE() or data_race() annotations. Note that icsk_ca_state is a bitfield, thus not covered in this series. ==================== Link: https://patch.msgid.link/20260416200319.3608680-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6e937f4e769e60947909e3525965f0137b9039e8 Author: Wolfram Sang Date: Fri Apr 17 09:42:36 2026 +0200 mailbox: mailbox-test: make data_ready a per-instance variable While not the default case, multiple tests can be run simultaneously. Then, data_ready being a global variable will be overwritten and the per-instance lock will not help. Turn the global variable into a per-instance one to avoid this problem. Fixes: e339c80af95e ("mailbox: mailbox-test: don't rely on rx_buffer content to signal data ready") Signed-off-by: Wolfram Sang Signed-off-by: Jassi Brar commit 9e89b9d03a2d2e30dcca166d5af52f9a8eceab25 Author: Eric Dumazet Date: Thu Apr 16 20:03:19 2026 +0000 tcp: annotate data-races around tp->plb_rehash tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() and WRITE_ONCE() annotations to keep KCSAN happy. Fixes: 29c1c44646ae ("tcp: add u32 counter in tcp_sock and an SNMP counter for PLB") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-15-edumazet@google.com Signed-off-by: Jakub Kicinski commit bbcf9af68bfedb3d9cc3c7eae62f5c844d8b78b9 Author: Wolfram Sang Date: Fri Apr 17 09:42:35 2026 +0200 mailbox: mailbox-test: initialize struct earlier The waitqueue must be initialized before the debugfs files are created because from that time, requests from userspace can already be made. Similarily, drvdata and spinlock needs to be initialized before we request the channel, otherwise dangling irqs might run into problems like a NULL pointer exception. Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers") Signed-off-by: Wolfram Sang Signed-off-by: Jassi Brar commit 88ebadbf0deefdaccdab868b44ff70a0a257f473 Author: Wolfram Sang Date: Fri Apr 17 09:42:34 2026 +0200 mailbox: mailbox-test: don't free the reused channel The RX channel can be aliased to the TX channel if it has a different MMIO. This special case needs to be handled when freeing the channels otherwise a double-free occurs. Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers") Signed-off-by: Wolfram Sang Signed-off-by: Jassi Brar commit dd9aa1f269000d679f4ec12b32abacfc8d921413 Author: Wolfram Sang Date: Fri Apr 17 09:42:33 2026 +0200 mailbox: mailbox-test: handle channel errors consistently mbox_test_request_channel() returns either an ERR_PTR or NULL. The callers, however, mostly checked for non-NULL which allows for bogus code paths when an ERR_PTR is treated like a valid channel. A later commit tried to fix it in one place but missed the other ones. Because the ERR_PTR is only used for -ENOMEM once and is converted to -EPROBE_DEFER anyhow, convert the callee to only return NULL which simplifies handling a lot and makes it less error prone. Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers") Fixes: 9b63a810c6f9 ("mailbox: mailbox-test: Fix an error check in mbox_test_probe()") Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Signed-off-by: Jassi Brar commit 3a63b3d160560ef51e43fb4c880a5cde8078053c Author: Eric Dumazet Date: Thu Apr 16 20:03:18 2026 +0000 tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() annotations to keep KCSAN happy. WRITE_ONCE() annotations are already present. Fixes: e08ab0b377a1 ("tcp: add bytes not sent to SCM_TIMESTAMPING_OPT_STATS") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-14-edumazet@google.com Signed-off-by: Jakub Kicinski commit 71c675358b711bbfd8528949249419dc2dfa4ce1 Author: Eric Dumazet Date: Thu Apr 16 20:03:17 2026 +0000 tcp: annotate data-races around tp->timeout_rehash tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() and WRITE_ONCE() annotations to keep KCSAN happy. Fixes: 32efcc06d2a1 ("tcp: export count for rehash attempts") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-13-edumazet@google.com Signed-off-by: Jakub Kicinski commit 290b693ce7c9d48588d88b15a782a3efc6fa036b Author: Eric Dumazet Date: Thu Apr 16 20:03:16 2026 +0000 tcp: annotate data-races around tp->srtt_us tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() and WRITE_ONCE() annotations to keep KCSAN happy. Fixes: e8bd8fca6773 ("tcp: add SRTT to SCM_TIMESTAMPING_OPT_STATS") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-12-edumazet@google.com Signed-off-by: Jakub Kicinski commit 62585690e6b2a112c408fe25f142b246ac833c42 Author: Eric Dumazet Date: Thu Apr 16 20:03:15 2026 +0000 tcp: annotate data-races around tp->reord_seen tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() and WRITE_ONCE() annotations to keep KCSAN happy. Fixes: 7ec65372ca53 ("tcp: add stat of data packet reordering events") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-11-edumazet@google.com Signed-off-by: Jakub Kicinski commit a984705ca88b976bf1087978fd98b7f3993da88c Author: Eric Dumazet Date: Thu Apr 16 20:03:14 2026 +0000 tcp: annotate data-races around tp->dsack_dups tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() and WRITE_ONCE() annotations to keep KCSAN happy. Fixes: 7e10b6554ff2 ("tcp: add dsack blocks received stats") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-10-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5efc7b9f7cbd43401f1af81d3d7f2be00f93390d Author: Eric Dumazet Date: Thu Apr 16 20:03:13 2026 +0000 tcp: annotate data-races around tp->bytes_retrans tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() and WRITE_ONCE() annotations to keep KCSAN happy. Fixes: fb31c9b9f6c8 ("tcp: add data bytes retransmitted stats") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-9-edumazet@google.com Signed-off-by: Jakub Kicinski commit ee43e957ce2ec77b2ec47fef28f3c0df6ab01a31 Author: Eric Dumazet Date: Thu Apr 16 20:03:12 2026 +0000 tcp: annotate data-races around tp->bytes_sent tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() and WRITE_ONCE() annotations to keep KCSAN happy. Fixes: ba113c3aa79a ("tcp: add data bytes sent stats") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit 124199444de467767175a9004e1574dc42523e62 Author: Eric Dumazet Date: Thu Apr 16 20:03:11 2026 +0000 tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() and WRITE_ONCE() annotations to keep KCSAN happy. Fixes: 87ecc95d81d9 ("tcp: add send queue size stat in SCM_TIMESTAMPING_OPT_STATS") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit faa886ad3ce5fc8f5156493491fe189b2b726bc9 Author: Eric Dumazet Date: Thu Apr 16 20:03:10 2026 +0000 tcp: annotate data-races around tp->delivered and tp->delivered_ce tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() and WRITE_ONCE() annotations to keep KCSAN happy. Fixes: feb5f2ec6464 ("tcp: export packets delivery info") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit fd571afb05ebaeac5d8f09460a0640d4cf6755f8 Author: Eric Dumazet Date: Thu Apr 16 20:03:09 2026 +0000 tcp: annotate data-races around tp->snd_ssthresh tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() and WRITE_ONCE() annotations to keep KCSAN happy. Fixes: 7156d194a077 ("tcp: add snd_ssthresh stat in SCM_TIMESTAMPING_OPT_STATS") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 829ba1f329cb7cbd56d599a6d225997fba66dc32 Author: Eric Dumazet Date: Thu Apr 16 20:03:08 2026 +0000 tcp: add data-races annotations around tp->reordering, tp->snd_cwnd tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE(), WRITE_ONCE() data_race() annotations to keep KCSAN happy. Fixes: bb7c19f96012 ("tcp: add related fields into SCM_TIMESTAMPING_OPT_STATS") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 21e92a38cfd891538598ba8f805e0165a820d532 Author: Eric Dumazet Date: Thu Apr 16 20:03:07 2026 +0000 tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans tcp_get_timestamping_opt_stats() intentionally runs lockless, we must add READ_ONCE() and WRITE_ONCE() annotations to keep KCSAN happy. Fixes: 7e98102f4897 ("tcp: record pkts sent and retransmistted") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 267bf3cf9a6f0ffb98b8afd983c1950e835f07c9 Author: Eric Dumazet Date: Thu Apr 16 20:03:06 2026 +0000 tcp: annotate data-races in tcp_get_info_chrono_stats() tcp_get_timestamping_opt_stats() does not own the socket lock, this is intentional. It calls tcp_get_info_chrono_stats() while other threads could change chrono fields in tcp_chrono_set(). I do not think we need coherent TCP socket state snapshot in tcp_get_timestamping_opt_stats(), I chose to only add annotations to keep KCSAN happy. Fixes: 1c885808e456 ("tcp: SOF_TIMESTAMPING_OPT_STATS option for SO_TIMESTAMPING") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260416200319.3608680-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit a068c4d42c035c63b26ff91c394e6dc2cb7dc5d0 Author: Wolfram Sang Date: Mon Apr 13 12:42:39 2026 +0200 mailbox: update kdoc for struct mbox_controller Add field for missing lock around the hrtimer. Add 'Required' where the core checks for valid entries. Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Signed-off-by: Jassi Brar commit c1aad75595fb67edc7fda8af249d3b886efa1be9 Author: Wolfram Sang Date: Mon Apr 13 12:42:38 2026 +0200 mailbox: add sanity check for channel array Fail gracefully if there is no channel array attached to the mailbox controller. Otherwise the later dereference will cause an OOPS which might not be seen because mailbox controllers might instantiate very early. Remove the comment explaining the obvious while here. Fixes: 2b6d83e2b8b7 ("mailbox: Introduce framework for mailbox") Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Signed-off-by: Jassi Brar commit 30010c952077a1c89ecdd71fc4d574c75a8f5617 Author: Tristan Madani Date: Fri Apr 17 19:33:17 2026 +0000 ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f ("ksmbd: fix potencial OOB in get_file_all_info() for compound requests") and commit fda9522ed6af ("ksmbd: fix OOB write in QUERY_INFO for compound requests"), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers. Cc: stable@vger.kernel.org Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound") Signed-off-by: Tristan Madani Acked-by: Namjae Jeon Signed-off-by: Steve French commit 299f962c0b02d048fb45d248b4da493d03f3175d Author: Tristan Madani Date: Fri Apr 17 19:54:57 2026 +0000 ksmbd: use check_add_overflow() to prevent u16 DACL size overflow set_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes in u16 variables. When a file has many POSIX ACL entries, the accumulated size can wrap past 65535, causing the pointer arithmetic (char *)pndace + *size to land within already-written ACEs. Subsequent writes then overwrite earlier entries, and pndacl->size gets a truncated value. Use check_add_overflow() at each accumulation point to detect the wrap before it corrupts the buffer, consistent with existing check_mul_overflow() usage elsewhere in smbacl.c. Cc: stable@vger.kernel.org Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: Tristan Madani Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1baff47b81f94f9231c91236aa511420d0e266b9 Author: Akif Date: Fri Apr 17 23:57:09 2026 +0530 ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor early during the durable reconnect process. If an error occurs subsequently (eg, ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, it leads to a use-after-free when accessing fp properties (eg fp->create_time). Move the single put to the end of the function below err_out2 so fp stays valid until smb2_open returns. Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2") Signed-off-by: Akif Acked-by: Namjae Jeon Signed-off-by: Steve French commit 3e4e2ea2a781018ed5d75f969e3e5606beb66e48 Author: Michael Bommarito Date: Fri Apr 17 14:45:57 2026 -0400 ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() smb_inherit_dacl() trusts the on-disk num_aces value from the parent directory's DACL xattr and uses it to size a heap allocation: aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...); num_aces is a u16 read from le16_to_cpu(parent_pdacl->num_aces) without checking that it is consistent with the declared pdacl_size. An authenticated client whose parent directory's security.NTACL is tampered (e.g. via offline xattr corruption or a concurrent path that bypasses parse_dacl()) can present num_aces = 65535 with minimal actual ACE data. This causes a ~8 MB allocation (not kzalloc, so uninitialized) that the subsequent loop only partially populates, and may also overflow the three-way size_t multiply on 32-bit kernels. Additionally, the ACE walk loop uses the weaker offsetof(struct smb_ace, access_req) minimum size check rather than the minimum valid on-wire ACE size, and does not reject ACEs whose declared size is below the minimum. Reproduced on UML + KASAN + LOCKDEP against the real ksmbd code path. A legitimate mount.cifs client creates a parent directory over SMB (ksmbd writes a valid security.NTACL xattr), then the NTACL blob on the backing filesystem is rewritten to set num_aces = 0xFFFF while keeping the posix_acl_hash bytes intact so ksmbd_vfs_get_sd_xattr()'s hash check still passes. A subsequent SMB2 CREATE of a child under that parent drives smb2_open() into smb_inherit_dacl() (share has "vfs objects = acl_xattr" set), which fails the page allocator: WARNING: mm/page_alloc.c:5226 at __alloc_frozen_pages_noprof+0x46c/0x9c0 Workqueue: ksmbd-io handle_ksmbd_work __alloc_frozen_pages_noprof+0x46c/0x9c0 ___kmalloc_large_node+0x68/0x130 __kmalloc_large_node_noprof+0x24/0x70 __kmalloc_noprof+0x4c9/0x690 smb_inherit_dacl+0x394/0x2430 smb2_open+0x595d/0xabe0 handle_ksmbd_work+0x3d3/0x1140 With the patch applied the added guard rejects the tampered value with -EINVAL before any large allocation runs, smb2_open() falls back to smb2_create_sd_buffer(), and the child is created with a default SD. No warning, no splat. Fix by: 1. Validating num_aces against pdacl_size using the same formula applied in parse_dacl(). 2. Replacing the raw kmalloc(sizeof * num_aces * 2) with kmalloc_array(num_aces * 2, sizeof(...)) for overflow-safe allocation. 3. Tightening the per-ACE loop guard to require the minimum valid ACE size (offsetof(smb_ace, sid) + CIFS_SID_BASE_SIZE) and rejecting under-sized ACEs, matching the hardening in smb_check_perm_dacl() and parse_dacl(). v1 -> v2: - Replace the synthetic test-module splat in the changelog with a real-path UML + KASAN reproduction driven through mount.cifs and SMB2 CREATE; Namjae flagged the kcifs3_test_inherit_dacl_old name in v1 since it does not exist in ksmbd. - Drop the commit-hash citation from the code comment per Namjae's review; keep the parse_dacl() pointer. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Michael Bommarito Acked-by: Namjae Jeon Signed-off-by: Steve French commit ce23158bfe584bd90d1918f279fdf9de57802012 Author: DaeMyung Kang Date: Fri Apr 17 06:17:35 2026 +0900 smb: server: fix max_connections off-by-one in tcp accept path The global max_connections check in ksmbd's TCP accept path counts the newly accepted connection with atomic_inc_return(), but then rejects the connection when the result is greater than or equal to server_conf.max_connections. That makes the effective limit one smaller than configured. For example: - max_connections=1 rejects the first connection - max_connections=2 allows only one connection The per-IP limit in the same function uses <= correctly because it counts only pre-existing connections. The global limit instead checks the post-increment total, so it should reject only when that total exceeds the configured maximum. Fix this by changing the comparison from >= to >, so exactly max_connections simultaneous connections are allowed and the next one is rejected. This matches the documented meaning of max_connections in fs/smb/server/ksmbd_netlink.h as the "Number of maximum simultaneous connections". Fixes: 0d0d4680db22 ("ksmbd: add max connections parameter") Cc: stable@vger.kernel.org Signed-off-by: DaeMyung Kang Acked-by: Namjae Jeon Signed-off-by: Steve French commit d07b26f39246a82399661936dd0c853983cfade7 Author: Michael Bommarito Date: Tue Apr 14 15:15:33 2026 -0400 ksmbd: require minimum ACE size in smb_check_perm_dacl() Both ACE-walk loops in smb_check_perm_dacl() only guard against an under-sized remaining buffer, not against an ACE whose declared `ace->size` is smaller than the struct it claims to describe: if (offsetof(struct smb_ace, access_req) > aces_size) break; ace_size = le16_to_cpu(ace->size); if (ace_size > aces_size) break; The first check only requires the 4-byte ACE header to be in bounds; it does not require access_req (4 bytes at offset 4) to be readable. An attacker who has set a crafted DACL on a file they own can declare ace->size == 4 with aces_size == 4, pass both checks, and then granted |= le32_to_cpu(ace->access_req); /* upper loop */ compare_sids(&sid, &ace->sid); /* lower loop */ reads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid at offset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES * 4 bytes). Tighten both loops to require ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE which is the smallest valid on-wire ACE layout (4-byte header + 4-byte access_req + 8-byte sid base with zero sub-auths). Also reject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES before letting compare_sids() dereference sub_auth[] entries. parse_sec_desc() already enforces an equivalent check (lines 441-448); smb_check_perm_dacl() simply grew weaker validation over time. Reachability: authenticated SMB client with permission to set an ACL on a file. On a subsequent CREATE against that file, the kernel walks the stored DACL via smb_check_perm_dacl() and triggers the OOB read. Not pre-auth, and the OOB read is not reflected to the attacker, but KASAN reports and kernel state corruption are possible. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Acked-by: Namjae Jeon Signed-off-by: Steve French commit d6a6aa81eac2c9bff66dc6e191179cb69a14426b Author: Michael Bommarito Date: Wed Apr 15 07:25:00 2026 -0400 ksmbd: validate response sizes in ipc_validate_msg() ipc_validate_msg() computes the expected message size for each response type by adding (or multiplying) attacker-controlled fields from the daemon response to a fixed struct size in unsigned int arithmetic. Three cases can overflow: KSMBD_EVENT_RPC_REQUEST: msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz; KSMBD_EVENT_SHARE_CONFIG_REQUEST: msg_sz = sizeof(struct ksmbd_share_config_response) + resp->payload_sz; KSMBD_EVENT_LOGIN_REQUEST_EXT: msg_sz = sizeof(struct ksmbd_login_response_ext) + resp->ngroups * sizeof(gid_t); resp->payload_sz is __u32 and resp->ngroups is __s32. Each addition can wrap in unsigned int; the multiplication by sizeof(gid_t) mixes signed and size_t, so a negative ngroups is converted to SIZE_MAX before the multiply. A wrapped value of msg_sz that happens to equal entry->msg_sz bypasses the size check on the next line, and downstream consumers (smb2pdu.c:6742 memcpy using rpc_resp->payload_sz, kmemdup in ksmbd_alloc_user using resp_ext->ngroups) then trust the unverified length. Use check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST paths to detect integer overflow without constraining functional payload size; userspace ksmbd-tools grows NDR responses in 4096-byte chunks for calls like NetShareEnumAll, so a hard transport cap is unworkable on the response side. For LOGIN_REQUEST_EXT, reject resp->ngroups outside the signed [0, NGROUPS_MAX] range up front and report the error from ipc_validate_msg() so it fires at the IPC boundary; with that bound the subsequent multiplication and addition stay well below UINT_MAX. The now-redundant ngroups check and pr_err in ksmbd_alloc_user() are removed. This is the response-side analogue of aab98e2dbd64 ("ksmbd: fix integer overflows on 32 bit systems"), which hardened the request side. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Fixes: a77e0e02af1c ("ksmbd: add support for supplementary groups") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6551300dc452ac16a855a83dbd1e74899542d3b3 Author: Michael Bommarito Date: Tue Apr 14 18:54:38 2026 -0400 smb: server: fix active_num_conn leak on transport allocation failure Commit 77ffbcac4e56 ("smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()") addressed the kthread_run() failure path. The earlier alloc_transport() == NULL path in the same function has the same leak, is reachable pre-authentication via any TCP connect to port 445, and was empirically reproduced on UML (ARCH=um, v7.0-rc7): a small number of forced allocation failures were sufficient to put ksmbd into a state where every subsequent connection attempt was rejected for the remainder of the boot. ksmbd_kthread_fn() increments active_num_conn before calling ksmbd_tcp_new_connection() and discards the return value, so when alloc_transport() returns NULL the socket is released and -ENOMEM returned without decrementing the counter. Each such failure permanently consumes one slot from the max_connections pool; once cumulative failures reach the cap, atomic_inc_return() hits the threshold on every subsequent accept and every new connection is rejected. The counter is only reset by module reload. An unauthenticated remote attacker can drive the server toward the memory pressure that makes alloc_transport() fail by holding open connections with large RFC1002 lengths up to MAX_STREAM_PROT_LEN (0x00FFFFFF); natural transient allocation failures on a loaded host produce the same drift more slowly. Mirror the existing rollback pattern in ksmbd_kthread_fn(): on the alloc_transport() failure path, decrement active_num_conn gated on server_conf.max_connections. Repro details: with the patch reverted, forced alloc_transport() NULL returns leaked counter slots and subsequent connection attempts -- including legitimate connects issued after the forced-fail window had closed -- were all rejected with "Limit the maximum number of connections". With this patch applied, the same connect sequence produces no rejections and the counter cycles cleanly between zero and one on every accept. Fixes: 0d0d4680db22 ("ksmbd: add max connections parameter") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Acked-by: Namjae Jeon Signed-off-by: Steve French commit fba676bd2919ceff5a678c0bd05ab3ac89affaeb Merge: 1e769656963e03 e336aa3c396ba4 Author: Linus Torvalds Date: Sat Apr 18 09:44:22 2026 -0700 Merge tag 'i2c-for-7.1-rc1-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "The biggest news in this pull request is that it will start the last cycle of me handling the I2C subsystem. From 7.2. on, I will pass maintainership to Andi Shyti who has been maintaining the I2C drivers for a while now and who has done a great job in doing so. We will use this cycle for a hopefully smooth transition. Thanks must go to Andi for stepping up! I will still be around for guidance. Updates: - generic cleanups in npcm7xx, qcom-cci, xiic and designware DT bindings - atr: use kzalloc_flex for alias pool allocation - ixp4xx: convert bindings to DT schema - ocores: use read_poll_timeout_atomic() for polling waits - qcom-geni: skip extra TX DMA TRE for single read messages - s3c24xx: validate SMBus block length before using it - spacemit: refactor xfer path and add K1 PIO support - tegra: identify DVC and VI with SoC data variants - tegra: support SoC-specific register offsets - xiic: switch to devres and generic fw properties - xiic: skip input clock setup on non-OF systems - various minor improvements in other drivers rtl9300: - add per-SoC callbacks and clock support for RTL9607C - add support for new 50 kHz and 2.5 MHz bus speeds - general refactoring in preparation for RTL9607C support New support: - DesignWare GOOG5000 (ACPI HID) - Intel Nova Lake (ACPI ID) - Realtek RTL9607C - SpacemiT K3 binding - Tegra410 register layout support" * tag 'i2c-for-7.1-rc1-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (40 commits) i2c: usbio: Add ACPI device-id for NVL platforms i2c: qcom-geni: Avoid extra TX DMA TRE for single read message in GPI mode i2c: atr: use kzalloc_flex i2c: spacemit: introduce pio for k1 i2c: spacemit: move i2c_xfer_msg() i2c: xiic: skip input clock setup on non-OF systems i2c: xiic: use numbered adapter registration i2c: xiic: cosmetic: use resource format specifier in debug log i2c: xiic: cosmetic cleanup i2c: xiic: switch to generic device property accessors i2c: xiic: remove duplicate error message i2c: xiic: switch to devres managed APIs i2c: rtl9300: add RTL9607C i2c controller support i2c: rtl9300: introduce new function properties to driver data i2c: rtl9300: introduce clk struct for upcoming rtl9607 support dt-bindings: i2c: realtek,rtl9301-i2c: extend for clocks and RTL9607C support i2c: rtl9300: introduce a property for 8 bit width reg address i2c: rtl9300: introduce F_BUSY to the reg_fields struct i2c: rtl9300: introduce max length property to driver data i2c: rtl9300: split data_reg into read and write reg ... commit 1e769656963e0329b91d32ec76955e077966b603 Merge: df8f6181ab57d6 75c486cb1bcaa1 Author: Linus Torvalds Date: Sat Apr 18 09:33:54 2026 -0700 Merge tag 'for-linus-7.1-1' of https://github.com/cminyard/linux-ipmi Pull ipmi updates from Corey Minyard: "Small updates and fixes (mostly to the BMC software): - Fix one issue in the host side driver where a kthread can be left running on a specific memory allocation failre at probe time - Replace system_wq with system_percpu_wq so system_wq can eventually go away" * tag 'for-linus-7.1-1' of https://github.com/cminyard/linux-ipmi: ipmi:ssif: Clean up kthread on errors ipmi:ssif: Remove unnecessary indention ipmi: ssif_bmc: Fix KUnit test link failure when KUNIT=m ipmi: ssif_bmc: add unit test for state machine ipmi: ssif_bmc: change log level to dbg in irq callback ipmi: ssif_bmc: fix message desynchronization after truncated response ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure ipmi: ssif_bmc: cancel response timer on remove ipmi: Replace use of system_wq with system_percpu_wq commit df8f6181ab57d65a99e61fcfc5be22a42df58642 Merge: 8541d8f725c673 9a683fe0a00d26 Author: Linus Torvalds Date: Sat Apr 18 09:24:56 2026 -0700 Merge tag 'perf-tools-for-v7.1-2026-04-17' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools updates from Namhyung Kim: "perf report: - Add 'comm_nodigit' sort key to combine similar threads that only have different numbers in the comm. In the following example, the 'comm_nodigit' will have samples from all threads starting with "bpfrb/" into an entry "bpfrb/". $ perf report -s comm_nodigit,comm -H ... # # Overhead CommandNoDigit / Command # ........... ........................ # 20.30% swapper 20.30% swapper 13.37% chrome 13.37% chrome 10.07% bpfrb/ 7.47% bpfrb/0 0.70% bpfrb/1 0.47% bpfrb/3 0.46% bpfrb/2 0.25% bpfrb/4 0.23% bpfrb/5 0.20% bpfrb/6 0.14% bpfrb/10 0.07% bpfrb/7 - Support flat layout for symfs. The --symfs option is to specify the location of debugging symbol files. The default 'hierarchy' layout would search the symbol file using the same path of the original file under the symfs root. The new 'flat' layout would search only in the root directory. - Update 'simd' sort key for ARM SIMD flags to cover ASE/SME and more predicate flags. perf stat: - Add --pmu-filter option to select specific PMUs. This would be useful when you measure metrics from multiple instance of uncore PMUs with similar names. # perf stat -M cpa_p0_avg_bw Performance counter stats for 'system wide': 19,417,779,115 hisi_sicl0_cpa0/cpa_cycles/ # 0.00 cpa_p0_avg_bw 0 hisi_sicl0_cpa0/cpa_p0_wr_dat/ 0 hisi_sicl0_cpa0/cpa_p0_rd_dat_64b/ 0 hisi_sicl0_cpa0/cpa_p0_rd_dat_32b/ 19,417,751,103 hisi_sicl10_cpa0/cpa_cycles/ # 0.00 cpa_p0_avg_bw 0 hisi_sicl10_cpa0/cpa_p0_wr_dat/ 0 hisi_sicl10_cpa0/cpa_p0_rd_dat_64b/ 0 hisi_sicl10_cpa0/cpa_p0_rd_dat_32b/ 19,417,730,679 hisi_sicl2_cpa0/cpa_cycles/ # 0.31 cpa_p0_avg_bw 75,635,749 hisi_sicl2_cpa0/cpa_p0_wr_dat/ 18,520,640 hisi_sicl2_cpa0/cpa_p0_rd_dat_64b/ 0 hisi_sicl2_cpa0/cpa_p0_rd_dat_32b/ 19,417,674,227 hisi_sicl8_cpa0/cpa_cycles/ # 0.00 cpa_p0_avg_bw 0 hisi_sicl8_cpa0/cpa_p0_wr_dat/ 0 hisi_sicl8_cpa0/cpa_p0_rd_dat_64b/ 0 hisi_sicl8_cpa0/cpa_p0_rd_dat_32b/ 19.417734480 seconds time elapsed With --pmu-filter, users can select only hisi_sicl2_cpa0 PMU. # perf stat --pmu-filter hisi_sicl2_cpa0 -M cpa_p0_avg_bw Performance counter stats for 'system wide': 6,234,093,559 cpa_cycles # 0.60 cpa_p0_avg_bw 50,548,465 cpa_p0_wr_dat 7,552,182 cpa_p0_rd_dat_64b 0 cpa_p0_rd_dat_32b 6.234139320 seconds time elapsed Data type profiling: - Quality improvements by tracking register state more precisely - Ensure array members to get the type - Handle more cases for global variables Vendor event/metric updates: - Update various Intel events and metrics - Add NVIDIA Tegra 410 Olympus events Internal changes: - Verify perf.data header for maliciously crafted files - Update perf test to cover more usages and make them robust - Move a couple of copied kernel headers not to annoy objtool build - Fix a bug in map sorting in name order - Remove some unused codes Misc: - Fix module symbol resolution with non-zero text address - Add -t/--threads option to `perf bench mem mmap` - Track duration of exit*() syscall by `perf trace -s` - Add core.addr2line-timeout and core.addr2line-disable-warn config items" * tag 'perf-tools-for-v7.1-2026-04-17' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (131 commits) perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND perf annotate: Use jump__delete when freeing LoongArch jumps perf test: Fixes for check branch stack sampling perf test: Fix inet_pton probe failure and unroll call graph perf build: fix "argument list too long" in second location perf header: Add sanity checks to HEADER_BPF_BTF processing perf header: Sanity check HEADER_BPF_PROG_INFO perf header: Sanity check HEADER_PMU_CAPS perf header: Sanity check HEADER_HYBRID_TOPOLOGY perf header: Sanity check HEADER_CACHE perf header: Sanity check HEADER_GROUP_DESC perf header: Sanity check HEADER_PMU_MAPPINGS perf header: Sanity check HEADER_MEM_TOPOLOGY perf header: Sanity check HEADER_NUMA_TOPOLOGY perf header: Sanity check HEADER_CPU_TOPOLOGY perf header: Sanity check HEADER_NRCPUS and HEADER_CPU_DOMAIN_INFO perf header: Bump up the max number of command line args allowed perf header: Validate nr_domains when reading HEADER_CPU_DOMAIN_INFO perf sample: Fix documentation typo perf arm_spe: Improve SIMD flags setting ... commit 647b43f65357673a9ee4fe8a99247a7549bdb368 Author: Thomas Zimmermann Date: Wed Apr 1 10:32:34 2026 +0200 sh: Drop CONFIG_FIRMWARE_EDID from defconfig files CONFIG_FIRMWARE_EDID=y depends on X86 or EFI_GENERIC_STUB. Neither is true here, so drop the lines from the defconfig files. Signed-off-by: Thomas Zimmermann Reviewed-by: John Paul Adrian Glaubitz Reviewed-by: Geert Uytterhoeven Signed-off-by: John Paul Adrian Glaubitz commit 44ab0a3ee21830178a289de8d713225bedc319ef Author: Thomas Weißschuh Date: Tue Feb 24 16:35:31 2026 +0100 sh: Remove CONFIG_VSYSCALL reference from UAPI AT_SYSINFO_EHDR defines the auxvector index representing the vDSO entrypoint. Its value or presence does not depend on whether a vDSO is actually provided by the kernel. The definition of AT_SYSINFO_EHDR was gated between CONFIG_VSYSCALL to avoid a default gate VMA to be created. However that default gate VMA was removed entirely in commit a6c19dfe3994 ("arm64,ia64,ppc,s390,sh,tile,um,x86,mm: remove default gate area"). Remove the now unnecessary conditional. Signed-off-by: Thomas Weißschuh Reviewed-by: John Paul Adrian Glaubitz Signed-off-by: John Paul Adrian Glaubitz commit 222717d642ca98f6e72107621ab37d1aa4f26966 Author: Tim Bird Date: Thu Feb 12 12:28:45 2026 -0700 sh: Fix typo in SPDX license ID lines Both platform_early.c and platform_early.h have an extra dash in their SPDX-License-Identifier lines. Use the correct (single-dash) syntax for these lines. Signed-off-by: Tim Bird Reviewed-by: John Paul Adrian Glaubitz Reviewed-by: Geert Uytterhoeven Reviewed-by: Greg Kroah-Hartman Signed-off-by: John Paul Adrian Glaubitz commit 57b3ec396dd898aadc073bb16f3d05ee64b2c8af Author: Thomas Zimmermann Date: Tue Oct 28 18:07:55 2025 +0100 sh: Include in dac.h Include to avoid depending on for including it. Declares __raw_readb() and __raw_writeb(). Signed-off-by: Thomas Zimmermann Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510282206.wI0HrqcK-lkp@intel.com/ Fixes: 243ce64b2b37 ("backlight: Do not include in header file") Cc: Thomas Zimmermann Cc: Daniel Thompson (RISCstar) Cc: Simona Vetter Cc: Lee Jones Cc: Daniel Thompson Cc: Jingoo Han Cc: dri-devel@lists.freedesktop.org Reviewed-by: John Paul Adrian Glaubitz Reviewed-by: Daniel Thompson (RISCstar) Signed-off-by: John Paul Adrian Glaubitz commit f05799491d6a2a29d8e15f4451e685c4a6e13d8f Author: Marc Zyngier Date: Tue Apr 14 17:05:28 2026 +0100 KVM: arm64: pkvm: Adopt MARKER() to define host hypercall ranges The EL2 code defines ranges of host hypercalls that are either enabled at boot-time only, used by [nh]VHE KVM, or reserved to pKVM. The way these ranges are delineated is error prone, as the enum symbols defining the limits are expressed in terms of actual function symbols. This means that should a new function be added, special care must be taken to also update the limit symbol. Improve this by reusing the mechanism introduced for the vcpu_sysreg enum, which uses a MARKER() macro and some extra trickery to make the limit symbol standalone. Crucially, the limit symbol has the same value as the *following* symbol. The handle_host_hcall() function is then updated to make use of the new limit definitions and get rid of the brittle default upper limit. This allows for some more strict checks at build time, and the removal of an comparison at run time. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Link: https://patch.msgid.link/20260414160528.2218858-1-maz@kernel.org Signed-off-by: Marc Zyngier commit 0b5e8d7999076ac3c490fc18376a404e2626abff Author: Jan Kara Date: Wed Apr 15 19:40:40 2026 +0200 MAINTAINERS: add page cache reviewer Add myself as a page cache reviewer since I tend to review changes in these areas anyway. [akpm@linux-foundation.org: add linux-mm@kvack.org] Link: https://lore.kernel.org/20260415174039.13016-2-jack@suse.cz Signed-off-by: Jan Kara Acked-by: Matthew Wilcox (Oracle) Acked-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 3de705a43a465fa92a45c0a494ec13bf0bad2642 Author: Arnd Bergmann Date: Tue Apr 14 08:51:58 2026 +0200 mm/vmscan: avoid false-positive -Wuninitialized warning When the -fsanitize=bounds sanitizer is enabled, gcc-16 sometimes runs into a corner case in the read_ctrl_pos() pos function, where it sees possible undefined behavior from the 'tier' index overflowing, presumably in the case that this was called with a negative tier: In function 'get_tier_idx', inlined from 'isolate_folios' at mm/vmscan.c:4671:14: mm/vmscan.c: In function 'isolate_folios': mm/vmscan.c:4645:29: error: 'pv.refaulted' is used uninitialized [-Werror=uninitialized] Part of the problem seems to be that read_ctrl_pos() has unusual calling conventions since commit 37a260870f2c ("mm/mglru: rework type selection") where passing MAX_NR_TIERS makes it accumulate all tiers but passing a smaller positive number makes it read a single tier instead. Shut up the warning by adding a fake initialization to the two instances of this variable that can run into that corner case. Link: https://lore.kernel.org/all/CAJHvVcjtFW86o5FoQC8MMEXCHAC0FviggaQsd5EmiCHP+1fBpg@mail.gmail.com/ Link: https://lore.kernel.org/20260414065206.3236176-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Davidlohr Bueso Cc: Johannes Weiner Cc: Kairui Song Cc: Koichiro Den Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Muchun Song Cc: Qi Zheng Cc: Shakeel Butt Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit e86ffbe7dfdd869498f1c44edd9ff230286d514e Author: Dave Young Date: Wed Apr 15 11:29:26 2026 +0800 MAINTAINERS: update Dave's kdump reviewer email address Use my personal email address due to the Red Hat work will stop soon Link: https://lore.kernel.org/ad8GFhh3SI1wb7IC@darkstar.users.ipa.redhat.com Signed-off-by: Dave Young Acked-by: Dave Young Signed-off-by: Andrew Morton commit b5a9ac2bb0e4f8a2a03c395c5176a85cea273c15 Author: Pratyush Yadav (Google) Date: Tue Apr 14 12:17:20 2026 +0000 MAINTAINERS: drop include/linux/liveupdate from LIVE UPDATE The directory does not exist any more. Link: https://lore.kernel.org/20260414121752.1912847-4-pratyush@kernel.org Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Pasha Tatashin Acked-by: Mike Rapoport (Microsoft) Reviewed-by: David Hildenbrand (Arm) Reviewed-by: SeongJae Park Cc: Alexander Graf Cc: Baoquan He Signed-off-by: Andrew Morton commit de61e40bcbb84546972191fb70ef64c5aecdda68 Author: Pratyush Yadav (Google) Date: Tue Apr 14 12:17:19 2026 +0000 MAINTAINERS: drop include/linux/kho/abi/ from KHO The KHO entry already includes include/linux/kho. Listing its subdirectory is redundant. Link: https://lore.kernel.org/20260414121752.1912847-3-pratyush@kernel.org Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Pasha Tatashin Acked-by: Mike Rapoport (Microsoft) Reviewed-by: David Hildenbrand (Arm) Reviewed-by: SeongJae Park Cc: Alexander Graf Cc: Baoquan He Signed-off-by: Andrew Morton commit 320c7234d1d1d3552cbbf58886f4219cc1a5ba48 Author: Pratyush Yadav (Google) Date: Tue Apr 14 12:17:18 2026 +0000 MAINTAINERS: update KHO and LIVE UPDATE maintainers Patch series "MAINTAINERS: update KHO and LIVE UPDATE entries". This series contains some updates for the Kexec Handover (KHO) and Live update entries. Patch 1 updates the maintainers list and adds the liveupdate tree. Patches 2 and 3 clean up stale files in the list. This patch (of 3): I have been helping out with reviewing and developing KHO. I would also like to help maintain it. Change my entry from R to M for KHO and live update. Alex has been inactive for a while, so to avoid over-crowding the KHO entry and to keep the information up-to-date, move his entry from M to R. We also now have a tree for KHO and live update at liveupdate/linux.git where we plan to start maintaining those subsystems and start queuing the patches. List that in the entries as well. Link: https://lore.kernel.org/20260414121752.1912847-1-pratyush@kernel.org Link: https://lore.kernel.org/20260414121752.1912847-2-pratyush@kernel.org Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Alexander Graf Reviewed-by: Pasha Tatashin Acked-by: Mike Rapoport (Microsoft) Cc: Baoquan He Cc: David Hildenbrand Signed-off-by: Andrew Morton commit 60087b49f8e7289681586609fc1d012615354754 Author: Pasha Tatashin Date: Mon Apr 13 12:11:46 2026 +0000 MAINTAINERS: update kexec/kdump maintainers entries Update KEXEC and KDUMP maintainer entries by adding the live update group maintainers. Remove Vivek Goyal due to inactivity to keep the MAINTAINERS file up-to-date, and add Vivek to the CREDITS file to recognize their contributions. Link: https://lore.kernel.org/20260413121146.49215-1-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Acked-by: Pratyush Yadav Acked-by: Mike Rapoport (Microsoft) Cc: Diego Viola Cc: Jakub Kacinski Cc: Magnus Karlsson Cc: Mark Brown Cc: Martin Kepplinger Cc: Masahiro Yamada Signed-off-by: Andrew Morton commit 57294a97bdd115b06ac05486e0e4a4f50a21ab7b Author: Davidlohr Bueso Date: Wed Feb 11 17:46:11 2026 -0800 mm/migrate_device: remove dead migration entry check in migrate_vma_collect_huge_pmd() The softleaf_is_migration() check is unreachable as entries that are not device_private are filtered out. Similarly, the PTE-level equivalent in migrate_vma_collect_pmd() skips migration entries. This dead branch also contained a double spin_unlock(ptl) bug. Link: https://lore.kernel.org/20260212014611.416695-1-dave@stgolabs.net Fixes: a30b48bf1b244 ("mm/migrate_device: implement THP migration of zone device pages") Signed-off-by: Davidlohr Bueso Suggested-by: Matthew Brost Reviewed-by: Alistair Popple Acked-by: Balbir Singh Acked-by: David Hildenbrand (Arm) Cc: Byungchul Park Cc: Gregory Price Cc: Jason Gunthorpe Cc: John Hubbard Cc: Joshua Hahn Cc: Mathew Brost Cc: Rakie Kim Cc: Ying Huang Cc: Zi Yan Cc: Thomas Hellström Signed-off-by: Andrew Morton commit d432e8847f58f825dada827eb492c34f65cdc82a Author: Cao Ruichuang Date: Fri Apr 10 12:41:39 2026 +0800 selftests: mm: skip charge_reserved_hugetlb without killall charge_reserved_hugetlb.sh tears down background writers with killall from psmisc. Minimal Ubuntu images do not always provide that tool, so the selftest fails in cleanup for an environment reason rather than for the hugetlb behavior it is trying to cover. Skip the test when killall is unavailable, similar to the existing root check, so these environments report the dependency clearly instead of failing the test. Link: https://lore.kernel.org/20260410044139.67480-1-create0818@163.com Signed-off-by: Cao Ruichuang Acked-by: Mike Rapoport (Microsoft) Cc: David Hildenbrand Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 161ce69c2c89781784b945d8e281ff2da9dede9c Author: Denis M. Karpov Date: Thu Apr 9 13:33:45 2026 +0300 userfaultfd: allow registration of ranges below mmap_min_addr The current implementation of validate_range() in fs/userfaultfd.c performs a hard check against mmap_min_addr. This is redundant because UFFDIO_REGISTER operates on memory ranges that must already be backed by a VMA. Enforcing mmap_min_addr or capability checks again in userfaultfd is unnecessary and prevents applications like binary compilers from using UFFD for valid memory regions mapped by application. Remove the redundant check for mmap_min_addr. We started using UFFD instead of the classic mprotect approach in the binary translator to track application writes. During development, we encountered this bug. The translator cannot control where the translated application chooses to map its memory and if the app requires a low-address area, UFFD fails, whereas mprotect would work just fine. I believe this is a genuine logic bug rather than an improvement, and I would appreciate including the fix in stable. Link: https://lore.kernel.org/20260409103345.15044-1-komlomal@gmail.com Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") Signed-off-by: Denis M. Karpov Reviewed-by: Lorenzo Stoakes Acked-by: Harry Yoo (Oracle) Reviewed-by: Pedro Falcato Reviewed-by: Liam R. Howlett Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Viro Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Peter Xu Cc: Signed-off-by: Andrew Morton commit 2b19bf05719b73f7d04d7d27ec423b459b868852 Author: Breno Leitao Date: Thu Apr 9 05:26:36 2026 -0700 mm/vmstat: fix vmstat_shepherd double-scheduling vmstat_update vmstat_shepherd uses delayed_work_pending() to check whether vmstat_update is already scheduled for a given CPU before queuing it. However, delayed_work_pending() only tests WORK_STRUCT_PENDING_BIT, which is cleared the moment a worker thread picks up the work to execute it. This means that while vmstat_update is actively running on a CPU, delayed_work_pending() returns false. If need_update() also returns true at that point (per-cpu counters not yet zeroed mid-flush), the shepherd queues a second invocation with delay=0, causing vmstat_update to run again immediately after finishing. On a 72-CPU system this race is readily observable: before the fix, many CPUs show invocation gaps well below 500 jiffies (the minimum round_jiffies_relative() can produce), with the most extreme cases reaching 0 jiffies—vmstat_update called twice within the same jiffy. Fix this by replacing delayed_work_pending() with work_busy(), which returns non-zero for both WORK_BUSY_PENDING (timer armed or work queued) and WORK_BUSY_RUNNING (work currently executing). The shepherd now correctly skips a CPU in all busy states. After the fix, all sub-jiffy and most sub-100-jiffie gaps disappear. The remaining early invocations have gaps in the 700–999 jiffie range, attributable to round_jiffies_relative() aligning to a nearer jiffie-second boundary rather than to this race. Each spurious vmstat_update invocation has a measurable side effect: refresh_cpu_vm_stats() calls decay_pcp_high() for every zone, which drains idle per-CPU pages back to the buddy allocator via free_pcppages_bulk(), taking the zone spinlock each time. Eliminating the double-scheduling therefore reduces zone lock contention directly. On a 72-CPU stress-ng workload measured with perf lock contention: free_pcppages_bulk contention count: ~55% reduction free_pcppages_bulk total wait time: ~57% reduction free_pcppages_bulk max wait time: ~47% reduction Note: work_busy() is inherently racy—between the check and the subsequent queue_delayed_work_on() call, vmstat_update can finish execution, leaving the work neither pending nor running. In that narrow window the shepherd can still queue a second invocation. After the fix, this residual race is rare and produces only occasional small gaps, a significant improvement over the systematic double-scheduling seen with delayed_work_pending(). Link: https://lore.kernel.org/20260409-vmstat-v2-1-e9d9a6db08ad@debian.org Fixes: 7b8da4c7f07774 ("vmstat: get rid of the ugly cpu_stat_off variable") Signed-off-by: Breno Leitao Reviewed-by: Vlastimil Babka (SUSE) Acked-by: Michal Hocko Reviewed-by: Dmitry Ilvokhin Cc: Christoph Lameter Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mike Rapoport Cc: Shakeel Butt Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit c45b354911d01565156e38d7f6bc07edb51fc34c Author: Thorsten Blum Date: Thu Apr 9 12:54:40 2026 +0200 mm/hugetlb: fix early boot crash on parameters without '=' separator If hugepages, hugepagesz, or default_hugepagesz are specified on the kernel command line without the '=' separator, early parameter parsing passes NULL to hugetlb_add_param(), which dereferences it in strlen() and can crash the system during early boot. Reject NULL values in hugetlb_add_param() and return -EINVAL instead. Link: https://lore.kernel.org/20260409105437.108686-4-thorsten.blum@linux.dev Fixes: 5b47c02967ab ("mm/hugetlb: convert cmdline parameters from setup to early") Signed-off-by: Thorsten Blum Reviewed-by: Muchun Song Cc: David Hildenbrand Cc: Frank van der Linden Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton commit 2f529e73d72048743b6eaa241da6ac2bcb28099e Author: Andrew Stellman Date: Tue Apr 7 11:30:27 2026 -0400 zram: reject unrecognized type= values in recompress_store() recompress_store() parses the type= parameter with three if statements checking for "idle", "huge", and "huge_idle". An unrecognized value silently falls through with mode left at 0, causing the recompression pass to run with no slot filter — processing all slots instead of the intended subset. Add a !mode check after the type parsing block to return -EINVAL for unrecognized values, consistent with the function's other parameter validation. Link: https://lore.kernel.org/20260407153027.42425-1-astellman@stellman-greene.com Signed-off-by: Andrew Stellman Suggested-by: Sergey Senozhatsky Reviewed-by: Sergey Senozhatsky Cc: Jens Axboe Cc: Minchan Kim Signed-off-by: Andrew Morton commit 9a8ea3c1cb251d4fc354d031e649da099140c4f4 Author: Kevin Brodsky Date: Tue Apr 7 13:51:33 2026 +0100 docs: proc: document ProtectionKey in smaps The ProtectionKey entry was added in v4.9; back then it was x86-specific, but it now lives in generic code and applies to all architectures supporting pkeys (currently x86, power, arm64). Time to document it: add a paragraph to proc.rst about the ProtectionKey entry. [akpm@linux-foundation.org: s/system/hardware/, per review discussion] [akpm@linux-foundation.org: s/hardware/CPU/] Link: https://lore.kernel.org/20260407125133.564182-1-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Reported-by: Yury Khrustalev Acked-by: Vlastimil Babka (SUSE) Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes Acked-by: Dave Hansen Cc: Jonathan Corbet Cc: Kevin Brodsky Cc: Marc Rutland Cc: Shuah Khan Cc: Randy Dunlap Signed-off-by: Andrew Morton commit 89e613bc0b2d6d4a18a09b161131ce4ca5c70f2a Author: Pedro Falcato Date: Thu Apr 2 15:16:28 2026 +0100 mm/mprotect: special-case small folios when applying permissions The common order-0 case is important enough to want its own branch, and avoids the hairy, large loop logic that the CPU does not seem to handle particularly well. While at it, encourage the compiler to inline batch PTE logic and resolve constant branches by adding __always_inline strategically. Link: https://lore.kernel.org/20260402141628.3367596-3-pfalcato@suse.de Signed-off-by: Pedro Falcato Suggested-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Tested-by: Luke Yang Reviewed-by: Vlastimil Babka (SUSE) Cc: Dev Jain Cc: Jann Horn Cc: Jiri Hladky Cc: Liam Howlett Cc: Davidlohr Bueso Signed-off-by: Andrew Morton commit 3bc181c1436373e42220baaa0d8c9b45fa18afe1 Author: Pedro Falcato Date: Thu Apr 2 15:16:27 2026 +0100 mm/mprotect: move softleaf code out of the main function Patch series "mm/mprotect: micro-optimization work", v3. Micro-optimize the change_protection functionality and the change_pte_range() routine. This set of functions works in an incredibly tight loop, and even small inefficiencies are incredibly evident when spun hundreds, thousands or hundreds of thousands of times. There was an attempt to keep the batching functionality as much as possible, which introduced some part of the slowness, but not all of it. Removing it for !arm64 architectures would speed mprotect() up even further, but could easily pessimize cases where large folios are mapped (which is not as rare as it seems, particularly when it comes to the page cache these days). The micro-benchmark used for the tests was [0] (usable using google/benchmark and g++ -O2 -lbenchmark repro.cpp) This resulted in the following (first entry is baseline): --------------------------------------------------------- Benchmark Time CPU Iterations --------------------------------------------------------- mprotect_bench 85967 ns 85967 ns 6935 mprotect_bench 70684 ns 70684 ns 9887 After the patchset we can observe an ~18% speedup in mprotect. Wonderful for the elusive mprotect-based workloads! Testing & more ideas welcome. I suspect there is plenty of improvement possible but it would require more time than what I have on my hands right now. The entire inlined function (which inlines into change_protection()) is gigantic - I'm not surprised this is so finnicky. Note: per my profiling, the next _big_ bottleneck here is modify_prot_start_ptes, exactly on the xchg() done by x86. ptep_get_and_clear() is _expensive_. I don't think there's a properly safe way to go about it since we do depend on the D bit quite a lot. This might not be such an issue on other architectures. Luke Yang reported [1]: : On average, we see improvements ranging from a minimum of 5% to a : maximum of 55%, with most improvements showing around a 25% speed up in : the libmicro/mprot_tw4m micro benchmark. This patch (of 2): Move softleaf change_pte_range code into a separate function. This makes the change_pte_range() function a good bit smaller, and lessens cognitive load when reading through the function. Link: https://lore.kernel.org/20260402141628.3367596-1-pfalcato@suse.de Link: https://lore.kernel.org/20260402141628.3367596-2-pfalcato@suse.de Link: https://lore.kernel.org/all/aY8-XuFZ7zCvXulB@luyang-thinkpadp1gen7.toromso.csb/ Link: https://gist.github.com/heatd/1450d273005aba91fa5744f44dfcd933 [0] Link: https://lore.kernel.org/CAL2CeBxT4jtJ+LxYb6=BNxNMGinpgD_HYH5gGxOP-45Q2OncqQ@mail.gmail.com [1] Signed-off-by: Pedro Falcato Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Tested-by: Luke Yang Reviewed-by: Vlastimil Babka (SUSE) Cc: Dev Jain Cc: Jann Horn Cc: Jiri Hladky Cc: Liam Howlett Cc: Davidlohr Bueso Signed-off-by: Andrew Morton commit 19999e479c2a38672789e66b4830f43c645ca1f2 Author: Zhaoyang Huang Date: Thu Feb 12 11:21:11 2026 +0800 mm: remove '!root_reclaim' checking in should_abort_scan() Android systems usually use memory.reclaim interface to implement user space memory management which expects that the requested reclaim target and actually reclaimed amount memory are not diverging by too much. With the current MGRLU implementation there is, however, no bail out when the reclaim target is reached and this could lead to an excessive reclaim that scales with the reclaim hierarchy size.For example, we can get a nr_reclaimed=394/nr_to_reclaim=32 proactive reclaim under a common 1-N cgroup hierarchy. This defect arose from the goal of keeping fairness among memcgs that is, for try_to_free_mem_cgroup_pages -> shrink_node_memcgs -> shrink_lruvec -> lru_gen_shrink_lruvec -> try_to_shrink_lruvec, the !root_reclaim(sc) check was there for reclaim fairness, which was necessary before commit b82b530740b9 ("mm: vmscan: restore incremental cgroup iteration") because the fairness depended on attempted proportional reclaim from every memcg under the target memcg. However after commit b82b530740b9 there is no longer a need to visit every memcg to ensure fairness. Let's have try_to_shrink_lruvec bail out when the nr_reclaimed achieved. Link: https://lore.kernel.org/20260318011558.1696310-1-zhaoyang.huang@unisoc.com Link: https://lore.kernel.org/20260212032111.408865-1-zhaoyang.huang@unisoc.com Signed-off-by: Zhaoyang Huang Suggested-by: T.J.Mercier Reviewed-by: T.J. Mercier Acked-by: Shakeel Butt Acked-by: Qi Zheng Reviewed-by: Barry Song Reviewed-by: Kairui Song Cc: Johannes Weiner Cc: Michal Hocko Cc: Rik van Riel Cc: Roman Gushchin Cc: Yu Zhao Cc: Axel Rasmussen Cc: Yuanchu Xie Cc: Wei Xu Signed-off-by: Andrew Morton commit 77c368f057e17b59b23899a1907ee9d4f4d7a532 Author: Muchun Song Date: Thu Apr 2 18:23:20 2026 +0800 mm/sparse: fix comment for section map alignment The comment in mmzone.h currently details exhaustive per-architecture bit-width lists and explains alignment using min(PAGE_SHIFT, PFN_SECTION_SHIFT). Such details risk falling out of date over time and may inadvertently be left un-updated. We always expect a single section to cover full pages. Therefore, we can safely assume that PFN_SECTION_SHIFT is large enough to accommodate SECTION_MAP_LAST_BIT. We use BUILD_BUG_ON() to ensure this. Update the comment to accurately reflect this consensus, making it clear that we rely on a single section covering full pages. Link: https://lore.kernel.org/20260402102320.3617578-1-songmuchun@bytedance.com Signed-off-by: Muchun Song Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Petr Tesarik Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit df620ec4d4d703f11f3b0adecd4450c34489e0f1 Author: David Carlier Date: Thu Apr 2 07:14:07 2026 +0100 mm/page_io: use sio->len for PSWPIN accounting in sio_read_complete() sio_read_complete() uses sio->pages to account global PSWPIN vm events, but sio->pages tracks the number of bvec entries (folios), not base pages. While large folios cannot currently reach this path (SWP_FS_OPS and SWP_SYNCHRONOUS_IO are mutually exclusive, and mTHP swap-in allocation is gated on SWP_SYNCHRONOUS_IO), the accounting is semantically inconsistent with the per-memcg path which correctly uses folio_nr_pages(). Use sio->len >> PAGE_SHIFT instead, which gives the correct base page count since sio->len is accumulated via folio_size(folio). Link: https://lore.kernel.org/20260402061408.36119-1-devnexen@gmail.com Signed-off-by: David Carlier Acked-by: David Hildenbrand (Arm) Cc: Baoquan He Cc: Chris Li Cc: Kairui Song Cc: Kemeng Shi Cc: NeilBrown Cc: Nhat Pham Signed-off-by: Andrew Morton commit cfe9a446f519f355f2e3741e2d63944e6064c4cc Author: Chunyu Hu Date: Thu Apr 2 09:45:43 2026 +0800 selftests/mm: transhuge_stress: skip the test when thp not available The test requires thp, skip the test when thp is not available to avoid false positive. Tested with thp disabled kernel. Before the fix: # -------------------------------- # running ./transhuge-stress -d 20 # -------------------------------- # TAP version 13 # 1..1 # transhuge-stress: allocate 1453 transhuge pages, using 2907 MiB virtual memory and 11 MiB of ram # Bail out! MADV_HUGEPAGE# Planned tests != run tests (1 != 0) # # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:0 # [FAIL] not ok 60 transhuge-stress -d 20 # exit=1 After the fix: # -------------------------------- # running ./transhuge-stress -d 20 # -------------------------------- # TAP version 13 # 1..0 # SKIP Transparent Hugepages not available # [SKIP] ok 5 transhuge-stress -d 20 # SKIP Link: https://lore.kernel.org/20260402014543.1671131-7-chuhu@redhat.com Signed-off-by: Chunyu Hu Acked-by: David Hildenbrand (Arm) Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Zi Yan Cc: Li Wang Cc: Nico Pache Signed-off-by: Andrew Morton commit dad4964a34c20cb86dcbedfe64ef7fe0728346df Author: Chunyu Hu Date: Thu Apr 2 09:45:42 2026 +0800 selftests/mm: split_huge_page_test: skip the test when thp is not available When thp is not enabled on some kernel config such as realtime kernel, the test will report failure. Fix the false positive by skipping the test directly when thp is not enabled. Tested with thp disabled kernel: Before The fix: # -------------------------------------------------- # running ./split_huge_page_test /tmp/xfs_dir_Ywup9p # -------------------------------------------------- # TAP version 13 # Bail out! Reading PMD pagesize failed # # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:0 # [FAIL] not ok 61 split_huge_page_test /tmp/xfs_dir_Ywup9p # exit=1 After the fix: # -------------------------------------------------- # running ./split_huge_page_test /tmp/xfs_dir_YHPUPl # -------------------------------------------------- # TAP version 13 # 1..0 # SKIP Transparent Hugepages not available # [SKIP] ok 6 split_huge_page_test /tmp/xfs_dir_YHPUPl # SKIP Link: https://lore.kernel.org/20260402014543.1671131-6-chuhu@redhat.com Signed-off-by: Chunyu Hu Acked-by: David Hildenbrand (Arm) Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Zi Yan Cc: Li Wang Cc: Nico Pache Signed-off-by: Andrew Morton commit a784a3a39cc58b45807083b6447fa13028fd47e7 Author: Chunyu Hu Date: Thu Apr 2 09:45:41 2026 +0800 selftests/mm/vm_util: robust write_file() Add three more checks for buflen and numwritten. The buflen should be at least two, that means at least one char and the null-end. The error case check is added by checking numwriten < 0 instead of numwritten < 1. And the truncate case is checked. The test will exit if any of these conditions aren't met. Additionally, add more print information when a write failure occurs or a truncated write happens, providing clearer diagnostics. Link: https://lore.kernel.org/20260402014543.1671131-5-chuhu@redhat.com Signed-off-by: Chunyu Hu Acked-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes Cc: Nico Pache Signed-off-by: Andrew Morton commit 710d2f307945e892aaa147ae98232fafebe0be33 Author: Chunyu Hu Date: Thu Apr 2 09:45:40 2026 +0800 selftests/mm: move write_file helper to vm_util thp_settings provides write_file() helper for safely writing to a file and exit when write failure happens. It's a very low level helper and many sub tests need such a helper, not only thp tests. split_huge_page_test also defines a write_file locally. The two have minior differences in return type and used exit api. And there would be conflicts if split_huge_page_test wanted to include thp_settings.h because of different prototype, making it less convenient. It's possisble to merge the two, although some tests don't use the kselftest infrastrucutre for testing. It would also work when using the ksft_exit_msg() to exit in my test, as the counters are all zero. Output will be like: TAP version 13 1..62 Bail out! /proc/sys/vm/drop_caches1 open failed: No such file or directory # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:0 So here we just keep the version in split_huge_page_test, and move it into the vm_util. This makes it easy to maitain and user could just include one vm_util.h when they don't need thp setting helpers. Keep the prototype of void return as the function will exit on any error, return value is not necessary, and will simply the callers like write_num() and write_string(). Link: https://lore.kernel.org/20260402014543.1671131-4-chuhu@redhat.com Signed-off-by: Chunyu Hu Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Reviewed-by: Zi Yan Acked-by: Mike Rapoport (Microsoft) Suggested-by: Mike Rapoport Cc: Nico Pache Signed-off-by: Andrew Morton commit 929d5fbf1a00ed86e02348a0a26dfddc301ababd Author: Chunyu Hu Date: Thu Apr 2 09:45:39 2026 +0800 selftests/mm: soft-dirty: skip two tests when thp is not available The test_hugepage test contain two sub tests. If just reporting one skip when thp not available, there will be error in the log because the test count don't match the test plan. Change to skip two tests by running the ksft_test_result_skip twice in this case. Without the fix (run test on thp disabled kernel): ./run_vmtests.sh -t soft_dirty # -------------------- # running ./soft-dirty # -------------------- # TAP version 13 # 1..19 # ok 1 Test test_simple # ok 2 Test test_vma_reuse dirty bit of allocated page # ok 3 Test test_vma_reuse dirty bit of reused address page # ok 4 # SKIP Transparent Hugepages not available # ok 5 Test test_mprotect-anon dirty bit of new written page # ok 6 Test test_mprotect-anon soft-dirty clear after clear_refs # ok 7 Test test_mprotect-anon soft-dirty clear after marking RO # ok 8 Test test_mprotect-anon soft-dirty clear after marking RW # ok 9 Test test_mprotect-anon soft-dirty after rewritten # ok 10 Test test_mprotect-file dirty bit of new written page # ok 11 Test test_mprotect-file soft-dirty clear after clear_refs # ok 12 Test test_mprotect-file soft-dirty clear after marking RO # ok 13 Test test_mprotect-file soft-dirty clear after marking RW # ok 14 Test test_mprotect-file soft-dirty after rewritten # ok 15 Test test_merge-anon soft-dirty after remap merge 1st pg # ok 16 Test test_merge-anon soft-dirty after remap merge 2nd pg # ok 17 Test test_merge-anon soft-dirty after mprotect merge 1st pg # ok 18 Test test_merge-anon soft-dirty after mprotect merge 2nd pg # # 1 skipped test(s) detected. Consider enabling relevant config options to improve coverage. # # Planned tests != run tests (19 != 18) # # Totals: pass:17 fail:0 xfail:0 xpass:0 skip:1 error:0 # [FAIL] not ok 52 soft-dirty # exit=1 With the fix (run test on thp disabled kernel): ./run_vmtests.sh -t soft_dirty # -------------------- # running ./soft-dirty # TAP version 13 # -------------------- # running ./soft-dirty # -------------------- # TAP version 13 # 1..19 # ok 1 Test test_simple # ok 2 Test test_vma_reuse dirty bit of allocated page # ok 3 Test test_vma_reuse dirty bit of reused address page # # Transparent Hugepages not available # ok 4 # SKIP Test test_hugepage huge page allocation # ok 5 # SKIP Test test_hugepage huge page dirty bit # ok 6 Test test_mprotect-anon dirty bit of new written page # ok 7 Test test_mprotect-anon soft-dirty clear after clear_refs # ok 8 Test test_mprotect-anon soft-dirty clear after marking RO # ok 9 Test test_mprotect-anon soft-dirty clear after marking RW # ok 10 Test test_mprotect-anon soft-dirty after rewritten # ok 11 Test test_mprotect-file dirty bit of new written page # ok 12 Test test_mprotect-file soft-dirty clear after clear_refs # ok 13 Test test_mprotect-file soft-dirty clear after marking RO # ok 14 Test test_mprotect-file soft-dirty clear after marking RW # ok 15 Test test_mprotect-file soft-dirty after rewritten # ok 16 Test test_merge-anon soft-dirty after remap merge 1st pg # ok 17 Test test_merge-anon soft-dirty after remap merge 2nd pg # ok 18 Test test_merge-anon soft-dirty after mprotect merge 1st pg # ok 19 Test test_merge-anon soft-dirty after mprotect merge 2nd pg # # 2 skipped test(s) detected. Consider enabling relevant config options to improve coverage. # # Totals: pass:17 fail:0 xfail:0 xpass:0 skip:2 error:0 # [PASS] ok 1 soft-dirty hwpoison_inject # SUMMARY: PASS=1 SKIP=0 FAIL=0 1..1 Link: https://lore.kernel.org/20260402014543.1671131-3-chuhu@redhat.com Signed-off-by: Chunyu Hu Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Reviewed-by: Zi Yan Cc: Li Wang Cc: Nico Pache Signed-off-by: Andrew Morton commit fb0fca46b9b460f7ac60f66d92ac6276fce9d9e9 Author: Chunyu Hu Date: Thu Apr 2 09:45:38 2026 +0800 selftests/mm/guard-regions: skip collapse test when thp not enabled Patch series "selftests/mm: skip several tests when thp is not available", v8. There are several tests requires transprarent hugepages, when run on thp disabled kernel such as realtime kernel, there will be false negative. Mark those tests as skip when thp is not available. This patch (of 6): When thp is not available, just skip the collape tests to avoid the false negative. Without the change, run with a thp disabled kernel: ./run_vmtests.sh -t madv_guard -n 1 # RUN guard_regions.anon.collapse ... # guard-regions.c:2217:collapse:Expected madvise(ptr, size, MADV_NOHUGEPAGE) (-1) == 0 (0) # collapse: Test terminated by assertion # FAIL guard_regions.anon.collapse not ok 2 guard_regions.anon.collapse # RUN guard_regions.shmem.collapse ... # guard-regions.c:2217:collapse:Expected madvise(ptr, size, MADV_NOHUGEPAGE) (-1) == 0 (0) # collapse: Test terminated by assertion # FAIL guard_regions.shmem.collapse not ok 32 guard_regions.shmem.collapse # RUN guard_regions.file.collapse ... # guard-regions.c:2217:collapse:Expected madvise(ptr, size, MADV_NOHUGEPAGE) (-1) == 0 (0) # collapse: Test terminated by assertion # FAIL guard_regions.file.collapse not ok 62 guard_regions.file.collapse # FAILED: 87 / 90 tests passed. # 17 skipped test(s) detected. Consider enabling relevant config options to improve coverage. # Totals: pass:70 fail:3 xfail:0 xpass:0 skip:17 error:0 With this change, run with thp disabled kernel: ./run_vmtests.sh -t madv_guard -n 1 # RUN guard_regions.anon.collapse ... # SKIP Transparent Hugepages not available # OK guard_regions.anon.collapse ok 2 guard_regions.anon.collapse # SKIP Transparent Hugepages not available # RUN guard_regions.file.collapse ... # SKIP Transparent Hugepages not available # OK guard_regions.file.collapse ok 62 guard_regions.file.collapse # SKIP Transparent Hugepages not available # RUN guard_regions.shmem.collapse ... # SKIP Transparent Hugepages not available # OK guard_regions.shmem.collapse ok 32 guard_regions.shmem.collapse # SKIP Transparent Hugepages not available # PASSED: 90 / 90 tests passed. # 20 skipped test(s) detected. Consider enabling relevant config options to improve coverage. # Totals: pass:70 fail:0 xfail:0 xpass:0 skip:20 error:0 Link: https://lore.kernel.org/20260402014543.1671131-1-chuhu@redhat.com Link: https://lore.kernel.org/20260402014543.1671131-2-chuhu@redhat.com Signed-off-by: Chunyu Hu Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Reviewed-by: Zi Yan Acked-by: Mike Rapoport (Microsoft) Cc: Li Wang Cc: Nico Pache Signed-off-by: Andrew Morton commit 6ab703034f145ef8e1a705b1630cc317ec8dd8a2 Author: Mike Rapoport (Microsoft) Date: Thu Apr 2 07:11:52 2026 +0300 userfaultfd: mfill_atomic(): remove retry logic Since __mfill_atomic_pte() handles the retry for both anonymous and shmem, there is no need to retry copying the date from the userspace in the loop in mfill_atomic(). Drop the retry logic from mfill_atomic(). [rppt@kernel.org: remove safety measure of not returning ENOENT from _copy] Link: https://lore.kernel.org/ac5zcDUY8CFHr6Lw@kernel.org Link: https://lore.kernel.org/20260402041156.1377214-12-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Andrea Arcangeli Cc: Andrei Vagin Cc: Axel Rasmussen Cc: Baolin Wang Cc: David Hildenbrand (Arm) Cc: Harry Yoo Cc: Harry Yoo (Oracle) Cc: Hugh Dickins Cc: James Houghton Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Nikita Kalyazin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Peter Xu Cc: Sean Christopherson Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Carlier Signed-off-by: Andrew Morton commit f74991b4e3836dd38f3adb41b146994b283942a1 Author: Mike Rapoport (Microsoft) Date: Thu Apr 2 07:11:51 2026 +0300 shmem, userfaultfd: implement shmem uffd operations using vm_uffd_ops Add filemap_add() and filemap_remove() methods to vm_uffd_ops and use them in __mfill_atomic_pte() to add shmem folios to page cache and remove them in case of error. Implement these methods in shmem along with vm_uffd_ops->alloc_folio() and drop shmem_mfill_atomic_pte(). Since userfaultfd now does not reference any functions from shmem, drop include if linux/shmem_fs.h from mm/userfaultfd.c mfill_atomic_install_pte() is not used anywhere outside of mm/userfaultfd, make it static. Link: https://lore.kernel.org/20260402041156.1377214-11-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: James Houghton Cc: Andrea Arcangeli Cc: Andrei Vagin Cc: Axel Rasmussen Cc: Baolin Wang Cc: David Hildenbrand (Arm) Cc: Harry Yoo Cc: Harry Yoo (Oracle) Cc: Hugh Dickins Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Nikita Kalyazin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Peter Xu Cc: Sean Christopherson Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Carlier Signed-off-by: Andrew Morton commit ad9ac3081332e955bc4b513018a1e0e86683bfb5 Author: Mike Rapoport (Microsoft) Date: Thu Apr 2 07:11:50 2026 +0300 userfaultfd: introduce vm_uffd_ops->alloc_folio() and use it to refactor mfill_atomic_pte_zeroed_folio() and mfill_atomic_pte_copy(). mfill_atomic_pte_zeroed_folio() and mfill_atomic_pte_copy() perform almost identical actions: * allocate a folio * update folio contents (either copy from userspace of fill with zeros) * update page tables with the new folio Split a __mfill_atomic_pte() helper that handles both cases and uses newly introduced vm_uffd_ops->alloc_folio() to allocate the folio. Pass the ops structure from the callers to __mfill_atomic_pte() to later allow using anon_uffd_ops for MAP_PRIVATE mappings of file-backed VMAs. Note, that the new ops method is called alloc_folio() rather than folio_alloc() to avoid clash with alloc_tag macro folio_alloc(). Link: https://lore.kernel.org/20260402041156.1377214-10-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: James Houghton Cc: Andrea Arcangeli Cc: Andrei Vagin Cc: Axel Rasmussen Cc: Baolin Wang Cc: David Hildenbrand (Arm) Cc: Harry Yoo Cc: Harry Yoo (Oracle) Cc: Hugh Dickins Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Nikita Kalyazin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Peter Xu Cc: Sean Christopherson Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Carlier Signed-off-by: Andrew Morton commit dfc4d771820a171bd701d06252fcf920d0ede25c Author: Mike Rapoport (Microsoft) Date: Thu Apr 2 07:11:49 2026 +0300 shmem, userfaultfd: use a VMA callback to handle UFFDIO_CONTINUE When userspace resolves a page fault in a shmem VMA with UFFDIO_CONTINUE it needs to get a folio that already exists in the pagecache backing that VMA. Instead of using shmem_get_folio() for that, add a get_folio_noalloc() method to 'struct vm_uffd_ops' that will return a folio if it exists in the VMA's pagecache at given pgoff. Implement get_folio_noalloc() method for shmem and slightly refactor userfaultfd's mfill_get_vma() and mfill_atomic_pte_continue() to support this new API. Link: https://lore.kernel.org/20260402041156.1377214-9-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: James Houghton Cc: Andrea Arcangeli Cc: Andrei Vagin Cc: Axel Rasmussen Cc: Baolin Wang Cc: David Hildenbrand (Arm) Cc: Harry Yoo Cc: Harry Yoo (Oracle) Cc: Hugh Dickins Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Nikita Kalyazin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Peter Xu Cc: Sean Christopherson Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Carlier Signed-off-by: Andrew Morton commit 0f48947c4232c934885711dde0b49066f9d8ee87 Author: Mike Rapoport (Microsoft) Date: Thu Apr 2 07:11:48 2026 +0300 userfaultfd: introduce vm_uffd_ops Current userfaultfd implementation works only with memory managed by core MM: anonymous, shmem and hugetlb. First, there is no fundamental reason to limit userfaultfd support only to the core memory types and userfaults can be handled similarly to regular page faults provided a VMA owner implements appropriate callbacks. Second, historically various code paths were conditioned on vma_is_anonymous(), vma_is_shmem() and is_vm_hugetlb_page() and some of these conditions can be expressed as operations implemented by a particular memory type. Introduce vm_uffd_ops extension to vm_operations_struct that will delegate memory type specific operations to a VMA owner. Operations for anonymous memory are handled internally in userfaultfd using anon_uffd_ops that implicitly assigned to anonymous VMAs. Start with a single operation, ->can_userfault() that will verify that a VMA meets requirements for userfaultfd support at registration time. Implement that method for anonymous, shmem and hugetlb and move relevant parts of vma_can_userfault() into the new callbacks. [rppt@kernel.org: relocate VM_DROPPABLE test, per Tal] Link: https://lore.kernel.org/adffgfM5ANxtPIEF@kernel.org Link: https://lore.kernel.org/20260402041156.1377214-8-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Andrea Arcangeli Cc: Andrei Vagin Cc: Axel Rasmussen Cc: Baolin Wang Cc: David Hildenbrand (Arm) Cc: Harry Yoo Cc: Harry Yoo (Oracle) Cc: Hugh Dickins Cc: James Houghton Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Nikita Kalyazin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Peter Xu Cc: Sean Christopherson Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Carlier Cc: Tal Zussman Signed-off-by: Andrew Morton commit a5bb8669872b6b8463b8777a7a259a8305060016 Author: Mike Rapoport (Microsoft) Date: Thu Apr 2 07:11:47 2026 +0300 userfaultfd: move vma_can_userfault out of line vma_can_userfault() has grown pretty big and it's not called on performance critical path. Move it out of line. No functional changes. Link: https://lore.kernel.org/20260402041156.1377214-7-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: David Hildenbrand (Red Hat) Reviewed-by: Liam R. Howlett Cc: Andrea Arcangeli Cc: Andrei Vagin Cc: Axel Rasmussen Cc: Baolin Wang Cc: Harry Yoo Cc: Harry Yoo (Oracle) Cc: Hugh Dickins Cc: James Houghton Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Nikita Kalyazin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Peter Xu Cc: Sean Christopherson Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Carlier Signed-off-by: Andrew Morton commit f5f035a724235f6dbef428ca54a3e9f25becc10e Author: Mike Rapoport (Microsoft) Date: Thu Apr 2 07:11:46 2026 +0300 userfaultfd: retry copying with locks dropped in mfill_atomic_pte_copy() Implementation of UFFDIO_COPY for anonymous memory might fail to copy data from userspace buffer when the destination VMA is locked (either with mm_lock or with per-VMA lock). In that case, mfill_atomic() releases the locks, retries copying the data with locks dropped and then re-locks the destination VMA and re-establishes PMD. Since this retry-reget dance is only relevant for UFFDIO_COPY and it never happens for other UFFDIO_ operations, make it a part of mfill_atomic_pte_copy() that actually implements UFFDIO_COPY for anonymous memory. As a temporal safety measure to avoid breaking biscection mfill_atomic_pte_copy() makes sure to never return -ENOENT so that the loop in mfill_atomic() won't retry copiyng outside of mmap_lock. This is removed later when shmem implementation will be updated later and the loop in mfill_atomic() will be adjusted. [akpm@linux-foundation.org: update mfill_copy_folio_retry()] Link: https://lore.kernel.org/20260316173829.1126728-1-avagin@google.com Link: https://lore.kernel.org/20260306171815.3160826-6-rppt@kernel.org Link: https://lore.kernel.org/20260402041156.1377214-6-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Harry Yoo (Oracle) Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: Baolin Wang Cc: David Hildenbrand (Arm) Cc: Hugh Dickins Cc: James Houghton Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Nikita Kalyazin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Peter Xu Cc: Sean Christopherson Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Carlier Cc: Harry Yoo Signed-off-by: Andrew Morton commit b8c03b7f4558219ca09693b5fa4f5e068041d2c2 Author: Mike Rapoport (Microsoft) Date: Thu Apr 2 07:11:45 2026 +0300 userfaultfd: introduce mfill_get_vma() and mfill_put_vma() Split the code that finds, locks and verifies VMA from mfill_atomic() into a helper function. This function will be used later during refactoring of mfill_atomic_pte_copy(). Add a counterpart mfill_put_vma() helper that unlocks the VMA and releases map_changing_lock. [avagin@google.com: fix lock leak in mfill_get_vma()] Link: https://lore.kernel.org/20260316173829.1126728-1-avagin@google.com Link: https://lore.kernel.org/20260402041156.1377214-5-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Signed-off-by: Andrei Vagin Reviewed-by: Harry Yoo (Oracle) Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: Baolin Wang Cc: David Hildenbrand (Arm) Cc: Harry Yoo Cc: Hugh Dickins Cc: James Houghton Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Nikita Kalyazin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Peter Xu Cc: Sean Christopherson Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Carlier Signed-off-by: Andrew Morton commit e2e0b826d37419536b91b25fa51ecc0565d27726 Author: Mike Rapoport (Microsoft) Date: Thu Apr 2 07:11:44 2026 +0300 userfaultfd: introduce mfill_establish_pmd() helper There is a lengthy code chunk in mfill_atomic() that establishes the PMD for UFFDIO operations. This code may be called twice: first time when the copy is performed with VMA/mm locks held and the other time after the copy is retried with locks dropped. Move the code that establishes a PMD into a helper function so it can be reused later during refactoring of mfill_atomic_pte_copy(). Link: https://lore.kernel.org/20260402041156.1377214-4-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Harry Yoo (Oracle) Cc: Andrea Arcangeli Cc: Andrei Vagin Cc: Axel Rasmussen Cc: Baolin Wang Cc: David Hildenbrand (Arm) Cc: Harry Yoo Cc: Hugh Dickins Cc: James Houghton Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Nikita Kalyazin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Peter Xu Cc: Sean Christopherson Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Carlier Signed-off-by: Andrew Morton commit db0062d2c0357eb23b1c2dd4978ff4c2e1e5806b Author: Mike Rapoport (Microsoft) Date: Thu Apr 2 07:11:43 2026 +0300 userfaultfd: introduce struct mfill_state mfill_atomic() passes a lot of parameters down to its callees. Aggregate them all into mfill_state structure and pass this structure to functions that implement various UFFDIO_ commands. Tracking the state in a structure will allow moving the code that retries copying of data for UFFDIO_COPY into mfill_atomic_pte_copy() and make the loop in mfill_atomic() identical for all UFFDIO operations on PTE-mapped memory. The mfill_state definition is deliberately local to mm/userfaultfd.c, hence shmem_mfill_atomic_pte() is not updated. [harry.yoo@oracle.com: properly initialize mfill_state.len to fix folio_add_new_anon_rmap() WARN] Link: https://lore.kernel.org/abehBY7QakYF9bK4@hyeyoo Link: https://lore.kernel.org/20260402041156.1377214-3-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Signed-off-by: Harry Yoo Acked-by: David Hildenbrand (Arm) Reviewed-by: Harry Yoo (Oracle) Cc: Andrea Arcangeli Cc: Andrei Vagin Cc: Axel Rasmussen Cc: Baolin Wang Cc: Harry Yoo (Oracle) Cc: Hugh Dickins Cc: James Houghton Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Cc: Nikita Kalyazin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Peter Xu Cc: Sean Christopherson Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Carlier Signed-off-by: Andrew Morton commit c0620487fc33320ed7ccdfdd9644d996f8c09c5a Author: Mike Rapoport (Microsoft) Date: Thu Apr 2 07:11:42 2026 +0300 userfaultfd: introduce mfill_copy_folio_locked() helper Patch series "mm, kvm: allow uffd support in guest_memfd", v4. These patches enable support for userfaultfd in guest_memfd. As the groundwork I refactored userfaultfd handling of PTE-based memory types (anonymous and shmem) and converted them to use vm_uffd_ops for allocating a folio or getting an existing folio from the page cache. shmem also implements callbacks that add a folio to the page cache after the data passed in UFFDIO_COPY was copied and remove the folio from the page cache if page table update fails. In order for guest_memfd to notify userspace about page faults, there are new VM_FAULT_UFFD_MINOR and VM_FAULT_UFFD_MISSING that a ->fault() handler can return to inform the page fault handler that it needs to call handle_userfault() to complete the fault. Nikita helped to plumb these new goodies into guest_memfd and provided basic tests to verify that guest_memfd works with userfaultfd. The handling of UFFDIO_MISSING in guest_memfd requires ability to remove a folio from page cache, the best way I could find was exporting filemap_remove_folio() to KVM. I deliberately left hugetlb out, at least for the most part. hugetlb handles acquisition of VMA and more importantly establishing of parent page table entry differently than PTE-based memory types. This is a different abstraction level than what vm_uffd_ops provides and people objected to exposing such low level APIs as a part of VMA operations. Also, to enable uffd in guest_memfd refactoring of hugetlb is not needed and I prefer to delay it until the dust settles after the changes in this set. This patch (of 4): Split copying of data when locks held from mfill_atomic_pte_copy() into a helper function mfill_copy_folio_locked(). This makes improves code readability and makes complex mfill_atomic_pte_copy() function easier to comprehend. No functional change. Link: https://lore.kernel.org/20260402041156.1377214-1-rppt@kernel.org Link: https://lore.kernel.org/20260402041156.1377214-2-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Peter Xu Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Harry Yoo (Oracle) Cc: Andrea Arcangeli Cc: Andrei Vagin Cc: Axel Rasmussen Cc: Baolin Wang Cc: Hugh Dickins Cc: James Houghton Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Sean Christopherson Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Harry Yoo Cc: Nikita Kalyazin Cc: David Carlier Signed-off-by: Andrew Morton commit dc44f32fde25c401da6c4746c389ec552ddbc30f Author: Chenghao Duan Date: Thu Mar 26 16:47:26 2026 +0800 mm/memfd_luo: remove folio from page cache when accounting fails In memfd_luo_retrieve_folios(), when shmem_inode_acct_blocks() fails after successfully adding the folio to the page cache, the code jumps to unlock_folio without removing the folio from the page cache. While the folio eventually will be freed when the file is released by memfd_luo_retrieve(), it is a good idea to directly remove a folio that was not fully added to the file. This avoids the possibility of accounting mismatches in shmem or filemap core. Fix by adding a remove_from_cache label that calls filemap_remove_folio() before unlocking, matching the error handling pattern in shmem_alloc_and_add_folio(). This issue was identified by AI review: https://sashiko.dev/#/patchset/20260323110747.193569-1-duanchenghao@kylinos.cn [pratyush@kernel.org: changelog alterations] Link: https://lore.kernel.org/2vxzzf3lfujq.fsf@kernel.org Link: https://lore.kernel.org/20260326084727.118437-7-duanchenghao@kylinos.cn Signed-off-by: Chenghao Duan Reviewed-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Cc: Haoran Jiang Cc: Mike Rapoport (Microsoft) Signed-off-by: Andrew Morton commit 3538f90ab89aaf302782b4b073a0aae66904cd67 Author: Chenghao Duan Date: Thu Mar 26 16:47:25 2026 +0800 mm/memfd_luo: fix physical address conversion in put_folios cleanup In memfd_luo_retrieve_folios()'s put_folios cleanup path: 1. kho_restore_folio() expects a phys_addr_t (physical address) but receives a raw PFN (pfolio->pfn). This causes kho_restore_page() to check the wrong physical address (pfn << PAGE_SHIFT instead of the actual physical address). 2. This loop lacks the !pfolio->pfn check that exists in the main retrieval loop and memfd_luo_discard_folios(), which could incorrectly process sparse file holes where pfn=0. Fix by converting PFN to physical address with PFN_PHYS() and adding the !pfolio->pfn check, matching the pattern used elsewhere in this file. This issue was identified by the AI review. https://sashiko.dev/#/patchset/20260323110747.193569-1-duanchenghao@kylinos.cn Link: https://lore.kernel.org/20260326084727.118437-6-duanchenghao@kylinos.cn Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") Signed-off-by: Chenghao Duan Reviewed-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Cc: Haoran Jiang Cc: Mike Rapoport (Microsoft) Cc: Signed-off-by: Andrew Morton commit 32f6cec5e7511ce3e48d504601035f108844e063 Author: Chenghao Duan Date: Thu Mar 26 16:47:24 2026 +0800 mm/memfd_luo: use i_size_write() to set inode size during retrieve Use i_size_write() instead of directly assigning to inode->i_size when restoring the memfd size in memfd_luo_retrieve(), to keep code consistency. No functional change intended. Link: https://lore.kernel.org/20260326084727.118437-5-duanchenghao@kylinos.cn Signed-off-by: Chenghao Duan Reviewed-by: Pasha Tatashin Cc: Haoran Jiang Cc: Mike Rapoport (Microsoft) Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit 4aa6424f37b58a4f8298329166657bd4fd8e9ca8 Author: Chenghao Duan Date: Thu Mar 26 16:47:23 2026 +0800 mm/memfd_luo: remove unnecessary memset in zero-size memfd path The memset(kho_vmalloc, 0, sizeof(*kho_vmalloc)) call in the zero-size file handling path is unnecessary because the allocation of the ser structure already uses the __GFP_ZERO flag, ensuring the memory is already zero-initialized. Link: https://lore.kernel.org/20260326084727.118437-4-duanchenghao@kylinos.cn Signed-off-by: Chenghao Duan Reviewed-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Cc: Haoran Jiang Signed-off-by: Andrew Morton commit 502d3c2ad8f05d1545ae05f96f71a5916aa88b0f Author: Chenghao Duan Date: Thu Mar 26 16:47:22 2026 +0800 mm/memfd_luo: optimize shmem_recalc_inode calls in retrieve path Move shmem_recalc_inode() out of the loop in memfd_luo_retrieve_folios() to improve performance when restoring large memfds. Currently, shmem_recalc_inode() is called for each folio during restore, which is O(n) expensive operations. This patch collects the number of successfully added folios and calls shmem_recalc_inode() once after the loop completes, reducing complexity to O(1). Additionally, fix the error path to also call shmem_recalc_inode() for the folios that were successfully added before the error occurred. Link: https://lore.kernel.org/20260326084727.118437-3-duanchenghao@kylinos.cn Signed-off-by: Chenghao Duan Reviewed-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Cc: Haoran Jiang Cc: Mike Rapoport (Microsoft) Signed-off-by: Andrew Morton commit ed2a29dc6dcf4630ef19d588704c2ca7b46607bb Author: Chenghao Duan Date: Thu Mar 26 16:47:21 2026 +0800 mm/memfd: use folio_nr_pages() for shmem inode accounting I found several modifiable points while reading the code. This patch (of 6): Patch series "Modify memfd_luo code", v3. memfd_luo_retrieve_folios() called shmem_inode_acct_blocks() and shmem_recalc_inode() with hardcoded 1 instead of the actual folio page count. memfd may use large folios (THP/hugepages), causing quota/limit under-accounting and incorrect stat output. Fix by using folio_nr_pages(folio) for both functions. Issue found by AI review and suggested by Pratyush Yadav . https://sashiko.dev/#/patchset/20260319012845.29570-1-duanchenghao%40kylinos.cn Link: https://lore.kernel.org/20260326084727.118437-1-duanchenghao@kylinos.cn Link: https://lore.kernel.org/20260326084727.118437-2-duanchenghao@kylinos.cn Signed-off-by: Chenghao Duan Suggested-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Cc: Haoran Jiang Cc: Mike Rapoport Signed-off-by: Andrew Morton commit 7cf6d940f4032d87d9cfe6b27c0e49e309818e5d Author: Muchun Song Date: Tue Mar 31 19:37:24 2026 +0800 mm/sparse: fix preinited section_mem_map clobbering on failure path sparse_init_nid() is careful to leave alone every section whose vmemmap has already been set up by sparse_vmemmap_init_nid_early(); it only clears section_mem_map for the rest: if (!preinited_vmemmap_section(ms)) ms->section_mem_map = 0; A leftover line after that conditional block ms->section_mem_map = 0; was supposed to be deleted but was missed in the failure path, causing the field to be overwritten for all sections when memory allocation fails, effectively destroying the pre-initialization check. Drop the stray assignment so that preinited sections retain their already valid state. Those pre-inited sections (HugeTLB pages) are not activated. However, such failures are extremely rare, so I don't see any major userspace issues. Link: https://lore.kernel.org/20260331113724.2080833-1-songmuchun@bytedance.com Fixes: d65917c42373 ("mm/sparse: allow for alternate vmemmap section init at boot") Signed-off-by: Muchun Song Acked-by: David Hildenbrand (Arm) Reviewed by: Donet Tom Cc: David Hildenbrand Cc: Frank van der Linden Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit e3668b371329ea036ff022ce8ecc82f8befcf003 Author: Sergey Senozhatsky Date: Tue Mar 31 16:42:44 2026 +0900 zram: do not forget to endio for partial discard requests As reported by Qu Wenruo and Avinesh Kumar, the following getconf PAGESIZE 65536 blkdiscard -p 4k /dev/zram0 takes literally forever to complete. zram doesn't support partial discards and just returns immediately w/o doing any discard work in such cases. The problem is that we forget to endio on our way out, so blkdiscard sleeps forever in submit_bio_wait(). Fix this by jumping to end_bio label, which does bio_endio(). Link: https://lore.kernel.org/20260331074255.777019-1-senozhatsky@chromium.org Fixes: 0120dd6e4e20 ("zram: make zram_bio_discard more self-contained") Signed-off-by: Sergey Senozhatsky Reported-by: Qu Wenruo Closes: https://lore.kernel.org/linux-block/92361cd3-fb8b-482e-bc89-15ff1acb9a59@suse.com Tested-by: Qu Wenruo Reported-by: Avinesh Kumar Closes: https://bugzilla.suse.com/show_bug.cgi?id=1256530 Reviewed-by: Christoph Hellwig Cc: Brian Geffon Cc: Jens Axboe Cc: Minchan Kim Cc: Signed-off-by: Andrew Morton commit af69016dab967346f759016ca503ebc61dd048b5 Author: Alistair Popple Date: Tue Mar 31 17:34:45 2026 +1100 lib: test_hmm: implement a device release method Unloading the HMM test module produces the following warning: [ 3782.224783] ------------[ cut here ]------------ [ 3782.226323] Device 'hmm_dmirror0' does not have a release() function, it is broken and must be fixed. See Documentation/core-api/kobject.rst. [ 3782.230570] WARNING: drivers/base/core.c:2567 at device_release+0x185/0x210, CPU#20: rmmod/1924 [ 3782.233949] Modules linked in: test_hmm(-) nvidia_uvm(O) nvidia(O) [ 3782.236321] CPU: 20 UID: 0 PID: 1924 Comm: rmmod Tainted: G O 7.0.0-rc1+ #374 PREEMPT(full) [ 3782.240226] Tainted: [O]=OOT_MODULE [ 3782.241639] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 3782.246193] RIP: 0010:device_release+0x185/0x210 [ 3782.247860] Code: 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 86 00 00 00 48 8b 73 50 48 85 f6 74 11 48 8d 3d db 25 29 03 <67> 48 0f b9 3a e9 0d ff ff ff 48 b8 00 00 00 00 00 fc ff df 48 89 [ 3782.254211] RSP: 0018:ffff888126577d98 EFLAGS: 00010246 [ 3782.256054] RAX: dffffc0000000000 RBX: ffffffffc2b70310 RCX: ffffffff8fe61ba1 [ 3782.258512] RDX: 1ffffffff856e062 RSI: ffff88811341eea0 RDI: ffffffff91bbacb0 [ 3782.261041] RBP: ffff888111475000 R08: 0000000000000001 R09: fffffbfff856e069 [ 3782.263471] R10: ffffffffc2b7034b R11: 00000000ffffffff R12: 0000000000000000 [ 3782.265983] R13: dffffc0000000000 R14: ffff88811341eea0 R15: 0000000000000000 [ 3782.268443] FS: 00007fd5a3689040(0000) GS:ffff88842c8d0000(0000) knlGS:0000000000000000 [ 3782.271236] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3782.273251] CR2: 00007fd5a36d2c10 CR3: 00000001242b8000 CR4: 00000000000006f0 [ 3782.275362] Call Trace: [ 3782.276071] [ 3782.276678] kobject_put+0x146/0x270 [ 3782.277731] hmm_dmirror_exit+0x7a/0x130 [test_hmm] [ 3782.279135] __do_sys_delete_module+0x341/0x510 [ 3782.280438] ? module_flags+0x300/0x300 [ 3782.281547] do_syscall_64+0x111/0x670 [ 3782.282620] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 3782.284091] RIP: 0033:0x7fd5a3793b37 [ 3782.285303] Code: 73 01 c3 48 8b 0d c9 82 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 99 82 0c 00 f7 d8 64 89 01 48 [ 3782.290708] RSP: 002b:00007ffd68b7dc68 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 3782.292817] RAX: ffffffffffffffda RBX: 000055e3c0d1c770 RCX: 00007fd5a3793b37 [ 3782.294735] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055e3c0d1c7d8 [ 3782.296661] RBP: 0000000000000000 R08: 1999999999999999 R09: 0000000000000000 [ 3782.298622] R10: 00007fd5a3806ac0 R11: 0000000000000206 R12: 00007ffd68b7deb0 [ 3782.300576] R13: 00007ffd68b7e781 R14: 000055e3c0d1b2a0 R15: 00007ffd68b7deb8 [ 3782.301963] [ 3782.302371] irq event stamp: 5019 [ 3782.302987] hardirqs last enabled at (5027): [] __up_console_sem+0x52/0x60 [ 3782.304507] hardirqs last disabled at (5036): [] __up_console_sem+0x37/0x60 [ 3782.306086] softirqs last enabled at (4940): [] __irq_exit_rcu+0xc0/0xf0 [ 3782.307567] softirqs last disabled at (4929): [] __irq_exit_rcu+0xc0/0xf0 [ 3782.309105] ---[ end trace 0000000000000000 ]--- This is because the test module doesn't have a device.release method. In this case one probably isn't needed for correctness - the device structs are in a static array so don't need freeing when the final reference goes away. However some device state is freed on exit, so to ensure this happens at the right time and to silence the warning move the deinitialisation to a release method and assign that as the device release callback. Whilst here also fix a minor error handling bug where cdev_device_del() wasn't being called if allocation failed. Link: https://lore.kernel.org/20260331063445.3551404-4-apopple@nvidia.com Fixes: 6a760f58c792 ("mm/hmm/test: use char dev with struct device to get device node") Signed-off-by: Alistair Popple Acked-by: Balbir Singh Tested-by: Zenghui Yu (Huawei) Cc: David Hildenbrand Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Matthew Brost Cc: Signed-off-by: Andrew Morton commit f9d7975c52c00b3685cf9a90a81023d17817d991 Author: Alistair Popple Date: Tue Mar 31 17:34:44 2026 +1100 selftests/mm: hmm-tests: don't hardcode THP size to 2MB Several HMM tests hardcode TWOMEG as the THP size. This is wrong on architectures where the PMD size is not 2MB such as arm64 with 64K base pages where THP is 512MB. Fix this by using read_pmd_pagesize() from vm_util instead. While here also replace the custom file_read_ulong() helper used to parse the default hugetlbfs page size from /proc/meminfo with the existing default_huge_page_size() from vm_util. Link: https://lore.kernel.org/20260331063445.3551404-3-apopple@nvidia.com Link: https://lore.kernel.org/linux-mm/8bd0396a-8997-4d2e-a13f-5aac033083d7@linux.dev/ Fixes: fee9f6d1b8df ("mm/hmm/test: add selftests for HMM") Fixes: 519071529d2a ("selftests/mm/hmm-tests: new tests for zone device THP migration") Signed-off-by: Alistair Popple Reported-by: Zenghui Yu Closes: https://lore.kernel.org/linux-mm/8bd0396a-8997-4d2e-a13f-5aac033083d7@linux.dev/ Reviewed-by: Balbir Singh Cc: Matthew Brost Cc: David Hildenbrand Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit 744dd97752ef1076a8d8672bb0d8aa2c7abc1144 Author: Alistair Popple Date: Tue Mar 31 17:34:43 2026 +1100 lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the problems. This patch (of 3): When dmirror_fops_release() is called it frees the dmirror struct but doesn't migrate device private pages back to system memory first. This leaves those pages with a dangling zone_device_data pointer to the freed dmirror. If a subsequent fault occurs on those pages (eg. during coredump) the dmirror_devmem_fault() callback dereferences the stale pointer causing a kernel panic. This was reported [1] when running mm/ksft_hmm.sh on arm64, where a test failure triggered SIGABRT and the resulting coredump walked the VMAs faulting in the stale device private pages. Fix this by calling dmirror_device_evict_chunk() for each devmem chunk in dmirror_fops_release() to migrate all device private pages back to system memory before freeing the dmirror struct. The function is moved earlier in the file to avoid a forward declaration. Link: https://lore.kernel.org/20260331063445.3551404-1-apopple@nvidia.com Link: https://lore.kernel.org/20260331063445.3551404-2-apopple@nvidia.com Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM") Signed-off-by: Alistair Popple Reported-by: Zenghui Yu Closes: https://lore.kernel.org/linux-mm/8bd0396a-8997-4d2e-a13f-5aac033083d7@linux.dev/ Reviewed-by: Balbir Singh Tested-by: Zenghui Yu Cc: David Hildenbrand Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Zenghui Yu Cc: Matthew Brost Cc: Signed-off-by: Andrew Morton commit 047a6d494033db26736b19e247851632cd74959d Author: Li Wang Date: Wed Apr 1 17:05:20 2026 +0800 selftests/mm: skip hugetlb_dio tests when DIO alignment is incompatible hugetlb_dio test uses sub-page offsets (pagesize / 2) to verify that hugepages used as DIO user buffers are correctly unpinned at completion. However, on filesystems with a logical block size larger than half the page size (e.g., 4K-sector block devices), these unaligned DIO writes are rejected with -EINVAL, causing the test to fail unexpectedly. Add get_dio_alignment() to query the filesystem's required DIO alignment via statx(STATX_DIOALIGN) and skip individual test cases whose file offset or write size is not a multiple of that alignment. Aligned cases continue to run so the core coverage is preserved. While here, open the temporary file once in main() and share the fd across all test cases instead of reopening it in each invocation. === Reproduce Steps === # dd if=/dev/zero of=/tmp/test.img bs=1M count=512 # losetup --sector-size 4096 /dev/loop0 /tmp/test.img # mkfs.xfs /dev/loop0 # mkdir -p /mnt/dio_test # mount /dev/loop0 /mnt/dio_test // Modify test to open /mnt/dio_test and rebuild it: - fd = open("/tmp", O_TMPFILE | O_RDWR | O_DIRECT, 0664); + fd = open("/mnt/dio_test", O_TMPFILE | O_RDWR | O_DIRECT, 0664); # getconf PAGESIZE 4096 # echo 100 >/proc/sys/vm/nr_hugepages # ./hugetlb_dio TAP version 13 1..4 # No. Free pages before allocation : 100 # No. Free pages after munmap : 100 ok 1 free huge pages from 0-12288 Bail out! Error writing to file : Invalid argument (22) # Planned tests != run tests (4 != 1) # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 Link: https://lore.kernel.org/20260401090520.24018-1-liwang@redhat.com Signed-off-by: Li Wang Suggested-by: Mike Rapoport Suggested-by: David Hildenbrand Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 84f4928446e65b9f3f142809f192edf46f67e380 Author: Lorenzo Stoakes (Oracle) Date: Tue Mar 31 08:36:27 2026 +0100 tools/testing/selftests: add merge test for partial msealed range Commit 2697dd8ae721 ("mm/mseal: update VMA end correctly on merge") fixed an issue in the loop which iterates through VMAs applying mseal, which was triggered by mseal()'ing a range of VMAs where the second was mseal()'d and the first mergeable with it, once mseal()'d. Add a regression test to assert that this behaviour is correct. We place it in the merge selftests as this is strictly an issue with merging (via a vma_modify() invocation). It also asserts that mseal()'d ranges are correctly merged as you'd expect. The test is implemented such that it is skipped if mseal() is not available on the system. [rppt@kernel.org: fix inclusions, to fix handle_uprobe_upon_merged_vma()] Link: https://lore.kernel.org/ac_mCIUQWRAbuH8F@kernel.org [ljs@kernel.org: simplifications per Pedro] Link: https://lore.kernel.org/1c9c922d-5cb5-4cff-9273-b737cdb57ca1@lucifer.local Link: https://lore.kernel.org/20260331073627.50010-1-ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Signed-off-by: Mike Rapoport Cc: David Hildenbrand Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Pedro Falcato Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6fae274ce0e3109cbbc4c18b354eaace1f0af7d7 Author: Jackie Liu Date: Wed Apr 1 08:57:02 2026 +0800 mm/mempolicy: fix memory leaks in weighted_interleave_auto_store() weighted_interleave_auto_store() fetches old_wi_state inside the if (!input) block only. This causes two memory leaks: 1. When a user writes "false" and the current mode is already manual, the function returns early without freeing the freshly allocated new_wi_state. 2. When a user writes "true", old_wi_state stays NULL because the fetch is skipped entirely. The old state is then overwritten by rcu_assign_pointer() but never freed, since the cleanup path is gated on old_wi_state being non-NULL. A user can trigger this repeatedly by writing "1" in a loop. Fix both leaks by moving the old_wi_state fetch before the input check, making it unconditional. This also allows a unified early return for both "true" and "false" when the requested mode matches the current mode. Link: https://lore.kernel.org/20260401005702.7096-1-liu.yun@linux.dev Link: https://sashiko.dev/#/patchset/20260331100740.84906-1-liu.yun@linux.dev Fixes: e341f9c3c841 ("mm/mempolicy: Weighted Interleave Auto-tuning") Signed-off-by: Jackie Liu Reviewed-by: Joshua Hahn Reviewed by: Donet Tom Cc: Gregory Price Cc: Alistair Popple Cc: Byungchul Park Cc: David Hildenbrand Cc: # v6.16+ Signed-off-by: Andrew Morton commit 0c13ed77dd2bc1c2d46db8ef27721213742cccd8 Author: SeongJae Park Date: Sun Mar 29 08:30:50 2026 -0700 Docs/admin-guide/mm/damon/lru_sort: warn commit_inputs vs param updates race DAMON_LRU_SORT handles commit_inputs request inside kdamond thread, reading the module parameters. If the user updates the module parameters while the kdamond thread is reading those, races can happen. To avoid this, the commit_inputs parameter shows whether it is still in the progress, assuming users wouldn't update parameters in the middle of the work. Some users might ignore that. Add a warning about the behavior. The issue was discovered in [1] by sashiko. Link: https://lore.kernel.org/20260329153052.46657-3-sj@kernel.org Link: https://lore.kernel.org/20260319161620.189392-2-objecting@objecting.org [1] Fixes: 6acfcd0d7524 ("Docs/admin-guide/damon: add a document for DAMON_LRU_SORT") Signed-off-by: SeongJae Park Cc: # 6.0.x Signed-off-by: Andrew Morton commit 0beba407d4585a15b0dc09f2064b5b3ddcb0e857 Author: SeongJae Park Date: Sun Mar 29 08:30:49 2026 -0700 Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race Patch series "Docs/admin-guide/mm/damon: warn commit_inputs vs other params race". Writing 'Y' to the commit_inputs parameter of DAMON_RECLAIM and DAMON_LRU_SORT, and writing other parameters before the commit_inputs request is completely processed can cause race conditions. While the consequence can be bad, the documentation is not clearly describing that. Add clear warnings. The issue was discovered [1,2] by sashiko. This patch (of 2): DAMON_RECLAIM handles commit_inputs request inside kdamond thread, reading the module parameters. If the user updates the module parameters while the kdamond thread is reading those, races can happen. To avoid this, the commit_inputs parameter shows whether it is still in the progress, assuming users wouldn't update parameters in the middle of the work. Some users might ignore that. Add a warning about the behavior. The issue was discovered in [1] by sashiko. Link: https://lore.kernel.org/20260329153052.46657-2-sj@kernel.org Link: https://lore.kernel.org/20260319161620.189392-3-objecting@objecting.org [1] Link: https://lore.kernel.org/20260319161620.189392-2-objecting@objecting.org [3] Fixes: 81a84182c343 ("Docs/admin-guide/mm/damon/reclaim: document 'commit_inputs' parameter") Signed-off-by: SeongJae Park Cc: # 5.19.x Signed-off-by: Andrew Morton commit 049a57421dd67a28c45ae7e92c36df758033e5fa Author: SeongJae Park Date: Sun Mar 29 08:23:05 2026 -0700 mm/damon/core: use time_in_range_open() for damos quota window start damos_adjust_quota() uses time_after_eq() to show if it is time to start a new quota charge window, comparing the current jiffies and the scheduled next charge window start time. If it is, the next charge window start time is updated and the new charge window starts. The time check and next window start time update is skipped while the scheme is deactivated by the watermarks. Let's suppose the deactivation is kept more than LONG_MAX jiffies (assuming CONFIG_HZ of 250, more than 99 days in 32 bit systems and more than one billion years in 64 bit systems), resulting in having the jiffies larger than the next charge window start time + LONG_MAX. Then, the time_after_eq() call can return false until another LONG_MAX jiffies are passed. This means the scheme can continue working after being reactivated by the watermarks. But, soon, the quota will be exceeded and the scheme will again effectively stop working until the next charge window starts. Because the current charge window is extended to up to LONG_MAX jiffies, however, it will look like it stopped unexpectedly and indefinitely, from the user's perspective. Fix this by using !time_in_range_open() instead. The issue was discovered [1] by sashiko. Link: https://lore.kernel.org/20260329152306.45796-1-sj@kernel.org Link: https://lore.kernel.org/20260324040722.57944-1-sj@kernel.org [1] Fixes: ee801b7dd782 ("mm/damon/schemes: activate schemes based on a watermarks mechanism") Signed-off-by: SeongJae Park Cc: # 5.16.x Signed-off-by: Andrew Morton commit a34dac6482e53e2c76944f25b1489b9b7da3a6e6 Author: SeongJae Park Date: Sat Mar 28 21:39:00 2026 -0700 mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp Users can set damos_quota_goal->nid with arbitrary value for node_memcg_{used,free}_bp. But DAMON core is using those for NODE-DATA() without a validation of the value. This can result in out of bounds memory access. The issue can actually triggered using DAMON user-space tool (damo), like below. $ sudo mkdir /sys/fs/cgroup/foo $ sudo ./damo start --damos_action stat --damos_quota_interval 1s \ --damos_quota_goal node_memcg_used_bp 50% -1 /foo $ sudo dmseg [...] [ 524.181426] Unable to handle kernel paging request at virtual address 0000000000002c00 Fix this issue by adding the validation of the given node id. If an invalid node id is given, it returns 0% for used memory ratio, and 100% for free memory ratio. Link: https://lore.kernel.org/20260329043902.46163-3-sj@kernel.org Fixes: b74a120bcf50 ("mm/damon/core: implement DAMOS_QUOTA_NODE_MEMCG_USED_BP") Signed-off-by: SeongJae Park Cc: # 6.19.x Signed-off-by: Andrew Morton commit 40250b2dded0604a112be605f3828700d80ad7c2 Author: SeongJae Park Date: Sat Mar 28 21:38:59 2026 -0700 mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp Patch series "mm/damon/core: validate damos_quota_goal->nid". node_mem[cg]_{used,free}_bp DAMOS quota goals receive the node id. The node id is used for si_meminfo_node() and NODE_DATA() without proper validation. As a result, privileged users can trigger an out of bounds memory access using DAMON_SYSFS. Fix the issues. The issue was originally reported [1] with a fix by another author. The original author announced [2] that they will stop working including the fix that was still in the review stage. Hence I'm restarting this. This patch (of 2): Users can set damos_quota_goal->nid with arbitrary value for node_mem_{used,free}_bp. But DAMON core is using those for si_meminfo_node() without the validation of the value. This can result in out of bounds memory access. The issue can actually triggered using DAMON user-space tool (damo), like below. $ sudo ./damo start --damos_action stat \ --damos_quota_goal node_mem_used_bp 50% -1 \ --damos_quota_interval 1s $ sudo dmesg [...] [ 65.565986] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 Fix this issue by adding the validation of the given node. If an invalid node id is given, it returns 0% for used memory ratio, and 100% for free memory ratio. Link: https://lore.kernel.org/20260329043902.46163-2-sj@kernel.org Link: https://lore.kernel.org/20260325073034.140353-1-objecting@objecting.org [1] Link: https://lore.kernel.org/20260327040924.68553-1-sj@kernel.org [2] Fixes: 0e1c773b501f ("mm/damon/core: introduce damos quota goal metrics for memory node utilization") Signed-off-by: SeongJae Park Cc: # 6.16.x Signed-off-by: Andrew Morton commit e04ed278d25bf15769800bf6e35c6737f137186f Author: Jackie Liu Date: Tue Mar 31 18:15:53 2026 +0800 mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start() Destroy the DAMON context and reset the global pointer when damon_start() fails. Otherwise, the context allocated by damon_stat_build_ctx() is leaked, and the stale damon_stat_context pointer will be overwritten on the next enable attempt, making the old allocation permanently unreachable. Link: https://lore.kernel.org/20260331101553.88422-1-liu.yun@linux.dev Fixes: 369c415e6073 ("mm/damon: introduce DAMON_STAT module") Signed-off-by: Jackie Liu Reviewed-by: SeongJae Park Cc: # 6.17.x Signed-off-by: Andrew Morton commit 33c3f6c2b48cd84b441dba1ee3e62290e53930f4 Author: SeongJae Park Date: Fri Mar 27 16:33:15 2026 -0700 mm/damon/core: fix damos_walk() vs kdamond_fn() exit race When kdamond_fn() main loop is finished, the function cancels remaining damos_walk() request and unset the damon_ctx->kdamond so that API callers and API functions themselves can show the context is terminated. damos_walk() adds the caller's request to the queue first. After that, it shows if the kdamond of the damon_ctx is still running (damon_ctx->kdamond is set). Only if the kdamond is running, damos_walk() starts waiting for the kdamond's handling of the newly added request. The damos_walk() requests registration and damon_ctx->kdamond unset are protected by different mutexes, though. Hence, damos_walk() could race with damon_ctx->kdamond unset, and result in deadlocks. For example, let's suppose kdamond successfully finished the damow_walk() request cancelling. Right after that, damos_walk() is called for the context. It registers the new request, and shows the context is still running, because damon_ctx->kdamond unset is not yet done. Hence the damos_walk() caller starts waiting for the handling of the request. However, the kdamond is already on the termination steps, so it never handles the new request. As a result, the damos_walk() caller thread infinitely waits. Fix this by introducing another damon_ctx field, namely walk_control_obsolete. It is protected by the damon_ctx->walk_control_lock, which protects damos_walk() request registration. Initialize (unset) it in kdamond_fn() before letting damon_start() returns and set it just before the cancelling of the remaining damos_walk() request is executed. damos_walk() reads the obsolete field under the lock and avoids adding a new request. After this change, only requests that are guaranteed to be handled or cancelled are registered. Hence the after-registration DAMON context termination check is no longer needed. Remove it together. The issue is found by sashiko [1]. Link: https://lore.kernel.org/20260327233319.3528-3-sj@kernel.org Link: https://lore.kernel.org/20260325141956.87144-1-sj@kernel.org [1] Fixes: bf0eaba0ff9c ("mm/damon/core: implement damos_walk()") Signed-off-by: SeongJae Park Cc: # 6.14.x Signed-off-by: Andrew Morton commit 55da81663b9642dd046b26dd6f1baddbcf337c1e Author: SeongJae Park Date: Fri Mar 27 16:33:14 2026 -0700 mm/damon/core: fix damon_call() vs kdamond_fn() exit race Patch series "mm/damon/core: fix damon_call()/damos_walk() vs kdmond exit race". damon_call() and damos_walk() can leak memory and/or deadlock when they race with kdamond terminations. Fix those. This patch (of 2); When kdamond_fn() main loop is finished, the function cancels all remaining damon_call() requests and unset the damon_ctx->kdamond so that API callers and API functions themselves can know the context is terminated. damon_call() adds the caller's request to the queue first. After that, it shows if the kdamond of the damon_ctx is still running (damon_ctx->kdamond is set). Only if the kdamond is running, damon_call() starts waiting for the kdamond's handling of the newly added request. The damon_call() requests registration and damon_ctx->kdamond unset are protected by different mutexes, though. Hence, damon_call() could race with damon_ctx->kdamond unset, and result in deadlocks. For example, let's suppose kdamond successfully finished the damon_call() requests cancelling. Right after that, damon_call() is called for the context. It registers the new request, and shows the context is still running, because damon_ctx->kdamond unset is not yet done. Hence the damon_call() caller starts waiting for the handling of the request. However, the kdamond is already on the termination steps, so it never handles the new request. As a result, the damon_call() caller threads infinitely waits. Fix this by introducing another damon_ctx field, namely call_controls_obsolete. It is protected by the damon_ctx->call_controls_lock, which protects damon_call() requests registration. Initialize (unset) it in kdamond_fn() before letting damon_start() returns and set it just before the cancelling of remaining damon_call() requests is executed. damon_call() reads the obsolete field under the lock and avoids adding a new request. After this change, only requests that are guaranteed to be handled or cancelled are registered. Hence the after-registration DAMON context termination check is no longer needed. Remove it together. Note that the deadlock will not happen when damon_call() is called for repeat mode request. In tis case, damon_call() returns instead of waiting for the handling when the request registration succeeds and it shows the kdamond is running. However, if the request also has dealloc_on_cancel, the request memory would be leaked. The issue is found by sashiko [1]. Link: https://lore.kernel.org/20260327233319.3528-1-sj@kernel.org Link: https://lore.kernel.org/20260327233319.3528-2-sj@kernel.org Link: https://lore.kernel.org/20260325141956.87144-1-sj@kernel.org [1] Fixes: 42b7491af14c ("mm/damon/core: introduce damon_call()") Signed-off-by: SeongJae Park Cc: # 6.14.x Signed-off-by: Andrew Morton commit ef3c0f6cb798e2602a8d8ee3f669fb1cc52345ce Author: Kanchana P. Sridhar Date: Tue Mar 31 11:33:51 2026 -0700 mm: zswap: tie per-CPU acomp_ctx lifetime to the pool Currently, per-CPU acomp_ctx are allocated on pool creation and/or CPU hotplug, and destroyed on pool destruction or CPU hotunplug. This complicates the lifetime management to save memory while a CPU is offlined, which is not very common. Simplify lifetime management by allocating per-CPU acomp_ctx once on pool creation (or CPU hotplug for CPUs onlined later), and keeping them allocated until the pool is destroyed. Refactor cleanup code from zswap_cpu_comp_dead() into acomp_ctx_free() to be used elsewhere. The main benefit of using the CPU hotplug multi state instance startup callback to allocate the acomp_ctx resources is that it prevents the cores from being offlined until the multi state instance addition call returns. From Documentation/core-api/cpu_hotplug.rst: "The node list add/remove operations and the callback invocations are serialized against CPU hotplug operations." Furthermore, zswap_[de]compress() cannot contend with zswap_cpu_comp_prepare() because: - During pool creation/deletion, the pool is not in the zswap_pools list. - During CPU hot[un]plug, the CPU is not yet online, as Yosry pointed out. zswap_cpu_comp_prepare() will be run on a control CPU, since CPUHP_MM_ZSWP_POOL_PREPARE is in the PREPARE section of "enum cpuhp_state". In both these cases, any recursions into zswap reclaim from zswap_cpu_comp_prepare() will be handled by the old pool. The above two observations enable the following simplifications: 1) zswap_cpu_comp_prepare(): a) acomp_ctx mutex locking: If the process gets migrated while zswap_cpu_comp_prepare() is running, it will complete on the new CPU. In case of failures, we pass the acomp_ctx pointer obtained at the start of zswap_cpu_comp_prepare() to acomp_ctx_free(), which again, can only undergo migration. There appear to be no contention scenarios that might cause inconsistent values of acomp_ctx's members. Hence, it seems there is no need for mutex_lock(&acomp_ctx->mutex) in zswap_cpu_comp_prepare(). b) acomp_ctx mutex initialization: Since the pool is not yet on zswap_pools list, we don't need to initialize the per-CPU acomp_ctx mutex in zswap_pool_create(). This has been restored to occur in zswap_cpu_comp_prepare(). c) Subsequent CPU offline-online transitions: zswap_cpu_comp_prepare() checks upfront if acomp_ctx->acomp is valid. If so, it returns success. This should handle any CPU hotplug online-offline transitions after pool creation is done. 2) CPU offline vis-a-vis zswap ops: Let's suppose the process is migrated to another CPU before the current CPU is dysfunctional. If zswap_[de]compress() holds the acomp_ctx->mutex lock of the offlined CPU, that mutex will be released once it completes on the new CPU. Since there is no teardown callback, there is no possibility of UAF. 3) Pool creation/deletion and process migration to another CPU: During pool creation/deletion, the pool is not in the zswap_pools list. Hence it cannot contend with zswap ops on that CPU. However, the process can get migrated. a) Pool creation --> zswap_cpu_comp_prepare() --> process migrated: * Old CPU offline: no-op. * zswap_cpu_comp_prepare() continues to run on the new CPU to finish allocating acomp_ctx resources for the offlined CPU. b) Pool deletion --> acomp_ctx_free() --> process migrated: * Old CPU offline: no-op. * acomp_ctx_free() continues to run on the new CPU to finish de-allocating acomp_ctx resources for the offlined CPU. 4) Pool deletion vis-a-vis CPU onlining: The call to cpuhp_state_remove_instance() cannot race with zswap_cpu_comp_prepare() because of hotplug synchronization. The current acomp_ctx_get_cpu_lock()/acomp_ctx_put_unlock() are deleted. Instead, zswap_[de]compress() directly call mutex_[un]lock(&acomp_ctx->mutex). The per-CPU memory cost of not deleting the acomp_ctx resources upon CPU offlining, and only deleting them when the pool is destroyed, is 8.28 KB on x86_64. This cost is only paid when a CPU is offlined, until it is onlined again. Link: https://lore.kernel.org/20260331183351.29844-3-kanchanapsridhar2026@gmail.com Co-developed-by: Kanchana P. Sridhar Signed-off-by: Kanchana P. Sridhar Signed-off-by: Kanchana P Sridhar Acked-by: Yosry Ahmed Cc: Chengming Zhou Cc: Herbert Xu Cc: Johannes Weiner Cc: Nhat Pham Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton commit 1556478e9e86585d4c48fcddb8f490713bd78156 Author: Kanchana P. Sridhar Date: Tue Mar 31 11:33:50 2026 -0700 mm: zswap: remove redundant checks in zswap_cpu_comp_dead() Patch series "zswap pool per-CPU acomp_ctx simplifications", v3. This patchset first removes redundant checks on the acomp_ctx and its "req" member in zswap_cpu_comp_dead(). Next, it persists the zswap pool's per-CPU acomp_ctx resources to last until the pool is destroyed. It then simplifies the per-CPU acomp_ctx mutex locking in zswap_compress()/zswap_decompress(). Code comments added after allocation and before checking to deallocate the per-CPU acomp_ctx's members, based on expected crypto API return values and zswap changes this patchset makes. Patch 2 is an independent submission of patch 23 from [1], to facilitate merging. This patch (of 2): There are presently redundant checks on the per-CPU acomp_ctx and it's "req" member in zswap_cpu_comp_dead(): redundant because they are inconsistent with zswap_pool_create() handling of failure in allocating the acomp_ctx, and with the expected NULL return value from the acomp_request_alloc() API when it fails to allocate an acomp_req. Fix these by converting to them to be NULL checks. Add comments in zswap_cpu_comp_prepare() clarifying the expected return values of the crypto_alloc_acomp_node() and acomp_request_alloc() API. Link: https://lore.kernel.org/20260331183351.29844-2-kanchanapsridhar2026@gmail.com Link: https://patchwork.kernel.org/project/linux-mm/list/?series=1046677 Signed-off-by: Kanchana P. Sridhar Suggested-by: Yosry Ahmed Acked-by: Yosry Ahmed Signed-off-by: Andrew Morton commit 6b1842775a460245e97d36d3a67d0cfba7c4ff79 Author: Hao Ge Date: Tue Mar 31 16:13:12 2026 +0800 mm/alloc_tag: clear codetag for pages allocated before page_ext initialization Due to initialization ordering, page_ext is allocated and initialized relatively late during boot. Some pages have already been allocated and freed before page_ext becomes available, leaving their codetag uninitialized. A clear example is in init_section_page_ext(): alloc_page_ext() calls kmemleak_alloc(). If the slab cache has no free objects, it falls back to the buddy allocator to allocate memory. However, at this point page_ext is not yet fully initialized, so these newly allocated pages have no codetag set. These pages may later be reclaimed by KASAN, which causes the warning to trigger when they are freed because their codetag ref is still empty. Use a global array to track pages allocated before page_ext is fully initialized. The array size is fixed at 8192 entries, and will emit a warning if this limit is exceeded. When page_ext initialization completes, set their codetag to empty to avoid warnings when they are freed later. This warning is only observed with CONFIG_MEM_ALLOC_PROFILING_DEBUG=Y and mem_profiling_compressed disabled: [ 9.582133] ------------[ cut here ]------------ [ 9.582137] alloc_tag was not set [ 9.582139] WARNING: ./include/linux/alloc_tag.h:164 at __pgalloc_tag_sub+0x40f/0x550, CPU#5: systemd/1 [ 9.582190] CPU: 5 UID: 0 PID: 1 Comm: systemd Not tainted 7.0.0-rc4 #1 PREEMPT(lazy) [ 9.582192] Hardware name: Red Hat KVM, BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 9.582194] RIP: 0010:__pgalloc_tag_sub+0x40f/0x550 [ 9.582196] Code: 00 00 4c 29 e5 48 8b 05 1f 88 56 05 48 8d 4c ad 00 48 8d 2c c8 e9 87 fd ff ff 0f 0b 0f 0b e9 f3 fe ff ff 48 8d 3d 61 2f ed 03 <67> 48 0f b9 3a e9 b3 fd ff ff 0f 0b eb e4 e8 5e cd 14 02 4c 89 c7 [ 9.582197] RSP: 0018:ffffc9000001f940 EFLAGS: 00010246 [ 9.582200] RAX: dffffc0000000000 RBX: 1ffff92000003f2b RCX: 1ffff110200d806c [ 9.582201] RDX: ffff8881006c0360 RSI: 0000000000000004 RDI: ffffffff9bc7b460 [ 9.582202] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff3a62324 [ 9.582203] R10: ffffffff9d311923 R11: 0000000000000000 R12: ffffea0004001b00 [ 9.582204] R13: 0000000000002000 R14: ffffea0000000000 R15: ffff8881006c0360 [ 9.582206] FS: 00007ffbbcf2d940(0000) GS:ffff888450479000(0000) knlGS:0000000000000000 [ 9.582208] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9.582210] CR2: 000055ee3aa260d0 CR3: 0000000148b67005 CR4: 0000000000770ef0 [ 9.582211] PKRU: 55555554 [ 9.582212] Call Trace: [ 9.582213] [ 9.582214] ? __pfx___pgalloc_tag_sub+0x10/0x10 [ 9.582216] ? check_bytes_and_report+0x68/0x140 [ 9.582219] __free_frozen_pages+0x2e4/0x1150 [ 9.582221] ? __free_slab+0xc2/0x2b0 [ 9.582224] qlist_free_all+0x4c/0xf0 [ 9.582227] kasan_quarantine_reduce+0x15d/0x180 [ 9.582229] __kasan_slab_alloc+0x69/0x90 [ 9.582232] kmem_cache_alloc_noprof+0x14a/0x500 [ 9.582234] do_getname+0x96/0x310 [ 9.582237] do_readlinkat+0x91/0x2f0 [ 9.582239] ? __pfx_do_readlinkat+0x10/0x10 [ 9.582240] ? get_random_bytes_user+0x1df/0x2c0 [ 9.582244] __x64_sys_readlinkat+0x96/0x100 [ 9.582246] do_syscall_64+0xce/0x650 [ 9.582250] ? __x64_sys_getrandom+0x13a/0x1e0 [ 9.582252] ? __pfx___x64_sys_getrandom+0x10/0x10 [ 9.582254] ? do_syscall_64+0x114/0x650 [ 9.582255] ? ksys_read+0xfc/0x1d0 [ 9.582258] ? __pfx_ksys_read+0x10/0x10 [ 9.582260] ? do_syscall_64+0x114/0x650 [ 9.582262] ? do_syscall_64+0x114/0x650 [ 9.582264] ? __pfx_fput_close_sync+0x10/0x10 [ 9.582266] ? file_close_fd_locked+0x178/0x2a0 [ 9.582268] ? __x64_sys_faccessat2+0x96/0x100 [ 9.582269] ? __x64_sys_close+0x7d/0xd0 [ 9.582271] ? do_syscall_64+0x114/0x650 [ 9.582273] ? do_syscall_64+0x114/0x650 [ 9.582275] ? clear_bhb_loop+0x50/0xa0 [ 9.582277] ? clear_bhb_loop+0x50/0xa0 [ 9.582279] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 9.582280] RIP: 0033:0x7ffbbda345ee [ 9.582282] Code: 0f 1f 40 00 48 8b 15 29 38 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 0b 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fa 37 0d 00 f7 d8 64 89 01 48 [ 9.582284] RSP: 002b:00007ffe2ad8de58 EFLAGS: 00000202 ORIG_RAX: 000000000000010b [ 9.582286] RAX: ffffffffffffffda RBX: 000055ee3aa25570 RCX: 00007ffbbda345ee [ 9.582287] RDX: 000055ee3aa25570 RSI: 00007ffe2ad8dee0 RDI: 00000000ffffff9c [ 9.582288] RBP: 0000000000001000 R08: 0000000000000003 R09: 0000000000001001 [ 9.582289] R10: 0000000000001000 R11: 0000000000000202 R12: 0000000000000033 [ 9.582290] R13: 00007ffe2ad8dee0 R14: 00000000ffffff9c R15: 00007ffe2ad8deb0 [ 9.582292] [ 9.582293] ---[ end trace 0000000000000000 ]--- Link: https://lore.kernel.org/20260331081312.123719-1-hao.ge@linux.dev Fixes: dcfe378c81f72 ("lib: introduce support for page allocation tagging") Signed-off-by: Hao Ge Suggested-by: Suren Baghdasaryan Acked-by: Suren Baghdasaryan Cc: Kent Overstreet Cc: Signed-off-by: Andrew Morton commit d14514c66cb9721b54318850796c005c446d76d6 Author: Suren Baghdasaryan Date: Sun Mar 22 00:08:43 2026 -0700 mm/vmscan: prevent MGLRU reclaim from pinning address space When shrinking lruvec, MGLRU pins address space before walking it. This is excessive since all it needs for walking the page range is a stable mm_struct to be able to take and release mmap_read_lock and a stable mm->mm_mt tree to walk. This address space pinning results in delays when releasing the memory of a dying process. This also prevents mm reapers (both in-kernel oom-reaper and userspace process_mrelease()) from doing their job during MGLRU scan because they check task_will_free_mem() which will yield negative result due to the elevated mm->mm_users. This affects the system in the sense that if the MM of the killed process is being reclaimed by kswapd then reapers won't be able to reap it. Even the process itself (which might have higher-priority than kswapd) will not free its memory until kswapd drops the last reference. IOW, we delay freeing the memory because kswapd is reclaiming it. In Android the visible result for us is that process_mrelease() (userspace reaper) skips MM in such cases and we see process memory not released for an unusually long time (secs). Replace unnecessary address space pinning with mm_struct pinning by replacing mmget/mmput with mmgrab/mmdrop calls. mm_mt is contained within mm_struct itself, therefore it won't be freed as long as mm_struct is stable and it won't change during the walk because mmap_read_lock is being held. Link: https://lore.kernel.org/20260322070843.941997-1-surenb@google.com Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks") Signed-off-by: Suren Baghdasaryan Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Johannes Weiner Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Wei Xu Cc: Yuanchu Xie Cc: Yu Zhao Cc: Kalesh Singh Signed-off-by: Andrew Morton commit 68750e820bc4095d25cf70002782c284e5702415 Author: Pasha Tatashin Date: Fri Mar 27 03:33:34 2026 +0000 liveupdate: defer file handler module refcounting to active sessions Stop pinning modules indefinitely upon file handler registration. Instead, dynamically increment the module reference count only when a live update session actively uses the file handler (e.g., during preservation or deserialization), and release it when the session ends. This allows modules providing live update handlers to be gracefully unloaded when no live update is in progress. Link: https://lore.kernel.org/20260327033335.696621-11-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav (Google) Cc: David Matlack Cc: Mike Rapoport Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 2ab7207e7ec6cd5af1912d9be5174f114633286b Author: Pasha Tatashin Date: Fri Mar 27 03:33:33 2026 +0000 liveupdate: make unregister functions return void Change liveupdate_unregister_file_handler and liveupdate_unregister_flb to return void instead of an error code. This follows the design principle that unregistration during module unload should not fail, as the unload cannot be stopped at that point. Link: https://lore.kernel.org/20260327033335.696621-10-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav (Google) Cc: David Matlack Cc: Mike Rapoport Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 074488008d6e745af067e968d6046f2c04b12537 Author: Pasha Tatashin Date: Fri Mar 27 03:33:32 2026 +0000 liveupdate: remove liveupdate_test_unregister() Now that file handler unregistration automatically unregisters all associated file handlers (FLBs), the liveupdate_test_unregister() function is no longer needed. Remove it along with its usages and declarations. Link: https://lore.kernel.org/20260327033335.696621-9-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav (Google) Cc: David Matlack Cc: Mike Rapoport Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 5ee1c7d6414a0b1cb7285bd4904b4969c0d9fab1 Author: Pasha Tatashin Date: Fri Mar 27 03:33:31 2026 +0000 liveupdate: auto unregister FLBs on file handler unregistration To ensure that unregistration is always successful and doesn't leave dangling resources, introduce auto-unregistration of FLBs: when a file handler is unregistered, all FLBs associated with it are automatically unregistered. Introduce a new helper luo_flb_unregister_all() which unregisters all FLBs linked to the given file handler. Link: https://lore.kernel.org/20260327033335.696621-8-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav (Google) Cc: David Matlack Cc: Mike Rapoport Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 118c3908242076c6e281c7010d29c2d0607c3190 Author: Pasha Tatashin Date: Fri Mar 27 03:33:30 2026 +0000 liveupdate: remove luo_session_quiesce() Now that FLB module references are handled dynamically during active sessions, we can safely remove the luo_session_quiesce() and luo_session_resume() mechanism. Link: https://lore.kernel.org/20260327033335.696621-7-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav (Google) Cc: David Matlack Cc: Mike Rapoport Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 76be9983df33aebd69716edaa8204ed90e72fef1 Author: Pasha Tatashin Date: Fri Mar 27 03:33:29 2026 +0000 liveupdate: defer FLB module refcounting to active sessions Stop pinning modules indefinitely upon FLB registration. Instead, dynamically take a module reference when the FLB is actively used in a session (e.g., during preserve and retrieve) and release it when the session concludes. This allows modules providing FLB operations to be cleanly unloaded when not in active use by the live update orchestrator. Link: https://lore.kernel.org/20260327033335.696621-6-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Samiullah Khawaja Reviewed-by: Pratyush Yadav (Google) Cc: David Matlack Cc: Mike Rapoport Signed-off-by: Andrew Morton commit 6b2b22f7c8cf1596490beaac96a989cbafdfea57 Author: Pasha Tatashin Date: Fri Mar 27 03:33:28 2026 +0000 liveupdate: protect FLB lists with luo_register_rwlock Because liveupdate FLB objects will soon drop their persistent module references when registered, list traversals must be protected against concurrent module unloading. To provide this protection, utilize the global luo_register_rwlock. It protects the global registry of FLBs and the handler's specific list of FLB dependencies. Read locks are used during concurrent list traversals (e.g., during preservation and serialization). Write locks are taken during registration and unregistration. Link: https://lore.kernel.org/20260327033335.696621-5-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav (Google) Cc: David Matlack Cc: Mike Rapoport Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 9e1e18584548e8ef8b37a2a7f5eb84b91e35a160 Author: Pasha Tatashin Date: Fri Mar 27 03:33:27 2026 +0000 liveupdate: protect file handler list with rwsem Because liveupdate file handlers will no longer hold a module reference when registered, we must ensure that the access to the handler list is protected against concurrent module unloading. Utilize the global luo_register_rwlock to protect the global registry of file handlers. Read locks are taken during list traversals in luo_preserve_file() and luo_file_deserialize(). Write locks are taken during registration and unregistration. Link: https://lore.kernel.org/20260327033335.696621-4-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav (Google) Cc: David Matlack Cc: Mike Rapoport Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 38fb71ace230bcf0106b6a09e7361c09255ba332 Author: Pasha Tatashin Date: Fri Mar 27 03:33:26 2026 +0000 liveupdate: synchronize lazy initialization of FLB private state The luo_flb_get_private() function, which is responsible for lazily initializing the private state of FLB objects, can be called concurrently from multiple threads. This creates a data race on the 'initialized' flag and can lead to multiple executions of mutex_init() and INIT_LIST_HEAD() on the same memory. Introduce a static spinlock (luo_flb_init_lock) local to the function to synchronize the initialization path. Use smp_load_acquire() and smp_store_release() for memory ordering between the fast path and the slow path. Link: https://lore.kernel.org/20260327033335.696621-3-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Cc: David Matlack Cc: Mike Rapoport Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 277f4e5e398b8c59148ebc33dbee8f9821f087eb Author: Pasha Tatashin Date: Fri Mar 27 03:33:25 2026 +0000 liveupdate: safely print untrusted strings Patch series "liveupdate: Fix module unloading and unregister API", v3. This patch series addresses an issue with how LUO handles module reference counting and unregistration during a module unload (e.g., via rmmod). Currently, modules that register live update file handlers are pinned for the entire duration they are registered. This prevents the modules from being unloaded gracefully, even when no live update session is in progress. Furthermore, if a module is forcefully unloaded, the unregistration functions return an error (e.g. -EBUSY) if a session is active, which is ignored by the kernel's module unload path, leaving dangling pointers in the LUO global lists. To resolve these issues, this series introduces the following changes: 1. Adds a global read-write semaphore (luo_register_rwlock) to protect the registration lists for both file handlers and FLBs. 2. Reduces the scope of module reference counting for file handlers and FLBs. Instead of pinning modules indefinitely upon registration, references are now taken only when they are actively used in a live update session (e.g., during preservation, retrieval, or deserialization). 3. Removes the global luo_session_quiesce() mechanism since module unload behavior now handles active sessions implicitly. 4. Introduces auto-unregistration of FLBs during file handler unregistration to prevent leaving dangling resources. 5. Changes the unregistration functions to return void instead of an error code. 6. Fixes a data race in luo_flb_get_private() by introducing a spinlock for thread-safe lazy initialization. 7. Strengthens security by using %.*s when printing untrusted deserialized compatible strings and session names to prevent out-of-bounds reads. This patch (of 10): Deserialized strings from KHO data (such as file handler compatible strings and session names) are provided by the previous kernel and might not be null-terminated if the data is corrupted or maliciously crafted. When printing these strings in error messages, use the %.*s format specifier with the maximum buffer size to prevent out-of-bounds reads into adjacent kernel memory. Link: https://lore.kernel.org/20260327033335.696621-1-pasha.tatashin@soleen.com Link: https://lore.kernel.org/20260327033335.696621-2-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav (Google) Cc: David Matlack Cc: Mike Rapoport Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 13b6b620910436c29dea398382e83c9499fd13e4 Author: Baolin Wang Date: Fri Mar 27 18:21:08 2026 +0800 mm: vmscan: fix dirty folios throttling on cgroup v1 for MGLRU The balance_dirty_pages() won't do the dirty folios throttling on cgroupv1. See commit 9badce000e2c ("cgroup, writeback: don't enable cgroup writeback on traditional hierarchies"). Moreover, after commit 6b0dfabb3555 ("fs: Remove aops->writepage"), we no longer attempt to write back filesystem folios through reclaim. On large memory systems, the flusher may not be able to write back quickly enough. Consequently, MGLRU will encounter many folios that are already under writeback. Since we cannot reclaim these dirty folios, the system may run out of memory and trigger the OOM killer. Hence, for cgroup v1, let's throttle reclaim after waking up the flusher, which is similar to commit 81a70c21d917 ("mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1"), to avoid unnecessary OOM. The following test program can easily reproduce the OOM issue. With this patch applied, the test passes successfully. $mkdir /sys/fs/cgroup/memory/test $echo 256M > /sys/fs/cgroup/memory/test/memory.limit_in_bytes $echo $$ > /sys/fs/cgroup/memory/test/cgroup.procs $dd if=/dev/zero of=/mnt/data.bin bs=1M count=800 Link: https://lore.kernel.org/3445af0f09e8ca945492e052e82594f8c4f2e2f6.1774606060.git.baolin.wang@linux.alibaba.com Fixes: ac35a4902374 ("mm: multi-gen LRU: minimal implementation") Signed-off-by: Baolin Wang Reviewed-by: Barry Song Reviewed-by: Kairui Song Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Qi Zheng Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit e3e613a33e654a37c4fb34b7eb2776008c461e0c Author: Pasha Tatashin Date: Thu Mar 26 16:39:43 2026 +0000 selftests: liveupdate: add test for double preservation Verify that a file can only be preserved once across all active sessions. Attempting to preserve it a second time, whether in the same or a different session, should fail with EBUSY. Link: https://lore.kernel.org/20260326163943.574070-4-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Samiullah Khawaja Cc: David Matlack Cc: Pratyush Yadav Cc: Shuah Khan Cc: Christian Brauner Signed-off-by: Andrew Morton commit bc3a5763f4664c5da812eb3f14d55b0c99abd4ab Author: Pasha Tatashin Date: Thu Mar 26 16:39:42 2026 +0000 memfd: implement get_id for memfd_luo Memfds are identified by their underlying inode. Implement get_id for memfd_luo to return the inode pointer. This prevents the same memfd from being managed twice by LUO if the same inode is pointed by multiple file objects. Link: https://lore.kernel.org/20260326163943.574070-3-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav (Google) Cc: David Matlack Cc: Mike Rapoport (Microsoft) Cc: Samiullah Khawaja Cc: Shuah Khan Cc: Christian Brauner Signed-off-by: Andrew Morton commit 00d0b372374f2528394aabf7b1f53f8dafe294de Author: Pasha Tatashin Date: Thu Mar 26 16:39:41 2026 +0000 liveupdate: prevent double management of files Patch series "liveupdate: prevent double preservation", v4. Currently, LUO does not prevent the same file from being managed twice across different active sessions. Because LUO preserves files of absolutely different types: memfd, and upcoming vfiofd [1], iommufd [2], guestmefd (and possible kvmfd/cpufd). There is no common private data or guarantee on how to prevent that the same file is not preserved twice beside using inode or some slower and expensive method like hashtables. This patch (of 4) Currently, LUO does not prevent the same file from being managed twice across different active sessions. Use a global xarray luo_preserved_files to keep track of file identifiers being preserved by LUO. Update luo_preserve_file() to check and insert the file identifier into this xarray when it is preserved, and erase it in luo_file_unpreserve_files() when it is released. To allow handlers to define what constitutes a "unique" file (e.g., different struct file objects pointing to the same hardware resource), add a get_id() callback to struct liveupdate_file_ops. If not provided, the default identifier is the struct file pointer itself. This ensures that the same file (or resource) cannot be managed by multiple sessions. If another session attempts to preserve an already managed file, it will now fail with -EBUSY. Link: https://lore.kernel.org/20260326163943.574070-1-pasha.tatashin@soleen.com Link: https://lore.kernel.org/20260326163943.574070-2-pasha.tatashin@soleen.com Link: https://lore.kernel.org/all/20260129212510.967611-1-dmatlack@google.com [1] Link: https://lore.kernel.org/all/20260203220948.2176157-1-skhawaja@google.com [2] Signed-off-by: Pasha Tatashin Reviewed-by: Samiullah Khawaja Reviewed-by: Mike Rapoport (Microsoft) Cc: David Matlack Cc: Pratyush Yadav Cc: Shuah Khan Cc: Christian Brauner Signed-off-by: Andrew Morton commit e524feaad5467f39a56d2697f7db31f02796dc7d Author: Breno Leitao Date: Mon Mar 16 04:54:36 2026 -0700 kho: document kexec-metadata tracking feature Add documentation for the kexec-metadata feature that tracks the previous kernel version and kexec boot count across kexec reboots. This helps diagnose bugs that only reproduce when kexecing from specific kernel versions. Link: https://lore.kernel.org/20260316-kho-v9-6-ed6dcd951988@debian.org Signed-off-by: Breno Leitao Suggested-by: Mike Rapoport Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: David Hildenbrand Cc: Jonathan Corbet Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Pasha Tatashin Cc: SeongJae Park Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 76aa46b9e4049247858309c6e3527d477da2b2fe Author: Breno Leitao Date: Mon Mar 16 04:54:35 2026 -0700 kho: kexec-metadata: track previous kernel chain Use Kexec Handover (KHO) to pass the previous kernel's version string and the number of kexec reboots since the last cold boot to the next kernel, and print it at boot time. Example output: [ 0.000000] KHO: exec from: 6.19.0-rc4-next-20260107 (count 1) Motivation ========== Bugs that only reproduce when kexecing from specific kernel versions are difficult to diagnose. These issues occur when a buggy kernel kexecs into a new kernel, with the bug manifesting only in the second kernel. Recent examples include the following commits: * commit eb2266312507 ("x86/boot: Fix page table access in 5-level to 4-level paging transition") * commit 77d48d39e991 ("efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption") * commit 64b45dd46e15 ("x86/efi: skip memattr table on kexec boot") As kexec-based reboots become more common, these version-dependent bugs are appearing more frequently. At scale, correlating crashes to the previous kernel version is challenging, especially when issues only occur in specific transition scenarios. Implementation ============== The kexec metadata is stored as a plain C struct (struct kho_kexec_metadata) rather than FDT format, for simplicity and direct field access. It is registered via kho_add_subtree() as a separate subtree, keeping it independent from the core KHO ABI. This design choice: - Keeps the core KHO ABI minimal and stable - Allows the metadata format to evolve independently - Avoids requiring version bumps for all KHO consumers (LUO, etc.) when the metadata format changes The struct kho_kexec_metadata contains two fields: - previous_release: The kernel version that initiated the kexec - kexec_count: Number of kexec boots since last cold boot On cold boot, kexec_count starts at 0 and increments with each kexec. The count helps identify issues that only manifest after multiple consecutive kexec reboots. [leitao@debian.org: call kho_kexec_metadata_init() for both boot paths] Link: https://lore.kernel.org/all/20260309-kho-v8-5-c3abcf4ac750@debian.org/ [1] Link: https://lore.kernel.org/20260409-kho_fix_merge_issue-v1-1-710c84ceaa85@debian.org Link: https://lore.kernel.org/20260316-kho-v9-5-ed6dcd951988@debian.org Signed-off-by: Breno Leitao Acked-by: SeongJae Park Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: David Hildenbrand Cc: Jonathan Corbet Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Pasha Tatashin Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 062dd306d99cc2e02f761124e064e6a3735e27b0 Author: Breno Leitao Date: Mon Mar 16 04:54:34 2026 -0700 kho: fix kho_in_debugfs_init() to handle non-FDT blobs kho_in_debugfs_init() calls fdt_totalsize() to determine blob sizes, which assumes all blobs are FDTs. This breaks for non-FDT blobs like struct kho_kexec_metadata. Fix this by reading the "blob-size" property from the FDT (persisted by kho_add_subtree()) instead of calling fdt_totalsize(). Also rename local variables from fdt_phys/sub_fdt to blob_phys/blob for consistency with the non-FDT-specific naming. Link: https://lore.kernel.org/20260316-kho-v9-4-ed6dcd951988@debian.org Signed-off-by: Breno Leitao Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: David Hildenbrand Cc: Jonathan Corbet Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport (Microsoft) Cc: Pasha Tatashin Cc: SeongJae Park Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 85e41392820fcf0f7a3f9784cea907905f921358 Author: Breno Leitao Date: Mon Mar 16 04:54:33 2026 -0700 kho: persist blob size in KHO FDT kho_add_subtree() accepts a size parameter but only forwards it to debugfs. The size is not persisted in the KHO FDT, so it is lost across kexec. This makes it impossible for the incoming kernel to determine the blob size without understanding the blob format. Store the blob size as a "blob-size" property in the KHO FDT alongside the "preserved-data" physical address. This allows the receiving kernel to recover the size for any blob regardless of format. Also extend kho_retrieve_subtree() with an optional size output parameter so callers can learn the blob size without needing to understand the blob format. Update all callers to pass NULL for the new parameter. Link: https://lore.kernel.org/20260316-kho-v9-3-ed6dcd951988@debian.org Signed-off-by: Breno Leitao Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: David Hildenbrand Cc: Jonathan Corbet Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Pasha Tatashin Cc: SeongJae Park Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4916ae386760ad666eafa8afc075957bf479afbc Author: Breno Leitao Date: Mon Mar 16 04:54:32 2026 -0700 kho: rename fdt parameter to blob in kho_add/remove_subtree() Since kho_add_subtree() now accepts arbitrary data blobs (not just FDTs), rename the parameter from 'fdt' to 'blob' to better reflect its purpose. Apply the same rename to kho_remove_subtree() for consistency. Also rename kho_debugfs_fdt_add() and kho_debugfs_fdt_remove() to kho_debugfs_blob_add() and kho_debugfs_blob_remove() respectively, with the same parameter rename from 'fdt' to 'blob'. Link: https://lore.kernel.org/20260316-kho-v9-2-ed6dcd951988@debian.org Signed-off-by: Breno Leitao Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: David Hildenbrand Cc: Jonathan Corbet Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Pasha Tatashin Cc: SeongJae Park Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d9e4142e7635f6f7173854667c0695ce5b836bbc Author: Breno Leitao Date: Mon Mar 16 04:54:31 2026 -0700 kho: add size parameter to kho_add_subtree() Patch series "kho: history: track previous kernel version and kexec boot count", v9. Use Kexec Handover (KHO) to pass the previous kernel's version string and the number of kexec reboots since the last cold boot to the next kernel, and print it at boot time. Example ======= [ 0.000000] Linux version 6.19.0-rc3-upstream-00047-ge5d992347849 ... [ 0.000000] KHO: exec from: 6.19.0-rc4-next-20260107upstream-00004-g3071b0dc4498 (count 1) Motivation ========== Bugs that only reproduce when kexecing from specific kernel versions are difficult to diagnose. These issues occur when a buggy kernel kexecs into a new kernel, with the bug manifesting only in the second kernel. Recent examples include: * eb2266312507 ("x86/boot: Fix page table access in 5-level to 4-level paging transition") * 77d48d39e991 ("efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption") * 64b45dd46e15 ("x86/efi: skip memattr table on kexec boot") As kexec-based reboots become more common, these version-dependent bugs are appearing more frequently. At scale, correlating crashes to the previous kernel version is challenging, especially when issues only occur in specific transition scenarios. Some bugs manifest only after multiple consecutive kexec reboots. Tracking the kexec count helps identify these cases (this metric is already used by live update sub-system). KHO provides a reliable mechanism to pass information between kernels. By carrying the previous kernel's release string and kexec count forward, we can print this context at boot time to aid debugging. The goal of this feature is to have this information being printed in early boot, so, users can trace back kernel releases in kexec. Systemd is not helpful because we cannot assume that the previous kernel has systemd or even write access to the disk (common when using Linux as bootloaders) This patch (of 6): kho_add_subtree() assumes the fdt argument is always an FDT and calls fdt_totalsize() on it in the debugfs code path. This assumption will break if a caller passes arbitrary data instead of an FDT. When CONFIG_KEXEC_HANDOVER_DEBUGFS is enabled, kho_debugfs_fdt_add() calls __kho_debugfs_fdt_add(), which executes: f->wrapper.size = fdt_totalsize(fdt); Fix this by adding an explicit size parameter to kho_add_subtree() so callers specify the blob size. This allows subtrees to contain arbitrary data formats, not just FDTs. Update all callers: - memblock.c: use fdt_totalsize(fdt) - luo_core.c: use fdt_totalsize(fdt_out) - test_kho.c: use fdt_totalsize() - kexec_handover.c (root fdt): use fdt_totalsize(kho_out.fdt) Also update __kho_debugfs_fdt_add() to receive the size explicitly instead of computing it internally via fdt_totalsize(). In kho_in_debugfs_init(), pass fdt_totalsize() for the root FDT and sub-blobs since all current users are FDTs. A subsequent patch will persist the size in the KHO FDT so the incoming side can handle non-FDT blobs correctly. Link: https://lore.kernel.org/20260323110747.193569-1-duanchenghao@kylinos.cn Link: https://lore.kernel.org/20260316-kho-v9-1-ed6dcd951988@debian.org Signed-off-by: Breno Leitao Suggested-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: David Hildenbrand Cc: Jonathan Corbet Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Pasha Tatashin Cc: SeongJae Park Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit e9d973ef18b0554f5a819b4b0e0d5ac9c3b74657 Author: Breno Leitao Date: Mon Mar 23 04:12:13 2026 -0700 mm: kmemleak: add CONFIG_DEBUG_KMEMLEAK_VERBOSE build option Add a Kconfig option to default kmemleak verbose mode on at build time. This option depends on DEBUG_KMEMLEAK_AUTO_SCAN since verbose reporting is only meaningful when the automatic scanning thread is running. When enabled, kmemleak prints full details (backtrace, hex dump, address) of unreferenced objects to dmesg as they are detected during scanning, removing the need to manually read /sys/kernel/debug/kmemleak. Making this a compile-time option rather than a boot parameter allows debug kernel flavors to enable verbose kmemleak reporting by default without requiring changes to boot arguments. A machine can simply swap to a debug kernel and benefit from kmemleak reporting automatically. By surfacing leak reports directly in dmesg, they are automatically forwarded through any kernel logging infrastructure and can be easily captured by log aggregation tooling, making it practical to monitor memory leaks across large fleets. The verbose setting can still be toggled at runtime via /sys/module/kmemleak/parameters/verbose. Link: https://lore.kernel.org/20260323-kmemleak_report-v1-1-ba2cdd9c11b9@debian.org Signed-off-by: Breno Leitao Acked-by: SeongJae Park Acked-by: Vlastimil Babka (SUSE) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: Catalin Marinas Cc: David Hildenbrand Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 34c45804ae0535c7bce9e7ce00329382afe68a1f Author: Lorenzo Stoakes (Oracle) Date: Thu Mar 26 18:56:29 2026 +0000 MAINTAINERS: update MGLRU entry to reflect current status We are moving to a far more proactive model of maintainership within mm and thus put a great deal of emphasis on sub-maintainers being active within the community both in terms of code contributions and review. The MGLRU has not had much activity since being added to the kernel and the current maintainers who kindly stepped up have unfortunately not been able to contribute a great deal to it for over a year, nor engage all that heavily in review. As a result, and within no negative connotations implied whatsoever, it seems appropriate to downgrade the current maintainers to reviewers. At this time nobody is quite exercising the maintainer role in this area of the kernel, but there is encouraging activity from a number of people who are trusted elsewhere in the kernel, and who have contributed relevant work or review. Therefore add further reviewers, and at this stage - to reflect the reality on the ground - we will not have any sub-maintainers listed at all. Each of the files listed are shared with other sections in MAINTAINERS, so this doesn't reduce sub-maintainer coverage. Link: https://lore.kernel.org/20260326185629.355476-1-ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Axel Rasmussen Acked-by: Vlastimil Babka (SUSE) Acked-by: David Hildenbrand (Arm) Acked-by: Barry Song Acked-by: SeongJae Park Acked-by: Kairui Song Acked-by: Qi Zheng Acked-by: Yuanchu Xie Acked-by: Shakeel Butt Cc: Suren Baghdasaryan Cc: Wei Xu Cc: Kalesh Singh Signed-off-by: Andrew Morton commit 1c514a2c6e4c3bf2016a1dbbddc36d19fdf52ce5 Author: Qi Zheng Date: Fri Mar 27 18:16:30 2026 +0800 mm: memcontrol: correct the nr_pages parameter type of mem_cgroup_update_lru_size() The nr_pages parameter of mem_cgroup_update_lru_size() represents a page count. During the reparenting of LRU folios, the value passed to it can potentially exceed the maximum value of a 32-bit integer. It should be declared as long instead of int to match the types used in lruvec size accounting and to prevent possible overflow. Update the parameter type to long to ensure correctness. Link: https://lore.kernel.org/fd4140de44fa0a3978e4e2426731187fe8625f0b.1774604356.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Harry Yoo (Oracle) Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Michal Hocko Cc: Michal Koutný Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Usama Arif Cc: Wei Xu Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 85358bad68f5d72a8cff3d79d46e4c38a91afe06 Author: Qi Zheng Date: Fri Mar 27 18:16:29 2026 +0800 mm: memcontrol: change val type to long in __mod_memcg_{lruvec_}state() The __mod_memcg_state() and __mod_memcg_lruvec_state() functions are also used to reparent non-hierarchical stats. In this scenario, the values passed to them are accumulated statistics that might be extremely large and exceed the upper limit of a 32-bit integer. Change the val parameter type from int to long in these functions and their corresponding tracepoints (memcg_rstat_stats) to prevent potential overflow issues. After that, in memcg_state_val_in_pages(), if the passed val is negative, the expression val * unit / PAGE_SIZE could be implicitly converted to a massive positive number when compared with 1UL in the max() macro. This leads to returning an incorrect massive positive value. Fix this by using abs(val) to calculate the magnitude first, and then restoring the sign of the value before returning the result. Additionally, use mult_frac() to prevent potential overflow during the multiplication of val and unit. Link: https://lore.kernel.org/70a9440e49c464b4dca88bcabc6b491bd335c9f0.1774604356.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Reported-by: Harry Yoo (Oracle) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Harry Yoo (Oracle) Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Michal Hocko Cc: Michal Koutný Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Usama Arif Cc: Wei Xu Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 616795d7db00377b76f6918fafd32f61af7f78f0 Author: Qi Zheng Date: Fri Mar 27 18:16:28 2026 +0800 mm: memcontrol: correct the type of stats_updates to unsigned long Patch series "fix unexpected type conversions and potential overflows", v3. As Harry Yoo pointed out [1], in scenarios where massive state updates occur (e.g., during the reparenting of LRU folios), the values passed to memcg stat update functions can accumulate and exceed the upper limit of a 32-bit integer. If the parameter types are not large enough (like 'int') or are handled incorrectly, it can lead to severe truncation, potential overflow issues, and unexpected type conversion bugs. This series aims to address these issues by correcting the parameter types in the relevant functions, and by fixing an implicit conversion bug in memcg_state_val_in_pages(). This patch (of 3): The memcg_rstat_updated() tracks updates for vmstats_percpu->state and lruvec_stats_percpu->state. Since these state values are of type long, change the val parameter passed to memcg_rstat_updated() to long as well. Correspondingly, change the type of stats_updates in struct memcg_vmstats_percpu and struct memcg_vmstats from unsigned int and atomic_t to unsigned long and atomic_long_t respectively to prevent potential overflow when handling large state updates during the reparenting of LRU folios. Link: https://lore.kernel.org/cover.1774604356.git.zhengqi.arch@bytedance.com Link: https://lore.kernel.org/a5b0b468e7b4fe5f26c50e36d5d016f16d92f98f.1774604356.git.zhengqi.arch@bytedance.com Link: https://lore.kernel.org/all/acDxaEgnqPI-Z4be@hyeyoo/ [1] Signed-off-by: Qi Zheng Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Harry Yoo (Oracle) Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Michal Hocko Cc: Michal Koutný Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Usama Arif Cc: Wei Xu Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 0a98e13963424d7f1f50211c692f46a3b1e8d03f Author: Muchun Song Date: Thu Mar 5 19:52:51 2026 +0800 mm: lru: add VM_WARN_ON_ONCE_FOLIO to lru maintenance helpers We must ensure the folio is deleted from or added to the correct lruvec list. So, add VM_WARN_ON_ONCE_FOLIO() to catch invalid users. The VM_BUG_ON_PAGE() in move_pages_to_lru() can be removed as add_page_to_lru_list() will perform the necessary check. Link: https://lore.kernel.org/2c90fc006d9d730331a3caeef96f7e5dabe2036d.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Roman Gushchin Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Harry Yoo Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit f1cf8d2f36dc369688bbe61ce064fbd829dbc9e1 Author: Muchun Song Date: Thu Mar 5 19:52:50 2026 +0800 mm: memcontrol: eliminate the problem of dying memory cgroup for LRU folios Now that everything is set up, switch folio->memcg_data pointers to objcgs, update the accessors, and execute reparenting on cgroup death. Finally, folio->memcg_data of LRU folios and kmem folios will always point to an object cgroup pointer. The folio->memcg_data of slab folios will point to an vector of object cgroups. Link: https://lore.kernel.org/80cb7af198dc6f2173fe616d1207a4c315ece141.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Harry Yoo Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 01b9da291c4969354807b52956f4aae1f41b4924 Author: Qi Zheng Date: Thu Mar 5 19:52:49 2026 +0800 mm: memcontrol: convert objcg to be per-memcg per-node type Convert objcg to be per-memcg per-node type, so that when reparent LRU folios later, we can hold the lru lock at the node level, thus avoiding holding too many lru locks at once. [zhengqi.arch@bytedance.com: reset pn->orig_objcg to NULL] Link: https://lore.kernel.org/20260309112939.31937-1-qi.zheng@linux.dev [akpm@linux-foundation.org: fix comment typo, per Usama. Reflow comment to 80 cols] [devnexen@gmail.com: fix obj_cgroup leak in mem_cgroup_css_online() error path] Link: https://lore.kernel.org/20260322193631.45457-1-devnexen@gmail.com [devnexen@gmail.com: add newline, per Qi Zheng] Link: https://lore.kernel.org/20260323063007.7783-1-devnexen@gmail.com Link: https://lore.kernel.org/56c04b1c5d54f75ccdc12896df6c1ca35403ecc3.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Signed-off-by: David Carlier Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Harry Yoo Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Cc: Usama Arif Signed-off-by: Andrew Morton commit 8285917d6f383aef274fb442eb0e6f948d76abe3 Author: Qi Zheng Date: Thu Mar 5 19:52:48 2026 +0800 mm: memcontrol: prepare for reparenting non-hierarchical stats To resolve the dying memcg issue, we need to reparent LRU folios of child memcg to its parent memcg. This could cause problems for non-hierarchical stats. As Yosry Ahmed pointed out: In short, if memory is charged to a dying cgroup at the time of reparenting, when the memory gets uncharged the stats updates will occur at the parent. This will update both hierarchical and non-hierarchical stats of the parent, which would corrupt the parent's non-hierarchical stats (because those counters were never incremented when the memory was charged). Now we have the following two types of non-hierarchical stats, and they are only used in CONFIG_MEMCG_V1: a. memcg->vmstats->state_local[i] b. pn->lruvec_stats->state_local[i] To ensure that these non-hierarchical stats work properly, we need to reparent these non-hierarchical stats after reparenting LRU folios. To this end, this commit makes the following preparations: 1. implement reparent_state_local() to reparent non-hierarchical stats 2. make css_killed_work_fn() to be called in rcu work, and implement get_non_dying_memcg_start() and get_non_dying_memcg_end() to avoid race between mod_memcg_state()/mod_memcg_lruvec_state() and reparent_state_local() Link: https://lore.kernel.org/e862995c45a7101a541284b6ebee5e5c32c89066.1772711148.git.zhengqi.arch@bytedance.com Co-developed-by: Yosry Ahmed Signed-off-by: Yosry Ahmed Signed-off-by: Qi Zheng Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Harry Yoo Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 5371e350fda70bbdbee364215ca37b7fea25047b Author: Qi Zheng Date: Thu Mar 5 19:52:47 2026 +0800 mm: memcontrol: refactor mod_memcg_state() and mod_memcg_lruvec_state() Refactor the memcg_reparent_objcgs() to facilitate subsequent reparenting non-hierarchical stats. Link: https://lore.kernel.org/7f8bd3aacec2270b9453428fc8585cca9f10751e.1772711148.git.zhengqi.arch@bytedance.com Co-developed-by: Yosry Ahmed Signed-off-by: Yosry Ahmed Signed-off-by: Qi Zheng Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Harry Yoo Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 7404bd37cfbeb2aa06249418c1788ca94bae2875 Author: Qi Zheng Date: Thu Mar 5 19:52:46 2026 +0800 mm: workingset: use lruvec_lru_size() to get the number of lru pages For cgroup v2, count_shadow_nodes() is the only place to read non-hierarchical stats (lruvec_stats->state_local). To avoid the need to consider cgroup v2 during subsequent non-hierarchical stats reparenting, use lruvec_lru_size() instead of lruvec_page_state_local() to get the number of lru pages. For NR_SLAB_RECLAIMABLE_B and NR_SLAB_UNRECLAIMABLE_B cases, it appears that the statistics here have already been problematic for a while since slab pages have been reparented. So just ignore it for now. Link: https://lore.kernel.org/b1d448c667a8fb377c3390d9aba43bdb7e4d5739.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: Shakeel Butt Acked-by: Muchun Song Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Harry Yoo Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 131adcc774bb138b55ab2d09201dd333832db87b Author: Qi Zheng Date: Thu Mar 5 19:52:45 2026 +0800 mm: memcontrol: refactor memcg_reparent_objcgs() Refactor the memcg_reparent_objcgs() to facilitate subsequent reparenting LRU folios here. Link: https://lore.kernel.org/2e5696db1993e593a51004c1dacedbc261689629.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: Johannes Weiner Acked-by: Shakeel Butt Reviewed-by: Harry Yoo Reviewed-by: Muchun Song Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit f304652609eae3814b0e9d11c75c0e0cb62da31f Author: Qi Zheng Date: Thu Mar 5 19:52:44 2026 +0800 mm: vmscan: prepare for reparenting MGLRU folios Similar to traditional LRU folios, in order to solve the dying memcg problem, we also need to reparenting MGLRU folios to the parent memcg when memcg offline. However, there are the following challenges: 1. Each lruvec has between MIN_NR_GENS and MAX_NR_GENS generations, the number of generations of the parent and child memcg may be different, so we cannot simply transfer MGLRU folios in the child memcg to the parent memcg as we did for traditional LRU folios. 2. The generation information is stored in folio->flags, but we cannot traverse these folios while holding the lru lock, otherwise it may cause softlockup. 3. In walk_update_folio(), the gen of folio and corresponding lru size may be updated, but the folio is not immediately moved to the corresponding lru list. Therefore, there may be folios of different generations on an LRU list. 4. In lru_gen_del_folio(), the generation to which the folio belongs is found based on the generation information in folio->flags, and the corresponding LRU size will be updated. Therefore, we need to update the lru size correctly during reparenting, otherwise the lru size may be updated incorrectly in lru_gen_del_folio(). Finally, this patch chose a compromise method, which is to splice the lru list in the child memcg to the lru list of the same generation in the parent memcg during reparenting. And in order to ensure that the parent memcg has the same generation, we need to increase the generations in the parent memcg to the MAX_NR_GENS before reparenting. Of course, the same generation has different meanings in the parent and child memcg, this will cause confusion in the hot and cold information of folios. But other than that, this method is simple enough, the lru size is correct, and there is no need to consider some concurrency issues (such as lru_gen_del_folio()). To prepare for the above work, this commit implements the specific functions, which will be used during reparenting. [zhengqi.arch@bytedance.com: use list_splice_tail_init() to reparent child folios] Link: https://lore.kernel.org/20260324114937.28569-1-qi.zheng@linux.dev Link: https://lore.kernel.org/e75050354cdbc42221a04f7cf133292b61105548.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Suggested-by: Harry Yoo Suggested-by: Imran Khan Acked-by: Harry Yoo Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 07a6e9a2c199fed361f528781284d56771d0016f Author: Qi Zheng Date: Thu Mar 5 19:52:43 2026 +0800 mm: vmscan: prepare for reparenting traditional LRU folios To resolve the dying memcg issue, we need to reparent LRU folios of child memcg to its parent memcg. For traditional LRU list, each lruvec of every memcg comprises four LRU lists. Due to the symmetry of the LRU lists, it is feasible to transfer the LRU lists from a memcg to its parent memcg during the reparenting process. This commit implements the specific function, which will be used during the reparenting process. Link: https://lore.kernel.org/a92d217a9fc82bd0c401210204a095caaf615b1c.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Muchun Song Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 31b54a5e8916fdd4819880e3aed93f65ecbb47e3 Author: Muchun Song Date: Thu Mar 5 19:52:42 2026 +0800 mm: memcontrol: prepare for reparenting LRU pages for lruvec lock The following diagram illustrates how to ensure the safety of the folio lruvec lock when LRU folios undergo reparenting. In the folio_lruvec_lock(folio) function: rcu_read_lock(); retry: lruvec = folio_lruvec(folio); /* There is a possibility of folio reparenting at this point. */ spin_lock(&lruvec->lru_lock); if (unlikely(lruvec_memcg(lruvec) != folio_memcg(folio))) { /* * The wrong lruvec lock was acquired, and a retry is required. * This is because the folio resides on the parent memcg lruvec * list. */ spin_unlock(&lruvec->lru_lock); goto retry; } /* Reaching here indicates that folio_memcg() is stable. */ In the memcg_reparent_objcgs(memcg) function: spin_lock(&lruvec->lru_lock); spin_lock(&lruvec_parent->lru_lock); /* Transfer folios from the lruvec list to the parent's. */ spin_unlock(&lruvec_parent->lru_lock); spin_unlock(&lruvec->lru_lock); After acquiring the lruvec lock, it is necessary to verify whether the folio has been reparented. If reparenting has occurred, the new lruvec lock must be reacquired. During the LRU folio reparenting process, the lruvec lock will also be acquired (this will be implemented in a subsequent patch). Therefore, folio_memcg() remains unchanged while the lruvec lock is held. Given that lruvec_memcg(lruvec) is always equal to folio_memcg(folio) after the lruvec lock is acquired, the lruvec_memcg_debug() check is redundant. Hence, it is removed. This patch serves as a preparation for the reparenting of LRU folios. Link: https://lore.kernel.org/23f22cbb1419f277a3483018b32158ae2b86c666.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Harry Yoo Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit d14f87858178c64cc94ecd05bb41bba474c1c654 Author: Qi Zheng Date: Thu Mar 5 19:52:41 2026 +0800 mm: do not open-code lruvec lock Now we have lruvec_unlock(), lruvec_unlock_irq() and lruvec_unlock_irqrestore(), but no the paired lruvec_lock(), lruvec_lock_irq() and lruvec_lock_irqsave(). There is currently no use case for lruvec_lock_irqsave(), so only introduce lruvec_lock_irq(), and change all open-code places to use this helper function. This looks cleaner and prepares for reparenting LRU pages, preventing user from missing RCU lock calls due to open-code lruvec lock. Link: https://lore.kernel.org/2d0bafe7564e17ece46dfd58197af22ce57017dc.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: Muchun Song Acked-by: Shakeel Butt Reviewed-by: Harry Yoo Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 507382970b6ad2806fbfd72bc13e3f7c1249c4b1 Author: Muchun Song Date: Thu Mar 5 19:52:40 2026 +0800 mm: workingset: prevent lruvec release in workingset_activation() In the near future, a folio will no longer pin its corresponding memory cgroup. So an lruvec returned by folio_lruvec() could be released without the rcu read lock or a reference to its memory cgroup. In the current patch, the rcu read lock is employed to safeguard against the release of the lruvec in workingset_activation(). This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/c6130476affbba0a7d309a887c3df11e0167990b.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 74e225ffaac7bd8d22cc485902a484381cafa1ab Author: Muchun Song Date: Thu Mar 5 19:52:39 2026 +0800 mm: swap: prevent lruvec release in lru_gen_clear_refs() In the near future, a folio will no longer pin its corresponding memory cgroup. So an lruvec returned by folio_lruvec() could be released without the rcu read lock or a reference to its memory cgroup. In the current patch, the rcu read lock is employed to safeguard against the release of the lruvec in lru_gen_clear_refs(). This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/986cd26227191a48a7c34a2a15812d361f4ebd53.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit d5ddaf4341f70b13a357b7e8800c8087c96ff318 Author: Muchun Song Date: Thu Mar 5 19:52:38 2026 +0800 mm: zswap: prevent lruvec release in zswap_folio_swapin() In the near future, a folio will no longer pin its corresponding memory cgroup. So an lruvec returned by folio_lruvec() could be released without the rcu read lock or a reference to its memory cgroup. In the current patch, the rcu read lock is employed to safeguard against the release of the lruvec in zswap_folio_swapin(). This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/02b3f76ee8d1132f69ac5baaedce38fb82b09a48.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Nhat Pham Reviewed-by: Chengming Zhou Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit fe132152c885d482eb232209bfea87ac94bf253a Author: Muchun Song Date: Thu Mar 5 19:52:37 2026 +0800 mm: workingset: prevent lruvec release in workingset_refault() In the near future, a folio will no longer pin its corresponding memory cgroup. So an lruvec returned by folio_lruvec() could be released without the rcu read lock or a reference to its memory cgroup. In the current patch, the rcu read lock is employed to safeguard against the release of the lruvec in workingset_refault(). This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/e3a8c19a9b18422b43213f6c89c451c5b6ca1577.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Cc: Zi Yan Cc: Chengming Zhou Cc: Chen Ridong Cc: Muchun Song Cc: Nhat Pham Cc: Yosry Ahmed Signed-off-by: Andrew Morton commit cf4d6ad54ba14fc8d6899bacb28b0698ee971cc6 Author: Qi Zheng Date: Thu Mar 5 19:52:36 2026 +0800 mm: zswap: prevent memory cgroup release in zswap_compress() In the near future, a folio will no longer pin its corresponding memory cgroup. To ensure safety, it will only be appropriate to hold the rcu read lock or acquire a reference to the memory cgroup returned by folio_memcg(), thereby preventing it from being released. In the current patch, the rcu read lock is employed to safeguard against the release of the memory cgroup in zswap_compress(). Link: https://lore.kernel.org/340f315050fb8a67caaf01b4836d4f38a41cf1a8.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: Muchun Song Reviewed-by: Harry Yoo Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 681d325b23dccbf8f6beda18dc1a61d8e3c715cf Author: Qi Zheng Date: Thu Mar 5 19:52:35 2026 +0800 mm: thp: prevent memory cgroup release in folio_split_queue_lock{_irqsave}() In the near future, a folio will no longer pin its corresponding memory cgroup. To ensure safety, it will only be appropriate to hold the rcu read lock or acquire a reference to the memory cgroup returned by folio_memcg(), thereby preventing it from being released. In the current patch, the rcu read lock is employed to safeguard against the release of the memory cgroup in folio_split_queue_lock{_irqsave}(). Link: https://lore.kernel.org/ca2957c0df1126b2c71b40c738018fd5255525a6.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: David Hildenbrand (Red Hat) Acked-by: Muchun Song Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit b3ca98297cd98a51ee9d6d491d0a4ee0ca79b515 Author: Muchun Song Date: Thu Mar 5 19:52:34 2026 +0800 mm: workingset: prevent memory cgroup release in lru_gen_eviction() In the near future, a folio will no longer pin its corresponding memory cgroup. To ensure safety, it will only be appropriate to hold the rcu read lock or acquire a reference to the memory cgroup returned by folio_memcg(), thereby preventing it from being released. In the current patch, the rcu read lock is employed to safeguard against the release of the memory cgroup in lru_gen_eviction(). This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/f37e8ae2d84ddc690813d834cd75735d52d1bc78.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit c863aded26d1f98247af2719b1e3ed01e3d0d4f6 Author: Muchun Song Date: Thu Mar 5 19:52:33 2026 +0800 mm: memcontrol: prevent memory cgroup release in mem_cgroup_swap_full() In the near future, a folio will no longer pin its corresponding memory cgroup. To ensure safety, it will only be appropriate to hold the rcu read lock or acquire a reference to the memory cgroup returned by folio_memcg(), thereby preventing it from being released. In the current patch, the rcu read lock is employed to safeguard against the release of the memory cgroup in mem_cgroup_swap_full(). This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/21d1abab7342615745ea4c18a88237335ab44d13.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit c29f90a2dac18bdd407eafc4cbaa57f14665393a Author: Muchun Song Date: Thu Mar 5 19:52:32 2026 +0800 mm: mglru: prevent memory cgroup release in mglru In the near future, a folio will no longer pin its corresponding memory cgroup. To ensure safety, it will only be appropriate to hold the rcu read lock or acquire a reference to the memory cgroup returned by folio_memcg(), thereby preventing it from being released. In the current patch, the rcu read lock is employed to safeguard against the release of the memory cgroup in mglru. This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/9d887662a9d39c425742dd8468e3123316bccfe3.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Shakeel Butt Reviewed-by: Harry Yoo Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 53050890802e25b6b04ab5b243c90e42d10ef777 Author: Muchun Song Date: Thu Mar 5 19:52:31 2026 +0800 mm: migrate: prevent memory cgroup release in folio_migrate_mapping() In the near future, a folio will no longer pin its corresponding memory cgroup. To ensure safety, it will only be appropriate to hold the rcu read lock or acquire a reference to the memory cgroup returned by folio_memcg(), thereby preventing it from being released. In __folio_migrate_mapping(), the rcu read lock is employed to safeguard against the release of the memory cgroup in folio_migrate_mapping(). This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/0f156c2f1188f256855617953f8305f43e066065.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 1f6f80c2dbb4516dffaaeb54a9009acea2bf61ca Author: Muchun Song Date: Thu Mar 5 19:52:30 2026 +0800 mm: page_io: prevent memory cgroup release in page_io module In the near future, a folio will no longer pin its corresponding memory cgroup. To ensure safety, it will only be appropriate to hold the rcu read lock or acquire a reference to the memory cgroup returned by folio_memcg(), thereby preventing it from being released. In the current patch, the rcu read lock is employed to safeguard against the release of the memory cgroup in swap_writeout() and bio_associate_blkg_from_page(). This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/7c3708358412fb02c482d0985feb5e9513a863ef.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit f995da5341c1854e59415c2c2c6f0b6406b498f2 Author: Muchun Song Date: Thu Mar 5 19:52:29 2026 +0800 mm: memcontrol: prevent memory cgroup release in count_memcg_folio_events() In the near future, a folio will no longer pin its corresponding memory cgroup. To ensure safety, it will only be appropriate to hold the rcu read lock or acquire a reference to the memory cgroup returned by folio_memcg(), thereby preventing it from being released. In the current patch, the rcu read lock is employed to safeguard against the release of the memory cgroup in count_memcg_folio_events(). This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/dea6aa0389367f7fd6b715c8837a2cf7506bd889.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 49717c7bd6b8e14329c2d04b1e8ec691175b6f4e Author: Muchun Song Date: Thu Mar 5 19:52:28 2026 +0800 writeback: prevent memory cgroup release in writeback module In the near future, a folio will no longer pin its corresponding memory cgroup. To ensure safety, it will only be appropriate to hold the rcu read lock or acquire a reference to the memory cgroup returned by folio_memcg(), thereby preventing it from being released. In the current patch, the function get_mem_cgroup_css_from_folio() and the rcu read lock are employed to safeguard against the release of the memory cgroup. This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/645f99bc344575417f67def3744f975596df2793.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit d10adce2c1a8ec61b46ff1841d3662f3c7a66d7a Author: Muchun Song Date: Thu Mar 5 19:52:27 2026 +0800 buffer: prevent memory cgroup release in folio_alloc_buffers() In the near future, a folio will no longer pin its corresponding memory cgroup. To ensure safety, it will only be appropriate to hold the rcu read lock or acquire a reference to the memory cgroup returned by folio_memcg(), thereby preventing it from being released. In the current patch, the function get_mem_cgroup_from_folio() is employed to safeguard against the release of the memory cgroup. This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/d6d48fdcf329c549373ac0a1c80fd9f38067e34e.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit af86590786d7ee1597ff0d8ea4e18f94529d2442 Author: Muchun Song Date: Thu Mar 5 19:52:26 2026 +0800 mm: memcontrol: prevent memory cgroup release in get_mem_cgroup_from_folio() In the near future, a folio will no longer pin its corresponding memory cgroup. To ensure safety, it will only be appropriate to hold the rcu read lock or acquire a reference to the memory cgroup returned by folio_memcg(), thereby preventing it from being released. In the current patch, the rcu read lock is employed to safeguard against the release of the memory cgroup in get_mem_cgroup_from_folio(). This serves as a preparatory measure for the reparenting of the LRU pages. Link: https://lore.kernel.org/a5a64c6173a566bd21534606aeaaa9220cb1366d.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Johannes Weiner Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit d5aa8c1d136e7de89defb06f42f8108992967a70 Author: Muchun Song Date: Thu Mar 5 19:52:25 2026 +0800 mm: memcontrol: return root object cgroup for root memory cgroup Memory cgroup functions such as get_mem_cgroup_from_folio() and get_mem_cgroup_from_mm() return a valid memory cgroup pointer, even for the root memory cgroup. In contrast, the situation for object cgroups has been different. Previously, the root object cgroup couldn't be returned because it didn't exist. Now that a valid root object cgroup exists, for the sake of consistency, it's necessary to align the behavior of object-cgroup-related operations with that of memory cgroup APIs. Link: https://lore.kernel.org/e9c3f40ba7681d9753372d4ee2ac7a0216848b95.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Johannes Weiner Acked-by: Shakeel Butt Reviewed-by: Harry Yoo Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit aa01ec1325e211ee4b57ad1375e4efaa846d7ff3 Author: Muchun Song Date: Thu Mar 5 19:52:24 2026 +0800 mm: memcontrol: allocate object cgroup for non-kmem case To allow LRU page reparenting, the objcg infrastructure is no longer solely applicable to the kmem case. In this patch, we extend the scope of the objcg infrastructure beyond the kmem case, enabling LRU folios to reuse it for folio charging purposes. It should be noted that LRU folios are not accounted for at the root level, yet the folio->memcg_data points to the root_mem_cgroup. Hence, the folio->memcg_data of LRU folios always points to a valid pointer. However, the root_mem_cgroup does not possess an object cgroup. Therefore, we also allocate an object cgroup for the root_mem_cgroup. Link: https://lore.kernel.org/b77274aa8e3f37c419bedf4782943fd5885dda82.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Harry Yoo Acked-by: Johannes Weiner Acked-by: Shakeel Butt Reviewed-by: Chen Ridong Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit a760b64ee08809fb98874a72f82acf6fd30c5d7e Author: Muchun Song Date: Thu Mar 5 19:52:23 2026 +0800 mm: vmscan: refactor move_folios_to_lru() In a subsequent patch, we'll reparent the LRU folios. The folios that are moved to the appropriate LRU list can undergo reparenting during the move_folios_to_lru() process. Hence, it's incorrect for the caller to hold a lruvec lock. Instead, we should utilize the more general interface of folio_lruvec_relock_irq() to obtain the correct lruvec lock. This patch involves only code refactoring and doesn't introduce any functional changes. Link: https://lore.kernel.org/6f1dac88b61e2e3cb7a3e90bacdf06b654acfc15.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Johannes Weiner Acked-by: Shakeel Butt Reviewed-by: Harry Yoo Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 676496738b7e6c58fc5efba255e9c35b4896cdd6 Author: Qi Zheng Date: Thu Mar 5 19:52:22 2026 +0800 mm: vmscan: prepare for the refactoring the move_folios_to_lru() Once we refactor move_folios_to_lru(), its callers will no longer have to hold the lruvec lock; For shrink_inactive_list(), shrink_active_list() and evict_folios(), IRQ disabling is only needed for __count_vm_events() and __mod_node_page_state(). To avoid using local_irq_disable() on the PREEMPT_RT kernel, let's make all callers of move_folios_to_lru() use IRQ-safed count_vm_events() and mod_node_page_state(). Link: https://lore.kernel.org/b3a202f1787b0857bb6cbe059fffb8edefaf67b7.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: Johannes Weiner Acked-by: Shakeel Butt Reviewed-by: Chen Ridong Reviewed-by: Harry Yoo Acked-by: Muchun Song Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit db128b2c6b7d0c9b514327a0873425bbf18e739b Author: Muchun Song Date: Thu Mar 5 19:52:21 2026 +0800 mm: rename unlock_page_lruvec_irq and its variants It is inappropriate to use folio_lruvec_lock() variants in conjunction with unlock_page_lruvec() variants, as this involves the inconsistent operation of locking a folio while unlocking a page. To rectify this, the functions unlock_page_lruvec{_irq, _irqrestore} are renamed to lruvec_unlock{_irq,_irqrestore}. Link: https://lore.kernel.org/4e5e05271a250df4d1812e1832be65636a78c957.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Roman Gushchin Acked-by: Johannes Weiner Reviewed-by: Harry Yoo Reviewed-by: Chen Ridong Acked-by: David Hildenbrand (Red Hat) Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 2b33c342f7d4bf61710fd5a59c0a5e06d2d3082f Author: Muchun Song Date: Thu Mar 5 19:52:20 2026 +0800 mm: workingset: use folio_lruvec() in workingset_refault() Use folio_lruvec() to simplify the code. Link: https://lore.kernel.org/11bd2fbbf082f4f7972a1113ca42a61fbe2876a9.1772711148.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Johannes Weiner Reviewed-by: Harry Yoo Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: Chen Ridong Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit f95fcd7f28082524938db0b3808ce53630b8a718 Author: Muchun Song Date: Thu Mar 5 19:52:19 2026 +0800 mm: memcontrol: remove dead code of checking parent memory cgroup Patch series "Eliminate Dying Memory Cgroup", v6. Introduction ============ This patchset is intended to transfer the LRU pages to the object cgroup without holding a reference to the original memory cgroup in order to address the issue of the dying memory cgroup. A consensus has already been reached regarding this approach recently [1]. Background ========== The issue of a dying memory cgroup refers to a situation where a memory cgroup is no longer being used by users, but memory (the metadata associated with memory cgroups) remains allocated to it. This situation may potentially result in memory leaks or inefficiencies in memory reclamation and has persisted as an issue for several years. Any memory allocation that endures longer than the lifespan (from the users' perspective) of a memory cgroup can lead to the issue of dying memory cgroup. We have exerted greater efforts to tackle this problem by introducing the infrastructure of object cgroup [2]. Presently, numerous types of objects (slab objects, non-slab kernel allocations, per-CPU objects) are charged to the object cgroup without holding a reference to the original memory cgroup. The final allocations for LRU pages (anonymous pages and file pages) are charged at allocation time and continues to hold a reference to the original memory cgroup until reclaimed. File pages are more complex than anonymous pages as they can be shared among different memory cgroups and may persist beyond the lifespan of the memory cgroup. The long-term pinning of file pages to memory cgroups is a widespread issue that causes recurring problems in practical scenarios [3]. File pages remain unreclaimed for extended periods. Additionally, they are accessed by successive instances (second, third, fourth, etc.) of the same job, which is restarted into a new cgroup each time. As a result, unreclaimable dying memory cgroups accumulate, leading to memory wastage and significantly reducing the efficiency of page reclamation. Fundamentals ============ A folio will no longer pin its corresponding memory cgroup. It is necessary to ensure that the memory cgroup or the lruvec associated with the memory cgroup is not released when a user obtains a pointer to the memory cgroup or lruvec returned by folio_memcg() or folio_lruvec(). Users are required to hold the RCU read lock or acquire a reference to the memory cgroup associated with the folio to prevent its release if they are not concerned about the binding stability between the folio and its corresponding memory cgroup. However, some users of folio_lruvec() (i.e., the lruvec lock) desire a stable binding between the folio and its corresponding memory cgroup. An approach is needed to ensure the stability of the binding while the lruvec lock is held, and to detect the situation of holding the incorrect lruvec lock when there is a race condition during memory cgroup reparenting. The following four steps are taken to achieve these goals. 1. The first step to be taken is to identify all users of both functions (folio_memcg() and folio_lruvec()) who are not concerned about binding stability and implement appropriate measures (such as holding a RCU read lock or temporarily obtaining a reference to the memory cgroup for a brief period) to prevent the release of the memory cgroup. 2. Secondly, the following refactoring of folio_lruvec_lock() demonstrates how to ensure the binding stability from the user's perspective of folio_lruvec(). struct lruvec *folio_lruvec_lock(struct folio *folio) { struct lruvec *lruvec; rcu_read_lock(); retry: lruvec = folio_lruvec(folio); spin_lock(&lruvec->lru_lock); if (unlikely(lruvec_memcg(lruvec) != folio_memcg(folio))) { spin_unlock(&lruvec->lru_lock); goto retry; } return lruvec; } From the perspective of memory cgroup removal, the entire reparenting process (altering the binding relationship between folio and its memory cgroup and moving the LRU lists to its parental memory cgroup) should be carried out under both the lruvec lock of the memory cgroup being removed and the lruvec lock of its parent. 3. Finally, transfer the LRU pages to the object cgroup without holding a reference to the original memory cgroup. Effect ====== Finally, it can be observed that the quantity of dying memory cgroups will not experience a significant increase if the following test script is executed to reproduce the issue. #!/bin/bash # Create a temporary file 'temp' filled with zero bytes dd if=/dev/zero of=temp bs=4096 count=1 # Display memory-cgroup info from /proc/cgroups cat /proc/cgroups | grep memory for i in {0..2000} do mkdir /sys/fs/cgroup/memory/test$i echo $$ > /sys/fs/cgroup/memory/test$i/cgroup.procs # Append 'temp' file content to 'log' cat temp >> log echo $$ > /sys/fs/cgroup/memory/cgroup.procs # Potentially create a dying memory cgroup rmdir /sys/fs/cgroup/memory/test$i done # Display memory-cgroup info after test cat /proc/cgroups | grep memory rm -f temp log This patch (of 33): Since the no-hierarchy mode has been deprecated after the commit: commit bef8620cd8e0 ("mm: memcg: deprecate the non-hierarchical mode"). As a result, parent_mem_cgroup() will not return NULL except when passing the root memcg, and the root memcg cannot be offline. Hence, it's safe to remove the check on the returned value of parent_mem_cgroup(). Remove the corresponding dead code. Link: https://lore.kernel.org/f4481291bf8c6561dd8949045b5a1ed4008a6b63.1772711148.git.zhengqi.arch@bytedance.com Link: https://lore.kernel.org/linux-mm/Z6OkXXYDorPrBvEQ@hm-sls2/ [1] Link: https://lwn.net/Articles/895431/ [2] Link: https://github.com/systemd/systemd/pull/36827 [3] Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Roman Gushchin Acked-by: Johannes Weiner Reviewed-by: Harry Yoo Reviewed-by: Chen Ridong Acked-by: Shakeel Butt Cc: Allen Pais Cc: Axel Rasmussen Cc: Baoquan He Cc: Chengming Zhou Cc: David Hildenbrand Cc: Hamza Mahfooz Cc: Hugh Dickins Cc: Imran Khan Cc: Kamalesh Babulal Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Xu Cc: Yosry Ahmed Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 3d3544a6c996e88bb793bb6b2665c3e3f674f5eb Author: Lorenzo Stoakes Date: Mon Apr 13 11:57:13 2026 +0100 mm/vma: remove __vma_check_mmap_hook() Commit c50ca15dd496 ("mm: add vm_ops->mapped hook") introduced __vma_check_mmap_hook() in order to assert that a driver doesn't incorrectly implement both an f_op->mmap() and a vm_ops->mapped hook, the latter of which would not ultimately get invoked. However, this did not correctly account for stacked drivers (or drivers that otherwise use the compatibility layer) which might recursively call an mmap_prepare hook via the compatibility layer. Thus the nested mmap_prepare() invocation might result in a VMA which has vm_ops->mapped set with an overlaying mmap() hook, causing the __vma_check_mmap_hook() to fail in vfs_mmap(), wrongly failing the operation. This patch resolves this by simply removing the check, as we can't be certain that an mmap() hook doesn't at some point invoke the compatibility layer, and it's not worth trying to track it. Link: https://lore.kernel.org/20260413105713.92625-1-ljs@kernel.org Fixes: c50ca15dd496 ("mm: add vm_ops->mapped hook") Reported-by: Shinichiro Kawasaki Closes: https://lore.kernel.org/all/adx2ws5z0NMIe5Yj@shinmob/ Signed-off-by: Lorenzo Stoakes Acked-by: Vlastimil Babka (SUSE) Tested-by: Shinichiro Kawasaki Cc: Al Viro Cc: Christian Brauner Cc: David Hildenbrand Cc: Jan Kara Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 660b982305cebd242df52fe87adf6b203a12f9be Author: Dan Carpenter Date: Sat Apr 11 00:24:49 2026 +0900 ntfs: fix potential 32-bit truncation in ntfs_write_cb() Smatch warned that the bitwise negation in ntfs_write_cb() might lead to unintended truncation. Casting the block size to loff_t before bitwise negation prevents the upper 32 bits of pos from being incorrectly zeroed out during the calculation of new_vcn. Signed-off-by: Dan Carpenter Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit dacc18029ef69ed225fdb4d7c3215c285e9e8ef4 Author: Namjae Jeon Date: Sat Apr 11 00:18:30 2026 +0900 ntfs: fix uninitialized variable in ntfs_map_runlist_nolock Smatch reported that ctx_needs_reset could be used uninitialized if ntfs_map_runlist_nolock() fails early when a search context is provided. Specifically, if the function returns -EIO because the attribute is resident, the code jumps to err_out. This initializes ctx_needs_reset to false to satisfy the static checker. Reported-by: Dan Carpenter Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 32ba4750dfc6f4139b90fefe59ce8866b2eab56d Author: Dan Carpenter Date: Fri Apr 10 13:10:57 2026 +0300 ntfs: delete dead code We know "ret2" is zero so there is no need to check. Delete the if statement. Signed-off-by: Dan Carpenter Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit e8b79d09e3121390ebd04591ac1d8c4dea811815 Author: Dan Carpenter Date: Fri Apr 10 09:47:25 2026 +0300 ntfs: add missing error code in ntfs_mft_record_alloc() Return -ENOMEM if the kmalloc() fails. Don't return success. Signed-off-by: Dan Carpenter Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit cd8d29c1b3c3397493115a9e919a806ea28aef05 Author: Namjae Jeon Date: Sat Apr 11 00:02:49 2026 +0900 ntfs: fix uninitialized variables in ntfs_ea_set_wsl_inode() Smatch reported uninitialized symbol warnings in ntfs_ea_set_wsl_inode() and __ntfs_create(). In ntfs_ea_set_wsl_inode(), the err variable could be returned without initialization if no flags are set and rdev is zero. Additionally, ea_size might remain uninitialized from the caller's perspective if no EA operations are performed. While these cases might not be triggered under current logic, we initialize them to zero to satisfy the static checker. Reported-by: Dan Carpenter Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 545834ac412fb42d41a41442aee7998c1d2dcced Author: Namjae Jeon Date: Fri Apr 10 23:49:01 2026 +0900 ntfs: fix uninitialized pointer in ntfs_write_mft_block Smatch reported that the variable rl could be used uninitialized in ntfs_write_mft_block(). After analyzing the code, when vol->cluster_size == NTFS_BLOCK_SIZE (512), it is smaller than folio_size, so rl is guaranteed to be initialized. If vol->cluster_size is larger, the condition to access rl becomes false, so a runtime error is not expected to occur. However, to make the static checker happy, this patch initializes rl to NULL and adds an explicit check before its usage. Reported-by: Dan Carpenter Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 8a59a2d84fa3de2b4bbb8759b52e62c9c06d9d32 Author: Namjae Jeon Date: Fri Apr 10 20:29:44 2026 +0900 ntfs: fix uninitialized variable in ntfs_write_simple_iomap_begin_non_resident Smatch reported that err could be used uninitialized if the code path does not enter the first ntfs_zero_range() block. Reported-by: Dan Carpenter Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit cf29a21b3d9105c5309e679ba875df1e987cabfa Author: Hyunchul Lee Date: Mon Apr 6 10:24:16 2026 +0900 ntfs: remove noop_direct_IO from address_space_operations Since commit a2ad63daa88b ("VFS: add FMODE_CAN_ODIRECT file flag"), noop_direct_io is not required. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 0b79de3299079e4132972ab5e04136c770e38038 Author: Hyunchul Lee Date: Fri Apr 3 10:10:39 2026 +0900 ntfs: limit memory allocation in ntfs_attr_readall check an attribute size before memory allocation, and reject if the size is over the maximum size. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit ca513e492fb8ac59f5e3092a79d836cd2e687a2a Author: Hyunchul Lee Date: Fri Apr 3 08:54:11 2026 +0900 ntfs: not zero out range beyond init in punch_hole The area beyond initialized_size are read as zero values, there is no need to zero out that region. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 8b4064e6146efc6c0202d671c4e26bcbd26e3555 Author: Hyunchul Lee Date: Wed Apr 1 16:24:57 2026 +0900 ntfs: zero out stale data in straddle block beyond initialized_size ntfs_read_iomap_begin_non_resident() rounds up MAPPED extents to the block boundary of initialized_size. This ensures that any subsequent blocks are treated as IOMAP_UNWRITTEN, but it also causes the "straddle block" containing initialized_size to be read from disk. The disk data beyond initialized_size in this block is stale and must be zeroed to prevent data leakage. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 8541d8f725c673db3bd741947f27974358b2e163 Merge: a436a0b847c0fe b2a4fe0960aee9 Author: Linus Torvalds Date: Fri Apr 17 17:57:04 2026 -0700 Merge tag 'mtd/for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "MTD changes: - mtdconcat finally makes it in, after several years of being merged and reverted - Baikal SoC support is being removed, so MTD bits are being removed as well - misc cleanups NAND changes: - SunXi driver support for new versions of the Allwinner NAND controller. - DT-binding improvements and cleanups. - A few fixes (Realtek ECC and Winbond SPI NAND), aside with the usual load of misc changes. SPI NOR fixes: - Enable die erase on MT35XU02GCBA. We knew this flash needed this fixup since 7f77c561e227 ("mtd: spi-nor: micron-st: add TODO for fixing mt35xu02gcba") but did not add it due to lack of hardware to test on. - Fix locking on some Winbond w25q series flashes. - Fix Auto Address Increment (AAI) writes on SST that flashes that start on odd address. The write enable latch needs to be set again after the single byte program" * tag 'mtd/for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (44 commits) mtd: spinand: winbond: Declare the QE bit on W25NxxJW mtd: spi-nor: micron-st: Enable die erase support for MT35XU02GCBA mtd: spi-nor: winbond: Fix locking support for w25q256jw mtd: spi-nor: sst: Fix write enable before AAI sequence mtd: spi-nor: winbond: Fix locking support for w25q64jvm mtd: spi-nor: winbond: Fix locking support for w25q256jwm dt-bindings: mtd: mxc-nand: add missing compatible string and ref to nand-controller-legacy.yaml dt-bindings: mtd: gpmi-nand: ref to nand-controller-legacy.yaml dt-bindings: mtd: refactor NAND bindings and add nand-controller-legacy.yaml mtd: spinand: winbond: Clarify when to enable the HS bit mtd: rawnand: sunxi: introduce maximize variable user data length mtd: rawnand: sunxi: fix typos in comments mtd: rawnand: sunxi: change error prone variable name mtd: rawnand: sunxi: remove dead code mtd: rawnand: sunxi: make the code more self-explanatory mtd: rawnand: sunxi: replace hard coded value by a define - take2 mtd: rawnand: sunxi: do not count BBM bytes twice mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob mtd: rawnand: sunxi: sunxi_nand_ooblayout_free code clarification mtd: cmdlinepart: use a flexible array member ... commit a436a0b847c0fef9ead14f99bc03d8adbf66f15b Merge: 30999ad0491580 981fcc5674e671 Author: Linus Torvalds Date: Fri Apr 17 17:08:31 2026 -0700 Merge tag 'ext4_for_linux-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: - Refactor code paths involved with partial block zero-out in prearation for converting ext4 to use iomap for buffered writes - Remove use of d_alloc() from ext4 in preparation for the deprecation of this interface - Replace some J_ASSERTS with a journal abort so we can avoid a kernel panic for a localized file system error - Simplify various code paths in mballoc, move_extent, and fast commit - Fix rare deadlock in jbd2_journal_cancel_revoke() that can be triggered by generic/013 when blocksize < pagesize - Fix memory leak when releasing an extended attribute when its value is stored in an ea_inode - Fix various potential kunit test bugs in fs/ext4/extents.c - Fix potential out-of-bounds access in check_xattr() with a corrupted file system - Make the jbd2_inode dirty range tracking safe for lockless reads - Avoid a WARN_ON when writeback files due to a corrupted file system; we already print an ext4 warning indicatign that data will be lost, so the WARN_ON is not necessary and doesn't add any new information * tag 'ext4_for_linux-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (37 commits) jbd2: fix deadlock in jbd2_journal_cancel_revoke() ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() ext4: fix possible null-ptr-deref in mbt_kunit_exit() ext4: fix possible null-ptr-deref in extents_kunit_exit() ext4: fix the error handling process in extents_kunit_init). ext4: call deactivate_super() in extents_kunit_exit() ext4: fix miss unlock 'sb->s_umount' in extents_kunit_init() ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access ext4: zero post-EOF partial block before appending write ext4: move pagecache_isize_extended() out of active handle ext4: remove ctime/mtime update from ext4_alloc_file_blocks() ext4: unify SYNC mode checks in fallocate paths ext4: ensure zeroed partial blocks are persisted in SYNC mode ext4: move zero partial block range functions out of active handle ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() ext4: remove handle parameters from zero partial block functions ext4: move ordered data handling out of ext4_block_do_zero_range() ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() ext4: factor out journalled block zeroing range ext4: rename and extend ext4_block_truncate_page() ... commit 30999ad049158057d55e613c90a8302970540f7a Merge: cdd4dc3aebeab4 e61bc5e4d87433 Author: Linus Torvalds Date: Fri Apr 17 17:03:43 2026 -0700 Merge tag 'for-linus-7.1-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs updates from Mike Marshall: "Fixes: - validate getxattr response length - don't overflow the bufmap slot on readahead - fix parsing problem with kernel debug keywords Cleanup: - take better advantage of strscpy New: - manage bufmap as folios - add usercopy whitelist to orangefs_op_cache" * tag 'for-linus-7.1-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: bufmap: manage as folios, V2. orangefs: validate getxattr response length orangefs_readahead: don't overflow the bufmap slot. debugfs: take better advantage of strscpy. orangefs: add usercopy whitelist to orangefs_op_cache orangefs-debugfs.c: fix parsing problem with kernel debug keywords. commit cdd4dc3aebeab43a72ce0bc2b5bab6f0a80b97a5 Merge: eb0d6d97c27c29 14f0a13ec79dfa Author: Linus Torvalds Date: Fri Apr 17 16:35:49 2026 -0700 Merge tag 'ntfs-for-7.1-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs Pull ntfs resurrection from Namjae Jeon: "Ever since Kari Argillander’s 2022 report [1] regarding the state of the ntfs3 driver, I have spent the last 4 years working to provide full write support and current trends (iomap, no buffer head, folio), enhanced performance, stable maintenance, utility support including fsck for NTFS in Linux. This new implementation is built upon the clean foundation of the original read-only NTFS driver, adding: - Write support: Implemented full write support based on the classic read-only NTFS driver. Added delayed allocation to improve write performance through multi-cluster allocation and reduced fragmentation of the cluster bitmap. - iomap conversion: Switched buffered IO (reads/writes), direct IO, file extent mapping, readpages, and writepages to use iomap. - Remove buffer_head: Completely removed buffer_head usage by converting to folios. As a result, the dependency on CONFIG_BUFFER_HEAD has been removed from Kconfig. - Stability improvements: The new ntfs driver passes 326 xfstests, compared to 273 for ntfs3. All tests passed by ntfs3 are a complete subset of the tests passed by this implementation. Added support for fallocate, idmapped mounts, permissions, and more. xfstests Results report: Total tests run: 787 Passed : 326 Failed : 38 Skipped : 423 Failed tests breakdown: - 34 tests require metadata journaling - 4 other tests: 094: No unwritten extent concept in NTFS on-disk format 563: cgroup v2 aware writeback accounting not supported 631: RENAME_WHITEOUT support required 787: NFS delegation test" Link: https://lore.kernel.org/all/da20d32b-5185-f40b-48b8-2986922d8b25@stargateuniverse.net/ [1] [ Let's see if this undead filesystem ends up being of the "Easter miracle" kind, or the "Nosferatu of filesystems" kind... ] * tag 'ntfs-for-7.1-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (46 commits) ntfs: remove redundant out-of-bound checks ntfs: add bound checking to ntfs_external_attr_find ntfs: add bound checking to ntfs_attr_find ntfs: fix ignoring unreachable code warnings ntfs: fix inconsistent indenting warnings ntfs: fix variable dereferenced before check warnings ntfs: prefer IS_ERR_OR_NULL() over manual NULL check ntfs: harden ntfs_listxattr against EA entries ntfs: harden ntfs_ea_lookup against malformed EA entries ntfs: check $EA query-length in ntfs_ea_get ntfs: validate WSL EA payload sizes ntfs: fix WSL ea restore condition ntfs: add missing newlines to pr_err() messages ntfs: fix pointer/integer casting warnings ntfs: use ->mft_no instead of ->i_ino in prints ntfs: change mft_no type to u64 ntfs: select FS_IOMAP in Kconfig ntfs: add MODULE_ALIAS_FS ntfs: reduce stack usage in ntfs_write_mft_block() ntfs: fix sysctl table registration and path ... commit eb0d6d97c27c29cd7392c8fd74f46edf7dff7ec2 Merge: 12bffaef28820e e1d486445af3c3 Author: Linus Torvalds Date: Fri Apr 17 15:58:22 2026 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: "Most of the diff stat comes from Xu Kuohai's fix to emit ENDBR/BTI, since all JITs had to be touched to move constant blinding out and pass bpf_verifier_env in. - Fix use-after-free in arena_vm_close on fork (Alexei Starovoitov) - Dissociate struct_ops program with map if map_update fails (Amery Hung) - Fix out-of-range and off-by-one bugs in arm64 JIT (Daniel Borkmann) - Fix precedence bug in convert_bpf_ld_abs alignment check (Daniel Borkmann) - Fix arg tracking for imprecise/multi-offset in BPF_ST/STX insns (Eduard Zingerman) - Copy token from main to subprogs to fix missing kallsyms (Eduard Zingerman) - Prevent double close and leak of btf objects in libbpf (Jiri Olsa) - Fix af_unix null-ptr-deref in sockmap (Michal Luczaj) - Fix NULL deref in map_kptr_match_type for scalar regs (Mykyta Yatsenko) - Avoid unnecessary IPIs. Remove redundant bpf_flush_icache() in arm64 and riscv JITs (Puranjay Mohan) - Fix out of bounds access. Validate node_id in arena_alloc_pages() (Puranjay Mohan) - Reject BPF-to-BPF calls and callbacks in arm32 JIT (Puranjay Mohan) - Refactor all JITs to pass bpf_verifier_env to emit ENDBR/BTI for indirect jump targets on x86-64, arm64 JITs (Xu Kuohai) - Allow UTF-8 literals in bpf_bprintf_prepare() (Yihan Ding)" * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (32 commits) bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT bpf: Dissociate struct_ops program with map if map_update fails bpf: Validate node_id in arena_alloc_pages() libbpf: Prevent double close and leak of btf objects selftests/bpf: cover UTF-8 trace_printk output bpf: allow UTF-8 literals in bpf_bprintf_prepare() selftests/bpf: Reject scalar store into kptr slot bpf: Fix NULL deref in map_kptr_match_type for scalar regs bpf: Fix precedence bug in convert_bpf_ld_abs alignment check bpf, arm64: Emit BTI for indirect jump target bpf, x86: Emit ENDBR for indirect jump targets bpf: Add helper to detect indirect jump targets bpf: Pass bpf_verifier_env to JIT bpf: Move constants blinding out of arch-specific JITs bpf, sockmap: Take state lock for af_unix iter bpf, sockmap: Fix af_unix null-ptr-deref in proto update selftests/bpf: Extend bpf_iter_unix to attempt deadlocking bpf, sockmap: Fix af_unix iter deadlock bpf, sockmap: Annotate af_unix sock:: Sk_state data-races selftests/bpf: verify kallsyms entries for token-loaded subprograms ... commit 12bffaef28820e0b94c644c75708195c61af78f7 Merge: 7d672741a5012b 6c724ce0ec6ed8 Author: Linus Torvalds Date: Fri Apr 17 15:52:58 2026 -0700 Merge tag 'cxl-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL (Compute Express Link) updates from Dave Jiang: "The significant change of interest is the handling of soft reserved memory conflict between CXL and HMEM. In essence CXL will be the first to claim the soft reserved memory ranges that belongs to CXL and attempt to enumerate them with best effort. If CXL is not able to enumerate the ranges it will punt them to HMEM. There are also MAINTAINERS email changes from Dan Williams and Jonathan Cameron" * tag 'cxl-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (37 commits) MAINTAINERS: Update Jonathan Cameron's email address cxl/hdm: Add support for 32 switch decoders MAINTAINERS: Update address for Dan Williams tools/testing/cxl: Enable replay of user regions as auto regions cxl/region: Add a region sysfs interface for region lock status tools/testing/cxl: Test dax_hmem takeover of CXL regions tools/testing/cxl: Simulate auto-assembly failure dax/hmem: Parent dax_hmem devices dax/hmem: Fix singleton confusion between dax_hmem_work and hmem devices dax/hmem: Reduce visibility of dax_cxl coordination symbols cxl/region: Constify cxl_region_resource_contains() cxl/region: Limit visibility of cxl_region_contains_resource() dax/cxl: Fix HMEM dependencies cxl/region: Fix use-after-free from auto assembly failure cxl/core: Check existence of cxl_memdev_state in poison test cxl/core: use cleanup.h for devm_cxl_add_dax_region cxl/core/region: move dax region device logic into region_dax.c cxl/core/region: move pmem region driver logic into region_pmem.c dax/hmem, cxl: Defer and resolve Soft Reserved ownership cxl/region: Add helper to check Soft Reserved containment by CXL regions ... commit 7d672741a5012b0c133847f970eba792430d432d Merge: 9cdca336677b4d 48f7a50c027dd2 Author: Linus Torvalds Date: Fri Apr 17 15:48:36 2026 -0700 Merge tag 'stop-machine.2026.04.16a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull stop-machine update from Paul McKenney: - kernel-doc updates for stop_machine() and stop_machine_cpuslocked() functions * tag 'stop-machine.2026.04.16a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: stop_machine: Fix the documentation for a NULL cpus argument commit 9cdca336677b4d15579ec462e33c8a330ab3a9de Merge: ba314ed1bff907 82bbd447199ff1 Author: Linus Torvalds Date: Fri Apr 17 15:42:01 2026 -0700 Merge tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity updates from Mimi Zohar: "There are two main changes, one feature removal, some code cleanup, and a number of bug fixes. Main changes: - Detecting secure boot mode was limited to IMA. Make detecting secure boot mode accessible to EVM and other LSMs - IMA sigv3 support was limited to fsverity. Add IMA sigv3 support for IMA regular file hashes and EVM portable signatures Remove: - Remove IMA support for asychronous hash calculation originally added for hardware acceleration Cleanup: - Remove unnecessary Kconfig CONFIG_MODULE_SIG and CONFIG_KEXEC_SIG tests - Add descriptions of the IMA atomic flags Bug fixes: - Like IMA, properly limit EVM "fix" mode - Define and call evm_fix_hmac() to update security.evm - Fallback to using i_version to detect file change for filesystems that do not support STATX_CHANGE_COOKIE - Address missing kernel support for configured (new) TPM hash algorithms - Add missing crypto_shash_final() return value" * tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: evm: Enforce signatures version 3 with new EVM policy 'bit 3' integrity: Allow sigv3 verification on EVM_XATTR_PORTABLE_DIGSIG ima: add support to require IMA sigv3 signatures ima: add regular file data hash signature version 3 support ima: Define asymmetric_verify_v3() to verify IMA sigv3 signatures ima: remove buggy support for asynchronous hashes integrity: Eliminate weak definition of arch_get_secureboot() ima: Add code comments to explain IMA iint cache atomic_flags ima_fs: Correctly create securityfs files for unsupported hash algos ima: check return value of crypto_shash_final() in boot aggregate ima: Define and use a digest_size field in the ima_algo_desc structure powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG ima: fallback to using i_version to detect file change evm: fix security.evm for a file with IMA signature s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT evm: Don't enable fix mode when secure boot is enabled integrity: Make arch_ima_get_secureboot integrity-wide commit ba314ed1bff907321ab4091a4e46c4d9f24b5e39 Merge: 3d2d10e1f558be ad5fd5aeb65a44 Author: Linus Torvalds Date: Fri Apr 17 14:21:40 2026 -0700 Merge tag 'hwlock-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull hwspinlock updates from Bjorn Andersson: "Remove the unused u8500 hardware spinlock driver, and clean out the hwspinlock_pdata struct as this was the last user of the struct" * tag 'hwlock-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: hwspinlock: remove now unused pdata from header file hwspinlock: u8500: delete driver commit 3d2d10e1f558be304d747056c01dad2218ddc534 Merge: d65218de87c4bf 3e2fa997d1e2b6 Author: Linus Torvalds Date: Fri Apr 17 14:18:55 2026 -0700 Merge tag 'rpmsg-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: "Mark 'data' argument in rpmsg_send() const, and perculate to related drivers. Replace deprecated class_destroy() with class_unregister()" * tag 'rpmsg-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: media: platform: mtk-mdp3: Constify buffer passed to mdp_vpu_sendmsg() ASoC: qcom: Constify GPR packet being send over GPR interface rpmsg: Constify buffer passed to send API remoteproc: mtk_scp: Constify buffer passed to scp_send_ipi() remoteproc: mtk_scp_ipi: Constify buffer passed to scp_ipi_send() drivers: rpmsg: class_destroy() is deprecated commit d65218de87c4bfa879bc453c3050d3851c353dcc Merge: e2d10998e4293a 56c1ec52428480 Author: Linus Torvalds Date: Fri Apr 17 14:16:15 2026 -0700 Merge tag 'rproc-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Move requesting of IRQs in TI Keystone driver to probe time instead of remoteproc start, to allow better handling of errors. - Introduce support for more than 10 entries in the Qualcomm minidump implementation. - Add audio DSP remoteproc support for the Qualcomm Eliza platform. Add modem remoteproc support for the Qualcomm MDM9607, MSM8917, MSM8937, and MSM8940 platforms. - Add list of Qualcomm QMI service ids to the QMI header file, in order to avoid sprinkling them across the various drivers using them. Migrate sysmon to use this constant. - Fix several issues related to DeviceTree parsing and mailbox handling in the Xilinx R5F remote processor driver. - Fix incorrect error checks in reserved memory handling and polish the code across i.MX and TI drivers. * tag 'rproc-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (35 commits) remoteproc: qcom: pas: Add Eliza ADSP support dt-bindings: remoteproc: qcom,milos-pas: Document Eliza ADSP remoteproc: qcom: Add missing space before closing bracket dt-bindings: remoteproc: qcom: Drop types for firmware-name remoteproc: qcom: Fix minidump out-of-bounds access on subsystems array dt-bindings: remoteproc: k3-r5f: Add memory-region-names dt-bindings: remoteproc: k3-r5f: Split up memory regions remoteproc: use SIZE_MAX in rproc_u64_fit_in_size_t() dt-bindings: remoteproc: qcom,sm8550-pas: Add Glymur CDSP dt-bindings: remoteproc: qcom,sm8550-pas: Add Glymur ADSP remoteproc: xlnx: Release mailbox channels on shutdown remoteproc: sysmon: Use the unified QMI service ID instead of defining it locally remoteproc: xlnx: Only access buffer information if IPI is buffered remoteproc: xlnx: Avoid mailbox setup remoteproc: keystone: Request IRQs in probe() remoteproc: pru: Remove empty remove callback remoteproc: pru: Use rproc_of_parse_firmware() to get firmware name remoteproc: da8xx: Reorder resource fetching in probe() remoteproc: da8xx: Remove unused local struct data remoteproc: da8xx: Use dev_err_probe() ... commit e2d10998e4293a27c0389870b5fdf736a71d61ef Merge: 430cc9f42b44d1 a74c2e55ab6651 Author: Linus Torvalds Date: Fri Apr 17 14:09:02 2026 -0700 Merge tag 'devicetree-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "DT core: - Cleanup of the reserved memory code to keep CMA specifics in CMA code - Add and convert several users to new of_machine_get_match() helper - Validate nul termination in string properties - Update dtc to upstream v1.7.2-69-g53373d135579 - Limit matching reserved memory devices to /reserved-memory nodes - Fix some UAF in unittests - Remove Baikal SoC bus driver - Fix false DT_SPLIT_BINDING_PATCH checkpatch warning - Allow fw_devlink device-tree on x86 - Fix kerneldoc return description for of_property_count_elems_of_size() DT bindings: - Add fsl,imx25-aips, fsl,imx25-tcq, qcom,eliza-pdc, qcom,eliza-spmi-pmic-arb, qcom,hawi-imem, qcom,milos-imem, qcom,hawi-pdc, and lg,sw49410 bindings - Convert arm,vexpress-scc to DT schema - Deprecate Qualcomm generic CPU compatibles. Add Apple M3 CPU cores. - Move some dual-link display panels to the dual-link schema - Drop mux controller node name constraints - Remove Baikal SoC bus bindings - Fix a false warning in the thermal trip node binding" * tag 'devicetree-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (39 commits) dt-bindings: display: panel: panel-simple: Add lg,sw49410 compatible dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints dt-bindings: display: simple: Move Innolux G156HCE-L01 panel to dual-link dt-bindings: display: simple: Move AUO 21.5" FHD to dual-link dt-bindings: thermal: Fix false warning with 'phandle' in trips nodes of: unittest: fix use-after-free in testdrv_probe() of: unittest: fix use-after-free in of_unittest_changeset() dt-bindings: qcom,pdc: document the Hawi Power Domain Controller dt-bindings: ARM: arm,vexpress-scc: convert to DT schema drivers/of: fdt: validate flat DT string properties before string use drivers/of: fdt: validate stdout-path properties before parsing them dt-bindings: sram: Document qcom,hawi-imem compatible dt-bindings: sram: Allow multiple-word prefixes to sram subnode dt-bindings: sram: Document qcom,milos-imem scripts/dtc: Update to upstream version v1.7.2-69-g53373d135579 of: property: Allow fw_devlink device-tree on x86 dt-bindings: arm: cpus: Add Apple M3 CPU core compatibles dt-bindings: display: lt8912b: Drop redundant endpoint properties dt-bindings: opp-v2: Fix example 3 CPU reg value dt-bindings: connector: add pd-disable dependency ... commit 430cc9f42b44d174230f646767e1403699645ec5 Merge: 59bd5ae0db2256 005b25ad117171 Author: Linus Torvalds Date: Fri Apr 17 13:50:10 2026 -0700 Merge tag 'for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux Pull hte updates from Dipen Patel: - Add tegra264 HTE driver and dt binding support - Remove tegra194 SoC Kconfig dependency - Replace use of system_unbound_wq with system_dfl_wq * tag 'for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux: hte: tegra194: Add Tegra264 GTE support dt-bindings: timestamp: Add Tegra264 support hte: tegra194: remove Kconfig dependency on Tegra194 SoC hte: replace use of system_unbound_wq with system_dfl_wq commit 19d32966e1f68623ac9d95fbcf34b1fb1a7be48d Author: Marco Crivellari Date: Mon Feb 23 10:29:20 2026 +0100 block/blk-throttle: Add WQ_PERCPU to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Cc: Josef Bacik Cc: cgroups@vger.kernel.org Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20260223092920.60424-3-marco.crivellari@suse.com Signed-off-by: Jens Axboe commit 98236343bb5dbbf3fcb3260795be2bbb1e3d2001 Author: Marco Crivellari Date: Mon Feb 23 10:29:19 2026 +0100 block: Add WQ_PERCPU to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20260223092920.60424-2-marco.crivellari@suse.com Signed-off-by: Jens Axboe commit 41c665aae2b5dbecddddcc8ace344caf630cc7a4 Author: Naman Jain Date: Fri Apr 10 15:34:14 2026 +0000 block: relax pgmap check in bio_add_page for compatible zone device pages bio_add_page() and bio_integrity_add_page() reject pages from different dev_pagemaps entirely, returning 0 even when those pages have compatible DMA mapping requirements. This forces callers to start a new bio when buffers span pgmap boundaries, even though the pages could safely coexist as separate bvec entries. This matters for guests where memory is registered through devm_memremap_pages() with MEMORY_DEVICE_GENERIC in multiple calls, creating separate dev_pagemaps for each chunk. When a direct I/O buffer spans two such chunks, bio_add_page() rejects the second page, forcing an unnecessary bio split or I/O failure. Introduce zone_device_pages_compatible() in blk.h to check whether two pages can coexist in the same bio as separate bvec entries. The block DMA iterator (blk_dma_map_iter_start) caches the P2PDMA mapping state from the first segment and applies it to all others, so P2PDMA pages from different pgmaps must not be mixed, and neither must P2PDMA and non-P2PDMA pages. All other combinations (MEMORY_DEVICE_GENERIC pages from different pgmaps, or MEMORY_DEVICE_GENERIC with normal RAM) use the same dma_map_phys path and are safe. Replace the blanket zone_device_pages_have_same_pgmap() rejection with zone_device_pages_compatible(), while keeping zone_device_pages_have_same_pgmap() as a merge guard. Pages from different pgmaps can be added as separate bvec entries but must not be coalesced into the same segment, as that would make it impossible to recover the correct pgmap via page_pgmap(). Fixes: 49580e690755 ("block: add check when merging zone device pages") Cc: stable@vger.kernel.org Signed-off-by: Naman Jain Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260410153414.4159050-3-namjain@linux.microsoft.com Signed-off-by: Jens Axboe commit 13920e4b7b784b40cf4519ff1f0f3e513476a499 Author: Naman Jain Date: Fri Apr 10 15:34:13 2026 +0000 block: add pgmap check to biovec_phys_mergeable biovec_phys_mergeable() is used by the request merge, DMA mapping, and integrity merge paths to decide if two physically contiguous bvec segments can be coalesced into one. It currently has no check for whether the segments belong to different dev_pagemaps. When zone device memory is registered in multiple chunks, each chunk gets its own dev_pagemap. A single bio can legitimately contain bvecs from different pgmaps -- iov_iter_extract_bvecs() breaks at pgmap boundaries but the outer loop in bio_iov_iter_get_pages() continues filling the same bio. If such bvecs are physically contiguous, biovec_phys_mergeable() will coalesce them, making it impossible to recover the correct pgmap for the merged segment via page_pgmap(). Add a zone_device_pages_have_same_pgmap() check to prevent merging bvec segments that span different pgmaps. Fixes: 49580e690755 ("block: add check when merging zone device pages") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Signed-off-by: Naman Jain Link: https://patch.msgid.link/20260410153414.4159050-2-namjain@linux.microsoft.com Signed-off-by: Jens Axboe commit e784f2ea0b4fd0e7b70028ff8218f22456c5dcf8 Author: Guangshuo Li Date: Wed Apr 15 22:57:08 2026 +0800 floppy: fix reference leak on platform_device_register() failure When platform_device_register() fails in do_floppy_init(), the embedded struct device in floppy_device[drive] has already been initialized by device_initialize(), but the failure path jumps to out_remove_drives without dropping the device reference for the current drive. Previously registered floppy devices are cleaned up in out_remove_drives, but the device for the drive that fails registration is not, leading to a reference leak. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by calling put_device() for the current floppy device before jumping to the common cleanup path. Fixes: 94fd0db7bfb4a ("[PATCH] Floppy: Add cmos attribute to floppy driver") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260415145708.3331818-1-lgs201920130244@gmail.com Signed-off-by: Jens Axboe commit a7c9fa7f6601c84d27cdd43bd96e8fcbacfb7479 Author: Ming Lei Date: Thu Apr 16 07:02:46 2026 +0800 ublk: use unchecked copy helpers for bio page data Bio pages may originate from slab caches that lack a usercopy region (e.g. jbd2 frozen metadata buffers allocated via jbd2_alloc()). When CONFIG_HARDENED_USERCOPY is enabled, copy_to_iter() calls check_copy_size() which rejects these slab pages, triggering a kernel BUG in usercopy_abort(). This is a false positive: the data is ordinary block I/O content — the same data the loop driver writes to its backing file via vfs_iter_write(). The bvec length is always trusted, so the size check in check_copy_size() is not needed either. Switch to _copy_to_iter()/_copy_from_iter() which skip the check_copy_size() wrapper while the underlying copy_to_user() remains unchanged. Acked-by: Caleb Sander Mateos Fixes: 2299ceec364e ("ublk: use copy_{to,from}_iter() for user copy") Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260415230246.808176-1-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 2f5015461984caa8ebf265a60b22f38c94d9c70a Author: Caleb Sander Mateos Date: Wed Apr 15 15:08:47 2026 -0600 t10-pi: reduce ref tag code duplication t10_pi_ref_tag() and ext_pi_ref_tag() are identical except for the final truncation of the ref tag to 32 or 48 bits. Factor out a helper full_pi_ref_tag() to return the untruncated ref tag and use it in t10_pi_ref_tag() and ext_pi_ref_tag(). Signed-off-by: Caleb Sander Mateos Reviewed-by: Anuj Gupta Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260415210847.1730016-1-csander@purestorage.com Signed-off-by: Jens Axboe commit b2a4fe0960aee9a2c8045cfd26fbeacf30b26efe Merge: 357e460a309970 7866ce992cf0d3 Author: Miquel Raynal Date: Fri Apr 17 21:51:05 2026 +0200 Merge tag 'nand/for-7.1' into mtd/next The main changes happened in the SunXi driver in order to support new versions of the Allwinner NAND controller. There are also some DT-binding improvements and cleanups. Finally a couple of actual fixes (Realtek ECC and Winbond SPI NAND), aside with the usual load of misc changes. commit 357e460a3099702a904f8b164a13305c34d4385d Merge: b800359a4dfaca cf6788aed0cd91 Author: Miquel Raynal Date: Fri Apr 17 21:50:54 2026 +0200 Merge tag 'spi-nor/for-7.1' into mtd/next SPI NOR changes for 7.1 There is only a collection of bugfixes this time around, with no notable changes to the core. Some of the more noteworthy bugfixes listed below. - Enable die erase on MT35XU02GCBA. We knew this flash needed this fixup since 7f77c561e227 ("mtd: spi-nor: micron-st: add TODO for fixing mt35xu02gcba") but did not add it due to lack of hardware to test on. - Fix locking on some Winbond w25q series flashes. - Fix Auto Address Increment (AAI) writes on SST that flashes that start on odd address. The write enable latch needs to be set again after the single byte program. commit dd88d42d9ca0dd7a4ed327dd33f6ead76cedf726 Author: Prike Liang Date: Wed Apr 8 14:00:04 2026 +0800 drm/amdgpu: drop userq fence driver refs out of fence process() amdgpu_userq_wait_ioctl() takes extra references on waited-on fence drivers and stores them in waitq->fence_drv_xa. When a new userq fence is created, those references are transferred into userq_fence->fence_drv_array so they can be released when the fence completes. However, those inherited references are currently only dropped from amdgpu_userq_fence_driver_process(). If a fence never reaches that path, such as it is already signaled when created, so we need to explicitly release those fences in that case. v2: use a list(list_cut_before) for managing the signal userq driver fences.(Christian) Link: https://patchwork.freedesktop.org/patch/718078/?series=164763&rev=2 v3: Doesn't cache the userq first unsignaled fence and use the cut before list head directly.(Christian) Cc: Alex Deucher Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit b250a43bf57e544071a834a7f4223dcc58270a6b Author: Sunil Khatri Date: Mon Apr 13 18:23:06 2026 +0530 drm/amdgpu/userq: unpin and unref doorbell and wptr outside mutex In amdgpu_userq_destroy once unmap_helpder is called within mutex there is no need to hold mutex. This helps in avoiding a deadlock between doorbell and wptr ww mutex and we could unpin and unref these bos outside mutex safely. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit d3a9fe4584ffb4717e5362d8259794c6220fc465 Author: Sunil Khatri Date: Sat Apr 11 13:41:06 2026 +0530 drm/amdgpu/userq: use pm_runtime_resume_and_get and fix err handling Use pm_runtime_resume_and_get instead of pm_runtime_get_sync as it return error but put the reference in the function itself. In goto statements we need to drop the pm reference too. Signed-off-by: Sunil Khatri Reviewed-by: Alex Deucher Acked-by: Christian König Signed-off-by: Alex Deucher commit 1e8b7062d2a8f7cecdbf7ae3fd07efc49a300d0f Author: Sunil Khatri Date: Mon Apr 13 11:46:47 2026 +0530 drm/amdgpu/userq: unmap_helper dont return the queue state We check for return value of amdgpu_userq_unmap_helper and compare it against the queue->state which is logically wrong and we should just check for failure and do the needfull. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 810df8de2f1f4602c4279455db0a88307ece5c00 Author: Sunil Khatri Date: Mon Apr 13 11:38:46 2026 +0530 drm/amdgpu/userq: unmap is to be called before freeing doorbell/wptr bo Unmap the queue after freeing doorbell and wptr memory is completely wrong. Any operation on the queue needs the doorbell and wptr to be valid and hence fixing the ordering. Also since we are using amdgpu_bo_reserve in non interruptrable mode so there is no need to check for its return values. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 85653fe2e52e19034db5914d65a4579dd7c4b275 Author: Sunil Khatri Date: Wed Apr 8 21:34:27 2026 +0530 drm/amdgpu/userq: hold root bo lock in caller of input_va_validate Caller should hold the reservation lock for root.bo in func amdgpu_userq_input_va_validate. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 168178b0cbac72f7adecdcbd68c04e1fd644abf5 Author: Sunil Khatri Date: Wed Apr 8 17:56:23 2026 +0530 drm/amdgpu/userq: caller to take reserv lock for vas_list_cleanup In function amdgpu_userq_buffer_vas_list_cleanup, remove the reservation lock for vm and caller should make sure it's taken before locking userq_mutex. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 469e6fea0949216d150c7b999d95ad0e0203ce27 Author: Sunil Khatri Date: Thu Apr 9 12:59:33 2026 +0530 drm/amdgpu/userq: create_mqd does not need userq_mutex Reshuffle the code to run create_mqd outside the mutex. code here is mostly setting up software structure init before actually registering the userqueue in the xa and to the driver. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 51358444d18d8b9905d7eb1a30686aa5610b2b5f Author: Sunil Khatri Date: Wed Apr 8 17:16:24 2026 +0530 drm/amdgpu/userq: dont lock root bo with userq_mutex held Do not hold reservation lock for root bo if userq_mutex is already held in the call flow this cause a lock issue with ttm_bo_delayed_delete. Its better to lock the vm->root.bo first and then go ahead with userq_mutex so userq_mutex threads dont get stuck until the reservation lock is held. In this case it helps in the function amdgpu_userq_buffer_vas_mapped for each queue during restore_all. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 1eb90c7403c4afae1d791a2671f4873fd8d44c34 Author: Sunil Khatri Date: Wed Apr 8 15:11:05 2026 +0530 drm/amdgpu/userq: fix kerneldoc for amdgpu_userq_ensure_ev_fence Move the comment for the caller to the definition for amdgpu_userq_ensure_ev_fence in kerneldoc format. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit dc87834e9a50fcad2de8c4be5a8912f40e9b9e9e Author: Sunil Khatri Date: Wed Apr 8 10:35:05 2026 +0530 drm/amdgpu/userq: clean the VA mapping list for failed queue creation If the queue creation failed during mapping of the important VA's like queue_va, rptr_va and wptr_va. These needs to be cleaned as queue destroy will not be called for such queues as user never get call to creation failure. Signed-off-by: Sunil Khatri Acked-by: Christian König Signed-off-by: Alex Deucher commit a7fe8c1b6cf0cd217a8d22609cf9e0c1fe26e873 Author: Sunil Khatri Date: Wed Apr 8 10:21:53 2026 +0530 drm/amdgpu/userq: avoid uneccessary locking in amdgpu_userq_create Reorganise code to avoid holding mutex userq_mutex while also trying to grab exec lock ww_mutex where its not needed for function amdgpu_userq_input_va_validate Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 732a8adde033fb084f16409206b7d9ee9c3849c9 Author: Srinivasan Shanmugam Date: Wed Apr 15 06:33:33 2026 +0530 drm/amd/display: Fix ISM teardown crash from NULL dc dereference The Idle State Manager (ISM) uses delayed work to apply display idle optimizations later, instead of immediately. This helps avoid rapid idle transitions that can hurt power or performance. A crash was seen during driver teardown. The system boots normally and the driver loads successfully. Later, when the GPU is being stopped, the log shows: amdgpu 0000:0e:00.0: finishing device. Workqueue: events_unbound dm_ism_sso_delayed_work_func [amdgpu] After this, delayed ISM work still runs and reaches: dm_ism_sso_delayed_work_func() -> amdgpu_dm_ism_commit_event() -> dm_ism_commit_idle_optimization_state() -> dc_allow_idle_optimizations_internal() The crash report showed: KASAN: null-ptr-deref in range [0x690-0x697] Signature: [22601.113316] KASAN: null-ptr-deref in range [0x0000000000000690-0x0000000000000697] ... [22601.113368] Workqueue: events_unbound dm_ism_sso_delayed_work_func [amdgpu] [22601.113930] RIP: 0010:dc_allow_idle_optimizations_internal+0xa6/0xc40 [amdgpu] ... [22601.114491] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000690 ... [22601.114561] Call Trace: [22601.114566] [22601.114572] ? srso_alias_return_thunk+0x5/0xfbef5 [22601.114582] ? update_load_avg+0x1b6/0x20b0 [22601.114593] ? __pfx_dc_allow_idle_optimizations_internal+0x10/0x10 [amdgpu] [22601.114932] ? psi_group_change+0x4ed/0x8d0 [22601.114942] dm_ism_commit_idle_optimization_state+0x214/0x570 [amdgpu] [22601.115268] amdgpu_dm_ism_commit_event+0xe1d/0x15a0 [amdgpu] [22601.115588] ? srso_alias_return_thunk+0x5/0xfbef5 [22601.115595] ? __kasan_check_write+0x18/0x20 [22601.115603] ? srso_alias_return_thunk+0x5/0xfbef5 [22601.115610] ? mutex_lock+0x83/0xc0 [22601.115620] dm_ism_sso_delayed_work_func+0x64/0x90 [amdgpu] GDB resolved dc_allow_idle_optimizations_internal+0xa6 to: struct dc_state *context = dc->current_state; The matching disassembly showed: mov %rdi, %r12 mov 0x690(%r12), %r13 where r12 holds the dc pointer. A GDB layout dump of struct dc showed: /* 1680 | 8 */ struct dc_state *current_state; Since 1680 decimal is 0x690, this confirms that current_state is at offset 0x690. The faulting access was effectively: dc + 0x690 which indicates that dc was NULL at the time of dereference. This shows that ISM work can still run during teardown after dc has been cleared. ISM is not expected to run after dc is destroyed. Fix this by disabling ISM under dc_lock in amdgpu_dm_fini() before dc_destroy(), ensuring no further ISM work runs after dc teardown. Also add ASSERT(dm->dc) in amdgpu_dm_ism_commit_event() to enforce this invariant, and ASSERT(mutex_is_locked(&dm->dc_lock)) in amdgpu_dm_ism_disable() to clarify the locking requirement. Fixes: 754003486c3c ("drm/amd/display: Add Idle state manager(ISM)") Suggested-by: Leo Li Cc: Ray Wu Cc: Roman Li Cc: Alex Hung Cc: Tom Chung Cc: Harry Wentland Cc: Aurabindo Pillai Cc: Mario Limonciello (AMD) Signed-off-by: Srinivasan Shanmugam Reviewed-by: Leo Li Signed-off-by: Alex Deucher commit 8bf0cb97edb697dba2515e6452c17c5245111448 Author: Rafal Ostrowski Date: Fri Apr 10 09:09:57 2026 +0200 drm/amd/display: Move dml2_destroy to non-FPU compilation unit On PREEMPT_RT kernels, vfree() can sleep because spin_lock is converted to rt_mutex. dml2_destroy() calls vfree() while inside an FPU-guarded region (preempt_count=2), which is illegal. dml2_wrapper_fpu.c is compiled with CC_FLAGS_FPU which defines _LINUX_FPU_COMPILATION_UNIT, making DC_RUN_WITH_PREEMPTION_ENABLED() resolve to a no-op. This prevents the macro from cycling FPU context off/on around vfree(). Move dml2_destroy() to dml2_wrapper.c (non-FPU compilation unit) where DC_RUN_WITH_PREEMPTION_ENABLED() properly cycles DC_FP_END/ DC_FP_START around vfree(). This pairs it with dml2_allocate_memory() which already lives there. Reviewed-by: Dillon Varone Signed-off-by: Rafal Ostrowski Signed-off-by: Chenyu Chen Signed-off-by: Alex Deucher commit 07598c76964a2c73702fa652bcd07ec21088c5ef Author: Wayne Lin Date: Wed Apr 8 15:01:27 2026 +0800 drm/amd/display: Fix fpu guard warning [Why] Due to improper fpu guarding, we encounter this warning during boot up: [ 10.027021] WARNING: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/dc_fpu.c:58 at dc_assert_fp_enabled+0x12/0x20 [amdgpu], CPU#8: (udev-worker)/469 [ 10.027644] Modules linked in: binfmt_misc snd_ctl_led nls_iso8859_1 intel_rapl_msr amd_atl intel_rapl_common amdgpu(+) snd_acp_legacy_mach snd_acp_mach snd_soc_nau8821 snd_acp3x_pdm_dma snd_acp3x_rn snd_soc_dmic snd_sof_amd_acp63 snd_sof_amd_vangogh snd_sof_amd_rembrandt snd_sof_amd_renoir snd_sof_amd_acp snd_sof_pci snd_hda_codec_alc269 snd_sof_xtensa_dsp snd_hda_scodec_component snd_hda_codec_realtek_lib snd_sof snd_hda_codec_generic snd_sof_utils snd_pci_ps snd_soc_acpi_amd_match snd_amd_sdw_acpi soundwire_amd snd_hda_codec_atihdmi soundwire_generic_allocation snd_hda_codec_hdmi soundwire_bus snd_soc_sdca edac_mce_amd snd_hda_intel snd_soc_core snd_hda_codec kvm_amd snd_compress snd_hda_core ac97_bus ee1004 amdxcp snd_pcm_dmaengine snd_intel_dspcfg snd_intel_sdw_acpi kvm drm_panel_backlight_quirks snd_rpl_pci_acp6x gpu_sched snd_hwdep snd_acp_pci irqbypass snd_amd_acpi_mach drm_buddy snd_acp_legacy_common snd_seq_midi ghash_clmulni_intel drm_ttm_helper aesni_intel snd_seq_midi_event snd_pci_acp6x joydev rapl [ 10.027750] snd_pcm snd_rawmidi ttm snd_seq snd_pci_acp5x drm_exec drm_suballoc_helper snd_seq_device wmi_bmof snd_rn_pci_acp3x drm_display_helper snd_timer snd_acp_config cec snd_soc_acpi snd rc_core i2c_piix4 ccp snd_pci_acp3x i2c_smbus soundcore k10temp i2c_algo_bit spi_amd cdc_mbim input_leds cdc_wdm mac_hid sch_fq_codel msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs autofs4 cdc_ncm cdc_ether usbnet mii hid_logitech_hidpp hid_logitech_dj hid_generic nvme nvme_core ahci serio_raw nvme_keyring usbhid ucsi_acpi amd_xgbe nvme_auth libahci hkdf typec_ucsi video typec wmi i2c_hid_acpi i2c_hid hid [ 10.027853] CPU: 8 UID: 0 PID: 469 Comm: (udev-worker) Not tainted 6.19.0asdn-260408-asdn #1 PREEMPT(voluntary) [ 10.027858] Hardware name: AMD Crater-RN/Crater-RN, BIOS TCR1004A 03/12/2024 [ 10.027861] RIP: 0010:dc_assert_fp_enabled+0x12/0x20 [amdgpu] [ 10.028416] Code: 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 65 8b 05 39 79 cc c4 85 c0 7e 07 31 c0 e9 9e 75 2a c3 <0f> 0b 31 c0 e9 95 75 2a c3 0f 1f 44 00 00 90 90 90 90 90 90 90 90 [ 10.028420] RSP: 0018:ffffcca10188b348 EFLAGS: 00010246 [ 10.028425] RAX: 0000000000000000 RBX: ffff88c6077f8000 RCX: 0000000000000000 [ 10.028428] RDX: ffff88c607d0e400 RSI: ffffffffc204d860 RDI: ffff88c624c00000 [ 10.028430] RBP: ffffcca10188b3e8 R08: ffff88c624c35c88 R09: 0000000000000000 [ 10.028433] R10: 0000000000000000 R11: 0000000000000000 R12: ffffcca10188b548 [ 10.028435] R13: ffff88c60be5bd00 R14: ffffffffc204d860 R15: ffff88c624c00000 [ 10.028438] FS: 00007c80c2432980(0000) GS:ffff88cdc7464000(0000) knlGS:0000000000000000 [ 10.028441] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 10.028443] CR2: 00007866ae013da8 CR3: 000000010a511000 CR4: 0000000000350ef0 [ 10.028446] Call Trace: [ 10.028449] [ 10.028452] ? dcn21_update_bw_bounding_box+0x38/0xb30 [amdgpu] [ 10.028991] ? srso_return_thunk+0x5/0x5f [ 10.029001] dc_create+0x37c/0x730 [amdgpu] [ 10.029505] ? srso_return_thunk+0x5/0x5f [ 10.029512] amdgpu_dm_init+0x374/0x2ff0 [amdgpu] [ 10.030053] ? srso_return_thunk+0x5/0x5f [ 10.030057] ? __irq_work_queue_local+0x61/0xe0 [ 10.030063] ? srso_return_thunk+0x5/0x5f [ 10.030067] ? irq_work_queue+0x2f/0x70 [ 10.030071] ? srso_return_thunk+0x5/0x5f [ 10.030075] ? __wake_up_klogd+0x75/0xa0 [ 10.030081] ? srso_return_thunk+0x5/0x5f [ 10.030085] ? vprintk_emit+0x35b/0x3f0 [ 10.030102] dm_hw_init+0x1c/0x110 [amdgpu] [ 10.030625] amdgpu_device_init+0x23e8/0x3210 [amdgpu] [ 10.031041] ? pci_read+0x55/0x90 [ 10.031047] ? srso_return_thunk+0x5/0x5f [ 10.031051] ? pci_read_config_word+0x27/0x50 [ 10.031057] ? srso_return_thunk+0x5/0x5f [ 10.031061] ? do_pci_enable_device+0x155/0x180 [ 10.031068] amdgpu_driver_load_kms+0x1a/0xd0 [amdgpu] [ 10.031486] amdgpu_pci_probe+0x28c/0x6f0 [amdgpu] [ 10.031902] local_pci_probe+0x47/0xb0 [ 10.031908] pci_device_probe+0xf3/0x270 [ 10.031914] really_probe+0xf1/0x410 [ 10.031920] __driver_probe_device+0x8c/0x190 [ 10.031924] driver_probe_device+0x24/0xd0 [ 10.031928] __driver_attach+0x10b/0x240 [ 10.031932] ? __pfx___driver_attach+0x10/0x10 [ 10.031936] bus_for_each_dev+0x8c/0xf0 [ 10.031942] driver_attach+0x1e/0x30 [ 10.031947] bus_add_driver+0x160/0x2a0 [ 10.031952] driver_register+0x5e/0x130 [ 10.031957] ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [ 10.032361] __pci_register_driver+0x5e/0x70 [ 10.032366] amdgpu_init+0x5d/0xff0 [amdgpu] [ 10.032768] ? srso_return_thunk+0x5/0x5f [ 10.032773] do_one_initcall+0x5d/0x340 [ 10.032783] do_init_module+0x97/0x2c0 [ 10.032788] load_module+0x2b49/0x2c30 [ 10.032800] init_module_from_file+0xf4/0x120 [ 10.032804] ? init_module_from_file+0xf4/0x120 [ 10.032813] idempotent_init_module+0x10f/0x300 [ 10.032820] __x64_sys_finit_module+0x73/0xf0 [ 10.032824] ? srso_return_thunk+0x5/0x5f [ 10.032829] x64_sys_call+0x1d68/0x26b0 [ 10.032834] do_syscall_64+0x81/0x500 [ 10.032839] ? srso_return_thunk+0x5/0x5f [ 10.032843] ? do_syscall_64+0x2e5/0x500 [ 10.032848] ? srso_return_thunk+0x5/0x5f [ 10.032852] ? native_flush_tlb_global+0x95/0xb0 [ 10.032860] ? srso_return_thunk+0x5/0x5f [ 10.032864] ? __flush_tlb_all+0x13/0x60 [ 10.032870] ? srso_return_thunk+0x5/0x5f [ 10.032874] ? do_flush_tlb_all+0xe/0x20 [ 10.032879] ? srso_return_thunk+0x5/0x5f [ 10.032882] ? __flush_smp_call_function_queue+0x9c/0x430 [ 10.032888] ? srso_return_thunk+0x5/0x5f [ 10.032897] ? irqentry_exit+0xb2/0x740 [ 10.032901] ? srso_return_thunk+0x5/0x5f [ 10.032906] ? srso_return_thunk+0x5/0x5f [ 10.032911] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 10.032915] RIP: 0033:0x7c80c1d3490d [ 10.032920] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d d3 f4 0f 00 f7 d8 64 89 01 48 [ 10.032923] RSP: 002b:00007fff3a12fe28 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 10.032928] RAX: ffffffffffffffda RBX: 00005c44096804f0 RCX: 00007c80c1d3490d [ 10.032930] RDX: 0000000000000000 RSI: 00005c4409681690 RDI: 000000000000002b [ 10.032933] RBP: 00007fff3a12fec0 R08: 0000000000000000 R09: 00005c4409681790 [ 10.032935] R10: 0000000000000000 R11: 0000000000000246 R12: 00005c4409681690 [ 10.032937] R13: 0000000000020000 R14: 00005c44094ff7f0 R15: 00005c4409681690 [ 10.032945] [ 10.032948] ---[ end trace 0000000000000000 ]--- [How] Add wrapper function to guard fpu properly for dcn21/dcn31/dcn315/dcn316. Fixes: 3539437f354b ("drm/amd/display: Move FPU Guards From DML To DC - Part 1") Reviewed-by: Dillon Varone Reviewed-by: Rafal Ostrowski Signed-off-by: Wayne Lin Signed-off-by: Chenyu Chen Signed-off-by: Alex Deucher commit 0f6d7ec4f1b4febd3f9c6ab39efc25a7cb922cab Author: Srinivasan Shanmugam Date: Sat Apr 11 21:35:39 2026 +0530 drm/amdgpu: Clear cached EDID pointer after drm_edid_free() The driver stores EDID in amdgpu_connector->edid and uses it as a cache. amdgpu_connector_get_edid() checks this pointer. If it is not NULL, it assumes EDID is already present and does not read it again. In some detect paths, the driver frees the EDID using drm_edid_free(), but does not set the pointer to NULL. Because of this, the pointer still looks valid even though the memory is already freed. Later, when amdgpu_connector_get_edid() is called, it returns early and does not read a new EDID. This can lead to using a freed pointer. Fix this by setting amdgpu_connector->edid = NULL after drm_edid_free(). This makes sure the driver reads a fresh EDID and does not use invalid memory. Fixes: 71036457ad85 ("drm/amdgpu/amdgpu_connectors: remove amdgpu_connector_free_edid") Reported-by: Dan Carpenter Cc: Joshua Peisach Cc: Alex Deucher Cc: Christian König Signed-off-by: Srinivasan Shanmugam Reviewed-by: Joshua Peisach Signed-off-by: Alex Deucher commit b5245cbe44115d2eb14c2c273771211e1b170c41 Author: Taimur Hassan Date: Fri Apr 3 04:34:51 2026 -0500 drm/amd/display: Promote DC to 3.2.378 DC v3.2.378 summary: New: - Add p-state schedule admissibility flags and frame-time utility Fixes: - Fixed incorrect math_mod() result due to wrong variable in fmod implementation (Cc: stable) - Use overlay cursor when a color pipeline is active to avoid incorrect rendering Cleanups: - Add const qualifiers to watermark params struct - Fix narrowing-conversion compiler warnings Signed-off-by: Taimur Hassan Signed-off-by: Aurabindo Pillai Reviewed-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8d7d0fd7db2c4435dcb3b5f21100c29286ee8b4c Author: Wenjing Liu Date: Thu Mar 26 17:39:28 2026 -0400 drm/amd/display: add pstate schedule admissibility flags and frame-time utility [Why] Core needs to track pstate schedule admissibility for different global change scenarios (fclk, temp read, PPT) and requires a reusable way to compute per-stream frame time from timing parameters. [How] Extend dml2_core_internal_mode_support_info with: fclk_pstate_schedule_admissible temp_read_pstate_schedule_admissible ppt_pstate_schedule_admissible Add dummy_double_array[3][DML2_MAX_PLANES] to dml2_core_calcs_mode_support_locals. Introduce dml2_core_utils_get_frame_time_us() in dml2_core_utils.c and export it in dml2_core_utils.h to compute frame time in microseconds from stream timing (vline time * (vactive + vblank)). Reviewed-by: Dillon Varone Signed-off-by: Wenjing Liu Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit dd2308c1d007d7a3416c02e542abdc6acc23966d Author: Wenjing Liu Date: Thu Mar 26 17:13:27 2026 -0400 drm/amd/display: add const qualifiers to watermark params struct [why] There are few non const input pointer fields. Setting them to const to prevent future modification of read-only data. Reviewed-by: Dillon Varone Signed-off-by: Wenjing Liu Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 2b104fc31be0607c04188fadbd4a9fa5b50f3b99 Author: Wenjing Liu Date: Thu Mar 26 12:00:34 2026 -0400 drm/amd/display: fix math_mod() using arg1 instead of arg2 [Why] math_mod() multiplied by arg1 instead of arg2, returning a wrong result for any non-trivial modulo operation. [How] Replace arg1 with arg2 in the subtraction term to correctly implement fmod(arg1, arg2). Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Dillon Varone Signed-off-by: Wenjing Liu Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d3a549f4df7864bca8612c8bcfce1ec72b2874fb Author: Alex Hung Date: Tue Mar 24 20:03:25 2026 -0600 drm/amd/display: Use overlay cursor when color pipeline is active Force overlay cursor mode when an underlying plane has a non-bypassed color pipeline to avoid incorrect cursor transformation. Reviewed-by: Sun peng (Leo) Li Signed-off-by: Alex Hung Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 82f510ae5ac8b8ff7cfd757aab1ff0fc4f22aed0 Author: Gaghik Khachatrian Date: Fri Mar 20 16:57:35 2026 -0400 drm/amd/display: Fix compiler warnings [Why] Implicit conversions from wider integer types to byte-sized fields were generating compiler warnings. These warnings hide intentional protocol /storage boundaries and reduce signal quality during builds. Making conversion intent explicit improves readability and warning hygiene without changing behavior. [How] Added explicit, type-safe casts at intentional narrow-storage boundaries. Kept data models & runtime logic unchanged, only clarifying conversion intent. Functionality and behavior is unchanged; only type intent is explicit. Aligned warning cleanup with existing coding standards for explicit boundary conversions. Reviewed-by: Aric Cyr Signed-off-by: Gaghik Khachatrian Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 17edfa32f1496df914b355cf7c0711a481765446 Author: Ray Wu Date: Tue Apr 7 16:24:39 2026 +0800 drm/amd/display: fix NULL ptr deref in ISM delayed work dc_destroy() sets dm->dc to NULL before amdgpu_dm_ism_fini() is called, leaving a window where in-flight ISM delayed work dereferences the stale pointer. Call amdgpu_dm_ism_fini() in amdgpu_dm_fini() before dc_destroy(). Fixes: 754003486c3c ("drm/amd/display: Add Idle state manager(ISM)") Reviewed-by: Leo Li Signed-off-by: Ray Wu Signed-off-by: Alex Deucher commit 7949927ad03c70582c21436442eef30269869732 Author: Srinivasan Shanmugam Date: Thu Apr 9 07:11:48 2026 +0530 drm/amd/display: Add missing do_mccs parameter description Add missing description for do_mccs parameter in amdgpu_dm_update_freesync_caps. Fixes the below with gcc W=1: ../display/amdgpu_dm/amdgpu_dm.c:13269 function parameter 'do_mccs' not described in 'amdgpu_dm_update_freesync_caps' Fixes: 8dc88c6a5948 ("drm/amd/display: Avoid to do MCCS transaction if unnecessary") Cc: Harry Wentland Cc: Wayne Lin Cc: Roman Li Cc: Alex Hung Cc: Tom Chung Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 1fd0c5c91e1c735edd6714e2269a7c734ab895b7 Author: Roman Li Date: Thu Apr 9 13:37:36 2026 -0400 drm/amd/display: Remove redundant includes from DC [Why] The explicit include of linux/array_size.h in Display Core (DC) is redundant. The ARRAY_SIZE macro is already provided by dm_services.h (via os_types.h) which DC includes. [How] Remove the unnecessary #include from dc_hw_sequencer.c and dce_clock_source.c. Fixes: 2d2366176445 ("drm/amd/display: Replace inline NUM_ELEMENTS macro with ARRAY_SIZE") CC: Linus Probert Signed-off-by: Roman Li Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 1e65171a1daccaf2b37c8b1b2f9df71e550e75c8 Author: Taimur Hassan Date: Fri Mar 27 18:54:22 2026 -0500 drm/amd/display: Promote DC to 3.2.377 This version brings along the following updates: - Enable sink freesync via MCCS with pcon whitelist adjustments - Rework YCbCr422 DSC policy - Update DML2.1 parameters - Fix coding style issues and compiler warnings Reviewed-by: Leo Li Signed-off-by: Taimur Hassan Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit a62346043a89d2cc1693e52f55783aa3cf91471e Author: Chuanyu Tseng Date: Sat Mar 28 08:13:49 2026 +0800 drm/amd/display: Fix coding style issue [Why & How] Function logic should put after variable declare section, so let's move it. Reviewed-by: Aurabindo Pillai Signed-off-by: Chuanyu Tseng Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 0bb8605a8bef8731e0d7ab77707943f9447ba3c4 Author: Zheng, Austin Date: Thu Mar 26 13:29:32 2026 -0400 drm/amd/display: Remove Duplicate Prefetch Parameter [Why/How] UrgLatency value is passed in twice to the prefetch calculations. Once through the UrgentLatency term and once through the Turg term. Only Turg is used in the prefetch calculation so remove the unused UrgentLatency parameter Reviewed-by: Dillon Varone Signed-off-by: Zheng, Austin Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit bcfeed174882248d079a7ce02d0b4f7ca2467436 Author: Nicholas Kazlauskas Date: Wed Mar 25 14:37:04 2026 -0400 drm/amd/display: Add DCN42 PMO policy for DML2.1 [Why] The MinTTU policy in DML2.1 does not guarantee that we support p-state in blank. This is a delta vs dml2 and earlier revisions as the prefetch mode override has been removed in favor of a more configurable pstate optimizer. [How] Split off DCN42 with its own PMO helpers so that we can use a simpler strategy of only allowing the mode if we support p-state in vblank and if vactive has enough latency hiding. The actual hookup to use these helpers in the PMO factory will be done in a later patch to satisfy build system requirements. Reviewed-by: Dillon Varone Signed-off-by: Nicholas Kazlauskas Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 136d15b077e3ec3ab7df5848cba0bb3a5eff222c Author: Dmytro Laktyushkin Date: Wed Mar 25 17:07:03 2026 -0400 drm/amd/display: move memory latency update to dml for dcn42 Memory latencies are soc specific and should be part of dml soc bounding box. This change removes them from clk_mgr and has latency update happen based on memory type when dml socbb is being updated. Reviewed-by: Nicholas Kazlauskas Reviewed-by: Charlene Liu Signed-off-by: Dmytro Laktyushkin Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 355408042a4ddbd56548d7e7f6ab49731a7efa4b Author: Gaghik Khachatrian Date: Mon Mar 23 15:26:53 2026 -0400 drm/amd/display: Fix implicit narrowing conversions in modules [Why]: Implicit narrowing of wider integer types (unsigned int, uint64_t) into narrower fields (uint8_t, uint16_t, unsigned short) has potential truncation issues. [How]: For each warning site, added ASSERT( <= 0xFFFF/0xFF) for debug-mode bounds verification followed by an explicit cast. Typed intermediate variables introduced where needed for clarity. No functional change intended. Reviewed-by: Dillon Varone Signed-off-by: Gaghik Khachatrian Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 463a84daf2875582f5fd6d0a27bf80bcc7e73192 Author: Dmytro Laktyushkin Date: Wed Mar 25 17:03:25 2026 -0400 drm/amd/display: update dcn42 memory latencies Add latency update based on memory type to dml2.1 Reviewed-by: Dillon Varone Signed-off-by: Dmytro Laktyushkin Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit a0ce0de0ce9c7d60a6f22417c2237ad36687ef86 Author: Nicholas Kazlauskas Date: Thu Mar 19 14:39:14 2026 -0400 drm/amd/display: Fix DCN42 gpuvm_min_page_size_kbytes in SOC BB [Why & How] To match the HW specification this should be 4, not 256. Reviewed-by: Dillon Varone Signed-off-by: Nicholas Kazlauskas Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 07ac59230d5fd603d56af2363dae80d3e973e4bc Author: Nicholas Kazlauskas Date: Thu Mar 19 14:34:56 2026 -0400 drm/amd/display: Pass min page size from SOC BB to dml2_1 plane config [Why] Like dml2_0 this isn't guaranteed to be constant for every ASIC. This can cause corruption or underflow for linear surfaces due to a wrong PTE_ROW_HEIGHT_LINEAR value if not correctly specified. [How] Like dml2_0 pass in the SOC bb into the plane configuration population functions. Set both GPUVM and HostVM page sizes in the overrides. Reviewed-by: Dillon Varone Signed-off-by: Nicholas Kazlauskas Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 5a89553231833ee2ac5dc228855791c219e7d784 Author: Nicholas Kazlauskas Date: Tue Mar 24 11:50:18 2026 -0400 drm/amd/display: Correct MALL parameters for DCN42 soc bb [Why & How] The MALL and DCC parameters were copied and pasted from a previous ASIC but the correct value per HW specification should all be 0. If not correct this can impact urgent bandwidth calculation and PMO. Reviewed-by: Dillon Varone Signed-off-by: Nicholas Kazlauskas Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 5721b5b9c9c792233d7817239bd81925fb3ad9d1 Author: Nicholas Kazlauskas Date: Tue Mar 24 14:28:12 2026 -0400 drm/amd/display: Fix HostVMMinPageSize unit mismatch in DML2.1 [Why] This was found back on DML2 but was missed when creating DML2.1. The bottom layer calculation (CalculateHostVMDynamicLevels) expects a value in bytes, not KB, but we pass in the value in KB (eg. 4). This causes an extra page table level to be required in the prefetch bytes which can be significant overhead - preventing some modes from being supported that should otherwise be. [How] Correct the units by multiplying the input and override values by 1024. Reviewed-by: Austin Zheng Signed-off-by: Nicholas Kazlauskas Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8dc88c6a5948c9565f4901f2a62c74306a8eda8d Author: Wayne Lin Date: Wed Mar 11 16:11:57 2026 +0800 drm/amd/display: Avoid to do MCCS transaction if unnecessary We don't have to do MCCS/DDCCI transactions with sink side every time by calling get_modes(). Limit it to be operated when hotplug occurs. Reviewed-by: Harry Wentland Signed-off-by: Wayne Lin Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 602b8ef9d2a607c6028c6b9d8e174b2e859dd769 Author: Wayne Lin Date: Fri Mar 6 16:32:36 2026 +0800 drm/amd/display: Enable sink freesync via MCCS If sink like HDMI indicates supporting freesync via MCCS, explicitly to send vcp set command on sink to enable freesync. Reviewed-by: Harry Wentland Signed-off-by: Wayne Lin Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 6f71d5dd320663f2003fff252a5da93f4f753bef Author: Wayne Lin Date: Tue Mar 3 13:55:42 2026 +0800 drm/amd/display: Read sink freesync support via mccs If EDID AMD VSDB declares that sink supports MCCS method for freesync usage, send mccs request to understand sink freesync current supporting state. If sink supports freesync but user toggles OSD to turn off it, disable freesync. If HDMI sink doesn't support MCCS method for freesync usage, disable freesync as well. Reviewed-by: Harry Wentland Signed-off-by: Wayne Lin Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 72022bad019e038c647a8ea50193ed30459fdb19 Author: Wayne Lin Date: Tue Mar 3 16:00:24 2026 +0800 drm/amd/display: Parse freesync mccs vcp code [Why & How] DMUB supports to parse freesynce mccs vcp code now. Store it for later freesync mccs manipulation. Reviewed-by: Harry Wentland Signed-off-by: Wayne Lin Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d49086491bcb7bde67f0cc760c72ea12444ecb79 Author: Wayne Lin Date: Thu Mar 5 17:07:16 2026 +0800 drm/amd/display: Adjust freesync pcon whitelist Add more freesync supported pcon ID into the whitelist. Reviewed-by: Harry Wentland Signed-off-by: Wayne Lin Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d79e023f2fb96c0e3c5683d1097a8d0f334dc18f Author: George Shen Date: Mon Mar 23 17:15:16 2026 -0400 drm/amd/display: Remove unnecessary Freesync w/a from DCN32 [Why/How] A workaround was previously used for certain Freesync cases that would override the vstartup_start value from DML to position the SDP correctly. This is no longer needed in DCN32 and above, so remove the workaround. Reviewed-by: Dillon Varone Signed-off-by: George Shen Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit ba86f9b5c09aee64923b90b7d7add993fcb34a89 Author: Relja Vojvodic Date: Fri Mar 20 15:40:25 2026 -0400 drm/amd/display: Rework YCbCr422 DSC policy - Reworked YCbCr4:2:2 Native/Simple policy decision making with DSC enabled based on DSC caps and stream signal type Reviewed-by: Wenjing Liu Signed-off-by: Relja Vojvodic Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 06ea8754956dfbed15657c7df6f95ae8689f4a7b Author: Charlene Liu Date: Fri Feb 27 21:17:37 2026 -0500 drm/amd/display: update dcn42 bounding box [why] update according hw spec. Reviewed-by: Dillon Varone Signed-off-by: Charlene Liu Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit e1d486445af3c392628532229f7ce5f5cf7891b6 Author: Puranjay Mohan Date: Fri Apr 17 07:33:52 2026 -0700 bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT The ARM32 BPF JIT does not support BPF-to-BPF function calls (BPF_PSEUDO_CALL) or callbacks (BPF_PSEUDO_FUNC), but it does not reject them either. When a program with subprograms is loaded (e.g. libxdp's XDP dispatcher uses __noinline__ subprograms, or any program using callbacks like bpf_loop or bpf_for_each_map_elem), the verifier invokes bpf_jit_subprogs() which calls bpf_int_jit_compile() for each subprogram. For BPF_PSEUDO_CALL, since ARM32 does not reject it, the JIT silently emits code using the wrong address computation: func = __bpf_call_base + imm where imm is a pc-relative subprogram offset, producing a bogus function pointer. For BPF_PSEUDO_FUNC, the ldimm64 handler ignores src_reg and loads the immediate as a normal 64-bit value without error. In both cases, build_body() reports success and a JIT image is allocated. ARM32 lacks the jit_data/extra_pass mechanism needed for the second JIT pass in bpf_jit_subprogs(). On the second pass, bpf_int_jit_compile() performs a full fresh compilation, allocating a new JIT binary and overwriting prog->bpf_func. The first allocation is never freed. bpf_jit_subprogs() then detects the function pointer changed and aborts with -ENOTSUPP, but the original JIT binary has already been leaked. Each program load/unload cycle leaks one JIT binary allocation, as reported by kmemleak: unreferenced object 0xbf0a1000 (size 4096): backtrace: bpf_jit_binary_alloc+0x64/0xfc bpf_int_jit_compile+0x14c/0x348 bpf_jit_subprogs+0x4fc/0xa60 Fix this by rejecting both BPF_PSEUDO_CALL in the BPF_CALL handler and BPF_PSEUDO_FUNC in the BPF_LD_IMM64 handler, falling through to the existing 'notyet' path. This causes build_body() to fail before any JIT binary is allocated, so bpf_int_jit_compile() returns the original program unjitted. bpf_jit_subprogs() then sees !prog->jited and cleanly falls back to the interpreter with no leak. Acked-by: Daniel Borkmann Fixes: 1c2a088a6626 ("bpf: x64: add JIT support for multi-function programs") Reported-by: Jonas Rebmann Closes: https://lore.kernel.org/bpf/b63e9174-7a3d-4e22-8294-16df07a4af89@pengutronix.de Tested-by: Jonas Rebmann Signed-off-by: Puranjay Mohan Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260417143353.838911-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit f75aeb2de89127052975b1bfade88ac87f164f4a Author: Amery Hung Date: Fri Apr 17 10:49:00 2026 -0700 bpf: Dissociate struct_ops program with map if map_update fails Currently, when bpf_struct_ops_map_update_elem() fails, the programs' st_ops_assoc will remain set. They may become dangling pointers if the map is freed later, but they will never be dereferenced since the struct_ops attachment did not succeed. However, if one of the programs is subsequently attached as part of another struct_ops map, its st_ops_assoc will be poisoned even though its old st_ops_assoc was stale from a failed attachment. Fix the spurious poisoned st_ops_assoc by dissociating struct_ops programs with a map if the attachment fails. Move bpf_prog_assoc_struct_ops() to after *plink++ to make sure bpf_prog_disassoc_struct_ops() will not miss a program when iterating st_map->links. Note that, dissociating a program from a map requires some attention as it must not reset a poisoned st_ops_assoc or a st_ops_assoc pointing to another map. The former is already guarded in bpf_prog_disassoc_struct_ops(). The latter also will not happen since st_ops_assoc of programs in st_map->links are set by bpf_prog_assoc_struct_ops(), which can only be poisoned or pointing to the current map. Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260417174900.2895486-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 41d701ddc36d5301b44ea79529f3cf03c541c1e1 Author: Guopeng Zhang Date: Fri Apr 17 11:37:41 2026 +0800 cgroup/cpuset: record DL BW alloc CPU for attach rollback cpuset_can_attach() allocates DL bandwidth only when migrating deadline tasks to a disjoint CPU mask, but cpuset_cancel_attach() rolls back based only on nr_migrate_dl_tasks. This makes the DL bandwidth alloc/free paths asymmetric: rollback can call dl_bw_free() even when no dl_bw_alloc() was done. Rollback also needs to undo the reservation against the same CPU/root domain that was charged. Record the CPU used by dl_bw_alloc() and use that state in cpuset_cancel_attach(). If no allocation happened, dl_bw_cpu stays at -1 and rollback skips dl_bw_free(). If allocation did happen, bandwidth is returned to the same CPU/root domain. Successful attach paths are unchanged. This only fixes failed attach rollback accounting. Fixes: 2ef269ef1ac0 ("cgroup/cpuset: Free DL BW in case can_attach() fails") Signed-off-by: Guopeng Zhang Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 73cea8c0b60ea5ec6afc26da6ea1118e81d618a8 Author: Roman Li Date: Wed Apr 1 17:38:26 2026 -0400 drm/amd/display: Drop unused tiling formats from dml2 Remove unused legacy tiling format support from dml2. Legacy asics don't use dml2. Fixes: e56e3cff2a1b ("drm/amd/display: Sync dcn42 with DC 3.2.373") Reviewed-by: Leo Li Signed-off-by: Roman Li Signed-off-by: Alex Deucher commit b35601c5432a52c5a889a8bf505bbe2540e13254 Author: Gaghik Khachatrian Date: Sat Mar 7 15:10:13 2026 -0500 drm/amd/display: Fix unused parameters warnings in dml2_0 [Why] Resolve warnings by marking unused parameters explicitly. [How] Keep parameter names in signatures and add a line with '(void)param;' inside the function body Preserved function signatures and avoids breaking code paths that may reference the parameter under conditional compilation. Reviewed-by: Dillon Varone Reviewed-by: Clayton King Signed-off-by: Gaghik Khachatrian Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit e1fb16cef03ec1c12301ae1b26b77118851a14d7 Author: Srinivasan Shanmugam Date: Fri Apr 10 17:57:56 2026 +0530 drm/amdgpu/mes_v12_1: Fix iterator reuse in mes_v12_1_test_ring() This code waits for the MES self-test to complete by repeatedly checking a register or memory value until it becomes valid or a timeout occurs. The fix ensures the timeout counter works correctly by not reusing the same variable inside another loop. mes_v12_1_test_ring() uses 'i' as the outer timeout loop counter, but reuses the same variable for the inner XCC scan in cooperative mode. This makes the timeout counter ambiguous and can lead to incorrect timeout handling. It also triggers a Smatch warning about reusing the outer loop iterator. Fix this by introducing a separate iterator for the inner XCC loop so that 'i' continues to represent only the timeout wait duration. drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:2080 mes_v12_1_test_ring() warn: reusing outside iterator: 'i' drivers/gpu/drm/amd/amdgpu/mes_v12_1.c 2069 atomic64_set((atomic64_t *)wptr_cpu_addr, wptr); 2070 WDOORBELL64(doorbell_idx, wptr); 2071 2072 for (i = 0; i < adev->usec_timeout; i++) { i is counting usec 2073 if (queue_type == AMDGPU_RING_TYPE_SDMA) { 2074 tmp = le32_to_cpu(*cpu_ptr); 2075 } else { 2076 if (!adev->mes.enable_coop_mode) { 2077 tmp = RREG32_SOC15(GC, GET_INST(GC, xcc_id), 2078 regSCRATCH_REG0); 2079 } else { --> 2080 for (i = 0; i < num_xcc; i++) { and then re-used to count something else Fixes: 44e5195fa3d4 ("drm/amdgpu/mes_v12_1: add mes self test") Reported-by: Dan Carpenter Cc: Jack Xiao Cc: Hawking Zhang Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Jack Xiao Signed-off-by: Alex Deucher commit 4f2c86c62a0043be59447c1507c81ecdac7bfa55 Author: Yang Wang Date: Thu Apr 2 23:52:46 2026 -0400 drm/amd/pm: add od table upload error message parsing for smu v14.0.x parse and print detailed reasons for od table upload failures to help users understand error causes. example: $ echo "0 30 40" | sudo tee fan_curve $ echo "1 40 30" | sudo tee fan_curve $ echo "c" | sudo tee fan_curve kernel log: [ 75.040174] amdgpu 0000:0a:00.0: Failed to upload overdrive table, ret:-5 [ 75.040178] amdgpu 0000:0a:00.0: Invalid overdrive table content: OD_FAN_CURVE_PWM_ERROR (13) [ 75.040181] amdgpu 0000:0a:00.0: Failed to upload overdrive table! Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 79d47bc4c73080aeac971bfc0e687b0cdefbabde Author: Yang Wang Date: Thu Apr 2 23:30:22 2026 -0400 drm/amd/pm: add read arg support to smu_cmn_update_table Extend the smu_cmn_update_table function to support reading a 32-bit return argument from the SMU firmware during table transfer operations. - Rename the original function to smu_cmn_update_table_read_arg - Add a uint32_t *read_arg output parameter to capture firmware response - Pass the read_arg pointer to the SMU message command - Keep full backward compatibility using a macro wrapper for the old API This allows the driver to retrieve status codes, results, or configuration feedback from the SMU firmware after table data transfer. No functional changes for existing users of the original smu_cmn_update_table() API. Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 25fd8095a868cfbeb9ef3118131d2ba1f7057846 Author: Yang Wang Date: Thu Apr 16 18:17:30 2026 +0800 drm/amd/pm: fix runtime PM imbalance issue in amdgpu_pm.c Fix runtime PM counter imbalance to prevent device from failing to enter low power state Fixes: a50d32c41fb2 ("drm/amd/pm: Deprecate print_clock_levels interface") Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 80d4d3a45b86816e9a99de4e3d6640ff82707dac Author: Alex Deucher Date: Thu Mar 26 13:50:03 2026 -0400 drm/amdgpu/sdma7.1: add support for disable_kq Plumb in support for disabling kernel queues and make it the default. For testing, kernel queues can be re-enabled by setting amdgpu.user_queue=0. Kernel queues are still created for use by the kernel driver for memory management, etc., just not user submissions. Reviewed-by: Prike Liang Signed-off-by: Alex Deucher commit 831cb9ba54d2da3eb416845042add6882c0a8527 Author: filippor Date: Thu Apr 16 16:34:57 2026 +0200 drm/amdgpu: fix IP discovery v0 handling Cyan skillfish uses IP discovery v0. This was broken when the IP discovery was refactored for newer versions. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5189 Fixes: d0c647a6aae2 ("drm/amdgpu/discovery: support new discovery binary header") Signed-off-by: filippor Signed-off-by: Alex Deucher commit a6d561a88c72e1dbd34816dee46d8d7d77fffdc4 Author: Srinivasan Shanmugam Date: Tue Apr 14 14:10:21 2026 +0530 drm/amd/pm: Fix mode2 reset ACK handling on aldebaran v2 aldebaran_mode2_reset() sends a mode2 reset message and waits for an acknowledgment from the SMU. The current ACK handling is incorrect. The wait loop runs only when ret is -ETIME. But after a successful async send, ret is 0. Because of this, the loop is skipped and the code does not wait for the reset acknowledgment. Also, the code checks for ret != 1 after calling smu_msg_wait_response(). However, smu_msg_wait_response() returns 0 on success and negative error codes on failure. So checking against 1 is wrong. Return -EOPNOTSUPP when the firmware does not support this reset message. Fix this by setting ret to -ETIME before entering the wait loop, checking for ret != 0 after getting the SMU response, and returning -EOPNOTSUPP when the firmware does not support the message. v2: - Update ACK check to use ret != 0 instead of ret != 1, since smu_msg_wait_response() returns 0 on success (Feifei) - Remove unnecessary handling for ret == 0 Fixes: e42569d02acb ("drm/amd/pm: Modify mode2 msg sequence on aldebaran") Reported-by: Dan Carpenter Cc: Feifei Xu Cc: Lijo Lazar Cc: Hawking Zhang Cc: Alex Deucher Cc: Christian König Signed-off-by: Srinivasan Shanmugam Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit e81a492d1259827f78a06c483a64ea07c81378fe Author: Srinivasan Shanmugam Date: Fri Apr 10 18:08:56 2026 +0530 drm/amd/pm: smu7: Remove stale error check in smu7_hwmgr_backend_init smu7_hwmgr_backend_init() is responsible for initializing the SMU7 power management backend. It allocates and sets up the backend structure, initializes voltage tables, configures dependency tables, and prepares platform-specific power and clock parameters. The function follows a typical pattern where each initialization step returns a status in "result", and failures are handled via a common "goto fail" path that performs cleanup. Commit 2c21648bb814 ("drm/amd/pm/smu7: Remove non-functional SMU7 voltage dependency on DAL") removed a function call in this initialization sequence, but left behind the corresponding error check. As a result, "result" is checked twice without being updated in between: result = smu7_init_voltage_dependency_on_display_clock_table(hwmgr); if (result) goto fail; ... if (result) goto fail; The second check is redundant and unreachable for any new failure, since no operation modifies "result" between the two checks. This triggers a Smatch warning about a duplicate zero check and reduces code clarity. Remove the stale error check to keep the control flow correct and readable. Fixes: 9f49e3d4cb86 ("drm/amd/pm/smu7: Remove non-functional SMU7 voltage dependency on DAL") Reported-by: Dan Carpenter Cc: Timur Kristóf Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher commit 505dcb8eeaf2196853c30136b0cbea24af0f7aaa Author: Ce Sun Date: Mon Apr 13 19:49:24 2026 +0800 drm/amd/ras: Avoid ECC status update in hw_fini for VF unload VF sends IDH_REQ_GPU_FINI_ACCESS before hw_fini during unload. PF no longer accepts requests, so skip ECC status update to prevent mailbox timeout. Signed-off-by: Ce Sun Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit b8939bd764c9c8bf6488dc0d71d9c718c25d8cfc Author: Xiang Liu Date: Thu Apr 9 17:10:21 2026 +0800 drm/amdgpu: fix CPER ring header parsing amdgpu_cper_ring_get_ent_sz() parses CPER headers directly from the circular ring buffer to determine the current entry size. When the ring is full and the write pointer lands near the end of the buffer, the header can wrap across the ring boundary. The existing code treats the 4-byte CPER signature as a C string and uses strcmp() on in-ring binary data, then reads record_length through a direct struct pointer cast. Both assumptions are unsafe for wrapped entries and can read past the end of the ring mapping. Fix the parser by comparing the signature as raw bytes and by copying the header into a local buffer before reading record_length, handling wraparound explicitly in both cases. This avoids out-of-bounds reads in amdgpu_cper_ring_get_ent_sz() when the CPER ring is full or the current entry starts at the tail of the ring. Signed-off-by: Xiang Liu Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit d42d3012b278151b65bb8e328bbc6fdc678822a4 Author: Vitaly Prosyak Date: Thu Apr 9 20:05:50 2026 -0400 drm/amdgpu: fix heap buffer overflow in amdgpu_coredump ring dump The off variable in the ring content dump loop tracks a byte offset accumulated from ring->ring_size (which is in bytes), but it is used as an index into u32 *rings_dw. C pointer arithmetic on a u32 pointer automatically multiplies the index by sizeof(u32) = 4, so the actual byte address accessed is: &rings_dw[off] == (char *)rings_dw + off * 4 This means off is effectively quadrupled, causing a 4x overshoot. Concrete example -- two rings, each ring_size = 8 192 bytes (8 KB): total_ring_size = 16 384 bytes rings_dw = kzalloc(16 384) /* 16 KB buffer */ Ring 0: off = 0 memcpy(&rings_dw[0], ring0->ring, 8192) -> writes bytes 0 .. 8 191 OK off += ring->ring_size -> off = 8 192 (BUG) Ring 1: off = 8 192 memcpy(&rings_dw[8192], ring1->ring, 8192) -> actual byte offset = 8 192 * 4 = 32 768 -> writes bytes 32 768 .. 40 959 -> but buffer is only 16 384 bytes! OVERFLOW With the fix (off += ring->ring_size / 4): Ring 0: off = 0 memcpy(&rings_dw[0], ring0->ring, 8192) OK off += 8 192 / 4 -> off = 2 048 Ring 1: off = 2 048 memcpy(&rings_dw[2048], ring1->ring, 8192) -> byte offset = 2 048 * 4 = 8 192 -> writes bytes 8 192 .. 16 383 OK KASAN catches the overflow as a slab-use-after-free when the write lands on a quarantined slab object: BUG: KASAN: slab-use-after-free in amdgpu_coredump+0x775/0x13c0 [amdgpu] Write of size 8192 at addr ffff8890b2400000 by task kworker/u128:1/329 Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched] Call Trace: __asan_memcpy+0x3c/0x60 amdgpu_coredump+0x775/0x13c0 [amdgpu] amdgpu_job_timedout+0xdb5/0x1420 [amdgpu] The corrupted object was a 4 KB drm_exec buffer from a completed amdgpu_cs_ioctl -- the ring dump memcpy overshot into this freed slab region. Fix by accumulating off in dword units (ring->ring_size / 4) so the u32* indexing produces the correct byte address. The reader in amdgpu_devcoredump_format() already consumes the stored offset as a dword index (rings_dw[off + j / 4]), so no change is needed there. Fixes: eea85914d15b ("drm/amdgpu: save ring content before resetting the device") Cc: Pierre-Eric Pelloux-Prayer Cc: Christian König Cc: Alex Deucher Cc: Jesse Zhang Signed-off-by: Vitaly Prosyak Acked-by: Christian König Reviewed-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Alex Deucher commit 169a0556d9317e23dc393f085466b9c4a51bf729 Author: Ce Sun Date: Fri Apr 10 15:26:59 2026 +0800 drm/amdgpu: correct single device PCIe reset flow for DPC For triggering the dpc event with a single device, we still need to set the in_link_reset flag and the dpc status. Signed-off-by: Ce Sun Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit d91db49e97382efe38b51f5943c1a7073c0f06cd Author: Vitaly Prosyak Date: Mon Apr 13 23:07:55 2026 -0400 drm/amdgpu: fix NULL pointer dereference in amdgpu_devcoredump_format A race condition in the devcoredump code causes a NULL pointer dereference in amdgpu_devcoredump_format() when multiple GPU resets occur in quick succession. The sequence of events: 1. First reset calls amdgpu_coredump(), creates coredump1, sets adev->coredump = coredump1, and queues the deferred work. 2. The deferred work begins executing (work_pending() returns false since the work is now running, not just queued). 3. A second reset calls amdgpu_coredump(). work_pending() returns false because the work is running, so amdgpu_coredump() proceeds: creates coredump2, overwrites adev->coredump = coredump2, and re-queues the deferred work with queue_work(). 4. The first deferred work finishes and unconditionally sets adev->coredump = NULL, destroying the reference to coredump2. 5. The re-queued deferred work starts and reads adev->coredump = NULL. It then passes this NULL into amdgpu_devcoredump_format() which dereferences coredump->adev (offset 0 in the struct), triggering: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:amdgpu_devcoredump_format+0xa6/0x36b0 [amdgpu] This was observed during the amd_deadlock IGT test where multiple subtests trigger rapid ring resets. The dmesg log shows four coredumps created within 120ms (at 102.377s, 104.424s, 104.492s, and 104.497s), with the crash occurring 13ms after the last one. Fix this with two changes: - Replace work_pending() with work_busy() in amdgpu_coredump() to also reject new coredumps while the deferred work is executing, not just when it is queued. This closes the main race window. - Add a defensive NULL check for adev->coredump at the start of amdgpu_devcoredump_deferred_work() to prevent the crash if the race still occurs (work_busy() is advisory, not a full barrier). v2: Drop the job->pasid NULL guard -- that fix was independently submitted and merged as commit 4c1f0a162da5 ("drm/amdgpu: add job->pasid in check as amdgpu_job could be NULL") by Sunil Khatri, reviewed by Christian König. Integrate with that patch as suggested by Christian. Fixes: 4bbba79a7f1d ("drm/amdgpu: move devcoredump generation to a worker") Cc: Pierre-Eric Pelloux-Prayer Cc: Christian König Cc: Alex Deucher Signed-off-by: Vitaly Prosyak Reviewed-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Alex Deucher commit 97284621c5bf513fa013f9a1c67b42f267732ce4 Author: Sunil Khatri Date: Fri Apr 10 16:26:00 2026 +0530 drm/amdgpu: add job->pasid in check as amdgpu_job could be NULL In below stack job->pasid is accessed while job is NULL. Access it within the check when job is non NULL. Failure call stack. [ 222.653622] BUG: kernel NULL pointer dereference, address: 000000000000014c [ 222.653625] #PF: supervisor read access in kernel mode [ 222.653628] #PF: error_code(0x0000) - not-present page [ 222.653630] PGD 0 P4D 0 [ 222.653635] Oops: Oops: 0000 [#1] SMP NOPTI [ 222.653639] CPU: 1 UID: 0 PID: 12 Comm: kworker/u96:0 Not tainted 6.19.0-amd-staging-drm-next #271 PREEMPT(voluntary) [ 222.653644] Hardware name: Gigabyte Technology Co., Ltd. X570 AORUS ELITE/X570 AORUS ELITE, BIOS F37c 05/12/2022 [ 222.653646] Workqueue: amdgpu-reset-dev amdgpu_userq_reset_work [amdgpu] [ 222.653961] RIP: 0010:amdgpu_coredump+0x8b/0x470 [amdgpu] [ 222.654158] Code: 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 c9 31 ff 31 d2 31 f6 45 31 c0 45 31 db e9 8c a9 1a e2 88 58 48 44 88 68 49 <41> 8b b7 4c 01 00 00 89 b0 80 00 00 00 4d 85 ff 48 89 45 d0 0f 84 [ 222.654161] RSP: 0018:ffffce68c0147c00 EFLAGS: 00010282 [ 222.654165] RAX: ffff8bc337407740 RBX: 0000000000000000 RCX: 0000000000000000 [ 222.654167] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 222.654170] RBP: ffffce68c0147c48 R08: 0000000000000000 R09: 0000000000000000 [ 222.654172] R10: ffff8bc337407740 R11: ffffffffc10dda10 R12: ffff8bc2d2e00000 [ 222.654174] R13: 0000000000000001 R14: ffff8bc2d2e5b368 R15: 0000000000000000 [ 222.654176] FS: 0000000000000000(0000) GS:ffff8bc64a5fe000(0000) knlGS:0000000000000000 [ 222.654179] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 222.654182] CR2: 000000000000014c CR3: 0000000135eca000 CR4: 0000000000350ef0 [ 222.654184] Call Trace: [ 222.654187] [ 222.654190] ? amdgpu_ip_block_resume+0x28/0x70 [amdgpu] [ 222.654376] ? srso_return_thunk+0x5/0x5f [ 222.654382] amdgpu_device_reinit_after_reset+0x184/0x320 [amdgpu] [ 222.654552] amdgpu_do_asic_reset+0x129/0x160 [amdgpu] [ 222.654720] amdgpu_device_asic_reset+0x92/0x710 [amdgpu] [ 222.654890] amdgpu_device_gpu_recover+0x2ae/0x3d0 [amdgpu] [ 222.655060] amdgpu_userq_reset_work+0x76/0xa0 [amdgpu] [ 222.655229] process_scheduled_works+0x1f0/0x450 [ 222.655235] worker_thread+0x27f/0x370 Fixes: 32ab301b89b3 ("drm/amdgpu: store ib info for devcoredump") Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit ad52d61d82181dbdb7f05826de38352d5e550cc2 Author: Amir Shetaia Date: Fri Apr 10 10:38:13 2026 -0400 drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure KFD VRAM allocations set AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE but not AMDGPU_GEM_CREATE_VRAM_CLEARED, leaving freshly allocated VRAM with stale data from prior use observable by compute kernels. The GEM ioctl path already sets VRAM_CLEARED for all userspace allocations via amdgpu_gem_create_ioctl() and amdgpu_mode_dumb_create(). The KFD path was missing this flag, allowing stale page table remnants to leak into user buffers. This causes crashes in RCCL P2P transport where non-zero data in ptrExchange/head/tail fields corrupts the protocol handshake. Signed-off-by: Amir Shetaia Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 08cdf07b55bff236aeaea3d52a8d1ffe11d801ec Author: Ramalingeswara Reddy, Kanala Date: Fri Apr 10 11:20:20 2026 +0530 drm/amdgpu: Use NBIF offset for register RCC_STRAP0_RCC_DEV0_EPF0_STRAP0 . Define and use regRCC_STRAP0_RCC_DEV0_EPF0_STRAP0_nbif_4_10, to get correct rev_id in nbif_v6_3_1_get_rev_id(). Reviewed-by: Pratik Vishwakarma Signed-off-by: Ramalingeswara Reddy, Kanala Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 2744103f58e8e03ce675c670bbfe3f46034e5f24 Author: Mario Limonciello Date: Wed Apr 8 22:36:49 2026 -0500 drm/amd: Add missing firmware declaration for PSP v15.0.0 PSP v15.0.0 needs both TOC and TA firmware. Without the declaration it won't get included in initramfs and leads to following failure: ``` Direct firmware load for amdgpu/psp_15_0_0_ta.bin failed with error -2 early_init of IP block failed -19 Fatal error during GPU init ``` Fixes: 9b24f63d825e7 ("drm/amdgpu: Enable support for PSP 15_0_0") Reviewed-by: Pratik Vishwakarma Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit e90dc3b2d73986610476b02c29d0074aa4d92fb0 Author: David (Ming Qiang) Wu Date: Mon Mar 9 18:48:37 2026 -0400 amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 PCTL0__MMHUB_DEEPSLEEP_IB is 0x69004 on MMHUB 4,1,0 and and 0x60804 on MMHUB 4,2,0. 0x62a04 is on MMHUB 1,8,0/1. The DS bits are adjusted to cover more JPEG engines and MMHUB version. Signed-off-by: David (Ming Qiang) Wu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit ddda81c4d7e71e41b1be91d921fd85747eddbd12 Author: Chenglei Xie Date: Tue Apr 7 10:51:24 2026 -0400 drm/amdgpu: gate VM CPU HDP flush on reset lock During GPU reset, the application could still run CPU page table updates. Each commit called amdgpu_device_flush_hdp(), which on SR-IOV sends work through the KIQ ring. That can advance sync_seq while the GPU is being reset, leaving fence writeback out of sync and causing amdgpu_fence_emit_polling() to time out on later KIQ use. Fix: amdgpu_vm_cpu_commit(): Reset will flush HDP anyway, the HDP flush in amdgpu_vm_cpu_commit() can be skipped when a reset is ongoging. Take reset_domain->sem with down_read_trylock() before amdgpu_device_flush_hdp(). If the reset path holds the write lock, skip the HDP flush so no HDP-related HW access (including KIQ) runs during reset; state is re-established after reset. Signed-off-by: Chenglei Xie Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 574b3b14f7d1b329fc6e67b79328f0e6f4d4b3d4 Author: Ramalingeswara Reddy, Kanala Date: Tue Mar 31 17:23:22 2026 +0530 drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Define and use regGOLDEN_TSC_COUNT_UPPER_smu_15_0_0 and regGOLDEN_TSC_COUNT_LOWER_smu_15_0_0 for TSC upper and lower count. Acked-by: Alex Deucher Reviewed-by: Pratik Vishwakarma Signed-off-by: Ramalingeswara Reddy, Kanala Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit a094bcf204cd86485624ac1a1fd3913337a89446 Author: Xiaogang Chen Date: Tue Apr 7 16:16:23 2026 -0500 drm/amdgpu: Remove sys file compute_partition_mem_alloc_mode at module unload Module reload would fail when create sys file that was not removed during module unload. Fixes: e0e9792ea2d4 ("drm/amdgpu: add an option to allow gpu partition allocate all available memory") Signed-off-by: Xiaogang Chen Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit 504f0098ebd074ac8c0ce3471795d79f68e3d265 Author: Yang Wang Date: Thu Apr 2 22:44:29 2026 -0400 drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x OverDriveTable.FanMinimumPwm and FeatureCtrlMask.PP_OD_FEATURE_FAN_LEGACY_BIT have a hard dependency. Invalid handling of this dependency leads to disabled thermal monitoring and temperature boundary validation. v2: squash in typo fix (Yang) Fixes: 9710b84e2a6a ("drm/amd/pm: add overdrive support on smu v14.0.2/3") Cc: stable@vger.kernel.org Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 59bd5ae0db22566e2b961742126269c151d587c7 Merge: e0dcd2b2a00bf8 98d68b74ebb9d5 Author: Linus Torvalds Date: Fri Apr 17 11:41:33 2026 -0700 Merge tag 'for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Power-supply drivers: - S2MU005: new battery fuel gauge driver - macsmc-power: new driver for Apple Silicon - qcom_battmgr: Add support for Glymur and Kaanapali - max17042: add support for max77759 - qcom_smbx: allow disabling charging - bd71828: add input current limit support - multiple drivers: use new device managed workqueue allocation function - misc small cleanups and fixes Reset core: - Expose sysfs for registered reboot_modes Reset drivers - misc small cleanups and fixes" * tag 'for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (36 commits) power: supply: qcom_smbx: allow disabling charging power: reset: drop unneeded dependencies on OF_GPIO power: supply: bd71828: add input current limit property dt-bindings: power: reset: cortina,gemini-power-controller: convert to DT schema power: supply: add support for S2MU005 battery fuel gauge device dt-bindings: power: supply: document Samsung S2MU005 battery fuel gauge power: reset: reboot-mode: fix -Wformat-security warning power: supply: ipaq_micro: Simplify with devm power: supply: mt6370: Simplify with devm_alloc_ordered_workqueue() power: supply: max77705: Free allocated workqueue and fix removal order power: supply: max77705: Drop duplicated IRQ error message power: supply: cw2015: Free allocated workqueue power: reset: keystone: Use register_sys_off_handler(SYS_OFF_MODE_RESTART) power: supply: twl4030_madc: Drop unused header includes power: supply: bq24190: Avoid rescheduling after cancelling work power: supply: axp288_charger: Simplify returns of dev_err_probe() power: supply: axp288_charger: Do not cancel work before initializing it power: supply: cpcap-battery: pass static battery cell data from device tree dt-bindings: power: supply: cpcap-battery: document monitored-battery property power: supply: qcom_battmgr: Add support for Glymur and Kaanapali ... commit e0dcd2b2a00bf86073264751897b949dd9c02258 Merge: d97e7d7c304f87 df5ead915b19a6 Author: Linus Torvalds Date: Fri Apr 17 11:32:01 2026 -0700 Merge tag 'hsi-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi Pull HSI updates from Sebastian Reichel: - use flexible array member for hsi_port in hsi_controller - misc small fixes * tag 'hsi-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: omap_ssi_port: remove depends on ARM HSI: omap_ssi_port: remove set but unused variables HSI: cmt_speech: fix wrong printf format HSI: omap_ssi_port: remove null check from FAM hsi: hsi_core: use kzalloc_flex commit d97e7d7c304f87419921f740743f7baa99f40539 Merge: 87768582a440e7 b8a5774cd49996 Author: Linus Torvalds Date: Fri Apr 17 11:24:00 2026 -0700 Merge tag 'hid-for-linus-2026041601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: "Core: - fixed handling of 0-sized reports (Dmitry Torokhov) - convert core code to __free() (Dmitry Torokhov) - support for multiple batteries per HID device (Lucas Zampieri) Drivers: - support for rumble effects in winwing driver (Ivan Gorinov) - new support for a variety of Sony Rock Band and Sony DJ Hero Turntable devices (Rosalie Wanders) - new driver for Lenovo Legion Go / S devices (Derek J. Clark) - power management improvements to intel-thc-hid driver (Even Xu) ... other assorted cleanups, fixes and device-specific quirks" * tag 'hid-for-linus-2026041601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (73 commits) HID: core: clamp report_size in s32ton() to avoid undefined shift HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report HID: logitech-hidpp: fix race condition when accessing stale stack pointer HID: winwing: Enable rumble effects HID: core: do not allow parsing 0-sized reports HID: usbhid: refactor endpoint lookup HID: huawei: fix CD30 keyboard report descriptor issue HID: playstation: validate num_touch_reports in DualShock 4 reports HID: drop 'default !EXPERT' from tristate symbols HID: usbhid: fix deadlock in hid_post_reset() HID: apple: ensure the keyboard backlight is off if suspending HID: quirks: Set ALWAYS_POLL for LOGITECH_BOLT_RECEIVER HID: alps: fix NULL pointer dereference in alps_raw_event() HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write HID: logitech-dj: Standardise hid_report_enum variable nomenclature HID: sony: update module description HID: logitech-hidpp: Check bounds when deleting force-feedback effects HID: sony: add battery status support for Rock Band 4 PS5 guitars HID: sony: fix style issues HID: quirks: update hid-sony supported devices ... commit 87768582a440e7049a04e8af7383b86738d15b38 Merge: d662a710c668a8 15818b2cd42df3 Author: Linus Torvalds Date: Fri Apr 17 11:12:42 2026 -0700 Merge tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping updates from Marek Szyprowski: - added support for batched cache sync, what improves performance of dma_map/unmap_sg() operations on ARM64 architecture (Barry Song) - introduced DMA_ATTR_CC_SHARED attribute for explicitly shared memory used in confidential computing (Jiri Pirko) - refactored spaghetti-like code in drivers/of/of_reserved_mem.c and its clients (Marek Szyprowski, shared branch with device-tree updates to avoid merge conflicts) - prepared Contiguous Memory Allocator related code for making dma-buf drivers modularized (Maxime Ripard) - added support for benchmarking dma_map_sg() calls to tools/dma utility (Qinxin Xia) * tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: (24 commits) dma-buf: heaps: system: document system_cc_shared heap dma-buf: heaps: system: add system_cc_shared heap for explicitly shared memory dma-mapping: introduce DMA_ATTR_CC_SHARED for shared memory mm: cma: Export cma_alloc(), cma_release() and cma_get_name() dma: contiguous: Export dev_get_cma_area() dma: contiguous: Make dma_contiguous_default_area static dma: contiguous: Make dev_get_cma_area() a proper function dma: contiguous: Turn heap registration logic around of: reserved_mem: rework fdt_init_reserved_mem_node() of: reserved_mem: clarify fdt_scan_reserved_mem*() functions of: reserved_mem: rearrange code a bit of: reserved_mem: replace CMA quirks by generic methods of: reserved_mem: switch to ops based OF_DECLARE() of: reserved_mem: use -ENODEV instead of -ENOENT of: reserved_mem: remove fdt node from the structure dma-mapping: fix false kernel-doc comment marker dma-mapping: Support batch mode for dma_direct_{map,unmap}_sg dma-mapping: Separate DMA sync issuing and completion waiting arm64: Provide dcache_inval_poc_nosync helper arm64: Provide dcache_clean_poc_nosync helper ... commit 83ef26f911432d9c98b6d8b6ed0709a8b79cd834 Author: Mark Brown Date: Fri Apr 17 17:57:50 2026 +0100 selftests: Fix duplicated test number reporting Commit 2964f6b816c2 ("selftests: Use ktap helpers for runner.sh") converted the prints in runner.sh to use the relevant helpers from ktap_helpers.sh, not modifying any of the strings printed in the process. This included converting all the result reports to use the relevant ktap_test_ function. Since the output was originally KTAP compliant the strings reported for test names now include test numbers: ok 59 59 selftests: arm64: syscall-abi instead of the expected format: ok 59 selftests: arm64: syscall-abi which causes result parsers to interpret the second number as part of the test name. Given the use of the helpers the tracking of test numbers by runner.sh is now redundant, remove it entirely to restore the expected output format. Link: https://lore.kernel.org/r/20260417-selftests-fix-double-number-v1-1-1be5d7c36b94@kernel.org Fixes: 2964f6b816c2 ("selftests: Use ktap helpers for runner.sh") Signed-off-by: Mark Brown Signed-off-by: Shuah Khan commit d662a710c668a86a39ebaad334d9960a0cc776c2 Merge: 3f887edd35c63a b7560798466a07 Author: Linus Torvalds Date: Fri Apr 17 10:29:01 2026 -0700 Merge tag 'dmaengine-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "Core: - New devm_of_dma_controller_register() API New Support: - Support for RZ/G3L SoC - Loongson Multi-Channel DMA controller support - Conversion of Xilinx AXI DMA binding - DW AXI CV1800B DMA support - Switchtec DMA engine driver Updates: - AMD MDB Endpoint and non-LL mode support - DW edma virtual IRQ for interrupt-emulation, cyclic transfers support" * tag 'dmaengine-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (65 commits) dmaengine: dw-edma: Add non-LL mode dmaengine: dw-edma: Add AMD MDB Endpoint Support dt-bindings: dmaengine: Fix spelling mistake "Looongson" -> "Looogson" dmaengine: loongson: Fix spelling mistake "Looongson" -> "Looogson" dmaengine: loongson: New driver for the Loongson Multi-Channel DMA controller dt-bindings: dmaengine: Add Loongson Multi-Channel DMA controller dmaengine: loongson: loongson2-apb: Simplify locking with guard() and scoped_guard() dmaengine: loongson: loongson2-apb: Convert to devm_clk_get_enabled() dmaengine: loongson: loongson2-apb: Convert to dmaenginem_async_device_register() dmaengine: loongson: New directory for Loongson DMA controllers drivers dt-bindings: dma: xlnx,axi-dma: Convert to DT schema dt-bindings: dma: rz-dmac: Add conditional schema for RZ/G3L dmaengine: sh: rz-dmac: Add device_{pause,resume}() callbacks dmaengine: sh: rz-dmac: Add device_tx_status() callback dmaengine: sh: rz-dmac: Use rz_lmdesc_setup() to invalidate descriptors dmaengine: sh: rz-dmac: Drop unnecessary local_irq_save() call dmaengine: sh: rz-dmac: Drop goto instruction and label dmaengine: sh: rz-dmac: Drop read of CHCTRL register dmaengine: sh: rz_dmac: add RZ/{T2H,N2H} support dt-bindings: dma: renesas,rz-dmac: document RZ/{T2H,N2H} ... commit c802f460dd485c1332b5a35e7adcfb2bc22536a2 Author: cuitao Date: Tue Apr 14 09:53:27 2026 +0800 cgroup/rdma: fix integer overflow in rdmacg_try_charge() The expression `rpool->resources[index].usage + 1` is computed in int arithmetic before being assigned to s64 variable `new`. When usage equals INT_MAX (the default "max" value), the addition overflows to INT_MIN. This negative value then passes the `new > max` check incorrectly, allowing a charge that should be rejected and corrupting usage to negative. Fix by casting usage to s64 before the addition so the arithmetic is done in 64-bit. Fixes: 39d3e7584a68 ("rdmacg: Added rdma cgroup controller") Signed-off-by: cuitao Reviewed-by: Michal Koutný Signed-off-by: Tejun Heo commit a5b98009f16d8a5fb4a8ff9a193f5735515c38fa Author: Edward Adam Davis Date: Tue Apr 14 14:15:43 2026 +0800 sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_file, which triggers the uaf reported in [1]. Consider the following scenario involving execution on two separate CPUs: CPU0 CPU1 ==== ==== vfs_rmdir() kernfs_iop_rmdir() cgroup_rmdir() cgroup_kn_lock_live() cgroup_destroy_locked() cgroup_addrm_files() cgroup_rm_file() kernfs_remove_by_name() kernfs_remove_by_name_ns() vfs_write() __kernfs_remove() new_sync_write() kernfs_drain() kernfs_fop_write_iter() kernfs_drain_open_files() cgroup_file_write() kernfs_release_file() pressure_write() cgroup_file_release() ctx = of->priv; kfree(ctx); of->priv = NULL; cgroup_kn_unlock() cgroup_kn_lock_live() cgroup_get(cgrp) cgroup_kn_unlock() if (ctx->psi.trigger) // here, trigger uaf for ctx, that is of->priv The cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards the memory deallocation of of->priv performed within cgroup_file_release(). However, the operations involving of->priv executed within pressure_write() are not entirely covered by the protection of cgroup_mutex. Consequently, if the code in pressure_write(), specifically the section handling the ctx variable executes after cgroup_file_release() has completed, a uaf vulnerability involving of->priv is triggered. Therefore, the issue can be resolved by extending the scope of the cgroup_mutex lock within pressure_write() to encompass all code paths involving of->priv, thereby properly synchronizing the race condition occurring between cgroup_file_release() and pressure_write(). And, if an live kn lock can be successfully acquired while executing the pressure write operation, it indicates that the cgroup deletion process has not yet reached its final stage; consequently, the priv pointer within open_file cannot be NULL. Therefore, the operation to retrieve the ctx value must be moved to a point *after* the live kn lock has been successfully acquired. In another situation, specifically after entering cgroup_kn_lock_live() but before acquiring cgroup_mutex, there exists a different class of race condition: CPU0: write memory.pressure CPU1: write cgroup.pressure=0 =========================== ============================= kernfs_fop_write_iter() kernfs_get_active_of(of) pressure_write() cgroup_kn_lock_live(memory.pressure) cgroup_tryget(cgrp) kernfs_break_active_protection(kn) ... blocks on cgroup_mutex cgroup_pressure_write() cgroup_kn_lock_live(cgroup.pressure) cgroup_file_show(memory.pressure, false) kernfs_show(false) kernfs_drain_open_files() cgroup_file_release(of) kfree(ctx) of->priv = NULL cgroup_kn_unlock() ... acquires cgroup_mutex ctx = of->priv; // may now be NULL if (ctx->psi.trigger) // NULL dereference Consequently, there is a possibility that of->priv is NULL, the pressure write needs to check for this. Now that the scope of the cgroup_mutex has been expanded, the original explicit cgroup_get/put operations are no longer necessary, this is because acquiring/releasing the live kn lock inherently executes a cgroup get/put operation. [1] BUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 Call Trace: pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011 cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:4311 kernfs_fop_write_iter+0x3b0/0x540 fs/kernfs/file.c:352 Allocated by task 9352: cgroup_file_open+0x90/0x3a0 kernel/cgroup/cgroup.c:4256 kernfs_fop_open+0x9eb/0xcb0 fs/kernfs/file.c:724 do_dentry_open+0x83d/0x13e0 fs/open.c:949 Freed by task 9353: cgroup_file_release+0xd6/0x100 kernel/cgroup/cgroup.c:4283 kernfs_release_file fs/kernfs/file.c:764 [inline] kernfs_drain_open_files+0x392/0x720 fs/kernfs/file.c:834 kernfs_drain+0x470/0x600 fs/kernfs/dir.c:525 Fixes: 0e94682b73bf ("psi: introduce psi monitor") Reported-by: syzbot+33e571025d88efd1312c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=33e571025d88efd1312c Tested-by: syzbot+33e571025d88efd1312c@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Reviewed-by: Chen Ridong Signed-off-by: Tejun Heo commit 3f887edd35c63a7092a0babbc6074355ebc57248 Merge: 65bec0c4ea57b7 caf08514bbee07 Author: Linus Torvalds Date: Fri Apr 17 10:22:08 2026 -0700 Merge tag 'phy-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "New Support: - Qualcomm Eliza QMP UFS PHY - Canaan K230 USB 2.0 PHY driver - Mediatek mt8167 dsi-phy - Eswin EIC7700 SATA PHY driver Updates: - Sorted subsytem Makefile/Kconfig and some kernel-doc udpates" * tag 'phy-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: document the Eliza QMP UFS PHY phy: qcom: m31-eusb2: clear PLL_EN during init phy: eswin: Create eswin directory and add EIC7700 SATA PHY driver dt-bindings: phy: eswin: Document the EIC7700 SoC SATA PHY phy: apple: apple: Use local variable for ioremap return value phy: qcom: qmp-usbc: Simplify check for non-NULL pointer phy: marvell: mmp3-hsic: Avoid re-casting __iomem phy: apple: atc: Make atcphy_dwc3_reset_ops variable static dt-bindings: phy: mediatek,dsi-phy: Add support for mt8167 phy: usb: Add driver for Canaan K230 USB 2.0 PHY dt-bindings: phy: Add Canaan K230 USB PHY phy: phy-mtk-tphy: Update names and format of kernel-doc comments phy: Sort the subsystem Kconfig phy: Sort the subsystem Makefile phy: move spacemit pcie driver to its subfolder commit 65bec0c4ea57b74749a21200031b2350ac238de8 Merge: 0b6bc3dbe6322b b8f2d65fec19f3 Author: Linus Torvalds Date: Fri Apr 17 10:16:53 2026 -0700 Merge tag 'soundwire-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: - Core: DP prepare polling for avoiding interrupt deadlock - AMD clock init and bandwidth refactoring - Intel more codecs to wake list, clear message on before signaling waiting thread * tag 'soundwire-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: intel_auxdevice: Add cs42l49 to wake_capable_list soundwire: cadence: Clear message complete before signaling waiting thread soundwire: Intel: test bus.bpt_stream before assigning it soundwire: bus: demote UNATTACHED state warnings to dev_dbg() soundwire: stream: Poll for DP prepare to avoid interrupt deadlock soundwire: amd: refactor bandwidth calculation logic soundwire: amd: add clock init control function soundwire: intel_auxdevice: Add CS47L47 to wake_capable_list soundwire: slave: Don't register devices that are disabled in ACPI soundwire: sdw.h: repair names and format of kernel-doc comments commit 2845989f2ebaf7848e4eccf9a779daf3156ea0a5 Author: Puranjay Mohan Date: Fri Apr 17 08:21:33 2026 -0700 bpf: Validate node_id in arena_alloc_pages() arena_alloc_pages() accepts a plain int node_id and forwards it through the entire allocation chain without any bounds checking. Validate node_id before passing it down the allocation chain in arena_alloc_pages(). Fixes: 317460317a02 ("bpf: Introduce bpf_arena.") Signed-off-by: Puranjay Mohan Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260417152135.1383754-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 0b6bc3dbe6322b283dfe5786a8e2a13d38f469f8 Merge: cb30bf881c5b4e 4245bf4dc58f58 Author: Linus Torvalds Date: Fri Apr 17 10:12:11 2026 -0700 Merge tag 'trace-latency-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing latency update from Steven Rostedt: - Add TIMERLAT_ALIGN osnoise option Add a timer alignment option for timerlat that makes it work like the cyclictest -A option. timelat creates threads to test the latency of the kernel. The alignment option will have these threads trigger at the alignment offsets from each other. Instead of having each thread wake up at the exact same time, if the alignment is set to "20" each thread will wake up at 20 microseconds from the previous one. * tag 'trace-latency-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/osnoise: Add option to align tlat threads commit 4d5bbbafc170eb21474a37d844211fce6b0f3c51 Author: Ben Horgan Date: Tue Apr 14 14:27:58 2026 +0100 arm_mpam: resctrl: Make resctrl_mon_ctx_waiters static resctrl_mon_ctx_waiters is not used outside of this file, so make it static. This fixes the sparse warning: drivers/resctrl/mpam_resctrl.c:25:1: warning: symbol 'resctrl_mon_ctx_waiters' was not declared. Should it be static? Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603281842.c2K96tJA-lkp@intel.com/ Fixes: 2a3c79c61539 ("arm_mpam: resctrl: Allow resctrl to allocate monitors") Signed-off-by: Ben Horgan Reviewed-by: Gavin Shan Signed-off-by: James Morse commit 67c0a487efa542cca9477ea84915db2e091f98d0 Author: Ben Horgan Date: Tue Apr 14 14:27:56 2026 +0100 arm_mpam: resctrl: Fix the check for no monitor components found Dan Carpenter reports that, in mpam_resctrl_alloc_domain(), any_mon_comp is used in an 'if' condition when it may be uninitialized. Initialize it to NULL so that the check behaves correctly when no monitor components are found. Reported-by: Dan Carpenter Fixes: 264c285999fc ("arm_mpam: resctrl: Add monitor initialisation and domain boilerplate") Signed-off-by: Ben Horgan Reviewed-by: Gavin Shan Signed-off-by: James Morse commit f758340da529ccb12531c3f83d5992e912f6c8d5 Author: Zeng Heng Date: Mon Apr 13 17:00:41 2026 +0800 arm_mpam: resctrl: Fix MBA CDP alloc_capable handling on unmount The code to set MBA's alloc_capable to true appears to be trying to restore alloc_capable on unmount. This can never work because resctrl_arch_set_cdp_enabled() is never invoked with RDT_RESOURCE_MBA as the rid parameter. Consequently, mpam_resctrl_controls[RDT_RESOURCE_MBA].cdp_enabled always remains false. The alloc_capable setting in resctrl_arch_set_cdp_enabled() is to re-enable MBA if the caller opts in to separate control values using CDP for this resource. This doesn't happen today. Add a comment to describe this. However a bug remains where MBA allocation is permanently disabled after the mount with CDP option. Remounting without CDP cannot restore the MBA partition capability. Add a check to re-enable MBA when CDP is disabled, which happens on unmount. Fixes: 6789fb99282c ("arm_mpam: resctrl: Add CDP emulation") Signed-off-by: Zeng Heng [ morse: Added comment for existing code, added hunk to fix this bug from Ben H ] Reviewed-by: James Morse Signed-off-by: James Morse commit cb30bf881c5b4ee8b879558a2fce93d7de652955 Merge: c9e03d59483a64 621a59d8fc6787 Author: Linus Torvalds Date: Fri Apr 17 09:43:12 2026 -0700 Merge tag 'trace-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Fix printf format warning for bprintf sunrpc uses a trace_printk() that triggers a printf warning during the compile. Move the __printf() attribute around for when debugging is not enabled the warning will go away - Remove redundant check for EVENT_FILE_FL_FREED in event_filter_write() The FREED flag is checked in the call to event_file_file() and then checked again right afterward, which is unneeded - Clean up event_file_file() and event_file_data() helpers These helper functions played a different role in the past, but now with eventfs, the READ_ONCE() isn't needed. Simplify the code a bit and also add a warning to event_file_data() if the file or its data is not present - Remove updating file->private_data in tracing open All access to the file private data is handled by the helper functions, which do not use file->private_data. Stop updating it on open - Show ENUM names in function arguments via BTF in function tracing When showing the function arguments when func-args option is set for function tracing, if one of the arguments is found to be an enum, show the name of the enum instead of its number - Add new trace_call__##name() API for tracepoints Tracepoints are enabled via static_branch() blocks, where when not enabled, there's only a nop that is in the code where the execution will just skip over it. When tracing is enabled, the nop is converted to a direct jump to the tracepoint code. Sometimes more calculations are required to be performed to update the parameters of the tracepoint. In this case, trace_##name##_enabled() is called which is a static_branch() that gets enabled only when the tracepoint is enabled. This allows the extra calculations to also be skipped by the nop: if (trace_foo_enabled()) { x = bar(); trace_foo(x); } Where the x=bar() is only performed when foo is enabled. The problem with this approach is that there's now two static_branch() calls. One for checking if the tracepoint is enabled, and then again to know if the tracepoint should be called. The second one is redundant Introduce trace_call__foo() that will call the foo() tracepoint directly without doing a static_branch(): if (trace_foo_enabled()) { x = bar(); trace_call__foo(); } - Update various locations to use the new trace_call__##name() API - Move snapshot code out of trace.c Cleaning up trace.c to not be a "dump all", move the snapshot code out of it and into a new trace_snapshot.c file - Clean up some "%*.s" to "%*s" - Allow boot kernel command line options to be called multiple times Have options like: ftrace_filter=foo ftrace_filter=bar ftrace_filter=zoo Equal to: ftrace_filter=foo,bar,zoo - Fix ipi_raise event CPU field to be a CPU field The ipi_raise target_cpus field is defined as a __bitmask(). There is now a __cpumask() field definition. Update the field to use that - Have hist_field_name() use a snprintf() and not a series of strcat() It's safer to use snprintf() that a series of strcat() - Fix tracepoint regfunc balancing A tracepoint can define a "reg" and "unreg" function that gets called before the tracepoint is enabled, and after it is disabled respectively. But on error, after the "reg" func is called and the tracepoint is not enabled, the "unreg" function is not called to tear down what the "reg" function performed - Fix output that shows what histograms are enabled Event variables are displayed incorrectly in the histogram output Instead of "sched.sched_wakeup.$var", it is showing "$sched.sched_wakeup.var" where the '$' is in the incorrect location - Some other simple cleanups * tag 'trace-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (24 commits) selftests/ftrace: Add test case for fully-qualified variable references tracing: Fix fully-qualified variable reference printing in histograms tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() tracing: Rebuild full_name on each hist_field_name() call tracing: Report ipi_raise target CPUs as cpumask tracing: Remove duplicate latency_fsnotify() stub tracing: Preserve repeated trace_trigger boot parameters tracing: Append repeated boot-time tracing parameters tracing: Remove spurious default precision from show_event_trigger/filter formats cpufreq: Use trace_call__##name() at guarded tracepoint call sites tracing: Remove tracing_alloc_snapshot() when snapshot isn't defined tracing: Move snapshot code out of trace.c and into trace_snapshot.c mm: damon: Use trace_call__##name() at guarded tracepoint call sites btrfs: Use trace_call__##name() at guarded tracepoint call sites spi: Use trace_call__##name() at guarded tracepoint call sites i2c: Use trace_call__##name() at guarded tracepoint call sites kernel: Use trace_call__##name() at guarded tracepoint call sites tracepoint: Add trace_call__##name() API tracing: trace_mmap.h: fix a kernel-doc warning tracing: Pretty-print enum parameters in function arguments ... commit c9e03d59483a64967850e6d321b7fc56a957ef83 Merge: 829000f7894bcb e0a384434ae1bd Author: Linus Torvalds Date: Fri Apr 17 09:18:32 2026 -0700 Merge tag 'probes-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull fprobe update from Masami Hiramatsu: - do not zero out unused fgraph_data. This removes unneeded memset of fgraph_data in fprobe entry handler. * tag 'probes-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: fprobe: do not zero out unused fgraph_data commit 829000f7894bcb0bfedf5e2c91f277ae3ef72c40 Merge: d730905bc3c007 6eb255d019b810 Author: Linus Torvalds Date: Fri Apr 17 09:14:07 2026 -0700 Merge tag 'bootconfig-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig updates from Masami Hiramatsu: "Minor fixes for handling errors: - fix off-by-one in xbc_verify_tree() next node check - increment xbc_node_num after node init succeeds - validate child node index in xbc_verify_tree() Code cleanups (mainly type/attribute changes): - clean up comment typos and bracing - drop redundant memset of xbc_nodes - replace linux/kernel.h with specific includes - narrow flag parameter type from uint32_t to uint16_t - constify xbc_calc_checksum() data parameter - fix signed comparison in xbc_node_get_data() - use size_t for strlen result in xbc_node_match_prefix() - use signed type for offset in xbc_init_node() - use size_t for key length tracking in xbc_verify_tree() - change xbc_node_index() return type to uint16_t" * tag 'bootconfig-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: lib/bootconfig: change xbc_node_index() return type to uint16_t lib/bootconfig: use size_t for key length tracking in xbc_verify_tree() lib/bootconfig: use signed type for offset in xbc_init_node() lib/bootconfig: use size_t for strlen result in xbc_node_match_prefix() lib/bootconfig: fix signed comparison in xbc_node_get_data() lib/bootconfig: validate child node index in xbc_verify_tree() lib/bootconfig: replace linux/kernel.h with specific includes bootconfig: constify xbc_calc_checksum() data parameter lib/bootconfig: drop redundant memset of xbc_nodes lib/bootconfig: increment xbc_node_num after node init succeeds lib/bootconfig: fix off-by-one in xbc_verify_tree() next node check lib/bootconfig: narrow flag parameter type from uint32_t to uint16_t lib/bootconfig: clean up comment typos and bracing commit d730905bc3c0075275b2d109cd971735274b98c0 Merge: a10e80be6343cb 15513eefac7ca6 Author: Linus Torvalds Date: Fri Apr 17 08:53:23 2026 -0700 Merge tag 'mips_7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - Support for Mobileye EyeQ6Lplus - Cleanups and fixes * tag 'mips_7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (30 commits) MIPS/mtd: Handle READY GPIO in generic NAND platform data MIPS/input: Move RB532 button to GPIO descriptors MIPS: validate DT bootargs before appending them MIPS: Alchemy: Remove unused forward declaration MAINTAINERS: Mobileye: Add EyeQ6Lplus files MIPS: config: add eyeq6lplus_defconfig MIPS: Add Mobileye EyeQ6Lplus evaluation board dts MIPS: Add Mobileye EyeQ6Lplus SoC dtsi clk: eyeq: Add Mobileye EyeQ6Lplus OLB clk: eyeq: Adjust PLL accuracy computation clk: eyeq: Skip post-divisor when computing PLL frequency pinctrl: eyeq5: Add Mobileye EyeQ6Lplus OLB pinctrl: eyeq5: Use match data reset: eyeq: Add Mobileye EyeQ6Lplus OLB MIPS: Add Mobileye EyeQ6Lplus support dt-bindings: soc: mobileye: Add EyeQ6Lplus OLB dt-bindings: mips: Add Mobileye EyeQ6Lplus SoC MIPS: dts: loongson64g-package: Switch to Loongson UART driver mips: pci-mt7620: rework initialization procedure mips: pci-mt7620: add more register init values ... commit a3542d1b30f92307f545f2def14e8d988dffdff0 Author: Cássio Gabriel Date: Fri Apr 17 10:41:33 2026 -0300 ALSA: caiaq: Fix control_put() result and cache rollback control_put() always returns 1 and updates cdev->control_state[] before sending the USB command. It also ignores transport errors from usb_bulk_msg(), snd_usb_caiaq_send_command(), and snd_usb_caiaq_send_command_bank(). That breaks the ALSA .put() contract and can leave control_get() reporting a cached value the device never accepted. Return 0 for unchanged values, propagate transport failures, and restore the cached byte when the write fails. Fixes: 8e3cd08ed8e59 ("[ALSA] caiaq - add control API and more input features") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260417-caiaq-control-put-v1-1-c37826e92447@gmail.com Signed-off-by: Takashi Iwai commit a10e80be6343cbdaabe80f82cbd640fe3772d102 Merge: 01f492e1817e85 bd39fc81340aed Author: Linus Torvalds Date: Fri Apr 17 08:34:43 2026 -0700 Merge tag 'alpha-for-v7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha Pull alpha updates from Magnus Lindholm: "One fix to silence pgprot_modify() compiler warnings, and one patch adding SECCOMP/SECCOMP_FILTER support together with the syscall and ptrace fixes needed for it" * tag 'alpha-for-v7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha: alpha: Define pgprot_modify to silence tautological comparison warnings alpha: add support for SECCOMP and SECCOMP_FILTER commit 9091e3b59f2bef11c0a841096327565ae0ca220b Author: Michael Margolin Date: Thu Apr 16 20:14:08 2026 +0000 RDMA/core: Fix user CQ creation for drivers without create_cq CQ creation is failing for drivers that only implement create_user_cq (e.g. EFA), when buffer isn't provided by userspace. This because of a leftover check that requires create_cq existence in such case. Remove the create_cq existence check from the no-buffer path. The buffer is optional and drivers that handle their own memory should work through create_user_cq regardless. Fixes: 584ec74748e6 ("RDMA/core: Prepare create CQ path for API unification") Link: https://patch.msgid.link/r/20260416201408.13980-1-mrgolin@amazon.com Signed-off-by: Michael Margolin Signed-off-by: Jason Gunthorpe commit ccab51d69b1478b549ad0bbb38f556ab3bfb47ab Author: Vincent Donnefort Date: Tue Apr 14 11:02:31 2026 +0100 KVM: arm64: Re-allow hyp tracing HVCs for [nh]VHE The introduction of __KVM_HOST_SMCCC_FUNC_MAX_NO_PKVM excluded hyp tracing HVCs from the common [nh]VHE/pKVM list. Re-allow them. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260414100231.1859687-1-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 01f492e1817e858d1712f2489d0afbaa552f417b Merge: e55d98e7756135 6b802031877a99 Author: Linus Torvalds Date: Fri Apr 17 07:18:03 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "Arm: - Add support for tracing in the standalone EL2 hypervisor code, which should help both debugging and performance analysis. This uses the new infrastructure for 'remote' trace buffers that can be exposed by non-kernel entities such as firmware, and which came through the tracing tree - Add support for GICv5 Per Processor Interrupts (PPIs), as the starting point for supporting the new GIC architecture in KVM - Finally add support for pKVM protected guests, where pages are unmapped from the host as they are faulted into the guest and can be shared back from the guest using pKVM hypercalls. Protected guests are created using a new machine type identifier. As the elusive guestmem has not yet delivered on its promises, anonymous memory is also supported This is only a first step towards full isolation from the host; for example, the CPU register state and DMA accesses are not yet isolated. Because this does not really yet bring fully what it promises, it is hidden behind CONFIG_ARM_PKVM_GUEST + 'kvm-arm.mode=protected', and also triggers TAINT_USER when a VM is created. Caveat emptor - Rework the dreaded user_mem_abort() function to make it more maintainable, reducing the amount of state being exposed to the various helpers and rendering a substantial amount of state immutable - Expand the Stage-2 page table dumper to support NV shadow page tables on a per-VM basis - Tidy up the pKVM PSCI proxy code to be slightly less hard to follow - Fix both SPE and TRBE in non-VHE configurations so that they do not generate spurious, out of context table walks that ultimately lead to very bad HW lockups - A small set of patches fixing the Stage-2 MMU freeing in error cases - Tighten-up accepted SMC immediate value to be only #0 for host SMCCC calls - The usual cleanups and other selftest churn LoongArch: - Use CSR_CRMD_PLV for kvm_arch_vcpu_in_kernel() - Add DMSINTC irqchip in kernel support RISC-V: - Fix steal time shared memory alignment checks - Fix vector context allocation leak - Fix array out-of-bounds in pmu_ctr_read() and pmu_fw_ctr_read_hi() - Fix double-free of sdata in kvm_pmu_clear_snapshot_area() - Fix integer overflow in kvm_pmu_validate_counter_mask() - Fix shift-out-of-bounds in make_xfence_request() - Fix lost write protection on huge pages during dirty logging - Split huge pages during fault handling for dirty logging - Skip CSR restore if VCPU is reloaded on the same core - Implement kvm_arch_has_default_irqchip() for KVM selftests - Factored-out ISA checks into separate sources - Added hideleg to struct kvm_vcpu_config - Factored-out VCPU config into separate sources - Support configuration of per-VM HGATP mode from KVM user space s390: - Support for ESA (31-bit) guests inside nested hypervisors - Remove restriction on memslot alignment, which is not needed anymore with the new gmap code - Fix LPSW/E to update the bear (which of course is the breaking event address register) x86: - Shut up various UBSAN warnings on reading module parameter before they were initialized - Don't zero-allocate page tables that are used for splitting hugepages in the TDP MMU, as KVM is guaranteed to set all SPTEs in the page table and thus write all bytes - As an optimization, bail early when trying to unsync 4KiB mappings if the target gfn can just be mapped with a 2MiB hugepage x86 generic: - Copy single-chunk MMIO write values into struct kvm_vcpu (more precisely struct kvm_mmio_fragment) to fix use-after-free stack bugs where KVM would dereference stack pointer after an exit to userspace - Clean up and comment the emulated MMIO code to try to make it easier to maintain (not necessarily "easy", but "easier") - Move VMXON+VMXOFF and EFER.SVME toggling out of KVM (not *all* of VMX and SVM enabling) as it is needed for trusted I/O - Advertise support for AVX512 Bit Matrix Multiply (BMM) instructions - Immediately fail the build if a required #define is missing in one of KVM's headers that is included multiple times - Reject SET_GUEST_DEBUG with -EBUSY if there's an already injected exception, mostly to prevent syzkaller from abusing the uAPI to trigger WARNs, but also because it can help prevent userspace from unintentionally crashing the VM - Exempt SMM from CPUID faulting on Intel, as per the spec - Misc hardening and cleanup changes x86 (AMD): - Fix and optimize IRQ window inhibit handling for AVIC; make it per-vCPU so that KVM doesn't prematurely re-enable AVIC if multiple vCPUs have to-be-injected IRQs - Clean up and optimize the OSVW handling, avoiding a bug in which KVM would overwrite state when enabling virtualization on multiple CPUs in parallel. This should not be a problem because OSVW should usually be the same for all CPUs - Drop a WARN in KVM_MEMORY_ENCRYPT_REG_REGION where KVM complains about a "too large" size based purely on user input - Clean up and harden the pinning code for KVM_MEMORY_ENCRYPT_REG_REGION - Disallow synchronizing a VMSA of an already-launched/encrypted vCPU, as doing so for an SNP guest will crash the host due to an RMP violation page fault - Overhaul KVM's APIs for detecting SEV+ guests so that VM-scoped queries are required to hold kvm->lock, and enforce it by lockdep. Fix various bugs where sev_guest() was not ensured to be stable for the whole duration of a function or ioctl - Convert a pile of kvm->lock SEV code to guard() - Play nicer with userspace that does not enable KVM_CAP_EXCEPTION_PAYLOAD, for which KVM needs to set CR2 and DR6 as a response to ioctls such as KVM_GET_VCPU_EVENTS (even if the payload would end up in EXITINFO2 rather than CR2, for example). Only set CR2 and DR6 when consumption of the payload is imminent, but on the other hand force delivery of the payload in all paths where userspace retrieves CR2 or DR6 - Use vcpu->arch.cr2 when updating vmcb12's CR2 on nested #VMEXIT instead of vmcb02->save.cr2. The value is out of sync after a save/restore or after a #PF is injected into L2 - Fix a class of nSVM bugs where some fields written by the CPU are not synchronized from vmcb02 to cached vmcb12 after VMRUN, and so are not up-to-date when saved by KVM_GET_NESTED_STATE - Fix a class of bugs where the ordering between KVM_SET_NESTED_STATE and KVM_SET_{S}REGS could cause vmcb02 to be incorrectly initialized after save+restore - Add a variety of missing nSVM consistency checks - Fix several bugs where KVM failed to correctly update VMCB fields on nested #VMEXIT - Fix several bugs where KVM failed to correctly synthesize #UD or #GP for SVM-related instructions - Add support for save+restore of virtualized LBRs (on SVM) - Refactor various helpers and macros to improve clarity and (hopefully) make the code easier to maintain - Aggressively sanitize fields when copying from vmcb12, to guard against unintentionally allowing L1 to utilize yet-to-be-defined features - Fix several bugs where KVM botched rAX legality checks when emulating SVM instructions. There are remaining issues in that KVM doesn't handle size prefix overrides for 64-bit guests - Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12 fails instead of somewhat arbitrarily synthesizing #GP (i.e. don't double down on AMD's architectural but sketchy behavior of generating #GP for "unsupported" addresses) - Cache all used vmcb12 fields to further harden against TOCTOU bugs x86 (Intel): - Drop obsolete branch hint prefixes from the VMX instruction macros - Use ASM_INPUT_RM() in __vmcs_writel() to coerce clang into using a register input when appropriate - Code cleanups guest_memfd: - Don't mark guest_memfd folios as accessed, as guest_memfd doesn't support reclaim, the memory is unevictable, and there is no storage to write back to LoongArch selftests: - Add KVM PMU test cases s390 selftests: - Enable more memory selftests x86 selftests: - Add support for Hygon CPUs in KVM selftests - Fix a bug in the MSR test where it would get false failures on AMD/Hygon CPUs with exactly one of RDPID or RDTSCP - Add an MADV_COLLAPSE testcase for guest_memfd as a regression test for a bug where the kernel would attempt to collapse guest_memfd folios against KVM's will" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (373 commits) KVM: x86: use inlines instead of macros for is_sev_*guest x86/virt: Treat SVM as unsupported when running as an SEV+ guest KVM: SEV: Goto an existing error label if charging misc_cg for an ASID fails KVM: SVM: Move lock-protected allocation of SEV ASID into a separate helper KVM: SEV: use mutex guard in snp_handle_guest_req() KVM: SEV: use mutex guard in sev_mem_enc_unregister_region() KVM: SEV: use mutex guard in sev_mem_enc_ioctl() KVM: SEV: use mutex guard in snp_launch_update() KVM: SEV: Assert that kvm->lock is held when querying SEV+ support KVM: SEV: Document that checking for SEV+ guests when reclaiming memory is "safe" KVM: SEV: Hide "struct kvm_sev_info" behind CONFIG_KVM_AMD_SEV=y KVM: SEV: WARN on unhandled VM type when initializing VM KVM: LoongArch: selftests: Add PMU overflow interrupt test KVM: LoongArch: selftests: Add basic PMU event counting test KVM: LoongArch: selftests: Add cpucfg read/write helpers LoongArch: KVM: Add DMSINTC inject msi to vCPU LoongArch: KVM: Add DMSINTC device support LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function LoongArch: KVM: Move host CSR_GSTAT save and restore in context switch LoongArch: KVM: Move host CSR_EENTRY save and restore in context switch ... commit 4a92ef0c57df610ba0b2eb7f308c5472020ce8ea Author: Guido Günther Date: Fri Apr 17 08:55:42 2026 +0200 drm/panel: visionox-rm69299: Make use of prepare_prev_first The DSI link must be powered up to let panel driver to talk to the panel during prepare() callback execution. Set the prepare_prev_first flag to guarantee this. Fixes: 9e15123eca79 ("drm/msm/dsi: Stop unconditionally powering up DSI hosts at modeset") Signed-off-by: Guido Günther Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260417-axolotl-display-v2-1-8ce5341e46c2@ixit.cz commit 707610bcccbd0327530938e33f3f33211a640a4e Author: Guangshuo Li Date: Thu Apr 16 01:05:15 2026 +0800 parisc: led: fix reference leak on failed device registration When platform_device_register() fails in startup_leds(), the embedded struct device in platform_leds has already been initialized by device_initialize(), but the failure path only reports the error and does not drop the device reference for the current platform device: startup_leds() -> platform_device_register(&platform_leds) -> device_initialize(&platform_leds.dev) -> setup_pdev_dma_masks(&platform_leds) -> platform_device_add(&platform_leds) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() after reporting the error. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fixes: 789e527adfc33 ("parisc: led: Rewrite LED/LCD driver to utilizize Linux LED subsystem") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Signed-off-by: Helge Deller commit 1221365f55281349da4f4ba41c05b57cd15f5c28 Author: Helge Deller Date: Tue Apr 7 22:07:22 2026 +0200 module.lds.S: Fix modules on 32-bit parisc architecture On the 32-bit parisc architecture, we always used the -ffunction-sections compiler option to tell the compiler to put the functions into seperate text sections. This is necessary, otherwise "big" kernel modules like ext4 or ipv6 fail to load because some branches won't be able to reach their stubs. Commit 1ba9f8979426 ("vmlinux.lds: Unify TEXT_MAIN, DATA_MAIN, and related macros") broke this for parisc because all text sections will get unconditionally merged now. Introduce the ARCH_WANTS_MODULES_TEXT_SECTIONS config option which avoids the text section merge for modules, and fix this issue by enabling this option by default for 32-bit parisc. Fixes: 1ba9f8979426 ("vmlinux.lds: Unify TEXT_MAIN, DATA_MAIN, and related macros") Cc: Josh Poimboeuf Cc: stable@vger.kernel.org # v6.19+ Suggested-by: Sami Tolvanen Reviewed-by: Petr Pavlu Signed-off-by: Helge Deller commit 3dce917902056ca7e46685f86f1f94b5953092e2 Author: Helge Deller Date: Wed Apr 8 18:19:01 2026 +0200 parisc: Allow to build without VDSO32 When building for 64-bit and without CONFIG_COMPAT, leave out the vdso32 binary. Signed-off-by: Helge Deller commit ba56cdf133646565dde354433bb80fcbd459474b Author: Helge Deller Date: Tue Apr 14 18:28:03 2026 +0200 parisc: Include 32-bit VDSO only when building for 32-bit or compat mode Signed-off-by: Helge Deller commit bc4021c4e992960f1b8902bd613630c1e8edf7e7 Author: Helge Deller Date: Wed Apr 8 00:17:03 2026 +0200 parisc: Allow to disable COMPAT mode on 64-bit kernel Although we don't yet have a 64-bit userspace, allowing to disable the compat mode should be possible. Signed-off-by: Helge Deller commit 35493b28e71c3e7d376f98e58bb3c227511177c1 Author: Helge Deller Date: Wed Apr 8 00:15:39 2026 +0200 parisc: Fix default stack size when COMPAT=n The CONFIG_STACK_MAX_DEFAULT_SIZE_MB config option does not exist when CONFIG_COMPAT is disabled. Use default 1 GB stack in this case. Signed-off-by: Helge Deller commit 7dc9ee6e5e22722f219e4cdcab37e2476d6baaf6 Author: Helge Deller Date: Wed Apr 8 00:04:55 2026 +0200 parisc: Fix signal code to depend on CONFIG_COMPAT instead of CONFIG_64BIT The signal handler code used CONFIG_64BIT to decide if compat handling code should be compiled in. Fix it to use CONFIG_COMPAT instead. This allows to disable CONFIG_COMPAT even when running a 64-bit kernel. Signed-off-by: Helge Deller commit b5d5faba0f774f3216d8d699e130b01021e79f6c Author: Helge Deller Date: Wed Apr 8 00:03:41 2026 +0200 parisc: is_compat_task() shall return false for COMPAT=n Signed-off-by: Helge Deller commit 97bfda452054ae0c20ab5318337e9b95ed32f616 Author: Helge Deller Date: Wed Apr 8 00:01:28 2026 +0200 parisc: Avoid compat syscalls when COMPAT=n Drop unnecessary code and syscall tables when we run a 64-bit kernel with conpat mode disabled. Signed-off-by: Helge Deller commit e55d98e7756135f32150b9b8f75d580d0d4b2dd3 Author: Borislav Petkov (AMD) Date: Tue Apr 7 11:40:03 2026 +0200 x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under certain circumstances, partial results from previous operations. Those results can be leaked by another, attacker thread. Fix that with a chicken bit. Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Linus Torvalds commit 75c486cb1bcaa1a3ec3a6438498176a3a4998ae4 Author: Corey Minyard Date: Mon Apr 13 08:00:23 2026 -0500 ipmi:ssif: Clean up kthread on errors If an error occurs after the ssif kthread is created, but before the main IPMI code starts the ssif interface, the ssif kthread will not be stopped. So make sure the kthread is stopped on an error condition if it is running. Fixes: 259307074bfc ("ipmi: Add SMBus interface driver (SSIF)") Reported-by: Li Xiao <<252270051@hdu.edu.cn> Cc: stable@vger.kernel.org Reviewed-by: Li Xiao <252270051@hdu.edu.cn> Signed-off-by: Corey Minyard commit 16d990a15491cf76cd6eef0846e1b4100e63261a Author: Junrui Luo Date: Wed Apr 15 17:26:55 2026 +0800 KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() index the GAIT by manually multiplying the index with sizeof(struct zpci_gaite). Since aift->gait is already a struct zpci_gaite pointer, this double-scales the offset, accessing element aisb*16 instead of aisb. This causes out-of-bounds accesses when aisb >= 32 (with ZPCI_NR_DEVICES=512) Fix by removing the erroneous sizeof multiplication. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding") Fixes: 73f91b004321 ("KVM: s390: pci: enable host forwarding of Adapter Event Notifications") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Tested-by: Matthew Rosato Signed-off-by: Christian Borntraeger commit 7e555fcae40ab2ba91fd5cd54a5a83096414957f Author: Yuho Choi Date: Thu Apr 16 19:56:30 2026 -0400 regmap: ram: fix memory leaks in __regmap_init_ram() on error Two allocations in __regmap_init_ram() are not cleaned up on failure. If the kzalloc_objs() for data->written fails, data->read is returned with no way for the caller to free it. If __regmap_init() fails, neither data->read nor data->written is freed because its error paths do not call bus->free_context() (which is regmap_ram_free_context() here). Only regmap_exit() does, and that is never reached on an init failure. Free the allocated arrays before returning any error. Fixes: f6352424e37e ("regmap: Add RAM backed register map") Signed-off-by: Yuho Choi Link: https://patch.msgid.link/20260416235630.78408-1-dbgh9129@gmail.com Signed-off-by: Mark Brown commit da3680f564bd787ce974f9931e6e924d908b3b2a Author: Helge Deller Date: Tue Apr 7 23:56:28 2026 +0200 parisc: _llseek syscall is only available for 32-bit userspace Cc: stable@vger.kernel.org Signed-off-by: Helge Deller commit 3dd31a370c1dccb580f729af7c580ccb1ae3c0c9 Author: Helge Deller Date: Fri Apr 10 16:12:31 2026 +0200 parisc: Drop ip_fast_csum() inline assembly implementation The assembly code of ip_fast_csum() triggers unaligned access warnings if the IP header isn't correctly aligned: Kernel: unaligned access to 0x173d22e76 in inet_gro_receive+0xbc/0x2e8 (iir 0x0e8810b6) Kernel: unaligned access to 0x173d22e7e in inet_gro_receive+0xc4/0x2e8 (iir 0x0e88109a) Kernel: unaligned access to 0x173d22e82 in inet_gro_receive+0xc8/0x2e8 (iir 0x0e90109d) Kernel: unaligned access to 0x173d22e7a in inet_gro_receive+0xd0/0x2e8 (iir 0x0e9810b8) Kernel: unaligned access to 0x173d22e86 in inet_gro_receive+0xdc/0x2e8 (iir 0x0e8810b8) We have the option to a) ignore the warnings, b) work around it by adding more code to check for alignment, or c) to switch to the generic implementation and rely on the compiler to optimize the code. Let's go with c), because a) isn't nice, and b) would effectively lead to an implementation which is basically equal to c). Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v7.0+ commit 0b6c8e21157fb6dfa35163fdfe5c10387bcc6c41 Author: Kexin Sun Date: Sat Mar 21 18:58:31 2026 +0800 parisc: update outdated comments for renamed ccio_alloc_consistent() The function ccio_alloc_consistent() was renamed to ccio_alloc() by commit 79387179e2e4 ("parisc: convert to dma_map_ops"). Update the three stale references in ccio-dma.c. Also replace the obsolete PCI_DMA_TODEVICE constant name with DMA_TO_DEVICE in a nearby comment to match the code. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Signed-off-by: Helge Deller commit 082a6d03a2d685a83a332666b500ad3966349588 Author: Marco Elver Date: Thu Apr 16 15:25:07 2026 +0200 slub: fix data loss and overflow in krealloc() Commit 2cd8231796b5 ("mm/slub: allow to set node and align in k[v]realloc") introduced the ability to force a reallocation if the original object does not satisfy new alignment or NUMA node, even when the object is being shrunk. This introduced two bugs in the reallocation fallback path: 1. Data loss during NUMA migration: The jump to 'alloc_new' happens before 'ks' and 'orig_size' are initialized. As a result, the memcpy() in the 'alloc_new' block would copy 0 bytes into the new allocation. 2. Buffer overflow during shrinking: When shrinking an object while forcing a new alignment, 'new_size' is smaller than the old size. However, the memcpy() used the old size ('orig_size ?: ks'), leading to an out-of-bounds write. The same overflow bug exists in the kvrealloc() fallback path, where the old bucket size ksize(p) is copied into the new buffer without being bounded by the new size. A simple reproducer: // e.g. add to lkdtm as KREALLOC_SHRINK_OVERFLOW while (1) { void *p = kmalloc(128, GFP_KERNEL); p = krealloc_node_align(p, 64, 256, GFP_KERNEL, NUMA_NO_NODE); kfree(p); } demonstrates the issue: ================================================================== BUG: KFENCE: out-of-bounds write in memcpy_orig+0x68/0x130 Out-of-bounds write at 0xffff8883ad757038 (120B right of kfence-#47): memcpy_orig+0x68/0x130 krealloc_node_align_noprof+0x1c8/0x340 lkdtm_KREALLOC_SHRINK_OVERFLOW+0x8c/0xc0 [lkdtm] lkdtm_do_action+0x3a/0x60 [lkdtm] ... kfence-#47: 0xffff8883ad756fc0-0xffff8883ad756fff, size=64, cache=kmalloc-64 allocated by task 316 on cpu 7 at 97.680481s (0.021813s ago): krealloc_node_align_noprof+0x19c/0x340 lkdtm_KREALLOC_SHRINK_OVERFLOW+0x8c/0xc0 [lkdtm] lkdtm_do_action+0x3a/0x60 [lkdtm] ... ================================================================== Fix it by moving the old size calculation to the top of __do_krealloc() and bounding all copy lengths by the new allocation size. Fixes: 2cd8231796b5 ("mm/slub: allow to set node and align in k[v]realloc") Cc: stable@vger.kernel.org Reported-by: https://sashiko.dev/#/patchset/20260415143735.2974230-1-elver%40google.com Signed-off-by: Marco Elver Link: https://patch.msgid.link/20260416132837.3787694-1-elver@google.com Reviewed-by: Harry Yoo (Oracle) Signed-off-by: Vlastimil Babka (SUSE) commit 6c9b1dc218fea8b15893953f5299b209f11fa0a8 Author: Ralf Lici Date: Thu Apr 16 09:19:28 2026 +0200 selftests: ovpn: serialize YNL listener startup Starting one background YNL notification listener per peer back-to-back can intermittently stall the test setup before the listeners even reach the Python main function. This was reproducible in a reduced test.sh setup-only loop: a single listener stayed stable across repeated runs, while starting listeners for all peers could hang early in the listener launch phase. Adding a short delay between listener launches makes the listeners start cleanly and eliminates the reproduced hangs in repeated normal and slow-runner tests. Serialize listener startup with a small sleep between setup_listener calls. Fixes: 77de28cd7cf1 ("selftests: ovpn: add notification parsing and matching") Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit 1be93bb979ab02554541b04406e9e3a6a8e0ce9e Author: Ralf Lici Date: Mon Mar 23 15:12:32 2026 +0100 selftests: ovpn: align command flow with TAP Current tests do not properly adhere to the TAP infrastructure therefore they do not properly report failures leading to hangs of the CI machinery. Restructure ovpn selftests into using the TAP infrastructure: split each test in stages, execute stage bodies with fail-fast semantics, and emit KTAP pass/fail for each stage. Centralize behavior control in common.sh and makes the scripts use dedicated wrappers for required-success, expected-failure, and non-fatal commands. Also add the OVPN_VERBOSE mode that exposes captured command output for debugging. This way tests won't hang anymore in case of failure when executed within the CI machinery. This change also makes default OVPN_CLI and YNL resolution independent from the caller CWD by anchoring both to COMMON_DIR, so behavior is stable across direct execution and run_tests-style execution. Fixes: 959bc330a439 ("testing/selftests: add test tool and scripts for ovpn module") Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit 7c29665a3a3cce1b0e9d6b96054eef64bfc4cebd Author: Ralf Lici Date: Fri Mar 20 17:29:38 2026 +0100 selftests: ovpn: add prefix to helpers and shared variables Current naming for shared variables, helpers and netnamespaces is a bit unfortunate as it doesn't come with a clean prefix. This showed to be problematic in case of name clashes with external scripts or in case of abrupt test termination (hanging netns' weren't easily reconducible to ovpn). Rename common helper entry points and all shared globals in the ovpn selftests to ovpn_ or OVPN_ names so test scripts and wrappers use a single explicit prefix. Also rename the temporary network namespaces created by the tests from peerN to ovpn_peerN. This makes leaked namespaces easier to identify. This is a mechanical refactor only, behavior is unchanged. Fixes: 959bc330a439 ("testing/selftests: add test tool and scripts for ovpn module") Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit 222e7f8d1ca3aaebe7588a79bf64d9820813785c Author: Ralf Lici Date: Tue Mar 24 15:54:18 2026 +0100 selftests: ovpn: flatten slurped notification JSON before filtering Notification comparison uses jq -s, which slurps all inputs into an array. Some inputs can be arrays themselves, and applying the .msg.peer filter directly on those entries triggers jq type errors. Expand any array-valued JSON items returned by jq -s before selecting .msg.peer, so the filter handles both normal notification objects and [] entries without type errors. Fixes: 77de28cd7cf1 ("selftests: ovpn: add notification parsing and matching") Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit c409da0fe15e2b2aae7f93edbab977e23117ce4d Author: Ralf Lici Date: Mon Mar 23 15:32:26 2026 +0100 selftests: ovpn: fail notification check on mismatch compare_ntfs doesn't fail when expected and received notification streams diverge. Fix this bug by tracking the diff exit status explicitly and return it to the caller so notification mismatches propagate as test failures. Fixes: 77de28cd7cf1 ("selftests: ovpn: add notification parsing and matching") Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit e5fd34ab8dff6c5bd4f2e9ee4f3945b79e511068 Author: Ralf Lici Date: Tue Mar 24 08:48:57 2026 +0100 selftests: ovpn: add nftables config dependencies for test-mark test-mark.sh installs nftables rules in an inet/filter output chain and verifies packet drops via nft counters. In vmksft this can fail when the nftables core is not enabled by the ovpn selftest config. Add the missing kernel options required by this test: - CONFIG_NETFILTER - CONFIG_NF_TABLES - CONFIG_NF_TABLES_INET Fixes: 7b80d8a33500 ("selftests: ovpn: add test for the FW mark feature") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/all/20260319124114.42f91f72@kernel.org/ Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit d7e20b9bd6c990773cf0c09e2642250b8a70263d Author: Giovanni Cabiddu Date: Thu Apr 16 18:07:00 2026 +0100 crypto: acomp - fix wrong pointer stored by acomp_save_req() acomp_save_req() stores &req->chain in req->base.data. When acomp_reqchain_done() is invoked on asynchronous completion, it receives &req->chain as the data argument but casts it directly to struct acomp_req. Since data points to the chain member, all subsequent field accesses are at a wrong offset, resulting in memory corruption. The issue occurs when an asynchronous hardware implementation, such as the QAT driver, completes a request that uses the DMA virtual address interface (e.g. acomp_request_set_src_dma()). This combination causes crypto_acomp_compress() to enter the acomp_do_req_chain() path, which sets acomp_reqchain_done() as the completion callback via acomp_save_req(). With KASAN enabled, this manifests as a general protection fault in acomp_reqchain_done(): general protection fault, probably for non-canonical address 0xe000040000000000 KASAN: probably user-memory-access in range [0x0000400000000000-0x0000400000000007] RIP: 0010:acomp_reqchain_done+0x15b/0x4e0 Call Trace: qat_comp_alg_callback+0x5d/0xa0 [intel_qat] adf_ring_response_handler+0x376/0x8b0 [intel_qat] adf_response_handler+0x60/0x170 [intel_qat] tasklet_action_common+0x223/0x820 handle_softirqs+0x1ab/0x640 Fix this by storing the request itself in req->base.data instead of &req->chain, so that acomp_reqchain_done() receives the correct pointer. Simplify acomp_restore_req() accordingly to access req->chain directly. Fixes: 64929fe8c0a4 ("crypto: acomp - Remove request chaining") Cc: stable@vger.kernel.org Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit bc0fcb9823cd0894934cf968b525c575833d7078 Author: Yilin Zhu Date: Sun Apr 12 13:07:54 2026 +0800 ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() xfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not already have a dst attached. ip6_route_input_lookup() returns a referenced dst entry even when the lookup resolves to an error route. If dst->error is set, xfrm6_rcv_encap() drops the skb without attaching the dst to the skb and without releasing the reference returned by the lookup. Repeated packets hitting this path therefore leak dst entries. Release the dst before jumping to the drop path. Fixes: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP") Cc: stable@kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Ruide Cao Signed-off-by: Yilin Zhu Signed-off-by: Ren Wei Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit 4ff036f95238f02c87e5d7c0a9d93748582a8950 Author: Guangshuo Li Date: Thu Apr 16 03:31:38 2026 +0800 ALSA: pcmtest: fix reference leak on failed device registration When platform_device_register() fails in mod_init(), the embedded struct device in pcmtst_pdev has already been initialized by device_initialize(), but the failure path returns the error without dropping the device reference for the current platform device: mod_init() -> platform_device_register(&pcmtst_pdev) -> device_initialize(&pcmtst_pdev.dev) -> setup_pdev_dma_masks(&pcmtst_pdev) -> platform_device_add(&pcmtst_pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before returning the error. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fixes: 315a3d57c64c5 ("ALSA: Implement the new Virtual PCM Test Driver") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260415193138.3861297-1-lgs201920130244@gmail.com Signed-off-by: Takashi Iwai commit dc88eef8f55e85e92d016cdf7e291f5560efd79b Author: Cássio Gabriel Date: Thu Apr 16 10:24:40 2026 -0300 ALSA: 6fire: Fix input volume change detection usb6fire_control_input_vol_put() stores the analog capture volume as a signed offset in rt->input_vol[] (-15..+15), but it compares the cached value against the user-visible mixer value (0..30) before subtracting 15. This mixes two domains in the change detection path. Since the runtime is zero-initialized, the visible default is 15; writing 0 right after probe is ignored, while writing 15 is reported as a change even though the cached value remains 0. Normalize the user value before comparing it with the cached offset. Fixes: 06bb4e743501 ("ALSA: snd-usb-6fire: add analog input volume control") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260416-alsa-6fire-input-volume-change-detection-v1-1-ec78299168df@gmail.com Signed-off-by: Takashi Iwai commit 17bc5dd49214b50c9eb6df0fad1d1aea287dd078 Author: Johnathan Penberthy Date: Thu Apr 16 19:01:23 2026 -0600 ALSA: usb-audio: Add quirk entries for NexiGo N930W webcam The NexiGo N930W 60fps webcam (USB ID 3443:930d) hits the same 'cannot get freq at ep 0x84' error in snd-usb-audio as its sibling N930AF (1bcf:2283). Without QUIRK_FLAG_GET_SAMPLE_RATE the ADC clock is never configured and the microphone streams only zero samples. Testing on Linux 6.17 with QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16 (via quirk_alias=3443930d:1bcf2283) confirmed the microphone captures real audio after a cold USB re-enumeration. Adding a native quirk_flags_table entry avoids the alias workaround. Signed-off-by: Johnathan Penberthy Link: https://patch.msgid.link/20260417010123.3080904-1-johnathan.penberthy@gmail.com Signed-off-by: Takashi Iwai commit 2866156e770c3c00aed96de9eab35cde0fd486cd Author: Randy Dunlap Date: Sun Feb 15 22:00:10 2026 -0800 ALSA: vx: use correct function name in kernel-doc comment Use the correct function name to avoid a kernel-doc warning (when W=1 is used): vx_cmd.h:210: warning: expecting prototype for vx_send_pipe_cmd_params(). Prototype was for vx_set_pipe_cmd_params() instead Signed-off-by: Randy Dunlap Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260216060010.2784438-1-rdunlap@infradead.org commit 4f01559b5ec490b58e4a74cba36b43fe5f06f1ee Author: Randy Dunlap Date: Sun Feb 15 21:59:56 2026 -0800 ALSA: virtio: drop an extaneous kernel-doc comment Drop a kernel-doc struct comment since the struct member was removed. This eliminates a kernel-doc warning when make W=1 is used. virtio_pcm.h:65: warning: Excess struct member 'msg_last_enqueued' description in 'virtio_pcm_substream' Fixes: fe981e67568c ("ALSA: virtio: use ack callback") Signed-off-by: Randy Dunlap Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260216055956.2784399-1-rdunlap@infradead.org commit d1aa2b9aad696c0434a5e0ac1d07810ce264e686 Author: Juan Pablo Fuentealba Bizama Date: Thu Apr 16 15:11:49 2026 -0400 ALSA: usb-audio: Add quirk for SmartlinkTechnology M01 Add quirk entry for SmartlinkTechnology M01 USB microphone to enable the standard mixer interface. Signed-off-by: Juan Pablo Fuentealba Bizama Link: https://patch.msgid.link/20260416191149.12088-1-jpfuentealbabizama@gmail.com Signed-off-by: Takashi Iwai commit a7756371e57f69a137f295a418fb56f15ff2c10f Merge: 19785999991dee dc6d51959ec0c0 Author: Dave Airlie Date: Fri Apr 17 16:26:26 2026 +1000 Merge tag 'drm-misc-next-fixes-2026-04-17' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Short summary of fixes pull: dma-buf: - fix documentation formatting Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260417061430.GA11880@linux.fritz.box commit 43cfbdda5af60ffc6272a7b8c5c37d1d0a181ca9 Merge: 87fe97a184c000 8602018b1f17fb Author: Linus Torvalds Date: Thu Apr 16 21:21:55 2026 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "Several fixes: - Add missing static const - Correct type 1 emulation for VFIO_CHECK_EXTENSION when no-iommu is turned on - Fix selftest memory leak and syzkaller splat - Fix missed -EFAULT in fault reporting write() fops - Fix a race where map/unmap with the internal IOVA allocator can unmap things it should not" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Fix a race with concurrent allocation and unmap iommufd/selftest: Remove MOCK_IOMMUPT_AMDV1 format iommufd: Fix return value of iommufd_fault_fops_write() iommufd: update outdated comment for renamed iommufd_hw_pagetable_alloc() iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} iommufd: vfio compatibility extension check for noiommu mode iommufd: Constify struct dma_buf_attach_ops commit c4d3fc5844d685441befd0caaab648321013cdfd Author: Paulo Alcantara Date: Thu Apr 16 21:15:50 2026 -0300 smb: client: fix dir separator in SMB1 UNIX mounts When calling cifs_mount_get_tcon() with SMB1 UNIX mounts, @cifs_sb->mnt_cifs_flags needs to be read or updated only after calling reset_cifs_unix_caps(), otherwise it might end up with missing CIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS bits. This fixes the wrong dir separator used in paths caused by the missing CIFS_MOUNT_POSIX_PATHS bit in cifs_sb_info::mnt_cifs_flags. Reported-by: "Kris Karas (Bug Reporting)" Closes: https://lore.kernel.org/r/f758f4ff-4d54-4244-931d-38f469c3ff14@moonlit-rail.com Fixes: 4fc3a433c139 ("smb: client: use atomic_t for mnt_cifs_flags") Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 87fe97a184c000a3941e2b53671742993abb1ddc Merge: 8242c709d4ba85 a55f80233f384d Author: Linus Torvalds Date: Thu Apr 16 21:15:56 2026 -0700 Merge tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl Pull fwctl updates from Jason Gunthorpe: - New fwctl driver for Broadcom RDMA NICs - Bug fix for non-modular builds * tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl: fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal fwctl/bnxt_fwctl: Add documentation entries fwctl/bnxt_fwctl: Add bnxt fwctl device fwctl/bnxt_en: Create an aux device for fwctl fwctl/bnxt_en: Refactor aux bus functions to be more generic fwctl/bnxt_en: Move common definitions to include/linux/bnxt/ commit 8242c709d4ba858c483ef7ef3cc2dc1280f5383c Merge: 231d703058b2e2 3ef628c3f37f1d Author: Linus Torvalds Date: Thu Apr 16 20:45:14 2026 -0700 Merge tag 'soc-arm-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC ARM code updates from Arnd Bergmann: "These are again very minimal updates: - A workaround for firmware on Google Nexus 10 - A fix for early debugging on OMAP1 - A rework for Microchip SoC configuration - Cleanups on OMAP2 an R-Car-Gen2" * tag 'soc-arm-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: omap2: dead code cleanup in kconfig for ARCH_OMAP4 ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX arm64: Kconfig: provide a top-level switch for Microchip platforms ARM: shmobile: rcar-gen2: Use of_phandle_args_equal() helper ARM: omap: fix all kernel-doc warnings ARM: omap2: Replace scnprintf with strscpy in omap3_cpuinfo ARM: samsung: exynos5250: Allow CPU1 to boot commit 231d703058b2e2ee59884c8531e02c60a2a109ab Merge: 31b43c079f9aa5 07e1a498ee9a9e Author: Linus Torvalds Date: Thu Apr 16 20:40:20 2026 -0700 Merge tag 'soc-defconfig-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC defconfig updates from Arnd Bergmann: "As usual, we enable a number of additional device drivers as loadable modules, to support the added platforms. The largest change this time is for OMAP2/3, which were not that well supported in the generic arm32 defconfig. The Tegra SoC platforms are now enabled by default in Kconfig when ARCH_TEGRA is enabled, which means the defconfig change is done at the same time as the Kconfig change here" * tag 'soc-defconfig-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits) arch/arm: Drop CONFIG_FIRMWARE_EDID from defconfig files arm64: defconfig: Enable DP83TG720 PHY driver arm64: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC ARM: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC arm64: defconfig: enable pci-pwrctrl-generic as module arm64: defconfig: Enable Lontium LT8713sx driver arm64: defconfig: Enable Qualcomm Eliza SoC display clock controller arm64: defconfig: enable IPQ5210 RDP504 base configs arm64: defconfig: Enable Milos LPASS LPI pinctrl driver arm64: defconfig: Enable Kaanapali clock controllers arm64: defconfig: Enable configs for Arduino VENTUNO Q arm64: defconfig: Enable Qualcomm Eliza basic resource providers arm64: defconfig: Enable S5KJN1 camera sensor arm64: defconfig: Enable configurations for Toradex Aquila AM69 arm64: defconfig: remove SENSORS_SA67MCU arm64: defconfig: Enable Qualcomm WCD937x headphone codec as module arm64: defconfig: Enable QCOMTEE module for QTEE-enabled Qualcomm SoCs ARM: shmobile: defconfig: Refresh for v7.0-rc1 arm: multi_v7_defconfig: Enable more OMAP 3/4 related configs ARM: multi_v7_defconfig: omap2plus_defconfig: Enable ITE IT66121 driver ... commit 31b43c079f9aa55754c20404a42bca9a49e01f60 Merge: e65f4718a577fc 33a20cdaf41d08 Author: Linus Torvalds Date: Thu Apr 16 20:34:34 2026 -0700 Merge tag 'soc-drivers-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "The driver updates again are all over the place with many minor fixes going into platform specific code. The most notable changes are: - Support for Microchip pic64gx system controllers - Work on cleaning up devicetree bindings for SoC drivers, and converting them into the new format - Lots of smaller changes for Qualcomm SoC drivers, including support for a number of newly supported chips - reset controller API cleanups and a new driver for Cix Sky1 - Reworks of the Tegra PMC and CBB drivers, along with a change to how individual Tegra SoCs get selected in Kconfig and BPMP firmware driver updates including a refresh of the ABI header to match the version used by firmware - STM32 updates to the firewall bus driver and support for the debug bus through OP-TEE - SCMI firmware driver improvements for reliability, in particular for dealing with broken firmware interrupts - Memory driver updates for Tegra, and a patch to remove the unused Baikal T1 driver" * tag 'soc-drivers-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (193 commits) firmware: arm_ffa: Use the correct buffer size during RXTX_MAP firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaCentre Mini X clk: spear: fix resource leak in clk_register_vco_pll() reset: rzv2h-usb2phy: Add support for VBUS mux controller registration reset: rzv2h-usb2phy: Convert to regmap API dt-bindings: reset: renesas,rzv2h-usb2phy: Document RZ/G3E USB2PHY reset dt-bindings: reset: renesas,rzv2h-usb2phy: Add '#mux-state-cells' property soc: microchip: add mpfs gpio interrupt mux driver dt-bindings: soc: microchip: document PolarFire SoC's gpio interrupt mux gpio: mpfs: Add interrupt support soc: qcom: ubwc: add helpers to get programmable values soc: qcom: ubwc: add helper to get min_acc length firmware: qcom: scm: Register gunyah watchdog device soc: qcom: socinfo: Add SoC ID for SA8650P dt-bindings: arm: qcom,ids: Add SoC ID for SA8650P firmware: qcom: scm: Allow QSEECOM on Mahua CRD soc: qcom: wcnss: simplify allocation of req soc: qcom: pd-mapper: Add support for Eliza soc: qcom: aoss: compare against normalized cooling state soc: qcom: llcc: fix v1 SB syndrome register offset ... commit e65f4718a577fcc84d40431f022985898b6dbf2e Merge: 440d6635b20037 41d7004ab4e521 Author: Linus Torvalds Date: Thu Apr 16 20:28:48 2026 -0700 Merge tag 'soc-dt-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC devicetree updates from Arnd Bergmann: "A number of SoC platforms are adding modernized variants of their already supported chips time, with a total of 12 new SoCs, and two older SoC getting removed: - Qualcomm Glymur is a compute SoC using 18 Oryon-2 CPU cores - Qualcomm Mahua is a variant of Glymur with only 12 CPU cores, but largely identical. - Qualcomm Eliza is an embeded platform for mobile phone (SM7750) and IOT (QC7790S/M) workloads - Qualcomm IPQ5210 is a wireless networking SoC using Cortex-A53 cores - Qualcomm apq8084 and ipq806x had only rudimentary support but no actual products using them, so they are now gone. - Axis ARTPEC-9 is a follow-up to the ARTPEC-8 embedded SoC, using the Samsung SoC platform but now with Cortex-A55 cores - ARM Zena is a virtual platform in FVP using Cortex-A720AE cores, with additional versions planned to be merged in the future. - ARM corstone-1000-a320 is a reference platform for IOT, using low-end Cortex-A320 cores - Microchip LAN9691 is an updated 64-bit variant of the arm32 lan966x series of networking SoCs - Microchip PIC64GX is an embedded RISC-V chip using SIFIVE U54 CPU cores - Rockchip RV1103B is the low-end 32-bit single-core vision processor - Renesas RZ/G3L (r9a08g046) is an industrial embedded chip using Cortex-A55 cores, similar to the G3E and G3S variants we already supported. - NXP S32N79 is an automotive SoC using Cortex-A78AE cores, a significant upgrade from the older S32V and S32G series These all come with at least one reference board or an initial product using these, in total there are 67 newly added boards. The ones for already supported SoCs are: - Two more Aspeed BMC based boards - Three older tablets based on 32-bit OMAP4 and Exynos5 SoCs - One Set-top-box based on Allwinner H6 - 22 additional industrial/embedded boards using 64-bit NXP i.MX8M or i.MX9 SoCs - 20 Qualcomm SoC based machines across all possible markets: workstation, gaming, laptop, phone, networking, reference, ... - Three more Rockchips rk35xx based boards - Four variants of the Toradex Verdin using TI AM62 Other notable bits are: - A cleanup for the 32-bit Tegra paz00 board moved the last board specific code on Tegra into equivalent dts syntax. - There continues to be a significant number of fixes for static checking of dtc syntax, but it feels like this is slowing down, hopefully getting into a state where most known issues are addressed - Additional hardware support for many existing boards across SoC families, notably Qualcomm, Broadcom, i.MX2, i.MX6, Rockchips, STM32, Mediatek, Tegra, TI and Microchip" * tag 'soc-dt-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (841 commits) arm64: dts: ti: k3: Use memory-region-names for r5f ARM: dts: imx: Add DT overlays for DH i.MX6 DHCOM SoM and boards ARM: dts: imx6sx: remove fallback compatible string fsl,imx28-lcdif ARM: dts: imx25: rename node name tcq to touchscreen ARM: dts: imx: b850v3: Disable unused usdhc4 ARM: dts: imx: b850v3: Define GPIO line names ARM: dts: imx: b850v3: Use alphabetical sorting ARM: dts: imx: bx50v3: Configure phy-mode to eliminate a warning ARM: dts: imx: bx50v3: Configure switch PHY max-speed to 100Mbps ARM: dts: imx7ulp: Add CPU clock and OPP table support ARM: dts: imx7-mba7: Deassert BOOT_EN after boot ARM: dts: tqma7: add boot phase properties ARM: dts: imx7s: add boot phase properties ARM: dts: tqma6ul[l]: correct spelling of TQ-Systems ARM: dts: mba6ulx: add boot phase properties ARM: dts: imx6ul[l]-tqma6ul[l]: add boot phase properties ARM: dts: imx6ul/imx6ull: add boot phase properties ARM: dts: imx6qdl-mba6: add boot phase properties ARM: dts: imx6qdl-tqma6: add boot phase properties ARM: dts: imx6qdl: add boot phase properties ... commit 440d6635b20037bc9ad46b20817d7b61cef0fc1b Merge: 0b2f2b1fc0c61e 70b672833f4025 Author: Linus Torvalds Date: Thu Apr 16 20:11:56 2026 -0700 Merge tag 'mm-nonmm-stable-2026-04-15-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: - "pid: make sub-init creation retryable" (Oleg Nesterov) Make creation of init in a new namespace more robust by clearing away some historical cruft which is no longer needed. Also some documentation fixups - "selftests/fchmodat2: Error handling and general" (Mark Brown) Fix and a cleanup for the fchmodat2() syscall selftest - "lib: polynomial: Move to math/ and clean up" (Andy Shevchenko) - "hung_task: Provide runtime reset interface for hung task detector" (Aaron Tomlin) Give administrators the ability to zero out /proc/sys/kernel/hung_task_detect_count - "tools/getdelays: use the static UAPI headers from tools/include/uapi" (Thomas Weißschuh) Teach getdelays to use the in-kernel UAPI headers rather than the system-provided ones - "watchdog/hardlockup: Improvements to hardlockup" (Mayank Rungta) Several cleanups and fixups to the hardlockup detector code and its documentation - "lib/bch: fix undefined behavior from signed left-shifts" (Josh Law) A couple of small/theoretical fixes in the bch code - "ocfs2/dlm: fix two bugs in dlm_match_regions()" (Junrui Luo) - "cleanup the RAID5 XOR library" (Christoph Hellwig) A quite far-reaching cleanup to this code. I can't do better than to quote Christoph: "The XOR library used for the RAID5 parity is a bit of a mess right now. The main file sits in crypto/ despite not being cryptography and not using the crypto API, with the generic implementations sitting in include/asm-generic and the arch implementations sitting in an asm/ header in theory. The latter doesn't work for many cases, so architectures often build the code directly into the core kernel, or create another module for the architecture code. Change this to a single module in lib/ that also contains the architecture optimizations, similar to the library work Eric Biggers has done for the CRC and crypto libraries later. After that it changes to better calling conventions that allow for smarter architecture implementations (although none is contained here yet), and uses static_call to avoid indirection function call overhead" - "lib/list_sort: Clean up list_sort() scheduling workarounds" (Kuan-Wei Chiu) Clean up this library code by removing a hacky thing which was added for UBIFS, which UBIFS doesn't actually need - "Fix bugs in extract_iter_to_sg()" (Christian Ehrhardt) Fix a few bugs in the scatterlist code, add in-kernel tests for the now-fixed bugs and fix a leak in the test itself - "kdump: Enable LUKS-encrypted dump target support in ARM64 and PowerPC" (Coiby Xu) Enable support of the LUKS-encrypted device dump target on arm64 and powerpc - "ocfs2: consolidate extent list validation into block read callbacks" (Joseph Qi) Cleanup, simplify, and make more robust ocfs2's validation of extent list fields (Kernel test robot loves mounting corrupted fs images!) * tag 'mm-nonmm-stable-2026-04-15-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (127 commits) ocfs2: validate group add input before caching ocfs2: validate bg_bits during freefrag scan ocfs2: fix listxattr handling when the buffer is full doc: watchdog: fix typos etc update Sean's email address ocfs2: use get_random_u32() where appropriate ocfs2: split transactions in dio completion to avoid credit exhaustion ocfs2: remove redundant l_next_free_rec check in __ocfs2_find_path() ocfs2: validate extent block list fields during block read ocfs2: remove empty extent list check in ocfs2_dx_dir_lookup_rec() ocfs2: validate dx_root extent list fields during block read ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY ocfs2: handle invalid dinode in ocfs2_group_extend .get_maintainer.ignore: add Askar ocfs2: validate bg_list extent bounds in discontig groups checkpatch: exclude forward declarations of const structs tools/accounting: handle truncated taskstats netlink messages taskstats: set version in TGID exit notifications ocfs2/heartbeat: fix slot mapping rollback leaks on error paths arm64,ppc64le/kdump: pass dm-crypt keys to kdump kernel ... commit 82c21069028c5db3463f851ae8ac9cc2e38a3827 Author: Jakub Kicinski Date: Wed Apr 15 18:04:39 2026 -0700 selftests: net: add missing CMAC to tcp_ao config Recent changes to crypto and wifi made CMAC no longer selected by default on x86 and tcp_ao needs it. Add the missing config. Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260416010439.1053587-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 946e99146597558c7447ac4d1e598fcb1695489b Merge: d2dced26bc6a18 2a2675ef619010 Author: Jakub Kicinski Date: Thu Apr 16 19:34:26 2026 -0700 Merge branch 'vsock-virtio-fix-msg_peek-calculation-on-bytes-to-copy' Luigi Leonardi says: ==================== vsock/virtio: fix MSG_PEEK calculation on bytes to copy `virtio_transport_stream_do_peek`, when calculating the number of bytes to copy, didn't consider the `offset`, caused by partial reads that happened before. This might cause out-of-bounds read that lead to an EFAULT. More details in the commits. Commit 1 introduces the fix Commit 2 introduces some preliminary work for adding a test and fixes a problem in existing tests. Commit 3 introduces a test that checks for this bug to avoid future regressions. For disclosure: this bug was found initially by claude opus 4.6, I then analyzed it and worked on the fix and the test. ==================== Link: https://patch.msgid.link/20260415-fix_peek-v4-0-8207e872759e@redhat.com Signed-off-by: Jakub Kicinski commit 2a2675ef619010912a5826297cd3cab00d7dc697 Author: Luigi Leonardi Date: Wed Apr 15 17:09:30 2026 +0200 vsock/test: add MSG_PEEK after partial recv test Add a test that verifies MSG_PEEK works correctly after a partial recv(). This is to test a bug that was present in the `virtio_transport_stream_do_peek()` when computing the number of bytes to copy: After a partial read, the peek function didn't take into consideration the number of bytes that were already read. So peeking the whole buffer would cause an out-of-bounds read, that resulted in a -EFAULT. This test does exactly this: do a partial recv on a buffer, then try to peek the whole buffer content. The test re-uses `test_stream_msg_peek_client()` to also cover this scenario. Reviewed-by: Stefano Garzarella Signed-off-by: Luigi Leonardi Link: https://patch.msgid.link/20260415-fix_peek-v4-3-8207e872759e@redhat.com Signed-off-by: Jakub Kicinski commit a3f77afbf67d5ddbc8938fd5627a11221d8a3368 Author: Luigi Leonardi Date: Wed Apr 15 17:09:29 2026 +0200 vsock/test: fix MSG_PEEK handling in recv_buf() `recv_buf` does not handle the MSG_PEEK flag correctly: it keeps calling `recv` until all requested bytes are available or an error occurs. The problem is how it calculates the number of bytes read: MSG_PEEK doesn't consume any bytes and will re-read the same bytes from the buffer head, so summing the return value every time is wrong. Moreover, MSG_PEEK doesn't consume the bytes in the buffer, so if more bytes are requested than are available, the loop will never terminate, because `recv` will never return EOF. For this reason, we need to compare the number of bytes read with the number of bytes expected. Add a check: if the MSG_PEEK flag is present, update the byte counter and break out of the loop only after at least the expected number of bytes have been received; otherwise, retry after a short delay to avoid consuming too many CPU cycles. This allows us to simplify the `test_stream_credit_update_test` by reusing `recv_buf`, like some other tests already do. Suggested-by: Stefano Garzarella Signed-off-by: Luigi Leonardi Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20260415-fix_peek-v4-2-8207e872759e@redhat.com Signed-off-by: Jakub Kicinski commit 080f22f5d30233faf3d83be3098f35b8be9b7a00 Author: Luigi Leonardi Date: Wed Apr 15 17:09:28 2026 +0200 vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy `virtio_transport_stream_do_peek()` does not account for the skb offset when computing the number of bytes to copy. This means that, after a partial recv() that advances the offset, a peek requesting more bytes than are available in the sk_buff causes `skb_copy_datagram_iter()` to go past the valid payload, resulting in a -EFAULT. The dequeue path already handles this correctly. Apply the same logic to the peek path. Fixes: 0df7cd3c13e4 ("vsock/virtio/vhost: read data from non-linear skb") Reviewed-by: Stefano Garzarella Acked-by: Arseniy Krasnov Signed-off-by: Luigi Leonardi Link: https://patch.msgid.link/20260415-fix_peek-v4-1-8207e872759e@redhat.com Signed-off-by: Jakub Kicinski commit d2dced26bc6a188534957e82a9a8e0a25ce81549 Merge: 5099807f335ce4 3cade698881eb2 Author: Jakub Kicinski Date: Thu Apr 16 19:31:09 2026 -0700 Merge branch 'net-enetc-fix-command-bd-ring-issues' Wei Fang says: ==================== net: enetc: fix command BD ring issues Currently, the implementation of command BD ring has two issues, one is that the driver may obtain wrong consumer index of the ring, because the driver does not mask out the SBE bit of the CIR value, so a wrong index will be obtained when a SBE error ouccrs. The other one is that the DMA buffer may be used after free. If netc_xmit_ntmp_cmd() times out and returns an error, the pending command is not explicitly aborted, while ntmp_free_data_mem() unconditionally frees the DMA buffer. If the buffer has already been reallocated elsewhere, this may lead to silent memory corruption. Because the hardware eventually processes the pending command and perform a DMA write of the response to the physical address of the freed buffer. So this patch set is to fix these two issues. ==================== Link: https://patch.msgid.link/20260415060833.2303846-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 3cade698881eb238f88cbbfec82acc2110440a3f Author: Wei Fang Date: Wed Apr 15 14:08:33 2026 +0800 net: enetc: fix NTMP DMA use-after-free issue The AI-generated review reported a potential DMA use-after-free issue [1]. If netc_xmit_ntmp_cmd() times out and returns an error, the pending command is not explicitly aborted, while ntmp_free_data_mem() unconditionally frees the DMA buffer. If the buffer has already been reallocated elsewhere, this may lead to silent memory corruption. Because the hardware eventually processes the pending command and perform a DMA write of the response to the physical address of the freed buffer. To resolve this issue, this patch does the following modifications: 1. Convert cbdr->ring_lock from a spinlock to a mutex The lock was originally a spinlock in case NTMP operations might be invoked from atomic context. After downstream support for all NTMP tables, no such usage has materialized. A mutex lock is now required because the driver now needs to reclaim used BDs and release associated DMA memory within the lock's context, while dma_free_coherent() might sleep. 2. Introduce software command BD (struct netc_swcbd) The hardware write-back overwrites the addr and len fields of the BD, so the driver cannot rely on the hardware BD to free the associated DMA memory. The driver now maintains a software shadow BD storing the DMA buffer pointer, DMA address, and size. And netc_xmit_ntmp_cmd() only reclaims older BDs when the number of used BDs reaches NETC_CBDR_CLEAN_WORK (16). The software BD enables correct DMA memory release. With this, struct ntmp_dma_buf and ntmp_free_data_mem() are no longer needed and are removed. 3. Require callers to hold ring_lock across netc_xmit_ntmp_cmd() netc_xmit_ntmp_cmd() releases the ring_lock before the caller finishes consuming the response. At this point, if a concurrent thread submits a new command, it may trigger ntmp_clean_cbdr() and free the DMA buffer while it is still in use. Move ring_lock ownership to the caller to ensure the response buffer cannot be reclaimed prematurely. So the helpers ntmp_select_and_lock_cbdr() and ntmp_unlock_cbdr() are added. These changes eliminate the DMA use-after-free condition and ensure safe and consistent BD reclamation and DMA buffer lifecycle management. Fixes: 4701073c3deb ("net: enetc: add initial netc-lib driver to support NTMP") Link: https://lore.kernel.org/netdev/20260403011729.1795413-1-kuba@kernel.org/ # [1] Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260415060833.2303846-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 759a32900b6f3db3d0f34a3b61123742723b50b4 Author: Wei Fang Date: Wed Apr 15 14:08:32 2026 +0800 net: enetc: correct the command BD ring consumer index The command BD ring cousumer index register has the consumer index as the lower 10 bits, and the bit 31 is SBE, which indicates whether a system bus error occurred during execution of the CBD command. So if a system bus error occurs, reading the register will get the SBE bit set. However, the current implementation directly uses the register value as the consumer index without masking it. Therefore, if a system bus error occurs, an incorrect consumer index will be obtained, causing errors in the processing of the command BD ring. Thus, we need to mask out the other bits to obtain the correct consumer index. In addition, this patch adds a check for the SBE bit after the polling loop and returns an error if the bit is set. Fixes: 4701073c3deb ("net: enetc: add initial netc-lib driver to support NTMP") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260415060833.2303846-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 5099807f335ce4f783f0578bef7278fffad30b07 Author: Kory Maincent Date: Wed Apr 15 15:02:59 2026 +0200 net: pse-pd: fix out-of-bounds bitmap access in pse_isr() on 32-bit In pse_isr(), notifs_mask was declared as a single unsigned long on the stack (32 bits on 32-bit architectures). For PSE controllers with more than 32 ports, this causes two problems: - map_event callbacks could wrote bit positions >= 32 via *notifs_mask |= BIT(i), which is undefined behaviour on a 32-bit unsigned long and corrupts adjacent stack memory. - for_each_set_bit(i, ¬ifs_mask, pcdev->nr_lines) treats ¬ifs_mask as a multi-word bitmap and reads beyond the single unsigned long when nr_lines > BITS_PER_LONG. Fix this by moving notifs_mask out of the stack and into struct pse_irq as a dynamically allocated bitmap. It is sized with BITS_TO_LONGS(pcdev->nr_lines) words in devm_pse_irq_helper(), so it is always wide enough regardless of the host word size. [Jakub]: No upstream driver currently supports >=32 ports. Signed-off-by: Kory Maincent Link: https://patch.msgid.link/20260415130300.806152-1-kory.maincent@bootlin.com Signed-off-by: Jakub Kicinski commit 0b2f2b1fc0c61e602a6babf580b91f895b0ea80a Merge: 3cd8b194bf3428 c09fb907a28228 Author: Linus Torvalds Date: Thu Apr 16 19:14:55 2026 -0700 Merge tag 'v7.1-rc1-part2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - Fix integer underflow in encrypted read - Four debug patches, adding a few tracepoints - Minor update to MAINTAINERS file (preferred server URL for cifs) - Remove the BUG_ON() calls in d_mark_tmpfile_name * tag 'v7.1-rc1-part2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: MAINTAINERS: change git.samba.org to https smb: client: fix integer underflow in receive_encrypted_read() smb: client: add tracepoints for deferred handle caching smb: client: add oplock level to smb3_open_done tracepoint smb: client: add tracepoint for local lock conflicts smb: client: add tracepoints for lock operations vfs: get rid of BUG_ON() in d_mark_tmpfile_name() commit 0f99e0c3e19badaf3fdced0d3feba623e59eed41 Author: Stanislav Fomichev Date: Tue Apr 14 16:10:35 2026 -0700 net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops DSA replaces the conduit (master) device's ethtool_ops with its own wrappers that aggregate stats from both the conduit and DSA switch ports. Taking the lock again inside the DSA wrappers causes a deadlock. Stumbled upon this when booting qemu with fbnic and CONFIG_NET_DSA_LOOP=y (which looks like some kind of testing device that auto-populates the ports of eth0). `ethtool -i` is enough to deadlock. This means we have basically zero coverage for DSA stuff with real ops locked devs. Remove the redundant netdev_lock_ops()/netdev_unlock_ops() calls from the DSA conduit ethtool wrappers. Fixes: 2bcf4772e45a ("net: ethtool: try to protect all callback with netdev instance lock") Signed-off-by: Stanislav Fomichev Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260414231035.1917035-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 105425b1969c5affe532713cfac1c0b320d7ac2b Author: Vinicius Costa Gomes Date: Fri Apr 10 18:57:57 2026 -0700 net/sched: taprio: fix use-after-free in advance_sched() on schedule switch In advance_sched(), when should_change_schedules() returns true, switch_schedules() is called to promote the admin schedule to oper. switch_schedules() queues the old oper schedule for RCU freeing via call_rcu(), but 'next' still points into an entry of the old oper schedule. The subsequent 'next->end_time = end_time' and rcu_assign_pointer(q->current_entry, next) are use-after-free. Fix this by selecting 'next' from the new oper schedule immediately after switch_schedules(), and using its pre-calculated end_time. setup_first_end_time() sets the first entry's end_time to base_time + interval when the schedule is installed, so the value is already correct. The deleted 'end_time = sched_base_time(admin)' assignment was also harmful independently: it would overwrite the new first entry's pre-calculated end_time with just base_time. Fixes: a3d43c0d56f1 ("taprio: Add support adding an admin schedule") Reported-by: Junxi Qian Signed-off-by: Vinicius Costa Gomes Signed-off-by: Jakub Kicinski commit 1e9e7fd839b7f22b46762059c6f3e576b3e6e179 Author: Geert Uytterhoeven Date: Tue Apr 14 12:30:47 2026 +0200 net: mdio: MDIO_PIC64HPSC should depend on ARCH_MICROCHIP The PIC64-HPSC/HX MDIO interface is only present on Microchip PIC64-HPSC/HX SoCs. Hence add a dependency on ARCH_MICROCHIP, to prevent asking the user about this driver when configuring a kernel without Microchip SoC support. Fixes: f76aef980206e7c6 ("net: mdio: add a driver for PIC64-HPSC/HX MDIO controller") Signed-off-by: Geert Uytterhoeven Reviewed-by: Charles Perry Reviewed-by: Simon Horman Link: https://patch.msgid.link/980c57efa5843733ef95459c3283aebade56f142.1776162544.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit f3206328bb52c2787197d80d7cbd687946047d5f Author: Lorenzo Bianconi Date: Tue Apr 14 16:08:52 2026 +0200 net: airoha: Wait for NPU PPE configuration to complete in airoha_ppe_offload_setup() In order to properly enable flowtable hw offloading, poll REG_PPE_FLOW_CFG register in airoha_ppe_offload_setup routine and wait for NPU PPE configuration triggered by ppe_init callback to complete before running airoha_ppe_hw_init(). Fixes: 00a7678310fe3 ("net: airoha: Introduce flowtable offload support") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260414-airoha-wait-for-npu-config-offload-setup-v2-1-5a9bf6d43aee@kernel.org Signed-off-by: Jakub Kicinski commit 19785999991deef010ff09ab5f460d31808b31a7 Merge: 993eb191400f5d a97c88a176b6b8 Author: Dave Airlie Date: Fri Apr 17 10:25:46 2026 +1000 Merge tag 'drm-intel-next-fixes-2026-04-16' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Fix VESA backlight possible check condition [backlight] (Suraj Kandpal) - Verify the correct plane DDB entry [wm] (Ville Syrjälä) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patch.msgid.link/aeCGoL4FFwT66bF4@linux commit 993eb191400f5d06322989ea7c890fd11965f80b Merge: ca8639fbb33546 2c683e9b419328 Author: Dave Airlie Date: Fri Apr 17 07:32:30 2026 +1000 Merge tag 'topic/pipe-reorder-2026-04-15' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915/display: change pipe allocation order for discrete platforms This is a topic pull request for changing the pipe allocation order for discrete platforms from the usual A,B,C,D to A,C,B,D. The goal is to help pipe joiner configurations that reserve the adjacent pipe as the secondary pipe without the user space knowing. More details in the relevant commit message. The CRTC iteration is also changed to remain in pipe order. Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patch.msgid.link/d69501d53c233386d70ed10290af24aafebf434f@intel.com commit 380044c40b1636a72fd8f188b5806be6ae564279 Author: Jiri Olsa Date: Thu Apr 16 12:00:34 2026 +0200 libbpf: Prevent double close and leak of btf objects Sashiko found possible double close of btf object fd [1], which happens when strdup in load_module_btfs fails at which point the obj->btf_module_cnt is already incremented. The error path close btf fd and so does later cleanup code in bpf_object_post_load_cleanup function. Also libbpf_ensure_mem failure leaves btf object not assigned and it's leaked. Replacing the err_out label with break to make the error path less confusing as suggested by Alan. Incrementing obj->btf_module_cnt only if there's no failure and releasing btf object in error path. Fixes: 91abb4a6d79d ("libbpf: Support attachment of BPF tracing programs to kernel modules") [1] https://sashiko.dev/#/patchset/20260324081846.2334094-1-jolsa%40kernel.org Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260416100034.1610852-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit d6f5841a4f291188e0bae21a47c6e540fd937aa8 Merge: 766bf026d0da24 4198ff31edb193 Author: Alexei Starovoitov Date: Thu Apr 16 15:53:32 2026 -0700 Merge branch 'bpf-allow-utf-8-literals-in-bpf_bprintf_prepare' Yihan Ding says: ==================== bpf: allow UTF-8 literals in bpf_bprintf_prepare() bpf_bprintf_prepare() currently rejects any non-ASCII byte in format strings, so helpers such as bpf_trace_printk() fail to emit UTF-8 literal text even when those bytes are not part of a format specifier. Keep plain text permissive while continuing to parse '%' sequences as ASCII-only. Patch 1 updates snprintf_negative() at the same time so the selftests stay consistent during bisection. Patch 2 then extends trace_printk coverage for both the valid UTF-8 literal case and the invalid non-ASCII-after-'%' case. Changes in v3: - drop Suggested-by trailers and move review credit into this changelog - update test_snprintf_negative() in patch 1/2 so plain non-ASCII text is accepted while non-ASCII after '%' is still rejected, keeping ./test_progs -t snprintf aligned with the new behavior. - clarify the trace_printk negative case with an explicit invalid format string and comment - address Paul Chaignon's review feedback and keep the negative coverage requested earlier by Alan Maguire Changes in v2: - split the core change and selftest updates into two patches - drop unnecessary isspace()/ispunct() casts - add comments to clarify plain-text vs format-specifier handling - add a negative selftest for non-ASCII bytes inside '%' sequences Testing: - Reproduced on x86_64 without the core fix: ASCII trace output works, while UTF-8 literal text in bpf_trace_printk() is rejected and produces no trace output - Verified with tools/testing/selftests/bpf: ./test_progs -t trace_printk - Verified with tools/testing/selftests/bpf: ./test_progs -t snprintf ==================== Link: https://patch.msgid.link/20260416120142.1420646-1-dingyihan@uniontech.com Signed-off-by: Alexei Starovoitov commit 4198ff31edb193cb11955338ee923d9f842a4fce Author: Yihan Ding Date: Thu Apr 16 20:01:42 2026 +0800 selftests/bpf: cover UTF-8 trace_printk output Extend trace_printk coverage to verify that UTF-8 literal text is emitted successfully and that '%' parsing still rejects non-ASCII bytes once format parsing starts. Use an explicitly invalid format string for the negative case so the ASCII-only parser expectation is visible from the test code itself. Signed-off-by: Yihan Ding Acked-by: Paul Chaignon Link: https://lore.kernel.org/r/20260416120142.1420646-3-dingyihan@uniontech.com Signed-off-by: Alexei Starovoitov commit b960430ea8862ef37ce53c8bf74a8dc79d3f2404 Author: Yihan Ding Date: Thu Apr 16 20:01:41 2026 +0800 bpf: allow UTF-8 literals in bpf_bprintf_prepare() bpf_bprintf_prepare() only needs ASCII parsing for conversion specifiers. Plain text can safely carry bytes >= 0x80, so allow UTF-8 literals outside '%' sequences while keeping ASCII control bytes rejected and format specifiers ASCII-only. This keeps existing parsing rules for format directives unchanged, while allowing helpers such as bpf_trace_printk() to emit UTF-8 literal text. Update test_snprintf_negative() in the same commit so selftests keep matching the new plain-text vs format-specifier split during bisection. Fixes: 48cac3f4a96d ("bpf: Implement formatted output helpers with bstr_printf") Signed-off-by: Yihan Ding Acked-by: Paul Chaignon Link: https://lore.kernel.org/r/20260416120142.1420646-2-dingyihan@uniontech.com Signed-off-by: Alexei Starovoitov commit 766bf026d0da242a329b402c436c8e4cfa2008d8 Merge: e5f635edd393ae fcd11ff8bd0e52 Author: Alexei Starovoitov Date: Thu Apr 16 15:20:27 2026 -0700 Merge branch 'bpf-fix-null-deref-when-storing-scalar-into-kptr-slot' Mykyta Yatsenko says: ==================== bpf: Fix NULL deref when storing scalar into kptr slot map_kptr_match_type() accesses reg->btf before confirming the register is PTR_TO_BTF_ID. A scalar store into a kptr slot has no btf, causing a NULL pointer dereference. Guard base_type() first. Signed-off-by: Mykyta Yatsenko ==================== Link: https://patch.msgid.link/20260416-kptr_crash-v1-0-5589356584b4@meta.com Signed-off-by: Alexei Starovoitov commit fcd11ff8bd0e526bdd5f43f534ccf7c4e67245ad Author: Mykyta Yatsenko Date: Thu Apr 16 11:08:08 2026 -0700 selftests/bpf: Reject scalar store into kptr slot Verify that the verifier rejects a direct scalar write to a kptr map value slot without crashing. Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260416-kptr_crash-v1-2-5589356584b4@meta.com Signed-off-by: Alexei Starovoitov commit 4d0a375887ab4d49e4da1ff10f9606cab8f7c3ad Author: Mykyta Yatsenko Date: Thu Apr 16 11:08:07 2026 -0700 bpf: Fix NULL deref in map_kptr_match_type for scalar regs Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr") refactored map_kptr_match_type() to branch on btf_is_kernel() before checking base_type(). A scalar register stored into a kptr slot has no btf, so the btf_is_kernel(reg->btf) call dereferences NULL. Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf access. Fixes: ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr") Reported-by: Hiker Cl Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221372 Signed-off-by: Mykyta Yatsenko Acked-by: Paul Chaignon Link: https://lore.kernel.org/r/20260416-kptr_crash-v1-1-5589356584b4@meta.com Signed-off-by: Alexei Starovoitov commit cf92d78a4aa2adbc2b1e687776aabe63c5b97f3f Author: Tao Jiang Date: Thu Apr 16 01:27:15 2026 +0800 nvme-pci: add quirk for Memblaze Pblaze5 (0x1c5f:0x0555) The Memblaze Pblaze5 NVMe device (PCI ID 0x1c5f:0x0555) is detected as a controller on recent kernels (tested on 5.15.85 and 6.8.4), but no namespace is exposed. Tools like lsblk and fdisk do not report any block device. dmesg shows: nvme nvme0: missing or invalid SUBNQN field. The device works correctly on older kernels (e.g. 4.19), suggesting a compatibility issue with newer namespace handling. This indicates the device does not properly support the Namespace Descriptor List feature. Applying NVME_QUIRK_NO_NS_DESC_LIST allows the namespace to be discovered correctly. Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Signed-off-by: Tao Jiang Signed-off-by: Keith Busch commit 3f150f0f010f234f34a67897344f18e68fe803f7 Author: John Garry Date: Wed Apr 15 15:53:58 2026 +0000 nvme-multipath: put module reference when delayed removal work is canceled The delayed disk removal work is canceled when a NS (re)appears. However, we do not put the module reference grabbed in nvme_mpath_remove_disk(), so fix that. Reviewed-by: Christoph Hellwig Reviewed-by: Nilay Shroff Reviewed-by: Chaitanya Kulkarni Signed-off-by: John Garry Signed-off-by: Keith Busch commit 20925812de7bf5e6fdc133c691ef52b33f700fbc Author: Daniel Wagner Date: Wed Apr 8 18:19:56 2026 +0200 nvme: expose TLS mode It is not possible to determine the active TLS mode from the presence or absence of sysfs attributes like tls_key, tls_configured_key, or dhchap_secret. With the introduction of the concat mode and optional DH-CHAP authentication, different configurations can result in identical sysfs state. This makes user space detection unreliable. Expose the TLS mode explicitly to allow user space to unambiguously identify the active configuration and avoid fragile heuristics in nvme-cli. Reviewed-by: Chris Leech Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch commit ba9d308ccd6732dd97ed8080d834a4a89e758e14 Author: Fedor Pchelkin Date: Wed Apr 8 17:18:14 2026 +0300 nvme-apple: drop invalid put of admin queue reference count Commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime") moved the admin queue reference ->put call into nvme_free_ctrl() - a controller device release callback performed for every nvme driver doing nvme_init_ctrl(). nvme-apple sets refcount of the admin queue to 1 at allocation during the probe function and then puts it twice now: nvme_free_ctrl() blk_put_queue(ctrl->admin_q) // #1 ->free_ctrl() apple_nvme_free_ctrl() blk_put_queue(anv->ctrl.admin_q) // #2 Note that there is a commit 941f7298c70c ("nvme-apple: remove an extra queue reference") which intended to drop taking an extra admin queue reference. Looks like at that moment it accidentally fixed a refcount leak, which existed since the driver's introduction. There were two ->get calls at driver's probe function and a single ->put inside apple_nvme_free_ctrl(). However now after commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime") the refcount is imbalanced again. Fix it by removing extra ->put call from apple_nvme_free_ctrl(). anv->dev and ctrl->dev point to the same device, so use ctrl->dev directly for simplification. Compile tested only. Found by Linux Verification Center (linuxtesting.org). Fixes: 03b3bcd319b3 ("nvme: fix admin request_queue lifetime") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Signed-off-by: Fedor Pchelkin Signed-off-by: Keith Busch commit e80e39f25567310c1c7392eed886890b5c6788ba Author: Flavio Suligoi Date: Wed Apr 8 14:45:22 2026 +0200 nvme-core: fix parameter name in comment In the declaration of the structure "core_quirks[]", in the comment referred to the devices "Kioxia CD6-V Series / HPE PE8030", the parameter "default_ps_max_latency_us" is reported in a wrong way: nvme_core.default_ps_max_latency=0 The correct form is, instead: nvme_core.default_ps_max_latency_us=0 Reviewed-by: Christoph Hellwig Signed-off-by: Flavio Suligoi Signed-off-by: Keith Busch commit aade8abd8b868b6ffa9697aadaea28ec7f65bee6 Author: Chaitanya Kulkarni Date: Wed Apr 8 17:56:47 2026 -0700 nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final controller reference through nvmet_cq_put(). If that triggers nvmet_ctrl_free(), the teardown path flushes ctrl->async_event_work on the same nvmet-wq. Call chain: nvmet_tcp_schedule_release_queue() kref_put(&queue->kref, nvmet_tcp_release_queue) nvmet_tcp_release_queue() queue_work(nvmet_wq, &queue->release_work) <--- nvmet_wq process_one_work() nvmet_tcp_release_queue_work() nvmet_cq_put(&queue->nvme_cq) nvmet_cq_destroy() nvmet_ctrl_put(cq->ctrl) nvmet_ctrl_free() flush_work(&ctrl->async_event_work) <--- nvmet_wq Previously Scheduled by :- nvmet_add_async_event queue_work(nvmet_wq, &ctrl->async_event_work); This trips lockdep with a possible recursive locking warning. [ 5223.015876] run blktests nvme/003 at 2026-04-07 20:53:55 [ 5223.061801] loop0: detected capacity change from 0 to 2097152 [ 5223.072206] nvmet: adding nsid 1 to subsystem blktests-subsystem-1 [ 5223.088368] nvmet_tcp: enabling port 0 (127.0.0.1:4420) [ 5223.126086] nvmet: Created discovery controller 1 for subsystem nqn.2014-08.org.nvmexpress.discovery for NQN nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349. [ 5223.128453] nvme nvme1: new ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery", addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349 [ 5233.199447] nvme nvme1: Removing ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery" [ 5233.227718] ============================================ [ 5233.231283] WARNING: possible recursive locking detected [ 5233.234696] 7.0.0-rc3nvme+ #20 Tainted: G O N [ 5233.238434] -------------------------------------------- [ 5233.241852] kworker/u192:6/2413 is trying to acquire lock: [ 5233.245429] ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90 [ 5233.251438] but task is already holding lock: [ 5233.255254] ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x5cc/0x6e0 [ 5233.261125] other info that might help us debug this: [ 5233.265333] Possible unsafe locking scenario: [ 5233.269217] CPU0 [ 5233.270795] ---- [ 5233.272436] lock((wq_completion)nvmet-wq); [ 5233.275241] lock((wq_completion)nvmet-wq); [ 5233.278020] *** DEADLOCK *** [ 5233.281793] May be due to missing lock nesting notation [ 5233.286195] 3 locks held by kworker/u192:6/2413: [ 5233.289192] #0: ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x5cc/0x6e0 [ 5233.294569] #1: ffffc9000e2a7e40 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x6e0 [ 5233.300128] #2: ffffffff82d7dc40 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530 [ 5233.304290] stack backtrace: [ 5233.306520] CPU: 4 UID: 0 PID: 2413 Comm: kworker/u192:6 Tainted: G O N 7.0.0-rc3nvme+ #20 PREEMPT(full) [ 5233.306524] Tainted: [O]=OOT_MODULE, [N]=TEST [ 5233.306525] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 5233.306527] Workqueue: nvmet-wq nvmet_tcp_release_queue_work [nvmet_tcp] [ 5233.306532] Call Trace: [ 5233.306534] [ 5233.306536] dump_stack_lvl+0x73/0xb0 [ 5233.306552] print_deadlock_bug+0x225/0x2f0 [ 5233.306556] __lock_acquire+0x13f0/0x2290 [ 5233.306563] lock_acquire+0xd0/0x300 [ 5233.306565] ? touch_wq_lockdep_map+0x26/0x90 [ 5233.306571] ? __flush_work+0x20b/0x530 [ 5233.306573] ? touch_wq_lockdep_map+0x26/0x90 [ 5233.306577] touch_wq_lockdep_map+0x3b/0x90 [ 5233.306580] ? touch_wq_lockdep_map+0x26/0x90 [ 5233.306583] ? __flush_work+0x20b/0x530 [ 5233.306585] __flush_work+0x268/0x530 [ 5233.306588] ? __pfx_wq_barrier_func+0x10/0x10 [ 5233.306594] ? xen_error_entry+0x30/0x60 [ 5233.306600] nvmet_ctrl_free+0x140/0x310 [nvmet] [ 5233.306617] nvmet_cq_put+0x74/0x90 [nvmet] [ 5233.306629] nvmet_tcp_release_queue_work+0x19f/0x360 [nvmet_tcp] [ 5233.306634] process_one_work+0x206/0x6e0 [ 5233.306640] worker_thread+0x184/0x320 [ 5233.306643] ? __pfx_worker_thread+0x10/0x10 [ 5233.306646] kthread+0xf1/0x130 [ 5233.306648] ? __pfx_kthread+0x10/0x10 [ 5233.306651] ret_from_fork+0x355/0x450 [ 5233.306653] ? __pfx_kthread+0x10/0x10 [ 5233.306656] ret_from_fork_asm+0x1a/0x30 [ 5233.306664] There is also no need to flush async_event_work from controller teardown. The admin queue teardown already fails outstanding AER requests before the final controller put :- nvmet_sq_destroy(admin sq) nvmet_async_events_failall(ctrl) The controller has already been removed from the subsystem list before nvmet_ctrl_free() quiesces outstanding work. Replace flush_work() with cancel_work_sync() so a pending async_event_work item is canceled and a running instance is waited on without recursing into the same workqueue. Fixes: 06406d81a2d7 ("nvmet: cancel fatal error and flush async work before free controller") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Signed-off-by: Chaitanya Kulkarni Signed-off-by: Keith Busch commit 4f96b7c68a9904e01049ef610d701b382dca9574 Author: Nathan Chancellor Date: Wed Mar 25 18:19:15 2026 -0700 extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' A recent strengthening of -Wunused-but-set-variable (enabled with -Wall) in clang under a new subwarning, -Wunused-but-set-global, points out an unused static global variable in certs/extract-cert.c: certs/extract-cert.c:46:20: error: variable 'key_pass' set but not used [-Werror,-Wunused-but-set-global] 46 | static const char *key_pass; | ^ After commit 558bdc45dfb2 ("sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3"), key_pass is only used with the OpenSSL engine API, not the new provider API. Wrap key_pass's declaration and assignment with '#ifdef USE_PKCS11_ENGINE' so that it is only included with its use to clear up the warning. While this is a little uglier than just marking key_pass with the unused attribute, this will make it easier to clean up all code associated with the use of the engine API if it were ever removed in the future. While in the area, use a tab for the key_pass assignment line to match the rest of the file. Cc: stable@vger.kernel.org Fixes: 558bdc45dfb2 ("sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3") Reviewed-by: Nick Desaulniers Tested-by: Nick Desaulniers Link: https://patch.msgid.link/20260325-certs-extract-cert-key_pass-unused-but-set-global-v1-1-ecf94326d532@kernel.org Signed-off-by: Nathan Chancellor commit df410ad40ca0a57c46c06de2b992de8baf3a7f5a Author: Mark Brown Date: Thu Apr 16 20:03:59 2026 +0100 selftests: Fix runner.sh for non-bash shells Commit 2964f6b816c2 ("selftests: Use ktap helpers for runner.sh") added a number of bashisms and updated the interpreter specified for the script to be /bin/bash to reflect this. Unfortunately this does not actually achieve anything in production since the main way runner.sh is invoked is from the top level run_kselftest.sh which sources it rather than running it as a separate script and specifies the shell as /bin/sh. This means that on systems where /bin/sh is not bash (such as Debian where /bin/sh defaults to being dash) we see failures: ./run_kselftest.sh: 195: ./kselftest/runner.sh: Syntax error: "(" unexpected (expecting "}") These bashisms come from this part of the change: 4. In runner.sh run_one(), get the return value and use ktap helpers for all pass/fail reporting. This allows counting pass/fail numbers in the main process. which uses a bash array to track all the subtests being run. Convert this to use a simple flat variable instead. Link: https://lore.kernel.org/r/20260416-selftest-fix-readlink-e-v1-2-94e4cabbdec4@kernel.org Fixes: 2964f6b816c2 ("selftests: Use ktap helpers for runner.sh") Signed-off-by: Mark Brown Signed-off-by: Shuah Khan commit 93edbf1782afaf907b035010c00e7390c9d45b18 Author: Mark Brown Date: Thu Apr 16 20:03:58 2026 +0100 selftests: Fix runner.sh busybox support Commit 2964f6b816c2 ("selftests: Use ktap helpers for runner.sh") added an import of ktap_helper.sh to runner.sh in order to standardise on these for output formatting. Rather than build on the existing requirement for the user to supply BASE_DIR to find the helpers it uses some magic which features a use of "readlink -e". Unfortunately the -e option is a GNU extension and is not available in at least busybox, meaning that runner.sh starts failing: ./run_kselftest.sh: 5: ./kselftest/runner.sh: Bad substitution ./run_kselftest.sh: 5: .: cannot open ./ktap_helpers.sh: No such file Fix this by using the already required BASE_DIR to locate the helper library. Link: https://lore.kernel.org/r/20260416-selftest-fix-readlink-e-v1-1-94e4cabbdec4@kernel.org Fixes: 2964f6b816c2 ("selftests: Use ktap helpers for runner.sh") Signed-off-by: Mark Brown Signed-off-by: Shuah Khan commit cad6f32665cbff8e556a1da035e55261f7374ebd Author: Mark Brown Date: Thu Apr 16 14:19:24 2026 +0100 selftests: Deescalate error reporting Commit 7e47389142b8 ("selftests: Preserve subtarget failures in all/install") updated the propagation of errors from indivdual kselftest targets to be similar to that seen with FORCE_TARGETS. While it would be really nice to be in a position to do this currently it is premature to do this as the default behaviour. At present we default to trying to build all selftests but a combination of code quality issues and build dependencies mean that it is almost certain that at least one of them will fail to build (for example, several depend on clang so don't work in a GCC container) and a top level failure in the kselftest build reported. Further, the resulting failures mean that the install target does not run at all so any build problem is escallated to a complete failure to produce a kselftest tarball so CI systems that run into issues loose all selftests coverage. This has been causing disruption to a range of CI systems including KernelCI, mine and Arm's internal one. Revert the commit, users who need this behaviour should be able to use FORCE_TARGETS for the time being. At present users that do this (such as linux-next) are most likely building a subset of targets known to succeed in their environments. Link: https://lore.kernel.org/r/20260416-selftests-deescalate-error-reporting-v1-1-38e7c0536227@kernel.org Fixes: 7e47389142b8 ("selftests: Preserve subtarget failures in all/install") Signed-off-by: Mark Brown Signed-off-by: Shuah Khan commit 7b41ff29c8d386257bae62ad557fd6bad8cc6787 Author: Oleg Nesterov Date: Sun Apr 12 20:07:21 2026 +0200 entry: Kill ARCH_SYSCALL_WORK_{ENTER,EXIT} Nowadays nothing redefines these flags. Signed-off-by: Oleg Nesterov Signed-off-by: Thomas Gleixner Reviewed-by: Jinjie Ruan Link: https://patch.msgid.link/advfWWKgOQkFkwp9@redhat.com commit 4096fd0e8eaea13ebe5206700b33f49635ae18e5 Author: Thomas Gleixner Date: Tue Apr 14 22:55:01 2026 +0200 clockevents: Add missing resets of the next_event_forced flag The prevention mechanism against timer interrupt starvation missed to reset the next_event_forced flag in a couple of places: - When the clock event state changes. That can cause the flag to be stale over a shutdown/startup sequence - When a non-forced event is armed, which then prevents rearming before that event. If that event is far out in the future this will cause missed timer interrupts. - In the suspend wakeup handler. That led to stalls which have been reported by several people. Add the missing resets, which fixes the problems for the reporters. Fixes: d6e152d905bd ("clockevents: Prevent timer interrupt starvation") Reported-by: Hanabishi Reported-by: Eric Naim Signed-off-by: Thomas Gleixner Tested-by: Hanabishi Tested-by: Eric Naim Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/68d1e9ac-2780-4be3-8ee3-0788062dd3a4@gmail.com Link: https://patch.msgid.link/87340xfeje.ffs@tglx commit b8a5774cd49996e8ef83b1637a9b547158f18de9 Merge: a1bbd84071bc33 c89046d57d5343 Author: Jiri Kosina Date: Thu Apr 16 21:11:19 2026 +0200 Merge branch 'for-7.1/asus' into for-linus - robustification of hid-asus driver to prepare for support for more devices which is underway (Denis Benato) commit a1bbd84071bc338e4b1ce55da4355690b1d6784e Merge: b3793af3277f65 30fb45cc2e4aa1 Author: Jiri Kosina Date: Thu Apr 16 21:09:41 2026 +0200 Merge branch 'for-7.1/hid-bpf' into for-linus - sync of HID-BPF with udev-hid-bpf (Benjamin Tissoires, Muhammed Rishal) commit b3793af3277f65d256d67f9949e760b434ff66dd Merge: 51cc1c427461d6 88919bedabb8d3 Author: Jiri Kosina Date: Thu Apr 16 21:08:14 2026 +0200 Merge branch 'for-7.1/intel-thc' into for-linus - power management improvements to intel-thc-hid driver (Even Xu) commit 51cc1c427461d6c989126971d2fd5ef70216ade3 Merge: a3922c8393290d 19acad732afbfb Author: Jiri Kosina Date: Thu Apr 16 21:07:13 2026 +0200 Merge branch 'for-7.1/lenovo-v2' into for-linus - new driver for Lenovo Legion Go / S devices (Derek J. Clark) commit a3922c8393290da840d4a5dd7313a7e44d918b08 Merge: 38d76018bb412d ac977b900907f6 Author: Jiri Kosina Date: Thu Apr 16 21:06:51 2026 +0200 Merge branch 'for-7.1/mcp2221' into for-linus commit 38d76018bb412dc66b08837097eff53d21e8df29 Merge: 1b2e4375f66c00 f8d379460bd088 Author: Jiri Kosina Date: Thu Apr 16 21:05:37 2026 +0200 Merge branch 'for-7.1/pidff' into for-linus - various new per-device(-group) type quirks for pidff driver (Tomasz Pakuła) commit 1b2e4375f66c00bfe28b3298f9171897a4107582 Merge: 436e7263520fa0 9bd35baa37226a Author: Jiri Kosina Date: Thu Apr 16 21:05:19 2026 +0200 Merge branch 'for-7.1/pl' into for-linus commit 436e7263520fa0eac231975e2c4d0b643c8f9266 Merge: 500af712f9cb61 de80aa182d6ca1 Author: Jiri Kosina Date: Thu Apr 16 21:03:56 2026 +0200 Merge branch 'for-7.1/sony' into for-linus - new support for a variety of Rock Band and DJ Hero Turntable devices (Rosalie Wanders) commit 500af712f9cb61e9e3d32760df0cc5dd4f3046aa Merge: d4eb7b2da66c84 42d020b54edc57 Author: Jiri Kosina Date: Thu Apr 16 21:03:22 2026 +0200 Merge branch 'for-7.1/winwing' into for-linus - support for rubmle effects in winwing driver (Ivan Gorinov) commit d4eb7b2da66c848709e31585b9c371fa234abc39 Merge: 8b9a097eb2fc37 69c02ffde6ed4d Author: Jiri Kosina Date: Thu Apr 16 21:01:18 2026 +0200 Merge branch 'for-7.1/core-v2' into for-linus - fixed handling of 0-sized reports (Dmitry Torokhov) - convert core code to __free() (Dmitry Torokhov) - support for multiple batteries per HID device (Lucas Zampieri) commit 6b701fde9b31f085f39fc2a371cb33212fab6f68 Merge: 522a83abc36eb3 42ca4f0c9444be 1db4d0edc92712 7b6894e99f835a 6358c883179e3f 1603cbb64173a0 Author: Stephen Boyd Date: Thu Apr 16 10:12:43 2026 -0700 Merge branches 'clk-samsung', 'clk-qcom', 'clk-round', 'clk-sai' and 'clk-cleanup' into clk-next * clk-samsung: clk: samsung: exynos850: Add APM-to-AP mailbox clock dt-bindings: clock: exynos850: Add APM_AP MAILBOX clock clk: samsung: Use %pe format to simplify clk: samsung: pll: Fix possible truncation in a9fraco recalc rate clk: samsung: exynosautov920: add block G3D clock support dt-bindings: clock: exynosautov920: add G3D clock definitions clk: samsung: gs101: harmonise symbol names (clock arrays) clk: samsung: artpec-9: Add initial clock support for ARTPEC-9 SoC clk: samsung: Add clock PLL support for ARTPEC-9 SoC dt-bindings: clock: Add ARTPEC-9 clock controller * clk-qcom: (67 commits) clk: qcom: gcc: Add multiple global clock controller driver for Nord SoC clk: qcom: rpmh: Add support for Nord rpmh clocks clk: qcom: Add TCSR clock driver for Nord SoC dt-bindings: clock: qcom: Add Nord Global Clock Controller dt-bindings: clock: qcom-rpmhcc: Add support for Nord SoCs dt-bindings: clock: qcom: Document the Nord SoC TCSR Clock Controller clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON clk: qcom: Constify list of critical CBCR registers clk: qcom: Constify qcom_cc_driver_data clk: qcom: videocc-glymur: Constify qcom_cc_desc clk: qcom: Add a driver for SM8750 GPU clocks dt-bindings: clock: qcom: Add SM8750 GPU clocks clk: qcom: ipq-cmn-pll: Add IPQ8074 SoC support dt-bindings: clock: qcom: Add CMN PLL support for IPQ8074 clk: qcom: ipq-cmn-pll: Add IPQ6018 SoC support dt-bindings: clock: qcom: Add CMN PLL support for IPQ6018 clk: qcom: gdsc: Fix error path on registration of multiple pm subdomains dt-bindings: clock: qcom: Add missing power-domains property clk: qcom: gcc-eliza: Enable FORCE_MEM_CORE_ON for UFS AXI PHY clock clk: qcom: dispcc-sc7180: Add missing MDSS resets ... * clk-round: clk: divider: remove divider_round_rate() and divider_round_rate_parent() clk: divider: remove divider_ro_round_rate_parent() clk: remove round_rate() clk ops clk: composite: convert from round_rate() to determine_rate() clk: test: remove references to clk_ops.round_rate * clk-sai: clk: fsl-sai: Add MCLK generation support clk: fsl-sai: Extract clock setup into fsl_sai_clk_register() dt-bindings: clock: fsl-sai: Document clock-cells = <1> support clk: fsl-sai: Add i.MX8M support with 8 byte register offset clk: fsl-sai: Sort the headers dt-bindings: clock: fsl-sai: Document i.MX8M support * clk-cleanup: clk: visconti: pll: initialize clk_init_data to zero clk: xgene: Fix mapping leak in xgene_pllclk_init() clk: Simplify clk_is_match() clk: baikal-t1: Remove not-going-to-be-supported code for Baikal SoC clk: mvebu: armada-37xx-periph: fix __iomem casts in structure init clk: qoriq: avoid format string warning commit 522a83abc36eb374d532a3db326ee1d3aab1d367 Merge: 699646e684aa8c 5aa81ab21de30b 0fc42d26467f2b 6e42454d90fa4e 887f655eab23ab Author: Stephen Boyd Date: Thu Apr 16 10:12:33 2026 -0700 Merge branches 'clk-tenstorrent', 'clk-rockchip', 'clk-imx' and 'clk-allwinner' into clk-next * clk-tenstorrent: clk: tenstorrent: Add Atlantis clock controller driver reset: tenstorrent: Add reset controller for Atlantis dt-bindings: clk: tenstorrent: Add tenstorrent,atlantis-prcm-rcpu * clk-rockchip: clk: rockchip: rk3568: Add PCIe pipe clock gates clk: rockchip: Add clock controller for the RV1103B dt-bindings: clock: rockchip: Add RV1103B CRU support * clk-imx: clk: imx8mq: Correct the CSI PHY sels clk: vf610: Add support for the Ethernet switch clocks dt-bindings: clock: vf610: Add definitions for MTIP L2 switch dt-bindings: clock: vf610: Drop VF610_CLK_END define clk: vf610: Move VF610_CLK_END define to clk-vf610 driver clk: imx: imx8-acm: fix flags for acm clocks clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() clk: imx: fracn-gppll: Add 477.4MHz support clk: imx: fracn-gppll: Add 333.333333 MHz support clk: imx: pll14xx: Use unsigned format specifier dt-bindings: clock: imx6q[ul]-clock: add optional clock enet[1]_ref_pad * clk-allwinner: clk: sunxi-ng: sun55i-a523-r: Add missing r-spi module clock commit 699646e684aa8ca8dca6ab68c4f5fff87d456790 Merge: cc8f74d3011e02 98266d5f940a25 672299736af6c3 858f6273cf003e d8b034525fd954 Author: Stephen Boyd Date: Thu Apr 16 10:07:47 2026 -0700 Merge branches 'clk-fixes', 'clk-renesas', 'clk-rpi', 'clk-eswin' and 'clk-mediatek' into clk-next - ESWIN eic700 SoC clk support - Econet EN751221 SoC clock/reset support * clk-fixes: clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc() clk: microchip: mpfs-ccc: fix out of bounds access during output registration clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source * clk-renesas: clk: renesas: Add support for RZ/G3L SoC dt-bindings: clock: renesas,rzg2l-cpg: Document RZ/G3L SoC clk: renesas: rzg2l: Re-enable critical module clocks during resume clk: renesas: rzg2l: Add rzg2l_mod_clock_init_mstop_helper() clk: renesas: rzg2l: Add helper for mod clock enable/disable clk: renesas: r9a0{7g04[34],8g045}: Add critical reset entries clk: renesas: rzg2l: Add support for critical resets clk: renesas: r9a09g056: Remove entries for WDT{0,2,3} clk: renesas: r9a06g032: Enable watchdog reset sources clk: renesas: cpg-mssr: Use struct_size() helper clk: renesas: r9a09g047: Add PCIe clocks and reset clk: renesas: r9a09g057: Add PCIe clocks and reset clk: renesas: r9a09g056: Add PCIe clocks and reset clk: renesas: r9a09g047: Add entries for the RSPIs clk: renesas: r9a09g056: Add clock and reset entries for RTC clk: renesas: r9a09g057: Remove entries for WDT{0,2,3} clk: renesas: r9a09g056: Fix ordering of module clocks array clk: renesas: r9a09g057: Fix ordering of module clocks array * clk-rpi: clk: bcm: rpi: Manage clock rate in prepare/unprepare callbacks * clk-eswin: MAINTAINERS: Add entry for ESWIN EIC7700 clock driver clk: eswin: Add eic7700 clock driver clk: divider: Add devm_clk_hw_register_divider_parent_data dt-bindings: clock: eswin: Documentation for eic7700 SoC * clk-mediatek: clk: airoha: Add econet EN751221 clock/reset support to en7523-scu dt-bindings: clock, reset: Add econet EN751221 commit 3cd8b194bf3428dfa53120fee47e827a7c495815 Merge: d3d9443f8bac79 d09a040c186a20 Author: Linus Torvalds Date: Thu Apr 16 08:25:04 2026 -0700 Merge tag 'v7.1-rc-part1-smbdirect-fixes' of git://git.samba.org/ksmbd Pull smbdirect updates from Steve French: "Move smbdirect server and client code to common directory: - temporary use of smbdirect_all_c_files.c to allow micro steps - factor out common functions into a smbdirect.ko. - convert cifs.ko to use smbdirect.ko - convert ksmbd.ko to use smbdirect.ko - let smbdirect.ko use global workqueues - move ib_client logic from ksmbd.ko into smbdirect.ko - remove smbdirect_all_c_files.c hack again - some locking and teardown related fixes on top" * tag 'v7.1-rc-part1-smbdirect-fixes' of git://git.samba.org/ksmbd: (145 commits) smb: smbdirect: let smbdirect_connection_deregister_mr_io unlock while waiting smb: smbdirect: fix the logic in smbdirect_socket_destroy_sync() without an error smb: smbdirect: fix copyright header of smbdirect.h smb: smbdirect: change smbdirect_socket_parameters.{initiator_depth,responder_resources} to __u16 smb: smbdirect: remove unused SMBDIRECT_USE_INLINE_C_FILES logic smb: server: no longer use smbdirect_socket_set_custom_workqueue() smb: client: no longer use smbdirect_socket_set_custom_workqueue() smb: smbdirect: introduce global workqueues smb: smbdirect: prepare use of dedicated workqueues for different steps smb: smbdirect: remove unused smbdirect_connection_mr_io_recovery_work() smb: smbdirect: wrap rdma_disconnect() in rdma_[un]lock_handler() smb: server: make use of smbdirect_netdev_rdma_capable_mode_type() smb: smbdirect: introduce smbdirect_netdev_rdma_capable_mode_type() smb: server: make use of smbdirect.ko smb: server: remove unused ksmbd_transport_ops.prepare() smb: server: make use of smbdirect_socket_{listen,accept}() smb: server: only use public smbdirect functions smb: server: make use of smbdirect_socket_create_accepting()/smbdirect_socket_release() smb: server: make use of smbdirect_{socket_init_accepting,connection_wait_for_connected}() smb: server: make use of smbdirect_connection_send_iter() and related functions ... commit d3d9443f8bac799340bb04db51ef4ababc4f7267 Merge: 090748e62f57a8 448c0f8cb7cdf2 Author: Linus Torvalds Date: Thu Apr 16 08:13:27 2026 -0700 Merge tag 'livepatching-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching updates from Petr Mladek: - Add two new selftests * tag 'livepatching-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: selftests/livepatch: add test for module function patching selftests: livepatch: test-ftrace: livepatch a traced function commit 090748e62f57a80286b2fcc32fe2be069f891200 Merge: 948ef73f7ec396 56f295853f38d3 Author: Linus Torvalds Date: Thu Apr 16 08:11:01 2026 -0700 Merge tag 'm68k-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - Add support for QEMU virt-ctrl, and use it for system reset and power off on the virt platform - defconfig updates - Miscellaneous fixes and improvements * tag 'm68k-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: virt: Switch to qemu-virt-ctrl driver power: reset: Add QEMU virt-ctrl driver m68k: defconfig: Update defconfigs for v7.0-rc1 m68k: emu: Replace unbounded sprintf() in nfhd_init_one() m68k: uapi: Add ucontext.h m68k: defconfig: hp300: Enable monochrome and 16-color linux logos m68k: q40: Remove commented out code commit 948ef73f7ec39622ebd27bba4e94d78a983109f6 Merge: f0bf3eac92b2be 48a42821578232 Author: Linus Torvalds Date: Thu Apr 16 08:06:25 2026 -0700 Merge tag 'efi-next-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: "Again not a busy cycle for EFI, just some minor tweaks and bug fixes: - Enable boot graphics resource table (BGRT) on Xen/x86 - Correct a misguided assumption in the memory attributes table sanity check - Start tagging efi_mem_reserve()'d regions as MEMBLOCK_RSRV_KERN - Some other minor fixes and cleanups" * tag 'efi-next-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/capsule-loader: fix incorrect sizeof in phys array reallocation efi: Tag memblock reservations of boot services regions as RSRV_KERN memblock: Permit existing reserved regions to be marked RSRV_KERN efi/memattr: Fix thinko in table size sanity check efi: libstub: fix type of fdt 32 and 64bit variables efi: Drop unused efi_range_is_wc() function efi: Enable BGRT loading under Xen efi: make efi_mem_type() and efi_mem_attributes() work on Xen PV commit f0bf3eac92b2be5f34b944cb82f1c23db642c7f5 Merge: 1d51b370a0f8f6 493c7eff3c2ffa Author: Linus Torvalds Date: Thu Apr 16 08:01:16 2026 -0700 Merge tag 'vfio-v7.1-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Update QAT vfio-pci variant driver for Gen 5, 420xx devices (Vijay Sundar Selvamani, Suman Kumar Chakraborty, Giovanni Cabiddu) - Fix vfio selftest MMIO DMA mapping selftest (Alex Mastro) - Conversions to const struct class in support of class_create() deprecation (Jori Koolstra) - Improve selftest compiler compatibility by avoiding initializer on variable-length array (Manish Honap) - Define new uAPI for drivers supporting migration to advise user- space of new initial data for reducing target startup latency. Implemented for mlx5 vfio-pci variant driver (Yishai Hadas) - Enable vfio selftests on aarch64, not just cross-compiles reporting arm64 (Ted Logan) - Update vfio selftest driver support to include additional DSA devices (Yi Lai) - Unconditionally include debugfs root pointer in vfio device struct, avoiding a build failure seen in hisi_acc variant driver without debugfs otherwise (Arnd Bergmann) - Add support for the s390 ISM (Internal Shared Memory) device via a new variant driver. The device is unique in the size of its BAR space (256TiB) and lack of mmap support (Julian Ruess) - Enforce that vfio-pci drivers implement a name in their ops structure for use in sequestering SR-IOV VFs (Alex Williamson) - Prune leftover group notifier code (Paolo Bonzini) - Fix Xe vfio-pci variant driver to avoid migration support as a dependency in the reset path and missing release call (Michał Winiarski) * tag 'vfio-v7.1-rc1' of https://github.com/awilliam/linux-vfio: (23 commits) vfio/xe: Add a missing vfio_pci_core_release_dev() vfio/xe: Reorganize the init to decouple migration from reset vfio: remove dead notifier code vfio/pci: Require vfio_device_ops.name MAINTAINERS: add VFIO ISM PCI DRIVER section vfio/ism: Implement vfio_pci driver for ISM devices vfio/pci: Rename vfio_config_do_rw() to vfio_pci_config_rw_single() and export it vfio: unhide vdev->debug_root vfio/qat: add support for Intel QAT 420xx VFs vfio: selftests: Support DMR and GNR-D DSA devices vfio: selftests: Build tests on aarch64 vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO vfio/mlx5: consider inflight SAVE during PRE_COPY net/mlx5: Add IFC bits for migration state vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set() vfio: uapi: fix comment typo vfio: mdev: replace mtty_dev->vd_class with a const struct class ... commit 51942b77f443ac3f1b4628c2f5f7dea8a7fe654f Author: Felix Gu Date: Thu Apr 16 21:00:08 2026 +0800 spi: mtk-snfi: fix memory leak in probe ms->buf is allocated in mtk_snand_setup_pagefmt() but was not freed on the following error paths. Fixes: 2b1e19811a8e ("spi: mtk-snfi: Change default page format to setup default setting") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260416-mtk-snfi-v2-1-3f487689dacb@gmail.com Signed-off-by: Mark Brown commit 6bf7969a145e13a3390143038fe82c52025aeb93 Author: Melissa Wen Date: Wed Mar 18 13:27:11 2026 -0300 drm/drm_atomic: duplicate colorop states if plane color pipeline in use For suspend/resume to work correctly, do for colorop state the same we do for plane/crtc/connector states: duplicate the state of colorops in a color pipeline if it's in use by a given plane when suspending and restore cached colorop states when resuming. While at it, prevent unused-variable warning when using for_each_new_colorop_in_stage here. Fixes: 2afc3184f3b3 ("drm/plane: Add COLOR PIPELINE property") Reviewed-by: Harry Wentland Reviewed-by: Alex Hung Reviewed-by: Chaitanya Kumar Borah Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260318163629.300627-1-mwen@igalia.com Signed-off-by: Melissa Wen commit 4245bf4dc58f58b7042c29d7b04d4e403a0379bc Author: Tomas Glozar Date: Thu Apr 16 13:59:42 2026 +0200 tracing/osnoise: Add option to align tlat threads Add an option called TIMERLAT_ALIGN to osnoise/options, together with a corresponding setting osnoise/timerlat_align_us. This option sets the alignment of wakeup times between different timerlat threads, similarly to cyclictest's -A/--aligned option. If TIMERLAT_ALIGN is set, the first thread that reaches the first cycle records its first wake-up time. Each following thread sets its first wake-up time to a fixed offset from the recorded time, and increments it by the same offset. Example: osnoise/timerlat_period is set to 1000, osnoise/timerlat_align_us is set to 20. There are four threads, on CPUs 1 to 4. - CPU 4 enters first cycle first. The current time is 20000us, so the wake-up of the first cycle is set to 21000us. This time is recorded. - CPU 2 enter first cycle next. It reads the recorded time, increments it to 21020us, and uses this value as its own wake-up time for the first cycle. - CPU 3 enters first cycle next. It reads the recorded time, increments it to 21040 us, and uses the value as its own wake-up time. - CPU 1 proceeds analogically. In each next cycle, the wake-up time (called "absolute period" in timerlat code) is incremented by the (relative) period of 1000us. Thus, the wake-ups in the following cycles (provided the times are reached and not in the past) will be as follows: CPU 1 CPU 2 CPU 3 CPU 4 21080us 21020us 21040us 21000us 22080us 22020us 22040us 22000us ... ... ... ... Even if any cycle is skipped due to e.g. the first cycle calculation happening later, the alignment stays in place. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: John Kacur Cc: Luis Goncalves Cc: Costa Shulyupin Link: https://patch.msgid.link/20260416115942.544032-1-tglozar@redhat.com Signed-off-by: Tomas Glozar Reviewed-by: Wander Lairson Costa Reviewed-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit e5f635edd393aeaa7cad9e42831d397e6e2e1eed Author: Daniel Borkmann Date: Thu Apr 16 14:27:19 2026 +0200 bpf: Fix precedence bug in convert_bpf_ld_abs alignment check Fix an operator precedence issue in convert_bpf_ld_abs() where the expression offset + ip_align % size evaluates as offset + (ip_align % size) due to % having higher precedence than +. That latter evaluation does not make any sense. The intended check is (offset + ip_align) % size == 0 to verify that the packet load offset is properly aligned for direct access. With NET_IP_ALIGN == 2, the bug causes the inline fast-path for direct packet loads to almost never be taken on !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS platforms. This forces nearly all cBPF BPF_LD_ABS packet loads through the bpf_skb_load_helper slow path on the affected archs. Fixes: e0cea7ce988c ("bpf: implement ld_abs/ld_ind in native bpf") Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260416122719.661033-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 1cedfe17badeebdcc044855713597ac7db58414a Merge: a20446652956ed f6606a44bc438e Author: Alexei Starovoitov Date: Thu Apr 16 07:03:41 2026 -0700 Merge branch 'emit-endbr-bti-instructions-for-indirect' Xu Kuohai says: ==================== emit ENDBR/BTI instructions for indirect On architectures with CFI protection enabled that require landing pad instructions at indirect jump targets, such as x86 with CET/IBT enabled and arm64 with BTI enabled, kernel panics when an indirect jump lands on a target without landing pad. Therefore, the JIT must emit landing pad instructions for indirect jump targets. The verifier already recognizes which instructions are indirect jump targets during the verification phase. So we can store this information in env->insn_aux_data and pass it to the JIT as new parameter, allowing the JIT to consult env->insn_aux_data to determine which instructions are indirect jump targets. During JIT, constants blinding is performed. It rewrites the private copy of instructions for the JITed program, but it does not adjust the global env->insn_aux_data array. As a result, after constants blinding, the instruction indexes used by JIT may no longer match the indexes in env->insn_aux_data, so the JIT can not use env->insn_aux_data directly. To avoid this mismatch, and given that all existing arch-specific JITs already implement constants blinding with largely duplicated code, move constants blinding from JIT to generic code. v15: - Rebase and target bpf tree - Resotre subprog_start of the fake 'exit' subprog on failure - Fix wrong function name used in comment v14: https://lore.kernel.org/all/cover.1776062885.git.xukuohai@hotmail.com/ - Rebase - Fix comment style - Fix incorrect variable and function name used in commit message v13: https://lore.kernel.org/bpf/20260411133847.1042658-1-xukuohai@huaweicloud.com - Use vmalloc to allocate memory for insn_aux_data copies to match with vfree - Do not free the copied memory of insn_aux_data when restoring from failure - Code cleanup v12: https://lore.kernel.org/bpf/20260403132811.753894-1-xukuohai@huaweicloud.com - Restore env->insn_aux_data on JIT failure - Fix incorrect error code sign (-EFAULT vs EFAULT) - Fix incorrect prog used in the restore path v11: https://lore.kernel.org/bpf/20260403090915.473493-1-xukuohai@huaweicloud.com - Restore env->subprog_info after jit_subprogs() fails - Clear prog->jit_requested and prog->blinding_requested on failure - Use the actual env->insn_aux_data size in clear_insn_aux_data() on failure v10: https://lore.kernel.org/bpf/20260324122052.342751-1-xukuohai@huaweicloud.com - Fix the incorrect call_imm restore in jit_subprogs - Define a dummy void version of bpf_jit_prog_release_other and bpf_patch_insn_data when the corresponding config is not set - Remove the unnecessary #ifdef in x86_64 JIT (Leon Hwang) v9: https://lore.kernel.org/bpf/20260312170255.3427799-1-xukuohai@huaweicloud.com - Make constant blinding available for classic bpf (Eduard) - Clear prog->bpf_func, prog->jited ... on the error path of extra pass (Eduard) - Fix spelling errors and remove unused parameter (Anton Protopopov) v8: https://lore.kernel.org/bpf/20260309140044.2652538-1-xukuohai@huaweicloud.com - Define void bpf_jit_blind_constants() function when CONFIG_BPF_JIT is not set - Move indirect_target fixup for insn patching from bpf_jit_blind_constants() to adjust_insn_aux_data() v7: https://lore.kernel.org/bpf/20260307103949.2340104-1-xukuohai@huaweicloud.com - Move constants blinding logic back to bpf/core.c - Compute ip address before switch statement in x86 JIT - Clear JIT state from error path on arm64 and loongarch v6: https://lore.kernel.org/bpf/20260306102329.2056216-1-xukuohai@huaweicloud.com - Move constants blinding from JIT to verifier - Move call to bpf_prog_select_runtime from bpf_prog_load to verifier v5: https://lore.kernel.org/bpf/20260302102726.1126019-1-xukuohai@huaweicloud.com - Switch to pass env to JIT directly to get rid of copying private insn_aux_data for each prog v4: https://lore.kernel.org/all/20260114093914.2403982-1-xukuohai@huaweicloud.com - Switch to the approach proposed by Eduard, using insn_aux_data to identify indirect jump targets, and emit ENDBR on x86 v3: https://lore.kernel.org/bpf/20251227081033.240336-1-xukuohai@huaweicloud.com - Get rid of unnecessary enum definition (Yonghong Song, Anton Protopopov) v2: https://lore.kernel.org/bpf/20251223085447.139301-1-xukuohai@huaweicloud.com - Exclude instruction arrays not used for indirect jumps (Anton Protopopov) v1: https://lore.kernel.org/bpf/20251127140318.3944249-1-xukuohai@huaweicloud.com ==================== Link: https://patch.msgid.link/20260416064341.151802-1-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov commit f6606a44bc438ec5f1d450d0153878e80e79ff80 Author: Xu Kuohai Date: Thu Apr 16 06:43:41 2026 +0000 bpf, arm64: Emit BTI for indirect jump target On CPUs that support BTI, the indirect jump selftest triggers a kernel panic because there is no BTI instructions at the indirect jump targets. Fix it by emitting a BTI instruction for each indirect jump target. For reference, below is a sample panic log. Internal error: Oops - BTI: 0000000036000003 [#1] SMP ... Call trace: bpf_prog_2e5f1c71c13ac3e0_big_jump_table+0x54/0xf8 (P) bpf_prog_run_pin_on_cpu+0x140/0x468 bpf_prog_test_run_syscall+0x280/0x3b8 bpf_prog_test_run+0x22c/0x2c0 Fixes: f4a66cf1cb14 ("bpf: arm64: Add support for indirect jumps") Reviewed-by: Anton Protopopov # v8 Reviewed-by: Emil Tsalapatis # v12 Acked-by: Leon Hwang Signed-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20260416064341.151802-6-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 9a0e89dcc9be8e0ba20aeb81c330a6352261667e Author: Xu Kuohai Date: Thu Apr 16 06:43:40 2026 +0000 bpf, x86: Emit ENDBR for indirect jump targets On CPUs that support CET/IBT, the indirect jump selftest triggers a kernel panic because the indirect jump targets lack ENDBR instructions. To fix it, emit an ENDBR instruction to each indirect jump target. Since the ENDBR instruction shifts the position of original jited instructions, fix the instruction address calculation wherever the addresses are used. For reference, below is a sample panic log. Missing ENDBR: bpf_prog_2e5f1c71c13ac3e0_big_jump_table+0x97/0xe1 ------------[ cut here ]------------ kernel BUG at arch/x86/kernel/cet.c:133! Oops: invalid opcode: 0000 [#1] SMP NOPTI ... ? 0xffffffffc00fb258 ? bpf_prog_2e5f1c71c13ac3e0_big_jump_table+0x97/0xe1 bpf_prog_test_run_syscall+0x110/0x2f0 ? fdget+0xba/0xe0 __sys_bpf+0xe4b/0x2590 ? __kmalloc_node_track_caller_noprof+0x1c7/0x680 ? bpf_prog_test_run_syscall+0x215/0x2f0 __x64_sys_bpf+0x21/0x30 do_syscall_64+0x85/0x620 ? bpf_prog_test_run_syscall+0x1e2/0x2f0 Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps") Reviewed-by: Anton Protopopov # v8 Reviewed-by: Emil Tsalapatis # v12 Acked-by: Leon Hwang Signed-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20260416064341.151802-5-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 07ae6c130b46cf5e3e1a7dc5c1889fefe9adc2d3 Author: Xu Kuohai Date: Thu Apr 16 06:43:39 2026 +0000 bpf: Add helper to detect indirect jump targets Introduce helper bpf_insn_is_indirect_target to check whether a BPF instruction is an indirect jump target. Since the verifier knows which instructions are indirect jump targets, add a new flag indirect_target to struct bpf_insn_aux_data to mark them. The verifier sets this flag when verifying an indirect jump target instruction, and the helper checks the flag to determine whether an instruction is an indirect jump target. Reviewed-by: Anton Protopopov #v8 Reviewed-by: Emil Tsalapatis #v12 Signed-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20260416064341.151802-4-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov commit d9ef13f72711f2dad64cd4445472ded98fb6c954 Author: Xu Kuohai Date: Thu Apr 16 06:43:38 2026 +0000 bpf: Pass bpf_verifier_env to JIT Pass bpf_verifier_env to bpf_int_jit_compile(). The follow-up patch will use env->insn_aux_data in the JIT stage to detect indirect jump targets. Since bpf_prog_select_runtime() can be called by cbpf and lib/test_bpf.c code without verifier, introduce helper __bpf_prog_select_runtime() to accept the env parameter. Remove the call to bpf_prog_select_runtime() in bpf_prog_load(), and switch to call __bpf_prog_select_runtime() in the verifier, with env variable passed. The original bpf_prog_select_runtime() is preserved for cbpf and lib/test_bpf.c, where env is NULL. Now all constants blinding calls are moved into the verifier, except the cbpf and lib/test_bpf.c cases. The instructions arrays are adjusted by bpf_patch_insn_data() function for normal cases, so there is no need to call adjust_insn_arrays() in bpf_jit_blind_constants(). Remove it. Reviewed-by: Anton Protopopov # v8 Reviewed-by: Emil Tsalapatis # v12 Acked-by: Hengqi Chen # v14 Signed-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20260416064341.151802-3-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov commit d3e945223e0158c85dbde23de4f89493a2a817f6 Author: Xu Kuohai Date: Thu Apr 16 06:43:37 2026 +0000 bpf: Move constants blinding out of arch-specific JITs During the JIT stage, constants blinding rewrites instructions but only rewrites the private instruction copy of the JITed subprog, leaving the global env->prog->insnsi and env->insn_aux_data untouched. This causes a mismatch between subprog instructions and the global state, making it difficult to use the global data in the JIT. To avoid this mismatch, and given that all arch-specific JITs already support constants blinding, move it to the generic verifier code, and switch to rewrite the global env->prog->insnsi with the global states adjusted, as other rewrites in the verifier do. This removes the constants blinding calls in each JIT, which are largely duplicated code across architectures. Since constants blinding is only required for JIT, and there are two JIT entry functions, jit_subprogs() for BPF programs with multiple subprogs and bpf_prog_select_runtime() for programs with no subprogs, move the constants blinding invocation into these two functions. In the verifier path, bpf_patch_insn_data() is used to keep global verifier auxiliary data in sync with patched instructions. A key question is whether this global auxiliary data should be restored on the failure path. Besides instructions, bpf_patch_insn_data() adjusts: - prog->aux->poke_tab - env->insn_array_maps - env->subprog_info - env->insn_aux_data For prog->aux->poke_tab, it is only used by JIT or only meaningful after JIT succeeds, so it does not need to be restored on the failure path. For env->insn_array_maps, when JIT fails, programs using insn arrays are rejected by bpf_insn_array_ready() due to missing JIT addresses. Hence, env->insn_array_maps is only meaningful for JIT and does not need to be restored. For subprog_info, if jit_subprogs fails and CONFIG_BPF_JIT_ALWAYS_ON is not enabled, kernel falls back to interpreter. In this case, env->subprog_info is used to determine subprogram stack depth. So it must be restored on failure. For env->insn_aux_data, it is freed by clear_insn_aux_data() at the end of bpf_check(). Before freeing, clear_insn_aux_data() loops over env->insn_aux_data to release jump targets recorded in it. The loop uses env->prog->len as the array length, but this length no longer matches the actual size of the adjusted env->insn_aux_data array after constants blinding. To address it, a simple approach is to keep insn_aux_data as adjusted after failure, since it will be freed shortly, and record its actual size for the loop in clear_insn_aux_data(). But since clear_insn_aux_data() uses the same index to loop over both env->prog->insnsi and env->insn_aux_data, this approach results in incorrect index for the insnsi array. So an alternative approach is adopted: clone the original env->insn_aux_data before blinding and restore it after failure, similar to env->prog. For classic BPF programs, constants blinding works as before since it is still invoked from bpf_prog_select_runtime(). Reviewed-by: Anton Protopopov # v8 Reviewed-by: Hari Bathini # powerpc jit Reviewed-by: Pu Lehui # riscv jit Acked-by: Hengqi Chen # loongarch jit Signed-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20260416064341.151802-2-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov commit a74c2e55ab66519ffa2069ac9ae83cd937bff4c4 Author: Paul Sajna Date: Mon Sep 15 19:32:14 2025 -0700 dt-bindings: display: panel: panel-simple: Add lg,sw49410 compatible LG SW49410 is the display panel used by sdm845-lg-judyln (LG G7 ThinQ). It supports all the same properties as panel-simple. Signed-off-by: Paul Sajna Acked-by: Conor Dooley Link: https://patch.msgid.link/20250915-judyln-panel-v2-3-01ab2199fea5@postmarketos.org Signed-off-by: Rob Herring (Arm) commit 52bcb57a4e8a0865a76c587c2451906342ae1b2d Author: Dudu Lu Date: Mon Apr 13 21:14:09 2026 +0800 vsock/virtio: fix accept queue count leak on transport mismatch virtio_transport_recv_listen() calls sk_acceptq_added() before vsock_assign_transport(). If vsock_assign_transport() fails or selects a different transport, the error path returns without calling sk_acceptq_removed(), permanently incrementing sk_ack_backlog. After approximately backlog+1 such failures, sk_acceptq_is_full() returns true, causing the listener to reject all new connections. Fix by moving sk_acceptq_added() to after the transport validation, matching the pattern used by vmci_transport and hyperv_transport. Fixes: c0cfa2d8a788 ("vsock: add multi-transports support") Signed-off-by: Dudu Lu Reviewed-by: Bobby Eshleman Reviewed-by: Luigi Leonardi Reviewed-by: Stefano Garzarella Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260413131409.19022-1-phx0fer@gmail.com Signed-off-by: Paolo Abeni commit c15bc1681045f158811643d6c990f87c590dd693 Author: Hsieh Hung-En Date: Wed Apr 15 11:02:52 2026 +0800 ASoC: es8311: Fix clock leak and check update_bits in set_bias_level() In es8311_set_bias_level(), the return value of snd_soc_component_update_bits() was ignored. If this fails, not only is the VMID selection not applied, but the previously enabled mclk is left running, leading to an unbalanced clock reference count (clock leak). Check the return value and ensure clk_disable_unprepare() is called on failure to maintain proper resource management. Signed-off-by: Hsieh Hung-En Link: https://patch.msgid.link/20260415030252.5547-3-hungen3108@gmail.com Signed-off-by: Mark Brown commit 37e9faf21670cf86d36eebc3b4d27afe6819983a Author: Hsieh Hung-En Date: Wed Apr 15 11:02:51 2026 +0800 ASoC: es8311: Check regcache_sync() error in resume The es8311_resume() function currently ignores the return value of regcache_sync(). If syncing the cache fails, the function still returns 0, leaving the codec in a potentially incorrect state. Check the return value and propagate it to the ASoC core to ensure resume failures are properly handled. Signed-off-by: Hsieh Hung-En Link: https://patch.msgid.link/20260415030252.5547-2-hungen3108@gmail.com Signed-off-by: Mark Brown commit 9c469240997584449cfac51a75d1d3d71968c76f Author: Swamil Jain Date: Wed Apr 15 16:34:09 2026 +0530 dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints The AM62L DSS [1] support incorrectly used the same register and clock constraints as AM65x, but AM62L has a single video port Fix this by adding conditional constraints that properly define the register regions and clocks for AM62L DSS (single video port) versus other AM65x variants (dual video port). [1]: Section 12.7 (Display Subsystem and Peripherals) Link : https://www.ti.com/lit/pdf/sprujb4 Fixes: cb8d4323302c ("dt-bindings: display: ti,am65x-dss: Add support for AM62L DSS") Cc: stable@vger.kernel.org Signed-off-by: Swamil Jain Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260415110409.2577633-1-s-jain1@ti.com Signed-off-by: Rob Herring (Arm) commit 2a62dd135311f8865ecb9bf09d87da40f2ab3fdb Author: Marek Vasut Date: Sat Apr 4 05:42:50 2026 +0200 dt-bindings: display: simple: Move Innolux G156HCE-L01 panel to dual-link The Innolux G156HCE-L01 15.6" 1920x1080 24bpp dual-link LVDS TFT panel is exactly that, dual-link LVDS panel. Move it into the correct schema, which is panel-simple-lvds-dual-ports.yaml. Fixes: 3c5e8aa44dfc ("dt-bindings: display: simple: Add Innolux G156HCE-L01 panel") Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260404034321.341210-2-marex@nabladev.com Signed-off-by: Rob Herring (Arm) commit bacf0b2bfa7a0532664e42aacf882a4a644f75d8 Author: Marek Vasut Date: Sat Apr 4 05:42:49 2026 +0200 dt-bindings: display: simple: Move AUO 21.5" FHD to dual-link AU Optronics Corporation 21.5" FHD (1920x1080) color TFT LCD panel is a dual-link LVDS panel. Move it into the correct schema, which is panel-simple-lvds-dual-ports.yaml. Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260404034321.341210-1-marex@nabladev.com Signed-off-by: Rob Herring (Arm) commit 5d0e969c4e6ab4c4693f7a4c381e30125106f73d Author: Rob Herring (Arm) Date: Fri Apr 10 17:17:53 2026 -0500 dt-bindings: thermal: Fix false warning with 'phandle' in trips nodes A pattern property matching essentially anything doesn't work if there are implicit properties such as 'phandle' which can occur on any node. One such example popped up recently: arch/arm64/boot/dts/qcom/sm8650-hdk.dtb: thermal-zones: gpuss0-thermal:trips:phandle: 531 is not of type 'object' from schema $id: http://devicetree.org/schemas/thermal/thermal-zones.yaml Instead of a pattern property, use an "additionalProperties" schema instead which is the fallback in case of no matching property. Link: https://patch.msgid.link/20260410223601.1487473-2-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 07fd339b2c253205794bea5d9b4b7548a4546c56 Author: Wentao Liang Date: Thu Apr 9 03:48:59 2026 +0000 of: unittest: fix use-after-free in testdrv_probe() The function testdrv_probe() retrieves the device_node from the PCI device, applies an overlay, and then immediately calls of_node_put(dn). This releases the reference held by the PCI core, potentially freeing the node if the reference count drops to zero. Later, the same freed pointer 'dn' is passed to of_platform_default_populate(), leading to a use-after-free. The reference to pdev->dev.of_node is owned by the device model and should not be released by the driver. Remove the erroneous of_node_put() to prevent premature freeing. Fixes: 26409dd04589 ("of: unittest: Add pci_dt_testdrv pci driver") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Link: https://patch.msgid.link/20260409034859.429071-1-vulab@iscas.ac.cn Signed-off-by: Rob Herring (Arm) commit faecdd423c27f0d6090156a435ba9dbbac0eaddb Author: Wentao Liang Date: Thu Apr 9 02:22:33 2026 +0000 of: unittest: fix use-after-free in of_unittest_changeset() The variable 'parent' is assigned the value of 'nchangeset' earlier in the function, meaning both point to the same struct device_node. The call to of_node_put(nchangeset) can decrement the reference count to zero and free the node if there are no other holders. After that, the code still uses 'parent' to check for the presence of a property and to read a string property, leading to a use-after-free. Fix this by moving the of_node_put() call after the last access to 'parent', avoiding the UAF. Fixes: 1c668ea65506 ("of: unittest: Use of_property_present()") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Link: https://patch.msgid.link/20260409022233.418103-1-vulab@iscas.ac.cn Signed-off-by: Rob Herring (Arm) commit 104f082f5ed6d19c5d85ca905ccd4e4d01aef66e Author: Jiayuan Chen Date: Mon Apr 13 19:45:20 2026 +0800 selftests: fib_nexthops: test stale has_v4 on nexthop replace Add test cases that exercise the scenario where an IPv6 nexthop is replaced with an IPv4 nexthop while being part of a group. The group's has_v4 flag must be updated so that subsequent IPv6 route additions are properly rejected. Two cases are covered: 1. Gateway nexthop replaced across families with an existing IPv6 route on the group (rejected by fib6_check_nh_list). 2. Blackhole nexthop replaced across families with no existing IPv6 route on the group (fib6_check_nh_list returns early) — this is the path that triggers a NULL ptr deref without the kernel fix. Signed-off-by: Jiayuan Chen Reviewed-by: David Ahern Link: https://patch.msgid.link/20260413114522.147784-2-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 29c95185ba32b621fbc3800fb86e7dc3edf5c2be Author: Jiayuan Chen Date: Mon Apr 13 19:45:19 2026 +0800 nexthop: fix IPv6 route referencing IPv4 nexthop syzbot reported a panic [1] [2]. When an IPv6 nexthop is replaced with an IPv4 nexthop, the has_v4 flag of all groups containing this nexthop is not updated. This is because nh_group_v4_update is only called when replacing AF_INET to AF_INET6, but the reverse direction (AF_INET6 to AF_INET) is missed. This allows a stale has_v4=false to bypass fib6_check_nexthop, causing IPv6 routes to be attached to groups that effectively contain only AF_INET members. Subsequent route lookups then call nexthop_fib6_nh() which returns NULL for the AF_INET member, leading to a NULL pointer dereference. Fix by calling nh_group_v4_update whenever the family changes, not just AF_INET to AF_INET6. Reproducer: # AF_INET6 blackhole ip -6 nexthop add id 1 blackhole # group with has_v4=false ip nexthop add id 100 group 1 # replace with AF_INET (no -6), has_v4 stays false ip nexthop replace id 1 blackhole # pass stale has_v4 check ip -6 route add 2001:db8::/64 nhid 100 # panic ping -6 2001:db8::1 [1] https://syzkaller.appspot.com/bug?id=e17283eb2f8dcf3dd9b47fe6f67a95f71faadad0 [2] https://syzkaller.appspot.com/bug?id=8699b6ae54c9f35837d925686208402949e12ef3 Fixes: 7bf4796dd099 ("nexthops: add support for replace") Signed-off-by: Jiayuan Chen Reviewed-by: David Ahern Link: https://patch.msgid.link/20260413114522.147784-1-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 7746e3bd4cc19b5092e00d32d676e329bfcb6900 Author: Miklos Szeredi Date: Fri Apr 10 16:49:47 2026 +0200 fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached marks that are not in the current group. CC: stable@vger.kernel.org Fixes: abc77577a669 ("fsnotify: Provide framework for dropping SRCU lock in ->handle_event") Signed-off-by: Miklos Szeredi Link: https://patch.msgid.link/20260410144950.156160-1-mszeredi@redhat.com Signed-off-by: Jan Kara commit f9e40664706927d7ae22a448a3383e23c38a4c0b Author: Dudu Lu Date: Mon Apr 13 19:00:41 2026 +0800 net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys cake_update_flowkeys() is supposed to update the flow dissector keys with the NAT-translated addresses and ports from conntrack, so that CAKE's per-flow fairness correctly identifies post-NAT flows as belonging to the same connection. For the source port, this works correctly: keys->ports.src = port; But for the destination port, the assignment is reversed: port = keys->ports.dst; This means the NAT destination port is never updated in the flow keys. As a result, when multiple connections are NATed to the same destination, CAKE treats them as separate flows because the original (pre-NAT) destination ports differ. This breaks CAKE's NAT-aware flow isolation when using the "nat" mode. The bug was introduced in commit b0c19ed6088a ("sch_cake: Take advantage of skb->hash where appropriate") which refactored the original direct assignment into a compare-and-conditionally-update pattern, but wrote the destination port update backwards. Fix by reversing the assignment direction to match the source port pattern. Fixes: b0c19ed6088a ("sch_cake: Take advantage of skb->hash where appropriate") Signed-off-by: Dudu Lu Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260413110041.44704-1-phx0fer@gmail.com Signed-off-by: Paolo Abeni commit df4601653201de21b487c3e7fffd464790cab808 Author: Zhengchuan Liang Date: Mon Apr 13 17:08:46 2026 +0800 net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to another port or to `NULL` while keeping the entry alive. Several bridge RCU readers inspect `f->dst`, including `br_fdb_fillbuf()` through the `brforward_read()` sysfs path. These readers currently load `f->dst` multiple times and can therefore observe inconsistent values across the check and later dereference. In `br_fdb_fillbuf()`, this means a concurrent local-FDB update can change `f->dst` after the NULL check and before the `port_no` dereference, leading to a NULL-ptr-deref. Fix this by taking a single `READ_ONCE()` snapshot of `f->dst` in each affected RCU reader and using that snapshot for the rest of the access sequence. Also publish the in-place `f->dst` updates in `fdb_delete_local()` with `WRITE_ONCE()` so the readers and writer use matching access patterns. Fixes: 960b589f86c7 ("bridge: Properly check if local fdb entry can be deleted in br_fdb_change_mac_address") Cc: stable@kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Ren Wei Signed-off-by: Zhengchuan Liang Signed-off-by: Ren Wei Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/6570fabb85ecadb8baaf019efe856f407711c7b9.1776043229.git.zcliangcn@gmail.com Signed-off-by: Paolo Abeni commit fa92a77b0ed4d5f11a71665a232ac5a54a4b055d Author: Dudu Lu Date: Mon Apr 13 16:53:49 2026 +0800 macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF macvlan_get_size() does not account for IFLA_MACVLAN_BC_CUTOFF, but macvlan_fill_info() conditionally includes it when port->bc_cutoff != 1. This causes nla_put_s32() to fail with -EMSGSIZE when the netlink skb runs out of space, triggering a WARN_ON in rtnetlink and preventing the interface from being dumped. The bug can be reproduced with: ip link add macvlan0 link eth0 type macvlan mode bridge ip link set macvlan0 type macvlan bc_cutoff 0 ip -d link show macvlan0 # fails with -EMSGSIZE The bc_cutoff feature was added in commit 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff"), which added the nla_put_s32() call in macvlan_fill_info() but missed adding the corresponding nla_total_size(4) in macvlan_get_size(). A follow-up commit 55cef78c244d ("macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF") fixed the missing nla_policy entry but still did not fix the size calculation. Fixes: 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff") Signed-off-by: Dudu Lu Reviewed-by: Vadim Fedorenko Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260413085349.73977-1-phx0fer@gmail.com Signed-off-by: Paolo Abeni commit a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4 Author: Paul Moses Date: Wed Apr 1 03:07:49 2026 -0500 crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV buffer while RFC3686 skciphers expose an 8-byte IV, so the restore overruns the provided buffer. Use crypto_skcipher_ivsize() to copy only the algorithm's IV length. Fixes: 2b789435d7f3 ("crypto: ccp - CCP AES crypto API support") Signed-off-by: Paul Moses Reviewed-by: Tom Lendacky Signed-off-by: Herbert Xu commit 4f685dbfa87c546e51d9dc6cab379d20f275e114 Author: Sean Christopherson Date: Fri Mar 13 10:57:31 2026 -0700 crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed When retrieving the ID for the CPU, don't attempt to copy the ID blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388 CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 Call Trace: dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 copy_to_user ../include/linux/uaccess.h:236 [inline] sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222 sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575 vfs_ioctl ../fs/ioctl.c:51 [inline] __do_sys_ioctl ../fs/ioctl.c:597 [inline] __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e WARN if the driver says the command succeeded, but the firmware error code says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any firwmware error. Reported-by: Alexander Potapenko Reported-by: Sebastian Alba Vives Fixes: d6112ea0cb34 ("crypto: ccp - introduce SEV_GET_ID2 command") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Herbert Xu commit e76239fed3cffd6d304d8ca3ce23984fd24f57d3 Author: Sean Christopherson Date: Fri Mar 13 10:48:53 2026 -0700 crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed When retrieving the PDH cert, don't attempt to copy the blobs to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033 CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025 Call Trace: dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 copy_to_user ../include/linux/uaccess.h:236 [inline] sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347 sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568 vfs_ioctl ../fs/ioctl.c:51 [inline] __do_sys_ioctl ../fs/ioctl.c:597 [inline] __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e WARN if the driver says the command succeeded, but the firmware error code says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any firwmware error. Reported-by: Alexander Potapenko Reported-by: Sebastian Alba Vives Fixes: 76a2b524a4b1 ("crypto: ccp: Implement SEV_PDH_CERT_EXPORT ioctl command") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Herbert Xu commit abe4a6d6f606113251868c2c4a06ba904bb41eed Author: Sean Christopherson Date: Fri Mar 13 10:43:16 2026 -0700 crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed When retrieving the PEK CSR, don't attempt to copy the blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e. the userspace buffer+length was too small, copying the number of bytes _firmware_ requires will overflow the kernel-allocated buffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405 CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 Call Trace: dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 copy_to_user ../include/linux/uaccess.h:236 [inline] sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872 sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562 vfs_ioctl ../fs/ioctl.c:51 [inline] __do_sys_ioctl ../fs/ioctl.c:597 [inline] __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e WARN if the driver says the command succeeded, but the firmware error code says otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any firwmware error. Reported-by: Alexander Potapenko Reported-by: Sebastian Alba Vives Fixes: e799035609e1 ("crypto: ccp: Implement SEV_PEK_CSR ioctl command") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Herbert Xu commit 915b692e6cb723aac658c25eb82c58fd81235110 Author: Herbert Xu Date: Thu Apr 16 17:00:50 2026 +0800 crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications. Reported-by: Yiming Qian Fixes: 5a1436beec57 ("crypto: pcrypt - call the complete function on error") Signed-off-by: Herbert Xu commit 8451ab6ad686ffdcdf9ddadaa446a79ab48e5590 Author: T Pratham Date: Wed Apr 15 20:06:58 2026 +0530 crypto: sa2ul - Fix AEAD fallback algorithm names For authenc AEAD algorithms, sa2ul is trying to register very specific -ce version as a fallback. This causes registration failure on SoCs which do not have ARMv8-CE enabled/available. Change the fallback algorithm from the specific driver name to generic algorithm name so that the kernel can allocate any available fallback. Fixes: d2c8ac187fc92 ("crypto: sa2ul - Add AEAD algorithm support") Signed-off-by: T Pratham Reviewed-by: Manorit Chawdhry Signed-off-by: Herbert Xu commit 1f48ad3b19a9dfc947868edda0bb8e48e5b5a8fa Author: Herbert Xu Date: Wed Apr 15 07:39:06 2026 +0800 crypto: authencesn - Fix src offset when decrypting in-place The src SG list offset wasn't set properly when decrypting in-place, fix it. Reported-by: Wolfgang Walter Fixes: e02494114ebf ("crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption") Signed-off-by: Herbert Xu commit 3ba3b02f897b14e34977e1886d95ffe64d907204 Author: Aleksander Jan Bajkowski Date: Sat Apr 11 23:08:17 2026 +0200 crypto: eip93 - fix hmac setkey algo selection eip93_hmac_setkey() allocates a temporary ahash transform for computing HMAC ipad/opad key material. The allocation uses the driver-specific cra_driver_name (e.g. "sha256-eip93") but passes CRYPTO_ALG_ASYNC as the mask, which excludes async algorithms. Since the EIP93 hash algorithms are the only ones registered under those driver names and they are inherently async, the lookup is self-contradictory and always fails with -ENOENT. When called from the AEAD setkey path, this failure leaves the SA record partially initialized with zeroed digest fields. A subsequent crypto operation then dereferences a NULL pointer in the request context, resulting in a kernel panic: ``` pc : eip93_aead_handle_result+0xc8c/0x1240 [crypto_hw_eip93] lr : eip93_aead_handle_result+0xbec/0x1240 [crypto_hw_eip93] sp : ffffffc082feb820 x29: ffffffc082feb820 x28: ffffff8011043980 x27: 0000000000000000 x26: 0000000000000000 x25: ffffffc078da0bc8 x24: 0000000091043980 x23: ffffff8004d59e50 x22: ffffff8004d59410 x21: ffffff8004d593c0 x20: ffffff8004d593c0 x19: ffffff8004d4f300 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000007fda7aa498 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: fffffffff8127a80 x9 : 0000000000000000 x8 : ffffff8004d4f380 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : 0000000000000008 x3 : 0000000000000009 x2 : 0000000000000008 x1 : 0000000028000003 x0 : ffffff8004d388c0 Code: 910142b6 f94012e0 f9002aa0 f90006d3 (f9400740) ``` The reported symbol eip93_aead_handle_result+0xc8c is a resolution artifact from static functions being merged under the nearest exported symbol. Decoding the faulting sequence: ``` 910142b6 ADD X22, X21, #0x50 f94012e0 LDR X0, [X23, #0x20] f9002aa0 STR X0, [X21, #0x50] f90006d3 STR X19, [X22, #0x8] f9400740 LDR X0, [X26, #0x8] ``` The faulting LDR at [X26, #0x8] is loading ctx->flags (offset 8 in eip93_hash_ctx), where ctx has been resolved to NULL from a partially initialized or unreachable transform context following the failed setkey. Fix this by dropping the CRYPTO_ALG_ASYNC mask from the crypto_alloc_ahash() call. The code already handles async completion correctly via crypto_wait_req(), so there is no requirement to restrict the lookup to synchronous algorithms. Note that hashing a single 64-byte block through the hardware is likely slower than doing it in software due to the DMA round-trip overhead, but offloading it may still spare CPU cycles on the slower embedded cores where this IP is found. Fixes: 9739f5f93b78 ("crypto: eip93 - Add Inside Secure SafeXcel EIP-93 crypto engine support") Signed-off-by: Aleksander Jan Bajkowski [Detailed investigation report of this bug] Signed-off-by: Kenneth Kasilag Signed-off-by: Herbert Xu commit 4510d140524ca7d6e772db962e013f26f09a63b1 Author: Dudu Lu Date: Mon Apr 13 16:49:27 2026 +0800 net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir In tcf_blockcast_redir(), when iterating block ports to redirect packets to multiple devices, the mac_header_xmit flag is queried from the wrong device. The loop sends to dev_prev but queries dev_is_mac_header_xmit(dev) — which is the NEXT device in the iteration, not the one being sent to. This causes tcf_mirred_to_dev() to make incorrect decisions about whether to push or pull the MAC header. When the block contains mixed device types (e.g., an ethernet veth and a tunnel device), intermediate devices get the wrong mac_header_xmit flag, leading to skb header corruption. In the worst case, skb_push_rcsum with an incorrect mac_len can exhaust headroom and panic. The last device in the loop is handled correctly (line 365-366 uses dev_is_mac_header_xmit(dev_prev)), confirming this is a copy-paste oversight for the intermediate devices. Fix by using dev_prev instead of dev for the mac_header_xmit query, consistent with the device actually being sent to. Fixes: 42f39036cda8 ("net/sched: act_mirred: Allow mirred to block") Signed-off-by: Dudu Lu Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260413084927.71353-1-phx0fer@gmail.com Signed-off-by: Paolo Abeni commit 448c0f8cb7cdf2e6d6e9d1ed3bb8c7397bc71c66 Merge: 920e5001f4beb3 57000fe6a60421 Author: Petr Mladek Date: Thu Apr 16 10:33:43 2026 +0200 Merge branch 'for-7.1/module-function-test' into for-linus commit 3c318f97dcc50b2e0556a1813bd6958678e881fd Author: Cássio Gabriel Date: Wed Apr 15 12:04:53 2026 -0300 ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES parse_uac2_sample_rate_range() caps the number of enumerated rates at MAX_NR_RATES, but it only breaks out of the current rate loop. A malformed UAC2 RANGE response with additional triplets continues parsing the remaining triplets and repeatedly prints "invalid uac2 rates" while probe still holds register_mutex. Stop the whole parse once the cap is reached and return the number of rates collected so far. Fixes: 4fa0e81b8350 ("ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()") Cc: stable@vger.kernel.org Reported-by: syzbot+d56178c27a4710960820@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d56178c27a4710960820 Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260415-usb-audio-uac2-rate-cap-v1-1-5ecbafc120d8@gmail.com Signed-off-by: Takashi Iwai commit eb90ae3cca783ebec65704597027811431465de4 Author: Takashi Iwai Date: Wed Apr 15 15:55:22 2026 +0200 ALSA: hda/intel: Move firmware loading into the probe work The hda-intel driver uses request_firmware_nowait() for loading its patch, and tries to continue the probe directly from the fw loader callback. This works in principle, but it has a few drawbacks: - The driver may be released before the firmware callback completes - Having two ways of async probe makes the code flow unnecessarily complex The former issue is more severe, as it may potentially lead to a UAF, and there is no explicit way to cancel the pending firmware worker for now. This patch changes the firmware loading to be performed rather in the common probe work without *_nowait(). Then the pending work can be easily canceled, and the code becomes more straightforward. A nice bonus is that, by moving into the probe work, the firmware doesn't need any longer to be cached, hence we can get rid of struct azx.fw field, and release the firmware immediately after parsing it, too. Fixes: 5cb543dba986 ("ALSA: hda - Deferred probing with request_firmware_nowait()") Link: https://patch.msgid.link/20260415135526.1813126-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 819bd270abf9de3b7f306e233054b85a07c47820 Author: Konstantin Komarov Date: Wed Apr 15 17:43:47 2026 +0200 fs/ntfs3: fix Smatch warnings Initialize err in ni_allocate_da_blocks_locked() and correct the pre_alloc condition in attr_allocate_clusters(). Suggested-by: Dan Carpenter Signed-off-by: Konstantin Komarov commit 0ca0485e4b2e837ebb6cbd4f2451aba665a03e4b Author: Greg Kroah-Hartman Date: Thu Apr 9 16:37:15 2026 +0200 fs/ntfs3: validate rec->used in journal-replay file record check check_file_record() validates rec->total against the record size but never validates rec->used. The do_action() journal-replay handlers read rec->used from disk and use it to compute memmove lengths: DeleteAttribute: memmove(attr, ..., used - asize - roff) CreateAttribute: memmove(..., attr, used - roff) change_attr_size: memmove(..., used - PtrOffset(rec, next)) When rec->used is smaller than the offset of a validated attribute, or larger than the record size, these subtractions can underflow allowing us to copy huge amounts of memory in to a 4kb buffer, generally considered a bad idea overall. This requires a corrupted filesystem, which isn't a threat model the kernel really needs to worry about, but checking for such an obvious out-of-bounds value is good to keep things robust, especially on journal replay Fix this up by bounding rec->used correctly. This is much like commit b2bc7c44ed17 ("fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot") which checked different values in this same switch statement. Cc: Konstantin Komarov Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") Cc: stable Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Signed-off-by: Konstantin Komarov commit 9a683fe0a00d2684ae874fd9eb58e6c1864fdf36 Merge: 841dbf4871c57c 7aaa8047eafd0b Author: Namhyung Kim Date: Wed Apr 15 22:40:47 2026 -0700 Merge tag 'v7.0-rc6' into perf-tools To get the latest updates and fixes. Signed-off-by: Namhyung Kim commit 5d087c485b6ecf200a9ebb2a032bf8571d330250 Author: Uwe Kleine-König Date: Wed Apr 15 16:50:12 2026 +0200 pwm: stm32: Fix rounding issue for requests with inverted polarity The calculation of the number of pwm clk ticks from a time length in nanoseconds involves a division and thus some rounding. That might result in duty_ticks + offset_ticks < period_ticks despite duty_length_ns + duty_offset_ns >= period_length_ns . The stm32 PWM cannot configure offset_ticks freely, it can only select 0 or period_length_ns - duty_length_ns---that is the classic normal and inverted polarity. The decision to select the hardware polarity must be done using the ticks values and not the nanoseconds times to adhere to the rounding rules by the pwm core. With the pwm clk running at 208900 kHz on my test machine (stm32mp135f-dk), a test case that was handled wrong is: # pwmround -P 9999962 -O 24970 -D 9974992 period_length = 9999962 duty_length = 9974840 duty_offset = 25123 With this change applied the rounding is done correctly: # pwmround -P 9999962 -O 24970 -D 9974992 period_length = 9999962 duty_length = 9974840 duty_offset = 0 Fixes: deaba9cff809 ("pwm: stm32: Implementation of the waveform callbacks") Signed-off-by: Uwe Kleine-König Link: https://patch.msgid.link/c5e7767cee821b5f6e00f95bd14a5e13015646fb.1776264104.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit d09a040c186a2083b1cfa9c3c112782ce4b1f6d4 Author: Stefan Metzmacher Date: Tue Apr 7 16:46:30 2026 +0200 smb: smbdirect: let smbdirect_connection_deregister_mr_io unlock while waiting We should not hold a mutex locked during wait_for_completion() holding a reference is enough. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: Henrique Carvalho Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 25c2e34931c5f2a02baefd111a4eb7fa31158059 Author: Stefan Metzmacher Date: Tue Apr 7 16:46:29 2026 +0200 smb: smbdirect: fix the logic in smbdirect_socket_destroy_sync() without an error If smbdirect_socket_destroy_sync() and sc->first_error was not set we should set -ESHUTDOWN, that's a better condition doing it only implicitly with the sc->status < SMBDIRECT_SOCKET_DISCONNECTING check. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: Henrique Carvalho Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 3892007f2bbf8ae2df5374de708282d6895402e9 Author: Stefan Metzmacher Date: Tue Apr 7 16:46:28 2026 +0200 smb: smbdirect: fix copyright header of smbdirect.h Everything in smbdirect.h was taken from my out of tree prototype. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: Henrique Carvalho Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 735610d0cefa9e44b28498b53706ed2ebac3be27 Author: Stefan Metzmacher Date: Tue Apr 7 16:46:27 2026 +0200 smb: smbdirect: change smbdirect_socket_parameters.{initiator_depth,responder_resources} to __u16 We still limit this to U8_MAX as the rdma api only uses __u8 and that's also the limit for Infiniband and RoCE*, while iWarp would be able to support larger values at the protocol level. As struct smbdirect_socket_parameters will be part of the uapi for IPPROTO_SMBDIRECT in future, change it now even if userspace sockets won't be supported yet. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Henrique Carvalho Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit aa43bb2c0fc0d928bb120f853349c8affcfeb8b4 Author: Stefan Metzmacher Date: Thu Oct 30 12:48:30 2025 +0100 smb: smbdirect: remove unused SMBDIRECT_USE_INLINE_C_FILES logic We always build as standalone module (or as part of the core kernel). This also removes unused elements from struct smbdirect_socket and unused exports. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 649c47559a37fdefefc259ab580b537abbc79fbd Author: Stefan Metzmacher Date: Tue Nov 4 17:35:46 2025 +0100 smb: server: no longer use smbdirect_socket_set_custom_workqueue() smbdirect.ko has global workqueues now, so we should use these default once. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 73dc52d2942ccf4d4f680176c1e7f36aadba4ce8 Author: Stefan Metzmacher Date: Tue Nov 4 17:31:25 2025 +0100 smb: client: no longer use smbdirect_socket_set_custom_workqueue() smbdirect.ko has global workqueues now, so we should use these default once. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1adde16a9e28446b5a73a8f0e05f6f977e520528 Author: Stefan Metzmacher Date: Tue Nov 4 17:25:48 2025 +0100 smb: smbdirect: introduce global workqueues These will be used in future and callers should no longer use smbdirect_socket_set_custom_workqueue(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit e4ce1fca0468eb4b6fc2f02667f599bb76df8848 Author: Stefan Metzmacher Date: Tue Nov 4 17:02:29 2025 +0100 smb: smbdirect: prepare use of dedicated workqueues for different steps This is a preparation in order to have global workqueues in the smbdirect module instead of having the caller to provide one. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 00ac2a4fe04af50e65bbac010379d66d87547c0f Author: Stefan Metzmacher Date: Tue Nov 4 16:29:38 2025 +0100 smb: smbdirect: remove unused smbdirect_connection_mr_io_recovery_work() This would actually never be used as we only move to SMBDIRECT_MR_ERROR when we directly call smbdirect_socket_schedule_cleanup(). Doing an ib_dereg_mr/ib_alloc_mr dance on working connection is not needed and it's also pointless on a broken connection as we don't reuse any ib_pd. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit a40e6f0166e6d5fef4dd7d3b71c333319a0964ab Author: Stefan Metzmacher Date: Mon Nov 24 14:49:55 2025 +0100 smb: smbdirect: wrap rdma_disconnect() in rdma_[un]lock_handler() This might not be needed, but it controls the order of ib_drain_qp() and rdma_disconnect(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 33b2894e8df76f7faf7253d8784515415511968f Author: Stefan Metzmacher Date: Tue Dec 9 13:39:52 2025 +0100 smb: server: make use of smbdirect_netdev_rdma_capable_mode_type() This removes is basically the same logic. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 81a7a3a0faea7e8e64f83aa58e807a8ad329c97d Author: Stefan Metzmacher Date: Mon Dec 8 20:56:45 2025 +0100 smb: smbdirect: introduce smbdirect_netdev_rdma_capable_mode_type() This is basically a copy of ksmbd_rdma_capable_netdev() in the server, but this also prints a message when a device is renamed. The differences are: - It uses rdma_for_each_port() instead of implementing the same logic again. - It returns RDMA_NODE_{UNSPECIFIED,IB_CA,RNIC} values instead of bool Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 50bdab9ae45e6345eaa94adbaefaf1ce5a7e90a1 Author: Stefan Metzmacher Date: Fri Jul 18 19:22:47 2025 +0200 smb: server: make use of smbdirect.ko This means we no longer inline the common smbdirect .c files and use the exported functions from the module instead. Note the connection specific logging is still redirect to ksmbd.ko functions via smbdirect_socket_set_logging(). We still don't use real socket layer, but we're very close... Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 98bdc5fda9cc425afe608342b372d25970071f96 Author: Stefan Metzmacher Date: Tue Nov 25 17:44:31 2025 +0100 smb: server: remove unused ksmbd_transport_ops.prepare() This is no longer needed for smbdirect. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2eff5e51f97663ad2371115260884396718b5e92 Author: Stefan Metzmacher Date: Fri Nov 14 15:41:02 2025 +0100 smb: server: make use of smbdirect_socket_{listen,accept}() We no longer need the custom rdma listener. The code logic is very similar to transport_tcp.c now using a kernel thread that loops over smbdirect_socket_accept(). This is the first step in the direction of using IPPROTO_SMBDIRECT sockets in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1b2d94a3c986473fbb05cd6c5a45d67e5f39f3c2 Author: Stefan Metzmacher Date: Mon Oct 27 21:39:19 2025 +0100 smb: server: only use public smbdirect functions Also remove a lot of unused includes... Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ff7673f6fde8a39d2a693c4ef431a7ce933397d2 Author: Stefan Metzmacher Date: Thu Oct 23 22:49:27 2025 +0200 smb: server: make use of smbdirect_socket_create_accepting()/smbdirect_socket_release() With this we no longer embed struct smbdirect_socket, which will allow us to make it private in the following commits. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 94604164871e4c182d1305ab1e43971f41b6cf38 Author: Stefan Metzmacher Date: Sun Sep 21 00:21:41 2025 +0200 smb: server: make use of smbdirect_{socket_init_accepting,connection_wait_for_connected}() This means we finally only use common functions in the server. We still use the embedded struct smbdirect_socket and are able to access internals, but the will be removed in the next commits as well. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4b4c21a7d2204bda49aa9772d407ba1264727d6d Author: Stefan Metzmacher Date: Fri Oct 17 22:16:56 2025 +0200 smb: server: make use of smbdirect_connection_send_iter() and related functions This makes use of common code for sending messages, this will allow to make more use of common code in the next commits. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c6b077efbc39e0ad6c20733693671ab4a8dbba18 Author: Stefan Metzmacher Date: Fri Oct 17 20:20:02 2025 +0200 smb: server: let smb_direct_post_send_data() return data_length This make it easier moving to common code shared with the client. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 08ffdf0c416849615e8bc935839557429ec24194 Author: Stefan Metzmacher Date: Fri Oct 17 19:25:12 2025 +0200 smb: server: split out smb_direct_send_iter() out of smb_direct_writev() This will help to move to common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit da20536c508c0f511cf20ceef6757ea4861bf547 Author: Stefan Metzmacher Date: Fri Oct 17 17:58:16 2025 +0200 smb: server: let smbdirect_map_sges_from_iter() truncate the message boundary smbdirect_map_sges_from_iter() already handles the case that only a limited number of sges are available. Its return value is data_length and the remaining bytes in the iter are remaining_data_length. This is now much easier and will allow us to share more code with the client soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0af87a0a31668d4a0dc8d8140fb51da594935eb4 Author: Stefan Metzmacher Date: Fri Oct 17 17:24:28 2025 +0200 smb: server: inline smb_direct_create_header() into smb_direct_post_send_data() The point is that ib_dma_map_single() is done first, but the 'Fill in the packet header' will be done after smbdirect_map_sges_from_iter(). This will simplify further changes in order to share common code with the client. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0184d2b386f836925ff2f9b4e6d4f9a8048cf58f Author: Stefan Metzmacher Date: Fri Oct 17 16:51:42 2025 +0200 smb: server: move iov_iter_kvec() out of smb_direct_post_send_data() This will allow us to make the code more generic in order to move it to common with the client. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1421d50ea941c450d089d3b296d308f2b2728f6d Author: Stefan Metzmacher Date: Fri Oct 17 15:53:04 2025 +0200 smb: server: make use of smbdirect_connection_request_keep_alive() This will help to share more common code soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0a1702e9319f428e2e24a6f4b7109d212296f812 Author: Stefan Metzmacher Date: Fri Oct 17 15:45:01 2025 +0200 smb: server: make use of smbdirect_connection_grant_recv_credits() This is already used by the client too and will help to share more common code. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 73489efddadc53dbdd4270569c0c00492ace9801 Author: Stefan Metzmacher Date: Mon Oct 13 18:49:30 2025 +0200 smb: server: make use of smbdirect_connection_recvmsg() This is basically the same logic, it just operates on iov_iter_kvec() instead of a raw buffer pointer. This allows us to use common code between client and server. We keep returning -EINTR instead of -ERESTARTSYS if wait_event_interruptible() fails. I don't if this is required, but changing it is a task for another patch. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit a3bf9bfee8370d7a497276c26ee639d1d7e41677 Author: Stefan Metzmacher Date: Mon Oct 13 16:36:07 2025 +0200 smb: server: make use of smbdirect_socket_destroy_sync() This is basically the same logic as before, but we now use common code, which will also be used by the server soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 21a72d0900733f19b8b1b846e8318bfe96795636 Author: Stefan Metzmacher Date: Fri Sep 19 10:23:24 2025 +0200 smb: server: make use of functions from smbdirect_rw.c The copied code only got new names, some indentation/formatting changes, some variable names are changed too. They also only use struct smbdirect_socket instead of struct smb_direct_transport. But the logic is still the same. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0911d32ba20657c1ceafeab83442ef1f24cdff57 Author: Stefan Metzmacher Date: Fri Sep 19 09:52:35 2025 +0200 smb: server: make use of smbdirect_socket_wait_for_credits() This will allow us to share more common code between client and server soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit be0ac9f59f4c7d3399388f8ec90137c5fed1fcd0 Author: Stefan Metzmacher Date: Fri Sep 19 09:41:16 2025 +0200 smb: server: make use of smbdirect_get_buf_page_count() This will allow us to move code into common code between client and server soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8d55169a570944cf68c740ba723987ffcd762728 Author: Stefan Metzmacher Date: Thu Sep 18 21:50:44 2025 +0200 smb: server: make use of smbdirect_connection_recv_io_refill[_work]() This is basically a copy of smb_direct_post_recv_credits(), but there are several improvements compared to the existing function: 1. We calculate the number of missing posted buffers by getting the difference between recv_io.credits.target and recv_io.posted.count. Instead of the difference between recv_io.credits.target and recv_io.credits.count, because recv_io.credits.count is only updated once a message is send to the peer. It was not really a problem before, because we have a fixed number smbdirect_recv_io buffers, so the loop terminated when smbdirect_connection_get_recv_io() returns NULL. But using recv_io.posted.count makes it easier to understand. 2. In order to tell the peer about the newly posted buffer and grant the credits, we only trigger the send immediate when we're not granting only the last possible credit. This is mostly a difference relative to the servers smb_direct_post_recv_credits() implementation, which should avoid useless ping pong messages. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 62782820e85250bc9919621aa242510d300e9093 Author: Stefan Metzmacher Date: Thu Sep 18 19:52:03 2025 +0200 smb: server: make use of smbdirect_connection_post_recv_io() The only difference is that smbdirect_connection_post_recv_io() returns early if the connection is already broken. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5a2999d7d9c550f265b04e1abf5774e97150d220 Author: Stefan Metzmacher Date: Thu Sep 18 18:48:40 2025 +0200 smb: server: make use of smbdirect_connection_{create,destroy}_qp() It's good a use common code for this and it will allow us to share more code in the next steps. Calling ib_drain_qp() twice is ok. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d5e2bdda493f10ccc8e7c3545f79e2505ee94dff Author: Stefan Metzmacher Date: Thu Sep 18 18:38:14 2025 +0200 smb: server: make use of smbdirect_connection_negotiate_rdma_resources() It's good to have this logic in a central place, it will allow us share more code soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ab8e9249e735f8801039f7eef7ca556d65f64b2b Author: Stefan Metzmacher Date: Mon Sep 15 07:59:20 2025 +0200 smb: server: make use of smbdirect_connection_qp_event_handler() This is a copy of smb_direct_qpair_handler()... It will allow more code to be moved to common functions soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8688d7a8c712dc507bf4ae6ee07c1eed536e35a5 Author: Stefan Metzmacher Date: Mon Sep 15 04:39:13 2025 +0200 smb: server: make use of smbdirect_map_sges_from_iter() It will make it easier to move stuff into common code when both client and server use smbdirect_map_sges_from_iter(). Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 07aec3a151b732cfa06bd00821a1ed99b8f87c89 Author: Stefan Metzmacher Date: Sat Sep 13 00:18:50 2025 +0200 smb: server: make use of smbdirect_connection_{create,destroy}_mem_pools() This were based on smb_direct_{create,destroy}_pools() in the server. The main logical differences are the following: We now don't use smbdirect_connection_get_recv_io() on cleanup, instead it uses list_for_each_entry_safe()... We don't generate warnings if smbdirect_recv_io payload is copied into userspace buffers. This doesn't happen in the server anyway. And it uses list_add_tail() just to let me feel better when looking at the code... Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit bb1d5c49d6cdc0be77719123237ead835216f304 Author: Stefan Metzmacher Date: Thu Sep 11 20:54:31 2025 +0200 smb: server: make use of smbdirect_connection_send_io_done() This also wakes up send_io.pending.dec_wait_queue, which is currently always empty in the server, but that might change in future. And we also don't spam the logs on IB_WC_WR_FLUSH_ERR. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8ecb32ada10e13d608a80f1112daf03c82fa3683 Author: Stefan Metzmacher Date: Thu Sep 11 20:12:11 2025 +0200 smb: server: make use of smbdirect_connection_{alloc,free}_send_io() These are basically copies of smb_direct_{alloc,free}_sendmsg() just a bit simpler and with the gfp_mask mask abstracted. For now we still use KSMBD_DEFAULT_GFP, which includes __GFP_RETRY_MAYFAIL. The only difference is that we use ib_dma_unmap_page() for all sges, this simplifies the logic and doesn't matter as ib_dma_unmap_single() and ib_dma_unmap_page() both operate on dma_addr_t and dma_unmap_single_attrs() is just an alias for dma_unmap_page_attrs(). We already had such an inconsistency in the client code where we use ib_dma_unmap_single(), while we mapped using ib_dma_map_page(). Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c81c66d3c09aa1dfab2137ac6b737a206d228b2f Author: Stefan Metzmacher Date: Thu Aug 28 17:01:58 2025 +0200 smb: server: make use of smbdirect_frwr_is_supported() This is an exact copy of rdma_frwr_is_supported(). Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 84d7085e5f2343877e4b0e0a55569f59f7db92a1 Author: Stefan Metzmacher Date: Wed Aug 27 17:25:37 2025 +0200 smb: server: make use of smbdirect_connection_idle_timer_work() This is basically a copy of smb_direct_idle_connection_timer(). The only difference is that we had no logging before. Note smbdirect_socket_prepare_create() already calls INIT_DELAYED_WORK(). Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit aa1255e71ffac6868e9db10ac3b6c2c10711afd9 Author: Stefan Metzmacher Date: Wed Aug 27 16:57:47 2025 +0200 smb: server: make use of smbdirect_connection_reassembly_{append,first}_recv_io() These are basically copies of enqueue_reassembly() and get_first_reassembly(). The only difference is that sc->statistics.enqueue_reassembly_queue now updated. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 01f26988c8728c5dd993f03b316c32d2cce3b4e3 Author: Stefan Metzmacher Date: Tue Aug 26 19:16:54 2025 +0200 smb: server: make use of smbdirect_connection_{get,put}_recv_io() These are basically copies of {get,put}_receive_buffer() in the client. They are very similar to {get_free,put}_recvmsg() the only logical difference is the updating of the sc->statistics.*. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0ffbbfdf6a2698d31dc6b38b47fa04ef0cd075a1 Author: Stefan Metzmacher Date: Tue Aug 26 17:31:39 2025 +0200 smb: server: make use of smbdirect_socket_schedule_cleanup() This removes smb_direct_disconnect_rdma_connection() which is basically the same as smbdirect_socket_schedule_cleanup(). And we pass more useful errors than -ECONNABORTED if we have them. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1b1ee1e3ee32115492adc6c746177fca6fc8593b Author: Stefan Metzmacher Date: Tue Aug 26 17:20:30 2025 +0200 smb: server: make use of smbdirect_socket_cleanup_work() Note smbdirect_socket_prepare_create() already calls INIT_WORK() with smbdirect_socket_cleanup_work. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 33562021f4151c3d18be696c7c55e323716a0a39 Author: Stefan Metzmacher Date: Tue Sep 2 12:55:04 2025 +0200 smb: server: make use of smbdirect_socket_wake_up_all() This is a superset of smb_direct_disconnect_wake_up_all() and calling wake_up_all(&sc->mr_io.ready.wait_queue); and wake_up_all(&sc->mr_io.cleanup.wait_queue); in addition should not matter as it's not used on the server anyway. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit bbf3559afe5ef7283eaa3112520ce06f73426ee1 Author: Stefan Metzmacher Date: Thu Oct 23 14:40:48 2025 +0200 smb: server: make use of smbdirect_socket_set_logging() This will allow the logging to keep working as before, when we move to common functions in the next commits. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4624f1bf1b79bd50ddbd1178aa741b8a7afba5b0 Author: Stefan Metzmacher Date: Tue Aug 26 15:32:48 2025 +0200 smb: server: make use of smbdirect_socket_prepare_create() This prepares the use of functions from smbdirect_connection.c. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6acc747906c5b87657dc313ff6cb777d805a6ec4 Author: Stefan Metzmacher Date: Fri Jul 18 19:22:33 2025 +0200 smb: client: make use of smbdirect.ko This means we no longer inline the common smbdirect .c files and use the exported functions from the module instead. Note the connection specific logging is still redirect to cifs.ko functions via smbdirect_socket_set_logging(). We still don't use real socket layer, but we're very close... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit a8e98e392062a9575e41646621f238f3a35203ae Author: Stefan Metzmacher Date: Mon Oct 27 21:29:48 2025 +0100 smb: client: only use public smbdirect functions Also remove a lot of unused includes... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b8aef8c8808cc78992bec2ab2195c5e0903c0879 Author: Stefan Metzmacher Date: Fri Oct 24 17:41:03 2025 +0200 smb: client: make use of smbdirect_socket_create_kern()/smbdirect_socket_release() With this we no longer embed struct smbdirect_socket, which will allow us to make it private in the following commits. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7dbfc0d910e0364117e01b6c41fb641360852497 Author: Stefan Metzmacher Date: Fri Sep 19 22:54:36 2025 +0200 smb: client: make use of smbdirect_socket_init_new() and smbdirect_connect_sync() This means we finally only use common functions in the client. We still use the embedded struct smbdirect_socket and are able to access internals, but the will be removed in the next commits as well. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0b0a1a3b2d25464ed65a89e2cfbdd41ea78b2502 Author: Stefan Metzmacher Date: Tue Oct 21 21:07:26 2025 +0200 smb: client: introduce and use smbd_debug_proc_show() This will allow us to make struct smbdirect_socket private in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5bd752e7749e4abcae71d95e22b75272ac767b06 Author: Stefan Metzmacher Date: Tue Oct 21 20:43:44 2025 +0200 smb: client: introduce and use smbd_mr_fill_buffer_descriptor() This will allow us to make struct smbdirect_mr_io private in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 63972da39f900b98c18b5283dcde74e3ce0909fb Author: Stefan Metzmacher Date: Fri Oct 17 22:23:10 2025 +0200 smb: client: make use of smbdirect_connection_send_{single_iter,immediate_work}() With this the low level send functions are in common, we'll have to do some more changes in generic smb code in order to use smbdirect_connection_send_iter() instead of looping around smbdirect_connection_send_single_iter(). David's cleanups will allow us to use smbdirect_connection_send_iter(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7c81e7bb1338b7c9a45f6f240aec3bc243abf0b6 Author: Stefan Metzmacher Date: Fri Oct 17 21:03:45 2025 +0200 smb: client: let smbd_post_send_full_iter() get remaining_length and return data_length This will simplify further changes in order to share more common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b626ccd251ae9181dd716036718da7b7da042726 Author: Stefan Metzmacher Date: Fri Oct 17 20:46:29 2025 +0200 smb: client: let smbd_post_send_iter() get remaining_length and return data_length This lets the logic be like smb_direct_post_send_data(), so we can share common code in the next steps. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 15c7e492610f001e1ff6480c6b5d9d1653afaa3c Author: Stefan Metzmacher Date: Fri Oct 17 20:33:10 2025 +0200 smb: client: change smbd_post_send_empty() to void return The caller doesn't check, so we better call smbdirect_socket_schedule_cleanup() to handle the error. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b942f351c25051f971a39fac06ebed02da9a648e Author: Stefan Metzmacher Date: Fri Oct 17 15:51:26 2025 +0200 smb: client: make use of smbdirect_connection_request_keep_alive() This will help to share more common code soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8b72c199a9626cc1b53c8d579e9e4c6f23af8908 Author: Stefan Metzmacher Date: Fri Oct 17 15:37:32 2025 +0200 smb: client: make use of smbdirect_connection_grant_recv_credits() This already calls atomic_add(new_credits, &sc->recv_io.credits.count), so there's no need to do it in the caller anymore. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit edb9e514f0e058a924a169795fb0e34286da9572 Author: Stefan Metzmacher Date: Mon Oct 13 18:42:08 2025 +0200 smb: client: make use of smbdirect_connection_recvmsg() This is basically the same as it was copied before... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2cafcddbdada359f36a93bd014eef7ea2186435d Author: Stefan Metzmacher Date: Mon Oct 13 16:33:20 2025 +0200 smb: client: make use of smbdirect_socket_destroy_sync() This is basically the same logic as before, but we now use common code, which will also be used by the server soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2a49b625189ebf43329299f47dd513840acd89ae Author: Stefan Metzmacher Date: Fri Sep 19 08:35:51 2025 +0200 smb: client: make use of functions from smbdirect_mr.c The copied code only got new names, some indentation/formatting changes, some variable names are changed too. They also only use struct smbdirect_socket instead of struct smbd_connection. But the logic is still the same. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 73ec624781cd7a43a2dbad8c7d40133703089224 Author: Stefan Metzmacher Date: Thu Sep 18 21:39:25 2025 +0200 smb: client: make use of smbdirect_connection_recv_io_refill_work() This is basically a copy of smbd_post_send_credits(), but there are several improvements compared to the existing function: We calculate the number of missing posted buffers by getting the difference between recv_io.credits.target and recv_io.posted.count. Instead of the difference between recv_io.credits.target and recv_io.credits.count, because recv_io.credits.count is only updated once a message is send to the peer. It was not really a problem before, because we have a fixed number smbdirect_recv_io buffers, so the loop terminated when smbdirect_connection_get_recv_io() returns NULL. But using recv_io.posted.count makes it easier to understand. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 26003faa7d477eed4ceb5b5b49e4eb4a77bf2f6f Author: Stefan Metzmacher Date: Wed Sep 17 09:18:08 2025 +0200 smb: client: make use of smbdirect_connection_post_recv_io() The only difference is that smbdirect_connection_post_recv_io() returns early if the connection is already broken. And that the error code from ib_dma_mapping_error() (currently only -ENOMEM is possible) is returned instead of -EIO. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6a67fe6212028754d3b3b57871916309a16863a6 Author: Stefan Metzmacher Date: Wed Sep 17 08:54:03 2025 +0200 smb: client: initialize recv_io->cqe.done = recv_done just once smbdirect_recv_io structures are pre-allocated so we can set the callback function just once. This will make it easy to move smbd_post_recv() to common code soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8de5571045902b5cadee117ec02c62c2f6cb0886 Author: Stefan Metzmacher Date: Tue Sep 16 01:53:23 2025 +0200 smb: client: make use of smbdirect_connection_{create,destroy}_qp() It's good a use common code for this and it will allow us to share more code in the next steps. Calling ib_drain_qp() twice is ok. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6bcccfb0c0f214e2ee3f09125f0459c9fbfea766 Author: Stefan Metzmacher Date: Thu Sep 18 18:37:40 2025 +0200 smb: client: make use of smbdirect_connection_negotiate_rdma_resources() It's good to have this logic in a central place, it will allow us share more code soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0b7da58fec9ae573263571d5574d6a44f52c8223 Author: Stefan Metzmacher Date: Mon Sep 15 07:55:19 2025 +0200 smb: client: make use of smbdirect_connection_qp_event_handler() This is a copy of smbd_qp_async_error_upcall()... It will allow more code to be moved to common functions soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit e5fd091663f82ee6c36cffd4bb93fcee9fc644c3 Author: Stefan Metzmacher Date: Mon Sep 15 02:26:47 2025 +0200 smb: client: make use of smbdirect_map_sges_from_iter() This is basically a copy of smb_extract_iter_to_rdma() moved to common code. Before we had the inconsistency we called ib_dma_unmap_single(), while we mapped using ib_dma_map_page() in smb_set_sge(). Now ib_dma_unmap_page() is used for consistency. It doesn't really matter as ib_dma_unmap_single() and ib_dma_unmap_page() both operate on dma_addr_t and dma_unmap_single_attrs() is just an alias for dma_unmap_page_attrs(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 116f3eed365143dd8c31a50fe62726966d047577 Author: Stefan Metzmacher Date: Sat Sep 13 00:10:06 2025 +0200 smb: client: make use of smbdirect_connection_{create,destroy}_mem_pools() The main logical differences are the following: We now don't use smbdirect_connection_get_recv_io() on cleanup, instead it uses list_for_each_entry_safe()... For the smbdirect_recv_io payload we expose the whole payload including the smbdirect_data_transfer header as documentation says data_offset = 0 and data_length != 0 would be valid, while the existing client code requires data_offset >= 24. The smbdirect_send_io cache includes header space for sizeof(struct smbdirect_negotiate_resp) = 32 bytes instead of sizeof(struct smbdirect_data_transfer) = 24 bytes. If this ever becomes a problem, we can allocate separate space for the smbdirect_negotiate_resp in the server. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 958da403e1db2fad62d1b9398b486e34658396f8 Author: Stefan Metzmacher Date: Thu Sep 11 20:51:53 2025 +0200 smb: client: make use of smbdirect_connection_send_io_done() This handles freeing of siblings too, which is used on the client yet, but that might follow later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit f7a59fff0259592e138c702b3c22b5fbf3c8ea00 Author: Stefan Metzmacher Date: Thu Sep 11 20:09:24 2025 +0200 smb: client: make use of smbdirect_connection_{alloc,free}_send_io() This simplifies the code and allows us to share more code in common with the server. The only difference is that we use ib_dma_unmap_page() for all sges, this simplifies the logic and doesn't matter as ib_dma_unmap_single() and ib_dma_unmap_page() both operate on dma_addr_t and dma_unmap_single_attrs() is just an alias for dma_unmap_page_attrs(). We already had such an inconsistency before as we called ib_dma_unmap_single(), while we mapped using ib_dma_map_page() in smb_set_sge(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6f9055aa9c8c16c7a9e185e35257dbee3852d42f Author: Stefan Metzmacher Date: Thu Aug 28 16:59:00 2025 +0200 smb: client: make use of smbdirect_frwr_is_supported() This an exact copy of frwr_is_supported(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c85814ca5f3d22f08f3513a6eb91162392f4fe4b Author: Stefan Metzmacher Date: Wed Aug 27 17:22:44 2025 +0200 smb: client: make use of smbdirect_connection_idle_timer_work() This is basically a copy of idle_connection_timer(). Note smbdirect_socket_prepare_create() already calls INIT_DELAYED_WORK(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 018ed87aa5ddc42f4437f6f9df4386e8e18e481d Author: Stefan Metzmacher Date: Wed Aug 27 16:48:39 2025 +0200 smb: client: make use of smbdirect_connection_reassembly_{append,first}_recv_io() These are exact copies of enqueue_reassembly() and _get_first_reassembly(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 927183cdbe4897f9a4bc0f64201fb0f192722d35 Author: Stefan Metzmacher Date: Tue Aug 26 19:13:27 2025 +0200 smb: client: make use of smbdirect_connection_{get,put}_recv_io() These are basically copies of {get,put}_receive_buffer(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 43e1fed89e40346578a2f94ae0a87dfa05987fa5 Author: Stefan Metzmacher Date: Tue Aug 26 17:28:53 2025 +0200 smb: client: make use of smbdirect_socket_schedule_cleanup() This removes smbd_disconnect_rdma_connection() which is basically the same as smbdirect_socket_schedule_cleanup(). And we pass more useful errors than -ECONNABORTED if we have them. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 872b23ab6d9495e5504ac0a43e9ec977e750052a Author: Stefan Metzmacher Date: Tue Aug 26 16:55:52 2025 +0200 smb: client: make use of smbdirect_socket_cleanup_work() Note smbdirect_socket_prepare_create() already calls INIT_WORK() with smbdirect_socket_cleanup_work. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5f6e338bbb78787933ffcf87959178c4f0a08757 Author: Stefan Metzmacher Date: Tue Sep 2 12:49:44 2025 +0200 smb: client: make use of smbdirect_socket_wake_up_all() This is a superset of smbd_disconnect_wake_up_all() and calling wake_up_all(&sc->rw_io.credits.wait_queue); in addition should not matter as it's not used on the client anyway. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2459505596f57664f61a1be9b50065ebed9da660 Author: Stefan Metzmacher Date: Thu Oct 23 13:29:46 2025 +0200 smb: client: make use of smbdirect_socket_set_logging() This will allow the logging to keep working as before, when we move to common functions in the next commits. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit dd43c2227394472aa6e438ddffc2f58028de7531 Author: Stefan Metzmacher Date: Tue Aug 26 15:32:48 2025 +0200 smb: client: make use of smbdirect_socket_prepare_create() This prepares the use of functions from smbdirect_connection.c. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit f9a804da479cc41172f1039b4ffde06a09920506 Author: Stefan Metzmacher Date: Fri Jul 18 18:44:15 2025 +0200 smb: smbdirect: introduce the basic smbdirect.ko This exports the functions needed by cifs.ko and ksmbd.ko. It doesn't yet provide a generic socket layer, but it is a good start to introduce that on top. It will be much easier after Davids refactoring using MSG_SPLICE_PAGES, will make it easier to use the socket layer without an additional copy. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit dc691b91ad1677def14582a279e56fd943b52f94 Author: Stefan Metzmacher Date: Wed Nov 19 11:46:01 2025 +0100 smb: smbdirect: introduce smbdirect_socket_{listen,accept}() These will be used by the server soon instead of using smbdirect_accept_connect_request() together with rdma_listen(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 03f9e2c15f8fa32b8056a3a59f98f652726f78b8 Author: Stefan Metzmacher Date: Wed Nov 19 14:56:03 2025 +0100 smb: smbdirect: introduce smbdirect_socket_bind() This will be used by the server in the next steps. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 84df3cde16090d5d1de4df31623ef0433fdea041 Author: Stefan Metzmacher Date: Thu Nov 13 13:10:24 2025 +0100 smb: smbdirect: split out smbdirect_accept_negotiate_finish() This will make it easier to support the listen/accept socket interfaces in the next steps. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4c9e665cb1132b92812886d08ec784132eb66caf Author: Stefan Metzmacher Date: Tue Feb 3 19:26:43 2026 +0100 smb: smbdirect: introduce smbdirect_init_send_batch_storage() This makes it possible to use batching via public functions without exposing the internals of struct smbdirect_send_batch. Once the client no longer needs to use smbdirect_connection_send_single_iter() we can remove this again. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 89df0942907894a92dbece12bfa35e1647959b0c Author: Stefan Metzmacher Date: Mon Oct 27 20:57:51 2025 +0100 smb: smbdirect: provide explicit prototypes for cross .c file functions These prototypes are used between private .c files, when they will be compiled alone into smbdirect.ko. For now this uses the SMBDIRECT_USE_INLINE_C_FILES code path and marks all function as '__maybe_unused static', but this will make further changes easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b2261ceedd4a4831957732ebae5ad33bf5c7fc80 Author: Stefan Metzmacher Date: Mon Oct 27 16:57:39 2025 +0100 smb: smbdirect: introduce smbdirect_public.h with prototypes smbdirect_public.h contains functions which will be still be eported when we move to an smbdirect.ko. For now this uses the SMBDIRECT_USE_INLINE_C_FILES code path and marks all function as '__maybe_unused static', but this will make further changes easier. Note this generates the following things from checkpatch.pl, so I passed --ignore=FILE_PATH_CHANGES,EXPORT_SYMBOL,COMPLEX_MACRO ERROR: Macros with complex values should be enclosed in parentheses #514: FILE: fs/smb/common/smbdirect/smbdirect_public.h:18: +#define __SMBDIRECT_PUBLIC__ __maybe_unused static WARNING: EXPORT_SYMBOL(foo); should immediately follow its function/variable #515: FILE: fs/smb/common/smbdirect/smbdirect_public.h:19: +#define __SMBDIRECT_EXPORT_SYMBOL__(__sym) WARNING: EXPORT_SYMBOL(foo); should immediately follow its function/variable #518: FILE: fs/smb/common/smbdirect/smbdirect_public.h:22: +#define __SMBDIRECT_EXPORT_SYMBOL__(__sym) EXPORT_SYMBOL_FOR_MODULES(__sym, "cifs,ksmbd") This is exactly what we want here, so we should ignore the checkpatch.pl problems. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5e4bf7fadd4a608cace7604b720483f051f8176f Author: Stefan Metzmacher Date: Tue Oct 28 11:11:16 2025 +0100 smb: smbdirect: let smbdirect_internal.h define pr_fmt without SMBDIRECT_USE_INLINE_C_FILES When we move to smbdirect.ko we want log message prefixed with the module name. Note callers are still using smbdirect_socket_set_logging() in order to redirect the per connection logging to their own log functions. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b1e6277bd1240c3a66aac537b1b43b4bfd2edcd8 Author: Stefan Metzmacher Date: Fri Oct 31 14:19:26 2025 +0100 smb: smbdirect: let smbdirect_socket.h include all headers for used structures Currently they are implicitly included via client and server code, but this is needed when we move to an smbdirect.ko. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 20cd3cc4420bdb9f63644cd140e2682f634e651e Author: Stefan Metzmacher Date: Tue Oct 21 16:48:12 2025 +0200 smb: smbdirect: introduce smbdirect_socket_create_{kern,accepting}() and smbdirect_socket_release() This provides functions which also allocate and free struct smbdirect_socket. This allows callers to use the same flow as with sock_create_kern()/sock_release(). The end goal would be to use sock_create_kern()/sock_release(), but the first step will be to use smbdirect specific functions without any struct socket nor struct sock. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit eb3ed1e9048cf7b2a38112f48e0f1b772bb7860d Author: Stefan Metzmacher Date: Sat Sep 20 08:42:16 2025 +0200 smb: smbdirect: introduce smbdirect_accept_connect_request() This will be used by the server to handle new connections. All rdma processing from rdma_accept() to RDMA_CM_EVENT_ESTABLISHED as well as the waiting for the smbdirect negotiation request and sending the negotiation response is done async until we reach SMBDIRECT_SOCKET_CONNECTED. Sync behaviour will be done by the server calling smbdirect_conection_wait_for_connected() in order to each SMBDIRECT_SOCKET_CONNECTED or an error. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d1f187656797fc7434388c1795e05f8abe370d46 Author: Stefan Metzmacher Date: Mon Sep 1 16:10:49 2025 +0200 smb: smbdirect: introduce smbdirect_connect[_sync]() This implements a fully async connect logic over all rdma related operations: rdma_resolve_addr, rdma_resolve_route and rdma_connect_locked until we reach RDMA_CM_EVENT_ESTABLISHED, followed by the smbdirect negotiation request/response handling until we reach SMBDIRECT_SOCKET_CONNECTED. smbdirect_connect_sync() is just a useful wrapper around the async logic calling smbdirect_connect() followed by smbdirect_connection_wait_for_connected(), which only waits for SMBDIRECT_SOCKET_CONNECTED or an error. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ede2b44b0e62378cb8585dda20a4edadbc621bb0 Author: Stefan Metzmacher Date: Thu Dec 18 20:54:25 2025 +0100 smb: smbdirect: let smbdirect_socket_set_initial_parameters() call rdma_restrict_node_type() We allow the caller of smbdirect_socket_set_initial_parameters() to pass SMBDIRECT_FLAG_PORT_RANGE_ONLY_{IB,IW} in order to restrict the rdma devices for the listener or connection to either iWarp (RDMA_NODE_RNIC) or InfiniBand/RoCEv1/RoCEv2 (RDMA_NODE_IB_CA). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit dce268ffcddc96f29707c1967c52b036ad92e43d Author: Stefan Metzmacher Date: Tue Oct 21 15:17:35 2025 +0200 smb: smbdirect: introduce smbdirect_socket_init_{new,accepting}() and helpers These will be used in order to initialize struct smbdirect_socket with rdma.cm_id being valid from the start in order to hold a reference to the correct net namespace, this will allow us to implement async connecting and accepting logic in the next steps. This comes with some related helper functions in order to initialize the socket without the need to access internals of struct smbdirect_socket: smbdirect_socket_set_initial_parameters smbdirect_socket_get_current_parameters smbdirect_socket_set_kernel_settings smbdirect_socket_set_custom_workqueue Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b3e78c651441eaf08e830e260d06fd8d33a8b7f9 Author: Stefan Metzmacher Date: Tue Oct 21 17:32:07 2025 +0200 smb: smbdirect: introduce smbdirect_socket_shutdown() This can be used by client and server to trigger a disconnect of the connection, the idea of to be similar to kernel_sock_shutdown(), but for smbdirect there's no point in shutting down only one direction so there's no 'how' argument. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit dc24063813ea617394db153cf9203286770ed404 Author: Stefan Metzmacher Date: Tue Oct 21 19:42:17 2025 +0200 smb: smbdirect: introduce smbdirect_connection_is_connected() This is a simple way to check is the connection is still ok without the need to know internals of struct smbdirect_socket. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 09d617d3121e14309ad5e4287b0da3ec27d386a8 Author: Stefan Metzmacher Date: Tue Oct 21 17:32:07 2025 +0200 smb: smbdirect: introduce smbdirect_connection_wait_for_connected() This will be used by client and server in order to wait for the connect/negotiation to finish in order to get a usable connection. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit a93b68d46e1450ca6d395be0ca002f8bdf04d9a6 Author: Stefan Metzmacher Date: Tue Oct 21 20:55:38 2025 +0200 smb: smbdirect: introduce smbdirect_connection_legacy_debug_proc_show() This will be used by the client in order to keep the debug output in the current way without the need to access struct smbdirect_socket internals. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b183b7b9b51fc37cc8e1fbad3c0d84e0cb605266 Author: Stefan Metzmacher Date: Tue Oct 21 17:52:05 2025 +0200 smb: smbdirect: introduce smbdirect_mr_io_fill_buffer_descriptor() This will be used by the client instead of dereferencing struct smbdirect_mr_io internals. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 099db5093e4d894483163bd7e4b58c99319bc3f3 Author: Stefan Metzmacher Date: Sun Sep 21 21:47:52 2025 +0200 smb: smbdirect: introduce smbdirect_connection_negotiation_done() This will be used by client and server in order to turn the connection into a usable state. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit db3092ed2f0bec27eb289755173134e46e3ae7a4 Author: Stefan Metzmacher Date: Fri Oct 17 22:10:50 2025 +0200 smb: smbdirect: introduce smbdirect_connection_send_immediate_work() This is a combination of smb_direct_send_immediate_work() in the server as well as send_immediate_empty_message() and smbd_post_send_empty() in the client. smbdirect_connection_send_immediate_work() replace all of them in client and server. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 54abc694ebb8fae2bf1c23fa0a5b1652f4d70bf6 Author: Stefan Metzmacher Date: Fri Oct 17 21:54:09 2025 +0200 smb: smbdirect: introduce smbdirect_connection_send_iter() and related functions This is basically a copy of the following functions in the server: smb_direct_post_send => smbdirect_connection_post_send_wr smb_direct_send_ctx_init => smbdirect_connection_send_batch_init smb_direct_flush_send_list => smbdirect_connection_send_batch_flush wait_for_send_lcredit => smbdirect_connection_wait_for_send_lcredit wait_for_send_credits => smbdirect_connection_wait_for_send_credits post_sendmsg => smbdirect_connection_post_send_io smb_direct_post_send_data => smbdirect_connection_send_single_iter smb_direct_send_iter => smbdirect_connection_send_iter They will replace the server functions soon and will also be used in the client as smbdirect_connection_send_single_iter() is very similar to smbd_post_send_iter(). There's also a smbdirect_connection_send_wait_zero_pending() helper that can be used together with smbdirect_connection_send_single_iter() in the client until it can use smbdirect_connection_send_iter(), which can happen with David's refactoring. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4908d19640f4e7834acf26a7de2b78b1c1880829 Author: Stefan Metzmacher Date: Fri Oct 17 15:49:50 2025 +0200 smb: smbdirect: introduce smbdirect_connection_request_keep_alive() This a copy of manage_keep_alive_before_sending() in client and server, it will replace these in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 3514195010828078173dd0608ba04340b718892f Author: Stefan Metzmacher Date: Fri Oct 17 15:15:05 2025 +0200 smb: smbdirect: introduce smbdirect_connection_grant_recv_credits() This is basically a copy of manage_credits_prior_sending() in the client and the server. It will replace both versions in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 20c55c6910cc305854e7d545d85493d0d383b081 Author: Stefan Metzmacher Date: Mon Oct 13 18:34:08 2025 +0200 smb: smbdirect: introduce smbdirect_connection_recvmsg() This is basically a copy of smbd_recv() in the client. And it's very similar to smb_direct_read() in the server. It will replace both in the following commits. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b895bc4d215575132c7fec55cf6a2d3787c16a58 Author: Stefan Metzmacher Date: Sat Sep 20 07:34:44 2025 +0200 smb: smbdirect: introduce smbdirect_connection_rdma_{established,event_handler}() This will be used by client and server in future, it will be used after the rdma connection is established in order to simplify the events happening on an established connection. We'll also have smbdirect_{connect,accept}_rdma_event_handler functions which will be used before the rdma connection is established. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 422a2436697da6cc0f2de812a778ff1d249b5335 Author: Stefan Metzmacher Date: Mon Oct 13 16:13:15 2025 +0200 smb: smbdirect: introduce smbdirect_socket_destroy[_sync]() This will be used in common between client and server in order to destroy all resources attached to a connection. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ea4151222a93d3bfd5d5c438d1c286a5dcff846c Author: Stefan Metzmacher Date: Sat Sep 20 06:49:55 2025 +0200 smb: smbdirect: introduce smbdirect_connection_recv_io_done() This is basically a copy of recv_done() in client and server, with the following additions: - Only handling the SMBDIRECT_EXPECT_DATA_TRANSFER code path, as we'll have separate functions for the negotiate messages. - Using more helper variables - Improved logging - Add credits_requested == 0 error check - Add data_offset not 8 bytes aligned error check - Use disable_work(&sc->recv_io.posted.refill_work) before smbdirect_connection_put_recv_io, when it is followed by smbdirect_socket_schedule_cleanup() This will be used on common between client and server in future and replace the existing recv_done() functions. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 822b1f296a4a230425464a7e42a7f180990aed5d Author: Stefan Metzmacher Date: Sat Sep 20 23:14:15 2025 +0200 smb: smbdirect: define SMBDIRECT_RDMA_CM_[RNR_]RETRY These are copies of {SMBD,SMB_DIRECT}_CM_[RNR_]RETRY. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5fe03dd0c52094a2673b829af0f432bab038edcc Author: Stefan Metzmacher Date: Sat Sep 20 04:27:03 2025 +0200 smb: smbdirect: define SMBDIRECT_MIN_{RECEIVE,FRAGMENTED}_SIZE These are specified in MS-SMBD... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6cc55655d0bc5836e17f84fd81e450740a78a7bb Author: Stefan Metzmacher Date: Fri Sep 19 09:07:03 2025 +0200 smb: smbdirect: introduce smbdirect_rw.c with server rw code This is basically contains the following functions copied from the server: wait_for_rw_credits, calc_rw_credits, get_sg_list, smb_direct_free_rdma_rw_msg, read_write_done, read_done, write_done, smb_direct_rdma_xmit. They got new names, some indentation/formatting changes, some variable names are changed too. They also only use struct smbdirect_socket instead of struct smb_direct_transport. But the logic is still the same. They will be used by the server soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit de5ef8ec3c4694b9ad665eeea7321202a85474b6 Author: Stefan Metzmacher Date: Fri Sep 19 07:19:26 2025 +0200 smb: smbdirect: introduce smbdirect_mr.c with client mr code This is basically contains the following functions copied from the client: destroy_mr_list, allocate_mr_list, register_mr_done, smbd_mr_recovery_work, get_mr, smbd_iter_to_mr, smbd_register_mr and smbd_deregister_mr. They got new names, some indentation/formatting changes, some variable names are changed too. They also only use struct smbdirect_socket instead of struct smbd_connection. But the logic is still the same. They will be used by the client soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0ad03ed97da1761a8c42bf4fad559409dfbe0db7 Author: Stefan Metzmacher Date: Fri Sep 19 09:48:58 2025 +0200 smb: smbdirect: introduce smbdirect_socket_wait_for_credits() This is a copy of wait_for_credits() in the server, which will be replaced by this soon. This will allow us to share more common code between client and server soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit dc01504c90d9613a83d6ecf8323800213495c966 Author: Stefan Metzmacher Date: Fri Sep 19 09:36:14 2025 +0200 smb: smbdirect: introduce smbdirect_get_buf_page_count() This is a copy of get_buf_page_count() in the server and will replace it soon. The only difference is that we now use size_t instead of int. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit a5159795248fec94d4b0995584e038d50cceb1b6 Author: Stefan Metzmacher Date: Sat Sep 20 05:42:56 2025 +0200 smb: smbdirect: split out smbdirect_connection_recv_io_refill() This will allow us to refill the recv queue in a sync way after negotiation. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2b41feecdfdf8364242fb98d9dc4e52147b72f1e Author: Stefan Metzmacher Date: Thu Sep 18 08:23:03 2025 +0200 smb: smbdirect: introduce smbdirect_connection_recv_io_refill_work() This is basically a copy of smbd_post_send_credits() in the client and smb_direct_post_recv_credits() in the server. There are several improvements compared to the existing functions: 1. We calculate the number of missing posted buffers by getting the difference between recv_io.credits.target and recv_io.posted.count. Instead of the difference between recv_io.credits.target and recv_io.credits.count, because recv_io.credits.count is only updated once a message is send to the peer. It was not really a problem before, because we have a fixed number smbdirect_recv_io buffers, so the loop terminated when smbdirect_connection_get_recv_io() returns NULL. But using recv_io.posted.count makes it easier to understand. 2. In order to tell the peer about the newly posted buffer and grant the credits, we only trigger the send immediate when we're not granting only the last possible credit (only one credit is missing to reach the desired target). This is mostly a difference relative to the servers smb_direct_post_recv_credits() implementation, which should avoid useless ping pong messages. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit dd1960ab384e9188a3d1f7db4ac8276f3edec13e Author: Stefan Metzmacher Date: Wed Sep 17 09:13:25 2025 +0200 smb: smbdirect: introduce smbdirect_connection_post_recv_io() This is basically a copy of smbd_post_recv() in the client and smb_direct_post_recv() in the server. The only difference is that this returns early if the connection is already broken. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6073eb3e31756d569c4853fb22724525739d0e0c Author: Stefan Metzmacher Date: Tue Sep 16 01:10:00 2025 +0200 smb: smbdirect: introduce smbdirect_connection_{create,destroy}_qp() smbdirect_connection_create_qp() is basically a copy of smb_direct_create_qpair() in the server, it just adds extra send_wr space for MR requests. smbdirect_connection_destroy_qp() is the cleanup code smb_direct_create_qpair() has, plus calling ib_drain_qp(), it be a no-op if no requests are posted. These additions allow the functions to be used by client and server. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 71c4b615daffe85dba6f181d4200da57d4550480 Author: Stefan Metzmacher Date: Wed Sep 17 06:19:46 2025 +0200 smb: smbdirect: introduce smbdirect_connection_negotiate_rdma_resources() This is a copy of the same logic used in client and server, it's inlined there, but they will use the new helper function soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0bac604158750d76d30f26d203242c11dd9efcfb Author: Stefan Metzmacher Date: Mon Sep 15 07:50:01 2025 +0200 smb: smbdirect: introduce smbdirect_connection_qp_event_handler() This is basically a copy of smbd_qp_async_error_upcall() in the client and smb_direct_qpair_handler() in the server. They will be replaced by the new common function soon, which will allow more code to be moved as well. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8a4d6c0d4fc4a138c7569e081389f163d2cee389 Author: Stefan Metzmacher Date: Mon Sep 15 01:41:44 2025 +0200 smb: smbdirect: introduce smbdirect_map_sges_from_iter() and helper functions These are basically copies of smb_extract_iter_to_rdma() and its helpers in the client, which will be replaced in the next steps. The goal is to use them also in the server, which will simplify a lot. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d674665d514e4cb58455a7380c5a927ea2859585 Author: Stefan Metzmacher Date: Fri Sep 12 21:35:11 2025 +0200 smb: smbdirect: introduce smbdirect_connection_{create,destroy}_mem_pools() This is based on smb_direct_{create,destroy}_pools() in the server. But it doesn't use smbdirect_connection_get_recv_io() on cleanup, instead it uses list_for_each_entry_safe()... It also keep some logic to allow userspace access to smbdirect_recv_io payload, which is needed for the client code. But it exposes the whole payload including the smbdirect_data_transfer header as documentation says data_offset = 0 and data_length != 0 would be valid, while the existing client code requires data_offset >= 24. This should replace the related server functions and also be used on the client. It also abstracts recv_io.mem.gfp_mask in order to allow server to keep using __GFP_RETRY_MAYFAIL. It also uses struct kmem_cache_args consistently as that's the currently preferred version of kmem_cache_create(). And it makes use of the mempool_create_slab_pool() helper. And it uses list_add_tail() just to let me feel better when looking at the code... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c81459bddbf758e1b9915f0c6d00d9f18ce21f49 Author: Stefan Metzmacher Date: Thu Sep 11 20:45:09 2025 +0200 smb: smbdirect: introduce smbdirect_connection_send_io_done() This is a combination of send_done() of client and server. It will replace both... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8fde1963386a2ba1b7e57a347a00fd8b98cd07d3 Author: Stefan Metzmacher Date: Thu Sep 11 19:49:18 2025 +0200 smb: smbdirect: introduce smbdirect_connection_{alloc,free}_send_io() These are more or less copies of smb_direct_{alloc,free}_sendmsg() in the server. The only difference is that we use ib_dma_unmap_page() for all sges, this simplifies the logic and doesn't matter as ib_dma_unmap_single() and ib_dma_unmap_page() both operate on dma_addr_t and dma_unmap_single_attrs() is just an alias for dma_unmap_page_attrs(). We already have in inconsistency like that in the client code where we use ib_dma_unmap_single(), while we mapped using ib_dma_map_page(). The new functions will replace the existing once in the next commits and will also be used in the client. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 64d6bd25339bb0820556af6a46e41a23a34a2ed3 Author: Stefan Metzmacher Date: Thu Sep 11 19:41:53 2025 +0200 smb: smbdirect: introduce smbdirect_socket.{send,recv}_io.mem.gfp_mask This will allow common code to be split out while still using the gfp_mask currently used. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 66a840b3ba538142fec5895cb197b1ec9f3a717c Author: Stefan Metzmacher Date: Thu Aug 28 16:45:23 2025 +0200 smb: smbdirect: introduce smbdirect_frwr_is_supported() This will replace frwr_is_supported() on the client and rdma_frwr_is_supported() on the server. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8e342e68992e93db0c999f892e7aa1eb35c67709 Author: Stefan Metzmacher Date: Thu Aug 28 13:38:29 2025 +0200 smb: smbdirect: set SMBDIRECT_KEEPALIVE_NONE before disable_delayed_work(&sc->idle.timer_work); This avoids a potential confusing log message from smbdirect_connection_idle_timer_work() if it's already running. This is a very small race windows and not really needed, but it feels better when reading the code. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1593f5d004f5f3812ba175f4253fba07853db24e Author: Stefan Metzmacher Date: Wed Aug 27 17:15:55 2025 +0200 smb: smbdirect: introduce smbdirect_connection_idle_timer_work() This is basically a copy of idle_connection_timer() in the client and smb_direct_idle_connection_timer() in the server. The only difference is that the server does not have logging. Currently the callers set their own timer function after smbdirect_socket_prepare_create(), but that will change in the next steps... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b90169bcb2a6f46b1b5d7a17d5fd15a64ab552ff Author: Stefan Metzmacher Date: Wed Aug 27 16:39:22 2025 +0200 smb: smbdirect: introduce smbdirect_connection_reassembly_{append,first}_recv_io() These are basically copies of enqueue_reassembly() and [_]get_first_reassembly() of both client and server. The only difference is that enqueue_reassembly() of the server does not have: sc->statistics.enqueue_reassembly_queue++ Also smbdirect_connection_reassembly_first_recv_io() makes use of list_first_entry_or_null() in order to simplify the code. In the next commits they will replace the existing functions. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit bb0a49edfe1ac5d831c897e4869a167cddea835f Author: Stefan Metzmacher Date: Tue Aug 26 19:05:01 2025 +0200 smb: smbdirect: introduce smbdirect_connection_{get,put}_recv_io() These are basically copies of {get,put}_receive_buffer() in the client and they are very similar to {get_free,put}_recvmsg() in the server. The only difference to {get_free,put}_recvmsg() are the updating of the sc->statistics.*. In addition smbdirect_connection_get_recv_io() uses list_first_entry_or_null() in order to simplify the code. We also only use it on a healthy connection. smbdirect_connection_put_recv_io() uses msg->socket instead of an explicit argument. And it disables any complex_work. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 3e319f26a79afa65fc98b9ce15979c6219e1be04 Author: Stefan Metzmacher Date: Tue Aug 26 15:01:28 2025 +0200 smb: smbdirect: introduce smbdirect_connection.c to be filled Over time smbdirect_connection.c will get more and more functions which will be included in fs/smb/client/smbdirect.c and fs/smb/server/transport_rdma.c via fs/smb/common/smbdirect/smbdirect_all_c_files.c in order to allow tiny steps in the direction of moving to a few exported functions from an smbdirect.ko. That's why __maybe_unused is added for now it will be removed at the end of the road to common code. Note the Copyright (C) 2017, Microsoft Corporation is added as a lot of functions from fs/smb/client/smbdirect.c will be moved into this file soon and I don't want to forget about adding it. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d85614860184f31153ff243ff06e34d76c22be7b Author: Stefan Metzmacher Date: Tue Aug 26 17:25:24 2025 +0200 smb: smbdirect: introduce smbdirect_socket_schedule_cleanup[{_lvl,_status}]() smbdirect_socket_schedule_cleanup() is more or less copy of smbd_disconnect_rdma_connection() and smb_direct_disconnect_rdma_connection(). It will replace them in the next steps. A difference is that the location of the first error is logged, which makes it easier to analyze problems. And also disable any complex work from recv_io objects, currently these are not used and the work is always disabled anyway, but this prepares future changes. It also gets an explicit error passed in instead of hardcoding -ECONNABORTED. Beside the main smbdirect_socket_schedule_cleanup() there are some special additions: - smbdirect_socket_schedule_cleanup_lvl(), will be used for cases where we don't want a log message with SMBDIRECT_LOG_ERR. - smbdirect_socket_schedule_cleanup_status(), will be used to specify the log level together with a direct final status, for the RDMA_CM_EVENT_DEVICE_REMOVAL and RDMA_CM_EVENT_DISCONNECTED cases where we need to avoid SMBDIRECT_SOCKET_DISCONNECTING and rdma_disconnect() in smbdirect_socket_cleanup_work(). With this we're also able to define a default for __SMBDIRECT_SOCKET_DISCONNECT() just using: smbdirect_socket_schedule_cleanup(__sc, -ECONNABORTED) Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1be83fad0c74b288d3664ff0677da19a997bcbf3 Author: Stefan Metzmacher Date: Tue Aug 26 16:01:15 2025 +0200 smb: smbdirect: introduce smbdirect_socket_cleanup_work() This is basically a copy of smbd_disconnect_rdma_work() and smb_direct_disconnect_rdma_work() and will replace them in the next steps. Differences is that a message is logged if first error is still 0, which makes it easier to analyze problems. And also disable any complex work from recv_io objects, currently these are not used and the work is always disabled anyway, but this prepares future changes. It also makes sure it's never used in an interrupt, which is not expected anyway... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 67ac123e026b8b98e6d2f3f7ba3706c32ecde019 Author: Stefan Metzmacher Date: Tue Sep 2 12:42:51 2025 +0200 smb: smbdirect: introduce smbdirect_socket_wake_up_all() This is a superset of smbd_disconnect_wake_up_all() in the client and smb_direct_disconnect_wake_up_all() in the server and will replace them. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 036614cb738a9d092814eba48286da6e1c63f704 Author: Stefan Metzmacher Date: Thu Oct 23 13:40:43 2025 +0200 smb: smbdirect: introduce smbdirect_socket_set_logging() This will be used by client and server in order to setup their own logging functions. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit df76b456280ba2c467907b9f25e1ddc8aea773f1 Author: Stefan Metzmacher Date: Tue Aug 26 15:01:28 2025 +0200 smb: smbdirect: introduce smbdirect_socket_prepare_create() This will be used by client and server until we reach the point where we have only public function from an smbdirect.ko. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 83c769a9f45cc4a111e60690fa5e64929dba948a Author: Stefan Metzmacher Date: Tue Aug 26 15:01:28 2025 +0200 smb: smbdirect: introduce smbdirect_socket.c to be filled Over time smbdirect_socket.c will get more and more functions which will be included in fs/smb/client/smbdirect.c and fs/smb/server/transport_rdma.c via fs/smb/common/smbdirect/smbdirect_all_c_files.c in order to allow tiny steps in the direction of moving to a few exported functions from an smbdirect.ko. That's why __maybe_unused is added for now it will be removed at the end of the road to common code. Note the Copyright (C) 2017, Microsoft Corporation is added as a lot of functions from fs/smb/client/smbdirect.c will be moved into this file soon and I don't want to forget about adding it. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit cdb9545c238ff175e72b38269dc6d89c9ccd30b2 Author: Stefan Metzmacher Date: Tue Aug 26 15:24:33 2025 +0200 smb: server: include smbdirect_all_c_files.c This is the first tiny step in order to use common functions in future. Once we have all functions in common we'll move to an smbdirect.ko that exports public functions instead of including the .c file. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit bd33b696eb1638a169975552eb4bda3e5ab2cddc Author: Stefan Metzmacher Date: Tue Aug 26 15:24:33 2025 +0200 smb: client: include smbdirect_all_c_files.c This is the first tiny step in order to use common functions in future. Once we have all functions in common we'll move to an smbdirect.ko that exports public functions instead of including the .c file. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Arnd Bergmann Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 86bca3df0fa0e6f9efd81165900de0af098f6bc2 Author: Stefan Metzmacher Date: Tue Oct 28 11:11:16 2025 +0100 smb: smbdirect: introduce smbdirect_internal.h This will be included by individual .c files as first header. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0a6428978df1c16971db0b0daae60b8fc0c4eb9b Author: Stefan Metzmacher Date: Fri Oct 24 15:48:15 2025 +0200 smb: smbdirect: introduce smbdirect_all_c_files.c This is a very basic start in order to introduce common functions, which will be shared by client and server. As a start smbdirect_all_c_files.c will be included in fs/smb/client/smbdirect.c and fs/smb/server/transport_rdma.c in order to allow tiny steps in the direction of moving to a few exported functions from an smbdirect.ko. Step by step this will include individual c files with the real functions. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8fc518e489c1386fd0cf7f4256d055960ed6a2e4 Author: Yufan Chen Date: Tue Mar 24 23:30:23 2026 +0800 9p/trans_xen: replace simple_strto* with kstrtouint In xen_9pfs_front_init(), parse the backend version list as comma-separated tokens with kstrtouint(), keep strict token validation, and explicitly require protocol version 1 to be present. This replaces the deprecated simple_strtoul(), improves error reporting consistency, and avoids partially parsed values in control paths. Signed-off-by: Yufan Chen Reviewed-by: Stefano Stabellini Message-ID: <20260324153023.86853-3-ericterminal@gmail.com> Signed-off-by: Dominique Martinet commit 72cb9ee4f6d80962df17c9763b14e62e28fd85a2 Author: Yufan Chen Date: Tue Mar 24 23:30:22 2026 +0800 9p/trans_xen: make cleanup idempotent after dataring alloc errors xen_9pfs_front_alloc_dataring() tears down resources on failure but leaves ring fields stale. If xen_9pfs_front_init() later jumps to the common error path, xen_9pfs_front_free() may touch the same resources again, causing duplicate/invalid gnttab_end_foreign_access() calls and potentially dereferencing a freed intf pointer. Initialize dataring sentinels before allocation, gate teardown on those sentinels, and clear ref/intf/data/irq immediately after each release. This keeps cleanup idempotent for partially initialized rings and prevents repeated teardown during init failure handling. Signed-off-by: Yufan Chen Reviewed-by: Stefano Stabellini Message-ID: <20260324153023.86853-2-ericterminal@gmail.com> Signed-off-by: Dominique Martinet commit 890d56964c62dfbe228b30b157811088cf64f9f1 Author: Kit Dallege Date: Sun Mar 15 20:06:33 2026 +0100 9p: document missing enum values in kernel-doc comments Add kernel-doc entries for all undocumented enum values: - p9_debug_flags: P9_DEBUG_CACHE, P9_DEBUG_MMAP - p9_msg_t: all 9P2000.L message types (TLOPEN/RLOPEN through TUNLINKAT/RUNLINKAT) - p9_open_mode_t: P9L_MODE_MASK, P9L_DIRECT, P9L_NOWRITECACHE, P9L_LOOSE Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Kit Dallege Reviewed-by: Christian Schoenebeck Message-ID: <20260315190633.73536-1-xaum.io@gmail.com> Signed-off-by: Dominique Martinet commit da2346a48a5a1fed86c3fe3d73c0b60e7b3027c9 Author: Pierre Barre Date: Thu Apr 2 12:03:12 2026 +0200 9p: fix access mode flags being ORed instead of replaced Since commit 1f3e4142c0eb ("9p: convert to the new mount API"), v9fs_apply_options() applies parsed mount flags with |= onto flags already set by v9fs_session_init(). For 9P2000.L, session_init sets V9FS_ACCESS_CLIENT as the default, so when the user mounts with "access=user", both bits end up set. Access mode checks compare against exact values, so having both bits set matches neither mode. This causes v9fs_fid_lookup() to fall through to the default switch case, using INVALID_UID (nobody/65534) instead of current_fsuid() for all fid lookups. Root is then unable to chown or perform other privileged operations. Fix by clearing the access mask before applying the user's choice. Fixes: 1f3e4142c0eb ("9p: convert to the new mount API") Signed-off-by: Pierre Barre Reviewed-by: Christian Schoenebeck Message-ID: <0ddc72da-d196-4f01-8755-0086f670e779@app.fastmail.com> Cc: stable@vger.kernel.org Signed-off-by: Dominique Martinet commit 1d51b370a0f8f642f4fc84c795fbedac0fcdbbd2 Merge: 5414f3fd54b3a3 dad98c5b2a05ef Author: Linus Torvalds Date: Wed Apr 15 19:29:18 2026 -0700 Merge tag 'jfs-7.1' of github.com:kleikamp/linux-shaggy Pull jfs updates from Dave Kleikamp: "More robust data integrity checking and some fixes" * tag 'jfs-7.1' of github.com:kleikamp/linux-shaggy: jfs: avoid -Wtautological-constant-out-of-range-compare warning again JFS: always load filesystem UUID during mount jfs: hold LOG_LOCK on umount to avoid null-ptr-deref jfs: Set the lbmDone flag at the end of lbmIODone jfs: fix corrupted list in dbUpdatePMap jfs: add dmapctl integrity check to prevent invalid operations jfs: add dtpage integrity check to prevent index/pointer overflows jfs: add dtroot integrity check to prevent index out-of-bounds commit 5414f3fd54b3a3f7f63f3edd276fb55281ecbe3b Merge: c4ef28fe97556d 25947cc5b2374c Author: Linus Torvalds Date: Wed Apr 15 19:22:16 2026 -0700 Merge tag 'fs_for_v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2, udf, quota updates from Jan Kara: - A fix for a race in quota code that can expose ocfs2 to use-after-free issues - UDF fix to avoid memory corruption in face of corrupted format - Couple of ext2 fixes for better handling of fs corruption - Some more various code cleanups in UDF & ext2 * tag 'fs_for_v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() ext2: use get_random_u32() where appropriate quota: Fix race of dquot_scan_active() with quota deactivation udf: fix partition descriptor append bookkeeping ext2: avoid drop_nlink() during unlink of zero-nlink inode in ext2_unlink() ext2: guard reservation window dump with EXT2FS_DEBUG ext2: replace BUG_ON with WARN_ON_ONCE in ext2_get_blocks ext2: remove stale TODO about kmap fs: udf: avoid assignment in condition when selecting allocation goal commit c4ef28fe97556db32ffcbfb4cf8bd7c2b34c3b9a Merge: 048091722259b6 0fdbe845534f4e Author: Linus Torvalds Date: Wed Apr 15 19:18:51 2026 -0700 Merge tag 'fsnotify_for_v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "A couple of small fsnotify fixes and cleanups" * tag 'fsnotify_for_v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: replace deprecated strcpy in fanotify_info_copy_{name,name2} fsnotify: inotify: pass mark connector to fsnotify_recalc_mask() fanotify: call fanotify_events_supported() before path_permission() and security_path_notify() fanotify: avoid/silence premature LSM capability checks inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails commit 048091722259b6e8d2ef3b138b0c121a2afabe61 Merge: 4da0dd95be3b03 2de35d992ba1e4 Author: Linus Torvalds Date: Wed Apr 15 19:14:01 2026 -0700 Merge tag 'v7.1-rc-part1-ksmbd-srv-fixes' of git://git.samba.org/ksmbd Pull smb server updates from Steve French: - smbdirect double free fixes - Add some smbdirect logging - Minor cleanup in crypto, and smbdirect and in IPC handling - Minor cleanup to move header info to common FSCC code - Fix crypt message use after free - Fix memory leak in session setup - Fix for DACL parsing - Fix EA name length validation - Reconnect fix - Fix use after free in close * tag 'v7.1-rc-part1-ksmbd-srv-fixes' of git://git.samba.org/ksmbd: smb: smbdirect: add some logging to SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}() smb: smbdirect: introduce smbdirect_socket.logging infrastructure smb: smbdirect: let smbdirect.h include #include smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc ksmbd: require 3 sub-authorities before reading sub_auth[2] ksmbd: validate EaNameLength in smb2_get_ea() ksmbd: Remove unnecessary selection of CRYPTO_ECB ksmbd: validate owner of durable handle on reconnect ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger ksmbd: ipc: use kzalloc_flex and __counted_by smb: move filesystem_vol_info into common/fscc.h smb: move file_basic_info into common/fscc.h smb: move some definitions from common/smb2pdu.h into common/fscc.h commit 4da0dd95be3b0321bf9687fb1a3c2fed3319c032 Merge: acf6c670e47630 74b4dbb946060a Author: Linus Torvalds Date: Wed Apr 15 19:12:04 2026 -0700 Merge tag 'gfs2-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Fix possible data loss during inode evict - Fix a race during bufdata allocation - More careful cleaning up during a withdraw - Prevent excessive log flushing under memory pressure - Various other minor fixes and cleanups * tag 'gfs2-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: prevent NULL pointer dereference during unmount gfs2: hide error messages after withdraw gfs2: wait for withdraw earlier during unmount gfs2: inode directory consistency checks gfs2: gfs2_log_flush withdraw fixes gfs2: add some missing log locking gfs2: fix address space truncation during withdraw gfs2: drain ail under sd_log_flush_lock gfs2: bufdata allocation race gfs2: Remove trans_drain code duplication gfs2: Move gfs2_remove_from_journal to log.c gfs2: Get rid of gfs2_log_[un]lock helpers gfs2: less aggressive low-memory log flushing gfs2: Fix data loss during inode evict gfs2: minor evict_[un]linked_inode cleanup gfs2: Avoid unnecessary transactions in evict_linked_inode gfs2: Remove unnecessary check in gfs2_evict_inode gfs2: Call unlock_new_inode before d_instantiate commit acf6c670e476304c89b5e9320ca8f9d20c9e0aa8 Merge: 9e1e9d660255d7 2339f9cc9f080e Author: Linus Torvalds Date: Wed Apr 15 19:04:21 2026 -0700 Merge tag 'fuse-update-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse update from Miklos Szeredi: - Fix possible hang in virtiofs when cleaning up a DAX inode (Sergio Lopez) - Fix a warning when using large folio as the source of SPLICE_F_MOVE on the fuse device (Bernd) - Fix uninitialized value found by KMSAN (Luis Henriques) - Fix synchronous INIT hang (Miklos) - Fix race between inode initialization and FUSE_NOTIFY_INVAL_INODE (Horst) - Allow fd to be closed after passing fuse device fd to fsconfig(..., "fd", ...) (Miklos) - Support FSCONFIG_SET_FD for "fd" option (Miklos) - Misc fixes and cleanups * tag 'fuse-update-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (21 commits) fuse: support FSCONFIG_SET_FD for "fd" option fuse: clean up device cloning fuse: don't require /dev/fuse fd to be kept open during mount fuse: add refcount to fuse_dev fuse: create fuse_dev on /dev/fuse open instead of mount fuse: check connection state on notification fuse: fuse_dev_ioctl_clone() should wait for device file to be initialized fuse: fix inode initialization race fuse: abort on fatal signal during sync init fuse: fix uninit-value in fuse_dentry_revalidate() fuse: use offset_in_page() for page offset calculations fuse: use DIV_ROUND_UP() for page count calculations fuse: simplify logic in fuse_notify_store() and fuse_retrieve() fuse: validate outarg offset and size in notify store/retrieve fuse: Check for large folio with SPLICE_F_MOVE fuse: quiet down complaints in fuse_conn_limit_write fuse: drop unnecessary argument from fuse_lookup_init() fuse: fix premature writetrhough request for large folio fuse: refactor duplicate queue teardown operation virtiofs: add FUSE protocol validation ... commit 0fd76f1be20d19ac593138ceec502cb044c909bd Author: Sasha Levin Date: Wed Feb 25 08:57:45 2026 -0500 9p: fix memory leak in v9fs_init_fs_context error path Move the assignments of fc->ops and fc->fs_private to right after the kzalloc, before any fallible operations. Previously these were assigned at the end of the function, after the kstrdup calls for uname and aname. If either kstrdup failed, the error path would set fc->need_free but leave fc->ops NULL, so put_fs_context() would never call v9fs_free_fc() to free the allocated context and any already-duplicated strings. Fixes: 1f3e4142c0eb ("9p: convert to the new mount API") Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Sasha Levin Message-ID: <20260225135745.351984-1-sashal@kernel.org> Signed-off-by: Dominique Martinet commit 9e1e9d660255d7216067193d774f338d08d8528d Merge: fdbfee9fc56e13 82374995b63d2d Author: Linus Torvalds Date: Wed Apr 15 17:48:24 2026 -0700 Merge tag 'trace-rtla-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull RTLA updates from Steven Rostedt: - Simplify option parsing Auto-generate getopt_long() optstring for short options from long options array, avoiding the need to specify it manually and reducing the surface for mistakes. - Add unit tests Implement unit tests (make unit-tests) using libcheck, next to existing runtime tests (make check). Currently, three functions from utils.c are tested. - Add --stack-format option In addition to stopping stack pointer decoding (with -s/--stack option) on first unresolvable pointer, allow also skipping unresolvable pointers and displaying everything, configurable with a new option. - Unify number of CPUs into one global variable Use one global variable, nr_cpus, to store the number of CPUs instead of retrieving it and passing it at multiple places. - Fix behavior in various corner cases Make RTLA behave correctly in several corner cases: memory allocation failure, invalid value read from kernel side, thread creation failure, malformed time value input, and read/write failure or interruption by signal. - Improve string handling Simplify several places in the code that handle strings, including parsing of action arguments. A few new helper functions and variables are added for that purpose. - Get rid of magic numbers Few places handling paths use a magic number of 1024. Replace it with MAX_PATH and ARRAY_SIZE() macro. - Unify threshold handling Code that handles response to latency threshold is duplicated between tools, which has led to bugs in the past. Unify it into a new helper as much as possible. - Fix segfault on SIGINT during cleanup The SIGINT handler touches dynamically allocated memory. Detach it before freeing it during cleanup to prevent segmentation fault and discarding of output buffers. Also, properly document SIGINT handling while at it. * tag 'trace-rtla-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (28 commits) Documentation/rtla: Document SIGINT behavior rtla: Fix segfault on multiple SIGINTs rtla/utils: Fix loop condition in PID validation rtla/utils: Fix resource leak in set_comm_sched_attr() rtla/trace: Fix I/O handling in save_trace_to_file() rtla/trace: Fix write loop in trace_event_save_hist() rtla/timerlat: Simplify RTLA_NO_BPF environment variable check rtla: Use str_has_prefix() for option prefix check rtla: Enforce exact match for time unit suffixes rtla: Use str_has_prefix() for prefix checks rtla: Add str_has_prefix() helper function rtla: Handle pthread_create() failure properly rtla/timerlat: Add bounds check for softirq vector rtla: Simplify code by caching string lengths rtla: Replace magic number with MAX_PATH rtla: Introduce common_threshold_handler() helper rtla/actions: Simplify argument parsing rtla: Use strdup() to simplify code rtla: Exit on memory allocation failures during initialization tools/rtla: Remove unneeded nr_cpus from for_each_monitored_cpu ... commit a20446652956ed26be529b8788e76dfddf705717 Merge: 9d8e92e15f7579 64c2f93fc3254d Author: Martin KaFai Lau Date: Wed Apr 15 13:15:25 2026 -0700 Merge branch 'bpf-sockmap-fix-af_unix-null-ptr-deref-in-proto-update' Michal Luczaj says: ==================== bpf, sockmap: Fix af_unix null-ptr-deref in proto update Updating sockmap/sockhash using a unix sock races unix_stream_connect(): when sock_map_sk_state_allowed() passes (sk_state == TCP_ESTABLISHED), unix_peer(sk) in unix_stream_bpf_update_proto() may still return NULL. ==================== Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-0-2af6fe97918e@rbox.co Signed-off-by: Martin KaFai Lau commit 64c2f93fc3254d3bf5de4445fb732ee5c451edb6 Author: Michal Luczaj Date: Tue Apr 14 16:13:19 2026 +0200 bpf, sockmap: Take state lock for af_unix iter When a BPF iterator program updates a sockmap, there is a race condition in unix_stream_bpf_update_proto() where the `peer` pointer can become stale[1] during a state transition TCP_ESTABLISHED -> TCP_CLOSE. CPU0 bpf CPU1 close -------- ---------- // unix_stream_bpf_update_proto() sk_pair = unix_peer(sk) if (unlikely(!sk_pair)) return -EINVAL; // unix_release_sock() skpair = unix_peer(sk); unix_peer(sk) = NULL; sock_put(skpair) sock_hold(sk_pair) // UaF More practically, this fix guarantees that the iterator program is consistently provided with a unix socket that remains stable during iterator execution. [1]: BUG: KASAN: slab-use-after-free in unix_stream_bpf_update_proto+0x155/0x490 Write of size 4 at addr ffff8881178c9a00 by task test_progs/2231 Call Trace: dump_stack_lvl+0x5d/0x80 print_report+0x170/0x4f3 kasan_report+0xe4/0x1c0 kasan_check_range+0x125/0x200 unix_stream_bpf_update_proto+0x155/0x490 sock_map_link+0x71c/0xec0 sock_map_update_common+0xbc/0x600 sock_map_update_elem+0x19a/0x1f0 bpf_prog_bbbf56096cdd4f01_selective_dump_unix+0x20c/0x217 bpf_iter_run_prog+0x21e/0xae0 bpf_iter_unix_seq_show+0x1e0/0x2a0 bpf_seq_read+0x42c/0x10d0 vfs_read+0x171/0xb20 ksys_read+0xff/0x200 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 2236: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x63/0x80 kmem_cache_alloc_noprof+0x1d5/0x680 sk_prot_alloc+0x59/0x210 sk_alloc+0x34/0x470 unix_create1+0x86/0x8a0 unix_stream_connect+0x318/0x15b0 __sys_connect+0xfd/0x130 __x64_sys_connect+0x72/0xd0 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 2236: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x47/0x70 kmem_cache_free+0x11c/0x590 __sk_destruct+0x432/0x6e0 unix_release_sock+0x9b3/0xf60 unix_release+0x8a/0xf0 __sock_release+0xb0/0x270 sock_close+0x18/0x20 __fput+0x36e/0xac0 fput_close_sync+0xe5/0x1a0 __x64_sys_close+0x7d/0xd0 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 2c860a43dd77 ("bpf: af_unix: Implement BPF iterator for UNIX domain socket.") Suggested-by: Kuniyuki Iwashima Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-5-2af6fe97918e@rbox.co commit dca38b7734d2ea00af4818ff3ae836fab33d5d5a Author: Michal Luczaj Date: Tue Apr 14 16:13:18 2026 +0200 bpf, sockmap: Fix af_unix null-ptr-deref in proto update unix_stream_connect() sets sk_state (`WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)`) _before_ it assigns a peer (`unix_peer(sk) = newsk`). sk_state == TCP_ESTABLISHED makes sock_map_sk_state_allowed() believe that socket is properly set up, which would include having a defined peer. IOW, there's a window when unix_stream_bpf_update_proto() can be called on socket which still has unix_peer(sk) == NULL. CPU0 bpf CPU1 connect -------- ------------ WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED) sock_map_sk_state_allowed(sk) ... sk_pair = unix_peer(sk) sock_hold(sk_pair) sock_hold(newsk) smp_mb__after_atomic() unix_peer(sk) = newsk BUG: kernel NULL pointer dereference, address: 0000000000000080 RIP: 0010:unix_stream_bpf_update_proto+0xa0/0x1b0 Call Trace: sock_map_link+0x564/0x8b0 sock_map_update_common+0x6e/0x340 sock_map_update_elem_sys+0x17d/0x240 __sys_bpf+0x26db/0x3250 __x64_sys_bpf+0x21/0x30 do_syscall_64+0x6b/0x3a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Initial idea was to move peer assignment _before_ the sk_state update[1], but that involved an additional memory barrier, and changing the hot path was rejected. Then a NULL check during proto update in unix_stream_bpf_update_proto() was considered[2], but the follow-up discussion[3] focused on the root cause, i.e. sockmap update taking a wrong lock. Or, more specifically, missing unix_state_lock()[4]. In the end it was concluded that teaching sockmap about the af_unix locking would be unnecessarily complex[5]. Complexity aside, since BPF_PROG_TYPE_SCHED_CLS and BPF_PROG_TYPE_SCHED_ACT are allowed to update sockmaps, sock_map_update_elem() taking the unix lock, as it is currently implemented in unix_state_lock(): spin_lock(&unix_sk(s)->lock), would be problematic. unix_state_lock() taken in a process context, followed by a softirq-context TC BPF program attempting to take the same spinlock -- deadlock[6]. This way we circled back to the peer check idea[2]. [1]: https://lore.kernel.org/netdev/ba5c50aa-1df4-40c2-ab33-a72022c5a32e@rbox.co/ [2]: https://lore.kernel.org/netdev/20240610174906.32921-1-kuniyu@amazon.com/ [3]: https://lore.kernel.org/netdev/7603c0e6-cd5b-452b-b710-73b64bd9de26@linux.dev/ [4]: https://lore.kernel.org/netdev/CAAVpQUA+8GL_j63CaKb8hbxoL21izD58yr1NvhOhU=j+35+3og@mail.gmail.com/ [5]: https://lore.kernel.org/bpf/CAAVpQUAHijOMext28Gi10dSLuMzGYh+jK61Ujn+fZ-wvcODR2A@mail.gmail.com/ [6]: https://lore.kernel.org/bpf/dd043c69-4d03-46fe-8325-8f97101435cf@linux.dev/ Summary of scenarios where af_unix/stream connect() may race a sockmap update: 1. connect() vs. bpf(BPF_MAP_UPDATE_ELEM), i.e. sock_map_update_elem_sys() Implemented NULL check is sufficient. Once assigned, socket peer won't be released until socket fd is released. And that's not an issue because sock_map_update_elem_sys() bumps fd refcnf. 2. connect() vs BPF program doing update Update restricted per verifier.c:may_update_sockmap() to BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER BPF_PROG_TYPE_SOCK_OPS (bpf_sock_map_update() only) BPF_PROG_TYPE_SOCKET_FILTER BPF_PROG_TYPE_SCHED_CLS BPF_PROG_TYPE_SCHED_ACT BPF_PROG_TYPE_XDP BPF_PROG_TYPE_SK_REUSEPORT BPF_PROG_TYPE_FLOW_DISSECTOR BPF_PROG_TYPE_SK_LOOKUP Plus one more race to consider: CPU0 bpf CPU1 connect -------- ------------ WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED) sock_map_sk_state_allowed(sk) sock_hold(newsk) smp_mb__after_atomic() unix_peer(sk) = newsk sk_pair = unix_peer(sk) if (unlikely(!sk_pair)) return -EINVAL; CPU1 close ---------- skpair = unix_peer(sk); unix_peer(sk) = NULL; sock_put(skpair) // use after free? sock_hold(sk_pair) 2.1 BPF program invoking helper function bpf_sock_map_update() -> BPF_CALL_4(bpf_sock_map_update(), ...) Helper limited to BPF_PROG_TYPE_SOCK_OPS. Nevertheless, a unix sock might be accessible via bpf_map_lookup_elem(). Which implies sk already having psock, which in turn implies sk already having sk_pair. Since sk_psock_destroy() is queued as RCU work, sk_pair won't go away while BPF executes the update. 2.2 BPF program invoking helper function bpf_map_update_elem() -> sock_map_update_elem() 2.2.1 Unix sock accessible to BPF prog only via sockmap lookup in BPF_PROG_TYPE_SOCKET_FILTER, BPF_PROG_TYPE_SCHED_CLS, BPF_PROG_TYPE_SCHED_ACT, BPF_PROG_TYPE_XDP, BPF_PROG_TYPE_SK_REUSEPORT, BPF_PROG_TYPE_FLOW_DISSECTOR, BPF_PROG_TYPE_SK_LOOKUP. Pretty much the same as case 2.1. 2.2.2 Unix sock accessible to BPF program directly: BPF_PROG_TYPE_TRACING, narrowed down to BPF_TRACE_ITER. Sockmap iterator (sock_map_seq_ops) is safe: unix sock residing in a sockmap means that the sock already went through the proto update step. Unix sock iterator (bpf_iter_unix_seq_ops), on the other hand, gives access to socks that may still be unconnected. Which means iterator prog can race sockmap/proto update against connect(). BUG: KASAN: null-ptr-deref in unix_stream_bpf_update_proto+0x253/0x4d0 Write of size 4 at addr 0000000000000080 by task test_progs/3140 Call Trace: dump_stack_lvl+0x5d/0x80 kasan_report+0xe4/0x1c0 kasan_check_range+0x125/0x200 unix_stream_bpf_update_proto+0x253/0x4d0 sock_map_link+0x71c/0xec0 sock_map_update_common+0xbc/0x600 sock_map_update_elem+0x19a/0x1f0 bpf_prog_bbbf56096cdd4f01_selective_dump_unix+0x20c/0x217 bpf_iter_run_prog+0x21e/0xae0 bpf_iter_unix_seq_show+0x1e0/0x2a0 bpf_seq_read+0x42c/0x10d0 vfs_read+0x171/0xb20 ksys_read+0xff/0x200 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e While the introduced NULL check prevents null-ptr-deref in the BPF program path as well, it is insufficient to guard against a poorly timed close() leading to a use-after-free. This will be addressed in a subsequent patch. Fixes: c63829182c37 ("af_unix: Implement ->psock_update_sk_prot()") Closes: https://lore.kernel.org/netdev/ba5c50aa-1df4-40c2-ab33-a72022c5a32e@rbox.co/ Reported-by: Michal Luczaj Reported-by: 钱一铭 Suggested-by: Kuniyuki Iwashima Suggested-by: Martin KaFai Lau Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-4-2af6fe97918e@rbox.co commit 997b8483d44c60805c71a9882376a16eb176cb24 Author: Michal Luczaj Date: Tue Apr 14 16:13:17 2026 +0200 selftests/bpf: Extend bpf_iter_unix to attempt deadlocking Updating a sockmap from a unix iterator prog may lead to a deadlock. Piggyback on the original selftest. Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Reviewed-by: Jiayuan Chen Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-3-2af6fe97918e@rbox.co commit 4d328dd695383224aa750ddee6b4ad40c0f8d205 Author: Michal Luczaj Date: Tue Apr 14 16:13:16 2026 +0200 bpf, sockmap: Fix af_unix iter deadlock bpf_iter_unix_seq_show() may deadlock when lock_sock_fast() takes the fast path and the iter prog attempts to update a sockmap. Which ends up spinning at sock_map_update_elem()'s bh_lock_sock(): WARNING: possible recursive locking detected test_progs/1393 is trying to acquire lock: ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: sock_map_update_elem+0xdb/0x1f0 but task is already holding lock: ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(slock-AF_UNIX); lock(slock-AF_UNIX); *** DEADLOCK *** May be due to missing lock nesting notation 4 locks held by test_progs/1393: #0: ffff88814b59c790 (&p->lock){+.+.}-{4:4}, at: bpf_seq_read+0x59/0x10d0 #1: ffff88811ec25fd8 (sk_lock-AF_UNIX){+.+.}-{0:0}, at: bpf_seq_read+0x42c/0x10d0 #2: ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0 #3: ffffffff85a6a7c0 (rcu_read_lock){....}-{1:3}, at: bpf_iter_run_prog+0x51d/0xb00 Call Trace: dump_stack_lvl+0x5d/0x80 print_deadlock_bug.cold+0xc0/0xce __lock_acquire+0x130f/0x2590 lock_acquire+0x14e/0x2b0 _raw_spin_lock+0x30/0x40 sock_map_update_elem+0xdb/0x1f0 bpf_prog_2d0075e5d9b721cd_dump_unix+0x55/0x4f4 bpf_iter_run_prog+0x5b9/0xb00 bpf_iter_unix_seq_show+0x1f7/0x2e0 bpf_seq_read+0x42c/0x10d0 vfs_read+0x171/0xb20 ksys_read+0xff/0x200 do_syscall_64+0x6b/0x3a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 2c860a43dd77 ("bpf: af_unix: Implement BPF iterator for UNIX domain socket.") Suggested-by: Kuniyuki Iwashima Suggested-by: Martin KaFai Lau Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Reviewed-by: Jiayuan Chen Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-2-2af6fe97918e@rbox.co commit a25566084e391348385a72dd507e0cc0c268dd5d Author: Michal Luczaj Date: Tue Apr 14 16:13:15 2026 +0200 bpf, sockmap: Annotate af_unix sock:: Sk_state data-races sock_map_sk_state_allowed() and sock_map_redirect_allowed() read af_unix socket sk_state locklessly. Use READ_ONCE(). Note that for sock_map_redirect_allowed() change affects not only af_unix, but all non-TCP sockets (UDP, af_vsock). Suggested-by: Kuniyuki Iwashima Suggested-by: Martin KaFai Lau Signed-off-by: Michal Luczaj Signed-off-by: Martin KaFai Lau Reviewed-by: Jiayuan Chen Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-1-2af6fe97918e@rbox.co commit fdbfee9fc56e13a1307868829d438ad66ab308a4 Merge: 5ed19574ebf0ba 00f0dadde8c503 Author: Linus Torvalds Date: Wed Apr 15 17:15:18 2026 -0700 Merge tag 'trace-rv-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull runtime verification updates from Steven Rostedt: - Refactor da_monitor header to share handlers across monitor types No functional changes, only less code duplication. - Add Hybrid Automata model class Add a new model class that extends deterministic automata by adding constraints on transitions and states. Those constraints can take into account wall-clock time and as such allow RV monitor to make assertions on real time. Add documentation and code generation scripts. - Add stall monitor as hybrid automaton example Add a monitor that triggers a violation when a task is stalling as an example of automaton working with real time variables. - Convert the opid monitor to a hybrid automaton The opid monitor can be heavily simplified if written as a hybrid automaton: instead of tracking preempt and interrupt enable/disable events, it can just run constraints on the preemption/interrupt states when events like wakeup and need_resched verify. - Add support for per-object monitors in DA/HA Allow writing deterministic and hybrid automata monitors for generic objects (e.g. any struct), by exploiting a hash table where objects are saved. This allows to track more than just tasks in RV. For instance it will be used to track deadline entities in deadline monitors. - Add deadline tracepoints and move some deadline utilities Prepare the ground for deadline monitors by defining events and exporting helpers. - Add nomiss deadline monitor Add first example of deadline monitor asserting all entities complete before their deadline. - Improve rvgen error handling Introduce AutomataError exception class and better handle expected exceptions while showing a backtrace for unexpected ones. - Improve python code quality in rvgen Refactor the rvgen generation scripts to align with python best practices: use f-strings instead of %, use len() instead of __len__(), remove semicolons, use context managers for file operations, fix whitespace violations, extract magic strings into constants, remove unused imports and methods. - Fix small bugs in rvgen The generator scripts presented some corner case bugs: logical error in validating what a correct dot file looks like, fix an isinstance() check, enforce a dot file has an initial state, fix type annotations and typos in comments. - rvgen refactoring Refactor automata.py to use iterator-based parsing and handle required arguments directly in argparse. - Allow epoll in rtapp-sleep monitor The epoll_wait call is now rt-friendly so it should be allowed in the sleep monitor as a valid sleep method. * tag 'trace-rv-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (32 commits) rv: Allow epoll in rtapp-sleep monitor rv/rvgen: fix _fill_states() return type annotation rv/rvgen: fix unbound loop variable warning rv/rvgen: enforce presence of initial state rv/rvgen: extract node marker string to class constant rv/rvgen: fix isinstance check in Variable.expand() rv/rvgen: make monitor arguments required in rvgen rv/rvgen: remove unused __get_main_name method rv/rvgen: remove unused sys import from dot2c rv/rvgen: refactor automata.py to use iterator-based parsing rv/rvgen: use class constant for init marker rv/rvgen: fix DOT file validation logic error rv/rvgen: fix PEP 8 whitespace violations rv/rvgen: fix typos in automata and generator docstring and comments rv/rvgen: use context managers for file operations rv/rvgen: remove unnecessary semicolons rv/rvgen: replace __len__() calls with len() rv/rvgen: replace % string formatting with f-strings rv/rvgen: remove bare except clauses in generator rv/rvgen: introduce AutomataError exception class ... commit 5ed19574ebf0ba857c8a0d3d80ee409ff9498363 Merge: b7f84966b6f176 81fca7087466bd Author: Linus Torvalds Date: Wed Apr 15 17:11:22 2026 -0700 Merge tag 'ktest-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest Pull ktest updates from Steven Rostedt: - Fix undef warning when WARNINGS_FILE is unset The check_buildlog() references WARNINGS_FILE even when it's not set. Perl triggers a warning in this case. Check if the WARNINGS_FILE is defined before checking if the file it represents exists. - Fix how LOG_FILE is resolved LOG_FILE is expanded immediately after the config file is parsed. If LOG_FILE depends on variables from the tests it will use stale values instead of using the test variables. Have LOG_FILE also resolve test variables. - Treat a undefined self reference variable as empty Variables can recursively include itself for appending. Currently, if the references itself and it is not defined, it leaves the variable in the define: "VAR = ${VAR} foo" keeps the ${VAR} around. Have it removed instead. - Fix clearing of variables per tests If a variable has a defined default, a test can not clear it by assigning the variable to empty. Fix this by clearing the variable for a test when the test config has that variable assigned to nothing. - Fix run_command() to catch stderr in the shell command parsing Switch to Perl list form open to use "sh -c" wrapper to run shell commands to have the log file catch shell parsing errors. - Fix console output during reboot cycle The POWER_CYCLE callback during reboot() can miss output from the next boot making ktest miss the boot string it was waiting for. - Add PRE_KTEST_DIE for PRE_KTEST failures If the command for PRE_KTEST fails, ktest does not fail (this was by design as this command was used to add patches that may or may not apply). Add PRE_KTEST_DIE value to force ktest to fail if PRE_KTEST fails. - Run POST_KTEST hooks on failure and cancellation PRE_KTEST always runs before a ktest test, have POST_KTEST always run after a test even if the test fails or is cancelled to do the teardown of PRE_KTEST. - Add a --dry-run mode Add --dry-run to parse the config, print the results and exit without running any of the tests. - Store failures from the dodie() path as well The STORE_FAILURES saves the logs on failure, but there's failure paths that miss storing. Perform STORE_FAILURES in dodie() to capture these failures too. * tag 'ktest-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest: ktest: Store failure logs also in fatal paths ktest: Add a --dry-run mode ktest: Run POST_KTEST hooks on failure and cancellation ktest: Add PRE_KTEST_DIE for PRE_KTEST failures ktest: Stop dropping console output during power-cycle reboot ktest: Run commands through list-form shell open ktest: Honor empty per-test option overrides ktest: Treat undefined self-reference as empty ktest: Resolve LOG_FILE in test option context ktest: Avoid undef warning when WARNINGS_FILE is unset commit 9d8e92e15f75794c469f586a2c47fab58f093a3a Merge: d3fdb3db13a209 969fb456ffb43d Author: Alexei Starovoitov Date: Wed Apr 15 16:46:47 2026 -0700 Merge branch 'bpf-copy-bpf-token-from-main-program-to-subprograms' Eduard Zingerman says: ==================== bpf: copy BPF token from main program to subprograms bpf_jit_subprogs() omits aux->token when it creates a struct bpf_prog_aux instances for a subprograms. This means that for programs loaded via BPF token (i.e., from a non-init user namespace), subprograms fail the bpf_token_capable() check in bpf_prog_kallsyms_add() and don't appear in /proc/kallsyms. Which in-turn makes it impossible to freplace such subprograms. Changelog: v3 -> v4: - check sysctl_set calls for errors (sashiko). v2 -> v3: - mark selftest as serial (sashiko). v1 -> v2: - target bpf-next tree (fixups.c) instead of bpf tree (verifier.c). v1: https://lore.kernel.org/bpf/20260414-subprog-token-fix-v1-0-5b1a38e01546@gmail.com/T/ v2: https://lore.kernel.org/bpf/20260414-subprog-token-fix-v2-0-59146c31f6f1@gmail.com/T/ v3: https://lore.kernel.org/bpf/20260415-subprog-token-fix-v3-0-6fefe1d51646@gmail.com/T/ ==================== Link: https://patch.msgid.link/20260415-subprog-token-fix-v4-0-9bd000e8b068@gmail.com Signed-off-by: Alexei Starovoitov commit 969fb456ffb43d87894a295dbe6a0a722691552a Author: Eduard Zingerman Date: Wed Apr 15 13:03:56 2026 -0700 selftests/bpf: verify kallsyms entries for token-loaded subprograms Add a test that loads an XDP program with a global subprogram using a BPF token from a user namespace, then verifies that both the main program and the subprogram appear in /proc/kallsyms. This exercises the bpf_prog_kallsyms_add() path for subprograms and would have caught the missing aux->token copy in bpf_jit_subprogs(). load_kallsyms_local() filters out kallsyms with zero addresses. For a process with limited capabilities to read kallsym addresses the following sysctl variables have to be set to zero: - /proc/sys/kernel/perf_event_paranoid - /proc/sys/kernel/kptr_restrict Set these variables using sysctl_set() utility function extracted from unpriv_bpf_disabled.c to a separate c/header. Since the test modifies global system state, mark it as serial. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260415-subprog-token-fix-v4-2-9bd000e8b068@gmail.com Signed-off-by: Alexei Starovoitov commit 0251e40c48299243c12f7cf4a6046f080af206cb Author: Eduard Zingerman Date: Wed Apr 15 13:03:55 2026 -0700 bpf: copy BPF token from main program to subprograms bpf_jit_subprogs() copies various fields from the main program's aux to each subprogram's aux, but omits the BPF token. This causes bpf_prog_kallsyms_add() to fail for subprograms loaded via BPF token, as bpf_token_capable() falls back to capable() in init_user_ns when token is NULL. Copy prog->aux->token to func[i]->aux->token so that subprograms inherit the same capability delegation as the main program. Fixes: d79a35497547 ("bpf: Consistently use BPF token throughout BPF verifier logic") Signed-off-by: Tao Chen Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260415-subprog-token-fix-v4-1-9bd000e8b068@gmail.com Signed-off-by: Alexei Starovoitov commit b7f84966b6f17626a8129723894dc315a076b391 Merge: e4bf304f000e6f 43cec30c44764c Author: Linus Torvalds Date: Wed Apr 15 16:27:32 2026 -0700 Merge tag 'tracefs-v7.1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracefs updates from Steven Rostedt: - Simplify error handling with guards() Use guards() to simplify the handling of releasing locks in exit paths. - Use dentry name snapshots instead of allocation Instead of allocating a temp buffer to store the dentry name to use in mkdir() and rmdir() use take_dentry_name_snapshot(). - Fix default permissions not being applied at boot The default permissions for tracefs was 0700 to only allow root having access. But after a change to fix other mount options the update to permissions ignored the defined default and used the system default of 0755. This is a regression and is fixed. * tag 'tracefs-v7.1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracefs: Removed unused 'ret' variable in eventfs_iterate() tracefs: Fix default permissions not being applied on initial mount tracefs: Use dentry name snapshots instead of heap allocation eventfs: Simplify code using guard()s commit e4bf304f000e6fcceaf60b1455a5124b783b3a66 Merge: 15218296329e48 6170922f137231 Author: Linus Torvalds Date: Wed Apr 15 15:59:46 2026 -0700 Merge tag 'trace-ringbuffer-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ring-buffer updates from Steven Rostedt: - Add remote buffers for pKVM pKVM has a hypervisor component that is used to protect the guest from the host kernel. This hypervisor is a black box to the kernel as the kernel is to user space. The remote buffers are used to have a memory mapping between the hypervisor and the kernel where kernel may send commands to enable tracing within the hypervisor. Then the kernel will read this memory mapping just like user space can read the memory mapped ring buffer of the kernel tracing system. Since the hypervisor only has a single context, it doesn't need to worry about races between normal context, interrupt context and NMIs like the kernel does. The ring buffer it uses doesn't need to be as complex. The remote buffers are a simple version of the ring buffer that works in a single context. They are still per-CPU and use sub buffers. The data layout is the same as the kernel's ring buffer to share the same parsing. Currently, only ARM64 implements pKVM, but there's work to implement it also in x86. The remote buffer code is separated out from the ARM implementation so that it can be used in the future by x86. The ARM64 updates for pKVM is in the ARM/KVM tree and it merged in the remote buffers of this tree. - Make the backup instance non reusable The backup instance is a copy of the persistent ring buffer so that the persistent ring buffer could start recording again without using the data from the previous boot. The backup isn't for normal tracing. It is made read-only, and after it is consumed, it is automatically removed. - Have backup copy persistent instance before it starts recording To allow the persistent ring buffer to start recording from the kernel command line commands, move the copy of the backup instance to before the the command line options start recording. - Report header_page overwrite field as "char" and not "int' The rust parser of the header_page file was triggering a warning when it defined the overwrite variable as "int" but it was only a single byte in size. - Fix memory barriers for the trace_buffer CPU mask When a CPU comes online, the bit is set to allow readers to know that the CPU buffer is allocated. The bit is set after the allocation is done, and a smp_wmb() is performed after the allocation and before the setting of the bit. But instead of adding a smp_rmb() to all readers, since once a buffer is created for a CPU it is not deleted if that CPU goes offline, so this allocation is almost always done at boot up before any readers exist. If for the unlikely case where a CPU comes online for the first time after the system boot has finished, send an IPI to all CPUs to force the smp_rmb() for each CPU. - Show clock function being used in debugging ring buffer data When the ring buffer checks are enabled and the ring buffer detects an inconsistency in the times of the invents, print out the clock being used when the error occurred. There was a very hard to hit bug that would happen every so often and it ended up being only triggered when the jiffies clock was being used. If the bug showed the clock being used, it would have been much easier to find the problem (which was an internal function was being traced which caused the clock accounting to go off). * tag 'trace-ringbuffer-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (26 commits) ring-buffer: Prevent off-by-one array access in ring_buffer_desc_page() ring-buffer: Report header_page overwrite as char tracing: Allow backup to save persistent ring buffer before it starts tracing/Documentation: Add a section about backup instance tracing: Remove the backup instance automatically after read tracing: Make the backup instance non-reusable ring-buffer: Enforce read ordering of trace_buffer cpumask and buffers ring-buffer: Show what clock function is used on timestamp errors tracing: Check for undefined symbols in simple_ring_buffer tracing: load/unload page callbacks for simple_ring_buffer Documentation: tracing: Add tracing remotes tracing: selftests: Add trace remote tests tracing: Add a trace remote module for testing tracing: Introduce simple_ring_buffer ring-buffer: Export buffer_data_page and macros tracing: Add helpers to create trace remote events tracing: Add events/ root files to trace remotes tracing: Add events to trace remotes tracing: Add init callback to trace remotes tracing: Add non-consuming read to trace remotes ... commit 15218296329e489d861a3e4fd2bd299afc115b8e Merge: aec2f682d47c54 93e8fd1a565eb5 Author: Linus Torvalds Date: Wed Apr 15 15:57:11 2026 -0700 Merge tag 'ftrace-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ftrace update from Steven Rostedt: - Speed up ftrace_lookup_symbols() for single lookups The kallsyms lookup in ftrace_lookup_symbols() does a linear search over each symbol. This is fine when it must match multiple strings, but when there's only a single string being searched for, using a binary search is much more efficient. When a single string is passed in to search, use the binary search method. * tag 'ftrace-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ftrace: Use kallsyms binary search for single-symbol lookup commit c09fb907a2822864b7da866461fb33f10713b4ed Author: Stefan Metzmacher Date: Fri Nov 28 14:49:51 2025 +0100 MAINTAINERS: change git.samba.org to https This is the preferred way to access the server. Cc: Steve French Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 6b83b03c07fbe0b57bb729bee91ae44c623c82ff Author: Dudu Lu Date: Wed Apr 15 18:24:24 2026 +0800 smb: client: fix integer underflow in receive_encrypted_read() In receive_encrypted_read(), the length of data to read from the socket is computed as: len = le32_to_cpu(tr_hdr->OriginalMessageSize) - server->vals->read_rsp_size; OriginalMessageSize comes from the server's transform header and is untrusted. If a malicious server sends a value smaller than read_rsp_size, the unsigned subtraction wraps to a very large value (~4GB). This value is then passed to netfs_alloc_folioq_buffer() and cifs_read_iter_from_socket(), causing either a massive allocation attempt that fails with -ENOMEM (DoS), or under extreme memory pressure, potential heap corruption. Fix by adding a check that OriginalMessageSize is at least read_rsp_size before the subtraction. On failure, jump to discard_data to drain the remaining PDU from the socket, preventing desync of subsequent reads on the connection. Signed-off-by: Dudu Lu Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit aec2f682d47c54ef434b2d440992626d80b1ebdc Merge: 8801e23b5b0dcf 8879a3c110cb8c Author: Linus Torvalds Date: Wed Apr 15 15:22:26 2026 -0700 Merge tag 'v7.1-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto update from Herbert Xu: "API: - Replace crypto_get_default_rng with crypto_stdrng_get_bytes - Remove simd skcipher support - Allow algorithm types to be disabled when CRYPTO_SELFTESTS is off Algorithms: - Remove CPU-based des/3des acceleration - Add test vectors for authenc(hmac(md5),cbc({aes,des})) and authenc(hmac({md5,sha1,sha224,sha256,sha384,sha512}),rfc3686(ctr(aes))) - Replace spin lock with mutex in jitterentropy Drivers: - Add authenc algorithms to safexcel - Add support for zstd in qat - Add wireless mode support for QAT GEN6 - Add anti-rollback support for QAT GEN6 - Add support for ctr(aes), gcm(aes), and ccm(aes) in dthev2" * tag 'v7.1-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (129 commits) crypto: af_alg - use sock_kmemdup in alg_setkey_by_key_serial crypto: vmx - remove CRYPTO_DEV_VMX from Kconfig crypto: omap - convert reqctx buffer to fixed-size array crypto: atmel-sha204a - add Thorsten Blum as maintainer crypto: atmel-ecc - add Thorsten Blum as maintainer crypto: qat - fix IRQ cleanup on 6xxx probe failure crypto: geniv - Remove unused spinlock from struct aead_geniv_ctx crypto: qce - simplify qce_xts_swapiv() crypto: hisilicon - Fix dma_unmap_single() direction crypto: talitos - rename first/last to first_desc/last_desc crypto: talitos - fix SEC1 32k ahash request limitation crypto: jitterentropy - replace long-held spinlock with mutex crypto: hisilicon - remove unused and non-public APIs for qm and sec crypto: hisilicon/qm - drop redundant variable initialization crypto: hisilicon/qm - remove else after return crypto: hisilicon/qm - add const qualifier to info_name in struct qm_cmd_dump_item crypto: hisilicon - fix the format string type error crypto: ccree - fix a memory leak in cc_mac_digest() crypto: qat - add support for zstd crypto: qat - use swab32 macro ... commit 8801e23b5b0dcf7d9c2291cc0901628dc1006145 Merge: 83964553e8a942 d46515ec0b1d4a Author: Linus Torvalds Date: Wed Apr 15 15:19:45 2026 -0700 Merge tag 'ipe-pr-20260413' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe Pull IPE update from Fan Wu: "A single commit from Evan Ducas that fixes several spelling and grammar mistakes in the IPE documentation. There are no functional changes" * tag 'ipe-pr-20260413' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe: docs: security: ipe: fix typos and grammar commit 83964553e8a94217edf961994ea0ca722d297447 Merge: a5f998094fa344 3f100dd61ad4ee Author: Linus Torvalds Date: Wed Apr 15 15:16:39 2026 -0700 Merge tag 'for-linus-7.1-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - fix an error path in drivers/xen/manage.c - fix the Xen console driver solving a boot hangup when the console backend isn't yet running - comment fix in the Xen swiotlb driver - hardening for Xen on Arm adding a more thorough validation - cleanup of the Xen grant table code hiding suspend/resume code for the case if CONFIG_HIBERNATE_CALLBACKS isn't defined * tag 'for-linus-7.1-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/grant-table: guard gnttab_suspend/resume with CONFIG_HIBERNATE_CALLBACKS hvc/xen: Check console connection flag xen/swiotlb: fix stale reference to swiotlb_unmap_page() xen/manage: unwind partial shutdown watcher setup on error ARM: xen: validate hypervisor compatible before parsing its version commit a5f998094fa344cdd1342164948abb4d7c6101ce Merge: f1d26d72f01556 8c0ee19db81f0f Author: Linus Torvalds Date: Wed Apr 15 15:11:05 2026 -0700 Merge tag 'for-7.1/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Benjamin Marzinski: "There are fixes for some corner case crashes in dm-cache and dm-mirror, new setup functionality for dm-vdo, and miscellaneous minor fixes and cleanups, especially to dm-verity. dm-vdo: - Make dm-vdo able to format the device itself, like other dm targets, instead of needing a userspace formating program - Add some sanity checks and code cleanup dm-cache: - Fix crashes and hangs when operating in passthrough mode (which have been around, unnoticed, since 4.12), as well as a late arriving fix for an error path bug in the passthrough fix - Fix a corner case memory leak dm-verity: - Another set of minor bugfixes and code cleanups to the forward error correction code dm-mirror - Fix minor initialization bug - Fix overflow crash on a large devices with small region sizes dm-crypt - Reimplement elephant diffuser using AES library and minor cleanups dm-core: - Claude found a buffer overflow in /dev/mapper/contrl ioctl handling - make dm_mod.wait_for correctly wait for partitions - minor code fixes and cleanups" * tag 'for-7.1/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (62 commits) dm cache: fix missing return in invalidate_committed's error path dm: fix a buffer overflow in ioctl processing dm-crypt: Make crypt_iv_operations::post return void dm vdo: Fix spelling mistake "postive" -> "positive" dm: provide helper to set stacked limits dm-integrity: always set the io hints dm-integrity: fix mismatched queue limits dm-bufio: use kzalloc_flex dm vdo: save the formatted metadata to disk dm vdo: add formatting logic and initialization dm vdo: add synchronous metadata I/O submission helper dm vdo: add geometry block structure dm vdo: add geometry block encoding dm vdo: add upfront validation for logical size dm vdo: add formatting parameters to table line dm vdo: add super block initialization to encodings.c dm vdo: add geometry block initialization to encodings.c dm-crypt: Make crypt_iv_operations::wipe return void dm-crypt: Reimplement elephant diffuser using AES library dm-verity-fec: warn even when there were no errors ... commit 6597ff1d8de3f583be169587efeafd8af134e138 Author: David Carlier Date: Sat Apr 11 07:29:38 2026 +0100 drm/nouveau: fix nvkm_device leak on aperture removal failure When aperture_remove_conflicting_pci_devices() fails during probe, the error path returns directly without unwinding the nvkm_device that was just allocated by nvkm_device_pci_new(). This leaks both the device wrapper and the pci_enable_device() reference taken inside it. Jump to the existing fail_nvkm label so nvkm_device_del() runs and balances both. The leak was introduced when the intermediate nvkm_device_del() between detection and aperture removal was dropped in favor of creating the pci device once. Fixes: c0bfe34330b5 ("drm/nouveau: create pci device once") Cc: stable@vger.kernel.org Signed-off-by: David Carlier Link: https://patch.msgid.link/20260411062938.22925-1-devnexen@gmail.com Signed-off-by: Danilo Krummrich commit f1d26d72f01556c787b1291729aa7a2ce37656a8 Merge: 5a69195686d5b8 f8d5e7066d846c Author: Linus Torvalds Date: Wed Apr 15 15:05:51 2026 -0700 Merge tag 'iommu-updates-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Joerg Roedel: "Core: - Support for RISC-V IO-page-table format in generic iommupt code ARM-SMMU Updates: - Introduction of an "invalidation array" for SMMUv3, which enables future scalability work and optimisations for devices with a large number of SMMUv3 instances - Update the conditions under which the SMMUv3 driver works around hardware errata for invalidation on MMU-700 implementations - Fix broken command filtering for the host view of NVIDIA's "cmdqv" SMMUv3 extension - MMU-500 device-tree binding additions for Qualcomm Eliza & Hawi SoCs Intel VT-d: - Support for dirty tracking on domains attached to PASID - Removal of unnecessary read*()/write*() wrappers - Improvements to the invalidation paths AMD Vi: - Race-condition fixed in debugfs code - Make log buffer allocation NUMA aware RISC-V: - IO-TLB flushing improvements - Minor fixes" * tag 'iommu-updates-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (48 commits) iommu/vt-d: Restore IOMMU_CAP_CACHE_COHERENCY dt-bindings: arm-smmu: qcom: Add compatible for Hawi SoC iommu/amd: Invalidate IRT cache for DMA aliases iommu/riscv: Remove overflows on the invalidation path iommu/amd: Fix clone_alias() to use the original device's devid iommu/vt-d: Remove the remaining pages along the invalidation path iommu/vt-d: Pass size_order to qi_desc_piotlb() not npages iommu/vt-d: Split piotlb invalidation into range and all iommu/vt-d: Remove dmar_writel() and dmar_writeq() iommu/vt-d: Remove dmar_readl() and dmar_readq() iommufd/selftest: Test dirty tracking on PASID iommu/vt-d: Support dirty tracking on PASID iommu/vt-d: Rename device_set_dirty_tracking() and pass dmar_domain pointer iommu/vt-d: Block PASID attachment to nested domain with dirty tracking iommu/dma: Always allow DMA-FQ when iommupt provides the iommu_domain iommu/riscv: Fix signedness bug iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs iommu/amd: Fix illegal device-id access in IOMMU debugfs iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() ... commit 5a69195686d5b874ac5a4c7f809ecb75fbc535ef Merge: 40286d6379aacf 8ebf408e7d463e Author: Linus Torvalds Date: Wed Apr 15 15:03:01 2026 -0700 Merge tag 'ata-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata updates from Niklas Cassel: - Misc code cleanups related to tag checking and tag command completion (Damien) - Remove Baikal bt1-ahci DT binding since the upstreaming for this SoC is not going to be finalized (Andy) - Only call the libata port error handler from the SCSI error handler if there were command timeouts or if EH was scheduled for the port (Damien) - Refactor ata_scsiop_maint_in() to more clearly show that there is only one service action implemented for the MAINTENANCE IN command (me) - Clean up the handling of sysfs attributes exposed by libata (Heiner) - Let libahci_platform use a flexible array member for platform PHYs to avoid multiple allocations (Rosen) - Do not retry reset if the device has been removed/hot-unplugged (Igor) - Add missing newlines to error prints in pata_arasan_cf driver (Haoyu) - Use the correct SCSI host byte when completing deferred ATA PASS-THROUGH commands, to avoid the SCSI mid-layer from failing the commands instead of requeuing (Igor) * tag 'ata-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands ata: pata_arasan_cf: fix missing newline in dev_err() messages ata: libata-transport: remove static variable ata_scsi_transport_template ata: libata-transport: split struct ata_internal ata: libata-transport: use static struct ata_transport_internal to simplify match functions ata: libata-transport: inline ata_attach|release_transport ata: libata-transport: instantiate struct ata_internal statically ata: libata-eh: Do not retry reset if the device is gone ata: libahci_platform: use flex array for platform PHYs ata: libata-transport: remove redundant dynamic sysfs attributes ata: libata-scsi: refactor ata_scsiop_maint_in() ata: libata-eh: avoid unnecessary calls to ata_scsi_port_error_handler() ata: ahci-dwc: Remove not-going-to-be-supported code for Baikal SoC ata: libata-scsi: rename and improve ata_qc_done() ata: libata-scsi: make ata_scsi_simulate() static ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() ata: libata-sata: simplify ata_sas_queuecmd() ata: libata-core: improve tag checks in ata_qc_issue() commit 40286d6379aacfcc053253ef78dc78b09addffda Merge: 46576fa3290804 4224e91fea5695 Author: Linus Torvalds Date: Wed Apr 15 14:41:21 2026 -0700 Merge tag 'pci-v7.1-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci updates from Bjorn Helgaas: "Enumeration: - Allow TLP Processing Hints to be enabled for RCiEPs (George Abraham P) - Enable AtomicOps only if we know the Root Port supports them (Gerd Bayer) - Don't enable AtomicOps for RCiEPs since none of them need Atomic Ops and we can't tell whether the Root Complex would support them (Gerd Bayer) - Leave Precision Time Measurement disabled until a driver enables it to avoid PCIe errors (Mika Westerberg) - Make pci_set_vga_state() fail if bridge doesn't support VGA routing, i.e., PCI_BRIDGE_CTL_VGA is not writable, and return errors to vga_get() callers including userspace via /dev/vga_arbiter (Simon Richter) - Validate max-link-speed from DT in j721e, brcmstb, mediatek-gen3, rzg3s drivers (where the actual controller constraints are known), and remove validation from the generic OF DT accessor (Hans Zhang) - Remove pc110pad driver (no longer useful after 486 CPU support removed) and no_pci_devices() (pc110pad was the last user) (Dmitry Torokhov, Heiner Kallweit) Resource management: - Prevent assigning space to unimplemented bridge windows; previously we mistakenly assumed prefetchable window existed and assigned space and put a BAR there (Ahmed Naseef) - Avoid shrinking bridge windows to fit in the initial Root Port window; fixes one problem with devices with large BARs connected via switches, e.g., Thunderbolt (Ilpo Järvinen) - Pass full extent of empty space, not just the aligned space, to resource_alignf callback so free space before the requested alignment can be used (Ilpo Järvinen) - Place small resources before larger ones for better utilization of address space (Ilpo Järvinen) - Fix alignment calculation for resource size larger than align, e.g., bridge windows larger than the 1MB required alignment (Ilpo Järvinen) Reset: - Update slot handling so all ARI functions are treated as being in the same slot. They're all reset by Secondary Bus Reset, but previously drivers of ARI functions that appeared to be on a non-zero device weren't notified and fatal hardware errors could result (Keith Busch) - Make sysfs reset_subordinate hotplug safe to avoid spurious hotplug events (Keith Busch) - Hide Secondary Bus Reset ('bus') from sysfs reset_methods if masked by CXL because it has no effect (Vidya Sagar) - Avoid FLR for AMD NPU device, where it causes the device to hang (Lizhi Hou) Error handling: - Clear only error bits in PCIe Device Status to avoid accidentally clearing Emergency Power Reduction Detected (Shuai Xue) - Check for AER errors even in devices without drivers (Lukas Wunner) - Initialize ratelimit info so DPC and EDR paths log AER error information (Kuppuswamy Sathyanarayanan) Power control: - Add UPD720201/UPD720202 USB 3.0 xHCI Host Controller .compatible so generic pwrctrl driver can control it (Neil Armstrong) Hotplug: - Set LED_HW_PLUGGABLE for NPEM hotplug-capable ports so LED core doesn't complain when setting brightness fails because the endpoint is gone (Richard Cheng) Peer-to-peer DMA: - Allow wildcards in list of host bridges that support peer-to-peer DMA between hierarchy domains and add all Google SoCs (Jacob Moroni) Endpoint framework: - Advertise dynamic inbound mapping support in pci-epf-test and update host pci_endpoint_test to skip doorbell testing if not advertised by endpoint (Koichiro Den) - Return 0, not remaining timeout, when MHI eDMA ops complete so mhi_ep_ring_add_element() doesn't interpret non-zero as failure (Daniel Hodges) - Remove vntb and ntb duplicate resource teardown that leads to oops when .allow_link() fails or .drop_link() is called (Koichiro Den) - Disable vntb delayed work before clearing BAR mappings and doorbells to avoid oops caused by doing the work after resources have been torn down (Koichiro Den) - Add a way to describe reserved subregions within BARs, e.g., platform-owned fixed register windows, and use it for the RK3588 BAR4 DMA ctrl window (Koichiro Den) - Add BAR_DISABLED for BARs that will never be available to an EPF driver, and change some BAR_RESERVED annotations to BAR_DISABLED (Niklas Cassel) - Add NTB .get_dma_dev() callback for cases where DMA API requires a different device, e.g., vNTB devices (Koichiro Den) - Add reserved region types for MSI-X Table and PBA so Endpoint controllers can them as describe hardware-owned regions in a BAR_RESERVED BAR (Manikanta Maddireddy) - Make Tegra194/234 BAR0 programmable and remove 1MB size limit (Manikanta Maddireddy) - Expose Tegra BAR2 (MSI-X) and BAR4 (DMA) as 64-bit BAR_RESERVED (Manikanta Maddireddy) - Add Tegra194 and Tegra234 device table entries to pci_endpoint_test (Manikanta Maddireddy) - Skip the BAR subrange selftest if there are not enough inbound window resources to run the test (Christian Bruel) New native PCIe controller drivers: - Add DT binding and driver for Andes QiLai SoC PCIe host controller (Randolph Lin) - Add DT binding and driver for ESWIN PCIe Root Complex (Senchuan Zhang) Baikal T-1 PCIe controller driver: - Remove driver since it never quite became usable (Andy Shevchenko) Cadence PCIe controller driver: - Implement byte/word config reads with dword (32-bit) reads because some Cadence controllers don't support sub-dword accesses (Aksh Garg) CIX Sky1 PCIe controller driver: - Add 'power-domains' to DT binding for SCMI power domain (Gary Yang) Freescale i.MX6 PCIe controller driver: - Add i.MX94 and i.MX943 to fsl,imx6q-pcie-ep DT binding (Richard Zhu) - Delay instead of polling for L2/L3 Ready after PME_Turn_off when suspending i.MX6SX because LTSSM registers are inaccessible (Richard Zhu) - Separate PERST# assertion (for resetting endpoints) from core reset (for resetting the RC itself) to prepare for new DTs with PERST# GPIO in per-Root Port nodes (Sherry Sun) - Retain Root Port MSI capability on i.MX7D, i.MX8MM, and i.MX8MQ so MSI from downstream devices will work (Richard Zhu) - Fix i.MX95 reference clock source selection when internal refclk is used (Franz Schnyder) Freescale Layerscape PCIe controller driver: - Allow building as a removable module (Sascha Hauer) MediaTek PCIe Gen3 controller driver: - Use dev_err_probe() to simplify error paths and make deferred probe messages visible in /sys/kernel/debug/devices_deferred (Chen-Yu Tsai) - Power off device if setup fails (Chen-Yu Tsai) - Integrate new pwrctrl API to enable power control for WiFi/BT adapters on mainboard or in PCIe or M.2 slots (Chen-Yu Tsai) NVIDIA Tegra194 PCIe controller driver: - Poll less aggressively and non-atomically for PME_TO_Ack during transition to L2 (Vidya Sagar) - Disable LTSSM after transition to Detect on surprise link down to stop toggling between Polling and Detect (Manikanta Maddireddy) - Don't force the device into the D0 state before L2 when suspending or shutting down the controller (Vidya Sagar) - Disable PERST# IRQ only in Endpoint mode because it's not registered in Root Port mode (Manikanta Maddireddy) - Handle 'nvidia,refclk-select' as optional (Vidya Sagar) - Disable direct speed change in Endpoint mode so link speed change is controlled by the host (Vidya Sagar) - Set LTR values before link up to avoid bogus LTR messages with 0 latency (Vidya Sagar) - Allow system suspend when the Endpoint link is down (Vidya Sagar) - Use DWC IP core version, not Tegra custom values, to avoid DWC core version check warnings (Manikanta Maddireddy) - Apply ECRC workaround to devices based on DesignWare 5.00a as well as 4.90a (Manikanta Maddireddy) - Disable PM Substate L1.2 in Endpoint mode to work around Tegra234 erratum (Vidya Sagar) - Delay post-PERST# cleanup until core is powered on to avoid CBB timeout (Manikanta Maddireddy) - Assert CLKREQ# so switches that forward it to their downstream side can bring up those links successfully (Vidya Sagar) - Calibrate pipe to UPHY for Endpoint mode to reset stale PLL state from any previous bad link state (Vidya Sagar) - Remove IRQF_ONESHOT flag from Endpoint interrupt registration so DMA driver and Endpoint controller driver can share the interrupt line (Vidya Sagar) - Enable DMA interrupt to support DMA in both Root Port and Endpoint modes (Vidya Sagar) - Enable hardware link retraining after link goes down in Endpoint mode (Vidya Sagar) - Add DT binding and driver support for core clock monitoring (Vidya Sagar) Qualcomm PCIe controller driver: - Advertise 'Hot-Plug Capable' and set 'No Command Completed Support' since Qcom Root Ports support hotplug events like DL_Up/Down and can accept writes to Slot Control without delays between writes (Krishna Chaitanya Chundru) Renesas R-Car PCIe controller driver: - Mark Endpoint BAR0 and BAR2 as Resizable (Koichiro Den) - Reduce EPC BAR alignment requirement to 4K (Koichiro Den) Renesas RZ/G3S PCIe controller driver: - Add RZ/G3E to DT binding and to driver (John Madieu) - Assert (not deassert) resets in probe error path (John Madieu) - Assert resets in suspend path in reverse order they were deasserted during probe (John Madieu) - Rework inbound window algorithm to prevent mapping more than intended region and enforce alignment on size, to prepare for RZ/G3E support (John Madieu) Rockchip DesignWare PCIe controller driver: - Add tracepoints for PCIe controller LTSSM transitions and link rate changes (Shawn Lin) - Trace LTSSM events collected by the dw-rockchip debug FIFO (Shawn Lin) SOPHGO PCIe controller driver: - Disable ASPM L0s and L1 on Sophgo 2042 PCIe Root Ports that advertise support for them (Yao Zi) Synopsys DesignWare PCIe controller driver: - Continue with system suspend even if an Endpoint doesn't respond with PME_TO_Ack message (Manivannan Sadhasivam) - Set Endpoint MSI-X Table Size in the correct function of a multi-function device when configuring MSI-X, not in Function 0 (Aksh Garg) - Set Max Link Width and Max Link Speed for all functions of a multi-function device, not just Function 0 (Aksh Garg) - Expose PCIe event counters in groups 5-7 in debugfs (Hans Zhang) Miscellaneous: - Warn only once about invalid ACS kernel parameter format (Richard Cheng) - Suppress FW_BUG warning when writing sysfs 'numa_node' with the current value (Li RongQing) - Drop redundant 'depends on PCI' from Kconfig (Julian Braha)" * tag 'pci-v7.1-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (165 commits) PCI/P2PDMA: Add Google SoCs to the P2P DMA host bridge list PCI/P2PDMA: Allow wildcard Device IDs in host bridge list PCI: sg2042: Avoid L0s and L1 on Sophgo 2042 PCIe Root Ports PCI: cadence: Add flags for disabling ASPM capability for broken Root Ports PCI: tegra194: Add core monitor clock support dt-bindings: PCI: tegra194: Add monitor clock support PCI: tegra194: Enable hardware hot reset mode in Endpoint mode PCI: tegra194: Enable DMA interrupt PCI: tegra194: Remove IRQF_ONESHOT flag during Endpoint interrupt registration PCI: tegra194: Calibrate pipe to UPHY for Endpoint mode PCI: tegra194: Assert CLKREQ# explicitly by default PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on PCI: tegra194: Disable L1.2 capability of Tegra234 EP PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well PCI: tegra194: Use DWC IP core version PCI: tegra194: Free up Endpoint resources during remove() PCI: tegra194: Allow system suspend when the Endpoint link is not up PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode PCI: tegra194: Disable direct speed change for Endpoint mode PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" ... commit 46576fa32908043975471bd26fe833a7d8015b35 Merge: 405f6584d7d0fc fb447217c59a13 Author: Linus Torvalds Date: Wed Apr 15 14:37:32 2026 -0700 Merge tag 'hwmon-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers: - Lenovo Yoga/Legion fan monitoring (yogafan) - LattePanda Sigma EC - Infineon XDP720 eFuse - Microchip MCP998X New device support: - TI INA234 - Infineon XDPE1A2G5B/7B - Renesas RAA228942 and RAA228943 (isl68137) - Delta Q54SN120A1 and Q54SW120A7 (pmbus) - TI TMP110 and TMP113 (tmp102) - Sony APS-379 (pmbus) - ITE IT8689E (it87) - ASUS ROG STRIX Z790-H, X470-F, and CROSSHAIR X670E (asus-ec-sensors) - GPD Win 5 (gpd-fan) Modernization and Cleanups: - Convert asus_atk0110 and acpi_power_meter ACPI drivers to platform drivers - Remove i2c_match_id() usage in many PMBus drivers - Use guard() for mutex protection in pmbus_core - Replace sprintf() with sysfs_emit() in ads7871, emc1403, max6650, ads7828, max31722, and tc74 - Various markup and documentation improvements for yogafan and ltc4282 Bug fixes: - Fix use-after-free and missing usb_kill_urb on disconnect in powerz driver - Avoid cacheline sharing for DMA buffer in powerz driver - Fix integer overflow in power calculation on 32-bit in isl28022 driver - Fix bugs in pt5161l_read_block_data() - Propagate SPI errors and fix incorrect error codes in ads7871 driver - Fix i2c_smbus_write_byte_data wrapper argument type in max31785 driver Device tree bindings: - Convert npcm750-pwm-fan to DT schema - Add bindings for Infineon XDP720, Microchip MCP998X, Sony APS-379, Renesas RAA228942/3, Delta Q54SN120A1/7, XDPE1A2G5B/7B, Aosong AHT10/20, DHT20, and TI INA234 - Adapt moortec,mr75203 bindings for T-Head TH1520" * tag 'hwmon-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (82 commits) hwmon: (ina233) Don't check for specific errors when parsing properties hwmon: (isl28022) Don't check for specific errors when parsing properties hwmon: (pmbus/tps25990) Don't check for specific errors when parsing properties hwmon: (nct6683) Add customer ID for ASRock B650I Lightning WiFi hwmon:(pmbus/xdp720) Add support for efuse xdp720 dt-bindings: hwmon/pmbus: Add Infineon XDP720 hwmon: add support for MCP998X dt-bindings: hwmon: add support for MCP998X hwmon: (powerz) Avoid cacheline sharing for DMA buffer hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt hwmon: (powerz) Fix use-after-free on USB disconnect hwmon: pmbus: Add support for Sony APS-379 dt-bindings: trivial-devices: Add sony,aps-379 hwmon: (yogafan) various markup improvements hwmon: (sparx5) Make it selectable for ARCH_LAN969X hwmon: (tmp102) add support for update interval hwmon: (yogafan) fix markup warning hwmon: (yogafan) Add support for Lenovo Yoga/Legion fan monitoring ... commit 405f6584d7d0fc46534fd370e374630283dffe60 Merge: 44f7a3795395b5 c4c3fc872d2a05 Author: Linus Torvalds Date: Wed Apr 15 14:34:11 2026 -0700 Merge tag 'spi-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "A busy release for SPI, almost all of it in a couple of larger fix and cleanup series for patterns that affected many drivers. We do have a couple of core API additions as well, relatively application specific but they enable some new use cases. - A packed command operation for spi-mem devices - Improvements to the ancillary device support to enable some IIO use cases from Antoniu Miclaus - Fixes for a registration ordering issue pattern caused by the handover between allocation and registration of controllers in concert with devm from Johan Hovold - Improvements to handling of clock allocation from Pei Xiao - Cleanups in the fsl-lpspi driver from Marc Kleine-Budde - Support for Renesas RZ/G3E and RZ/G3L" * tag 'spi-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (115 commits) spi: sn-f-ospi: fix incorrect return code for invalid num-cs spi: spi-mem: Add a packed command operation spi: cadence-qspi: Revert the filtering of certain opcodes in ODTR spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback spi: s3c64xx: fix NULL-deref on driver unbind spi: zynq-qspi: fix controller deregistration spi: zynqmp-gqspi: fix controller deregistration spi: uniphier: fix controller deregistration spi: ti-qspi: fix controller deregistration spi: tegra20-sflash: fix controller deregistration spi: tegra114: fix controller deregistration spi: syncuacer: fix controller deregistration spi: sun6i: fix controller deregistration spi: sun4i: fix controller deregistration spi: st-ssc4: fix controller deregistration spi: sprd: fix controller deregistration spi: slave-mt27xx: fix controller deregistration spi: sifive: fix controller deregistration spi: sh-msiof: fix controller deregistration spi: sh-hspi: fix controller deregistration ... commit 44f7a3795395b54bf674002803e3e80c6312e210 Merge: 8e258317dd0126 606c780b884373 Author: Linus Torvalds Date: Wed Apr 15 14:32:12 2026 -0700 Merge tag 'regulator-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This has been a very quiet update for the regulator API, the bulk of the diffstat is DT binding conversions and the most promient series in the changelog is Johan Hovold cleaning up some leaks of OF nodes. For some reason we have had several different people sending improvements to better describe the parent supplies for existing regulators, these look to be independent efforts. The only new hardware support is for some Motorola custom varints of cpcap" * tag 'regulator-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (35 commits) regulator: max77620: drop redundant OF node initialisation regulator: bq257xx: Make OTG enable GPIO really optional regulator: bq257xx: Remove reference to the parent MFD's dev regulator: bd9571mwv: fix OF node reference imbalance regulator: act8945a: fix OF node reference imbalance regulator: s2dos05: fix OF node reference imbalance regulator: mt6357: fix OF node reference imbalance regulator: max77650: fix OF node reference imbalance regulator: rk808: fix OF node reference imbalance regulator: bq257xx: fix OF node reference imbalance regulator: dt-bindings: qcom,qca6390-pmu: Document WCN6755 PMU regulator: dt-bindings: regulator-max77620: convert to DT schema regulator: mt6315: Add regulator supplies regulator: dt-bindings: mt6315: Add regulator supplies regulator: devres: Use enum regulator_get_type in internal functions regulator: dt-bindings: mps,mp8859: convert to DT schema regulator: da9121: Allow caching BUCK registers regulator: dt-bindings: dlg,da9121: Add dlg,no-gpio-control regulator: cros-ec: Add regulator supply regulator: dt-bindings: cros-ec: Add regulator supply ... commit 8e258317dd01261331670877beafa3157bd61478 Merge: e41a25c53f96ab 8ad7f3b265a87c Author: Linus Torvalds Date: Wed Apr 15 14:27:51 2026 -0700 Merge tag 'regmap-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "This has been quite a busy release for regmap, the user visible changes are quite minor but there's some quite good work on internal code improvements: - Cleanup helper for __free()ing regmap_fields - Support non-devm I3C regmaps - A bunch of cleanup work, mostly from Andy Shevchenko - Fix for bootstrapping issues with hardware initialised regmaps, which was the main inspiration for some of the cleanups" * tag 'regmap-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: i3c: Add non-devm regmap_init_i3c() helper regmap: debugfs: fix race condition in dummy name allocation regmap: Synchronize cache for the page selector regmap: Simplify devres handling regcache: Move HW readback after cache initialisation regcache: Allocate and free reg_defaults on the same level regcache: Move count check and cache_bypass assignment to the caller regcache: Factor out regcache_hw_exit() helper regcache: Amend printf() specifiers when printing registers regcache: Define iterator inside for-loop and align their types regmap: define cleanup helper for regmap_field regmap: sort header includes regcache: Split regcache_count_cacheable_registers() helper regcache: Remove duplicate check in regcache_hw_init() commit e41a25c53f96abe40edc5db1626d37a518852d84 Merge: 4ddd4f0651a710 596ca99cf04f33 Author: Linus Torvalds Date: Wed Apr 15 14:22:42 2026 -0700 Merge tag 'pmdomain-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: "pmdomain core: - Extend statistics for domain idle states with s2idle data - Show latency/residency for domain idle states in debugfs pmdomain providers: - imx: Add support for optional subnodes for imx93-blk-ctrl - marvell: Add audio power island for Marvell PXA1908 - mediatek: - Add legacy support for the MT7622 audio power domain - Add nvmem provider functionality to the mtk-mfg-pmdomain - Add support for the MT8189 power domains - qcom: Add support for the Eliza and Hawi power domains - sunxi: Add support for the Allwinner A733 power domains - ti: Handle wakeup constraints for out-of-band wakeups for ti_sci" * tag 'pmdomain-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (32 commits) pmdomain: qcom: rpmhpd: Add power domains for Hawi SoC dt-bindings: power: qcom,rpmhpd: Add RPMh power domain for Hawi SoC pmdomain: qcom: cpr: add COMPILE_TEST support PM: domains: De-constify fields in struct dev_pm_domain_attach_data pmdomain: qcom: cpr: simplify main allocation pmdomain: bcm: bcm2835-power: Replace open-coded polling with readl_poll_timeout_atomic() pmdomain: sunxi: Add support for A733 to Allwinner PCK600 driver pmdomain: qcom: rpmhpd: Add Eliza RPMh Power Domains pmdomain: arm: Add print after a successful probe for SCMI power domains pmdomain: rockchip: quiet regulator error on -EPROBE_DEFER pmdomain: mediatek: Add power domain driver for MT8189 SoC pmdomain: mediatek: Add bus protect control flow for MT8189 pmdomain: core: Extend statistics for domain idle states with s2idle data pmdomain: core: Show latency/residency for domain idle states in debugfs pmdomain: core: Restructure domain idle states data for genpd in debugfs pmdomain: qcom: rpmpd: drop stray semicolon pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() pmdomain: ti: omap_prm: Fix a reference leak on device node pmdomain: mediatek: scpsys: Add MT7622 Audio power domain to legacy driver pmdomain: mediatek: Simplify with scoped for each OF child loop ... commit 4ddd4f0651a710f33dfbb9dadd94f2bb0aa31aa8 Merge: b9962335d4c6de 52957cdad30f80 Author: Linus Torvalds Date: Wed Apr 15 14:15:25 2026 -0700 Merge tag 'mmc-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Add NXP vendor and IW61x device IDs for WiFi chips over SDIO - Add quirk for incorrect manufacturing date - Add support for manufacturing date beyond 2025 - Optimize support for secure erase/trim for some Kingston eMMCs - Remove support for the legacy "enable-sdio-wakeup" DT property - Use single block writes in the retry path MMC host: - dw_mmc: - A great amount of cleanups/simplifications to improve the code - Add clk_phase_map support - Remove mshc DT alias support - dw_mmc-rockchip: - Fix runtime PM support for internal phase - Add support for the RV1103B variant - loongson2: - Add support for the Loongson-2K0300 SD/SDIO/eMMC controller - mtk-sd: - Add support for the MT8189 variant - renesas_sdhi_core: - Add support for selecting an optional mux - rtsx_pci_sdmmc: - Simplify voltage switch handling - sdhci: - Stop advertising the driver in dmesg - sdhci-esdhc-imx: - Add 1-bit bus width support - Add support for the NXP S32N79 variant - sdhci-msm: - Add support for the IPQ5210 and IPQ9650 variants - Add support for wrapped keys - Enable ICE for CQE-capable controllers with non-CQE cards - sdhci-of-arasan: - Add support for the Axiado AX3000 variant - sdhci-of-aspeed: - Add support for the AST2700 variant - sdhci-of-bst: - Add driver for the Black Sesame Technologies C1200 controller - sdhci-of-dwcmshc: - Add support for the Canaan K230 variant - Add support for the HPE GSC variant - Prevent clock glitches to avoid malfunction - sdhci-of-k1: - Add support for the K3 variant mux core/consumers: - core: - Add helper functions for getting optional and selected mux-state - i2c-omap: - Convert to devm_mux_state_get_optional_selected() - phy-renesas: - Convert to devm_mux_state_get_optional_selected() - phy-can-transceiver: - Convert to devm_mux_state_get_optional()" * tag 'mmc-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (131 commits) mmc: sdhci-msm: Fix the wrapped key handling mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration mmc: core: Simplify with scoped for each OF child loop mmc: core: Optimize size of struct mmc_queue_req mmc: vub300: clean up module init mmc: vub300: rename probe error labels mmc: dw_mmc: Remove dw_mci_start_request wrapper and rename core function mmc: dw_mmc: Inline dw_mci_queue_request() into dw_mci_request() mmc: block: Use MQRQ_XFER_SINGLE_BLOCK for both read and write recovery mmc: mmc_test: Replace hard-coded values with macros and consolidate test parameters mmc: block: Convert to use DEFINE_SIMPLE_DEV_PM_OPS() mmc: core: Replace the hard-coded shift value 9 with SECTOR_SHIFT mmc: sdhci-dwcmshc: Refactor Rockchip platform data for controller revisions mmc: core: Switch to use pm_ptr() for mmc_host_class_dev_pm_ops mmc: core: Remove legacy 'enable-sdio-wakeup' DT property support mmc: mmc_test: use kzalloc_flex mmc: mtk-sd: disable new_tx/rx and modify related settings for mt8189 dt-bindings: mmc: hisilicon,hi3660-dw-mshc: Convert to DT schema dt-bindings: mmc: sdhci-msm: add IPQ9650 compatible mmc: block: use single block write in retry ... commit b9962335d4c6dee152e95dce9f0dd32048735a6d Merge: 5af6e08ae74ef4 aa8f35172ab66c Author: Linus Torvalds Date: Wed Apr 15 14:13:31 2026 -0700 Merge tag 'pwm/for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm updates from Uwe Kleine-König: "Just two minor fixes, a device tree binding addition to support a few more SoCs (without the need for driver adaptions), a driver include cleanup and the addition of the #linux-pwm irc channel to MAINTAINERS" * tag 'pwm/for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: th1520: fix `CLIPPY=1` warning pwm: jz4740: Drop unused include MAINTAINERS: Add #linux-pwm irc channel to pwm entry dt-bindings: pwm: amlogic: Document A4 A5 and T7 PWM pwm: imx-tpm: Count the number of enabled channels in probe commit 5af6e08ae74ef4c9e59873c7265ca4894205c636 Merge: f82b61de0f5dc5 168e4b208ca8c2 Author: Linus Torvalds Date: Wed Apr 15 14:10:40 2026 -0700 Merge tag 'chrome-platform-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "Improvements: - Reduce transmission size by dropping unnecessary data in cros_ec_lightbar - Convert chromeos_privacy_screen, chromeos_tbmc, and wilco_ec/event from ACPI drivers to platform drivers Fixes: - Drop wakeup source on remove() in chromeos_tbmc Cleanups: - Simplify workqueue usage with devm in cros_usbpd_logger" * tag 'chrome-platform-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: cros_usbpd_logger: Simplify with devm platform/chrome: wilco_ec: event: Convert to a platform driver platform/chrome: wilco_ec: event: Register ACPI notify handler platform/chrome: chromeos_tbmc: Convert to a platform driver platform/chrome: chromeos_tbmc: Register ACPI notify handler platform/chrome: chromeos_tbmc: Drop wakeup source on remove platform/chrome: Convert ChromeOS privacy-screen driver to platform platform/chrome: lightbar: Optimize command size commit f82b61de0f5dc58930fdb773b9e843573fcc374b Merge: 334fbe734e6874 b374977413e723 Author: Linus Torvalds Date: Wed Apr 15 13:39:23 2026 -0700 Merge tag 'locking_futex_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex selftest updates from Borislav Petkov: - Correct the version guard for the futex_numa_mpol test to require libnuma 2.0.18 instead of 2.0.16, which is the version that actually introduced numa_set_mempolicy_home_node() used by the test - Allow the futex_numa_mpol selftest to build and run on systems without libnuma installed with affected test gracefully being skipped instead of failing to compile - Use the proper assertion macros so that individual sub-test failures are correctly propagated and the test suite reports failure when something goes wrong * tag 'locking_futex_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests/futex: Bump up libnuma version check selftests/futex: Conditionally include libnuma support selftests/futex: Fix incorrect result reporting of futex_requeue test item commit ca8639fbb3354629084c15e137e61fcb8528c4ec Merge: 83e8d8bbffa816 7b15fc2d1f1a00 Author: Dave Airlie Date: Thu Apr 16 06:28:15 2026 +1000 Merge tag 'amd-drm-next-7.1-2026-04-03' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-7.1-2026-04-03: amdgpu: - Audio regression fix - Use drm edid parser for AMD VSDB - Misc cleanups - VCE cs parse fixes - VCN cs parse fixes - RAS fixes - Clean up and unify vram reservation handling - GPU Partition updates - system_wq cleanups - Add CONFIG_GCOV_PROFILE_AMDGPU kconfig option - SMU vram copy updates - SMU 15 fixes - SMU 13 fixes - SMU 14 fixes - UserQ fixes - Replace pasid idr with an xarray - Dither handling fix - Enable amdgpu by default for CIK APUs - Add IBs to devcoredump amdkfd: - system_wq cleanups radeon: - system_wq cleanups drm: - Add support for AMD VSDB parsing to drm_edid Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260403214329.2976329-1-alexander.deucher@amd.com commit 326941b22806cbf2df1fbfe902b7908b368cce42 Author: Longxuan Yu Date: Sun Apr 12 16:38:20 2026 +0800 io_uring/poll: fix signed comparison in io_poll_get_ownership() io_poll_get_ownership() uses a signed comparison to check whether poll_refs has reached the threshold for the slowpath: if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS)) atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG (BIT(31)) is set in poll_refs, the value becomes negative in signed arithmetic, so the >= 128 comparison always evaluates to false and the slowpath is never taken. Fix this by casting the atomic_read() result to unsigned int before the comparison, so that the cancel flag is treated as a large positive value and correctly triggers the slowpath. Fixes: a26a35e9019f ("io_uring: make poll refs more robust") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Zhengchuan Liang Signed-off-by: Longxuan Yu Signed-off-by: Ren Wei Reviewed-by: Pavel Begunkov Link: https://patch.msgid.link/3a3508b08bcd7f1bc3beff848ae6e1d73d355043.1775965597.git.ylong030@ucr.edu Signed-off-by: Jens Axboe commit e9cd85a42638090181a2af38684656d1cbc574e5 Author: Mukesh Ojha Date: Wed Apr 1 18:20:04 2026 +0530 dt-bindings: qcom,pdc: document the Hawi Power Domain Controller Document the Power Domain Controller on the Qualcomm Hawi SoC. Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Link: https://patch.msgid.link/20260401125004.592925-1-mukesh.ojha@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 334fbe734e687404f346eba7d5d96ed2b44d35ab Merge: 5bdb4078e1efba 3bac01168982ec Author: Linus Torvalds Date: Wed Apr 15 12:59:16 2026 -0700 Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - "maple_tree: Replace big node with maple copy" (Liam Howlett) Mainly prepararatory work for ongoing development but it does reduce stack usage and is an improvement. - "mm, swap: swap table phase III: remove swap_map" (Kairui Song) Offers memory savings by removing the static swap_map. It also yields some CPU savings and implements several cleanups. - "mm: memfd_luo: preserve file seals" (Pratyush Yadav) File seal preservation to LUO's memfd code - "mm: zswap: add per-memcg stat for incompressible pages" (Jiayuan Chen) Additional userspace stats reportng to zswap - "arch, mm: consolidate empty_zero_page" (Mike Rapoport) Some cleanups for our handling of ZERO_PAGE() and zero_pfn - "mm/kmemleak: Improve scan_should_stop() implementation" (Zhongqiu Han) A robustness improvement and some cleanups in the kmemleak code - "Improve khugepaged scan logic" (Vernon Yang) Improve khugepaged scan logic and reduce CPU consumption by prioritizing scanning tasks that access memory frequently - "Make KHO Stateless" (Jason Miu) Simplify Kexec Handover by transitioning KHO from an xarray-based metadata tracking system with serialization to a radix tree data structure that can be passed directly to the next kernel - "mm: vmscan: add PID and cgroup ID to vmscan tracepoints" (Thomas Ballasi and Steven Rostedt) Enhance vmscan's tracepointing - "mm: arch/shstk: Common shadow stack mapping helper and VM_NOHUGEPAGE" (Catalin Marinas) Cleanup for the shadow stack code: remove per-arch code in favour of a generic implementation - "Fix KASAN support for KHO restored vmalloc regions" (Pasha Tatashin) Fix a WARN() which can be emitted the KHO restores a vmalloc area - "mm: Remove stray references to pagevec" (Tal Zussman) Several cleanups, mainly udpating references to "struct pagevec", which became folio_batch three years ago - "mm: Eliminate fake head pages from vmemmap optimization" (Kiryl Shutsemau) Simplify the HugeTLB vmemmap optimization (HVO) by changing how tail pages encode their relationship to the head page - "mm/damon/core: improve DAMOS quota efficiency for core layer filters" (SeongJae Park) Improve two problematic behaviors of DAMOS that makes it less efficient when core layer filters are used - "mm/damon: strictly respect min_nr_regions" (SeongJae Park) Improve DAMON usability by extending the treatment of the min_nr_regions user-settable parameter - "mm/page_alloc: pcp locking cleanup" (Vlastimil Babka) The proper fix for a previously hotfixed SMP=n issue. Code simplifications and cleanups ensued - "mm: cleanups around unmapping / zapping" (David Hildenbrand) A bunch of cleanups around unmapping and zapping. Mostly simplifications, code movements, documentation and renaming of zapping functions - "support batched checking of the young flag for MGLRU" (Baolin Wang) Batched checking of the young flag for MGLRU. It's part cleanups; one benchmark shows large performance benefits for arm64 - "memcg: obj stock and slab stat caching cleanups" (Johannes Weiner) memcg cleanup and robustness improvements - "Allow order zero pages in page reporting" (Yuvraj Sakshith) Enhance free page reporting - it is presently and undesirably order-0 pages when reporting free memory. - "mm: vma flag tweaks" (Lorenzo Stoakes) Cleanup work following from the recent conversion of the VMA flags to a bitmap - "mm/damon: add optional debugging-purpose sanity checks" (SeongJae Park) Add some more developer-facing debug checks into DAMON core - "mm/damon: test and document power-of-2 min_region_sz requirement" (SeongJae Park) An additional DAMON kunit test and makes some adjustments to the addr_unit parameter handling - "mm/damon/core: make passed_sample_intervals comparisons overflow-safe" (SeongJae Park) Fix a hard-to-hit time overflow issue in DAMON core - "mm/damon: improve/fixup/update ratio calculation, test and documentation" (SeongJae Park) A batch of misc/minor improvements and fixups for DAMON - "mm: move vma_(kernel|mmu)_pagesize() out of hugetlb.c" (David Hildenbrand) Fix a possible issue with dax-device when CONFIG_HUGETLB=n. Some code movement was required. - "zram: recompression cleanups and tweaks" (Sergey Senozhatsky) A somewhat random mix of fixups, recompression cleanups and improvements in the zram code - "mm/damon: support multiple goal-based quota tuning algorithms" (SeongJae Park) Extend DAMOS quotas goal auto-tuning to support multiple tuning algorithms that users can select - "mm: thp: reduce unnecessary start_stop_khugepaged()" (Breno Leitao) Fix the khugpaged sysfs handling so we no longer spam the logs with reams of junk when starting/stopping khugepaged - "mm: improve map count checks" (Lorenzo Stoakes) Provide some cleanups and slight fixes in the mremap, mmap and vma code - "mm/damon: support addr_unit on default monitoring targets for modules" (SeongJae Park) Extend the use of DAMON core's addr_unit tunable - "mm: khugepaged cleanups and mTHP prerequisites" (Nico Pache) Cleanups to khugepaged and is a base for Nico's planned khugepaged mTHP support - "mm: memory hot(un)plug and SPARSEMEM cleanups" (David Hildenbrand) Code movement and cleanups in the memhotplug and sparsemem code - "mm: remove CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE and cleanup CONFIG_MIGRATION" (David Hildenbrand) Rationalize some memhotplug Kconfig support - "change young flag check functions to return bool" (Baolin Wang) Cleanups to change all young flag check functions to return bool - "mm/damon/sysfs: fix memory leak and NULL dereference issues" (Josh Law and SeongJae Park) Fix a few potential DAMON bugs - "mm/vma: convert vm_flags_t to vma_flags_t in vma code" (Lorenzo Stoakes) Convert a lot of the existing use of the legacy vm_flags_t data type to the new vma_flags_t type which replaces it. Mainly in the vma code. - "mm: expand mmap_prepare functionality and usage" (Lorenzo Stoakes) Expand the mmap_prepare functionality, which is intended to replace the deprecated f_op->mmap hook which has been the source of bugs and security issues for some time. Cleanups, documentation, extension of mmap_prepare into filesystem drivers - "mm/huge_memory: refactor zap_huge_pmd()" (Lorenzo Stoakes) Simplify and clean up zap_huge_pmd(). Additional cleanups around vm_normal_folio_pmd() and the softleaf functionality are performed. * tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (369 commits) mm: fix deferred split queue races during migration mm/khugepaged: fix issue with tracking lock mm/huge_memory: add and use has_deposited_pgtable() mm/huge_memory: add and use normal_or_softleaf_folio_pmd() mm: add softleaf_is_valid_pmd_entry(), pmd_to_softleaf_folio() mm/huge_memory: separate out the folio part of zap_huge_pmd() mm/huge_memory: use mm instead of tlb->mm mm/huge_memory: remove unnecessary sanity checks mm/huge_memory: deduplicate zap deposited table call mm/huge_memory: remove unnecessary VM_BUG_ON_PAGE() mm/huge_memory: add a common exit path to zap_huge_pmd() mm/huge_memory: handle buggy PMD entry in zap_huge_pmd() mm/huge_memory: have zap_huge_pmd return a boolean, add kdoc mm/huge: avoid big else branch in zap_huge_pmd() mm/huge_memory: simplify vma_is_specal_huge() mm: on remap assert that input range within the proposed VMA mm: add mmap_action_map_kernel_pages[_full]() uio: replace deprecated mmap hook with mmap_prepare in uio_info drivers: hv: vmbus: replace deprecated mmap hook with mmap_prepare mm: allow handling of stacked mmap_prepare hooks in more drivers ... commit 64b437c4a96ae088d46c7d9930c35e77ee1b5b21 Author: Christoph Hellwig Date: Tue Apr 14 10:17:51 2026 +0200 zloop: remove irq-safe locking All of zloop runs in user context, so drop the irq-safe locking. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://patch.msgid.link/20260414081811.549755-7-hch@lst.de Signed-off-by: Jens Axboe commit ec5c045f6cc879637cb52c9902d5fb7d419bdf47 Author: Christoph Hellwig Date: Tue Apr 14 10:17:50 2026 +0200 zloop: factor out zloop_mark_{full,empty} helpers Move a few chunks of duplicated code into helpers. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://patch.msgid.link/20260414081811.549755-6-hch@lst.de Signed-off-by: Jens Axboe commit 5b680d7afc4a2fefa0b4f584462c7540de56e2e4 Author: Christoph Hellwig Date: Tue Apr 14 10:17:49 2026 +0200 zloop: set RQF_QUIET when completing requests on deleted devices Reduce the dmesg spam for tests that involve device deletion. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://patch.msgid.link/20260414081811.549755-5-hch@lst.de Signed-off-by: Jens Axboe commit 6466b211f797ae88073b5826dd764a6a98b67edb Author: Christoph Hellwig Date: Tue Apr 14 10:17:48 2026 +0200 zloop: improve the unaligned write pointer warning Use the IS_ALIGNED helper and avoid extra conversions, and tell the user what the unaligned size is. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://patch.msgid.link/20260414081811.549755-4-hch@lst.de Signed-off-by: Jens Axboe commit 14e0077911e3d5e11e94417861e700cbb521a107 Author: Christoph Hellwig Date: Tue Apr 14 10:17:47 2026 +0200 zloop: use vfs_truncate While vfs_truncate does various extra checks that we don't really need, it is always better to use a VFS helper rather than open coding the logic. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://patch.msgid.link/20260414081811.549755-3-hch@lst.de Signed-off-by: Jens Axboe commit 32be3c01c3b8e948a4326ab7e76c1c63dd3e27bc Author: Christoph Hellwig Date: Tue Apr 14 10:17:46 2026 +0200 zloop: fix write pointer calculation in zloop_forget_cache The write pointer is absolute and in sector units, so we need to convert it to a relative byte address first. Fixes: c505448748f7 ("zloop: forget write cache on force removal") Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://patch.msgid.link/20260414081811.549755-2-hch@lst.de Signed-off-by: Jens Axboe commit feffac1874820d501e51cd8dcee697063b792c82 Author: Kaushlendra Kumar Date: Tue Mar 17 16:36:15 2026 +0530 tools/power/x86: Add SOC slider and platform profile support Add support for reading and writing SOC slider parameters and platform profile via sysfs in x86_energy_perf_policy. New command-line options: --soc-slider-balance --soc-slider-offset --platform-profile These options allow control of the processor thermal SOC slider balance and offset through the processor_thermal_soc_slider module, as well as the platform profile class interface. When no update flags are set, the tool now also prints the current SOC slider and platform profile values alongside existing MSR output. Signed-off-by: Kaushlendra Kumar Signed-off-by: Len Brown commit d3fdb3db13a209dc8005b301130538c705fda579 Merge: b3dde701e73354 b4b0233730d5b2 Author: Alexei Starovoitov Date: Wed Apr 15 12:10:20 2026 -0700 Merge branch 'fix-garbage-data-in-task-local-data' Amery Hung says: ==================== Fix garbage data in task local data Hi, The patchset fixes two scenarios where BPF side task local data API may see garbage data and adds corresponding selftests. ==================== Link: https://patch.msgid.link/20260413190259.358442-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit b4b0233730d5b2cdb170f6f5f183bfb1047b6dfa Author: Amery Hung Date: Mon Apr 13 12:02:59 2026 -0700 selftests/bpf: Test small task local data allocation Make sure task local data is working correctly for different allocation sizes. Existing task local data selftests allocate the maximum amount of data possible but miss the garbage data issue when only small amount of data is allocated. Therefore, test small data allocations as well. Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260413190259.358442-4-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 615e55a2418405b628921e0596ac50317fd04474 Author: Amery Hung Date: Mon Apr 13 12:02:58 2026 -0700 selftests/bpf: Fix tld_get_data() returning garbage data BPF side tld_get_data() currently may return garbage when tld_data_u is not aligned to page_size. This can happen when small amount of memory is allocated for tld_data_u. The misalignment is supposed to be allowed and the BPF side will use tld_data_u->start to reference the tld_data_u in a page. However, since "start" is within tld_data_u, there is no way to know the correct "start" in the first place. As a result, BPF programs will see garbage data. The selftest did not catch this since it tries to allocate the maximum amount of data possible (i.e., a page) such that tld_data_u->start is always correct. Fix it by moving tld_data_u->start to tld_data_map->start. The original field is now renamed as unused instead of removing it because BPF side tld_get_data() views off = 0 returned from tld_fetch_key() as uninitialized. Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260413190259.358442-3-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 36bf7beb9d23bfe7feba6f376a0c13ed7b670cf8 Author: Amery Hung Date: Mon Apr 13 12:02:57 2026 -0700 selftests/bpf: Prevent allocating data larger than a page Fix a bug in the task local data library that may allocate more than a a page for tld_data_u. This may happen when users set a too large TLD_DYN_DATA_SIZE, so check it when creating dynamic TLD fields and fix the corresponding selftest. Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260413190259.358442-2-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit b3dde701e73354eb1c5027adbf01a147b056954a Merge: 4fddde2a732de6 46ee1342b887c9 Author: Alexei Starovoitov Date: Wed Apr 15 12:09:47 2026 -0700 Merge branch 'bpf-arm64-riscv-remove-redundant-icache-flush-after-pack-allocator-finalize' Puranjay Mohan says: ==================== bpf, arm64/riscv: Remove redundant icache flush after pack allocator finalize Changelog: v1: https://lore.kernel.org/all/20260413123256.3296452-1-puranjay@kernel.org/ Changes in v2: - Remove "#include " as it is not needed now. - Add Acked-by: Song Liu When the BPF prog pack allocator was added for arm64 and riscv, the existing bpf_flush_icache() calls were retained after bpf_jit_binary_pack_finalize(). However, the finalize path copies the JITed code via architecture text patching routines (__text_poke on arm64, patch_text_nosync on riscv) that already perform a full flush_icache_range() internally. The subsequent bpf_flush_icache() repeats the same cache maintenance on the same range. Remove the redundant flush and the now-unused bpf_flush_icache() definitions on both architectures. ==================== Link: https://patch.msgid.link/20260413191111.3426023-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 46ee1342b887c9387a933397d846ff6c9584322c Author: Puranjay Mohan Date: Mon Apr 13 12:11:09 2026 -0700 bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator finalize bpf_flush_icache() calls flush_icache_range() to clean the data cache and invalidate the instruction cache for the JITed code region. However, since commit 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the BPF JIT"), this flush is redundant. bpf_jit_binary_pack_finalize() copies the JITed instructions to the ROX region via bpf_arch_text_copy() -> patch_text_nosync(), and patch_text_nosync() already calls flush_icache_range() on the written range. The subsequent bpf_flush_icache() repeats the same cache maintenance on an overlapping range. Remove the redundant bpf_flush_icache() call and its now-unused definition. Fixes: 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the BPF JIT") Acked-by: Song Liu Signed-off-by: Puranjay Mohan Reviewed-by: Pu Lehui Tested-by: Paul Chaignon Link: https://lore.kernel.org/r/20260413191111.3426023-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 42f18ae53011826cfd3c84d041817e7f07bc645b Author: Puranjay Mohan Date: Mon Apr 13 12:11:08 2026 -0700 bpf, arm64: Remove redundant bpf_flush_icache() after pack allocator finalize bpf_flush_icache() calls flush_icache_range() to clean the data cache and invalidate the instruction cache for the JITed code region. However, since commit 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management"), this flush is redundant. bpf_jit_binary_pack_finalize() copies the JITed instructions to the ROX region via bpf_arch_text_copy() -> aarch64_insn_copy() -> __text_poke(), and __text_poke() already calls flush_icache_range() on the written range. The subsequent bpf_flush_icache() repeats the same cache maintenance on an overlapping range, including an unnecessary second synchronous IPI to all CPUs via kick_all_cpus_sync(). Remove the redundant bpf_flush_icache() call and its now-unused definition. Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management") Acked-by: Song Liu Signed-off-by: Puranjay Mohan Acked-by: Breno Leitao Link: https://lore.kernel.org/r/20260413191111.3426023-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 4fddde2a732de60bb97e3307d4eb69ac5f1d2b74 Author: Alexei Starovoitov Date: Mon Apr 13 12:42:45 2026 -0700 bpf: Fix use-after-free in arena_vm_close on fork arena_vm_open() only bumps vml->mmap_count but never registers the child VMA in arena->vma_list. The vml->vma always points at the parent VMA, so after parent munmap the pointer dangles. If the child then calls bpf_arena_free_pages(), zap_pages() reads the stale vml->vma triggering use-after-free. Fix this by preventing the arena VMA from being inherited across fork with VM_DONTCOPY, and preventing VMA splits via the may_split callback. Also reject mremap with a .mremap callback returning -EINVAL. A same-size mremap(MREMAP_FIXED) on the full arena VMA reaches copy_vma() through the following path: check_prep_vma() - returns 0 early: new_len == old_len skips VM_DONTEXPAND check prep_move_vma() - vm_start == old_addr and vm_end == old_addr + old_len so may_split is never called move_vma() copy_vma_and_data() copy_vma() vm_area_dup() - copies vm_private_data (vml pointer) vm_ops->open() - bumps vml->mmap_count vm_ops->mremap() - returns -EINVAL, rollback unmaps new VMA The refcount ensures the rollback's arena_vm_close does not free the vml shared with the original VMA. Reported-by: Weiming Shi Reported-by: Xiang Mei Fixes: 317460317a02 ("bpf: Introduce bpf_arena.") Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260413194245.21449-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 1dd8be4ec722ce54e4cace59f3a4ba658111b3ec Author: Daniel Borkmann Date: Wed Apr 15 14:14:03 2026 +0200 bpf, arm64: Fix off-by-one in check_imm signed range check check_imm(bits, imm) is used in the arm64 BPF JIT to verify that a branch displacement (in arm64 instruction units) fits into the signed N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding before it is handed to the encoder. The macro currently tests for (imm > 0 && imm >> bits) || (imm < 0 && ~imm >> bits) which admits values in [-2^N, 2^N) — effectively a signed (N+1)-bit range. A signed N-bit field only holds [-2^(N-1), 2^(N-1)), so the check admits one extra bit of range on each side. In particular, for check_imm19(), values in [2^18, 2^19) slip past the check but do not fit into the 19-bit signed imm19 field of B.cond. aarch64_insn_encode_immediate() then masks the raw value into the 19-bit field, setting bit 18 (the sign bit) and flipping a forward branch into a backward one. Same class of issue exists for check_imm26() and the B/BL encoding. Shift by (bits - 1) instead of bits so the actual signed N-bit range is enforced. Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler") Signed-off-by: Daniel Borkmann Reviewed-by: Puranjay Mohan Link: https://lore.kernel.org/r/20260415121403.639619-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 48d83d94930eb4db4c93d2de44838b9455cff626 Author: Daniel Borkmann Date: Wed Apr 15 14:14:02 2026 +0200 bpf, arm64: Reject out-of-range B.cond targets aarch64_insn_gen_cond_branch_imm() calls label_imm_common() to compute a 19-bit signed byte offset for a conditional branch, but unlike its siblings aarch64_insn_gen_branch_imm() and aarch64_insn_gen_comp_branch_imm(), it does not check whether label_imm_common() returned its out-of-range sentinel (range) before feeding the value to aarch64_insn_encode_immediate(). aarch64_insn_encode_immediate() unconditionally masks the value with the 19-bit field mask, so an offset that was rejected by label_imm_common() gets silently truncated. With the sentinel value SZ_1M, the resulting field ends up with bit 18 (the sign bit of the 19-bit signed displacement) set, and the CPU decodes it as a ~1 MiB *backward* branch, producing an incorrectly targeted B.cond instruction. For code-gen locations like the emit_bpf_tail_call() this function is the only barrier between an overflowing displacement and a silently miscompiled branch. Fix it by returning AARCH64_BREAK_FAULT when the offset is out of range, so callers see a loud failure instead of a silently misencoded branch. validate_code() scans the generated image for any AARCH64_BREAK_FAULT and then lets the JIT fail. Fixes: 345e0d35ecdd ("arm64: introduce aarch64_insn_gen_cond_branch_imm()") Fixes: c94ae4f7c5ec ("arm64: insn: remove BUG_ON from codegen") Signed-off-by: Daniel Borkmann Reviewed-by: Puranjay Mohan Link: https://lore.kernel.org/r/20260415121403.639619-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 5bdb4078e1efba9650c03753616866192d680718 Merge: 7de6b4a246330f 7e311bafb9ad3a Author: Linus Torvalds Date: Wed Apr 15 10:54:24 2026 -0700 Merge tag 'sched_ext-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext updates from Tejun Heo: - cgroup sub-scheduler groundwork Multiple BPF schedulers can be attached to cgroups and the dispatch path is made hierarchical. This involves substantial restructuring of the core dispatch, bypass, watchdog, and dump paths to be per-scheduler, along with new infrastructure for scheduler ownership enforcement, lifecycle management, and cgroup subtree iteration The enqueue path is not yet updated and will follow in a later cycle - scx_bpf_dsq_reenq() generalized to support any DSQ including remote local DSQs and user DSQs Built on top of this, SCX_ENQ_IMMED guarantees that tasks dispatched to local DSQs either run immediately or get reenqueued back through ops.enqueue(), giving schedulers tighter control over queueing latency Also useful for opportunistic CPU sharing across sub-schedulers - ops.dequeue() was only invoked when the core knew a task was in BPF data structures, missing scheduling property change events and skipping callbacks for non-local DSQ dispatches from ops.select_cpu() Fixed to guarantee exactly one ops.dequeue() call when a task leaves BPF scheduler custody - Kfunc access validation moved from runtime to BPF verifier time, removing runtime mask enforcement - Idle SMT sibling prioritization in the idle CPU selection path - Documentation, selftest, and tooling updates. Misc bug fixes and cleanups * tag 'sched_ext-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (134 commits) tools/sched_ext: Add explicit cast from void* in RESIZE_ARRAY() sched_ext: Make string params of __ENUM_set() const tools/sched_ext: Kick home CPU for stranded tasks in scx_qmap sched_ext: Drop spurious warning on kick during scheduler disable sched_ext: Warn on task-based SCX op recursion sched_ext: Rename scx_kf_allowed_on_arg_tasks() to scx_kf_arg_task_ok() sched_ext: Remove runtime kfunc mask enforcement sched_ext: Add verifier-time kfunc context filter sched_ext: Drop redundant rq-locked check from scx_bpf_task_cgroup() sched_ext: Decouple kfunc unlocked-context check from kf_mask sched_ext: Fix ops.cgroup_move() invocation kf_mask and rq tracking sched_ext: Track @p's rq lock across set_cpus_allowed_scx -> ops.set_cpumask sched_ext: Add select_cpu kfuncs to scx_kfunc_ids_unlocked sched_ext: Drop TRACING access to select_cpu kfuncs selftests/sched_ext: Fix wrong DSQ ID in peek_dsq error message sched_ext: Documentation: improve accuracy of task lifecycle pseudo-code selftests/sched_ext: Improve runner error reporting for invalid arguments sched_ext: Documentation: Fix scx_bpf_move_to_local kfunc name sched_ext: Documentation: Add ops.dequeue() to task lifecycle tools/sched_ext: Fix off-by-one in scx_sdt payload zeroing ... commit 7de6b4a246330fe29fa2fd144b4724ca35d60d6c Merge: b71f0be2d23d87 76af54648899ab Author: Linus Torvalds Date: Wed Apr 15 10:32:08 2026 -0700 Merge tag 'wq-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: - New default WQ_AFFN_CACHE_SHARD affinity scope subdivides LLCs into smaller shards to improve scalability on machines with many CPUs per LLC - Misc: - system_dfl_long_wq for long unbound works - devm_alloc_workqueue() for device-managed allocation - sysfs exposure for ordered workqueues and the EFI workqueue - removal of HK_TYPE_WQ from wq_unbound_cpumask - various small fixes * tag 'wq-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: (21 commits) workqueue: validate cpumask_first() result in llc_populate_cpu_shard_id() workqueue: use NR_STD_WORKER_POOLS instead of hardcoded value workqueue: avoid unguarded 64-bit division docs: workqueue: document WQ_AFFN_CACHE_SHARD affinity scope workqueue: add test_workqueue benchmark module tools/workqueue: add CACHE_SHARD support to wq_dump.py workqueue: set WQ_AFFN_CACHE_SHARD as the default affinity scope workqueue: add WQ_AFFN_CACHE_SHARD affinity scope workqueue: fix typo in WQ_AFFN_SMT comment workqueue: Remove HK_TYPE_WQ from affecting wq_unbound_cpumask workqueue: unlink pwqs from wq->pwqs list in alloc_and_link_pwqs() error path workqueue: Remove NULL wq WARN in __queue_delayed_work() workqueue: fix parse_affn_scope() prefix matching bug workqueue: devres: Add device-managed allocate workqueue workqueue: Add system_dfl_long_wq for long unbound works tools/workqueue/wq_dump.py: add NODE prefix to all node columns tools/workqueue/wq_dump.py: fix column alignment in node_nr/max_active section tools/workqueue/wq_dump.py: remove backslash separator from node_nr/max_active header efi: Allow to expose the workqueue via sysfs workqueue: Allow to expose ordered workqueues via sysfs ... commit b71f0be2d23d876648758d57bc6761500e3b9c70 Merge: 05cef13fa80de8 3348e1e83a0f8a Author: Linus Torvalds Date: Wed Apr 15 10:18:49 2026 -0700 Merge tag 'cgroup-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - cgroup_file_notify() locking converted from a global lock to per-cgroup_file spinlock with a lockless fast-path when no notification is needed - Misc changes including exposing cgroup helpers for sched_ext and minor fixes * tag 'cgroup-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/rdma: fix swapped arguments in pr_warn() format string cgroup/dmem: remove region parameter from dmemcg_parse_limit cgroup: replace global cgroup_file_kn_lock with per-cgroup_file lock cgroup: add lockless fast-path checks to cgroup_file_notify() cgroup: reduce cgroup_file_kn_lock hold time in cgroup_file_notify() cgroup: Expose some cgroup helpers commit 05cef13fa80de8cec481ae5a015e58bc6340ca2d Merge: a8e7ef3cec99ba 44e0ebe4accd67 Author: Linus Torvalds Date: Wed Apr 15 10:15:39 2026 -0700 Merge tag 'slab-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - Sheaves performance improvements for systems with memoryless NUMA nodes, developed in response to regression reports. These mainly ensure that percpu sheaves exist and are used on cpus that belong to these memoryless nodes (Vlastimil Babka, Hao Li). - Cleanup API usage and constify sysfs attributes (Thomas Weißschuh) - Disable kfree_rcu() batching on builds intended for fuzzing/debugging that enable CONFIG_RCU_STRICT_GRACE_PERIOD (Jann Horn) - Add a kunit test for kmalloc_nolock()/kfree_nolock() (Harry Yoo) * tag 'slab-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slub: clarify kmem_cache_refill_sheaf() comments lib/tests/slub_kunit: add a test case for {kmalloc,kfree}_nolock MAINTAINERS: add lib/tests/slub_kunit.c to SLAB ALLOCATOR section slub: use N_NORMAL_MEMORY in can_free_to_pcs to handle remote frees slab,rcu: disable KVFREE_RCU_BATCHED for strict grace period slab: free remote objects to sheaves on memoryless nodes slab: create barns for online memoryless nodes slab: decouple pointer to barn from kmem_cache_node slab: remove alloc_full_sheaf() mm/slab: constify sysfs attributes mm/slab: create sysfs attribute through default_groups commit 1583a7ded0d3d67fd6e7e4336600bc191d068a20 Author: Jaegeuk Kim Date: Wed Apr 1 04:05:56 2026 +0000 f2fs: do not support mmap write for large folio Let's check mmap writes onto the large folio, since we don't support writing large folios. Reviewed-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit a8e7ef3cec99ba2487110e01d77a8a278593b3e9 Merge: 4a57e0913e8c7f e0da8a8cac74f4 Author: Linus Torvalds Date: Wed Apr 15 09:20:49 2026 -0700 Merge tag 'sound-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "Nothing too thrilling here, but we see lots of driver updates and bug fixes, including quirk additions and refactoring works, while there have been little changes in the core functionality. Here are some highlights: Core: - Add validation for the control API put callback - Fixes in compress-offload API timestamp handling - Continued ASoC core API cleanups ASoC: - Add support for bus keepers (for Apple devices in future) - Enhancements to the SDCA support, including retaskable jacks - Test improvements for Cirrus Logic drivers - Lots of fixes for the NXP, nVidia and Qualcomm - Support for AMD RPL DMIC, Cirrus Logic CS42L43 and CS47L47, nVidia machines with CPCAP and WM8962 USB-audio: - Quirks for Huawei Headset, Focusrite Novation, MV-Silicon, Studio 1824, Arturia AF16Rig, Hotone Audio, Feaulle Rainbow, PreSonus AudioBox, Moondrop Ju Jiu, Scarlett 18i20, etc - Extended mixer volume quirk handling - UAF and other fixes for us144mkii, 6fire and caiaq drivers HD-audio: - Add quirks or fixes for Acer, Lenovo, HP, ASUS machines - Fixes & cleanups of GPIO helper code Misc: - Add suspend/resume support for multiple legacy ISA and Apple drivers - Further regression fixes for ctxfi driver" * tag 'sound-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (359 commits) ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() ALSA: usb-audio: Fix missing error handling for get_min_max*() ALSA: hda/realtek - fixed speaker no sound update ALSA: hda/realtek: Add quirk for Acer PT316-51S headset mic ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUP ALSA: hda/realtek: Add quirk for Legion S7 15IMH ALSA: hda/realtek: Add quirk for HP Spectre x360 14-ea ALSA: caiaq: take a reference on the USB device in create_card() ASoC: dt-bindings: rockchip: convert rk3399-gru-sound to DT Schema ALSA: sscape: Add suspend and resume support ALSA: sscape: Cache per-card resources for board reinitialization ALSA: usb-audio: Do not expose sticky mixers ALSA: usb-audio: Move volume control resolution check into a function ALSA: usb-audio: Add error checks against get_min_max*() ALSA: usb-audio: Add quirk for PreSonus AudioBox USB ALSA: interwave: guard PM-only restore helpers with CONFIG_PM ALSA: usb-audio: Evaluate packsize caps at the right place ALSA: sc6000: Restore board setup across suspend ALSA: sc6000: Keep the programmed board state in card-private data ALSA: 6fire: fix use-after-free on disconnect ... commit 4a57e0913e8c7fff407e97909f4ae48caa84d612 Merge: afac4c66d1aa63 83e8d8bbffa816 Author: Linus Torvalds Date: Wed Apr 15 08:45:00 2026 -0700 Merge tag 'drm-next-2026-04-15' of https://gitlab.freedesktop.org/drm/kernel Pull drm updates from Dave Airlie: "Highlights: - new DRM RAS infrastructure using netlink - amdgpu: enable DC on CIK APUs, and more IP enablement, and more user queue work - xe: purgeable BO support, and new hw enablement - dma-buf : add revocable operations Full summary: mm: - two-pass MMU interval notifiers - add gpu active/reclaim per-node stat counters math: - provide __KERNEL_DIV_ROUND_CLOSEST() in UAPI - implement DIV_ROUND_CLOSEST() with __KERNEL_DIV_ROUND_CLOSEST() rust: - shared tag with driver-core: register macro and io infra - core: rework DMA coherent API - core: add interop::list to interop with C linked lists - core: add more num::Bounded operations - core: enable generic_arg_infer and add EMSGSIZE - workqueue: add ARef support for work and delayed work - add GPU buddy allocator abstraction - add DRM shmem GEM helper abstraction - allow drm:::Device to dispatch work and delayed work items to driver private data - add dma_resv_lock helper and raw accessors core: - introduce DRM RAS infrastructure over netlink - add connector panel_type property - fourcc: add ARM interleaved 64k modifier - colorop: add destroy helper - suballoc: split into alloc and init helpers - mode: provide DRM_ARGB_GET*() macros for reading color components edid: - provide drm_output_color_Format dma-buf: - provide revoke mechanism for shared buffers - rename move_notify to invalidate_mappings - always enable move_notify - protect dma_fence_ops with RCU and improve locking - clean pages with helpers atomic: - allocate drm_private_state via callback - helper: use system_percpu_wq buddy: - make buddy allocator available to gpu level - add kernel-doc for buddy allocator - improve aligned allocation ttm: - fix fence signalling - improve tests and docs - improve handling of gfp_retry_mayfail - use per-node stat counters to track memory allocations - port pool to use list_lru - drop NUMA specific pools - make pool shrinker numa aware - track allocated pages per numa node coreboot: - cleanup coreboot framebuffer support sched: - fix race condition in drm_sched_fini pagemap: - enable THP support - pass pagemap_addr by reference gem-shmem: - Track page accessed/dirty status across mmap/vmap gpusvm: - reenable device to device migration - fix unbalanced unclock bridge: - anx7625: Support USB-C plus DT bindings - connector: Fix EDID detection - dw-hdmi-qp: Support Vendor-Specfic and SDP Infoframes; improve others - fsl-ldb: Fix visual artifacts plus related DT property 'enable-termination-resistor' - imx8qxp-pixel-link: Improve bridge reference handling - lt9611: Support Port-B-only input plus DT bindings - tda998x: Support DRM_BRIDGE_ATTACH_NO_CONNECTOR; Clean up - Support TH1520 HDMI plus DT bindings - waveshare-dsi: Fix register and attach; Support 1..4 DSI lanes plus DT bindings - anx7625: Fix USB Type-C handling - cdns-mhdp8546-core: Handle HDCP state in bridge atomic_check - Support Lontium LT8713SX DP MST bridge plus DT bindings - analogix_dp: Use DP helpers for link training panel: - panel-jdi-lt070me05000: Use mipi-dsi multi functions - panel-edp: Support Add AUO B116XAT04.1 (HW: 1A); Support CMN N116BCL-EAK (C2); Support FriendlyELEC plus DT changes - panel-edp: Fix timings for BOE NV140WUM-N64 - ilitek-ili9882t: Allow GPIO calls to sleep - jadard: Support TAIGUAN XTI05101-01A - lxd: Support LXD M9189A plus DT bindings - mantix: Fix pixel clock; Clean up - motorola: Support Motorola Atrix 4G and Droid X2 plus DT bindings - novatek: Support Novatek/Tianma NT37700F plus DT bindings - simple: Support EDT ET057023UDBA plus DT bindings; Support Powertip PH800480T032-ZHC19 plus DT bindings; Support Waveshare 13.3" - novatek-nt36672a: Use mipi_dsi_*_multi() functions - panel-edp: Support BOE NV153WUM-N42, CMN N153JCA-ELK, CSW MNF307QS3-2 - support Himax HX83121A plus DT bindings - support JuTouch JT070TM041 plus DT bindings - support Samsung S6E8FC0 plus DT bindings - himax-hx83102c: support Samsung S6E8FC0 plus DT bindings; support backlight - ili9806e: support Rocktech RK050HR345-CT106A plus DT bindings - simple: support Tianma TM050RDH03 plus DT bindings amdgpu: - enable DC by default on CIK APUs - userq fence ioctl param size fixes - set panel_type to OLED for eDP - refactor DC i2c code - FAMS2 update - rework ttm handling to allow multiple engines - DC DCE 6.x cleanup - DC support for NUTMEG/TRAVIS DP bridge - DCN 4.2 support - GC12 idle power fix for compute - use struct drm_edid in non-DC code - enable NV12/P010 support on primary planes - support newer IP discovery tables - VCN/JPEG 5.0.2 support - GC/MES 12.1 updates - USERQ fixes - add DC idle state manager - eDP DSC seamless boot amdkfd: - GC 12.1 updates - non 4K page fixes xe: - basic Xe3p_LPG and NVL-P enabling patches - allow VM_BIND decompress support - add purgeable buffer object support - add xe_vm_get_property_ioctl - restrict multi-lrc to VCS/VECS engines - allow disabling VM overcommit in fault mode - dGPU memory optimizations - Workaround cleanups and simplification - Allow VFs VRAM quote changes using sysfs - convert GT stats to per-cpu counters - pagefault refactors - enable multi-queue on xe3p_xpc - disable DCC on PTL - make MMIO communication more robust - disable D3Cold for BMG on specific platforms - vfio: improve FLR sync for Xe VFIO i915/display: - C10/C20/LT PHY PLL divider verification - use trans push mechanism to generate PSR frame change on LNL+ - refactor DP DSC slice config - VGA decode refactoring - refactor DPT, gen2-4 overlay, masked field register macro helpers - refactor stolen memory allocation decisions - prepare for UHBR DP tunnels - refactor LT PHY PLL to use DPLL framework - implement register polling/waiting in display code - add shared stepping header between i915 and display i915: - fix potential overflow of shmem scatterlist length nouveau: - provide Z cull info to userspace - initial GA100 support - shutdown on PCI device shutdown nova-core: - harden GSP command queue - add support for large RPCs - simplify GSP sequencer and message handling - refactor falcon firmware handling - convert to new register macro - conver to new DMA coherent API - use checked arithmetic - add debugfs support for gsp-rm log buffers - fix aux device registration for multi-GPU msm: - CI: - Uprev mesa - Restore CI jobs for Qualcomm APQ8016 and APQ8096 devices - Core: - Switched to of_get_available_child_by_name() - DPU: - Fixes for DSC panels - Fixed brownout because of the frequency / OPP mismatch - Quad pipe preparation (not enabled yet) - Switched to virtual planes by default - Dropped VBIF_NRT support - Added support for Eliza platform - Reworked alpha handling - Switched to correct CWB definitions on Eliza - Dropped dummy INTF_0 on MSM8953 - Corrected INTFs related to DP-MST - DP: - Removed debug prints looking into PHY internals - DSI: - Fixes for DSC panels - RGB101010 support - Support for SC8280XP - Moved PHY bindings from display/ to phy/ - GPU: - Preemption support for x2-85 and a840 - IFPC support for a840 - SKU detection support for x2-85 and a840 - Expose AQE support (VK ray-pipeline) - Avoid locking in VM_BIND fence signaling path - Fix to avoid reclaim in GPU snapshot path - Disallow foreign mapping of _NO_SHARE BOs - HDMI: - Fixed infoframes programming - MDP5: - Dropped support for MSM8974v1 - Dropped now unused code for MSM8974 v1 and SDM660 / MSM8998 panthor: - add tracepoints for power and IRQs - fix fence handling - extend timestamp query with flags - support various sources for timestamp queries tyr: - fix names and model/versions rockchip: - vop2: use drm logging function - rk3576 displayport support - support CRTC background color atmel-hlcdc: - support sana5d65 LCD controller tilcdc: - use DT bindings schema - use managed DRM interfaces - support DRM_BRIDGE_ATTACH_NO_CONNECTOR verisilicon: - support DC8200 + DT bindings virtgpu: - support PRIME import with 3D enabled komeda: - fix integer overflow in AFBC checks mcde: - improve bridge handling gma500: - use drm client buffer for fbdev framebuffer amdxdna: - add sensors ioctls - provide NPU power estimate - support column utilization sensor - allow forcing DMA through IOMMU IOVA - support per-BO mem usage queries - refactor GEM implementation ivpu: - update boot API to v3.29.4 - limit per-user number of doorbells/contexts - perform engine reset on TDR error loongson: - replace custom code with drm_gem_ttm_dumb_map_offset() imx: - support planes behind the primary plane - fix bus-format selection vkms: - support CRTC background color v3d: - improve handling of struct v3d_stats komeda: - support Arm China Linlon D6 plus DT bindings imagination: - improve power-off sequence - support context-reset notification from firmware mediatek: - mtk_dsi: enable hs clock during pre-enable - Remove all conflicting aperture devices during probe - Add support for mt8167 display blocks" * tag 'drm-next-2026-04-15' of https://gitlab.freedesktop.org/drm/kernel: (1735 commits) drm/ttm/tests: Remove checks from ttm_pool_free_no_dma_alloc drm/ttm/tests: fix lru_count ASSERT drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs drm/fb-helper: Fix a locking bug in an error path dma-fence: correct kernel-doc function parameter @flags ttm/pool: track allocated_pages per numa node. ttm/pool: make pool shrinker NUMA aware (v2) ttm/pool: drop numa specific pools ttm/pool: port to list_lru. (v2) drm/ttm: use gpu mm stats to track gpu memory allocations. (v4) mm: add gpu active/reclaim per-node stat counters (v2) gpu: nova-core: fix missing colon in SEC2 boot debug message gpu: nova-core: vbios: use from_le_bytes() for PCI ROM header parsing gpu: nova-core: bitfield: fix broken Default implementation gpu: nova-core: falcon: pad firmware DMA object size to required block alignment gpu: nova-core: gsp: fix undefined behavior in command queue code drm/shmem_helper: Make sure PMD entries get the writeable upgrade accel/ivpu: Trigger recovery on TDR with OS scheduling drm/msm: Use of_get_available_child_by_name() dt-bindings: display/msm: move DSI PHY bindings to phy/ subdir ... commit 2865c3f3f620fa78294522665f470e1bf0e64d47 Merge: 813f336269e629 d97cc8fc997c77 Author: Alexei Starovoitov Date: Wed Apr 15 08:40:48 2026 -0700 Merge branch 'bpf-arg-tracking-for-imprecise-multi-offset-bpf_st-stx' Eduard Zingerman says: ==================== bpf: arg tracking for imprecise/multi-offset BPF_ST/STX When the static arg tracking analysis encounters a store through a pointer with imprecise or multi-offset destination, it must use weak updates (join) instead of strong updates (overwrite) for the affected at_stack slots. At runtime only one slot is actually written; the others retain their old values. Two cases are addressed: - BPF_STX, handled by spill_to_stack(). It was gated on `dst_is_local_fp = (frame == depth)`, which missed ARG_IMPRECISE pointers entirely. - BPF_ST, handled by clear_stack_for_all_offs(). It delegates to clear_overlapping_stack_slots() which unconditionally set `at_stack[i] = none`. Change to `at_stack[i] = join(old, none)` when multiple candidate slots exist (cnt != 1), so that untouched slots preserve their tracked values. No veristat diff compared to current master when tested on selftests, sched_ext, cilium and a set of Meta internal programs. This addresses issues reported by sashiko for patch #7 in [1]. [1] https://sashiko.dev/#/patchset/20260410-patch-set-v4-0-5d4eecb343db%40gmail.com Changelog: v2 -> v3: - Use check_add_overflow() in arg_add() (Alexei). - Add missing fixes tag (CI bot). - Remove unused __imm in the selftest (sashiko). v1 -> v2: - Delete the OFF_IMPRECISE constant, always rely on arg_track->cnt == 0 as a marker the offset is imprecise. (Alexei). - Squash all patches together to simplify backporting to 'bpf' branch (Alexei). v1: https://lore.kernel.org/bpf/20260413-stacklive-fixes-v1-0-9f48a9999d6e@gmail.com/T/ v2: https://lore.kernel.org/bpf/20260413-stacklive-fixes-v2-0-ff91c4f8d273@gmail.com/T/ --- ==================== Link: https://patch.msgid.link/20260413-stacklive-fixes-v2-0-398e126e5cf3@gmail.com Signed-off-by: Alexei Starovoitov commit d97cc8fc997c77234580c77b21466164ff71307a Author: Eduard Zingerman Date: Mon Apr 13 16:30:53 2026 -0700 selftests/bpf: arg tracking for imprecise/multi-offset BPF_ST/STX Add test cases for clear_stack_for_all_offs and dst_is_local_fp handling of multi-offset and ARG_IMPRECISE stack pointers: - st_imm_join_with_multi_off: BPF_ST through multi-offset dst should join at_stack with none instead of overwriting both candidate slots. - st_imm_join_with_imprecise_off: BPF_ST through offset-imprecise dst should join at_stack with none instead of clearing all slots. - st_imm_join_with_single_off: a canary checking that BPF_ST with a known offset overwrites slot instead of joining. - imprecise_dst_spill_join: BPF_STX through ARG_IMPRECISE dst should be recognized as a local spill and join at_stack with the written value. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260413-stacklive-fixes-v2-2-398e126e5cf3@gmail.com Signed-off-by: Alexei Starovoitov commit ecdd4fd8a54ca4679ab8676674a2388ea37eee1a Author: Eduard Zingerman Date: Mon Apr 13 16:30:52 2026 -0700 bpf: fix arg tracking for imprecise/multi-offset BPF_ST/STX BPF_STX through ARG_IMPRECISE dst should be recognized as a local spill and join at_stack with the written value. For example, consider the following situation: // r1 = ARG_IMPRECISE{mask=BIT(0)|BIT(1)} *(u64 *)(r1 + 0) = r8 Here the analysis should produce an equivalent of at_stack[*] = join(old, r8) BPF_ST through multi-offset or imprecise dst should join at_stack with none instead of overwriting the slots. For example, consider the following situation: // r1 = ARG_IMPRECISE{mask=BIT(0)|BIT(1)} *(u64 *)(r1 + 0) = 0 Here the analysis should produce an equivalent of at_stack[*r1] = join(old, none). Move the definition of the clear_overlapping_stack_slots() in order to have __arg_track_join() visible. Remove the OFF_IMPRECISE constant to avoid having two ways to express imprecise offset. Only 'offset-imprecise {frame=N, cnt=0}' remains. Fixes: bf0c571f7feb ("bpf: introduce forward arg-tracking dataflow analysis") Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260413-stacklive-fixes-v2-1-398e126e5cf3@gmail.com Signed-off-by: Alexei Starovoitov commit afac4c66d1aa6396ce44d94fe895d7b61e085fd4 Merge: 00c6649bafef62 a31e4518bec703 Author: Linus Torvalds Date: Wed Apr 15 08:37:45 2026 -0700 Merge tag 'fbdev-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "A major refactorization by Thomas Zimmermann from SUSE regarding handling of console font data, addition of helpers for console font rotation and split into individual components for glyphs, fonts and the overall fbcon state. And there is the round of usual code cleanups and fixes: Cleanups: - atyfb: Remove unused fb_list (Geert Uytterhoeven) - goldfishfb, wmt_ge_rops: use devm_platform_ioremap_resource() (Amin GATTOUT) - matroxfb: Mark variable with __maybe_unused (Andy Shevchenko) - omapfb: Add missing error check for clk_get() (Chen Ni) - tdfxfb: Make the VGA register initialisation a bit more obvious (Daniel Palmer) - macfb: Replace deprecated strcpy with strscpy (Thorsten Blum) Fixes: - tdfxfb, udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (Greg Kroah-Hartman) - omap2: fix inconsistent lock returns in omapfb_mmap (Hongling Zeng) - viafb: check ioremap return value in viafb_lcd_get_mobile_state (Wang Jun)" * tag 'fbdev-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (40 commits) fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO fbdev: omap2: fix inconsistent lock returns in omapfb_mmap MAINTAINERS: Add dedicated entry for fbcon fbcon: Put font-rotation state into separate struct fbcon: Fill cursor mask in helper function lib/fonts: Implement font rotation lib/fonts: Refactor glyph-rotation helpers lib/fonts: Refactor glyph-pattern helpers lib/fonts: Implement glyph rotation lib/fonts: Clean up Makefile lib/fonts: Provide helpers for calculating glyph pitch and size vt: Implement helpers for struct vc_font in source file fbcon: Avoid OOB font access if console rotation fails fbdev: atyfb: Remove unused fb_list fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break fbdev: update help text for CONFIG_FB_NVIDIA fbdev: omapfb: Add missing error check for clk_get() fbdev: viafb: check ioremap return value in viafb_lcd_get_mobile_state lib/fonts: Remove internal symbols and macros from public header file ... commit 00c6649bafef628955569dd39a59e3170e48f7b5 Merge: 1f5ffc672165ff 4fbeef21f53872 Author: Linus Torvalds Date: Wed Apr 15 08:32:10 2026 -0700 Merge tag 'media/v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - new CSI tegra support, covering Tegra20 and Tegra30 - new camera sensor drivers: T4ka3 and ov2732 - m88ds3103: add 3103c chip support - uvcvideo: add support for Intel RealSense D436/D555 and P010 pixel format - synopsys csi2rx: add i.MX93 support - imx8-isi: add i.MX95 support - imx8mq-mipi-csi2: add i.MX8ULP support - dw100: add V4L2 requests support - support for DTV devices from Hauppauge got some improvements - media staging: dropped starfive-camss driver - media docs: document multi-committers model and improve maint profile - media core: - add v4l2_subdev_get_frame_desc_passthrough() helper - improve error handling in fwnode parsing - lots of driver fixes, cleanups and improvements * tag 'media/v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (251 commits) Revert "media: cx231xx: add USB ID 2040:8360 for Hauppauge WinTV-HVR-935" media: synopsys: csi2rx: add i.MX93 support media: dt-bindings: add NXP i.MX93 compatible string media: synopsys: csi2rx: Use enum and u32 array for register offsets media: synopsys: csi2rx: implement .get_frame_desc() callback media: synopsys: csi2rx: only check errors from devm_clk_bulk_get_all() media: synopsys: csi2rx: use devm_reset_control_get_optional_exclusive() media: i2c: imx283: add support for non-continuous MIPI clock mode media: i2c: ov08d10: add support for 24 MHz input clock media: i2c: ov08d10: add support for reset and power management media: i2c: ov08d10: add support for binding via device tree dt-bindings: media: i2c: document Omnivision OV08D10 CMOS image sensor media: i2c: ov08d10: add missing newline to prints media: i2c: ov08d10: fix some typos in comments media: i2c: ov08d10: remove duplicate register write media: i2c: ov08d10: fix image vertical start setting media: i2c: ov08d10: fix runtime PM handling in probe staging: media: ipu7: Update TODO media: Add t4ka3 camera sensor driver media: i2c: Add ov2732 image sensor driver ... commit 813f336269e629da5d9c86a8098d6bee3d84680e Author: Shung-Hsi Yu Date: Wed Apr 15 20:03:28 2026 +0800 selftests/bpf: Fix timer_start_deadlock failure due to hrtimer change Since commit f2e388a019e4 ("hrtimer: Reduce trace noise in hrtimer_start()"), hrtimer_cancel tracepoint is no longer called when a hrtimer is re-armed. So instead of a hrtimer_cancel followed by hrtimer_start tracepoint events, there is now only a since hrtimer_start tracepoint event with the new was_armed field set to 1, to indicated that the hrtimer was previously armed. Update timer_start_deadlock accordingly so it traces hrtimer_start tracepoint instead, with was_armed used as guard. Signed-off-by: Shung-Hsi Yu Tested-by: Mykyta Yatsenko Acked-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260415120329.129192-1-shung-hsi.yu@suse.com Signed-off-by: Alexei Starovoitov commit 6c724ce0ec6ed8608917673bbb363b208ce2644c Merge: 3939dba00f981c dc989bb7938019 Author: Dave Jiang Date: Wed Apr 15 08:16:31 2026 -0700 Merge branch 'for-7.1/cxl-misc' into cxl-for-next MAINTAINERS: Update Jonathan Cameron's email address commit dc989bb79380194917351284167f78c3aa084c94 Author: Jonathan Cameron Date: Wed Apr 15 13:43:57 2026 +0100 MAINTAINERS: Update Jonathan Cameron's email address Update my email address for CXL, FWCTL and Cache subsystems to use my kernel.org account. Also update .mailmap. Separate patches will replace maintainers for HiSilicon specific hardware. Signed-off-by: Jonathan Cameron Acked-by: Conor Dooley Link: https://patch.msgid.link/20260415124357.12539-1-Jonathan.Cameron@huawei.com Signed-off-by: Dave Jiang commit 61b00c0ad209a712e0c8c83a6c998158155c9673 Author: Hans de Goede Date: Mon Apr 13 11:31:00 2026 +0200 ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section The video_detect_dmi_table[] quirk table has different sections for different types of problems. The Lenovo Legion S7 15ACH6 quirk deals with a non working nvidia_wmi_ec backlight, move it to the section with the other models with this problem. While at it also add a comment with the laptop model name to the quirk. Fixes: f144bc21befd ("ACPI: video: force native for Lenovo 82K8") Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20260413093100.24993-1-johannes.goede@oss.qualcomm.com Signed-off-by: Rafael J. Wysocki commit ad7997f5a01af6f711fe6b6a2df578b964109d49 Author: Jan Schär Date: Sat Apr 11 11:26:06 2026 +0200 ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO The Dell OptiPlex 7770 AIO needs the same quirk as the 7760 AIO. The backlight can be controlled with the native controller, intel_backlight, but not with dell_uart_backlight. I dumped the DSDT using acpidump, acpixtract and iasl, and confirmed that it contains the DELL0501 device. When loading the dell_uart_backlight driver with `rmmod dell_uart_backlight`, `modprobe dell_uart_backlight dyndbg`, it reports "Firmware version: GL_Re_V18". Fixes: cd8e468efb4f ("ACPI: video: Add Dell UART backlight controller detection") Cc: All applicable Signed-off-by: Jan Schär Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260411092606.47925-1-jan@jschaer.ch Signed-off-by: Rafael J. Wysocki commit fbd5d52ebf49595975e24e14e57632d580738091 Author: Arnd Bergmann Date: Mon Apr 13 09:01:26 2026 +0200 ACPI: add acpi_get_cpu_uid() stub helper When ACPI is disabled, x86 Xen support fails to build: arch/x86/xen/enlighten_hvm.c: In function 'xen_cpu_up_prepare_hvm': arch/x86/xen/enlighten_hvm.c:165:13: error: implicit declaration of function 'acpi_get_cpu_uid' [-Wimplicit-function-declaration] 165 | if (acpi_get_cpu_uid(cpu, &cpu_uid) == 0) | ^~~~~~~~~~~~~~~~ Add a trivial stub that can be used in place of the real function. Fixes: f652d0a4e13c ("ACPI: Centralize acpi_get_cpu_uid() declaration in include/linux/acpi.h") Signed-off-by: Arnd Bergmann Acked-by: Chengwen Feng Link: https://patch.msgid.link/20260413070132.3828606-1-arnd@kernel.org Signed-off-by: Rafael J. Wysocki commit 02c78abe1b373e141fb40bcf50dd5ae291161224 Author: Lukas Bulwahn Date: Mon Apr 13 12:21:18 2026 +0200 MAINTAINERS: adjust file entry in NVIDIA GHES HANDLER Commit d7610855b0b5 ("ACPI: APEI: GHES: Add NVIDIA vendor CPER record handler") adds the file drivers/acpi/apei/ghes-nvidia.c and also adds a section NVIDIA GHES VENDOR CPER RECORD HANDLER in the MAINTAINERS file with a file entry referring to drivers/acpi/apei/nvidia-ghes.c. Note that the file name in the entry (nvidia-ghes.c) differs from the actual file in the repository (ghes-nvidia.c). Adjust the file entry to the actual existing file. Fixes: d7610855b0b5 ("ACPI: APEI: GHES: Add NVIDIA vendor CPER record handler") Signed-off-by: Lukas Bulwahn Link: https://patch.msgid.link/20260413102118.33088-1-lukas.bulwahn@redhat.com Signed-off-by: Rafael J. Wysocki commit 9c0acc169ac71535477caedea8315f7041c5f07c Author: Guangshuo Li Date: Mon Apr 13 21:53:43 2026 +0800 ACPI: scan: Use acpi_dev_put() in object add error paths After acpi_init_device_object(), the lifetime of struct acpi_device is managed by the driver core through reference counting. Both acpi_add_power_resource() and acpi_add_single_object() call acpi_init_device_object() and then invoke acpi_device_add(). If that fails, their error paths call the release callback directly instead of dropping the device reference through acpi_dev_put(). This bypasses the normal device lifetime rules and frees the object without releasing the reference acquired by device_initialize(), which may lead to a refcount leak. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix both error paths by using acpi_dev_put() and let the release callback handle the final cleanup. Fixes: 781d737c7466 ("ACPI: Drop power resources driver") Fixes: 718fb0de8ff88 ("ACPI: fix NULL bug for HID/UID string") Cc: All applicable Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260413135343.2884481-1-lgs201920130244@gmail.com Signed-off-by: Rafael J. Wysocki commit d33db956c9618e7cb08c2520ce708437914214ec Author: Thomas Zimmermann Date: Thu Apr 2 11:09:15 2026 +0200 hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Hyperv's sysfb access only exists in the VMBUS support. Therefore only select CONFIG_SYSFB for CONFIG_HYPERV_VMBUS. Avoids sysfb code on systems that don't need it. Signed-off-by: Thomas Zimmermann Fixes: 96959283a58d ("Drivers: hv: Always select CONFIG_SYSFB for Hyper-V guests") Cc: Michael Kelley Cc: Saurabh Sengar Cc: Wei Liu Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Dexuan Cui Cc: Long Li Cc: linux-hyperv@vger.kernel.org Cc: # v6.16+ Reviewed-by: Saurabh Sengar Link: https://patch.msgid.link/20260402092305.208728-2-tzimmermann@suse.de commit d9448dca423543c6c0a9890d3ff53a5d51895318 Author: Timofey Tarasenko Date: Wed Apr 15 17:46:57 2026 +1000 ALSA: hda/realtek: add quirk for HONOR MRB-XXX M1020 Adds pin fixups to enable subwoofer and JACK functionality on Honor Magicbook Art 14 2025 (HONOR MRB-XXX M1020) Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221147 Signed-off-by: Timofey Tarasenko Link: https://patch.msgid.link/20260415074657.1217862-1-timka.tarasen@gmail.com Signed-off-by: Takashi Iwai commit 37a6b2d67b0a08e5c3d2156c9178c158c3c0225f Author: Rong Zhang Date: Tue Apr 14 21:29:01 2026 +0800 ALSA: usb-audio: Tidy up error check for processing unit There are two duplicated code paths calling get_min_max() with the same arguments in build_audio_procunit(). This once led to a failure to notice a code path that caused the `err' variable uninitialized when adding error checks for callers of get_min_max*() [1]. Move cases in the switch-case statement to tidy up the error check by merging the duplicated code paths together with a fallthrough attribute. This also eliminates the `err = 0' lines and aggregates the error check along with the corresponding call together, so that the intent of these code paths is clearer. The refactor also has an interesting effect that shrinks the .text size by 16 bytes (GCC 15 amd64). It seems that the compiler was unable to perform dead code elimination for the `err = 0' paths before. Link: https://lore.kernel.org/r/ad36dGpCBTGsyFr_@stanley.mountain/ [1] Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20260414-uac-build_auto_procunit-refactor-v1-1-afeb7efa6518@rong.moe Signed-off-by: Takashi Iwai commit 02df59d0258cd97cc60b49e5570ebfcc95ea6030 Author: Takashi Iwai Date: Tue Apr 14 15:22:14 2026 +0200 ALSA: 6fire: Drop unnecessary NULL checks The NULL checks of chip pointer in usb6fire_chip_abrt() and usb6fire_card_free() are utterly useless, as it's guaranteed to be non-NULL. Drop them for increasing the readability. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260414132218.411013-5-tiwai@suse.de commit 14101a067012ee227b7c3e5ec877e79885961cff Author: Takashi Iwai Date: Tue Apr 14 15:22:13 2026 +0200 ALSA: 6fire: Reduce multi-level conditionals in usb6fire_chip_disconnect() The current code has deep indentation levels because of multiple if's. Make it returning and reduce the multi-level conditionals for increasing the code readability. No functional change, just but a code refactoring. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260414132218.411013-4-tiwai@suse.de commit 4d5de85b6a9961130666070061a2466913a5c607 Author: Takashi Iwai Date: Tue Apr 14 15:22:12 2026 +0200 ALSA: 6fire: Fix leftover global pointers after probe failures snd-usb-6fire driver holds devices[] and chips[] pointer arrays to keep the usb_device and sfire_chip objects assigned to multiple interfaces. Those are, however, not properly cleared at the error path of usb6fire_chip_probe(), which may confuse the later probes. Also, the use of two pointer arrays makes things complicated; chips[] may be NULL while devices[] may be left over. For addressing this inconsistency, unify the pointer arrays, and use only chips[] for managing the multiple devices, while the device is checked with chip->dev pointer, instead. Also, the assignment of chips[] is moved at a later point where the probe successfully returns, so that we don't leave the pointer there after the error. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260414132218.411013-3-tiwai@suse.de commit f3c80e76a0e94c7c9771997de90f6a284b4f10d9 Author: Takashi Iwai Date: Tue Apr 14 15:22:11 2026 +0200 ALSA: 6fire: Cover the whole probe and disconnect calls with register_mutex In 6fire driver, we protect the concurrent calls against probe and disconnect with the register_mutex, but it's applied only partially. Since we handle two global pointers in devices[] and chips[] pairs, the assignment of the latter can be inconsistent upon concurrent interface probes, and the refcount handling isn't properly protected at disconnect, either. This patch extends the mutex application range to the whole probe and disconnect functions. It makes the code safer against potential concurrent probles and disconnects, while it makes the code easier to read, too. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260414132218.411013-2-tiwai@suse.de commit 28abd224db4a49560b452115bca3672a20e45b2f Author: Takashi Iwai Date: Tue Apr 14 12:59:00 2026 +0200 ALSA: caiaq: Handle probe errors properly The probe procedure of setup_card() in caiaq driver doesn't treat the error cases gracefully, e.g. the error from snd_card_register() calls snd_card_free() but continues. This would lead to a UAF for the further calls like snd_usb_caiaq_control_init(), as Berk suggested in another patch in the link below. However, the problem is not only that; in general, this function drops the all error handlings (as it's a void function) although its caller can propagate an error to snd_probe(), which eventually calls snd_card_free() as a proper error path. That said, we should treat each error case in setup_card(), and just return the error code promptly, which is then handled later as a fatal error in snd_probe(). This patch achieves it by changing the setup_card() to return an error code. Also, the superfluous snd_card_free() call is removed, too. Note that card->private_free can be set still safely at returning an error. All called functions in card_free() have checks of the unassigned resources or NULL checks. Fixes: 8e3cd08ed8e5 ("[ALSA] caiaq - add control API and more input features") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20260413034941.1131465-2-berkcgoksel@gmail.com Link: https://patch.msgid.link/20260414105916.364073-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 7daff375fa4602934b3b385f83e7ad95d97d86d3 Author: Tvrtko Ursulin Date: Wed Apr 15 09:32:06 2026 +0100 dma-fence: Silence sparse warning in dma_fence_describe Sparse complains about assigning a string to a __rcu annotated local variable: drivers/dma-buf/dma-fence.c:1040:38: warning: incorrect type in initializer (different address spaces) drivers/dma-buf/dma-fence.c:1040:38: expected char const [noderef] __rcu *timeline drivers/dma-buf/dma-fence.c:1040:38: got char * drivers/dma-buf/dma-fence.c:1041:36: warning: incorrect type in initializer (different address spaces) drivers/dma-buf/dma-fence.c:1041:36: expected char const [noderef] __rcu *driver drivers/dma-buf/dma-fence.c:1041:36: got char * It is harmless but lets silence it. Signed-off-by: Tvrtko Ursulin Fixes: ac364014fd81 ("dma-buf: cleanup dma_fence_describe v3") Cc: Christian König Cc: linux-media@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linaro-mm-sig@lists.linaro.org Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260415083207.40513-1-tvrtko.ursulin@igalia.com commit 2c683e9b419328da3433a49f7c467da71aaf0469 Author: Jani Nikula Date: Mon Apr 13 11:16:09 2026 +0300 drm/i915/display: change pipe allocation order for discrete platforms When big joiner is enabled, it reserves the adjacent pipe as the secondary pipe. This happens without the user space knowing, and subsequent attempts at using the CRTC with that pipe will fail. If the user space does not have a coping mechanism, i.e. trying another CRTC, this leads to a black screen. Try to reduce the impact of the problem on discrete platforms by mapping the CRTCs to pipes in order A, C, B, and D. If the user space reserves CRTCs in order, this should trick it to using pipes that are more likely to be available for and after joining. Limit this to discrete platforms, which have four pipes, and no eDP, a combination that should benefit the most with least drawbacks. Cc: Ville Syrjala Reviewed-by: Ville Syrjälä Link: https://patch.msgid.link/20260413081609.969342-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 70b672833f4025341c11b22c7f83778a5cd611bc Author: ZhengYuan Huang Date: Fri Apr 10 10:02:08 2026 +0800 ocfs2: validate group add input before caching [BUG] OCFS2_IOC_GROUP_ADD can trigger a BUG_ON in ocfs2_set_new_buffer_uptodate(): kernel BUG at fs/ocfs2/uptodate.c:509! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_set_new_buffer_uptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509 Code: ffffe88f 42b9fe4c 89e64889 dfe8b4df Call Trace: ocfs2_group_add+0x3f1/0x1510 fs/ocfs2/resize.c:507 ocfs2_ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7bbfb55a966d [CAUSE] ocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a user-controlled group block before ocfs2_verify_group_and_input() validates that block number. That helper is only valid for newly allocated metadata and asserts that the block is not already present in the chosen metadata cache. The code also uses INODE_CACHE(inode) even though the group descriptor belongs to main_bm_inode and later journal accesses use that cache context instead. [FIX] Validate the on-disk group descriptor before caching it, then add it to the metadata cache tracked by INODE_CACHE(main_bm_inode). Keep the validation failure path separate from the later cleanup path so we only remove the buffer from that cache after it has actually been inserted. This keeps the group buffer lifetime consistent across validation, journaling, and cleanup. Link: https://lkml.kernel.org/r/20260410020209.3786348-1-gality369@gmail.com Fixes: 7909f2bf8353 ("[PATCH 2/2] ocfs2: Implement group add for online resize") Signed-off-by: ZhengYuan Huang Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 8f687eeed3da3012152b0f9473f578869de0cd7b Author: ZhengYuan Huang Date: Fri Apr 10 11:42:20 2026 +0800 ocfs2: validate bg_bits during freefrag scan [BUG] A crafted filesystem can trigger an out-of-bounds bitmap walk when OCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT. BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: use-after-free in test_bit_le include/asm-generic/bitops/le.h:21 [inline] BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline] BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline] BUG: KASAN: use-after-free in ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline] BUG: KASAN: use-after-free in ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754 Read of size 8 at addr ffff888031bce000 by task syz.0.636/1435 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xd1/0x650 mm/kasan/report.c:482 kasan_report+0xfb/0x140 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 [inline] kasan_check_range+0x11c/0x200 mm/kasan/generic.c:200 __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] test_bit_le include/asm-generic/bitops/le.h:21 [inline] ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline] ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline] ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline] ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754 ocfs2_info_handle+0x18d/0x2a0 fs/ocfs2/ioctl.c:828 ocfs2_ioctl+0x632/0x6e0 fs/ocfs2/ioctl.c:913 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 ... [CAUSE] ocfs2_info_freefrag_scan_chain() uses on-disk bg_bits directly as the bitmap scan limit. The coherent path reads group descriptors through ocfs2_read_group_descriptor(), which validates the descriptor before use. The non-coherent path uses ocfs2_read_blocks_sync() instead and skips that validation, so an impossible bg_bits value can drive the bitmap walk past the end of the block. [FIX] Compute the bitmap capacity from the filesystem format with ocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds that limit, and clamp the scan to the computed capacity. This keeps the freefrag report going while avoiding reads beyond the buffer. Link: https://lkml.kernel.org/r/20260410034220.3825769-1-gality369@gmail.com Fixes: d24a10b9f8ed ("Ocfs2: Add a new code 'OCFS2_INFO_FREEFRAG' for o2info ioctl.") Signed-off-by: ZhengYuan Huang Reviewed-by: Heming Zhao Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit d12f558e6200b3f47dbef9331ed6d115d2410e59 Author: ZhengYuan Huang Date: Fri Apr 10 12:03:39 2026 +0800 ocfs2: fix listxattr handling when the buffer is full [BUG] If an OCFS2 inode has both inline and block-based xattrs, listxattr() can return a size larger than the caller's buffer when the inline names consume that buffer exactly. kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102 Call Trace: __check_heap_object+0xe3/0x120 mm/slub.c:8243 check_heap_object mm/usercopy.c:196 [inline] __check_object_size mm/usercopy.c:250 [inline] __check_object_size+0x5c5/0x780 mm/usercopy.c:215 check_object_size include/linux/ucopysize.h:22 [inline] check_copy_size include/linux/ucopysize.h:59 [inline] copy_to_user include/linux/uaccess.h:219 [inline] listxattr+0xb0/0x170 fs/xattr.c:926 filename_listxattr fs/xattr.c:958 [inline] path_listxattrat+0x137/0x320 fs/xattr.c:988 __do_sys_listxattr fs/xattr.c:1001 [inline] __se_sys_listxattr fs/xattr.c:998 [inline] __x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998 ... [CAUSE] Commit 936b8834366e ("ocfs2: Refactor xattr list and remove ocfs2_xattr_handler().") replaced the old per-handler list accounting with ocfs2_xattr_list_entry(), but it kept using size == 0 to detect probe mode. That assumption stops being true once ocfs2_listxattr() finishes the inline-xattr pass. If the inline names fill the caller buffer exactly, the block-xattr pass runs with a non-NULL buffer and a remaining size of zero. ocfs2_xattr_list_entry() then skips the bounds check, keeps counting block names, and returns a positive size larger than the supplied buffer. [FIX] Detect probe mode by testing whether the destination buffer pointer is NULL instead of whether the remaining size is zero. That restores the pre-refactor behavior and matches the OCFS2 getxattr helpers. Once the remaining buffer reaches zero while more names are left, the block-xattr pass now returns -ERANGE instead of reporting a size larger than the allocated list buffer. Link: https://lkml.kernel.org/r/20260410040339.3837162-1-gality369@gmail.com Fixes: 936b8834366e ("ocfs2: Refactor xattr list and remove ocfs2_xattr_handler().") Signed-off-by: ZhengYuan Huang Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 5cc6421aaad34ba3b0830c3fcc4a6845648043d4 Author: Randy Dunlap Date: Wed Apr 8 14:35:21 2026 -0700 doc: watchdog: fix typos etc Correct typos in lockup-watchdogs.rst. Link: https://lkml.kernel.org/r/20260408213523.2707947-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Jonathan Corbet Cc: Shuah Khan Cc: Björn Persson Signed-off-by: Andrew Morton commit fb9907939b01338c26dbe17951628e4974470548 Author: Sean Anderson Date: Tue Apr 7 12:47:21 2026 -0400 update Sean's email address Soon I will no longer be working at SECO. Update the mailmap to redirect to my linux.dev address which I still have access to. Link: https://lkml.kernel.org/r/20260407164722.211610-1-sean.anderson@linux.dev Signed-off-by: Sean Anderson Acked-by: Krzysztof Kozlowski Cc: Sean Anderson Cc: Conor Dooley Cc: Daniel Lezcano Cc: Rob Herring Cc: Thomas Gleixner Signed-off-by: Andrew Morton commit 6c9340a2ff2b32cc4477cc6c2a969855195bf9a3 Author: David Carlier Date: Sun Apr 5 16:47:20 2026 +0100 ocfs2: use get_random_u32() where appropriate Use the typed random integer helpers instead of get_random_bytes() when filling a single integer variable. The helpers return the value directly, require no pointer or size argument, and better express intent. Link: https://lkml.kernel.org/r/20260405154720.4732-1-devnexen@gmail.com Signed-off-by: David Carlier Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit d647c5b2fbf81560818dacade360abc8c00a9665 Author: Heming Zhao Date: Thu Apr 2 21:43:27 2026 +0800 ocfs2: split transactions in dio completion to avoid credit exhaustion During ocfs2 dio operations, JBD2 may report warnings via following call trace: ocfs2_dio_end_io_write ocfs2_mark_extent_written ocfs2_change_extent_flag ocfs2_split_extent ocfs2_try_to_merge_extent ocfs2_extend_rotate_transaction ocfs2_extend_trans jbd2__journal_restart start_this_handle output: JBD2: kworker/6:2 wants too many credits credits:5450 rsv_credits:0 max:5449 To prevent exceeding the credits limit, modify ocfs2_dio_end_io_write() to handle extents in a batch of transaction. Additionally, relocate ocfs2_del_inode_from_orphan(). The orphan inode should only be removed from the orphan list after the extent tree update is complete. This ensures that if a crash occurs in the middle of extent tree updates, we won't leave stale blocks beyond EOF. This patch also changes the logic for updating the inode size and removing orphan, making it similar to ext4_dio_write_end_io(). Both operations are performed only when everything looks good. Finally, thanks to Jans and Joseph for providing the bug fix prototype and suggestions. Link: https://lkml.kernel.org/r/20260402134328.27334-2-heming.zhao@suse.com Signed-off-by: Heming Zhao Suggested-by: Jan Kara Suggested-by: Joseph Qi Reviewed-by: Jan Kara Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 510a75028707645ecd606b18c6ca98e6834f9c14 Author: Joseph Qi Date: Fri Apr 3 17:08:03 2026 +0800 ocfs2: remove redundant l_next_free_rec check in __ocfs2_find_path() The l_next_free_rec > l_count check after ocfs2_read_extent_block() in __ocfs2_find_path() is now redundant, as ocfs2_validate_extent_block() already performs this validation at block read time. Remove the duplicate check to avoid maintaining the same validation in two places. Link: https://lkml.kernel.org/r/20260403090803.3860971-5-joseph.qi@linux.alibaba.com Signed-off-by: Joseph Qi Reviewed-by: Heming Zhao Cc: Changwei Ge Cc: Joel Becker Cc: Jun Piao Cc: Junxiao Bi Cc: Mark Fasheh Signed-off-by: Andrew Morton commit af5e456c0b1930546c39cb785d120c2d54268d9c Author: Joseph Qi Date: Fri Apr 3 17:08:02 2026 +0800 ocfs2: validate extent block list fields during block read Add extent list validation to ocfs2_validate_extent_block() so that corrupted on-disk fields are caught early at block read time rather than during extent tree traversal. Two checks are added: - l_count must equal the expected value from ocfs2_extent_recs_per_eb(), catching blocks with a corrupted record count before any array iteration. - l_next_free_rec must not exceed l_count, preventing out-of-bounds access when iterating over extent records. Link: https://lkml.kernel.org/r/20260403090803.3860971-4-joseph.qi@linux.alibaba.com Signed-off-by: Joseph Qi Reviewed-by: Heming Zhao Cc: Changwei Ge Cc: Joel Becker Cc: Jun Piao Cc: Junxiao Bi Cc: Mark Fasheh Signed-off-by: Andrew Morton commit 4ae9cca37e328637cf837ac73f6b8b529f4a918d Author: Joseph Qi Date: Fri Apr 3 17:08:01 2026 +0800 ocfs2: remove empty extent list check in ocfs2_dx_dir_lookup_rec() The full extent list check is introduced by commit 44acc46d182f, which is to avoid NULL pointer dereference if a dirent is not found. Reworking the error message to not reference rec. Instead, report major_hash being looked up and l_next_free_rec, which naturally covers both failure cases (empty extent list and no matching record) without needing a separate l_next_free_rec == 0 guard. Link: https://lkml.kernel.org/r/20260403090803.3860971-3-joseph.qi@linux.alibaba.com Signed-off-by: Joseph Qi Reviewed-by: Heming Zhao Cc: Changwei Ge Cc: Joel Becker Cc: Jun Piao Cc: Junxiao Bi Cc: Mark Fasheh Signed-off-by: Andrew Morton commit 775c17386a6fd695f999d4cda90e3931386570dd Author: Joseph Qi Date: Fri Apr 3 17:08:00 2026 +0800 ocfs2: validate dx_root extent list fields during block read Patch series "ocfs2: consolidate extent list validation into block read callbacks". ocfs2 validates extent list fields (l_count, l_next_free_rec) at various points during extent tree traversal. This is fragile because each caller must remember to check for corrupted on-disk data before using it. This series moves those checks into the block read validation callbacks (ocfs2_validate_dx_root and ocfs2_validate_extent_block), so corrupted fields are caught early at block read time. Redundant post-read checks are then removed. This patch (of 4): Move the extent list l_count validation from ocfs2_dx_dir_lookup_rec() into ocfs2_validate_dx_root(), so that corrupted on-disk fields are caught early at block read time rather than during directory lookups. Additionally, add a l_next_free_rec <= l_count check to prevent out-of-bounds access when iterating over extent records. Both checks are skipped for inline dx roots (OCFS2_DX_FLAG_INLINE), which use dr_entries instead of dr_list. Link: https://lkml.kernel.org/r/20260403090803.3860971-1-joseph.qi@linux.alibaba.com Link: https://lkml.kernel.org/r/20260403090803.3860971-2-joseph.qi@linux.alibaba.com Signed-off-by: Joseph Qi Reviewed-by: Heming Zhao Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 7de554cabf160e331e4442e2a9ad874ca9875921 Author: Tejas Bharambe Date: Fri Apr 10 01:38:16 2026 -0700 ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY filemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY, as documented in mm/filemap.c: "If our return value has VM_FAULT_RETRY set, it's because the mmap_lock may be dropped before doing I/O or by lock_folio_maybe_drop_mmap()." When this happens, a concurrent munmap() can call remove_vma() and free the vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then becomes a dangling pointer, and the subsequent trace_ocfs2_fault() call dereferences it -- a use-after-free. Fix this by saving ip_blkno as a plain integer before calling filemap_fault(), and removing vma from the trace event. Since ip_blkno is copied by value before the lock can be dropped, it remains valid regardless of what happens to the vma or inode afterward. Link: https://lkml.kernel.org/r/20260410083816.34951-1-tejas.bharambe@outlook.com Fixes: 614a9e849ca6 ("ocfs2: Remove FILE_IO from masklog.") Signed-off-by: Tejas Bharambe Reported-by: syzbot+a49010a0e8fcdeea075f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a49010a0e8fcdeea075f Suggested-by: Joseph Qi Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Cc: Signed-off-by: Andrew Morton commit 4a1c0ddc6e7bcf2e9db0eeaab9340dcfe97f448f Author: ZhengYuan Huang Date: Wed Apr 1 17:23:03 2026 +0800 ocfs2: handle invalid dinode in ocfs2_group_extend [BUG] kernel BUG at fs/ocfs2/resize.c:308! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308 Code: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe Call Trace: ... ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... [CAUSE] ocfs2_group_extend() assumes that the global bitmap inode block returned from ocfs2_inode_lock() has already been validated and BUG_ONs when the signature is not a dinode. That assumption is too strong for crafted filesystems because the JBD2-managed buffer path can bypass structural validation and return an invalid dinode to the resize ioctl. [FIX] Validate the dinode explicitly in ocfs2_group_extend(). If the global bitmap buffer does not contain a valid dinode, report filesystem corruption with ocfs2_error() and fail the resize operation instead of crashing the kernel. Link: https://lkml.kernel.org/r/20260401092303.3709187-1-gality369@gmail.com Fixes: 10995aa2451a ("ocfs2: Morph the haphazard OCFS2_IS_VALID_DINODE() checks.") Signed-off-by: ZhengYuan Huang Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Cc: Signed-off-by: Andrew Morton commit 496649d23db6e171cca42f7a5be1a2d0e779ecc7 Author: Askar Safin Date: Wed Apr 1 07:46:19 2026 +0000 .get_maintainer.ignore: add Askar I don't want get_maintainer.pl to automatically print my email. Link: https://lkml.kernel.org/r/20260401074619.988459-1-safinaskar@gmail.com Signed-off-by: Askar Safin Signed-off-by: Andrew Morton commit 6110d18e208cc5572158928401246d98cd2b90b4 Author: ZhengYuan Huang Date: Wed Apr 1 10:16:22 2026 +0800 ocfs2: validate bg_list extent bounds in discontig groups [BUG] Running ocfs2 on a corrupted image with a discontiguous block group whose bg_list.l_next_free_rec is set to an excessively large value triggers a KASAN use-after-free crash: BUG: KASAN: use-after-free in ocfs2_bg_discontig_fix_by_rec fs/ocfs2/suballoc.c:1678 [inline] BUG: KASAN: use-after-free in ocfs2_bg_discontig_fix_result+0x4a4/0x560 fs/ocfs2/suballoc.c:1715 Read of size 4 at addr ffff88801a85f000 by task syz.0.115/552 Call Trace: ... __asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380 ocfs2_bg_discontig_fix_by_rec fs/ocfs2/suballoc.c:1678 [inline] ocfs2_bg_discontig_fix_result+0x4a4/0x560 fs/ocfs2/suballoc.c:1715 ocfs2_search_one_group fs/ocfs2/suballoc.c:1752 [inline] ocfs2_claim_suballoc_bits+0x13c3/0x1cd0 fs/ocfs2/suballoc.c:1984 ocfs2_claim_new_inode+0x2e7/0x8a0 fs/ocfs2/suballoc.c:2292 ocfs2_mknod_locked.constprop.0+0x121/0x2a0 fs/ocfs2/namei.c:637 ocfs2_mknod+0xc71/0x2400 fs/ocfs2/namei.c:384 ocfs2_create+0x158/0x390 fs/ocfs2/namei.c:676 lookup_open.isra.0+0x10a1/0x1460 fs/namei.c:3796 open_last_lookups fs/namei.c:3895 [inline] path_openat+0x11fe/0x2ce0 fs/namei.c:4131 do_filp_open+0x1f6/0x430 fs/namei.c:4161 do_sys_openat2+0x117/0x1c0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] ... [CAUSE] ocfs2_bg_discontig_fix_result() iterates over bg->bg_list.l_recs[] using l_next_free_rec as the upper bound without any sanity check: for (i = 0; i < le16_to_cpu(bg->bg_list.l_next_free_rec); i++) { rec = &bg->bg_list.l_recs[i]; l_next_free_rec is read directly from the on-disk group descriptor and is trusted blindly. On a 4 KiB block device, bg_list.l_recs[] can hold at most 235 entries (ocfs2_extent_recs_per_gd(sb)). A corrupted or crafted filesystem image can set l_next_free_rec to an arbitrarily large value, causing the loop to index past the end of the group descriptor buffer_head data page and into an adjacent freed page. [FIX] Validate discontiguous bg_list.l_count against ocfs2_extent_recs_per_gd(sb), then reject l_next_free_rec values that exceed l_count. This keeps the on-disk extent list self-consistent and matches how the rest of ocfs2 uses l_count as the extent-list bound. Link: https://lkml.kernel.org/r/20260401021622.3560952-1-gality369@gmail.com Signed-off-by: ZhengYuan Huang Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit f758440d3d82f2e1804d7df281a64d9ad88b7f52 Author: Taylor Nelms Date: Tue Mar 31 14:15:09 2026 -0400 checkpatch: exclude forward declarations of const structs Limit checkpatch warnings for normally-const structs by excluding patterns consistent with forward declarations. For example, the forward declaration `struct regmap_access_table;` in a header file currently generates a warning recommending that it is generally declared as const; however, this would apply a useless type qualifier in the empty declaration `const struct regmap_access_table;`, and subsequently generate compiler warnings. Link: https://lkml.kernel.org/r/20260331181509.1258693-1-tknelms@google.com Signed-off-by: Taylor Nelms Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Dwaipayan Ray Cc: Lukas Bulwahn Signed-off-by: Andrew Morton commit cc82b3dcc6a8fa259fbda12ab00d6fc00908a49e Author: Yiyang Chen Date: Mon Mar 30 03:00:41 2026 +0800 tools/accounting: handle truncated taskstats netlink messages procacct and getdelays use a fixed receive buffer for taskstats generic netlink messages. A multi-threaded process exit can emit a single PID+TGID notification large enough to exceed that buffer on newer kernels. Switch to recvmsg() so MSG_TRUNC is detected explicitly, increase the message buffer size, and report truncated datagrams clearly instead of misparsing them as fatal netlink errors. Also print the taskstats version in debug output to make version mismatches easier to diagnose while inspecting taskstats traffic. Link: https://lkml.kernel.org/r/520308bb4cbbaf8dc2c7296b5f60f11e12fb30a5.1774810498.git.cyyzero16@gmail.com Signed-off-by: Yiyang Chen Cc: Balbir Singh Cc: Dr. Thomas Orgis Cc: Fan Yu Cc: Wang Yaxin Cc: Signed-off-by: Andrew Morton commit 16c4f0211aaa1ec1422b11b59f64f1abe9009fc0 Author: Yiyang Chen Date: Mon Mar 30 03:00:40 2026 +0800 taskstats: set version in TGID exit notifications delay accounting started populating taskstats records with a valid version field via fill_pid() and fill_tgid(). Later, commit ad4ecbcba728 ("[PATCH] delay accounting taskstats interface send tgid once") changed the TGID exit path to send the cached signal->stats aggregate directly instead of building the outgoing record through fill_tgid(). Unlike fill_tgid(), fill_tgid_exit() only accumulates accounting data and never initializes stats->version. As a result, TGID exit notifications can reach userspace with version == 0 even though PID exit notifications and TASKSTATS_CMD_GET replies carry a valid taskstats version. This is easy to reproduce with `tools/accounting/getdelays.c`. I have a small follow-up patch for that tool which: 1. increases the receive buffer/message size so the pid+tgid combined exit notification is not dropped/truncated 2. prints `stats->version`. With that patch, the reproducer is: Terminal 1: ./getdelays -d -v -l -m 0 Terminal 2: taskset -c 0 python3 -c 'import threading,time; t=threading.Thread(target=time.sleep,args=(0.1,)); t.start(); t.join()' That produces both PID and TGID exit notifications for the same process. The PID exit record reports a valid taskstats version, while the TGID exit record reports `version 0`. This patch (of 2): Set stats->version = TASKSTATS_VERSION after copying the cached TGID aggregate into the outgoing netlink payload so all taskstats records are self-describing again. Link: https://lkml.kernel.org/r/ba83d934e59edd431b693607de573eb9ca059309.1774810498.git.cyyzero16@gmail.com Fixes: ad4ecbcba728 ("[PATCH] delay accounting taskstats interface send tgid once") Signed-off-by: Yiyang Chen Cc: Balbir Singh Cc: Dr. Thomas Orgis Cc: Fan Yu Cc: Wang Yaxin Cc: Signed-off-by: Andrew Morton commit 5686459423d03d192134166f0ec45f98bb2d5d57 Author: Yufan Chen Date: Mon Mar 30 23:34:28 2026 +0800 ocfs2/heartbeat: fix slot mapping rollback leaks on error paths o2hb_map_slot_data() allocates hr_tmp_block, hr_slots, hr_slot_data, and pages in stages. If a later allocation fails, the current code returns without unwinding the earlier allocations. o2hb_region_dev_store() also leaves slot mapping resources behind when setup aborts, and it keeps hr_aborted_start/hr_node_deleted set across retries. That leaves stale state behind after a failed start. Factor the slot cleanup into o2hb_unmap_slot_data(), use it from both o2hb_map_slot_data() and o2hb_region_release(), and call it from the dev_store() rollback after stopping a started heartbeat thread. While freeing pages, clear each hr_slot_data entry as it is released, and reset the start state before each new setup attempt. This closes the slot mapping leak on allocation/setup failure paths and keeps failed setup attempts retryable. Link: https://lkml.kernel.org/r/20260330153428.19586-1-yufan.chen@linux.dev Signed-off-by: Yufan Chen Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 8901ac9d2c7eb8ed7ae5e749bf13ecb3b6062488 Author: Petr Mladek Date: Tue Apr 14 17:41:24 2026 +0200 printf: Compile the kunit test with DISABLE_BRANCH_PROFILING DISABLE_BRANCH_PROFILING GCC < 12.1 can miscompile printf_kunit's errptr() test when branch profiling is enabled. BUILD_BUG_ON(IS_ERR(PTR)) is a constant false expression, but CONFIG_TRACE_BRANCH_PROFILING and CONFIG_PROFILE_ALL_BRANCHES make the IS_ERR() path side-effectful. GCC's IPA splitter can then outline the cold assert arm into errptr.part.* and leave that clone with an unconditional __compiletime_assert_*() call, causing a false build failure. This started showing up after test_hashed() became a macro and moved its local buffer into errptr(), which changed GCC's inlining and splitting decisions enough to expose the compiler bug. Workaround the problem by disabling the branch profiling for printf_kunit.o. It is a straightforward and acceptable solution. The workaround can be removed once the minimum GCC includes commit 76fe49423047 ("Fix tree-optimization/101941: IPA splitting out function with error attribute"), which first shipped in GCC 12.1. Fixes: 9bfa52dac27a ("printf: convert test_hashed into macro") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604030636.NqjaJvYp-lkp@intel.com/ Cc: stable@vger.kernel.org Acked-by: Tamir Duberstein Link: https://patch.msgid.link/ad5gJAX9f6dSQluz@pathway.suse.cz Signed-off-by: Petr Mladek commit 8c2f1288250a90a4b5cabed5d888d7e3aeed4035 Author: Lukas Wunner Date: Sun Apr 12 16:19:47 2026 +0200 lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Yiming reports an integer underflow in mpi_read_raw_from_sgl() when subtracting "lzeros" from the unsigned "nbytes". For this to happen, the scatterlist "sgl" needs to occupy more bytes than the "nbytes" parameter and the first "nbytes + 1" bytes of the scatterlist must be zero. Under these conditions, the while loop iterating over the scatterlist will count more zeroes than "nbytes", subtract the number of zeroes from "nbytes" and cause the underflow. When commit 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") originally introduced the bug, it couldn't be triggered because all callers of mpi_read_raw_from_sgl() passed a scatterlist whose length was equal to "nbytes". However since commit 63ba4d67594a ("KEYS: asymmetric: Use new crypto interface without scatterlists"), the underflow can now actually be triggered. When invoking a KEYCTL_PKEY_ENCRYPT system call with a larger "out_len" than "in_len" and filling the "in" buffer with zeroes, crypto_akcipher_sync_prep() will create an all-zero scatterlist used for both the "src" and "dst" member of struct akcipher_request and thereby fulfil the conditions to trigger the bug: sys_keyctl() keyctl_pkey_e_d_s() asymmetric_key_eds_op() software_key_eds_op() crypto_akcipher_sync_encrypt() crypto_akcipher_sync_prep() crypto_akcipher_encrypt() rsa_enc() mpi_read_raw_from_sgl() To the user this will be visible as a DoS as the kernel spins forever, causing soft lockup splats as a side effect. Fix it. Reported-by: Yiming Qian # off-list Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") Signed-off-by: Lukas Wunner Cc: stable@vger.kernel.org # v4.4+ Reviewed-by: Ignat Korchagin Reviewed-by: Jarkko Sakkinen Link: https://lore.kernel.org/r/59eca92ff4f87e2081777f1423a0efaaadcfdb39.1776003111.git.lukas@wunner.de Signed-off-by: Eric Biggers commit 1f5ffc672165ff851063a5fd044b727ab2517ae3 Author: Linus Torvalds Date: Tue Apr 14 23:03:02 2026 -0700 Fix mismerge of the arm64 / timer-core interrupt handling changes Commit c43267e6794a ("Merge tag 'arm64-upstream' of git://...") had a conflict in the irq entry/exit code due to commit c5538d0141b3 ("entry: Split kernel mode logic from irqentry_{enter,exit}()") having moved the core code in irqentry_enter/exit() from kernel/entry/common.c into helper inline functions in include/linux/irq-entry-common.h. On the other side of the merge, the timer-core code had introduced deferred hrtimer rearming infrastructure in commit 0e98eb14814e ("entry: Prepare for deferred hrtimer rearming"), adding two calls to hrtimer_rearm_deferred() in irqentry_enter(). When merging the two, moving the two calls to the new location wasn't a problem, but afterwards I had made the mistake of looking what had happened in linux-next. And linux-next had a very different merge resolution in commit 04f02dc3ea74 ("Merge tag 'entry-for-arm64-26-04-08' into sched/hrtick"), which had unified the two calls into one single call-site in irqentry_exit_to_kernel_mode_preempt(). And that merge resolution looked cleverer than the straightforward one I had done, so I re-did my merge the way it had been done in linux-next. But it turns out nobody apparently tests linux-next, and the merge in linux-next was just wrong. The difference is that hrtimer_rearm_deferred() doesn't get called at all for the case when state.exit_rcu is true, and the boot will typically fail due to timers not triggering correctly. So this undoes the "clever" merge, and does the straightforward one instead. Fixes: c43267e6794a ("Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux" Reported-and-tested-by: Alexei Starovoitov Link: https://lore.kernel.org/all/CAADnVQJ=MoiX4=guPWhL9vtnAELkpNx=GNm8RA1-aV424UFz2A@mail.gmail.com/ Link: https://lore.kernel.org/all/CAHk-=wg8+BER4VyFKG3rnPi2gXxbf-jbHS=EU+xhFqGVQfbutw@mail.gmail.com/ Signed-off-by: Linus Torvalds commit 5c0f43e8535d619ff32400e2e916075109fc7a56 Merge: 7c8a4671dc3247 4c68d150246d7e Author: Linus Torvalds Date: Tue Apr 14 20:28:40 2026 -0700 Merge tag 'kernel-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull pid_namespace updates from Christian Brauner: - pid_namespace: make init creation more flexible Annotate ->child_reaper accesses with {READ,WRITE}_ONCE() to protect the unlocked readers from cpu/compiler reordering, and enforce that pid 1 in a pid namespace is always the first allocated pid (the set_tid path already required this). On top of that, allow opening pid_for_children before the pid namespace init has been created. This lets one process create the pid namespace and a different process create the init via setns(), which makes clone3(set_tid) usable in all cases evenly and is particularly useful to CRIU when restoring nested containers. A new selftest covers both the basic create-pidns-then-init flow and the cross-process variant, and a MAINTAINERS entry for the pid namespace code is added. - unrelated signal cleanup: update outdated comment for the removed freezable_schedule() * tag 'kernel-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: signal: update outdated comment for removed freezable_schedule() MAINTAINERS: add a pid namespace entry selftests: Add tests for creating pidns init via setns pid_namespace: allow opening pid_for_children before init was created pid: check init is created first after idr alloc pid_namespace: avoid optimization of accesses to ->child_reaper commit 7c8a4671dc3247a26a702e5f5996e9f453d7070d Merge: 91a4855d6c03e7 cad3bf1c330274 Author: Linus Torvalds Date: Tue Apr 14 19:59:25 2026 -0700 Merge tag 'vfs-7.1-rc1.mount.v2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs mount updates from Christian Brauner: - Add FSMOUNT_NAMESPACE flag to fsmount() that creates a new mount namespace with the newly created filesystem attached to a copy of the real rootfs. This returns a namespace file descriptor instead of an O_PATH mount fd, similar to how OPEN_TREE_NAMESPACE works for open_tree(). This allows creating a new filesystem and immediately placing it in a new mount namespace in a single operation, which is useful for container runtimes and other namespace-based isolation mechanisms. This accompanies OPEN_TREE_NAMESPACE and avoids a needless detour via OPEN_TREE_NAMESPACE to get the same effect. Will be especially useful when you mount an actual filesystem to be used as the container rootfs. - Currently, creating a new mount namespace always copies the entire mount tree from the caller's namespace. For containers and sandboxes that intend to build their mount table from scratch this is wasteful: they inherit a potentially large mount tree only to immediately tear it down. This series adds support for creating a mount namespace that contains only a clone of the root mount, with none of the child mounts. Two new flags are introduced: - CLONE_EMPTY_MNTNS (0x400000000) for clone3(), using the 64-bit flag space - UNSHARE_EMPTY_MNTNS (0x00100000) for unshare() Both flags imply CLONE_NEWNS. The resulting namespace contains a single nullfs root mount with an immutable empty directory. The intended workflow is to then mount a real filesystem (e.g., tmpfs) over the root and build the mount table from there. - Allow MOVE_MOUNT_BENEATH to target the caller's rootfs, allowing to switch out the rootfs without pivot_root(2). The traditional approach to switching the rootfs involves pivot_root(2) or a chroot_fs_refs()-based mechanism that atomically updates fs->root for all tasks sharing the same fs_struct. This has consequences for fork(), unshare(CLONE_FS), and setns(). This series instead decomposes root-switching into individually atomic, locally-scoped steps: fd_tree = open_tree(-EBADF, "/newroot", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC); fchdir(fd_tree); move_mount(fd_tree, "", AT_FDCWD, "/", MOVE_MOUNT_BENEATH | MOVE_MOUNT_F_EMPTY_PATH); chroot("."); umount2(".", MNT_DETACH); Since each step only modifies the caller's own state, the fork/unshare/setns races are eliminated by design. A key step to making this possible is to remove the locked mount restriction. Originally MOVE_MOUNT_BENEATH doesn't support mounting beneath a mount that is locked. The locked mount protects the underlying mount from being revealed. This is a core mechanism of unshare(CLONE_NEWUSER | CLONE_NEWNS). The mounts in the new mount namespace become locked. That effectively makes the new mount table useless as the caller cannot ever get rid of any of the mounts no matter how useless they are. We can lift this restriction though. We simply transfer the locked property from the top mount to the mount beneath. This works because what we care about is to protect the underlying mount aka the parent. The mount mounted between the parent and the top mount takes over the job of protecting the parent mount from the top mount mount. This leaves us free to remove the locked property from the top mount which can consequently be unmounted: unshare(CLONE_NEWUSER | CLONE_NEWNS) and we inherit a clone of procfs on /proc then currently we cannot unmount it as: umount -l /proc will fail with EINVAL because the procfs mount is locked. After this series we can now do: mount --beneath -t tmpfs tmpfs /proc umount -l /proc after which a tmpfs mount has been placed beneath the procfs mount. The tmpfs mount has become locked and the procfs mount has become unlocked. This means you can safely modify an inherited mount table after unprivileged namespace creation. Afterwards we simply make it possible to move a mount beneath the rootfs allowing to upgrade the rootfs. Removing the locked restriction makes this very useful for containers created with unshare(CLONE_NEWUSER | CLONE_NEWNS) to reshuffle an inherited mount table safely and MOVE_MOUNT_BENEATH makes it possible to switch out the rootfs instead of using the costly pivot_root(2). * tag 'vfs-7.1-rc1.mount.v2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/namespaces: remove unused utils.h include from listns_efault_test selftests/fsmount_ns: add missing TARGETS and fix cap test selftests/empty_mntns: fix wrong CLONE_EMPTY_MNTNS hex value in comment selftests/empty_mntns: fix statmount_alloc() signature mismatch selftests/statmount: remove duplicate wait_for_pid() mount: always duplicate mount selftests/filesystems: add MOVE_MOUNT_BENEATH rootfs tests move_mount: allow MOVE_MOUNT_BENEATH on the rootfs move_mount: transfer MNT_LOCKED selftests/filesystems: add clone3 tests for empty mount namespaces selftests/filesystems: add tests for empty mount namespaces namespace: allow creating empty mount namespaces selftests: add FSMOUNT_NAMESPACE tests selftests/statmount: add statmount_alloc() helper tools: update mount.h header mount: add FSMOUNT_NAMESPACE mount: simplify __do_loopback() mount: start iterating from start of rbtree commit 91a4855d6c03e770e42f17c798a36a3c46e63de2 Merge: f5ad4101009e7f 35c2c39832e569 Author: Linus Torvalds Date: Tue Apr 14 18:36:10 2026 -0700 Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Jakub Kicinski: "Core & protocols: - Support HW queue leasing, allowing containers to be granted access to HW queues for zero-copy operations and AF_XDP - Number of code moves to help the compiler with inlining. Avoid output arguments for returning drop reason where possible - Rework drop handling within qdiscs to include more metadata about the reason and dropping qdisc in the tracepoints - Remove the rtnl_lock use from IP Multicast Routing - Pack size information into the Rx Flow Steering table pointer itself. This allows making the table itself a flat array of u32s, thus making the table allocation size a power of two - Report TCP delayed ack timer information via socket diag - Add ip_local_port_step_width sysctl to allow distributing the randomly selected ports more evenly throughout the allowed space - Add support for per-route tunsrc in IPv6 segment routing - Start work of switching sockopt handling to iov_iter - Improve dynamic recvbuf sizing in MPTCP, limit burstiness and avoid buffer size drifting up - Support MSG_EOR in MPTCP - Add stp_mode attribute to the bridge driver for STP mode selection. This addresses concerns about call_usermodehelper() usage - Remove UDP-Lite support (as announced in 2023) - Remove support for building IPv6 as a module. Remove the now unnecessary function calling indirection Cross-tree stuff: - Move Michael MIC code from generic crypto into wireless, it's considered insecure but some WiFi networks still need it Netfilter: - Switch nft_fib_ipv6 module to no longer need temporary dst_entry object allocations by using fib6_lookup() + RCU. Florian W reports this gets us ~13% higher packet rate - Convert IPVS's global __ip_vs_mutex to per-net service_mutex and switch the service tables to be per-net. Convert some code that walks the service lists to use RCU instead of the service_mutex - Add more opinionated input validation to lower security exposure - Make IPVS hash tables to be per-netns and resizable Wireless: - Finished assoc frame encryption/EPPKE/802.1X-over-auth - Radar detection improvements - Add 6 GHz incumbent signal detection APIs - Multi-link support for FILS, probe response templates and client probing - New APIs and mac80211 support for NAN (Neighbor Aware Networking, aka Wi-Fi Aware) so less work must be in firmware Driver API: - Add numerical ID for devlink instances (to avoid having to create fake bus/device pairs just to have an ID). Support shared devlink instances which span multiple PFs - Add standard counters for reporting pause storm events (implement in mlx5 and fbnic) - Add configuration API for completion writeback buffering (implement in mana) - Support driver-initiated change of RSS context sizes - Support DPLL monitoring input frequency (implement in zl3073x) - Support per-port resources in devlink (implement in mlx5) Misc: - Expand the YAML spec for Netfilter Drivers - Software: - macvlan: support multicast rx for bridge ports with shared source MAC address - team: decouple receive and transmit enablement for IEEE 802.3ad LACP "independent control" - Ethernet high-speed NICs: - nVidia/Mellanox: - support high order pages in zero-copy mode (for payload coalescing) - support multiple packets in a page (for systems with 64kB pages) - Broadcom 25-400GE (bnxt): - implement XDP RSS hash metadata extraction - add software fallback for UDP GSO, lowering the IOMMU cost - Broadcom 800GE (bnge): - add link status and configuration handling - add various HW and SW statistics - Marvell/Cavium: - NPC HW block support for cn20k - Huawei (hinic3): - add mailbox / control queue - add rx VLAN offload - add driver info and link management - Ethernet NICs: - Marvell/Aquantia: - support reading SFP module info on some AQC100 cards - Realtek PCI (r8169): - add support for RTL8125cp - Realtek USB (r8152): - support for the RTL8157 5Gbit chip - add 2500baseT EEE status/configuration support - Ethernet NICs embedded and off-the-shelf IP: - Synopsys (stmmac): - cleanup and reorganize SerDes handling and PCS support - cleanup descriptor handling and per-platform data - cleanup and consolidate MDIO defines and handling - shrink driver memory use for internal structures - improve Tx IRQ coalescing - improve TCP segmentation handling - add support for Spacemit K3 - Cadence (macb): - support PHYs that have inband autoneg disabled with GEM - support IEEE 802.3az EEE - rework usrio capabilities and handling - AMD (xgbe): - improve power management for S0i3 - improve TX resilience for link-down handling - Virtual: - Google cloud vNIC: - support larger ring sizes in DQO-QPL mode - improve HW-GRO handling - support UDP GSO for DQO format - PCIe NTB: - support queue count configuration - Ethernet PHYs: - automatically disable PHY autonomous EEE if MAC is in charge - Broadcom: - add BCM84891/BCM84892 support - Micrel: - support for LAN9645X internal PHY - Realtek: - add RTL8224 pair order support - support PHY LEDs on RTL8211F-VD - support spread spectrum clocking (SSC) - Maxlinear: - add PHY-level statistics via ethtool - Ethernet switches: - Maxlinear (mxl862xx): - support for bridge offloading - support for VLANs - support driver statistics - Bluetooth: - large number of fixes and new device IDs - Mediatek: - support MT6639 (MT7927) - support MT7902 SDIO - WiFi: - Intel (iwlwifi): - UNII-9 and continuing UHR work - MediaTek (mt76): - mt7996/mt7925 MLO fixes/improvements - mt7996 NPU support (HW eth/wifi traffic offload) - Qualcomm (ath12k): - monitor mode support on IPQ5332 - basic hwmon temperature reporting - support IPQ5424 - Realtek: - add USB RX aggregation to improve performance - add USB TX flow control by tracking in-flight URBs - Cellular: - IPA v5.2 support" * tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1561 commits) net: pse-pd: fix kernel-doc function name for pse_control_find_by_id() wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit wireguard: allowedips: remove redundant space tools: ynl: add sample for wireguard wireguard: allowedips: Use kfree_rcu() instead of call_rcu() MAINTAINERS: Add netkit selftest files selftests/net: Add additional test coverage in nk_qlease selftests/net: Split netdevsim tests from HW tests in nk_qlease tools/ynl: Make YnlFamily closeable as a context manager net: airoha: Add missing PPE configurations in airoha_ppe_hw_init() net: airoha: Fix VIP configuration for AN7583 SoC net: caif: clear client service pointer on teardown net: strparser: fix skb_head leak in strp_abort_strp() net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() selftests/bpf: add test for xdp_master_redirect with bond not up net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master net: airoha: Remove PCE_MC_EN_MASK bit in REG_FE_PCE_CFG configuration sctp: disable BH before calling udp_tunnel_xmit_skb() sctp: fix missing encap_port propagation for GSO fragments net: airoha: Rely on net_device pointer in ETS callbacks ... commit f5ad4101009e7f5f5984ffea6923d4fcd470932a Merge: e997ac58ad0b47 71b500afd2f733 Author: Linus Torvalds Date: Tue Apr 14 18:04:04 2026 -0700 Merge tag 'bpf-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Pull bpf updates from Alexei Starovoitov: - Welcome new BPF maintainers: Kumar Kartikeya Dwivedi, Eduard Zingerman while Martin KaFai Lau reduced his load to Reviwer. - Lots of fixes everywhere from many first time contributors. Thank you All. - Diff stat is dominated by mechanical split of verifier.c into multiple components: - backtrack.c: backtracking logic and jump history - states.c: state equivalence - cfg.c: control flow graph, postorder, strongly connected components - liveness.c: register and stack liveness - fixups.c: post-verification passes: instruction patching, dead code removal, bpf_loop inlining, finalize fastcall 8k line were moved. verifier.c still stands at 20k lines. Further refactoring is planned for the next release. - Replace dynamic stack liveness with static stack liveness based on data flow analysis. This improved the verification time by 2x for some programs and equally reduced memory consumption. New logic is in liveness.c and supported by constant folding in const_fold.c (Eduard Zingerman, Alexei Starovoitov) - Introduce BTF layout to ease addition of new BTF kinds (Alan Maguire) - Use kmalloc_nolock() universally in BPF local storage (Amery Hung) - Fix several bugs in linked registers delta tracking (Daniel Borkmann) - Improve verifier support of arena pointers (Emil Tsalapatis) - Improve verifier tracking of register bounds in min/max and tnum domains (Harishankar Vishwanathan, Paul Chaignon, Hao Sun) - Further extend support for implicit arguments in the verifier (Ihor Solodrai) - Add support for nop,nop5 instruction combo for USDT probes in libbpf (Jiri Olsa) - Support merging multiple module BTFs (Josef Bacik) - Extend applicability of bpf_kptr_xchg (Kaitao Cheng) - Retire rcu_trace_implies_rcu_gp() (Kumar Kartikeya Dwivedi) - Support variable offset context access for 'syscall' programs (Kumar Kartikeya Dwivedi) - Migrate bpf_task_work and dynptr to kmalloc_nolock() (Mykyta Yatsenko) - Fix UAF in in open-coded task_vma iterator (Puranjay Mohan) * tag 'bpf-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (241 commits) selftests/bpf: cover short IPv4/IPv6 inputs with adjust_room bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb selftests/bpf: Use memfd_create instead of shm_open in cgroup_iter_memcg selftests/bpf: Add test for cgroup storage OOB read bpf: Fix OOB in pcpu_init_value selftests/bpf: Fix reg_bounds to match new tnum-based refinement selftests/bpf: Add tests for non-arena/arena operations bpf: Allow instructions with arena source and non-arena dest registers bpftool: add missing fsession to the usage and docs of bpftool docs/bpf: add missing fsession attach type to docs bpf: add missing fsession to the verifier log bpf: Move BTF checking logic into check_btf.c bpf: Move backtracking logic to backtrack.c bpf: Move state equivalence logic to states.c bpf: Move check_cfg() into cfg.c bpf: Move compute_insn_live_regs() into liveness.c bpf: Move fixup/post-processing logic from verifier.c into fixups.c bpf: Simplify do_check_insn() bpf: Move checks for reserved fields out of the main pass bpf: Delete unused variable ... commit e997ac58ad0b47141c62c79cde8356fe5633287a Merge: 6198c86a975f7b f8e0a5a174d7d3 Author: Linus Torvalds Date: Tue Apr 14 17:46:12 2026 -0700 Merge tag 'linux_kselftest-next-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: - cpu-hotplug: fix to check if cpu hotplug is supported to avoid test failures when cpu hotplug isn't supported. - frace: fix to relevant comparisons and path checks in the helper so it handles those patterns without spurious shell warnings. - runner.sh: add ktrap support - tracing: fix to make --logdir option work again - tracing: fix to check awk supports non POSIX strtonum() - mqueue: fix incorrectly named settings file to make sure the test used the correct timeout value - kselftest: - fix to treat xpass as successful result - add ksft_reset_state() - kselftest_harness: - validate kselftest exit codes are handled explicitly - add detection of invalid mixing of kselftest and harness functionality - add validation of intermixing of kselftest and harness functionality - run_kselftest.sh: - remove unused $ROOT - resolve BASE_DIR with pwd -P to avoid dependency on realpath or readlink commands to generate a physical absolute path for BASE_DIR - allow choosing per-test log directory - preserve subtarget failures in all/install * tag 'linux_kselftest-next-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/ftrace: Quote check_requires comparisons selftests: Preserve subtarget failures in all/install selftests/run_kselftest.sh: Allow choosing per-test log directory selftests/run_kselftest.sh: Resolve BASE_DIR with pwd -P selftests/run_kselftest.sh: Remove unused $ROOT selftests/cpu-hotplug: Fix check for cpu hotplug not supported selftests/mqueue: Fix incorrectly named file selftests: Use ktap helpers for runner.sh selftests: harness: Validate intermixing of kselftest and harness functionality selftests: harness: Detect illegal mixing of kselftest and harness functionality selftests: kselftest: Add ksft_reset_state() selftests: harness: Validate that explicit kselftest exitcodes are handled selftests: kselftest: Treat xpass as successful result selftests/tracing: Fix to check awk supports non POSIX strtonum() selftests/tracing: Fix to make --logdir option work again commit 6198c86a975f7bec992459fe4506846caae4e41a Merge: 88b29f3f579987 8f260b02eeeffb Author: Linus Torvalds Date: Tue Apr 14 17:39:42 2026 -0700 Merge tag 'linux_kselftest-kunit-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit tool updates from Shuah Khan: - terminate kernel under test on SIGINT when it catches SIGINT to make sure the TTY isn't messed up and terminate the running kernel - recommend --raw_output=all when KTAP header isn't found in the kernel output, it's useful to re-run the test with --raw_output=all to find out the reasons why the test didn't complete. - skip stty when stdin is not a tty to avoid writing noise to stderr. - show suites when user runs --list_suites option instead of entire list of tests to make the output user friendly and concise. * tag 'linux_kselftest-kunit-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: tool: Terminate kernel under test on SIGINT kunit: tool: skip stty when stdin is not a tty kunit: tool: Recommend --raw_output=all if no KTAP found kunit: Add --list_suites to show suites commit 88b29f3f579987fff0d2bd726d5fa95a53f857fa Merge: ee60c510fb3468 663385f9155f27 Author: Linus Torvalds Date: Tue Apr 14 17:16:38 2026 -0700 Merge tag 'modules-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module updates from Sami Tolvanen: "Kernel symbol flags: - Replace the separate *_gpl symbol sections (__ksymtab_gpl and __kcrctab_gpl) with a unified symbol table and a new __kflagstab section. This section stores symbol flags, such as the GPL-only flag, as an 8-bit bitset for each exported symbol. This is a cleanup that simplifies symbol lookup in the module loader by avoiding table fragmentation and will allow a cleaner way to add more flags later if needed. Module signature UAPI: - Move struct module_signature to the UAPI headers to allow reuse by tools outside the kernel proper, such as kmod and scripts/sign-file. This also renames a few constants for clarity and drops unused signature types as preparation for hash-based module integrity checking work that's in progress. Sysfs: - Add a /sys/module//import_ns sysfs attribute to show the symbol namespaces imported by loaded modules. This makes it easier to verify driver API access at runtime on systems that care about such things (e.g. Android). Cleanups and fixes: - Force sh_addr to 0 for all sections in module.lds. This prevents non-zero section addresses when linking modules with 'ld.bfd -r', which confused elfutils. - Fix a memory leak of charp module parameters on module unload when the kernel is configured with CONFIG_SYSFS=n. - Override the -EEXIST error code returned by module_init() to userspace. This prevents confusion with the errno reserved by the module loader to indicate that a module is already loaded. - Simplify the warning message and drop the stack dump on positive returns from module_init(). - Drop unnecessary extern keywords from function declarations and synchronize parse_args() arguments with their implementation" * tag 'modules-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: (23 commits) module: Simplify warning on positive returns from module_init() module: Override -EEXIST module return documentation: remove references to *_gpl sections module: remove *_gpl sections from vmlinux and modules module: deprecate usage of *_gpl sections in module loader module: use kflagstab instead of *_gpl sections module: populate kflagstab in modpost module: add kflagstab section to vmlinux and modules module: define ksym_flags enumeration to represent kernel symbol flags selftests/bpf: verify_pkcs7_sig: Use 'struct module_signature' from the UAPI headers sign-file: use 'struct module_signature' from the UAPI headers tools uapi headers: add linux/module_signature.h module: Move 'struct module_signature' to UAPI module: Give MODULE_SIG_STRING a more descriptive name module: Give 'enum pkey_id_type' a more specific name module: Drop unused signature types extract-cert: drop unused definition of PKEY_ID_PKCS7 docs: symbol-namespaces: mention sysfs attribute module: expose imported namespaces via sysfs module: Remove extern keyword from param prototypes ... commit ee60c510fb3468ec6fab98419218c4e7b37e2ca3 Merge: 3203a08c126668 b070dc36291fec Author: Linus Torvalds Date: Tue Apr 14 17:13:09 2026 -0700 Merge tag 'nolibc-20260412-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc Pull nolibc updates from Thomas Weißschuh: - Many new features and optimizations to printf() - Rename non-standard symbols to avoid collisions with application code - Support for byteswap.h, endian.h, err.h and asprintf() - 64-bit dev_t - Smaller cleanups and fixes to the code and build system * tag 'nolibc-20260412-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc: (61 commits) selftests/nolibc: use gcc 15 tools/nolibc: support UBSAN on gcc tools/nolibc: create __nolibc_no_sanitize_ubsan selftests/nolibc: don't skip tests for unimplemented syscalls anymore selftests/nolibc: explicitly handle ENOSYS from ptrace() tools/nolibc: add byteorder conversions tools/nolibc: add the _syscall() macro tools/nolibc: move the call to __sysret() into syscall() tools/nolibc: rename the internal macros used in syscall() selftests/nolibc: only use libgcc when really necessary selftests/nolibc: test the memory allocator tools/nolibc: check for overflow in calloc() without divisions tools/nolibc: add support for asprintf() tools/nolibc: use __builtin_offsetof() tools/nolibc: use makedev() in fstatat() tools/nolibc: handle all major and minor numbers in makedev() and friends tools/nolibc: make dev_t 64 bits wide tools/nolibc: move the logic of makedev() and friends into functions selftests/nolibc: add a test for stat().st_rdev selftests/nolibc: add some tests for makedev() and friends ... commit 3203a08c1266689c204fb8f10d6bb5186921fce2 Merge: e6b162a63f9b6d b80777aef570ac Author: Linus Torvalds Date: Tue Apr 14 17:10:15 2026 -0700 Merge tag 'powerpc-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Madhavan Srinivasan: - powerpc support for huge pfnmaps - Cleanups to use masked user access - Rework pnv_ioda_pick_m64_pe() to use better bitmap API - Convert powerpc to AUDIT_ARCH_COMPAT_GENERIC - Backup region offset update to eflcorehdr - Fixes for wii/ps3 platform - Implement JIT support for private stack in powerpc - Implement JIT support for fsession in powerpc64 trampoline - Add support for instruction array and indirect jump in powerpc - Misc selftest fixes and cleanups Thanks to Abhishek Dubey, Aditya Gupta, Alex Williamson, Amit Machhiwal, Andrew Donnellan, Bartosz Golaszewski, Cédric Le Goater, Chen Ni, Christophe Leroy (CS GROUP), Hari Bathini, J. Neuschäfer, Mukesh Kumar Chaurasiya (IBM), Nam Cao, Nilay Shroff, Pavithra Prakash, Randy Dunlap, Ritesh Harjani (IBM), Shrikanth Hegde, Sourabh Jain, Vaibhav Jain, Venkat Rao Bagalkote, and Yury Norov (NVIDIA) * tag 'powerpc-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (47 commits) mailmap: Add entry for Andrew Donnellan powerpc32/bpf: fix loading fsession func metadata using PPC_LI32 selftest/bpf: Enable gotox tests for powerpc64 powerpc64/bpf: Add support for indirect jump selftest/bpf: Enable instruction array test for powerpc powerpc/bpf: Add support for instruction array powerpc32/bpf: Add fsession support powerpc64/bpf: Implement fsession support selftests/bpf: Enable private stack tests for powerpc64 powerpc64/bpf: Implement JIT support for private stack powerpc: pci-ioda: Optimize pnv_ioda_pick_m64_pe() powerpc: pci-ioda: use bitmap_alloc() in pnv_ioda_pick_m64_pe() powerpc/net: Inline checksum wrappers and convert to scoped user access powerpc/sstep: Convert to scoped user access powerpc/align: Convert emulate_spe() to scoped user access powerpc/ptrace: Convert gpr32_set_common_user() to scoped user access powerpc/futex: Use masked user access powerpc/audit: Convert powerpc to AUDIT_ARCH_COMPAT_GENERIC cpuidle: powerpc: avoid double clear when breaking snooze powerpc/ps3: spu.c: fix enum and Return kernel-doc warnings ... commit e6b162a63f9b6d14473d9433ba8035c6351f35b2 Merge: c43267e6794a36 2c6805145e1605 Author: Linus Torvalds Date: Tue Apr 14 17:07:45 2026 -0700 Merge tag 'm68knommu-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu update from Greg Ungerer: - fix task info flags handling for 68000 nommu * tag 'm68knommu-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: Fix task info flags handling for 68000 commit c43267e6794a36013fd495a4d81bf7f748fe4615 Merge: 508fed6795411f 480a9e57cceaf4 Author: Linus Torvalds Date: Tue Apr 14 16:48:56 2026 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: "The biggest changes are MPAM enablement in drivers/resctrl and new PMU support under drivers/perf. On the core side, FEAT_LSUI lets futex atomic operations with EL0 permissions, avoiding PAN toggling. The rest is mostly TLB invalidation refactoring, further generic entry work, sysreg updates and a few fixes. Core features: - Add support for FEAT_LSUI, allowing futex atomic operations without toggling Privileged Access Never (PAN) - Further refactor the arm64 exception handling code towards the generic entry infrastructure - Optimise __READ_ONCE() with CONFIG_LTO=y and allow alias analysis through it Memory management: - Refactor the arm64 TLB invalidation API and implementation for better control over barrier placement and level-hinted invalidation - Enable batched TLB flushes during memory hot-unplug - Fix rodata=full block mapping support for realm guests (when BBML2_NOABORT is available) Perf and PMU: - Add support for a whole bunch of system PMUs featured in NVIDIA's Tegra410 SoC (cspmu extensions for the fabric and PCIe, new drivers for CPU/C2C memory latency PMUs) - Clean up iomem resource handling in the Arm CMN driver - Fix signedness handling of AA64DFR0.{PMUVer,PerfMon} MPAM (Memory Partitioning And Monitoring): - Add architecture context-switch and hiding of the feature from KVM - Add interface to allow MPAM to be exposed to user-space using resctrl - Add errata workaround for some existing platforms - Add documentation for using MPAM and what shape of platforms can use resctrl Miscellaneous: - Check DAIF (and PMR, where relevant) at task-switch time - Skip TFSR_EL1 checks and barriers in synchronous MTE tag check mode (only relevant to asynchronous or asymmetric tag check modes) - Remove a duplicate allocation in the kexec code - Remove redundant save/restore of SCS SP on entry to/from EL0 - Generate the KERNEL_HWCAP_ definitions from the arm64 hwcap descriptions - Add kselftest coverage for cmpbr_sigill() - Update sysreg definitions" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (109 commits) arm64: rsi: use linear-map alias for realm config buffer arm64: Kconfig: fix duplicate word in CMDLINE help text arm64: mte: Skip TFSR_EL1 checks and barriers in synchronous tag check mode arm64/sysreg: Update ID_AA64SMFR0_EL1 description to DDI0601 2025-12 arm64/sysreg: Update ID_AA64ZFR0_EL1 description to DDI0601 2025-12 arm64/sysreg: Update ID_AA64FPFR0_EL1 description to DDI0601 2025-12 arm64/sysreg: Update ID_AA64ISAR2_EL1 description to DDI0601 2025-12 arm64/sysreg: Update ID_AA64ISAR0_EL1 description to DDI0601 2025-12 arm64/hwcap: Generate the KERNEL_HWCAP_ definitions for the hwcaps arm64: kexec: Remove duplicate allocation for trans_pgd ACPI: AGDI: fix missing newline in error message arm64: Check DAIF (and PMR) at task-switch time arm64: entry: Use split preemption logic arm64: entry: Use irqentry_{enter_from,exit_to}_kernel_mode() arm64: entry: Consistently prefix arm64-specific wrappers arm64: entry: Don't preempt with SError or Debug masked entry: Split preemption from irqentry_exit_to_kernel_mode() entry: Split kernel mode logic from irqentry_{enter,exit}() entry: Move irqentry_enter() prototype later entry: Remove local_irq_{enable,disable}_exit_to_user() ... commit faed986de5250e1cd1296e82d1fcb4c03997e02a Author: Adlavinitha Reddy Date: Wed Mar 18 16:46:16 2026 +0800 i2c: mediatek: add bus regulator control for power saving Add conditional bus regulator enable/disable in mtk_i2c_transfer() to support I2C bus power gating for platforms that require it. This implementation: - Enables bus_regulator before clk_bulk_enable() if vbus-supply is defined - Disables bus_regulator after clk_bulk_disable() - Only activates when vbus-supply is provided in device tree - Has no impact on platforms without vbus-supply defined This approach provides power savings for platforms with an extra I2C bus regulator, while avoiding runtime PM complexity. Tested on MT8188. Signed-off-by: Adlavinitha Reddy Reviewed-by: Chen-Yu Tsai Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260318084621.4127757-2-adlavinitha.reddy@mediatek.com commit 508fed6795411f5ab277fd1edc0d7adca4946f23 Merge: 1834703b8426c9 b90d398138ab30 Author: Linus Torvalds Date: Tue Apr 14 15:32:39 2026 -0700 Merge tag 'ras_core_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS updates from Borislav Petkov: - Add new AMD MCA bank names and types to the MCA code, preceded by a clean up of the relevant places to have them more developer-friendly (read: sort them alphanumerically and clean up comments) such that adding new banks is easy * tag 'ras_core_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce, EDAC/mce_amd: Add new SMCA bank types x86/mce, EDAC/mce_amd: Update CS bank type naming x86/mce, EDAC/mce_amd: Reorder SMCA bank type enums commit 1834703b8426c92211fd92a0e552fd4ae84dcb71 Merge: 60b8d4d492815e 4db9a9841dc106 Author: Linus Torvalds Date: Tue Apr 14 15:29:55 2026 -0700 Merge tag 'edac_updates_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - amd64_edac: Add support for AMD Zen 3 (family 19h, models 40h–4fh) - i10nm: Add GNR error information decoder support as an alternative to the firmware decoder - versalnet: Restructure the init/teardown logic for correct and more readable error handling. Also, fix two memory leaks and a resource leak - Convert several internal structs to use bounded flex arrays, enabling the kernel's runtime checker to catch out-of-bounds memory accesses - Mark various sysfs attribute tables read-only, preventing accidental modification at runtime - The usual fixes and cleanups across the subsystem * tag 'edac_updates_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/mc: Use kzalloc_flex() EDAC/ie31200: Make rpl_s_cfg static EDAC/i10nm: Fix spelling mistake "readd" -> "read" EDAC/versalnet: Fix device_node leak in mc_probe() EDAC/versalnet: Fix memory leak in remove and probe error paths EDAC/amd64: Add support for family 19h, models 40h-4fh EDAC/i10nm: Add driver decoder for Granite Rapids server EDAC/sb: Use kzalloc_flex() EDAC/i7core: Use kzalloc_flex() EDAC/mpc85xx: Constify device sysfs attributes EDAC/device: Allow addition of const sysfs attributes EDAC/pci_sysfs: Constify instance sysfs attributes EDAC/device: Constify info sysfs attributes EDAC/device: Drop unnecessary and dangerous casts of attributes EDAC/device: Drop unused macro to_edacdev_attr() EDAC/altera: Drop unused field eccmgr_sysfs_attr EDAC/versalnet: Refactor memory controller initialization and cleanup commit 60b8d4d492815eed6d52646998167bc60dd94e5a Merge: 970216e0231d79 c3aa64ab6a5ea5 Author: Linus Torvalds Date: Tue Apr 14 15:20:54 2026 -0700 Merge tag 'x86_sev_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SEV updates from Borislav Petkov: - Change the SEV host code handling of when SNP gets enabled in order to allow the machine to claim SNP-related resources only when SNP guests are really going to be launched. The user requests this by loading the ccp module and thus it controls when SNP initialization is done So export an API which module code can call and do the necessary SNP setup only when really needed - Drop an unnecessary write-back and invalidate operation that was being performed too early, since the ccp driver already issues its own at the correct point in the initialization sequence - Drop the hotplug callbacks for enabling SNP on newly onlined CPUs, which were both architecturally unsound (the firmware rejects initialization if any CPU lacks the required configuration) and buggy (the MFDM SYSCFG MSR bit was not being set) - Code refactoring and cleanups to accomplish the above * tag 'x86_sev_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: crypto/ccp: Update HV_FIXED page states to allow freeing of memory crypto/ccp: Implement SNP x86 shutdown x86/sev, crypto/ccp: Move HSAVE_PA setup to arch/x86/ x86/sev, crypto/ccp: Move SNP init to ccp driver x86/sev: Create snp_shutdown() x86/sev: Create snp_prepare() x86/sev: Create a function to clear/zero the RMP x86/sev: Rename SNP_FEATURES_PRESENT to SNP_FEATURES_IMPL x86/virt/sev: Keep the RMP table bookkeeping area mapped x86/virt/sev: Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN x86/virt/sev: Drop support for SNP hotplug commit 60c8a400fbef3592b8d718dc49f92914a9c8d762 Author: Shi Hao Date: Sat Apr 11 16:54:51 2026 +0530 dt-bindings: i2c: cnxt,cx92755-i2c: Convert to DT schema Convert the Conexant Digicolor I2C bindings to DT schema. Signed-off-by: Shi Hao Reviewed-by: Rob Herring (Arm) Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260411112451.35095-1-i.shihao.999@gmail.com commit 970216e0231d7984a85492b9de9dba71004f4ee6 Merge: cd4cdc53cc5e70 b21cf01c29ea16 Author: Linus Torvalds Date: Tue Apr 14 15:15:08 2026 -0700 Merge tag 'x86_misc_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Borislav Petkov: - Reference the tip tree maintainer handbook directly from the relevant MAINTAINERS file entries (covering timers, IRQ, locking, scheduling, perf, x86, and others) so that contributors and tooling can know where to look - Enable interrupt remapping in defconfig, which is an architectural requirement for x2APIC to function correctly on bare metal. Without it, x2APIC was effectively enabled but non-functional. - Ensure that drivers which register custom restart handlers (such as those needed for SoC-based x86 devices like Intel Lightning Mountain) are actually invoked during reboot, bringing x86 in line with how other architectures handle this. - Cleanups * tag 'x86_misc_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: MAINTAINERS: Add references to tip tree handbook x86/64/defconfig: Add CONFIG_IRQ_REMAP x86/reboot: Execute the kernel restart handler upon machine restart x86/mtrr: Use kstrtoul() in parse_mtrr_spare_reg() commit d98f6fcec6f1ab9e47617c579b50457d4cbfb0ac Author: Gabor Juhos Date: Thu Feb 26 14:11:28 2026 +0100 i2c: pxa: handle 'Early Bus Busy' condition on Armada 3700 Under some circumstances I2C recovery fails on Armada 3700. At least on the Methode uDPU board, removing and replugging an SFP module fails often, like this: [ 36.953127] sfp sfp-eth1: module removed [ 38.468549] i2c i2c-1: i2c_pxa: timeout waiting for bus free [ 38.486960] sfp sfp-eth1: module MENTECHOPTO POS22-LDCC-KR rev 1.0 sn MNC208U90009 dc 200828 [ 38.496867] mvneta d0040000.ethernet eth1: unsupported SFP module: no common interface modes [ 38.521448] hwmon hwmon2: temp1_input not attached to any thermal zone [ 39.249196] sfp sfp-eth1: module removed ... [ 292.568799] sfp sfp-eth1: please wait, module slow to respond ... [ 625.208814] sfp sfp-eth1: failed to read EEPROM: -EREMOTEIO Note that the 'unsupported SFP module' messages are not relevant. The module is used only for testing the I2C recovery funcionality, because the error can be triggered easily with this specific one. Enabling debug in the i2c-pxa driver reveals the following: [ 82.034678] sfp sfp-eth1: module removed [ 90.008654] i2c i2c-1: slave_0x50 error: timeout with active message [ 90.015112] i2c i2c-1: msg_num: 2 msg_idx: 0 msg_ptr: 0 [ 90.020464] i2c i2c-1: IBMR: 00000003 IDBR: 000000a0 ICR: 000007e0 ISR: 00000802 [ 90.027906] i2c i2c-1: log: [ 90.030787] This continues until the retries are exhausted ... [ 110.192489] i2c i2c-1: slave_0x50 error: exhausted retries [ 110.198012] i2c i2c-1: msg_num: 2 msg_idx: 0 msg_ptr: 0 [ 110.203323] i2c i2c-1: IBMR: 00000003 IDBR: 000000a0 ICR: 000007e0 ISR: 00000802 [ 110.210810] i2c i2c-1: log: [ 110.213633] ... then the whole sequence starts again ... [ 115.368641] i2c i2c-1: slave_0x50 error: timeout with active message ... while finally the SFP core gives up: [ 671.975258] sfp sfp-eth1: failed to read EEPROM: -EREMOTEIO When we analyze the log, it can be seen that bit 1 and 11 is set in the ISR (Interface Status Register). Bit 1 indicates the ACK/NACK status, but the purpose of bit 11 is not documented in the driver code unfortunately. The 'Functional Specification' document of the Armada 3700 SoCs family however says that this bit indicates an 'Early Bus Busy' condition. The document also notes that whenever this bit is set, it is not possible to initiate a transaction on the I2C bus. The observed behaviour corresponds to this statement. Unfortunately, I2C recovery does not help as it never runs in this special case. Although the driver checks the busyness of the bus at several places, but since it does not consider the A3700 specific bit in these checks it can't determine the actual status of the bus correctly which results in the errors above. In order to fix the problem, add a new member to struct 'i2c_pxa' to store a controller specific bitmask containing the bits indicating the busy status, and use that in the code while checking the actual status of the bus. This ensures that the correct status can be determined on the Armada 3700 based devices without causing functional changes on devices based on other SoCs. With the change applied, the driver detects the busy condition, and runs the recovery process: [ 742.617312] i2c i2c-1: state:i2c_pxa_wait_bus_not_busy:449: ISR=00000802, ICR=000007e0, IBMR=03 [ 742.626099] i2c i2c-1: i2c_pxa: timeout waiting for bus free [ 742.631933] i2c i2c-1: recovery: resetting controller, ISR=0x00000802 [ 742.638421] i2c i2c-1: recovery: IBMR 0x00000003 ISR 0x00000000 This clears the EBB bit in the ISR register, so it makes it possible to initiate transactions on the I2C bus again. After this patch, the SFP module used for testing can be removed and replugged numerous times without causing the error described at the beginning. Previously, the error happened after a few such attempts. The patch has been tested also with the following kernel versions: 5.10.251, 5.15.201, 6.1.164, 6.6.127, 6.12.74, 6.14.11, 6.15.10, 6.16.1, 6.18.13, 6.19.3 It improves recovery on all of them. Signed-off-by: Gabor Juhos Reviewed-by: Imre Kaloz Tested-by: Robert Marko Reviewed-by: Linus Walleij Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260226-i2c-pxa-fix-i2c-communication-v4-2-797a091dae87@gmail.com commit cd4cdc53cc5e7009ea6ef305336682d7800becf7 Merge: e9635f2a73604a 7989c39341348e Author: Linus Torvalds Date: Tue Apr 14 14:57:29 2026 -0700 Merge tag 'x86_microcode_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode loading updates from Borislav Petkov: "The kernel carries a table of Intel CPUs family, model, stepping, etc tuples which say what is the latest microcode for that particular CPU. Some CPU variants differ only by the platform ID which determines what microcode needs to be loaded on them. Carve out the platform ID handling from the microcode loader and make it available in a more generic place so that the old microcode verification machinery can use it" * tag 'x86_microcode_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode: Add platform mask to Intel microcode "old" list x86/cpu: Add platform ID to CPU matching structure x86/cpu: Add platform ID to CPU info structure x86/microcode: Refactor platform ID enumeration into a helper commit e9635f2a73604ad9cb33d480b489a03bdd03329f Merge: fabd5a8d24fb5b f0958d588e6de2 Author: Linus Torvalds Date: Tue Apr 14 14:50:51 2026 -0700 Merge tag 'x86_fred_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 FRED updates from Borislav Petkov: "We made the FRED support an opt-in initially out of fear of it breaking machines left and right in the case of a hw bug in the first generation of machines supporting it. Now that that the FRED code has seen a lot of hammering, flip the logic to be opt-out as is the usual case with new hw features" * tag 'x86_fred_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fred: Remove kernel log message when initializing exceptions x86/fred: Enable FRED by default commit fabd5a8d24fb5b430f71d3d3608696a7d5e9d720 Merge: 883af1f8e8788b 79727019ce3da2 Author: Linus Torvalds Date: Tue Apr 14 14:46:37 2026 -0700 Merge tag 'x86_cache_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: - Add return value descriptions to several internal functions, addressing kernel-doc complaints - Add the x86 maintainer mailing list to the resctrl section so they are automatically included in patch submissions, and reference the applicable contribution rules document - Allow users to apply a single Capacity Bitmask to all cache domains at once using '*' as a shorthand, instead of having to specify each domain individually. This is particularly user-friendly on high core-count systems with many cache clusters - When a user provides a non-existent domain ID while configuring cache allocation, ensure the failure reason is properly reported to the user rather than silently returning an error with a misleading "ok" status * tag 'x86_cache_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: fs/resctrl: Add missing return value descriptions MAINTAINERS: Update resctrl entry fs/resctrl: Add "*" shorthand to set io_alloc CBM for all domains fs/resctrl: Report invalid domain ID when parsing io_alloc_cbm commit 883af1f8e8788b99c5cd6797219bca44571775c9 Merge: 51efd08647deb0 0f409eaea53e49 Author: Linus Torvalds Date: Tue Apr 14 14:42:55 2026 -0700 Merge tag 'x86_tdx_for_7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 TDX updates from Dave Hansen: "The only real thing of note here is printing the TDX module version. This is a little silly on its own, but the upcoming TDX module update code needs the same TDX module call. This shrinks that set a wee bit. There's also few minor macro cleanups and a tweak to the GetQuote ABI to make it easier for userspace to detect zero-length (failed) quotes" * tag 'x86_tdx_for_7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: virt: tdx-guest: Return error for GetQuote failures KVM/TDX: Rename KVM_SUPPORTED_TD_ATTRS to KVM_SUPPORTED_TDX_TD_ATTRS x86/tdx: Rename TDX_ATTR_* to TDX_TD_ATTR_* KVM/TDX: Remove redundant definitions of TDX_TD_ATTR_* x86/tdx: Fix the typo in TDX_ATTR_MIGRTABLE x86/virt/tdx: Print TDX module version during init x86/virt/tdx: Retrieve TDX module version commit 51efd08647deb0506749df7b4d5314189e56b5f5 Merge: 9f2bb6c7b364f1 e751303e0ad2e9 Author: Linus Torvalds Date: Tue Apr 14 14:33:56 2026 -0700 Merge tag 'x86_mm_for_7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm updates from Dave Hansen: - Convert x86 code to use generic "pagetable" APIs and ptdescs This aligns some the set_memory*() code better with the new page table APIs, especially using ptdescs as opposed to 'struct page' directly. * tag 'x86_mm_for_7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm/pat: Convert split_large_page() to use ptdescs x86/mm/pat: Convert populate_pgd() to use page table apis x86/mm/pat: Convert pmd code to use page table apis x86/mm/pat: Convert pte code to use page table apis commit 9f2bb6c7b364f186aa37c524f6df33bd488d4efa Merge: 49b30f3e9cde34 124ad3034ec002 Author: Linus Torvalds Date: Tue Apr 14 14:24:45 2026 -0700 Merge tag 'x86_cpu_for_7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu updates from Dave Hansen: - Complete LASS enabling: deal with vsyscall and EFI The existing Linear Address Space Separation (LASS) support punted on support for common EFI and vsyscall configs. Complete the implementation by supporting EFI and vsyscall=xonly. - Clean up CPUID usage in newer Intel "avs" audio driver and update the x86-cpuid-db file * tag 'x86_cpu_for_7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tools/x86/kcpuid: Update bitfields to x86-cpuid-db v3.0 ASoC: Intel: avs: Include CPUID header at file scope ASoC: Intel: avs: Check maximum valid CPUID leaf x86/cpu: Remove LASS restriction on vsyscall emulation x86/vsyscall: Disable LASS if vsyscall mode is set to EMULATE x86/vsyscall: Restore vsyscall=xonly mode under LASS x86/traps: Consolidate user fixups in the #GP handler x86/vsyscall: Reorganize the page fault emulation code x86/cpu: Remove LASS restriction on EFI x86/efi: Disable LASS while executing runtime services x86/cpu: Defer LASS enabling until userspace comes up commit 49b30f3e9cde3403b8719dfcddc923bce572b69c Merge: 0972ba5605a0a0 6ccd0843b93966 Author: Linus Torvalds Date: Tue Apr 14 14:16:27 2026 -0700 Merge tag 'x86-vdso-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 vdso updates from Ingo Molnar: "vdso cleanups by Thomas Weißschuh: - Clean up remnants of VDSO32_NOTE_MASK - Drop pointless #ifdeffery in vvar_vclock_fault()" * tag 'x86-vdso-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vdso: Drop pointless #ifdeffery in vvar_vclock_fault() x86/vdso: Clean up remnants of VDSO32_NOTE_MASK commit 0972ba5605a0a0cd8a9e74558b97a9c9626adfb5 Merge: ac633ba77c84fa bc91133e260c81 Author: Linus Torvalds Date: Tue Apr 14 14:10:44 2026 -0700 Merge tag 'x86-platform-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform updates from Ingo Molnar: - Remove M486/M486SX/ELAN support, first minimal step (Ingo Molnar) - Print AGESA string from DMI additional information entry (Yazen Ghannam, Mario Limonciello) - Improve and fix the DMI code (Mario Limonciello): - Correct an indexing error in - Adjust dmi_decode() to use enums - Add pr_fmt() for dmi_scan.c to fix & standardize the log prefixes * tag 'x86-platform-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Print AGESA string from DMI additional information entry firmware: dmi: Add pr_fmt() for dmi_scan.c firmware: dmi: Adjust dmi_decode() to use enums firmware: dmi: Correct an indexing error in dmi.h x86/cpu: Remove M486/M486SX/ELAN support commit ac633ba77c84fa5be1ec081967be081d6e25577e Merge: 2ee08a89634caf 9b8ad2b63067eb Author: Linus Torvalds Date: Tue Apr 14 14:03:27 2026 -0700 Merge tag 'x86-cleanups-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Ingo Molnar: - Consolidate AMD and Hygon cases in parse_topology() (Wei Wang) - asm constraints cleanups in __iowrite32_copy() (Uros Bizjak) - Drop AMD Extended Interrupt LVT macros (Naveen N Rao) - Don't use REALLY_SLOW_IO for delays (Juergen Gross) - paravirt cleanups (Juergen Gross) - FPU code cleanups (Borislav Petkov) - split-lock handling code cleanups (Borislav Petkov, Ronan Pigott) * tag 'x86-cleanups-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Correct the comment explaining what xfeatures_in_use() does x86/split_lock: Don't warn about unknown split_lock_detect parameter x86/fpu: Correct misspelled xfeaures_to_write local var x86/apic: Drop AMD Extended Interrupt LVT macros x86/cpu/topology: Consolidate AMD and Hygon cases in parse_topology() block/floppy: Don't use REALLY_SLOW_IO for delays x86/paravirt: Replace io_delay() hook with a bool x86/irqflags: Preemptively move include paravirt.h directive where it belongs x86/split_lock: Restructure the unwieldy switch-case in sld_state_show() x86/local: Remove trailing semicolon from _ASM_XADD in local_add_return() x86/asm: Use inout "+" asm onstraint modifiers in __iowrite32_copy() commit 2ee08a89634caf79bffc515f8e163988f83b7398 Merge: 1c3b68f0d55b59 3b19e22cffe61b Author: Linus Torvalds Date: Tue Apr 14 13:54:17 2026 -0700 Merge tag 'x86-asm-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm from Ingo Molnar: "x86 asm cleanups by Uros Bizjak: - Remove unnecessary memory clobbers from FS/GS base (read-) accessors and savesegment() - Use ASM_INPUT_RM in __loadsegment_fs() to work around clang code generation problems - Implement loadsegment()/savesegment() macros with static inline helpers - Use savesegment() for segment register reads in ELF core dump and __show_regs() - Use correct type for 'gs' variable in __show_regs() to avoid zero-extension - Clean up 'sel' variable usage in do_set_thread_area()" * tag 'x86-asm-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tls: Clean up 'sel' variable usage in do_set_thread_area() x86/process/32: Use correct type for 'gs' variable in __show_regs() to avoid zero-extension x86/process/64: Use savesegment() in __show_regs() instead of inline asm x86/elf: Use savesegment() for segment register reads in ELF core dump x86/asm/segment: Implement loadsegment()/savesegment() macros with static inline helpers x86/asm/segment: Use ASM_INPUT_RM in __loadsegment_fs() x86/asm/segment: Remove unnecessary "memory" clobber from savesegment() x86/asm/fsgsbase: Remove unnecessary "memory" clobbers from FS/GS base (read-) accessors commit 1c3b68f0d55b5932eb38eda602a61aec6d6f5e5e Merge: 33c66eb5e98444 78cde54ea5f033 Author: Linus Torvalds Date: Tue Apr 14 13:33:36 2026 -0700 Merge tag 'sched-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "Fair scheduling updates: - Skip SCHED_IDLE rq for SCHED_IDLE tasks (Christian Loehle) - Remove superfluous rcu_read_lock() in the wakeup path (K Prateek Nayak) - Simplify the entry condition for update_idle_cpu_scan() (K Prateek Nayak) - Simplify SIS_UTIL handling in select_idle_cpu() (K Prateek Nayak) - Avoid overflow in enqueue_entity() (K Prateek Nayak) - Update overutilized detection (Vincent Guittot) - Prevent negative lag increase during delayed dequeue (Vincent Guittot) - Clear buddies for preempt_short (Vincent Guittot) - Implement more complex proportional newidle balance (Peter Zijlstra) - Increase weight bits for avg_vruntime (Peter Zijlstra) - Use full weight to __calc_delta() (Peter Zijlstra) RT and DL scheduling updates: - Fix incorrect schedstats for rt and dl thread (Dengjun Su) - Skip group schedulable check with rt_group_sched=0 (Michal Koutný) - Move group schedulability check to sched_rt_global_validate() (Michal Koutný) - Add reporting of runtime left & abs deadline to sched_getattr() for DEADLINE tasks (Tommaso Cucinotta) Scheduling topology updates by K Prateek Nayak: - Compute sd_weight considering cpuset partitions - Extract "imb_numa_nr" calculation into a separate helper - Allocate per-CPU sched_domain_shared in s_data - Switch to assigning "sd->shared" from s_data - Remove sched_domain_shared allocation with sd_data Energy-aware scheduling updates: - Filter false overloaded_group case for EAS (Vincent Guittot) - PM: EM: Switch to rcu_dereference_all() in wakeup path (Dietmar Eggemann) Infrastructure updates: - Replace use of system_unbound_wq with system_dfl_wq (Marco Crivellari) Proxy scheduling updates by John Stultz: - Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() - Minimise repeated sched_proxy_exec() checking - Fix potentially missing balancing with Proxy Exec - Fix and improve task::blocked_on et al handling - Add assert_balance_callbacks_empty() helper - Add logic to zap balancing callbacks if we pick again - Move attach_one_task() and attach_task() helpers to sched.h - Handle blocked-waiter migration (and return migration) - Add K Prateek Nayak to scheduler reviewers for proxy execution Misc cleanups and fixes by John Stultz, Joseph Salisbury, Peter Zijlstra, K Prateek Nayak, Michal Koutný, Randy Dunlap, Shrikanth Hegde, Vincent Guittot, Zhan Xusheng, Xie Yuanbin and Vincent Guittot" * tag 'sched-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (46 commits) sched/eevdf: Clear buddies for preempt_short sched/rt: Cleanup global RT bandwidth functions sched/rt: Move group schedulability check to sched_rt_global_validate() sched/rt: Skip group schedulable check with rt_group_sched=0 sched/fair: Avoid overflow in enqueue_entity() sched: Use u64 for bandwidth ratio calculations sched/fair: Prevent negative lag increase during delayed dequeue sched/fair: Use sched_energy_enabled() sched: Handle blocked-waiter migration (and return migration) sched: Move attach_one_task and attach_task helpers to sched.h sched: Add logic to zap balance callbacks if we pick again sched: Add assert_balance_callbacks_empty helper sched/locking: Add special p->blocked_on==PROXY_WAKING value for proxy return-migration sched: Fix modifying donor->blocked on without proper locking locking: Add task::blocked_lock to serialize blocked_on state sched: Fix potentially missing balancing with Proxy Exec sched: Minimise repeated sched_proxy_exec() checking sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() MAINTAINERS: Add K Prateek Nayak to scheduler reviewers sched/core: Get this cpu once in ttwu_queue_cond() ... commit 33c66eb5e9844429911bf5478c96c60f9f8af9d0 Merge: 4b2bdc22210e39 5a84b600050c5f Author: Linus Torvalds Date: Tue Apr 14 13:22:40 2026 -0700 Merge tag 'perf-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull performance events updates from Ingo Molnar: "Core updates: - Try to allocate task_ctx_data quickly, to optimize O(N^2) algorithm on large systems with O(100k) threads (Namhyung Kim) AMD PMU driver IBS support updates and fixes, by Ravi Bangoria: - Fix interrupt accounting for discarded samples - Fix a Zen5-specific quirk - Fix PhyAddrVal handling - Fix NMI-safety with perf_allow_kernel() - Fix a race between event add and NMIs Intel PMU driver updates: - Only check GP counters for PEBS constraints validation (Dapeng Mi) MSR driver: - Turn SMI_COUNT and PPERF on by default, instead of a long list of CPU models to enable them on (Kan Liang) ... and misc cleanups and fixes by Aldf Conte, Anshuman Khandual, Namhyung Kim, Ravi Bangoria and Yen-Hsiang Hsu" * tag 'perf-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/events: Replace READ_ONCE() with standard pgtable accessors perf/x86/msr: Make SMI and PPERF on by default perf/x86/intel/p4: Fix unused variable warning in p4_pmu_init() perf/x86/intel: Only check GP counters for PEBS constraints validation perf/x86/amd/ibs: Fix comment typo in ibs_op_data perf/amd/ibs: Advertise remote socket capability perf/amd/ibs: Enable streaming store filter perf/amd/ibs: Enable RIP bit63 hardware filtering perf/amd/ibs: Enable fetch latency filtering perf/amd/ibs: Support IBS_{FETCH|OP}_CTL2[Dis] to eliminate RMW race perf/amd/ibs: Add new MSRs and CPUID bits definitions perf/amd/ibs: Define macro for ldlat mask and shift perf/amd/ibs: Avoid race between event add and NMI perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler perf/amd/ibs: Preserve PhyAddrVal bit when clearing PhyAddr MSR perf/amd/ibs: Limit ldlat->l3missonly dependency to Zen5 perf/amd/ibs: Account interrupt for discarded samples perf/core: Simplify __detach_global_ctx_data() perf/core: Try to allocate task_ctx_data quickly perf/core: Pass GFP flags to attach_task_ctx_data() commit c7ff53ef45b2f879576f7bbeb163828d04f5f491 Author: Axel Flordal Date: Wed Apr 8 07:21:23 2026 +0000 arm64: dts: apple: Fix spelling error Change "configiguration" to "configuration". Reviewed-by: Neal Gompa Signed-off-by: Axel Flordal Link: https://patch.msgid.link/2338500.vFx2qVVIhK@fedora Signed-off-by: Sven Peter commit 44d9ae042c58977e56459e0bc0db0af678214605 Author: Sasha Finkelstein Date: Sat Apr 11 16:36:08 2026 +0200 dt-bindings: Update Sasha Finkelstein's email address Change the bindings that list my address Signed-off-by: Sasha Finkelstein Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260411-mailmap-v1-2-5a519f7b00b5@chaosmail.tech Signed-off-by: Sven Peter commit b04a4f8ff704febfb1a7d052ef2ad8adac1d9cfa Author: Sasha Finkelstein Date: Sat Apr 11 16:36:07 2026 +0200 mailmap: Update Sasha Finkelstein's email address Add mailmap entry Signed-off-by: Sasha Finkelstein Link: https://patch.msgid.link/20260411-mailmap-v1-1-5a519f7b00b5@chaosmail.tech Signed-off-by: Sven Peter commit 4b2bdc22210e39a02b3dc984cb8eb6b3293a56a7 Merge: 7393febcb1b208 1735858caa4bbb Author: Linus Torvalds Date: Tue Apr 14 13:00:04 2026 -0700 Merge tag 'objtool-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool updates from Ingo Molnar: - KLP support updates and fixes (Song Liu) - KLP-build script updates and fixes (Joe Lawrence) - Support Clang RAX DRAP sequence, to address clang false positive (Josh Poimboeuf) - Reorder ORC register numbering to match regular x86 register numbering (Josh Poimboeuf) - Misc cleanups (Wentong Tian, Song Liu) * tag 'objtool-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool/x86: Reorder ORC register numbering objtool: Support Clang RAX DRAP sequence livepatch/klp-build: report patch validation fuzz livepatch/klp-build: add terminal color output livepatch/klp-build: provide friendlier error messages livepatch/klp-build: improve short-circuit validation livepatch/klp-build: fix shellcheck complaints livepatch/klp-build: add Makefile with check target livepatch/klp-build: add grep-override function livepatch/klp-build: switch to GNU patch and recountdiff livepatch/klp-build: support patches that add/remove files objtool/klp: Correlate locals to globals objtool/klp: Match symbols based on demangled_name for global variables objtool/klp: Remove .llvm suffix in demangle_name() objtool/klp: Also demangle global objects objtool/klp: Use sym->demangled_name for symbol_name hash objtool/klp: Remove trailing '_' in demangle_name() objtool/klp: Remove redundant strcmp() in correlate_symbols() objtool: Use section/symbol type helpers commit e336aa3c396ba41fd5a3b818df917a70f39594a5 Merge: 73e65c424867fb e43f2df330a1b8 Author: Wolfram Sang Date: Tue Apr 14 21:48:38 2026 +0200 Merge tag 'i2c-host-7.1-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host for v7.1, part 1 - generic cleanups in npcm7xx, qcom-cci, xiic and designware DT bindings - atr: use kzalloc_flex for alias pool allocation - ixp4xx: convert bindings to DT schema - ocores: use read_poll_timeout_atomic() for polling waits - qcom-geni: skip extra TX DMA TRE for single read messages - s3c24xx: validate SMBus block length before using it - spacemit: refactor xfer path and add K1 PIO support - tegra: identify DVC and VI with SoC data variants - tegra: support SoC-specific register offsets - xiic: switch to devres and generic fw properties - xiic: skip input clock setup on non-OF systems rtl9300: - add per-SoC callbacks and clock support for RTL9607C - add support for new 50 kHz and 2.5 MHz bus speeds - general refactoring in preparation for RTL9607C support New support: - DesignWare GOOG5000 (ACPI HID) - Intel Nova Lake (ACPI ID) - Realtek RTL9607C - SpacemiT K3 binding - Tegra410 register layout support commit 7393febcb1b2082c0484952729cbebfe4dc508d5 Merge: e80d033851b3bc a21c1e961de28b Author: Linus Torvalds Date: Tue Apr 14 12:36:25 2026 -0700 Merge tag 'locking-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "Mutexes: - Add killable flavor to guard definitions (Davidlohr Bueso) - Remove the list_head from struct mutex (Matthew Wilcox) - Rename mutex_init_lockep() (Davidlohr Bueso) rwsems: - Remove the list_head from struct rw_semaphore and replace it with a single pointer (Matthew Wilcox) - Fix logic error in rwsem_del_waiter() (Andrei Vagin) Semaphores: - Remove the list_head from struct semaphore (Matthew Wilcox) Jump labels: - Use ATOMIC_INIT() for initialization of .enabled (Thomas Weißschuh) - Remove workaround for old compilers in initializations (Thomas Weißschuh) Lock context analysis changes and improvements: - Add context analysis for rwsems (Peter Zijlstra) - Fix rwlock and spinlock lock context annotations (Bart Van Assche) - Fix rwlock support in (Bart Van Assche) - Add lock context annotations in the spinlock implementation (Bart Van Assche) - signal: Fix the lock_task_sighand() annotation (Bart Van Assche) - ww-mutex: Fix the ww_acquire_ctx function annotations (Bart Van Assche) - Add lock context support in do_raw_{read,write}_trylock() (Bart Van Assche) - arm64, compiler-context-analysis: Permit alias analysis through __READ_ONCE() with CONFIG_LTO=y (Marco Elver) - Add __cond_releases() (Peter Zijlstra) - Add context analysis for mutexes (Peter Zijlstra) - Add context analysis for rtmutexes (Peter Zijlstra) - Convert futexes to compiler context analysis (Peter Zijlstra) Rust integration updates: - Add atomic fetch_sub() implementation (Andreas Hindborg) - Refactor various rust_helper_ methods for expansion (Boqun Feng) - Add Atomic<*{mut,const} T> support (Boqun Feng) - Add atomic operation helpers over raw pointers (Boqun Feng) - Add performance-optimal Flag type for atomic booleans, to avoid slow byte-sized RMWs on architectures that don't support them. (FUJITA Tomonori) - Misc cleanups and fixes (Andreas Hindborg, Boqun Feng, FUJITA Tomonori) LTO support updates: - arm64: Optimize __READ_ONCE() with CONFIG_LTO=y (Marco Elver) - compiler: Simplify generic RELOC_HIDE() (Marco Elver) Miscellaneous fixes and cleanups by Peter Zijlstra, Randy Dunlap, Thomas Weißschuh, Davidlohr Bueso and Mikhail Gavrilov" * tag 'locking-core-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (39 commits) compiler: Simplify generic RELOC_HIDE() locking: Add lock context annotations in the spinlock implementation locking: Add lock context support in do_raw_{read,write}_trylock() locking: Fix rwlock support in lockdep: Raise default stack trace limits when KASAN is enabled cleanup: Optimize guards jump_label: remove workaround for old compilers in initializations jump_label: use ATOMIC_INIT() for initialization of .enabled futex: Convert to compiler context analysis locking/rwsem: Fix logic error in rwsem_del_waiter() locking/rwsem: Add context analysis locking/rtmutex: Add context analysis locking/mutex: Add context analysis compiler-context-analysys: Add __cond_releases() locking/mutex: Remove the list_head from struct mutex locking/semaphore: Remove the list_head from struct semaphore locking/rwsem: Remove the list_head from struct rw_semaphore rust: atomic: Update a safety comment in impl of `fetch_add()` rust: sync: atomic: Update documentation for `fetch_add()` rust: sync: atomic: Add fetch_sub() ... commit 35c2c39832e569449b9192fa1afbbc4c66227af7 Merge: 6bb6bafa88b4ed b9d8b856689d2b Author: Jakub Kicinski Date: Tue Apr 14 11:54:21 2026 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Merge in late fixes in preparation for the net-next PR. Conflicts: include/net/sch_generic.h a6bd339dbb351 ("net_sched: fix skb memory leak in deferred qdisc drops") ff2998f29f390 ("net: sched: introduce qdisc-specific drop reason tracing") https://lore.kernel.org/adz0iX85FHMz0HdO@sirena.org.uk drivers/net/ethernet/airoha/airoha_eth.c 1acdfbdb516b ("net: airoha: Fix VIP configuration for AN7583 SoC") bf3471e6e6c0 ("net: airoha: Make flow control source port mapping dependent on nbq parameter") Adjacent changes: drivers/net/ethernet/airoha/airoha_ppe.c f44218cd5e6a ("net: airoha: Reset PPE cpu port configuration in airoha_ppe_hw_init()") 7da62262ec96 ("inet: add ip_local_port_step_width sysctl to improve port usage distribution") Signed-off-by: Jakub Kicinski commit 6bb6bafa88b4edfea59d931c8d85b73dd7a662ae Author: Kory Maincent Date: Tue Apr 14 17:09:47 2026 +0200 net: pse-pd: fix kernel-doc function name for pse_control_find_by_id() The kernel-doc comment header incorrectly referenced the function name pse_control_find_net_by_id() instead of the actual function name pse_control_find_by_id(). Correct the function name in the documentation to match the implementation. Signed-off-by: Kory Maincent Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260414150948.744618-1-kory.maincent@bootlin.com Signed-off-by: Jakub Kicinski commit 18cd10d2affe764eb26ec3bd4ffa14c259339ad0 Merge: bc28831d7a09f7 60a25ef8dacb35 Author: Jakub Kicinski Date: Tue Apr 14 11:48:07 2026 -0700 Merge branch 'wireguard-fixes-for-7-1-rc1' Jason A. Donenfeld says: ==================== WireGuard fixes for 7.1-rc1 1) Asbjørn's YNL sample, finally merged. Sorry for the wait on this one. 2) A simplification to use kfree_rcu instead of call_rcu, since kfree_rcu now works with kmem caches. 3) A trivial formatting derp. 4) Fix for a deadlock by moving to using exit_rtnl instead of pre_exit. ==================== Link: https://patch.msgid.link/20260414153944.2742252-1-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 60a25ef8dacb3566b1a8c4de00572a498e2a3bf9 Author: Shardul Bankar Date: Tue Apr 14 17:39:44 2026 +0200 wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit wg_netns_pre_exit() manually acquires rtnl_lock() inside the pernet .pre_exit callback. This causes a hung task when another thread holds rtnl_mutex - the cleanup_net workqueue (or the setup_net failure rollback path) blocks indefinitely in wg_netns_pre_exit() waiting to acquire the lock. Convert to .exit_rtnl, introduced in commit 7a60d91c690b ("net: Add ->exit_rtnl() hook to struct pernet_operations."), where the framework already holds RTNL and batches all callbacks under a single rtnl_lock()/rtnl_unlock() pair, eliminating the contention window. The rcu_assign_pointer(wg->creating_net, NULL) is safe to move from .pre_exit to .exit_rtnl (which runs after synchronize_rcu()) because all RCU readers of creating_net either use maybe_get_net() - which returns NULL for a dying namespace with zero refcount - or access net->user_ns which remains valid throughout the entire ops_undo_list sequence. Reported-by: syzbot+f2fbf7478a35a94c8b7c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=cb64c22a492202ca929e18262fdb8cb89e635c70 Signed-off-by: Shardul Bankar [ Jason: added __net_exit and __read_mostly annotations that were missing. ] Fixes: 900575aa33a3 ("wireguard: device: avoid circular netns references") Cc: stable@vger.kernel.org Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20260414153944.2742252-5-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit f364db381c9d38c96de3148ac584f859c550fad5 Author: Jason A. Donenfeld Date: Tue Apr 14 17:39:43 2026 +0200 wireguard: allowedips: remove redundant space Not a contentful commit, but amusingly found when porting ba3d7b93 to Windows. Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20260414153944.2742252-4-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 121f416756d63f6e130f4b9c49676c2b132c48b9 Author: Asbjørn Sloth Tønnesen Date: Tue Apr 14 17:39:42 2026 +0200 tools: ynl: add sample for wireguard Add a sample application for WireGuard, using the generated C library. The main benefit of this is to exercise the generated library, which might be useful for future self-tests. Example: $ make -C tools/net/ynl/lib $ make -C tools/net/ynl/generated $ make -C tools/net/ynl/tests wireguard $ ./tools/net/ynl/tests/wireguard usage: ./tools/net/ynl/tests/wireguard $ sudo ./tools/net/ynl/tests/wireguard wg-test Interface 3: wg-test Peer 6adfb183a4a2c94a2f92dab5ade762a4788[...]: Data: rx: 42 / tx: 42 bytes Allowed IPs: 0.0.0.0/0 ::/0 Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20260414153944.2742252-3-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit e5549aecdd24c43ef9d05c376343a621f0e04277 Author: Fushuai Wang Date: Tue Apr 14 17:39:41 2026 +0200 wireguard: allowedips: Use kfree_rcu() instead of call_rcu() Replace call_rcu() + kmem_cache_free() with kfree_rcu() to simplify the code and reduce function size. Signed-off-by: Fushuai Wang Reviewed-by: Simon Horman Signed-off-by: Jason A. Donenfeld Link: https://patch.msgid.link/20260414153944.2742252-2-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit e80d033851b3bc94c3d254ac66660ddd0a49d72c Merge: f21f7b5162e9db 7eb28030f641d5 Author: Linus Torvalds Date: Tue Apr 14 11:14:56 2026 -0700 Merge tag 'smp-core-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull SMP core updates from Thomas Gleixner: - Switch smp_call_on_cpu() to user system_percpu_wq instead of system_wq a part of the ongoing workqueue restructuring - Improve the CSD-lock diagnostics for smp_call_function_single() to provide better debug mechanisms on weakly ordered systems. - Cache the current CPU number once in smp_call_function*() instead of retrieving it over and over. - Add missing kernel-doc comments all over the place * tag 'smp-core-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp: Use system_percpu_wq instead of system_wq smp: Improve smp_call_function_single() CSD-lock diagnostics smp: Get this_cpu once in smp_call_function smp: Add missing kernel-doc comments commit abce65948c2cd9f4d36ea0a57e79b9885b9801c6 Author: Bharath SM Date: Tue Apr 14 21:48:05 2026 +0530 smb: client: add tracepoints for deferred handle caching Add tracepoints to observe handle caching behavior. smb3_open_cached: emitted when an open reuses a cached handle from a previous deferred close, avoiding a network round-trip smb3_close_cached: emitted when a close is deferred (handle cached for potential reuse by subsequent opens) Signed-off-by: Bharath SM Signed-off-by: Steve French commit 4c46b677f352dc480b8a19ea198146eac0c60f9e Author: Bharath SM Date: Tue Apr 14 21:48:04 2026 +0530 smb: client: add oplock level to smb3_open_done tracepoint Add an oplock field to the smb3_open_done_class trace event to show the granted oplock/lease level. Move the trace_smb3_open_done call after smb2_parse_contexts() so the oplock value reflects the parsed lease state (R/W/H flags). Signed-off-by: Bharath SM Signed-off-by: Steve French commit afab3f61aeb19693109e8a71028c7b0c8088f452 Author: Bharath SM Date: Tue Apr 14 21:48:03 2026 +0530 smb: client: add tracepoint for local lock conflicts Add smb3_lock_conflict tracepoint that fires when a byte-range lock request conflicts with an existing cached lock. This helps debug lock contention issues when locks are cached locally due to oplocks/leases. The trace includes both the requested and conflicting lock details: - Requested: offset, length, type - Conflicting: offset, length, type, pid (lock holder) Signed-off-by: Bharath SM Signed-off-by: Steve French commit eb4d3691fc9bf3687026daa8ec2cf32cfd962a11 Author: Bharath SM Date: Tue Apr 14 21:48:02 2026 +0530 smb: client: add tracepoints for lock operations Add tracepoints when lock operations are sent to the server with details including lock offset, length, and flags. smb3_lock_enter: before sending lock request smb3_lock_done: lock acquired successfully smb3_lock_err: lock request failed smb3_lock_cached: lock granted from local cache (no server roundtrip) Signed-off-by: Bharath SM Signed-off-by: Steve French commit f21f7b5162e9dbde6d3d5ce727d4ca2552d76ce9 Merge: c1fe867b5bf9c5 7138a8698a39e8 Author: Linus Torvalds Date: Tue Apr 14 10:53:44 2026 -0700 Merge tag 'timers-vdso-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull vdso updates from Thomas Gleixner: - Make the handling of compat functions consistent and more robust - Rework the underlying data store so that it is dynamically allocated, which allows the conversion of the last holdout SPARC64 to the generic VDSO implementation - Rework the SPARC64 VDSO to utilize the generic implementation - Mop up the left overs of the non-generic VDSO support in the core code - Expand the VDSO selftest and make them more robust - Allow time namespaces to be enabled independently of the generic VDSO support, which was not possible before due to SPARC64 not using it - Various cleanups and improvements in the related code * tag 'timers-vdso-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (51 commits) timens: Use task_lock guard in timens_get*() timens: Use mutex guard in proc_timens_set_offset() timens: Simplify some calls to put_time_ns() timens: Add a __free() wrapper for put_time_ns() timens: Remove dependency on the vDSO vdso/timens: Move functions to new file selftests: vDSO: vdso_test_correctness: Add a test for time() selftests: vDSO: vdso_test_correctness: Use facilities from parse_vdso.c selftests: vDSO: vdso_test_correctness: Handle different tv_usec types selftests: vDSO: vdso_test_correctness: Drop SYS_getcpu fallbacks selftests: vDSO: vdso_test_gettimeofday: Remove nolibc checks Revert "selftests: vDSO: parse_vdso: Use UAPI headers instead of libc headers" random: vDSO: Remove ifdeffery random: vDSO: Trim vDSO includes vdso/datapage: Trim down unnecessary includes vdso/datapage: Remove inclusion of gettimeofday.h vdso/helpers: Explicitly include vdso/processor.h vdso/gettimeofday: Add explicit includes random: vDSO: Add explicit includes MIPS: vdso: Explicitly include asm/vdso/vdso.h ... commit c1fe867b5bf9c57ab7856486d342720e2b205eed Merge: 1d5e40351e7d52 ff1c0c5d07028a Author: Linus Torvalds Date: Tue Apr 14 10:27:07 2026 -0700 Merge tag 'timers-core-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer core updates from Thomas Gleixner: - A rework of the hrtimer subsystem to reduce the overhead for frequently armed timers, especially the hrtick scheduler timer: - Better timer locality decision - Simplification of the evaluation of the first expiry time by keeping track of the neighbor timers in the RB-tree by providing a RB-tree variant with neighbor links. That avoids walking the RB-tree on removal to find the next expiry time, but even more important allows to quickly evaluate whether a timer which is rearmed changes the position in the RB-tree with the modified expiry time or not. If not, the dequeue/enqueue sequence which both can end up in rebalancing can be completely avoided. - Deferred reprogramming of the underlying clock event device. This optimizes for the situation where a hrtimer callback sets the need resched bit. In that case the code attempts to defer the re-programming of the clock event device up to the point where the scheduler has picked the next task and has the next hrtick timer armed. In case that there is no immediate reschedule or soft interrupts have to be handled before reaching the reschedule point in the interrupt entry code the clock event is reprogrammed in one of those code paths to prevent that the timer becomes stale. - Support for clocksource coupled clockevents The TSC deadline timer is coupled to the TSC. The next event is programmed in TSC time. Currently this is done by converting the CLOCK_MONOTONIC based expiry value into a relative timeout, converting it into TSC ticks, reading the TSC adding the delta ticks and writing the deadline MSR. As the timekeeping core has the conversion factors for the TSC already, the whole back and forth conversion can be completely avoided. The timekeeping core calculates the reverse conversion factors from nanoseconds to TSC ticks and utilizes the base timestamps of TSC and CLOCK_MONOTONIC which are updated once per tick. This allows a direct conversion into the TSC deadline value without reading the time and as a bonus keeps the deadline conversion in sync with the TSC conversion factors, which are updated by adjtimex() on systems with NTP/PTP enabled. - Allow inlining of the clocksource read and clockevent write functions when they are tiny enough, e.g. on x86 RDTSC and WRMSR. With all those enhancements in place a hrtick enabled scheduler provides the same performance as without hrtick. But also other hrtimer users obviously benefit from these optimizations. - Robustness improvements and cleanups of historical sins in the hrtimer and timekeeping code. - Rewrite of the clocksource watchdog. The clocksource watchdog code has over time reached the state of an impenetrable maze of duct tape and staples. The original design, which was made in the context of systems far smaller than today, is based on the assumption that the to be monitored clocksource (TSC) can be trivially compared against a known to be stable clocksource (HPET/ACPI-PM timer). Over the years this rather naive approach turned out to have major flaws. Long delays between the watchdog invocations can cause wrap arounds of the reference clocksource. The access to the reference clocksource degrades on large multi-sockets systems dure to interconnect congestion. This has been addressed with various heuristics which degraded the accuracy of the watchdog to the point that it fails to detect actual TSC problems on older hardware which exposes slow inter CPU drifts due to firmware manipulating the TSC to hide SMI time. The rewrite addresses this by: - Restricting the validation against the reference clocksource to the boot CPU which is usually closest to the legacy block which contains the reference clocksource (HPET/ACPI-PM). - Do a round robin validation betwen the boot CPU and the other CPUs based only on the TSC with an algorithm similar to the TSC synchronization code during CPU hotplug. - Being more leniant versus remote timeouts - The usual tiny fixes, cleanups and enhancements all over the place * tag 'timers-core-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (75 commits) alarmtimer: Access timerqueue node under lock in suspend hrtimer: Fix incorrect #endif comment for BITS_PER_LONG check posix-timers: Fix stale function name in comment timers: Get this_cpu once while clearing the idle state clocksource: Rewrite watchdog code completely clocksource: Don't use non-continuous clocksources as watchdog x86/tsc: Handle CLOCK_SOURCE_VALID_FOR_HRES correctly MIPS: Don't select CLOCKSOURCE_WATCHDOG parisc: Remove unused clocksource flags hrtimer: Add a helper to retrieve a hrtimer from its timerqueue node hrtimer: Remove trailing comma after HRTIMER_MAX_CLOCK_BASES hrtimer: Mark index and clockid of clock base as const hrtimer: Drop unnecessary pointer indirection in hrtimer_expire_entry event hrtimer: Drop spurious space in 'enum hrtimer_base_type' hrtimer: Don't zero-initialize ret in hrtimer_nanosleep() hrtimer: Remove hrtimer_get_expires_ns() timekeeping: Mark offsets array as const timekeeping/auxclock: Consistently use raw timekeeper for tk_setup_internals() timer_list: Print offset as signed integer tracing: Use explicit array size instead of sentinel elements in symbol printing ... commit 1d5e40351e7d521d7d143447d57315b6eb1e1160 Merge: c0ecb2a9eeaa25 aa80869b77e16d Author: Linus Torvalds Date: Tue Apr 14 10:23:19 2026 -0700 Merge tag 'irq-msi-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull MSI interrupt update from Thomas Gleixner: "A small update for the MSI interrupt library to check for callers which fail to provide the mandatory irq_write_msi_msg() callback, which prevents a NULL pointer dereference later" * tag 'irq-msi-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/msi-lib: Refuse initialization when irq_write_msi_msg() is missing commit c0ecb2a9eeaa25832c1367ecc865ab2523b8c3d5 Merge: db23954eeaf234 1fac04a0a4737c Author: Linus Torvalds Date: Tue Apr 14 10:18:10 2026 -0700 Merge tag 'irq-drivers-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull interrupt chip driver updates from Thomas Gleixner: - A large refactoring for the Renesas RZV2H driver to add new interrupt types cleanly - A large refactoring for the Renesas RZG2L driver to add support the new RZ/G3L variant - Add support for the new NXP S32N79 chip in the IMX irq-steer driver - Add support for the Apple AICv3 variant - Enhance the Loongson PCH LPC driver so it can be used on MIPS with device tree firmware - Allow the PIC32 EVIC driver to be built independent of MIPS in compile tests - The usual small fixes and enhancements all over the place * tag 'irq-drivers-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (46 commits) irqchip/irq-pic32-evic: Add __maybe_unused for board_bind_eic_interrupt in COMPILE_TEST irqchip/renesas-rzv2h: Kill icu_err string irqchip/renesas-rzv2h: Kill swint_names[] irqchip/renesas-rzv2h: Kill swint_idx[] irqchip/renesas-rzg2l: Add NMI support irqchip/renesas-rzg2l: Clear the shared interrupt bit in rzg2l_irqc_free() irqchip/renesas-rzg2l: Replace raw_spin_{lock,unlock} with guard() in rzg2l_irq_set_type() irqchip/gic-v3: Print a warning for out-of-range interrupt numbers irqchip/renesas-rzg2l: Add shared interrupt support irqchip/renesas-rzg2l: Add RZ/G3L support irqchip/renesas-rzg2l: Drop IRQC_IRQ_COUNT macro irqchip/renesas-rzg2l: Drop IRQC_TINT_START macro irqchip/renesas-rzg2l: Drop IRQC_NUM_IRQ macro irqchip/renesas-rzg2l: Dynamically allocate fwspec array irqchip/renesas-rzg2l: Split rzfive_irqc_{mask,unmask} into separate IRQ and TINT handlers irqchip/renesas-rzg2l: Split rzfive_tint_irq_endisable() into separate IRQ and TINT helpers irqchip/renesas-rzg2l: Replace rzg2l_irqc_irq_{enable,disable} with TINT-specific handlers irqchip/renesas-rzg2l: Split set_type handler into separate IRQ and TINT functions irqchip/renesas-rzg2l: Split EOI handler into separate IRQ and TINT functions irqchip/renesas-rzg2l: Replace single irq_chip with per-region irq_chip instances ... commit db23954eeaf23464669043ddbb38a64f7b301ebd Merge: 2ad332b0e221de e8be82c2d77ec1 Author: Linus Torvalds Date: Tue Apr 14 10:02:41 2026 -0700 Merge tag 'irq-core-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core irq updates from Thomas Gleixner: - Invoke add_interrupt_randomness() in handle_percpu_devid_irq() and cleanup the workaround in the Hyper-V driver, which would now invoke it twice on ARM64. Removing it from the driver requires to add it to the x86 system vector entry point - Remove the pointles cpu_read_lock() around reading CPU possible mask, which is read only after init - Add documentation for the interaction between device tree bindings and the interrupt type defines in irq.h - Delete stale defines in the matrix allocator and the equivalent in loongarch * tag 'irq-core-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Drivers: hv: Move add_interrupt_randomness() to hypervisor callback sysvec genirq/chip: Invoke add_interrupt_randomness() in handle_percpu_devid_irq() genirq/affinity: Remove cpus_read_lock() while reading cpu_possible_mask genirq/matrix, LoongArch: Delete IRQ_MATRIX_BITS leftovers genirq: Document interaction between and DT binding defines commit 15e9e00a5aa4f56ca1cff7749c166e072d7cb6ac Author: Paulo Alcantara Date: Tue Apr 14 11:37:21 2026 -0300 vfs: get rid of BUG_ON() in d_mark_tmpfile_name() Do proper error handling in d_mark_tmpfile_name() by returning errors rather than using BUG_ON()'s. Adjust caller to check for errors from d_mark_tmpfile_name() as well as clean it up for using return value from scnprintf() in QSTR_LEN() to make it more obvious where the tmpfile name's length is coming from. Link: https://lore.kernel.org/r/CAHk-=wgerpUKCDhdzKH0FEdLyfhj3doc9t+kO9Yb6rSsTp7hdQ@mail.gmail.com Suggested-by: Linus Torvalds Reviewed-by: David Howells Signed-off-by: Paulo Alcantara (Red Hat) Cc: Christian Brauner Cc: Jan Kara CC: linux-fsdevel@vger.kernel.org Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 2ad332b0e221dedc4c483faef2003be3655f9d77 Merge: 15a1bccddccba6 723ddce93e8db1 Author: Linus Torvalds Date: Tue Apr 14 09:48:39 2026 -0700 Merge tag 'core-debugobjects-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects update from Thomas Gleixner: "A trivial update for debugobjects to drop a pointless likely() around IS_ERR_OR_NULL()" * tag 'core-debugobjects-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Drop likely() around !IS_ERR_OR_NULL() commit 15a1bccddccba6cab63fec1345fbd24102d9e0b8 Merge: 5d0d3623303775 c291cfac49a67d Author: Linus Torvalds Date: Tue Apr 14 09:45:24 2026 -0700 Merge tag 'core-entry-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull entry code update from Thomas Gleixner: "A trivial update for the entry code adding missing kernel documentation for function arguments" * tag 'core-entry-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: entry: Add missing kernel-doc for arch_ptrace_report_syscall functions commit 41d7004ab4e521ccbd98793d7da55022796c463f Merge: 5b3a6cf06c8e01 abe76f9f47d59f Author: Krzysztof Kozlowski Date: Tue Apr 14 18:43:28 2026 +0200 Merge tag 'ti-k3-dt-for-v7.1-part2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt TI K3 device tree updates for v7.1 part2 Late addition: - Use memory-region-names for r5f across K3 SoCs * tag 'ti-k3-dt-for-v7.1-part2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: dts: ti: k3: Use memory-region-names for r5f Signed-off-by: Krzysztof Kozlowski commit 5d0d3623303775d750e122a2542d1a26c8573d38 Merge: a970ed18812d0c 404927758daac5 Author: Linus Torvalds Date: Tue Apr 14 09:18:40 2026 -0700 Merge tag 'kbuild-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild/Kconfig updates from Nicolas Schier: "Kbuild: - reject unexpected values for LLVM= - uapi: remove usage of toolchain headers - switch from '-fms-extensions' to '-fms-anonymous-structs' when available (currently: clang >= 23.0.0) - reduce the number of compiler-generated suffixes for clang thin-lto build - reduce output spam ("GEN Makefile") when building out of tree - improve portability for testing headers - also test UAPI headers against C++ compilers - drop build ID architecture allow-list in vdso_install - only run checksyscalls when necessary - update the debug information notes in reproducible-builds.rst - expand inlining hints with -fdiagnostics-show-inlining-chain Kconfig: - forbid multiple entries with the same symbol in a choice - error out on duplicated kconfig inclusion" * tag 'kbuild-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: (35 commits) kbuild: expand inlining hints with -fdiagnostics-show-inlining-chain kconfig: forbid multiple entries with the same symbol in a choice Documentation: kbuild: Update the debug information notes in reproducible-builds.rst checksyscalls: move instance functionality into generic code checksyscalls: only run when necessary checksyscalls: fail on all intermediate errors checksyscalls: move path to reference table to a variable kbuild: vdso_install: drop build ID architecture allow-list kbuild: vdso_install: gracefully handle images without build ID kbuild: vdso_install: hide readelf warnings kbuild: vdso_install: split out the readelf invocation kbuild: uapi: also test UAPI headers against C++ compilers kbuild: uapi: provide a C++ compatible dummy definition of NULL kbuild: uapi: handle UML in architecture-specific exclusion lists kbuild: uapi: move all include path flags together kbuild: uapi: move some compiler arguments out of the command definition check-uapi: use dummy libc includes check-uapi: honor ${CROSS_COMPILE} setting check-uapi: link into shared objects kbuild: reduce output spam when building out of tree ... commit 344bf523d441d44c75c429ea6cdcfa8f12efde4d Author: Krishna Chomal Date: Sat Apr 11 00:40:39 2026 +0530 platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C77) The HP Omen 16-wf1xxx (board ID: 8C77) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile. Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_thermal_params. Testing on board 8C77 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: Thomas Arici Reported-by: Thomas Arici Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221300 Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20260410191039.125659-5-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 899225257e78585e2e10b0f7ba472b3c212a8d16 Author: Krishna Chomal Date: Sat Apr 11 00:40:38 2026 +0530 platform/x86: hp-wmi: Add support for Omen 16-n0xxx (8A44) The HP Omen 16-n0xxx (board ID: 8A44) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile. Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_legacy_thermal_params. Testing on board 8A44 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: Prasoon Dev Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20260410191039.125659-4-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5badf5ebcd1476f4bb38c5909c5020e14384ad7d Author: Krishna Chomal Date: Sat Apr 11 00:40:37 2026 +0530 platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8D87) The HP OMEN MAX 16-ak0xxx (8D87) requires the same WMI queries as other Victus S devices, hence it has been added to the corresponding list. For this reason, platform_profile_victus_s_get_ec() will be called during thermal_profile_setup() and victus_s_powersource_event() to obtain hardware state (platform profile) by reading from the Embedded Controller, however, this particular board's EC does not seem to expose the platform profile value, unlike other boards. Hence EC readback is disabled. Testing on board 8D87 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: Jinyang Zhu Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20260410191039.125659-3-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 9d317a54e46d3b6420567dc5b63e9d7ff5c064a3 Author: Krishna Chomal Date: Sat Apr 11 00:40:36 2026 +0530 platform/x86: hp-wmi: fix fan table parsing For Victus S devices, the BIOS fan table header was being incorrectly parsed as: struct { u8 unknown; u8 num_entries; } The first field should be num_fans and the second should be unknown. It is pure coincidence that interpreting an "unknown" field as "num_entries" worked on multiple device, however for board 8D87 (in an upcoming patch), this assumption fails, and the hp-wmi driver fails to load. We fix this by correcting the header definition and compensating for num_entries by parsing each entry of the fan table until an all-NULL row is obtained, mirroring the behavior of OMEN Gaming Hub on Windows. Fixes: 46be1453e6e6 ("platform/x86: hp-wmi: add manual fan control for Victus S models") Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20260410191039.125659-2-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a970ed18812d0cf5e1f54401403300bb35b36433 Merge: 5181afcdf99527 592a22338e5acf Author: Linus Torvalds Date: Tue Apr 14 08:55:18 2026 -0700 Merge tag 'bitmap-for-v7.1' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: - new API: bitmap_weight_from() and bitmap_weighted_xor() (Yury) - drop unused __find_nth_andnot_bit() (Yury) - new tests and test improvements (Andy, Akinobu, Yury) - fixes for count_zeroes API (Yury) - cleanup bitmap_print_to_pagebuf() mess (Yury) - documentation updates (Andy, Kai, Kit). * tag 'bitmap-for-v7.1' of https://github.com/norov/linux: (24 commits) bitops: Update kernel-doc for sign_extendXX() powerpc/xive: simplify xive_spapr_debug_show() thermal: intel: switch cpumask_get() to using cpumask_print_to_pagebuf() coresight: don't use bitmap_print_to_pagebuf() lib/prime_numbers: drop temporary buffer in dump_primes() drm/xe: switch xe_pagefault_queue_init() to using bitmap_weighted_or() ice: use bitmap_empty() in ice_vf_has_no_qs_ena ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() bitmap: introduce bitmap_weighted_xor() bitmap: add test_zero_nbits() bitmap: exclude nbits == 0 cases from bitmap test bitmap: test bitmap_weight() for more asm-generic/bitops: Fix a comment typo in instrumented-atomic.h bitops: fix kernel-doc parameter name for parity8() lib: count_zeros: unify count_{leading,trailing}_zeros() lib: count_zeros: fix 32/64-bit inconsistency in count_trailing_zeros() lib: crypto: fix comments for count_leading_zeros() x86/topology: use bitmap_weight_from() bitmap: add bitmap_weight_from() lib/find_bit_benchmark: avoid clearing randomly filled bitmap in test_find_first_bit() ... commit 5181afcdf99527dd92a88f80fc4d0d8013e1b510 Merge: d60bc140158342 40a3f6c5e2604f Author: Linus Torvalds Date: Tue Apr 14 08:47:08 2026 -0700 Merge tag 'docs-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux Pull documentation updates from Jonathan Corbet: "A busier cycle than I had expected for docs, including: - Translations: some overdue updates to the Japanese translations, Chinese translations for some of the Rust documentation, and the beginnings of a Portuguese translation. - New documents covering CPU isolation, managed interrupts, debugging Python gbb scripts, and more. - More tooling work from Mauro, reducing docs-build warnings, adding self tests, improving man-page output, bringing in a proper C tokenizer to replace (some of) the mess of kernel-doc regexes, and more. - Update and synchronize changes.rst and scripts/ver_linux, and put both into alphabetical order. ... and a long list of documentation updates, typo fixes, and general improvements" * tag 'docs-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: (162 commits) Documentation: core-api: real-time: correct spelling doc: Add CPU Isolation documentation Documentation: Add managed interrupts Documentation: seq_file: drop 2.6 reference docs/zh_CN: update rust/index.rst translation docs/zh_CN: update rust/quick-start.rst translation docs/zh_CN: update rust/coding-guidelines.rst translation docs/zh_CN: update rust/arch-support.rst translation docs/zh_CN: sync process/2.Process.rst with English version docs/zh_CN: fix an inconsistent statement in dev-tools/testing-overview tracing: Documentation: Update histogram-design.rst for fn() handling docs: sysctl: Add documentation for /proc/sys/xen/ Docs: hid: intel-ish-hid: make long URL usable Documentation/kernel-parameters: fix architecture alignment for pt, nopt, and nobypass sched/doc: Update yield_task description in sched-design-CFS Documentation/rtla: Convert links to RST format docs: fix typos and duplicated words across documentation docs: fix typo in zoran driver documentation docs: add an Assisted-by mention to submitting-patches.rst Revert "scripts/checkpatch: add Assisted-by: tag validation" ... commit e534e9d13d0b7bdbb2cccdace7b96b769a10540e Author: Sami Mujawar Date: Fri Apr 10 17:36:36 2026 +0100 virt: arm-cca-guest: fix error check for RSI_INCOMPLETE The RSI interface can return RSI_INCOMPLETE when a report spans multiple granules. This is an expected condition and should not be treated as a fatal error. Currently, arm_cca_report_new() checks for `info.result != RSI_SUCCESS` and bails out, which incorrectly flags RSI_INCOMPLETE as a failure. Fix the check to only break out on results other than RSI_SUCCESS or RSI_INCOMPLETE. This ensures partial reports are handled correctly and avoids spurious -ENXIO errors when generating attestation reports. Fixes: 7999edc484ca ("virt: arm-cca-guest: TSM_REPORT support for realms") Signed-off-by: Sami Mujawar Reported-by: Jagdish Gediya Reviewed-by: Steven Price Reviewed-by: Gavin Shan Reviewed-by: Suzuki K Poulose Reviewed-by: Yeoreum Yun Signed-off-by: Catalin Marinas commit 680b961ebf41a7183389edbbfd5bbb302f69cce7 Author: Mark Brown Date: Mon Apr 13 16:44:11 2026 +0100 arm64/hwcap: Include kernel-hwcap.h in list of generated files When adding generation for the kernel internal constants for hwcaps the generated file was not explicitly flagged as such in the build system, causing it to be regenerated on each build. This wasn't obvious when the series the change was included in was developed since it was all about changes that trigger rebuilds anyway. Fixes: abed23c3c44f ("arm64/hwcap: Generate the KERNEL_HWCAP_ definitions for the hwcaps") Reported-by: Marek Vasut Signed-off-by: Mark Brown Reviewed-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit bc28831d7a09f7058cdca4658d81e5faf635bed7 Author: Daniel Borkmann Date: Tue Apr 14 09:52:49 2026 +0200 MAINTAINERS: Add netkit selftest files The following selftest files are related to netkit and should have netkit folks in Cc for review: - tools/testing/selftests/bpf/prog_tests/tc_netkit.c - tools/testing/selftests/drivers/net/hw/nk_qlease.py - tools/testing/selftests/net/nk_qlease.py Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260414075249.611608-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 2d7e20c9886f359a4ebd4bdbba53ab2df44667d6 Merge: 34e1a98ff2a87c 1e822171ba9bca Author: Jakub Kicinski Date: Tue Apr 14 08:17:06 2026 -0700 Merge branch 'follow-ups-to-nk_qlease-net-selftests' Daniel Borkmann says: ==================== Follow-ups to nk_qlease net selftests This is a set of follow-ups addressing [0]: - Split netdevsim tests from HW tests in nk_qlease and move the SW tests under selftests/net/ - Remove multiple ksft_run()s to fix the recently enforced hard-fail - Move all the setup inside the test cases for the ones under selftests/net/ (I'll defer the HW ones to David) - Add more test coverage related to queue leasing behavior and corner cases, so now we have 45 tests in nk_qlease.py with netdevsim which does not need special HW ==================== Link: https://patch.msgid.link/20260413220809.604592-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 1e822171ba9bca7a5d2371bc10358340835bdad3 Author: Daniel Borkmann Date: Tue Apr 14 00:08:06 2026 +0200 selftests/net: Add additional test coverage in nk_qlease Add further netkit queue-lease coverage for netns lifecycle of the guest and physical halves, channel resize across active leases, single-device and multi-lessee scenarios, L3 mode operation, lease capacity exhaustion, and corner-cases of e.g. queue-create rejection paths. Also make the tests more robust by removing the time.sleep(0.1) after netns deletion and turn them into a wait loop. Full test run: # ./nk_qlease.py TAP version 13 1..45 ok 1 nk_qlease.test_remove_phys ok 2 nk_qlease.test_double_lease ok 3 nk_qlease.test_virtual_lessor ok 4 nk_qlease.test_phys_lessee ok 5 nk_qlease.test_different_lessors ok 6 nk_qlease.test_queue_out_of_range ok 7 nk_qlease.test_resize_leased ok 8 nk_qlease.test_self_lease ok 9 nk_qlease.test_create_tx_type ok 10 nk_qlease.test_create_primary ok 11 nk_qlease.test_create_limit ok 12 nk_qlease.test_link_flap_phys ok 13 nk_qlease.test_queue_get_virtual ok 14 nk_qlease.test_remove_virt_first ok 15 nk_qlease.test_multiple_leases ok 16 nk_qlease.test_lease_queue_tx_type ok 17 nk_qlease.test_invalid_netns ok 18 nk_qlease.test_invalid_phys_ifindex ok 19 nk_qlease.test_multi_netkit_remove_phys ok 20 nk_qlease.test_single_remove_phys ok 21 nk_qlease.test_link_flap_virt ok 22 nk_qlease.test_phys_queue_no_lease ok 23 nk_qlease.test_same_ns_lease ok 24 nk_qlease.test_resize_after_unlease ok 25 nk_qlease.test_lease_queue_zero ok 26 nk_qlease.test_release_and_reuse ok 27 nk_qlease.test_veth_queue_create ok 28 nk_qlease.test_two_netkits_same_queue ok 29 nk_qlease.test_l3_mode_lease ok 30 nk_qlease.test_single_double_lease ok 31 nk_qlease.test_single_different_lessors ok 32 nk_qlease.test_cross_ns_netns_id ok 33 nk_qlease.test_delete_guest_netns ok 34 nk_qlease.test_move_guest_netns ok 35 nk_qlease.test_resize_phys_no_reduction ok 36 nk_qlease.test_delete_one_netkit_of_two ok 37 nk_qlease.test_bind_rx_leased_phys_queue ok 38 nk_qlease.test_resize_phys_shrink_past_leased ok 39 nk_qlease.test_resize_virt_not_supported ok 40 nk_qlease.test_lease_devices_down ok 41 nk_qlease.test_lease_capacity_exhaustion ok 42 nk_qlease.test_resize_phys_up ok 43 nk_qlease.test_multi_ns_lease ok 44 nk_qlease.test_multi_ns_delete_one ok 45 nk_qlease.test_move_phys_netns # Totals: pass:45 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260413220809.604592-4-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit e254ffb9502c8b4c7f8712c34ae6590796825260 Author: Daniel Borkmann Date: Tue Apr 14 00:08:05 2026 +0200 selftests/net: Split netdevsim tests from HW tests in nk_qlease As pointed out in 3d2c3d2eea9a ("selftests: net: py: explicitly forbid multiple ksft_run() calls"), ksft_run() cannot be called multiple times. Move the netdevsim-based queue lease tests to selftests/net/ so that each file has exactly one ksft_run() call. The HW tests (io_uring ZC RX, queue attrs, XDP with MP, destroy) remain in selftests/drivers/net/hw/. Fixes: 65d657d80684 ("selftests/net: Add queue leasing tests with netkit") Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/netdev/20260409181950.7e099b6c@kernel.org Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260413220809.604592-3-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 4a6fe5fe60040c31c25767ca815a06fab35c1eb7 Author: Daniel Borkmann Date: Tue Apr 14 00:08:04 2026 +0200 tools/ynl: Make YnlFamily closeable as a context manager YnlFamily opens an AF_NETLINK socket in __init__ but has no way to release it other than leaving it to the GC. YnlFamily holds a self reference cycle through SpecFamily's self.family = self in its super().__init__() call, so refcount GC cannot reclaim it and the socket stays open until the cyclic GC runs. If a test creates a guest netns, instantiates a YnlFamily inside it via NetNSEnter(), performs some test case work via Ynl, and then deletes the netns, then the 'ip netns del' only drops the mount binding and cleanup_net in the kernel never runs, so any subsequent test case assertions that objects got cleaned up would fail given this only gets triggered later via cyclic GC run. Add an explicit close() that closes the netlink socket and wire up the __enter__/__exit__ so callers can scope the instance deterministically via 'with YnlFamily(...) as ynl: ...'. Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260413220809.604592-2-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 43cec30c44764c4b1401fdeb48bfd18c3fc7eff8 Author: Steven Rostedt Date: Tue Apr 14 11:03:44 2026 -0400 tracefs: Removed unused 'ret' variable in eventfs_iterate() Moving to guard() usage removed the need of using the 'ret' variable but it wasn't removed. As it was set to zero, the compiler in use didn't warn (although some compilers do). Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260414110344.75c0663f@robin Fixes: 4d9b262031f ("eventfs: Simplify code using guard()s") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604100111.AAlbQKmK-lkp@intel.com/ Signed-off-by: Steven Rostedt (Google) commit 8fc1ad90075f54797197827787ac691bf410b07b Author: Tetsuo Handa Date: Wed Apr 15 00:00:10 2026 +0900 tomoyo: use u64 for holding inode->i_ino value TOMOYO is treating numeric fields (including inode->i_ino) as "unsigned long". Now that commit 0b2600f81cef ("treewide: change inode->i_ino from unsigned long to u64") went upstream, update affected portions in TOMOYO. While an administrator might write a rule that compares inode->i_ino with an immediate value, this patch changes type of variable for inode->i_ino to "u64" but does not change type of variable for the corresponding immediate value to "u64" due to the following reasons. It is likely that rules that compare inode->i_ino are for testing whether the directories involved in e.g. rename() operation are the same (i.e. comparison between two inode->i_ino values rather than one inode->i_ino value and one immediate value). It unlikely makes sense to compare inode->i_ino with an immediate value larger than UINT_MAX. Signed-off-by: Tetsuo Handa commit aea645c02f1acc36088618667e086b62d8f83e92 Author: Thorsten Blum Date: Tue Apr 7 20:18:36 2026 +0200 lib/vsprintf: use bool for local decode variable The local variable 'decode' is only used as a boolean value - change its data type from int to bool accordingly. Signed-off-by: Thorsten Blum Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20260407181835.1053072-2-thorsten.blum@linux.dev Signed-off-by: Petr Mladek commit e0da8a8cac74f4b9f577979d131f0d2b88a84487 Author: Ziqing Chen Date: Tue Apr 14 21:24:37 2026 +0800 ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() snd_ctl_elem_init_enum_names() advances pointer p through the names buffer while decrementing buf_len. If buf_len reaches zero but items remain, the next iteration calls strnlen(p, 0). While strnlen(p, 0) returns 0 and would hit the existing name_len == 0 error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks maxlen against __builtin_dynamic_object_size(). When Clang loses track of p's object size inside the loop, this triggers a BRK exception panic before the return value is examined. Add a buf_len == 0 guard at the loop entry to prevent calling fortified strnlen() on an exhausted buffer. Found by kernel fuzz testing through Xiaomi Smartphone. Fixes: 8d448162bda5 ("ALSA: control: add support for ENUMERATED user space controls") Cc: stable@vger.kernel.org Signed-off-by: Ziqing Chen Link: https://patch.msgid.link/20260414132437.261304-1-chenziqing@xiaomi.com Signed-off-by: Takashi Iwai commit b9d8b856689d2b968495d79fe653d87fcb8ad98c Author: Lorenzo Bianconi Date: Sun Apr 12 10:43:26 2026 +0200 net: airoha: Add missing PPE configurations in airoha_ppe_hw_init() Add the following PPE configuration in airoha_ppe_hw_init routine: - 6RD hw offloading is currently not supported by Netfilter flowtable. Disable explicitly PPE 6RD offloading in order to prevent PPE to learn 6RD flows and eventually interrupt the traffic. - Add missing PPE bind rate configuration for L3 and L2 traffic. PPE bind rate configuration specifies the pps threshold to move a PPE entry state from UNBIND to BIND. Without this configuration this value is random. - Set ageing thresholds to the values used in the vendor SDK in order to improve connection stability under load and avoid packet loss caused by fast aging. Fixes: 00a7678310fe3 ("net: airoha: Introduce flowtable offload support") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260412-airoha_ppe_hw_init-missing-bits-v1-1-06ac670819e3@kernel.org Signed-off-by: Paolo Abeni commit 978df761538ec60265a7a968204fd4a8f1548185 Author: Johan Hovold Date: Fri Apr 10 10:34:23 2026 +0200 MAINTAINERS: update second Socionext SPI maintainer address The Linaro address is bouncing so switch to Jassi's gmail address also found in MAINTAINERS. Cc: Jassi Brar Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410083423.504695-3-johan@kernel.org Signed-off-by: Mark Brown commit 9c53a0379e29b25dbfe043fca80fc784b00a62e3 Author: Johan Hovold Date: Fri Apr 10 10:34:22 2026 +0200 MAINTAINERS: update Socionext SPI maintainer address The Linaro address is bouncing so switch to Masahisa's Socionext address also found in MAINTAINERS. Acked-by: Masahisa Kojima Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410083423.504695-2-johan@kernel.org Signed-off-by: Mark Brown commit ebeef57b7ba92ff5b4edcd14a34b30b9645871db Author: Krzysztof Kozlowski Date: Mon Apr 13 10:59:48 2026 +0200 spi: dt-bindings: fsl: Correct GPIO flags in the example IRQ_TYPE_xxx flags are not correct in the context of GPIO flags. These are simple defines so they could be used in DTS but they will not have the same meaning: IRQ_TYPE_EDGE_RISING = 1 = GPIO_ACTIVE_LOW. Correct the example DTS to use proper flags for chip select GPIOs, assuming the author of the code wanted similar logical behavior: IRQ_TYPE_EDGE_RISING => GPIO_ACTIVE_HIGH Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260413085947.51047-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown commit 6e5b0fac1063ba0b3c0e3fe1c605f95a3f45d440 Merge: cf162476f7e082 a158fe7b0c817e Author: Mark Brown Date: Tue Apr 14 12:47:16 2026 +0100 ASoC: SOF: Intel: NVL/NVL-S: add platform name Bard Liao says: The platform name will be used in the topology name. Link: https://patch.msgid.link/20260413060800.3156425-1-yung-chuan.liao@linux.intel.com commit a158fe7b0c817eebcf2871fe1306347a376030e8 Author: Bard Liao Date: Mon Apr 13 14:08:00 2026 +0800 ASoC: SOF: Intel: NVL-S: add platform name The platform name will be used in the topology name. Fixes: d3df422f66e8a ("ASoC: SOF: Intel: add initial support for NVL-S") Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Link: https://patch.msgid.link/20260413060800.3156425-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit ab463b4655857b1865c611ff5fbcb752cd804b0b Author: Bard Liao Date: Mon Apr 13 14:07:59 2026 +0800 ASoC: SOF: Intel: NVL: add platform name The platform name will be used in the topology name. Fixes: 1800bcdc68ead ("ASoC: SOF: Intel: add support for Nova Lake NVL") Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Link: https://patch.msgid.link/20260413060800.3156425-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 1acdfbdb516b32165a8ecd1d5f8c68e4eac64637 Author: Lorenzo Bianconi Date: Sun Apr 12 09:57:29 2026 +0200 net: airoha: Fix VIP configuration for AN7583 SoC EN7581 and AN7583 SoCs have different VIP definitions. Introduce get_vip_port callback in airoha_eth_soc_data struct in order to take into account EN7581 and AN7583 VIP register layout and definition differences. Introduce nbq parameter in airoha_gdm_port struct. At the moment nbq is set statically to value previously used in airhoha_set_gdm2_loopback routine and it will be read from device tree in subsequent patches. Fixes: e4e5ce823bdd ("net: airoha: Add AN7583 SoC support") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260412-airoha-7583-vip-fix-v1-1-c35e02b054bb@kernel.org Signed-off-by: Paolo Abeni commit f7cf8ece8cee3c1ee361991470cdb1eb65ab02e8 Author: Zhengchuan Liang Date: Sat Apr 11 23:10:26 2026 +0800 net: caif: clear client service pointer on teardown `caif_connect()` can tear down an existing client after remote shutdown by calling `caif_disconnect_client()` followed by `caif_free_client()`. `caif_free_client()` releases the service layer referenced by `adap_layer->dn`, but leaves that pointer stale. When the socket is later destroyed, `caif_sock_destructor()` calls `caif_free_client()` again and dereferences the freed service pointer. Clear the client/service links before releasing the service object so repeated teardown becomes harmless. Fixes: 43e369210108 ("caif: Move refcount from service layer to sock and dev.") Cc: stable@kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Ren Wei Signed-off-by: Zhengchuan Liang Signed-off-by: Ren Wei Link: https://patch.msgid.link/9f3d37847c0037568aae698ca23cd47c6691acb0.1775897577.git.zcliangcn@gmail.com Signed-off-by: Paolo Abeni commit cf162476f7e082662691e75f96bfc99c6a64810d Author: Shuming Fan Date: Tue Apr 14 15:14:41 2026 +0800 ASoC: rt1320: fix the warning 'rae_fw' from request_firmware() not released New smatch warnings: sound/soc/codecs/rt1320-sdw.c:1575 rt1320_rae_load() warn: 'rae_fw' from request_firmware() not released on lines: 1575. Fixes: 22937af75abb ("ASoC: rt1320: support RAE parameters loading") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202604111548.EL450PMb-lkp@intel.com/ Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20260414071441.1524039-1-shumingf@realtek.com Signed-off-by: Mark Brown commit fe72340daaf1af588be88056faf98965f39e6032 Author: Luxiao Xu Date: Sat Apr 11 23:10:10 2026 +0800 net: strparser: fix skb_head leak in strp_abort_strp() When the stream parser is aborted, for example after a message assembly timeout, it can still hold a reference to a partially assembled message in strp->skb_head. That skb is not released in strp_abort_strp(), which leaks the partially assembled message and can be triggered repeatedly to exhaust memory. Fix this by freeing strp->skb_head and resetting the parser state in the abort path. Leave strp_stop() unchanged so final cleanup still happens in strp_done() after the work and timer have been synchronized. Fixes: 43a0c6751a32 ("strparser: Stream parser for messages") Cc: stable@kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Yuan Tan Signed-off-by: Luxiao Xu Signed-off-by: Ren Wei Link: https://patch.msgid.link/ade3857a9404999ce9a1c27ec523efc896072678.1775482694.git.rakukuip@gmail.com Signed-off-by: Paolo Abeni commit a1ed2ec1c5458b4a99765439cb595dd0e026a352 Author: Takashi Iwai Date: Tue Apr 14 11:33:34 2026 +0200 ALSA: usb-audio: Fix missing error handling for get_min_max*() The recent fix to add the error return value check from get_min_max*() missed one case in build_audio_procunit() where no error value is set. This may lead to an uninitialized variable and confuse the caller (although this wouldn't happen practically because err is set for the loop of num_ins at the beginning of the funciton). Fix it by setting "err = 0" properly at the missing case, too. Fixes: 4f55a85cd4fc ("ALSA: usb-audio: Add error checks against get_min_max*()") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/ad36dGpCBTGsyFr_@stanley.mountain Link: https://patch.msgid.link/20260414093336.305464-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit be19b43f92fae4794f271ed9e338bdbcfa725aa2 Author: Osama Abdelkader Date: Fri Apr 3 16:52:05 2026 +0200 drm/bridge: dw-mipi-dsi: Fix bridge leak when host attach fails dw_mipi_dsi_host_attach() and dw_mipi_dsi2_host_attach() call drm_bridge_add() before pdata->host_ops->attach(). If attach fails, the bridge stayed registered without drm_bridge_remove(), leaking the bridge reference and leaving the device on the global bridge list. Fixes: 90910a651123 ("drm/bridge/synopsys: dsi: add ability to have glue-specific attach and detach") Fixes: 0d6d86253fef ("drm/bridge/synopsys: Add MIPI DSI2 host controller bridge") Signed-off-by: Osama Abdelkader Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260403145208.15890-1-osama.abdelkader@gmail.com Signed-off-by: Luca Ceresoli commit 600dc40554dc5ad1e6f3af51f700228033f43ea7 Author: Greg Kroah-Hartman Date: Sat Apr 11 13:01:35 2026 +0200 net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() A malicious USB device claiming to be a CDC Phonet modem can overflow the skb_shared_info->frags[] array by sending an unbounded sequence of full-page bulk transfers. Drop the skb and increment the length error when the frag limit is reached. This matches the same fix that commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") did for the t7xx driver. Cc: Andrew Lunn Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: stable Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026041134-dreamboat-buddhism-d1ec@gregkh Fixes: 87cf65601e17 ("USB host CDC Phonet network interface driver") Signed-off-by: Paolo Abeni commit 621a59d8fc678762abc12ad8ad6bf616496fa4d2 Author: Tom Zanussi Date: Mon Apr 13 17:35:38 2026 -0500 selftests/ftrace: Add test case for fully-qualified variable references This test adds a variable (ts0) to two events (sched_waking and sched_wakeup) and uses a fully-qualified variable reference to expicitly choose a particular one (sched_wakeup.$ts0) when calculating the wakeup latency. Link: https://patch.msgid.link/ce9d96aeb84b2d40bd469fe9a346e225442873b1.1776112478.git.zanussi@kernel.org Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (Google) commit 9236eebd138aa2753f7b30fc6cee7b7202841247 Author: Tom Zanussi Date: Mon Apr 13 17:35:37 2026 -0500 tracing: Fix fully-qualified variable reference printing in histograms The syntax for fully-qualified variable references in histograms is subsys.event.$var, which is parsed correctly, but not displayed correctly when printing a histogram spec. The current code puts the $ reference at the beginning of the fully-qualified variable name i.e. $subsys.event.var, which is incorrect. Before: trigger info: hist:keys=next_comm:vals=hitcount:wakeup_lat=common_timestamp.usecs-$sched.sched_wakeup.ts0: ... After: trigger info: hist:keys=next_comm:vals=hitcount:wakeup_lat=common_timestamp.usecs-sched.sched_wakeup.$ts0: ... Link: https://patch.msgid.link/5dee9a86d062a4dd68c2214f3d90ac93811e1951.1776112478.git.zanussi@kernel.org Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (Google) commit 5b484311507b5d403c1f7a45f6aa3778549e268b Author: Douglas Anderson Date: Mon Apr 13 19:59:11 2026 -0700 driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Even though nobody should use this value (except when declaring the "flags" bitmap), kernel-doc still gets upset that it's not documented. It reports: WARNING: ../include/linux/device.h:519 Enum value 'DEV_FLAG_COUNT' not described in enum 'struct_device_flags' Add the description of DEV_FLAG_COUNT. Fixes: a2225b6e834a ("driver core: Don't let a device probe until it's ready") Reported-by: Randy Dunlap Closes: https://lore.kernel.org/f318cd43-81fd-48b9-abf7-92af85f12f91@infradead.org Signed-off-by: Douglas Anderson Tested-by: Randy Dunlap Reviewed-by: Randy Dunlap Link: https://patch.msgid.link/20260413195910.1.I23aca74fe2d3636a47df196a80920fecb2643220@changeid Signed-off-by: Danilo Krummrich commit ad3ac32a3893a2bbcad545efc005a8e4e7ecf10c Author: Luca Ceresoli Date: Thu Apr 2 18:42:20 2026 +0200 drm/arcpgu: fix device node leak This function gets a device_node reference via of_graph_get_remote_port_parent() and stores it in encoder_node, but never puts that reference. Add it. There used to be a of_node_put(encoder_node) but it has been removed by mistake during a rework in commit 3ea66a794fdc ("drm/arc: Inline arcpgu_drm_hdmi_init"). Fixes: 3ea66a794fdc ("drm/arc: Inline arcpgu_drm_hdmi_init") Cc: stable@vger.kernel.org Reviewed-by: Louis Chauvet Link: https://patch.msgid.link/20260402-drm-arcgpu-fix-device-node-leak-v2-1-d773cf754ae5@bootlin.com Signed-off-by: Luca Ceresoli commit fad217e16fded7f3c09f8637b0f6a224d58b5f2e Author: David Carlier Date: Mon Apr 13 20:06:01 2026 +0100 tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func() invokes the subsystem's ext->regfunc() before attempting to install the new probe via func_add(). If func_add() then fails (for example, when allocate_probes() cannot allocate a new probe array under memory pressure and returns -ENOMEM), the function returns the error without calling the matching ext->unregfunc(), leaving the side effects of regfunc() behind with no installed probe to justify them. For syscall tracepoints this is particularly unpleasant: syscall_regfunc() bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task. After a leaked failure, the refcount is stuck at a non-zero value with no consumer, and every task continues paying the syscall trace entry/exit overhead until reboot. Other subsystems providing regfunc()/unregfunc() pairs exhibit similarly scoped persistent state. Mirror the existing 1 -> 0 cleanup and call ext->unregfunc() in the func_add() error path, gated on the same condition used there so the unwind is symmetric with the registration. Fixes: 8cf868affdc4 ("tracing: Have the reg function allow to fail") Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260413190601.21993-1-devnexen@gmail.com Signed-off-by: David Carlier Signed-off-by: Steven Rostedt (Google) commit 6170922f137231b98fc568571befef63e1edff3f Author: Vincent Donnefort Date: Fri Apr 10 13:45:27 2026 +0100 ring-buffer: Prevent off-by-one array access in ring_buffer_desc_page() As pointed out by Smatch, the ring-buffer descriptor array page_va is counted by nr_page_va, but the accessor ring_buffer_desc_page() allows access off by one. Currently, this does not cause problems, as the page ID always comes from a trusted source. Nonetheless, ensure robustness and fix the accessor. While at it, make the page_id unsigned. Link: https://patch.msgid.link/20260410124527.3563970-1-vdonnefort@google.com Reported-by: Dan Carpenter Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 5ec1d1e97de134beed3a5b08235a60fc1c51af96 Author: Pengpeng Hou Date: Wed Apr 1 19:22:23 2026 +0800 tracing: Rebuild full_name on each hist_field_name() call hist_field_name() uses a static MAX_FILTER_STR_VAL buffer for fully qualified variable-reference names, but it currently appends into that buffer with strcat() without rebuilding it first. As a result, repeated calls append a new "system.event.field" name onto the previous one, which can eventually run past the end of full_name. Build the name with snprintf() on each call and return NULL if the fully qualified name does not fit in MAX_FILTER_STR_VAL. Link: https://patch.msgid.link/20260401112224.85582-1-pengpeng@iscas.ac.cn Fixes: 067fe038e70f ("tracing: Add variable reference handling to hist triggers") Reviewed-by: Tom Zanussi Tested-by: Tom Zanussi Signed-off-by: Pengpeng Hou Signed-off-by: Steven Rostedt (Google) commit ab4b6e4e80a0e573bd77d69439e4cb55e9e3c5ee Merge: 2cd7e6971fc278 8dd1bdde38af84 Author: Paolo Abeni Date: Tue Apr 14 10:39:26 2026 +0200 Merge branch 'net-bpf-fix-null-ptr-deref-in-xdp_master_redirect-for-bonding-and-add-selftest' Jiayuan Chen says: ==================== net,bpf: fix null-ptr-deref in xdp_master_redirect() for bonding and add selftest From: Jiayuan Chen This series has gone through several rounds of discussion and the maintainers hold different views on where the fix should live (in the generic xdp_master_redirect() path vs. inside bonding). I respect all of the suggestions, but I would like to get the crash fixed first, so this version takes the approach of checking whether the master device is up in xdp_master_redirect(), as suggested by Daniel Borkmann. If a different shape is preferred later it can be done as a follow-up, but the null-ptr-deref should not linger. syzkaller reported a kernel panic, full decoded trace here: https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73 Problem Description bond_rr_gen_slave_id() dereferences bond->rr_tx_counter without a NULL check. rr_tx_counter is a per-CPU counter that bonding only allocates in bond_open() when the mode is round-robin. If the bond device was never brought up, rr_tx_counter stays NULL. The XDP redirect path can still reach that code on a bond that was never opened: bpf_master_redirect_enabled_key is a global static key, so as soon as any bond device has native XDP attached, the XDP_TX -> xdp_master_redirect() interception is enabled for every slave system-wide. The path xdp_master_redirect() -> bond_xdp_get_xmit_slave() -> bond_xdp_xmit_roundrobin_slave_get() -> bond_rr_gen_slave_id() then runs against a bond that has no rr_tx_counter and crashes. Solution Patch 1: Fix this in the generic xdp_master_redirect() by skipping master interception when the master device is not running. Returning XDP_TX keeps the original XDP_TX behaviour on the receiving slave, and avoids calling into any master ->ndo_xdp_get_xmit_slave() on a device that has not fully initialized its XDP state. This is not specific to bonding: any current or future master that defers XDP state allocation to ->ndo_open() is protected. Patch 2: Add a selftest that reproduces the above scenario. v6: https://lore.kernel.org/netdev/20260410113726.368111-1-jiayuan.chen@linux.dev/T/#t v5: https://lore.kernel.org/netdev/20260309030659.xxxxx-1-jiayuan.chen@linux.dev/ v4: https://lore.kernel.org/netdev/20260304074301.35482-1-jiayuan.chen@linux.dev/ v3: https://lore.kernel.org/netdev/20260228021918.141002-1-jiayuan.chen@linux.dev/T/#t v2: https://lore.kernel.org/netdev/20260227092254.272603-1-jiayuan.chen@linux.dev/T/#t v1: https://lore.kernel.org/netdev/20260224112545.37888-1-jiayuan.chen@linux.dev/T/#t [1] https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73 ==================== Link: https://patch.msgid.link/20260411005524.201200-1-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 8dd1bdde38af8418889ba322a3663c401a60fe28 Author: Jiayuan Chen Date: Sat Apr 11 08:55:20 2026 +0800 selftests/bpf: add test for xdp_master_redirect with bond not up Add a selftest that reproduces the null-ptr-deref in bond_rr_gen_slave_id() when XDP redirect targets a bond device in round-robin mode that was never brought up. The test verifies the fix by ensuring no crash occurs. Test setup: - bond0: active-backup mode, UP, with native XDP (enables bpf_master_redirect_enabled_key globally) - bond1: round-robin mode, never UP - veth1: slave of bond1, with generic XDP (XDP_TX) - BPF_PROG_TEST_RUN with live frames triggers the redirect path Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260411005524.201200-3-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 1921f91298d1388a0bb9db8f83800c998b649cb3 Author: Jiayuan Chen Date: Sat Apr 11 08:55:19 2026 +0800 net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master syzkaller reported a kernel panic in bond_rr_gen_slave_id() reached via xdp_master_redirect(). Full decoded trace: https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73 bond_rr_gen_slave_id() dereferences bond->rr_tx_counter, a per-CPU counter that bonding only allocates in bond_open() when the mode is round-robin. If the bond device was never brought up, rr_tx_counter stays NULL. The XDP redirect path can still reach that code on a bond that was never opened: bpf_master_redirect_enabled_key is a global static key, so as soon as any bond device has native XDP attached, the XDP_TX -> xdp_master_redirect() interception is enabled for every slave system-wide. The path xdp_master_redirect() -> bond_xdp_get_xmit_slave() -> bond_xdp_xmit_roundrobin_slave_get() -> bond_rr_gen_slave_id() then runs against a bond that has no rr_tx_counter and crashes. Fix this in the generic xdp_master_redirect() by refusing to call into the master's ->ndo_xdp_get_xmit_slave() when the master device is not up. IFF_UP is only set after ->ndo_open() has successfully returned, so this reliably excludes masters whose XDP state has not been fully initialized. Drop the frame with XDP_ABORTED so the exception is visible via trace_xdp_exception() rather than silently falling through. This is not specific to bonding: any current or future master that defers XDP state allocation to ->ndo_open() is protected. Fixes: 879af96ffd72 ("net, core: Add support for XDP redirection to slave device") Reported-by: syzbot+80e046b8da2820b6ba73@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/698f84c6.a70a0220.2c38d7.00cc.GAE@google.com/T/ Suggested-by: Daniel Borkmann Acked-by: Daniel Borkmann Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260411005524.201200-2-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 1111e9bd83f8562391f9052af37ddbdfee5b76db Author: Cao Ruichuang Date: Tue Apr 7 00:53:33 2026 +0800 ring-buffer: Report header_page overwrite as char The header_page tracefs metadata currently reports overwrite as an int field with size 1. That makes parsers warn about a type and size mismatch even though the field is only used as a one-byte flag within commit. Keep the shared offset with commit as-is, but report overwrite as char so the declared type matches the hardcoded size. The signedness is already carried separately by the emitted signed field. Link: https://patch.msgid.link/20260406165333.46052-1-create0818@163.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=216999 Signed-off-by: Cao Ruichuang Signed-off-by: Steven Rostedt (Google) commit 46c862f5419e0a86b60b9f9558d247f6084c99f9 Author: Kailang Yang Date: Tue Apr 14 15:44:04 2026 +0800 ALSA: hda/realtek - fixed speaker no sound update Fixed speaker has pop noise on Lenovo Thinkpad X11 Carbon Gen 12. Fixes: 630fbc6e870e ("ALSA: hda/realtek - fixed speaker no sound") Reported-and-tested-by: Jeremy Bethmont Closes: https://lore.kernel.org/CAC88DfsHrhyhy0Pn1O-z9egBvMYu=6NYgcvcC6KCgwh_-Ldkxg@mail.gmail.com Signed-off-by: Kailang Yang Signed-off-by: Takashi Iwai commit 841dbf4871c57ce2da18c4ea7ffac5487d0eda16 Author: WANG Rui Date: Tue Apr 14 08:51:52 2026 +0800 perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND Building perf for LoongArch fails when CONFIG_LIBDW_DWARF_UNWIND is enabled because unwind-libdw.o is still referenced in arch/loongarch/util/Build. Fixes: e62fae9d9e8 ("perf unwind-libdw: Fix a cross-arch unwinding bug") Signed-off-by: WANG Rui Acked-by: Huacai Chen Signed-off-by: Namhyung Kim commit cad3bf1c330274d11f25f1b7afae9b9dba13fbd3 Author: Christian Brauner Date: Tue Mar 31 10:58:58 2026 +0200 selftests/namespaces: remove unused utils.h include from listns_efault_test Remove the inclusion of ../filesystems/utils.h from listns_efault_test.c. The test doesn't use any symbols from that header. Including it alongside ../pidfd/pidfd.h causes a build failure because both headers define wait_for_pid() with conflicting linkage: ../filesystems/utils.h: extern int wait_for_pid(pid_t pid); ../pidfd/pidfd.h: static inline int wait_for_pid(pid_t pid) All symbols the test actually uses (create_child, read_nointr, write_nointr, sys_pidfd_send_signal) come from pidfd.h. Reported-by: Mark Brown Link: https://lore.kernel.org/all/acPV19IY3Gna6Ira@sirena.org.uk Fixes: 07d7ad46dad4 ("selftests/namespaces: test for efault") Signed-off-by: Christian Brauner commit 660c09404cdabfe969d58375e990d2955af59797 Author: Christian Brauner Date: Mon Mar 23 17:41:08 2026 +0100 selftests/fsmount_ns: add missing TARGETS and fix cap test Add missing top-level kselftest TARGETS entries for empty_mntns and fsmount_ns so that 'make kselftest' discovers and runs these tests. Fix requires_cap_sys_admin test which always SKIPped because fsopen() was called after enter_userns(), where CAP_SYS_ADMIN in the mount namespace's user_ns is unavailable. Move fsopen/fsconfig before fork so the configured fs_fd is inherited by the child, which then only needs to call fsmount() after dropping privileges. Fixes: 3ac7ea91f3d0 ("selftests: add FSMOUNT_NAMESPACE tests") Signed-off-by: Christian Brauner commit d38aa6cdee8e09d77ce3a6c5b04800fb3b146d69 Author: Christian Brauner Date: Mon Mar 23 17:41:00 2026 +0100 selftests/empty_mntns: fix wrong CLONE_EMPTY_MNTNS hex value in comment CLONE_EMPTY_MNTNS is (1ULL << 37) = 0x2000000000ULL, not 0x400000000ULL. Fixes: 5b8ffd63fbd9 ("selftests/filesystems: add clone3 tests for empty mount namespaces") Signed-off-by: Christian Brauner commit 1a398a23787506360b4c766270de00abf51b27c8 Author: Christian Brauner Date: Mon Mar 23 17:00:09 2026 +0100 selftests/empty_mntns: fix statmount_alloc() signature mismatch empty_mntns.h includes ../statmount/statmount.h which provides a 4-argument statmount_alloc(mnt_id, mnt_ns_id, mask, flags), but then redefines its own 3-argument version without the flags parameter. This causes a build failure due to conflicting types. Remove the duplicate definition from empty_mntns.h and update all callers to pass 0 for the flags argument. Fixes: 32f54f2bbccf ("selftests/filesystems: add tests for empty mount namespaces") Signed-off-by: Christian Brauner commit a27e4642629381ed36d7e22d5b6fff5792ec31f6 Author: Christian Brauner Date: Mon Mar 23 16:31:30 2026 +0100 selftests/statmount: remove duplicate wait_for_pid() Remove the local static wait_for_pid() definition from statmount_test_ns.c as it conflicts with the extern declaration in utils.h. The identical function is already provided by utils.c. Fixes: 3ac7ea91f3d0 ("selftests: add FSMOUNT_NAMESPACE tests") Cc: # mainline only Signed-off-by: Christian Brauner commit ad4999496e73923adb524b24c2f448c9498476b5 Author: Christian Brauner Date: Mon Mar 23 15:05:07 2026 +0100 mount: always duplicate mount In the OPEN_TREE_NAMESPACE path vfs_open_tree() resolves a path via filename_lookup() without holding namespace_lock. Between the lookup and create_new_namespace() acquiring namespace_lock via LOCK_MOUNT_EXACT_COPY() another thread can unmount the mount, setting mnt->mnt_ns to NULL. When create_new_namespace() then checks !mnt->mnt_ns it incorrectly takes the swap-and-mntget path that was designed for fsmount()'s detached mounts. This reuses a mount whose mnt_mp_list is in an inconsistent state from the concurrent unmount, causing a general protection fault in __umount_mnt() -> hlist_del_init(&mnt->mnt_mp_list) during namespace teardown. Remove the !mnt->mnt_ns special case entirely. Instead, always duplicate the mount: - For OPEN_TREE_NAMESPACE use __do_loopback() which will properly clone the mount or reject it via may_copy_tree() if it was unmounted in the race window. - For fsmount() use clone_mnt() directly (via the new MOUNT_COPY_NEW flag) since the mount is freshly created by vfs_create_mount() and not in any namespace so __do_loopback()'s IS_MNT_UNBINDABLE, may_copy_tree, and __has_locked_children checks don't apply. Reported-by: syzbot+e4470cc28308f2081ec8@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit a7b56be59b47f4195ddc79ecab238c4401a60bbb Author: Faye Nichols Date: Mon Apr 13 15:20:25 2026 -0600 ALSA: hda/realtek: Add quirk for Acer PT316-51S headset mic The Acer PT316-51S (PCI SSID 1025:160e) with ALC287 codec does not detect the headset microphone due to missing BIOS pin configuration for pin 0x19. Apply ALC2XX_FIXUP_HEADSET_MIC to enable it. Signed-off-by: Faye Nichols Link: https://patch.msgid.link/20260413212645.117119-1-faye.opensource@gmail.com Signed-off-by: Takashi Iwai commit a97c88a176b6b8d116f4d3f508f3bd02bc77b462 Author: Ville Syrjälä Date: Tue Mar 24 15:48:38 2026 +0200 drm/i915/wm: Verify the correct plane DDB entry Actually verify the DDB entry for the plane we're looking at instead of always verifying the cursor DDB. Fixes: 7d4561722c3b ("drm/i915: Tweak plane ddb allocation tracking") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260324134843.2364-5-ville.syrjala@linux.intel.com Reviewed-by: Vinod Govindapillai (cherry picked from commit f002f7c7439de18117a31ca84dc87a59719c3dd6) Signed-off-by: Tvrtko Ursulin commit ed8be780bdbc9f7727553b9fa6951f5c38b0a15b Author: Suraj Kandpal Date: Tue Apr 7 08:37:11 2026 +0530 drm/i915/backlight: Fix VESA backlight possible check condition VESA backlight enable is possible when BACKLIGHT_AUX_ENABLE_CAPABLE is true via AUX command or when BACKLIGHT_PIN_ENABLE_CAPABLE is true via eDP connector pin. Similarly, backlight brightness adjustment can be done via AUX-based control or PWM pin-based control. It means there can be three configurations: 1) Full AUX-based: Enable and adjustment both via AUX. We currently support this (apart from the AUX luminance-based backlight control). 2) Hybrid: Enable via the BL_ENABLE pin, adjustment via either AUX or PWM. 3) Fully PWM pin-based: Enable via the BL_ENABLE pin, adjustment via PWM. Since that only 1 is supported as of now we need to make sure we do not try to manipulate backlight when BACKLIGHT_AUX_ENABLE_CAPABLE is not set. Also fix return value when condition is not fulfilled. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/15907 Fixes: 0fb03890d182 ("drm/i915/backlight: Check if VESA backlight is possible") Signed-off-by: Suraj Kandpal Tested-by: Ville Syrjälä Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260407030710.1440046-1-suraj.kandpal@intel.com (cherry picked from commit 102d44b3a8fad96e94e9ccd0579986c14a1f2f75) Signed-off-by: Tvrtko Ursulin commit a355eefc36c4481188249b067832b40a2c45fa5c Author: Rong Bao Date: Mon Apr 13 18:03:55 2026 +0800 perf annotate: Use jump__delete when freeing LoongArch jumps Currently, the initialization of loongarch_jump_ops does not contain an assignment to its .free field. This causes disasm_line__free() to fall through to ins_ops__delete() for LoongArch jump instructions. ins_ops__delete() will free ins_operands.source.raw and ins_operands.source.name, and these fields overlaps with ins_operands.jump.raw_comment and ins_operands.jump.raw_func_start. Since in loongarch_jump__parse(), these two fields are populated by strchr()-ing the same buffer, trying to free them will lead to undefined behavior. This invalid free usually leads to crashes: Process 1712902 (perf) of user 1000 dumped core. Stack trace of thread 1712902: #0 0x00007fffef155c58 n/a (libc.so.6 + 0x95c58) #1 0x00007fffef0f7a94 raise (libc.so.6 + 0x37a94) #2 0x00007fffef0dd6a8 abort (libc.so.6 + 0x1d6a8) #3 0x00007fffef145490 n/a (libc.so.6 + 0x85490) #4 0x00007fffef1646f4 n/a (libc.so.6 + 0xa46f4) #5 0x00007fffef164718 n/a (libc.so.6 + 0xa4718) #6 0x00005555583a6764 __zfree (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x106764) #7 0x000055555854fb70 disasm_line__free (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x2afb70) #8 0x000055555853d618 annotated_source__purge (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x29d618) #9 0x000055555852300c __hist_entry__tui_annotate (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x28300c) #10 0x0000555558526718 do_annotate (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x286718) #11 0x000055555852ed94 evsel__hists_browse (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x28ed94) #12 0x000055555831fdd0 cmd_report (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x7fdd0) #13 0x000055555839b644 handle_internal_command (/home/csmantle/dist/linux-arch/tools/perf/perf + 0xfb644) #14 0x00005555582fe6ac main (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x5e6ac) #15 0x00007fffef0ddd90 n/a (libc.so.6 + 0x1dd90) #16 0x00007fffef0ddf0c __libc_start_main (libc.so.6 + 0x1df0c) #17 0x00005555582fed10 _start (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x5ed10) ELF object binary architecture: LoongArch ... and it can be confirmed with Valgrind: ==1721834== Invalid free() / delete / delete[] / realloc() ==1721834== at 0x4EA9014: free (in /usr/lib/valgrind/vgpreload_memcheck-loongarch64-linux.so) ==1721834== by 0x4106287: __zfree (zalloc.c:13) ==1721834== by 0x42ADC8F: disasm_line__free (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== by 0x429B737: annotated_source__purge (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== by 0x42811EB: __hist_entry__tui_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== by 0x42848D7: do_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== by 0x428CF33: evsel__hists_browse (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== Address 0x7d34303 is 35 bytes inside a block of size 62 alloc'd ==1721834== at 0x4EA59B8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-loongarch64-linux.so) ==1721834== by 0x6B80B6F: strdup (strdup.c:42) ==1721834== by 0x42AD917: disasm_line__new (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== by 0x42AE5A3: symbol__disassemble_objdump (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== by 0x42AF0A7: symbol__disassemble (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== by 0x429B3CF: symbol__annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== by 0x429C233: symbol__annotate2 (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== by 0x42804D3: __hist_entry__tui_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== by 0x42848D7: do_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf) ==1721834== by 0x428CF33: evsel__hists_browse (in /home/csmantle/dist/linux-arch/tools/perf/perf) This patch adds the missing free() specialization in loongarch_jump_ops, which prevents disasm_line__free() from invoking the default cleanup function. Fixes: fb7fd2a14a503b9a ("perf annotate: Move raw_comment and raw_func_start fields out of 'struct ins_operands'") Cc: stable@vger.kernel.org Cc: WANG Rui Cc: Huacai Chen Cc: WANG Xuerui Cc: loongarch@lists.linux.dev Signed-off-by: Rong Bao Tested-by: WANG Rui Signed-off-by: Namhyung Kim commit 86d1095fdb7017a93e9d7be875775f7e5aa5c2f5 Author: Ian Rogers Date: Wed Apr 8 17:02:16 2026 -0700 perf test: Fixes for check branch stack sampling When filtering branch stack samples on user events they sample in user land but may have come from the kernel. Aarch64 avoids leaking the kernel address for kaslr reasons but other platforms, for now, don't. Be more permissive in allowing kernel addresses in the source of user branch stacks. When filtering branch stack samples on kernel events they sample in kernel land but may have come from user land. Avoid the target being a user address but allow the source to be in user land. Aarch64 may not leak the user land addresses (making them 0) but other platforms do. As the kernel address sampling implies privelege, just allow this. Increase the duration of the system call sampling test to make the likelihood of sampling a system call higher (increased from 1000 to 8000 loops - a number found through experimentation on an Intel Tigerlake laptop), also make the period of the event a prime number. Put unneeded perf record output into a temporary file so that the test output isn't cluttered. More clearly state which test is running and the pass, fail or skipped result of the test. These changes make the test on an Intel tigerlake laptop reliably pass rather than reliably fail. Signed-off-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit c7fe4e5665b7c31a24d362229182f6ee27e07233 Author: Ian Rogers Date: Sat Apr 11 12:37:05 2026 -0700 perf test: Fix inet_pton probe failure and unroll call graph When adding a probe for libc's inet_pton, perf probe may create multiple probe points (e.g., due to inlining or multiple symbol resolutions), resulting in multiple identical event names being output (e.g., `probe_libc:inet_pton_1`). The script previously used a brittle pipeline (`tail -n +2 | head -n -5`) and an awk script to extract the event name. When multiple probes were added, awk would output the event name multiple times, which expanded to multiple words in bash. This broke the subsequent `perf record` and `perf probe -d` commands, causing the test to fail with: `Error: another command except --add is set.` Fix this by removing the brittle `tail/head` commands and appending `| head -n 1` to the awk extraction. This ensures that only a single, unique event name is captured, regardless of how many probe points are created. Additionally, the test artificially limited the backtrace size via `max-stack=4` and did not specify dwarf call graphs for non-s390x architectures. In newer libc versions where `inet_pton` is nested deeper or compiled without frame pointers, `perf script` failed to resolve the backtrace up to `/bin/ping`. Fix this by explicitly collecting dwarf call-graphs for all architectures and increasing `max-stack` to 8. Assisted-by: Gemini:gemini-3.1-pro-preview Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit 97ab89686a9e5d087042dbe73604a32b3de72653 Author: Markus Mayer Date: Thu Apr 9 15:14:17 2026 -0700 perf build: fix "argument list too long" in second location Turns out that displaying "RM $^" via quiet_cmd_rm can also upset the shell and cause it to display "argument list too long". Trying to quote $^ doesn't help. In the end, *not* displaying the (potentially long) list of files is probably the right thing to do for a "quiet" message, anyway. Instead, let's display a count of how many files were removed. There is always V=1 if more detail is required. TEST linux/tools/perf/pmu-events/metric_test.log RM ...634 orphan file(s)... LD linux/tools/perf/util/perf-util-in.o Also move the comment regarding xargs before the rule, so it doesn't show up in the build output. Signed-off-by: Markus Mayer Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit dff56bdafae8e65d9acb88cc98e1f5129c352201 Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:09:05 2026 -0300 perf header: Add sanity checks to HEADER_BPF_BTF processing Validate the BTF entry count and individual data sizes when reading HEADER_BPF_BTF from perf.data files to prevent excessive memory allocation from malformed files. Reuses the MAX_BPF_PROGS (131072) and MAX_BPF_DATA_LEN (256 MB) limits from HEADER_BPF_PROG_INFO processing. Cc: Song Liu Cc: Jiri Olsa Cc: Namhyung Kim Cc: Ian Rogers Cc: Adrian Hunter Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 66af7e9b05c4e7ff435c0aef0d253a65d290f03c Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:09:04 2026 -0300 perf header: Sanity check HEADER_BPF_PROG_INFO Add validation to process_bpf_prog_info() to harden against malformed perf.data files: - Upper bound on BPF program count (max 131072) - Upper bound on per-program data_len (max 256MB) Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit f5722a6b6a443fd56ce0a71b4be4c75d7a857dbe Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:09:03 2026 -0300 perf header: Sanity check HEADER_PMU_CAPS Add upper bound checks in PMU capabilities processing to harden against malformed perf.data files: - nr_pmu bounded to MAX_PMU_MAPPINGS (4096) in process_pmu_caps() - nr_pmu_caps bounded to MAX_PMU_CAPS (512) in __process_pmu_caps() Cc: Ravi Bangoria Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 47c68eb15ae90fa3953db9a67b4569089ff63cd0 Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:09:02 2026 -0300 perf header: Sanity check HEADER_HYBRID_TOPOLOGY Add upper bound check on nr_nodes in process_hybrid_topology() to harden against malformed perf.data files (reuses MAX_PMU_MAPPINGS, 4096). Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 110a661708a6a90997442f02f261e2043624a1c8 Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:09:01 2026 -0300 perf header: Sanity check HEADER_CACHE Add upper bound check on cache entry count in process_cache() to harden against malformed perf.data files (max 32768). Cc: Jiri Olsa Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 6830e20c92e7388ae4834a3574a0d3d90500c4c1 Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:09:00 2026 -0300 perf header: Sanity check HEADER_GROUP_DESC Add upper bound check on nr_groups in process_group_desc() to harden against malformed perf.data files (max 32768), and move the env assignment after validation. Cc: Namhyung Kim Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit f613a6d694aa499edb2a291ab2c2d906619585f2 Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:08:59 2026 -0300 perf header: Sanity check HEADER_PMU_MAPPINGS Add upper bound check on pmu_num in process_pmu_mappings() to harden against malformed perf.data files (max 4096). Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit a881fc56038a7baa5cb5074cdd52315d9ad9ee63 Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:08:58 2026 -0300 perf header: Sanity check HEADER_MEM_TOPOLOGY Add validation to process_mem_topology() to harden against malformed perf.data files: - Upper bound check on nr_nodes (reuses MAX_NUMA_NODES, 4096) - Minimum section size check before allocating This is particularly important here since nr is u64, making unbounded values especially dangerous. Cc: Jiri Olsa Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 4ba223016b0be7ec11aad63f480cd251cecad594 Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:08:57 2026 -0300 perf header: Sanity check HEADER_NUMA_TOPOLOGY Add validation to process_numa_topology() to harden against malformed perf.data files: - Upper bound check on nr_nodes (max 4096) - Minimum section size check before allocating Cc: Jiri Olsa Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 22a2e2b29217455cf337c765fc26ad2f55d7291a Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:08:56 2026 -0300 perf header: Sanity check HEADER_CPU_TOPOLOGY Add validation to process_cpu_topology() to harden against malformed perf.data files: - Verify nr_cpus_avail was initialized (HEADER_NRCPUS processed first) - Bounds check sibling counts (cores, threads, dies) against nr_cpus_avail - Fix two bare 'return -1' that leaked env->cpu by using 'goto free_cpu' Cc: Jiri Olsa Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 376ce5a9f706a75815c8281861b66060438798d1 Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:08:55 2026 -0300 perf header: Sanity check HEADER_NRCPUS and HEADER_CPU_DOMAIN_INFO While working on some cleanups sashiko questioned about pre-existing issues, namely lacking sanity checks for perf.data headers, add some with the help of Claude. Cc: Ian Rogers Cc: Swapnil Sapkal Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 06452a412e5e89c62cd4917a457c5cfd43dc1ead Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:08:54 2026 -0300 perf header: Bump up the max number of command line args allowed We need to do some upper limit validation, bump up the arbitrary limit as per suggestion of Sashiko about command line wildcard expansion ending up with more than 32768 args. Link: https://sashiko.dev/#/patchset/20260408172846.96360-1-acme%40kernel.org Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit f823d7efb81cd2a799dc386da4f9292fdc2c1dbe Author: Arnaldo Carvalho de Melo Date: Fri Apr 10 19:08:53 2026 -0300 perf header: Validate nr_domains when reading HEADER_CPU_DOMAIN_INFO Further validate the HEADER_CPU_DOMAIN_INFO fields, this time checking the nr_domains field. Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 404cd6bffe17e25e0f94ed2775ffdd6cd10ac3fd Author: Naman Jain Date: Mon Apr 6 09:24:59 2026 +0000 mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER When registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, the kernel computes pgmap->vmemmap_shift as the number of trailing zeros in the OR of start_pfn and last_pfn, intending to use the largest compound page order both endpoints are aligned to. However, this value is not clamped to MAX_FOLIO_ORDER, so a sufficiently aligned range (e.g. physical range [0x800000000000, 0x800080000000), corresponding to start_pfn=0x800000000 with 35 trailing zeros) can produce a shift larger than what memremap_pages() accepts, triggering a WARN and returning -EINVAL: WARNING: ... memremap_pages+0x512/0x650 requested folio size unsupported The MAX_FOLIO_ORDER check was added by commit 646b67d57589 ("mm/memremap: reject unreasonable folio/compound page sizes in memremap_pages()"). Fix this by clamping vmemmap_shift to MAX_FOLIO_ORDER so we always request the largest order the kernel supports, in those cases, rather than an out-of-range value. Also fix the error path to propagate the actual error code from devm_memremap_pages() instead of hard-coding -EFAULT, which was masking the real -EINVAL return. Fixes: 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver") Cc: stable@vger.kernel.org Signed-off-by: Naman Jain Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit ca5ee0e918115fb5cf626d75461d9fca06e06caf Author: Aditya Garg Date: Thu Apr 9 03:32:18 2026 -0700 tools: hv: Fix cross-compilation Use the native ARCH only in case it is not set, this will allow the cross-compilation where ARCH is explicitly set. Additionally, simplify the ARCH check to build the fcopy daemon only for x86 and x86_64. Fixes: 82b0945ce2c2 ("tools: hv: Add new fcopy application based on uio driver") Reported-by: Adrian Vladu Closes: https://lore.kernel.org/linux-hyperv/PR3PR09MB54119DB2FD76977C62D8DD6AB04D2@PR3PR09MB5411.eurprd09.prod.outlook.com/ Co-developed-by: Saurabh Sengar Signed-off-by: Saurabh Sengar Signed-off-by: Aditya Garg Reviewed-by: Roman Kisel Signed-off-by: Wei Liu commit 0d5acba6331c326f394a677daf49a67f44a0416a Author: Dexuan Cui Date: Thu Apr 9 14:52:32 2026 -0700 Drivers: hv: vmbus: Export hv_vmbus_exists() and use it in pci-hyperv With commit f84b21da3624 ("PCI: hv: Don't load the driver for baremetal root partition"), the bare metal Linux root partition won't use the pci-hyperv driver, but when a Linux VM runs on the Linux root partition, pci-hyperv's module_init function init_hv_pci_drv() can still run, e.g. in the case of CONFIG_PCI_HYPERV=y, even if the VMBus driver is not used in such a VM (i.e. the hv_vmbus driver's init function returns -ENODEV due to vmbus_root_device being NULL). In such a Linux VM, init_hv_pci_drv() runs with a side effect: the 3 hvpci_block_ops callbacks are set to functions that depend on hv_vmbus. Later, when the MLX driver in such a VM invokes the callbacks, e.g. in drivers/net/ethernet/mellanox/mlx5/core/lib/hv.c: mlx5_hv_register_invalidate(), hvpci_block_ops.reg_blk_invalidate() is hv_register_block_invalidate() rather than a NULL function pointer, and hv_register_block_invalidate() assumes that it can find a struct hv_pcibus_device from pdev->bus->sysdata, which is false in such a VM. Consequently, hv_register_block_invalidate() -> get_pcichild_wslot() -> spin_lock_irqsave() may hang since it can be accessing an invalid spinlock pointer. Fix the issue by exporting hv_vmbus_exists() and using it in pci-hyperv: hv_root_partition() is true and hv_nested is false ==> hv_vmbus_exists() is false. hv_root_partition() is true and hv_nested is true ==> hv_vmbus_exists() is true. hv_root_partition() is false ==> hv_vmbus_exists() is true. While at it, rename vmbus_exists() to hv_vmbus_exists() to follow the convention that all public functions have the hv_ prefix; also change the return value's type from int to bool to make the code more readable; also move the two pr_info() calls. Reported-by: Mukesh Rathor Signed-off-by: Dexuan Cui Signed-off-by: Wei Liu commit 80acc80ea25dad5f8f71bafcadca6258efec6236 Author: Stanislav Kinsburskii Date: Sun Mar 1 17:39:10 2026 +0000 mshv: Introduce tracing support Introduces various trace events and use them in the corresponding places in the driver. Signed-off-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit 1c80dd81cac1865bbd6049bb93068a41ffb19845 Author: Michael Kelley Date: Fri Feb 20 08:40:45 2026 -0800 Drivers: hv: vmbus: Limit channel interrupt scan to relid high water mark When checking for VMBus channel interrupts, current code always scans the full SynIC receive interrupt bit array to get the relid of the interrupting channels. The array has HV_EVENT_FLAGS_COUNT (2048) bits. But VMs rarely have more than 100 channels, and the relid is typically a small integer that is densely assigned by the Hyper-V host. It's wasteful to scan 2048 bits when it is highly unlikely that anything will be found past bit 100. The waste is double with Confidential VMBus because there are two receive interrupt arrays that must be scanned: one for the hypervisor SynIC and one for the paravisor SynIC. Improve the scanning by tracking the largest relid that has been offered by the Hyper-V host. Then when checking for VMBus channel interrupts, only scan up to this high water mark. When channels are rescinded, it's not worth the complexity to recalculate the high water mark. Hyper-V tends to reuse the rescinded relids for any new channels that are subsequently added, and the performance benefit of exactly tracking the high water mark would be minimal. Signed-off-by: Michael Kelley Tested-by: Roman Kisel Reviewed-by: Roman Kisel Signed-off-by: Wei Liu commit d60bc140158342716e13ff0f8aa65642f43ba053 Merge: 1334d2a3b3235d b4464d8f313f90 Author: Linus Torvalds Date: Mon Apr 13 20:28:22 2026 -0700 Merge tag 'pwrseq-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull power sequencing updates from Bartosz Golaszewski: "For this release we have an extension of the pwrseq-pcie-m2 driver with support for PCIe M.2 Key E connectors. The rest of the commits fulfill a supporting role: document the hardware in DT bindings, provide required serdev helpers (this has been provided in an immutable branch to Rob Herring so you may see it in his PR as well) and is followed up by some Kconfig fixes from Arnd. Summary: - add support for the PCIe M.2 Key E connectors in pwrseq-pcie-m2 - describe PCIe M.2 Mechanical Key E connectors in DT bindings - add serdev helpers for looking up devices by OF nodes - minor serdev core rework to enable support for PCIe M.2 Key E connectors" * tag 'pwrseq-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: power: sequencing: pcie-m2: add SERIAL_DEV_BUS dependency power: sequencing: pcie-m2: enforce PCI and OF dependencies power: sequencing: pcie-m2: Create serdev device for WCN7850 bluetooth power: sequencing: pcie-m2: Add support for PCIe M.2 Key E connectors dt-bindings: connector: Add PCIe M.2 Mechanical Key E connector dt-bindings: serial: Document the graph port serdev: Do not return -ENODEV from of_serdev_register_devices() if external connector is used serdev: Add an API to find the serdev controller associated with the devicetree node serdev: Convert to_serdev_*() helpers to macros and use container_of_const() commit 1334d2a3b3235d062e5e1f51aebe7a64ed57cf72 Merge: fbfb6bd927c9ac ca13ab654064fe Author: Linus Torvalds Date: Mon Apr 13 20:10:58 2026 -0700 Merge tag 'gpio-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "For this merge window we have two new drivers: support for GPIO-signalled ACPI events on Intel platforms and a generic GPIO-over-pinctrl driver using the ARM SCMI protocol for controlling pins. Several things have been reworked in GPIO core: we unduplicated GPIO hog handling, reduced the number of SRCU locks and dereferences, improved support for software-node-based lookup and removed more legacy code after converting remaining users to modern alternatives. There's also a number of driver reworks and refactoring, documentation updates, some bug-fixes and new tests. GPIO core: - defer probe on software node lookups when the remote software node exists but has not been registered as a firmware node yet - unify GPIO hog handling by moving code duplicated in OF and ACPI modules into GPIO core and allow setting up hogs with software nodes - allow matching GPIO controllers by secondary firmware node if matching by primary does not succeed - demote deferral warnings to debug level as they are quite normal when using software nodes which don't support fw_devlink yet - disable the legacy GPIO character device uAPI v1 supprt in Kconfig by default - rework several core functions in preparation for the upcoming Revocable helper library for protecting resources against sudden removal, this reduces the number of SRCU dereferences in GPIO core - simplify file descriptor logic in GPIO character device code by using FD_PREPARE() - introduce a header defining symbols used by both GPIO consumers and providers to avoid having to include provider-specific headers from drivers which only consume GPIOs - replace snprintf() with strscpy() where formatting is not required New drivers: - add the gpio-by-pinctrl generic driver using the ARM SCMI protocol to control GPIOs (along with SCMI changes pulled from the pinctrl tree) - add a driver providing support for handling of platform events via GPIO-signalled ACPI events (used on Intel Nova Lake and later platforms) Driver changes: - extend the gpio-kempld driver with support for more recent models, interrupts and setting/getting multiple values at once - improve interrupt handling in gpio-brcmstb - add support for multi-SoC systems in gpio-tegra186 - make sure we return correct values from the .get() callbacks in several GPIO drivers by normalizing any values other than 0, 1 or negative error numbers - use flexible arrays in several drivers to reduce the number of required memory allocations - simplify synchronous waiting for virtual drivers to probe and remove the dedicated, a bit overengineered helper library dev-sync-probe - remove unneeded Kconfig dependencies on OF_GPIO in several drivers and subsystems - convert the two remaining users of of_get_named_gpio() to using GPIO descriptors and remove the (no longer used) function along with the header that declares it - add missing includes in gpio-mmio - shrink and simplify code in gpio-max732x by using guard(mutex) - remove duplicated code handling the 'ngpios' property from gpio-ts4800, it's already handled in GPIO core - use correct variable type in gpio-aspeed - add support for a new model in gpio-realtek-otto - allow to specify the active-low setting of simulated hogs over the configfs interface (in addition to existing devicetree support) in gpio-sim Bug fixes: - clear the OF_POPULATED flag on hog nodes in GPIO chip remove path on OF systems - fix resource leaks in error path in gpiochip_add_data_with_key() - drop redundant device reference in gpio-mpsse Tests: - add selftests for use-after-free cases in GPIO character device code DT bindings: - add a DT binding document for SCMI based, gpio-over-pinctrl devices - fix interrupt description in microchip,mpfs-gpio - add new compatible for gpio-realtek-otto - describe the resets of the mpfs-gpio controller - fix maintainer's email in gpio-delay bindings - remove the binding document for cavium,thunder-8890 as the corresponding device is bound over PCI and not firmware nodes Documentation: - update the recommended way of converting legacy boards to using software nodes for GPIO description - describe GPIO line value semantics - misc updates to kerneldocs Misc: - convert OMAP1 ams-delta board to using GPIO hogs described with software nodes" * tag 'gpio-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (79 commits) gpio: swnode: defer probe on references to unregistered software nodes dt-bindings: gpio: cavium,thunder-8890: Remove DT binding Documentation: gpio: update the preferred method for using software node lookup gpio: gpio-by-pinctrl: s/used to do/is used to do/ gpio: aspeed: fix unsigned long int declaration gpio: rockchip: convert to dynamic GPIO base allocation gpio: remove dev-sync-probe gpio: virtuser: stop using dev-sync-probe gpio: aggregator: stop using dev-sync-probe gpio: sim: stop using dev-sync-probe gpio: Add Intel Nova Lake ACPI GPIO events driver gpiolib: Make deferral warnings debug messages gpiolib: fix hogs with multiple lines gpio: fix up CONFIG_OF dependencies gpio: gpio-by-pinctrl: add pinctrl based generic GPIO driver gpio: dt-bindings: Add GPIO on top of generic pin control firmware: arm_scmi: Allow PINCTRL_REQUEST to return EOPNOTSUPP pinctrl: scmi: ignore PIN_CONFIG_PERSIST_STATE pinctrl: scmi: Delete PIN_CONFIG_OUTPUT_IMPEDANCE_OHMS support pinctrl: scmi: Add SCMI_PIN_INPUT_VALUE ... commit fbfb6bd927c9ac6ea155471cc7ced8e16b37c2cb Merge: d7c8087a9cd897 cd1a3b2ff0553e Author: Linus Torvalds Date: Mon Apr 13 20:01:50 2026 -0700 Merge tag 'thermal-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These include thermal core fixes and simplifications, driver fixes and new hardware support (SDM670, Eliza SoC), new driver features (hwmon support in imx91, DDR data rate on Nova Lake in int340x), and a handful of cleanups: - Fix thermal core issues related to thermal zone removal and registration errors that may lead to a use-after-free or a memory leak in some cases (Rafael Wysocki) - Drop a redundant check from thermal_zone_device_update(), adjust thermal workqueue allocation flags, and switch over thermal_class allocation to static (Rafael Wysocki) - Relocate the suspend and resume of thermal zones closer to the suspend and resume of devices, respectively (Rafael Wysocki) - Remove a pointless variable used in the thermal core when registering a cooling device (Daniel Lezcano) - Replace sprintf() in thermal_bind_cdev_to_trip() and use str_enabled_disabled() helper in mode_show() (Thorsten Blum) - Replace cpumask_weight() in intel_hfi_offline() with cpumask_empty() which is generally more efficient (Yury Norov) - Add support for reading DDR data rate from PCI config space on Nova Lake platforms to the int340x thermal driver (Srinivas Pandruvada) - Add an OF node address to output message to make sensor names more distinguishable (Alexander Stein) - Add hwmon support for the i.MX97 thermal sensor (Alexander Stein) - Clamp correctly the results when doing value/temperature conversion in the Spreadtrum driver (Thorsten Blum) - Add SDM670 compatible DT bindings for the Tsens and the lMH thermal drivers (Richard Acayan) - Add SM8750 compatible DT bindings for the Tsens thermal driver (Manaf Meethalavalappu Pallikunhi) - Add Eliza SoC compatible DT bindings for the Tsens driver (Krzysztof Kozlowski) - Fix inverted condition check on error in the Spear thermal control driver (Gopi Krishna Menon) - Convert DT bindings documentation into DT schema (Gopi Krishna Menon) - Use max() macro to increase readability in the Broadcom STB thermal sensor (Thorsten Blum) - Remove a stale @trim_offset kernel-doc entry (John Madieu)" * tag 'thermal-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (25 commits) thermal: renesas: rzg3e: Remove stale @trim_offset kernel-doc entry thermal: core: Suspend thermal zones later and resume them earlier thermal: core: Allocate thermal_class statically thermal: core: Adjust thermal_wq allocation flags thermal: core: Drop redundant check from thermal_zone_device_update() thermal: core: Free thermal zone ID later during removal thermal: core: Fix thermal zone governor cleanup issues thermal/core: Remove pointless variable when registering a cooling device thermal/drivers/brcmstb_thermal: Use max to simplify brcmstb_get_temp dt-bindings: thermal: st,thermal-spear1340: convert to dtschema thermal/drivers/spear: Fix error condition for reading st,thermal-flags dt-bindings: thermal: qcom-tsens: Add Eliza SoC TSENS thermal: devfreq_cooling: avoid unnecessary kfree of freq_table thermal: intel: hfi: use cpumask_empty() in intel_hfi_offline() thermal: sysfs: Use str_enabled_disabled() helper in mode_show() dt-bindings: thermal: qcom-tsens: Document the SM8750 Temperature Sensor thermal/drivers/sprd: Use min instead of clamp in sprd_thm_temp_to_rawdata dt-bindings: thermal: lmh: Add SDM670 compatible dt-bindings: thermal: tsens: add SDM670 compatible thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp ... commit d7c8087a9cd8979d70edfe7c7feda9423feae3ab Merge: 2e31b16101834b d923f70e37310f Author: Linus Torvalds Date: Mon Apr 13 19:47:52 2026 -0700 Merge tag 'pm-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "Once again, cpufreq is the most active development area, mostly because of the new feature additions and documentation updates in the amd-pstate driver, but there are also changes in the cpufreq core related to boost support and other assorted updates elsewhere. Next up are power capping changes due to the major cleanup of the Intel RAPL driver. On the cpuidle front, a new C-states table for Intel Panther Lake is added to the intel_idle driver, the stopped tick handling in the menu and teo governors is updated, and there are a couple of cleanups. Apart from the above, support for Tegra114 is added to devfreq and there are assorted cleanups of that code, there are also two updates of the operating performance points (OPP) library, two minor updates related to hibernation, and cpupower utility man pages updates and cleanups. Specifics: - Update qcom-hw DT bindings to include Eliza hardware (Abel Vesa) - Update cpufreq-dt-platdev blocklist (Faruque Ansari) - Minor updates to driver and dt-bindings for Tegra (Thierry Reding, Rosen Penev) - Add MAINTAINERS entry for CPPC driver (Viresh Kumar) - Add support for new features: CPPC performance priority, Dynamic EPP, Raw EPP, and new unit tests for them to amd-pstate (Gautham Shenoy, Mario Limonciello) - Fix sysfs files being present when HW missing and broken/outdated documentation in the amd-pstate driver (Ninad Naik, Gautham Shenoy) - Pass the policy to cpufreq_driver->adjust_perf() to avoid using cpufreq_cpu_get() in the .adjust_perf() callback in amd-pstate which leads to a scheduling-while-atomic bug (K Prateek Nayak) - Clean up dead code in Kconfig for cpufreq (Julian Braha) - Remove max_freq_req update for pre-existing cpufreq policy and add a boost_freq_req QoS request to save the boost constraint instead of overwriting the last scaling_max_freq constraint (Pierre Gondois) - Embed cpufreq QoS freq_req objects in cpufreq policy so they all are allocated in one go along with the policy to simplify lifetime rules and avoid error handling issues (Viresh Kumar) - Use DMI max speed when CPPC is unavailable in the acpi-cpufreq scaling driver (Henry Tseng) - Switch policy_is_shared() in cpufreq to using cpumask_nth() instead of cpumask_weight() because the former is more efficient (Yury Norov) - Use sysfs_emit() in sysfs show functions for cpufreq governor attributes (Thorsten Blum) - Update intel_pstate to stop returning an error when "off" is written to its status sysfs attribute while the driver is already off (Fabio De Francesco) - Include current frequency in the debug message printed by __cpufreq_driver_target() (Pengjie Zhang) - Refine stopped tick handling in the menu cpuidle governor and rearrange stopped tick handling in the teo cpuidle governor (Rafael Wysocki) - Add Panther Lake C-states table to the intel_idle driver (Artem Bityutskiy) - Clean up dead dependencies on CPU_IDLE in Kconfig (Julian Braha) - Simplify cpuidle_register_device() with guard() (Huisong Li) - Use performance level if available to distinguish between rates in OPP debugfs (Manivannan Sadhasivam) - Fix scoped_guard in dev_pm_opp_xlate_required_opp() (Viresh Kumar) - Return -ENODATA if the snapshot image is not loaded (Alberto Garcia) - Remove inclusion of crypto/hash.h from hibernate_64.c on x86 (Eric Biggers) - Clean up and rearrange the intel_rapl power capping driver to make the respective interface drivers (TPMI, MSR, and MMOI) hold their own settings and primitives and consolidate PL4 and PMU support flags into rapl_defaults (Kuppuswamy Sathyanarayanan) - Correct kernel-doc function parameter names in the power capping core code (Randy Dunlap) - Remove unneeded casting for HZ_PER_KHZ in devfreq (Andy Shevchenko) - Use _visible attribute to replace create/remove_sysfs_files() in devfreq (Pengjie Zhang) - Add Tegra114 support to activity monitor device in tegra30-devfreq as a preparation to upcoming EMC controller support (Svyatoslav Ryhel) - Fix mistakes in cpupower man pages, add the boost and epp options to the cpupower-frequency-info man page, and add the perf-bias option to the cpupower-info man page (Roberto Ricci) - Remove unnecessary extern declarations from getopt.h in arguments parsing functions in cpufreq-set, cpuidle-info, cpuidle-set, cpupower-info, and cpupower-set utilities (Kaushlendra Kumar)" * tag 'pm-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (74 commits) cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP cpupower: remove extern declarations in cmd functions cpuidle: Simplify cpuidle_register_device() with guard() PM / devfreq: tegra30-devfreq: add support for Tegra114 PM / devfreq: use _visible attribute to replace create/remove_sysfs_files() PM / devfreq: Remove unneeded casting for HZ_PER_KHZ MAINTAINERS: amd-pstate: Step down as maintainer, add Prateek as reviewer cpufreq: Pass the policy to cpufreq_driver->adjust_perf() cpufreq/amd-pstate: Pass the policy to amd_pstate_update() cpufreq/amd-pstate-ut: Add a unit test for raw EPP cpufreq/amd-pstate: Add support for raw EPP writes cpufreq/amd-pstate: Add support for platform profile class cpufreq/amd-pstate: add kernel command line to override dynamic epp cpufreq/amd-pstate: Add dynamic energy performance preference Documentation: amd-pstate: fix dead links in the reference section cpufreq/amd-pstate: Cache the max frequency in cpudata Documentation/amd-pstate: Add documentation for amd_pstate_floor_{freq,count} Documentation/amd-pstate: List amd_pstate_prefcore_ranking sysfs file Documentation/amd-pstate: List amd_pstate_hw_prefcore sysfs file amd-pstate-ut: Add a testcase to validate the visibility of driver attributes ... commit 772a896a56e0e3ef9424a025cec9176f9d8f4552 Author: Greg Kroah-Hartman Date: Sat Apr 11 14:06:00 2026 +0200 scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cur_len bytes from that buffer. snprintf() returns the length the output would have had, which can exceed the buffer size when the fabric WWN is long because iSCSI IQN names can be up to 223 bytes. The check at the memcpy() site only guards the destination page write, not the source read, so memcpy() will read past the stack buffer and copy adjacent stack contents to the sysfs reader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic() will be triggered. Commit 27e06650a5ea ("scsi: target: target_core_configfs: Add length check to avoid buffer overflow") added the same bound to the target_lu_gp_members_show() but the tg_pt_gp variant was missed so resolve that here. Cc: Martin K. Petersen Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026041159-garter-theft-3be0@gregkh Signed-off-by: Martin K. Petersen commit 2e31b16101834bdc0b720967845d6a0a309cf27b Merge: 4793dae01f4775 8e937866b42524 Author: Linus Torvalds Date: Mon Apr 13 19:25:07 2026 -0700 Merge tag 'acpi-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support updates from Rafael Wysocki: "These include an update of the CMOS RTC driver and the related ACPI and x86 code that, among other things, switches it over to using the platform device interface for device binding on x86 instead of the PNP device driver interface (which allows the code in question to be simplified quite a bit), a major update of the ACPI Time and Alarm Device (TAD) driver adding an RTC class device interface to it, and updates of core ACPI drivers that remove some unnecessary and not really useful code from them. Apart from that, two drivers are converted to using the platform driver interface for device binding instead of the ACPI driver one, which is slated for removal, support for the Performance Limited register is added to the ACPI CPPC library and there are some janitorial updates of it and the related cpufreq CPPC driver, the ACPI processor driver is fixed and cleaned up, and NVIDIA vendor CPER record handler is added to the APEI GHES code. Also, the interface for obtaining a CPU UID from ACPI is consolidated across architectures and used for fixing a problem with the PCI TPH Steering Tag on ARM64, there are two updates related to ACPICA, a minor ACPI OS Services Layer (OSL) update, and a few assorted updates related to ACPI tables parsing. Specifics: - Update maintainers information regarding ACPICA (Rafael Wysocki) - Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy() (Kees Cook) - Trigger an ordered system power off after encountering a fatal error operator in AML (Armin Wolf) - Enable ACPI FPDT parsing on LoongArch (Xi Ruoyao) - Remove the temporary stop-gap acpi_pptt_cache_v1_full structure from the ACPI PPTT parser (Ben Horgan) - Add support for exposing ACPI FPDT subtables FBPT and S3PT (Nate DeSimone) - Address multiple assorted issues and clean up the code in the ACPI processor idle driver (Huisong Li) - Replace strlcat() in the ACPI processor idle drive with a better alternative (Andy Shevchenko) - Rearrange and clean up acpi_processor_errata_piix4() (Rafael Wysocki) - Move reference performance to capabilities and fix an uninitialized variable in the ACPI CPPC library (Pengjie Zhang) - Add support for the Performance Limited Register to the ACPI CPPC library (Sumit Gupta) - Add cppc_get_perf() API to read performance controls, extend cppc_set_epp_perf() for FFH/SystemMemory, and make the ACPI CPPC library warn on missing mandatory DESIRED_PERF register (Sumit Gupta) - Modify the cpufreq CPPC driver to update MIN_PERF/MAX_PERF in target callbacks to allow it to control performance bounds via standard scaling_min_freq and scaling_max_freq sysfs attributes and add sysfs documentation for the Performance Limited Register to it (Sumit Gupta) - Add ACPI support to the platform device interface in the CMOS RTC driver, make the ACPI core device enumeration code create a platform device for the CMOS RTC, and drop CMOS RTC PNP device support (Rafael Wysocki) - Consolidate the x86-specific CMOS RTC handling with the ACPI TAD driver and clean up the CMOS RTC ACPI address space handler (Rafael Wysocki) - Enable ACPI alarm in the CMOS RTC driver if advertised in ACPI FADT and allow that driver to work without a dedicated IRQ if the ACPI alarm is used (Rafael Wysocki) - Clean up the ACPI TAD driver in various ways and add an RTC class device interface, including both the RTC setting/reading and alarm timer support, to it (Rafael Wysocki) - Clean up the ACPI AC and ACPI PAD (processor aggregator device) drivers (Rafael Wysocki) - Rework checking for duplicate video bus devices and consolidate pnp.bus_id workarounds handling in the ACPI video bus driver (Rafael Wysocki) - Update the ACPI core device drivers to stop setting acpi_device_name() unnecessarily (Rafael Wysocki) - Rearrange code using acpi_device_class() in the ACPI core device drivers and update them to stop setting acpi_device_class() unnecessarily (Rafael Wysocki) - Define ACPI_AC_CLASS in one place (Rafael Wysocki) - Convert the ni903x_wdt watchdog driver and the xen ACPI PAD driver to bind to platform devices instead of ACPI devices (Rafael Wysocki) - Add devm_ghes_register_vendor_record_notifier(), use it in the PCI hisi driver, and Add NVIDIA vendor CPER record handler (Kai-Heng Feng) - Consolidate the interface for obtaining a CPU UID from ACPI across architectures and use it to address incorrect PCI TPH Steering Tag on ARM64 resulting from the invalid assumption that the ACPI Processor UID would always be the same as the corresponding logical CPU ID in Linux (Chengwen Feng)" * tag 'acpi-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (73 commits) ACPICA: Update maintainers information watchdog: ni903x_wdt: Convert to a platform driver ACPI: PAD: xen: Convert to a platform driver ACPI: processor: idle: Reset cpuidle on C-state list changes cpuidle: Extract and export no-lock variants of cpuidle_unregister_device() PCI/TPH: Pass ACPI Processor UID to Cache Locality _DSM ACPI: PPTT: Use acpi_get_cpu_uid() and remove get_acpi_id_for_cpu() perf: arm_cspmu: Switch to acpi_get_cpu_uid() from get_acpi_id_for_cpu() ACPI: Centralize acpi_get_cpu_uid() declaration in include/linux/acpi.h x86/acpi: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval RISC-V: ACPI: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval LoongArch: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval arm64: acpi: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval ACPI: APEI: GHES: Add NVIDIA vendor CPER record handler PCI: hisi: Use devm_ghes_register_vendor_record_notifier() ACPI: APEI: GHES: Add devm_ghes_register_vendor_record_notifier() ACPI: tables: Enable FPDT on LoongArch ACPI: processor: idle: Fix NULL pointer dereference in hotplug path ACPI: processor: idle: Reset power_setup_done flag on initialization failure ACPI: TAD: Add alarm support to the RTC class device interface ... commit 4793dae01f47754e288cdbb3a22581cac2317f2b Merge: d568788baab248 6c8dfb0362732b Author: Linus Torvalds Date: Mon Apr 13 19:03:11 2026 -0700 Merge tag 'driver-core-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "debugfs: - Fix NULL pointer dereference in debugfs_create_str() - Fix misplaced EXPORT_SYMBOL_GPL for debugfs_create_str() - Fix soundwire debugfs NULL pointer dereference from uninitialized firmware_file device property: - Make fwnode flags modifications thread safe; widen the field to unsigned long and use set_bit() / clear_bit() based accessors - Document how to check for the property presence devres: - Separate struct devres_node from its "subclasses" (struct devres, struct devres_group); give struct devres_node its own release and free callbacks for per-type dispatch - Introduce struct devres_action for devres actions, avoiding the ARCH_DMA_MINALIGN alignment overhead of struct devres - Export struct devres_node and its init/add/remove/dbginfo primitives for use by Rust Devres - Fix missing node debug info in devm_krealloc() - Use guard(spinlock_irqsave) where applicable; consolidate unlock paths in devres_release_group() driver_override: - Convert PCI, WMI, vdpa, s390/cio, s390/ap, and fsl-mc to the generic driver_override infrastructure, replacing per-bus driver_override strings, sysfs attributes, and match logic; fixes a potential UAF from unsynchronized access to driver_override in bus match() callbacks - Simplify __device_set_driver_override() logic kernfs: - Send IN_DELETE_SELF and IN_IGNORED inotify events on kernfs file and directory removal - Add corresponding selftests for memcg platform: - Allow attaching software nodes when creating platform devices via a new 'swnode' field in struct platform_device_info - Add kerneldoc for struct platform_device_info software node: - Move software node initialization from postcore_initcall() to driver_init(), making it available early in the boot process - Move kernel_kobj initialization (ksysfs_init) earlier to support the above - Remove software_node_exit(); dead code in a built-in unit SoC: - Introduce of_machine_read_compatible() and of_machine_read_model() OF helpers and export soc_attr_read_machine() to replace direct accesses to of_root from SoC drivers; also enables CONFIG_COMPILE_TEST coverage for these drivers sysfs: - Constify attribute group array pointers to 'const struct attribute_group *const *' in sysfs functions, device_add_groups() / device_remove_groups(), and struct class Rust: - Devres: - Embed struct devres_node directly in Devres instead of going through devm_add_action(), avoiding the extra allocation and the unnecessary ARCH_DMA_MINALIGN alignment - I/O: - Turn IoCapable from a marker trait into a functional trait carrying the raw I/O accessor implementation (io_read / io_write), providing working defaults for the per-type Io methods - Add RelaxedMmio wrapper type, making relaxed accessors usable in code generic over the Io trait - Remove overloaded per-type Io methods and per-backend macros from Mmio and PCI ConfigSpace - I/O (Register): - Add IoLoc trait and generic read/write/update methods to the Io trait, making I/O operations parameterizable by typed locations - Add register! macro for defining hardware register types with typed bitfield accessors backed by Bounded values; supports direct, relative, and array register addressing - Add write_reg() / try_write_reg() and LocatedRegister trait - Update PCI sample driver to demonstrate the register! macro Example: ``` register! { /// UART control register. CTRL(u32) @ 0x18 { /// Receiver enable. 19:19 rx_enable => bool; /// Parity configuration. 14:13 parity ?=> Parity; } /// FIFO watermark and counter register. WATER(u32) @ 0x2c { /// Number of datawords in the receive FIFO. 26:24 rx_count; /// RX interrupt threshold. 17:16 rx_water; } } impl WATER { fn rx_above_watermark(&self) -> bool { self.rx_count() > self.rx_water() } } fn init(bar: &pci::Bar) { let water = WATER::zeroed() .with_const_rx_water::<1>(); // > 3 would not compile bar.write_reg(water); let ctrl = CTRL::zeroed() .with_parity(Parity::Even) .with_rx_enable(true); bar.write_reg(ctrl); } fn handle_rx(bar: &pci::Bar) { if bar.read(WATER).rx_above_watermark() { // drain the FIFO } } fn set_parity(bar: &pci::Bar, parity: Parity) { bar.update(CTRL, |r| r.with_parity(parity)); } ``` - IRQ: - Move 'static bounds from where clauses to trait declarations for IRQ handler traits - Misc: - Enable the generic_arg_infer Rust feature - Extend Bounded with shift operations, single-bit bool conversion, and const get() Misc: - Make deferred_probe_timeout default a Kconfig option - Drop auxiliary_dev_pm_ops; the PM core falls back to driver PM callbacks when no bus type PM ops are set - Add conditional guard support for device_lock() - Add ksysfs.c to the DRIVER CORE MAINTAINERS entry - Fix kernel-doc warnings in base.h - Fix stale reference to memory_block_add_nid() in documentation" * tag 'driver-core-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (67 commits) bus: fsl-mc: use generic driver_override infrastructure s390/ap: use generic driver_override infrastructure s390/cio: use generic driver_override infrastructure vdpa: use generic driver_override infrastructure platform/wmi: use generic driver_override infrastructure PCI: use generic driver_override infrastructure driver core: make software nodes available earlier software node: remove software_node_exit() kernel: ksysfs: initialize kernel_kobj earlier MAINTAINERS: add ksysfs.c to the DRIVER CORE entry drivers/base/memory: fix stale reference to memory_block_add_nid() device property: Document how to check for the property presence soundwire: debugfs: initialize firmware_file to empty string debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() debugfs: check for NULL pointer in debugfs_create_str() driver core: Make deferred_probe_timeout default a Kconfig option driver core: simplify __device_set_driver_override() clearing logic driver core: auxiliary bus: Drop auxiliary_dev_pm_ops device property: Make modifications of fwnode "flags" thread safe rust: devres: embed struct devres_node directly ... commit d568788baab24875604c231f723dbb72387fb081 Merge: cea4a90faf9e5d cf2f06f7152d5e Author: Linus Torvalds Date: Mon Apr 13 17:52:29 2026 -0700 Merge tag 'hardening-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: - randomize_kstack: Improve implementation across arches (Ryan Roberts) - lkdtm/fortify: Drop unneeded FORTIFY_STR_OBJECT test - refcount: Remove unused __signed_wrap function annotations * tag 'hardening-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: lkdtm/fortify: Drop unneeded FORTIFY_STR_OBJECT test refcount: Remove unused __signed_wrap function annotations randomize_kstack: Unify random source across arches randomize_kstack: Maintain kstack_offset per task commit cea4a90faf9e5d15aee1fd01883bc81ad7640260 Merge: 613b48bbd46594 41fa0432738414 Author: Linus Torvalds Date: Mon Apr 13 17:45:25 2026 -0700 Merge tag 'seccomp-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp update from Kees Cook: - selftests: Add hard-coded __NR_uprobe for x86_64 (Oleg Nesterov) * tag 'seccomp-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: selftests/seccomp: Add hard-coded __NR_uprobe for x86_64 commit 613b48bbd465941f796c174c96707a9bce595265 Merge: cae0d23288e959 9bf092c97b86af Author: Linus Torvalds Date: Mon Apr 13 17:41:36 2026 -0700 Merge tag 'execve-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve updates from Kees Cook: - use strnlen() in __set_task_comm (Thorsten Blum) - update task_struct->comm comment (Thorsten Blum) * tag 'execve-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: sched: update task_struct->comm comment exec: use strnlen() in __set_task_comm commit cae0d23288e959a05377a307b96dc30ea4fd9f1a Merge: d142ab35ee0b7f 24b8f8dcb9a139 Author: Linus Torvalds Date: Mon Apr 13 17:39:08 2026 -0700 Merge tag 'pstore-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore updates from Kees Cook: - fix ftrace dump when ECC is enabled (Andrey Skvortsov) - fix resource leak when ioremap() fails (Cole Leavitt) - Remove useless memblock header (Guilherme G. Piccoli) - Fix ECC parameter help text (Guilherme G. Piccoli) - Keep ftrace module parameter and debugfs switch in sync (Guilherme G. Piccoli) - Factor KASLR offset in the core kernel instruction addresses (Guilherme G. Piccoli) * tag 'pstore-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/ftrace: Factor KASLR offset in the core kernel instruction addresses pstore/ftrace: Keep ftrace module parameter and debugfs switch in sync pstore/ram: fix resource leak when ioremap() fails pstore/ramoops: Fix ECC parameter help text pstore/ramoops: Remove useless memblock header pstore: fix ftrace dump, when ECC is enabled commit d142ab35ee0b7f9e84115fe3e4c3de4a9ac35f5e Merge: 370c3883195566 8fdef85d601db6 Author: Linus Torvalds Date: Mon Apr 13 17:36:04 2026 -0700 Merge tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull CRC updates from Eric Biggers: - Several improvements related to crc_kunit, to align with the standard KUnit conventions and make it easier for developers and CI systems to run this test suite - Add an arm64-optimized implementation of CRC64-NVME - Remove unused code for big endian arm64 * tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crc: arm64: Simplify intrinsics implementation lib/crc: arm64: Use existing macros for kernel-mode FPU cflags lib/crc: arm64: Drop unnecessary chunking logic from crc64 lib/crc: arm64: Assume a little-endian kernel lib/crc: arm64: add NEON accelerated CRC64-NVMe implementation lib/crc: arm64: Drop check for CONFIG_KERNEL_MODE_NEON crypto: crc32c - Remove another outdated comment crypto: crc32c - Remove more outdated usage information kunit: configs: Enable all CRC tests in all_tests.config lib/crc: tests: Add a .kunitconfig file lib/crc: tests: Add CRC_ENABLE_ALL_FOR_KUNIT lib/crc: tests: Make crc_kunit test only the enabled CRC variants commit 370c3883195566ee3e7d79e0146c3d735a406573 Merge: 9932f00bf40d28 12b11e47f126d0 Author: Linus Torvalds Date: Mon Apr 13 17:31:39 2026 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library updates from Eric Biggers: - Migrate more hash algorithms from the traditional crypto subsystem to lib/crypto/ Like the algorithms migrated earlier (e.g. SHA-*), this simplifies the implementations, improves performance, enables further simplifications in calling code, and solves various other issues: - AES CBC-based MACs (AES-CMAC, AES-XCBC-MAC, and AES-CBC-MAC) - Support these algorithms in lib/crypto/ using the AES library and the existing arm64 assembly code - Reimplement the traditional crypto API's "cmac(aes)", "xcbc(aes)", and "cbcmac(aes)" on top of the library - Convert mac80211 to use the AES-CMAC library. Note: several other subsystems can use it too and will be converted later - Drop the broken, nonstandard, and likely unused support for "xcbc(aes)" with key lengths other than 128 bits - Enable optimizations by default - GHASH - Migrate the standalone GHASH code into lib/crypto/ - Integrate the GHASH code more closely with the very similar POLYVAL code, and improve the generic GHASH implementation to resist cache-timing attacks and use much less memory - Reimplement the AES-GCM library and the "gcm" crypto_aead template on top of the GHASH library. Remove "ghash" from the crypto_shash API, as it's no longer needed - Enable optimizations by default - SM3 - Migrate the kernel's existing SM3 code into lib/crypto/, and reimplement the traditional crypto API's "sm3" on top of it - I don't recommend using SM3, but this cleanup is worthwhile to organize the code the same way as other algorithms - Testing improvements: - Add a KUnit test suite for each of the new library APIs - Migrate the existing ChaCha20Poly1305 test to KUnit - Make the KUnit all_tests.config enable all crypto library tests - Move the test kconfig options to the Runtime Testing menu - Other updates to arch-optimized crypto code: - Optimize SHA-256 for Zhaoxin CPUs using the Padlock Hash Engine - Remove some MD5 implementations that are no longer worth keeping - Drop big endian and voluntary preemption support from the arm64 code, as those configurations are no longer supported on arm64 - Make jitterentropy and samples/tsm-mr use the crypto library APIs * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (66 commits) lib/crypto: arm64: Assume a little-endian kernel arm64: fpsimd: Remove obsolete cond_yield macro lib/crypto: arm64/sha3: Remove obsolete chunking logic lib/crypto: arm64/sha512: Remove obsolete chunking logic lib/crypto: arm64/sha256: Remove obsolete chunking logic lib/crypto: arm64/sha1: Remove obsolete chunking logic lib/crypto: arm64/poly1305: Remove obsolete chunking logic lib/crypto: arm64/gf128hash: Remove obsolete chunking logic lib/crypto: arm64/chacha: Remove obsolete chunking logic lib/crypto: arm64/aes: Remove obsolete chunking logic lib/crypto: Include instead of lib/crypto: aesgcm: Don't disable IRQs during AES block encryption lib/crypto: aescfb: Don't disable IRQs during AES block encryption lib/crypto: tests: Migrate ChaCha20Poly1305 self-test to KUnit lib/crypto: sparc: Drop optimized MD5 code lib/crypto: mips: Drop optimized MD5 code lib: Move crypto library tests to Runtime Testing menu crypto: sm3 - Remove 'struct sm3_state' crypto: sm3 - Remove the original "sm3_block_generic()" crypto: sm3 - Remove sm3_base.h ... commit 9932f00bf40d281151de5694bc0f097cb9b5616c Merge: 81dc1e4d32b064 1546d3feb5e533 Author: Linus Torvalds Date: Mon Apr 13 17:29:12 2026 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt updates from Eric Biggers: - Various cleanups for the interface between fs/crypto/ and filesystems, from Christoph Hellwig - Simplify and optimize the implementation of v1 key derivation by using the AES library instead of the crypto_skcipher API * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: use AES library for v1 key derivation ext4: use a byte granularity cursor in ext4_mpage_readpages fscrypt: pass a real sector_t to fscrypt_zeroout_range fscrypt: pass a byte length to fscrypt_zeroout_range fscrypt: pass a byte offset to fscrypt_zeroout_range fscrypt: pass a byte length to fscrypt_zeroout_range_inline_crypt fscrypt: pass a byte offset to fscrypt_zeroout_range_inline_crypt fscrypt: pass a byte offset to fscrypt_set_bio_crypt_ctx fscrypt: pass a byte offset to fscrypt_mergeable_bio fscrypt: pass a byte offset to fscrypt_generate_dun fscrypt: move fscrypt_set_bio_crypt_ctx_bh to buffer.c ext4, fscrypt: merge fscrypt_mergeable_bio_bh into io_submit_need_new_bio ext4: factor out a io_submit_need_new_bio helper ext4: open code fscrypt_set_bio_crypt_ctx_bh ext4: initialize the write hint in io_submit_init_bio commit 81dc1e4d32b064ac47abc60b0acbf49b66a34d52 Merge: 0b0128e64af056 4248ed1013816f Author: Linus Torvalds Date: Mon Apr 13 17:09:00 2026 -0700 Merge tag 'v7.1-rc1-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - Fix EAs bounds check - Fix OOB read in symlink response parsing - Add support for creating tmpfiles - Minor debug improvement for mount failure - Minor crypto cleanup - Add missing module description - mount fix for lease vs. nolease - Add Metze as maintainer for smbdirect - Minor error mapping header cleanup - Improve search speed of SMB1 maperror - Fix potential null ptr ref in smb2 map error tests * tag 'v7.1-rc1-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: (26 commits) smb: client: allow both 'lease' and 'nolease' mount options smb: client: get rid of d_drop()+d_add() smb: client: set ATTR_TEMPORARY with O_TMPFILE | O_EXCL smb: client: add support for O_TMPFILE vfs: introduce d_mark_tmpfile_name() MAINTAINERS: create entry for smbdirect smb: client: add missing MODULE_DESCRIPTION() to smb1maperror_test smb: client: fix OOB reads parsing symlink error response smb: client: fix off-by-8 bounds check in check_wsl_eas() smb: client: Remove unnecessary selection of CRYPTO_ECB smb/client: move smb2maperror declarations to smb2proto.h smb/client: introduce KUnit tests to check DOS/SRV err mapping search smb/client: check if SMB1 DOS/SRV error mapping arrays are sorted smb/client: use binary search for SMB1 DOS/SRV error mapping smb/client: autogenerate SMB1 DOS/SRV to POSIX error mapping smb/client: annotate smberr.h with POSIX error codes smb/client: move ERRnetlogonNotStarted to DOS error class smb/client: introduce KUnit test to check ntstatus_to_dos_map search smb/client: check if ntstatus_to_dos_map is sorted smb/client: use binary search for NT status to DOS mapping ... commit 0b0128e64af056a7dd29fa3bc780af654e53f861 Merge: 230fb3a33efd52 2ffc6900d5c3a7 Author: Linus Torvalds Date: Mon Apr 13 17:03:48 2026 -0700 Merge tag 'xfs-merge-7.1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Carlos Maiolino: "There aren't any new features. The whole series is just a collection of bug fixes and code refactoring. There is some new information added a couple new tracepoints, new data added to mountstats, but no big changes" * tag 'xfs-merge-7.1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (41 commits) xfs: fix number of GC bvecs xfs: untangle the open zones reporting in mountinfo xfs: expose the number of open zones in sysfs xfs: reduce special casing for the open GC zone xfs: streamline GC zone selection xfs: refactor GC zone selection helpers xfs: rename xfs_zone_gc_iter_next to xfs_zone_gc_iter_irec xfs: put the open zone later xfs_open_zone_put xfs: add a separate tracepoint for stealing an open zone for GC xfs: delay initial open of the GC zone xfs: fix a resource leak in xfs_alloc_buftarg() xfs: handle too many open zones when mounting xfs: refactor xfs_mount_zones xfs: fix integer overflow in busy extent sort comparator xfs: fix integer overflow in deferred intent sort comparators xfs: fold xfs_setattr_size into xfs_vn_setattr_size xfs: remove a duplicate assert in xfs_setattr_size xfs: return default quota limits for IDs without a dquot xfs: start gc on zonegc_low_space attribute updates xfs: don't decrement the buffer LRU count for in-use buffers ... commit 34e1a98ff2a87cf4b8de3ccebe9d45273f014aeb Author: Lorenzo Bianconi Date: Sun Apr 12 11:56:25 2026 +0200 net: airoha: Remove PCE_MC_EN_MASK bit in REG_FE_PCE_CFG configuration PCE_MC_EN_MASK bit in REG_FE_PCE_CFG configuration performed in airoha_fe_init() is used to duplicate multicast packets and send a copy to the CPU when the traffic is offloaded. This is necessary just if it is requested by the user. Disable multicast packets duplication by default. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260412-airoha_fe_init_remove_mc_en_bit-v1-1-7b6a5a25a74d@kernel.org Signed-off-by: Jakub Kicinski commit 230fb3a33efd52613910a3970495b20295557731 Merge: a62fe21079978e a5242d37c83abe Author: Linus Torvalds Date: Mon Apr 13 16:59:19 2026 -0700 Merge tag 'erofs-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: - Validate xattr h_shared_count to report -EFSCORRUPTED explicitly for crafted images - Verify metadata accesses for file-backed mounts via rw_verify_area() - Fix FS_IOC_GETFSLABEL to include the trailing NUL byte, consistent with ext4 and xfs - Properly handle 48-bit on-disk blocks/uniaddr for extra devices - Fix an index underflow in the LZ4 in-place decompression that can cause out-of-bounds accesses with crafted images - Minor fixes and cleanups * tag 'erofs-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: error out obviously illegal extents in advance erofs: clean up encoded map flags erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() erofs: handle 48-bit blocks/uniaddr for extra devices erofs: include the trailing NUL in FS_IOC_GETFSLABEL erofs: ensure all folios are managed in erofs_try_to_free_all_cached_folios() erofs: verify metadata accesses for file-backed mounts erofs: harden h_shared_count in erofs_init_inode_xattrs() commit a62fe21079978e5134ad863f8a9835eb24c06d43 Merge: f2729827aefffe 08cf4a8181b437 Author: Linus Torvalds Date: Mon Apr 13 16:57:31 2026 -0700 Merge tag 'exfat-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - Implement FALLOC_FL_ALLOCATE_RANGE to add support for preallocating clusters without zeroing, helping to reduce file fragmentation - Add a unified block readahead helper for FAT chain conversion, bitmap allocation, and directory entry lookups - Optimize exfat_chain_cont_cluster() by caching buffer heads to minimize mark_buffer_dirty() and mirroring overhead during NO_FAT_CHAIN to FAT_CHAIN conversion - Switch to truncate_inode_pages_final() in evict_inode() to prevent BUG_ON caused by shadow entries during reclaim - Fix a 32-bit truncation bug in directory entry calculations by ensuring proper bitwise coercion - Fix sb->s_maxbytes calculation to correctly reflect the maximum possible volume size for a given cluster size, resolving xfstests generic/213 - Introduced exfat_cluster_walk() helper to traverse FAT chains by a specified step, handling both ALLOC_NO_FAT_CHAIN and ALLOC_FAT_CHAIN modes - Introduced exfat_chain_advance() helper to advance an exfat_chain structure, updating both the current cluster and remaining size - Remove dead assignments and fix Smatch warnings * tag 'exfat-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: use exfat_chain_advance helper exfat: introduce exfat_chain_advance helper exfat: remove NULL cache pointer case in exfat_ent_get exfat: use exfat_cluster_walk helper exfat: introduce exfat_cluster_walk helper exfat: fix incorrect directory checksum after rename to shorter name exfat: fix s_maxbytes exfat: fix passing zero to ERR_PTR() in exfat_mkdir() exfat: fix error handling for FAT table operations exfat: optimize exfat_chain_cont_cluster with cached buffer heads exfat: drop redundant sec parameter from exfat_mirror_bh exfat: use readahead helper in exfat_get_dentry exfat: use readahead helper in exfat_allocate_bitmap exfat: add block readahead in exfat_chain_cont_cluster exfat: add fallocate FALLOC_FL_ALLOCATE_RANGE support exfat: Fix bitwise operation having different size exfat: Drop dead assignment of num_clusters exfat: use truncate_inode_pages_final() at evict_inode() commit f2729827aefffe333e9d92ffd49bef4e35c2c22d Merge: 4d9981429aa61c be3e5d10643d3b Author: Linus Torvalds Date: Mon Apr 13 16:53:19 2026 -0700 Merge tag 'nilfs2-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2 Pull nilfs2 updates from Viacheslav Dubeyko: "This contains fixes of syzbot reported issues in NILFS2 functionality: - The DAT inode's btree node cache (i_assoc_inode) is initialized lazily during btree operations. However, nilfs_mdt_save_to_shadow_map() assumes i_assoc_inode is already initialized when copying dirty pages to the shadow map during GC. If NILFS_IOCTL_CLEAN_SEGMENTS is called immediately after mount before any btree operation has occurred on the DAT inode, i_assoc_inode is NULL leading to a general protection fault. Fix this by calling nilfs_attach_btree_node_cache() on the DAT inode in nilfs_dat_read() at mount time, ensuring i_assoc_inode is always initialized before any GC operation can use it (Deepanshu Kartikey) - nilfs_ioctl_mark_blocks_dirty() uses bd_oblocknr to detect dead blocks by comparing it with the current block number bd_blocknr. If they differ, the block is considered dead and skipped. A corrupted ioctl request with bd_oblocknr set to 0 causes the comparison to incorrectly match when the lookup returns -ENOENT and sets bd_blocknr to 0, bypassing the dead block check and calling nilfs_bmap_mark() on a non- existent block. This causes nilfs_btree_do_lookup() to return -ENOENT, triggering the WARN_ON(ret == -ENOENT). Fix this by rejecting ioctl requests with bd_oblocknr set to 0 at the beginning of each iteration (Deepanshu Kartikey)" * tag 'nilfs2-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2: nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map commit 4d9981429aa61c31e67371ac09e7dbba6b59de14 Merge: f3756afb6f6cdc c1307d18caa819 Author: Linus Torvalds Date: Mon Apr 13 16:50:38 2026 -0700 Merge tag 'hfs-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs Pull hfsplus updates from Viacheslav Dubeyko: "This contains several fixes of syzbot reported issues and HFS+ fixes of xfstests failures. - Fix a syzbot reported issue of a KMSAN uninit-value in hfsplus_strcasecmp(). The root cause was that hfs_brec_read() doesn't validate that the on-disk record size matches the expected size for the record type being read. The fix introduced hfsplus_brec_read_cat() wrapper that validates the record size based on the type field and returns -EIO if size doesn't match (Deepanshu Kartikey) - Fix a syzbot reported issue of processing corrupted HFS+ images where the b-tree allocation bitmap indicates that the header node (Node 0) is free. Node 0 must always be allocated. Violating this invariant leads to allocator corruption, which cascades into kernel panics or undefined behavior. Prevent trusting a corrupted allocator state by adding a validation check during hfs_btree_open(). If corruption is detected, print a warning identifying the specific corrupted tree and force the filesystem to mount read-only (SB_RDONLY). This prevents kernel panics from corrupted images while enabling data recovery (Shardul Bankar) - Fix a potential deadlock in hfsplus_fill_super(). hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which acquires tree->tree_lock. If the subsequent call to hfsplus_cat_build_key() fails, the function jumps to the out_put_root error label without releasing the lock. Fix this by adding the missing hfs_find_exit(&fd) call before jumping to the out_put_root error label. This ensures that tree->tree_lock is properly released on the error path (Zilin Guan) - Update a files ctime after rename in hfsplus_rename() (Yangtao Li) The rest of the patches introduce the HFS+ fixes for the case of generic/348, generic/728, generic/533, generic/523, and generic/642 test-cases of xfstests suite" * tag 'hfs-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs: hfsplus: fix generic/642 failure hfsplus: rework logic of map nodes creation in xattr b-tree hfsplus: fix logic of alloc/free b-tree node hfsplus: fix error processing issue in hfs_bmap_free() hfsplus: fix potential race conditions in b-tree functionality hfsplus: extract hidden directory search into a helper function hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus: fix generic/523 test-case failure hfsplus: validate b-tree node 0 bitmap at mount time hfsplus: refactor b-tree map page access and add node-type validation hfsplus: fix to update ctime after rename hfsplus: fix generic/533 test-case failure hfsplus: set ctime after setxattr and removexattr hfsplus: fix uninit-value by validating catalog record size hfsplus: fix potential Allocation File corruption after fsync commit 2cd7e6971fc2787408ceef17906ea152791448cf Author: Xin Long Date: Sun Apr 12 14:15:27 2026 -0400 sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path: udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU. Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit(). Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths. In my testing, after enabling the SCTP over UDP: # ip net exec ha sysctl -w net.sctp.udp_port=9899 # ip net exec ha sysctl -w net.sctp.encap_port=9899 # ip net exec hb sysctl -w net.sctp.udp_port=9899 # ip net exec hb sysctl -w net.sctp.encap_port=9899 # ip net exec ha iperf3 -s - without this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver - with this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver Fixes: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions") Fixes: 046c052b475e ("sctp: enable udp tunneling socks") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Link: https://patch.msgid.link/c874a8548221dcd56ff03c65ba75a74e6cf99119.1776017727.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit bf6f95ae3b8b2638c0e1d6d802d50983ce5d0f45 Author: Xin Long Date: Sun Apr 12 14:13:51 2026 -0400 sctp: fix missing encap_port propagation for GSO fragments encap_port in SCTP_INPUT_CB(skb) is used by sctp_vtag_verify() for SCTP-over-UDP processing. In the GSO case, it is only set on the head skb, while fragment skbs leave it 0. This results in fragment skbs seeing encap_port == 0, breaking SCTP-over-UDP connections. Fix it by propagating encap_port from the head skb cb when initializing fragment skbs in sctp_inq_pop(). Fixes: 046c052b475e ("sctp: enable udp tunneling socks") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Link: https://patch.msgid.link/ea65ed61b3598d8b4940f0170b9aa1762307e6c3.1776017631.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit f4d35a2c4c6fb2e28e8009c774baab2279332657 Merge: 88e8577a2bac19 ae32f80018f0f0 Author: Jakub Kicinski Date: Mon Apr 13 16:48:40 2026 -0700 Merge branch 'net-airoha-preliminary-series-to-support-multiple-net_devices-connected-to-the-same-gdm-port' Lorenzo Bianconi says: ==================== net: airoha: Preliminary series to support multiple net_devices connected to the same GDM port EN7581 or AN7583 SoCs support connecting multiple external SerDes (e.g. Ethernet or USB SerDes) to GDM3 or GDM4 ports via a hw arbiter that manages the traffic in a TDM manner. This series introduces some preliminary changes necessary to introduce support for multiple net_devices connected to the same Frame Engine (FE) GDM port (GDM3 or GDM4). ==================== Link: https://patch.msgid.link/20260412-airoha-multi-serdes-preliminary-patch-v1-0-08d5b670ca8f@kernel.org Signed-off-by: Jakub Kicinski commit ae32f80018f0f0f4ebc7a0a70d4092d08a1545e8 Author: Lorenzo Bianconi Date: Sun Apr 12 19:13:14 2026 +0200 net: airoha: Rely on net_device pointer in ETS callbacks Remove airoha_gdm_port dependency in ETS tc callback signatures and rely on net_device pointer instead. Please note this patch does not introduce any logical change and it is a preliminary patch in order to support multiple net_devices connected to the same GDM3 or GDM4 port via an external hw arbiter. Tested-by: Xuegang Lu Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260412-airoha-multi-serdes-preliminary-patch-v1-3-08d5b670ca8f@kernel.org Signed-off-by: Jakub Kicinski commit 8baf4bf72ef94c955ef89d4644f1986603ee8320 Author: Lorenzo Bianconi Date: Sun Apr 12 19:13:13 2026 +0200 net: airoha: Rely on net_device pointer in HTB callbacks Remove airoha_gdm_port dependency in HTB tc callback signatures and rely on net_device pointer instead. Please note this patch does not introduce any logical change and it is a preliminary patch in order to support multiple net_devices connected to the same GDM3 or GDM4 port via an external hw arbiter. Tested-by: Xuegang Lu Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260412-airoha-multi-serdes-preliminary-patch-v1-2-08d5b670ca8f@kernel.org Signed-off-by: Jakub Kicinski commit 360d745a5319f09849a94dee0974c8ead721e392 Author: Lorenzo Bianconi Date: Sun Apr 12 19:13:12 2026 +0200 net: airoha: Rely on net_device pointer in airoha_dev_setup_tc_block signature Remove airoha_gdm_port dependency in airoha_dev_setup_tc_block routine signature and rely on net_device pointer instead. Please note this patch does not introduce any logical change and it is a preliminary patch to support multiple net_devices connected to the GDM3 or GDM4 ports via an external hw arbiter. Tested-by: Xuegang Lu Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260412-airoha-multi-serdes-preliminary-patch-v1-1-08d5b670ca8f@kernel.org Signed-off-by: Jakub Kicinski commit 88e8577a2bac19fc9f0792c06fae1cc4319e9ed2 Merge: 43a2deae3661d0 a21d33a5265f0b Author: Jakub Kicinski Date: Mon Apr 13 16:46:47 2026 -0700 Merge branch 'net-dsa-mxl862xx-add-statistics-support' Daniel Golle says: ==================== net: dsa: mxl862xx: add statistics support Add per-port RMON statistics support for the MxL862xx DSA driver, covering hardware-specific ethtool -S counters, standard IEEE 802.3 MAC/ctrl/pause statistics, and rtnl_link_stats64 via polled 64-bit accumulation. ==================== Link: https://patch.msgid.link/cover.1775951347.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit a21d33a5265f0b31d935a8b9b2b6faefb5185911 Author: Daniel Golle Date: Sun Apr 12 01:02:05 2026 +0100 net: dsa: mxl862xx: implement .get_stats64 Poll free-running firmware RMON counters every 2 seconds and accumulate deltas into 64-bit per-port statistics. 32-bit packet counters wrap in ~220s at 10 Gbps line rate with minimum-size frames; the 2s polling interval provides a comfortable margin. The .get_stats64 callback forces a fresh poll so that counters are always up to date when queried. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/fa38548ba05866879e8912721edc91947ce4ff12.1775951347.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit e6295d124644b14a12b55edf5d3e89cf86a4a2ce Author: Daniel Golle Date: Sun Apr 12 01:01:57 2026 +0100 net: dsa: mxl862xx: add ethtool statistics support The MxL862xx firmware exposes per-port RMON counters through the RMON_PORT_GET command, covering standard IEEE 802.3 MAC statistics (unicast/multicast/broadcast packet and byte counts, collision counters, pause frames) as well as hardware-specific counters such as extended VLAN discard and MTU exceed events. Add the RMON counter firmware API structures and command definitions. Implement .get_strings, .get_sset_count, and .get_ethtool_stats for legacy ethtool -S support. Implement .get_eth_mac_stats, .get_eth_ctrl_stats, and .get_pause_stats for the standardized IEEE 802.3 statistics interface. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/480be14d5ed51f3db7b1681b298044dbf8e87494.1775951347.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit f3756afb6f6cdcbbc246f1edd0580b8c7485124a Merge: c92b4d3dd59f9f 6fa253b38b9b29 Author: Linus Torvalds Date: Mon Apr 13 16:39:01 2026 -0700 Merge tag 'affs-for-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull AFFS fix from David Sterba: "There's a potential out-of-bounds read in the directory hash table during readdir" * tag 'affs-for-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: affs: bound hash_pos before table lookup in affs_readdir commit 43a2deae3661d0d51f9d39244ceb0a1701ec0006 Author: Aleksander Jan Bajkowski Date: Sat Apr 11 12:51:45 2026 +0200 net: phy: realtek: use LEDCR page number define on RTL8211F Replace the magic number with an existing define for the LEDCR register page number on the RTL8211F. Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Daniel Golle Link: https://patch.msgid.link/20260411105150.184577-1-olek2@wp.pl Signed-off-by: Jakub Kicinski commit c92b4d3dd59f9f71ac34b42d4603d2323a499ab0 Merge: 23acda7c221a76 fc3d53288158d6 Author: Linus Torvalds Date: Mon Apr 13 16:35:32 2026 -0700 Merge tag 'for-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "User visible changes: - move shutdown ioctl support out of experimental features, a forced stop of filesystem operation until the next unmount; additionally there's a super block operation to forcibly remove a device from under the filesystem that could lead to a shutdown or not if the redundancy allows that - report filesystem shutdown using fserror mechanism - tree-checker updates: - verify free space info, extent and bitmap items - verify remap-tree items and related data in block group items Performance improvements: - speed up clearing first extent in the tracked range (+10% throughput on sample workload) - reduce COW rewrites of extent buffers during the same transaction - avoid taking big device lock to update device stats during transaction commit - fix unnecessary flush on close when truncating empty files (observed in practice on a backup application) - prevent direct reclaim during compressed readahead to avoid stalls under memory pressure Notable fixes: - fix chunk allocation strategy on RAID1-like block groups with disproportionate device sizes, this could lead to ENOSPC due to skewed reservation estimates - adjust metadata reservation overcommit ratio to be less aggressive and also try to flush if possible, this avoids ENOSPC and potential transaction aborts in some edge cases (that are otherwise hard to reproduce) - fix silent IO error in encoded writes and ordered extent split in zoned mode, the error was not correctly propagated to the address space and could lead to zeroed ranges - don't mark inline files NOCOMPRESS unexpectedly, the intent was to do that for single block writes of regular files - fix deadlock between reflink and transaction commit when using flushoncommit - fix overly strict item check of a running dev-replace operation Core: - zoned mode space reservation fixes: - cap delayed refs metadata reservation to avoid overcommit - update logic to reclaim partially unusable zones - add another state to flush and reclaim partially used zone - limit number of zones reclaimed in one go to avoid blocking other operations - don't let log trees consume global reserve on overcommit and fall back to transaction commit - revalidate extent buffer when checking its up-to-date status - add self tests for zoned mode block group specifics - reduce atomic allocations in some qgroup paths - avoid unnecessary root node COW during snapshotting - start new transaction in block group relocation conditionally - faster check of NOCOW files on currently snapshotted root - change how compressed bio size is tracked from bio and reduce the structure size - new tracepoint for search slot restart tracking - checksum list manipulation improvements - type, parameter cleanups, refactoring - error handling improvements, transaction abort call adjustments" * tag 'for-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (116 commits) btrfs: btrfs_log_dev_io_error() on all bio errors btrfs: fix silent IO error loss in encoded writes and zoned split btrfs: skip clearing EXTENT_DEFRAG for NOCOW ordered extents btrfs: use BTRFS_FS_UPDATE_UUID_TREE_GEN flag for UUID tree rescan check btrfs: remove duplicate journal_info reset on failure to commit transaction btrfs: tag as unlikely if statements that check for fs in error state btrfs: fix double free in create_space_info() error path btrfs: fix double free in create_space_info_sub_group() error path btrfs: do not reject a valid running dev-replace btrfs: only invalidate btree inode pages after all ebs are released btrfs: prevent direct reclaim during compressed readahead btrfs: replace BUG_ON() with error return in cache_save_setup() btrfs: zstd: don't cache sectorsize in a local variable btrfs: zlib: don't cache sectorsize in a local variable btrfs: zlib: drop redundant folio address variable btrfs: lzo: inline read/write length helpers btrfs: use common eb range validation in read_extent_buffer_to_user_nofault() btrfs: read eb folio index right before loops btrfs: rename local variable for offset in folio btrfs: unify types for binary search variables ... commit 23acda7c221a76ff711d65f4ca90029d43b249a0 Merge: 7fe6ac157b7e15 c5e9f6a96bf737 Author: Linus Torvalds Date: Mon Apr 13 16:22:30 2026 -0700 Merge tag 'for-7.1/io_uring-20260411' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring updates from Jens Axboe: - Add a callback driven main loop for io_uring, and BPF struct_ops on top to allow implementing custom event loop logic - Decouple IOPOLL from being a ring-wide all-or-nothing setting, allowing IOPOLL use cases to also issue certain white listed non-polled opcodes - Timeout improvements. Migrate internal timeout storage from timespec64 to ktime_t for simpler arithmetic and avoid copying of timespec data - Zero-copy receive (zcrx) updates: - Add a device-less mode (ZCRX_REG_NODEV) for testing and experimentation where data flows through the copy fallback path - Fix two-step unregistration regression, DMA length calculations, xarray mark usage, and a potential 32-bit overflow in id shifting - Refactoring toward multi-area support: dedicated refill queue struct, consolidated DMA syncing, netmem array refilling format, and guard-based locking - Zero-copy transmit (zctx) cleanup: - Unify io_send_zc() and io_sendmsg_zc() into a single function - Add vectorized registered buffer send for IORING_OP_SEND_ZC - Add separate notification user_data via sqe->addr3 so notification and completion CQEs can be distinguished without extra reference counting - Switch struct io_ring_ctx internal bitfields to explicit flag bits with atomic-safe accessors, and annotate the known harmless races on those flags - Various optimizations caching ctx and other request fields in local variables to avoid repeated loads, and cleanups for tctx setup, ring fd registration, and read path early returns * tag 'for-7.1/io_uring-20260411' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (58 commits) io_uring: unify getting ctx from passed in file descriptor io_uring/register: don't get a reference to the registered ring fd io_uring/tctx: clean up __io_uring_add_tctx_node() error handling io_uring/tctx: have io_uring_alloc_task_context() return tctx io_uring/timeout: use 'ctx' consistently io_uring/rw: clean up __io_read() obsolete comment and early returns io_uring/zcrx: use correct mmap off constants io_uring/zcrx: use dma_len for chunk size calculation io_uring/zcrx: don't clear not allocated niovs io_uring/zcrx: don't use mark0 for allocating xarray io_uring: cast id to u64 before shifting in io_allocate_rbuf_ring() io_uring/zcrx: reject REG_NODEV with large rx_buf_size io_uring/cancel: validate opcode for IORING_ASYNC_CANCEL_OP io_uring/rsrc: use io_cache_free() to free node io_uring/zcrx: rename zcrx [un]register functions io_uring/zcrx: check ctrl op payload struct sizes io_uring/zcrx: cache fallback availability in zcrx ctx io_uring/zcrx: warn on a repeated area append io_uring/zcrx: consolidate dma syncing io_uring/zcrx: netmem array as refiling format ... commit 8b0c25528cb64f71a73b5c0d49cbbcb68540a4ce Author: Greg Kroah-Hartman Date: Sat Apr 11 12:45:25 2026 +0200 bnge: return after auxiliary_device_uninit() in error path When auxiliary_device_add() fails, the error block calls auxiliary_device_uninit() but does not return. The uninit drops the last reference and synchronously runs bnge_aux_dev_release(), which sets bd->auxr_dev = NULL and frees the underlying object. The subsequent bd->auxr_dev->net = bd->netdev then dereferences NULL, which is not a good thing to have happen when trying to clean up from an error. Add the missing return, as the auxiliary bus documentation states is a requirement (seems that LLM tools read documentation better than humans do...) Cc: Vikas Gupta Cc: Andrew Lunn Fixes: 8ac050ec3b1c ("bng_en: Add RoCE aux device support") Cc: stable Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026041124-banshee-molecular-0f70@gregkh Signed-off-by: Jakub Kicinski commit d46515ec0b1d4ae07f8f437515c43cfb6eb61ffa Author: Evan Ducas Date: Sun Mar 8 14:07:34 2026 -0400 docs: security: ipe: fix typos and grammar Fix several spelling and grammar mistakes in the IPE documentation. No functional change. Signed-off-by: Evan Ducas Acked-by: Bagas Sanjaya Acked-by: Randy Dunlap Signed-off-by: Fan Wu commit c058bbf05b1197c33df7204842665bd8bc70b3a8 Author: Kuniyuki Iwashima Date: Fri Apr 10 23:53:27 2026 +0000 tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init(). Commit de5626b95e13 ("tcp: Factorise cookie-independent fields initialisation in cookie_v[46]_check().") miscategorised tcp_rsk(req)->req_usec_ts init to cookie_tcp_reqsk_init(), which is used by both BPF/non-BPF SYN cookie reqsk. Rather, it should have been moved to cookie_tcp_reqsk_alloc() by commit 8e7bab6b9652 ("tcp: Factorise cookie-dependent fields initialisation in cookie_v[46]_check()") so that only non-BPF SYN cookie sets tcp_rsk(req)->req_usec_ts to false. Let's move the initialisation to cookie_tcp_reqsk_alloc() to respect bpf_tcp_req_attrs.usec_ts_ok. Fixes: e472f88891ab ("bpf: tcp: Support arbitrary SYN Cookie.") Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260410235328.1773449-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit b635f2ecdb5ad34f9c967cabb704d6bed9382fd0 Author: Guangshuo Li Date: Fri Apr 10 20:47:26 2026 +0800 f2fs: fix uninitialized kobject put in f2fs_init_sysfs() In f2fs_init_sysfs(), all failure paths after kset_register() jump to put_kobject, which unconditionally releases both f2fs_tune and f2fs_feat. If kobject_init_and_add(&f2fs_feat, ...) fails, f2fs_tune has not been initialized yet, so calling kobject_put(&f2fs_tune) is invalid. Fix this by splitting the unwind path so each error path only releases objects that were successfully initialized. Fixes: a907f3a68ee26ba4 ("f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5909bedbed38c558bee7cb6758ceedf9bc3a9194 Author: Yongpeng Yang Date: Fri Apr 10 23:05:39 2026 +0800 f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() In f2fs_sbi_show(), the extension_list, extension_count and hot_ext_count are read without holding sbi->sb_lock. If a concurrent sysfs store modifies the extension list via f2fs_update_extension_list(), the show path may read inconsistent count and array contents, potentially leading to out-of-bounds access or displaying stale data. Fix this by holding sb_lock around the entire extension list read and format operation. Fixes: b6a06cbbb5f7 ("f2fs: support hot file extension") Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit b8b902fd57fbaec70eb5ae2f0ec12a650ae62d96 Author: Yongpeng Yang Date: Fri Apr 10 23:05:37 2026 +0800 f2fs: disallow setting an extension to both cold and hot An extension should not exist in both the cold and hot extension lists simultaneously. When adding a hot extension, check whether it already exists in the cold list, and vice versa. Reject the operation with -EINVAL if a conflict is found. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7fe6ac157b7e15c8976bd62ad7cb98e248884e83 Merge: b8f82cb0d84d00 36446de0c30c62 Author: Linus Torvalds Date: Mon Apr 13 15:51:31 2026 -0700 Merge tag 'for-7.1/block-20260411' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block updates from Jens Axboe: - Add shared memory zero-copy I/O support for ublk, bypassing per-I/O copies between kernel and userspace by matching registered buffer PFNs at I/O time. Includes selftests. - Refactor bio integrity to support filesystem initiated integrity operations and arbitrary buffer alignment. - Clean up bio allocation, splitting bio_alloc_bioset() into clear fast and slow paths. Add bio_await() and bio_submit_or_kill() helpers, unify synchronous bi_end_io callbacks. - Fix zone write plug refcount handling and plug removal races. Add support for serializing zone writes at QD=1 for rotational zoned devices, yielding significant throughput improvements. - Add SED-OPAL ioctls for Single User Mode management and a STACK_RESET command. - Add io_uring passthrough (uring_cmd) support to the BSG layer. - Replace pp_buf in partition scanning with struct seq_buf. - zloop improvements and cleanups. - drbd genl cleanup, switching to pre_doit/post_doit. - NVMe pull request via Keith: - Fabrics authentication updates - Enhanced block queue limits support - Workqueue usage updates - A new write zeroes device quirk - Tagset cleanup fix for loop device - MD pull requests via Yu Kuai: - Fix raid5 soft lockup in retry_aligned_read() - Fix raid10 deadlock with check operation and nowait requests - Fix raid1 overlapping writes on writemostly disks - Fix sysfs deadlock on array_state=clear - Proactive RAID-5 parity building with llbitmap, with write_zeroes_unmap optimization for initial sync - Fix llbitmap barrier ordering, rdev skipping, and bitmap_ops version mismatch fallback - Fix bcache use-after-free and uninitialized closure - Validate raid5 journal metadata payload size - Various cleanups - Various other fixes, improvements, and cleanups * tag 'for-7.1/block-20260411' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (146 commits) ublk: fix tautological comparison warning in ublk_ctrl_reg_buf scsi: bsg: fix buffer overflow in scsi_bsg_uring_cmd() block: refactor blkdev_zone_mgmt_ioctl MAINTAINERS: update ublk driver maintainer email Documentation: ublk: address review comments for SHMEM_ZC docs ublk: allow buffer registration before device is started ublk: replace xarray with IDA for shmem buffer index allocation ublk: simplify PFN range loop in __ublk_ctrl_reg_buf ublk: verify all pages in multi-page bvec fall within registered range ublk: widen ublk_shmem_buf_reg.len to __u64 for 4GB buffer support xfs: use bio_await in xfs_zone_gc_reset_sync block: add a bio_submit_or_kill helper block: factor out a bio_await helper block: unify the synchronous bi_end_io callbacks xfs: fix number of GC bvecs selftests/ublk: add read-only buffer registration test selftests/ublk: add filesystem fio verify test for shmem_zc selftests/ublk: add hugetlbfs shmem_zc test for loop target selftests/ublk: add shared memory zero-copy test selftests/ublk: add UBLK_F_SHMEM_ZC support for loop target ... commit ed78aeebef05212ef7dca93bd931e4eff67c113f Author: Yongpeng Yang Date: Fri Apr 3 22:40:17 2026 +0800 f2fs: fix node_cnt race between extent node destroy and writeback f2fs_destroy_extent_node() does not set FI_NO_EXTENT before clearing extent nodes. When called from f2fs_drop_inode() with I_SYNC set, concurrent kworker writeback can insert new extent nodes into the same extent tree, racing with the destroy and triggering f2fs_bug_on() in __destroy_extent_node(). The scenario is as follows: drop inode writeback - iput - f2fs_drop_inode // I_SYNC set - f2fs_destroy_extent_node - __destroy_extent_node - while (node_cnt) { write_lock(&et->lock) __free_extent_tree write_unlock(&et->lock) - __writeback_single_inode - f2fs_outplace_write_data - f2fs_update_read_extent_cache - __update_extent_tree_range // FI_NO_EXTENT not set, // insert new extent node } // node_cnt == 0, exit while - f2fs_bug_on(node_cnt) // node_cnt > 0 Additionally, __update_extent_tree_range() only checks FI_NO_EXTENT for EX_READ type, leaving EX_BLOCK_AGE updates completely unprotected. This patch set FI_NO_EXTENT under et->lock in __destroy_extent_node(), consistent with other callers (__update_extent_tree_range and __drop_extent_tree) and check FI_NO_EXTENT for both EX_READ and EX_BLOCK_AGE tree. Fixes: 3fc5d5a182f6 ("f2fs: fix to shrink read extent node in batches") Cc: stable@vger.kernel.org Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2a3db1e02ce08c14af04da70bb99e8a0a31eb9e8 Author: Jaegeuk Kim Date: Mon Mar 30 23:40:59 2026 +0000 f2fs: allow empty mount string for Opt_usr|grp|projjquota The fsparam_string_empty() gives an error when mounting without string, since its type is set to fsparam_flag in VFS. So, let's allow the flag as well. This addresses xfstests/f2fs/015 and f2fs/021. Fixes: d18535132523 ("f2fs: separate the options parsing and options checking") Reviewed-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit b80a95ccf1604a882bb153c45ccb4056e44c8edb Author: Gabriel Krisman Bertazi Date: Fri Apr 10 11:59:36 2026 -0400 udp: Force compute_score to always inline Back in 2024 I reported a 7-12% regression on an iperf3 UDP loopback thoughput test that we traced to the extra overhead of calling compute_score on two places, introduced by commit f0ea27e7bfe1 ("udp: re-score reuseport groups when connected sockets are present"). At the time, I pointed out the overhead was caused by the multiple calls, associated with cpu-specific mitigations, and merged commit 50aee97d1511 ("udp: Avoid call to compute_score on multiple sites") to jump back explicitly, to force the rescore call in a single place. Recently though, we got another regression report against a newer distro version, which a team colleague traced back to the same root-cause. Turns out that once we updated to gcc-13, the compiler got smart enough to unroll the loop, undoing my previous mitigation. Let's bite the bullet and __always_inline compute_score on both ipv4 and ipv6 to prevent gcc from de-optimizing it again in the future. These functions are only called in two places each, udpX_lib_lookup1 and udpX_lib_lookup2, so the extra size shouldn't be a problem and it is hot enough to be very visible in profilings. In fact, with gcc13, forcing the inline will prevent gcc from unrolling the fix from commit 50aee97d1511, so we don't end up increasing udpX_lib_lookup2 at all. I haven't recollected the results myself, as I don't have access to the machine at the moment. But the same colleague reported 4.67% inprovement with this patch in the loopback benchmark, solving the regression report within noise margins. Eric Dumazet reported no size change to vmlinux when built with clang. I report the same also with gcc-13: scripts/bloat-o-meter vmlinux vmlinux-inline add/remove: 0/2 grow/shrink: 4/0 up/down: 616/-416 (200) Function old new delta udp6_lib_lookup2 762 949 +187 __udp6_lib_lookup 810 975 +165 udp4_lib_lookup2 757 906 +149 __udp4_lib_lookup 871 986 +115 __pfx_compute_score 32 - -32 compute_score 384 - -384 Total: Before=35011784, After=35011984, chg +0.00% Fixes: 50aee97d1511 ("udp: Avoid call to compute_score on multiple sites") Reviewed-by: Eric Dumazet Acked-by: Willem de Bruijn Signed-off-by: Gabriel Krisman Bertazi Link: https://patch.msgid.link/20260410155936.654915-1-krisman@suse.de Signed-off-by: Jakub Kicinski commit b8f82cb0d84d00c04cdbdce42f67df71b8507e8b Merge: b206a6fb9a105b 3457a5ccacd34f Author: Linus Torvalds Date: Mon Apr 13 15:42:19 2026 -0700 Merge tag 'landlock-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull Landlock update from Mickaël Salaün: "This adds a new Landlock access right for pathname UNIX domain sockets thanks to a new LSM hook, and a few fixes" * tag 'landlock-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (23 commits) landlock: Document fallocate(2) as another truncation corner case landlock: Document FS access right for pathname UNIX sockets selftests/landlock: Simplify ruleset creation and enforcement in fs_test selftests/landlock: Check that coredump sockets stay unrestricted selftests/landlock: Audit test for LANDLOCK_ACCESS_FS_RESOLVE_UNIX selftests/landlock: Test LANDLOCK_ACCESS_FS_RESOLVE_UNIX selftests/landlock: Replace access_fs_16 with ACCESS_ALL in fs_test samples/landlock: Add support for named UNIX domain socket restrictions landlock: Clarify BUILD_BUG_ON check in scoping logic landlock: Control pathname UNIX domain socket resolution by path landlock: Use mem_is_zero() in is_layer_masks_allowed() lsm: Add LSM hook security_unix_find landlock: Fix kernel-doc warning for pointer-to-array parameters landlock: Fix formatting in tsync.c landlock: Improve kernel-doc "Return:" section consistency landlock: Add missing kernel-doc "Return:" sections selftests/landlock: Fix format warning for __u64 in net_test selftests/landlock: Skip stale records in audit_match_record() selftests/landlock: Drain stale audit records on init selftests/landlock: Fix socket file descriptor leaks in audit helpers ... commit 2258d1dffaf77bad190ac1cdd0a98db513c15232 Merge: 9ad24ba4085ebe dd66b42854705e Author: Jakub Kicinski Date: Mon Apr 13 15:40:52 2026 -0700 Merge branch 'octeon_ep_vf-fix-napi_build_skb-null-dereference' David Carlier says: ==================== octeon_ep_vf: fix napi_build_skb() NULL dereference napi_build_skb() can return NULL on allocation failure. In __octep_vf_oq_process_rx(), the result is used directly without a NULL check in both the single-buffer and multi-fragment paths, leading to a NULL pointer dereference. Patch 1 introduces a helper to deduplicate the ring index advance pattern, patch 2 adds the actual NULL checks. ==================== Link: https://patch.msgid.link/20260409184009.930359-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski commit dd66b42854705e4e4ee7f14d260f86c578bed3e3 Author: David Carlier Date: Thu Apr 9 19:40:09 2026 +0100 octeon_ep_vf: add NULL check for napi_build_skb() napi_build_skb() can return NULL on allocation failure. In __octep_vf_oq_process_rx(), the result is used directly without a NULL check in both the single-buffer and multi-fragment paths, leading to a NULL pointer dereference. Add NULL checks after both napi_build_skb() calls, properly advancing descriptors and consuming remaining fragments on failure. Fixes: 1cd3b407977c ("octeon_ep_vf: add Tx/Rx processing and interrupt support") Cc: stable@vger.kernel.org Signed-off-by: David Carlier Link: https://patch.msgid.link/20260409184009.930359-3-devnexen@gmail.com Signed-off-by: Jakub Kicinski commit 4e5bc3ff060e6a495117a164a1ce6df5cdf1454f Author: David Carlier Date: Thu Apr 9 19:40:08 2026 +0100 octeon_ep_vf: introduce octep_vf_oq_next_idx() helper Introduce octep_vf_oq_next_idx() to consolidate the repeated ring index advance and wraparound pattern in __octep_vf_oq_process_rx(). No functional change intended. Signed-off-by: David Carlier Link: https://patch.msgid.link/20260409184009.930359-2-devnexen@gmail.com Signed-off-by: Jakub Kicinski commit b206a6fb9a105be198cf2dc435ffa4ad7c75ddc2 Merge: 3ba310f2a3ca70 8dc51459ef702b Author: Linus Torvalds Date: Mon Apr 13 15:34:52 2026 -0700 Merge tag 'selinux-pr-20260410' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux update from Paul Moore: - Annotate a known race condition to soothe KCSAN * tag 'selinux-pr-20260410' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: annotate intentional data race in inode_doinit_with_dentry() commit 9ad24ba4085ebee5419cdd0dcc71050dda99af68 Merge: e7a62edd34b1b4 7809fea20c9404 Author: Jakub Kicinski Date: Mon Apr 13 15:34:09 2026 -0700 Merge branch 'net-qrtr-ns-a-bunch-of-fixs' Manivannan Sadhasivam says: ==================== net: qrtr: ns: A bunch of fixs This series fixes a bunch of possible memory exhaustion issues in the QRTR nameserver. ==================== Link: https://patch.msgid.link/20260409-qrtr-fix-v3-0-00a8a5ff2b51@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 7809fea20c9404bfcfa6112ec08d1fe1d3520beb Author: Manivannan Sadhasivam Date: Thu Apr 9 23:04:16 2026 +0530 net: qrtr: ns: Fix use-after-free in driver remove() In the remove callback, if a packet arrives after destroy_workqueue() is called, but before sock_release(), the qrtr_ns_data_ready() callback will try to queue the work, causing use-after-free issue. Fix this issue by saving the default 'sk_data_ready' callback during qrtr_ns_init() and use it to replace the qrtr_ns_data_ready() callback at the start of remove(). This ensures that even if a packet arrives after destroy_workqueue(), the work struct will not be dereferenced. Note that it is also required to ensure that the RX threads are completed before destroying the workqueue, because the threads could be using the qrtr_ns_data_ready() callback. Cc: stable@vger.kernel.org Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace") Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260409-qrtr-fix-v3-5-00a8a5ff2b51@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 27d5e84e810b0849d08b9aec68e48570461ce313 Author: Manivannan Sadhasivam Date: Thu Apr 9 23:04:15 2026 +0530 net: qrtr: ns: Limit the total number of nodes Currently, the nameserver doesn't limit the number of nodes it handles. This can be an attack vector if a malicious client starts registering random nodes, leading to memory exhaustion. Hence, limit the maximum number of nodes to 64. Note that, limit of 64 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased. Cc: stable@vger.kernel.org Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace") Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260409-qrtr-fix-v3-4-00a8a5ff2b51@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 68efba36446a7774ea5b971257ade049272a07ac Author: Manivannan Sadhasivam Date: Thu Apr 9 23:04:14 2026 +0530 net: qrtr: ns: Free the node during ctrl_cmd_bye() A node sends the BYE packet when it is about to go down. So the nameserver should advertise the removal of the node to all remote and local observers and free the node finally. But currently, the nameserver doesn't free the node memory even after processing the BYE packet. This causes the node memory to leak. Hence, remove the node from Xarray list and free the node memory during both success and failure case of ctrl_cmd_bye(). Cc: stable@vger.kernel.org Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace") Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260409-qrtr-fix-v3-3-00a8a5ff2b51@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 5640227d9a21c6a8be249a10677b832e7f40dc55 Author: Manivannan Sadhasivam Date: Thu Apr 9 23:04:13 2026 +0530 net: qrtr: ns: Limit the maximum number of lookups Current code does no bound checking on the number of lookups a client can perform. Though the code restricts the lookups to local clients, there is still a possibility of a malicious local client sending a flood of NEW_LOOKUP messages over the same socket. Fix this issue by limiting the maximum number of lookups to 64 globally. Since the nameserver allows only atmost one local observer, this global lookup count will ensure that the lookups stay within the limit. Note that, limit of 64 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased. Cc: stable@vger.kernel.org Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace") Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260409-qrtr-fix-v3-2-00a8a5ff2b51@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit d5ee2ff98322337951c56398e79d51815acbf955 Author: Manivannan Sadhasivam Date: Thu Apr 9 23:04:12 2026 +0530 net: qrtr: ns: Limit the maximum server registration per node Current code does no bound checking on the number of servers added per node. A malicious client can flood NEW_SERVER messages and exhaust memory. Fix this issue by limiting the maximum number of server registrations to 256 per node. If the NEW_SERVER message is received for an old port, then don't restrict it as it will get replaced. While at it, also rate limit the error messages in the failure path of qrtr_ns_worker(). Note that the limit of 256 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased. Cc: stable@vger.kernel.org Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace") Reported-by: Yiming Qian Reviewed-by: Simon Horman Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260409-qrtr-fix-v3-1-00a8a5ff2b51@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 3ba310f2a3ca70f0497aab5c2e8aa85a12e19406 Merge: de639344bbe962 82544d36b17291 Author: Linus Torvalds Date: Mon Apr 13 15:17:28 2026 -0700 Merge tag 'lsm-pr-20260410' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull LSM updates from Paul Moore: "We only have five patches in the LSM tree, but three of the five are for an important bugfix relating to overlayfs and the mmap() and mprotect() access controls for LSMs. Highlights below: - Fix problems with the mmap() and mprotect() LSM hooks on overlayfs As we are dealing with problems both in mmap() and mprotect() there are essentially two components to this fix, spread across three patches with all marked for stable. The simplest portion of the fix is the creation of a new LSM hook, security_mmap_backing_file(), that is used to enforce LSM mmap() access controls on backing files in the stacked/overlayfs case. The existing security_mmap_file() does not have visibility past the user file. You can see from the associated SELinux hook callback the code is fairly straightforward. The mprotect() fix is a bit more complicated as there is no way in the mprotect() code path to inspect both the user and backing files, and bolting on a second file reference to vm_area_struct wasn't really an option. The solution taken here adds a LSM security blob and associated hooks to the backing_file struct that LSMs can use to capture and store relevant information from the user file. While the necessary SELinux information is relatively small, a single u32, I expect other LSMs to require more than that, and a dedicated backing_file LSM blob provides a storage mechanism without negatively impacting other filesystems. I want to note that other LSMs beyond SELinux have been involved in the discussion of the fixes presented here and they are working on their own related changes using these new hooks, but due to other issues those patches will be coming at a later date. - Use kstrdup_const()/kfree_const() for securityfs symlink targets - Resolve a handful of kernel-doc warnings in cred.h" * tag 'lsm-pr-20260410' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: selinux: fix overlayfs mmap() and mprotect() access checks lsm: add backing_file LSM hooks fs: prepare for adding LSM blob to backing_file securityfs: use kstrdup_const() to manage symlink targets cred: fix kernel-doc warnings in cred.h commit de639344bbe962985e3de22cc8d1388b016c1e54 Merge: ef3da345ccb1fd 360160f75592bd Author: Linus Torvalds Date: Mon Apr 13 14:56:54 2026 -0700 Merge tag 'audit-pr-20260410' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: - Improved handling of unknown status requests from userspace The current kernel code ignores unknown/unused request bits sent from userspace and returns an error code based on the results of the request(s) it does understand. The patch from Ricardo fixes this so that unknown requests return an -EINVAL to userspace, making compatibility a bit easier moving forward. - A number of small style and formatting cleanups * tag 'audit-pr-20260410' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: handle unknown status requests in audit_receive_msg() audit: fix coding style issues audit: remove redundant initialization of static variables to 0 audit: fix whitespace alignment in include/uapi/linux/audit.h commit 2e652049a4db27d052f9c987710920ed328a70e9 Merge: 1b9707e6f1a9d5 5b75e7d6769557 Author: Jakub Kicinski Date: Mon Apr 13 14:56:33 2026 -0700 Merge branch 'net-move-getsockopt-away-from-__user-buffers' Breno Leitao says: ==================== net: move .getsockopt away from __user buffers Currently, the .getsockopt callback requires __user pointers: int (*getsockopt)(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen); This prevents kernel callers (io_uring, BPF) from using getsockopt on levels other than SOL_SOCKET, since they pass kernel pointers. Following Linus' suggestion [0], this series introduces sockopt_t, a type-safe wrapper around iov_iter, and a getsockopt_iter callback that works with both user and kernel buffers. AF_PACKET and CAN raw are converted as initial users, with selftests covering the trickiest conversion patterns. [0] https://lore.kernel.org/all/CAHk-=whmzrO-BMU=uSVXbuoLi-3tJsO=0kHj1BCPBE3F2kVhTA@mail.gmail.com/ ==================== Link: https://patch.msgid.link/20260408-getsockopt-v3-0-061bb9cb355d@debian.org Signed-off-by: Jakub Kicinski commit 5b75e7d6769557fbee2ae46181deaff0c98ca795 Author: Breno Leitao Date: Wed Apr 8 03:30:32 2026 -0700 can: raw: convert to getsockopt_iter Convert CAN raw socket's getsockopt implementation to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) and returned size (output) - Use copy_to_iter() instead of copy_to_user() - For CAN_RAW_FILTER and CAN_RAW_XL_VCID_OPTS: on -ERANGE, set opt->optlen to the required buffer size. The wrapper writes this back to userspace even on error, preserving the existing API that lets userspace discover the needed allocation size. Signed-off-by: Breno Leitao Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260408-getsockopt-v3-4-061bb9cb355d@debian.org Signed-off-by: Jakub Kicinski commit 9c99d62705692db7fc8b8921efa0db189e84e694 Author: Breno Leitao Date: Wed Apr 8 03:30:31 2026 -0700 af_packet: convert to getsockopt_iter Convert AF_PACKET's getsockopt implementation to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) and returned size (output) - Use copy_to_iter() instead of put_user()/copy_to_user() - For PACKET_HDRLEN which reads from optval: use opt->iter_in with copy_from_iter() for the input read, then the common opt->iter_out copy_to_iter() epilogue handles the output Signed-off-by: Breno Leitao Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260408-getsockopt-v3-3-061bb9cb355d@debian.org Signed-off-by: Jakub Kicinski commit 5bd0dec150f56b6307d599132dcb7c01007bbecc Author: Breno Leitao Date: Wed Apr 8 03:30:30 2026 -0700 net: call getsockopt_iter if available Update do_sock_getsockopt() to use the new getsockopt_iter callback when available. Add do_sock_getsockopt_iter() helper that: 1. Reads optlen from user/kernel space 2. Initializes a sockopt_t with the appropriate iov_iter (kvec for kernel, ubuf for user buffers) and sets opt.optlen 3. Calls the protocol's getsockopt_iter callback 4. Writes opt.optlen back to user/kernel space The optlen is always written back, even on failure. Some protocols (e.g. CAN raw) return -ERANGE and set optlen to the required buffer size so userspace knows how much to allocate. The callback is responsible for setting opt.optlen to indicate the returned data size. Important to say that iov_out does not need to be copied back in do_sock_getsockopt(). When optval is not kernel (the userspace path), sockptr_to_sockopt() sets up opt->iter_out as a ITER_DEST ubuf iterator pointing directly at the userspace buffer (optval.user). So when getsockopt_iter implementations call copy_to_iter(..., &opt->iter_out), the data is written directly to userspace — no intermediate kernel buffer is involved. When optval.is_kernel is true (the in-kernel path, e.g. from io_uring), the kvec points at the already-provided kernel buffer (optval.kernel), so the data lands in the caller's buffer directly via the kvec-backed iterator. In both cases the iterator writes to the final destination in-place at protocol callback. There's nothing to copy back — only optlen needs to be written back. Signed-off-by: Breno Leitao Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260408-getsockopt-v3-2-061bb9cb355d@debian.org Signed-off-by: Jakub Kicinski commit 67fab22a7adcec0279b9b057eb3dc669e32834f0 Author: Breno Leitao Date: Wed Apr 8 03:30:29 2026 -0700 net: add getsockopt_iter callback to proto_ops Add a new getsockopt_iter callback to struct proto_ops that uses sockopt_t, a type-safe wrapper around iov_iter. This provides a clean interface for socket option operations that works with both user and kernel buffers. The sockopt_t type encapsulates an iov_iter and an optlen field. The optlen field, although not suggested by Linus, serves as both input (buffer size) and output (returned data size), allowing callbacks to return random values independent of the bytes written via copy_to_iter(), so, keep it separated from iov_iter.count. This is preparatory work for removing the SOL_SOCKET level restriction from io_uring getsockopt operations. Keep in mind that both iter_out and iter_in always point to the same data at all times, and we just have two of them to make the callback implementation sane. Suggested-by: Linus Torvalds Signed-off-by: Breno Leitao Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260408-getsockopt-v3-1-061bb9cb355d@debian.org Signed-off-by: Jakub Kicinski commit 8c787b286f39c7584440b97b92f87cbe934c13ff Author: Tushar Sariya Date: Sat Apr 4 11:58:03 2026 -0230 NFSv4.1: Apply session size limits on clone path nfs4_clone_server() builds a child nfs_server for same-server automounted submounts but never calls nfs4_session_limit_rwsize() or nfs4_session_limit_xasize() after nfs_clone_server(). This means the child mount can end up with rsize/wsize values that exceed the negotiated session channel limits, causing NFS4ERR_REQ_TOO_BIG and EIO on servers that enforce tight max_request_size budgets. Top-level mounts go through nfs4_server_common_setup() which calls these limiters after nfs_probe_server(). Apply the same clamping on the clone path for consistency. Fixes: 2b092175f5e3 ("NFS: Fix inheritance of the block sizes when automounting") Cc: stable@vger.kernel.org Signed-off-by: Tushar Sariya Signed-off-by: Trond Myklebust commit 515af10044f1c0d6f4356fcfb313465f02f484e9 Author: Olga Kornievskaia Date: Fri Apr 10 12:48:05 2026 -0400 NFSv4: retry GETATTR if GET_DIR_DELEGATION failed Currently, getting a directory delegation is opportinistic and gets added to an existing GETATTR that's trying to retrieve some needed attributes. However, GET_DIRDELEGATION can fail and that currently causes a GETATTR to fail and an error is propagated to the user. Instead, the original GETATTR should be retried without requesting a directory delegation. Also, now chosing to clear asking for the direct delegation for this specific inode. Fixes: 156b09482933 ("NFS: Request a directory delegation on ACCESS, CREATE, and UNLINK") Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit 4fa7ab8d292b1d4271fad397d98ea440e474cd7f Author: Olga Kornievskaia Date: Thu Apr 2 19:12:36 2026 -0400 NFS: fix RENAME attr in presence of directory delegations Since commit 6f9bda2337f8 ("NFS: Fix directory delegation verifier checks") xfstest generic/309 is failing because after the rename (mv) operation, client's mtime/ctime is the same. Update the delegated mtime when directory delegations are present in rename. Fixes: 6f9bda2337f8 ("NFS: Fix directory delegation verifier checks") Signed-off-by: Olga Kornievskaia Reviewed-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit e7a62edd34b1b4bc5f979988efc2f81c075733fd Author: Maxime Chevallier Date: Fri Apr 10 19:10:20 2026 +0200 net: phy: qcom: at803x: Use the correct bit to disable extended next page As noted in the blamed commit, the AR8035 and other PHYs from this family advertise the Extended Next Page support by default, which may be understood by some partners as this PHY being multi-gig capable. The fix is to disable XNP advertising, which is done by setting bit 12 of the Auto-Negotiation Advertisement Register (MII_ADVERTISE). The blamed commit incorrectly uses MDIO_AN_CTRL1_XNP, which is bit 13 as per 802.3 : 45.2.7.1 AN control register (Register 7.0) BIT 12 in MII_ADVERTISE is wrapped by ADVERTISE_RESV, used by some drivers such as the aquantia one. 802.3 Clause 28 defines bit 12 as Extended Next Page ability, at least in recent versions of the standard. Let's add a define for it and use it in the at803x driver. Fixes: 3c51fa5d2afe ("net: phy: ar803x: disable extended next page bit") Signed-off-by: Maxime Chevallier Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260410171021.1277138-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 1b9707e6f1a9d5f9e1b91750f24743108b093e2b Author: Russell King (Oracle) Date: Fri Apr 10 14:07:51 2026 +0100 net: stmmac: enable RPS and RBU interrupts Enable receive process stopped and receive buffer unavailable interrupts, so that the statistic counters can be updated. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1wBBaR-0000000GZHR-1dbM@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e9dc62f25ba63773a62a1a5cacd7a487ae3185ee Merge: bc174d054986ac c347ca17d62a32 Author: Jakub Kicinski Date: Mon Apr 13 14:26:02 2026 -0700 Merge tag 'for-net-next-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: core: - hci_core: Rate limit the logging of invalid ISO handle - hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - hci_event: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - hci_event: fix potential UAF in SSP passkey handlers - HCI: Avoid a couple -Wflex-array-member-not-at-end warnings - L2CAP: CoC: Disconnect if received packet size exceeds MPS - L2CAP: Add missing chan lock in l2cap_ecred_reconf_rsp - L2CAP: Fix printing wrong information if SDU length exceeds MTU - SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec drivers: - btusb: MT7922: Add VID/PID 0489/e174 - btusb: Add Lite-On 04ca:3807 for MediaTek MT7921 - btusb: Add MT7927 IDs ASUS ROG Crosshair X870E Hero, Lenovo Legion Pro 7 16ARX9, Gigabyte Z790 AORUS MASTER X, MSI X870E Ace Max, TP-Link Archer TBE550E, ASUS X870E / ProArt X870E-Creator. - btusb: Add MT7902 IDs 13d3/3579, 13d3/3580, 13d3/3594, 13d3/3596, 0e8d/1ede - btusb: Add MT7902 IDs 13d3/3579, 13d3/3580, 13d3/3594, 13d3/3596, 0e8d/1ede - btusb: MediaTek MT7922: Add VID 0489 & PID e11d - btintel: Add support for Scorpious Peak2 support - btintel: Add support for Scorpious Peak2F support - btintel_pcie: Add device id of Scorpius Peak2, Nova Lake-PCD-H - btintel_pcie: Add device id of Scorpious2, Nova Lake-PCD-S - btmtk: Add reset mechanism if downloading firmware failed - btmtk: Add MT6639 (MT7927) Bluetooth support - btmtk: fix ISO interface setup for single alt setting - btmtk: add MT7902 SDIO support - Bluetooth: btmtk: add MT7902 MCU support - btbcm: Add entry for BCM4343A2 UART Bluetooth - qca: enable pwrseq support for wcn39xx devices - hci_qca: Fix BT not getting powered-off on rmmod - hci_qca: disable power control for WCN7850 when bt_en is not defined - hci_qca: Fix missing wakeup during SSR memdump handling - hci_ldisc: Clear HCI_UART_PROTO_INIT on error - mmc: sdio: add MediaTek MT7902 SDIO device ID - hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x * tag 'for-net-next-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (59 commits) Bluetooth: hci_qca: Fix missing wakeup during SSR memdump handling Bluetooth: btintel_pcie: use strscpy to copy plain strings Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Bluetooth: hci.h: Avoid a couple -Wflex-array-member-not-at-end warnings Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec Bluetooth: btintel_pcie: Align shared DMA memory to 128 bytes Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp Bluetooth: hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x Bluetooth: btusb: MediaTek MT7922: Add VID 0489 & PID e11d Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array Bluetooth: btusb: Add MT7927 ID for ASUS X870E / ProArt X870E-Creator Bluetooth: btusb: Add MT7927 ID for TP-Link Archer TBE550E Bluetooth: btusb: Add MT7927 ID for MSI X870E Ace Max Bluetooth: btusb: Add MT7927 ID for Gigabyte Z790 AORUS MASTER X Bluetooth: btusb: Add MT7927 ID for Lenovo Legion Pro 7 16ARX9 Bluetooth: btusb: Add MT7927 ID for ASUS ROG Crosshair X870E Hero Bluetooth: btmtk: fix ISO interface setup for single alt setting Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER Bluetooth: btmtk: refactor endpoint lookup ... ==================== Link: https://patch.msgid.link/20260413132247.320961-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit ef3da345ccb1fd70e2288b821301698483c6c35a Merge: 07c3ef58223e2c 97b67e64affb0e Author: Linus Torvalds Date: Mon Apr 13 14:20:11 2026 -0700 Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "Features: - coredump: add tracepoint for coredump events - fs: hide file and bfile caches behind runtime const machinery Fixes: - fix architecture-specific compat_ftruncate64 implementations - dcache: Limit the minimal number of bucket to two - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - fs/mbcache: cancel shrink work before destroying the cache - dcache: permit dynamic_dname()s up to NAME_MAX Cleanups: - remove or unexport unused fs_context infrastructure - trivial ->setattr cleanups - selftests/filesystems: Assume that TIOCGPTPEER is defined - writeback: fix kernel-doc function name mismatch for wb_put_many() - autofs: replace manual symlink buffer allocation in autofs_dir_symlink - init/initramfs.c: trivial fix: FSM -> Finite-state machine - fs: remove stale and duplicate forward declarations - readdir: Introduce dirent_size() - fs: Replace user_access_{begin/end} by scoped user access - kernel: acct: fix duplicate word in comment - fs: write a better comment in step_into() concerning .mnt assignment - fs: attr: fix comment formatting and spelling issues" * tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits) dcache: permit dynamic_dname()s up to NAME_MAX fs: attr: fix comment formatting and spelling issues fs: hide file and bfile caches behind runtime const machinery fs: write a better comment in step_into() concerning .mnt assignment proc: rename proc_notify_change to proc_setattr proc: rename proc_setattr to proc_nochmod_setattr affs: rename affs_notify_change to affs_setattr adfs: rename adfs_notify_change to adfs_setattr hfs: update comments on hfs_inode_setattr kernel: acct: fix duplicate word in comment fs: Replace user_access_{begin/end} by scoped user access readdir: Introduce dirent_size() coredump: add tracepoint for coredump events fs: remove do_sys_truncate fs: pass on FTRUNCATE_* flags to do_truncate fs: fix archiecture-specific compat_ftruncate64 fs: remove stale and duplicate forward declarations init/initramfs.c: trivial fix: FSM -> Finite-state machine autofs: replace manual symlink buffer allocation in autofs_dir_symlink fs/mbcache: cancel shrink work before destroying the cache ... commit 493c7eff3c2ffa94ce3c5e62172948a1e38b491e Author: Michał Winiarski Date: Sat Apr 11 00:49:48 2026 +0200 vfio/xe: Add a missing vfio_pci_core_release_dev() The driver is implementing its own .release(), which means that it needs to call vfio_pci_core_release_dev(). Add the missing call. Fixes: 1f5556ec8b9ef ("vfio/xe: Add device specific vfio_pci driver variant for Intel graphics") Reported-by: Niklas Schnelle Closes: https://lore.kernel.org/kvm/408e262c507e8fd628a71e39904fedd99fa0ee8e.camel@linux.ibm.com/ Cc: stable@vger.kernel.org Signed-off-by: Michał Winiarski Reviewed-by: Niklas Schnelle Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260410224948.900550-2-michal.winiarski@intel.com Signed-off-by: Alex Williamson commit 1b81ed612e12ea9df8c5cb6f0ddd4419fd0b8ac8 Author: Michał Winiarski Date: Sat Apr 11 00:49:47 2026 +0200 vfio/xe: Reorganize the init to decouple migration from reset Attempting to issue reset on VF devices that don't support migration leads to the following: BUG: unable to handle page fault for address: 00000000000011f8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 7443 Comm: xe_sriov_flr Tainted: G S U 7.0.0-rc1-lgci-xe-xe-4588-cec43d5c2696af219-nodebug+ #1 PREEMPT(lazy) Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023 RIP: 0010:xe_sriov_vfio_wait_flr_done+0xc/0x80 [xe] Code: ff c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 54 53 <83> bf f8 11 00 00 02 75 61 41 89 f4 85 f6 74 52 48 8b 47 08 48 89 RSP: 0018:ffffc9000f7c39b8 EFLAGS: 00010202 RAX: ffffffffa04d8660 RBX: ffff88813e3e4000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000f7c39c8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888101a48800 R13: ffff88813e3e4150 R14: ffff888130d0d008 R15: ffff88813e3e40d0 FS: 00007877d3d0d940(0000) GS:ffff88890b6d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000011f8 CR3: 000000015a762000 CR4: 0000000000f52ef0 PKRU: 55555554 Call Trace: xe_vfio_pci_reset_done+0x49/0x120 [xe_vfio_pci] pci_dev_restore+0x3b/0x80 pci_reset_function+0x109/0x140 reset_store+0x5c/0xb0 dev_attr_store+0x17/0x40 sysfs_kf_write+0x72/0x90 kernfs_fop_write_iter+0x161/0x1f0 vfs_write+0x261/0x440 ksys_write+0x69/0xf0 __x64_sys_write+0x19/0x30 x64_sys_call+0x259/0x26e0 do_syscall_64+0xcb/0x1500 ? __fput+0x1a2/0x2d0 ? fput_close_sync+0x3d/0xa0 ? __x64_sys_close+0x3e/0x90 ? x64_sys_call+0x1b7c/0x26e0 ? do_syscall_64+0x109/0x1500 ? __task_pid_nr_ns+0x68/0x100 ? __do_sys_getpid+0x1d/0x30 ? x64_sys_call+0x10b5/0x26e0 ? do_syscall_64+0x109/0x1500 ? putname+0x41/0x90 ? do_faccessat+0x1e8/0x300 ? __x64_sys_access+0x1c/0x30 ? x64_sys_call+0x1822/0x26e0 ? do_syscall_64+0x109/0x1500 ? tick_program_event+0x43/0xa0 ? hrtimer_interrupt+0x126/0x260 ? irqentry_exit+0xb2/0x710 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7877d5f1c5a4 Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d a5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 RSP: 002b:00007fff48e5f908 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007877d5f1c5a4 RDX: 0000000000000001 RSI: 00007877d621b0c9 RDI: 0000000000000009 RBP: 0000000000000001 R08: 00005fb49113b010 R09: 0000000000000007 R10: 0000000000000000 R11: 0000000000000202 R12: 00007877d621b0c9 R13: 0000000000000009 R14: 00007fff48e5fac0 R15: 00007fff48e5fac0 This is caused by the fact that some of the xe_vfio_pci_core_device members needed for handling reset are only initialized as part of migration init. Fix the problem by reorganizing the code to decouple VF init from migration init. Fixes: 1f5556ec8b9ef ("vfio/xe: Add device specific vfio_pci driver variant for Intel graphics") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7352 Cc: stable@vger.kernel.org Signed-off-by: Michał Winiarski Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260410224948.900550-1-michal.winiarski@intel.com Signed-off-by: Alex Williamson commit 94545ffc0ae8ae6ab6590e9d7fed4da8123060cb Author: Jenny Guanni Qu Date: Fri Mar 13 22:42:07 2026 +0000 pnfs/flexfiles: validate ds_versions_cnt is non-zero nfs4_ff_alloc_deviceid_node() reads version_count from XDR without checking it is non-zero. When a malicious NFS server sends a pNFS LAYOUTGET response with version_count=0, kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10). The subsequent ds_versions[0] access in nfs4_ff_layout_ds_version() and other callers dereferences this invalid pointer, causing an out-of-bounds read. Add a check for version_count == 0 after parsing it from XDR, before the allocation. The OOB read was confirmed with KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] from accessing ZERO_SIZE_PTR. Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") Reported-by: Klaudia Kloc Reported-by: Dawid Moczadło Tested-by: Jenny Guanni Qu Signed-off-by: Jenny Guanni Qu Signed-off-by: Trond Myklebust commit b0ed12538fdfeb39c844eba3fa4c269ddb4ebca7 Author: Christoph Hellwig Date: Mon Mar 23 08:03:06 2026 +0100 NFS/blocklayout: print each device used for SCSI layouts We already print device uses for block layouts, do the same for SCSI layouts as that greatly helps understanding the operation of the client. Signed-off-by: Christoph Hellwig Signed-off-by: Trond Myklebust commit bc174d054986ac5767828e6fbb3371f3474fbbd8 Author: Alok Tiwari Date: Thu Apr 9 02:27:47 2026 -0700 mlx4: correct error reporting in mlx4_master_process_vhcr() mlx4_master_process_vhcr() logs vhcr->errno on failures, but this field is never populated by the PF path. As a result, all failures are reported with errno 0 and err print in status case which is misleading. Use the actual return value (err) instead, translate it to FW status before logging, and report both values. Signed-off-by: Alok Tiwari Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260409092754.508880-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 07c3ef58223e2c75ea209d8c416b976ec30d9413 Merge: dc0dfa73381bc8 d29eb5f0ce674c Author: Linus Torvalds Date: Mon Apr 13 13:27:11 2026 -0700 Merge tag 'vfs-7.1-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull clone and pidfs updates from Christian Brauner: "Add three new clone3() flags for pidfd-based process lifecycle management. CLONE_AUTOREAP: CLONE_AUTOREAP makes a child process auto-reap on exit without ever becoming a zombie. This is a per-process property in contrast to the existing auto-reap mechanism via SA_NOCLDWAIT or SIG_IGN for SIGCHLD which applies to all children of a given parent. Currently the only way to automatically reap children is to set SA_NOCLDWAIT or SIG_IGN on SIGCHLD. This is a parent-scoped property affecting all children which makes it unsuitable for libraries or applications that need selective auto-reaping of specific children while still being able to wait() on others. CLONE_AUTOREAP stores an autoreap flag in the child's signal_struct. When the child exits do_notify_parent() checks this flag and causes exit_notify() to transition the task directly to EXIT_DEAD. Since the flag lives on the child it survives reparenting: if the original parent exits and the child is reparented to a subreaper or init the child still auto-reaps when it eventually exits. This is cleaner than forcing the subreaper to get SIGCHLD and then reaping it. If the parent doesn't care the subreaper won't care. If there's a subreaper that would care it would be easy enough to add a prctl() that either just turns back on SIGCHLD and turns off auto-reaping or a prctl() that just notifies the subreaper whenever a child is reparented to it. CLONE_AUTOREAP can be combined with CLONE_PIDFD to allow the parent to monitor the child's exit via poll() and retrieve exit status via PIDFD_GET_INFO. Without CLONE_PIDFD it provides a fire-and-forget pattern. No exit signal is delivered so exit_signal must be zero. CLONE_THREAD and CLONE_PARENT are rejected: CLONE_THREAD because autoreap is a process-level property, and CLONE_PARENT because an autoreap child reparented via CLONE_PARENT could become an invisible zombie under a parent that never calls wait(). The flag is not inherited by the autoreap process's own children. Each child that should be autoreaped must be explicitly created with CLONE_AUTOREAP. CLONE_NNP: CLONE_NNP sets no_new_privs on the child at clone time. Unlike prctl(PR_SET_NO_NEW_PRIVS) which a process sets on itself, CLONE_NNP allows the parent to impose no_new_privs on the child at creation without affecting the parent's own privileges. CLONE_THREAD is rejected because threads share credentials. CLONE_NNP is useful on its own for any spawn-and-sandbox pattern but was specifically introduced to enable unprivileged usage of CLONE_PIDFD_AUTOKILL. CLONE_PIDFD_AUTOKILL: This flag ties a child's lifetime to the pidfd returned from clone3(). When the last reference to the struct file created by clone3() is closed the kernel sends SIGKILL to the child. A pidfd obtained via pidfd_open() for the same process does not keep the child alive and does not trigger autokill - only the specific struct file from clone3() has this property. This is useful for container runtimes, service managers, and sandboxed subprocess execution - any scenario where the child must die if the parent crashes or abandons the pidfd or just wants a throwaway helper process. CLONE_PIDFD_AUTOKILL requires both CLONE_PIDFD and CLONE_AUTOREAP. It requires CLONE_PIDFD because the whole point is tying the child's lifetime to the pidfd. It requires CLONE_AUTOREAP because a killed child with no one to reap it would become a zombie - the primary use case is the parent crashing or abandoning the pidfd so no one is around to call waitpid(). CLONE_THREAD is rejected because autokill targets a process not a thread. If CLONE_NNP is specified together with CLONE_PIDFD_AUTOKILL an unprivileged user may spawn a process that is autokilled. The child cannot escalate privileges via setuid/setgid exec after being spawned. If CLONE_PIDFD_AUTOKILL is specified without CLONE_NNP the caller must have have CAP_SYS_ADMIN in its user namespace" * tag 'vfs-7.1-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests: check pidfd_info->coredump_code correctness pidfds: add coredump_code field to pidfd_info kselftest/coredump: reintroduce null pointer dereference selftests/pidfd: add CLONE_PIDFD_AUTOKILL tests selftests/pidfd: add CLONE_NNP tests selftests/pidfd: add CLONE_AUTOREAP tests pidfd: add CLONE_PIDFD_AUTOKILL clone: add CLONE_NNP clone: add CLONE_AUTOREAP commit dc0dfa73381bc8b2ebd298face5dbe7e240cd80c Merge: fc825e513cd494 935a04923ad293 Author: Linus Torvalds Date: Mon Apr 13 13:02:49 2026 -0700 Merge tag 'namespaces-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull namespace update from Christian Brauner: "Add two simple helper macros for the namespace infrastructure" * tag 'namespaces-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: nsproxy: Add FOR_EACH_NS_TYPE() X-macro and CLONE_NS_ALL commit 52d652c7e178332ce767dbaf5035249c524d8a15 Author: Khushal Chitturi Date: Sun Apr 12 00:03:55 2026 +0530 dt-bindings: ARM: arm,vexpress-scc: convert to DT schema Convert the ARM Versatile Express Serial Configuration Controller bindings to DT schema. Signed-off-by: Khushal Chitturi Reviewed-by: Krzysztof Kozlowski Reviewed-by: Liviu Dudau Link: https://patch.msgid.link/20260411183355.8847-1-khushalchitturi@gmail.com Signed-off-by: Rob Herring (Arm) commit b74f2f7fb2bb8c651e322919342aeddf747d69f7 Author: Pengpeng Hou Date: Fri Apr 3 13:59:47 2026 +0800 drivers/of: fdt: validate flat DT string properties before string use Firmware-supplied flat DT properties are raw byte sequences. Several early FDT helpers fetch properties such as status, model, compatible, and device_type and then use them as C strings with strcmp(), strlen(), or pr_info() without first proving that the property is NUL-terminated within its declared length. Use fdt_stringlist_get() for these string properties instead. That preserves the existing behavior for valid DTBs while rejecting malformed unterminated properties before they are passed to C string helpers. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260403164501.1-drivers-of-fdt-v2-pengpeng@iscas.ac.cn Signed-off-by: Rob Herring (Arm) commit bb04fcc89a889ad7d5e3427cd1afddd924ef691c Author: Pengpeng Hou Date: Fri Apr 3 11:55:29 2026 +0800 drivers/of: fdt: validate stdout-path properties before parsing them early_init_dt_scan_chosen_stdout() fetches stdout-path and linux,stdout-path directly from the flat DT and immediately passes the result to strchrnul(). Flat DT properties are raw firmware-supplied byte sequences, and this path does not prove that either property is NUL-terminated within its declared bounds. Use fdt_stringlist_get() so malformed unterminated stdout-path properties are rejected before the local parser walks them as C strings. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260403143001.1-dt-fdt-stdout-pengpeng@iscas.ac.cn Signed-off-by: Rob Herring (Arm) commit 38fe5379504ffd300f8546249ffa0e8d0000e94c Author: Mukesh Ojha Date: Wed Apr 1 18:25:28 2026 +0530 dt-bindings: sram: Document qcom,hawi-imem compatible On Qualcomm Hawi platform, IMEM is a block of SRAM shared across multiple IP blocks which can fall back to "mmio-sram". Document its compatible. Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Link: https://patch.msgid.link/20260401125528.594108-1-mukesh.ojha@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 2452dcf4d740effff5aa71b7f6529ee8c04fd8f6 Author: Mathias Krause Date: Thu Apr 2 16:51:16 2026 +0200 kbuild: builddeb - avoid recompiles for non-cross-compiles Commit e2c318225ac1 ("kbuild: deb-pkg: add pkg.linux-upstream.nokernelheaders build profile") changed how install-extmod-build gets called, making it always rebuild the host programs below scripts/ if HOSTCC wasn't specified with its full triplet on the make command line. That is, apparently, needed to fix up commit f1d87664b82a ("kbuild: cross-compile linux-headers package when possible") for cross-compiles. However, in the much more common case of non-cross-compile builds this will lead to unnecessary rebuilding of host tools including gcc plugins. This, in turn, will lead to a full kernel rebuild on the next 'make bindeb-pkg' which is unfortunate. Avoid that by only triggering the rebuild of host tools for actual cross-compile builds. Signed-off-by: Mathias Krause Fixes: e2c318225ac1 ("kbuild: deb-pkg: add pkg.linux-upstream.nokernelheaders build profile") Cc: Masahiro Yamada Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20260402145116.1010901-1-minipli@grsecurity.net Signed-off-by: Nicolas Schier commit fc825e513cd494cfcbeb47acf5738fe64f3a9051 Merge: 2802f9407299c8 6e22726900ea54 Author: Linus Torvalds Date: Mon Apr 13 12:46:42 2026 -0700 Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs buffer_head updates from Christian Brauner: "This cleans up the mess that has accumulated over the years in metadata buffer_head tracking for inodes. It moves the tracking into dedicated structure in filesystem-private part of the inode (so that we don't use private_list, private_data, and private_lock in struct address_space), and also moves couple other users of private_data and private_list so these are removed from struct address_space saving 3 longs in struct inode for 99% of inodes" * tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (42 commits) fs: Drop i_private_list from address_space fs: Drop mapping_metadata_bhs from address space ext4: Track metadata bhs in fs-private inode part minix: Track metadata bhs in fs-private inode part udf: Track metadata bhs in fs-private inode part fat: Track metadata bhs in fs-private inode part bfs: Track metadata bhs in fs-private inode part affs: Track metadata bhs in fs-private inode part ext2: Track metadata bhs in fs-private inode part fs: Provide functions for handling mapping_metadata_bhs directly fs: Switch inode_has_buffers() to take mapping_metadata_bhs fs: Make bhs point to mapping_metadata_bhs fs: Move metadata bhs tracking to a separate struct fs: Fold fsync_buffers_list() into sync_mapping_buffers() fs: Drop osync_buffers_list() kvm: Use private inode list instead of i_private_list fs: Remove i_private_data aio: Stop using i_private_data and i_private_lock hugetlbfs: Stop using i_private_data fs: Stop using i_private_data for metadata bh tracking ... commit 2802f9407299c8e17bb8e1311e2ea7816f550649 Merge: b7d74ea0fdaa8d 94505767bd32f8 Author: Linus Torvalds Date: Mon Apr 13 12:40:26 2026 -0700 Merge tag 'vfs-7.1-rc1.fat' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull FAT updates from Christian Brauner: "Minor fixes for the fat filesystem" * tag 'vfs-7.1-rc1.fat' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fat: fix stack frame size warnings in KUnit tests fat: add KUnit tests for timestamp conversion helpers commit b7d74ea0fdaa8d641fe6f18507c5f0d21b652d53 Merge: 0f00132132937c 2e43ca1a4f949e Author: Linus Torvalds Date: Mon Apr 13 12:19:01 2026 -0700 Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs i_ino updates from Christian Brauner: "For historical reasons, the inode->i_ino field is an unsigned long, which means that it's 32 bits on 32 bit architectures. This has caused a number of filesystems to implement hacks to hash a 64-bit identifier into a 32-bit field, and deprives us of a universal identifier field for an inode. This changes the inode->i_ino field from an unsigned long to a u64. This shouldn't make any material difference on 64-bit hosts, but 32-bit hosts will see struct inode grow by at least 4 bytes. This could have effects on slabcache sizes and field alignment. The bulk of the changes are to format strings and tracepoints, since the kernel itself doesn't care that much about the i_ino field. The first patch changes some vfs function arguments, so check that one out carefully. With this change, we may be able to shrink some inode structures. For instance, struct nfs_inode has a fileid field that holds the 64-bit inode number. With this set of changes, that field could be eliminated. I'd rather leave that sort of cleanups for later just to keep this simple" * tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: nilfs2: fix 64-bit division operations in nilfs_bmap_find_target_in_group() EVM: add comment describing why ino field is still unsigned long vfs: remove externs from fs.h on functions modified by i_ino widening treewide: fix missed i_ino format specifier conversions ext4: fix signed format specifier in ext4_load_inode trace event treewide: change inode->i_ino from unsigned long to u64 nilfs2: widen trace event i_ino fields to u64 f2fs: widen trace event i_ino fields to u64 ext4: widen trace event i_ino fields to u64 zonefs: widen trace event i_ino fields to u64 hugetlbfs: widen trace event i_ino fields to u64 ext2: widen trace event i_ino fields to u64 cachefiles: widen trace event i_ino fields to u64 vfs: widen trace event i_ino fields to u64 net: change sock.sk_ino and sock_i_ino() to u64 audit: widen ino fields to u64 vfs: widen inode hash/lookup functions to u64 commit 45df9111692c62d5f09fc4345ae36dae31024797 Author: John Groves Date: Sun Apr 12 15:50:06 2026 +0000 dax/fsdev: fix uninitialized kaddr in fsdev_dax_zero_page_range() __fsdev_dax_direct_access() returns -EFAULT without setting *kaddr when dax_pgoff_to_phys() returns -1 (pgoff out of range). The return value was ignored, leaving kaddr uninitialized before being passed to fsdev_write_dax(). Check the return value and propagate the error. Thanks to Dan Carpenter and the smatch project for reporting this. Signed-off-by: John Groves Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://patch.msgid.link/0100019d8262cda2-9714d31c-8fc1-4ca5-b32d-4df678240d14-000000@email.amazonses.com Signed-off-by: Ira Weiny commit 704f3f640f72db4d44ec5ce3db8d4e150c974bc7 Author: Chuck Lever Date: Fri Mar 6 16:56:28 2026 -0500 xprtrdma: Post receive buffers after RPC completion rpcrdma_post_recvs() runs in CQ poll context and its cost falls on the latency-critical path between polling a Receive completion and waking the RPC consumer. Every cycle spent refilling the Receive Queue delays delivery of the reply to the NFS layer. Move the rpcrdma_post_recvs() call in rpcrdma_reply_handler() to after the RPC has been decoded and completed. The larger batch size from the preceding patch provides sufficient Receive Queue headroom to absorb the brief delay before buffers are replenished. Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit 93b4791adb1017b2b079b4a453e7159e101a7e55 Author: Chuck Lever Date: Fri Mar 6 16:56:27 2026 -0500 xprtrdma: Scale receive batch size with credit window The fixed RPCRDMA_MAX_RECV_BATCH of 7 results in frequent small ib_post_recv batches during high-rate workloads. With a 128-slot credit window, receives are reposted every 7th completion, each batch incurring atomic serialization and a doorbell write. Replace the fixed batch constant with a per-endpoint value scaled to 25% of the negotiated credit window. For a typical 128-credit connection this raises the batch from 7 to 32, reducing doorbell frequency by roughly 4x and amortizing the per-batch atomic and MMIO costs over a larger group of receive WRs. Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit 7a079ab57c4eeff241d9abfc1ec6477cb90a6206 Author: Chuck Lever Date: Fri Mar 6 16:56:26 2026 -0500 xprtrdma: Replace rpcrdma_mr_seg with xdr_buf cursor The FRWR registration path converts data through three representations: xdr_buf -> rpcrdma_mr_seg[] -> scatterlist[] -> ib_map_mr_sg(). The rpcrdma_mr_seg intermediate is a relic of when multiple registration strategies existed (FMR, physical, FRWR). Only FRWR remains, so this indirection and the 6240-byte rl_segments[260] array embedded in each rpcrdma_req serve no purpose. Introduce struct rpcrdma_xdr_cursor to track position within an xdr_buf during iterative MR registration. Rewrite frwr_map to populate scatterlist entries directly from the xdr_buf regions (head kvec, page list, tail kvec). The boundary logic for non-SG_GAPS devices is simpler because the xdr_buf structure guarantees that page-region entries after the first start at offset 0, and that head/tail kvecs are separate regions that naturally break at MR boundaries. Fix a pre-existing bug in rpcrdma_encode_write_list where the write-pad statistics accumulator added mr->mr_length from the last data MR rather than the write-pad MR. The refactored code uses ep->re_write_pad_mr->mr_length. Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit 6f2e565fb3bd68636e4920223e599d70861f8ba6 Author: Chuck Lever Date: Fri Mar 6 16:56:25 2026 -0500 xprtrdma: Decouple frwr_wp_create from frwr_map frwr_wp_create is the only caller of frwr_map outside the encode path. It registers a single 4-byte write-pad region from a stack- local rpcrdma_mr_seg. Inlining the registration logic directly (sg_init_table + sg_set_page + ib_dma_map_sg + ib_map_mr_sg + IOVA mangle + reg_wr setup) eliminates the coupling that would otherwise complicate the removal of rpcrdma_mr_seg from frwr_map's interface. The inlined version adds a proper error-unwind ladder: on failure, the DMA mapping (if established) is released, ep->re_write_pad_mr is cleared, and the MR is returned to the transport free list. The old frwr_map-based code relied on rpcrdma_mrs_destroy at teardown to reclaim partially-initialized MRs. This is a one-time setup path; duplicating ~20 lines is a reasonable tradeoff for decoupling the write-pad registration from the data- path MR registration. Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit 765bde47fe7f197dabeb12da76831f40d0b20377 Author: Chuck Lever Date: Fri Mar 6 16:56:24 2026 -0500 xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot xprt_rdma_alloc_slot() and xprt_rdma_free_slot() lack serialization between the buffer pool and the backlog queue. A buffer freed after rpcrdma_buffer_get() finds the pool empty but before rpc_sleep_on() places the task on the backlog is returned to the pool with no waiter to wake, leaving the task stuck on the backlog indefinitely. After joining the backlog, re-check the pool and route any recovered buffer through xprt_wake_up_backlog(), whose queue lock serializes with concurrent wakeups and avoids double-assignment of slots. Because xprt_rdma_free_slot() does not hold reserve_lock, the XPRT_CONGESTED double-check in xprt_throttle_congested() is ineffective: a task can join the backlog through that path after free_slot has already found it empty and cleared the bit. Avoid this by using xprt_add_backlog_noncongested(), which queues the task without setting XPRT_CONGESTED, so every allocation reaches xprt_rdma_alloc_slot() and its post-sleep re-check. Fixes: edb41e61a54e ("xprtrdma: Make rpc_rqst part of rpcrdma_req") Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit 100142093e22b3f7741ac88e94878bb3694e306f Author: Chuck Lever Date: Fri Mar 6 16:56:23 2026 -0500 xprtrdma: Avoid 250 ms delay on backlog wakeup Commit a721035477fb ("SUNRPC/xprt: async tasks mustn't block waiting for memory") changed xprt_rdma_alloc_slot() to set tk_status to -ENOMEM so that call_reserveresult() would sleep HZ/4 before retrying. That rationale applies to xprt_dynamic_alloc_slot(), where an immediate retry under memory pressure wastes CPU, but not to the RDMA backlog path: a task woken from the backlog has a slot waiting for it, so the 250 ms rpc_delay adds latency without benefit. This also aligns the code with the existing kernel-doc for xprt_rdma_alloc_slot(), which already documented %-EAGAIN. Fixes: a721035477fb ("SUNRPC/xprt: async tasks mustn't block waiting for memory") Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit 24297c7cd3f9389374bb13d1ca578c335d2866b9 Author: Chuck Lever Date: Fri Mar 6 16:56:22 2026 -0500 xprtrdma: Close sendctx get/put race that can block a transport rpcrdma_sendctx_get_locked() and rpcrdma_sendctx_put_locked() can race in a way that leaves XPRT_WRITE_SPACE set permanently, blocking all further sends on the transport: get_locked put_locked (Send completion) ---------- -------------------------- read rb_sc_tail -> ring full advance rb_sc_tail xprt_write_space(): test_bit(WRITE_SPACE) -> not set, return set_bit(WRITE_SPACE) return NULL (-EAGAIN) After the sender releases XPRT_LOCKED, the release path refuses to wake the next task because XPRT_WRITE_SPACE is set. The sender retries, finds XPRT_WRITE_SPACE still set, and sleeps on xprt_sending. No further Send completions arrive to clear the flag because no new Sends can be posted. With nconnect, the stalled transport's share of congestion credits are never returned, starving the remaining transports as well. Fixes: 05eb06d86685 ("xprtrdma: Fix occasional transport deadlock") Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit 9c332d7f63401c3ff1765c9998531b3784f3f9a4 Author: Jeff Layton Date: Tue Mar 24 13:32:12 2026 -0400 nfs: update inode ctime after removexattr operation xfstest generic/728 fails with delegated timestamps. The client does a removexattr and then a stat to test the ctime, which doesn't change. The stat() doesn't trigger a GETATTR because of the delegated timestamps, so it relies on the cached ctime, which is wrong. The setxattr compound has a trailing GETATTR, which ensures that its ctime gets updated. Follow the same strategy with removexattr. Fixes: 3e1f02123fba ("NFSv4.2: add client side XDR handling for extended attributes") Reported-by: Olga Kornievskaia Signed-off-by: Jeff Layton Signed-off-by: Trond Myklebust commit 16d99dce938ecbbc703843a31fb951acca46af27 Author: Jeff Layton Date: Tue Mar 24 13:32:11 2026 -0400 nfs: fix utimensat() for atime with delegated timestamps xfstest generic/221 is failing with delegated timestamps enabled. When the client holds a WRITE_ATTRS_DELEG delegation, and a userland process does a utimensat() for only the atime, the ctime is not properly updated. The problem is that the client tries to cache the atime update, but there is no mtime update, so the delegated attribute update never updates the ctime. Delegated timestamps don't have a mechanism to update the ctime in accordance with atime-only changes due to utimensat() and the like. Change the client to issue an RPC in this case, so that the ctime gets properly updated alongside the atime. Fixes: 40f45ab3814f ("NFS: Further fixes to attribute delegation a/mtime changes") Reported-by: Olga Kornievskaia Signed-off-by: Jeff Layton Signed-off-by: Trond Myklebust commit 3a06bac55bf56290673ea67abe3d285f0ab3837a Author: Olga Kornievskaia Date: Fri Feb 20 16:42:18 2026 -0500 NFS: improve "Server wrote zero bytes" error When a pnfs error occurs, the IO is retried against the MDS. However, the initial IO leads to the kernel logging "Serer wrote zero bytes" when in fact the MDS IO will not fail and thus the error misleads administrators that the system is experiencing issues. When pnfs IO fails which triggers pnfs_write_done_resent_to_mds() which would end up clearing nfs_pgio_header's pages structure (copying the content into a new one to do new RPC calls to the MDS). Thus, in nfs_writeback_result() when we have no pages to work with no need to try and also therefore skip logging the message about 0bytes. Fixes: 6c75dc0d498c ("NFS: merge _full and _partial write rpc_ops") Suggested-by: Trond Myklebust Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit a47306a74c31557b1e5cab54642950bbb20294cb Author: Geoffrey D. Bennett Date: Tue Apr 14 03:03:00 2026 +0930 ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUP Same issue as the other 1st Gen Scarletts: QUIRK_FLAG_SKIP_IFACE_SETUP causes distorted audio on the Scarlett 18i20 1st Gen (1235:800c). Fixes: 38c322068a26 ("ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP") Reported-by: tucktuckg00se [https://github.com/geoffreybennett/linux-fcp/issues/54] Signed-off-by: Geoffrey D. Bennett Link: https://patch.msgid.link/ad0ozNnkcFrcjVQz@m.b4.vu Signed-off-by: Takashi Iwai commit 4224e91fea5695a89843b4c38283016616946307 Merge: b274423c79277a 7010f13acd3828 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:54 2026 -0500 Merge branch 'pci/misc' - Warn only once about invalid ACS kernel parameter format (Richard Cheng) - Suppress FW_BUG warning when writing sysfs 'numa_node' with the current value (Li RongQing) - Drop redundant 'depends on PCI' from Kconfig (Julian Braha) * pci/misc: PCI: Clean up dead code in Kconfig PCI/sysfs: Suppress FW_BUG warning when NUMA node already matches PCI: Use pr_warn_once() for ACS parameter parse failure PCI: of: Reduce severity of missing of_root error message commit b274423c79277a34521a7553d07e3dc25b0b96c6 Merge: d096bd7d8bf75a 8197ec49a20621 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:53 2026 -0500 Merge branch 'pci/controller/rzg3s-host' - Assert (not deassert) resets in probe error path (John Madieu) - Assert resets in suspend path in reverse order they were deasserted during probe (John Madieu) - Rework inbound window algorithm to prevent mapping more than intended region and enforce alignment on size, to prepare for RZ/G3E support (John Madieu) - Fix renesas,r9a08g045s33-pcie 'serr_cor' typo and convert properties from 'description' to 'const' for better validation (John Madieu) - Add RZ/G3E to DT binding and to driver (John Madieu) * pci/controller/rzg3s-host: PCI: rzg3s-host: Add support for RZ/G3E PCIe controller PCI: rzg3s-host: Add PCIe Gen3 (8.0 GT/s) link speed support PCI: rzg3s-host: Explicitly set class code for RZ/G3E compatibility PCI: rzg3s-host: Add SoC-specific configuration and initialization callbacks PCI: rzg3s-host: Make configuration reset lines optional PCI: rzg3s-host: Make SYSC register offsets SoC-specific dt-bindings: PCI: renesas,r9a08g045s33-pcie: Document RZ/G3E SoC dt-bindings: PCI: renesas,r9a08g045s33-pcie: Fix naming properties PCI: rzg3s-host: Rework inbound window algorithm for supporting RZ/G3E SoC PCI: rzg3s-host: Reorder reset assertion during suspend PCI: rzg3s-host: Fix reset handling in probe error path # Conflicts: # drivers/pci/controller/pcie-rzg3s-host.c commit d096bd7d8bf75a09d6d10438449e0c33d5f51081 Merge: 8a1c7effae1579 5573c44cb3fd01 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:48 2026 -0500 Merge branch 'pci/controller/mediatek-gen3' - Use dev_err_probe() to simplify error paths and make deferred probe messages visible in /sys/kernel/debug/devices_deferred (Chen-Yu Tsai) - Initialize IRQ domains earlier to remove need for cleanup if it fails (Chen-Yu Tsai) - Set up controller windows and MSI before bringing the link up to separate controller init and things related to downstream devices (Chen-Yu Tsai) - Split out device power up and down helpers (Chen-Yu Tsai) - Power off device if setup fails (Chen-Yu Tsai) - Integrate new pwrctrl API to enable power control for WiFi/BT adapters on mainboard or in PCIe or M.2 slots (Chen-Yu Tsai) - Prevent leaking IRQ domains when IRQ not found (Chen-Yu Tsai) * pci/controller/mediatek-gen3: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found PCI: mediatek-gen3: Integrate new pwrctrl API PCI: mediatek-gen3: Disable device if further setup fails PCI: mediatek-gen3: Split out device power helpers PCI: mediatek-gen3: Add error path for resume driver callbacks PCI: mediatek-gen3: Move controller setup steps before PERST# control PCI: mediatek-gen3: Move mtk_pcie_setup_irq() out of mtk_pcie_setup() PCI: mediatek-gen3: Clean up mtk_pcie_parse_port() with dev_err_probe() commit 8a1c7effae15793f07916911af00167dd1b61125 Merge: b43cdb32ee1370 ab4a4043db1fcc Author: Bjorn Helgaas Date: Mon Apr 13 12:50:48 2026 -0500 Merge branch 'pci/controller/mediatek' - Increase snprintf() buffer size to avoid truncation warnings (Ryder Lee) * pci/controller/mediatek: PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() commit b43cdb32ee1370eacdcb9b2a48e6c8a3978c7179 Merge: bc55afb8fae10f a86ca8698c8846 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:47 2026 -0500 Merge branch 'pci/controller/dwc-tegra194' - Poll less aggressively and non-atomically for PME_TO_Ack during transition to L2 (Vidya Sagar) - Increase LTSSM poll time on surprise link down (Manikanta Maddireddy) - Disable LTSSM after transition to Detect on surprise link down to stop toggling between Polling and Detect (Manikanta Maddireddy) - Don't force the device into the D0 state before L2 when suspending or shutting down the controller (Vidya Sagar) - Disable PERST# IRQ only in Endpoint mode because it's not registered in Root Port mode (Manikanta Maddireddy) - Handle 'nvidia,refclk-select' as optional (Vidya Sagar) - Disable direct speed change in Endpoint mode so link speed change is controlled by the host (Vidya Sagar) - Set LTR values before link up to avoid bogus LTR messages with 0 latency (Vidya Sagar) - Allow system suspend when the Endpoint link is down (Vidya Sagar) - During remove, free resources allocated during Endpoint .probe() (Vidya Sagar) - Use DWC IP core version, not Tegra custom values, to avoid DWC core version check warnings (Manikanta Maddireddy) - Apply ECRC workaround to devices based on DesignWare 5.00a as well as 4.90a (Manikanta Maddireddy) - Disable PM Substate L1.2 in Endpoint mode to work around Tegra234 erratum (Vidya Sagar) - Delay post-PERST# cleanup until core is powered on to avoid CBB timeout (Manikanta Maddireddy) - Assert CLKREQ# so switches that forward it to their downstream side can bring up those links successfully (Vidya Sagar) - Calibrate pipe to UPHY for Endpoint mode to reset stale PLL state from any previous bad link state (Vidya Sagar) - Remove IRQF_ONESHOT flag from Endpoint interrupt registration so DMA driver and Endpoint controller driver can share the interrupt line (Vidya Sagar) - Enable DMA interrupt to support DMA in both Root Port and Endpoint modes (Vidya Sagar) - Enable hardware link retraining after link goes down in Endpoint mode (Vidya Sagar) - Add DT binding and driver support for core clock monitoring (Vidya Sagar) * pci/controller/dwc-tegra194: PCI: tegra194: Add core monitor clock support dt-bindings: PCI: tegra194: Add monitor clock support PCI: tegra194: Enable hardware hot reset mode in Endpoint mode PCI: tegra194: Enable DMA interrupt PCI: tegra194: Remove IRQF_ONESHOT flag during Endpoint interrupt registration PCI: tegra194: Calibrate pipe to UPHY for Endpoint mode PCI: tegra194: Assert CLKREQ# explicitly by default PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on PCI: tegra194: Disable L1.2 capability of Tegra234 EP PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well PCI: tegra194: Use DWC IP core version PCI: tegra194: Free up Endpoint resources during remove() PCI: tegra194: Allow system suspend when the Endpoint link is not up PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode PCI: tegra194: Disable direct speed change for Endpoint mode PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" PCI: tegra194: Disable PERST# IRQ only in Endpoint mode PCI: tegra194: Don't force the device into the D0 state before L2 PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down PCI: tegra194: Increase LTSSM poll time on surprise link down PCI: tegra194: Fix polling delay for L2 state commit bc55afb8fae10fc81a9c83c80b5d83ba74f5051a Merge: 1e6df556f194a7 f3ddb8a9a97fd7 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:47 2026 -0500 Merge branch 'pci/controller/dwc-rockchip' - Add tracepoints for PCIe controller LTSSM transitions and link rate changes (Shawn Lin) - Trace LTSSM events collected by the dw-rockchip debug FIFO (Shawn Lin) * pci/controller/dwc-rockchip: PCI: dw-rockchip: Add pcie_ltssm_state_transition tracepoint support Documentation: tracing: Add PCI controller event documentation PCI: trace: Add PCI controller tracepoint feature commit 1e6df556f194a7b9a71b638a70138c1337990e69 Merge: 07f7d0f0eef771 13f55a7ca773c7 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:46 2026 -0500 Merge branch 'pci/controller/dwc-rcar-gen4-ep' - Mark BAR0 and BAR2 as Resizable (Koichiro Den) - Reduce EPC BAR alignment requirement to 4K (Koichiro Den) * pci/controller/dwc-rcar-gen4-ep: PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation PCI: dwc: rcar-gen4: Mark BAR0 and BAR2 as Resizable BARs in endpoint mode # Conflicts: # drivers/pci/controller/dwc/pcie-rcar-gen4.c commit 07f7d0f0eef771e27e7860bc6576af5fe55b0edd Merge: b94fd087469556 33a76fc3c3e613 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:23 2026 -0500 Merge branch 'pci/controller/dwc-qcom' - Advertise 'Hot-Plug Capable' and set 'No Command Completed Support' since Qcom Root Ports support hotplug events like DL_Up/Down and can accept writes to Slot Control without delays between writes (Krishna Chaitanya Chundru) * pci/controller/dwc-qcom: PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support commit b94fd08746955623c5e7e95e3a0fcf858f125d60 Merge: d33fae1754285f e36262c5e6c25e Author: Bjorn Helgaas Date: Mon Apr 13 12:50:23 2026 -0500 Merge branch 'pci/controller/dwc-layerscape' - Allow Layerscape host controller driver to be build as a removable module (Sascha Hauer) * pci/controller/dwc-layerscape: PCI: layerscape: Allow to compile as module commit d33fae1754285fa7c2daac0a42a30e82030e68fb Merge: 927e9d9d4e7921 88cc4cbe08bba2 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:23 2026 -0500 Merge branch 'pci/controller/dwc-imx6' - Fix device node reference leak in imx_pcie_probe() (Felix Gu) - Delay instead of polling for L2/L3 Ready after PME_Turn_off when suspending i.MX6SX because LTSSM registers are inaccessible (Richard Zhu) - Separate PERST# assertion (for resetting endpoints) from core reset (for resetting the RC itself) to prepare for new DTs with PERST# GPIO in per-Root Port nodes (Sherry Sun) - Retain the Root Port MSI capability on i.MX7D, i.MX8MM, and i.MX8MQ so MSI from downstream devices will work (Richard Zhu) - Fix the i.MX95 reference clock source selection when internal refclk is used (Franz Schnyder) * pci/controller/dwc-imx6: PCI: imx6: Fix reference clock source selection for i.MX95 PCI: imx6: Keep Root Port MSI capability with iMSI-RX to work around hardware bug PCI: imx6: Separate PERST# assertion from core reset functions PCI: imx6: Change imx_pcie_deassert_core_reset() return type to void PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX PCI: imx6: Fix device node reference leak in imx_pcie_probe() commit 927e9d9d4e792159268310716a87bd56c5fcc810 Merge: d52e0276261c0a b593c26d081a4f Author: Bjorn Helgaas Date: Mon Apr 13 12:50:22 2026 -0500 Merge branch 'pci/controller/dwc-eswin' - Add DT binding and driver for ESWIN PCIe Root Complex (Senchuan Zhang) * pci/controller/dwc-eswin: PCI: eswin: Add ESWIN PCIe Root Complex driver dt-bindings: PCI: eswin: Add ESWIN PCIe Root Complex # Conflicts: # drivers/pci/controller/dwc/Kconfig # drivers/pci/controller/dwc/Makefile commit d52e0276261c0ad359b2ef8e40fb63bd7afa65bf Merge: 9cba2840beabca df5d8fb6fe5575 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:15 2026 -0500 Merge branch 'pci/controller/dwc-andes-qilai' - Add Andes QiLai SoC PCIe host driver support (Randolph Lin) * pci/controller/dwc-andes-qilai: PCI: qilai: Add Andes QiLai SoC PCIe host driver support dt-bindings: PCI: Add Andes QiLai PCIe support # Conflicts: # drivers/pci/controller/dwc/Makefile commit 9cba2840beabcaec443bab1e3de3fd2f8966c62d Merge: 764fd8338622d4 56435b70f77899 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:09 2026 -0500 Merge branch 'pci/controller/dwc-amd-mdb' - Correct the IRQ number logged in INTx error message (Rakuram Eswaran) * pci/controller/dwc-amd-mdb: PCI: amd-mdb: Correct IRQ number in INTx error message commit 764fd8338622d4e4c763bca6fa8e3ba747473eb6 Merge: 7dde59ebdadd35 445588a3b18bb0 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:09 2026 -0500 Merge branch 'pci/controller/dwc' - Continue with system suspend even if an Endpoint doesn't respond with PME_TO_Ack message (Manivannan Sadhasivam) - Remove the Baikal-T1 controller driver since it never quite became usable (Andy Shevchenko) - Set Endpoint MSI-X Table Size in the correct function of a multi-function device when configuring MSI-X, not in Function 0 (Aksh Garg) - Set Max Link Width and Max Link Speed for all functions of a multi-function device, not just Function 0 (Aksh Garg) - Clean up in the dw_pcie_resume_noirq() error path (Manivannan Sadhasivam) - Expose PCIe event counters in groups 5-7 in debugfs (Hans Zhang) - Fix type mismatch for kstrtou32_from_user() in debugfs write functions (Hans Zhang) * pci/controller/dwc: PCI: dwc: Fix type mismatch for kstrtou32_from_user() return value PCI: dwc: Expose PCIe event counters for groups 5 to 7 over debugfs PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq() PCI: dwc: ep: Mirror the max link width and speed fields to all functions PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix() PCI: dwc: Remove not-going-to-be-supported code for Baikal SoC PCI: dwc: Proceed with system suspend even if the endpoint doesn't respond with PME_TO_Ack message commit 7dde59ebdadd3543ece73f971c3f64f872d4ce63 Merge: 9120557a9d32c4 99d986686331ba Author: Bjorn Helgaas Date: Mon Apr 13 12:50:09 2026 -0500 Merge branch 'pci/controller/cadence-sky1' - Release ECAM config on probe failure (Felix Gu) * pci/controller/cadence-sky1: PCI: sky1: Use boolean true for is_rc field PCI: sky1: Fix missing cleanup of ECAM config on probe failure commit 9120557a9d32c436ee3aebafcc957d3c9ac492cd Merge: cadf80e0015ef6 988ef706cdd8a7 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:08 2026 -0500 Merge branch 'pci/controller/cadence-sg2042' - Add cadence core flags to disable advertising broken ASPM support (Yao Zi) - Disable ASPM L0s and L1 on Sophgo 2042 PCIe Root Ports that advertise support for them (Yao Zi) * pci/controller/cadence-sg2042: PCI: sg2042: Avoid L0s and L1 on Sophgo 2042 PCIe Root Ports PCI: cadence: Add flags for disabling ASPM capability for broken Root Ports commit cadf80e0015ef6d4aa01103311d3aaf079cd887b Merge: bf6dd2240783c6 d9cf7154deed71 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:08 2026 -0500 Merge branch 'pci/controller/cadence' - Implement byte/word config reads with dword (32-bit) reads because some Cadence controllers don't support sub-dword accesses (Aksh Garg) * pci/controller/cadence: PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access commit bf6dd2240783c6898675dc3f96ec2be4f30eae6f Merge: 736b677ff42837 c54d5f5b33990f Author: Bjorn Helgaas Date: Mon Apr 13 12:50:08 2026 -0500 Merge branch 'pci/controller/aspeed' - Fix IRQ domain leak on platform_get_irq() failure (Felix Gu) * pci/controller/aspeed: PCI: aspeed: Fix IRQ domain leak on platform_get_irq() failure commit 736b677ff42837accf40784d5bd71a1d01f8fc87 Merge: 8153aaf6b9e798 c8b610341914cb Author: Bjorn Helgaas Date: Mon Apr 13 12:50:07 2026 -0500 Merge branch 'pci/controller/max-link-speed' - Add pcie_get_link_speed() to encapsulate and bounds-check pcie_link_speed[] accesses (Hans Zhang) - Validate max-link-speed from DT in j721e, brcmstb, mediatek-gen3, rzg3s (where the actual controller constraints are known), and remove it from the generic OF DT accessor (Hans Zhang) * pci/controller/max-link-speed: PCI: of: Remove max-link-speed generation validation PCI: controller: Validate max-link-speed PCI: j721e: Validate max-link-speed from DT PCI: dwc: Use pcie_get_link_speed() helper for safe array access PCI: Add pcie_get_link_speed() helper for safe array access commit 8153aaf6b9e798a89d5939cf55f44a1815fe3252 Merge: 0b211318e08408 1d3225cb5d8268 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:07 2026 -0500 Merge branch 'pci/endpoint' - Free all previously requested IRQs in epf_ntb_db_bar_init_msi_doorbell() error path (Koichiro Den) - Free doorbell IRQ in pci-epf-test only if it has actually been requested (Koichiro Den) - Discard pointer to doorbell message array after freeing it in pci_epf_alloc_doorbell() error path (Koichiro Den) - Advertise dynamic inbound mapping support in pci-epf-test and update host pci_endpoint_test to skip doorbell testing if not advertised by endpoint (Koichiro Den) - Constify configfs item and group operations (Christophe JAILLET) - Use array_index_nospec() on configfs MW show/store attributes (Koichiro Den) - Return -ERANGE (not -EINVAL) for configfs out-of-range MW index (Koichiro Den) - Return 0, not remaining timeout, when MHI eDMA ops complete so mhi_ep_ring_add_element() doesn't interpret non-zero as failure (Daniel Hodges) - Remove vntb and ntb duplicate resource teardown that leads to oops when .allow_link() fails or .drop_link() is called (Koichiro Den) - Disable vntb delayed work before clearing BAR mappings and doorbells to avoid oops caused by doing the work after resources have been torn down (Koichiro Den) - Fix pci_epf_add_vepf() kernel-doc typo (Alok Tiwari) - Propagate pci_epf_create() errors to pci_epf_make() callers (Alok Tiwari) - Remove redundant BAR_RESERVED annotation for the high order part of a 64-bit BAR (Niklas Cassel) - Add a way to describe reserved subregions within BARs, e.g., platform-owned fixed register windows, and use it for the RK3588 BAR4 DMA ctrl window (Koichiro Den) - Add BAR_DISABLED for BARs that will never be available to an EPF driver, and change some BAR_RESERVED annotations to BAR_DISABLED (Niklas Cassel) - Disable BARs in common code instead of in each glue driver (Niklas Cassel) - Advertise reserved BARs in Capabilities so host-side drivers can skip them (Niklas Cassel) - Skip reserved BARs in selftests (Niklas Cassel) - Improve error messages and include device name when available (Manivannan Sadhasivam) - Add NTB .get_dma_dev() callback for cases where DMA API requires a different device, e.g., vNTB devices (Koichiro Den) - Return -EINVAL, not -ENOSPC, if endpoint test determines the subrange size is too small (Koichiro Den) - Add reserved region types for MSI-X Table and PBA so Endpoint controllers can them as describe hardware-owned regions in a BAR_RESERVED BAR (Manikanta Maddireddy) - Make Tegra194/234 BAR0 programmable and remove 1MB size limit (Manikanta Maddireddy) - Expose Tegra BAR2 (MSI-X) and BAR4 (DMA) as 64-bit BAR_RESERVED (Manikanta Maddireddy) - Add Tegra194 and Tegra234 device table entries to pci_endpoint_test (Manikanta Maddireddy) - Skip the BAR subrange selftest if there are not enough inbound window resources to run the test (Christian Bruel) * pci/endpoint: selftests: pci_endpoint: Skip BAR subrange test on -ENOSPC misc: pci_endpoint_test: Add Tegra194 and Tegra234 device table entries PCI: tegra194: Expose BAR2 (MSI-X) and BAR4 (DMA) as 64-bit BAR_RESERVED PCI: tegra194: Make BAR0 programmable and remove 1MB size limit PCI: endpoint: Add reserved region type for MSI-X Table and PBA misc: pci_endpoint_test: Use -EINVAL for small subrange size PCI: endpoint: pci-epf-vntb: Implement .get_dma_dev() NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers NTB: core: Add .get_dma_dev() callback to ntb_dev_ops PCI: endpoint: Improve error messages PCI: endpoint: Print the EPF name in the error log of pci_epf_make() selftests: pci_endpoint: Skip reserved BARs misc: pci_endpoint_test: Give reserved BARs a distinct error code PCI: endpoint: pci-epf-test: Advertise reserved BARs PCI: dwc: Disable BARs in common code instead of in each glue driver PCI: dwc: Replace certain BAR_RESERVED with BAR_DISABLED in glue drivers PCI: endpoint: Introduce pci_epc_bar_type BAR_DISABLED PCI: dw-rockchip: Describe RK3588 BAR4 DMA ctrl window PCI: endpoint: Describe reserved subregions within BARs PCI: endpoint: Allow only_64bit on BAR_RESERVED PCI: endpoint: Do not mark the BAR succeeding a 64-bit BAR as BAR_RESERVED PCI: endpoint: Propagate error from pci_epf_create() PCI: endpoint: Fix typo in pci_epf_add_vepf() kernel-doc PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete PCI: endpoint: pci-epf-vntb: Return -ERANGE for out-of-range MW index PCI: endpoint: pci-epf-vntb: Use array_index_nospec() on mws_size[] access PCI: endpoint: Constify struct configfs_item_operations and configfs_group_operations selftests: pci_endpoint: Skip doorbell test when unsupported misc: pci_endpoint_test: Gate doorbell test on dynamic inbound mapping PCI: endpoint: pci-epf-test: Advertise dynamic inbound mapping support PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested PCI: endpoint: pci-epf-vntb: Fix MSI doorbell IRQ unwind commit 0b211318e0840800e0a9063645c645164c47fb22 Merge: 981b3fefcc7abe 4d7937d8cc32b0 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:06 2026 -0500 Merge branch 'pci/dt-binding' - Add 'power-domains' to cix,sky1-pcie-host DT binding for Sky1 controller SCMI power domain (Gary Yang) - Increase 'clocks' maxItems to 6 in fsl,imx6q-pcie-common DT binding (Richard Zhu) - Add i.MX94 and i.MX943 to fsl,imx6q-pcie-ep DT binding (Richard Zhu) * pci/dt-binding: dt-bindings: PCI: imx6q-pcie: Add i.MX94 and i.MX943 SoCs dt-bindings: PCI: imx6q-pcie: Fix maxItems of clocks and clock-names dt-bindings: PCI: cix,sky1-pcie-host: Add power-domains commit 981b3fefcc7abe3bf4043cb99cf5b453c1a41e49 Merge: a09007a782687d 806140e9a33218 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:06 2026 -0500 Merge branch 'pci/virtualization' - Avoid FLR for AMD NPU device, where it causes the device to hang (Lizhi Hou) * pci/virtualization: PCI: Avoid FLR for AMD NPU device commit a09007a782687d8322e3aa31b7cc9ce0be223656 Merge: 6cf4941ba9b11c 5b6471fc72a42e Author: Bjorn Helgaas Date: Mon Apr 13 12:50:06 2026 -0500 Merge branch 'pci/vga' - Return vga_get_uninterruptible() back to userspace in the /dev/vga_arbiter path so user can tell whether VGA routing was updated (Simon Richter) - Make pci_set_vga_state() fail if bridge doesn't support VGA routing, i.e., PCI_BRIDGE_CTL_VGA is not writable, and return errors up to vga_get() callers (Simon Richter) * pci/vga: PCI/VGA: Fail pci_set_vga_state() if VGA decoding not supported PCI/VGA: Pass errors from pci_set_vga_state() up PCI/VGA: Pass vga_get_uninterruptible() errors to userspace commit 6cf4941ba9b11c28bbd7c9a7c1a461b94cd486c3 Merge: 12b56ec723d2d7 8cb08166737770 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:05 2026 -0500 Merge branch 'pci/resource' - Prevent assigning space to unimplemented bridge windows; previously we mistakenly assumed prefetchable window existed and assigned space and put a BAR there (Ahmed Naseef) - Avoid shrinking bridge windows to fit in the initial Root Port window; this fixes one problem with devices with large BARs connected via switches, e.g., Thunderbolt (Ilpo Järvinen) - Retain information about optional resources to make assignment during rescan more likely to succeed (Ilpo Järvinen) - Add __resource_contains_unbound() for use in finding space for resources with no address assigned (Ilpo Järvinen) - Pass full extent of empty space, not just the aligned space, to resource_alignf callback so free space before the requested alignment can be used (Ilpo Järvinen) - Remove unnecessary second alignment from ARM, m68k, MIPS (Ilpo Järvinen) - Place small resources before larger ones for better utilization of address space (Ilpo Järvinen) - Fix alignment calculation for resource size larger than align, e.g., bridge windows larger than the 1MB required alignment (Ilpo Järvinen) * pci/resource: PCI: Fix alignment calculation for resource size larger than align PCI: Align head space better PCI: Rename window_alignment() to pci_min_window_alignment() parisc/PCI: Clean up align handling MIPS: PCI: Remove unnecessary second application of align m68k/PCI: Remove unnecessary second application of align ARM/PCI: Remove unnecessary second application of align resource: Rename 'tmp' variable to 'full_avail' resource: Pass full extent of empty space to resource_alignf callback resource: Add __resource_contains_unbound() for internal contains checks PCI: Fix premature removal from realloc_head list during resource assignment PCI: Prevent shrinking bridge window from its required size PCI: Prevent assignment to unsupported bridge windows commit 12b56ec723d2d736feb16ea6ea2505520de3cc58 Merge: 85d9948d59efad 702c1d56c7177a Author: Bjorn Helgaas Date: Mon Apr 13 12:50:05 2026 -0500 Merge branch 'pci/reset' - Update slot handling so all ARI functions are treated as being in the same slot. They're all reset by Secondary Bus Reset, but previously drivers of ARI functions that appeared to be on a non-zero device weren't notified and fatal hardware errors could result (Keith Busch) - Make sysfs reset_subordinate hotplug safe to avoid spurious hotplug events (Keith Busch) - Consolidate bus iteration across the _lock(), _unlock(), and _trylock() functions for pci_bus and pci_slot (Ilpo Järvinen) - Hide Secondary Bus Reset ('bus') from sysfs reset_methods if masked by CXL because it has no effect (Vidya Sagar) * pci/reset: PCI/CXL: Hide SBR from reset_methods if masked by CXL PCI: Consolidate pci_bus/slot_lock/unlock/trylock() PCI: Make reset_subordinate hotplug safe PCI: Allow all bus devices to use the same slot PCI: Rename __pci_bus_reset() and __pci_slot_reset() commit 85d9948d59efad0833139f11c3e07fa25c688b12 Merge: 7d7c6ebd46d952 bd3622e5b8e065 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:04 2026 -0500 Merge branch 'pci/pwrctrl' - Rename 'slot' driver to 'generic' since it can handle any device with individual power control as well as slots (Neil Armstrong) - Add UPD720201/UPD720202 USB 3.0 xHCI Host Controller .compatible so generic pwrctrl driver can control it (Neil Armstrong) * pci/pwrctrl: PCI/pwrctrl: generic: Add UPD720201/UPD720202 USB 3.0 xHCI Host Controller support PCI/pwrctrl: generic: Simplify dev_err_probe() usage PCI/pwrctrl: generic: Rename pci-pwrctrl-slot as generic commit 7d7c6ebd46d952335ff33e21f77fdd761ac2b573 Merge: a735a513ff2c21 e1092d5e15e6a9 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:04 2026 -0500 Merge branch 'pci/ptm' - Leave Precision Time Measurement disabled until a driver enables it to avoid PCIe errors (Mika Westerberg) * pci/ptm: PCI/PTM: Do not enable PTM automatically for Root and Switch Upstream Ports PCI/PTM: Drop pci_enable_ptm() granularity parameter commit a735a513ff2c219f3dc4f9c159f3a328bfb41834 Merge: 3ebccb123dfa8b 70cf146a674c44 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:03 2026 -0500 Merge branch 'pci/p2pdma' - Allow wildcards in list of host bridges that support peer-to-peer DMA between hierarchy domains and add all Google SoCs (Jacob Moroni) * pci/p2pdma: PCI/P2PDMA: Add Google SoCs to the P2P DMA host bridge list PCI/P2PDMA: Allow wildcard Device IDs in host bridge list commit 3ebccb123dfa8b475ee77b9c49bc775152e70205 Merge: c9aad5598046f8 874b07eb087572 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:03 2026 -0500 Merge branch 'pci/msi' - Update documentation of pci_free_irq_vectors() and pcim_enable_device() (Shawn Lin) * pci/msi: PCI/MSI: Add TODO comment about legacy pcim_enable_device() side-effect PCI/MSI: Clarify pci_free_irq_vectors() usage for managed devices commit c9aad5598046f884d5164b5e5000fd0b32a90dd7 Merge: 236b47433db829 16d021c878dca2 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:03 2026 -0500 Merge branch 'pci/hotplug' - Use for_each_child_of_node_scoped() to simplify iteration over OF children (Krzysztof Kozlowski) - Set LED_HW_PLUGGABLE for NPEM hotplug-capable ports so LED core doesn't complain when setting brightness fails because the endpoint is gone (Richard Cheng) * pci/hotplug: PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports PCI: rpaphp: Simplify with scoped for each OF child loop PCI: pnv_php: Simplify with scoped for each OF child loop commit 236b47433db829b0787f120841b5427958734cb8 Merge: e27c43d59475e5 d79dc408deb6c1 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:02 2026 -0500 Merge branch 'pci/enumeration' - Allow TPH to be enabled for RCiEPs (George Abraham P) - Remove the pc110pad since 486 CPU support is being removed (Dmitry Torokhov) - Remove no_pci_devices() since pc110pad was the last remaining user (Heiner Kallweit) * pci/enumeration: PCI: Remove no_pci_devices() Input: pc110pad - remove driver PCI/TPH: Allow TPH enable for RCiEPs commit e27c43d59475e5f941029ea8295b220acb2a0499 Merge: 31e39c9ae1320c 97970e7c694356 Author: Bjorn Helgaas Date: Mon Apr 13 12:50:02 2026 -0500 Merge branch 'pci/dpc' - Hold a pci_dev reference during error recovery (Sizhe Liu) - Initialize ratelimit info so DPC and EDR paths log AER error information (Kuppuswamy Sathyanarayanan) * pci/dpc: PCI/DPC: Log AER error info for DPC/EDR uncorrectable errors PCI/DPC: Hold pci_dev reference during error recovery commit 31e39c9ae1320c84a3b50fe489d7a3c75fedbbbc Merge: 02c511ebd02b11 8e69214402397f Author: Bjorn Helgaas Date: Mon Apr 13 12:50:02 2026 -0500 Merge branch 'pci/atomics' - Don't enable AtomicOps by RCiEPs since none of them need Atomic Ops and we can't tell whether the Root Complex would support them (Gerd Bayer) - Enable AtomicOps only if we know the Root Port supports them (Gerd Bayer) * pci/atomics: PCI: Update PCIe spec references for AtomicOps PCI: Enable AtomicOps only if Root Port supports them PCI: Do not enable AtomicOps by RCiEPs commit 02c511ebd02b1147eb6ad635d00f31929a9d483b Merge: b3a631e43fe927 cc33985d26c92a Author: Bjorn Helgaas Date: Mon Apr 13 12:50:01 2026 -0500 Merge branch 'pci/aspm' - Fix ASPM usage of pci_clear_and_set_config_dword() to prevent inadvertently setting Common_Mode_Restore_Time and other fields (Lukas Wunner) * pci/aspm: PCI/ASPM: Fix pci_clear_and_set_config_dword() usage commit b3a631e43fe92736e64d583dbfc9f8ca5dcead56 Merge: 6de23f81a5e08b 1ab4a3c805084d Author: Bjorn Helgaas Date: Mon Apr 13 12:50:01 2026 -0500 Merge branch 'pci/aer' - Clear only error bits in PCIe Device Status to avoid accidentally clearing Emergency Power Reduction Detected (Shuai Xue) - Check for AER errors even in devices without drivers (Lukas Wunner) * pci/aer: PCI/AER: Stop ruling out unbound devices as error source PCI/AER: Clear only error bits in PCIe Device Status commit 0f00132132937ca01a99feaf8985109a9087c9ff Merge: 3383589700ea1c 1b63f91d1c9013 Author: Linus Torvalds Date: Mon Apr 13 10:40:26 2026 -0700 Merge tag 'vfs-7.1-rc1.integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs integrity updates from Christian Brauner: "This adds support to generate and verify integrity information (aka T10 PI) in the file system, instead of the automatic below the covers support that is currently used. The implementation is based on refactoring the existing block layer PI code to be reusable for this use case, and then adding relatively small wrappers for the file system use case. These are then used in iomap to implement the semantics, and wired up in XFS with a small amount of glue code. Compared to the baseline this does not change performance for writes, but increases read performance up to 15% for 4k I/O, with the benefit decreasing with larger I/O sizes as even the baseline maxes out the device quickly on my older enterprise SSD" * tag 'vfs-7.1-rc1.integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: xfs: support T10 protection information iomap: support T10 protection information iomap: support ioends for buffered reads iomap: add a bioset pointer to iomap_read_folio_ops ntfs3: remove copy and pasted iomap code iomap: allow file systems to hook into buffered read bio submission iomap: only call into ->submit_read when there is a read_ctx iomap: pass the iomap_iter to ->submit_read iomap: refactor iomap_bio_read_folio_range block: pass a maxlen argument to bio_iov_iter_bounce block: add fs_bio_integrity helpers block: make max_integrity_io_size public block: prepare generation / verification helpers for fs usage block: add a bdev_has_integrity_csum helper block: factor out a bio_integrity_setup_default helper block: factor out a bio_integrity_action helper commit 3383589700ea1c196f05b164d2b6c15269b6e9e4 Merge: c8db08110cbeff 9c62536a958ffe Author: Linus Torvalds Date: Mon Apr 13 10:24:33 2026 -0700 Merge tag 'vfs-7.1-rc1.directory' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs directory updates from Christian Brauner: "Recently 'start_creating', 'start_removing', 'start_renaming' and related interfaces were added which combine the locking and the lookup. At that time many callers were changed to use the new interfaces. However there are still an assortment of places out side of the core vfs where the directory is locked explictly, whether with inode_lock() or lock_rename() or similar. These were missed in the first pass for an assortment of uninteresting reasons. This addresses the remaining places where explicit locking is used, and changes them to use the new interfaces, or otherwise removes the explicit locking. The biggest changes are in overlayfs. The other changes are quite simple, though maybe the cachefiles changes is the least simple of those" * tag 'vfs-7.1-rc1.directory' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: VFS: unexport lock_rename(), lock_rename_child(), unlock_rename() ovl: remove ovl_lock_rename_workdir() ovl: use is_subdir() for testing if one thing is a subdir of another ovl: change ovl_create_real() to get a new lock when re-opening created file. ovl: pass name buffer to ovl_start_creating_temp() cachefiles: change cachefiles_bury_object to use start_renaming_dentry() ovl: Simplify ovl_lookup_real_one() VFS: make lookup_one_qstr_excl() static. nfsd: switch purge_old() to use start_removing_noperm() selinux: Use simple_start_creating() / simple_done_creating() Apparmor: Use simple_start_creating() / simple_done_creating() libfs: change simple_done_creating() to use end_creating() VFS: move the start_dirop() kerndoc comment to before start_dirop() fs/proc: Don't lock root inode when creating "self" and "thread-self" VFS: note error returns in documentation for various lookup functions commit c8db08110cbeff12a1f3990a31730936b092f62b Merge: 0e58e3f1c57850 98779186aa0b33 Author: Linus Torvalds Date: Mon Apr 13 10:10:28 2026 -0700 Merge tag 'vfs-7.1-rc1.xattr' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs xattr updates from Christian Brauner: "This reworks the simple_xattr infrastructure and adds support for user.* extended attributes on sockets. The simple_xattr subsystem currently uses an rbtree protected by a reader-writer spinlock. This series replaces the rbtree with an rhashtable giving O(1) average-case lookup with RCU-based lockless reads. This sped up concurrent access patterns on tmpfs quite a bit and it's an overall easy enough conversion to do and gets rid or rwlock_t. The conversion is done incrementally: a new rhashtable path is added alongside the existing rbtree, consumers are migrated one at a time (shmem, kernfs, pidfs), and then the rbtree code is removed. All three consumers switch from embedded structs to pointer-based lazy allocation so the rhashtable overhead is only paid for inodes that actually use xattrs. With this infrastructure in place the series adds support for user.* xattrs on sockets. Path-based AF_UNIX sockets inherit xattr support from the underlying filesystem (e.g. tmpfs) but sockets in sockfs - that is everything created via socket() including abstract namespace AF_UNIX sockets - had no xattr support at all. The xattr_permission() checks are reworked to allow user.* xattrs on S_IFSOCK inodes. Sockfs sockets get per-inode limits of 128 xattrs and 128KB total value size matching the limits already in use for kernfs. The practical motivation comes from several directions. systemd and GNOME are expanding their use of Varlink as an IPC mechanism. For D-Bus there are tools like dbus-monitor that can observe IPC traffic across the system but this only works because D-Bus has a central broker. For Varlink there is no broker and there is currently no way to identify which sockets speak Varlink. With user.* xattrs on sockets a service can label its socket with the IPC protocol it speaks (e.g., user.varlink=1) and an eBPF program can then selectively capture traffic on those sockets. Enumerating bound sockets via netlink combined with these xattr labels gives a way to discover all Varlink IPC entrypoints for debugging and introspection. Similarly, systemd-journald wants to use xattrs on the /dev/log socket for protocol negotiation to indicate whether RFC 5424 structured syslog is supported or whether only the legacy RFC 3164 format should be used. In containers these labels are particularly useful as high-privilege or more complicated solutions for socket identification aren't available. The series comes with comprehensive selftests covering path-based AF_UNIX sockets, sockfs socket operations, per-inode limit enforcement, and xattr operations across multiple address families (AF_INET, AF_INET6, AF_NETLINK, AF_PACKET)" * tag 'vfs-7.1-rc1.xattr' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/xattr: test xattrs on various socket families selftests/xattr: sockfs socket xattr tests selftests/xattr: path-based AF_UNIX socket xattr tests xattr: support extended attributes on sockets xattr,net: support limited amount of extended attributes on sockfs sockets xattr: move user limits for xattrs to generic infra xattr: switch xattr_permission() to switch statement xattr: add xattr_permission_error() xattr: remove rbtree-based simple_xattr infrastructure pidfs: adapt to rhashtable-based simple_xattrs kernfs: adapt to rhashtable-based simple_xattrs with lazy allocation shmem: adapt to rhashtable-based simple_xattrs with lazy allocation xattr: add rhashtable-based simple_xattr infrastructure xattr: add rcu_head and rhash_head to struct simple_xattr commit 0e58e3f1c57850f62afd40a642a7fe3417d80b21 Merge: 26ff969926a08e 86566865986c4f Author: Linus Torvalds Date: Mon Apr 13 10:08:01 2026 -0700 Merge tag 'vfs-7.1-rc1.writeback' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs writeback updates from Christian Brauner: "This introduces writeback helper APIs and converts f2fs, gfs2 and nfs to stop accessing writeback internals directly" * tag 'vfs-7.1-rc1.writeback' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: nfs: stop using writeback internals for WB_WRITEBACK accounting gfs2: stop using writeback internals for dirty_exceeded check f2fs: stop using writeback internals for dirty_exceeded checks writeback: prep helpers for dirty-limit and writeback accounting commit bad4bd28abf4d7cb2adcb39cc0de789729d2cd69 Author: Nishanth Sampath Kumar Date: Tue Apr 7 16:39:27 2026 -0700 regmap-i2c: add SMBus byte/word reg16 bus for adapters lacking I2C_FUNC_I2C AMD PIIX4 SMBus adapters, present on AMD SP5/EPYC-based platforms (including Cisco 8000 series routers), support SMBUS_BYTE_DATA and SMBUS_WORD_DATA but lack I2C_FUNC_I2C and I2C_FUNC_SMBUS_I2C_BLOCK. When at24 (or any driver) requests a regmap with reg_bits=16 and val_bits=8 on such an adapter, regmap_get_i2c_bus() finds no matching bus and returns -ENOTSUPP. The existing regmap_i2c_smbus_i2c_block_reg16 bus type already implements 16-bit addressed reads using only write_byte_data() + read_byte() primitives, but its selection is gated on I2C_FUNC_SMBUS_I2C_BLOCK which these adapters lack. Add a new regmap_smbus_byte_word_reg16 bus that: READ: reuses regmap_i2c_smbus_i2c_read_reg16() -- sets the 16-bit address via write_byte_data(addr_lo, addr_hi), then reads bytes sequentially via read_byte() (EEPROM auto-increments). Requires only SMBUS_BYTE_DATA. WRITE: uses write_word_data(addr_hi, (data << 8) | addr_lo) to encode one data byte per SMBus WORD transaction. Requires only SMBUS_WORD_DATA. Single-byte writes only. The new bus is selected in regmap_get_i2c_bus() when reg_bits=16, val_bits=8, and the adapter has SMBUS_BYTE_DATA | SMBUS_WORD_DATA but not I2C_FUNC_I2C or SMBUS_I2C_BLOCK. The branch is placed after the existing I2C_BLOCK_reg16 check so adapters with full block support continue to use the faster path. This fixes at24 EEPROM probe failures on PIIX4: at24 3-0055: probe with driver at24 failed with error -524 No driver changes are required -- at24 already passes reg_bits=16 to devm_regmap_init_i2c(), which now succeeds. Signed-off-by: Nishanth Sampath Kumar Link: https://patch.msgid.link/20260407233927.498932-1-nissampa@cisco.com Signed-off-by: Mark Brown commit f8e0a5a174d7d3bc3547c15bc1647c35427f5c34 Author: Cao Ruichuang Date: Wed Apr 8 12:32:12 2026 +0800 selftests/ftrace: Quote check_requires comparisons check_requires() compares requirement strings that can contain shell pattern characters such as '[' and ']'. Under /bin/sh, the unquoted test expressions can emit 'unexpected operator' warnings while parsing README-backed requirements. Quote the relevant comparisons and path checks so the helper handles those patterns without spurious shell warnings. Validated by rerunning fprobe_syntax_errors.tc and confirming the previous '/bin/sh: unexpected operator' lines disappear from the detailed ftracetest log. Signed-off-by: Cao Ruichuang Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20260408043212.8063-1-create0818@163.com Signed-off-by: Shuah Khan commit 7e47389142b8ada66280be71e01a3238751086f0 Author: Ricardo B. Marlière Date: Fri Mar 20 15:29:20 2026 -0300 selftests: Preserve subtarget failures in all/install Track failures explicitly in the top-level selftests all/install loops. The current code multiplies `ret` by each sub-make exit status. For example, with `TARGETS=net`, the implicit `net/lib` dependency runs after `net`, so a failed `net` build can be followed by a successful `net/lib` build and reset the final result to success. Set `ret` to 1 on any non-zero sub-make exit code and keep it sticky, so the top-level make returns failure when any selected selftest target fails. Signed-off-by: Ricardo B. Marlière Link: https://lore.kernel.org/r/20260320-selftests-fixes-v1-5-79144f76be01@suse.com Signed-off-by: Shuah Khan commit d6ea9f404b905ba7351d6b0e9ed611d9d0bf20f7 Author: Ricardo B. Marlière Date: Fri Mar 20 15:29:19 2026 -0300 selftests/run_kselftest.sh: Allow choosing per-test log directory The --per-test-log option currently hard-codes /tmp. However, the system under test will most likely have tmpfs mounted there. Since it's not clear which filenames the log files will have, the user should be able to specify a persistent directory to store the logs. Keeping those logs are important because the run_kselftest.sh runner will only yield KTAP output, trimming information that is otherwise available through running individual tests directly. Allow --per-test-log to take an optional directory argument. Keep the existing behaviour when the option is passed without an argument, but if a directory is provided, create it if needed, reject non-directory paths and non-writable directories, canonicalize it, and have runner.sh write per-test logs there instead of /tmp. This also makes relative paths safe by resolving them before the runner changes into a collection directory. Signed-off-by: Ricardo B. Marlière Link: https://lore.kernel.org/r/20260320-selftests-fixes-v1-4-79144f76be01@suse.com Signed-off-by: Shuah Khan commit a82e076f4a0c084b2f5470db31dd9282ba3fcbb2 Author: Ricardo B. Marlière Date: Fri Mar 20 15:29:18 2026 -0300 selftests/run_kselftest.sh: Resolve BASE_DIR with pwd -P run_kselftest.sh only needs to canonicalize the directory containing the script itself. Use shell-native path resolution for that by changing into the directory and calling pwd -P. This avoids depending on either realpath or readlink -f while still producing a physical absolute path for BASE_DIR. Signed-off-by: Ricardo B. Marlière Link: https://lore.kernel.org/r/20260320-selftests-fixes-v1-3-79144f76be01@suse.com Signed-off-by: Shuah Khan commit 6b802031877a995456c528095c41d1948546bf45 Merge: 01f217fa8a8c78 9b8e8aad5896d6 Author: Paolo Bonzini Date: Mon Apr 13 19:01:15 2026 +0200 Merge tag 'kvm-s390-next-7.1-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD - ESA nesting support - 4k memslots - LPSW/E fix commit 01f217fa8a8c7878d28df90233f68c20bea9bdc7 Author: Paolo Bonzini Date: Mon Apr 13 18:57:26 2026 +0200 KVM: x86: use inlines instead of macros for is_sev_*guest This helps avoiding more embarrassment to this maintainer, but also will catch mistakes more easily for others. Signed-off-by: Paolo Bonzini commit 92cdeac6a417391349481933aa32e3216a1cc217 Merge: 4a530993dafec2 bc0932cf9b9917 Author: Paolo Bonzini Date: Mon Apr 13 13:19:36 2026 +0200 Merge tag 'kvm-x86-svm-7.1' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 7.1 - Fix and optimize IRQ window inhibit handling for AVIC (the tracking needs to be per-vCPU, e.g. so that KVM doesn't prematurely re-enable AVIC if multiple vCPUs have to-be-injected IRQs). - Fix an undefined behavior warning where a crafty userspace can read the "avic" module param before it's fully initialized. - Fix a (likely benign) bug in the "OS-visible workarounds" handling, where KVM could clobber state when enabling virtualization on multiple CPUs in parallel, and clean up and optimize the code. - Drop a WARN in KVM_MEMORY_ENCRYPT_REG_REGION where KVM complains about a "too large" size based purely on user input, and clean up and harden the related pinning code. - Disallow synchronizing a VMSA of an already-launched/encrypted vCPU, as doing so for an SNP guest will trigger an RMP violation #PF and crash the host. - Protect all of sev_mem_enc_register_region() with kvm->lock to ensure sev_guest() is stable for the entire of the function. - Lock all vCPUs when synchronizing VMSAs for SNP guests to ensure the VMSA page isn't actively being used. - Overhaul KVM's APIs for detecting SEV+ guests so that VM-scoped queries are required to hold kvm->lock (KVM has had multiple bugs due "is SEV?" checks becoming stale), enforced by lockdep. Add and use vCPU-scoped APIs when possible/appropriate, as all checks that originate from a vCPU are guaranteed to be stable. - Convert a pile of kvm->lock SEV code to guard(). commit 54a032d3e62fd1792cb16d8096aaf00397589c5f Author: Peng Fan Date: Mon Apr 13 18:52:43 2026 +0800 ASoC: pxa2xx-ac97: fix error handling for reset GPIO descriptor The reset GPIO obtained via devm_gpiod_get() may return an ERR_PTR() when the GPIO is missing or an error occurs. The current code unconditionally assigns PTR_ERR() to ret and later dereferences rst_gpio via desc_to_gpio(), which is incorrect when rst_gpio is an error pointer. Rework the logic to first check IS_ERR(rst_gpio) before converting the descriptor. Handle -ENOENT by disabling reset GPIO support, and return other errors to the caller as expected. Fixes: c76d50b71e89 ("ASoC: ac97: Convert to GPIO descriptors") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202604041426.i2C1xqHk-lkp@intel.com/ Signed-off-by: Peng Fan Link: https://patch.msgid.link/20260413-ac97-v1-1-b44b9e084307@nxp.com Signed-off-by: Mark Brown commit 26ff969926a08eee069767ddbbbc301adbcd9676 Merge: 28483203f7d7fe 8a23051ed85842 Author: Linus Torvalds Date: Mon Apr 13 09:54:20 2026 -0700 Merge tag 'rust-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust updates from Miguel Ojeda: "Toolchain and infrastructure: - Bump the minimum Rust version to 1.85.0 (and 'bindgen' to 0.71.1). As proposed in LPC 2025 and the Maintainers Summit [1], we are going to follow Debian Stable's Rust versions as our minimum versions. Debian Trixie was released on 2025-08-09 with a Rust 1.85.0 and 'bindgen' 0.71.1 toolchain, which is a fair amount of time for e.g. kernel developers to upgrade. Other major distributions support a Rust version that is high enough as well, including: + Arch Linux. + Fedora Linux. + Gentoo Linux. + Nix. + openSUSE Slowroll and openSUSE Tumbleweed. + Ubuntu 25.10 and 26.04 LTS. In addition, 24.04 LTS using their versioned packages. The merged patch series comes with the associated cleanups and simplifications treewide that can be performed thanks to both bumps, as well as documentation updates. In addition, start using 'bindgen''s '--with-attribute-custom-enum' feature to set the 'cfi_encoding' attribute for the 'lru_status' enum used in Binder. Link: https://lwn.net/Articles/1050174/ [1] - Add experimental Kconfig option ('CONFIG_RUST_INLINE_HELPERS') that inlines C helpers into Rust. Essentially, it performs a step similar to LTO, but just for the helpers, i.e. very local and fast. It relies on 'llvm-link' and its '--internalize' flag, and requires a compatible LLVM between Clang and 'rustc' (i.e. same major version, 'CONFIG_RUSTC_CLANG_LLVM_COMPATIBLE'). It is only enabled for two architectures for now. The result is a measurable speedup in different workloads that different users have tested. For instance, for the null block driver, it amounts to a 2%. - Support global per-version flags. While we already have per-version flags in many places, we didn't have a place to set global ones that depend on the compiler version, i.e. in 'rust_common_flags', which sometimes is needed to e.g. tweak the lints set per version. Use that to allow the 'clippy::precedence' lint for Rust < 1.86.0, since it had a change in behavior. - Support overriding the crate name and apply it to Rust Binder, which wanted the module to be called 'rust_binder'. - Add the remaining '__rust_helper' annotations (started in the previous cycle). 'kernel' crate: - Introduce the 'const_assert!' macro: a more powerful version of 'static_assert!' that can refer to generics inside functions or implementation bodies, e.g.: fn f() { const_assert!(N > 1); } fn g() { const_assert!(size_of::() > 0, "T cannot be ZST"); } In addition, reorganize our set of build-time assertion macros ('{build,const,static_assert}!') to live in the 'build_assert' module. Finally, improve the docs as well to clarify how these are different from one another and how to pick the right one to use, and their equivalence (if any) to the existing C ones for extra clarity. - 'sizes' module: add 'SizeConstants' trait. This gives us typed 'SZ_*' constants (avoiding casts) for use in device address spaces where the address width depends on the hardware (e.g. 32-bit MMIO windows, 64-bit GPU framebuffers, etc.), e.g.: let gpu_heap = 14 * u64::SZ_1M; let mmio_window = u32::SZ_16M; - 'clk' module: implement 'Send' and 'Sync' for 'Clk' and thus simplify the users in Tyr and PWM. - 'ptr' module: add 'const_align_up'. - 'str' module: improve the documentation of the 'c_str!' macro to explain that one should only use it for non-literal cases (for the other case we instead use C string literals, e.g. 'c"abc"'). - Disallow the use of 'CStr::{as_ptr,from_ptr}' and clean one such use in the 'task' module. - 'sync' module: finish the move of 'ARef' and 'AlwaysRefCounted' outside of the 'types' module, i.e. update the last remaining instances and finally remove the re-exports. - 'error' module: clarify that 'from_err_ptr' can return 'Ok(NULL)', including runtime-tested examples. The intention is to hopefully prevent UB that assumes the result of the function is not 'NULL' if successful. This originated from a case of UB I noticed in 'regulator' that created a 'NonNull' on it. Timekeeping: - Expand the example section in the 'HrTimer' documentation. - Mark the 'ClockSource' trait as unsafe to ensure valid values for 'ktime_get()'. - Add 'Delta::from_nanos()'. 'pin-init' crate: - Replace the 'Zeroable' impls for 'Option' with impls of 'ZeroableOption' for 'NonZero*'. - Improve feature gate handling for unstable features. - Declutter the documentation of implementations of 'Zeroable' for tuples. - Replace uses of 'addr_of[_mut]!' with '&raw [mut]'. rust-analyzer: - Add type annotations to 'generate_rust_analyzer.py'. - Add support for scripts written in Rust ('generate_rust_target.rs', 'rustdoc_test_builder.rs', 'rustdoc_test_gen.rs'). - Refactor 'generate_rust_analyzer.py' to explicitly identify host and target crates, improve readability, and reduce duplication. And some other fixes, cleanups and improvements" * tag 'rust-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (79 commits) rust: sizes: add SizeConstants trait for device address space constants rust: kernel: update `file_with_nul` comment rust: kbuild: allow `clippy::precedence` for Rust < 1.86.0 rust: kbuild: support global per-version flags rust: declare cfi_encoding for lru_status docs: rust: general-information: use real example docs: rust: general-information: simplify Kconfig example docs: rust: quick-start: remove GDB/Binutils mention docs: rust: quick-start: remove Nix "unstable channel" note docs: rust: quick-start: remove Gentoo "testing" note docs: rust: quick-start: add Ubuntu 26.04 LTS and remove subsection title docs: rust: quick-start: update minimum Ubuntu version docs: rust: quick-start: update Ubuntu versioned packages docs: rust: quick-start: openSUSE provides `rust-src` package nowadays rust: kbuild: remove "dummy parameter" workaround for `bindgen` < 0.71.1 rust: kbuild: update `bindgen --rust-target` version and replace comment rust: rust_is_available: remove warning for `bindgen` < 0.69.5 && libclang >= 19.1 rust: rust_is_available: remove warning for `bindgen` 0.66.[01] rust: bump `bindgen` minimum supported version to 0.71.1 (Debian Trixie) rust: block: update `const_refs_to_static` MSRV TODO comment ... commit bc9b1ebaa7624edde54d4ae842d11cebb26db09b Author: Arnd Bergmann Date: Mon Apr 13 09:00:45 2026 +0200 ASoC: tas2781: fix unused-const-variable warning When both CONFIG_OF and CONFIG_ACPI are disabled, the ID table is not referenced any more: sound/soc/codecs/tas2781-i2c.c:102:35: error: 'tasdevice_id' defined but not used [-Werror=unused-const-variable=] 102 | static const struct i2c_device_id tasdevice_id[] = { | ^~~~~~~~~~~~ Remove the #ifdef checks and just include the ID tables unconditionally to get a clean build in all configurations. The code already uses IS_ENABLED() checks for both to benefit from dead code elimination and the ID tables are small enough that they can just be included all the time. Fixes: 9a52d1b7cb4a ("ASoC: tas2781: Explicit association of Device, Device Name, and Device ID") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260413070059.3828364-1-arnd@kernel.org Signed-off-by: Mark Brown commit 28483203f7d7fe4f123ed08266c381fac96b0701 Merge: 599bbba5a36f6d 95c7d025cc8c3c Author: Linus Torvalds Date: Mon Apr 13 09:36:45 2026 -0700 Merge tag 'rcu.2026.03.31a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU updates from Joel Fernandes: "NOCB CPU management: - Consolidate rcu_nocb_cpu_offload() and rcu_nocb_cpu_deoffload() to reduce code duplication - Extract nocb_bypass_needs_flush() helper to reduce duplication in NOCB bypass path rcutorture/torture infrastructure: - Add NOCB01 config for RCU_LAZY torture testing - Add NOCB02 config for NOCB poll mode testing - Add TRIVIAL-PREEMPT config for textbook-style preemptible RCU torture - Test call_srcu() with preemption both disabled and enabled - Remove kvm-check-branches.sh in favor of kvm-series.sh - Make hangs more visible in torture.sh output - Add informative message for tests without a recheck file - Fix numeric test comparison in srcu_lockdep.sh - Use torture_shutdown_init() in refscale and rcuscale instead of open-coded shutdown functions - Fix modulo-zero error in torture_hrtimeout_ns(). SRCU: - Fix SRCU read flavor macro comments - Fix s/they disables/they disable/ typo in srcu_read_unlock_fast() RCU Tasks: - Document that RCU Tasks Trace grace periods now imply RCU grace periods - Remove unnecessary smp_store_release() in cblist_init_generic()" * tag 'rcu.2026.03.31a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: rcutorture: Test call_srcu() with preemption disabled and not rcu: Add BOOTPARAM_RCU_STALL_PANIC Kconfig option torture: Avoid modulo-zero error in torture_hrtimeout_ns() rcu/nocb: Extract nocb_bypass_needs_flush() to reduce duplication rcu/nocb: Consolidate rcu_nocb_cpu_offload/deoffload functions rcu-tasks: Remove unnecessary smp_store_release() in cblist_init_generic() rcutorture: Add NOCB02 config for nocb poll mode testing rcutorture: Add NOCB01 config for RCU_LAZY torture testing rcu-tasks: Document that RCU Tasks Trace grace periods now imply RCU grace periods srcu: Fix s/they disables/they disable/ typo in srcu_read_unlock_fast() srcu: Fix SRCU read flavor macro comments rcuscale: Ditch rcu_scale_shutdown in favor of torture_shutdown_init() refscale: Ditch ref_scale_shutdown in favor of torture_shutdown_init() rcutorture: Fix numeric "test" comparison in srcu_lockdep.sh torture: Print informative message for test without recheck file torture: Make hangs more visible in torture.sh output kvm-check-branches.sh: Remove in favor of kvm-series.sh rcutorture: Add a textbook-style trivial preemptible RCU commit 1805e6b2f49fbf63322a629a36019cbe2c6628e3 Author: Trond Myklebust Date: Mon Jan 5 16:43:21 2026 -0500 NFSv4/pnfs: If the server is down, retry the layout returns on reboot If a layout return is embedded in a CLOSE or DELEGRETURN rpc call, and the metadata server reboots, the expectation now is that the client should resend the layout return once the server comes back up. This patch changes the current behaviour of dropping the layouts on the floor, and instead queues them up for retrying. Signed-off-by: Trond Myklebust commit 76af54648899abbd6b449c035583e47fd407078a Author: Breno Leitao Date: Mon Apr 13 07:26:47 2026 -0700 workqueue: validate cpumask_first() result in llc_populate_cpu_shard_id() On uniprocessor (UP) configs such as nios2, NR_CPUS is 1, so cpu_shard_id[] is a single-element array (int[1]). In llc_populate_cpu_shard_id(), cpumask_first(sibling_cpus) returns an unsigned int that the compiler cannot prove is always 0, triggering a -Warray-bounds warning when the result is used to index cpu_shard_id[]: kernel/workqueue.c:8321:55: warning: array subscript 1 is above array bounds of 'int[1]' [-Warray-bounds] 8321 | cpu_shard_id[c] = cpu_shard_id[cpumask_first(sibling_cpus)]; | ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This is a false positive: sibling_cpus can never be empty here because 'c' itself is always set in it, so cpumask_first() will always return a valid CPU. However, the compiler cannot prove this statically, and the warning only manifests on UP configs where the array size is 1. Add a bounds check with WARN_ON_ONCE to silence the warning, and store the result in a local variable to make the code clearer and avoid calling cpumask_first() twice. Fixes: 5920d046f7ae ("workqueue: add WQ_AFFN_CACHE_SHARD affinity scope") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604022343.GQtkF2vO-lkp@intel.com/ Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit e61bc5e4d87433c8759e7dc92bb640ef71a8970c Author: Mike Marshall Date: Mon Apr 13 11:18:23 2026 -0400 bufmap: manage as folios, V2. Thanks for the feedback from Dan Carpenter and Arnd Bergmann. Dan suggested to make the rollback loop in orangefs_bufmap_map more robust. Arnd caught a %ld format for a size_t in orangefs_bufmap_copy_to_iovec. He suggested %zd, I used %zu which I think is OK too. Orangefs userspace allocates 40 megabytes on an address that's page aligned. With this folio modification the allocation is aligned on a multiple of 2 megabytes: posix_memalign(&ptr, 2097152, 41943040); Then userspace tries to enable Huge Pages for the range: madvise(ptr, 41943040, MADV_HUGEPAGE); Userspace provides the address of the 40 megabyte allocation to the Orangefs kernel module with an ioctl. The kernel module initializes the memory as a "bufmap" with ten 4 megabyte "slots". Traditionally, the slots are manipulated a page at a time. This folio/bufmap modification manages the slots as folios, with two 2 megabyte folios per slot and data can be read into and out of each slot a folio at a time. This modification works fine with orangefs userspace lacking the THP focused posix_memalign and madvise settings listed above, each slot can end up being made of page sized folios. It also works if there are some, but less than 20, hugepages available. A message is printed in the kernel ring buffer (dmesg) at userspace start time that describes the folio/page ratio. As an example, I started orangefs and saw "Grouped 2575 folios from 10240 pages" in the ring buffer. To get the optimum ratio, 20/10240, I use these settings before I start the orangefs userspace: echo always > /sys/kernel/mm/transparent_hugepage/enabled echo always > /sys/kernel/mm/transparent_hugepage/defrag echo 30 > /proc/sys/vm/nr_hugepages https://docs.kernel.org/admin-guide/mm/hugetlbpage.html discusses hugepages and manipulating the /proc/sys/vm settings. Comparing the performance between the page/bufmap and the folio/bufmap is a mixed bag. - The folio/bufmap version is about 8% faster at running through the xfstest suite on my VMs. - It is easy to construct an fio test that brings the page/bufmap version to its knees on my dinky VM test system, with all bufmap slots used and I/O timeouts cascading. - Some smaller tests I did with fio that didn't overwhelm the page/bufmap version showed no performance gain with the folio/bufmap version on my VM. I suspect this change will improve performance only in some use-cases. I think it will be a gain when there are many concurrent IOs that mostly fill the bufmap. I'm working up a gcloud test for that. Reported-by: Dan Carpenter Reported-by: Arnd Bergmann Signed-off-by: Mike Marshall commit 7e311bafb9ad3a4711c08c00b09fb7839ada37f0 Author: Kuba Piecuch Date: Mon Apr 13 15:50:05 2026 +0000 tools/sched_ext: Add explicit cast from void* in RESIZE_ARRAY() This fixes the following compilation error when using the header from C++ code: error: assigning to 'struct scx_flux__data_uei_dump *' from incompatible type 'void *' Signed-off-by: Kuba Piecuch Signed-off-by: Tejun Heo commit 4615361f0b148c172852590e6245a953cc075b73 Author: Kuba Piecuch Date: Mon Apr 13 12:49:02 2026 +0000 sched_ext: Make string params of __ENUM_set() const A small change to improve type safety/const correctness. __COMPAT_read_enum() already has const string parameters. It fixes a warning when using the header in C++ code: error: ISO C++11 does not allow conversion from string literal to 'char *' [-Werror,-Wwritable-strings] That's because string literals have type char[N] in C and const char[N] in C++. Signed-off-by: Kuba Piecuch Signed-off-by: Tejun Heo commit 3d3667f265148d856bc6eb54d1bd780a94e38da7 Author: Tejun Heo Date: Sun Apr 12 17:30:52 2026 -1000 tools/sched_ext: Kick home CPU for stranded tasks in scx_qmap scx_qmap uses global BPF queue maps (BPF_MAP_TYPE_QUEUE) that any CPU's ops.dispatch() can pop from. When a CPU pops a task that can't run on it (e.g. a pinned per-CPU kthread), it inserts the task into SHARED_DSQ. consume_dispatch_q() then skips the task due to affinity mismatch, leaving it stranded until some CPU in its allowed mask calls ops.dispatch(). This doesn't cause indefinite stalls -- the periodic tick keeps firing (can_stop_idle_tick() returns false when softirq is pending) -- but can cause noticeable scheduling delays. After inserting to SHARED_DSQ, kick the task's home CPU if this CPU can't run it. There's a small race window where the home CPU can enter idle before the kick lands -- if a per-CPU kthread like ksoftirqd is the stranded task, this can trigger a "NOHZ tick-stop error" warning. The kick arrives shortly after and the home CPU drains the task. Rather than fully eliminating the warning by routing pinned tasks to local or global DSQs, the current code keeps them going through the normal BPF queue path and documents the race and the resulting warning in detail. scx_qmap is an example scheduler and having tasks go through the usual dispatch path is useful for testing. The detailed comment also serves as a reference for other schedulers that may encounter similar warnings. Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 599bbba5a36f6de57ab14c373c25881e2b5273f5 Author: Linus Torvalds Date: Mon Apr 13 09:12:37 2026 -0700 proc: make PROC_MEM_FORCE_PTRACE the Kconfig default This kconfig option was introduced 18 months ago, with the historical default of always allowing forcing memory permission overrides in order to not change any existing behavior. But it was documented as "for now", and this is a gentle nudge to people that you probably _should_ be using PROC_MEM_FORCE_PTRACE. I've had that in my local kernel config since the option was introduced. Anybody who just does "make oldconfig" will pick up their old configuration with no change, so this is still meant to not change any existing system behavior, but at least gently prod people into trying it. I'd love to get rid of FOLL_FORCE entirely (see commit 8ee74a91ac30 "proc: try to remove use of FOLL_FORCE entirely" from roughly a decade ago), but sadly that is likely not a realistic option (see commit f511c0b17b08 "Yes, people use FOLL_FORCE ;)" three weeks later). But at least let's make it more obvious that you have the choice to limit it and force people to at least be a bit more conscious about their use of FOLL_FORCE, since judging from a recent discussion people weren't even aware of this one. Reminded-by: Vova Tokarev Signed-off-by: Linus Torvalds commit 080615b7213ae60965a1e6be7dc0f73737fe51bc Merge: 67f4c61a73e9b1 115e7d764dad66 Author: Takashi Iwai Date: Mon Apr 13 18:09:48 2026 +0200 Merge tag 'asoc-v7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v7.1 There's one new core feature here but mostly this has been a fairly quiet release, we've got a few new drivers and one core feature that's likely to be relatively rarely used but the bulk of the work this time around has been on quality. - Support for bus keepers, this will be used by the Apple device support. - Enhancements to the SDCA support, incuding retaskable jacks. - Unwinding of the pcm_new()/pcm_free() cleanups from Morimoto-san. - Test improvements for the Cirrus Logic drivers. - Large sets of fixes for the NXP, nVidia and Qualcomm drivers. - Support for AMD RPL DMICs, Cirrus Logic CS42L43 and CS47L47, nVidia machines with CPCAP and WM8962. commit 67f4c61a73e9b17dc9593bf27badc6785ecadd78 Author: Eric Naim Date: Mon Apr 13 23:48:17 2026 +0800 ALSA: hda/realtek: Add quirk for Legion S7 15IMH Fix speaker output on the Lenovo Legion S7 15IMH05. Cc: stable@vger.kernel.org Signed-off-by: Eric Naim Link: https://patch.msgid.link/20260413154818.351597-1-dnaim@cachyos.org Signed-off-by: Takashi Iwai commit fdcbb1bc06508eb7ad961b3876b16382ae678ef8 Merge: 028ef9c96e9619 809b997a5ce945 Author: Linus Torvalds Date: Mon Apr 13 08:39:51 2026 -0700 Merge branch 'nocache-cleanup' This series cleans up some of the special user copy functions naming and semantics. In particular, get rid of the (very traditional) double underscore names and behavior: the whole "optimize away the range check" model has been largely excised from the other user accessors because it's so subtle and can be unsafe, but also because it's just not a relevant optimization any more. To do that, a couple of drivers that misused the "user" copies as kernel copies in order to get non-temporal stores had to be fixed up, but that kind of code should never have been allowed anyway. The x86-only "nocache" version was also renamed to more accurately reflect what it actually does. This was all done because I looked at this code due to a report by Jann Horn, and I just couldn't stand the inconsistent naming, the horrible semantics, and the random misuse of these functions. This code should probably be cleaned up further, but it's at least slightly closer to normal semantics. I had a more intrusive series that went even further in trying to normalize the semantics, but that ended up hitting so many other inconsistencies between different architectures in this area (eg 'size_t' vs 'unsigned long' vs 'int' as size arguments, and various iovec check differences that Vasily Gorbik pointed out) that I ended up with this more limited version that fixed the worst of the issues. Reported-by: Jann Horn Tested-by: Will Deacon Link: https://lore.kernel.org/all/CAHk-=wgg1QVWNWG-UCFo1hx0zqrPnB3qhPzUTrWNft+MtXQXig@mail.gmail.com/ * nocache-cleanup: x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache x86: rename and clean up __copy_from_user_inatomic_nocache() x86-64: rename misleadingly named '__copy_user_nocache()' function commit e0f53c2a6ab0ea49b9cfe4d9adb1282b6e463ca6 Author: Adrián Larumbe Date: Wed Apr 8 20:12:24 2026 +0100 drm/panthor: Fix outdated function documentation 'vm' is no longer allowed to be NULL. Reviewed-by: Boris Brezillon Reviewed-by: Steven Price Fixes: 8a1cc07578bf ("drm/panthor: Add GEM logical block") Reviewed-by: Liviu Dudau Link: https://patch.msgid.link/20260408191228.537625-2-adrian.larumbe@collabora.com Signed-off-by: Adrián Larumbe commit 8867262d993d249309a8d3ec28ce095378cf1720 Author: Adrián Larumbe Date: Wed Apr 8 20:12:23 2026 +0100 drm/panthor: Extend VM locked region for remap case to be a superset In the event of an sm_step_remap() that leads to a partial unmap of a transparent huge page, the new locked region required by an extended unmap might not be a superset of the original one. Then, if it leaves a portion of the initially requested one out, the ensuing map will trigger a warning. Fixes: 8e7460eac786 ("drm/panthor: Support partial unmaps of huge pages") Reviewed-by: Boris Brezillon Reviewed-by: Steven Price Reviewed-by: Liviu Dudau Link: https://patch.msgid.link/20260408191228.537625-1-adrian.larumbe@collabora.com Signed-off-by: Adrián Larumbe commit 4248ed1013816f97f4029d06b16c67a6e43d0668 Author: Rajasi Mandal Date: Thu Apr 9 09:59:19 2026 +0000 smb: client: allow both 'lease' and 'nolease' mount options Change the nolease mount option from fsparam_flag() to fsparam_flag_no() so that both 'lease' and 'nolease' are accepted as valid mount options. Previously, only 'nolease' was recognized. Passing 'lease' would fail with an unknown parameter error (or be silently ignored with 'sloppy'). With this change: - 'nolease' disables lease requests (same behavior as before) - 'lease' explicitly enables lease requests This also renames the enum value from Opt_nolease to Opt_lease and uses result.negated to set ctx->no_lease, which is the standard pattern used by other flag_no options in the cifs mount option parser. Signed-off-by: Rajasi Mandal Reviewed-by: Meetakshi Setiya Signed-off-by: Steve French commit 2d76319c4cbb19eccfca71fa05d40a6b4ce7fc3d Author: Andi Shyti Date: Wed Apr 8 14:39:15 2026 +0200 dma-buf: fix UAF in dma_buf_put() tracepoint dma_buf_put() may drop the final file reference via fput(), which can free the dma-buf. The new tracepoint invocation was added after fput(), and DMA_BUF_TRACE() dereferences dmabuf and takes dmabuf->name_lock. This leads to a use-after-free on the final put, visible for example as a spinlock bad magic fault on a poisoned 0x6b6b6b... lock. Move the dma_buf_put tracepoint before fput(). Reported-by: Janusz Krzysztofik Fixes: 281a22631423 ("dma-buf: add some tracepoints to debug.") Signed-off-by: Andi Shyti Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260408123916.2604101-1-andi.shyti@kernel.org commit 15513eefac7ca68602e9de9853f5e671bf7b4eef Author: Linus Walleij Date: Sat Mar 28 16:55:48 2026 +0100 MIPS/mtd: Handle READY GPIO in generic NAND platform data The callbacks into the MIPS RB532 platform to read the GPIO pin indicating that the NAND chip is ready are oldschool and does not assign GPIOs as properties to the NAND device. Add a capability to the generic platform NAND chip driver to use a GPIO line to detect if a NAND chip is ready and override the platform-local drv_ready() callback with this check if the GPIO is present. This makes it possible to drop the legacy include header from the RB532 devices. Signed-off-by: Linus Walleij Acked-by: Miquel Raynal Signed-off-by: Thomas Bogendoerfer commit 42671e9c1e40032f982d2163ba4867dc85e23832 Author: Linus Walleij Date: Sat Mar 28 16:55:47 2026 +0100 MIPS/input: Move RB532 button to GPIO descriptors Convert the Mikrotik RouterBoard RB532 to use GPIO descriptors by defining a software node for the GPIO chip, then register the button platform device with full info passing the GPIO as a device property. This can be used as a base to move more of the RB532 devices over to passing GPIOs using device properties. Use the GPIO_ACTIVE_LOW flag and drop the inversion in the rb532_button_pressed() function. Signed-off-by: Linus Walleij Acked-by: Dmitry Torokhov Signed-off-by: Thomas Bogendoerfer commit f992846d0b45691a02d0a9775c5c2a50956e62a5 Author: Pengpeng Hou Date: Tue Apr 7 09:57:03 2026 +0800 MIPS: validate DT bootargs before appending them bootcmdline_scan_chosen() fetches the raw flat-DT bootargs property and passes it straight to bootcmdline_append(). That helper later feeds the same pointer into strlcat(), which computes strlen(src) before copying. Flat DT properties are external boot input, and this path does not prove that bootargs is NUL-terminated within its declared bounds. Reject unterminated bootargs properties before appending them to the kernel command line. Signed-off-by: Pengpeng Hou Signed-off-by: Thomas Bogendoerfer commit d1d0aa620a0f5fc621e5fb780e55a71962b19413 Author: Andy Shevchenko Date: Fri Mar 20 21:28:08 2026 +0100 MIPS: Alchemy: Remove unused forward declaration The 'struct gpio' is not used in the code, remove unneeded forward declaration. This seems to be a leftover for a 5 years. Acked-by: Thomas Bogendoerfer Signed-off-by: Andy Shevchenko Signed-off-by: Thomas Bogendoerfer commit b025461303d87923abfaae6cc07ba8a83ddfd844 Author: Jakub Kicinski Date: Tue Apr 7 17:14:38 2026 -0700 tcp: update window_clamp when SO_RCVBUF is set Commit under Fixes moved recomputing the window clamp to tcp_measure_rcv_mss() (when scaling_ratio changes). I suspect it missed the fact that we don't recompute the clamp when rcvbuf is set. Until scaling_ratio changes we are stuck with the old window clamp which may be based on the small initial buffer. scaling_ratio may never change. Inspired by Eric's recent commit d1361840f8c5 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning") plumb the user action thru to TCP and have it update the clamp. A smaller fix would be to just have tcp_rcvbuf_grow() adjust the clamp even if SOCK_RCVBUF_LOCK is set. But IIUC this is what we were trying to get away from in the first place. Fixes: a2cbb1603943 ("tcp: Update window clamping condition") Signed-off-by: Jakub Kicinski Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260408001438.129165-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 5152a7d4166563e5492c5d1bec3a554002120f7f Author: Benoît Monin Date: Mon Mar 16 16:25:50 2026 +0100 MAINTAINERS: Mobileye: Add EyeQ6Lplus files Use wildcard to match all EyeQ defconfigs under arch/mips. This covers the newly added defconfig, and the EyeQ5 and EyeQ6H ones. Add an entry for the dt-bindings header of the EyeQ6Lplus clocks. While at it, add myself to the maintainers of Mobileye MIPS SoCs. Signed-off-by: Benoît Monin Signed-off-by: Thomas Bogendoerfer commit 9f861f60475dba9f42229f32920f4cdd6b290a5f Author: Benoît Monin Date: Mon Mar 16 16:25:49 2026 +0100 MIPS: config: add eyeq6lplus_defconfig Add a default configuration for Mobileye EyeQ6Lplus evaluation board. Signed-off-by: Benoît Monin Signed-off-by: Thomas Bogendoerfer commit d024ba24ee6573da93eaa556d467828c5c7defd4 Author: Benoît Monin Date: Mon Mar 16 16:25:48 2026 +0100 MIPS: Add Mobileye EyeQ6Lplus evaluation board dts Add the device tree of the evaluation board of the EyeQ6Lplus SoC. The board comes with 2GB of RAM and an SPI NAND connected to the octoSPI controller The UART of the SoC is used as the serial console. Signed-off-by: Benoît Monin Signed-off-by: Thomas Bogendoerfer commit 361600d16e3aba997ec5fa482732565580a948b4 Author: Benoît Monin Date: Mon Mar 16 16:25:47 2026 +0100 MIPS: Add Mobileye EyeQ6Lplus SoC dtsi Add the device tree include files for the EyeQ6Lplus system on chip from Mobileye. Those files provide the initial support of the SoC: * The I6500 CPU and GIC interrupt controller. * The OLB ("Other Logic Block") providing clocks, resets and pin controls. * One UART. * One GPIO controller. * Two SPI controllers, one in host mode and one in target mode. * One octoSPI flash controller. * Two I2C controllers. Signed-off-by: Benoît Monin Signed-off-by: Thomas Bogendoerfer commit 4eb9ed3933e541ed96416608033620f64eea39f5 Author: Benoît Monin Date: Mon Mar 16 16:25:46 2026 +0100 clk: eyeq: Add Mobileye EyeQ6Lplus OLB Declare the PLLs and fixed factors found in the EyeQ6Lplus OLB as part of the match data for the "mobileye,eyeq6lplus-olb" compatible. The PLL and fixed factor of the CPU are registered in early init as they are required during the boot by the GIC timer. Also select clk-eyeq for all EYEQ SoCs instead of listing each one individually, as it is needed by all Mobileye EyeQ SoC. Signed-off-by: Benoît Monin Acked-by: Stephen Boyd Signed-off-by: Thomas Bogendoerfer commit fe9545bbc3c6befce2b72b53cdf12004193e63e1 Author: Benoît Monin Date: Mon Mar 16 16:25:45 2026 +0100 clk: eyeq: Adjust PLL accuracy computation The spread spectrum of the PLL found in eyeQ OLB is in 1/1024 parts of the frequency, not in 1/1000, so adjust the computation of the accuracy. Also correct the downspreading to match. Signed-off-by: Benoît Monin Acked-by: Stephen Boyd Signed-off-by: Thomas Bogendoerfer commit 8ab1e58ca9eb21d44c4716141248acac1d0635cd Author: Benoît Monin Date: Mon Mar 16 16:25:44 2026 +0100 clk: eyeq: Skip post-divisor when computing PLL frequency The output of the PLL is routed before the post-divisor so it should be ignored when computing the frequency of the PLL, functional change is implemented to reflect how the clock signal is wired internally. For the PLL of the EyeQ5, EyeQ6L, and EyeQ6H, this change has no impact as the post-divisor is either reported as disabled or set to 1. The PLL frequency is the same before and after the post-divisor. For the PLL in EyeQ6Lplus, however, the post-divisor is not 1, so it must be ignored to compute the correct frequency. Signed-off-by: Benoît Monin Acked-by: Stephen Boyd Signed-off-by: Thomas Bogendoerfer commit c4fc0fb95ad3771dc2269bc48bdde50c50d48b71 Author: Benoît Monin Date: Mon Mar 16 16:25:43 2026 +0100 pinctrl: eyeq5: Add Mobileye EyeQ6Lplus OLB Add the match data for the pinctrl found in the EyeQ6Lplus OLB. The pin control is identical in function to the one present in the EyeQ5 but has a single bank of 32 pins. Signed-off-by: Benoît Monin Reviewed-by: Linus Walleij Signed-off-by: Thomas Bogendoerfer commit 7cfa9474b91e8ed53f7d4f7b9ac42358929dc2eb Author: Benoît Monin Date: Mon Mar 16 16:25:42 2026 +0100 pinctrl: eyeq5: Use match data Instead of using the pin descriptions, pin functions and register offsets of the EyeQ5 directly, access those via a pointer to a newly introduced struct eq5p_match_data. This structure contains, in addition to the pin descriptions and pin functions, an array of pin banks. Each bank holds the number of pins and the register offsets. All functions accessing a pin now use a pointer to a bank structure and an offset inside that bank. The conversion from a pin number to a bank and an offset is done in the new function eq5p_pin_to_bank_offset(), which replace eq5p_pin_to_bank() and eq5p_pin_to_offset(). All the data related to the EyeQ5 is declared with the eq5p_eyeq5_ prefix to distinguish it from the common code. During the probe, we use the parent OF node to get the match data. We cannot directly use an OF node since pinctrl-eyeq5 is an auxiliary device of clk-eyeq. Signed-off-by: Benoît Monin Reviewed-by: Linus Walleij Signed-off-by: Thomas Bogendoerfer commit 36cab4bd8ba3145b3c4e197cdf20596279036ab7 Author: Benoît Monin Date: Mon Mar 16 16:25:41 2026 +0100 reset: eyeq: Add Mobileye EyeQ6Lplus OLB Declare the two reset domains found in the EyeQ6Lplus OLB and add them to the data matched by 'mobileye,eyeq6lplus-olb' compatible. Those reset domains are identical to those present in the EyeQ5 OLB, so no changes are needed to support them. Also select reset-eyeq for all EYEQ SoCs instead of listing each one individually, as it is needed by all Mobileye EyeQ SoC. Reviewed-by: Philipp Zabel Signed-off-by: Benoît Monin Signed-off-by: Thomas Bogendoerfer commit 2aca86de974b309e86025644f186b82e7805c352 Author: Benoît Monin Date: Mon Mar 16 16:25:40 2026 +0100 MIPS: Add Mobileye EyeQ6Lplus support Add the EyeQ6Lplus to the group of choices for Mobileye SoC and set the kernel load address specific to this SoC. Signed-off-by: Benoît Monin Signed-off-by: Thomas Bogendoerfer commit 4434c3896fab5f284469182a3cdf7cd46a7f11ce Author: Benoît Monin Date: Mon Mar 16 16:25:39 2026 +0100 dt-bindings: soc: mobileye: Add EyeQ6Lplus OLB The "Other Logic Block" found in the EyeQ6Lplus from Mobileye provides various functions for the controllers present in the SoC. The OLB produces 22 clocks derived from its input, which is connected to the main oscillator of the SoC. It provides reset signals via two reset domains. It also controls 32 pins to be either a GPIO or an alternate function. Reviewed-by: Rob Herring (Arm) Signed-off-by: Benoît Monin Reviewed-by: Linus Walleij Acked-by: Stephen Boyd Signed-off-by: Thomas Bogendoerfer commit 20e65a6dd85cbd8aa8d1e15e55a3d180516e09d3 Author: Benoît Monin Date: Mon Mar 16 16:25:38 2026 +0100 dt-bindings: mips: Add Mobileye EyeQ6Lplus SoC Add an entry to the mobileye bindings for the EyeQ6Lplus which is part of the EyeQ family of system-on-chip. Reviewed-by: Rob Herring (Arm) Signed-off-by: Benoît Monin Signed-off-by: Thomas Bogendoerfer commit c347ca17d62a32c25564fee0ca3a2a7bc2d5fd6f Author: Shuai Zhang Date: Fri Apr 10 17:54:43 2026 +0800 Bluetooth: hci_qca: Fix missing wakeup during SSR memdump handling When a Bluetooth controller encounters a coredump, it triggers the Subsystem Restart (SSR) mechanism. The controller first reports the coredump data and, once the upload is complete, sends a hw_error event. The host relies on this event to proceed with subsequent recovery actions. If the host has not finished processing the coredump data when the hw_error event is received, it waits until either the processing is complete or the 8-second timeout expires before handling the event. The current implementation clears QCA_MEMDUMP_COLLECTION using clear_bit(), which does not wake up waiters sleeping in wait_on_bit_timeout(). As a result, the waiting thread may remain blocked until the timeout expires even if the coredump collection has already completed. Fix this by clearing QCA_MEMDUMP_COLLECTION with clear_and_wake_up_bit(), which also wakes up the waiting thread and allows the hw_error handling to proceed immediately. Test case: - Trigger a controller coredump using: hcitool cmd 0x3f 0c 26 - Tested on QCA6390. - Capture HCI logs using btmon. - Verify that the delay between receiving the hw_error event and initiating the power-off sequence is reduced compared to the timeout-based behavior. Reviewed-by: Bartosz Golaszewski Reviewed-by: Paul Menzel Signed-off-by: Shuai Zhang Signed-off-by: Luiz Augusto von Dentz commit 76388eae1da94f6c29886c7e49bce1d5abf88734 Author: Thorsten Blum Date: Wed Apr 1 18:46:24 2026 +0200 Bluetooth: btintel_pcie: use strscpy to copy plain strings Use strscpy() instead of snprintf() to copy plain strings with no format specifiers. Signed-off-by: Thorsten Blum Signed-off-by: Luiz Augusto von Dentz commit 85fa3512048793076eef658f66489112dcc91993 Author: Shuvam Pandey Date: Thu Apr 9 00:32:30 2026 +0545 Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connection can be freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage in both handlers. Keep the existing keypress notification behavior unchanged by routing the early exits through a common unlock path. Fixes: 92a25256f142 ("Bluetooth: mgmt: Implement support for passkey notification") Cc: stable@vger.kernel.org Signed-off-by: Shuvam Pandey Signed-off-by: Luiz Augusto von Dentz commit a0cff16d0f6e0bcd4173583694b85df42912e644 Author: Gustavo A. R. Silva Date: Tue Apr 7 14:16:46 2026 -0600 Bluetooth: hci.h: Avoid a couple -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. struct hci_std_codecs and struct hci_std_codecs_v2 are flexible structures, this is structures that contain a flexible-array member (__u8 codec[]; and struct hci_std_codec_v2 codec[];, correspondingly.) Since struct hci_rp_read_local_supported_codecs and struct hci_rp_read_local_supported_codecs_v2 are defined by hardware, we create the new struct hci_std_codecs_hdr and struct hci_std_codecs_v2_hdr types, and use them to replace the object types causing trouble in struct hci_rp_read_local_supported_codecs and struct hci_rp_read_local_supported_codecs_v2, namely struct hci_std_codecs std_codecs; and struct hci_std_codecs_v2_hdr std_codecs;. Also, once -fms-extensions is enabled, we can use transparent struct members in both struct hci_std_codecs and struct hci_std_codecs_v2_hdr. Notice that the newly created types does not contain the flex-array member `codec`, which is the object causing the -Wfamnae warnings. After these changes, the size of struct hci_rp_read_local_supported_codecs and struct hci_rp_read_local_supported_codecs_v2, along with their member's offsets remain the same, hence the memory layouts don't change: Before changes: struct hci_rp_read_local_supported_codecs { __u8 status; /* 0 1 */ struct hci_std_codecs std_codecs; /* 1 1 */ struct hci_vnd_codecs vnd_codecs; /* 2 1 */ /* size: 3, cachelines: 1, members: 3 */ /* last cacheline: 3 bytes */ } __attribute__((__packed__)); struct hci_rp_read_local_supported_codecs_v2 { __u8 status; /* 0 1 */ struct hci_std_codecs_v2 std_codecs; /* 1 1 */ struct hci_vnd_codecs_v2 vendor_codecs; /* 2 1 */ /* size: 3, cachelines: 1, members: 3 */ /* last cacheline: 3 bytes */ } __attribute__((__packed__)); After changes: struct hci_rp_read_local_supported_codecs { __u8 status; /* 0 1 */ struct hci_std_codecs_hdr std_codecs; /* 1 1 */ struct hci_vnd_codecs vnd_codecs; /* 2 1 */ /* size: 3, cachelines: 1, members: 3 */ /* last cacheline: 3 bytes */ } __attribute__((__packed__)); struct hci_rp_read_local_supported_codecs_v2 { __u8 status; /* 0 1 */ struct hci_std_codecs_v2_hdr std_codecs; /* 1 1 */ struct hci_vnd_codecs_v2 vendor_codecs; /* 2 1 */ /* size: 3, cachelines: 1, members: 3 */ /* last cacheline: 3 bytes */ } __attribute__((__packed__)); With these changes fix the following warnings: include/net/bluetooth/hci.h:1490:31: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] include/net/bluetooth/hci.h:1525:34: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Signed-off-by: Luiz Augusto von Dentz commit 4e10a9ebbf081c16517cdd9366ac618bf38d7d0c Author: Stefan Metzmacher Date: Tue Apr 7 17:13:45 2026 +0200 Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec copy_struct_from_sockptr() fill 'buffer' in sco_sock_setsockopt() with zeros, so there's no real problem. But it actually looks strange to do this, without checking all of codecs->codecs[0] really comes from userspace: sco_pi(sk)->codec = codecs->codecs[0]; As only optlen < sizeof(struct bt_codecs) is checked and codecs->num_codecs is not checked against != 1, but only <= 1, and the space for the additional struct bt_codec is not checked. Note I don't understand bluetooth and I didn't do any runtime tests with this! I just found it when debugging a problem in copy_struct_from_sockptr(). I just added this to check the size is as expected: BUILD_BUG_ON(struct_size(codecs, codecs, 0) != 1); BUILD_BUG_ON(struct_size(codecs, codecs, 1) != 8); And made sure it still compiles using this: make CF=-D__CHECK_ENDIAN__ W=1ce C=1 net/bluetooth/sco.o Fixes: 3e643e4efa1e ("Bluetooth: Improve setsockopt() handling of malformed user input") Cc: Michal Luczaj Cc: Luiz Augusto von Dentz Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Cc: David Wei Cc: linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Metzmacher Signed-off-by: Luiz Augusto von Dentz commit 9e3d074bb21ddc35374d80bf69c3592cd3d057a2 Author: Kiran K Date: Tue Apr 7 15:32:40 2026 +0530 Bluetooth: btintel_pcie: Align shared DMA memory to 128 bytes Align each descriptor/index/context region to 128 bytes before calculating the total DMA pool size. This ensures the memory layout shared with firmware meets the 128-byte alignment requirement. The DMA pool alignment is also set to 128 bytes to match the firmware expectation for all shared structures. Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 42776497cdbc9a665b384a6dcb85f0d4bd927eab Author: Dudu Lu Date: Sun Apr 5 23:47:41 2026 +0800 Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del(). Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") Signed-off-by: Dudu Lu Signed-off-by: Luiz Augusto von Dentz commit 1c0bc11cd445ba8235ac8ec87d5999b6769ed8b9 Author: Stefano Radaelli Date: Thu Apr 2 20:47:03 2026 +0200 Bluetooth: hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x TI WL183x controllers advertise support for the HCI Enhanced Setup Synchronous Connection command, but SCO setup fails when the enhanced path is used. The only working configuration is to fall back to the legacy HCI Setup Synchronous Connection (0x0028). This matches the scenario described in commit 05abad857277 ("Bluetooth: HCI: Add HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk"). Enable HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN automatically for devices compatible with: - ti,wl1831-st - ti,wl1835-st - ti,wl1837-st Signed-off-by: Stefano Radaelli Signed-off-by: Luiz Augusto von Dentz commit 5e17010bfc7e6820a5004f1e06d08db886e3927e Author: Kamiyama Chiaki Date: Wed Apr 1 02:53:01 2026 +0900 Bluetooth: btusb: MediaTek MT7922: Add VID 0489 & PID e11d Add VID 0489 & PID e11d for MediaTek MT7922 USB Bluetooth chip. Found in Dynabook GA/ZY (W6GAZY5RCL). The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=03 Lev=01 Prnt=01 Port=03 Cnt=02 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e11d Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 Reviewed-by: Paul Menzel Signed-off-by: Kamiyama Chiaki Signed-off-by: Luiz Augusto von Dentz commit 81f971c6abec59240e2bcfc38756bda8172fa788 Author: Arnd Bergmann Date: Thu Apr 2 16:11:15 2026 +0200 Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array When USB support is disabled, the array is not referenced anywhere, causing a warning: drivers/bluetooth/btmtk.c:35:3: error: 'btmtk_mt6639_devs' defined but not used [-Werror=unused-const-variable=] 35 | } btmtk_mt6639_devs[] = { | ^~~~~~~~~~~~~~~~~ Move it into the #ifdef block. Fixes: 28b7c5a6db74 ("Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support") Signed-off-by: Arnd Bergmann Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 751b06a28b3fce0ec7a1d0df357e329dd58ad7c3 Author: Javier Tia Date: Mon Mar 30 14:39:30 2026 -0600 Bluetooth: btusb: Add MT7927 ID for ASUS X870E / ProArt X870E-Creator Add USB device ID 13d3:3588 (IMC Networks/Azurewave) for the MediaTek MT7927 (Filogic 380) Bluetooth interface found on the ASUS ROG STRIX X870E-E GAMING WIFI and ASUS ProArt X870E-Creator WiFi motherboards. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3588 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Link: https://bugzilla.kernel.org/show_bug.cgi?id=221096 Link: https://github.com/openwrt/mt76/issues/927 Signed-off-by: Javier Tia Tested-by: Jose Tiburcio Ribeiro Netto Tested-by: Ivan Lubnin Signed-off-by: Luiz Augusto von Dentz commit adcbb348e9ad4cd3ff2ba17c14c8c183a51c59e9 Author: Javier Tia Date: Mon Mar 30 14:39:29 2026 -0600 Bluetooth: btusb: Add MT7927 ID for TP-Link Archer TBE550E Add USB device ID 0489:e116 (Foxconn/Hon Hai) for the MediaTek MT7927 (Filogic 380) Bluetooth interface found on the TP-Link Archer TBE550E PCIe adapter. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=04 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e116 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb ... I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Link: https://bugzilla.kernel.org/show_bug.cgi?id=221096 Link: https://github.com/openwrt/mt76/issues/927 Signed-off-by: Javier Tia Tested-by: Thibaut FRANCOIS Signed-off-by: Luiz Augusto von Dentz commit 71708de05e77165f3030978662f1c7969ff2e874 Author: Javier Tia Date: Mon Mar 30 14:39:28 2026 -0600 Bluetooth: btusb: Add MT7927 ID for MSI X870E Ace Max Add USB device ID 0489:e110 (Foxconn/Hon Hai) for the MediaTek MT7927 (Filogic 380) Bluetooth interface found on the MSI X870E Ace Max motherboard. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=04 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e110 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb ... I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Link: https://bugzilla.kernel.org/show_bug.cgi?id=221096 Link: https://github.com/openwrt/mt76/issues/927 Signed-off-by: Javier Tia Tested-by: Nitin Gurram Signed-off-by: Luiz Augusto von Dentz commit 0e2f6aca7c3b30b72a3e6dd8b0af5c63b4ddf7a5 Author: Javier Tia Date: Mon Mar 30 14:39:27 2026 -0600 Bluetooth: btusb: Add MT7927 ID for Gigabyte Z790 AORUS MASTER X Add USB device ID 0489:e10f (Foxconn/Hon Hai) for the MediaTek MT7927 (Filogic 380) Bluetooth interface found on the Gigabyte Z790 AORUS MASTER X motherboard. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=04 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e10f Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb ... I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Link: https://bugzilla.kernel.org/show_bug.cgi?id=221096 Link: https://github.com/openwrt/mt76/issues/927 Signed-off-by: Javier Tia Tested-by: Chapuis Dario Tested-by: Evgeny Kapusta <3193631@gmail.com> Signed-off-by: Luiz Augusto von Dentz commit 6f7d4428cc921d687d8778c2edcc18cd0ee0bd17 Author: Javier Tia Date: Mon Mar 30 14:39:26 2026 -0600 Bluetooth: btusb: Add MT7927 ID for Lenovo Legion Pro 7 16ARX9 Add USB device ID 0489:e0fa (Foxconn/Hon Hai) for the MediaTek MT7927 (Filogic 380) Bluetooth interface found on the Lenovo Legion Pro 7 16ARX9 laptop. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=04 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e0fa Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb ... I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Link: https://bugzilla.kernel.org/show_bug.cgi?id=221096 Link: https://github.com/openwrt/mt76/issues/927 Signed-off-by: Javier Tia Tested-by: Llewellyn Curran Signed-off-by: Luiz Augusto von Dentz commit bfe11e17b3005e7458b46530e9d27e1d36924541 Author: Javier Tia Date: Mon Mar 30 14:39:25 2026 -0600 Bluetooth: btusb: Add MT7927 ID for ASUS ROG Crosshair X870E Hero Add USB device ID 0489:e13a (Foxconn/Hon Hai) for the MediaTek MT7927 (Filogic 380) Bluetooth interface found on the ASUS ROG Crosshair X870E Hero WiFi motherboard. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=04 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e13a Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb ... I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Link: https://bugzilla.kernel.org/show_bug.cgi?id=221096 Link: https://github.com/openwrt/mt76/issues/927 Signed-off-by: Javier Tia Tested-by: Jose Tiburcio Ribeiro Netto Signed-off-by: Luiz Augusto von Dentz commit e4f6bc7f8222a9e40283d3fc6c4c4c656d79a48e Author: Javier Tia Date: Mon Mar 30 14:39:24 2026 -0600 Bluetooth: btmtk: fix ISO interface setup for single alt setting Some MT6639 Bluetooth USB interfaces (e.g. IMC Networks 13d3:3588 on ASUS ROG STRIX X870E-E and ProArt X870E-Creator boards) expose only a single alternate setting (alt 0) on the ISO interface. The driver unconditionally requests alt setting 1, which fails with EINVAL on these devices, causing a ~20 second initialization delay and no LE audio support. Check the number of available alternate settings before selecting one. If only alt 0 exists, use it; otherwise request alt 1 as before. Closes: https://github.com/jetm/mediatek-mt7927-dkms/pull/39 Signed-off-by: Javier Tia Reported-by: Ryan Gilbert Tested-by: Ryan Gilbert Signed-off-by: Luiz Augusto von Dentz commit 28b7c5a6db74e9305c6cbcbe52f259ff1cf85158 Author: Javier Tia Date: Mon Mar 30 14:39:23 2026 -0600 Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support The MediaTek MT7927 (Filogic 380) combo WiFi 7 + BT 5.4 module uses hardware variant 0x6639 for its Bluetooth subsystem. Without this patch, the chip fails with "Unsupported hardware variant (00006639)" or hangs during firmware download. Three changes are needed to support MT6639: 1. CHIPID workaround: On some boards the BT USB MMIO register reads 0x0000 for dev_id, causing the driver to skip the 0x6639 init path. Force dev_id to 0x6639 only when the USB VID/PID matches a known MT6639 device, avoiding misdetection if a future chip also reads zero. This follows the WiFi-side pattern that uses PCI device IDs to scope the same workaround. 2. Firmware naming: MT6639 uses firmware version prefix "2_1" instead of "1_1" used by MT7925 and other variants. The firmware path is mediatek/mt7927/BT_RAM_CODE_MT6639_2_1_hdr.bin, using the mt7927 directory to match the WiFi firmware convention. The filename will likely change to use MT7927 once MediaTek submits a dedicated Linux firmware binary. 3. Section filtering: The MT6639 firmware binary contains 9 sections, but only sections with (dlmodecrctype & 0xff) == 0x01 are Bluetooth-related. Sending the remaining WiFi/other sections causes an irreversible BT subsystem hang requiring a full power cycle. This matches the Windows driver behavior observed via USB captures. Also add 0x6639 to the reset register (CONNV3) and firmware setup switch cases alongside the existing 0x7925 handling. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221096 Link: https://github.com/openwrt/mt76/issues/927 Reported-by: Ryan Gilbert Signed-off-by: Javier Tia Signed-off-by: Luiz Augusto von Dentz commit 5c7209a341ff2ac338b2b0375c34a307b37c9ac2 Author: Pauli Virtanen Date: Sun Mar 29 16:42:59 2026 +0300 Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm() assumes it is held, and if conn is deleted concurrently -> UAF. Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen, and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred listening socket code paths, hci_connect_cfm(conn) is called with hdev->lock held. Fix by holding the lock. Fixes: 70c464256310 ("Bluetooth: Refactor connection request handling") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 120941654f187674b3aac4d546c2a915965b3937 Author: Johan Hovold Date: Mon Mar 30 11:41:34 2026 +0200 Bluetooth: btmtk: refactor endpoint lookup Use the common USB helper for looking up bulk and interrupt endpoints instead of open coding. Signed-off-by: Johan Hovold Signed-off-by: Luiz Augusto von Dentz commit 5c31aaa05624b54dc18c9e313bcee5a88c025593 Author: Johan Hovold Date: Mon Mar 30 11:41:33 2026 +0200 Bluetooth: btusb: refactor endpoint lookup Use the common USB helper for looking up bulk and interrupt endpoints instead of open coding. Signed-off-by: Johan Hovold Signed-off-by: Luiz Augusto von Dentz commit 68d39ea5e0adc9ecaea1ce8abd842ec972eb8718 Author: Jonathan Rissanen Date: Fri Mar 27 11:47:20 2026 +0100 Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and setting hu->hdev to NULL. This means incoming UART data will reach the protocol-specific recv handler in hci_uart_tty_receive() after resources are freed. Clear HCI_UART_PROTO_INIT with a write lock before calling hu->proto->close() and setting hu->hdev to NULL. The write lock ensures all active readers have completed and no new reader can enter the protocol recv path before resources are freed. This allows the protocol-specific recv functions to remove the "HCI_UART_REGISTERED" guard without risking a null pointer dereference if hci_register_dev() fails. Fixes: 5df5dafc171b ("Bluetooth: hci_uart: Fix another race during initialization") Signed-off-by: Jonathan Rissanen Signed-off-by: Luiz Augusto von Dentz commit d288f4db0909c22342eb50cd1632b4d850517281 Author: Pauli Virtanen Date: Wed Mar 25 21:07:45 2026 +0200 Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists hci_cmd_sync_run_once() needs to indicate whether a queue item was added, so caller can know if callbacks are called, so it can avoid leaking resources. Change the function to return -EEXIST if queue item already exists. Modify all callsites vs. the changes. The only callsite is hci_abort_conn(). Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 7b75867803a8712bdf7683c31d71d3d5e28ce821 Author: Shuai Zhang Date: Tue Mar 24 10:30:16 2026 +0800 Bluetooth: hci_qca: disable power control for WCN7850 when bt_en is not defined On platforms using an M.2 slot with both UART and USB support, bt_en is pulled high by hardware. In this case, software-based power control should be disabled. The current platforms are Lemans-EVK and Monaco-EVK. Add QCA_WCN7850 to the existing condition so that power_ctrl_enabled is cleared when bt_en is not software-controlled (or absent), aligning its behavior with WCN6750 and WCN6855 Signed-off-by: Shuai Zhang Reviewed-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz commit 552aac414f9a2e663dfe2810999f28988720f2a4 Author: Lukas Kraft Date: Fri Mar 13 17:39:12 2026 +0100 bluetooth: btusb: Fix whitespace in btusb.c Replace single space with tab and insert blank line after declaration, according to checkpatch Signed-off-by: Lukas Kraft Signed-off-by: Luiz Augusto von Dentz commit 15bf35a660eb82a49f8397fc3d3acada8dae13db Author: Luiz Augusto von Dentz Date: Mon Mar 16 14:34:13 2026 -0400 Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU The code was printing skb->len and sdu_len in the places where it should be sdu_len and chan->imtu respectively to match the if conditions. Link: https://lore.kernel.org/linux-bluetooth/20260315132013.75ab40c5@kernel.org/T/#m1418f9c82eeff8510c1beaa21cf53af20db96c06 Fixes: e1d9a6688986 ("Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU") Signed-off-by: Luiz Augusto von Dentz Reviewed-by: Paul Menzel commit c7211b6e83342c71380c2e40ae46ce4a745b98b6 Merge: 8806d502e0a7e7 d3870724eb16c1 Author: Paolo Abeni Date: Mon Apr 13 15:09:51 2026 +0200 Merge branch 'decouple-receive-and-transmit-enablement-in-team-driver' Marc Harvey says: ==================== Decouple receive and transmit enablement in team driver Allow independent control over receive and transmit enablement states for aggregated ports in the team driver. The motivation is that IEE 802.3ad LACP "independent control" can't be implemented for the team driver currently. This was added to the bonding driver in commit 240fd405528b ("bonding: Add independent control state machine"). This series also has a few patches that add tests to show that the old coupled enablement still works and that the new decoupled enablement works as intended (4, 5, and 10). There are three patches with small fixes as well, with the goal of making the final decoupling patch clearer (1, 2, and 3). Signed-off-by: Marc Harvey ==================== Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-0-f47e7589685d@google.com Signed-off-by: Paolo Abeni commit d3870724eb16c1e6a73cff8a548af0c03a0e6c52 Author: Marc Harvey Date: Thu Apr 9 02:59:32 2026 +0000 selftests: net: Add tests for team driver decoupled tx and rx control Use ping and tcpdump to verify that independent rx and tx enablement of team driver member interfaces works as intended. Signed-off-by: Marc Harvey Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-10-f47e7589685d@google.com Signed-off-by: Paolo Abeni commit bb9215a98179509e9b1b9a31d68faeebd9339f7c Author: Marc Harvey Date: Thu Apr 9 02:59:31 2026 +0000 net: team: Add new tx_enabled team port option This option allows independent control over tx enablement without affecting rx enablement. Like the rx_enabled option, this also implicitly affects the enabled option. If this option is not used, then the enabled option will continue to behave as it did before. Tested in a follow-up patch with a new selftest. Reviewed-by: Jiri Pirko Signed-off-by: Marc Harvey Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-9-f47e7589685d@google.com Signed-off-by: Paolo Abeni commit 0e47569a574d447fec072abf3b4330974a471b97 Author: Marc Harvey Date: Thu Apr 9 02:59:30 2026 +0000 net: team: Add new rx_enabled team port option Allow independent control over rx enablement via the rx_enabled option without affecting tx enablement. This affects the normal enabled option since a port is only considered enabled if both tx and rx are enabled. If this option is not used, then the enabled option will continue to behave exactly as it did before. Tested in a follow-up patch with a new selftest. Reviewed-by: Jiri Pirko Signed-off-by: Marc Harvey Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-8-f47e7589685d@google.com Signed-off-by: Paolo Abeni commit 68f0833f279ac209ec865da76568c843dd38c508 Author: Marc Harvey Date: Thu Apr 9 02:59:29 2026 +0000 net: team: Track rx enablement separately from tx enablement Separate the rx and tx enablement/disablement into different functions so that it is easier to interact with them independently later. Although this patch changes receive and transmit paths, the actual behavior of the teaming driver should remain unchanged, since there is no option introduced yet to change rx or tx enablement independently. Those options will be added in follow-up patches. Reviewed-by: Jiri Pirko Signed-off-by: Marc Harvey Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-7-f47e7589685d@google.com Signed-off-by: Paolo Abeni commit fa6ed31dd913b0f68c75ec80c3f4a324572071fc Author: Marc Harvey Date: Thu Apr 9 02:59:28 2026 +0000 net: team: Rename enablement functions and struct members to tx Add no functional changes, but rename enablement functions, variables etc. that are used in teaming driver transmit decisions. Since rx and tx enablement are still coupled, some of the variables renamed in this patch are still used for the rx path, but that will change in a follow-up patch. Reviewed-by: Jiri Pirko Signed-off-by: Marc Harvey Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-6-f47e7589685d@google.com Signed-off-by: Paolo Abeni commit 10407eebe8861802d5117956604f94d364df85d5 Author: Marc Harvey Date: Thu Apr 9 02:59:27 2026 +0000 selftests: net: Add test for enablement of ports with teamd There are no tests that verify enablement and disablement of team driver ports with teamd. This should work even with changes to the enablement option, so it is important to test. This test sets up an active-backup network configuration across two network namespaces, and tries to send traffic while changing which link is the active one. Also increase the team test timeout to 300 seconds, because gracefully killing teamd can take 30 seconds for each instance. Signed-off-by: Marc Harvey Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-5-f47e7589685d@google.com Signed-off-by: Paolo Abeni commit 05e352444b2430de4b183b4a988085381e5fd6ad Author: Marc Harvey Date: Thu Apr 9 02:59:26 2026 +0000 selftests: net: Add tests for failover of team-aggregated ports There are currently no kernel tests that verify the effect of setting the enabled team driver option. In a followup patch, there will be changes to this option, so it will be important to make sure it still behaves as it does now. The test verifies that tcp continues to work across two different team devices in separate network namespaces, even when member links are manually disabled. Signed-off-by: Marc Harvey Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-4-f47e7589685d@google.com Signed-off-by: Paolo Abeni commit cfa477df2cc62ba53cb936669886361152b594a7 Author: Marc Harvey Date: Thu Apr 9 02:59:25 2026 +0000 net: team: Rename port_disabled team mode op to port_tx_disabled This team mode op is only used by the load balance mode, and it only uses it in the tx path. Reviewed-by: Jiri Pirko Signed-off-by: Marc Harvey Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-3-f47e7589685d@google.com Signed-off-by: Paolo Abeni commit 014f249121d73909528df320818fba7693d0ec92 Author: Marc Harvey Date: Thu Apr 9 02:59:24 2026 +0000 net: team: Remove unused team_mode_op, port_enabled This team_mode_op wasn't used by any of the team modes, so remove it. Reviewed-by: Jiri Pirko Signed-off-by: Marc Harvey Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-2-f47e7589685d@google.com Signed-off-by: Paolo Abeni commit 3faf0ce6e499dfd32e596bcb5bca2c44d64f4cc1 Author: Marc Harvey Date: Thu Apr 9 02:59:23 2026 +0000 net: team: Annotate reads and writes for mixed lock accessed values The team_port's "index" and the team's "en_port_count" are read in the hot transmit path, but are only written to when holding the rtnl lock. Use READ_ONCE() for all lockless reads of these values, and use WRITE_ONCE() for all writes. Reviewed-by: Jiri Pirko Signed-off-by: Marc Harvey Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260409-teaming-driver-internal-v7-1-f47e7589685d@google.com Signed-off-by: Paolo Abeni commit 91eb7ec7261254b6875909df767185838598e21e Author: Corey Minyard Date: Mon Apr 13 07:09:15 2026 -0500 ipmi:ssif: Remove unnecessary indention A section was in {} that didn't need to be, move the variable definition to the top and set th eindentino properly. Signed-off-by: Corey Minyard commit 44e0ebe4accd67c67134cf3b805917153041a300 Merge: 51274836193a66 92af129b4085cd Author: Vlastimil Babka (SUSE) Date: Tue Apr 7 14:39:34 2026 +0200 Merge branch 'slab/for-7.1/misc' into slab/for-next Merge misc slab changes that are not related to sheaves. Various improvements for sysfs, debugging and testing. commit 92c36b634b4586e02409488fa02a4908ee4ebea7 Author: Shaun Varghese Date: Fri Apr 10 23:15:21 2026 +0530 platform/x86: hp-wmi: add Omen 14-fb0xxx (board 8C58) support Board 8C58 (HP Omen Transcend Gaming Laptop 14-fb0xxx) appears to use the same thermal profile handling as other supported Omen systems, including board 8E41. Add it to omen_thermal_profile_boards so hp-wmi can expose the firmware thermal profiles through the platform_profile interface. Tested on Omen 14-fb0xxx: the profile handler exposes cool, balanced, and performance modes, and selecting performance increases sustained CPU package power under load. Signed-off-by: Shaun Varghese Link: https://patch.msgid.link/20260410174651.1424000-1-shaunvarghese43@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2e2a39149fe37327e0af225f09cad19526a90d48 Author: Armin Wolf Date: Mon Apr 6 22:32:37 2026 +0200 platform/wmi: Replace .no_notify_data with .min_event_size WMI drivers using the buffer-based WMI API are expected to reject undersized event payloads. Extend the WMI driver core to allow such drivers to specify their minimum supported event payload size. Also remove the now redundant .no_notify_data field. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260406203237.2970-7-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1aeded2f55f04fafb07b01e12142fd20c2a3d288 Author: Armin Wolf Date: Mon Apr 6 22:32:36 2026 +0200 platform/wmi: Extend wmidev_query_block() to reject undersized data WMI drivers using the buffer-based WMI API are expected to reject undersized query results. Extend wmidev_query_block() to enable the WMI driver core to perform this size check internally. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260406203237.2970-6-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 96b1b053e10d89f666a37b52be25ed4294e342be Author: Armin Wolf Date: Mon Apr 6 22:32:35 2026 +0200 platform/wmi: Extend wmidev_invoke_method() to reject undersized data WMI drivers using the buffer-based WMI API are expected to reject undersized method return values. Extend wmidev_invoke_method() to enable the WMI driver core to perform this size check internally. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260406203237.2970-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 204b52fadf98b77eab8fd6cba4a7d55224bbf11b Author: Armin Wolf Date: Mon Apr 6 22:32:34 2026 +0200 platform/wmi: Prepare to reject undersized unmarshalling results Driver using the buffer-based WMI API usually reject buffers resulting from WMI method calls or block queries if they contain not enough data. Prepare the WMI core for assisting in this by automatically rejecting undersized unmarshalling results. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260406203237.2970-4-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 578bc2a53ae286e438024d363ad0513f7105e6dc Author: Armin Wolf Date: Mon Apr 6 22:32:33 2026 +0200 platform/wmi: Convert drivers to use wmidev_invoke_procedure() Convert users of wmidev_invoke_method() to wmidev_invoke_procedure() where applicable to prepare for future changes. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260406203237.2970-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7e2d964f417ec13763eecfecc5d2813f63cb8da0 Author: Armin Wolf Date: Mon Apr 6 22:32:32 2026 +0200 platform/wmi: Add wmidev_invoke_procedure() Some WMI methods return no values, so the whole postprocessing of the result data is not needed for them. Add a special function for calling such WMI methods to prepare for future changes of the main wmidev_invoke_method() function. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260406203237.2970-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0ec7f158dc01e354ba83d808e46346dba826e353 Author: Marco Nenciarini Date: Wed Apr 1 22:36:38 2026 +0200 platform/x86: int3472: Add support for GPIO type 0x02 (IR flood LED) Add support for GPIO type 0x02, which controls an IR flood LED used for face authentication on some laptops (e.g. Dell Pro Max 16 Premium). Without this patch, the kernel logs "GPIO type 0x02 unknown; the sensor may not work" and IR sensors paired with a flood LED cannot function. The flood LED is registered through the LED subsystem like the existing privacy LED, including a lookup entry to allow future consumer drivers to find and control it via led_get(). To support multiple LEDs per INT3472 device, convert the single led struct member to an array with a counter. Signed-off-by: Marco Nenciarini Reviewed-by: Andy Shevchenko Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260401203638.1601661-5-mnencia@kcore.it Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4a530993dafec27085321424aeab303eb0e7869e Merge: ea8bc95fbb75da e30aa03d032df0 Author: Paolo Bonzini Date: Mon Apr 13 13:04:48 2026 +0200 Merge tag 'kvm-x86-vmxon-7.1' of https://github.com/kvm-x86/linux into HEAD KVM x86 VMXON and EFER.SVME extraction for 7.1 Move _only_ VMXON+VMXOFF and EFER.SVME toggling out of KVM (versus all of VMX and SVM enabling) out of KVM and into the core kernel so that non-KVM TDX enabling, e.g. for trusted I/O, can make SEAMCALLs without needing to ensure KVM is fully loaded. TIO isn't a hypervisor, and isn't trying to be a hypervisor. Specifically, TIO should _never_ have it's own VMCSes (that are visible to the host; the TDX-Module has it's own VMCSes to do SEAMCALL/SEAMRET), and so there is simply no reason to move that functionality out of KVM. With that out of the way, dealing with VMXON/VMXOFF and EFER.SVME is a fairly simple refcounting game. commit ea8bc95fbb75da215b7533c7c46f63423e84ff5e Merge: 1b3090da8d25b1 052ca584bd7c51 Author: Paolo Bonzini Date: Mon Apr 13 13:01:24 2026 +0200 Merge tag 'kvm-x86-nested-7.1' of https://github.com/kvm-x86/linux into HEAD KVM nested SVM changes for 7.1 (with one common x86 fix) - To minimize the probability of corrupting guest state, defer KVM's non-architectural delivery of exception payloads (e.g. CR2 and DR6) until consumption of the payload is imminent, and force delivery of the payload in all paths where userspace saves relevant state. - Use vcpu->arch.cr2 when updating vmcb12's CR2 on nested #VMEXIT to fix a bug where L2's CR2 can get corrupted after a save/restore, e.g. if the VM is migrated while L2 is faulting in memory. - Fix a class of nSVM bugs where some fields written by the CPU are not synchronized from vmcb02 to cached vmcb12 after VMRUN, and so are not up-to-date when saved by KVM_GET_NESTED_STATE. - Fix a class of bugs where the ordering between KVM_SET_NESTED_STATE and KVM_SET_{S}REGS could cause vmcb02 to be incorrectly initialized after save+restore. - Add a variety of missing nSVM consistency checks. - Fix several bugs where KVM failed to correctly update VMCB fields on nested #VMEXIT. - Fix several bugs where KVM failed to correctly synthesize #UD or #GP for SVM-related instructions. - Add support for save+restore of virtualized LBRs (on SVM). - Refactor various helpers and macros to improve clarity and (hopefully) make the code easier to maintain. - Aggressively sanitize fields when copying from vmcb12 to guard against unintentionally allowing L1 to utilize yet-to-be-defined features. - Fix several bugs where KVM botched rAX legality checks when emulating SVM instructions. Note, KVM is still flawed in that KVM doesn't address size prefix overrides for 64-bit guests; this should probably be documented as a KVM erratum. - Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12 fails instead of somewhat arbitrarily synthesizing #GP (i.e. don't bastardize AMD's already- sketchy behavior of generating #GP if for "unsupported" addresses). - Cache all used vmcb12 fields to further harden against TOCTOU bugs. commit eecdd4bd6e47bf0c8ff1e049771fa5bab7074c7c Author: Marek Vasut Date: Thu Apr 9 04:48:41 2026 +0200 drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector If the connector is disabled, the new connector state has .crtc field set to NULL and there is nothing more to validate after that point. The .crtc field being NULL is not an error. Test for .crtc being NULL, and if it is NULL, exit early with return 0. This fixes a failure in suspend/resume path, where the connector is already disabled, but .atomic_check is called, fails, returns -EINVAL and blocks the suspend entry. Fixes: aca1cbc1c986 ("drm/stm: lvds: add new STM32 LVDS Display Interface Transmitter driver") Signed-off-by: Marek Vasut Acked-by: Raphaël Gallais-Pou Link: https://patch.msgid.link/20260409024928.344010-1-marex@nabladev.com Signed-off-by: Raphael Gallais-Pou commit 1b3090da8d25b1dd59744e32e6872c2831fed874 Merge: 7e7a6e2ad24b45 b3ae3ceb556945 Author: Paolo Bonzini Date: Mon Apr 13 12:50:08 2026 +0200 Merge tag 'kvm-x86-mmu-7.1' of https://github.com/kvm-x86/linux into HEAD KVM x86 MMU changes for 7.1 - Fix an undefined behavior warning where a crafty userspace can read kvm.ko's nx_huge_pages before it's fully initialized. - Don't zero-allocate page tables that are used for splitting hugepages in the TDP MMU, as KVM is guaranteed to set all SPTEs in the page table and thus write all bytes. - Bail early when trying to unsync 4KiB mappings if the target gfn can be mapped with a 2MiB hugepage, to avoid the gfn hash lookup. commit 7e7a6e2ad24b45b323a5c2e474847650e982b82a Merge: aa856775be633b 577da677aa7cbc Author: Paolo Bonzini Date: Mon Apr 13 12:49:36 2026 +0200 Merge tag 'kvm-x86-vmx-7.1' of https://github.com/kvm-x86/linux into HEAD KVM VMX changes for 7.1 - Drop obsolete (largely ignored by hardwre) branch hint prefixes from the VMX instruction macros, as saving a byte of code per instruction provides more benefits than the (mostly) superfluous prefixes. - Use ASM_INPUT_RM() in __vmcs_writel() to coerce clang into using a register input when appropriate. - Drop unnecessary parentheses in cpu_has_load_cet_ctrl() so as not to suggest that "return (x & y);" is KVM's preferred style. commit aa856775be633b00f4f535ce6d2ce0e6ae5ecb2f Merge: c13008ed3d7614 e2138c4a5be1e5 Author: Paolo Bonzini Date: Mon Apr 13 12:49:14 2026 +0200 Merge tag 'kvm-x86-mmio-7.1' of https://github.com/kvm-x86/linux into HEAD KVM x86 emulated MMIO changes for 7.1 Copy single-chunk MMIO write values into a persistent (per-fragment) field to fix use-after-free stack bugs due to KVM dereferencing a stack pointer after an exit to userspace. Clean up and comment the emulated MMIO code to try to make it easier to maintain (not necessarily "easy", but "easier"). commit 56f295853f38d3202c20fd0d98939e7a4c56c3fb Author: Kuan-Wei Chiu Date: Sun Apr 12 21:19:52 2026 +0000 m68k: virt: Switch to qemu-virt-ctrl driver Register the "qemu-virt-ctrl" platform device during board initialization to utilize the new generic power/reset driver. Consequently, remove the legacy reset and power-off implementations specific to the virt machine. The platform's mach_reset callback is updated to call do_kernel_restart(), bridging the legacy m68k reboot path to the generic kernel restart handler framework for this machine. To prevent any regressions in reboot or power-off functionality when the driver is not built-in, explicitly select POWER_RESET and POWER_RESET_QEMU_VIRT_CTRL for the VIRT machine in Kconfig.machine. Signed-off-by: Kuan-Wei Chiu Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260412211952.3564033-3-visitorckw@gmail.com Signed-off-by: Geert Uytterhoeven commit ad9d2cd065d15c2ad992cb5db51a5bdc847e2909 Author: Kuan-Wei Chiu Date: Sun Apr 12 21:19:51 2026 +0000 power: reset: Add QEMU virt-ctrl driver Add a new driver for the 'virt-ctrl' device found on QEMU virt machines (e.g. m68k). This device provides a simple interface for system reset and power off [1]. This driver utilizes the modern system-off API to register callbacks for both system restart and power off. It also registers a reboot notifier to catch SYS_HALT events, ensuring that LINUX_REBOOT_CMD_HALT is properly handled. It is designed to be generic and can be reused by other architectures utilizing this QEMU device. Link: https://gitlab.com/qemu-project/qemu/-/blob/v10.2.0/hw/misc/virt_ctrl.c [1] Signed-off-by: Kuan-Wei Chiu Acked-by: Sebastian Reichel Link: https://patch.msgid.link/20260412211952.3564033-2-visitorckw@gmail.com Signed-off-by: Geert Uytterhoeven commit c13008ed3d76142a001ebc56d8e391431cac2411 Merge: 276f81a4912157 9830209b4ae8c8 Author: Paolo Bonzini Date: Mon Apr 13 11:53:46 2026 +0200 Merge tag 'kvm-x86-selftests-7.1' of https://github.com/kvm-x86/linux into HEAD KVM selftests changes for 7.1 - Add support for Hygon CPUs in KVM selftests. - Fix a bug in the MSR test where it would get false failures on AMD/Hygon CPUs with exactly one of RDPID or RDTSCP. - Add an MADV_COLLAPSE testcase for guest_memfd as a regression test for a bug where the kernel would attempt to collapse guest_memfd folios against KVM's will. commit 276f81a4912157a018141dfe71ab0f40e575a796 Merge: ed86b06bb35f6c de0bfdc7137d51 Author: Paolo Bonzini Date: Mon Apr 13 11:51:34 2026 +0200 Merge tag 'kvm-x86-misc-7.1' of https://github.com/kvm-x86/linux into HEAD KVM x86 misc changes for 7.1 - Advertise support for AVX512 Bit Matrix Multiply (BMM) when it's present in hardware (no additional emulation/virtualization required). - Immediately fail the build if a required #define is missing in one of KVM's headers that is included multiple times. - Reject SET_GUEST_DEBUG with -EBUSY if there's an already injected exception, mostly to prevent syzkaller from abusing the uAPI to trigger WARNs, but also because it can help prevent userspace from unintentionally crashing the VM. - Exempt SMM from CPUID faulting on Intel, as per the spec. - Misc hardening and cleanup changes. commit ed86b06bb35f6ccd2b81995803b8ec93ab97955b Merge: e74c3a8891c05f 6dad5447c7bfca Author: Paolo Bonzini Date: Mon Apr 13 11:50:41 2026 +0200 Merge tag 'kvm-x86-gmem-7.1' of https://github.com/kvm-x86/linux into HEAD KVM guest_memfd changes for 7.1 Don't mark guest_memfd folios as accessed, as guest_memfd doesn't support reclaim, the memory is unevictable, and there is no storage to write back to. commit e74c3a8891c05f88eeb87121de7e12dc95766a4a Merge: 05578316ca7246 94b4ae79ebb42a Author: Paolo Bonzini Date: Mon Apr 13 11:49:54 2026 +0200 Merge tag 'kvmarm-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 7.1 * New features: - Add support for tracing in the standalone EL2 hypervisor code, which should help both debugging and performance analysis. This comes with a full infrastructure for 'remote' trace buffers that can be exposed by non-kernel entities such as firmware. - Add support for GICv5 Per Processor Interrupts (PPIs), as the starting point for supporting the new GIC architecture in KVM. - Finally add support for pKVM protected guests, with anonymous memory being used as a backing store. About time! * Improvements and bug fixes: - Rework the dreaded user_mem_abort() function to make it more maintainable, reducing the amount of state being exposed to the various helpers and rendering a substantial amount of state immutable. - Expand the Stage-2 page table dumper to support NV shadow page tables on a per-VM basis. - Tidy up the pKVM PSCI proxy code to be slightly less hard to follow. - Fix both SPE and TRBE in non-VHE configurations so that they do not generate spurious, out of context table walks that ultimately lead to very bad HW lockups. - A small set of patches fixing the Stage-2 MMU freeing in error cases. - Tighten-up accepted SMC immediate value to be only #0 for host SMCCC calls. - The usual cleanups and other selftest churn. commit 05578316ca7246b45fb7d9eaf81308c0e0f3ee10 Merge: d880d2a9c694b6 e47b8e1db9a9bb Author: Paolo Bonzini Date: Mon Apr 13 11:46:11 2026 +0200 Merge tag 'loongarch-kvm-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v7.1 1. Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel(). 2. Let vcpu_is_preempted() a macro & some enhanments. 3. Add DMSINTC irqchip in kernel support. 4. Add KVM PMU test cases for tools/selftests. commit 4db9a9841dc1060e8805a4c40bdd7e6058d45100 Merge: 62ba6d66b22356 865867a6652ade Author: Borislav Petkov (AMD) Date: Mon Apr 13 11:43:52 2026 +0200 Merge remote-tracking branches 'ras/edac-misc' and 'ras/edac-drivers' into edac-updates * ras/edac-misc: EDAC/mc: Use kzalloc_flex() EDAC/ie31200: Make rpl_s_cfg static EDAC/mpc85xx: Constify device sysfs attributes EDAC/device: Allow addition of const sysfs attributes EDAC/pci_sysfs: Constify instance sysfs attributes EDAC/device: Constify info sysfs attributes EDAC/device: Drop unnecessary and dangerous casts of attributes EDAC/device: Drop unused macro to_edacdev_attr() EDAC/altera: Drop unused field eccmgr_sysfs_attr * ras/edac-drivers: EDAC/i10nm: Fix spelling mistake "readd" -> "read" EDAC/versalnet: Fix device_node leak in mc_probe() EDAC/versalnet: Fix memory leak in remove and probe error paths EDAC/amd64: Add support for family 19h, models 40h-4fh EDAC/i10nm: Add driver decoder for Granite Rapids server EDAC/sb: Use kzalloc_flex() EDAC/i7core: Use kzalloc_flex() EDAC/versalnet: Refactor memory controller initialization and cleanup Signed-off-by: Borislav Petkov (AMD) commit d880d2a9c694b616ccd3ba4c966275fe52e27fc3 Merge: 028ef9c96e9619 ddbf9c76c4020b Author: Paolo Bonzini Date: Mon Apr 13 11:42:26 2026 +0200 Merge tag 'kvm-riscv-7.1-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 7.1 - Fix steal time shared memory alignment checks - Fix vector context allocation leak - Fix array out-of-bounds in pmu_ctr_read() and pmu_fw_ctr_read_hi() - Fix double-free of sdata in kvm_pmu_clear_snapshot_area() - Fix integer overflow in kvm_pmu_validate_counter_mask() - Fix shift-out-of-bounds in make_xfence_request() - Fix lost write protection on huge pages during dirty logging - Split huge pages during fault handling for dirty logging - Skip CSR restore if VCPU is reloaded on the same core - Implement kvm_arch_has_default_irqchip() for KVM selftests - Factored-out ISA checks into separate sources - Added hideleg to struct kvm_vcpu_config - Factored-out VCPU config into separate sources - Support configuration of per-VM HGATP mode from KVM user space commit 69c02ffde6ed4d535fa4e693a9e572729cad3d0d Author: Greg Kroah-Hartman Date: Mon Apr 6 16:04:10 2026 +0200 HID: core: clamp report_size in s32ton() to avoid undefined shift s32ton() shifts by n-1 where n is the field's report_size, a value that comes directly from a HID device. The HID parser bounds report_size only to <= 256, so a broken HID device can supply a report descriptor with a wide field that triggers shift exponents up to 256 on a 32-bit type when an output report is built via hid_output_field() or hid_set_field(). Commit ec61b41918587 ("HID: core: fix shift-out-of-bounds in hid_report_raw_event") added the same n > 32 clamp to the function snto32(), but s32ton() was never given the same fix as I guess syzbot hadn't figured out how to fuzz a device the same way. Fix this up by just clamping the max value of n, just like snto32() does. Cc: stable Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: linux-input@vger.kernel.org Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Signed-off-by: Jiri Kosina commit f49499e635c18ead4ba6b573c63955c02056b840 Author: Ville Syrjälä Date: Wed Apr 8 18:57:44 2026 +0300 drm/i915: Walk crtcs in pipe order Currently our crtcs are registered in pipe order, and thus all the for_intel_crtc*() iterators walk the crtcs in pipe order. There are a bunch of places that more or less depend on that. Eg. during plane updates and such we want joined pipes to be processed back-to-back to give a better chance of an atomic update across the whole set. When we start to register crtcs in a different order we don't want to change the order in which the pipes get handled. Decouple the for_each_intel_crtc*() iterators from the crtc registration order by using a separate list which will be sorted by the pipe rather than the crtc index. We could probably use a simple array or something, but that would require some kind of extra iterator variable for the macros, and thus would require a lot more changes. Using a linked list keeps the fallout minimal. We can look at using a more optimal data structure later. I also added this extra junk to the atomic state iterators: "(__i) = drm_crtc_index(&(crtc)->base), (void)(__i)" even though the macro itself no longer needs the "__i" iterator. This in case the "__i" is used by the caller, and to avoid compiler warnings if it's completely unused now. v2: Flip the pipe comparison (Jani) Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260408155744.13326-3-ville.syrjala@linux.intel.com Signed-off-by: Jani Nikula commit 482bcc7ee600dcb5fb937dc742d051977fb5983c Author: Ville Syrjälä Date: Wed Apr 8 18:57:43 2026 +0300 drm/i915/joiner: Make joiner "nomodeset" state copy independent of pipe order Currently the joiner primary->secondary hw state copy still happens from the main compute_config loop alongside the primary uapi->hw state copy. The primary uapi->hw state copy must therefore happen first, or else we'll end up copying stale junk into the secondary. We have a WARN in intel_atomic_check_joiner() to make sure the CRTCs will be walked in the correct order. The plan is to reoder the CRTCs, which would mess up the order, unless we also adjust the iterators to keep the pipe order. The actual plan is to do both, so technically we should be able to just remove the WARN and call it a day. But relying on the iteration order like this is fragile and confusing, so let's move the "nomodeset" joiner state copy into the later loop where the "modeset" state copy is also done. The first loop having completely finished, we are guaranteed to have up to date hw state on the primary when we do the copy to the secondary. Cc: Jani Nikula Signed-off-by: Ville Syrjälä Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260408155744.13326-2-ville.syrjala@linux.intel.com Signed-off-by: Jani Nikula commit 005b25ad11717139ca5c14c9f06c2a60855c2afd Author: Suneel Garapati Date: Wed Apr 8 21:24:12 2026 +0000 hte: tegra194: Add Tegra264 GTE support Add AON-GTE mapping and LIC GTE instance support for the Tegra264. Move TSC clock parameters from macros to members of SoC data as values differ for Tegra264 chip. Signed-off-by: Suneel Garapati Reviewed-by: Dipen Patel Signed-off-by: Dipen Patel commit d354e47f6464bddd777916f3939bafa1673156c7 Author: Suneel Garapati Date: Wed Apr 8 21:24:11 2026 +0000 dt-bindings: timestamp: Add Tegra264 support Add timestamp provider support for the Tegra264 in devicetree bindings. Tegra264 has two generic timestamping engines (GTE) which are the always-on GTE (AON) and legacy interrupt controller (LIC) GTE. 'nvidia,slices' property is deprecated and hence not allowed for Tegra264. Signed-off-by: Suneel Garapati Reviewed-by: Krzysztof Kozlowski Signed-off-by: Dipen Patel commit 882321ccaeea52dd645dff98bfea2f92b286e673 Author: songxiebing Date: Mon Apr 13 09:18:54 2026 +0800 ALSA: hda/realtek: Add quirk for HP Spectre x360 14-ea HP Spectre x360 Convertible 14-ea0xxx (2021 model or so) doesn't make produce sound,The Bang & Olufsen speaker amplifier is not enabled. Root causing: The PCI subsystem ID is 103c:0000 (HP left it unset), while the codec subsystem ID is 103c:885b. The vendor-wide catch-all SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED) matches 103c:0000 before the codec SSID fallback is reached, so ALC245_FIXUP_HP_X360_AMP never applies. So add the quirk in alc269_fixup_tbl. Reported-by: dzidmail Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221341 Signed-off-by: songxiebing Link: https://patch.msgid.link/20260413011854.96520-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai commit 80bb50e2d459213cccff3111d5ef98ed4238c0d5 Author: Berk Cem Goksel Date: Mon Apr 13 06:49:41 2026 +0300 ALSA: caiaq: take a reference on the USB device in create_card() The caiaq driver stores a pointer to the parent USB device in cdev->chip.dev but never takes a reference on it. The card's private_free callback, snd_usb_caiaq_card_free(), can run asynchronously via snd_card_free_when_closed() after the USB device has already been disconnected and freed, so any access to cdev->chip.dev in that path dereferences a freed usb_device. On top of the refcounting issue, the current card_free implementation calls usb_reset_device(cdev->chip.dev). A reset in a free callback is inappropriate: the device is going away, the call takes the device lock in a teardown context, and the reset races with the disconnect path that the callback is already cleaning up after. Take a reference on the USB device in create_card() with usb_get_dev(), drop it with usb_put_dev() in the free callback, and remove the usb_reset_device() call. Fixes: b04dcbb7f7b1 ("ALSA: caiaq: Use snd_card_free_when_closed() at disconnection") Cc: stable@vger.kernel.org Cc: Andrey Konovalov Signed-off-by: Berk Cem Goksel Link: https://patch.msgid.link/20260413034941.1131465-3-berkcgoksel@gmail.com Signed-off-by: Takashi Iwai commit f365e47bfbe388b2dde411f8a016065274eee02f Merge: 52521e83988391 713e0f011178a2 Author: Takashi Iwai Date: Mon Apr 13 07:18:36 2026 +0200 Merge branch 'for-next' into for-linus Signed-off-by: Takashi Iwai commit c02053a9055d5fdfd32432287cca8958db1d5bc5 Author: Wolfram Sang Date: Fri Apr 10 14:53:00 2026 +0200 mailbox: mailbox-test: free channels on probe error On probe error, free the previously obtained channels. This not only prevents a leak, but also UAF scenarios because the client structure will be removed nonetheless because it was allocated with devm. Link: https://sashiko.dev/#/patchset/20260327151217.5327-2-wsa%2Brenesas%40sang-engineering.com Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers") Signed-off-by: Wolfram Sang Signed-off-by: Jassi Brar commit 0bd75b7abafb3ed199df830c539c57ef9b62c2a2 Author: Wolfram Sang Date: Fri Apr 10 14:49:12 2026 +0200 mailbox: prefix new constants with MBOX_ Commit 89e5d7d61600 ("mailbox: remove superfluous internal header") moved some constants to a public header but forgot to add a mailbox specific prefix. Add this now to prevent future collisions on a too generic naming. Link: https://sashiko.dev/#/patchset/20260327151112.5202-2-wsa%2Brenesas%40sang-engineering.com Signed-off-by: Wolfram Sang Reviewed-by: Sudeep Holla Signed-off-by: Jassi Brar commit 2de35d992ba1e4017ec21cde06a85ca7fca94810 Author: Stefan Metzmacher Date: Fri Nov 21 10:56:34 2025 +0100 smb: smbdirect: add some logging to SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}() This should make it easier to analyze any possible problems. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c31823988260a55e050a33d8f27be8ee9ee8d0c7 Author: Stefan Metzmacher Date: Thu Oct 23 02:31:28 2025 +0200 smb: smbdirect: introduce smbdirect_socket.logging infrastructure This will be used by client and server in order to keep controlling the logging when we move to shared functions. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 731a5302bedc5e2ce41b2c87e7aaaab00a6dcfa7 Author: Stefan Metzmacher Date: Mon Oct 27 16:51:12 2025 +0100 smb: smbdirect: let smbdirect.h include #include This will make it easier to use. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 84ff995ae826aa6bbcc6c7b9ea569ff67c021d72 Author: Stefan Metzmacher Date: Fri Apr 10 12:48:54 2026 +0200 smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(), so we should not call it again after post_sendmsg() moved it to the batch list. Reported-by: Ruikai Peng Closes: https://lore.kernel.org/linux-cifs/CAFD3drNOSJ05y3A+jNXSDxW-2w09KHQ0DivhxQ_pcc7immVVOQ@mail.gmail.com/ Fixes: 34abd408c8ba ("smb: server: make use of smbdirect_socket.send_io.bcredits") Cc: stable@kernel.org Cc: Steve French Cc: Tom Talpey Cc: Ruikai Peng Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Cc: security@kernel.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Acked-by: Paulo Alcantara (Red Hat) Tested-by: Ruikai Peng Signed-off-by: Steve French commit 27b7c3e916218b5eb2ee350211140e961bfc49be Author: Stefan Metzmacher Date: Fri Apr 10 12:48:54 2026 +0200 smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() smbd_send_batch_flush() already calls smbd_free_send_io(), so we should not call it again after smbd_post_send() moved it to the batch list. Reported-by: Ruikai Peng Closes: https://lore.kernel.org/linux-cifs/CAFD3drNOSJ05y3A+jNXSDxW-2w09KHQ0DivhxQ_pcc7immVVOQ@mail.gmail.com/ Fixes: 21538121efe6 ("smb: client: make use of smbdirect_socket.send_io.bcredits") Cc: stable@kernel.org Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Ruikai Peng Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Cc: security@kernel.org Acked-by: Paulo Alcantara (Red Hat) Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Tested-by: Ruikai Peng Signed-off-by: Steve French commit 3e298897f41c61450c2e7a4f457e8b2485eb35b3 Author: Joshua Klinesmith Date: Mon Apr 6 22:31:12 2026 -0400 ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the Qualcomm Crypto Engine (QCE). When QCE returns -EINPROGRESS, ksmbd treats it as an error and immediately frees the request while the hardware DMA operation is still in flight. The DMA completion callback then dereferences freed memory, causing a NULL pointer crash: pc : qce_skcipher_done+0x24/0x174 lr : vchan_complete+0x230/0x27c ... el1h_64_irq+0x68/0x6c ksmbd_free_work_struct+0x20/0x118 [ksmbd] ksmbd_exit_file_cache+0x694/0xa4c [ksmbd] Use the standard crypto_wait_req() pattern with crypto_req_done() as the completion callback, matching the approach used by the SMB client in fs/smb/client/smb2ops.c. This properly handles both synchronous engines (immediate return) and async engines (-EINPROGRESS followed by callback notification). Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Link: https://github.com/openwrt/openwrt/issues/21822 Signed-off-by: Joshua Klinesmith Acked-by: Namjae Jeon Signed-off-by: Steve French commit ad0057fb91218914d6c98268718ceb9d59b388e1 Author: Greg Kroah-Hartman Date: Mon Apr 6 15:46:48 2026 +0200 ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc The kernel ASN.1 BER decoder calls action callbacks incrementally as it walks the input. When ksmbd_decode_negTokenInit() reaches the mechToken [2] OCTET STRING element, ksmbd_neg_token_alloc() allocates conn->mechToken immediately via kmemdup_nul(). If a later element in the same blob is malformed, then the decoder will return nonzero after the allocation is already live. This could happen if mechListMIC [3] overrunse the enclosing SEQUENCE. decode_negotiation_token() then sets conn->use_spnego = false because both the negTokenInit and negTokenTarg grammars failed. The cleanup at the bottom of smb2_sess_setup() is gated on use_spnego: if (conn->use_spnego && conn->mechToken) { kfree(conn->mechToken); conn->mechToken = NULL; } so the kfree is skipped, causing the mechToken to never be freed. This codepath is reachable pre-authentication, so untrusted clients can cause slow memory leaks on a server without even being properly authenticated. Fix this up by not checking check for use_spnego, as it's not required, so the memory will always be properly freed. At the same time, always free the memory in ksmbd_conn_free() incase some other failure path forgot to free it. Cc: Namjae Jeon Cc: Steve French Cc: Sergey Senozhatsky Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Acked-by: Namjae Jeon Signed-off-by: Steve French commit 53370cf9090777774e07fd9a8ebce67c6cc333ab Author: Greg Kroah-Hartman Date: Mon Apr 6 15:46:47 2026 +0200 ksmbd: require 3 sub-authorities before reading sub_auth[2] parse_dacl() compares each ACE SID against sid_unix_NFS_mode and on match reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is the prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() compares only min(num_subauth, 2) sub-authorities so a client SID with num_subauth = 2 and sub_auth = {88, 3} will match. If num_subauth = 2 and the ACE is placed at the very end of the security descriptor, sub_auth[2] will be 4 bytes past end_of_acl. The out-of-band bytes will then be masked to the low 9 bits and applied as the file's POSIX mode, probably not something that is good to have happen. Fix this up by forcing the SID to actually carry a third sub-authority before reading it at all. Cc: Namjae Jeon Cc: Steve French Cc: Sergey Senozhatsky Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Acked-by: Namjae Jeon Signed-off-by: Steve French commit 66751841212c2cc196577453c37f7774ff363f02 Author: Greg Kroah-Hartman Date: Mon Apr 6 15:46:46 2026 +0200 ksmbd: validate EaNameLength in smb2_get_ea() smb2_get_ea() reads ea_req->EaNameLength from the client request and passes it directly to strncmp() as the comparison length without verifying that the length of the name really is the size of the input buffer received. Fix this up by properly checking the size of the name based on the value received and the overall size of the request, to prevent a later strncmp() call to use the length as a "trusted" size of the buffer. Without this check, uninitialized heap values might be slowly leaked to the client. Cc: Namjae Jeon Cc: Steve French Cc: Sergey Senozhatsky Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1c137636c9fd1f65fb1a0246abb1af3f906dd5ec Author: Eric Biggers Date: Sat Apr 4 12:43:38 2026 -0700 ksmbd: Remove unnecessary selection of CRYPTO_ECB Since the SMB server never uses any ecb(...) algorithm from the crypto_skcipher API, selecting CRYPTO_ECB is unnecessary. Remove it along with the unused CRYPTO_BLK_* constants. Signed-off-by: Eric Biggers Acked-by: Namjae Jeon Signed-off-by: Steve French commit 49110a8ce654bbe56bef7c5e44cce31f4b102b8a Author: Namjae Jeon Date: Sun Apr 12 22:16:16 2026 +0900 ksmbd: validate owner of durable handle on reconnect Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any authenticated user to hijack an orphaned durable handle by predicting or brute-forcing the persistent ID. According to MS-SMB2, the server MUST verify that the SecurityContext of the reconnect request matches the SecurityContext associated with the existing open. Add a durable_owner structure to ksmbd_file to store the original opener's UID, GID, and account name. and catpure the owner information when a file handle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner() to validate the identity of the requester during SMB2_CREATE (DHnC). Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2") Reported-by: Davide Ornaghi Reported-by: Navaneeth K Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 235e32320a470fcd3998fb3774f2290a0eb302a1 Author: Namjae Jeon Date: Sat Apr 4 21:09:02 2026 +0900 ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger When a durable file handle survives session disconnect (TCP close without SMB2_LOGOFF), session_fd_check() sets fp->conn = NULL to preserve the handle for later reconnection. However, it did not clean up the byte-range locks on fp->lock_list. Later, when the durable scavenger thread times out and calls __ksmbd_close_fd(NULL, fp), the lock cleanup loop did: spin_lock(&fp->conn->llist_lock); This caused a slab use-after-free because fp->conn was NULL and the original connection object had already been freed by ksmbd_tcp_disconnect(). The root cause is asymmetric cleanup: lock entries (smb_lock->clist) were left dangling on the freed conn->lock_list while fp->conn was nulled out. To fix this issue properly, we need to handle the lifetime of smb_lock->clist across three paths: - Safely skip clist deletion when list is empty and fp->conn is NULL. - Remove the lock from the old connection's lock_list in session_fd_check() - Re-add the lock to the new connection's lock_list in ksmbd_reopen_durable_fd(). Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2") Co-developed-by: munan Huang Signed-off-by: munan Huang Reviewed-by: ChenXiaoSong Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 3df614ebc976bb23d2f99734695c1b7ff126d7fc Author: Rosen Penev Date: Thu Mar 5 22:35:22 2026 -0800 ksmbd: ipc: use kzalloc_flex and __counted_by The former is just a nice macro and the latter allows runtime analysis of the allocation and its size. Signed-off-by: Rosen Penev Acked-by: Namjae Jeon Signed-off-by: Steve French commit 95e1d378ce30af134e6abb4db4e2891864467e39 Author: ZhangGuoDong Date: Tue Mar 3 15:13:16 2026 +0000 smb: move filesystem_vol_info into common/fscc.h The structure definition on the server side is specified in MS-CIFS 2.2.8.2.3, but we should instead refer to MS-FSCC 2.5.9, just as the client side does. Modify the following places: - smb3_fs_vol_info -> filesystem_vol_info - SerialNumber -> VolumeSerialNumber - VolumeLabelSize -> VolumeLabelLength Then move it into common header file. Signed-off-by: ZhangGuoDong Reviewed-by: ChenXiaoSong Reviewed-by: Steve French Acked-by: Namjae Jeon Signed-off-by: Steve French commit 31884d4bc981bb7663d33ce594f761796d0f4f55 Author: ZhangGuoDong Date: Tue Mar 3 15:13:15 2026 +0000 smb: move file_basic_info into common/fscc.h This struct definition is specified in MS-FSCC, so move them into fscc.h. Modify the following places: - smb2_file_basic_info -> file_basic_info - Pad1 -> Pad Signed-off-by: ZhangGuoDong Reviewed-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit a5e581093b1d9321cbb627dd8c209d0d4e0a988a Author: ZhangGuoDong Date: Tue Mar 3 15:13:14 2026 +0000 smb: move some definitions from common/smb2pdu.h into common/fscc.h These definitions are specified in MS-FSCC, so move them into fscc.h. Only add some documentation references, no other changes. Signed-off-by: ZhangGuoDong Reviewed-by: ChenXiaoSong Reviewed-by: Steve French Acked-by: Namjae Jeon Signed-off-by: Steve French commit 71b500afd2f7336f5b6c6026f2af546fc079be26 Merge: 47687a29b2c3ac f1cc94665df907 Author: Alexei Starovoitov Date: Sun Apr 12 15:42:57 2026 -0700 Merge branch 'bpf-fix-short-ipv4-ipv6-handling-in-test_run_skb' Sun Jian says: ==================== bpf: fix short IPv4/IPv6 handling in test_run_skb bpf_prog_test_run_skb() may access IPv4/IPv6 network headers based on skb->protocol even when the provided test input only contains an Ethernet header. Fix it by rejecting such short IPv4/IPv6 inputs before accessing the L3 headers, and add a selftest that exercises the reported bpf_skb_adjust_room() path on ETH_HLEN-sized IPv4/IPv6 EtherType inputs. Changes in v4: - Split the selftests into a separate patch. - Rework the selftest to actually execute a BPF program calling bpf_skb_adjust_room(). - Reuse a single struct ethhdr eth_hlen and initialize h_proto from the test case table. - Add the Fixes tag to the test_run.c patch. Link: https://lore.kernel.org/bpf/CABFUUZF_CWQZrRk=L9cNxO=8Z4iSgGfXi3J=hpzeyTKDbfE2-w@mail.gmail.com/T/#mfabfe7e86bb30c0141fbc9f751b8b1cb07767f01 ==================== Link: https://patch.msgid.link/20260408034623.180320-1-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov commit f1cc94665df907a85589ddb5fe74d7768ff61533 Author: Sun Jian Date: Wed Apr 8 11:46:23 2026 +0800 selftests/bpf: cover short IPv4/IPv6 inputs with adjust_room Add a selftest covering ETH_HLEN-sized IPv4/IPv6 EtherType inputs for bpf_prog_test_run_skb(). Reuse a single zero-initialized struct ethhdr eth_hlen and set eth_hlen.h_proto from the per-test h_proto field. Also add a dedicated tc_adjust_room program and route the short IPv4/IPv6 cases to it, so the selftest actually exercises the bpf_skb_adjust_room() path from the report. Signed-off-by: Sun Jian Link: https://lore.kernel.org/r/20260408034623.180320-3-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov commit 12bec2bd4b76d81c5d3996bd14ec1b7f4d983747 Author: Sun Jian Date: Wed Apr 8 11:46:22 2026 +0800 bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb bpf_prog_test_run_skb() calls eth_type_trans() first and then uses skb->protocol to initialize sk family and address fields for the test run. For IPv4 and IPv6 packets, it may access ip_hdr(skb) or ipv6_hdr(skb) even when the provided test input only contains an Ethernet header. Reject the input earlier if the Ethernet frame carries IPv4/IPv6 EtherType but the L3 header is too short. Fold the IPv4/IPv6 header length checks into the existing protocol switch and return -EINVAL before accessing the network headers. Fixes: fa5cb548ced6 ("bpf: Setup socket family and addresses in bpf_prog_test_run_skb") Reported-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc Signed-off-by: Sun Jian Link: https://lore.kernel.org/r/20260408034623.180320-2-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov commit 8806d502e0a7e7d895b74afbd24e8550a65a2b17 Merge: 06b97ff99712b3 29b1ee8788c5fe Author: Jakub Kicinski Date: Sun Apr 12 15:29:06 2026 -0700 Merge branch 'net-fix-skb_ext-build_bug_on-failures-with-gcov' Konstantin Khorenko says: ==================== net: fix skb_ext BUILD_BUG_ON failures with GCOV This mini-series fixes build failures in net/core/skbuff.c when the kernel is built with CONFIG_GCOV_PROFILE_ALL=y. This is part of a larger effort to add -fprofile-update=atomic to global CFLAGS_GCOV (posted earlier as a combined series): https://lore.kernel.org/lkml/20260401142020.1434243-1-khorenko@virtuozzo.com/T/#t That combined series was split per subsystem as requested by Jakub. The companion patches are: - iommu: use __always_inline for amdv1pt_install_leaf_entry() (sent to iommu maintainers) - gcov: add -fprofile-update=atomic globally (sent to gcov/kbuild maintainers, depends on this series and the iommu patch) Patch 1/2 fixes a pre-existing build failure with CONFIG_GCOV_PROFILE_ALL: GCOV counters prevent GCC from constant-folding the skb_ext_total_length() loop. It also removes the CONFIG_KCOV_INSTRUMENT_ALL preprocessor guard from d6e5794b06c0: that guard was a precaution in case KCOV instrumentation also prevented constant folding, but KCOV's -fsanitize-coverage=trace-pc does not interfere with GCC's constant folding (verified experimentally with GCC 14.2 and GCC 16.0.1), so the guard is unnecessary. Patch 2/2 is an additional fix needed when -fprofile-update=atomic is added to CFLAGS_GCOV: __no_profile on the __always_inline function alone is insufficient because after inlining, the code resides in the caller's profiled body. The caller (skb_extensions_init) needs __no_profile and noinline to prevent re-exposure to GCOV instrumentation. ==================== Link: https://patch.msgid.link/20260410162150.3105738-1-khorenko@virtuozzo.com Signed-off-by: Jakub Kicinski commit 29b1ee8788c5fe03588e06adf0868008305d9b01 Author: Konstantin Khorenko Date: Fri Apr 10 19:21:50 2026 +0300 net: add noinline __init __no_profile to skb_extensions_init() for GCOV compatibility With -fprofile-update=atomic in global CFLAGS_GCOV, GCC still cannot constant-fold the skb_ext_total_length() loop when it is inlined into a profiled caller. The existing __no_profile on skb_ext_total_length() itself is insufficient because after __always_inline expansion the code resides in the caller's body, which still carries GCOV instrumentation. Mark skb_extensions_init() with __no_profile so the BUILD_BUG_ON checks can be evaluated at compile time. Also mark it noinline to prevent the compiler from inlining it into skb_init() (which lacks __no_profile), which would re-expose the function body to GCOV instrumentation. Add __init since skb_extensions_init() is only called from __init skb_init(). Previously it was implicitly inlined into the .init.text section; with noinline it would otherwise remain in permanent .text, wasting memory after boot. Build-tested with both CONFIG_GCOV_PROFILE_ALL=y and CONFIG_KCOV_INSTRUMENT_ALL=y. Signed-off-by: Konstantin Khorenko Link: https://patch.msgid.link/20260410162150.3105738-3-khorenko@virtuozzo.com Signed-off-by: Jakub Kicinski commit c0b4382c86e3d92f79b71c9ed55654db520d7b36 Author: Konstantin Khorenko Date: Fri Apr 10 19:21:49 2026 +0300 net: fix skb_ext_total_length() BUILD_BUG_ON with CONFIG_GCOV_PROFILE_ALL When CONFIG_GCOV_PROFILE_ALL=y is enabled, the kernel fails to build: In file included from : In function 'skb_extensions_init', inlined from 'skb_init' at net/core/skbuff.c:5214:2: ././include/linux/compiler_types.h:706:45: error: call to '__compiletime_assert_1490' declared with attribute error: BUILD_BUG_ON failed: skb_ext_total_length() > 255 CONFIG_GCOV_PROFILE_ALL adds -fprofile-arcs -ftest-coverage -fno-tree-loop-im to CFLAGS globally. GCC inserts branch profiling counters into the skb_ext_total_length() loop and, combined with -fno-tree-loop-im (which disables loop invariant motion), cannot constant-fold the result. BUILD_BUG_ON requires a compile-time constant and fails. The issue manifests in kernels with 5+ SKB extension types enabled (e.g., after addition of SKB_EXT_CAN, SKB_EXT_PSP). With 4 extensions GCC can still unroll and fold the loop despite GCOV instrumentation; with 5+ it gives up. Mark skb_ext_total_length() with __no_profile to prevent GCOV from inserting counters into this function. Without counters the loop is "clean" and GCC can constant-fold it even with -fno-tree-loop-im active. This allows BUILD_BUG_ON to work correctly while keeping GCOV profiling for the rest of the kernel. This also removes the CONFIG_KCOV_INSTRUMENT_ALL preprocessor guard introduced by d6e5794b06c0. That guard was added as a precaution because KCOV instrumentation was also suspected of inhibiting constant folding. However, KCOV uses -fsanitize-coverage=trace-pc, which inserts lightweight trace callbacks that do not interfere with GCC's constant folding or loop optimization passes. Only GCOV's -fprofile-arcs combined with -fno-tree-loop-im actually prevents the compiler from evaluating the loop at compile time. The guard is therefore unnecessary and can be safely removed. Fixes: 96ea3a1e2d31 ("can: add CAN skb extension infrastructure") Signed-off-by: Konstantin Khorenko Reviewed-by: Thomas Weissschuh Link: https://patch.msgid.link/20260410162150.3105738-2-khorenko@virtuozzo.com Signed-off-by: Jakub Kicinski commit 06b97ff99712b3c55593d9a19326d01ff8d99b04 Merge: 6bc78039a77a46 4bf38bac1b2e25 Author: Jakub Kicinski Date: Sun Apr 12 15:26:18 2026 -0700 Merge branch 'ipa-v5-2-support' Luca Weiss says: ==================== IPA v5.2 support Add support for IPA v5.2 which can be found in the Milos SoC. ==================== Link: https://patch.msgid.link/20260410-ipa-v5-2-v2-0-778422a05060@fairphone.com Signed-off-by: Jakub Kicinski commit 4bf38bac1b2e2586a14529053cf56346db8a0032 Author: Luca Weiss Date: Fri Apr 10 09:40:08 2026 +0200 net: ipa: add IPA v5.2 configuration data Add the configuration data required for IPA v5.2, which is used in the Qualcomm Milos SoC. Reviewed-by: Simon Horman Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20260410-ipa-v5-2-v2-2-778422a05060@fairphone.com Signed-off-by: Jakub Kicinski commit d471d70cc964c3fe5c5e7765ab07b5f2f70f276e Author: Luca Weiss Date: Fri Apr 10 09:40:07 2026 +0200 dt-bindings: net: qcom,ipa: add Milos compatible Add support for the Milos SoC, which uses IPA v5.2. Acked-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20260410-ipa-v5-2-v2-1-778422a05060@fairphone.com Signed-off-by: Jakub Kicinski commit 2dddb34dd0d07b01fa770eca89480a4da4f13153 Author: Daniel Golle Date: Fri Apr 10 03:57:52 2026 +0100 net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers The PPE enforces output frame size limits via per-tag-layer VLAN_MTU registers that the driver never initializes. The hardware defaults do not account for PPPoE overhead, causing the PPE to punt encapsulated frames back to the CPU instead of forwarding them. Initialize the registers at PPE start and on MTU changes using the maximum GMAC MTU. This is a conservative approximation -- the actual per-PPE requirement depends on egress path, but using the global maximum ensures the limits are never too small. Fixes: ba37b7caf1ed2 ("net: ethernet: mtk_eth_soc: add support for initializing the PPE") Signed-off-by: Daniel Golle Link: https://patch.msgid.link/ec995ab8ce8be423267a1cc093147a74d2eb9d82.1775789829.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 6bc78039a77a46d89df987813fbafe333cd81367 Author: Qingfang Deng Date: Fri Apr 10 13:49:50 2026 +0800 pppox: convert pppox_sk() to use container_of() Use container_of() macro instead of direct pointer casting to get the pppox_sock from a sock pointer. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260410054954.114031-2-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski commit 105369d627b946f6a05f25e9c399167b1674d4bc Author: Qingfang Deng Date: Fri Apr 10 13:49:49 2026 +0800 pppox: remove sk_pppox() helper The sk member can be directly accessed from struct pppox_sock without relying on type casting. Remove the sk_pppox() helper and update all call sites to use po->sk directly. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260410054954.114031-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski commit 0fedce7244e4b85c049ce579c87e298a1b0b811d Author: Anthony Pighin (Nokia) Date: Tue Nov 25 18:00:10 2025 +0000 rtc: abx80x: Disable alarm feature if no interrupt attached Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm") exposed an issue where the rtc-abx80x driver does not clear the alarm feature bit, but instead relies on the set_alarm operation to return invalid. For example, when a RTC_UIE_ON ioctl is handled, it should abort at the feature validation. Instead, it proceeds to the rtc_timer_enqueue(), which used to return an error from the set_alarm call. However, following the race condition handling, which likely should not be discarding predecing errors, a success condition is returned to the ioctl() caller. This results in (for example): hwclock: select() to /dev/rtc0 to wait for clock tick timed out Notwithstanding the validity of the race condition handling, if an interrupt wasn't specified, or could not be attached, the driver should clear the alarm feature bit. Fixes: 718a820a303c ("rtc: abx80x: add alarm support") Signed-off-by: Anthony Pighin Link: https://patch.msgid.link/BN0PR08MB69510928028C933749F4139383D1A@BN0PR08MB6951.namprd08.prod.outlook.com Signed-off-by: Alexandre Belloni commit 47687a29b2c3acc9aa553737d482645813878aed Author: Alexei Starovoitov Date: Sun Apr 12 14:06:36 2026 -0700 selftests/bpf: Use memfd_create instead of shm_open in cgroup_iter_memcg Replace shm_open/shm_unlink with memfd_create in the shmem subtest. shm_open requires /dev/shm to be mounted, which is not always available in test environments, causing the test to fail with ENOENT. memfd_create creates an anonymous shmem-backed fd without any filesystem dependency while exercising the same shmem accounting path. Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20260412210636.47516-1-alexei.starovoitov@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi commit 5e700c773032e02def9a4c33d0023ebc3925cdd3 Merge: d114bfdc9b76bf edccdd1eb94712 Author: Jakub Kicinski Date: Sun Apr 12 14:37:10 2026 -0700 Merge branch 'mlx5-misc-fixes-2026-04-09' Tariq Toukan says: ==================== mlx5 misc fixes 2026-04-09 This small patchset provides misc bug fixes from Gal to the mlx5 Eth driver. ==================== Link: https://patch.msgid.link/20260409202852.158059-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit edccdd1eb94712da97a6ce71123ec27890add754 Author: Gal Pressman Date: Thu Apr 9 23:28:52 2026 +0300 net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() The do-while poll loop uses jiffies for its timeout: expires = jiffies + msecs_to_jiffies(10); jiffies is sampled at an arbitrary point within the current tick, so the first partial tick contributes anywhere from a full tick down to nearly zero real time. For small msecs_to_jiffies() results this is significant, the effective poll window can be much shorter than the requested 10ms, and in the worst case the loop exits after a single iteration (e.g., when HZ=100), well before the device has delivered the CQE. Replace the loop with read_poll_timeout_atomic(), which counts elapsed time via udelay() accounting rather than jiffies, guaranteeing the full poll window regardless of HZ. Additionally, read_poll_timeout_atomic() executes the poll operation one more time after the timeout has expired, giving the CQE a final chance to be detected. The old do-while loop could exit without a final poll if the timeout expired during the udelay() between iterations. Fixes: 76e463f6508b ("net/mlx5e: Overcome slow response for first IPsec ASO WQE") Signed-off-by: Gal Pressman Reviewed-by: Jianbo Liu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260409202852.158059-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 9994ad4df82d64e57135c0f0906897685f5a9e87 Author: Gal Pressman Date: Thu Apr 9 23:28:51 2026 +0300 net/mlx5e: Fix features not applied during netdev registration mlx5e_fix_features() returns early when the netdevice is not present. This is correct during profile transitions where priv is cleared, but it also incorrectly blocks feature fixups during register_netdev(), when the device is also not yet present. It is not trivial to distinguish between both cases as we cannot use priv to carry state, and in both cases reg_state == NETREG_REGISTERED. Force a netdev features update after register_netdev() completes, where the device is present and fix_features() can actually work. This is not a pretty solution, as it results in an additional features update call (register_netdevice() already calls __netdev_update_features() internally), but it is the simplest, cleanest, and most robust way I found to fix this issue after multiple attempts. This fixes an issue on systems where CQE compression is enabled by default, RXHASH remains enabled after registration despite the two features being mutually exclusive. Fixes: ab4b01bfdaa6 ("net/mlx5e: Verify dev is present for fix features ndo") Signed-off-by: Gal Pressman Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260409202852.158059-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit f05b619d0fb67d38565ad5d1a83c189984aaa0ac Merge: 9336854a59e370 a1bac8b70ede33 Author: Jakub Kicinski Date: Sun Apr 12 14:34:27 2026 -0700 Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2026-04-09 * 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Add icm_mng_function_id_mode cap bit net/mlx5: Rename MLX5_PF page counter type to MLX5_SELF net/mlx5: Add vhca_id_type bit to alias context mlx5: Remove redundant iseg base ==================== Link: https://patch.msgid.link/20260409110431.154894-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d114bfdc9b76bf93b881e195b7ec957c14227bab Author: Norbert Szetei Date: Thu Apr 9 18:34:12 2026 +0200 vsock: fix buffer size clamping order In vsock_update_buffer_size(), the buffer size was being clamped to the maximum first, and then to the minimum. If a user sets a minimum buffer size larger than the maximum, the minimum check overrides the maximum check, inverting the constraint. This breaks the intended socket memory boundaries by allowing the vsk->buffer_size to grow beyond the configured vsk->buffer_max_size. Fix this by checking the minimum first, and then the maximum. This ensures the buffer size never exceeds the buffer_max_size. Fixes: b9f2b0ffde0c ("vsock: handle buffer_size sockopts in the core") Suggested-by: Stefano Garzarella Signed-off-by: Norbert Szetei Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/180118C5-8BCF-4A63-A305-4EE53A34AB9C@doyensec.com Signed-off-by: Jakub Kicinski commit 9336854a59e370386c28a9e956bcb1111ac89717 Merge: cf5389811ae61f fb37aea2a00e67 Author: Jakub Kicinski Date: Sun Apr 12 14:30:27 2026 -0700 Merge branch 'net-reduce-sk_filter-and-friends-bloat' Eric Dumazet says: ==================== net: reduce sk_filter() (and friends) bloat Some functions return an error by value, and a drop_reason by an output parameter. This extra parameter can force stack canaries. A drop_reason is enough and more efficient. This series reduces bloat by 678 bytes on x86_64: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.final add/remove: 0/0 grow/shrink: 3/18 up/down: 79/-757 (-678) Function old new delta vsock_queue_rcv_skb 50 79 +29 ipmr_cache_report 1290 1315 +25 ip6mr_cache_report 1322 1347 +25 tcp_v6_rcv 3169 3167 -2 packet_rcv_spkt 329 327 -2 unix_dgram_sendmsg 1731 1726 -5 netlink_unicast 957 945 -12 netlink_dump 1372 1359 -13 sk_filter_trim_cap 889 858 -31 netlink_broadcast_filtered 1633 1595 -38 tcp_v4_rcv 3152 3111 -41 raw_rcv_skb 122 80 -42 ping_queue_rcv_skb 109 61 -48 ping_rcv 215 162 -53 rawv6_rcv_skb 278 224 -54 __sk_receive_skb 690 632 -58 raw_rcv 591 527 -64 udpv6_queue_rcv_one_skb 935 869 -66 udp_queue_rcv_one_skb 919 853 -66 tun_net_xmit 1146 1074 -72 sock_queue_rcv_skb_reason 166 76 -90 Total: Before=29722890, After=29722212, chg -0.00% Future conversions from sock_queue_rcv_skb() to sock_queue_rcv_skb_reason() can be done later. ==================== Link: https://patch.msgid.link/20260409145625.2306224-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit fb37aea2a00e67ef5264ea39371d350a1d19b24f Author: Eric Dumazet Date: Thu Apr 9 14:56:24 2026 +0000 net: change sk_filter_trim_cap() to return a drop_reason by value Current return value can be replaced with the drop_reason, reducing kernel bloat: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/2 grow/shrink: 1/11 up/down: 32/-603 (-571) Function old new delta tcp_v6_rcv 3135 3167 +32 unix_dgram_sendmsg 1731 1726 -5 netlink_unicast 957 945 -12 netlink_dump 1372 1359 -13 sk_filter_trim_cap 882 858 -24 tcp_v4_rcv 3143 3111 -32 __pfx_tcp_filter 32 - -32 netlink_broadcast_filtered 1633 1595 -38 sock_queue_rcv_skb_reason 126 76 -50 tun_net_xmit 1127 1074 -53 __sk_receive_skb 690 632 -58 udpv6_queue_rcv_one_skb 935 869 -66 udp_queue_rcv_one_skb 919 853 -66 tcp_filter 154 - -154 Total: Before=29722783, After=29722212, chg -0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260409145625.2306224-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 97449a5f1a586d2befde5297b0fcb0bfdade774e Author: Eric Dumazet Date: Thu Apr 9 14:56:23 2026 +0000 tcp: change tcp_filter() to return the reason by value sk_filter_trim_cap() will soon return the reason by value, do the same for tcp_filter(). Note: tcp_filter() is no longer inlined. Following patch will inline it again. $ scripts/bloat-o-meter -t vmlinux.4 vmlinux.5 add/remove: 2/0 grow/shrink: 0/2 up/down: 186/-43 (143) Function old new delta tcp_filter - 154 +154 __pfx_tcp_filter - 32 +32 tcp_v4_rcv 3152 3143 -9 tcp_v6_rcv 3169 3135 -34 Total: Before=29722640, After=29722783, chg +0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260409145625.2306224-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit c78bcbd51976f123909e5c2baf8cebb699453c2f Author: Eric Dumazet Date: Thu Apr 9 14:56:22 2026 +0000 net: change sk_filter_reason() to return the reason by value sk_filter_trim_cap will soon return the reason by value, do the same for sk_filter_reason(). $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 0/2 up/down: 0/-21 (-21) Function old new delta sock_queue_rcv_skb_reason 128 126 -2 tun_net_xmit 1146 1127 -19 Total: Before=29722661, After=29722640, chg -0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260409145625.2306224-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 734ea7e324ad1cee2a21f909f756b5e2d903a224 Author: Eric Dumazet Date: Thu Apr 9 14:56:21 2026 +0000 net: always set reason in sk_filter_trim_cap() sk_filter_trim_cap() will soon return the drop reason by value. Make sure *reason is cleared when no error is returned, to ease this conversion. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-7 (-7) Function old new delta sk_filter_trim_cap 889 882 -7 Total: Before=29722668, After=29722661, chg -0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260409145625.2306224-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 900f27fb797c7eaf0b84b7a6516613e19746bc4e Author: Eric Dumazet Date: Thu Apr 9 14:56:20 2026 +0000 net: change sock_queue_rcv_skb_reason() to return a drop_reason Change sock_queue_rcv_skb_reason() to return the drop_reason directly instead of using a reference. This is part of an effort to remove stack canaries and reduce bloat. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 3/7 up/down: 79/-301 (-222) Function old new delta vsock_queue_rcv_skb 50 79 +29 ipmr_cache_report 1290 1315 +25 ip6mr_cache_report 1322 1347 +25 packet_rcv_spkt 329 327 -2 sock_queue_rcv_skb_reason 166 128 -38 raw_rcv_skb 122 80 -42 ping_queue_rcv_skb 109 61 -48 ping_rcv 215 162 -53 rawv6_rcv_skb 278 224 -54 raw_rcv 591 527 -64 Total: Before=29722890, After=29722668, chg -0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260409145625.2306224-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit cf5389811ae61fa8749a443d822e9a374080b251 Merge: 600f01dc4bd0c7 96aefe3afe0e12 Author: Jakub Kicinski Date: Sun Apr 12 14:19:25 2026 -0700 Merge branch 'add-support-for-pic64-hpsc-hx-mdio-controller' Charles Perry says: ==================== Add support for PIC64-HPSC/HX MDIO controller This series adds a driver for the two MDIO controllers of PIC64-HPSC/HX. The hardware supports C22 and C45 but only C22 is implemented for now. This MDIO hardware is based on a Microsemi design supported in Linux by mdio-mscc-miim.c. However, The register interface is completely different with pic64hpsc, hence the need for a separate driver. The documentation recommends an input clock of 156.25MHz and a prescaler of 39, which yields an MDIO clock of 1.95MHz. This was tested on Microchip HB1301 evalkit which has a VSC8574 and a VSC8541. I've tested with bus frequencies of 0.6, 1.95 and 2.5 MHz. This series also adds a PHY write barrier when disabling PHY interrupts as discussed in: https://lore.kernel.org/acvUqDgepCIScs8M@shell.armlinux.org.uk ==================== Link: https://patch.msgid.link/20260408131821.1145334-1-charles.perry@microchip.com Signed-off-by: Jakub Kicinski commit 96aefe3afe0e122a1472967224ffe21c3d51b67b Author: Charles Perry Date: Wed Apr 8 06:18:16 2026 -0700 net: phy: add a PHY write barrier when disabling interrupts MDIO bus controllers are not required to wait for write transactions to complete before returning as synchronization is often achieved by polling status bits. This can cause issues when disabling interrupts since an interrupt could fire before the interrupt handler is unregistered and there's no status bit to poll. Add a phy_write_barrier() function and use it in phy_disable_interrupts() to fix this issue. The write barrier just reads an MII register and discards the value, which is enough to guarantee that previous writes have completed. Signed-off-by: Charles Perry Link: https://patch.msgid.link/20260408131821.1145334-4-charles.perry@microchip.com Signed-off-by: Jakub Kicinski commit f76aef980206e7c6bc09933fd3c8e2b8a3479bd2 Author: Charles Perry Date: Wed Apr 8 06:18:15 2026 -0700 net: mdio: add a driver for PIC64-HPSC/HX MDIO controller This adds an MDIO driver for PIC64-HPSC/HX. The hardware supports C22 and C45 but only C22 is implemented in this commit. This MDIO hardware is based on a Microsemi design supported in Linux by mdio-mscc-miim.c. However, The register interface is completely different with pic64hpsc, hence the need for a separate driver. The documentation recommends an input clock of 156.25MHz and a prescaler of 39, which yields an MDIO clock of 1.95MHz. The hardware supports an interrupt pin or a "TRIGGER" bit that can be polled to signal transaction completion. This commit uses polling. This was tested on Microchip HB1301 evalkit with a VSC8574 and a VSC8541. Signed-off-by: Charles Perry Reviewed-by: Maxime Chevallier Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260408131821.1145334-3-charles.perry@microchip.com Signed-off-by: Jakub Kicinski commit 268bb35d1a34c9965ec79922a412e966af98be34 Author: Charles Perry Date: Wed Apr 8 06:18:14 2026 -0700 dt-bindings: net: document Microchip PIC64-HPSC/HX MDIO controller This MDIO hardware is based on a Microsemi design supported in Linux by mdio-mscc-miim.c. However, The register interface is completely different with pic64hpsc, hence the need for separate documentation. The hardware supports C22 and C45. The documentation recommends an input clock of 156.25MHz and a prescaler of 39, which yields an MDIO clock of 1.95MHz. The hardware supports an interrupt pin to signal transaction completion which is not strictly needed as the software can also poll a "TRIGGER" bit for this. Signed-off-by: Charles Perry Acked-by: Conor Dooley Link: https://patch.msgid.link/20260408131821.1145334-2-charles.perry@microchip.com Signed-off-by: Jakub Kicinski commit 6f533abe7bbad2eef1e42c639b6bb9dad2b02362 Author: Charles Perry Date: Thu Apr 9 06:36:54 2026 -0700 net: phy: fix a return path in get_phy_c45_ids() The return value of phy_c45_probe_present() is stored in "ret", not "phy_reg", fix this. "phy_reg" always has a positive value if we reach this return path (since it would have returned earlier otherwise), which means that the original goal of the patch of not considering -ENODEV fatal wasn't achieved. Fixes: 17b447539408 ("net: phy: c45 scanning: Don't consider -ENODEV fatal") Signed-off-by: Charles Perry Reviewed-by: Andrew Lunn Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260409133654.3203336-1-charles.perry@microchip.com Signed-off-by: Jakub Kicinski commit 30c4d2f26bb3538c328035cea2e6265c8320539e Author: Johan Hovold Date: Tue Apr 7 14:27:17 2026 +0200 rtc: ntxec: fix OF node reference imbalance The driver reuses the OF node of the parent multi-function device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices. Fix this by using the intended helper for reusing OF nodes. Fixes: 435af89786c6 ("rtc: New driver for RTC in Netronix embedded controller") Cc: stable@vger.kernel.org # 5.13 Cc: Jonathan Neuschäfer Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260407122717.2676774-1-johan@kernel.org Signed-off-by: Alexandre Belloni commit 095a3e886dd250acc9ff692f8fcc296f0023a5c6 Author: Brian Masney Date: Sun Feb 22 18:30:51 2026 -0500 rtc: pic32: allow driver to be compiled with COMPILE_TEST This driver currently only supports builds against a PIC32 target. Now that commit ed65ae9f6c6b ("rtc: pic32: update include to use pic32.h from platform_data") is merged, it's possible to compile this driver on other architectures. To avoid future breakage of this driver in the future, let's update the Kconfig so that it can be built with COMPILE_TEST enabled on all architectures. Signed-off-by: Brian Masney Link: https://patch.msgid.link/20260222-rtc-pic32-v1-1-3f8eb654a34d@redhat.com Signed-off-by: Alexandre Belloni commit 0e9b12ee74c57617bb362deb3c82e35fe49694b5 Author: Akashdeep Kaur Date: Fri Mar 13 16:47:40 2026 +0530 rtc: ti-k3: Add support to resume from IO DDR low power mode Restore the RTC HW context which may be lost when system enters certain low power mode (IO+DDR mode). Check if the RTC registers are locked which would indicate loss of context (reset) and restore the context as needed. Signed-off-by: Akashdeep Kaur Reviewed-by: Vignesh Raghavendra Link: https://patch.msgid.link/20260313111740.1492519-1-a-kaur@ti.com Signed-off-by: Alexandre Belloni commit 600f01dc4bd0c736b3ffea9f7976136d8bf1b136 Author: Josua Mayer Date: Thu Apr 9 14:34:33 2026 +0200 dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 Currently, the binding requires 'spi-cpha' for SJA1105 and 'spi-cpol' for SJA1110. However, the SJA1110 supports both SPI modes 0 and 2. Mode 2 (cpha=0, cpol=1) is used by the NXP LX2160 Bluebox 3. On the SolidRun i.MX8DXL HummingBoard Telematics, mode 0 is stable, while forcing mode 2 introduces CRC errors especially during bursts. Drop the requirement on spi-cpol for SJA1110. Fixes: af2eab1a8243 ("dt-bindings: net: nxp,sja1105: document spi-cpol/cpha") Signed-off-by: Josua Mayer Acked-by: Conor Dooley Link: https://patch.msgid.link/20260409-imx8dxl-sr-som-v2-1-83ff20629ba0@solid-run.com Signed-off-by: Jakub Kicinski commit 21ad19a99d943d794d132c52eeb28b8731369516 Author: Nobuhiro Iwamatsu Date: Thu Apr 9 14:08:11 2026 +0900 octeon_ep: Remove unnecessary semicolons in octep_oq_drop_rx() Remove unnecessary semicolons in octep_oq_drop_rx(). Signed-off-by: Nobuhiro Iwamatsu Link: https://patch.msgid.link/1775711291-13938-1-git-send-email-nobuhiro.iwamatsu.x90@mail.toshiba Signed-off-by: Jakub Kicinski commit e4df9f02640e87a73b3d88224b8d164188fbf8e0 Merge: 2bb6379416fd19 1335b903cf2e8a Author: Jakub Kicinski Date: Sun Apr 12 13:49:34 2026 -0700 Merge branch 'more-fixes-for-the-ipa-driver' Luca Weiss says: ==================== More fixes for the IPA driver Two more fixes for the Qualcomm IPA driver. ==================== Link: https://patch.msgid.link/20260409-ipa-fixes-v1-0-a817c30678ac@fairphone.com Signed-off-by: Jakub Kicinski commit 1335b903cf2e8aeaca87fd665683384c731ec941 Author: Luca Weiss Date: Thu Apr 9 10:13:32 2026 +0200 net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ Initially 'reg' and 'val' are assigned from HW_PARAM_2. But since IPA v5.0+ takes EV_PER_EE from HW_PARAM_4 (instead of NUM_EV_PER_EE from HW_PARAM_2), we not only need to re-assign 'reg' but also read the register value of that register into 'val' so that reg_decode() works on the correct value. Fixes: f651334e1ef5 ("net: ipa: add HW_PARAM_4 GSI register") Link: https://sashiko.dev/#/patchset/20260403-milos-ipa-v1-0-01e9e4e03d3e%40fairphone.com?part=2 Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260409-ipa-fixes-v1-2-a817c30678ac@fairphone.com Signed-off-by: Jakub Kicinski commit de08f9585692813bd41ee654fca0487664c4de30 Author: Luca Weiss Date: Thu Apr 9 10:13:31 2026 +0200 net: ipa: Fix programming of QTIME_TIMESTAMP_CFG The 'val' variable gets overwritten multiple times, discarding previous values. Looking at the git log shows these should be combined with |= instead. Fixes: 9265a4f0f0b4 ("net: ipa: define even more IPA register fields") Link: https://sashiko.dev/#/patchset/20260403-milos-ipa-v1-0-01e9e4e03d3e%40fairphone.com?part=4 Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260409-ipa-fixes-v1-1-a817c30678ac@fairphone.com Signed-off-by: Jakub Kicinski commit 2bb6379416fd19f44c3423a00bfd8626259f6067 Author: Taegu Ha Date: Thu Apr 9 16:11:15 2026 +0900 ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns. As a result, a local unprivileged user can create a new user namespace with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace, and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace. Require CAP_NET_ADMIN in the user namespace that owns the target network namespace before handling unattached PPP administrative ioctls. This preserves normal pppd operation in the network namespace it is actually privileged in, while rejecting the userns-only inherited-netns case. Fixes: 273ec51dd7ce ("net: ppp_generic - introduce net-namespace functionality v2") Signed-off-by: Taegu Ha Link: https://patch.msgid.link/20260409071117.4354-1-hataegu0826@gmail.com Signed-off-by: Jakub Kicinski commit fa2942918afbd0cb765277e2fd09fe0aaef6dd8d Merge: 2fefa9c81a2553 171609f047552b Author: Alexei Starovoitov Date: Sun Apr 12 13:34:41 2026 -0700 Merge patch series "bpf: Fix OOB in pcpu_init_value and add a test" xulang says: ==================== Fix OOB read when copying element from a BPF_MAP_TYPE_CGROUP_STORAGE map to another pcpu map with the same value_size that is not rounded up to 8 bytes, and add a test case to reproduce the issue. The root cause is that pcpu_init_value() uses copy_map_value_long() which rounds up the copy size to 8 bytes, but CGROUP_STORAGE map values are not 8-byte aligned (e.g., 4-byte). This causes a 4-byte OOB read when the copy is performed. ==================== Link: https://lore.kernel.org/r/7653EEEC2BAB17DF+20260402073948.2185396-1-xulang@uniontech.com Signed-off-by: Alexei Starovoitov commit 171609f047552b51b8ed78f338cbffb84b7f5e8f Author: Lang Xu Date: Thu Apr 2 15:42:36 2026 +0800 selftests/bpf: Add test for cgroup storage OOB read Add a test case to reproduce the out-of-bounds read issue when copying from a cgroup storage map to a pcpu map with a value_size not rounded up to 8 bytes. The test creates: 1. A CGROUP_STORAGE map with 4-byte value (not 8-byte aligned) 2. A LRU_PERCPU_HASH map with 4-byte value (same size) When a socket is created in the cgroup, the BPF program triggers bpf_map_update_elem() which calls copy_map_value_long(). This function rounds up the copy size to 8 bytes, but the cgroup storage buffer is only 4 bytes, causing an OOB read (before the fix). Signed-off-by: Lang Xu Link: https://lore.kernel.org/r/D63BF0DBFF1EA122+20260402074236.2187154-2-xulang@uniontech.com Signed-off-by: Alexei Starovoitov commit 576afddfee8d1108ee299bf10f581593540d1a36 Author: Lang Xu Date: Thu Apr 2 15:42:35 2026 +0800 bpf: Fix OOB in pcpu_init_value An out-of-bounds read occurs when copying element from a BPF_MAP_TYPE_CGROUP_STORAGE map to another pcpu map with the same value_size that is not rounded up to 8 bytes. The issue happens when: 1. A CGROUP_STORAGE map is created with value_size not aligned to 8 bytes (e.g., 4 bytes) 2. A pcpu map is created with the same value_size (e.g., 4 bytes) 3. Update element in 2 with data in 1 pcpu_init_value assumes that all sources are rounded up to 8 bytes, and invokes copy_map_value_long to make a data copy, However, the assumption doesn't stand since there are some cases where the source may not be rounded up to 8 bytes, e.g., CGROUP_STORAGE, skb->data. the verifier verifies exactly the size that the source claims, not the size rounded up to 8 bytes by kernel, an OOB happens when the source has only 4 bytes while the copy size(4) is rounded up to 8. Fixes: d3bec0138bfb ("bpf: Zero-fill re-used per-cpu map element") Reported-by: Kaiyan Mei Closes: https://lore.kernel.org/all/14e6c70c.6c121.19c0399d948.Coremail.kaiyanm@hust.edu.cn/ Link: https://lore.kernel.org/r/420FEEDDC768A4BE+20260402074236.2187154-1-xulang@uniontech.com Signed-off-by: Lang Xu Signed-off-by: Alexei Starovoitov commit e802cd8cb0ffc4ddd2d6f78fc970d195af33deda Merge: 2654557112d6ca ebf71dd4aff46e Author: Jakub Kicinski Date: Sun Apr 12 13:33:21 2026 -0700 Merge branch 'net-rds-fix-use-after-free-in-rds-ib-for-non-init-namespaces' Allison Henderson says: ==================== net/rds: Fix use-after-free in RDS/IB for non-init namespaces This series fixes syzbot bug da8e060735ae02c8f3d1 https://syzkaller.appspot.com/bug?extid=da8e060735ae02c8f3d1 The report finds a use-after-free bug where ib connections access an invalid network namespace after it has been freed. The stack is: rds_rdma_cm_event_handler_cmn rds_conn_path_drop rds_destroy_pending check_net() <-- use-after-free This is initially introduced in: d5a8ac28a7ff ("RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net"). Here, we made RDS aware of the namespace by storing a net pointer in each connection. But it is not explicitly restricted to init_net in the case of ib. The RDS/TCP transport has its own pernet exit handler (rds_tcp_exit_net) that destroys connections when a namespace is torn down. But RDS/IB does not support more than the initial namespace and has no such handler. The initial namespace is statically allocated, and never torn down, so it always has at least one reference. Allowing non init namespaces that do not have a persistent reference means that when their refcounts drop to zero, they are released through cleanup_net(). Which would call any registered pernet clean up handlers if it had any, but since they don't in this case, the extra rds_connections remain with stale c_net pointers. Which are then accessed later causing the use-after-free bug. So, the simple fix is to disallow more than the initial namespace to be created in the case of ib connections. Fixes are ported from UEK patches found here: https://github.com/oracle/linux-uek/commit/8ed9a82376b7 Patch 1 is a prerequisite optimization to rds_ib_laddr_check() that avoids excessive rdma_bind_addr() calls during transport probing by first checking rds_ib_get_device(). This is needed because patch 2 adds a namespace check at the top of the same function. UEK: 8ed9a82376b7 ("rds: ib: Optimize rds_ib_laddr_check") https://github.com/oracle/linux-uek/commit/bd9489a08004 Patch 2 restricts RDS/IB to the initial network namespace. It adds checks in both rds_ib_laddr_check() and rds_set_transport() to reject IB use from non-init namespaces with -EPROTOTYPE. This prevents the use-after-free by ensuring IB connections cannot exist in namespaces that may be torn down. UEK: bd9489a08004 ("net/rds: Restrict use of RDS/IB to the initial network namespace") Questions, comments and feedback appreciated! ==================== Link: https://patch.msgid.link/20260408080420.540032-1-achender@kernel.org Signed-off-by: Jakub Kicinski commit ebf71dd4aff46e8e421d455db3e231ba43d2fa8a Author: Greg Jumper Date: Wed Apr 8 01:04:20 2026 -0700 net/rds: Restrict use of RDS/IB to the initial network namespace Prevent using RDS/IB in network namespaces other than the initial one. The existing RDS/IB code will not work properly in non-initial network namespaces. Fixes: d5a8ac28a7ff ("RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net") Reported-by: syzbot+da8e060735ae02c8f3d1@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=da8e060735ae02c8f3d1 Signed-off-by: Greg Jumper Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260408080420.540032-3-achender@kernel.org Signed-off-by: Jakub Kicinski commit 236f718ac885965fa886440b9898dfae185c9733 Author: Håkon Bugge Date: Wed Apr 8 01:04:19 2026 -0700 net/rds: Optimize rds_ib_laddr_check rds_ib_laddr_check() creates a CM_ID and attempts to bind the address in question to it. This in order to qualify the allegedly local address as a usable IB/RoCE address. In the field, ExaWatcher runs rds-ping to all ports in the fabric from all local ports. This using all active ToS'es. In a full rack system, we have 14 cell servers and eight db servers. Typically, 6 ToS'es are used. This implies 528 rds-ping invocations per ExaWatcher's "RDSinfo" interval. Adding to this, each rds-ping invocation creates eight sockets and binds the local address to them: socket(AF_RDS, SOCK_SEQPACKET, 0) = 3 bind(3, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.36.2")}, 16) = 0 socket(AF_RDS, SOCK_SEQPACKET, 0) = 4 bind(4, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.36.2")}, 16) = 0 socket(AF_RDS, SOCK_SEQPACKET, 0) = 5 bind(5, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.36.2")}, 16) = 0 socket(AF_RDS, SOCK_SEQPACKET, 0) = 6 bind(6, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.36.2")}, 16) = 0 socket(AF_RDS, SOCK_SEQPACKET, 0) = 7 bind(7, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.36.2")}, 16) = 0 socket(AF_RDS, SOCK_SEQPACKET, 0) = 8 bind(8, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.36.2")}, 16) = 0 socket(AF_RDS, SOCK_SEQPACKET, 0) = 9 bind(9, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.36.2")}, 16) = 0 socket(AF_RDS, SOCK_SEQPACKET, 0) = 10 bind(10, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.36.2")}, 16) = 0 So, at every interval ExaWatcher executes rds-ping's, 4224 CM_IDs are allocated, considering this full-rack system. After the a CM_ID has been allocated, rdma_bind_addr() is called, with the port number being zero. This implies that the CMA will attempt to search for an un-used ephemeral port. Simplified, the algorithm is to start at a random position in the available port space, and then if needed, iterate until an un-used port is found. The book-keeping of used ports uses the idr system, which again uses slab to allocate new struct idr_layer's. The size is 2092 bytes and slab tries to reduce the wasted space. Hence, it chooses an order:3 allocation, for which 15 idr_layer structs will fit and only 1388 bytes are wasted per the 32KiB order:3 chunk. Although this order:3 allocation seems like a good space/speed trade-off, it does not resonate well with how it used by the CMA. The combination of the randomized starting point in the port space (which has close to zero spatial locality) and the close proximity in time of the 4224 invocations of the rds-ping's, creates a memory hog for order:3 allocations. These costly allocations may need reclaims and/or compaction. At worst, they may fail and produce a stack trace such as (from uek4): [] __inc_zone_page_state+0x35/0x40 [] page_add_file_rmap+0x57/0x60 [] remove_migration_pte+0x3f/0x3c0 [ksplice_6cn872bt_vmlinux_new] [] rmap_walk+0xd8/0x340 [] remove_migration_ptes+0x40/0x50 [] migrate_pages+0x3ec/0x890 [] compact_zone+0x32d/0x9a0 [] compact_zone_order+0x6d/0x90 [] try_to_compact_pages+0x102/0x270 [] __alloc_pages_direct_compact+0x46/0x100 [] __alloc_pages_nodemask+0x74b/0xaa0 [] alloc_pages_current+0x91/0x110 [] new_slab+0x38b/0x480 [] __slab_alloc+0x3b7/0x4a0 [ksplice_s0dk66a8_vmlinux_new] [] kmem_cache_alloc+0x1fb/0x250 [] idr_layer_alloc+0x36/0x90 [] idr_get_empty_slot+0x28c/0x3d0 [] idr_alloc+0x4d/0xf0 [] cma_alloc_port+0x4d/0xa0 [rdma_cm] [] rdma_bind_addr+0x2ae/0x5b0 [rdma_cm] [] rds_ib_laddr_check+0x83/0x2c0 [ksplice_6l2xst5i_rds_rdma_new] [] rds_trans_get_preferred+0x5b/0xa0 [rds] [] rds_bind+0x212/0x280 [rds] [] SYSC_bind+0xe6/0x120 [] SyS_bind+0xe/0x10 [] system_call_fastpath+0x18/0xd4 To avoid these excessive calls to rdma_bind_addr(), we optimize rds_ib_laddr_check() by simply checking if the address in question has been used before. The rds_rdma module keeps track of addresses associated with IB devices, and the function rds_ib_get_device() is used to determine if the address already has been qualified as a valid local address. If not found, we call the legacy rds_ib_laddr_check(), now renamed to rds_ib_laddr_check_cm(). Signed-off-by: Håkon Bugge Signed-off-by: Somasundaram Krishnasamy Signed-off-by: Gerd Rausch Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260408080420.540032-2-achender@kernel.org Signed-off-by: Jakub Kicinski commit 2654557112d6ca298d0ef43b56e4cafb5cc0cb10 Merge: 2835750dd6475a 8263e484d66224 Author: Jakub Kicinski Date: Sun Apr 12 13:19:07 2026 -0700 Merge branch 'net-hamradio-fix-missing-input-validation-in-bpqether-and-scc' Mashiro Chen says: ==================== net: hamradio: fix missing input validation in bpqether and scc This series fixes two missing input validation bugs in the hamradio drivers. Both patches were reviewed by Joerg Reuter (hamradio maintainer). ==================== Link: https://patch.msgid.link/20260409024927.24397-1-mashiro.chen@mailbox.org Signed-off-by: Jakub Kicinski commit 8263e484d6622464ec72a5ad563f62492d84fa54 Author: Mashiro Chen Date: Thu Apr 9 10:49:27 2026 +0800 net: hamradio: scc: validate bufsize in SIOCSCCSMEM ioctl The SIOCSCCSMEM ioctl copies a scc_mem_config from user space and assigns its bufsize field directly to scc->stat.bufsize without any range validation: scc->stat.bufsize = memcfg.bufsize; If a privileged user (CAP_SYS_RAWIO) sets bufsize to 0, the receive interrupt handler later calls dev_alloc_skb(0) and immediately writes a KISS type byte via skb_put_u8() into a zero-capacity socket buffer, corrupting the adjacent skb_shared_info region. Reject bufsize values smaller than 16; this is large enough to hold at least one KISS header byte plus useful data. Signed-off-by: Mashiro Chen Acked-by: Joerg Reuter Link: https://patch.msgid.link/20260409024927.24397-3-mashiro.chen@mailbox.org Signed-off-by: Jakub Kicinski commit 6183bd8723a3eecd2d89cbc506fe938bc6288345 Author: Mashiro Chen Date: Thu Apr 9 10:49:26 2026 +0800 net: hamradio: bpqether: validate frame length in bpq_rcv() The BPQ length field is decoded as: len = skb->data[0] + skb->data[1] * 256 - 5; If the sender sets bytes [0..1] to values whose combined value is less than 5, len becomes negative. Passing a negative int to skb_trim() silently converts to a huge unsigned value, causing the function to be a no-op. The frame is then passed up to AX.25 with its original (untrimmed) payload, delivering garbage beyond the declared frame boundary. Additionally, a negative len corrupts the 64-bit rx_bytes counter through implicit sign-extension. Add a bounds check before pulling the length bytes: reject frames where len is negative or exceeds the remaining skb data. Acked-by: Joerg Reuter Signed-off-by: Mashiro Chen Link: https://patch.msgid.link/20260409024927.24397-2-mashiro.chen@mailbox.org Signed-off-by: Jakub Kicinski commit 2fefa9c81a25534464911447d51ddb44b04a8e5b Author: Paul Chaignon Date: Wed Apr 8 22:40:50 2026 +0200 selftests/bpf: Fix reg_bounds to match new tnum-based refinement Commit efc11a667878 ("bpf: Improve bounds when tnum has a single possible value") improved the bounds refinement to detect when the tnum and u64 range overlap in a single value (and the bounds can thus be set to that value). Eduard then noticed that it broke the slow-mode reg_bounds selftests because they don't have an equivalent logic and are therefore unable to refine the bounds as much as the verifier. The following test case illustrates this. ACTUAL TRUE1: scalar(u64=0xffffffff00000000,u32=0,s64=0xffffffff00000000,s32=0) EXPECTED TRUE1: scalar(u64=[0xfffffffe00000001; 0xffffffff00000000],u32=0,s64=[0xfffffffe00000001; 0xffffffff00000000],s32=0) [...] #323/1007 reg_bounds_gen_consts_s64_s32/(s64)[0xfffffffe00000001; 0xffffffff00000000] (s32) S64_MIN:FAIL with the verifier logs: [...] 19: w0 = w6 ; R0=scalar(smin=0,smax=umax=0xffffffff, var_off=(0x0; 0xffffffff)) R6=scalar(smin=0xfffffffe00000001,smax=0xffffffff00000000, umin=0xfffffffe00000001,umax=0xffffffff00000000, var_off=(0xfffffffe00000000; 0x1ffffffff)) 20: w0 = w7 ; R0=0 R7=0x8000000000000000 21: if w6 == w7 goto pc+3 [...] from 21 to 25: [...] 25: w0 = w6 ; R0=0 R6=0xffffffff00000000 ; ^ ; unexpected refined value 26: w0 = w7 ; R0=0 R7=0x8000000000000000 27: exit When w6 == w7 is true, the verifier can deduce that the R6's tnum is equal to (0xfffffffe00000000; 0x100000000) and then use that information to refine the bounds: the tnum only overlap with the u64 range in 0xffffffff00000000. The reg_bounds selftest doesn't know about tnums and therefore fails to perform the same refinement. This issue happens when the tnum carries information that cannot be represented in the ranges, as otherwise the selftest could reach the same refined value using just the ranges. The tnum thus needs to represent non-contiguous values (ex., R6's tnum above, after the condition). The only way this can happen in the reg_bounds selftest is at the boundary between the 32 and 64bit ranges. We therefore only need to handle that case. This patch fixes the selftest refinement logic by checking if the u32 and u64 ranges overlap in a single value. If so, the ranges can be set to that value. We need to handle two cases: either they overlap in umin64... u64 values matching u32 range: xxx xxx xxx xxx |--------------------------------------| u64 range: 0 xxxxx UMAX64 or in umax64: u64 values matching u32 range: xxx xxx xxx xxx |--------------------------------------| u64 range: 0 xxxxx UMAX64 To detect the first case, we decrease umax64 to the maximum value that matches the u32 range. If that happens to be umin64, then umin64 is the only overlap. We proceed similarly for the second case, increasing umin64 to the minimum value that matches the u32 range. Note this is similar to how the verifier handles the general case using tnum, but we don't need to care about a single-value overlap in the middle of the range. That case is not possible when comparing two ranges. This patch also adds two test cases reproducing this bug as part of the normal test runs (without SLOW_TESTS=1). Fixes: efc11a667878 ("bpf: Improve bounds when tnum has a single possible value") Reported-by: Eduard Zingerman Closes: https://lore.kernel.org/bpf/4e6dd64a162b3cab3635706ae6abfdd0be4db5db.camel@gmail.com/ Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/ada9UuSQi2SE2IfB@mail.gmail.com Signed-off-by: Alexei Starovoitov commit 2835750dd6475a5ddc116be0b4c81fee8ce1a902 Author: Mashiro Chen Date: Thu Apr 9 01:25:51 2026 +0800 net: rose: reject truncated CLEAR_REQUEST frames in state machines All five ROSE state machines (states 1-5) handle ROSE_CLEAR_REQUEST by reading the cause and diagnostic bytes directly from skb->data[3] and skb->data[4] without verifying that the frame is long enough: rose_disconnect(sk, ..., skb->data[3], skb->data[4]); The entry-point check in rose_route_frame() only enforces ROSE_MIN_LEN (3 bytes), so a remote peer on a ROSE network can send a syntactically valid but truncated CLEAR_REQUEST (3 or 4 bytes) while a connection is open in any state. Processing such a frame causes a one- or two-byte out-of-bounds read past the skb data, leaking uninitialized heap content as the cause/diagnostic values returned to user space via getsockopt(ROSE_GETCAUSE). Add a single length check at the rose_process_rx_frame() dispatch point, before any state machine is entered, to drop frames that carry the CLEAR_REQUEST type code but are too short to contain the required cause and diagnostic fields. Signed-off-by: Mashiro Chen Link: https://patch.msgid.link/20260408172551.281486-1-mashiro.chen@mailbox.org Signed-off-by: Jakub Kicinski commit d35a6db887eeae7c57b719521e39d64f929c6dc3 Author: Billy Tsai Date: Tue Apr 7 16:53:23 2026 +0800 i3c: mipi-i3c-hci: fix IBI payload length calculation for final status In DMA mode, the IBI status descriptor encodes the payload using CHUNKS (number of chunks) and DATA_LENGTH (valid bytes in the last chunk). All preceding chunks are implicitly full-sized. The current code accumulates full chunk sizes for non-final status descriptors, but for the final status descriptor it only adds DATA_LENGTH. This ignores the contribution of the preceding full chunks described by the same final status entry. As a result, the computed IBI payload length is truncated whenever the final status spans multiple chunks. For example, with a chunk size of 4 bytes, CHUNKS=2 and DATA_LENGTH=1 should result in a total payload size of 5 bytes, but the current code reports only 1 byte. Fix the calculation by adding the size of (CHUNKS - 1) full chunks plus DATA_LENGTH for the last chunk. Fixes: 9ad9a52cce28 ("i3c/master: introduce the mipi-i3c-hci driver") Signed-off-by: Billy Tsai Reviewed-by: Frank Li Link: https://patch.msgid.link/20260407-i3c-hci-dma-v2-1-a583187b9d22@aspeedtech.com Signed-off-by: Alexandre Belloni commit baf7cebcf97541fedf72332f4aa88a74f4b1da63 Merge: 8632175ccb0c8c 98a4f3d341322f Author: Jakub Kicinski Date: Sun Apr 12 13:03:51 2026 -0700 Merge branch 'net-enetc-improve-statistics-for-v1-and-add-statistics-for-v4' Wei Fang says: ==================== net: enetc: improve statistics for v1 and add statistics for v4 For ENETC v1, some standardized statistics were redundantly included in the unstructured statistics, so remove these duplicated entries. Previously, the unstructured statistics only contained eMAC data and did not include pMAC data; add pMAC statistics to ensure completeness. For ENETC v4, the driver previously reported MAC statistics only for the internal ENETC (Pseudo MAC). Extend the implementation to provide additional statistics for both the internal ENETC and the standalone ENETC. ==================== Link: https://patch.msgid.link/20260408055849.1314033-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 98a4f3d341322f3c6dd341902b419f701f3e678e Author: Wei Fang Date: Wed Apr 8 13:58:49 2026 +0800 net: enetc: add unstructured counters for ENETC v4 Like ENETC v1, ENETC v4 also has many non-standard counters, so these counters are added to improve statistical coverage. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260408055849.1314033-6-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit dbc30b154e331dc023c4ace3fd57056c6c7a98e2 Author: Wei Fang Date: Wed Apr 8 13:58:48 2026 +0800 net: enetc: add unstructured pMAC counters for ENETC v1 The ENETC v1 has two MACs (eMAC and pMAC) to support preemption. The existing unstructured counters include the eMAC counters, but not the pMAC counters. So add pMAC counters to improve statistical coverage. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260408055849.1314033-5-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 6d78c37a73e01955104c2cb8f65584d23aba4f88 Author: Wei Fang Date: Wed Apr 8 13:58:47 2026 +0800 net: enetc: remove standardized counters from enetc_pm_counters The standardized counters are already exposed via the get_pause_stats(), get_rmon_stats(), get_eth_ctrl_stats() and get_eth_mac_stats() interfaces. Keeping the same counters in enetc_pm_counters results in redundant output. Remove these standardized counters from enetc_pm_counters and rely on the existing statistics interfaces to report them. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260408055849.1314033-4-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit c571d309d4cf9ac4c3129cdf312696e1c6b18cce Author: Wei Fang Date: Wed Apr 8 13:58:46 2026 +0800 net: enetc: show RX drop counters only for assigned RX rings For ENETC v1, each SI provides 16 RBDCR registers for RX ring drop counters, but this does not imply that an SI actually owns 16 RX rings. The ENETC hardware supports a total of 16 RX rings, which are assigned to 3 SIs (1 PSI and 2 VSIs), so each SI is assigned fewer than 16 RX rings. The current implementation always reports 16 RX drop counters per SI, leading to redundant output for SIs with fewer RX rings. Update the logic to display drop counters only for the RX rings that are actually assigned to the SI. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260408055849.1314033-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit c6c223fd06edbc34c7b04170e375abfb2a13cbf8 Author: Wei Fang Date: Wed Apr 8 13:58:45 2026 +0800 net: enetc: add support for the standardized counters ENETC v4 provides 64-bit counters for IEEE 802.3 basic and mandatory managed objects, the IETF Management Information Database (MIB) package (RFC2665), and Remote Network Monitoring (RMON) statistics. In addition, some ENETCs support preemption, so these ENETCs have two MACs: MAC 0 is the express MAC (eMAC), MAC 1 is the preemptible MAC (pMAC). Both MACs support these statistics. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260408055849.1314033-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 4c5f21d4dfa4f7a54622b375a878e0ca0db94786 Author: Emil Tsalapatis Date: Sun Apr 12 13:45:39 2026 -0400 selftests/bpf: Add tests for non-arena/arena operations Add a selftest that ensures instructions with arena source and non-arena destination registers are accepted by the verifier. Signed-off-by: Emil Tsalapatis Acked-by: Song Liu Link: https://lore.kernel.org/r/20260412174546.18684-3-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit ac61bffe91d4bda08806e12957c6d64756d042db Author: Emil Tsalapatis Date: Sun Apr 12 13:45:38 2026 -0400 bpf: Allow instructions with arena source and non-arena dest registers The compiler sometimes stores the result of a PTR_TO_ARENA and SCALAR operation into the scalar register rather than the pointer register. Relax the verifier to allow operations between a source arena register and a destination non-arena register, marking the destination's value as a PTR_TO_ARENA. Signed-off-by: Emil Tsalapatis Acked-by: Song Liu Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.") Link: https://lore.kernel.org/r/20260412174546.18684-2-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 9623c3c69e51aaa096f3770655994d7a1992358d Merge: 46ffc1f78295b8 f0e16ac7161860 Author: Alexei Starovoitov Date: Sun Apr 12 12:42:38 2026 -0700 Merge branch 'bpf-add-the-missing-fsession' Menglong Dong says: ==================== bpf: add the missing fsession Add the missing fsession attach type to the BPF docs, verifier log and bpftool. Changes since v2: - replace "FENTRY/FEXIT/FSESSION" with "Tracing" in the 1st patch - v2: https://lore.kernel.org/all/20260408062109.386083-1-dongml2@chinatelecom.cn/ Changes since v1: - add a missing FSESSION in bpf_check_attach_target() in the 1st patch - v1: https://lore.kernel.org/all/20260408031416.266229-1-dongml2@chinatelecom.cn/ ==================== Link: https://patch.msgid.link/20260412060346.142007-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit f0e16ac716186086478836758dfb5c5df62520db Author: Menglong Dong Date: Sun Apr 12 14:03:46 2026 +0800 bpftool: add missing fsession to the usage and docs of bpftool Add the fsession attach type to the usage of bpftool in do_help(). Meanwhile, add it to the bash-completion and bpftool-prog.rst too. Acked-by: Leon Hwang Acked-by: Quentin Monnet Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260412060346.142007-4-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 46d9f15a55fb17008605339f322fd844d13d026f Author: Menglong Dong Date: Sun Apr 12 14:03:45 2026 +0800 docs/bpf: add missing fsession attach type to docs Add the fsession attach type to program_types.rst and drgn.rst. Acked-by: Leon Hwang Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260412060346.142007-3-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 9fd19e3ed7751bbd28cfca1e3f73811e2f1a370f Author: Menglong Dong Date: Sun Apr 12 14:03:44 2026 +0800 bpf: add missing fsession to the verifier log The fsession attach type is missed in the verifier log in check_get_func_ip(), bpf_check_attach_target() and check_attach_btf_id(). Update them to make the verifier log proper. Meanwhile, update the corresponding selftests. Acked-by: Leon Hwang Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260412060346.142007-2-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 46ffc1f78295b8fdb587b99ffc18f29e00ec3a30 Merge: 2ec74a053611ed 99a832a2b5b8a8 Author: Alexei Starovoitov Date: Sun Apr 12 12:34:31 2026 -0700 Merge branch 'bpf-split-verifier-c' Alexei Starovoitov says: ==================== v3->v4: Restore few minor comments and undo few function moves v2->v3: Actually restore comments lost in patch 3 (instead of adding them to patch 4) v1->v2: Restore comments lost in patch 3 verifier.c is huge. Split it into logically independent pieces. No functional changes. The diff is impossible to review over email. 'git show' shows minimal actual changes. Only plenty of moved lines. Such split may cause backport headaches. We should have split it long ago. Even after split verifier.c is still 20k lines, but further split is harder. ==================== Acked-by: Kumar Kartikeya Dwivedi Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20260412152936.54262-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 99a832a2b5b8a8ecc1a2bdd64017892caf4aa096 Author: Alexei Starovoitov Date: Sun Apr 12 08:29:35 2026 -0700 bpf: Move BTF checking logic into check_btf.c BTF validation logic is independent from the main verifier. Move it into check_btf.c Acked-by: Kumar Kartikeya Dwivedi Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260412152936.54262-7-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit ed0b9710bd2efbe663d89728cd9c680c31c6a4e3 Author: Alexei Starovoitov Date: Sun Apr 12 08:29:34 2026 -0700 bpf: Move backtracking logic to backtrack.c Move precision propagation and backtracking logic to backtrack.c to reduce verifier.c size. No functional changes. Acked-by: Kumar Kartikeya Dwivedi Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260412152936.54262-6-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit c82834a5a11f743f2926107d8f8150e80742b814 Author: Alexei Starovoitov Date: Sun Apr 12 08:29:33 2026 -0700 bpf: Move state equivalence logic to states.c verifier.c is huge. Move is_state_visited() to states.c, so that all state equivalence logic is in one file. Mechanical move. No functional changes. Acked-by: Kumar Kartikeya Dwivedi Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260412152936.54262-5-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit f8a8faceab9953ed074cd4125b31cc6a562237d8 Author: Alexei Starovoitov Date: Sun Apr 12 08:29:32 2026 -0700 bpf: Move check_cfg() into cfg.c verifier.c is huge. Move check_cfg(), compute_postorder(), compute_scc() into cfg.c Mechanical move. No functional changes. Acked-by: Kumar Kartikeya Dwivedi Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260412152936.54262-4-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit fc150cddeea77561fbc94ac8f02cc75b016b09dd Author: Alexei Starovoitov Date: Sun Apr 12 08:29:31 2026 -0700 bpf: Move compute_insn_live_regs() into liveness.c verifier.c is huge. Move compute_insn_live_regs() into liveness.c. Mechanical move. No functional changes. Acked-by: Kumar Kartikeya Dwivedi Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260412152936.54262-3-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 449f08fa59dda5da40317b6976604b877c4ecd63 Author: Alexei Starovoitov Date: Sun Apr 12 08:29:30 2026 -0700 bpf: Move fixup/post-processing logic from verifier.c into fixups.c verifier.c is huge. Split fixup/post-processing logic that runs after the verifier accepted the program into fixups.c. Mechanical move. No functional changes. Acked-by: Kumar Kartikeya Dwivedi Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260412152936.54262-2-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 8632175ccb0c8cfc69b0f54c47b4b15b44c263ff Author: Gal Pressman Date: Thu Apr 9 12:09:45 2026 +0300 gre: Count GRE packet drops GRE is silently dropping packets without updating statistics. In case of drop, increment rx_dropped counter to provide visibility into packet loss. For the case where no GRE protocol handler is registered, use rx_nohandler. Reviewed-by: Dragos Tatulea Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20260409090945.1542440-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit ba69b788ed79d82ed4940fc8dbee9b3f9c5b1a88 Merge: 46ce8be2ced389 04013c3ca02273 Author: Jakub Kicinski Date: Sun Apr 12 12:28:07 2026 -0700 Merge branch 'bpf-fix-sock_ops_get_sk-same-register-oob-read-in-sock_ops-and-add-selftest' Jiayuan Chen says: ==================== bpf: Fix SOCK_OPS_GET_SK same-register OOB read in sock_ops and add selftest When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path, leading to OOB read (GET_SK) and kernel pointer leak (GET_FIELD). Patch 1: Fix both macros by adding BPF_MOV64_IMM(si->dst_reg, 0) in the !fullsock landing pad. Patch 2: Add selftests covering same-register and different-register cases for both GET_SK and GET_FIELD. [1] https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u ==================== Link: https://patch.msgid.link/20260407022720.162151-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 04013c3ca022734ec2897b28a96d4cbd8a930407 Author: Jiayuan Chen Date: Tue Apr 7 10:26:28 2026 +0800 selftests/bpf: Add tests for sock_ops ctx access with same src/dst register Add selftests to verify SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() correctly return NULL/zero when dst_reg == src_reg and is_fullsock == 0. Three subtests are included: - get_sk: ctx->sk with same src/dst register (SOCK_OPS_GET_SK) - get_field: ctx->snd_cwnd with same src/dst register (SOCK_OPS_GET_FIELD) - get_sk_diff_reg: ctx->sk with different src/dst register (baseline) Each BPF program uses inline asm (__naked) to force specific register allocation, reads is_fullsock first, then loads the field using the same (or different) register. The test triggers TCP_NEW_SYN_RECV via a TCP handshake and checks that the result is NULL/zero when is_fullsock == 0. Reviewed-by: Sun Jian Signed-off-by: Jiayuan Chen Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20260407022720.162151-3-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 10f86a2a5c91fc4c4d001960f1c21abe52545ef6 Author: Jiayuan Chen Date: Tue Apr 7 10:26:27 2026 +0800 bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path. Both macros borrow a temporary register to check is_fullsock / is_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the ctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with a request_sock), dst_reg should be zeroed but is not, leaving the stale ctx pointer: - SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer, leading to stack-out-of-bounds access in helpers like bpf_skc_to_tcp6_sock(). - SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the verifier believes is a SCALAR_VALUE, leaking a kernel pointer. Fix both macros by: - Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the added instruction. - Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register restore in the !fullsock path, placed after the restore because dst_reg == src_reg means we need src_reg intact to read ctx->temp. Fixes: fd09af010788 ("bpf: sock_ops ctx access may stomp registers in corner case") Fixes: 84f44df664e9 ("bpf: sock_ops sk access may stomp registers when dst_reg = src_reg") Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn> Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Reported-by: Dongliang Mu Reviewed-by: Emil Tsalapatis Closes: https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u Signed-off-by: Jiayuan Chen Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20260407022720.162151-2-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit fab205e49286ab01cbc6fa8debd65a5a6e6cca71 Author: Ian Rogers Date: Sat Apr 11 19:08:04 2026 -0700 perf sample: Fix documentation typo s/PEF/PERF/ Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 40a3f6c5e2604ff7c007da6628120529569e950c Author: Sukrut Heroorkar Date: Sat Apr 11 17:51:19 2026 +0200 Documentation: core-api: real-time: correct spelling Fix typo "excpetion" with "exception". Signed-off-by: Sukrut Heroorkar Signed-off-by: Jonathan Corbet Message-ID: <20260411155120.233357-1-hsukrut3@gmail.com> commit f0efd29aa60cb3399c79c0a041d1f1c0a4367862 Author: Frederic Weisbecker Date: Thu Apr 2 11:47:49 2026 +0200 doc: Add CPU Isolation documentation nohz_full was introduced in v3.10 in 2013, which means this documentation is overdue for 13 years. Fortunately Paul wrote a part of the needed documentation a while ago, especially concerning nohz_full in Documentation/timers/no_hz.rst and also about per-CPU kthreads in Documentation/admin-guide/kernel-per-CPU-kthreads.rst Introduce a new page that gives an overview of CPU isolation in general. Acked-by: Waiman Long Reviewed-by: Valentin Schneider Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Frederic Weisbecker Reviewed-by: Paul E. McKenney Signed-off-by: Jonathan Corbet Message-ID: <20260402094749.18879-1-frederic@kernel.org> commit 46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1 Author: Greg Kroah-Hartman Date: Thu Apr 9 17:18:14 2026 +0200 NFC: digital: Bounds check NFC-A cascade depth in SDD response handler The NFC-A anti-collision cascade in digital_in_recv_sdd_res() appends 3 or 4 bytes to target->nfcid1 on each round, but the number of cascade rounds is controlled entirely by the peer device. The peer sets the cascade tag in the SDD_RES (deciding 3 vs 4 bytes) and the cascade-incomplete bit in the SEL_RES (deciding whether another round follows). ISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is sized accordingly (NFC_NFCID1_MAXSIZE = 10), but nothing in the driver actually enforces this. This means a malicious peer can keep the cascade running, writing past the heap-allocated nfc_target with each round. Fix this by rejecting the response when the accumulated UID would exceed the buffer. Commit e329e71013c9 ("NFC: nci: Bounds check struct nfc_target arrays") fixed similar missing checks against the same field on the NCI path. Cc: Simon Horman Cc: Kees Cook Cc: Thierry Escande Cc: Samuel Ortiz Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support") Cc: stable Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026040913-figure-seducing-bd3f@gregkh Signed-off-by: Jakub Kicinski commit a6bd339dbb3514bce690fdcf252e788dfab4ee76 Author: Fernando Fernandez Mancera Date: Wed Apr 8 12:00:44 2026 +0200 net_sched: fix skb memory leak in deferred qdisc drops When the network stack cleans up the deferred list via qdisc_run_end(), it operates on the root qdisc. If the root qdisc do not implement the TCQ_F_DEQUEUE_DROPS flag the packets queue to free are never freed and gets stranded on the child's local to_free list. Fix this by making qdisc_dequeue_drop() aware of the root qdisc. It fetches the root qdisc and check for the TCQ_F_DEQUEUE_DROPS flag. If the flag is present, the packet is appended directly to the root's to_free list. Otherwise, drop it directly as it was done before the optimization was implemented. Fixes: a6efc273ab82 ("net_sched: use qdisc_dequeue_drop() in cake, codel, fq_codel") Reported-by: Damilola Bello Closes: https://lore.kernel.org/netdev/CAPgFtOLaedBMU0f_BxV2bXftTJSmJr018Q5uozOo5vVo6b9tjw@mail.gmail.com/ Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260408100044.4530-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 4e17b9b43322e1cc1db88c7457bf57a00ff45b32 Merge: 200df94709118d bb14e3b63c63a4 Author: Jakub Kicinski Date: Sun Apr 12 11:33:26 2026 -0700 Merge branch 'net-phy-add-support-for-disabling-autonomous-eee' Nicolai Buchwitz says: ==================== net: phy: add support for disabling autonomous EEE Some PHYs implement autonomous EEE where the PHY manages EEE independently, preventing the MAC from controlling LPI signaling. This conflicts with MACs that implement their own LPI control. This series adds a .disable_autonomous_eee callback to struct phy_driver and calls it from phy_support_eee(). When a MAC indicates it supports EEE, the PHY's autonomous EEE is automatically disabled. The setting is persisted across suspend/resume by re-applying it in phy_init_hw() after soft reset, following the same pattern suggested by Russell King for PHY tunables [1]. Patch 1 adds the phylib infrastructure. Patch 2 implements it for Broadcom BCM54xx (AutogrEEEn). Patch 3 converts the Realtek RTL8211F, which previously unconditionally disabled PHY-mode EEE in config_init. This came up while adding EEE support to the Cadence macb driver (used on Raspberry Pi 5 with a BCM54210PE PHY). The PHY's AutogrEEEn mode prevented the MAC from tracking LPI state. The Realtek RTL8211F has the same pattern, unconditionally disabling PHY-mode EEE with the comment "Disable PHY-mode EEE so LPI is passed to the MAC". Other BCM54xx PHYs likely have the same AutogrEEEn register layout, but I only have access to the BCM54210PE/BCM54213PE datasheets. It would be appreciated if Florian or others could confirm which other BCM54xx variants share this register so we can wire them up too. Tested on Raspberry Pi CM4 (bcmgenet + BCM54210PE), Raspberry Pi CM5 (Cadence GEM + BCM54210PE) and Raspberry Pi 5 (Cadence GEM + BCM54213PE). [1] https://lore.kernel.org/netdev/acuwvoydmJusuj9x@shell.armlinux.org.uk/ ==================== Link: https://patch.msgid.link/20260406-devel-autonomous-eee-v1-0-b335e7143711@tipi-net.de Signed-off-by: Jakub Kicinski commit bb14e3b63c63a48307843c82180bc8abb34e1acc Author: Nicolai Buchwitz Date: Mon Apr 6 09:13:09 2026 +0200 net: phy: realtek: convert RTL8211F to .disable_autonomous_eee The RTL8211F previously unconditionally disabled PHY-mode EEE in config_init. Convert this to use the new .disable_autonomous_eee callback so it is only disabled when the MAC indicates EEE support via phy_support_eee(). This preserves PHY-autonomous EEE for MACs that do not support EEE, while still disabling it when the MAC manages LPI. Signed-off-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260406-devel-autonomous-eee-v1-3-b335e7143711@tipi-net.de Signed-off-by: Jakub Kicinski commit bcb3e89fc0ecbe7a2b7ce614b72deda39083ac74 Author: Nicolai Buchwitz Date: Mon Apr 6 09:13:08 2026 +0200 net: phy: broadcom: implement .disable_autonomous_eee for BCM54xx Implement the .disable_autonomous_eee callback for the BCM54210E. In AutogrEEEn mode the PHY manages EEE autonomously. Clearing the AutogrEEEn enable bit in MII_BUF_CNTL_0 switches the PHY to Native EEE mode. Signed-off-by: Nicolai Buchwitz Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260406-devel-autonomous-eee-v1-2-b335e7143711@tipi-net.de Signed-off-by: Jakub Kicinski commit 7ef629b458018ed01dcab6cbdc644ef26b0d0d83 Author: Nicolai Buchwitz Date: Mon Apr 6 09:13:07 2026 +0200 net: phy: add support for disabling PHY-autonomous EEE Some PHYs (e.g. Broadcom BCM54xx, Realtek RTL8211F) implement autonomous EEE where the PHY manages LPI signaling without forwarding it to the MAC. This conflicts with MAC drivers that implement their own LPI control. Add a .disable_autonomous_eee callback to struct phy_driver and call it from phy_support_eee(). When a MAC driver indicates it supports EEE via phy_support_eee(), the PHY's autonomous EEE is automatically disabled so the MAC can manage LPI entry/exit. Signed-off-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260406-devel-autonomous-eee-v1-1-b335e7143711@tipi-net.de Signed-off-by: Jakub Kicinski commit 656121b155030086b01cfce9bd31b0c925ee6860 Author: Lorenzo Bianconi Date: Wed Apr 8 20:26:56 2026 +0200 net: airoha: Add missing RX_CPU_IDX() configuration in airoha_qdma_cleanup_rx_queue() When the descriptor index written in REG_RX_CPU_IDX() is equal to the one stored in REG_RX_DMA_IDX(), the hw will stop since the QDMA RX ring is empty. Add missing REG_RX_CPU_IDX() configuration in airoha_qdma_cleanup_rx_queue routine during QDMA RX ring cleanup. Fixes: 514aac359987 ("net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260408-airoha-cpu-idx-airoha_qdma_cleanup_rx_queue-v1-1-8efa64844308@kernel.org Signed-off-by: Jakub Kicinski commit 200df94709118d58f2ee3b398e63b2b03ac9b4d6 Merge: 5acd07df868337 b2fb1a336383f1 Author: Jakub Kicinski Date: Sun Apr 12 11:23:52 2026 -0700 Merge branch 'ynl-ethtool-netlink-fix-nla_len-overflow-for-large-string-sets' Hangbin Liu says: ==================== ynl/ethtool/netlink: fix nla_len overflow for large string sets This series addresses a silent data corruption issue triggered when ynl retrieves string sets from NICs with a large number of statistics entries (e.g. mlx5_core with thousands of ETH_SS_STATS strings). The root cause is that struct nlattr.nla_len is a __u16 (max 65535 bytes). When a NIC exports enough statistics strings, the ETHTOOL_A_STRINGSET_STRINGS nest built by strset_fill_set() exceeds this limit. nla_nest_end() silently truncates the length on assignment, producing a corrupted netlink message. Patch 1 moves ethtool.py to selftest. Patch 2 improves the ethtool tool: rename the doit/dumpit helpers to do_set/do_get and convert do_get to use ynl.do() with an explicit device header instead of a full dump with client-side filtering. Patch 3 adds a --dbg-small-recv option to the YNL ethtool tool, matching the same option already present in cli.py, to help debug netlink message size issues Patch 4 adds a new helper nla_nest_end_safe() to check whether the nla_len is overflow and return -EMSGSIZE early if so. Patch 5 uses the new helper in ethtool to make sure the ethtool doesn't reply a corrupted netlink message. ==================== Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-0-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski commit b2fb1a336383f1fb4667a9cc930c70f52ae1e20e Author: Hangbin Liu Date: Wed Apr 8 15:08:53 2026 +0800 ethtool: strset: check nla_len overflow The netlink attribute length field nla_len is a __u16, which can only represent values up to 65535 bytes. NICs with a large number of statistics strings (e.g. mlx5_core with thousands of ETH_SS_STATS entries) can produce a ETHTOOL_A_STRINGSET_STRINGS nest that exceeds this limit. When nla_nest_end() writes the actual nest size back to nla_len, the value is silently truncated. This results in a corrupted netlink message being sent to userspace: the parser reads a wrong (truncated) attribute length and misaligns all subsequent attribute boundaries, causing decode errors. Fix this by using the new helper nla_nest_end_safe and error out if the size exceeds U16_MAX. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-5-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski commit 1346586a9ac96588eff586ca1893dd2e88b88510 Author: Hangbin Liu Date: Wed Apr 8 15:08:52 2026 +0800 netlink: add a nla_nest_end_safe() helper The nla_len field in struct nlattr is a __u16, which can only hold values up to 65535. If a nested attribute grows beyond this limit, nla_nest_end() silently truncates the length, producing a corrupted netlink message with no indication of the problem. Since nla_nest_end() is used everywhere and this issue rarely happens, let's add a new helper to check the length. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-4-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski commit 594ba4477164af58c9703039b63b8b07a3a55f18 Author: Hangbin Liu Date: Wed Apr 8 15:08:51 2026 +0800 tools: ynl: ethtool: add --dbg-small-recv option Add a --dbg-small-recv debug option to control the recv() buffer size used by YNL, matching the same option already present in cli.py. This is useful if user need to get large netlink message. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-3-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski commit 1c43d471a513e93b5420d8af5d43afd3a75f95f1 Author: Hangbin Liu Date: Wed Apr 8 15:08:50 2026 +0800 tools: ynl: ethtool: use doit instead of dumpit for per-device GET Rename the local helper doit() to do_set() and dumpit() to do_get() to better reflect their purpose. Convert do_get() to use ynl.do() with an explicit device header instead of ynl.dump() followed by client-side filtering. This is more efficient as the kernel only processes and returns data for the requested device, rather than dumping all devices across the netns. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-2-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski commit 22ef8a263c17f02176e3a322b76da07411092c17 Author: Hangbin Liu Date: Wed Apr 8 15:08:49 2026 +0800 tools: ynl: move ethtool.py to selftest We have converted all the samples to selftests. This script is the last piece of random "PoC" code we still have lying around. Let's move it to tests. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-1-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski commit ed45d380c54641039761c5e569f948612eaf0e98 Merge: 2b5dd4632966c3 3b7c7fc97aea7b Author: Jakub Kicinski Date: Sun Apr 12 11:22:56 2026 -0700 Merge branch 'net-mana-fix-debugfs-directory-naming-and-file-lifecycle' Erni Sri Satya Vennela says: ==================== net: mana: Fix debugfs directory naming and file lifecycle This series fixes two pre-existing debugfs issues in the MANA driver. Patch 1 fixes the per-device debugfs directory naming to use the unique PCI BDF address via pci_name(), avoiding a potential NULL pointer dereference when pdev->slot is NULL (e.g. VFIO passthrough, nested KVM) and preventing name collisions across multiple PFs or VFs. Patch 2 moves the current_speed debugfs file creation from mana_probe_port() to mana_init_port() so it survives detach/attach cycles triggered by MTU changes or XDP program changes. ==================== Link: https://patch.msgid.link/20260408081224.302308-1-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 3b7c7fc97aea7b4048001d12f45777201c74a17f Author: Erni Sri Satya Vennela Date: Wed Apr 8 01:12:20 2026 -0700 net: mana: Move current_speed debugfs file to mana_init_port() Move the current_speed debugfs file creation from mana_probe_port() to mana_init_port(). The file was previously created only during initial probe, but mana_cleanup_port_context() removes the entire vPort debugfs directory during detach/attach cycles. Since mana_init_port() recreates the directory on re-attach, moving current_speed here ensures it survives these cycles. Fixes: 75cabb46935b ("net: mana: Add support for net_shaper_ops") Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260408081224.302308-3-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski commit c116f07ab9d22bb6f355f3cf9e44c1e6a47fe559 Author: Erni Sri Satya Vennela Date: Wed Apr 8 01:12:19 2026 -0700 net: mana: Use pci_name() for debugfs directory naming Use pci_name(pdev) for the per-device debugfs directory instead of hardcoded "0" for PFs and pci_slot_name(pdev->slot) for VFs. The previous approach had two issues: 1. pci_slot_name() dereferences pdev->slot, which can be NULL for VFs in environments like generic VFIO passthrough or nested KVM, causing a NULL pointer dereference. 2. Multiple PFs would all use "0", and VFs across different PCI domains or buses could share the same slot name, leading to -EEXIST errors from debugfs_create_dir(). pci_name(pdev) returns the unique BDF address, is always valid, and is unique across the system. Fixes: 6607c17c6c5e ("net: mana: Enable debugfs files for MANA device") Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260408081224.302308-2-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 2b5dd4632966c39da6ba74dbc8689b309065e82c Author: Junxi Qian Date: Wed Apr 8 16:10:06 2026 +0800 nfc: llcp: add missing return after LLCP_CLOSED checks In nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket state is LLCP_CLOSED, the code correctly calls release_sock() and nfc_llcp_sock_put() but fails to return. Execution falls through to the remainder of the function, which calls release_sock() and nfc_llcp_sock_put() again. This results in a double release_sock() and a refcount underflow via double nfc_llcp_sock_put(), leading to a use-after-free. Add the missing return statements after the LLCP_CLOSED branches in both functions to prevent the fall-through. Fixes: d646960f7986 ("NFC: Initial LLCP support") Signed-off-by: Junxi Qian Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260408081006.3723-1-qjx1298677004@gmail.com Signed-off-by: Jakub Kicinski commit 5acd07df8683371161969a7bb43f4a5b33e74870 Merge: 05ed6c221e595d bcc0f4c0f25713 Author: Jakub Kicinski Date: Sun Apr 12 11:09:39 2026 -0700 Merge branch 'bng_en-add-link-management-and-statistics-support' Bhargava Marreddy says: ==================== bng_en: add link management and statistics support This series enhances the bng_en driver by adding: 1. Link/PHY support a. Link query b. Async Link events c. Ethtool link set/get functionality 2. Hardware statistics reporting via ethtool -S This version incorporates feedback received prior to splitting the original series into two parts. ==================== Link: https://patch.msgid.link/20260406180420.279470-1-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit bcc0f4c0f257135a37b674382efcaef4a257642f Author: Bhargava Marreddy Date: Mon Apr 6 23:34:20 2026 +0530 bng_en: add support for ethtool -S stats display Implement the legacy ethtool statistics interface (get_sset_count, get_strings, get_ethtool_stats) to expose hardware counters not available through standard kernel stats APIs. Ex: a) Per-queue ring stats rxq0_ucast_packets: 2 rxq0_mcast_packets: 0 rxq0_bcast_packets: 15 rxq0_ucast_bytes: 120 rxq0_mcast_bytes: 0 rxq0_bcast_bytes: 900 txq0_ucast_packets: 0 txq0_mcast_packets: 0 txq0_bcast_packets: 0 txq0_ucast_bytes: 0 txq0_mcast_bytes: 0 txq0_bcast_bytes: 0 b) Per-queue TPA(LRO/GRO) stats rxq4_tpa_eligible_pkt: 0 rxq4_tpa_eligible_bytes: 0 rxq4_tpa_pkt: 0 rxq4_tpa_bytes: 0 rxq4_tpa_errors: 0 rxq4_tpa_events: 0 c) Port level stats rxp_good_vlan_frames: 0 rxp_mtu_err_frames: 0 rxp_tagged_frames: 0 rxp_double_tagged_frames: 0 rxp_pfc_ena_frames_pri0: 0 rxp_pfc_ena_frames_pri1: 0 rxp_pfc_ena_frames_pri2: 0 rxp_pfc_ena_frames_pri3: 0 rxp_pfc_ena_frames_pri4: 0 rxp_pfc_ena_frames_pri5: 0 rxp_pfc_ena_frames_pri6: 0 rxp_pfc_ena_frames_pri7: 0 rxp_eee_lpi_events: 0 rxp_eee_lpi_duration: 0 rxp_runt_bytes: 0 rxp_runt_frames: 0 txp_good_vlan_frames: 0 txp_jabber_frames: 0 txp_fcs_err_frames: 0 txp_pfc_ena_frames_pri0: 0 txp_pfc_ena_frames_pri1: 0 txp_pfc_ena_frames_pri2: 0 txp_pfc_ena_frames_pri3: 0 txp_pfc_ena_frames_pri4: 0 txp_pfc_ena_frames_pri5: 0 txp_pfc_ena_frames_pri6: 0 txp_pfc_ena_frames_pri7: 0 txp_eee_lpi_events: 0 txp_eee_lpi_duration: 0 txp_xthol_frames: 0 d) Per-priority stats rx_bytes_pri0: 4182650 rx_bytes_pri1: 4182650 rx_bytes_pri2: 4182650 rx_bytes_pri3: 4182650 rx_bytes_pri4: 4182650 rx_bytes_pri5: 4182650 rx_bytes_pri6: 4182650 rx_bytes_pri7: 4182650 Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Link: https://patch.msgid.link/20260406180420.279470-11-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit c1da271f0d35b2c043a0b7cd58b3683a3776b135 Author: Bhargava Marreddy Date: Mon Apr 6 23:34:19 2026 +0530 bng_en: implement netdev_stat_ops Implement netdev_stat_ops to provide standardized per-queue statistics via the Netlink API. Below is the description of the hardware drop counters: rx-hw-drop-overruns: Packets dropped by HW due to resource limitations (e.g., no BDs available in the host ring). rx-hw-drops: Total packets dropped by HW (sum of overruns and error drops). tx-hw-drop-errors: Packets dropped by HW because they were invalid or malformed. tx-hw-drops: Total packets dropped by HW (sum of resource limitations and error drops). The implementation was verified using the ynl tool: ./tools/net/ynl/pyynl/cli.py --spec \ Documentation/netlink/specs/netdev.yaml --dump qstats-get --json \ '{"ifindex":14, "scope":"queue"}' [{'ifindex': 14, 'queue-id': 0, 'queue-type': 'rx', 'rx-bytes': 758, 'rx-hw-drop-overruns': 0, 'rx-hw-drops': 0, 'rx-packets': 11}, {'ifindex': 14, 'queue-id': 1, 'queue-type': 'rx', 'rx-bytes': 0, 'rx-hw-drop-overruns': 0, 'rx-hw-drops': 0, 'rx-packets': 0}, {'ifindex': 14, 'queue-id': 0, 'queue-type': 'tx', 'tx-bytes': 0, 'tx-hw-drop-errors': 0, 'tx-hw-drops': 0, 'tx-packets': 0}, {'ifindex': 14, 'queue-id': 1, 'queue-type': 'tx', 'tx-bytes': 0, 'tx-hw-drop-errors': 0, 'tx-hw-drops': 0, 'tx-packets': 0}, {'ifindex': 14, 'queue-id': 2, 'queue-type': 'tx', 'tx-bytes': 810, 'tx-hw-drop-errors': 0, 'tx-hw-drops': 0, 'tx-packets': 10},] Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Link: https://patch.msgid.link/20260406180420.279470-10-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit d4f802eb4e7d4eb786db9ce2a6d50eed7cbf4e5c Author: Bhargava Marreddy Date: Mon Apr 6 23:34:18 2026 +0530 bng_en: implement ndo_get_stats64 Implement the ndo_get_stats64 callback to report aggregate network statistics. The driver gathers these by accumulating the per-ring counters into the provided rtnl_link_stats64 structure. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Link: https://patch.msgid.link/20260406180420.279470-9-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 50c885cb2ebec05ca2ba1ff2723a654ac4b22df9 Author: Bhargava Marreddy Date: Mon Apr 6 23:34:17 2026 +0530 bng_en: periodically fetch and accumulate hardware statistics Use the timer to schedule periodic stats collection via the workqueue when the link is up. Fetch fresh counters from hardware via DMA and accumulate them into 64-bit software shadows, handling wrap-around for counters narrower than 64 bits. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rahul Gupta Reviewed-by: Ajit Kumar Khaparde Link: https://patch.msgid.link/20260406180420.279470-8-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 8438239bd2b2b1c85f57f7fa24c57f70692fd095 Author: Bhargava Marreddy Date: Mon Apr 6 23:34:16 2026 +0530 bng_en: add HW stats infra and structured ethtool ops Implement the hardware-level statistics foundation and modern structured ethtool operations. 1. Infrastructure: Add HWRM firmware wrappers (FUNC_QSTATS_EXT, PORT_QSTATS_EXT, and PORT_QSTATS) to query ring and port counters. 2. Structured ops: Implement .get_eth_phy_stats, .get_eth_mac_stats, .get_eth_ctrl_stats, .get_pause_stats, and .get_rmon_stats. Stats are initially reported as 0; accumulation logic is added in a subsequent patch. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Link: https://patch.msgid.link/20260406180420.279470-7-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 4a75900989c964fc839a615542f96353b1c7bc80 Author: Bhargava Marreddy Date: Mon Apr 6 23:34:15 2026 +0530 bng_en: add support for link async events Register for firmware asynchronous events, including link-status, link-speed, and PHY configuration changes. Upon event reception, re-query the PHY and update ethtool settings accordingly. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Reviewed-by: Ajit Kumar Khaparde Link: https://patch.msgid.link/20260406180420.279470-6-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit dc85e8a51f5a6b8f8a3a8de0f89467ae797b5cd8 Author: Bhargava Marreddy Date: Mon Apr 6 23:34:14 2026 +0530 bng_en: implement ethtool pauseparam operations Implement .get_pauseparam and .set_pauseparam to support flow control configuration. This allows reporting and setting of autoneg, RX pause, and TX pause states. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Link: https://patch.msgid.link/20260406180420.279470-5-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 169f6e8dd14957bbb66bf5bab40bf251a3950fc2 Author: Bhargava Marreddy Date: Mon Apr 6 23:34:13 2026 +0530 bng_en: add ethtool link settings, get_link, and nway_reset Add get/set_link_ksettings, get_link, and nway_reset support. Report supported, advertised, and link-partner speeds across NRZ, PAM4, and PAM4-112 signaling modes. Enable lane count reporting. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Reviewed-by: Ajit Kumar Khaparde Signed-off-by: Vikas Gupta Link: https://patch.msgid.link/20260406180420.279470-4-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 7626cd3d53be5249769bd2784a65bfccdce9ffaf Author: Bhargava Marreddy Date: Mon Apr 6 23:34:12 2026 +0530 bng_en: query PHY capabilities and report link status Query PHY capabilities and supported speeds from firmware, retrieve current link state (speed, duplex, pause, FEC), and log the information. Seed initial link state during probe. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Reviewed-by: Ajit Kumar Khaparde Link: https://patch.msgid.link/20260406180420.279470-3-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 2095da234017760068b654de25b466ae0654287d Author: Bhargava Marreddy Date: Mon Apr 6 23:34:11 2026 +0530 bng_en: add per-PF workqueue, timer, and slow-path task Add a dedicated single-thread workqueue and a timer for each PF to drive deferred slow-path work such as link event handling and stats collection. The timer is stopped via timer_delete_sync() when interrupts are disabled and restarted on open. While the close path stops the timer to prevent new tasks from being scheduled, the sp_task and workqueue are preserved to maintain state continuity. Final draining and destruction of the workqueue are handled during PCI remove. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Ajit Kumar Khaparde Link: https://patch.msgid.link/20260406180420.279470-2-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 8ebf408e7d463eee02c348a3c8277b95587b710d Author: Igor Pylypiv Date: Sun Apr 12 08:36:37 2026 -0700 ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands Commit 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") introduced ata_scsi_requeue_deferred_qc() to handle commands deferred during resets or NCQ failures. This deferral logic completed commands with DID_SOFT_ERROR to trigger a retry in the SCSI mid-layer. However, DID_SOFT_ERROR is subject to scsi_cmd_retry_allowed() checks. ATA PASS-THROUGH commands sent via SG_IO ioctl have scmd->allowed set to zero. This causes the mid-layer to fail the command immediately instead of retrying, even though the command was never actually issued to the hardware. Switch to DID_REQUEUE to ensure these commands are inserted back into the request queue regardless of retry limits. Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") Reviewed-by: Damien Le Moal Signed-off-by: Igor Pylypiv Signed-off-by: Niklas Cassel commit 05ed6c221e595dce22a3863a97d89088db1c28ee Merge: 006679268a2942 5d3b12d1a24b72 Author: Jakub Kicinski Date: Sun Apr 12 10:54:35 2026 -0700 Merge branch 'add-tso-map-once-dma-helpers-and-bnxt-sw-uso-support' Joe Damato says: ==================== Add TSO map-once DMA helpers and bnxt SW USO support Greetings: This series extends net/tso to add a data structure and some helpers allowing drivers to DMA map headers and packet payloads a single time. The helpers can then be used to reference slices of shared mapping for each segment. This helps to avoid the cost of repeated DMA mappings, especially on systems which use an IOMMU. N per-packet DMA maps are replaced with a single map for the entire GSO skb. As of v3, the series uses the DMA IOVA API (as suggested by Leon [1]) and provides a fallback path when an IOMMU is not in use. The DMA IOVA API provides even better efficiency than the v2; see below. The added helpers are then used in bnxt to add support for software UDP Segmentation Offloading (SW USO) for older bnxt devices which do not have support for USO in hardware. Since the helpers are generic, other drivers can be extended similarly. The v2 showed a ~4x reduction in DMA mapping calls at the same wire packet rate on production traffic with a bnxt device. The v3, however, shows a larger reduction of about ~6x at the same wire packet rate. This is thanks to Leon's suggestion of using the DMA IOVA API [1]. Special care is taken to make bnxt ethtool operations work correctly: the ring size cannot be reduced below a minimum threshold while USO is enabled and growing the ring automatically re-enables USO if it was previously blocked. This v10 contains some cosmetic changes (wrapping long lines), moves the test to the correct directory, and attempts to fix the slot availability check added in the v9. I re-ran the python test and the test passed on my bnxt system. I also ran this on a production system. ==================== Link: https://patch.msgid.link/20260408230607.2019402-1-joe@dama.to Signed-off-by: Jakub Kicinski commit 5d3b12d1a24b72e147fbb585158f51585593f640 Author: Joe Damato Date: Wed Apr 8 16:05:59 2026 -0700 selftests: drv-net: Add USO test Add a simple test for USO. Tests both ipv4 and ipv6 with several full segments and a partial segment. Suggested-by: Jakub Kicinski Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260408230607.2019402-11-joe@dama.to Signed-off-by: Jakub Kicinski commit 28f2c22398fbaaad9f16ac84647a3ed9e1a1e284 Author: Joe Damato Date: Wed Apr 8 16:05:58 2026 -0700 net: bnxt: Dispatch to SW USO Wire in the SW USO path added in preceding commits when hardware USO is not possible. When a GSO skb with SKB_GSO_UDP_L4 arrives and the NIC lacks HW USO capability, redirect to bnxt_sw_udp_gso_xmit() which handles software segmentation into individual UDP frames submitted directly to the TX ring. Suggested-by: Jakub Kicinski Reviewed-by: Pavan Chebbi Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260408230607.2019402-10-joe@dama.to Signed-off-by: Jakub Kicinski commit 87550ba2dc39489be292ecb485118ea662800b82 Author: Joe Damato Date: Wed Apr 8 16:05:57 2026 -0700 net: bnxt: Add SW GSO completion and teardown support Update __bnxt_tx_int and bnxt_free_one_tx_ring_skbs to handle SW GSO segments: - MID segments: adjust tx_pkts/tx_bytes accounting and skip skb free (the skb is shared across all segments and freed only once) - LAST segments: call tso_dma_map_complete() to tear down the IOVA mapping if one was used. On the fallback path, payload DMA unmapping is handled by the existing per-BD dma_unmap_len walk. Both MID and LAST completions advance tx_inline_cons to release the segment's inline header slot back to the ring. is_sw_gso is initialized to zero, so the new code paths are not run. Add logic for feature advertisement and guardrails for ring sizing. Suggested-by: Jakub Kicinski Reviewed-by: Pavan Chebbi Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260408230607.2019402-9-joe@dama.to Signed-off-by: Jakub Kicinski commit cc5d90667db81474ed7a92a1b2fa3daec5559307 Author: Joe Damato Date: Wed Apr 8 16:05:56 2026 -0700 net: bnxt: Implement software USO Implement bnxt_sw_udp_gso_xmit() using the core tso_dma_map API and the pre-allocated TX inline buffer for per-segment headers. The xmit path: 1. Calls tso_start() to initialize TSO state 2. Stack-allocates a tso_dma_map and calls tso_dma_map_init() to DMA-map the linear payload and all frags upfront. 3. For each segment: - Copies and patches headers via tso_build_hdr() into the pre-allocated tx_inline_buf (DMA-synced per segment) - Counts payload BDs via tso_dma_map_count() - Emits long BD (header) + ext BD + payload BDs - Payload BDs use tso_dma_map_next() which yields (dma_addr, chunk_len, mapping_len) tuples. Header BDs set dma_unmap_len=0 since the inline buffer is pre-allocated and unmapped only at ring teardown. Completion state is updated by calling tso_dma_map_completion_save() for the last segment. Suggested-by: Jakub Kicinski Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260408230607.2019402-8-joe@dama.to Signed-off-by: Jakub Kicinski commit 0440e27eedace1c96b46b67d5607348bb07281ec Author: Joe Damato Date: Wed Apr 8 16:05:55 2026 -0700 net: bnxt: Add boilerplate GSO code Add bnxt_gso.c and bnxt_gso.h with a stub bnxt_sw_udp_gso_xmit() function, SW USO constants (BNXT_SW_USO_MAX_SEGS, BNXT_SW_USO_MAX_DESCS), and the is_sw_gso field in bnxt_sw_tx_bd with BNXT_SW_GSO_MID/LAST markers. The full SW USO implementation will be added in a future commit. Suggested-by: Jakub Kicinski Reviewed-by: Pavan Chebbi Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260408230607.2019402-7-joe@dama.to Signed-off-by: Jakub Kicinski commit 0c26a0e765e70b7342a47dd3a29f5e0734081d7d Author: Joe Damato Date: Wed Apr 8 16:05:54 2026 -0700 net: bnxt: Add TX inline buffer infrastructure Add per-ring pre-allocated inline buffer fields (tx_inline_buf, tx_inline_dma, tx_inline_size) to bnxt_tx_ring_info and helpers to allocate and free them. A producer and consumer (tx_inline_prod, tx_inline_cons) are added to track which slot(s) of the inline buffer are in-use. The inline buffer will be used by the SW USO path for pre-allocated, pre-DMA-mapped per-segment header copies. In the future, this could be extended to support TX copybreak. Allocation helper is marked __maybe_unused in this commit because it will be wired in later. Suggested-by: Jakub Kicinski Reviewed-by: Pavan Chebbi Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260408230607.2019402-6-joe@dama.to Signed-off-by: Jakub Kicinski commit 3cb430e62c83823b76fc7dc1aec8dc7bbf81a729 Author: Joe Damato Date: Wed Apr 8 16:05:53 2026 -0700 net: bnxt: Use dma_unmap_len for TX completion unmapping Store the DMA mapping length in each TX buffer descriptor via dma_unmap_len_set at submit time, and use dma_unmap_len at completion time. This is a no-op for normal packets but prepares for software USO, where header BDs set dma_unmap_len to 0 because the header buffer is unmapped collectively rather than per-segment. Suggested-by: Jakub Kicinski Reviewed-by: Pavan Chebbi Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260408230607.2019402-5-joe@dama.to Signed-off-by: Jakub Kicinski commit 637237d3d93cab7f183075f4fadbfbf62663c6f4 Author: Joe Damato Date: Wed Apr 8 16:05:52 2026 -0700 net: bnxt: Add a helper for tx_bd_ext Factor out some code to setup tx_bd_exts into a helper function. This helper will be used by SW USO implementation in the following commits. Suggested-by: Jakub Kicinski Reviewed-by: Pavan Chebbi Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260408230607.2019402-4-joe@dama.to Signed-off-by: Jakub Kicinski commit 268c63f2c6b23c80f3c903642f300a8e37ab3aa3 Author: Joe Damato Date: Wed Apr 8 16:05:51 2026 -0700 net: bnxt: Export bnxt_xmit_get_cfa_action Export bnxt_xmit_get_cfa_action so that it can be used in future commits which add software USO support to bnxt. Suggested-by: Jakub Kicinski Reviewed-by: Pavan Chebbi Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260408230607.2019402-3-joe@dama.to Signed-off-by: Jakub Kicinski commit 82db77f6fb16d23ea60d0f96dcf2b502a322a28f Author: Joe Damato Date: Wed Apr 8 16:05:50 2026 -0700 net: tso: Introduce tso_dma_map and helpers Add struct tso_dma_map to tso.h for tracking DMA addresses of mapped GSO payload data and tso_dma_map_completion_state. The tso_dma_map combines DMA mapping storage with iterator state, allowing drivers to walk pre-mapped DMA regions linearly. Includes fields for the DMA IOVA path (iova_state, iova_offset, total_len) and a fallback per-region path (linear_dma, frags[], frag_idx, offset). The tso_dma_map_completion_state makes the IOVA completion state opaque for drivers. Drivers are expected to allocate this and use the added helpers to update the completion state. Adds skb_frag_phys() to skbuff.h, returning the physical address of a paged fragment's data, which is used by the tso_dma_map helpers introduced in this commit described below. The added TSO DMA map helpers are: tso_dma_map_init(): DMA-maps the linear payload region and all frags upfront. Prefers the DMA IOVA API for a single contiguous mapping with one IOTLB sync; falls back to per-region dma_map_phys() otherwise. Returns 0 on success, cleans up partial mappings on failure. tso_dma_map_cleanup(): Handles both IOVA and fallback teardown paths. tso_dma_map_count(): counts how many descriptors the next N bytes of payload will need. Returns 1 if IOVA is used since the mapping is contiguous. tso_dma_map_next(): yields the next (dma_addr, chunk_len) pair. On the IOVA path, each segment is a single contiguous chunk. On the fallback path, indicates when a chunk starts a new DMA mapping so the driver can set dma_unmap_len on that descriptor for completion-time unmapping. tso_dma_map_completion_save(): updates the completion state. Drivers will call this at xmit time. tso_dma_map_complete(): tears down the mapping at completion time and returns true if the IOVA path was used. If it was not used, this is a no-op and returns false. Suggested-by: Jakub Kicinski Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260408230607.2019402-2-joe@dama.to Signed-off-by: Jakub Kicinski commit bd39fc81340aed5445c731eb391af9ac9a701658 Author: Matt Turner Date: Fri Apr 3 11:01:28 2026 -0400 alpha: Define pgprot_modify to silence tautological comparison warnings Alpha's pgprot_noncached, pgprot_writecombine, and pgprot_device are all identity macros, so the generic pgprot_modify() produces tautological self-comparisons that GCC warns about: include/linux/pgtable.h:1701:25: warning: self-comparison always evaluates to true [-Wtautological-compare] Since all caching attributes are no-ops on Alpha, define pgprot_modify() to simply return newprot. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Matt Turner Reviewed-by: Magnus Lindholm Link: https://lore.kernel.org/r/20260403150128.488513-1-mattst88@gmail.com Signed-off-by: Magnus Lindholm commit 55b22075f7840ef48254886758976531fe146609 Author: Magnus Lindholm Date: Thu Apr 9 19:10:15 2026 +0200 alpha: add support for SECCOMP and SECCOMP_FILTER Add SECCOMP and SECCOMP_FILTER support to the Alpha architecture and fix syscall entry and ptrace issues uncovered by the seccomp-bpf selftests. The syscall entry path is reworked to consistently track syscall state using r0, r1 and r2: - r1 holds the active syscall number - r2 preserves the original syscall number for restart - r0 carries the return value, with r19 (a3) indicating success/error This allows syscall restarts to be permitted only for valid ERESTART* return codes and prevents kernel-internal restart values from leaking to userspace. The syscall tracing error marker is corrected to use the saved syscall number slot, matching the Alpha ABI. Additionally, implement minimal PTRACE_GETREGSET and PTRACE_SETREGSET support for NT_PRSTATUS, exporting struct pt_regs directly. This fixes ptrace-based seccomp tests that previously failed with -EIO. With these changes, seccomp-bpf and ptrace syscall tests pass reliably on Alpha. Tested-by: Michael Cree Signed-off-by: Magnus Lindholm Link: https://lore.kernel.org/r/20260409171439.8759-2-linmag7@gmail.com Signed-off-by: Magnus Lindholm commit 006679268a2942f897a1d601779867a8dcbb8ed0 Author: Luigi Leonardi Date: Wed Apr 8 17:21:02 2026 +0200 vsock/virtio: remove unnecessary call to `virtio_transport_get_ops` `virtio_transport_send_pkt_info` gets all the transport information from the parameter `t_ops`. There is no need to call `virtio_transport_get_ops()`. Remove it. Acked-by: Arseniy Krasnov Acked-by: Michael S. Tsirkin Signed-off-by: Luigi Leonardi Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20260408-remove_parameter-v2-1-e00f31cf7a17@redhat.com Signed-off-by: Jakub Kicinski commit 5758be283ff8b37beed49e270b908a251d5ca2d7 Author: Jiayuan Chen Date: Fri Apr 10 11:47:32 2026 +0800 net: skb: clean up dead code after skb_kfree_head() simplification Since commit 0f42e3f4fe2a ("net: skb: fix cross-cache free of KFENCE-allocated skb head"), skb_kfree_head() always calls kfree() and no longer uses end_offset to distinguish between skb_small_head_cache and generic kmalloc caches. Clean up the leftovers: - Remove the unused end_offset parameter from skb_kfree_head() and update all callers. - Remove the SKB_SMALL_HEAD_HEADROOM guard in __skb_unclone_keeptruesize() which was protecting the old skb_kfree_head() logic. - Update the SKB_SMALL_HEAD_CACHE_SIZE comment to reflect that the non-power-of-2 sizing is no longer used for free-path disambiguation. No functional change. Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260410034736.297900-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit e530b484b70552d6222e2327e311f364724ce616 Author: Daniel Borkmann Date: Fri Apr 10 09:23:34 2026 +0200 netkit: Don't emit scrub attribute for single device mode When userspace reads a single mode netkit device via RTM_GETLINK, it receives IFLA_NETKIT_SCRUB=NETKIT_SCRUB_DEFAULT attribute from netkit_fill_info(). If that attribute is echoed back to recreate the device, the seen_scrub presence check in netkit_new_link() causes creation to fail with -EOPNOTSUPP. Since it has no meaning for single devices at this point, just don't dump it. Fixes: 481038960538 ("netkit: Add single device mode for netkit") Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260410072334.548232-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 469faa546e7a82be85114e322cec6438790870ff Author: Thangaraj Samynathan Date: Fri Apr 10 14:27:10 2026 +0530 net: lan743x: rename chip_rev to fpga_rev The variable chip_rev stores the value read from the FPGA_REV register and represents the FPGA revision. Rename it to fpga_rev to better reflect its meaning. No functional change intended. Signed-off-by: Thangaraj Samynathan Link: https://patch.msgid.link/20260410085710.9246-1-thangaraj.s@microchip.com Signed-off-by: Jakub Kicinski commit 61119542663cac70898aef532eb57ee41ea9b477 Author: Florian Westphal Date: Fri Apr 10 00:45:02 2026 +0200 selftests: netfilter: nft_tproxy.sh: adjust to socat changes Like e65d8b6f3092 ("selftests: drv-net: adjust to socat changes") we need to add shut-none for this test too. The extra 0-packet can trigger a second (unexpected) reply from the server. Fixes: 7e37e0eacd22 ("selftests: netfilter: nft_tproxy.sh: add tcp tests") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20260408152432.24b8ad0d@kernel.org/ Suggested-by: Jakub Kicinski Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260409224506.27072-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 03a1569c2b9f5af5b23f82f7b14fce8358c43fcf Merge: 118cbd428e434b 62443dc21114c0 Author: Jakub Kicinski Date: Sun Apr 12 09:39:20 2026 -0700 Merge tag 'nf-next-26-04-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== netfilter: updates for net-next 1-3) IPVS updates from Julian Anastasov to enhance visibility into IPVS internal state by exposing hash size, load factor etc and allows userspace to tune the load factor used for resizing hash tables. 4) reject empty/not nul terminated device names from xt_physdev. This isn't a bug fix; existing code doesn't require a c-string. But clean this up anyway because conceptually the interface name definitely should be a c-string. 5) Switch nfnetlink to skb_mac_header helpers that didn't exist back when this code was written. This gives us additional debug checks but is not intended to change functionality. 6) Let the xt ttl/hoplimit match reject unknown operator modes. This is a cleanup, the evaluation function simply returns false when the mode is out of range. From Marino Dzalto. 7) xt_socket match should enable defrag after all other checks. This bug is harmless, historically defrag could not be disabled either except by rmmod. 8) remove UDP-Lite conntrack support, from Fernando Fernandez Mancera. 9) Avoid a couple -Wflex-array-member-not-at-end warnings in the old xtables 32bit compat code, from Gustavo A. R. Silva. 10) nftables fwd expression should drop packets when their ttl/hl has expired. This is a bug fix deferred, its not deemed important enough for -rc8. 11) Add additional checks before assuming the mac header is an ethernet header, from Zhengchuan Liang. * tag 'nf-next-26-04-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: require Ethernet MAC header before using eth_hdr() netfilter: nft_fwd_netdev: check ttl/hl before forwarding netfilter: x_tables: Avoid a couple -Wflex-array-member-not-at-end warnings netfilter: conntrack: remove UDP-Lite conntrack support netfilter: xt_socket: enable defrag after all other checks netfilter: xt_HL: add pr_fmt and checkentry validation netfilter: nfnetlink: prefer skb_mac_header helpers netfilter: x_physdev: reject empty or not-nul terminated device names ipvs: add conn_lfactor and svc_lfactor sysctl vars ipvs: add ip_vs_status info ipvs: show the current conn_tab size to users ==================== Link: https://patch.msgid.link/20260410112352.23599-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit f462dca0c8415bf0058d0ffa476354c4476d0f09 Author: Jamal Hadi Salim Date: Fri Apr 10 07:16:27 2026 -0400 net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero() is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft object. This vulnerability can lead to privilege escalation. Analysis from zdi-disclosures@trendmicro.com: When initializing act_ct, tcf_ct_init() is called, which internally triggers tcf_ct_flow_table_get(). static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params) { struct zones_ht_key key = { .net = net, .zone = params->zone }; struct tcf_ct_flow_table *ct_ft; int err = -ENOMEM; mutex_lock(&zones_mutex); ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); // [1] if (ct_ft && refcount_inc_not_zero(&ct_ft->ref)) // [2] goto out_unlock; ... } static __always_inline void *rhashtable_lookup_fast( struct rhashtable *ht, const void *key, const struct rhashtable_params params) { void *obj; rcu_read_lock(); obj = rhashtable_lookup(ht, key, params); rcu_read_unlock(); return obj; } At [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft from zones_ht . The lookup is performed within an RCU read critical section through rcu_read_lock() / rcu_read_unlock(), which prevents the object from being freed. However, at the point of function return, rcu_read_unlock() has already been called, and there is nothing preventing ct_ft from being freed before reaching refcount_inc_not_zero(&ct_ft->ref) at [2]. This interval becomes the race window, during which ct_ft can be freed. Free Process: tcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu() tcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put(). static void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft) { if (refcount_dec_and_test(&ct_ft->ref)) { rhashtable_remove_fast(&zones_ht, &ct_ft->node, zones_params); INIT_RCU_WORK(&ct_ft->rwork, tcf_ct_flow_table_cleanup_work); // [3] queue_rcu_work(act_ct_wq, &ct_ft->rwork); } } At [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work static void tcf_ct_flow_table_cleanup_work(struct work_struct *work) { struct tcf_ct_flow_table *ct_ft; struct flow_block *block; ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table, rwork); nf_flow_table_free(&ct_ft->nf_ft); block = &ct_ft->nf_ft.flow_block; down_write(&ct_ft->nf_ft.flow_block_lock); WARN_ON(!list_empty(&block->cb_list)); up_write(&ct_ft->nf_ft.flow_block_lock); kfree(ct_ft); // [4] module_put(THIS_MODULE); } tcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes between [1] and [2], UAF occurs. This race condition has a very short race window, making it generally difficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was inserted after[1] Fixes: 138470a9b2cc2 ("net/sched: act_ct: fix lockdep splat in tcf_ct_flow_table_get") Reported-by: zdi-disclosures@trendmicro.com Tested-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260410111627.46611-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 115e7d764dad66a10e150bd4b3ba3bbb95b04d85 Author: Anushka Badhe Date: Fri Apr 10 11:25:32 2026 +0530 ASoC: dt-bindings: rockchip: convert rk3399-gru-sound to DT Schema Convert the rockchip,rk3399-gru-sound.txt DT binding to DT Schema format. Update rockchip,cpu from a single I2S controller phandle to a phandle-array. Add an optional second entry for the SPDIF controller, as seen in rk3399-gru.dtsi, required by boards with DisplayPort audio. Signed-off-by: Anushka Badhe Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260410055532.60868-1-anushkabadhe@gmail.com Signed-off-by: Mark Brown commit 372169fd9519bc44ebd9addfc1cd6e4ce10c7c62 Merge: 65782b2db7321d a535a9217ca3f2 Author: Jakub Kicinski Date: Sun Apr 12 09:24:15 2026 -0700 Merge tag 'linux-can-fixes-for-7.0-20260409' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-04-09 Johan Hovold's patch fixes the a devres lifetime in the ucan driver. The last patch is by Samuel Page and fixes a use-after-free in raw_rcv() in the CAN_RAW protocol. * tag 'linux-can-fixes-for-7.0-20260409' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: raw: fix ro->uniq use-after-free in raw_rcv() can: ucan: fix devres lifetime ==================== Link: https://patch.msgid.link/20260409165942.588421-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 118cbd428e434bc1b8aac92a74b4992c7683f0fe Merge: 29703d7813f991 fa489a77e3267e Author: Jakub Kicinski Date: Sun Apr 12 09:17:42 2026 -0700 Merge tag 'wireless-next-2026-04-10' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Final updates, notably: - crypto: move Michael MIC code into wireless (only) - mac80211: - multi-link 4-addr support - NAN data support (but no drivers yet) - ath10k: DT quirk to make it work on some devices - ath12k: IPQ5424 support - rtw89: USB improvements for performance * tag 'wireless-next-2026-04-10' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (124 commits) wifi: cfg80211: Explicitly include in michael-mic.c wifi: ath10k: Add device-tree quirk to skip host cap QMI requests dt-bindings: wireless: ath10k: Add quirk to skip host cap QMI requests crypto: Remove michael_mic from crypto_shash API wifi: ipw2x00: Use michael_mic() from cfg80211 wifi: ath12k: Use michael_mic() from cfg80211 wifi: ath11k: Use michael_mic() from cfg80211 wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211 wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic() wifi: libertas_tf: refactor endpoint lookup wifi: libertas: refactor endpoint lookup wifi: at76c50x: refactor endpoint lookup wifi: ath12k: Enable IPQ5424 WiFi device support wifi: ath12k: Add CE remap hardware parameters for IPQ5424 wifi: ath12k: add ath12k_hw_regs for IPQ5424 wifi: ath12k: add ath12k_hw_version_map entry for IPQ5424 wifi: ath12k: Add ath12k_hw_params for IPQ5424 dt-bindings: net: wireless: add ath12k wifi device IPQ5424 wifi: ath10k: fix station lookup failure during disconnect wifi: ath12k: Create symlink for each radio in a wiphy ... ==================== Link: https://patch.msgid.link/20260410064703.735099-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 29703d7813f991e4ef80741ee15fe30e529a2192 Author: Eric Dumazet Date: Fri Apr 10 17:49:50 2026 +0000 tcp: add indirect call wrapper in tcp_conn_request() Small improvement in SYN processing, to directly call tcp_v6_init_seq_and_ts_off() or tcp_v4_init_seq_and_ts_off(). Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260410174950.745670-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 59818773bab657f629a60ca534d198b85944417f Author: Daniel Borkmann Date: Fri Apr 10 15:06:02 2026 +0200 net: Rename ifq_idx to rxq_idx in netif_mp_* helpers Rename the leftover ifq_idx parameter naming to rxq_idx to be consistent with the rest of the file and the header declaration. Back then this was taken out of the queue leasing series given the cleanup is independent. No functional change. Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/netdev/20260131160237.07789674@kernel.org Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260410130602.552600-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit e46ff213f7a5f5aaebd6bca589517844aa0fe73a Author: Jakub Kicinski Date: Thu Apr 9 18:39:21 2026 -0700 selftests: net: py: add test case filtering and listing When developing new test cases and reproducing failures in existing ones we currently have to run the entire test which can take minutes to finish. Add command line options for test selection, modeled after kselftest_harness.h: -l list tests (filtered, if filters were specified) -t name include test -T name exclude test Since we don't have as clean separation into fixture / variant / test as kselftest_harness this is not really a 1 to 1 match. We have to lean on glob patterns instead. Like in kselftest_harness filters are evaluated in order, first match wins. If only exclusions are specified everything else is included and vice versa. Glob patterns (*, ?, [) are supported in addition to exact matching. Reviewed-by: Willem de Bruijn Tested-by: Gal Pressman Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260410013921.1710295-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 0aa72fc37e15974827ceb72c5cf8e57085a29301 Author: Jakub Kicinski Date: Fri Apr 10 08:36:00 2026 -0700 net: fix reference tracker mismanagement in netdev_put_lock() dev_put() releases a reference which didn't have a tracker. References without a tracker are accounted in the tracking code as "no_tracker". We can't free the tracker and then call dev_put(). The references themselves will be fine but the tracking code will think it's a double-release: refcount_t: decrement hit 0; leaking memory. IOW commit under fixes confused dev_put() (release never tracked reference) with __dev_put() (just release the reference, skipping the reference tracking infra). Since __netdev_put_lock() uses dev_put() we can't feed a previously tracked netdev ref into it. Let's flip things around. netdev_put(dev, NULL) is the same as dev_put(dev) so make netdev_put_lock() the real function and have __netdev_put_lock() feed it a NULL tracker for all the cases that were untracked. Fixes: d04686d9bc86 ("net: Implement netdev_nl_queue_create_doit") Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20260410153600.1984522-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f5148298b0fe18cc91f07584bd0f75cbace3cece Author: Eric Dumazet Date: Thu Apr 9 10:11:47 2026 +0000 tcp: return a drop_reason from tcp_add_backlog() Part of a stack canary removal from tcp_v{4,6}_rcv(). Return a drop_reason instead of a boolean, so that we no longer have to pass the address of a local variable. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 0/3 up/down: 0/-37 (-37) Function old new delta tcp_v6_rcv 3133 3129 -4 tcp_v4_rcv 3206 3202 -4 tcp_add_backlog 1281 1252 -29 Total: Before=25567186, After=25567149, chg -0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260409101147.1642967-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4431c239a3010c12147d166c409ad6867d08f2f1 Merge: b258cba1e05df7 6dd82499fa6c46 Author: Jakub Kicinski Date: Sun Apr 12 09:05:59 2026 -0700 Merge branch 'ipvlan-multicast-delivery-changes' Eric Dumazet says: ==================== ipvlan: multicast delivery changes As we did recently for macvlan, this series adds some relief when ipvlan is under multicast storms. ==================== Link: https://patch.msgid.link/20260409085238.1122947-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6dd82499fa6c468237801541589eb83023d9fd46 Author: Eric Dumazet Date: Thu Apr 9 08:52:38 2026 +0000 ipvlan: avoid spinlock contention in ipvlan_multicast_enqueue() Under high stress, we spend a lot of time cloning skbs, then acquiring a spinlock, then freeing the clone because the queue is full. Add a shortcut to avoid these costs under pressure, as we did in macvlan with commit 0d5dc1d7aad1 ("macvlan: avoid spinlock contention in macvlan_broadcast_enqueue()") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260409085238.1122947-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 441ec8b5bdcc77f084b63800fd39404d9fc7c9f5 Author: Eric Dumazet Date: Thu Apr 9 08:52:37 2026 +0000 ipvlan: ipvlan_handle_mode_l2() refactoring Reduce indentation level, and add a likely() clause as we expect to process more unicast packets than multicast ones. No functional change, this eases the following patch review. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260409085238.1122947-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit b258cba1e05df758e4e99a0e374da3e044618475 Author: Chris J Arges Date: Wed Apr 8 14:10:47 2026 -0500 net: Add net_cookie to Dead loop messages Network devices can have the same name within different network namespaces. To help distinguish these devices, add the net_cookie value which can be used to identify the netns. Signed-off-by: Chris J Arges Link: https://patch.msgid.link/20260408191056.1036330-1-carges@cloudflare.com Signed-off-by: Jakub Kicinski commit cea470a6944f6e0b07780ec9d9d3d8b97279b2c3 Merge: 17ad4759a082e3 82f37bd9a4d779 Author: Jakub Kicinski Date: Sun Apr 12 09:03:58 2026 -0700 Merge branch 'net-dsa-tag_rtl8_4-fixes-doc-and-set-keep' Luiz Angelo Daros de Luca says: ==================== net: dsa: tag_rtl8_4: fixes doc and set keep This small series addresses two points in the rtl8_4 tagger used by the realtel rtl8365mb driver. The first patch updates the documentation of the tag format while the second patch sets the KEEP flag bit, ensuring that the switch respects the frame's VLAN format as provided by the kernel. These patches were previously part of a larger series but are being submitted independently as they are self-contained and already received review. Link: https://patch.msgid.link/CAD++jLmX31KfhGXA6SMAPXb14dHSC1t4JQZ=PQvjh-3hUcnzJA@mail.gmail.com ==================== Link: https://patch.msgid.link/20260408-realtek_fixes-v1-0-915ff1404d56@gmail.com Signed-off-by: Jakub Kicinski commit 82f37bd9a4d779495479c0c13152208d5400c8a4 Author: Luiz Angelo Daros de Luca Date: Wed Apr 8 17:31:02 2026 -0300 net: dsa: tag_rtl8_4: set KEEP flag KEEP=1 is needed because we should respect the format of the packet as the kernel sends it to us. Unless tx forward offloading is used, the kernel is giving us the packet exactly as it should leave the specified port on the wire. Until now this was not needed because the ports were always functioning in a standalone mode in a VLAN-unaware way, so the switch would not tag or untag frames anyway. But arguably it should have been KEEP=1 all along. Co-developed-by: Alvin Šipraga Signed-off-by: Alvin Šipraga Signed-off-by: Luiz Angelo Daros de Luca Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260408-realtek_fixes-v1-2-915ff1404d56@gmail.com Signed-off-by: Jakub Kicinski commit 297e1f411ed4927a912c7e207ba6f978cb1f9f0e Author: Alvin Šipraga Date: Wed Apr 8 17:31:01 2026 -0300 net: dsa: tag_rtl8_4: update format description Document the updated tag layout fields (EFID, VSEL/VIDX) and clarify which bits are set/cleared when emitting tags. Co-developed-by: Alvin Šipraga Signed-off-by: Alvin Šipraga Signed-off-by: Luiz Angelo Daros de Luca Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260408-realtek_fixes-v1-1-915ff1404d56@gmail.com Signed-off-by: Jakub Kicinski commit 65782b2db7321d5f97c16718c4c7f6c7205a56be Author: Davide Caratti Date: Wed Apr 8 17:24:36 2026 +0200 net/sched: cls_fw: fix NULL dereference of "old" filters before change() Like pointed out by Sashiko [1], since commit ed76f5edccc9 ("net: sched: protect filter_chain list with filter_chain_lock mutex") TC filters are added to a shared block and published to datapath before their ->change() function is called. This is a problem for cls_fw: an invalid filter created with the "old" method can still classify some packets before it is destroyed by the validation logic added by Xiang. Therefore, insisting with repeated runs of the following script: # ip link add dev crash0 type dummy # ip link set dev crash0 up # mausezahn crash0 -c 100000 -P 10 \ > -A 4.3.2.1 -B 1.2.3.4 -t udp "dp=1234" -q & # sleep 1 # tc qdisc add dev crash0 egress_block 1 clsact # tc filter add block 1 protocol ip prio 1 matchall \ > action skbedit mark 65536 continue # tc filter add block 1 protocol ip prio 2 fw # ip link del dev crash0 can still make fw_classify() hit the WARN_ON() in [2]: WARNING: ./include/net/pkt_cls.h:88 at fw_classify+0x244/0x250 [cls_fw], CPU#18: mausezahn/1399 Modules linked in: cls_fw(E) act_skbedit(E) CPU: 18 UID: 0 PID: 1399 Comm: mausezahn Tainted: G E 7.0.0-rc6-virtme #17 PREEMPT(full) Tainted: [E]=UNSIGNED_MODULE Hardware name: Red Hat KVM, BIOS 1.16.3-2.el9 04/01/2014 RIP: 0010:fw_classify+0x244/0x250 [cls_fw] Code: 5c 49 c7 45 00 00 00 00 00 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 5b b8 ff ff ff ff 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 <0f> 0b 90 eb a0 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffd1b7026bf8a8 EFLAGS: 00010202 RAX: ffff8c5ac9c60800 RBX: ffff8c5ac99322c0 RCX: 0000000000000004 RDX: 0000000000000001 RSI: ffff8c5b74d7a000 RDI: ffff8c5ac8284f40 RBP: ffffd1b7026bf8d0 R08: 0000000000000000 R09: ffffd1b7026bf9b0 R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000010000 R13: ffffd1b7026bf930 R14: ffff8c5ac8284f40 R15: 0000000000000000 FS: 00007fca40c37740(0000) GS:ffff8c5b74d7a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fca40e822a0 CR3: 0000000005ca0001 CR4: 0000000000172ef0 Call Trace: tcf_classify+0x17d/0x5c0 tc_run+0x9d/0x150 __dev_queue_xmit+0x2ab/0x14d0 ip_finish_output2+0x340/0x8f0 ip_output+0xa4/0x250 raw_sendmsg+0x147d/0x14b0 __sys_sendto+0x1cc/0x1f0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x126/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fca40e822ba Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc248a42c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055ef233289d0 RCX: 00007fca40e822ba RDX: 000000000000001e RSI: 000055ef23328c30 RDI: 0000000000000003 RBP: 000055ef233289d0 R08: 00007ffc248a42d0 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001e R13: 00000000000186a0 R14: 0000000000000000 R15: 00007fca41043000 irq event stamp: 1045778 hardirqs last enabled at (1045784): [] __up_console_sem+0x52/0x60 hardirqs last disabled at (1045789): [] __up_console_sem+0x37/0x60 softirqs last enabled at (1045426): [] __alloc_skb+0x207/0x260 softirqs last disabled at (1045434): [] __dev_queue_xmit+0x78/0x14d0 Then, because of the value in the packet's mark, dereference on 'q->handle' with NULL 'q' occurs: BUG: kernel NULL pointer dereference, address: 0000000000000038 [...] RIP: 0010:fw_classify+0x1fe/0x250 [cls_fw] [...] Skip "old-style" classification on shared blocks, so that the NULL dereference is fixed and WARN_ON() is not hit anymore in the short lifetime of invalid cls_fw "old-style" filters. [1] https://sashiko.dev/#/patchset/20260331050217.504278-1-xmei5%40asu.edu [2] https://elixir.bootlin.com/linux/v7.0-rc6/source/include/net/pkt_cls.h#L86 Fixes: faeea8bbf6e9 ("net/sched: cls_fw: fix NULL pointer dereference on shared blocks") Fixes: ed76f5edccc9 ("net: sched: protect filter_chain list with filter_chain_lock mutex") Acked-by: Jamal Hadi Salim Signed-off-by: Davide Caratti Link: https://patch.msgid.link/e39cbd3103a337f1e515d186fe697b4459d24757.1775661704.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 17ad4759a082e38c6c195fddf7022d363c2838ee Merge: 436e9e48ca5141 40637e4a4477ab Author: Jakub Kicinski Date: Sun Apr 12 08:42:30 2026 -0700 Merge branch 'wangxun-improvement' Jiawen Wu says: ==================== Wangxun improvement This patch series cleans up the code and enhances the implementation. ==================== Link: https://patch.msgid.link/20260407025616.33652-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 40637e4a4477ab0f059f60e38d376390b4c71823 Author: Jiawen Wu Date: Tue Apr 7 10:56:16 2026 +0800 net: libwx: improve flow control setting Save the current mode of flow control, and enhance the statistics of pause frames. The received pause frames are divided into XON and XOFF to be counted. And due to the hardware defect of SP devices, XON packets cannot be trasmitted correctly, so Tx XON pause is disabled by default for those devices. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20260407025616.33652-10-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 1dd9b0dafd21cfdac534b423b7e7ee980b3c535a Author: Jiawen Wu Date: Tue Apr 7 10:56:15 2026 +0800 net: libwx: wrap-around and reset qmprc counter The WX_PX_MPRC registers are not clear-on-read hardware counters. The previous implementation directly read and accumulated these 32-bit values into a 64-bit software counter. Now implement a rd32_wrap() helper function to calculate the delta counter to correct the statistic. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20260407025616.33652-9-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit dc33e52b8ce6f2d42dce18da12dc47d6c21f2e8b Author: Jiawen Wu Date: Tue Apr 7 10:56:14 2026 +0800 net: wangxun: schedule hardware stats update in watchdog Hardware statistics should be updated periodically in the watchdog to prevent 32-bit registers from overflowing. This is also required for the upcoming pause frame accounting logic, which relies on regular statistics sampling. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20260407025616.33652-8-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 58f6303572ec66e7c2967ac168125f444c9e880d Author: Jiawen Wu Date: Tue Apr 7 10:56:13 2026 +0800 net: wangxun: reorder timer and work sync cancellations When removing the device, timer_delete_sync(&wx->service_timer) is called in .ndo_stop() after cancel_work_sync(&wx->service_task). This may cause new work to be queued after device down. Move unregister_netdev() before cancel_work_sync(), and use timer_shutdown_sync() to prevent the timer from being re-armed. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20260407025616.33652-7-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit b736ebed937e5e0ab68cff3ed6103c7aa058f414 Author: Jiawen Wu Date: Tue Apr 7 10:56:12 2026 +0800 net: wangxun: move ethtool_ops.set_channels into libwx Since function ops wx->setup_tc() is set in txgbe and ngbe, ethtool_ops.set_channels can be implemented in libwx to reduce duplicated code. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20260407025616.33652-6-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit d48df7e7c3fb456d2dc907707a124dab8462eb19 Author: Jiawen Wu Date: Tue Apr 7 10:56:11 2026 +0800 net: wangxun: replace busy-wait reset flag with kernel mutex Replace the busy-wait loop using test_and_set_bit(WX_STATE_RESETTING) with a proper per-device mutex to serialize reset operations. The reset flag is reserved for other code paths (like watchdog), which need tocheck if a reset is in process. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20260407025616.33652-5-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 9bc29a87fbc647db5f08643403d59f094d19298e Author: Jiawen Wu Date: Tue Apr 7 10:56:10 2026 +0800 net: ngbe: remove redundant macros NGBE_NCSI_SUP and NGBE_NCSI_MASK are duplicate-defined, they can be replaced by the macros defined in libwx. Just remove them. Signed-off-by: Jiawen Wu Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260407025616.33652-4-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 752157d9eded7f9213d102048388a78753b84617 Author: Jiawen Wu Date: Tue Apr 7 10:56:09 2026 +0800 net: ngbe: move the WOL functions to libwx Remove duplicate-defined register macros, move the WOL implementation to the library module. So that the WOL functions can be reused in txgbe later. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20260407025616.33652-3-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 4d19654dacef1ce6e29769c0c863df13de0d5be3 Author: Jiawen Wu Date: Tue Apr 7 10:56:08 2026 +0800 net: ngbe: remove netdev->ethtool->wol_enabled setting netdev->ethtool->wol_enabled is set in ethtool core code, so remove the redundant setting in ngbe_set_wol(). Signed-off-by: Jiawen Wu Reviewed-by: Breno Leitao Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260407025616.33652-2-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 436e9e48ca5141658d65f1190fccbc60a490c84b Author: Nora Schiffer Date: Tue Apr 7 12:48:02 2026 +0200 net: ethernet: ti: am65-cpsw: add support for J722S SoC family The J722S CPSW3G is mostly identical to the AM64's, but additionally supports SGMII. Signed-off-by: Nora Schiffer Link: https://patch.msgid.link/6118e81358d47f455e4c1dbddf3ece6f3329e184.1775558273.git.nora.schiffer@ew.tq-group.com Signed-off-by: Jakub Kicinski commit f757a2da6df52299606512b0920eba728d642543 Author: Nora Schiffer Date: Tue Apr 7 12:48:01 2026 +0200 dt-bindings: net: ti: k3-am654-cpsw-nuss: Add ti,j722s-cpsw-nuss compatible The J722S CPSW3G is mostly identical to the AM64's, but additionally supports SGMII. The AM64 compatible ti,am642-cpsw-nuss is used as a fallback. Signed-off-by: Nora Schiffer Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/191e9f7e3a6c14eabe891a98c5fb646766479c0a.1775558273.git.nora.schiffer@ew.tq-group.com Signed-off-by: Jakub Kicinski commit d24b443429e071e4dad662c440e2ea56000accba Merge: 3f3a2aefbc661b 14f269ae699869 Author: Jakub Kicinski Date: Sun Apr 12 08:27:43 2026 -0700 Merge branch 'dpll-zl3073x-add-ref-sync-pair-support' Ivan Vecera says: ==================== dpll: zl3073x: add ref-sync pair support This series adds Reference-Sync pair support to the ZL3073x DPLL driver. A Ref-Sync pair consists of a clock reference and a low-frequency sync signal (e.g. 1 PPS) where the DPLL locks to the clock reference but phase-aligns to the sync reference. Patches 1-3 are preparatory cleanups and helper additions: - Clean up esync get/set callbacks with early returns and use the zl3073x_out_is_ndiv() helper - Convert open-coded clear-and-set bitfield patterns to FIELD_MODIFY() - Add ref sync control and output clock type accessor helpers Patch 4 adds the 'ref-sync-sources' phandle-array property to the dpll-pin device tree binding schema and updates the ZL3073x binding examples. Patch 5 implements the driver support: - ref_sync_get/set callbacks with frequency validation - Automatic sync source exclusion from reference selection - Device tree based ref-sync pair registration Tested and verified on Microchip EDS2 (pcb8385) development board. ==================== Link: https://patch.msgid.link/20260408102716.443099-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 14f269ae699869ddaca7c29c9c6c52288e3bfb73 Author: Ivan Vecera Date: Wed Apr 8 12:27:16 2026 +0200 dpll: zl3073x: add ref-sync pair support Add support for ref-sync pair registration using the 'ref-sync-sources' phandle property from device tree. A ref-sync pair consists of a clock reference and a low-frequency sync signal where the DPLL locks to the clock reference but phase-aligns to the sync reference. The implementation: - Stores fwnode handle in zl3073x_dpll_pin during pin registration - Adds ref_sync_get/set callbacks to read and write the sync control mode and pair registers - Validates ref-sync frequency constraints: sync signal must be 8 kHz or less, clock reference must be 1 kHz or more and higher than sync - Excludes sync source from automatic reference selection by setting its priority to NONE on connect; on disconnect the priority is left as NONE and the user must explicitly make the pin selectable again - Iterates ref-sync-sources phandles to register declared pairings via dpll_pin_ref_sync_pair_add() Reviewed-by: Petr Oros Reviewed-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260408102716.443099-6-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit a1a702090def20ab0fea13700128861b70d91bc5 Author: Ivan Vecera Date: Wed Apr 8 12:27:15 2026 +0200 dt-bindings: dpll: add ref-sync-sources property Add ref-sync-sources phandle-array property to the dpll-pin schema allowing board designers to declare which input pins can serve as sync sources in a Reference-Sync pair. A Ref-Sync pair consists of a clock reference and a low-frequency sync signal where the DPLL locks to the clock but phase-aligns to the sync reference. Update both examples in the Microchip ZL3073x binding to demonstrate the new property with a 1 PPS sync source paired to a clock source. Reviewed-by: Petr Oros Reviewed-by: Prathosh Satish Reviewed-by: Rob Herring (Arm) Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260408102716.443099-5-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 63009eb92b0f379afddbba8dfdf8df087f6d5b62 Author: Ivan Vecera Date: Wed Apr 8 12:27:14 2026 +0200 dpll: zl3073x: add ref sync and output clock type helpers Add ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR and ZL_REF_SYNC_CTRL_PAIR register definitions. Add inline helpers to get and set the sync control mode and sync pair fields of the reference sync control register: zl3073x_ref_sync_mode_get/set() - ZL_REF_SYNC_CTRL_MODE field zl3073x_ref_sync_pair_get/set() - ZL_REF_SYNC_CTRL_PAIR field Add inline helpers to get and set the clock type field of the output mode register: zl3073x_out_clock_type_get/set() - ZL_OUTPUT_MODE_CLOCK_TYPE field Convert existing esync callbacks to use the new helpers. Reviewed-by: Petr Oros Reviewed-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260408102716.443099-4-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 737cb6195c40acf67c876f509e209158436cf287 Author: Ivan Vecera Date: Wed Apr 8 12:27:13 2026 +0200 dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns Replace open-coded clear-and-set bitfield operations with FIELD_MODIFY(). Reviewed-by: Petr Oros Reviewed-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260408102716.443099-3-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 3c8c39768b10867e4f630080785b602245f01760 Author: Ivan Vecera Date: Wed Apr 8 12:27:12 2026 +0200 dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() Return -EOPNOTSUPP early in esync_get callbacks when esync is not supported instead of conditionally populating the range at the end. This simplifies the control flow by removing the finish label/goto in the output variant and the conditional range assignment in both input and output variants. Replace open-coded N-div signal format switch statements with zl3073x_out_is_ndiv() helper in esync_get, esync_set and frequency_set callbacks. Reviewed-by: Petr Oros Reviewed-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260408102716.443099-2-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 0b73da96b6eb6b9354654f96a9d423ab22cb222d Author: Jorge Marques Date: Mon Mar 23 17:11:33 2026 +0100 i3c: master: adi: Fix error propagation for CCCs adi_i3c_master_send_ccc_cmd() always returned 0, ignoring the transfer result populated in the completion path. As a consequence, CCC command errors were silently dropped, including the default -ETIMEDOUT and later overwritten by adi_i3c_master_end_xfer_locked(). Fix this by returning xfer->ret so that callers correctly receive any transfer error codes. Fixes: a79ac2cdc91d ("i3c: master: Add driver for Analog Devices I3C Controller IP") Reviewed-by: Adrian Hunter Reviewed-by: Frank Li Signed-off-by: Jorge Marques Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-5-30bdc68004be@analog.com Signed-off-by: Alexandre Belloni commit ef8b5229348f0719aca557c4ca5530630ae4d134 Author: Jorge Marques Date: Mon Mar 23 17:11:32 2026 +0100 i3c: master: Fix error codes at send_ccc_cmd i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive, Mx codes) to the ret variable, cascading down multiple methods until reaching methods that explicitly stated they would return 0 on success or negative error code. For example, the call chain: i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <- master->ops.enable_ibi <- i3c_master_enec_locked <- i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked Fix this by returning the ret value, callers can still read the cmd->err value if ret is negative. All corner cases where the Mx codes do need to be handled individually, are resolved in previous commits. Those corner cases are all scenarios when I3C_ERROR_M2 is expected and acceptable. The prerequisite patches for the fix are: i3c: master: Move rstdaa error suppression i3c: master: Move entdaa error suppression i3c: master: Move bus_init error suppression Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/ Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Reviewed-by: Adrian Hunter Signed-off-by: Jorge Marques Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com Signed-off-by: Alexandre Belloni commit 49775afa983e3e5ce8e7d00ee241791073be214d Author: Jorge Marques Date: Mon Mar 23 17:11:31 2026 +0100 i3c: master: Move bus_init error suppression Prepare to fix improper Mx positive error propagation in later commits by handling Mx error codes where the i3c_ccc_cmd command is allocated. The CCC DISEC to broadcast address is invoked with i3c_master_enec_disec_locked() and yields error I3C_ERROR_M2 if there are no devices active on the bus. This is expected at the bus initialization stage, where it is not known yet that there are no active devices on the bus. Add bool suppress_m2 argument to i3c_master_enec_disec_locked() and update the call site at i3c_master_bus_init() with the exact corner case to not require propagating positive Mx error codes. Other call site should not suppress the error code, for example, if a driver requests to peripheral to disable events and the transfer is not acknowledged, this is an error and should not proceed. Reviewed-by: Frank Li Reviewed-by: Adrian Hunter Signed-off-by: Jorge Marques Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-3-30bdc68004be@analog.com Signed-off-by: Alexandre Belloni commit 42247fffb3044dd99c405904fef78bfe6d9d58f6 Author: Jorge Marques Date: Mon Mar 23 17:11:30 2026 +0100 i3c: master: Move entdaa error suppression Prepare to fix improper Mx positive error propagation in later commits by handling Mx error codes where the i3c_ccc_cmd command is allocated. The CCC ENTDAA is invoked with i3c_master_entdaa_locked() and yields error I3C_ERROR_M2 if there are no devices active on the bus. Some controllers may also yield if there are no more devices need an dynamic address, since the sequence do always end in a NACK. Handle inside i3c_master_entdaa_locked(), checking cmd->err directly. Both call sites are updated, adi_i3c_master_do_daa() and cdns_i3c_master_do_daa(). Reviewed-by: Frank Li Reviewed-by: Adrian Hunter Signed-off-by: Jorge Marques Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-2-30bdc68004be@analog.com Signed-off-by: Alexandre Belloni commit 19a1b61fa623748f37f467e7813c58a2a792b90c Author: Jorge Marques Date: Mon Mar 23 17:11:29 2026 +0100 i3c: master: Move rstdaa error suppression Prepare to fix improper Mx positive error propagation in later commits by handling Mx error codes where the i3c_ccc_cmd command is allocated. Two of the four i3c_master_rstdaa_locked() are error paths that already suppressed the return value, the remaining two are changed to handle the I3C_ERROR_M2 Mx error code inside i3c_master_rstdaa_locked(), checking cmd->err directly. Reviewed-by: Frank Li Reviewed-by: Adrian Hunter Signed-off-by: Jorge Marques Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-1-30bdc68004be@analog.com Signed-off-by: Alexandre Belloni commit 6105f49196158f3e27143444651c9ca9439ac8d4 Author: Felix Gu Date: Sat Apr 4 18:32:31 2026 +0800 i3c: dw: Simplify xfer cleanup with __free(kfree) Convert dw-i3c-master to use __free(kfree) guards for struct dw_i3c_xfer allocations. This frees xfer objects automatically on scope exit, and removes the now-unused dw_i3c_master_free_xfer() helper. Signed-off-by: Felix Gu Reviewed-by: Frank Li Link: https://patch.msgid.link/20260404-dw-i3c-2-v3-2-8f7d146549c1@gmail.com Signed-off-by: Alexandre Belloni commit 256cc1f1305a8e5dcadf8ca208d04a3acadd26f1 Author: Felix Gu Date: Sat Apr 4 18:32:30 2026 +0800 i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() The dw_i3c_master_i3c_xfers() function allocates memory for the xfer structure using dw_i3c_master_alloc_xfer(). If pm_runtime_resume_and_get() fails, the function returns without freeing the allocated xfer, resulting in a memory leak. Since dw_i3c_master_free_xfer() is a thin wrapper around kfree(), use the __free(kfree) cleanup attribute to handle the free automatically on all exit paths. Fixes: 62fe9d06f570 ("i3c: dw: Add power management support") Signed-off-by: Felix Gu Reviewed-by: Frank Li Link: https://patch.msgid.link/20260404-dw-i3c-2-v3-1-8f7d146549c1@gmail.com Signed-off-by: Alexandre Belloni commit 57c91ca3dd87e58d635ecbcf9635aaead2f2b1de Author: Felix Gu Date: Mon Apr 6 20:43:17 2026 +0800 i3c: master: renesas: Use __free(kfree) for xfer cleanup in renesas_i3c_send_ccc_cmd() Use __free(kfree) for automatic cleanup, matching the pattern already used in other functions in this driver. Signed-off-by: Felix Gu Tested-by: Tommaso Merciai Reviewed-by: Tommaso Merciai Reviewed-by: Frank Li Link: https://patch.msgid.link/20260406-renesas-v3-2-4b724d7708f4@gmail.com Signed-off-by: Alexandre Belloni commit d7665c3b4f575251e449e2656879392346ca612b Author: Felix Gu Date: Mon Apr 6 20:43:16 2026 +0800 i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers() The xfer structure allocated by renesas_i3c_alloc_xfer() was never freed in the renesas_i3c_i3c_xfers() function. Use the __free(kfree) cleanup attribute to automatically free the memory when the variable goes out of scope. Fixes: d028219a9f14 ("i3c: master: Add basic driver for the Renesas I3C controller") Tested-by: Tommaso Merciai Reviewed-by: Tommaso Merciai Reviewed-by: Frank Li Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260406-renesas-v3-1-4b724d7708f4@gmail.com Signed-off-by: Alexandre Belloni commit 19d6dd322c3f05550606dbfcbafb5f6989975c02 Author: Felix Gu Date: Sat Mar 21 17:04:43 2026 +0800 i3c: master: dw-i3c: Balance PM runtime usage count on probe failure When DW_I3C_DISABLE_RUNTIME_PM_QUIRK is set, the probe function calls pm_runtime_get_noresume() to prevent runtime suspend. However, if i3c_master_register() fails, the error path does not balance this call, leaving the usage count incremented. Add pm_runtime_put_noidle() in the error cleanup path to properly balance the usage count. Fixes: fba0e56ee752 ("i3c: dw: Disable runtime PM on Agilex5 to avoid bus hang on IBI") Signed-off-by: Felix Gu Reviewed-by: Frank Li Link: https://patch.msgid.link/20260321-dw-i3c-1-v1-1-821623aac7bb@gmail.com Signed-off-by: Alexandre Belloni commit bef1eef667186cedb0bc6d152464acb3c97d5f72 Author: Felix Gu Date: Fri Mar 20 22:18:02 2026 +0800 i3c: master: dw-i3c: Fix missing reset assertion in remove() callback The reset line acquired during probe is currently left deasserted when the driver is unbound. Switch to devm_reset_control_get_optional_exclusive_deasserted() to ensure the reset is automatically re-asserted by the devres core when the driver is removed. Fixes: 62fe9d06f570 ("i3c: dw: Add power management support") Reviewed-by: Philipp Zabel Signed-off-by: Felix Gu Reviewed-by: Frank Li Link: https://patch.msgid.link/20260320-dw-i3c-v3-1-477040c2e3f5@gmail.com Signed-off-by: Alexandre Belloni commit e7a718627c6f75c8a75056ab09d6aa7ed305aaf8 Author: Adrian Hunter Date: Fri Mar 6 10:53:38 2026 +0200 i3c: mipi-i3c-hci-pci: Enable IBI while runtime suspended for Intel controllers Intel LPSS I3C controllers can wake from runtime suspend to receive in-band interrupts (IBIs), and they also implement the MIPI I3C HCI Multi-Bus Instance capability. When multiple I3C bus instances share the same PCI wakeup, the PCI parent must coordinate runtime PM so that all instances suspend together and their mipi-i3c-hci runtime suspend callbacks are invoked in a consistent manner. Enable IBI-based wakeup by setting HCI_QUIRK_RPM_IBI_ALLOWED for the intel-lpss-i3c platform device. Also set HCI_QUIRK_RPM_PARENT_MANAGED so that the mipi-i3c-hci core driver expects runtime PM to be controlled by the PCI parent rather than by individual instances. For all Intel HCI PCI configurations, enable the corresponding control_instance_pm flag in the PCI driver. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306085338.62955-6-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit e813e7e300863b6c5777792291a03e054115c551 Author: Adrian Hunter Date: Fri Mar 6 10:53:37 2026 +0200 i3c: mipi-i3c-hci-pci: Add optional ability to manage child runtime PM Some platforms implement the MIPI I3C HCI Multi-Bus Instance capability, where a single parent device hosts multiple I3C controller instances. In such designs, the parent - not the individual child instances - may need to coordinate runtime PM so that all controllers runtime PM callbacks are invoked in a controlled and synchronized manner. For example, if the parent enables IBI-wakeup when transitioning into a low-power state, every bus instance must remain able to receive IBIs up until that point. This requires deferring the individual controllers' runtime suspend callbacks (which disable bus activity) until the parent decides it is safe for all instances to suspend together. To support this usage model: * Add runtime PM and system PM callbacks in the PCI driver to invoke the mipi-i3c-hci driver's runtime PM callbacks for each instance. * Introduce a driver-data flag, control_instance_pm, which opts into the new parent-managed PM behaviour. * Ensure the callbacks are only used when the corresponding instance is operational at suspend time. This is reliable because the operational state cannot change while the parent device is undergoing a PM transition, and PCI always performs a runtime resume before system suspend on current configurations, so that suspend and resume alternate irrespective of whether it is runtime or system PM. By that means, parent-managed runtime PM coordination for multi-instance MIPI I3C HCI PCI devices is provided without altering existing behaviour on platforms that do not require it. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306085338.62955-5-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 82851828a8b19b207d9e547c759ee1195f8cd140 Author: Adrian Hunter Date: Fri Mar 6 10:53:36 2026 +0200 i3c: mipi-i3c-hci: Allow parent to manage runtime PM Some platforms implement the MIPI I3C HCI Multi-Bus Instance capability, where a single parent device hosts multiple I3C controller instances. In such designs, the parent - not the individual child instances - may need to coordinate runtime PM so that all controllers runtime PM callbacks are invoked in a controlled and synchronized manner. For example, if the parent enables IBI-wakeup when transitioning into a low-power state, every bus instance must remain able to receive IBIs up until that point. This requires deferring the individual controllers' runtime suspend callbacks (which disable bus activity) until the parent decides it is safe for all instances to suspend together. To support this usage model: * Export the low-level runtime PM suspend and resume helpers so that the parent can explicitly invoke them. * Add a new quirk, HCI_QUIRK_RPM_PARENT_MANAGED, allowing platforms to bypass per-instance runtime PM callbacks and delegate control to the parent device. * Move DEFAULT_AUTOSUSPEND_DELAY_MS into the header so it can be shared by parent-managed PM implementations. The new quirk allows platforms with multi-bus parent-managed PM infrastructure to correctly coordinate runtime PM across all I3C HCI instances. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306085338.62955-4-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 5fe77a6d8d5d89a250e277edf13ec73331b827ba Author: Adrian Hunter Date: Fri Mar 6 10:53:35 2026 +0200 i3c: mipi-i3c-hci: Add quirk to allow IBI while runtime suspended Some I3C controllers can be automatically runtime-resumed in order to handle in-band interrupts (IBIs), meaning that runtime suspend does not need to be blocked when IBIs are enabled. For example, a PCI-attached controller in a low-power state may generate a Power Management Event (PME) when the SDA line is pulled low to signal the START condition of an IBI. The PCI subsystem will then runtime-resume the device, allowing the IBI to be received without requiring the controller to remain active. Introduce a new quirk, HCI_QUIRK_RPM_IBI_ALLOWED, so that drivers can opt-in to this capability via driver data. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306085338.62955-3-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 815b4448198fba89036706d80bc7f2ba212a5a56 Author: Adrian Hunter Date: Fri Mar 6 10:53:34 2026 +0200 i3c: mipi-i3c-hci-pci: Set d3hot_delay to 0 for Intel controllers Set d3hot_delay to 0 for Intel controllers because a delay is not needed. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306085338.62955-2-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit acfcdff920dcab2b71536f04684e92c7933f7f40 Author: haoyu.lu Date: Tue Mar 17 11:40:15 2026 +0800 i3c: fix missing newline in dev_err messages Add missing newline to dev_err messages in: - drivers/i3c/master.c - drivers/i3c/master/svc-i3c-master.c Signed-off-by: haoyu.lu Reviewed-by: Frank Li Reviewed-by: Miquel Raynal Link: https://patch.msgid.link/20260317034015.638-1-hechushiguitu666@gmail.com Signed-off-by: Alexandre Belloni commit 7f53c556c207600a9cd26798687f2df1c1c1dce2 Author: Rosen Penev Date: Wed Mar 11 17:15:34 2026 -0700 i3c: master: use kzalloc_flex Simplifies allocations by using a flexible array member in this struct. Add __counted_by to get extra runtime analysis. Signed-off-by: Rosen Penev Reviewed-by: Frank Li Link: https://patch.msgid.link/20260312001534.24423-1-rosenp@gmail.com Signed-off-by: Alexandre Belloni commit eaa1d092a4f304415b867b7b74ed74b8f8722b0b Author: Adrian Hunter Date: Mon Mar 9 09:50:45 2026 +0200 i3c: mipi-i3c-hci-pci: Add support for Intel Nova Lake-H I3C Add I3C controller PCI IDs for Intel Nova Lake-H. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260309075045.52344-1-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 8ea0b60bc00d86b5ce33837487f4d16ae212f70a Author: David Nyström Date: Thu Feb 19 21:58:03 2026 +0100 i3c: master: Add sysfs option to rescan bus via entdaa Allow userspace to request dynamic address assignment, which is useful for i3cdev devices with broken hot-join support. This will assign dynamic addresses to all devices on the I3C bus which are currently unassigned. Signed-off-by: David Nyström Reviewed-by: Frank Li Reviewed-by: Meagan Lloyd Link: https://patch.msgid.link/20260219-i3c_rescan-v6-1-b81d6cc3cb30@est.tech Signed-off-by: Alexandre Belloni commit 335c21a2bb47585fdeb87c169d91f09b399c1d3d Author: Randy Dunlap Date: Sun Feb 15 22:17:55 2026 -0800 i3c: master: svc: spelling corrections Correct spelling for 3 words as identified by codespell: svc-i3c-master.c:340: tigger ==> trigger svc-i3c-master.c:532: reamins ==> remains svc-i3c-master.c:734: filetered ==> filtered Signed-off-by: Randy Dunlap Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Reviewed-by: Miquel Raynal Link: https://patch.msgid.link/20260216061755.2801697-1-rdunlap@infradead.org Signed-off-by: Alexandre Belloni commit fb447217c59a13b2fff22d94de2498c185cd9032 Author: Andy Shevchenko Date: Thu Feb 19 15:15:32 2026 +0100 hwmon: (ina233) Don't check for specific errors when parsing properties Instead of checking for the specific error codes (that can be considered a layering violation to some extent) check for the property existence first and then either parse it, or apply a default value. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20260219141532.2259642-1-andriy.shevchenko@linux.intel.com Signed-off-by: Guenter Roeck commit 77353904e1847ae51b7e1df14dd73c661ff799a4 Author: Andy Shevchenko Date: Thu Feb 19 15:05:32 2026 +0100 hwmon: (isl28022) Don't check for specific errors when parsing properties Instead of checking for the specific error codes (that can be considered a layering violation to some extent) check for the property existence first and then either parse it, or apply a default value. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20260219140532.2259235-1-andriy.shevchenko@linux.intel.com Signed-off-by: Guenter Roeck commit a69ae329d425df7e0638903ca74abea615cafc7d Author: Andy Shevchenko Date: Thu Feb 19 15:19:36 2026 +0100 hwmon: (pmbus/tps25990) Don't check for specific errors when parsing properties Instead of checking for the specific error codes (that can be considered a layering violation to some extent) check for the property existence first and then either parse it, or apply a default value. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20260219141936.2259945-1-andriy.shevchenko@linux.intel.com Signed-off-by: Guenter Roeck commit ff708b549c4dbecb308fa97e360a8fe0b2f89309 Author: Petr Klotz Date: Sun Apr 12 00:17:27 2026 +0000 hwmon: (nct6683) Add customer ID for ASRock B650I Lightning WiFi The ASRock B650I Lightning WiFi motherboard uses an NCT6686D chip with a customer ID of 0x1633. Without this ID, the nct6683 driver fails to recognize the hardware on this board, preventing hardware monitoring from working. Add NCT6683_CUSTOMER_ID_ASROCK6 (0x1633) to the list of supported customer IDs and update the probe function to handle it Signed-off-by: Petr Klotz Link: https://lore.kernel.org/r/20260412000911.9063-2-pklotz0@protonmail.com Signed-off-by: Guenter Roeck commit 8879a3c110cb8ca5a69c937643f226697aa551d9 Author: Thorsten Blum Date: Sun Apr 5 21:49:41 2026 +0200 crypto: af_alg - use sock_kmemdup in alg_setkey_by_key_serial Replace sock_kmalloc() followed by memcpy() with sock_kmemdup() to simplify alg_setkey_by_key_serial(). Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit c697c5fcfb5e73c723ca7d9f003e37b2b9534520 Author: Thorsten Blum Date: Sat Apr 4 15:52:03 2026 +0200 crypto: vmx - remove CRYPTO_DEV_VMX from Kconfig CRYPTO_DEV_VMX has been moved to arch/powerpc/crypto/Kconfig, remove it. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 809c9b60cf03e083b1ae0c6aa4a369b2eeda9900 Author: Thorsten Blum Date: Sat Apr 4 12:10:17 2026 +0200 crypto: omap - convert reqctx buffer to fixed-size array The flexible array member 'buffer' in 'omap_sham_reqctx' is always allocated with BUFLEN bytes. Replace the flexible array with a fixed-size array and remove the now-redundant 'buflen' field. Since 'struct omap_sham_reqctx' now includes the buffer, simplify 'reqsize' and 'statesize' and use an offsetof-based memcpy() in omap_sham_export() and omap_sham_import(). Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit a883b38a6f616a84d75213705c64d96c37536d74 Author: Thorsten Blum Date: Fri Apr 3 13:21:39 2026 +0200 crypto: atmel-sha204a - add Thorsten Blum as maintainer Add a MAINTAINERS entry for the atmel-sha204a driver and Thorsten Blum as maintainer. Signed-off-by: Thorsten Blum Acked-by: Nicolas Ferre Signed-off-by: Herbert Xu commit 93d93d91d3f2c9c54fdbccc69596bd1f20ae2ca8 Author: Thorsten Blum Date: Fri Apr 3 13:21:37 2026 +0200 crypto: atmel-ecc - add Thorsten Blum as maintainer Add Thorsten Blum as maintainer of the atmel-ecc driver. Signed-off-by: Thorsten Blum Acked-by: Nicolas Ferre Signed-off-by: Herbert Xu commit 95aed2af87ec43fa7624cc81dd13d37824ad4972 Author: Giovanni Cabiddu Date: Wed Apr 1 10:31:11 2026 +0100 crypto: qat - fix IRQ cleanup on 6xxx probe failure When adf_dev_up() partially completes and then fails, the IRQ handlers registered during adf_isr_resource_alloc() are not detached before the MSI-X vectors are released. Since the device is enabled with pcim_enable_device(), calling pci_alloc_irq_vectors() internally registers pcim_msi_release() as a devres action. On probe failure, devres runs pcim_msi_release() which calls pci_free_irq_vectors(), tearing down the MSI-X vectors while IRQ handlers (for example 'qat0-bundle0') are still attached. This causes remove_proc_entry() warnings: [ 22.163964] remove_proc_entry: removing non-empty directory 'irq/143', leaking at least 'qat0-bundle0' Moving the devm_add_action_or_reset() before adf_dev_up() does not solve the problem since devres runs in LIFO order and pcim_msi_release(), registered later inside adf_dev_up(), would still fire before adf_device_down(). Fix by calling adf_dev_down() explicitly when adf_dev_up() fails, to properly free IRQ handlers before devres releases the MSI-X vectors. Fixes: 17fd7514ae68 ("crypto: qat - add qat_6xxx driver") Cc: stable@vger.kernel.org Signed-off-by: Giovanni Cabiddu Reviewed-by: Ahsan Atta Reviewed-by: Laurent M Coquerel Signed-off-by: Herbert Xu commit 2418431211d5d348245a79b41cf0cb89bcadc27b Author: Herbert Xu Date: Tue Mar 31 17:36:29 2026 +0900 crypto: geniv - Remove unused spinlock from struct aead_geniv_ctx The spin lock in geniv hasn't been used in over 10 years. Remove it. Signed-off-by: Herbert Xu commit 3787fb7697a942baa25361bfc3390575e5659db8 Author: Thorsten Blum Date: Mon Mar 30 19:39:25 2026 +0200 crypto: qce - simplify qce_xts_swapiv() Declare 'swap' as zero-initialized and use a single index variable to simplify the byte-swapping loop in qce_xts_swapiv(). Add a comment for clarity. Signed-off-by: Thorsten Blum Reviewed-by: Bjorn Andersson Signed-off-by: Herbert Xu commit 1ee57ab93b75eb59f426aef37b5498a7ffc28278 Author: Thomas Fourier Date: Mon Mar 30 17:19:32 2026 +0200 crypto: hisilicon - Fix dma_unmap_single() direction The direction used to map the buffer skreq->iv is DMA_TO_DEVICE but it is unmapped with direction DMA_BIDIRECTIONAL in the error path. Change the unmap to match the mapping. Fixes: 915e4e8413da ("crypto: hisilicon - SEC security accelerator driver") Cc: Signed-off-by: Thomas Fourier Reviewed-by: Thorsten Blum Signed-off-by: Herbert Xu commit a1b80018b8cec27fc06a8b04a7f8b5f6cfe86eae Author: Paul Louvel Date: Mon Mar 30 12:28:19 2026 +0200 crypto: talitos - rename first/last to first_desc/last_desc Previous commit introduces a new last_request variable in the context structure. Renaming the first/last existing member variable in the context structure to improve readability. Cc: stable@vger.kernel.org Signed-off-by: Paul Louvel Signed-off-by: Herbert Xu commit 655ef638a2bc3cd0a9eff99a02f83cab94a3a917 Author: Paul Louvel Date: Mon Mar 30 12:28:18 2026 +0200 crypto: talitos - fix SEC1 32k ahash request limitation Since commit c662b043cdca ("crypto: af_alg/hash: Support MSG_SPLICE_PAGES"), the crypto core may pass large scatterlists spanning multiple pages to drivers supporting ahash operations. As a result, a driver can now receive large ahash requests. The SEC1 engine has a limitation where a single descriptor cannot process more than 32k of data. The current implementation attempts to handle the entire request within a single descriptor, which leads to failures raised by the driver: "length exceeds h/w max limit" Address this limitation by splitting large ahash requests into multiple descriptors, each respecting the 32k hardware limit. This allows processing arbitrarily large requests. Cc: stable@vger.kernel.org Fixes: c662b043cdca ("crypto: af_alg/hash: Support MSG_SPLICE_PAGES") Signed-off-by: Paul Louvel Signed-off-by: Herbert Xu commit 01d798e9feb30212952d4e992801ba6bd6a82351 Author: Haixin Xu Date: Mon Mar 30 15:23:46 2026 +0800 crypto: jitterentropy - replace long-held spinlock with mutex jent_kcapi_random() serializes the shared jitterentropy state, but it currently holds a spinlock across the jent_read_entropy() call. That path performs expensive jitter collection and SHA3 conditioning, so parallel readers can trigger stalls as contending waiters spin for the same lock. To prevent non-preemptible lock hold, replace rng->jent_lock with a mutex so contended readers sleep instead of spinning on a shared lock held across expensive entropy generation. Fixes: bb5530e40824 ("crypto: jitterentropy - add jitterentropy RNG") Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Haixin Xu Reviewed-by: Stephan Mueller Signed-off-by: Herbert Xu commit 06c42142cf8aaeba3fa3c4336717b87ca4eebf8a Author: Chenghai Huang Date: Mon Mar 30 14:25:31 2026 +0800 crypto: hisilicon - remove unused and non-public APIs for qm and sec - sec_register_to_crypto() and sec_unregister_from_crypto() have been removed, the function declarations have not been removed. Remove them. - hisi_qm_start_qp and hisi_qm_stop_qp are called internally by the QM. Therefore, the EXPORT_SYMBOL_GPL declaration of these non-public interfaces is deleted. Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit d2b5e8d3193df4e2795f405e1757d6384124330a Author: Chenghai Huang Date: Mon Mar 30 14:25:30 2026 +0800 crypto: hisilicon/qm - drop redundant variable initialization Variables are assigned before used. Initialization is not required. Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 6e7619dc6a243f972aabc22c349e1f6b371fbd24 Author: Chenghai Huang Date: Mon Mar 30 14:25:29 2026 +0800 crypto: hisilicon/qm - remove else after return Else condition is not needed after a return, remove it. Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit ff34953026dd38dd62d28847c34670f20cbea37a Author: Chenghai Huang Date: Mon Mar 30 14:25:28 2026 +0800 crypto: hisilicon/qm - add const qualifier to info_name in struct qm_cmd_dump_item The "info_name" is never changed in struct qm_cmd_dump_item, make it const. Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit f94f6cff1dcf9296879c7242dda8171320188ed7 Author: Zhushuai Yin Date: Mon Mar 30 14:25:27 2026 +0800 crypto: hisilicon - fix the format string type error 1. The return value val of sec_debugfs_atomic64_get is of the u64 type, but %lld instead of %llu is used in DEFINE_DEBUGFS_ATTRIBUTE. Fix it. 2. In debugfs.c, since the types of q_depth and xeq_depth are u16, the results of q_depth - 1 and xeq_depth - 1 are int rather than u16. Use %d for int. Signed-off-by: Zhushuai Yin Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 02c64052fad03699b9c6d1df2f9b444d17e4ac50 Author: Haoxiang Li Date: Mon Mar 30 11:34:02 2026 +0800 crypto: ccree - fix a memory leak in cc_mac_digest() Add cc_unmap_result() if cc_map_hash_request_final() fails to prevent potential memory leak. Fixes: 63893811b0fc ("crypto: ccree - add ahash support") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Signed-off-by: Herbert Xu commit 713e0f011178a2896e46db3244093454708066e2 Author: Cássio Gabriel Date: Sat Apr 11 15:14:41 2026 -0300 ALSA: sscape: Add suspend and resume support The SoundScape ISA driver has lacked suspend and resume callbacks since commit 277e926c9b27 ("[ALSA] sscape - Use platform_device"). A plain snd_wss resume is not sufficient for SoundScape. Resume also needs to restore the board-specific gate-array routing, and non-VIVO boards need to reinitialize the probe-time MIDI firmware and MIDI control state when the MPU-401 side was enabled during probe. That firmware reload can be handled in-kernel because commit acd47100914b ("ALSA: sscape: convert to firmware loader framework") moved the driver to request_firmware(). Add ISA and ISA-PnP PM callbacks, reconfigure the board on resume, reload the non-VIVO MIDI firmware, restore the MIDI state, and then resume the WSS codec. If MIDI firmware reload fails, keep the WSS resume path alive and leave MIDI unavailable instead of failing the whole device resume. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260411-alsa-sscape-pm-v2-2-aeb5682e14b0@gmail.com Signed-off-by: Takashi Iwai commit f312f8b5988003a10d662904c58c8c6bc036782b Author: Cássio Gabriel Date: Sat Apr 11 15:14:40 2026 -0300 ALSA: sscape: Cache per-card resources for board reinitialization The SoundScape driver programs the gate-array directly from the global resource arrays during probe. That is sufficient for initial bring-up, but a PM resume path also needs the resolved per-card IRQ, DMA, MPU IRQ and joystick settings after probe has finished. Store the resolved resources in struct soundscape and move the board setup into a reusable helper. Also factor the MIDI state programming so the same sequence can be reused by a later PM resume path. This is preparatory work for suspend/resume support and is not intended to change runtime behaviour. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260411-alsa-sscape-pm-v2-1-aeb5682e14b0@gmail.com Signed-off-by: Takashi Iwai commit 1603cbb64173a0e9fa7500f2a686f4aa011c58b9 Author: Brian Masney Date: Mon Mar 30 10:32:37 2026 -0400 clk: visconti: pll: initialize clk_init_data to zero Sashiko reported the following: > The struct clk_init_data init is declared on the stack without being > fully zero-initialized. While fields like name, flags, parent_names, > num_parents, and ops are explicitly assigned, the parent_data and > parent_hws fields are left containing stack garbage. clk_core_populate_parent_map() currently prefers the parent names over the parent data and hws, so this isn't a problem at the moment. If that ordering ever changed in the future, then this could lead to some unexpected crashes. Let's just go ahead and make sure that the struct clk_init_data is initialized to zero as a good practice. Fixes: b4cbe606dc367 ("clk: visconti: Add support common clock driver and reset driver") Link: https://sashiko.dev/#/patchset/20260326042317.122536-1-rosenp%40gmail.com Signed-off-by: Brian Masney Reviewed-by: Benoît Monin Reviewed-by: Nobuhiro Iwamatsu Signed-off-by: Stephen Boyd commit 2ec74a053611edf77259ecdef1d94be181dd1dd6 Author: Alexei Starovoitov Date: Sat Apr 11 16:00:01 2026 -0700 bpf: Simplify do_check_insn() Move env->insn_idx++ to the caller, so that most of check_*() calls in do_check_insn() tail call into the next helper. Link: https://lore.kernel.org/r/20260411230001.71664-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 6358c883179e3f89085bf2de625e1bbf15dfe8b0 Author: Marek Vasut Date: Thu Apr 9 02:29:06 2026 +0200 clk: fsl-sai: Add MCLK generation support The driver currently supports generating BCLK. There are systems which require generation of MCLK instead. Register new MCLK clock and handle clock-cells = <1> to differentiate between BCLK and MCLK. In case of a legacy system with clock-cells = <0>, the driver behaves as before, i.e. always returns BCLK. Note that it is not possible re-use the current SAI audio driver to generate MCLK and correctly enable and disable the MCLK. If SAI (audio driver) is used to control the MCLK enablement, then MCLK clock is not always enabled, and it is not necessarily enabled when the codec may need the clock to be enabled. There is also no way for the codec node to specify phandle to clock provider in DT, because the SAI (audio driver) is not clock provider. If SAI (clock driver) is used to control the MCLK enablement, then MCLK clock is enabled when the codec needs the clock enabled, because the codec is the clock consumer and the SAI (clock driver) is the clock provider, and the codec driver can request the clock to be enabled when needed. There is also the usual phandle to clock provider in DT, because the SAI (clock driver) is clock provider. Acked-by: Michael Walle Signed-off-by: Marek Vasut Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 32b0c7aac1a2d17373b38fcfd4d5f352281892f7 Author: Marek Vasut Date: Thu Apr 9 02:29:05 2026 +0200 clk: fsl-sai: Extract clock setup into fsl_sai_clk_register() Create helper function fsl_sai_clk_register() to set up and register SAI clock. Rename BCLK specific struct fsl_sai_clk members with bclk_ prefix. Use of_node_full_name(dev->of_node) and clock name to register uniquely named clock. This is done in preparation for the follow up patch, which adds MCLK support. Signed-off-by: Marek Vasut Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit f293f885c4b2f0aa7a9c405c807dff60ec9905f5 Author: Marek Vasut Date: Thu Apr 9 02:29:04 2026 +0200 dt-bindings: clock: fsl-sai: Document clock-cells = <1> support The driver now supports generation of both BCLK and MCLK, document support for #clock-cells = <0> for legacy case and #clock-cells = <1> for the new case which can differentiate between BCLK and MCLK. Acked-by: Conor Dooley Signed-off-by: Marek Vasut Signed-off-by: Stephen Boyd commit c206085b2678840df7f99018cac048a4f7b21d8a Author: Marek Vasut Date: Thu Apr 9 02:29:03 2026 +0200 clk: fsl-sai: Add i.MX8M support with 8 byte register offset The i.MX8M/Mini/Nano/Plus variant of the SAI IP has control registers shifted by +8 bytes and requires additional bus clock. Add support for the i.MX8M variant of the IP with this register shift and additional clock. Reviewed-by: Brian Masney Reviewed-by: Peng Fan Signed-off-by: Marek Vasut Signed-off-by: Stephen Boyd commit d0a4d582140b1dcc28848d2f66e18f2346123bc3 Author: Marek Vasut Date: Thu Apr 9 02:29:02 2026 +0200 clk: fsl-sai: Sort the headers Sort the headers. No functional change. Reviewed-by: Brian Masney Signed-off-by: Marek Vasut Signed-off-by: Stephen Boyd commit 29e64a37088da2f61524263f0c3ebc9cc15b36ae Author: Marek Vasut Date: Thu Apr 9 02:29:01 2026 +0200 dt-bindings: clock: fsl-sai: Document i.MX8M support The i.MX8M/Mini/Nano/Plus variant of the SAI IP has control registers shifted by +8 bytes and requires additional bus clock. Document support for the i.MX8M variant of the IP with this register shift and additional clock. Update the description slightly. Acked-by: Conor Dooley Signed-off-by: Marek Vasut Signed-off-by: Stephen Boyd commit 7b6894e99f835a0fe0690ad801c4f7f0a06a4b07 Merge: c369299895a591 d4851759742c13 Author: Stephen Boyd Date: Sat Apr 11 16:36:44 2026 -0700 Merge tag 'clk-remove-deprecated-apis-v7.1' of ssh://github.com/masneyb/linux into clk-round Pull round_rate refactoring from Brian Masney: Now that all of the dependencies across the tree have been merged into Linus's tree, here's a small series with the following changes: - Converts clk-composite from round_rate() to determine_rate() - Removes the round_rate() clk op - Removes the deprecated functions divider_round_rate(), divider_round_rate_parent(), and divider_ro_round_rate_parent() since these are just wrappers for the corresponding determine_rate variant * tag 'clk-remove-deprecated-apis-v7.1' of ssh://github.com/masneyb/linux: clk: divider: remove divider_round_rate() and divider_round_rate_parent() clk: divider: remove divider_ro_round_rate_parent() clk: remove round_rate() clk ops clk: composite: convert from round_rate() to determine_rate() clk: test: remove references to clk_ops.round_rate commit 1db4d0edc927125a3fb981725fbf47868ab10d57 Merge: c369299895a591 a4f780cd5c7aa8 Author: Stephen Boyd Date: Sat Apr 11 16:27:36 2026 -0700 Merge tag 'qcom-clk-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clock driver updates from Bjorn Andersson: - Global TCSR, RPMh, and display clock controller support for the Qualcomm Eliza platform - TCSR, the multiple global, and the RPMh clock controller support for the Qualcomm Nord platform - GPU clock controller support for Qualcomm SM8750 - Video and GPU clock controller support for Qualcomm Glymur - Global clock controller support for Qualcomm IPQ5210 - Introduce various smaller display-related fixes across Qualcomm Kaanapali, Milos, SC8280XP, SM4450, SM8250, and SA8775P. - Add missing GDSCs and fix retention flags for PCIe and USB power domains on SC8180X. - Enable runtime PM support to ensure performance votes are propagated to CX on Qualcomm platforms. - Mark the USB QTB clock as always-on on Qualcomm Hamoa, in order to ensure the SMMU can work even when USB controller device is sleeping. - Qualcomm IPQ6018 and IPQ8074 support in the IPQ CMN PLL driver - MDSS resets for Qualcomm SC7180, SM6115, and SM6125, to allow display subsystem driver to reset the hardware from the state left by the bootloader. * tag 'qcom-clk-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (67 commits) clk: qcom: gcc: Add multiple global clock controller driver for Nord SoC clk: qcom: rpmh: Add support for Nord rpmh clocks clk: qcom: Add TCSR clock driver for Nord SoC dt-bindings: clock: qcom: Add Nord Global Clock Controller dt-bindings: clock: qcom-rpmhcc: Add support for Nord SoCs dt-bindings: clock: qcom: Document the Nord SoC TCSR Clock Controller clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON clk: qcom: Constify list of critical CBCR registers clk: qcom: Constify qcom_cc_driver_data clk: qcom: videocc-glymur: Constify qcom_cc_desc clk: qcom: Add a driver for SM8750 GPU clocks dt-bindings: clock: qcom: Add SM8750 GPU clocks clk: qcom: ipq-cmn-pll: Add IPQ8074 SoC support dt-bindings: clock: qcom: Add CMN PLL support for IPQ8074 clk: qcom: ipq-cmn-pll: Add IPQ6018 SoC support dt-bindings: clock: qcom: Add CMN PLL support for IPQ6018 clk: qcom: gdsc: Fix error path on registration of multiple pm subdomains dt-bindings: clock: qcom: Add missing power-domains property clk: qcom: gcc-eliza: Enable FORCE_MEM_CORE_ON for UFS AXI PHY clock clk: qcom: dispcc-sc7180: Add missing MDSS resets ... commit 42ca4f0c9444bea688c2f4797b00cea0b3f842d9 Merge: c369299895a591 e57c36bc1a3e45 Author: Stephen Boyd Date: Sat Apr 11 16:24:53 2026 -0700 Merge tag 'samsung-clk-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-samsung Pull Samsung SoC clock driver updates from Krzysztof Kozlowski: - Axis ARTPEC-9: Add new PLL clocks and new drivers for eight clock controllers on the SoC - ExynosAutov920: Add G3D (GPU) clock controller - Exynos850: Define missing clock for the APM mailbox * tag 'samsung-clk-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: clk: samsung: exynos850: Add APM-to-AP mailbox clock dt-bindings: clock: exynos850: Add APM_AP MAILBOX clock clk: samsung: Use %pe format to simplify clk: samsung: pll: Fix possible truncation in a9fraco recalc rate clk: samsung: exynosautov920: add block G3D clock support dt-bindings: clock: exynosautov920: add G3D clock definitions clk: samsung: gs101: harmonise symbol names (clock arrays) clk: samsung: artpec-9: Add initial clock support for ARTPEC-9 SoC clk: samsung: Add clock PLL support for ARTPEC-9 SoC dt-bindings: clock: Add ARTPEC-9 clock controller commit 887f655eab23abd612162491877569c7f6d46f25 Merge: c369299895a591 fb20ccf70cf695 Author: Stephen Boyd Date: Sat Apr 11 16:23:48 2026 -0700 Merge tag 'sunxi-clk-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-allwinner Pull Allwinner clk driver updates from Chen-Yu Tsai: Just one change for this cycle, implementing support for the r-spi module clock in the A523 PRCM block, which was somehow missing during the initial bring-up. * tag 'sunxi-clk-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: sun55i-a523-r: Add missing r-spi module clock commit cc8f74d3011e029a29378dc5de4071e38269eb26 Merge: ce56ffbea7a581 141af1be817c42 Author: Stephen Boyd Date: Sat Apr 11 16:22:21 2026 -0700 Merge tag 'qcom-clk-fixes-for-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-fixes Pull a Qualcomm clk driver fix from Bjorn Andersson - Fix the clock ops for SM8450 DPTX1 aux clock src to ensure DisplayPort works * tag 'qcom-clk-fixes-for-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source commit ce56ffbea7a58134e80b3a01356310d89ce0427c Merge: 3de1320ae99adf 54e97360b44bed Author: Stephen Boyd Date: Sat Apr 11 16:19:57 2026 -0700 Merge tag 'spacemit-clk-fixes-for-7.0-1' of ssh://github.com/spacemit-com/linux into clk-fixes Pull a SpacemiT clk fix from Yixun Lan: - Fix inverted condition check * tag 'spacemit-clk-fixes-for-7.0-1' of ssh://github.com/spacemit-com/linux: clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc() commit 3de1320ae99adf0c6d606b5a8f0ea4d65d5152bd Merge: c369299895a591 2f7ae8ab6aa73d Author: Stephen Boyd Date: Sat Apr 11 16:18:18 2026 -0700 Merge tag 'clk-microchip-fixes-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-fixes Pull a microchip clk driver fix from Claudiu Beznea: - Fix out of bounds access for MPFS CCC clock controller * tag 'clk-microchip-fixes-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: clk: microchip: mpfs-ccc: fix out of bounds access during output registration commit 6e42454d90fa4ef88ea9a52559bde9a00683c14c Merge: c369299895a591 d16f57caa78776 Author: Stephen Boyd Date: Sat Apr 11 16:16:10 2026 -0700 Merge tag 'clk-imx-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux into clk-imx Pull i.MX clock driver updates from Abel Vesa: - Add optional ENET reference pad clock inputs for i.MX6Q/UL - Fix debug output in PLL14xx driver to use unsigned format specifier - Add 333.333 MHz and 477.4 MHz support to fracn-gppll for display use cases - Fix device node reference leaks in i.MX6 driver - Fix device node reference leak in of_assigned_ldb_sels() - Fix ACM clock flags on i.MX8 to prevent SAI sysclk failures - Move VF610_CLK_END define into the driver - Add VF610 Ethernet switch clock support - Correct CSI PHY parent clock selection on i.MX8MQ * tag 'clk-imx-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux: clk: imx8mq: Correct the CSI PHY sels clk: vf610: Add support for the Ethernet switch clocks dt-bindings: clock: vf610: Add definitions for MTIP L2 switch dt-bindings: clock: vf610: Drop VF610_CLK_END define clk: vf610: Move VF610_CLK_END define to clk-vf610 driver clk: imx: imx8-acm: fix flags for acm clocks clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() clk: imx: fracn-gppll: Add 477.4MHz support clk: imx: fracn-gppll: Add 333.333333 MHz support clk: imx: pll14xx: Use unsigned format specifier dt-bindings: clock: imx6q[ul]-clock: add optional clock enet[1]_ref_pad commit 0fc42d26467f2b3321aa3cc57f97350e1e04ecb9 Merge: c369299895a591 41b1a676095901 Author: Stephen Boyd Date: Sat Apr 11 16:14:15 2026 -0700 Merge tag 'v7.1-rockchip-clk1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull Rockchip clk driver updates from Heiko Stuebner: - Clock driver for the Rockchip RV1103B SoC For whatever reason that SoC only got a B addition to the name, but major changes internally - likely it is pin compatible with the non-b-variant. Other change is actually exporting PCIe pipe-clocks that were already in the binding. * tag 'v7.1-rockchip-clk1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: rk3568: Add PCIe pipe clock gates clk: rockchip: Add clock controller for the RV1103B dt-bindings: clock: rockchip: Add RV1103B CRU support commit 98266d5f940a257d41661bef075057816589040f Merge: 96df81372d0f4e 77894661c00ab9 Author: Stephen Boyd Date: Sat Apr 11 16:03:44 2026 -0700 Merge tag 'renesas-clk-for-v7.1-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull more Renesas clk driver updates from Geert Uytterhoeven: - Add SPI clocks and resets on Renesas RZ/G3E - Add PCIe clocks and resets on Renesas RZ/V2N, RZ/V2H(P), and RZ/G3E - Enable watchdog reset on Renesas RZ/N1D - Remove clocks for watchdogs meant for other CPU cores on Renesas RZ/V2N - Handle critical clock during system resume on Renesas RZ/G2L, RZ/G2UL, and RZ/G3S - Add initial support for the Renesas RZ/G3L (R9A08G046) SoC * tag 'renesas-clk-for-v7.1-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: Add support for RZ/G3L SoC dt-bindings: clock: renesas,rzg2l-cpg: Document RZ/G3L SoC clk: renesas: rzg2l: Re-enable critical module clocks during resume clk: renesas: rzg2l: Add rzg2l_mod_clock_init_mstop_helper() clk: renesas: rzg2l: Add helper for mod clock enable/disable clk: renesas: r9a0{7g04[34],8g045}: Add critical reset entries clk: renesas: rzg2l: Add support for critical resets clk: renesas: r9a09g056: Remove entries for WDT{0,2,3} clk: renesas: r9a06g032: Enable watchdog reset sources clk: renesas: cpg-mssr: Use struct_size() helper clk: renesas: r9a09g047: Add PCIe clocks and reset clk: renesas: r9a09g057: Add PCIe clocks and reset clk: renesas: r9a09g056: Add PCIe clocks and reset clk: renesas: r9a09g047: Add entries for the RSPIs commit 5aa81ab21de30b7b058202102f052289115298ef Merge: c369299895a591 23c8ebc952849b Author: Stephen Boyd Date: Sat Apr 11 15:55:13 2026 -0700 Merge tag 'tenstorrent-clk-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tenstorrent/linux into clk-tenstorrent Pull Tenstorrent clk driver updates from Drew Fustini: - Clock and reset controllers (e.g. PRCM) in the Tenstorrent Atlantis SoC * tag 'tenstorrent-clk-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tenstorrent/linux: clk: tenstorrent: Add Atlantis clock controller driver reset: tenstorrent: Add reset controller for Atlantis dt-bindings: clk: tenstorrent: Add tenstorrent,atlantis-prcm-rcpu commit ae3f8ca2ba505d62173bb2f6bf6f6edf951b909e Author: Alexei Starovoitov Date: Sat Apr 11 13:09:32 2026 -0700 bpf: Move checks for reserved fields out of the main pass Check reserved fields of each insn once in a prepass instead of repeatedly rechecking them during the main verifier pass. Link: https://lore.kernel.org/r/20260411200932.41797-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 57205e2dd962d2c0e2093cf9b06dad6ba7737844 Author: Alexei Starovoitov Date: Sat Apr 11 07:14:47 2026 -0700 bpf: Delete unused variable 'cnt' is set, but not used. Delete it. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604111401.eqzyF2kx-lkp@intel.com/ Fixes: 2c167d91775b ("bpf: change logging scheme for live stack analysis") Link: https://lore.kernel.org/r/20260411141447.45932-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 4b64e5244183c0dcffc077b840689e4c6c1f7b1f Merge: d6bae125f21f74 335a6ca0415850 Author: Alexei Starovoitov Date: Sat Apr 11 07:17:06 2026 -0700 Merge branch 'selftests-bpf-impose-global-ordering-for-test-decl_tags' Eduard Zingerman says: ==================== selftests/bpf: impose global ordering for test decl_tags Impose global ordering for all decl tags used by test_loader.c based tests: __success, __failure, __msg, etc. The tags are now sorted by testing framework to be processed in the same order they appear in the C source code of the test. The ordering is necessary for gcc-bpf. Neither GCC nor the C standard defines the order in which function attributes are consumed. While Clang tends to preserve tags definition order in the output BTF, GCC does not. This inconsistency causes BPF tests with multiple __msg entries to fail when compiled with GCC. This is based on a patch [1] from Cupertino Miranda (see patch #3) and includes some additional cleanups for test_loader.c decl tags declaration and processing (see patches #1, #2, #4). [1] https://lore.kernel.org/bpf/20260305130035.192080-1-cupertino.miranda@oracle.com/ Changelog: v2: https://lore.kernel.org/bpf/20260330-selftests-global-tags-ordering-v2-0-c0ac61e81098@gmail.com/ v2 -> v3: - fixed free(tmp) call in collect_decl_tags() (Puranjay, bot) - naming nit in compile_regex() (Mykyta) v1 -> v2: - refactoring str_has_pfx() usages missing from v1 (Puranjay) - removed realloc_or_free() (Andrii) - fixed qsort(NULL, ...) usage (Puranjay) - skip_decl_tag_pfx() returns NULL if tag does not start from "comment:" (Puranjay) v1: https://lore.kernel.org/bpf/20260326-selftests-global-tags-ordering-v1-0-5dd2ced5d9ad@gmail.com/ ==================== Link: https://patch.msgid.link/20260410-selftests-global-tags-ordering-v2-0-c566ec9781bf@gmail.com Signed-off-by: Alexei Starovoitov commit 335a6ca04158505b94afb7271488f5052c46f5e5 Author: Eduard Zingerman Date: Sat Apr 11 00:33:47 2026 -0700 selftests/bpf: inline TEST_TAG constants in test_loader.c After str_has_pfx() refactoring each TEST_TAG_* / TEST_BTF_PATH constant is used exactly once. Since constant definitions are not shared between BPF-side bpf_misc.h and userspace side test_loader.c, there is no need in the additional redirection layer. Acked-by: Ihor Solodrai Reviewed-by: Puranjay Mohan Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-selftests-global-tags-ordering-v2-4-c566ec9781bf@gmail.com Signed-off-by: Alexei Starovoitov commit 713db9fd0336e8fade7e776ab807c21fd8b7a0f1 Author: Eduard Zingerman Date: Sat Apr 11 00:33:46 2026 -0700 selftests/bpf: impose global ordering for test decl_tags Impose global ordering for all decl tags used by test_loader.c based tests (__success, __failure, __msg, etc): - change every tag to expand as __attribute__((btf_decl_tag("comment:" XSTR(__COUNTER__) ...))) - change parse_test_spec() to collect all decl tags before processing and sort them using strverscmp(). The ordering is necessary for gcc-bpf. Neither GCC nor the C standard defines the order in which function attributes are consumed. While Clang tends to preserve definition order, GCC may process them out of sequence. This inconsistency causes BPF tests with multiple __msg entries to fail when compiled with GCC. Signed-off-by: Cupertino Miranda Reviewed-by: Puranjay Mohan Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-selftests-global-tags-ordering-v2-3-c566ec9781bf@gmail.com Signed-off-by: Alexei Starovoitov commit 5160e584c3616e744252d0a571264f9745bc6e11 Author: Eduard Zingerman Date: Sat Apr 11 00:33:45 2026 -0700 selftests/bpf: make str_has_pfx return pointer past the prefix Change str_has_pfx() to return a pointer to the first character after the prefix, thus eliminating the repetitive (s + sizeof(PFX) - 1) patterns. Acked-by: Ihor Solodrai Acked-by: Mykyta Yatsenko Reviewed-by: Puranjay Mohan Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-selftests-global-tags-ordering-v2-2-c566ec9781bf@gmail.com Signed-off-by: Alexei Starovoitov commit cdd54fe98c00549264a92613af6bb0e9a5fd0d1c Author: Eduard Zingerman Date: Sat Apr 11 00:33:44 2026 -0700 selftests/bpf: fix __jited_unpriv tag name __jited_unpriv was using "test_jited=" as its tag name, same as the priv variant __jited. Fix by using "test_jited_unpriv=". Fixes: 7d743e4c759c ("selftests/bpf: __jited test tag to check disassembly after jit") Acked-by: Ihor Solodrai Reviewed-by: Puranjay Mohan Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-selftests-global-tags-ordering-v2-1-c566ec9781bf@gmail.com Signed-off-by: Alexei Starovoitov commit 9ce4a8c07b28cdd70f6ca38b60bf688c27dbbfb9 Author: Thomas Weißschuh Date: Fri Apr 3 18:31:02 2026 +0200 sysfs: attribute_group: Respect is_visible_const() when changing owner The call to grp->is_visible in sysfs_group_attrs_change_owner() was missed when support for is_visible_const() was added. Check for both is_visible variants there too. Fixes: 7dd9fdb4939b ("sysfs: attribute_group: enable const variants of is_visible()") Cc: stable@vger.kernel.org Reported-by: Michael Kelley Closes: https://lore.kernel.org/lkml/SN6PR02MB4157D5F04608E4E3C21AB56ED45EA@SN6PR02MB4157.namprd02.prod.outlook.com/ Link: https://sashiko.dev/#/patchset/20260403-sysfs-const-hv-v2-0-8932ab8d41db%40weissschuh.net Signed-off-by: Thomas Weißschuh Reviewed-by: Michael Kelley Link: https://patch.msgid.link/20260403-sysfs-is_visible_const-fix-v1-1-f87f26071d2c@weissschuh.net Signed-off-by: Danilo Krummrich commit 8f4c13c2674d37bcbbdfc47c28ce0ca1a40a6682 Author: Bartosz Golaszewski Date: Tue Apr 7 15:27:57 2026 +0200 software node: return -ENOTCONN when referenced swnode is not registered yet It's possible that at the time of resolving a reference to a remote software node, the node we know exists is not yet registered as a full firmware node. We currently return -ENOENT in this case but the same error code is also returned in some other cases, like the reference property with given name not existing in the property list of the local software node. It makes sense to let users know that we're dealing with an unregistered software node so that they can defer probe - the situation is somewhat similar to there existing a firmware node to which no device is bound yet - which is valid grounds for probe deferral. To that end: use -ENOTCONN to indicate the software node is "not connected". Acked-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260407-swnode-unreg-retcode-v4-1-1b2f0725eb9c@oss.qualcomm.com [ Drop software node backend specifics from fwnode_property_get_reference_args() documentation. - Danilo ] Signed-off-by: Danilo Krummrich commit bb6a85b4b652f8424b5a28c2c445ded41ded51d0 Author: Sebastian Andrzej Siewior Date: Wed Apr 1 13:02:32 2026 +0200 Documentation: Add managed interrupts I stumbled upon "isolcpus=managed_irq" which is the last piece which can only be handled by isolcpus= and has no runtime knob. I knew roughly what managed interrupts should do but I lacked some details how it is used and what the managed_irq sub parameter means in practise. This documents what we have as of today and how it works. I added some examples how the parameter affects the configuration. Did I miss something? Given that the spreading as computed group_cpus_evenly() does not take the mask of isolated CPUs into account I'm not sure how relevant the managed_irq argument is. The virtio_scsi driver has no way to limit the interrupts and I don't see this for the nvme. Even if the number of queues can be reduced to two (as in the example) it is still spread evenly in the system instead and the isolated CPUs are not taken into account. To make this worse, you can even argue further whether or not the application on the isolated CPU wants to receive the interrupt directly or would prefer not to. Given all this, I am not sure if it makes sense to add 'io_queue' to the mix or if it could be incorporated into 'managed_irq'. One more point: Given that isolcpus= is marked deprecated as of commit b0d40d2b22fe4 ("sched/isolation: Document isolcpus= boot parameter flags, mark it deprecated") and the 'managed_irq' is evaluated at device's probe time it would require additional callbacks to re-evaluate the situation. Probably for 'io_queue', too. Does is make sense or should we simply drop the "deprecation" notice and allowing using it long term? Dynamic partitions work with cpusets, there this (managed_irq) limitation but is it really? And if static partition is the use case why bother. Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Ming Lei Reviewed-by: Aaron Tomlin Acked-by: Thomas Gleixner Signed-off-by: Jonathan Corbet Message-ID: <20260401110232.ET5RxZfl@linutronix.de> commit 8602018b1f17fbdaa5e5d79f4c8603ad20640c12 Author: Sina Hassani Date: Fri Apr 10 11:32:44 2026 -0700 iommufd: Fix a race with concurrent allocation and unmap iopt_unmap_iova_range() releases the lock on iova_rwsem inside the loop body when getting to the more expensive unmap operations. This is fine on its own, except the loop condition is based on the first area that matches the unmap address range. If a concurrent call to map picks an area that was unmapped in previous iterations, the loop mistakenly tries to unmap it. This is reproducible by having one userspace thread map buffers and pass them to another thread that unmaps them. The problem manifests as EBUSY errors with single page mappings. Fix this by advancing the start pointer after unmapping an area. This ensures each iteration only examines the IOVA range that remains mapped, which is guaranteed not to have overlaps. Cc: stable@vger.kernel.org Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping") Link: https://patch.msgid.link/r/CAAJpGJSR4r_ds1JOjmkqHtsBPyxu8GntoeW08Sk5RNQPmgi+tg@mail.gmail.com Signed-off-by: Sina Hassani Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe commit a2225b6e834a838ae3c93709760edc0a169eb2f2 Author: Douglas Anderson Date: Mon Apr 6 16:22:54 2026 -0700 driver core: Don't let a device probe until it's ready The moment we link a "struct device" into the list of devices for the bus, it's possible probe can happen. This is because another thread can load the driver at any time and that can cause the device to probe. This has been seen in practice with a stack crawl that looks like this [1]: really_probe() __driver_probe_device() driver_probe_device() __driver_attach() bus_for_each_dev() driver_attach() bus_add_driver() driver_register() __platform_driver_register() init_module() [some module] do_one_initcall() do_init_module() load_module() __arm64_sys_finit_module() invoke_syscall() As a result of the above, it was seen that device_links_driver_bound() could be called for the device before "dev->fwnode->dev" was assigned. This prevented __fw_devlink_pickup_dangling_consumers() from being called which meant that other devices waiting on our driver's sub-nodes were stuck deferring forever. It's believed that this problem is showing up suddenly for two reasons: 1. Android has recently (last ~1 year) implemented an optimization to the order it loads modules [2]. When devices opt-in to this faster loading, modules are loaded one-after-the-other very quickly. This is unlike how other distributions do it. The reproduction of this problem has only been seen on devices that opt-in to Android's "parallel module loading". 2. Android devices typically opt-in to fw_devlink, and the most noticeable issue is the NULL "dev->fwnode->dev" in device_links_driver_bound(). fw_devlink is somewhat new code and also not in use by all Linux devices. Even though the specific symptom where "dev->fwnode->dev" wasn't assigned could be fixed by moving that assignment higher in device_add(), other parts of device_add() (like the call to device_pm_add()) are also important to run before probe. Only moving the "dev->fwnode->dev" assignment would likely fix the current symptoms but lead to difficult-to-debug problems in the future. Fix the problem by preventing probe until device_add() has run far enough that the device is ready to probe. If somehow we end up trying to probe before we're allowed, __driver_probe_device() will return -EPROBE_DEFER which will make certain the device is noticed. In the race condition that was seen with Android's faster module loading, we will temporarily add the device to the deferred list and then take it off immediately when device_add() probes the device. Instead of adding another flag to the bitfields already in "struct device", instead add a new "flags" field and use that. This allows us to freely change the bit from different thread without worrying about corrupting nearby bits (and means threads changing other bit won't corrupt us). [1] Captured on a machine running a downstream 6.6 kernel [2] https://cs.android.com/android/platform/superproject/main/+/main:system/core/libmodprobe/libmodprobe.cpp?q=LoadModulesParallel Cc: stable@vger.kernel.org Fixes: 2023c610dc54 ("Driver core: add new device to bus's list before probing") Reviewed-by: Alan Stern Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Danilo Krummrich Acked-by: Greg Kroah-Hartman Acked-by: Marek Szyprowski Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260406162231.v5.1.Id750b0fbcc94f23ed04b7aecabcead688d0d8c17@changeid Signed-off-by: Danilo Krummrich commit c4c3fc872d2a05bf10372233c98e81344e685cdf Author: Felix Gu Date: Sat Apr 11 19:49:38 2026 +0800 spi: sn-f-ospi: fix incorrect return code for invalid num-cs Returning -ENOMEM for an invalid num-cs value is semantically wrong. Use -EINVAL instead. Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260411-ispi-v1-1-af384e81c4c8@gmail.com Signed-off-by: Mark Brown commit f79ee9e4b23244e77b28d176ce99a2d84d813ac5 Author: Miquel Raynal Date: Fri Apr 10 19:41:02 2026 +0200 spi: spi-mem: Add a packed command operation Instead of repeating the command opcode twice, some flash devices try to pack command and address bits. In this case, the second opcode byte being sent (LSB) is free to be used. The input data must be ANDed to only provide the relevant bits. Signed-off-by: Miquel Raynal Link: https://patch.msgid.link/20260410-winbond-6-19-rc1-oddr-v1-2-2ac4827a3868@bootlin.com Signed-off-by: Mark Brown commit 5e75c1d4d386fb7d64e2b19355e4d38dd4fd8845 Author: Miquel Raynal Date: Fri Apr 10 19:41:01 2026 +0200 spi: cadence-qspi: Revert the filtering of certain opcodes in ODTR I got mislead while analyzing the driver by the fact that the second opcode byte was in all cases smashed: if (op->cmd.dtr) opcode = op->cmd.opcode >> 8; else opcode = op->cmd.opcode; While at a first glance this doesn't let a chance to the second byte to be shifted out on the bus, this is actually the second step of an initialization, where the byte being apparently "ignored" in DTR mode has already been written in a dedicated "extended opcode" register. As such, the comment and the extra check that I proposed were entirely wrong, remove them. Fixes: bee085476d27 ("spi: cadence-qspi: Make sure we filter out unsupported ops") Signed-off-by: Miquel Raynal Link: https://patch.msgid.link/20260410-winbond-6-19-rc1-oddr-v1-1-2ac4827a3868@bootlin.com Signed-off-by: Mark Brown commit 87117347a0e77f528f357faa2230d5caffcd1b4e Author: Minda Chen Date: Fri Apr 10 19:25:00 2026 +0800 usb: dwc3: starfive: Add JHB100 USB 2.0 DRD controller JHB100 contains 2 dwc3 USB controllers and PHYs and working as USB 2.0 speed. It can working in generic platform and setting default properties. Signed-off-by: Minda Chen Link: https://patch.msgid.link/20260410112500.90432-3-minda.chen@starfivetech.com Signed-off-by: Greg Kroah-Hartman commit d7a8d8b40800f51a6281ea330233a0ef22982513 Author: Minda Chen Date: Fri Apr 10 19:24:59 2026 +0800 dt-bindings: usb: dwc3: add support for StarFive JHB100 Add support for the USB 2.0 Dual-Role Device (DRD) controller embedded in the StarFive JHB100 SoC. The controller is based on the Synopsys DesignWare Core USB 3 (DWC3) IP. Signed-off-by: Minda Chen Acked-by: Conor Dooley Link: https://patch.msgid.link/20260410112500.90432-2-minda.chen@starfivetech.com Signed-off-by: Greg Kroah-Hartman commit 35c8b7148c8d387efde7b54019035e8c4a9ea99e Author: Charan Pedumuru Date: Fri Mar 27 16:47:46 2026 +0000 dt-bindings: usb: atmel,at91sam9rl-udc: convert to DT schema Convert Atmel High-Speed USB Device Controller (USBA) binding to DT schema. Changes during conversion: - Make the "clock-names" property flexible enough to accept the items in any order as the existing in tree DTS nodes doesn't follow an order. Signed-off-by: Charan Pedumuru Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260327-atmel-usb-v4-5-eb8b6e49b29d@gmail.com Signed-off-by: Greg Kroah-Hartman commit abfffb4b365ec18c4d3c6465b47fb36936fd4c2b Author: Charan Pedumuru Date: Fri Mar 27 16:47:45 2026 +0000 dt-bindings: usb: atmel,at91rm9200-udc: convert to DT schema Convert Atmel AT91 USB Device Controller (UDC) binding to DT schema. Changes during conversion: - Include "atmel,pullup-gpio" and "atmel,matrix" in the properties since they are required by existing in-tree DTS definitions. Reviewed-by: Rob Herring (Arm) Signed-off-by: Charan Pedumuru Link: https://patch.msgid.link/20260327-atmel-usb-v4-4-eb8b6e49b29d@gmail.com Signed-off-by: Greg Kroah-Hartman commit 02d58df0a5c12e5dcff0a690973537fc1b27db3e Author: Charan Pedumuru Date: Fri Mar 27 16:47:44 2026 +0000 dt-bindings: usb: generic-ehci: fix schema structure and add at91sam9g45 constraints Add clock and phy constraints for atmel,at91sam9g45-ehci and reorganize the allOf section to fix dtbs_check warnings. Reviewed-by: Rob Herring (Arm) Signed-off-by: Charan Pedumuru Link: https://patch.msgid.link/20260327-atmel-usb-v4-3-eb8b6e49b29d@gmail.com Signed-off-by: Greg Kroah-Hartman commit 73d4839a3a86f3329fda8cc2cda723f10b22eb92 Author: Charan Pedumuru Date: Fri Mar 27 16:47:43 2026 +0000 dt-bindings: usb: generic-ohci: add AT91RM9200 OHCI binding support Convert the Atmel AT91RM9200 OHCI USB host controller binding to DT schema by defining it in the existing generic OHCI schema. Signed-off-by: Charan Pedumuru Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260327-atmel-usb-v4-2-eb8b6e49b29d@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2b7f1a4f19f87f44f95a812b0f40f79a23950f99 Author: Charan Pedumuru Date: Fri Mar 27 16:47:42 2026 +0000 arm: dts: at91: remove unused #address-cells/#size-cells from sam9x60 udc node The UDC node does not define any child nodes, so the "#address-cells" and "#size-cells" properties are unnecessary. Remove these unused properties to simplify the devicetree node and keep it consistent with DT conventions. Reviewed-by: Claudiu Beznea Signed-off-by: Charan Pedumuru Link: https://patch.msgid.link/20260327-atmel-usb-v4-1-eb8b6e49b29d@gmail.com Signed-off-by: Greg Kroah-Hartman commit e7d219f4302182f956bc25e1b76bfe14009847e7 Author: Qinghua Zhao Date: Thu Apr 9 22:54:28 2026 +0800 drivers/usb/host: Fix spelling error 'seperate' -> 'separate' Fix typo in comment where 'seperate' should be 'separate'. Signed-off-by: Qinghua Zhao Link: https://patch.msgid.link/20260409145428.18130-1-zqh1630@126.com Signed-off-by: Greg Kroah-Hartman commit cfcd7b29e5191f5ff097f7c278188face0c79ab7 Author: Zongmin Zhou Date: Thu Apr 2 16:32:04 2026 +0800 usbip: tools: add hint when no exported devices are found When refresh_exported_devices() finds no devices, it's helpful to inform users about potential causes. This could be due to: 1. The usbip driver module is not loaded. 2. No devices have been exported yet. Add an informational message to guide users when ndevs == 0. Also update the condition in usbip_host_driver_open() and usbip_device_driver_open() to check both ret and ndevs == 0, and change err() to info(). Message visibility by scenario: - usbipd (console mode): Show on console/serial, this allows instant visibility for debugging. - usbipd -D (daemon mode): Message logged to syslog, can keep logs for later traceability in production. Also can use "journalctl -f" to trace on console. Suggested-by: Shuah Khan Signed-off-by: Zongmin Zhou Reviewed-by: Shuah Khan Link: https://patch.msgid.link/20260402083204.53179-1-min_halo@163.com Signed-off-by: Greg Kroah-Hartman commit a5cc53f047bb343a988954b30ca33da5c424d339 Merge: cd1be4b2c6398c 37d9c4c055c3b3 Author: Greg Kroah-Hartman Date: Sat Apr 11 11:58:41 2026 +0200 Merge tag 'usb-serial-7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB serial updates for 7.1-rc1 Here are the USB serial updates for 7.1-rc1, including: - use strscpy() instead of strcpy() - new modem device id All have been in linux-next with no reported issues. * tag 'usb-serial-7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: iuu_phoenix: fix iuutool author name USB: serial: option: add Telit Cinterion FN990A MBIM composition USB: serial: ti_usb_3410_5052: use strscpy() instead of strcpy() commit 5b3a6cf06c8e013e0bffe929aac8129188b8933d Merge: 2bb665a2175876 29d8a380643521 Author: Krzysztof Kozlowski Date: Sat Apr 11 11:28:59 2026 +0200 Merge tag 'mvebu-dt-7.1-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/dt mvebu dt for 7.1 (part 1) Drop unnecessary MAINTAINERS entry for non-existent Marvell db-falcon files * tag 'mvebu-dt-7.1-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: MAINTAINERS: drop file entry in Marvell Kirkwood and Armada SOC support Signed-off-by: Krzysztof Kozlowski commit 8d7ea40011551c2ec915ee0260cae1c746c63156 Author: Harald Freudenberger Date: Tue Apr 7 13:30:45 2026 +0200 s390/zcrypt: Fix warning about wrong kernel doc comment Fix this warning: Warning: drivers/s390/crypto/zcrypt_msgtype6.c:1253 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603252022.vEojGo3V-lkp@intel.com/ Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Vasily Gorbik commit e4f9ab031dc86c9987c3619e97c5c7d8ad7afda2 Author: Niklas Schnelle Date: Tue Apr 7 15:24:46 2026 +0200 PCI: s390: Expose the UID as an arch specific PCI slot attribute On s390, an individual PCI function can generally be identified by two identifiers, the FID and the UID. Which identifier is used depends on the scope and the platform configuration. The first identifier, the FID, is always available and identifies a PCI device uniquely within a machine. The FID may be virtualized by hypervisors, but on the LPAR level, the machine scope makes it impossible to create the same configuration based on FIDs on two different LPARs of the same machine, and difficult to reuse across machines. Such matching LPAR configurations are useful, though, allowing standardized setups and booting a Linux installation on different LPARs. To this end the UID, or user-defined identifier, was introduced. While it is only guaranteed to be unique within an LPAR and only if indicated by firmware, it allows users to replicate PCI device setups. On s390, which uses a machine hypervisor, a per PCI function hotplug model is used. The shortcoming with the UID then is, that it is not visible to the user without first attaching the PCI function and accessing the "uid" device attribute. The FID, on the other hand, is used as the slot name and is thus known even with the PCI function in standby. Remedy this shortcoming by providing the UID as an attribute on the slot allowing the user to identify a PCI function based on the UID without having to first attach it. Do this via a macro mechanism analogous to what was introduced by commit 265baca69a07 ("s390/pci: Stop usurping pdev->dev.groups") for the PCI device attributes. Reviewed-by: Gerd Bayer Reviewed-by: Julian Ruess Signed-off-by: Niklas Schnelle Acked-by: Bjorn Helgaas # drivers/pci/slot.c Link: https://lore.kernel.org/r/20260407-uid_slot-v8-2-15ae4409d2ce@linux.ibm.com Signed-off-by: Vasily Gorbik commit 737c4f4a241ca85c597ca2ef1a6f8446bf681ab5 Author: Niklas Schnelle Date: Tue Apr 7 15:24:45 2026 +0200 docs: s390/pci: Improve and update PCI documentation Update the s390 specific PCI documentation to better reflect current behavior and terms such as the handling of Isolated VFs via commit 25f39d3dcb48 ("s390/pci: Ignore RID for isolated VFs"). Add a descriptions for /sys/firmware/clp/uid_checking which was added in commit b043a81ce3ee ("s390/pci: Expose firmware provided UID Checking state in sysfs") but missed documentation. Similarly add documentation for the fidparm attribute added by commit 99ad39306a62 ("s390/pci: Expose FIDPARM attribute in sysfs") and add a list of pft values and their names. Finally improve formatting of the different attribute descriptions by adding a separating colon. Reviewed-by: Farhan Ali Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Matthew Rosato Signed-off-by: Niklas Schnelle Reviewed-by: Gerd Bayer Link: https://lore.kernel.org/r/20260407-uid_slot-v8-1-15ae4409d2ce@linux.ibm.com Signed-off-by: Vasily Gorbik commit 3e2444044d160e33ec2b139d1e4f9691bb9d9bac Merge: 1cc30cfc66a1db edb7efa767da8b Author: Krzysztof Kozlowski Date: Sat Apr 11 10:53:44 2026 +0200 Merge tag 'mvebu-fixes-7.0-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into arm/fixes mvebu fixes for 7.0 (part 1) A new device tree has been merged without a binding, which triggered warnings during dtb_checks. The commit in this pull request fixes this issue, enabling easier detection of new problems in device trees by reducing the number of false warnings. * tag 'mvebu-fixes-7.0-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: dt-bindings: arm64: add Marvell 7k COMe boards Signed-off-by: Krzysztof Kozlowski commit 1cc30cfc66a1db71cdd7a0f52b90f74091e8eb77 Merge: 90ac490364bd7e 9797524ef2b69c Author: Krzysztof Kozlowski Date: Sat Apr 11 10:51:23 2026 +0200 Merge tag 'reset-fixes-for-v7.0-3' of https://git.pengutronix.de/git/pza/linux into arm/fixes Reset controller fixes for v7.0, part 3 * Add missing reset ops for amlogic,t7-reset to the reset-meson driver. The resets are unused as of now, but as soon as they are, the driver would otherwise run into a NULL pointer dereference. * tag 'reset-fixes-for-v7.0-3' of https://git.pengutronix.de/git/pza/linux: reset: amlogic: t7: Fix null reset ops Signed-off-by: Krzysztof Kozlowski commit 33a20cdaf41d08a66581cc01a60c1a3d596ba9cd Merge: f5fc003c457e3e 83210251fd70d5 Author: Krzysztof Kozlowski Date: Sat Apr 11 10:48:50 2026 +0200 Merge tag 'ffa-fix-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers Arm FF-A fix for v7.1 Use the page aligned backing allocation size when computing the RXTX_MAP page count. This fixes FF-A RX/TX buffer registration on kernels built with 16K/64K PAGE_SIZE, where alloc_pages_exact() backs the buffer with a larger aligned span than the discovered minimum buffer size. * tag 'ffa-fix-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Use the correct buffer size during RXTX_MAP Signed-off-by: Krzysztof Kozlowski commit 2bb665a217587688fd20c5f101db573f2a2c3d0b Merge: b7e1557eb6ce7e c755e39836ec49 Author: Krzysztof Kozlowski Date: Sat Apr 11 10:42:27 2026 +0200 Merge tag 'sunxi-dt-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner Device Tree Changes for 7.1 - Part 2 UART DMA channels added for A64 and H6. Standard resolution MMIO timer added for H616. This timer can be used as a broadcast timer for wakeup from idle states. * tag 'sunxi-dt-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: enable h616 timer support arm64: dts: allwinner: sun50i-h6: add UART DMA channels arm64: dts: allwinner: sun50i-a64: add UART DMA channels Signed-off-by: Krzysztof Kozlowski commit f5fc003c457e3eaaa55ed1c3c0cb2b9bcd7bffcf Merge: ecaf3a92fb86d8 a31ad9339eff4c Author: Krzysztof Kozlowski Date: Sat Apr 11 10:40:56 2026 +0200 Merge tag 'qcom-drivers-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers One more Qualcomm driver update for v7.1 Flag Lenovo IdeaCentre Mini X to have functional QSEECOM/uefisecapp. * tag 'qcom-drivers-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux: firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaCentre Mini X Signed-off-by: Krzysztof Kozlowski commit b7e1557eb6ce7e71788b41e211ceb47b72c4850a Merge: 746e195d439a17 af241225893ac4 Author: Krzysztof Kozlowski Date: Sat Apr 11 10:36:04 2026 +0200 Merge tag 'qcom-arm64-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt A few more Arm64 DeviceTree updates for v7.1 Introduce the Hamoa-based Lenovo IdeaCentre Mini X, the Dragonwing IQ-615 (Talos) EVK, and a Talos EVK camera overlay. Enable DisplayPort support on the Glymur CRD. Add WiFi, Bluetooh, LEDs, and venus on LG-based SDM845 devices. Add battery, charger, and display on the LG G7 ThinQ. Enable SD-card, describe the audio amplifier, and increase the speed of the i2c clock for touchscreen on the SHIFT SHIFT6mq. Add camera subsystem, camera control interface, GPU, GMU, and GPU cooling on the Talos platform. Enable the GPU on the Ride board. * tag 'qcom-arm64-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (31 commits) arm64: dts: qcom: Add the Lenovo IdeaCentre Mini X dt-bindings: arm: qcom: Document the Lenovo IdeaCentre Mini X arm64: dts: qcom: sdm845-shift-axolotl: Enable TFA9890 codec arm64: dts: qcom: sdm845-shift-axolotl: Set higher touchscreen i2c clock arm64: dts: qcom: sdm845-shift-axolotl: Enable sdcard arm64: dts: qcom: talos: Add clocks for QoS configuration arm64: dts: qcom: talos-evk-camera: Add DT overlay arm64: dts: qcom: talos: Add camera MCLK pinctrl arm64: dts: qcom: talos: Add CCI definitions arm64: dts: qcom: talos: Add camss node arm64: dts: qcom: talos: Add EL2 overlay arm64: dts: qcom: talos-evk: Add support for QCS615 talos evk board arm64: dts: qcom: talos/qcs615-ride: Fix inconsistent USB PHY node naming dt-bindings: arm: qcom: talos-evk: Add QCS615 Talos EVK SMARC platform arm64: dts: qcom: qcs615-ride: Enable Adreno 612 GPU arm64: dts: qcom: talos: Add GPU cooling arm64: dts: qcom: talos: Add gpu and rgmu nodes arm64: dts: qcom: talos: add the GPU SMMU node arm64: dts: qcom: sdm845-lg-common: Add chassis-type arm64: dts: qcom: sdm845-lg: Add wifi nodes ... Signed-off-by: Krzysztof Kozlowski commit ecaf3a92fb86d8ddfc47f228374e22d33a502fff Merge: 98bc7682ffa395 bd34cdd6d214f8 Author: Krzysztof Kozlowski Date: Sat Apr 11 10:31:20 2026 +0200 Merge tag 'riscv-soc-drivers-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers RISC-V soc drivers for v7.1 Microchip: Add coverage for the pic64gx in the system controller and syscons. Add a interrupt mux driver (akin to the one that Renesas recently added) that fixes a problem where the platform never properly modelled gpio interrupts. There's a gpio driver change here that Bartosz has acked that adds the interrupt support to the GPIO driver itself. Signed-off-by: Conor Dooley * tag 'riscv-soc-drivers-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux: soc: microchip: add mpfs gpio interrupt mux driver dt-bindings: soc: microchip: document PolarFire SoC's gpio interrupt mux gpio: mpfs: Add interrupt support soc: microchip: mpfs-sys-controller: add support for pic64gx dt-bindings: soc: microchip: mpfs-sys-controller: Add pic64gx compatibility dt-bindings: soc: microchip: add compatible for the mss-top-sysreg on pic64gx Signed-off-by: Krzysztof Kozlowski commit 746e195d439a17e0dbe6b6eef080cce66b5aa4ee Merge: 17ed8fd2fa714b b0258f69f1e0ed Author: Krzysztof Kozlowski Date: Sat Apr 11 10:29:22 2026 +0200 Merge tag 'riscv-dt-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt RISC-V devicetrees for v7.1 Generic: Add binding coverage for Supm. Microchip: Add support for the picgx64 and its curiosity board. This is a PolarFire SoC without the FPGA. Add the missing tsu_clk for ptp on the macb on PolarFire SoC and resolve a long-running problem with gpio interrupts being incorrectly described on the platform. Signed-off-by: Conor Dooley * tag 'riscv-dt-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: microchip: update mpfs gpio interrupts to better match the SoC riscv: dts: microchip: add tsu clock to macb on mpfs dt-bindings: riscv: Add Supm extension description riscv: dts: microchip: remove POLARFIRE mention in Makefile riscv: dts: microchip: add pic64gx and its curiosity kit dt-bindings: riscv: microchip: document the PIC64GX curiosity kit dt-bindings: timer: sifive,clint: add pic64gx compatibility riscv: dts: microchip: add pinctrl nodes for mpfs/icicle kit Signed-off-by: Krzysztof Kozlowski commit 17ed8fd2fa714bb06c53c5bd88a3948d23fba8f2 Merge: 4177ec9d586571 0037d16644b156 Author: Krzysztof Kozlowski Date: Sat Apr 11 10:20:17 2026 +0200 Merge tag 'imx-dt-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt i.MX ARM device tree changes for 7.1: - Device Tree Schema Compliance Fixes Fixed numerous CHECK_DTBS warnings across multiple i.MX SoC families Renamed nodes to match schema requirements (tcq→touchscreen, uart8250→serial, iomuxc→pinmux, etc.). Fixed node naming conventions (added "led-" prefix, proper addressing formats). Corrected compatible strings and removed undocumented fallbacks. Added required properties (clocks, clock-names, power supplies, #sound-dai-cells). - New Hardware Support Added DT overlays for various expansion modules (i.MX6 DHCOM PDK2, PicoITX display boards). Added support for muRata 1YN WiFi chip (replacement for 1DX) on i.MX6ULL DHCOR board. i.MX7ULP: Added CPU clock and OPP table support for frequency scaling. - Boot Phase Properties Added bootph.yaml properties to multiple TQ-Systems boards and SoCs: imx7s, tqma7, mba7 imx6ul/ull, tqma6ul/ull, mba6ulx imx6qdl, tqma6, mba6. - Bug Fixes & Corrections Fixed interrupt property usage (interrupts→interrupts-extended where needed). Corrected spelling ("TQ-Systems" with hyphen). Removed redundant intermediate nodes in pinmux hierarchy. Fixed clock references and naming. * tag 'imx-dt-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: (43 commits) ARM: dts: imx: Add DT overlays for DH i.MX6 DHCOM SoM and boards ARM: dts: imx6sx: remove fallback compatible string fsl,imx28-lcdif ARM: dts: imx25: rename node name tcq to touchscreen ARM: dts: imx: b850v3: Disable unused usdhc4 ARM: dts: imx: b850v3: Define GPIO line names ARM: dts: imx: b850v3: Use alphabetical sorting ARM: dts: imx: bx50v3: Configure phy-mode to eliminate a warning ARM: dts: imx: bx50v3: Configure switch PHY max-speed to 100Mbps ARM: dts: imx7ulp: Add CPU clock and OPP table support ARM: dts: imx7-mba7: Deassert BOOT_EN after boot ARM: dts: tqma7: add boot phase properties ARM: dts: imx7s: add boot phase properties ARM: dts: tqma6ul[l]: correct spelling of TQ-Systems ARM: dts: mba6ulx: add boot phase properties ARM: dts: imx6ul[l]-tqma6ul[l]: add boot phase properties ARM: dts: imx6ul/imx6ull: add boot phase properties ARM: dts: imx6qdl-mba6: add boot phase properties ARM: dts: imx6qdl-tqma6: add boot phase properties ARM: dts: imx6qdl: add boot phase properties ARM: dts: imx6qdl-tqma6: add missing labels ... Signed-off-by: Krzysztof Kozlowski commit 90ac490364bd7e3c161037ce86b6a313cdb09ae7 Merge: eaad992e3fa808 42a9f5a16328ed Author: Krzysztof Kozlowski Date: Sat Apr 11 10:14:22 2026 +0200 Merge tag 'imx-fixes-7.0-2nd' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into arm/fixes i.MX fixes for 7.0 2nd round: - Fixes interrupt storm by adding pull up pinctrl config for pin PMIC_nINT. * tag 'imx-fixes-7.0-2nd' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-ultra-mach-sbc: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-sr-som: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-nitrogen-som: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-aristainetos3a-som-v1: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-edm-g: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT Signed-off-by: Krzysztof Kozlowski commit 4177ec9d5865710c5964c08167d20a74c17f88ab Merge: 104f1e3f6d03f8 683192d7d5b47e Author: Krzysztof Kozlowski Date: Sat Apr 11 10:09:33 2026 +0200 Merge tag 'v7.1-rockchip-dts32-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt Support for the RV1103B SoC and the Onion Omega4 board using it. While the RV1103B only got a B-extension to its name, the SoC internals were reworked heavily. So likely it's mainly pin compatible to the non-B variant. The dt-binding for the RV1103B clock driver is shared with the clock- driver branch going into the clock-tree. * tag 'v7.1-rockchip-dts32-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: Add Onion Omega4 Evaluation Board dt-bindings: arm: rockchip: Add Omega4 Evaluation board ARM: dts: rockchip: Add support for RV1103B dt-bindings: soc: rockchip: grf: Add RV1103B compatibles dt-bindings: clock: rockchip: Add RV1103B CRU support Signed-off-by: Krzysztof Kozlowski commit 104f1e3f6d03f848f88fe116c7290512de7d6350 Merge: 0ba8e918c7ab6a 94c8dc1fa8e1ad Author: Krzysztof Kozlowski Date: Sat Apr 11 10:04:14 2026 +0200 Merge tag 'v7.1-rockchip-dts32-1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt A number of dt-schema cleanups that are log standing, so not suitable as fix for the current release. * tag 'v7.1-rockchip-dts32-1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: Pass linux,code to the power key on rk3288-veyron-pinky ARM: dts: rockchip: Fix LED node names on rk3288-phycore-rdk ARM: dts: rockchip: Fix GMAC description n RK3288 boards ARM: dts: rockchip: Fix RTC description on rk3288-firefly-reload ARM: dts: rockchip: Add missing the touchscreen interrupt on rk3288-phycore-rdk ARM: dts: rockchip: Fix the trackpad supply on rk3288-veyron-jerry ARM: dts: rockchip: Fix the Bluetooth node name on rk3288-veyron ARM: dts: rockchip: Remove invalid regulator-property from rk3288-veyron ARM: dts: rockchip: Use mount-matrix on rk3188-bqedison2qc ARM: dts: rockchip: Fix RTC compatible on rk3288-phycore-rdk ARM: dts: rockchip: Move PHY reset to ethernet-phy node on rk3036 boards ARM: dts: rockchip: Remove rockchip,grf from rk3288 tsadc Signed-off-by: Krzysztof Kozlowski commit 86aa1ea1f15ce6b56ac1b4c0d9b88a07a5b9bf03 Author: Rong Zhang Date: Sat Apr 11 01:49:04 2026 +0800 ALSA: usb-audio: Do not expose sticky mixers Some devices' mixers are sticky, which accept SET_CUR but do absolutely nothing. Registering these mixers confuses userspace and results in ineffective volume control. Check if a mixer is sticky by setting the volume to the maximum or minimum value and checking for effectiveness afterward. Prevent the mixer from being registered if it turns out to be sticky. Quirky device sample: usb 7-1: New USB device found, idVendor=0e0b, idProduct=fa01, bcdDevice= 1.00 usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 7-1: Product: Feaulle Rainbow usb 7-1: Manufacturer: Generic usb 7-1: SerialNumber: 20210726905926 (Mic Capture Volume) Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20260411-uac-sticky-mixer-v1-3-29d62717befd@rong.moe Signed-off-by: Takashi Iwai commit e3ad86a82868fcde16f213240a60891c2d7bbec4 Author: Rong Zhang Date: Sat Apr 11 01:49:03 2026 +0800 ALSA: usb-audio: Move volume control resolution check into a function get_min_max_with_quirks() is too lengthy and hard to read. Move the volume control resolution check code into a function as it's relatively self-contained. Suggested-by: Takashi Iwai Link: https://lore.kernel.org/r/87o6jsk3vs.wl-tiwai@suse.de Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20260411-uac-sticky-mixer-v1-2-29d62717befd@rong.moe Signed-off-by: Takashi Iwai commit 4f55a85cd4fc988712965f710ba1475e7ba3292a Author: Rong Zhang Date: Sat Apr 11 01:49:02 2026 +0800 ALSA: usb-audio: Add error checks against get_min_max*() All callers of get_min_max*() ignore the latter's return code completely. This means to ignore temporary errors at the probe time. However, it is not optimal and leads to some maintenance burdens. Return -EAGAIN for temporary errors, and check against it in the callers of get_min_max*(). If any other error occurs, bail out of the caller early. Suggested-by: Takashi Iwai Link: https://lore.kernel.org/r/87ldewi4j8.wl-tiwai@suse.de Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20260411-uac-sticky-mixer-v1-1-29d62717befd@rong.moe Signed-off-by: Takashi Iwai commit a0c370a6fd9634bd55ee10c83643940a88bdd159 Author: Ashish Yadav Date: Fri Apr 10 12:31:54 2026 +0530 hwmon:(pmbus/xdp720) Add support for efuse xdp720 Add the pmbus driver for Infineon XDP720 Digital eFuse Controller. Signed-off-by: Ashish Yadav Link: https://lore.kernel.org/r/20260410070154.3313-3-Ashish.Yadav@infineon.com Signed-off-by: Guenter Roeck commit 59f0b7befab1859d0e1dde8ad9774ab1858f0b22 Author: Ashish Yadav Date: Fri Apr 10 12:31:53 2026 +0530 dt-bindings: hwmon/pmbus: Add Infineon XDP720 Add documentation for the device tree binding of the XDP720 eFuse. Signed-off-by: Ashish Yadav Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20260410070154.3313-2-Ashish.Yadav@infineon.com Signed-off-by: Guenter Roeck commit e2fe950f34e54d6bd91d2c56501faa903e25fb5e Author: Victor Duicu Date: Fri Apr 3 16:32:17 2026 +0300 hwmon: add support for MCP998X Add driver for Microchip MCP998X/33 and MCP998XD/33D Multichannel Automotive Temperature Monitor Family. Signed-off-by: Victor Duicu Link: https://lore.kernel.org/r/20260403-add-mcp9982-hwmon-v12-2-b3bfb26ff136@microchip.com [groeck: Add missing break; to avoid build warning] Signed-off-by: Guenter Roeck commit 24b8f8dcb9a139a36cf48bfbe935e8dc1f33ed79 Author: Guilherme G. Piccoli Date: Fri Apr 10 17:49:26 2026 -0300 pstore/ftrace: Factor KASLR offset in the core kernel instruction addresses The pstore ftrace frontend works by purely collecting the instruction address, saving it on the persistent area through the backend and when the log is read, on next boot for example, the address is then resolved by using the regular printk symbol lookup (%pS for example). Problem: if we are running a relocatable kernel with KASLR enabled, this is a recipe for failure in the symbol resolution on next boots, since the addresses are offset'ed by the KASLR address. So, naturally the way to go is factor the KASLR address out of instruction address collection, and adding the fresh offset when resolving the symbol on future boots. Problem #2: modules also have varying addresses that float based on module base address and potentially the module ordering in memory, meaning factoring KASLR offset for them is useless. So, let's hereby only take KASLR offset into account for core kernel addresses, leaving module ones as is. And we have yet a 3rd complexity: not necessarily the check range for core kernel addresses holds true on future boots, since the module base address will vary. With that, the choice was to mark the addresses as being core vs module based on its MSB. And with that... ...we have the 4th challenge here: for some "simple" architectures, the CPU number is saved bit-encoded on the instruction pointer, to allow bigger timestamps - this is set through the PSTORE_CPU_IN_IP define for such architectures. Hence, the approach here is to skip such architectures (at least in a first moment). Finished? No. On top of all previous complexities, we have one extra pain point: kaslr_offset() is inlined and fully "resolved" at boot-time, after kernel decompression, through ELF relocation mechanism. Once the offset is known, it's patched to the kernel text area, wherever it is used. The mechanism, and its users, are only built-in - incompatible with module usage. Though there are possibly some hacks (as computing the offset using some kallsym lookup), the choice here is to restrict this optimization to the (hopefully common) case of CONFIG_PSTORE=y. TL;DR: let's factor KASLR offsets on pstore/ftrace for core kernel addresses, only when PSTORE is built-in and leaving module addresses out, as well as architectures that define PSTORE_CPU_IN_IP. Signed-off-by: Guilherme G. Piccoli Link: https://patch.msgid.link/20260410205848.2607169-1-gpiccoli@igalia.com Signed-off-by: Kees Cook commit ff1c0c5d07028a84837950b619d30da623f8ddb2 Merge: 09c04714cb455d d6e152d905bdb1 Author: Thomas Gleixner Date: Sat Apr 11 07:58:33 2026 +0200 Merge branch 'timers/urgent' into timers/core to resolve the conflict with urgent fixes. commit d6bae125f21f74201a3eab0996b2f27be3abc4bf Merge: 497fa510ee46af 136deea435dc83 Author: Alexei Starovoitov Date: Fri Apr 10 21:22:32 2026 -0700 Merge branch 'use-kmalloc_nolock-universally-in-bpf-local-storage' Amery Hung says: ==================== Use kmalloc_nolock() universally in BPF local storage Socket local storage did not convert to use kmalloc_nolock() since there were observable performance degredation due to kfree_nolock() hitting the slow path and the lack of kfree_rcu()-like batching freeing. Now that these concern were addressed in slub, convert all remaining local storage flavors to use kmalloc_nolock(). v1 -> v2: - Fix build (CI, Alexei) ==================== Link: https://patch.msgid.link/20260411015419.114016-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 136deea435dc83d7fe2304303bb9bccb54f69bb0 Author: Amery Hung Date: Fri Apr 10 18:54:18 2026 -0700 bpf: Remove gfp_flags plumbing from bpf_local_storage_update() Remove the check that rejects sleepable BPF programs from doing BPF_ANY/BPF_EXIST updates on local storage. This restriction was added in commit b00fa38a9c1c ("bpf: Enable non-atomic allocations in local storage") because kzalloc(GFP_KERNEL) could sleep inside local_storage->lock. This is no longer a concern: all local storage allocations now use kmalloc_nolock() which never sleeps. In addition, since kmalloc_nolock() only accepts __GFP_ACCOUNT, __GFP_ZERO and __GFP_NO_OBJ_EXT, the gfp_flags parameter plumbing from bpf_*_storage_get() to bpf_local_storage_update() becomes dead code. Remove gfp_flags from bpf_selem_alloc(), bpf_local_storage_alloc() and bpf_local_storage_update(). Drop the hidden 5th argument from bpf_*_storage_get helpers, and remove the verifier patching that injected GFP_KERNEL/GFP_ATOMIC into the fifth argument. Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260411015419.114016-4-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 5063e775889948c0475ccdf21c74a6191b7b6482 Author: Amery Hung Date: Fri Apr 10 18:54:17 2026 -0700 bpf: Use kmalloc_nolock() universally in local storage Switch to kmalloc_nolock() universally in local storage. Socket local storage didn't move to kmalloc_nolock() when BPF memory allocator was replaced by it for performance reasons. Now that kfree_rcu() supports freeing memory allocated by kmalloc_nolock(), we can move the remaining local storages to use kmalloc_nolock() and cleanup the cluttered free paths. Use kfree() instead of kfree_nolock() in bpf_selem_free_trace_rcu() and bpf_local_storage_free_trace_rcu(). Both callbacks run in process context where spinning is allowed, so kfree_nolock() is unnecessary. Benchmark: ./bench -p 1 local-storage-create --storage-type socket \ --batch-size {16,32,64} The benchmark is a microbenchmark stress-testing how fast local storage can be created. There is no measurable throughput change for socket local storage after switching from kzalloc() to kmalloc_nolock(). Socket local storage batch creation speed diff --------------- ---- ------------------ ---- Baseline 16 433.9 ± 0.6 k/s 32 434.3 ± 1.4 k/s 64 434.2 ± 0.7 k/s After 16 439.0 ± 1.9 k/s +1.2% 32 437.3 ± 2.0 k/s +0.7% 64 435.8 ± 2.5k/s +0.4% Also worth noting that the baseline got a 5% throughput boost when sheaf replaces percpu partial slab recently [0]. [0] https://lore.kernel.org/bpf/20260123-sheaves-for-all-v4-0-041323d506f7@suse.cz/ Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260411015419.114016-3-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 78ee02a966ad76966be516ed3d56860d7a58fe7e Author: Amery Hung Date: Fri Apr 10 18:54:16 2026 -0700 selftests/bpf: Remove kmalloc tracing from local storage create bench Remove the raw_tp/kmalloc BPF program and its associated reporting from the local storage create benchmark. The kmalloc count per create is not a useful metric as different code paths use different allocators (e.g. kmalloc_nolock vs kzalloc), introducing noise that makes the number hard to interpret. Keep total_creates in the summary output as it is useful for normalizing perf statistics collected alongside the benchmark. Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260411015419.114016-2-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 49d78adf9555bbc02ccb65a28325e3e57e9c52ed Author: Tejun Heo Date: Fri Apr 10 10:19:22 2026 -1000 sched_ext: Drop spurious warning on kick during scheduler disable kick_cpus_irq_workfn() warns when scx_kick_syncs is NULL, but this can legitimately happen when a BPF timer or other kick source races with free_kick_syncs() during scheduler disable. Drop the pr_warn_once() and add a comment explaining the race. Signed-off-by: Tejun Heo Reviewed-by: Zhao Mengmeng commit dc0325b0aafe28fa7a00c49aec97095ccae0952b Author: Paulo Alcantara Date: Fri Apr 10 20:20:55 2026 -0300 smb: client: get rid of d_drop()+d_add() Replace d_drop()+d_add() in cifs_tmpfile() and cifs_create() with d_instantiate(), and in cifs_atomic_open() with d_splice_alias() if in-lookup, otherwise d_instantiate(). Reported-by: Al Viro Closes: https://lore.kernel.org/r/20260408065719.GF3836593@ZenIV Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: NeilBrown Cc: linux-fsdevel@vger.kernel.org Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 497fa510ee46af2bf04991cd64cb919266d0ca5a Author: Daniel Borkmann Date: Sat Apr 11 01:26:51 2026 +0200 selftests/bpf: Add test for add_const base_id consistency Add a test to verifier_linked_scalars that exercises the base_id consistency check for BPF_ADD_CONST linked scalars during state pruning. With the fix, pruning fails and the verifier discovers the true branch's R3 is too wide for the stack access. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_linked_scalars [...] #613/22 verifier_linked_scalars/scalars_stale_delta_from_cleared_id:OK #613/23 verifier_linked_scalars/scalars_stale_delta_from_cleared_id_alu32:OK #613/24 verifier_linked_scalars/linked scalars: add_const base_id must be consistent for pruning:OK #613 verifier_linked_scalars:OK Summary: 1/24 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260410232651.559778-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0 Author: Daniel Borkmann Date: Sat Apr 11 01:26:50 2026 +0200 bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars When regsafe() compares two scalar registers that both carry BPF_ADD_CONST, check_scalar_ids() maps their full compound id (aka base | BPF_ADD_CONST flag) as one idmap entry. However, it never verifies that the underlying base ids, that is, with the flag stripped are consistent with existing idmap mappings. This allows construction of two verifier states where the old state has R3 = R2 + 10 (both sharing base id A) while the current state has R3 = R4 + 10 (base id C, unrelated to R2). The idmap creates two independent entries: A->B (for R2) and A|flag->C|flag (for R3), without catching that A->C conflicts with A->B. State pruning then incorrectly succeeds. Fix this by additionally verifying base ID mapping consistency whenever BPF_ADD_CONST is set: after mapping the compound ids, also invoke check_ids() on the base IDs (flag bits stripped). This ensures that if A was already mapped to B from comparing the source register, any ADD_CONST derivative must also derive from B, not an unrelated C. Fixes: 98d7ca374ba4 ("bpf: Track delta between "linked" registers.") Reported-by: STAR Labs SG Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260410232651.559778-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 3f3a2aefbc661b837c8e344f944982d61c2ae037 Author: Aleksandr Loktionov Date: Thu Apr 9 11:30:20 2026 +0200 iavf: fix kernel-doc comment style in iavf_ethtool.c iavf_ethtool.c contains 31 kernel-doc comment blocks using the legacy `**/` terminator instead of the correct single `*/`. Two function headers also use a colon separator (`iavf_get_channels:`, `iavf_set_channels:`) instead of the ` - ` dash required by kernel-doc. Additionally several comments embed their return-value descriptions in the body paragraph, producing `scripts/kernel-doc -Wreturn` warnings. Void functions that incorrectly say "Returns ..." are also rephrased. Fix all issues across the full file: - Replace every `**/` terminator with `*/`. - Change `function_name:` doc headers to `function_name -`. - Move inline "Returns ..." sentences into dedicated `Return:` sections for non-void functions (iavf_get_msglevel, iavf_get_rxnfc, iavf_set_channels, iavf_get_rxfh_key_size, iavf_get_rxfh_indir_size, iavf_get_rxfh, iavf_set_rxfh). - Rephrase body descriptions in void functions that incorrectly said "Returns ..." (iavf_get_drvinfo, iavf_get_ringparam, iavf_get_coalesce). - Remove boilerplate body text for iavf_get_rxfh_key_size and iavf_get_rxfh_indir_size; the `Return:` line now conveys the same information without the vague "Returns the table size." sentence. Suggested-by: Anthony L. Nguyen Suggested-by: Leszek Pepiak Signed-off-by: Aleksandr Loktionov Reviewed-by: Breno Leitao Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260409093020.3808687-1-aleksandr.loktionov@intel.com Signed-off-by: Jakub Kicinski commit 02f72964395911e7a09bb2ea2fe6f79eda4ea2c2 Author: Lorenzo Bianconi Date: Wed Apr 8 12:20:09 2026 +0200 net: airoha: Fix FE_PSE_BUF_SET configuration if PPE2 is available airoha_fe_set routine is used to set specified bits to 1 in the selected register. In the FE_PSE_BUF_SET case this can due to a overestimation of the required buffers for I/O queues since we can miss to set some bits of PSE_ALLRSV_MASK subfield to 0. Fix the issue relying on airoha_fe_rmw routine instead. Fixes: 8e38e08f2c560 ("net: airoha: fix PSE memory configuration in airoha_fe_pse_ports_init()") Tested-by: Xuegang Lu Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260408-airoha-reg_fe_pse_buf_set-v1-1-0c4fa8f4d1d9@kernel.org Signed-off-by: Jakub Kicinski commit 43f7081d526cf5d3efeaff649f82d82a4d9f4f51 Merge: d6aa47704561b2 d587f9b6dcc98c Author: Jakub Kicinski Date: Fri Apr 10 16:03:49 2026 -0700 Merge branch 'net-dsa-mxl862xx-vlan-support-and-minor-improvements' Daniel Golle says: ==================== net: dsa: mxl862xx: VLAN support and minor improvements This series adds VLAN offloading to the mxl862xx DSA driver along with two minor improvements to port setup and bridge configuration. VLAN support uses a hybrid architecture combining the Extended VLAN engine for PVID insertion and tag stripping with the VLAN Filter engine for per-port VID membership, both drawing from shared 1024-entry hardware pools partitioned across user ports at probe time. ==================== Link: https://patch.msgid.link/cover.1775581804.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit d587f9b6dcc98c1e8aeb5c189a7bfac60d6d29ac Author: Daniel Golle Date: Tue Apr 7 18:31:01 2026 +0100 net: dsa: mxl862xx: implement VLAN functionality Add VLAN support using both the Extended VLAN (EVLAN) engine and the VLAN Filter (VF) engine in a hybrid architecture that allows a higher number of VIDs than either engine could achieve alone. The VLAN Filter engine handles per-port VID membership checks with discard-unmatched semantics. The Extended VLAN engine handles PVID insertion on ingress (via fixed catchall rules) and tag stripping on egress (2 rules per untagged VID). Tagged-only VIDs need no EVLAN egress rules at all, so they consume only a VF entry. Both engines draw from shared 1024-entry hardware pools. The VF pool is divided equally among user ports for VID membership, while the EVLAN pool is partitioned into small fixed-size ingress blocks (7 entries of catchall rules per port) and fixed-size egress blocks for tag stripping. With 5 user ports this yields up to 204 VIDs per port (limited by VF), of which up to 98 can be untagged (limited by EVLAN egress budget). With 9 user ports the numbers are 113 total and 53 untagged. Wire up .port_vlan_add, .port_vlan_del, and .port_vlan_filtering. Reprogram all EVLAN rules when the PVID or filtering mode changes. Detach blocks from the bridge port before freeing them on bridge leave to satisfy the firmware's internal refcount. Future optimizations could increase VID capacity by dynamically sizing the egress EVLAN blocks based on actual per-port untagged VID counts rather than worst-case pre-allocation, or by sharing EVLAN egress and VLAN Filter blocks across ports with identical VID sets. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/9be29637675342b109a85fa08f5378800d9f7b78.1775581804.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 71934b9e6f36b1786bd969c0e1d2de8f9bd65f0f Author: Daniel Golle Date: Tue Apr 7 18:30:35 2026 +0100 net: dsa: mxl862xx: don't skip early bridge port configuration mxl862xx_bridge_port_set() is currently guarded by the mxl8622_port->setup_done flag, as the early call to mxl862xx_bridge_port_set() from mxl862xx_port_stp_state_set() would otherwise cause a NULL-pointer dereference on unused ports which don't have dp->cpu_dp despite not being a CPU port. Using the setup_done flag (which is never set for unused ports), however, also prevents mxl862xx_bridge_port_set() from configuring user ports' single-port bridges early, which was unintended. Fix this by returning early from mxl862xx_bridge_port_set() in case dsa_port_is_unused(). Fixes: 340bdf984613c ("net: dsa: mxl862xx: implement bridge offloading") Signed-off-by: Daniel Golle Link: https://patch.msgid.link/15962aac29ebe0a6eb77565451acff880c41ef33.1775581804.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 3a4056ec7ec8f71ae9722f86d3cfbc4589deeac4 Author: Daniel Golle Date: Tue Apr 7 18:30:27 2026 +0100 net: dsa: mxl862xx: reject DSA_PORT_TYPE_DSA DSA links aren't supported by the mxl862xx driver. Instead of returning early from .port_setup when called for DSA_PORT_TYPE_DSA ports rather return -EOPNOTSUPP and show an error message. The desired side-effect is that the framework will switch the port to DSA_PORT_TYPE_UNUSED, so we can stop caring about DSA_PORT_TYPE_DSA in all other places. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/b686f3a22d8a6e7d470e7aa98da811a996a229b9.1775581804.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit d6aa47704561b2e363821d243fd405da1ac06bcb Merge: 02468f3492bfb9 20ae6d76e381eb Author: Jakub Kicinski Date: Fri Apr 10 15:52:46 2026 -0700 Merge branch 'net-bridge-add-stp_mode-attribute-for-stp-mode-selection' Andy Roulin says: ==================== net: bridge: add stp_mode attribute for STP mode selection The bridge-stp usermode helper is currently restricted to the initial network namespace, preventing userspace STP daemons like mstpd from operating on bridges in other namespaces. Since commit ff62198553e4 ("bridge: Only call /sbin/bridge-stp for the initial network namespace"), bridges in non-init namespaces silently fall back to kernel STP with no way to request userspace STP. This series adds a new IFLA_BR_STP_MODE bridge attribute that allows explicit per-bridge control over STP mode selection. Three modes are supported: - auto (default): existing behavior, try /sbin/bridge-stp in init_net, fall back to kernel STP otherwise - user: directly enable BR_USER_STP without invoking the helper, works in any network namespace - kernel: directly enable BR_KERNEL_STP without invoking the helper The user and kernel modes bypass call_usermodehelper() entirely, addressing the security concerns discussed at [1]. Userspace is responsible for ensuring an STP daemon manages the bridge, rather than relying on the kernel to invoke /sbin/bridge-stp. Patch 1 adds the kernel support. The mode can only be changed while STP is disabled and is processed before IFLA_BR_STP_STATE in br_changelink() so both can be set atomically in a single netlink message. Patch 2 adds documentation for the new attribute in the bridge docs. Patch 3 adds a selftest with 9 test cases. The test requires iproute2 with IFLA_BR_STP_MODE support and can be run with virtme-ng: vng --run arch/x86/boot/bzImage --skip-modules \ --overlay-rwdir /sbin --overlay-rwdir /tmp --overlay-rwdir /bin \ --exec 'cp /path/to/iproute2-next/ip/ip /bin/ip && \ cd tools/testing/selftests/net && \ bash bridge_stp_mode.sh' iproute2 support can be found here [2]. [1] https://lore.kernel.org/netdev/565B7F7D.80208@nod.at/ [2] https://github.com/aroulin/iproute2-next/tree/bridge-stp-mode ==================== Link: https://patch.msgid.link/20260405205224.3163000-1-aroulin@nvidia.com Signed-off-by: Jakub Kicinski commit 20ae6d76e381eb520d0d1db526a41b22390816f6 Author: Andy Roulin Date: Sun Apr 5 13:52:24 2026 -0700 selftests: net: add bridge STP mode selection test Add a selftest for the IFLA_BR_STP_MODE bridge attribute that verifies: 1. stp_mode defaults to auto on new bridges 2. stp_mode can be toggled between user, kernel, and auto 3. Changing stp_mode while STP is active is rejected with -EBUSY 4. Re-setting the same stp_mode while STP is active succeeds 5. stp_mode user in a network namespace yields userspace STP (stp_state=2) 6. stp_mode kernel forces kernel STP (stp_state=1) 7. stp_mode auto in a netns preserves traditional fallback to kernel STP 8. stp_mode and stp_state can be set atomically in a single message 9. stp_mode persists across STP disable/enable cycles Test 5 is the key use case: it demonstrates that userspace STP can now be enabled in non-init network namespaces by setting stp_mode to user before enabling STP. Test 8 verifies the atomic usage pattern where both attributes are set in a single netlink message, which is supported because br_changelink() processes IFLA_BR_STP_MODE before IFLA_BR_STP_STATE. The test gracefully skips if the installed iproute2 does not support the stp_mode attribute. Assisted-by: Claude:claude-opus-4-6 Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Andy Roulin Link: https://patch.msgid.link/20260405205224.3163000-4-aroulin@nvidia.com Signed-off-by: Jakub Kicinski commit c4f2aab121cdc8400dcd5ec3cc0aa0fb3c06694f Author: Andy Roulin Date: Sun Apr 5 13:52:23 2026 -0700 docs: net: bridge: document stp_mode attribute Add documentation for the IFLA_BR_STP_MODE bridge attribute in the "User space STP helper" section of the bridge documentation. Reference the BR_STP_MODE_* values via kernel-doc and describe the use case for network namespace environments. Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Andy Roulin Link: https://patch.msgid.link/20260405205224.3163000-3-aroulin@nvidia.com Signed-off-by: Jakub Kicinski commit 54fc83a1728535831df0f251e155d05574918115 Author: Andy Roulin Date: Sun Apr 5 13:52:22 2026 -0700 net: bridge: add stp_mode attribute for STP mode selection The bridge-stp usermode helper is currently restricted to the initial network namespace, preventing userspace STP daemons (e.g. mstpd) from operating on bridges in other network namespaces. Since commit ff62198553e4 ("bridge: Only call /sbin/bridge-stp for the initial network namespace"), bridges in non-init namespaces silently fall back to kernel STP with no way to use userspace STP. Add a new bridge attribute IFLA_BR_STP_MODE that allows explicit per-bridge control over STP mode selection: BR_STP_MODE_AUTO (default) - Existing behavior: invoke the /sbin/bridge-stp helper in init_net only; fall back to kernel STP if it fails or in non-init namespaces. BR_STP_MODE_USER - Directly enable userspace STP (BR_USER_STP) without invoking the helper. Works in any network namespace. Userspace is responsible for ensuring an STP daemon manages the bridge. BR_STP_MODE_KERNEL - Directly enable kernel STP (BR_KERNEL_STP) without invoking the helper. The mode can only be changed while STP is disabled, or set to the same value (-EBUSY otherwise). IFLA_BR_STP_MODE is processed before IFLA_BR_STP_STATE in br_changelink(), so both can be set atomically in a single netlink message. The mode can also be changed in the same message that disables STP. The stp_mode struct field is u8 since all possible values fit, while NLA_U32 is used for the netlink attribute since it occupies the same space in the netlink message as NLA_U8. A new stp_helper_active boolean tracks whether the /sbin/bridge-stp helper was invoked during br_stp_start(), so that br_stp_stop() only calls the helper for stop when it was called for start. This avoids calling the helper asymmetrically when stp_mode changes between start and stop. Suggested-by: Ido Schimmel Assisted-by: Claude:claude-opus-4-6 Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Signed-off-by: Andy Roulin Link: https://patch.msgid.link/20260405205224.3163000-2-aroulin@nvidia.com Signed-off-by: Jakub Kicinski commit 02468f3492bfb901f53fa9a62c85b79df7fd387e Merge: 42f9b4c6ef19e7 a66374a3eb0244 Author: Jakub Kicinski Date: Fri Apr 10 15:32:14 2026 -0700 Merge branch 'add-selftests-for-ntuple-nfc-rules' Dimitri Daskalakis says: ==================== Add selftests for ntuple (NFC) rules Thoroughly testing a device's NFC implementation can be tedious. The more features a device supports, the more combinations to validate. This series aims to ease that burden, validating the most common NFC rule combinations. ==================== Link: https://patch.msgid.link/20260407164954.2977820-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit a66374a3eb0244f3c66b06d77fd5a1253e97ff27 Author: Dimitri Daskalakis Date: Tue Apr 7 09:49:54 2026 -0700 selftests: drv-net: ntuple: Add dst-ip, src-port, dst-port fields Extend the ntuple flow steering test to cover dst-ip, src-port, and dst-port fields. The test supports arbitrary combinations of the fields, for now we test src_ip/dst_ip, and src_ip/dst_ip/src_port/dst_port. The tests currently match full fields, but we can consider adding support for masked fields in the future. TAP version 13 1..24 ok 1 ntuple.queue.tcp4.src_ip ok 2 ntuple.queue.tcp4.dst_ip ok 3 ntuple.queue.tcp4.src_port ok 4 ntuple.queue.tcp4.dst_port ok 5 ntuple.queue.tcp4.src_ip.dst_ip ok 6 ntuple.queue.tcp4.src_ip.dst_ip.src_port.dst_port ok 7 ntuple.queue.udp4.src_ip ok 8 ntuple.queue.udp4.dst_ip ok 9 ntuple.queue.udp4.src_port ok 10 ntuple.queue.udp4.dst_port ok 11 ntuple.queue.udp4.src_ip.dst_ip ok 12 ntuple.queue.udp4.src_ip.dst_ip.src_port.dst_port ok 13 ntuple.queue.tcp6.src_ip ok 14 ntuple.queue.tcp6.dst_ip ok 15 ntuple.queue.tcp6.src_port ok 16 ntuple.queue.tcp6.dst_port ok 17 ntuple.queue.tcp6.src_ip.dst_ip ok 18 ntuple.queue.tcp6.src_ip.dst_ip.src_port.dst_port ok 19 ntuple.queue.udp6.src_ip ok 20 ntuple.queue.udp6.dst_ip ok 21 ntuple.queue.udp6.src_port ok 22 ntuple.queue.udp6.dst_port ok 23 ntuple.queue.udp6.src_ip.dst_ip ok 24 ntuple.queue.udp6.src_ip.dst_ip.src_port.dst_port # Totals: pass:24 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20260407164954.2977820-3-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit 18589df9344c459f062ad74a5890e87ad6c0f1a6 Author: Dimitri Daskalakis Date: Tue Apr 7 09:49:53 2026 -0700 selftests: drv-net: Add ntuple (NFC) flow steering test Add a test for ethtool NFC (ntuple) flow steering rules. The test creates an ntuple rule matching on various flow fields and verifies that traffic is steered to the correct queue. The test forces all traffic to queue 0 via the indirection table, then installs an ntuple rule to steer select traffic to a specific queue. The test then verifies the expected number of packets is received on the queue. This test has variants for TCP/UDP over IPv4/IPv6, with rules matching the source IP. Additional match fields will be added in the next commit. TAP version 13 1..4 ok 1 ntuple.queue.tcp4.src_ip ok 2 ntuple.queue.udp4.src_ip ok 3 ntuple.queue.tcp6.src_ip ok 4 ntuple.queue.udp6.src_ip # Totals: pass:4 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20260407164954.2977820-2-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit e2e6a6ea2418e23d6afaf3c37e207f6ca85ba9d8 Merge: 749b925802c235 2cb27158adb38f Author: Alexei Starovoitov Date: Fri Apr 10 15:01:57 2026 -0700 Merge branch 'bpf-static-stack-liveness-data-flow-analysis' Eduard Zingerman says: ==================== bpf: static stack liveness data flow analysis This patch set converts current dynamic stack slot liveness tracking mechanism to a static data flow analysis. The result is used during state pruning (clean_verifier_state): to zero out dead stack slots, enabling more aggressive state equivalence and pruning. To improve analysis precision live stack slot tracking is converted to 4-byte granularity. The key ideas and the bulk of the execution behind the series belong to Alexei Starovoitov. I contributed to patch set integration with existing liveness tracking mechanism. Due to complexity of the changes the bisectability property of the patch set is not preserved. Some selftests may fail between intermediate patches of the series. Analysis consists of two passes: - A forward fixed-point analysis that tracks which frame's FP each register value is derived from, and at what byte offset. This is needed because a callee can receive a pointer to its caller's stack frame (e.g. r1 = fp-16 at the call site), then do *(u64 *)(r1 + 0) inside the callee - a cross-frame stack access that the callee's local liveness must attribute to the caller's stack. - A backward dataflow pass within each callee subprog that computes live_in = (live_out \ def) ∪ use for both local and non-local (ancestor) stack slots. The result of the analysis for callee is propagated up to the callsite. The key idea making such analysis possible is that limited and conservative argument tracking pass is sufficient to recover most of the offsets / stack pointer arguments. Changelog: v3 -> v4: liveness.c: - fill_from_stack(): correct conservative stack mask for imprecise result, instead of picking frames from pointer register (Alexei, sashiko). - spill_to_stack(): join with existing values instead of overwriting when dst has multiple offsets (cnt > 1) or imprecise offset (cnt == 0) (Alexei, sashiko). - analyze_subprog(): big change, now each analyze_subprog() is called with a fresh func_instance, once read/write marks are collected the instance is joined with the one accumulated for (callsite, depth) and update_instance() is called. This handles several issues: - Avoids stale must_write marks when same func_instance is reused by analyze_subprog() several times. - Handles potential calls multiple calls for mark_stack_write() within single instruction. (Alexei, sashiko). - analyze_subprog(): added complexity limit to avoid exponential analysis time blowup for crafted programs with lots of nested function calls (Alexei, sashiko). - the patch "bpf: record arg tracking results in bpf_liveness masks" is reinstated, it was accidentally squashed during v1->v2 transition. verifier.c: - clean_live_states() is replaced by a direct call to clean_verifier_state(), bpf_verifier_state->cleaned is dropped. verifier_live_stack.c: - added selftests for arg tracking changes. v2 -> v3: liveness.c: - record_stack_access(): handle S64_MIN (unknown read) with imprecise offset. Test case can't be created with existing helpers/kfuncs (sashiko). - fmt_subprog(): handle NULL name (subprogs without BTF info). - print_instance(): use u64 for pos/insn_pos avoid truncation (bot+bpf-ci). - compute_subprog_args(): return error if 'env->callsite_at_stack[idx] = kvmalloc_objs(...)' fails (sashiko). - clear_overlapping_stack_slots(): avoid integer promoting issues by adding explicit (int) cast (sashiko). bpf_verifier.h, verifier.c, liveness.c: - Fixes in comments and commit messages (bot+bpf-ci). v1 -> v2: liveness.c: - Removed func_instance->callsites and replaced it with explicit spine passed through analys_subprog() calls (sashiko). - Fixed BPF_LOAD_ACQ handling in arg_track_xfer: don't clear dst register tracking (sashiko). - Various error threading nits highlighted by bots (sashiko, bot+bpf-ci). - Massaged fmt_spis_mask() to be more concise (Alexei) verifier.c: - Move subprog_info[i].name assignment from add_subprog_and_kfunc to check_btf_func (sashiko, bot+bpf-ci). - Fixed inverse usage of msb/lsb halves by patch "bpf: make liveness.c track stack with 4-byte granularity" (sashiko, bot+bpf-ci). v1: https://lore.kernel.org/bpf/20260408-patch-set-v1-0-1a666e860d42@gmail.com/ v2: https://lore.kernel.org/bpf/20260409-patch-set-v2-0-651804512349@gmail.com/ v3: https://lore.kernel.org/bpf/20260410-patch-set-v3-0-1f5826dc0ef2@gmail.com/ Verification performance impact (negative % is good): ========= selftests: master vs patch-set ========= File Program Insns (A) Insns (B) Insns (DIFF) ----------------------- ------------- --------- --------- --------------- xdp_synproxy_kern.bpf.o syncookie_tc 20363 22910 +2547 (+12.51%) xdp_synproxy_kern.bpf.o syncookie_xdp 20450 23001 +2551 (+12.47%) Total progs: 4490 Old success: 2856 New success: 2856 total_insns diff min: -80.26% total_insns diff max: 12.51% 0 -> value: 0 value -> 0: 0 total_insns abs max old: 837,487 total_insns abs max new: 837,487 -85 .. -75 %: 1 -50 .. -40 %: 1 -35 .. -25 %: 1 -20 .. -10 %: 5 -10 .. 0 %: 18 0 .. 5 %: 4458 5 .. 15 %: 6 ========= scx: master vs patch-set ========= File Program Insns (A) Insns (B) Insns (DIFF) -------------- --------- --------- --------- -------------- scx_qmap.bpf.o qmap_init 20230 19022 -1208 (-5.97%) Total progs: 376 Old success: 351 New success: 351 total_insns diff min: -27.15% total_insns diff max: 0.50% 0 -> value: 0 value -> 0: 0 total_insns abs max old: 236,251 total_insns abs max new: 233,669 -30 .. -20 %: 8 -20 .. -10 %: 2 -10 .. 0 %: 21 0 .. 5 %: 345 ========= meta: master vs patch-set ========= File Program Insns (A) Insns (B) Insns (DIFF) ---------------------------------------------------------------------------- ----------------- --------- --------- ----------------- ... third-party-scx-backports-scheds-rust-scx_layered-bpf_skel_genskel-bpf.bpf.o layered_dispatch 13944 13104 -840 (-6.02%) third-party-scx-backports-scheds-rust-scx_layered-bpf_skel_genskel-bpf.bpf.o layered_dispatch 13944 13104 -840 (-6.02%) third-party-scx-gefe21962f49a-__scx_layered_bpf_skel_genskel-bpf.bpf.o layered_dispatch 13825 12985 -840 (-6.08%) third-party-scx-v1.0.16-__scx_lavd_bpf_skel_genskel-bpf.bpf.o lavd_enqueue 15501 13602 -1899 (-12.25%) third-party-scx-v1.0.16-__scx_lavd_bpf_skel_genskel-bpf.bpf.o lavd_select_cpu 19814 16231 -3583 (-18.08%) third-party-scx-v1.0.17-__scx_lavd_bpf_skel_genskel-bpf.bpf.o lavd_enqueue 15501 13602 -1899 (-12.25%) third-party-scx-v1.0.17-__scx_lavd_bpf_skel_genskel-bpf.bpf.o lavd_select_cpu 19814 16231 -3583 (-18.08%) third-party-scx-v1.0.17-__scx_layered_bpf_skel_genskel-bpf.bpf.o layered_dispatch 13976 13151 -825 (-5.90%) third-party-scx-v1.0.18-__scx_lavd_bpf_skel_genskel-bpf.bpf.o lavd_dispatch 260628 237930 -22698 (-8.71%) third-party-scx-v1.0.18-__scx_lavd_bpf_skel_genskel-bpf.bpf.o lavd_enqueue 13437 12225 -1212 (-9.02%) third-party-scx-v1.0.18-__scx_lavd_bpf_skel_genskel-bpf.bpf.o lavd_select_cpu 17744 14730 -3014 (-16.99%) third-party-scx-v1.0.19-10-6b1958477-__scx_lavd_bpf_skel_genskel-bpf.bpf.o lavd_cpu_offline 19676 18418 -1258 (-6.39%) third-party-scx-v1.0.19-10-6b1958477-__scx_lavd_bpf_skel_genskel-bpf.bpf.o lavd_cpu_online 19674 18416 -1258 (-6.39%) ... Total progs: 1540 Old success: 1492 New success: 1493 total_insns diff min: -75.83% total_insns diff max: 73.60% 0 -> value: 0 value -> 0: 0 total_insns abs max old: 434,763 total_insns abs max new: 666,036 -80 .. -70 %: 2 -55 .. -50 %: 7 -50 .. -45 %: 10 -45 .. -35 %: 4 -35 .. -25 %: 4 -25 .. -20 %: 8 -20 .. -15 %: 15 -15 .. -10 %: 11 -10 .. -5 %: 45 -5 .. 0 %: 112 0 .. 5 %: 1316 5 .. 15 %: 2 15 .. 25 %: 1 25 .. 35 %: 1 55 .. 65 %: 1 70 .. 75 %: 1 ========= cilium: master vs patch-set ========= File Program Insns (A) Insns (B) Insns (DIFF) --------------- --------------------------------- --------- --------- ---------------- bpf_host.o cil_host_policy 45801 32027 -13774 (-30.07%) bpf_host.o cil_to_netdev 100287 69042 -31245 (-31.16%) bpf_host.o tail_handle_ipv4_cont_from_host 60911 20962 -39949 (-65.59%) bpf_host.o tail_handle_ipv4_from_netdev 59735 33155 -26580 (-44.50%) bpf_host.o tail_handle_ipv6_cont_from_host 23529 17036 -6493 (-27.60%) bpf_host.o tail_handle_ipv6_from_host 11906 10303 -1603 (-13.46%) bpf_host.o tail_handle_ipv6_from_netdev 29778 23743 -6035 (-20.27%) bpf_host.o tail_handle_snat_fwd_ipv4 61616 67463 +5847 (+9.49%) bpf_host.o tail_handle_snat_fwd_ipv6 30802 22806 -7996 (-25.96%) bpf_host.o tail_ipv4_host_policy_ingress 20017 10528 -9489 (-47.40%) bpf_host.o tail_ipv6_host_policy_ingress 20693 17301 -3392 (-16.39%) bpf_host.o tail_nodeport_nat_egress_ipv4 16455 13684 -2771 (-16.84%) bpf_host.o tail_nodeport_nat_ingress_ipv4 36174 20080 -16094 (-44.49%) bpf_host.o tail_nodeport_nat_ingress_ipv6 48039 25779 -22260 (-46.34%) bpf_lxc.o tail_handle_ipv4 13765 10001 -3764 (-27.34%) bpf_lxc.o tail_handle_ipv4_cont 96891 68725 -28166 (-29.07%) bpf_lxc.o tail_handle_ipv6_cont 21809 17697 -4112 (-18.85%) bpf_lxc.o tail_ipv4_ct_egress 15949 17746 +1797 (+11.27%) bpf_lxc.o tail_nodeport_nat_egress_ipv4 16183 13432 -2751 (-17.00%) bpf_lxc.o tail_nodeport_nat_ingress_ipv4 18532 10697 -7835 (-42.28%) bpf_overlay.o tail_handle_inter_cluster_revsnat 15708 11099 -4609 (-29.34%) bpf_overlay.o tail_handle_ipv4 105672 76108 -29564 (-27.98%) bpf_overlay.o tail_handle_ipv6 15733 19944 +4211 (+26.77%) bpf_overlay.o tail_handle_snat_fwd_ipv4 19327 26468 +7141 (+36.95%) bpf_overlay.o tail_handle_snat_fwd_ipv6 20817 12556 -8261 (-39.68%) bpf_overlay.o tail_nodeport_nat_egress_ipv4 16175 12184 -3991 (-24.67%) bpf_overlay.o tail_nodeport_nat_ingress_ipv4 20760 11951 -8809 (-42.43%) bpf_wireguard.o tail_handle_ipv4 27466 28909 +1443 (+5.25%) bpf_wireguard.o tail_nodeport_nat_egress_ipv4 15937 12094 -3843 (-24.11%) bpf_wireguard.o tail_nodeport_nat_ingress_ipv4 20624 11993 -8631 (-41.85%) bpf_xdp.o tail_lb_ipv4 42673 60855 +18182 (+42.61%) bpf_xdp.o tail_lb_ipv6 87903 108585 +20682 (+23.53%) bpf_xdp.o tail_nodeport_nat_ingress_ipv4 28787 20991 -7796 (-27.08%) bpf_xdp.o tail_nodeport_nat_ingress_ipv6 207593 152012 -55581 (-26.77%) Total progs: 134 Old success: 134 New success: 134 total_insns diff min: -65.59% total_insns diff max: 42.61% 0 -> value: 0 value -> 0: 0 total_insns abs max old: 207,593 total_insns abs max new: 152,012 -70 .. -60 %: 1 -50 .. -40 %: 7 -40 .. -30 %: 9 -30 .. -25 %: 9 -25 .. -20 %: 12 -20 .. -15 %: 7 -15 .. -10 %: 14 -10 .. -5 %: 6 -5 .. 0 %: 16 0 .. 5 %: 42 5 .. 15 %: 5 15 .. 25 %: 2 25 .. 35 %: 2 35 .. 45 %: 2 ==================== Link: https://patch.msgid.link/20260410-patch-set-v4-0-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit 70cf146a674c447753ceeb34246ad0afdd0064bb Author: Jacob Moroni Date: Thu Apr 9 15:01:23 2026 +0000 PCI/P2PDMA: Add Google SoCs to the P2P DMA host bridge list All Google SoCs support peer-to-peer DMA between Root Ports, so add a wildcard rule to the host bridge list. Signed-off-by: Jacob Moroni Signed-off-by: Bjorn Helgaas Tested-by: David Hu Reviewed-by: Logan Gunthorpe Link: https://patch.msgid.link/20260409150123.3538444-2-jmoroni@google.com commit 1a1f96e3e2a8dc1774c626bc6e15944c3e160393 Author: Jacob Moroni Date: Thu Apr 9 15:01:22 2026 +0000 PCI/P2PDMA: Allow wildcard Device IDs in host bridge list Currently, the pci_p2pdma_whitelist array requires an exact match for both Vendor and Device ID. Some hardware vendors support cross bridge peer-to-peer DMA across their entire silicon lineup, so add support for wildcard device IDs to avoid the need to continuously update this array. Signed-off-by: Jacob Moroni Signed-off-by: Bjorn Helgaas Reviewed-by: Logan Gunthorpe Link: https://patch.msgid.link/20260409150123.3538444-1-jmoroni@google.com commit bf9a38803b2626b01cc769aaf13485d8650f576f Author: Mashiro Chen Date: Wed Apr 8 01:31:01 2026 +0800 net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf sixpack_receive_buf() does not properly skip bytes with TTY error flags. The while loop iterates through the flags buffer but never advances the data pointer (cp), and passes the original count (including error bytes) to sixpack_decode(). This causes sixpack_decode() to process bytes that should have been skipped due to TTY errors. The TTY layer does not guarantee that cp[i] holds a meaningful value when fp[i] is set, so passing those positions to sixpack_decode() results in KMSAN reporting an uninit-value read. Fix this by processing bytes one at a time, advancing cp on each iteration, and only passing valid (non-error) bytes to sixpack_decode(). This matches the pattern used by slip_receive_buf() and mkiss_receive_buf() for the same purpose. Reported-by: syzbot+ecdb8c9878a81eb21e54@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ecdb8c9878a81eb21e54 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Mashiro Chen Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260407173101.107352-1-mashiro.chen@mailbox.org Signed-off-by: Jakub Kicinski commit 2cb27158adb38f1a78729e99f7469199d71c714a Author: Alexei Starovoitov Date: Fri Apr 10 13:56:05 2026 -0700 bpf: poison dead stack slots As a sanity check poison stack slots that stack liveness determined to be dead, so that any read from such slots will cause program rejection. If stack liveness logic is incorrect the poison can cause valid program to be rejected, but it also will prevent unsafe program to be accepted. Allow global subprogs "read" poisoned stack slots. The static stack liveness determined that subprog doesn't read certain stack slots, but sizeof(arg_type) based global subprog validation isn't accurate enough to know which slots will actually be read by the callee, so it needs to check full sizeof(arg_type) at the caller. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-14-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit 27417e5eb9cd4151320866e0b2cca0c612f1cdf7 Author: Alexei Starovoitov Date: Fri Apr 10 13:56:04 2026 -0700 selftests/bpf: add new tests for static stack liveness analysis Add a bunch of new tests to verify the static stack liveness analysis. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-13-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit 957c30c06748ffe8ab20c242f1a5506447436d6e Author: Alexei Starovoitov Date: Fri Apr 10 13:56:03 2026 -0700 selftests/bpf: adjust verifier_log buffers The new liveness analysis in liveness.c adds verbose output at BPF_LOG_LEVEL2, making the verifier log for good_prog exceed the 1024-byte reference buffer. When the reference is truncated in fixed mode, the rolling mode captures the actual tail of the full log, which doesn't match the truncated reference. The fix is to increase the buffer sizes in the test. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-12-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit b42eb55f6ca29d9cc9d2239f8665cca5f16efecb Author: Alexei Starovoitov Date: Fri Apr 10 13:56:02 2026 -0700 selftests/bpf: update existing tests due to liveness changes The verifier cleans all dead registers and stack slots in the current state. Adjust expected output in tests or insert dummy stack/register reads. Also update verifier_live_stack tests to adhere to new logging scheme. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-11-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit 2c167d91775b0928eba1d2b9b5483ede63ca7b2e Author: Eduard Zingerman Date: Fri Apr 10 13:56:01 2026 -0700 bpf: change logging scheme for live stack analysis Instead of breadcrumbs like: (d2,cs15) frame 0 insn 18 +live -16 (d2,cs15) frame 0 insn 17 +live -16 Print final accumulated stack use/def data per-func_instance per-instruction. printed func_instance's are ordered by callsite and depth. For example: stack use/def subprog#0 shared_instance_must_write_overwrite (d0,cs0): 0: (b7) r1 = 1 1: (7b) *(u64 *)(r10 -8) = r1 ; def: fp0-8 2: (7b) *(u64 *)(r10 -16) = r1 ; def: fp0-16 3: (bf) r1 = r10 4: (07) r1 += -8 5: (bf) r2 = r10 6: (07) r2 += -16 7: (85) call pc+7 ; use: fp0-8 fp0-16 8: (bf) r1 = r10 9: (07) r1 += -16 10: (bf) r2 = r10 11: (07) r2 += -8 12: (85) call pc+2 ; use: fp0-8 fp0-16 13: (b7) r0 = 0 14: (95) exit stack use/def subprog#1 forwarding_rw (d1,cs7): 15: (85) call pc+1 ; use: fp0-8 fp0-16 16: (95) exit stack use/def subprog#1 forwarding_rw (d1,cs12): 15: (85) call pc+1 ; use: fp0-8 fp0-16 16: (95) exit stack use/def subprog#2 write_first_read_second (d2,cs15): 17: (7a) *(u64 *)(r1 +0) = 42 18: (79) r0 = *(u64 *)(r2 +0) ; use: fp0-8 fp0-16 19: (95) exit For groups of three or more consecutive stack slots, abbreviate as follows: 25: (85) call bpf_loop#181 ; use: fp2-8..-512 fp1-8..-512 fp0-8..-512 Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-10-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit 6762e3a0bce5fce94bca3c34ff13cde6a07b87f3 Author: Eduard Zingerman Date: Fri Apr 10 13:56:00 2026 -0700 bpf: simplify liveness to use (callsite, depth) keyed func_instances Rework func_instance identification and remove the dynamic liveness API, completing the transition to fully static stack liveness analysis. Replace callchain-based func_instance keys with (callsite, depth) pairs. The full callchain (all ancestor callsites) is no longer part of the hash key; only the immediate callsite and the call depth matter. This does not lose precision in practice and simplifies the data structure significantly: struct callchain is removed entirely, func_instance stores just callsite, depth. Drop must_write_acc propagation. Previously, must_write marks were accumulated across successors and propagated to the caller via propagate_to_outer_instance(). Instead, callee entry liveness (live_before at subprog start) is pulled directly back to the caller's callsite in analyze_subprog() after each callee returns. Since (callsite, depth) instances are shared across different call chains that invoke the same subprog at the same depth, must_write marks from one call may be stale for another. To handle this, analyze_subprog() records into a fresh_instance() when the instance was already visited (must_write_initialized), then merge_instances() combines the results: may_read is unioned, must_write is intersected. This ensures only slots written on ALL paths through all call sites are marked as guaranteed writes. This replaces commit_stack_write_marks() logic. Skip recursive descent into callees that receive no FP-derived arguments (has_fp_args() check). This is needed because global subprogram calls can push depth beyond MAX_CALL_FRAMES (max depth is 64 for global calls but only 8 frames are accommodated for FP passing). It also handles the case where a callback subprog cannot be determined by argument tracking: such callbacks will be processed by analyze_subprog() at depth 0 independently. Update lookup_instance() (used by is_live_before queries) to search for the func_instance with maximal depth at the corresponding callsite, walking depth downward from frameno to 0. This accounts for the fact that instance depth no longer corresponds 1:1 to bpf_verifier_state->curframe, since skipped non-FP calls create gaps. Remove the dynamic public liveness API from verifier.c: - bpf_mark_stack_{read,write}(), bpf_reset/commit_stack_write_marks() - bpf_update_live_stack(), bpf_reset_live_stack_callchain() - All call sites in check_stack_{read,write}_fixed_off(), check_stack_range_initialized(), mark_stack_slot_obj_read(), mark/unmark_stack_slots_{dynptr,iter,irq_flag}() - The per-instruction write mark accumulation in do_check() - The bpf_update_live_stack() call in prepare_func_exit() mark_stack_read() and mark_stack_write() become static functions in liveness.c, called only from the static analysis pass. The func_instance->updated and must_write_dropped flags are removed. Remove spis_single_slot(), spis_one_bit() helpers from bpf_verifier.h as they are no longer used. Signed-off-by: Eduard Zingerman Tested-by: Paul Chaignon Link: https://lore.kernel.org/r/20260410-patch-set-v4-9-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit fed53dbcdb61b0fbb1cf1d5bbd68d10f97aec974 Author: Eduard Zingerman Date: Fri Apr 10 13:55:59 2026 -0700 bpf: record arg tracking results in bpf_liveness masks After arg tracking reaches a fixed point, perform a single linear scan over the converged at_in[] state and translate each memory access into liveness read/write masks on the func_instance: - Load/store instructions: FP-derived pointer's frame and offset(s) are converted to half-slot masks targeting per_frame_masks->{may_read,must_write} - Helper/kfunc calls: record_call_access() queries bpf_helper_stack_access_bytes() / bpf_kfunc_stack_access_bytes() for each FP-derived argument to determine access size and direction. Unknown access size (S64_MIN) conservatively marks all slots from fp_off to fp+0 as read. - Imprecise pointers (frame == ARG_IMPRECISE): conservatively mark all slots in every frame covered by the pointer's frame bitmask as fully read. - Static subprog calls with unresolved arguments: conservatively mark all frames as fully read. Instead of a call to clean_live_states(), start cleaning the current state continuously as registers and stack become dead since the static analysis provides complete liveness information. This makes clean_live_states() and bpf_verifier_state->cleaned unnecessary. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-8-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit bf0c571f7feb6fa05a512e2a5e50702501849d61 Author: Eduard Zingerman Date: Fri Apr 10 13:55:58 2026 -0700 bpf: introduce forward arg-tracking dataflow analysis The analysis is a basis for static liveness tracking mechanism introduced by the next two commits. A forward fixed-point analysis that tracks which frame's FP each register value is derived from, and at what byte offset. This is needed because a callee can receive a pointer to its caller's stack frame (e.g. r1 = fp-16 at the call site), then do *(u64 *)(r1 + 0) inside the callee — a cross-frame stack access that the callee's local liveness must attribute to the caller's stack. Each register holds an arg_track value from a three-level lattice: - Precise {frame=N, off=[o1,o2,...]} — known frame index and up to 4 concrete byte offsets - Offset-imprecise {frame=N, off_cnt=0} — known frame, unknown offset - Fully-imprecise {frame=ARG_IMPRECISE, mask=bitmask} — unknown frame, mask says which frames might be involved At CFG merge points the lattice moves toward imprecision (same frame+offset stays precise, same frame different offsets merges offset sets or becomes offset-imprecise, different frames become fully-imprecise with OR'd bitmask). The analysis also tracks spills/fills to the callee's own stack (at_stack_in/out), so FP derived values spilled and reloaded. This pass is run recursively per call site: when subprog A calls B with specific FP-derived arguments, B is re-analyzed with those entry args. The recursion follows analyze_subprog -> compute_subprog_args -> (for each call insn) -> analyze_subprog. Subprogs that receive no FP-derived args are skipped during recursion and analyzed independently at depth 0. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-7-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit 8d3219f64d98f4b6591063b15bfe102937b585be Author: Eduard Zingerman Date: Fri Apr 10 13:55:57 2026 -0700 bpf: prepare liveness internal API for static analysis pass Move the `updated` check and reset from bpf_update_live_stack() into update_instance() itself, so callers outside the main loop can reuse it. Similarly, move write_insn_idx assignment out of reset_stack_write_marks() into its public caller, and thread insn_idx as a parameter to commit_stack_write_marks() instead of reading it from liveness->write_insn_idx. Drop the unused `env` parameter from alloc_frame_masks() and mark_stack_read(). Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-6-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit be23266b4a08540aa43d8503a2ea10247c8daebe Author: Eduard Zingerman Date: Fri Apr 10 13:55:56 2026 -0700 bpf: 4-byte precise clean_verifier_state Migrate clean_verifier_state() and its liveness queries from 8-byte SPI granularity to 4-byte half-slot granularity. In __clean_func_state(), each SPI is cleaned in two independent halves: - half_spi 2*i (lo): slot_type[0..3] - half_spi 2*i+1 (hi): slot_type[4..7] Slot types STACK_DYNPTR, STACK_ITER and STACK_IRQ_FLAG are never cleaned, as their slot type markers are required by destroy_if_dynptr_stack_slot(), is_iter_reg_valid_uninit() and is_irq_flag_reg_valid_uninit() for correctness. When only the hi half is dead, spilled_ptr metadata is destroyed and the lo half's STACK_SPILL bytes are downgraded to STACK_MISC or STACK_ZERO. When only the lo half is dead, spilled_ptr is preserved because the hi half may still need it for state comparison. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-5-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit 7ca5f68cda073a6c4aa6135e98a27c7b2a731cdd Author: Eduard Zingerman Date: Fri Apr 10 13:55:55 2026 -0700 bpf: make liveness.c track stack with 4-byte granularity Convert liveness bitmask type from u64 to spis_t, doubling the number of trackable stack slots from 64 to 128 to support 4-byte granularity. Each 8-byte SPI now maps to two consecutive 4-byte sub-slots in the bitmask: spi*2 half and spi*2+1 half. In verifier.c, check_stack_write_fixed_off() now reports 4-byte aligned writes of 4-byte writes as half-slot marks and 8-byte aligned 8-byte writes as two slots. Similar logic applied in check_stack_read_fixed_off(). Queries (is_live_before) are not yet migrated to half-slot granularity. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-4-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit 2ad45b414b8779ba5c50f746fd767926cccde729 Author: Alexei Starovoitov Date: Fri Apr 10 13:55:54 2026 -0700 bpf: Add spis_*() helpers for 4-byte stack slot bitmasks Add helper functions for manipulating u64[2] bitmasks that represent 4-byte stack slot liveness. The 512-byte BPF stack is divided into 128 4-byte slots, requiring 128 bits (two u64s) to track. These will be used by the static stack liveness analysis in the next commit. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-3-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit cf3ee1ecf3466ddb978a58df9d5b638e7dff673d Author: Eduard Zingerman Date: Fri Apr 10 13:55:53 2026 -0700 bpf: save subprogram name in bpf_subprog_info Subprogram name can be computed from function info and BTF, but it is convenient to have the name readily available for logging purposes. Update comment saying that bpf_subprog_info->start has to be the first field, this is no longer true, relevant sites access .start field by it's name. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-2-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit 33dfc521c20d02375c8696dcace04037d2a865e6 Author: Eduard Zingerman Date: Fri Apr 10 13:55:52 2026 -0700 bpf: share several utility functions as internal API Namely: - bpf_subprog_is_global - bpf_vlog_alignment Acked-by: Mykyta Yatsenko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260410-patch-set-v4-1-5d4eecb343db@gmail.com Signed-off-by: Alexei Starovoitov commit 0ba8e918c7ab6a008bd06d579ed077df2da55a31 Merge: b5bfa8a92161da af62a095eb0c33 Author: Linus Walleij Date: Fri Apr 10 23:52:26 2026 +0200 Merge tag 'spacemit-dt-for-7.1-1' of https://github.com/spacemit-com/linux into soc/dt RISC-V SpacemiT DT changes for 7.1 For K3 SoC - Add I2C support - Add PMIC regulator tree - Add ethernet support - Add pinctrl/GPIO/Clock - Enable full UART support For K1 SoC On Milk-V Jupiter - Enable PCIe/USB on - Enable QSPI/SPI NOR - Enable EEPROM, LEDs Others - Fix PMIC supply properties - Fix PCIe missing power regulator * tag 'spacemit-dt-for-7.1-1' of https://github.com/spacemit-com/linux: dts: riscv: spacemit: k3: add P1 PMIC regulator tree dts: riscv: spacemit: k3: Add i2c nodes riscv: dts: spacemit: enable PCIe ports on Milk-V Jupiter riscv: dts: spacemit: enable USB 3 ports on Milk-V Jupiter riscv: dts: spacemit: enable QSPI and add SPI NOR on Milk-V Jupiter riscv: dts: spacemit: add i2c aliases on Milk-V Jupiter riscv: dts: spacemit: add 24c04 eeprom on Milk-V Jupiter riscv: dts: spacemit: add LEDs for Milk-V Jupiter board riscv: dts: spacemit: Add ethernet device for K3 riscv: dts: spacemit: drop incorrect pinctrl for combo PHY riscv: dts: spacemit: reorder phy nodes for K1 riscv: dts: spacemit: k3: add full resource to UART riscv: dts: spacemit: k3: add GPIO support riscv: dts: spacemit: k3: add pinctrl support riscv: dts: spacemit: k3: add clock tree dt-bindings: serial: 8250: spacemit: fix clock property for K3 SoC riscv: dts: spacemit: Add 'linux,pci-domain' to PCIe nodes for K1 riscv: dts: spacemit: adapt regulator node name to preferred form riscv: dts: spacemit: Update PMIC supply properties for BPI-F3 and Jupiter riscv: dts: spacemit: pcie: fix missing power regulator Signed-off-by: Linus Walleij commit e43f2df330a1b87c97235e4faade860d15787735 Author: Arun T Date: Fri Apr 10 13:34:08 2026 +0530 i2c: usbio: Add ACPI device-id for NVL platforms Add device IDs of Nova Lake into i2c-usbio support list Signed-off-by: Arun T Reviewed-by: Vadillo Miguel Reviewed-by: Sakari Ailus Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260410080408.562311-1-arun.t@intel.com commit 656147fb1d4ce047a3889d1b9539cdec0327cc16 Author: Aniket Randive Date: Fri Apr 10 15:49:49 2026 +0530 i2c: qcom-geni: Avoid extra TX DMA TRE for single read message in GPI mode In GPI mode, the I2C GENI driver programs an extra TX DMA transfer descriptor (TRE) on the TX channel when handling a single read message. This results in an unintended write phase being issued on the I2C bus, even though a read transaction does not require any TX data. For a single-byte read, the correct hardware sequence consists of the CONFIG and GO commands followed by a single RX DMA TRE. Programming an additional TX DMA TRE is redundant, causes unnecessary DMA buffer mapping on the TX channel, and may lead to incorrect bus behavior. Update the transfer logic to avoid programming a TX DMA TRE for single read messages in GPI mode. Co-developed-by: Maramaina Naresh Signed-off-by: Maramaina Naresh Signed-off-by: Aniket Randive Reviewed-by: Mukesh Kumar Savaliya Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260410101949.2315058-1-aniket.randive@oss.qualcomm.com commit 749b925802c2351ae7204e6960ca086e4c4e4fa7 Merge: aacee214d57636 0e4dc6fbddb01b Author: Alexei Starovoitov Date: Fri Apr 10 12:34:36 2026 -0700 Merge branch 'selftests-bpf-test-btf-sanitization' Alan Maguire says: ==================== selftests/bpf: Test BTF sanitization Allow simulation of missing BPF features through provision of a synthetic feature cache set, and use this to simulate case where FEAT_BTF_LAYOUT is missing. Ensure sanitization leaves us with expected BTF (layout info removed, layout header fields zeroed, strings data adjusted). Specifying a feature cache with selected missing features will allow testing of other missing feature codepaths, but for now add BTF layout sanitization test only. Changes since v2 [1]: - change zfree() to free() since we immediately assign the feat_cache (Jiri, patch 1) - "goto out" to avoid skeleton leak (Chengkaitao, patch 2) - just use kfree_skb__open() since we do not need to load skeleton Changes since v1 [2]: - renamed to bpf_object_set_feat_cache() (Andrii, patch 1) - remove __packed, relocate skeleton open/load, fix formatting issues (Andrii, patch 2) [1] https://lore.kernel.org/bpf/20260408105324.663280-1-alan.maguire@oracle.com/ [2] https://lore.kernel.org/bpf/20260401164302.3844142-1-alan.maguire@oracle.com/ ==================== Link: https://patch.msgid.link/20260408165735.843763-1-alan.maguire@oracle.com Signed-off-by: Alexei Starovoitov commit 0e4dc6fbddb01b2ce0d0b4d67ad5f70e976bedcc Author: Alan Maguire Date: Wed Apr 8 17:57:35 2026 +0100 selftests/bpf: Add BTF sanitize test covering BTF layout Add test that fakes up a feature cache of supported BPF features to simulate an older kernel that does not support BTF layout information. Ensure that BTF is sanitized correctly to remove layout info between types and strings, and that all offsets and lengths are adjusted appropriately. Signed-off-by: Alan Maguire Link: https://lore.kernel.org/r/20260408165735.843763-3-alan.maguire@oracle.com Signed-off-by: Alexei Starovoitov commit 7419fcadd1dcd5efb5771a2725f9a80dc90d9e5a Author: Alan Maguire Date: Wed Apr 8 17:57:34 2026 +0100 libbpf: Allow use of feature cache for non-token cases Allow bpf object feat_cache assignment in BPF selftests to simulate missing features via inclusion of libbpf_internal.h and use of bpf_object_set_feat_cache() and bpf_object__sanitize_btf() to test BTF sanitization for cases where missing features are simulated. Signed-off-by: Alan Maguire Link: https://lore.kernel.org/r/20260408165735.843763-2-alan.maguire@oracle.com Signed-off-by: Alexei Starovoitov commit aacee214d57636fa1f63007c65f333b5ea75a7a0 Author: Venkat Rao Bagalkote Date: Fri Apr 10 16:24:04 2026 +0530 selftests/bpf: Remove test_access_variable_array test_access_variable_array relied on accessing struct sched_domain::span to validate variable-length array handling via BTF. Recent scheduler refactoring removed or hid this field, causing the test to fail to build. Given that this test depends on internal scheduler structures that are subject to refactoring, and equivalent variable-length array coverage already exists via bpf_testmod-based tests, remove test_access_variable_array entirely. Link: https://lore.kernel.org/all/177434340048.1647592.8586759362906719839.tip-bot2@tip-bot2/ Signed-off-by: Venkat Rao Bagalkote Tested-by: Naveen Kumar Thummalapenta Link: https://lore.kernel.org/r/20260410105404.91126-1-venkat88@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 3c443ec743422442229a9c93ac6e4e5d188bc41a Author: Paolo Bonzini Date: Tue Apr 7 19:59:34 2026 +0200 vfio: remove dead notifier code group->notifier is dead code. VFIO initializes it and checks it for emptiness on teardown, but nobody ever registers on it or triggers it. Signed-off-by: Paolo Bonzini Acked-by: Anthony Krowiak Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20260407175934.1602711-1-pbonzini@redhat.com Signed-off-by: Alex Williamson commit 4406942e65ca128c56c67443832988873c21d2e9 Author: Sechang Lim Date: Tue Apr 7 10:38:23 2026 +0000 bpf: Fix RCU stall in bpf_fd_array_map_clear() Add a missing cond_resched() in bpf_fd_array_map_clear() loop. For PROG_ARRAY maps with many entries this loop calls prog_array_map_poke_run() per entry which can be expensive, and without yielding this can cause RCU stalls under load: rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 30932 Comm: kworker/0:2 Not tainted 6.14.0-13195-g967e8def1100 #2 PREEMPT(undef) Workqueue: events prog_array_map_clear_deferred RIP: 0010:write_comp_data+0x38/0x90 kernel/kcov.c:246 Call Trace: prog_array_map_poke_run+0x77/0x380 kernel/bpf/arraymap.c:1096 __fd_array_map_delete_elem+0x197/0x310 kernel/bpf/arraymap.c:925 bpf_fd_array_map_clear kernel/bpf/arraymap.c:1000 [inline] prog_array_map_clear_deferred+0x119/0x1b0 kernel/bpf/arraymap.c:1141 process_one_work+0x898/0x19d0 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x770/0x10b0 kernel/workqueue.c:3400 kthread+0x465/0x880 kernel/kthread.c:464 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x19/0x30 arch/x86/entry/entry_64.S:245 Reviewed-by: Sun Jian Fixes: da765a2f5993 ("bpf: Add poke dependency tracking for prog array maps") Signed-off-by: Sechang Lim Link: https://lore.kernel.org/r/20260407103823.3942156-1-rhkrqnwk98@gmail.com Signed-off-by: Alexei Starovoitov commit ae1a82e5112e568f66cbbf2a15ea103940138dee Merge: a0c584fc180567 4cbee026db54ca Author: Alexei Starovoitov Date: Fri Apr 10 12:05:16 2026 -0700 Merge branch 'bpf-fix-and-improve-open-coded-task_vma-iterator' Puranjay Mohan says: ==================== bpf: fix and improve open-coded task_vma iterator Changelog: v5: https://lore.kernel.org/all/20260326151111.4002475-1-puranjay@kernel.org/ Changes in v6: - Replace local_irq_disable() + get_task_mm() with spin_trylock() on alloc_lock to avoid a softirq deadlock: if the target task holds its alloc_lock and gets interrupted, a softirq BPF program iterating that task would deadlock on task_lock() (Gemini) - Gate on CONFIG_MMU in patch 1 so that the mmput() fallback in bpf_iter_mmput_async() cannot sleep in non-sleepable BPF context on NOMMU; patch 2 tightens this to CONFIG_PER_VMA_LOCK (Gemini) - Merge the split if (irq_work_busy) / if (!mmap_read_trylock()) back into a single if statement in patch 1 (Andrii) - Flip comparison direction in bpf_iter_task_vma_find_next() so both the locked and unlocked VMA failure cases read consistently: end <= next_addr → PAGE_SIZE, else - use end (Andrii) - Add Acked-by from Andrii on patch 3 v4: https://lore.kernel.org/all/20260316185736.649940-1-puranjay@kernel.org/ Changes in v5: - Use get_task_mm() instead of a lockless task->mm read followed by mmget_not_zero() to fix a use-after-free: mm_struct is not SLAB_TYPESAFE_BY_RCU, so the lockless pointer can go stale (AI) - Add a local bpf_iter_mmput_async() wrapper with #ifdef CONFIG_MMU to avoid modifying fork.c and sched/mm.h outside the BPF tree - Drop the fork.c and sched/mm.h changes that widened the mmput_async() #if guard - Disable IRQs around get_task_mm() to prevent raw tracepoint re-entrancy from deadlocking on task_lock() v3: https://lore.kernel.org/all/20260311225726.808332-1-puranjay@kernel.org/ Changes in v4: - Disable task_vma iterator in irq_disabled() contexts to mitigate deadlocks (Alexei) - Use a helper function to reset the snapshot (Andrii) - Remove the redundant snap->vm_mm = kit->data->mm; (Andrii) - Remove all irq_work deferral as the iterator will not work in irq_disabled() sections anymore and _new() will return -EBUSY early. v2: https://lore.kernel.org/all/20260309155506.23490-1-puranjay@kernel.org/ Changes in v3: - Remove the rename patch 1 (Andrii) - Put the irq_work in the iter data, per-cpu slot is not needed (Andrii) - Remove the unnecessary !in_hardirq() in the deferral path (Alexei) - Use PAGE_SIZE advancement in case vma shrinks back to maintain the forward progress guarantee (AI) v1: https://lore.kernel.org/all/20260304142026.1443666-1-puranjay@kernel.org/ Changes in v2: - Add a preparatory patch to rename mmap_unlock_irq_work to bpf_iter_mm_irq_work (Mykyta) - Fix bpf_iter_mmput() to also defer for IRQ disabled regions (Alexei) - Fix a build issue where mmpu_async() is not available without CONFIG_MMU (kernel test robot) - Reuse mmap_unlock_irq_work (after rename) for mmput (Mykyta) - Move vma lookup (retry block) to a separate function (Mykyta) This series fixes the mm lifecycle handling in the open-coded task_vma BPF iterator and switches it from mmap_lock to per-VMA locking to reduce contention. It then fixes a deadlock that is caused by holding locks accross the body of the iterator where faulting is allowed. Patch 1 fixes a use-after-free where task->mm was read locklessly and could be freed before the iterator used it. It uses a trylock on alloc_lock to safely read task->mm and acquire an mm reference, and disables the iterator in irq_disabled() contexts by returning -EBUSY from _new(). Patch 2 switches from holding mmap_lock for the entire iteration to per-VMA locking via lock_vma_under_rcu(). This still doesn't fix the deadlock problem because holding the per-vma lock for the whole iteration can still cause lock ordering issues when a faultable helper is called in the body of the iterator. Patch 3 resolves the lock ordering problems caused by holding the per-VMA lock or the mmap_lock (not applicable after patch 2) across BPF program execution. It snapshots VMA fields under the lock, then drops the lock before returning to the BPF program. File references are managed via get_file()/fput() across iterations. ==================== Link: https://patch.msgid.link/20260408154539.3832150-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 4cbee026db54cad39c39db4d356100cb133412b3 Author: Puranjay Mohan Date: Wed Apr 8 08:45:37 2026 -0700 bpf: return VMA snapshot from task_vma iterator Holding the per-VMA lock across the BPF program body creates a lock ordering problem when helpers acquire locks that depend on mmap_lock: vm_lock -> i_rwsem -> mmap_lock -> vm_lock Snapshot the VMA under the per-VMA lock in _next() via memcpy(), then drop the lock before returning. The BPF program accesses only the snapshot. The verifier only trusts vm_mm and vm_file pointers (see BTF_TYPE_SAFE_TRUSTED_OR_NULL in verifier.c). vm_file is reference- counted with get_file() under the lock and released via fput() on the next iteration or in _destroy(). vm_mm is already correct because lock_vma_under_rcu() verifies vma->vm_mm == mm. All other pointers are left as-is by memcpy() since the verifier treats them as untrusted. Fixes: 4ac454682158 ("bpf: Introduce task_vma open-coded iterator kfuncs") Signed-off-by: Puranjay Mohan Acked-by: Andrii Nakryiko Acked-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260408154539.3832150-4-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit bee9ef4a40a277bf401be43d39ba7f7f063cf39c Author: Puranjay Mohan Date: Wed Apr 8 08:45:36 2026 -0700 bpf: switch task_vma iterator from mmap_lock to per-VMA locks The open-coded task_vma iterator holds mmap_lock for the entire duration of iteration, increasing contention on this highly contended lock. Switch to per-VMA locking. Find the next VMA via an RCU-protected maple tree walk and lock it with lock_vma_under_rcu(). lock_next_vma() is not used because its fallback takes mmap_read_lock(), and the iterator must work in non-sleepable contexts. lock_vma_under_rcu() is a point lookup (mas_walk) that finds the VMA containing a given address but cannot iterate across gaps. An RCU-protected vma_next() walk (mas_find) first locates the next VMA's vm_start to pass to lock_vma_under_rcu(). Between the RCU walk and the lock, the VMA may be removed, shrunk, or write-locked. On failure, advance past it using vm_end from the RCU walk. Because the VMA slab is SLAB_TYPESAFE_BY_RCU, vm_end may be stale; fall back to PAGE_SIZE advancement when it does not make forward progress. Concurrent VMA insertions at addresses already passed by the iterator are not detected. CONFIG_PER_VMA_LOCK is required; return -EOPNOTSUPP without it. Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20260408154539.3832150-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit d8e27d2d22b6e2df3a0125b8c08e9aace38c954c Author: Puranjay Mohan Date: Wed Apr 8 08:45:35 2026 -0700 bpf: fix mm lifecycle in open-coded task_vma iterator The open-coded task_vma iterator reads task->mm locklessly and acquires mmap_read_trylock() but never calls mmget(). If the task exits concurrently, the mm_struct can be freed as it is not SLAB_TYPESAFE_BY_RCU, resulting in a use-after-free. Safely read task->mm with a trylock on alloc_lock and acquire an mm reference. Drop the reference via bpf_iter_mmput_async() in _destroy() and error paths. bpf_iter_mmput_async() is a local wrapper around mmput_async() with a fallback to mmput() on !CONFIG_MMU. Reject irqs-disabled contexts (including NMI) up front. Operations used by _next() and _destroy() (mmap_read_unlock, bpf_iter_mmput_async) take spinlocks with IRQs disabled (pool->lock, pi_lock). Running from NMI or from a tracepoint that fires with those locks held could deadlock. A trylock on alloc_lock is used instead of the blocking task_lock() (get_task_mm) to avoid a deadlock when a softirq BPF program iterates a task that already holds its alloc_lock on the same CPU. Fixes: 4ac454682158 ("bpf: Introduce task_vma open-coded iterator kfuncs") Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20260408154539.3832150-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 0baba94a9779c13c857f6efc55807e6a45b1d4e4 Author: Catalin Marinas Date: Tue Apr 7 11:28:44 2026 +0100 arm64: errata: Work around early CME DVMSync acknowledgement C1-Pro acknowledges DVMSync messages before completing the SME/CME memory accesses. Work around this by issuing an IPI to the affected CPUs if they are running in EL0 with SME enabled. Note that we avoid the local DSB in the IPI handler as the kernel runs with SCTLR_EL1.IESB=1. This is sufficient to complete SME memory accesses at EL0 on taking an exception to EL1. On the return to user path, no barrier is necessary either. See the comment in sme_set_active() and the more detailed explanation in the link below. To avoid a potential IPI flood from malicious applications (e.g. madvise(MADV_PAGEOUT) in a tight loop), track where a process is active via mm_cpumask() and only interrupt those CPUs. Link: https://lore.kernel.org/r/ablEXwhfKyJW1i7l@J2N7QTR9R3 Cc: Will Deacon Cc: Mark Rutland Cc: James Morse Cc: Mark Brown Reviewed-by: Will Deacon Signed-off-by: Catalin Marinas commit 2c99561016c591f4c3d5ad7d22a61b8726e79735 Author: Catalin Marinas Date: Tue Apr 7 11:28:43 2026 +0100 arm64: cputype: Add C1-Pro definitions Add cputype definitions for C1-Pro. These will be used for errata detection in subsequent patches. These values can be found in "Table A-303: MIDR_EL1 bit descriptions" in issue 07 of the C1-Pro TRM: https://documentation-service.arm.com/static/6930126730f8f55a656570af Acked-by: Mark Rutland Cc: Will Deacon Cc: James Morse Reviewed-by: Will Deacon Signed-off-by: Catalin Marinas commit d9fb08ba946a6190c371dcd9f9e465d0d52c5021 Author: Catalin Marinas Date: Tue Apr 7 11:28:42 2026 +0100 arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish() The mm structure will be used for workarounds that need limiting to specific tasks. Acked-by: Mark Rutland Cc: Will Deacon Reviewed-by: Will Deacon Signed-off-by: Catalin Marinas commit 6bfbf574a39139da11af9fdf6e8d56fe1989cd3e Author: Catalin Marinas Date: Tue Apr 7 11:28:41 2026 +0100 arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance Add __tlbi_sync_s1ish_kernel() similar to __tlbi_sync_s1ish() and use it for kernel TLB maintenance. Also use this function in flush_tlb_all() which is only used in relation to kernel mappings. Subsequent patches can differentiate between workarounds that apply to user only or both user and kernel. A subsequent patch will add mm_struct to __tlbi_sync_s1ish(). Since arch_tlbbatch_flush() is not specific to an mm, add a corresponding __tlbi_sync_s1ish_batch() helper. Acked-by: Mark Rutland Cc: Will Deacon Reviewed-by: Will Deacon Signed-off-by: Catalin Marinas commit 3939dba00f981c26d1748769f2f28a3cc0afb6a8 Merge: bfbb6cb1b6e408 3624a22783b74f Author: Dave Jiang Date: Fri Apr 10 11:11:53 2026 -0700 Merge branch 'for-7.1/cxl-misc' into cxl-for-next cxl/hdm: Add support for 32 switch decoders commit e719e17d99aaf3922dbc15ae3ac3bb62fac32bad Author: Tejun Heo Date: Fri Apr 10 07:54:06 2026 -1000 sched_ext: Warn on task-based SCX op recursion The kf_tasks[] design assumes task-based SCX ops don't nest - if they did, kf_tasks[0] would get clobbered. The old scx_kf_allow() WARN_ONCE caught invalid nesting via kf_mask, but that machinery is gone now. Add a WARN_ON_ONCE(current->scx.kf_tasks[0]) at the top of each SCX_CALL_OP_TASK*() macro. Checking kf_tasks[0] alone is sufficient: all three variants (SCX_CALL_OP_TASK, SCX_CALL_OP_TASK_RET, SCX_CALL_OP_2TASKS_RET) write to kf_tasks[0], so a non-NULL value at entry to any of the three means re-entry from somewhere in the family. Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit 979a98b6e9bf8ebf11dc3ca260be087606ac4c2c Author: Tejun Heo Date: Fri Apr 10 07:54:06 2026 -1000 sched_ext: Rename scx_kf_allowed_on_arg_tasks() to scx_kf_arg_task_ok() The "kf_allowed" framing on this helper comes from the old runtime scx_kf_allowed() gate, which has been removed. Rename it to describe what it actually does in the new model. Pure rename, no functional change. Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit 7cd9a5d7d4b75802b97aa89f6f53375a6d84d1d5 Author: Cheng-Yang Chou Date: Fri Apr 10 07:54:06 2026 -1000 sched_ext: Remove runtime kfunc mask enforcement Now that scx_kfunc_context_filter enforces context-sensitive kfunc restrictions at BPF load time, the per-task runtime enforcement via scx_kf_mask is redundant. Remove it entirely: - Delete enum scx_kf_mask, the kf_mask field on sched_ext_entity, and the scx_kf_allow()/scx_kf_disallow()/scx_kf_allowed() helpers along with the higher_bits()/highest_bit() helpers they used. - Strip the @mask parameter (and the BUILD_BUG_ON checks) from the SCX_CALL_OP[_RET]/SCX_CALL_OP_TASK[_RET]/SCX_CALL_OP_2TASKS_RET macros and update every call site. Reflow call sites that were wrapped only to fit the old 5-arg form and now collapse onto a single line under ~100 cols. - Remove the in-kfunc scx_kf_allowed() runtime checks from scx_dsq_insert_preamble(), scx_dsq_move(), scx_bpf_dispatch_nr_slots(), scx_bpf_dispatch_cancel(), scx_bpf_dsq_move_to_local___v2(), scx_bpf_sub_dispatch(), scx_bpf_reenqueue_local(), and the per-call guard inside select_cpu_from_kfunc(). scx_bpf_task_cgroup() and scx_kf_allowed_on_arg_tasks() were already cleaned up in the "drop redundant rq-locked check" patch. scx_kf_allowed_if_unlocked() was rewritten in the preceding "decouple" patch. No further changes to those helpers here. Co-developed-by: Juntong Deng Signed-off-by: Juntong Deng Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit d1d3c1c6ae3691869be9d94730d6e5325aaae8c6 Author: Tejun Heo Date: Fri Apr 10 07:54:06 2026 -1000 sched_ext: Add verifier-time kfunc context filter Move enforcement of SCX context-sensitive kfunc restrictions from per-task runtime kf_mask checks to BPF verifier-time filtering, using the BPF core's struct_ops context information. A shared .filter callback is attached to each context-sensitive BTF set and consults a per-op allow table (scx_kf_allow_flags[]) indexed by SCX ops member offset. Disallowed calls are now rejected at program load time instead of at runtime. The old model split reachability across two places: each SCX_CALL_OP*() set bits naming its op context, and each kfunc's scx_kf_allowed() check OR'd together the bits it accepted. A kfunc was callable when those two masks overlapped. The new model transposes the result to the caller side - each op's allow flags directly list the kfunc groups it may call. The old bit assignments were: Call-site bits: ops.select_cpu = ENQUEUE | SELECT_CPU ops.enqueue = ENQUEUE ops.dispatch = DISPATCH ops.cpu_release = CPU_RELEASE Kfunc-group accepted bits: enqueue group = ENQUEUE | DISPATCH select_cpu group = SELECT_CPU | ENQUEUE dispatch group = DISPATCH cpu_release group = CPU_RELEASE Intersecting them yields the reachability now expressed directly by scx_kf_allow_flags[]: ops.select_cpu -> SELECT_CPU | ENQUEUE ops.enqueue -> SELECT_CPU | ENQUEUE ops.dispatch -> ENQUEUE | DISPATCH ops.cpu_release -> CPU_RELEASE Unlocked ops carried no kf_mask bits and reached only unlocked kfuncs; that maps directly to UNLOCKED in the new table. Equivalence was checked by walking every (op, kfunc-group) combination across SCX ops, SYSCALL, and non-SCX struct_ops callers against the old scx_kf_allowed() runtime checks. With two intended exceptions (see below), all combinations reach the same verdict; disallowed calls are now caught at load time instead of firing scx_error() at runtime. scx_bpf_dsq_move_set_slice() and scx_bpf_dsq_move_set_vtime() are exceptions: they have no runtime check at all, but the new filter rejects them from ops outside dispatch/unlocked. The affected cases are nonsensical - the values these setters store are only read by scx_bpf_dsq_move{,_vtime}(), which is itself restricted to dispatch/unlocked, so a setter call from anywhere else was already dead code. Runtime scx_kf_mask enforcement is left in place by this patch and removed in a follow-up. Original-patch-by: Juntong Deng Original-patch-by: Cheng-Yang Chou Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 2193af26a149acfb7a66f49397665640c2a60d8c Author: Tejun Heo Date: Fri Apr 10 07:54:06 2026 -1000 sched_ext: Drop redundant rq-locked check from scx_bpf_task_cgroup() scx_kf_allowed_on_arg_tasks() runs both an scx_kf_allowed(__SCX_KF_RQ_LOCKED) mask check and a kf_tasks[] check. After the preceding call-site fixes, every SCX_CALL_OP_TASK*() invocation has kf_mask & __SCX_KF_RQ_LOCKED non-zero, so the mask check is redundant whenever the kf_tasks[] check passes. Drop it and simplify the helper to take only @sch and @p. Fold the locking guarantee into the SCX_CALL_OP_TASK() comment block, which scx_bpf_task_cgroup() now points to. No functional change. Extracted from a larger verifier-time kfunc context filter patch originally written by Juntong Deng. Original-patch-by: Juntong Deng Cc: Cheng-Yang Chou Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 0022b328504d1055be57eecf9e02c00e2ddcb0a2 Author: Tejun Heo Date: Fri Apr 10 07:54:06 2026 -1000 sched_ext: Decouple kfunc unlocked-context check from kf_mask scx_kf_allowed_if_unlocked() uses !current->scx.kf_mask as a proxy for "no SCX-tracked lock held". kf_mask is removed in a follow-up patch, so its two callers - select_cpu_from_kfunc() and scx_dsq_move() - need another basis. Add a new bool scx_rq.in_select_cpu, set across the SCX_CALL_OP_TASK_RET that invokes ops.select_cpu(), to capture the one case where SCX itself holds no lock but try_to_wake_up() holds @p's pi_lock. Together with scx_locked_rq(), it expresses the same accepted-context set. select_cpu_from_kfunc() needs a runtime test because it has to take different locking paths depending on context. Open-code as a three-way branch. The unlocked branch takes raw_spin_lock_irqsave(&p->pi_lock) directly - pi_lock alone is enough for the fields the kfunc reads, and is lighter than task_rq_lock(). scx_dsq_move() doesn't really need a runtime test - its accepted contexts could be enforced at verifier load time. But since the runtime state is already there and using it keeps the upcoming load-time filter simpler, just write it the same way: (scx_locked_rq() || in_select_cpu) && !kf_allowed(DISPATCH). scx_kf_allowed_if_unlocked() is deleted with the conversions. No semantic change. v2: s/No functional change/No semantic change/ - the unlocked path now acquires pi_lock instead of the heavier task_rq_lock() (Andrea Righi). Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit b470e37c1fad72731be6f437e233cb6b16618f41 Author: Tejun Heo Date: Fri Apr 10 07:54:06 2026 -1000 sched_ext: Fix ops.cgroup_move() invocation kf_mask and rq tracking sched_move_task() invokes ops.cgroup_move() inside task_rq_lock(tsk), so @p's rq lock is held. The SCX_CALL_OP_TASK invocation mislabels this: - kf_mask = SCX_KF_UNLOCKED (== 0), claiming no lock is held. - rq = NULL, so update_locked_rq() doesn't run and scx_locked_rq() returns NULL. Switch to SCX_KF_REST and pass task_rq(p), matching ops.set_cpumask() from set_cpus_allowed_scx(). Three effects: - scx_bpf_task_cgroup() becomes callable (was rejected by scx_kf_allowed(__SCX_KF_RQ_LOCKED)). Safe; rq lock is held. - scx_bpf_dsq_move() is now rejected (was allowed via the unlocked branch). Calling it while holding an unrelated task's rq lock is risky; rejection is correct. - scx_bpf_select_cpu_*() previously took the unlocked branch in select_cpu_from_kfunc() and called task_rq_lock(p, &rf), which would deadlock against the already-held pi_lock. Now it takes the locked-rq branch and is rejected with -EPERM via the existing kf_allowed(SCX_KF_SELECT_CPU | SCX_KF_ENQUEUE) check. Latent deadlock fix. No in-tree scheduler is known to call any of these from ops.cgroup_move(). v2: Add Fixes: tag (Andrea Righi). Fixes: 18853ba782be ("sched_ext: Track currently locked rq") Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 9fb457074f6d118b30458624223abef985725a88 Author: Tejun Heo Date: Fri Apr 10 07:54:06 2026 -1000 sched_ext: Track @p's rq lock across set_cpus_allowed_scx -> ops.set_cpumask The SCX_CALL_OP_TASK call site passes rq=NULL incorrectly, leaving scx_locked_rq() unset. Pass task_rq(p) instead so update_locked_rq() reflects reality. v2: Add Fixes: tag (Andrea Righi). Fixes: 18853ba782be ("sched_ext: Track currently locked rq") Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit a37e134317c68941fb3e0a4890d95de41eac63f5 Author: Tejun Heo Date: Fri Apr 10 07:54:06 2026 -1000 sched_ext: Add select_cpu kfuncs to scx_kfunc_ids_unlocked select_cpu_from_kfunc() has an extra scx_kf_allowed_if_unlocked() branch that accepts calls from unlocked contexts and takes task_rq_lock() itself - a "callable from unlocked" property encoded in the kfunc body rather than in set membership. That's fine while the runtime check is the authoritative gate, but the upcoming verifier-time filter uses set membership as the source of truth and needs it to reflect every context the kfunc may be called from. Add the three select_cpu kfuncs to scx_kfunc_ids_unlocked so their full set of callable contexts is captured by set membership. This follows the existing dual-set convention used by scx_bpf_dsq_move{,_vtime} and scx_bpf_dsq_move_set_{slice,vtime}, which are members of both scx_kfunc_ids_dispatch and scx_kfunc_ids_unlocked. While at it, add brief comments on each duplicate BTF_ID_FLAGS block (including the pre-existing dsq_move ones) explaining the dual membership. No runtime behavior change: the runtime check in select_cpu_from_kfunc() remains the authoritative gate until it is removed along with the rest of the scx_kf_mask enforcement in a follow-up. v2: Clarify dispatch-set comment to name scx_bpf_dsq_move*() explicitly so it doesn't appear to cover scx_bpf_sub_dispatch() (Andrea Righi). Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 9b5501d3c95924198914f3df920faae1594e68d5 Author: Tejun Heo Date: Fri Apr 10 07:54:06 2026 -1000 sched_ext: Drop TRACING access to select_cpu kfuncs The select_cpu kfuncs - scx_bpf_select_cpu_dfl(), scx_bpf_select_cpu_and() and __scx_bpf_select_cpu_and() - take task_rq_lock() internally. Exposing them via scx_kfunc_set_idle to BPF_PROG_TYPE_TRACING is unsafe: arbitrary tracing contexts (kprobes, tracepoints, fentry, LSM) may run with @p's pi_lock state unknown. Move them out of scx_kfunc_ids_idle into a new scx_kfunc_ids_select_cpu set registered only for STRUCT_OPS and SYSCALL. Extracted from a larger verifier-time kfunc context filter patch originally written by Juntong Deng. Original-patch-by: Juntong Deng Cc: Cheng-Yang Chou Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 7866ce992cf0d3c3b50fe8bf4acb1dbb173a2304 Author: Miquel Raynal Date: Wed Mar 25 18:04:50 2026 +0100 mtd: spinand: winbond: Declare the QE bit on W25NxxJW Factory default for this bit is "set" (at least on the chips I have), but we must make sure it is actually set by Linux explicitly, as the bit is writable by an earlier stage. Fixes: 6a804fb72de5 ("mtd: spinand: winbond: add support for serial NAND flash") Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal commit 4e03d6494f9504f8af46ba68a2a8b6877c196789 Author: Leo Yan Date: Fri Apr 10 08:37:01 2026 +0100 perf arm_spe: Improve SIMD flags setting Fill in ASE and SME operations for the SIMD arch field. Also set the predicate flags for SVE and SME, but differences between them: SME does not have a predicate flag, so the setting is based on events. SVE provides a predicate flag to indicate whether the predicate is disabled, which allows it to be distinguished into four cases: full predicates, empty predicates, fully predicated, and disabled predicates. After: perf report -s +simd ... 0.06% 0.06% sve-test sve-test [.] setz [p] SVE 0.06% 0.06% sve-test [kernel.kallsyms] [k] do_raw_spin_lock 0.06% 0.06% sve-test sve-test [.] getz [p] SVE 0.06% 0.06% sve-test [kernel.kallsyms] [k] timekeeping_advance 0.06% 0.06% sve-test sve-test [.] getz [d] SVE 0.06% 0.06% sve-test [kernel.kallsyms] [k] update_load_avg 0.06% 0.06% sve-test sve-test [.] getz [e] SVE 0.05% 0.05% sve-test sve-test [.] setz [e] SVE 0.05% 0.05% sve-test [kernel.kallsyms] [k] update_curr 0.05% 0.05% sve-test sve-test [.] setz [d] SVE 0.05% 0.05% sve-test [kernel.kallsyms] [k] do_raw_spin_unlock 0.05% 0.05% sve-test [kernel.kallsyms] [k] timekeeping_update_from_shadow.constprop.0 0.05% 0.05% sve-test sve-test [.] getz [f] SVE 0.05% 0.05% sve-test sve-test [.] setz [f] SVE Reviewed-by: James Clark Reviewed-by: Ian Rogers Signed-off-by: Leo Yan Signed-off-by: Namhyung Kim commit 54940f15269e0a5f6249e8520f81c2b980111f42 Author: Leo Yan Date: Fri Apr 10 08:37:00 2026 +0100 perf report: Update document for SIMD flags Update SIMD architecture and predicate flags. Reviewed-by: James Clark Reviewed-by: Ian Rogers Signed-off-by: Leo Yan Signed-off-by: Namhyung Kim commit 0f648fc245c316d799f853d7ab97f2bfef68d7dd Author: Leo Yan Date: Fri Apr 10 08:36:59 2026 +0100 perf sort: Sort disabled and full predicated flags According to the Arm ARM (ARM DDI 0487, L.a), section D18.2.6 "Events packet", apart from the empty predicate and partial predicates, an SVE or SME operation can be predicate-disabled or full predicated. To provide complete results, introduce two predicate types for these cases. Reviewed-by: James Clark Reviewed-by: Ian Rogers Signed-off-by: Leo Yan Signed-off-by: Namhyung Kim commit faaf70f938236b94b150320e452fe2d577936a42 Author: Leo Yan Date: Fri Apr 10 08:36:58 2026 +0100 perf sort: Support sort ASE and SME Support sort Advance SIMD extension (ASE) and SME. Reviewed-by: James Clark Reviewed-by: Ian Rogers Signed-off-by: Leo Yan Signed-off-by: Namhyung Kim commit 62e02084ab93c31c53dd38f149782ce8349a2d90 Author: Paulo Alcantara Date: Tue Apr 7 19:51:35 2026 -0300 smb: client: set ATTR_TEMPORARY with O_TMPFILE | O_EXCL Set ATTR_TEMPORARY attribute on temporary delete-on-close files when O_EXCL is specified in conjunction with O_TMPFILE to let some servers cache as much data as possible and possibly never persist them into storage, thereby improving performance. Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 3e7d63037a2b1715f70b7454630f3b2b8a922ec8 Author: Paulo Alcantara Date: Tue Apr 7 16:58:10 2026 -0300 smb: client: add support for O_TMPFILE Implement O_TMPFILE support for SMB2+ in the CIFS client. Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: Al Viro Cc: linux-fsdevel@vger.kernel.org Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 30a59dddd688bbd75f54e96b174a7aac914774d2 Author: Paulo Alcantara Date: Tue Apr 7 16:58:09 2026 -0300 vfs: introduce d_mark_tmpfile_name() CIFS requires O_TMPFILE dentries to have names of newly created delete-on-close files in the server so it can build full pathnames from the root of the share when performing operations on them. Suggested-by: Al Viro Signed-off-by: Paulo Alcantara (Red Hat) Cc: Christian Brauner Cc: Jan Kara Cc: David Howells Cc: Matthew Wilcox Cc: linux-fsdevel@vger.kernel.org Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 158f4ff1b809e71a37ea46a6726bbc50b5112221 Author: Steve French Date: Wed Apr 8 09:21:06 2026 -0500 MAINTAINERS: create entry for smbdirect Create entry for the client and server smbdirect code and the new smbdirect module, and add Metze as reviewer. Acked-by: Namjae Jeon Signed-off-by: Steve French commit bc1a64d23641669b60d35dfaed77666a1983bad5 Author: Venkat Rao Bagalkote Date: Fri Apr 10 20:32:48 2026 +0530 smb: client: add missing MODULE_DESCRIPTION() to smb1maperror_test On the latest linux-next following modpost warning is reported: WARNING: modpost: missing MODULE_DESCRIPTION() in fs/smb/client/smb1maperror_test.o Add MODULE_DESCRIPTION() to the test module to fix the warning. Reviewed-by: Saket Kumar Bhaskar Reviewed-by: ChenXiaoSong Signed-off-by: Venkat Rao Bagalkote Signed-off-by: Steve French commit a345c1e3cd1b49ddf03331ee9c19ddebe149793e Author: Victor Duicu Date: Fri Apr 3 16:32:16 2026 +0300 dt-bindings: hwmon: add support for MCP998X Add devicetree schema for Microchip MCP998X/33 and MCP998XD/33D Multichannel Automotive Temperature Monitor Family. Signed-off-by: Victor Duicu Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260403-add-mcp9982-hwmon-v12-1-b3bfb26ff136@microchip.com Signed-off-by: Guenter Roeck commit 48a428215782321b56956974f23593e40ce84b7a Author: Thomas Huth Date: Fri Apr 10 17:46:37 2026 +0200 efi/capsule-loader: fix incorrect sizeof in phys array reallocation The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be causing an undersized allocation. The allocation is also inconsistent with the initial array allocation in efi_capsule_open() that allocates one entry with sizeof(phys_addr_t), and the efi_capsule_write() function that stores phys_addr_t values (not pointers) via page_to_phys(). On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit, this allocates half the required space, which might lead to a heap buffer overflow when storing physical addresses. This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader: fix incorrect allocation size") which fixed the same issue at the initial allocation site. Fixes: f24c4d478013 ("efi/capsule-loader: Reinstate virtual capsule mapping") Assisted-by: Claude:claude-sonnet-4-5 Signed-off-by: Thomas Huth Signed-off-by: Ard Biesheuvel commit 3023c050af3600bf451153335dea5e073c9a3088 Author: Thomas Weißschuh Date: Wed Apr 8 20:45:50 2026 +0200 hwmon: (powerz) Avoid cacheline sharing for DMA buffer Depending on the architecture the transfer buffer may share a cacheline with the following mutex. As the buffer may be used for DMA, that is problematic. Use the high-level DMA helpers to make sure that cacheline sharing can not happen. Also drop the comment, as the helpers are documentation enough. https://sashiko.dev/#/message/20260408175814.934BFC19421%40smtp.kernel.org Fixes: 4381a36abdf1c ("hwmon: add POWER-Z driver") Cc: stable@vger.kernel.org # ca085faabb42: dma-mapping: add __dma_from_device_group_begin()/end() Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20260408-powerz-cacheline-alias-v1-1-1254891be0dd@weissschuh.net Signed-off-by: Guenter Roeck commit 3624a22783b74ffebaa7d9f286e203604baa06c7 Author: Li Ming Date: Sat Mar 21 14:14:59 2026 +0800 cxl/hdm: Add support for 32 switch decoders Per CXL r4.0 section 8.2.4.20.1. CXL host bridge and switch ports can support 32 HDM decoders. Current implementation misses some decoders on CXL host bridge and switch in the case that the value of Decoder Count field in CXL HDM decoder Capability Register is greater than or equal to 9. Update calculation implementation to ensure the decoder count calculation is correct for CXL host bridge/switch ports. Signed-off-by: Li Ming Reviewed-by: Gregory Price Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260321061459.1910205-1-ming.li@zohomail.com Signed-off-by: Dave Jiang commit a7c0aaa50e40ffd8fd703d006d5a04b540b9ca92 Author: Sanman Pradhan Date: Fri Apr 10 00:26:19 2026 +0000 hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit isl28022_read_power() computes: *val = ((51200000L * ((long)data->gain)) / (long)data->shunt) * (long)regval; On 32-bit platforms, 'long' is 32 bits. With gain=8 and shunt=10000 (the default configuration): (51200000 * 8) / 10000 = 40960 40960 * 65535 = 2,684,313,600 This exceeds LONG_MAX (2,147,483,647), resulting in signed integer overflow. Additionally, dividing before multiplying by regval loses precision unnecessarily. Use u64 arithmetic with div_u64() and multiply before dividing to retain precision. The intermediate product cannot overflow u64 (worst case: 51200000 * 8 * 65535 = 26843136000000). Power is inherently non-negative, so unsigned types are the natural fit. Cap the result to LONG_MAX before returning it through the hwmon callback. Fixes: 39671a14df4f2 ("hwmon: (isl28022) new driver for ISL28022 power monitor") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260410002613.424557-1-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit 24c73e93d6a756e1b8626bb259d2e07c5b89b370 Author: Sanman Pradhan Date: Fri Apr 10 00:25:55 2026 +0000 hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Fix two bugs in pt5161l_read_block_data(): 1. Buffer overrun: The local buffer rbuf is declared as u8 rbuf[24], but i2c_smbus_read_block_data() can return up to I2C_SMBUS_BLOCK_MAX (32) bytes. The i2c-core copies the data into the caller's buffer before the return value can be checked, so the post-read length validation does not prevent a stack overrun if a device returns more than 24 bytes. Resize the buffer to I2C_SMBUS_BLOCK_MAX. 2. Unexpected positive return on length mismatch: When all three retries are exhausted because the device returns data with an unexpected length, i2c_smbus_read_block_data() returns a positive byte count. The function returns this directly, and callers treat any non-negative return as success, processing stale or incomplete buffer contents. Return -EIO when retries are exhausted with a positive return value, preserving the negative error code on I2C failure. Fixes: 1b2ca93cd0592 ("hwmon: Add driver for Astera Labs PT5161L retimer") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260410002549.424162-1-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit b66437cb20a2d9ef201f40b675569f8ea7787c9f Author: Sanman Pradhan Date: Fri Apr 10 00:25:41 2026 +0000 hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt wait_for_completion_interruptible_timeout() returns -ERESTARTSYS when interrupted. This needs to abort the URB and return an error. No data has been received from the device so any reads from the transfer buffer are invalid. The original code tests !ret, which only catches the timeout case (0). On signal delivery (-ERESTARTSYS), !ret is false so the function skips usb_kill_urb() and falls through to read from the unfilled transfer buffer. Fix by capturing the return value into a long (matching the function return type) and handling signal (negative) and timeout (zero) cases with separate checks that both call usb_kill_urb() before returning. Fixes: 4381a36abdf1c ("hwmon: add POWER-Z driver") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260410002521.422645-3-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit 08e57f5e1a9067d5fbf33993aa7f51d60b3d13a4 Author: Sanman Pradhan Date: Fri Apr 10 00:25:35 2026 +0000 hwmon: (powerz) Fix use-after-free on USB disconnect After powerz_disconnect() frees the URB and releases the mutex, a subsequent powerz_read() call can acquire the mutex and call powerz_read_data(), which dereferences the freed URB pointer. Fix by: - Setting priv->urb to NULL in powerz_disconnect() so that powerz_read_data() can detect the disconnected state. - Adding a !priv->urb check at the start of powerz_read_data() to return -ENODEV on a disconnected device. - Moving usb_set_intfdata() before hwmon registration so the disconnect handler can always find the priv pointer. Fixes: 4381a36abdf1c ("hwmon: add POWER-Z driver") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260410002521.422645-2-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit a2981c20ad673bcd5f0e5caa6ef103b8fcdbd6a2 Author: Chris Packham Date: Fri Apr 10 13:24:12 2026 +1200 hwmon: pmbus: Add support for Sony APS-379 Add pmbus support for Sony APS-379 power supplies. There are a few PMBUS commands that return data that is undocumented/invalid so these need to be rejected with -ENXIO. The READ_VOUT command returns data in linear11 format instead of linear16 so we need to workaround this. Signed-off-by: Chris Packham Link: https://lore.kernel.org/r/20260410012414.2818829-3-chris.packham@alliedtelesis.co.nz [groeck: Dropped empty line from documentation; added module name to Kconfig] Signed-off-by: Guenter Roeck commit 502a498c1d03b941efae90b192d51109a66d463f Author: Chris Packham Date: Fri Apr 10 13:24:11 2026 +1200 dt-bindings: trivial-devices: Add sony,aps-379 Add the compatible string for the sony,aps-379. This is a simple PMBus (I2C) device that requires no additional attributes. Signed-off-by: Chris Packham Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260410012414.2818829-2-chris.packham@alliedtelesis.co.nz Signed-off-by: Guenter Roeck commit 8b9a097eb2fc37b486afd81388c693bf3ab44466 Author: Benjamin Tissoires Date: Fri Apr 10 16:03:07 2026 +0200 HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write") assumed that all HID devices attached to the logitech-dj driver was having an output report of DJ_SHORT. However, on the receiver itself, we have 2 other HID device we attach here: the mouse emulation and the keyboard emulation. For those devices the value of rep is NULL and we are triggered a segfault here. This is doubly required because logitech-dj also handles non DJ devices that might not have the DJ collection. Fixes: b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write") Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 34fe4a9df2476f52a809d0cd9659ff73de605774 Author: Abhinav Mahadevan Date: Fri Apr 10 20:03:35 2026 +0530 ALSA: usb-audio: Add quirk for PreSonus AudioBox USB The PreSonus AudioBox USB (0x194f:0x0301) only supports S24_3LE format for both playback and capture. It does not support S16_LE despite being a USB full-speed device. Add explicit format quirks for both the playback (interface 2) and capture (interface 3) interfaces to ensure correct format negotiation. Signed-off-by: Abhinav Mahadevan Link: https://patch.msgid.link/20260410143335.5974-1-abhi220204@gmail.com Signed-off-by: Takashi Iwai commit a31e4518bec70333a0a98f2946a12b53b45fe5b9 Author: Greg Kroah-Hartman Date: Thu Apr 9 15:23:46 2026 +0200 fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the udlfb driver as it uses pixclock directly when dividing, which will crash. Cc: Bernie Thompson Cc: Helge Deller Fixes: 59277b679f8b ("Staging: udlfb: add dynamic modeset support") Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Signed-off-by: Helge Deller commit 8f98b81fe011e1879e6a7b1247e69e06a5e17af2 Author: Greg Kroah-Hartman Date: Thu Apr 9 15:23:14 2026 +0200 fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the udlfb driver as it uses pixclock directly when dividing, which will crash. Cc: Helge Deller Assisted-by: gregkh_clanker_t1000 Cc: stable Signed-off-by: Greg Kroah-Hartman Signed-off-by: Helge Deller commit 64cb68766fc8679626b422319b8b678d5792bfbf Author: Wolfram Sang Date: Fri Apr 10 16:31:25 2026 +0200 Documentation: seq_file: drop 2.6 reference Even kernels after 2.6 have seq-file support. Signed-off-by: Wolfram Sang Signed-off-by: Jonathan Corbet Message-ID: <20260410143234.43610-2-wsa+renesas@sang-engineering.com> commit b7feba842c0d5f6c5b01592f80d164e974767501 Author: Cássio Gabriel Date: Fri Apr 10 10:56:52 2026 -0300 ALSA: interwave: guard PM-only restore helpers with CONFIG_PM The InterWave PM patch added snd_interwave_restore_regs() and snd_interwave_restore_memory() as static helpers, but both are used only from the resume path under CONFIG_PM. On configurations without CONFIG_PM, such as alpha allyesconfig, this leaves both helpers unused and triggers -Wunused-function warnings with W=1. Move the PM-only helpers into the existing CONFIG_PM section. Keep __snd_interwave_restore_regs() outside the guard because it is also used during probe-time initialization. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604101958.x16oNkfo-lkp@intel.com/ Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260410-alsa-interwave-pm-warning-fix-v1-1-434d14c9c262@gmail.com Signed-off-by: Takashi Iwai commit 52521e8398839105ef8eb22b3f0993f9b0d11a57 Author: Takashi Iwai Date: Fri Apr 10 16:32:19 2026 +0200 ALSA: usb-audio: Evaluate packsize caps at the right place We introduced the upper bound checks of the packet sizes by the ep->maxframesize for avoiding the URB submission errors. However, the check was applied at an incorrect place in the function snd_usb_endpoint_set_params() where ep->maxframesize isn't defined yet; the value is defined at a bit later position. So this ended up with a failure at the first run while the second run works. For fixing it, move the check at the correct place, right after the calculation of ep->maxframesize in the same function. Fixes: 7fe8dec3f628 ("ALSA: usb-audio: Cap the packet size pre-calculations") Link: https://bugzilla.kernel.org/show_bug.cgi?id=221292 Cc: Link: https://patch.msgid.link/20260410143220.1676344-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 78cde54ea5f03398f1cf6656de2472068f6da966 Author: Vincent Guittot Date: Fri Apr 10 15:23:21 2026 +0200 sched/eevdf: Clear buddies for preempt_short next buddy should not prevent shorter slice preemption. Don't take buddy into account when checking if shorter slice entity can preempt and clear it if the entity with a shorter slice can preempt current. Test on snapdragon rb5: hackbench -T -p -l 16000000 -g 2 1> /dev/null & hackbench runs in cgroup /test-A cyclictest -t 1 -i 2777 -D 63 --policy=fair --mlock -h 20000 -q cyclictest runs in cgroup /test-B tip/sched/core tip/sched/core +this patch cyclictest slice (ms) (default)2.8 8 8 hackbench slice (ms) (default)2.8 20 20 Total Samples | 22679 22595 22686 Average (us) | 84 94(-12%) 59( 37%) Median (P50) (us) | 56 56( 0%) 56( 0%) 90th Percentile (us) | 64 65(- 2%) 63( 3%) 99th Percentile (us) | 1047 1273(-22%) 74( 94%) 99.9th Percentile (us) | 2431 4751(-95%) 663( 86%) Maximum (us) | 4694 8655(-84%) 3934( 55%) Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260410132321.2897789-1-vincent.guittot@linaro.org commit 9f168e4de5fd43766f6d49b393f445be805c1e05 Author: Dmitry Baryshkov Date: Wed Mar 11 01:02:58 2026 +0200 Bluetooth: qca: enable pwrseq support for WCN39xx devices The WCN39xx family of WiFi/BT chips incorporates a simple PMU, spreading voltages over internal rails. Implement support for using powersequencer for this family of QCA devices in addition to using regulators. Reviewed-by: Bartosz Golaszewski Signed-off-by: Dmitry Baryshkov Signed-off-by: Luiz Augusto von Dentz commit 15a315e4172b1dfd78f1d1ed62808a2c968d5a7b Author: Luiz Augusto von Dentz Date: Mon Mar 2 15:21:21 2026 -0500 Bluetooth: btintel_pci: Fix btintel_pcie_read_hwexp code style Use proper alignment for break under a switch. Signed-off-by: Luiz Augusto von Dentz commit 5741118b5da398f3864be04044de975aa154af1d Author: Kiran K Date: Sat Feb 28 14:42:39 2026 +0530 Bluetooth: btintel_pcie: Add device id of Scorpious2, Nova Lake-PCD-S sudo lspci -v -k -d 8086:6e74 80:14.7 Bluetooth: Intel Corporation Device 6e74 (rev 10) Subsystem: Intel Corporation Device 0011 Flags: bus master, fast devsel, latency 0, IRQ 16 Memory at 200002a8000 (64-bit, non-prefetchable) [size=16K] Capabilities: [c8] Power Management version 3 Capabilities: [d0] MSI: Enable- Count=1/1 Maskable- 64bit+ Capabilities: [40] Express Root Complex Integrated Endpoint, MSI 00 Capabilities: [80] MSI-X: Enable+ Count=32 Masked- Capabilities: [100] Latency Tolerance Reporting Kernel driver in use: btintel_pcie Kernel modules: btintel_pcie Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 0e77b6ad7ae41894742b0e3ba0a80506e4ad1b5e Author: Kiran K Date: Sat Feb 28 14:42:38 2026 +0530 Bluetooth: btintel_pcie: Add device id of Scorpius Peak2, Nova Lake-PCD-H sudo lspci -v -k -d 8086:d346 00:14.7 Bluetooth: Intel Corporation Device d346 Subsystem: Intel Corporation Device 0011 Flags: bus master, fast devsel, latency 0, IRQ 16, IOMMU group 14 Memory at b018378000 (64-bit, non-prefetchable) [size=16K] Capabilities: [c8] Power Management version 3 Capabilities: [d0] MSI: Enable- Count=1/1 Maskable- 64bit+ Capabilities: [40] Express Root Complex Integrated Endpoint, MSI 00 Capabilities: [80] MSI-X: Enable+ Count=32 Masked- Capabilities: [100] Latency Tolerance Reporting Kernel driver in use: btintel_pcie Kernel modules: btintel_pcie Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 68a1729ae5043d900e040565f3db87f06ce64a76 Author: Kiran K Date: Sat Feb 28 14:42:37 2026 +0530 Bluetooth: btintel_pcie: Add support for exception dump for ScP2F Add device coredump support for Scorpious Peak2F product. Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 9c52085e10af716812cfc8de79bc4f22747b3c19 Author: Kiran K Date: Sat Feb 28 14:42:36 2026 +0530 Bluetooth: btintel: Add support for Scorpious Peak2F support Add support for Intel Bluetooth Scorpious Peak2F core. Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit e64621ef1500f9c0c26d0b680223d4f3819cf24d Author: Kiran K Date: Sat Feb 28 14:42:35 2026 +0530 Bluetooth: btintel_pcie: Add support for exception dump for ScP2 Add device coredump support for Scorpious Peak2 product. Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 140f6afd3dd75a02d067b39806a998e5effb56b5 Author: Kiran K Date: Sat Feb 28 14:42:34 2026 +0530 Bluetooth: btintel: Add DSBR support for ScP2 onwards Add DSBR support for Scorpious Peak2 cores onwards. Refer commit eb9e749c0182 ("Bluetooth: btintel: Allow configuring drive strength of BRI") for details about DSBR. Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 3b74115bb35285f56b5d4cc5a7a90c5825663b9e Author: Kiran K Date: Sat Feb 28 14:42:33 2026 +0530 Bluetooth: btintel: Add support for Scorpious Peak2 support Add support for Intel Bluetooth Scorpious Peak2 core. Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit c239ad6e531e00b474c8d30afaf320993bb53023 Author: Kiran K Date: Sat Feb 28 14:42:32 2026 +0530 Bluetooth: btintel: Replace CNVi id with hardware variant Use hardware variant instead of CNVi to send dsbr command. Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 21b51648f3f48d3623d3a1c434356c96e8fc15c1 Author: Kiran K Date: Sat Feb 28 14:42:31 2026 +0530 Bluetooth: btintel: Add support for hybrid signature for ScP2 onwards If FW image has hybrid signature (ECDSA and LMS) then send CSS header, ECDSA public key, ECDSA signature, LMS public key, LMS signature and command buffer to device. Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 728a3d128325bad286b1e4f191026e8de8d12a85 Author: Christian Eggers Date: Wed Feb 25 18:07:26 2026 +0100 Bluetooth: L2CAP: CoC: Disconnect if received packet size exceeds MPS Core 6.0, Vol 3, Part A, 3.4.3: "... If the payload size of any K-frame exceeds the receiver's MPS, the receiver shall disconnect the channel..." This fixes L2CAP/LE/CFC/BV-27-C (running together with 'l2test -r -P 0x0027 -V le_public -I 100'). Signed-off-by: Christian Eggers Signed-off-by: Luiz Augusto von Dentz Tested-by: Christian Eggers commit 7f2c3c49ba0d3fead557a8026a021ebe23f919d6 Author: Sean Wang Date: Tue Feb 24 00:13:25 2026 -0600 Bluetooth: btmtk: add MT7902 SDIO support Add MT7902 Bluetooth SDIO support by introducing chip data and registering the device ID. Runtime PM is not yet supported by the driver, but normal operation is unaffected. Signed-off-by: Sean Wang Signed-off-by: Luiz Augusto von Dentz commit 22fd19bf249a4fc80ec57ebe09c924469f53222b Author: Sean Wang Date: Tue Feb 24 00:13:24 2026 -0600 Bluetooth: btusb: Add new VID/PID 0e8d/1ede for MT7902 Add VID 0e8d & PID 1ede for MediaTek MT7902 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0e8d ProdID=1ede Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Co-developed-by: Bitterblue Smith Signed-off-by: Bitterblue Smith Signed-off-by: Sean Wang Signed-off-by: Luiz Augusto von Dentz commit 6724fb35cdd6186bd68f8de84210fd40099fff86 Author: Sean Wang Date: Tue Feb 24 00:13:23 2026 -0600 Bluetooth: btusb: Add new VID/PID 13d3/3596 for MT7902 Add VID 13d3 & PID 3596 for MediaTek MT7902 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=07 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3596 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Co-developed-by: Kush Kulshrestha Signed-off-by: Kush Kulshrestha Signed-off-by: Sean Wang Signed-off-by: Luiz Augusto von Dentz commit 7968f6d34e0551a166e293a8d35cef605afde3ec Author: Sean Wang Date: Tue Feb 24 00:13:22 2026 -0600 Bluetooth: btusb: Add new VID/PID 13d3/3594 for MT7902 Add VID 13d3 & PID 3594 for MediaTek MT7902 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3594 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Co-developed-by: Kush Kulshrestha Signed-off-by: Kush Kulshrestha Signed-off-by: Sean Wang Signed-off-by: Luiz Augusto von Dentz commit cdb7f671bca136c6f4e2deb6163c4f5d482f5eae Author: Sean Wang Date: Tue Feb 24 00:13:21 2026 -0600 Bluetooth: btusb: Add new VID/PID 13d3/3580 for MT7902 Add VID 13d3 & PID 3580 for MediaTek MT7902 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3580 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Co-developed-by: Kush Kulshrestha Signed-off-by: Kush Kulshrestha Signed-off-by: Sean Wang Signed-off-by: Luiz Augusto von Dentz commit 51c4173b89fe7399bad1381016096cc154588660 Author: Sean Wang Date: Tue Feb 24 00:13:20 2026 -0600 Bluetooth: btusb: Add new VID/PID 13d3/3579 for MT7902 Add VID 13d3 & PID 3579 for MediaTek MT7902 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=04 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3579 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Sean Wang Signed-off-by: Luiz Augusto von Dentz commit aab25984e55972e53f3e58821cb85a7101876056 Author: Sean Wang Date: Tue Feb 24 00:13:19 2026 -0600 Bluetooth: btmtk: add MT7902 MCU support Add MT7902 device ID and firmware filename to enable MCU firmware loading. Signed-off-by: Sean Wang Signed-off-by: Luiz Augusto von Dentz commit cde32a92d4562b686f730fc08d4d558ecc99d516 Author: Sean Wang Date: Tue Feb 24 00:13:18 2026 -0600 mmc: sdio: add MediaTek MT7902 SDIO device ID Add SDIO device ID (0x790a) for MediaTek MT7902 to sdio_ids.h. Acked-by: Ulf Hansson Signed-off-by: Sean Wang Signed-off-by: Luiz Augusto von Dentz commit 9a9d21f780805fd6f950e930eeae437748d72793 Author: Thorsten Blum Date: Tue Feb 24 00:33:42 2026 +0100 Bluetooth: btintel_pcie: Use struct_size to improve hci_drv_read_info Use struct_size(), which provides additional compile-time checks for structures with flexible array members (e.g., __must_be_array()), to determine the allocation size for a new 'struct hci_drv_rp_read_info'. Signed-off-by: Thorsten Blum Signed-off-by: Luiz Augusto von Dentz commit 67377cd38b89ce782ccdb83bda3f65a2def843cd Author: Dylan Eray Date: Thu Feb 19 20:32:09 2026 +0100 Bluetooth: btusb: Add Lite-On 04ca:3807 for MediaTek MT7921 Add USB device ID (04ca:3807) for a Lite-On Wireless_Device containing a MediaTek MT7921 (MT7920) Bluetooth chipset found in Acer laptops. Without this entry, btusb binds via the generic USB class-based wildcard match but never sets the BTUSB_MEDIATEK flag. This means btmtk never triggers firmware loading, and the driver sends a raw HCI Reset that the uninitialized chip cannot respond to, resulting in: Bluetooth: hci0: Opcode 0x0c03 failed: -110 The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below: T: Bus=03 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#=5 Spd=480 MxCh=0 P: Vendor=04ca ProdID=3807 Rev=1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C: #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) Reviewed-by: Paul Menzel Signed-off-by: Dylan Eray Signed-off-by: Luiz Augusto von Dentz commit c0ad33d273ef1097b28421c3e8d19f52553f26e8 Author: Thorsten Blum Date: Fri Feb 20 09:00:59 2026 +0100 Bluetooth: btintel_pcie: Replace snprintf("%s") with strscpy Replace snprintf("%s", ...) with the faster and more direct strscpy(). Signed-off-by: Thorsten Blum Signed-off-by: Luiz Augusto von Dentz commit 9ff5ff0b9175c37f1fc2ad4e94fa23c7bbc9504f Author: Hans de Goede Date: Thu Feb 12 15:17:21 2026 +0100 Bluetooth: hci_qca: Fix BT not getting powered-off on rmmod The BT core skips calling the hci_dev's shutdown method when the HCI is unregistered. This means that qca_power_off() was not getting called leaving BT powered on. This causes regulators / pwrseq providers to not get disabled which also causes problem when re-loading the module because regulators and pwrseq providers have an enablecount which now has never dropped to 0, causing the BT to not get properly reset between rmmod and re-load which causes initialization failure on the re-load. Fix this by calling qca_power_off() from qca_close() when BT has not already been powered off through a qca_hci_shutdown() call. hci_ldisc.c will call qca_close() after freeing the hdev, so this means that qca_power_off() can now no longer deref hu->hdev, change the logging in qca_power_off() to no longer use hu->hdev. Signed-off-by: Hans de Goede Reviewed-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz commit 7e2e1e5859359c62b4b8f8780be2c8dea1708529 Author: Hans de Goede Date: Thu Feb 12 15:17:20 2026 +0100 Bluetooth: hci_qca: Fix confusing shutdown() and power_off() naming The function called qca_power_off() is actually the hci_dev shutdown handler, rename it to qca_hci_shutdown() to make this clear. While the qca_power_shutdown() function is actually the counter-part of qca_power_on() rename it to qca_power_off() to make this clear. Signed-off-by: Hans de Goede Reviewed-by: Paul Menzel Reviewed-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz commit 04c217a7fc8f23a1c99b014cb6a89cf77ac7a012 Author: Marek Vasut Date: Mon Feb 9 18:11:48 2026 +0100 Bluetooth: btbcm: Add entry for BCM4343A2 UART Bluetooth This patch adds the device ID for the BCM4343A2 module, found e.g. in the muRata 1YN WiFi+BT combined device. The required firmware file is named 'BCM4343A2.hcd'. Signed-off-by: Marek Vasut Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit f29bc37dfc4ad7570d78f8cd482d4b83c3caffdf Author: Vivek Sahu Date: Tue Feb 10 17:31:01 2026 +0530 Bluetooth: qca: Refactor code on the basis of chipset names Whenever new chipset support is added to the driver code, we ended up adding chipset name to the last of the switch case arising code readability issue because of improper sorting of the chipset names in various places of the code. Refactor code such a way that new chipset can be added easily in the code without compromising code readability. Signed-off-by: Vivek Sahu Reviewed-by: Dmitry Baryshkov Signed-off-by: Luiz Augusto von Dentz commit 679621a767bfa0a2cb77fbd8b664412e9e3f89cf Author: Chris Lu Date: Tue Feb 3 14:25:10 2026 +0800 Bluetooth: btmtk: Add reset mechanism if downloading firmware failed Add a new flag 'BTMTK_FIRMWARE_DL_RETRY'. If an error occurs during mt79xx firmware download process, this flag will be set and cleared after a reset. If the flag is already set and firmware still cannot be loaded successfully after a reset, no further reset attempts will be made. In other words, if there is a problem during firmware download, only one reset will be attempted. Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit b27a306e9f206aaf10f22b0c6338d7b97799c7b7 Author: Chris Lu Date: Tue Feb 3 14:25:09 2026 +0800 Bluetooth: btmtk: add status check in mt79xx firmware setup To prevent abnormal controller states, it is necessary to check status in another part of the mt79xx firmware setup. During this process, receiving the 'BTMTK_WMT_PATCH_PROGRESS' status is unexpected. If this occurs, it should be treated as an error, and driver must be prevented from continuing execution. Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit a55f80233f384dc89ef3425b2e1dd0e6d44bcf29 Author: Richard Cheng Date: Thu Apr 9 13:19:02 2026 +0800 fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal CXL is linked before fwctl in drivers/Makefile. Both use `module_init, so `cxl_pci_driver_init()` runs first. When `cxl_pci_probe()` calls `fwctl_register()` and then `device_add()`, fwctl_class is not yet registered because fwctl_init() hasn't run, causing `class_to_subsys()` to return NULL and skip knode_class initialization. On device removal, `class_to_subsys()` returns non-NULL, and `device_del()` calls `klist_del()` on the uninitialized knode, triggering a NULL pointer dereference. Fixes: 858ce2f56b52 ("cxl: Add FWCTL support to CXL") Link: https://patch.msgid.link/r/20260409051902.40218-1-icheng@nvidia.com Signed-off-by: Richard Cheng Reviewed-by: Kai-Heng Feng Reviewed-by: Dave Jiang Signed-off-by: Jason Gunthorpe commit 54f1f020e9f4a087779cc4d96a7c86f47d0c6797 Author: Chris Lu Date: Tue Feb 3 14:25:08 2026 +0800 Bluetooth: btmtk: improve mt79xx firmware setup retry flow If retries are exhausted, driver should not do futher operation. During mt79xx firmware download process, if the retry count reaches0, driver will return an -EIO error and release the firmware resources. Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit a80b51f066063e399a50c1e1ced008734a6ec800 Author: Dongyang Jin Date: Tue Feb 3 15:10:48 2026 +0800 Bluetooth: btbcm: remove done label in btbcm_patchram There is no point in having the label since all it does is return the value in the 'err' variable. Instead make every goto return directly and remove the label. Signed-off-by: Dongyang Jin Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit edef6576853e51faa11bb286884c362ff7fc83a0 Author: Pauli Virtanen Date: Tue Feb 3 21:57:21 2026 +0200 Bluetooth: hci_core: Rate limit the logging of invalid ISO handle Some controller firmwares (eg for MT7925) continuously send invalid ISO packet, which result to "ISO unknown handle" error spam in logs. It's not important to show all of them to the user. Rate limit these ISO error messages, similarly as we do for SCO. Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 1f2ac009d3e06380400618e777c858e582872efa Author: Chris Lu Date: Fri Jan 30 14:13:56 2026 +0800 Bluetooth: btusb: MT7922: Add VID/PID 0489/e174 Add VID 0489 & PID e174 for MediaTek MT7922 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e174 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit 218d3c44f5f0a3cc1647bc61a4e4eac663b37aa5 Author: Marco Nenciarini Date: Wed Apr 1 22:36:37 2026 +0200 platform/x86: int3472: Parameterize LED con_id in registration Add a con_id parameter to skl_int3472_register_led() to allow callers to specify both the LED name suffix and lookup con_id instead of hardcoding "privacy". This prepares for registering additional LED types with different names. While at it, rename the privacy LED's GPIO con_id from "privacy-led" to "privacy" in int3472_get_con_id_and_polarity() and pass it directly to skl_int3472_register_led(), reducing churn when adding new LED types. No functional change. Reviewed-by: Andy Shevchenko Reviewed-by: Hans de Goede Signed-off-by: Marco Nenciarini Link: https://patch.msgid.link/20260401203638.1601661-4-mnencia@kcore.it Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 39237e3208209d1bb35d939d6fee1f36b642f562 Author: Marco Nenciarini Date: Wed Apr 1 22:36:36 2026 +0200 platform/x86: int3472: Rename pled to led in LED registration code Rename the privacy LED type, struct member, and functions from "pled" to "led" in preparation for supporting additional LED types beyond just the privacy LED. No functional change. Reviewed-by: Andy Shevchenko Reviewed-by: Hans de Goede Signed-off-by: Marco Nenciarini Link: https://patch.msgid.link/20260401203638.1601661-3-mnencia@kcore.it Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d6116d86e58a04a9522e349c4a27145521c01ad7 Author: Marco Nenciarini Date: Wed Apr 1 22:36:35 2026 +0200 platform/x86: int3472: Use local variable for LED struct access Introduce a local struct int3472_pled pointer in the LED registration, unregistration, and brightness callback functions to avoid repeatedly dereferencing int3472->pled. In the brightness callback, use container_of() to get the int3472_pled struct directly instead of going through int3472_discrete_device. No functional change. Reviewed-by: Andy Shevchenko Reviewed-by: Hans de Goede Signed-off-by: Marco Nenciarini Link: https://patch.msgid.link/20260401203638.1601661-2-mnencia@kcore.it Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dc6d51959ec0c08366d5aaeb5b8fb02d814d1e4b Author: Sumit Semwal Date: Fri Apr 10 18:07:03 2026 +0530 dma-buf: fix htmldocs error for dma_buf_attach_revocable linux-next testing showed this htmldoc error due to a missing extra line in the comments; add it. Fixes: be6d4c9e9d714 ("dma-buf: Add dma_buf_attach_revocable()") Reported-by: Mark Brown Closes: https://lore.kernel.org/lkml/adaNJaF58PZlvs6K@sirena.org.uk/ Signed-off-by: Sumit Semwal Reviewed-by: Christian König Link: https://patch.msgid.link/20260410123703.937822-1-sumit.semwal@linaro.org commit b8bb703fe44ece3e0bc26debd279bf7f6e44247c Merge: 1eab6493f52591 78405e7f42fa91 Author: Jonathan Corbet Date: Fri Apr 10 07:50:40 2026 -0600 Merge tag 'Chinese-docs-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/alexs/linux into tmp Chinese translation docs for 7.1 This is the Chinese translation subtree for 7.1. It includes the following changes: - Add the rust docs translation - Fix an inconsistent statement in dev-tools/testing-overview - sync process/2.Process.rst with English version Above patches are tested by 'make htmldocs' Signed-off-by: Alex Shi commit 738dd185d3e447e1dfa65b5287730fef456089bf Author: Konrad Dybcio Date: Thu Apr 9 12:04:30 2026 +0200 dt-bindings: sram: Allow multiple-word prefixes to sram subnode Currently, foo-sram is allowed, but foo-bar-sram is not. Allow it so that more complex names aren't unnecessarily simplified. Signed-off-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260409-topic-sram_dtbindings_misc-v2-1-59dc6b0dec45@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 4e0dc01bd55d5fbaf30d823655e05c038f88f34b Author: Luca Weiss Date: Fri Apr 10 09:31:06 2026 +0200 dt-bindings: sram: Document qcom,milos-imem Add compatible for Milos SoC IMEM. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20260410-milos-imem-v3-1-d215385fa5ab@fairphone.com Signed-off-by: Rob Herring (Arm) commit 480a9e57cceaf42db6ff874dbfe91de201935035 Merge: 47f06ebbe8dad6 773b24bcedc16a 34e563947c7620 b7d9d2e3a8ab53 be6e9dee0e978d 74cd4e0e539948 e223258ed8a683 4ce0a2ccc0358f 95a58852b0e541 1d37713fa83780 306736fd515565 8d13386c7624dc b178330b67abb7 Author: Catalin Marinas Date: Fri Apr 10 14:22:24 2026 +0100 Merge branches 'for-next/misc', 'for-next/tlbflush', 'for-next/ttbr-macros-cleanup', 'for-next/kselftest', 'for-next/feat_lsui', 'for-next/mpam', 'for-next/hotplug-batched-tlbi', 'for-next/bbml2-fixes', 'for-next/sysreg', 'for-next/generic-entry' and 'for-next/acpi', remote-tracking branches 'arm64/for-next/perf' and 'arm64/for-next/read-once' into for-next/core * arm64/for-next/perf: : Perf updates perf/arm-cmn: Fix resource_size_t printk specifier in arm_cmn_init_dtc() perf/arm-cmn: Fix incorrect error check for devm_ioremap() perf: add NVIDIA Tegra410 C2C PMU perf: add NVIDIA Tegra410 CPU Memory Latency PMU perf/arm_cspmu: nvidia: Add Tegra410 PCIE-TGT PMU perf/arm_cspmu: nvidia: Add Tegra410 PCIE PMU perf/arm_cspmu: Add arm_cspmu_acpi_dev_get perf/arm_cspmu: nvidia: Add Tegra410 UCF PMU perf/arm_cspmu: nvidia: Rename doc to Tegra241 perf/arm-cmn: Stop claiming entire iomem region arm64: cpufeature: Use pmuv3_implemented() function arm64: cpufeature: Make PMUVer and PerfMon unsigned KVM: arm64: Read PMUVer as unsigned * arm64/for-next/read-once: : Fixes for __READ_ONCE() with CONFIG_LTO=y arm64, compiler-context-analysis: Permit alias analysis through __READ_ONCE() with CONFIG_LTO=y arm64: Optimize __READ_ONCE() with CONFIG_LTO=y * for-next/misc: : Miscellaneous cleanups/fixes arm64: rsi: use linear-map alias for realm config buffer arm64: Kconfig: fix duplicate word in CMDLINE help text arm64: mte: Skip TFSR_EL1 checks and barriers in synchronous tag check mode arm64/hwcap: Generate the KERNEL_HWCAP_ definitions for the hwcaps arm64: kexec: Remove duplicate allocation for trans_pgd arm64: mm: Use generic enum pgtable_level arm64: scs: Remove redundant save/restore of SCS SP on entry to/from EL0 arm64: remove ARCH_INLINE_* * for-next/tlbflush: : Refactor the arm64 TLB invalidation API and implementation arm64: mm: __ptep_set_access_flags must hint correct TTL arm64: mm: Provide level hint for flush_tlb_page() arm64: mm: Wrap flush_tlb_page() around __do_flush_tlb_range() arm64: mm: More flags for __flush_tlb_range() arm64: mm: Refactor __flush_tlb_range() to take flags arm64: mm: Refactor flush_tlb_page() to use __tlbi_level_asid() arm64: mm: Simplify __flush_tlb_range_limit_excess() arm64: mm: Simplify __TLBI_RANGE_NUM() macro arm64: mm: Re-implement the __flush_tlb_range_op macro in C arm64: mm: Inline __TLBI_VADDR_RANGE() into __tlbi_range() arm64: mm: Push __TLBI_VADDR() into __tlbi_level() arm64: mm: Implicitly invalidate user ASID based on TLBI operation arm64: mm: Introduce a C wrapper for by-range TLB invalidation arm64: mm: Re-implement the __tlbi_level macro as a C function * for-next/ttbr-macros-cleanup: : Cleanups of the TTBR1_* macros arm64/mm: Directly use TTBRx_EL1_CnP arm64/mm: Directly use TTBRx_EL1_ASID_MASK arm64/mm: Describe TTBR1_BADDR_4852_OFFSET * for-next/kselftest: : arm64 kselftest updates selftests/arm64: Implement cmpbr_sigill() to hwcap test * for-next/feat_lsui: : Futex support using FEAT_LSUI instructions to avoid toggling PAN arm64: armv8_deprecated: Disable swp emulation when FEAT_LSUI present arm64: Kconfig: Add support for LSUI KVM: arm64: Use CAST instruction for swapping guest descriptor arm64: futex: Support futex with FEAT_LSUI arm64: futex: Refactor futex atomic operation KVM: arm64: kselftest: set_id_regs: Add test for FEAT_LSUI KVM: arm64: Expose FEAT_LSUI to guests arm64: cpufeature: Add FEAT_LSUI * for-next/mpam: (40 commits) : Expose MPAM to user-space via resctrl: : - Add architecture context-switch and hiding of the feature from KVM. : - Add interface to allow MPAM to be exposed to user-space using resctrl. : - Add errata workaoround for some existing platforms. : - Add documentation for using MPAM and what shape of platforms can use resctrl arm64: mpam: Add initial MPAM documentation arm_mpam: Quirk CMN-650's CSU NRDY behaviour arm_mpam: Add workaround for T241-MPAM-6 arm_mpam: Add workaround for T241-MPAM-4 arm_mpam: Add workaround for T241-MPAM-1 arm_mpam: Add quirk framework arm_mpam: resctrl: Call resctrl_init() on platforms that can support resctrl arm64: mpam: Select ARCH_HAS_CPU_RESCTRL arm_mpam: resctrl: Add empty definitions for assorted resctrl functions arm_mpam: resctrl: Update the rmid reallocation limit arm_mpam: resctrl: Add resctrl_arch_rmid_read() arm_mpam: resctrl: Allow resctrl to allocate monitors arm_mpam: resctrl: Add support for csu counters arm_mpam: resctrl: Add monitor initialisation and domain boilerplate arm_mpam: resctrl: Add kunit test for control format conversions arm_mpam: resctrl: Add support for 'MB' resource arm_mpam: resctrl: Wait for cacheinfo to be ready arm_mpam: resctrl: Add rmid index helpers arm_mpam: resctrl: Convert to/from MPAMs fixed-point formats arm_mpam: resctrl: Hide CDP emulation behind CONFIG_EXPERT ... * for-next/hotplug-batched-tlbi: : arm64/mm: Enable batched TLB flush in unmap_hotplug_range() arm64/mm: Reject memory removal that splits a kernel leaf mapping arm64/mm: Enable batched TLB flush in unmap_hotplug_range() * for-next/bbml2-fixes: : Fixes for realm guest and BBML2_NOABORT arm64: mm: Remove pmd_sect() and pud_sect() arm64: mm: Handle invalid large leaf mappings correctly arm64: mm: Fix rodata=full block mapping support for realm guests * for-next/sysreg: : arm64 sysreg updates arm64/sysreg: Update ID_AA64SMFR0_EL1 description to DDI0601 2025-12 arm64/sysreg: Update ID_AA64ZFR0_EL1 description to DDI0601 2025-12 arm64/sysreg: Update ID_AA64FPFR0_EL1 description to DDI0601 2025-12 arm64/sysreg: Update ID_AA64ISAR2_EL1 description to DDI0601 2025-12 arm64/sysreg: Update ID_AA64ISAR0_EL1 description to DDI0601 2025-12 arm64/sysreg: Update SMIDR_EL1 to DDI0601 2025-06 * for-next/generic-entry: : More arm64 refactoring towards using the generic entry code arm64: Check DAIF (and PMR) at task-switch time arm64: entry: Use split preemption logic arm64: entry: Use irqentry_{enter_from,exit_to}_kernel_mode() arm64: entry: Consistently prefix arm64-specific wrappers arm64: entry: Don't preempt with SError or Debug masked entry: Split preemption from irqentry_exit_to_kernel_mode() entry: Split kernel mode logic from irqentry_{enter,exit}() entry: Move irqentry_enter() prototype later entry: Remove local_irq_{enable,disable}_exit_to_user() entry: Fix stale comment for irqentry_enter() * for-next/acpi: : arm64 ACPI updates ACPI: AGDI: fix missing newline in error message commit 8c0ee19db81f0fa1ff25fd75b22b17c0cc2acde3 Author: Ming-Hung Tsai Date: Fri Apr 10 21:08:01 2026 +0800 dm cache: fix missing return in invalidate_committed's error path In passthrough mode, dm-cache defers write submission until after metadata commit completes via the invalidate_committed() continuation. On commit error, invalidate_committed() calls invalidate_complete() to end the bio and free the migration struct, after which it should return immediately. The patch 4ca8b8bd952d ("dm cache: fix write hang in passthrough mode") omitted this early return, causing execution to fall through into the success path on error. This results in use-after-free on the migration struct in the subsequent calls. Fix by adding the missing return after the invalidate_complete() call. Fixes: 4ca8b8bd952d ("dm cache: fix write hang in passthrough mode") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/dm-devel/adjMq6T5RRjv_uxM@stanley.mountain/ Signed-off-by: Ming-Hung Tsai Signed-off-by: Mikulas Patocka commit 36446de0c30c62b9d89502fd36c4904996d86ecd Author: Ming Lei Date: Fri Apr 10 20:41:36 2026 +0800 ublk: fix tautological comparison warning in ublk_ctrl_reg_buf On 32-bit architectures, 'unsigned long size' can never exceed UBLK_SHMEM_BUF_SIZE_MAX (1ULL << 32), causing a tautological comparison warning. Validate buf_reg.len (__u64) directly before using it, and consolidate all input validation into a single check. Also remove the unnecessary local variables 'addr' and 'size' since buf_reg.addr and buf_reg.len can be used directly. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604101952.3NOzqnu9-lkp@intel.com/ Fixes: 23b3b6f0b584 ("ublk: widen ublk_shmem_buf_reg.len to __u64 for 4GB buffer support") Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260410124136.3983429-1-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 47f72d57ddb11222479c80bd07f5bc036d84c94d Author: Cássio Gabriel Date: Fri Apr 10 00:54:33 2026 -0300 ALSA: sc6000: Restore board setup across suspend snd_wss_resume() restores only the codec register image. The SC-6000 driver also programs card-specific DSP routing and enters MSS mode during probe, and that setup is not replayed after suspend. Cache the WSS chip pointer in the SC-6000 card state and wire ISA suspend and resume callbacks to the shared board-programming helper, so the board is reinitialized before the codec state is restored. This keeps the old/new DSP split in one place and restores the board-level MSS setup that the codec resume path does not cover. Signed-off-by: Cássio Gabriel Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260410-alsa-sc6000-pm-v1-2-4d9e95493d26@gmail.com commit fb79bf127ac2577b4876132da6dba768018aad4c Author: Cássio Gabriel Date: Fri Apr 10 00:54:32 2026 -0300 ALSA: sc6000: Keep the programmed board state in card-private data The driver may auto-select IRQ and DMA resources at probe time, but sc6000_init_board() still derives the SC-6000 soft configuration from the module parameter arrays. When irq=auto or dma=auto is used, the codec is created with the selected resources while the board is programmed with the unresolved values. Store the mapped ports and generated SC-6000 board configuration in card-private data, build that configuration from the live probe results instead of the raw module parameters, and keep the probe-time board programming in a shared helper. This fixes the resource-programming mismatch and leaves the driver with a stable board-state block that can be reused by suspend/resume. Fixes: c282866101bf ("ALSA: sc6000: add support for SC-6600 and SC-7000") Signed-off-by: Cássio Gabriel Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260410-alsa-sc6000-pm-v1-1-4d9e95493d26@gmail.com commit b9c826916fdce6419b94eb0cd8810fdac18c2386 Author: Berk Cem Goksel Date: Fri Apr 10 08:13:41 2026 +0300 ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_card_free_when_closed() is called and no file handles are open, the card and embedded chip are freed synchronously. The subsequent chip->card = NULL write then hits freed slab memory. Call trace: usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline] usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458 ... hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953 Fix by moving the card lifecycle out of usb6fire_chip_abort() and into usb6fire_chip_disconnect(). The card pointer is saved in a local before any teardown, snd_card_disconnect() is called first to prevent new opens, URBs are aborted while chip is still valid, and snd_card_free_when_closed() is called last so chip is never accessed after the card may be freed. Fixes: a0810c3d6dd2 ("ALSA: 6fire: Release resources at card release") Cc: stable@vger.kernel.org Cc: Andrey Konovalov Signed-off-by: Berk Cem Goksel Link: https://patch.msgid.link/20260410051341.1069716-1-berkcgoksel@gmail.com Signed-off-by: Takashi Iwai commit 07704bbf36f57e4379e4cadf96410dab14621e3b Author: Greg Kroah-Hartman Date: Thu Apr 9 16:05:54 2026 +0200 ALSA: fireworks: bound device-supplied status before string array lookup The status field in an EFW response is a 32-bit value supplied by the firewire device. efr_status_names[] has 17 entries so a status value outside that range goes off into the weeds when looking at the %s value. Even worse, the status could return EFR_STATUS_INCOMPLETE which is 0x80000000, and is obviously not in that array of potential strings. Fix this up by properly bounding the index against the array size and printing "unknown" if it's not recognized. Cc: Clemens Ladisch Cc: Takashi Sakamoto Cc: Jaroslav Kysela Cc: Takashi Iwai Fixes: bde8a8f23bbe ("ALSA: fireworks: Add transaction and some commands") Cc: stable Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Reviewed-by: Takashi Sakamoto Link: https://patch.msgid.link/2026040953-astute-camera-1aa1@gregkh Signed-off-by: Takashi Iwai commit 48bd344e1040b9f2eb512be73c13f5db83efc191 Author: Greg Kroah-Hartman Date: Thu Apr 9 16:01:56 2026 +0200 ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0 A malicious USB device with the TASCAM US-144MKII device id can have a configuration containing bInterfaceNumber=1 but no interface 0. USB configuration descriptors are not required to assign interface numbers sequentially, so usb_ifnum_to_if(dev, 0) returns will NULL, which will then be dereferenced directly. Fix this up by checking the return value properly. Cc: Jaroslav Kysela Cc: Takashi Iwai Fixes: dee1bcf28a3d ("ALSA: usb-audio: Add initial driver for TASCAM US-144MKII") Cc: stable Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026040955-fall-gaining-e338@gregkh Signed-off-by: Takashi Iwai commit c5b6285aae050ff1c3ea824ca3d88ac4be1e69c8 Author: Mark Brown Date: Thu Mar 26 14:52:41 2026 +0000 ASoC: SOF: Don't allow pointer operations on unconfigured streams When reporting the pointer for a compressed stream we report the current I/O frame position by dividing the position by the number of channels multiplied by the number of container bytes. These values default to 0 and are only configured as part of setting the stream parameters so this allows a divide by zero to be configured. Validate that they are non zero, returning an error if not Fixes: c1a731c71359 ("ASoC: SOF: compress: Add support for computing timestamps") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260326-asoc-compress-tstamp-params-v1-1-3dc735b3d599@kernel.org Signed-off-by: Mark Brown commit 606c780b8843731c78c0f6fa0a1c3b99456ca263 Author: Johan Hovold Date: Tue Apr 7 14:14:05 2026 +0200 regulator: max77620: drop redundant OF node initialisation The platform device OF node is set unconditionally since commit 6f55c5dd1118 ("regulator: max77620: Use device_set_of_node_from_dev()") so drop the earlier redundant conditional initialisation. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260407121405.2663004-1-johan@kernel.org Signed-off-by: Mark Brown commit ab00febad191d7a4400aa1c3468279fb508258d4 Author: Pei Xiao Date: Tue Apr 7 15:26:59 2026 +0800 spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback mtk_snand_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action after successful registration so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and during device removal. Fixes: 764f1b748164 ("spi: add driver for MTK SPI NAND Flash Interface") Signed-off-by: Pei Xiao Link: https://patch.msgid.link/20263f885f1a9c9d559f95275298cd6de4b11ed5.1775546401.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit 45daacbead8a009844bd5dba6cfa731332184d17 Author: Johan Hovold Date: Fri Apr 10 11:49:25 2026 +0200 spi: s3c64xx: fix NULL-deref on driver unbind A change moving DMA channel allocation from probe() back to s3c64xx_spi_prepare_transfer() failed to remove the corresponding deallocation from remove(). Drop the bogus DMA channel release from remove() to avoid triggering a NULL-pointer dereference on driver unbind. This issue was flagged by Sashiko when reviewing a controller deregistration fix. Fixes: f52b03c70744 ("spi: s3c64xx: requests spi-dma channel only during data transfer") Cc: stable@vger.kernel.org # 6.0 Cc: Adithya K V Link: https://sashiko.dev/#/patchset/20260410081757.503099-1-johan%40kernel.org Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410094925.518343-1-johan@kernel.org Signed-off-by: Mark Brown commit 0a42ca4d2bff6306dd574a7897258fd02c2e6930 Author: Dan Carpenter Date: Fri Apr 10 13:14:52 2026 +0300 scsi: bsg: fix buffer overflow in scsi_bsg_uring_cmd() The bounds checking in scsi_bsg_uring_cmd() does not work because cmd->request_len is a u32 and scmd->cmd_len is a u16. We check that scmd->cmd_len is valid but if the cmd->request_len is more than USHRT_MAX it would still lead to a buffer overflow when we do the copy_from_user(). Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/adjNnMYK7A7KMNkA@stanley.mountain Signed-off-by: Jens Axboe commit 81c9cdb110ef4a2dd653286a06ce0ae9ac05aac1 Merge: 5b94c94caafcad c9c012706c9fa8 Author: Mark Brown Date: Fri Apr 10 13:22:46 2026 +0100 spi: fix controller deregistration (part 2/2) Johan Hovold says: Device managed registration generally only works if all involved resources are managed as otherwise resources may be disabled or freed while they are still in use. This series fixes the SPI controller drivers that get this wrong by disabling resources such as clocks, DMA and interrupts while the controller (and its devices) are still registered, which can lead to issues like system errors due to unclocked accesses, NULL-pointer dereferences, hangs or just prevent SPI device drivers from doing I/O during during deregistration (e.g. to power down devices). I decided to split these fixes in two parts consisting of 20 and 26 patches respectively in order not to spam the lists too much. I've also prepared a follow-on series to convert the drivers here that do not yet use device managed controller allocation (which avoids taking extra references during deregistration). After that it should be possible to change the SPI API so that it no longer drops a reference during deregistration without too much effort (cf. [1]). Note that this series is based on spi/for-next which specifically has commit 1f8fd9490e31 ("spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()") (which is not in the for-7.1 branch). Johan [1] https://lore.kernel.org/lkml/20260325145319.1132072-1-johan@kernel.org/ commit c9c012706c9fa8ca6d129a9161caf92ab625a3fd Author: Johan Hovold Date: Fri Apr 10 10:17:56 2026 +0200 spi: zynq-qspi: fix controller deregistration Make sure to deregister the controller before disabling it during driver unbind. Note that clocks were also disabled before the recent commit 1f8fd9490e31 ("spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()"). Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller") Cc: stable@vger.kernel.org # 5.2: 8eb2fd00f65a Cc: stable@vger.kernel.org # 5.2 Cc: Naga Sureshkumar Relli Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-27-johan@kernel.org Signed-off-by: Mark Brown commit 6895fc4faafc9082e15e4e624b23dd5f0c98feb5 Author: Johan Hovold Date: Fri Apr 10 10:17:55 2026 +0200 spi: zynqmp-gqspi: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: dfe11a11d523 ("spi: Add support for Zynq Ultrascale+ MPSoC GQSPI controller") Cc: stable@vger.kernel.org # 4.2: 64640f6c972e Cc: stable@vger.kernel.org # 4.2 Cc: Ranjit Waghmode Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-26-johan@kernel.org Signed-off-by: Mark Brown commit 0245435f777264ac45945ed2f325dd095a41d1af Author: Johan Hovold Date: Fri Apr 10 10:17:54 2026 +0200 spi: uniphier: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind. Note that clocks were also disabled before the recent commit fdca270f8f87 ("spi: uniphier: Simplify clock handling with devm_clk_get_enabled()"). Fixes: 5ba155a4d4cc ("spi: add SPI controller driver for UniPhier SoC") Cc: stable@vger.kernel.org # 4.19 Cc: Keiji Hayashibara Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-25-johan@kernel.org Signed-off-by: Mark Brown commit 0c18a1bacbb1d8b8aa34d3d004a2cb8226c8b1ea Author: Johan Hovold Date: Fri Apr 10 10:17:53 2026 +0200 spi: ti-qspi: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Note that the controller is suspended before disabling and releasing resources since commit 3ac066e2227c ("spi: spi-ti-qspi: Suspend the queue before removing the device") which avoids issues like unclocked accesses but prevents SPI device drivers from doing I/O during deregistration. Fixes: 3b3a80019ff1 ("spi: ti-qspi: one only one interrupt handler") Cc: stable@vger.kernel.org # 3.13 Cc: Sebastian Andrzej Siewior Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-24-johan@kernel.org Signed-off-by: Mark Brown commit ad7310e983327f939dd6c4e801eab13238992572 Author: Johan Hovold Date: Fri Apr 10 10:17:52 2026 +0200 spi: tegra20-sflash: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: f12f7318c44a ("spi: tegra20-sflash: use devm_spi_register_master()") Cc: stable@vger.kernel.org # 3.13 Cc: Jingoo Han Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-23-johan@kernel.org Signed-off-by: Mark Brown commit 9c9c27ff2058142d8f800de3186d6864184958de Author: Johan Hovold Date: Fri Apr 10 10:17:51 2026 +0200 spi: tegra114: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: 5c8096439600 ("spi: tegra114: use devm_spi_register_master()") Cc: stable@vger.kernel.org # 3.13 Cc: Jingoo Han Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-22-johan@kernel.org Signed-off-by: Mark Brown commit 75d849c3452e9611de031db45b3149ba9a99035f Author: Johan Hovold Date: Fri Apr 10 10:17:50 2026 +0200 spi: syncuacer: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: b0823ee35cf9 ("spi: Add spi driver for Socionext SynQuacer platform") Cc: stable@vger.kernel.org # 5.3 Cc: Masahisa Kojima Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-21-johan@kernel.org Signed-off-by: Mark Brown commit d874a1c33aee0d88fb4ba2f8aeadaa9f1965209a Author: Johan Hovold Date: Fri Apr 10 10:17:49 2026 +0200 spi: sun6i: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: 3558fe900e8a ("spi: sunxi: Add Allwinner A31 SPI controller driver") Cc: stable@vger.kernel.org # 3.15 Cc: Maxime Ripard Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-20-johan@kernel.org Signed-off-by: Mark Brown commit 42108a2f03e0fdeabe9d02d085bdb058baa1189f Author: Johan Hovold Date: Fri Apr 10 10:17:48 2026 +0200 spi: sun4i: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: b5f6517948cc ("spi: sunxi: Add Allwinner A10 SPI controller driver") Cc: stable@vger.kernel.org # 3.15 Cc: Maxime Ripard Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-19-johan@kernel.org Signed-off-by: Mark Brown commit 19857374010d06ca6a2f7c2c53464122eb804df0 Author: Johan Hovold Date: Fri Apr 10 10:17:47 2026 +0200 spi: st-ssc4: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: 9e862375c542 ("spi: Add new driver for STMicroelectronics' SPI Controller") Cc: stable@vger.kernel.org # 4.0 Cc: Lee Jones Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-18-johan@kernel.org Signed-off-by: Mark Brown commit 123d17dbc5f07059752fa5e616385ca29a8f935a Author: Johan Hovold Date: Fri Apr 10 10:17:46 2026 +0200 spi: sprd: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Note that the controller is suspended before disabling and releasing resources since commit de082d866cce ("spi: sprd: Add the SPI irq function for the SPI DMA mode") which avoids issues like unclocked accesses but prevents SPI device drivers from doing I/O during deregistration. Fixes: e7d973a31c24 ("spi: sprd: Add SPI driver for Spreadtrum SC9860") Cc: stable@vger.kernel.org # 4.20 Cc: Lanqing Liu Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-17-johan@kernel.org Signed-off-by: Mark Brown commit ab840cbda4fe6c40e52f6415c47056797c663bb2 Author: Johan Hovold Date: Fri Apr 10 10:17:45 2026 +0200 spi: slave-mt27xx: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks (by disabling runtime PM) during driver unbind. Fixes: 805be7ddf367 ("spi: mediatek: add spi slave for Mediatek MT2712") Cc: stable@vger.kernel.org # 4.20 Cc: Leilk Liu Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-16-johan@kernel.org Signed-off-by: Mark Brown commit 0f25236694a2854627c1597465a071e6bb6fe572 Author: Johan Hovold Date: Fri Apr 10 10:17:44 2026 +0200 spi: sifive: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like interrupts during driver unbind. Note that clocks were also disabled before the recent commit 140039c23aca ("spi: sifive: Simplify clock handling with devm_clk_get_enabled()"). Fixes: 484a9a68d669 ("spi: sifive: Add driver for the SiFive SPI controller") Cc: stable@vger.kernel.org # 5.1 Cc: Yash Shah Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-15-johan@kernel.org Signed-off-by: Mark Brown commit 45170f67a08b912ead6ccc387ba06954d1d4e53a Author: Johan Hovold Date: Fri Apr 10 10:17:43 2026 +0200 spi: sh-msiof: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind. Fixes: 1bd6363bc0c6 ("spi: sh-msiof: Use core message handling instead of spi-bitbang") Cc: stable@vger.kernel.org # 3.15 Cc: Geert Uytterhoeven Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-14-johan@kernel.org Signed-off-by: Mark Brown commit e63982e6392e45a6ecd68d6c317a081cc8e70143 Author: Johan Hovold Date: Fri Apr 10 10:17:42 2026 +0200 spi: sh-hspi: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like clocks during driver unbind. Fixes: 49e599b8595f ("spi: sh-hspi: control spi clock more correctly") Cc: stable@vger.kernel.org # 3.4 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-13-johan@kernel.org Signed-off-by: Mark Brown commit c1446b61e472da24d1547525193467b4bea4a7cb Author: Johan Hovold Date: Fri Apr 10 10:17:41 2026 +0200 spi: s3c64xx: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind. Fixes: 91800f0e9005 ("spi/s3c64xx: Use managed registration") Cc: stable@vger.kernel.org # 3.13: 76fbad410c0f Cc: stable@vger.kernel.org # 3.13 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-12-johan@kernel.org Signed-off-by: Mark Brown commit 9944fa6726afb1e6eb7e2212764e7da0c97f2dcc Author: Johan Hovold Date: Fri Apr 10 10:17:40 2026 +0200 spi: rspi: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind. Fixes: 9e03d05eee4c ("spi: rcar: Use devm_spi_register_master()") Cc: stable@vger.kernel.org # 3.14 Cc: Jingoo Han Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-11-johan@kernel.org Signed-off-by: Mark Brown commit 443e3a0005a4342b218b6dbd4c6387d3c7fed85a Author: Johan Hovold Date: Fri Apr 10 10:17:39 2026 +0200 spi: qup: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support") Cc: stable@vger.kernel.org # 3.15 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-10-johan@kernel.org Signed-off-by: Mark Brown commit 994b33366be9148240690e3e94bffe17c4d89458 Author: Johan Hovold Date: Fri Apr 10 10:17:38 2026 +0200 spi: pl022: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind. Fixes: b43d65f7e818 ("[ARM] 5546/1: ARM PL022 SSP/SPI driver v3") Cc: stable@vger.kernel.org # 2.6.31 Cc: Linus Walleij Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-9-johan@kernel.org Signed-off-by: Mark Brown commit 420df79d1a618951eb0eb4331df95c9f4f763b8b Author: Johan Hovold Date: Fri Apr 10 10:17:37 2026 +0200 spi: pic32-sqi: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind. Fixes: 3270ac230f66 ("spi: pic32-sqi: add SPI driver for PIC32 SQI controller.") Cc: stable@vger.kernel.org # 4.7 Cc: Purna Chandra Mandal Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-8-johan@kernel.org Signed-off-by: Mark Brown commit 6b627bfe0c44e064aba464839e430dc1ca2b0bb8 Author: Johan Hovold Date: Fri Apr 10 10:17:36 2026 +0200 spi: pic32: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind. Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver") Cc: stable@vger.kernel.org # 4.7 Cc: Purna Chandra Mandal Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-7-johan@kernel.org Signed-off-by: Mark Brown commit fb45f95c377e4a4bdece2c5e17643b459c9c13e7 Author: Johan Hovold Date: Fri Apr 10 10:17:35 2026 +0200 spi: omap2-mcspi: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind. Fixes: ccdc7bf92573 ("SPI: omap2_mcspi driver") Cc: stable@vger.kernel.org # 2.6.23 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-6-johan@kernel.org Signed-off-by: Mark Brown commit ebd81199e00e107980bf8c4d2c747ae50158f797 Author: Johan Hovold Date: Fri Apr 10 10:17:34 2026 +0200 spi: npcm-pspi: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: 2a22f1b30cee ("spi: npcm: add NPCM PSPI controller driver") Cc: stable@vger.kernel.org # 5.0 Cc: Tomer Maimon Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-5-johan@kernel.org Signed-off-by: Mark Brown commit 8b0d0011af20fb547aa67a1cefbf320992fd5e92 Author: Johan Hovold Date: Fri Apr 10 10:17:33 2026 +0200 spi: mxs: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind. Fixes: 33e195acf268 ("spi: mxs: use devm_spi_register_master()") Cc: stable@vger.kernel.org # 3.13 Cc: Jingoo Han Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-4-johan@kernel.org Signed-off-by: Mark Brown commit 76336f24934621db286cabb20b483773ee01dcaa Author: Johan Hovold Date: Fri Apr 10 10:17:32 2026 +0200 spi: mtk-nor: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: 881d1ee9fe81 ("spi: add support for mediatek spi-nor controller") Cc: stable@vger.kernel.org # 5.7 Cc: Chuanhong Guo Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-3-johan@kernel.org Signed-off-by: Mark Brown commit 2ad30599cccc572ba2fc11010670eb6e01ea6bfc Author: Johan Hovold Date: Fri Apr 10 10:17:31 2026 +0200 spi: mt65xx: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: a568231f4632 ("spi: mediatek: Add spi bus for Mediatek MT8173") Cc: stable@vger.kernel.org # 4.3: ace145802350 Cc: stable@vger.kernel.org # 4.3 Cc: Leilk Liu Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410081757.503099-2-johan@kernel.org Signed-off-by: Mark Brown commit 5b94c94caafcad3c77cc6b1d213a93bf5dc0a98e Author: Breno Leitao Date: Wed Apr 8 06:45:43 2026 -0700 spi: tegra210-quad: Fix false positive WARN on interrupt timeout with transfer complete The WARN_ON_ONCE/WARN_ON fired unconditionally on any completion timeout, including the recoverable case where the interrupt was lost but the hardware actually finished the transfer. This produced a noisy splat with a full call trace even though the driver successfully recovered via tegra_qspi_handle_timeout(). Since tegra210 uses threaded interrupts, the transfer completion can be signaled before the interrupt fires, making this false positive case common in practice. Almost all the hosts I sysadmin in my fleet produce the following splat: WARNING: CPU: 47 PID: 844 at drivers/spi/spi-tegra210-quad.c:1226 tegra_qspi_transfer_one_message+0x8a4/0xba8 .... tegra-qspi NVDA1513:00: QSPI interrupt timeout, but transfer complete Move WARN_ON_ONCE/WARN_ON to fire only on real unrecoverable timeouts, i.e., when tegra_qspi_handle_timeout() confirms the hardware did NOT complete. This makes the warning actionable instead of just polluting the metrics. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260408-tegra_warn-v1-1-669a3bc74d77@debian.org Signed-off-by: Mark Brown commit 15818b2cd42df3cc886f4cc46acfab4d072dcacc Author: Jiri Pirko Date: Tue Apr 7 11:26:17 2026 +0200 dma-buf: heaps: system: document system_cc_shared heap Document the system_cc_shared dma-buf heap that was introduced recently. Describe its purpose, availability conditions and relation to confidential computing VMs. Signed-off-by: Jiri Pirko Reviewed-by: T.J.Mercier Acked-by: Sumit Semwal Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260407092617.635223-1-jiri@resnulli.us commit 6dd13023ec49dcbe9dd6781de524d9e63bb27a49 Merge: 9b7abfed4c3754 c958bb67b2dfd8 Author: Mark Brown Date: Fri Apr 10 13:20:01 2026 +0100 spi: rzv2h-rspi: Fix max_speed_hz and clock configuration issues Prabhakar says: This patch series addresses three issues in the RZV2H RSPI driver: 1. The max_speed_hz field was advertising a prohibited bit rate, which could lead to incorrect behavior when userspace applications attempt to set the SPI clock speed. 2. The clock configuration logic allowed for an invalid combination of SPR=0 and BRDV=0, which is not supported by the hardware. 3. Simplified the clock rate search function as min/max speed parameters are not needed. Note, patches apply on top of next-20260409. commit c958bb67b2dfd87b09d725a60162d13674fc5fd9 Author: Lad Prabhakar Date: Fri Apr 10 09:05:17 2026 +0100 spi: rzv2h-rspi: Simplify clock rate search function signatures The spr_min and spr_max parameters passed to rzv2h_rspi_find_rate_variable() and rzv2h_rspi_find_rate_fixed() were always called with RSPI_SPBR_SPR_MIN and RSPI_SPBR_SPR_MAX respectively. There is no need to pass these as parameters since the valid SPR range is fixed by the hardware. Signed-off-by: Lad Prabhakar Link: https://patch.msgid.link/20260410080517.2405700-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Mark Brown commit 0335767dd8e7ade8a8e3028d08c4621515d47388 Author: Lad Prabhakar Date: Fri Apr 10 09:05:16 2026 +0100 spi: rzv2h-rspi: Fix invalid SPR=0/BRDV=0 clock configuration The combination of SPR=0 and BRDV=0 results in the minimum division ratio of 2, producing the maximum possible bit rate for a given clock source. This combination is not supported in two cases: - On RZ/G3E, RZ/G3L, RZ/V2H(P) and RZ/V2N, RSPI_n_TCLK is fixed at 200MHz, which would yield 100Mbps. The next hardware manual update will explicitly state that since the maximum frequency of the RSPICKn clock signal is 50MHz, settings with N=0 and n=0 resulting in 100Mbps are prohibited. - On RZ/T2H and RZ/N2H, when PCLK (125MHz) is used as the clock source, SPR=0 and BRDV=0 is explicitly listed as unsupported in the hardware manual (Table 36.7). Skip the SPR=0/BRDV=0 combination in rzv2h_rspi_find_rate_fixed() to prevent the driver from selecting an invalid clock configuration on the affected SoCs. Additionally, remove the now redundant RSPI_SPBR_SPR_PCLK_MIN define which was previously set to 1 to work around the PCLK restriction, but was overly broad as it incorrectly blocked valid combinations such as SPR=0/BRDV=1 (31.25Mbps on PCLK=125MHz). Fixes: 8b61c8919dff ("spi: Add driver for the RZ/V2H(P) RSPI IP") Fixes: 1ce3e8adc7d0 ("spi: rzv2h-rspi: add support for using PCLK for transfer clock") Signed-off-by: Lad Prabhakar Link: https://patch.msgid.link/20260410080517.2405700-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Mark Brown commit 4e292cbf3890657db2f2692942cb0f168c80167e Author: Lad Prabhakar Date: Fri Apr 10 09:05:15 2026 +0100 spi: rzv2h-rspi: Fix max_speed_hz advertising prohibited bit rate On RZ/V2H(P), RZ/G3E and RZ/G3L, RSPI_n_TCLK is fixed at 200MHz. The max_speed_hz was computed using clk_round_rate(tclk, ULONG_MAX) with SPR=0 and BRDV=0, resulting in 100Mbps - the exact combination prohibited on these SoCs. This could cause the SPI framework to request a speed that rzv2h_rspi_find_rate_fixed() would skip, potentially leading to a clock selection failure. On RZ/T2H and RZ/N2H the max_speed_hz was correctly calculated as 50Mbps for both the variable PCLKSPIn and fixed PCLK clock sources. Since the maximum supported bit rate is 50Mbps across all supported SoC variants, replace the clk_round_rate() based calculation with a define RSPI_MAX_SPEED_HZ set to 50MHz and use it directly for max_speed_hz. Signed-off-by: Lad Prabhakar Link: https://patch.msgid.link/20260410080517.2405700-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Mark Brown commit 9b7abfed4c3754062d1f3ffd452e65a38667f586 Author: Johan Hovold Date: Fri Apr 10 08:47:49 2026 +0200 spi: fsl: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind. Fixes: 4178b6b1b595 ("spi: fsl-(e)spi: migrate to using devm_ functions to simplify cleanup") Cc: stable@vger.kernel.org # 4.3 Cc: Heiner Kallweit Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260410064749.496888-1-johan@kernel.org Signed-off-by: Mark Brown commit 78405e7f42fa9127325c65aec9289187f67ac5ce Author: Ben Guo Date: Fri Apr 10 10:41:13 2026 +0800 docs/zh_CN: update rust/index.rst translation Update the translation of .../rust/index.rst into Chinese. Update the translation through commit a592a36e4937 ("Documentation: use a source-read extension for the index link boilerplate") Reviewed-by: Dongliang Mu Reviewed-by: Gary Guo Signed-off-by: Ben Guo Signed-off-by: Alex Shi commit 1e75555ee443b8d4c654535fa79435982c0b3722 Author: Ben Guo Date: Fri Apr 10 10:41:12 2026 +0800 docs/zh_CN: update rust/quick-start.rst translation Update the translation of .../rust/quick-start.rst into Chinese. Update the translation through commit 5935461b4584 ("docs: rust: quick-start: add Debian 13 (Trixie)") Reviewed-by: Dongliang Mu Reviewed-by: Gary Guo Signed-off-by: Ben Guo Acked-by: Gary Guo # Rust Signed-off-by: Alex Shi commit a32ee1a808fe7dd9c3fa48d2af83334d47e76b78 Author: Ben Guo Date: Fri Apr 10 10:41:11 2026 +0800 docs/zh_CN: update rust/coding-guidelines.rst translation Update the translation of .../rust/coding-guidelines.rst into Chinese. Update the translation through commit 4a9cb2eecc78 ("docs: rust: add section on imports formatting") Reviewed-by: Dongliang Mu Reviewed-by: Gary Guo Signed-off-by: Ben Guo Signed-off-by: Alex Shi commit 4c361fc63d89cd2f8ca1a49d2c552664ed1793c1 Author: Ben Guo Date: Fri Apr 10 10:41:10 2026 +0800 docs/zh_CN: update rust/arch-support.rst translation Update the translation of .../rust/arch-support.rst into Chinese. Update the translation through commit ccb8ce526807 ("ARM: 9441/1: rust: Enable Rust support for ARMv7") Reviewed-by: Dongliang Mu Reviewed-by: Gary Guo Signed-off-by: Ben Guo Signed-off-by: Alex Shi commit 8c199fb49871cad666e408af41ca3c145679b8a4 Author: Song Hongyi Date: Wed Mar 11 20:31:03 2026 +0800 docs/zh_CN: sync process/2.Process.rst with English version The Chinese translation of the development process documentation was outdated. Sync it with the current English version to ensure consistency. Key changes include: - Update versioning examples from 5.x to the 9.x placeholder. - Add footnote [1] to explain the non-semantic versioning scheme. - Replace the obsolete LTS kernel table with a link to kernel.org. - Add a cross-reference for the "interleaved replies" section. Update the translation through commit 5ce70894f6ca ("Doc: correct spelling and wording mistakes") Signed-off-by: Song Hongyi Signed-off-by: Alex Shi commit 29442165759cd557194815cdba391a4bf37db05e Author: LIU Haoyang Date: Fri Mar 6 04:10:58 2026 +0800 docs/zh_CN: fix an inconsistent statement in dev-tools/testing-overview This patch fixes an inconsistent describtion in testing-overview.rst, which should be ``kmalloc`` instead of ``kmalloc_arry`` according to the original text. Signed-off-by: LIU Haoyang Reviewed-by: Dongliang Mu Signed-off-by: Alex Shi commit 485c900a42e8e41177754d191bc5152f8dcd565c Merge: 573c7db8fce91a 705355a82b8ea8 Author: Mark Brown Date: Fri Apr 10 12:47:33 2026 +0100 spi: Merge up fixes Needed for Johan's controller deregistration ordering changes. commit 2603ea46ce5c59568cf968ce35d2bf2854042182 Author: Jack Yu Date: Fri Apr 10 14:42:25 2026 +0800 ASoC: rt1320-sdw: Add an approach to get new hardware advance gain Add an approach to get new hardware advance gain, and if there is no advance gain with this approach, we can still get advance gain with original method. Signed-off-by: Jack Yu Link: https://patch.msgid.link/20260410064225.662656-1-jack.yu@realtek.com Signed-off-by: Mark Brown commit cd1be4b2c6398c915d9685d2cf94d93385c08486 Merge: 8f993d30b95dc9 498c05821bb42f Author: Greg Kroah-Hartman Date: Fri Apr 10 13:10:28 2026 +0200 Merge tag 'thunderbolt-for-v7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next Mika writes: thunderbolt: Changes for v7.1 merge window This includes following USB4/Thunderbolt changes for the v7.1 merge window: - Disable CL-states for Titan Ridge based devices with older firmware. - MAINTAINER update. - Simplify allocation of various structures with kzalloc_flex(). All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: tunnel: Simplify allocation thunderbolt: Use kzalloc_flex() for struct tb_path allocation thunderbolt: dma_port: kmalloc_array + kzalloc to flex MAINTAINERS: Remove bouncing maintainer, Mika takes over DMA test driver thunderbolt: Disable CLx on Titan Ridge-based devices with old firmware thunderbolt: Read router NVM version before applying quirks commit 558f5228e1dbfa995b7303e20f26836525e85151 Author: Charles Keepax Date: Fri Apr 10 11:45:00 2026 +0100 ASoC: SDCA: Update text of FIXME A couple of attempts to correct this FIXME have been sent upstream but the situation is not quite a simple as the FIXME implies. Update the FIXME to include a better description of the situation. Link: https://lore.kernel.org/linux-sound/20260408085607.3813488-1-shumingf@realtek.com/ Link: https://lore.kernel.org/linux-sound/20260324-sdca-function-status-init-irq-v1-1-bba49417a4e0@gmail.com/ Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260410104500.163337-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit cd1a3b2ff0553e987de71ff0aa675e418de22898 Merge: ecc26ba41ce254 bf746e2a41efd9 Author: Rafael J. Wysocki Date: Fri Apr 10 13:00:36 2026 +0200 Merge tag 'thermal-v7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux Merge updates of assorted thermal drivers for 7.1-rc1 from Daniel Lezcano: "- Added an OF node address to output message to make sensor names more distinguishable (Alexander Stein) - Added hwmon support for the i.MX97 thermal sensor (Alexander Stein) - Clamped correctly the results when doing value/temperature conversion in the Spreadtrum driver (Thorsten Blum) - Added the SDM670 compatible DT bindings for the Tsens and the lMH drivers (Richard Acayan) - Added the SM8750 compatible DT bindings for the Tsens (Manaf Meethalavalappu Pallikunhi) - Added the Eliza SoC compatible DT bindings for the Tsens (Krzysztof Kozlowski) - Fixed inverted condition check on error in the Spear driver (Gopi Krishna Menon) - Converted the DT bindings documentation into DT schema (Gopi Krishna Menon) - Used max() macro to increase readibility in the Broadcom STB thermal sensor (Thorsten Blum) - Removed stale @trim_offset kernel-doc entry (John Madieu)" * tag 'thermal-v7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: thermal: renesas: rzg3e: Remove stale @trim_offset kernel-doc entry thermal/drivers/brcmstb_thermal: Use max to simplify brcmstb_get_temp dt-bindings: thermal: st,thermal-spear1340: convert to dtschema thermal/drivers/spear: Fix error condition for reading st,thermal-flags dt-bindings: thermal: qcom-tsens: Add Eliza SoC TSENS dt-bindings: thermal: qcom-tsens: Document the SM8750 Temperature Sensor thermal/drivers/sprd: Use min instead of clamp in sprd_thm_temp_to_rawdata dt-bindings: thermal: lmh: Add SDM670 compatible dt-bindings: thermal: tsens: add SDM670 compatible thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata thermal/drivers/imx91: Add hwmon support thermal/of: Add OF node address to output message commit de76a763805d0051242b3862823b34d894ec81f9 Author: Alexey Charkov Date: Tue Mar 31 19:43:41 2026 +0400 regulator: bq257xx: Make OTG enable GPIO really optional The bindings describe the OTG enable GPIO as optional, but the driver gets upset if it's not provided in the device tree. Make the driver accept the absence of the GPIO, and just use register writes to handle OTG mode in that case, skipping the error message for -ENOENT. Acked-by: Mark Brown Tested-by: Chris Morgan Signed-off-by: Alexey Charkov Link: https://patch.msgid.link/20260331-bq25792-v6-4-0278fba33eb9@flipper.net Signed-off-by: Mark Brown commit aef4d87f2c1fdb87e55ea2cbe3ea47b01b256f57 Author: Alexey Charkov Date: Tue Mar 31 19:43:39 2026 +0400 regulator: bq257xx: Remove reference to the parent MFD's dev Drop the ->bq field from the platform data of the bq257xx regulator driver, which was only used to get the regmap of the parent MFD device, and use the regmap from the regulator_dev instead, slimming down the code a bit. Acked-by: Mark Brown Tested-by: Chris Morgan Signed-off-by: Alexey Charkov Link: https://patch.msgid.link/20260331-bq25792-v6-2-0278fba33eb9@flipper.net Signed-off-by: Mark Brown commit 34e563947c76201c6e941ac17dd35eb87c0e68bb Author: Aneesh Kumar K.V (Arm) Date: Tue Apr 7 20:59:00 2026 +0530 arm64: rsi: use linear-map alias for realm config buffer rsi_get_realm_config() passes its argument to virt_to_phys(), but &config is a kernel image address and not a linear-map alias. On arm64 this triggers the below warning: virt_to_phys used for non-linear address: (____ptrval____) (config+0x0/0x1000) WARNING: arch/arm64/mm/physaddr.c:15 at __virt_to_phys+0x50/0x70, CPU#0: swapper/0 Modules linked in: ..... Hardware name: linux,dummy-virt (DT) pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __virt_to_phys+0x50/0x70 lr : __virt_to_phys+0x4c/0x70 ..... ...... Call trace: __virt_to_phys+0x50/0x70 (P) arm64_rsi_init+0xa0/0x1b8 setup_arch+0x13c/0x1a0 start_kernel+0x68/0x398 __primary_switched+0x88/0x90 Pass lm_alias(&config) instead so the RSI call uses the linear-map alias of the same buffer and avoids the boot-time warning. Signed-off-by: Aneesh Kumar K.V (Arm) Signed-off-by: Catalin Marinas commit d923f70e37310fe613883a3a4c2ea2f31246253b Merge: 2bd33eb5075448 6e6e1e3be6d864 Author: Rafael J. Wysocki Date: Fri Apr 10 12:48:32 2026 +0200 Merge branch 'pm-devfreq' Merge devfreq updates for 7.1-rc1: - Remove unneeded casting for HZ_PER_KHZ in devfreq (Andy Shevchenko) - Use _visible attribute to replace create/remove_sysfs_files() in devfreq (Pengjie Zhang) - Add Tegra114 support to activity monitor device in tegra30-devfreq as a preparation to upcoming EMC controller support (Svyatoslav Ryhel) * pm-devfreq: PM / devfreq: tegra30-devfreq: add support for Tegra114 PM / devfreq: use _visible attribute to replace create/remove_sysfs_files() PM / devfreq: Remove unneeded casting for HZ_PER_KHZ commit 8ad7f3b265a87cd4e5052677545f90f14c855b10 Author: Pei Xiao Date: Fri Apr 10 10:29:24 2026 +0800 regmap: i3c: Add non-devm regmap_init_i3c() helper Add __regmap_init_i3c() and the corresponding regmap_init_i3c() macro to allow creating a regmap for I3C devices without using the device-managed version. This mirrors the pattern already established for other buses such as I2C, SPI and so on, giving drivers more flexibility when the regmap lifetime is not directly tied to the device. Signed-off-by: Pei Xiao Link: https://patch.msgid.link/a81256a8866b163979a20406abf01df7d7440104.1775788105.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit 2bd33eb50754489dc75175e730eeeb7fcfac474f Merge: 7431d90cfc07b5 c3bb8d4f5d802e Author: Rafael J. Wysocki Date: Fri Apr 10 12:43:10 2026 +0200 Merge branch 'pm-powercap' Merge power capping updates for 7.1-rc1: - Clean up and rearrange the intel_rapl power capping driver to make the respective interface drivers (TPMI, MSR, and MMOI) hold their own settings and primitives and consolidate PL4 and PMU support flags into rapl_defaults (Kuppuswamy Sathyanarayanan) - Correct kernel-doc function parameter names in the power capping core code (Randy Dunlap) * pm-powercap: powercap: intel_rapl: Consolidate PL4 and PMU support flags into rapl_defaults powercap: intel_rapl: Move MSR primitives to MSR driver thermal: intel: int340x: processor: Move MMIO primitives to MMIO driver powercap: intel_rapl: Move TPMI primitives to TPMI driver powercap: intel_rapl: Move primitive info to header for interface drivers powercap: intel_rapl: Remove unused macro definitions powercap: intel_rapl: Move MSR default settings into MSR interface driver powercap: intel_rapl: Remove unused AVERAGE_POWER primitive powercap: correct kernel-doc function parameter names thermal: intel: int340x: processor: Move RAPL defaults to MMIO driver powercap: intel_rapl: Move TPMI default settings into TPMI interface driver powercap: intel_rapl: Allow interface drivers to configure rapl_defaults powercap: intel_rapl: Use unit conversion macros from units.h powercap: intel_rapl: Use GENMASK() and BIT() macros powercap: intel_rapl: Use shifts for power-of-2 operations powercap: intel_rapl: Simplify rapl_compute_time_window_atom() powercap: intel_rapl: Remove unused TIME_WINDOW macros powercap: intel_rapl: Cleanup coding style powercap: intel_rapl: Add a symbol namespace for intel_rapl exports commit 7431d90cfc07b5f62d1a6b7d3e4fa22aad754710 Merge: 83e990310dfc92 629be87e0d6be4 e810f1f8015f78 949a5ed0826b42 Author: Rafael J. Wysocki Date: Fri Apr 10 12:37:27 2026 +0200 Merge branches 'pm-cpuidle', 'pm-opp' and 'pm-sleep' Merge cpuidle updates, OPP (operating performance points) library updates, and updates related to system suspend and hibernation for 7.1-rc1: - Refine stopped tick handling in the menu cpuidle governor and rearrange stopped tick handling in the teo cpuidle governor (Rafael Wysocki) - Add Panther Lake C-states table to the intel_idle driver (Artem Bityutskiy) - Clean up dead dependencies on CPU_IDLE in Kconfig (Julian Braha) - Simplify cpuidle_register_device() with guard() (Huisong Li) - Use performance level if available to distinguish between rates in OPP debugfs (Manivannan Sadhasivam) - Fix scoped_guard in dev_pm_opp_xlate_required_opp() (Viresh Kumar) - Return -ENODATA if the snapshot image is not loaded (Alberto Garcia) - Remove inclusion of crypto/hash.h from hibernate_64.c on x86 (Eric Biggers) * pm-cpuidle: cpuidle: Simplify cpuidle_register_device() with guard() cpuidle: clean up dead dependencies on CPU_IDLE in Kconfig intel_idle: Add Panther Lake C-states table cpuidle: governors: teo: Rearrange stopped tick handling cpuidle: governors: menu: Refine stopped tick handling * pm-opp: OPP: Move break out of scoped_guard in dev_pm_opp_xlate_required_opp() OPP: debugfs: Use performance level if available to distinguish between rates * pm-sleep: PM: hibernate: return -ENODATA if the snapshot image is not loaded PM: hibernate: x86: Remove inclusion of crypto/hash.h commit 72dcd84938f5026dc44d0e7e1e68d9d571c113a0 Author: Ihor Uzlov Date: Fri Apr 10 11:45:53 2026 +0200 ASoC: amd: yc: Add MSI Vector A16 HX A8WHG to quirk table Add the MSI Vector A16 HX A8WHG (board MS-15MM) to the DMI quirk table to enable DMIC support. This laptop uses an AMD Ryzen 9 7945HX (Dragon Range) with the ACP6x audio coprocessor (rev 0x62) and a Realtek ALC274 codec. The built-in digital microphone is connected via the ACP PDM interface and requires this DMI entry to be activated. Tested on MSI Vector A16 HX A8WHG with kernel 6.8.0-107 (Ubuntu 24.04). DMIC capture device appears as 'acp6x' and records audio correctly. Signed-off-by: Ihor Uzlov Link: https://patch.msgid.link/20260410094553.24654-1-igor.uzlov@gmail.com Signed-off-by: Mark Brown commit 0cb7aa965ad02e90ba7d6bf847f3de07e8d0c05e Author: Linus Walleij Date: Thu Apr 9 23:39:31 2026 +0200 ASoC: uda1380: Modernize the driver This codec driver depended on the legacy GPIO API, and nothing in the kernel is defining the platform data, so get rid of this. Two in-kernel device trees are defining this codec using undocumented device tree properties, so support these for now. The same properties can be defined using software nodes if board files are desired. The device tree use the "-gpio" rather than "-gpios" suffix but the GPIO DT parser will deal with that. Since there may be out of tree users, migrate to GPIO descriptors, drop the platform data that is unused, and assign the dac_clk the value that was used in all platforms found in a historical dig, and support setting the clock to the PLL using the undocumented device tree property. Add some menuconfig so the codec can be selected and tested. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260409-asoc-uda1380-v3-1-b3d5a53f31be@kernel.org Signed-off-by: Mark Brown commit 62443dc21114c0bbc476fa62973db89743f2f137 Author: Zhengchuan Liang Date: Sat Apr 4 17:39:48 2026 +0800 netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`. Suggested-by: Florian Westphal Tested-by: Ren Wei Signed-off-by: Zhengchuan Liang Signed-off-by: Ren Wei Signed-off-by: Florian Westphal commit 1dfd95bdf4d18d263aa8fad06bfb9f4d9c992b18 Author: Florian Westphal Date: Thu Apr 9 13:30:41 2026 +0200 netfilter: nft_fwd_netdev: check ttl/hl before forwarding Drop packets if their ttl/hl is too small for forwarding. Fixes: d32de98ea70f ("netfilter: nft_fwd_netdev: allow to forward packets via neighbour layer") Signed-off-by: Florian Westphal commit f30e5a7291a879deeeb6b9ba92b12c9be1ee5f29 Author: Gustavo A. R. Silva Date: Thu Apr 9 16:34:43 2026 -0600 netfilter: x_tables: Avoid a couple -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the TRAILING_OVERLAP() helper to fix the following warnings: 1 net/netfilter/x_tables.c:816:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] 1 net/netfilter/x_tables.c:811:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] This helper creates a union between a flexible-array member (FAM) and a set of members that would otherwise follow it. This overlays the trailing members onto the FAM while preserving the original memory layout. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Florian Westphal commit 84dee05d9d61884ee0986f5b4f3d69886f7dfeb0 Author: Fernando Fernandez Mancera Date: Mon Mar 30 17:19:34 2026 +0200 netfilter: conntrack: remove UDP-Lite conntrack support UDP-Lite (RFC 3828) socket support was recently retired from the core networking stack. As a follow-up of that, drop the connection tracker and NAT support for UDP-Lite in Netfilter. This patch removes CONFIG_NF_CT_PROTO_UDPLITE and scrubs UDP-Lite awareness from the conntrack core, NAT core, nft_ct, and ctnetlink. Please note that stateless packet inspection, matching, ipsets or logging support for IPPROTO_UDPLITE is preserved. As conntrack no longer extracts UDP-Lite ports or tracks its L4 state, when performing NAT the UDP-Lite checksum cannot be updated anymore. That is an expected and acceptable consequence of removing UDP-Lite conntrack module. Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit 542be3fa5aff54210a02954c38f07e53ea9bdafd Author: Florian Westphal Date: Sat Apr 4 12:12:59 2026 +0200 netfilter: xt_socket: enable defrag after all other checks Originally this did not matter because defrag was enabled once per netns and only disabled again on netns dismantle. When this got changed I should have adjusted checkentry to not leave defrag enabled on error. Fixes: de8c12110a13 ("netfilter: disable defrag once its no longer needed") Signed-off-by: Florian Westphal commit 24bd5c2679caf8a228d90cafa221da4b47fd6642 Author: Marino Dzalto Date: Fri Apr 3 22:59:07 2026 +0200 netfilter: xt_HL: add pr_fmt and checkentry validation Add pr_fmt to prefix log messages with the module name for easier debugging in dmesg. Add checkentry functions for IPv4 (ttl_mt_check) and IPv6 (hl_mt6_check) to validate the match mode at rule registration time, rejecting invalid modes with -EINVAL. The evaluation function returns false in case the mode is unknown, so this is a cleanup, not a bug fix. Signed-off-by: Marino Dzalto Signed-off-by: Florian Westphal commit 74feb7d373b32a63d7986a2caf9689c860c9a761 Author: Florian Westphal Date: Sat Apr 4 12:09:05 2026 +0200 netfilter: nfnetlink: prefer skb_mac_header helpers This adds implicit DEBUG_WARN_ON_ONCE for debug configurations. No other changes intended. Signed-off-by: Florian Westphal commit 8df772afc9d016b597d22a1431e7011b90ce1fb3 Author: Florian Westphal Date: Sat Mar 28 23:00:31 2026 +0100 netfilter: x_physdev: reject empty or not-nul terminated device names Reject names that lack a \0 character and reject the empty string as well. iptables allows this but it fails to re-parse iptables-save output that contain such rules. Signed-off-by: Florian Westphal commit 8d7de5477e47525c870b599fb2de06ef8af63466 Author: Julian Anastasov Date: Sat Apr 4 18:34:39 2026 +0300 ipvs: add conn_lfactor and svc_lfactor sysctl vars Allow the default load factor for the connection and service tables to be configured. Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit 9a9ccef907a7a8722ed27013c925baf68b7c0506 Author: Julian Anastasov Date: Sat Apr 4 18:34:38 2026 +0300 ipvs: add ip_vs_status info Add /proc/net/ip_vs_status to show current state of IPVS. The motivation for this new /proc interface is to provide the output for the users to help them decide when to tune the load factor for hash tables, which is possible with the new sysctl knobs coming in followup patch. The output also includes information for the kthreads used for stats. Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit 22e620fe8455870ee1aa26aca6f2b5277a57431f Author: Julian Anastasov Date: Sat Apr 4 18:34:37 2026 +0300 ipvs: show the current conn_tab size to users As conn_tab is per-net, better to show the current hash table size to users instead of the ip_vs_conn_tab_size (max). Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit 74b63934abf5011d4ff0ac6ece5cffca9d5647ac Author: Michael Ugrin Date: Thu Apr 9 09:24:12 2026 -0700 arm64: Kconfig: fix duplicate word in CMDLINE help text Remove duplicate 'the' in the CMDLINE config help text. Signed-off-by: Michael Ugrin Signed-off-by: Catalin Marinas commit 83e990310dfc92be7cf84c9008137d3275363d94 Merge: 2acabc866c688f 67934397758878 Author: Rafael J. Wysocki Date: Fri Apr 10 12:05:32 2026 +0200 Merge branch 'pm-cpufreq' Merge cpufreq updates for 7.1-rc1: - Update qcom-hw DT bindings to include Eliza hardware (Abel Vesa) - Update cpufreq-dt-platdev blocklist (Faruque Ansari) - Minor updates to driver and dt-bindings for Tegra (Thierry Reding, Rosen Penev) - Add MAINTAINERS entry for CPPC driver (Viresh Kumar) - Add support for new features: CPPC performance priority, Dynamic EPP, Raw EPP, and new unit tests for them to amd-pstate (Gautham Shenoy, Mario Limonciello) - Fix sysfs files being present when HW missing and broken/outdated documentation in the amd-pstate driver (Ninad Naik, Gautham Shenoy) - Pass the policy to cpufreq_driver->adjust_perf() to avoid using cpufreq_cpu_get() in the .adjust_perf() callback in amd-pstate which leads to a scheduling-while-atomic bug (K Prateek Nayak) - Clean up dead code in Kconfig for cpufreq (Julian Braha) - Remove max_freq_req update for pre-existing cpufreq policy and add a boost_freq_req QoS request to save the boost constraint instead of overwriting the last scaling_max_freq constraint (Pierre Gondois) - Embed cpufreq QoS freq_req objects in cpufreq policy so they all are allocated in one go along with the policy to simplify lifetime rules and avoid error handling issues (Viresh Kumar) - Use DMI max speed when CPPC is unavailable in the acpi-cpufreq scaling driver (Henry Tseng) - Switch policy_is_shared() in cpufreq to using cpumask_nth() instead of cpumask_weight() because the former is more efficient (Yury Norov) - Use sysfs_emit() in sysfs show functions for cpufreq governor attributes (Thorsten Blum) - Update intel_pstate to stop returning an error when "off" is written to its status sysfs attribute while the driver is already off (Fabio De Francesco) - Include current frequency in the debug message printed by __cpufreq_driver_target() (Pengjie Zhang) * pm-cpufreq: (38 commits) cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP MAINTAINERS: amd-pstate: Step down as maintainer, add Prateek as reviewer cpufreq: Pass the policy to cpufreq_driver->adjust_perf() cpufreq/amd-pstate: Pass the policy to amd_pstate_update() cpufreq/amd-pstate-ut: Add a unit test for raw EPP cpufreq/amd-pstate: Add support for raw EPP writes cpufreq/amd-pstate: Add support for platform profile class cpufreq/amd-pstate: add kernel command line to override dynamic epp cpufreq/amd-pstate: Add dynamic energy performance preference Documentation: amd-pstate: fix dead links in the reference section cpufreq/amd-pstate: Cache the max frequency in cpudata Documentation/amd-pstate: Add documentation for amd_pstate_floor_{freq,count} Documentation/amd-pstate: List amd_pstate_prefcore_ranking sysfs file Documentation/amd-pstate: List amd_pstate_hw_prefcore sysfs file amd-pstate-ut: Add a testcase to validate the visibility of driver attributes amd-pstate-ut: Add module parameter to select testcases amd-pstate: Introduce a tracepoint trace_amd_pstate_cppc_req2() amd-pstate: Add sysfs support for floor_freq and floor_count amd-pstate: Add support for CPPC_REQ2 and FLOOR_PERF x86/cpufeatures: Add AMD CPPC Performance Priority feature. ... commit 3f100dd61ad4ee7c1fb6a44775a928dcdba7515b Author: Pengpeng Hou Date: Tue Mar 10 08:08:00 2026 +0000 xen/grant-table: guard gnttab_suspend/resume with CONFIG_HIBERNATE_CALLBACKS In current linux.git, gnttab_suspend() and gnttab_resume() are defined and declared unconditionally. However, their only in-tree callers reside in drivers/xen/manage.c, which are guarded by CONFIG_HIBERNATE_CALLBACKS. Match the helper scope to their callers by wrapping the definitions in CONFIG_HIBERNATE_CALLBACKS and providing no-op stubs in the header. This fixes the config-scope mismatch and reduces the code footprint when hibernation callbacks are disabled. Signed-off-by: Pengpeng Hou Signed-off-by: Juergen Gross Message-ID: <20260310080800.742223-1-pengpeng.hou@isrc.iscas.ac.cn> commit bdd5de3d9e2da45852d0d21313af3a02f0e0626e Author: Jason Andryuk Date: Wed Mar 18 19:53:26 2026 -0400 hvc/xen: Check console connection flag When the console out buffer is filled, __write_console() will return 0 as it cannot send any data. domU_write_console() will then spin in `while (len)` as len doesn't decrement until xenconsoled attaches. This would block a domU and nullify the parallelism of Hyperlaunch until dom0 userspace starts xenconsoled, which empties the buffer. Xen 4.21 added a connection field to the xen console page. This is set to XENCONSOLE_DISCONNECTED (1) when a domain is built, and xenconsoled will set it to XENCONSOLE_CONNECTED (0) when it connects. Update the hvc_xen driver to check the field. When the field is disconnected, drop the write with -ENOTCONN. We only drop the write when the field is XENCONSOLE_DISCONNECTED (1) to try for maximum compatibility. The Xen toolstack has historically zero initialized the console, so it should see XENCONSOLE_CONNECTED (0) by default. If an implemenation used uninitialized memory, only checking for XENCONSOLE_DISCONNECTED could have the lowest chance of not connecting. This lets the hyperlaunched domU boot without stalling. Once dom0 starts xenconsoled, xl console can be used to access the domU's hvc0. Paritally sync console.h from xen.git to bring in the new field. Reviewed-by: Stefano Stabellini Signed-off-by: Jason Andryuk Signed-off-by: Juergen Gross Message-ID: <20260318235326.14568-1-jason.andryuk@amd.com> commit fdfdd01e801f4e808cba27b3e78504cfeca610d9 Author: Kexin Sun Date: Sat Mar 21 19:00:39 2026 +0800 xen/swiotlb: fix stale reference to swiotlb_unmap_page() Commit af85de5a9f00 ("xen: swiotlb: Switch to physical address mapping callbacks") renamed xen_swiotlb_unmap_page() to xen_swiotlb_unmap_phys(). The comment in xen_swiotlb_unmap_sg() had already been missing the xen_ prefix (reading swiotlb_unmap_page()), and the rename only changed _page to _phys without correcting this, leaving it as swiotlb_unmap_phys(). Fix the reference to use the correct function name xen_swiotlb_unmap_phys(). Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Signed-off-by: Juergen Gross Message-ID: <20260321110039.8905-1-kexinsun@smail.nju.edu.cn> commit 7f8862d2873d8b0e0df805a9aef1972d8ad4f08e Author: GuoHan Zhao Date: Tue Apr 7 10:24:43 2026 +0800 xen/manage: unwind partial shutdown watcher setup on error setup_shutdown_watcher() registers shutdown_watch first, then the sysrq watch, and finally publishes the supported feature-* nodes in xenstore. If sysrq watch registration fails, or xenbus_printf() fails after one or more feature nodes were created, the function returns immediately without undoing the earlier setup. This leaves the system in a partially initialized state, with registered watches and/or stale xenstore entries despite the function reporting failure. Unwind the partial setup before returning an error by unregistering any watches that were already registered and removing feature nodes that were already published. Signed-off-by: GuoHan Zhao Reviewed-by: Stefano Stabellini Signed-off-by: Juergen Gross Message-ID: <20260407022443.12971-1-zhaoguohan@kylinos.cn> commit dcd47f27c01e795395379025525bfd47a99a91e1 Author: fangqiurong Date: Fri Apr 10 14:47:53 2026 +0800 selftests/sched_ext: Fix wrong DSQ ID in peek_dsq error message The error path after scx_bpf_create_dsq(real_dsq_id, ...) was reporting test_dsq_id instead of real_dsq_id in the error message, which would mislead debugging. Signed-off-by: fangqiurong Signed-off-by: Tejun Heo commit a5242d37c83abe86df95c6941e2ace9f9055ffcb Author: Gao Xiang Date: Fri Apr 10 16:48:38 2026 +0800 erofs: error out obviously illegal extents in advance Detect some corrupted extent cases during metadata parsing rather than letting them result in harmless decompression failures later: - For full-reference compressed extents, the compressed size must not exceed the decompressed size, which is a strict on-disk layout constraint; - For plain (shifted/interlaced) extents, the decoded size must not exceed the encoded size, even accounting for partial decoding. Both ways work but it should be better to report illegal extents as metadata layout violations rather than deferring as decompression failure. Signed-off-by: Gao Xiang commit 5c40d2e9e3ce9e81d76773c68756e9b07cce802c Author: Gao Xiang Date: Fri Apr 10 16:48:37 2026 +0800 erofs: clean up encoded map flags - Remove EROFS_MAP_ENCODED since it was always set together with EROFS_MAP_MAPPED for compressed extents and checked redundantly; - Replace the EROFS_MAP_FULL_MAPPED flag with the opposite EROFS_MAP_PARTIAL_MAPPED flag so that extents are implicitly fully mapped initially to simplify the logic; - Make fragment extents independent of EROFS_MAP_MAPPED since they are not directly allocated on disk; thus fragment extents are no longer twisted with mapped extents. Signed-off-by: Gao Xiang commit f45ab27774aadeee28f093a9f074892e9bebb586 Author: Pengpeng Hou Date: Sun Apr 5 08:42:00 2026 +0800 ARM: xen: validate hypervisor compatible before parsing its version fdt_find_hyper_node() reads the raw compatible property and then derives hyper_node.version from a prefix match before later printing it with %s. Flat DT properties are external boot input, and this path does not prove that the first compatible entry is NUL-terminated within the returned property length. Keep the existing flat-DT lookup path, but verify that the first compatible entry terminates within the returned property length before deriving the version suffix from it. Signed-off-by: Pengpeng Hou Reviewed-by: Stefano Stabellini Signed-off-by: Juergen Gross Message-ID: <20260405094005.5-arm-xen-v2-pengpeng@iscas.ac.cn> commit 71ba9a5cb125998a875e3f008cbb28b028b609aa Author: Kuba Piecuch Date: Thu Apr 9 16:57:44 2026 +0000 sched_ext: Documentation: improve accuracy of task lifecycle pseudo-code * Add ops.quiescent() and ops.runnable() to the sched_change path. When a queued task has one of its scheduling properties changed (e.g. nice, affinity), it goes through dequeue() -> quiescent() -> (property change callback, e.g. ops.set_weight()) -> runnable() -> enqueue(). * Change && to || in ops.enqueue() condition. We want to enqueue tasks that have a non-zero slice and are not in any DSQ. * Call ops.dispatch() and ops.dequeue() only for tasks that have had ops.enqueue() called. This is to account for tasks direct-dispatched from ops.select_cpu(). * Add a note explaining that the pseudo-code provides a simplified view of the task lifecycle and list some examples of cases that the pseudo-code does not account for. Fixes: a4f61f0a1afd ("sched_ext: Documentation: Add ops.dequeue() to task lifecycle") Signed-off-by: Kuba Piecuch Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 3348e1e83a0f8a5ca1095843bc3316aaef7aae34 Author: cuitao Date: Thu Apr 9 13:21:35 2026 +0800 cgroup/rdma: fix swapped arguments in pr_warn() format string The format string says "device %p ... rdma cgroup %p" but the arguments were passed as (cg, device), printing them in the wrong order. Signed-off-by: cuitao Signed-off-by: Tejun Heo commit 52957cdad30f8011da1f4ef1338ba0339ca4c158 Author: Neeraj Soni Date: Fri Apr 10 12:28:33 2026 +0530 mmc: sdhci-msm: Fix the wrapped key handling Inline Crypto Engine (ICE) supports wrapped key generation. While registering crypto profile the supported key types are queried from ICE driver. So the explicit check for RAW key is not needed. Fixes: fd78e2b582a0 ("mmc: sdhci-msm: Add support for wrapped keys") Signed-off-by: Neeraj Soni Signed-off-by: Ulf Hansson commit 6522fe5c1b007c376fc5f2de1016c99a18b0af8e Author: Kees Cook Date: Wed Apr 8 22:20:42 2026 -0700 um: Disable GCOV_PROFILE_ALL on 32-bit UML with Clang 20/21 Clang 20 and 21 miscompute __builtin_object_size() when -fprofile-arcs is active on 32-bit UML targets, which passes incorrect object size calculations for local variables through always_inline copy_to_user() and check_copy_size(), causing spurious compile-time errors: include/linux/ucopysize.h:52:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small The regression was introduced in LLVM commit 02b8ee281947 ("[llvm] Improve llvm.objectsize computation by computing GEP, alloca and malloc parameters bound"), which shipped in Clang 20. It was fixed in LLVM by commit 45b697e610fd ("[MemoryBuiltins] Consider index type size when aggregating gep offsets"), which was backported to the LLVM 22.x release branch. The bug requires 32-bit UML + GCOV_PROFILE_ALL (which uses -fprofile-arcs), though the exact trigger depends on optimizer decisions influenced by other enabled configs. Prevent the bad combination by disabling UML's ARCH_HAS_GCOV_PROFILE_ALL on 32-bit when using Clang 20.x or 21.x. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604030531.O6FveVgn-lkp@intel.com/ Suggested-by: Nathan Chancellor Assisted-by: Claude:claude-opus-4-6[1m] Signed-off-by: Kees Cook Link: https://patch.msgid.link/20260409052038.make.995-kees@kernel.org Signed-off-by: Johannes Berg commit 42f9b4c6ef19e71d2c7d9bfd3c5037d4fe434ad7 Author: Hangbin Liu Date: Wed Apr 8 15:19:05 2026 +0800 tools: ynl: tests: fix leading space on Makefile target The ../generated/protos.a rule had a spurious leading space before the target name. In make, target rules must start at column 0; only recipe lines are indented with a tab. The extra space caused make to misparse the rule. Remove the leading space to match the style of the adjacent ../lib/ynl.a rule. Fixes: e0aa0c61758f ("tools: ynl: move samples to tests") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20260408-ynl_makefile-v1-1-f9624acc2ad9@gmail.com Signed-off-by: Jakub Kicinski commit 3d2c3d2eea9acdbee5b5742d15d021069b49d3f9 Author: Jakub Kicinski Date: Wed Apr 8 15:19:52 2026 -0700 selftests: net: py: explicitly forbid multiple ksft_run() calls People (do people still write code or is it all AI?) seem to not get that ksft_run() can only be called once. If we call it multiple times KTAP parsers will likely cut off after the first batch has finished. Link: https://patch.msgid.link/20260408221952.819822-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3c6132ccc58e8adf044166728e783f55dc323ef9 Author: Yue Haibing Date: Wed Apr 8 11:20:51 2026 +0800 ipv6: sit: remove redundant ret = 0 assignment The variable ret is assigned a value at all places where it is used; There is no need to assign a value when it is initially defined. Signed-off-by: Yue Haibing Link: https://patch.msgid.link/20260408032051.3096449-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 12ff2a4aee6c86746623d5aed24389dbf6dffded Author: Mohsin Bashir Date: Tue Apr 7 17:24:15 2026 -0700 eth: fbnic: Use wake instead of start fbnic_up() calls netif_tx_start_all_queues(), which only clears __QUEUE_STATE_DRV_XOFF. If qdisc backlog has accumulated on any TX queue before the reconfiguration (e.g. ring resize via ethtool -G), start does not call __netif_schedule() to kick the qdisc, so the pending backlog is never drained and the queue stalls. Switch to netif_tx_wake_all_queues(), which clears DRV_XOFF and also calls __netif_schedule() on every queue, ensuring any backlog that built up before the down/up cycle is promptly dequeued. Fixes: bc6107771bb4 ("eth: fbnic: Allocate a netdevice and napi vectors with queues") Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260408002415.2963915-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 4ae0604a0673e11e2075b178387151fcad5111b5 Author: Lorenzo Bianconi Date: Tue Apr 7 08:48:04 2026 +0200 net: airoha: Add dma_rmb() and READ_ONCE() in airoha_qdma_rx_process() Add missing dma_rmb() in airoha_qdma_rx_process routine to make sure the DMA read operations are completed when the NIC reports the processing on the current descriptor is done. Moreover, add missing READ_ONCE() in airoha_qdma_rx_process() for DMA descriptor control fields in order to avoid any compiler reordering. Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260407-airoha_qdma_rx_process-fix-reordering-v3-1-91c36e9da31f@kernel.org Signed-off-by: Jakub Kicinski commit e159f05e12cc1111a3103b99375ddf0dfd0e7d63 Author: Jiawen Wu Date: Tue Apr 7 17:40:41 2026 +0800 net: txgbe: fix RTNL assertion warning when remove module For the copper NIC with external PHY, the driver called phylink_connect_phy() during probe and phylink_disconnect_phy() during remove. It caused an RTNL assertion warning in phylink_disconnect_phy() upon module remove. To fix this, add rtnl_lock() and rtnl_unlock() around the phylink_disconnect_phy() in remove function. ------------[ cut here ]------------ RTNL: assertion failed at drivers/net/phy/phylink.c (2351) WARNING: drivers/net/phy/phylink.c:2351 at phylink_disconnect_phy+0xd8/0xf0 [phylink], CPU#0: rmmod/4464 Modules linked in: ... CPU: 0 UID: 0 PID: 4464 Comm: rmmod Kdump: loaded Not tainted 7.0.0-rc4+ Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 RIP: 0010:phylink_disconnect_phy+0xe4/0xf0 [phylink] Code: 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 f6 31 ff e9 3a 38 8f e7 48 8d 3d 48 87 e2 ff ba 2f 09 00 00 48 c7 c6 c1 22 24 c0 <67> 48 0f b9 3a e9 34 ff ff ff 66 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffce7288363ac0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff89654b2a1a00 RCX: 0000000000000000 RDX: 000000000000092f RSI: ffffffffc02422c1 RDI: ffffffffc0239020 RBP: ffffce7288363ae8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8964c4022000 R13: ffff89654fce3028 R14: ffff89654ebb4000 R15: ffffffffc0226348 FS: 0000795e80d93780(0000) GS:ffff896c52857000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005b528b592000 CR3: 0000000170d0f000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: txgbe_remove_phy+0xbb/0xd0 [txgbe] txgbe_remove+0x4c/0xb0 [txgbe] pci_device_remove+0x41/0xb0 device_remove+0x43/0x80 device_release_driver_internal+0x206/0x270 driver_detach+0x4a/0xa0 bus_remove_driver+0x83/0x120 driver_unregister+0x2f/0x60 pci_unregister_driver+0x40/0x90 txgbe_driver_exit+0x10/0x850 [txgbe] __do_sys_delete_module.isra.0+0x1c3/0x2f0 __x64_sys_delete_module+0x12/0x20 x64_sys_call+0x20c3/0x2390 do_syscall_64+0x11c/0x1500 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_syscall_64+0x15a/0x1500 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_fault+0x312/0x580 ? srso_alias_return_thunk+0x5/0xfbef5 ? __handle_mm_fault+0x9d5/0x1040 ? srso_alias_return_thunk+0x5/0xfbef5 ? count_memcg_events+0x101/0x1d0 ? srso_alias_return_thunk+0x5/0xfbef5 ? handle_mm_fault+0x1e8/0x2f0 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_user_addr_fault+0x2f8/0x820 ? srso_alias_return_thunk+0x5/0xfbef5 ? irqentry_exit+0xb2/0x600 ? srso_alias_return_thunk+0x5/0xfbef5 ? exc_page_fault+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 02b2a6f91b90 ("net: txgbe: support copper NIC with external PHY") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/8B47A5872884147D+20260407094041.4646-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 8832e5791d73c8db5d962091b3ac6d7530cde65a Merge: b02e3c4c80c916 5393b2b5bee2ac Author: Jakub Kicinski Date: Thu Apr 9 20:19:47 2026 -0700 Merge branch 'net-bcmgenet-fix-queue-lock-up' Justin Chen says: ==================== net: bcmgenet: fix queue lock up We have been seeing reports of logs like this. [ 41.761198] bcmgenet 1001300000.ethernet eth0: NETDEV WATCHDOG: CPU: 0: transmit queue 2 timed out 10039 ms [ 43.745198] bcmgenet 1001300000.ethernet eth0: NETDEV WATCHDOG: CPU: 0: transmit queue 2 timed out 12023 ms [ 45.729198] bcmgenet 1001300000.ethernet eth0: NETDEV WATCHDOG: CPU: 0: transmit queue 2 timed out 14007 ms We have two issues. The persistent queue timeouts and the eventual lock up of the entire transmit. We address the lock up issue first. The queue timeouts are due to a fundamental design issue not a bug perse. Timeouts still persist, but we should no longer lock up. ==================== Link: https://patch.msgid.link/20260406175756.134567-1-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 5393b2b5bee2ac51a0043dc7f4ac3475f053d08d Author: Justin Chen Date: Mon Apr 6 10:57:56 2026 -0700 net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue. Fixes: 13ea657806cf ("net: bcmgenet: improve TX timeout") Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Reviewed-by: Nicolai Buchwitz Tested-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260406175756.134567-4-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 3f3168300efb839028328d720ab3962f91d6a0d0 Author: Justin Chen Date: Mon Apr 6 10:57:55 2026 -0700 net: bcmgenet: fix leaking free_bds While reclaiming the tx queue we fast forward the write pointer to drop any data in flight. These dropped frames are not added back to the pool of free bds. We also need to tell the netdev that we are dropping said data. Fixes: f1bacae8b655 ("net: bcmgenet: support reclaiming unsent Tx packets") Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Reviewed-by: Nicolai Buchwitz Tested-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260406175756.134567-3-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 57f3f53d2c9c5a9e133596e2f7bc1c50688a6d38 Author: Justin Chen Date: Mon Apr 6 10:57:54 2026 -0700 net: bcmgenet: fix off-by-one in bcmgenet_put_txcb The write_ptr points to the next open tx_cb. We want to return the tx_cb that gets rewinded, so we must rewind the pointer first then return the tx_cb that it points to. That way the txcb can be correctly cleaned up. Fixes: 876dbadd53a7 ("net: bcmgenet: Fix unmapping of fragments in bcmgenet_xmit()") Signed-off-by: Justin Chen Reviewed-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260406175756.134567-2-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit a17d3c3d0cb2827eaa87c43e748095e21f8cc1ab Author: Kevin Hao Date: Tue Apr 7 08:45:39 2026 +0800 net: macb: Use napi_schedule_irqoff() in IRQ handler For non-PREEMPT_RT kernels, the IRQ handler runs with interrupts disabled, allowing the use of napi_schedule_irqoff() to save a pair of local_irq_{save,restore} operations. For PREEMPT_RT kernels, napi_schedule_irqoff() behaves identically to napi_schedule(). Signed-off-by: Kevin Hao Link: https://patch.msgid.link/20260407-macb-napi-irqoff-v1-1-61bec60047d7@gmail.com Signed-off-by: Jakub Kicinski commit 5ecbebc9483c61280153ebdceda5f4db7ae63d18 Author: Qingfang Deng Date: Tue Apr 7 17:40:56 2026 +0800 ppp: consolidate refcount decrements ppp_destroy_{channel,interface} are always called after refcount_dec_and_test(). To reduce boilerplate code, consolidate the decrements by moving them into the two functions. To reflect this change in semantics, rename the functions to ppp_release_*. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260407094058.257246-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski commit 84c5a3f00084ffd741a4c3261a58dd10cd5aceaf Author: Marek Vasut Date: Mon Apr 6 01:29:58 2026 +0200 net: phy: realtek: Add property to enable SSC Add support for spread spectrum clocking (SSC) on RTL8211F(D)(I)-CG, RTL8211FS(I)(-VS)-CG, RTL8211FG(I)(-VS)-CG PHYs. The implementation follows EMI improvement application note Rev. 1.2 for these PHYs. The current implementation enables SSC for both RXC and SYSCLK clock signals. Introduce DT properties 'realtek,clkout-ssc-enable', 'realtek,rxc-ssc-enable' and 'realtek,sysclk-ssc-enable' which control CLKOUT, RXC and SYSCLK SSC spread spectrum clocking enablement on these signals. Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260405233008.148974-3-marek.vasut@mailbox.org Signed-off-by: Jakub Kicinski commit bfb859a5cb4941db06b37fd8bbd8e6d8a0dd5dcf Author: Marek Vasut Date: Mon Apr 6 01:29:57 2026 +0200 dt-bindings: net: realtek,rtl82xx: Document realtek,*-ssc-enable property Document support for spread spectrum clocking (SSC) on RTL8211F(D)(I)-CG, RTL8211FS(I)(-VS)-CG, RTL8211FG(I)(-VS)-CG PHYs. Introduce DT properties 'realtek,clkout-ssc-enable', 'realtek,rxc-ssc-enable' and 'realtek,sysclk-ssc-enable' which control CLKOUT, RXC and SYSCLK SSC spread spectrum clocking enablement on these signals. These clock are not exposed via the clock API, therefore assigned-clock-sscs property does not apply. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260405233008.148974-2-marek.vasut@mailbox.org Signed-off-by: Jakub Kicinski commit 4de7a8acd18e2b71591e286678a8ed711e258090 Author: Marek Vasut Date: Mon Apr 6 01:29:56 2026 +0200 dt-bindings: net: realtek,rtl82xx: Keep property list sorted Sort the documented properties alphabetically, no functional change. Acked-by: Rob Herring (Arm) Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260405233008.148974-1-marek.vasut@mailbox.org Signed-off-by: Jakub Kicinski commit b02e3c4c80c91693b05c82751149d05d921bccb9 Merge: eb216e422044f5 a363b1c8be879c Author: Jakub Kicinski Date: Thu Apr 9 19:38:44 2026 -0700 Merge branch 'macsec-add-support-for-vlan-filtering-in-offload-mode' Cosmin Ratiu says: ==================== macsec: Add support for VLAN filtering in offload mode This short series adds support for VLANs in MACsec devices when offload mode is enabled. This allows VLAN netdevs on top of MACsec netdevs to function, which accidentally used to be the case in the past, but was broken. This series adds back proper support. As part of this, the existing nsim-only MACsec offload tests were translated to Python so they can run against real HW and new traffic-based tests were added for VLAN filter propagation, since there's currently no uAPI to check VLAN filters. ==================== Link: https://patch.msgid.link/20260408115240.1636047-1-cratiu@nvidia.com Signed-off-by: Jakub Kicinski commit a363b1c8be879c79a688eaf93ba01b63f8b0e63c Author: Cosmin Ratiu Date: Wed Apr 8 14:52:40 2026 +0300 macsec: Support VLAN-filtering lower devices VLAN-filtering is done through two netdev features (NETIF_F_HW_VLAN_CTAG_FILTER and NETIF_F_HW_VLAN_STAG_FILTER) and two netdev ops (ndo_vlan_rx_add_vid and ndo_vlan_rx_kill_vid). Implement these and advertise the features if the lower device supports them. This allows proper VLAN filtering to work on top of MACsec devices, when the lower device is capable of VLAN filtering. As a concrete example, having this chain of interfaces now works: vlan_filtering_capable_dev(1) -> macsec_dev(2) -> macsec_vlan_dev(3) Before the mentioned commit this used to accidentally work because the MACsec device (and thus the lower device) was put in promiscuous mode and the VLAN filter was not used. But after commit [1] correctly made the macsec driver expose the IFF_UNICAST_FLT flag, promiscuous mode was no longer used and VLAN filters on dev 1 kicked in. Without support in dev 2 for propagating VLAN filters down, the register_vlan_dev -> vlan_vid_add -> __vlan_vid_add -> vlan_add_rx_filter_info call from dev 3 is silently eaten (because vlan_hw_filter_capable returns false and vlan_add_rx_filter_info silently succeeds). For MACsec, VLAN filters are only relevant for offload, otherwise the VLANs are encrypted and the lower devices don't care about them. So VLAN filters are only passed on to lower devices in offload mode. Flipping between offload modes now needs to offload/unoffload the filters with vlan_{get,drop}_rx_*_filter_info(). To avoid the back-and-forth filter updating during rollback, the setting of macsec->offload is moved after the add/del secy ops. This is safe since none of the code called from those requires macsec->offload. In case adding the filters fails, the added ones are rolled back and an error is returned to the operation toggling the offload state. Fixes: 0349659fd72f ("macsec: set IFF_UNICAST_FLT priv flag") Signed-off-by: Cosmin Ratiu Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260408115240.1636047-5-cratiu@nvidia.com Signed-off-by: Jakub Kicinski commit 26555673bc7888b80d5867618525eb04d4216a24 Author: Cosmin Ratiu Date: Wed Apr 8 14:52:39 2026 +0300 selftests: Add MACsec VLAN propagation traffic test Add VLAN filter propagation tests through offloaded MACsec devices via actual traffic. The tests create MACsec tunnels with matching SAs on both endpoints, stack VLANs on top, and verify connectivity with ping. Covered: - Offloaded MACsec with VLAN (filters propagate to HW) - Software MACsec with VLAN (no HW filter propagation) - Offload on/off toggle and verifying traffic still works On netdevsim this makes use of the VLAN filter debugfs file to actually validate that filters are applied/removed correctly. On real hardware the traffic should validate actual VLAN filter propagation. Signed-off-by: Cosmin Ratiu Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260408115240.1636047-4-cratiu@nvidia.com Signed-off-by: Jakub Kicinski commit c89f194b6b8eddc905425a4ad702db803f50af47 Author: Cosmin Ratiu Date: Wed Apr 8 14:52:38 2026 +0300 nsim: Add support for VLAN filters Add support for storing the list of VLANs in nsim devices, together with ops for adding/removing them and a debug file to show them. This will be used in upcoming tests. Signed-off-by: Cosmin Ratiu Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260408115240.1636047-3-cratiu@nvidia.com Signed-off-by: Jakub Kicinski commit e1ab601bb23006e2710359c0fba27342f8887aec Author: Cosmin Ratiu Date: Wed Apr 8 14:52:37 2026 +0300 selftests: Migrate nsim-only MACsec tests to Python Move MACsec offload API and ethtool feature tests from tools/testing/selftests/drivers/net/netdevsim/macsec-offload.sh to tools/testing/selftests/drivers/net/macsec.py using the NetDrvEnv framework so tests can run against both netdevsim (default) and real hardware (NETIF=ethX). As some real hardware requires MACsec to use encryption, add that to the tests. Netdevsim-specific limit checks (max SecY, max RX SC) were moved into separate test cases to avoid failures on real hardware. Signed-off-by: Cosmin Ratiu Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260408115240.1636047-2-cratiu@nvidia.com Signed-off-by: Jakub Kicinski commit 8e6405f8218b3f412d36b772318e94d589513eba Author: Paolo Abeni Date: Wed Apr 8 16:36:49 2026 +0200 ipv6: move IFA_F_PERMANENT percpu allocation in process scope Observed at boot time: CPU: 43 UID: 0 PID: 3595 Comm: (t-daemon) Not tainted 6.12.0 #1 Call Trace: dump_stack_lvl+0x4e/0x70 pcpu_alloc_noprof.cold+0x1f/0x4b fib_nh_common_init+0x4c/0x110 fib6_nh_init+0x387/0x740 ip6_route_info_create+0x46d/0x640 addrconf_f6i_alloc+0x13b/0x180 addrconf_permanent_addr+0xd0/0x220 addrconf_notify+0x93/0x540 notifier_call_chain+0x5a/0xd0 __dev_notify_flags+0x5c/0xf0 dev_change_flags+0x54/0x70 do_setlink+0x36c/0xce0 rtnl_setlink+0x11f/0x1d0 rtnetlink_rcv_msg+0x142/0x3f0 netlink_rcv_skb+0x50/0x100 netlink_unicast+0x242/0x390 netlink_sendmsg+0x21b/0x470 __sys_sendto+0x1dc/0x1f0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x7d/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f5c3852f127 Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d 85 ef 0c 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 71 c3 55 48 83 ec 30 44 89 4c 24 2c 4c 89 44 RSP: 002b:00007ffe86caf4c8 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000556c5cd93210 RCX: 00007f5c3852f127 RDX: 0000000000000020 RSI: 0000556c5cd938b0 RDI: 0000000000000003 RBP: 00007ffe86caf5a0 R08: 00007ffe86caf4e0 R09: 0000000000000080 R10: 0000000000000000 R11: 0000000000000202 R12: 0000556c5cd932d0 R13: 00000000021d05d1 R14: 00000000021d05d1 R15: 0000000000000001 IFA_F_PERMANENT addresses require the allocation of a bunch of percpu pointers, currently in atomic scope. Similar to commit 51454ea42c1a ("ipv6: fix locking issues with loops over idev->addr_list"), move fixup_permanent_addr() outside the &idev->lock scope, and do the allocations with GFP_KERNEL. With such change fixup_permanent_addr() is invoked with the BH enabled, and the ifp lock acquired there needs the BH variant. Note that we don't need to acquire a reference to the permanent addresses before releasing the mentioned write lock, because addrconf_permanent_addr() runs under RTNL and ifa removal always happens under RTNL, too. Also the PERMANENT flag is constant in the relevant scope, as it can be cleared only by inet6_addr_modify() under the RTNL lock. Reviewed-by: David Ahern Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/46a7a030727e236af2dc7752994cd4f04f4a91d2.1775658924.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 9addea5d44b69d377ba97a36f7a19e1097969e18 Author: David Carlier Date: Tue Apr 7 16:07:58 2026 +0100 net: use get_random_u{16,32,64}() where appropriate Use the typed random integer helpers instead of get_random_bytes() when filling a single integer variable. The helpers return the value directly, require no pointer or size argument, and better express intent. Skipped sites writing into __be16 (netdevsim) and __le64 (ceph) fields where a direct assignment would trigger sparse endianness warnings. Signed-off-by: David Carlier Reviewed-by: Matthieu Baerts (NGI0) Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260407150758.5889-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski commit 981fcc5674e67158d24d23e841523eccba19d0e7 Author: Zhang Yi Date: Thu Apr 9 19:42:03 2026 +0800 jbd2: fix deadlock in jbd2_journal_cancel_revoke() Commit f76d4c28a46a ("fs/jbd2: use sleeping version of __find_get_block()") changed jbd2_journal_cancel_revoke() to use __find_get_block_nonatomic() which holds the folio lock instead of i_private_lock. This breaks the lock ordering (folio -> buffer) and causes an ABBA deadlock when the filesystem blocksize < pagesize: T1 T2 ext4_mkdir() ext4_init_new_dir() ext4_append() ext4_getblk() lock_buffer() <- A sync_blockdev() blkdev_writepages() writeback_iter() writeback_get_folio() folio_lock() <- B ext4_journal_get_create_access() jbd2_journal_cancel_revoke() __find_get_block_nonatomic() folio_lock() <- B block_write_full_folio() lock_buffer() <- A This can occasionally cause generic/013 to hang. Fix by only calling __find_get_block_nonatomic() when the passed buffer_head doesn't belong to the bdev, which is the only case that we need to look up its bdev alias. Otherwise, the lookup is redundant since the found buffer_head is equal to the one we passed in. Fixes: f76d4c28a46a ("fs/jbd2: use sleeping version of __find_get_block()") Signed-off-by: Zhang Yi Link: https://patch.msgid.link/20260409114204.917154-1-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 77d059519382bd66283e6a4e83ee186e87e7708f Author: Sohei Koyama Date: Mon Apr 6 16:48:30 2026 +0900 ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() The commit c8e008b60492 ("ext4: ignore xattrs past end") introduced a refcount leak in when block_csum is false. ext4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to get iloc.bh, but never releases it with brelse(). Fixes: c8e008b60492 ("ext4: ignore xattrs past end") Signed-off-by: Sohei Koyama Reviewed-by: Andreas Dilger Reviewed-by: Ritesh Harjani (IBM) Cc: stable@vger.kernel.org Reviewed-by: Zhang Yi Reviewed-by: Baokun Li Link: https://patch.msgid.link/20260406074830.8480-1-skoyama@ddn.com Signed-off-by: Theodore Ts'o commit 22f53f08d9eb837ce69b1a07641d414aac8d045f Author: Ye Bin Date: Mon Mar 30 21:30:35 2026 +0800 ext4: fix possible null-ptr-deref in mbt_kunit_exit() There's issue as follows: # test_new_blocks_simple: failed to initialize: -12 KASAN: null-ptr-deref in range [0x0000000000000638-0x000000000000063f] Tainted: [E]=UNSIGNED_MODULE, [N]=TEST RIP: 0010:mbt_kunit_exit+0x5e/0x3e0 [ext4_test] Call Trace: kunit_try_run_case_cleanup+0xbc/0x100 [kunit] kunit_generic_run_threadfn_adapter+0x89/0x100 [kunit] kthread+0x408/0x540 ret_from_fork+0xa76/0xdf0 ret_from_fork_asm+0x1a/0x30 If mbt_kunit_init() init testcase failed will lead to null-ptr-deref. So add test if 'sb' is inited success in mbt_kunit_exit(). Fixes: 7c9fa399a369 ("ext4: add first unit test for ext4_mb_new_blocks_simple in mballoc") Signed-off-by: Ye Bin Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/20260330133035.287842-6-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit ca78c31af467ffe94b15f6a2e4e1cc1c164db19b Author: Ye Bin Date: Mon Mar 30 21:30:34 2026 +0800 ext4: fix possible null-ptr-deref in extents_kunit_exit() There's issue as follows: KASAN: null-ptr-deref in range [0x00000000000002c0-0x00000000000002c7] Tainted: [E]=UNSIGNED_MODULE, [N]=TEST RIP: 0010:extents_kunit_exit+0x2e/0xc0 [ext4_test] Call Trace: kunit_try_run_case_cleanup+0xbc/0x100 [kunit] kunit_generic_run_threadfn_adapter+0x89/0x100 [kunit] kthread+0x408/0x540 ret_from_fork+0xa76/0xdf0 ret_from_fork_asm+0x1a/0x30 Above issue happens as extents_kunit_init() init testcase failed. So test if testcase is inited success. Fixes: cb1e0c1d1fad ("ext4: kunit tests for extent splitting and conversion") Signed-off-by: Ye Bin Reviewed-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Link: https://patch.msgid.link/20260330133035.287842-5-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit 17f73c95d47325000ee68492be3ad76ae09f6f19 Author: Ye Bin Date: Mon Mar 30 21:30:33 2026 +0800 ext4: fix the error handling process in extents_kunit_init). The error processing in extents_kunit_init() is improper, causing resource leakage. Reconstruct the error handling process to prevent potential resource leaks Fixes: cb1e0c1d1fad ("ext4: kunit tests for extent splitting and conversion") Signed-off-by: Ye Bin Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/20260330133035.287842-4-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit f9c1f7647ac8fb70bebb1615ac112d1568abe339 Author: Ye Bin Date: Mon Mar 30 21:30:32 2026 +0800 ext4: call deactivate_super() in extents_kunit_exit() Call deactivate_super() is called in extents_kunit_exit() to cleanup the file system resource. Fixes: cb1e0c1d1fad ("ext4: kunit tests for extent splitting and conversion") Signed-off-by: Ye Bin Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/20260330133035.287842-3-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit 5941a072d48841255005e3a5b5a620692d81d1a7 Author: Ye Bin Date: Mon Mar 30 21:30:31 2026 +0800 ext4: fix miss unlock 'sb->s_umount' in extents_kunit_init() There's warning as follows when do ext4 kunit test: WARNING: kunit_try_catch/15923 still has locks held! 7.0.0-rc3-next-20260309-00028-g73f965a1bbb1-dirty #281 Tainted: G E N 1 lock held by kunit_try_catch/15923: #0: ffff888139f860e0 (&type->s_umount_key#70/1){+.+.}-{4:4}, at: alloc_super.constprop.0+0x172/0xa90 Call Trace: dump_stack_lvl+0x180/0x1b0 debug_check_no_locks_held+0xc8/0xd0 do_exit+0x1502/0x2b20 kthread+0x3a9/0x540 ret_from_fork+0xa76/0xdf0 ret_from_fork_asm+0x1a/0x30 As sget() will return 'sb' which holds 's->s_umount' lock. However, "extents-test" miss unlock this lock. So unlock 's->s_umount' in the end of extents_kunit_init(). Fixes: cb1e0c1d1fad ("ext4: kunit tests for extent splitting and conversion") Signed-off-by: Ye Bin Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/20260330133035.287842-2-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit eceafc31ea7b42c984ece10d79d505c0bb6615d5 Author: Deepanshu Kartikey Date: Sat Mar 28 20:30:38 2026 +0530 ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access The bounds check for the next xattr entry in check_xattrs() uses (void *)next >= end, which allows next to point within sizeof(u32) bytes of end. On the next loop iteration, IS_LAST_ENTRY() reads 4 bytes via *(__u32 *)(entry), which can overrun the valid xattr region. For example, if next lands at end - 1, the check passes since next < end, but IS_LAST_ENTRY() reads 4 bytes starting at end - 1, accessing 3 bytes beyond the valid region. Fix this by changing the check to (void *)next + sizeof(u32) > end, ensuring there is always enough space for the IS_LAST_ENTRY() read on the subsequent iteration. Fixes: 3478c83cf26b ("ext4: improve xattr consistency checking and error reporting") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20260224231429.31361-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260328150038.349497-1-kartikey406@gmail.com Signed-off-by: Theodore Ts'o commit 3f60efd65412dfe4ff33b376a983220ef74056b1 Author: Zhang Yi Date: Fri Mar 27 18:29:39 2026 +0800 ext4: zero post-EOF partial block before appending write In cases of appending write beyond EOF, ext4_zero_partial_blocks() is called within ext4_*_write_end() to zero out the partial block beyond EOF. This prevents exposing stale data that might be written through mmap. However, supporting only the regular buffered write path is insufficient. It is also necessary to support the DAX path as well as the upcoming iomap buffered write path. Therefore, move this operation to ext4_write_checks(). In addition, this may introduce a race window in which a post-EOF buffered write can race with an mmap write after the old EOF block has been zeroed. As a result, the data in this block written by the buffer-write and the data written by the mmap-write may be mixed. However, this is safe because users should not rely on the result of the race condition. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-14-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 1ad0f42823291bcac371dafd37533f5e8d92acc3 Author: Zhang Yi Date: Fri Mar 27 18:29:38 2026 +0800 ext4: move pagecache_isize_extended() out of active handle In ext4_alloc_file_blocks(), pagecache_isize_extended() is called under an active handle and may also hold folio lock if the block size is smaller than the folio size. This also breaks the "folio lock -> transaction start" lock ordering for the upcoming iomap buffered I/O path. Therefore, move pagecache_isize_extended() outside of an active handle. Additionally, it is unnecessary to update the file length during each iteration of the allocation loop. Instead, update the file length only to the position where the allocation is successful. Postpone updating the inode size until after the allocation loop completes or is interrupted due to an error. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-13-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 116c0bdac2ec059d91045ba3f57cc90cb1e3b71d Author: Zhang Yi Date: Fri Mar 27 18:29:37 2026 +0800 ext4: remove ctime/mtime update from ext4_alloc_file_blocks() The ctime and mtime update is already handled by file_modified() in ext4_fallocate(), the caller of ext4_alloc_file_blocks(). So remove the redundant calls to inode_set_ctime_current() and inode_set_mtime_to_ts() in ext4_alloc_file_blocks(). Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-12-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit c3688d212fc6306bbb7136fbc1d0be0f175a5270 Author: Zhang Yi Date: Fri Mar 27 18:29:36 2026 +0800 ext4: unify SYNC mode checks in fallocate paths In the ext4 fallocate call chain, SYNC mode handling is inconsistent: some places check the inode state, while others check the open file descriptor state. Unify these checks by evaluating both conditions to ensure consistent behavior across all fallocate operations. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-11-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 7d81ec0246ff74b10d92a4617fea84eaf06162c0 Author: Zhang Yi Date: Fri Mar 27 18:29:35 2026 +0800 ext4: ensure zeroed partial blocks are persisted in SYNC mode In ext4_zero_range() and ext4_punch_hole(), when operating in SYNC mode and zeroing a partial block, only data=journal modes guarantee that the zeroed data is synchronously persisted after the operation completes. For data=ordered/writeback mode and non-journal modes, this guarantee is missing. Introduce a partial_zero parameter to explicitly trigger writeback for all scenarios where a partial block is zeroed, ensuring the zeroed data is durably persisted. Signed-off-by: Zhang Yi Link: https://patch.msgid.link/20260327102939.1095257-10-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit c4602a1d09ec7c6dd6f53e5faf3f04e9c02d71eb Author: Zhang Yi Date: Fri Mar 27 18:29:34 2026 +0800 ext4: move zero partial block range functions out of active handle Move ext4_block_zero_eof() and ext4_zero_partial_blocks() calls out of the active handle context, making them independent operations, and also add return value checks. This is safe because it still ensures data is updated before metadata for data=ordered mode and data=journal mode because we still zero data and ordering data before modifying the metadata. This change is required for iomap infrastructure conversion because the iomap buffered I/O path does not use the same journal infrastructure for partial block zeroing. The lock ordering of folio lock and starting transactions is "folio lock -> transaction start", which is opposite of the current path. Therefore, zeroing partial blocks cannot be performed under the active handle. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-9-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit ad1876bc4c4cae59f747b4225007cdc31f834597 Author: Zhang Yi Date: Fri Mar 27 18:29:33 2026 +0800 ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() Change ext4_alloc_file_blocks() to accept offset and len in byte granularity instead of block granularity. This allows callers to pass byte offsets and lengths directly, and this prepares for moving the ext4_zero_partial_blocks() call from the while(len) loop for unaligned append writes, where it only needs to be invoked once before doing block allocation. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-8-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit d3609a71b777d073ea6ead2e6eed93e97841fa21 Author: Zhang Yi Date: Fri Mar 27 18:29:32 2026 +0800 ext4: remove handle parameters from zero partial block functions Only journal data mode requires an active journal handle when zeroing partial blocks. Stop passing handle_t *handle to ext4_zero_partial_blocks() and related functions, and make ext4_block_journalled_zero_range() start a handle independently. This change has no practical impact now because all callers invoke these functions within the context of an active handle. It prepares for moving ext4_block_zero_eof() out of an active handle in the next patch, which is a prerequisite for converting block zero range operations to iomap infrastructure. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-7-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 69e2d5c1f544982389327ff90b491a0f7d1afe48 Author: Zhang Yi Date: Fri Mar 27 18:29:31 2026 +0800 ext4: move ordered data handling out of ext4_block_do_zero_range() Remove the handle parameter from ext4_block_do_zero_range() and move the ordered data handling to ext4_block_zero_eof(). This is necessary for truncate up and append writes across a range extending beyond EOF. The ordered data must be committed before updating i_disksize to prevent exposing stale on-disk data from concurrent post-EOF mmap writes during previous folio writeback or in case of system crash during append writes. This is unnecessary for partial block hole punching because the entire punch operation does not provide atomicity guarantees and can already expose intermediate results in case of crash. Hole punching can only ever expose data that was there before the punch but missed zeroing during append / truncate could expose data that was not visible in the file before the operation. Since ordered data handling is no longer performed inside ext4_zero_partial_blocks(), ext4_punch_hole() no longer needs to attach jinode. This is prepared for the conversion to the iomap infrastructure, which does not use ordered data mode while zeroing post-EOF partial blocks. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-6-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit ad11526d1504641b632918e202e23c9c80923fff Author: Zhang Yi Date: Fri Mar 27 18:29:30 2026 +0800 ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() Rename ext4_block_zero_page_range() to ext4_block_zero_range() since the "page" naming is no longer appropriate for current context. Also change its signature to take an inode pointer instead of an address_space. This aligns with the caller ext4_block_zero_eof() and ext4_zero_partial_blocks(). Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-5-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 3b312a6f510ca217607ffacf5cbca2f08c402ec0 Author: Zhang Yi Date: Fri Mar 27 18:29:29 2026 +0800 ext4: factor out journalled block zeroing range Refactor __ext4_block_zero_page_range() by separating the block zeroing operations for ordered data mode and journal data mode into two distinct functions: - ext4_block_do_zero_range(): handles non-journal data mode with ordered data support - ext4_block_journalled_zero_range(): handles journal data mode Also extract a common helper, ext4_load_tail_bh(), to handle buffer head and folio retrieval, along with the associated error handling. This prepares for converting the partial block zero range to the iomap infrastructure. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-4-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit bd099a0565fce5c771e1d0bfcefec26fb5b1c1b7 Author: Zhang Yi Date: Fri Mar 27 18:29:28 2026 +0800 ext4: rename and extend ext4_block_truncate_page() Rename ext4_block_truncate_page() to ext4_block_zero_eof() and extend its signature to accept an explicit 'end' offset instead of calculating the block boundary. This helper function now can replace all cases requiring zeroing of the partial EOF block, including the append buffered write paths in ext4_*_write_end(). Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-3-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 5447c8b9de7581ca7254d712652678cc460a18c2 Author: Zhang Yi Date: Fri Mar 27 18:29:27 2026 +0800 ext4: add did_zero output parameter to ext4_block_zero_page_range() Add a bool *did_zero output parameter to ext4_block_zero_page_range() and __ext4_block_zero_page_range(). The parameter reports whether a partial block was zeroed out, which is needed for the upcoming iomap buffered I/O conversion. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260327102939.1095257-2-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 6ea3b34d8625ef5544d1c619bd67e2c6080ea4c2 Author: David Laight Date: Thu Mar 26 20:18:04 2026 +0000 ext4: fix diagnostic printf formats The formats for non-terminated names should be "%.*s" not "%*.s". The kernel currently treats "%*.s" as equivalent to "%*s" whereas userspace requires it be equivalent to "%*.0s". Neither is correct here. Signed-off-by: David Laight Link: https://patch.msgid.link/20260326201804.3881-1-david.laight.linux@gmail.com Signed-off-by: Theodore Ts'o commit 52b4fea162dd384792d0dec7f817e4ba5d8d4c9b Author: NeilBrown Date: Fri Mar 20 11:03:18 2026 +1100 ext4: move dcache manipulation out of __ext4_link() __ext4_link() has two callers. - ext4_link() calls it during normal handling of the link() system call or similar - ext4_fc_replay_link_internal() calls it when replaying the journal at mount time. The former needs changes to dcache - instantiating the dentry to the inode on success. The latter doesn't need or want any dcache manipulation. So move the manipulation out of __ext4_link() and do it in ext4_link() only. This requires: - passing the qname from the dentry explicitly to __ext4_link. The parent dir is already passed. The dentry is still passed in the ext4_link() case purely for use by ext4_fc_track_link(). - passing the inode separately to ext4_fc_track_link() as the dentry will not be instantiated yet. - using __ext4_add_entry() in ext4_link, which doesn't need a dentry. - moving ihold(), d_instantiate(), drop_nlink() and iput() calls out of __ext4_link() into ext4_link(). Note that ext4_inc_count() and drop_nlink() remain in __ext4_link() as both callers need them and they are not related to the dentry. This substantially simplifies ext4_fc_replay_link_internal(), and removes a use of d_alloc() which, it is planned, will be removed. Reviewed-by: Jan Kara Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260320000838.3797494-4-neilb@ownmail.net Signed-off-by: Theodore Ts'o commit 0f5f14f334c85efd80503489f8c7cba1dd64bd51 Author: NeilBrown Date: Fri Mar 20 11:03:17 2026 +1100 ext4: add ext4_fc_eligible() Testing EXT4_MF_FC_INELIGIBLE is almost always combined with testing ext4_fc_disabled(). The code can be simplified by combining these two in a new ext4_fc_eligible(). In ext4_fc_track_inode() this moves the ext4_fc_disabled() test after ext4_fc_mark_ineligible(), but as that is a non-op when ext4_fc_disabled() is true, this is no no consequence. Note that it is important to still call ext4_fc_mark_ineligible() in ext4_fc_track_inode() even when ext4_fc_eligible() would return true. ext4_fc_mark_ineligible() does not ONLY set the "INELIGIBLE" flag but also updates ->s_fc_ineligible_tid to make sure that the flag remains set until all ineligible transactions have been committed. Reviewed-by: Andreas Dilger Reviewed-by: Jan Kara Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260320000838.3797494-3-neilb@ownmail.net Signed-off-by: Theodore Ts'o commit 2879374604b72bd43b346777fa05d3ac6dea9c45 Author: NeilBrown Date: Fri Mar 20 11:03:16 2026 +1100 ext4: split __ext4_add_entry() out of ext4_add_entry() __ext4_add_entry() is not given a dentry - just inodes and name. This will help the next patch which simplifies __ex4_link(). Reviewed-by: Andreas Dilger Reviewed-by: Jan Kara Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260320000838.3797494-2-neilb@ownmail.net Signed-off-by: Theodore Ts'o commit 1d749e110277ce4103f27bd60d6181e52c0cc1e3 Author: Philipp Hahn Date: Tue Mar 10 12:48:30 2026 +0100 ext4: prefer IS_ERR_OR_NULL over manual NULL check Prefer using IS_ERR_OR_NULL() over using IS_ERR() and a manual NULL check. Change generated with coccinelle. To: "Theodore Ts'o" To: Andreas Dilger Cc: linux-ext4@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Philipp Hahn Link: https://patch.msgid.link/20260310-b4-is_err_or_null-v1-4-bd63b656022d@avm.de Signed-off-by: Theodore Ts'o commit 581d28606cdd51c5da06330e8fb97476503cd74d Author: Jakub Kicinski Date: Wed Apr 8 15:12:51 2026 -0700 net: remove the netif_get_rx_queue_lease_locked() helpers The netif_get_rx_queue_lease_locked() API hides the locking and the descend onto the leased queue. Making the code harder to follow (at least to me). Remove the API and open code the descend a bit. Most of the code now looks like: if (!leased) return __helper(x); hw_rxq = .. netdev_lock(hw_rxq->dev); ret = __helper(x); netdev_unlock(hw_rxq->dev); return ret; Of course if we have more code paths that need the wrapping we may need to revisit. For now, IMHO, having to know what netif_get_rx_queue_lease_locked() does is not worth the 20LoC it saves. Link: https://patch.msgid.link/20260408151251.72bd2482@kernel.org Signed-off-by: Jakub Kicinski commit 15089225889ba4b29f0263757cd66932fa676cb0 Merge: b6e39e48469e37 65d657d806848a Author: Jakub Kicinski Date: Thu Apr 9 18:24:34 2026 -0700 Merge branch 'netkit-support-for-io_uring-zero-copy-and-af_xdp' Daniel Borkmann says: ==================== netkit: Support for io_uring zero-copy and AF_XDP Containers use virtual netdevs to route traffic from a physical netdev in the host namespace. They do not have access to the physical netdev in the host and thus can't use memory providers or AF_XDP that require reconfiguring/restarting queues in the physical netdev. This patchset adds the concept of queue leasing to virtual netdevs that allow containers to use memory providers and AF_XDP at native speed. Leased queues are bound to a real queue in a physical netdev and act as a proxy. Memory providers and AF_XDP operations take an ifindex and queue id, so containers would pass in an ifindex for a virtual netdev and a queue id of a leased queue, which then gets proxied to the underlying real queue. We have implemented support for this concept in netkit and tested the latter against Nvidia ConnectX-6 (mlx5) as well as Broadcom BCM957504 (bnxt_en) 100G NICs. For more details see the individual patches. ==================== Link: https://patch.msgid.link/20260402231031.447597-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 65d657d806848add1e1f0632562d7f47d5d5c188 Author: David Wei Date: Fri Apr 3 01:10:31 2026 +0200 selftests/net: Add queue leasing tests with netkit Add extensive selftests for netkit queue leasing, using io_uring zero copy test binary inside of a netns with netkit. This checks that memory providers can be bound against virtual queues in a netkit within a netns that are leasing from a physical netdev in the default netns. Also add various test cases around corner cases for the queue creation itself as well as queue info dumping and teardown in case of netkit in device pair and single mode. Signed-off-by: David Wei Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Link: https://patch.msgid.link/20260402231031.447597-15-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit a14fd6474883871f0cb348db7b58688d9953c178 Author: Daniel Borkmann Date: Fri Apr 3 01:10:30 2026 +0200 netkit: Add xsk support for af_xdp applications Enable support for AF_XDP applications to operate on a netkit device. The goal is that AF_XDP applications can natively consume AF_XDP from network namespaces. The use-case from Cilium side is to support Kubernetes KubeVirt VMs through QEMU's AF_XDP backend. KubeVirt is a virtual machine management add-on for Kubernetes which aims to provide a common ground for virtualization. KubeVirt spawns the VMs inside Kubernetes Pods which reside in their own network namespace just like regular Pods. Raw QEMU AF_XDP backend example with eth0 being a physical device with 16 queues where netkit is bound to the last queue (for multi-queue RSS context can be used if supported by the driver): # ethtool -X eth0 start 0 equal 15 # ethtool -X eth0 start 15 equal 1 context new # ethtool --config-ntuple eth0 flow-type ether \ src 00:00:00:00:00:00 \ src-mask ff:ff:ff:ff:ff:ff \ dst $mac dst-mask 00:00:00:00:00:00 \ proto 0 proto-mask 0xffff action 15 [ ... setup BPF/XDP prog on eth0 to steer into shared xsk map ... ] # ip netns add foo # ip link add numrxqueues 2 nk type netkit single # ynl --family netdev --output-json --do queue-create \ --json "{"ifindex": $(ifindex nk), "type": "rx", \ "lease": { "ifindex": $(ifindex eth0), \ "queue": { "type": "rx", "id": 15 } } }" {'id': 1} # ip link set nk netns foo # ip netns exec foo ip link set lo up # ip netns exec foo ip link set nk up # ip netns exec foo qemu-system-x86_64 \ -kernel $kernel \ -drive file=${image_name},index=0,media=disk,format=raw \ -append "root=/dev/sda rw console=ttyS0" \ -cpu host \ -m $memory \ -enable-kvm \ -device virtio-net-pci,netdev=net0,mac=$mac \ -netdev af-xdp,ifname=nk,id=net0,mode=native,queues=1,start-queue=1,inhibit=on,map-path=$dir/xsks_map \ -nographic We have tested the above against a dual-port Nvidia ConnectX-6 (mlx5) 100G NIC with successful network connectivity out of QEMU. An earlier iteration of this work was presented at LSF/MM/BPF [0] and more recently at LPC [1]. For getting to a first starting point to connect all things with KubeVirt, bind mounting the xsk map from Cilium into the VM launcher Pod which acts as a regular Kubernetes Pod while not perfect, is not a big problem given its out of reach from the application sitting inside the VM (and some of the control plane aspects are baked in the launcher Pod already), so the isolation barrier is still the VM. Eventually the goal is to have a XDP/XSK redirect extension where there is no need to have the xsk map, and the BPF program can just derive the target xsk through the queue where traffic was received on. The exposure through netkit is because Cilium should not act as a proxy handing out xsk sockets. Existing applications expect a netdev from kernel side and should not need to rewrite just to implement against a CNI's protocol. Also, all the memory should not be accounted against Cilium but rather the application Pod itself which is consuming AF_XDP. Further, on up/downgrades we expect the data plane to being completely decoupled from the control plane; if Cilium would own the sockets that would be disruptive. Another use-case which opens up and is regularly asked from users would be to have DPDK applications on top of AF_XDP in regular Kubernetes Pods. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Nikolay Aleksandrov Link: https://bpfconf.ebpf.io/bpfconf2025/bpfconf2025_material/lsfmmbpf_2025_netkit_borkmann.pdf [0] Link: https://lpc.events/event/19/contributions/2275/ [1] Link: https://patch.msgid.link/20260402231031.447597-14-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 25444470570b44da61366e307b3e54be653bf595 Author: Daniel Borkmann Date: Fri Apr 3 01:10:29 2026 +0200 netkit: Add netkit notifier to check for unregistering devices Add a netdevice notifier in netkit to watch for NETDEV_UNREGISTER events. If the target device is indeed NETREG_UNREGISTERING and previously leased a queue to a netkit device, then collect the related netkit devices and batch-unregister_netdevice_many() them. If this were not done, then the netkit device would hold a reference on the physical device preventing it from going away. However, in case of both io_uring zero-copy as well as AF_XDP this situation is handled gracefully and the allocated resources are torn down. In the case where mentioned infra is used through netkit, the applications have a reference on netkit, and netkit in turn holds a reference on the physical device. In order to have netkit release the reference on the physical device, we need such watcher to then unregister the netkit ones. This is generally quite similar to the dependency handling in case of tunnels (e.g. vxlan bound to a underlying netdev) where the tunnel device gets removed along with the physical device. # ip a [...] 4: enp10s0f0np0: mtu 1500 qdisc mq state DOWN group default qlen 1000 link/ether e8:eb:d3:a3:43:f6 brd ff:ff:ff:ff:ff:ff inet 10.0.0.2/24 scope global enp10s0f0np0 valid_lft forever preferred_lft forever [...] 8: nk@NONE: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff [...] # rmmod mlx5_ib # rmmod mlx5_core [...] [ 309.261822] mlx5_core 0000:0a:00.0 mlx5_0: Port: 1 Link DOWN [ 344.235236] mlx5_core 0000:0a:00.1: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) [ 344.246948] mlx5_core 0000:0a:00.1: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) [ 344.463754] mlx5_core 0000:0a:00.1: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) [ 344.770155] mlx5_core 0000:0a:00.1: E-Switch: cleanup [...] # ip a [...] [ both enp10s0f0np0 and nk gone ] [...] Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260402231031.447597-13-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit b789acc0695cc273736ada06aac5f3c830af39e1 Author: David Wei Date: Fri Apr 3 01:10:28 2026 +0200 netkit: Implement rtnl_link_ops->alloc and ndo_queue_create Implement rtnl_link_ops->alloc that allows the number of rx queues to be set when netkit is created. By default, netkit has only a single rxq (and single txq). The number of queues is deliberately not allowed to be changed via ethtool -L and is fixed for the lifetime of a netkit instance. For netkit device creation, numrxqueues with larger than one rxq can be specified. These rxqs are leasable to real rxqs in physical netdevs: ip link add type netkit peer numrxqueues 64 # for device pair ip link add numrxqueues 64 type netkit single # for single device The limit of numrxqueues for netkit is currently set to 1024, which allows leasing multiple real rxqs from physical netdevs. The implementation of ndo_queue_create() adds a new rxq during the queue lease operation. We allow to create queues either in single device mode or for the case of dual device mode for the netkit peer device which gets placed into the target network namespace. For dual device mode the lease against the primary device does not make sense for the targeted use cases, and therefore gets rejected. We also need to add a lockdep class for netkit, such that lockdep does not trip over us, similarly done as in commit 0bef512012b1 ("net: add netdev_lockdep_set_classes() to virtual drivers"). This is also the last missing bit to netkit for supporting io_uring with zero-copy mode [0]. Up until this point it was not possible to consume the latter out of containers or Kubernetes Pods where applications are in their own network namespace. io_uring example with eth0 being a physical device with 16 queues where netkit is bound to the last queue, iou-zcrx.c is binary from selftests; ethtool configuration (tcp-data-split, hds_thresh, RSS, flow steering) is done on the physical device by the control plane; here, flow steering to that queue is based on the service VIP:port of the server utilizing io_uring: # ethtool -X eth0 start 0 equal 15 # ethtool -X eth0 start 15 equal 1 context new # ethtool --config-ntuple eth0 flow-type tcp4 dst-ip 1.2.3.4 dst-port 5000 action 15 # ip netns add foo # ip link add type netkit peer numrxqueues 2 # ynl --family netdev --output-json --do queue-create \ --json "{"ifindex": $(ifindex nk0), "type": "rx", \ "lease": { "ifindex": $(ifindex eth0), \ "queue": { "type": "rx", "id": 15 } } }" {'id': 1} # ip link set nk0 netns foo # ip link set nk1 up # ip netns exec foo ip link set lo up # ip netns exec foo ip link set nk0 up # ip netns exec foo ip addr add 1.2.3.4/32 dev nk0 [ ... setup routing etc to get external traffic into the netns ... ] # ip netns exec foo ./iou-zcrx -s -p 5000 -i nk0 -q 1 Remote io_uring client: # ./iou-zcrx -c -h 1.2.3.4 -p 5000 -l 12840 -z 65536 We have tested the above against a Broadcom BCM957504 (bnxt_en) 100G NIC, supporting TCP header/data split. Similarly, this also works for devmem which we tested using ncdevmem: # ip netns exec foo ./ncdevmem -s 1.2.3.4 -l -p 5000 -f nk0 -t 1 -q 1 And on the remote client: # ./ncdevmem -s 1.2.3.4 -p 5000 -f eth0 For Cilium, the plan is to open up support for the various memory providers for regular Kubernetes Pods when Cilium is configured with netkit datapath mode. Signed-off-by: David Wei Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Link: https://kernel-recipes.org/en/2024/schedule/efficient-zero-copy-networking-using-io_uring [0] Link: https://patch.msgid.link/20260402231031.447597-12-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 48103896053828a8b4d25839a39aa8514071914a Author: Daniel Borkmann Date: Fri Apr 3 01:10:27 2026 +0200 netkit: Add single device mode for netkit Add a single device mode for netkit instead of netkit pairs. The primary target for the paired devices is to connect network namespaces, of course, and support has been implemented in projects like Cilium [0]. For the rxq leasing the plan is to support two main scenarios related to single device mode: * For the use-case of io_uring zero-copy, the control plane can either set up a netkit pair where the peer device can perform rxq leasing which is then tied to the lifetime of the peer device, or the control plane can use a regular netkit pair to connect the hostns to a Pod/container and dynamically add/remove rxq leasing through a single device without having to interrupt the device pair. In the case of io_uring, the memory pool is used as skb non-linear pages, and thus the skb will go its way through the regular stack into netkit. Things like the netkit policy when no BPF is attached or skb scrubbing etc apply as-is in case the paired devices are used, or if the backend memory is tied to the single device and traffic goes through a paired device. * For the use-case of AF_XDP, the control plane needs to use netkit in the single device mode. The single device mode currently enforces only a pass policy when no BPF is attached, and does not yet support BPF link attachments for AF_XDP. skbs sent to that device get dropped at the moment. Given AF_XDP operates at a lower layer of the stack tying this to the netkit pair did not make sense. In future, the plan is to allow BPF at the XDP layer which can: i) process traffic coming from the AF_XDP application (e.g. QEMU with AF_XDP backend) to filter egress traffic or to push selected egress traffic up to the single netkit device to the local stack (e.g. DHCP requests), and ii) vice-versa skbs sent to the single netkit into the AF_XDP application (e.g. DHCP replies). Also, the control-plane can dynamically manage rxq leasing for the single netkit device without having to interrupt (e.g. down/up cycle) the main netkit pair for the Pod which has traffic going in and out. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Jordan Rife Reviewed-by: Nikolay Aleksandrov Link: https://docs.cilium.io/en/stable/operations/performance/tuning/#netkit-device-mode [0] Link: https://patch.msgid.link/20260402231031.447597-11-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 910f636db958b65c03eb2ea6f2f93c8d426c6066 Author: Daniel Borkmann Date: Fri Apr 3 01:10:26 2026 +0200 xsk: Proxy pool management for leased queues Similarly to the netif_mp_{open,close}_rxq handling for leased queues, proxy the xsk_{reg,clear}_pool_at_qid via netif_get_rx_queue_lease_locked such that in case a virtual netdev picked a leased rxq, the request gets through to the real rxq in the physical netdev. The proxying is only relevant for queue_id < dev->real_num_rx_queues since right now it's only supported for rxqs. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260402231031.447597-10-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 9368397fb92ac95a0495cd73b5e3194ade6b883d Author: Daniel Borkmann Date: Fri Apr 3 01:10:25 2026 +0200 xsk: Extend xsk_rcv_check validation xsk_rcv_check tests for inbound packets to see whether they match the bound AF_XDP socket. Refactor the test into a small helper xsk_dev_queue_valid and move the validation against xs->dev and xs->queue_id there. The fast-path case stays in place and allows for quick return in xsk_dev_queue_valid. If it fails, the validation is extended to check whether the AF_XDP socket is bound against a leased queue, and if so, the test is redone. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260402231031.447597-9-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 222b5566a02dbf136291376e4aa1806213fe9fa2 Author: David Wei Date: Fri Apr 3 01:10:24 2026 +0200 net: Proxy netdev_queue_get_dma_dev for leased queues Extend netdev_queue_get_dma_dev to return the physical device of the real rxq for DMA in case the queue was leased. This allows memory providers like io_uring zero-copy or devmem to bind to the physically leased rxq via virtual devices such as netkit. Signed-off-by: David Wei Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260402231031.447597-8-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 5602ad61ebee99c83081fba1aaf5814736edc3e7 Author: David Wei Date: Fri Apr 3 01:10:23 2026 +0200 net: Proxy netif_mp_{open,close}_rxq for leased queues When a process in a container wants to setup a memory provider, it will use the virtual netdev and a leased rxq, and call netif_mp_{open,close}_rxq to try and restart the queue. At this point, proxy the queue restart on the real rxq in the physical netdev. For memory providers (io_uring zero-copy rx and devmem), it causes the real rxq in the physical netdev to be filled from a memory provider that has DMA mapped memory from a process within a container. Signed-off-by: David Wei Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260402231031.447597-7-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 1e91c98bc9a8ef8198e73151b2a118cd3748925d Author: Daniel Borkmann Date: Fri Apr 3 01:10:22 2026 +0200 net: Slightly simplify net_mp_{open,close}_rxq net_mp_open_rxq is currently not used in the tree as all callers are using __net_mp_open_rxq directly, and net_mp_close_rxq is only used once while all other locations use __net_mp_close_rxq. Consolidate into a single API, netif_mp_{open,close}_rxq, using the netif_ prefix to indicate that the caller is responsible for locking. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260402231031.447597-6-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 22fdf28f7c03d3c130103ee77382c53d293f1732 Author: Daniel Borkmann Date: Fri Apr 3 01:10:21 2026 +0200 net, ethtool: Disallow leased real rxqs to be resized Similar to AF_XDP, do not allow queues in a physical netdev to be resized by ethtool -L when they are leased. Cover channel resize paths (both netlink and ioctl) to reject resizing when the queues would be affected. Given we need to have different checks for RX vs TX, detangle the code into a two-loop version rather than the range of new_combined + min(new_rx, new_tx) to old_combined + max(old_rx, old_tx). Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260402231031.447597-5-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 21d58b35e500ae099188c1be8398442733bc0d89 Author: Daniel Borkmann Date: Fri Apr 3 01:10:20 2026 +0200 net: Add lease info to queue-get response Populate nested lease info to the queue-get response that returns the ifindex, queue id with type and optionally netns id if the device resides in a different netns. Example with ynl client when using AF_XDP via queue leasing: # ip a [...] 4: enp10s0f0np0: mtu 1500 xdp/id:24 qdisc mq state UP group default qlen 1000 link/ether e8:eb:d3:a3:43:f6 brd ff:ff:ff:ff:ff:ff inet 10.0.0.2/24 scope global enp10s0f0np0 valid_lft forever preferred_lft forever inet6 fe80::eaeb:d3ff:fea3:43f6/64 scope link proto kernel_ll valid_lft forever preferred_lft forever [...] # ethtool -i enp10s0f0np0 driver: mlx5_core [...] # ynl --family netdev --output-json --do queue-get \ --json '{"ifindex": 4, "id": 15, "type": "rx"}' {'id': 15, 'ifindex': 4, 'lease': {'ifindex': 8, 'netns-id': 0, 'queue': {'id': 1, 'type': 'rx'}}, 'napi-id': 8227, 'type': 'rx', 'xsk': {}} # ip netns list foo (id: 0) # ip netns exec foo ip a [...] 8: nk@NONE: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff inet6 fe80::200:ff:fe00:0/64 scope link proto kernel_ll valid_lft forever preferred_lft forever [...] # ip netns exec foo ethtool -i nk driver: netkit [...] # ip netns exec foo ls /sys/class/net/nk/queues/ rx-0 rx-1 tx-0 # ip netns exec foo ynl --family netdev --output-json --do queue-get \ --json '{"ifindex": 8, "id": 1, "type": "rx"}' {"id": 1, "type": "rx", "ifindex": 8, "xsk": {}} Note that the caller of netdev_nl_queue_fill_one() holds the netdevice lock. For the queue-get we do not lock both devices. When queues get {un,}leased, both devices are locked, thus if __netif_get_rx_queue_lease() returns a lease pointer, it points to a valid device. The netns-id is fetched via peernet2id_alloc() similarly as done in OVS. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260402231031.447597-4-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit d04686d9bc86432ea3008d5f358373d8466d1943 Author: Daniel Borkmann Date: Fri Apr 3 01:10:19 2026 +0200 net: Implement netdev_nl_queue_create_doit Implement netdev_nl_queue_create_doit which creates a new rx queue in a virtual netdev and then leases it to a rx queue in a physical netdev. Example with ynl client: # ynl --family netdev --output-json --do queue-create \ --json '{"ifindex": 8, "type": "rx", "lease": {"ifindex": 4, "queue": {"type": "rx", "id": 15}}}' {'id': 1} Note that the netdevice locking order is always from the virtual to the physical device. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260402231031.447597-3-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 7789c6bb76acf21539c2c74b0cc869bb57de99e6 Author: Daniel Borkmann Date: Fri Apr 3 01:10:18 2026 +0200 net: Add queue-create operation Add a ynl netdev family operation called queue-create that creates a new queue on a netdevice: name: queue-create attribute-set: queue flags: [admin-perm] do: request: attributes: - ifindex - type - lease reply: &queue-create-op attributes: - id This is a generic operation such that it can be extended for various use cases in future. Right now it is mandatory to specify ifindex, the queue type which is enforced to rx and a lease. The newly created queue id is returned to the caller. A queue from a virtual device can have a lease which refers to another queue from a physical device. This is useful for memory providers and AF_XDP operations which take an ifindex and queue id to allow applications to bind against virtual devices in containers. The lease couples both queues together and allows to proxy the operations from a virtual device in a container to the physical device. In future, the nested lease attribute can be lifted and made optional for other use-cases such as dynamic queue creation for physical netdevs. The lack of lease and the specification of the physical device as an ifindex will imply that we need a real queue to be allocated. Similarly, the queue type enforcement to rx can then be lifted as well to support tx. An early implementation had only driver-specific integration [0], but in order for other virtual devices to reuse, it makes sense to have this as a generic API in core net. For leasing queues, the virtual netdev must have real_num_rx_queues less than num_rx_queues at the time of calling queue-create. The queue-type must be rx as only rx queues are supported for leasing for now. We also enforce that the queue-create ifindex must point to a virtual device, and that the nested lease attribute's ifindex must point to a physical device. The nested lease attribute set contains a netns-id attribute which is optional and can specify a netns-id relative to the caller's netns. It requires cap_net_admin and if the netns-id attribute is not specified, the lease ifindex will be retrieved from the current netns. Also, it is modeled as an s32 type similarly as done elsewhere in the stack. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://bpfconf.ebpf.io/bpfconf2025/bpfconf2025_material/lsfmmbpf_2025_netkit_borkmann.pdf [0] Link: https://patch.msgid.link/20260402231031.447597-2-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 83e8d8bbffa8161e94f3aeee4dd09a35062a78c8 Merge: 9fb0106249ca3e 4aa0deae107069 Author: Dave Airlie Date: Fri Apr 10 11:15:14 2026 +1000 Merge tag 'drm-misc-next-fixes-2026-04-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Short summary of fixes pull: dma-buf: - fence: fix docs for dma_fence_unlock_irqrestore() fb-helper: - unlock in error path gem-shmem: - fix PMD write update gem-vram: - remove obsolete documentation ivpu: - fix device-recovery handling Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260409113921.GA181028@linux.fritz.box commit 539fb773a3f7c07cf7fd00617f33ed4e33058d72 Author: Christoph Hellwig Date: Fri Mar 27 10:00:32 2026 +0100 block: refactor blkdev_zone_mgmt_ioctl Split the zone reset case into a separate helper so that the conditional locking goes away. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Bart Van Assche Reviewed-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Link: https://patch.msgid.link/20260327090032.3722065-1-hch@lst.de Signed-off-by: Jens Axboe commit b774765fb804045ee774476ded8e52482ae5ecb7 Author: Ming Lei Date: Thu Apr 9 21:30:19 2026 +0800 MAINTAINERS: update ublk driver maintainer email Update the ublk userspace block driver maintainer email address from ming.lei@redhat.com to tom.leiming@gmail.com as the original email will become invalid. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260409133020.3780098-8-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 289653bb76c46149f88939c3cfef55cdb236ace2 Author: Ming Lei Date: Thu Apr 9 21:30:18 2026 +0800 Documentation: ublk: address review comments for SHMEM_ZC docs - Use "physical pages" instead of "page frame numbers (PFNs)" for clarity - Remove "without any per-I/O overhead" claim from zero-copy description - Add scatter/gather limitation: each I/O's data must be contiguous within a single registered buffer Suggested-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260409133020.3780098-7-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 365ea7cc62447caac508706b429cdf031cc15a9f Author: Ming Lei Date: Thu Apr 9 21:30:17 2026 +0800 ublk: allow buffer registration before device is started Before START_DEV, there is no disk, no queue, no I/O dispatch, so the maple tree can be safely modified under ub->mutex alone without freezing the queue. Add ublk_lock_buf_tree()/ublk_unlock_buf_tree() helpers that take ub->mutex first, then freeze the queue if device is started. This ordering (mutex -> freeze) is safe because ublk_stop_dev_unlocked() already holds ub->mutex when calling del_gendisk() which freezes the queue. Suggested-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260409133020.3780098-6-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 5e864438e2853ef5112d7905fadcc3877e2be70a Author: Ming Lei Date: Thu Apr 9 21:30:16 2026 +0800 ublk: replace xarray with IDA for shmem buffer index allocation Remove struct ublk_buf which only contained nr_pages that was never read after registration. Use IDA for pure index allocation instead of xarray. Make __ublk_ctrl_unreg_buf() return int so the caller can detect invalid index without a separate lookup. Simplify ublk_buf_cleanup() to walk the maple tree directly and unpin all pages in one pass, instead of iterating the xarray by buffer index. Suggested-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260409133020.3780098-5-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 8ea8566a9aeef746699d8c84bed3ac44edbfaa0e Author: Ming Lei Date: Thu Apr 9 21:30:15 2026 +0800 ublk: simplify PFN range loop in __ublk_ctrl_reg_buf Use the for-loop increment instead of a manual `i++` past the last page, and fix the mtree_insert_range end key accordingly. Suggested-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260409133020.3780098-4-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 211ff1602b67e26125977f8b2f369d7c2847628c Author: Ming Lei Date: Thu Apr 9 21:30:14 2026 +0800 ublk: verify all pages in multi-page bvec fall within registered range rq_for_each_bvec() yields multi-page bvecs where bv_page is only the first page. ublk_try_buf_match() only validated the start PFN against the maple tree, but a bvec can span multiple pages past the end of a registered range. Use mas_walk() instead of mtree_load() to obtain the range boundaries stored in the maple tree, and check that the bvec's end PFN does not exceed the range. Also remove base_pfn from struct ublk_buf_range since mas.index already provides the range start PFN. Reported-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260409133020.3780098-3-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 23b3b6f0b584b70a427d5bb826d320151890d7da Author: Ming Lei Date: Thu Apr 9 21:30:13 2026 +0800 ublk: widen ublk_shmem_buf_reg.len to __u64 for 4GB buffer support The __u32 len field cannot represent a 4GB buffer (0x100000000 overflows to 0). Change it to __u64 so buffers up to 4GB can be registered. Add a reserved field for alignment and validate it is zero. The kernel enforces a default max of 4GB (UBLK_SHMEM_BUF_SIZE_MAX) which may be increased in future. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260409133020.3780098-2-tom.leiming@gmail.com Signed-off-by: Jens Axboe commit 6fa253b38b9b293a0de2a361de400557ca7666ca Author: Hyungjung Joo Date: Fri Mar 13 22:29:43 2026 +0900 affs: bound hash_pos before table lookup in affs_readdir affs_readdir() decodes ctx->pos into hash_pos and chain_pos and then dereferences AFFS_HEAD(dir_bh)->table[hash_pos] before validating that hash_pos is within the runtime table bound. Treat out-of-range positions as end-of-directory before the first table lookup. Signed-off-by: Hyungjung Joo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6ecea2083d61f2b440477693b8b024df00dccbb4 Author: Rosen Penev Date: Thu Mar 26 20:03:10 2026 -0700 i2c: atr: use kzalloc_flex Convert kzalloc_obj + kcalloc to kzalloc_flex to save an allocation. Add __counted_by to get extra runtime analysis. Signed-off-by: Rosen Penev Reviewed-by: Luca Ceresoli Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260327030310.8502-1-rosenp@gmail.com commit b070dc36291fec966ad915f80a4f239b5c70c290 Author: Thomas Weißschuh Date: Wed Apr 8 23:03:58 2026 +0200 selftests/nolibc: use gcc 15 Newer compilers tend to detect more problematic code. Update the testsuite to use gcc 15.2.0 by default. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260408-nolibc-gcc-15-v1-3-330d0c40f894@weissschuh.net commit 3495279d05d62b07d7594c75d4380f51d04410dd Author: Thomas Weißschuh Date: Wed Apr 8 23:03:57 2026 +0200 tools/nolibc: support UBSAN on gcc The UBSAN implementation in gcc requires a slightly different function attribute to skip instrumentation. Extend __nolibc_no_sanitize_undefined to also handle gcc. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260408-nolibc-gcc-15-v1-2-330d0c40f894@weissschuh.net commit 08ab9580726edcc12019d2097b56b88de1142ca7 Author: Thomas Weißschuh Date: Wed Apr 8 23:03:56 2026 +0200 tools/nolibc: create __nolibc_no_sanitize_ubsan The logic to disable UBSAN will become a bit more complicated. Move it out into compiler.h, so crt.h stays readable. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260408-nolibc-gcc-15-v1-1-330d0c40f894@weissschuh.net commit 9fb0106249ca3e01d60c15d4f5592cd58a9164b0 Author: Maarten Lankhorst Date: Thu Apr 9 16:26:59 2026 +0200 drm/ttm/tests: Remove checks from ttm_pool_free_no_dma_alloc On !x86, the pool type is never initialised, and the pages are freed back to the system. The test broke on the list_lru rewrite, but I'm not sure how that it was supposed to work previously. In the meantime CI is broken so reverting for now. Fixes: 444e2a19d7fd ("ttm/pool: port to list_lru. (v2)") Cc: Christian Koenig Cc: Johannes Weiner Cc: Dave Chinner Cc: Christian König Cc: Dave Airlie Signed-off-by: Maarten Lankhorst Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260409142658.1511941-2-dev@lankhorst.se commit 3b053cd71598f7769f41b4f01f4540aab2e77b93 Author: Matthew Auld Date: Thu Apr 9 13:15:09 2026 +0100 drm/ttm/tests: fix lru_count ASSERT On pool init we should expect the lru_count for each node to be zeroed as per __list_lru_init -> init_one_lru, but here we are asserting the opposite. Currently our CI is blowing up with: 10:23:33] # ttm_device_init_pools: ASSERTION FAILED at drivers/gpu/drm/ttm/tests/ttm_device_test.c:178 [10:23:33] Expected !list_lru_count(&pt.pages) to be false, but is true [10:23:33] [FAILED] DMA allocations, DMA32 required [10:23:33] [PASSED] No DMA allocations, DMA32 required [10:23:33] # ttm_device_init_pools: ASSERTION FAILED at drivers/gpu/drm/ttm/tests/ttm_device_test.c:178 [10:23:33] Expected !list_lru_count(&pt.pages) to be false, but is true Fixes: 444e2a19d7fd ("ttm/pool: port to list_lru. (v2)") Signed-off-by: Matthew Auld Cc: Matthew Brost Cc: Christian Koenig Cc: Dave Airlie Reviewed-by: Ryszard Knop Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260409121512.81298-3-matthew.auld@intel.com commit a0c584fc18056709c8e047a82a6045d6c209f4ce Author: Jiayuan Chen Date: Thu Apr 9 10:37:32 2026 +0800 bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offloaded BPF map or program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown during netns destruction. If the netns refcount has already reached 0, get_net() performs a refcount_t increment on 0, triggering: refcount_t: addition on 0; use-after-free. Although rtnl_lock and bpf_devs_lock ensure the netdev pointer remains valid, they cannot prevent the netns refcount from reaching zero. Fix this by using maybe_get_net() instead of get_net(). maybe_get_net() uses refcount_inc_not_zero() and returns NULL if the refcount is already zero, which causes ns_get_path_cb() to fail and the caller to return -ENOENT -- the correct behavior when the netns is being destroyed. Fixes: 675fc275a3a2d ("bpf: offload: report device information for offloaded programs") Fixes: 52775b33bb507 ("bpf: offload: report device information about offloaded maps") Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Reviewed-by: Dongliang Mu Closes: https://lore.kernel.org/bpf/f0aa3678-79c9-47ae-9e8c-02a3d1df160a@hust.edu.cn/ Signed-off-by: Jiayuan Chen Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260409023733.168050-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit eb216e422044f5523da038136ce0f2abcc6a75bc Author: Salil Mehta Date: Thu Apr 9 01:04:30 2026 +0100 MAINTAINERS: Remove Salil Mehta as HiSilicon HNS3/HNS Ethernet maintainer Closing this chapter and a long wonderful journey with my team, I sign off one last time with my Huawei email address. Remove my maintainer entry for the HiSilicon HNS and HNS3 10G/100G Ethernet drivers, and add a CREDITS entry for my co-authorship and maintenance contributions to these drivers. Link: https://lore.kernel.org/netdev/259cd032-2ccb-452b-8524-75bc7162e138@huawei.com/ Cc: Jian Shen Signed-off-by: Salil Mehta Acked-by: Jijie Shao Link: https://patch.msgid.link/20260409000430.7217-1-salil.mehta@huawei.com Signed-off-by: Jakub Kicinski commit b6e39e48469e37057fce27a1b87cf6d3e456aa42 Merge: 9700282a7ec721 a55f7f5f29b32c Author: Jakub Kicinski Date: Thu Apr 2 10:57:09 2026 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-7.0-rc8). Conflicts: net/ipv6/seg6_iptunnel.c c3812651b522f ("seg6: separate dst_cache for input and output paths in seg6 lwtunnel") 78723a62b969a ("seg6: add per-route tunnel source address") https://lore.kernel.org/adZhwtOYfo-0ImSa@sirena.org.uk net/ipv4/icmp.c fde29fd934932 ("ipv4: icmp: fix null-ptr-deref in icmp_build_probe()") d98adfbdd5c01 ("ipv4: drop ipv6_stub usage and use direct function calls") https://lore.kernel.org/adO3dccqnr6j-BL9@sirena.org.uk Adjacent changes: drivers/net/ethernet/stmicro/stmmac/chain_mode.c 51f4e090b9f8 ("net: stmmac: fix integer underflow in chain mode") 6b4286e05508 ("net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()") Signed-off-by: Jakub Kicinski commit 8697bdd67be87fc007c1ea2f98a59e29ae902170 Author: Daniel Borkmann Date: Thu Apr 9 17:50:16 2026 +0200 selftests/bpf: Add test for stale pkt range after scalar arithmetic Extend the verifier_direct_packet_access BPF selftests to exercise the verifier code paths which ensure that the pkt range is cleared after add/sub alu with a known scalar. The tests reject the invalid access. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_direct [...] #592/35 verifier_direct_packet_access/direct packet access: pkt_range cleared after sub with known scalar:OK #592/36 verifier_direct_packet_access/direct packet access: pkt_range cleared after add with known scalar:OK #592/37 verifier_direct_packet_access/direct packet access: test3:OK #592/38 verifier_direct_packet_access/direct packet access: test3 @unpriv:OK #592/39 verifier_direct_packet_access/direct packet access: test34 (non-linear, cgroup_skb/ingress, too short eth):OK #592/40 verifier_direct_packet_access/direct packet access: test35 (non-linear, cgroup_skb/ingress, too short 1):OK #592/41 verifier_direct_packet_access/direct packet access: test36 (non-linear, cgroup_skb/ingress, long enough):OK #592 verifier_direct_packet_access:OK [...] Summary: 2/47 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260409155016.536608-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 9f118095dd341885dbc3f1cd6a028414da099aba Author: Daniel Borkmann Date: Thu Apr 9 17:50:15 2026 +0200 bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken When a pkt pointer acquires AT_PKT_END or BEYOND_PKT_END range from a comparison, and then, known-constant arithmetic is performed, adjust_ptr_min_max_vals() copies the stale range via dst_reg->raw = ptr_reg->raw without clearing the negative reg->range sentinel values. This lets is_pkt_ptr_branch_taken() choose one branch direction and skip going through the other. Fix this by clearing negative pkt range values (that is, AT_PKT_END and BEYOND_PKT_END) after arithmetic on pkt pointers. This ensures is_pkt_ptr_branch_taken() returns unknown and both branches are properly verified. Fixes: 6d94e741a8ff ("bpf: Support for pointers beyond pkt_end.") Reported-by: STAR Labs SG Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260409155016.536608-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 8e937866b425248fa375b2138c19c117a87c6be0 Merge: 2fb9ec386fa1a8 d7610855b0b5e9 Author: Rafael J. Wysocki Date: Thu Apr 9 22:01:19 2026 +0200 Merge branch 'acpi-apei' Merge ACPI APEI updates for 7.1-rc1: - Add devm_ghes_register_vendor_record_notifier(), use it in the PCI hisi driver, and Add NVIDIA vendor CPER record handler (Kai-Heng Feng) * acpi-apei: ACPI: APEI: GHES: Add NVIDIA vendor CPER record handler PCI: hisi: Use devm_ghes_register_vendor_record_notifier() ACPI: APEI: GHES: Add devm_ghes_register_vendor_record_notifier() commit 2fb9ec386fa1a842701a5ba4bb44f1e544d9bfc4 Merge: 5437cdcb552b69 d37ec2fbab55d7 Author: Rafael J. Wysocki Date: Thu Apr 9 21:54:15 2026 +0200 Merge branch 'acpi-driver' Merge ACPI core driver core driver updates and assorted driver updates related to ACPI support for 7.1-rc1: - Clean up the ACPI AC and ACPI PAD (processor aggregator device) drivers (Rafael Wysocki) - Rework checking for duplicate video bus devices and consolidate pnp.bus_id workarounds handling in the ACPI video bus driver (Rafael Wysocki) - Update the ACPI core device drivers to stop setting acpi_device_name() unnecessarily (Rafael Wysocki) - Rearrange code using acpi_device_class() in the ACPI core device drivers and update them to stop setting acpi_device_class() unnecessarily (Rafael Wysocki) - Define ACPI_AC_CLASS in one place (Rafael Wysocki) - Convert the ni903x_wdt watchdog driver and the xen ACPI PAD driver to bind to platform devices instead of ACPI devices (Rafael Wysocki) * acpi-driver: watchdog: ni903x_wdt: Convert to a platform driver ACPI: PAD: xen: Convert to a platform driver ACPI: AC: Define ACPI_AC_CLASS in one place ACPI: driver: Do not set acpi_device_class() unnecessarily ACPI: driver: Avoid using pnp.device_class for netlink handling ACPI: event: Redefine acpi_notifier_call_chain() ACPI: driver: Do not set acpi_device_name() unnecessarily ACPI: video: Consolidate pnp.bus_id workarounds handling ACPI: video: Rework checking for duplicate video bus devices driver core: auxiliary bus: Introduce dev_is_auxiliary() ACPI: PAD: Rearrange notify handler installation and removal ACPI: AC: Get rid of unnecessary declarations commit 7d696210cf36ed31c7c37f6eff17cb7147e83367 Author: Zxyan Zhu Date: Thu Apr 9 11:50:15 2026 +0800 regmap: debugfs: fix race condition in dummy name allocation Use IDA instead of a simple counter for generating unique dummy names. The previous implementation used dummy_index++ which is not atomic, leading to potential duplicate names when multiple threads call regmap_debugfs_init() concurrently with name="dummy". Signed-off-by: Zxyan Zhu Link: https://patch.msgid.link/20260409035015.950764-1-zxyan0222@gmail.com Signed-off-by: Mark Brown commit 5437cdcb552b698ebc7274e84f2ce8bae1769e56 Merge: d07060217b8bbe 7572dcabe38d90 Author: Rafael J. Wysocki Date: Thu Apr 9 21:50:37 2026 +0200 Merge branch 'acpi-tad' Merge ACPI Time and Alarm Device (TAD) driver updates for 7.1-rc1: - Clean up the ACPI TAD driver in various ways and add an RTC class device interface, including both the RTC setting/reading and alarm timer support, to it (Rafael Wysocki) * acpi-tad: ACPI: TAD: Add alarm support to the RTC class device interface ACPI: TAD: Split acpi_tad_rtc_read_time() ACPI: TAD: Relocate two functions ACPI: TAD: Split three functions to untangle runtime PM handling ACPI: TAD: Use DC wakeup only if AC wakeup is supported ACPI: TAD: Use dev_groups in struct device_driver ACPI: TAD: Update the driver description comment ACPI: TAD: Add RTC class device interface ACPI: TAD: Clear unused RT data in acpi_tad_set_real_time() ACPI: TAD: Rearrange RT data validation checking ACPI: TAD: Use __free() for cleanup in time_store() ACPI: TAD: Support RTC without wakeup ACPI: TAD: Create one attribute group commit bf746e2a41efd98668c97759e06d436ae5af5a82 Author: John Madieu Date: Thu Apr 9 14:59:16 2026 +0200 thermal: renesas: rzg3e: Remove stale @trim_offset kernel-doc entry The trim_offset field was removed from struct rzg3e_thermal_priv but its kernel-doc entry was left behind. Remove it to fix the mismatch. Signed-off-by: John Madieu Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20260409125916.2244241-1-john.madieu.xa@bp.renesas.com commit fbb1f8ba4e2d847859d04220c4a775996f072d57 Author: Jack Yu Date: Thu Apr 9 14:01:01 2026 +0800 ASoC: rt1320-sdw: kcontrol for brown-out feature update Create a kcontrol to enable or disable brown-out dynamically. Signed-off-by: Jack Yu Link: https://patch.msgid.link/20260409060102.4177554-1-jack.yu@realtek.com Signed-off-by: Mark Brown commit d07060217b8bbed26a84c2d80b2bbb550cb5b403 Merge: bfb0315a2dc89a b48ee1f7404a17 Author: Rafael J. Wysocki Date: Thu Apr 9 21:40:22 2026 +0200 Merge branch 'acpi-cmos-rtc' Merge updates related to the CMOS RTC driver and x86/ACPI CMOS RTC support for 7.1-rc1: - Add ACPI support to the platform device interface in the CMOS RTC driver, make the ACPI core device enumeration code create a platform device for the CMOS RTC, and drop CMOS RTC PNP device support (Rafael Wysocki) - Consolidate the x86-specific CMOS RTC handling with the ACPI TAD driver and clean up the CMOS RTC ACPI address space handler (Rafael Wysocki) - Enable ACPI alarm in the CMOS RTC driver if advertised in ACPI FADT and allow that driver to work without a dedicated IRQ if the ACPI alarm is used (Rafael Wysocki) * acpi-cmos-rtc: rtc: cmos: Do not require IRQ if ACPI alarm is used rtc: cmos: Enable ACPI alarm if advertised in ACPI FADT ACPI: TAD/x86: cmos_rtc: Consolidate address space handler setup rtc: cmos: Drop PNP device support x86: rtc: Drop PNP device check ACPI: PNP: Drop CMOS RTC PNP device support ACPI: x86/rtc-cmos: Use platform device for driver binding ACPI: x86: cmos_rtc: Create a CMOS RTC platform device ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver ACPI: x86: cmos_rtc: Clean up address space handler driver commit bfb0315a2dc89a2f3b353b3b82efe8eeeac629b2 Merge: 8e2308c1aec91b 07cba0de5598a4 0cc24977224a6c Author: Rafael J. Wysocki Date: Thu Apr 9 21:26:06 2026 +0200 Merge branches 'acpi-processor' and 'acpi-cppc' Merge ACPI processor driver updates and ACPI CPPC library updates for 7.1-rc1: - Address multiple assorted issues and clean up the code in the ACPI processor idle driver (Huisong Li) - Replace strlcat() in the ACPI processor idle drive with a better alternative (Andy Shevchenko) - Rearrange and clean up acpi_processor_errata_piix4() (Rafael Wysocki) - Move reference performance to capabilities and fix an uninitialized variable in the ACPI CPPC library (Pengjie Zhang) - Add support for the Performance Limited Register to the ACPI CPPC library (Sumit Gupta) - Add cppc_get_perf() API to read performance controls, extend cppc_set_epp_perf() for FFH/SystemMemory, and make the ACPI CPPC library warn on missing mandatory DESIRED_PERF register (Sumit Gupta) - Modify the cpufreq CPPC driver to update MIN_PERF/MAX_PERF in target callbacks to allow it to control performance bounds via standard scaling_min_freq and scaling_max_freq sysfs attributes and add sysfs documentation for the Performance Limited Register to it (Sumit Gupta) * acpi-processor: ACPI: processor: idle: Reset cpuidle on C-state list changes cpuidle: Extract and export no-lock variants of cpuidle_unregister_device() ACPI: processor: idle: Fix NULL pointer dereference in hotplug path ACPI: processor: idle: Reset power_setup_done flag on initialization failure ACPI: processor: Rearrange and clean up acpi_processor_errata_piix4() ACPI: processor: idle: Replace strlcat() with better alternative ACPI: processor: idle: Remove redundant static variable and rename cstate check function ACPI: processor: idle: Move max_cstate update out of the loop ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init ACPI: processor: idle: Add missing bounds check in flatten_lpi_states() * acpi-cppc: ACPI: CPPC: Check cpc_read() return values consistently ACPI: CPPC: Fix uninitialized ref variable in cppc_get_perf_caps() ACPI: CPPC: Move reference performance to capabilities cpufreq: CPPC: Add sysfs documentation for perf_limited ACPI: CPPC: add APIs and sysfs interface for perf_limited cpufreq: cppc: Update MIN_PERF/MAX_PERF in target callbacks cpufreq: CPPC: Update cached perf_ctrls on sysfs write ACPI: CPPC: Extend cppc_set_epp_perf() for FFH/SystemMemory ACPI: CPPC: Warn on missing mandatory DESIRED_PERF register ACPI: CPPC: Add cppc_get_perf() API to read performance controls commit e30aa03d032df0f3ee5efb1995a7a2fe662177be Author: Sean Christopherson Date: Thu Apr 9 12:13:41 2026 -0700 x86/virt: Treat SVM as unsupported when running as an SEV+ guest When running as an SEV+ guest, treat SVM as unsupported even if CPUID (and other reporting, e.g. MSRs) enumerate support for SVM, as KVM doesn't support nested virtualization within an SEV VM (KVM would need to explicitly share all VMCBs and other assets with the untrusted host), let alone running nested VMs within SEV-ES+ guests (e.g. emulating VMLOAD, VMSAVE, and VMRUN all require access to guest register state). And outside of KVM, there is no in-tree user of SVM enabling. Arguably, the hypervisor/VMM (e.g. QEMU) should clear SVM from guest CPUID for SEV VMs, especially for SEV-ES+, but super duper technically, it's feasible to run nested VMs in SEV+ guests (with many caveats). More importantly, Linux-as-a-guest has played nice with SVM being advertised to SEV+ guests for a long time. Treating SVM as unsupported fixes a regression where a clean shutdown of an SEV-ES+ guest degrades into an abrupt termination. Due to a gnarly virtualization hole in SEV-ES (the architecture), where EFER must NOT be intercepted by the hypervisor (because the untrusted hypervisor can't set e.g. EFER.LME on behalf o the guest), the _host's_ EFER.SVME is visible to the guest. Because EFER.SVME must be always '1' while in guest mode, Linux-the-guest sees EFER.SVME=1 even when _its_ EFER.SVME is '0', thinks it has enabled virtualization, and ultimately can cause x86_svm_emergency_disable_virtualization_cpu() to execute STGI to ensure GIF is enabled. Executing STGI _should_ be fine, except Linux is a also wee bit paranoid when running as an SEV-ES guest. Because L0 sees EFER.SVME=0 for the guest, a well-behaved L0 hypervisor will intercept STGI (to inject #UD), and thus generate a #VC on the STGI. Which, again, should be fine. Unfortunately, vc_check_opcode_bytes() fails to account for STGI and other SVM instructions, throws a fatal error, and triggers a termination request. In a perfect world, the #VC handler would be more forgiving of unknown intercepts, especially when the #VC happened on an instruction with exception fixup. For now, just fix the immediate regression. Fixes: 428afac5a8ea ("KVM: x86: Move bulk of emergency virtualizaton logic to virt subsystem") Reported-by: Srikanth Aithal Closes: https://lore.kernel.org/all/c820e242-9f3a-4210-b414-19d11b022404@amd.com Link: https://patch.msgid.link/20260409191341.1932853-1-seanjc@google.com Signed-off-by: Sean Christopherson commit e7ef5ec6d1f0568e5c11ceeb729f412560ad8ef7 Merge: b043657c35e52e 8498100ee1d004 Author: Mark Brown Date: Thu Apr 9 20:19:36 2026 +0100 regulator: fix OF node imbalance on reuse Johan Hovold says: These drivers reuse the OF node of their parent multi-function device but fail to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices. Fix this by using the intended helper for reusing OF nodes. Note that the first two patches will cause a trivial conflict with Doug's series adding accessor functions for struct device flags which has now been merged to the driver-core tree: https://lore.kernel.org/r/20260406232444.3117516-1-dianders@chromium.org Link: https://patch.msgid.link/20260408073055.5183-1-johan@kernel.org commit 8498100ee1d00422b8c5b161b3e332278b92a59a Author: Johan Hovold Date: Wed Apr 8 09:30:55 2026 +0200 regulator: bd9571mwv: fix OF node reference imbalance The driver reuses the OF node of the parent multi-function device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices. Fix this by using the intended helper for reusing OF nodes. Fixes: e85c5a153fe2 ("regulator: Add ROHM BD9571MWV-M PMIC regulator driver") Cc: stable@vger.kernel.org # 4.12 Cc: Marek Vasut Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260408073055.5183-8-johan@kernel.org Signed-off-by: Mark Brown commit 8e2308c1aec91b32640c488205f4fe6d6cc8d1de Merge: abdd2a86535b59 22dd51bb0a48ab f862f2919669ea 1b7cbe343349ec Author: Rafael J. Wysocki Date: Thu Apr 9 21:19:34 2026 +0200 Merge branches 'acpica', 'acpi-osl' and 'acpi-tables' Merge ACPICA updates, an ACPI OS service layer (OSL) update and assorted updates related to parsing ACPI tables for 7.1-rc1: - Update maintainers information regarding ACPICA (Rafael Wysocki) - Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy() (Kees Cook) - Trigger an ordered system power off after encountering a fatal error operator in AML (Armin Wolf) - Enable ACPI FPDT parsing on LoongArch (Xi Ruoyao) - Remove the temporary stop-gap acpi_pptt_cache_v1_full structure from the ACPI PPTT parser (Ben Horgan) - Add support for exposing ACPI FPDT subtables FBPT and S3PT (Nate DeSimone) * acpica: ACPICA: Update maintainers information ACPICA: Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy() * acpi-osl: ACPI: OSL: Poweroff when encountering a fatal ACPI error * acpi-tables: ACPI: tables: Enable FPDT on LoongArch Documentation: ABI: add FBPT and S3PT entries to sysfs-firmware-acpi ACPI: FPDT: expose FBPT and S3PT subtables via sysfs ACPI: PPTT: Remove duplicate structure, acpi_pptt_cache_v1_full commit 0d15ce31375ccef4162f960b34547a821b7619d2 Author: Johan Hovold Date: Wed Apr 8 09:30:54 2026 +0200 regulator: act8945a: fix OF node reference imbalance The driver reuses the OF node of the parent multi-function device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices. Fix this by using the intended helper for reusing OF nodes. Fixes: 38c09961048b ("regulator: act8945a: add regulator driver for ACT8945A") Cc: stable@vger.kernel.org # 4.6 Cc: Wenyou Yang Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260408073055.5183-7-johan@kernel.org Signed-off-by: Mark Brown commit ebe694d67f159899b063eee61bacda4cb825ed7b Author: Johan Hovold Date: Wed Apr 8 09:30:53 2026 +0200 regulator: s2dos05: fix OF node reference imbalance The driver reuses the OF node of the parent multi-function device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices. Fix this by using the intended helper for reusing OF nodes. Fixes: bb2441402392 ("regulator: add s2dos05 regulator support") Cc: stable@vger.kernel.org # 6.18 Cc: Dzmitry Sankouski Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260408073055.5183-6-johan@kernel.org Signed-off-by: Mark Brown commit 2f38e96c273e15f5e9f5d1fc2c0cbba703751602 Author: Johan Hovold Date: Wed Apr 8 09:30:52 2026 +0200 regulator: mt6357: fix OF node reference imbalance The driver reuses the OF node of the parent multi-function device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices. Fix this by using the intended helper for reusing OF nodes. Fixes: dafc7cde23dc ("regulator: add mt6357 regulator") Cc: stable@vger.kernel.org # 6.2 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260408073055.5183-5-johan@kernel.org Signed-off-by: Mark Brown commit 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 Author: Johan Hovold Date: Wed Apr 8 09:30:51 2026 +0200 regulator: max77650: fix OF node reference imbalance The driver reuses the OF node of the parent multi-function device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices. Fix this by using the intended helper for reusing OF nodes. Fixes: bcc61f1c44fd ("regulator: max77650: add regulator support") Cc: stable@vger.kernel.org # 5.1 Reviewed-by: Bartosz Golaszewski Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260408073055.5183-4-johan@kernel.org Signed-off-by: Mark Brown commit 65290b24d8a5f0b8cd065201e653db824c4a4da6 Author: Johan Hovold Date: Wed Apr 8 09:30:50 2026 +0200 regulator: rk808: fix OF node reference imbalance The driver reuses the OF node of the parent multi-function device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices. Fix this by using the intended helper for reusing OF nodes. Fixes: 647e57351f8e ("regulator: rk808: reduce 'struct rk808' usage") Cc: stable@vger.kernel.org # 6.2 Reviewed-by: Sebastian Reichel Reviewed-by: Douglas Anderson Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260408073055.5183-3-johan@kernel.org Signed-off-by: Mark Brown commit 7ea07bc030d8d6395524dec22ff3267441a28c0d Author: Johan Hovold Date: Wed Apr 8 09:30:49 2026 +0200 regulator: bq257xx: fix OF node reference imbalance The driver reuses the OF node of the parent multi-function device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the MFD and deregistering the child devices. Fix this by using the intended helper for reusing OF nodes. Fixes: 981dd162b635 ("regulator: bq257xx: Add bq257xx boost regulator driver") Cc: stable@vger.kernel.org # 6.18 Cc: Chris Morgan Reviewed-by: Douglas Anderson Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260408073055.5183-2-johan@kernel.org Signed-off-by: Mark Brown commit 22dd51bb0a48abe74b32cd4425fca878030d16ca Author: Rafael J. Wysocki Date: Thu Apr 9 13:24:28 2026 +0200 ACPICA: Update maintainers information Update MAINTAINERS to reflect ACPICA maintainership changes. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12876647.O9o76ZdvQC@rafael.j.wysocki commit 573c7db8fce91a1b07dd64a260bb44b9e6d05943 Author: Johan Hovold Date: Thu Apr 9 14:04:19 2026 +0200 spi: mpfs: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like interrupts during driver unbind. Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") Cc: stable@vger.kernel.org # 6.0 Cc: Conor Dooley Signed-off-by: Johan Hovold Acked-by: Conor Dooley Link: https://patch.msgid.link/20260409120419.388546-21-johan@kernel.org Signed-off-by: Mark Brown commit d00d722ebad46cf7a9886684f26a26337b5ee3f4 Author: Johan Hovold Date: Thu Apr 9 14:04:18 2026 +0200 spi: microchip-core-spi: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like interrupts during driver unbind. Fixes: 059f545832be ("spi: add support for microchip "soft" spi controller") Cc: stable@vger.kernel.org # 6.19 Cc: Prajna Rajendra Kumar Signed-off-by: Johan Hovold Acked-by: Conor Dooley Link: https://patch.msgid.link/20260409120419.388546-20-johan@kernel.org Signed-off-by: Mark Brown commit e6464140d439f2d42f072eb422a5b1fec470c5a6 Author: Johan Hovold Date: Thu Apr 9 14:04:17 2026 +0200 spi: microchip-core-qspi: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like interrupts during driver unbind. Fixes: 8596124c4c1b ("spi: microchip-core-qspi: Add support for microchip fpga qspi controllers") Cc: stable@vger.kernel.org # 6.1 Cc: Naga Sureshkumar Relli Signed-off-by: Johan Hovold Acked-by: Conor Dooley Link: https://patch.msgid.link/20260409120419.388546-19-johan@kernel.org Signed-off-by: Mark Brown commit 77953c76bec9af4191f8692a10225dd816208718 Author: Johan Hovold Date: Thu Apr 9 14:04:16 2026 +0200 spi: meson-spicc: fix controller deregistration Make sure to deregister the controller before disabling it to allow SPI device drivers to do I/O during deregistration. Fixes: 454fa271bc4e ("spi: Add Meson SPICC driver") Cc: stable@vger.kernel.org # 4.13 Cc: Neil Armstrong Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-18-johan@kernel.org Signed-off-by: Mark Brown commit b99206710d032c16b7f8b75e4bc18414d8e4b9f4 Author: Johan Hovold Date: Thu Apr 9 14:04:15 2026 +0200 spi: lantiq-ssc: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like clocks during driver unbind. Fixes: 17f84b793c01 ("spi: lantiq-ssc: add support for Lantiq SSC SPI controller") Cc: stable@vger.kernel.org # 4.11 Cc: Hauke Mehrtens Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-17-johan@kernel.org Signed-off-by: Mark Brown commit fc3a83b0d9c16b941c9028f5a8db9541dce4ddf2 Author: Johan Hovold Date: Thu Apr 9 14:04:14 2026 +0200 spi: img-spfi: fix controller deregistration Make sure to deregister the controller before disabling and releasing underlying resources like clocks and DMA during driver unbind. Fixes: deba25800a12 ("spi: Add driver for IMG SPFI controller") Cc: stable@vger.kernel.org # 3.19 Cc: Andrew Bresticker Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-16-johan@kernel.org Signed-off-by: Mark Brown commit e506a700a7ad229f5c8f01f4b8350119cccb4158 Author: Johan Hovold Date: Thu Apr 9 14:04:12 2026 +0200 spi: fsl-espi: fix controller deregistration Make sure to deregister the controller before disabling runtime PM (which can leave the controller disabled) to allow SPI device drivers to do I/O during deregistration. Fixes: e9abb4db8d10 ("spi: fsl-espi: add runtime PM") Cc: stable@vger.kernel.org # 4.3 Cc: Heiner Kallweit Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-14-johan@kernel.org Signed-off-by: Mark Brown commit f4838934b695a58eda0833583cb8028e73a19529 Author: Johan Hovold Date: Thu Apr 9 14:04:11 2026 +0200 spi: ep93xx: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind. Fixes: 011f23a3c2f2 ("spi/ep93xx: implemented driver for Cirrus EP93xx SPI controller") Cc: stable@vger.kernel.org # 2.6.35 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-13-johan@kernel.org Signed-off-by: Mark Brown commit c353020fbfa8514ee91a6de2d88de4e5edca5803 Author: Johan Hovold Date: Thu Apr 9 14:04:10 2026 +0200 spi: dln2: fix controller deregistration Make sure to deregister the controller before disabling it to allow SPI device drivers to do I/O during deregistration. Fixes: 3d8c0d749da3 ("spi: add support for DLN-2 USB-SPI adapter") Cc: stable@vger.kernel.org # 4.0 Cc: Laurentiu Palcu Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-12-johan@kernel.org Signed-off-by: Mark Brown commit e7c510e192ff2a1264d999575eea39a506424264 Author: Johan Hovold Date: Thu Apr 9 14:04:09 2026 +0200 spi: coldfire-qspi: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks (via runtime pm) during driver unbind. Fixes: 34b8c6617366 ("spi: Add Freescale/Motorola Coldfire QSPI driver") Cc: stable@vger.kernel.org # 2.6.34 Cc: Steven King Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-11-johan@kernel.org Signed-off-by: Mark Brown commit dbb6b01267c0c866eaac4019cec19f414beec61d Author: Johan Hovold Date: Thu Apr 9 14:04:08 2026 +0200 spi: cavium-thunderx: fix controller deregistration Make sure to deregister the controller before disabling it to avoid hanging or leaking resources associated with the queue when the queue non-empty. Fixes: 7347a6c7af8d ("spi: octeon: Add ThunderX driver") Cc: stable@vger.kernel.org # 4.9 Cc: Jan Glauber Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-10-johan@kernel.org Signed-off-by: Mark Brown commit 3c49a4d8799bee423a80f392ba95b26af8e9ab91 Author: Johan Hovold Date: Thu Apr 9 14:04:07 2026 +0200 spi: octeon: fix controller deregistration Make sure to deregister the controller before disabling it to avoid hanging or leaking resources associated with the queue when the queue is non-empty. Fixes: 22ad2d8df77d ("spi: octeon: use devm_spi_register_master()") Cc: stable@vger.kernel.org # 3.13 Cc: Jingoo Han Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-9-johan@kernel.org Signed-off-by: Mark Brown commit c3d97c3320b9a1ebbd6119857341be034f7b3efc Author: Johan Hovold Date: Thu Apr 9 14:04:06 2026 +0200 spi: bcmbca-hsspi: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like interrupts during driver unbind to allow SPI drivers to do I/O during deregistration. Note that clocks were also disabled before the recent commit e532e21a246d ("spi: bcm63xx-hsspi: Simplify clock handling with devm_clk_get_enabled()"). Fixes: a38a2233f23b ("spi: bcmbca-hsspi: Add driver for newer HSSPI controller") Cc: stable@vger.kernel.org # 6.3: deb269e0394f Cc: stable@vger.kernel.org # 6.3 Cc: William Zhang Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-8-johan@kernel.org Signed-off-by: Mark Brown commit ab837c51899d7595c1165a45dfb631facad49461 Author: Johan Hovold Date: Thu Apr 9 14:04:05 2026 +0200 spi: bcm63xx-hsspi: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like interrupts during driver unbind to allow SPI drivers to do I/O during deregistration. Note that clocks were also disabled before the recent commit e532e21a246d ("spi: bcm63xx-hsspi: Simplify clock handling with devm_clk_get_enabled()"). Fixes: 7d255695804f ("spi/bcm63xx-hsspi: use devm_register_master()") Cc: stable@vger.kernel.org # 3.14 Cc: Jonas Gorski Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-7-johan@kernel.org Signed-off-by: Mark Brown commit c39e65a4e3b8e764efed0b2f5152a1a8547b80fd Author: Johan Hovold Date: Thu Apr 9 14:04:04 2026 +0200 spi: bcm63xx: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver") Cc: stable@vger.kernel.org # 3.4 Cc: Florian Fainelli Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-6-johan@kernel.org Signed-off-by: Mark Brown commit 8d4de97e83520be89d0ff40610ca633b3963a7de Author: Johan Hovold Date: Thu Apr 9 14:04:03 2026 +0200 spi: atmel: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: 754ce4f29937 ("[PATCH] SPI: atmel_spi driver") Cc: stable@vger.kernel.org # 2.6.21 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-5-johan@kernel.org Signed-off-by: Mark Brown commit 9acecc9bcff058eaef40fd7a4c3650e88b06b220 Author: Johan Hovold Date: Thu Apr 9 14:04:02 2026 +0200 spi: at91-usart: fix controller deregistration Make sure to deregister the controller before disabling and releasing underlying resources like clocks and DMA during driver unbind. Fixes: e1892546ff66 ("spi: at91-usart: Add driver for at91-usart as SPI") Cc: stable@vger.kernel.org # 4.20 Cc: Radu Pirea Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-4-johan@kernel.org Signed-off-by: Mark Brown commit 1044e5a4ccd57bf5a64f90100a321b498e0267a2 Author: Johan Hovold Date: Thu Apr 9 14:04:01 2026 +0200 spi: aspeed-smc: fix controller deregistration Make sure to deregister the controller before disabling it to allow SPI device drivers to do I/O during deregistration. Fixes: e3228ed92893 ("spi: spi-mem: Convert Aspeed SMC driver to spi-mem") Cc: stable@vger.kernel.org # 5.19 Cc: Cédric Le Goater Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-3-johan@kernel.org Signed-off-by: Mark Brown commit 84d31bb1f6256eea0db6cf64a3c7a53145f92bb9 Author: Johan Hovold Date: Thu Apr 9 14:04:00 2026 +0200 spi: amlogic-spisg: fix controller deregistration Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: cef9991e04ae ("spi: Add Amlogic SPISG driver") Cc: stable@vger.kernel.org # 6.17: b8db95529979 Cc: stable@vger.kernel.org # 6.17 Cc: Sunny Luo Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120419.388546-2-johan@kernel.org Signed-off-by: Mark Brown commit bc0932cf9b9917e826871db947398aa2b62789b2 Author: Sean Christopherson Date: Tue Mar 10 16:48:29 2026 -0700 KVM: SEV: Goto an existing error label if charging misc_cg for an ASID fails Dedup a small amount of cleanup code in SEV ASID allocation by reusing an existing error label. No functional change intended. Link: https://patch.msgid.link/20260310234829.2608037-22-seanjc@google.com Signed-off-by: Sean Christopherson commit 1d353dae3d33bf22fba47a96b627eeb7bfe37be8 Author: Carlos López Date: Tue Mar 10 16:48:28 2026 -0700 KVM: SVM: Move lock-protected allocation of SEV ASID into a separate helper Extract the lock-protected parts of SEV ASID allocation into a new helper and opportunistically convert it to use guard() when acquiring the mutex. Preserve the goto even though it's a little odd, as it's there's a fair amount of subtlety that makes it surprisingly difficult to replicate the functionality with a loop construct, and arguably using goto yields the most readable code. No functional change intended. Signed-off-by: Carlos López [sean: move code to separate helper, rework shortlog+changelog] Link: https://patch.msgid.link/20260310234829.2608037-21-seanjc@google.com Signed-off-by: Sean Christopherson commit f09b7f4af9bb8a0e4f219bb2ed6af25b8baa8be3 Author: Carlos López Date: Tue Mar 10 16:48:27 2026 -0700 KVM: SEV: use mutex guard in snp_handle_guest_req() Simplify the error paths in snp_handle_guest_req() by using a mutex guard, allowing early return instead of using gotos. Signed-off-by: Carlos López Link: https://patch.msgid.link/20260120201013.3931334-8-clopez@suse.de Link: https://patch.msgid.link/20260310234829.2608037-20-seanjc@google.com Signed-off-by: Sean Christopherson commit 84841f3941d7e837b23852e966c7bd4f4d6b62e6 Author: Carlos López Date: Tue Mar 10 16:48:26 2026 -0700 KVM: SEV: use mutex guard in sev_mem_enc_unregister_region() Simplify the error paths in sev_mem_enc_unregister_region() by using a mutex guard, allowing early return instead of using gotos. Signed-off-by: Carlos López Link: https://patch.msgid.link/20260120201013.3931334-7-clopez@suse.de Link: https://patch.msgid.link/20260310234829.2608037-19-seanjc@google.com Signed-off-by: Sean Christopherson commit 63e56d8425a71e20789f68c533f5615a9e7d43cc Author: Carlos López Date: Tue Mar 10 16:48:25 2026 -0700 KVM: SEV: use mutex guard in sev_mem_enc_ioctl() Simplify the error paths in sev_mem_enc_ioctl() by using a mutex guard, allowing early return instead of using gotos. Signed-off-by: Carlos López Link: https://patch.msgid.link/20260120201013.3931334-5-clopez@suse.de Link: https://patch.msgid.link/20260310234829.2608037-18-seanjc@google.com Signed-off-by: Sean Christopherson commit 04d77ded6407199d7a6964fa8a74bd93e568b763 Author: Carlos López Date: Tue Mar 10 16:48:24 2026 -0700 KVM: SEV: use mutex guard in snp_launch_update() Simplify the error paths in snp_launch_update() by using a mutex guard, allowing early return instead of using gotos. Signed-off-by: Carlos López Link: https://patch.msgid.link/20260120201013.3931334-4-clopez@suse.de Link: https://patch.msgid.link/20260310234829.2608037-17-seanjc@google.com Signed-off-by: Sean Christopherson commit ba903f7382490776d2df2fca6bf5c8ef2eb4663f Author: Sean Christopherson Date: Tue Mar 10 16:48:23 2026 -0700 KVM: SEV: Assert that kvm->lock is held when querying SEV+ support Assert that kvm->lock is held when checking if a VM is an SEV+ VM, as KVM sets *and* resets the relevant flags when initialization SEV state, i.e. it's extremely easy to end up with TOCTOU bugs if kvm->lock isn't held. Add waivers for a VM being torn down (refcount is '0') and for there being a loaded vCPU, with comments for both explaining why they're safe. Note, the "vCPU loaded" waiver is necessary to avoid splats on the SNP checks in sev_gmem_prepare() and sev_gmem_max_mapping_level(), which are currently called when handling nested page faults. Alternatively, those checks could key off KVM_X86_SNP_VM, as kvm_arch.vm_type is stable early in VM creation. Prioritize consistency, at least for now, and to leave a "reminder" that the max mapping level code in particular likely needs special attention if/when KVM supports dirty logging for SNP guests. Link: https://patch.msgid.link/20260310234829.2608037-16-seanjc@google.com Signed-off-by: Sean Christopherson commit 2f34d421e8f041cf831b26a7596dc38336062d24 Author: Sean Christopherson Date: Tue Mar 10 16:48:22 2026 -0700 KVM: SEV: Document that checking for SEV+ guests when reclaiming memory is "safe" Document that the check for an SEV+ guest when reclaiming guest memory is safe even though kvm->lock isn't held. This will allow asserting that kvm->lock is held in the SEV accessors, without triggering false positives on the "safe" cases. No functional change intended. Link: https://patch.msgid.link/20260310234829.2608037-15-seanjc@google.com Signed-off-by: Sean Christopherson commit 85d2243a21122b9be328152b9e0a0a64625b7016 Author: Sean Christopherson Date: Tue Mar 10 16:48:21 2026 -0700 KVM: SEV: Hide "struct kvm_sev_info" behind CONFIG_KVM_AMD_SEV=y Bury "struct kvm_sev_info" behind CONFIG_KVM_AMD_SEV=y to make it harder for SEV specific code to sneak into common SVM code. No functional change intended. Link: https://patch.msgid.link/20260310234829.2608037-14-seanjc@google.com Signed-off-by: Sean Christopherson commit 4f67cf7e7e756436d2a525ac6743711e598573c4 Author: Sean Christopherson Date: Tue Mar 10 16:48:20 2026 -0700 KVM: SEV: WARN on unhandled VM type when initializing VM WARN if KVM encounters an unhandled VM type when setting up flags for SEV+ VMs, e.g. to guard against adding a new flavor of SEV without adding proper recognition in sev_vm_init(). Practically speaking, no functional change intended (the new "default" case should be unreachable). Link: https://patch.msgid.link/20260310234829.2608037-13-seanjc@google.com Signed-off-by: Sean Christopherson commit 48c0d3c6a4a2e32c5acccd1129896b33a1f5046b Author: Johan Hovold Date: Thu Apr 9 14:08:10 2026 +0200 spi: npcm-fiu: drop unused remove callback Drop the remove callback which is unused since commit 82c4fadb0b95 ("spi: npcm-fiu: Use helper function devm_clk_get_enabled()"). The above mentioned commit also removed the last user of the platform driver data which no longer needs to be set (twice). Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409120810.388909-1-johan@kernel.org Signed-off-by: Mark Brown commit 2fa49cc884f6496a915c35621ba4da35649bf159 Author: Mikulas Patocka Date: Thu Apr 9 17:49:58 2026 +0200 dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn't check overflow, so outptr could point past the buffer end 4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number 6. With "remaining" being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally Reported-by: Tony Asleson Signed-off-by: Mikulas Patocka Reviewed-by: Bryn M. Reeves Cc: stable@vger.kernel.org commit 5bbc10c50a35490624b86f457ead53054dcd0b34 Author: Johan Hovold Date: Thu Apr 9 16:56:18 2026 +0200 spi: atcspi200: enable compile testing There seems to be nothing preventing this driver from being compile tested so enable that for wider build coverage. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260409145618.466701-1-johan@kernel.org Signed-off-by: Mark Brown commit 833011cbe663b4ab49c125e09d02c900b599e13b Author: Qinghua Zhao Date: Thu Apr 9 21:52:13 2026 +0800 ASoC: tegra: Fix spelling error 'recieved' -> 'received' Fix typo in comment where 'recieved' should be 'received'. Signed-off-by: Qinghua Zhao Link: https://patch.msgid.link/20260409135213.16558-1-zqh1630@126.com Signed-off-by: Mark Brown commit c822e308c32588a9b52edc2394303d14f675330c Merge: f4ee8a882a5603 87ceac0a98e92f Author: Mark Brown Date: Thu Apr 9 19:39:32 2026 +0100 ASoC: Yet another round of SDCA fixes Charles Keepax says: Another round of SDCA fixes a couple of fix to the IRQ cleanup from Richard, and a minor tweak to the IRQ handling from me. commit 87ceac0a98e92f4efd031b5b9ab49ab5645d1c7e Author: Charles Keepax Date: Thu Apr 9 17:43:27 2026 +0100 ASoC: SDCA: Tidy up irq_enable_flags()/sdca_irq_disable() In irq_enable_flags() and sdca_irq_disable() there is a NULL check on the interrupt data pointer, however this is just pulled from an array so can never be NULL. This was likely left over from an earlier version that looked up the data in a different way. Replace the check with checking for the IRQ itself being non-zero. Whilst here also drop the sdca_interrupt structure down into the loop within the function to better match the style of the rest of the code in this file. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260409164328.3999434-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 7936490e04733ade80d0d445529c0a6de0f95515 Author: Richard Fitzgerald Date: Thu Apr 9 17:43:26 2026 +0100 ASoC: SDCA: Fix cleanup inversion in class driver Fix inverted cleanup of the SoundWire IRQ and the function drivers that use it. The devm cleanup function to call sdca_dev_unregister_functions() was being registered at the end of class_sdw_probe(). The bus core creates the parent SoundWire IRQ handler after class_sdw_probe() has returned, and it registers a devm cleanup handler at the same time. This led to a cleanup inversion where the devm cleanup for the parent Soundwire IRQ runs before the handler that removes the function drivers. So the parent IRQ is destroyed before the function drivers had a chance to do any cleanup and remove their IRQ handlers. Move the registrations of the function driver cleanup into class_boot_work() after the function drivers are registered, so that it runs before the cleanup of the parent SoundWire IRQ handler. Fixes: 2d877d0659cb ("ASoC: SDCA: Add basic SDCA class driver") Signed-off-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260409164328.3999434-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit c271b0815f45078342bc4e778683c86fdc45fde7 Author: Charles Keepax Date: Thu Apr 9 17:43:25 2026 +0100 ASoC: SDCA: Correct kernel doc for sdca_irq_cleanup() Fix typo of function argument name in the kernel doc. Fixes: 0b8757b220f9 ("ASoC: SDCA: Unregister IRQ handlers on module remove") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604090800.koxM6j6O-lkp@intel.com/ Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260409164328.3999434-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 988ef706cdd8a72e61dd90c0d0554eec4df7594a Author: Yao Zi Date: Sun Apr 5 15:41:54 2026 +0000 PCI: sg2042: Avoid L0s and L1 on Sophgo 2042 PCIe Root Ports Since commit f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") force enables ASPM on all device tree platforms, the SG2042 Root Ports are breaking as they advertise L0s and L1 capabilities without supporting them. Set ASPM quirks to disable the L0s and L1 capabilities for the Root Ports so that these broken link states won't be enabled. Fixes: 4e27aca4881a ("riscv: sophgo: dts: add PCIe controllers for SG2042") Co-developed-by: Inochi Amaoto Signed-off-by: Inochi Amaoto Signed-off-by: Yao Zi [mani: commit log] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Han Gao Tested-by: Chen Wang # Pioneerbox Reviewed-by: Chen Wang Link: https://patch.msgid.link/20260405154154.46829-3-me@ziyao.cc commit 5ccc76a87f1ec2422811e61be44165bfc9e7cf54 Author: Yao Zi Date: Sun Apr 5 15:41:53 2026 +0000 PCI: cadence: Add flags for disabling ASPM capability for broken Root Ports Add flags for disabling the ASPM L0s/L1 capability for broken Root Ports by clearing the corresponding bits in Link Capabilities Register through the local management bus. This allows ASPM to be disabled on platforms which don't support it. Signed-off-by: Yao Zi Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Han Gao Tested-by: Chen Wang # Pioneerbox Reviewed-by: Chen Wang Link: https://patch.msgid.link/20260405154154.46829-2-me@ziyao.cc commit 249bf9733198fe0527542ba6acf4bd8f12b7e5fc Author: Muhammad Usama Anjum Date: Wed Mar 11 17:50:50 2026 +0000 arm64: mte: Skip TFSR_EL1 checks and barriers in synchronous tag check mode With KASAN_HW_TAGS (MTE) in synchronous mode, tag check faults are reported as immediate Data Abort exceptions. The TFSR_EL1.TF1 bit is never set since faults never go through the asynchronous path. Therefore, reading TFSR_EL1 and executing data and instruction barriers on kernel entry, exit, context switch and suspend is unnecessary overhead. As with the check_mte_async_tcf and clear_mte_async_tcf paths for TFSRE0_EL1, extend the same optimisation to kernel entry/exit, context switch and suspend. All mte kselftests pass. The kunit before and after the patch show same results. A selection of test_vmalloc benchmarks running on a arm64 machine. v6.19 is the baseline. (>0 is faster, <0 is slower, (R)/(I) = statistically significant Regression/Improvement). Based on significance and ignoring the noise, the benchmarks improved. * 77 result classes were considered, with 9 wins, 0 losses and 68 ties Results of fastpath [1] on v6.19 vs this patch: +----------------------------+----------------------------------------------------------+------------+ | Benchmark | Result Class | barriers | +============================+==========================================================+============+ | micromm/fork | fork: p:1, d:10 (seconds) | (I) 2.75% | | | fork: p:512, d:10 (seconds) | 0.96% | +----------------------------+----------------------------------------------------------+------------+ | micromm/munmap | munmap: p:1, d:10 (seconds) | -1.78% | | | munmap: p:512, d:10 (seconds) | 5.02% | +----------------------------+----------------------------------------------------------+------------+ | micromm/vmalloc | fix_align_alloc_test: p:1, h:0, l:500000 (usec) | -0.56% | | | fix_size_alloc_test: p:1, h:0, l:500000 (usec) | 0.70% | | | fix_size_alloc_test: p:4, h:0, l:500000 (usec) | 1.18% | | | fix_size_alloc_test: p:16, h:0, l:500000 (usec) | -5.01% | | | fix_size_alloc_test: p:16, h:1, l:500000 (usec) | 13.81% | | | fix_size_alloc_test: p:64, h:0, l:100000 (usec) | 6.51% | | | fix_size_alloc_test: p:64, h:1, l:100000 (usec) | 32.87% | | | fix_size_alloc_test: p:256, h:0, l:100000 (usec) | 4.17% | | | fix_size_alloc_test: p:256, h:1, l:100000 (usec) | 8.40% | | | fix_size_alloc_test: p:512, h:0, l:100000 (usec) | -0.48% | | | fix_size_alloc_test: p:512, h:1, l:100000 (usec) | -0.74% | | | full_fit_alloc_test: p:1, h:0, l:500000 (usec) | 0.53% | | | kvfree_rcu_1_arg_vmalloc_test: p:1, h:0, l:500000 (usec) | -2.81% | | | kvfree_rcu_2_arg_vmalloc_test: p:1, h:0, l:500000 (usec) | -2.06% | | | long_busy_list_alloc_test: p:1, h:0, l:500000 (usec) | -0.56% | | | pcpu_alloc_test: p:1, h:0, l:500000 (usec) | -0.41% | | | random_size_align_alloc_test: p:1, h:0, l:500000 (usec) | 0.89% | | | random_size_alloc_test: p:1, h:0, l:500000 (usec) | 1.71% | | | vm_map_ram_test: p:1, h:0, l:500000 (usec) | 0.83% | +----------------------------+----------------------------------------------------------+------------+ | schbench/thread-contention | -m 16 -t 1 -r 10 -s 1000, avg_rps (req/sec) | 0.05% | | | -m 16 -t 1 -r 10 -s 1000, req_latency_p99 (usec) | 0.60% | | | -m 16 -t 1 -r 10 -s 1000, wakeup_latency_p99 (usec) | 0.00% | | | -m 16 -t 4 -r 10 -s 1000, avg_rps (req/sec) | -0.34% | | | -m 16 -t 4 -r 10 -s 1000, req_latency_p99 (usec) | -0.58% | | | -m 16 -t 4 -r 10 -s 1000, wakeup_latency_p99 (usec) | 9.09% | | | -m 16 -t 16 -r 10 -s 1000, avg_rps (req/sec) | -0.74% | | | -m 16 -t 16 -r 10 -s 1000, req_latency_p99 (usec) | -1.40% | | | -m 16 -t 16 -r 10 -s 1000, wakeup_latency_p99 (usec) | 0.00% | | | -m 16 -t 64 -r 10 -s 1000, avg_rps (req/sec) | -0.78% | | | -m 16 -t 64 -r 10 -s 1000, req_latency_p99 (usec) | -0.11% | | | -m 16 -t 64 -r 10 -s 1000, wakeup_latency_p99 (usec) | 0.11% | | | -m 16 -t 256 -r 10 -s 1000, avg_rps (req/sec) | 2.64% | | | -m 16 -t 256 -r 10 -s 1000, req_latency_p99 (usec) | 3.15% | | | -m 16 -t 256 -r 10 -s 1000, wakeup_latency_p99 (usec) | 17.54% | | | -m 32 -t 1 -r 10 -s 1000, avg_rps (req/sec) | -1.22% | | | -m 32 -t 1 -r 10 -s 1000, req_latency_p99 (usec) | 0.85% | | | -m 32 -t 1 -r 10 -s 1000, wakeup_latency_p99 (usec) | 0.00% | | | -m 32 -t 4 -r 10 -s 1000, avg_rps (req/sec) | -0.34% | | | -m 32 -t 4 -r 10 -s 1000, req_latency_p99 (usec) | 1.05% | | | -m 32 -t 4 -r 10 -s 1000, wakeup_latency_p99 (usec) | 0.00% | | | -m 32 -t 16 -r 10 -s 1000, avg_rps (req/sec) | -0.41% | | | -m 32 -t 16 -r 10 -s 1000, req_latency_p99 (usec) | 0.58% | | | -m 32 -t 16 -r 10 -s 1000, wakeup_latency_p99 (usec) | 2.13% | | | -m 32 -t 64 -r 10 -s 1000, avg_rps (req/sec) | 0.67% | | | -m 32 -t 64 -r 10 -s 1000, req_latency_p99 (usec) | 2.07% | | | -m 32 -t 64 -r 10 -s 1000, wakeup_latency_p99 (usec) | -1.28% | | | -m 32 -t 256 -r 10 -s 1000, avg_rps (req/sec) | 1.01% | | | -m 32 -t 256 -r 10 -s 1000, req_latency_p99 (usec) | 0.69% | | | -m 32 -t 256 -r 10 -s 1000, wakeup_latency_p99 (usec) | 13.12% | | | -m 64 -t 1 -r 10 -s 1000, avg_rps (req/sec) | -0.25% | | | -m 64 -t 1 -r 10 -s 1000, req_latency_p99 (usec) | -0.48% | | | -m 64 -t 1 -r 10 -s 1000, wakeup_latency_p99 (usec) | 10.53% | | | -m 64 -t 4 -r 10 -s 1000, avg_rps (req/sec) | -0.06% | | | -m 64 -t 4 -r 10 -s 1000, req_latency_p99 (usec) | 0.00% | | | -m 64 -t 4 -r 10 -s 1000, wakeup_latency_p99 (usec) | 0.00% | | | -m 64 -t 16 -r 10 -s 1000, avg_rps (req/sec) | -0.36% | | | -m 64 -t 16 -r 10 -s 1000, req_latency_p99 (usec) | 0.52% | | | -m 64 -t 16 -r 10 -s 1000, wakeup_latency_p99 (usec) | 0.11% | | | -m 64 -t 64 -r 10 -s 1000, avg_rps (req/sec) | 0.52% | | | -m 64 -t 64 -r 10 -s 1000, req_latency_p99 (usec) | 3.53% | | | -m 64 -t 64 -r 10 -s 1000, wakeup_latency_p99 (usec) | -0.10% | | | -m 64 -t 256 -r 10 -s 1000, avg_rps (req/sec) | 2.53% | | | -m 64 -t 256 -r 10 -s 1000, req_latency_p99 (usec) | 1.82% | | | -m 64 -t 256 -r 10 -s 1000, wakeup_latency_p99 (usec) | -5.80% | +----------------------------+----------------------------------------------------------+------------+ | syscall/getpid | mean (ns) | (I) 15.98% | | | p99 (ns) | (I) 11.11% | | | p99.9 (ns) | (I) 16.13% | +----------------------------+----------------------------------------------------------+------------+ | syscall/getppid | mean (ns) | (I) 14.82% | | | p99 (ns) | (I) 17.86% | | | p99.9 (ns) | (I) 9.09% | +----------------------------+----------------------------------------------------------+------------+ | syscall/invalid | mean (ns) | (I) 17.78% | | | p99 (ns) | (I) 11.11% | | | p99.9 (ns) | 13.33% | +----------------------------+----------------------------------------------------------+------------+ [1] https://gitlab.arm.com/tooling/fastpath Signed-off-by: Muhammad Usama Anjum Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Yeoreum Yun Signed-off-by: Catalin Marinas commit 21e161de2dc660b1bb70ef5b156ab8e6e1cca3ab Author: Junrui Luo Date: Thu Apr 9 21:59:39 2026 +0800 erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Some crafted images can have illegal (!partial_decoding && m_llen < m_plen) extents, and the LZ4 inplace decompression path can be wrongly hit, but it cannot handle (outpages < inpages) properly: "outpages - inpages" wraps to a large value and the subsequent rq->out[] access reads past the decompressed_pages array. However, such crafted cases can correctly result in a corruption report in the normal LZ4 non-inplace path. Let's add an additional check to fix this for backporting. Reproducible image (base64-encoded gzipped blob): H4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g dilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i PNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz 2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w ywAAAAAAAADwu14ATsEYtgBQAAA= $ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt $ dd if=/mnt/data of=/dev/null bs=4096 count=1 Fixes: 598162d05080 ("erofs: support decompress big pcluster for lz4 backend") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 592a22338e5acfcd10983699cae8ea02ecd42935 Author: Andy Shevchenko Date: Tue Apr 7 17:14:31 2026 +0200 bitops: Update kernel-doc for sign_extendXX() The sign_extendXX() lack of Return section and have other style issues. Address that by updating kernel-doc accordingly. Signed-off-by: Andy Shevchenko Signed-off-by: Yury Norov commit 4ff568ce3ca66573e8b97b0caaa12b971dd38ae3 Author: Yury Norov Date: Tue Mar 3 15:08:37 2026 -0500 powerpc/xive: simplify xive_spapr_debug_show() The function creates temporary buffer to convert xibm->bitmap to a human-readable list before passing it to seq_printf. Drop it and print the list by seq_printf() directly with the "%*pbl" specifier. Reviewed-by: Shrikanth Hegde Acked-by: Madhavan Srinivasan for powerpc patch Signed-off-by: Yury Norov commit f3d8bb94255117aa7b405c949277c874c1c496f0 Author: Yury Norov Date: Tue Mar 3 15:08:38 2026 -0500 thermal: intel: switch cpumask_get() to using cpumask_print_to_pagebuf() The function opencodes cpumask_print_to_pagebuf() with more generic bitmap_print_to_pagebuf(). Switch to using the proper API. Signed-off-by: Yury Norov commit 6f3aa76b3db44f93013702348c31d479931e681d Author: Yury Norov Date: Tue Mar 3 15:08:39 2026 -0500 coresight: don't use bitmap_print_to_pagebuf() Switch the driver to using the proper sysfs_emit("%*pbl") where appropriate. Suggested-by: Thomas Weißschuh Signed-off-by: Yury Norov commit 7ca1d7f939964e31fe8ecbca70d96423d511fb93 Author: Yury Norov Date: Tue Mar 3 15:08:40 2026 -0500 lib/prime_numbers: drop temporary buffer in dump_primes() The function uses temporary buffer to convert primes bitmap into human readable format. Switch to using kunit_info("%*pbl")", and drop the buffer. Signed-off-by: Yury Norov commit ac679a6e0fccab0e30ea04c97a3a0713b8b722ae Author: Yury Norov Date: Sun Mar 1 20:11:58 2026 -0500 drm/xe: switch xe_pagefault_queue_init() to using bitmap_weighted_or() The function calls bitmap_or() immediately followed by bitmap_weight(). Switch to using the dedicated bitmap_weighted_or() and save one bitmap traverse. Reviewed-by: Matthew Brost Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Signed-off-by: Yury Norov commit 82e68aa4a6b16aa060d5044116dac957631cf6f0 Author: Yury Norov Date: Sun Mar 1 20:11:57 2026 -0500 ice: use bitmap_empty() in ice_vf_has_no_qs_ena bitmap_empty() is more verbose and efficient, as it stops traversing {r,t}xq_ena as soon as the 1st set bit found. Tested-by: Rafal Romanowski Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Signed-off-by: Yury Norov commit bdeaa653aeff7316581c51507937f4f925d68cbc Author: Yury Norov Date: Sun Mar 1 20:11:56 2026 -0500 ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() Use the right helper and save one bitmaps traverse. Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Yury Norov commit e2aaf2d3ad92ac4a8afa6b69ad4c38e7747d3d6e Author: Benoît Sevens Date: Wed Apr 1 14:48:11 2026 +0000 HID: logitech-hidpp: fix race condition when accessing stale stack pointer The driver uses hidpp->send_receive_buf to point to a stack-allocated buffer in the synchronous command path (__do_hidpp_send_message_sync). However, this pointer is not cleared when the function returns. If an event is processed (e.g. by a different thread) while the send_mutex is held by a new command, but before that command has updated send_receive_buf, the handler (hidpp_raw_hidpp_event) will observe that the mutex is locked and dereference the stale pointer. This results in an out-of-bounds access on a different thread's kernel stack (or a NULL pointer dereference on the very first command). Fix this by: 1. Clearing hidpp->send_receive_buf to NULL before releasing the mutex in the synchronous command path. 2. Moving the assignment of the local 'question' and 'answer' pointers inside the mutex_is_locked() block in the handler, and adding a NULL check before dereferencing. Signed-off-by: Benoît Sevens Signed-off-by: Jiri Kosina commit a535a9217ca3f2fccedaafb2fddb4c48f27d36dc Author: Samuel Page Date: Wed Apr 8 15:30:13 2026 +0100 can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a window where raw_rcv() may still be running in an RCU read-side critical section after raw_release() frees ro->uniq, leading to a use-after-free of the percpu uniq storage. Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific socket destructor. can_rx_unregister() takes an extra reference to the socket and only drops it from the RCU callback, so freeing uniq from sk_destruct ensures the percpu area is not released until the relevant callbacks have drained. Fixes: 514ac99c64b2 ("can: fix multiple delivery of a single CAN frame for overlapping CAN filters") Cc: stable@vger.kernel.org # v4.1+ Assisted-by: Bynario AI Signed-off-by: Samuel Page Link: https://patch.msgid.link/26ec626d-cae7-4418-9782-7198864d070c@bynar.io Acked-by: Oliver Hartkopp [mkl: applied manually] Signed-off-by: Marc Kleine-Budde commit 5dd75dac1b35e5b24f5051d01fc85105adcc2e15 Author: Troy Mitchell Date: Sat Feb 7 23:08:22 2026 +0800 i2c: spacemit: introduce pio for k1 This patch introduces I2C PIO functionality for the Spacemit K1 SoC, enabling the use of I2C in atomic context. When i2c xfer_atomic is invoked, use_pio is set accordingly. Since an atomic context is required, all interrupts are disabled when operating in PIO mode. Even with interrupts disabled, the bits in the ISR (Interrupt Status Register) will still be set, so error handling can be performed by polling the relevant status bits in the ISR. Signed-off-by: Troy Mitchell Tested-by: Aurelien Jarno Reviewed-by: Aurelien Jarno Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260207-b4-k3-i2c-pio-v7-2-626942d94d91@linux.spacemit.com commit 5b74da8e6cf7e2b5aed0836c733238c0fd7235af Author: Troy Mitchell Date: Sat Feb 7 23:08:21 2026 +0800 i2c: spacemit: move i2c_xfer_msg() The upcoming PIO support requires a wait_pio_xfer() helper, which is invoked from xfer_msg(). Since wait_pio_xfer() depends on err_check(), move the definition of xfer_msg() after err_check() to avoid a forward declaration of err_check(). Reviewed-by: Aurelien Jarno Reviewed-by: Alex Elder Signed-off-by: Troy Mitchell Tested-by: Aurelien Jarno Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260207-b4-k3-i2c-pio-v7-1-626942d94d91@linux.spacemit.com commit fed4626501c871890da287bec62a96e52da1af89 Author: Johan Hovold Date: Fri Mar 27 11:45:20 2026 +0100 can: ucan: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes). Fix the control message buffer lifetime so that it is released on driver unbind. Fixes: 9f2d3eae88d2 ("can: ucan: add driver for Theobroma Systems UCAN devices") Cc: stable@vger.kernel.org # 4.19 Cc: Jakob Unterwurzacher Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260327104520.1310158-1-johan@kernel.org Signed-off-by: Marc Kleine-Budde commit 42d020b54edc57d03749bed75976f1e962a9fbfa Author: Ivan Gorinov Date: Sat Mar 7 05:22:46 2026 +0000 HID: winwing: Enable rumble effects Enable rumble motor control on TGRIP-15E and TGRIP-15EX throttle grips by sending haptic feedback commands (EV_FF events) to the input device. Signed-off-by: Ivan Gorinov Signed-off-by: Jiri Kosina commit 590204185d84635961b0ce2460784749c959a9b4 Author: Dmitry Torokhov Date: Tue Mar 31 23:04:13 2026 -0700 HID: core: do not allow parsing 0-sized reports Commit d7db259bd6df ("HID: core: factor out hid_parse_collections()") reworked collection parsing code and inadvertently allowed returning "success" when parsing 0-sized reports where old code returned -EINVAL. Restore the original behavior by doing an explicit check. Note that the error message now differs from the generic "item fetching failed at offset %u/%u" that is now used only for non-empty descriptors. Fixes: d7db259bd6df ("HID: core: factor out hid_parse_collections()") Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Kosina commit 2fcc5e0ee7989154c4a5d169bcc9565cf2d62147 Author: Johan Hovold Date: Mon Mar 30 11:50:34 2026 +0200 HID: usbhid: refactor endpoint lookup Use the common USB helper for looking up interrupt-in endpoints instead of open coding. Signed-off-by: Johan Hovold Signed-off-by: Jiri Kosina commit e93faaca84b73431ccef029b2c8e902e5be83006 Author: Miao Li Date: Wed Mar 18 17:12:49 2026 +0800 HID: huawei: fix CD30 keyboard report descriptor issue When the Huawei CD30 USB keyboard undergoes 500 reboot cycles, initialization may fail due to a report descriptor problem. The error log is as follows: [pid:175,cpu0,kworker/0:1,6]usb 1-1.2.2: new low-speed USB device number 6 using xhci-hcd [pid:175,cpu0,kworker/0:1,9]usb 1-1.2.2: New USB device found, idVendor=12d1, idProduct=109b, bcdDevice= 1.03 [pid:175,cpu0,kworker/0:1,0]usb 1-1.2.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [pid:175,cpu0,kworker/0:1,1]usb 1-1.2.2: Product: HUAWEI USB Wired Keyboard [pid:175,cpu0,kworker/0:1,2]usb 1-1.2.2: Manufacturer: HUAWEI [pid:175,cpu0,kworker/0:1,4]input: HUAWEI HUAWEI USB Wired Keyboard as /devices/platform/efc00000.hisi_usb/efc00000.dwc3/xhci-hcd.1.auto/usb1/1-1/1-1.2/1-1.2.2/1-1.2.2:1.0/0003:12D1:109B.0002/input/input6 [pid:175,cpu0,kworker/0:1,5]hid-generic 0003:12D1:109B.0002: input,hidraw1: USB HID v1.10 Keyboard [HUAWEI HUAWEI USB Wired Keyboard] on usb-xhci-hcd.1.auto-1.2.2/input0 [pid:175,cpu0,kworker/0:1,9]hid-generic 0003:12D1:109B.0003: collection stack underflow [pid:175,cpu0,kworker/0:1,0]hid-generic 0003:12D1:109B.0003: item 0 0 0 12 parsing failed [pid:175,cpu0,kworker/0:1,1]hid-generic: probe of 0003:12D1:109B.0003 failed with error -22 ... When encountering such a situation, fix it with the correct report descriptor. Signed-off-by: Miao Li Signed-off-by: Jiri Kosina commit 82a4fc46330910b4c1d9b189561439d468e3ff11 Author: Benoît Sevens Date: Mon Mar 23 12:47:37 2026 +0000 HID: playstation: validate num_touch_reports in DualShock 4 reports The DualShock 4 HID driver fails to validate the num_touch_reports field received from the device in both USB and Bluetooth input reports. A malicious device could set this field to a value larger than the allocated size of the touch_reports array (3 for USB, 4 for Bluetooth), leading to an out-of-bounds read in dualshock4_parse_report(). This can result in kernel memory disclosure when processing malicious HID reports. Validate num_touch_reports against the array size for the respective connection types before processing the touch data. Signed-off-by: Benoît Sevens Signed-off-by: Jiri Kosina commit 3d39be2a76d1dfed9ab74305bb5bb107a7d7ce67 Author: Thomas Weißschuh Date: Sat Mar 21 14:15:45 2026 +0100 HID: drop 'default !EXPERT' from tristate symbols There is no reason to build random drivers for obscure hardware into the core kernel by default. The usages of 'default !EXPERT' for the HID_PICOLCD suboptions are kept, as these make some sense, although they probably should use 'default y'. Signed-off-by: Thomas Weißschuh Signed-off-by: Jiri Kosina commit 6546a49bbe656981d99a389195560999058c89c4 Author: Shawn Lin Date: Wed Apr 8 15:18:49 2026 +0800 mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration According to the ASIC design recommendations, the clock must be disabled before operating the DLL to prevent glitches that could affect the internal digital logic. In extreme cases, failing to do so may cause the controller to malfunction completely. Adds a step to disable the clock before DLL configuration and re-enables it at the end. Fixes: 08f3dff799d4 ("mmc: sdhci-of-dwcmshc: add rockchip platform support") Cc: stable@vger.kernel.org Signed-off-by: Shawn Lin Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 873cc5560804f5270b1670f8bed4d55400343cf5 Author: Hans Zhang <18255117159@163.com> Date: Tue Apr 7 09:40:33 2026 +0800 mmc: core: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to simplify the code, but also to ensure the device node reference is automatically released when the loop scope ends. Signed-off-by: Hans Zhang <18255117159@163.com> Reviewed-by: Shawn Lin Signed-off-by: Ulf Hansson commit 306736fd515565c6c4787dc55aba890ebce2dc45 Author: Mark Brown Date: Mon Mar 2 22:53:21 2026 +0000 arm64/sysreg: Update ID_AA64SMFR0_EL1 description to DDI0601 2025-12 The 2025 extensions add FEAT_SME2P3, including LUT6. Signed-off-by: Mark Brown Signed-off-by: Catalin Marinas commit bf56250f34a40d83252e1cbc3b41955df7dc11b1 Author: Mark Brown Date: Mon Mar 2 22:53:20 2026 +0000 arm64/sysreg: Update ID_AA64ZFR0_EL1 description to DDI0601 2025-12 The 2025 extensions add FEAT_SVE2P3 and FEAT_SVE_B16MM. Signed-off-by: Mark Brown Signed-off-by: Catalin Marinas commit d74576b51ba6d3a7f1f321b57ad8736f73a5074d Author: Mark Brown Date: Mon Mar 2 22:53:19 2026 +0000 arm64/sysreg: Update ID_AA64FPFR0_EL1 description to DDI0601 2025-12 The 2025 extensions add FEAT_F16MM and adjust some of the RES0 bits to be RAZ instead as a placeholder for future extensions. Signed-off-by: Mark Brown Signed-off-by: Catalin Marinas commit bb5e1e540501f068f888dca8951128d682f5ff44 Author: Mark Brown Date: Mon Mar 2 22:53:18 2026 +0000 arm64/sysreg: Update ID_AA64ISAR2_EL1 description to DDI0601 2025-12 The 2025 extensions update the LUT field for new instructions added by SVE and SME 2.3, there is no separate FEAT_ feature for these. Signed-off-by: Mark Brown Signed-off-by: Catalin Marinas commit b964aa8d68f7705932357483d35d82067bd755c3 Author: Mark Brown Date: Mon Mar 2 22:53:17 2026 +0000 arm64/sysreg: Update ID_AA64ISAR0_EL1 description to DDI0601 2025-12 The 2025 extensions add FEAT_F16F32DOT and FEAT_F16F32MM. Signed-off-by: Mark Brown Signed-off-by: Catalin Marinas commit abed23c3c44f565dc812563ac015be70dd61e97b Author: Mark Brown Date: Mon Mar 2 22:53:16 2026 +0000 arm64/hwcap: Generate the KERNEL_HWCAP_ definitions for the hwcaps Currently for each hwcap we define both the HWCAPn_NAME definition which is exposed to userspace and a kernel internal KERNEL_HWCAP_NAME definition which we use internally. This is tedious and repetitive, instead use a script to generate the KERNEL_HWCAP_ definitions from the UAPI definitions. No functional changes intended. Signed-off-by: Mark Brown Signed-off-by: Catalin Marinas commit 5fa0e32ed4f4a8a62998d0c955311cbfe92919af Author: Bin Liu Date: Thu Apr 2 07:31:55 2026 -0500 mmc: core: Optimize size of struct mmc_queue_req ioc_count won't be more than MMC_IOC_MAX_CMDS (255), retries won't be more than MMC_NO_RETRIES (6), flags is newly introduced and uses only 1 bit. Therefore let's change them all to become u8. Signed-off-by: Bin Liu Signed-off-by: Ulf Hansson commit 8df2c1b47ee3cd50fd454f75c7a7e2ae8a6adf72 Author: Oliver Neukum Date: Tue Mar 24 15:24:54 2026 +0100 HID: usbhid: fix deadlock in hid_post_reset() You can build a USB device that includes a HID component and a storage or UAS component. The components can be reset only together. That means that hid_pre_reset() and hid_post_reset() are in the block IO error handling. Hence no memory allocation used in them may do block IO because the IO can deadlock on the mutex held while resetting a device and calling the interface drivers. Use GFP_NOIO for all allocations in them. Fixes: dc3c78e434690 ("HID: usbhid: Check HID report descriptor contents after device reset") Signed-off-by: Oliver Neukum Signed-off-by: Jiri Kosina commit 654a27f25530d052eeedf086e6c3e2d585c203bd Author: Kai Zen Date: Tue Apr 7 12:20:22 2026 +0300 RDMA/ionic: bound node_desc sysfs read with %.64s node_desc[64] in struct ib_device is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason (drivers/infiniband/core/sysfs.c:1307), since node_desc_store() performs a raw memcpy of up to IB_DEVICE_NODE_DESC_MAX bytes with no NUL termination: memcpy(desc.node_desc, buf, min_t(int, count, IB_DEVICE_NODE_DESC_MAX)); If exactly 64 bytes are written via the node_desc sysfs file, the array contains no NUL byte. The ionic hca_type_show() handler uses unbounded "%s" and will read past the end of node_desc into adjacent fields of struct ib_device until it encounters a NUL. ionic supports IB_DEVICE_MODIFY_NODE_DESC, so this is triggerable by userspace. Match the core handler and bound the format specifier. Cc: stable@vger.kernel.org Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality") Link: https://patch.msgid.link/r/CALynFi7NAbhDCt1tdaDbf6TnLvAqbaHa6-Wqf6OkzREbA_PAfg@mail.gmail.com Signed-off-by: Kai Aizen Signed-off-by: Jason Gunthorpe commit 1f95a6cd5ad78ed27a31a20cbd1facff6f10b33d Author: Aditya Garg Date: Sat Apr 4 15:14:34 2026 +0530 HID: apple: ensure the keyboard backlight is off if suspending Some users reported that upon suspending their keyboard backlight remained on. Fix this by adding the missing LED_CORE_SUSPENDRESUME flag. Cc: stable@vger.kernel.org Fixes: 394ba612f941 ("HID: apple: Add support for magic keyboard backlight on T2 Macs") Fixes: 9018eacbe623 ("HID: apple: Add support for keyboard backlight on certain T2 Macs.") Reported-by: André Eikmeyer Tested-by: André Eikmeyer Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit d4229fc0cb50c52b385538d072c5fc8827b287a9 Author: Nícolas F. R. A. Prado Date: Tue Apr 7 16:59:28 2026 -0400 HID: quirks: Set ALWAYS_POLL for LOGITECH_BOLT_RECEIVER The Logitech Bolt receiver once connected to a wireless device will generate data on interface 2. If this data isn't polled, when the USB port it is connected to gets suspended (and if that happens within 5 minutes of the last input from the wireless device), it will trigger a remote wakeup 3 seconds later, which will result in a spurious system wakeup if the port was suspended as part of system sleep. Set the ALWAYS_POLL quirk for this device to ensure interface 2 is always polled and this spurious wakeup never happens. With this change in place the system can be suspended with the receiver plugged in and the system can be woken up when an input is sent from the wireless device. Signed-off-by: Nícolas F. R. A. Prado Signed-off-by: Jiri Kosina commit 1badfc4319224820d5d890f8eab6aa52e4e83339 Author: Greg Kroah-Hartman Date: Mon Apr 6 16:03:25 2026 +0200 HID: alps: fix NULL pointer dereference in alps_raw_event() Commit ecfa6f34492c ("HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them") attempted to fix up the HID drivers that had missed the previous fix that was done in 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at raw event handle"), but the alps driver was missed. Fix this up by properly checking in the hid-alps driver that it had been claimed correctly before attempting to process the raw event. Fixes: 73196ebe134d ("HID: alps: add support for Alps T4 Touchpad device") Cc: stable Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: Masaki Ota Cc: linux-input@vger.kernel.org Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Signed-off-by: Jiri Kosina commit b6a57912854e7ea36f3b270032661140cc4209cd Author: Lee Jones Date: Tue Mar 24 14:36:44 2026 +0000 HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write logi_dj_recv_send_report() assumes that all incoming REPORT_ID_DJ_SHORT reports are 14 Bytes (DJREPORT_SHORT_LENGTH - 1) long. It uses that assumption to load the associated field's 'value' array with 14 Bytes of data. However, if a malicious user only sends say 1 Byte of data, 'report_count' will be 1 and only 1 Byte of memory will be allocated to the 'value' Byte array. When we come to populate 'value[1-13]' we will experience an OOB write. Signed-off-by: Lee Jones Signed-off-by: Jiri Kosina commit a940aee176437046598dfc786b719bd96db3c74c Author: Lee Jones Date: Tue Mar 24 14:36:43 2026 +0000 HID: logitech-dj: Standardise hid_report_enum variable nomenclature Since we will need to differentiate between the two report_enum types soon, let's unify the naming conventions now to save confusion and/or unnecessary/unrelated changes in upcoming commits. {input,output}_report_enum is used in other places to let's conform. Signed-off-by: Lee Jones Signed-off-by: Jiri Kosina commit de80aa182d6ca1eb7ad41fa46d9ec7bb685850db Author: Rosalie Wanders Date: Thu Apr 2 17:59:15 2026 +0200 HID: sony: update module description This commit updates the hid-sony module description to make it correct with the recent hid-sony changes alongside making it more consistent. Signed-off-by: Rosalie Wanders Signed-off-by: Jiri Kosina commit e606d8329be1e19b7eb3e0c6c72a73cbbb25ae3d Author: Günther Noack Date: Tue Mar 31 09:40:51 2026 +0200 HID: logitech-hidpp: Check bounds when deleting force-feedback effects Without this bounds check, this might otherwise overwrite index -1. Triggering this condition requires action both from the USB device and from userspace, which reduces the scenarios in which it can be exploited. Cc: Lee Jones Signed-off-by: Günther Noack Reviewed-by: Lee Jones Signed-off-by: Jiri Kosina commit 5e6de34d82b49cab9d8a42063e9cd0f22a4f31e5 Author: Chen Zhao Date: Sun Apr 5 18:44:55 2026 +0300 IB/core: Fix zero dmac race in neighbor resolution dst_fetch_ha() checks nud_state without holding the neighbor lock, then copies ha under the seqlock. A race in __neigh_update() where nud_state is set to NUD_REACHABLE before ha is written allows dst_fetch_ha() to read a zero MAC address while the seqlock reports no concurrent writer. netevent_callback amplifies this by waking ALL pending addr_req workers when ANY neighbor becomes NUD_VALID. At scale (N peers resolving ARP concurrently), the hit probability scales as N^2, making it near-certain for large RDMA workloads. N(A): neigh_update(A) W(A): addr_resolve(A) | [sleep] | write_lock_bh(&A->lock) | | A->nud_state = NUD_REACHABLE | | // A->ha is still 0 | | [woken by netevent_cb() of | another neighbour] | | dst_fetch_ha(A) | | A->nud_state & NUD_VALID | | read_seqbegin(&A->ha_lock) | | snapshot = A->ha /* 0 */ | | read_seqretry(&A->ha_lock) | | return snapshot | seqlock(&A->ha_lock) | A->ha = mac_A /* too late */ | sequnlock(&A->ha_lock) | write_unlock_bh(&A->lock) The incorrect/zero mac is read and programmed in the device QP while it was not yet updated. This causes silent packet loss and eventual RETRY_EXC_ERR. Fix by holding the neighbor read lock across the nud_state check and ha copy in dst_fetch_ha(), ensuring it synchronizes with __neigh_update() which is updating while holding the write lock. Cc: stable@vger.kernel.org Fixes: 92ebb6a0a13a ("IB/cm: Remove now useless rcu_lock in dst_fetch_ha") Link: https://patch.msgid.link/r/20260405-fix-dmac-race-v1-1-cfa1ec2ce54a@nvidia.com Signed-off-by: Chen Zhao Reviewed-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 259e3e6f9382b6a9fe570313d97c59a233f7d72f Author: Ard Biesheuvel Date: Wed Feb 25 12:03:04 2026 +0100 efi: Tag memblock reservations of boot services regions as RSRV_KERN By definition, EFI memory regions of type boot services code or data have no special significance to the firmware at runtime, only to the OS. In some cases, the firmware will allocate tables and other assets that are passed in memory in regions of this type, and leave it up to the OS to decide whether or not to treat the allocation as special, or simply consume the contents at boot and recycle the RAM for ordinary use. The reason for this approach is that it avoids needless memory reservations for assets that the OS knows nothing about, and therefore doesn't know how to free either. This means that any memblock reservations covering such regions can be marked as MEMBLOCK_RSRV_KERN - this is a better match semantically, and is useful on x86 to distinguish true reservations from temporary reservations that are only needed to work around firmware bugs. Acked-by: Mike Rapoport (Microsoft) Signed-off-by: Ard Biesheuvel commit a142d0ae9f2ceb0fc7417e19ecfafc8179282e35 Author: Ard Biesheuvel Date: Wed Feb 25 13:39:48 2026 +0100 memblock: Permit existing reserved regions to be marked RSRV_KERN Permit existing memblock reservations to be marked as RSRV_KERN. This will be used by the EFI code on x86 to distinguish between reservations of boot services data regions that have actual significance to the kernel and regions that are reserved temporarily to work around buggy firmware. Acked-by: Mike Rapoport (Microsoft) Signed-off-by: Ard Biesheuvel commit 4edafa81a1d6020272d0c6eb68faeb810dd083c1 Author: Li Chen Date: Fri Mar 6 16:56:42 2026 +0800 jbd2: store jinode dirty range in PAGE_SIZE units jbd2_inode fields are updated under journal->j_list_lock, but some paths read them without holding the lock (e.g. fast commit helpers and ordered truncate helpers). READ_ONCE() alone is not sufficient for the dirty range fields when they are stored as loff_t because 32-bit platforms can observe torn loads. Store the dirty range in PAGE_SIZE units as pgoff_t instead. Represent the dirty range end as an exclusive end page. This avoids a special sentinel value and keeps MAX_LFS_FILESIZE on 32-bit representable. Publish a new dirty range by updating end_page before start_page, and treat start_page >= end_page as empty in the accessor for robustness. Use READ_ONCE() on the read side and WRITE_ONCE() on the write side for the dirty range and i_flags to match the existing lockless access pattern. Suggested-by: Jan Kara Reviewed-by: Jan Kara Signed-off-by: Li Chen Link: https://patch.msgid.link/20260306085643.465275-5-me@linux.beauty Signed-off-by: Theodore Ts'o commit be81084e032c2d74f51173e30f687ce13476cb73 Author: Li Chen Date: Fri Mar 6 16:56:41 2026 +0800 ocfs2: use jbd2 jinode dirty range accessor ocfs2 journal commit callback reads jbd2_inode dirty range fields without holding journal->j_list_lock. Use jbd2_jinode_get_dirty_range() to get the range in bytes. Suggested-by: Jan Kara Reviewed-by: Jan Kara Signed-off-by: Li Chen Link: https://patch.msgid.link/20260306085643.465275-4-me@linux.beauty Signed-off-by: Theodore Ts'o commit 660d23669982202c99798658e2a15ccdd001f82b Author: Li Chen Date: Fri Mar 6 16:56:40 2026 +0800 ext4: use jbd2 jinode dirty range accessor ext4 journal commit callbacks access jbd2_inode dirty range fields without holding journal->j_list_lock. Use jbd2_jinode_get_dirty_range() to get the range in bytes, and read i_transaction with READ_ONCE() in the redirty check. Suggested-by: Jan Kara Reviewed-by: Jan Kara Signed-off-by: Li Chen Link: https://patch.msgid.link/20260306085643.465275-3-me@linux.beauty Signed-off-by: Theodore Ts'o commit 5267f6ef49cb5fba426f2d286817b1355fde31da Author: Li Chen Date: Fri Mar 6 16:56:39 2026 +0800 jbd2: add jinode dirty range accessors Provide a helper to fetch jinode dirty ranges in bytes. This lets filesystem callbacks avoid depending on the internal representation, preparing for a later conversion to page units. Suggested-by: Andreas Dilger Reviewed-by: Jan Kara Signed-off-by: Li Chen Link: https://patch.msgid.link/20260306085643.465275-2-me@linux.beauty Signed-off-by: Theodore Ts'o commit 1eab6493f525910aa7bc383a2a27b68916e3c616 Author: Steven Rostedt Date: Mon Jan 26 18:17:42 2026 -0500 tracing: Documentation: Update histogram-design.rst for fn() handling The histogram documentation describes the old method of the histogram triggers using the fn() field of the histogram field structure to process the field. But due to Spectre mitigation, the function pointer to handle the fields at runtime caused a noticeable overhead. It was converted over to a fn_num and hist_fn_call() is now used to call the specific functions for the fields via a switch statement based on the field's fn_num value. Update the documentation to reflect this change. Signed-off-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20260126181742.03e8f0d5@gandalf.local.home> commit f7fc28b014ebb00796f99f12f0583caab23276e3 Author: Milos Nikic Date: Wed Mar 4 09:20:16 2026 -0800 jbd2: gracefully abort on transaction state corruptions Auditing the jbd2 codebase reveals several legacy J_ASSERT calls that enforce internal state machine invariants (e.g., verifying jh->b_transaction or jh->b_next_transaction pointers). When these invariants are broken, the journal is in a corrupted state. However, triggering a fatal panic brings down the entire system for a localized filesystem error. This patch targets a specific class of these asserts: those residing inside functions that natively return integer error codes, booleans, or error pointers. It replaces the hard J_ASSERTs with WARN_ON_ONCE to capture the offending stack trace, safely drops any held locks, gracefully aborts the journal, and returns -EINVAL. This prevents a catastrophic kernel panic while ensuring the corrupted journal state is safely contained and upstream callers (like ext4 or ocfs2) can gracefully handle the aborted handle. Functions modified in fs/jbd2/transaction.c: - jbd2__journal_start() - do_get_write_access() - jbd2_journal_dirty_metadata() - jbd2_journal_forget() - jbd2_journal_try_to_free_buffers() - jbd2_journal_file_inode() Signed-off-by: Milos Nikic Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Andreas Dilger Link: https://patch.msgid.link/20260304172016.23525-3-nikic.milos@gmail.com Signed-off-by: Theodore Ts'o commit 64924362f833fd15d75d2b8fc771eff9646c0933 Author: Milos Nikic Date: Wed Mar 4 09:20:15 2026 -0800 jbd2: gracefully abort instead of panicking on unlocked buffer In jbd2_journal_get_create_access(), if the caller passes an unlocked buffer, the code currently triggers a fatal J_ASSERT. While an unlocked buffer here is a clear API violation and a bug in the caller, crashing the entire system is an overly severe response. It brings down the whole machine for a localized filesystem inconsistency. Replace the J_ASSERT with a WARN_ON_ONCE to capture the offending caller's stack trace, and return an error (-EINVAL). This allows the journal to gracefully abort the transaction, protecting data integrity without causing a kernel panic. Signed-off-by: Milos Nikic Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Andreas Dilger Link: https://patch.msgid.link/20260304172016.23525-2-nikic.milos@gmail.com Signed-off-by: Theodore Ts'o commit 136799e52c4d3ebf14705ffffb69b8c7ae6f03ae Author: Shubham Chakraborty Date: Wed Mar 4 20:34:19 2026 +0530 docs: sysctl: Add documentation for /proc/sys/xen/ Add documentation for the Xen hypervisor sysctl controls in /proc/sys/xen/balloon/. Documents the hotplug_unpopulated tunable (available when CONFIG_XEN_BALLOON_MEMORY_HOTPLUG is enabled) which controls whether unpopulated memory regions are automatically hotplugged when the Xen balloon driver needs to reclaim memory. The documentation is based on source code analysis of drivers/xen/balloon.c. Signed-off-by: Shubham Chakraborty Signed-off-by: Jonathan Corbet Message-ID: <20260304150419.16738-1-chakrabortyshubham66@gmail.com> commit af1502f98e2cdd43504596cd438f3aa6d0be8712 Author: Weixie Cui Date: Wed Feb 25 13:02:31 2026 +0800 ext4: simplify mballoc preallocation size rounding for small files The if-else ladder in ext4_mb_normalize_request() manually rounds up the preallocation size to the next power of two for files up to 1MB, enumerating each step from 16KB to 1MB individually. Replace this with a single roundup_pow_of_two() call clamped to a 16KB minimum, which is functionally equivalent but much more concise. Also replace raw byte constants with SZ_1M and SZ_16K from for clarity, and remove the stale "XXX: should this table be tunable?" comment that has been there since the original mballoc code. No functional change. Reviewed-by: Andreas Dilger Signed-off-by: Weixie Cui Link: https://patch.msgid.link/tencent_E9C5F1B2E9939B3037501FD04A7E9CF0C407@qq.com Signed-off-by: Theodore Ts'o commit c41d03d03fe95f9f81fcb519d1f934e48e168c29 Author: Randy Dunlap Date: Sat Mar 21 16:09:34 2026 -0700 Docs: hid: intel-ish-hid: make long URL usable The '\' line continuation character in this long URL doesn't help anything. There is no documentation tooling that handles the line continuation character to join the 2 lines to make a usable URL. Web browsers terminate the URL just before the '\' character so that the second line of the URL is lost. See: https://docs.kernel.org/hid/intel-ish-hid.html Join the 2 lines together so that the URL is usable. Signed-off-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20260321230934.435020-1-rdunlap@infradead.org> commit a804ecc399d91a529726fa1b10ff699bb531253d Author: Julia Lawall Date: Sun Feb 22 13:50:49 2026 +0100 ext4/move_extent: use folio_next_pos() A series of patches such as commit 60a70e61430b ("mm: Use folio_next_pos()") replace folio_pos() + folio_size() by folio_next_pos(). The former performs x << z + y << z while the latter performs (x + y) << z, which is slightly more efficient. This case was not taken into account, perhaps because the argument is not named folio. The change was performed using the following Coccinelle semantic patch: @@ expression folio; @@ - folio_pos(folio) + folio_size(folio) + folio_next_pos(folio) Signed-off-by: Julia Lawall Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20260222125049.1309075-1-Julia.Lawall@inria.fr Signed-off-by: Theodore Ts'o commit 01f218d439acd5e129d214ea57e760ee2e34e869 Author: Takashi Iwai Date: Thu Apr 9 16:37:29 2026 +0200 ALSA: hda/alc269: Drop superfluous GPIO write at resume alc269_resume() has an extra code to write GPIO data, but this is basically already done in the standard alc_init(), hence it's superfluous. Let's drop the code. Since all external callers of alc_write_gpio_data() are gone after this, fold the only usage of alc_write_gpio_data() into the caller and drop the export as well. Link: https://patch.msgid.link/20260409143735.1412134-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 4f84e6caf38b05991b3b2afc0ddf4e48c2752d1d Author: Rong Zhang Date: Thu Apr 9 02:33:05 2026 +0800 ALSA: usb-audio: Add quirk flags for Feaulle Rainbow Feaulle Rainbow is a wired USB-C dynamic in-ear monitor (IEM) featuring active noise cancellation (ANC). The supported sample rates are 48000Hz and 96000Hz at 16bit or 24bit, but it does not support reading the current sample rate and results in an error message printed to kmsg. Set QUIRK_FLAG_GET_SAMPLE_RATE to skip the sample rate check. Its playback mixer reports val = -15360/0/128. Setting -15360 (-60dB) mutes the playback, so QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE is needed. Add a quirk table entry matching VID/PID=0x0e0b/0xfa01 and applying the mentioned quirk flags, so that it can work properly. Quirky device sample: usb 7-1: New USB device found, idVendor=0e0b, idProduct=fa01, bcdDevice= 1.00 usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 7-1: Product: Feaulle Rainbow usb 7-1: Manufacturer: Generic usb 7-1: SerialNumber: 20210726905926 Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20260409-feaulle-rainbow-v1-1-09179e09000d@rong.moe Signed-off-by: Takashi Iwai commit 15d49089e5b541c514fa458d6c8487afc8f8af7c Author: Li RongQing Date: Mon Mar 30 06:59:57 2026 -0400 Documentation/kernel-parameters: fix architecture alignment for pt, nopt, and nobypass Commit ab0e7f20768a ("Documentation: Merge x86-specific boot options doc into kernel-parameters.txt") introduced a formatting regression where architecture tags were placed on separate lines with broken indentation. This caused the 'nopt' [X86] parameter to appear as if it belonged to the [PPC/POWERNV] section. Furthermore, since the main 'iommu=' parameter heading already specifies it is for [X86, EARLY], the subsequent standalone [X86] tags for 'pt', 'nopt', and the AMD GART options are redundant and clutter the documentation. Clean up the formatting by removing these redundant tags and properly attributing the 'nobypass' option to [PPC/POWERNV]. Fixes: ab0e7f20768a ("Documentation: Merge x86-specific boot options doc into kernel-parameters.txt") Acked-by: Randy Dunlap Signed-off-by: Li RongQing Signed-off-by: Jonathan Corbet Message-ID: <20260330105957.2271-1-lirongqing@baidu.com> commit 2f17d1993b01960579761284e9a0da533a7a82fa Author: Guoqing Jiang Date: Wed Jan 21 14:38:05 2026 +0800 ext4: remove tl argument from ext4_fc_replay_{add,del}_range Since commit a7ba36bc94f2 ("ext4: fix fast commit alignment issues"), both ext4_fc_replay_add_range and ext4_fc_replay_del_range get ex based on 'val' instead of 'tl'. Signed-off-by: Guoqing Jiang Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20260121063805.19863-1-guoqing.jiang@linux.dev Signed-off-by: Theodore Ts'o commit eb10607628acd1408a02e49b545e6421bb7a6ea2 Author: Li Chen Date: Tue Jan 20 20:19:41 2026 +0800 ext4: remove unused i_fc_wait i_fc_wait is only initialized in ext4_fc_init_inode() and never used for waiting or wakeups. Drop it. Signed-off-by: Li Chen Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20260120121941.144192-1-me@linux.beauty Signed-off-by: Theodore Ts'o commit 5d0faa8e8369b9a48498f6f132c2ced5f0549acc Author: Ard Biesheuvel Date: Thu Mar 26 14:26:57 2026 +0100 efi/memattr: Fix thinko in table size sanity check While it is true that each PE/COFF runtime driver in memory can generally be split into 3 different regions (the header, the code/rodata region and the data/bss region), each with different permissions, it does not mean that 3x the size of the memory map is a suitable upper bound. This is due to the fact that all runtime drivers could be coalesced into a single EFI runtime code region by the firmware, and if the firmware does a good job of keeping the fragmentation down, it is conceivable that the memory attributes table has more entries than the EFI memory map itself. So instead, base the sanity check on whether the descriptor size matches the EFI memory map's descriptor size closely enough (which is not mandated by the spec but extremely unlikely to differ in practice), and whether the size of the whole table does not exceed 64k entries. Reviewed-by: Breno Leitao Signed-off-by: Ard Biesheuvel commit 1cc973b7c94a77bd3419bca847bbf19b5cfdfa4c Author: fangqiurong Date: Fri Apr 3 13:58:06 2026 +0800 sched/doc: Update yield_task description in sched-design-CFS The yield_task description referenced the long-removed compat_yield sysctl and described the function as a dequeue/enqueue cycle. Update it to reflect current behavior: yielding the CPU by moving the current task's position back in the runqueue. Sync zh_CN and sp_SP translations. Signed-off-by: fangqiurong Signed-off-by: Jonathan Corbet Message-ID: <20260403055806.358921-1-user@fqr-pc> commit ba716ad46d251528562fdd65cad8ce0b09853bd2 Author: Costa Shulyupin Date: Sun Apr 5 19:38:45 2026 +0300 Documentation/rtla: Convert links to RST format Web links in the documentation are not properly displayed. In the man pages web links look like: Osnoise tracer documentation: < > On web pages the URL caption is the URL itself. Convert tracer documentation links to RST anonymous hyperlink format for better rendering. Use newer docs.kernel.org instead of www.kernel.org/doc/html/latest for brevity. After the change, the links in the man pages look like: Osnoise tracer On web pages the captions are the titles of the links. Signed-off-by: Costa Shulyupin Signed-off-by: Jonathan Corbet Message-ID: <20260405163847.3337981-1-costa.shul@redhat.com> commit b21058880c454a06eeb0d146cd08e80b00caacb4 Author: Konstantin Taranov Date: Tue Mar 31 02:08:51 2026 -0700 RDMA/mana_ib: Support memory windows Implement .alloc_mw() and .dealloc_mw() for mana device. This is just the basic infrastructure, MW is not practically usable until additional kernel support for allowing user space to submit MW work requests is completed. Link: https://patch.msgid.link/r/20260331090851.2276205-1-kotaranov@linux.microsoft.com Signed-off-by: Konstantin Taranov Reviewed-by: Long Li Signed-off-by: Jason Gunthorpe commit 96c1f4517eb4feeae4656cf018a8d8a6156f1db3 Author: Manuel Cortez Date: Sun Apr 5 20:03:23 2026 -0700 docs: fix typos and duplicated words across documentation Fix the following typos and duplicated words: - admin-guide/pm/intel-speed-select.rst: "weather" -> "whether" - core-api/real-time/differences.rst: "the the" -> "the" - admin-guide/bcache.rst: "to to" -> "to" Signed-off-by: Manuel Cortez Acked-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20260406030323.1196-1-mdjesuscv@gmail.com> commit 7d435caacd91d23ebba281c4aac859196e1e2938 Author: John Garry Date: Wed Apr 8 08:03:57 2026 +0000 nvme-multipath: drop head pointer check in nvme_mpath_clear_current_path() A NS will always have a head pointer, so drop the check. As proof in practice, all the nvme_mpath_clear_current_path() callers also dereference ns->head. This check has endured since the original changes to support multipath. Reviewed-by: Christoph Hellwig Signed-off-by: John Garry Signed-off-by: Keith Busch commit 7f991e3f9b8f044640bcb5fa8570350a68932843 Author: Alan Cui Date: Thu Apr 9 16:15:25 2026 +0800 nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808 (Samsung PM981/983/970 EVO Plus ) The firmware for Samsung 970 Evo Plus / PM981 / PM983 does not support SUBNQN. Make quirks to suppress warnings. # nvme id-ctrl /dev/nvme1n1 NVME Identify Controller: vid : 0x144d ssvid : 0x144d sn : *** mn : Samsung SSD 970 EVO Plus 500GB fr : 2B2QEXM7 mcdqpc : 0 subnqn : ioccsz : 0 Signed-off-by: Alan Cui Signed-off-by: Keith Busch commit 5293a8882c549fab4a878bc76b0b6c951f980a61 Author: Chaitanya Kulkarni Date: Wed Apr 8 00:51:31 2026 -0700 nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown. If an NVMe/TCP host sends an Initialization Connection Request (ICReq) and immediately closes the connection, target-side teardown may start in softirq context before io_work drains the already buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue reference under state_lock. If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and allows a later socket state change to re-enter teardown and issue a second kref_put() on an already released queue. The ICResp send failure path has the same problem. If teardown has already moved the queue to DISCONNECTING, a send error can still overwrite the state with NVMET_TCP_Q_FAILED, again reopening the window for a second teardown path to drop the queue reference. Fix this by serializing both post-send state transitions with state_lock and bailing out if teardown has already started. Use -ESHUTDOWN as an internal sentinel for that bail-out path rather than propagating it as a transport error like -ECONNRESET. Keep nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before honoring that sentinel so receive-side parsing stays quiesced until the existing release path completes. Fixes: c46a6465bac2 ("nvmet-tcp: add NVMe over TCP target driver") Cc: stable@vger.kernel.org Reported-by: Shivam Kumar Tested-by: Shivam Kumar Signed-off-by: Chaitanya Kulkarni Signed-off-by: Keith Busch commit 7244491dab347f648e661da96dc0febadd9daec3 Author: hkbinbin Date: Wed Apr 1 12:19:07 2026 +0000 RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size() underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) + RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE. Cc: stable@vger.kernel.org Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://patch.msgid.link/r/20260401121907.1468366-1-hkbinbinbin@gmail.com Signed-off-by: hkbinbin Reviewed-by: Zhu Yanjun Signed-off-by: Jason Gunthorpe commit 9b25f381de6b8942645f43735cb0a4fb0ab3a6d1 Author: Deepanshu Kartikey Date: Fri Dec 5 11:29:14 2025 +0530 ext4: unmap invalidated folios from page tables in mpage_release_unused_pages() When delayed block allocation fails (e.g., due to filesystem corruption detected in ext4_map_blocks()), the writeback error handler calls mpage_release_unused_pages(invalidate=true) which invalidates affected folios by clearing their uptodate flag via folio_clear_uptodate(). However, these folios may still be mapped in process page tables. If a subsequent operation (such as ftruncate calling ext4_block_truncate_page) triggers a write fault, the existing page table entry allows access to the now-invalidated folio. This leads to ext4_page_mkwrite() being called with a non-uptodate folio, which then gets marked dirty, triggering: WARNING: CPU: 0 PID: 5 at mm/page-writeback.c:2960 __folio_mark_dirty+0x578/0x880 Call Trace: fault_dirty_shared_page+0x16e/0x2d0 do_wp_page+0x38b/0xd20 handle_pte_fault+0x1da/0x450 The sequence leading to this warning is: 1. Process writes to mmap'd file, folio becomes uptodate and dirty 2. Writeback begins, but delayed allocation fails due to corruption 3. mpage_release_unused_pages(invalidate=true) is called: - block_invalidate_folio() clears dirty flag - folio_clear_uptodate() clears uptodate flag - But folio remains mapped in page tables 4. Later, ftruncate triggers ext4_block_truncate_page() 5. This causes a write fault on the still-mapped folio 6. ext4_page_mkwrite() is called with folio that is !uptodate 7. block_page_mkwrite() marks buffers dirty 8. fault_dirty_shared_page() tries to mark folio dirty 9. block_dirty_folio() calls __folio_mark_dirty(warn=1) 10. WARNING triggers: WARN_ON_ONCE(warn && !uptodate && !dirty) Fix this by unmapping folios from page tables before invalidating them using unmap_mapping_pages(). This ensures that subsequent accesses trigger new page faults rather than reusing invalidated folios through stale page table entries. Note that this results in data loss for any writes to the mmap'd region that couldn't be written back, but this is expected behavior when writeback fails due to filesystem corruption. The existing error message already states "This should not happen!! Data will be lost". Reported-by: syzbot+b0a0670332b6b3230a0a@syzkaller.appspotmail.com Tested-by: syzbot+b0a0670332b6b3230a0a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b0a0670332b6b3230a0a Suggested-by: Matthew Wilcox Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20251205055914.1393799-1-kartikey406@gmail.com Signed-off-by: Theodore Ts'o commit ba0e9fdab3f8cbd1e70ecd288f3255b8b57c932a Author: Gleb Golovko Date: Wed Apr 8 00:28:18 2026 +0300 docs: fix typo in zoran driver documentation Replace "an a few" with "and a few" in Documentation/driver-api/media/drivers/zoran.rst. Signed-off-by: Gleb Golovko Signed-off-by: Jonathan Corbet Message-ID: <20260407212818.925-1-gaben123001@gmail.com> commit ca13ab654064fee86d6e7c9e87d0af7789561509 Author: Bartosz Golaszewski Date: Tue Apr 7 15:27:58 2026 +0200 gpio: swnode: defer probe on references to unregistered software nodes fwnode_property_get_reference_args() now returns -ENOTCONN when called on a software node referencing another software node which has not yet been registered as a firmware node. It makes sense to defer probe in this situation as the node will most likely be registered later on and we'll be able to resolve the reference eventually. Change the behavior of swnode_find_gpio() to return -EPROBE_DEFER if the software node reference resolution returns -ENOTCONN. Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260407-swnode-unreg-retcode-v4-2-1b2f0725eb9c@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 6ed3d14fc45d3da6025e7fe4a6a09066856698e2 Author: Florian Westphal Date: Mon Mar 30 14:27:39 2026 +0200 RDMA/core: Prefer NLA_NUL_STRING These attributes are evaluated as c-string (passed to strcmp), but NLA_STRING doesn't check for the presence of a \0 terminator. Either this needs to switch to nla_strcmp() and needs to adjust printf fmt specifier to not use plain %s, or this needs to use NLA_NUL_STRING. As the code has been this way for long time, it seems to me that userspace does include the terminating nul, even tough its not enforced so far, and thus NLA_NUL_STRING use is the simpler solution. Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service") Link: https://patch.msgid.link/r/20260330122742.13315-1-fw@strlen.de Signed-off-by: Florian Westphal Signed-off-by: Jason Gunthorpe commit 79ae8510b5b81b9500370f89c619b50ca9c0990f Author: Thomas Zimmermann Date: Tue Dec 9 15:33:18 2025 +0100 drm/atomic: Increase timeout in drm_atomic_helper_wait_for_vblanks() Increase the timeout for vblank events from 100 ms to 1000 ms. This is the same fix as in commit f050da08a4ed ("drm/vblank: Increase timeout in drm_wait_one_vblank()") for another vblank timeout. After merging generic DRM vblank timers [1] and converting several DRM drivers for virtual hardware, these drivers synchronize their vblank events to the display refresh rate. This can trigger timeouts within the DRM framework. Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/dri-devel/20250904145806.430568-1-tzimmermann@suse.de/ # [1] Reported-by: syzbot+fcede535e7eb57cf5b43@syzkaller.appspotmail.com Closes: https://lore.kernel.org/dri-devel/69381d6c.050a0220.4004e.0017.GAE@google.com/ Reviewed-by: Ville Syrjälä Fixes: 74afeb812850 ("drm/vblank: Add vblank timer") Link: https://patch.msgid.link/20251209143325.102056-1-tzimmermann@suse.de commit a29b5cd42f5bc6ba1be6422f61f3f05bab707ce8 Author: Daniil Bulgar Date: Tue Apr 7 21:05:46 2026 +0200 platform/x86: thinkpad_acpi: remove obsolete TODO comment This patch removes the obsolete TODO comment regarding fan speed presets in fan_write_cmd_speed. After discussion with the maintainers, it was decided that fixed presets (low/medium/high) are not suitable due to platform-specific variations. Signed-off-by: Daniil Bulgar Reviewed-by: Mark Pearson Link: https://patch.msgid.link/20260407190546.109900-1-bulgardaniil18@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7a43ccf85dfe06eef483c034e68b81ff326741aa Author: Andy Shevchenko Date: Fri Mar 27 11:27:29 2026 +0100 leds: class: Make led_remove_lookup() NULL-aware It is a usual pattern in the kernel to make releasing functions be NULL-aware so they become a no-op. This helps reducing unneeded checks in the code where the given resource is optional. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260327102729.797254-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit 3c34471c26abc52a37f5ad90949e2e4b8027eb14 Author: Pengpeng Hou Date: Wed Apr 8 08:38:21 2026 +0800 platform/x86: dell-wmi-sysman: bound enumeration string aggregation populate_enum_data() aggregates firmware-provided value-modifier and possible-value strings into fixed 512-byte struct members. The current code bounds each individual source string but then appends every string and separator with raw strcat() and no remaining-space check. Switch the aggregation loops to a bounded append helper and reject enumeration packages whose combined strings do not fit in the destination buffers. Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems") Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260408084501.1-dell-wmi-sysman-v2-pengpeng@iscas.ac.cn [ij: add include] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f8d5e7066d846c92ecac245134baf8a207becb65 Merge: 7aaa8047eafd0b 7e0548525abd2b 9dcef98dbee35b 5e8323c3d52838 40a13b49957937 b334d7f7e230ff 5aac28784dca68 ebfaf2bcc1902d Author: Will Deacon Date: Thu Apr 9 13:18:27 2026 +0100 Merge branches 'fixes', 'arm/smmu/updates', 'arm/smmu/bindings', 'riscv', 'intel/vt-d', 'amd/amd-vi' and 'core' into next commit ebfaf2bcc1902d293ed25f5a0580c96f73c47cbb Author: Alex Williamson Date: Wed Apr 8 12:44:42 2026 -0600 iommu/vt-d: Restore IOMMU_CAP_CACHE_COHERENCY In removing IOMMU_CAP_DEFERRED_FLUSH, the below referenced commit was over-eager in removing the return, resulting in the test for IOMMU_CAP_CACHE_COHERENCY falling through to an irrelevant option. Restore dropped return. Fixes: 1c18a1212c77 ("iommu/dma: Always allow DMA-FQ when iommupt provides the iommu_domain") Signed-off-by: Alex Williamson Reviewed-by: Lu Baolu Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Signed-off-by: Will Deacon commit e8c597368b8500a824c639bfb5ed0044068c6870 Author: Krishna Chomal Date: Fri Apr 3 13:31:55 2026 +0530 platform/x86: hp-wmi: Ignore backlight and FnLock events On HP OmniBook 7 the keyboard backlight and FnLock keys are handled directly by the firmware. However, they still trigger WMI events which results in "Unknown key code" warnings in dmesg. Add these key codes to the keymap with KE_IGNORE to silence the warnings since no software action is needed. Tested-by: Artem S. Tashkinov Reported-by: Artem S. Tashkinov Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221181 Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20260403080155.169653-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6b0567dc4c9ad140044400e06dd97fdce12c204f Author: Ethan Tidmore Date: Fri Apr 3 02:09:28 2026 -0500 platform/x86: uniwill-laptop: Fix signedness bug The function sysfs_match_string() can return negative error codes and the variable assigned to it is the enum 'option'. Which could be an unsigned int due to different compiler implementations. Assign signed variable 'ret' to sysfs_match_string(), check for error, then assign ret to option. Detected by Smatch: drivers/platform/x86/uniwill/uniwill-acpi.c:919 usb_c_power_priority_store() warn: unsigned 'option' is never less than zero. Fixes: 03ae0a0d0973b ("platform/x86: uniwill-laptop: Implement USB-C power priority setting") Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260403070928.802196-1-ethantidmore06@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f8fd138c2363c0e2d3235c32bfb4fb5c6474e4ae Author: Fedor Pchelkin Date: Fri Apr 3 16:42:39 2026 +0300 platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() Ensure the temp value has been properly parsed from the user-provided buffer and initialized to be used in later operations. While at it, prefer a convenient kstrtoul() helper. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool. Fixes: ad6ce87e5bd4 ("[PATCH] dell_rbu: changes in packet update mechanism") Signed-off-by: Fedor Pchelkin Link: https://patch.msgid.link/20260403134240.604837-1-pchelkin@ispras.ru [ij: add include] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5969c55e2145368254194edbe0e64880314be69f Author: Emre Cecanpunar Date: Tue Apr 7 17:25:14 2026 +0300 platform/x86: hp-wmi: add locking for concurrent hwmon access hp_wmi_hwmon_priv.mode and .pwm are written by hp_wmi_hwmon_write() in sysfs context and read by hp_wmi_hwmon_keep_alive_handler() in a workqueue. A concurrent write and keep-alive expiry can observe an inconsistent mode/pwm pair (e.g. mode=MANUAL with a stale pwm). Add a mutex to hp_wmi_hwmon_priv protecting mode and pwm. Hold it in hp_wmi_hwmon_write() across the field update and apply call, and in hp_wmi_hwmon_keep_alive_handler() before calling apply. In hp_wmi_hwmon_read(), only the pwm_enable path reads priv->mode; use scoped_guard() there to avoid holding the lock across unrelated WMI calls. Fixes: c203c59fb5de ("platform/x86: hp-wmi: implement fan keep-alive") Suggested-by: Ilpo Järvinen Signed-off-by: Emre Cecanpunar Link: https://patch.msgid.link/20260407142515.20683-6-emreleno@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit cb4daa450f05447c1f914eaef75b2577c25a0fcd Author: Emre Cecanpunar Date: Tue Apr 7 17:25:13 2026 +0300 platform/x86: hp-wmi: fix u8 underflow in gpu_delta calculation gpu_delta was declared as u8. If the firmware specifies a GPU RPM lower than the CPU RPM, subtracting them causes an underflow (e.g. 10 - 20 = 246), which forces the GPU fan to remain clamped at U8_MAX (100% speed) during operation. Change gpu_delta to int and use signed arithmetic. Existing signed logic in hp_wmi_fan_speed_set() correctly handles negative deltas. Fixes: 46be1453e6e6 ("platform/x86: hp-wmi: add manual fan control for Victus S models") Suggested-by: Ilpo Järvinen Signed-off-by: Emre Cecanpunar Link: https://patch.msgid.link/20260407142515.20683-5-emreleno@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6297443beb0c5606399ec7d4f4b335e2e7379147 Author: Emre Cecanpunar Date: Tue Apr 7 17:25:12 2026 +0300 platform/x86: hp-wmi: use mod_delayed_work to reset keep-alive timer Currently, schedule_delayed_work() is used to queue the 90s keep-alive timer. If a user manually changes the fan speed at T=85s, schedule_delayed_work() leaves the existing timer in place as it is a no-op if the work is already pending. This results in the keep-alive timer firing unnecessarily at T=90s, just 5 seconds after the user action. Replace schedule_delayed_work() with mod_delayed_work() to reset the 90s timer whenever fan settings are applied. This guarantees a full 90s delay after every user interaction, preventing redundant keep-alive executions and improving efficiency. Fixes: c203c59fb5de ("platform/x86: hp-wmi: implement fan keep-alive") Signed-off-by: Emre Cecanpunar Link: https://patch.msgid.link/20260407142515.20683-4-emreleno@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 249ddba9c0ba4453c0a6bc0e3626e7864751d940 Author: Emre Cecanpunar Date: Tue Apr 7 17:25:11 2026 +0300 platform/x86: hp-wmi: avoid cancel_delayed_work_sync from work handler hp_wmi_apply_fan_settings() uses cancel_delayed_work_sync() to stop the keep-alive timer in AUTO mode. However, since hp_wmi_apply_fan_settings() is also called from the keep-alive handler, a race condition with a sysfs write can cause the handler to wait on itself, leading to a deadlock. Replace cancel_delayed_work_sync() with cancel_delayed_work() in hp_wmi_apply_fan_settings() to avoid the self-flush deadlock. Fixes: c203c59fb5de ("platform/x86: hp-wmi: implement fan keep-alive") Signed-off-by: Emre Cecanpunar Link: https://patch.msgid.link/20260407142515.20683-3-emreleno@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7265b57fbc32782d02bdb8d865ba0d8efa209c8c Author: Emre Cecanpunar Date: Tue Apr 7 17:25:10 2026 +0300 platform/x86: hp-wmi: fix ignored return values in fan settings hp_wmi_get_fan_count_userdefine_trigger() can fail, but its return value was silently ignored in hp_wmi_apply_fan_settings() for PWM_MODE_MAX/AUTO. Propagate these errors consistently. Additionally, handle the return value of hp_wmi_apply_fan_settings() in its callers by adding appropriate warnings on failure, and remove an unreachable "return 0" at the end of the function. Fixes: 46be1453e6e6 ("platform/x86: hp-wmi: add manual fan control for Victus S models") Signed-off-by: Emre Cecanpunar Link: https://patch.msgid.link/20260407142515.20683-2-emreleno@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit abe76f9f47d59ff80eb2fc59482aa76bbf6fd13a Author: Markus Schneider-Pargmann (TI) Date: Wed Mar 18 16:13:09 2026 +0100 arm64: dts: ti: k3: Use memory-region-names for r5f Add the newly introduced memory-region-names to all occurences of ti,*-r5f. This helps adding a name to each memory-region so it is easier to see what memory regions are for. Signed-off-by: Markus Schneider-Pargmann (TI) Link: https://patch.msgid.link/20260318-topic-am62a-ioddr-dt-v6-19-v3-3-c41473cb23c3@baylibre.com Signed-off-by: Vignesh Raghavendra commit e47b8e1db9a9bbef6765e85b11e87f48e6b56846 Author: Song Gao Date: Thu Apr 9 18:56:38 2026 +0800 KVM: LoongArch: selftests: Add PMU overflow interrupt test Extend the PMU test suite to cover overflow interrupts. The test enables the PMI (Performance Monitor Interrupt), sets counter 0 to one less than the overflow value, and verifies that an interrupt is raised when the counter overflows. A guest interrupt handler checks the interrupt cause and disables further PMU interrupts upon success. Signed-off-by: Song Gao Signed-off-by: Huacai Chen commit 11c840192768a5a63b6aed75273c5e8e416230ee Author: Song Gao Date: Thu Apr 9 18:56:37 2026 +0800 KVM: LoongArch: selftests: Add basic PMU event counting test Introduce a basic PMU test that verifies hardware event counting for four performance counters. The test enables the events for CPU cycles, instructions retired, branch instructions, and branch misses, runs a fixed number of loops, and checks that the counter values fall within expected ranges. It also validates that the host supports PMU and that the VM feature is enabled. Signed-off-by: Song Gao Signed-off-by: Huacai Chen commit fa19ea9a7bdb97575e05d72305a4c40a3a631357 Author: Song Gao Date: Thu Apr 9 18:56:37 2026 +0800 KVM: LoongArch: selftests: Add cpucfg read/write helpers Add helper macros and functions to read and write CPU configuration registers (cpucfg) from the guest and from the VMM. This interface is required in upcoming selftests for querying and setting CPU features, such as PMU capabilities. Signed-off-by: Song Gao Signed-off-by: Huacai Chen commit 03de5eecb0f0f68f29086bc0075c7fd597bf4e4a Author: Song Gao Date: Thu Apr 9 18:56:37 2026 +0800 LoongArch: KVM: Add DMSINTC inject msi to vCPU Implement irqfd that deliver msi to vCPU and vCPU dmsintc irq injection. Add pch_msi_set_irq() choice dmsintc to set msi irq by the msg_addr and implement dmsintc set msi irq. Signed-off-by: Song Gao Signed-off-by: Huacai Chen commit 229132c309d667bb05405fc8b539e7d90e0dfb3b Author: Song Gao Date: Thu Apr 9 18:56:37 2026 +0800 LoongArch: KVM: Add DMSINTC device support Add device model for DMSINTC interrupt controller, implement basic create/destroy/set_attr interfaces, and register device model to kvm device table. Reviewed-by: Bibo Mao Signed-off-by: Song Gao Signed-off-by: Huacai Chen commit c43dce6f13fb12144571c168c7a593e5e546f3b5 Author: Bibo Mao Date: Thu Apr 9 18:56:36 2026 +0800 LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function vcpu_is_preempted() is performance sensitive that called in function osq_lock(), here make it as a macro. So that parameter is not parsed at most time, it can avoid cache line thrashing across numa nodes. Here is part of UnixBench result on Loongson-3C5000 DualWay machine with 32 cores and 2 numa nodes. original inline macro execl 7025.7 6991.2 7242.3 fstime 474.6 703.1 1071 From the test result, making vcpu_is_preempted() as a macro is the best, and there is some improvment compared with the original function method. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit aac656857e9f008a014ac9d58aab66e8fc803604 Author: Bibo Mao Date: Thu Apr 9 18:56:36 2026 +0800 LoongArch: KVM: Move host CSR_GSTAT save and restore in context switch CSR register LOONGARCH_CSR_GSTAT stores guest VMID information. With existing implementation method, VMID is per vCPU, similar with ASID in kernel. LOONGARCH_CSR_GSTAT is written at VM entry even if VMID is not changed. Here move LOONGARCH_CSR_GSTAT save/restore in vCPU context switch, and update LOONGARCH_CSR_GSTAT only when VMID is updated at VM entry. At most time VM enter/exit is much more frequent than vCPU thread context switch. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit f62eb9ca8def410bcef39e8909945409d0968473 Author: Bibo Mao Date: Thu Apr 9 18:56:36 2026 +0800 LoongArch: KVM: Move host CSR_EENTRY save and restore in context switch CSR register LOONGARCH_CSR_EENTRY is shared between host CPU and guest vCPU, KVM need save and restore LOONGARCH_CSR_EENTRY register. Here move LOONGARCH_CSR_EENTRY saving in to context switch function rather than VM entry. At most time VM enter/exit is much more frequent than vCPU thread context switch. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 14d2714d6537a9df5bea2515185034dbb9d30f03 Author: Bibo Mao Date: Thu Apr 9 18:56:36 2026 +0800 LoongArch: KVM: Check kvm_request_pending() in kvm_late_check_requests() Add kvm_request_pending() checking firstly in kvm_late_check_requests(), at most time there is no pending request, then the following pending bit checking can be skipped. Also embed function kvm_check_pmu() in to kvm_late_check_requests(), and put it after the kvm_request_pending() checking. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit da773ea3f59032f659bfc4c450ca86e384786168 Author: Tao Cui Date: Thu Apr 9 18:56:36 2026 +0800 LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel() The function reads LOONGARCH_CSR_CRMD but uses CSR_PRMD_PPLV to extract the privilege level. While both masks have the same value (0x3), CSR_CRMD_PLV is the semantically correct constant for CRMD. Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao Signed-off-by: Tao Cui Signed-off-by: Huacai Chen commit 5a21253b3073df578ee074da2f9427cbb4c3146a Author: William Zhang Date: Thu Apr 2 02:43:25 2026 +0100 ARM: 9471/1: module: fix unwind section relocation out of range error In an armv7 system that uses non-3G/1G split and with more than 512MB physical memory, driver load may fail with following error: section 29 reloc 0 sym '': relocation 42 out of range (0xc2ab9be8 -> 0x7fad5998) This happens when relocation R_ARM_PREL31 from the unwind section .ARM.extab and .ARM.exidx are allocated from the VMALLOC space while .text section is from MODULES_VADDR space. It exceeds the +/-1GB relocation requirement of R_ARM_PREL31 hence triggers the error. The fix is to mark .ARM.extab and .ARM.exidx sections as executable so they can be allocated along with .text section and always meet range requirement. Co-developed-by: Ard Biesheuvel Signed-off-by: Ard Biesheuvel Signed-off-by: William Zhang Signed-off-by: Russell King (Oracle) commit dd9d3e16c2d5fa166e13dce07413be51f42c8f5d Author: Bae Yeonju Date: Sat Mar 21 13:45:02 2026 +0900 fs/adfs: validate nzones in adfs_validate_bblk() Reject ADFS disc records with a zero zone count during boot block validation, before the disc record is used. When nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...) which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to dm[-1], causing an out-of-bounds write before the allocated buffer. adfs_validate_dr0() already rejects nzones != 1 for old-format images. Add the equivalent check to adfs_validate_bblk() for new-format images so that a crafted image with nzones == 0 is rejected at probe time. Found by syzkaller. Fixes: f6f14a0d71b0 ("fs/adfs: map: move map-specific sb initialisation to map.c") Signed-off-by: Bae Yeonju Signed-off-by: Russell King (Oracle) commit 9700282a7ec721e285771d995ccfe33845e776dc Merge: 58dd34dbd5b097 fd3c7d080df531 Author: Paolo Abeni Date: Thu Apr 9 12:16:47 2026 +0200 Merge branch 'r8152-add-support-for-the-rtl8157-5gbit-usb-ethernet-chip' Birger Koblitz says: ==================== r8152: Add support for the RTL8157 5Gbit USB Ethernet chip Add support for the RTL8157, which is a 5GBit USB-Ethernet adapter chip in the RTL815x family of chips. The RTL8157 uses a different frame descriptor format, and different SRAM/ADV access methods, plus offers 5GBit/s Ethernet, so support for these features is added in addition to chip initialization and configuration. The module was tested with an OEM RTL8157 USB adapter: [25758.328238] usb 4-1: new SuperSpeed Plus Gen 2x1 USB device number 2 using xhci_hcd [25758.345565] usb 4-1: New USB device found, idVendor=0bda, idProduct=8157, bcdDevice=30.00 [25758.345585] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=7 [25758.345593] usb 4-1: Product: USB 10/100/1G/2.5G/5G LAN [25758.345599] usb 4-1: Manufacturer: Realtek [25758.345605] usb 4-1: SerialNumber: 000300E04C68xxxx [25758.534241] r8152-cfgselector 4-1: reset SuperSpeed Plus Gen 2x1 USB device number 2 using xhci_hcd [25758.603511] r8152 4-1:1.0: skip request firmware [25758.653351] r8152 4-1:1.0 eth0: v1.12.13 [25758.689271] r8152 4-1:1.0 enx00e04c68xxxx: renamed from eth0 [25763.271682] r8152 4-1:1.0 enx00e04c68xxxx: carrier on The RTL8157 adapter was tested against an AQC107 PCIe-card supporting 10GBit/s and an RTL8126 5Gbit PCIe-card supporting 5GBit/s for performance, link speed and EEE negotiation. Using USB3.2 Gen 1 with the RTL8157 USB adapter and running iperf3 against the AQC107 PCIe card resulted in 3.47 Gbits/sec, whereas using USB3.2 Gen2 resulted in 4.70 Gbits/sec, speeds against the RTL8126-card were the same. As the code integrates the RTL8157-specific code with existing RTL8156 code in order to improve code maintainability (instead of adding RTL8157-specific functions duplicaing most of the RTL8156 code), regression tests were done with an Edimax EU-4307 V1.0 USB-Ethernet adapter with RTL8156. The code is based on the out-of-tree r8152 driver published by Realtek under the GPL. This patch is on top of linux-next as the code re-uses the 2.5 Gbit EEE recently added in r8152.c. Signed-off-by: Birger Koblitz ==================== Link: https://patch.msgid.link/20260404-rtl8157_next-v7-0-039121318f23@birger-koblitz.de Signed-off-by: Paolo Abeni commit fd3c7d080df53136c7e7e37f753fb7bd4640ca42 Author: Birger Koblitz Date: Sat Apr 4 09:57:43 2026 +0200 r8152: Add support for the RTL8157 hardware The RTL8157 uses a different packet descriptor format compared to the previous generation of chips. Add support for this format by adding a descriptor format structure into the r8152 structure and corresponding desc_ops functions which abstract the vlan-tag, tx/rx len and tx/rx checksum algorithms. Also, add support for the ADV indirect access interface of the RTL8157 and PHY setup. For initialization of the RTL8157, combine the existing RTL8156B and RTL8156 init functions and add RTL8157-specific functinality in order to improve code readability and maintainability. r8156_init() is now called with RTL_VER_10 and RTL_VER_11 for the RTL8156, with RTL_VER_12, RTL_VER_13 and RTL_VER_15 for the RTL8156B and with RTL_VER_16 for the RTL8157 and checks the version for chip-specific code. Also add USB power control functions for the RTL8157. Add support for the USB device ID of Realtek RTL8157-based adapters. Detect the RTL8157 as RTL_VER_16 and set it up. Signed-off-by: Birger Koblitz Link: https://patch.msgid.link/20260404-rtl8157_next-v7-2-039121318f23@birger-koblitz.de Signed-off-by: Paolo Abeni commit ebe5fd2ed20af5ae176dd41dd4a85a3cdc738b8a Author: Birger Koblitz Date: Sat Apr 4 09:57:42 2026 +0200 r8152: Add support for 5Gbit Link Speeds and EEE The RTL8157 supports 5GBit Link speeds. Add support for this speed in the setup and setting/getting through ethtool. Also add 5GBit EEE. Add functionality for setup and ethtool get/set methods. Signed-off-by: Birger Koblitz Link: https://patch.msgid.link/20260404-rtl8157_next-v7-1-039121318f23@birger-koblitz.de Signed-off-by: Paolo Abeni commit c2938a83a257ca1e3a8e74b385f543d6bd6eab8b Author: Takashi Iwai Date: Thu Apr 9 11:38:23 2026 +0200 ALSA: hda/senarytech: Clean up with the new GPIO helper Use the new GPIO helper function to clean up the open code. Merely a code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260409093826.1317626-11-tiwai@suse.de commit 9851bc2b9013674ba7dc151843f29b6255fedba3 Author: Takashi Iwai Date: Thu Apr 9 11:38:22 2026 +0200 ALSA: hda/conexant: Clean up with the new GPIO helper Use the new GPIO helper function to clean up the open code. Merely a code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260409093826.1317626-10-tiwai@suse.de commit daadb7fce1b53336acb195f34bd42d79754afa0e Author: Takashi Iwai Date: Thu Apr 9 11:38:21 2026 +0200 ALSA: hda/cirrus: Clean up with the new GPIO helper Use the new GPIO helper function to clean up the open code. Merely a code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260409093826.1317626-9-tiwai@suse.de commit d35f8e8c6fc5c92c96be38e9ca94d99233ce1ddd Author: Takashi Iwai Date: Thu Apr 9 11:38:20 2026 +0200 ALSA: hda/ca0132: Clean up with the new GPIO helper Use the new GPIO helper function to clean up the open code. Merely a code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260409093826.1317626-8-tiwai@suse.de commit 37e4fccc21aa0e812d77e3e3f7b8373475ee3715 Author: Takashi Iwai Date: Thu Apr 9 11:38:19 2026 +0200 ALSA: hda/sigmatel: Clean up with the new GPIO helper Use the new GPIO helper function to clean up the open code. Merely a code refactoring, and no behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260409093826.1317626-7-tiwai@suse.de commit 735b3739517b18983cb0347ba56d76bf1018e0c4 Author: Takashi Iwai Date: Thu Apr 9 11:38:18 2026 +0200 ALSA: hda/analog: Fix GPIO verb orders So far we used the verb cache to restore the GPIO mask, direction and data bits at PM resume. But, due to the nature of the cache resume mechanism, the calling order isn't guaranteed, and this might lead to some inconsistency at the restored state. For assuring the GPIO verb orders, use the new GPIO helper function to explicitly set up the GPIO bits, instead of using the codec verb caches, while keeping the current data bits in ad198x_spec. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260409093826.1317626-6-tiwai@suse.de commit ef27d8ce0a3b55744b86e1866c62dc7537749180 Author: Takashi Iwai Date: Thu Apr 9 11:38:17 2026 +0200 ALSA: hda/alc662: Simplify the quirk for CSL Unity BF24B The previous implementation of the quirk for CSL Unity BF24B in commit de65275fc94e ("ALSA: hda/realtek: Add quirk for CSL Unity BF24B") introduced the unnecessary GPIO caching which leads to a superfluous write at each init/resume. Use the new helper to write GPIO bits directly for optimization. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260409093826.1317626-5-tiwai@suse.de commit d19ecd85a245a2052a502f72bee83982f535c2e6 Author: Takashi Iwai Date: Thu Apr 9 11:38:16 2026 +0200 ALSA: hda/realtek: Clean up with snd_hda_codec_set_gpio() Use a new helper function to clean up the code. Along with it, make alc_write_gpio() static as well, which is used only locally in realtek.c. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260409093826.1317626-4-tiwai@suse.de commit cd8fd5a0566e0d93fbd408e6b06ca484a78b5ccd Author: Takashi Iwai Date: Thu Apr 9 11:38:15 2026 +0200 ALSA: hda: Add a simple GPIO setup helper function Introduce a common GPIO setup helper function, so that we can clean up the open code found in many codec drivers later. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260409093826.1317626-3-tiwai@suse.de commit b0762dd2fcab5b8b4b953314f3f6eb9d92bc16bc Author: Takashi Iwai Date: Thu Apr 9 11:38:14 2026 +0200 ALSA: hda: Add sync version of snd_hda_codec_write() We used snd_hda_codec_read() for the verb write when a synchronization is needed after the write, e.g. for the power state toggle or such cases. It works in principle, but it looks rather confusing and too hackish. For improving the code readability, introduce a new helper function, snd_hda_codec_write_sync(), which is another variant of snd_hda_codec_write(), and replace the existing snd_hda_codec_read() calls with this one. No behavior change but just the code refactoring. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260409093826.1317626-2-tiwai@suse.de commit 9575766a682f50ec4bcb85ecd438685bdc09f9cc Author: Lianqin Hu Date: Thu Apr 9 08:21:37 2026 +0000 ALSA: usb-audio: Add iface reset and delay quirk for HUAWEI USB-C HEADSET Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: new full-speed USB device number 2 using xhci-hcd usb 1-1: New USB device found, idVendor=12d1, idProduct=3a07 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: HUAWEI USB-C HEADSET usb 1-1: Manufacturer: bestechnic usb 1-1: SerialNumber: 0296C100000000000000000000000 Signed-off-by: Lianqin Hu Link: https://patch.msgid.link/TYUPR06MB62176A18EA7A9DD0AC2826BCD2582@TYUPR06MB6217.apcprd06.prod.outlook.com Signed-off-by: Takashi Iwai commit efca489a86fc6a5364215fdf03c2fad3b864d03a Author: Cássio Gabriel Date: Thu Apr 9 02:07:46 2026 -0300 ALSA: msnd: add ISA and PnP system sleep callbacks The msnd drivers do not implement system sleep callbacks today, so they have no defined way to recover DSP state after suspend. Add common card suspend/resume helpers, rerun the DSP initialization path on resume, restore the cached capture-source state, and rearm the shared IRQ for already-open users. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260409-msnd-pm-support-v1-2-2abef720d0e7@gmail.com Signed-off-by: Takashi Iwai commit 49690509ebdcbfa7618dd5a5ff3c89f7af9a5b43 Author: Cássio Gabriel Date: Thu Apr 9 02:07:45 2026 -0300 ALSA: msnd: prepare system sleep support System suspend cannot work for msnd today because the PCM trigger paths reject SNDRV_PCM_TRIGGER_SUSPEND, and the driver has only refcounted IRQ helpers. Add the small helpers needed by the PM callbacks and restore master volume from the cached ALSA mixer state when the DSP is reinitialized. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260409-msnd-pm-support-v1-1-2abef720d0e7@gmail.com Signed-off-by: Takashi Iwai commit aa6c1052b7730e18d5999f9a5cfb1dadaac82310 Author: Cássio Gabriel Date: Wed Apr 8 12:17:37 2026 -0300 ALSA: i2c: ak4xxx-adda: seed AK5365 cache with reset defaults snd_akm4xxx_init() clears the register and volume caches before dispatching by codec type. The AK5365 case then returns immediately, leaving the software cache at zero instead of the documented AK5365 reset defaults. The AK5365 capture volume controls read from volumes[] and the proc register dump reads from images[], so the initial capture volume state and proc output are wrong until a control write happens. Seed the AK5365 cache with its documented reset defaults instead of adding a guessed init sequence. The datasheet documents the reset values and states that MCLK/LRCK changes do not require a PDN/PWN reset because the chip has a built-in reset-free circuit. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260408-ak5365-cache-defaults-v1-1-fff639aca3e3@gmail.com Signed-off-by: Takashi Iwai commit a1bac8b70ede332a05487081c7512d2947f3a912 Author: Moshe Shemesh Date: Fri Apr 3 12:00:28 2026 +0300 net/mlx5: Add icm_mng_function_id_mode cap bit Introduce the capability bit icm_mng_function_id_mode to indicate that the device firmware uses vhca_id instead of function_id as the effective identifier for the firmware commands MANAGE_PAGES, QUERY_PAGES, and page request event. Signed-off-by: Moshe Shemesh Reviewed-by: Akiva Goldberger Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260403090028.137783-3-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit f9e3bd43d55f24331e5ea65f667dbb33716e7d6b Author: Moshe Shemesh Date: Fri Apr 3 12:00:27 2026 +0300 net/mlx5: Rename MLX5_PF page counter type to MLX5_SELF The MLX5_PF enum value in mlx5_func_type is used to track firmware page allocations for the page manager function itself, which is either the ECPF on SmartNIC systems or the host PF when there is no ECPF. Rename it to MLX5_SELF to accurately reflect that this counter tracks pages allocated by the manager for its own use, regardless of whether it is a PF or ECPF. Signed-off-by: Moshe Shemesh Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260403090028.137783-2-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 90700e10d2ad61c13a5117cfa5e08d9f2e497dcc Author: Mukesh Ojha Date: Wed Apr 8 19:45:48 2026 +0530 pinctrl: qcom: Add Hawi pinctrl driver Add pinctrl driver for TLMM block found in the Hawi SoC. Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Reviewed-by: Bjorn Andersson Signed-off-by: Linus Walleij commit ec25710ce8c55295b92f3547a71f376350ad2048 Author: Mukesh Ojha Date: Wed Apr 8 19:45:47 2026 +0530 dt-bindings: pinctrl: qcom: Describe Hawi TLMM block The Top Level Mode Multiplexer (TLMM) in the Qualcomm Hawi SoC provides GPIO and pinctrl functionality for UFS, SDC and 226 GPIO pins. Add a DeviceTree binding to describe the TLMM block on Qualcomm's Hawi SoC. Signed-off-by: Mukesh Ojha Reviewed-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit c43b91eef8eaf29ee895ab1becb799279bc789d6 Author: Svyatoslav Ryhel Date: Mon Apr 6 10:51:14 2026 +0300 dt-bindings: pinctrl: pinctrl-max77620: convert to DT schema Convert pinctrl-max77620 devicetree bindings for the MAX77620 PMIC from TXT to YAML format. This patch does not change any functionality; the bindings remain the same. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Signed-off-by: Linus Walleij commit 5bcd451286176202f4ba84b89fd98c7ea74f33a2 Author: Shi Hao Date: Wed Apr 8 15:03:13 2026 +0530 dt-bindings: gpio: cavium,thunder-8890: Remove DT binding Remove the cavium,thunder-8890 GPIO binding as there are no active use cases. The binding is unused as the corresponding kernel driver binds via PCI and not the compatible. Signed-off-by: Shi Hao Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260408093313.17025-1-i.shihao.999@gmail.com [Bartosz: tweaked the commit message] Signed-off-by: Bartosz Golaszewski commit 6ea7185731ada6bb0633f3347fc8eb2a013e54c7 Author: Florian Fainelli Date: Tue Apr 7 16:56:11 2026 -0700 pinctrl: single: Add bcm7038-padconf compatible matching Just like the TI J7200 padconf, we lose the context and therefore need to save it and restore it across suspend/resume states. Signed-off-by: Florian Fainelli [linusw@kernel.org: rebased on am62l changes] Signed-off-by: Linus Walleij commit ee2d43699e255fa8f2c5e4b1c4d2d783ca3047b6 Author: Florian Fainelli Date: Tue Apr 7 16:56:10 2026 -0700 dt-bindings: pinctrl: pinctrl-single: Add brcm,bcm7038-padconf Add the "brcm,bcm7038-padconf" compatible to the pinctrl-single binding. Signed-off-by: Florian Fainelli Acked-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit 4ef01cf208367014ceac7b81f60515a66b3f2ce5 Author: Janne Grunau Date: Fri Mar 20 13:23:23 2026 +0100 dt-bindings: pinctrl: apple,pinctrl: Add t8122 compatible The pin controller on the Apple silicon t8122 (M3) SoC is compatible with the existing driver. Add "apple,t8122-pinctrl" as SoC specific compatible under "apple,t8103-pinctrl" used by the driver. Signed-off-by: Janne Grunau Acked-by: Rob Herring (Arm) Reviewed-by: Linus Walleij Reviewed-by: Neal Gompa Reviewed-by: Joshua Peisach Signed-off-by: Linus Walleij commit 98cf7df6e0844f7076df1db690c1ede9d69b61ff Author: Hongling Zeng Date: Thu Apr 2 17:34:03 2026 +0800 fbdev: omap2: fix inconsistent lock returns in omapfb_mmap Fix the warning about inconsistent returns for '&rg->lock' in omapfb_mmap() function. The warning arises because the error path uses 'ofbi->region' while the normal path uses 'rg'. smatch warnings: drivers/video/fbdev/omap2/omapfb/omapfb-main.c:1126 omapfb_mmap() warn: inconsistent returns '&rg->lock'. Reported-by: kernel test robot Signed-off-by: Hongling Zeng Signed-off-by: Helge Deller commit 00e6d608fe80b0f68c325cb46862f78e9a8ec768 Author: Gabor Juhos Date: Mon Mar 30 17:25:17 2026 +0200 arm64: dts: marvell: armada-37xx: swap PHYs' order in USB3 controller node It seems that the Armada 3700 is the only platform where the USB3 specific PHY is defined before the USB2 specific one in the device tree: $ git grep -E 'phy-names[ \t]*=[ \t]*"usb3-phy"[ \t]*,' next-20260327 -- *.dts *.dtsi | tr '\t' ' ' next-20260327:arch/arm64/boot/dts/marvell/armada-37xx.dtsi: phy-names = "usb3-phy", "usb2-utmi-otg-phy"; In contrary to this, there are 93 other platforms/boards where 'usb2-phy' is defined first: $ git grep -E 'phy-names[ \t]*=[ \t]*"usb2-phy"[ \t]*,' next-20260327 -- *.dts *.dtsi | wc -l 93 Swap the order of the USB3 and USB2 PHYs to follow the common pattern used on other platforms. No functional changes intended. Signed-off-by: Gabor Juhos Signed-off-by: Gregory CLEMENT commit 0fef19844624f8bc07651b4d26088d8940affba3 Author: Gabor Juhos Date: Mon Mar 30 17:25:16 2026 +0200 arm64: dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's phy-names Instead of the generic 'usb2-phy' name, the Armada 37xx device trees are using a custom 'usb2-utmi-otg-phy' name for the USB2 PHY in the USB3 controller node. Since commit 53a2d95df836 ("usb: core: add phy notify connect and disconnect"), this triggers a bug [1] in the USB core which causes double use of the USB3 PHY. Change the PHY name to 'usb2-phy' in the SoC and in the uDPU specific dtsi files in order to avoid triggering the bug and also to keep the names in line with the ones used by other platforms. Link: https://lore.kernel.org/r/20260330-usb-avoid-usb3-phy-double-use-v1-1-d2113aecb535@gmail.com # [1] Fixes: 53a2d95df836 ("usb: core: add phy notify connect and disconnect") Signed-off-by: Gabor Juhos Signed-off-by: Gregory CLEMENT commit 3bea4a0ee8188c2702f0536fbffbc44d3eb9e619 Author: Thomas Zimmermann Date: Thu Apr 9 09:26:09 2026 +0200 MAINTAINERS: Add dedicated entry for fbcon Add an own entry for the framebuffer console code, which is jointly used by the fbdev and DRM drivers. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 4aa0deae1070690d08c1f47c489f8b5ce3f6ea6d Author: Thadeu Lima de Souza Cascardo Date: Wed Apr 8 16:31:00 2026 -0300 drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs Commit 02f64b2d8605 ("drm/vram: drop DRM_VRAM_MM_FILE_OPERATIONS") dropped DRM_VRAM_MM_FILE_OPERATIONS in preference for using DEFINE_DRM_GEM_OPS. However, it was not dropped from the kernel docs. Use DEFINE_DRM_GEM_OPS in the illustration on how to define a struct file_operations for such a DRM driver and remove any reference to DRM_VRAM_MM_FILE_OPERATIONS. Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Thomas Zimmermann Fixes: 02f64b2d8605 ("drm/vram: drop DRM_VRAM_MM_FILE_OPERATIONS") Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260408-drm_gem_vram_helper_docs-v1-1-4d667a768f75@igalia.com commit bd64240dc88caaf7b96dd869f36f165f51b52039 Author: Bart Van Assche Date: Fri Apr 3 13:53:54 2026 -0700 drm/fb-helper: Fix a locking bug in an error path The name of the function __drm_fb_helper_initial_config_and_unlock() and also the comment above that function make it clear that all code paths in this function should unlock fb_helper->lock before returning. Add a mutex_unlock() call in the only code path where it is missing. This has been detected by the Clang thread-safety analyzer. Cc: Thomas Zimmermann Cc: Christian König # radeon Cc: Dmitry Baryshkov # msm Cc: Javier Martinez Canillas Fixes: 63c971af4036 ("drm/fb-helper: Allocate and release fb_info in single place") Signed-off-by: Bart Van Assche Signed-off-by: Thomas Zimmermann Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260403205355.1181984-1-bvanassche@acm.org commit 1c0220a61508d67a09a6e71eb09593a8aea61822 Merge: 0990a71f678aa0 971f3474f8898a Author: Greg Kroah-Hartman Date: Thu Apr 9 09:21:13 2026 +0200 Merge tag 'coresight-next-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-next Suzuki writes: coresight: Updates for Linux v7.1 CoreSight self hosted tracing subsystem updates for Linux v7.1, includes: - Fix unregistration related issues - Clean up CTI power management and sysfs code - Miscellaneous fixes - MAINTAINERS: Add Leo Yan as Reviewer - MAINTAINERS: Update Mike's email address Signed-off-by: Suzuki K Poulose * tag 'coresight-next-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux: (25 commits) coresight: tpdm: fix invalid MMIO access issue coresight: tpdm: add traceid_show for checking traceid coresight: platform: check the availability of the endpoint before parse coresight: cti: fix the check condition in inout_sel_store MAINTAINERS: coresight: Add Leo Yan as Reviewer coresight: cti: Properly handle negative offsets in cti_reg32_{show|store}() coresight: cti: Remove hw_enabled flag coresight: cti: Remove hw_powered flag coresight: cti: Rename cti_active() to cti_is_active() coresight: cti: Remove CPU power management code coresight: cti: Access ASICCTL only when implemented coresight: cti: Fix register reads coresight: cti: Make spinlock usage consistent drivers/hwtracing/coresight: remove unneeded variable in tmc_crashdata_release() MAINTAINERS: Change e-mail address for reviewer coresight: ctcu: fix the spin_bug coresight: Unify bus unregistration via coresight_unregister() coresight: Do not mix success path with failure handling coresight: Move sink validation into etm_perf_add_symlink_sink() coresight: Refactor sysfs connection group cleanup ... commit 7fe21f1ef74f2f4b95896789db656c84b22f01c1 Author: Richard Acayan Date: Wed Apr 8 18:30:38 2026 -0400 pinctrl: qcom: sdm670-lpass-lpi: label variables as static These variables are local to the driver and have no need to be exported to the global namespace. Label them as static to fix compiler warnings. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604080950.Mvm8aN0a-lkp@intel.com/ Fixes: 9826035a75da ("pinctrl: qcom: add sdm670 lpi tlmm") Signed-off-by: Richard Acayan Signed-off-by: Linus Walleij commit fa489a77e3267e05df95db96ba98e141ec07cbd9 Author: Eric Biggers Date: Wed Apr 8 20:03:33 2026 -0700 wifi: cfg80211: Explicitly include in michael-mic.c This happened to be included transitively via a long chain starting with , but it's less fragile to include it explicitly. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260409030333.13024-1-ebiggers@kernel.org Signed-off-by: Johannes Berg commit de65275fc94e2e0acc79bd016d60889bf251ccd9 Author: Zhang Heng Date: Thu Apr 9 10:40:28 2026 +0800 ALSA: hda/realtek: Add quirk for CSL Unity BF24B The CSL Unity BF24B all-in-one PC uses a Realtek ALC662 rev3 audio codec and requires the correct GPIO configuration to enable sound output from both the speakers and the headphone. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221258 Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260409024028.1297587-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 3f44bccdd6605d5d156c02ea2f861dcd30ef5dcd Merge: 292286b2d229fb 00afb1811fa638 Author: Takashi Iwai Date: Thu Apr 9 08:31:21 2026 +0200 Merge branch 'for-linus' into for-next Pull 7.0-devel branch for further development of HD-audio codec quirks. Signed-off-by: Takashi Iwai commit b80777aef570ac561977d7210d04890f9df7e484 Author: Andrew Donnellan Date: Mon Dec 8 16:13:33 2025 +1100 mailmap: Add entry for Andrew Donnellan I'm leaving IBM in January 2026. Add mailmap aliases to switch to using my personal email for now. (I will send a patch to update MAINTAINERS soon, hopefully after I can get someone to replace me.) Signed-off-by: Andrew Donnellan Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251208-mailmap-v1-1-524d5b9d175b@linux.ibm.com commit 4cf1f549bbcdfea9c20df52994bb342677472dcd Author: Thomas Richter Date: Wed Apr 8 13:31:43 2026 +0200 perf test: Make perf trace BTF general tests exclusive Running both tests cases 126 128 together causes the first test case 126 to fail: # for i in $(seq 3); do ./perf test 'perf trace BTF general tests' \ 'perf trace record and replay'; done 126: perf trace BTF general tests : FAILED! 128: perf trace record and replay : Ok 126: perf trace BTF general tests : FAILED! 128: perf trace record and replay : Ok 126: perf trace BTF general tests : FAILED! 128: perf trace record and replay : Ok # Test case 126 fails because test case 128 runs concurrently as can be observed using a ps -ef | grep perf output list on a different window. Both do a perf trace command concurrently. Make test case 'perf trace BTF general tests' exclusive. Output after: # for i in $(seq 3); do ./perf test 'perf trace BTF general tests' \ 'perf trace record and replay'; done 127: perf trace BTF general tests : Ok 155: perf trace record and replay : Ok 127: perf trace BTF general tests : Ok 155: perf trace record and replay : Ok 127: perf trace BTF general tests : Ok 155: perf trace record and replay : Ok # Signed-off-by: Thomas Richter Acked-by: Howard Chu Signed-off-by: Namhyung Kim commit 58dd34dbd5b09749f33337296e76db54b2274bcc Merge: 5ae4ba98d72509 78c327c1728de3 Author: Jakub Kicinski Date: Wed Apr 8 19:55:43 2026 -0700 Merge branch 'devlink-add-per-port-resource-support' Tariq Toukan says: ==================== devlink: add per-port resource support This series by Or adds devlink per-port resource support: Currently, devlink resources are only available at the device level. However, some resources are inherently per-port, such as the maximum number of subfunctions (SFs) that can be created on a specific PF port. This limitation prevents user space from obtaining accurate per-port capacity information. This series adds infrastructure for per-port resources in devlink core and implements it in the mlx5 driver to expose the max_SFs resource on PF devlink ports. Patch #1 refactors resource functions to be generic Patch #2 adds port-level resource registration infrastructure Patch #3 registers SF resource on PF port representor in mlx5 Patch #4 adds devlink port resource registration to netdevsim for testing Patch #5 adds dump support for device-level resources Patch #6 includes port resources in the resource dump dumpit path Patch #7 adds port-specific option to resource dump doit path Patch #8 adds selftest for devlink port resource doit Patch #9 documents port-level resources and full dump Patch #10 adds resource scope filtering to resource dump Patch #11 adds selftest for resource dump and scope filter Patch #12 documents resource scope filtering ==================== Link: https://patch.msgid.link/20260407194107.148063-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 78c327c1728de377020672d429250c80a8a13723 Author: Or Har-Toov Date: Tue Apr 7 22:41:07 2026 +0300 devlink: Document resource scope filtering Document the scope parameter for devlink resource show, which allows filtering the dump to device-level or port-level resources only. Signed-off-by: Or Har-Toov Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-13-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 2a8e91235254862aa1d99434c6105aec65cd8e42 Author: Or Har-Toov Date: Tue Apr 7 22:41:06 2026 +0300 selftest: netdevsim: Add resource dump and scope filter test Add resource_dump_test() which verifies dumping resources for all devices and ports, and tests that scope=dev returns only device-level resources and scope=port returns only port resources. Skip if userspace does not support the scope parameter. Signed-off-by: Or Har-Toov Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-12-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 1bc45341a6ea4009ee9f2fbca9096b33a9ef71a2 Author: Or Har-Toov Date: Tue Apr 7 22:41:05 2026 +0300 devlink: Add resource scope filtering to resource dump Allow filtering the resource dump to device-level or port-level resources using the 'scope' option. Example - dump only device-level resources: $ devlink resource show scope dev pci/0000:03:00.0: name max_local_SFs size 128 unit entry dpipe_tables none name max_external_SFs size 128 unit entry dpipe_tables none pci/0000:03:00.1: name max_local_SFs size 128 unit entry dpipe_tables none name max_external_SFs size 128 unit entry dpipe_tables none Example - dump only port-level resources: $ devlink resource show scope port pci/0000:03:00.0/196608: name max_SFs size 128 unit entry dpipe_tables none pci/0000:03:00.0/196609: name max_SFs size 128 unit entry dpipe_tables none pci/0000:03:00.1/196708: name max_SFs size 128 unit entry dpipe_tables none pci/0000:03:00.1/196709: name max_SFs size 128 unit entry dpipe_tables none Signed-off-by: Or Har-Toov Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-11-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 170e160a0e7c6396f74279d922bee90902bd16f6 Author: Or Har-Toov Date: Tue Apr 7 22:41:04 2026 +0300 devlink: Document port-level resources and full dump Document the port-level resource support and the option to dump all resources, including both device-level and port-level entries. Signed-off-by: Or Har-Toov Reviewed-by: Shay Drori Reviewed-by: Moshe Shemesh Reviewed-by: Jiri Pirko Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-10-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 3961353771041908cadfdf8b773bfcb19b281b1a Author: Or Har-Toov Date: Tue Apr 7 22:41:03 2026 +0300 selftest: netdevsim: Add devlink port resource doit test Tests that querying a specific port handle returns the expected resource name and size. Signed-off-by: Or Har-Toov Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-9-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 7511ff14f30d264691ec493b09111404aed4aaf4 Author: Or Har-Toov Date: Tue Apr 7 22:41:02 2026 +0300 devlink: Add port-specific option to resource dump doit Allow querying devlink resources per-port via the resource-dump doit handler. When a port-index attribute is provided, only that port's resources are returned. When no port-index is given, only device-level resources are returned, preserving backward compatibility. Signed-off-by: Or Har-Toov Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-8-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 810b76394d69f340c0060260f7167639352b7217 Author: Or Har-Toov Date: Tue Apr 7 22:41:01 2026 +0300 devlink: Include port resources in resource dump dumpit Allow querying devlink resources per-port via the resource-dump dumpit handler. Both device-level and all ports resources are included in the reply. For example: $ devlink resource show pci/0000:03:00.0: name local_max_SFs size 508 unit entry name external_max_SFs size 508 unit entry pci/0000:03:00.0/196608: name max_SFs size 20 unit entry pci/0000:03:00.1: name local_max_SFs size 508 unit entry name external_max_SFs size 508 unit entry pci/0000:03:00.1/262144: name max_SFs size 20 unit entry Signed-off-by: Or Har-Toov Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 11636b550eea9e480fe4ceec8ab7bd8f24b363da Author: Or Har-Toov Date: Tue Apr 7 22:41:00 2026 +0300 devlink: Add dump support for device-level resources Add dumpit handler for resource-dump command to iterate over all devlink devices and show their resources. $ devlink resource show pci/0000:08:00.0: name local_max_SFs size 508 unit entry name external_max_SFs size 508 unit entry pci/0000:08:00.1: name local_max_SFs size 508 unit entry name external_max_SFs size 508 unit entry Signed-off-by: Or Har-Toov Reviewed-by: Shay Drori Reviewed-by: Moshe Shemesh Reviewed-by: Jiri Pirko Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 085b234b28ccf13af96c2465d4b82c3bc46a7885 Author: Or Har-Toov Date: Tue Apr 7 22:40:59 2026 +0300 netdevsim: Add devlink port resource registration Register port-level resources for netdevsim ports to enable testing of the port resource infrastructure. Signed-off-by: Or Har-Toov Reviewed-by: Shay Drori Reviewed-by: Moshe Shemesh Reviewed-by: Jiri Pirko Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 4be8326d817e6d47f8446938408bb2001b799340 Author: Or Har-Toov Date: Tue Apr 7 22:40:58 2026 +0300 net/mlx5: Register SF resource on PF port representor The device-level "resource show" displays max_local_SFs and max_external_SFs without indicating which port each resource belongs to. Users cannot determine the controller number and pfnum associated with each SF pool. Register max_SFs resource on the host PF representor port to expose per-port SF limits. Users can correlate the port resource with the controller number and pfnum shown in 'devlink port show'. Future patches will introduce an ECPF that manages multiple PFs, where each PF has its own SF pool. Example usage: $ devlink resource show pci/0000:03:00.0/196608 pci/0000:03:00.0/196608: name max_SFs size 20 unit entry $ devlink port show pci/0000:03:00.0/196608 pci/0000:03:00.0/196608: type eth netdev pf0hpf flavour pcipf controller 1 pfnum 0 external true splittable false function: hw_addr b8:3f:d2:e1:8f:dc roce enable max_io_eqs 120 We can create up to 20 SFs over devlink port pci/0000:03:00.0/196608, with pfnum 0 and controller 1. Signed-off-by: Or Har-Toov Reviewed-by: Shay Drori Reviewed-by: Moshe Shemesh Reviewed-by: Jiri Pirko Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 6f38acfed5edb398201d9ff127919745cbb331a1 Author: Or Har-Toov Date: Tue Apr 7 22:40:57 2026 +0300 devlink: Add port-level resource registration infrastructure The current devlink resource infrastructure supports only device-level resources. Some hardware resources are associated with specific ports rather than the entire device, and today we have no way to show resource per-port. Add support for registering resources at the port level. Signed-off-by: Or Har-Toov Reviewed-by: Shay Drori Reviewed-by: Moshe Shemesh Reviewed-by: Jiri Pirko Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 7be3163c49b24bf923d32f333096963159e03a14 Author: Or Har-Toov Date: Tue Apr 7 22:40:56 2026 +0300 devlink: Refactor resource functions to be generic Currently the resource functions take devlink pointer as parameter and take the resource list from there. Allow resource functions to work with other resource lists that will be added in next patches and not only with the devlink's resource list. Signed-off-by: Or Har-Toov Reviewed-by: Shay Drori Reviewed-by: Moshe Shemesh Reviewed-by: Jiri Pirko Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260407194107.148063-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 5ae4ba98d72509a4da592751be4d6b4dbfa8cac8 Author: Leon Hwang Date: Mon Apr 6 15:26:54 2026 +0800 selftests/drivers/net: Add an xdp test to xdp.py In "bpf: Disallow freplace on XDP with mismatched xdp_has_frags values" [1], this XDP test is suggested to add to xdp.py. 1. Verify the failure of updating frag-capable prog with non-frag-capable prog, when the frag-capable prog attaches to mtu=9k driver. The test has been verified against Mellanox CX6 and Intel 82599ES NICs. With dropping other tests, here is the test log. # ethtool -i eth0 driver: mlx5_core version: 6.19.0-061900-generic # NETIF=eth0 python3 xdp.py TAP version 13 1..1 ok 1 xdp.test_xdp_native_update_mb_to_sb # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 # ethtool -i eth0 driver: ixgbe version: 6.19.0-061900-generic # NETIF=eth0 python3 xdp.py TAP version 13 1..1 # CMD: ip link set dev eth0 xdpdrv obj /path/to/tools/testing/selftests/net/lib/xdp_dummy.bpf.o sec xdp.frags # EXIT: 2 # STDERR: RTNETLINK answers: Invalid argument ok 1 xdp.test_xdp_native_update_mb_to_sb # SKIP device does not support multi-buffer XDP # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:1 error:0 Signed-off-by: Leon Hwang Link: https://patch.msgid.link/20260406072655.368173-1-leon.huangfu@shopee.com Signed-off-by: Jakub Kicinski commit 68911235cfd9dc8b42faaa380a20be968e439ec2 Merge: 3723c3b656ad47 da9008674d9658 Author: Jakub Kicinski Date: Wed Apr 8 19:38:55 2026 -0700 Merge branch 'dsa_loop-and-platform_data-cleanups' Vladimir Oltean says: ==================== dsa_loop and platform_data cleanups While working to add some new features to dsa_loop, I gathered a number of cleanup patches. They mostly remove some data structures that became unused after the multi-switch platforms were migrated to the modern DT bindings. ==================== Link: https://patch.msgid.link/20260406212158.721806-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit da9008674d9658de1e9f45d386ff6627313f39f7 Author: Vladimir Oltean Date: Tue Apr 7 00:21:58 2026 +0300 net: dsa: eliminate There is no reason at all to export these data types to the global include directory. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260406212158.721806-5-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit c3b09190e658d3f1c3cd595df3a931962662f8f0 Author: Vladimir Oltean Date: Tue Apr 7 00:21:57 2026 +0300 net: dsa: remove unused platform_data definitions Pretty self-explanatory, nobody needs these. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260406212158.721806-4-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit dc915f375e545cf72421d66ede983d88e298228f Author: Vladimir Oltean Date: Tue Apr 7 00:21:56 2026 +0300 net: dsa: clean up struct dsa_chip_data This has accumulated some fields which are no longer parsed by the core or set by any driver. Remove them. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260406212158.721806-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit b773b9935239e9bec86b96ce91b6ba2252c20b44 Author: Vladimir Oltean Date: Tue Apr 7 00:21:55 2026 +0300 net: dsa: remove struct platform_data This is not used anywhere in the kernel. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260406212158.721806-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 070ec6f691411f27e7a743841bdfb0bf604fbce2 Author: Stefan Hajnoczi Date: Thu Apr 2 14:03:42 2026 -0400 scsi: target: Don't validate ignored fields in PROUT PREEMPT The PERSISTENT RESERVE OUT command's PREEMPT service action provides two different functions: 1. preempting persistent reservations and 2. removing registrations. In the latter case the spec says: b) ignore the contents of the SCOPE field and the TYPE field; The code currently validates the SCOPE and TYPE fields even when PREEMPT is called to remove registrations. This patch achieves spec compliance by validating the SCOPE and TYPE fields only when they will actually be used. To confirm my interpretation of the specification I tested against HPE 3PAR storage and found the TYPE field is indeed ignored in this case. Cc: Maurizio Lombardi Cc: Dmitry Bogdanov Signed-off-by: Stefan Hajnoczi Link: https://patch.msgid.link/20260402180342.126583-1-stefanha@redhat.com Signed-off-by: Martin K. Petersen commit 271aeff266c9ca97eae315d59ef0bfe0e4ce0a94 Author: Li RongQing Date: Tue Mar 31 01:32:45 2026 -0400 scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation Change the memory allocation for qp_cpu_map to use the actual number of CPUs ('nr_cpu_ids') instead of the maximum possible CPUs ('NR_CPUS'). This saves memory on systems where the maximum CPU limit is much higher than the active CPU count. Signed-off-by: Li RongQing Link: https://patch.msgid.link/20260331053245.1839-1-lirongqing@baidu.com Signed-off-by: Martin K. Petersen commit 3723c3b656ad47bcdad8bc2918a3456f9662a6cc Merge: 1a6b3965385a93 7272d8131a9dc9 Author: Jakub Kicinski Date: Wed Apr 8 19:32:05 2026 -0700 Merge branch 'mptcp-autotune-related-improvement' Matthieu Baerts says: ==================== mptcp: autotune related improvement Here are two patches from Paolo that have been crafted a couple of months ago, but needed more validation because they were indirectly causing instabilities in the sefltests. The root cause has been fixed in 'net' recently in commit 8c09412e584d ("selftests: mptcp: more stable simult_flows tests"). These patches refactor the receive space and RTT estimator, overall making DRS more correct while avoiding receive buffer drifting to tcp_rmem[2], which in turn makes the throughput more stable and less bursty, especially with high bandwidth and low delay environments. Note that the first patch addresses a very old issue. 'net-next' is targeted because the change is quite invasive and based on a recent backlog refactor. The 'Fixes' tag is then there more as a FYI, because backporting this patch will quickly be blocked due to large conflicts. ==================== Link: https://patch.msgid.link/20260407-net-next-mptcp-reduce-rbuf-v2-0-0d1d135bf6f6@kernel.org Signed-off-by: Jakub Kicinski commit 7272d8131a9dc9bda39ecbb639986889fee002a6 Author: Paolo Abeni Date: Tue Apr 7 10:45:18 2026 +0200 mptcp: add receive queue awareness in tcp_rcv_space_adjust() This is the MPTCP counter-part of commit ea33537d8292 ("tcp: add receive queue awareness in tcp_rcv_space_adjust()"). Prior to this commit: ESTAB 33165568 0 192.168.255.2:5201 192.168.255.1:53380 \ skmem:(r33076416,rb33554432,t0,tb91136,f448,w0,o0,bl0,d0) After: ESTAB 3279168 0 192.168.255.2:5201 192.168.255.1]:53042 \ skmem:(r3190912,rb3719956,t0,tb91136,f1536,w0,o0,bl0,d0) Same throughput. Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260407-net-next-mptcp-reduce-rbuf-v2-2-0d1d135bf6f6@kernel.org Signed-off-by: Jakub Kicinski commit d2000361e4ddf5047d660a902a3b0ed7520be1e5 Author: Paolo Abeni Date: Tue Apr 7 10:45:17 2026 +0200 mptcp: better mptcp-level RTT estimator The current MPTCP-level RTT estimator has several issues. On high speed links, the MPTCP-level receive buffer auto-tuning happens with a frequency well above the TCP-level's one. That in turn can cause excessive/unneeded receive buffer increase. On such links, the initial rtt_us value is considerably higher than the actual delay, and the current mptcp_rcv_space_adjust() updates msk->rcvq_space.rtt_us with a period equal to the such field previous value. If the initial rtt_us is 40ms, its first update will happen after 40ms, even if the subflows see actual RTT orders of magnitude lower. Additionally: - setting the msk RTT to the maximum among all the subflows RTTs makes DRS constantly overshooting the rcvbuf size when a subflow has considerable higher latency than the other(s). - during unidirectional bulk transfers with multiple active subflows, the TCP-level RTT estimator occasionally sees considerably higher value than the real link delay, i.e. when the packet scheduler reacts to an incoming ACK on given subflow pushing data on a different subflow. - currently inactive but still open subflows (i.e. switched to backup mode) are always considered when computing the msk-level RTT. Address the all the issues above with a more accurate RTT estimation strategy: the MPTCP-level RTT is set to the minimum of all the subflows actually feeding data into the MPTCP receive buffer, using a small sliding window. While at it, also use EWMA to compute the msk-level scaling_ratio, to that MPTCP can avoid traversing the subflow list is mptcp_rcv_space_adjust(). Use some care to avoid updating msk and ssk level fields too often. Fixes: a6b118febbab ("mptcp: add receive buffer auto-tuning") Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260407-net-next-mptcp-reduce-rbuf-v2-1-0d1d135bf6f6@kernel.org Signed-off-by: Jakub Kicinski commit 1a6b3965385a935ffd70275d162f68139bd86898 Author: Jiayuan Chen Date: Tue Apr 7 16:42:18 2026 +0800 net: initialize sk_rx_queue_mapping in sk_clone() sk_clone() initializes sk_tx_queue_mapping via sk_tx_queue_clear() but does not initialize sk_rx_queue_mapping. Since this field is in the sk_dontcopy region, it is neither copied from the parent socket by sock_copy() nor zeroed by sk_prot_alloc() (called without __GFP_ZERO from sk_clone). Commit 03cfda4fa6ea ("tcp: fix another uninit-value (sk_rx_queue_mapping)") attempted to fix this by introducing sk_mark_napi_id_set() with force_set=true in tcp_child_process(). However, sk_mark_napi_id_set() -> sk_rx_queue_set() only writes when skb_rx_queue_recorded(skb) is true. If the 3-way handshake ACK arrives through a device that does not record rx_queue (e.g. loopback or veth), sk_rx_queue_mapping remains uninitialized. When a subsequent data packet arrives with a recorded rx_queue, sk_mark_napi_id() -> sk_rx_queue_update() reads the uninitialized field for comparison (force_set=false path), triggering KMSAN. This was reproduced by establishing a TCP connection over loopback (which does not call skb_record_rx_queue), then attaching a BPF TC program on lo ingress to set skb->queue_mapping on data packets: BUG: KMSAN: uninit-value in tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1875) tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1875) tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2287) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb (net/core/dev.c:6294) process_backlog (net/core/dev.c:6646) __napi_poll (net/core/dev.c:7710) net_rx_action (net/core/dev.c:7929) handle_softirqs (kernel/softirq.c:623) do_softirq (kernel/softirq.c:523) __local_bh_enable_ip (kernel/softirq.c:?) __dev_queue_xmit (net/core/dev.c:?) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output (net/ipv4/ip_output.c:438) __ip_queue_xmit (net/ipv4/ip_output.c:534) __tcp_transmit_skb (net/ipv4/tcp_output.c:1693) tcp_write_xmit (net/ipv4/tcp_output.c:3064) tcp_sendmsg_locked (net/ipv4/tcp.c:?) tcp_sendmsg (net/ipv4/tcp.c:1465) inet_sendmsg (net/ipv4/af_inet.c:865) sock_write_iter (net/socket.c:1195) vfs_write (fs/read_write.c:688) ... Uninit was created at: kmem_cache_alloc_noprof (mm/slub.c:4873) sk_prot_alloc (net/core/sock.c:2239) sk_alloc (net/core/sock.c:2301) inet_create (net/ipv4/af_inet.c:334) __sock_create (net/socket.c:1605) __sys_socket (net/socket.c:1747) Fix this at the root by adding sk_rx_queue_clear() alongside sk_tx_queue_clear() in sk_clone(). Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260407084219.95718-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit e423f1c7195645e18945fba0bd8f0a32e39286e7 Author: Aaron Kling Date: Fri Apr 3 13:41:34 2026 -0500 scsi: ufs: core: Disable timestamp for Kioxia THGJFJT0E25BAIP Kioxia has another product that does not support the qTimestamp attribute. Signed-off-by: Aaron Kling Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260403-thgjfjt0e25baip-no-timestamp-v1-1-1ddb34225133@gmail.com Signed-off-by: Martin K. Petersen commit fff75dba7992d8f63d4df8796baf8114015842cc Author: Ioana Ciornei Date: Tue Apr 7 13:20:58 2026 +0300 selftests: forwarding: lib: rewrite processing of command line arguments The piece of code which processes the command line arguments and populates NETIFS based on them is really unobvious. Rewrite it so that the intention is clear and the code is easy to follow. Suggested-by: Petr Machata Signed-off-by: Ioana Ciornei Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260407102058.867279-1-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski commit 03a5e8ec68d7b2a908c22e1f43e4f168f4b2798c Author: Claudiu Beznea Date: Fri Apr 3 16:31:09 2026 +0300 scsi: mpi3mr: Fix typo Fix typo in "synchronize". Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260403133109.2744351-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Martin K. Petersen commit 686a7587bd0be9407f5ea748edf3d8bb00e5bc72 Author: Florian Fainelli Date: Tue Apr 7 17:18:13 2026 -0700 net: bcmasp: Switch to page pool for RX path This shows an improvement of 1.9% in reducing the CPU cycles and data cache misses. Signed-off-by: Florian Fainelli Reviewed-by: Justin Chen Reviewed-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260408001813.635679-1-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski commit 80b549be27de0f11124c66eaeb5307c7b4582edd Author: Ian Rogers Date: Wed Apr 8 13:38:58 2026 -0700 perf data: Clean up use_stdio and structures use_stdio was associated with struct perf_data and not perf_data_file meaning there was implicit use of fd rather than fptr that may not be safe. For example, in perf_data_file__write. Reorganize perf_data_file to better abstract use_stdio, add kernel-doc and more consistently use perf_data__ accessors so that use_stdio is better respected. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 19a9ed115fda95317c98bef0c716ea8412cd8ce0 Author: Arnaldo Carvalho de Melo Date: Wed Apr 8 14:32:03 2026 -0300 perf tools: Replace basename() calls with perf_basename() As noticed in a sashiko review for a patch adding a missing libgen.h in a file using basename(): https://sashiko.dev/#/patchset/20260402001740.2220481-1-acme%40kernel.org So avoid these subtleties and instead reuse the gnu_basename() function we had in srcline.c, renaming it to perf_basename() and replace basename() calls with it, simplifying several cases by removing now needless strdups. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit fbfb858552fb9a4c869e22f3303c7c7365367509 Author: Arnaldo Carvalho de Melo Date: Wed Apr 8 14:32:02 2026 -0300 perf tools: Use calloc() where applicable Instead of using zalloc(nr_entries * sizeof_entry) that is what calloc() does. In some places where linux/zalloc.h isn't needed, remove it, add when needed and was getting it indirectly. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 7507abd16a05e8b191ed7bed69e075b23111c401 Author: Arnaldo Carvalho de Melo Date: Wed Apr 8 14:32:01 2026 -0300 perf header: Do validation of perf.data HEADER_CPU_DOMAIN_INFO As suggested in an unrelated sashiko review: https://sashiko.dev/#/patchset/20260407195145.2372104-1-acme%40kernel.org " Could a malformed perf.data file provide out-of-bounds values for cpu and domain? These variables are read directly from the file and used as indices for cd_map and cd_map[cpu]->domains without any validation against env->nr_cpus_avail or max_sched_domains. Similar to the issue above, this is an existing lack of validation that becomes apparent when looking at the allocation boundaries. " Validate it. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit fc32ae6df83d78145391bfdaf0e213babad8e93f Author: Arnaldo Carvalho de Melo Date: Wed Apr 8 14:32:00 2026 -0300 perf header: Use a max number of command line args Sashiko suggests we use some reasonable max number of args to avoid overflows when reading perf.data files, do it. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit c89f35def821874d993bb1c033a7c3cbd32bccdb Author: Arnaldo Carvalho de Melo Date: Wed Apr 8 14:31:59 2026 -0300 perf bench: Constify tables Those tables and variables don't change, better capture this by explicitely using 'const'. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 046fd8206d820b71e7870f7b894b46f8a15ae974 Author: Ian Rogers Date: Wed Apr 8 14:31:58 2026 -0300 perf tools: Make more global variables static `make check` will run sparse on the perf code base. A frequent warning is "warning: symbol '...' was not declared. Should it be static?" Go through and make global definitions without declarations static. In some cases it is deliberate due to dlsym accessing the symbol, this change doesn't clean up the missing declarations for perf test suites. Sometimes things can opportunistically be made const. Making somethings static exposed unused functions warnings, so restructuring of ifdefs was necessary for that. These changes reduce the size of the perf binary by 568 bytes. Committer notes: Refreshed the patch, the original one fell thru the cracks, updated the size reduction. Remove the trace-event-scripting.c changes, break the build, noticed with container builds and with sashiko: https://sashiko.dev/#/patchset/20260401215306.2152898-1-acme%40kernel.org Also make two variables static to address another sashiko review comment: https://sashiko.dev/#/patchset/20260402001740.2220481-1-acme%40kernel.org Signed-off-by: Ian Rogers Acked-by: Ankur Arora Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Leo Yan Cc: Masami Hiramatsu Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Yujie Liu Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit e5cce1b9c82fbd48e2f1f7a25a9fad8ee228176f Author: Arnaldo Carvalho de Melo Date: Wed Apr 8 14:31:57 2026 -0300 perf util: Kill die() prototype, dead for a long time In fef2a735167a827a ("perf tools: Kill die()") the die() function was removed, but not the prototype in util.h, now when building with LIBPERL=1, during a 'make -C tools/perf build-test' routine test, it is failing as perl likes die() calls and then this clashes with this remnant, remove it. Fixes: fef2a735167a827a ("perf tools: Kill die()") Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit d3e01be6daab9f76f3c8b0ffd556ed9f18275c22 Author: Arnaldo Carvalho de Melo Date: Wed Apr 8 14:31:56 2026 -0300 perf symbols: Make variable receiving result strrchr() const Fixing: util/symbol.c: In function ‘symbol__config_symfs’: util/symbol.c:2499:20: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers] 2499 | layout_str = strrchr(dir, ','); | With recent gcc/glibc. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 202ab599413c9a66e3e4449886b85c7b21314d50 Author: Eric Dumazet Date: Tue Apr 7 15:07:10 2026 +0000 net: dropreason: add MACVLAN_BROADCAST_BACKLOG and IPVLAN_MULTICAST_BACKLOG ipvlan and macvlan use queues to process broadcast/multicast packets from a work queue. Under attack these queues can drop packets. Add MACVLAN_BROADCAST_BACKLOG drop_reason for macvlan broadcast queue. Add IPVLAN_MULTICAST_BACKLOG drop_reason for ipvlan multicast queue. Use different reasons as some deployments use both ipvlan and macvlan. Also change ipvlan_rcv_frame() to use SKB_DROP_REASON_DEV_READY when the device is not UP. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260407150710.1640747-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit ea25e03da7a79e0413f1606d4a407a97ed41628a Author: Eric Dumazet Date: Tue Apr 7 14:30:53 2026 +0000 codel: annotate data-races in codel_dump_stats() codel_dump_stats() only runs with RTNL held, reading fields that can be changed in qdisc fast path. Add READ_ONCE()/WRITE_ONCE() annotations. Alternative would be to acquire the qdisc spinlock, but our long-term goal is to make qdisc dump operations lockless as much as we can. tc_codel_xstats fields don't need to be latched atomically, otherwise this bug would have been caught earlier. No change in kernel size: $ scripts/bloat-o-meter -t vmlinux.0 vmlinux add/remove: 0/0 grow/shrink: 1/1 up/down: 3/-1 (2) Function old new delta codel_qdisc_dequeue 2462 2465 +3 codel_dump_stats 250 249 -1 Total: Before=29739919, After=29739921, chg +0.00% Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260407143053.1570620-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit dbc2bb4e8742068d3d3dc8ebb46d874e5fd953b8 Author: Aleksander Jan Bajkowski Date: Mon Apr 6 22:12:12 2026 +0200 net: phy: realtek: get rid of magic numbers in rtl8201_config_intr() Replace the magic numbers with defines. Register names were obtained from publicly available documentation[1]. This should make it clear what's going on in the code. 1. RTL8201F/RTL8201FL/RTL8201FN Rev. 1.4 Datasheet Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Daniel Golle Reviewed-by: Nicolai Buchwitz nb@tipi-net.de Link: https://patch.msgid.link/20260406201222.1043396-1-olek2@wp.pl Signed-off-by: Jakub Kicinski commit 1e111c4b3a726df1254670a5cc4868cedb946d37 Author: Yang Xiuwei Date: Mon Mar 30 09:49:52 2026 +0800 scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails If device_add(&sdkp->disk_dev) fails, put_device() runs scsi_disk_release(), which frees the scsi_disk but leaves the gendisk referenced. The device_add_disk() error path in sd_probe() calls put_disk(gd); call put_disk(gd) here to mirror that cleanup. Fixes: 265dfe8ebbab ("scsi: sd: Free scsi_disk device via put_device()") Cc: stable@vger.kernel.org Reviewed-by: John Garry Signed-off-by: Yang Xiuwei Link: https://patch.msgid.link/20260330014952.152776-1-yangxiuwei@kylinos.cn Signed-off-by: Martin K. Petersen commit f81f4e79b192be6c43abb256ea7da3a7dfb7899d Author: Xiang Mei Date: Sat Apr 4 15:04:12 2026 -0700 bonding: remove unused bond_is_first_slave and bond_is_last_slave macros Since commit 2884bf72fb8f ("net: bonding: fix use-after-free in bond_xmit_broadcast()"), bond_is_last_slave() was only used in bond_xmit_broadcast(). After the recent fix replaced that usage with a simple index comparison, bond_is_last_slave() has no remaining callers. bond_is_first_slave() likewise has no callers. Remove both unused macros. Signed-off-by: Xiang Mei Link: https://patch.msgid.link/20260404220412.444753-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski commit bd5c24e4001d39136e1084fc47335c93e4ebbb0d Author: Jakub Kicinski Date: Mon Apr 6 10:53:34 2026 -0700 docs: netdev: improve wording of reviewer guidance Reword the reviewer guidance based on behavior we see on the list. Steer folks: - towards sending tags - away from process issues. Reviewed-by: Joe Damato Reviewed-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260406175334.3153451-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a4f780cd5c7aa8c0d2d044ffd153f7a3a13ca81e Author: Taniya Das Date: Fri Apr 3 16:10:54 2026 +0200 clk: qcom: gcc: Add multiple global clock controller driver for Nord SoC The global clock controller on the Nord SoC is partitioned into GCC, SE_GCC, NE_GCC, and NW_GCC. Introduce driver support for each of these controllers. Signed-off-by: Taniya Das [Shawn: Drop include of as the driver doesn't use any OF APIs] Co-developed-by: Shawn Guo Signed-off-by: Shawn Guo Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20260403-nord-clks-v1-6-018af14979fd@oss.qualcomm.com [bjorn: Added missing .use_rpm to gcc_nord_desc] Signed-off-by: Bjorn Andersson commit 1795654f000568d36ff170a17f5b56df3503ada5 Merge: ea0f90d1ed7d95 c6f85577584b5f Author: Jakub Kicinski Date: Wed Apr 8 18:58:08 2026 -0700 Merge tag 'nf-next-26-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== netfilter: updates for net-next 1) Fix ancient sparse warnings in nf conntrack nat modules, from Sun Jian. 2) Fix typo in enum description, from Jelle van der Waa. 3) remove redundant refetch of netns pointer in nf_conntrack_sip. 4) add a deprecation warning for dccp match. We can extend the deadline later if needed, but plan atm is to remove the feature. 5) remove nf_conntrack_h323 debug code that can read out-of-bounds with malformed messages. This code was commented out, but better remove this. 6+7) add more netlink policy validations in netfilter. This could theoretically cause issues when a client sends e.g. unsupported feature flags that were previously ignored, so we may have to relax some changes. For now, try to be stricter and reject upfront. 8+9) minor code cleanup in nft_set_pipapo (an nftables set backend). 10) Add nftables matching support fro double-tagged vlan and pppoe frames, from Pablo Neira Ayuso. 11) Fix up indentation of debug messages in nf_conntrack_h323 conntrack helper, from David Laight. 12) Add a helper to iterate to next flow action and bail out if the maximum number of actions is reached, also from Pablo. * tag 'nf-next-26-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it netfilter: nf_conntrack_h323: Correct indentation when H323_TRACE defined netfilter: nft_meta: add double-tagged vlan and pppoe support netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow netfilter: nft_set_pipapo: increment data in one step netfilter: nf_tables: add netlink policy based cap on registers netfilter: add more netlink-based policy range checks netfilter: nf_conntrack_h323: remove unreliable debug code in decode_octstr netfilter: add deprecation warning for dccp support netfilter: nf_conntrack_sip: remove net variable shadowing netfilter: nf_tables: Fix typo in enum description netfilter: use function typedefs for __rcu NAT helper hook pointers ==================== Link: https://patch.msgid.link/20260408060419.25258-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit cf6e6ac63c62cb9f60f981dbaebe591bdbee2f46 Author: Prasanna Tolety Date: Fri Apr 3 16:10:53 2026 +0200 clk: qcom: rpmh: Add support for Nord rpmh clocks Add RPMH clock support for the Nord SoC to allow enable/disable of the clocks. Signed-off-by: Taniya Das Signed-off-by: Bartosz Golaszewski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260403-nord-clks-v1-5-018af14979fd@oss.qualcomm.com [bjorn: sorted clk_rpmh_match_table[] addition] Signed-off-by: Bjorn Andersson commit 9d13c7bbee5f789738a645df5868b69da5ae3879 Author: Taniya Das Date: Fri Apr 3 16:10:52 2026 +0200 clk: qcom: Add TCSR clock driver for Nord SoC Add a clock driver for the TCSR clock controller found on Nord SoC, which provides refclks for PCIE, USB, SGMII, UFS subsystems. [Shawn: - Use compatible qcom,nord-tcsrcc - Drop include of as the driver doesn't use any OF APIs] Signed-off-by: Taniya Das Co-developed-by: Shawn Guo Signed-off-by: Shawn Guo Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20260403-nord-clks-v1-4-018af14979fd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 06498d59bb4e10032b1495762a999d640fe4a8dc Author: Taniya Das Date: Fri Apr 3 16:10:51 2026 +0200 dt-bindings: clock: qcom: Add Nord Global Clock Controller Add device tree bindings for the global clock controller on Qualcomm Nord platform. The global clock controller on Nord SoC is divided into multiple clock controllers (GCC,SE_GCC,NE_GCC and NW_GCC). Add each of the bindings to define the clock controllers. Signed-off-by: Taniya Das Signed-off-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260403-nord-clks-v1-3-018af14979fd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8a108047245780ca17667b05a7af600d118ec1d6 Author: Taniya Das Date: Fri Apr 3 16:10:50 2026 +0200 dt-bindings: clock: qcom-rpmhcc: Add support for Nord SoCs Add bindings and update documentation compatible for RPMh clock controller on Nord SoC. Signed-off-by: Taniya Das Signed-off-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260403-nord-clks-v1-2-018af14979fd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 31fcf6995e74117fe235a7a07a6e13077070b4a2 Author: Taniya Das Date: Fri Apr 3 16:10:49 2026 +0200 dt-bindings: clock: qcom: Document the Nord SoC TCSR Clock Controller The Nord SoC TCSR block provides CLKREF clocks for DP, PCIe, UFS, SGMII and USB. Signed-off-by: Taniya Das [Shawn: Use compatible qcom,nord-tcsrcc rather than qcom,nord-tcsr] Signed-off-by: Shawn Guo Signed-off-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260403-nord-clks-v1-1-018af14979fd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1a2f61970a6365ca5fb1a667300348815ae81727 Author: Thomas Weißschuh Date: Wed Apr 8 20:28:00 2026 +0200 scsi: libsas: Delete unused to_dom_device() and to_dev_attr() These macros are unused and to_dev_attr() will conflict with an upcoming centralization of general attribute macros. Signed-off-by: Thomas Weißschuh Reviewed-by: John Garry Link: https://patch.msgid.link/20260408-libsas-cleanup-v1-1-826325bbc0ba@weissschuh.net Signed-off-by: Martin K. Petersen commit 9cf351b289fb2be22491fa3964f99126db67aa08 Author: Li Tian Date: Mon Apr 6 09:53:44 2026 +0800 scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC The storvsc driver has become stricter in handling SRB status codes returned by the Hyper-V host. When using Virtual Fibre Channel (vFC) passthrough, the host may return SRB_STATUS_DATA_OVERRUN for PERSISTENT_RESERVE_IN commands if the allocation length in the CDB does not match the host's expected response size. Currently, this status is treated as a fatal error, propagating Host_status=0x07 [DID_ERROR] to the SCSI mid-layer. This causes userspace storage utilities (such as sg_persist) to fail with transport errors, even when the host has actually returned the requested reservation data in the buffer. Refactor the existing command-specific workarounds into a new helper function, storvsc_host_mishandles_cmd(), and add PERSISTENT_RESERVE_IN to the list of commands where SRB status errors should be suppressed for vFC devices. This ensures that the SCSI mid-layer processes the returned data buffer instead of terminating the command. Signed-off-by: Li Tian Reviewed-by: Long Li Reviewed-by: Laurence Oberman Link: https://patch.msgid.link/20260406015344.12566-1-litian@redhat.com Signed-off-by: Martin K. Petersen commit ea0f90d1ed7d9560d5078e628c3be316dfc4cae9 Merge: b3e69fc3196fc4 05d42dc8ab92aa Author: Jakub Kicinski Date: Wed Apr 8 18:51:54 2026 -0700 Merge tag 'ipsec-next-2026-04-08' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2026-04-08 1) Update outdated comment in xfrm_dst_check(). From kexinsun. 2) Drop support for HMAC-RIPEMD-160 from IPsec. From Eric Biggers. * tag 'ipsec-next-2026-04-08' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next: xfrm: Drop support for HMAC-RIPEMD-160 xfrm: update outdated comment ==================== Link: https://patch.msgid.link/20260408094258.148555-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit e0fcb42bc6f41bab2895757d6610616b3820eff7 Author: Daniel Borkmann Date: Wed Apr 8 21:12:42 2026 +0200 selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs Extend the verifier_ld_ind BPF selftests with subprogs containing ld_{abs,ind} and craft the test in a way where the invalid register read is rejected in the fixed case. Also add a success case each, and add additional coverage related to the BTF return type enforcement. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_ld_ind [...] #611/1 verifier_ld_ind/ld_ind: check calling conv, r1:OK #611/2 verifier_ld_ind/ld_ind: check calling conv, r1 @unpriv:OK #611/3 verifier_ld_ind/ld_ind: check calling conv, r2:OK #611/4 verifier_ld_ind/ld_ind: check calling conv, r2 @unpriv:OK #611/5 verifier_ld_ind/ld_ind: check calling conv, r3:OK #611/6 verifier_ld_ind/ld_ind: check calling conv, r3 @unpriv:OK #611/7 verifier_ld_ind/ld_ind: check calling conv, r4:OK #611/8 verifier_ld_ind/ld_ind: check calling conv, r4 @unpriv:OK #611/9 verifier_ld_ind/ld_ind: check calling conv, r5:OK #611/10 verifier_ld_ind/ld_ind: check calling conv, r5 @unpriv:OK #611/11 verifier_ld_ind/ld_ind: check calling conv, r7:OK #611/12 verifier_ld_ind/ld_ind: check calling conv, r7 @unpriv:OK #611/13 verifier_ld_ind/ld_abs: subprog early exit on ld_abs failure:OK #611/14 verifier_ld_ind/ld_ind: subprog early exit on ld_ind failure:OK #611/15 verifier_ld_ind/ld_abs: subprog with both paths safe:OK #611/16 verifier_ld_ind/ld_ind: subprog with both paths safe:OK #611/17 verifier_ld_ind/ld_abs: reject void return subprog:OK #611/18 verifier_ld_ind/ld_ind: reject void return subprog:OK #611 verifier_ld_ind:OK Summary: 1/18 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260408191242.526279-4-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 9dba0ae973e75051b63cbdd5b3532bb24aa63b3f Author: Daniel Borkmann Date: Wed Apr 8 21:12:41 2026 +0200 bpf: Remove static qualifier from local subprog pointer The local subprog pointer in create_jt() and visit_abnormal_return_insn() was declared static. It is unconditionally assigned via bpf_find_containing_subprog() before every use. Thus, the static qualifier serves no purpose and rather creates confusion. Just remove it. Fixes: e40f5a6bf88a ("bpf: correct stack liveness for tail calls") Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps") Signed-off-by: Daniel Borkmann Acked-by: Anton Protopopov Link: https://lore.kernel.org/r/20260408191242.526279-3-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit ee861486e377edc55361c08dcbceab3f6b6577bd Author: Daniel Borkmann Date: Wed Apr 8 21:12:40 2026 +0200 bpf: Fix ld_{abs,ind} failure path analysis in subprogs Usage of ld_{abs,ind} instructions got extended into subprogs some time ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These are only allowed in subprograms when the latter are BTF annotated and have scalar return types. The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 + exit) from legacy cBPF times. While the enforcement is on scalar return types, the verifier must also simulate the path of abnormal exit if the packet data load via ld_{abs,ind} failed. This is currently not the case. Fix it by having the verifier simulate both success and failure paths, and extend it in similar ways as we do for tail calls. The success path (r0=unknown, continue to next insn) is pushed onto stack for later validation and the r0=0 and return to the caller is done on the fall-through side. Fixes: 09b28d76eac4 ("bpf: Add abnormal return checks.") Reported-by: STAR Labs SG Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260408191242.526279-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 6bd96e40f31dde8f8cd79772b4df0f171cf8a915 Author: Daniel Borkmann Date: Wed Apr 8 21:12:39 2026 +0200 bpf: Propagate error from visit_tailcall_insn Commit e40f5a6bf88a ("bpf: correct stack liveness for tail calls") added visit_tailcall_insn() but did not check its return value. Fixes: e40f5a6bf88a ("bpf: correct stack liveness for tail calls") Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260408191242.526279-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 7aa0f56d4b48fb1a1ed3af11b53ba19901092e0a Author: Eric Biggers Date: Sat Apr 4 13:30:03 2026 -0700 scsi: iscsi_tcp: Remove unneeded selections of CRYPTO and CRYPTO_MD5 As far as I can tell, CRYPTO_MD5 has been unnecessary here ever since it was added by commit c899e4ef96f0 ("[SCSI] open-iscsi/linux-iscsi-5 Initiator: Kconfig update") in 2005. CRYPTO was needed until commit 92186c1455a2 ("scsi: iscsi_tcp: Switch to using the crc32c library"), but is no longer needed. Remove these unnecessary kconfig selections. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260404203003.33738-1-ebiggers@kernel.org Signed-off-by: Martin K. Petersen commit ff1befcb168395481fd6a28d8036b707cb7e7a13 Author: Cheng-Yang Chou Date: Wed Apr 8 07:57:15 2026 +0800 selftests/sched_ext: Improve runner error reporting for invalid arguments Report an error for './runner foo' (positional arg instead of -t) and for './runner -t foo' when the filter matches no tests. Previously both cases produced no error output. Pre-scan the test list before the main loop so the error is reported immediately, avoiding spurious SKIP output from '-s' when no tests match. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit c7cab53f9d5273f0cf2a26bdf178c4e074bdfb50 Author: Varun R Mallya Date: Thu Apr 9 00:31:37 2026 +0530 selftests/bpf: Add test to ensure kprobe_multi is not sleepable Add a selftest to ensure that kprobe_multi programs cannot be attached using the BPF_F_SLEEPABLE flag. This test succeeds when the kernel rejects attachment of kprobe_multi when the BPF_F_SLEEPABLE flag is set. Suggested-by: Leon Hwang Signed-off-by: Varun R Mallya Link: https://lore.kernel.org/r/20260408190137.101418-3-varunrmallya@gmail.com Signed-off-by: Alexei Starovoitov commit 4f64d5b66418b7f5967b7f7614d6107bb1fba705 Author: Kumar Kartikeya Dwivedi Date: Wed Apr 8 04:13:54 2026 +0200 bpf: Make find_linfo widely available Move find_linfo() as bpf_find_linfo() into core.c to allow for its use in the verifier in subsequent patches. Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260408021359.3786905-4-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit fbb98834a9221de850a3b1afd78a25473685f9b5 Author: Kumar Kartikeya Dwivedi Date: Wed Apr 8 04:13:53 2026 +0200 bpf: Extract bpf_get_linfo_file_line Extract bpf_get_linfo_file_line as its own function so that the logic to obtain the file, line, and line number for a given program can be shared in subsequent patches. Reviewed-by: Puranjay Mohan Acked-by: Mykyta Yatsenko Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260408021359.3786905-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit e836ec1819b0cc50e0b45a53b0bdce6c596f0207 Author: Christoph Hellwig Date: Wed Apr 8 08:06:42 2026 +0200 ecryptfs: keep the lower iattr contained in truncate_upper Currently the two callers of truncate_upper handle passing information very differently. ecryptfs_truncate passes a zeroed lower_ia and expects truncate_upper to fill it in from the upper ia created just for that, while ecryptfs_setattr passes a fully initialized lower_ia copied from the upper one. Both of them then call notify_change on the lower_ia. Switch to only passing the upper ia, and derive the lower ia from it inside truncate_upper, and call notify_change inside the function itself. Because the old name is misleading now, rename the resulting function to __ecryptfs_truncate as it deals with both the lower and upper inodes. Signed-off-by: Christoph Hellwig Signed-off-by: Tyler Hicks commit 5d1f0e8cd9482ddb5318f765f7ca508ce707cf83 Author: Christoph Hellwig Date: Wed Apr 8 08:06:41 2026 +0200 ecryptfs: factor out a ecryptfs_iattr_to_lower helper Prepare for using the code to create a lower struct iattr in multiple places. Signed-off-by: Christoph Hellwig Signed-off-by: Tyler Hicks commit 081447ecfc255cb63b6e392cd01d9f684d4df5b8 Author: Christoph Hellwig Date: Wed Apr 8 08:06:40 2026 +0200 ecryptfs: merge ecryptfs_inode_newsize_ok into truncate_upper Both callers of ecryptfs_inode_newsize_ok call truncate_upper right after. Merge ecryptfs_inode_newsize_ok into truncate_upper to simplify the logic. Signed-off-by: Christoph Hellwig Signed-off-by: Tyler Hicks commit 472dea1d2235439c0c25850d53deffc517cc8c61 Author: Christoph Hellwig Date: Wed Apr 8 08:06:39 2026 +0200 ecryptfs: combine the two ATTR_SIZE blocks in ecryptfs_setattr Simplify the logic in ecryptfs_setattr by combining the two ATTR_SIZE blocks. This initializes lower_ia before the size check, which is obviously correct as the size check doesn't look at it. Signed-off-by: Christoph Hellwig Signed-off-by: Tyler Hicks commit b19fe74e0fc970cef90bb78ddb473ae0356bce94 Author: Christoph Hellwig Date: Wed Apr 8 08:06:38 2026 +0200 ecryptfs: use ZERO_PAGE instead of allocating zeroed memory in truncate_upper Use the existing pre-zeroed memory instead of allocating a new chunk. Signed-off-by: Christoph Hellwig Signed-off-by: Tyler Hicks commit b109187378615e683d8d8a24f4bc246bd3fb7b26 Author: Christoph Hellwig Date: Wed Apr 8 08:06:37 2026 +0200 ecryptfs: streamline truncate_upper Use a few strategic gotos to reduce indentation and keep the main flow outside of branches. Switch all touched comments to normal kernel style and avoid breaks in printed strings for all the code touched. Signed-off-by: Christoph Hellwig Signed-off-by: Tyler Hicks commit 8f61364322a07ff6c35691b575d6fbda8e71e29d Author: Christoph Hellwig Date: Wed Apr 8 08:06:36 2026 +0200 ecryptfs: cleanup ecryptfs_setattr Initialize variables at declaration time where applicable and reformat conditionals to match the kernel coding style. Signed-off-by: Christoph Hellwig Signed-off-by: Tyler Hicks commit e353f1beeda3e7037f192235d5bd6abffacb49f6 Author: Sean Christopherson Date: Tue Mar 10 16:48:19 2026 -0700 KVM: SEV: Move SEV-specific VM initialization to sev.c Move SEV+ VM initialization to sev.c (as sev_vm_init()) so that kvm_sev_info (and all usage) can be gated on CONFIG_KVM_AMD_SEV=y without needing more #ifdefs. As a bonus, isolating the logic will make it easier to harden the flow, e.g. to WARN if the vm_type is unknown. No functional change intended (SEV, SEV_ES, and SNP VM types are only supported if CONFIG_KVM_AMD_SEV=y). Link: https://patch.msgid.link/20260310234829.2608037-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 7341500f8b8624616f3760206765b1ea01e2b849 Author: Sean Christopherson Date: Tue Mar 10 16:48:18 2026 -0700 KVM: SEV: Move standard VM-scoped helpers to detect SEV+ guests to sev.c Now that all external usage of the VM-scoped APIs to detect SEV+ guests is gone, drop the stubs provided for CONFIG_KVM_AMD_SEV=n builds and bury the "standard" APIs in sev.c. No functional change intended. Link: https://patch.msgid.link/20260310234829.2608037-11-seanjc@google.com Signed-off-by: Sean Christopherson commit 56906910ea3084cbe82b9078a561130a6203f978 Author: Sean Christopherson Date: Tue Mar 10 16:48:17 2026 -0700 KVM: SEV: Document the SEV-ES check when querying SMM support as "safe" Use the "unsafe" API to check for an SEV-ES+ guest when determining whether or not SMBASE is a supported MSR, i.e. whether or not emulated SMM is supported. This will eventually allow adding lockdep assertings to the APIs for detecting SEV+ VMs without triggering "real" false positives. While svm_has_emulated_msr() doesn't hold kvm->lock, i.e. can get both false positives *and* false negatives, both are completely fine, as the only time the result isn't stable is when userspace is the sole consumer of the result. I.e. userspace can confuse itself, but that's it. No functional change intended. Link: https://patch.msgid.link/20260310234829.2608037-10-seanjc@google.com Signed-off-by: Sean Christopherson commit 138e5f6a3e1172fee8665bc8b1bbe695ba6b2adf Author: Sean Christopherson Date: Tue Mar 10 16:48:16 2026 -0700 KVM: SEV: Add quad-underscore version of VM-scoped APIs to detect SEV+ guests Add "unsafe" quad-underscore versions of the SEV+ guest detectors in anticipation of hardening the APIs via lockdep assertions. This will allow adding exceptions for usage that is known to be safe in advance of the lockdep assertions. Use a pile of underscores to try and communicate that use of the "unsafe" shouldn't be done lightly. No functional change intended. Link: https://patch.msgid.link/20260310234829.2608037-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 5bf92e475311b22598770caa151dea697b63c0cf Author: Sean Christopherson Date: Tue Mar 10 16:48:15 2026 -0700 KVM: SEV: Provide vCPU-scoped accessors for detecting SEV+ guests Provide vCPU-scoped accessors for detecting if the vCPU belongs to an SEV, SEV-ES, or SEV-SNP VM, partly to dedup a small amount of code, but mostly to better document which usages are "safe". Generally speaking, using the VM-scoped sev_guest() and friends outside of kvm->lock is unsafe, as they can get both false positives and false negatives. But for vCPUs, the accessors are guaranteed to provide a stable result as KVM disallows initialization SEV+ state after vCPUs are created. I.e. operating on a vCPU guarantees the VM can't "become" an SEV+ VM, and that it can't revert back to a "normal" VM. This will also allow dropping the stubs for the VM-scoped accessors, as it's relatively easy to eliminate usage of the accessors from common SVM once the vCPU-scoped checks are out of the way. No functional change intended. Link: https://patch.msgid.link/20260310234829.2608037-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 8075360f3b9648abe58bcedcb7a27d83d9bf210d Author: Sean Christopherson Date: Tue Mar 10 16:48:14 2026 -0700 KVM: SEV: Lock all vCPUs for the duration of SEV-ES VMSA synchronization Lock and unlock all vCPUs in a single batch when synchronizing SEV-ES VMSAs during launch finish, partly to dedup the code by a tiny amount, but mostly so that sev_launch_update_vmsa() uses the same logic/flow as all other SEV ioctls that lock all vCPUs. Link: https://patch.msgid.link/20260310234829.2608037-7-seanjc@google.com Signed-off-by: Sean Christopherson commit cb923ee6a80f4e604e6242a4702b59251e61a380 Author: Sean Christopherson Date: Tue Mar 10 16:48:13 2026 -0700 KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish Lock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as allowing userspace to manipulate and/or run a vCPU while its state is being synchronized would at best corrupt vCPU state, and at worst crash the host kernel. Opportunistically assert that vcpu->mutex is held when synchronizing its VMSA (the SEV-ES path already locks vCPUs). Fixes: ad27ce155566 ("KVM: SEV: Add KVM_SEV_SNP_LAUNCH_FINISH command") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260310234829.2608037-6-seanjc@google.com Signed-off-by: Sean Christopherson commit e4bdeaef035135957d2a833c16117e6f6f16260e Author: Rosalie Wanders Date: Sat Mar 7 10:48:25 2026 +0100 HID: sony: add battery status support for Rock Band 4 PS5 guitars This commit adds battery status support for Rock Band 4 PS5 guitars. The data is reported in the same way as the dualsense in hid-playstation except it's located at byte 30. Signed-off-by: Rosalie Wanders Signed-off-by: Jiri Kosina commit 4b9c410e7d6dacef1a27baddb176fece2c6a6a30 Author: Rosalie Wanders Date: Tue Apr 7 21:49:20 2026 +0200 HID: sony: fix style issues This commit fixes inconsistent quirk names and also fixes all the checkpatch.pl issues alongside inconsistent code, it also adds static asserts to assert struct sizes at compile time. Signed-off-by: Rosalie Wanders Signed-off-by: Jiri Kosina commit 2531731e29455a02c6084658155eb3e88388600b Author: Rosalie Wanders Date: Tue Apr 7 21:53:28 2026 +0200 HID: quirks: update hid-sony supported devices hid-sony has been updated with new device support, update the hid_have_special_driver list accordingly. Signed-off-by: Rosalie Wanders Signed-off-by: Jiri Kosina commit 7245b0017d1218042507e2f94129e1873ca29d6d Author: Rosalie Wanders Date: Tue Apr 7 21:46:36 2026 +0200 HID: sony: add support for more instruments This patch adds support for the following instruments: * Rock Band 1/2/3 Wii/PS3 instruments * Rock Band 3 PS3 Pro instruments * DJ Hero Turntable Wii and PS3 instruments are the same besides the vendor and product ID. This patch also fixes the mappings for the existing Guitar Hero instruments. Co-developed-by: Sanjay Govind Signed-off-by: Sanjay Govind Co-developed-by: Brenton Simpson Signed-off-by: Brenton Simpson Signed-off-by: Rosalie Wanders Signed-off-by: Jiri Kosina commit a86ca8698c88461dd5770b638a2e2459f58d370c Author: Vidya Sagar Date: Wed Mar 25 00:39:58 2026 +0530 PCI: tegra194: Add core monitor clock support Add support for Tegra PCIe core clock monitoring. Monitoring tracks rate changes that may occur due to link speed changes and is useful for detecting core clock changes not initiated by software. Parse the monitor clock from device tree and enable it when present. Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260324191000.1095768-8-mmaddireddy@nvidia.com commit 5aed9ab3dff22b8cae6f6ff901dee0a14941f7bc Author: Vidya Sagar Date: Wed Mar 25 00:39:57 2026 +0530 dt-bindings: PCI: tegra194: Add monitor clock support Tegra supports PCIe core clock monitoring for any rate changes that may be happening because of the link speed changes. This is useful in tracking any changes in the core clock that are not initiated by the software. Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Rob Herring (Arm) Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324191000.1095768-7-mmaddireddy@nvidia.com commit acd46d51f22f0d4b83d4e34088e68498110085b5 Author: Vidya Sagar Date: Wed Mar 25 00:39:56 2026 +0530 PCI: tegra194: Enable hardware hot reset mode in Endpoint mode When PCIe link goes down, hardware can retrain the link and try to link up. To enable this feature, program the APPL_CTRL register with hardware hot reset with immediate LTSSM enable mode when the controller is operating in endpoint mode. Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy [mani: commit log] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324191000.1095768-6-mmaddireddy@nvidia.com commit 66861c592af8c2176a36f52e6b3949e8c98e5a8e Author: Vidya Sagar Date: Wed Mar 25 00:39:55 2026 +0530 PCI: tegra194: Enable DMA interrupt Enable DMA interrupt to support Tegra PCIe DMA in both Root Port and Endpoint modes. Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260324191000.1095768-5-mmaddireddy@nvidia.com commit 323a6e370af56c550255aeeb9264d1f493d878a9 Author: Vidya Sagar Date: Wed Mar 25 00:39:54 2026 +0530 PCI: tegra194: Remove IRQF_ONESHOT flag during Endpoint interrupt registration The Tegra PCIe Endpoint controller has a single interrupt line that is shared between multiple interrupt sources: 1. PCIe link state events (link up, hot reset done) 2. Configuration space events (Bus Master Enable changes) 3. DMA completion events The interrupt is currently registered with IRQF_ONESHOT, which keeps the interrupt line masked until the threaded handler completes. That blocks processing of DMA completion events (and other sources) while the threaded handler runs. Removing IRQF_ONESHOT is safe for the following reasons: 1. The hard IRQ handler (tegra_pcie_ep_hard_irq) properly acknowledges and clears all interrupt status bits in hardware before returning. This prevents interrupt storms and ensures the interrupt controller can re-enable the interrupt line immediately. 2. The follow-up commit adds handling in the hard IRQ for DMA completion events. Dropping IRQF_ONESHOT is required so the line is unmasked after the hard IRQ returns and those events can be serviced without being blocked by the threaded handler. 3. The threaded handler (tegra_pcie_ep_irq_thread) only processes link-up notifications and LTR message sending. These operations don't conflict with DMA interrupt processing and don't require the interrupt line to remain masked. This change enables both DMA driver and Endpoint controller driver to share the interrupt line without blocking each other. Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324191000.1095768-4-mmaddireddy@nvidia.com commit f50e0c7d57b08dfbd6a2aab1eed8f99dd8e81377 Author: Vidya Sagar Date: Wed Mar 25 00:39:53 2026 +0530 PCI: tegra194: Calibrate pipe to UPHY for Endpoint mode Calibrate 'Pipe to Universal PHY(UPHY)' (P2U) for the Endpoint controller to request UPHY PLL rate change to 2.5GT/s (Gen 1) during initialization. This helps to reset stale PLL state from the previous bad link state. Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324191000.1095768-3-mmaddireddy@nvidia.com commit 01d36261ae331583e6bc2034e6aa75c101b83e1d Author: Vidya Sagar Date: Wed Mar 25 00:39:52 2026 +0530 PCI: tegra194: Assert CLKREQ# explicitly by default The Root Port's CLKREQ# signal is shared with a downstream PCIe switch and the endpoints behind it. By default, APPL_PINMUX_CLKREQ_OVERRIDE only overrides the CLKREQ# input to the controller (so REFCLK is enabled internally); it does not drive the CLKREQ# output pin low. Some PCIe switches (e.g. Broadcom PCIe Gen4) forward the Root Port's CLKREQ# to their downstream side and expect it to be driven low for REFCLK, even when the switch does not support CLK-PM or ASPM-L1SS. Without driving the output pin low, link-up can fail between the switch and endpoints. Clear APPL_PINMUX_CLKREQ_DEFAULT_VALUE so the CLKREQ# output pad is explicitly driven low. That makes the shared CLKREQ# line low on the wire and avoids link-up issues with such switches. Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Vidya Sagar Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260324191000.1095768-2-mmaddireddy@nvidia.com commit 34b3eef48d980cd37b876e128bbf314f69fb5d70 Author: Manikanta Maddireddy Date: Wed Mar 25 00:37:55 2026 +0530 PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on When PERST# is deasserted twice (assert -> deassert -> assert -> deassert), a CBB (Control Backbone) timeout occurs at DBI register offset 0x8bc (PCIE_MISC_CONTROL_1_OFF). This happens because pci_epc_deinit_notify() and dw_pcie_ep_cleanup() are called before reset_control_deassert() powers on the controller core. The call chain that causes the timeout: pex_ep_event_pex_rst_deassert() pci_epc_deinit_notify() pci_epf_test_epc_deinit() pci_epf_test_clear_bar() pci_epc_clear_bar() dw_pcie_ep_clear_bar() __dw_pcie_ep_reset_bar() dw_pcie_dbi_ro_wr_en() <- Accesses 0x8bc DBI register reset_control_deassert(pcie->core_rst) <- Core powered on HERE The DBI registers, including PCIE_MISC_CONTROL_1_OFF (0x8bc), are only accessible after the controller core is powered on via reset_control_deassert(pcie->core_rst). Accessing them before this point results in a CBB timeout because the hardware is not yet operational. Fix this by moving pci_epc_deinit_notify() and dw_pcie_ep_cleanup() to after reset_control_deassert(pcie->core_rst), ensuring the controller is fully powered on before any DBI register accesses occur. Fixes: 40e2125381dc ("PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert()") Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324190755.1094879-15-mmaddireddy@nvidia.com commit f59df1d9e6bdb6bd7ef65fb5d200900ac40c20ba Author: Vidya Sagar Date: Wed Mar 25 00:37:54 2026 +0530 PCI: tegra194: Disable L1.2 capability of Tegra234 EP When Tegra234 is operating in the Endpoint mode with L1.2 enabled, PCIe link goes down during L1.2 exit. This is because Tegra234 powers up UPHY PLL immediately without making sure that the REFCLK is stable. This causes UPHY PLL to fail to lock to the correct frequency and leads to link going down. There is no hardware fix for this, hence do not advertise the L1.2 capability in the Endpoint mode. Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support") Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324190755.1094879-14-mmaddireddy@nvidia.com commit 40805f32dceadebb7381d911003100bec7b8cd51 Author: Manikanta Maddireddy Date: Wed Mar 25 00:37:53 2026 +0530 PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well The ECRC (TLP digest) workaround was originally added for DesignWare version 4.90a. Tegra234 SoC has 5.00a DWC HW version, which has the same ATU TD override behaviour, so apply the workaround for 5.00a too. Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support") Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324190755.1094879-13-mmaddireddy@nvidia.com commit ea60ca067f0f098043610c96a915d162113c1aac Author: Manikanta Maddireddy Date: Wed Mar 25 00:37:52 2026 +0530 PCI: tegra194: Use DWC IP core version Tegra194 PCIe driver used custom version numbers to detect Tegra194 and Tegra234 IPs. With version detect logic added, version check results in mismatch warnings: tegra194-pcie 14100000.pcie: Versions don't match (0000562a != 3536322a) Use HW version numbers which match to PORT_LOGIC.PCIE_VERSION_OFF in Tegra194 driver to avoid these kernel warnings. Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support") Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324190755.1094879-12-mmaddireddy@nvidia.com commit 8870f02f7868209eb9bdc5dc53540a6262cf9227 Author: Vidya Sagar Date: Wed Mar 25 00:37:51 2026 +0530 PCI: tegra194: Free up Endpoint resources during remove() Free up the resources during remove() that were acquired by the DesignWare driver for the Endpoint mode during probe(). Fixes: bb617cbd8151 ("PCI: tegra194: Clean up the exit path for Endpoint mode") Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324190755.1094879-11-mmaddireddy@nvidia.com commit c76f8eae7d4695b1176c4ea5eb93c17e16a20272 Author: Vidya Sagar Date: Wed Mar 25 00:37:50 2026 +0530 PCI: tegra194: Allow system suspend when the Endpoint link is not up Host software initiates the L2 sequence. PCIe link is kept in L2 state during suspend. If Endpoint mode is enabled and the link is up, the software cannot proceed with suspend. However, when the PCIe Endpoint driver is probed, but the PCIe link is not up, Tegra can go into suspend state. So, allow system to suspend in this case. Fixes: de2bbf2b71bb ("PCI: tegra194: Don't allow suspend when Tegra PCIe is in EP mode") Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324190755.1094879-10-mmaddireddy@nvidia.com commit b256493bf8cacf0e524bf4c10b5c4901d0c6cefe Author: Vidya Sagar Date: Wed Mar 25 00:37:49 2026 +0530 PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode LTR message should be sent as soon as the Root Port enables LTR in the Endpoint mode. So set snoop and no-snoop LTR timing and LTR message request before the PCIe link comes up, so that the LTR message is sent upstream as soon as LTR is enabled. Without programming these values, the Endpoint would send latencies of 0 to the host, which will be inaccurate. Fixes: c57247f940e8 ("PCI: tegra: Add support for PCIe endpoint mode in Tegra194") Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy [mani: commit log] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20260324190755.1094879-9-mmaddireddy@nvidia.com commit 976f6763f57970388bcd7118931f33f447916927 Author: Vidya Sagar Date: Wed Mar 25 00:37:48 2026 +0530 PCI: tegra194: Disable direct speed change for Endpoint mode Pre-silicon simulation showed the controller operating in Endpoint mode initiating link speed change after completing Secondary Bus Reset. Ideally, the Root Port or the Switch Downstream Port should initiate the link speed change post SBR, not the Endpoint. So, as per the hardware team recommendation, disable direct speed change for the Endpoint mode to prevent it from initiating speed change after the physical layer link is up at Gen1, leaving speed change ownership with the host. Fixes: c57247f940e8 ("PCI: tegra: Add support for PCIe endpoint mode in Tegra194") Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy [mani: commit log] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324190755.1094879-8-mmaddireddy@nvidia.com commit f62bc7917de1374dce86a852ffba8baf9cb7a56a Author: Vidya Sagar Date: Wed Mar 25 00:37:47 2026 +0530 PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" The GPIO DT property "nvidia,refclk-select", to select the PCIe reference clock is optional. Use devm_gpiod_get_optional() to get it. Fixes: c57247f940e8 ("PCI: tegra: Add support for PCIe endpoint mode in Tegra194") Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324190755.1094879-7-mmaddireddy@nvidia.com commit 40658a31b6e134169c648041efc84944c4c71dcd Author: Manikanta Maddireddy Date: Wed Mar 25 00:37:46 2026 +0530 PCI: tegra194: Disable PERST# IRQ only in Endpoint mode The PERST# GPIO interrupt is only registered when the controller is operating in Endpoint mode. In Root Port mode, the PERST# GPIO is configured as an output to control downstream devices, and no interrupt is registered for it. Currently, tegra_pcie_dw_stop_link() unconditionally calls disable_irq() on pex_rst_irq, which causes issues in Root Port mode where this IRQ is not registered. Fix this by only disabling the PERST# IRQ when operating in Endpoint mode, where the interrupt is actually registered and used to detect PERST# assertion/deassertion from the host. Fixes: c57247f940e8 ("PCI: tegra: Add support for PCIe endpoint mode in Tegra194") Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Reviewed-by: Vidya Sagar Link: https://patch.msgid.link/20260324190755.1094879-6-mmaddireddy@nvidia.com commit 71d9f67701e1affc82d18ca88ae798c5361beddf Author: Vidya Sagar Date: Wed Mar 25 00:37:45 2026 +0530 PCI: tegra194: Don't force the device into the D0 state before L2 As per PCIe CEM r6.0, sec 2.3, the PCIe Endpoint device should be in D3cold to assert WAKE# pin. The previous workaround that forced downstream devices to D0 before taking the link to L2 cited PCIe r4.0, sec 5.2, "Link State Power Management"; however, that spec does not explicitly require putting the device into D0 and only indicates that power removal may be initiated without transitioning to D3hot. Remove the D0 workaround so that Endpoint devices can use wake functionality (WAKE# from D3). With some Endpoints the link may not enter L2 when they remain in D3, but the Root Port continues with the usual flow after PME timeout, so there is no functional issue. Fixes: 56e15a238d92 ("PCI: tegra: Add Tegra194 PCIe support") Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Vidya Sagar Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260324190755.1094879-5-mmaddireddy@nvidia.com commit 9fa0c242f8d7acf1b124d4462d18f4023573ac1c Author: Manikanta Maddireddy Date: Wed Mar 25 00:37:44 2026 +0530 PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down After the link reaches a Detect-related LTSSM state, disable LTSSM so it does not keep toggling between Polling and Detect. Do this by polling for the Detect state first, then clearing APPL_CTRL_LTSSM_EN in both tegra_pcie_dw_pme_turnoff() and pex_ep_event_pex_rst_assert(). Fixes: 56e15a238d92 ("PCI: tegra: Add Tegra194 PCIe support") Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260324190755.1094879-4-mmaddireddy@nvidia.com commit 650c54b6a501e169447f14a2af975980f598b662 Merge: 4516432284e1b2 a7a080bb4236eb Author: Dave Airlie Date: Thu Apr 9 07:30:11 2026 +1000 Merge tag 'drm-rust-next-2026-04-06' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-next DRM Rust changes for v7.1-rc1 (2nd) Nova (Core): - Don't create intermediate (mutable) references to the whole command queue buffer, which is potential undefined behavior. - Add missing padding to the falcon firmware DMA buffer to prevent DMA transfers going out of range of the DMA buffer. - Actually set the default values in the bitfield Default implementation. - Use u32::from_le_bytes() instead of manual bit shifts to parse the PCI ROM header. - Fix a missing colon in the SEC2 boot debug message. Signed-off-by: Dave Airlie From: "Danilo Krummrich" Link: https://patch.msgid.link/DHN5GMSIBKO2.2AYOLXDU4X19S@kernel.org commit 929298742bb5dfacd53ea99cf989cc81210f90a3 Merge: 8c6d03b7a249ff 6a7693873b2068 Author: Johannes Berg Date: Wed Apr 8 23:25:13 2026 +0200 Merge tag 'ath-next-20260408' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.1 (PR #4) Add support for an ath10k device-tree quirk to skip host cap QMI requests. ================== Signed-off-by: Johannes Berg commit c1307d18caa819ddc28459d858eb38fdd6c3f8a0 Author: Viacheslav Dubeyko Date: Fri Apr 3 16:05:56 2026 -0700 hfsplus: fix generic/642 failure The xfstests' test-case generic/642 finishes with corrupted HFS+ volume: sudo ./check generic/642 [sudo] password for slavad: FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #26 SMP PREEMPT_DYNAMIC Mon Mar 23 17:24:32 PDT 2026 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/642 6s ... _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent (see xfstests-dev/results//generic/642.full for details) Ran: generic/642 Failures: generic/642 Failed 1 of 1 tests sudo fsck.hfs -d /dev/loop51 ** /dev/loop51 Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. Executing fsck_hfs (version 540.1-Linux). ** Checking non-journaled HFS Plus Volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking multi-linked files. ** Checking catalog hierarchy. ** Checking extended attributes file. invalid free nodes - calculated 1637 header 1260 Invalid B-tree header Invalid map node (8, 0) ** Checking volume bitmap. ** Checking volume information. Verify Status: VIStat = 0x0000, ABTStat = 0xc000 EBTStat = 0x0000 CBTStat = 0x0000 CatStat = 0x00000000 ** Repairing volume. ** Rechecking volume. ** Checking non-journaled HFS Plus Volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking multi-linked files. ** Checking catalog hierarchy. ** Checking extended attributes file. ** Checking volume bitmap. ** Checking volume information. ** The volume untitled was repaired successfully. The fsck tool detected that Extended Attributes b-tree is corrupted. Namely, the free nodes number is incorrect and map node bitmap has inconsistent state. Analysis has shown that during b-tree closing there are still some lost b-tree's nodes in the hash out of b-tree structure. But this orphaned b-tree nodes are still accounted as used in map node bitmap: tree_cnid 8, nidx 0, node_count 1408, free_nodes 1403 tree_cnid 8, nidx 1, node_count 1408, free_nodes 1403 tree_cnid 8, nidx 3, node_count 1408, free_nodes 1403 tree_cnid 8, nidx 54, node_count 1408, free_nodes 1403 tree_cnid 8, nidx 67, node_count 1408, free_nodes 1403 tree_cnid 8, nidx 0, prev 0, next 0, parent 0, num_recs 3, type 0x1, height 0 tree_cnid 8, nidx 1, prev 0, next 0, parent 3, num_recs 1, type 0xff, height 1 tree_cnid 8, nidx 3, prev 0, next 0, parent 0, num_recs 1, type 0x0, height 2 tree_cnid 8, nidx 54, prev 29, next 46, parent 3, num_recs 0, type 0xff, height 1 tree_cnid 8, nidx 67, prev 8, next 14, parent 3, num_recs 0, type 0xff, height 1 This issue happens in hfs_bnode_split() logic during detection the possibility of moving half ot the records out of the node. The hfs_bnode_split() contains a loop that implements a roughly 50/50 split of the B-tree node's records by scanning the offset table to find where the data crosses the node's midpoint. If this logic detects the incapability of spliting the node, then it simply calls hfs_bnode_put() for newly created node. However, node is not set as HFS_BNODE_DELETED and real deletion of node doesn't happen. As a result, the empty node becomes orphaned but it is still accounted as used. Finally, fsck tool detects this inconsistency of HFS+ volume. This patch adds call of hfs_bnode_unlink() before hfs_bnode_put() for the case if new node cannot be used for spliting the existing node. sudo ./check generic/642 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #26 SMP PREEMPT_DYNAMIC Fri Apr 3 12:39:13 PDT 2026 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/642 40s ... 39s Ran: generic/642 Passed all 1 tests Closes: https://github.com/hfs-linux-kernel/hfs-linux-kernel/issues/242 cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260403230556.614171-6-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 732af3aa6337fd56025c0548a9e54d6231052144 Author: Viacheslav Dubeyko Date: Fri Apr 3 16:05:55 2026 -0700 hfsplus: rework logic of map nodes creation in xattr b-tree In hfsplus_init_header_node() when node_count > 63488 (header bitmap capacity), the code calculates map_nodes, subtracts them from free_nodes, and marks their positions used in the bitmap. However, it doesn't write the actual map node structure (type, record offsets, bitmap) for those physical positions, only node 0 is written. This patch reworks hfsplus_create_attributes_file() logic by introducing a specialized method of hfsplus_init_map_node() and writing the allocated map b-tree's nodes by means of hfsplus_write_attributes_file_node() method. cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260403230556.614171-5-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 63584d76765bb3e212f70c4c3951ea785fabef1b Author: Viacheslav Dubeyko Date: Fri Apr 3 16:05:54 2026 -0700 hfsplus: fix logic of alloc/free b-tree node The hfs_bmap_alloc() and hfs_bmap_free() modify the b-tree's counters and nodes' bitmap of b-tree. However, hfs_btree_write() synchronizes the state of in-core b-tree's counters and node's bitmap with b-tree's descriptor in header node. Postponing this synchronization could result in inconsistent state of file system volume. This patch adds calling of hfs_btree_write() in hfs_bmap_alloc() and hfs_bmap_free() methods. cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260403230556.614171-4-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit cd3901f4c0348da84f33b6b6e3e8e9aa7e441d01 Author: Viacheslav Dubeyko Date: Fri Apr 3 16:05:53 2026 -0700 hfsplus: fix error processing issue in hfs_bmap_free() Currently, we check only -EINVAL error code in hfs_bmap_free() after calling the hfs_bmap_clear_bit(). It means that other error codes will be silently ignored. This patch adds the checking of all other error codes. cc: Shardul Bankar cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260403230556.614171-3-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 6dca66d7ba1767d1e8688ee63162eca8d2248e8c Author: Viacheslav Dubeyko Date: Fri Apr 3 16:05:52 2026 -0700 hfsplus: fix potential race conditions in b-tree functionality The HFS_BNODE_DELETED flag is checked in hfs_bnode_put() under locked tree->hash_lock. This patch adds locking for the case of setting the HFS_BNODE_DELETED flag in hfs_bnode_unlink() with the goal to avoid potential race conditions. The hfs_btree_write() method should be called under tree->tree_lock. This patch reworks logic by adding locking the tree->tree_lock for the calls of hfs_btree_write() in hfsplus_cat_write_inode() and hfsplus_system_write_inode(). This patch adds also the lockdep_assert_held() in hfs_bmap_reserve(), hfs_bmap_alloc(), and hfs_bmap_free(). cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260403230556.614171-2-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 74dd8efe4d6cead433162147333af989a568aac7 Author: Manikanta Maddireddy Date: Wed Mar 25 00:37:43 2026 +0530 PCI: tegra194: Increase LTSSM poll time on surprise link down On surprise link down, LTSSM state transits from L0 -> Recovery.RcvrLock -> Recovery.RcvrSpeed -> Gen1 Recovery.RcvrLock -> Detect. Recovery.RcvrLock and Recovery.RcvrSpeed transit times are 24 ms and 48 ms respectively, so the total time from L0 to Detect is ~96 ms. Increase the poll timeout to 120 ms to account for this. While at it, add LTSSM state defines for Detect-related states and use them in the poll condition. Use readl_poll_timeout() instead of readl_poll_timeout_atomic() in tegra_pcie_dw_pme_turnoff() since that path runs in non-atomic context. Fixes: 56e15a238d92 ("PCI: tegra: Add Tegra194 PCIe support") Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260324190755.1094879-3-mmaddireddy@nvidia.com commit adaffed907f14f954096555665ad6af2ae724d83 Author: Vidya Sagar Date: Wed Mar 25 00:37:42 2026 +0530 PCI: tegra194: Fix polling delay for L2 state As per PCIe r7.0, sec 5.3.3.2.1, after sending PME_Turn_Off message, Root Port should wait for 1-10 msec for PME_TO_Ack message. Currently, driver is polling for 10 msec with 1 usec delay which is aggressive. Use existing macro PCIE_PME_TO_L2_TIMEOUT_US to poll for 10 msec with 1 msec delay. Since this function is used in non-atomic context only, use non-atomic poll function. Fixes: 56e15a238d92 ("PCI: tegra: Add Tegra194 PCIe support") Signed-off-by: Vidya Sagar Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Jon Hunter Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260324190755.1094879-2-mmaddireddy@nvidia.com commit 0ec6be95351b00ca95b39e8f0c6bbe0a9615f990 Author: CaoRuichuang Date: Tue Apr 7 00:24:34 2026 +0800 tracing: Report ipi_raise target CPUs as cpumask Bugzilla 217447 points out that ftrace bitmask fields still use the legacy dynamic-array format, which makes trace consumers treat them as unsigned long arrays instead of bitmaps. This is visible in the ipi events today: ipi_send_cpumask already reports its CPU mask as '__data_loc cpumask_t', but ipi_raise still exposes target_cpus as '__data_loc unsigned long[]'. Switch ipi_raise to __cpumask() and the matching helpers so its tracefs format matches the existing cpumask representation used by the other ipi event. The underlying storage size stays the same, but trace data consumers can now recognize the field as a cpumask directly. Link: https://patch.msgid.link/20260406162434.40767-1-create0818@163.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=217447 Signed-off-by: CaoRuichuang Signed-off-by: Steven Rostedt (Google) commit e8368d1f4bedbb0cce4cfe33a1d2664bb0fd4f27 Author: David Carlier Date: Sat Apr 4 14:47:47 2026 +0100 tracefs: Fix default permissions not being applied on initial mount Commit e4d32142d1de ("tracing: Fix tracefs mount options") moved the option application from tracefs_fill_super() to tracefs_reconfigure() called from tracefs_get_tree(). This fixed mount options being ignored on user-space mounts when the superblock already exists, but introduced a regression for the initial kernel-internal mount. On the first mount (via simple_pin_fs during init), sget_fc() transfers fc->s_fs_info to sb->s_fs_info and sets fc->s_fs_info to NULL. When tracefs_get_tree() then calls tracefs_reconfigure(), it sees a NULL fc->s_fs_info and returns early without applying any options. The root inode keeps mode 0755 from simple_fill_super() instead of the intended TRACEFS_DEFAULT_MODE (0700). Furthermore, even on subsequent user-space mounts without an explicit mode= option, tracefs_apply_options(sb, true) gates the mode behind fsi->opts & BIT(Opt_mode), which is unset for the defaults. So the mode is never corrected unless the user explicitly passes mode=0700. Restore the tracefs_apply_options(sb, false) call in tracefs_fill_super() to apply default permissions on initial superblock creation, matching what debugfs does in debugfs_fill_super(). Cc: stable@vger.kernel.org Fixes: e4d32142d1de ("tracing: Fix tracefs mount options") Link: https://patch.msgid.link/20260404134747.98867-1-devnexen@gmail.com Signed-off-by: David Carlier Signed-off-by: Steven Rostedt (Google) commit 30fb45cc2e4aa1b215e0b4f5aeb757128811a3ff Author: muhammed Rishal Date: Fri Apr 3 18:12:26 2026 +0200 bpf: Add fix for Trust Philips SPK6327 (145f:024b) modifier keys The Trust Philips SPK6327 keyboard (USB ID 145f:024b) has a broken HID descriptor on interface 1. Byte 101 is 0x00 (Input Array) but should be 0x02 (Input Variable), causing LCtrl, LAlt, Super, RAlt, RCtrl and RShift to all report as LShift on Linux. This BPF fix patches byte 101 at runtime fixing all affected modifier keys. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/234 Signed-off-by: muhammed Rishal Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit cc3993d3484672635d14a9e5b17ec53920a34407 Author: Benjamin Tissoires Date: Fri Apr 3 18:12:25 2026 +0200 HID: bpf: Add support for the Huion KeyDial K20 over bluetooth When connected over bluetooth this device is just different enough that forcing it into the same source file as the USB connection doesn't gain us much benefit. So let's duplicate this. Code and tests originally produced by Claude code. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/work_items/69 Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/201 Signed-off-by: Peter Hutterer Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit af79443be6c6f1732c2912aa0d50f5bb71c70cf9 Author: Benjamin Tissoires Date: Fri Apr 3 18:12:24 2026 +0200 HID: bpf: add a BPF to get the touchpad type Currently the kernel is scheduled to do this call by itself, but it requires a kernel v6.18 at least to have the INPUT_PROP set. For older kernels, we can try to query the property from a HID-BPF probe, and set a udev property based on that. This way we can provide the information to old kernels without modifying them. Signed-off-by: Benjamin Tissoires Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/220 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit bb8be68d1280eff1abb697136b54576af218b266 Author: Benjamin Tissoires Date: Fri Apr 3 18:12:23 2026 +0200 hid: bpf: hid_bpf_helpers: add helper for having read/write udev properties We want udev-hid-bpf to be able to set udev properties by printing them out after the BPF object has been loaded. This allows to make a query to the device, and set a udev prop based on the answer. Because the way udev works, the properties are cleared on bind/unbind, and we need a way to store them. After several attempts to keep the property alive without re-running the udev-hid-bpf tool to communicate with the device, it came out that HID-BPF maps are pinned in the bpffs and we can then query them. So the following would export a UDEV property in the bpffs: EXPORT_UDEV_PROP(HID_FOO, 32); SEC("syscall") int probe(struct hid_bpf_probe_args *ctx) { const char *foo = "foo"; UDEV_PROP_SPRINTF(HID_FOO, "%s", foo); return 0; } Then, we can debug it with a simple cat: sudo cat /sys/fs/bpf/hid/.../UDEV_PROP_HID_FOO 0: {['f','o','o',],} This way, the property is always accessible without talking to the device Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/220 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit fc778f21a18e79cfb1ad17b7af0478e21ab41daf Author: Benjamin Tissoires Date: Fri Apr 3 18:12:22 2026 +0200 HID: bpf: handle injected report descriptor in HID-BPF udev-hid-bpf is now capable of injecting the parsed report descriptor in the program. Provide the macros required for it. Sync up from udev-hid-bpf commits: bpf: inject the parsed report descriptor in HID_REPORT_DESCRIPTOR hid_bpf_helpers: provide iterator macros for walking the HID report descriptor hid_bpf_helpers: Add extract_bits function bpf: add hid_usages.h bpf: move the report descriptor structs into their own header Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/221 Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/228 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 462240acc5c84a1462fd66f0e0e1ecbbb3613ddb Author: Peter Hutterer Date: Fri Apr 3 18:12:21 2026 +0200 HID: bpf: add helper macros for LE/BE conversion BPF has bpf_htons and friends but those only work with data in Big Endian format. HID is little endian so we need our own macros. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/221 Signed-off-by: Peter Hutterer Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit ed1d6d21c961df2241d0434963c6885036172718 Author: Benjamin Tissoires Date: Fri Apr 3 18:12:20 2026 +0200 HID: bpf: hid_bpf_helpers: provide a cleanup functions Combination of 2 udev-hid-bpf commits: bpf: hid_bpf_helpers: provide a cleanup function for hid_bpf_release_context bpf: helpers: add guard(bpf_spin) macro Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/221 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit e43d74d66b5efad97e62f34cd1ff250add969586 Author: Peter Hutterer Date: Fri Apr 3 18:12:19 2026 +0200 HID: bpf: fix some signed vs unsigned compiler warnings On udev-hid-bpf, we are now getting warnings here, shut them off. Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/227 Signed-off-by: Peter Hutterer Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 1d3225cb5d82680143ffd705088199917ceafd76 Author: Christian Bruel Date: Tue Apr 7 14:04:08 2026 +0200 selftests: pci_endpoint: Skip BAR subrange test on -ENOSPC In pci-epf-test.c, set the STATUS_NO_RESOURCE status bit if pci_epc_set_bar() returns -ENOSPC. This status bit is used to indicate that there are not enough inbound window resources to allocate the subrange. In pci_endpoint_test.c, return -ENOSPC instead of -EIO when STATUS_NO_RESOURCE is set. In pci_endpoint_test.c, skip the BAR subrange test if -ENOSPC, i.e., there are not enough inbound window resources to run the test. Signed-off-by: Christian Bruel [mani: commit log] Signed-off-by: Manivannan Sadhasivam [bhelgaas: squash related commits] Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Reviewed-by: Frank Li Reviewed-by: Koichiro Den Link: https://patch.msgid.link/20260407-skip-bar_subrange-tests-if-enospc-v4-1-6f2e65f2298c@foss.st.com Link: https://patch.msgid.link/20260407-skip-bar_subrange-tests-if-enospc-v4-2-6f2e65f2298c@foss.st.com Link: https://patch.msgid.link/20260407-skip-bar_subrange-tests-if-enospc-v4-3-6f2e65f2298c@foss.st.com commit c5e9f6a96bf7379da87df1b852b90527e242b56f Author: Jens Axboe Date: Wed Apr 8 11:56:02 2026 -0600 io_uring: unify getting ctx from passed in file descriptor io_uring_enter() and io_uring_register() end up having duplicated code for getting a ctx from a passed in file descriptor, for either a registered ring descriptor or a normal file descriptor. Move the io_uring_register_get_file() into io_uring.c and name it a bit more generically, and use it from both callsites rather than have that logic and handling duplicated. Signed-off-by: Jens Axboe commit b4d893d636f435701f025e43146d0a4b9a065102 Author: Jens Axboe Date: Wed Apr 8 11:50:08 2026 -0600 io_uring/register: don't get a reference to the registered ring fd This isn't necessary and was only done because the register path isn't a hot path and hence the extra ref/put doesn't matter, and to have the exit path be able to unconditionally put whatever file was gotten regardless of the type. In preparation for sharing this code with the main io_uring_enter(2) syscall, drop the reference and have the caller conditionally put the file if it was a normal file descriptor. Signed-off-by: Jens Axboe commit 7880174e1e5e88944ea75cf871efd77ec5e3ef51 Author: Jens Axboe Date: Wed Apr 8 11:31:38 2026 -0600 io_uring/tctx: clean up __io_uring_add_tctx_node() error handling Refactor __io_uring_add_tctx_node() so that on error it never leaves current->io_uring pointing at a half-setup tctx. This moves the assignment of current->io_uring to the end of the function post any failure points. Separate out the node installation into io_tctx_install_node() to further clean this up. Signed-off-by: Jens Axboe commit 2c453a4281245135b9e6f1048962272c74853b53 Author: Jens Axboe Date: Wed Apr 8 11:31:05 2026 -0600 io_uring/tctx: have io_uring_alloc_task_context() return tctx Instead of having io_uring_alloc_task_context() return an int and assign tsk->io_uring, just have it return the task context directly. This enables cleaner error handling in callers, which may have failure points post calling io_uring_alloc_task_context(). Signed-off-by: Jens Axboe commit bad44c9c312f07b590ad7be892a95693baba976e Author: Maurizio Lombardi Date: Mon Mar 16 15:39:36 2026 +0100 nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() Executing nvmet_tcp_fatal_error() is generally the responsibility of the caller (nvmet_tcp_try_recv); all other functions should just return the error code. Remove the nvmet_tcp_fatal_error() function, it's not needed anymore. Reviewed-by: Hannes Reinecke Reviewed-by: Chaitanya Kulkarni Signed-off-by: Maurizio Lombardi Signed-off-by: Keith Busch commit ea8e356acb165cb1fd75537a52e1f66e5e76c538 Author: Maurizio Lombardi Date: Mon Mar 16 15:39:35 2026 +0100 nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occurred and that the cmd->recv_msg.msg_iter was left uninitialized. Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA Consequently, the socket receiving loop may attempt to read incoming network data into the uninitialized iterator. Fix this by shifting the error handling responsibility to the callers. Fixes: 52a0a9854934 ("nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec") Reviewed-by: Hannes Reinecke Reviewed-by: Yunje Shin Reviewed-by: Chaitanya Kulkarni Signed-off-by: Maurizio Lombardi Signed-off-by: Keith Busch commit f4ee8a882a560308c390cf45ffa616c59f60a731 Author: Chaitanya Sabnis Date: Fri Mar 27 14:51:06 2026 +0530 ASoC: dt-bindings: hisilicon: Convert hi6210 I2S to dt-schema Convert the Hisilicon hi6210 I2S controller hardware binding from legacy plain text to modern YAML dt-schema format. During the conversion, the order of the dma-names properties in the example was corrected to "tx", "rx" to match the official property description, resolving a contradiction in the original text binding. Signed-off-by: Chaitanya Sabnis Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260327092106.4233-1-chaitanya.msabnis@gmail.com Signed-off-by: Mark Brown commit 9a52d1b7cb4a00a0dde3036b56a9706f54fccbb9 Author: Shenghao Ding Date: Mon Apr 6 18:31:31 2026 +0800 ASoC: tas2781: Explicit association of Device, Device Name, and Device ID By correlating devices with their names and IDs, the driver becomes more discoverable. Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20260406103131.1883-1-shenghao-ding@ti.com Signed-off-by: Mark Brown commit f552b132e4d5248715828e7e5c2bf7889bf05b2e Author: Ian Rogers Date: Tue Apr 7 19:08:38 2026 -0700 perf maps: Fix copy_from that can break sorted by name order When an parent is copied into a child the name array is populated in address not name order. Make sure the name array isn't flagged as sorted. Fixes: 659ad3492b91 ("perf maps: Switch from rbtree to lazily sorted array for addresses") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit c4f3ff3289380437d26177e8f2fe4b7507816ee3 Author: Ian Rogers Date: Tue Apr 7 19:08:37 2026 -0700 perf maps: Fix fixup_overlap_and_insert that can break sorted by name order When an entry in the address array is replaced, the corresponding name entry is replaced. The entries names may sort differently and so it is important that the sorted by name property be cleared on the maps. Fixes: 0d11fab32714 ("perf maps: Fixup maps_by_name when modifying maps_by_address") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit b01741b2854aef073a8106468903aba0cf4f8539 Author: Ian Rogers Date: Tue Apr 7 19:08:36 2026 -0700 perf maps: Move getting debug_file to verbose path Getting debug_file can trigger warnings if not set. Avoid getting these warnings by pushing the use under the controlling if. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 83674a78293f113b47a042d4470c264f6aa54fd5 Author: Thomas Richter Date: Tue Apr 7 12:08:35 2026 +0200 perf addr2line: Remove global variable addr2line_timeout_ms Remove global variable addr2line_timeout_ms and add it as a member to symbol_conf structure. Signed-off-by: Thomas Richter Reviewed-by: Ian Rogers [namhyung: move the initialization to util/symbol.c] Signed-off-by: Namhyung Kim commit 59f6de4e8f2295f8beb2857d8b87e67218e63538 Author: Thomas Richter Date: Tue Apr 7 12:08:34 2026 +0200 perf config: Make symbol_conf::addr2line_disable_warn configurable Make symbol_conf::addr2line_disable_warn configurable by reading the perfconfig file. Use section core and addr2line-disable-warn = value. Update documentation. Example: # perf config -l core.addr2line-timeout=5000 core.addr2line-disable-warn=1 # Signed-off-by: Thomas Richter Reviewed-by: Ian Rogers Suggested-by: Namhyung Kim Signed-off-by: Namhyung Kim commit bb7aeeaa2106c6cc31cc88a513249bb80018535d Author: Thomas Richter Date: Tue Apr 7 12:08:33 2026 +0200 perf config: Rename symbol_conf::disable_add2line_warn Rename member symbol_conf::disable_add2line_warn to symbol_conf::addr2line_disable_warn to make it consistent with other addr2line_xxx constants. Signed-off-by: Thomas Richter Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 875115b82c295277b81b6dfee7debc725f44e854 Author: Seungjin Bae Date: Wed Apr 8 09:03:59 2026 -0700 Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() The `ims_pcu_process_data()` processes incoming URB data byte by byte. However, it fails to check if the `read_pos` index exceeds IMS_PCU_BUF_SIZE. If a malicious USB device sends a packet larger than IMS_PCU_BUF_SIZE, `read_pos` will increment indefinitely. Moreover, since `read_pos` is located immediately after `read_buf`, the attacker can overwrite `read_pos` itself to arbitrarily control the index. This manipulated `read_pos` is subsequently used in `ims_pcu_handle_response()` to copy data into `cmd_buf`, leading to a heap buffer overflow. Specifically, an attacker can overwrite the `cmd_done.wait.head` located at offset 136 relative to `cmd_buf` in the `ims_pcu_handle_response()`. Consequently, when the driver calls `complete(&pcu->cmd_done)`, it triggers a control flow hijack by using the manipulated pointer. Fix this by adding a bounds check for `read_pos` before writing to `read_buf`. If the packet is too long, discard it, log a warning, and reset the parser state. Fixes: 628329d524743 ("Input: add IMS Passenger Control Unit driver") Co-developed-by: Sanghoon Choi Signed-off-by: Sanghoon Choi Signed-off-by: Seungjin Bae Link: https://patch.msgid.link/20251221211442.841549-2-eeodqql09@gmail.com [dtor: factor out resetting packet state, reset checksum as well] Signed-off-by: Dmitry Torokhov commit 6a7693873b20680a3c33bae0c9f9cb3185f64ade Author: Amit Pundir Date: Tue Apr 7 08:43:55 2026 +0200 wifi: ath10k: Add device-tree quirk to skip host cap QMI requests Some firmware versions do not support the host capability QMI request. Since this request occurs before firmware-N.bin and board-M.bin are loaded, the quirk cannot be expressed in the firmware itself. The root cause is unclear, but there appears to be a generation of firmware that lacks host capability support. Without this quirk, ath10k_qmi_host_cap_send_sync() returns QMI_ERR_MALFORMED_MSG_V01 before loading the firmware. This error is not fatal - Wi-Fi services still come up successfully if the request is simply skipped. Add a device-tree quirk to skip the host capability QMI request on devices whose firmware does not support it. For example, firmware build "QC_IMAGE_VERSION_STRING=WLAN.HL.2.0.c3-00257-QCAHLSWMTPLZ-1" on Xiaomi Poco F1 phone requires this quirk. Suggested-by: Bjorn Andersson Signed-off-by: Amit Pundir Tested-by: Paul Sajna Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Acked-by: Dmitry Baryshkov Signed-off-by: David Heidelberg Link: https://patch.msgid.link/20260407-skip-host-cam-qmi-req-v5-2-dfa8a05c6538@ixit.cz Signed-off-by: Jeff Johnson commit 3d7640b6c371a1795e6d9580695d20caf16be9a4 Author: Amit Pundir Date: Tue Apr 7 08:43:54 2026 +0200 dt-bindings: wireless: ath10k: Add quirk to skip host cap QMI requests Some firmware versions do not support the host-capability QMI request. Since this request occurs before firmware and board files are loaded, the quirk cannot be expressed in the firmware itself and must be described in the device tree. Signed-off-by: Amit Pundir Co-developed-by: David Heidelberg Signed-off-by: David Heidelberg Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260407-skip-host-cam-qmi-req-v5-1-dfa8a05c6538@ixit.cz Signed-off-by: Jeff Johnson commit ee020bf6f14094c9ae434bb37e6957a1fdad513c Author: Wang Wensheng Date: Sun Apr 5 19:42:31 2026 +0800 arm64: kexec: Remove duplicate allocation for trans_pgd trans_pgd would be allocated in trans_pgd_create_copy(), so remove the duplicate allocation before calling trans_pgd_create_copy(). Fixes: 3744b5280e67 ("arm64: kexec: install a copy of the linear-map") Signed-off-by: Wang Wensheng Reviewed-by: Pasha Tatashin Signed-off-by: Catalin Marinas commit b178330b67abb7293b6de28b2a49d49c83962db5 Author: Haoyu Lu Date: Tue Apr 7 11:31:15 2026 +0800 ACPI: AGDI: fix missing newline in error message Add the missing trailing newline to the dev_err() message printed when SDEI event registration fails. This keeps the error output as a properly terminated log line. Fixes: a2a591fb76e6 ("ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device") Reviewed-by: Ilkka Koskinen Signed-off-by: Haoyu Lu Reviewed-by: Hanjun Guo Signed-off-by: Catalin Marinas commit 8d13386c7624dc8bd3caad483875fb9be4044ea0 Author: Mark Rutland Date: Tue Apr 7 14:16:50 2026 +0100 arm64: Check DAIF (and PMR) at task-switch time When __switch_to() switches from a 'prev' task to a 'next' task, various pieces of CPU state are expected to have specific values, such that these do not need to be saved/restored. If any of these hold an unexpected value when switching away from the prev task, they could lead to surprising behaviour in the context of the next task, and it would be difficult to determine where they were configured to their unexpected value. Add some checks for DAIF and PMR at task-switch time so that we can detect such issues. Signed-off-by: Mark Rutland Cc: Andy Lutomirski Cc: Jinjie Ruan Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Vladimir Murzin Cc: Will Deacon Acked-by: Peter Zijlstra (Intel) Signed-off-by: Catalin Marinas commit ae654112eac05f316ef31587fc55e4d7160d0086 Author: Mark Rutland Date: Tue Apr 7 14:16:49 2026 +0100 arm64: entry: Use split preemption logic The generic irqentry code now provides irqentry_exit_to_kernel_mode_preempt() and irqentry_exit_to_kernel_mode_after_preempt(), which can be used where architectures have different state requirements for involuntary preemption and exception return, as is the case on arm64. Use the new functions on arm64, aligning our exit to kernel mode logic with the style of our exit to user mode logic. This removes the need for the recently-added bodge in arch_irqentry_exit_need_resched(), and allows preemption to occur when returning from any exception taken from kernel mode, which is nicer for RT. In an ideal world, we'd remove arch_irqentry_exit_need_resched(), and fold the conditionality directly into the architecture-specific entry code. That way all the logic necessary to avoid preempting from a pseudo-NMI could be constrained specifically to the EL1 IRQ/FIQ paths, avoiding redundant work for other exceptions, and making the flow a bit clearer. At present it looks like that would require a larger refactoring (e.g. for the PREEMPT_DYNAMIC logic), and so I've left that as-is for now. Signed-off-by: Mark Rutland Cc: Andy Lutomirski Cc: Jinjie Ruan Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Vladimir Murzin Cc: Will Deacon Reviewed-by: Jinjie Ruan Acked-by: Peter Zijlstra (Intel) Signed-off-by: Catalin Marinas commit a07b7b214240e1bf3de7067f2f43d88aa8e50c28 Author: Mark Rutland Date: Tue Apr 7 14:16:48 2026 +0100 arm64: entry: Use irqentry_{enter_from,exit_to}_kernel_mode() The generic irqentry code now provides irqentry_enter_from_kernel_mode() and irqentry_exit_to_kernel_mode(), which can be used when an exception is known to be taken from kernel mode. These can be inlined into architecture-specific entry code, and avoid redundant work to test whether the exception was taken from user mode. Use these in arm64_enter_from_kernel_mode() and arm64_exit_to_kernel_mode(), which are only used for exceptions known to be taken from kernel mode. This will remove a small amount of redundant work, and will permit further changes to arm64_exit_to_kernel_mode() in subsequent patches. There should be no funcitonal change as a result of this patch. Signed-off-by: Mark Rutland Cc: Andy Lutomirski Cc: Jinjie Ruan Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Vladimir Murzin Cc: Will Deacon Reviewed-by: Jinjie Ruan Acked-by: Peter Zijlstra (Intel) Signed-off-by: Catalin Marinas commit 6879ef130223f015c9a5a8a0d14d3f6d0464fa21 Author: Mark Rutland Date: Tue Apr 7 14:16:47 2026 +0100 arm64: entry: Consistently prefix arm64-specific wrappers For historical reasons, arm64's entry code has arm64-specific functions named enter_from_kernel_mode() and exit_to_kernel_mode(), which are wrappers for similarly-named functions from the generic irqentry code. Other arm64-specific wrappers have an 'arm64_' prefix to clearly distinguish them from their generic counterparts, e.g. arm64_enter_from_user_mode() and arm64_exit_to_user_mode(). For consistency and clarity, add an 'arm64_' prefix to these functions. There should be no functional change as a result of this patch. Signed-off-by: Mark Rutland Cc: Andy Lutomirski Cc: Jinjie Ruan Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Vladimir Murzin Cc: Will Deacon Reviewed-by: Jinjie Ruan Acked-by: Peter Zijlstra (Intel) Signed-off-by: Catalin Marinas commit 2371bd83b3df9d833191fe58dadb0e69a794a1cd Author: Mark Rutland Date: Tue Apr 7 14:16:46 2026 +0100 arm64: entry: Don't preempt with SError or Debug masked On arm64, involuntary kernel preemption has been subtly broken since the move to the generic irqentry code. When preemption occurs, the new task may run with SError and Debug exceptions masked unexpectedly, leading to a loss of RAS events, breakpoints, watchpoints, and single-step exceptions. Prior to moving to the generic irqentry code, involuntary preemption of kernel mode would only occur when returning from regular interrupts, in a state where interrupts were masked and all other arm64-specific exceptions (SError, Debug, and pseudo-NMI) were unmasked. This is the only state in which it is valid to switch tasks. As part of moving to the generic irqentry code, the involuntary preemption logic was moved such that involuntary preemption could occur when returning from any (non-NMI) exception. As most exception handlers mask all arm64-specific exceptions before this point, preemption could occur in a state where arm64-specific exceptions were masked. This is not a valid state to switch tasks, and resulted in the loss of exceptions described above. As a temporary bodge, avoid the loss of exceptions by avoiding involuntary preemption when SError and/or Debug exceptions are masked. Practically speaking this means that involuntary preemption will only occur when returning from regular interrupts, as was the case before moving to the generic irqentry code. Fixes: 99eb057ccd67 ("arm64: entry: Move arm64_preempt_schedule_irq() into __exit_to_kernel_mode()") Reported-by: Ada Couprie Diaz Reported-by: Vladimir Murzin Signed-off-by: Mark Rutland Cc: Andy Lutomirski Cc: Jinjie Ruan Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Reviewed-by: Jinjie Ruan Acked-by: Peter Zijlstra (Intel) Signed-off-by: Catalin Marinas commit 23528aa3320a74b028e990b5a939fed32a8afc2f Author: Shivaji Kant Date: Mon Apr 6 09:21:32 2026 +0000 nvme: enable PCI P2PDMA support for RDMA transport Enable BLK_FEAT_PCI_P2PDMA on the NVMe when the underlying RDMA controller supports it. Suggested-by: Pranjal Shrivastava Reviewed-by: Pranjal Shrivastava Reviewed-by: Henrique Carvalho Reviewed-by: Christoph Hellwig Signed-off-by: Shivaji Kant Signed-off-by: Keith Busch commit 0a5a94648627a438067fc8a6dd178187ceb112fb Author: Aurelien Aptel Date: Wed Apr 8 09:02:26 2026 +0000 nvmet: introduce new mdts configuration entry Using this port configuration, one will be able to set the Maximum Data Transfer Size (MDTS) for any controller that will be associated to the configured port. The default value remains 0 (no limit). Signed-off-by: Max Gurtovoy Signed-off-by: Aurelien Aptel Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 723277b15ed97185ce6f75abbf19f06e00f0a6f5 Author: Geliang Tang Date: Tue Mar 31 16:17:31 2026 +0800 nvme: add missing MODULE_ALIAS for fabrics transports The generic fabrics layer uses request_module("nvme-%s", opts->transport) to auto-load transport modules. Currently, the nvme-tcp, nvme-rdma, and nvme-fc modules lack MODULE_ALIAS entries for these names, which prevents the kernel from automatically finding and loading them when requested. Reviewed-by: Christoph Hellwig Signed-off-by: Geliang Tang Signed-off-by: Keith Busch commit 484eb2c4cc7f788a68c11abc477c065a79cfc0d6 Author: Johan Hovold Date: Wed Apr 8 10:44:07 2026 +0200 spi: pl022: enable compile testing There seems to be nothing preventing this driver from being compile tested so enable that for wider build coverage. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260408084407.107416-1-johan@kernel.org Signed-off-by: Mark Brown commit f7a78e84446e19c9de9adda85a064f947aefa336 Author: Dmitry Torokhov Date: Thu Aug 8 10:27:31 2024 -0700 Input: ct82c710 - remove driver This is a PS/2 mouse interface chip from Chips & Technologies that was used in TI TravelMate and Gateway Nomad laptops, which used 386 and 486 CPUs. With 486 support being removed from the kernel (and 386 support is long gone) it is time to retire this driver as well. Remove the driver. Link: https://patch.msgid.link/20240808172733.1194442-6-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 2c9e7a5f2e3f398213c0c122c18ffa2f4e192457 Merge: fdca270f8f87ca 9be11435164736 Author: Mark Brown Date: Wed Apr 8 15:57:55 2026 +0100 Add Renesas RZ/G3L RSPI support Biju says: This patch series adds binding and driver support for RSPI IP found on the RZ/G3L SoC. The RSPI is compatible with RZ/V2H RSPI, but has 2 clocks compared to 3 on RZ/V2H. Link: https://patch.msgid.link/20260408085418.18770-1-biju.das.jz@bp.renesas.com commit 9be1143516473694ffd731304198a8b02e832d1d Author: Biju Das Date: Wed Apr 8 09:54:15 2026 +0100 spi: rzv2h-rspi: Add support for RZ/G3L (R9A08G046) Add support for RZ/G3L RSPI. The RZ/G3L variant requires only 2 clocks (pclk + tclk), unlike the RZ/V2H which needs 3. Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20260408085418.18770-3-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown commit 5277c291968d87c6a093f50ef489df9d52cb3ca9 Author: Biju Das Date: Wed Apr 8 09:54:14 2026 +0100 spi: dt-bindings: renesas,rzv2h-rspi: Document RZ/G3L SoC Document RSPI IP found on the RZ/G3L SoC. The RSPI IP is compatible with the RZ/V2H RSPI IP, but has 2 clocks compared to 3 on RZ/V2H. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20260408085418.18770-2-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown commit 86a9e4f4efc0a8dc4490023c6e2bf57fd8080ea3 Author: Dmitry Torokhov Date: Thu Aug 8 10:27:30 2024 -0700 Input: mk712 - remove driver This touchscreen controller was used om Gateway AOL Connected Touchpad released in 2000 and, according to Wikipedia, removed from the market in October 2001 due to slow sales. It looks like it can still be bought on eBay for $1000 but I really doubt anyone will actually use it. Remove the driver. Link: https://patch.msgid.link/20240808172733.1194442-5-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 931e3151dba74786f36a948a8d08490f3657c1f3 Author: Dmitry Torokhov Date: Thu Aug 8 10:27:28 2024 -0700 Input: logibm - remove driver Bus mice use specialized bus interface implemented via an ISA add-in cards. They were superseded by PS/2 and later USB. Kconfig entry for the Logitech bus mice states that they "are rather rare these days". This statement was true in 2002 and is no less true in 2024. Remove the driver. Link: https://patch.msgid.link/20240808172733.1194442-3-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 8291ffa3e51d6a280b9348fcf5ac6cf45abd2fb8 Author: Dmitry Torokhov Date: Thu Aug 8 10:27:27 2024 -0700 Input: inport - remove driver Inport (ATI XL and Microsoft) mice use specialized bus interface implemented via an ISA add-in card. Have been superseded by PS/2 and then USB, and are historical curiosity by now. Remove the driver. Link: https://patch.msgid.link/20240808172733.1194442-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 16bbb5912742ffba347828ddf5b1a297de5bcd58 Author: Thorsten Blum Date: Wed Apr 8 16:19:26 2026 +0200 Input: qt1070 - inline i2c_check_functionality check Inline the i2c_check_functionality() check, since the function returns a boolean status rather than an error code. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260408141926.1181389-4-thorsten.blum@linux.dev Signed-off-by: Dmitry Torokhov commit 512b0f41aab28733fff9fb78f0162224ba581cad Author: Thorsten Blum Date: Wed Apr 8 16:19:25 2026 +0200 Input: qt1050 - inline i2c_check_functionality check Inline the i2c_check_functionality() check, since the function returns a boolean status rather than an error code. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260408141926.1181389-3-thorsten.blum@linux.dev Signed-off-by: Dmitry Torokhov commit d129779da5e3f8878e105fb3ca8519d9ff759a91 Author: Bartosz Golaszewski Date: Fri Apr 3 15:04:55 2026 +0200 Documentation: gpio: update the preferred method for using software node lookup In its current version, the manual for converting of board files from using GPIO lookup tables to software nodes recommends leaving the software nodes representing GPIO controllers as "free-floating", not attached objects and relying on the matching of their names against the GPIO controller's name. This is an abuse of the software node API and makes it impossible to create fw_devlinks between GPIO suppliers and consumers in this case. We want to remove this behavior from GPIOLIB and to this end, work on converting all existing drivers to using "attached" software nodes. Except for a few corner-cases where board files define consumers depending on GPIO controllers described in firmware - where we need to reference a real firmware node from a software node - which requires a more complex approach, most board files can easily be converted to using propert firmware node lookup. Update the documentation to recommend attaching the GPIO chip's software nodes to the actual platform devices and show how to do it. Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260403-doc-gpio-swnodes-v2-1-c705f5897b80@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 408df6213f56f467675dc0ecf156a8bd1984555e Author: Randy Dunlap Date: Mon Apr 6 21:36:48 2026 -0700 dma-fence: correct kernel-doc function parameter @flags 'make htmldocs' complains that dma_fence_unlock_irqrestore() is missing a description of its @flags parameter. The description is there but it is missing a ':' sign. Add that and correct the possessive form of "its". WARNING: ../include/linux/dma-fence.h:414 function parameter 'flags' not described in 'dma_fence_unlock_irqrestore' Fixes: 3e5067931b5d ("dma-buf: abstract fence locking v2") Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20260407043649.2015894-1-rdunlap@infradead.org Reviewed-by: Christian König Signed-off-by: Christian König commit 3f4aa994c0cc3616b8758345508ccddc6f324dfc Author: Kuninori Morimoto Date: Wed Apr 8 05:22:06 2026 +0000 ASoC: amd: acp-da7219-max98357a: tidyup acp_soc_is_rltk_max() acp-da7219-max98357a() user exists behind it. No need to has pre-define. Remove it. And it is local function, add static. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87h5pmvxfm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d0cc5f585f8b140cbab326f0e44f966aab52f2c8 Merge: 2d148a214b24b4 7f9f7c69747426 Author: Jens Axboe Date: Wed Apr 8 06:53:16 2026 -0600 Merge tag 'md-7.1-20260407' of git://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into for-7.1/block Pull MD changes from Yu Kuai: "Bug Fixes: - avoid a sysfs deadlock when clearing array state (Yu Kuai) - validate raid5 journal payloads before reading metadata (Junrui Luo) - fall back to the correct bitmap operations after version mismatches (Yu Kuai) - serialize overlapping writes on writemostly raid1 disks (Xiao Ni) - wake raid456 reshape waiters before suspend (Yu Kuai) - prevent retry_aligned_read() from triggering soft lockups (Chia-Ming Chang) Improvements: - switch raid0 strip zone and devlist allocations to kvmalloc helpers (Gregory Price) - track clean unwritten stripes for proactive RAID5 parity building (Yu Kuai) - speed up initial llbitmap sync with write_zeroes_unmap support (Yu Kuai) Cleanups: - remove the unused static md workqueue definition (Abd-Alrhman Masalkhi)" * tag 'md-7.1-20260407' of git://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: md/raid5: fix soft lockup in retry_aligned_read() md: wake raid456 reshape waiters before suspend md/raid1: serialize overlap io for writemostly disk md/md-llbitmap: optimize initial sync with write_zeroes_unmap support md/md-llbitmap: add CleanUnwritten state for RAID-5 proactive parity building md: add fallback to correct bitmap_ops on version mismatch md/raid5: validate payload size before accessing journal metadata md: remove unused static md_wq workqueue md/raid0: use kvzalloc/kvfree for strip_zone and devlist allocations md: fix array_state=clear sysfs deadlock commit 94b4ae79ebb42a8a6f2124b4d4b033b15a98e4f9 Merge: d77f4792db8be8 03db5f05d4c76d Author: Marc Zyngier Date: Wed Apr 8 12:26:11 2026 +0100 Merge branch kvm-arm64/misc-7.1 into kvmarm-master/next * kvm-arm64/misc-7.1: KVM: arm64: selftests: Avoid testing the IMPDEF behavior KVM: arm64: Destroy stage-2 page-table in kvm_arch_destroy_vm() KVM: arm64: Don't leave mmu->pgt dangling on kvm_init_stage2_mmu() error KVM: arm64: Prevent the host from using an smc with imm16 != 0 Signed-off-by: Marc Zyngier commit d77f4792db8be87bd1ed88c952250c717c1b629c Merge: 83a3980750e3cc 7e629348df81b3 Author: Marc Zyngier Date: Wed Apr 8 12:26:00 2026 +0100 Merge branch kvm-arm64/vgic-fixes-7.1 into kvmarm-master/next * kvm-arm64/vgic-fixes-7.1: : . : FIrst pass at fixing a number of vgic-v5 bugs that were found : after the merge of the initial series. : . KVM: arm64: Advertise ID_AA64PFR2_EL1.GCIE KVM: arm64: vgic-v5: Fold PPI state for all exposed PPIs KVM: arm64: set_id_regs: Allow GICv3 support to be set at runtime KVM: arm64: Don't advertises GICv3 in ID_PFR1_EL1 if AArch32 isn't supported KVM: arm64: Correctly plumb ID_AA64PFR2_EL1 into pkvm idreg handling KVM: arm64: Move GICv5 timer PPI validation into timer_irqs_are_valid() KVM: arm64: Remove evaluation of timer state in kvm_cpu_has_pending_timer() KVM: arm64: Kill arch_timer_context::direct field KVM: arm64: vgic-v5: Correctly set dist->ready once initialised KVM: arm64: vgic-v5: Make the effective priority mask a strict limit KVM: arm64: vgic-v5: Cast vgic_apr to u32 to avoid undefined behaviours KVM: arm64: vgic-v5: Transfer edge pending state to ICH_PPI_PENDRx_EL2 KVM: arm64: vgic-v5: Hold config_lock while finalizing GICv5 PPIs KVM: arm64: Account for RESx bits in __compute_fgt() KVM: arm64: Fix writeable mask for ID_AA64PFR2_EL1 arm64: Fix field references for ICH_PPI_DVIR[01]_EL2 KVM: arm64: Don't skip per-vcpu NV initialisation KVM: arm64: vgic: Don't reset cpuif/redist addresses at finalize time Signed-off-by: Marc Zyngier commit 83a3980750e3cc25cb7ded90f11c157eb3f9f428 Merge: 73bb0bc2f439cd bc20692f528b2a Author: Marc Zyngier Date: Wed Apr 8 12:25:39 2026 +0100 Merge branch kvm-arm64/pkvm-protected-guest into kvmarm-master/next * kvm-arm64/pkvm-protected-guest: (41 commits) : . : pKVM support for protected guests, implementing the very long : awaited support for anonymous memory, as the elusive guestmem : has failed to deliver on its promises despite a multi-year : effort. Patches courtesy of Will Deacon. From the initial cover : letter: : : "[...] this patch series implements support for protected guest : memory with pKVM, where pages are unmapped from the host as they are : faulted into the guest and can be shared back from the guest using pKVM : hypercalls. Protected guests are created using a new machine type : identifier and can be booted to a shell using the kvmtool patches : available at [2], which finally means that we are able to test the pVM : logic in pKVM. Since this is an incremental step towards full isolation : from the host (for example, the CPU register state and DMA accesses are : not yet isolated), creating a pVM requires a developer Kconfig option to : be enabled in addition to booting with 'kvm-arm.mode=protected' and : results in a kernel taint." : . KVM: arm64: Don't hold 'vm_table_lock' across guest page reclaim KVM: arm64: Allow get_pkvm_hyp_vm() to take a reference to a dying VM KVM: arm64: Prevent teardown finalisation of referenced 'hyp_vm' drivers/virt: pkvm: Add Kconfig dependency on DMA_RESTRICTED_POOL KVM: arm64: Rename PKVM_PAGE_STATE_MASK KVM: arm64: Extend pKVM page ownership selftests to cover guest hvcs KVM: arm64: Extend pKVM page ownership selftests to cover forced reclaim KVM: arm64: Register 'selftest_vm' in the VM table KVM: arm64: Extend pKVM page ownership selftests to cover guest donation KVM: arm64: Add some initial documentation for pKVM KVM: arm64: Allow userspace to create protected VMs when pKVM is enabled KVM: arm64: Implement the MEM_UNSHARE hypercall for protected VMs KVM: arm64: Implement the MEM_SHARE hypercall for protected VMs KVM: arm64: Add hvc handler at EL2 for hypercalls from protected VMs KVM: arm64: Return -EFAULT from VCPU_RUN on access to a poisoned pte KVM: arm64: Reclaim faulting page from pKVM in spurious fault handler KVM: arm64: Introduce hypercall to force reclaim of a protected page KVM: arm64: Annotate guest donations with handle and gfn in host stage-2 KVM: arm64: Change 'pkvm_handle_t' to u16 KVM: arm64: Introduce host_stage2_set_owner_metadata_locked() ... Signed-off-by: Marc Zyngier commit 73bb0bc2f439cdc80f3d980cd353c7f4b3115466 Merge: 64f2fa630d7f7e 7aba10efef1d97 Author: Marc Zyngier Date: Wed Apr 8 12:23:58 2026 +0100 Merge branch kvm-arm64/spe-trbe-nvhe into kvmarm-master/next * kvm-arm64/spe-trbe-nvhe: : . : Fix SPE and TRBE nVHE world switch which can otherwise result in : pretty bad behaviours, as they have the nasty habit of performing : out of context speculative page table walks. : : Patches courtesy of Will Deacon. : . KVM: arm64: Don't pass host_debug_state to BRBE world-switch routines KVM: arm64: Disable SPE Profiling Buffer when running in guest context KVM: arm64: Disable TRBE Trace Buffer Unit when running in guest context Signed-off-by: Marc Zyngier commit 64f2fa630d7f7e1b87018a3623a75d11e718db94 Merge: b693940e81318d e9550374d13a4b Author: Marc Zyngier Date: Wed Apr 8 12:23:45 2026 +0100 Merge branch kvm-arm64/user_mem_abort-rework into kvmarm-master/next * kvm-arm64/user_mem_abort-rework: (30 commits) : . : user_mem_abort() has become an absolute pain to maintain, : to the point that each single fix is likely to introduce : *two* new bugs. : : Deconstruct the whole thing in logical units, reducing : the amount of visible and/or mutable state between functions, : and finally making the code a bit more maintainable. : . KVM: arm64: Convert gmem_abort() to struct kvm_s2_fault_desc KVM: arm64: Simplify integration of adjust_nested_*_perms() KVM: arm64: Directly expose mapping prot and kill kvm_s2_fault KVM: arm64: Move device mapping management into kvm_s2_fault_pin_pfn() KVM: arm64: Replace force_pte with a max_map_size attribute KVM: arm64: Move kvm_s2_fault.{pfn,page} to kvm_s2_vma_info KVM: arm64: Restrict the scope of the 'writable' attribute KVM: arm64: Kill logging_active from kvm_s2_fault KVM: arm64: Move VMA-related information to kvm_s2_fault_vma_info KVM: arm64: Kill topup_memcache from kvm_s2_fault KVM: arm64: Kill exec_fault from kvm_s2_fault KVM: arm64: Kill write_fault from kvm_s2_fault KVM: arm64: Constrain fault_granule to kvm_s2_fault_map() KVM: arm64: Replace fault_is_perm with a helper KVM: arm64: Move fault context to const structure KVM: arm64: Make fault_ipa immutable KVM: arm64: Kill fault->ipa KVM: arm64: Clean up control flow in kvm_s2_fault_map() KVM: arm64: Hoist MTE validation check out of MMU lock path KVM: arm64: Optimize early exit checks in kvm_s2_fault_pin_pfn() ... Signed-off-by: Marc Zyngier commit b693940e81318d5cf4432afc97be5e22e541e2fd Merge: e85d1c0cc77b08 54a3cc14545627 Author: Marc Zyngier Date: Wed Apr 8 12:23:24 2026 +0100 Merge branch kvm-arm64/pkvm-psci into kvmarm-master/next * kvm-arm64/pkvm-psci: : . : Cleanup of the pKVM PSCI relay CPU entry code, making it slightly : easier to follow, should someone have to wade into these waters : ever again. : . KVM: arm64: Remove extra ISBs when using msr_hcr_el2 KVM: arm64: pkvm: Use direct function pointers for cpu_{on,resume} KVM: arm64: pkvm: Turn __kvm_hyp_init_cpu into an inner label KVM: arm64: pkvm: Simplify BTI handling on CPU boot KVM: arm64: pkvm: Move error handling to the end of kvm_hyp_cpu_entry Signed-off-by: Marc Zyngier commit e85d1c0cc77b08b21a44912d69d0c0c405b1808c Merge: f8078d51ee232c 570428601ba506 Author: Marc Zyngier Date: Wed Apr 8 12:22:55 2026 +0100 Merge branch kvm-arm64/nv-s2-debugfs into kvmarm-master/next * kvm-arm64/nv-s2-debugfs: : . : Expand the stage-2 ptdump infrastructure to be able to display : the content of the shadow s2 tables generated by nested virt. : : Patches courtesy of Wei-Lin Chang. : . KVM: arm64: ptdump: Initialize parser_state before pgtable walk KVM: arm64: nv: Expose shadow page tables in debugfs KVM: arm64: ptdump: Make KVM ptdump code s2 mmu aware Signed-off-by: Marc Zyngier commit f8078d51ee232c8d4fa552d30e06c641b944e2c2 Merge: 2de32a25a3f721 ce29261ec6482d Author: Marc Zyngier Date: Wed Apr 8 12:22:35 2026 +0100 Merge branch kvm-arm64/vgic-v5-ppi into kvmarm-master/next * kvm-arm64/vgic-v5-ppi: (40 commits) : . : Add initial GICv5 support for KVM guests, only adding PPI support : for the time being. Patches courtesy of Sascha Bischoff. : : From the cover letter: : : "This is v7 of the patch series to add the virtual GICv5 [1] device : (vgic_v5). Only PPIs are supported by this initial series, and the : vgic_v5 implementation is restricted to the CPU interface, : only. Further patch series are to follow in due course, and will add : support for SPIs, LPIs, the GICv5 IRS, and the GICv5 ITS." : . KVM: arm64: selftests: Add no-vgic-v5 selftest KVM: arm64: selftests: Introduce a minimal GICv5 PPI selftest KVM: arm64: gic-v5: Communicate userspace-driveable PPIs via a UAPI Documentation: KVM: Introduce documentation for VGICv5 KVM: arm64: gic-v5: Probe for GICv5 device KVM: arm64: gic-v5: Set ICH_VCTLR_EL2.En on boot KVM: arm64: gic-v5: Introduce kvm_arm_vgic_v5_ops and register them KVM: arm64: gic-v5: Hide FEAT_GCIE from NV GICv5 guests KVM: arm64: gic: Hide GICv5 for protected guests KVM: arm64: gic-v5: Mandate architected PPI for PMU emulation on GICv5 KVM: arm64: gic-v5: Enlighten arch timer for GICv5 irqchip/gic-v5: Introduce minimal irq_set_type() for PPIs KVM: arm64: gic-v5: Initialise ID and priority bits when resetting vcpu KVM: arm64: gic-v5: Create and initialise vgic_v5 KVM: arm64: gic-v5: Support GICv5 interrupts with KVM_IRQ_LINE KVM: arm64: gic-v5: Implement direct injection of PPIs KVM: arm64: Introduce set_direct_injection irq_op KVM: arm64: gic-v5: Trap and mask guest ICC_PPI_ENABLERx_EL1 writes KVM: arm64: gic-v5: Check for pending PPIs KVM: arm64: gic-v5: Clear TWI if single task running ... Signed-off-by: Marc Zyngier commit 2de32a25a3f721052c9aaf753a65b96f63c2c7d9 Merge: f338e77383789c ec07906bdc5284 Author: Marc Zyngier Date: Wed Apr 8 12:21:51 2026 +0100 Merge branch kvm-arm64/hyp-tracing into kvmarm-master/next * kvm-arm64/hyp-tracing: (40 commits) : . : EL2 tracing support, adding both 'remote' ring-buffer : infrastructure and the tracing itself, courtesy of : Vincent Donnefort. From the cover letter: : : "The growing set of features supported by the hypervisor in protected : mode necessitates debugging and profiling tools. Tracefs is the : ideal candidate for this task: : : * It is simple to use and to script. : : * It is supported by various tools, from the trace-cmd CLI to the : Android web-based perfetto. : : * The ring-buffer, where are stored trace events consists of linked : pages, making it an ideal structure for sharing between kernel and : hypervisor. : : This series first introduces a new generic way of creating remote events and : remote buffers. Then it adds support to the pKVM hypervisor." : . tracing: selftests: Extend hotplug testing for trace remotes tracing: Non-consuming read for trace remotes with an offline CPU tracing: Adjust cmd_check_undefined to show unexpected undefined symbols tracing: Restore accidentally removed SPDX tag KVM: arm64: avoid unused-variable warning tracing: Generate undef symbols allowlist for simple_ring_buffer KVM: arm64: tracing: add ftrace dependency tracing: add more symbols to whitelist tracing: Update undefined symbols allow list for simple_ring_buffer KVM: arm64: Fix out-of-tree build for nVHE/pKVM tracing tracing: selftests: Add hypervisor trace remote tests KVM: arm64: Add selftest event support to nVHE/pKVM hyp KVM: arm64: Add hyp_enter/hyp_exit events to nVHE/pKVM hyp KVM: arm64: Add event support to the nVHE/pKVM hyp and trace remote KVM: arm64: Add trace reset to the nVHE/pKVM hyp KVM: arm64: Sync boot clock with the nVHE/pKVM hyp KVM: arm64: Add trace remote for the nVHE/pKVM hyp KVM: arm64: Add tracing capability for the nVHE/pKVM hyp KVM: arm64: Support unaligned fixmap in the pKVM hyp KVM: arm64: Initialise hyp_nr_cpus for nVHE hyp ... Signed-off-by: Marc Zyngier commit 5a84b600050c5f16b8bba25dd0e7aea845880407 Author: Anshuman Khandual Date: Fri Feb 27 06:27:44 2026 +0000 perf/events: Replace READ_ONCE() with standard pgtable accessors Replace raw READ_ONCE() dereferences of pgtable entries with corresponding standard page table accessors pxdp_get() in perf_get_pgtable_size(). These accessors default to READ_ONCE() on platforms that don't override them. So there is no functional change on such platforms. However arm64 platform is being extended to support 128 bit page tables via a new architecture feature i.e FEAT_D128 in which case READ_ONCE() will not provide required single copy atomic access for 128 bit page table entries. Although pxdp_get() accessors can later be overridden on arm64 platform to extend required single copy atomicity support on 128 bit entries. Signed-off-by: Anshuman Khandual Signed-off-by: Peter Zijlstra (Intel) Acked-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260227062744.2215491-1-anshuman.khandual@arm.com commit 985215804dcbf02ab675977e770708e3f084e9fc Author: Michal Koutný Date: Mon Mar 23 13:39:39 2026 +0100 sched/rt: Cleanup global RT bandwidth functions The commit 5f6bd380c7bdb ("sched/rt: Remove default bandwidth control") and followup changes made a few of the functions unnecessary, drop them for simplicity. Signed-off-by: Michal Koutný Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260323-sched-rert_groups-v3-3-1e7d5ed6b249@suse.com commit 4f70a0456d090303d5a6c915dd7d9db9da56cb16 Author: Michal Koutný Date: Mon Mar 23 13:39:38 2026 +0100 sched/rt: Move group schedulability check to sched_rt_global_validate() The sched_rt_global_constraints() function is a remnant that used to set up global RT throttling but that is no more since commit 5f6bd380c7bdb ("sched/rt: Remove default bandwidth control") and the function ended up only doing schedulability check. Move the check into the validation function where it fits better. (The order of validations sched_dl_global_validate() and sched_rt_global_validate() shouldn't matter.) Signed-off-by: Michal Koutný Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260323-sched-rert_groups-v3-2-1e7d5ed6b249@suse.com commit 8b016dcec9365675be81d26be88f2c09cf983bd4 Author: Michal Koutný Date: Mon Mar 23 13:39:37 2026 +0100 sched/rt: Skip group schedulable check with rt_group_sched=0 The warning from the commit 87f1fb77d87a6 ("sched: Add RT_GROUP WARN checks for non-root task_groups") is wrong -- it assumes that only task_groups with rt_rq are traversed, however, the schedulability check would iterate all task_groups even when rt_group_sched=0 is disabled at boot time but some non-root task_groups exist. The schedulability check is supposed to validate: a) that children don't overcommit its parent, b) no RT task group overcommits global RT limit. but with rt_group_sched=0 there is no (non-trivial) hierarchy of RT groups, therefore skip the validation altogether. Otherwise, writes to the global sched_rt_runtime_us knob will be rejected with incorrect validation error. This fix is immaterial with CONFIG_RT_GROUP_SCHED=n. Fixes: 87f1fb77d87a6 ("sched: Add RT_GROUP WARN checks for non-root task_groups") Signed-off-by: Michal Koutný Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260323-sched-rert_groups-v3-1-1e7d5ed6b249@suse.com commit 9b8ad2b63067eb302aea429cb6f1f22947b353d7 Author: Borislav Petkov (AMD) Date: Wed Apr 8 12:32:06 2026 +0200 x86/fpu: Correct the comment explaining what xfeatures_in_use() does It returns the mask of the features which are being currently used, i.e., NOT in their initial configuration. No functional changes. Signed-off-by: Borislav Petkov (AMD) commit ecc26ba41ce254479232c750f96968abddbbb6ab Merge: d33e89d1229508 d8d3e49b3821b3 Author: Rafael J. Wysocki Date: Wed Apr 8 12:31:06 2026 +0200 Merge branch 'thermal-intel' Merge updates of Intel thermal drivers for 7.1: - Replace cpumask_weight() in intel_hfi_offline() with cpumask_empty() which is generally more efficient (Yury Norov) - Add support for reading DDR data rate from PCI config space on Nova Lake platforms to the int340x thermal driver (Srinivas Pandruvada) * thermal-intel: thermal: intel: hfi: use cpumask_empty() in intel_hfi_offline() thermal: intel: int340x: Read DDR data rate for Nova Lake commit d33e89d12295087afd108a42f5e240ff53820461 Author: Rafael J. Wysocki Date: Tue Apr 7 16:09:21 2026 +0200 thermal: core: Suspend thermal zones later and resume them earlier To avoid some undesirable interactions between thermal zone suspend and resume with user space that is running when those operations are carried out, move them closer to the suspend and resume of devices, respectively, by updating dpm_prepare() to carry out thermal zone suspend and dpm_complete() to start thermal zone resume (that will continue asynchronously). This also makes the code easier to follow by removing one, arguably redundant, level of indirection represented by the thermal PM notifier. Signed-off-by: Rafael J. Wysocki Reviewed-by: Armin Wolf Link: https://patch.msgid.link/2036875.PYKUYFuaPT@rafael.j.wysocki commit c4c6a8646359612db34c76f58799f5206945e365 Author: Rafael J. Wysocki Date: Tue Apr 7 16:07:51 2026 +0200 thermal: core: Allocate thermal_class statically Define thermal_class as a static structure to simplify thermal_init() and to simplify thermal class availability checks that will need to be carried out during the suspend and resume of thermal zones after subsequent changes. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/10831981.nUPlyArG6x@rafael.j.wysocki commit 26fd03effa94cdfbbad550f3aa32cb89ccb016b6 Author: Rafael J. Wysocki Date: Tue Apr 7 16:06:35 2026 +0200 thermal: core: Adjust thermal_wq allocation flags The thermal workqueue doesn't need to be freezable or per-CPU, so drop WQ_FREEZABLE and WQ_PERCPU from the flags when allocating it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki [ rjw: Subject rewrite ] Link: https://patch.msgid.link/3413335.44csPzL39Z@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit 323803ac63209f9709c988011caa62b014993219 Author: Rafael J. Wysocki Date: Tue Apr 7 16:06:23 2026 +0200 thermal: core: Drop redundant check from thermal_zone_device_update() Since __thermal_zone_device_update() checks if tz->state is TZ_STATE_READY and bails out immediately otherwise, it is not necessary to check the thermal_zone_is_present() return value in thermal_zone_device_update(). Namely, tz->state is equal to TZ_STATE_FLAG_INIT initially and that flag is only cleared in thermal_zone_init_complete() after adding tz to the list of thermal zones, and thermal_zone_exit() sets TZ_STATE_FLAG_EXIT in tz->state while removing tz from that list. Thus tz->state is not TZ_STATE_READY when tz is not in the list and the check mentioned above is redundant. Accordingly, drop the redundant thermal_zone_is_present() check from thermal_zone_device_update() and drop the former altogether because it has no more users. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3406806.aeNJFYEL58@rafael.j.wysocki commit daae9c18feec74566e023fc88cfb0ce26e39d868 Author: Rafael J. Wysocki Date: Tue Apr 7 15:58:34 2026 +0200 thermal: core: Free thermal zone ID later during removal The thermal zone removal ordering is different from the thermal zone registration rollback path ordering and the former is arguably problematic because freeing a thermal zone ID prematurely may cause it to be used during the registration of another thermal zone which may fail as a result. Prevent that from occurring by changing the thermal zone removal ordering to reflect the thermal zone registration rollback path ordering. Also more the ida_destroy() call from thermal_zone_device_unregister() to thermal_release() for consistency. Fixes: b31ef8285b19 ("thermal core: convert ID allocation to IDA") Cc: All applicable Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5063934.GXAFRqVoOG@rafael.j.wysocki commit 41ff66baf81c6541f4f985dd7eac4494d03d9440 Author: Rafael J. Wysocki Date: Tue Apr 7 15:55:19 2026 +0200 thermal: core: Fix thermal zone governor cleanup issues If thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak. In turn, thermal_zone_device_unregister() calls thermal_set_governor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case. Address these issues by adding two thermal_set_governor() calls, one to thermal_release() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration. Fixes: e33df1d2f3a0 ("thermal: let governors have private data for each thermal zone") Cc: All applicable Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5092923.31r3eYUQgx@rafael.j.wysocki commit 596ca99cf04f339db2ed18a5bb230ee11a47b699 Author: Fenglin Wu Date: Thu Apr 2 17:35:22 2026 -0700 pmdomain: qcom: rpmhpd: Add power domains for Hawi SoC Add the RPMh power domains required for the Hawi SoC. This includes new definitions for domains supplying specific hardware components: - DCX: supplies VDD_DISP - GBX: supplies VDD_GFX_BX Reviewed-by: Taniya Das Reviewed-by: Konrad Dybcio Signed-off-by: Fenglin Wu Reviewed-by: Dmitry Baryshkov Signed-off-by: Ulf Hansson commit deba8c5712739929f37d50e0fd7f0c75c611fbca Merge: a6112de8f4a05b 950ace2e5322a3 Author: Ulf Hansson Date: Wed Apr 8 11:57:45 2026 +0200 pmdomain: Merge branch dt into next Merge the immutable branch dt into next, to allow the updated DT bindings to be tested together with the pmdomain changes that are targeted for the next release. Signed-off-by: Ulf Hansson commit 950ace2e5322a36ed3d8e1c22df7d8408104ff2b Author: Fenglin Wu Date: Thu Apr 2 17:35:21 2026 -0700 dt-bindings: power: qcom,rpmhpd: Add RPMh power domain for Hawi SoC Document the RPMh power domain for Hawi SoC, and add definitions for the new power domains which present in Hawi SoC: - RPMHPD_DCX (Display Core X): supplies VDD_DISP for the display subsystem - RPMHPD_GBX (Graphics Box): supplies VDD_GFX_BX for the GPU/graphics subsystem Also, add constants for new power domain levels that supported in Hawi SoC, including: LOW_SVS_D3_0, LOW_SVS_D1_0, LOW_SVS_D0_0, SVS_L2_0, TURBO_L1_0/1/2, TURBO_L1_0/1/2. Signed-off-by: Fenglin Wu Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit a6112de8f4a05bb10f62868990f47fb7169acd60 Author: Rosen Penev Date: Wed Apr 1 19:54:06 2026 -0700 pmdomain: qcom: cpr: add COMPILE_TEST support Allows the buildbots to build the driver on other platforms. There's nothing special arch specific thing going on here. Signed-off-by: Rosen Penev Signed-off-by: Ulf Hansson commit 041aa7a85390c99b1de86dc28eddcff0890d8186 Author: Mark Rutland Date: Tue Apr 7 14:16:45 2026 +0100 entry: Split preemption from irqentry_exit_to_kernel_mode() Some architecture-specific work needs to be performed between the state management for exception entry/exit and the "real" work to handle the exception. For example, arm64 needs to manipulate a number of exception masking bits, with different exceptions requiring different masking. Generally this can all be hidden in the architecture code, but for arm64 the current structure of irqentry_exit_to_kernel_mode() makes this particularly difficult to handle in a way that is correct, maintainable, and efficient. The gory details are described in the thread surrounding: https://lore.kernel.org/lkml/acPAzdtjK5w-rNqC@J2N7QTR9R3/ The summary is: * Currently, irqentry_exit_to_kernel_mode() handles both involuntary preemption AND state management necessary for exception return. * When scheduling (including involuntary preemption), arm64 needs to have all arm64-specific exceptions unmasked, though regular interrupts must be masked. * Prior to the state management for exception return, arm64 needs to mask a number of arm64-specific exceptions, and perform some work with these exceptions masked (with RCU watching, etc). While in theory it is possible to handle this with a new arch_*() hook called somewhere under irqentry_exit_to_kernel_mode(), this is fragile and complicated, and doesn't match the flow used for exception return to user mode, which has a separate 'prepare' step (where preemption can occur) prior to the state management. To solve this, refactor irqentry_exit_to_kernel_mode() to match the style of {irqentry,syscall}_exit_to_user_mode(), moving preemption logic into a new irqentry_exit_to_kernel_mode_preempt() function, and moving state management in a new irqentry_exit_to_kernel_mode_after_preempt() function. The existing irqentry_exit_to_kernel_mode() is left as a caller of both of these, avoiding the need to modify existing callers. There should be no functional change as a result of this change. [ tglx: Updated kernel doc ] Signed-off-by: Mark Rutland Signed-off-by: Thomas Gleixner Reviewed-by: Jinjie Ruan Acked-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260407131650.3813777-6-mark.rutland@arm.com commit c5538d0141b383808f440186fcd0bc2799af2853 Author: Mark Rutland Date: Tue Apr 7 14:16:44 2026 +0100 entry: Split kernel mode logic from irqentry_{enter,exit}() The generic irqentry code has entry/exit functions specifically for exceptions taken from user mode, but doesn't have entry/exit functions specifically for exceptions taken from kernel mode. It would be helpful to have separate entry/exit functions specifically for exceptions taken from kernel mode. This would make the structure of the entry code more consistent, and would make it easier for architectures to manage logic specific to exceptions taken from kernel mode. Move the logic specific to kernel mode out of irqentry_enter() and irqentry_exit() into new irqentry_enter_from_kernel_mode() and irqentry_exit_to_kernel_mode() functions. These are marked __always_inline and placed in irq-entry-common.h, as with irqentry_enter_from_user_mode() and irqentry_exit_to_user_mode(), so that they can be inlined into architecture-specific wrappers. The existing out-of-line irqentry_enter() and irqentry_exit() functions retained as callers of the new functions. The lockdep assertion from irqentry_exit() is moved into irqentry_exit_to_user_mode() and irqentry_exit_to_kernel_mode(). This was previously missing from irqentry_exit_to_user_mode() when called directly, and any new lockdep assertion failure relating from this change is a latent bug. Aside from the lockdep change noted above, there should be no functional change as a result of this change. [ tglx: Updated kernel doc ] Signed-off-by: Mark Rutland Signed-off-by: Thomas Gleixner Reviewed-by: Jinjie Ruan Acked-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260407131650.3813777-5-mark.rutland@arm.com commit eb1b51afde506a8e38976190e518990d69ef5382 Author: Mark Rutland Date: Tue Apr 7 14:16:43 2026 +0100 entry: Move irqentry_enter() prototype later Subsequent patches will rework the irqentry_*() functions. The end result (and the intermediate diffs) will be much clearer if the prototype for the irqentry_enter() function is moved later, immediately before the prototype of the irqentry_exit() function. Move the prototype later. This is purely a move; there should be no functional change as a result of this change. Signed-off-by: Mark Rutland Signed-off-by: Thomas Gleixner Reviewed-by: Jinjie Ruan Acked-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260407131650.3813777-4-mark.rutland@arm.com commit 22f66e7ef4ce9414b4bd18abe50ead4a1284b01a Author: Mark Rutland Date: Tue Apr 7 14:16:42 2026 +0100 entry: Remove local_irq_{enable,disable}_exit_to_user() local_irq_enable_exit_to_user() and local_irq_disable_exit_to_user() are never overridden by architecture code, and are always equivalent to local_irq_enable() and local_irq_disable(). These functions were added on the assumption that arm64 would override them to manage 'DAIF' exception masking, as described by Thomas Gleixner in these threads: https://lore.kernel.org/all/20190919150809.340471236@linutronix.de/ https://lore.kernel.org/all/alpine.DEB.2.21.1910240119090.1852@nanos.tec.linutronix.de/ In practice arm64 did not need to override either. Prior to moving to the generic irqentry code, arm64's management of DAIF was reworked in commit: 97d935faacde ("arm64: Unmask Debug + SError in do_notify_resume()") Since that commit, arm64 only masks interrupts during the 'prepare' step when returning to user mode, and masks other DAIF exceptions later. Within arm64_exit_to_user_mode(), the arm64 entry code is as follows: local_irq_disable(); exit_to_user_mode_prepare_legacy(regs); local_daif_mask(); mte_check_tfsr_exit(); exit_to_user_mode(); Remove the unnecessary local_irq_enable_exit_to_user() and local_irq_disable_exit_to_user() functions. Signed-off-by: Mark Rutland Signed-off-by: Thomas Gleixner Reviewed-by: Jinjie Ruan Acked-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260407131650.3813777-3-mark.rutland@arm.com commit 1f0d117cd6ca8e74e70e415e89b059fce37674c6 Author: Mark Rutland Date: Tue Apr 7 14:16:41 2026 +0100 entry: Fix stale comment for irqentry_enter() The kerneldoc comment for irqentry_enter() refers to idtentry_exit(), which is an accidental holdover from the x86 entry code that the generic irqentry code was based on. Correct this to refer to irqentry_exit(). Signed-off-by: Mark Rutland Signed-off-by: Thomas Gleixner Reviewed-by: Jinjie Ruan Acked-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260407131650.3813777-2-mark.rutland@arm.com commit cbd3b8ef970a2a4738c3b237ca8fe3fe5985627e Author: Geert Uytterhoeven Date: Mon Mar 2 11:25:20 2026 +0100 m68k: defconfig: Update defconfigs for v7.0-rc1 - Restore the state of the standard black-and-white and 16-color Linux logos (no longer auto-enabled since commit 994fcd4b107d747b ("video/logo: don't select LOGO_LINUX_MONO and LOGO_LINUX_VGA16 by default")). Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/67dd5553e9289757c274d79ce1b13fca33fde25d.1772446429.git.geert@linux-m68k.org commit 59747bec5d6e00a83ce5dfc8f7ac9b7113a11472 Author: Thorsten Blum Date: Wed Mar 18 01:16:33 2026 +0100 m68k: emu: Replace unbounded sprintf() in nfhd_init_one() Replace unbounded sprintf() with the safer snprintf(). Signed-off-by: Thorsten Blum Reviewed-by: Kees Cook Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260318001632.2974-3-thorsten.blum@linux.dev Signed-off-by: Geert Uytterhoeven commit 292286b2d229fb732421429b027d38ac3f969383 Author: songxiebing Date: Wed Apr 8 16:33:11 2026 +0800 ALSA: usb-audio: qcom: Fix incorrect type in enable_audio_stream Fix sparse warning: sound/usb/qcom/qc_audio_offload.c:943:27: sparse: incorrect type in argument 2 expected unsigned int val but got snd_pcm_format_t. Explicitly cast pcm_format to unsigned int for snd_mask_leave(). Fixes: 326bbc348298 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604062109.Oxi8JjWW-lkp@intel.com/ Signed-off-by: songxiebing Link: https://patch.msgid.link/20260408083311.774173-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai commit 8a23051ed8584215b22368e9501f771ef98f0c1d Merge: b06b348e855383 09808839c7aa66 Author: Miguel Ojeda Date: Wed Apr 8 10:44:46 2026 +0200 Merge tag 'pin-init-v7.1' of https://github.com/Rust-for-Linux/linux into rust-next Pull pin-init updates from Benno Lossin: - Replace the 'Zeroable' impls for 'Option' with impls of 'ZeroableOption' for 'NonZero*'. - Improve feature gate handling for unstable features. - Declutter the documentation of implementations of 'Zeroable' for tuples. - Replace uses of 'addr_of[_mut]!' with '&raw [mut]'. * tag 'pin-init-v7.1' of https://github.com/Rust-for-Linux/linux: rust: pin-init: replace `addr_of_mut!` with `&raw mut` rust: pin-init: implement ZeroableOption for NonZero* integer types rust: pin-init: doc: de-clutter documentation with fake-variadics rust: pin-init: properly document let binding workaround rust: pin-init: build: simplify use of nightly features commit b06b348e855383ed80e041299f3925cdd7dff3da Merge: f4231eb25cd215 ddb1444d333512 Author: Miguel Ojeda Date: Wed Apr 8 09:46:01 2026 +0200 Merge tag 'rust-timekeeping-for-v7.1' of https://github.com/Rust-for-Linux/linux into rust-next Pull timekeeping updates from Andreas Hindborg: - Expand the example section in the 'HrTimer' documentation. - Mark the 'ClockSource' trait as unsafe to ensure valid values for 'ktime_get()'. - Add 'Delta::from_nanos()'. This is a back merge since the pull request has a newer base -- we will avoid that in the future. And, given it is a back merge, it happens to resolve the "subtle" conflict around '--remap-path-{prefix,scope}' that I discussed in linux-next [1], plus a few other common conflicts. The result matches what we did for next-20260407. The actual diffstat (i.e. using a temporary merge of upstream first) is: rust/kernel/time.rs | 32 ++++- rust/kernel/time/hrtimer.rs | 336 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 362 insertions(+), 6 deletions(-) Link: https://lore.kernel.org/linux-next/CANiq72kdxB=W3_CV1U44oOK3SssztPo2wLDZt6LP94TEO+Kj4g@mail.gmail.com/ [1] * tag 'rust-timekeeping-for-v7.1' of https://github.com/Rust-for-Linux/linux: hrtimer: add usage examples to documentation rust: time: make ClockSource unsafe trait rust/time: Add Delta::from_nanos() commit 66f6f543283e91b8899b0dd109d8f15a529e8464 Author: Cássio Gabriel Date: Tue Apr 7 18:13:06 2026 -0300 ALSA: i2c: ak4xxx-adda: implement AK4529 reset handling Delta 410 uses snd_akm4xxx_reset() both around DFS changes and from its PM callbacks, but the AK4529 case in this helper is still left unimplemented and never drives the codec reset path. The AK4529 datasheet documents register 09h.RSTN as an internal timing reset. Clearing RSTN powers down the ADC and DAC blocks, but does not reinitialize the register map. That matches the existing ak4xxx helper model, which already keeps the desired codec state in the software register cache. Implement AK4529 reset handling by clearing 09h.RSTN on state == 1, then replaying the cached register image and setting RSTN back to 1 on state == 0. This restores cached Delta 410 mixer state after resume and gives the AK4529 DFS-change path a real codec reset sequence. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260407-ak4529-reset-handling-v1-1-b971c18b1a32@gmail.com Signed-off-by: Takashi Iwai commit 8c6d03b7a249ffe85ba2bda09a2a7614c0ff03db Author: Eric Biggers Date: Tue Apr 7 20:06:51 2026 -0700 crypto: Remove michael_mic from crypto_shash API Remove the "michael_mic" crypto_shash algorithm, since it's no longer used. Its only users were wireless drivers, which have now been converted to use the michael_mic() function instead. It makes sense that no other users ever appeared: Michael MIC is an insecure algorithm that is specific to WPA TKIP, which itself was an interim security solution to replace the broken WEP standard. Acked-by: Geert Uytterhoeven Signed-off-by: Eric Biggers Acked-by: Herbert Xu Link: https://patch.msgid.link/20260408030651.80336-7-ebiggers@kernel.org Signed-off-by: Johannes Berg commit 6f800c3397b7f64da4c9eb636a1206f8d8636c95 Author: Cássio Gabriel Date: Tue Apr 7 12:35:43 2026 -0300 ALSA: interwave: add ISA and PnP suspend and resume callbacks interwave still leaves both its ISA and PnP PM callbacks disabled even though the shared GUS suspend and resume path now exists. This board needs InterWave-specific glue around the shared GUS PM path. The attached WSS codec has its own register image that must be saved and restored across suspend, the InterWave-specific GF1 compatibility, decode, MPU401, and emulation settings must be rewritten after the shared GF1 resume path reinitializes the chip, and the probe-detected InterWave memory layout must be restored without rerunning the destructive DRAM/ROM detection path. Track the optional STB TEA6330T bus at probe time, restore its cached mixer state after resume, add resume-safe helpers for the InterWave register and memory-configuration state, and wire both the ISA and PnP front-ends up to the shared GUS PM helpers. The resume path intentionally restores only the cached hardware setup. It does not attempt to preserve sample RAM contents across suspend. Signed-off-by: Cássio Gabriel Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260407-alsa-interwave-pm-v2-3-8dd96c6129e9@gmail.com commit 19cbb3e0c27f28feb7781641994226cb2ee206a2 Author: Cássio Gabriel Date: Tue Apr 7 12:35:42 2026 -0300 ALSA: tea6330t: add mixer state restore helper The InterWave STB variant uses a TEA6330T mixer on its private I2C bus. The mixer state is cached in software, but there is no helper to push that register image back to hardware after system resume. Add a small restore helper that reapplies the cached TEA6330T register image to the device so board drivers can restore the external mixer state as part of their PM resume path. Take snd_i2c_lock() around the full device lookup and restore sequence so the bus device list traversal is also protected. Signed-off-by: Cássio Gabriel Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260407-alsa-interwave-pm-v2-2-8dd96c6129e9@gmail.com commit 22cb174c0af85e83d02a7b44fcc20c77008ee885 Author: Cássio Gabriel Date: Tue Apr 7 12:35:41 2026 -0300 ALSA: tea6330t: move snd_tea6330t_detect() EXPORT_SYMBOL Move the remaining standalone snd_tea6330t_detect() EXPORT_SYMBOL() declaration next to its function definition so tea6330t.c follows the usual layout. No functional change intended. Signed-off-by: Cássio Gabriel Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260407-alsa-interwave-pm-v2-1-8dd96c6129e9@gmail.com commit 37d9c4c055c3b3357c61dba2335ab21340e33553 Author: Thorsten Blum Date: Tue Apr 7 21:23:43 2026 +0200 USB: serial: iuu_phoenix: fix iuutool author name The original iuutool author is Juan Carlos Borrás - fix the spelling. Signed-off-by: Thorsten Blum Signed-off-by: Johan Hovold commit 91e901c65b4da02a6fd543e3f0049829ae9645b7 Author: Michael Bommarito Date: Wed Apr 8 03:01:02 2026 -0400 um: drivers: call kernel_strrchr() explicitly in cow_user.c Building ARCH=um on glibc >= 2.43 fails: arch/um/drivers/cow_user.c: error: implicit declaration of function 'strrchr' [-Wimplicit-function-declaration] glibc 2.43's C23 const-preserving strrchr() macro does not survive UML's global -Dstrrchr=kernel_strrchr remap from arch/um/Makefile. Call kernel_strrchr() directly in cow_user.c so the source no longer depends on the -D rewrite. Fixes: 2c51a4bc0233 ("um: fix strrchr() problems") Suggested-by: Johannes Berg Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260408070102.2325572-1-michael.bommarito@gmail.com [remove unnecessary 'extern'] Signed-off-by: Johannes Berg commit 32a0e1c63cdfaa9a6f1405b552b5f9eb2be61c59 Author: Eric Biggers Date: Tue Apr 7 20:06:50 2026 -0700 wifi: ipw2x00: Use michael_mic() from cfg80211 Just use the michael_mic() function from cfg80211 instead of a local implementation of it using the crypto_shash API. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260408030651.80336-6-ebiggers@kernel.org Signed-off-by: Johannes Berg commit 65abaa9e722ef29ce79dbc6034195961aa33954c Author: Eric Biggers Date: Tue Apr 7 20:06:49 2026 -0700 wifi: ath12k: Use michael_mic() from cfg80211 Just use the michael_mic() function from cfg80211 instead of a local implementation of it using the crypto_shash API. Note: when the kernel is booted with fips=1, crypto_alloc_shash("michael_mic", 0, 0) always returned ERR_PTR(-ENOENT), because Michael MIC is not a "FIPS allowed" algorithm. For now, just preserve that behavior exactly, to ensure that TKIP is not allowed to be used in FIPS mode. This logic actually seems to disable the entire driver in FIPS mode and not just TKIP, but that was the existing behavior. Supporting this driver in FIPS mode, if anyone actually needs it there, should be a separate commit. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260408030651.80336-5-ebiggers@kernel.org Signed-off-by: Johannes Berg commit 295e476b8217345ba25ff69d8e78c842771c31a8 Author: Eric Biggers Date: Tue Apr 7 20:06:48 2026 -0700 wifi: ath11k: Use michael_mic() from cfg80211 Just use the michael_mic() function from cfg80211 instead of a local implementation of it using the crypto_shash API. Note: when the kernel is booted with fips=1, crypto_alloc_shash("michael_mic", 0, 0) always returned ERR_PTR(-ENOENT), because Michael MIC is not a "FIPS allowed" algorithm. For now, just preserve that behavior exactly, to ensure that TKIP is not allowed to be used in FIPS mode. This logic actually seems to disable the entire driver in FIPS mode and not just TKIP, but that was the existing behavior. Supporting this driver in FIPS mode, if anyone actually needs it there, should be a separate commit. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260408030651.80336-4-ebiggers@kernel.org Signed-off-by: Johannes Berg commit 613c83766884503f0f6bfdc45964c84b5286091c Author: Eric Biggers Date: Tue Apr 7 20:06:47 2026 -0700 wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211 Export michael_mic() so that the ath11k and ath12k drivers can call it. In addition, move it from mac80211 to cfg80211 so that the ipw2x00 drivers, which depend on cfg80211 but not mac80211, can also call it. Currently these drivers have their own local implementations of michael_mic() based on crypto_shash, which is redundant and inefficient. By consolidating all the Michael MIC code into cfg80211, we'll be able to remove the duplicate Michael MIC code in the crypto/ directory. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260408030651.80336-3-ebiggers@kernel.org Signed-off-by: Johannes Berg commit ea06baf59bd4b83c2cb13698411909e5e6be001e Author: Eric Biggers Date: Tue Apr 7 20:06:46 2026 -0700 wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic() Rename the driver-local michael_mic() function to libipw_michael_mic() to prevent a name conflict with the common michael_mic() function. Note that this code will be superseded later when libipw starts using the common michael_mic(). This commit just prevents a bisection hazard. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260408030651.80336-2-ebiggers@kernel.org Signed-off-by: Johannes Berg commit c9b7f640426ca0fbaa506df13feabfc5b05bf071 Merge: e801194b604cd9 8fb66931fe3109 Author: Johannes Berg Date: Wed Apr 8 08:34:51 2026 +0200 Merge tag 'ath-next-20260407' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.1 (PR #3) Add ath12k support for IPQ5424. And of course there is the usual set of cleanups and bug fixes touching the ath10k and ath12k drivers. ================== Signed-off-by: Johannes Berg commit e801194b604cd9fdb24c2958892fd79e1aa3b651 Author: Johan Hovold Date: Tue Apr 7 17:11:11 2026 +0200 wifi: libertas_tf: refactor endpoint lookup Use the common USB helpers for looking up bulk and interrupt endpoints (and determining max packet size) instead of open coding. Note that the driver has an implicit max packet size check which is kept. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260407151111.3187826-4-johan@kernel.org Signed-off-by: Johannes Berg commit c885e392aadb43227d3c677eab2941a2c31355ff Author: Johan Hovold Date: Tue Apr 7 17:11:10 2026 +0200 wifi: libertas: refactor endpoint lookup Use the common USB helpers for looking up bulk and interrupt endpoints (and determining max packet size) instead of open coding. Note that the driver has an implicit max packet size check which is kept. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260407151111.3187826-3-johan@kernel.org Signed-off-by: Johannes Berg commit 607363a10ee60cc46ae0168349f1f8c59045c371 Author: Johan Hovold Date: Tue Apr 7 17:11:09 2026 +0200 wifi: at76c50x: refactor endpoint lookup Use the common USB helper for looking up bulk and interrupt endpoints instead of open coding. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260407151111.3187826-2-johan@kernel.org Signed-off-by: Johannes Berg commit c6f85577584b5f8414141ae389e974b8ca6a698b Author: Pablo Neira Ayuso Date: Mon Mar 30 11:04:02 2026 +0200 netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it Add a new helper function to retrieve the next action entry in flow rule, check if the maximum number of actions is reached, bail out in such case. Replace existing opencoded iteration on the action array by this helper function. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit f33fad8dbfff7c35c22abb3a7305173d005ac362 Author: David Laight Date: Thu Mar 26 20:18:19 2026 +0000 netfilter: nf_conntrack_h323: Correct indentation when H323_TRACE defined The trace lines are indented using PRINT("%*.s", xx, " "). Userspace will treat this as "%*.0s" and will output no characters when 'xx' is zero, the kernel treats it as "%*s" and will output a single ' ' - which is probably what is intended. Change all the formats to "%*s" removing the default precision. This gives a single space indent when level is zero. Signed-off-by: David Laight Reviewed-by: Petr Mladek Signed-off-by: Florian Westphal commit 3785091c6c16a1ce4a5e0460881fc81ed8d2c8a1 Author: Pablo Neira Ayuso Date: Sun Mar 22 23:51:47 2026 +0100 netfilter: nft_meta: add double-tagged vlan and pppoe support Currently: add rule netdev x y ip saddr 1.1.1.1 does not work with neither double-tagged vlan nor pppoe packets. This is because the network and transport header offset are not pointing to the IP and transport protocol headers in the stack. This patch expands NFT_META_PROTOCOL and NFT_META_L4PROTO to parse double-tagged vlan and pppoe packets so matching network and transport header fields becomes possible with the existing userspace generated bytecode. Note that this parser only supports double-tagged vlan which is composed of vlan offload + vlan header in the skb payload area for simplicity. NFT_META_PROTOCOL is used by bridge and netdev family as an implicit dependency in the bytecode to match on network header fields. Similarly, there is also NFT_META_L4PROTO, which is also used as an implicit dependency when matching on the transport protocol header fields. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit a3f1e6a19a5dccb7a29d941b3acee0a3974974f4 Author: Florian Westphal Date: Tue Mar 17 15:09:18 2026 +0100 netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow nft_pipapo_avx2_lookup_slow will never be used in reality, because the common sizes are handled by avx2 optimized versions. However, nft_pipapo_avx2_lookup_slow loops over the data just like the avx2 functions. However, _slow doesn't need to do that. As-is, first loop sets all the right result bits and the next iterations boil down to 'x = x & x'. Remove the loop. Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal commit 04e1ca21a5e3f84595c546b481b7bc2b5c3c5fbd Author: Florian Westphal Date: Tue Mar 17 15:50:08 2026 +0100 netfilter: nft_set_pipapo: increment data in one step Since commit e807b13cb3e3 ("nft_set_pipapo: Generalise group size for buckets") there is no longer a need to increment the data pointer in two steps. Switch to a single invocation of NFT_PIPAPO_GROUPS_PADDED_SIZE() helper, like the avx2 implementation. [ Stefano: Improve commit message ] Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal commit 8e57338c3601d0cde806bd7e70c377109106c983 Author: Florian Westphal Date: Fri Mar 13 13:12:30 2026 +0100 netfilter: nf_tables: add netlink policy based cap on registers Should have no effect in practice; all of these use the nft_parse_register_load/store apis which is mandatory anyway due to the need to further validate the register load/store, e.g. that the size argument doesn't result in out-of-bounds load/store. OTOH this is a simple method to reject obviously wrong input at earlier stage. Signed-off-by: Florian Westphal commit 66b75e6bbeeb489156a74534561bbbd360843a73 Author: Florian Westphal Date: Tue Mar 10 00:26:46 2026 +0100 netfilter: add more netlink-based policy range checks These spots either already check the attribute range manually before use or the consuming functions tolerate unexpected values. Nevertheless, add more range checks via netlink policy so we gain more users and avoid possible re-use in other places that might not have the required manual checks. This also improves error reporting: netlink core can generate extack errors. Signed-off-by: Florian Westphal commit 390a57dd61af837fcf5ad0681267890bd6cdd594 Author: Florian Westphal Date: Thu Mar 12 18:53:41 2026 +0100 netfilter: nf_conntrack_h323: remove unreliable debug code in decode_octstr The debug code (not enabled in any build) reads up to 6 octets of the inpt buffer, but does so without bound checks. Zap this. Signed-off-by: Florian Westphal commit 606bd17ef0de1b8f4227cb070308ddfd702979dc Author: Florian Westphal Date: Wed Mar 11 10:53:15 2026 +0100 netfilter: add deprecation warning for dccp support Add a deprecation warning for the xt_dccp match and the nft exthdr code. Signed-off-by: Florian Westphal commit 7970d6aaf710db166de98c5356a260089896fae5 Author: Florian Westphal Date: Tue Mar 10 16:05:51 2026 +0100 netfilter: nf_conntrack_sip: remove net variable shadowing net is already set, derived from nf_conn. I don't see how the device could be living in a different netns than the conntrack entry. Remove the extra variable and re-use existing one. Signed-off-by: Florian Westphal commit 1f290c497cb644dd3b52e69b2eaa24a5ffb66094 Author: Jelle van der Waa Date: Mon Mar 9 21:29:33 2026 +0100 netfilter: nf_tables: Fix typo in enum description Fix the spelling of "options". Signed-off-by: Jelle van der Waa Signed-off-by: Florian Westphal commit 6e6f2b9b3375cc0e6b8567d31ae7d3b2d910582f Author: Sun Jian Date: Tue Mar 3 18:15:25 2026 +0800 netfilter: use function typedefs for __rcu NAT helper hook pointers After commit 07919126ecfc ("netfilter: annotate NAT helper hook pointers with __rcu"), sparse can warn about type/address-space mismatches when RCU-dereferencing NAT helper hook function pointers. The hooks are __rcu-annotated and accessed via rcu_dereference(), but the combination of complex function pointer declarators and the WRITE_ONCE() machinery used by RCU_INIT_POINTER()/rcu_assign_pointer() can confuse sparse and trigger false positives. Introduce typedefs for the NAT helper function types, so __rcu applies to a simple "fn_t __rcu *" pointer form. Also replace local typeof(hook) variables with "fn_t *" to avoid propagating __rcu address space into temporaries. No functional change intended. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603022359.3dGE9fwI-lkp@intel.com/ Signed-off-by: Sun Jian Signed-off-by: Florian Westphal commit e6ef4eb871ed884f5f480579b2e5f4fc9d2cb003 Author: Abhishek Dubey Date: Wed Apr 8 01:53:01 2026 -0400 powerpc32/bpf: fix loading fsession func metadata using PPC_LI32 PPC_RAW_LI32 is not a valid macro in the PowerPC BPF JIT. Use PPC_LI32, which correctly handles immediate loads for large values. Fixes the build error introduced when adding fsession support on ppc32. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604040212.jIxEd2DW-lkp@intel.com/ Fixes: 92258b5bf1ec ("powerpc32/bpf: Add fsession support") Signed-off-by: Abhishek Dubey Reviewed-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260408055301.232745-1-adubey@linux.ibm.com commit b3e69fc3196fc421e26196e7792f17b0463edc6f Merge: e65d8b6f309239 7fb4c19670110f Author: Jakub Kicinski Date: Tue Apr 7 19:02:18 2026 -0700 Merge branch 'net-pull-gso-packet-headers-in-core-stack' Eric Dumazet says: ==================== net: pull gso packet headers in core stack Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head. net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len); qdisc_pkt_len_segs_init() already does a dissection of gso packets. Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this. First patch is a small cleanup to ease second patch review. ==================== Link: https://patch.msgid.link/20260403221540.3297753-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 Author: Eric Dumazet Date: Fri Apr 3 22:15:40 2026 +0000 net: pull headers in qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head. net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len); qdisc_pkt_len_segs_init() already does a dissection of gso packets. Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this. Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason. Fixes: e876f208af18 ("net: Add a software TSO helper API") Signed-off-by: Eric Dumazet Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260403221540.3297753-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 30e02ec3b4b6bd429a4824f125eb843a291dcccf Author: Eric Dumazet Date: Fri Apr 3 22:15:39 2026 +0000 net: qdisc_pkt_len_segs_init() cleanup Reduce indentation level by returning early if the transport header was not set. Add an unlikely() clause as this is not the common case. No functional change. Signed-off-by: Eric Dumazet Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260403221540.3297753-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit e65d8b6f3092398efd7c74e722cb7a516d9a0d6d Author: Jakub Kicinski Date: Sat Apr 4 16:01:03 2026 -0700 selftests: drv-net: adjust to socat changes socat v1.8.1.0 now defaults to shut-null, it sends an extra 0-length UDP packet when sender disconnects. This breaks our tests which expect the exact packet sequence. Add shut-none which was the old default where necessary. Acked-by: Stanislav Fomichev Reviewed-by: Joe Damato Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260404230103.2719103-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5c662b1c1789f51f79ee9c648681abc8410dfa81 Merge: cac16ce1e3786b 4cfb09a38357dc Author: Alexei Starovoitov Date: Tue Apr 7 18:20:49 2026 -0700 Merge branch 'allow-referenced-dynptr-to-be-overwritten-when-siblings-exists' Amery Hung says: ==================== Allow referenced dynptr to be overwritten when siblings exists The patchset conditionally allow a referenced dynptr to be overwritten when its siblings (original dynptr or dynptr clone) exist. Do it before the verifier relation tracking refactor to mimimize verifier changes at a time. ==================== Link: https://patch.msgid.link/20260406150548.1354271-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 4cfb09a38357dc1ae1082eb80aabd477d7c24b18 Author: Amery Hung Date: Mon Apr 6 08:05:48 2026 -0700 selftests/bpf: Test overwriting referenced dynptr Test overwriting referenced dynptr and clones to make sure it is only allow when there is at least one other dynptr with the same ref_obj_id. Also make sure slice is still invalidated after the dynptr's stack slot is destroyed. Signed-off-by: Amery Hung Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260406150548.1354271-3-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 017f5c4ef73c99ab4cdda3470a5310dc42094949 Author: Amery Hung Date: Mon Apr 6 08:05:47 2026 -0700 bpf: Allow overwriting referenced dynptr when refcnt > 1 The verifier currently does not allow overwriting a referenced dynptr's stack slot to prevent resource leak. This is because referenced dynptr holds additional resources that requires calling specific helpers to release. This limitation can be relaxed when there are multiple copies of the same dynptr. Whether it is the orignial dynptr or one of its clones, as long as there exists at least one other dynptr with the same ref_obj_id (to be used to release the reference), its stack slot should be allowed to be overwritten. Suggested-by: Andrii Nakryiko Signed-off-by: Amery Hung Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260406150548.1354271-2-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit cac16ce1e3786bd98cec0c108e3bc06ed3d3c6a9 Author: Daniel Borkmann Date: Tue Apr 7 21:24:21 2026 +0200 selftests/bpf: Add tests for stale delta leaking through id reassignment Extend the verifier_linked_scalars BPF selftest with a stale delta test such that the div-by-zero path is rejected in the fixed case. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_linked_scalars [...] ./test_progs -t verifier_linked_scalars #612/1 verifier_linked_scalars/scalars: find linked scalars:OK #612/2 verifier_linked_scalars/sync_linked_regs_preserves_id:OK #612/3 verifier_linked_scalars/scalars_neg:OK #612/4 verifier_linked_scalars/scalars_neg_sub:OK #612/5 verifier_linked_scalars/scalars_neg_alu32_add:OK #612/6 verifier_linked_scalars/scalars_neg_alu32_sub:OK #612/7 verifier_linked_scalars/scalars_pos:OK #612/8 verifier_linked_scalars/scalars_sub_neg_imm:OK #612/9 verifier_linked_scalars/scalars_double_add:OK #612/10 verifier_linked_scalars/scalars_sync_delta_overflow:OK #612/11 verifier_linked_scalars/scalars_sync_delta_overflow_large_range:OK #612/12 verifier_linked_scalars/scalars_alu32_big_offset:OK #612/13 verifier_linked_scalars/scalars_alu32_basic:OK #612/14 verifier_linked_scalars/scalars_alu32_wrap:OK #612/15 verifier_linked_scalars/scalars_alu32_zext_linked_reg:OK #612/16 verifier_linked_scalars/scalars_alu32_alu64_cross_type:OK #612/17 verifier_linked_scalars/scalars_alu32_alu64_regsafe_pruning:OK #612/18 verifier_linked_scalars/alu32_negative_offset:OK #612/19 verifier_linked_scalars/spurious_precision_marks:OK #612/20 verifier_linked_scalars/scalars_self_add_clears_id:OK #612/21 verifier_linked_scalars/scalars_self_add_alu32_clears_id:OK #612/22 verifier_linked_scalars/scalars_stale_delta_from_cleared_id:OK #612/23 verifier_linked_scalars/scalars_stale_delta_from_cleared_id_alu32:OK #612 verifier_linked_scalars:OK Summary: 1/23 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260407192421.508817-4-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit ed2eecdc0c6613353bc1565e900d2b23237713da Author: Daniel Borkmann Date: Tue Apr 7 21:24:20 2026 +0200 selftests/bpf: Add tests for delta tracking when src_reg == dst_reg Extend the verifier_linked_scalars BPF selftest with a rX += rX test such that the div-by-zero path is rejected in the fixed case. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_linked_scalars [...] ./test_progs -t verifier_linked_scalars #612/1 verifier_linked_scalars/scalars: find linked scalars:OK #612/2 verifier_linked_scalars/sync_linked_regs_preserves_id:OK #612/3 verifier_linked_scalars/scalars_neg:OK #612/4 verifier_linked_scalars/scalars_neg_sub:OK #612/5 verifier_linked_scalars/scalars_neg_alu32_add:OK #612/6 verifier_linked_scalars/scalars_neg_alu32_sub:OK #612/7 verifier_linked_scalars/scalars_pos:OK #612/8 verifier_linked_scalars/scalars_sub_neg_imm:OK #612/9 verifier_linked_scalars/scalars_double_add:OK #612/10 verifier_linked_scalars/scalars_sync_delta_overflow:OK #612/11 verifier_linked_scalars/scalars_sync_delta_overflow_large_range:OK #612/12 verifier_linked_scalars/scalars_alu32_big_offset:OK #612/13 verifier_linked_scalars/scalars_alu32_basic:OK #612/14 verifier_linked_scalars/scalars_alu32_wrap:OK #612/15 verifier_linked_scalars/scalars_alu32_zext_linked_reg:OK #612/16 verifier_linked_scalars/scalars_alu32_alu64_cross_type:OK #612/17 verifier_linked_scalars/scalars_alu32_alu64_regsafe_pruning:OK #612/18 verifier_linked_scalars/alu32_negative_offset:OK #612/19 verifier_linked_scalars/spurious_precision_marks:OK #612/20 verifier_linked_scalars/scalars_self_add_clears_id:OK #612/21 verifier_linked_scalars/scalars_self_add_alu32_clears_id:OK #612 verifier_linked_scalars:OK Summary: 1/21 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260407192421.508817-3-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 1b327732c84640c1e3da487eefe9d00cc9f2dd34 Author: Daniel Borkmann Date: Tue Apr 7 21:24:19 2026 +0200 bpf: Clear delta when clearing reg id for non-{add,sub} ops When a non-{add,sub} alu op such as xor is performed on a scalar register that previously had a BPF_ADD_CONST delta, the else path in adjust_reg_min_max_vals() only clears dst_reg->id but leaves dst_reg->delta unchanged. This stale delta can propagate via assign_scalar_id_before_mov() when the register is later used in a mov. It gets a fresh id but keeps the stale delta from the old (now-cleared) BPF_ADD_CONST. This stale delta can later propagate leading to a verifier-vs- runtime value mismatch. The clear_id label already correctly clears both delta and id. Make the else path consistent by also zeroing the delta when id is cleared. More generally, this introduces a helper clear_scalar_id() which internally takes care of zeroing. There are various other locations in the verifier where only the id is cleared. By using the helper we catch all current and future locations. Fixes: 98d7ca374ba4 ("bpf: Track delta between "linked" registers.") Reported-by: STAR Labs SG Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260407192421.508817-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit d7f14173c0d5866c3cae759dee560ad1bed10d2e Author: Daniel Borkmann Date: Tue Apr 7 21:24:18 2026 +0200 bpf: Fix linked reg delta tracking when src_reg == dst_reg Consider the case of rX += rX where src_reg and dst_reg are pointers to the same bpf_reg_state in adjust_reg_min_max_vals(). The latter first modifies the dst_reg in-place, and later in the delta tracking, the subsequent is_reg_const(src_reg)/reg_const_value(src_reg) reads the post-{add,sub} value instead of the original source. This is problematic since it sets an incorrect delta, which sync_linked_regs() then propagates to linked registers, thus creating a verifier-vs-runtime mismatch. Fix it by just skipping this corner case. Fixes: 98d7ca374ba4 ("bpf: Track delta between "linked" registers.") Reported-by: STAR Labs SG Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260407192421.508817-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 8fb66931fe31094aa2e1b2a5c015050b8b4cb2ec Author: Sowmiya Sree Elavalagan Date: Tue Apr 7 10:56:33 2026 +0530 wifi: ath12k: Enable IPQ5424 WiFi device support Currently, ath12k AHB (in IPQ5332) uses SCM calls to authenticate the firmware image to bring up userpd. From IPQ5424 onwards, Q6 firmware can directly communicate with the Trusted Management Engine - Lite (TME-L), eliminating the need for SCM calls for userpd bring-up. Hence, to enable IPQ5424 device support, use qcom_mdt_load_no_init() and skip the SCM call as Q6 will directly authenticate the userpd firmware. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ5424 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sowmiya Sree Elavalagan Co-developed-by: Saravanakumar Duraisamy Signed-off-by: Saravanakumar Duraisamy Co-developed-by: Raj Kumar Bhagat Signed-off-by: Raj Kumar Bhagat Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260407-ath12k-ipq5424-v5-6-8e96aa660ec4@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 38cff745fa7c0b006f95565a2e5de9f0cac13702 Author: Saravanakumar Duraisamy Date: Tue Apr 7 10:56:32 2026 +0530 wifi: ath12k: Add CE remap hardware parameters for IPQ5424 Add CE remap hardware parameters for Ath12k AHB device IPQ5424. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ5424 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Signed-off-by: Saravanakumar Duraisamy Signed-off-by: Raj Kumar Bhagat Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260407-ath12k-ipq5424-v5-5-8e96aa660ec4@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 7e2131ba332f5ae62b6302eb889feeeea56a1691 Author: Saravanakumar Duraisamy Date: Tue Apr 7 10:56:31 2026 +0530 wifi: ath12k: add ath12k_hw_regs for IPQ5424 Add register addresses (ath12k_hw_regs) for ath12k AHB based WiFi 7 device IPQ5424. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ5424 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Signed-off-by: Saravanakumar Duraisamy Signed-off-by: Raj Kumar Bhagat Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260407-ath12k-ipq5424-v5-4-8e96aa660ec4@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 74f5a619b1a6a06cc5e6246d326da5b6f2b0fcbd Author: Raj Kumar Bhagat Date: Tue Apr 7 10:56:30 2026 +0530 wifi: ath12k: add ath12k_hw_version_map entry for IPQ5424 Add a new ath12k_hw_version_map entry for the AHB based WiFi 7 device IPQ5424. Reuse most of the ath12k_hw_version_map fields such as hal_ops, hal_desc_sz, tcl_to_wbm_rbm_map, and hal_params from IPQ5332. The register addresses differ on IPQ5424, hence set hw_regs temporarily to NULL and populated it in a subsequent patch. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ5424 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Signed-off-by: Raj Kumar Bhagat Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260407-ath12k-ipq5424-v5-3-8e96aa660ec4@oss.qualcomm.com Signed-off-by: Jeff Johnson commit b1ad1a052beda2ac0400d6d4cc05dd2e549a6936 Author: Saravanakumar Duraisamy Date: Tue Apr 7 10:56:29 2026 +0530 wifi: ath12k: Add ath12k_hw_params for IPQ5424 Add ath12k_hw_params for the ath12k AHB-based WiFi 7 device IPQ5424. The WiFi device IPQ5424 is similar to IPQ5332. Most of the hardware parameters like hw_ops, wmi_init, ring_mask, etc., are the same between IPQ5424 and IPQ5332, hence use these same parameters for IPQ5424. Some parameters are specific to IPQ5424; initially set these to 0 or NULL, and populate them in subsequent patches. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Tested-on: IPQ5424 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Signed-off-by: Saravanakumar Duraisamy Signed-off-by: Raj Kumar Bhagat Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260407-ath12k-ipq5424-v5-2-8e96aa660ec4@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 3ebaf730b5832319726e12ebe634a7679eaf2e9b Author: Raj Kumar Bhagat Date: Tue Apr 7 10:56:28 2026 +0530 dt-bindings: net: wireless: add ath12k wifi device IPQ5424 Add the device-tree bindings for the ATH12K AHB wifi device IPQ5424. Signed-off-by: Raj Kumar Bhagat Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260407-ath12k-ipq5424-v5-1-8e96aa660ec4@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 9a34a59c6086ae731a06b3e61b0951feef758648 Author: Baochen Qiang Date: Wed Mar 25 11:05:01 2026 +0800 wifi: ath10k: fix station lookup failure during disconnect Recent commit [1] moved station statistics collection to an earlier stage of the disconnect flow. With this change in place, ath10k fails to resolve the station entry when handling a peer stats event triggered during disconnect, resulting in log messages such as: wlp58s0: deauthenticating from 74:1a:e0:e7:b4:c8 by local choice (Reason: 3=DEAUTH_LEAVING) ath10k_pci 0000:3a:00.0: not found station for peer stats ath10k_pci 0000:3a:00.0: failed to parse stats info tlv: -22 The failure occurs because ath10k relies on ieee80211_find_sta_by_ifaddr() for station lookup. That function uses local->sta_hash, but by the time the peer stats request is triggered during disconnect, mac80211 has already removed the station from that hash table, leading to lookup failure. Before commit [1], this issue was not visible because the transition from IEEE80211_STA_NONE to IEEE80211_STA_NOTEXIST prevented ath10k from sending a peer stats request at all: ath10k_mac_sta_get_peer_stats_info() would fail early to find the peer and skip requesting statistics. Fix this by switching the lookup path to ath10k_peer_find(), which queries ath10k's internal peer table. At the point where the firmware emits the peer stats event, the peer entry is still present in the driver's list, ensuring lookup succeeds. Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1 Fixes: a203dbeeca15 ("wifi: mac80211: collect station statistics earlier when disconnect") # [1] Reported-by: Paul Menzel Closes: https://lore.kernel.org/ath10k/57671b89-ec9f-4e6c-992c-45eb8e75929c@molgen.mpg.de Signed-off-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Reviewed-by: Paul Menzel Tested-by: Paul Menzel Link: https://patch.msgid.link/20260325-ath10k-station-lookup-failure-v1-1-2e0c970f25d5@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 0ec4b904be72f78ba6ce6bb9a8aaf2eb6b9b1004 Author: Roopni Devanathan Date: Thu Apr 2 10:44:02 2026 +0530 wifi: ath12k: Create symlink for each radio in a wiphy In single-wiphy design, when more than one radio is registered as a single-wiphy in the mac80211 layer, the following warnings are seen: 1. debugfs: File 'ath12k' in directory 'phy0' already present! 2. debugfs: File 'simulate_fw_crash' in directory 'pci-0000:57:00.0' already present! debugfs: File 'device_dp_stats' in directory 'pci-01777777777777777777777:57:00.0' already present! When more than one radio is registered as a single-wiphy, symlinks for all the radios are created in the same debugfs directory: /sys/kernel/debug/ieee80211/phyX/ath12k, resulting in warning 1. When a symlink is created for the first radio, since the 'ath12k' directory is not present, it will be created and no warning will be thrown. But when symlink is created for more than one radio, since the 'ath12k' directory was already created for symlink for radio 1, a warning is thrown complaining that 'ath12k' directory is already present. To resolve warning 1, create symlink for each radio in separate debugfs directories. For the first radio, the symlink will always be the 'ath12k' directory. This ensures that the existing directory structure is retained for single-wiphy and multi-wiphy architectures. In single-wiphy architecture with multiple radios, create symlink in separate debugfs directories introduced by mac80211. Existing debugfs directory in single-wiphy architecture: /sys/kernel/debug/ieee80211/phyX/ath12k is a symlink to /sys/kernel/debug/ath12k/pci-0001:01:00.0/macY Proposed debugfs directory in single-wiphy architecture with one radio: /sys/kernel/debug/ieee80211/phyX/ath12k is a symlink to /sys/kernel/debug/ath12k/pci-0001:01:00.0/mac0 Proposed debugfs directory in single-wiphy architecture with more than one radio: /sys/kernel/debug/ieee80211/phyX/radio0/ath12k is a symlink to /sys/kernel/debug/ath12k/pci-0001:01:00.0/mac0 and /sys/kernel/debug/ieee80211/phyX/radioY/ath12k is a symlink to /sys/kernel/debug/ath12k/pci-0001:01:00.0/macY Where X is phy index and Y is radio index, seen in 'iw phyX info | grep Idx'. Two symlinks for the first radio are to ensure compatibility with the existing design. Add radio_idx inside ar, to track the radio index in probing order. API ath12k_debugfs_pdev_create() that creates SoC entries is called more than once when hardware group starts up, resulting in warning 2. To resolve this warning, remove all other calls to this API and add one inside the ath12k_core_pdev_create(). This API carries all pdev-specific initializations and can conveniently hold a call to ath12k_debugfs_pdev_create(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Co-developed-by: Harshitha Prem Signed-off-by: Harshitha Prem Signed-off-by: Roopni Devanathan Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260402051402.3903795-1-roopni.devanathan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 7d7dc26f72abb7a76abb4a68ebad75d5ab7b375e Author: Avula Sri Charan Date: Mon Mar 30 09:37:32 2026 +0530 wifi: ath12k: Skip adding inactive partner vdev info Currently, a vdev that is created is considered active for partner link population. In case of an MLD station, non-associated link vdevs can be created but not started. Yet, they are added as partner links. This leads to the creation of stale FW partner entries which accumulate and cause assertions. To resolve this issue, check if the vdev is started and operating on a chosen frequency, i.e., arvif->is_started, instead of checking if the vdev is created, i.e., arvif->is_created. This determines if the vdev is active or not and skips adding it as a partner link if it's inactive. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01181-QCAHKSWPL_SILICONZ-1 Signed-off-by: Avula Sri Charan Signed-off-by: Roopni Devanathan Reviewed-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260330040732.1847263-1-roopni.devanathan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit af5708ed67fc562bc45fafbd0f95789c464c0105 Author: Harish Rachakonda Date: Thu Mar 26 10:36:41 2026 +0530 wifi: ath12k: Support channel change stats Add support to request channel change stats from the firmware through HTT stats type 76. These stats give channel switch details like the channel that the radio changed to, its center frequency, time taken for the switch, chainmask details, etc. Sample output: echo 76 > /sys/kernel/debug/ath12k/pci-0000\:06\:00.0/mac0/htt_stats_type cat /sys/kernel/debug/ath12k/pci-0000\:06\:00.0/mac0/htt_stats Channel Change Timings: |PRIMARY CHANNEL FREQ|BANDWIDTH CENTER FREQ|PHYMODE|TX_CHAINMASK|RX_CHAINMASK|SWITCH TIME(us)|INI(us)|TPC+CTL(us)|CAL(us)|MISC(us)|CTL(us)|SW PROFILE| | 5200| 5200| 24| 15| 15| 448850| 2410| 10546| 434593| 1071| 1100| 4| | 5240| 5240| 24| 15| 15| 450730| 4106| 10524| 434528| 1306| 1150| 4| | 5180| 5210| 26| 15| 15| 467894| 4764| 10438| 451101| 1337| 1508| 4| | 5200| 5200| 0| 15| 15| 13838| 2692| 1736| 8558| 686| 802| 6| | 5180| 5180| 0| 15| 15| 13465| 3207| 855| 8579| 578| 760| 6| | 5200| 5200| 24| 15| 15| 570321| 2441| 10439| 555661| 1574| 949| 4| Note: QCC2072 and WCN7850 firmware does not support HTT stats type 76. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01181-QCAHKSWPL_SILICONZ-1 Signed-off-by: Harish Rachakonda Signed-off-by: Roopni Devanathan Reviewed-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260326050641.3066562-1-roopni.devanathan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit ba563287beaa99c18144b2e39f63b89412abfd18 Author: Roopni Devanathan Date: Tue Mar 31 10:28:34 2026 +0530 wifi: ath12k: Rename hw_link_id to radio_idx in ath12k_ah_to_ar() ath12k_ah_to_ar() is returning radio from the given hardware based on the radio index passed. But, the variable that radio index is received at is wrongly named 'hw_link_id', which points to the hardware link index that comes from the firmware. This affects readability. Resolve this by renaming 'hw_link_id' to 'radio_idx'. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Roopni Devanathan Reviewed-by: Baochen Qiang Reviewed-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20260331045834.1181924-1-roopni.devanathan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 656e835bb0f850bdb7a42bfb64a2495f4f4d2064 Merge: a4985a1755ec9e cea4323f1cfe1d Author: Alexei Starovoitov Date: Tue Apr 7 16:27:29 2026 -0700 Merge branch 'tracing-fix-kprobe-attachment-when-module-shadows-vmlinux-symbol' Andrey Grodzovsky says: ==================== tracing: Fix kprobe attachment when module shadows vmlinux symbol When a kernel module exports a symbol with the same name as an existing vmlinux symbol, kprobe attachment fails with -EADDRNOTAVAIL because number_of_same_symbols() counts matches across both vmlinux and all loaded modules, returning a count greater than 1. This series takes a different approach from v1-v4, which implemented a libbpf-side fallback parsing /proc/kallsyms and retrying with the absolute address. That approach was rejected (Andrii Nakryiko, Ihor Solodrai) because ambiguous symbol resolution does not belong in libbpf. Following Ihor's suggestion, this series fixes the root cause in the kernel: when an unqualified symbol name is given and the symbol is found in vmlinux, prefer the vmlinux symbol and do not scan loaded modules. This makes the skeleton auto-attach path work transparently with no libbpf changes needed. Patch 1: Kernel fix - return vmlinux-only count from number_of_same_symbols() when the symbol is found in vmlinux, preventing module shadows from causing -EADDRNOTAVAIL. Patch 2: Selftests using bpf_fentry_shadow_test which exists in both vmlinux and bpf_testmod - tests unqualified (vmlinux) and MOD:SYM (module) attachment across all four attach modes, plus kprobe_multi with the duplicate symbol. Changes since v6 [1]: - Fix comment style: use /* on its own line instead of networking-style /* text on opener line (Alexei Starovoitov). [1] https://lore.kernel.org/bpf/20260407165145.1651061-1-andrey.grodzovsky@crowdstrike.com/ ==================== Link: https://patch.msgid.link/20260407203912.1787502-1-andrey.grodzovsky@crowdstrike.com Signed-off-by: Alexei Starovoitov commit cea4323f1cfe1d56dffcf98b5add1acd23aa91ed Author: Andrey Grodzovsky Date: Tue Apr 7 16:39:12 2026 -0400 selftests/bpf: Add tests for kprobe attachment with duplicate symbols bpf_fentry_shadow_test exists in both vmlinux (net/bpf/test_run.c) and bpf_testmod (bpf_testmod.c), creating a duplicate symbol condition when bpf_testmod is loaded. Add subtests that verify kprobe behavior with this duplicate symbol: In attach_probe: - dup-sym-{default,legacy,perf,link}: unqualified attach succeeds across all four modes, preferring vmlinux over module shadow. - MOD:SYM qualification attaches to the module version. In kprobe_multi_test: - dup_sym: kprobe_multi attach with kprobe and kretprobe succeeds. bpf_fentry_shadow_test is not invoked via test_run, so tests verify attach and detach succeed without triggering the probe. Signed-off-by: Andrey Grodzovsky Link: https://lore.kernel.org/r/20260407203912.1787502-3-andrey.grodzovsky@crowdstrike.com Signed-off-by: Alexei Starovoitov commit 1870ddcd94b061f54613b90d6300a350f29fc2f4 Author: Andrey Grodzovsky Date: Tue Apr 7 16:39:11 2026 -0400 bpf: Prefer vmlinux symbols over module symbols for unqualified kprobes When an unqualified kprobe target exists in both vmlinux and a loaded module, number_of_same_symbols() returns a count greater than 1, causing kprobe attachment to fail with -EADDRNOTAVAIL even though the vmlinux symbol is unambiguous. When no module qualifier is given and the symbol is found in vmlinux, return the vmlinux-only count without scanning loaded modules. This preserves the existing behavior for all other cases: - Symbol only in a module: vmlinux count is 0, falls through to module scan as before. - Symbol qualified with MOD:SYM: mod != NULL, unchanged path. - Symbol ambiguous within vmlinux itself: count > 1 is returned as-is. Fixes: 926fe783c8a6 ("tracing/kprobes: Fix symbol counting logic by looking at modules as well") Fixes: 9d8616034f16 ("tracing/kprobes: Add symbol counting check when module loads") Suggested-by: Ihor Solodrai Acked-by: Jiri Olsa Acked-by: Ihor Solodrai Signed-off-by: Andrey Grodzovsky Link: https://lore.kernel.org/r/20260407203912.1787502-2-andrey.grodzovsky@crowdstrike.com Signed-off-by: Alexei Starovoitov commit a4985a1755ec9e5aa5cfb89468ba4b51546b5eeb Author: Qi Tang Date: Tue Apr 7 22:54:21 2026 +0800 selftests/bpf: add test for nullable PTR_TO_BUF access Add iter_buf_null_fail with two tests and a test runner: - iter_buf_null_deref: verifier must reject direct dereference of ctx->key (PTR_TO_BUF | PTR_MAYBE_NULL) without a null check - iter_buf_null_check_ok: verifier must accept dereference after an explicit null check Acked-by: Kumar Kartikeya Dwivedi Reviewed-by: Amery Hung Signed-off-by: Qi Tang Link: https://lore.kernel.org/r/20260407145421.4315-1-tpluszz77@gmail.com Signed-off-by: Alexei Starovoitov commit 4516432284e1b2ad9e70de8067f779c9c1072189 Author: Dave Airlie Date: Tue Feb 24 12:06:23 2026 +1000 ttm/pool: track allocated_pages per numa node. This gets the memory sizes from the nodes and stores the limit as 50% of those. I think eventually we should drop the limits once we have memcg aware shrinking, but this should be more NUMA friendly, and I think seems like what people would prefer to happen on NUMA aware systems. Cc: Christian Koenig Signed-off-by: Dave Airlie commit 0180d6ff34e6460b79c75fc62d1915d115a84597 Author: Dave Airlie Date: Tue Feb 24 12:06:22 2026 +1000 ttm/pool: make pool shrinker NUMA aware (v2) This enable NUMA awareness for the shrinker on the ttm pools. Cc: Christian Koenig Cc: Dave Chinner Reviewed-by: Christian König Signed-off-by: Dave Airlie commit c21066ef697bbecc49dd7888bf8f4e7c684a8ef9 Author: Dave Airlie Date: Tue Feb 24 12:06:21 2026 +1000 ttm/pool: drop numa specific pools The list_lru will now handle numa for us, so no need to keep separate pool types for it. Just consolidate into the global ones. This adds a debugfs change to avoid dumping non-existant orders due to this change. Cc: Christian Koenig Cc: Johannes Weiner Signed-off-by: Dave Airlie commit 444e2a19d7fd1f08044a68fbd8b37721c6531565 Author: Dave Airlie Date: Tue Feb 24 12:06:20 2026 +1000 ttm/pool: port to list_lru. (v2) This is an initial port of the TTM pools for write combined and uncached pages to use the list_lru. This makes the pool's more NUMA aware and avoids needing separate NUMA pools (later commit enables this). Cc: Christian Koenig Cc: Johannes Weiner Cc: Dave Chinner Reviewed-by: Christian König Signed-off-by: Dave Airlie commit ae80122f3896c88884841520c983a6e8551da448 Author: Dave Airlie Date: Tue Feb 24 12:06:19 2026 +1000 drm/ttm: use gpu mm stats to track gpu memory allocations. (v4) This uses the newly introduced per-node gpu tracking stats, to track GPU memory allocated via TTM and reclaimable memory in the TTM page pools. These stats will be useful later for system information and later when mem cgroups are integrated. Cc: Christian Koenig Cc: Matthew Brost Cc: Johannes Weiner Cc: linux-mm@kvack.org Cc: Andrew Morton Acked-by: Christian König Signed-off-by: Dave Airlie commit 2232ba9c7931d5c1061f7f4e897b944ea39c3aa9 Author: Dave Airlie Date: Tue Feb 24 12:06:18 2026 +1000 mm: add gpu active/reclaim per-node stat counters (v2) While discussing memcg intergration with gpu memory allocations, it was pointed out that there was no numa/system counters for GPU memory allocations. With more integrated memory GPU server systems turning up, and more requirements for memory tracking it seems we should start closing the gap. Add two counters to track GPU per-node system memory allocations. The first is currently allocated to GPU objects, and the second is for memory that is stored in GPU page pools that can be reclaimed, by the shrinker. Cc: Christian Koenig Cc: Matthew Brost Cc: Johannes Weiner Cc: linux-mm@kvack.org Cc: Andrew Morton Acked-by: Zi Yan Acked-by: Shakeel Butt Acked-by: Andrew Morton Acked-by: Christian König Signed-off-by: Dave Airlie commit 3df690bba28edec865cf7190be10708ad0ddd67e Author: Greg Kroah-Hartman Date: Mon Apr 6 15:49:38 2026 +0200 smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the symlink parsers as the only defense against an untrusted server. symlink_data() walks SMB 3.1.1 error contexts with the loop test "p < end", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset 0. When the server-controlled ErrorDataLength advances p to within 1-7 bytes of end, the next iteration will read past it. When the matching context is found, sym->SymLinkErrorTag is read at offset 4 from p->ErrorContextData with no check that the symlink header itself fits. smb2_parse_symlink_response() then bounds-checks the substitute name using SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from iov_base. That value is computed as sizeof(smb2_err_rsp) + sizeof(smb2_symlink_err_rsp), which is correct only when ErrorContextCount == 0. With at least one error context the symlink data sits 8 bytes deeper, and each skipped non-matching context shifts it further by 8 + ALIGN(ErrorDataLength, 8). The check is too short, allowing the substitute name read to run past iov_len. The out-of-bound heap bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2). Fix this all up by making the loops test require the full context header to fit, rejecting sym if its header runs past end, and bound the substitute name against the actual position of sym->PathBuffer rather than a fixed offset. Because sub_offs and sub_len are 16bits, the pointer math will not overflow here with the new greater-than. Cc: Ronnie Sahlberg Cc: Shyam Prasad N Cc: Tom Talpey Cc: Bharath SM Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Cc: stable Reviewed-by: Paulo Alcantara (Red Hat) Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Signed-off-by: Steve French commit 3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b Author: Greg Kroah-Hartman Date: Mon Apr 6 15:49:37 2026 +0200 smb: client: fix off-by-8 bounds check in check_wsl_eas() The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA name and value, but ea_data sits at offset sizeof(struct smb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp() later reads ea->ea_data[0..nlen-1] and the value bytes follow at ea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1 + vlen. Isn't pointer math fun? The earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the 8-byte header is in bounds, but since the last EA is placed within 8 bytes of the end of the response, the name and value bytes are read past the end of iov. Fix this mess all up by using ea->ea_data as the base for the bounds check. An "untrusted" server can use this to leak up to 8 bytes of kernel heap into the EA name comparison and influence which WSL xattr the data is interpreted as. Cc: Ronnie Sahlberg Cc: Shyam Prasad N Cc: Tom Talpey Cc: Bharath SM Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Cc: stable Assisted-by: gregkh_clanker_t1000 Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Greg Kroah-Hartman Signed-off-by: Steve French commit 74b4dbb946060a3233604d91859a9abd3708141d Author: Andreas Gruenbacher Date: Tue Apr 7 12:14:30 2026 +0200 gfs2: prevent NULL pointer dereference during unmount When flushing out outstanding glock work during an unmount, gfs2_log_flush() can be called when sdp->sd_jdesc has already been deallocated and sdp->sd_jdesc is NULL. Commit 35264909e9d1 ("gfs2: Fix NULL pointer dereference in gfs2_log_flush") added a check for that to gfs2_log_flush() itself, but it missed the sdp->sd_jdesc dereference in gfs2_log_release(). Fix that. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202604071139.HNJiCaAi-lkp@intel.com/ Fixes: 35264909e9d1 ("gfs2: Fix NULL pointer dereference in gfs2_log_flush") Signed-off-by: Andreas Gruenbacher commit 734f0b4b9b84c45156ac91f4bc1fb378101cf956 Author: Andreas Gruenbacher Date: Sun Apr 5 14:21:22 2026 +0200 gfs2: hide error messages after withdraw In gfs2_evict_inode(), don't issue error messages once a withdraw has already occurred. Signed-off-by: Andreas Gruenbacher commit f458aafc5c2174407c46ea1aaec03a3a79957887 Author: Andreas Gruenbacher Date: Mon Apr 6 00:25:42 2026 +0200 gfs2: wait for withdraw earlier during unmount During an unmount, wait for potential withdraw to complete before calling gfs2_make_fs_ro(). This will allow gfs2_make_fs_ro() to skip much of its work. Signed-off-by: Andreas Gruenbacher commit b89e487bfcbc172e686a547fec4bc4072035a73b Author: Andreas Gruenbacher Date: Thu Mar 26 22:56:26 2026 +0100 gfs2: inode directory consistency checks In gfs2_dinode_in(), only allow directories to have the GFS2_DIF_EXHASH flag set. This will prevent other parts of the code from treating regular inodes as directories based on the presence of that flag. In sweep_bh_for_rgrps() and __gfs2_free_blocks(), check if the GFS2_DIF_EXHASH flag is set instead of checking if i_depth is non-zero. This matches what the directory code does. (The i_depth checks were introduced in commit 6d3117b412951 ("GFS2: Wipe directory hash table metadata when deallocating a directory").) Signed-off-by: Andreas Gruenbacher commit bb47cce7a1eea1d9d165260328270ddc39e19526 Author: Andreas Gruenbacher Date: Sun Apr 5 16:33:36 2026 +0200 gfs2: gfs2_log_flush withdraw fixes When a withdraw occurs in gfs2_log_flush() and we are left with an unsubmitted bio, fail that bio. Otherwise, the bh's in that bio will remain locked and gfs2_evict_inode() -> truncate_inode_pages() -> gfs2_invalidate_folio() -> gfs2_discard() will hang trying to discard the locked bh's. In addition, when gfs2_log_flush() fails to submit a new transaction, unpin the buffers in the failing transaction like gfs2_remove_from_journal() does. If any of the bd's are on the ail2 list, leave them there and do_withdraw() -> gfs2_withdraw_glocks() -> inode_go_inval() -> truncate_inode_pages() -> gfs2_invalidate_folio() -> gfs2_discard() will remove them. They will be freed in gfs2_release_folio(). Signed-off-by: Andreas Gruenbacher commit fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8 Author: Andreas Gruenbacher Date: Tue Mar 31 06:13:42 2026 +0200 gfs2: add some missing log locking Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions. To fix that, add a non-locking __gfs2_log_flush() function. Then, in gfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log flushing functions and __gfs2_log_flush(). Fixes: 5e4c7632aae1c ("gfs2: Issue revokes more intelligently") Signed-off-by: Andreas Gruenbacher commit f4e4c4e6acdc20a9065064dd164db52e2e0d44ad Author: Andreas Gruenbacher Date: Fri Apr 3 14:42:18 2026 +0200 gfs2: fix address space truncation during withdraw When a withdrawn filesystem's inodes are being evicted, the address spaces of those inodes still need to be truncated but we can no longer start new transactions. We still don't want gfs2_invalidate_folio() to race with gfs2_log_flush(), so take a read lock on sdp->sd_log_flush_lock in that case. (It may not be obvious, but gfs2_invalidate_folio() is a jdata-only address space operation.) Signed-off-by: Andreas Gruenbacher commit 7d2da6ed172680a7ef06acfe3e44a2326977573f Author: Andreas Gruenbacher Date: Wed Apr 1 18:18:38 2026 +0200 gfs2: drain ail under sd_log_flush_lock When a withdraw is carried out, call gfs2_ail_drain() under the sdp->sd_log_flush_lock. This isn't strictly necessary but should be easier to read, and more robust against possible future bugs. Signed-off-by: Andreas Gruenbacher commit 5a09df20872c1897506351636fdafbcda97ff2c0 Author: Rob Herring (Arm) Date: Tue Apr 7 15:04:13 2026 -0500 scripts/dtc: Update to upstream version v1.7.2-69-g53373d135579 This adds the following commits from upstream: 53373d135579 dtc: Remove unused dts_version in dtc-lexer.l caf7465c5d60 libfdt: fdt_check_full: Handle FDT_NOP when FDT_END is expected 5976c4a66098 libfdt: fdt_rw: Introduce fdt_downgrade_version() 5bb5bedd347d fdtdump: Return an error code on wrong tag value 68b960e299f7 fdtdump: Remove dtb version check adba02caf554 dtc: Use a consistent type for basenamelen 8d15a63e84ff libfdt: Verify alignment of sub-blocks in dtb Signed-off-by: Rob Herring (Arm) commit 679343977588781bd3effba79e9644aee4ee046c Author: Mario Limonciello Date: Tue Apr 7 14:49:49 2026 -0500 cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP The dynamic EPP feature uses power_supply_reg_notifier() and power_supply_unreg_notifier() but doesn't declare a dependency on POWER_SUPPLY, causing linker errors when POWER_SUPPLY is not enabled. Add POWER_SUPPLY to the selects. Suggested-by: K Prateek Nayak Fixes: e30ca6dd5345 ("cpufreq/amd-pstate: Add dynamic energy performance preference") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604040742.ySEdkuAa-lkp@intel.com/ Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20260407194949.310114-1-mario.limonciello@amd.com Signed-off-by: Rafael J. Wysocki commit 404927758daac5ec4594071e033c1fa6ee9ca9b6 Author: Justin Stitt Date: Mon Mar 30 17:09:08 2026 -0700 kbuild: expand inlining hints with -fdiagnostics-show-inlining-chain Clang recently added -fdiagnostics-show-inlining-chain [1] to improve the visibility of inlining chains in diagnostics. This is particularly useful for CONFIG_FORTIFY_SOURCE where detections can happen deep in inlined functions. Add this flag to KBUILD_CFLAGS under a cc-option so it is enabled if the compiler supports it. Note that GCC does not have an equivalent flag as it supports a similar diagnostic structure unconditionally. Link: https://github.com/llvm/llvm-project/pull/174892 [1] Link: https://github.com/ClangBuiltLinux/linux/issues/1571 Signed-off-by: Justin Stitt Reviewed-by: Nathan Chancellor Reviewed-by: Kees Cook Link: https://patch.msgid.link/20260330-kbuild-show-inlining-v2-1-c0c481a4ea7b@google.com Signed-off-by: Nicolas Schier commit d79dc408deb6c192adbad7893ee0c22d50826511 Author: Heiner Kallweit Date: Fri Apr 3 00:18:15 2026 +0200 PCI: Remove no_pci_devices() After having removed the last usage of no_pci_devices(), this function can be removed. Signed-off-by: Heiner Kallweit Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/b0ce592d-c34c-4e0b-b389-4e346b3a0c44@gmail.com commit 6f468ea360f0a6a1e45854afbc3019842ed891a8 Author: Dmitry Torokhov Date: Thu Aug 8 10:27:29 2024 -0700 Input: pc110pad - remove driver Palm Top PC 110 is a handheld personal computer with 80486SX CPU that was released exclusively in Japan in September 1995. While the kernel still supports 486 CPU it is highly unlikely that anyone is using this device with the latest kernel. Remove the driver. [bhelgaas: since this was posted, "x86/cpu: Remove M486/M486SX/ELAN support" has been queued for v7.1, so pc110pad is no longer relevant: https://lore.kernel.org/all/20251214084710.3606385-2-mingo@kernel.org/] Signed-off-by: Dmitry Torokhov Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20240808172733.1194442-4-dmitry.torokhov@gmail.com commit 57b23c0f612dcfa1aae99c9422d6d36ced1670d4 Author: Kumar Kartikeya Dwivedi Date: Tue Apr 7 18:22:33 2026 +0200 bpf: Retire rcu_trace_implies_rcu_gp() RCU Tasks Trace grace period implies RCU grace period, and this guarantee is expected to remain in the future. Only BPF is the user of this predicate, hence retire the API and clean up all in-tree users. RCU Tasks Trace is now implemented on SRCU-fast and its grace period mechanism always has at least one call to synchronize_rcu() as it is required for SRCU-fast's correctness (it replaces the smp_mb() that SRCU-fast readers skip). So, RCU-tt GP will always imply RCU GP. Reviewed-by: Puranjay Mohan Reviewed-by: Paul E. McKenney Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260407162234.785270-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit a8aa306741cdeb7b1cb4832133390f9cd08ece14 Author: Kumar Kartikeya Dwivedi Date: Tue Apr 7 16:56:06 2026 +0200 selftests/bpf: Allow prog name matching for tests with __description For tests that carry a __description tag, allow matching on both the description string and program name for convenience. Before this commit, the description string must be spelt out to filter the tests. Suggested-by: Alexei Starovoitov Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260407145606.3991770-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit d37ec2fbab55d732aae48ef2c877fb2d5ab08cd7 Author: Rafael J. Wysocki Date: Sat Mar 14 12:53:01 2026 +0100 watchdog: ni903x_wdt: Convert to a platform driver In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. In particular, registering a watchdog device under a struct acpi_device is questionable because it causes the watchdog to be hidden in the ACPI bus sysfs hierarchy and it goes against the general rule that a struct acpi_device can only be a parent of another struct acpi_device. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the ni903x_wdt watchdog ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Note that after this change it actually makes sense to look for the "timeout-sec" property via device_property_read_u32() under the device passed to watchdog_init_timeout() because it has an fwnode handle (unlike a struct acpi_device which is an fwnode itself). Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Guenter Roeck Link: https://patch.msgid.link/13996583.uLZWGnKmhe@rafael.j.wysocki commit 112b2f978afee7df725cda74a94802f919c61564 Author: Rafael J. Wysocki Date: Sat Mar 14 12:57:23 2026 +0100 ACPI: PAD: xen: Convert to a platform driver In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Xen ACPI processor aggregator device (PAD) driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/8683270.T7Z3S40VBb@rafael.j.wysocki commit 79727019ce3da234d877ec0cb6a3985f001e2b2d Author: Reinette Chatre Date: Tue Apr 7 09:01:59 2026 -0700 fs/resctrl: Add missing return value descriptions Using the stricter "./tools/docs/kernel-doc -Wall -v" to verify proper formatting of documentation comments includes warnings related to return markup on functions that are omitted during the default verification checks. This stricter verification reports a couple of missing return descriptions in resctrl: Warning: .../fs/resctrl/rdtgroup.c:1536 No description found for return value of 'rdtgroup_cbm_to_size' Warning: .../fs/resctrl/rdtgroup.c:3131 No description found for return value of 'mon_get_kn_priv' Warning: .../fs/resctrl/rdtgroup.c:3523 No description found for return value of 'cbm_ensure_valid' Warning: .../fs/resctrl/monitor.c:238 No description found for return value of 'resctrl_find_cleanest_closid' Add the missing return descriptions. Signed-off-by: Reinette Chatre Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/1c50b9f7c73251c007133590986f127e1af57780.1775576382.git.reinette.chatre@intel.com commit c611752be9d73d12fca9b456a0b8f5c8409a2346 Author: Reinette Chatre Date: Tue Apr 7 09:01:58 2026 -0700 MAINTAINERS: Update resctrl entry The x86 maintainers handle the resctrl filesystem and x86 architectural resctrl code. Even so, the x86 maintainers are not part of the resctrl section and not returned when scripts/get_maintainer.pl is run on resctrl filesystem code. With patches flowing via x86 maintainers resctrl should also ensure it follows the tip rules. Add the x86 maintainer alias, x86@kernel.org, to the resctrl section to ensure x86 maintainers are included in associated resctrl submissions. Add a reference to the tip tree handbook to make it clear which rules resctrl follows. Signed-off-by: Reinette Chatre Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/4c14dd82e81737c6413e10fe097475b1cc0886fc.1775576382.git.reinette.chatre@intel.com commit 393754191b85b3f76d9cc44dda5209ef23337e8a Author: fangqiurong Date: Tue Apr 7 17:34:05 2026 +0800 sched_ext: Documentation: Fix scx_bpf_move_to_local kfunc name The correct kfunc name is scx_bpf_dsq_move_to_local(), not scx_bpf_move_to_local(). Fix the two references in the Scheduling Cycle section. Signed-off-by: fangqiurong Signed-off-by: Tejun Heo commit 034db4dd4449c556705e6b32bc07bd31df3889ba Author: Maninder Singh Date: Tue Apr 7 09:12:15 2026 +0530 workqueue: use NR_STD_WORKER_POOLS instead of hardcoded value use NR_STD_WORKER_POOLS for irq_work_fns[] array definition. NR_STD_WORKER_POOLS is also 2, but better to use MACRO. Initialization loop for_each_bh_worker_pool() also uses same MACRO. Signed-off-by: Maninder Singh Signed-off-by: Tejun Heo commit c349e45fbe1f752432f291d24f43d67ab9007758 Author: Herve Codina Date: Wed Mar 25 15:35:44 2026 +0100 of: property: Allow fw_devlink device-tree on x86 PCI drivers can use a device-tree overlay to describe the hardware available on the PCI board. This is the case, for instance, of the LAN966x PCI device driver. Adding some more nodes in the device-tree overlay adds some more consumer/supplier relationship between devices instantiated from this overlay. Those fw_node consumer/supplier relationships are handled by fw_devlink and are created based on the device-tree parsing done by the of_fwnode_add_links() function. Those consumer/supplier links are needed in order to ensure a correct PM runtime management and a correct removal order between devices. For instance, without those links a supplier can be removed before its consumers is removed leading to all kind of issue if this consumer still want the use the already removed supplier. The support for the usage of an overlay from a PCI driver has been added on x86 systems in commit 1f340724419ed ("PCI: of: Create device tree PCI host bridge node"). In the past, support for fw_devlink on x86 had been tried but this support has been removed in commit 4a48b66b3f52 ("of: property: Disable fw_devlink DT support for X86"). Indeed, this support was breaking some x86 systems such as OLPC system and the regression was reported in [0]. Instead of disabling this support for all x86 system, use a finer grain and disable this support only for the possible problematic subset of x86 systems (at least OLPC and CE4100). Those systems use a device-tree to describe their hardware. Identify those systems using key properties in the device-tree. Signed-off-by: Herve Codina Link: https://lore.kernel.org/lkml/3c1f2473-92ad-bfc4-258e-a5a08ad73dd0@web.de/ [0] Link: https://patch.msgid.link/20260325143555.451852-18-herve.codina@bootlin.com Signed-off-by: Rob Herring (Arm) commit fc3d53288158d68444eed059adb734709b855bbf Author: Boris Burkov Date: Mon Apr 6 09:15:15 2026 -0700 btrfs: btrfs_log_dev_io_error() on all bio errors As far as I can tell, we never intentionally constrained ourselves to these status codes, and it is misleading and surprising to lack the bdev error logging when we get a different error code from the block layer. This can lead to jumping to a wrong conclusion like "this system didn't see any bio failures but aborted with EIO". For example on nvme devices, I observe many failures coming back as BLK_STS_MEDIUM. It is apparent that the nvme driver returns a variety of BLK_STS_* status values in nvme_error_status(). So handle the known expected errors and make some noise on the rest which we expect won't really happen. Reviewed-by: Christoph Hellwig Reviewed-by: Anand Jain Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 3cd181cc46d36aa7bd4af85f14639d86a25beaec Author: Michal Grzedzicki Date: Mon Mar 30 09:06:44 2026 -0700 btrfs: fix silent IO error loss in encoded writes and zoned split can_finish_ordered_extent() and btrfs_finish_ordered_zoned() set BTRFS_ORDERED_IOERR via bare set_bit(). Later, btrfs_mark_ordered_extent_error() in btrfs_finish_one_ordered() uses test_and_set_bit(), finds it already set, and skips mapping_set_error(). The error is never recorded on the inode's address_space, making it invisible to fsync. For encoded writes this causes btrfs receive to silently produce files with zero-filled holes. Fix: replace bare set_bit(BTRFS_ORDERED_IOERR) with btrfs_mark_ordered_extent_error() which pairs test_and_set_bit() with mapping_set_error(), guaranteeing the error is recorded exactly once. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Mark Harmstone Signed-off-by: Michal Grzedzicki Signed-off-by: David Sterba commit e0dfaebb8f4a1de59a8b805d600e3b662b235efc Author: Dave Chen Date: Mon Mar 30 11:31:48 2026 +0800 btrfs: skip clearing EXTENT_DEFRAG for NOCOW ordered extents In btrfs_finish_one_ordered(), clear_bits is unconditionally initialized with EXTENT_DEFRAG. For NOCOW ordered extents this is always a no-op because should_nocow() already forces the COW path when EXTENT_DEFRAG is set, so a NOCOW ordered extent can never have EXTENT_DEFRAG on its range. Although harmless, the unconditional btrfs_clear_extent_bit() call still performs a cold rbtree lookup under the io tree spinlock on every NOCOW write completion. Avoid this by only adding EXTENT_DEFRAG to clear_bits for non-NOCOW ordered extents, and skip the call entirely when there are no bits to clear. Signed-off-by: Dave Chen Signed-off-by: Robbie Ko Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit e70e3f858e084aee34a2206e5f4dd49a47673f6a Author: Dave Chen Date: Tue Apr 7 11:36:24 2026 +0800 btrfs: use BTRFS_FS_UPDATE_UUID_TREE_GEN flag for UUID tree rescan check The UUID tree rescan check in open_ctree() compares fs_info->generation with the superblock's uuid_tree_generation. This comparison is not reliable because fs_info->generation is bumped at transaction start time in join_transaction(), while uuid_tree_generation is only updated at commit time via update_super_roots(). Between the early BTRFS_FS_UPDATE_UUID_TREE_GEN flag check and the late rescan decision, mount operations such as file orphan cleanup from an unclean shutdown start transactions without committing them. This advances fs_info->generation past uuid_tree_generation and produces a false-positive mismatch. Use the BTRFS_FS_UPDATE_UUID_TREE_GEN flag directly instead. The flag was already set earlier in open_ctree() when the generations were known to match, and accurately represents "UUID tree is up to date" without being affected by subsequent transaction starts. Reviewed-by: Filipe Manana Signed-off-by: Dave Chen Signed-off-by: Robbie Ko Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit e1194226bf7642cab9d45f32fff4ea600c9069cc Author: Filipe Manana Date: Wed Apr 1 19:46:59 2026 +0100 btrfs: remove duplicate journal_info reset on failure to commit transaction If we get an error during the transaction commit path, we are resetting current->journal_info to NULL twice - once in btrfs_commit_transaction() right before calling cleanup_transaction() and then once again inside cleanup_transaction(). Remove the instance in btrfs_commit_transaction(). Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 7801f3ea9591cf040f7f92c44f8ec91eaa0d6207 Author: Filipe Manana Date: Wed Apr 1 18:51:35 2026 +0100 btrfs: tag as unlikely if statements that check for fs in error state Having the filesystem in an error state, meaning we had a transaction abort, is unexpected. Mark every check for the error state with the unlikely annotation to convey that and to allow the compiler to generate better code. On x86_64, using gcc 14.2.0-19 from Debian, resulted in a slightly reduced object size and better code. Before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 2008598 175912 15592 2200102 219226 fs/btrfs/btrfs.ko After: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 2008450 175912 15592 2199954 219192 fs/btrfs/btrfs.ko Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3666dc0c47c399695d01fde7c36e08b14f834fa0 Author: Syed Saba Kareem Date: Fri Apr 3 15:36:17 2026 +0530 ASoC: amd: ps: fix the pcm device numbering for acp pdm dmic Fixed PCM device numbering is required for acp pdm dmic pcm device to have a common UCM changes. Set the 'use_dai_pcm_id' flag true in acp pdm dma driver for acp 6.3 platform. This will fix the pcm device numbering based on dai_link->id. Fixes: 33cea6bbe488 ("ASoC: amd: add acp6.2 pdm platform driver") Signed-off-by: Syed Saba Kareem Fixes: tag. Link: https://patch.msgid.link/20260403100624.676953-1-syed.sabakareem@amd.com Signed-off-by: Mark Brown commit 09c04714cb455debc1dcc3535b6becb52c5b01e0 Author: Zhan Xusheng Date: Tue Apr 7 22:36:27 2026 +0800 alarmtimer: Access timerqueue node under lock in suspend In alarmtimer_suspend(), timerqueue_getnext() is called under base->lock, but next->expires is read after the lock is released. This is safe because suspend freezes all relevant task contexts, but reading the node while holding the lock makes the code easier to reason about and not worry about a theoretical UAF. Signed-off-by: Zhan Xusheng Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260407143627.19405-1-zhanxusheng@xiaomi.com commit 5e8323c3d52838e3b7494062980dba9450636eb4 Author: Mukesh Ojha Date: Fri Apr 3 13:39:56 2026 +0530 dt-bindings: arm-smmu: qcom: Add compatible for Hawi SoC Qualcomm Hawi SoC include apps smmu that implements arm,mmu-500, which is used to translate device-visible virtual addresses to physical addresses. Add compatible for these items. Signed-off-by: Mukesh Ojha Reviewed-by: Krzysztof Kozlowski Signed-off-by: Will Deacon commit 3f487be81292702a59ea9dbc4088b3360a50e837 Author: Guangshuo Li Date: Wed Apr 1 18:56:19 2026 +0800 btrfs: fix double free in create_space_info() error path When kobject_init_and_add() fails, the call chain is: create_space_info() -> btrfs_sysfs_add_space_info_type() -> kobject_init_and_add() -> failure -> kobject_put(&space_info->kobj) -> space_info_release() -> kfree(space_info) Then control returns to create_space_info(): btrfs_sysfs_add_space_info_type() returns error -> goto out_free -> kfree(space_info) This causes a double free. Keep the direct kfree(space_info) for the earlier failure path, but after btrfs_sysfs_add_space_info_type() has called kobject_put(), let the kobject release callback handle the cleanup. Fixes: a11224a016d6d ("btrfs: fix memory leaks in create_space_info() error paths") CC: stable@vger.kernel.org # 6.19+ Reviewed-by: Qu Wenruo Signed-off-by: Guangshuo Li Signed-off-by: David Sterba commit a7449edf96143f192606ec8647e3167e1ecbd728 Author: Guangshuo Li Date: Wed Apr 1 19:02:19 2026 +0800 btrfs: fix double free in create_space_info_sub_group() error path When kobject_init_and_add() fails, the call chain is: create_space_info_sub_group() -> btrfs_sysfs_add_space_info_type() -> kobject_init_and_add() -> failure -> kobject_put(&sub_group->kobj) -> space_info_release() -> kfree(sub_group) Then control returns to create_space_info_sub_group(), where: btrfs_sysfs_add_space_info_type() returns error -> kfree(sub_group) Thus, sub_group is freed twice. Keep parent->sub_group[index] = NULL for the failure path, but after btrfs_sysfs_add_space_info_type() has called kobject_put(), let the kobject release callback handle the cleanup. Fixes: f92ee31e031c ("btrfs: introduce btrfs_space_info sub-group") CC: stable@vger.kernel.org # 6.18+ Reviewed-by: Qu Wenruo Signed-off-by: Guangshuo Li Signed-off-by: David Sterba commit 3c0c45a4dff73845ba93d41365fc14e45ee32bd7 Author: Qu Wenruo Date: Wed Apr 1 09:32:57 2026 +1030 btrfs: do not reject a valid running dev-replace [BUG] There is a bug report that a btrfs with running dev-replace got rejected with the following messages: BTRFS error (device sdk1): devid 0 path /dev/sdk1 is registered but not found in chunk tree BTRFS error (device sdk1): remove the above devices or use 'btrfs device scan --forget ' to unregister them before mount BTRFS error (device sdk1): open_ctree failed: -117 [CAUSE] The tree and super block dumps show the fs is completely sane, except one thing, there is no dev item for devid 0 in chunk tree. However this is not a bug, as we do not insert dev item for devid 0 in the first place. Since the devid 0 is only there temporarily we do not really need to insert a dev item for it and then later remove it again. It is the commit 34308187395f ("btrfs: add extra device item checks at mount") adding a overly strict check that triggers a false alert and rejected the valid filesystem. [FIX] Add a special handling for devid 0, and doesn't require devid 0 to have a device item in chunk tree. Reported-by: Jaron Viëtor Link: https://lore.kernel.org/linux-btrfs/CAF1bhLVYLZvD=j2XyuxXDKD-NWNJAwDnpVN+UYeQW-HbzNRn1A@mail.gmail.com/ Fixes: 34308187395f ("btrfs: add extra device item checks at mount") Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 48aa5c0e2bb85dae61a6cb405094eb135c711a04 Author: Qu Wenruo Date: Tue Mar 31 08:51:56 2026 +1030 btrfs: only invalidate btree inode pages after all ebs are released In close_ctree(), we call invalidate_inode_pages2() to invalidate all pages from btree inode. But the problem is, it never returns 0, but always -EBUSY. The problem is that we are still holding all the essential tree root nodes, thus pages holding those tree blocks can not be invalidated thus invalidate_inode_pages2() always returns -EBUSY. This is also against the error cleanup path of open_ctree(), which properly frees all root pointers before calling invalidate_inode_pages(). So fix the order by delaying invalidate_inode_pages2() until we have freed all root pointers. Reviewed-by: Anand Jain Reviewed-by: Filipe Manana Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 7ae37b2c94ed30bfefece2b68c727a4474206718 Author: JP Kobryn (Meta) Date: Sat Mar 28 14:46:19 2026 -0700 btrfs: prevent direct reclaim during compressed readahead Under memory pressure, direct reclaim can kick in during compressed readahead. This puts the associated task into D-state. Then shrink_lruvec() disables interrupts when acquiring the LRU lock. Under heavy pressure, we've observed reclaim can run long enough that the CPU becomes prone to CSD lock stalls since it cannot service incoming IPIs. Although the CSD lock stalls are the worst case scenario, we have found many more subtle occurrences of this latency on the order of seconds, over a minute in some cases. Prevent direct reclaim during compressed readahead. This is achieved by using different GFP flags at key points when the bio is marked for readahead. There are two functions that allocate during compressed readahead: btrfs_alloc_compr_folio() and add_ra_bio_pages(). Both currently use GFP_NOFS which includes __GFP_DIRECT_RECLAIM. For the internal API call btrfs_alloc_compr_folio(), the signature changes to accept an additional gfp_t parameter. At the readahead call site, it gets flags similar to GFP_NOFS but stripped of __GFP_DIRECT_RECLAIM. __GFP_NOWARN is added since these allocations are allowed to fail. Demand reads still use full GFP_NOFS and will enter reclaim if needed. All other existing call sites of btrfs_alloc_compr_folio() now explicitly pass GFP_NOFS to retain their current behavior. add_ra_bio_pages() gains a bool parameter which allows callers to specify if they want to allow direct reclaim or not. In either case, the __GFP_NOWARN flag was added unconditionally since the allocations are speculative. There has been some previous work done on calling add_ra_bio_pages() [0]. This patch is complementary: where that patch reduces call frequency, this patch reduces the latency associated with those calls. [0] https://lore.kernel.org/linux-btrfs/656838ec1232314a2657716e59f4f15a8eadba64.1751492111.git.boris@bur.io/ Reviewed-by: Mark Harmstone Reviewed-by: Qu Wenruo Signed-off-by: JP Kobryn (Meta) Reviewed-by: David Sterba Signed-off-by: David Sterba commit 30d537f723d6f37a8ddfb17fe668bb9808f5b49f Author: Teng Liu <27rabbitlt@gmail.com> Date: Sat Mar 28 07:40:59 2026 +0100 btrfs: replace BUG_ON() with error return in cache_save_setup() In cache_save_setup(), if create_free_space_inode() succeeds but the subsequent lookup_free_space_inode() still fails on retry, the BUG_ON(retries) will crash the kernel. This can happen due to I/O errors or transient failures, not just programming bugs. Replace the BUG_ON with proper error handling that returns the original error code through the existing cleanup path. The callers already handle this gracefully: disk_cache_state defaults to BTRFS_DC_ERROR, so the space cache simply won't be written for that block group. Reviewed-by: Qu Wenruo Signed-off-by: Teng Liu <27rabbitlt@gmail.com> Signed-off-by: David Sterba commit f0d3b4c7b82b6bc8bf23be58150d49ecc51ec897 Author: David Sterba Date: Tue Jan 6 17:20:34 2026 +0100 btrfs: zstd: don't cache sectorsize in a local variable The sectorsize is used once or at most twice in the callbacks, no need to cache it on stack. Minor effect on zstd_compress_folios() where it saves 8 bytes of stack. Signed-off-by: David Sterba commit efcf0898a6d01724fc8ea15e55fc39bfb1ecf347 Author: David Sterba Date: Tue Jan 6 17:20:31 2026 +0100 btrfs: zlib: don't cache sectorsize in a local variable The sectorsize is used once or at most twice in the callbacks, no need to cache it on stack. Signed-off-by: David Sterba commit 4d083672b49294c31a683fd0e50d468e555768ca Author: David Sterba Date: Tue Jan 6 17:20:30 2026 +0100 btrfs: zlib: drop redundant folio address variable We're caching the current output folio address but it's not really necessary as we store it in the variable and then pass it to the stream context. We can read the folio address directly. Signed-off-by: David Sterba commit 5b93f241685fa87c6a222522e18ca2c21f4b29fb Author: David Sterba Date: Tue Jan 6 17:20:29 2026 +0100 btrfs: lzo: inline read/write length helpers The LZO_LEN read/write helpers are supposed to be trivial and we're duplicating the put/get unaligned helpers so use them directly. Signed-off-by: David Sterba commit 463626a2eccffc8945c73bc9361367ae4d8779a7 Author: David Sterba Date: Tue Jan 6 17:20:28 2026 +0100 btrfs: use common eb range validation in read_extent_buffer_to_user_nofault() The extent buffer access is checked in other helpers by check_eb_range(), which validates the requested start, length against the extent buffer. While this almost never fails we should still handle it as an error and not just warn. Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit b8aa337121ddfb050199ecda57b0654d5e3d91e9 Author: David Sterba Date: Tue Jan 6 17:20:27 2026 +0100 btrfs: read eb folio index right before loops There are generic helpers to access extent buffer folio data of any length, potentially iterating over a few of them. This is a slow path, either we use the type based accessors or the eb folio allocation is contiguous and we can use the memcpy/memcmp helpers. The initialization of 'i' is done at the beginning though it may not be needed. Move it right before the folio loop, this has minor effect on generated code in __write_extent_buffer(). Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit aae90421940a7c9a3bb783ec031435ba069fe3c5 Author: David Sterba Date: Tue Jan 6 17:20:26 2026 +0100 btrfs: rename local variable for offset in folio Use proper abbreviation of the 'offset in folio' in the variable name, same as we have in accessors.c. Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit a5b6b23c4572694da7b767a04826b06b10712bf0 Author: David Sterba Date: Tue Jan 6 17:20:25 2026 +0100 btrfs: unify types for binary search variables The variables calculating where to jump next are using mixed in types which requires some conversions on the instruction level. Using 'u32' removes one call to 'movslq', making the main loop shorter. This complements type conversion done in a724f313f84beb ("btrfs: do unsigned integer division in the extent buffer binary search loop") Signed-off-by: David Sterba commit 7e1e45a9e42efb77a44f331e5220cdc820a8d924 Author: David Sterba Date: Tue Jan 6 17:20:24 2026 +0100 btrfs: remove duplicate calculation of eb offset in btrfs_bin_search() In the main search loop the variable 'oil' (offset in folio) is set twice, one duplicated when the key fits completely to the contiguous range. We can remove it and while it's just a simple calculation, the binary search loop is executed many times so micro optimizations add up. The code size is reduced by 64 bytes on release config, the loop is reorganized a bit and a few instructions shorter. Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit b753612be0dc64744d6b027c93d32b1f895196e2 Author: Mark Harmstone Date: Wed Mar 25 12:53:43 2026 +0000 btrfs: tree-checker: add remap-tree checks to check_block_group_item() Add some write-time checks for block group items relating to the remap tree. Here we're checking: * That the REMAPPED or METADATA_REMAP flags aren't set unless the REMAP_TREE incompat flag is also set * That `remap_bytes` isn't more than the size of the block group * That `identity_remap_count` isn't more than the number of sectors in the block group Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit e3799e65c12e0fa0bb04193ace99ed9d2851abe7 Author: Filipe Manana Date: Tue Mar 24 15:01:34 2026 +0000 btrfs: make btrfs_free_log() and btrfs_free_log_root_tree() return void These functions never fail, always return success (0) and none of the callers care about their return values. Change their return type from int to void. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b48c980b6a7e409050bb3067165db31cc6205e3e Author: Filipe Manana Date: Mon Mar 23 15:50:13 2026 +0000 btrfs: fix deadlock between reflink and transaction commit when using flushoncommit When using the flushoncommit mount option, we can have a deadlock between a transaction commit and a reflink operation that copied an inline extent to an offset beyond the current i_size of the destination node. The deadlock happens like this: 1) Task A clones an inline extent from inode X to an offset of inode Y that is beyond Y's current i_size. This means we copied the inline extent's data to a folio of inode Y that is beyond its EOF, using a call to copy_inline_to_page(); 2) Task B starts a transaction commit and calls btrfs_start_delalloc_flush() to flush delalloc; 3) The delalloc flushing sees the new dirty folio of inode Y and when it attempts to flush it, it ends up at extent_writepage() and sees that the offset of the folio is beyond the i_size of inode Y, so it attempts to invalidate the folio by calling folio_invalidate(), which ends up at btrfs' folio invalidate callback - btrfs_invalidate_folio(). There it tries to lock the folio's range in inode Y's extent io tree, but it blocks since it's currently locked by task A - during a reflink we lock the inodes and the source and destination ranges after flushing all delalloc and waiting for ordered extent completion - after that we don't expect to have dirty folios in the ranges, the exception is if we have to copy an inline extent's data (because the destination offset is not zero); 4) Task A then attempts to start a transaction to update the inode item, and then it's blocked since the current transaction is in the TRANS_STATE_COMMIT_START state. Therefore task A has to wait for the current transaction to become unblocked (its state >= TRANS_STATE_UNBLOCKED). So task A is waiting for the transaction commit done by task B, and the later waiting on the extent lock of inode Y that is currently held by task A. Syzbot recently reported this with the following stack traces: INFO: task kworker/u8:7:1053 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:7 state:D stack:23520 pid:1053 tgid:1053 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: writeback wb_workfn (flush-btrfs-46) Call Trace: context_switch kernel/sched/core.c:5298 [inline] __schedule+0x1553/0x5240 kernel/sched/core.c:6911 __schedule_loop kernel/sched/core.c:6993 [inline] schedule+0x164/0x360 kernel/sched/core.c:7008 wait_extent_bit fs/btrfs/extent-io-tree.c:811 [inline] btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:1914 btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline] btrfs_invalidate_folio+0x43d/0xc40 fs/btrfs/inode.c:7704 extent_writepage fs/btrfs/extent_io.c:1852 [inline] extent_write_cache_pages fs/btrfs/extent_io.c:2580 [inline] btrfs_writepages+0x12ff/0x2440 fs/btrfs/extent_io.c:2713 do_writepages+0x32e/0x550 mm/page-writeback.c:2554 __writeback_single_inode+0x133/0x11a0 fs/fs-writeback.c:1750 writeback_sb_inodes+0x995/0x19d0 fs/fs-writeback.c:2042 wb_writeback+0x456/0xb70 fs/fs-writeback.c:2227 wb_do_writeback fs/fs-writeback.c:2374 [inline] wb_workfn+0x41a/0xf60 fs/fs-writeback.c:2414 process_one_work kernel/workqueue.c:3276 [inline] process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.4.64:6910 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.64 state:D stack:22752 pid:6910 tgid:6905 ppid:5944 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5298 [inline] __schedule+0x1553/0x5240 kernel/sched/core.c:6911 __schedule_loop kernel/sched/core.c:6993 [inline] schedule+0x164/0x360 kernel/sched/core.c:7008 wait_current_trans+0x39f/0x590 fs/btrfs/transaction.c:535 start_transaction+0x6a7/0x1650 fs/btrfs/transaction.c:705 clone_copy_inline_extent fs/btrfs/reflink.c:299 [inline] btrfs_clone+0x128a/0x24d0 fs/btrfs/reflink.c:529 btrfs_clone_files+0x271/0x3f0 fs/btrfs/reflink.c:750 btrfs_remap_file_range+0x76b/0x1320 fs/btrfs/reflink.c:903 vfs_copy_file_range+0xda7/0x1390 fs/read_write.c:1600 __do_sys_copy_file_range fs/read_write.c:1683 [inline] __se_sys_copy_file_range+0x2fb/0x480 fs/read_write.c:1650 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f73afc799 RSP: 002b:00007f5f7315e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000146 RAX: ffffffffffffffda RBX: 00007f5f73d75fa0 RCX: 00007f5f73afc799 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000005 RBP: 00007f5f73b92c99 R08: 0000000000000863 R09: 0000000000000000 R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5f73d76038 R14: 00007f5f73d75fa0 R15: 00007fff138a5068 INFO: task syz.4.64:6975 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.64 state:D stack:24736 pid:6975 tgid:6905 ppid:5944 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5298 [inline] __schedule+0x1553/0x5240 kernel/sched/core.c:6911 __schedule_loop kernel/sched/core.c:6993 [inline] schedule+0x164/0x360 kernel/sched/core.c:7008 wb_wait_for_completion+0x3e8/0x790 fs/fs-writeback.c:227 __writeback_inodes_sb_nr+0x24c/0x2d0 fs/fs-writeback.c:2838 try_to_writeback_inodes_sb+0x9a/0xc0 fs/fs-writeback.c:2886 btrfs_start_delalloc_flush fs/btrfs/transaction.c:2175 [inline] btrfs_commit_transaction+0x82e/0x31a0 fs/btrfs/transaction.c:2364 btrfs_ioctl+0xca7/0xd00 fs/btrfs/ioctl.c:5206 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f73afc799 RSP: 002b:00007f5f7313d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f5f73d76090 RCX: 00007f5f73afc799 RDX: 0000000000000000 RSI: 0000000000009408 RDI: 0000000000000004 RBP: 00007f5f73b92c99 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5f73d76128 R14: 00007f5f73d76090 R15: 00007fff138a5068 Fix this by updating the i_size of the destination inode of a reflink operation after we copy an inline extent's data to an offset beyond the i_size and before attempting to start a transaction to update the inode's item. Reported-by: syzbot+63056bf627663701bbbf@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/69bba3fe.050a0220.227207.002f.GAE@google.com/ Fixes: 05a5a7621ce6 ("Btrfs: implement full reflink support for inline extents") Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 18addf9ec82f857bb36891bb5d93cc4a82281360 Author: Mark Harmstone Date: Wed Mar 4 12:02:10 2026 +0000 btrfs: tree-checker: check remap-tree flags in btrfs_check_chunk_valid() Add a check to btrfs_check_chunk_valid() that the METADATA_REMAP and REMAPPED flags are only set if the REMAP_TREE incompat flag is also set. Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit da08c02bc705694f51edb67b094f1e5db629c1e2 Author: Mark Harmstone Date: Tue Mar 3 15:59:12 2026 +0000 btrfs: tree-checker: add checker for items in remap tree Add write-time checking of items in the remap tree, to catch errors before they are written to disk. We're checking: * That remap items, remap backrefs, and identity remaps aren't written unless the REMAP_TREE incompat flag is set * That identity remaps have a size of 0 * That remap items and remap backrefs have a size of sizeof(struct btrfs_remap_item) * That the objectid for these items is aligned to the sector size * That the offset for these items (i.e. the size of the remapping) isn't 0 and is aligned to the sector size * That objectid + offset doesn't overflow Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0e6a169c6487ca3a13d19a9ec6dc9673af5a1cf7 Author: Dave Chen Date: Mon Mar 23 11:43:22 2026 +0800 btrfs: fix unnecessary flush on close when truncating zero-sized files In btrfs_setsize(), when a file is truncated to size 0, the BTRFS_INODE_FLUSH_ON_CLOSE flag is unconditionally set to ensure pending writes get flushed on close. This flag was designed to protect the "truncate-then-rewrite" pattern, where an application truncates a file with existing data down to zero and writes new content, ensuring the new data reach disk on close. However, when a file already has a size of 0 (e.g. a newly created file opened with O_CREAT | O_TRUNC), oldsize and newsize are both 0. In this case, setting BTRFS_INODE_FLUSH_ON_CLOSE is unnecessary because no "good data" was truncated away. The subsequent filemap_flush() in btrfs_release_file() then triggers avoidable writeback that disrupts the normal delayed writeback batching, adding I/O overhead. This comes from a real workload. A backup service creates temporary files via mkstemp(), closes them, and later reopens them with O_TRUNC for writing. The O_TRUNC is defensive. The file creation and usage is done by a different component, so removing the unneeded truncation is not straightforward. This pattern repeats for a large number of files each close() triggers an unnecessary filemap_flush(). Signed-off-by: Dave Chen Signed-off-by: Robbie Ko Reviewed-by: David Sterba Signed-off-by: David Sterba commit 304076527c38efaf68a17f9e4837834ac66cfc1a Author: Qu Wenruo Date: Fri Feb 27 14:03:44 2026 +1030 btrfs: move shutdown and remove_bdev callbacks out of experimental features These two new callbacks have been introduced in v6.19, and it has been two releases in v7.1. During that time we have not yet exposed bugs related that two features, thus it's time to expose them for end users. It's especially important to expose remove_bdev callback to end users. That new callback makes btrfs automatically shutdown or go degraded when a device is missing (depending on if the fs can maintain RW), which is affecting end users. We want some feedback from early adopters. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 973e57c726c1f8e77259d1c8e519519f1e9aea77 Author: Yochai Eisenrich Date: Sun Mar 22 08:39:35 2026 +0200 btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak btrfs_ioctl_space_info() has a TOCTOU race between two passes over the block group RAID type lists. The first pass counts entries to determine the allocation size, then the second pass fills the buffer. The groups_sem rwlock is released between passes, allowing concurrent block group removal to reduce the entry count. When the second pass fills fewer entries than the first pass counted, copy_to_user() copies the full alloc_size bytes including trailing uninitialized kmalloc bytes to userspace. Fix by copying only total_spaces entries (the actually-filled count from the second pass) instead of alloc_size bytes, and switch to kzalloc so any future copy size mismatch cannot leak heap data. Fixes: 7fde62bffb57 ("Btrfs: buffer results in the space_info ioctl") CC: stable@vger.kernel.org # 3.0 Signed-off-by: Yochai Eisenrich Reviewed-by: David Sterba Signed-off-by: David Sterba commit cee4cfd6cc32a272a438836113cb698e2bca452c Author: Filipe Manana Date: Wed Mar 18 13:39:51 2026 +0000 btrfs: avoid taking the device_list_mutex in btrfs_run_dev_stats() btrfs_run_dev_stats() is called during the critical section of a transaction commit and it takes the device_list_mutex, which is also acquired by fitrim, which does discard operations while holding that mutex. Most of the time, if we are on a healthy filesystem, we don't have new stat updates to persist in the device tree, so blocking on the device_list_mutex is just wasting time and making any tasks that need to start a new transaction wait longer that necessary. Since the device list is RCU safe/protected, make btrfs_run_dev_stats() do an initial check for device stat updates using RCU and quit without taking the device_list_mutex in case there are no new device stats that need to be persisted in the device tree. Also note that adding/removing devices also requires starting a transaction, and since btrfs_run_dev_stats() is called from the critical section of a transaction commit, no one can be concurrently adding or removing a device while btrfs_run_dev_stats() is called. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e0a85137a882db789b1bccc1e7db06356ac8c69f Author: Leo Martins Date: Thu Mar 19 16:49:08 2026 -0700 btrfs: avoid GFP_ATOMIC allocations in qgroup free paths When qgroups are enabled, __btrfs_qgroup_release_data() and qgroup_free_reserved_data() pass an extent_changeset to btrfs_clear_record_extent_bits() to track how many bytes had their EXTENT_QGROUP_RESERVED bits cleared. Inside the extent IO tree spinlock, add_extent_changeset() calls ulist_add() with GFP_ATOMIC to record each changed range. If this allocation fails, it hits a BUG_ON and panics the kernel. However, both of these callers only read changeset.bytes_changed afterwards — the range_changed ulist is populated and immediately freed without ever being iterated. The GFP_ATOMIC allocation is entirely unnecessary for these paths. Introduce extent_changeset_init_bytes_only() which uses a sentinel value (EXTENT_CHANGESET_BYTES_ONLY) on the ulist's prealloc field to signal that only bytes_changed should be tracked. add_extent_changeset() checks for this sentinel and returns early after updating bytes_changed, skipping the ulist_add() call entirely. This eliminates the GFP_ATOMIC allocation and makes the BUG_ON unreachable for these paths. Callers that need range tracking (qgroup_reserve_data, qgroup_unreserve_range, btrfs_qgroup_check_reserved_leak) continue to use extent_changeset_init() and are unaffected. Reviewed-by: Qu Wenruo Signed-off-by: Leo Martins Signed-off-by: David Sterba commit 390aa432f3268c0947f903ab2d60ae2c7cafd11b Author: Johannes Thumshirn Date: Wed Mar 18 08:17:00 2026 +0100 btrfs: decrease indentation of find_free_extent_update_loop Decrease the indentation of find_free_extent_update_loop(), by inverting the check if the loop state is smaller than LOOP_NO_EMPTY_SIZE. This also allows for an early return from find_free_extent_update_loop(), in case LOOP_NO_EMPTY_SIZE is already set at this point. While at it change a if () { } else if else pattern to all using curly braces and be consistent with the rest of btrfs code. Also change 'int exists' to 'bool have_trans' giving it a more meaningful name and type. No functional changes intended. Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit 9a04488473102f08f078653de51bb0b8291087aa Author: Filipe Manana Date: Tue Mar 17 19:35:58 2026 +0000 btrfs: unexport btrfs_qgroup_reserve_meta() There's only one caller outside qgroup.c of btrfs_qgroup_reserve_meta() and we have btrfs_qgroup_reserve_meta_prealloc() is a wrapper around that function. Make that caller use btrfs_qgroup_reserve_meta_prealloc() and unexport btrfs_qgroup_reserve_meta(), simplifying the external API. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 534c0adacdebfcabb89b57862a6766f8ccf8f8f4 Author: Filipe Manana Date: Tue Mar 17 19:19:43 2026 +0000 btrfs: collapse __btrfs_qgroup_reserve_meta() into btrfs_qgroup_reserve_meta_prealloc() Since __btrfs_qgroup_reserve_meta() is only called by btrfs_qgroup_reserve_meta_prealloc(), which is a simple inline wrapper, get rid of the later and rename __btrfs_qgroup_reserve_meta() to the later. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5adf3f32c0b3adc65dc8ab889bcfc109a450c6fa Author: Filipe Manana Date: Tue Mar 17 19:09:15 2026 +0000 btrfs: collapse __btrfs_qgroup_free_meta() into btrfs_qgroup_free_meta_prealloc() Since __btrfs_qgroup_free_meta() is only called by btrfs_qgroup_free_meta_prealloc(), which is a simple inline wrapper, get rid of the later and rename __btrfs_qgroup_free_meta() to the later. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e35577706ec90791ac9a1379b3ef44591ad1a0f6 Author: Filipe Manana Date: Tue Mar 17 18:54:04 2026 +0000 btrfs: remove unused qgroup functions for pertrans reservation and freeing They have no more users since commit a6496849671a ("btrfs: fix start transaction qgroup rsv double free"), so remove them. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 031dd12c37071d0bac01d67794000a75d042cfdb Author: Filipe Manana Date: Wed Mar 11 18:36:36 2026 +0000 btrfs: optimize clearing all bits from first extent record in an io tree When we are clearing all the bits from the first record that contains the target range and that record ends at or before our target range but starts before our target range, we are doing a lot of unnecessary work: 1) Allocating a prealloc state if we don't have one already; 2) Adjust that record's start offset to the start of our range and make the prealloc state have a range going from the original start offset of that first record to the start offset of our target range, and with the same bits as that first record. Then we insert the prealloc extent in the rbtree - this is done in split_state(); 3) Remove our adjusted first state from the rbtree since all the bits were cleared - this is done in clear_state_bit(). This is only wasting time when we can simply trim that first record, so that it represents the range from its start offset to the start offset of our target range. So optimize for that case and avoid the prealloc state allocation, insertion and deletion from the rbtree. This patch is the last patch of a patchset comprised of the following patches (in descending order): btrfs: optimize clearing all bits from first extent record in an io tree btrfs: panic instead of warn when splitting extent state not in the tree btrfs: free cached state outside critical section in wait_extent_bit() btrfs: avoid unnecessary wake ups on io trees when there are no waiters btrfs: remove wake parameter from clear_state_bit() btrfs: change last argument of add_extent_changeset() to boolean btrfs: use extent_io_tree_panic() instead of BUG_ON() btrfs: make add_extent_changeset() only return errors or success btrfs: tag as unlikely branches that call extent_io_tree_panic() btrfs: turn extent_io_tree_panic() into a macro for better error reporting btrfs: optimize clearing all bits from the last extent record in an io tree The following fio script was used to measure performance before and after applying all the patches: $ cat ./fio-io-uring-2.sh #!/bin/bash DEV=/dev/nullb0 MNT=/mnt/nullb0 MOUNT_OPTIONS="-o ssd" MKFS_OPTIONS="" if [ $# -ne 3 ]; then echo "Use $0 NUM_JOBS FILE_SIZE RUN_TIME" exit 1 fi NUM_JOBS=$1 FILE_SIZE=$2 RUN_TIME=$3 cat < /tmp/fio-job.ini [io_uring_rw] rw=randwrite fsync=0 fallocate=none group_reporting=1 direct=1 ioengine=io_uring fixedbufs=1 iodepth=64 bs=4K filesize=$FILE_SIZE runtime=$RUN_TIME time_based filename=foobar directory=$MNT numjobs=$NUM_JOBS thread EOF echo performance | \ tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor echo echo "Using config:" echo cat /tmp/fio-job.ini echo umount $MNT &> /dev/null mkfs.btrfs -f $MKFS_OPTIONS $DEV &> /dev/null mount $MOUNT_OPTIONS $DEV $MNT fio /tmp/fio-job.ini umount $MNT When running this script on a 12 cores machine using a 16G null block device the results were the following: Before patchset: $ ./fio-io-uring-2.sh 12 8G 60 (...) WRITE: bw=74.8MiB/s (78.5MB/s), 74.8MiB/s-74.8MiB/s (78.5MB/s-78.5MB/s), io=4504MiB (4723MB), run=60197-60197msec After patchset: $ ./fio-io-uring-2.sh 12 8G 60 (...) WRITE: bw=82.2MiB/s (86.2MB/s), 82.2MiB/s-82.2MiB/s (86.2MB/s-86.2MB/s), io=4937MiB (5176MB), run=60027-60027msec Also, using bpftrace to collect the duration (in nanoseconds) of all the btrfs_clear_extent_bit_changeset() calls done during that fio test and then making an histogram from that data, held the following results: Before patchset: Count: 6304804 Range: 0.000 - 7587172.000; Mean: 2011.308; Median: 1219.000; Stddev: 17117.533 Percentiles: 90th: 1888.000; 95th: 2189.000; 99th: 16104.000 0.000 - 8.098: 7 | 8.098 - 40.385: 20 | 40.385 - 187.254: 146 | 187.254 - 855.347: 742048 ####### 855.347 - 3894.426: 5462542 ##################################################### 3894.426 - 17718.848: 41489 | 17718.848 - 80604.558: 46085 | 80604.558 - 366664.449: 11285 | 366664.449 - 1667918.122: 961 | 1667918.122 - 7587172.000: 113 | After patchset: Count: 6282879 Range: 0.000 - 6029290.000; Mean: 1896.482; Median: 1126.000; Stddev: 15276.691 Percentiles: 90th: 1741.000; 95th: 2026.000; 99th: 15713.000 0.000 - 60.014: 12 | 60.014 - 217.984: 63 | 217.984 - 784.949: 517515 ##### 784.949 - 2819.823: 5632335 ##################################################### 2819.823 - 10123.127: 55716 # 10123.127 - 36335.184: 46034 | 36335.184 - 130412.049: 25708 | 130412.049 - 468060.350: 4824 | 468060.350 - 1679903.189: 549 | 1679903.189 - 6029290.000: 84 | Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 057217f39a7dc89dcd97ce56d12c40ceb5cc51f3 Author: Filipe Manana Date: Wed Mar 11 16:15:59 2026 +0000 btrfs: panic instead of warn when splitting extent state not in the tree We are not expected ever to split an extent state record that is not in the rbtree, as every record we pass to split_state() was found by iterating the rbtree, so if that ever happens it means we are not holding the extent io tree's spinlock or we have some memory corruption. Instead of simply warning in case the extent state record passed to split_state() is not in the rbtree, panic as this is a serious problem. Also tag as unlikely the case where the record is not in the rbtree. This also makes a tiny reduction the btrfs module's text size. Before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 2000080 174328 15592 2190000 216ab0 fs/btrfs/btrfs.ko After: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 2000064 174328 15592 2189984 216aa0 fs/btrfs/btrfs.ko Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0611e2ad02b3a6ede4f1e26b792a80261e63a28e Author: Filipe Manana Date: Mon Mar 16 11:38:36 2026 +0000 btrfs: free cached state outside critical section in wait_extent_bit() There's no need to free the cached extent state record while holding the io tree's spinlock, it's just making the critical section longer than it needs to be. So just do it after unlocking the io tree. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 87f5c3139ee34e0642584cff86298ef4b9a827ef Author: Filipe Manana Date: Wed Mar 11 15:07:11 2026 +0000 btrfs: avoid unnecessary wake ups on io trees when there are no waiters Whenever clearing the extent lock bits of an extent state record, we unconditionally call wake_up() on the state's waitqueue. Most of the time there are no waiters on the queue so we are just wasting time calling wake_up(), since that requires locking and unlocking the queue's spinlock, disable and re-enable interrupts, function calls, and other minor overhead while we are holding a critical section delimited by the extent io tree's spinlock. So call wake_up() only if there are waiters on an extent state's wait queue. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d110eb2f7f58c7b74c558dc922d5dae3e1b94362 Author: Filipe Manana Date: Wed Mar 11 12:50:03 2026 +0000 btrfs: remove wake parameter from clear_state_bit() There's no need to pass the 'wake' parameter, we can determine if we have to wake up waiters by checking if EXTENT_LOCK_BITS is set in the bits to clear. So simplify things and remove the parameter. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4a7ae19ca381df9b2ea2e78d31468994ab699e7e Author: Filipe Manana Date: Wed Mar 11 12:43:57 2026 +0000 btrfs: change last argument of add_extent_changeset() to boolean The argument is used as a boolean but it's defined as an integer. Switch it to a boolean for better readability. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6fc58dec5b83685dee058bf0e86effa8fff0c96a Author: Filipe Manana Date: Wed Mar 11 12:35:33 2026 +0000 btrfs: use extent_io_tree_panic() instead of BUG_ON() There's no need to call BUG_ON(), instead call extent_io_tree_panic(), which also calls BUG(), but it prints an additional error message with some useful information before hitting BUG(). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f5405ffce78d6e79babc8246df6566b7e001dadb Author: Filipe Manana Date: Wed Mar 11 12:17:03 2026 +0000 btrfs: make add_extent_changeset() only return errors or success Currently add_extent_changeset() always returns the return value from its call to ulist_add(), which can return an error, 0 or 1. There are no callers that care about the difference between 0 and 1 and all except one of them, check for negative values and ignore other values, but there is another caller (btrfs_clear_extent_bit_changeset()) that must set its 'ret' variable to 0 after calling add_extent_changeset(), so that it does not return an unexpected value of 1 to its caller. So change add_extent_changeset() to only return errors or 0, avoiding that caller (and any future callers) from having to deal with a return value of 1. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0f7c10d662ac4fcd749543568d15cd65325feef9 Author: Filipe Manana Date: Wed Mar 11 12:07:03 2026 +0000 btrfs: tag as unlikely branches that call extent_io_tree_panic() It's unexpected to ever call extent_io_tree_panic() so surround with 'unlikely' every if statement condition that leads to it, making it explicit to a reader and to hint the compiler to potentially generate better code. On x86_64, using gcc 14.2.0-19 from Debian, this resulted in a slightly decrease of the btrfs module's text size. Before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1999832 174320 15592 2189744 2169b0 fs/btrfs/btrfs.ko After: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1999768 174320 15592 2189680 216970 fs/btrfs/btrfs.ko Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 598c10a9e9e80d776f32a2174f6dced705b74178 Author: Filipe Manana Date: Wed Mar 11 12:00:31 2026 +0000 btrfs: turn extent_io_tree_panic() into a macro for better error reporting When extent_io_tree_panic() is called we get a stace trace that is not very useful since the error message reports the location inside the extent_io_tree_panic() function and not in the caller of the function. Example: [ 7830.424291] BTRFS critical (device sdb): panic in extent_io_tree_panic:334: extent io tree error on add_extent_changeset state start 4083712 end 4112383 (errno=1 unknown) [ 7830.426816] ------------[ cut here ]------------ [ 7830.427581] kernel BUG at fs/btrfs/extent-io-tree.c:334! [ 7830.428495] Oops: invalid opcode: 0000 [#1] SMP PTI [ 7830.429318] CPU: 5 UID: 0 PID: 1451600 Comm: fsstress Not tainted 7.0.0-rc2-btrfs-next-227+ #1 PREEMPT(full) [ 7830.430899] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [ 7830.432771] RIP: 0010:extent_io_tree_panic+0x41/0x43 [btrfs] [ 7830.433815] Code: 75 0a 48 8b (...) [ 7830.436849] RSP: 0018:ffffd2334f4a3b68 EFLAGS: 00010246 [ 7830.437668] RAX: 0000000000000000 RBX: 00000000003ebfff RCX: 0000000000000000 [ 7830.438801] RDX: ffffffffc08d4368 RSI: ffffffffbb6ce475 RDI: ffff896501d6b780 [ 7830.439671] RBP: 0000000000001000 R08: 0000000000000000 R09: 00000000ffefffff [ 7830.440575] R10: 0000000000000000 R11: 0000000000000003 R12: 0000000000000000 [ 7830.441458] R13: ffff896547374c08 R14: 00000000003effff R15: ffff896547374c08 [ 7830.442333] FS: 00007f3e252af0c0(0000) GS:ffff896c6185d000(0000) knlGS:0000000000000000 [ 7830.443326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7830.444047] CR2: 00007f3e252ad000 CR3: 0000000113b0a004 CR4: 0000000000370ef0 [ 7830.444905] Call Trace: [ 7830.445229] [ 7830.445557] btrfs_clear_extent_bit_changeset.cold+0x43/0x80 [btrfs] [ 7830.446543] btrfs_clear_record_extent_bits+0x19/0x20 [btrfs] [ 7830.447308] qgroup_free_reserved_data+0xf9/0x170 [btrfs] [ 7830.448040] btrfs_buffered_write+0x368/0x8e0 [btrfs] [ 7830.448707] btrfs_direct_write+0x1a5/0x480 [btrfs] [ 7830.449396] btrfs_do_write_iter+0x18c/0x210 [btrfs] [ 7830.450167] vfs_write+0x21f/0x450 [ 7830.450662] ksys_write+0x5f/0xd0 [ 7830.451092] do_syscall_64+0xe9/0xf20 [ 7830.451610] entry_SYSCALL_64_after_hwframe+0x76/0x7e Change extent_io_tree_panic() to a macro so that we get a report that gives the exact place where the error happens. Example after this change: [63677.406061] BTRFS critical (device sdc): panic in btrfs_clear_extent_bit_changeset:744: extent io tree error on add_extent_changeset state start 1818624 end 1830911 (errno=1 unknown) [63677.410055] ------------[ cut here ]------------ [63677.410910] kernel BUG at fs/btrfs/extent-io-tree.c:744! [63677.411918] Oops: invalid opcode: 0000 [#1] SMP PTI [63677.413032] CPU: 0 UID: 0 PID: 13028 Comm: fsstress Not tainted 7.0.0-rc2-btrfs-next-227+ #1 PREEMPT(full) [63677.415139] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [63677.417283] RIP: 0010:btrfs_clear_extent_bit_changeset.cold+0xcd/0x10c [btrfs] [63677.418676] Code: 8b 37 48 8b (...) [63677.421917] RSP: 0018:ffffd2290a417b30 EFLAGS: 00010246 [63677.422824] RAX: 0000000000000000 RBX: 00000000001befff RCX: 0000000000000000 [63677.424320] RDX: ffffffffc0970348 RSI: ffffffffa92ce475 RDI: ffff8897ded9dc80 [63677.429772] RBP: 0000000000001000 R08: 0000000000000000 R09: 00000000ffefffff [63677.430787] R10: 0000000000000000 R11: 0000000000000003 R12: 0000000000000000 [63677.431818] R13: ffff8897966655d8 R14: 00000000001bffff R15: ffff8897966655d8 [63677.432764] FS: 00007f5c074c50c0(0000) GS:ffff889ef3b1d000(0000) knlGS:0000000000000000 [63677.433940] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [63677.434787] CR2: 00007f5c074c3000 CR3: 000000014b9de002 CR4: 0000000000370ef0 [63677.435960] Call Trace: [63677.436432] [63677.436838] btrfs_clear_record_extent_bits+0x19/0x20 [btrfs] [63677.437980] qgroup_free_reserved_data+0xf9/0x170 [btrfs] [63677.439070] btrfs_buffered_write+0x368/0x8e0 [btrfs] [63677.439889] btrfs_do_write_iter+0x1a8/0x210 [btrfs] [63677.441460] do_iter_readv_writev+0x145/0x240 [63677.446309] vfs_writev+0x120/0x3b0 [63677.446878] ? __do_sys_newfstat+0x33/0x60 [63677.447759] ? do_pwritev+0x8a/0xd0 [63677.449119] do_pwritev+0x8a/0xd0 [63677.452342] do_syscall_64+0xe9/0xf20 [63677.452961] entry_SYSCALL_64_after_hwframe+0x76/0x7e Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit aa40d5601e66d873d3095e07037fc070da16aab5 Author: Filipe Manana Date: Tue Mar 10 15:29:33 2026 +0000 btrfs: optimize clearing all bits from the last extent record in an io tree When we are clearing all the bits from the last record that contains the target range (i.e. the record starts before our target range and ends beyond it), we are doing a lot of unnecessary work: 1) Allocating a prealloc state if we don't have one already; 2) Adjust that last record's start offset to the end of our range and make the prealloc state have a range going from the original start offset of that last record to the end offset of our target range and the same bits as the last record. Then we insert the prealloc extent in the rbtree - this is done in split_state(); 3) Remove our prealloc state from the rbtree since all the bits were cleared - this is done in clear_state_bit(). This is only wasting time when we can simply trim the last record so that it's start offset is adjust to the end of the target range. So optimize for that case and avoid the prealloc state allocation, insertion and deletion from the rbtree. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 908ab5634751c4168e864d56a5270e251ce89ee3 Author: Qu Wenruo Date: Mon Mar 16 08:08:24 2026 +1030 btrfs: remove atomic parameter from btrfs_buffer_uptodate() That parameter was introduced by commit b9fab919b748 ("Btrfs: avoid sleeping in verify_parent_transid while atomic"). At that time we needed to lock the extent buffer range inside the io tree to avoid content changes, thus it could sleep. But that behavior is no longer there, as later commit 9e2aff90fc2a ("btrfs: stop using lock_extent in btrfs_buffer_uptodate") dropped the io tree lock. We can remove the @atomic parameter safely now. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3c53ad7549ed80f4d27b6bee89425bb022ecfd32 Author: Qu Wenruo Date: Sat Mar 14 10:30:39 2026 +1030 btrfs: output more info when duplicated ordered extent is found During development of a new feature, I triggered that btrfs_panic() inside insert_ordered_extent() and spent quite some unnecessary before noticing I'm passing incorrect flags when creating a new ordered extent. Unfortunately the existing error message is not providing much help. Enhance the output to provide file offset, num bytes and flags of both existing and new ordered extents. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 232770bcf3aa65ae83fd7389961fa651f09f7b3a Author: Qu Wenruo Date: Sat Mar 14 10:30:38 2026 +1030 btrfs: check type flags in alloc_ordered_extent() Unlike other flags used in btrfs, BTRFS_ORDERED_* macros are different as they cannot be directly used as flags. They are defined as bit values, thus they should be utilized with bit operations, not directly with logical operations. Unfortunately sometimes I forgot this and passed the incorrect flags to alloc_ordered_extent() and hit weird bugs. Enhance the type checks in alloc_ordered_extent(): - Make sure there is one and only one bit set for exclusive type flags There are four exclusive type flags, REGULAR, NOCOW, PREALLOC and COMPRESSED. So introduce a new macro, BTRFS_ORDERED_EXCLUSIVE_FLAGS, to cover above flags. Add an ASSERT() to check one and only one of those exclusive flags can be set for alloc_ordered_extent(). - Re-order the type bit numbers to the end of the enum This is make it much harder to get a valid false negative. E.g., with the old code BTRFS_ORDERED_REGULAR starts at zero, we can have the following flags passing the bit uniqueness check: * BTRFS_ORDERED_NOCOW Be treated as BTRFS_ORDERED_REGULAR (1 == 1UL << 0). * BTRFS_ORDERED_PREALLOC Be treated as BTRFS_ORDERED_NOCOW (2 == 1UL << 1). * BTRFS_ORDERED_DIRECT Be treated as BTRFS_ORDERED_PREALLOC (4 == 1UL << 2). Now all those types start at 8, passing any of those bit numbers as flags directly will not pass the ASSERT(). - Add a static assert to avoid overflow To make sure all BTRFS_ORDERED_* flags can fit into an unsigned long. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit f04c6475c2db778e7a9657a7f7b4a5033c933ff1 Author: ZhengYuan Huang Date: Fri Mar 13 17:19:23 2026 +0800 btrfs: revalidate cached tree blocks on the uptodate path read_extent_buffer_pages_nowait() returns immediately when an extent buffer is already marked uptodate. On that cache-hit path, the caller supplied btrfs_tree_parent_check is not re-run. This can let read_tree_root_path() accept a cached tree block whose actual header level/owner does not match the expected value derived from the parent. E.g. a corrupted root item that points to a tree block which doesn't even belong to that root, and has mismatching level/owner. But that tree block is already read and cached, later the corrupted tree root got read from disk and hit the cached tree block. Fix this by re-validating cached extent buffers against the supplied btrfs_tree_parent_check on the uptodate path, and make read_tree_root_path() pass its check to btrfs_buffer_uptodate(). This makes cache hits and fresh reads follow the same tree-parent verification rules, and turns the corruption into a read failure instead of constructing an inconsistent root object. Signed-off-by: ZhengYuan Huang Reviewed-by: Qu Wenruo [ Resolve the conflict with extent_buffer_uptodate() helper, handle transid mismatch case ] Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit e5267796482fad93ee7948c7cbc37f32046244f7 Author: Philipp Hahn Date: Tue Mar 10 12:48:28 2026 +0100 btrfs: prefer IS_ERR_OR_NULL() over manual NULL check Prefer using IS_ERR_OR_NULL() over using IS_ERR() and a manual NULL check. IS_ERR_OR_NULL() already uses likely(!ptr) internally. checkpatch does not like nesting it: > WARNING: nested (un)?likely() calls, IS_ERR_OR_NULL already uses > unlikely() internally Remove the explicit use of likely(). Change generated with coccinelle. Signed-off-by: Philipp Hahn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 94e445085c7be52c1cc937959fa8254b56cdf672 Author: ZhengYuan Huang Date: Wed Mar 11 08:26:10 2026 +1030 btrfs: tree-checker: introduce checks for FREE_SPACE_BITMAP Introduce checks for FREE_SPACE_BITMAP item, which include: - Key alignment check Same as FREE_SPACE_EXTENT, the objectid is the logical bytenr of the free space, and offset is the length of the free space, so both should be aligned to the fs block size. - Non-zero range check A zero key->offset would describe an empty bitmap, which is invalid. - Item size check The item must hold exactly DIV_ROUND_UP(key->offset >> sectorsize_bits, BITS_PER_BYTE) bytes. A mismatch indicates a truncated or otherwise corrupt bitmap item; without this check, the bitmap loading path would walk past the end of the leaf and trigger a NULL dereference in assert_eb_folio_uptodate(). Signed-off-by: ZhengYuan Huang Reviewed-by: Qu Wenruo Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit b4a1246298d9c0a7cbcbc05d437c5803eb6a9994 Author: Qu Wenruo Date: Tue Mar 10 08:49:26 2026 +1030 btrfs: tree-checker: introduce checks for FREE_SPACE_EXTENT Introduce FREE_SPACE_EXTENT checks, which include: - The key alignment check The objectid is the logical bytenr of the free space, and offset is the length of the free space, thus they should all be aligned to the fs block size. - The item size check The FREE_SPACE_EXTENT item should have a size of zero. Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 52e71eb95cc73e544f36041973bd3c4cd460a4fb Author: Qu Wenruo Date: Tue Mar 10 08:49:25 2026 +1030 btrfs: tree-checker: introduce checks for FREE_SPACE_INFO Introduce checks for FREE_SPACE_INFO item, which include: - Key alignment check The objectid is the logical bytenr of the chunk/bg, and offset is the length of the chunk/bg, thus they should all be aligned to the fs block size. - Item size check The FREE_SPACE_INFO should a fix size. - Flags check The flags member should have no other flags than BTRFS_FREE_SPACE_USING_BITMAPS. For future expansion, introduce a new macro BTRFS_FREE_SPACE_FLAGS_MASK for such checks. And since we're here, the BTRFS_FREE_SPACE_USING_BITMAPS should not use unsigned long long, as the flags is only 32 bits wide. So fix that to use unsigned long. - Extent count check That member shows how many free space bitmap/extent items there are inside the chunk/bg. We know the chunk size (from key->offset), thus there should be at most (key->offset >> sectorsize_bits) blocks inside the chunk. Use that value as the upper limit and if that counter is larger than that, there is a high chance it's a bitflip in high bits. Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit ad0c23c97b4e9ed8233905294dd86659009c6e8a Author: Johannes Thumshirn Date: Thu Mar 5 11:06:44 2026 +0100 btrfs: zoned: limit number of zones reclaimed in flush_space() Limit the number of zones reclaimed in flush_space()'s RECLAIM_ZONES state. This prevents possibly long running reclaim sweeps to block other tasks in the system, while the system is under pressure anyways, causing the tasks to hang. An example of this can be seen here, triggered by fstests generic/551: generic/551 [ 27.042349] run fstests generic/551 at 2026-02-27 11:05:30 BTRFS: device fsid 78c16e29-20d9-4c8e-bc04-7ba431be38ff devid 1 transid 8 /dev/vdb (254:16) scanned by mount (806) BTRFS info (device vdb): first mount of filesystem 78c16e29-20d9-4c8e-bc04-7ba431be38ff BTRFS info (device vdb): using crc32c checksum algorithm BTRFS info (device vdb): host-managed zoned block device /dev/vdb, 64 zones of 268435456 bytes BTRFS info (device vdb): zoned mode enabled with zone size 268435456 BTRFS info (device vdb): checking UUID tree BTRFS info (device vdb): enabling free space tree INFO: task kworker/u38:1:90 blocked for more than 120 seconds. Not tainted 7.0.0-rc1+ #345 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u38:1 state:D stack:0 pid:90 tgid:90 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound btrfs_async_reclaim_data_space Call Trace: __schedule+0x34f/0xe70 schedule+0x41/0x140 schedule_timeout+0xa3/0x110 ? mark_held_locks+0x40/0x70 ? lockdep_hardirqs_on_prepare+0xd8/0x1c0 ? trace_hardirqs_on+0x18/0x100 ? lockdep_hardirqs_on+0x84/0x130 ? _raw_spin_unlock_irq+0x33/0x50 wait_for_completion+0xa4/0x150 ? __flush_work+0x24c/0x550 __flush_work+0x339/0x550 ? __pfx_wq_barrier_func+0x10/0x10 ? wait_for_completion+0x39/0x150 flush_space+0x243/0x660 ? find_held_lock+0x2b/0x80 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0x17/0x110 ? local_clock+0x15/0x30 ? lock_release+0x1b7/0x4b0 do_async_reclaim_data_space+0xe8/0x160 btrfs_async_reclaim_data_space+0x19/0x30 process_one_work+0x20a/0x5f0 ? lock_is_held_type+0xcd/0x130 worker_thread+0x1e2/0x3c0 ? __pfx_worker_thread+0x10/0x10 kthread+0x103/0x150 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x20d/0x320 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Showing all locks held in the system: 1 lock held by khungtaskd/67: #0: ffffffff824d58e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x194 2 locks held by kworker/u38:1/90: #0: ffff8881000aa158 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x3c4/0x5f0 #1: ffffc90000c17e58 ((work_completion)(&fs_info->async_data_reclaim_work)){+.+.}-{0:0}, at: process_one_work+0x1c0/0x5f0 5 locks held by kworker/u39:1/191: #0: ffff8881000aa158 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x3c4/0x5f0 #1: ffffc90000dfbe58 ((work_completion)(&fs_info->reclaim_bgs_work)){+.+.}-{0:0}, at: process_one_work+0x1c0/0x5f0 #2: ffff888101da0420 (sb_writers#9){.+.+}-{0:0}, at: process_one_work+0x20a/0x5f0 #3: ffff88811040a648 (&fs_info->reclaim_bgs_lock){+.+.}-{4:4}, at: btrfs_reclaim_bgs_work+0x1de/0x770 #4: ffff888110408a18 (&fs_info->cleaner_mutex){+.+.}-{4:4}, at: btrfs_relocate_block_group+0x95a/0x20f0 1 lock held by aio-dio-write-v/980: #0: ffff888110093008 (&sb->s_type->i_mutex_key#15){++++}-{4:4}, at: btrfs_inode_lock+0x51/0xb0 ============================================= To prevent these long running reclaims from blocking the system, only reclaim 5 block_groups in the RECLAIM_ZONES state of flush_space(). Also as these reclaims are now constrained, it opens up the use for a synchronous call to brtfs_reclaim_block_groups(), eliminating the need to place the reclaim task on a workqueue and then flushing the workqueue again. Reviewed-by: Boris Burkov Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit bd0ffde1d31e96a19ad50ab455285202b619614f Author: Johannes Thumshirn Date: Thu Mar 5 11:06:43 2026 +0100 btrfs: create btrfs_reclaim_block_groups() Create a function btrfs_reclaim_block_groups() that gets called from the block-group reclaim worker. This allows creating synchronous block_group reclaim later on. Reviewed-by: Damien Le Moal Reviewed-by: Boris Burkov Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit b619185168555dc286adf8af634bea39b9cf0107 Author: Johannes Thumshirn Date: Thu Mar 5 11:06:42 2026 +0100 btrfs: move reclaiming of a single block group into its own function The main work of reclaiming a single block-group in btrfs_reclaim_bgs_work() is done inside the loop iterating over all the block_groups in the fs_info->reclaim_bgs list. Factor out reclaim of a single block group from the loop to improve readability. No functional change intended. Reviewed-by: Damien Le Moal Reviewed-by: Boris Burkov Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit 3eaf5f082c4cc71dea70bee23355bf63b24df303 Author: Qu Wenruo Date: Wed Mar 4 15:48:44 2026 +1030 btrfs: extract inlined creation into a dedicated delalloc helper Currently we call cow_file_range_inline() in different situations, from regular cow_file_range() to compress_file_range(). This is because inline extent creation has different conditions based on whether it's a compressed one or not. But on the other hand, inline extent creation shouldn't be so distributed, we can just have a dedicated branch in btrfs_run_delalloc_range(). It will become more obvious for compressed inline cases, it makes no sense to go through all the complex async extent mechanism just to inline a single block. So here we introduce a dedicated run_delalloc_inline() helper, and remove all inline related handling from cow_file_range() and compress_file_range(). There is a special update to inode_need_compress(), that a new @check_inline parameter is introduced. This is to allow inline specific checks to be done inside run_delalloc_inline(), which allows single block compression, but other call sites should always reject single block compression. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 9d7db41000570e7a6bb2c7a16811532dae2ef986 Author: Qu Wenruo Date: Tue Mar 3 18:45:10 2026 +1030 btrfs: move the mapping_set_error() out of the loop in end_bbio_data_write() Previously we have to call mapping_set_error() inside the for_each_folio_all() loop, because we do not have a better way to grab an inode, other than through folio->mapping. But nowadays every btrfs_bio has its inode member populated, thus we can easily grab the inode and its i_mapping easily, without the help from a folio. Now we can move that mapping_set_error() out of the loop, and use bbio->inode to grab the i_mapping. Reviewed-by: David Sterba Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 99fe7e57d3e4e29a37fc2b2f434716344aa3498b Author: Qu Wenruo Date: Tue Mar 3 18:45:09 2026 +1030 btrfs: remove the alignment check in end_bbio_data_write() The check is not necessary because: - There is already assert_bbio_alignment() at btrfs_submit_bbio() - There is also btrfs_subpage_assert() for all btrfs_folio_*() helpers - The original commit mentions the check may go away in the future Commit 17a5adccf3fd01 ("btrfs: do away with non-whole_page extent I/O") introduced the check first, and in the commit message: I've replaced the whole_page computations with warnings, just to be sure that we're not issuing partial page reads or writes. The warnings should probably just go away some time. - No similar check in all other endio functions No matter if it's data read, compressed read or write. - There is no such report for very long I do not even remember if there is any such report. Thus the need to do such check in end_bbio_data_write() is very weak, and we can just get rid of it. Reviewed-by: David Sterba Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit cc970d21c4f37b7cbedd73e043b69faf2c66a6fe Author: Leo Martins Date: Thu Feb 26 01:51:08 2026 -0800 btrfs: add tracepoint for search slot restart tracking Add a btrfs_search_slot_restart tracepoint that fires at each restart site in btrfs_search_slot(), recording the root, tree level, and reason for the restart. This enables tracking search slot restarts which contribute to COW amplification under memory pressure. The four restart reasons are: - write_lock: insufficient write lock level, need to restart with higher lock - setup_nodes: node setup returned -EAGAIN - slot_zero: insertion at slot 0 requires higher write lock level - read_block: read_block_for_search returned -EAGAIN (block not cached or lock contention) COW counts are already tracked by the existing trace_btrfs_cow_block() tracepoint. The per-restart-site tracepoint avoids counter overhead in the critical path when tracepoints are disabled, and provides richer per-event information that bpftrace scripts can aggregate into counts, histograms, and per-root breakdowns. Reviewed-by: Filipe Manana Reviewed-by: Boris Burkov Signed-off-by: Leo Martins Signed-off-by: David Sterba commit f9a48549a15aa369d42cebc08a6a72b71a53d547 Author: Leo Martins Date: Thu Feb 26 01:51:07 2026 -0800 btrfs: inhibit extent buffer writeback to prevent COW amplification Inhibit writeback on COW'd extent buffers for the lifetime of the transaction handle, preventing background writeback from setting BTRFS_HEADER_FLAG_WRITTEN and causing unnecessary re-COW. COW amplification occurs when background writeback flushes an extent buffer that a transaction handle is still actively modifying. When lock_extent_buffer_for_io() transitions a buffer from dirty to writeback, it sets BTRFS_HEADER_FLAG_WRITTEN, marking the block as having been persisted to disk at its current bytenr. Once WRITTEN is set, should_cow_block() must either COW the block again or overwrite it in place, both of which are unnecessary overhead when the buffer is still being modified by the same handle that allocated it. By inhibiting background writeback on actively-used buffers, WRITTEN is never set while a transaction handle holds a reference to the buffer, avoiding this overhead entirely. Add an atomic_t writeback_inhibitors counter to struct extent_buffer, which fits in an existing 6-byte hole without increasing struct size. When a buffer is COW'd in btrfs_force_cow_block(), call btrfs_inhibit_eb_writeback() to store the eb in the transaction handle's writeback_inhibited_ebs xarray (keyed by eb->start), take a reference, and increment writeback_inhibitors. The function handles dedup (same eb inhibited twice by the same handle) and replacement (different eb at the same logical address). Allocation failure is graceful: the buffer simply falls back to the pre-existing behavior where it may be written back and re-COW'd. Also inhibit writeback in should_cow_block() when COW is skipped, so that every transaction handle that reuses an already-COW'd buffer also inhibits its writeback. Without this, if handle A COWs a block and inhibits it, and handle B later reuses the same block without inhibiting, handle A's uninhibit on end_transaction leaves the buffer unprotected while handle B is still using it. This ensures all handles that access a COW'd buffer contribute to the inhibitor count, and the buffer remains protected until the last handle releases it. In lock_extent_buffer_for_io(), when writeback_inhibitors is non-zero and the writeback mode is WB_SYNC_NONE, skip the buffer. WB_SYNC_NONE is used by the VM flusher threads for background and periodic writeback, which are the only paths that cause COW amplification by opportunistically writing out dirty extent buffers mid-transaction. Skipping these is safe because the buffers remain dirty in the page cache and will be written out at transaction commit time. WB_SYNC_ALL must always proceed regardless of writeback_inhibitors. This is required for correctness in the fsync path: btrfs_sync_log() writes log tree blocks via filemap_fdatawrite_range() (WB_SYNC_ALL) while the transaction handle that inhibited those same blocks is still active. Without the WB_SYNC_ALL bypass, those inhibited log tree blocks would be silently skipped, resulting in an incomplete log on disk and corruption on replay. btrfs_write_and_wait_transaction() also uses WB_SYNC_ALL via filemap_fdatawrite_range(); for that path, inhibitors are already cleared beforehand, but the bypass ensures correctness regardless. Uninhibit in __btrfs_end_transaction() before atomic_dec(num_writers) to prevent a race where the committer proceeds while buffers are still inhibited. Also uninhibit in btrfs_commit_transaction() before writing and in cleanup_transaction() for the error path. Reviewed-by: Filipe Manana Reviewed-by: Sun YangKai Reviewed-by: Boris Burkov Signed-off-by: Leo Martins Signed-off-by: David Sterba commit cab4c8b594e23649591317c5f0606ea6a8a27236 Author: Qu Wenruo Date: Fri Feb 27 13:15:53 2026 +1030 btrfs: extract the max compression chunk size into a macro We have two locations using open-coded 512K size, as the async chunk size. For compression we have not only the max size a compressed extent can represent (128K), but also how large an async chunk can be (512K). Although we have a macro for the maximum compressed extent size, we do not have any macro for the async chunk size. Add such a macro and replace the two open-coded SZ_512K. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 45cc960ff777ac9f4e57c896f1d01adc99fd696e Author: Filipe Manana Date: Wed Feb 25 19:22:41 2026 +0000 btrfs: remove pointless error check in btrfs_check_dir_item_collision() We're under the IS_ERR() branch so we know that 'ret', which got assigned the value of PTR_ERR(di) is always negative, so there's no point in checking if it's negative. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 01cebce71f2f90abe6a98d3066c085a34b95d96e Author: Filipe Manana Date: Thu Feb 19 16:05:39 2026 +0000 btrfs: remove duplicated uuid tree existence check in btrfs_uuid_tree_add() There's no point in checking if the uuid root exists in btrfs_uuid_tree_add(), since we already do it in btrfs_uuid_tree_lookup(). We can just remove the check from btrfs_uuid_tree_add() and make btrfs_uuid_tree_lookup() return -EINVAL instead of -ENOENT in case the uuid tree does not exists. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 7aa1788ff09fba1db7d66b38a20051f0997b9cb9 Author: Filipe Manana Date: Tue Feb 24 15:13:32 2026 +0000 btrfs: stop checking for -EEXIST return value from btrfs_uuid_tree_add() We never return -EEXIST from btrfs_uuid_tree_add(), if the item already exists we extend it, so it's pointless to check for such return value. Furthermore, in create_pending_snapshot(), the logic is completely broken. The goal was to not error out and abort the transaction in case of -EEXIST but we left 'ret' with the -EEXIST value, so we end up setting pending->error to -EEXIST and return that error up the call chain up to btrfs_commit_transaction(), which will abort the transaction. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f11c3d855988ce16da14a416832d0b876f44eece Author: Miquel Sabaté Solà Date: Mon Feb 16 01:28:06 2026 +0100 btrfs: report filesystem shutdown via fserror Commit 347b7042fb26 ("Merge patch series "fs: generic file IO error reporting"") has introduced a common framework for reporting errors to fsnotify in a standard way. One of the functions being introduced is fserror_report_shutdown() that, when combined with the experimental support for shutdown in btrfs, it means that user-space can also easily detect whenever a btrfs filesystem has been marked as shutdown. Signed-off-by: Miquel Sabaté Solà Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2d2b5507e598984f5832f0c5193f35733c42995e Author: Miquel Sabaté Solà Date: Tue Feb 24 22:45:44 2026 +0100 btrfs: replace kcalloc() calls to kzalloc_objs() Commit 2932ba8d9c99 ("slab: Introduce kmalloc_obj() and family") introduced, among many others, the kzalloc_objs() helper, which has some benefits over kcalloc(). Namely, internal introspection of the allocated type now becomes possible, allowing for future alignment-aware choices to be made by the allocator and future hardening work that can be type sensitive. Dropping 'sizeof' comes also as a nice side-effect. Moreover, this also allows us to be in line with the recent tree-wide migration to the kmalloc_obj() and family of helpers. See commit 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types"). Reviewed-by: Kees Cook Signed-off-by: Miquel Sabaté Solà Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6603a9859887ed325fea9fc9347c2d9e6cf3bbe3 Author: Qu Wenruo Date: Fri Feb 20 10:13:38 2026 +1030 btrfs: do compressed bio size roundup and zeroing in one go Currently we zero out all the remaining bytes of the last folio of the compressed bio, then round the bio size to fs block boundary. But that is done in two different functions, zero_last_folio() to zero the remaining bytes of the last folio, and round_up_last_block() to round up the bio to fs block boundary. There are some minor problems: - zero_last_folio() is zeroing ranges we won't submit This is mostly affecting block size < page size cases, where we can have a large folio (e.g. 64K), but the fs block size is only 4K. In that case, we may only want to submit the first 4K of the folio, the remaining range won't matter, but we still zero them all. This causes unnecessary CPU usage just to zero out some bytes we won't utilized. - compressed_bio_last_folio() is called twice in two different functions Which in theory we only need to call it once. Enhance the situation by: - Only zero out bytes up to the fs block boundary Thus this will reduce some overhead for bs < ps cases. - Move the folio_zero_range() call into round_up_last_block() So that we can reuse the same folio returned by compressed_bio_last_folio(). Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit b05342fe47b9828d004baf2b24cccd0479de54a5 Author: Qu Wenruo Date: Fri Feb 20 14:11:51 2026 +1030 btrfs: reduce the size of compressed_bio The member compressed_bio::compressed_len can be replaced by the bio size, as we always submit the full compressed data without any partial read/write. Furthermore we already have enough ASSERT()s making sure the bio size matches the ordered extent or the extent map. This saves 8 bytes from compressed_bio: Before: struct compressed_bio { u64 start; /* 0 8 */ unsigned int len; /* 8 4 */ unsigned int compressed_len; /* 12 4 */ u8 compress_type; /* 16 1 */ bool writeback; /* 17 1 */ /* XXX 6 bytes hole, try to pack */ struct btrfs_bio * orig_bbio; /* 24 8 */ struct btrfs_bio bbio __attribute__((__aligned__(8))); /* 32 304 */ /* XXX last struct has 1 bit hole */ /* size: 336, cachelines: 6, members: 7 */ /* sum members: 330, holes: 1, sum holes: 6 */ /* member types with bit holes: 1, total: 1 */ /* forced alignments: 1 */ /* last cacheline: 16 bytes */ } __attribute__((__aligned__(8))); After: struct compressed_bio { u64 start; /* 0 8 */ unsigned int len; /* 8 4 */ u8 compress_type; /* 12 1 */ bool writeback; /* 13 1 */ /* XXX 2 bytes hole, try to pack */ struct btrfs_bio * orig_bbio; /* 16 8 */ struct btrfs_bio bbio __attribute__((__aligned__(8))); /* 24 304 */ /* XXX last struct has 1 bit hole */ /* size: 328, cachelines: 6, members: 6 */ /* sum members: 326, holes: 1, sum holes: 2 */ /* member types with bit holes: 1, total: 1 */ /* forced alignments: 1 */ /* last cacheline: 8 bytes */ } __attribute__((__aligned__(8))); Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit c4bc2dd32c63a70ed948ed9927ea2c46f7c5b454 Author: Qu Wenruo Date: Fri Feb 20 14:11:50 2026 +1030 btrfs: introduce a common helper to calculate the size of a bio We have several call sites doing the same work to calculate the size of a bio: struct bio_vec *bvec; u32 bio_size = 0; int i; bio_for_each_bvec_all(bvec, bio, i) bio_size += bvec->bv_len; We can use a common helper instead of open-coding it everywhere. This also allows us to constify the @bio_size variables used in all the call sites. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8c0b917d78fc2a1fb4afac90a597b75e0a5b7223 Author: Alexey Velichayshiy Date: Sun Feb 22 15:47:23 2026 +0300 btrfs: remove redundant nowait check in lock_extent_direct() The nowait flag is always false in this context, making the conditional check unnecessary. Simplify the code by directly assigning -ENOTBLK. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Alexey Velichayshiy Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b6193a891653efcd8d6d39610ace204e157bed00 Author: Mark Harmstone Date: Wed Feb 18 12:41:00 2026 +0000 btrfs: fix placement of unlikely() in btrfs_insert_one_raid_extent() Fix the unlikely added to btrfs_insert_one_raid_extent() by commit a929904cf73b65 ("btrfs: add unlikely annotations to branches leading to transaction abort"): the exclamation point is in the wrong place, so we are telling the compiler that allocation failure is actually expected. Reviewed-by: Filipe Manana Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2c4648a39b23af5516df6509c856238d84693b78 Author: Filipe Manana Date: Tue Feb 17 17:48:17 2026 +0000 btrfs: pass a btrfs inode to tree-log.c:fill_inode_item() All internal functions should be given a btrfs_inode for consistency and not a VFS inode. So pass a btrfs_inode instead of a VFS inode. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d821d4f6fb804d2579b4523e591cb6dd03a49b86 Author: Filipe Manana Date: Thu Feb 19 15:37:59 2026 +0000 btrfs: stop printing condition result in assertion failure messages It's useless to print the result of the condition, it's always 0 if the assertion is triggered, so it doesn't provide any useful information. Examples: assertion failed: cb->bbio.bio.bi_iter.bi_size == disk_num_bytes :: 0, in inode.c:9991 assertion failed: folio_test_writeback(folio) :: 0, in subpage.c:476 So stop printing that, it's always ":: 0" for any assertion triggered (except for conditions that are just an identifier). Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1899d9b09d171834a950254ad21718618e5c7fd6 Author: Filipe Manana Date: Thu Feb 19 15:34:12 2026 +0000 btrfs: constify arguments of some functions There are several functions that take pointer arguments but don't need to modify the objects they point to, so add the const qualifiers. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1fce8eec9f89e3aaa13ced7c7ca625ab427b1bcc Author: Filipe Manana Date: Wed Feb 18 15:07:09 2026 +0000 btrfs: avoid unnecessary root node COW during snapshotting There's no need to COW the root node of the subvolume we are snapshotting because we then call btrfs_copy_root(), which creates a copy of the root node and sets its generation to the current transaction. So remove this redundant COW right before calling btrfs_copy_root(), saving one extent allocation, memory allocation, copying things, etc, and making the code less confusing. Also rename the extent buffer variable from "old" to "root_eb" since that name no longer makes any sense after removing the unnecessary COW operation. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 13816fd5aa3ca2842be5dba1dcff3b86b174c9c0 Author: Chen Guan Jie Date: Tue Feb 17 06:16:32 2026 +0800 btrfs: check snapshot_force_cow earlier in can_nocow_file_extent() When a snapshot is being created, the atomic counter snapshot_force_cow is incremented to force incoming writes to fallback to COW. This is a critical mechanism to protect the consistency of the snapshot being taken. Currently, can_nocow_file_extent() checks this counter only after performing several checks, most notably the expensive cross-reference check via btrfs_cross_ref_exist(). btrfs_cross_ref_exist() releases the path and performs a search in the extent tree or backref cache, which involves btree traversals and locking overhead. Moves the snapshot_force_cow check to the very beginning of can_nocow_file_extent(). This reordering is safe and beneficial because: 1. args->writeback_path is invariant for the duration of the call (set by caller run_delalloc_nocow). 2. is_freespace_inode is a static property of the inode. 3. The state of snapshot_force_cow is driven by the btrfs_mksnapshot() process. Checking it earlier does not change the outcome of the NOCOW decision, but effectively prunes the expensive code path when a fallback to COW is inevitable. By failing fast when a snapshot is pending, we avoid the unnecessary overhead of btrfs_cross_ref_exist() and other extent item checks in the scenario where NOCOW is already known to be impossible. Signed-off-by: Chen Guan Jie Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 2e0e3716c7b6f8d71df2fbe709b922e54700f71b Author: Qu Wenruo Date: Mon Feb 16 13:19:38 2026 +1030 btrfs: do not mark inode incompressible after inline attempt fails [BUG] The following sequence will set the file with nocompress flag: # mkfs.btrfs -f $dev # mount $dev $mnt -o max_inline=4,compress # xfs_io -f -c "pwrite 0 2k" -c sync $mnt/foobar The inode will have NOCOMPRESS flag, even if the content itself (all 0xcd) can still be compressed very well: item 4 key (257 INODE_ITEM 0) itemoff 15879 itemsize 160 generation 9 transid 10 size 2097152 nbytes 1052672 block group 0 mode 100600 links 1 uid 0 gid 0 rdev 0 sequence 257 flags 0x8(NOCOMPRESS) Please note that, this behavior is there even before commit 59615e2c1f63 ("btrfs: reject single block sized compression early"). [CAUSE] At compress_file_range(), after btrfs_compress_folios() call, we try making an inlined extent by calling cow_file_range_inline(). But cow_file_range_inline() calls can_cow_file_range_inline() which has more accurate checks on if the range can be inlined. One of the user configurable conditions is the "max_inline=" mount option. If that value is set low (like the example, 4 bytes, which cannot store any header), or the compressed content is just slightly larger than 2K (the default value, meaning a 50% compression ratio), cow_file_range_inline() will return 1 immediately. And since we're here only to try inline the compressed data, the range is no larger than a single fs block. Thus compression is never going to make it a win, we fall back to marking the inode incompressible unavoidably. [FIX] Just add an extra check after inline attempt, so that if the inline attempt failed, do not set the nocompress flag. As there is no way to remove that flag, and the default 50% compression ratio is way too strict for the whole inode. CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit a11d6912fdd9e57aff889ec97256b1d6b4e5bf06 Author: Qu Wenruo Date: Thu Feb 12 19:43:56 2026 +1030 btrfs: remove folio parameter from ordered io related functions Both functions btrfs_finish_ordered_extent() and btrfs_mark_ordered_io_finished() are accepting an optional folio parameter. That @folio is passed into can_finish_ordered_extent(), which later will test and clear the ordered flag for the involved range. However I do not think there is any other call site that can clear ordered flags of an page cache folio and can affect can_finish_ordered_extent(). There are limited *_clear_ordered() callers out of can_finish_ordered_extent() function: - btrfs_migrate_folio() This is completely unrelated, it's just migrating the ordered flag to the new folio. - btrfs_cleanup_ordered_extents() We manually clean the ordered flags of all involved folios, then call btrfs_mark_ordered_io_finished() without a @folio parameter. So it doesn't need and didn't pass a @folio parameter in the first place. - btrfs_writepage_fixup_worker() This function is going to be removed soon, and we should not hit that function anymore. - btrfs_invalidate_folio() This is the real call site we need to bother with. If we already have a bio running, btrfs_finish_ordered_extent() in end_bbio_data_write() will be executed first, as btrfs_invalidate_folio() will wait for the writeback to finish. Thus if there is a running bio, it will not see the range has ordered flags, and just skip to the next range. If there is no bio running, meaning the ordered extent is created but the folio is not yet submitted. In that case btrfs_invalidate_folio() will manually clear the folio ordered range, but then manually finish the ordered extent with btrfs_dec_test_ordered_pending() without bothering the folio ordered flags. Meaning if the OE range with folio ordered flags will be finished manually without the need to call can_finish_ordered_extent(). This means all can_finish_ordered_extent() call sites should get a range that has folio ordered flag set, thus the old "return false" branch should never be triggered. Now we can: - Remove the @folio parameter from involved functions * btrfs_mark_ordered_io_finished() * btrfs_finish_ordered_extent() For call sites passing a @folio into those functions, let them manually clear the ordered flag of involved folios. - Move btrfs_finish_ordered_extent() out of the loop in end_bbio_data_write() We only need to call btrfs_finish_ordered_extent() once per bbio, not per folio. - Add an ASSERT() to make sure all folio ranges have ordered flags It's only for end_bbio_data_write(). And we already have enough safe nets to catch over-accounting of ordered extents. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit afe60cdb3cb9495472b7feb10c5f2b31b7429956 Author: Qu Wenruo Date: Thu Feb 12 09:19:19 2026 +1030 btrfs: remove the btrfs_inode parameter from btrfs_remove_ordered_extent() We already have btrfs_ordered_extent::inode, thus there is no need to pass a btrfs_inode parameter to btrfs_remove_ordered_extent(). Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit e677ccac5a7b84db4894c723efb2dd2d1607046f Author: Qu Wenruo Date: Thu Feb 12 07:44:21 2026 +1030 btrfs: remove out-of-date comments in btree_writepages() There is a lengthy comment introduced in commit b3ff8f1d380e ("btrfs: Don't submit any btree write bio if the fs has errors") and commit c9583ada8cc4 ("btrfs: avoid double clean up when submit_one_bio() failed"), explaining two things: - Why we don't want to submit metadata write if the fs has errors - Why we re-set @ret to 0 if it's positive However it's no longer uptodate by the following reasons: - We have better checks nowadays Commit 2618849f31e7 ("btrfs: ensure no dirty metadata is written back for an fs with errors") has introduced better checks, that if the fs is in an error state, metadata writes will not result in any bio but instead complete immediately. That covers all metadata writes better. - Mentioned incorrect function name The commit c9583ada8cc4 ("btrfs: avoid double clean up when submit_one_bio() failed") introduced this ret > 0 handling, but at that time the function name submit_extent_page() was already incorrect. It was submit_eb_page() that could return >0 at that time, and submit_extent_page() could only return 0 or <0 for errors, never >0. Later commit b35397d1d325 ("btrfs: convert submit_extent_page() to use a folio") changed "submit_extent_page()" to "submit_extent_folio()" in the comment, but it doesn't make any difference since the function name is wrong from day 1. Finally commit 5e121ae687b8 ("btrfs: use buffer xarray for extent buffer writeback operations") completely reworked how metadata writeback works, and removed submit_eb_page(), leaving only the wrong function name in the comment. Furthermore the function submit_extent_folio() still exists in the latest code base, but is never utilized for metadata writeback, causing more confusion. Just remove the lengthy comment, and replace the "if (ret > 0)" check with an ASSERT(), since only btrfs_check_meta_write_pointer() can modify @ret and it returns 0 or <0 for errors. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit c9e39e92e4aab403df5004cbaa5be000e1db63bf Author: Filipe Manana Date: Sun Feb 8 18:42:13 2026 +0000 btrfs: remove bogus root search condition in load_extent_tree_free() There's no need to pass the maximum between the block group's start offset and BTRFS_SUPER_INFO_OFFSET (64K) since we can't have any block groups allocated in the first megabyte, as that's reserved space. Furthermore, even if we could, the correct thing to do was to pass the block group's start offset anyway - and that's precisely what we do for block groups hat happen to contain a superblock mirror (the range for the super block is never marked as free and it's marked as dirty in the fs_info->excluded_extents io tree). So simplify this and get rid of that maximum expression. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 75acee66b63ce2228b35ccd94221b1b1c3314885 Author: Chen Ni Date: Wed Feb 11 12:40:32 2026 +0800 btrfs: remove duplicate include of delayed-inode.h in disk-io.c Remove duplicate inclusion of delayed-inode.h in disk-io.c to clean up redundant code. Signed-off-by: Chen Ni Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 6fa972956830b17b0bf905a5b3da87517300dc0b Author: Filipe Manana Date: Tue Feb 10 12:18:50 2026 +0000 btrfs: pass literal booleans to functions that take boolean arguments We have several functions with parameters defined as booleans but then we have callers passing integers, 0 or 1, instead of false and true. While this isn't a bug since 0 and 1 are converted to false and true, it is odd and less readable. Change the callers to pass true and false literals instead. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 521f8672b6b34a8959f8b5a5859364e52aa1ba8a Author: Filipe Manana Date: Tue Feb 10 12:08:56 2026 +0000 btrfs: remove pointless out label in qgroup_account_snapshot() The 'out' label is pointless as there are no cleanups to perform there, we can replace every goto with a direct return. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b943097758ffa35dba31053de927d1cbb40a1bf5 Author: Qu Wenruo Date: Tue Feb 10 13:54:31 2026 +1030 btrfs: rename btrfs_csum_file_blocks() to btrfs_insert_data_csums() The function btrfs_csum_file_blocks() is a little confusing, unlike btrfs_csum_one_bio(), it is not calculating the checksum of some file blocks. Instead it's just inserting the already calculated checksums into a given root (can be a csum root or a log tree). So rename it to btrfs_insert_data_csums() to reflect its behavior better. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 00c865b60b0650723e1f103dc58ca3f01e7bd662 Author: Qu Wenruo Date: Tue Feb 10 13:54:30 2026 +1030 btrfs: make add_pending_csums() to take an ordered extent as parameter The structure btrfs_ordered_extent has a lot of list heads for different purposes, passing a random list_head pointer is never a good idea as if the wrong list is passed in, the type casting along with the fs will be screwed up. Instead pass the btrfs_ordered_extent pointer, and grab the csum_list inside add_pending_csums() to make it a little safer. Since we're here, also update the comments to follow the current style. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 09664971b33718680c20f94aaf5d18fc8d7b0a3c Author: Qu Wenruo Date: Tue Feb 10 13:54:29 2026 +1030 btrfs: rename btrfs_ordered_extent::list to csum_list That list head records all pending checksums for that ordered extent. And unlike other lists, we just use the name "list", which can be very confusing for readers. Rename it to "csum_list" which follows the remaining lists, showing the purpose of the list. And since we're here, remove a comment inside btrfs_finish_ordered_zoned() where we have "ASSERT(!list_empty(&ordered->csum_list))" to make sure the OE has pending csums. That comment is only here to make sure we do not call list_first_entry() before checking BTRFS_ORDERED_PREALLOC. But since we already have that bit checked and even have a dedicated ASSERT(), there is no need for that comment anymore. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 74e505fc89e2e6383b4f10f23318dfc3b62f70dc Author: Johannes Thumshirn Date: Tue Feb 10 14:19:46 2026 +0100 btrfs: change return type of cache_save_setup to void None of the callers of `cache_save_setup` care about the return type as the space cache is purely and optimization. Also the free space cache is a deprecated feature that is being phased out. Change the return type of `cache_save_setup` to void to reflect this. Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit 0eb6c12491ca44140a5facdaee3c8cb6f41202d2 Author: Filipe Manana Date: Mon Feb 9 19:45:06 2026 +0000 btrfs: avoid starting new transaction and commit in relocate_block_group() We join a transaction with the goal of catching the current transaction and then commit it to get rid of pinned extents and reclaim free space, but a join can create a new transaction if there isn't any running, and if right before we did the join the current transaction happened to be committed by someone else (like the transaction kthread for example), we end up starting and committing a new transaction, causing rotation of the super block backup roots besides extra and useless IO. So instead of doing a transaction join followed by a commit, use the helper btrfs_commit_current_transaction() which ensures no transaction is created if there isn't any running. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 90b7d4c415b2992125b8ff8fcd3191b14047fb7f Author: Filipe Manana Date: Mon Feb 9 10:54:27 2026 +0000 btrfs: remove redundant extent_buffer_uptodate() checks after read_tree_block() We have several places that call extent_buffer_uptodate() after reading a tree block with read_tree_block(), but that is redundant since we already call extent_buffer_uptodate() in the call chain of read_tree_block(): read_tree_block() btrfs_read_extent_buffer() read_extent_buffer_pages() returns -EIO if extent_buffer_uptodate() returns false So remove those redundant checks. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 6ee5c986b0ecf3e4be8268e607b62d01676dc115 Author: Filipe Manana Date: Mon Feb 9 10:44:16 2026 +0000 btrfs: use the helper extent_buffer_uptodate() everywhere Instead of open coding testing the uptodate bit on the extent buffer's flags, use the existing helper extent_buffer_uptodate() (which is even shorter to type). Also change the helper's return value from int to bool, since we always use it in a boolean context. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit e2a7fd22378f6500bcf979edc71e6837271eacfd Author: Johannes Thumshirn Date: Tue Feb 10 12:04:23 2026 +0100 btrfs: zoned: add zone reclaim flush state for DATA space_info On zoned block devices, DATA block groups can accumulate large amounts of zone_unusable space (space between the write pointer and zone end). When zone_unusable reaches high levels (e.g., 98% of total space), new allocations fail with ENOSPC even though space could be reclaimed by relocating data and resetting zones. The existing flush states don't handle this scenario effectively - they either try to free cached space (which doesn't exist for zone_unusable) or reset empty zones (which doesn't help when zones contain valid data mixed with zone_unusable space). Add a new RECLAIM_ZONES flush state that triggers the block group reclaim machinery. This state: - Calls btrfs_reclaim_sweep() to identify reclaimable block groups - Calls btrfs_reclaim_bgs() to queue reclaim work - Waits for reclaim_bgs_work to complete via flush_work() - Commits the transaction to finalize changes The reclaim work (btrfs_reclaim_bgs_work) safely relocates valid data from fragmented block groups to other locations before resetting zones, converting zone_unusable space back into usable space. Insert RECLAIM_ZONES before RESET_ZONES in data_flush_states so that we attempt to reclaim partially-used block groups before falling back to resetting completely empty ones. Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit 258e46a6385c57a3caef3fb1dc888e2efcfe5b18 Author: Johannes Thumshirn Date: Tue Feb 10 12:04:22 2026 +0100 btrfs: zoned: move partially zone_unusable block groups to reclaim list On zoned block devices, block groups accumulate zone_unusable space (space between the write pointer and zone end that cannot be allocated until the zone is reset). When a block group becomes mostly zone_unusable but still contains some valid data and it gets added to the unused_bgs list it can never be deleted because it's not actually empty. The deletion code (btrfs_delete_unused_bgs) skips these block groups due to the btrfs_is_block_group_used() check, leaving them on the unused_bgs list indefinitely. This causes two problems: 1. The block groups are never reclaimed, permanently wasting space 2. Eventually leads to ENOSPC even though reclaimable space exists Fix by detecting block groups where zone_unusable exceeds 50% of the block group size. Move these to the reclaim_bgs list instead of skipping them. This triggers btrfs_reclaim_bgs_work() which: 1. Marks the block group read-only 2. Relocates the remaining valid data via btrfs_relocate_chunk() 3. Removes the emptied block group 4. Resets the zones, converting zone_unusable back to usable space The 50% threshold ensures we only reclaim block groups where most space is unusable, making relocation worthwhile. Block groups with less zone_unusable are left on unused_bgs to potentially become fully empty through normal deletion. Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit 7bcb04de982ff0718870112ad9f38c35cbca528b Author: Johannes Thumshirn Date: Tue Feb 10 12:04:21 2026 +0100 btrfs: zoned: cap delayed refs metadata reservation to avoid overcommit On zoned filesystems metadata space accounting can become overly optimistic due to delayed refs reservations growing without a hard upper bound. The delayed_refs_rsv block reservation is allowed to speculatively grow and is only backed by actual metadata space when refilled. On zoned devices this can result in delayed_refs_rsv reserving a large portion of metadata space that is already effectively unusable due to zone write pointer constraints. As a result, space_info->may_use can grow far beyond the usable metadata capacity, causing the allocator to believe space is available when it is not. This leads to premature ENOSPC failures and "cannot satisfy tickets" reports even though commits would be able to make progress by flushing delayed refs. Analysis of "-o enospc_debug" dumps using a Python debug script confirmed that delayed_refs_rsv was responsible for the majority of metadata overcommit on zoned devices. By correlating space_info counters (total, used, may_use, zone_unusable) across transactions, the analysis showed that may_use continued to grow even after usable metadata space was exhausted, with delayed refs refills accounting for the excess reservations. Here's the output of the analysis: ====================================================================== Space Type: METADATA ====================================================================== Raw Values: Total: 256.00 MB (268435456 bytes) Used: 128.00 KB (131072 bytes) Pinned: 16.00 KB (16384 bytes) Reserved: 144.00 KB (147456 bytes) May Use: 255.48 MB (267894784 bytes) Zone Unusable: 192.00 KB (196608 bytes) Calculated Metrics: Actually Usable: 255.81 MB (total - zone_unusable) Committed: 255.77 MB (used + pinned + reserved + may_use) Consumed: 320.00 KB (used + zone_unusable) Percentages: Zone Unusable: 0.07% of total May Use: 99.80% of total Fix this by adding a zoned-specific cap in btrfs_delayed_refs_rsv_refill(): Before reserving additional metadata bytes, limit the delayed refs reservation based on the usable metadata space (total bytes minus zone_unusable). If the reservation would exceed this cap, return -EAGAIN to trigger the existing flush/commit logic instead of overcommitting metadata space. This preserves the existing reservation and flushing semantics while preventing metadata overcommit on zoned devices. The change is limited to metadata space and does not affect non-zoned filesystems. This patch addresses premature metadata ENOSPC conditions on zoned devices and ensures delayed refs are throttled before exhausting usable metadata. Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit 8352b29ad02ba647a32d45862478fb5165666155 Author: Filipe Manana Date: Mon Feb 9 10:03:08 2026 +0000 btrfs: remove duplicated eb uptodate check in btrfs_buffer_uptodate() We are calling extent_buffer_uptodate() twice, and the result will not change before the second call. So remove the second call. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 883adb6dcff0f96dbbdb6488842a38b121ebd68c Author: Qu Wenruo Date: Mon Feb 9 10:51:09 2026 +1030 btrfs: fix the inline compressed extent check in inode_need_compress() [BUG] Since commit 59615e2c1f63 ("btrfs: reject single block sized compression early"), the following script will result the inode to have NOCOMPRESS flag, meanwhile old kernels don't: # mkfs.btrfs -f $dev # mount $dev $mnt -o max_inline=2k,compress=zstd # truncate -s 8k $mnt/foobar # xfs_io -f -c "pwrite 0 2k" $mnt/foobar # sync Before that commit, the inode will not have NOCOMPRESS flag: item 4 key (257 INODE_ITEM 0) itemoff 15879 itemsize 160 generation 9 transid 9 size 8192 nbytes 4096 block group 0 mode 100644 links 1 uid 0 gid 0 rdev 0 sequence 3 flags 0x0(none) But after that commit, the inode will have NOCOMPRESS flag: item 4 key (257 INODE_ITEM 0) itemoff 15879 itemsize 160 generation 9 transid 10 size 8192 nbytes 4096 block group 0 mode 100644 links 1 uid 0 gid 0 rdev 0 sequence 3 flags 0x8(NOCOMPRESS) This will make a lot of files no longer to be compressed. [CAUSE] The old compressed inline check looks like this: if (total_compressed <= blocksize && (start > 0 || end + 1 < inode->disk_i_size)) goto cleanup_and_bail_uncompressed; That inline part check is equal to "!(start == 0 && end + 1 >= inode->disk_i_size)", but the new check no longer has that disk_i_size check. Thus it means any single block sized write at file offset 0 will pass the inline check, which is wrong. Furthermore, since we have merged the old check into inode_need_compress(), there is no disk_i_size based inline check anymore, we will always try compressing that single block at file offset 0, then later find out it's not a net win and go to the mark_incompressible tag. This results the inode to have NOCOMPRESS flag. [FIX] Add back the missing disk_i_size based check into inode_need_compress(). Now the same script will no longer cause NOCOMPRESS flag. Fixes: 59615e2c1f63 ("btrfs: reject single block sized compression early") Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260208183840.975975-1-clm@meta.com/ Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 1f3f98e42d82db7aa375371045bfdb632ecba5c2 Author: Filipe Manana Date: Tue Feb 3 20:02:18 2026 +0000 btrfs: set written super flag once in write_all_supers() In case we have multiple devices, there is no point in setting the written flag in the super block on every iteration over the device list. Just do it once before the loop. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8f3fc2d8973af8dc5559ecbbfb5ed3b19b2e8fa5 Author: Filipe Manana Date: Tue Feb 3 19:45:14 2026 +0000 btrfs: remove max_mirrors argument from write_all_supers() There's no need to pass max_mirrors to write_all_supers() since from the given transaction handle we can infer if we are in a transaction commit or fsync context, so we can determine how many mirrors we need to use. So remove the max_mirror argument from write_all_supers() and stop adjusting it in the callees write_dev_supers() and wait_dev_supers(), simplifying them besides the parameter list for write_all_supers(). Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit abd5e352b160f251ba1a481c03cdd7653557d0f2 Author: Filipe Manana Date: Tue Feb 3 17:47:33 2026 +0000 btrfs: tag error branches as unlikely during super block writes Mark all the unexpected error checks as unlikely, to make it more clear they are unexpected and to allow the compiler to potentially generate better code. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3810ab40afa5a0bf85f60b91228045bb9262a420 Author: Filipe Manana Date: Tue Feb 3 17:31:58 2026 +0000 btrfs: abort transaction on error in write_all_supers() We are in a transaction context and have an handle, so instead of using the less preferred btrfs_handle_fs_error(), abort the transaction and log an error to give some context information. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 98d9df251591b40a4a07b17870cb15dc4f1b1251 Author: Filipe Manana Date: Tue Feb 3 17:23:20 2026 +0000 btrfs: pass transaction handle to write_all_supers() We are holding a transaction In every context we call write_all_supers(), so pass the transaction handle instead of fs_info to it. This will allow us to abort the transaction in write_all_supers() instead of calling btrfs_handle_fs_error() in a later patch. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 00b41fee23dab8879bdf656bcdaa6998b18ef3dc Author: Filipe Manana Date: Tue Feb 3 16:11:42 2026 +0000 btrfs: mark all error and warning checks as unlikely in btrfs_validate_super() When validating a super block, either when mounting or every time we write a super block to disk, we do many checks for error and warnings and we don't expect to hit any. So mark each one as unlikely to reflect that and allow the compiler to potentially generate better code. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f754acce0f621425dadf7b50378e47adda336699 Author: Filipe Manana Date: Mon Feb 2 16:47:02 2026 +0000 btrfs: update comment for BTRFS_RESERVE_NO_FLUSH The comment is incomplete as BTRFS_RESERVE_NO_FLUSH is used for more reasons than currently holding a transaction handle open. Update the comment with all the other reasons and give some details. Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 40f2b11c1b7c593bbbfbf6bf333228ee53ed4050 Author: Filipe Manana Date: Mon Feb 2 16:35:01 2026 +0000 btrfs: don't allow log trees to consume global reserve or overcommit metadata For a fsync we never reserve space in advance, we just start a transaction without reserving space and we use an empty block reserve for a log tree. We reserve space as we need while updating a log tree, we end up in btrfs_use_block_rsv() when reserving space for the allocation of a log tree extent buffer and we attempt first to reserve without flushing, and if that fails we attempt to consume from the global reserve or overcommit metadata. This makes us consume space that may be the last resort for a transaction commit to succeed, therefore increasing the chances for a transaction abort with -ENOSPC. So make btrfs_use_block_rsv() fail if we can't reserve metadata space for a log tree extent buffer allocation without flushing, making the fsync fallback to a transaction commit and avoid using critical space that could be the only resort for a transaction commit to succeed when we are in a critical space situation. Reviewed-by: Leo Martins Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 574d93fc62e2b03ab39c8f92fb44ded89ca6274d Author: Filipe Manana Date: Mon Feb 2 15:12:29 2026 +0000 btrfs: be less aggressive with metadata overcommit when we can do full flushing Over the years we often get reports of some -ENOSPC failure while updating metadata that leads to a transaction abort. I have seen this happen for filesystems of all sizes and with workloads that are very user/customer specific and unable to reproduce, but Aleksandar recently reported a simple way to reproduce this with a 1G filesystem and using the bonnie++ benchmark tool. The following test script reproduces the failure: $ cat test.sh #!/bin/bash # Create and use a 1G null block device, memory backed, otherwise # the test takes a very long time. modprobe null_blk nr_devices="0" null_dev="/sys/kernel/config/nullb/nullb0" mkdir "$null_dev" size=$((1 * 1024)) # in MB echo 2 > "$null_dev/submit_queues" echo "$size" > "$null_dev/size" echo 1 > "$null_dev/memory_backed" echo 1 > "$null_dev/discard" echo 1 > "$null_dev/power" DEV=/dev/nullb0 MNT=/mnt/nullb0 mkfs.btrfs -f $DEV mount $DEV $MNT mkdir $MNT/test/ bonnie++ -d $MNT/test/ -m BTRFS -u 0 -s 256M -r 128M -b umount $MNT echo 0 > "$null_dev/power" rmdir "$null_dev" When running this bonnie++ fails in the phase where it deletes test directories and files: $ ./test.sh (...) Using uid:0, gid:0. Writing a byte at a time...done Writing intelligently...done Rewriting...done Reading a byte at a time...done Reading intelligently...done start 'em...done...done...done...done...done... Create files in sequential order...done. Stat files in sequential order...done. Delete files in sequential order...done. Create files in random order...done. Stat files in random order...done. Delete files in random order...Can't sync directory, turning off dir-sync. Can't delete file 9Bq7sr0000000338 Cleaning up test directory after error. Bonnie: drastic I/O error (rmdir): Read-only file system And in the syslog/dmesg we can see the following transaction abort trace: [161915.501506] BTRFS warning (device nullb0): Skipping commit of aborted transaction. [161915.502983] ------------[ cut here ]------------ [161915.503832] BTRFS: Transaction aborted (error -28) [161915.504748] WARNING: fs/btrfs/transaction.c:2045 at btrfs_commit_transaction+0xa21/0xd30 [btrfs], CPU#11: bonnie++/3377975 [161915.506786] Modules linked in: btrfs dm_zero dm_snapshot (...) [161915.518759] CPU: 11 UID: 0 PID: 3377975 Comm: bonnie++ Tainted: G W 6.19.0-rc7-btrfs-next-224+ #4 PREEMPT(full) [161915.520857] Tainted: [W]=WARN [161915.521405] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [161915.523414] RIP: 0010:btrfs_commit_transaction+0xa24/0xd30 [btrfs] [161915.524630] Code: 48 8b 7c 24 (...) [161915.526982] RSP: 0018:ffffd3fe8206fda8 EFLAGS: 00010292 [161915.527707] RAX: 0000000000000002 RBX: ffff8f4886d3c000 RCX: 0000000000000000 [161915.528723] RDX: 0000000002040001 RSI: 00000000ffffffe4 RDI: ffffffffc088f780 [161915.529691] RBP: ffff8f4f5adae7e0 R08: 0000000000000000 R09: ffffd3fe8206fb90 [161915.530842] R10: ffff8f4f9c1fffa8 R11: 0000000000000003 R12: 00000000ffffffe4 [161915.532027] R13: ffff8f4ef2cf2400 R14: ffff8f4f5adae708 R15: ffff8f4f62d18000 [161915.533229] FS: 00007ff93112a780(0000) GS:ffff8f4ff63ee000(0000) knlGS:0000000000000000 [161915.534611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [161915.535575] CR2: 00005571b3072000 CR3: 0000000176080005 CR4: 0000000000370ef0 [161915.536758] Call Trace: [161915.537185] [161915.537575] btrfs_sync_file+0x431/0x530 [btrfs] [161915.538473] do_fsync+0x39/0x80 [161915.539042] __x64_sys_fsync+0xf/0x20 [161915.539750] do_syscall_64+0x50/0xf20 [161915.540396] entry_SYSCALL_64_after_hwframe+0x76/0x7e [161915.541301] RIP: 0033:0x7ff930ca49ee [161915.541904] Code: 08 0f 85 f5 (...) [161915.544830] RSP: 002b:00007ffd94291f38 EFLAGS: 00000246 ORIG_RAX: 000000000000004a [161915.546152] RAX: ffffffffffffffda RBX: 00007ff93112a780 RCX: 00007ff930ca49ee [161915.547263] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [161915.548383] RBP: 0000000000000dab R08: 0000000000000000 R09: 0000000000000000 [161915.549853] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd94291fb0 [161915.551196] R13: 00007ffd94292350 R14: 0000000000000001 R15: 00007ffd94292340 [161915.552161] [161915.552457] ---[ end trace 0000000000000000 ]--- [161915.553232] BTRFS info (device nullb0 state A): dumping space info: [161915.553236] BTRFS info (device nullb0 state A): space_info DATA (sub-group id 0) has 12582912 free, is not full [161915.553239] BTRFS info (device nullb0 state A): space_info total=12582912, used=0, pinned=0, reserved=0, may_use=0, readonly=0 zone_unusable=0 [161915.553243] BTRFS info (device nullb0 state A): space_info METADATA (sub-group id 0) has -5767168 free, is full [161915.553245] BTRFS info (device nullb0 state A): space_info total=53673984, used=6635520, pinned=46956544, reserved=16384, may_use=5767168, readonly=65536 zone_unusable=0 [161915.553251] BTRFS info (device nullb0 state A): space_info SYSTEM (sub-group id 0) has 8355840 free, is not full [161915.553254] BTRFS info (device nullb0 state A): space_info total=8388608, used=16384, pinned=16384, reserved=0, may_use=0, readonly=0 zone_unusable=0 [161915.553257] BTRFS info (device nullb0 state A): global_block_rsv: size 5767168 reserved 5767168 [161915.553261] BTRFS info (device nullb0 state A): trans_block_rsv: size 0 reserved 0 [161915.553263] BTRFS info (device nullb0 state A): chunk_block_rsv: size 0 reserved 0 [161915.553265] BTRFS info (device nullb0 state A): remap_block_rsv: size 0 reserved 0 [161915.553268] BTRFS info (device nullb0 state A): delayed_block_rsv: size 0 reserved 0 [161915.553270] BTRFS info (device nullb0 state A): delayed_refs_rsv: size 0 reserved 0 [161915.553272] BTRFS: error (device nullb0 state A) in cleanup_transaction:2045: errno=-28 No space left [161915.554463] BTRFS info (device nullb0 state EA): forced readonly The problem is that we allow for a very aggressive metadata overcommit, about 1/8th of the currently available space, even when the task attempting the reservation allows for full flushing. Over time this allows more and more tasks to overcommit without getting a transaction commit to release pinned extents, joining the same transaction and eventually lead to the transaction abort when attempting some tree update, as the extent allocator is not able to find any available metadata extent and it's not able to allocate a new metadata block group either (not enough unallocated space for that). Fix this by allowing the overcommit to be up to 1/64th of the available (unallocated) space instead and for that limit to apply to both types of full flushing, BTRFS_RESERVE_FLUSH_ALL and BTRFS_RESERVE_FLUSH_ALL_STEAL. This way we get more frequent transaction commits to release pinned extents in case our caller is in a context where full flushing is allowed. Note that the space infos dump in the dmesg/syslog right after the transaction abort give the wrong idea that we have plenty of unallocated space when the abort happened. During the bonnie++ workload we had a metadata chunk allocation attempt and it failed with -ENOSPC because at that time we had a bunch of data block groups allocated, which then became empty and got deleted by the cleaner kthread after the metadata chunk allocation failed with -ENOSPC and before the transaction abort happened and dumped the space infos. The custom tracing (some trace_printk() calls spread in strategic places) used to check that: mount-1793735 [011] ...1. 28877.261096: btrfs_add_bg_to_space_info: added bg offset 13631488 length 8388608 flags 1 to space_info->flags 1 total_bytes 8388608 bytes_used 0 bytes_may_use 0 mount-1793735 [011] ...1. 28877.261098: btrfs_add_bg_to_space_info: added bg offset 22020096 length 8388608 flags 34 to space_info->flags 2 total_bytes 8388608 bytes_used 16384 bytes_may_use 0 mount-1793735 [011] ...1. 28877.261100: btrfs_add_bg_to_space_info: added bg offset 30408704 length 53673984 flags 36 to space_info->flags 4 total_bytes 53673984 bytes_used 131072 bytes_may_use 0 These are from loading the block groups created by mkfs during mount. Then when bonnie++ starts doing its thing: kworker/u48:5-1792004 [011] ..... 28886.122050: btrfs_create_chunk: gather_device_info 1 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 kworker/u48:5-1792004 [011] ..... 28886.122053: btrfs_create_chunk: gather_device_info 2 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 max_avail 927596544 kworker/u48:5-1792004 [011] ..... 28886.122055: btrfs_make_block_group: make bg offset 84082688 size 117440512 type 1 kworker/u48:5-1792004 [011] ...1. 28886.122064: btrfs_add_bg_to_space_info: added bg offset 84082688 length 117440512 flags 1 to space_info->flags 1 total_bytes 125829120 bytes_used 0 bytes_may_use 5251072 First allocation of a data block group of 112M. kworker/u48:5-1792004 [011] ..... 28886.192408: btrfs_create_chunk: gather_device_info 1 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 kworker/u48:5-1792004 [011] ..... 28886.192413: btrfs_create_chunk: gather_device_info 2 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 max_avail 810156032 kworker/u48:5-1792004 [011] ..... 28886.192415: btrfs_make_block_group: make bg offset 201523200 size 117440512 type 1 kworker/u48:5-1792004 [011] ...1. 28886.192425: btrfs_add_bg_to_space_info: added bg offset 201523200 length 117440512 flags 1 to space_info->flags 1 total_bytes 243269632 bytes_used 0 bytes_may_use 122691584 Another 112M data block group allocated. kworker/u48:5-1792004 [011] ..... 28886.260935: btrfs_create_chunk: gather_device_info 1 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 kworker/u48:5-1792004 [011] ..... 28886.260941: btrfs_create_chunk: gather_device_info 2 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 max_avail 692715520 kworker/u48:5-1792004 [011] ..... 28886.260943: btrfs_make_block_group: make bg offset 318963712 size 117440512 type 1 kworker/u48:5-1792004 [011] ...1. 28886.260954: btrfs_add_bg_to_space_info: added bg offset 318963712 length 117440512 flags 1 to space_info->flags 1 total_bytes 360710144 bytes_used 0 bytes_may_use 240132096 Yet another one. bonnie++-1793755 [010] ..... 28886.280407: btrfs_create_chunk: gather_device_info 1 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 bonnie++-1793755 [010] ..... 28886.280412: btrfs_create_chunk: gather_device_info 2 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 max_avail 575275008 bonnie++-1793755 [010] ..... 28886.280414: btrfs_make_block_group: make bg offset 436404224 size 117440512 type 1 bonnie++-1793755 [010] ...1. 28886.280419: btrfs_add_bg_to_space_info: added bg offset 436404224 length 117440512 flags 1 to space_info->flags 1 total_bytes 478150656 bytes_used 0 bytes_may_use 268435456 One more. kworker/u48:5-1792004 [011] ..... 28886.566233: btrfs_create_chunk: gather_device_info 1 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 kworker/u48:5-1792004 [011] ..... 28886.566238: btrfs_create_chunk: gather_device_info 2 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 max_avail 457834496 kworker/u48:5-1792004 [011] ..... 28886.566241: btrfs_make_block_group: make bg offset 553844736 size 117440512 type 1 kworker/u48:5-1792004 [011] ...1. 28886.566250: btrfs_add_bg_to_space_info: added bg offset 553844736 length 117440512 flags 1 to space_info->flags 1 total_bytes 595591168 bytes_used 268435456 bytes_may_use 209723392 Another one. bonnie++-1793755 [009] ..... 28886.613446: btrfs_create_chunk: gather_device_info 1 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 bonnie++-1793755 [009] ..... 28886.613451: btrfs_create_chunk: gather_device_info 2 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 max_avail 340393984 bonnie++-1793755 [009] ..... 28886.613453: btrfs_make_block_group: make bg offset 671285248 size 117440512 type 1 bonnie++-1793755 [009] ...1. 28886.613458: btrfs_add_bg_to_space_info: added bg offset 671285248 length 117440512 flags 1 to space_info->flags 1 total_bytes 713031680 bytes_used 268435456 bytes_may_use 2 68435456 Another one. bonnie++-1793755 [009] ..... 28886.674953: btrfs_create_chunk: gather_device_info 1 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 bonnie++-1793755 [009] ..... 28886.674957: btrfs_create_chunk: gather_device_info 2 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 max_avail 222953472 bonnie++-1793755 [009] ..... 28886.674959: btrfs_make_block_group: make bg offset 788725760 size 117440512 type 1 bonnie++-1793755 [009] ...1. 28886.674963: btrfs_add_bg_to_space_info: added bg offset 788725760 length 117440512 flags 1 to space_info->flags 1 total_bytes 830472192 bytes_used 268435456 bytes_may_use 1 34217728 Another one. bonnie++-1793755 [009] ..... 28886.674981: btrfs_create_chunk: gather_device_info 1 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 bonnie++-1793755 [009] ..... 28886.674982: btrfs_create_chunk: gather_device_info 2 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 max_avail 105512960 bonnie++-1793755 [009] ..... 28886.674983: btrfs_make_block_group: make bg offset 906166272 size 105512960 type 1 bonnie++-1793755 [009] ...1. 28886.674984: btrfs_add_bg_to_space_info: added bg offset 906166272 length 105512960 flags 1 to space_info->flags 1 total_bytes 935985152 bytes_used 268435456 bytes_may_use 67108864 Another one, but a bit smaller (~100.6M) since we now have less space. bonnie++-1793758 [009] ..... 28891.962096: btrfs_create_chunk: gather_device_info 1 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 bonnie++-1793758 [009] ..... 28891.962103: btrfs_create_chunk: gather_device_info 2 ctl->dev_extent_min = 65536 dev_extent_want 1073741824 max_avail 12582912 bonnie++-1793758 [009] ..... 28891.962105: btrfs_make_block_group: make bg offset 1011679232 size 12582912 type 1 bonnie++-1793758 [009] ...1. 28891.962114: btrfs_add_bg_to_space_info: added bg offset 1011679232 length 12582912 flags 1 to space_info->flags 1 total_bytes 948568064 bytes_used 268435456 bytes_may_use 8192 Another one, this one even smaller (12M). kworker/u48:5-1792004 [011] ..... 28892.112802: btrfs_chunk_alloc: enter first metadata chunk alloc attempt kworker/u48:5-1792004 [011] ..... 28892.112805: btrfs_create_chunk: gather_device_info 1 ctl->dev_extent_min = 131072 dev_extent_want 536870912 kworker/u48:5-1792004 [011] ..... 28892.112806: btrfs_create_chunk: gather_device_info 2 ctl->dev_extent_min = 131072 dev_extent_want 536870912 max_avail 0 536870912 is 512M, the standard 256M metadata chunk size times 2 because of the DUP profile for metadata. 'max_avail' is what find_free_dev_extent() returns to us in gather_device_info(). As a result, gather_device_info() sets ctl->ndevs to 0, making decide_stripe_size() fail with -ENOSPC, and therefore metadata chunk allocation fails while we are attempting to run delayed items during the transaction commit. kworker/u48:5-1792004 [011] ..... 28892.112807: btrfs_create_chunk: decide_stripe_size fail -ENOSPC In the syslog/dmesg pasted above, which happened after the transaction was aborted, the space info dumps did not account for all these data block groups that were allocated during bonnie++'s workload. And that is because after the metadata chunk allocation failed with -ENOSPC and before the transaction abort happened, most of the data block groups had become empty and got deleted by by the cleaner kthread - when the abort happened, we had bonnie++ in the middle of deleting the files it created. But dumping the space infos right after the metadata chunk allocation fails by adding a call to btrfs_dump_space_info_for_trans_abort() in decide_stripe_size() when it returns -ENOSPC, we get: [29972.409295] BTRFS info (device nullb0): dumping space info: [29972.409300] BTRFS info (device nullb0): space_info DATA (sub-group id 0) has 673341440 free, is not full [29972.409303] BTRFS info (device nullb0): space_info total=948568064, used=0, pinned=275226624, reserved=0, may_use=0, readonly=0 zone_unusable=0 [29972.409305] BTRFS info (device nullb0): space_info METADATA (sub-group id 0) has 3915776 free, is not full [29972.409306] BTRFS info (device nullb0): space_info total=53673984, used=163840, pinned=42827776, reserved=147456, may_use=6553600, readonly=65536 zone_unusable=0 [29972.409308] BTRFS info (device nullb0): space_info SYSTEM (sub-group id 0) has 7979008 free, is not full [29972.409310] BTRFS info (device nullb0): space_info total=8388608, used=16384, pinned=0, reserved=0, may_use=393216, readonly=0 zone_unusable=0 [29972.409311] BTRFS info (device nullb0): global_block_rsv: size 5767168 reserved 5767168 [29972.409313] BTRFS info (device nullb0): trans_block_rsv: size 0 reserved 0 [29972.409314] BTRFS info (device nullb0): chunk_block_rsv: size 393216 reserved 393216 [29972.409315] BTRFS info (device nullb0): remap_block_rsv: size 0 reserved 0 [29972.409316] BTRFS info (device nullb0): delayed_block_rsv: size 0 reserved 0 So here we see there's ~904.6M of data space, ~51.2M of metadata space and 8M of system space, making a total of 963.8M. Reported-by: Aleksandar Gerasimovski Link: https://lore.kernel.org/linux-btrfs/SA1PR18MB56922F690C5EC2D85371408B998FA@SA1PR18MB5692.namprd18.prod.outlook.com/ Link: https://lore.kernel.org/linux-btrfs/CAL3q7H61vZ3_+eqJ1A9po2WcgNJJjUu9MJQoYB2oDSAAecHaug@mail.gmail.com/ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 2672a26a75517a2b4409f2a379ee2bb5c38cff06 Author: Qu Wenruo Date: Wed Feb 4 13:24:08 2026 +1030 btrfs: use per-profile available space in calc_available_free_space() For the following disk layout, can_overcommit() can cause false confidence in available space: devid 1 unallocated: 1GiB devid 2 unallocated: 50GiB metadata type: RAID1 As can_overcommit() simply uses unallocated space with factor to calculate the allocatable metadata chunk size, resulting 25.5GiB available space. But in reality we can only allocate one 1GiB RAID1 chunk, the remaining 49GiB on devid 2 will never be utilized to fulfill a RAID1 chunk. This leads to various ENOSPC related transaction abort and flips the fs read-only. Now use per-profile available space in calc_available_free_space(), and only when that failed we fall back to the old factor based estimation. And for zoned devices or for the very low chance of temporary memory allocation failure, we will still fallback to factor based estimation. But I hope in reality it's very rare. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit c84053d9f7f758c79320716caa098cafc70a74da Author: Qu Wenruo Date: Wed Feb 4 13:24:07 2026 +1030 btrfs: update per-profile available estimation This involves the following timing: - Chunk allocation - Chunk removal - After Mount - New device - Device removal - Device shrink - Device enlarge And since the function btrfs_update_per_profile_avail() will not return an error, this won't cause new error handling path. Although when btrfs_update_per_profile_avail() failed (only ENOSPC possible) it will mark the per-profile available estimation as unreliable, so later btrfs_get_per_profile_avail() will return false and require the caller to have a fallback solution. The function btrfs_update_per_profile_avail() will be executed with chunk_mutex hold, thus it will slightly slow down those involved functions, but not a lot. As all the core workload is just various u64 calculations inside a loop, without any tree search, the overhead should be acceptable even for all supported 9 profiles. For 4 disks (which exercises all 9 profiles), the execution time of that function will still be less than 10 us. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 52fead5eb8a743384bab24ca8c3695257c755f0f Author: Qu Wenruo Date: Wed Feb 4 13:24:06 2026 +1030 btrfs: introduce the device layout aware per-profile available space [BUG] There is a long known bug that if metadata is using RAID1 on two disks with unbalanced sizes, there is a very high chance to hit ENOSPC related transaction abort. [CAUSE] The root cause is in the available space estimation code: - Factor based calculation Just use all unallocated space, divide by the profile factor One obvious user is can_overcommit(). This can not handle the following example: devid 1 unallocated: 1GiB devid 2 unallocated: 50GiB metadata type: RAID1 If using factor based estimation, we can use (1GiB + 50GiB) / 2 = 25.5GiB free space for metadata. Thus we can continue allocating metadata (over-commit) way beyond the 1GiB limit. But this estimation is completely wrong, in reality we can only allocate one single 1GiB RAID1 block group, thus if we continue over-commit, at one time we will hit ENOSPC at some critical path and flips the fs read-only. [SOLUTION] This patch will introduce per-profile available space estimation, which can provide chunk-allocator like behavior to give a (mostly) accurate result, with under-estimate corner cases. There are some differences between the estimation and real chunk allocator: - No consideration on hole size It's fine for most cases, as all data/metadata strips are in 1GiB size thus there should not be any hole wasting much space. And chunk allocator is able to use smaller stripes when there is really no other choice. Although in theory this means it can lead to some over-estimation, it should not cause too much hassle in the real world. The other benefit of such behavior is, we avoid dev-extent tree search completely, thus the overhead is very small. - No true balance for certain cases If we have 3 disks RAID1, and each device has 2GiB unallocated space, we can load balance the chunk allocation so that we can allocate 3GiB RAID1 chunks, and that's what chunk allocator will do. But this current estimation code is using the largest available space to do a single allocation. Meaning the estimation will be 2GiB, thus under estimate. Such under estimation is fine and after the first chunk allocation, the estimation will be updated and still give a correct 2GiB estimation. So this only means the estimation will be a little conservative, which is safer for call sites like metadata over-commit check. With that facility, for above 1GiB + 50GiB case, it will give a RAID1 estimation of 1GiB, instead of the incorrect 25.5GiB. Or for a more complex example: devid 1 unallocated: 1T devid 2 unallocated: 1T devid 3 unallocated: 10T We will get an array of: RAID10: 2T RAID1: 2T RAID1C3: 1T RAID1C4: 0 (not enough devices) DUP: 6T RAID0: 3T SINGLE: 12T RAID5: 2T RAID6: 1T [IMPLEMENTATION] And for the each profile , we go chunk allocator level calculation: The pseudo code looks like: clear_virtual_used_space_of_all_rw_devices(); do { /* * The same as chunk allocator, despite used space, * we also take virtual used space into consideration. */ sort_device_with_virtual_free_space(); /* * Unlike chunk allocator, we don't need to bother hole/stripe * size, so we use the smallest device to make sure we can * allocated as many stripes as regular chunk allocator */ stripe_size = device_with_smallest_free->avail_space; stripe_size = min(stripe_size, to_alloc / ndevs); /* * Allocate a virtual chunk, allocated virtual chunk will * increase virtual used space, allow next iteration to * properly emulate chunk allocator behavior. */ ret = alloc_virtual_chunk(stripe_size, &allocated_size); if (ret == 0) avail += allocated_size; } while (ret == 0) This minimal available space based calculation is not perfect, but the important part is, the estimation is never exceeding the real available space. This patch just introduces the infrastructure, no hooks are executed yet. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 08ef56661f69d40081ef782cd6a162bb0777af74 Author: Jiasheng Jiang Date: Wed Jan 14 14:44:50 2026 +0000 btrfs: zoned: remove redundant space_info lock and variable in do_allocation_zoned() In do_allocation_zoned(), the code acquires space_info->lock before block_group->lock. However, the critical section does not access or modify any members of the space_info structure. Thus, the lock is redundant as it provides no necessary synchronization here. This change simplifies the locking logic and aligns the function with other zoned paths, such as __btrfs_add_free_space_zoned(), which only rely on block_group->lock. Since the 'space_info' local variable is no longer used after removing the lock calls, it is also removed. Removing this unnecessary lock reduces contention on the global space_info lock, improving concurrency in the zoned allocation path. Reviewed-by: Boris Burkov Reviewed-by: Johannes Thumshirn Reviewed-by: Naohiro Aota Signed-off-by: Jiasheng Jiang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6141abb7f18f381d879d98f6c200494f14e502a0 Author: Filipe Manana Date: Tue Feb 3 15:22:54 2026 +0000 btrfs: move min sys chunk array size check to validate_sys_chunk_array() We check the minimum size of the sys chunk array in btrfs_validate_super() but we have a better place for that, the helper validate_sys_chunk_array() which we use for every other sys chunk array check. So move it there, also converting the return error from -EINVAL to -EUCLEAN, which is a better fit and also consistent with the other checks. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f3da62571ba25bf6c71076ee21420ed5257b84eb Author: Filipe Manana Date: Tue Feb 3 15:14:01 2026 +0000 btrfs: remove duplicate system chunk array max size overflow check We check it twice, once in validate_sys_chunk_array() and then again in its caller, btrfs_validate_super(), right after it calls validate_sys_chunk_array(). So remove the duplicated check from btrfs_validate_super(). Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit c4d30088fa28289aaf05ab421864ef8573ba9717 Author: Filipe Manana Date: Mon Feb 2 16:50:18 2026 +0000 btrfs: pass boolean literals as the last argument to inc_block_group_ro() The last argument of inc_block_group_ro() is defined as a boolean, but every caller is passing an integer literal, 0 or 1 for false and true respectively. While this is not incorrect, as 0 and 1 are converted to false and true, it's less readable and somewhat awkward since the argument is defined as boolean. Replace 0 and 1 with false and true. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1ba19a6ea9f27ea383560d3ead6d8f5b773aff33 Author: Naohiro Aota Date: Wed Feb 4 16:31:25 2026 +0900 btrfs: tests: zoned: add tests cases for zoned code Add a test function for the zoned code, for now it tests btrfs_load_block_group_by_raid_type() with various test cases. The load_zone_info_tests[] array defines the test cases. Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 3457a5ccacd34fdd5ebd3a4745e721b5a1239690 Author: Günther Noack Date: Wed Apr 1 17:09:10 2026 +0200 landlock: Document fallocate(2) as another truncation corner case Reinforce the already stated policy that LANDLOCK_ACCESS_FS_TRUNCATE should always go hand in hand with LANDLOCK_ACCESS_FS_WRITE_FILE, as their meanings and enforcement overlap in counterintuitive ways. On many common file systems, fallocate(2) offers a way to shorten files as long as the file is opened for writing, side-stepping the LANDLOCK_ACCESS_FS_TRUNCATE right. Assisted-by: Gemini-CLI:gemini-3.1 Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260401150911.1038072-1-gnoack@google.com Signed-off-by: Mickaël Salaün commit d1b2ab221d37f32cf1a796fc0ba3b8f9fc8458fa Author: Günther Noack Date: Fri Mar 27 17:48:37 2026 +0100 landlock: Document FS access right for pathname UNIX sockets Add LANDLOCK_ACCESS_FS_RESOLVE_UNIX to the example code, and explain it in the section about previous limitations. The bulk of the interesting flag documentation lives in the kernel header and is included in the Sphinx rendering. Cc: Justin Suess Cc: Mickaël Salaün Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260327164838.38231-13-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün commit dc75f890469401816fc8c492e11885409b5efd12 Author: Günther Noack Date: Fri Mar 27 17:48:36 2026 +0100 selftests/landlock: Simplify ruleset creation and enforcement in fs_test * Add enforce_fs() for defining and enforcing a ruleset in one step * In some places, dropped "ASSERT_LE(0, fd)" checks after create_ruleset() call -- create_ruleset() already checks that. * In some places, rename "file_fd" to "fd" if it is not needed to disambiguate any more. Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260327164838.38231-12-gnoack3000@gmail.com [mic: Tweak subjet] Signed-off-by: Mickaël Salaün commit f433fd3fa275e52fc1c7107e8aa57f1d037ee341 Author: Günther Noack Date: Fri Mar 27 17:48:35 2026 +0100 selftests/landlock: Check that coredump sockets stay unrestricted Even when a process is restricted with the new LANDLOCK_ACCESS_FS_RESOLVE_UNIX right, the kernel can continue writing its coredump to the configured coredump socket. In the test, we create a local server and rewire the system to write coredumps into it. We then create a child process within a Landlock domain where LANDLOCK_ACCESS_FS_RESOLVE_UNIX is restricted and make the process crash. The test uses SO_PEERCRED to check that the connecting client process is the expected one. Includes a fix by Mickaël Salaün for setting the EUID to 0 (see [1]). Link[1]: https://lore.kernel.org/all/20260218.ohth8theu8Yi@digikod.net/ Suggested-by: Mickaël Salaün Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260327164838.38231-11-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün commit 0f42f5be0b21c625ca52b9df96f452153aea05a8 Author: Günther Noack Date: Fri Mar 27 17:48:34 2026 +0100 selftests/landlock: Audit test for LANDLOCK_ACCESS_FS_RESOLVE_UNIX Add an audit test to check that Landlock denials from LANDLOCK_ACCESS_FS_RESOLVE_UNIX result in audit logs in the expected format. (There is one audit test for each filesystem access right, so we should add one for LANDLOCK_ACCESS_FS_RESOLVE_UNIX as well.) Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260327164838.38231-10-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün commit 9da41c65c907329a1848418cdc11fb10cc341217 Author: Günther Noack Date: Fri Mar 27 17:48:33 2026 +0100 selftests/landlock: Test LANDLOCK_ACCESS_FS_RESOLVE_UNIX * Extract common helpers from an existing IOCTL test that also uses pathname unix(7) sockets. * These tests use the common scoped domains fixture which is also used in other Landlock scoping tests and which was used in Tingmao Wang's earlier patch set in [1]. These tests exercise the cross product of the following scenarios: * Stream connect(), Datagram connect(), Datagram sendmsg() and Seqpacket connect(). * Child-to-parent and parent-to-child communication * The Landlock policy configuration as listed in the scoped_domains fixture. * In the default variant, Landlock domains are only placed where prescribed in the fixture. * In the "ALL_DOMAINS" variant, Landlock domains are also placed in the places where the fixture says to omit them, but with a LANDLOCK_RULE_PATH_BENEATH that allows connection. Cc: Justin Suess Cc: Tingmao Wang Cc: Mickaël Salaün Link[1]: https://lore.kernel.org/all/53b9883648225d5a08e82d2636ab0b4fda003bc9.1767115163.git.m@maowtm.org/ Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260327164838.38231-9-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün commit db8201a3fae2ca7a2865dbb9e8955289776783c7 Author: Günther Noack Date: Fri Mar 27 17:48:32 2026 +0100 selftests/landlock: Replace access_fs_16 with ACCESS_ALL in fs_test The access_fs_16 variable was originally intended to stay frozen at 16 access rights so that audit tests would not need updating when new access rights are added. Now that we have 17 access rights, the name is confusing. Replace all uses of access_fs_16 with ACCESS_ALL and delete the variable. Suggested-by: Mickaël Salaün Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260327164838.38231-8-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün commit a92cb5d7c6c988f304df355f4b5afcc379428f07 Author: Günther Noack Date: Fri Mar 27 17:48:31 2026 +0100 samples/landlock: Add support for named UNIX domain socket restrictions The access right for UNIX domain socket lookups is grouped with the read-write rights in the sample tool. Rationale: In the general case, any operations are possible through a UNIX domain socket, including data-mutating operations. Cc: Justin Suess Cc: Mickaël Salaün Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260327164838.38231-7-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün commit a46e32db1fb7acac49a35773345d4bcf343847f5 Author: Günther Noack Date: Fri Mar 27 17:48:30 2026 +0100 landlock: Clarify BUILD_BUG_ON check in scoping logic The BUILD_BUG_ON check in domain_is_scoped() and unmask_scoped_access() should check that the loop that counts down client_layer finishes. We therefore check that the numbers LANDLOCK_MAX_NUM_LAYERS-1 and -1 are both representable by that integer. If they are representable, the numbers in between are representable too, and the loop finishes. Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260327164838.38231-6-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün commit ae97330d1bd6a97646c2842d117577236cb40913 Author: Günther Noack Date: Fri Mar 27 17:48:29 2026 +0100 landlock: Control pathname UNIX domain socket resolution by path * Add a new access right LANDLOCK_ACCESS_FS_RESOLVE_UNIX, which controls the lookup operations for named UNIX domain sockets. The resolution happens during connect() and sendmsg() (depending on socket type). * Change access_mask_t from u16 to u32 (see below) * Hook into the path lookup in unix_find_bsd() in af_unix.c, using a LSM hook. Make policy decisions based on the new access rights * Increment the Landlock ABI version. * Minor test adaptations to keep the tests working. * Document the design rationale for scoped access rights, and cross-reference it from the header documentation. With this access right, access is granted if either of the following conditions is met: * The target socket's filesystem path was allow-listed using a LANDLOCK_RULE_PATH_BENEATH rule, *or*: * The target socket was created in the same Landlock domain in which LANDLOCK_ACCESS_FS_RESOLVE_UNIX was restricted. In case of a denial, connect() and sendmsg() return EACCES, which is the same error as it is returned if the user does not have the write bit in the traditional UNIX file system permissions of that file. The access_mask_t type grows from u16 to u32 to make space for the new access right. This also doubles the size of struct layer_access_masks from 32 byte to 64 byte. To avoid memory layout inconsistencies between architectures (especially m68k), pack and align struct access_masks [2]. Document the (possible future) interaction between scoped flags and other access rights in struct landlock_ruleset_attr, and summarize the rationale, as discussed in code review leading up to [3]. This feature was created with substantial discussion and input from Justin Suess, Tingmao Wang and Mickaël Salaün. Cc: Tingmao Wang Cc: Justin Suess Cc: Kuniyuki Iwashima Suggested-by: Jann Horn Link[1]: https://github.com/landlock-lsm/linux/issues/36 Link[2]: https://lore.kernel.org/all/20260401.Re1Eesu1Yaij@digikod.net/ Link[3]: https://lore.kernel.org/all/20260205.8531e4005118@gnoack.org/ Signed-off-by: Günther Noack Acked-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/20260327164838.38231-5-gnoack3000@gmail.com [mic: Fix kernel-doc formatting, pack and align access_masks] Signed-off-by: Mickaël Salaün commit 1c4fe87364782d1b058cc9d15fc8acef44bce033 Author: Günther Noack Date: Fri Mar 27 17:48:27 2026 +0100 landlock: Use mem_is_zero() in is_layer_masks_allowed() This is equivalent, but expresses the intent a bit clearer. Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260327164838.38231-3-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün commit eb25e202b3d60cdc239f14e0e5f6f7465fcc506c Author: Justin Suess Date: Fri Mar 27 17:48:26 2026 +0100 lsm: Add LSM hook security_unix_find Add an LSM hook security_unix_find. This hook is called to check the path of a named UNIX socket before a connection is initiated. The peer socket may be inspected as well. Why existing hooks are unsuitable: Existing socket hooks, security_unix_stream_connect(), security_unix_may_send(), and security_socket_connect() don't provide TOCTOU-free / namespace independent access to the paths of sockets. (1) We cannot resolve the path from the struct sockaddr in existing hooks. This requires another path lookup. A change in the path between the two lookups will cause a TOCTOU bug. (2) We cannot use the struct path from the listening socket, because it may be bound to a path in a different namespace than the caller, resulting in a path that cannot be referenced at policy creation time. Consumers of the hook wishing to reference @other are responsible for acquiring the unix_state_lock and checking for the SOCK_DEAD flag therein, ensuring the socket hasn't died since lookup. Cc: Günther Noack Cc: Tingmao Wang Cc: Mickaël Salaün Cc: Paul Moore Signed-off-by: Justin Suess Signed-off-by: Günther Noack Reviewed-by: Georgia Garcia Acked-by: Paul Moore Link: https://lore.kernel.org/r/20260327164838.38231-2-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün commit 64617ec0339f3f52accf5614bc918a940a503f7a Author: Mickaël Salaün Date: Tue Mar 10 18:20:03 2026 +0100 landlock: Fix kernel-doc warning for pointer-to-array parameters The insert_rule() and create_rule() functions take a pointer-to-flexible-array parameter declared as: const struct landlock_layer (*const layers)[] The kernel-doc parser cannot handle a qualifier between * and the parameter name in this syntax, producing spurious "Invalid param" and "not described" warnings. Remove the const qualifier of the "layers" argument to avoid this parsing issue. Cc: Günther Noack Cc: Jonathan Corbet Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260310172004.1839864-1-mic@digikod.net Signed-off-by: Mickaël Salaün commit aba1de96e80a26648a8e3b593a106041e3e1e2a1 Author: Mickaël Salaün Date: Wed Mar 4 20:31:27 2026 +0100 landlock: Fix formatting in tsync.c Fix comment formatting in tsync.c to fit in 80 columns. Cc: Günther Noack Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260304193134.250495-4-mic@digikod.net Signed-off-by: Mickaël Salaün commit fa20aeb95d72da9dd78a3c9b24e996b5d9219888 Author: Mickaël Salaün Date: Wed Mar 4 20:31:26 2026 +0100 landlock: Improve kernel-doc "Return:" section consistency The canonical kernel-doc form is "Return:" (singular, without trailing "s"). Normalize all existing "Returns:" occurrences across the Landlock source tree to the canonical form. Also fix capitalization for consistency. Balance descriptions to describe all possible returned values. Consolidate bullet-point return descriptions into inline text for functions with simple two-value or three-value returns for consistency. Cc: Günther Noack Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260304193134.250495-3-mic@digikod.net Signed-off-by: Mickaël Salaün commit e89dea254dce44c629d98639c05fe5ca7add7241 Author: Mickaël Salaün Date: Wed Mar 4 20:31:25 2026 +0100 landlock: Add missing kernel-doc "Return:" sections The kernel-doc -Wreturn check warns about functions with documentation comments that lack a "Return:" section. Add "Return:" documentation to all functions missing it so that kernel-doc -Wreturn passes cleanly. Convert existing function descriptions into a formal "Return:" section. Also fix the inaccurate return documentation for landlock_merge_ruleset() which claimed to return @parent directly, and document the previously missing ERR_PTR() error return path. Document the ABI version and errata return paths for landlock_create_ruleset() which were previously only implied by the prose. Cc: Günther Noack Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260304193134.250495-2-mic@digikod.net Signed-off-by: Mickaël Salaün commit a060ac0b8c3345639f5f4a01e2c435d34adf7e3d Author: Mickaël Salaün Date: Thu Apr 2 21:26:06 2026 +0200 selftests/landlock: Fix format warning for __u64 in net_test On architectures where __u64 is unsigned long (e.g. powerpc64), using %llx to format a __u64 triggers a -Wformat warning because %llx expects unsigned long long. Cast the argument to unsigned long long. Cc: Günther Noack Cc: stable@vger.kernel.org Fixes: a549d055a22e ("selftests/landlock: Add network tests") Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202604020206.62zgOTeP-lkp@intel.com/ Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260402192608.1458252-6-mic@digikod.net Signed-off-by: Mickaël Salaün commit 07c2572a87573b2a2f0fd6b9f538cd1aeef2eee7 Author: Mickaël Salaün Date: Thu Apr 2 21:26:05 2026 +0200 selftests/landlock: Skip stale records in audit_match_record() Domain deallocation records are emitted asynchronously from kworker threads (via free_ruleset_work()). Stale deallocation records from a previous test can arrive during the current test's deallocation read loop and be picked up by audit_match_record() instead of the expected record, causing a domain ID mismatch. The audit.layers test (which creates 16 nested domains) is particularly vulnerable because it reads 16 deallocation records in sequence, providing a large window for stale records to interleave. The same issue affects audit_flags.signal, where deallocation records from a previous test (audit.layers) can leak into the next test and be picked up by audit_match_record() instead of the expected record. Fix this by continuing to read records when the type matches but the content pattern does not. Stale records are silently consumed, and the loop only stops when both type and pattern match (or the socket times out with -EAGAIN). Additionally, extend matches_log_domain_deallocated() with an expected_domain_id parameter. When set, the regex pattern includes the specific domain ID as a literal hex value, so that deallocation records for a different domain do not match the pattern at all. This handles the case where the stale record has the same denial count as the expected one (e.g. both have denials=1), which the type+pattern loop alone cannot distinguish. Callers that already know the expected domain ID (from a prior denial or allocation record) now pass it to filter precisely. When expected_domain_id is set, matches_log_domain_deallocated() also temporarily increases the socket timeout to audit_tv_dom_drop (1 second) to wait for the asynchronous kworker deallocation, and restores audit_tv_default afterward. This removes the need for callers to manage the timeout switch manually. Cc: Günther Noack Cc: stable@vger.kernel.org Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs") Link: https://lore.kernel.org/r/20260402192608.1458252-5-mic@digikod.net Signed-off-by: Mickaël Salaün commit 3647a4977fb73da385e5a29b9775a4749733470d Author: Mickaël Salaün Date: Thu Apr 2 21:26:04 2026 +0200 selftests/landlock: Drain stale audit records on init Non-audit Landlock tests generate audit records as side effects when audit_enabled is non-zero (e.g. from boot configuration). These records accumulate in the kernel audit backlog while no audit daemon socket is open. When the next test opens a new netlink socket and registers as the audit daemon, the stale backlog is delivered, causing baseline record count checks to fail spuriously. Fix this by draining all pending records in audit_init() right after setting the receive timeout. The 1-usec SO_RCVTIMEO causes audit_recv() to return -EAGAIN once the backlog is empty, naturally terminating the drain loop. Domain deallocation records are emitted asynchronously from a work queue, so they may still arrive after the drain. Remove records.domain == 0 checks that are not preceded by audit_match_record() calls, which would otherwise consume stale records before the count. Document this constraint above audit_count_records(). Increasing the drain timeout to catch in-flight deallocation records was considered but rejected: a longer timeout adds latency to every audit_init() call even when no stale record is pending, and any fixed timeout is still not guaranteed to catch all records under load. Removing the unprotected checks is simpler and avoids the spurious failures. Cc: Günther Noack Cc: stable@vger.kernel.org Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs") Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260402192608.1458252-4-mic@digikod.net Signed-off-by: Mickaël Salaün commit 9143d790337a0d066c2d632c802f69b981e6c23a Author: Mickaël Salaün Date: Thu Apr 2 21:26:03 2026 +0200 selftests/landlock: Fix socket file descriptor leaks in audit helpers audit_init() opens a netlink socket and configures it, but leaks the file descriptor if audit_set_status() or setsockopt() fails. Fix this by jumping to an error path that closes the socket before returning. Apply the same fix to audit_init_with_exe_filter(), which leaks the file descriptor from audit_init() if audit_init_filter_exe() or audit_filter_exe() fails, and to audit_cleanup(), which leaks it if audit_init_filter_exe() fails in FIXTURE_TEARDOWN_PARENT(). Cc: Günther Noack Cc: stable@vger.kernel.org Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs") Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260402192608.1458252-3-mic@digikod.net Signed-off-by: Mickaël Salaün commit b566f7a4f0e4f15f78f2e5fac273fa954991e03a Author: Mickaël Salaün Date: Thu Apr 2 21:26:02 2026 +0200 selftests/landlock: Fix snprintf truncation checks in audit helpers snprintf() returns the number of characters that would have been written, excluding the terminating NUL byte. When the output is truncated, this return value equals or exceeds the buffer size. Fix matches_log_domain_allocated() and matches_log_domain_deallocated() to detect truncation with ">=" instead of ">". Cc: Günther Noack Cc: stable@vger.kernel.org Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs") Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260402192608.1458252-2-mic@digikod.net Signed-off-by: Mickaël Salaün commit e75e38055b9df5eafd663c6db00e634f534dc426 Author: Mickaël Salaün Date: Tue Apr 7 18:41:05 2026 +0200 landlock: Allow TSYNC with LOG_SUBDOMAINS_OFF and fd=-1 LANDLOCK_RESTRICT_SELF_TSYNC does not allow LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF with ruleset_fd=-1, preventing a multithreaded process from atomically propagating subdomain log muting to all threads without creating a domain layer. Relax the fd=-1 condition to accept TSYNC alongside LOG_SUBDOMAINS_OFF, and update the documentation accordingly. Add flag validation tests for all TSYNC combinations with ruleset_fd=-1, and audit tests verifying both transition directions: muting via TSYNC (logged to not logged) and override via TSYNC (not logged to logged). Cc: Günther Noack Cc: stable@vger.kernel.org Fixes: 42fc7e6543f6 ("landlock: Multithreading support for landlock_restrict_self()") Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260407164107.2012589-2-mic@digikod.net Signed-off-by: Mickaël Salaün commit 874c8f83826c95c62c21d9edfe9ef43e5c346724 Author: Mickaël Salaün Date: Tue Apr 7 18:41:04 2026 +0200 landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() hook_cred_transfer() only copies the Landlock security blob when the source credential has a domain. This is inconsistent with landlock_restrict_self() which can set LOG_SUBDOMAINS_OFF on a credential without creating a domain (via the ruleset_fd=-1 path): the field is committed but not preserved across fork() because the child's prepare_creds() calls hook_cred_transfer() which skips the copy when domain is NULL. This breaks the documented use case where a process mutes subdomain logs before forking sandboxed children: the children lose the muting and their domains produce unexpected audit records. Fix this by unconditionally copying the Landlock credential blob. Cc: Günther Noack Cc: Jann Horn Cc: stable@vger.kernel.org Fixes: ead9079f7569 ("landlock: Add LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF") Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260407164107.2012589-1-mic@digikod.net Signed-off-by: Mickaël Salaün commit a6cd43fe9b083fa23fe1595666d5738856cb261a Author: Pengpeng Hou Date: Fri Mar 27 14:19:55 2026 +0800 fs/ntfs3: terminate the cached volume label after UTF-8 conversion ntfs_fill_super() loads the on-disk volume label with utf16s_to_utf8s() and stores the result in sbi->volume.label. The converted label is later exposed through ntfs3_label_show() using %s, but utf16s_to_utf8s() only returns the number of bytes written and does not add a trailing NUL. If the converted label fills the entire fixed buffer, ntfs3_label_show() can read past the end of sbi->volume.label while looking for a terminator. Terminate the cached label explicitly after a successful conversion and clamp the exact-full case to the last byte of the buffer. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Pengpeng Hou Signed-off-by: Konstantin Komarov commit d1062683bf6b560b31f287eb0ebde4841bc72376 Author: Zhan Xusheng Date: Thu Mar 26 17:12:32 2026 +0800 fs/ntfs3: fix potential double iput on d_make_root() failure d_make_root() consumes the reference to the passed inode: it either attaches it to the newly created dentry on success, or drops it via iput() on failure. In the error path, the code currently does: sb->s_root = d_make_root(inode); if (!sb->s_root) goto put_inode_out; which leads to a second iput(inode) in put_inode_out. This results in a double iput and may trigger a use-after-free if the inode gets freed after the first iput(). Fix this by jumping directly to the common cleanup path, avoiding the extra iput(inode). Signed-off-by: Zhan Xusheng Signed-off-by: Konstantin Komarov commit 984a415f019536ea2d24de9010744e5302a9a948 Author: Tobias Gaertner Date: Sun Mar 29 04:17:03 2026 -0700 ntfs3: fix integer overflow in run_unpack() volume boundary check The volume boundary check `lcn + len > sbi->used.bitmap.nbits` uses raw addition which can wrap around for large lcn and len values, bypassing the validation. Use check_add_overflow() as is already done for the adjacent prev_lcn + dlcn and vcn64 + len checks added by commit 3ac37e100385 ("ntfs3: Fix integer overflow in run_unpack()"). Found by fuzzing with a source-patched harness (LibAFL + QEMU). Fixes: 82cae269cfa95 ("fs/ntfs3: Add initialization of super block") Cc: stable@vger.kernel.org Signed-off-by: Tobias Gaertner Signed-off-by: Konstantin Komarov commit b62567bca47408e6739dee75f02a2113548af875 Author: Tobias Gaertner Date: Sun Mar 29 04:17:02 2026 -0700 ntfs3: add buffer boundary checks to run_unpack() run_unpack() checks `run_buf < run_last` at the top of the while loop but then reads size_size and offset_size bytes via run_unpack_s64() without verifying they fit within the remaining buffer. A crafted NTFS image with truncated run data in an MFT attribute triggers an OOB heap read of up to 15 bytes when the filesystem is mounted. Add boundary checks before each run_unpack_s64() call to ensure the declared field size does not exceed the remaining buffer. Found by fuzzing with a source-patched harness (LibAFL + QEMU). Fixes: 82cae269cfa95 ("fs/ntfs3: Add initialization of super block") Cc: stable@vger.kernel.org Signed-off-by: Tobias Gaertner Signed-off-by: Konstantin Komarov commit 6d979b64287fb051642fe0101f28c839be8ca837 Author: Konstantin Komarov Date: Tue Mar 31 20:20:04 2026 +0200 ntfs3: fix mount failure on volumes with fragmented MFT bitmap When the $MFT's $BITMAP attribute is fragmented across multiple MFT records (base record + extent records), ntfs_fill_super() fails with -ENOENT during wnd_init() because the MFT bitmap's run list only contains runs from the base MFT record. The issue is that wnd_init() (which calls wnd_rescan()) is invoked before ni_load_all_mi(), so the extent MFT records containing additional $BITMAP runs have not been loaded yet. When wnd_rescan() tries to look up a VCN beyond the base record's runs, run_lookup_entry() fails and returns -ENOENT. This affects NTFS volumes with a large or heavily fragmented MFT, which is common on long-used Windows systems where the MFT bitmap's run list doesn't fit in the base MFT record and spills into extent records. Fix this by: 1. Moving ni_load_all_mi() before wnd_init() so all extent records are available. 2. After ni_load_all_mi(), iterating through the attribute list to find any $BITMAP extent attributes and unpacking their runs into sbi->mft.bitmap.run before wnd_init() is called. Tested on a 664GB NTFS volume with 86 MFT bitmap runs spanning records 0 (VCN 0-105) and 17 (VCN 106-165). Before the fix, mount fails with -ENOENT. After the fix, mount succeeds and all read/write operations work correctly. Stress-tested with 8 test categories (large file integrity, 10K small files, copy, move, delete/recreate cycles, concurrent writes, deep directories, overwrite persistence). Signed-off-by: Ruslan Elishev Signed-off-by: Konstantin Komarov commit bb82fe0872de867f87fd4f64c9cb157903ac78db Author: Zhan Xusheng Date: Fri Mar 27 11:24:54 2026 +0800 fs/ntfs3: fix $LXDEV xattr lookup Use correct xattr name ("$LXDEV") and buffer size when calling ntfs_get_ea(), otherwise the attribute may not be read. Signed-off-by: Zhan Xusheng Signed-off-by: Konstantin Komarov commit 859d777646b56dd878b136392f3d03fb8153b559 Author: 0xkato <0xkkato@gmail.com> Date: Sun Mar 29 13:57:57 2026 +0200 ntfs3: fix OOB write in attr_wof_frame_info() In attr_wof_frame_info(), the offset-table read range for a nonresident WofCompressedData stream is: u64 from = vbo[i] & ~(u64)(PAGE_SIZE - 1); u64 to = min(from + PAGE_SIZE, wof_size); ... ntfs_read_run(sbi, run, addr, from, to - from); A crafted image sets WofCompressedData.nres.data_size to 0xfff while the file is large enough to request frame 1024 (offset 0x400000). This gives from=0x1000, to=0xfff. The unsigned (to - from) wraps to 0xffffffffffffffff and ntfs_read_write_run() overflows the single-page offs_folio via memcpy. Triggered by pread() on a mounted NTFS image. Depending on adjacent memory layout at the time of the overflow, KASAN reports this as slab-out-of-bounds, use-after-free, or slab-use-after-free all at ntfs_read_write_run(). Secondary corruption/panic paths were also observed. Reject the read when the offset-table page is outside the stream. Signed-off-by: 0xkato <0xkkato@gmail.com> Signed-off-by: Konstantin Komarov commit f3ddb8a9a97fd7b933442d25309b90eafc5f2d74 Author: Shawn Lin Date: Wed Mar 25 09:58:32 2026 +0800 PCI: dw-rockchip: Add pcie_ltssm_state_transition tracepoint support Rockchip platforms provide a 64x4 bytes debug FIFO to trace the LTSSM transition and data rate change history. These will be useful for debugging issues such as link failure, etc. Hence, expose these information over pcie_ltssm_state_transition tracepoint. Signed-off-by: Shawn Lin [mani: commit log] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Anand Moon Reviewed-by: Steven Rostedt (Google) Link: https://patch.msgid.link/1774403912-210670-4-git-send-email-shawn.lin@rock-chips.com commit d08082a872f08d56122f8b174e950015e58585af Author: Janne Grunau Date: Fri Mar 20 13:23:19 2026 +0100 dt-bindings: arm: cpus: Add Apple M3 CPU core compatibles Add "apple,everest" compatible for the M3 performance core and "apple,sawtooth" for the M3 efficiency CPU core. These CPU cores are found on Apple Silicon SoCs M3 and M3 Pro, Max and Ultra. Signed-off-by: Janne Grunau Link: https://patch.msgid.link/20260320-apple-m3-initial-devicetrees-v1-1-5842e1e393a8@jannau.net Signed-off-by: Rob Herring (Arm) commit afc7e8f9bf7a9b47868b0875441e1013e16ee876 Author: Krzysztof Kozlowski Date: Mon Mar 16 14:46:07 2026 +0100 dt-bindings: display: lt8912b: Drop redundant endpoint properties The "endpoint" node references video-interfaces.yaml schema with "unevaluatedProperties: false" which means that all properties from referenced schema apply. Listing some of them with ": true" is simply redundant and does not make this code easier to read. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260316134606.57070-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 98e5b6d0699d5055623f2f070594b08b255eb1ce Author: Thomas Zimmermann Date: Tue Apr 7 11:23:21 2026 +0200 fbcon: Put font-rotation state into separate struct Move all temporary state of the font-rotation code into the struct rotated in struct fbcon_par. Protect it with the Kconfig symbol CONFIG_FRAMEBUFFER_CONSOLE_ROTATION. Avoids mixing it up with fbcon's regular state. v2: - fix typos Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 6903bd692057f1daee5a4860f13fe97a9906489a Author: Thomas Zimmermann Date: Tue Apr 7 11:23:20 2026 +0200 fbcon: Fill cursor mask in helper function Fbcon creates a cursor shape on the fly from the user-configured settings. The logic to create a glyph with the cursor's bitmap mask is duplicated in four places. In the cases that involve console rotation, the implementation further rotates the cursor glyph for displaying. Consolidate all cursor-mask creation in a single helper. Update the callers accordingly. For console rotation, use the glyph helpers to rotate the created cursor glyph to the correct orientation. v2: - fix sparse truncated-bits warning Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit cfa72955a029cd79433694cac6b5630788609cd4 Author: Thomas Zimmermann Date: Tue Apr 7 11:23:19 2026 +0200 lib/fonts: Implement font rotation Move the core of fbcon's font-rotation code to the font library as the new helper font_data_rotate(). The code can rotate in steps of 90°. For completeness, it also copies the glyph data for multiples of 360°. Bring back the memset optimization. A memset to 0 again clears the whole glyph output buffer. Then use the internal rotation helpers on the cleared output. Fbcon's original implementation worked like this, but lost it during refactoring. Replace fbcon's font-rotation code with the new implementations. All that's left to do for fbcon is to maintain its internal fbcon state. v2: - fix typos Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit a30e9e6b018f40941a626ff77e0bf35c015038fa Author: Thomas Zimmermann Date: Tue Apr 7 11:23:18 2026 +0200 lib/fonts: Refactor glyph-rotation helpers Change the signatures of the glyph-rotation helpers to match their public interfaces. Drop the inline qualifier. Rename several variables to better match their meaning. Especially rename variables to bit_pitch (or a variant thereof) if they store a pitch value in bits per scanline. The original code is fairly confusing about this. Move the calculation of the bit pitch into the new helper font_glyph_bit_pitch(). Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 6ad4ed8408157b1c78f69995c5808d9460fba58d Author: Thomas Zimmermann Date: Tue Apr 7 11:23:17 2026 +0200 lib/fonts: Refactor glyph-pattern helpers Change the signatures of the pattern helpers to align them with other font-glyph helpers: use the font_glyph_ prefix and pass the glyph buffer first. Calculating the position of the involved bit is somewhat obfuscated in the original implementation. Move it into the new helper __font_glyph_pos() and use the result as array index and bit position. Note that these bit helpers use a bit pitch, while other code uses a byte pitch. This is intentional and required here. v2: - fix typos in commit message Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit bdfd943231347ce57133d1ba2d93ed87f1050e81 Author: Thomas Zimmermann Date: Tue Apr 7 11:23:16 2026 +0200 lib/fonts: Implement glyph rotation Move the glyph rotation helpers from fbcon to the font library. Wrap them behind clean interfaces. Also clear the output memory to zero. Previously, the implementation relied on the caller to do that. Go through the fbcon code and callers of the glyph-rotation helpers. In addition to the font rotation, there's also the cursor code, which uses the rotation helpers. The font-rotation relied on a single memset to zero for the whole font. This is now multiple memsets on each glyph. This will be sorted out when the font library also implements font rotation. Building glyph rotation in the font library still depends on CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y. If we get more users of the code, we can still add a dedicated Kconfig symbol to the font library. No changes have been made to the actual implementation of the rotate_*() and pattern_*() functions. These will be refactored as separate changes. v2: - fix typos Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit de0b375bce6df8be2123d15a026dc74ba54e5b2c Author: Thomas Zimmermann Date: Tue Apr 7 11:23:15 2026 +0200 lib/fonts: Clean up Makefile Simplify the Makefile. Drop font-obj-y and sort the fonts by dictionary order. Done in preparation for supporting optional font rotation. v2: - sort Makefile font entries by Family/Size in ascending order (Geert, Jiri) Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 97df8960240afc47c2349d008b0993e7727bbda5 Author: Thomas Zimmermann Date: Tue Apr 7 11:23:14 2026 +0200 lib/fonts: Provide helpers for calculating glyph pitch and size Implement pitch and size calculation for a single font glyph in the new helpers font_glyph_pitch() and font_glyph_size(). Replace the instances where the calculations are open-coded. Note that in the case of fbcon console rotation, the parameters for a glyph's width and height might be reversed. This is intentional. v2: - fix typos in commit message Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit c713b96427ce5c4a74b8babe14137451ac3ffe54 Author: Thomas Zimmermann Date: Tue Apr 7 11:23:13 2026 +0200 vt: Implement helpers for struct vc_font in source file Move the helpers vc_font_pitch() and vc_font_size() from the VT header file into source file. They are not called very often, so there's no benefit in keeping them in the headers. Also avoids including from the header. v2: - fix typo in commit description Signed-off-by: Thomas Zimmermann Acked-by: Greg Kroah-Hartman Signed-off-by: Helge Deller commit e4ef723d8975a2694cc90733a6b888a5e2841842 Author: Thomas Zimmermann Date: Tue Apr 7 11:23:12 2026 +0200 fbcon: Avoid OOB font access if console rotation fails Clear the font buffer if the reallocation during console rotation fails in fbcon_rotate_font(). The putcs implementations for the rotated buffer will return early in this case. See [1] for an example. Currently, fbcon_rotate_font() keeps the old buffer, which is too small for the rotated font. Printing to the rotated console with a high-enough character code will overflow the font buffer. v2: - fix typos in commit message Signed-off-by: Thomas Zimmermann Fixes: 6cc50e1c5b57 ("[PATCH] fbcon: Console Rotation - Add support to rotate font bitmap") Cc: stable@vger.kernel.org # v2.6.15+ Link: https://elixir.bootlin.com/linux/v6.19/source/drivers/video/fbdev/core/fbcon_ccw.c#L144 # [1] Signed-off-by: Helge Deller commit 092e0d0e964279feb9f43f81e8d1c52ef080d085 Author: HyungJung Joo Date: Fri Mar 13 15:34:44 2026 +0900 orangefs: validate getxattr response length orangefs_inode_getxattr() trusts the userspace-client-controlled downcall.resp.getxattr.val_sz and uses it as a memcpy() length both for the temporary user buffer and the cached xattr buffer. Reject malformed negative or oversized lengths before copying response bytes. Reported-by: Hyungjung Joo Signed-off-by: HyungJung Joo Signed-off-by: Mike Marshall commit 1c22483a2c4bbf747787f328392ca3e68619c4dc Author: Weiming Shi Date: Sun Apr 5 00:12:20 2026 +0800 bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() CO-RE accessor strings are colon-separated indices that describe a path from a root BTF type to a target field, e.g. "0:1:2" walks through nested struct members. bpf_core_parse_spec() parses each component with sscanf("%d"), so negative values like -1 are silently accepted. The subsequent bounds checks (access_idx >= btf_vlen(t)) only guard the upper bound and always pass for negative values because C integer promotion converts the __u16 btf_vlen result to int, making the comparison (int)(-1) >= (int)(N) false for any positive N. When -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff, producing an out-of-bounds read far past the members array. A crafted BPF program with a negative CO-RE accessor on any struct that exists in vmlinux BTF (e.g. task_struct) crashes the kernel deterministically during BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y (default on major distributions). The bug is reachable with CAP_BPF: BUG: unable to handle page fault for address: ffffed11818b6626 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full) RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354) RAX: 00000000ffffffff Call Trace: bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321) bpf_core_apply (kernel/bpf/btf.c:9507) check_core_relo (kernel/bpf/verifier.c:19475) bpf_check (kernel/bpf/verifier.c:26031) bpf_prog_load (kernel/bpf/syscall.c:3089) __sys_bpf (kernel/bpf/syscall.c:6228) CO-RE accessor indices are inherently non-negative (struct member index, array element index, or enumerator index), so reject them immediately after parsing. Fixes: ddc7c3042614 ("libbpf: implement BPF CO-RE offset relocation algorithm") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Emil Tsalapatis Acked-by: Paul Chaignon Link: https://lore.kernel.org/r/20260404161221.961828-2-bestswngs@gmail.com Signed-off-by: Alexei Starovoitov commit 415e507cdefc510c01de8ab6644163327ee9a5d0 Author: Mike Marshall Date: Thu Apr 2 18:07:25 2026 -0400 orangefs_readahead: don't overflow the bufmap slot. generic/340 showed that this caller of wait_for_direct_io was sometimes asking for more than a bufmap slot could hold. This splits the calls up if needed. Signed-off-by: Mike Marshall commit 30f5059dba163550fb830af68cbd28ce78b1e0d2 Author: Mike Marshall Date: Tue Apr 7 11:25:54 2026 -0400 debugfs: take better advantage of strscpy. Signed-off-by: Mike Marshall commit f855f4ab123b2b9c93465288c03fbb07a5903bb3 Author: Ziyi Guo Date: Thu Feb 12 02:08:06 2026 +0000 orangefs: add usercopy whitelist to orangefs_op_cache orangefs_op_cache is created with kmem_cache_create(), which provides no usercopy whitelist. orangefs_devreq_read() copies the tag and upcall fields directly from slab objects to userspace via copy_to_user(). With CONFIG_HARDENED_USERCOPY enabled, this triggers usercopy_abort(). Switch to kmem_cache_create_usercopy() with a whitelist covering the tag and upcall fields, matching the pattern already used by orangefs_inode_cache in super.c. Signed-off-by: Ziyi Guo Signed-off-by: Mike Marshall commit dbd6a823057a728c7294f3aaa5ededba4ad19e57 Author: Mike Marshall Date: Wed Mar 4 16:50:41 2026 -0500 orangefs-debugfs.c: fix parsing problem with kernel debug keywords. When /sys/kernel/debug/orangefs/kernel-debug was set to a single keyword, the keyword was ignored. Now single and multiple keyword settings produce the expected debug output to the ring buffer. Signed-off-by: Mike Marshall commit 9b8e8aad5896d66005d29920cb1643076a20b172 Author: Claudio Imbrenda Date: Thu Apr 2 17:01:35 2026 +0200 KVM: s390: ucontrol: Fix memslot handling Fix memslots handling for UCONTROL guests. Attempts to delete user memslots will fail, as they should, without the risk of a NULL pointer dereference. Fixes: 413c98f24c63 ("KVM: s390: fake memslot for ucontrol VMs") Reviewed-by: Steffen Eiden Signed-off-by: Claudio Imbrenda commit 857e92662c07543887dafdb14b127519f4c0ac93 Author: Claudio Imbrenda Date: Thu Apr 2 17:01:34 2026 +0200 KVM: s390: selftests: enable some common memory-related tests Enable the following tests on s390: * memslot_modification_stress_test * memslot_perf_test * mmu_stress_test Since the first two tests are now supported on all architectures, move them into TEST_GEN_PROGS_COMMON and out of the indiviual architectures. Reviewed-by: Steffen Eiden Signed-off-by: Claudio Imbrenda commit c10e2771c745a206a2642cb03eec40ace2e0a7b5 Author: Claudio Imbrenda Date: Thu Apr 2 17:01:33 2026 +0200 KVM: selftests: Remove 1M alignment requirement for s390 Remove the 1M memslot alignment requirement for s390, since it is not needed anymore. Reviewed-by: Steffen Eiden Signed-off-by: Claudio Imbrenda commit 06a20c3ab6042ea7f9927fbeb50aa4e79894c136 Author: Claudio Imbrenda Date: Thu Apr 2 17:01:32 2026 +0200 KVM: s390: Allow 4k granularity for memslots Until now memslots on s390 needed to have 1M granularity and be 1M aligned. Since the new gmap code can handle memslots with 4k granularity and alignment, remove the restrictions. Reviewed-by: Christian Borntraeger Reviewed-by: Steffen Eiden Signed-off-by: Claudio Imbrenda commit 4204067f99820eda590ab99ae068463b4f930a33 Author: Claudio Imbrenda Date: Thu Apr 2 17:01:31 2026 +0200 KVM: s390: Add alignment checks for hugepages When backing a guest page with a large page, check that the alignment of the guest page matches the alignment of the host physical page backing it within the large page. Also check that the memslot is large enough to fit the large page. Those checks are currently not needed, because memslots are guaranteed to be 1m-aligned, but this will change. Reviewed-by: Steffen Eiden Signed-off-by: Claudio Imbrenda commit 6da4b1a4359b3ed5e7ee5e9a9751a9e483906409 Author: Claudio Imbrenda Date: Thu Apr 2 17:01:30 2026 +0200 KVM: s390: Add some useful mask macros Add _{SEGMENT,REGION3}_FR_MASK, similar to _{SEGMENT,REGION3}_MASK, but working on gfn/pfn instead of addresses. Use them in gaccess.c instead of using the normal masks plus gpa_to_gfn(). Also add _PAGES_PER_{SEGMENT,REGION3} to make future code more readable. Reviewed-by: Steffen Eiden Signed-off-by: Claudio Imbrenda commit 2ce8a41113eda1adddc1e6dc43cf89383ec6dc22 Author: Fernando Fernandez Mancera Date: Fri Apr 3 14:39:29 2026 +0200 net: hsr: emit notification for PRP slave2 changed hw addr on port deletion On PRP protocol, when deleting the port the MAC address change notification was missing. In addition to that, make sure to only perform the MAC address change on slave2 deletion and PRP protocol as the operation isn't necessary for HSR nor slave1. Note that the eth_hw_addr_set() is correct on PRP context as the slaves are either in promiscuous mode or forward offload enabled. Reported-by: Luka Gejak Closes: https://lore.kernel.org/netdev/DHFCZEM93FTT.1RWFBIE32K7OT@linux.dev/ Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Felix Maurer Link: https://patch.msgid.link/20260403123928.4249-2-fmancera@suse.de Signed-off-by: Paolo Abeni commit beaf0e96b1da74549a6cabd040f9667d83b2e97e Author: Jiayuan Chen Date: Tue Apr 7 20:23:33 2026 +0800 bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither hook can be used by sleepable LSM programs. Fixes: 423f16108c9d8 ("bpf: Augment the set of sleepable LSM hooks") Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn> Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Reported-by: Dongliang Mu Closes: https://lore.kernel.org/bpf/3ab69731-24d1-431a-a351-452aafaaf2a5@std.uestc.edu.cn/T/#u Signed-off-by: Jiayuan Chen Link: https://lore.kernel.org/r/20260407122334.344072-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit cc201899a972c9358639720404795d5a73acb1b4 Merge: fd495be8aa198a 591cd656a1bf5e Author: Mark Brown Date: Tue Apr 7 15:43:29 2026 +0100 ASoC: Merge up v7.0-rc7 Merge tag 'v7.0-rc7' to get fixes that make my CI happier. commit a3966a6f915ea7d1af0941ea26848d921e574c45 Author: Shawn Lin Date: Wed Mar 25 09:58:31 2026 +0800 Documentation: tracing: Add PCI controller event documentation The PCI controller tracepoint, pcie_ltssm_state_transition, monitors the LTSSM state transition and data rate changes for debugging purposes. Add documentation for it. Signed-off-by: Shawn Lin [mani: added MAINTAINERS entry] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Steven Rostedt (Google) Link: https://patch.msgid.link/1774403912-210670-3-git-send-email-shawn.lin@rock-chips.com commit 973403ca3553f0367a6982687f5f0ee4212e9ab9 Author: zhenwei pi Date: Mon Apr 6 21:28:26 2026 +0800 RDMA/core: Fix memory free for GID table When removing a RXE device, kernel oops: RIP: 0010:free_large_kmalloc+0xf6/0x140 Code: 75 28 0f 0b 44 0f b6 2d a5 d6 d1 01 41 80 fd 01 0f 87 7c d1 ad ff 41 83 e5 01 74 3d 41 bc 00 f0 ff ff 45 31 ed e9 61 ff ff ff <0f> 0b 48 c7 c6 af b1 70 83 48 89 df e8 79 0a fa ff 5b 41 5c 41 5d RSP: 0018:ffffd038c18074d8 EFLAGS: 00010293 RAX: 0017ffffc0000000 RBX: fffff86984219d00 RCX: 0000000000000000 RDX: 00000000000000f0 RSI: ffff899b88674000 RDI: fffff86984219d00 RBP: ffffd038c18074f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff899b88674000 R13: 0000000000000001 R14: ffff899b88674000 R15: ffff899b86180000 FS: 00007b163c71c740(0000) GS:ffff899c378bf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007b163c730200 CR3: 0000000106a1d000 CR4: 0000000000350ef0 Call Trace: kfree+0x163/0x3a0 gid_table_release_one+0xaf/0xf0 [ib_core] ib_cache_release_one+0x66/0x80 [ib_core] ib_device_release+0x48/0xb0 [ib_core] device_release+0x44/0xa0 kobject_put+0x9b/0x250 put_device+0x13/0x30 ib_unregister_device_and_put+0x40/0x60 [ib_core] nldev_dellink+0xd3/0x140 [ib_core] rdma_nl_rcv_msg+0x11d/0x300 [ib_core] ? netlink_bind+0x141/0x3a0 rdma_nl_rcv_skb.constprop.0.isra.0+0xba/0x110 [ib_core] rdma_nl_rcv+0xe/0x20 [ib_core] netlink_unicast+0x28d/0x3e0 netlink_sendmsg+0x214/0x470 __sys_sendto+0x21f/0x230 __x64_sys_sendto+0x24/0x40 x64_sys_call+0x1888/0x26e0 do_syscall_64+0xcb/0x14d0 ? _copy_from_user+0x27/0x70 ? do_sock_setsockopt+0xbd/0x190 ? __sys_setsockopt+0x72/0xd0 ? __x64_sys_setsockopt+0x1f/0x40 ? x64_sys_call+0x221b/0x26e0 ? do_syscall_64+0x109/0x14d0 ? exc_page_fault+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e GID table is allocated by kzalloc_flex() instead of raw kzalloc_obj(), kfree() should not be called on the data_vec flex array. Fixes: cef2842c922c ("RDMA/core: Use kzalloc_flex for GID table") Link: https://patch.msgid.link/r/20260406132830.435381-2-zhenwei.pi@linux.dev Reported-by: syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/69cc35ec.a70a0220.97f31.02a2.GAE@google.com Signed-off-by: zhenwei pi Signed-off-by: Jason Gunthorpe commit d1b7add89c004295cd48d7cd49946ed5cb5cbb55 Author: Shawn Lin Date: Wed Mar 25 09:58:30 2026 +0800 PCI: trace: Add PCI controller tracepoint feature Some PCI controllers may provide debug functionalities to track PCI bus activities like LTSSM state transitions and data rate changes. These will be very useful for debugging PCI link specific issues such as endpoint not getting detected or performance issues. Hence, implement the PCI controller tracepoint feature for recording LTSSM state transitions and data rate changes. Signed-off-by: Shawn Lin [mani: commit log and maintainers entry] Signed-off-by: Manivannan Sadhasivam Tested-by: Anand Moon Reviewed-by: Steven Rostedt (Google) Link: https://patch.msgid.link/1774403912-210670-2-git-send-email-shawn.lin@rock-chips.com commit ec427398794bbc0e294225a094a3060cc4bff19c Author: Thorsten Blum Date: Wed Apr 1 11:43:19 2026 +0200 platform/x86: dell-wmi-sysman: Fix typo in function comment s/Fress/Frees/ Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260401094318.658932-2-thorsten.blum@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4606467a75cfc16721937272ed29462a750b60c8 Author: Shivam Kumar Date: Wed Mar 18 18:56:58 2026 -0400 nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock. Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request(). Reviewed-by: Christoph Hellwig Signed-off-by: Shivam Kumar Signed-off-by: Keith Busch commit 2d5821579d39621fcce1b3d19ea25a2a9cf59cd9 Author: Thorsten Blum Date: Tue Mar 31 18:03:11 2026 +0200 platform/x86: dell-wmi-sysman: Clean up security buffer helpers In calculate_security_buffer(), call strlen() once and use ALIGN() to round up to an even size. In populate_security_buffer(), also avoid recomputing strlen(), rename the u32 pointer from 'seclen' to 'seclenp' to avoid confusion with the new length variable, and drop the memcpy() guard since calling it with size 0 is a no-op and therefore safe. Use 'const char *' for the read-only source string in both helpers. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260331160310.608857-3-thorsten.blum@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2d148a214b24b4a2525f649cced0c3e9e57281cd Author: Christoph Hellwig Date: Tue Apr 7 16:05:28 2026 +0200 xfs: use bio_await in xfs_zone_gc_reset_sync Replace the open-coded bio wait logic with the new bio_await helper. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260407140538.633364-6-hch@lst.de Signed-off-by: Jens Axboe commit 92c3737a2473ff5b83f90f5c1b353a27492a10f2 Author: Christoph Hellwig Date: Tue Apr 7 16:05:27 2026 +0200 block: add a bio_submit_or_kill helper Factor the common logic for the ioctl helpers to either submit a bio or end if the process is being killed. As this is now the only user of bio_await_chain, open code that. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260407140538.633364-5-hch@lst.de Signed-off-by: Jens Axboe commit 6fa747550e35f0a74e649b19d97055988a25b2e4 Author: Christoph Hellwig Date: Tue Apr 7 16:05:26 2026 +0200 block: factor out a bio_await helper Add a new helper to wait for a bio and anything chained off it to complete synchronously after submitting it. This factors common code out of submit_bio_wait and bio_await_chain and will also be useful for file system code and thus is exported. Note that this will now set REQ_SYNC also for the bio_await case for consistency. Nothing should look at the flag in the end_io handler, but if something does having the flag set makes more sense. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260407140538.633364-4-hch@lst.de Signed-off-by: Jens Axboe commit 65565ca5f99b42fe62b9a10117cca04f4311dc66 Author: Christoph Hellwig Date: Tue Apr 7 16:05:25 2026 +0200 block: unify the synchronous bi_end_io callbacks Put the bio in bio_await_chain after waiting for the completion, and share the now identical callbacks between submit_bio_wait and bio_await_chain. Signed-off-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260407140538.633364-3-hch@lst.de Signed-off-by: Jens Axboe commit 452c8f6cbd0ef1408474a875c5c4149a02c7610f Author: Christoph Hellwig Date: Tue Apr 7 16:05:24 2026 +0200 xfs: fix number of GC bvecs GC scratch allocations can wrap around and use the same buffer twice, and the current code fails to account for that. So far this worked due to rounding in the block layer, but changes to the bio allocator drop the over-provisioning and generic/256 or generic/361 will now usually fail when running against the current block tree. Simplify the allocation to always pass the maximum value that is easier to verify, as a saving of up to one bvec per allocation isn't worth the effort to verify a complicated calculated value. Fixes: 102f444b57b3 ("xfs: rework zone GC buffer management") Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Hans Holmberg Link: https://patch.msgid.link/20260407140538.633364-2-hch@lst.de Signed-off-by: Jens Axboe commit aa5e9884a2d63aa20fc3396d369382c1ecd16109 Merge: 915c1d23e2e3a9 80119a77e5b037 Author: Johannes Berg Date: Tue Apr 7 16:20:39 2026 +0200 Merge tag 'rtw-next-2026-04-02' of https://github.com/pkshih/rtw into wireless-next Ping-Ke Shih says: ================== rtw-next patches for -next Improve MLO and some random fixes. Notable changes are: * drop usb device reference across drivers rtw89: * add RTL8922DE but not enabled yet, because BT coexistence is still cooking. * add USB RX aggregation to improve performance. * add USB TX flow control by tracking in-flight URBs. ================== Signed-off-by: Johannes Berg commit 0b30c1037a6a48a4c293d45c6cbe8e312633782f Author: Randy Dunlap Date: Mon Apr 6 22:23:17 2026 -0700 hwmon: (yogafan) various markup improvements There are several places in yogafan.rst where it appears that lines are meant to be presented on their own but instead they are strung together due to the lack of markups. Fix these issues by: - using bullets where needed - indenting continuation lines of bulleted items - using a table where appropriate - using a literal block where appropriate Fixes: c67c248ca406 ("hwmon: (yogafan) Add support for Lenovo Yoga/Legion fan monitoring") Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20260407052317.2097791-1-rdunlap@infradead.org Signed-off-by: Guenter Roeck commit 6252e5c1c20e381adadfc91fa8af691017a268f1 Author: Jonathan Corbet Date: Mon Mar 30 16:25:11 2026 -0600 docs: add an Assisted-by mention to submitting-patches.rst We now require disclosure of the use of coding assistants, but our core submitting-patches document does not mention that. Add a brief mention with a pointer to Documentation/process/coding-assistants.rst Signed-off-by: Jonathan Corbet Message-ID: <877bqtlzug.fsf@trenco.lwn.net> commit 915c1d23e2e3a94f432bda6fb64f47c06f840ca1 Author: Tamizh Chelvam Raja Date: Thu Mar 26 22:17:23 2026 +0530 wifi: mac80211: enable MLO support for 4-address mode interfaces The current code does not support establishing MLO connections for interfaces operating in 4-address AP_VLAN mode. MLO bringup is blocked by sanity checks in cfg.c, iface.c, and mlme.c, which prevent MLD initialization when use_4addr is enabled. Remove these restrictions to allow 4-address AP_VLAN interfaces to initialize as part of an MLD and successfully participate in MLO connections. This patch series also adds the necessary changes to support WDS operation in MLO, making these modifications valid. Allow 4-address mode interfaces to: - Proceed with MLD initialization during interface setup - Add MLO links dynamically via ieee80211_add_intf_link() - Establish associations with MLO-capable access points - Support AP_VLAN interfaces with MLO parent APs Signed-off-by: Tamizh Chelvam Raja Link: https://patch.msgid.link/20260326164723.553927-4-tamizh.raja@oss.qualcomm.com Signed-off-by: Johannes Berg commit 594be50a3f0a6b7389f40f7acbf0dd731beb5204 Author: Tamizh Chelvam Raja Date: Thu Mar 26 22:17:22 2026 +0530 wifi: mac80211: use ap_addr for 4-address NULL frame destination Currently ieee80211_send_4addr_nullfunc() uses deflink.u.mgd.bssid for addr1 and addr3 fields. In MLO configurations, deflink.u.mgd.bssid represents link 0's BSSID and is not updated when link 0 is not an assoc link. This causes 4-address NULL frames to be sent to the wrong address, preventing WDS AP_VLAN interface creation on the peer AP. To fix this use sdata->vif.cfg.ap_addr instead, which contains the AP's MLD address populated during authentication/association and remains valid regardless of which links are active. This ensures 4-address NULL frames reach the correct AP, allowing proper WDS operation over MLO connections. Co-developed-by: Sathishkumar Muruganandam Signed-off-by: Sathishkumar Muruganandam Signed-off-by: Tamizh Chelvam Raja Link: https://patch.msgid.link/20260326164723.553927-3-tamizh.raja@oss.qualcomm.com Signed-off-by: Johannes Berg commit 469d5d5a3b7a133837004a18f34c899625fd5941 Author: Tamizh Chelvam Raja Date: Thu Mar 26 22:17:21 2026 +0530 wifi: mac80211: synchronize valid links for WDS AP_VLAN interfaces The current code does not provide any link-configuration support for 4-address mode WDS AP_VLAN interfaces in MLO setups, preventing MLD stations from being added correctly. Add the required handling to enable proper integration of 4-address WDS stations into an MLO environment. When a 4-address station associates with an MLO AP, compute the intersection of valid links between the master AP interface and the station's advertised capabilities. Configure the AP_VLAN interface with only these common links to ensure correct data-path operation. This update ensures AP_VLAN interfaces correctly track link-state transitions and maintain consistent addressing across all active MLO links. Co-developed-by: Muna Sinada Signed-off-by: Muna Sinada Signed-off-by: Tamizh Chelvam Raja Link: https://patch.msgid.link/20260326164723.553927-2-tamizh.raja@oss.qualcomm.com Signed-off-by: Johannes Berg commit affb5f67d73c1e0bd412e7807a55691502b5679e Author: Ming Lei Date: Tue Mar 31 23:32:01 2026 +0800 selftests/ublk: add read-only buffer registration test Add --rdonly_shmem_buf option to kublk that registers shared memory buffers with UBLK_SHMEM_BUF_READ_ONLY (read-only pinning without FOLL_WRITE) and mmaps with PROT_READ only. Add test_shmemzc_04.sh which exercises the new flag with a null target, hugetlbfs buffer, and write workload. Write I/O works because the server only reads from the shared buffer — the data flows from client to kernel to the shared pages, and the server reads them out. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260331153207.3635125-11-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 12075992c62ee330b2c531fa066b19be21698115 Author: Ming Lei Date: Tue Mar 31 23:32:00 2026 +0800 selftests/ublk: add filesystem fio verify test for shmem_zc Add test_shmemzc_03.sh which exercises shmem_zc through the full filesystem stack: mkfs ext4 on the ublk device, mount it, then run fio verify on a file inside the filesystem with --mem=mmaphuge. Extend _mkfs_mount_test() to accept an optional command that runs between mount and umount. The function cd's into the mount directory so the command can use relative file paths. Existing callers that pass only the device are unaffected. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260331153207.3635125-10-ming.lei@redhat.com Signed-off-by: Jens Axboe commit d4866503324c062f70dddfdd2e59957d335fc230 Author: Ming Lei Date: Tue Mar 31 23:31:59 2026 +0800 selftests/ublk: add hugetlbfs shmem_zc test for loop target Add test_shmem_zc_02.sh which tests the UBLK_IO_F_SHMEM_ZC zero-copy path on the loop target using a hugetlbfs shared buffer. Both kublk and fio mmap the same hugetlbfs file with MAP_SHARED, sharing physical pages. The kernel's PFN matching enables zero-copy — the loop target reads/writes directly from the shared buffer to the backing file. Uses standard fio --mem=mmaphuge: (supported since fio 1.10), no patched fio required. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260331153207.3635125-9-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 2f1e9468bdcba7e7572e16defd3c516f24281f14 Author: Ming Lei Date: Tue Mar 31 23:31:58 2026 +0800 selftests/ublk: add shared memory zero-copy test Add test_shmem_zc_01.sh which tests UBLK_IO_F_SHMEM_ZC on the null target using a hugetlbfs shared buffer. Both kublk (--htlb) and fio (--mem=mmaphuge:) mmap the same hugetlbfs file with MAP_SHARED, sharing physical pages. The kernel PFN match enables zero-copy I/O. Uses standard fio --mem=mmaphuge: (supported since fio 1.10), no patched fio required. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260331153207.3635125-8-ming.lei@redhat.com Signed-off-by: Jens Axboe commit ec20aa44ac2629943c9b2b5524bcb55d778f746c Author: Ming Lei Date: Tue Mar 31 23:31:57 2026 +0800 selftests/ublk: add UBLK_F_SHMEM_ZC support for loop target Add loop_queue_shmem_zc_io() which handles I/O requests marked with UBLK_IO_F_SHMEM_ZC. When the kernel sets this flag, the request data lives in a registered shared memory buffer — decode index + offset from iod->addr and use the server's mmap as the I/O buffer. The dispatch check in loop_queue_tgt_rw_io() routes SHMEM_ZC requests to this new function, bypassing the normal buffer registration path. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260331153207.3635125-7-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 166b476b8dee61dc6501f6eb91619d28c3430f75 Author: Ming Lei Date: Tue Mar 31 23:31:56 2026 +0800 selftests/ublk: add shared memory zero-copy support in kublk Add infrastructure for UBLK_F_SHMEM_ZC shared memory zero-copy: - kublk.h: struct ublk_shmem_entry and table for tracking registered shared memory buffers - kublk.c: per-device unix socket listener that accepts memfd registrations from clients via SCM_RIGHTS fd passing. The listener mmaps the memfd and registers the VA range with the kernel for PFN matching. Also adds --shmem_zc command line option. - kublk.c: --htlb option to open a pre-allocated hugetlbfs file, mmap it with MAP_SHARED|MAP_POPULATE, and register it with the kernel via ublk_ctrl_reg_buf(). Any process that mmaps the same hugetlbfs file shares the same physical pages, enabling zero-copy without socket-based fd passing. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260331153207.3635125-6-ming.lei@redhat.com Signed-off-by: Jens Axboe commit b5b8e295973083abf823fb66647a7c702a8db8a7 Author: Nicolas Escande Date: Fri Mar 27 11:02:56 2026 +0100 wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() A station which has a NSS ratio on the number of streams it is capable of in 160MHz VHT operation is supposed to use the 'Extended NSS BW Support' as defined by section '9.4.2.156.2 VHT Capabilities Information field'. This was missing in ieee80211_determine_our_sta_mode() and so we would wrongfully downgrade our bandwidth when connecting to an AP that supported 160MHz with messages such as: [ 37.638346] wlan1: AP XX:XX:XX:XX:XX:XX changed bandwidth in assoc response, new used config is 5280.000 MHz, width 3 (5290.000/0 MHz) Fixes: 310c8387c638 ("wifi: mac80211: clean up connection process") Signed-off-by: Nicolas Escande Link: https://patch.msgid.link/20260327100256.3101348-1-nico.escande@gmail.com Signed-off-by: Johannes Berg commit c4ed2c3f4f5e34156e607f2ea92cefad638af50e Author: Jiajia Liu Date: Tue Apr 7 14:32:05 2026 +0800 wifi: mac80211: remove unused variables in minstrel_ht_alloc_sta Remove the unused variable max_rates and related code. Also remove the variable mi and pass type to kzalloc_obj instead. Signed-off-by: Jiajia Liu Link: https://patch.msgid.link/20260407063205.68471-1-liujiajia@kylinos.cn Signed-off-by: Johannes Berg commit 8a34e88769f617dc980edb5a0079e347bd1b9a89 Author: Ming Lei Date: Tue Mar 31 23:31:55 2026 +0800 ublk: eliminate permanent pages[] array from struct ublk_buf The pages[] array (kvmalloc'd, 8 bytes per page = 2MB for a 1GB buffer) was stored permanently in struct ublk_buf but only needed during pin_user_pages_fast() and maple tree construction. Since the maple tree already stores PFN ranges via ublk_buf_range, struct page pointers can be recovered via pfn_to_page() during unregistration. Make pages[] a temporary allocation in ublk_ctrl_reg_buf(), freed immediately after the maple tree is built. Rewrite __ublk_ctrl_unreg_buf() to iterate the maple tree for matching buf_index entries, recovering struct page pointers via pfn_to_page() and unpinning in batches of 32. Simplify ublk_buf_erase_ranges() to iterate the maple tree by buf_index instead of walking the now-removed pages[] array. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260331153207.3635125-5-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 2acabc866c688fde0f40168614eeb27aed7906b6 Merge: 591cd656a1bf5e 2fd3b83cacfb91 Author: Rafael J. Wysocki Date: Tue Apr 7 15:39:38 2026 +0200 Merge tag 'linux-cpupower-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Pull cpupower utility updates for 7.1-rc1 from Shuah Khan: "- Fixes errors in cpupower-frequency-info short option names to its manpage. - Fixes cpupower-idle-info perf option name to its manpage. - Adds boost and epp options to cpupower-frequency-info to its manpage. - Adds description for perf-bias option to cpupower-info to its manpage. - Removes unnecessary extern declarations from getopt.h in arguments parsing functions in cpufreq-set, cpuidle-info, cpuidle-set, cpupower-info, and cpupower-set utilities. These functions are defined getopt.h file." * tag 'linux-cpupower-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower: remove extern declarations in cmd functions cpupower-info.1: describe the --perf-bias option cpupower-frequency-info.1: document --boost and --epp options cpupower-frequency-info.1: use the proper name of the --perf option cpupower-idle-info.1: fix short option names commit 08677040a91199175149d1fd465c02e3b3fc768a Author: Ming Lei Date: Tue Mar 31 23:31:54 2026 +0800 ublk: enable UBLK_F_SHMEM_ZC feature flag Add UBLK_F_SHMEM_ZC (1ULL << 19) to the UAPI header and UBLK_F_ALL. Switch ublk_support_shmem_zc() and ublk_dev_support_shmem_zc() from returning false to checking the actual flag, enabling the shared memory zero-copy feature for devices that request it. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260331153207.3635125-4-ming.lei@redhat.com [axboe: ublk_buf_reg -> ublk_shmem_buf_reg errors] Signed-off-by: Jens Axboe commit 368f5098ed0b2eb5d06dbbe692c163c85f240a4d Author: Alexander Stein Date: Sat Mar 28 15:01:21 2026 +0100 wifi: brcmfmac: silence warning for non-existent, optional firmware The driver tries to load optional firmware files, specific to the actual board compatible. These might not exist resulting in a warning like this: brcmfmac mmc2:0001:1: Direct firmware load for brcm/brcmfmac4373-sdio.tq,imx93-tqma9352-mba93xxla-mini.bin failed with error -2 Silence this by using firmware_request_nowait_nowarn() for all firmware loads which use brcmf_fw_request_done_alt_path() as callback. This one handles optional firmware files. Signed-off-by: Alexander Stein Tested-by: Christian Hewitt [arend: use nowarn api for optional firmware files] Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20260328140121.2583606-1-arend.vanspriel@broadcom.com [clean up code a bit] Signed-off-by: Johannes Berg commit 4d4a512a1f87b156f694d25c800e3d525aa56e8a Author: Ming Lei Date: Tue Mar 31 23:31:53 2026 +0800 ublk: add PFN-based buffer matching in I/O path Add ublk_try_buf_match() which walks a request's bio_vecs, looks up each page's PFN in the per-device maple tree, and verifies all pages belong to the same registered buffer at contiguous offsets. Add ublk_iod_is_shmem_zc() inline helper for checking whether a request uses the shmem zero-copy path. Integrate into the I/O path: - ublk_setup_iod(): if pages match a registered buffer, set UBLK_IO_F_SHMEM_ZC and encode buffer index + offset in addr - ublk_start_io(): skip ublk_map_io() for zero-copy requests - __ublk_complete_rq(): skip ublk_unmap_io() for zero-copy requests The feature remains disabled (ublk_support_shmem_zc() returns false) until the UBLK_F_SHMEM_ZC flag is enabled in the next patch. Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260331153207.3635125-3-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 1c161ca67e9bbd39b5c2adc8e067affcab10e8a5 Author: Brendan Jackman Date: Fri Mar 27 12:30:07 2026 +0000 wifi: iwlegacy: Fix GFP flags in allocation loop Do not latch these flags, they should be re-evaluated for each iteration of the loop. Concretely, rxq->free_count is incremented during the loop so the __GFP_NOWARN decision may be stale. There may be other reasons to require the re-evaluation too. Suggested-by: Stanislaw Gruszka Link: https://lore.kernel.org/all/20260327115739.GB16800@wp.pl/ Signed-off-by: Brendan Jackman Acked-by: Stanislaw Gruszka Link: https://patch.msgid.link/20260327-iwlegacy-gfp-fix-v1-1-b83e4db0bd66@google.com Signed-off-by: Johannes Berg commit 2fb0ded237bb55dae45bc076666b348fc948ac9e Author: Ming Lei Date: Tue Mar 31 23:31:52 2026 +0800 ublk: add UBLK_U_CMD_REG_BUF/UNREG_BUF control commands Add control commands for registering and unregistering shared memory buffers for zero-copy I/O: - UBLK_U_CMD_REG_BUF (0x18): pins pages from userspace, inserts PFN ranges into a per-device maple tree for O(log n) lookup during I/O. Buffer pointers are tracked in a per-device xarray. Returns the assigned buffer index. - UBLK_U_CMD_UNREG_BUF (0x19): removes PFN entries and unpins pages. Queue freeze/unfreeze is handled internally so userspace need not quiesce the device during registration. Also adds: - UBLK_IO_F_SHMEM_ZC flag and addr encoding helpers in UAPI header (16-bit buffer index supporting up to 65536 buffers) - Data structures (ublk_buf, ublk_buf_range) and xarray/maple tree - __ublk_ctrl_reg_buf() helper for PFN insertion with error unwinding - __ublk_ctrl_unreg_buf() helper for cleanup reuse - ublk_support_shmem_zc() / ublk_dev_support_shmem_zc() stubs (returning false — feature not enabled yet) Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260331153207.3635125-2-ming.lei@redhat.com [axboe: fixup ublk_buf_reg -> ublk_shmem_buf_reg errors, comments] Signed-off-by: Jens Axboe commit 72b18625ba8e5c28acbc923822a8b9ca7c5b3931 Author: Ronald Claveau Date: Fri Mar 27 10:36:26 2026 +0100 dt-bindings: net: wireless: brcm: Add compatible for bcm43752 Add bcm43752 compatible with its bcm4329 compatible fallback. Acked-by: Conor Dooley Signed-off-by: Ronald Claveau Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260327-add-bcm43752-compatible-v2-1-5b28e6637101@aliel.fr Signed-off-by: Johannes Berg commit d278bf868604af9895f4b8b4f7f4bb82e317740c Author: Rosen Penev Date: Thu Mar 26 20:06:16 2026 -0700 wifi: wilc1000: use kzalloc_flex Because key is a flexible array member, kzalloc_flex can be used to handle the math properly and simplify the code slightly. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260327030616.8774-1-rosenp@gmail.com Signed-off-by: Johannes Berg commit 49152949deeabd24db87f284f993ab89d4b8ac38 Author: Brendan Jackman Date: Thu Mar 26 12:31:58 2026 +0000 wifi: iwlegacy: Fixup allocation failure log Fix 2 issues spotted by AI[0]: 1. Missing space after the full stop. 2. Wrong GFP flags are printed. And also switch to %pGg for the GFP flags. This produces nice readable output and decouples the format string from the size of gfp_t. [0] https://sashiko.dev/#/patchset/20260319-gfp64-v1-0-2c73b8d42b7f%40google.com Signed-off-by: Brendan Jackman Acked-by: Stanislaw Gruszka Link: https://patch.msgid.link/20260326-gfp64-v2-2-d916021cecdf@google.com [add missing wifi: prefix] Signed-off-by: Johannes Berg commit 084863593243c5dce0f2eef44e23de8c53ebf4a2 Author: Rosen Penev Date: Thu Feb 19 18:27:39 2026 -0800 wifi: brcmfmac: of: defer probe for MAC address of_get_mac_address can return EPROBE_DEFER if the specific nvmem driver has not been loaded yet. Signed-off-by: Rosen Penev Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260220022739.41755-1-rosenp@gmail.com Signed-off-by: Johannes Berg commit dd8592fc6007a451c3e4b9025de365e39de8178a Author: Ethan Tidmore Date: Mon Feb 16 20:30:43 2026 -0600 wifi: brcmfmac: Fix error pointer dereference The function brcmf_chip_add_core() can return an error pointer and is not checked. Add checks for error pointer. Detected by Smatch: drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR() drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR() drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR() drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR() drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR() Fixes: cb7cf7be9eba7 ("brcmfmac: make chip related functions host interface independent") Signed-off-by: Ethan Tidmore Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260217023043.73631-1-ethantidmore06@gmail.com [add missing wifi: prefix] Signed-off-by: Johannes Berg commit 014eec318fc00f0b497bffa04f1a45255ba7ff5e Author: Avraham Stern Date: Thu Mar 26 12:14:45 2026 +0200 wifi: mac80211: allow add_key on NAN interfaces Keys may be added to the NAN interfaces to protect NAN management frames and data, allow that. Signed-off-by: Avraham Stern Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.34961ba9a0c4.I5b7c646c456d4112e5ab8663026153ace9b6b7d6@changeid Signed-off-by: Johannes Berg commit 5f6fba9a1e7b03a6369a1078d3921440fff95200 Author: Miri Korenblit Date: Thu Mar 26 12:14:44 2026 +0200 wifi: mac80211: report and drop spurious NAN Data frames According to Wi-Fi Aware (TM) 4.0 specification 6.2.5, in case a frame is recevied from an address that doesn't belong to any active NDP, the frame should be dropped and a NAN Data Path Termination should be sent to the transmitter. Do it by dropping the frame and calling cfg80211_rx_spurious_frame in that case. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.721b3a61c580.I19e3572508beeba143871682c80e9a56b6c1046a@changeid Signed-off-by: Johannes Berg commit 779df4461440b34278d8558c8c977f8ff1d6c18d Author: Miri Korenblit Date: Thu Mar 26 12:14:43 2026 +0200 wifi: mac80211: allow block ack agreements in NAN Data Allow receiving and sending Add Block Ack action frames for NAN Data Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.fe51df9d65f4.I104435f2af65e032cba168b1d842cb9610720041@changeid Signed-off-by: Johannes Berg commit 61408403e2b4a3e90b2bc6eda9a57837c4fa8ece Author: Miri Korenblit Date: Thu Mar 26 12:14:42 2026 +0200 wifi: mac80211: Accept frames on NAN DATA interfaces Accept frames there were received on NAN DATA interfaces: - Data frames, both multicast or unicast - Non-Public action frames, both multicast or unicast - Unicast secure management frames - FromDS and ToDS are 0. While at it, check FromDS/ToDS also for NAN management frames. Accept only data frames from devices that are part of the NAN cluster. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.0e6f37d4a40c.Iaa84cc3d063392f0150fcdf2bf610bdb41062f70@changeid Signed-off-by: Johannes Berg commit b5e4adbd01d1c4f864941162133840a370008e2c Author: Miri Korenblit Date: Thu Mar 26 12:14:41 2026 +0200 wifi: mac80211: add support for TX over NAN_DATA interfaces Add support for TXing frames over NAN_DATA interfaces: - find the NDI station - populoate the addresses fields - use NUM_NL80211_BANDS for the band, similar to NAN interfaces. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.b1d248947158.I04b27d9727f7a553fa80520cf6e532683ac03690@changeid Signed-off-by: Johannes Berg commit e1d5c95456a433b8898fff48c17a6150e69e9af9 Author: Miri Korenblit Date: Thu Mar 26 12:14:40 2026 +0200 wifi: mac80211: update NAN data path state on schedule changes A carrier of an NDI interface is turned on when there is at least one NDI station that: (1) correlates to this interface (2) is authorized (3) the NAN peer to which this station belongs has at least one common slot with the local schedule. Otherwise, it is turned off. (common slots are slots where both schedules are active on compatible channels.) Implement the calculation of the carrier state and trigger it when needed. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.98ff4115406f.Ie796487ab9eb23cda819b0afac57e7267b134911@changeid Signed-off-by: Johannes Berg commit 840492bf333bf3b69503a573a7ad71147a7ab67e Author: Miri Korenblit Date: Thu Mar 26 12:14:39 2026 +0200 wifi: mac80211: add NAN peer schedule support Peer schedules specify which channels the peer is available on and when. Add support for configuring peer NAN schedules: - build and store the schedule and maps - for each channel, make sure that it fits into the capabilities, and take the minimum between it and the local compatible nan channel. - configure the driver Note that the removal of a peer schedule should be done by the driver upon NMI station removal. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.185ff2283fa6.I0345eb665be8ccf4a77eb1aca9a421eb8d2432e2@changeid Signed-off-by: Johannes Berg commit 27e9b326b67440b559517977e19682461a50da2c Author: Miri Korenblit Date: Thu Mar 26 12:14:38 2026 +0200 wifi: mac80211: support NAN stations Add support for both NMI and NDI stations. The NDI station will be linked to the NMI station of the NAN peer for which the NDI station is added. A peer can choose to reuse its NMI address as the NDI address. Since different keys might be in use for NAN management and for data frames, we will have 2 different stations, even if they'll have the same address. Even though there are no links in NAN, sta->deflink will still be used to store the one set of capabilities and SMPS mode. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.9fdd37b8e755.I7a7bd6e8e751cab49c329419485839afd209cfc6@changeid Signed-off-by: Johannes Berg commit e43ec602201c5477508855f9c159956df18d108f Author: Miri Korenblit Date: Thu Mar 26 12:14:37 2026 +0200 wifi: mac80211: handle reconfig for NAN DATA interfaces Make sure these interfaces are added to the driver only after the NAN one was, and after NAN operation was started. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.b14392ce99d6.I2ba3bfcd93e47e48d7f7c74007c70cca52d46896@changeid Signed-off-by: Johannes Berg commit d6c470def51cd9ccc59c882e14ace478022b5a4a Author: Miri Korenblit Date: Thu Mar 26 12:14:36 2026 +0200 wifi: mac80211: support open and close for NAN_DATA interfaces Support opening and closing a NAN_DATA interface. Track the NAN (NMI) interface, for convenience. Allow opening an NAN_DATA interface only if the NAN interface is running (NAN has started). When closing the NAN interface, make sure all NAN_DATA interfaces are closed first, and warn if this is not the case. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.a19de68119e5.Ia6724dac6a0e17cb69989dd714d14f4df1c69bef@changeid Signed-off-by: Johannes Berg commit 589c06e8fdeec592e018004cebe283370160e581 Author: Miri Korenblit Date: Thu Mar 26 12:14:35 2026 +0200 wifi: mac80211: add NAN local schedule support A NAN local schedule consist of a list of NAN channels, and an array that maps time slots to the channel it is scheduled to (or NULL to indicate unscheduled). A NAN channel is the configuration of a channel which is used for NAN operations. It is a new type of chanctx user (before, the only user is a link). A NAN channel may not have a chanctx assigned if it is ULWed out. A NAN channel may or may not be scheduled (for example, user space may want to prepare the resources before the actual schedule is configured). Add management of the NAN local schedule. Since we introduce a new chanctx user, also adjust the different for_each_chanctx_user_* macros to visit also the NAN channels and take those into account. Co-developed-by: Avraham Stern Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.03350fd40630.Id158f815cfc9b5ab1ebdb8ee608bda426e4d7474@changeid Signed-off-by: Johannes Berg commit 23eab70e301f8b88282be658ac9b34b5a5953479 Author: Miri Korenblit Date: Thu Mar 26 12:14:34 2026 +0200 wifi: mac80211: run NAN DE code only when appropriate NAN DE (Discovery Engine) may be handled in the device or in user space. When handled in user space, all the NAN func management code should not run. Moreover, devices with user space DE should not provide the add/del_nan_func callbaks. For such devices, ieee80211_reconfig_nan will always fail. Make it clear what parts of ieee80211_if_nan are relevant to DE management, and touch those only when DE is offloaded. Add a check that makes sure that a driver doesn't register with add_del/nan_func callbacks if DE is in user space. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.6665f64865cd.Iee24bef3bae2e1d502216192e760c1e699d271c9@changeid Signed-off-by: Johannes Berg commit b16df0dacb3a77d4c1ce95f21c58a2b99ae10213 Author: Benjamin Berg Date: Thu Mar 26 12:14:33 2026 +0200 wifi: mac80211: export ieee80211_calculate_rx_timestamp The function is quite useful when handling beacon timestamps. Export it so that it can be used by mac80211_hwsim and others. Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.a1abc9c52f37.Ieabfe66768b1bf64c3076d62e73c50794faeacdc@changeid Signed-off-by: Johannes Berg commit 8ea6b92faebe4bad0e271cb9a8d819b8955ed476 Author: Benjamin Berg Date: Thu Mar 26 12:14:32 2026 +0200 wifi: ieee80211: add more NAN definitions These will be needed to implement NAN synchronization in mac80211_hwsim. Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.ebb52db4c1eb.Ie8142cf92fc8c97c744a7c8b0a94ce3da6ff75ec@changeid Signed-off-by: Johannes Berg commit 7f0de94ef44653764fa2fb8548b1253f0554f213 Author: Benjamin Berg Date: Thu Mar 26 12:14:31 2026 +0200 wifi: mac80211: add a TXQ for management frames on NAN devices Currently there is no TXQ for non-data frames. Add a new txq_mgmt for this purpose and create one of these on NAN devices. On NAN devices, these frames may only be transmitted during the discovery window and it is therefore helpful to schedule them using a queue. Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260326121156.32eddd986bd2.Iee95758287c276155fbd7779d3f263339308e083@changeid Signed-off-by: Johannes Berg commit 07cba0de5598a427cc8a7161202ebf4e79e692bd Author: Huisong Li Date: Tue Apr 7 16:11:41 2026 +0800 ACPI: processor: idle: Reset cpuidle on C-state list changes When a power notification event occurs, existing ACPI idle states may become obsolete. The current implementation only performs a partial update, leaving critical cpuidle parameters, like target_residency_ns and exit_latency_ns, stale. Furthermore, per-CPU cpuidle_device data, including last_residency_ns, states_usage, and the disable flag, are not properly synchronized. Using these stale values leads to incorrect power management decisions. To ensure all parameters are correctly synchronized, modify the notification handling logic: 1. Unregister all cpuidle_device instances to ensure a clean slate. 2. Unregister and re-register the ACPI idle driver. This forces the framework to re-evaluate global state parameters and ensures the driver state matches the new hardware power profile. 3. Re-initialize power information and re-register cpuidle_device for all possible CPUs to restore functional idle management. This complete reset ensures that the cpuidle framework and the underlying ACPI states are perfectly synchronized after a power state change. Signed-off-by: Huisong Li [ rjw: Subject rewrite ] Link: https://patch.msgid.link/20260407081141.2493581-3-lihuisong@huawei.com Signed-off-by: Rafael J. Wysocki commit a4c6c18e93a1d24df9ab95794cef471c89daefe4 Author: Huisong Li Date: Tue Apr 7 16:11:40 2026 +0800 cpuidle: Extract and export no-lock variants of cpuidle_unregister_device() The cpuidle_unregister_device() function always acquires the internal cpuidle_lock (or pause/resume idle) during their execution. However, in some power notification scenarios (e.g., when old idle states may become unavailable), it is necessary to efficiently disable cpuidle first, then remove and re-create all cpuidle devices for all CPUs. To avoid frequent lock overhead and ensure atomicity across the entire batch operation, the caller needs to hold the cpuidle_lock once outside the loop. To address this, extract the core logic into the new function cpuidle_unregister_device_no_lock() and export it. Signed-off-by: Huisong Li [ rjw: Added missing "inline", subject and changelog tweaks ] Link: https://patch.msgid.link/20260407081141.2493581-2-lihuisong@huawei.com Signed-off-by: Rafael J. Wysocki commit 51274836193a661a3f39e7f10629d5978a61bbfb Author: Hao Li Date: Tue Apr 7 19:59:33 2026 +0800 slub: clarify kmem_cache_refill_sheaf() comments In the in-place refill case, some objects may already have been added before the function returns -ENOMEM. Clarify this behavior and polish the rest of the comment for readability. Acked-by: Harry Yoo (Oracle) Signed-off-by: Hao Li Link: https://patch.msgid.link/20260407120018.42692-1-hao.li@linux.dev Signed-off-by: Vlastimil Babka (SUSE) commit 4a0fc189859bb564fddded12752e1893ad318263 Author: Geert Uytterhoeven Date: Tue Apr 7 12:11:01 2026 +0200 gpio: gpio-by-pinctrl: s/used to do/is used to do/ Add missing "is" to the driver's help text ("used to do" has a completely different meaning). Fixes: 7671f4949a6c9111 ("gpio: gpio-by-pinctrl: add pinctrl based generic GPIO driver") Signed-off-by: Geert Uytterhoeven Reviewed-by: Linus Walleij Link: https://patch.msgid.link/b1ecb31a37f8e35447122554a38985cb6240eb11.1775556619.git.geert+renesas@glider.be [Bartosz: tweak the help text even more] Signed-off-by: Bartosz Golaszewski commit 93b5d21e8b5cbdc3e439b94feee9b013e8170905 Author: Jian Zhang Date: Tue Apr 7 17:46:47 2026 +0800 ipmi: ssif_bmc: Fix KUnit test link failure when KUNIT=m Building with CONFIG_KUNIT=m and CONFIG_SSIF_IPMI_BMC_KUNIT_TEST=y results in link errors such as: undefined reference to `kunit_binary_assert_format' undefined reference to `__kunit_do_failed_assertion' This happens because the test code is built-in while the KUnit core is built as a module, so the required KUnit symbols are not available at link time. Fix this by requiring KUNIT to be built-in when enabling SSIF_IPMI_BMC_KUNIT_TEST. Signed-off-by: Jian Zhang Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604071448.zUBjPYPu-lkp@intel.com/ Message-ID: <20260407094647.356661-1-zhangjian.3032@bytedance.com> Signed-off-by: Corey Minyard commit fa0cac9a515877fad856c860ad51107b86ed6c4f Author: David Carlier Date: Sun Apr 5 16:47:04 2026 +0100 drbd: use get_random_u64() where appropriate Use the typed random integer helpers instead of get_random_bytes() when filling a single integer variable. The helpers return the value directly, require no pointer or size argument, and better express intent. Signed-off-by: David Carlier Reviewed-by: Christoph Böhmwalder Link: https://patch.msgid.link/20260405154704.4610-1-devnexen@gmail.com Signed-off-by: Jens Axboe commit fdca270f8f87cae2eb5b619234b9dd11a863ce6b Author: Pei Xiao Date: Tue Apr 7 15:30:28 2026 +0800 spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for the clock. This removes the need for explicit clock enable and disable calls, as the managed API automatically handles clock disabling on device removal or probe failure. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error path and the remove callback. Adjust error labels accordingly. Signed-off-by: Pei Xiao Reviewed-by: Kunihiko Hayashi Link: https://patch.msgid.link/b2deeefd4ef1a4bce71116aabfcb7e81400f6d37.1775546948.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit 556146ce5e9476db234134c46ddf0e154ca17028 Author: K Prateek Nayak Date: Tue Apr 7 13:36:17 2026 +0200 sched/fair: Avoid overflow in enqueue_entity() Here is one scenario which was triggered when running: stress-ng --yield=32 -t 10000000s& while true; do perf bench sched messaging -p -t -l 100000 -g 16; done on a 256CPUs machine after about an hour into the run: __enqeue_entity: entity_key(-141245081754) weight(90891264) overflow_mul(5608800059305154560) vlag(57498) delayed?(0) cfs_rq: zero_vruntime(3809707759657809) sum_w_vruntime(0) sum_weight(0) nr_queued(1) cfs_rq->curr: entity_key(0) vruntime(3809707759657809) deadline(3809723966988476) weight(37) The above comes from __enqueue_entity() after a place_entity(). Breaking this down: vlag_initial = 57498 vlag = (57498 * (37 + 90891264)) / 37 = 141,245,081,754 vruntime = 3809707759657809 - 141245081754 = 3,809,566,514,576,055 entity_key(se, cfs_rq) = -141,245,081,754 Now, multiplying the entity_key with its own weight results to 5,608,800,059,305,154,560 (same as what overflow_mul() suggests) but in Python, without overflow, this would be: -1,2837,944,014,404,397,056 Avoid the overflow (without doing the division for avg_vruntime()), by moving zero_vruntime to the new entity when it is heavier. Fixes: 4823725d9d1d ("sched/fair: Increase weight bits for avg_vruntime") Signed-off-by: K Prateek Nayak [peterz: suggested 'weight > load' condition] Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260407120052.GG3738010@noisy.programming.kicks-ass.net commit 8f993d30b95dc9557a8a96ceca11abed674c8acb Author: Greg Kroah-Hartman Date: Tue Apr 7 11:02:54 2026 +0200 usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() The block_len read from the host-supplied NTB header is checked against ntb_max but has no lower bound. When block_len is smaller than opts->ndp_size, the bounds check of: ndp_index > (block_len - opts->ndp_size) will underflow producing a huge unsigned value that ndp_index can never exceed, defeating the check entirely. The same underflow occurs in the datagram index checks against block_len - opts->dpe_size. With those checks neutered, a malicious USB host can choose ndp_index and datagram offsets that point past the actual transfer, and the skb_put_data() copies adjacent kernel memory into the network skb. Fix this by rejecting block lengths that cannot hold at least the NTB header plus one NDP. This will make block_len - opts->ndp_size and block_len - opts->dpe_size both well-defined. Commit 8d2b1a1ec9f5 ("CDC-NCM: avoid overflow in sanity checking") fixed a related class of issues on the host side of NCM. Fixes: 2b74b0a04d3e ("USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()") Cc: stable Assisted-by: gregkh_clanker_t1000 Link: https://patch.msgid.link/2026040753-baffle-handheld-624d@gregkh Signed-off-by: Greg Kroah-Hartman commit c088d5dd2fffb4de1fb8e7f57751c8b82942180a Author: Greg Kroah-Hartman Date: Tue Apr 7 10:55:05 2026 +0200 usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() A broken/bored/mean USB host can overflow the skb_shared_info->frags[] array on a Linux gadget exposing a Phonet function by sending an unbounded sequence of full-page OUT transfers. pn_rx_complete() finalizes the skb only when req->actual < req->length, where req->length is set to PAGE_SIZE by the gadget. If the host always sends exactly PAGE_SIZE bytes per transfer, fp->rx.skb will never be reset and each completion will add another fragment via skb_add_rx_frag(). Once nr_frags exceeds MAX_SKB_FRAGS (default 17), subsequent frag stores overwrite memory adjacent to the shinfo on the heap. Drop the skb and account a length error when the frag limit is reached, matching the fix applied in t7xx by commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path"). Cc: stable Assisted-by: gregkh_clanker_t1000 Link: https://patch.msgid.link/2026040705-fruit-unloved-0701@gregkh Signed-off-by: Greg Kroah-Hartman commit 2c863dbbeac7b919d4634ad886978a6731916de3 Author: Ethan Tidmore Date: Thu Apr 2 13:00:08 2026 -0500 usb: gadget: f_hid: Add missing error code Currently in cdev_alloc() error path no error code is assigned. Assign error code '-ENOMEM'. Detected by Smatch: drivers/usb/gadget/function/f_hid.c:1291 hidg_bind() warn: missing error code 'status' Fixes: 81ebd43cc0d6d ("usb: gadget: f_hid: don't call cdev_init while cdev in use") Signed-off-by: Ethan Tidmore Acked-by: Peter Korsgaard Reviewed-by: Michael Zimmermann Link: https://patch.msgid.link/20260402180008.64233-1-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit 40b17a345d3fe88b98acfe2637452baa32785ee0 Author: Jameson Thies Date: Fri Apr 3 22:33:27 2026 +0000 usb: typec: cros_ec_ucsi: Load driver from OF and ACPI definitions Add support for cros_ec_ucsi to load based on "google,cros-ec-ucsi" compatible devices and "GOOG0021" ACPI nodes. Signed-off-by: Jameson Thies Reviewed-by: Benson Leung Reviewed-by: Abhishek Pandit-Subedi Link: https://patch.msgid.link/20260403223357.1896403-3-jthies@google.com Signed-off-by: Greg Kroah-Hartman commit 250892b5d64d6a54faf4a0829ff3a99af27a4bc1 Author: Jameson Thies Date: Fri Apr 3 22:33:26 2026 +0000 dt-bindings: chrome: Add cros-ec-ucsi compatibility to typec binding Chrome OS devices with discrete power delivery controllers (PDCs) allow the host to read port status and control port behavior through a USB Type-C Connector System Software (UCSI) interface with the embedded controller (EC). This uses a separate interface driver than other Chrome OS devices with a Type-C port manager in the EC FW. Those use a host command interface supported by cros-ec-typec. Add a cros-ec-ucsi compatibility string to the existing cros-ec-typec binding. Additionally, update maintainer list to reflect cros-ec-ucsi and cros-ec-typec driver maintainers. Signed-off-by: Jameson Thies Reviewed-by: Benson Leung Reviewed-by: Rob Herring (Arm) Reviewed-by: Abhishek Pandit-Subedi Link: https://patch.msgid.link/20260403223357.1896403-2-jthies@google.com Signed-off-by: Greg Kroah-Hartman commit 9a8881aab5d3e69dd72d1b18bbde39be6f4664bf Author: Hans Zhang <18255117159@163.com> Date: Tue Apr 7 09:31:22 2026 +0800 USB: of: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Hans Zhang <18255117159@163.com> Link: https://patch.msgid.link/20260407013122.1296818-1-18255117159@163.com Signed-off-by: Greg Kroah-Hartman commit 2ab833a16a825373aad2ba7d54b572b277e95b71 Author: Nathan Rebello Date: Thu Apr 2 04:52:59 2026 -0400 usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible array whose size was fixed at URB allocation time based on the *original* number_of_packets from the CMD_SUBMIT. A malicious USB/IP server can set number_of_packets in the response to a value larger than what was originally submitted, causing a heap out-of-bounds write when usbip_recv_iso() writes to urb->iso_frame_desc[i] beyond the allocated region. KASAN confirmed this with kernel 7.0.0-rc5: BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640 Write of size 4 at addr ffff888106351d40 by task vhci_rx/69 The buggy address is located 0 bytes to the right of allocated 320-byte region [ffff888106351c00, ffff888106351d40) The server side (stub_rx.c) and gadget side (vudc_rx.c) already validate number_of_packets in the CMD_SUBMIT path since commits c6688ef9f297 ("usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input") and b78d830f0049 ("usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input"). The server side validates against USBIP_MAX_ISO_PACKETS because no URB exists yet at that point. On the client side we have the original URB, so we can use the tighter bound: the response must not exceed the original number_of_packets. This mirrors the existing validation of actual_length against transfer_buffer_length in usbip_recv_xbuff(), which checks the response value against the original allocation size. Kelvin Mbogo's series ("usb: usbip: fix integer overflow in usbip_recv_iso()", v2) hardens the receive-side functions themselves; this patch complements that work by catching the bad value at its source -- in usbip_pack_ret_submit() before the overwrite -- and using the tighter per-URB allocation bound rather than the global USBIP_MAX_ISO_PACKETS limit. Fix this by checking rpdu->number_of_packets against urb->number_of_packets in usbip_pack_ret_submit() before the overwrite. On violation, clamp to zero so that usbip_recv_iso() and usbip_pad_iso() safely return early. Fixes: 1325f85fa49f ("staging: usbip: bugfix add number of packets for isochronous frames") Cc: stable Acked-by: Shuah Khan Signed-off-by: Nathan Rebello Link: https://patch.msgid.link/20260402085259.234-1-nathan.c.rebello@gmail.com Signed-off-by: Greg Kroah-Hartman commit f880aac8a57ebd92abfa685d45424b2998ac1059 Author: Greg Kroah-Hartman Date: Mon Apr 6 17:09:48 2026 +0200 usb: gadget: renesas_usb3: validate endpoint index in standard request handlers The GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint number from the host-supplied wIndex without any sort of validation. Fix this up by validating the number of endpoints actually match up with the number the device has before attempting to dereference a pointer based on this math. This is just like what was done in commit ee0d382feb44 ("usb: gadget: aspeed_udc: validate endpoint index for ast udc") for the aspeed driver. Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") Cc: stable Assisted-by: gregkh_clanker_t1000 Link: https://patch.msgid.link/2026040647-sincerity-untidy-b104@gregkh Signed-off-by: Greg Kroah-Hartman commit 274875f72f6c188cdc9d4424e02341472bc2b3c1 Author: Greg Kroah-Hartman Date: Mon Apr 6 16:18:31 2026 +0200 usb: core: config: reverse the size check of the SSP isoc endpoint descriptor Reverse the check of the size of the usb_ssp_isoc_ep_comp_descriptor structure to be done before accessing the structure itself. Functionally, this doesn't really do anything as the buffer is all internal to the kernel, and reading off the end is just fine, but static checking tools get picky when noticing that a potential read could be made "outside" of an allocated buffer. Not a bugfix, but a cleanup to keep tools from tripping over this constantly and annoying me with their pointless reports. Link: https://patch.msgid.link/2026040630-graded-postwar-760f@gregkh Signed-off-by: Greg Kroah-Hartman commit 1ace770f5de3e28a4d61c2b5252cb823dcdb6049 Author: Jameson Thies Date: Thu Apr 2 18:24:38 2026 +0000 usb: typec: ucsi: Set usb mode on partner change Currently the partner usb_mode is only set in ucsi_register_partner(). If the partner enters USB4 operation after it is registered, this is not reported to the typec class. The UCSI spec states that the Connector Partner Changed bit can represent a Connector Partner Flags change. When handling a UCSI partner change, check the partner flags for USB4 operation. Signed-off-by: Jameson Thies Reviewed-by: Benson Leung Link: https://patch.msgid.link/20260402182438.867396-1-jthies@google.com Signed-off-by: Greg Kroah-Hartman commit f58752ebcb35e156c85cd1a82d6579c7af3b9023 Author: Dave Carey Date: Thu Apr 2 14:29:50 2026 -0400 USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen The Lenovo Yoga Book 9 14IAH10 (83KJ) has a composite USB device (17EF:6161) that controls both touchscreens via a CDC ACM interface. Interface 0 is a standard CDC ACM control interface, but interface 1 (the data interface) incorrectly declares vendor-specific class (0xFF) instead of USB_CLASS_CDC_DATA. cdc-acm rejects the device at probe with -EINVAL, leaving interface 0 unbound and EP 0x82 never polled. With no consumer polling EP 0x82, the firmware's watchdog fires every ~20 seconds and resets the USB bus, producing a continuous disconnect/ reconnect loop that prevents the touchscreens from ever initialising. Add two new quirk flags: VENDOR_CLASS_DATA_IFACE: Bypasses the bInterfaceClass check in acm_probe() that would otherwise reject the vendor-class data interface with -EINVAL. ALWAYS_POLL_CTRL: Submits the notification URB at probe() rather than waiting for a TTY open. This keeps EP 0x82 polled at all times, permanently suppressing the firmware watchdog. The URB is resubmitted after port_shutdown() and on system resume. SET_CONTROL_LINE_STATE (DTR|RTS) is sent at probe and after port_shutdown() to complete firmware handshake. Note: the firmware performs exactly 4 USB connect/disconnect cycles (~19 s each) on every cold boot before stabilising. This is a fixed firmware property; touch is available ~75-80 s after power-on. Signed-off-by: Dave Carey Cc: stable Tested-by: Dave Carey Acked-by: Oliver Neukum Link: https://patch.msgid.link/20260402182950.389016-1-carvsdriver@gmail.com Signed-off-by: Greg Kroah-Hartman commit 609865ab3d5d803556f628e221ecd3d06aed9f30 Author: Daniel Brát Date: Thu Apr 2 19:24:33 2026 +0200 usb: storage: Expand range of matched versions for VL817 quirks entry Expands range of matched bcdDevice values for the VL817 quirk entry. This is based on experience with Axagon EE35-GTR rev1 3.5" HDD enclosure, which reports its bcdDevice as 0x0843, but presumably other vendors using this IC in their products may set it to any other value. Signed-off-by: Daniel Brát Cc: stable Link: https://patch.msgid.link/20260402172433.5227-1-danek.brat@gmail.com Signed-off-by: Greg Kroah-Hartman commit a4e99587102a83ee911c670752fbca694c7e557f Author: Xu Yang Date: Thu Apr 2 15:14:57 2026 +0800 usb: chipidea: otg: not wait vbus drop if use role_switch The usb role switch will update ID and VBUS states at the same time, and vbus will not drop when execute data role swap in Type-C usecase. So lets not wait vbus drop in usb role switch case too. Fixes: e1b5d2bed67c ("usb: chipidea: core: handle usb role switch in a common way") Cc: stable@vger.kernel.org Acked-by: Peter Chen Reviewed-by: Jun Li Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260402071457.2516021-3-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit b94b631d9f78e653855f7fb58dbcb86c2a856f6f Author: Xu Yang Date: Thu Apr 2 15:14:56 2026 +0800 usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change For USB role switch-triggered IRQ, ID and VBUS change come together, for example when switching from host to device mode. ID indicate a role switch and VBUS is required to determine whether the device controller can start operating. Currently, ci_irq_handler() handles only a single event per invocation. This can cause an issue where switching to device mode results in the device controller not working at all. Allowing ci_irq_handler() to handle both ID and VBUS change in one call resolves this issue. Meanwhile, this change also affects the VBUS event handling logic. Previously, if an ID event indicated host mode the VBUS IRQ will be ignored as the device disable BSE when stop() is called. With the new behavior, if ID and VBUS IRQ occur together and the target mode is host, the VBUS event is queued and ci_handle_vbus_change() will call usb_gadget_vbus_connect(), after which USBMODE is switched to device mode, causing host mode to stop working. To prevent this, an additional check is added to skip handling VBUS event when current role is not device mode. Suggested-by: Peter Chen Fixes: e1b5d2bed67c ("usb: chipidea: core: handle usb role switch in a common way") Cc: stable@vger.kernel.org Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260402071457.2516021-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit abad793a41edbf05b87935f6b83017512ed0003a Author: Xu Yang Date: Thu Apr 2 15:14:55 2026 +0800 usb: chipidea: core: refactor ci_usb_role_switch_set() Current code is redundant, refactor the code, no function change. Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260402071457.2516021-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 1bf99c2a4b39307988a073bb29b126d1b832b415 Author: Vivian Wang Date: Fri Apr 3 18:34:29 2026 +0800 dt-bindings: opp-v2: Fix example 3 CPU reg value Example 3 is a dual-cluster example, meaning that the CPU nodes should have reg values 0x0, 0x1, 0x100, 0x101. The example incorrectly uses decimal 0, 1, 100, 101 instead, which seems unintended. Use the correct hexadecimal values. Even though the value doesn't change for the first two CPUs, 0 and 1 in example 3 are changed to 0x0 and 0x1 respectively for consistency. Other examples all have reg less than 10, so they have not been changed. Signed-off-by: Vivian Wang Acked-by: Viresh Kumar Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260403-dt-bindings-opp-v2-hex-cpu-reg-v1-1-38a4968ab515@iscas.ac.cn Signed-off-by: Rob Herring (Arm) commit 97a8355b6a715c79c090b906894e12dc3934b3fe Merge: dfecb0c5af3b07 25b8c9b6d7314d Author: Paolo Abeni Date: Tue Apr 7 13:34:08 2026 +0200 Merge branch 'net-mlx5e-xdp-add-support-for-multi-packet-per-page' Tariq Toukan says: ==================== net/mlx5e: XDP, Add support for multi-packet per page This series removes the limitation of having one packet per page in XDP mode. This has the following implications: - XDP in Striding RQ mode can now be used on 64K page systems. - XDP in Legacy RQ mode was using a single packet per page which on 64K page systems is quite inefficient. The improvement can be observed with an XDP_DROP test when running in Legacy RQ mode on a ARM Neoverse-N1 system with a 64K page size: +-----------------------------------------------+ | MTU | baseline | this change | improvement | |------+------------+-------------+-------------| | 1500 | 15.55 Mpps | 18.99 Mpps | 22.0 % | | 9000 | 15.53 Mpps | 18.24 Mpps | 17.5 % | +-----------------------------------------------+ After lifting this limitation, the series switches to using fragments for the side page in non-linear mode. This small improvement is at most visible for XDP_DROP tests with small 64B packets and a large enough MTU for Striding RQ to be in non-linear mode: +----------------------------------------------------------------------+ | System | MTU | baseline | this change | improvement | |----------------------+------+------------+-------------+-------------| | 4K page x86_64 [1] | 9000 | 26.30 Mpps | 30.45 Mpps | 15.80 % | | 64K page aarch64 [2] | 9000 | 15.27 Mpps | 20.10 Mpps | 31.62 % | +----------------------------------------------------------------------+ This series does not cover the xsk (AF_XDP) paths for 64K page systems. [1] https://lore.kernel.org/all/20260324024235.929875-1-kuba@kernel.org/ ==================== Link: https://patch.msgid.link/20260403090927.139042-1-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 25b8c9b6d7314d26f91bf115beafab58b5d376d0 Author: Dragos Tatulea Date: Fri Apr 3 12:09:27 2026 +0300 net/mlx5e: XDP, Use page fragments for linear data in multibuf-mode Currently in XDP multi-buffer mode for striding rq a whole page is allocated for the linear part of the XDP buffer. This is wasteful, especially on systems with larger page sizes. This change splits the page into fixed sized fragments. The page is replenished when the maximum number of allowed fragments is reached. When a fragment is not used, it will be simply recycled on next packet. This is great for XDP_DROP as the fragment can be recycled for the next packet. In the most extreme case (XDP_DROP everything), there will be 0 fragments used => only one linear page allocation for the lifetime of the XDP program. The previous page_pool size increase was too conservative (doubling the size) and now there are much fewer allocations (1/8 for a 4K page). So drop the page_pool size extension altogether when the linear side page is used. This small improvement is at most visible for XDP_DROP tests with small 64B packets and a large enough MTU for Striding RQ to be in non-linear mode: +----------------------------------------------------------------------+ | System | MTU | baseline | this change | improvement | |----------------------+------+------------+-------------+-------------| | 4K page x86_64 [1] | 9000 | 26.30 Mpps | 30.45 Mpps | 15.80 % | | 64K page aarch64 [2] | 9000 | 15.27 Mpps | 20.10 Mpps | 31.62 % | +----------------------------------------------------------------------+ [1] Intel Xeon Platinum 8580 [2] ARM Neoverse-N1 Signed-off-by: Dragos Tatulea Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260403090927.139042-6-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit ebd4ad29cc828f762d98f41b2a6a3f806185616f Author: Dragos Tatulea Date: Fri Apr 3 12:09:26 2026 +0300 net/mlx5e: XDP, Use a single linear page per rq Currently in striding rq there is one mlx5e_frag_page member per WQE for the linear page. This linear page is used only in XDP multi-buffer mode. This is wasteful because only one linear page is needed per rq: the page gets refreshed on every packet, regardless of WQE. Furthermore, it is not needed in other modes (non-XDP, XDP single-buffer). This change moves the linear page into its own structure (struct mlx5_mpw_linear_info) and allocates it only when necessary. A special structure is created because an upcoming patch will extend this structure to support fragmentation of the linear page. This patch has no functional changes. Signed-off-by: Dragos Tatulea Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260403090927.139042-5-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 2dfaa02387743306e1821ad01d4d4f5e7793cfb0 Author: Dragos Tatulea Date: Fri Apr 3 12:09:25 2026 +0300 net/mlx5e: XDP, Remove stride size limitation Currently XDP mode always uses PAGE_SIZE strides. This limitation existed because page fragment counting was not implemented when XDP was added. Furthermore, due to this limitation there were other issues as well on system with larger pages (e.g. 64K): - XDP for Striding RQ was effectively disabled on such systems. - Legacy RQ allows the configuration but uses a fixed scheme of one XDP buffer per page which is inefficient. As fragment counting was added during the driver conversion to page_pool and the support for XDP multi-buffer, it is now possible to remove this stride size limitation. This patch does just that. Now it is possible to use XDP on systems with higher page sizes (e.g. 64K): - For Striding RQ, loading the program is no longer blocked. Although a 64K page can fit any packet, MTUs that result in stride > 8K will still make the RQ in non-linear mode. That's because the HW doesn't support a higher than 8K stride. - For Legacy RQ, the stride size was PAGE_SIZE which was very inefficient. Now the stride size will be calculated relative to MTU. Legacy RQ will always be in linear mode for larger system pages. This can be observed with an XDP_DROP test [1] when running in Legacy RQ mode on a ARM Neoverse-N1 system with a 64K page size: +-----------------------------------------------+ | MTU | baseline | this change | improvement | |------+------------+-------------+-------------| | 1500 | 15.55 Mpps | 18.99 Mpps | 22.0 % | | 9000 | 15.53 Mpps | 18.24 Mpps | 17.5 % | +-----------------------------------------------+ There are performance benefits for Striding RQ mode as well: - Striding RQ non-linear mode now uses 256B strides, just like non-XDP mode. - Striding RQ linear mode can now fit a number of XDP buffers per page that is relative to the MTU size. That means that on 4K page systems and a small enough MTU, 2 XDP buffers can fit in one page. The above benefits for Striding RQ can be observed with an XDP_DROP test [1] when running on a 4K page x86_64 system (Intel Xeon Platinum 8580): +-----------------------------------------------+ | MTU | baseline | this change | improvement | |------+------------+-------------+-------------| | 1000 | 28.36 Mpps | 33.98 Mpps | 19.82 % | | 9000 | 20.76 Mpps | 26.30 Mpps | 26.70 % | +-----------------------------------------------+ [1] Test description: - xdp-bench with XDP_DROP - RX: single queue - TX: sends 64B packets to saturate CPU on RX side Signed-off-by: Dragos Tatulea Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260403090927.139042-4-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 833e72645aac10e9ca9459c4740c417e5b04faf6 Author: Dragos Tatulea Date: Fri Apr 3 12:09:24 2026 +0300 net/mlx5e: XDP, Improve dma address calculation of linear part for XDP_TX When calculating the dma address of the linear part of an XDP frame, the formula assumes that there is a single XDP buffer per page. Extend the formula to allow multiple XDP buffers per page by calculating the data offset in the page. This is a preparation for the upcoming removal of a single XDP buffer per page limitation when the formula will no longer be correct. Signed-off-by: Dragos Tatulea Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260403090927.139042-3-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 1047e14b44edecbbab02a86514a083b8db9fde4d Author: Dragos Tatulea Date: Fri Apr 3 12:09:23 2026 +0300 net/mlx5e: XSK, Increase size for chunk_size param When 64K pages are used, chunk_size can take the 64K value which doesn't fit in u16. This results in overflows that are detected in mlx5e_mpwrq_log_wqe_sz(). Increase the type to u32 to fix this. Signed-off-by: Dragos Tatulea Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260403090927.139042-2-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit fd495be8aa198a0d57069c37a9b44ee9e86a7486 Author: songxiebing Date: Wed Mar 25 10:17:52 2026 +0800 ASoC: intel: avs: Fix type mismatch in variable assignment The input parameter requirement for snd_pcm_format_physical_with is snd_pcm_format_t,but params->codec.format is __u32, resulting in a mismatch error: sparse warnings: (new ones prefixed by >>) >> sound/soc/intel/avs/probes.c:147:58: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted snd_pcm_format_t [usertype] format @@ got unsigned int [usertype] format @@ sound/soc/intel/avs/probes.c:147:58: sparse: expected restricted snd_pcm_format_t [usertype] format sound/soc/intel/avs/probes.c:147:58: sparse: got unsigned int [usertype] format So here, the format is cast to snd_pcm_format_t. Signed-off-by: songxiebing Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512190032.hnwn9mCV-lkp@intel.com/ Link: https://patch.msgid.link/20260325021752.238203-1-songxiebing@kylinos.cn Signed-off-by: Mark Brown commit 2ffc6900d5c3a7cd59becda2aa67581d9bd3858e Author: Christoph Hellwig Date: Mon Apr 6 07:54:17 2026 +0200 xfs: fix number of GC bvecs GC scratch allocations can wrap around and use the same buffer twice, and the current code fails to account for that. So far this worked due to rounding in the block layer, but changes to the bio allocator drop the over-provisioning and generic/256 or generic/361 will now usually fail when running against the current block tree. Simplify the allocation to always pass the maximum value that is easier to verify, as a saving of up to one bvec per allocation isn't worth the effort to verify a complicated calculated value. Fixes: 102f444b57b3 ("xfs: rework zone GC buffer management") Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit 971f3474f8898ae8bbab19a9b547819a5e6fbcf1 Author: Jie Gan Date: Tue Apr 7 19:09:05 2026 +0800 coresight: tpdm: fix invalid MMIO access issue Create the csdev_access struct only when a valid MMIO resource is available. In tpdm_probe(), base is uninitialized for static TPDM instances that lack an MMIO resource, causing csdev_access to be created with a garbage address. So far there has no register access for static instance, but this change helps mitigate potential risks in the future. Fixes: 14ae052f7947 ("coresight: tpdm: add static tpdm support") Reviewed-by: Leo Yan Signed-off-by: Jie Gan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260407-fix-potential-issue-in-tpdm-v2-1-1d0e0d3cb793@oss.qualcomm.com commit 9de45faed34d11f1821c386ea306d9788e9a6448 Author: Christoph Hellwig Date: Tue Mar 31 17:27:31 2026 +0200 xfs: untangle the open zones reporting in mountinfo Keeping a value per line makes parsing much easier, so move the maximum number of open zones into a separate line, and also add a new line for the number of open open GC zones. While that has to be either 0 or 1 currently having a value future-proofs the interface for adding more open GC zones if needed. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 62c89988dc198efc17be0119a43ad21cf32334d6 Author: Christoph Hellwig Date: Tue Mar 31 17:27:30 2026 +0200 xfs: expose the number of open zones in sysfs Add a sysfs attribute for the current number of open zones so that it can be trivially read from userspace in monitoring or testing software. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 1d0d9e9459c053fc1700739e267271adccdcaadc Author: Christoph Hellwig Date: Tue Mar 31 17:27:29 2026 +0200 xfs: reduce special casing for the open GC zone Currently the open zone used for garbage collection is a special snow flake, and it has been a bit annoying for some further zoned XFS work I've been doing. Remove the zi_open_gc_field and instead track the open GC zone in the zi_open_zones list together with the normal open zones, and keep an extra pointer and a reference of in the GC thread's data structure. This means anything iterating over open zones just has to look at zi_open_zones, and the life time rules are consistent. It also helps to add support for multiple open GC zones if we ever need them, and removes a bit of code. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 4c1b6e03e31c5933355f25fe7fa564be3a0f931d Author: Christoph Hellwig Date: Tue Mar 31 17:27:28 2026 +0200 xfs: streamline GC zone selection Currently picking of the GC target zone is a bit odd as it is done both in the main "can we start new GC cycles" routine and in the low-level block allocator for GC. This was mostly done to work around the rules for when code in a waitqueue wait loop can sleep. But with a trick to check if the process state has been set to running to discover if the wait loop has to be retried, all this becomes much simpler. We can select a GC zone just before writing, and bail out of starting new work if we can't find a usable zone. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 53c1c822908d9804504596486b96d8b887b0bacd Author: Christoph Hellwig Date: Tue Mar 31 17:27:27 2026 +0200 xfs: refactor GC zone selection helpers Merge xfs_zone_gc_ensure_target into xfs_zone_gc_select_target to keep all zone selection code together. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit ca0170a7fa41fa4ef5e31b0baf2225d84a385bfc Author: Christoph Hellwig Date: Tue Mar 31 17:27:26 2026 +0200 xfs: rename xfs_zone_gc_iter_next to xfs_zone_gc_iter_irec This function returns the current iterator position, which makes the _next postfix a bit misleading. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit a99ed5dbae018627faf4ac275cb322e94606a6f9 Author: Christoph Hellwig Date: Tue Mar 31 17:27:25 2026 +0200 xfs: put the open zone later xfs_open_zone_put The open zone is what holds the rtg reference for us. This doesn't matter until we support shrinking, and even then is rather theoretical because we can't shrink away a just filled zone in a tiny race window, but let's play safe here. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit c2257d9f63bbf7e1f39fb2b5585b21ea7445e18f Author: Christoph Hellwig Date: Tue Mar 31 17:27:24 2026 +0200 xfs: add a separate tracepoint for stealing an open zone for GC The case where we have to reuse an already open zone warrants a different trace point vs the normal opening of a GC zone. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit e771da0727c13ab2cb89ee47f2edcda8b87b2c73 Author: Christoph Hellwig Date: Tue Mar 31 17:27:23 2026 +0200 xfs: delay initial open of the GC zone The code currently used to select the new GC target zone when the previous one is full also handles the case where there is no current GC target zone at all. Make use of that to simplify the logic in xfs_zone_gc_mount. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 25947cc5b2374cd5bf627fe3141496444260d04f Author: Vasiliy Kovalev Date: Sat Apr 4 18:20:11 2026 +0300 ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() ext2_iget() already rejects inodes with i_nlink == 0 when i_mode is zero or i_dtime is set, treating them as deleted. However, the case of i_nlink == 0 with a non-zero mode and zero dtime slips through. Since ext2 has no orphan list, such a combination can only result from filesystem corruption - a legitimate inode deletion always sets either i_dtime or clears i_mode before freeing the inode. A crafted image can exploit this gap to present such an inode to the VFS, which then triggers WARN_ON inside drop_nlink() (fs/inode.c) via ext2_unlink(), ext2_rename() and ext2_rmdir(): WARNING: CPU: 3 PID: 609 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336 CPU: 3 UID: 0 PID: 609 Comm: syz-executor Not tainted 6.12.77+ #1 Call Trace: inode_dec_link_count include/linux/fs.h:2518 [inline] ext2_unlink+0x26c/0x300 fs/ext2/namei.c:295 vfs_unlink+0x2fc/0x9b0 fs/namei.c:4477 do_unlinkat+0x53e/0x730 fs/namei.c:4541 __x64_sys_unlink+0xc6/0x110 fs/namei.c:4587 do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x77/0x7f WARNING: CPU: 0 PID: 646 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336 CPU: 0 UID: 0 PID: 646 Comm: syz.0.17 Not tainted 6.12.77+ #1 Call Trace: inode_dec_link_count include/linux/fs.h:2518 [inline] ext2_rename+0x35e/0x850 fs/ext2/namei.c:374 vfs_rename+0xf2f/0x2060 fs/namei.c:5021 do_renameat2+0xbe2/0xd50 fs/namei.c:5178 __x64_sys_rename+0x7e/0xa0 fs/namei.c:5223 do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x77/0x7f WARNING: CPU: 0 PID: 634 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336 CPU: 0 UID: 0 PID: 634 Comm: syz-executor Not tainted 6.12.77+ #1 Call Trace: inode_dec_link_count include/linux/fs.h:2518 [inline] ext2_rmdir+0xca/0x110 fs/ext2/namei.c:311 vfs_rmdir+0x204/0x690 fs/namei.c:4348 do_rmdir+0x372/0x3e0 fs/namei.c:4407 __x64_sys_unlinkat+0xf0/0x130 fs/namei.c:4577 do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x77/0x7f Extend the existing i_nlink == 0 check to also catch this case, reporting the corruption via ext2_error() and returning -EFSCORRUPTED. This rejects the inode at load time and prevents it from reaching any of the namei.c paths. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Vasiliy Kovalev Link: https://patch.msgid.link/20260404152011.2590197-1-kovalev@altlinux.org Signed-off-by: Jan Kara commit 982999538269d5adbd7574098bd12e2c506bacfe Author: David Carlier Date: Sun Apr 5 16:47:17 2026 +0100 ext2: use get_random_u32() where appropriate Use the typed random integer helpers instead of get_random_bytes() when filling a single integer variable. The helpers return the value directly, require no pointer or size argument, and better express intent. Signed-off-by: David Carlier Link: https://patch.msgid.link/20260405154717.4705-1-devnexen@gmail.com Signed-off-by: Jan Kara commit 29a7b2614357393b176ef06ba5bc3ff5afc8df69 Author: Haoxiang Li Date: Wed Apr 1 12:02:41 2026 +0800 xfs: fix a resource leak in xfs_alloc_buftarg() In the error path, call fs_put_dax() to drop the DAX device reference. Fixes: 6f643c57d57c ("xfs: implement ->notify_failure() for XFS") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit c6584888864e36d6225a6c16d8c39fd2aa9a45d8 Author: Christoph Hellwig Date: Tue Mar 31 17:26:06 2026 +0200 xfs: handle too many open zones when mounting When running on conventional zones or devices, the zoned allocator does not have a real write pointer, but instead fakes it up at mount time based on the last block recorded in the rmap. This can create spurious "open" zones when the last written blocks in a conventional zone are invalidated. Add a loop to the mount code to find the conventional zone with the highest used block in the rmap tree and "finish" it until we are below the open zones limit. While we're at it, also error out if there are too many open sequential zones, which can only happen when the user overrode the max open zones limit (or with really buggy hardware reducing the limit, but not much we can do about that). Fixes: 4e4d52075577 ("xfs: add the zoned space allocator") Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 02367990bdcbeabb0ffd3e8e227e5f79a04186fc Author: Christoph Hellwig Date: Tue Mar 31 17:26:05 2026 +0200 xfs: refactor xfs_mount_zones xfs_mount_zones has grown a bit too big and unorganized. Split the zone reporting loop into a separate helper, hiding the rtg variable there. Print the mount message last, and also keep the VFS writeback chunk size last instead of in the middle of the logic to calculate the free/available blocks. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 553a13e2076d64774910d597977a17022625763d Author: Yuto Ohnuki Date: Sat Mar 28 17:34:10 2026 +0000 xfs: fix integer overflow in busy extent sort comparator xfs_extent_busy_ag_cmp() subtracts two uint32_t values (group numbers and block numbers) and returns the result as s32. When the difference exceeds INT_MAX, the result overflows and the sort order is corrupted. Use cmp_int() instead, as was done in commit 362c49098086 ("xfs: fix integer overflow in bmap intent sort comparator"). Fixes: 4a137e09151e ("xfs: keep a reference to the pag for busy extents") Signed-off-by: Yuto Ohnuki Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 59e586d7dc7813910abe20a8281bbc3f1360e08e Author: Yuto Ohnuki Date: Sat Mar 28 17:34:09 2026 +0000 xfs: fix integer overflow in deferred intent sort comparators xfs_extent_free_diff_items(), xfs_refcount_update_diff_items(), and xfs_rmap_update_diff_items() subtract two uint32_t group numbers and return the result as int, which can overflow when the difference exceeds INT_MAX. Use cmp_int() instead, as was done in commit 362c49098086 ("xfs: fix integer overflow in bmap intent sort comparator"). Fixes: c13418e8eb37 ("xfs: give xfs_rmap_intent its own perag reference") Fixes: f6b384631e1e ("xfs: give xfs_extfree_intent its own perag reference") Fixes: 00e7b3bac1dc ("xfs: give xfs_refcount_intent its own perag reference") Signed-off-by: Yuto Ohnuki Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit e92b3fc5b17c75d3ca31983a7d35e8b88786ee4e Author: Christoph Hellwig Date: Mon Mar 30 15:16:00 2026 +0200 xfs: fold xfs_setattr_size into xfs_vn_setattr_size xfs_vn_setattr_size is the only caller of xfs_setattr_size, so merge the two functions. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 0f7d2a9e020812a787d7c6dfc98715f9c8f72f53 Author: Christoph Hellwig Date: Mon Mar 30 15:15:59 2026 +0200 xfs: remove a duplicate assert in xfs_setattr_size There already is an assert that checks for uid and gid changes besides a lot of others at the beginning of the function. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit f4231eb25cd215882d4a5da9110d3772c2644b6c Author: John Hubbard Date: Fri Apr 3 19:12:02 2026 -0700 rust: sizes: add SizeConstants trait for device address space constants The SZ_* constants are usize, matching the CPU pointer width. But device address spaces have their own widths (32-bit MMIO windows, 64-bit GPU framebuffers, etc.), so drivers end up casting these constants with SZ_1M as u64 or helper functions. This adds boilerplate with no safety benefit. Add a SizeConstants trait with associated SZ_* constants, implemented for u32, u64, and usize. With the trait in scope, callers write u64::SZ_1M or u32::SZ_4K to get the constant in their device's native width. All SZ_* values fit in a u32, so every implementation is lossless. Each impl has a const assert to catch any future constant that would overflow. A define_sizes! macro generates everything from a single internal list of names. The macro takes the target types as arguments, so adding a new target type requires changing only the call site. Suggested-by: Danilo Krummrich Link: https://lore.kernel.org/all/DGB9G697GSWO.3VBFGU5MKFPMR@kernel.org/ Link: https://lore.kernel.org/all/DGHI8WRKBQS9.38910L6FIIZTE@kernel.org/ Reviewed-by: Eliot Courtney Reviewed-by: Alexandre Courbot Acked-by: Gary Guo Signed-off-by: John Hubbard Link: https://patch.msgid.link/20260404021204.339779-2-jhubbard@nvidia.com [ Applied the "kernel vertical" imports style. - Miguel ] Signed-off-by: Miguel Ojeda commit baa1cb259cc7f034435c3b8dad3e14267e2e6153 Author: Marc Kleine-Budde Date: Thu Mar 19 17:55:45 2026 +0100 spi: spi-fsl-lpspi: make struct lpspi_config::mode u32 The struct lpspi_config::mode holds a copy of the mode of struct spi_device::mode. In commit 937e6d756422 ("spi: expand mode support") the struct spi_device::mode was increased from u16 to u32. Increase the struct lpspi_config::mode to u32 avoid truncating the mode variable. Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-11-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown commit 4ef7fa7bca5728a3f61c28da73d7714ed1f303a6 Author: Marc Kleine-Budde Date: Thu Mar 19 17:55:44 2026 +0100 spi: spi-fsl-lpspi: fsl_lpspi_write_tx_fifo(): simplify while() loop check To simplify the loop check. Combine both conditions of the while() and the directly following if() into the while(). Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-10-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown commit b326c71d4e6f9623ee137bccf8205e4327aa1914 Author: Marc Kleine-Budde Date: Thu Mar 19 17:55:43 2026 +0100 spi: spi-fsl-lpspi: fsl_lpspi_reset(): convert to void function The function fsl_lpspi_reset() cannot fail and it's return value is never checked. Simplify the code and convert it into a void function. Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-9-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown commit e59fe5e0c418da4cf0432faa0fc9062d56bd98b1 Author: Marc Kleine-Budde Date: Thu Mar 19 17:55:42 2026 +0100 spi: spi-fsl-lpspi: fsl_lpspi_can_dma(): directly assign return value to fsl_lpspi->usedma The function fsl_lpspi_can_dma() returns a bool. Simplify the code, remove the if/else and assign the return value of fsl_lpspi_can_dma() directly to fsl_lpspi->usedma. Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-8-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown commit ca431d50bf62cca8f0a502e76b3d75ee371af32c Author: Marc Kleine-Budde Date: Thu Mar 19 17:55:41 2026 +0100 spi: spi-fsl-lpspi: fsl_lpspi_setup_transfer(): remove useless spi_transfer NULL pointer check fsl_lpspi_setup_transfer() is either called via: | fsl_lpspi_prepare_message() | -> fsl_lpspi_setup_transfer() or | -> spi_transfer_one_message() | -> controller->transfer_one == fsl_lpspi_transfer_one() | -> fsl_lpspi_setup_transfer() The first call path already has a spi_transfer NULL pointer check, the second one explicitly iterates over all spi_transfer of the spi_message. Simplify the code by removing the useless NULL pointer check. Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-7-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown commit c6e178460434e6dad2b948f501cc6811a2e6de8f Author: Marc Kleine-Budde Date: Thu Mar 19 17:55:40 2026 +0100 spi: spi-fsl-lpspi: fsl_lpspi_set_cmd(): use FIELD_PREP to encode Transmit Command register Instead of open coding mask and shift operations and to increase readability use FIELD_PREP() to encode the Transmit Command register. Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-6-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown commit 1712be8623b2befe4556da320b3f06a767ca5339 Author: Marc Kleine-Budde Date: Thu Mar 19 17:55:39 2026 +0100 spi: spi-fsl-lpspi: fsl_lpspi_set_cmd(): remove obfuscated and obsolete assignment of TCR_CPOL and SPI_CPHA Commit 7ae4d097b752 ("spi: spi-fsl-lpspi: Handle clock polarity and phase") enhances the driver with clock polarity and phase handling. Among other things that commit in fsl_lpspi_set_cmd() explicitly set the bits TCR_CPOL and TCR_CPHA bits in the TCR register depending on their corresponding bits in the SPI mode (SPI_CPOL and SPI_CPHA), to configure clock polarity and phase. That change made the assignment of the lowest 2 bits of lpspi_config::mode shifted by << 30 to the TCR register obsolete. The lowest 2 bits of struct lpspi_config::mode (= SPI_CPOL and SPI_CPHA) match the corresponding bits in the TCR register (TCR_CPOL and TCR_CPHA) if shifted. Keep the better readable and maintainable version provided in commit 7ae4d097b752 ("spi: spi-fsl-lpspi: Handle clock polarity and phase") and remove the obfuscated version. Cc: Marek Vasut Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-5-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown commit b191fbf446bcabe310d3d9ac759e4a071b74186d Author: Marc Kleine-Budde Date: Thu Mar 19 17:55:38 2026 +0100 spi: spi-fsl-lpspi: fsl_lpspi_set_cmd(): use mode from struct fsl_lpspi_data::config::mode Commit 7ae4d097b752 ("spi: spi-fsl-lpspi: Handle clock polarity and phase") enhances the driver with clock polarity and phase handling. That commit adds a 2nd argument ("struct spi_device *spi") to the fsl_lpspi_set_cmd() function. The "spi" pointer is used to access the "mode" of the current transfer. However the mode is already available via "fsl_lpspi->config.mode". To simplify the driver remove the 2nd argument and use "fsl_lpspi->config.mode" to access the mode. Cc: Marek Vasut Reviewed-by: Marek Vasut Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-4-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown commit 732b903ea3e2e95e11990a698df8e18537aeef19 Author: Marc Kleine-Budde Date: Thu Mar 19 17:55:36 2026 +0100 spi: spi-fsl-lpspi: fsl_lpspi_set_watermark(): use FIELD_PREP() to encode FIFO Control register Instead of open coding mask and shift operations and to increase readability use FIELD_PREP() to encode the FIFO Control register. Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-2-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown commit 8292eded59980eb2be64a22819885ab808f03440 Author: Marc Kleine-Budde Date: Thu Mar 19 17:55:35 2026 +0100 spi: spi-fsl-lpspi: adapt to kernel coding style Adapt the driver to current kernel coding style standards. Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-1-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown commit 354c085299defe9e49b21af77fdc715cc969ed36 Author: Miguel Ojeda Date: Mon Apr 6 11:58:19 2026 +0200 rust: kernel: update `file_with_nul` comment `feature(file_with_nul)` [1] has been stabilized in Rust 1.92.0 [2]. Thus update the comment to keep track of it. In addition, this will help to sort new conditionally enabled features (i.e. `cfg_attr`) around it appropriately. Link: https://github.com/rust-lang/rust/issues/141727 [1] Link: https://github.com/rust-lang/rust/pull/145664 [2] Link: https://patch.msgid.link/20260406095820.465994-1-ojeda@kernel.org Reviewed-by: Alice Ryhl Acked-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Miguel Ojeda commit 322e4116ac8d48255f9599250347f48e56ce8979 Merge: 512f9f150f3671 591cd656a1bf5e Author: Simona Vetter Date: Tue Apr 7 12:27:36 2026 +0200 Merge v7.0-rc7 into drm-next Thomas Zimmermann needs 2f42c1a61616 ("drm/ast: dp501: Fix initialization of SCU2C") for drm-misc-next. Conflicts: - drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c Just between e927b36ae18b ("drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()") and it's cherry-pick that confused git. - drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c Deleted in 6b0a6116286e ("drm/amd/pm: Unify version check in SMUv11") but some cherry-picks confused git. Same for v12/v14. Signed-off-by: Simona Vetter commit 50f1c48b155b74528b0b251b8c4e097fddd5ab46 Author: Chen Jung Ku Date: Sun Apr 5 22:48:03 2026 +0800 gpio: aspeed: fix unsigned long int declaration Replace "unsigned long int" with "unsigned long" to follow Linux kernel coding style. No functional change intended. Signed-off-by: Chen Jung Ku Link: https://patch.msgid.link/20260405144803.31358-1-ku.loong@gapp.nthu.edu.tw Signed-off-by: Bartosz Golaszewski commit c8079f83e0bf312645050c17d9c87deb707369c1 Author: Shawn Lin Date: Mon Mar 30 17:53:21 2026 +0800 gpio: rockchip: convert to dynamic GPIO base allocation This driver is used on device tree based platform. Use dynamic GPIO numberspace base to suppress the warning: gpio gpiochip0: Static allocation of GPIO base is deprecated, use dynamic allocation. gpio gpiochip1: Static allocation of GPIO base is deprecated, use dynamic allocation. gpio gpiochip2: Static allocation of GPIO base is deprecated, use dynamic allocation. gpio gpiochip3: Static allocation of GPIO base is deprecated, use dynamic allocation. gpio gpiochip4: Static allocation of GPIO base is deprecated, use dynamic allocation. Signed-off-by: Shawn Lin Reviewed-by: Linus Walleij Link: https://patch.msgid.link/1774864401-177149-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Bartosz Golaszewski commit dd84f7ce6fd12fb5d6648d6b5d8ea4bf6f834273 Author: Bartosz Golaszewski Date: Fri Mar 27 11:31:14 2026 +0100 gpio: remove dev-sync-probe There are no more users. Remove the dev-sync-probe module. Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260327-gpio-kill-dev-sync-probe-v1-4-efac254f1a1d@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit c3e2a8aef28c48a94c0cf0525ca96aa308bcf961 Author: Bartosz Golaszewski Date: Fri Mar 27 11:31:13 2026 +0100 gpio: virtuser: stop using dev-sync-probe dev-err-probe is an overengineered solution to a simple problem. Use a combination of wait_for_probe() and device_is_bound() to synchronously wait for the platform device to probe. Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260327-gpio-kill-dev-sync-probe-v1-3-efac254f1a1d@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 3a27f40b457053e6112a63d14590e4a3ff553b44 Author: Bartosz Golaszewski Date: Fri Mar 27 11:31:12 2026 +0100 gpio: aggregator: stop using dev-sync-probe dev-err-probe is an overengineered solution to a simple problem. Use a combination of wait_for_probe() and device_is_bound() to synchronously wait for the platform device to probe. Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260327-gpio-kill-dev-sync-probe-v1-2-efac254f1a1d@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 7fb3287946f937a32adad35c9bec4bbc71e25bb8 Author: Bartosz Golaszewski Date: Fri Mar 27 11:31:11 2026 +0100 gpio: sim: stop using dev-sync-probe dev-err-probe is an overengineered solution to a simple problem. Use a combination of wait_for_probe() and device_is_bound() to synchronously wait for the platform device to probe. Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260327-gpio-kill-dev-sync-probe-v1-1-efac254f1a1d@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 97b67e64affb0e709eeecc50f6a9222fc20bd14b Author: Aleksa Sarai Date: Wed Apr 1 01:46:21 2026 +1100 dcache: permit dynamic_dname()s up to NAME_MAX dynamic_dname() has had an implicit limit of 64 characters since it was introduced in commit c23fbb6bcb3e ("VFS: delay the dentry name generation on sockets and pipes"), however it seems that this was a fairly arbitrary number (suspiciously it was double the previously hardcoded buffer size). NAME_MAX seems like a more reasonable and consistent limit for d_name lengths. While we're at it, we can also remove the unnecessary stack-allocated array and just memmove() the formatted string to the end of the buffer. It should also be noted that at least one driver (in particular, liveupdate's usage of anon_inode for session files) already exceeded this limit without noticing that readlink(/proc/self/fd/$n) always returns -ENAMETOOLONG, so this fixes those drivers as well. Fixes: 0153094d03df ("liveupdate: luo_session: add sessions support") Fixes: c23fbb6bcb3e ("VFS: delay the dentry name generation on sockets and pipes") Signed-off-by: Aleksa Sarai Link: https://patch.msgid.link/20260401-dynamic-dname-name_max-v1-1-8ca20ab2642e@amutable.com Tested-by: Luca Boccassi Signed-off-by: Christian Brauner commit 15cbd66b69a9ecdc5c3638aa400ca9b872b84509 Author: Alan Borzeszkowski Date: Wed Apr 1 19:45:26 2026 +0200 gpio: Add Intel Nova Lake ACPI GPIO events driver This driver provides support for new way of handling platform events, through the use of GPIO-signaled ACPI events. This mechanism is used on Intel client platforms released in 2026 and later, starting with Intel Nova Lake. Signed-off-by: Alan Borzeszkowski Reviewed-by: Mika Westerberg Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260401174526.60881-1-alan.borzeszkowski@linux.intel.com Signed-off-by: Bartosz Golaszewski commit 955165c3e537668b9a5a6eb26397281b88143002 Author: Rafael J. Wysocki Date: Tue Mar 24 21:08:01 2026 +0100 platform/x86: thinkpad_acpi: Drop ACPI driver registration There is no point in registering an ACPI driver that only has an empty .add() callback, which is done by the thinkpad_acpi driver, since after binding to an ACPI device it only sits there and does nothing. That binding only effectively causes the ACPI device's reference count to increase, but that can be achieved by using acpi_get_acpi_dev() instead of acpi_fetch_acpi_dev() in setup_acpi_notify(), and doing the corresponding cleanup in ibm_exit(). Update the code accordingly and get rid of the non-functional ACPI driver. No intentional functional impact beyond altering sysfs content. Signed-off-by: Rafael J. Wysocki Tested-by: Mark Pearson Reviewed-by: Mark Pearson Link: https://patch.msgid.link/3949487.kQq0lBPeGt@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dfecb0c5af3b07ebfa84be63a7a21bfc9e29a872 Author: Qingfang Deng Date: Fri Apr 3 11:48:47 2026 +0800 selftests: net: add tests for PPP Add ping and iperf3 tests for ppp_async.c and pppoe.c. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260403034908.30017-1-qingfang.deng@linux.dev Signed-off-by: Paolo Abeni commit e85c8a185f6ea3f48506fd7fed7a03f34dd11845 Merge: f7e648027d7e1b ee69d9e32bdb00 Author: Ilpo Järvinen Date: Tue Apr 7 12:57:59 2026 +0300 Merge branch 'intel-sst' of https://github.com/spandruvada/linux-kernel into review-ilpo-next commit 83210251fd70d5f96bcdc8911e15f7411a6b2463 Author: Sebastian Ene Date: Thu Apr 2 11:39:39 2026 +0000 firmware: arm_ffa: Use the correct buffer size during RXTX_MAP Don't use the discovered buffer size from an FFA_FEATURES call directly since we can run on a system that has the PAGE_SIZE larger than the returned size which makes the alloc_pages_exact for the buffer to be rounded up. Fixes: 61824feae5c0 ("firmware: arm_ffa: Fetch the Rx/Tx buffer size using ffa_features()") Signed-off-by: Sebastian Ene Link: https://patch.msgid.link/20260402113939.930221-1-sebastianene@google.com Signed-off-by: Sudeep Holla commit f7e648027d7e1b5c06eb86d944b7e23926254cee Author: Rafael J. Wysocki Date: Sat Feb 28 16:12:48 2026 +0100 platform/x86: asus-wireless: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Asus wireless ACPI driver to a platform one. After this change, the subordinate input and LED devices will be registered under the platform device used for driver binding instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Denis Benato Link: https://patch.msgid.link/13959361.uLZWGnKmhe@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4f52c97292587c0ad21f3bc78cb2345f7dfc6c89 Author: Rafael J. Wysocki Date: Sat Feb 28 16:12:02 2026 +0100 platform/x86: asus-wireless: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Denis Benato Link: https://patch.msgid.link/1949745.tdWV9SEqCh@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ba19eb10170b50cd613aa18cfb0e1b4693db7edf Author: Rafael J. Wysocki Date: Sat Feb 28 16:11:10 2026 +0100 platform/x86: asus-laptop: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Asus laptop ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Denis Benato Link: https://patch.msgid.link/2402539.ElGaqSPkdT@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 378500dc1313e2c06a2f675bb00ab5d7880433ba Author: Rafael J. Wysocki Date: Sat Feb 28 16:10:21 2026 +0100 platform/x86: asus-laptop: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Denis Benato Link: https://patch.msgid.link/5082508.31r3eYUQgx@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 14f0a13ec79dfa63e143ea45e6530d80bec6e291 Author: Hyunchul Lee Date: Tue Mar 17 14:13:44 2026 +0900 ntfs: remove redundant out-of-bound checks Remove redundant out-of-bounds validations. Since ntfs_attr_find and ntfs_external_attr_find now validate the attribute value offsets and lengths against the bounds of the MFT record block, performing subsequent bounds checking in caller functions like ntfs_attr_lookup is no longer necessary. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit a198a0c4b898f7c62f240a5b6baef93e456fb033 Author: Hyunchul Lee Date: Mon Mar 16 13:28:34 2026 +0900 ntfs: add bound checking to ntfs_external_attr_find Add bound validation in ntfs_external_attr_find to prevent out-of-bounds memory accesses. This ensures that the attribute record's length, name offset, and both resident and non-resident value offsets strictly fall within the safe boundaries of the MFT record. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 6ceb4cc81ef3409ff79dcb959771f9110787397a Author: Hyunchul Lee Date: Thu Mar 12 10:23:46 2026 +0900 ntfs: add bound checking to ntfs_attr_find Add bound validations in ntfs_attr_find to ensure attribute value offsets and lengths are safe to access. It verifies that resident attributes meet type-specific minimum length requirements and check the mapping_pairs_offset boundaries for non-resident attributes. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 7648112358a4207916d3e38bfee49f85552fe95f Author: Inochi Amaoto Date: Wed Apr 1 08:35:50 2026 +0800 pinctrl: sophgo: pinctrl-sg2044: Fix wrong module description Fix the SoC model in module description string, it should be sg2044 instead of sg2002. Fixes: 614a54cb5ac3 ("pinctrl: sophgo: add support for SG2044 SoC") Signed-off-by: Inochi Amaoto Reviewed-by: Chen Wang Signed-off-by: Linus Walleij commit ca1c2ddff00480c213903a1479b56203536e92de Author: Inochi Amaoto Date: Wed Apr 1 08:35:49 2026 +0800 pinctrl: sophgo: pinctrl-sg2042: Fix wrong module description Fix the SoC model in module description string, it should be sg2042 instead of sg2002. Fixes: 1e67465d3b74 ("pinctrl: sophgo: add support for SG2042 SoC") Signed-off-by: Inochi Amaoto Reviewed-by: Chen Wang Signed-off-by: Linus Walleij commit 4639f1cfba03e77e4fa2062cf904de63021fb746 Author: Chelsy Ratnawat Date: Fri Apr 3 02:27:09 2026 -0700 fs: attr: fix comment formatting and spelling issues Fix minor comment issues in fs/attr.c reported by checkpatch: - Wrap long comment lines to comply with the 75-character limit - Correct spelling of “overriden” to “overridden” No functional changes. Signed-off-by: Chelsy Ratnawat Link: https://patch.msgid.link/20260403092709.83458-1-chelsyratnawat2001@gmail.com Signed-off-by: Christian Brauner commit 92af129b4085cd561b59bfa1596653844cb82e4c Author: Harry Yoo (Oracle) Date: Mon Apr 6 18:09:07 2026 +0900 lib/tests/slub_kunit: add a test case for {kmalloc,kfree}_nolock Testing invocation of {kmalloc,kfree}_nolock() during kmalloc() or kfree() is tricky, and it is even harder to ensure that slowpaths are properly tested. Lack of such testing has led to late discovery of the bug fixed by commit a1e244a9f177 ("mm/slab: use prandom if !allow_spin"). Add a slub_kunit test that allocates and frees objects in a tight loop while a perf event triggers interrupts (NMI or hardirq depending on the arch) on the same task, invoking {kmalloc,kfree}_nolock() from the overflow handler. Acked-by: David Rientjes Signed-off-by: Harry Yoo (Oracle) Link: https://patch.msgid.link/20260406090907.11710-3-harry@kernel.org Signed-off-by: Vlastimil Babka (SUSE) commit 7711207dcb9b7b74270ea0fb21daf91e4291f21d Author: Harry Yoo (Oracle) Date: Mon Apr 6 18:09:06 2026 +0900 MAINTAINERS: add lib/tests/slub_kunit.c to SLAB ALLOCATOR section The slub_kunit module has been maintained by SLAB ALLOCATOR folks, but is missing in the MAINTAINERS file. Add the missing entry. Acked-by: David Rientjes Signed-off-by: Harry Yoo (Oracle) Acked-by: SeongJae Park Link: https://patch.msgid.link/20260406090907.11710-2-harry@kernel.org Signed-off-by: Vlastimil Babka (SUSE) commit 1fac04a0a4737c4da3d55d7708931166a4a7136a Author: Brian Masney Date: Fri Apr 3 17:12:17 2026 -0400 irqchip/irq-pic32-evic: Add __maybe_unused for board_bind_eic_interrupt in COMPILE_TEST There are a few ifdefs in this driver so that it can be compiled on all architectures when COMPILE_TEST is set. board_bind_eic_interrupt is defined in arch/mips/ for normal usage, however when this driver is compiled with COMPILE_TEST on other architectures, it is defined as a static variable inside this driver. This causes the following warning: drivers/irqchip/irq-pic32-evic.c:54:15: warning: variable 'board_bind_eic_interrupt' set but not used [-Wunused-but-set-global] 54 | static void (*board_bind_eic_interrupt)(int irq, int regset); | ^ Annotate the static variable with __maybe_unused to avoid having to put even more ifdefs into this driver. Fixes: 282f8b547d51d ("irqchip/irq-pic32-evic: Define board_bind_eic_interrupt for !MIPS builds") Reported-by: kernel test robot Signed-off-by: Brian Masney Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260403-irq-pic32-evic-unused-v1-1-447cdc0675ec@redhat.com Closes: https://lore.kernel.org/oe-kbuild-all/202603300715.4HuMMAFb-lkp@intel.com/ commit 669d2067e3d095d525c69e675d8b9c738e3616c6 Author: Geert Uytterhoeven Date: Fri Apr 3 10:48:23 2026 +0200 irqchip/renesas-rzv2h: Kill icu_err string Replace the string variable icu_err by its expanded value where needed, to improve readability. This reduces generated code size by 16 bytes. Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/c7472bec20dea2c4d63e390e8e293b7d7003ef39.1775205874.git.geert+renesas@glider.be commit 8c7ffedff0db88837de11cfaf3e5367e0b77bc4c Author: Geert Uytterhoeven Date: Fri Apr 3 10:48:22 2026 +0200 irqchip/renesas-rzv2h: Kill swint_names[] The array swint_names[] just contains expansions of "int-ca55-%u". Replace it by formatting the strings where needed, to improve readability. Despite the two error messages can no longer be shared with the ICU error cases, this reduces generated code size by 56 bytes. Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Gleixner Reviewed-by: Biju Das Link: https://patch.msgid.link/aceab3fbc307ef428dfd62d8d846b68704dea012.1775205874.git.geert+renesas@glider.be commit fc4c926ccd34d4ee75669991693b47a9b8645a6c Author: Geert Uytterhoeven Date: Fri Apr 3 10:48:21 2026 +0200 irqchip/renesas-rzv2h: Kill swint_idx[] The array swint_idx[] just contains an identity mapping. Replace it by using the index directly, to simplify the code. Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Gleixner Reviewed-by: Biju Das Link: https://patch.msgid.link/0f32ba2a4701311710d02ff4fa2fd472b56745c4.1775205874.git.geert+renesas@glider.be commit 7f9bb84fdb5ee7621fcd6519cd14d3dc9aa75c5c Author: Hao Li Date: Fri Apr 3 15:37:36 2026 +0800 slub: use N_NORMAL_MEMORY in can_free_to_pcs to handle remote frees Memory hotplug now keeps N_NORMAL_MEMORY up to date correctly, so make can_free_to_pcs() use it. As a result, when freeing objects on memoryless nodes, or on nodes that have memory but only in ZONE_MOVABLE, the objects can be freed to the sheaf instead of going through the slow path. Signed-off-by: Hao Li Acked-by: Harry Yoo (Oracle) Acked-by: David Rientjes Link: https://patch.msgid.link/20260403073958.8722-1-hao.li@linux.dev Signed-off-by: Vlastimil Babka (SUSE) commit 05d42dc8ab92aa54aaeb1c033927c88fd2accba4 Author: Eric Biggers Date: Sat Apr 4 18:15:13 2026 -0700 xfrm: Drop support for HMAC-RIPEMD-160 Drop support for HMAC-RIPEMD-160 from IPsec to reduce the UAPI surface and simplify future maintenance. It's almost certainly unused. RIPEMD-160 received some attention in the early 2000s when SHA-* weren't quite as well established. But it never received much adoption outside of certain niches such as Bitcoin. It's actually unclear that Linux + IPsec + HMAC-RIPEMD-160 has *ever* been used, even historically. When support for it was added in 2003, it was done so in a "cleanup" commit without any justification [1]. It didn't actually work until someone happened to fix it 5 years later [2]. That person didn't use or test it either [3]. Finally, also note that "hmac(rmd160)" is by far the slowest of the algorithms in aalg_list[]. Of course, today IPsec is usually used with an AEAD, such as AES-GCM. But even for IPsec users still using a dedicated auth algorithm, they almost certainly aren't using, and shouldn't use, HMAC-RIPEMD-160. Thus, let's just drop support for it. Note: no kconfig update is needed, since CRYPTO_RMD160 wasn't actually being selected anyway. References: [1] linux-history commit d462985fc1941a47 ("[IPSEC]: Clean up key manager algorithm handling.") [2] linux commit a13366c632132bb9 ("xfrm: xfrm_algo: correct usage of RIPEMD-160") [3] https://lore.kernel.org/all/1212340578-15574-1-git-send-email-rueegsegger@swiss-it.ch Signed-off-by: Eric Biggers Signed-off-by: Steffen Klassert commit 7ab26eb5a2b4009344580117ef05981867e0c7d7 Merge: 36f5a2b09e650b 2e2f8b5a065683 Author: Miguel Ojeda Date: Tue Apr 7 10:40:11 2026 +0200 Merge patch series "rust: bump minimum Rust and `bindgen` versions" As proposed in the past in e.g. LPC 2025 and the Maintainers Summit [1], we are going to follow Debian Stable's Rust versions as our minimum supported version. Debian Trixie was released with a Rust 1.85.0 toolchain [2], which it still uses to this day [3] (i.e. no update to Rust 1.85.1). Debian Trixie was released with `bindgen` 0.71.1, which it also still uses to this day [4]. Debian Trixie's release happened on 2025-08-09 [5], which means that a fair amount of time has passed since its release for kernel developers to upgrade. Thus bump the minimum to the new versions, i.e. - Rust: 1.78.0 -> 1.85.0 - bindgen: 0.65.1 -> 0.71.1 There are a few main parts to the series, in this order: - A few cleanups that can be performed before the bumps. - The Rust bump (and its cleanups). - The `bindgen` bump (and its cleanups). - Documentation updates. - The `cfi_encoding` patch, added here, which needs the bump. - The per-version flags support and a Clippy cleanup on top. Link: https://lwn.net/Articles/1050174/ [1] Link: https://www.debian.org/releases/trixie/release-notes/whats-new.en.html#desktops-and-well-known-packages [2] Link: https://packages.debian.org/trixie/rustc [3] Link: https://packages.debian.org/trixie/bindgen [4] Link: https://www.debian.org/releases/trixie/ [5] Link: https://patch.msgid.link/20260405235309.418950-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 0990a71f678aa0f045f2c126b39b6b581844d3b0 Merge: 8aeea2311a5f10 0436cd305d0be2 Author: Greg Kroah-Hartman Date: Tue Apr 7 10:06:50 2026 +0200 Merge tag 'icc-7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: This pull request contains the interconnect changes for the 7.1-rc1 merge window. They are listed below: - New driver for Mahua SoC - New driver for Eliza SoC - Enable QoS support for QCS8300 and QCS615 SoCs - Add L3 cache scaling compatibles for SM8550 and Eliza SoCs - Fix multiple issues in the msm8974 driver - Fix kfree mismatch - Misc cleanups - Add maintainer entry for the interconnect KUnit tests Signed-off-by: Georgi Djakov * tag 'icc-7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: (22 commits) MAINTAINERS: Add interconnect kunit test entry interconnect: debugfs: fix devm_kstrdup and kfree mismatch interconnect: qcom: msm8974: expand DEFINE_QNODE macros interconnect: qcom: msm8974: switch to the main icc-rpm driver interconnect: qcom: let platforms declare their bugginess interconnect: qcom: define OCMEM bus resource interconnect: qcom: icc-rpm: allow overwriting get_bw callback interconnect: qcom: drop unused is_on flag dt-bindings: interconnect: qcom,msm8974: use qcom,rpm-common dt-bindings: interconnect: qcom,msm8974: drop bus clocks interconnect: qcom: qcs615: enable QoS configuration dt-bindings: interconnect: qcom,qcs615-rpmh: add clocks property to enable QoS interconnect: qcom: Add Eliza interconnect provider driver dt-bindings: interconnect: document the RPMh Network-On-Chip interconnect in Eliza SoC dt-bindings: interconnect: OSM L3: Add Eliza EPSS L3 compatible interconnect: qcom: De-acronymize SoC names dt-bindings: interconnect: qcom,glymur-rpmh: De-acronymize SoC name dt-bindings: interconnect: OSM L3: Document sm8550 OSM L3 compatible interconnect: qcom: qcs8300: enable QoS configuration dt-bindings: interconnect: qcom,qcs8300-rpmh: add clocks property to enable QoS ... commit 8aeea2311a5f10451968a0707f23e554a29a6737 Merge: a0a316f7683988 1bf0ba46d9d2c7 Author: Greg Kroah-Hartman Date: Tue Apr 7 10:03:56 2026 +0200 Merge tag 'extcon-next-for-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon into char-misc-next Chanwoo writes: Update extcon next for v7.1 Detailed description for this pull request: - Fix sysfs duplicate filename issue on extcon core : Adjust ida_free timing after device_unregister to prevent duplicate filename error when re-allocating id - Update NXP PTN5150 extcon driver and dt-binding document : Handle pending IRQ events during system resume : Allow "connector" node to present in devicetree : Add Type-C orientation switch support to correctly set orientation of multiplexer according to CC status : Support USB role switch via connector fwnode - Replace use of system_wq with system_percpu_wq on int3496 driver - Make typec-power-opmode optional on usbc-tusb320 driver : Prevent probe error when usb-c connector is configured in the DT without "typec-power-opmode" property * tag 'extcon-next-for-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon: extcon: usbc-tusb320: Make typec-power-opmode optional extcon: ptn5150: Support USB role switch via connector fwnode extcon: ptn5150: Add Type-C orientation switch support dt-bindings: extcon: ptn5150: Allow "connector" node to present extcon: Fixed sysfs duplicate filename issue extcon: int3496: replace use of system_wq with system_percpu_wq extcon: ptn5150: handle pending IRQ events during system resume commit 2e2f8b5a065683f4530ee71363875da1a20f5a7f Author: Miguel Ojeda Date: Mon Apr 6 01:53:09 2026 +0200 rust: kbuild: allow `clippy::precedence` for Rust < 1.86.0 The Clippy `precedence` lint was extended in Rust 1.85.0 to include bitmasking and shift operations [1]. However, because it generated many hits, in Rust 1.86.0 it was split into a new `precedence_bits` lint which is not enabled by default [2]. In other words, only Rust 1.85 has a different behavior. For instance, it reports: warning: operator precedence can trip the unwary --> drivers/gpu/nova-core/fb/hal/ga100.rs:16:5 | 16 | / u64::from(regs::NV_PFB_NISO_FLUSH_SYSMEM_ADDR::read(bar).adr_39_08()) << FLUSH_SYSMEM_ADDR_SHIFT 17 | | | u64::from(regs::NV_PFB_NISO_FLUSH_SYSMEM_ADDR_HI::read(bar).adr_63_40()) 18 | | << FLUSH_SYSMEM_ADDR_SHIFT_HI | |_________________________________________^ | = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#precedence = note: `-W clippy::precedence` implied by `-W clippy::all` = help: to override `-W clippy::all` add `#[allow(clippy::precedence)]` help: consider parenthesizing your expression | 16 ~ (u64::from(regs::NV_PFB_NISO_FLUSH_SYSMEM_ADDR::read(bar).adr_39_08()) << FLUSH_SYSMEM_ADDR_SHIFT) | (u64::from(regs::NV_PFB_NISO_FLUSH_SYSMEM_ADDR_HI::read(bar).adr_63_40()) 17 + << FLUSH_SYSMEM_ADDR_SHIFT_HI) | While so far we try our best to keep all versions Clippy-clean, the minimum (which is now Rust 1.85.0 after the bump) and the latest stable are the most important ones; and this may be considered a "false positive" with respect to the behavior in other versions. Thus allow this lint for this version using the per-version flags mechanism introduced in the previous commit. Link: https://github.com/rust-lang/rust-clippy/issues/14097 [1] Link: https://github.com/rust-lang/rust-clippy/pull/14115 [2] Link: https://lore.kernel.org/rust-for-linux/DFVDKMMA7KPC.2DN0951H3H55Y@kernel.org/ Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-34-ojeda@kernel.org [ Added paragraph from commit message to comment. - Miguel ] Signed-off-by: Miguel Ojeda commit b2aa1535ecdd10514daabe5e8eb7cea49aa5b5ec Author: Miguel Ojeda Date: Mon Apr 6 01:53:08 2026 +0200 rust: kbuild: support global per-version flags Sometimes it is useful to gate global Rust flags per compiler version. For instance, we may want to disable a lint that has false positives in a single version [1]. We already had helpers like `rustc-min-version` for that, which we use elsewhere, but we cannot currently use them for `rust_common_flags`, which contains the global flags for all Rust code (kernel and host), because `rustc-min-version` depends on `CONFIG_RUSTC_VERSION`, which does not exist when `rust_common_flags` is defined. Thus, to support that, introduce `rust_common_flags_per_version`, defined after the `include/config/auto.conf` inclusion (where `CONFIG_RUSTC_VERSION` becomes available), and append it to `rust_common_flags`, `KBUILD_HOSTRUSTFLAGS` and `KBUILD_RUSTFLAGS`. In addition, move the expansion of `HOSTRUSTFLAGS` to the same place, so that users can also override per-version flags [2]. Link: https://lore.kernel.org/rust-for-linux/CANiq72mWdFU11GcCZRchzhy0Gi1QZShvZtyRkHV2O+WA2uTdVQ@mail.gmail.com/ [1] Link: https://lore.kernel.org/rust-for-linux/CANiq72mTaA2tjhkLKf0-2hrrrt9rxWPgy6SfNSbponbGOegQvA@mail.gmail.com/ [2] Link: https://patch.msgid.link/20260307170929.153892-1-ojeda@kernel.org Link: https://patch.msgid.link/20260405235309.418950-33-ojeda@kernel.org Reviewed-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 9e5946de3a3876113098dc272873802baff022cc Author: Alice Ryhl Date: Mon Apr 6 01:53:07 2026 +0200 rust: declare cfi_encoding for lru_status By default bindgen will convert 'enum lru_status' into a typedef for an integer. For the most part, an integer of the same size as the enum results in the correct ABI, but in the specific case of CFI, that is not the case. The CFI encoding is supposed to be the same as a struct called 'lru_status' rather than the name of the underlying native integer type. To fix this, tell bindgen to generate a newtype and set the CFI type explicitly. Note that we need to set the CFI attribute explicitly as bindgen is using repr(transparent), which is otherwise identical to the inner type for ABI purposes. This allows us to remove the page range helper C function in Binder without risking a CFI failure when list_lru_walk calls the provided function pointer. The --with-attribute-custom-enum argument requires bindgen v0.71 or greater. [ In particular, the feature was added in 0.71.0 [1][2]. In addition, `feature(cfi_encoding)` has been available since Rust 1.71.0 [3]. Link: https://github.com/rust-lang/rust-bindgen/issues/2520 [1] Link: https://github.com/rust-lang/rust-bindgen/pull/2866 [2] Link: https://github.com/rust-lang/rust/pull/105452 [3] - Miguel ] My testing procedure was to add this to the android17-6.18 branch and verify that rust_shrink_free_page is successfully called without crash, and verify that it does in fact crash when the cfi_encoding is set to other values. Note that I couldn't test this on android16-6.12 as that branch uses a bindgen version that is too old. Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260223-cfi-lru-status-v2-1-89c6448a63a4@google.com [ Rebased on top of the minimum Rust version bump series which provide the required `bindgen` version. - Miguel ] Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-32-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 86c5d1c6740cd3e67c275d3590ad96009170320c Author: Miguel Ojeda Date: Mon Apr 6 01:53:06 2026 +0200 docs: rust: general-information: use real example Currently the example in the documentation shows a version-based name for the Kconfig example: RUSTC_VERSION_MIN_107900 The reason behind it was to possibly avoid repetition in case several features used the same minimum. However, we ended up preferring to give them a descriptive name for each feature added even if that could lead to some repetition. In practice, the repetition has not happened so far, and even if it does at some point, it is not a big deal. Thus replace the example in the documentation with one of our current examples (after removing previous ones from the bump), to show how they actually look like, and in case someone `grep`s for it. In addition, it has the advantage that it shows the `RUSTC_HAS_*` pattern we follow in `init/Kconfig`, similar to the C side. Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-31-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 9375ea727d7e5c0459c2423d2afccad78cc72187 Author: Miguel Ojeda Date: Mon Apr 6 01:53:05 2026 +0200 docs: rust: general-information: simplify Kconfig example There is no need to use `def_bool y if ` -- one can simply write `def_bool `. In fact, the simpler form is how we actually use them in practice in `init/Kconfig`. Thus simplify the example. Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-30-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit a4392ed1c8b985e0a3dbad2739445e52c1c5543c Author: Miguel Ojeda Date: Mon Apr 6 01:53:04 2026 +0200 docs: rust: quick-start: remove GDB/Binutils mention The versions provided nowadays by even a distribution like Debian Stable (and Debian Old Stable) are newer than those mentioned [1]. Thus remove the workaround. Note that the minimum binutils version in the kernel is still 2.30, so one could argue part of the note is still relevant, but it is unlikely a kernel developer using such an old binutils is enabling Rust on a modern kernel, especially when using distribution toolchains, e.g. the Rust minimum version is not satisfied by Debian Old Stable. So we are at the point where keeping the docs short and relevant for essentially everyone is probably the better trade-off. Link: https://packages.debian.org/search?suite=all&searchon=names&keywords=binutils [1] Link: https://lore.kernel.org/all/CANiq72mCpc9=2TN_zC4NeDMpFQtPXAFvyiP+gRApg2vzspPWmw@mail.gmail.com/ Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-29-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit b69a14650009266c53c4ce81ab5c0efb6ca4c07d Author: Miguel Ojeda Date: Mon Apr 6 01:53:03 2026 +0200 docs: rust: quick-start: remove Nix "unstable channel" note Nix does not need the "unstable channel" note, since its packages are recent enough even in the stable channel [1][2]. Thus remove it to simplify the documentation. Link: https://search.nixos.org/packages?channel=25.11&query=rust [1] Link: https://search.nixos.org/packages?channel=25.11&query=bindgen [2] Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-28-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 99c672426aedd7735508f0dfb26342bf5125a633 Author: Miguel Ojeda Date: Mon Apr 6 01:53:02 2026 +0200 docs: rust: quick-start: remove Gentoo "testing" note Gentoo does not need the "testing" note, since its packages are recent enough even in the stable branch [1][2]. Thus remove it to simplify the documentation. Link: https://packages.gentoo.org/packages/dev-lang/rust [1] Link: https://packages.gentoo.org/packages/dev-util/bindgen [2] Reviewed-by: Tamir Duberstein Link: https://patch.msgid.link/20260405235309.418950-27-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 780f847e141945c40de7bba1ddc17dbac04739d6 Author: Miguel Ojeda Date: Mon Apr 6 01:53:01 2026 +0200 docs: rust: quick-start: add Ubuntu 26.04 LTS and remove subsection title Ubuntu 26.04 LTS (Resolute Raccoon) is scheduled to be released in a few weeks [1], and it has a recent enough Rust toolchain, just like Ubuntu 25.10 has [2][3]. We could update the title and the paragraph, but to simplify and to make it more consistent with the other distributions' sections, let's instead just remove that title. It will also reduce the differences later on to keep it updated. Eventually, when we remove the remaining subsection for older LTSs, Ubuntu should be a small section like the other distributions. Thus remove the title and add the mention of Ubuntu 26.04 LTS. Link: https://documentation.ubuntu.com/release-notes/26.04/schedule/#resolute-raccoon-schedule [1] Link: https://packages.ubuntu.com/search?keywords=rustc&searchon=names&exact=1&suite=all§ion=all [2] Link: https://packages.ubuntu.com/search?keywords=bindgen&searchon=names&exact=1&suite=all§ion=all [3] Reviewed-by: Tamir Duberstein Link: https://patch.msgid.link/20260405235309.418950-26-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 6767147cb9418c512c947562f8d5dd4536496d81 Author: Miguel Ojeda Date: Mon Apr 6 01:53:00 2026 +0200 docs: rust: quick-start: update minimum Ubuntu version Ubuntu 25.04 is out of support [1], and Ubuntu 25.10 is the latest supported one. Moreover, Ubuntu 25.10 is the first that provides a recent enough Rust given the minimum bump -- they provide 1.85.1 [2]. Thus update it. Link: https://ubuntu.com/about/release-cycle [1] Link: https://packages.ubuntu.com/search?keywords=rustc&searchon=names&exact=1&suite=all§ion=all [2] Reviewed-by: Tamir Duberstein Link: https://patch.msgid.link/20260405235309.418950-25-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 982e1aa6de73c22a7b4961a81ba5d6a48404428e Author: Miguel Ojeda Date: Mon Apr 6 01:52:59 2026 +0200 docs: rust: quick-start: update Ubuntu versioned packages Now that the minimum supported Rust version is bumped, bump the versioned Rust packages [1][2][3][4] to that version for Ubuntu in the Quick Start guide. In addition, add "may" to the `RUST_LIB_SRC` line since it does not look like it is needed from a quick test in a Ubuntu 24.04 LTS container. Link: https://packages.ubuntu.com/search?suite=all&searchon=names&keywords=rustc [1] Link: https://packages.ubuntu.com/search?suite=all&searchon=names&keywords=bindgen [2] Link: https://launchpad.net/ubuntu/+source/rustc-1.85 [3] Link: https://launchpad.net/ubuntu/+source/rust-bindgen-0.71 [4] Reviewed-by: Tamir Duberstein Link: https://patch.msgid.link/20260405235309.418950-24-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 53c9647c0a488d839622aefa4bfaeacea3bc116f Author: Miguel Ojeda Date: Mon Apr 6 01:52:58 2026 +0200 docs: rust: quick-start: openSUSE provides `rust-src` package nowadays Both openSUSE Tumbleweed and Slowroll provide the `rust-src` package nowadays [1]. Thus remove the version-specific one from the Quick Start guide. Link: https://software.opensuse.org/package/rust-src?search_term=rust-src [1] Reviewed-by: Tamir Duberstein Link: https://patch.msgid.link/20260405235309.418950-23-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 93553d9922b07555344095b5d9202a3f5b84541c Author: Miguel Ojeda Date: Mon Apr 6 01:52:57 2026 +0200 rust: kbuild: remove "dummy parameter" workaround for `bindgen` < 0.71.1 Until the version bump of `bindgen`, we needed to pass a dummy parameter to avoid failing the `--version` call. Thus remove it. Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-22-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 276ed30c558ef890ebcf8b28d9979ac16be30d4c Author: Miguel Ojeda Date: Mon Apr 6 01:52:56 2026 +0200 rust: kbuild: update `bindgen --rust-target` version and replace comment As the comment in the `Makefile` explains, previously, we needed to limit ourselves to the list of Rust versions known by `bindgen` for its `--rust-target` option [1]. In other words, we needed to consult the versions known by the minimum version of `bindgen` that we supported. Now that we bumped the minimum version of `bindgen`, that limitation does not apply anymore since `bindgen` 0.71.0 [2]. Thus replace the comment and simply write our minimum supported Rust version there, which is much simpler. See commit 7a5f93ea5862 ("rust: kbuild: set `bindgen`'s Rust target version") for more details. Link: https://rust-lang.zulipchat.com/#narrow/channel/425075-rust-for-linux/topic/rust.20version.20on.20generated.20bindings/near/484087179 [1] Link: https://github.com/rust-lang/rust-bindgen/pull/2993 [2] Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-21-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit ae64324ad5c1fdefe479d77ecee975bc6b37467b Author: Miguel Ojeda Date: Mon Apr 6 01:52:55 2026 +0200 rust: rust_is_available: remove warning for `bindgen` < 0.69.5 && libclang >= 19.1 It is not possible anymore to fall into the issue that this warning was alerting about given the `bindgen` version bump. Thus simplify by removing the machinery behind it, including tests. Reviewed-by: Tamir Duberstein Link: https://patch.msgid.link/20260405235309.418950-20-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 41cfbb4295cf9fcdffa6c89ddc84dca2fa392c98 Author: Miguel Ojeda Date: Mon Apr 6 01:52:54 2026 +0200 rust: rust_is_available: remove warning for `bindgen` 0.66.[01] It is not possible anymore to fall into the issue that this warning was alerting about given the `bindgen` version bump. Thus simplify by removing the machinery behind it, including tests. Reviewed-by: Tamir Duberstein Link: https://patch.msgid.link/20260405235309.418950-19-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit c3a00a3f31fffc7adcd81b66de3fb2c2f0b11558 Author: Miguel Ojeda Date: Mon Apr 6 01:52:53 2026 +0200 rust: bump `bindgen` minimum supported version to 0.71.1 (Debian Trixie) As proposed in the past in e.g. LPC 2025 and the Maintainers Summit [1], we are going to follow Debian Stable's `bindgen` versions as our minimum supported version. Debian Trixie was released with `bindgen` 0.71.1, which it still uses to this day [2]. Debian Trixie's release happened on 2025-08-09 [3], which means that a fair amount of time has passed since its release for kernel developers to upgrade. Thus bump the minimum to the new version. Then, in later commits, clean up most of the workarounds and other bits that this upgrade of the minimum allows us. Ubuntu 25.10 also has a recent enough `bindgen` [4] (even the already unsupported Ubuntu 25.04 had it), and they also provide versioned packages with `bindgen` 0.71.1 back to Ubuntu 24.04 LTS [5]. Link: https://lwn.net/Articles/1050174/ [1] Link: https://packages.debian.org/trixie/bindgen [2] Link: https://www.debian.org/releases/trixie/ [3] Link: https://packages.ubuntu.com/search?suite=all&searchon=names&keywords=bindgen [4] Link: https://launchpad.net/ubuntu/+source/rust-bindgen-0.71 [5] Acked-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-18-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 961b72d45ae46ab7b11e7aaabbb2cb130301eeef Author: Miguel Ojeda Date: Mon Apr 6 01:52:52 2026 +0200 rust: block: update `const_refs_to_static` MSRV TODO comment `feature(const_refs_to_static)` was stabilized in Rust 1.83.0 [1]. Thus update the comment to reflect that. Link: https://github.com/rust-lang/rust/pull/129759 [1] Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-17-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 42ec980024f03bad6fd97d65c22f6cf32fb08c58 Author: Miguel Ojeda Date: Mon Apr 6 01:52:51 2026 +0200 rust: macros: simplify code using `feature(extract_if)` `feature(extract_if)` [1] was stabilized in Rust 1.87.0 [2], and the last significant change happened in Rust 1.85.0 [3] when the range parameter was added. That is, with our new minimum version, we can start using the feature. Thus simplify the code using the feature and remove the TODO comment. Suggested-by: Gary Guo Link: https://lore.kernel.org/rust-for-linux/DHHVSX66206Y.3E7I9QUNTCJ8I@garyguo.net/ Link: https://github.com/rust-lang/rust/issues/43244 [1] Link: https://github.com/rust-lang/rust/pull/137109 [2] Link: https://github.com/rust-lang/rust/pull/133265 [3] Link: https://patch.msgid.link/20260405235309.418950-16-ojeda@kernel.org Reviewed-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 161dd7b51e9699a5d1bb2cb24a7eaca23e0facad Author: Miguel Ojeda Date: Mon Apr 6 01:52:50 2026 +0200 rust: alloc: simplify with `NonNull::add()` now that it is stable Currently, we need to go through raw pointers and then re-create the `NonNull` from the result of offsetting the raw pointer. `feature(non_null_convenience)` [1] has been stabilized in Rust 1.80.0 [2], which is older than our new minimum Rust version (Rust 1.85.0). Thus, now that we bump the Rust minimum version, simplify using `NonNull::add()` and clean the TODO note. Link: https://github.com/rust-lang/rust/issues/117691 [1] Link: https://github.com/rust-lang/rust/pull/124498 [2] Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260405235309.418950-15-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit f309a6edda535f9a8da4f0620d4c45628465d04e Author: Miguel Ojeda Date: Mon Apr 6 01:52:49 2026 +0200 rust: transmute: simplify code with Rust 1.80.0 `split_at_*checked()` `feature(split_at_checked)` [1] has been stabilized in Rust 1.80.0 [2], which is older than our new minimum Rust version (Rust 1.85.0). Thus simplify the code using `split_at_*checked()`. Link: https://github.com/rust-lang/rust/issues/119128 [1] Link: https://github.com/rust-lang/rust/pull/124678 [2] Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-14-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit d1aa40daa777c74439eebf8aed17392e23685768 Author: Miguel Ojeda Date: Mon Apr 6 01:52:48 2026 +0200 rust: kbuild: remove `feature(...)`s that are now stable Now that the Rust minimum version is 1.85.0, there is no need to enable certain features that are stable. Thus clean them up. Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-13-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 0f6e1e0705f054ae68ecfa3f7ee47b9c35677e40 Author: Miguel Ojeda Date: Mon Apr 6 01:52:47 2026 +0200 rust: kbuild: remove skipping of `-Wrustdoc::unescaped_backticks` Back in Rust 1.82.0, I cleaned the `rustdoc::unescaped_backticks` lint in upstream Rust and added tests so that hopefully it would not regress [1]. Thus we can remove it from our side given the Rust minimum version bump. Link: https://github.com/rust-lang/rust/pull/128307 [1] Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-12-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 4ab22c543f18cfbcc2f8ae691dc5ec5cc0ac35fb Author: Miguel Ojeda Date: Mon Apr 6 01:52:46 2026 +0200 rust: remove `RUSTC_HAS_COERCE_POINTEE` and simplify code With the Rust version bump in place, the `RUSTC_HAS_COERCE_POINTEE` Kconfig (automatic) option is always true. Thus remove the option and simplify the code. In particular, this includes removing our use of the predecessor unstable features we used with Rust < 1.84.0 (`coerce_unsized`, `dispatch_from_dyn` and `unsize`). Reviewed-by: Tamir Duberstein Acked-by: Danilo Krummrich Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-11-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 9b398d0565438e9929afbfbb8a1cd1f3242067ac Author: Miguel Ojeda Date: Mon Apr 6 01:52:45 2026 +0200 rust: remove `RUSTC_HAS_SLICE_AS_FLATTENED` and simplify code With the Rust version bump in place, the `RUSTC_HAS_SLICE_AS_FLATTENED` Kconfig (automatic) option is always true. Thus remove the option and simplify the code. In particular, this includes removing the `slice` module which contained the temporary slice helpers, i.e. the `AsFlattened` extension trait and its `impl`s. Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-10-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit b28711ac98e8b43bfbf5c918022018a54dcedd45 Author: Miguel Ojeda Date: Mon Apr 6 01:52:44 2026 +0200 rust: simplify `RUSTC_VERSION` Kconfig conditions With the Rust version bump in place, several Kconfig conditions based on `RUSTC_VERSION` are always true. Thus simplify them. The minimum supported major LLVM version by our new Rust minimum version is now LLVM 18, instead of LLVM 16. However, there are no possible cleanups for `RUSTC_LLVM_VERSION`. Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-9-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 7ed188605e1d30e8b45d78846e3bc2bbb6394948 Author: Miguel Ojeda Date: Mon Apr 6 01:52:43 2026 +0200 rust: allow globally `clippy::incompatible_msrv` `clippy::incompatible_msrv` is not buying us much, and we discussed allowing it several times in the past. For instance, there was recently another patch sent to `allow` it where needed [1]. While that particular case would not be needed after the minimum version bump to 1.85.0, it is simpler to just allow it to prevent future instances. [ In addition, the lint fired without taking into account the features that have been enabled in a crate [2]. While this was improved in Rust 1.90.0 [3], it would still fire in a case like this patch. ] Thus do so, and remove the last instance of locally allowing it we have in the tree (except the one in the vendored `proc_macro2` crate). Note that we still keep the `msrv` config option in `clippy.toml` since that affects other lints as well. Link: https://lore.kernel.org/rust-for-linux/20260404212831.78971-4-jhubbard@nvidia.com/ [1] Link: https://github.com/rust-lang/rust-clippy/issues/14425 [2] Link: https://github.com/rust-lang/rust-clippy/pull/14433 [3] Link: https://patch.msgid.link/20260405235309.418950-8-ojeda@kernel.org Reviewed-by: Gary Guo Reviewed-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit b6cfba43662363dd7bff824e012cd924277ca86b Author: Miguel Ojeda Date: Mon Apr 6 01:52:42 2026 +0200 rust: bump Clippy's MSRV and clean `incompatible_msrv` allows Following the Rust compiler bump, we can now update Clippy's MSRV we set in the configuration, which will improve the diagnostics it generates. Thus do so and clean a few of the `allow`s that are not needed anymore. Reviewed-by: Tamir Duberstein Acked-by: Danilo Krummrich Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-7-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit f32fb9c58a5bd436f082dfa12639177b9da87680 Author: Miguel Ojeda Date: Mon Apr 6 01:52:41 2026 +0200 rust: bump Rust minimum supported version to 1.85.0 (Debian Trixie) As proposed in the past in e.g. LPC 2025 and the Maintainers Summit [1], we are going to follow Debian Stable's Rust versions as our minimum supported version. Debian Trixie was released with a Rust 1.85.0 toolchain [2], which it still uses to this day [3] (i.e. no update to Rust 1.85.1). Debian Trixie's release happened on 2025-08-09 [4], which means that a fair amount of time has passed since its release for kernel developers to upgrade. Thus bump the minimum to the new version. Then, in later commits, clean up most of the workarounds and other bits that this upgrade of the minimum allows us. pin-init was left as-is since the patches come from upstream. And the vendored crates are unmodified, since we do not want to change those. Note that the minimum LLVM major version for Rust 1.85.0 is LLVM 18 (the Rust upstream binaries use LLVM 19.1.7), thus e.g. `RUSTC_LLVM_VERSION` tests can also be updated, but there are no suitable ones to simplify. Ubuntu 25.10 also has a recent enough Rust toolchain [5], and they also provide versioned packages with a Rust 1.85.1 toolchain even back to Ubuntu 22.04 LTS [6]. Link: https://lwn.net/Articles/1050174/ [1] Link: https://www.debian.org/releases/trixie/release-notes/whats-new.en.html#desktops-and-well-known-packages [2] Link: https://packages.debian.org/trixie/rustc [3] Link: https://www.debian.org/releases/trixie/ [4] Link: https://packages.ubuntu.com/search?suite=all&searchon=names&keywords=rustc [5] Link: https://launchpad.net/ubuntu/+source/rustc-1.85 [6] Acked-by: Tamir Duberstein Acked-by: Benno Lossin Acked-by: Gary Guo Acked-by: Danilo Krummrich Acked-by: Alice Ryhl Link: https://patch.msgid.link/20260405235309.418950-6-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 341c51ee3293031476ca50f0406ddf1c7c91bba4 Author: Miguel Ojeda Date: Mon Apr 6 01:52:40 2026 +0200 gpu: nova-core: bindings: remove unneeded `cfg_attr` These were likely copied from the `bindings` and `uapi` crates, but are unneeded since there are no `cfg(test)`s in the bindings. In addition, the issue that triggered the addition in those crates originally is also fixed in `bindgen` (please see the previous commit). Thus remove them. Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260405235309.418950-5-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 92cc022f044f8702f18ae432d205dbf31db58b42 Author: Miguel Ojeda Date: Mon Apr 6 01:52:39 2026 +0200 rust: kbuild: remove unneeded old `allow`s for generated layout tests The issue that required `allow`s for `cfg(test)` code generated by `bindgen` for layout testing was fixed back in `bindgen` 0.60.0 [1], so it could have been removed even before the version bump, but it does not hurt. Thus remove it now. Link: https://github.com/rust-lang/rust-bindgen/pull/2203 [1] Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-4-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 518b9ad2fab3843ad50b776a55cec96c9503de51 Author: Miguel Ojeda Date: Mon Apr 6 01:52:38 2026 +0200 rust: kbuild: remove "`try` keyword" workaround for `bindgen` < 0.59.2 There is a workaround that has not been needed, even already after commit 08ab786556ff ("rust: bindgen: upgrade to 0.65.1"), but it does not hurt. Thus remove it. Reviewed-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260405235309.418950-3-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit c8cbe2fc22e4eb9f81a3fb2eefcaf25e19dcd171 Author: Miguel Ojeda Date: Mon Apr 6 01:52:37 2026 +0200 rust: kbuild: remove `--remap-path-prefix` workarounds Commit 8cf5b3f83614 ("Revert "kbuild, rust: use -fremap-path-prefix to make paths relative"") removed `--remap-path-prefix` from the build system, so the workarounds are not needed anymore. Thus remove them. Note that the flag has landed again in parallel in this cycle in commit dda135077ecc ("rust: build: remap path to avoid absolute path"), together with `--remap-path-scope=macro` [1]. However, they are gated on `rustc-option-yn, --remap-path-scope=macro`, which means they are both only passed starting with Rust 1.95.0 [2]: `--remap-path-scope` is only stable in Rust 1.95, so use `rustc-option` to detect its presence. This feature has been available as `-Zremap-path-scope` for all versions that we support; however due to bugs in the Rust compiler, it does not work reliably until 1.94. I opted to not enable it for 1.94 as it's just a single version that we missed. In turn, that means the workarounds removed here should not be needed again (even with the flag added again above), since: - `rustdoc` now recognizes the `--remap-path-prefix` flag since Rust 1.81.0 [3] (even if it is still an unstable feature [4]). - The Internal Compiler Error [5] that the comment mentions was fixed in Rust 1.87.0 [6]. We tested that was the case in a previous version of this series by making the workaround conditional [7][8]. ...which are both older versions than Rust 1.95.0. We will still need to skip `--remap-path-scope` for `rustdoc` though, since `rustdoc` does not support that one yet [4]. Link: https://github.com/rust-lang/rust/issues/111540 [1] Link: https://github.com/rust-lang/rust/pull/147611 [2] Link: https://github.com/rust-lang/rust/pull/107099 [3] Link: https://doc.rust-lang.org/nightly/rustdoc/unstable-features.html#--remap-path-prefix-remap-source-code-paths-in-output [4] Link: https://github.com/rust-lang/rust/issues/138520 [5] Link: https://github.com/rust-lang/rust/pull/138556 [6] Link: https://lore.kernel.org/rust-for-linux/20260401114540.30108-9-ojeda@kernel.org/ [7] Link: https://lore.kernel.org/rust-for-linux/20260401114540.30108-10-ojeda@kernel.org/ [8] Link: https://patch.msgid.link/20260405235309.418950-2-ojeda@kernel.org Acked-by: Gary Guo Reviewed-by: Tamir Duberstein Signed-off-by: Miguel Ojeda commit 598b670af347bc8d998866b1e795e40a3bb168de Author: Thomas Weißschuh Date: Sun Jan 4 16:14:42 2026 +0100 selftests/nolibc: don't skip tests for unimplemented syscalls anymore The automatic skipping of tests on ENOSYS returns was introduced in commit 349afc8a52f8 ("selftests/nolibc: skip tests for unimplemented syscalls"). It handled the fact that nolibc would return ENOSYS for many syscall wrappers on riscv32. Nowadays nolibc handles all these correctly, so this logic is not used anymore. To make missing nolibc functionality more obvious fail the tests again if something is not implemented. Revert the mentioned commit again. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260406-nolibc-no-skip-enosys-v1-2-c046b1ac7d73@weissschuh.net/ commit 9a5206f2564128ada61ba1d29aeafa0a439dca00 Author: Thomas Weißschuh Date: Sun Jan 4 20:05:26 2026 +0100 selftests/nolibc: explicitly handle ENOSYS from ptrace() The automatic ENOSYS handling in EXPECT_SYSER() is about to be removed. ptrace() will return legitimately return ENOSYS on qemu-user, so handle it explicitly. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260406-nolibc-no-skip-enosys-v1-1-c046b1ac7d73@weissschuh.net/ commit ce834c9cb984a9b85160a2c3a3821e179fa502fa Author: Thomas Weißschuh Date: Sun Apr 5 17:31:05 2026 +0200 tools/nolibc: add byteorder conversions Add some standard functions to convert between different byte orders. Conveniently the UAPI headers provide all the necessary functionality. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260405-nolibc-bswap-v1-1-f7699ca9cee0@weissschuh.net commit 2eb64b936d3b6332ae44bbf91277f912be5597e2 Author: Thomas Weißschuh Date: Sun Apr 5 11:06:25 2026 +0200 tools/nolibc: add the _syscall() macro The standard syscall() function or macro uses the libc return value convention. Errors returned from the kernel as negative values are stored in errno and -1 is returned. Users who want to avoid using errno don't have a way to call raw syscalls and check the returned error. Add a new macro _syscall() which works like the standard syscall() but passes through the return value from the kernel unchanged. The naming scheme and return values match the named _sys_foo() system call wrappers already part of nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260405-nolibc-syscall-v1-3-e5b12bc63211@weissschuh.net commit 022bbb5a41fd6463887dfb7de22f5be8262239a7 Author: Thomas Weißschuh Date: Sun Apr 5 11:06:24 2026 +0200 tools/nolibc: move the call to __sysret() into syscall() __sysret() transforms the return value from the kernel into the libc return value convention. There is no reason for it to be called in the middle of the internals of the syscall() implementation macros. Move the call up, directly into syscall(), to make the code simpler. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260405-nolibc-syscall-v1-2-e5b12bc63211@weissschuh.net commit 3f5059f01de1aca30e7f793da0a0b5bf2740cb7a Author: Thomas Weißschuh Date: Sun Apr 5 11:06:23 2026 +0200 tools/nolibc: rename the internal macros used in syscall() These macros are the internal implementation of syscall(). They can not be used by users. Align them with the standard naming scheme for internal symbols. The current name also prevents the addition of an application-usable _syscall() symbol. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260405-nolibc-syscall-v1-1-e5b12bc63211@weissschuh.net commit c6e80201e057dfb7253385e60bf541121bf5dc33 Author: Joseph Salisbury Date: Fri Apr 3 17:00:14 2026 -0400 sched: Use u64 for bandwidth ratio calculations to_ratio() computes BW_SHIFT-scaled bandwidth ratios from u64 period and runtime values, but it returns unsigned long. tg_rt_schedulable() also stores the current group limit and the accumulated child sum in unsigned long. On 32-bit builds, large bandwidth ratios can be truncated and the RT group sum can wrap when enough siblings are present. That can let an overcommitted RT hierarchy pass the schedulability check, and it also narrows the helper result for other callers. Return u64 from to_ratio() and use u64 for the RT group totals so bandwidth ratios are preserved and compared at full width on both 32-bit and 64-bit builds. Fixes: b40b2e8eb521 ("sched: rt: multi level group constraints") Assisted-by: Codex:GPT-5 Signed-off-by: Joseph Salisbury Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260403210014.2713404-1-joseph.salisbury@oracle.com commit a0a316f7683988463fc9417498292538055acb8f Merge: a5a1804332afc7 f63ddbcc329904 Author: Greg Kroah-Hartman Date: Tue Apr 7 09:15:21 2026 +0200 Merge tag 'fpga-for-7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next Xu writes: FPGA Manager changes for 7.1-rc1 - Dinh & Yury's changes to use sysfs_emit() for sysfs read All patches have been reviewed on the mailing list, and have been in the last linux-next releases (as part of our for-next branch). Sorry for the late post due to personal affairs. Signed-off-by: Xu Yilun * tag 'fpga-for-7.1-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga: fpga: m10bmc-sec: switch show_canceled_csk() to using sysfs_emit() fpga: bridge: Use sysfs_emit() instead of sprintf() commit 7f9f7c697474268d9ef9479df3ddfe7cdcfbbffc Author: Chia-Ming Chang Date: Thu Apr 2 14:14:06 2026 +0800 md/raid5: fix soft lockup in retry_aligned_read() When retry_aligned_read() encounters an overlapped stripe, it releases the stripe via raid5_release_stripe() which puts it on the lockless released_stripes llist. In the next raid5d loop iteration, release_stripe_list() drains the stripe onto handle_list (since STRIPE_HANDLE is set by the original IO), but retry_aligned_read() runs before handle_active_stripes() and removes the stripe from handle_list via find_get_stripe() -> list_del_init(). This prevents handle_stripe() from ever processing the stripe to resolve the overlap, causing an infinite loop and soft lockup. Fix this by using __release_stripe() with temp_inactive_list instead of raid5_release_stripe() in the failure path, so the stripe does not go through the released_stripes llist. This allows raid5d to break out of its loop, and the overlap will be resolved when the stripe is eventually processed by handle_stripe(). Fixes: 773ca82fa1ee ("raid5: make release_stripe lockless") Cc: stable@vger.kernel.org Signed-off-by: FengWei Shih Signed-off-by: Chia-Ming Chang Link: https://lore.kernel.org/linux-raid/20260402061406.455755-1-chiamingc@synology.com/ Signed-off-by: Yu Kuai commit f8cc59ecc22841be5deb07b549c0c6a2657cd5f9 Author: Fabio Porcedda Date: Thu Apr 2 11:57:27 2026 +0200 USB: serial: option: add Telit Cinterion FN990A MBIM composition Add the following Telit Cinterion FN990A MBIM composition: 0x1074: MBIM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb T: Bus=01 Lev=01 Prnt=04 Port=06 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1074 Rev=05.04 S: Manufacturer=Telit Wireless Solutions S: Product=FN990 S: SerialNumber=70628d0c C: #Ifs= 8 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: stable@vger.kernel.org Signed-off-by: Fabio Porcedda Signed-off-by: Johan Hovold commit 9826035a75da609ac2424c97915d6fe5b836ee65 Author: Richard Acayan Date: Tue Mar 31 16:06:57 2026 -0400 pinctrl: qcom: add sdm670 lpi tlmm The Snapdragon 670 has an Low-Power Island (LPI) TLMM for configuring pins related to audio. Add the driver for this. Signed-off-by: Richard Acayan Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Linus Walleij commit 72102fdae3a01365e32de651e8332db663899901 Author: Richard Acayan Date: Tue Mar 31 16:06:56 2026 -0400 dt-bindings: pinctrl: qcom: Add SDM670 LPASS LPI pinctrl Add the pin controller for the audio Low-Power Island (LPI) on SDM670. Signed-off-by: Richard Acayan Reviewed-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit a22d2598a5637986115ec442781edb634097ab88 Author: Richard Acayan Date: Tue Mar 31 16:06:55 2026 -0400 dt-bindings: qcom: lpass-lpi-common: add reserved GPIOs property There can be reserved GPIOs on the LPASS LPI pin controller to possibly control sensors. Add the property for reserved GPIOs so they can be avoided appropriately. Adapted from the same entry in qcom,tlmm-common.yaml. Signed-off-by: Richard Acayan Reviewed-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit 498c05821bb42f70e9bf6512c3dec4aa821815d0 Author: Rosen Penev Date: Wed Apr 1 14:47:26 2026 -0700 thunderbolt: tunnel: Simplify allocation Use a flexible array member and kzalloc_flex to combine allocations. Add __counted_by for extra runtime analysis. Move counting variable assignment after allocation. kzalloc_flex with GCC >= 15 does this automatically. Signed-off-by: Rosen Penev Signed-off-by: Mika Westerberg commit 95dffe32a66cbed07fbfa7afed39d56d5014e04f Author: Pengpeng Hou Date: Mon Apr 6 21:52:34 2026 -0700 Input: aiptek - validate raw macro indices before updating state aiptek_irq() derives macro key indices directly from tablet reports and then uses them to index macroKeyEvents[]. Report types 4 and 5 also save the derived value in aiptek->lastMacro and later use that state to release the previous key. Validate the raw macro index once before it enters that state machine, so lastMacro only ever stores an in-range macro key. Keep direct bounds checks for report type 6, which reads the macro number from the packet body and uses it immediately. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260329001711.88076-1-pengpeng@iscas.ac.cn [dtor: fix macro fallback in report 5s to use -1] Signed-off-by: Dmitry Torokhov commit bc561dc8ba5b9fe56ed1757bdad218c9a0f992f1 Author: Pengpeng Hou Date: Tue Apr 7 09:56:52 2026 +0800 Input: gf2k - skip invalid hat lookup values gf2k_read() decodes the hat position from a 4-bit field and uses it directly to index gf2k_hat_to_axis[]. The lookup table only has nine entries, so malformed packets can read past the end of the fixed table. Skip hat reporting when the decoded value falls outside the lookup table instead of forcing it to the neutral position. This keeps the fix local and avoids reporting a made-up axis state for malformed packets. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260407120001.1-gf2k-v2-pengpeng@iscas.ac.cn Signed-off-by: Dmitry Torokhov commit cf86bb53b9c92354904a328e947a05ffbfdd1840 Author: Yu Kuai Date: Fri Mar 27 22:07:29 2026 +0800 md: wake raid456 reshape waiters before suspend During raid456 reshape, direct IO across the reshape position can sleep in raid5_make_request() waiting for reshape progress while still holding an active_io reference. If userspace then freezes reshape and writes md/suspend_lo or md/suspend_hi, mddev_suspend() kills active_io and waits for all in-flight IO to drain. This can deadlock: the IO needs reshape progress to continue, but the reshape thread is already frozen, so the active_io reference is never dropped and suspend never completes. raid5_prepare_suspend() already wakes wait_for_reshape for dm-raid. Do the same for normal md suspend when reshape is already interrupted, so waiting raid456 IO can abort, drop its reference, and let suspend finish. The mdadm test tests/25raid456-reshape-deadlock reproduces the hang. Fixes: 714d20150ed8 ("md: add new helpers to suspend/resume array") Link: https://lore.kernel.org/linux-raid/20260327140729.2030564-1-yukuai@fnnas.com/ Signed-off-by: Yu Kuai commit 808cec74601cfddea87b6970134febfdc7f574b9 Author: Xiao Ni Date: Tue Mar 24 15:24:54 2026 +0800 md/raid1: serialize overlap io for writemostly disk Previously, using wait_event() would wake up all waiters simultaneously, and they would compete for the tree lock. The bio which gets the lock first will be handled, so the write sequence cannot be guaranteed. For example: bio1(100,200) bio2(150,200) bio3(150,300) The write sequence of fast device is bio1,bio2,bio3. But the write sequence of slow device could be bio1,bio3,bio2 due to lock competition. This causes data corruption. Replace waitqueue with a fifo list to guarantee the write sequence. And it also needs to iterate the list when removing one entry. If not, it may miss the opportunity to wake up the waiting io. For example: bio1(1,3), bio2(2,4) bio3(5,7), bio4(6,8) These four bios are in the same bucket. bio1 and bio3 are inserted into the rbtree. bio2 and bio4 are added to the waiting list and bio2 is the first one. bio3 returns from slow disk and tries to wake up the waiting bios. bio2 is removed from the list and will be handled. But bio1 hasn't finished. So bio2 will be added into waiting list again. Then bio1 returns from slow disk and wakes up waiting bios. bio4 is removed from the list and will be handled. Now bio1, bio3 and bio4 all finish and bio2 is left on the waiting list. So it needs to iterate the waiting list to wake up the right bio. Signed-off-by: Xiao Ni Link: https://lore.kernel.org/linux-raid/20260324072501.59865-1-xni@redhat.com/ Signed-off-by: Yu Kuai commit e92a5325b5d3bc30730b4842249ba8990a0a92b8 Author: Yu Kuai Date: Mon Mar 23 13:46:44 2026 +0800 md/md-llbitmap: optimize initial sync with write_zeroes_unmap support For RAID-456 arrays with llbitmap, if all underlying disks support write_zeroes with unmap, issue write_zeroes to zero all disk data regions and initialize the bitmap to BitCleanUnwritten instead of BitUnwritten. This optimization skips the initial XOR parity building because: 1. write_zeroes with unmap guarantees zeroed reads after the operation 2. For RAID-456, when all data is zero, parity is automatically consistent (0 XOR 0 XOR ... = 0) 3. BitCleanUnwritten indicates parity is valid but no user data has been written The implementation adds two helper functions: - llbitmap_all_disks_support_wzeroes_unmap(): Checks if all active disks support write_zeroes with unmap - llbitmap_zero_all_disks(): Issues blkdev_issue_zeroout() to each rdev's data region to zero all disks The zeroing and bitmap state setting happens in llbitmap_init_state() during bitmap initialization. If any disk fails to zero, we fall back to BitUnwritten and normal lazy recovery. This significantly reduces array initialization time for RAID-456 arrays built on modern NVMe SSDs or other devices that support write_zeroes with unmap. Reviewed-by: Xiao Ni Link: https://lore.kernel.org/linux-raid/20260323054644.3351791-4-yukuai@fnnas.com/ Signed-off-by: Yu Kuai commit 4403023e2aa7bab0193121d2ec543bea862d7304 Author: Yu Kuai Date: Mon Mar 23 13:46:43 2026 +0800 md/md-llbitmap: add CleanUnwritten state for RAID-5 proactive parity building Add new states to the llbitmap state machine to support proactive XOR parity building for RAID-5 arrays. This allows users to pre-build parity data for unwritten regions before any user data is written. New states added: - BitNeedSyncUnwritten: Transitional state when proactive sync is triggered via sysfs on Unwritten regions. - BitSyncingUnwritten: Proactive sync in progress for unwritten region. - BitCleanUnwritten: XOR parity has been pre-built, but no user data written yet. When user writes to this region, it transitions to BitDirty. New actions added: - BitmapActionProactiveSync: Trigger for proactive XOR parity building. - BitmapActionClearUnwritten: Convert CleanUnwritten/NeedSyncUnwritten/ SyncingUnwritten states back to Unwritten before recovery starts. State flows: - Current (lazy): Unwritten -> (write) -> NeedSync -> (sync) -> Dirty -> Clean - New (proactive): Unwritten -> (sysfs) -> NeedSyncUnwritten -> (sync) -> CleanUnwritten - On write to CleanUnwritten: CleanUnwritten -> (write) -> Dirty -> Clean - On disk replacement: CleanUnwritten regions are converted to Unwritten before recovery starts, so recovery only rebuilds regions with user data A new sysfs interface is added at /sys/block/mdX/md/llbitmap/proactive_sync (write-only) to trigger proactive sync. This only works for RAID-456 arrays. Link: https://lore.kernel.org/linux-raid/20260323054644.3351791-3-yukuai@fnnas.com/ Signed-off-by: Yu Kuai commit 09af773650024279a60348e7319d599e6571b15c Author: Yu Kuai Date: Mon Mar 23 13:46:42 2026 +0800 md: add fallback to correct bitmap_ops on version mismatch If default bitmap version and on-disk version doesn't match, and mdadm is not the latest version to set bitmap_type, set bitmap_ops based on the disk version. Link: https://lore.kernel.org/linux-raid/20260323054644.3351791-2-yukuai@fnnas.com/ Signed-off-by: Yu Kuai commit b0cc3ae97e893bf54bbce447f4e9fd2e0b88bff9 Author: Junrui Luo Date: Sat Apr 4 15:44:35 2026 +0800 md/raid5: validate payload size before accessing journal metadata r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a journal metadata block using on-disk payload size fields without validating them against the remaining space in the metadata block. A corrupted journal contains payload sizes extending beyond the PAGE_SIZE boundary can cause out-of-bounds reads when accessing payload fields or computing offsets. Add bounds validation for each payload type to ensure the full payload fits within meta_size before processing. Fixes: b4c625c67362 ("md/r5cache: r5cache recovery: part 1") Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Link: https://lore.kernel.org/linux-raid/SYBPR01MB78815E78D829BB86CD7C8015AF5FA@SYBPR01MB7881.ausprd01.prod.outlook.com/ Signed-off-by: Yu Kuai commit e4979f4fac4d6bbe757be50441b45e28e6bf7360 Author: Abd-Alrhman Masalkhi Date: Sat Mar 28 22:35:22 2026 +0300 md: remove unused static md_wq workqueue The md_wq workqueue is defined as static and initialized in md_init(), but it is not used anywhere within md.c. All asynchronous and deferred work in this file is handled via md_misc_wq or dedicated md threads. Fixes: b75197e86e6d3 ("md: Remove flush handling") Signed-off-by: Abd-Alrhman Masalkhi Link: https://lore.kernel.org/linux-raid/20260328193522.3624-1-abd.masalkhi@gmail.com/ Signed-off-by: Yu Kuai commit 078d1d8e688d75419abfedcae47eab8e42b991bb Author: Gregory Price Date: Sun Mar 8 19:42:02 2026 -0400 md/raid0: use kvzalloc/kvfree for strip_zone and devlist allocations syzbot reported a WARNING at mm/page_alloc.c:__alloc_frozen_pages_noprof() triggered by create_strip_zones() in the RAID0 driver. When raid_disks is large, the allocation size exceeds MAX_PAGE_ORDER (4MB on x86), causing WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER). Convert the strip_zone and devlist allocations from kzalloc/kzalloc_objs to kvzalloc/kvzalloc_objs, which first attempts a contiguous allocation with __GFP_NOWARN and then falls back to vmalloc for large sizes. Convert the corresponding kfree calls to kvfree. Both arrays are pure metadata lookup tables (arrays of pointers and zone descriptors) accessed only via indexing, so they do not require physically contiguous memory. Reported-by: syzbot+924649752adf0d3ac9dd@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69adaba8.a00a0220.b130.0005.GAE@google.com/ Signed-off-by: Gregory Price Reviewed-by: Yu Kuai Reviewed-by: Li Nan Link: https://lore.kernel.org/linux-raid/20260308234202.3118119-1-gourry@gourry.net/ Signed-off-by: Yu Kuai commit 63c2f06198ca7513433f1c92f2c654869d72417e Author: Zhan Xusheng Date: Fri Apr 3 14:36:58 2026 +0800 erofs: handle 48-bit blocks/uniaddr for extra devices erofs_init_device() only reads blocks_lo and uniaddr_lo from the on-disk device slot, ignoring blocks_hi and uniaddr_hi that were introduced alongside the 48-bit block addressing feature. For the primary device (dif0), erofs_read_superblock() already handles this correctly by combining blocks_lo with blocks_hi when 48-bit layout is enabled. But the same logic was not applied to extra devices. With a 48-bit EROFS image using extra devices whose uniaddr or blocks exceed 32-bit range, the truncated values cause erofs_map_dev() to compute wrong physical addresses, leading to silent data corruption. Fix this by reading blocks_hi and uniaddr_hi in erofs_init_device() when 48-bit layout is enabled, consistent with the primary device handling. Also fix the erofs_deviceslot on-disk definition where blocks_hi was incorrectly declared as __le32 instead of __le16. Fixes: 61ba89b57905 ("erofs: add 48-bit block addressing on-disk support") Suggested-by: Gao Xiang Signed-off-by: Zhan Xusheng Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit a9c4b1d37622ed01b75f94a4f68cf55f33153a31 Author: Christoph Böhmwalder Date: Fri Apr 3 15:29:53 2026 +0200 drbd: remove DRBD_GENLA_F_MANDATORY flag handling DRBD used a custom mechanism to mark netlink attributes as "mandatory": bit 14 of nla_type was repurposed as DRBD_GENLA_F_MANDATORY. Attributes sent from userspace that had this bit present and that were unknown to the kernel would lead to an error. Since commit ef6243acb478 ("genetlink: optionally validate strictly/dumps"), the generic netlink layer rejects unknown top-level attributes when strict validation is enabled. DRBD never opted out of strict validation, so unknown top-level attributes are already rejected by the netlink core. The mandatory flag mechanism was required for nested attributes, because these are parsed liberally, silently dropping attributes unknown to the kernel. This prepares for the move to a new YNL-based family, which will use the now-default strict parsing. The current family is not expected to gain any new attributes, which makes this change safe. Old userspace that still sets bit 14 is unaffected: nla_type() strips it before __nla_validate_parse() performs attribute validation, so the bit never reaches DRBD. Remove all references to the mandatory flag in DRBD. Cc: Johannes Berg Cc: Jakub Kicinski Signed-off-by: Christoph Böhmwalder Link: https://patch.msgid.link/20260403132953.2248751-1-christoph.boehmwalder@linbit.com Signed-off-by: Jens Axboe commit c149d90e260ca1b6b9175468955a15c4d95a9f3b Merge: ede3136e565574 c4a5cb2f00f9a8 Author: Jakub Kicinski Date: Mon Apr 6 19:14:30 2026 -0700 Merge branch 'mptcp-support-msg_eor-and-small-cleanups' Matthieu Baerts says: ==================== mptcp: support MSG_EOR and small cleanups This series contains various unrelated patches: - Patches 1 & 2: support MSG_EOR instead of ignoring it. - Patch 3: avoid duplicated code in TCP and MPTCP by using a new helper. - Patch 4: adapt test to reproduce bug and increase code coverage. ==================== Link: https://patch.msgid.link/20260403-net-next-mptcp-msg_eor-misc-v1-0-b0b33bea3fed@kernel.org Signed-off-by: Jakub Kicinski commit c4a5cb2f00f9a8e48437b973d1aceb1540851b98 Author: Matthieu Baerts (NGI0) Date: Fri Apr 3 13:29:31 2026 +0200 selftests: mptcp: join: recreate signal endp with same ID In this "delete re-add signal" MPTCP Join subtest, the endpoint linked to the initial subflow is removed, but readded once with different ID. It appears that there was an issue when reusing the same ID, recently fixed by commit d191101dee25 ("mptcp: pm: in-kernel: always set ID as avail when rm endp"). The test then now reuses the same ID the first time, but continue to use another one (88) the second time. This should then cover more cases. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/615 Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260403-net-next-mptcp-msg_eor-misc-v1-5-b0b33bea3fed@kernel.org Signed-off-by: Jakub Kicinski commit eb477fdd68036a54a6678020d4e6ab177dea111c Author: Geliang Tang Date: Fri Apr 3 13:29:29 2026 +0200 tcp: add recv_should_stop helper Factor out a new helper tcp_recv_should_stop() from tcp_recvmsg_locked() and tcp_splice_read() to check whether to stop receiving. And use this helper in mptcp_recvmsg() and mptcp_splice_read() to reduce redundant code. Suggested-by: Paolo Abeni Acked-by: Mat Martineau Signed-off-by: Geliang Tang Acked-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260403-net-next-mptcp-msg_eor-misc-v1-3-b0b33bea3fed@kernel.org Signed-off-by: Jakub Kicinski commit 7fb2f5f964998819dcc8f5d38dcd8999a568c3ef Author: Gang Yan Date: Fri Apr 3 13:29:28 2026 +0200 mptcp: preserve MSG_EOR semantics in sendmsg path Extend MPTCP's sendmsg handling to recognize and honor the MSG_EOR flag, which marks the end of a record for application-level message boundaries. Data fragments tagged with MSG_EOR are explicitly marked in the mptcp_data_frag structure and skb context to prevent unintended coalescing with subsequent data chunks. This ensures the intent of applications using MSG_EOR is preserved across MPTCP subflows, maintaining consistent message segmentation behavior. Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260403-net-next-mptcp-msg_eor-misc-v1-2-b0b33bea3fed@kernel.org Signed-off-by: Jakub Kicinski commit 00d46be3c319029bdf5b4eb53bff8e47a8e7ddc4 Author: Gang Yan Date: Fri Apr 3 13:29:27 2026 +0200 mptcp: reduce 'overhead' from u16 to u8 The 'overhead' in struct mptcp_data_frag can safely use u8, as it represents 'alignment + sizeof(mptcp_data_frag)'. With a maximum alignment of 7('ALIGN(1, sizeof(long)) - 1'), the overhead is at most 47, well below U8_MAX and validated with BUILD_BUG_ON(). This patch also adds a field named 'unused' for further extensions. Signed-off-by: Gang Yan Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260403-net-next-mptcp-msg_eor-misc-v1-1-b0b33bea3fed@kernel.org Signed-off-by: Jakub Kicinski commit ede3136e56557498ec3f2e6da58cb0920d8074e1 Author: Arnd Bergmann Date: Thu Apr 2 20:46:55 2026 +0200 dpaa2: avoid linking objects into multiple modules Each object file contains information about which module it gets linked into, so linking the same file into multiple modules now causes a warning: scripts/Makefile.build:254: drivers/net/ethernet/freescale/dpaa2/Makefile: dpaa2-mac.o is added to multiple modules: fsl-dpaa2-eth fsl-dpaa2-switch scripts/Makefile.build:254: drivers/net/ethernet/freescale/dpaa2/Makefile: dpmac.o is added to multiple modules: fsl-dpaa2-eth fsl-dpaa2-switch Change the way that dpaa2 is built by moving the two common files into a separate module with exported symbols instead. Tested-by: Ioana Ciornei Reviewed-by: Ioana Ciornei Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260402184726.3746487-3-arnd@kernel.org Signed-off-by: Jakub Kicinski commit df75bd552a8790e83d4aeb5f112050cf3dc687bf Author: Arnd Bergmann Date: Thu Apr 2 20:46:54 2026 +0200 net: ethernet: ti-cpsw: fix linking built-in code to modules There are six variants of the cpsw driver, sharing various parts of the code: davinci-emac, cpsw, cpsw-switchdev, netcp, netcp_ethss and am65-cpsw-nuss. I noticed that this means some files can be linked into more than one loadable module, or even part of vmlinux but also linked into a loadable module, both of which mess up assumptions of the build system, and causes warnings: scripts/Makefile.build:279: cpsw_ale.o is added to multiple modules: ti-am65-cpsw-nuss ti_cpsw ti_cpsw_new scripts/Makefile.build:279: cpsw_priv.o is added to multiple modules: ti_cpsw ti_cpsw_new scripts/Makefile.build:279: cpsw_sl.o is added to multiple modules: ti-am65-cpsw-nuss ti_cpsw ti_cpsw_new scripts/Makefile.build:279: cpsw_ethtool.o is added to multiple modules: ti_cpsw ti_cpsw_new scripts/Makefile.build:279: davinci_cpdma.o is added to multiple modules: ti_cpsw ti_cpsw_new ti_davinci_emac Change this back to having separate modules for each portion that can be linked standalone, exporting symbols as needed: - ti-cpsw-common.ko now contains both cpsw-common.o and davinci_cpdma.o as they are always used together - ti-cpsw-priv.ko contains cpsw_priv.o, cpsw_sl.o and cpsw_ethtool.o, which are the core of the cpsw and cpsw-new drivers. - ti-cpsw-sl.ko contains the cpsw-sl.o object and is used on ti-am65-cpsw-nuss.ko in addition to the two other cpsw variants. - ti-cpsw-ale.o is the one standalone module that is used by all except davinci_emac. Each of these will be built-in if any of its users are built-in, otherwise it's a loadable module if there is at least one module using it. I did not bring back the separate Kconfig symbols for this, but just handle it using Makefile logic. Note: ideally this is something that Kbuild complains about, but usually we just notice when something using THIS_MODULE misbehaves in a way that a user notices. Fixes: 99f6297182729 ("net: ethernet: ti: cpsw: drop TI_DAVINCI_CPDMA config option") Link: https://lore.kernel.org/lkml/20240417084400.3034104-1-arnd@kernel.org/ Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260402184726.3746487-2-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 961f3c535608df64553f61d64ca086aa9f371bdd Author: Arnd Bergmann Date: Thu Apr 2 20:46:53 2026 +0200 net: ethernet: ti-cpsw:: rename soft_reset() function While looking at the glob symbols shared between the cpsw drivers, I noticed that soft_reset() is the only one that is missing a proper namespace prefix, and will pollute the kernel namespace, so rename it to be consistent with the other symbols. Reviewed-by: Alexander Sverdlin Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260402184726.3746487-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit e6b7e1a10cba354e9fd5b10e3a83359f84ad8535 Author: Jakub Kicinski Date: Fri Apr 3 15:05:01 2026 -0700 eth: remove the driver for acenic / tigon1&2 The entire git history for this driver looks like tree-wide and automated cleanups. There's even more coming now with AI, so let's try to delete it instead. Acked-by: Jes Sorensen Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260403220501.2263835-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c321b5676d0c41de9155c1966aa6af8b7ca35091 Author: Kevin Hao Date: Fri Apr 3 22:23:39 2026 +0800 net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI The TX NAPI should be registered via netif_napi_add_tx() to avoid unnecessarily polluting the napi_hash table. Signed-off-by: Kevin Hao Link: https://patch.msgid.link/20260403-macb-napi-tx-v1-1-08126a60c65e@gmail.com Signed-off-by: Jakub Kicinski commit 646dbda284355e3c8a11423eabe954a0a19c30bc Merge: 2f60df9e61aa48 e72058a4bed070 Author: Jakub Kicinski Date: Mon Apr 6 18:50:51 2026 -0700 Merge branch 'nfc-support-for-five-qualcomm-sdm845-phones' David Heidelberg says: ==================== NFC support for five Qualcomm SDM845 phones - OnePlus 6 / 6T - Pixel 3 / 3 XL - SHIFT 6MQ Verified with NFC card using neard: systemctl enable --now neard nfctool --device nfc0 -1 nfctool -d nfc0 -p gdbus introspect --system --dest org.neard --object-path /org/neard/nfc0/tag0/record0 or use gNFC: https://gitlab.gnome.org/dh/gnfc/ successfully detecting and reading a tag. ==================== Link: https://patch.msgid.link/20260403-oneplus-nfc-v3-0-fbdce57d63c1@ixit.cz Signed-off-by: Jakub Kicinski commit e72058a4bed070193893410e5f6545cc4f99cd24 Author: David Heidelberg Date: Fri Apr 3 15:58:46 2026 +0200 dt-bindings: nfc: nxp,nci: Document PN557 compatible The PN557 uses the same hardware as the PN553 but ships with firmware compliant with NCI 2.0. Document PN557 as a compatible device. Signed-off-by: David Heidelberg Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260403-oneplus-nfc-v3-1-fbdce57d63c1@ixit.cz Signed-off-by: Jakub Kicinski commit 2f60df9e61aa48bf40c36254bf2e839f09cffd98 Author: Yue Haibing Date: Fri Apr 3 16:46:19 2026 +0800 ip6_tunnel: use generic for_each_ip_tunnel_rcu macro Remove the locally defined for_each_ip6_tunnel_rcu macro and use the generic for_each_ip_tunnel_rcu from linux/if_tunnel.h instead. This eliminates code duplication and ensures consistency across the kernel tunnel implementations. Signed-off-by: Yue Haibing Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260403084619.4107978-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 8b648a517522e308e4378f012c4d352271e0cecf Merge: 18474aed5d0d38 1c2e217ad349d2 Author: Alexei Starovoitov Date: Mon Apr 6 18:38:33 2026 -0700 Merge branch 'properly-load-values-from-insn_arays-with-non-zero-offsets' Anton Protopopov says: ==================== Properly load values from insn_arays with non-zero offsets The PTR_TO_INSN is always loaded via BPF_LDX_MEM instruction. However, the verifier doesn't properly verify such loads when the offset is not zero. Fix this and extend selftests with more scenarios. v2 -> v3: * Add a C-level selftest which triggers a load with nonzero offset (Alexei) * Rephrase commit messages a bit v2: https://lore.kernel.org/bpf/20260402184647.988132-1-a.s.protopopov@gmail.com/ v1: https://lore.kernel.org/bpf/20260401161529.681755-1-a.s.protopopov@gmail.com ==================== Link: https://patch.msgid.link/20260406160141.36943-1-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 1c2e217ad349d2af5c09f8e6e1c0561ad912477d Author: Anton Protopopov Date: Mon Apr 6 16:01:41 2026 +0000 selftests/bpf: Add more tests for loading insn arrays with offsets A `gotox rX` instruction accepts only values of type PTR_TO_INSN. The only way to create such a value is to load it from a map of type insn_array: rX = *(rY + offset) # rY was read from an insn_array ... gotox rX Add instruction-level and C-level selftests to validate loads with nonzero offsets. Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20260406160141.36943-3-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 43cd9d9520e6622f6b9ffcd4f68e9d99225482b2 Author: Anton Protopopov Date: Mon Apr 6 16:01:40 2026 +0000 bpf: Do not ignore offsets for loads from insn_arrays When a pointer to PTR_TO_INSN is dereferenced, the offset field of the BPF_LDX_MEM instruction can be nonzero. Patch the verifier to not ignore this field. Reported-by: Jiyong Yang Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps") Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20260406160141.36943-2-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 18474aed5d0d382f8057ceed7811a735134d28b9 Author: Gustavo A. R. Silva Date: Mon Mar 30 16:38:18 2026 -0600 bpf: Avoid -Wflex-array-members-not-at-end warnings Apparently, struct bpf_empty_prog_array exists entirely to populate a single element of "items" in a global variable. "null_prog" is only used during the initializer. None of this is needed; globals will be correctly sized with an array initializer of a flexible-array member. So, remove struct bpf_empty_prog_array and adjust the rest of the code, accordingly. With these changes, fix the following warnings: ./include/linux/bpf.h:2369:31: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Acked-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/acr7Whmn0br3xeBP@kspp Signed-off-by: Alexei Starovoitov commit 8a4e3ab61d496c37595219e5122d91f204cb05de Author: Jason Xing Date: Thu Apr 2 11:41:14 2026 +0800 net: advance skb_defer_disable_key check in napi_consume_skb When net.core.skb_defer_max is adjusted to zero, napi_consume_skb() shouldn't go into that deeper in skb_attempt_defer_free() because it adds an additional pair of local_bh_enable/disable() which is evidently not needed. Advancing the check of the static key saves more cycles and benefits non defer case. Signed-off-by: Jason Xing Link: https://patch.msgid.link/20260402034114.65766-1-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 1ef05ed263a1ad857149407a79496dcacafe39eb Merge: 98f28d8d6e5a5e 340bdf984613c4 Author: Jakub Kicinski Date: Mon Apr 6 18:30:35 2026 -0700 Merge branch 'net-dsa-mxl862xx-add-support-for-bridge-offloading' Daniel Golle says: ==================== net: dsa: mxl862xx: add support for bridge offloading As a next step to complete the mxl862xx DSA driver, add support for offloading forwarding between bridged ports to the switch hardware. This works pretty much without any big surprises, apart from two subtleties: * per-port control over flooding behavior has to be implemented by (ab)using a 0-rate QoS meters as stopper in lack of any better option. * STP state transition unconditionally enables learning on a port even if it was previously explicitely disabled (a firmware bug) Note that as the driver is still lacking all VLAN features (which are going to be added next), at this point some of the bridge_vlan_aware.sh tests are failing after applying this series. This is expected and cannot be avoided without implementing port_vlan_filtering + port_vlan_add/del. And adding both bridge and VLAN offloading at the same time would be too much for anyone to review, so VLAN support is going to be submitted in a follow-up series immediately after this series has been accepted. All other relevant selftests (including bridge_vlan_unaware.sh) are still passing. Inspired by the comments received from Paolo Abeni as reply to v5 the driver now no longer caches bridge port membership in the driver, but instead imports an existing helper from yt921x.c to dsa.h in order to allow the driver to easily iterate over bridge members. The mapping between DSA bridge num and firmware bridge ID is done using a simple fixed-size array in mxl862xx_priv. ==================== Link: https://patch.msgid.link/cover.1775049897.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 340bdf984613c4a9241d678915e513824f5a9b19 Author: Daniel Golle Date: Wed Apr 1 14:35:01 2026 +0100 net: dsa: mxl862xx: implement bridge offloading Implement joining and leaving bridges as well as add, delete and dump operations on isolated FDBs, port MDB membership management, and setting a port's STP state. The switch supports a maximum of 63 bridges, however, up to 12 may be used as "single-port bridges" to isolate standalone ports. Allowing up to 48 bridges to be offloaded seems more than enough on that hardware, hence that is set as max_num_bridges. A total of 128 bridge ports are supported in the bridge portmap, and virtual bridge ports have to be used eg. for link-aggregation, hence potentially exceeding the number of hardware ports. The firmware-assigned bridge identifier (FID) for each offloaded bridge is stored in an array used to map DSA bridge num to firmware bridge ID, avoiding the need for a driver-private bridge tracking structure. Bridge member portmaps are rebuilt on join/leave using dsa_switch_for_each_bridge_member(). As there are now more users of the BRIDGEPORT_CONFIG_SET API and the state of each port is cached locally, introduce a helper function mxl862xx_set_bridge_port(struct dsa_switch *ds, int port) which applies the cached per-port state to hardware. For standalone user ports (dp->bridge == NULL), it additionally resets the port to single-port bridge state: CPU-only portmap, learning and flooding disabled. The CPU port path sets its state explicitly before calling this helper and is therefore not affected by the reset. Note that MASK_VLAN_BASED_MAC_LEARNING is intentionally absent from the firmware write mask. After mxl862xx_reset(), the firmware initialises all VLAN-based MAC learning fields to 0 (disabled), so SVL is the active mode by default without having to set it explicitly. Note that there is no convenient way to control flooding on per-port level, so the driver is using a 0-rate QoS meter setup as a stopper in lack of any better option. In order to be perfect the firmware-enforced minimum bucket size is bypassed by directly writing 0s to the relevant registers -- without that at least one 64-byte packet could still pass before the meter would change from 'yellow' into 'red' state. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/dd079180e2098e5f9626fcd149b9bad9a1b5a1b2.1775049897.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 4250ff1640ea1ede99bfe02ca949acbcc6c0927f Author: Daniel Golle Date: Wed Apr 1 14:34:52 2026 +0100 dsa: tag_mxl862xx: set dsa_default_offload_fwd_mark() The MxL862xx offloads bridge forwarding in hardware, so set dsa_default_offload_fwd_mark() to avoid duplicate forwarding of packets of (eg. flooded) frames arriving at the CPU port. Link-local frames are directly trapped to the CPU port only, so don't set dsa_default_offload_fwd_mark() on those. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/e1161c90894ddc519c57dc0224b3a0f6bfa1d2d6.1775049897.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit f259e08494c47c614ce7b6d3079d1e0d3f30ae66 Author: Daniel Golle Date: Wed Apr 1 14:34:42 2026 +0100 net: dsa: add bridge member iteration macro Drivers that offload bridges need to iterate over the ports that are members of a given bridge, for example to rebuild per-port forwarding bitmaps when membership changes. Currently drivers typically open-code this by combining dsa_switch_for_each_user_port() with a dsa_port_offloads_bridge_dev() check, or cache bridge membership within the driver. Add dsa_switch_for_each_bridge_member() macro to express this pattern directly, and use it for the existing dsa_bridge_ports() inline helper. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/e7136aaa26773f39e805a00fe4ecf13cd2b83fc0.1775049897.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit b0a79590d10847f190ed377d2664377d7068191d Author: Daniel Golle Date: Wed Apr 1 14:34:30 2026 +0100 net: dsa: move dsa_bridge_ports() helper to dsa.h The yt921x driver contains a helper to create a bitmap of ports which are members of a bridge. Move the helper as static inline function into dsa.h, so other driver can make use of it as well. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/4f8bbfce3e4e3a02064fc4dc366263136c6e0383.1775049897.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 98f28d8d6e5a5ed058dd37854c19e9b3bae72eff Author: Laurence Rowe Date: Thu Apr 2 13:49:18 2026 -0700 vsock: avoid timeout for non-blocking accept() with empty backlog A common pattern in epoll network servers is to eagerly accept all pending connections from the non-blocking listening socket after epoll_wait indicates the socket is ready by calling accept in a loop until EAGAIN is returned indicating that the backlog is empty. Scheduling a timeout for a non-blocking accept with an empty backlog meant AF_VSOCK sockets used by epoll network servers incurred hundreds of microseconds of additional latency per accept loop compared to AF_INET or AF_UNIX sockets. Signed-off-by: Laurence Rowe Reviewed-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20260402204918.130395-1-laurencerowe@gmail.com Signed-off-by: Jakub Kicinski commit c8eee00c0fef5f709b9114be432d7b3afebb4c0a Author: Daniel Zahka Date: Fri Apr 3 03:26:31 2026 -0700 psp: add missing device stats to get-stats reply attributes Commit f05d26198cf2 ("psp: add stats from psp spec to driver facing api") added device statistics (rx-packets, rx-bytes, rx-auth-fail, rx-error, rx-bad, tx-packets, tx-bytes, tx-error) to the stats attribute-set but did not add them to the get-stats operation reply attributes. The kernel reports these attributes in the reply, so list them in the spec to match. Signed-off-by: Daniel Zahka Acked-by: Willem de Bruijn Link: https://patch.msgid.link/20260403-psp-yaml-fix-v1-1-dacee0663903@gmail.com Signed-off-by: Jakub Kicinski commit f32ba0963119b2520127077d72ebe7f6f8cb847f Author: Jeremy Kerr Date: Fri Apr 3 10:24:51 2026 +0800 net: mctp: defer creation of dst after source-address check Sashiko reports: > mctp_dst_from_route() increments the device reference count by calling > mctp_dev_hold(). When a valid route is found and dst is NULL, the > structure copy is bypassed and rc is set to 0. Instead of optimistically creating a dst from the final route (then releasing it if the saddr is invalid), perform the saddr check first. This means we don't have an unuecessary hold/release on the dev, which could leak if the dst pointer is NULL. No caller passes a NULL dst at present though (so the leak is not possible), but this is an intended use of mctp_dst_from_route(). Signed-off-by: Jeremy Kerr Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260403-dev-mctp-dst-defer-v1-1-9c2c55faf9e9@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit 70e32aadb5cab9ef706962e1293582ec03f89625 Author: Jeremy Kerr Date: Fri Apr 3 10:21:04 2026 +0800 net: mctp: tests: use actual address when creating dev with addr Sashiko reports: > This isn't a bug in the core networking code, but the addr parameter > appears to be ignored here. In mctp_test_create_dev_with_addr(), we are ignoring the addr argument and just using `8`. Use the passed address instead. All invocations use 8 anyway, so no effective change at present. Signed-off-by: Jeremy Kerr Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260403-dev-mctp-fix-test-addr-v1-1-b7fa789cdd9b@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit 3b45559f6c0af0eaf8a91dfc1037a423337cf21d Author: Jakub Kicinski Date: Thu Apr 2 14:54:44 2026 -0700 selftests: net: py: color the basics in the output Sometimes it's hard to spot the ok / not ok lines in the output. This is especially true for the GRO tests which retries a lot so there's a wall of non-fatal output printed. Try to color the crucial lines green / red / yellow when running in a terminal. Acked-by: Stanislav Fomichev Reviewed-by: Willem de Bruijn Acked-by: Joe Damato Link: https://patch.msgid.link/20260402215444.1589893-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 42e33c9af49c5199504bbfb16f65756a90fe90bf Merge: a1aa9ef47c299c 171580e432727a Author: Alexei Starovoitov Date: Mon Apr 6 15:27:27 2026 -0700 Merge branch 'allow-variable-offsets-for-syscall-ptr_to_ctx' Kumar Kartikeya Dwivedi says: ==================== Allow variable offsets for syscall PTR_TO_CTX Enable pointer modification with variable offsets accumulated in the register for PTR_TO_CTX for syscall programs where it won't be rewritten, and the context is user-supplied and checked against the max offset. See patches for details. Fixed offset support landed in [0]. By combining this set with [0], examples like the one below should succeed verification now. SEC("syscall") int prog(void *ctx) { int *arr = ctx; int i; bpf_for(i, 0, 100) arr[i] *= i; return 0; } [0]: https://lore.kernel.org/bpf/20260227005725.1247305-1-memxor@gmail.com Changelog: ---------- v4 -> v5 v4: https://lore.kernel.org/bpf/20260401122818.2240807-1-memxor@gmail.com * Use is_var_ctx_off_allowed() consistently. * Add acks. (Emil) v3 -> v4 v3: https://lore.kernel.org/bpf/20260318103526.2590079-1-memxor@gmail.com * Drop comment around describing choice of fixed or variable offsets. (Eduard) * Simplify offset adjustment for different cases. (Eduard) * Add PTR_TO_CTX case in __check_mem_access(). (Eduard) * Drop aligned access constraint from syscall_prog_is_valid_access(). * Wrap naked checks for BPF_PROG_TYPE_SYSCALL in a utility function. (Eduard) * Split tests into separate clean up and addition patches. (Eduard) * Remove CAP_SYS_ADMIN changes. (Eduard) * Enable unaligned access to syscall ctx, add tests. * Add more tests for various corner cases. * Add acks. (Puranjay, Mykyta) v2 -> v3 v2: https://lore.kernel.org/bpf/20260318075133.1031781-1-memxor@gmail.com * Prevent arg_type for KF_ARG_PTR_TO_CTX from applying to other cases due to preceding fallthrough. (Gemini/Sashiko) v1 -> v2 v1: https://lore.kernel.org/bpf/20260317111850.2107846-2-memxor@gmail.com * Harden check_func_arg_reg_off check with ARG_PTR_TO_CTX. * Add tests for unmodified ctx into tail calls. * Squash unmodified ctx change into base commit. * Add Reviewed-by's from Emil. ==================== Link: https://patch.msgid.link/20260406194403.1649608-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 171580e432727a9e729f286075ee86070424f490 Author: Kumar Kartikeya Dwivedi Date: Mon Apr 6 21:44:01 2026 +0200 selftests/bpf: Add tests for syscall ctx accesses beyond U16_MAX Ensure we reject programs that access beyond the maximum syscall ctx size, i.e. U16_MAX either through direct accesses or helpers/kfuncs. Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260406194403.1649608-8-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 0dca817f4dbd45aa82b5bffb3b380e5409addba8 Author: Kumar Kartikeya Dwivedi Date: Mon Apr 6 21:44:00 2026 +0200 selftests/bpf: Add tests for unaligned syscall ctx accesses Add coverage for unaligned access with fixed offsets and variable offsets, and through helpers or kfuncs. Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260406194403.1649608-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 02c68b10d84f133b88ebf160de49cb3fa4290d97 Author: Kumar Kartikeya Dwivedi Date: Mon Apr 6 21:43:59 2026 +0200 selftests/bpf: Test modified syscall ctx for ARG_PTR_TO_CTX Ensure that global subprogs and tail calls can only accept an unmodified PTR_TO_CTX for syscall programs. For all other program types, fixed or variable offsets on PTR_TO_CTX is rejected when passed into an argument of any call instruction type, through the unified logic of check_func_arg_reg_off. Finally, add a positive example of a case that should succeed with all our previous changes. Reviewed-by: Emil Tsalapatis Acked-by: Puranjay Mohan Acked-by: Mykyta Yatsenko Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260406194403.1649608-6-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 5a34139b273272af2badcb695931493ed400befc Author: Kumar Kartikeya Dwivedi Date: Mon Apr 6 21:43:58 2026 +0200 selftests/bpf: Add syscall ctx variable offset tests Add various tests to exercise fixed and variable offsets on PTR_TO_CTX for syscall programs, and cover disallowed cases for other program types lacking convert_ctx_access callback. Load verifier_ctx with CAP_SYS_ADMIN so that kfunc related logic can be tested. While at it, convert assembly tests to C. Unfortunately, ctx_pointer_to_helper_2's unpriv case conflicts with usage of kfuncs in the file and cannot be run. Reviewed-by: Emil Tsalapatis Acked-by: Puranjay Mohan Acked-by: Mykyta Yatsenko Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260406194403.1649608-5-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 02f500ce0109ec553864507da685bd5fbc906e94 Author: Kumar Kartikeya Dwivedi Date: Mon Apr 6 21:43:57 2026 +0200 selftests/bpf: Convert ctx tests from ASM to C Convert existing tests from ASM to C, in prep for future changes to add more comprehensive tests. Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260406194403.1649608-4-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit f25777056e24c5e724935b94a9a1aa16641be49a Author: Kumar Kartikeya Dwivedi Date: Mon Apr 6 21:43:56 2026 +0200 bpf: Enable unaligned accesses for syscall ctx Don't reject usage of fixed unaligned offsets for syscall ctx. Tests will be added in later commits. Unaligned offsets already work for variable offsets. Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260406194403.1649608-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit ae5ef001aa981e7ee0993e51b642bb2179711c7a Author: Kumar Kartikeya Dwivedi Date: Mon Apr 6 21:43:55 2026 +0200 bpf: Support variable offsets for syscall PTR_TO_CTX Allow accessing PTR_TO_CTX with variable offsets in syscall programs. Fixed offsets are already enabled for all program types that do not convert their ctx accesses, since the changes we made in the commit de6c7d99f898 ("bpf: Relax fixed offset check for PTR_TO_CTX"). Note that we also lift the restriction on passing syscall context into helpers, which was not permitted before, and passing modified syscall context into kfuncs. The structure of check_mem_access can be mostly shared and preserved, but we must use check_mem_region_access to correctly verify access with variable offsets. The check made in check_helper_mem_access is hardened to only allow PTR_TO_CTX for syscall programs to be passed in as helper memory. This was the original intention of the existing code anyway, and it makes little sense for other program types' context to be utilized as a memory buffer. In case a convincing example presents itself in the future, this check can be relaxed further. We also no longer use the last-byte access to simulate helper memory access, but instead go through check_mem_region_access. Since this no longer updates our max_ctx_offset, we must do so manually, to keep track of the maximum offset at which the program ctx may be accessed. Take care to ensure that when arg_type is ARG_PTR_TO_CTX, we do not relax any fixed or variable offset constraints around PTR_TO_CTX even in syscall programs, and require them to be passed unmodified. There are several reasons why this is necessary. First, if we pass a modified ctx, then the global subprog's accesses will not update the max_ctx_offset to its true maximum offset, and can lead to out of bounds accesses. Second, tail called program (or extension program replacing global subprog) where their max_ctx_offset exceeds the program they are being called from can also cause issues. For the latter, unmodified PTR_TO_CTX is the first requirement for the fix, the second is ensuring max_ctx_offset >= the program they are being called from, which has to be a separate change not made in this commit. All in all, we can hint using arg_type when we expect ARG_PTR_TO_CTX and make our relaxation around offsets conditional on it. Drop coverage of syscall tests from verifier_ctx.c temporarily for negative cases until they are updated in subsequent commits. Reviewed-by: Emil Tsalapatis Acked-by: Puranjay Mohan Acked-by: Mykyta Yatsenko Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260406194403.1649608-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 8f260b02eeeffbf2263c2b82b6e3e32fd73cde2b Author: David Gow Date: Sat Feb 28 18:07:22 2026 +0800 kunit: tool: Terminate kernel under test on SIGINT kunit.py will attempt to catch SIGINT / ^C in order to ensure the TTY isn't messed up, but never actually attempts to terminate the running kernel (be it UML or QEMU). This can lead to a bit of frustration if the kernel has crashed or hung. Terminate the kernel process in the signal handler, if it's running. This requires plumbing through the process handle in a few more places (and having some checks to see if the kernel is still running in places where it may have already been killed). Reported-by: Andy Shevchenko Closes: https://lore.kernel.org/all/aaFmiAmg9S18EANA@smile.fi.intel.com/ Signed-off-by: David Gow Reviewed-by: Andy Shevchenko Tested-by: Andy Shevchenko Signed-off-by: Shuah Khan commit e42c349f4cdfa43cb39a68c8f764f8cafc23a9a9 Author: Shuvam Pandey Date: Fri Feb 27 18:16:36 2026 +0545 kunit: tool: skip stty when stdin is not a tty run_kernel() cleanup and signal_handler() invoke stty unconditionally. When stdin is not a tty (for example in CI or unit tests), this writes noise to stderr. Call stty only when stdin is a tty. Add regression tests for these paths: - run_kernel() with non-tty stdin - signal_handler() with non-tty stdin - signal_handler() with tty stdin Signed-off-by: Shuvam Pandey Reviewed-by: David Gow Signed-off-by: Shuah Khan commit b73f50ffd4bddcd42b312a6c2b3d990f2cde7bf7 Author: David Gow Date: Fri Feb 27 18:56:49 2026 +0800 kunit: tool: Recommend --raw_output=all if no KTAP found If no KTAP header is found in the kernel output (e.g., because the kernel crashed before the KUnit executor was run), it's very useful to re-run the test with --raw_output=all, as that will show any error output (such as a stacktrace, log message, BUG, etc). This is not particularly intuitive, however, as --raw_output=all is not well known. Add an extra log line to advertise --raw_output=all in this case, as it's a terrible user experience to just get "Did any KUnit tests run?" Signed-off-by: David Gow Reviewed-by: Andy Shevchenko Signed-off-by: Shuah Khan commit b5f92fc4a7ac57c88a4ac600cf401171b3ea3b5f Author: Ryota Sakamoto Date: Fri Feb 13 01:37:32 2026 +0900 kunit: Add --list_suites to show suites Currently, kunit.py allows listing all individual tests via --list_tests. However, users often need to see only the available test suites. Add --list_suites to show suites. This option parses the test list output from the kernel and prints only the suite names. Example of the output of --list_suites: example_init miscdev_init printk-ringbuffer Signed-off-by: Ryota Sakamoto Reviewed-by: David Gow Signed-off-by: Shuah Khan commit e9b004ff83067cdf96774b45aea4b239ace99a2f Author: Yuto Ohnuki Date: Mon Mar 16 07:03:59 2026 +0000 blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default() wbt_init_enable_default() uses WARN_ON_ONCE to check for failures from wbt_alloc() and wbt_init(). However, both are expected failure paths: - wbt_alloc() can return NULL under memory pressure (-ENOMEM) - wbt_init() can fail with -EBUSY if wbt is already registered syzbot triggers this by injecting memory allocation failures during MTD partition creation via ioctl(BLKPG), causing a spurious warning. wbt_init_enable_default() is a best-effort initialization called from blk_register_queue() with a void return type. Failure simply means the disk operates without writeback throttling, which is harmless. Replace WARN_ON_ONCE with plain if-checks, consistent with how wbt_set_lat() in the same file already handles these failures. Add a pr_warn() for the wbt_init() failure to retain diagnostic information without triggering a full stack trace. Reported-by: syzbot+71fcf20f7c1e5043d78c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=71fcf20f7c1e5043d78c Fixes: 41afaeeda509 ("blk-wbt: fix possible deadlock to nest pcpu_alloc_mutex under q_usage_counter") Signed-off-by: Yuto Ohnuki Reviewed-by: Yu Kuai Reviewed-by: Nilay Shroff Link: https://patch.msgid.link/20260316070358.65225-2-ytohnuki@amazon.com Signed-off-by: Jens Axboe commit a4f61f0a1afdb3c07025b91379f5c46dd89eb817 Author: Andrea Righi Date: Mon Apr 6 13:47:55 2026 +0200 sched_ext: Documentation: Add ops.dequeue() to task lifecycle Document ops.dequeue() in the sched_ext task lifecycle now that its semantics are well-defined. Also update the pseudo-code to use task_is_runnable() consistently and clarify the case where ops.dispatch() does not refill the time slice. Signed-off-by: Andrea Righi Reviewed-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit a3c3fb2f86f8a1f266747622037f90eab58186ad Author: Cheng-Yang Chou Date: Tue Mar 31 17:18:33 2026 +0800 tools/sched_ext: Fix off-by-one in scx_sdt payload zeroing scx_alloc_free_idx() zeroes the payload of a freed arena allocation one word at a time. The loop bound was alloc->pool.elem_size / 8, but elem_size includes sizeof(struct sdt_data) (the 8-byte union sdt_id header). This caused the loop to write one extra u64 past the allocation, corrupting the tid field of the adjacent pool element. Fix the loop bound to (elem_size - sizeof(struct sdt_data)) / 8 so only the payload portion is zeroed. Test plan: - Add a temporary sanity check in scx_task_free() before the free call: if (mval->data->tid.idx != mval->tid.idx) scx_bpf_error("tid corruption: arena=%d storage=%d", mval->data->tid.idx, (int)mval->tid.idx); - stress-ng --fork 100 -t 10 & sudo ./build/bin/scx_sdt Without this fix, running scx_sdt under fork-heavy load triggers the corruption error. With the fix applied, the same workload completes without error. Fixes: 36929ebd17ae ("tools/sched_ext: add arena based scheduler") Signed-off-by: Cheng-Yang Chou Reviewed-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit 08b96aa962209de015de6c4a51e8cadbd1b21d0a Author: Thomas Weißschuh Date: Sat Apr 4 14:59:03 2026 +0200 selftests/nolibc: only use libgcc when really necessary nolibc should work without libgcc to be compatible with as many toolchains as possible. Currently the functionality tested by nolibc-test does not contain any dependencies, make sure it stays this way by not linking libgcc anymore. On the ppc target GCC always emits references to '_restgpr_' functions, so keep linking libgcc there. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260404-nolibc-libgcc-v1-1-eb3ecfe0e176@weissschuh.net commit e70a7bb5755997d845f641f5d46d8af4ea68fc8a Author: Thomas Weißschuh Date: Sat Apr 4 13:50:20 2026 +0200 selftests/nolibc: test the memory allocator The memory allocator has not seen any testing so far. Add a simple testcase for it. Suggested-by: Willy Tarreau Link: https://lore.kernel.org/lkml/adDRK8D6YBZgv36H@1wt.eu/ Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260404-nolibc-asprintf-v2-2-17d2d0df9763@weissschuh.net commit 1e3c374e9fd5ef0bf1ebcb866505b1aad404959e Author: Thomas Weißschuh Date: Sat Apr 4 13:50:19 2026 +0200 tools/nolibc: check for overflow in calloc() without divisions On some architectures without native division instructions the division can generate calls into libgcc/compiler-rt. This library might not be available, so its use should be avoided. Use the compiler builtin to check for overflows without needing a division. The builtin has been available since GCC 3 and clang 3.8. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260404-nolibc-asprintf-v2-1-17d2d0df9763@weissschuh.net commit 12496aad10c5671d66e160487326de942cd440ba Author: Thomas Weißschuh Date: Wed Apr 1 17:07:29 2026 +0200 tools/nolibc: add support for asprintf() Add support for dynamically allocating formatted strings through asprintf() and vasprintf(). Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260401-nolibc-asprintf-v1-3-46292313439f@weissschuh.net commit 16d021c878dca22532c984668c9e8cf4722d6a49 Author: Richard Cheng Date: Thu Apr 2 17:38:50 2026 +0800 PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports NPEM registers LED classdevs on PCI endpoint that may be behind hotplug-capable ports. During hot-removal, led_classdev_unregister() calls led_set_brightness(LED_OFF) which leads to a PCI config read to a disconnected device, which fails and returns -ENODEV (topology details in msgid.link below): leds 0003:01:00.0:enclosure:ok: Setting an LED's brightness failed (-19) The LED core already suppresses this for devices with LED_HW_PLUGGABLE set, but NPEM never sets it. Add the flag since NPEM LEDs are on hot-pluggable hardware by nature. Fixes: 4e893545ef87 ("PCI/NPEM: Add Native PCIe Enclosure Management support") Signed-off-by: Richard Cheng Signed-off-by: Bjorn Helgaas Reviewed-by: Lukas Wunner Acked-by: Kai-Heng Feng Link: https://patch.msgid.link/20260402093850.23075-1-icheng@nvidia.com commit 2fd3b83cacfb9160b896fb26117328eeb0598c54 Author: Kaushlendra Kumar Date: Thu Apr 2 21:45:32 2026 +0530 cpupower: remove extern declarations in cmd functions extern char *optarg and extern int optind, opterr, optopt are already declared by , which is included at the top of the file. Repeating extern declarations inside a function body is misleading and unnecessary. Signed-off-by: Kaushlendra Kumar Signed-off-by: Shuah Khan commit 88cc4cbe08bba27bb58888d25d336774aa0ccab1 Author: Franz Schnyder Date: Wed Mar 25 10:31:16 2026 +0100 PCI: imx6: Fix reference clock source selection for i.MX95 In the PCIe PHY init for the i.MX95, the reference clock source selection uses a conditional instead of always passing the mask. This currently breaks functionality if the internal refclk is used. To fix this issue, always pass IMX95_PCIE_REF_USE_PAD as the mask and clear bit if external refclk is not used. This essentially swaps the parameters. Fixes: d8574ce57d76 ("PCI: imx6: Add external reference clock input mode support") Signed-off-by: Franz Schnyder Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Acked-by: Richard Zhu Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260325093118.684142-1-fra.schnyder@gmail.com commit abdd2a86535b59c76d14da2547160bc83e059c03 Author: Chengwen Feng Date: Wed Apr 1 16:16:40 2026 +0800 PCI/TPH: Pass ACPI Processor UID to Cache Locality _DSM pcie_tph_get_cpu_st() uses the Query Cache Locality Features _DSM [1] to retrieve the TPH Steering Tag for memory associated with the CPU identified by its "cpu_uid" parameter, a Linux logical CPU ID. The _DSM requires an ACPI Processor UID, which pcie_tph_get_cpu_st() previously assumed was the same as the Linux logical CPU ID. This is true on x86 but not on arm64, so pcie_tph_get_cpu_st() returned the wrong Steering Tag, resulting in incorrect TPH functionality on arm64. Convert the Linux logical CPU ID to the ACPI Processor UID with acpi_get_cpu_uid() before passing it to the _DSM. Additionally, rename the pcie_tph_get_cpu_st() parameter from "cpu_uid" to "cpu" to reflect that it represents a logical CPU ID (not an ACPI Processor UID). [1] According to ECN_TPH-ST_Revision_20200924 (https://members.pcisig.com/wg/PCI-SIG/document/15470), the input is defined as: "If the target is a processor, then this field represents the ACPI Processor UID of the processor as specified in the MADT. If the target is a processor container, then this field represents the ACPI Processor UID of the processor container as specified in the PPTT." Fixes: d2e8a34876ce ("PCI/TPH: Add Steering Tag support") Signed-off-by: Chengwen Feng Reviewed-by: Jonathan Cameron Reviewed-by: Bjorn Helgaas Link: https://patch.msgid.link/20260401081640.26875-9-fengchengwen@huawei.com Signed-off-by: Rafael J. Wysocki commit a7034e9e4491573d268126a5e6991b83e95db560 Author: Chengwen Feng Date: Wed Apr 1 16:16:39 2026 +0800 ACPI: PPTT: Use acpi_get_cpu_uid() and remove get_acpi_id_for_cpu() Update acpi/pptt.c to use acpi_get_cpu_uid() and remove unused get_acpi_id_for_cpu() from arm64/loongarch/riscv, completing PPTT's migration to the unified ACPI CPU UID interface Signed-off-by: Chengwen Feng Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260401081640.26875-8-fengchengwen@huawei.com Signed-off-by: Rafael J. Wysocki commit 1ab03189793ffe60f184ce58ea7d0a4f0dcb7e06 Author: Chengwen Feng Date: Wed Apr 1 16:16:38 2026 +0800 perf: arm_cspmu: Switch to acpi_get_cpu_uid() from get_acpi_id_for_cpu() Update arm_cspmu to use acpi_get_cpu_uid() instead of get_acpi_id_for_cpu(), aligning with unified ACPI CPU UID interface. No functional changes are introduced by this switch (valid inputs retain original behavior). Signed-off-by: Chengwen Feng Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260401081640.26875-7-fengchengwen@huawei.com Signed-off-by: Rafael J. Wysocki commit f652d0a4e13c5f5416da15ba791b99c5d1ac9b18 Author: Chengwen Feng Date: Wed Apr 1 16:16:37 2026 +0800 ACPI: Centralize acpi_get_cpu_uid() declaration in include/linux/acpi.h Centralize acpi_get_cpu_uid() in include/linux/acpi.h (global scope) and remove arch-specific declarations from arm64/loongarch/riscv/x86 asm/acpi.h. This unifies the interface across architectures and simplifies maintenance by eliminating duplicate prototypes. Signed-off-by: Chengwen Feng Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260401081640.26875-6-fengchengwen@huawei.com Signed-off-by: Rafael J. Wysocki commit 3cfe889f8965ded727f3de38ee941b44978e1d9b Author: Chengwen Feng Date: Wed Apr 1 16:16:36 2026 +0800 x86/acpi: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval As a step towards unifying the interface for retrieving ACPI CPU UID across architectures, introduce a new function acpi_get_cpu_uid() for x86. While at it, add input validation to make the code more robust. Update Xen-related code to use acpi_get_cpu_uid() instead of the legacy cpu_acpi_id() function, and remove the now-unused cpu_acpi_id() to clean up redundant code. Signed-off-by: Chengwen Feng Reviewed-by: Jonathan Cameron Reviewed-by: Juergen Gross Link: https://patch.msgid.link/20260401081640.26875-5-fengchengwen@huawei.com Signed-off-by: Rafael J. Wysocki commit 0c8231994e43f445597166e8b342459079244d25 Author: Chengwen Feng Date: Wed Apr 1 16:16:35 2026 +0800 RISC-V: ACPI: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval As a step towards unifying the interface for retrieving ACPI CPU UID across architectures, introduce a new function acpi_get_cpu_uid() for riscv. While at it, add input validation to make the code more robust. And also update acpi_numa.c and rhct.c to use the new interface instead of the legacy get_acpi_id_for_cpu(). Signed-off-by: Chengwen Feng Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260401081640.26875-4-fengchengwen@huawei.com Signed-off-by: Rafael J. Wysocki commit d78ef9d2e1f2c7e0b69c102fc2867e8daa5612ed Author: Chengwen Feng Date: Wed Apr 1 16:16:34 2026 +0800 LoongArch: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval As a step towards unifying the interface for retrieving ACPI CPU UID across architectures, introduce a new function acpi_get_cpu_uid() for loongarch. While at it, add input validation to make the code more robust. Signed-off-by: Chengwen Feng Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260401081640.26875-3-fengchengwen@huawei.com Signed-off-by: Rafael J. Wysocki commit 7cd5f5659ac8e49811ef03cbfe8b4a2069abaa27 Author: Chengwen Feng Date: Wed Apr 1 16:16:33 2026 +0800 arm64: acpi: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval As a step towards unifying the interface for retrieving ACPI CPU UID across architectures, introduce a new function acpi_get_cpu_uid() for arm64. While at it, add input validation to make the code more robust. Reimplement get_cpu_for_acpi_id() based on acpi_get_cpu_uid() for consistency, and move its implementation next to the new function for code coherence. Signed-off-by: Chengwen Feng Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Link: https://patch.msgid.link/20260401081640.26875-2-fengchengwen@huawei.com Signed-off-by: Rafael J. Wysocki commit 56c1ec524284805da0181bc6e9ca656c0091b201 Author: Abel Vesa Date: Fri Mar 27 18:18:39 2026 +0200 remoteproc: qcom: pas: Add Eliza ADSP support The ADSP found on Eliza SoC is similar to the one found on SM8550. So just add the dedicated compatible for Eliza ADSP and reuse the SM8550 resource configuration. Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260327-eliza-remoteproc-adsp-v1-2-1c46c5e5f809@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d7610855b0b5e934a35dedb02047a2419bf00770 Author: Kai-Heng Feng Date: Mon Mar 30 17:41:57 2026 +0800 ACPI: APEI: GHES: Add NVIDIA vendor CPER record handler Add support for decoding NVIDIA-specific CPER sections delivered via the APEI GHES vendor record notifier chain. NVIDIA hardware generates vendor-specific CPER sections containing error signatures and diagnostic register dumps. This implementation registers a notifier_block with the GHES vendor record notifier and decodes these sections, printing error details via dev_info(). The driver binds to ACPI device NVDA2012, present on NVIDIA server platforms. The NVIDIA CPER section contains a fixed header with error metadata (signature, error type, severity, socket) followed by variable-length register address-value pairs for hardware diagnostics. This work is based on libcper [1]. Example output: nvidia-ghes NVDA2012:00: NVIDIA CPER section, error_data_length: 544 nvidia-ghes NVDA2012:00: signature: CMET-INFO nvidia-ghes NVDA2012:00: error_type: 0 nvidia-ghes NVDA2012:00: error_instance: 0 nvidia-ghes NVDA2012:00: severity: 3 nvidia-ghes NVDA2012:00: socket: 0 nvidia-ghes NVDA2012:00: number_regs: 32 nvidia-ghes NVDA2012:00: instance_base: 0x0000000000000000 nvidia-ghes NVDA2012:00: register[0]: address=0x8000000100000000 value=0x0000000100000000 https://github.com/openbmc/libcper/commit/683e055061ce [1] Reviewed-by: Jonathan Cameron Signed-off-by: Kai-Heng Feng [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260330094203.38022-4-kaihengf@nvidia.com Signed-off-by: Rafael J. Wysocki commit 35bdb5dbacf3ab4e4ee970ec2df2aa972ebbc21f Author: Kai-Heng Feng Date: Mon Mar 30 17:41:56 2026 +0800 PCI: hisi: Use devm_ghes_register_vendor_record_notifier() Switch to the device-managed variant so the notifier is automatically unregistered on device removal, allowing the open-coded remove callback to be dropped entirely. Signed-off-by: Kai-Heng Feng Acked-by: Manivannan Sadhasivam Reviewed-by: Shiju Jose Link: https://patch.msgid.link/20260330094203.38022-3-kaihengf@nvidia.com Signed-off-by: Rafael J. Wysocki commit 441fa10a5a1978e7a2f751f2d6f6a9194056262e Author: Kai-Heng Feng Date: Mon Mar 30 17:41:55 2026 +0800 ACPI: APEI: GHES: Add devm_ghes_register_vendor_record_notifier() Add a device-managed wrapper around ghes_register_vendor_record_notifier() so drivers can avoid manual cleanup on device removal or probe failure. Signed-off-by: Kai-Heng Feng Reviewed-by: Breno Leitao Reviewed-by: Shiju Jose Reviewed-by: Shuai Xue Link: https://patch.msgid.link/20260330094203.38022-2-kaihengf@nvidia.com Signed-off-by: Rafael J. Wysocki commit 7cf2f07f949c999f8c0349d1fa3f1f0e69854469 Author: Abel Vesa Date: Fri Mar 27 18:18:38 2026 +0200 dt-bindings: remoteproc: qcom,milos-pas: Document Eliza ADSP Since the devicetree bindings are exactly the same between Eliza ADSP and Milos ADSP, reuse the existing Milos schema, just add the Eliza specific ADSP compatible. Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260327-eliza-remoteproc-adsp-v1-1-1c46c5e5f809@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1b4eceb4829141ffa7de0255d5578d4bc3178563 Author: Shawn Guo Date: Fri Mar 6 22:56:07 2026 +0800 remoteproc: qcom: Add missing space before closing bracket Add missing space before closing curly bracket for qcom_q6v5_mss and qcom_q6v5_pas driver of_match[] lines, so that all qcom remoteproc drivers are consistent on the common coding style. Signed-off-by: Shawn Guo Link: https://lore.kernel.org/r/20260306145607.1394878-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 74eb6cd91aef968ee792575f10b438ae2f2a2bb2 Author: Shawn Guo Date: Mon Mar 9 20:33:57 2026 +0800 dt-bindings: remoteproc: qcom: Drop types for firmware-name The type of firmware-name is already defined by core schemas. Drop it from individual bindings that have either a redundant definition or an override as string type. For the later cases, constrain the number of expected firmware names to 1. Signed-off-by: Shawn Guo Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260309123357.1911586-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 743cfae79d2458e241b06ed523c28a09f1449b75 Author: Mukesh Ojha Date: Tue Mar 31 22:42:43 2026 +0530 remoteproc: qcom: Fix minidump out-of-bounds access on subsystems array MAX_NUM_OF_SS was hardcoded to 10 in the minidump_global_toc struct, which is a direct overlay on an SMEM item allocated by the firmware. Newer Qualcomm SoC firmware allocates space for more subsystems, while older firmware only allocates space for 10. Bumping the constant would cause Linux to read/write beyond the SMEM item boundary on older platforms. Fix this by converting subsystems[] to a flexible array member and deriving the actual number of subsystems at runtime from the size returned by qcom_smem_get(). Add a bounds check on minidump_id against the derived count before indexing into the array. Signed-off-by: Mukesh Ojha Acked-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260331171243.1962067-1-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ad5fd5aeb65a4426635cf55ef06c96e60a66e648 Author: Wolfram Sang Date: Wed Apr 1 09:11:40 2026 +0200 hwspinlock: remove now unused pdata from header file The last user turned out to be obsolete and was removed. Remove the unused struct now, too. Signed-off-by: Wolfram Sang Reviewed-by: Linus Walleij Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20260401071141.4718-3-wsa+renesas@sang-engineering.com Signed-off-by: Bjorn Andersson commit 392035c8b88b0198721e3b273f0a19ec2150710f Author: Wolfram Sang Date: Wed Apr 1 09:11:39 2026 +0200 hwspinlock: u8500: delete driver The U8500 platform was converted to DT around 2013 and is DT only meanwhile. This driver has never been converted to a DT driver, so it clearly hasn't been used since then. To ease upcoming refactoring in the hwspinlock subsystem, remove this obsolete driver. Signed-off-by: Wolfram Sang Reviewed-by: Linus Walleij Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20260401071141.4718-2-wsa+renesas@sang-engineering.com Signed-off-by: Bjorn Andersson commit 1b7cbe343349ec5aec6f3140820180c5bc00b14f Author: Xi Ruoyao Date: Wed Apr 1 21:53:12 2026 +0800 ACPI: tables: Enable FPDT on LoongArch FPDT provides system- and application-readable performance statistics, useful for profiling and analyzing boot-time performance. FPDT table support is now available as a pending patch at the EDK II upstream [1] and has been tested on real hardware such as Loongson XA61200_V1.1 and XB612B0_V1.2 with patched firmware. We have also cross checked systemd-analyze(1) against a stop watch and the `dp' command in EFI Shell to see that the timing information are correct. Now that the functionality of FPDT is verified on LoongArch hardware, list LOONGARCH as a possible dependency, allowing it to be enabled. Link: https://github.com/tianocore/edk2/pull/12378 [1] Signed-off-by: Xi Ruoyao [ rjw: Subject tweak ] Link: https://patch.msgid.link/20260401135311.1737958-2-xry111@xry111.site Signed-off-by: Rafael J. Wysocki commit 3e2fa997d1e2b651993ae7e81646aadd55470bce Author: Krzysztof Kozlowski Date: Tue Mar 17 13:36:54 2026 +0100 media: platform: mtk-mdp3: Constify buffer passed to mdp_vpu_sendmsg() mdp_vpu_sendmsg() passes the buffer to scp_ipi_send(), which takes now pointer to const, so adjust this interface as well for increased code safety and code readability. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260317-rpmsg-send-const-v3-5-4d7fd27f037f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 66ec83627902d2585e14911692b317496731767a Author: Krzysztof Kozlowski Date: Tue Mar 17 13:36:53 2026 +0100 ASoC: qcom: Constify GPR packet being send over GPR interface gpr_send_pkt() and pkt_router_send_svc_pkt() only send the GPR packet they receive, without any need to actually modify it, so mark the pointer to GPR packet as pointer to const for code safety and code self-documentation. Several users of this interface can follow up and also operate on pointer to const. Acked-by: Mathieu Poirier Acked-by: Mark Brown Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260317-rpmsg-send-const-v3-4-4d7fd27f037f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b8077b4da2e89917ec4c632b66e60d49089bbda3 Author: Krzysztof Kozlowski Date: Tue Mar 17 13:36:52 2026 +0100 rpmsg: Constify buffer passed to send API The rpmsg_send(), rpmsg_sendto() and other variants of sending interfaces should only send the passed data, without modifying its contents, so mark pointer 'data' as pointer to const. All users of this interface already follow this approach, so only the function declarations have to be updated. Acked-by: Mathieu Poirier Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260317-rpmsg-send-const-v3-3-4d7fd27f037f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 90dacbf4bf13410c727ffaca8fe3ce3276ae58c2 Author: Krzysztof Kozlowski Date: Tue Mar 17 13:36:51 2026 +0100 remoteproc: mtk_scp: Constify buffer passed to scp_send_ipi() scp_send_ipi() should only send the passed buffer, without modifying its contents, so mark pointer 'buf' as pointer to const. Acked-by: Mathieu Poirier Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260317-rpmsg-send-const-v3-2-4d7fd27f037f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4251dab9d176212afdf4ced263b59bc0d5292c7f Author: Krzysztof Kozlowski Date: Tue Mar 17 13:36:50 2026 +0100 remoteproc: mtk_scp_ipi: Constify buffer passed to scp_ipi_send() scp_ipi_send() should only send the passed buffer, without modifying its contents, so mark pointer 'buf' as pointer to const. Acked-by: Mathieu Poirier Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260317-rpmsg-send-const-v3-1-4d7fd27f037f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 320f9b1c6a942a73c26be56742ee1da04f893a4f Author: Uday Shankar Date: Sun Apr 5 22:25:31 2026 -0600 selftests: ublk: test that teardown after incomplete recovery completes Before the fix, teardown of a ublk server that was attempting to recover a device, but died when it had submitted a nonempty proper subset of the fetch commands to any queue would loop forever. Add a test to verify that, after the fix, teardown completes. This is done by: - Adding a new argument to the fault_inject target that causes it die after fetching a nonempty proper subset of the IOs to a queue - Using that argument in a new test while trying to recover an already-created device - Attempting to delete the ublk device at the end of the test; this hangs forever if teardown from the fault-injected ublk server never completed. It was manually verified that the test passes with the fix and hangs without it. Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Link: https://patch.msgid.link/20260405-cancel-v2-2-02d711e643c2@purestorage.com Signed-off-by: Jens Axboe commit 0842186d2c4e67d2f8c8c2d1d779e8acffd41b5b Author: Uday Shankar Date: Sun Apr 5 22:25:30 2026 -0600 ublk: reset per-IO canceled flag on each fetch If a ublk server starts recovering devices but dies before issuing fetch commands for all IOs, cancellation of the fetch commands that were successfully issued may never complete. This is because the per-IO canceled flag can remain set even after the fetch for that IO has been submitted - the per-IO canceled flags for all IOs in a queue are reset together only once all IOs for that queue have been fetched. So if a nonempty proper subset of the IOs for a queue are fetched when the ublk server dies, the IOs in that subset will never successfully be canceled, as their canceled flags remain set, and this prevents ublk_cancel_cmd from actually calling io_uring_cmd_done on the commands, despite the fact that they are outstanding. Fix this by resetting the per-IO cancel flags immediately when each IO is fetched instead of waiting for all IOs for the queue (which may never happen). Signed-off-by: Uday Shankar Fixes: 728cbac5fe21 ("ublk: move device reset into ublk_ch_release()") Reviewed-by: Ming Lei Reviewed-by: zhang, the-essence-of-life Link: https://patch.msgid.link/20260405-cancel-v2-1-02d711e643c2@purestorage.com Signed-off-by: Jens Axboe commit e810f1f8015f78e1e067f9f6f17110cd9e2420a1 Merge: 591cd656a1bf5e 3d2398f44a2d48 Author: Rafael J. Wysocki Date: Mon Apr 6 16:28:07 2026 +0200 Merge tag 'opp-updates-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull OPP updates for 7.1 from Viresh Kumar: "- Use performance level if available to distinguish between rates in debugfs (Manivannan Sadhasivam). - Fix scoped_guard in dev_pm_opp_xlate_required_opp() (Viresh Kumar)." * tag 'opp-updates-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: OPP: Move break out of scoped_guard in dev_pm_opp_xlate_required_opp() OPP: debugfs: Use performance level if available to distinguish between rates commit d7d36c3a0977400b3a727741bb0468403f5a0cbe Merge: 5cdfedf68e6ee3 8655a4e35cda55 Author: Rafael J. Wysocki Date: Mon Apr 6 16:25:16 2026 +0200 Merge tag 'cpufreq-arm-updates-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull CPUFreq Arm updates for 7.1 from Viresh Kumar: "- Update qcom-hw DT bindings to include Eliza hardware (Abel Vesa). - Update cpufreq-dt-platdev blocklist (Faruque Ansari). - Minor updates to driver and dt-bindings for Tegra (Thierry Reding and Rosen Penev). - Add MAINTAINERS entry for CPPC driver (Viresh Kumar)." * tag 'cpufreq-arm-updates-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: tegra194: remove COMPILE_TEST cpufreq: Add QCS8300 to cpufreq-dt-platdev blocklist cpufreq: Add MAINTAINERS entry for CPPC driver cpufreq: tegra194: Rename Tegra239 to Tegra238 dt-bindings: arm: nvidia: Document the Tegra238 CCPLEX cluster dt-bindings: cpufreq: qcom-hw: document Eliza cpufreq hardware commit b043657c35e52ec5cf1c9942462f4bfd91dfe256 Author: Luca Weiss Date: Fri Apr 3 15:52:47 2026 +0200 regulator: dt-bindings: qcom,qca6390-pmu: Document WCN6755 PMU Document the WCN6755 PMU using a fallback to WCN6750 since the two chips seem to be completely pin and software compatible. In fact the original downstream kernel just pretends the WCN6755 is a WCN6750. Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260403-milos-fp6-bt-wifi-v2-1-393322b27c5f@fairphone.com Signed-off-by: Mark Brown commit 881dd6b2ff82c6b0760c2bb5ca1de030608dd7c9 Author: Svyatoslav Ryhel Date: Mon Apr 6 10:51:13 2026 +0300 regulator: dt-bindings: regulator-max77620: convert to DT schema Convert regulator-max77620 devicetree bindings for the MAX77620 PMIC from TXT to YAML format. This patch does not change any functionality; the bindings remain the same. Signed-off-by: Svyatoslav Ryhel Acked-by: Mark Brown Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260406075114.25672-2-clamor95@gmail.com Signed-off-by: Mark Brown commit d78ddeb8938a366aabfabf60255c1a94de8d8ea1 Author: Kuninori Morimoto Date: Mon Apr 6 05:51:51 2026 +0000 ASoC: soc.h: remove unused card->pmdown_time commit f0fba2ad1b6b ("ASoC: multi-component - ASoC Multi-Component Support") has replaced "card->pmdown_time" to "rtd->pmdown_time". card->pmdown_time has been not used this 15 years. Let's remove it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87eckstz49.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 79b888ee4c6387bc07c5452bfd031cb985871a5f Author: Rong Zhang Date: Mon Mar 16 02:44:00 2026 +0800 MIPS: dts: loongson64g-package: Switch to Loongson UART driver Loongson64g is Loongson 3A4000, whose UART controller is compatible with Loongson 2K1500, which is NS16550A-compatible with an additional fractional frequency divisor register. Update the compatible strings to reflect this, so that 3A4000 can benefit from the fractional frequency divisor provided by loongson-uart. This is required on some devices, otherwise their UART can't work at some high baud rates, e.g., 115200. Tested on Loongson-LS3A4000-7A1000-NUC-SE with a 25MHz UART clock. Without fractional frequency divisor, the actual baud rate was 111607 (25MHz / 16 / 14, measured value: 111545) and some USB-to-UART converters couldn't work with it at all. With fractional frequency divisor, the measured baud rate becomes 115207, which is quite accurate. Signed-off-by: Rong Zhang Signed-off-by: Thomas Bogendoerfer commit 2c4fdd055f92a2fc8602dcd88bcea08c374b7e8b Author: Cássio Gabriel Date: Wed Mar 25 17:05:11 2026 -0300 ASoC: SOF: compress: return the configured codec from get_params The SOF compressed offload path accepts codec parameters in sof_compr_set_params() and forwards them to firmware as extended data in the SOF IPC stream params message. However, sof_compr_get_params() still returns success without filling the snd_codec structure. Since the compress core allocates that structure zeroed and copies it back to userspace on success, SNDRV_COMPRESS_GET_PARAMS returns an all-zero codec description even after the stream has been configured successfully. The stale TODO in this callback conflates get_params() with capability discovery. Supported codec enumeration belongs in get_caps() and get_codec_caps(). get_params() should report the current codec settings. Cache the codec accepted by sof_compr_set_params() in the per-stream SOF compress state and return it from sof_compr_get_params(). Fixes: 6324cf901e14 ("ASoC: SOF: compr: Add compress ops implementation") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260325-sof-compr-get-params-v1-1-0758815f13c7@gmail.com Signed-off-by: Mark Brown commit b481eabe5a193ba8499f446c2ab7e0ac042f8776 Author: Ravi Hothi Date: Thu Mar 26 17:05:31 2026 +0530 ASoC: qcom: audioreach: explicitly enable speaker protection modules Speaker protection and VI feedback modules are disabled by default. Explicitly enable them when configuring speaker protection. Fixes: 3e43a8c033c3 ("ASoC: qcom: audioreach: Add support for VI Sense module") Fixes: 0db76f5b2235 ("ASoC: qcom: audioreach: Add support for Speaker Protection module") Signed-off-by: Ravi Hothi Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260326113531.3144998-1-ravi.hothi@oss.qualcomm.com Signed-off-by: Mark Brown commit 2300d68e577909c7d3013910ff818e8572288491 Author: Shiji Yang Date: Wed Jun 18 11:42:07 2025 +0800 mips: pci-mt7620: rework initialization procedure Move the reset operation to the common part to reduce the code redundancy. They are actually the same and needed for all SoCs. Disabling power and clock are unnecessary for MT7620 and will be removed. In vendor SDK, it's used to save the power when the PCI driver is not selected. The MT7628 GPIO pinctrl has been removed because this should be done in device-tree. Some delay intervals have also been increased to follow the recommendations of the SoC SDK and datasheet. Tested on both MT7620 and MT7628. Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit c2631cc4508c2e331759b0e5481a03d6b4b76346 Author: Shiji Yang Date: Wed Jun 18 11:42:06 2025 +0800 mips: pci-mt7620: add more register init values These missing register init values are ported from the vendor SDK. It should have some stability enhancements. Tested on both MT7620 and MT7628. Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit 3dbb08276836de58fc3097526c4bd9c3abe8f142 Author: Shiji Yang Date: Wed Jun 18 11:42:05 2025 +0800 mips: pci-mt7620: fix bridge register access Host bridge registers and PCI RC control registers have different memory base. pcie_m32() is used to write the RC control registers instead of bridge registers. This patch introduces bridge_m32() and use it to operate bridge registers to fix the access issue. Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit c7dd395d7b53a66de8503507fe7ef21b8fab3e57 Author: Caleb James DeLisle Date: Mon Mar 9 13:18:18 2026 +0000 mips: dts: Add PCIe to EcoNet EN751221 Add PCIe based on EN7528 PCIe driver, also add two MT76 wifi devices to SmartFiber XP8421-B. Signed-off-by: Caleb James DeLisle Signed-off-by: Thomas Bogendoerfer commit ff8efe28bb3a184422c71553675385625c710c10 Author: Théo Lebrun Date: Wed Feb 25 17:55:24 2026 +0100 MIPS: mobileye: eyeq5-epm: add two Cadence GEM Ethernet PHYs The Mobileye EyeQ5 eval board (EPM) embeds two MDIO PHYs. Reviewed-by: Andrew Lunn Acked-by: Thomas Bogendoerfer Signed-off-by: Théo Lebrun Signed-off-by: Thomas Bogendoerfer commit a692761a8e7b0c1abce92af476972357765f69c7 Author: Théo Lebrun Date: Wed Feb 25 17:55:23 2026 +0100 MIPS: mobileye: eyeq5: add two Cadence GEM Ethernet controllers Add both MACB/GEM instances found in the Mobileye EyeQ5 SoC. Acked-by: Thomas Bogendoerfer Signed-off-by: Théo Lebrun Signed-off-by: Thomas Bogendoerfer commit 7d1b6b70927e0b65e2768c3f625f9da60635efad Author: Théo Lebrun Date: Wed Feb 25 17:55:22 2026 +0100 dt-bindings: soc: mobileye: OLB is an Ethernet PHY provider on EyeQ5 OLB on EyeQ5 ("mobileye,eyeq5-olb" compatible) is now declared as a generic PHY provider. Under the hood, it provides Ethernet RGMII/SGMII PHY support for both MAC instances. Acked-by: Conor Dooley Signed-off-by: Théo Lebrun Signed-off-by: Thomas Bogendoerfer commit 247d1c13992d2c501e2e020e84d9d2920e11bf78 Author: Sheetal Date: Mon Apr 6 09:05:47 2026 +0000 ASoC: rt5640: Handle 0Hz sysclk during stream shutdown Commit 2458adb8f92a ("SoC: simple-card-utils: set 0Hz to sysclk when shutdown") sends a 0Hz sysclk request during stream shutdown to clear codec rate constraints. The rt5640 codec forwards this 0Hz to clk_set_rate(), which can cause clock controller firmware faults on platforms where MCLK is SoC-driven (e.g. Tegra) and 0Hz falls below the hardware minimum rate. Handle the 0Hz case by clearing the internal sysclk state and returning early, avoiding the invalid clk_set_rate() call. Signed-off-by: Sheetal Link: https://patch.msgid.link/20260406090547.988966-1-sheetal@nvidia.com Signed-off-by: Mark Brown commit c523378ce6f65298fc1cb6be7c0e59a9008be446 Author: Maciej W. Rozycki Date: Sat Mar 28 15:50:05 2026 +0000 MIPS: DEC: Rate-limit memory errors for non-KN01 parity systems Similarly to memory errors in ECC systems also rate-limit memory parity errors for KN02-BA, KN02-CA, KN04-BA, KN04-CA DECstation and DECsystem models. Unlike with ECC these events are always fatal and are less likely to cause a message flood, but handle them the same way for consistency. Signed-off-by: Maciej W. Rozycki Signed-off-by: Thomas Bogendoerfer commit 798715fa06e1b3ff0f672721cca0a6789d5ebd37 Author: Maciej W. Rozycki Date: Sat Mar 28 15:50:01 2026 +0000 MIPS: DEC: Rate-limit memory errors for KN01 systems Similarly to memory errors in ECC systems also rate-limit memory parity errors for KN01 DECstation and DECsystem models. Unlike with ECC these events are always fatal and are less likely to cause a message flood, but handle them the same way for consistency. Signed-off-by: Maciej W. Rozycki Signed-off-by: Thomas Bogendoerfer commit 56236b7f6f4461e2aa1d1210de14e91c61601e53 Author: Maciej W. Rozycki Date: Sat Mar 28 15:49:57 2026 +0000 MIPS: DEC: Rate-limit memory errors for ECC systems Prevent the system from becoming unusable due to a flood of memory error messages with DECstation and DECsystem models using ECC, that is KN02, KN03 and KN05 systems. It seems common for gradual oxidation of memory module contacts to cause memory errors to eventually develop and while ECC takes care of correcting them and the system affected can continue operating normally until the contacts have been cleaned, the unlimited messages make the system spend all its time on producing them, therefore preventing it from being used. Rate-limiting removes the load from the system and enables its normal operation, e.g.: Bus error interrupt: CPU memory read ECC error at 0x139cfb04 ECC syndrome 0x54 -- corrected single bit error at data bit D3 Bus error interrupt: CPU partial memory write ECC error at 0x138c1f5c ECC syndrome 0x54 -- corrected single bit error at data bit D3 Bus error interrupt: CPU partial memory write ECC error at 0x138c1f6c ECC syndrome 0x54 -- corrected single bit error at data bit D3 Bus error interrupt: CPU memory read ECC error at 0x139cff64 ECC syndrome 0x54 -- corrected single bit error at data bit D3 Bus error interrupt: CPU memory read ECC error at 0x136af00c ECC syndrome 0x54 -- corrected single bit error at data bit D3 Bus error interrupt: CPU memory read ECC error at 0x136af044 ECC syndrome 0x54 -- corrected single bit error at data bit D3 Bus error interrupt: CPU memory read ECC error at 0x136af0cc ECC syndrome 0x54 -- corrected single bit error at data bit D3 Bus error interrupt: CPU memory read ECC error at 0x136af0cc ECC syndrome 0x54 -- corrected single bit error at data bit D3 Bus error interrupt: CPU memory read ECC error at 0x136af0e4 ECC syndrome 0x54 -- corrected single bit error at data bit D3 Bus error interrupt: CPU memory read ECC error at 0x136af104 ECC syndrome 0x54 -- corrected single bit error at data bit D3 dec_ecc_be_backend: 34455 callbacks suppressed Signed-off-by: Maciej W. Rozycki Signed-off-by: Thomas Bogendoerfer commit a163a96d4afb29c0783b4a3a26ff64440713f514 Author: Maciej W. Rozycki Date: Sat Mar 28 14:29:10 2026 +0000 MIPS: kernel: Remove $0 clobber from `mult_sh_align_mod' Remove rubbish $0 clobber added to inline asm within `mult_sh_align_mod' with the removal of support for GCC versions below 3.4 made with commit 57810ecb581a ("MIPS: Remove GCC_IMM_ASM & GCC_REG_ACCUM macros"). Previously a macro was used that, depending on GCC version, expanded to either `accum' or $0. Since the latter choice was only a placeholder to keep the syntax consistent and the register referred is hardwired, there is no point in having it here as it has no effect on code generation. Signed-off-by: Maciej W. Rozycki Signed-off-by: Thomas Bogendoerfer commit 71451b7105c777429de9bd3961666f02edd4f40e Author: Thomas Zimmermann Date: Wed Apr 1 10:27:57 2026 +0200 arch/mips: Drop CONFIG_FIRMWARE_EDID from defconfig files CONFIG_FIRMWARE_EDID=y depends on X86 or EFI_GENERIC_STUB. Neither is true here, so drop the lines from the defconfig files. Signed-off-by: Thomas Zimmermann Signed-off-by: Thomas Bogendoerfer commit a5a1804332afc7035d5c5b880548262e81d796bc Author: Alexander Usyskin Date: Sun Apr 5 17:17:58 2026 +0300 mei: me: add nova lake point H DID Add Nova Lake H device id. Cc: stable Co-developed-by: Tomas Winkler Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260405141758.1634556-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 773a43b8627f54dca56d08949497014b4ee8878a Author: Alexander Usyskin Date: Sun Apr 5 14:23:26 2026 +0300 mei: lb: add late binding version 2 The second Late Binding version allows to send payload bigger than client MTU by splitting it to chunks and uses separate firmware client for transfer. The component interface is unchanged and driver doing all splitting. Only one Late Binding version is supported by firmware. When Late binding version 2 is supported, the new client is advertised by firmware and existing MKHI will have version 2. This helps driver to select the right mode of work. Reviewed-by: Andy Shevchenko Reviewed-by: Badal Nilawar Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260405112326.1535208-3-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 3031b76d65e14a946cfb5000d79b642f58ffac5c Author: Alexander Usyskin Date: Sun Apr 5 14:23:25 2026 +0300 mei: bus: add mei_cldev_uuid Add mei_cldev_uuid API on mei bus to allow client to query what UUID it bound to. Reviewed-by: Andy Shevchenko Reviewed-by: Badal Nilawar Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260405112326.1535208-2-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 1b64e52380abfd368baa8a53d73336ffcd52c0c0 Author: Cássio Gabriel Date: Mon Apr 6 00:20:06 2026 -0300 ALSA: gusmax: add ISA suspend and resume callbacks gusmax still leaves its ISA PM callbacks disabled even though the shared GF1 suspend and resume path now exists. This board needs one extra piece of PM glue around the shared GF1 helpers. The attached WSS codec has its own register image that must be saved and restored across suspend, and the MAX control register must be rewritten on resume before the codec and GF1 sides are brought back. Use the existing wss->suspend() and wss->resume() hooks for the codec, then wire the driver up to the shared GUS suspend and resume helpers for the GF1 side. Signed-off-by: Cássio Gabriel Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260406-b4-alsa-gus-isa-pm-v1-4-b6829a7457cd@gmail.com commit 7da8af2541d01ce1a7ad5efbb3fee8567fdfc959 Author: Cássio Gabriel Date: Mon Apr 6 00:20:05 2026 -0300 ALSA: gusextreme: add ISA suspend and resume callbacks gusextreme still leaves its ISA PM callbacks disabled because the shared GF1 core had no suspend and resume path suitable for PM recovery. Resume on this board needs one extra step before the shared GF1 path can touch the chip again: the ES1688 side must restore the GF1 routing. Split that routing sequence into a helper, reuse it for probe and resume, reset the ES1688 side first on resume, and then wire the driver up to the shared GUS PM helpers. This restores usable post-resume GF1 operation on GUS Extreme without rerunning probe-only detection in the shared GF1 path. Signed-off-by: Cássio Gabriel Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260406-b4-alsa-gus-isa-pm-v1-3-b6829a7457cd@gmail.com commit d9bfa935a9855664f5cea12131fa809fd56ff82c Author: Cássio Gabriel Date: Mon Apr 6 00:20:04 2026 -0300 ALSA: gusclassic: add ISA suspend and resume callbacks gusclassic still leaves its ISA PM callbacks disabled because the shared GF1 core had no suspend and resume path suitable for PM recovery. Wire the driver up to the new shared GUS suspend and resume helpers so a suspend/resume cycle restores usable GF1 operation without rerunning probe-only detection or tearing down the runtime bookkeeping kept by the card instance. Signed-off-by: Cássio Gabriel Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260406-b4-alsa-gus-isa-pm-v1-2-b6829a7457cd@gmail.com commit d38e9457ddf0780dd55c953886ae48abbe4d33b8 Author: Cássio Gabriel Date: Mon Apr 6 00:20:03 2026 -0300 ALSA: gus: add shared GF1 suspend and resume helpers gusclassic and gusextreme still leave their ISA PM callbacks disabled because the shared GF1 core only provides probe-time startup and full shutdown paths. Those helpers are not suitable for suspend and resume. They reset software handlers and tear down runtime state such as the DRAM allocator, timer state, DMA queues, PCM state and UART setup. Resume instead needs a narrower recovery path that rebuilds the GF1 hardware state without rerunning probe-only detection or discarding the bookkeeping kept by the card instance. Add shared GF1 suspend and resume helpers for that recovery path. Suspend now quiesces GF1 PCM, aborts queued GF1 DMA work, resets the UART and powers the chip down without tearing down allocator, timer or rawmidi bookkeeping. Resume rebuilds the GF1 hardware state, restores timer and UART handlers, and brings the chip back to a usable post-resume state for the ISA front-ends. The scope is limited to restoring post-resume usability. It does not attempt transparent continuation of active GF1 PCM or synth state across suspend, and userspace may still need to reprepare streams or reload onboard sample data after resume. Open rawmidi substreams are restored only to a usable post-resume state. Signed-off-by: Cássio Gabriel Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260406-b4-alsa-gus-isa-pm-v1-1-b6829a7457cd@gmail.com commit 7d61662197ecdc458e33e475b6ada7f6da61d364 Author: Harin Lee Date: Mon Apr 6 16:49:13 2026 +0900 ALSA: ctxfi: Add fallback to default RSR for S/PDIF spdif_passthru_playback_get_resources() uses atc->pll_rate as the RSR for the MSR calculation loop. However, pll_rate is only updated in atc_pll_init() and not in hw_pll_init(), so it remains 0 after the card init. When spdif_passthru_playback_setup() skips atc_pll_init() for 32000 Hz, (rsr * desc.msr) always becomes 0, causing the loop to spin indefinitely. Add fallback to use atc->rsr when atc->pll_rate is 0. This reflects the hardware state, since hw_card_init() already configures the PLL to the default RSR. Fixes: 8cc72361481f ("ALSA: SB X-Fi driver merge") Cc: stable@vger.kernel.org Signed-off-by: Harin Lee Link: https://patch.msgid.link/20260406074913.217374-1-me@harin.net Signed-off-by: Takashi Iwai commit e9418da50d9e5c496c22fe392e4ad74c038a94eb Author: Harin Lee Date: Mon Apr 6 16:48:57 2026 +0900 ALSA: ctxfi: Limit PTP to a single page Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEM_PTPAL registers, but using them separately would require refactoring the entire virtual memory allocation logic. ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When aggregate memory allocations exceed this limit, ct_vm_map() tries to access beyond the allocated space and causes a page fault: BUG: unable to handle page fault for address: ffffd4ae8a10a000 Oops: Oops: 0002 [#1] SMP PTI RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi] Call Trace: atc_pcm_playback_prepare+0x225/0x3b0 ct_pcm_playback_prepare+0x38/0x60 snd_pcm_do_prepare+0x2f/0x50 snd_pcm_action_single+0x36/0x90 snd_pcm_action_nonatomic+0xbf/0xd0 snd_pcm_ioctl+0x28/0x40 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count remain unchanged. Fixes: 391e69143d0a ("ALSA: ctxfi: Bump playback substreams to 256") Cc: stable@vger.kernel.org Signed-off-by: Harin Lee Link: https://patch.msgid.link/20260406074857.216034-1-me@harin.net Signed-off-by: Takashi Iwai commit 2428cd6e8b6fa80c36db4652702ca0acd2ce3f08 Author: Panagiotis Petrakopoulos Date: Mon Apr 6 01:25:48 2026 +0300 ALSA: scarlett2: Add missing sentinel initializer field A "-Wmissing-field-initializers" warning was emitted when compiling the module using the W=2 option. There is a sentinel initializer field missing in the end of scarlett2_devices[]. Tested using a Scarlett Solo 4th gen. Fixes: d98cc489029d ("ALSA: scarlett2: Move USB IDs out from device_info struct") Signed-off-by: Panagiotis Petrakopoulos Link: https://patch.msgid.link/20260405222548.8903-1-npetrakopoulos2003@gmail.com Signed-off-by: Takashi Iwai commit 7b5b7d04498d84bc7abc05b4e09a0d17c820d3b0 Author: songxiebing Date: Sun Apr 5 09:42:08 2026 +0800 ALSA: hda/realtek: Fix code style error Output of checkpatch shows error: ERROR: else should follow close brace '}' 2168: FILE: sound/hda/codecs/realtek/realtek.c:2168: + } + else So fix it. Signed-off-by: songxiebing Link: https://patch.msgid.link/20260405014208.167364-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai commit 9551af27f8167bbb5f862a12f7f9bc5830e8f4e1 Author: Cássio Gabriel Date: Fri Apr 3 00:47:13 2026 -0300 ALSA: aoa: onyx: Update IEC958 sample-rate status for PCM playback onyx_prepare() accepts 32/44.1/48 kHz PCM playback, but it leaves the Onyx IEC958 sample-rate status bits at the driver's initial 44.1 kHz setting in DIG_INFO3. As a result, 32 kHz and 48 kHz PCM streams advertise a stale IEC958 sample rate unless userspace rewrites IEC958 Playback Default first. Update only the consumer sample-frequency bits in DIG_INFO3 from the PCM runtime during prepare, resolving the long-standing FIXME in the PCM playback path while leaving the other user-controlled IEC958 status bits unchanged. Mark IEC958 Playback Default as volatile as well, since prepare() now changes the exposed register contents outside the control put callback. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260403-onyx-spdif-pcm-rate-v1-1-dcfaf931cf83@gmail.com Signed-off-by: Takashi Iwai commit 3723393cc284e09107c0f55c47458b75b29be2c3 Merge: 1df7a7652f032c 591cd656a1bf5e Author: Greg Kroah-Hartman Date: Mon Apr 6 09:06:39 2026 +0200 Merge tag 'v7.0-rc7' into usb-next We need the USB fixes in here to build on and for testing Signed-off-by: Greg Kroah-Hartman commit a5210135489ae7bc1ef1cb4a8157361dd7b468cd Merge: 68c6d134edbf08 591cd656a1bf5e Author: Greg Kroah-Hartman Date: Mon Apr 6 09:04:53 2026 +0200 Merge tag 'v7.0-rc7' into char-misc-next We need the char/misc/iio/comedi fixes in here as well for testing Signed-off-by: Greg Kroah-Hartman commit dc647eb00969cd213c84d6caee90c480317e857d Author: Namhyung Kim Date: Sat Apr 4 22:16:44 2026 -0700 perf test: Skip sched stats test for !root Running perf sched stats requires root and it fails to open the schedstat file for regular users. Let's skip the test. $ perf sched stats true Failed to open /proc/sys/kernel/sched_schedstats Reviewed-by: Ian Rogers Tested-by: Swapnil Sapkal Signed-off-by: Namhyung Kim commit c9ef786c0970991578397043f1c819229e2b7197 Author: Ian Rogers Date: Fri Apr 3 23:05:52 2026 -0700 perf cgroup: Update metric leader in evlist__expand_cgroup When the evlist is expanded the metric leader wasn't being updated. As the original evsel is deleted this creates a use-after-free in stat-shadow's prepare_metric. This was detected running the "perf stat --bpf-counters --for-each-cgroup test" with sanitizers. The change itself puts the copied evsel into the priv field (known unused because of evsel__clone use) and then in a second pass over the list updates the copied values using the priv pointer. Fixes: d1c5a0e86a4e ("perf stat: Add --for-each-cgroup option") Signed-off-by: Ian Rogers Acked-by: Sun Jian Signed-off-by: Namhyung Kim commit aeae075a0352eb6ab363fb1910f209eaa296a175 Author: Ian Rogers Date: Fri Apr 3 20:43:03 2026 -0700 perf sample: Add evsel to struct perf_sample Add the evsel from evsel__parse_sample into the struct perf_sample. Sometimes we want to alter the evsel associated with a sample, such as with off-cpu bpf-output events. In general the evsel and perf_sample are passed as a pair, but this makes an altered evsel something of a chore to keep checking for and setting up. Later patches will remove passing an evsel with the perf_sample and switch to just using the perf_sample's value. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit ad5ceacd48e9ea36bd12e778071561290adb0154 Author: Ian Rogers Date: Fri Apr 3 20:43:02 2026 -0700 perf sample: Make sure perf_sample__init/exit are used The deferred stack trace code wasn't using perf_sample__init/exit. Add the deferred stack trace clean up to perf_sample__exit which requires proper NULL initialization in perf_sample__init. Make the perf_sample__exit robust to being called more than once by using zfree. Make the error paths in evsel__parse_sample exit the sample. Add a merged_callchain boolean to capture that callchain is allocated, deferred_callchain doen't suffice for this. Pack the struct variables to avoid padding bytes for this. Similiarly powerpc_vpadtl_sample wasn't using perf_sample__init/exit, use it for consistency and potential issues with uninitialized variables. Similarly guest_session__inject_events in builtin-inject wasn't using perf_sample_init/exit. The lifetime management for fetched events is somewhat complex there, but when an event is fetched the sample should be initialized and needs exiting on error. The sample may be left in place so that future injects have access to it. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 8a7a23b27d55e036c2c54438d75878cf24bf95f6 Author: Ian Rogers Date: Fri Apr 3 20:43:01 2026 -0700 perf sample: Document struct perf_sample Add kernel-doc for struct perf_sample capturing the somewhat unusual population of fields and lifetime relationships. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit c66cf8c593c7603415415587077f8de93238544f Author: Ricky Ringler Date: Sat Apr 4 01:16:56 2026 +0000 perf tools: Save cln_size header Store cacheline size during perf record in header, so that cacheline size can be used for other features, like sort keys for perf report. Testing example with feat enabled: $ perf record ./Example $ perf report --header-only | grep -C 3 cacheline CPU_DOMAIN_INFO info available, use -I to display e_machine : 62 e_flags : 0 cacheline size: 64 missing features: TRACING_DATA BUILD_ID BRANCH_STACK GROUP_DESC AUXTRACE \ STAT CLOCKID DIR_FORMAT COMPRESSED CLOCK_DATA ======== [namhyung: Update the commit message and remove blank lines] Signed-off-by: Ricky Ringler Signed-off-by: Namhyung Kim commit f1d78f5c9bd4dfda5f12372a4b99e413272723d2 Author: Ian Rogers Date: Fri Mar 20 23:14:48 2026 -0700 perf tests sched stats: Write output to temp file Writing to the perf.data file can fail in various contexts such as continual test. Other tests write to a mktemp-ed file, make the "perf sched stats tests" follow this convention. Signed-off-by: Ian Rogers Tested-by: Swapnil Sapkal Signed-off-by: Namhyung Kim commit 7f5b8d5e6dde6d5019d03a46c02a6281a4d76a22 Author: Namhyung Kim Date: Sun Apr 5 22:18:16 2026 -0700 perf sched: Avoid crash for unexpected perf sched stats report Doing a `perf sched record` then `perf sched stats report` crashes as the tp_handler isn't set. Add a dummy tp_handler for it rather than adding an extra check. Reported-by: Ian Rogers Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit ddbf9c76c4020bf63a0799b00faad40caa3de6c2 Author: Jiakai Xu Date: Fri Apr 3 23:20:11 2026 +0000 RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request() The make_xfence_request() function uses a shift operation to check if a vCPU is in the hart mask: if (!(hmask & (1UL << (vcpu->vcpu_id - hbase)))) However, when the difference between vcpu_id and hbase is >= BITS_PER_LONG, the shift operation causes undefined behavior. This was detected by UBSAN: UBSAN: shift-out-of-bounds in arch/riscv/kvm/tlb.c:343:23 shift exponent 256 is too large for 64-bit type 'long unsigned int' Fix this by adding a bounds check before the shift operation. This bug was found by fuzzing the KVM RISC-V interface. Fixes: 13acfec2dbcc ("RISC-V: KVM: Add remote HFENCE functions based on VCPU requests") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20260403232011.2394966-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 2aa72276fab9851dbd59c2daeb4b590c5a113908 Author: Yu Kuai Date: Mon Mar 30 13:52:13 2026 +0800 md: fix array_state=clear sysfs deadlock When "clear" is written to array_state, md_attr_store() breaks sysfs active protection so the array can delete itself from its own sysfs store method. However, md_attr_store() currently drops the mddev reference before calling sysfs_unbreak_active_protection(). Once do_md_stop(..., 0) has made the mddev eligible for delayed deletion, the temporary kobject reference taken by sysfs_break_active_protection() can become the last kobject reference protecting the md kobject. That allows sysfs_unbreak_active_protection() to drop the last kobject reference from the current sysfs writer context. kobject teardown then recurses into kernfs removal while the current sysfs node is still being unwound, and lockdep reports recursive locking on kn->active with kernfs_drain() in the call chain. Reproducer on an existing level: 1. Create an md0 linear array and activate it: mknod /dev/md0 b 9 0 echo none > /sys/block/md0/md/metadata_version echo linear > /sys/block/md0/md/level echo 1 > /sys/block/md0/md/raid_disks echo "$(cat /sys/class/block/sdb/dev)" > /sys/block/md0/md/new_dev echo "$(($(cat /sys/class/block/sdb/size) / 2))" > \ /sys/block/md0/md/dev-sdb/size echo 0 > /sys/block/md0/md/dev-sdb/slot echo active > /sys/block/md0/md/array_state 2. Wait briefly for the array to settle, then clear it: sleep 2 echo clear > /sys/block/md0/md/array_state The warning looks like: WARNING: possible recursive locking detected bash/588 is trying to acquire lock: (kn->active#65) at __kernfs_remove+0x157/0x1d0 but task is already holding lock: (kn->active#65) at sysfs_unbreak_active_protection+0x1f/0x40 ... Call Trace: kernfs_drain __kernfs_remove kernfs_remove_by_name_ns sysfs_remove_group sysfs_remove_groups __kobject_del kobject_put md_attr_store kernfs_fop_write_iter vfs_write ksys_write Restore active protection before mddev_put() so the extra sysfs kobject reference is dropped while the mddev is still held alive. The actual md kobject deletion is then deferred until after the sysfs write path has fully returned. Fixes: 9e59d609763f ("md: call del_gendisk in control path") Reviewed-by: Xiao Ni Link: https://lore.kernel.org/linux-raid/20260330055213.3976052-1-yukuai@fnnas.com/ Signed-off-by: Yu Kuai commit a1aa9ef47c299c5bbc30594d3c2f0589edf908e6 Author: MingTao Huang Date: Thu Apr 2 20:18:50 2026 +0800 bpf: Fix stale offload->prog pointer after constant blinding When a dev-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes JIT compilation with constant blinding enabled (bpf_jit_harden >= 2), bpf_jit_blind_constants() clones the program. The original prog is then freed in bpf_jit_prog_release_other(), which updates aux->prog to point to the surviving clone, but fails to update offload->prog. This leaves offload->prog pointing to the freed original program. When the network namespace is subsequently destroyed, cleanup_net() triggers bpf_dev_bound_netdev_unregister(), which iterates ondev->progs and calls __bpf_prog_offload_destroy(offload->prog). Accessing the freed prog causes a page fault: BUG: unable to handle page fault for address: ffffc900085f1038 Workqueue: netns cleanup_net RIP: 0010:__bpf_prog_offload_destroy+0xc/0x80 Call Trace: __bpf_offload_dev_netdev_unregister+0x257/0x350 bpf_dev_bound_netdev_unregister+0x4a/0x90 unregister_netdevice_many_notify+0x2a2/0x660 ... cleanup_net+0x21a/0x320 The test sequence that triggers this reliably is: 1. Set net.core.bpf_jit_harden=2 (echo 2 > /proc/sys/net/core/bpf_jit_harden) 2. Run xdp_metadata selftest, which creates a dev-bound-only XDP program on a veth inside a netns (./test_progs -t xdp_metadata) 3. cleanup_net -> page fault in __bpf_prog_offload_destroy Dev-bound-only programs are unique in that they have an offload structure but go through the normal JIT path instead of bpf_prog_offload_compile(). This means they are subject to constant blinding's prog clone-and-replace, while also having offload->prog that must stay in sync. Fix this by updating offload->prog in bpf_jit_prog_release_other(), alongside the existing aux->prog update. Both are back-pointers to the prog that must be kept in sync when the prog is replaced. Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs") Signed-off-by: MingTao Huang Link: https://lore.kernel.org/r/tencent_BCF692F45859CCE6C22B7B0B64827947D406@qq.com Signed-off-by: Alexei Starovoitov commit f254fb58dde38addca8f0767f92559120cfe54cf Author: Alexis Lothoré (eBPF Foundation) Date: Fri Apr 3 09:52:06 2026 +0200 selftests/bpf: remove unused toggle in tc_tunnel tc_tunnel test is based on a send_and_test_data function which takes a subtest configuration, and a boolean indicating whether the connection is supposed to fail or not. This boolean is systematically passed to true, and is a remnant from the first (not integrated) attempts to convert tc_tunnel to test_progs: those versions validated for example that a connection properly fails when only one side of the connection has tunneling enabled. This specific testing has not been integrated because it involved large timeouts which increased quite a lot the test duration, for little added value. Remove the unused boolean from send_and_test_data to simplify the generic part of subtests. Signed-off-by: Alexis Lothoré (eBPF Foundation) Acked-by: Paul Chaignon Link: https://lore.kernel.org/r/20260403-tc_tunnel_cleanup-v1-1-4f1bb113d3ab@bootlin.com Signed-off-by: Alexei Starovoitov commit c6095cb9684e278a59cb5a25deff6bfef9aecf27 Merge: 24dbbf8a2343d4 262b857da6bee5 Author: Alexei Starovoitov Date: Sun Apr 5 18:45:05 2026 -0700 Merge branch 'bpf-fix-end-of-list-detection-in-cgroup_storage_get_next_key' Weiming Shi says: ==================== bpf: fix end-of-list detection in cgroup_storage_get_next_key() list_next_entry() never returns NULL, so the NULL check in cgroup_storage_get_next_key() is dead code. When iterating past the last element, the function reads storage->key from a bogus pointer that aliases internal map fields and copies the result to userspace. Patch 1 replaces the NULL check with list_entry_is_head() so the function correctly returns -ENOENT when there are no more entries. Patch 2 adds a selftest to cover this corner case, as suggested by Sun Jian and Paul Chaignon. v2: - Added selftest (Paul Chaignon) - Collected Reviewed-by and Acked-by tags ==================== Link: https://patch.msgid.link/20260403132951.43533-1-bestswngs@gmail.com Signed-off-by: Alexei Starovoitov commit 262b857da6bee528420514690895ed7d2c65077e Author: Weiming Shi Date: Fri Apr 3 21:29:51 2026 +0800 selftests/bpf: add get_next_key boundary test for cgroup_storage Verify that bpf_map__get_next_key() correctly returns -ENOENT when called on the last (and only) key in a cgroup_storage map. Before the fix in the previous patch, this would succeed with bogus key data instead of failing. Suggested-by: Paul Chaignon Signed-off-by: Weiming Shi Acked-by: Paul Chaignon Link: https://lore.kernel.org/r/20260403132951.43533-3-bestswngs@gmail.com Signed-off-by: Alexei Starovoitov commit 5828b9e5b272ecff7cf5d345128d3de7324117f7 Author: Weiming Shi Date: Fri Apr 3 21:29:50 2026 +0800 bpf: fix end-of-list detection in cgroup_storage_get_next_key() list_next_entry() never returns NULL -- when the current element is the last entry it wraps to the list head via container_of(). The subsequent NULL check is therefore dead code and get_next_key() never returns -ENOENT for the last element, instead reading storage->key from a bogus pointer that aliases internal map fields and copying the result to userspace. Replace it with list_entry_is_head() so the function correctly returns -ENOENT when there are no more entries. Fixes: de9cbbaadba5 ("bpf: introduce cgroup storage maps") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Sun Jian Acked-by: Paul Chaignon Link: https://lore.kernel.org/r/20260403132951.43533-2-bestswngs@gmail.com Signed-off-by: Alexei Starovoitov commit 24dbbf8a2343d4063c370a1f25645eabc50d68c9 Merge: 6a14beefab457f f64eb44ce9067d Author: Alexei Starovoitov Date: Sun Apr 5 18:37:32 2026 -0700 Merge branch 'bpf-fix-torn-writes-in-non-prealloc-htab-with-bpf_f_lock' Mykyta Yatsenko says: ==================== bpf: Fix torn writes in non-prealloc htab with BPF_F_LOCK A torn write issue was reported in htab_map_update_elem() with BPF_F_LOCK on hash maps. The BPF_F_LOCK fast path performs a lockless lookup and copies the value under the element's embedded spin_lock. A concurrent delete can free the element via bpf_mem_cache_free(), which allows immediate reuse. When alloc_htab_elem() recycles the same memory, it writes the value with plain copy_map_value() without taking the spin_lock, racing with the stale lock holder and producing torn writes. Patch 1 fixes alloc_htab_elem() to use copy_map_value_locked() when BPF_F_LOCK is set. Patch 2 adds a selftest that reliably detects the torn writes on an unpatched kernel. Reported-by: Aaron Esau Signed-off-by: Mykyta Yatsenko ==================== Link: https://patch.msgid.link/20260401-bpf_map_torn_writes-v1-0-782d071c55e7@meta.com Signed-off-by: Alexei Starovoitov commit f64eb44ce9067d37e6334a940518dcf1254e83fe Author: Mykyta Yatsenko Date: Wed Apr 1 06:50:37 2026 -0700 selftests/bpf: Add torn write detection test for htab BPF_F_LOCK Add a consistency subtest to htab_reuse that detects torn writes caused by the BPF_F_LOCK lockless update racing with element reallocation in alloc_htab_elem(). The test uses three thread roles started simultaneously via a pipe: - locked updaters: BPF_F_LOCK|BPF_EXIST in-place updates - delete+update workers: delete then BPF_ANY|BPF_F_LOCK insert - locked readers: BPF_F_LOCK lookup checking value consistency Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260401-bpf_map_torn_writes-v1-2-782d071c55e7@meta.com Signed-off-by: Alexei Starovoitov commit 07738bc566c38e0a8c82084e962890d1d59715c8 Author: Mykyta Yatsenko Date: Wed Apr 1 06:50:36 2026 -0700 bpf: Use copy_map_value_locked() in alloc_htab_elem() for BPF_F_LOCK When a BPF_F_LOCK update races with a concurrent delete, the freed element can be immediately recycled by alloc_htab_elem(). The fast path in htab_map_update_elem() performs a lockless lookup and then calls copy_map_value_locked() under the element's spin_lock. If alloc_htab_elem() recycles the same memory, it overwrites the value with plain copy_map_value(), without taking the spin_lock, causing torn writes. Use copy_map_value_locked() when BPF_F_LOCK is set so the new element's value is written under the embedded spin_lock, serializing against any stale lock holders. Fixes: 96049f3afd50 ("bpf: introduce BPF_F_LOCK flag") Reported-by: Aaron Esau Closes: https://lore.kernel.org/all/CADucPGRvSRpkneb94dPP08YkOHgNgBnskTK6myUag_Mkjimihg@mail.gmail.com/ Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260401-bpf_map_torn_writes-v1-1-782d071c55e7@meta.com Signed-off-by: Alexei Starovoitov commit 0037d16644b15686eec420a90f05bcd2804edf6d Author: Marek Vasut Date: Tue Mar 24 20:03:11 2026 +0100 ARM: dts: imx: Add DT overlays for DH i.MX6 DHCOM SoM and boards Add DT overlays to support DH i.MX6 DHCOM SoM carrier board expansion modules. The following DT overlays are implemented: - PDK2: - DH 497-200 Display board in edge connector X12 - DH 505-200 Display board in edge connector X12 - DH 531-100 SPI/I2C board in header X21 - DH 531-200 SPI/I2C board in header X22 - DH 560-200 Display board in edge connector X12 - PicoITX: - DH 626-100 Display board in edge connector X2 Signed-off-by: Marek Vasut Signed-off-by: Frank Li commit c59ebeb2ad085bee952d35c601cad46be3bc86c1 Author: Frank Li Date: Wed Mar 11 15:41:11 2026 -0400 ARM: dts: imx6sx: remove fallback compatible string fsl,imx28-lcdif The i.MX6SX LCDIF is not fully compatible with the i.MX28 LCDIF. The i.MX6SX controller provides additional overlay registers (AS_CTRL) which are not present on i.MX28. Linux has supported the dedicated compatible string since commit 45d59d704080 ("drm: Add new driver for MXSFB controller"). Other known DT users such as U-Boot and Barebox already support "fsl,imx6sx-lcdif", so removing the fallback compatible string is low risk since this device is used for display output only. Fix the following CHECK_DTB warning: /arch/arm/boot/dts/nxp/imx/imx6sx-nitrogen6sx.dtb: lcdif@2220000 (fsl,imx6sx-lcdif): compatible: 'oneOf' conditional failed, one must be fixed: ['fsl,imx6sx-lcdif', 'fsl,imx28-lcdif'] is too long Signed-off-by: Frank Li commit 3432749efe6b76abf7cff90a05ff40ee919c060e Author: Frank Li Date: Wed Feb 11 16:41:06 2026 -0500 ARM: dts: imx25: rename node name tcq to touchscreen Rename node name tcq to touchscreen to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx25-karo-tx25.dtb: tscadc@50030000 (fsl,imx25-tsadc): 'tcq@50030400' does not match any of the regexes: '^adc@[0-9a-f]+$', '^pinctrl-[0-9]+$', '^touchscreen@[0-9a-f]+$' from schema $id: http://devicetree.org/schemas/mfd/fsl,imx25-tsadc.yaml Signed-off-by: Frank Li commit 3caf9e664163924f0a8b30159b66479f1d2c5418 Author: Ian Ray Date: Tue Feb 17 15:55:20 2026 +0200 ARM: dts: imx: b850v3: Disable unused usdhc4 Disable the unused interface, to fix print an error message during boot: mmc3: Failed to initialize a non-removable card Signed-off-by: Ian Ray Signed-off-by: Frank Li commit 2c8cfe54088c2683dc6ae6c538ff1baeec714484 Author: Ian Ray Date: Tue Feb 17 15:55:19 2026 +0200 ARM: dts: imx: b850v3: Define GPIO line names Define GPIO line names for gpio4. Signed-off-by: Ian Ray Signed-off-by: Frank Li commit 35f45b5533923d452ec27b59005c35d5bedd2649 Author: Ian Ray Date: Tue Feb 17 15:55:18 2026 +0200 ARM: dts: imx: b850v3: Use alphabetical sorting Use alphabetical sorting of references modification. Signed-off-by: Ian Ray Signed-off-by: Frank Li commit f45c54459d86e0ac6c91d1c4419f843e9fd7909a Author: Ian Ray Date: Tue Feb 17 15:55:17 2026 +0200 ARM: dts: imx: bx50v3: Configure phy-mode to eliminate a warning Set `phy-mode' on network switch CPU ports to eliminate a warning: mv88e6085 gpio-0:00: OF node /mdio-gpio/switch@0/ports/port@4 of CPU port 4 lacks the required "phy-mode" property Signed-off-by: Ian Ray Signed-off-by: Frank Li commit 12959ffa4e9e8dd85e6b06a3ac258e8855872a86 Author: Ian Ray Date: Tue Feb 17 15:55:16 2026 +0200 ARM: dts: imx: bx50v3: Configure switch PHY max-speed to 100Mbps Configure maximum speed for the switch PHYs according to the electrical connections from PHY to RJ45 connector. Signed-off-by: Ian Ray Signed-off-by: Frank Li commit d7a3aa262f79a63545014c69b8ead94692c8a7e5 Author: Peng Fan Date: Mon Mar 2 23:07:42 2026 +0800 ARM: dts: imx7ulp: Add CPU clock and OPP table support Add missing CPU clock definitions and operating-points-v2 table for the Cortex-A7 on i.MX7ULP to enable proper CPU frequency scaling and integration with the cpufreq/OPP frameworks. Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 137c291faac3e5ef3e1dfddb8726b30958a08097 Author: Alexander Feilke Date: Fri Feb 20 15:59:09 2026 +0100 ARM: dts: imx7-mba7: Deassert BOOT_EN after boot Deassert BOOT_EN after boot to separate BOOT_CFG circuits from LCD signals. Signed-off-by: Alexander Feilke Signed-off-by: Frank Li commit ac27604c555471cbb7565a30a16b424f8c1ca906 Author: Alexander Feilke Date: Fri Feb 20 15:59:08 2026 +0100 ARM: dts: tqma7: add boot phase properties dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. Adds boot phase properties to essential resources in tqma7 device trees. This includes UART, SD-Card, eMMC and QSPI. Signed-off-by: Alexander Feilke Signed-off-by: Frank Li commit 926095b5efbd4065a08f5b0f99afdef23bf1501b Author: Alexander Feilke Date: Fri Feb 20 15:59:07 2026 +0100 ARM: dts: imx7s: add boot phase properties dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. Adds boot phase properties to essential resources in imx7s device trees. This includes the buses aips1-3, iomuxc and SOC access. Signed-off-by: Alexander Feilke Signed-off-by: Frank Li commit 60536b6be8618d2a374c009b1d2bf0a0d9f23b1b Author: Max Merchel Date: Fri Feb 20 15:31:05 2026 +0100 ARM: dts: tqma6ul[l]: correct spelling of TQ-Systems TQ-Systems is written with a hyphen. Correct the spelling. Signed-off-by: Max Merchel Signed-off-by: Frank Li commit 8280d605cf352c8897d178a1130c92b45f67a6dc Author: Max Merchel Date: Fri Feb 20 15:31:04 2026 +0100 ARM: dts: mba6ulx: add boot phase properties dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. MBa6ULx need regulator, SD-Card, UART and watchdog access during boot process. Signed-off-by: Max Merchel Signed-off-by: Frank Li commit feb90561bead326cf95a744080db16dbe5bacdc1 Author: Max Merchel Date: Fri Feb 20 15:31:03 2026 +0100 ARM: dts: imx6ul[l]-tqma6ul[l]: add boot phase properties dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. TQMa6UL need eMMC, I2C, GPIO and QSPI access during boot process. Signed-off-by: Max Merchel Signed-off-by: Frank Li commit 72d47f32fd7f7a50849bd71894fa65e13d0e6dad Author: Max Merchel Date: Fri Feb 20 15:31:02 2026 +0100 ARM: dts: imx6ul/imx6ull: add boot phase properties dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. All SoCs require buses (aips and spba), clock, iomuxc and SOC access during boot process. Signed-off-by: Max Merchel Signed-off-by: Frank Li commit 24d209d1a1e8d3ac684422fc9859df95ecaf03b5 Author: Max Merchel Date: Fri Feb 20 15:30:05 2026 +0100 ARM: dts: imx6qdl-mba6: add boot phase properties dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. MBa6 need I2C, GPIO, SD-Card, UART and watchdog access during boot process. Signed-off-by: Max Merchel Signed-off-by: Frank Li commit c335bc0640784df933e60ae704453fdf186ba8da Author: Max Merchel Date: Fri Feb 20 15:30:04 2026 +0100 ARM: dts: imx6qdl-tqma6: add boot phase properties dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. TQMa6 need eMMC, I2C, GPIO, regulator and QSPI access during boot process. Signed-off-by: Max Merchel Signed-off-by: Frank Li commit 1ea07b5a0ff4a8d3f8fbe22947d648535fa73a4e Author: Max Merchel Date: Fri Feb 20 15:30:03 2026 +0100 ARM: dts: imx6qdl: add boot phase properties dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. All SoCs require buses (aips and spba), clock, iomuxc, ipu and SOC access during boot process. Signed-off-by: Max Merchel Signed-off-by: Frank Li commit e65d9599d28ffe1e165ec8aa17e08a574fd48834 Author: Max Merchel Date: Fri Feb 20 15:30:02 2026 +0100 ARM: dts: imx6qdl-tqma6: add missing labels Add the missing labels for the temperature sensor and the EEPROM. In SoM variants A and B, the components are connected to different I2C buses. These labels are needed to reference them in subsequent device trees. Signed-off-by: Max Merchel Signed-off-by: Frank Li commit b3d9c14e61de83d39fe271c4369fab1f567d6166 Author: Frank Li Date: Wed Jan 21 13:04:17 2026 -0500 ARM: dts: imx: add required clocks and clock-names for ccm Add required clocks and clock-names for ccm to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6dl-alti6p.dtb: clock-controller@20c4000 (fsl,imx6q-ccm): clock-names:0: 'osc' was expected from schema $id: http://devicetree.org/schemas/clock/imx6q-clock.yaml# Reviewed-by: Daniel Baluta Reviewed-by: Peng Fan Signed-off-by: Frank Li commit 955088ecc838acf4eb587d62311dde12121c4738 Author: Frank Li Date: Wed Jan 21 13:04:16 2026 -0500 ARM: dts: imx6qdl: add label for system clocks Add label for system clocks and add two missing clocks anaclk[1,2]. Prepare for fixing ccm related CHECK_DTB warnings. Reviewed-by: Daniel Baluta Reviewed-by: Peng Fan Signed-off-by: Frank Li commit 164922745ec43f43c2970865a40337c93cd8dc76 Author: Frank Li Date: Thu Feb 12 11:19:50 2026 -0500 ARM: dts: imx28-tx28: remove undocumented aliases Remove undocumented aliases, which is not used in kernel to fix CHECK_DTBS warnings. arch/arm/boot/dts/nxp/mxs/imx28-tx28.dtb: aliases: 'lcdif_23bit_pins', 'lcdif_24bit_pins', 'reg_can_xcvr', 'spi_gpio', 'spi_mxs' do not match any of the regexes: '^[a-z][a-z0-9\\-]*$', '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/aliases.yaml Signed-off-by: Frank Li commit f29f4db9f1a7f48058400c1956d8429a8ee4539d Author: Frank Li Date: Thu Feb 12 11:19:49 2026 -0500 ARM: dts: imx28-tx28: rename compatible to "edt,edt-ft5206" The compatible string "edt,edt-ft5x06" is neither documented nor used. According to drivers/input/touchscreen/edt-ft5x06.c, ft5206, ft5306 and ft5406 are compatible. Use "edt,edt-ft5206" instead, as the datasheet does not specify the exact touchscreen model. Signed-off-by: Frank Li commit 05e4d6ef33c878a63c283cbbc833450173a80a09 Author: Frank Li Date: Thu Feb 12 11:19:48 2026 -0500 ARM: dts: imx28-sps1: remove undocumented fallback compatible "mr25h256" Remove the undocumented fallback compatible string "mr25h256", as the SPI core strips the vendor prefix. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/mxs/imx28-sps1.dtb: /apb@80000000/apbh-bus@80000000/spi@80014000/flash@0: failed to match any schema with compatible: ['everspin,mr25h256', 'mr25h256'] Signed-off-by: Frank Li commit 97e27efc5b19242f80fc9678bfa8319e578ccd49 Author: Frank Li Date: Thu Feb 12 11:19:47 2026 -0500 ARM: dts: imx28: rename gpios-reset to reset-gpios of hx8357 Rename gpios-reset to reset-gpios of hx8357 node to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/mxs/imx28-cfa10055.dtb: hx8357@0 (himax,hx8357b): Unevaluated properties are not allowed ('gpios-reset' was unexpected) Signed-off-by: Frank Li commit 13d1513062f3cba5e1ef4255dec3f911653134cf Author: Frank Li Date: Thu Feb 12 11:19:46 2026 -0500 ARM: dts: imx23/28: add "led-" prefix to LED subnodes Add the "led-" prefix to LED subnodes to fix the below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/mxs/imx23-olinuxino.dtb: leds (gpio-leds): 'user' does not match any of the regexes: '(^led-[0-9a-f]$|led)', '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/leds/leds-gpio.yaml Signed-off-by: Frank Li commit a385279fa1cd567328e18046c2ef5cec37e3ffe5 Author: Frank Li Date: Thu Feb 12 11:19:45 2026 -0500 ARM: dts: imx23: fix interrupt names for dma-controller@80024000 There are duplicate "empty" entries in the interrupt-names property of the DMA controller. Rename them to "empty" to fix below CHECK_DTBS warnings. arch/arm/boot/dts/nxp/mxs/imx23-olinuxino.dtb: dma-controller@80024000 (fsl,imx23-dma-apbx): interrupt-names:15: 'empty5' was expected Signed-off-by: Frank Li commit 3bca7337b4a5a3d5c842c1cfc0064b60ebdf3818 Author: Frank Li Date: Wed Feb 11 18:12:57 2026 -0500 ARM: dts: imx27: remove fsl,imx-osc26m from fixed-clock node Remove fsl,imx-osc26m from fixed-clock node to fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/imx/imx27-apf27.dtb: osc26m (fsl,imx-osc26m): compatible: ['fsl,imx-osc26m', 'fixed-clock'] is too long from schema $id: http://devicetree.org/schemas/clock/fixed-clock.yaml Signed-off-by: Frank Li commit 53779e03483aeaaa280466199b24f8e6ade32a4a Author: Frank Li Date: Wed Feb 11 18:12:56 2026 -0500 ARM: dts: imx27-eukrea-cpuimx27: rename uart8250 to serial Rename node name uart8250 to serial to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx27-eukrea-mbimxsd27-baseboard.dtb: uart8250@3,200000 (ns8250): $nodename:0: 'uart8250@3,200000' does not match '^serial(@.*)?$' Reviewed-by: Daniel Baluta Signed-off-by: Frank Li commit 0477a6b31e2874e554e3bcfac9883684b8f8ca2d Author: Frank Li Date: Wed Feb 11 18:12:55 2026 -0500 ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended The property interrupts use default interrupt controllers. But pass down gpio as phandle. Correct it by use interrupts-extended. Fixes: d8cae888aa2bc ("ARM: dts: Add support for the cpuimx27 board from Eukrea and its baseboard") Signed-off-by: Frank Li commit e948cbdc41d6f4417586b4058bf818afcc255d3d Author: Frank Li Date: Wed Feb 11 16:00:03 2026 -0500 ARM: dts: imx: remove redundant intermediate node in pinmux hierarchy Remove the redundant intermediate node between the pinmux and group nodes, and add the missing "grp" suffix to the group node names. Fix below CHECK_DTBS warnings: arm/boot/dts/nxp/imx/imx27-apf27dev.dtb: iomuxc@10015000 (fsl,imx27-iomuxc): Unevaluated properties are not allowed ('imx27-apf27', 'imx27-apf27dev' were unexpected) from schema $id: http://devicetree.org/schemas/pinctrl/fsl,imx27-iomuxc.yaml Signed-off-by: Frank Li commit 81469ef61cf710274ef42999a3ebe96a5c204ee5 Author: Frank Li Date: Wed Feb 11 16:00:02 2026 -0500 ARM: dts: imx: rename iomuxc to pinmux Rename node name iomuxc to pinmux. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx1-apf9328.dtb: iomuxc@21c000 (fsl,imx1-iomuxc): $nodename:0: 'iomuxc@21c000' does not match '^(pinctrl|pinmux)(@[0-9a-f]+)?$' from schema $id: http://devicetree.org/schemas/pinctrl/fsl,imx27-iomuxc.yaml Signed-off-by: Frank Li commit d04bb165829294bc40cbc2613e42467212f5ea79 Author: Marek Vasut Date: Mon Feb 9 18:07:04 2026 +0100 ARM: dts: imx6ull-dhcor: Handle both 1DX and 1YN WiFi on i.MX6ULL DHCOR The muRata 1DX WiFi/BT chip is mounted on the DHCOM i.MX6ULL. This chip has been discontinued and replaced by the muRata 1YN chip. The new chip is a drop-in replacement of the old chip. To support both chips for the i.MX6ULL DHCOR, drop the more specific compatible string and let the driver auto-detect the chip type. Currently, there are no known quirks that would apply only to one or the other chip. Signed-off-by: Marek Vasut Signed-off-by: Frank Li commit 53b36dc978640518374eea4f04e40465589f2e15 Author: Frank Li Date: Mon Feb 2 14:43:27 2026 -0500 ARM: dts: imx7s-warp: Remove data-lanes and clock-lanes for ov2680 The ov2680 only support 1 lane. Needn't additional property to descript it. Remove it to fix below DTB_CHECK warnings: camera@36 (ovti,ov2680): port:endpoint: 'clock-lanes', 'data-lanes' do not match any of the regexes: '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/media/i2c/ovti,ov2680.yaml Signed-off-by: Frank Li commit abfd55dd8327f760cb91289bb696436c5ead23f3 Author: Frank Li Date: Mon Feb 2 14:43:26 2026 -0500 ARM: dts: imx53-smd: Add power supply node for fsl,sgtl5000 Add power supply, #sound-dai-cells and clock nodes for fsl,sgtl5000 to fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/imx/imx53-smd.dtb: sgtl5000@a (fsl,sgtl5000): '#sound-dai-cells' is a required property from schema $id: http://devicetree.org/schemas/sound/fsl,sgtl5000.yaml# arch/arm/boot/dts/nxp/imx/imx53-smd.dtb: sgtl5000@a (fsl,sgtl5000): 'clocks' is a required property from schema $id: http://devicetree.org/schemas/sound/fsl,sgtl5000.yaml# arch/arm/boot/dts/nxp/imx/imx53-smd.dtb: sgtl5000@a (fsl,sgtl5000): 'VDDA-supply' is a required property from schema $id: http://devicetree.org/schemas/sound/fsl,sgtl5000.yaml# arch/arm/boot/dts/nxp/imx/imx53-smd.dtb: sgtl5000@a (fsl,sgtl5000): 'VDDIO-supply' is a required property Signed-off-by: Frank Li commit 66ad164b0048df33afb1fa927242aeece547970d Author: Frank Li Date: Mon Feb 2 14:43:24 2026 -0500 ARM: dts: imx6qdl-sr-som-ti: use fixed-clock instead of clock-frequency Replace the clock-frequency property with a fixed-clock providing the 32kHz input to the gpio-gate-clock. Fix the following CHECK_DTBS warning: ti-wifi-clock (gpio-gate-clock): 'clock-frequency' does not match any of the regexes: '^pinctrl-[0-9]+$' Signed-off-by: Frank Li commit a7a080bb4236ebe577b6776d940d1717912ff6dd Author: David Carlier Date: Tue Mar 31 11:37:44 2026 +0100 gpu: nova-core: fix missing colon in SEC2 boot debug message The SEC2 mailbox debug output formats MBOX1 without a colon separator, producing "MBOX10xdead" instead of "MBOX1: 0xdead". The GSP debug message a few lines above uses the correct format. Fixes: 5949d419c193 ("gpu: nova-core: gsp: Boot GSP") Signed-off-by: David Carlier Link: https://patch.msgid.link/20260331103744.605683-1-devnexen@gmail.com Signed-off-by: Alexandre Courbot commit 314ef7f7249b87cdee368ab6b3e89774ac00e567 Author: Eric Biggers Date: Sat Apr 4 12:42:10 2026 -0700 smb: client: Remove unnecessary selection of CRYPTO_ECB Since the SMB client never uses any ecb(...) algorithm from the crypto_skcipher API, selecting CRYPTO_ECB is unnecessary. Specifically, it has been unnecessary since commit 06deeec77a5a ("cifs: Fix smbencrypt() to stop pointing a scatterlist at the stack") in 2016. Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 59ea368431ddf0569ac9201162bfea969fe3a03c Author: ZhangGuoDong Date: Fri Apr 3 15:38:52 2026 +0000 smb/client: move smb2maperror declarations to smb2proto.h For `smb2_error_map_table_test` and `smb2_error_map_num`, if their types are changed in `smb2maperror.c` but the corresponding extern declarations in `smb2maperror_test.c` are not updated, the compiler will not report an error. Moving them to a common header file allows the compiler to catch type mismatches. Signed-off-by: ZhangGuoDong Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 85274a3bd40f46a17f520c9d84a5b72d4704d2c3 Author: Youling Tang Date: Thu Apr 2 14:18:39 2026 +0000 smb/client: introduce KUnit tests to check DOS/SRV err mapping search Check whether all elements can be correctly found in the arrays. Signed-off-by: Youling Tang Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 8c028dd086ade4dd9fed8a4198f25531dcd11dcb Author: Youling Tang Date: Thu Apr 2 14:18:38 2026 +0000 smb/client: check if SMB1 DOS/SRV error mapping arrays are sorted Although the arrays are sorted at build time, verify the ordering again when cifs.ko is loaded to avoid potential regressions introduced by future script changes. Signed-off-by: Youling Tang Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 95e6b7340957f8b51e6abb97c666eadd37f1f69f Author: Huiwen He Date: Thu Apr 2 14:18:37 2026 +0000 smb/client: use binary search for SMB1 DOS/SRV error mapping Currently, map_smb_to_linux_error() uses linear searches for both mapping_table_ERRDOS[] and mapping_table_ERRSRV[]. Refactor this by introducing search_mapping_table_ERRDOS() and search_mapping_table_ERRSRV() that implements binary search(as the tables are sorted).This improves lookup performance and reduces code duplication. Also remove the sentinel entries from the mapping tables as they are no longer needed with ARRAY_SIZE(). Signed-off-by: Huiwen He Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 58ac796bb3c0f7b8295046404629724b68b40fa0 Author: Huiwen He Date: Thu Apr 2 14:18:36 2026 +0000 smb/client: autogenerate SMB1 DOS/SRV to POSIX error mapping Extend the `gen_smb1_mapping` script to support generating sorted POSIX error mapping tables for both ERRDOS and ERRSRV classes at compile time. The script parses annotations from smberr.h to generate smb1_err_dos_map.c and smb1_err_srv_map.c, which are included as the contents of the arrays mapping_table_ERRDOS[] and mapping_table_ERRSRV[], respectively. This ensures that the mapping logic remains synchronized with the source headers and prepares for faster error lookups using binary search in the future. Signed-off-by: Huiwen He Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit cd4e653a2f75517b4ba8a0589856aeb529a27871 Author: Huiwen He Date: Thu Apr 2 14:18:35 2026 +0000 smb/client: annotate smberr.h with POSIX error codes Annotate SMB1 error definitions in smberr.h with their corresponding POSIX error codes. To facilitate automated processing and ensure consistent formatting, existing inline comments (/* ... */) in smberr.h were first moved to the lines preceding the #define statements. This provides the source data for generating sorted mapping tables, allowing the implementation of binary search for faster error mapping lookups in later commits. The annotations were performed based on the manual mapping_table_ERRDOS[] and mapping_table_ERRSRV[] arrays in smb1maperror.c using the following python script: #!/usr/bin/env python3 import re import os MAP_FILE = "fs/smb/client/smb1maperror.c" SMBERR_FILE = "fs/smb/client/smberr.h" def get_mappings(): mappings = {} if not os.path.exists(MAP_FILE): return mappings with open(MAP_FILE, "r") as f: content = f.read() for table in ["mapping_table_ERRDOS", "mapping_table_ERRSRV"]: pattern = ( rf'static const struct smb_to_posix_error {table}\[\] = ' r'\{([\s\S]+?)\};' ) match = re.search(pattern, content) if match: entry_pattern = ( r'\{\s*([A-Za-z0-9_]+)\s*,\s*' r'(-[A-Z0-9_]+)\s*\}' ) entries = re.findall(entry_pattern, match.group(1)) for name, posix in entries: if name != "0": mappings[name] = posix return mappings def format_comment(comment_lines): """ Formats comment lines to comply with Linux kernel coding style. Single-line comments remain on one line. Multi-line comments use the standard block format. """ raw_text = [] for line in comment_lines: line = line.strip() if line.startswith('/*'): line = line[2:] if line.endswith('*/'): line = line[:-2] line = line.lstrip(' *').strip() if line: raw_text.append(line) if not raw_text: return [] # If it's a single line of text, keep it simple if len(raw_text) == 1: return [f"/* {raw_text[0]} */"] # Multi-line: Standard Kernel Block Comment Format formatted = ["/*"] for text in raw_text: formatted.append(f" * {text}") formatted.append(" */") return formatted def fix_content(content, mappings): lines = content.splitlines() new_lines, i = [], 0 while i < len(lines): line = lines[i] # Match #define with inline comment define_re = ( r'^(\s*#define\s+([A-Za-z0-9_]+)\s+' r'[^\s/]+)\s*/\*' ) match = re.match(define_re, line) if match: prefix, name = match.group(1), match.group(2) # Extract full comment block comment_block = [line[line.find('/*'):].strip()] if '*/' not in line: while i + 1 < len(lines): i += 1 comment_block.append(lines[i].strip()) if '*/' in lines[i]: break # Format and add comment new_lines.extend(format_comment(comment_block)) # Add define with tab-separated POSIX code new_define = prefix.rstrip() if name in mappings: new_define += '\t// ' + mappings[name] new_lines.append(new_define) else: no_comment_re = ( r'^(\s*#define\s+([A-Za-z0-9_]+)\s+' r'[^\s/]+)\s*$' ) match_no_comment = re.match(no_comment_re, line) if match_no_comment: prefix = match_no_comment.group(1) name = match_no_comment.group(2) new_define = prefix.rstrip() if name in mappings: new_define += '\t// ' + mappings[name] new_lines.append(new_define) else: new_lines.append(line) i += 1 return '\n'.join(new_lines) if __name__ == "__main__": m = get_mappings() if os.path.exists(SMBERR_FILE): with open(SMBERR_FILE, "r") as f: content = f.read() fixed = fix_content(content, m) with open(SMBERR_FILE, "w") as f: f.write(fixed + '\n') print(f"Successfully processed {SMBERR_FILE}") Signed-off-by: Huiwen He Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 669c3eedaefa9cce6d87ccdb3864cf9bb606f325 Author: Huiwen He Date: Thu Apr 2 14:18:34 2026 +0000 smb/client: move ERRnetlogonNotStarted to DOS error class In smb1maperror.c, ERRnetlogonNotStarted is included in the mapping_table_ERRDOS array. However, in the smberr.h header file, this macro was incorrectly placed under the ERRSRV (server) error class section. Move the macro definition to the ERRDOS section in smberr.h to maintain consistency between the error classification in the header file and its actual usage in the mapping tables. Signed-off-by: Huiwen He Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit e3ac6352a84d9ddc39a5772796032a852033ed92 Author: Youling Tang Date: Thu Apr 2 14:18:33 2026 +0000 smb/client: introduce KUnit test to check ntstatus_to_dos_map search Check whether all elements can be correctly found in the array. Introduce CONFIG_SMB1_KUNIT_TESTS for smb1maperror_test.ko since smb1maperror.o is only built when CONFIG_CIFS_ALLOW_INSECURE_LEGACY is enabled. We are going to define 3 functions to check the search results, introduce the macro DEFINE_CHECK_SEARCH_FUNC() to reduce duplicate code. Signed-off-by: Youling Tang Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 010ad1e895dbe269ab4f97b3e5245deefcc6205f Author: Youling Tang Date: Thu Apr 2 14:18:32 2026 +0000 smb/client: check if ntstatus_to_dos_map is sorted Although the array is sorted at build time, verify the ordering again when cifs.ko is loaded to avoid potential regressions introduced by future script changes. We are going to define 3 functions to check the sort results, introduce the macro DEFINE_CHECK_SORT_FUNC() to reduce duplicate code. Signed-off-by: Youling Tang Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 3c6c23ed9424cfd5a648863dc058c52094b1b99d Author: Huiwen He Date: Thu Apr 2 14:18:31 2026 +0000 smb/client: use binary search for NT status to DOS mapping The ntstatus_to_dos_map[] table is sorted now. Replace the linear search with binary search to improve lookup performance. Also remove the sentinel entry as it is no longer needed with ARRAY_SIZE(). Signed-off-by: Huiwen He Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 772d5920c3d417fc4ba44c0b6fb61ca4f19f5809 Author: Huiwen He Date: Thu Apr 2 14:18:30 2026 +0000 smb/client: refactor ntstatus_to_dos() to return mapping entry Refactor ntstatus_to_dos() to return a pointer to the mapping entry instead of using output parameters. This allows callers to access all fields of the entry directly. In map_smb_to_linux_error(), integrate the printing logic directly to avoid redundant lookups previously performed by cifs_print_status(), which is now removed. Signed-off-by: Huiwen He Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit c825f6b7432a11a801feb5f5783765cf31f2c3ff Author: Huiwen He Date: Thu Apr 2 14:18:29 2026 +0000 smb/client: replace nt_errs with ntstatus_to_dos_map The ntstatus_to_dos_map[] array now contains the NT error strings, making the nt_errs[] array redundant. Introduce `struct ntstatus_to_dos_err` instead of an anonymous struct. This allows cifs_print_status() to look up error strings directly from a single table. Remove nterr.c, as nt_errs[] was its only functional content. Signed-off-by: Huiwen He Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 415c5b8c9a41e3fc40e0e110c8fadf26c51df5c5 Author: Huiwen He Date: Thu Apr 2 14:18:28 2026 +0000 smb/client: autogenerate SMB1 NT status to DOS error mapping Introduce `gen_smb1_mapping` script to autogenerate the NT status to DOS error mapping table for SMB1. This script parses nterr.h to generate smb1_mapping_table.c, which is then directly included as the content of the ntstatus_to_dos_map[] array at compile time. The generated array is numerically sorted during the build process to ensure a consistent structure, providing the necessary groundwork for future introduction of binary search lookups. Signed-off-by: Huiwen He Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 378f75b7d6ea10f6368d414eb6b25f32224e9fc7 Author: Huiwen He Date: Thu Apr 2 14:18:27 2026 +0000 smb/client: annotate nterr.h with DOS error codes Add comments to NT_STATUS definitions in nterr.h indicating the corresponding DOS error class and code. To ensure formatting consistency and facilitate automated processing, existing human-readable comments in nterr.h were first moved to the line preceding the #define statements. This provides the source data for generating sorted mapping tables, allowing the implementation of binary search for faster error mapping lookups in later commits. The mapping data is extracted from the existing manual ntstatus_to_dos_map[] array in smb1maperror.c using the following python script: #!/usr/bin/env python3 import re import os MAP_FILE = "fs/smb/client/smb1maperror.c" NTERR_FILE = "fs/smb/client/nterr.h" def move_comments(file_path): """ Moves existing inline comments (/* ... */ or // ...) to the preceding line to ensure formatting consistency. """ if not os.path.exists(file_path): return with open(file_path, "r") as f: lines = f.readlines() new_lines = [] # Match #define statements with inline comments re_str = r'^(\s*#define\s+[A-Za-z0-9_]+\s+.*?)\s*(/\*.*?\*/|//.*)$' pattern = re.compile(re_str) for line in lines: match = pattern.match(line.rstrip()) if match: define_part, comment_part = match.groups() # Do not move if it's already an auto-generated mapping comment if re.search(r'//\s*[A-Z0-9_]+\s*,\s*[A-Za-z0-9_]+', comment_part): new_lines.append(line) continue indent = " " * (len(line) - len(line.lstrip())) # Move old comment to previous line new_lines.append(indent + comment_part + "\n") # Keep the define part new_lines.append(define_part.rstrip() + "\n") else: new_lines.append(line) with open(file_path, "w") as f: f.writelines(new_lines) def annotate_nterr(): """ Extracts DOS error mappings from smb1maperror.c and appends them as comments to NT_STATUS defines in nterr.h, ensuring proper alignment. """ mapping = {} if not os.path.exists(MAP_FILE) or not os.path.exists(NTERR_FILE): return # Extract mappings from the source mapping table with open(MAP_FILE, "r") as f: content = f.read() # Strip comments from source to ensure robust parsing content = re.sub(r'/\*.*?\*/', '', content, flags=re.DOTALL) content = re.sub(r'//.*', '', content) # Match [Class], [Code], [NT_STATUS] triplets using regex map_re = r'([A-Z0-9_]+)\s*,\s*([A-Za-z0-9_]+)\s*,\s*(NT_STATUS_[A-Z0-9_]+)' matches = re.findall(map_re, content) for m in matches: mapping[m[2]] = (m[0], m[1]) with open(NTERR_FILE, "r") as f: lines = f.readlines() new_lines = [] for line in lines: stripped = line.strip() if stripped.startswith("#define NT_STATUS_"): # Remove any existing // comments before re-annotating base_line = re.sub(r'\s*//.*$', '', line.rstrip()) parts = base_line.split() if len(parts) >= 2: name = parts[1] # Append comment, ensuring proper alignment if name == "NT_STATUS_OK": line = f"{base_line}\t// SUCCESS, 0\n" elif name in mapping: d_class, d_code = mapping[name] line = f"{base_line}\t// {d_class}, {d_code}\n" else: line = f"{base_line}\t// ERRHRD, ERRgeneral\n" new_lines.append(line) with open(NTERR_FILE, "w") as f: f.writelines(new_lines) if __name__ == "__main__": # Step 1: Clean existing inline comments and move them to separate lines move_comments(NTERR_FILE) # Step 2: Annotate with DOS codes, ensuring proper DOS codes comments annotate_nterr() print("Successfully processed nterr.h with DOS codes comments.") Signed-off-by: Huiwen He Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 53cf44fa727113affda4a17207a54e0d27c7fc78 Author: SunJianHao <24031212195@stu.xidian.edu.cn> Date: Fri Apr 3 21:12:05 2026 +0800 smb/client: avoid null-ptr-deref when tests fail in test_cmp_map() Use KUNIT_ASSERT_NOT_NULL() to abort the test cases on failure. Reported-by: ChenXiaoSong Signed-off-by: SunJianHao <24031212195@stu.xidian.edu.cn> Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit b3f5c2a41a0d0d2efbfb4dcdcdc086856562b28b Author: Fredric Cover Date: Sat Mar 28 18:47:53 2026 -0700 fs/smb/client: add verbose error logging for UNC parsing Add cifs_dbg(VFS, ...) statements to smb3_parse_devname() to provide explicit feedback when parsing fails. Currently, the function returns -EINVAL silently, making it difficult to debug mount failures caused by malformed paths or missing share names. Signed-off-by: Fredric Cover Acked-by: Henrique Carvalho <[2]henrique.carvalho@suse.com> Signed-off-by: Steve French commit 2c6805145e1605cef39459f78979f7edee251b41 Author: Daniel Palmer Date: Sat Apr 4 11:31:08 2026 +0900 m68k: Fix task info flags handling for 68000 The logic for deciding what to do after a syscall should be checking if any of the lower byte bits are set and then checking if the reschedule bit is set. Currently we are loading the top word, checking if any bits are set (which never seems to be true) and thus jumping over loading the whole long and checking if the reschedule bit is set. We get the thread info in two places so split that logic out in a macro and then fix the code so that it loads the byte of the flags we need to check, checks if anything is set and then checks if the reschedule bit in particular is set. Reported-by: Christoph Plattner Signed-off-by: Daniel Palmer Signed-off-by: Greg Ungerer commit fbe80bd6993a059ca366a3561051b419f3cd2b29 Author: Ronan Pigott Date: Sun Apr 5 10:28:25 2026 -0700 x86/split_lock: Don't warn about unknown split_lock_detect parameter The split_lock_detect command line parameter is handled in sld_setup() shortly after cpu_parse_early_param() but still before parse_early_param(). Add a dummy parsing function so that parse_early_param() doesn't later complain about the "unknown" parameter split_lock_detect=, and pass it along to init. [ bp: Massage commit message. ] Signed-off-by: Ronan Pigott Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260405181807.3906-1-ronan@rjp.ie commit 3bac01168982ec3e3bf87efdc1807c7933590a85 Author: Lance Yang Date: Wed Apr 1 21:10:32 2026 +0800 mm: fix deferred split queue races during migration migrate_folio_move() records the deferred split queue state from src and replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0) makes dst visible before it is requeued, so a concurrent rmap-removal path can mark dst partially mapped and trip the WARN in deferred_split_folio(). Move the requeue before remove_migration_ptes() so dst is back on the deferred split queue before it becomes visible again. Because migration still holds dst locked at that point, teach deferred_split_scan() to requeue a folio when folio_trylock() fails. Otherwise a fully mapped underused folio can be dequeued by the shrinker and silently lost from split_queue. [ziy@nvidia.com: move the comment] Link: https://lkml.kernel.org/r/FB71A764-0F10-4E5A-B4A0-BA4C7F138408@nvidia.com Link: https://syzkaller.appspot.com/bug?extid=a7067a757858ac8eb085 Link: https://lkml.kernel.org/r/20260401131032.13011-1-lance.yang@linux.dev Fixes: 8a8ca142a488 ("mm: migrate: requeue destination folio on deferred split queue") Signed-off-by: Lance Yang Signed-off-by: Zi Yan Reported-by: syzbot+a7067a757858ac8eb085@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-mm/69ccb65b.050a0220.183828.003a.GAE@google.com/ Suggested-by: David Hildenbrand (Arm) Acked-by: David Hildenbrand (Arm) Acked-by: Zi Yan Cc: Alistair Popple Cc: Baolin Wang Cc: Barry Song Cc: Byungchul Park Cc: David Hildenbrand Cc: Deepanshu Kartikey Cc: Dev Jain Cc: Gregory Price Cc: "Huang, Ying" Cc: Joshua Hahn Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Brost Cc: Nico Pache Cc: Rakie Kim Cc: Ryan Roberts Cc: Wei Yang Cc: Ying Huang Cc: Usama Arif Cc: Signed-off-by: Andrew Morton commit 5a62019807da4a7add0717c962ac83b23dd12b2c Author: Lorenzo Stoakes (Oracle) Date: Tue Mar 31 13:11:18 2026 +0100 mm/khugepaged: fix issue with tracking lock We are incorrectly treating lock_dropped to track both whether the lock is currently held and whether or not the lock was ever dropped. Update this change to account for this. Link: https://lkml.kernel.org/r/7760c811-e100-4d40-9217-0813c28314be@lucifer.local Fixes: 330f3758a3bc ("mm/khugepaged: unify khugepaged and madv_collapse with collapse_single_pmd()") Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Lance Yang Reviewed-by: Nico Pache Cc: Alistair Popple Cc: Andrea Arcangeli Cc: Anshuman Khandual Cc: Baolin Wang Cc: Barry Song Cc: Brendan Jackman Cc: Byungchul Park Cc: Catalin Marinas Cc: David Hildenbrand Cc: David Rientjes Cc: Dev Jain Cc: Gregory Price Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Kefeng Wang Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Matthew Brost Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nanyong Sun Cc: Pedro Falcato Cc: Peter Xu Cc: Rafael Aquini Cc: Rakie Kim Cc: Randy Dunlap Cc: Ryan Roberts Cc: Shivank Garg Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Takashi Iwai (SUSE) Cc: Thomas Hellström Cc: Usama Arif Cc: Vishal Moola (Oracle) Cc: Vlastimil Babka Cc: Wei Yang Cc: Will Deacon Cc: Yang Shi Cc: Zach O'Keefe Cc: Zi Yan Signed-off-by: Andrew Morton commit bf263bcaf61f6e921c458ce4c5a9100192447c8c Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:30 2026 +0000 mm/huge_memory: add and use has_deposited_pgtable() Rather than thread has_deposited through zap_huge_pmd(), make things clearer by adding has_deposited_pgtable() with comments describing why in each case. [ljs@kernel.org: fix folio_put()-before-recheck issue, per Sashiko] Link: https://lkml.kernel.org/r/0a917f80-902f-49b0-a75f-1bbaf23d7f94@lucifer.local Link: https://lkml.kernel.org/r/f9db59ca90937e39913d50ecb4f662e2bad17bbb.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Qi Zheng Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit d80a9cb1a64ab9c817b6262c7e4e433b6a3581a0 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:29 2026 +0000 mm/huge_memory: add and use normal_or_softleaf_folio_pmd() Now we have pmd_to_softleaf_folio() available to us which also raises a CONFIG_DEBUG_VM warning if unexpectedly an invalid softleaf entry, we can now abstract folio handling altogether. vm_normal_folio() deals with the huge zero page (which is present), as well as PFN map/mixed map mappings in both cases returning NULL. Otherwise, we try to obtain the softleaf folio. This makes the logic far easier to comprehend and has it use the standard vm_normal_folio_pmd() path for decoding of present entries. Finally, we have to update the flushing logic to only do so if a folio is established. This patch also makes the 'is_present' value more accurate - because PFN map, mixed map and zero huge pages are present, just not present and 'normal'. [ljs@kernel.org: avoid bisection hazard] Link: https://lkml.kernel.org/r/d0cc6161-77a4-42ba-a411-96c23c78df1b@lucifer.local Link: https://lkml.kernel.org/r/c2be872d64ef9573b80727d9ab5446cf002f17b5.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Qi Zheng Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 64b7d889d03ce94940d6dd9440c4e74c1108ac78 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:28 2026 +0000 mm: add softleaf_is_valid_pmd_entry(), pmd_to_softleaf_folio() Separate pmd_is_valid_softleaf() into separate components, then use the pmd_is_valid_softleaf() predicate to implement pmd_to_softleaf_folio(). This returns the folio associated with a softleaf entry at PMD level. It expects this to be valid for a PMD entry. If CONFIG_DEBUG_VM is set, then assert on this being an invalid entry, and either way return NULL in this case. This lays the ground for further refactorings. Link: https://lkml.kernel.org/r/b677592596274fa3fd701890497948e4b0e07cec.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Qi Zheng Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit f87854c9091014207ecb5bc108810ff3e4dbb08f Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:27 2026 +0000 mm/huge_memory: separate out the folio part of zap_huge_pmd() Place the part of the logic that manipulates counters and possibly updates the accessed bit of the folio into its own function to make zap_huge_pmd() more readable. Also rename flush_needed to is_present as we only require a flush for present entries. Additionally add comments as to why we're doing what we're doing with respect to softleaf entries. This also lays the ground for further refactoring. Link: https://lkml.kernel.org/r/6c4db67952f5529da4db102a6149b9050b5dda4e.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Baolin Wang Reviewed-by: Suren Baghdasaryan Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Qi Zheng Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 1c6b7ff60bd477bb73b737e2955c0ad49cffd7ca Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:26 2026 +0000 mm/huge_memory: use mm instead of tlb->mm Reduce the repetition, and lay the ground for further refactorings by keeping this variable separate. Link: https://lkml.kernel.org/r/98104cde87e4b2aabeb16f236b8731591594457f.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Baolin Wang Reviewed-by: Suren Baghdasaryan Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Qi Zheng Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 1fc034c1c9dd387f6f82be93326b0add6ffd49e7 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:25 2026 +0000 mm/huge_memory: remove unnecessary sanity checks These checks have been in place since 2014, I think we can safely assume that we are in a place where we don't need these as runtime checks. In addition there are 4 other invocations of folio_remove_rmap_pmd(), none of which make this assertion. If we need to add this assertion, it should be in folio_remove_rmap_pmd(), and as a VM_WARN_ON_ONCE(), however these seem superfluous so just remove them. Link: https://lkml.kernel.org/r/0c4c5ab247c90f80cf44718e8124b217d6a22544.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Qi Zheng Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit d490940f3a409f640bf98f8966c8e863b2452692 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:24 2026 +0000 mm/huge_memory: deduplicate zap deposited table call Rather than having separate logic for each case determining whether to zap the deposited table, simply track this via a boolean. We default this to whether the architecture requires it, and update it as required elsewhere. Link: https://lkml.kernel.org/r/71f576a1fbcd27a86322d12caa937bcdacf75407.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Baolin Wang Reviewed-by: Suren Baghdasaryan Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Qi Zheng Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 07f264680ac875725ca12e6adadd9e3def2e30f2 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:23 2026 +0000 mm/huge_memory: remove unnecessary VM_BUG_ON_PAGE() This has been around since the beginnings of the THP implementation. I think we can safely assume that, if we have a THP folio, it will have a head page. Link: https://lkml.kernel.org/r/f3fa8eb4634ccb2e78209f570cc1a769a02ce93e.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Baolin Wang Reviewed-by: Suren Baghdasaryan Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Qi Zheng Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 7217744e0aa373dd6f0a62b0db610ff085e50153 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:22 2026 +0000 mm/huge_memory: add a common exit path to zap_huge_pmd() Other than when we acquire the PTL, we always need to unlock the PTL, and optionally need to flush on exit. The code is currently very duplicated in this respect, so default flush_needed to false, set it true in the case in which it's required, then share the same logic for all exit paths. This also makes flush_needed make more sense as a function-scope value (we don't need to flush for the PFN map/mixed map, zero huge, error cases for instance). Link: https://lkml.kernel.org/r/6b281d8ed972dff0e89bdcbdd810c96c7ae8c9dc.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Baolin Wang Reviewed-by: Suren Baghdasaryan Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Qi Zheng Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 7011140612fd13000b2ebed43e1bfb542f90b959 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:21 2026 +0000 mm/huge_memory: handle buggy PMD entry in zap_huge_pmd() A recent bug I analysed managed to, through a bug in the userfaultfd implementation, reach an invalid point in the zap_huge_pmd() code where the PMD was none of: - A non-DAX, PFN or mixed map. - The huge zero folio - A present PMD entry - A softleaf entry The code at this point calls folio_test_anon() on a known-NULL folio. Having logic like this explicitly NULL dereference in the code is hard to understand, and makes debugging potentially more difficult. Add an else branch to handle this case and WARN(). No functional change intended. Link: https://lore.kernel.org/all/6b3d7ad7-49e1-407a-903d-3103704160d8@lucifer.local/ Link: https://lkml.kernel.org/r/fcf1f6de84a2ace188b6bf103fa15dde695f1ed8.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Baolin Wang Reviewed-by: Suren Baghdasaryan Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Qi Zheng Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit b92b9d4f699ce1f0ae746ebc69bca329adc07293 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:20 2026 +0000 mm/huge_memory: have zap_huge_pmd return a boolean, add kdoc There's no need to use the ancient approach of returning an integer here, just return a boolean. Also update flush_needed to be a boolean, similarly. Also add a kdoc comment describing the function. No functional change intended. Link: https://lkml.kernel.org/r/132274566cd49d2960a2294c36dd2450593dfc55.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Baolin Wang Acked-by: Qi Zheng Reviewed-by: Suren Baghdasaryan Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 6886f93790b3c1935bfb9e668a7c3f68d7eff510 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:19 2026 +0000 mm/huge: avoid big else branch in zap_huge_pmd() We don't need to have an extra level of indentation, we can simply exit early in the first two branches. No functional change intended. Link: https://lkml.kernel.org/r/6b4d5efdbf5554b8fe788f677d0b50f355eec999.1774029655.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Baolin Wang Acked-by: Qi Zheng Reviewed-by: Suren Baghdasaryan Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit c0ea52c18c78c33c68c350eb9d3dcdf8c513254d Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 18:07:18 2026 +0000 mm/huge_memory: simplify vma_is_specal_huge() Patch series "mm/huge_memory: refactor zap_huge_pmd()", v3. zap_huge_pmd() is overly complicated, clean it up and also add an assert in the case that we encounter a buggy PMD entry that doesn't match expectations. This is motivated by a bug discovered [0] where the PMD entry was none of: * A non-DAX, PFN or mixed map. * The huge zero folio * A present PMD entry * A softleaf entry In zap_huge_pmd(), but due to the bug we manged to reach this code. It is useful to explicitly call this out rather than have an arbitrary NULL pointer dereference happen, which also improves understanding of what's going on. The series goes further to make use of vm_normal_folio_pmd() rather than implementing custom logic for retrieving the folio, and extends softleaf functionality to provide and use an equivalent softleaf function. This patch (of 13): This function is confused - it overloads the term 'special' yet again, checks for DAX but in many cases the code explicitly excludes DAX before invoking the predicate. It also unnecessarily checks for vma->vm_file - this has to be present for a driver to have set VMA_MIXEDMAP_BIT or VMA_PFNMAP_BIT. In fact, a far simpler form of this is to reverse the DAX predicate and return false if DAX is set. This makes sense from the point of view of 'special' as in vm_normal_page(), as DAX actually does potentially have retrievable folios. Also there's no need to have this in mm.h so move it to huge_memory.c. No functional change intended. Link: https://lkml.kernel.org/r/cover.1774029655.git.ljs@kernel.org Link: https://lkml.kernel.org/r/d2b65883dc4895f197c4b4a69fbf27a063463412.1774029655.git.ljs@kernel.org Link: https://lore.kernel.org/all/6b3d7ad7-49e1-407a-903d-3103704160d8@lucifer.local/ [0] Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Zi Yan Cc: Qi Zheng Signed-off-by: Andrew Morton commit 1a0fe419f6af85b3ff311be46bfbff1b615b083d Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:47 2026 +0000 mm: on remap assert that input range within the proposed VMA Now we have range_in_vma_desc(), update remap_pfn_range_prepare() to check whether the input range in contained within the specified VMA, so we can fail at prepare time if an invalid range is specified. This covers the I/O remap mmap actions also which ultimately call into this function, and other mmap action types either already span the full VMA or check this already. Link: https://lkml.kernel.org/r/0fc1092f4b74f3f673a58e4e3942dc83f336dd85.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 62c65fd740e979a3967db08971b93aefcec510d4 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:46 2026 +0000 mm: add mmap_action_map_kernel_pages[_full]() A user can invoke mmap_action_map_kernel_pages() to specify that the mapping should map kernel pages starting from desc->start of a specified number of pages specified in an array. In order to implement this, adjust mmap_action_prepare() to be able to return an error code, as it makes sense to assert that the specified parameters are valid as quickly as possible as well as updating the VMA flags to include VMA_MIXEDMAP_BIT as necessary. This provides an mmap_prepare equivalent of vm_insert_pages(). We additionally update the existing vm_insert_pages() code to use range_in_vma() and add a new range_in_vma_desc() helper function for the mmap_prepare case, sharing the code between the two in range_is_subset(). We add both mmap_action_map_kernel_pages() and mmap_action_map_kernel_pages_full() to allow for both partial and full VMA mappings. We update the documentation to reflect the new features. Finally, we update the VMA tests accordingly to reflect the changes. Link: https://lkml.kernel.org/r/926ac961690d856e67ec847bee2370ab3c6b9046.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 933f05f58ac6014eaac387d22a76ace8606891d1 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:45 2026 +0000 uio: replace deprecated mmap hook with mmap_prepare in uio_info The f_op->mmap interface is deprecated, so update uio_info to use its successor, mmap_prepare. Therefore, replace the uio_info->mmap hook with a new uio_info->mmap_prepare hook, and update its one user, target_core_user, to both specify this new mmap_prepare hook and also to use the new vm_ops->mapped() hook to continue to maintain a correct udev->kref refcount. Then update uio_mmap() to utilise the mmap_prepare compatibility layer to invoke this callback from the uio mmap invocation. Link: https://lkml.kernel.org/r/157583e4477705b496896c7acd4ac88a937b8fa6.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit f98cb7ca4aa44645347771c2c2a9724bc210c49e Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:44 2026 +0000 drivers: hv: vmbus: replace deprecated mmap hook with mmap_prepare The f_op->mmap interface is deprecated, so update the vmbus driver to use its successor, mmap_prepare. This updates all callbacks which referenced the function pointer hv_mmap_ring_buffer to instead reference hv_mmap_prepare_ring_buffer, utilising the newly introduced compat_set_desc_from_vma() and __compat_vma_mmap() to be able to implement this change. The UIO HV generic driver is the only user of hv_create_ring_sysfs(), which is the only function which references vmbus_channel->mmap_prepare_ring_buffer which, in turn, is the only external interface to hv_mmap_prepare_ring_buffer. This patch therefore updates this caller to use mmap_prepare instead, which also previously used vm_iomap_memory(), so this change replaces it with its mmap_prepare equivalent, mmap_action_simple_ioremap(). [akpm@linux-foundation.org: restore struct vmbus_channel comment, per Michael Kelley] Link: https://lkml.kernel.org/r/05467cb62267d750e5c770147517d4df0246cda6.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Michael Kelley Tested-by: Michael Kelley Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 668937b7b2256f4b2a982e8f69b07d9ee8f81d36 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:43 2026 +0000 mm: allow handling of stacked mmap_prepare hooks in more drivers While the conversion of mmap hooks to mmap_prepare is underway, we will encounter situations where mmap hooks need to invoke nested mmap_prepare hooks. The nesting of mmap hooks is termed 'stacking'. In order to flexibly facilitate the conversion of custom mmap hooks in drivers which stack, we must split up the existing __compat_vma_mmap() function into two separate functions: * compat_set_desc_from_vma() - This allows the setting of a vm_area_desc object's fields to the relevant fields of a VMA. * __compat_vma_mmap() - Once an mmap_prepare hook has been executed upon a vm_area_desc object, this function performs any mmap actions specified by the mmap_prepare hook and then invokes its vm_ops->mapped() hook if any were specified. In ordinary cases, where a file's f_op->mmap_prepare() hook simply needs to be invoked in a stacked mmap() hook, compat_vma_mmap() can be used. However some drivers define their own nested hooks, which are invoked in turn by another hook. A concrete example is vmbus_channel->mmap_ring_buffer(), which is invoked in turn by bin_attribute->mmap(): vmbus_channel->mmap_ring_buffer() has a signature of: int (*mmap_ring_buffer)(struct vmbus_channel *channel, struct vm_area_struct *vma); And bin_attribute->mmap() has a signature of: int (*mmap)(struct file *, struct kobject *, const struct bin_attribute *attr, struct vm_area_struct *vma); And so compat_vma_mmap() cannot be used here for incremental conversion of hooks from mmap() to mmap_prepare(). There are many such instances like this, where conversion to mmap_prepare would otherwise cascade to a huge change set due to nesting of this kind. The changes in this patch mean we could now instead convert vmbus_channel->mmap_ring_buffer() to vmbus_channel->mmap_prepare_ring_buffer(), and implement something like: struct vm_area_desc desc; int err; compat_set_desc_from_vma(&desc, file, vma); err = channel->mmap_prepare_ring_buffer(channel, &desc); if (err) return err; return __compat_vma_mmap(&desc, vma); Allowing us to incrementally update this logic, and other logic like it. Unfortunately, as part of this change, we need to be able to flexibly assign to the VMA descriptor, so have to remove some of the const declarations within the structure. Also update the VMA tests to reflect the changes. Link: https://lkml.kernel.org/r/24aac3019dd34740e788d169fccbe3c62781e648.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 14beec0344954b8a84cb1575ae18667fe9205080 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:42 2026 +0000 staging: vme_user: replace deprecated mmap hook with mmap_prepare The f_op->mmap interface is deprecated, so update driver to use its successor, mmap_prepare. The driver previously used vm_iomap_memory(), so this change replaces it with its mmap_prepare equivalent, mmap_action_simple_ioremap(). Functions that wrap mmap() are also converted to wrap mmap_prepare() instead. Also update the documentation accordingly. Link: https://lkml.kernel.org/r/08ecc1e1d319564fd49b9e9012f994edaff921db.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit b0085cb94d2477787f4197a3000e33aabf3d48fc Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:41 2026 +0000 stm: replace deprecated mmap hook with mmap_prepare The f_op->mmap interface is deprecated, so update driver to use its successor, mmap_prepare. The driver previously used vm_iomap_memory(), so this change replaces it with its mmap_prepare equivalent, mmap_action_simple_ioremap(). Also, in order to correctly maintain reference counting, add a vm_ops->mapped callback to increment the reference count when successfully mapped. Link: https://lkml.kernel.org/r/9f3d559a264a83cf45518fcf35cc7ef1d7dfd500.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 0858653748eec59c1133fafc37b2bb7f6b20b6b4 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:40 2026 +0000 mtdchar: replace deprecated mmap hook with mmap_prepare, clean up Replace the deprecated mmap callback with mmap_prepare. Commit f5cf8f07423b ("mtd: Disable mtdchar mmap on MMU systems") commented out the CONFIG_MMU part of this function back in 2012, so after ~14 years it's probably reasonable to remove this altogether rather than updating dead code. Link: https://lkml.kernel.org/r/d036855c21962c58ace0eb24ecd6d973d77424fe.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Richard Weinberger Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 10de8b811eb4a770403014a4d7b7e9ff94ddc6a6 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:39 2026 +0000 hpet: replace deprecated mmap hook with mmap_prepare The f_op->mmap interface is deprecated, so update driver to use its successor, mmap_prepare. The driver previously used vm_iomap_memory(), so this change replaces it with its mmap_prepare equivalent, mmap_action_simple_ioremap(). Link: https://lkml.kernel.org/r/094c5fcfb2459a4f6d791b1fb852b01e252a44d4.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit d8bc7934db0cb96452899ec93887e3ca6f541899 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:38 2026 +0000 misc: open-dice: replace deprecated mmap hook with mmap_prepare The f_op->mmap interface is deprecated, so update driver to use its successor, mmap_prepare. The driver previously used vm_iomap_memory(), so this change replaces it with its mmap_prepare equivalent, mmap_action_simple_ioremap(). Link: https://lkml.kernel.org/r/5a83ab00195dc8d0609fa6cc525493010ac4ead1.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit a1b7fb40cb71a33c68a609fcee0946425d698415 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:37 2026 +0000 mm: add mmap_action_simple_ioremap() Currently drivers use vm_iomap_memory() as a simple helper function for I/O remapping memory over a range starting at a specified physical address over a specified length. In order to utilise this from mmap_prepare, separate out the core logic into __simple_ioremap_prep(), update vm_iomap_memory() to use it, and add simple_ioremap_prepare() to do the same with a VMA descriptor object. We also add MMAP_SIMPLE_IO_REMAP and relevant fields to the struct mmap_action type to permit this operation also. We use mmap_action_ioremap() to set up the actual I/O remap operation once we have checked and figured out the parameters, which makes simple_ioremap_prepare() easy to implement. We then add mmap_action_simple_ioremap() to allow drivers to make use of this mode. We update the mmap_prepare documentation to describe this mode. Finally, we update the VMA tests to reflect this change. Link: https://lkml.kernel.org/r/a08ef1c4542202684da63bb37f459d5dbbeddd91.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Suren Baghdasaryan Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 4995c67d4ed32b78415d9ed9237808fdf6a40c6d Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:36 2026 +0000 fs: afs: restore mmap_prepare implementation Commit 9d5403b1036c ("fs: convert most other generic_file_*mmap() users to .mmap_prepare()") updated AFS to use the mmap_prepare callback in favour of the deprecated mmap callback. However, it did not account for the fact that mmap_prepare is called pre-merge, and may then be merged, nor that mmap_prepare can fail to map due to an out of memory error. This change was therefore since reverted. Both of those are cases in which we should not be incrementing a reference count. With the newly added vm_ops->mapped callback available, we can simply defer this operation to that callback which is only invoked once the mapping is successfully in place (but not yet visible to userspace as the mmap and VMA write locks are held). This allows us to once again reimplement the .mmap_prepare implementation for this file system. Therefore add afs_mapped() to implement this callback for AFS, and remove the code doing so in afs_mmap_prepare(). Also update afs_vm_open(), afs_vm_close() and afs_vm_map_pages() to be consistent in how the vnode is accessed. Link: https://lkml.kernel.org/r/ad9a94350a9c7d2bdab79fc397ef0f64d3412d71.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit fbfc6578eaca12daa0c09df1e9ba7f2c657b49da Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:35 2026 +0000 fs: afs: revert mmap_prepare() change Partially reverts commit 9d5403b1036c ("fs: convert most other generic_file_*mmap() users to .mmap_prepare()"). This is because the .mmap invocation establishes a refcount, but .mmap_prepare is called at a point where a merge or an allocation failure might happen after the call, which would leak the refcount increment. Functionality is being added to permit the use of .mmap_prepare in this case, but in the interim, we need to fix this. Link: https://lkml.kernel.org/r/08804c94e39d9102a3a8fbd12385e8aa079ba1d3.1774045440.git.ljs@kernel.org Fixes: 9d5403b1036c ("fs: convert most other generic_file_*mmap() users to .mmap_prepare()") Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Vlastimil Babka (SUSE) Cc: Wei Liu Cc: Signed-off-by: Andrew Morton commit c50ca15dd4962bdf834945c2fa29b904042f366a Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:34 2026 +0000 mm: add vm_ops->mapped hook Previously, when a driver needed to do something like establish a reference count, it could do so in the mmap hook in the knowledge that the mapping would succeed. With the introduction of f_op->mmap_prepare this is no longer the case, as it is invoked prior to actually establishing the mapping. mmap_prepare is not appropriate for this kind of thing as it is called before any merge might take place, and after which an error might occur meaning resources could be leaked. To take this into account, introduce a new vm_ops->mapped callback which is invoked when the VMA is first mapped (though notably - not when it is merged - which is correct and mirrors existing mmap/open/close behaviour). We do better that vm_ops->open() here, as this callback can return an error, at which point the VMA will be unmapped. Note that vm_ops->mapped() is invoked after any mmap action is complete (such as I/O remapping). We intentionally do not expose the VMA at this point, exposing only the fields that could be used, and an output parameter in case the operation needs to update the vma->vm_private_data field. In order to deal with stacked filesystems which invoke inner filesystem's mmap() invocations, add __compat_vma_mapped() and invoke it on vfs_mmap() (via compat_vma_mmap()) to ensure that the mapped callback is handled when an mmap() caller invokes a nested filesystem's mmap_prepare() callback. Update the mmap_prepare documentation to describe the mapped hook and make it clear what its intended use is. The vm_ops->mapped() call is handled by the mmap complete logic to ensure the same code paths are handled by both the compatibility and VMA layers. Additionally, update VMA userland test headers to reflect the change. Link: https://lkml.kernel.org/r/4c5e98297eb0aae9565c564e1c296a112702f144.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 382c0f2895d2f16252941fe739227e081eb50f1f Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:33 2026 +0000 mm: have mmap_action_complete() handle the rmap lock and unmap Rather than have the callers handle this both the rmap lock release and unmapping the VMA on error, handle it within the mmap_action_complete() logic where it makes sense to, being careful not to unlock twice. This simplifies the logic and makes it harder to make mistake with this, while retaining correct behaviour with regard to avoiding deadlocks. Also replace the call_action_complete() function with a direct invocation of mmap_action_complete() as the abstraction is no longer required. Also update the VMA tests to reflect this change. Link: https://lkml.kernel.org/r/8d1ee8ebd3542d006a47e8382fb80cf5b57ecf10.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 04501e759e789288ba8359e04f83bcc00269611e Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:32 2026 +0000 mm/vma: remove superfluous map->hold_file_rmap_lock We don't need to reference this field, it's confusing as it duplicates mmap_action->hide_from_rmap_until_complete, so thread the mmap_action through to __mmap_new_vma() instead and use the same field consistently. Link: https://lkml.kernel.org/r/42c3fbb701e361a17193ecda0d2dabcc326288a5.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 33506d4bae9516beb9ad22ad3ce18c1a8e47aeb0 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:31 2026 +0000 mm: switch the rmap lock held option off in compat layer In the mmap_prepare compatibility layer, we don't need to hold the rmap lock, as we are being called from an .mmap handler. The .mmap_prepare hook, when invoked in the VMA logic, is called prior to the VMA being instantiated, but the completion hook is called after the VMA is linked into the maple tree, meaning rmap walkers can reach it. The mmap hook does not link the VMA into the tree, so this cannot happen. Therefore it's safe to simply disable this in the mmap_prepare compatibility layer. Also update VMA tests code to reflect current compatibility layer state. [akpm@linux-foundation.org: fix comment typo, per Vlastimil] Link: https://lkml.kernel.org/r/dda74230d26a1fcd79a3efab61fa4101dd1cac64.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit f96e1d5f15b7c854a6a9ec1225d68a12fe7dcda6 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:30 2026 +0000 mm: avoid deadlock when holding rmap on mmap_prepare error Commit ac0a3fc9c07d ("mm: add ability to take further action in vm_area_desc") added the ability for drivers to instruct mm to take actions after the .mmap_prepare callback is complete. To make life simpler and safer, this is done before the VMA/mmap write lock is dropped but when the VMA is completely established. So on error, we simply munmap() the VMA. As part of this implementation, unfortunately a horrible hack had to be implemented to support some questionable behaviour hugetlb relies upon - that is that the file rmap lock is held until the operation is complete. The implementation, for convenience, did this in mmap_action_finish() so both the VMA and mmap_prepare compatibility layer paths would have this correctly handled. However, it turns out there is a mistake here - the rmap lock cannot be held on munmap, as free_pgtables() -> unlink_file_vma_batch_add() -> unlink_file_vma_batch_process() takes the file rmap lock. We therefore currently have a deadlock issue that might arise. Resolve this by leaving it to callers to handle the unmap. The compatibility layer does not support this rmap behaviour, so we simply have it unmap on error after calling mmap_action_complete(). In the VMA implementation, we only perform the unmap after the rmap lock is dropped. This resolves the issue by ensuring the rmap lock is always dropped when the unmap occurs. Link: https://lkml.kernel.org/r/d44248be9da68258b07c2c59d4e73485ee0ca943.1774045440.git.ljs@kernel.org Fixes: ac0a3fc9c07d ("mm: add ability to take further action in vm_area_desc") Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Vlastimil Babka (SUSE) Cc: Wei Liu Cc: Signed-off-by: Andrew Morton commit 827e97cf4bf59e9a72bcec37944bcebb3139a457 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:29 2026 +0000 mm: document vm_operations_struct->open the same as close() Describe when the operation is invoked and the context in which it is invoked, matching the description already added for vm_op->close(). While we're here, update all outdated references to an 'area' field for VMAs to the more consistent 'vma'. Link: https://lkml.kernel.org/r/7d0ca833c12014320f0fa00f816f95e6e10076f2.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit fdd247841380d86c9e38027cb519b6fc45930a83 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:28 2026 +0000 mm: add documentation for the mmap_prepare file operation callback This documentation makes it easier for a driver/file system implementer to correctly use this callback. It covers the fundamentals, whilst intentionally leaving the less lovely possible actions one might take undocumented (for instance - the success_hook, error_hook fields in mmap_action). The document also covers the new VMA flags implementation which is the only one which will work correctly with mmap_prepare. Link: https://lkml.kernel.org/r/3aebf918c213fa2aecf00a31a444119b5bdd7801.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 3e4bb2706817710d9461394da8b75be79981586b Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 22:39:27 2026 +0000 mm: various small mmap_prepare cleanups Patch series "mm: expand mmap_prepare functionality and usage", v4. This series expands the mmap_prepare functionality, which is intended to replace the deprecated f_op->mmap hook which has been the source of bugs and security issues for some time. This series starts with some cleanup of existing mmap_prepare logic, then adds documentation for the mmap_prepare call to make it easier for filesystem and driver writers to understand how it works. It then importantly adds a vm_ops->mapped hook, a key feature that was missing from mmap_prepare previously - this is invoked when a driver which specifies mmap_prepare has successfully been mapped but not merged with another VMA. mmap_prepare is invoked prior to a merge being attempted, so you cannot manipulate state such as reference counts as if it were a new mapping. The vm_ops->mapped hook allows a driver to perform tasks required at this stage, and provides symmetry against subsequent vm_ops->open,close calls. The series uses this to correct the afs implementation which wrongly manipulated reference count at mmap_prepare time. It then adds an mmap_prepare equivalent of vm_iomap_memory() - mmap_action_simple_ioremap(), then uses this to update a number of drivers. It then splits out the mmap_prepare compatibility layer (which allows for invocation of mmap_prepare hooks in an mmap() hook) in such a way as to allow for more incremental implementation of mmap_prepare hooks. It then uses this to extend mmap_prepare usage in drivers. Finally it adds an mmap_prepare equivalent of vm_map_pages(), which lays the foundation for future work which will extend mmap_prepare to DMA coherent mappings. This patch (of 21): Rather than passing arbitrary fields, pass a vm_area_desc pointer to mmap prepare functions to mmap prepare, and an action and vma pointer to mmap complete in order to put all the action-specific logic in the function actually doing the work. Additionally, allow mmap prepare functions to return an error so we can error out as soon as possible if there is something logically incorrect in the input. Update remap_pfn_range_prepare() to properly check the input range for the CoW case. Also remove io_remap_pfn_range_complete(), as we can simply set up the fields correctly in io_remap_pfn_range_prepare() and use remap_pfn_range_complete() for this. While we're here, make remap_pfn_range_prepare_vma() a little neater, and pass mmap_action directly to call_action_complete(). Then, update compat_vma_mmap() to perform its logic directly, as __compat_vma_map() is not used by anything so we don't need to export it. Also update compat_vma_mmap() to use vfs_mmap_prepare() rather than calling the mmap_prepare op directly. Finally, update the VMA userland tests to reflect the changes. Link: https://lkml.kernel.org/r/cover.1774045440.git.ljs@kernel.org Link: https://lkml.kernel.org/r/99f408e4694f44ab12bdc55fe0bd9685d3bd1117.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Alexander Shishkin Cc: Alexandre Torgue Cc: Al Viro Cc: Arnd Bergmann Cc: Bodo Stroesser Cc: Christian Brauner Cc: Clemens Ladisch Cc: David Hildenbrand Cc: David Howells Cc: Dexuan Cui Cc: Greg Kroah-Hartman Cc: Haiyang Zhang Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Marc Dionne Cc: "Martin K. Petersen" Cc: Maxime Coquelin Cc: Michal Hocko Cc: Mike Rapoport Cc: Miquel Raynal Cc: Pedro Falcato Cc: Richard Weinberger Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vignesh Raghavendra Cc: Wei Liu Signed-off-by: Andrew Morton commit 71fdcf9283536370235b5f0a0e3a79b715bdb078 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:42 2026 +0000 mm: simplify VMA flag tests of excluded flags We have implemented flag mask comparisons of the form: if ((vm_flags & (VM_FOO|VM_BAR|VM_BAZ) == VM_FOO) { ... } Like-for-like in the code using a bitwise-and mask via vma_flags_and() and using vma_flags_same() to ensure the final result equals only the required flag value. This is fine but confusing, make things clearer by instead explicitly excluding undesired flags and including the desired one via tests of the form: if (vma_flags_test(&flags, VMA_FOO_BIT) && !vma_flags_test_any(&flags, VMA_BAR_BIT, VMA_BAZ_BIT)) { ... } Which makes it easier to understand what is going on. No functional change intended. Link: https://lkml.kernel.org/r/d395c5dd837a9864f5efcec42175910afbe3ce73.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Suggested-by: Vlastimil Babka (SUSE) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 90cb921c4d7bf92854344d3e76561f48784c613e Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:41 2026 +0000 mm/vma: convert __mmap_region() to use vma_flags_t Update the mmap() implementation logic implemented in __mmap_region() and functions invoked by it. The mmap_region() function converts its input vm_flags_t parameter to a vma_flags_t value which it then passes to __mmap_region() which uses the vma_flags_t value consistently from then on. As part of the change, we convert map_deny_write_exec() to using vma_flags_t (it was incorrectly using unsigned long before), and place it in vma.h, as it is only used internal to mm. With this change, we eliminate the legacy is_shared_maywrite_vm_flags() helper function which is now no longer required. We are also able to update the MMAP_STATE() and VMG_MMAP_STATE() macros to use the vma_flags_t value. Finally, we update the VMA tests to reflect the change. Link: https://lkml.kernel.org/r/1fc33a404c962f02da778da100387cc19bd62153.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit a06eb2f8279e0b2b42799d42041f144377f5a086 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:40 2026 +0000 mm/vma: convert vma_modify_flags[_uffd]() to use vma_flags_t Update the vma_modify_flags() and vma_modify_flags_uffd() functions to accept a vma_flags_t parameter rather than a vm_flags_t one, and propagate the changes as needed to implement this change. Also add vma_flags_reset_once() in replacement of vm_flags_reset_once(). We still need to be careful here because we need to avoid tearing, so maintain the assumption that the first system word set of flags are the only ones that require protection from tearing, and retain this functionality. We can copy the remainder of VMA flags above 64 bits normally. But hopefully by the time that happens, we will have replaced the logic that requires these WRITE_ONCE()'s with something else. We also replace instances of vm_flags_reset() with a simple write of VMA flags. We are no longer perform a number of checks, most notable of all the VMA flags asserts becase: 1. We might be operating on a VMA that is not yet added to the tree. 2. We might be operating on a VMA that is now detached. 3. Really in all but core code, you should be using vma_desc_xxx(). 4. Other VMA fields are manipulated with no such checks. 5. It'd be egregious to have to add variants of flag functions just to account for cases such as the above, especially when we don't do so for other VMA fields. Drivers are the problematic cases and why it was especially important (and also for debug as VMA locks were introduced), the mmap_prepare work is solving this generally. Additionally, we can fairly safely assume by this point the soft dirty flags are being set correctly, so it's reasonable to drop this also. Finally, update the VMA tests to reflect this. Link: https://lkml.kernel.org/r/51afbb2b8c3681003cc7926647e37335d793836e.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit e2963f639fde9f71a759bdfee02697a610ae4819 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:39 2026 +0000 tools: bitmap: add missing bitmap_copy() implementation I need this for changes I am making to keep the VMA tests running correctly. Link: https://lkml.kernel.org/r/4dcb2fb959137e9fe58a23e21cebcea97de41a1f.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka (SUSE) Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 769669bd9ca4cbae2562d57fe753efdcf17a196d Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:38 2026 +0000 mm/vma: convert as much as we can in mm/vma.c to vma_flags_t Now we have established a good foundation for vm_flags_t to vma_flags_t changes, update mm/vma.c to utilise vma_flags_t wherever possible. We are able to convert VM_STARTGAP_FLAGS entirely as this is only used in mm/vma.c, and to account for the fact we can't use VM_NONE to make life easier, place the definition of this within existing #ifdef's to be cleaner. Generally the remaining changes are mechanical. Also update the VMA tests to reflect the changes. Link: https://lkml.kernel.org/r/5fdeaf8af9a12c2a5d68497495f52fa627d05a5b.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit a6f14fb59337ec3b507856430e0636b1b10980ec Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:37 2026 +0000 tools/testing/vma: update VMA tests to test vma_clear_flags[_mask]() The tests have existing flag clearing logic, so simply expand this to use the new VMA-specific flag clearing helpers. Also correct some trivial formatting issue in a macro define. Link: https://lkml.kernel.org/r/f5da681d3c33039dd4a838188385796eb8d58373.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka (SUSE) Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit d720b81d01b137dfc23e07461b05b76f822af6ab Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:36 2026 +0000 mm/vma: introduce vma_clear_flags[_mask]() Introduce a helper function and helper macro to easily clear a VMA's flags using the new vma_flags_t vma->flags field: * vma_clear_flags_mask() - Clears all of the flags in a specified mask in the VMA's flags field. * vma_clear_flags() - Clears all of the specified individual VMA flag bits in a VMA's flags field. Also update the VMA tests to reflect the change. Link: https://lkml.kernel.org/r/9bd15da35c2c90e7441265adf01b5c2d3b5c6d41.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 7eb19a87d9c0e9b18fb069fa03ba365291922242 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:35 2026 +0000 mm: update vma_supports_mlock() to use new VMA flags We now have the ability to test all of this using the new vma_flags_t approach, so let's do so. Link: https://lkml.kernel.org/r/49cc166dbafe0a81abc4581a9f5c84630b02fcb8.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 3a6455d56bd7c4cfb1ea35ddae052943065e338e Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:34 2026 +0000 mm: convert do_brk_flags() to use vma_flags_t In order to be able to do this, we need to change VM_DATA_DEFAULT_FLAGS and friends and update the architecture-specific definitions also. We then have to update some KSM logic to handle VMA flags, and introduce VMA_STACK_FLAGS to define the vma_flags_t equivalent of VM_STACK_FLAGS. We also introduce two helper functions for use during the time we are converting legacy flags to vma_flags_t values - vma_flags_to_legacy() and legacy_to_vma_flags(). This enables us to iteratively make changes to break these changes up into separate parts. We use these explicitly here to keep VM_STACK_FLAGS around for certain users which need to maintain the legacy vm_flags_t values for the time being. We are no longer able to rely on the simple VM_xxx being set to zero if the feature is not enabled, so in the case of VM_DROPPABLE we introduce VMA_DROPPABLE as the vma_flags_t equivalent, which is set to EMPTY_VMA_FLAGS if the droppable flag is not available. While we're here, we make the description of do_brk_flags() into a kdoc comment, as it almost was already. We use vma_flags_to_legacy() to not need to update the vm_get_page_prot() logic as this time. Note that in create_init_stack_vma() we have to replace the BUILD_BUG_ON() with a VM_WARN_ON_ONCE() as the tested values are no longer build time available. We also update mprotect_fixup() to use VMA flags where possible, though we have to live with a little duplication between vm_flags_t and vma_flags_t values for the time being until further conversions are made. While we're here, update VM_SPECIAL to be defined in terms of VMA_SPECIAL_FLAGS now we have vma_flags_to_legacy(). Finally, we update the VMA tests to reflect these changes. Link: https://lkml.kernel.org/r/d02e3e45d9a33d7904b149f5604904089fd640ae.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Paul Moore [SELinux] Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit bbbc17cb023018605457f455202e028cc1ce0418 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:33 2026 +0000 tools/testing/vma: test vma_flags_count,vma[_flags]_test_single_mask Update the VMA tests to assert that vma_flags_count() behaves as expected, as well as vma_flags_test_single_mask() and vma_test_single_mask(). For the test functions we can simply update the existing vma_test(), et al. test to also test the single_mask variants. We also add some explicit testing of an empty VMA flag to this test to ensure this is handled properly. In order to test vma_flags_count() we simply take an existing set of flags and gradually remove flags ensuring the count remains as expected throughout. We also update the vma[_flags]_test_all() tests to make clear the semantics that we expect vma[_flags]_test_all(..., EMPTY_VMA_FLAGS) to return true, as trivially, all flags of none are always set in VMA flags. Link: https://lkml.kernel.org/r/4af95d559cd2af0ba3388de1e1386b9f94c0e009.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka (SUSE) Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit e79d1c500f52506b9eab39e81017e30b76f2864d Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:32 2026 +0000 mm: introduce vma_flags_count() and vma[_flags]_test_single_mask() vma_flags_count() determines how many bits are set in VMA flags, using bitmap_weight(). vma_flags_test_single_mask() determines if a vma_flags_t set of flags contains a single flag specified as another vma_flags_t value, or if the sought flag mask is empty, it is defined to return false. This is useful when we want to declare a VMA flag as optionally a single flag in a mask or empty depending on kernel configuration. This allows us to have VM_NONE-like semantics when checking whether the flag is set. In a subsequent patch, we introduce the use of VMA_DROPPABLE of type vma_flags_t using precisely these semantics. It would be actively confusing to use vma_flags_test_any_single_mask() for this (and vma_flags_test_all_mask() is not correct to use here, as it trivially returns true when tested against an empty vma flags mask). We introduce vma_flags_count() to be able to assert that the compared flag mask is singular or empty, checked when CONFIG_DEBUG_VM is enabled. Also update the VMA tests as part of this change. Link: https://lkml.kernel.org/r/cd778dd02b9f2a01eb54d25a49dea8ec2ddf7753.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 63cdb667d1ec3683dd6b0358fce7cae7da7fffc7 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:31 2026 +0000 tools/testing/vma: update VMA flag tests to test vma_test[_any_mask]() Update the existing test logic to assert that vma_test(), vma_test_any() and vma_test_any_mask() (implicitly tested via vma_test_any()) are functioning correctly. We already have tests for other variants like this, so it's simply a matter of expanding those tests to also include tests for the VMA-specific helpers. Link: https://lkml.kernel.org/r/dea3e97c6c3dd86f1a3f1a0703241b03f6e3a33f.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka (SUSE) Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit fb67bba5d9b8561f433695c8916c097910193561 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:30 2026 +0000 mm/vma: introduce vma_test[_any[_mask]](), and make inlining consistent Introduce helper functions and macros to make it convenient to test flags and flag masks for VMAs, specifically: * vma_test() - determine if a single VMA flag is set in a VMA. * vma_test_any_mask() - determine if any flags in a vma_flags_t value are set in a VMA. * vma_test_any() - Helper macro to test if any of specific flags are set. Also, there are a mix of 'inline's and '__always_inline's in VMA helper function declarations, update to consistently use __always_inline. Finally, update the VMA tests to reflect the changes. Link: https://lkml.kernel.org/r/be1d71f08307d747a82232cbd8664a88c0f41419.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit a8add93f805b1e36f056b214568aa131fd6e4cbd Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:29 2026 +0000 tools/testing/vma: test that legacy flag helpers work correctly Update the existing compare_legacy_flags() predicate function to assert that legacy_to_vma_flags() and vma_flags_to_legacy() behave as expected. Link: https://lkml.kernel.org/r/3374e50053adb65818fde948ae3488e1e29ae8b1.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka (SUSE) Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit c8555bc95d6222aa729b3a1195e07e566707ec02 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:28 2026 +0000 mm/vma: introduce [vma_flags,legacy]_to_[legacy,vma_flags]() helpers While we are still converting VMA flags from vma_flags_t to vm_flags_t, introduce helpers to convert between the two to allow for iterative development without having to 'change the world' in a single commit'. Also update VMA flags tests to reflect the change. Finally, refresh vma_flags_overwrite_word(), vma_flag_overwrite_word_once(), vma_flags_set_word() and vma_flags_clear_word() in the VMA tests to reflect current kernel implementations - this should make no functional difference, but keeps the logic consistent between the two. Link: https://lkml.kernel.org/r/d3569470dbb3ae79134ca7c3eb3fc4df7086e874.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 3ee584538259c356c66146ac46f2e4fd2ba28bee Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:27 2026 +0000 mm/vma: introduce vma_flags_same[_mask/_pair]() Add helpers to determine if two sets of VMA flags are precisely the same, that is - that every flag set one is set in another, and neither contain any flags not set in the other. We also introduce vma_flags_same_pair() for cases where we want to compare two sets of VMA flags which are both non-const values. Also update the VMA tests to reflect the change, we already implicitly test that this functions correctly having used it for testing purposes previously. Link: https://lkml.kernel.org/r/4f764bf619e77205837c7c819b62139ef6337ca3.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 5fb55e951cf591c5e2d45273ceadbdcd0c44932c Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:26 2026 +0000 mm: unexport vm_brk_flags() and eliminate vm_flags parameter This function is only used by elf_load(), and that is a static function that doesn't need an exported symbol to invoke an internal function, so un-EXPORT_SYMBOLS() it. Also, the vm_flags parameter is unnecessary, as we only ever set VM_EXEC, so simply make this parameter a boolean. While we're here, clean up the mm.h definitions for the various vm_xxx() helpers so we actually specify parameter names and elide the redundant extern's. Link: https://lkml.kernel.org/r/7bada48ddf3f9dbd3e6c4fc50ec2f4de97706f52.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit b22a48ec095e4777a0acb7b2f64ee36d3e60ba9b Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:25 2026 +0000 tools/testing/vma: add simple test for append_vma_flags() Add a simple test for append_vma_flags() to assert that it behaves as expected. Additionally, include the VMA_REMAP_FLAGS definition in the VMA tests to allow us to use this value in the testing. Link: https://lkml.kernel.org/r/eebd946c5325ad7fae93027245a562eb1aeb68a2.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka (SUSE) Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit e8d464f4a94ccbcae8c9d3137ac5621b57ddd8a1 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:24 2026 +0000 mm/vma: add append_vma_flags() helper In order to be able to efficiently combine VMA flag masks with additional VMA flag bits we need to extend the concept introduced in mk_vma_flags() and __mk_vma_flags() by allowing the specification of a VMA flag mask to append VMA flag bits to. Update __mk_vma_flags() to allow for this and update mk_vma_flags() accordingly, and also provide append_vma_flags() to allow for the caller to specify which VMA flags mask to append to. Finally, update the VMA flags tests to reflect the change. Link: https://lkml.kernel.org/r/9f928cd4688270002f2c0c3777fcc9b49cc7a8ea.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 06531d2bf352e26c620003c8420e2cea91009293 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:23 2026 +0000 tools/testing/vma: fix VMA flag tests The VMA tests are incorrectly referencing NUM_VMA_FLAGS, which doesn't exist, rather they should reference NUM_VMA_FLAG_BITS. Additionally, remove the custom-written implementation of __mk_vma_flags() as this means we are not testing the code as present in the kernel, rather add the actual __mk_vma_flags() to dup.h and add #ifdef's to handle declarations differently depending on NUM_VMA_FLAG_BITS. Link: https://lkml.kernel.org/r/b19c63af3d5efdfe712bf5d5f89368a5360a60f7.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka (SUSE) Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 7ec1885a7e283caaf6566aedc1eea5988d545f97 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:22 2026 +0000 mm/vma: use new VMA flags for sticky flags logic Use the new vma_flags_t flags implementation to perform the logic around sticky flags and what flags are ignored on VMA merge. We make use of the new vma_flags_empty(), vma_flags_diff_pair(), and vma_flags_and_mask() functionality. Also update the VMA tests accordingly. Link: https://lkml.kernel.org/r/369574f06360ffa44707047e3b58eb4897345fba.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit bd44d91d0ccc6da5ed91844b89a23a7df4938548 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:21 2026 +0000 tools/testing/vma: convert bulk of test code to vma_flags_t Convert the test code to utilise vma_flags_t as opposed to the deprecate vm_flags_t as much as possible. As part of this change, add VMA_STICKY_FLAGS and VMA_SPECIAL_FLAGS as early versions of what these defines will look like in the kernel logic once this logic is implemented. Link: https://lkml.kernel.org/r/df90efe29300bd899989f695be4ae3adc901a828.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka (SUSE) Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 8228e42b5f88aa68708ced277399ee3b59748627 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:20 2026 +0000 mm/vma: add further vma_flags_t unions In order to utilise the new vma_flags_t type, we currently place it in union with legacy vm_flags fields of type vm_flags_t to make the transition smoother. Add vma_flags_t union entries for mm->def_flags and vmg->vm_flags - mm->def_vma_flags and vmg->vma_flags respectively. Once the conversion is complete, these will be replaced with vma_flags_t entries alone. Also update the VMA tests to reflect the change. Link: https://lkml.kernel.org/r/d507d542c089ba132e9da53f2ff7f80ca117c3b4.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit e4fd34b84b564105d478a8613b4fdc1c702c3607 Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:19 2026 +0000 tools/testing/vma: add unit tests flag empty, diff_pair, and[_mask] Add VMA unit tests to assert that: * vma_flags_empty() * vma_flags_diff_pair() * vma_flags_and_mask() * vma_flags_and() All function as expected. In additional to the added tests, in order to make testing easier, add vma_flags_same_mask() and vma_flags_same() for testing only. If/when these are required in kernel code, they can be moved over. Also add ASSERT_FLAGS_[NOT_]SAME[_MASK](), ASSERT_FLAGS_[NON]EMPTY() test helpers to make asserting flag state easier and more convenient. Link: https://lkml.kernel.org/r/471ce7ceb1d32e5fc9c0660966b9eacdf899b4d1.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka (SUSE) Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 6bc0987d0b508b3768808efafa1e90041713526b Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 20 19:38:18 2026 +0000 mm/vma: add vma_flags_empty(), vma_flags_and(), vma_flags_diff_pair() Patch series "mm/vma: convert vm_flags_t to vma_flags_t in vma code", v4. This series converts a lot of the existing use of the legacy vm_flags_t data type to the new vma_flags_t type which replaces it. In order to do so it adds a number of additional helpers: * vma_flags_empty() - Determines whether a vma_flags_t value has no bits set. * vma_flags_and() - Performs a bitwise AND between two vma_flags_t values. * vma_flags_diff_pair() - Determines which flags are not shared between a pair of VMA flags (typically non-constant values) * append_vma_flags() - Similar to mk_vma_flags(), but allows a vma_flags_t value to be specified (typically a constant value) which will be copied and appended to to create a new vma_flags_t value, with additional flags specified to append to it. * vma_flags_same() - Determines if a vma_flags_t value is exactly equal to a set of VMA flags. * vma_flags_same_mask() - Determines if a vma_flags_t value is eactly equal to another vma_flags_t value (typically constant). * vma_flags_same_pair() - Determines if a pair of vma_flags_t values are exactly equal to one another (typically both non-constant). * vma_flags_to_legacy() - Converts a vma_flags_t value to a vm_flags_t value, used to enable more iterative introduction of the use of vma_flags_t. * legacy_to_vma_flags() - Converts a vm_flags_t value to a vma_flags-t value, for the same purpose. * vma_flags_test_single_mask() - Tests whether a vma_flags_t value contain the single flag specified in an input vma_flags_t flag mask, or if that flag mask is empty, is defined to return false. Useful for config-predicated VMA flag mask defines. * vma_test() - Tests whether a VMA's flags contain a specific singular VMA flag. * vma_test_any() - Tests whether a VMA's flags contain any of a set of VMA flags. * vma_test_any_mask() - Tests whether a VMA's flags contain any of the flags specified in another, typically constant, vma_flags_t value. * vma_test_single_mask() - Tests whether a VMA's flags contain the single flag specified in an input vma_flags_t flag mask, or if that flag mask is empty, is defined to return false. Useful for config-predicated VMA flag mask defines. * vma_clear_flags() - Clears a specific set of VMA flags from a vma_flags_t value. * vma_clear_flags_mask() - Clears those flag set in a vma_flags_t value (typically constant) from a (typically not constant) vma_flags_t value. The series mostly focuses on the the VMA specific code, especially that contained in mm/vma.c and mm/vma.h. It updates both brk() and mmap() logic to utils vma_flags_t values as much as is practiaclly possible at this point, changing surrounding logic to be able to do so. It also updates the vma_modify_xxx() functions where they interact with VMA flags directly to use vm_flags_t values where possible. There is extensive testing added in the VMA userland tests to assert that all of these new VMA flag functions work correctly. This patch (of 25): Firstly, add the ability to determine if VMA flags are empty, that is no flags are set in a vma_flags_t value. Next, add the ability to obtain the equivalent of the bitwise and of two vma_flags_t values, via vma_flags_and_mask(). Next, add the ability to obtain the difference between two sets of VMA flags, that is the equivalent to the exclusive bitwise OR of the two sets of flags, via vma_flags_diff_pair(). vma_flags_xxx_mask() typically operates on a pointer to a vma_flags_t value, which is assumed to be an lvalue of some kind (such as a field in a struct or a stack variable) and an rvalue of some kind (typically a constant set of VMA flags obtained e.g. via mk_vma_flags() or equivalent). However vma_flags_diff_pair() is intended to operate on two lvalues, so use the _pair() suffix to make this clear. Finally, update VMA userland tests to add these helpers. We also port bitmap_xor() and __bitmap_xor() to the tools/ headers and source to allow the tests to work with vma_flags_diff_pair(). Link: https://lkml.kernel.org/r/cover.1774034900.git.ljs@kernel.org Link: https://lkml.kernel.org/r/53ab55b7da91425775e42c03177498ad6de88ef4.1774034900.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Al Viro Cc: Anton Ivanov Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chengming Zhou Cc: Christian Borntraeger Cc: Christian Brauner Cc: David Hildenbrand Cc: Dinh Nguyen Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Kara Cc: Jann Horn Cc: Johannes Berg Cc: Kees Cook Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Ondrej Mosnacek Cc: Palmer Dabbelt Cc: Paul Moore Cc: Pedro Falcato Cc: Richard Weinberger Cc: Russell King Cc: Stephen Smalley Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: Vasily Gorbik Cc: Vineet Gupta Cc: WANG Xuerui Cc: Will Deacon Cc: xu xin Signed-off-by: Andrew Morton commit 5ac9c7c2efd0d3c0c2d3bc6e9cd900d3ab6af27a Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 27 17:31:04 2026 +0000 mm/mseal: update VMA end correctly on merge Previously we stored the end of the current VMA in curr_end, and then upon iterating to the next VMA updated curr_start to curr_end to advance to the next VMA. However, this doesn't take into account the fact that a VMA might be updated due to a merge by vma_modify_flags(), which can result in curr_end being stale and thus, upon setting curr_start to curr_end, ending up with an incorrect curr_start on the next iteration. Resolve the issue by setting curr_end to vma->vm_end unconditionally to ensure this value remains updated should this occur. While we're here, eliminate this entire class of bug by simply setting const curr_[start/end] to be clamped to the input range and VMAs, which also happens to simplify the logic. Link: https://lkml.kernel.org/r/20260327173104.322405-1-ljs@kernel.org Fixes: 6c2da14ae1e0 ("mm/mseal: rework mseal apply logic") Signed-off-by: Lorenzo Stoakes (Oracle) Reported-by: Antonius Closes: https://lore.kernel.org/linux-mm/CAK8a0jwWGj9-SgFk0yKFh7i8jMkwKm5b0ao9=kmXWjO54veX2g@mail.gmail.com/ Suggested-by: David Hildenbrand (ARM) Acked-by: Vlastimil Babka (SUSE) Reviewed-by: Pedro Falcato Acked-by: David Hildenbrand (Arm) Cc: Jann Horn Cc: Jeff Xu Cc: Liam Howlett Cc: Signed-off-by: Andrew Morton commit d2fd4225d8de3b9dccf46a7a021869c65152a044 Author: Arnd Bergmann Date: Mon Mar 23 21:55:16 2026 +0100 bug: avoid format attribute warning for clang as well Like gcc, clang-22 now also warns about a function that it incorrectly identifies as a printf-style format: lib/bug.c:190:22: error: diagnostic behavior may be improved by adding the 'format(printf, 1, 0)' attribute to the declaration of '__warn_printf' [-Werror,-Wmissing-format-attribute] 179 | static void __warn_printf(const char *fmt, struct pt_regs *regs) | __attribute__((format(printf, 1, 0))) 180 | { 181 | if (!fmt) 182 | return; 183 | 184 | #ifdef HAVE_ARCH_BUG_FORMAT_ARGS 185 | if (regs) { 186 | struct arch_va_list _args; 187 | va_list *args = __warn_args(&_args, regs); 188 | 189 | if (args) { 190 | vprintk(fmt, *args); | ^ Revert the change that added a gcc-specific workaround, and instead add the generic annotation that avoid the warning. Link: https://lkml.kernel.org/r/20260323205534.1284284-1-arnd@kernel.org Fixes: d36067d6ea00 ("bug: Hush suggest-attribute=format for __warn_printf()") Suggested-by: Andy Shevchenko Suggested-by: Brendan Jackman Link: https://lore.kernel.org/all/20251208141618.2805983-1-andriy.shevchenko@linux.intel.com/T/#u Signed-off-by: Arnd Bergmann Reviewed-by: Brendan Jackman Reviewed-by: Andy Shevchenko Cc: Bill Wendling Cc: Ingo Molnar Cc: Justin Stitt Cc: Nathan Chancellor Cc: Peter Zijlstra Signed-off-by: Andrew Morton commit 9b25a6e3d243a8ce14eeaf74082c621a9944c776 Author: Max Boone Date: Wed Mar 25 10:59:16 2026 +0100 mm/pagewalk: fix race between concurrent split and refault The splitting of a PUD entry in walk_pud_range() can race with a concurrent thread refaulting the PUD leaf entry causing it to try walking a PMD range that has disappeared. An example and reproduction of this is to try reading numa_maps of a process while VFIO-PCI is setting up DMA (specifically the vfio_pin_pages_remote call) on a large BAR for that process. This will trigger a kernel BUG: vfio-pci 0000:03:00.0: enabling device (0000 -> 0002) BUG: unable to handle page fault for address: ffffa23980000000 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI ... RIP: 0010:walk_pgd_range+0x3b5/0x7a0 Code: 8d 43 ff 48 89 44 24 28 4d 89 ce 4d 8d a7 00 00 20 00 48 8b 4c 24 28 49 81 e4 00 00 e0 ff 49 8d 44 24 ff 48 39 c8 4c 0f 43 e3 <49> f7 06 9f ff ff ff 75 3b 48 8b 44 24 20 48 8b 40 28 48 85 c0 74 RSP: 0018:ffffac23e1ecf808 EFLAGS: 00010287 RAX: 00007f44c01fffff RBX: 00007f4500000000 RCX: 00007f44ffffffff RDX: 0000000000000000 RSI: 000ffffffffff000 RDI: ffffffff93378fe0 RBP: ffffac23e1ecf918 R08: 0000000000000004 R09: ffffa23980000000 R10: 0000000000000020 R11: 0000000000000004 R12: 00007f44c0200000 R13: 00007f44c0000000 R14: ffffa23980000000 R15: 00007f44c0000000 FS: 00007fe884739580(0000) GS:ffff9b7d7a9c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa23980000000 CR3: 000000c0650e2005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: __walk_page_range+0x195/0x1b0 walk_page_vma+0x62/0xc0 show_numa_map+0x12b/0x3b0 seq_read_iter+0x297/0x440 seq_read+0x11d/0x140 vfs_read+0xc2/0x340 ksys_read+0x5f/0xe0 do_syscall_64+0x68/0x130 ? get_page_from_freelist+0x5c2/0x17e0 ? mas_store_prealloc+0x17e/0x360 ? vma_set_page_prot+0x4c/0xa0 ? __alloc_pages_noprof+0x14e/0x2d0 ? __mod_memcg_lruvec_state+0x8d/0x140 ? __lruvec_stat_mod_folio+0x76/0xb0 ? __folio_mod_stat+0x26/0x80 ? do_anonymous_page+0x705/0x900 ? __handle_mm_fault+0xa8d/0x1000 ? __count_memcg_events+0x53/0xf0 ? handle_mm_fault+0xa5/0x360 ? do_user_addr_fault+0x342/0x640 ? arch_exit_to_user_mode_prepare.constprop.0+0x16/0xa0 ? irqentry_exit_to_user_mode+0x24/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe88464f47e Code: c0 e9 b6 fe ff ff 50 48 8d 3d be 07 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28 RSP: 002b:00007ffe6cd9a9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fe88464f47e RDX: 0000000000020000 RSI: 00007fe884543000 RDI: 0000000000000003 RBP: 00007fe884543000 R08: 00007fe884542010 R09: 0000000000000000 R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 Fix this by validating the PUD entry in walk_pmd_range() using a stable snapshot (pudp_get()). If the PUD is not present or is a leaf, retry the walk via ACTION_AGAIN instead of descending further. This mirrors the retry logic in walk_pte_range(), which lets walk_pmd_range() retry if the PTE is not being got by pte_offset_map_lock(). Link: https://lkml.kernel.org/r/20260325-pagewalk-check-pmd-refault-v2-1-707bff33bc60@akamai.com Fixes: f9e54c3a2f5b ("vfio/pci: implement huge_fault support") Co-developed-by: David Hildenbrand (Arm) Signed-off-by: David Hildenbrand (Arm) Signed-off-by: Max Boone Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 26e7888a0c89e36332c1e897e4887f69e1e9c751 Author: David Hildenbrand (Arm) Date: Mon Mar 23 21:20:18 2026 +0100 mm/memory: fix PMD/PUD checks in follow_pfnmap_start() follow_pfnmap_start() suffers from two problems: (1) We are not re-fetching the pmd/pud after taking the PTL Therefore, we are not properly stabilizing what the lock actually protects. If there is concurrent zapping, we would indicate to the caller that we found an entry, however, that entry might already have been invalidated, or contain a different PFN after taking the lock. Properly use pmdp_get() / pudp_get() after taking the lock. (2) pmd_leaf() / pud_leaf() are not well defined on non-present entries pmd_leaf()/pud_leaf() could wrongly trigger on non-present entries. There is no real guarantee that pmd_leaf()/pud_leaf() returns something reasonable on non-present entries. Most architectures indeed either perform a present check or make it work by smart use of flags. However, for example loongarch checks the _PAGE_HUGE flag in pmd_leaf(), and always sets the _PAGE_HUGE flag in __swp_entry_to_pmd(). Whereby pmd_trans_huge() explicitly checks pmd_present(), pmd_leaf() does not do that. Let's check pmd_present()/pud_present() before assuming "the is a present PMD leaf" when spotting pmd_leaf()/pud_leaf(), like other page table handling code that traverses user page tables does. Given that non-present PMD entries are likely rare in VM_IO|VM_PFNMAP, (1) is likely more relevant than (2). It is questionable how often (1) would actually trigger, but let's CC stable to be sure. This was found by code inspection. Link: https://lkml.kernel.org/r/20260323-follow_pfnmap_fix-v1-1-5b0ec10872b3@kernel.org Fixes: 6da8e9634bb7 ("mm: new follow_pfnmap API") Signed-off-by: David Hildenbrand (Arm) Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Liam Howlett Cc: Michal Hocko Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit d0bde8e2f3d2fb9aaec15d9c01da0a01526c7a56 Author: Josh Law Date: Sat Mar 21 10:54:26 2026 -0700 mm/damon/sysfs: check contexts->nr in repeat_call_fn damon_sysfs_repeat_call_fn() calls damon_sysfs_upd_tuned_intervals(), damon_sysfs_upd_schemes_stats(), and damon_sysfs_upd_schemes_effective_quotas() without checking contexts->nr. If nr_contexts is set to 0 via sysfs while DAMON is running, these functions dereference contexts_arr[0] and cause a NULL pointer dereference. Add the missing check. For example, the issue can be reproduced using DAMON sysfs interface and DAMON user-space tool (damo) [1] like below. $ sudo damo start --refresh_interval 1s $ echo 0 | sudo tee \ /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts Link: https://patch.msgid.link/20260320163559.178101-3-objecting@objecting.org Link: https://lkml.kernel.org/r/20260321175427.86000-4-sj@kernel.org Link: https://github.com/damonitor/damo [1] Fixes: d809a7c64ba8 ("mm/damon/sysfs: implement refresh_ms file internal work") Signed-off-by: Josh Law Reviewed-by: SeongJae Park Signed-off-by: SeongJae Park Cc: [6.17+] Signed-off-by: Andrew Morton commit a12479ed43b386cba36817ed1d5bc70801258740 Author: Josh Law Date: Sat Mar 21 10:54:25 2026 -0700 mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Multiple sysfs command paths dereference contexts_arr[0] without first verifying that kdamond->contexts->nr == 1. A user can set nr_contexts to 0 via sysfs while DAMON is running, causing NULL pointer dereferences. In more detail, the issue can be triggered by privileged users like below. First, start DAMON and make contexts directory empty (kdamond->contexts->nr == 0). # damo start # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/nr_contexts Then, each of below commands will cause the NULL pointer dereference. # echo update_schemes_stats > state # echo update_schemes_tried_regions > state # echo update_schemes_tried_bytes > state # echo update_schemes_effective_quotas > state # echo update_tuned_intervals > state Guard all commands (except OFF) at the entry point of damon_sysfs_handle_cmd(). Link: https://lkml.kernel.org/r/20260321175427.86000-3-sj@kernel.org Fixes: 0ac32b8affb5 ("mm/damon/sysfs: support DAMOS stats") Signed-off-by: Josh Law Reviewed-by: SeongJae Park Signed-off-by: SeongJae Park Cc: [5.18+] Signed-off-by: Andrew Morton commit eb1074ece72f3cb8874e995d94bb02245614487a Author: Josh Law Date: Sat Mar 21 10:54:24 2026 -0700 mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure Patch series "mm/damon/sysfs: fix memory leak and NULL dereference issues", v4. DAMON_SYSFS can leak memory under allocation failure, and do NULL pointer dereference when a privileged user make wrong sequences of control. Fix those. This patch (of 3): When damon_sysfs_new_test_ctx() fails in damon_sysfs_commit_input(), param_ctx is leaked because the early return skips the cleanup at the out label. Destroy param_ctx before returning. Link: https://lkml.kernel.org/r/20260321175427.86000-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260321175427.86000-2-sj@kernel.org Fixes: f0c5118ebb0e ("mm/damon/sysfs: catch commit test ctx alloc failure") Signed-off-by: Josh Law Reviewed-by: SeongJae Park Signed-off-by: SeongJae Park Cc: [6.18+] Signed-off-by: Andrew Morton commit 9acbe135588e25070e963c0f066019cbeeb30c07 Author: Alexandre Ghiti Date: Fri Mar 20 06:05:59 2026 +0100 mm/swap: fix swap cache memcg accounting The swap readahead path was recently refactored and while doing this, the order between the charging of the folio in the memcg and the addition of the folio in the swap cache was inverted. Since the accounting of the folio is done while adding the folio to the swap cache and the folio is not charged in the memcg yet, the accounting is then done at the node level, which is wrong. Fix this by charging the folio in the memcg before adding it to the swap cache. Link: https://lkml.kernel.org/r/20260320050601.1833108-1-alex@ghiti.fr Fixes: 2732acda82c9 ("mm, swap: use swap cache as the swap in synchronize layer") Signed-off-by: Alexandre Ghiti Acked-by: Kairui Song Acked-by: Johannes Weiner Reviewed-by: Nhat Pham Acked-by: Chris Li Cc: Alexandre Ghiti Cc: Baoquan He Cc: Barry Song Cc: Kemeng Shi Cc: Signed-off-by: Andrew Morton commit 9594f05e31e89c795f2161cf9c4aae29c3061f2b Author: Harry Yoo (Oracle) Date: Fri Mar 20 21:59:25 2026 +0900 MAINTAINERS, mailmap: update email address for Harry Yoo Update my email address to harry@kernel.org. Link: https://lkml.kernel.org/r/20260320125925.2259998-1-harry@kernel.org Signed-off-by: Harry Yoo (Oracle) Signed-off-by: Andrew Morton commit 4ff07459db888054f68575646d7fe04f31f1e56d Author: Jinjiang Tu Date: Thu Mar 19 09:25:41 2026 +0800 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows: CPU0 CPU1 deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags. This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held. This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1. To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page(). [tujinjiang@huawei.com: update function name and comments] Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") Signed-off-by: Jinjiang Tu Acked-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Barry Song Cc: Kefeng Wang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nanyong Sun Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 224f1292615079d604651915a214f9e5ace9e41c Author: Zi Yan Date: Mon Mar 23 12:37:17 2026 -0400 selftests/mm: add folio_split() and filemap_get_entry() race test The added folio_split_race_test is a modified C port of the race condition test from [1]. The test creates shmem huge pages, where the main thread punches holes in the shmem to cause folio_split() in the kernel and a set of 16 threads reads the shmem to cause filemap_get_entry() in the kernel. filemap_get_entry() reads the folio and xarray split by folio_split() locklessly. The original test[2] is written in rust and uses memfd (shmem backed). This C port uses shmem directly and use a single process. Note: the initial rust to C conversion is done by Cursor. Link: https://lore.kernel.org/all/CAKNNEtw5_kZomhkugedKMPOG-sxs5Q5OLumWJdiWXv+C9Yct0w@mail.gmail.com/ [1] Link: https://github.com/dfinity/thp-madv-remove-test [2] Link: https://lkml.kernel.org/r/20260323163717.184107-1-ziy@nvidia.com Co-developed-by: Bas van Dijk Signed-off-by: Bas van Dijk Co-developed-by: Adam Bratschi-Kaye Signed-off-by: Adam Bratschi-Kaye Signed-off-by: Zi Yan Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Hugh Dickins Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 54fdcbfe1cbd1d8f06d0c57c8cc43ddcc1cd421c Author: Ye Liu Date: Mon Mar 23 17:03:04 2026 +0800 mm: remove unused page_is_file_lru() function The page_is_file_lru() wrapper function is no longer used. The kernel has moved to folio-based APIs, and all callers should use folio_is_file_lru() instead. Remove the obsolete page-based wrapper function. Link: https://lkml.kernel.org/r/20260323090305.798057-1-ye.liu@linux.dev Signed-off-by: Ye Liu Acked-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Signed-off-by: Andrew Morton commit 3f74e30d857bd546c32eba78739dc85dabc6aae1 Author: Kexin Sun Date: Sat Mar 21 18:57:04 2026 +0800 drivers/base/memory: fix stale reference to memory_block_add_nid() The function memory_block_add_nid() was renamed to memory_block_add_nid_early() by commit 0a947c14e48c ("drivers/base: move memory_block_add_nid() into the caller"). Update the stale reference in add_memory_block(). Assisted-by: unnamed:deepseek-v3.2 coccinelle Link: https://lkml.kernel.org/r/20260321105704.6093-1-kexinsun@smail.nju.edu.cn Signed-off-by: Kexin Sun Reviewed-by: David Hildenbrand (Arm) Reviewed by: Donet Tom Signed-off-by: Andrew Morton commit b480cbb071020bd590a0dc0166635b448e9fc46b Author: Frank van der Linden Date: Fri Mar 20 17:34:25 2026 +0000 mm/page_alloc: don't increase highatomic reserve after pcp alloc Higher order GFP_ATOMIC allocations can be served through a PCP list with ALLOC_HIGHATOMIC set. Such an allocation can e.g. happen if a zone is between the low and min watermarks, and get_page_from_freelist is retried after the alloc_flags are relaxed. The call to reserve_highatomic_pageblock() after such a PCP allocation will result in an increase every single time: the page from the (unmovable) PCP list will never have migrate type MIGRATE_HIGHATOMIC, since MIGRATE_HIGHATOMIC pages do not appear on the unmovable PCP list. So a new pageblock is converted to MIGRATE_HIGHATOMIC. Eventually that leads to the maximum of 1% of the zone being used up by (often mostly free) MIGRATE_HIGHATOMIC pageblocks, for no good reason. Since this space is not available for normal allocations, this wastes memory and will push things in to reclaim too soon. This was observed on a system that ran a test with bursts of memory activity, paired with GFP_ATOMIC SLUB activity. These would lead to a new slab being allocated with GFP_ATOMIC, sometimes hitting the get_page_from_freelist retry path by being below the low watermark. While the frequency of those allocations was low, it kept adding up over time, and the number of MIGRATE_ATOMIC pageblocks kept increasing. If a higher order atomic allocation can be served by the unmovable PCP list, there is probably no need yet to extend the reserves. So, move the check and possible extension of the highatomic reserves to the buddy case only, and do not refill the PCP list for ALLOC_HIGHATOMIC if it's empty. This way, the PCP list is tried for ALLOC_HIGHATOMIC for a fast atomic allocation. But it will immediately fall back to rmqueue_buddy() if it's empty. In rmqueue_buddy(), the MIGRATE_HIGHATOMIC buddy lists are tried first (as before), and the reserves are extended only if that fails. With this change, the test was stable. Highatomic reserves were built up, but to a normal level. No highatomic failures were seen. This is similar to the patch proposed in [1] by Zhiguo Jiang, but re-arranged a bit. Link: https://lkml.kernel.org/r/20260320173426.1831267-1-fvdl@google.com Link: https://lore.kernel.org/all/20231122013925.1507-1-justinjiang@vivo.com/ [1] Fixes: 44042b449872 ("mm/page_alloc: allow high-order pages to be stored on the per-cpu lists") Signed-off-by: Zhiguo Jiang Signed-off-by: Frank van der Linden Reviewed-by: Vlastimil Babka (SUSE) Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zhiguo Jiang Cc: Zi Yan Signed-off-by: Andrew Morton commit d885a076d7a74e03c6248fd3951fb9d43c4e7a82 Author: Bing Jiao Date: Sat Mar 21 03:34:13 2026 +0000 mm/memcontrol: fix reclaim_options leak in try_charge_memcg() In try_charge_memcg(), the 'reclaim_options' variable is initialized once at the start of the function. However, the function contains a retry loop. If reclaim_options were modified during an iteration (e.g., by encountering a memsw limit), the modified state would persist into subsequent retries. This leads to incorrect reclaim behavior. Specifically, MEMCG_RECLAIM_MAY_SWAP is cleared when the combined memcg->memsw limit is reached. After reclaimation attempts, a subsequent retry may successfully charge memcg->memsw but fail on the memcg->memory charge. In this case, swapping should be permitted, but the carried-over state prevents it. This issue was identified during code reading of try_charge_memcg() while analyzing memsw limit behavior in tiered-memory systems; no production failures have been reported yet. Fix by moving the initialization of 'reclaim_options' inside the retry loop, ensuring a clean state for every reclaim attempt. Link: https://lkml.kernel.org/r/20260321033500.2558070-1-bingjiao@google.com Fixes: 6539cc053869 ("mm: memcontrol: fold mem_cgroup_do_charge()") Signed-off-by: Bing Jiao Reviewed-by: Yosry Ahmed Acked-by: Michal Hocko Acked-by: Johannes Weiner Cc: Axel Rasmussen Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: David Rientjes Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lorenzo Stoakes (Oracle) Cc: Muchun Song Cc: Nhat Pham Cc: Qi Zheng Cc: Roman Gushchin Cc: Shakeel Butt Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 1fc7dc675e26c43f3219d70a09b9f0c4aa43a13a Author: Baolin Wang Date: Sat Mar 21 14:42:54 2026 +0800 mm: change to return bool for the MMU notifier's young flag check The MMU notifier young flag check related functions only return whether the young flag was set. Change the return type to bool to make the intention clearer. Link: https://lkml.kernel.org/r/a9ad3fe938002d87358e7bfca264f753ab602561.1774075004.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Ritesh Harjani (IBM) Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit fb87c88272973fa310d36dc60530fd6781bd1a55 Author: Baolin Wang Date: Sat Mar 21 14:42:53 2026 +0800 mm: change to return bool for pudp_test_and_clear_young() The pudp_test_and_clear_young() is used to clear the young flag, returning whether the young flag was set for this PUD entry. Change the return type to bool to make the intention clearer. Link: https://lkml.kernel.org/r/2c56fe52c1bf9404145274d7e91d4a65060f6c7c.1774075004.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 2d46a397472191a10b0df294d64da542bfd1de57 Author: Baolin Wang Date: Sat Mar 21 14:42:52 2026 +0800 mm: change to return bool for pmdp_clear_flush_young() The pmdp_clear_flush_young() is used to clear the young flag and flush the TLB, returning whether the young flag was set for this PMD entry. Change the return type to bool to make the intention clearer. Link: https://lkml.kernel.org/r/a668b9a974c0d675e7a41f6973bcbe3336e8b373.1774075004.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Ritesh Harjani (IBM) Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 42e26354c4ef28772398b1d71b7477834037305c Author: Baolin Wang Date: Sat Mar 21 14:42:51 2026 +0800 mm: change to return bool for pmdp_test_and_clear_young() Callers use pmdp_test_and_clear_young() to clear the young flag and check whether it was set for this PMD entry. Change the return type to bool to make the intention clearer. Link: https://lkml.kernel.org/r/f1d31307a13365d3d0fed5809727dcc2dd59631b.1774075004.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 06c4dfa3ced61635895d0e258da8dc63da539f42 Author: Baolin Wang Date: Sat Mar 21 14:42:50 2026 +0800 mm: change to return bool for ptep_clear_flush_young()/clear_flush_young_ptes() The ptep_clear_flush_young() and clear_flush_young_ptes() are used to clear the young flag and flush the TLB, returning whether the young flag was set. Change the return type to bool to make the intention clearer. Link: https://lkml.kernel.org/r/24af5144b96103631594501f77d4525f2475c1be.1774075004.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit a62ca3f40feaaaf0dfc4db1f2edeca5a70f4123d Author: Baolin Wang Date: Sat Mar 21 14:42:49 2026 +0800 mm: change to return bool for ptep_test_and_clear_young() Patch series "change young flag check functions to return bool", v2. This is a cleanup patchset to change all young flag check functions to return bool, as discussed with David in the previous thread[1]. Since callers only care about whether the young flag was set, returning bool makes the intention clearer. No functional changes intended. This patch (of 6): Callers use ptep_test_and_clear_young() to clear the young flag and check whether it was set. Change the return type to bool to make the intention clearer. Link: https://lkml.kernel.org/r/cover.1774075004.git.baolin.wang@linux.alibaba.com Link: https://lkml.kernel.org/r/57e70efa9703d43959aa645246ea3cbdba14fa17.1774075004.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit f2a48f8fb56466488f7525e3349d4e2f45dc5d74 Author: Kexin Sun Date: Sat Mar 21 18:58:14 2026 +0800 mm: update outdated comments for removed scan_swap_map_slots() The function scan_swap_map_slots() was removed in commit 0ff67f990bd4 ("mm, swap: remove swap slot cache"). The three comments referencing it simply noted that ->flags can be updated non-atomically by scan_swap_map_slots() to justify a data_race() annotation. Since the function no longer exists, drop the parenthetical reference while keeping the data_race() justification intact: ->flags can still be updated non-atomically by other paths (e.g., swapoff clearing SWP_WRITEOK). Assisted-by: unnamed:deepseek-v3.2 coccinelle Link: https://lkml.kernel.org/r/20260321105814.7053-1-kexinsun@smail.nju.edu.cn Signed-off-by: Kexin Sun Acked-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Axel Rasmussen Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Johannes Weiner Cc: Julia Lawall Cc: Kairui Song Cc: Kemeng Shi Cc: Michal Hocko Cc: Nhat Pham Cc: Qi Zheng Cc: Shakeel Butt Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 3cb0dc0d0eab18d6ef738e10d5634e3a71121044 Author: Kexin Sun Date: Sat Mar 21 18:58:20 2026 +0800 mm: vmalloc: update outdated comment for renamed vread() The function vread() was renamed to vread_iter() in commit 4c91c07c93bb ("mm: vmalloc: convert vread() to vread_iter()"), converting from a buffer-based to an iterator-based interface. Update the kdoc of vread_iter() to reflect the new interface: replace references to @buf with @iter, drop the stale "kernel's buffer" requirement, and update the self-reference from vread() to vread_iter(). Also update the stale vread() reference in pstore's ram_core.c. Assisted-by: unnamed:deepseek-v3.2 coccinelle Link: https://lkml.kernel.org/r/20260321105820.7134-1-kexinsun@smail.nju.edu.cn Signed-off-by: Kexin Sun Reviewed-by: Andrew Morton Cc: "Guilherme G. Piccoli" Cc: Julia Lawall Cc: Kees Cook Cc: Tony Luck Cc: "Uladzislau Rezki (Sony)" Signed-off-by: Andrew Morton commit c4a9439a5a372c6c0eb7cd2bc9dbb2494699e98d Author: Kaitao Cheng Date: Sat Mar 21 20:08:47 2026 +0800 mm: mark early-init static variables with __meminitdata Static variables defined inside __meminit functions should also be marked with __meminitdata, so that their storage is placed in the .init.data section and reclaimed with free_initmem(), thereby reducing permanent .bss memory usage when CONFIG_MEMORY_HOTPLUG is disabled. Link: https://lkml.kernel.org/r/20260321120847.8159-1-pilgrimtao@gmail.com Signed-off-by: Kaitao Cheng Reviewed-by: Andrew Morton Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 4fb61d95ad21c3b6f1c09f357ff49d70abb0535e Author: Shigeru Yoshida Date: Sat Mar 21 22:29:11 2026 +0900 mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() zs_page_migrate() uses copy_page() to copy the contents of a zspage page during migration. However, copy_page() is not instrumented by KMSAN, so the shadow and origin metadata of the destination page are not updated. As a result, subsequent accesses to the migrated page are reported as use-after-free by KMSAN, despite the data being correctly copied. Add a kmsan_copy_page_meta() call after copy_page() to propagate the KMSAN metadata to the new page, matching what copy_highpage() does internally. Link: https://lkml.kernel.org/r/20260321132912.93434-1-syoshida@redhat.com Fixes: afb2d666d025 ("zsmalloc: use copy_page for full page copy") Signed-off-by: Shigeru Yoshida Reviewed-by: Sergey Senozhatsky Cc: Mark-PK Tsai Cc: Minchan Kim Cc: Signed-off-by: Andrew Morton commit 1871d548fc4feb007644efb6d669c93a4e191254 Author: Hubert Mazur Date: Fri Mar 20 07:57:23 2026 +0000 mm/execmem: make the populate and alloc atomic When a block of memory is requested from the execmem manager it tries to find a suitable fragment by traversing the free_areas. In case there is no such block, a new memory area is added to the free_areas and then allocated to the caller by traversing the free_area tree again. The above operations of allocation and tree traversal are not atomic hence another request may consume this newly allocated memory block which results in the allocation failure for the original request. Such occurrence can be spotted on devices running the 6.18 kernel during the parallel modules loading. To mitigate such resource races execute the cache population and allocation operations under one mutex lock. Link: https://lkml.kernel.org/r/20260320075723.779985-1-hmazur@google.com Signed-off-by: Hubert Mazur Reviewed-by: Mike Rapoport (Microsoft) Cc: Greg Kroah-Hartman Cc: Stanislaw Kardach Cc: Michal Krawczyk Cc: Slawomir Rosek Cc: Hubert Mazur Signed-off-by: Andrew Morton commit 6f1e1823875f59591df1159b7d193b40337ef524 Author: Liew Rui Yan Date: Fri Mar 20 13:24:28 2026 +0800 Docs/mm/damon: document min_nr_regions constraint and rationale The current DAMON implementation requires 'min_nr_regions' to be at least 3. However, this constraint is not explicitly documented in the admin-guide documents, nor is its design rationale explained in the design document. Add a section in design.rst to explain the rationale: the virtual address space monitoring design needs to handle at least three regions to accommodate two large unmapped areas. While this is specific to 'vaddr', DAMON currently enforces it across all operation sets for consistency. Also update reclaim.rst and lru_sort.rst by adding cross-references to this constraint within their respective 'min_nr_regions' parameter description sections, ensuring users are aware of the lower bound. This change is motivated from a recent discussion [1]. Link: https://lkml.kernel.org/r/20260320052428.213230-1-aethernet65535@gmail.com Link: https://lore.kernel.org/damon/20260319151528.86490-1-sj@kernel.org/T/#t [1] Signed-off-by: Liew Rui Yan Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit cc4555fc6d8f8585ae05f3e117cfdd60e4673281 Author: Josh Law Date: Fri Mar 20 07:36:45 2026 -0700 mm/damon/core: document damos_commit_dests() failure semantics Add a kernel-doc-like comment to damos_commit_dests() documenting its allocation failure contract: on -ENOMEM, the destination structure is left in a partially torn-down state that is safe to deallocate via damon_destroy_scheme(), but must not be reused for further commits. This was unclear from the code alone and led to a separate patch [1] attempting to reset nr_dests on failure. Make the intended usage explicit so future readers do not repeat the confusion. Link: https://lkml.kernel.org/r/20260320143648.91673-1-sj@kernel.org Link: https://lore.kernel.org/20260318214939.36100-1-objecting@objecting.org [1] Signed-off-by: Josh Law Reviewed-by: SeongJae Park Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit a6a8c087dce00eac0c6d03e560b0fa3d529afa5f Author: Leno Hou Date: Thu Mar 19 00:30:49 2026 +0800 mm/mglru: fix cgroup OOM during MGLRU state switching When the Multi-Gen LRU (MGLRU) state is toggled dynamically, a race condition exists between the state switching and the memory reclaim path. This can lead to unexpected cgroup OOM kills, even when plenty of reclaimable memory is available. Problem Description ================== The issue arises from a "reclaim vacuum" during the transition. 1. When disabling MGLRU, lru_gen_change_state() sets lrugen->enabled to false before the pages are drained from MGLRU lists back to traditional LRU lists. 2. Concurrent reclaimers in shrink_lruvec() see lrugen->enabled as false and skip the MGLRU path. 3. However, these pages might not have reached the traditional LRU lists yet, or the changes are not yet visible to all CPUs due to a lack of synchronization. 4. get_scan_count() subsequently finds traditional LRU lists empty, concludes there is no reclaimable memory, and triggers an OOM kill. A similar race can occur during enablement, where the reclaimer sees the new state but the MGLRU lists haven't been populated via fill_evictable() yet. Solution ======== Introduce a 'switching' state (`lru_switch`) to bridge the transition. When transitioning, the system enters this intermediate state where the reclaimer is forced to attempt both MGLRU and traditional reclaim paths sequentially. This ensures that folios remain visible to at least one reclaim mechanism until the transition is fully materialized across all CPUs. Race & Mitigation ================ A race window exists between checking the 'draining' state and performing the actual list operations. For instance, a reclaimer might observe the draining state as false just before it changes, leading to a suboptimal reclaim path decision. However, this impact is effectively mitigated by the kernel's reclaim retry mechanism (e.g., in do_try_to_free_pages). If a reclaimer pass fails to find eligible folios due to a state transition race, subsequent retries in the loop will observe the updated state and correctly direct the scan to the appropriate LRU lists. This ensures the transient inconsistency does not escalate into a terminal OOM kill. This effectively reduce the race window that previously triggered OOMs under high memory pressure. This fix has been verified on v7.0.0-rc1; dynamic toggling of MGLRU functions correctly without triggering unexpected OOM kills. Link: https://lkml.kernel.org/r/20260319-b4-switch-mglru-v2-v5-1-8898491e5f17@gmail.com Signed-off-by: Leno Hou Acked-by: Yafang Shao Reviewed-by: Barry Song Reviewed-by: Axel Rasmussen Cc: Yuanchu Xie Cc: Wei Xu Cc: Jialing Wang Cc: Yu Zhao Cc: Kairui Song Cc: Bingfang Guo Signed-off-by: Andrew Morton commit dc711106a0bc76a30e0fbd16ed4d348171547d9a Author: teawater Date: Thu Mar 19 14:59:24 2026 +0800 zsmalloc: return -EBUSY for zspage migration lock contention movable_operations::migrate_page() should return an appropriate error code for temporary migration failures so the migration core can handle them correctly. zs_page_migrate() currently returns -EINVAL when zspage_write_trylock() fails. That path reflects transient lock contention, not invalid input, so -EINVAL is clearly wrong. However, -EAGAIN is also inappropriate here: the zspage's reader-lock owner may hold the lock for an unbounded duration due to slow decompression or reader-lock owner preemption. Since migration retries are bounded by NR_MAX_MIGRATE_PAGES_RETRY and performed with virtually no delay between attempts, there is no guarantee the lock will be released in time for a retry to succeed. -EAGAIN implies "try again soon", which does not hold in this case. Return -EBUSY instead, which more accurately conveys that the resource is occupied and migration cannot proceed at this time. Link: https://lkml.kernel.org/r/20260319065924.69337-1-hui.zhu@linux.dev Signed-off-by: teawater Acked-by: Sergey Senozhatsky Cc: Minchan Kim Signed-off-by: Andrew Morton commit 6ebf98d71f9b509e833e0af00795ad3723d2f410 Author: David Hildenbrand (Arm) Date: Thu Mar 19 09:19:41 2026 +0100 mm: introduce CONFIG_NUMA_MIGRATION and simplify CONFIG_MIGRATION CONFIG_MEMORY_HOTREMOVE, CONFIG_COMPACTION and CONFIG_CMA all select CONFIG_MIGRATION, because they require it to work (users). Only CONFIG_NUMA_BALANCING and CONFIG_BALLOON_MIGRATION depend on CONFIG_MIGRATION. CONFIG_BALLOON_MIGRATION is not an actual user, but an implementation of migration support, so the dependency is correct (CONFIG_BALLOON_MIGRATION does not make any sense without CONFIG_MIGRATION). However, kconfig-language.rst clearly states "In general use select only for non-visible symbols". So far CONFIG_MIGRATION is user-visible ... and the dependencies rather confusing. The whole reason why CONFIG_MIGRATION is user-visible is because of CONFIG_NUMA: some users might want CONFIG_NUMA but not page migration support. Let's clean all that up by introducing a dedicated CONFIG_NUMA_MIGRATION config option for that purpose only. Make CONFIG_NUMA_BALANCING that so far depended on CONFIG_NUMA && CONFIG_MIGRATION to depend on CONFIG_MIGRATION instead. CONFIG_NUMA_MIGRATION will depend on CONFIG_NUMA && CONFIG_MMU. CONFIG_NUMA_MIGRATION is user-visible and will default to "y". We use that default so new configs will automatically enable it, just like it was the case with CONFIG_MIGRATION. The downside is that some configs that used to have CONFIG_MIGRATION=n might get it re-enabled by CONFIG_NUMA_MIGRATION=y, which shouldn't be a problem. CONFIG_MIGRATION is now a non-visible config option. Any code that select CONFIG_MIGRATION (as before) must depend directly or indirectly on CONFIG_MMU. CONFIG_NUMA_MIGRATION is responsible for any NUMA migration code, which is mempolicy migration code, memory-tiering code, and move_pages() code in migrate.c. CONFIG_NUMA_BALANCING uses its functionality. Note that this implies that with CONFIG_NUMA_MIGRATION=n, move_pages() will not be available even though CONFIG_MIGRATION=y, which is an expected change. In migrate.c, we can remove the CONFIG_NUMA check as both CONFIG_NUMA_MIGRATION and CONFIG_NUMA_BALANCING depend on it. With this change, CONFIG_MIGRATION is an internal config, all users of migration selects CONFIG_MIGRATION, and only CONFIG_BALLOON_MIGRATION depends on it. Link: https://lkml.kernel.org/r/20260319-config_migration-v1-2-42270124966f@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: Zi Yan Reviewed-by: Jonathan Cameron Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alistair Popple Cc: "Borislav Petkov (AMD)" Cc: Byungchul Park Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Gregory Price Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: "Huang, Ying" Cc: Ingo Molnar Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Brost Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Rakie Kim Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 078f80f909ba9fa3060e89dc634ff4b1defc43d3 Author: David Hildenbrand (Arm) Date: Thu Mar 19 09:19:40 2026 +0100 mm: remove CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE Patch series "mm: remove CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE and cleanup CONFIG_MIGRATION". While working on memory hotplug code cleanups, I realized that CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE is not really required anymore. Changing that revealed some rather nasty looking CONFIG_MIGRATION handling. Let's clean that up by introducing a dedicated CONFIG_NUMA_MIGRATION option and reducing the dependencies that CONFIG_MIGRATION has. This patch (of 2): All architectures that select CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE also select CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG. So we can just remove CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE. For CONFIG_MIGRATION, make it depend on CONFIG_MEMORY_HOTREMOVE instead, and make CONFIG_MEMORY_HOTREMOVE select CONFIG_MIGRATION (just like CONFIG_CMA and CONFIG_COMPACTION already do). We'll clean up CONFIG_MIGRATION next. Link: https://lkml.kernel.org/r/20260319-config_migration-v1-0-42270124966f@kernel.org Link: https://lkml.kernel.org/r/20260319-config_migration-v1-1-42270124966f@kernel.org Signed-off-by: David Hildenbrand (Arm) Acked-by: Zi Yan Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Joshua Hahn Reviewed-by: Gregory Price Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Jonathan Cameron Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alistair Popple Cc: "Borislav Petkov (AMD)" Cc: Byungchul Park Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: "Huang, Ying" Cc: Ingo Molnar Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Brost Cc: Michael Ellerman Cc: Michal Hocko Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Rakie Kim Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 738de20c4fafe64290c5086d683254f60e837db6 Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:47 2026 +0100 mm/sparse: move memory hotplug bits to sparse-vmemmap.c Let's move all memory hoptplug related code to sparse-vmemmap.c. We only have to expose sparse_index_init(). While at it, drop the definition of sparse_index_init() for !CONFIG_SPARSEMEM, which is unused, and place the declaration in internal.h. Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-15-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 08e5f77c37206da5a8340afdbf23b61e722c0ed3 Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:46 2026 +0100 mm/sparse: move __section_mark_present() to internal.h Let's prepare for moving memory hotplug handling from sparse.c to sparse-vmemmap.c by moving __section_mark_present() to internal.h. Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-14-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit f62a3bf227c95a105fccb5a2062367387cd49430 Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:45 2026 +0100 mm/sparse: move sparse_init_one_section() to internal.h While at it, convert the BUG_ON to a VM_WARN_ON_ONCE, avoid long lines, and merge sparse_encode_mem_map() into its only caller sparse_init_one_section(). Clarify the comment a bit, pointing at page_to_pfn(). [david@kernel.org: s/VM_WARN_ON/VM_WARN_ON_ONCE/] Link: https://lkml.kernel.org/r/6b04c1a1-74e7-42e8-8523-a40802e5dacc@kernel.org Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-13-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit b551ed94d959900996364c810c5f96e89640b200 Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:44 2026 +0100 mm/sparse: drop set_section_nid() from sparse_add_section() CONFIG_MEMORY_HOTPLUG is CONFIG_SPARSEMEM_VMEMMAP-only. And CONFIG_SPARSEMEM_VMEMMAP implies that NODE_NOT_IN_PAGE_FLAGS cannot be set: see include/linux/page-flags-layout.h ... #elif defined(CONFIG_SPARSEMEM_VMEMMAP) #error "Vmemmap: No space for nodes field in page flags" ... Which implies that the node is always stored in page flags and NODE_NOT_IN_PAGE_FLAGS cannot be set. Therefore, set_section_nid() is a NOP on CONFIG_SPARSEMEM_VMEMMAP. So let's remove the set_section_nid() call to prepare for moving CONFIG_MEMORY_HOTPLUG to mm/sparse-vmemmap.c Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-12-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit fead6dcff83b02f8d6dc3c1ebbe4e09c05c54ee5 Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:43 2026 +0100 mm: prepare to move subsection_map_init() to mm/sparse-vmemmap.c We want to move subsection_map_init() to mm/sparse-vmemmap.c. To prepare for getting rid of subsection_map_init() in mm/sparse.c completely, use a static inline function for !CONFIG_SPARSEMEM_VMEMMAP. While at it, move the declaration to internal.h and rename it to "sparse_init_subsection_map()". Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-11-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit dac89b150bdb32fd276a3a22fa66c481dab47dea Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:42 2026 +0100 mm/sparse: remove CONFIG_MEMORY_HOTPLUG-specific usemap allocation handling In 2008, we added through commit 48c906823f39 ("memory hotplug: allocate usemap on the section with pgdat") quite some complexity to try allocating memory for the "usemap" (storing pageblock information per memory section) for a memory section close to the memory of the "pgdat" of the node. The goal was to make memory hotunplug of boot memory more likely to succeed. That commit also added some checks for circular dependencies between two memory sections, whereby two memory sections would contain each others usemap, turning both boot memory sections un-removable. However, in 2010, commit a4322e1bad91 ("sparsemem: Put usemap for one node together") started allocating the usemap for multiple memory sections on the same node in one chunk, effectively grouping all usemap allocations of the same node in a single memblock allocation. We don't really give guarantees about memory hotunplug of boot memory, and with the change in 2010, it is impossible in practice to get any circular dependencies. So let's simply remove this complexity. Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-10-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 22688ade3b54b2f4f2887c7dad75db6d588ae07c Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:41 2026 +0100 mm/sparse: remove sparse_decode_mem_map() section_deactivate() applies to CONFIG_SPARSEMEM_VMEMMAP only. So we can just use pfn_to_page() (after making sure we have the start PFN of the section), and remove sparse_decode_mem_map(). Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-9-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 7f8e592bb3271ea057e84dcc480feb962ec4f161 Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:40 2026 +0100 mm/bootmem_info: avoid using sparse_decode_mem_map() With SPARSEMEM_VMEMMAP, we can just do a pfn_to_page(). It is not super clear whether the start_pfn is properly aligned ... so let's just make sure it is properly aligned to the start of the section. We will soon might try to remove the bootmem info completely, for now, just keep it working as is. Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-8-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 41293414433a0d033ef1b7f95441e347c8f513c3 Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:39 2026 +0100 mm/bootmem_info: remove handling for !CONFIG_SPARSEMEM_VMEMMAP It is not immediately obvious that CONFIG_HAVE_BOOTMEM_INFO_NODE is only selected from CONFIG_MEMORY_HOTREMOVE, which itself depends on CONFIG_MEMORY_HOTPLUG that ... depends on CONFIG_SPARSEMEM_VMEMMAP. Let's remove the !CONFIG_SPARSEMEM_VMEMMAP leftovers that are dead code. Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-7-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 119c31caa59e84931cca713a00a58be61bfa7baa Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:38 2026 +0100 mm/sparse: remove !CONFIG_SPARSEMEM_VMEMMAP leftovers for CONFIG_MEMORY_HOTPLUG CONFIG_MEMORY_HOTPLUG now depends on CONFIG_SPARSEMEM_VMEMMAP. So let's remove the !CONFIG_SPARSEMEM_VMEMMAP leftovers that are dead code. Adjust the comment above fill_subsection_map() accordingly. Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-6-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 62257a5fb987cc6d092850ce6b70ec95a79a9442 Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:37 2026 +0100 mm/memory_hotplug: simplify check_pfn_span() We now always have CONFIG_SPARSEMEM_VMEMMAP, so remove the dead code. Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-5-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit fb3c3f5d27ef7c8845e3d0ac43c692216077602c Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:36 2026 +0100 mm/Kconfig: make CONFIG_MEMORY_HOTPLUG depend on CONFIG_SPARSEMEM_VMEMMAP Ever since commit f8f03eb5f0f9 ("mm: stop making SPARSEMEM_VMEMMAP user-selectable"), an architecture that supports CONFIG_SPARSEMEM_VMEMMAP (by selecting SPARSEMEM_VMEMMAP_ENABLE) can no longer enable CONFIG_SPARSEMEM without CONFIG_SPARSEMEM_VMEMMAP. Right now, CONFIG_MEMORY_HOTPLUG is guarded by CONFIG_SPARSEMEM. However, CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG is only enabled by * arm64: which selects SPARSEMEM_VMEMMAP_ENABLE * loongarch: which selects SPARSEMEM_VMEMMAP_ENABLE * powerpc (64bit): which selects SPARSEMEM_VMEMMAP_ENABLE * riscv (64bit): which selects SPARSEMEM_VMEMMAP_ENABLE * s390 with SPARSEMEM: which selects SPARSEMEM_VMEMMAP_ENABLE * x86 (64bit): which selects SPARSEMEM_VMEMMAP_ENABLE So, we can make CONFIG_MEMORY_HOTPLUG depend on CONFIG_SPARSEMEM_VMEMMAP without affecting any setups. Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-4-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit e66383b6746d226757f1db94633ca0d6c70d7c58 Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:35 2026 +0100 mm/sparse: remove WARN_ONs from (online|offline)_mem_sections() We do not allow offlining of memory with memory holes, and always hotplug memory without holes. Consequently, we cannot end up onlining or offlining memory sections that have holes (including invalid sections). That's also why these WARN_ONs never fired. Let's remove the WARN_ONs along with the TODO regarding double-checking. Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-3-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 9d80de66a04606eef625cb9141b6d1d8c970dbcb Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:34 2026 +0100 mm/memory_hotplug: remove for_each_valid_pfn() usage When offlining memory, we know that the memory range has no holes. Checking for valid pfns is not required. Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-2-096addc8800d@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 89e69c7d187eca8a040d4db0e080f79b5b32163d Author: David Hildenbrand (Arm) Date: Fri Mar 20 23:13:33 2026 +0100 mm/memory_hotplug: fix possible race in scan_movable_pages() Patch series "mm: memory hot(un)plug and SPARSEMEM cleanups", v2. Some cleanups around memory hot(un)plug and SPARSEMEM. In essence, we can limit CONFIG_MEMORY_HOTPLUG to CONFIG_SPARSEMEM_VMEMMAP, remove some dead code, and move all the hotplug bits over to mm/sparse-vmemmap.c. Some further/related cleanups around other unnecessary code (memory hole handling and complicated usemap allocation). I have some further sparse.c cleanups lying around, and I'm planning on getting rid of bootmem_info.c entirely. This patch (of 15): If a hugetlb folio gets freed while we are in scan_movable_pages(), folio_nr_pages() could return 0, resulting in or'ing "0 - 1 = -1" to the PFN, resulting in PFN = -1. We're not holding any locks or references that would prevent that. for_each_valid_pfn() would then search for the next valid PFN, and could return a PFN that is outside of the range of the original requested range. do_migrate_page() would then try to migrate quite a big range, which is certainly undesirable. To fix it, simply test for valid folio_nr_pages() values. While at it, as PageHuge() really just does a page_folio() internally, we can just use folio_test_hugetlb() on the folio directly. scan_movable_pages() is expected to be fast, and we try to avoid taking locks or grabbing references. We cannot use folio_try_get() as that does not work for free hugetlb folios. We could grab the hugetlb_lock, but that just adds complexity. The race is unlikely to trigger in practice, so we won't be CCing stable. Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-0-096addc8800d@kernel.org Link: https://lkml.kernel.org/r/20260320-sparsemem_cleanups-v2-1-096addc8800d@kernel.org Fixes: 16540dae959d ("mm/hugetlb: mm/memory_hotplug: use a folio in scan_movable_pages()") Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Axel Rasmussen Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 42561b341baae400ebd28540cdda7a6295eaf2a3 Author: Chen Ni Date: Wed Mar 18 12:38:49 2026 +0800 mm/swapfile: remove duplicate include of swap_table.h Remove duplicate inclusion of swap_table.h in swapfile.c to clean up redundant code. Link: https://lkml.kernel.org/r/20260318043849.399266-1-nichen@iscas.ac.cn Signed-off-by: Chen Ni Reviewed-by: SeongJae Park Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Kairui Song Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit 01494f713ee315e0aa2ddfe2f2760fd83c417e35 Author: Asier Gutierrez Date: Tue Mar 17 20:53:47 2026 -0700 Docs/mm/damon/design: document DAMON actions when TRANSPARENT_HUGEPAGE is off MADV_HUGEPAGE and MADV_NOHUGEPAGE are guarded and they are not available when compiling the kernel without TRANSPARENT_HUGEPAGE option. The DAMON behaviour is to silently fail [1] in when DAMOS_HUGEPAGE or DAMOS_NOHUGEPAGE are used, but TRANSPARENT_HUGEPAGE is disabled. Update the DAMON documentation to reflect this behaviour. Link: https://lkml.kernel.org/r/20260318035349.88715-1-sj@kernel.org Link: https://lore.kernel.org/66131775-180b-4b9f-b7ce-61a3e077b6e6@huawei-partners.com/ [1] Signed-off-by: Asier Gutierrez Reviewed-by: SeongJae Park Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit cba82993308dc66403c5c3dd27712a58e6fe3aa8 Author: Sergey Senozhatsky Date: Tue Mar 17 12:23:19 2026 +0900 zram: change scan_slots to return void scan_slots_for_writeback() and scan_slots_for_recompress() work in a "best effort" fashion, if they cannot allocate memory for a new pp-slot candidate they just return and post-processing selects slots that were successfully scanned thus far. scan_slots functions never return errors and their callers never check the return status, so convert them to return void. Link: https://lkml.kernel.org/r/20260317032349.753645-1-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reviewed-by: SeongJae Park Cc: Jens Axboe Cc: Minchan Kim Signed-off-by: Andrew Morton commit 4bdbddb4e482f283b60787b97fc06b3da3fb419c Author: Liew Rui Yan Date: Sun Mar 15 09:29:44 2026 -0700 Docs/mm/damon: document exclusivity of special-purpose modules Add a section in design.rst to explain that DAMON special-purpose kernel modules (LRU_SORT, RECLAIM, STAT) run in an exclusive manner and return -EBUSY if another is already running. Update lru_sort.rst, reclaim.rst and stat.rst by adding cross-references to this exclusivity rule at the end of their respective Example sections. This change is motivated from another discussion [1]. Link: https://lkml.kernel.org/r/20260315162945.80994-1-sj@kernel.org Link: https://lore.kernel.org/damon/20260314002119.79742-1-sj@kernel.org/T/#t [1] Signed-off-by: Liew Rui Yan Reviewed-by: SeongJae Park Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit bf989ade270d4ca65e73d5fc1ab5e4d2ef472e80 Author: Sergey Senozhatsky Date: Mon Mar 16 10:53:32 2026 +0900 zram: propagate read_from_bdev_async() errors When read_from_bdev_async() fails to chain bio, for instance fails to allocate request or bio, we need to propagate the error condition so that upper layer is aware of it. zram already does that by setting BLK_STS_IOERR ->bi_status, but only for sync reads. Change async read path to return its error status so that async errors are also handled. Link: https://lkml.kernel.org/r/20260316015354.114465-1-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Suggested-by: Brian Geffon Acked-by: Brian Geffon Cc: Minchan Kim Cc: Richard Chang Signed-off-by: Andrew Morton commit f0f6f787143068b23c5808e7a63aef03601f1377 Author: gao xu Date: Fri Mar 13 02:41:14 2026 +0000 zram: optimize LZ4 dictionary compression performance Calling `LZ4_loadDict()` repeatedly in Zram causes significant overhead due to its internal dictionary pre-processing. This commit introduces a template stream mechanism to pre-process the dictionary only once when the dictionary is initially set or modified. It then efficiently copies this state for subsequent compressions. Verification Test Items: Test Platform: android16-6.12 1. Collect Anonymous Page Dataset 1) Apply the following patch: static bool zram_meta_alloc(struct zram *zram, u64 disksize) if (!huge_class_size) - huge_class_size = zs_huge_class_size(zram->mem_pool); + huge_class_size = 0; 2）Install multiple apps and monkey testing until SwapFree is close to 0. 3）Execute the following command to export data: dd if=/dev/block/zram0 of=/data/samples/zram_dump.img bs=4K 2. Train Dictionary Since LZ4 does not have a dedicated dictionary training tool, the zstd tool can be used for training[1]. The command is as follows: zstd --train /data/samples/* --split=4096 --maxdict=64KB -o /vendor/etc/dict_data 3. Test Code adb shell "dd if=/data/samples/zram_dump.img of=/dev/test_pattern bs=4096 count=131072 conv=fsync" adb shell "swapoff /dev/block/zram0" adb shell "echo 1 > /sys/block/zram0/reset" adb shell "echo lz4 > /sys/block/zram0/comp_algorithm" adb shell "echo dict=/vendor/etc/dict_data > /sys/block/zram0/algorithm_params" adb shell "echo 6G > /sys/block/zram0/disksize" echo "Start Compression" adb shell "taskset 80 dd if=/dev/test_pattern of=/dev/block/zram0 bs=4096 count=131072 conv=fsync" echo. echo "Start Decompression" adb shell "taskset 80 dd if=/dev/block/zram0 of=/dev/output_result bs=4096 count=131072 conv=fsync" echo "mm_stat:" adb shell "cat /sys/block/zram0/mm_stat" echo. Note: To ensure stable test results, it is best to lock the CPU frequency before executing the test. LZ4 supports dictionaries up to 64KB. Below are the test results for compression rates at various dictionary sizes: dict_size base patch 4 KB 156M/s 219M/s 8 KB 136M/s 217M/s 16KB 98M/s 214M/s 32KB 66M/s 225M/s 64KB 38M/s 224M/s When an LZ4 compression dictionary is enabled, compression speed is negatively impacted by the dictionary's size; larger dictionaries result in slower compression. This patch eliminates the influence of dictionary size on compression speed, ensuring consistent performance regardless of dictionary scale. Link: https://lkml.kernel.org/r/698181478c9c4b10aa21b4a847bdc706@honor.com Link: https://github.com/lz4/lz4?tab=readme-ov-file [1] Signed-off-by: gao xu Acked-by: Sergey Senozhatsky Cc: Jens Axboe Cc: Minchan Kim Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit a155d945b73c5b0668e898df5495afe45bb261cd Author: Nico Pache Date: Wed Mar 25 05:40:22 2026 -0600 mm/khugepaged: unify khugepaged and madv_collapse with collapse_single_pmd() The khugepaged daemon and madvise_collapse have two different implementations that do almost the same thing. Create collapse_single_pmd to increase code reuse and create an entry point to these two users. Refactor madvise_collapse and collapse_scan_mm_slot to use the new collapse_single_pmd function. To help reduce confusion around the mmap_locked variable, we rename mmap_locked to lock_dropped in the collapse_scan_mm_slot() function, and remove the redundant mmap_locked in madvise_collapse(); this further unifies the code readiblity. the SCAN_PTE_MAPPED_HUGEPAGE enum is no longer reachable in the madvise_collapse() function, so we drop it from the list of "continuing" enums. This introduces a minor behavioral change that is most likely an undiscovered bug. The current implementation of khugepaged tests collapse_test_exit_or_disable() before calling collapse_pte_mapped_thp, but we weren't doing it in the madvise_collapse case. By unifying these two callers madvise_collapse now also performs this check. We also modify the return value to be SCAN_ANY_PROCESS which properly indicates that this process is no longer valid to operate on. By moving the madvise_collapse writeback-retry logic into the helper function we can also avoid having to revalidate the VMA. We guard the khugepaged_pages_collapsed variable to ensure its only incremented for khugepaged. As requested we also convert a VM_BUG_ON to a VM_WARN_ON. Link: https://lkml.kernel.org/r/20260325114022.444081-6-npache@redhat.com Signed-off-by: Nico Pache Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Lance Yang Reviewed-by: Baolin Wang Acked-by: David Hildenbrand (Arm) Cc: Alistair Popple Cc: Andrea Arcangeli Cc: Anshuman Khandual Cc: Barry Song Cc: Brendan Jackman Cc: Byungchul Park Cc: Catalin Marinas Cc: David Rientjes Cc: Dev Jain Cc: Gregory Price Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Matthew Brost Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nanyong Sun Cc: Pedro Falcato Cc: Peter Xu Cc: Rafael Aquini Cc: Rakie Kim Cc: Randy Dunlap Cc: Ryan Roberts Cc: Shivank Garg Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Takashi Iwai (SUSE) Cc: Thomas Hellström Cc: Usama Arif Cc: Vishal Moola (Oracle) Cc: Vlastimil Babka Cc: Wei Yang Cc: Will Deacon Cc: Yang Shi Cc: Zach O'Keefe Cc: Zi Yan Signed-off-by: Andrew Morton commit ff7e03a87169d3c2b05f86e7e96456ab62e6cbb1 Author: Nico Pache Date: Wed Mar 25 05:40:21 2026 -0600 mm/khugepaged: rename hpage_collapse_* to collapse_* The hpage_collapse functions describe functions used by madvise_collapse and khugepaged. remove the unnecessary hpage prefix to shorten the function name. Link: https://lkml.kernel.org/r/20260325114022.444081-5-npache@redhat.com Signed-off-by: Nico Pache Reviewed-by: Dev Jain Reviewed-by: Wei Yang Reviewed-by: Lance Yang Reviewed-by: Liam R. Howlett Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Arm) Cc: Alistair Popple Cc: Andrea Arcangeli Cc: Anshuman Khandual Cc: Barry Song Cc: Brendan Jackman Cc: Byungchul Park Cc: Catalin Marinas Cc: David Rientjes Cc: Gregory Price Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Kefeng Wang Cc: Lorenzo Stoakes (Oracle) Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Matthew Brost Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nanyong Sun Cc: Pedro Falcato Cc: Peter Xu Cc: Rafael Aquini Cc: Rakie Kim Cc: Randy Dunlap Cc: Ryan Roberts Cc: Shivank Garg Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Takashi Iwai (SUSE) Cc: Thomas Hellström Cc: Usama Arif Cc: Vishal Moola (Oracle) Cc: Vlastimil Babka Cc: Will Deacon Cc: Yang Shi Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit 36da8a88fd3b519fd31b2f31bbea1b189df6cd8c Author: Nico Pache Date: Wed Mar 25 05:40:20 2026 -0600 mm/khugepaged: define KHUGEPAGED_MAX_PTES_LIMIT as HPAGE_PMD_NR - 1 The value (HPAGE_PMD_NR - 1) is used often in the khugepaged code to signify the limit of the max_ptes_* values. Add a define for this to increase code readability and reuse. Link: https://lkml.kernel.org/r/20260325114022.444081-4-npache@redhat.com Signed-off-by: Nico Pache Acked-by: Pedro Falcato Acked-by: David Hildenbrand (Arm) Suggested-by: Lorenzo Stoakes (Oracle) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Baolin Wang Reviewed-by: Zi Yan Cc: Alistair Popple Cc: Andrea Arcangeli Cc: Anshuman Khandual Cc: Barry Song Cc: Brendan Jackman Cc: Byungchul Park Cc: Catalin Marinas Cc: David Rientjes Cc: Dev Jain Cc: Gregory Price Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Kefeng Wang Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Matthew Brost Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nanyong Sun Cc: Peter Xu Cc: Rafael Aquini Cc: Rakie Kim Cc: Randy Dunlap Cc: Ryan Roberts Cc: Shivank Garg Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Takashi Iwai (SUSE) Cc: Thomas Hellström Cc: Usama Arif Cc: Vishal Moola (Oracle) Cc: Vlastimil Babka Cc: Wei Yang Cc: Will Deacon Cc: Yang Shi Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit b90c453d2664ba445383956560581f9db708584f Author: Nico Pache Date: Wed Mar 25 05:40:19 2026 -0600 mm: introduce is_pmd_order helper In order to add mTHP support to khugepaged, we will often be checking if a given order is (or is not) a PMD order. Some places in the kernel already use this check, so lets create a simple helper function to keep the code clean and readable. Link: https://lkml.kernel.org/r/20260325114022.444081-3-npache@redhat.com Signed-off-by: Nico Pache Acked-by: David Hildenbrand (Arm) Reviewed-by: Baolin Wang Reviewed-by: Dev Jain Reviewed-by: Wei Yang Reviewed-by: Lance Yang Reviewed-by: Barry Song Reviewed-by: Zi Yan Reviewed-by: Pedro Falcato Reviewed-by: Lorenzo Stoakes Suggested-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Andrea Arcangeli Cc: Anshuman Khandual Cc: Brendan Jackman Cc: Byungchul Park Cc: Catalin Marinas Cc: David Rientjes Cc: Gregory Price Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Matthew Brost Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nanyong Sun Cc: Peter Xu Cc: Rafael Aquini Cc: Rakie Kim Cc: Randy Dunlap Cc: Ryan Roberts Cc: Shivank Garg Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Takashi Iwai (SUSE) Cc: Thomas Hellström Cc: Usama Arif Cc: Vishal Moola (Oracle) Cc: Vlastimil Babka Cc: Will Deacon Cc: Yang Shi Cc: Zach O'Keefe Signed-off-by: Andrew Morton commit a91fd9f710490a89713823be3e7790ac59a085f8 Author: Nico Pache Date: Wed Mar 25 05:40:18 2026 -0600 mm: consolidate anonymous folio PTE mapping into helpers Patch series "mm: khugepaged cleanups and mTHP prerequisites", v4. The following series contains cleanups and prerequisites for my work on khugepaged mTHP support [1]. These have been separated out to ease review. The first patch in the series refactors the page fault folio to pte mapping and follows a similar convention as defined by map_anon_folio_pmd_(no)pf(). This not only cleans up the current implementation of do_anonymous_page(), but will allow for reuse later in the khugepaged mTHP implementation. The second patch adds a small is_pmd_order() helper to check if an order is the PMD order. This check is open-coded in a number of places. This patch aims to clean this up and will be used more in the khugepaged mTHP work. The third patch also adds a small DEFINE for (HPAGE_PMD_NR - 1) which is used often across the khugepaged code. The fourth and fifth patch come from the khugepaged mTHP patchset [1]. These two patches include the rename of function prefixes, and the unification of khugepaged and madvise_collapse via a new collapse_single_pmd function. Patch 1: refactor do_anonymous_page into map_anon_folio_pte_(no)pf Patch 2: add is_pmd_order helper Patch 3: Add define for (HPAGE_PMD_NR - 1) Patch 4: Refactor/rename hpage_collapse Patch 5: Refactoring to combine madvise_collapse and khugepaged A big thanks to everyone that has reviewed, tested, and participated in the development process. This patch (of 5): The anonymous page fault handler in do_anonymous_page() open-codes the sequence to map a newly allocated anonymous folio at the PTE level: - construct the PTE entry - add rmap - add to LRU - set the PTEs - update the MMU cache. Introduce two helpers to consolidate this duplicated logic, mirroring the existing map_anon_folio_pmd_nopf() pattern for PMD-level mappings: map_anon_folio_pte_nopf(): constructs the PTE entry, takes folio references, adds anon rmap and LRU. This function also handles the uffd_wp that can occur in the pf variant. The future khugepaged mTHP code calls this to handle mapping the new collapsed mTHP to its folio. map_anon_folio_pte_pf(): extends the nopf variant to handle MM_ANONPAGES counter updates, and mTHP fault allocation statistics for the page fault path. The zero-page read path in do_anonymous_page() is also untangled from the shared setpte label, since it does not allocate a folio and should not share the same mapping sequence as the write path. We can now leave nr_pages undeclared at the function intialization, and use the single page update_mmu_cache function to handle the zero page update. This refactoring will also help reduce code duplication between mm/memory.c and mm/khugepaged.c, and provides a clean API for PTE-level anonymous folio mapping that can be reused by future callers (like khugpeaged mTHP support) Link: https://lkml.kernel.org/r/20260325114022.444081-1-npache@redhat.com Link: https://lkml.kernel.org/r/20260325114022.444081-2-npache@redhat.com Link: https://lore.kernel.org/all/20260122192841.128719-1-npache@redhat.com Signed-off-by: Nico Pache Suggested-by: Lorenzo Stoakes (Oracle) Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Dev Jain Reviewed-by: Lance Yang Acked-by: David Hildenbrand (Arm) Cc: Alistair Popple Cc: Andrea Arcangeli Cc: Anshuman Khandual Cc: Baolin Wang Cc: Barry Song Cc: Brendan Jackman Cc: Byungchul Park Cc: Catalin Marinas Cc: David Rientjes Cc: Gregory Price Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Kefeng Wang Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Matthew Brost Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nanyong Sun Cc: Pedro Falcato Cc: Peter Xu Cc: Rafael Aquini Cc: Rakie Kim Cc: Randy Dunlap Cc: Ryan Roberts Cc: Shivank Garg Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Takashi Iwai (SUSE) Cc: Thomas Hellström Cc: Usama Arif Cc: Vishal Moola (Oracle) Cc: Vlastimil Babka Cc: Wei Yang Cc: Will Deacon Cc: Yang Shi Cc: Zach O'Keefe Cc: Zi Yan Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 0217c7fb4de4a40cee667eb21901f3204effe5ac Author: Jianhui Zhou Date: Tue Mar 10 19:05:26 2026 +0800 mm/userfaultfd: fix hugetlb fault mutex hash calculation In mfill_atomic_hugetlb(), linear_page_index() is used to calculate the page index for hugetlb_fault_mutex_hash(). However, linear_page_index() returns the index in PAGE_SIZE units, while hugetlb_fault_mutex_hash() expects the index in huge page units. This mismatch means that different addresses within the same huge page can produce different hash values, leading to the use of different mutexes for the same huge page. This can cause races between faulting threads, which can corrupt the reservation map and trigger the BUG_ON in resv_map_release(). Fix this by introducing hugetlb_linear_page_index(), which returns the page index in huge page granularity, and using it in place of linear_page_index(). Link: https://lkml.kernel.org/r/20260310110526.335749-1-jianhuizzzzz@gmail.com Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c") Signed-off-by: Jianhui Zhou Reported-by: syzbot+f525fd79634858f478e7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f525fd79634858f478e7 Acked-by: SeongJae Park Reviewed-by: David Hildenbrand (Arm) Acked-by: Mike Rapoport (Microsoft) Cc: Jane Chu Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: JonasZhou Cc: Muchun Song Cc: Oscar Salvador Cc: Peter Xu Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Signed-off-by: Andrew Morton commit 8c6a765f4ad7f95bb0288637d9fafbf630871838 Author: SeongJae Park Date: Tue Mar 10 22:29:26 2026 -0700 mm/damon/lru_sort: respect addr_unit on default monitoring region setup In the past, damon_set_region_biggest_system_ram_default(), which is the core function for setting the default monitoring target region of DAMON_LRU_SORT, didn't support addr_unit. Hence DAMON_LRU_SORT was silently ignoring the user input for addr_unit when the user doesn't explicitly set the monitoring target regions, and therefore the default target region is being used. No real problem from that ignorance was reported so far. But, the implicit rule is only making things confusing. Also, the default target region setup function is updated to support addr_unit. Hence there is no reason to keep ignoring it. Respect the user-passed addr_unit for the default target monitoring region use case. Link: https://lkml.kernel.org/r/20260311052927.93921-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: Yang yingliang Signed-off-by: Andrew Morton commit fdfcda8d08df9055bc7e081a919ee0463c3a926f Author: SeongJae Park Date: Tue Mar 10 22:29:25 2026 -0700 mm/damon/reclaim: respect addr_unit on default monitoring region setup In the past, damon_set_region_biggest_system_ram_default(), which is the core function for setting the default monitoring target region of DAMON_RECLAIM, didn't support addr_unit. Hence DAMON_RECLAIM was silently ignoring the user input for addr_unit when the user doesn't explicitly set the monitoring target regions, and therefore the default target region is being used. No real problem from that ignorance was reported so far. But, the implicit rule is only making things confusing. Also, the default target region setup function is updated to support addr_unit. Hence there is no reason to keep ignoring it. Respect the user-passed addr_unit for the default target monitoring region use case. Link: https://lkml.kernel.org/r/20260311052927.93921-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: Yang yingliang Signed-off-by: Andrew Morton commit 5f9a5926b75c12ac01b9c2eae98c43939272632b Author: SeongJae Park Date: Fri Mar 13 16:49:08 2026 -0700 mm/damon/core: fix wrong damon_set_regions() argument The third argument is the length of the second parameter. But addr_unit is wrongly being passed. Fix it. Link: https://lkml.kernel.org/r/20260314001854.79623-1-sj@kernel.org Signed-off-by: SeongJae Park Cc: Yang yingliang Signed-off-by: Andrew Morton commit eabc2eddb2767e0ed90f98a65744bf4c8e287db7 Author: SeongJae Park Date: Tue Mar 10 22:29:24 2026 -0700 mm/damon/core: receive addr_unit on damon_set_region_biggest_system_ram_default() damon_find_biggest_system_ram() was not supporting addr_unit in the past. Hence, its caller, damon_set_region_biggest_system_ram_default(), was also not supporting addr_unit. The previous commit has updated the inner function to support addr_unit. There is no more reason to not support addr_unit on damon_set_region_biggest_system_ram_default(). Rather, it makes unnecessary inconsistency on support of addr_unit. Update it to receive addr_unit and handle it inside. Link: https://lkml.kernel.org/r/20260311052927.93921-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Yang yingliang Signed-off-by: Andrew Morton commit b47dcc1a28ccd5a175549055b7bc7a68a444ee92 Author: SeongJae Park Date: Tue Mar 10 22:29:23 2026 -0700 mm/damon/core: support addr_unit on damon_find_biggest_system_ram() damon_find_biggest_system_ram() sets an 'unsigned long' variable with 'resource_size_t' value. This is fundamentally wrong. On environments such as ARM 32 bit machines having LPAE (Large Physical Address Extensions), which DAMON supports, the size of 'unsigned long' may be smaller than that of 'resource_size_t'. It is safe, though, since we restrict the walk to be done only up to ULONG_MAX. DAMON supports the address size gap using 'addr_unit'. We didn't add the support to the function, just to make the initial support change small. Now the support is reasonably settled. This kind of gap is only making the code inconsistent and easy to be confused. Add the support of 'addr_unit' to the function, by letting callers pass the 'addr_unit' and handling it in the function. All callers are passing 'addr_unit' 1, though, to keep the old behavior. [sj@kernel.org: verify found biggest system ram] Link: https://lkml.kernel.org/r/20260317144725.88524-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260311052927.93921-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Yang yingliang Signed-off-by: Andrew Morton commit c63067e8b08495550be09afa646f9bf101762d0e Author: SeongJae Park Date: Tue Mar 10 22:29:22 2026 -0700 mm/damon/core: fix wrong end address assignment on walk_system_ram() Patch series "mm/damon: support addr_unit on default monitoring targets for modules". DAMON_RECLAIM and DAMON_LRU_SORT support 'addr_unit' parameters only when the monitoring target address range is explicitly set. This was intentional for making the initial 'addr_unit' support change small. Now 'addr_unit' support is being quite stabilized. Having the corner case of the support is only making the code inconsistent with implicit rules. The inconsistency makes it easy to confuse [1] readers. After all, there is no real reason to keep 'addr_unit' support incomplete. Add the support for the case to improve the readability and more completely support 'addr_unit'. This series is constructed with five patches. The first one (patch 1) fixes a small bug that mistakenly assigns inclusive end address to open end address, which was found from this work. The second and third ones (patches 2 and 3) extend the default monitoring target setting functions in the core layer one by one, to support the 'addr_unit' while making no visible changes. The final two patches (patches 4 and 5) update DAMON_RECLAIM and DAMON_LRU_SORT to support 'addr_unit' for the default monitoring target address ranges, by passing the user input to the core functions. This patch (of 5): 'struct damon_addr_range' and 'struct resource' represent different types of address ranges. 'damon_addr_range' is for end-open ranges ([start, end)). 'resource' is for fully-closed ranges ([start, end]). But walk_system_ram() is assigning resource->end to damon_addr_range->end without the inclusiveness adjustment. As a result, the function returns an address range that is missing the last one byte. The function is being used to find and set the biggest system ram as the default monitoring target for DAMON_RECLAIM and DAMON_LRU_SORT. Missing the last byte of the big range shouldn't be a real problem for the real use cases. That said, the loss is definitely an unintended behavior. Do the correct adjustment. Link: https://lkml.kernel.org/r/20260311052927.93921-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260311052927.93921-2-sj@kernel.org Link: https://lore.kernel.org/20260131015643.79158-1-sj@kernel.org [1] Fixes: 43b0536cb471 ("mm/damon: introduce DAMON-based Reclamation (DAMON_RECLAIM)") Signed-off-by: SeongJae Park Cc: Yang yingliang Signed-off-by: Andrew Morton commit 0289955fc548525aa6c4b12ec36afbb7283725fb Author: Lorenzo Stoakes (Oracle) Date: Wed Mar 11 17:24:38 2026 +0000 mm/mremap: check map count under mmap write lock and abstract We are checking the mmap count in check_mremap_params(), prior to obtaining an mmap write lock, which means that accesses to current->mm->map_count might race with this field being updated. Resolve this by only checking this field after the mmap write lock is held. Additionally, abstract this check into a helper function with extensive ASCII documentation of what's going on. Link: https://lkml.kernel.org/r/18be0b48eaa8e8804eb745974ee729c3ade0c687.1773249037.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reported-by: Jianzhou Zhao Closes: https://lore.kernel.org/all/1a7d4c26.6b46.19cdbe7eaf0.Coremail.luckd0g@163.com/ Reviewed-by: Pedro Falcato Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2d1e54aab6fd01f7502af20e125312e06a15bf9c Author: Lorenzo Stoakes (Oracle) Date: Wed Mar 11 17:24:37 2026 +0000 mm: abstract reading sysctl_max_map_count, and READ_ONCE() Concurrent reads and writes of sysctl_max_map_count are possible, so we should READ_ONCE() and WRITE_ONCE(). The sysctl procfs logic already enforces WRITE_ONCE(), so abstract the read side with get_sysctl_max_map_count(). While we're here, also move the field to mm/internal.h and add the getter there since only mm interacts with it, there's no need for anybody else to have access. Finally, update the VMA userland tests to reflect the change. Link: https://lkml.kernel.org/r/0715259eb37cbdfde4f9e5db92a20ec7110a1ce5.1773249037.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Pedro Falcato Cc: Jann Horn Cc: Jianzhou Zhao Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9b9b8d4aebf1eb8fe22293dcfc38c600a7e7859b Author: Lorenzo Stoakes (Oracle) Date: Wed Mar 11 17:24:36 2026 +0000 mm/mremap: correct invalid map count check Patch series "mm: improve map count checks". Firstly, in mremap(), it appears that our map count checks have been overly conservative - there is simply no reason to require that we have headroom of 4 mappings prior to moving the VMA, we only need headroom of 2 VMAs since commit 659ace584e7a ("mmap: don't return ENOMEM when mapcount is temporarily exceeded in munmap()"). Likely the original headroom of 4 mappings was a mistake, and 3 was actually intended. Next, we access sysctl_max_map_count in a number of places without being all that careful about how we do so. We introduce a simple helper that READ_ONCE()'s the field (get_sysctl_max_map_count()) to ensure that the field is accessed correctly. The WRITE_ONCE() side is already handled by the sysctl procfs code in proc_int_conv(). We also move this field to internal.h as there's no reason for anybody else to access it outside of mm. Unfortunately we have to maintain the extern variable, as mmap.c implements the procfs code. Finally, we are accessing current->mm->map_count without holding the mmap write lock, which is also not correct, so this series ensures the lock is head before we access it. We also abstract the check to a helper function, and add ASCII diagrams to explain why we're doing what we're doing. This patch (of 3): We currently check to see, if on moving a VMA when doing mremap(), if it might violate the sys.vm.max_map_count limit. This was introduced in the mists of time prior to 2.6.12. At this point in time, as now, the move_vma() operation would copy the VMA (+1 mapping if not merged), then potentially split the source VMA upon unmap. Prior to commit 659ace584e7a ("mmap: don't return ENOMEM when mapcount is temporarily exceeded in munmap()"), a VMA split would check whether mm->map_count >= sysctl_max_map_count prior to a split before it ran. On unmap of the source VMA, if we are moving a partial VMA, we might split the VMA twice. This would mean, on invocation of split_vma() (as was), we'd check whether mm->map_count >= sysctl_max_map_count with a map count elevated by one, then again with a map count elevated by two, ending up with a map count elevated by three. At this point we'd reduce the map count on unmap. At the start of move_vma(), there was a check that has remained throughout mremap()'s history of mm->map_count >= sysctl_max_map_count - 3 (which implies mm->mmap_count + 4 > sysctl_max_map_count - that is, we must have headroom for 4 additional mappings). After mm->map_count is elevated by 3, it is decremented by one once the unmap completes. The mmap write lock is held, so nothing else will observe mm->map_count > sysctl_max_map_count. It appears this check was always incorrect - it should have either be one of 'mm->map_count > sysctl_max_map_count - 3' or 'mm->map_count >= sysctl_max_map_count - 2'. After commit 659ace584e7a ("mmap: don't return ENOMEM when mapcount is temporarily exceeded in munmap()"), the map count check on split is eliminated in the newly introduced __split_vma(), which the unmap path uses, and has that path check whether mm->map_count >= sysctl_max_map_count. This is valid since, net, an unmap can only cause an increase in map count of 1 (split both sides, unmap middle). Since we only copy a VMA and (if MREMAP_DONTUNMAP is not set) unmap afterwards, the maximum number of additional mappings that will actually be subject to any check will be 2. Therefore, update the check to assert this corrected value. Additionally, update the check introduced by commit ea2c3f6f5545 ("mm,mremap: bail out earlier in mremap_to under map pressure") to account for this. While we're here, clean up the comment prior to that. Link: https://lkml.kernel.org/r/cover.1773249037.git.ljs@kernel.org Link: https://lkml.kernel.org/r/73e218c67dcd197c5331840fb011e2c17155bfb0.1773249037.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Pedro Falcato Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Jianzhou Zhao Signed-off-by: Andrew Morton commit d4e981b280454f4368950db6269c6077d66453cf Author: Kexin Sun Date: Thu Mar 12 13:38:12 2026 +0800 kasan: update outdated comment kmalloc_large() was renamed kmalloc_large_noprof() by commit 7bd230a26648 ("mm/slab: enable slab allocation tagging for kmalloc and friends"), and subsequently renamed __kmalloc_large_noprof() by commit a0a44d9175b3 ("mm, slab: don't wrap internal functions with alloc_hooks()"), making it an internal implementation detail. Large kmalloc allocations are now performed through the public kmalloc() interface directly, making the reference to KMALLOC_MAX_SIZE also stale (KMALLOC_MAX_CACHE_SIZE would be more accurate). Remove the references to kmalloc_large() and KMALLOC_MAX_SIZE, and rephrase the description for large kmalloc allocations. Link: https://lkml.kernel.org/r/20260312053812.1365-1-kexinsun@smail.nju.edu.cn Signed-off-by: Kexin Sun Suggested-by: Andrey Ryabinin Assisted-by: unnamed:deepseek-v3.2 coccinelle Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Julia Lawall Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit a2e0c0668a3486f96b86c50e02872c8e94fd4f9c Author: Usama Arif Date: Thu Mar 12 03:47:23 2026 -0700 mm: migrate: requeue destination folio on deferred split queue During folio migration, __folio_migrate_mapping() removes the source folio from the deferred split queue, but the destination folio is never re-queued. This causes underutilized THPs to escape the shrinker after NUMA migration, since they silently drop off the deferred split list. Fix this by recording whether the source folio was on the deferred split queue and its partially mapped state before move_to_new_folio() unqueues it, and re-queuing the destination folio after a successful migration if it was. By the time migrate_folio_move() runs, partially mapped folios without a pin have already been split by migrate_pages_batch(). So only two cases remain on the deferred list at this point: 1. Partially mapped folios with a pin (split failed). 2. Fully mapped but potentially underused folios. The recorded partially_mapped state is forwarded to deferred_split_folio() so that the destination folio is correctly re-queued in both cases. Because THPs are removed from the deferred_list, THP shinker cannot split the underutilized THPs in time. As a result, users will show less free memory than before. Link: https://lkml.kernel.org/r/20260312104723.1351321-1-usama.arif@linux.dev Fixes: dafff3f4c850 ("mm: split underused THPs") Signed-off-by: Usama Arif Reported-by: Johannes Weiner Acked-by: Johannes Weiner Acked-by: Zi Yan Acked-by: David Hildenbrand (Arm) Acked-by: SeongJae Park Reviewed-by: Wei Yang Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Joshua Hahn Cc: Matthew Brost Cc: Matthew Wilcox (Oracle) Cc: Nico Pache Cc: Rakie Kim Cc: Ying Huang Cc: Signed-off-by: Andrew Morton commit 2d028f3e4bbbfd448928a8d3d2814b0b04c214f4 Author: Waiman Long Date: Wed Mar 11 16:05:26 2026 -0400 selftest: memcg: skip memcg_sock test if address family not supported The test_memcg_sock test in memcontrol.c sets up an IPv6 socket and send data over it to consume memory and verify that memory.stat.sock and memory.current values are close. On systems where IPv6 isn't enabled or not configured to support SOCK_STREAM, the test_memcg_sock test always fails. When the socket() call fails, there is no way we can test the memory consumption and verify the above claim. I believe it is better to just skip the test in this case instead of reporting a test failure hinting that there may be something wrong with the memcg code. Link: https://lkml.kernel.org/r/20260311200526.885899-1-longman@redhat.com Fixes: 5f8f019380b8 ("selftests: cgroup/memcontrol: add basic test for socket accounting") Signed-off-by: Waiman Long Acked-by: Michal Koutný Acked-by: Shakeel Butt Cc: Johannes Weiner Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Muchun Song Cc: Roman Gushchin Cc: Shuah Khan Cc: Tejun Heo Signed-off-by: Andrew Morton commit f08f610ea00b75d6174cd34950a8338d51a0729f Author: Mike Rapoport (Microsoft) Date: Wed Mar 11 20:07:37 2026 +0200 selftests/mm: pagemap_ioctl: remove hungarian notation Replace lpBaseAddress with addr and dwRegionSize with size. Link: https://lkml.kernel.org/r/20260311180737.3767545-1-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3203a8706e81b8d73712d46952b96eb28238c45e Author: Breno Leitao Date: Tue Mar 17 08:33:59 2026 -0700 mm: ratelimit min_free_kbytes adjustment messages The "raising min_free_kbytes" pr_info message in set_recommended_min_free_kbytes() and the "min_free_kbytes is not updated to" pr_warn in calculate_min_free_kbytes() can spam the kernel log when called repeatedly. Switch the pr_info in set_recommended_min_free_kbytes() and the pr_warn in calculate_min_free_kbytes() to their _ratelimited variants to prevent the log spam for this message. Link: https://lkml.kernel.org/r/20260317-thp_logs-v7-4-31eb98fa5a8b@debian.org Signed-off-by: Breno Leitao Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Reviewed-by: Baolin Wang Acked-by: Zi Yan Cc: Barry Song Cc: Brendan Jackman Cc: Dev Jain Cc: Johannes Weiner Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton commit 35a01d94420e1c2b5b1b421d1471ae33f48ae13a Author: Breno Leitao Date: Tue Mar 17 08:33:58 2026 -0700 mm: huge_memory: refactor enabled_store() with set_global_enabled_mode() Refactor enabled_store() to use a new set_global_enabled_mode() helper. Introduce a separate enum global_enabled_mode and global_enabled_mode_strings[], mirroring the anon_enabled_mode pattern from the previous commit. A separate enum is necessary because the global THP setting does not support "inherit", only "always", "madvise", and "never". Reusing anon_enabled_mode would leave a NULL gap in the string array, causing sysfs_match_string() to stop early and fail to match entries after the gap. The helper uses the same loop pattern as set_anon_enabled_mode(), iterating over an array of flag bit positions and using test_and_set_bit()/test_and_clear_bit() to track whether the state actually changed. Link: https://lkml.kernel.org/r/20260317-thp_logs-v7-3-31eb98fa5a8b@debian.org Signed-off-by: Breno Leitao Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Reviewed-by: Wei Yang Acked-by: David Hildenbrand (Arm) Cc: Barry Song Cc: Brendan Jackman Cc: Dev Jain Cc: Johannes Weiner Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 82d9ff648c6c9fa00b3f31107e63127572cca741 Author: Breno Leitao Date: Tue Mar 17 08:33:57 2026 -0700 mm: huge_memory: refactor anon_enabled_store() with set_anon_enabled_mode() Consolidate the repeated spin_lock/set_bit/clear_bit pattern in anon_enabled_store() into a new set_anon_enabled_mode() helper that loops over an orders[] array, setting the bit for the selected mode and clearing the others. Introduce enum anon_enabled_mode and anon_enabled_mode_strings[] for the per-order anon THP setting. Use sysfs_match_string() with the anon_enabled_mode_strings[] table to replace the if/else chain of sysfs_streq() calls. The helper uses __test_and_set_bit()/__test_and_clear_bit() to track whether the state actually changed, so start_stop_khugepaged() is only called when needed. When the mode is unchanged, set_recommended_min_free_kbytes() is called directly to preserve the watermark recalculation behavior of the original code. Link: https://lkml.kernel.org/r/20260317-thp_logs-v7-2-31eb98fa5a8b@debian.org Signed-off-by: Breno Leitao Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Cc: Baolin Wang Cc: Barry Song Cc: Brendan Jackman Cc: Dev Jain Cc: Johannes Weiner Cc: Lance Yang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Yang Cc: Zi Yan Signed-off-by: Andrew Morton commit c82aade08c3b4f51029fdcdccb7b479facec0ed3 Author: Breno Leitao Date: Tue Mar 17 08:33:56 2026 -0700 mm: khugepaged: export set_recommended_min_free_kbytes() Patch series "mm: thp: reduce unnecessary start_stop_khugepaged()", v7. Writing to /sys/kernel/mm/transparent_hugepage/enabled causes start_stop_khugepaged() called independent of any change. start_stop_khugepaged() SPAMs the printk ring buffer overflow with the exact same message, even when nothing changes. For instance, if you have a custom vm.min_free_kbytes, just touching /sys/kernel/mm/transparent_hugepage/enabled causes a printk message. Example: # sysctl -w vm.min_free_kbytes=112382 # for i in $(seq 100); do echo never > /sys/kernel/mm/transparent_hugepage/enabled ; done and you have 100 WARN messages like the following, which is pretty dull: khugepaged: min_free_kbytes is not updated to 112381 because user defined value 112382 is preferred A similar message shows up when setting thp to "always": # for i in $(seq 100); do # echo 1024 > /proc/sys/vm/min_free_kbytes # echo always > /sys/kernel/mm/transparent_hugepage/enabled # done And then, we have 100 messages like: khugepaged: raising min_free_kbytes from 1024 to 67584 to help transparent hugepage allocations This is more common when you have a configuration management system that writes the THP configuration without an extra read, assuming that nothing will happen if there is no change in the configuration, but it prints these annoying messages. For instance, at Meta's fleet, ~10K servers were producing 3.5M of these messages per day. Fix this by making the sysfs _store helpers easier to digest and ratelimiting the message. This patch (of 4): Make set_recommended_min_free_kbytes() callable from outside khugepaged.c by removing the static qualifier and adding a declaration in mm/internal.h. This allows callers that change THP settings to recalculate watermarks without going through start_stop_khugepaged(). Link: https://lkml.kernel.org/r/20260317-thp_logs-v7-0-31eb98fa5a8b@debian.org Link: https://lkml.kernel.org/r/20260317-thp_logs-v7-1-31eb98fa5a8b@debian.org Signed-off-by: Breno Leitao Suggested-by: Lorenzo Stoakes (Oracle) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Reviewed-by: Zi Yan Cc: Baolin Wang Cc: Barry Song Cc: Brendan Jackman Cc: Dev Jain Cc: Johannes Weiner Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Usama Arif Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton commit ddac713da3bcd117a4ee4d184a34f02582495e7d Author: SeongJae Park Date: Mon Mar 9 18:05:27 2026 -0700 selftests/damon/sysfs.py: test goal_tuner commit Extend the near-full DAMON parameters commit selftest to commit goal_tuner and confirm the internal status is updated as expected. Link: https://lkml.kernel.org/r/20260310010529.91162-12-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit c2b0cb96e787a2f053003f4ea966cecdcc41e5d9 Author: SeongJae Park Date: Mon Mar 9 18:05:26 2026 -0700 selftests/damon/drgn_dump_damon_status: support quota goal_tuner dumping Update drgn_dump_damon_status.py, which is being used to dump the in-kernel DAMON status for tests, to dump goal_tuner setup status. Link: https://lkml.kernel.org/r/20260310010529.91162-11-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit c00863bc7cc3c30d8beb9d10f90aa19d799ab386 Author: SeongJae Park Date: Mon Mar 9 18:05:25 2026 -0700 selftests/damon/_damon_sysfs: support goal_tuner setup Add support of goal_tuner setup to the test-purpose DAMON sysfs interface control helper, _damon_sysfs.py. Link: https://lkml.kernel.org/r/20260310010529.91162-10-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit d972d68d506adf1abf9c52fdb8b19614ec816e70 Author: SeongJae Park Date: Mon Mar 9 18:05:24 2026 -0700 mm/damon/tests/core-kunit: test goal_tuner commit Extend damos_commit_quota() kunit test for the newly added goal_tuner parameter. Link: https://lkml.kernel.org/r/20260310010529.91162-9-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 3eda936f2a6fc3cd40ff6943179b63e8d781a9b0 Author: SeongJae Park Date: Mon Mar 9 18:05:23 2026 -0700 Docs/ABI/damon: update for goal_tuner Update the ABI document for the newly added goal_tuner sysfs file. Link: https://lkml.kernel.org/r/20260310010529.91162-8-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit d9cfe515d36eb4cf065665d494a5a826139922d4 Author: SeongJae Park Date: Mon Mar 9 18:05:22 2026 -0700 Docs/admin-guide/mm/damon/usage: document goal_tuner sysfs file Update the DAMON usage document for the new sysfs file for the goal based quota auto-tuning algorithm selection. Link: https://lkml.kernel.org/r/20260310010529.91162-7-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 5a242f9daf2931fe124aa5f0f57e4a04bd2e4fa8 Author: SeongJae Park Date: Mon Mar 9 18:05:21 2026 -0700 Docs/mm/damon/design: document the goal-based quota tuner selections Update the design document for the newly added goal-based quota tuner selection feature. Link: https://lkml.kernel.org/r/20260310010529.91162-6-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit e9a19cc85d4821a441f4b2d4756ae01e12f17393 Author: SeongJae Park Date: Mon Mar 9 18:05:20 2026 -0700 mm/damon/sysfs-schemes: implement quotas->goal_tuner file Add a new DAMON sysfs interface file, namely 'goal_tuner' under the DAMOS quotas directory. It is connected to the damos_quota->goal_tuner field. Users can therefore select their favorite goal-based quotas tuning algorithm by writing the name of the tuner to the file. Reading the file returns the name of the currently selected tuner. Link: https://lkml.kernel.org/r/20260310010529.91162-5-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit af738a6a00c1febb0d543ba6a1400413f824ecf1 Author: SeongJae Park Date: Mon Mar 9 18:05:19 2026 -0700 mm/damon/core: introduce DAMOS_QUOTA_GOAL_TUNER_TEMPORAL Introduce a new goal-based DAMOS quota auto-tuning algorithm, namely DAMOS_QUOTA_GOAL_TUNER_TEMPORAL (temporal in short). The algorithm aims to trigger the DAMOS action only for a temporal time, to achieve the goal as soon as possible. For the temporal period, it uses as much quota as allowed. Once the goal is achieved, it sets the quota zero, so effectively makes the scheme be deactivated. Link: https://lkml.kernel.org/r/20260310010529.91162-4-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 54419bbd0ee3c7fb7f3c1e3e117f0b8d15d7a896 Author: SeongJae Park Date: Mon Mar 9 18:05:18 2026 -0700 mm/damon/core: allow quota goals set zero effective size quota User-explicit quotas (size and time quotas) having zero value means the quotas are unset. And, effective size quota is set as the minimum value of the explicit quotas. When quota goals are set, the goal-based quota tuner can make it lower. But the existing only single tuner never sets the effective size quota zero. Because of the fact, DAMON core assumes zero effective quota means the user has set no quota. Multiple tuners are now allowed, though. In the future, some tuners might want to set a zero effective size quota. There is no reason to restrict that. Meanwhile, because of the current implementation, it will only deactivate all quotas and make the scheme work at its full speed. Introduce a dedicated function for checking if no quota is set. The function checks the fact by showing if the user-set explicit quotas are zero and no goal is installed. It is decoupled from zero effective quota, and hence allows future tuners set zero effective quota for intentionally deactivating the scheme by a purpose. Link: https://lkml.kernel.org/r/20260310010529.91162-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 8719c59c4b928fc9ad8d8f45ecbdf859660c904c Author: SeongJae Park Date: Mon Mar 9 18:05:17 2026 -0700 mm/damon/core: introduce damos_quota_goal_tuner Patch series "mm/damon: support multiple goal-based quota tuning algorithms". Aim-oriented DAMOS quota auto-tuning uses a single tuning algorithm. The algorithm is designed to find a quota value that should be consistently kept for achieving the aimed goal for long term. It is useful and reliable at automatically operating systems that have dynamic environments in the long term. As always, however, no single algorithm fits all. When the environment has static characteristics or there are control towers in not only the kernel space but also the user space, the algorithm shows some limitations. In such environments, users want kernel work in a more short term deterministic way. Actually there were at least two reports [1,2] of such cases. Extend DAMOS quotas goal to support multiple quota tuning algorithms that users can select. Keep the current algorithm as the default one, to not break the old users. Also give it a name, "consist", as it is designed to "consistently" apply the DAMOS action. And introduce a new tuning algorithm, namely "temporal". It is designed to apply the DAMOS action only temporally, in a deterministic way. In more detail, as long as the goal is under-achieved, it uses the maximum quota available. Once the goal is over-achieved, it sets the quota zero. Tests ===== I confirmed the feature is working as expected using the latest version of DAMON user-space tool, like below. $ # start DAMOS for reclaiming memory aiming 30% free memory $ sudo ./damo/damo start --damos_action pageout \ --damos_quota_goal_tuner temporal \ --damos_quota_goal node_mem_free_bp 30% 0 \ --damos_quota_interval 1s \ --damos_quota_space 100M Note that >=3.1.8 version of DAMON user-space tool supports this feature (--damos_quota_goal_tuner). As expected, DAMOS stops reclaiming memory as soon as the goal amount of free memory is made. When 'consist' tuner is used, the reclamation was continued even after the goal amount of free memory is made, resulting in more than goal amount of free memory, as expected. Patch Sequence ============== First four patches implement the features. Patch 1 extends core API to allow multiple tuners and make the current tuner as the default and only available tuner, namely 'consist'. Patch 2 allows future tuners setting zero effective quota. Patch 3 introduces the second tuner, namely 'temporal'. Patch 4 further extends DAMON sysfs API to let users use that. Three following patches (patches 5-7) update design, usage, and ABI documents, respectively. Final four patches (patches 8-11) are for adding tests. The eighth patch (patch 8) extends the kunit test for online parameters commit for validating the goal_tuner. The ninth and the tenth patches (patches 9-10) extend the testing-purpose DAMON sysfs control helper and DAMON status dumping tool to support the newly added feature. The final eleventh one (patch 11) extends the existing online commit selftest to cover the new feature. This patch (of 11): DAMOS quota goal feature utilizes a single feedback loop based algorithm for automatic tuning of the effective quota. It is useful in dynamic environments that operate systems with only kernels in the long term. But, no one fits all. It is not very easy to control in environments having more controlled characteristics and user-space control towers. We actually got multiple reports [1,2] of use cases that the algorithm is not optimal. Introduce a new field of 'struct damos_quotas', namely 'goal_tuner'. It specifies what tuning algorithm the given scheme should use, and allows DAMON API callers to set it as they want. Nonetheless, this commit introduces no new tuning algorithm but only the interface. This commit hence makes no behavioral change. A new algorithm will be added by the following commit. Link: https://lkml.kernel.org/r/20260310010529.91162-2-sj@kernel.org Link: https://lore.kernel.org/CALa+Y17__d=ZsM1yX+MXx0ozVdsXnFqF4p0g+kATEitrWyZFfg@mail.gmail.com [1] Link: https://lore.kernel.org/20260204022537.814-1-yunjeong.mun@sk.com [2] Signed-off-by: SeongJae Park Cc: Shuah Khan Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 86e69c020b62ee109e10db0ae53ba97f3465df8e Author: Hui Zhu Date: Tue Mar 10 09:56:57 2026 +0800 mm/swap: strengthen locking assertions and invariants in cluster allocation swap_cluster_alloc_table() requires several locks to be held by its callers: ci->lock, the per-CPU swap_cluster lock, and, for non-solid-state devices (non-SWP_SOLIDSTATE), the si->global_cluster_lock. While most call paths (e.g., via cluster_alloc_swap_entry() or alloc_swap_scan_list()) correctly acquire these locks before invocation, the path through swap_reclaim_work() -> swap_reclaim_full_clusters() -> isolate_lock_cluster() is distinct. This path operates exclusively on si->full_clusters, where the swap allocation tables are guaranteed to be already allocated. Consequently, isolate_lock_cluster() should never trigger a call to swap_cluster_alloc_table() for these clusters. Strengthen the locking and state assertions to formalize these invariants: 1. Add a lockdep_assert_held() for si->global_cluster_lock in swap_cluster_alloc_table() for non-SWP_SOLIDSTATE devices. 2. Reorder existing lockdep assertions in swap_cluster_alloc_table() to match the actual lock acquisition order (per-CPU lock, then global lock, then cluster lock). 3. Add a VM_WARN_ON_ONCE() in isolate_lock_cluster() to ensure that table allocations are only attempted for clusters being isolated from the free list. Attempting to allocate a table for a cluster from other lists (like the full list during reclaim) indicates a violation of subsystem invariants. These changes ensure locking consistency and help catch potential synchronization or logic issues during development. [zhuhui@kylinos.cn: remove redundant comment, per Barry] Link: https://lkml.kernel.org/r/20260311022241.177801-1-hui.zhu@linux.dev [zhuhui@kylinos.cn: initialize `flags', per Chris] Link: https://lkml.kernel.org/r/20260312023024.903143-1-hui.zhu@linux.dev Link: https://lkml.kernel.org/r/20260310015657.42395-1-hui.zhu@linux.dev Signed-off-by: Hui Zhu Reviewed-by: Youngjun Park Reviewed-by: Barry Song Acked-by: Chris Li Cc: Baoquan He Cc: Kairui Song Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit d239462787b072c78eb19fc1f155c3d411256282 Author: Anthony Yznaga Date: Tue Mar 10 08:58:20 2026 -0700 mm: prevent droppable mappings from being locked Droppable mappings must not be lockable. There is a check for VMAs with VM_DROPPABLE set in mlock_fixup() along with checks for other types of unlockable VMAs which ensures this when calling mlock()/mlock2(). For mlockall(MCL_FUTURE), the check for unlockable VMAs is different. In apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set, the current task's mm's default VMA flag field mm->def_flags has VM_LOCKED applied to it. VM_LOCKONFAULT is also applied if MCL_ONFAULT is also set. When these flags are set as default in this manner they are cleared in __mmap_complete() for new mappings that do not support mlock. A check for VM_DROPPABLE in __mmap_complete() is missing resulting in droppable mappings created with VM_LOCKED set. To fix this and reduce that chance of similar bugs in the future, introduce and use vma_supports_mlock(). Link: https://lkml.kernel.org/r/20260310155821.17869-1-anthony.yznaga@oracle.com Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always lazily freeable mappings") Signed-off-by: Anthony Yznaga Suggested-by: David Hildenbrand Acked-by: David Hildenbrand (Arm) Reviewed-by: Pedro Falcato Reviewed-by: Lorenzo Stoakes (Oracle) Tested-by: Lorenzo Stoakes (Oracle) Cc: Jann Horn Cc: Jason A. Donenfeld Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 301f3922009658ee353b3177bc186a12d36b8dd3 Author: Sergey Senozhatsky Date: Wed Mar 11 17:42:49 2026 +0900 zram: unify and harden algo/priority params handling We have two functions that accept algo= and priority= params - algorithm_params_store() and recompress_store(). This patch unifies and hardens handling of those parameters. There are 4 possible cases: - only priority= provided [recommended] We need to verify that provided priority value is within permitted range for each particular function. - both algo= and priority= provided We cannot prioritize one over another. All we should do is to verify that zram is configured in the way that user-space expects it to be. Namely that zram indeed has compressor algo= setup at given priority=. - only algo= provided [not recommended] We should lookup priority in compressors list. - none provided [not recommended] Just use function's defaults. Link: https://lkml.kernel.org/r/20260311084312.1766036-7-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Suggested-by: Minchan Kim Cc: Brian Geffon Cc: gao xu Cc: Jens Axboe Signed-off-by: Andrew Morton commit cedfa028b54e584532026888dec94039b62b3d1f Author: Sergey Senozhatsky Date: Wed Mar 11 17:42:48 2026 +0900 zram: remove chained recompression Chained recompression has unpredictable behavior and is not useful in practice. First, systems usually configure just one alternative recompression algorithm, which has slower compression/decompression but better compression ratio. A single alternative algorithm doesn't need chaining. Second, even with multiple recompression algorithms, chained recompression is suboptimal. If a lower priority algorithm succeeds, the page is never attempted with a higher priority algorithm, leading to worse memory savings. If a lower priority algorithm fails, the page is still attempted with a higher priority algorithm, wasting resources on the failed lower priority attempt. In either case, the system would be better off targeting a specific priority directly. Chained recompression also significantly complicates the code. Remove it. Link: https://lkml.kernel.org/r/20260311084312.1766036-6-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Cc: Brian Geffon Cc: gao xu Cc: Jens Axboe Cc: Minchan Kim Signed-off-by: Andrew Morton commit be5f13d94846e8207c9aac0180b13ce1f762e1b1 Author: Sergey Senozhatsky Date: Wed Mar 11 17:42:47 2026 +0900 zram: update recompression documentation Emphasize usage of the `priority` parameter for recompression and explain why `algo` parameter can lead to unexpected behavior and thus is not recommended. Link: https://lkml.kernel.org/r/20260311084312.1766036-5-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Cc: Brian Geffon Cc: gao xu Cc: Jens Axboe Cc: Minchan Kim Signed-off-by: Andrew Morton commit 5004a27edba5987bd75fe84c40b1b486ffae8f99 Author: Sergey Senozhatsky Date: Wed Mar 11 17:42:46 2026 +0900 zram: drop ->num_active_comps It's not entirely correct to use ->num_active_comps for max-prio limit, as ->num_active_comps just tells the number of configured algorithms, not the max configured priority. For instance, in the following theoretical example: [lz4] [nil] [nil] [deflate] ->num_active_comps is 2, while the actual max-prio is 3. Drop ->num_active_comps and use ZRAM_MAX_COMPS instead. Link: https://lkml.kernel.org/r/20260311084312.1766036-4-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Suggested-by: Minchan Kim Cc: Brian Geffon Cc: gao xu Cc: Jens Axboe Signed-off-by: Andrew Morton commit ed19b9d5504f3f7adb68ad8d8db96c390c8570e5 Author: Sergey Senozhatsky Date: Wed Mar 11 17:42:45 2026 +0900 zram: do not autocorrect bad recompression parameters Do not silently autocorrect bad recompression priority parameter value and just error out. Link: https://lkml.kernel.org/r/20260311084312.1766036-3-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Suggested-by: Minchan Kim Cc: Brian Geffon Cc: gao xu Cc: Jens Axboe Signed-off-by: Andrew Morton commit 241f9005b1c81c2637eef2c836a03c83b4f3eeb9 Author: Sergey Senozhatsky Date: Wed Mar 11 17:42:44 2026 +0900 zram: do not permit params change after init Patch series "zram: recompression cleanups and tweaks", v2. This series is a somewhat random mix of fixups, recompression cleanups and improvements partly based on internal conversations. A few patches in the series remove unexpected or confusing behaviour, e.g. auto correction of bad priority= param for recompression, which should have always been just an error. Then it also removes "chain recompression" which has a tricky, unexpected and confusing behaviour at times. We also unify and harden the handling of algo/priority params. There is also an addition of missing device lock in algorithm_params_store() which previously permitted modification of algo params while the device is active. This patch (of 6): First, algorithm_params_store(), like any sysfs handler, should grab device lock. Second, like any write() sysfs handler, it should grab device lock in exclusive mode. Third, it should not permit change of algos' parameters after device init, as this doesn't make sense - we cannot compress with one C/D dict and then just change C/D dict to a different one, for example. Another thing to notice is that algorithm_params_store() accesses device's ->comp_algs for algo priority lookup, which should be protected by device lock in exclusive mode in general. Link: https://lkml.kernel.org/r/20260311084312.1766036-1-senozhatsky@chromium.org Link: https://lkml.kernel.org/r/20260311084312.1766036-2-senozhatsky@chromium.org Fixes: 4eac932103a5 ("zram: introduce algorithm_params device attribute") Signed-off-by: Sergey Senozhatsky Acked-by: Brian Geffon Cc: gao xu Cc: Jens Axboe Cc: Minchan Kim Signed-off-by: Andrew Morton commit 22bdab8e98b7039e4cebd954bcf0c809422ebc0d Author: Pratyush Yadav Date: Mon Mar 9 12:34:07 2026 +0000 kho: drop restriction on maximum page order KHO currently restricts the maximum order of a restored page to the maximum order supported by the buddy allocator. While this works fine for much of the data passed across kexec, it is possible to have pages larger than MAX_PAGE_ORDER. For one, it is possible to get a larger order when using kho_preserve_pages() if the number of pages is large enough, since it tries to combine multiple aligned 0-order preservations into one higher order preservation. For another, upcoming support for hugepages can have gigantic hugepages being preserved over KHO. There is no real reason for this limit. The KHO preservation machinery can handle any page order. Remove this artificial restriction on max page order. Link: https://lkml.kernel.org/r/20260309123410.382308-2-pratyush@kernel.org Signed-off-by: Pratyush Yadav Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Pasha Tatashin Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 91e74fa8b1bc1e44612cb677a710edce2061b6a7 Author: Pratyush Yadav (Google) Date: Mon Mar 9 12:34:06 2026 +0000 kho: make sure preservations do not span multiple NUMA nodes The KHO restoration machinery is not capable of dealing with preservations that span multiple NUMA nodes. kho_preserve_folio() guarantees the preservation will only span one NUMA node since folios can't span multiple nodes. This leaves kho_preserve_pages(). While semantically kho_preserve_pages() only deals with 0-order pages, so all preservations should be single page only, in practice it combines preservations to higher orders for efficiency. This can result in a preservation spanning multiple nodes. Break up the preservations into a smaller order if that happens. Link: https://lkml.kernel.org/r/20260309123410.382308-1-pratyush@kernel.org Signed-off-by: Pratyush Yadav (Google) Suggested-by: Pasha Tatashin Reviewed-by: Samiullah Khawaja Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 396042fb2b834a8fbcea9c850dbbd4ae7c7b75a9 Author: David Hildenbrand (Arm) Date: Mon Mar 9 16:19:01 2026 +0100 KVM: PPC: remove hugetlb.h inclusion hugetlb.h is no longer required now that we moved vma_kernel_pagesize() to mm.h. Link: https://lkml.kernel.org/r/20260309151901.123947-5-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Ritesh Harjani Cc: "Christophe Leroy (CS GROUP)" Cc: Dan Williams Cc: Jann Horn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Muchun Song Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Pedro Falcato Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit e8301b6adcc42132225b9f8a58f587c0f6d962cf Author: David Hildenbrand (Arm) Date: Mon Mar 9 16:19:00 2026 +0100 KVM: remove hugetlb.h inclusion hugetlb.h is no longer required now that we moved vma_kernel_pagesize() to mm.h. Link: https://lkml.kernel.org/r/20260309151901.123947-4-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: Mike Rapoport (Microsoft) Cc: "Christophe Leroy (CS GROUP)" Cc: Dan Williams Cc: Jann Horn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Muchun Song Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Pedro Falcato Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit a9496e9e4b7c5785e82000a26b1118b4a1fd85c7 Author: David Hildenbrand (Arm) Date: Mon Mar 9 16:18:59 2026 +0100 mm: move vma_mmu_pagesize() from hugetlb to vma.c vma_mmu_pagesize() is also queried on non-hugetlb VMAs and does not really belong into hugetlb.c. PPC64 provides a custom overwrite with CONFIG_HUGETLB_PAGE, see arch/powerpc/mm/book3s64/slice.c, so we cannot easily make this a static inline function. So let's move it to vma.c and add some proper kerneldoc. To make vma tests happy, add a simple vma_kernel_pagesize() stub in tools/testing/vma/include/custom.h. Link: https://lkml.kernel.org/r/20260309151901.123947-3-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: Mike Rapoport (Microsoft) Cc: "Christophe Leroy (CS GROUP)" Cc: Dan Williams Cc: Jann Horn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Muchun Song Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Pedro Falcato Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 341ffe82a7a3a1e0756b58999405b6df0c2b3e8d Author: David Hildenbrand (Arm) Date: Mon Mar 9 16:18:58 2026 +0100 mm: move vma_kernel_pagesize() from hugetlb to mm.h Patch series "mm: move vma_(kernel|mmu)_pagesize() out of hugetlb.c", v2. Looking into vma_(kernel|mmu)_pagesize(), I realized that there is one scenario where DAX would not do the right thing when the kernel is not compiled with hugetlb support. Without hugetlb support, vma_(kernel|mmu)_pagesize() will always return PAGE_SIZE instead of using the ->pagesize() result provided by dax-device code. Fix that by moving vma_kernel_pagesize() to core MM code, where it belongs. I don't think this is stable material, but am not 100% sure. Also, move vma_mmu_pagesize() while at it. Remove the unnecessary hugetlb.h inclusion from KVM code. This patch (of 4): In the past, only hugetlb had special "vma_kernel_pagesize()" requirements, so it provided its own implementation. In commit 05ea88608d4e ("mm, hugetlbfs: introduce ->pagesize() to vm_operations_struct") we generalized that approach by providing a vm_ops->pagesize() callback to be used by device-dax. Once device-dax started using that callback in commit c1d53b92b95c ("device-dax: implement ->pagesize() for smaps to report MMUPageSize") it was missed that CONFIG_DEV_DAX does not depend on hugetlb support. So building a kernel with CONFIG_DEV_DAX but without CONFIG_HUGETLBFS would not pick up that value. Fix it by moving vma_kernel_pagesize() to mm.h, providing only a single implementation. While at it, improve the kerneldoc a bit. Ideally, we'd move vma_mmu_pagesize() as well to the header. However, its __weak symbol might be overwritten by a PPC variant in hugetlb code. So let's leave it in there for now, as it really only matters for some hugetlb oddities. This was found by code inspection. Link: https://lkml.kernel.org/r/20260309151901.123947-1-david@kernel.org Link: https://lkml.kernel.org/r/20260309151901.123947-2-david@kernel.org Fixes: c1d53b92b95c ("device-dax: implement ->pagesize() for smaps to report MMUPageSize") Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: Mike Rapoport (Microsoft) Cc: Dan Williams Cc: "Christophe Leroy (CS GROUP)" Cc: Jann Horn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Muchun Song Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Paolo Bonzini Cc: Pedro Falcato Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 1eba4c9599fa1de9308d45d289fcb944b4746526 Author: Akinobu Mita Date: Wed Mar 11 00:18:37 2026 +0900 docs: mm: fix typo in numa_memory_policy.rst Fix a typo: MPOL_INTERLEAVED -> MPOL_INTERLEAVE. Link: https://lkml.kernel.org/r/20260310151837.5888-1-akinobu.mita@gmail.com Signed-off-by: Akinobu Mita Reviewed-by: Andrew Morton Acked-by: SeongJae Park Signed-off-by: Andrew Morton commit a4e82de81fe59d5bfcc9450145e8e108561f2e07 Author: SeongJae Park Date: Sat Mar 7 11:53:55 2026 -0800 Docs/mm/damon/index: fix typo: autoamted -> automated There is an obvious typo. Fix it (s/autoamted/automated/). Link: https://lkml.kernel.org/r/20260307195356.203753-8-sj@kernel.org Fixes: 32d11b320897 ("Docs/mm/damon/index: simplify the intro") Signed-off-by: SeongJae Park Acked-by: wang lian Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 20675fc8c02217c8bea5c7a0aedec29e5c4fb426 Author: SeongJae Park Date: Sat Mar 7 11:53:54 2026 -0800 Docs/mm/damon/maintainer-profile: use flexible review cadence The document mentions the maitainer is working in the usual 9-5 fashion. The maintainer nowadays prefers working in a more flexible way. Update the document to avoid contributors having a wrong time expectation. Link: https://lkml.kernel.org/r/20260307195356.203753-7-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: wang lian Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d7f00084f6863a243b396200c81e83ae302c5a76 Author: SeongJae Park Date: Sat Mar 7 11:53:53 2026 -0800 Docs/admin-guide/mm/damn/lru_sort: fix intervals autotune parameter name The section name should be the same as the parameter name. Fix it. Link: https://lkml.kernel.org/r/20260307195356.203753-6-sj@kernel.org Fixes: ed581147a417 ("Docs/admin-guide/mm/damon/lru_sort: document intervals autotuning") Signed-off-by: SeongJae Park Acked-by: wang lian Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3802e1d98e92ca6abdd25446b802f405fef83da0 Author: SeongJae Park Date: Sat Mar 7 11:53:52 2026 -0800 mm/damon: document non-zero length damon_region assumption DAMON regions are assumed to always be non-zero length. There was a confusion [1] about it, probably due to lack of the documentation. Document it. Link: https://lkml.kernel.org/r/20260307195356.203753-5-sj@kernel.org Link: https://lore.kernel.org/20251231070029.79682-1-sj@kernel.org/ [1] Signed-off-by: SeongJae Park Acked-by: wang lian Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2a5f4454e00e630a3535b851fbe4f6e5d228cc5a Author: SeongJae Park Date: Sat Mar 7 11:53:51 2026 -0800 mm/damon/core: clarify damon_set_attrs() usages damon_set_attrs() is called for multiple purposes from multiple places. Calling it in an unsafe context can make DAMON internal state polluted and results in unexpected behaviors. Clarify when it is safe, and where it is being called. Link: https://lkml.kernel.org/r/20260307195356.203753-4-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: wang lian Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit fd83b0d1c49b7e52bdcd8704df04fdbae0c24194 Author: SeongJae Park Date: Sat Mar 7 11:53:50 2026 -0800 mm/damon/tests/core-kunit: add a test for damon_is_last_region() There was a bug [1] in damon_is_last_region(). Add a kunit test to not reintroduce the bug. Link: https://lkml.kernel.org/r/20260307195356.203753-3-sj@kernel.org Link: https://lore.kernel.org/20260114152049.99727-1-sj@kernel.org/ [1] Signed-off-by: SeongJae Park Tested-by: wang lian Reviewed-by: wang lian Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 5d6a520aff230c78df202a90429bc6fce2a11791 Author: SeongJae Park Date: Sat Mar 7 11:53:49 2026 -0800 mm/damon/core: use mult_frac() Patch series "mm/damon: improve/fixup/update ratio calculation, test and documentation". Yet another batch of misc/minor improvements and fixups. Use mult_frac() instead of the worse open-coding for rate calculations (patch 1). Add a test for a previously found and fixed bug (patch 2). Improve and update comments and documentations for easier code review and up-to-date information (patches 3-6). Finally, fix an obvious typo (patch 7). This patch (of 7): There are multiple places in core code that do open-code rate calculations. Use mult_frac(), which is developed for doing that in a way more safe from overflow and precision loss. Link: https://lkml.kernel.org/r/20260307195356.203753-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260307195356.203753-2-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: wang lian Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 23754a36cd1ce888a136c762080c89e4d7b364d9 Author: SeongJae Park Date: Sat Mar 7 11:49:14 2026 -0800 mm/damon/core: use time_after_eq() in kdamond_fn() damon_ctx->passed_sample_intervals and damon_ctx->next_*_sis are unsigned long. Those are compared in kdamond_fn() using normal comparison operators. It is unsafe from overflow. Use time_after_eq(), which is safe from overflows when correctly used, instead. Link: https://lkml.kernel.org/r/20260307194915.203169-4-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit f05e253637837b603682173ed6bd0bc873dc0496 Author: SeongJae Park Date: Sat Mar 7 11:49:13 2026 -0800 mm/damon/core: use time_before() for next_apply_sis damon_ctx->passed_sample_intervals and damos->next_apply_sis are unsigned long, and compared via normal comparison operators. It is unsafe from overflow. Use time_before(), which is safe from overflow when correctly used, instead. Link: https://lkml.kernel.org/r/20260307194915.203169-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 7e6c650fdbdb76bb6db74d3af025b7327707e6a0 Author: SeongJae Park Date: Sat Mar 7 11:49:12 2026 -0800 mm/damon/core: remove damos_set_next_apply_sis() duplicates Patch series "mm/damon/core: make passed_sample_intervals comparisons overflow-safe". DAMON accounts time using its own jiffies-like time counter, namely damon_ctx->passed_sample_intervals. The counter is incremented on each iteration of kdamond_fn() main loop, which sleeps at least one sample interval. Hence the name is like that. DAMON has time-periodic operations including monitoring results aggregation and DAMOS action application. DAMON sets the next time to do each of such operations in the passed_sample_intervals unit. And it does the operation when the counter becomes the same to or larger than the pre-set values, and update the next time for the operation. Note that the operation is done not only when the values exactly match but also when the time is passed, because the values can be updated for online-committed DAMON parameters. The counter is 'unsigned long' type, and the comparison is done using normal comparison operators. It is not safe from overflows. This can cause rare and limited but odd situations. Let's suppose there is an operation that should be executed every 20 sampling intervals, and the passed_sample_intervals value for next execution of the operation is ULONG_MAX - 3. Once the passed_sample_intervals reaches ULONG_MAX - 3, the operation will be executed, and the next time value for doing the operation becomes 17 (ULONG_MAX - 3 + 20), since overflow happens. In the next iteration of the kdamond_fn() main loop, passed_sample_intervals is larger than the next operation time value, so the operation will be executed again. It will continue executing the operation for each iteration, until the passed_sample_intervals also overflows. Note that this will not be common and problematic in the real world. The sampling interval, which takes for each passed_sample_intervals increment, is 5 ms by default. And it is usually [auto-]tuned for hundreds of milliseconds. That means it takes about 248 days or 4,971 days to have the overflow on 32 bit machines when the sampling interval is 5 ms and 100 ms, respectively (1<<32 * sampling_interval_in_seconds / 3600 / 24). On 64 bit machines, the numbers become 2924712086.77536 and 58494241735.5072 years. So the real user impact is negligible. But still this is better to be fixed as long as the fix is simple and efficient. Fix this by simply replacing the overflow-unsafe native comparison operators with the existing overflow-safe time comparison helpers. The first patch only cleans up the next DAMOS action application time setup for consistency and reduced code. The second and the third patches update DAMOS action application time setup and rest, respectively. This patch (of 3): There is a function for damos->next_apply_sis setup. But some places are open-coding it. Consistently use the helper. Link: https://lkml.kernel.org/r/20260307194915.203169-2-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit bfb1523cde1bf925822ec8783e45055a0c599860 Author: SeongJae Park Date: Sat Mar 7 11:42:21 2026 -0800 Docs/mm/damon/design: document the power-of-two limitation for addr_unit The min_region_sz is set as max(DAMON_MIN_REGION_SZ / addr_unit, 1). DAMON_MIN_REGION_SZ is the same to PAGE_SIZE, and addr_unit is what the user can arbitrarily set. Commit c80f46ac228b ("mm/damon/core: disallow non-power of two min_region_sz") made min_region_sz to always be a power of two. Hence, addr_unit should be a power of two when it is smaller than PAGE_SIZE. While 'addr_unit' is a user-exposed parameter, the rule is not documented. This can confuse users. Specifically, if the user sets addr_unit as a value that is smaller than PAGE_SIZE and not a power of two, the setup will explicitly fail. Document the rule on the design document. Usage documents reference the design document for detail, so updating only the design document should suffice. Link: https://lkml.kernel.org/r/20260307194222.202075-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit a260de7d45ea9144645748b1c54896dea6f79655 Author: SeongJae Park Date: Sat Mar 7 11:42:20 2026 -0800 mm/damon/tests/core-kunit: add a test for damon_commit_ctx() Patch series "mm/damon: test and document power-of-2 min_region_sz requirement". Since commit c80f46ac228b ("mm/damon/core: disallow non-power of two min_region_sz"), min_region_sz is always restricted to be a power of two. Add a kunit test to confirm the functionality. Also, the change adds a restriction to addr_unit parameter. Clarify it on the document. This patch (of 2): Add a kunit test for confirming the change that is made on commit c80f46ac228b ("mm/damon/core: disallow non-power of two min_region_sz") functions as expected. Link: https://lkml.kernel.org/r/20260307194222.202075-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: SeongJae Park Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 300252ebb116e8f9908a5f52203984b1bc15cc78 Author: SeongJae Park Date: Fri Mar 6 07:29:13 2026 -0800 selftests/damon/config: enable DAMON_DEBUG_SANITY CONFIG_DAMON_DEBUG_SANITY is recommended for DAMON development and test setups. Enable it on the build config for DAMON selftests. Link: https://lkml.kernel.org/r/20260306152914.86303-11-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Shuah Khan Signed-off-by: Andrew Morton commit 09cbdf7dbe2334d32853ad3ba3b54df017d7a37b Author: SeongJae Park Date: Fri Mar 6 07:29:12 2026 -0800 mm/damon/tests/.kunitconifg: enable DAMON_DEBUG_SANITY CONFIG_DAMON_DEBUG_SANITY is recommended for DAMON development and test setups. Enable it on the default configurations for DAMON kunit test run. Link: https://lkml.kernel.org/r/20260306152914.86303-10-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Shuah Khan Signed-off-by: Andrew Morton commit c556187b6e247b5d817b4392fe2ba6d299515795 Author: SeongJae Park Date: Fri Mar 6 07:29:11 2026 -0800 mm/damon/core: add damon_reset_aggregated() debug_sanity check At time of damon_reset_aggregated(), aggregation of the interval should be completed, and hence nr_accesses and nr_accesses_bp should match. I found a few bugs caused it to be broken in the past, from online parameters update and complicated nr_accesses handling changes. Add a sanity check for that under CONFIG_DAMON_DEBUG_SANITY. Link: https://lkml.kernel.org/r/20260306152914.86303-9-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Shuah Khan Signed-off-by: Andrew Morton commit 6aa1f783547896df3db1cf3dc5198f03df5ce775 Author: SeongJae Park Date: Fri Mar 6 07:29:10 2026 -0800 mm/damon/core: add damon_split_region_at() debug_sanity check damon_split_region_at() should be called with the correct address to split on. Add a sanity check for that under CONFIG_DAMON_DEBUG_SANITY. Link: https://lkml.kernel.org/r/20260306152914.86303-8-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Shuah Khan Signed-off-by: Andrew Morton commit c070da23913f66b7c08340a137622ba2f2203616 Author: SeongJae Park Date: Fri Mar 6 07:29:09 2026 -0800 mm/damon/core: add damon_merge_regions_of() debug_sanity check damon_merge_regions_of() should be called only after aggregation is finished and therefore each region's nr_accesses and nr_accesses_bp match. There were bugs that broke the assumption, during development of online DAMON parameter updates and monitoring results handling changes. Add a sanity check for that under CONFIG_DAMON_DEBUG_SANITY. Link: https://lkml.kernel.org/r/20260306152914.86303-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Shuah Khan Signed-off-by: Andrew Morton commit 0bb7682fdb533be8412e5678eab246144d855138 Author: SeongJae Park Date: Fri Mar 6 07:29:08 2026 -0800 mm/damon/core: add damon_merge_two_regions() debug_sanity check A data corruption could cause damon_merge_two_regions() creating zero length DAMON regions. Add a sanity check for that under CONFIG_DAMON_DEBUG_SANITY. Link: https://lkml.kernel.org/r/20260306152914.86303-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Shuah Khan Signed-off-by: Andrew Morton commit 242a764abe149f297273be18fdb66cfeaf27dec2 Author: SeongJae Park Date: Fri Mar 6 07:29:07 2026 -0800 mm/damon/core: add damon_nr_regions() debug_sanity check damon_target->nr_regions is introduced to get the number quickly without having to iterate regions always. Add a sanity check for that under CONFIG_DAMON_DEBUG_SANITY. Link: https://lkml.kernel.org/r/20260306152914.86303-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Shuah Khan Signed-off-by: Andrew Morton commit 9a647920d03d9da5ca4868d853a8f9267de1e070 Author: SeongJae Park Date: Fri Mar 6 07:29:06 2026 -0800 mm/damon/core: add damon_del_region() debug_sanity check damon_del_region() should be called for targets that have one or more regions. Add a sanity check for that under CONFIG_DAMON_DEBUG_SANITY. Link: https://lkml.kernel.org/r/20260306152914.86303-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Shuah Khan Signed-off-by: Andrew Morton commit b0264a951ced68313cbbd9f679c907a741004b58 Author: SeongJae Park Date: Fri Mar 6 07:29:05 2026 -0800 mm/damon/core: add damon_new_region() debug_sanity check damon_new_region() is supposed to be called with only valid address range arguments. Do the check under DAMON_DEBUG_SANITY. Link: https://lkml.kernel.org/r/20260306152914.86303-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Shuah Khan Signed-off-by: Andrew Morton commit 62f058287558af11f6d1af3d7597ff8599998b43 Author: SeongJae Park Date: Fri Mar 6 07:29:04 2026 -0800 mm/damon: add CONFIG_DAMON_DEBUG_SANITY Patch series "mm/damon: add optional debugging-purpose sanity checks". DAMON code has a few assumptions that can be critical if violated. Validating the assumptions in code can be useful at finding such critical bugs. I was actually adding some such additional sanity checks in my personal tree, and those were useful at finding bugs that I made during the development of new patches. We also found [1] sometimes the assumptions are misunderstood. The validation can work as good documentation for such cases. Add some of such debugging purpose sanity checks. Because those additional checks can impose more overhead, make those only optional via new config, CONFIG_DAMON_DEBUG_SANITY, that is recommended for only development and test setups. And as recommended, enable it for DAMON kunit tests and selftests. Note that the verification only WARN_ON() for each of the insanity. The developer or tester may better to set panic_on_oops together, like damon-tests/corr did [2]. This patch (of 10): Add a new build config that will enable additional DAMON sanity checks. It is recommended to be enabled on only development and test setups, since it can impose additional overhead. Link: https://lkml.kernel.org/r/20260306152914.86303-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260306152914.86303-2-sj@kernel.org Link: https://lore.kernel.org/20251231070029.79682-1-sj@kernel.org [1] Link: https://github.com/damonitor/damon-tests/commit/a80fbee55e272f151b4e5809ee85898aea33e6ff [2] Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Shuah Khan Signed-off-by: Andrew Morton commit 5a14198ec63c130b7377911d3cf99c93547d5fb8 Author: Usama Arif Date: Mon Mar 9 14:25:02 2026 -0700 mm/migrate_device: document folio_get requirement before frozen PMD split split_huge_pmd_address() with freeze=true splits a PMD migration entry into PTE migration entries, consuming one folio reference in the process. The folio_get() before it provides this reference. Add a comment explaining this relationship. The expected folio refcount at the start of migrate_vma_split_unmapped_folio() is 1. Link: https://lkml.kernel.org/r/20260309212502.3922825-1-usama.arif@linux.dev Signed-off-by: Usama Arif Suggested-by: Zi Yan Reviewed-by: Zi Yan Reviewed-by: Nico Pache Acked-by: David Hildenbrand (Arm) Reviewed-by: Wei Yang Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Johannes Weiner Cc: Joshua Hahn Cc: Matthew Brost Cc: Rakie Kim Cc: Ying Huang Signed-off-by: Andrew Morton commit d7651089939bf00fe033845e662905ce750b1f18 Author: Arnd Bergmann Date: Fri Mar 6 16:05:49 2026 +0100 ubsan: turn off kmsan inside of ubsan instrumentation The structure initialization in the two type mismatch handling functions causes a call to __msan_memset() to be generated inside of a UACCESS block, which in turn leads to an objtool warning about possibly leaking uaccess-enabled state: lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch+0xda: call to __msan_memset() with UACCESS enabled lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch_v1+0xf4: call to __msan_memset() with UACCESS enabled Most likely __msan_memset() is safe to be called here and could be added to the uaccess_safe_builtin[] list of safe functions, but seeing that the ubsan file itself already has kasan, ubsan and kcsan disabled itself, it is probably a good idea to also turn off kmsan here, in particular this also avoids the risk of recursing between ubsan and kcsan checks in other functions of this file. I saw this happen while testing randconfig builds with clang-22, but did not try older versions, or attempt to see which kernel change introduced the warning. Link: https://lkml.kernel.org/r/20260306150613.350029-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Acked-by: Andrey Ryabinin Cc: Kees Cook Cc: Marco Elver Cc: Andrey Konovalov Cc: Bill Wendling Cc: Justin Stitt Cc: Nathan Chancellor Cc: Peter Zijlstra Signed-off-by: Andrew Morton commit db359fccf212e7fa3136e6edbed6228475646fd7 Author: Byungchul Park Date: Tue Feb 24 14:13:47 2026 +0900 mm: introduce a new page type for page pool in page type Currently, the condition 'page->pp_magic == PP_SIGNATURE' is used to determine if a page belongs to a page pool. However, with the planned removal of @pp_magic, we should instead leverage the page_type in struct page, such as PGTY_netpp, for this purpose. Introduce and use the page type APIs e.g. PageNetpp(), __SetPageNetpp(), and __ClearPageNetpp() instead, and remove the existing APIs accessing @pp_magic e.g. page_pool_page_is_pp(), netmem_or_pp_magic(), and netmem_clear_pp_magic(). Plus, add @page_type to struct net_iov at the same offset as struct page so as to use the page_type APIs for struct net_iov as well. While at it, reorder @type and @owner in struct net_iov to avoid a hole and increasing the struct size. This work was inspired by the following link: https://lore.kernel.org/all/582f41c0-2742-4400-9c81-0d46bf4e8314@gmail.com/ While at it, move the sanity check for page pool to on the free path. [byungchul@sk.com: gate the sanity check, per Johannes] Link: https://lkml.kernel.org/r/20260316223113.20097-1-byungchul@sk.com Link: https://lkml.kernel.org/r/20260224051347.19621-1-byungchul@sk.com Co-developed-by: Pavel Begunkov Signed-off-by: Pavel Begunkov Signed-off-by: Byungchul Park Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Acked-by: Zi Yan Acked-by: Vlastimil Babka Reviewed-by: Toke Høiland-Jørgensen Acked-by: Mike Rapoport (Microsoft) Acked-by: Johannes Weiner Acked-by: Jakub Kicinski Acked-by: Jesper Dangaard Brouer Acked-by: Ilias Apalodimas Cc: Alexei Starovoitov Cc: Andrew Lunn Cc: Baolin Wang Cc: Brendan Jackman Cc: Christian Brauner Cc: Daniel Borkmann Cc: David S. Miller Cc: David Wei Cc: Dragos Tatulea Cc: Eric Dumazet Cc: John Fastabend Cc: Leon Romanovsky Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Mark Bloch Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mina Almasry Cc: Paolo Abeni Cc: Saeed Mahameed Cc: Simon Horman Cc: Stanislav Fomichev Cc: Stehen Rothwell Cc: Suren Baghdasaryan Cc: Taehee Yoo Cc: Tariq Toukan Cc: Usama Arif Cc: Yu Zhao Signed-off-by: Andrew Morton commit 92a9cf97a46b806e7f4e4780724203753093b5b1 Author: Chengkaitao Date: Sun Feb 1 14:35:31 2026 +0800 sparc: use vmemmap_populate_hugepages for vmemmap_populate Change sparc's implementation of vmemmap_populate() using vmemmap_populate_hugepages() to streamline the code. Another benefit is that it allows us to eliminate the external declarations of vmemmap_p?d_populate functions and convert them to static functions. Since vmemmap_populate_hugepages may fallback to vmemmap_populate- _basepages, which differs from sparc's original implementation. During the v1 discussion with Mike Rapoport, sparc uses base pages in the kernel page tables, so it should be able to use them in vmemmap as well. Consequently, no additional special handling is required. 1. In the SPARC architecture, reimplement vmemmap_populate using vmemmap_populate_hugepages. 2. Allow the SPARC arch to fallback to vmemmap_populate_basepages(), when vmemmap_alloc_block returns NULL. Link: https://lkml.kernel.org/r/20260201063532.44807-2-pilgrimtao@gmail.com Signed-off-by: Chengkaitao Tested-by: Andreas Larsson Acked-by: Andreas Larsson Cc: David Hildenbrand Cc: David S. Miller Cc: Kevin Brodsky Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Qi Zheng Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit bc7a2d1b4f0499ceabf9cd4813f118fdbca813f8 Author: Vlastimil Babka (SUSE) Date: Thu Mar 5 09:26:29 2026 +0100 MAINTAINERS: add mm-related procfs files to MM sections Some procfs files are very much related to memory management so let's have MAINTAINERS reflect that. Add fs/proc/meminfo.c to MEMORY MANAGEMENT - CORE. Add fs/proc/task_[no]mmu.c to MEMORY MAPPING. Link: https://lkml.kernel.org/r/20260305-maintainers-proc-v1-1-d6d09b3db3b6@kernel.org Signed-off-by: Vlastimil Babka (SUSE) Acked-by: Lorenzo Stoakes (Oracle) Acked-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand (Arm) Acked-by: SeongJae Park Signed-off-by: Andrew Morton commit 5cfb95f38a684d0e24eb9e4d9b6f7a34328ed837 Author: Lorenzo Stoakes (Oracle) Date: Thu Mar 5 10:50:19 2026 +0000 tools/testing/vma: add test for vma_flags_test(), vma_desc_test() Now we have helpers which test singular VMA flags - vma_flags_test() and vma_desc_test() - add a test to explicitly assert that these behave as expected. [ljs@kernel.org: test_vma_flags_test(): use struct initializer, per David] Link: https://lkml.kernel.org/r/f6f396d2-1ba2-426f-b756-d8cc5985cc7c@lucifer.local Link: https://lkml.kernel.org/r/376a39eb9e134d2c8ab10e32720dd292970b080a.1772704455.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Reviewed-by: Pedro Falcato Cc: Arnd Bergmann Cc: Babu Moger Cc: Baolin Wang Cc: Chao Yu Cc: Chatre, Reinette Cc: Chunhai Guo Cc: Damien Le Maol Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Gao Xiang Cc: Greg Kroah-Hartman Cc: Hongbo Li Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jeffle Xu Cc: Johannes Thumshirn Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naohiro Aota Cc: Oscar Salvador Cc: Sandeep Dhavale Cc: Suren Baghdasaryan Cc: Vishal Verma Cc: Vlastimil Babka Cc: Yue Hu Signed-off-by: Andrew Morton commit 0c2aa6635716a5aa19576deef062efab5322072f Author: Lorenzo Stoakes (Oracle) Date: Thu Mar 5 10:50:18 2026 +0000 mm: reintroduce vma_desc_test() as a singular flag test Similar to vma_flags_test(), we have previously renamed vma_desc_test() to vma_desc_test_any(). Now that is in place, we can reintroduce vma_desc_test() to explicitly check for a single VMA flag. As with vma_flags_test(), this is useful as often flag tests are against a single flag, and vma_desc_test_any(flags, VMA_READ_BIT) reads oddly and potentially causes confusion. As with vma_flags_test() a combination of sparse and vma_flags_t being a struct means that users cannot misuse this function without it getting flagged. Also update the VMA tests to reflect this change. Link: https://lkml.kernel.org/r/3a65ca23defb05060333f0586428fe279a484564.1772704455.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Reviewed-by: Pedro Falcato Cc: Arnd Bergmann Cc: Babu Moger Cc: Baolin Wang Cc: Chao Yu Cc: Chatre, Reinette Cc: Chunhai Guo Cc: Damien Le Maol Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Gao Xiang Cc: Greg Kroah-Hartman Cc: Hongbo Li Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jeffle Xu Cc: Johannes Thumshirn Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naohiro Aota Cc: Oscar Salvador Cc: Sandeep Dhavale Cc: Suren Baghdasaryan Cc: Vishal Verma Cc: Vlastimil Babka Cc: Yue Hu Signed-off-by: Andrew Morton commit 5e6d45d720ca299cc82d84948c4ba622fff64f22 Author: Lorenzo Stoakes (Oracle) Date: Thu Mar 5 10:50:17 2026 +0000 mm: reintroduce vma_flags_test() as a singular flag test Since we've now renamed vma_flags_test() to vma_flags_test_any() to be very clear as to what we are in fact testing, we now have the opportunity to bring vma_flags_test() back, but for explicitly testing a single VMA flag. This is useful, as often flag tests are against a single flag, and vma_flags_test_any(flags, VMA_READ_BIT) reads oddly and potentially causes confusion. We use sparse to enforce that users won't accidentally pass vm_flags_t to this function without it being flagged so this should make it harder to get this wrong. Of course, passing vma_flags_t to the function is impossible, as it is a struct. Also update the VMA tests to reflect this change. Link: https://lkml.kernel.org/r/f33f8d7f16c3f3d286a1dc2cba12c23683073134.1772704455.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Reviewed-by: Pedro Falcato Cc: Arnd Bergmann Cc: Babu Moger Cc: Baolin Wang Cc: Chao Yu Cc: Chatre, Reinette Cc: Chunhai Guo Cc: Damien Le Maol Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Gao Xiang Cc: Greg Kroah-Hartman Cc: Hongbo Li Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jeffle Xu Cc: Johannes Thumshirn Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naohiro Aota Cc: Oscar Salvador Cc: Sandeep Dhavale Cc: Suren Baghdasaryan Cc: Vishal Verma Cc: Vlastimil Babka Cc: Yue Hu Signed-off-by: Andrew Morton commit a5eee1128de526ba199bd4c7be39b849223e5001 Author: Lorenzo Stoakes (Oracle) Date: Thu Mar 5 10:50:16 2026 +0000 mm: always inline __mk_vma_flags() and invoked functions Be explicit about __mk_vma_flags() (which is used by the mk_vma_flags() macro) always being inline, as we rely on the compiler to evaluate the loop in this function and determine that it can replace the code with the an equivalent constant value, e.g. that: __mk_vma_flags(2, (const vma_flag_t []){ VMA_WRITE_BIT, VMA_EXEC_BIT }); Can be replaced with: (1UL << VMA_WRITE_BIT) | (1UL << VMA_EXEC_BIT) = (1UL << 1) | (1UL << 2) = 6 Most likely an 'inline' will suffice for this, but be explicit as we can be. Also update all of the functions __mk_vma_flags() ultimately invokes to be always inline too. Note that test_bitmap_const_eval() asserts that the relevant bitmap functions result in build time constant values. Additionally, vma_flag_set() operates on a vma_flags_t type, so it is inconsistently named versus other VMA flags functions. We only use vma_flag_set() in __mk_vma_flags() so we don't need to worry about its new name being rather cumbersome, so rename it to vma_flags_set_flag() to disambiguate it from vma_flags_set(). Also update the VMA test headers to reflect the changes. Link: https://lkml.kernel.org/r/241f49c52074d436edbb9c6a6662a8dc142a8f43.1772704455.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Reviewed-by: Pedro Falcato Cc: Arnd Bergmann Cc: Babu Moger Cc: Baolin Wang Cc: Chao Yu Cc: Chatre, Reinette Cc: Chunhai Guo Cc: Damien Le Maol Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Gao Xiang Cc: Greg Kroah-Hartman Cc: Hongbo Li Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jeffle Xu Cc: Johannes Thumshirn Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naohiro Aota Cc: Oscar Salvador Cc: Sandeep Dhavale Cc: Suren Baghdasaryan Cc: Vishal Verma Cc: Vlastimil Babka Cc: Yue Hu Signed-off-by: Andrew Morton commit 0b3ed2a495b5c10296d9371502d70ce4398f0c58 Author: Lorenzo Stoakes (Oracle) Date: Thu Mar 5 10:50:15 2026 +0000 mm: add vma_desc_test_all() and use it erofs and zonefs are using vma_desc_test_any() twice to check whether all of VMA_SHARED_BIT and VMA_MAYWRITE_BIT are set, this is silly, so add vma_desc_test_all() to test all flags and update erofs and zonefs to use it. While we're here, update the helper function comments to be more consistent. Also add the same to the VMA test headers. Link: https://lkml.kernel.org/r/568c8f8d6a84ff64014f997517cba7a629f7eed6.1772704455.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Vlastimil Babka (SUSE) Acked-by: David Hildenbrand (Arm) Reviewed-by: Pedro Falcato Cc: Arnd Bergmann Cc: Babu Moger Cc: Baolin Wang Cc: Chao Yu Cc: Chatre, Reinette Cc: Chunhai Guo Cc: Damien Le Maol Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Gao Xiang Cc: Greg Kroah-Hartman Cc: Hongbo Li Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jeffle Xu Cc: Johannes Thumshirn Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naohiro Aota Cc: Oscar Salvador Cc: Sandeep Dhavale Cc: Suren Baghdasaryan Cc: Vishal Verma Cc: Yue Hu Signed-off-by: Andrew Morton commit e650bb30ca532901da6def04c7d1de72ae59ea4e Author: Lorenzo Stoakes (Oracle) Date: Thu Mar 5 10:50:14 2026 +0000 mm: rename VMA flag helpers to be more readable Patch series "mm: vma flag tweaks". The ongoing work around introducing non-system word VMA flags has introduced a number of helper functions and macros to make life easier when working with these flags and to make conversions from the legacy use of VM_xxx flags more straightforward. This series improves these to reduce confusion as to what they do and to improve consistency and readability. Firstly the series renames vma_flags_test() to vma_flags_test_any() to make it abundantly clear that this function tests whether any of the flags are set (as opposed to vma_flags_test_all()). It then renames vma_desc_test_flags() to vma_desc_test_any() for the same reason. Note that we drop the 'flags' suffix here, as vma_desc_test_any_flags() would be cumbersome and 'test' implies a flag test. Similarly, we rename vma_test_all_flags() to vma_test_all() for consistency. Next, we have a couple of instances (erofs, zonefs) where we are now testing for vma_desc_test_any(desc, VMA_SHARED_BIT) && vma_desc_test_any(desc, VMA_MAYWRITE_BIT). This is silly, so this series introduces vma_desc_test_all() so these callers can instead invoke vma_desc_test_all(desc, VMA_SHARED_BIT, VMA_MAYWRITE_BIT). We then observe that quite a few instances of vma_flags_test_any() and vma_desc_test_any() are in fact only testing against a single flag. Using the _any() variant here is just confusing - 'any' of single item reads strangely and is liable to cause confusion. So in these instances the series reintroduces vma_flags_test() and vma_desc_test() as helpers which test against a single flag. The fact that vma_flags_t is a struct and that vma_flag_t utilises sparse to avoid confusion with vm_flags_t makes it impossible for a user to misuse these helpers without it getting flagged somewhere. The series also updates __mk_vma_flags() and functions invoked by it to explicitly mark them always inline to match expectation and to be consistent with other VMA flag helpers. It also renames vma_flag_set() to vma_flags_set_flag() (a function only used by __mk_vma_flags()) to be consistent with other VMA flag helpers. Finally it updates the VMA tests for each of these changes, and introduces explicit tests for vma_flags_test() and vma_desc_test() to assert that they behave as expected. This patch (of 6): On reflection, it's confusing to have vma_flags_test() and vma_desc_test_flags() test whether any comma-separated VMA flag bit is set, while also having vma_flags_test_all() and vma_test_all_flags() separately test whether all flags are set. Firstly, rename vma_flags_test() to vma_flags_test_any() to eliminate this confusion. Secondly, since the VMA descriptor flag functions are becoming rather cumbersome, prefer vma_desc_test*() to vma_desc_test_flags*(), and also rename vma_desc_test_flags() to vma_desc_test_any(). Finally, rename vma_test_all_flags() to vma_test_all() to keep the VMA-specific helper consistent with the VMA descriptor naming convention and to help avoid confusion vs. vma_flags_test_all(). While we're here, also update whitespace to be consistent in helper functions. Link: https://lkml.kernel.org/r/cover.1772704455.git.ljs@kernel.org Link: https://lkml.kernel.org/r/0f9cb3c511c478344fac0b3b3b0300bb95be95e9.1772704455.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Suggested-by: Pedro Falcato Acked-by: David Hildenbrand (Arm) Reviewed-by: Pedro Falcato Cc: Arnd Bergmann Cc: Babu Moger Cc: Baolin Wang Cc: Chao Yu Cc: Chatre, Reinette Cc: Chunhai Guo Cc: Damien Le Maol Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Gao Xiang Cc: Greg Kroah-Hartman Cc: Hongbo Li Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jeffle Xu Cc: Johannes Thumshirn Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naohiro Aota Cc: Oscar Salvador Cc: Sandeep Dhavale Cc: Suren Baghdasaryan Cc: Vishal Verma Cc: Vlastimil Babka Cc: Yue Hu Signed-off-by: Andrew Morton commit caf55fef6141c29c095cb1ef7ba84af08ff16734 Author: Andrey Ryabinin Date: Thu Mar 5 19:56:59 2026 +0100 kasan: fix bug type classification for SW_TAGS mode kasan_non_canonical_hook() derives orig_addr from kasan_shadow_to_mem(), but the pointer tag may remain in the top byte. In SW_TAGS mode this tagged address is compared against PAGE_SIZE and TASK_SIZE, which leads to incorrect bug classification. As a result, NULL pointer dereferences may be reported as "wild-memory-access". Strip the tag before performing these range checks and use the untagged value when reporting addresses in these ranges. Before: [ ] Unable to handle kernel paging request at virtual address ffef800000000000 [ ] KASAN: maybe wild-memory-access in range [0xff00000000000000-0xff0000000000000f] After: [ ] Unable to handle kernel paging request at virtual address ffef800000000000 [ ] KASAN: null-ptr-deref in range [0x0000000000000000-0x000000000000000f] Link: https://lkml.kernel.org/r/20260305185659.20807-1-ryabinin.a.a@gmail.com Signed-off-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Maciej Wieczor-Retman Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit d9f74cfb5a9b06d287e855f4c388db1eb40f91e3 Author: Bing Jiao Date: Tue Mar 3 05:25:17 2026 +0000 mm/vmscan: fix unintended mtc->nmask mutation in alloc_demote_folio() In alloc_demote_folio(), mtc->nmask is set to NULL for the first allocation. If that succeeds, it returns without restoring mtc->nmask to allowed_mask. For subsequent allocations from the migrate_pages() batch, mtc->nmask will be NULL. If the target node then becomes full, the fallback allocation will use nmask = NULL, allocating from any node allowed by the task cpuset, which for kswapd is all nodes. To address this issue, use a local copy of the mtc structure with nmask = NULL for the first allocation attempt specifically, ensuring the original mtc remains unmodified. Link: https://lkml.kernel.org/r/20260303052519.109244-1-bingjiao@google.com Fixes: 320080272892 ("mm/demotion: demote pages according to allocation fallback order") Signed-off-by: Bing Jiao Acked-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Axel Rasmussen Cc: Johannes Weiner Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 909632714f687560627f3e8c21fb5f5180373afd Author: Maninder Singh Date: Tue Mar 3 15:56:00 2026 +0530 mm/oom_kill.c: simpilfy rcu call with guard(rcu) guard(rcu)() simplifies code readability and there is no need of extra goto labels. Thus replacing rcu_read_lock/unlock with guard(rcu)(). Link: https://lkml.kernel.org/r/20260303102600.105255-1-maninder1.s@samsung.com Signed-off-by: Maninder Singh Acked-by: Michal Hocko Reviewed-by: Dmitry Ilvokhin Acked-by: Shakeel Butt Cc: David Rientjes Signed-off-by: Andrew Morton commit 4a34e46eb5e9c762ba4cea4b3c4d89c8e39b1608 Author: Yuvraj Sakshith Date: Tue Mar 3 03:30:32 2026 -0800 mm/page_reporting: change page_reporting_order to PAGE_REPORTING_ORDER_UNSPECIFIED page_reporting_order when uninitialised, holds a magic number -1. Since we now maintain PAGE_REPORTING_ORDER_UNSPECIFIED as -1, which is also a flag, set page_reporting_order to this flag. Link: https://lkml.kernel.org/r/20260303113032.3008371-6-yuvraj.sakshith@oss.qualcomm.com Signed-off-by: Yuvraj Sakshith Acked-by: David Hildenbrand (Arm) Reviewed-by: Michael Kelley Acked-by: Michael S. Tsirkin Cc: Brendan Jackman Cc: Dexuan Cui Cc: Eugenio Pérez Cc: Haiyang Zhang Cc: Jason Wang Cc: Johannes Weiner Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Liu Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 5467c292d07ffcd55a7a66af2259855f49e1dd06 Author: Yuvraj Sakshith Date: Tue Mar 3 03:30:31 2026 -0800 mm/page_reporting: change PAGE_REPORTING_ORDER_UNSPECIFIED to -1 PAGE_REPORTING_ORDER_UNSPECIFIED is now set to zero. This means, pages of order zero cannot be reported to a client/driver -- as zero is used to signal a fallback to MAX_PAGE_ORDER. Change PAGE_REPORTING_ORDER_UNSPECIFIED to (-1), so that zero can be used as a valid order with which pages can be reported. Link: https://lkml.kernel.org/r/20260303113032.3008371-5-yuvraj.sakshith@oss.qualcomm.com Signed-off-by: Yuvraj Sakshith Acked-by: David Hildenbrand (Arm) Reviewed-by: Michael Kelley Acked-by: Michael S. Tsirkin Cc: Brendan Jackman Cc: Dexuan Cui Cc: Eugenio Pérez Cc: Haiyang Zhang Cc: Jason Wang Cc: Johannes Weiner Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Liu Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit fd4bf4f2875a8d0cf3245da670a097fd0259c183 Author: Yuvraj Sakshith Date: Tue Mar 3 03:30:30 2026 -0800 hv_balloon: set unspecified page reporting order Explicitly mention page reporting order to be set to default value using PAGE_REPORTING_ORDER_UNSPECIFIED fallback value. Link: https://lkml.kernel.org/r/20260303113032.3008371-4-yuvraj.sakshith@oss.qualcomm.com Signed-off-by: Yuvraj Sakshith Acked-by: David Hildenbrand (Arm) Reviewed-by: Michael Kelley Acked-by: Michael S. Tsirkin Cc: Brendan Jackman Cc: Dexuan Cui Cc: Eugenio Pérez Cc: Haiyang Zhang Cc: Jason Wang Cc: Johannes Weiner Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Liu Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit f2325daa3a37502156a761cc5c3cc497eb3b0f4c Author: Yuvraj Sakshith Date: Tue Mar 3 03:30:29 2026 -0800 virtio_balloon: set unspecified page reporting order virtio_balloon page reporting order is set to MAX_PAGE_ORDER implicitly as vb->prdev.order is never initialised and is auto-set to zero. Explicitly mention usage of default page order by making use of PAGE_REPORTING_ORDER_UNSPECIFIED fallback value. Link: https://lkml.kernel.org/r/20260303113032.3008371-3-yuvraj.sakshith@oss.qualcomm.com Signed-off-by: Yuvraj Sakshith Acked-by: David Hildenbrand (Arm) Reviewed-by: Michael Kelley Acked-by: Michael S. Tsirkin Cc: Brendan Jackman Cc: Dexuan Cui Cc: Eugenio Pérez Cc: Haiyang Zhang Cc: Jason Wang Cc: Johannes Weiner Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Liu Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 417607de1f4e6280f646aa42cad5ed84e9228c01 Author: Yuvraj Sakshith Date: Tue Mar 3 03:30:28 2026 -0800 mm/page_reporting: add PAGE_REPORTING_ORDER_UNSPECIFIED Patch series "Allow order zero pages in page reporting", v4. Today, page reporting sets page_reporting_order in two ways: (1) page_reporting.page_reporting_order cmdline parameter (2) Driver can pass order while registering itself. In both cases, order zero is ignored by free page reporting because it is used to set page_reporting_order to a default value, like MAX_PAGE_ORDER. In some cases we might want page_reporting_order to be zero. For instance, when virtio-balloon runs inside a guest with tiny memory (say, 16MB), it might not be able to find a order 1 page (or in the worst case order MAX_PAGE_ORDER page) after some uptime. Page reporting should be able to return order zero pages back for optimal memory relinquishment. This patch changes the default fallback value from '0' to '-1' in all possible clients of free page reporting (hv_balloon and virtio-balloon) together with allowing '0' as a valid order in page_reporting_register(). This patch (of 5): Drivers can pass order of pages to be reported while registering itself. Today, this is a magic number, 0. Label this with PAGE_REPORTING_ORDER_UNSPECIFIED and check for it when the driver is being registered. This macro will be used in relevant drivers next. [akpm@linux-foundation.org: tweak whitespace, per David] Link: https://lkml.kernel.org/r/20260303113032.3008371-1-yuvraj.sakshith@oss.qualcomm.com Link: https://lkml.kernel.org/r/20260303113032.3008371-2-yuvraj.sakshith@oss.qualcomm.com Signed-off-by: Yuvraj Sakshith Acked-by: David Hildenbrand (Arm) Reviewed-by: Michael Kelley Acked-by: Michael S. Tsirkin Cc: Brendan Jackman Cc: Dexuan Cui Cc: Eugenio Pérez Cc: Haiyang Zhang Cc: Jason Wang Cc: Johannes Weiner Cc: K. Y. Srinivasan Cc: Liam Howlett Cc: Long Li Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Liu Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 52af721b9421436a5ee8c301043849f804e3e807 Author: Johannes Weiner Date: Mon Mar 2 14:50:18 2026 -0500 mm: memcg: separate slab stat accounting from objcg charge cache Cgroup slab metrics are cached per-cpu the same way as the sub-page charge cache. However, the intertwined code to manage those dependent caches right now is quite difficult to follow. Specifically, cached slab stat updates occur in consume() if there was enough charge cache to satisfy the new object. If that fails, whole pages are reserved, and slab stats are updated when the remainder of those pages, after subtracting the size of the new slab object, are put into the charge cache. This already juggles a delicate mix of the object size, the page charge size, and the remainder to put into the byte cache. Doing slab accounting in this path as well is fragile, and has recently caused a bug where the input parameters between the two caches were mixed up. Refactor the consume() and refill() paths into unlocked and locked variants that only do charge caching. Then let the slab path manage its own lock section and open-code charging and accounting. This makes the slab stat cache subordinate to the charge cache: __refill_obj_stock() is called first to prepare it; __account_obj_stock() follows to hitch a ride. This results in a minor behavioral change: previously, a mismatching percpu stock would always be drained for the purpose of setting up slab account caching, even if there was no byte remainder to put into the charge cache. Now, the stock is left alone, and slab accounting takes the uncached path if there is a mismatch. This is exceedingly rare, and it was probably never worth draining the whole stock just to cache the slab stat update. Link: https://lkml.kernel.org/r/20260302195305.620713-6-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: Roman Gushchin Reviewed-by: Hao Li Acked-by: Vlastimil Babka (SUSE) Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton commit 4665aa7e6523c418d6178ef7e23a4159c72b9d3a Author: Johannes Weiner Date: Mon Mar 2 14:50:17 2026 -0500 mm: memcontrol: use __account_obj_stock() in the !locked path Make __account_obj_stock() usable for the case where the local trylock failed. Then switch refill_obj_stock() over to it. This consolidates the mod_objcg_mlstate() call into one place and will make the next patch easier to follow. Link: https://lkml.kernel.org/r/20260302195305.620713-5-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: Roman Gushchin Reviewed-by: Vlastimil Babka (SUSE) Reviewed-by: Hao Li Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton commit edb6abd31bff0746c687cf5af9ecacefaa90e9cb Author: Johannes Weiner Date: Mon Mar 2 14:50:16 2026 -0500 mm: memcontrol: split out __obj_cgroup_charge() Move the page charge and remainder calculation into its own function. It will make the slab stat refactor easier to follow. Link: https://lkml.kernel.org/r/20260302195305.620713-4-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: Roman Gushchin Reviewed-by: Vlastimil Babka (SUSE) Reviewed-by: Hao Li Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton commit 9d181e47098d6911f4a5b3d9feff60c2bf6786a2 Author: Johannes Weiner Date: Mon Mar 2 14:50:15 2026 -0500 mm: memcg: simplify objcg charge size and stock remainder math Use PAGE_ALIGN() and a more natural cache remainder calculation. Link: https://lkml.kernel.org/r/20260302195305.620713-3-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: Roman Gushchin Reviewed-by: Vlastimil Babka (SUSE) Reviewed-by: Hao Li Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton commit 9f2541d9b2fc1ee86415b8d41f6a19cb2a582aac Author: Johannes Weiner Date: Mon Mar 2 14:50:14 2026 -0500 mm: memcg: factor out trylock_stock() and unlock_stock() Patch series "memcg: obj stock and slab stat caching cleanups". This is a follow-up to `[PATCH] memcg: fix slab accounting in refill_obj_stock() trylock path`. The way the slab stat cache and the objcg charge cache interact appears a bit too fragile. This series factors those paths apart as much as practical. This patch (of 5): Consolidate the local lock acquisition and the local stock lookup. This allows subsequent patches to use !!stock as an easy way to disambiguate the locked vs. contended cases through the callstack. Link: https://lkml.kernel.org/r/20260302195305.620713-1-hannes@cmpxchg.org Link: https://lkml.kernel.org/r/20260302195305.620713-2-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: Roman Gushchin Reviewed-by: Vlastimil Babka (SUSE) Reviewed-by: Hao Li Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton commit 9970a9a27ffca8b45c4a242f90adeb979fcaafb0 Author: Baolin Wang Date: Fri Mar 6 14:43:42 2026 +0800 arm64: mm: implement the architecture-specific test_and_clear_young_ptes() Implement the Arm64 architecture-specific test_and_clear_young_ptes() to enable batched checking of young flags, improving performance during large folio reclamation when MGLRU is enabled. While we're at it, simplify ptep_test_and_clear_young() by calling test_and_clear_young_ptes(). Since callers guarantee that PTEs are present before calling these functions, we can use pte_cont() to check the CONT_PTE flag instead of pte_valid_cont(). Performance testing: Enable MGLRU, then allocate 10G clean file-backed folios by mmap() in a memory cgroup, and try to reclaim 8G file-backed folios via the memory.reclaim interface. I can observe 60%+ performance improvement on my Arm64 32-core server (and about 15% improvement on my X86 machine). W/o patchset: real 0m0.470s user 0m0.000s sys 0m0.470s W/ patchset: real 0m0.180s user 0m0.001s sys 0m0.179s Link: https://lkml.kernel.org/r/7f891d42a720cc2e57862f3b79e4f774404f313c.1772778858.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Rik van Riel Reviewed-by: David Hildenbrand (Arm) Cc: Alistair Popple Cc: Axel Rasmussen Cc: Barry Song Cc: Catalin Marinas Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Qi Zheng Cc: Ryan Roberts Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Will Deacon Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 56e5b60b2114dee967c971f08dd29ef193bd3a2d Author: Baolin Wang Date: Fri Mar 6 14:43:41 2026 +0800 mm: support batched checking of the young flag for MGLRU Use the batched helper test_and_clear_young_ptes_notify() to check and clear the young flag to improve the performance during large folio reclamation when MGLRU is enabled. Meanwhile, we can also support batched checking the young and dirty flag when MGLRU walks the mm's pagetable to update the folios' generation counter. Since MGLRU also checks the PTE dirty bit, use folio_pte_batch_flags() with FPB_MERGE_YOUNG_DIRTY set to detect batches of PTEs for a large folio. Then we can remove the ptep_test_and_clear_young_notify() since it has no users now. Note that we also update the 'young' counter and 'mm_stats[MM_LEAF_YOUNG]' counter with the batched count in the lru_gen_look_around() and walk_pte_range(). However, the batched operations may inflate these two counters, because in a large folio not all PTEs may have been accessed. (Additionally, tracking how many PTEs have been accessed within a large folio is not very meaningful, since the mm core actually tracks access/dirty on a per-folio basis, not per page). The impact analysis is as follows: 1. The 'mm_stats[MM_LEAF_YOUNG]' counter has no functional impact and is mainly for debugging. 2. The 'young' counter is used to decide whether to place the current PMD entry into the bloom filters by suitable_to_scan() (so that next time we can check whether it has been accessed again), which may set the hash bit in the bloom filters for a PMD entry that hasn't seen much access. However, bloom filters inherently allow some error, so this effect appears negligible. Link: https://lkml.kernel.org/r/378f4acf7d07410aa7c2e4b49d56bb165918eb34.1772778858.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Rik van Riel Acked-by: David Hildenbrand (Arm) Cc: Alistair Popple Cc: Axel Rasmussen Cc: Barry Song Cc: Catalin Marinas Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Qi Zheng Cc: Ryan Roberts Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Will Deacon Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 6d7237dda44f24bb0dec5dbd2a0ed6be77bf6ef6 Author: Baolin Wang Date: Fri Mar 6 14:43:40 2026 +0800 mm: add a batched helper to clear the young flag for large folios Currently, MGLRU will call ptep_test_and_clear_young_notify() to check and clear the young flag for each PTE sequentially, which is inefficient for large folios reclamation. Moreover, on Arm64 architecture, which supports contiguous PTEs, the Arm64- specific ptep_test_and_clear_young() already implements an optimization to clear the young flags for PTEs within a contiguous range. However, this is not sufficient. Similar to the Arm64 specific clear_flush_young_ptes(), we can extend this to perform batched operations for the entire large folio (which might exceed the contiguous range: CONT_PTE_SIZE). Thus, we can introduce a new batched helper: test_and_clear_young_ptes() and its wrapper test_and_clear_young_ptes_notify() which are consistent with the existing functions, to perform batched checking of the young flags for large folios, which can help improve performance during large folio reclamation when MGLRU is enabled. And it will be overridden by the architecture that implements a more efficient batch operation in the following patches. Link: https://lkml.kernel.org/r/23ec671bfcc06cd24ee0fbff8e329402742274a0.1772778858.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Andrew Morton Cc: Alistair Popple Cc: Axel Rasmussen Cc: Barry Song Cc: Catalin Marinas Cc: David Hildenbrand (Arm) Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Qi Zheng Cc: Rik van Riel Cc: Ryan Roberts Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Will Deacon Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 83ec1286b173e6ff54d0dd0291fbc517d65a8d5b Author: Baolin Wang Date: Fri Mar 6 14:43:39 2026 +0800 mm: rmap: add a ZONE_DEVICE folio warning in folio_referenced() The folio_referenced() is used to test whether a folio was referenced during reclaim. Moreover, ZONE_DEVICE folios are controlled by their device driver, have a lifetime tied to that driver, and are never placed on the LRU list. That means we should never try to reclaim ZONE_DEVICE folios, so add a warning to catch this unexpected behavior in folio_referenced() to avoid confusion, as discussed in the previous thread[1]. [1] https://lore.kernel.org/all/16fb7985-ec0f-4b56-91e7-404c5114f899@kernel.org/ Link: https://lkml.kernel.org/r/64d6fb2a33f7101e1d4aca2c9052e0758b76d492.1772778858.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Alistair Popple Acked-by: David Hildenbrand (Arm) Cc: Axel Rasmussen Cc: Barry Song Cc: Catalin Marinas Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Qi Zheng Cc: Rik van Riel Cc: Ryan Roberts Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Will Deacon Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 37fb436ff673f33e1ecd2d6f771fd789ed2a6092 Author: Baolin Wang Date: Fri Mar 6 14:43:38 2026 +0800 mm: rename ptep/pmdp_clear_young_notify() to ptep/pmdp_test_and_clear_young_notify() Rename ptep/pmdp_clear_young_notify() to ptep/pmdp_test_and_clear_young_notify() to make the function names consistent. Link: https://lkml.kernel.org/r/b3454077ce88745e6f88386b1763721746884565.1772778858.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Acked-by: David Hildenbrand (Arm) Suggested-by: David Hildenbrand (Arm) Cc: Alistair Popple Cc: Axel Rasmussen Cc: Barry Song Cc: Catalin Marinas Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Qi Zheng Cc: Rik van Riel Cc: Ryan Roberts Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Will Deacon Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 5a970006786a3b10577e762a9a6c0b9353b4e8a4 Author: Baolin Wang Date: Fri Mar 6 14:43:37 2026 +0800 mm: use inline helper functions instead of ugly macros Patch series "support batched checking of the young flag for MGLRU", v3. This is a follow-up to the previous work [1], to support batched checking of the young flag for MGLRU. Similarly, batched checking of young flag for large folios can improve performance during large-folio reclamation when MGLRU is enabled. I observed noticeable performance improvements (see patch 5) on an Arm64 machine that supports contiguous PTEs. All mm-selftests are passed. Patch 1 - 3: cleanup patches. Patch 4: add a new generic batched PTE helper: test_and_clear_young_ptes(). Patch 5: support batched young flag checking for MGLRU. Patch 6: implement the Arm64 arch-specific test_and_clear_young_ptes(). This patch (of 6): People have already complained that these *_clear_young_notify() related macros are very ugly, so let's use inline helpers to make them more readable. In addition, we cannot implement these inline helper functions in the mmu_notifier.h file, because some arch-specific files will include the mmu_notifier.h, which introduces header compilation dependencies and causes build errors (e.g., arch/arm64/include/asm/tlbflush.h). Moreover, since these functions are only used in the mm, implementing these inline helpers in the mm/internal.h header seems reasonable. Link: https://lkml.kernel.org/r/cover.1772778858.git.baolin.wang@linux.alibaba.com Link: https://lkml.kernel.org/r/ea14af84e7967ccebb25082c28a8669d6da8fe57.1772778858.git.baolin.wang@linux.alibaba.com Link: https://lore.kernel.org/all/cover.1770645603.git.baolin.wang@linux.alibaba.com/ [1] Signed-off-by: Baolin Wang Reviewed-by: Rik van Riel Reviewed-by: Barry Song Acked-by: David Hildenbrand (Arm) Cc: Axel Rasmussen Cc: Catalin Marinas Cc: Dev Jain Cc: Jann Horn Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Qi Zheng Cc: Ryan Roberts Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Will Deacon Cc: Yuanchu Xie Cc: Alistair Popple Signed-off-by: Andrew Morton commit cf2124a90c365cbe2cbeea006b4273374f8d1ecc Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:47 2026 +0100 mm/memory: support VM_MIXEDMAP in zap_special_vma_range() There is demand for also zapping page table entries by drivers in VM_MIXEDMAP VMAs[1]. Nothing really speaks against supporting VM_MIXEDMAP for driver use. We just don't want arbitrary drivers to zap in ordinary (non-special) VMAs. Link: https://lkml.kernel.org/r/20260227200848.114019-17-david@kernel.org Link: https://lore.kernel.org/r/aYSKyr7StGpGKNqW@google.com [1] Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 52a9e9cd181fab8b03cf4e982533224697669976 Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:46 2026 +0100 mm: rename zap_vma_ptes() to zap_special_vma_range() zap_vma_ptes() is the only zapping function we export to modules. It's essentially a wrapper around zap_vma_range(), however, with some safety checks: * That the passed range fits fully into the VMA * That it's only used for VM_PFNMAP We will add support for VM_MIXEDMAP next, so use the more-generic term "special vma", although "special" is a bit overloaded. Maybe we'll later just support any VM_SPECIAL flag. While at it, improve the kerneldoc. Link: https://lkml.kernel.org/r/20260227200848.114019-16-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Acked-by: Leon Romanovsky [drivers/infiniband] Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 0326440c3545c86b6501c7c636fcf018d6e87b8c Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:45 2026 +0100 mm: rename zap_page_range_single() to zap_vma_range() Let's rename it to make it better match our new naming scheme. While at it, polish the kerneldoc. [akpm@linux-foundation.org: fix rustfmtcheck] Link: https://lkml.kernel.org/r/20260227200848.114019-15-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: Puranjay Mohan Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 784a742e7b6db236ef1ccfcdbfe29bf6234b3ccb Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:44 2026 +0100 mm: rename zap_page_range_single_batched() to zap_vma_range_batched() Let's make the naming more consistent with our new naming scheme. While at it, polish the kerneldoc a bit. Link: https://lkml.kernel.org/r/20260227200848.114019-14-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 32bc7fe4a6f4d359b6de96cbc106d2cac695154e Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:43 2026 +0100 mm: rename zap_vma_pages() to zap_vma() Let's rename it to an even simpler name. While at it, add some simplistic kernel doc. Link: https://lkml.kernel.org/r/20260227200848.114019-13-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 3a31d08d242aeb104814c93a1b93d09e483ddf8e Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:42 2026 +0100 mm/memory: inline unmap_page_range() into __zap_vma_range() Let's inline it into the single caller to reduce the number of confusing unmap/zap helpers. Get rid of the unnecessary BUG_ON(). [david@kernel.org: call the local variable simply "addr", per Lorenzo] Link: https://lkml.kernel.org/r/f7732d1c-0e85-4a14-948a-912c417018b5@kernel.org Link: https://lkml.kernel.org/r/20260227200848.114019-12-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 5f10cbbddc2bd80a5944f1c783830f7ebf648ad2 Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:41 2026 +0100 mm/memory: use __zap_vma_range() in zap_vma_for_reaping() Let's call __zap_vma_range() instead of unmap_page_range() to prepare for further cleanups. To keep the existing behavior, whereby we do not call uprobe_munmap() which could block, add a new "reaping" member to zap_details and use it. Likely we should handle the possible blocking in uprobe_munmap() differently, but for now keep it unchanged. Link: https://lkml.kernel.org/r/20260227200848.114019-11-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit a97bc13d15f472c7f8ede1b38660fb55b6dab68d Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:40 2026 +0100 mm/memory: convert details->even_cows into details->skip_cows The current semantics are confusing: simply because someone specifies an empty zap_detail struct suddenly makes should_zap_cows() behave differently. The default should be to also zap CoW'ed anonymous pages. Really only unmap_mapping_pages() and friends want to skip zapping of these anon folios. So let's invert the meaning; turn the confusing "reclaim_pt" check that overrides other properties in should_zap_cows() into a safety check. Note that the only caller that sets reclaim_pt=true is madvise_dontneed_single_vma(), which wants to zap any pages. Link: https://lkml.kernel.org/r/20260227200848.114019-10-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit b6c0384a04267350c12875e2fd569a31618e4b11 Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:39 2026 +0100 mm/memory: move adjusting of address range to unmap_vmas() __zap_vma_range() has two callers, whereby zap_page_range_single_batched() documents that the range must fit into the VMA range. So move adjusting the range to unmap_vmas() where it is actually required and add a safety check in __zap_vma_range() instead. In unmap_vmas(), we'd never expect to have empty ranges (otherwise, why have the vma in there in the first place). __zap_vma_range() will no longer be called with start == end, so cleanup the function a bit. While at it, simplify the overly long comment to its core message. We will no longer call uprobe_munmap() for start == end, which actually seems to be the right thing to do. Note that hugetlb_zap_begin()->...->adjust_range_if_pmd_sharing_possible() cannot result in the range exceeding the vma range. Link: https://lkml.kernel.org/r/20260227200848.114019-9-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 19e48cb98b808983541fac258741610174fe1fca Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:38 2026 +0100 mm/memory: rename unmap_single_vma() to __zap_vma_range() Let's rename it to better fit our new naming scheme. Link: https://lkml.kernel.org/r/20260227200848.114019-8-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit ba25127a8f0cb501c2d8e8879e38d203d044e50c Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:37 2026 +0100 mm/oom_kill: factor out zapping of VMA into zap_vma_for_reaping() Let's factor it out so we can turn unmap_page_range() into a static function instead, and so oom reaping has a clean interface to call. Note that hugetlb is not supported, because it would require a bunch of hugetlb-specific further actions (see zap_page_range_single_batched()). Link: https://lkml.kernel.org/r/20260227200848.114019-7-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit f52f202ddebb17d7e2001ecbe863115c5a9c8c0b Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:36 2026 +0100 mm/oom_kill: use MMU_NOTIFY_CLEAR in __oom_reap_task_mm() In commit 7269f999934b ("mm/mmu_notifier: use correct mmu_notifier events for each invalidation") we converted all MMU_NOTIFY_UNMAP to MMU_NOTIFY_CLEAR, except the ones that actually perform munmap() or mremap() as documented. __oom_reap_task_mm() behaves much more like MADV_DONTNEED. So use MMU_NOTIFY_CLEAR as well. This is a preparation for further changes. Link: https://lkml.kernel.org/r/20260227200848.114019-6-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 599a59e6037838ea7cd6264d7980ea63de244994 Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:35 2026 +0100 mm/memory: simplify calculation in unmap_mapping_range_tree() Let's simplify the calculation a bit further to make it easier to get, reusing vma_last_pgoff() which we move from interval_tree.c to mm.h. Link: https://lkml.kernel.org/r/20260227200848.114019-5-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 75c5ae05e3d98d2cb4eeef40bf1467f2edc14bd2 Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:34 2026 +0100 mm/memory: inline unmap_mapping_range_vma() into unmap_mapping_range_tree() Let's remove the number of unmap-related functions that cause confusion by inlining unmap_mapping_range_vma() into its single caller. The end result looks pretty readable. Link: https://lkml.kernel.org/r/20260227200848.114019-4-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit de008c9ba5684f14e83bcf86cd45fb0e4e6c4d82 Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:33 2026 +0100 mm/memory: remove "zap_details" parameter from zap_page_range_single() Nobody except memory.c should really set that parameter to non-NULL. So let's just drop it and make unmap_mapping_range_vma() use zap_page_range_single_batched() instead. [david@kernel.org: format on a single line] Link: https://lkml.kernel.org/r/8a27e9ac-2025-4724-a46d-0a7c90894ba7@kernel.org Link: https://lkml.kernel.org/r/20260227200848.114019-3-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: Puranjay Mohan Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit c48ad5a4b8fef0f9c85d3e0531be4968860d3792 Author: David Hildenbrand (Arm) Date: Fri Feb 27 21:08:32 2026 +0100 mm/madvise: drop range checks in madvise_free_single_vma() Patch series "mm: cleanups around unmapping / zapping". A bunch of cleanups around unmapping and zapping. Mostly simplifications, code movements, documentation and renaming of zapping functions. With this series, we'll have the following high-level zap/unmap functions (excluding high-level folio zapping): * unmap_vmas() for actual unmapping (vmas will go away) * zap_vma(): zap all page table entries in a vma * zap_vma_for_reaping(): zap_vma() that must not block * zap_vma_range(): zap a range of page table entries * zap_vma_range_batched(): zap_vma_range() with more options and batching * zap_special_vma_range(): limited zap_vma_range() for modules * __zap_vma_range(): internal helper Patch #1 is not about unmapping/zapping, but I stumbled over it while verifying MADV_DONTNEED range handling. Patch #16 is related to [1], but makes sense even independent of that. This patch (of 16): madvise_vma_behavior()-> madvise_dontneed_free()->madvise_free_single_vma() is only called from madvise_walk_vmas() (a) After try_vma_read_lock() confirmed that the whole range falls into a single VMA (see is_vma_lock_sufficient()). (b) After adjusting the range to the VMA in the loop afterwards. madvise_dontneed_free() might drop the MM lock when handling userfaultfd, but it properly looks up the VMA again to adjust the range. So in madvise_free_single_vma(), the given range should always fall into a single VMA and should also span at least one page. Let's drop the error checks. The code now matches what we do in madvise_dontneed_single_vma(), where we call zap_vma_range_batched() that documents: "The range must fit into one VMA.". Although that function still adjusts that range, we'll change that soon. Link: https://lkml.kernel.org/r/20260227200848.114019-1-david@kernel.org Link: https://lkml.kernel.org/r/20260227200848.114019-2-david@kernel.org Link: https://lore.kernel.org/r/aYSKyr7StGpGKNqW@google.com [1] Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Alice Ryhl Cc: Andrii Nakryiko Cc: Andy Lutomirski Cc: Arnaldo Carvalho de Melo Cc: Arnd Bergmann Cc: Arve Cc: "Borislav Petkov (AMD)" Cc: Carlos Llamas Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: Daniel Borkman Cc: Dave Airlie Cc: David Ahern Cc: David Rientjes Cc: David S. Miller Cc: Dimitri Sivanich Cc: Eric Dumazet Cc: Gerald Schaefer Cc: Greg Kroah-Hartman Cc: Hartley Sweeten Cc: Heiko Carstens Cc: Ian Abbott Cc: Ingo Molnar Cc: Jakub Kacinski Cc: Jani Nikula Cc: Jann Horn Cc: Janosch Frank Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Jonas Lahtinen Cc: Leon Romanovsky Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Wilcox (Oracle) Cc: Michael Ellerman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Namhyung kim Cc: Neal Cardwell Cc: Paolo Abeni Cc: Pedro Falcato Cc: Peter Zijlstra Cc: Rodrigo Vivi Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Todd Kjos Cc: Tvrtko Ursulin Cc: Vasily Gorbik Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 9de209c183de3a52220b37262e2a0e0d52719de5 Author: David Hildenbrand (Arm) Date: Tue Mar 3 13:04:16 2026 +0100 kasan: docs: SLUB is the only remaining slab implementation We have only the SLUB implementation left in the kernel (referred to as "slab"). Therefore, there is nothing special regarding KASAN modes when it comes to the slab allocator anymore. Drop the stale comment regarding differing SLUB vs. SLAB support. Link: https://lkml.kernel.org/r/20260303120416.62580-1-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Vlastimil Babka (SUSE) Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Vincenzo Frascino Cc: Jonathan Corbet Cc: Shuah Khan Signed-off-by: Andrew Morton commit 3caedb3b99eabe9f67b7b6c704ab8a92fe35dcec Author: Michal Hocko Date: Mon Mar 2 12:47:40 2026 +0100 vmalloc: support __GFP_RETRY_MAYFAIL and __GFP_NORETRY __GFP_RETRY_MAYFAIL and __GFP_NORETRY haven't been supported so far because their semantic (i.e. to not trigger OOM killer) is not possible with the existing vmalloc page table allocation which is allowing for the OOM killer. Example: __vmalloc(size, GFP_KERNEL | __GFP_RETRY_MAYFAIL); vmalloc_test/55 invoked oom-killer: gfp_mask=0x40dc0( GFP_KERNEL|__GFP_ZERO|__GFP_COMP), order=0, oom_score_adj=0 active_anon:0 inactive_anon:0 isolated_anon:0 active_file:0 inactive_file:0 isolated_file:0 unevictable:0 dirty:0 writeback:0 slab_reclaimable:700 slab_unreclaimable:33708 mapped:0 shmem:0 pagetables:5174 sec_pagetables:0 bounce:0 kernel_misc_reclaimable:0 free:850 free_pcp:319 free_cma:0 CPU: 4 UID: 0 PID: 639 Comm: vmalloc_test/55 ... Hardware name: QEMU Standard PC (i440FX + PIIX, ... Call Trace: dump_stack_lvl+0x5d/0x80 dump_header+0x43/0x1b3 out_of_memory.cold+0x8/0x78 __alloc_pages_slowpath.constprop.0+0xef5/0x1130 __alloc_frozen_pages_noprof+0x312/0x330 alloc_pages_mpol+0x7d/0x160 alloc_pages_noprof+0x50/0xa0 __pte_alloc_kernel+0x1e/0x1f0 ... There are usecases for these modifiers when a large allocation request should rather fail than trigger OOM killer which wouldn't be able to handle the situation anyway [1]. While we cannot change existing page table allocation code easily we can piggy back on scoped NOWAIT allocation for them that we already have in place. The rationale is that the bulk of the consumed memory is sitting in pages backing the vmalloc allocation. Page tables are only participating a tiny fraction. Moreover page tables for virtually allocated areas are never reclaimed so the longer the system runs to less likely they are. It makes sense to allow an approximation of __GFP_RETRY_MAYFAIL and __GFP_NORETRY even if the page table allocation part is much weaker. This doesn't break the failure mode while it allows for the no OOM semantic. [1] https://lore.kernel.org/all/32bd9bed-a939-69c4-696d-f7f9a5fe31d8@redhat.com/T/#u Link: https://lkml.kernel.org/r/20260302114740.2668450-2-urezki@gmail.com Signed-off-by: Michal Hocko Signed-off-by: Uladzislau Rezki (Sony) Tested-by: Uladzislau Rezki (Sony) Cc: Baoquan He Cc: Mikulas Patocka Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit 0edd78cd4d40a752dc6d1bc661ce297c40baea29 Author: Uladzislau Rezki (Sony) Date: Mon Mar 2 12:47:39 2026 +0100 mm/vmalloc: fix incorrect size reporting on allocation failure When __vmalloc_area_node() fails to allocate pages, the failure message may report an incorrect allocation size, for example: vmalloc error: size 0, failed to allocate pages, ... This happens because the warning prints area->nr_pages * PAGE_SIZE. At this point, area->nr_pages may be zero or partly populated thus it is not valid. Report the originally requested allocation size instead by using nr_small_pages * PAGE_SIZE, which reflects the actual number of pages being requested by user. Link: https://lkml.kernel.org/r/20260302114740.2668450-1-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Mikulas Patocka Reviewed-by: Vishal Moola (Oracle) Cc: Baoquan He Cc: Michal Hocko Signed-off-by: Andrew Morton commit 7a197d346a44384a1a858a98ef03766840e561d4 Author: Jane Chu Date: Mon Mar 2 13:10:15 2026 -0700 Documentation: fix a hugetlbfs reservation statement Documentation/mm/hugetlbfs_reserv.rst has if (resv_needed <= (resv_huge_pages - free_huge_pages)) resv_huge_pages += resv_needed; which describes this code in gather_surplus_pages() needed = (h->resv_huge_pages + delta) - h->free_huge_pages; if (needed <= 0) { h->resv_huge_pages += delta; return 0; } which means if there are enough free hugepages to account for the new reservation, simply update the global reservation count without further action. But the description is backwards, it should be if (resv_needed <= (free_huge_pages - resv_huge_pages)) instead. Link: https://lkml.kernel.org/r/20260302201015.1824798-1-jane.chu@oracle.com Fixes: 70bc0dc578b3 ("Documentation: vm, add hugetlbfs reservation overview") Signed-off-by: Jane Chu Cc: David Hildenbrand Cc: Hillf Danton Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Oscar Salvador Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 28266ac94a50e585c267a79d9ef5c2803d4dcd7a Author: Gladyshev Ilya Date: Sun Mar 1 13:19:39 2026 +0000 mm: make ref_unless functions unless_zero only There are no users of (folio/page)_ref_add_unless(page, nr, u) with u != 0 [1] and all current users are "internal" for page refcounting API. This allows us to safely drop this parameter and reduce function semantics to the "unless zero" cases only. If needed, these functions for the u!=0 cases can be trivially reintroduced later using the same atomic_add_unless operations as before. [1]: The last user was dropped in v5.18 kernel, commit 27674ef6c73f ("mm: remove the extra ZONE_DEVICE struct page refcount"). There is no trace of discussion as to why this cleanup wasn't done earlier. Link: https://lkml.kernel.org/r/a0c89b49d38c671a0bdd35069d15ee13e08314d2.1772370066.git.gladyshev.ilya1@h-partners.com Co-developed-by: Gorbunov Ivan Signed-off-by: Gorbunov Ivan Signed-off-by: Gladyshev Ilya Acked-by: David Hildenbrand (Arm) Acked-by: Kiryl Shutsemau Acked-by: Zi Yan Reviewed-by: Lorenzo Stoakes Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Cc: Yu Zhao Signed-off-by: Andrew Morton commit e9c01915ae2b2bc9f02dbe994aca826a1021f0a2 Author: Vlastimil Babka Date: Fri Feb 27 18:08:00 2026 +0100 mm/page_alloc: remove pcpu_spin_* wrappers We only ever use pcpu_spin_trylock()/unlock() with struct per_cpu_pages so refactor the helpers to remove the generic layer. No functional change intended. Link: https://lkml.kernel.org/r/20260227-b4-pcp-locking-cleanup-v1-3-f7e22e603447@kernel.org Signed-off-by: Vlastimil Babka (SUSE) Suggested-by: Matthew Wilcox Acked-by: Johannes Weiner Cc: Brendan Jackman Cc: David Hildenbrand (Arm) Cc: Mel Gorman Cc: Michal Hocko Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 0a2c52a9a2f55e80fee6a10a846cadab590dc918 Author: Vlastimil Babka Date: Fri Feb 27 18:07:59 2026 +0100 mm/page_alloc: remove IRQ saving/restoring from pcp locking Effectively revert commit 038a102535eb ("mm/page_alloc: prevent pcp corruption with SMP=n"). The original problem is now avoided by pcp_spin_trylock() always failing on CONFIG_SMP=n, so we do not need to disable IRQs anymore. It's not a complete revert, because keeping the pcp_spin_(un)lock() wrappers is useful. Rename them from _maybe_irqsave/restore to _nopin. The difference from pcp_spin_trylock()/pcp_spin_unlock() is that the _nopin variants don't perform pcpu_task_pin/unpin(). Link: https://lkml.kernel.org/r/20260227-b4-pcp-locking-cleanup-v1-2-f7e22e603447@kernel.org Signed-off-by: Vlastimil Babka (SUSE) Acked-by: Johannes Weiner Cc: Brendan Jackman Cc: David Hildenbrand (Arm) Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit a373f371166df56eb3ec043d72dafc70a7d46536 Author: Vlastimil Babka Date: Fri Feb 27 18:07:58 2026 +0100 mm/page_alloc: effectively disable pcp with CONFIG_SMP=n Patch series "mm/page_alloc: pcp locking cleanup". This is a followup to the hotfix 038a102535eb ("mm/page_alloc: prevent pcp corruption with SMP=n"), to simplify the code and deal with the original issue properly. The previous RFC attempt [1] argued for changing the UP spinlock implementation, which was discouraged, but thanks to David's off-list suggestion, we can achieve the goal without changing the spinlock implementation. The main change in Patch 1 relies on the fact that on UP we don't need the pcp lists for scalability, so just make them always bypassed during alloc/free by making the pcp trylock an unconditional failure. The various drain paths that use pcp_spin_lock_maybe_irqsave() continue to exist but will never do any work in practice. In Patch 2 we can again remove the irq saving from them that commit 038a102535eb added. Besides simpler code with all the ugly UP_flags removed, we get less bloat with CONFIG_SMP=n for mm/page_alloc.o as a result: add/remove: 25/28 grow/shrink: 4/5 up/down: 2105/-6665 (-4560) Function old new delta get_page_from_freelist 5689 7248 +1559 free_unref_folios 2006 2324 +318 make_alloc_exact 270 286 +16 __zone_watermark_ok 306 322 +16 drain_pages_zone.isra 119 109 -10 decay_pcp_high 181 149 -32 setup_pcp_cacheinfo 193 147 -46 __free_frozen_pages 1339 1089 -250 alloc_pages_bulk_noprof 1054 419 -635 free_frozen_page_commit 907 - -907 try_to_claim_block 1975 - -1975 __rmqueue_pcplist 2614 - -2614 Total: Before=54624, After=50064, chg -8.35% This patch (of 3): The page allocator has been using a locking scheme for its percpu page caches (pcp) based on spin_trylock() with no _irqsave() part. The trick is that if we interrupt the locked section, we fail the trylock and just fallback to the slowpath taking the zone lock. That's more expensive, but rare, so we don't need to pay the irqsave/restore cost all the time in the fastpaths. It's similar to but not exactly local_trylock_t (which is also newer anyway) because in some cases we do lock the pcp of a non-local cpu to drain it, in a way that's cheaper than using IPI or queue_work_on(). The complication of this scheme has been UP non-debug spinlock implementation which assumes spin_trylock() can't fail on UP and has no state to track whether it's locked. It just doesn't anticipate this usage scenario. So to work around that we disable IRQs only on UP, complicating the implementation. Also recently we found years old bug in where we didn't disable IRQs in related paths - see 038a102535eb ("mm/page_alloc: prevent pcp corruption with SMP=n"). We can avoid this UP complication by realizing that we do not need the pcp caching for scalability on UP in the first place. Removing it completely with #ifdefs is not worth the trouble either. Just make pcp_spin_trylock() return NULL unconditionally on CONFIG_SMP=n. This makes the slowpaths unconditional, and we can remove the IRQ save/restore handling in pcp_spin_trylock()/unlock() completely. Link: https://lkml.kernel.org/r/20260227-b4-pcp-locking-cleanup-v1-0-f7e22e603447@kernel.org Link: https://lkml.kernel.org/r/20260227-b4-pcp-locking-cleanup-v1-1-f7e22e603447@kernel.org Link: https://lore.kernel.org/all/d762c46b-36f0-471a-b5b4-23c8cf5628ae@suse.cz/ [1] Signed-off-by: Vlastimil Babka (SUSE) Suggested-by: David Hildenbrand (Arm) Acked-by: Johannes Weiner Cc: Brendan Jackman Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit ca6969e074dc1d2a3ac9f7e00de75769eb3cde64 Author: SeongJae Park Date: Sat Feb 28 14:28:27 2026 -0800 mm/damon/test/core-kunit: add damon_apply_min_nr_regions() test Add a kunit test for the functionality of damon_apply_min_nr_regions(). Link: https://lkml.kernel.org/r/20260228222831.7232-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit 442d87c7db9e9e2a569a49d38f404b8b556b8719 Author: SeongJae Park Date: Sat Feb 28 14:28:26 2026 -0800 mm/damon/vaddr: do not split regions for min_nr_regions The previous commit made DAMON core split regions at the beginning for min_nr_regions. The virtual address space operation set (vaddr) does similar work on its own, for a case user delegates entire initial monitoring regions setup to vaddr. It is unnecessary now, as DAMON core will do similar work for any case. Remove the duplicated work in vaddr. Also, remove a helper function that was being used only for the work, and the test code of the helper function. Link: https://lkml.kernel.org/r/20260228222831.7232-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit b1029f29eb1d5fbf07fa8db9b5e7ab6d9813ad67 Author: SeongJae Park Date: Sat Feb 28 14:28:25 2026 -0800 mm/damon/core: split regions for min_nr_regions Patch series "mm/damon: strictly respect min_nr_regions". DAMON core respects min_nr_regions only at merge operation. DAMON API callers are therefore responsible to respect or ignore that. Only vaddr ops is respecting that, but only for initial start time. DAMON sysfs interface allows users to setup the initial regions that DAMON core also respects. But, again, it works for only the initial time. Users setting the regions for min_nr_regions can be difficult and inefficient, when the min_nr_regions value is high. There was actually a report [1] from a user. The use case was page granular access monitoring with a large aggregation interval. Make the following three changes for resolving the issue. First (patch 1), make DAMON core split regions at the beginning and every aggregation interval, to respect the min_nr_regions. Second (patch 2), drop the vaddr's split operations and related code that are no more needed. Third (patch 3), add a kunit test for the newly introduced function. This patch (of 3): DAMON core layer respects the min_nr_regions parameter by setting the maximum size of each region as total monitoring region size divided by the parameter value. And the limit is applied by preventing merge of regions that result in a region larger than the maximum size. The limit is updated per ops update interval, because vaddr updates the monitoring regions on the ops update callback. It does nothing for the beginning state. That's because the users can set the initial monitoring regions as they want. That is, if the users really care about the min_nr_regions, they are supposed to set the initial monitoring regions to have more than min_nr_regions regions. The virtual address space operation set, vaddr, has an exceptional case. Users can ask the ops set to configure the initial regions on its own. For the case, vaddr sets up the initial regions to meet the min_nr_regions. So, vaddr has exceptional support, but basically users are required to set the regions on their own if they want min_nr_regions to be respected. When 'min_nr_regions' is high, such initial setup is difficult. If DAMON sysfs interface is used for that, the memory for saving the initial setup is also a waste. Even if the user forgives the setup, DAMON will eventually make more than min_nr_regions regions by splitting operations. But it will take time. If the aggregation interval is long, the delay could be problematic. There was actually a report [1] of the case. The reporter wanted to do page granular monitoring with a large aggregation interval. Also, DAMON is doing nothing for online changes on monitoring regions and min_nr_regions. For example, the user can remove a monitoring region or increase min_nr_regions while DAMON is running. Split regions larger than the size at the beginning of the kdamond main loop, to fix the initial setup issue. Also do the split every aggregation interval, for online changes. This means the behavior is slightly changed. It is difficult to imagine a use case that actually depends on the old behavior, though. So this change is arguably fine. Note that the size limit is aligned by damon_ctx->min_region_sz and cannot be zero. That is, if min_nr_region is larger than the total size of monitoring regions divided by ->min_region_sz, that cannot be respected. Link: https://lkml.kernel.org/r/20260228222831.7232-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260228222831.7232-2-sj@kernel.org Link: https://lore.kernel.org/CAC5umyjmJE9SBqjbetZZecpY54bHpn2AvCGNv3aF6J=1cfoPXQ@mail.gmail.com [1] Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit 51d8c78be0c27ddb91bc2c0263941d8b30a47d3b Author: Ritesh Harjani (IBM) Date: Tue Feb 24 18:53:16 2026 +0530 mm/kasan: fix double free for kasan pXds kasan_free_pxd() assumes the page table is always struct page aligned. But that's not always the case for all architectures. E.g. In case of powerpc with 64K pagesize, PUD table (of size 4096) comes from slab cache named pgtable-2^9. Hence instead of page_to_virt(pxd_page()) let's just directly pass the start of the pxd table which is passed as the 1st argument. This fixes the below double free kasan issue seen with PMEM: radix-mmu: Mapped 0x0000047d10000000-0x0000047f90000000 with 2.00 MiB pages ================================================================== BUG: KASAN: double-free in kasan_remove_zero_shadow+0x9c4/0xa20 Free of addr c0000003c38e0000 by task ndctl/2164 CPU: 34 UID: 0 PID: 2164 Comm: ndctl Not tainted 6.19.0-rc1-00048-gea1013c15392 #157 VOLUNTARY Hardware name: IBM,9080-HEX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_012) hv:phyp pSeries Call Trace: dump_stack_lvl+0x88/0xc4 (unreliable) print_report+0x214/0x63c kasan_report_invalid_free+0xe4/0x110 check_slab_allocation+0x100/0x150 kmem_cache_free+0x128/0x6e0 kasan_remove_zero_shadow+0x9c4/0xa20 memunmap_pages+0x2b8/0x5c0 devm_action_release+0x54/0x70 release_nodes+0xc8/0x1a0 devres_release_all+0xe0/0x140 device_unbind_cleanup+0x30/0x120 device_release_driver_internal+0x3e4/0x450 unbind_store+0xfc/0x110 drv_attr_store+0x78/0xb0 sysfs_kf_write+0x114/0x140 kernfs_fop_write_iter+0x264/0x3f0 vfs_write+0x3bc/0x7d0 ksys_write+0xa4/0x190 system_call_exception+0x190/0x480 system_call_vectored_common+0x15c/0x2ec ---- interrupt: 3000 at 0x7fff93b3d3f4 NIP: 00007fff93b3d3f4 LR: 00007fff93b3d3f4 CTR: 0000000000000000 REGS: c0000003f1b07e80 TRAP: 3000 Not tainted (6.19.0-rc1-00048-gea1013c15392) MSR: 800000000280f033 CR: 48888208 XER: 00000000 <...> NIP [00007fff93b3d3f4] 0x7fff93b3d3f4 LR [00007fff93b3d3f4] 0x7fff93b3d3f4 ---- interrupt: 3000 The buggy address belongs to the object at c0000003c38e0000 which belongs to the cache pgtable-2^9 of size 4096 The buggy address is located 0 bytes inside of 4096-byte region [c0000003c38e0000, c0000003c38e1000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3c38c head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:c0000003bfd63e01 flags: 0x63ffff800000040(head|node=6|zone=0|lastcpupid=0x7ffff) page_type: f5(slab) raw: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000 raw: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01 head: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000 head: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01 head: 063ffff800000002 c00c000000f0e301 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected [ 138.953636] [ T2164] Memory state around the buggy address: [ 138.953643] [ T2164] c0000003c38dff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953652] [ T2164] c0000003c38dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953661] [ T2164] >c0000003c38e0000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953669] [ T2164] ^ [ 138.953675] [ T2164] c0000003c38e0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953684] [ T2164] c0000003c38e0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953692] [ T2164] ================================================================== [ 138.953701] [ T2164] Disabling lock debugging due to kernel taint Link: https://lkml.kernel.org/r/2f9135c7866c6e0d06e960993b8a5674a9ebc7ec.1771938394.git.ritesh.list@gmail.com Fixes: 0207df4fa1a8 ("kernel/memremap, kasan: make ZONE_DEVICE with work with KASAN") Signed-off-by: Ritesh Harjani (IBM) Reported-by: Venkat Rao Bagalkote Reviewed-by: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: "Ritesh Harjani (IBM)" Cc: Vincenzo Frascino Cc: Signed-off-by: Andrew Morton commit 3d56d7317b271a1a5030ebb135c58aedc4c0fd36 Author: Anshuman Khandual Date: Fri Feb 27 04:03:00 2026 +0000 mm: replace READ_ONCE() in pud_trans_unstable() Replace READ_ONCE() with the existing standard page table accessor for PUD aka pudp_get() in pud_trans_unstable(). This does not create any functional change for platforms that do not override pudp_get(), which still defaults to READ_ONCE(). Link: https://lkml.kernel.org/r/20260227040300.2091901-1-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Acked-by: David Hildenbrand (Arm) Acked-by: SeongJae Park Reviewed-by: Lorenzo Stoakes Cc: Mike Rapoport Signed-off-by: Andrew Morton commit 4d267106ab013aa7f21aeab0a5272ac952f31d22 Author: Anshuman Khandual Date: Fri Feb 27 06:12:04 2026 +0000 mm/debug_vm_pgtable: replace WRITE_ONCE() with pxd_clear() Replace WRITE_ONCE() with generic pxd_clear() to clear out the page table entries as required. Besides this does not cause any functional change as well. Link: https://lkml.kernel.org/r/20260227061204.2215395-1-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Suggested-by: Ryan Roberts Acked-by: David Hildenbrand (Arm) Ackeed-by: SeongJae Park Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 99573ef4ac30d4eae7a7937f0c9ea351991e3ccc Author: David Hildenbrand (Arm) Date: Fri Feb 27 22:29:52 2026 +0100 mm/pagewalk: drop FW_MIGRATION We removed the last user of FW_MIGRATION in commit 912aa825957f ("Revert "mm/ksm: convert break_ksm() from walk_page_range_vma() to folio_walk""). So let's remove FW_MIGRATION and assign FW_ZEROPAGE bit 0. Including leafops.h is no longer required. While at it, convert "expose_page" to "zeropage", as zeropages are now the only remaining use case for not exposing a page. Link: https://lkml.kernel.org/r/20260227212952.190691-1-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Cc: Lorenzo Stoakes Cc: "Liam R. Howlett" Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Signed-off-by: Andrew Morton commit 22aa3321992eee0a39fb465e5083f5b8b5e7a82a Author: Dev Jain Date: Fri Feb 27 20:05:01 2026 +0530 khugepaged: remove redundant index check for pmd-folios Claim: folio_order(folio) == HPAGE_PMD_ORDER => folio->index == start. Proof: Both loops in hpage_collapse_scan_file and collapse_file, which iterate on the xarray, have the invariant that start <= folio->index < start + HPAGE_PMD_NR ... (i) A folio is always naturally aligned in the pagecache, therefore folio_order == HPAGE_PMD_ORDER => IS_ALIGNED(folio->index, HPAGE_PMD_NR) == true ... (ii) thp_vma_allowable_order -> thp_vma_suitable_order requires that the virtual offsets in the VMA are aligned to the order, => IS_ALIGNED(start, HPAGE_PMD_NR) == true ... (iii) Combining (i), (ii) and (iii), the claim is proven. Therefore, remove this check. While at it, simplify the comments. Link: https://lkml.kernel.org/r/20260227143501.1488110-1-dev.jain@arm.com Signed-off-by: Dev Jain Acked-by: David Hildenbrand (Arm) Reviewed-by: Lance Yang Reviewed-by: Baolin Wang Reviewed-by: Lorenzo Stoakes Reviewed-by: Anshuman Khandual Cc: Barry Song Cc: Liam Howlett Cc: Nico Pache Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 1745ccbd2907db2bdaa843e4abccde4fdaccbe5d Author: SeongJae Park Date: Fri Feb 27 09:06:21 2026 -0800 mm/damon/core: do non-safe region walk on kdamond_apply_schemes() kdamond_apply_schemes() is using damon_for_each_region_safe(), which is safe for deallocation of the region inside the loop. However, the loop internal logic does not deallocate regions. Hence it is only wasting the next pointer. Also, it causes a problem. When an address filter is applied, and there is a region that intersects with the filter, the filter splits the region on the filter boundary. The intention is to let DAMOS apply action to only filtered-in address ranges. However, it is using damon_for_each_region_safe(), which sets the next region before the execution of the iteration. Hence, the region that split and now will be next to the previous region, is simply ignored. As a result, DAMOS applies the action to target regions bit slower than expected, when the address filter is used. Shouldn't be a big problem but definitely better to be fixed. damos_skip_charged_region() was working around the issue using a double pointer hack. Use damon_for_each_region(), which is safe for this use case. And drop the work around in damos_skip_charged_region(). Link: https://lkml.kernel.org/r/20260227170623.95384-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit e7e1a26b8ddf0c8df117cc5b211a81ce635a0613 Author: SeongJae Park Date: Fri Feb 27 09:06:20 2026 -0800 mm/damon/core: set quota-score histogram with core filters Patch series "mm/damon/core: improve DAMOS quota efficiency for core layer filters". Improve two below problematic behaviors of DAMOS that makes it less efficient when core layer filters are used. DAMOS generates the under-quota regions prioritization-purpose access temperature histogram [1] with only the scheme target access pattern. The DAMOS filters are ignored on the histogram, and this can result in the scheme not applied to eligible regions. For working around this, users had to use separate DAMON contexts. The memory tiering approaches are such examples. DAMOS splits regions that intersect with address filters, so that only filtered-out part of the region is skipped. But, the implementation is skipping the other part of the region that is not filtered out, too. As a result, DAMOS can work slower than expected. Improve the two inefficient behaviors with two patches, respectively. Read the patches for more details about the problem and how those are fixed. This patch (of 2): The histogram for under-quota region prioritization [1] is made for all regions that are eligible for the DAMOS target access pattern. When there are DAMOS filters, the prioritization-threshold access temperature that generated from the histogram could be inaccurate. For example, suppose there are three regions. Each region is 1 GiB. The access temperature of the regions are 100, 50, and 0. And a DAMOS scheme that targets _any_ access temperature with quota 2 GiB is being used. The histogram will look like below: temperature size of regions having >=temperature temperature 0 3 GiB 50 2 GiB 100 1 GiB Based on the histogram and the quota (2 GiB), DAMOS applies the action to only the regions having >=50 temperature. This is all good. Let's suppose the region of temperature 50 is excluded by a DAMOS filter. Regardless of the filter, DAMOS will try to apply the action on only regions having >=50 temperature. Because the region of temperature 50 is filtered out, the action is applied to only the region of temperature 100. Worse yet, suppose the filter is excluding regions of temperature 50 and 100. Then no action is really applied to any region, while the region of temperature 0 is there. People used to work around this by utilizing multiple contexts, instead of the core layer DAMOS filters. For example, DAMON-based memory tiering approaches including the quota auto-tuning based one [2] are using a DAMON context per NUMA node. If the above explained issue is effectively alleviated, those can be configured again to run with single context and DAMOS filters for applying the promotion and demotion to only specific NUMA nodes. Alleviate the problem by checking core DAMOS filters when generating the histogram. The reason to check only core filters is the overhead. While core filters are usually for coarse-grained filtering (e.g., target/address filters for process, NUMA, zone level filtering), operation layer filters are usually for fine-grained filtering (e.g., for anon page). Doing this for operation layer filters would cause significant overhead. There is no known use case that is affected by the operation layer filters-distorted histogram problem, though. Do this for only core filters for now. We will revisit this for operation layer filters in future. We might be able to apply a sort of sampling based operation layer filtering. After this fix is applied, for the first case that there is a DAMOS filter excluding the region of temperature 50, the histogram will be like below: temperature size of regions having >=temperature temperature 0 2 GiB 100 1 GiB And DAMOS will set the temperature threshold as 0, allowing both regions of temperatures 0 and 100 be applied. For the second case that there is a DAMOS filter excluding the regions of temperature 50 and 100, the histogram will be like below: temperature size of regions having >=temperature temperature 0 1 GiB And DAMOS will set the temperature threshold as 0, allowing the region of temperature 0 be applied. [1] 'Prioritization' section of Documentation/mm/damon/design.rst [2] commit 0e1c773b501f ("mm/damon/core: introduce damos quota goal metrics for memory node utilization") Link: https://lkml.kernel.org/r/20260227170623.95384-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260227170623.95384-2-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 8231e4c040fb0ddd37d66093281d197fd5000297 Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:56 2026 +0000 mm/slab: use compound_head() in page_slab() page_slab() contained an open-coded implementation of compound_head(). Replace the duplicated code with a direct call to compound_head(). Link: https://lkml.kernel.org/r/20260227194302.274384-19-kas@kernel.org Signed-off-by: Kiryl Shutsemau Acked-by: David Hildenbrand (Arm) Reviewed-by: Vlastimil Babka Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: WANG Xuerui Cc: Zi Yan Signed-off-by: Andrew Morton commit fed8676ca2b0195647046dfc955f86f53ab837f0 Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:55 2026 +0000 hugetlb: update vmemmap_dedup.rst Update the documentation regarding vmemmap optimization for hugetlb to reflect the changes in how the kernel maps the tail pages. Fake heads no longer exist. Remove their description. [kas@kernel.org: update vmemmap_dedup.rst] Link: https://lkml.kernel.org/r/20260302105630.303492-1-kas@kernel.org Link: https://lkml.kernel.org/r/20260227194302.274384-18-kas@kernel.org Signed-off-by: Kiryl Shutsemau Reviewed-by: Muchun Song Reviewed-by: David Hildenbrand (Arm) Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Zi Yan Signed-off-by: Andrew Morton commit 66b2a3d9ae460934fef5fd588077730f483e8c8c Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:54 2026 +0000 mm: remove the branch from compound_head() The compound_head() function is a hot path. For example, the zap path calls it for every leaf page table entry. Rewrite the helper function in a branchless manner to eliminate the risk of CPU branch misprediction. Link: https://lkml.kernel.org/r/20260227194302.274384-17-kas@kernel.org Signed-off-by: Kiryl Shutsemau Reviewed-by: Muchun Song Reviewed-by: Zi Yan Acked-by: David Hildenbrand (Arm) Reviewed-by: Vlastimil Babka Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: WANG Xuerui Signed-off-by: Andrew Morton commit da3e2d1ca43de56a83a806237b6be7e91cf07052 Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:53 2026 +0000 mm/hugetlb: remove hugetlb_optimize_vmemmap_key static key The hugetlb_optimize_vmemmap_key static key was used to guard fake head detection in compound_head() and related functions. It allowed skipping the fake head checks entirely when HVO was not in use. With fake heads eliminated and the detection code removed, the static key serves no purpose. Remove its definition and all increment/decrement calls. Link: https://lkml.kernel.org/r/20260227194302.274384-16-kas@kernel.org Signed-off-by: Kiryl Shutsemau Reviewed-by: Muchun Song Acked-by: David Hildenbrand (Arm) Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Zi Yan Signed-off-by: Andrew Morton commit 01b1d0ffb6f7f37f466033cf167959946309ed3d Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:52 2026 +0000 hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU The VMEMMAP_SYNCHRONIZE_RCU flag triggered synchronize_rcu() calls to prevent a race between HVO remapping and page_ref_add_unless(). The race could occur when a speculative PFN walker tried to modify the refcount on a struct page that was in the process of being remapped to a fake head. With fake heads eliminated, page_ref_add_unless() no longer needs RCU protection. Remove the flag and synchronize_rcu() calls. Link: https://lkml.kernel.org/r/20260227194302.274384-15-kas@kernel.org Signed-off-by: Kiryl Shutsemau Reviewed-by: Muchun Song Reviewed-by: David Hildenbrand (Arm) Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Zi Yan Signed-off-by: Andrew Morton commit 32c440d67e6cd96a715007d0e62eb970b0c49abc Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:51 2026 +0000 mm: drop fake head checks With fake head pages eliminated in the previous commit, remove the supporting infrastructure: - page_fixed_fake_head(): no longer needed to detect fake heads; - page_is_fake_head(): no longer needed; - page_count_writable(): no longer needed for RCU protection; - RCU read_lock in page_ref_add_unless(): no longer needed; This substantially simplifies compound_head() and page_ref_add_unless(), removing both branches and RCU overhead from these hot paths. RCU was required to serialize allocation of hugetlb page against get_page_unless_zero() and prevent writing to read-only fake head. It is redundant without fake heads. See bd225530a4c7 ("mm/hugetlb_vmemmap: fix race with speculative PFN walkers") for more details. synchronize_rcu() in mm/hugetlb_vmemmap.c will be removed by a separate patch. Link: https://lkml.kernel.org/r/20260227194302.274384-14-kas@kernel.org Signed-off-by: Kiryl Shutsemau Reviewed-by: Muchun Song Acked-by: David Hildenbrand (Arm) Reviewed-by: Vlastimil Babka Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: WANG Xuerui Cc: Zi Yan Signed-off-by: Andrew Morton commit 622026e87c4019e609010811757e31193cc23847 Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:50 2026 +0000 mm/hugetlb: remove fake head pages HugeTLB Vmemmap Optimization (HVO) reduces memory usage by freeing most vmemmap pages for huge pages and remapping the freed range to a single page containing the struct page metadata. With the new mask-based compound_info encoding (for power-of-2 struct page sizes), all tail pages of the same order are now identical regardless of which compound page they belong to. This means the tail pages can be truly shared without fake heads. Allocate a single page of initialized tail struct pages per zone per order in the vmemmap_tails[] array in struct zone. All huge pages of that order in the zone share this tail page, mapped read-only into their vmemmap. The head page remains unique per huge page. Redefine MAX_FOLIO_ORDER using ilog2(). The define has to produce a compile-constant as it is used to specify vmemmap_tail array size. For some reason, compiler is not able to solve get_order() at compile-time, but ilog2() works. Avoid PUD_ORDER to define MAX_FOLIO_ORDER as it adds dependency to which generates hard-to-break include loop. This eliminates fake heads while maintaining the same memory savings, and simplifies compound_head() by removing fake head detection. Link: https://lkml.kernel.org/r/20260227194302.274384-13-kas@kernel.org Signed-off-by: Kiryl Shutsemau Reviewed-by: Vlastimil Babka (SUSE) Acked-by: David Hildenbrand (Arm) Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: WANG Xuerui Cc: Zi Yan Signed-off-by: Andrew Morton commit 76351f2f0c27b36600caa8767bc384745f51c7de Author: Kiryl Shutsemau (Meta) Date: Fri Feb 27 19:42:49 2026 +0000 x86/vdso: undefine CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP for vdso32 The 32-bit VDSO build on x86_64 uses fake_32bit_build.h to undefine various kernel configuration options that are not suitable for the VDSO context or may cause build issues when including kernel headers. Undefine CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP in fake_32bit_build.h to prepare for change in HugeTLB Vmemmap Optimization. Link: https://lkml.kernel.org/r/20260227194302.274384-12-kas@kernel.org Signed-off-by: Kiryl Shutsemau (Meta) Acked-by: David Hildenbrand (Arm) Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Zi Yan Signed-off-by: Andrew Morton commit c0b495b91a47b6c5ee54cf00e620dbadeb884253 Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:48 2026 +0000 mm/hugetlb: refactor code around vmemmap_walk To prepare for removing fake head pages, the vmemmap_walk code is being reworked. The reuse_page and reuse_addr variables are being eliminated. There will no longer be an expectation regarding the reuse address in relation to the operated range. Instead, the caller will provide head and tail vmemmap pages. Currently, vmemmap_head and vmemmap_tail are set to the same page, but this will change in the future. The only functional change is that __hugetlb_vmemmap_optimize_folio() will abandon optimization if memory allocation fails. Link: https://lkml.kernel.org/r/20260227194302.274384-11-kas@kernel.org Signed-off-by: Kiryl Shutsemau Reviewed-by: Muchun Song Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Hildenbrand (arm) Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Zi Yan Signed-off-by: Andrew Morton commit 209e6d9eb13aaf1b6e0fc6f76afc00d055e5ba12 Author: Kiryl Shutsemau (Meta) Date: Fri Feb 27 19:42:47 2026 +0000 mm/hugetlb: defer vmemmap population for bootmem hugepages Currently, the vmemmap for bootmem-allocated gigantic pages is populated early in hugetlb_vmemmap_init_early(). However, the zone information is only available after zones are initialized. If it is later discovered that a page spans multiple zones, the HVO mapping must be undone and replaced with a normal mapping using vmemmap_undo_hvo(). Defer the actual vmemmap population to hugetlb_vmemmap_init_late(). At this stage, zones are already initialized, so it can be checked if the page is valid for HVO before deciding how to populate the vmemmap. This allows us to remove vmemmap_undo_hvo() and the complex logic required to rollback HVO mappings. In hugetlb_vmemmap_init_late(), if HVO population fails or if the zones are invalid, fall back to a normal vmemmap population. Postponing population until hugetlb_vmemmap_init_late() also makes zone information available from within vmemmap_populate_hvo(). Link: https://lkml.kernel.org/r/20260227194302.274384-10-kas@kernel.org Signed-off-by: Kiryl Shutsemau (Meta) Acked-by: David Hildenbrand (Arm) Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Zi Yan Signed-off-by: Andrew Morton commit 9f94db4c7eaa1737171ec80df20c33eab04c3703 Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:46 2026 +0000 mm/sparse: check memmap alignment for compound_info_has_mask() If page->compound_info encodes a mask, it is expected that vmemmap to be naturally aligned to the maximum folio size. Add a VM_WARN_ON_ONCE() to check the alignment. Link: https://lkml.kernel.org/r/20260227194302.274384-9-kas@kernel.org Signed-off-by: Kiryl Shutsemau Acked-by: Zi Yan Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Hildenbrand (arm) Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: Vlastimil Babka Cc: WANG Xuerui Signed-off-by: Andrew Morton commit 8c846c879e226c312c2c7a7bc1e323779903530f Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:45 2026 +0000 mm: rework compound_head() for power-of-2 sizeof(struct page) For tail pages, the kernel uses the 'compound_info' field to get to the head page. The bit 0 of the field indicates whether the page is a tail page, and if set, the remaining bits represent a pointer to the head page. For cases when size of struct page is power-of-2, change the encoding of compound_info to store a mask that can be applied to the virtual address of the tail page in order to access the head page. It is possible because struct page of the head page is naturally aligned with regards to order of the page. The significant impact of this modification is that all tail pages of the same order will now have identical 'compound_info', regardless of the compound page they are associated with. This paves the way for eliminating fake heads. The HugeTLB Vmemmap Optimization (HVO) creates fake heads and it is only applied when the sizeof(struct page) is power-of-2. Having identical tail pages allows the same page to be mapped into the vmemmap of all pages, maintaining memory savings without fake heads. If sizeof(struct page) is not power-of-2, there is no functional changes. Limit mask usage to HugeTLB vmemmap optimization (HVO) where it makes a difference. The approach with mask would work in the wider set of conditions, but it requires validating that struct pages are naturally aligned for all orders up to the MAX_FOLIO_ORDER, which can be tricky. Link: https://lkml.kernel.org/r/20260227194302.274384-8-kas@kernel.org Signed-off-by: Kiryl Shutsemau Reviewed-by: Muchun Song Reviewed-by: Zi Yan Acked-by: David Hildenbrand (Arm) Acked-by: Usama Arif Reviewed-by: Vlastimil Babka Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: WANG Xuerui Signed-off-by: Andrew Morton commit 2969b42c8f994330fc020ec0d235aeb43bce317c Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:44 2026 +0000 LoongArch/mm: align vmemmap to maximal folio size The upcoming change to the HugeTLB vmemmap optimization (HVO) requires struct pages of the head page to be naturally aligned with regard to the folio size. Align vmemmap to MAX_FOLIO_VMEMMAP_ALIGN. Link: https://lkml.kernel.org/r/20260227194302.274384-7-kas@kernel.org Signed-off-by: Kiryl Shutsemau Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Hildenbrand (arm) Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Zi Yan Signed-off-by: Andrew Morton commit 476849b0fba4450f5adf22196bcff9c24c673bc4 Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:43 2026 +0000 riscv/mm: align vmemmap to maximal folio size The upcoming change to the HugeTLB vmemmap optimization (HVO) requires struct pages of the head page to be naturally aligned with regard to the folio size. Align vmemmap to the newly introduced MAX_FOLIO_VMEMMAP_ALIGN. Link: https://lkml.kernel.org/r/20260227194302.274384-6-kas@kernel.org Signed-off-by: Kiryl Shutsemau Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Hildenbrand (arm) Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Zi Yan Signed-off-by: Andrew Morton commit 67c79a5af051f57339ecf383d3f67e200741ce20 Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:42 2026 +0000 mm: move set/clear_compound_head() next to compound_head() Move set_compound_head() and clear_compound_head() to be adjacent to the compound_head() function in page-flags.h. These functions encode and decode the same compound_info field, so keeping them together makes it easier to verify their logic is consistent, especially when the encoding changes. Link: https://lkml.kernel.org/r/20260227194302.274384-5-kas@kernel.org Signed-off-by: Kiryl Shutsemau Reviewed-by: Muchun Song Reviewed-by: Zi Yan Acked-by: David Hildenbrand (arm) Reviewed-by: Vlastimil Babka Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: WANG Xuerui Signed-off-by: Andrew Morton commit d50569612c29215c5d1c64f47a65604ed265d2e9 Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:41 2026 +0000 mm: rename the 'compound_head' field in the 'struct page' to 'compound_info' The 'compound_head' field in the 'struct page' encodes whether the page is a tail and where to locate the head page. Bit 0 is set if the page is a tail, and the remaining bits in the field point to the head page. As preparation for changing how the field encodes information about the head page, rename the field to 'compound_info'. Link: https://lkml.kernel.org/r/20260227194302.274384-4-kas@kernel.org Signed-off-by: Kiryl Shutsemau Reviewed-by: Muchun Song Reviewed-by: Zi Yan Acked-by: David Hildenbrand (arm) Reviewed-by: Vlastimil Babka Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: WANG Xuerui Signed-off-by: Andrew Morton commit f0369fb13619569ba8564ce8d4fc9d385bbee8a2 Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:40 2026 +0000 mm: change the interface of prep_compound_tail() Instead of passing down the head page and tail page index, pass the tail and head pages directly, as well as the order of the compound page. This is a preparation for changing how the head position is encoded in the tail page. Link: https://lkml.kernel.org/r/20260227194302.274384-3-kas@kernel.org Signed-off-by: Kiryl Shutsemau Reviewed-by: Muchun Song Reviewed-by: Zi Yan Acked-by: David Hildenbrand (arm) Reviewed-by: Vlastimil Babka Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: Usama Arif Cc: WANG Xuerui Signed-off-by: Andrew Morton commit a2c77ec320a99581e8272868ccfa53a7d7a7b168 Author: Kiryl Shutsemau Date: Fri Feb 27 19:42:39 2026 +0000 mm: move MAX_FOLIO_ORDER definition to mmzone.h Patch series "mm: Eliminate fake head pages from vmemmap optimization", v7. This series removes "fake head pages" from the HugeTLB vmemmap optimization (HVO) by changing how tail pages encode their relationship to the head page. It simplifies compound_head() and page_ref_add_unless(). Both are in the hot path. Background ========== HVO reduces memory overhead by freeing vmemmap pages for HugeTLB pages and remapping the freed virtual addresses to a single physical page. Previously, all tail page vmemmap entries were remapped to the first vmemmap page (containing the head struct page), creating "fake heads" - tail pages that appear to have PG_head set when accessed through the deduplicated vmemmap. This required special handling in compound_head() to detect and work around fake heads, adding complexity and overhead to a very hot path. New Approach ============ For architectures/configs where sizeof(struct page) is a power of 2 (the common case), this series changes how position of the head page is encoded in the tail pages. Instead of storing a pointer to the head page, the ->compound_info (renamed from ->compound_head) now stores a mask. The mask can be applied to any tail page's virtual address to compute the head page address. Critically, all tail pages of the same order now have identical compound_info values, regardless of which compound page they belong to. The key insight is that all tail pages of the same order now have identical compound_info values, regardless of which compound page they belong to. In v7, these shared tail pages are allocated per-zone. This ensures that zone information (stored in page->flags) is correct even for shared tail pages, removing the need for the special-casing in page_zonenum() proposed in earlier versions. To support per-zone shared pages for boot-allocated gigantic pages, the vmemmap population is deferred until zones are initialized. This simplifies the logic significantly and allows the removal of vmemmap_undo_hvo(). Benefits ======== 1. Simplified compound_head(): No fake head detection needed, can be implemented in a branchless manner. 2. Simplified page_ref_add_unless(): RCU protection removed since there's no race with fake head remapping. 3. Cleaner architecture: The shared tail pages are truly read-only and contain valid tail page metadata. If sizeof(struct page) is not power-of-2, there are no functional changes. HVO is not supported in this configuration. I had hoped to see performance improvement, but my testing thus far has shown either no change or only a slight improvement within the noise. Series Organization =================== Patch 1: Move MAX_FOLIO_ORDER definition to mmzone.h. Patches 2-4: Refactoring of field names and interfaces. Patches 5-6: Architecture alignment for LoongArch and RISC-V. Patch 7: Mask-based compound_head() implementation. Patch 8: Add memmap alignment checks. Patch 9: Branchless compound_head() optimization. Patch 10: Defer vmemmap population for bootmem hugepages. Patch 11: Refactor vmemmap_walk. Patch 12: x86 vDSO build fix. Patch 13: Eliminate fake heads with per-zone shared tail pages. Patches 14-16: Cleanup of fake head infrastructure. Patch 17: Documentation update. Patch 18: Use compound_head() in page_slab(). This patch (of 17): Move MAX_FOLIO_ORDER definition from mm.h to mmzone.h. This is preparation for adding the vmemmap_tails array to struct zone, which requires MAX_FOLIO_ORDER to be available in mmzone.h. Link: https://lkml.kernel.org/r/20260227194302.274384-1-kas@kernel.org Link: https://lkml.kernel.org/r/20260227194302.274384-2-kas@kernel.org Signed-off-by: Kiryl Shutsemau Acked-by: David Hildenbrand (Red Hat) Acked-by: Zi Yan Acked-by: Muchun Song Acked-by: Usama Arif Reviewed-by: Vlastimil Babka Cc: Albert Ou Cc: Alexandre Ghiti Cc: Baoquan He Cc: Christoph Lameter Cc: David Rientjes Cc: Frank van der Linden Cc: Harry Yoo Cc: Huacai Chen Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Roman Gushchin Cc: WANG Xuerui Signed-off-by: Andrew Morton commit c09fb53d293a05adf1b53c800273273e59413f39 Author: gao xu Date: Thu Feb 26 12:37:22 2026 +0000 zram: use statically allocated compression algorithm names Currently, zram dynamically allocates memory for compressor algorithm names when they are set by the user. This requires careful memory management, including explicit `kfree` calls and special handling to avoid freeing statically defined default compressor names. This patch refactors the way zram handles compression algorithm names. Instead of storing dynamically allocated copies, `zram->comp_algs` will now store pointers directly to the static name strings defined within the `zcomp_ops` backend structures, thereby removing the need for conditional `kfree` calls. Link: https://lkml.kernel.org/r/5bb2e9318d124dbcb2b743dcdce6a950@honor.com Signed-off-by: gao xu Reviewed-by: Sergey Senozhatsky Cc: Jens Axboe Cc: Minchan Kim Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 511f04aac469a3ae04f7f2588101020aebb19c90 Author: Tal Zussman Date: Wed Feb 25 18:44:28 2026 -0500 folio_batch: rename PAGEVEC_SIZE to FOLIO_BATCH_SIZE struct pagevec no longer exists. Rename the macro appropriately. Link: https://lkml.kernel.org/r/20260225-pagevec_cleanup-v2-4-716868cc2d11@columbia.edu Signed-off-by: Tal Zussman Acked-by: David Hildenbrand (Arm) Reviewed-by: Jan Kara Acked-by: Zi Yan Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Chris Li Cc: Christian Brauner Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 4e1d77a8f382a0ef4dd7732bb1986c8143600def Author: Tal Zussman Date: Wed Feb 25 18:44:27 2026 -0500 folio_batch: rename pagevec.h to folio_batch.h struct pagevec was removed in commit 1e0877d58b1e ("mm: remove struct pagevec"). Rename include/linux/pagevec.h to reflect reality and update includes tree-wide. Add the new filename to MAINTAINERS explicitly, as it no longer matches the "include/linux/page[-_]*" pattern in MEMORY MANAGEMENT - CORE. Link: https://lkml.kernel.org/r/20260225-pagevec_cleanup-v2-3-716868cc2d11@columbia.edu Signed-off-by: Tal Zussman Acked-by: David Hildenbrand (Arm) Reviewed-by: Jan Kara Acked-by: Zi Yan Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Chris Li Cc: Christian Brauner Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit ab5193e919bbc2577bf404983b2c0ee3c6d3ef83 Author: Tal Zussman Date: Wed Feb 25 18:44:26 2026 -0500 fs: remove unncessary pagevec.h includes Remove unused pagevec.h includes from .c files. These were found with the following command: grep -rl '#include.*pagevec\.h' --include='*.c' | while read f; do grep -qE 'PAGEVEC_SIZE|folio_batch' "$f" || echo "$f" done There are probably more removal candidates in .h files, but those are more complex to analyze. Link: https://lkml.kernel.org/r/20260225-pagevec_cleanup-v2-2-716868cc2d11@columbia.edu Signed-off-by: Tal Zussman Reviewed-by: Jan Kara Acked-by: Zi Yan Acked-by: Chris Li Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Christian Brauner Cc: David Hildenbrand (Arm) Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit cbf56f9981014ee48ae9b9e2254f31d1642b8f8f Author: Tal Zussman Date: Wed Feb 25 18:44:25 2026 -0500 mm: remove stray references to struct pagevec Patch series "mm: Remove stray references to pagevec", v2. struct pagevec was removed in commit 1e0877d58b1e ("mm: remove struct pagevec"). Remove any stray references to it and rename relevant files and macros accordingly. While at it, remove unnecessary #includes of pagevec.h (now folio_batch.h) in .c files. There are probably more of these that could be removed in .h files, but those are more complex to verify. This patch (of 4): struct pagevec was removed in commit 1e0877d58b1e ("mm: remove struct pagevec"). Remove remaining forward declarations and change __folio_batch_release()'s declaration to match its definition. Link: https://lkml.kernel.org/r/20260225-pagevec_cleanup-v2-0-716868cc2d11@columbia.edu Link: https://lkml.kernel.org/r/20260225-pagevec_cleanup-v2-1-716868cc2d11@columbia.edu Signed-off-by: Tal Zussman Reviewed-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand (Arm) Acked-by: Chris Li Acked-by: Zi Yan Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Christian Brauner Cc: Jan Kara Signed-off-by: Andrew Morton commit 019fc36872374db6fd35e118c9e935374404bfbf Author: Pasha Tatashin Date: Wed Feb 25 17:38:57 2026 -0500 kho: fix KASAN support for restored vmalloc regions Restored vmalloc regions are currently not properly marked for KASAN, causing KASAN to treat accesses to these regions as out-of-bounds. Fix this by properly unpoisoning the restored vmalloc area using kasan_unpoison_vmalloc(). This requires setting the VM_UNINITIALIZED flag during the initial area allocation and clearing it after the pages have been mapped and unpoisoned, using the clear_vm_uninitialized_flag() helper. Link: https://lkml.kernel.org/r/20260225223857.1714801-3-pasha.tatashin@soleen.com Fixes: a667300bd53f ("kho: add support for preserving vmalloc allocations") Signed-off-by: Pasha Tatashin Reported-by: Pratyush Yadav Reviewed-by: Pratyush Yadav (Google) Tested-by: Pratyush Yadav (Google) Cc: Alexander Graf Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: "Uladzislau Rezki (Sony)" Signed-off-by: Andrew Morton commit ec106365394dc6c4e9ecf00842186d367dcc955a Author: Pasha Tatashin Date: Wed Feb 25 17:38:56 2026 -0500 mm/vmalloc: export clear_vm_uninitialized_flag() Patch series "Fix KASAN support for KHO restored vmalloc regions". When KHO restores a vmalloc area, it maps existing physical pages into a newly allocated virtual memory area. However, because these areas were not properly unpoisoned, KASAN would treat any access to the restored region as out-of-bounds, as seen in the following trace: BUG: KASAN: vmalloc-out-of-bounds in kho_test_restore_data.isra.0+0x17b/0x2cd Read of size 8 at addr ffffc90000025000 by task swapper/0/1 [...] Call Trace: [...] kasan_report+0xe8/0x120 kho_test_restore_data.isra.0+0x17b/0x2cd kho_test_init+0x15a/0x1f0 do_one_initcall+0xd5/0x4b0 The fix involves deferring KASAN's default poisoning by using the VM_UNINITIALIZED flag during allocation, manually unpoisoning the memory once it is correctly mapped, and then clearing the uninitialized flag using a newly exported helper. This patch (of 2): Make clear_vm_uninitialized_flag() available to other parts of the kernel that need to manage vmalloc areas manually, such as KHO for restoring vmallocs. Link: https://lkml.kernel.org/r/20260225220223.1695350-1-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20260225223857.1714801-2-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Acked-by: Pratyush Yadav (Google) Cc: Alexander Graf Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: "Uladzislau Rezki (Sony)" Signed-off-by: Andrew Morton commit da735962d05c4e7ffc68e02c0cb2459f837a0f51 Author: Marco Elver Date: Wed Feb 25 21:36:05 2026 +0100 kfence: add kfence.fault parameter Add kfence.fault parameter to control the behavior when a KFENCE error is detected (similar in spirit to kasan.fault=). The supported modes for kfence.fault= are: - report: print the error report and continue (default). - oops: print the error report and oops. - panic: print the error report and panic. In particular, the 'oops' mode offers a trade-off between no mitigation on report and panicking outright (if panic_on_oops is not set). Link: https://lkml.kernel.org/r/20260225203639.3159463-1-elver@google.com Signed-off-by: Marco Elver Reviewed-by: Alexander Potapenko Cc: Dmitry Vyukov Cc: Jonathan Corbet Cc: Kees Cook Cc: Shuah Khan Signed-off-by: Andrew Morton commit 3efb9800557b855b493dc98d22c5e57974ac1593 Author: Catalin Marinas Date: Wed Feb 25 16:14:02 2026 +0000 mm: do not map the shadow stack as THP The default shadow stack size allocated on first prctl() for the main thread or subsequently on clone() is either half of RLIMIT_STACK or half of a thread's stack size (for arm64). Both of these are likely to be suitable for a THP allocation and the kernel is more aggressive in creating such mappings. However, it does not make much sense to use a huge page. It didn't make sense for the normal stacks either, see commit c4608d1bf7c6 ("mm: mmap: map MAP_STACK to VM_NOHUGEPAGE"). Force VM_NOHUGEPAGE when allocating/mapping the shadow stack. As per commit 7190b3c8bd2b ("mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled"), only pass this flag if TRANSPARENT_HUGEPAGE is enabled as not to confuse CRIU tools. Link: https://lkml.kernel.org/r/20260225161404.3157851-6-catalin.marinas@arm.com Signed-off-by: Catalin Marinas Tested-by: Deepak Gupta Reviewed-by: Mark Brown Acked-by: David Hildenbrand (Arm) Cc: Albert Ou Cc: Alexandre Ghiti Cc: "Borislav Petkov (AMD)" Cc: Dave Hansen Cc: "Edgecombe, Rick P" Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit a515ffc9de96f86318bc44e2ba702c4b5fdbd5bb Author: Catalin Marinas Date: Wed Feb 25 16:14:01 2026 +0000 x86: shstk: use the new common vm_mmap_shadow_stack() helper Replace part of the x86 alloc_shstk() content with a call to vm_mmap_shadow_stack(). There is no functional change. Link: https://lkml.kernel.org/r/20260225161404.3157851-5-catalin.marinas@arm.com Signed-off-by: Catalin Marinas Reviewed-by: Rick Edgecombe Tested-by: Rick Edgecombe Reviewed-by: David Hildenbrand (Arm) Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: H. Peter Anvin Cc: Albert Ou Cc: Alexandre Ghiti Cc: Deepak Gupta Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Michal Hocko Cc: Mike Rapoport Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit fecd446f0ca44e9b2c38efea99cfc54fd4517f75 Author: Catalin Marinas Date: Wed Feb 25 16:14:00 2026 +0000 riscv: shstk: use the new common vm_mmap_shadow_stack() helper Replace part of the allocate_shadow_stack() content with a call to vm_mmap_shadow_stack(). There is no functional change. Link: https://lkml.kernel.org/r/20260225161404.3157851-4-catalin.marinas@arm.com Signed-off-by: Catalin Marinas Tested-by: Deepak Gupta Reviewed-by: David Hildenbrand (Arm) Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: "Borislav Petkov (AMD)" Cc: Dave Hansen Cc: "Edgecombe, Rick P" Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 845e0af36235d893c34218cb629618168f8f34b4 Author: Catalin Marinas Date: Wed Feb 25 16:13:59 2026 +0000 arm64: gcs: use the new common vm_mmap_shadow_stack() helper Replace the arm64 map_shadow_stack() content with a call to vm_mmap_shadow_stack(). There is no functional change. Link: https://lkml.kernel.org/r/20260225161404.3157851-3-catalin.marinas@arm.com Signed-off-by: Catalin Marinas Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Mark Brown Cc: Will Deacon Cc: Albert Ou Cc: Alexandre Ghiti Cc: "Borislav Petkov (AMD)" Cc: Dave Hansen Cc: Deepak Gupta Cc: "Edgecombe, Rick P" Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2b8acf8450f577d3785dacfd616630b76dc8f88d Author: Catalin Marinas Date: Wed Feb 25 16:13:58 2026 +0000 mm: introduce vm_mmap_shadow_stack() as a helper for VM_SHADOW_STACK mappings Patch series "mm: arch/shstk: Common shadow stack mapping helper and VM_NOHUGEPAGE", v2. A series to extract the common shadow stack mmap into a separate helper for arm64, riscv and x86. This patch (of 5): arm64, riscv and x86 use a similar pattern for mapping the user shadow stack (cloned from x86). Extract this into a helper to facilitate code reuse. The call to do_mmap() from the new helper uses PROT_READ|PROT_WRITE prot bits instead of the PROT_READ with an explicit VM_WRITE vm_flag. The x86 intent was to avoid PROT_WRITE implying normal write since the shadow stack is not writable by normal stores. However, from a kernel perspective, the vma is writeable. Functionally there is no difference. Link: https://lkml.kernel.org/r/20260225161404.3157851-1-catalin.marinas@arm.com Link: https://lkml.kernel.org/r/20260225161404.3157851-2-catalin.marinas@arm.com Signed-off-by: Catalin Marinas Tested-by: Deepak Gupta Reviewed-by: Mark Brown Acked-by: David Hildenbrand (Arm) Reviewed-by: Mike Rapoport (Microsoft) Cc: Albert Ou Cc: Alexandre Ghiti Cc: "Borislav Petkov (AMD)" Cc: "Edgecombe, Rick P" Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Palmer Dabbelt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Cc: Dave Hansen Cc: Paul Walmsley Cc: Thomas Gleixner Signed-off-by: Andrew Morton commit 03375203e1da8f4782ec5cd7023eb1b4adfba739 Author: Michal Koutný Date: Wed Feb 25 19:38:44 2026 +0100 mm: do not allocate shrinker info with cgroup.memory=nokmem There'd be no work for memcg-aware shrinkers when kernel memory is not accounted per cgroup, so we can skip allocating per memcg shrinker data. This saves some memory, avoids holding shrinker_mutex with O(nr_memcgs) and saves work in shrink_slab_memcg(). Then there are SHRINKER_NONSLAB shrinkers which handle non-kernel memory so nokmem should not disable their per-memcg behavior. Such shrinkers (e.g. deferred_split_shrinker) still need access to per-memcg data (see also commit 0a432dcbeb32e ("mm: shrinker: make shrinker not depend on memcg kmem")). The savings with this patch come on container hosts that create many superblocks (each with own shrinker) but tracking and processing per-memcg data is pointless with nokmem (shrink_slab_memcg() is partially guarded with !memcg_kmem_online already). The patch uses "boottime" predicate mem_cgroup_kmem_disabled() (not memcg_kmem_online()) to avoid mistakenly un-MEMCG_AWARE-ing shrinkers registered before first non-root memcg is mkdir'd. [mkoutny@suse.com: update comment, per Qi Zheng] Link: https://lkml.kernel.org/r/20260309-cgroup-ml-nokmem-shrinker-v2-1-3e7a7eefb6c9@suse.com Link: https://lkml.kernel.org/r/20260225-cgroup-ml-nokmem-shrinker-v1-1-d703899bdda4@suse.com Signed-off-by: Michal Koutný Reviewed-by: Roman Gushchin Acked-by: Qi Zheng Reviewed-by: Muchun Song Cc: Dave Chinner Cc: Jan Kara Signed-off-by: Andrew Morton commit db3df34e5bdd5383e011f113d5ea2199e6c875f2 Author: Youngjun Park Date: Thu Feb 26 10:07:39 2026 +0900 MAINTAINERS: add Youngjun Park as reviewer for SWAP Recently, I have been actively contributing to the swap subsystem through works such as swap-tier patches and flash friendly swap proposal. During this process, I have consistently reviewed swap table code, some other patches and fixed several bugs. As I am already CC'd on many patches and maintaining active interest in ongoing developments, I would like to officially add myself as a reviewer. I am committed to contributing to the kernel community with greater responsibility. Link: https://lkml.kernel.org/r/20260226010739.3773838-1-youngjun.park@lge.com Signed-off-by: Youngjun Park Reviewed-by: Barry Song Acked-by: Kairui Song Acked-by: Chris Li Acked-by: Baoquan He Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit 1fb3d8c20bfadbbe2d9e5de18074de9282a52b5f Author: Lance Yang Date: Tue Feb 24 22:21:01 2026 +0800 mm/mmu_gather: replace IPI with synchronize_rcu() when batch allocation fails When freeing page tables, we try to batch them. If batch allocation fails (GFP_NOWAIT), __tlb_remove_table_one() immediately frees the one without batching. On !CONFIG_PT_RECLAIM, the fallback sends an IPI to all CPUs via tlb_remove_table_sync_one(). It disrupts all CPUs even when only a single process is unmapping memory. IPI broadcast was reported to hurt RT workloads[1]. tlb_remove_table_sync_one() synchronizes with lockless page-table walkers (e.g. GUP-fast) that rely on IRQ disabling. These walkers use local_irq_disable(), which is also an RCU read-side critical section. This patch introduces tlb_remove_table_sync_rcu() which uses RCU grace period (synchronize_rcu()) instead of IPI broadcast. This provides the same guarantee as IPI but without disrupting all CPUs. Since batch allocation already failed, we are in a slow path where sleeping is acceptable - we are in process context (unmap_region, exit_mmap) with only mmap_lock held. tlb_remove_table_sync_one() is retained for other callers (e.g., khugepaged after pmdp_collapse_flush(), tlb_finish_mmu() when tlb->fully_unshared_tables) that are not slow paths. Converting those may require different approaches such as targeted IPIs. Link: https://lore.kernel.org/linux-mm/1b27a3fa-359a-43d0-bdeb-c31341749367@kernel.org/ [1] Link: https://lore.kernel.org/linux-mm/20260202150957.GD1282955@noisy.programming.kicks-ass.net/ Link: https://lore.kernel.org/linux-mm/dfdfeac9-5cd5-46fc-a5c1-9ccf9bd3502a@intel.com/ Link: https://lore.kernel.org/linux-mm/bc489455-bb18-44dc-8518-ae75abda6bec@kernel.org/ Link: https://lkml.kernel.org/r/20260224142101.20500-1-lance.yang@linux.dev Signed-off-by: Lance Yang Suggested-by: Peter Zijlstra (Intel) Suggested-by: Dave Hansen Suggested-by: David Hildenbrand (Arm) Acked-by: David Hildenbrand (Arm) Acked-by: Peter Zijlstra (Intel) Cc: Arnd Bergmann Cc: Nicholas Piggin Cc: Nick Piggin Cc: Will Deacon Signed-off-by: Andrew Morton commit 77a9c445b668765129f877d3c0d08ec4dc3ce77b Author: Thomas Ballasi Date: Mon Mar 16 09:09:08 2026 -0700 mm: vmscan: add PIDs to vmscan tracepoints The changes aims at adding additionnal tracepoints variables to help debuggers attribute them to specific processes. Link: https://lkml.kernel.org/r/20260316160908.42727-4-tballasi@linux.microsoft.com Signed-off-by: Thomas Ballasi Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Cc: Steven Rostedt (Google) Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 874a0a566ede40f3d6062cae8fe1022e616edd1a Author: Thomas Ballasi Date: Mon Mar 16 09:09:07 2026 -0700 mm: vmscan: add cgroup IDs to vmscan tracepoints Memory reclaim events are currently difficult to attribute to specific cgroups, making debugging memory pressure issues challenging. This patch adds memory cgroup ID (memcg_id) to key vmscan tracepoints to enable better correlation and analysis. For operations not associated with a specific cgroup, the field is defaulted to 0. Link: https://lkml.kernel.org/r/20260316160908.42727-3-tballasi@linux.microsoft.com Signed-off-by: Thomas Ballasi Acked-by: Shakeel Butt Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Qi Zheng Cc: Steven Rostedt (Google) Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit d8d68d8111d894cf2406c2eee814ce1f4cf9e939 Author: Steven Rostedt Date: Mon Mar 16 09:09:06 2026 -0700 tracing: add __event_in_*irq() helpers Patch series "mm: vmscan: add PID and cgroup ID to vmscan tracepoints", v8. This patch (of 3): Some trace events want to expose in their output if they were triggered in an interrupt or softirq context. Instead of recording this in the event structure itself, as this information is stored in the flags portion of the event header, add helper macros that can be used in the print format: TP_printk("val=%d %s", __entry->val, __event_in_irq() ? "(in-irq)" : "") This will output "(in-irq)" for the event in the trace data if the event was triggered in hard or soft interrupt context. Link: https://lkml.kernel.org/r/20260316160908.42727-1-tballasi@linux.microsoft.com Link: https://lore.kernel.org/all/20251229132942.31a2b583@gandalf.local.home/ Link: https://lkml.kernel.org/r/20260316160908.42727-2-tballasi@linux.microsoft.com Signed-off-by: Steven Rostedt (Google) Signed-off-by: Thomas Ballasi Reviewed-by: Shakeel Butt Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Qi Zheng Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit c466412c73c339e33e83b68770e5b556457c03de Author: Johannes Weiner Date: Mon Feb 23 11:01:07 2026 -0500 mm: memcontrol: switch to native NR_VMALLOC vmstat counter Eliminates the custom memcg counter and results in a single, consolidated accounting call in vmalloc code. Link: https://lkml.kernel.org/r/20260223160147.3792777-2-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Shakeel Butt Reviewed-by: Uladzislau Rezki (Sony) Reviewed-by: Roman Gushchin Reviewed-by: Vishal Moola (Oracle) Cc: Joshua Hahn Cc: Michal Hocko Cc: Muchun Song Cc: Shakeel Butt Signed-off-by: Andrew Morton commit b9ec0ed907062a67a7cca2d04e7652aec06a0c35 Author: Johannes Weiner Date: Mon Feb 23 11:01:06 2026 -0500 mm: vmalloc: streamline vmalloc memory accounting Use a vmstat counter instead of a custom, open-coded atomic. This has the added benefit of making the data available per-node, and prepares for cleaning up the memcg accounting as well. Link: https://lkml.kernel.org/r/20260223160147.3792777-1-hannes@cmpxchg.org Acked-by: Shakeel Butt Signed-off-by: Johannes Weiner Reviewed-by: Roman Gushchin Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Uladzislau Rezki (Sony) Cc: Joshua Hahn Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton commit 6b0dd42d7681af148e13df3806f251bc3dc7c36e Author: Jason Miu Date: Thu Feb 5 18:14:28 2026 -0800 kho: remove finalize state and clients Eliminate the `kho_finalize()` function and its associated state from the KHO subsystem. The transition to a radix tree for memory tracking makes the explicit "finalize" state and its serialization step obsolete. Remove the `kho_finalize()` and `kho_finalized()` APIs and their stub implementations. Update KHO client code and the debugfs interface to no longer call or depend on the `kho_finalize()` mechanism. Complete the move towards a stateless KHO, simplifying the overall design by removing unnecessary state management. Link: https://lkml.kernel.org/r/20260206021428.3386442-3-jasonmiu@google.com Signed-off-by: Jason Miu Reviewed-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: David Matlack Cc: David Rientjes Cc: Jason Gunthorpe Cc: Pratyush Yadav Cc: Ran Xiaokai Signed-off-by: Andrew Morton commit 3f2ad90060f65d6f66414b8a67c569154bafec7b Author: Jason Miu Date: Thu Feb 5 18:14:27 2026 -0800 kho: adopt radix tree for preserved memory tracking Patch series "Make KHO Stateless", v9. This series transitions KHO from an xarray-based metadata tracking system with serialization to a radix tree data structure that can be passed directly to the next kernel. The key motivations for this change are to: - Eliminate the need for data serialization before kexec. - Remove the KHO finalize state. - Pass preservation metadata more directly to the next kernel via the FDT. The new approach uses a radix tree to mark preserved pages. A page's physical address and its order are encoded into a single value. The tree is composed of multiple levels of page-sized tables, with leaf nodes being bitmaps where each set bit represents a preserved page. The physical address of the radix tree's root is passed in the FDT, allowing the next kernel to reconstruct the preserved memory map. This series is broken down into the following patches: 1. kho: Adopt radix tree for preserved memory tracking: Replaces the xarray-based tracker with the new radix tree implementation and increments the ABI version. 2. kho: Remove finalize state and clients: Removes the now-obsolete kho_finalize() function and its usage from client code and debugfs. This patch (of 2): Introduce a radix tree implementation for tracking preserved memory pages and switch the KHO memory tracking mechanism to use it. This lays the groundwork for a stateless KHO implementation that eliminates the need for serialization and the associated "finalize" state. This patch introduces the core radix tree data structures and constants to the KHO ABI. It adds the radix tree node and leaf structures, along with documentation for the radix tree key encoding scheme that combines a page's physical address and order. To support broader use by other kernel subsystems, such as hugetlb preservation, the core radix tree manipulation functions are exported as a public API. The xarray-based memory tracking is replaced with this new radix tree implementation. The core KHO preservation and unpreservation functions are wired up to use the radix tree helpers. On boot, the second kernel restores the preserved memory map by walking the radix tree whose root physical address is passed via the FDT. The ABI `compatible` version is bumped to "kho-v2" to reflect the structural changes in the preserved memory map and sub-FDT property names. This includes renaming "fdt" to "preserved-data" to better reflect that preserved state may use formats other than FDT. [ran.xiaokai@zte.com.cn: fix child node parsing for debugfs in/sub_fdts] Link: https://lkml.kernel.org/r/20260309033530.244508-1-ranxiaokai627@163.com Link: https://lkml.kernel.org/r/20260206021428.3386442-1-jasonmiu@google.com Link: https://lkml.kernel.org/r/20260206021428.3386442-2-jasonmiu@google.com Signed-off-by: Jason Miu Signed-off-by: Ran Xiaokai Reviewed-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: David Matlack Cc: David Rientjes Cc: Jason Gunthorpe Cc: Pratyush Yadav Cc: Ran Xiaokai Signed-off-by: Andrew Morton commit 63de231ef02afbe5b2a6277c3bdf8d0d7f7e1d21 Author: Pratyush Yadav (Google) Date: Fri Feb 13 09:59:12 2026 +0100 kho: move alloc tag init to kho_init_{folio,pages}() Commit 8f1081892d62 ("kho: simplify page initialization in kho_restore_page()") cleaned up the page initialization logic by moving the folio and 0-order-page paths into separate functions. It missed moving the alloc tag initialization. Do it now to keep the two paths cleanly separated. While at it, touch up the comments to be a tiny bit shorter (mainly so it doesn't end up splitting into a multiline comment). This is purely a cosmetic change and there should be no change in behaviour. Link: https://lkml.kernel.org/r/20260213085914.2778107-1-pratyush@kernel.org Signed-off-by: Pratyush Yadav (Google) Cc: Alexander Graf Cc: Mike Rapoport Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 514c2fe9927e91f44eb3f53f2e175d232bd2a989 Author: David Hildenbrand (Arm) Date: Mon Feb 23 17:39:20 2026 +0100 mm: centralize+fix comments about compound_mapcount() in new sync_with_folio_pmd_zap() We still mention compound_mapcount() in two comments. Instead of simply referring to the folio mapcount in both places, let's factor out the odd-looking PTL sync into sync_with_folio_pmd_zap(), and add centralized documentation why this is required. [akpm@linux-foundation.org: update comment per Matthew and David] Link: https://lkml.kernel.org/r/20260223163920.287720-1-david@kernel.org Signed-off-by: David Hildenbrand (Arm) Cc: Lorenzo Stoakes Cc: Liam Howlett Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Cc: Rik van Riel Cc: Harry Yoo Cc: Jann Horn Signed-off-by: Andrew Morton commit 05620419776ab07f1d057bdca5be846f263df1fd Author: Vernon Yang Date: Sat Feb 21 17:39:18 2026 +0800 mm: khugepaged: skip lazy-free folios For example, create three task: hot1 -> cold -> hot2. After all three task are created, each allocate memory 128MB. the hot1/hot2 task continuously access 128 MB memory, while the cold task only accesses its memory briefly and then call madvise(MADV_FREE). However, khugepaged still prioritizes scanning the cold task and only scans the hot2 task after completing the scan of the cold task. All folios in VM_DROPPABLE are lazyfree, Collapsing maintains that property, so we can just collapse and memory pressure in the future will free it up. In contrast, collapsing in !VM_DROPPABLE does not maintain that property, the collapsed folio will not be lazyfree and memory pressure in the future will not be able to free it up. So if the user has explicitly informed us via MADV_FREE that this memory will be freed, and this vma does not have VM_DROPPABLE flags, it is appropriate for khugepaged to skip it only, thereby avoiding unnecessary scan and collapse operations to reducing CPU wastage. Here are the performance test results: (Throughput bigger is better, other smaller is better) Testing on x86_64 machine: | task hot2 | without patch | with patch | delta | |---------------------|---------------|---------------|---------| | total accesses time | 3.14 sec | 2.93 sec | -6.69% | | cycles per access | 4.96 | 2.21 | -55.44% | | Throughput | 104.38 M/sec | 111.89 M/sec | +7.19% | | dTLB-load-misses | 284814532 | 69597236 | -75.56% | Testing on qemu-system-x86_64 -enable-kvm: | task hot2 | without patch | with patch | delta | |---------------------|---------------|---------------|---------| | total accesses time | 3.35 sec | 2.96 sec | -11.64% | | cycles per access | 7.29 | 2.07 | -71.60% | | Throughput | 97.67 M/sec | 110.77 M/sec | +13.41% | | dTLB-load-misses | 241600871 | 3216108 | -98.67% | [vernon2gm@gmail.com: add comment about VM_DROPPABLE in code, make it clearer] Link: https://lkml.kernel.org/r/i4uowkt4h2ev47obm5h2vtd4zbk6fyw5g364up7kkjn2vmcikq@auepvqethj5r Link: https://lkml.kernel.org/r/20260221093918.1456187-5-vernon2gm@gmail.com Signed-off-by: Vernon Yang Acked-by: David Hildenbrand (arm) Reviewed-by: Lance Yang Reviewed-by: Barry Song Cc: Baolin Wang Cc: Dev Jain Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nico Pache Cc: Ryan Roberts Cc: Steven Rostedt Cc: Zi Yan Signed-off-by: Andrew Morton commit 6cc153f90b7cf07db2b49469dfd79141b145036a Author: Vernon Yang Date: Sat Feb 21 17:39:17 2026 +0800 mm: add folio_test_lazyfree helper Add folio_test_lazyfree() function to identify lazy-free folios to improve code readability. Link: https://lkml.kernel.org/r/20260221093918.1456187-4-vernon2gm@gmail.com Signed-off-by: Vernon Yang Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lance Yang Reviewed-by: Dev Jain Reviewed-by: Barry Song Cc: Baolin Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nico Pache Cc: Ryan Roberts Cc: Steven Rostedt Cc: Zi Yan Signed-off-by: Andrew Morton commit 34c1f77e4a639fd915cf262cba1ac7a29063a68d Author: Vernon Yang Date: Thu Feb 26 22:31:34 2026 +0800 mm-khugepaged-refine-scan-progress-number-fix Based on previous discussions [1], v2 as follow, and testing shows the same performance benefits. Just make code cleaner, no function changes. Link: https://lkml.kernel.org/r/hbftflvdmnranprul4zkq3d2iymqm7ta2a7fwiphggsmt36gt7@bihvv5jg2ko5 Link: https://lore.kernel.org/linux-mm/zdvzmoop5xswqcyiwmvvrdfianm4ccs3gryfecwbm4bhuh7ebo@7an4huwgbuwo [1] Signed-off-by: Vernon Yang Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand (arm) Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nico Pache Cc: Ryan Roberts Cc: Steven Rostedt Cc: Zi Yan Signed-off-by: Andrew Morton commit eeeb79d5ed2b89051e8bfb9a4d68721c4a49cc1d Author: Vernon Yang Date: Sat Feb 21 17:39:16 2026 +0800 mm: khugepaged: refine scan progress number Currently, each scan always increases "progress" by HPAGE_PMD_NR, even if only scanning a single PTE/PMD entry. - When only scanning a sigle PTE entry, let me provide a detailed example: static int hpage_collapse_scan_pmd() { for (addr = start_addr, _pte = pte; _pte < pte + HPAGE_PMD_NR; _pte++, addr += PAGE_SIZE) { pte_t pteval = ptep_get(_pte); ... if (pte_uffd_wp(pteval)) { <-- first scan hit result = SCAN_PTE_UFFD_WP; goto out_unmap; } } } During the first scan, if pte_uffd_wp(pteval) is true, the loop exits directly. In practice, only one PTE is scanned before termination. Here, "progress += 1" reflects the actual number of PTEs scanned, but previously "progress += HPAGE_PMD_NR" always. - When the memory has been collapsed to PMD, let me provide a detailed example: The following data is traced by bpftrace on a desktop system. After the system has been left idle for 10 minutes upon booting, a lot of SCAN_PMD_MAPPED or SCAN_NO_PTE_TABLE are observed during a full scan by khugepaged. From trace_mm_khugepaged_scan_pmd and trace_mm_khugepaged_scan_file, the following statuses were observed, with frequency mentioned next to them: SCAN_SUCCEED : 1 SCAN_EXCEED_SHARED_PTE: 2 SCAN_PMD_MAPPED : 142 SCAN_NO_PTE_TABLE : 178 total progress size : 674 MB Total time : 419 seconds, include khugepaged_scan_sleep_millisecs The khugepaged_scan list save all task that support collapse into hugepage, as long as the task is not destroyed, khugepaged will not remove it from the khugepaged_scan list. This exist a phenomenon where task has already collapsed all memory regions into hugepage, but khugepaged continues to scan it, which wastes CPU time and invalid, and due to khugepaged_scan_sleep_millisecs (default 10s) causes a long wait for scanning a large number of invalid task, so scanning really valid task is later. After applying this patch, when the memory is either SCAN_PMD_MAPPED or SCAN_NO_PTE_TABLE, just skip it, as follow: SCAN_EXCEED_SHARED_PTE: 2 SCAN_PMD_MAPPED : 147 SCAN_NO_PTE_TABLE : 173 total progress size : 45 MB Total time : 20 seconds SCAN_PTE_MAPPED_HUGEPAGE is the same, for detailed data, refer to https://lore.kernel.org/linux-mm/4qdu7owpmxfh3ugsue775fxarw5g2gcggbxdf5psj75nnu7z2u@cv2uu2yocaxq Link: https://lkml.kernel.org/r/20260221093918.1456187-3-vernon2gm@gmail.com Signed-off-by: Vernon Yang Reviewed-by: Dev Jain Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand (arm) Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nico Pache Cc: Ryan Roberts Cc: Steven Rostedt Cc: Zi Yan Signed-off-by: Andrew Morton commit 36cec70e4acbae21e39527c1d41083bca148c7c8 Author: Vernon Yang Date: Sat Feb 21 17:39:15 2026 +0800 mm: khugepaged: add trace_mm_khugepaged_scan event Patch series "Improve khugepaged scan logic", v8. This series improves the khugepaged scan logic and reduces CPU consumption by prioritizing scanning tasks that access memory frequently. The following data is traced by bpftrace[1] on a desktop system. After the system has been left idle for 10 minutes upon booting, a lot of SCAN_PMD_MAPPED or SCAN_NO_PTE_TABLE are observed during a full scan by khugepaged. @scan_pmd_status[1]: 1 ## SCAN_SUCCEED @scan_pmd_status[6]: 2 ## SCAN_EXCEED_SHARED_PTE @scan_pmd_status[3]: 142 ## SCAN_PMD_MAPPED @scan_pmd_status[2]: 178 ## SCAN_NO_PTE_TABLE total progress size: 674 MB Total time : 419 seconds ## include khugepaged_scan_sleep_millisecs The khugepaged has below phenomenon: the khugepaged list is scanned in a FIFO manner, as long as the task is not destroyed, 1. the task no longer has memory that can be collapsed into hugepage, continues scan it always. 2. the task at the front of the khugepaged scan list is cold, they are still scanned first. 3. everyone scan at intervals of khugepaged_scan_sleep_millisecs (default 10s). If we always scan the above two cases first, the valid scan will have to wait for a long time. For the first case, when the memory is either SCAN_PMD_MAPPED or SCAN_NO_PTE_TABLE or SCAN_PTE_MAPPED_HUGEPAGE [5], just skip it. For the second case, if the user has explicitly informed us via MADV_FREE that these folios will be freed, just skip it only. The below is some performance test results. kernbench results (testing on x86_64 machine): baseline w/o patches test w/ patches Amean user-32 18522.51 ( 0.00%) 18333.64 * 1.02%* Amean syst-32 1137.96 ( 0.00%) 1113.79 * 2.12%* Amean elsp-32 666.04 ( 0.00%) 659.44 * 0.99%* BAmean-95 user-32 18520.01 ( 0.00%) 18323.57 ( 1.06%) BAmean-95 syst-32 1137.68 ( 0.00%) 1110.50 ( 2.39%) BAmean-95 elsp-32 665.92 ( 0.00%) 659.06 ( 1.03%) BAmean-99 user-32 18520.01 ( 0.00%) 18323.57 ( 1.06%) BAmean-99 syst-32 1137.68 ( 0.00%) 1110.50 ( 2.39%) BAmean-99 elsp-32 665.92 ( 0.00%) 659.06 ( 1.03%) Create three task[2]: hot1 -> cold -> hot2. After all three task are created, each allocate memory 128MB. the hot1/hot2 task continuously access 128 MB memory, while the cold task only accesses its memory briefly andthen call madvise(MADV_FREE). Here are the performance test results: (Throughput bigger is better, other smaller is better) Testing on x86_64 machine: | task hot2 | without patch | with patch | delta | |---------------------|---------------|---------------|---------| | total accesses time | 3.14 sec | 2.93 sec | -6.69% | | cycles per access | 4.96 | 2.21 | -55.44% | | Throughput | 104.38 M/sec | 111.89 M/sec | +7.19% | | dTLB-load-misses | 284814532 | 69597236 | -75.56% | Testing on qemu-system-x86_64 -enable-kvm: | task hot2 | without patch | with patch | delta | |---------------------|---------------|---------------|---------| | total accesses time | 3.35 sec | 2.96 sec | -11.64% | | cycles per access | 7.29 | 2.07 | -71.60% | | Throughput | 97.67 M/sec | 110.77 M/sec | +13.41% | | dTLB-load-misses | 241600871 | 3216108 | -98.67% | This patch (of 4): Add mm_khugepaged_scan event to track the total time for full scan and the total number of pages scanned of khugepaged. Link: https://lkml.kernel.org/r/20260221093918.1456187-2-vernon2gm@gmail.com Signed-off-by: Vernon Yang Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Barry Song Reviewed-by: Lance Yang Reviewed-by: Dev Jain Cc: Baolin Wang Cc: Dev Jain Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nico Pache Cc: Ryan Roberts Cc: Steven Rostedt Cc: Zi Yan Signed-off-by: Andrew Morton commit c2d9196541fa58de16e219092f56ae507c925cac Author: Zhongqiu Han Date: Fri Jan 30 17:37:29 2026 +0800 mm/kmemleak: use PF_KTHREAD flag to detect kernel threads Replace the current->mm check with PF_KTHREAD flag for more reliable kernel thread detection in scan_should_stop(). The PF_KTHREAD flag is the standard way to identify kernel threads and is not affected by temporary mm borrowing via kthread_use_mm() (although kmemleak does not currently encounter such cases, this makes the code more robust). No functional change. Link: https://lkml.kernel.org/r/20260130093729.2045858-3-zhongqiu.han@oss.qualcomm.com Signed-off-by: Zhongqiu Han Acked-by: Catalin Marinas Signed-off-by: Andrew Morton commit fc9ef2978d440162f507f70cbc351006af9a77d4 Author: Zhongqiu Han Date: Fri Jan 30 17:37:28 2026 +0800 mm/kmemleak: remove unreachable return statement in scan_should_stop() Patch series "mm/kmemleak: Improve scan_should_stop() implementation". This series improves the scan_should_stop() function by addressing code quality issues and enhancing kernel thread detection robustness. This patch (of 2): Remove unreachable "return 0;" statement as all execution paths return before reaching it. No functional change. Link: https://lkml.kernel.org/r/20260130093729.2045858-2-zhongqiu.han@oss.qualcomm.com Signed-off-by: Zhongqiu Han Acked-by: Catalin Marinas Signed-off-by: Andrew Morton commit ae1a645def136e23b81330763edb76c554ce6e23 Author: Kairui Song Date: Mon Feb 2 01:47:32 2026 +0800 mm/zswap: remove SWP_SYNCHRONOUS_IO swapcache bypass workaround Since commit f1879e8a0c60 ("mm, swap: never bypass the swap cache even for SWP_SYNCHRONOUS_IO"), all swap-in operations go through the swap cache, including those from SWP_SYNCHRONOUS_IO devices like zram. Which means the workaround for swap cache bypassing introduced by commit 25cd241408a2 ("mm: zswap: fix data loss on SWP_SYNCHRONOUS_IO devices") is no longer needed. Remove it, but keep the comments that are still helpful. Link: https://lkml.kernel.org/r/20260202-zswap-syncio-cleanup-v1-1-86bb24a64521@tencent.com Signed-off-by: Kairui Song Suggested-by: Yosry Ahmed Reviewed-by: Barry Song Acked-by: Chris Li Acked-by: Yosry Ahmed Acked-by: Nhat Pham Reviewed-by: Chengming Zhou Cc: Baoquan He Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit 1c7b8d8a51cc1022bcf6604adf3f1963f8162f3f Author: qinyu Date: Tue Feb 3 18:26:49 2026 +0800 mm/page_idle.c: remove redundant mmu notifier in aging code Now we have mmu_notifier_clear_young immediately follows pmdp_clear_young_notify which internally calls mmu_notifier_clear_young, this is redundant. change it with non-notify variant and keep consistent with ptep aging code. Link: https://lkml.kernel.org/r/20260203102649.2486836-1-qin.yuA@h3c.com Signed-off-by: qinyu Reviewed-by: Baolin Wang Reviewed-by: SeongJae Park Acked-by: David Hildenbrand (arm) Signed-off-by: Andrew Morton commit b0fbe8c3414d26d43f76cc9c4c1ae8eb51a04428 Author: Li RongQing Date: Wed Feb 4 03:09:37 2026 -0500 mm/mmu_notifiers: use hlist_for_each_entry_srcu() for SRCU list traversal The mmu_notifier_subscriptions list is protected by SRCU. While the current code uses hlist_for_each_entry_rcu() with an explicit SRCU lockdep check, it is more appropriate to use the dedicated hlist_for_each_entry_srcu() macro. This change aligns the code with the preferred kernel API for SRCU-protected lists, improving code clarity and ensuring that the synchronization method is explicitly documented by the iterator name itself. Link: https://lkml.kernel.org/r/20260204080937.2472-1-lirongqing@baidu.com Signed-off-by: Li RongQing Acked-by: SeongJae Park Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 80a4bcac69348e32ccb5ab46401ac2a416fcb576 Author: Vernon Yang Date: Sat Feb 7 16:16:13 2026 +0800 mm: khugepaged: set to next mm direct when mm has MMF_DISABLE_THP_COMPLETELY When an mm with the MMF_DISABLE_THP_COMPLETELY flag is detected during scanning, directly set khugepaged_scan.mm_slot to the next mm_slot, reduce redundant operation. Without this patch, entering khugepaged_scan_mm_slot() next time, we will set khugepaged_scan.mm_slot to the next mm_slot. With this patch, we will directly set khugepaged_scan.mm_slot to the next mm_slot. Link: https://lkml.kernel.org/r/20260207081613.588598-6-vernon2gm@gmail.com Signed-off-by: Vernon Yang Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lance Yang Reviewed-by: Dev Jain Reviewed-by: Barry Song Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Nico Pache Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 15c578d0dc9952c634f59fcdf9f75be0e42ca834 Author: Chen Ni Date: Wed Feb 11 14:43:11 2026 +0800 selftests/mm: remove duplicate include of unistd.h Remove duplicate inclusion of unistd.h in memory-failure.c to clean up redundant code. Link: https://lkml.kernel.org/r/20260211064311.2981726-1-nichen@iscas.ac.cn Signed-off-by: Chen Ni Acked-by: Miaohe Lin Reviewed-by: Liam R. Howlett Reviewed-by: SeongJae Park Reviewed-by: Dev Jain Signed-off-by: Andrew Morton commit 26513781d1b3a1e8b4b576ed62751d604a69b374 Author: Mike Rapoport (Microsoft) Date: Wed Feb 11 12:31:41 2026 +0200 mm: cache struct page for empty_zero_page and return it from ZERO_PAGE() For most architectures every invocation of ZERO_PAGE() does virt_to_page(empty_zero_page). But empty_zero_page is in BSS and it is enough to get its struct page once at initialization time and then use it whenever a zero page should be accessed. Add yet another __zero_page variable that will be initialized as virt_to_page(empty_zero_page) for most architectures in a weak arch_setup_zero_pages() function. For architectures that use colored zero pages (MIPS and s390) rename their setup_zero_pages() to arch_setup_zero_pages() and make it global rather than static. For architectures that cannot use virt_to_page() for BSS (arm64 and sparc64) add override of arch_setup_zero_pages(). Link: https://lkml.kernel.org/r/20260211103141.3215197-5-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Catalin Marinas Acked-by: David Hildenbrand (Arm) Acked-by: Liam R. Howlett Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Christophe Leroy (CS GROUP) Cc: Dave Hansen Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Palmer Dabbelt Cc: Richard Weinberger Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 6215d9f4470fbb48245ffdfade821685e2728c65 Author: Mike Rapoport (Microsoft) Date: Wed Feb 11 12:31:40 2026 +0200 arch, mm: consolidate empty_zero_page Reduce 22 declarations of empty_zero_page to 3 and 23 declarations of ZERO_PAGE() to 4. Every architecture defines empty_zero_page that way or another, but for the most of them it is always a page aligned page in BSS and most definitions of ZERO_PAGE do virt_to_page(empty_zero_page). Move Linus vetted x86 definition of empty_zero_page and ZERO_PAGE() to the core MM and drop these definitions in architectures that do not implement colored zero page (MIPS and s390). ZERO_PAGE() remains a macro because turning it to a wrapper for a static inline causes severe pain in header dependencies. For the most part the change is mechanical, with these being noteworthy: * alpha: aliased empty_zero_page with ZERO_PGE that was also used for boot parameters. Switching to a generic empty_zero_page removes the aliasing and keeps ZERO_PGE for boot parameters only * arm64: uses __pa_symbol() in ZERO_PAGE() so that definition of ZERO_PAGE() is kept intact. * m68k/parisc/um: allocated empty_zero_page from memblock, although they do not support zero page coloring and having it in BSS will work fine. * sparc64 can have empty_zero_page in BSS rather allocate it, but it can't use virt_to_page() for BSS. Keep it's definition of ZERO_PAGE() but instead of allocating it, make mem_map_zero point to empty_zero_page. * sh: used empty_zero_page for boot parameters at the very early boot. Rename the parameters page to boot_params_page and let sh use the generic empty_zero_page. * hexagon: had an amusing comment about empty_zero_page /* A handy thing to have if one has the RAM. Declared in head.S */ that unfortunately had to go :) Link: https://lkml.kernel.org/r/20260211103141.3215197-4-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Helge Deller [parisc] Tested-by: Helge Deller [parisc] Reviewed-by: Christophe Leroy (CS GROUP) Acked-by: Dave Hansen Acked-by: Catalin Marinas Acked-by: Magnus Lindholm [alpha] Acked-by: Dinh Nguyen [nios2] Acked-by: Andreas Larsson [sparc] Acked-by: David Hildenbrand (Arm) Acked-by: Liam R. Howlett Cc: "Borislav Petkov (AMD)" Cc: David S. Miller Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Palmer Dabbelt Cc: Richard Weinberger Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 9a1d0c738b45ea8da4e6897099c708e89f43daad Author: Mike Rapoport (Microsoft) Date: Wed Feb 11 12:31:39 2026 +0200 mm: rename my_zero_pfn() to zero_pfn() my_zero_pfn() is a silly name. Rename zero_pfn variable to zero_page_pfn and my_zero_pfn() function to zero_pfn(). While on it, move extern declarations of zero_page_pfn outside the functions that use it and add a comment about what ZERO_PAGE is. Link: https://lkml.kernel.org/r/20260211103141.3215197-3-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand (Arm) Acked-by: Vlastimil Babka Reviewed-by: Liam R. Howlett Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Christophe Leroy (CS GROUP) Cc: Dave Hansen Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Palmer Dabbelt Cc: Richard Weinberger Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Vineet Gupta Cc: Will Deacon Signed-off-by: Andrew Morton commit 652d12bc74a075f345f228f8945e05517a38874d Author: Mike Rapoport (Microsoft) Date: Wed Feb 11 12:31:38 2026 +0200 mm: don't special case !MMU for is_zero_pfn() and my_zero_pfn() Patch series "arch, mm: consolidate empty_zero_page", v3. These patches cleanup handling of ZERO_PAGE() and zero_pfn. This patch (of 4): nommu architectures have empty_zero_page and define ZERO_PAGE() and although they don't really use it to populate page tables, there is no reason to hardwire !MMU implementation of is_zero_pfn() and my_zero_pfn() to 0. Drop #ifdef CONFIG_MMU around implementations of is_zero_pfn() and my_zero_pfn() and remove !MMU version. While on it, make zero_pfn __ro_after_init. Link: https://lkml.kernel.org/r/20260211103141.3215197-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20260211103141.3215197-2-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand (Arm) Acked-by: Liam R. Howlett Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Palmer Dabbelt Cc: Richard Weinberger Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Cc: Christophe Leroy (CS GROUP) Cc: Dave Hansen Signed-off-by: Andrew Morton commit 7498bddab9455b3750b655c27cdcc0a2c48af318 Author: Kairui Song Date: Wed Feb 11 22:33:23 2026 +0800 mm/shmem: remove unnecessary restrain unmask of swap gfp flags The comment makes it look like copy-paste leftovers from shmem_replace_folio. The first try of the swap doesn't always have a limited zone. So don't drop the restraint, which should make the GFP more accurate. Link: https://lkml.kernel.org/r/20260211-shmem-swap-gfp-v1-1-e9781099a861@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Cc: Hugh Dickins Signed-off-by: Andrew Morton commit c5c48345135ff04e039377020df23294d59aa59a Author: Gregory Price Date: Wed Feb 11 16:54:47 2026 -0500 mm: name the anonymous MMOP enum as enum mmop Give the MMOP enum (MMOP_OFFLINE, MMOP_ONLINE, etc) a proper type name so the compiler can help catch invalid values being assigned to variables of this type. Leave the existing functions returning int alone to allow for value-or-error pattern to remain unchanged without churn. mmop_default_online_type is left as int because it uses the -1 sentinal value to signal it hasn't been initialized yet. Keep the uint8_t buffer in offline_and_remove_memory() as-is for space efficiency, with an explicit cast when we consume the value. Move the enum definition before the CONFIG_MEMORY_HOTPLUG guard so it is unconditionally available for struct memory_block in memory.h. No functional change. Link: https://lore.kernel.org/linux-mm/3424eba7-523b-4351-abd0-3a888a3e5e61@kernel.org/ Link: https://lkml.kernel.org/r/20260211215447.2194189-1-gourry@gourry.net Signed-off-by: Gregory Price Suggested-by: Jonathan Cameron Suggested-by: "David Hildenbrand (arm)" Reviewed-by: Ben Cheatham Acked-by: David Hildenbrand (Arm) Reviewed-by: Dave Jiang Reviewed-by: Davidlohr Bueso Reviewed-by: Jonathan Cameron Cc: Danilo Krummrich Cc: Greg Kroah-Hartman Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4e89004eebc559595e58d75fd7f7f8ecd5aa600d Author: Jiayuan Chen Date: Fri Feb 13 15:18:23 2026 +0800 selftests/cgroup: add test for zswap incompressible pages Add test_zswap_incompressible() to verify that the zswap_incomp memcg stat correctly tracks incompressible pages. The test allocates memory filled with random data from /dev/urandom, which cannot be effectively compressed by zswap. When this data is swapped out to zswap, it should be stored as-is and tracked by the zswap_incomp counter. The test verifies that: 1. Pages are swapped out to zswap (zswpout increases) 2. Incompressible pages are tracked (zswap_incomp increases) test: dd if=/dev/zero of=/swapfile bs=1M count=2048 chmod 600 /swapfile mkswap /swapfile swapon /swapfile echo Y > /sys/module/zswap/parameters/enabled ./test_zswap TAP version 13 1..8 ok 1 test_zswap_usage ok 2 test_swapin_nozswap ok 3 test_zswapin ok 4 test_zswap_writeback_enabled ok 5 test_zswap_writeback_disabled ok 6 test_no_kmem_bypass ok 7 test_no_invasive_cgroup_shrink ok 8 test_zswap_incompressible Totals: pass:8 fail:0 xfail:0 xpass:0 skip:0 error:0 Link: https://lkml.kernel.org/r/20260213071827.5688-3-jiayuan.chen@linux.dev Signed-off-by: Jiayuan Chen Acked-by: Shakeel Butt Acked-by: Nhat Pham Reviewed-by: SeongJae Park Cc: Chengming Zhou Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Michal Hocko Cc: Michal Koutný Cc: Muchun Song Cc: Roman Gushchin Cc: Shuah Khan Cc: Tejun Heo Cc: Yosry Ahmed Signed-off-by: Andrew Morton commit 5ad41a38c36474ff59545cb514801d90719555de Author: Jiayuan Chen Date: Fri Feb 13 15:18:22 2026 +0800 mm: zswap: add per-memcg stat for incompressible pages Patch series "mm: zswap: add per-memcg stat for incompressible pages", v3. In containerized environments, knowing which cgroup is contributing incompressible pages to zswap is essential for effective resource management. This series adds a new per-memcg stat 'zswap_incomp' to track incompressible pages, along with a selftest. This patch (of 2): The global zswap_stored_incompressible_pages counter was added in commit dca4437a5861 ("mm/zswap: store Acked-by: Nhat Pham Acked-by: Shakeel Butt Reviewed-by: Yosry Ahmed Reviewed-by: SeongJae Park Cc: Johannes Weiner Cc: Chengming Zhou Cc: Jonathan Corbet Cc: Michal Hocko Cc: Michal Koutný Cc: Muchun Song Cc: Roman Gushchin Cc: Shuah Khan Cc: Tejun Heo Signed-off-by: Andrew Morton commit 37cb8cd043cbcbe5c617340cff1684cf2f68fb58 Author: Kairui Song Date: Fri Feb 13 18:03:32 2026 +0800 memcg: consolidate private id refcount get/put helpers We currently have two different sets of helpers for getting or putting the private IDs' refcount for order 0 and large folios. This is redundant. Just use one and always acquire the refcount of the swapout folio size unless it's zero, and put the refcount using the folio size if the charge failed, since the folio size can't change. Then there is no need to update the refcount for tail pages. Same for freeing, then only one pair of get/put helper is needed now. The performance might be slightly better, too: both "inc unless zero" and "add unless zero" use the same cmpxchg implementation. For large folios, we saved an atomic operation. And for both order 0 and large folios, we saved a branch. Link: https://lkml.kernel.org/r/20260213-memcg-privid-v1-1-d8cb7afcf831@tencent.com Signed-off-by: Kairui Song Acked-by: Johannes Weiner Reviewed-by: Chen Ridong Acked-by: Shakeel Butt Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Signed-off-by: Andrew Morton commit c9cb94c6b85a2854ae03c874331b0880ee735441 Author: Asier Gutierrez Date: Fri Feb 13 14:50:32 2026 +0000 mm/damon: remove unused target param of get_scheme_score() damon_target is not used by get_scheme_score operations, nor with virtual neither with physical addresses. Link: https://lkml.kernel.org/r/20260213145032.1740407-1-gutierrez.asier@huawei-partners.com Signed-off-by: Asier Gutierrez Reviewed-by: SeongJae Park Cc: Kefeng Wang Cc: Quanmin Yan Cc: ze zuo Signed-off-by: Andrew Morton commit 8a552d68a86ef0e6fb2ff4af13031a5e82c0f1d0 Author: Pratyush Yadav (Google) Date: Mon Feb 16 19:59:33 2026 +0100 mm: memfd_luo: preserve file seals File seals are used on memfd for making shared memory communication with untrusted peers safer and simpler. Seals provide a guarantee that certain operations won't be allowed on the file such as writes or truncations. Maintaining these guarantees across a live update will help keeping such use cases secure. These guarantees will also be needed for IOMMUFD preservation with LUO. Normally when IOMMUFD maps a memfd, it pins all its pages to make sure any truncation operations on the memfd don't lead to IOMMUFD using freed memory. This doesn't work with LUO since the preserved memfd might have completely different pages after a live update, and mapping them back to the IOMMUFD will cause all sorts of problems. Using and preserving the seals allows IOMMUFD preservation logic to trust the memfd. Since the uABI defines seals as an int, preserve them by introducing a new u32 field. There are currently only 6 possible seals, so the extra bits are unused and provide room for future expansion. Since the seals are uABI, it is safe to use them directly in the ABI. While at it, also add a u32 flags field. It makes sure the struct is nicely aligned, and can be used later to support things like MFD_CLOEXEC. Since the serialization structure is changed, bump the version number to "memfd-v2". It is important to note that the memfd-v2 version only supports seals that existed when this version was defined. This set is defined by MEMFD_LUO_ALL_SEALS. Any new seal might bring a completely different semantic with it and the parser for memfd-v2 cannot be expected to deal with that. If there are any future seals added, they will need another version bump. Link: https://lkml.kernel.org/r/20260216185946.1215770-3-pratyush@kernel.org Signed-off-by: Pratyush Yadav (Google) Tested-by: Samiullah Khawaja Cc: Alexander Graf Cc: Baolin Wang Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: Mike Rapoport (Microsoft) Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 1beb9b7223d2a1f1872f76a3d29b0a4a3cee4171 Author: Pratyush Yadav (Google) Date: Mon Feb 16 19:59:32 2026 +0100 memfd: export memfd_{add,get}_seals() Patch series "mm: memfd_luo: preserve file seals", v2. This series adds support for preserving file seals when preserving a memfd using LUO. Patch 1 exports some memfd seal manipulation functions and patch 2 adds support for preserving them. Since it makes changes to the serialized data structure for memfd, it also bumps the version number. This patch (of 2): Support for preserving file seals will be added to memfd preservation using the Live Update Orchestrator (LUO). Export memfd_{add,get}_seals)() so memfd_luo can use them to manipulate the seals. Link: https://lkml.kernel.org/r/20260216185946.1215770-1-pratyush@kernel.org Link: https://lkml.kernel.org/r/20260216185946.1215770-2-pratyush@kernel.org Signed-off-by: Pratyush Yadav (Google) Acked-by: Mike Rapoport (Microsoft) Tested-by: Samiullah Khawaja Cc: Alexander Graf Cc: Baolin Wang Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 1df1a1b950863e64c00d48df718ed7ed28db3ea3 Author: Kairui Song Date: Wed Feb 18 04:06:37 2026 +0800 mm, swap: no need to clear the shadow explicitly Since we no longer bypass the swap cache, every swap-in will clear the swap shadow by inserting the folio into the swap table. The only place we may seem to need to free the swap shadow is when the swap slots are freed directly without a folio (swap_put_entries_direct). But with the swap table, that is not needed either. Freeing a slot in the swap table will set the table entry to NULL, which erases the shadow just fine. So just delete all explicit shadow clearing, it's no longer needed. Also, rearrange the freeing. Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-12-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Nhat Pham Signed-off-by: Andrew Morton commit a0f79916e125f75cf665f5b3ff6ccc1ff60b1a10 Author: Kairui Song Date: Wed Feb 18 04:06:36 2026 +0800 mm, swap: simplify checking if a folio is swapped Clean up and simplify how we check if a folio is swapped. The helper already requires the folio to be in swap cache and locked. That's enough to pin the swap cluster from being freed, so there is no need to lock anything else to avoid UAF. And besides, we have cleaned up and defined the swap operation to be mostly folio based, and now the only place a folio will have any of its swap slots' count increased from 0 to 1 is folio_dup_swap, which also requires the folio lock. So as we are holding the folio lock here, a folio can't change its swap status from not swapped (all swap slots have a count of 0) to swapped (any slot has a swap count larger than 0). So there won't be any false negatives of this helper if we simply depend on the folio lock to stabilize the cluster. We are only using this helper to determine if we can and should release the swap cache. So false positives are completely harmless, and also already exist before. Depending on the timing, previously, it's also possible that a racing thread releases the swap count right after releasing the ci lock and before this helper returns. In any case, the worst that could happen is we leave a clean swap cache. It will still be reclaimed when under pressure just fine. So, in conclusion, we can simplify and make the check much simpler and lockless. Also, rename it to folio_maybe_swapped to reflect the design. Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-11-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Nhat Pham Signed-off-by: Andrew Morton commit 45711d446b743da099b7a795ce91ca581d5981a3 Author: Kairui Song Date: Wed Feb 18 04:06:35 2026 +0800 mm, swap: no need to truncate the scan border swap_map had a static flexible size, so the last cluster won't be fully covered, hence the allocator needs to check the scan border to avoid OOB. But the swap table has a fixed-sized swap table for each cluster, and the slots beyond the device size are marked as bad slots. The allocator can simply scan all slots as usual, and any bad slots will be skipped. Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-10-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Nhat Pham Signed-off-by: Andrew Morton commit 0d6af9bcf383bcdf601e670bb605861b01e318e7 Author: Kairui Song Date: Wed Feb 18 04:06:34 2026 +0800 mm, swap: use the swap table to track the swap count Now all the infrastructures are ready, switch to using the swap table only. This is unfortunately a large patch because the whole old counting mechanism, especially SWP_CONTINUED, has to be gone and switch to the new mechanism together, with no intermediate steps available. The swap table is capable of holding up to SWP_TB_COUNT_MAX - 1 counts in the higher bits of each table entry, so using that, the swap_map can be completely dropped. swap_map also had a limit of SWAP_CONT_MAX. Any value beyond that limit will require a COUNT_CONTINUED page. COUNT_CONTINUED is a bit complex to maintain, so for the swap table, a simpler approach is used: when the count goes beyond SWP_TB_COUNT_MAX - 1, the cluster will have an extend_table allocated, which is a swap cluster-sized array of unsigned int. The counting is basically offloaded there until the count drops below SWP_TB_COUNT_MAX again. Both the swap table and the extend table are cluster-based, so they exhibit good performance and sparsity. To make the switch from swap_map to swap table clean, this commit cleans up and introduces a new set of functions based on the swap table design, for manipulating swap counts: - __swap_cluster_dup_entry, __swap_cluster_put_entry, __swap_cluster_alloc_entry, __swap_cluster_free_entry: Increase/decrease the count of a swap slot, or alloc / free a swap slot. This is the internal routine that does the counting work based on the swap table and handles all the complexities. The caller will need to lock the cluster before calling them. All swap count-related update operations are wrapped by these four helpers. - swap_dup_entries_cluster, swap_put_entries_cluster: Increase/decrease the swap count of one or a set of swap slots in the same cluster range. These two helpers serve as the common routines for folio_dup_swap & swap_dup_entry_direct, or folio_put_swap & swap_put_entries_direct. And use these helpers to replace all existing callers. This helps to simplify the count tracking by a lot, and the swap_map is gone. [ryncsn@gmail.com: fix build] Link: https://lkml.kernel.org/r/aZWuLZi-vYi3vAWe@KASONG-MC4 Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-9-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Suggested-by: Chris Li Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Nhat Pham Signed-off-by: Andrew Morton commit 5dc533f7aa504d85d63b6f2e83ff21f411ea04b8 Author: Kairui Song Date: Wed Feb 18 04:06:33 2026 +0800 mm, swap: simplify swap table sanity range check The newly introduced helper, which checks bad slots and emptiness of a cluster, can cover the older sanity check just fine, with a more rigorous condition check. So merge them. Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-8-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Nhat Pham Signed-off-by: Andrew Morton commit 1307442b935bcac127dafb7fc54545e7e70aed96 Author: Kairui Song Date: Wed Feb 18 04:06:32 2026 +0800 mm, swap: mark bad slots in swap table directly In preparing the deprecating swap_map, mark bad slots in the swap table too when setting SWAP_MAP_BAD in swap_map. Also, refine the swap table sanity check on freeing to adapt to the bad slots change. For swapoff, the bad slots count must match the cluster usage count, as nothing should touch them, and they contribute to the cluster usage count on swapon. For ordinary swap table freeing, the swap table of clusters with bad slots should never be freed since the cluster usage count never reaches zero. Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-7-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Nhat Pham Signed-off-by: Andrew Morton commit 62629ae49baa70362125a02a488d885b3c17eab7 Author: Kairui Song Date: Wed Feb 18 04:06:31 2026 +0800 mm, swap: implement helpers for reserving data in the swap table To prepare for using the swap table as the unified swap layer, introduce macros and helpers for storing multiple kinds of data in a swap table entry. From now on, we are storing PFN in the swap table to make space for extra counting bits (SWAP_COUNT). Shadows are still stored as they are, as the SWAP_COUNT is not used yet. Also, rename shadow_swp_to_tb to shadow_to_swp_tb. That's a spelling error, not really worth a separate fix. No behaviour change yet, just prepare the API. Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-6-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Nhat Pham Signed-off-by: Andrew Morton commit f3d652b0604375f66f631c467f8e8e2b1c16df78 Author: Kairui Song Date: Wed Feb 18 04:06:30 2026 +0800 mm/workingset: leave highest bits empty for anon shadow Swap table entry will need 4 bits reserved for swap count in the shadow, so the anon shadow should have its leading 4 bits remain 0. This should be OK for the foreseeable future. Take 52 bits of physical address space as an example: for 4K pages, there would be at most 40 bits for addressable pages. Currently, we have 36 bits available (64 - 1 - 16 - 10 - 1, where XA_VALUE takes 1 bit for marker, MEM_CGROUP_ID_SHIFT takes 16 bits, NODES_SHIFT takes <=10 bits, WORKINGSET flags takes 1 bit). So in the worst case, we previously need to pack the 40 bits of address in 36 bits fields using a 64K bucket (bucket_order = 4). After this, the bucket will be increased to 1M. Which should be fine, as on such large machines, the working set size will be way larger than the bucket size. And for MGLRU's gen number tracking, it should be even more than enough, MGLRU's gen number (max_seq) increment is much slower compared to the eviction counter (nonresident_age). And after all, either the refault distance or the gen distance is only a hint that can tolerate inaccuracy just fine. And the 4 bits can be shrunk to 3, or extended to a higher value if needed later. Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-5-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Nhat Pham Signed-off-by: Andrew Morton commit 0c7e6014b725cc9835b013d92b573a4d06a87f1f Author: Kairui Song Date: Wed Feb 18 04:06:29 2026 +0800 mm, swap: consolidate bad slots setup and make it more robust In preparation for using the swap table to track bad slots directly, move the bad slot setup to one place, set up the swap_map mark, and cluster counter update together. While at it, provide more informative logs and a more robust fallback if any bad slot info looks incorrect. Fixes a potential issue that a malformed swap file may cause the cluster to be unusable upon swapon, and provides a more verbose warning on a malformed swap file Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-4-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Nhat Pham Signed-off-by: Andrew Morton commit 50f8c41928fd82a8062474e4f22ac1a6be15ddea Author: Kairui Song Date: Wed Feb 18 04:06:28 2026 +0800 mm, swap: remove redundant arguments and locking for enabling a device There is no need to repeatedly pass zero map and priority values. zeromap is similar to cluster info and swap_map, which are only used once the swap device is exposed. And the prio values are currently read only once set, and only used for the list insertion upon expose or swap info display. Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-3-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Nhat Pham Signed-off-by: Andrew Morton commit 451c6326105b22a97d77669867be10370ff3b78e Author: Kairui Song Date: Wed Feb 18 04:06:27 2026 +0800 mm, swap: clean up swapon process and locking Slightly clean up the swapon process. Add comments about what swap_lock protects, introduce and rename helpers that wrap swap_map and cluster_info setup, and do it outside of the swap_lock lock. This lock protection is not needed for swap_map and cluster_info setup because all swap users must either hold the percpu ref or hold a stable allocated swap entry (e.g., locking a folio in the swap cache) before accessing. So before the swap device is exposed by enable_swap_info, nothing would use the swap device's map or cluster. So we are safe to allocate and set up swap data freely first, then expose the swap device and set the SWP_WRITEOK flag. Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-2-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Kemeng Shi Cc: kernel test robot Cc: Lorenzo Stoakes Cc: Nhat Pham Signed-off-by: Andrew Morton commit eca4d01b982db4c104f6c83b9ac167c269c4310a Author: Kairui Song Date: Wed Feb 18 04:06:26 2026 +0800 mm, swap: protect si->swap_file properly and use as a mount indicator Patch series "mm, swap: swap table phase III: remove swap_map", v3. This series removes the static swap_map and uses the swap table for the swap count directly. This saves about ~30% memory usage for the static swap metadata. For example, this saves 256MB of memory when mounting a 1TB swap device. Performance is slightly better too, since the double update of the swap table and swap_map is now gone. Test results: Mounting a swap device: ======================= Mount a 1TB brd device as SWAP, just to verify the memory save: `free -m` before: total used free shared buff/cache available Mem: 1465 1051 417 1 61 413 Swap: 1054435 0 1054435 `free -m` after: total used free shared buff/cache available Mem: 1465 795 672 1 62 670 Swap: 1054435 0 1054435 Idle memory usage is reduced by ~256MB just as expected. And following this design we should be able to save another ~512MB in a next phase. Build kernel test: ================== Test using ZSWAP with NVME SWAP, make -j48, defconfig, in a x86_64 VM with 5G RAM, under global pressure, avg of 32 test run: Before After: System time: 1038.97s 1013.75s (-2.4%) Test using ZRAM as SWAP, make -j12, tinyconfig, in a ARM64 VM with 1.5G RAM, under global pressure, avg of 32 test run: Before After: System time: 67.75s 66.65s (-1.6%) The result is slightly better. Redis / Valkey benchmark: ========================= Test using ZRAM as SWAP, in a ARM64 VM with 1.5G RAM, under global pressure, avg of 64 test run: Server: valkey-server --maxmemory 2560M Client: redis-benchmark -r 3000000 -n 3000000 -d 1024 -c 12 -P 32 -t get no persistence with BGSAVE Before: 472705.71 RPS 369451.68 RPS After: 481197.93 RPS (+1.8%) 374922.32 RPS (+1.5%) In conclusion, performance is better in all cases, and memory usage is much lower. The swap cgroup array will also be merged into the swap table in a later phase, saving the other ~60% part of the static swap metadata and making all the swap metadata dynamic. The improved API for swap operations also reduces the lock contention and makes more batching operations possible. This patch (of 12): /proc/swaps uses si->swap_map as the indicator to check if the swap device is mounted. swap_map will be removed soon, so change it to use si->swap_file instead because: - si->swap_file is exactly the only dynamic content that /proc/swaps is interested in. Previously, it was checking si->swap_map just to ensure si->swap_file is available. si->swap_map is set under mutex protection, and after si->swap_file is set, so having si->swap_map set guarantees si->swap_file is set. - Checking si->flags doesn't work here. SWP_WRITEOK is cleared during swapoff, but /proc/swaps is supposed to show the device under swapoff too to report the swapoff progress. And SWP_USED is set even if the device hasn't been properly set up. We can have another flag, but the easier way is to just check si->swap_file directly. So protect si->swap_file setting with mutext, and set si->swap_file only when the swap device is truly enabled. /proc/swaps only interested in si->swap_file and a few static data reading. Only si->swap_file needs protection. Reading other static fields is always fine. Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-0-f4e34be021a7@tencent.com Link: https://lkml.kernel.org/r/20260218-swap-table-p3-v3-1-f4e34be021a7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kemeng Shi Cc: Lorenzo Stoakes Cc: Nhat Pham Cc: Kairui Song Cc: kernel test robot Signed-off-by: Andrew Morton commit e623b4ebee9d3a4b1e408b2c3e60cfc99b4e61ea Author: Miquel Sabaté Solà Date: Fri Feb 20 00:44:07 2026 +0100 mm: fix typo in the comment of mod_zone_state() Use the proper function name, followed by parenthesis as usual. Link: https://lkml.kernel.org/r/20260219234407.3261196-1-mssola@mssola.com Signed-off-by: Miquel Sabaté Solà Acked-by: SeongJae Park Reviewed-by: Lorenzo Stoakes (Oracle) Cc: David Hildenbrand Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit e4f4fc7aa8b720d934a0bfcea7f8aae4271d308f Author: JP Kobryn (Meta) Date: Thu Feb 19 15:58:46 2026 -0800 mm: move pgscan, pgsteal, pgrefill to node stats There are situations where reclaim kicks in on a system with free memory. One possible cause is a NUMA imbalance scenario where one or more nodes are under pressure. It would help if we could easily identify such nodes. Move the pgscan, pgsteal, and pgrefill counters from vm_event_item to node_stat_item to provide per-node reclaim visibility. With these counters as node stats, the values are now displayed in the per-node section of /proc/zoneinfo, which allows for quick identification of the affected nodes. /proc/vmstat continues to report the same counters, aggregated across all nodes. But the ordering of these items within the readout changes as they move from the vm events section to the node stats section. Memcg accounting of these counters is preserved. The relocated counters remain visible in memory.stat alongside the existing aggregate pgscan and pgsteal counters. However, this change affects how the global counters are accumulated. Previously, the global event count update was gated on !cgroup_reclaim(), excluding memcg-based reclaim from /proc/vmstat. Now that mod_lruvec_state() is being used to update the counters, the global counters will include all reclaim. This is consistent with how pgdemote counters are already tracked. Finally, the virtio_balloon driver is updated to use global_node_page_state() to fetch the counters, as they are no longer accessible through the vm_events array. Link: https://lkml.kernel.org/r/20260219235846.161910-1-jp.kobryn@linux.dev Signed-off-by: JP Kobryn Suggested-by: Johannes Weiner Acked-by: Michael S. Tsirkin Reviewed-by: Vlastimil Babka (SUSE) Acked-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: Michal Hocko Cc: Alistair Popple Cc: Axel Rasmussen Cc: Byungchul Park Cc: David Hildenbrand Cc: Eugenio Pérez Cc: Gregory Price Cc: "Huang, Ying" Cc: Jason Wang Cc: Joshua Hahn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mathew Brost Cc: Mike Rapoport Cc: Muchun Song Cc: Qi Zheng Cc: Rakie Kim Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Wei Xu Cc: Xuan Zhuo Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 54218f10dfbe88c8e41c744fd45a756cde60b8c4 Author: AnishMulay Date: Wed Feb 18 11:39:41 2026 -0500 selftests/mm: skip migration tests if NUMA is unavailable Currently, the migration test asserts that numa_available() returns 0. On systems where NUMA is not available (returning -1), such as certain ARM64 configurations or single-node systems, this assertion fails and crashes the test. Update the test to check the return value of numa_available(). If it is less than 0, skip the test gracefully instead of failing. This aligns the behavior with other MM selftests (like rmap) that skip when NUMA support is missing. Link: https://lkml.kernel.org/r/20260218163941.13499-1-anishm7030@gmail.com Fixes: 0c2d08728470 ("mm: add selftests for migration entries") Signed-off-by: AnishMulay Reviewed-by: SeongJae Park Reviewed-by: Dev Jain Reviewed-by: Anshuman Khandual Tested-by: Sayali Patil Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3d443691ed00eff21ca049ac49c584cdcc7134ac Author: Seongsu Park Date: Thu Feb 19 15:35:06 2026 +0900 mm/pkeys: remove unused tsk parameter from arch_set_user_pkey_access() The tsk parameter in arch_set_user_pkey_access() is never used in the function implementations across all architectures (arm64, powerpc, x86). Link: https://lkml.kernel.org/r/20260219063506.545148-1-sgsu.park@samsung.com Signed-off-by: Seongsu Park Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Ingo Molnar Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Thomas Gleixner Cc: Will Deacon Signed-off-by: Andrew Morton commit 0e8cf9a31a8c3f996c48b633a673076d6997b093 Author: Liam R. Howlett Date: Fri Jan 30 15:59:35 2026 -0500 maple_tree: clean up mas_wr_node_store() The new_end does not need to be passed in as the data is already being checked. This allows for other areas to skip getting the node new_end in the calling function. The type was incorrectly void * instead of void __rcu *, which isn't an issue but is technically incorrect. Move the variable assignment to after the declarations to clean up the initial setup. Ensure there is something to copy before calling memcpy(). Link: https://lkml.kernel.org/r/20260130205935.2559335-31-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b82f4c811e4d22b308dccf9f7b0a382b0105c190 Author: Liam R. Howlett Date: Fri Jan 30 15:59:34 2026 -0500 maple_tree: don't pass end to mas_wr_append() Figure out the end internally. This is necessary for future cleanups. Link: https://lkml.kernel.org/r/20260130205935.2559335-30-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2969241fa22e39f0c751e96d2f53b1d9dfac19ba Author: Liam R. Howlett Date: Fri Jan 30 15:59:33 2026 -0500 maple_tree: pass maple copy node to mas_wmb_replace() mas_wmb_replace() is called in three places with the same setup, move the setup into the function itself. The function needs to be relocated as it calls mtree_range_walk(). Link: https://lkml.kernel.org/r/20260130205935.2559335-29-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b8852ef30c67318d40e69d295e28f6cab5174862 Author: Liam R. Howlett Date: Fri Jan 30 15:59:32 2026 -0500 maple_tree: remove maple big node and subtree structs Now that no one uses the structures and functions, drop the dead code. Link: https://lkml.kernel.org/r/20260130205935.2559335-28-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 280b792cac62ddadca2935766ca870b438c86323 Author: Liam R. Howlett Date: Fri Jan 30 15:59:31 2026 -0500 maple_tree: use maple copy node for mas_wr_split() Instead of using the maple big node, use the maple copy node for reduced stack usage and aligning with mas_wr_rebalance() and mas_wr_spanning_store(). Splitting a node is similar to rebalancing, but a new evaluation of when to ascend is needed. The only other difference is that the data is pushed and never rebalanced at each level. The testing must also align with the changes to this commit to ensure the test suite continues to pass. Link: https://lkml.kernel.org/r/20260130205935.2559335-27-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 11e7f22f5e85058b09ca90e74002a3b82f50e940 Author: Liam R. Howlett Date: Fri Jan 30 15:59:30 2026 -0500 maple_tree: add cp_converged() helper When the maple copy node converges into a single entry, then certain operations can stop ascending the tree. This is used more later. Link: https://lkml.kernel.org/r/20260130205935.2559335-26-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 0abff2081983e5dfa7642ab1a794afc0a8417070 Author: Liam R. Howlett Date: Fri Jan 30 15:59:29 2026 -0500 maple_tree: add copy_tree_location() helper Extract the copying of the tree location from one maple state to another into its own function. This is used more later. Link: https://lkml.kernel.org/r/20260130205935.2559335-25-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit ebfee00c0bc8295b4dd8281f792f44d38b2af0c7 Author: Liam R. Howlett Date: Fri Jan 30 15:59:28 2026 -0500 maple_tree: add test for rebalance calculation off-by-one During the big node removal, an incorrect rebalance step went too far up the tree causing insufficient nodes. Test the faulty condition by recreating the scenario in the userspace testing. Link: https://lkml.kernel.org/r/20260130205935.2559335-24-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 971f0db15977582a811712bba042191721715c19 Author: Liam R. Howlett Date: Fri Jan 30 15:59:27 2026 -0500 maple_tree: use maple copy node for mas_wr_rebalance() operation Stop using the maple big node for rebalance operations by changing to more align with spanning store. The rebalance operation needs its own data calculation in rebalance_data(). In the event of too much data, the rebalance tries to push the data using push_data_sib(). If there is insufficient data, the rebalance operation will rebalance against a sibling (found with rebalance_sib()). The rebalance starts at the leaf and works its way upward in the tree using rebalance_ascend(). Most of the code is shared with spanning store such as the copy node having a new root, but is fundamentally different in that the data must come from a sibling. A parent maple state is used to track the parent location to avoid multiple mas_ascend() calls. The maple state tree location is copied from the parent to the mas (child) in the ascend step. Ascending itself is done in the main loop. Link: https://lkml.kernel.org/r/20260130205935.2559335-23-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b00a1804e69297489a88d4cbdffba6a6f21795e3 Author: Liam R. Howlett Date: Fri Jan 30 15:59:26 2026 -0500 maple_tree: add cp_is_new_root() helper Add a helper to do what is needed when the maple copy node contains a new root node. This is useful for future commits and is self-documenting code. [Liam.Howlett@oracle.com: remove warnings on older compilers] Link: https://lkml.kernel.org/r/malwmirqnpuxqkqrobcmzfkmmxipoyzwfs2nwc5fbpxlt2r2ej@wchmjtaljvw3 [akpm@linux-foundation.org: s/cp->slot[0]/&cp->slot[0]/, per Liam] Link: https://lkml.kernel.org/r/20260130205935.2559335-22-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 62e9d349afce279944a22295515c18af335722c0 Author: Liam R. Howlett Date: Fri Jan 30 15:59:25 2026 -0500 maple_tree: separate wr_split_store and wr_rebalance store type code path The split and rebalance store types both go through the same function that uses the big node. Separate the code paths so that each can be updated independently. No functional change intended Link: https://lkml.kernel.org/r/20260130205935.2559335-21-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 448ec8c0a424b89b22acb641481088af1e43f5c2 Author: Liam R. Howlett Date: Fri Jan 30 15:59:24 2026 -0500 maple_tree: remove unnecessary return statements Functions do not need to state return at the end, unless skipping unwind. These can safely be dropped. Link: https://lkml.kernel.org/r/20260130205935.2559335-20-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3578d61c1c4305ef4e24adda97266bc4d1ebc962 Author: Liam R. Howlett Date: Fri Jan 30 15:59:23 2026 -0500 maple_tree: inline mas_wr_spanning_rebalance() Now that the spanning rebalance is small, fully inline it in mas_wr_spanning_store(). No functional change. Link: https://lkml.kernel.org/r/20260130205935.2559335-19-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit a9c6716e088a1d4badd4fa6797469506bb99ec8b Author: Liam R. Howlett Date: Fri Jan 30 15:59:22 2026 -0500 maple_tree: start using maple copy node for destination Stop using the maple subtree state and big node in favour of using three destinations in the maple copy node. That is, expand the way leaves were handled to all levels of the tree and use the maple copy node to track the new nodes. Extract out the sibling init into the data calculation since this is where the insufficient data can be detected. The remainder of the sibling code to shift the next iteration is moved to the spanning_ascend() function, since it is not always needed. Next introduce the dst_setup() function which will decide how many nodes are needed to contain the data at this level. Using the destination count, populate the copy node's dst array with the new nodes and set d_count to the correct value. Note that this can be tricky in the case of a leaf node with exactly enough room because of the rule against NULLs at the end of leaves. Once the destinations are ready, copy the data by altering the cp_data_write() function to copy from the sources to the destinations directly. This eliminates the use of the big node in this code path. On node completion, node_finalise() will zero out the remaining area and set the metadata, if necessary. spanning_ascend() is used to decide if the operation is complete. It may create a new root, converge into one destination, or continue upwards by ascending the left and right write maple states. One test case setup needed to be tweaked so that the targeted node was surrounded by full nodes. [akpm@linux-foundation.org: coding-style cleanups] Link: https://lkml.kernel.org/r/20260130205935.2559335-18-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 20b20162e1f3b7e60cf0e79116fb2f3bdef3dc5e Author: Liam R. Howlett Date: Fri Jan 30 15:59:21 2026 -0500 maple_tree: add gap support, slot and pivot sizes for maple copy Add plumbing work for using maple copy as a normal node for a source of copy operations. This is needed later. Link: https://lkml.kernel.org/r/20260130205935.2559335-17-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit de7f3ed37c1a433b7e1d5514e9a86a6c354e83d7 Author: Liam R. Howlett Date: Fri Jan 30 15:59:20 2026 -0500 maple_tree: introduce ma_leaf_max_gap() This is the same as mas_leaf_max_gap(), but the information necessary is known without a maple state in future code. Adding this function now simplifies the review for a subsequent patch. Link: https://lkml.kernel.org/r/20260130205935.2559335-16-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6953038cab845f3720ec8d83915f4f083861e195 Author: Liam R. Howlett Date: Fri Jan 30 15:59:19 2026 -0500 maple_tree: change initial big node setup in mas_wr_spanning_rebalance() Instead of copying the data into the big node and finding out that the data may need to be moved or appended to, calculate the data space up front (in the maple copy node) and set up another source for the copy. The additional copy source is tracked in the maple state sib (short for sibling), and is put into the maple write states for future operations after the data is in the big node. To facilitate the newly moved node, some initial setup of the maple subtree state are relocated after the potential shift caused by the new way of rebalancing against a sibling. Link: https://lkml.kernel.org/r/20260130205935.2559335-15-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit f141d5664388db2ec155f61c9ce36b9b4dc307bc Author: Liam R. Howlett Date: Fri Jan 30 15:59:18 2026 -0500 maple_tree: inline mas_spanning_rebalance_loop() into mas_wr_spanning_rebalance() Just copy the code and replace count with height. This is done to avoid affecting other code paths into mas_spanning_rebalance_loop() for the next change. No functional change intended. Link: https://lkml.kernel.org/r/20260130205935.2559335-14-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b14ffd2c6c7d95d140ae1e955cf2738b0fa71f17 Author: Liam R. Howlett Date: Fri Jan 30 15:59:17 2026 -0500 maple_tree: testing update for spanning store Spanning store had some corner cases which showed up during rcu stress testing. Add explicit tests for those cases. At the same time add some locking for easier visibility of the rcu stress testing. Only a single dump of the tree will happen on the first detected issue instead of flooding the console with output. Link: https://lkml.kernel.org/r/20260130205935.2559335-13-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9ec1e972c3de3106140c18d2a1c7c74795d85a69 Author: Liam R. Howlett Date: Fri Jan 30 15:59:16 2026 -0500 maple_tree: introduce maple_copy node and use it in mas_spanning_rebalance() Introduce an internal-memory only node type called maple_copy to facilitate internal copy operations. Use it in mas_spanning_rebalance() for just the leaf nodes. Initially, the maple_copy node is used to configure the source nodes and copy the data into the big_node. The maple_copy contains a list of source entries with start and end offsets. One of the maple_copy entries can be itself with an offset of 0 to 2, representing the data where the store partially overwrites entries, or fully overwrites the entry. The side effect is that the source nodes no longer have to worry about partially copying the existing offset if it is not fully overwritten. This is in preparation of removal of the maple big_node, but for the time being the data is copied to the big node to limit the change size. Link: https://lkml.kernel.org/r/20260130205935.2559335-12-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6b74d44b6297de89284cec8a83fce223106c159a Author: Liam R. Howlett Date: Fri Jan 30 15:59:15 2026 -0500 maple_tree: correct right ma_wr_state end pivot in mas_wr_spanning_store() The end_piv will be needed in the next patch set and has not been set correctly in this code path. Correct the oversight before using it. Link: https://lkml.kernel.org/r/20260130205935.2559335-11-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2fce1c3c47caa73ceb0c97d2a3c4c9f470ad736c Author: Liam R. Howlett Date: Fri Jan 30 15:59:14 2026 -0500 maple_tree: move maple_subtree_state from mas_wr_spanning_store to mas_wr_spanning_rebalance Moving the maple_subtree_state is necessary for future cleanups and is only set up in mas_wr_spanning_rebalance() but never used. Link: https://lkml.kernel.org/r/20260130205935.2559335-10-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 368015952767753abdf13e62b31e58b8107fc916 Author: Liam R. Howlett Date: Fri Jan 30 15:59:13 2026 -0500 maple_tree: don't pass through height in mas_wr_spanning_store Height is not used locally in the function, so call the height argument closer to where it is passed in the next level. Link: https://lkml.kernel.org/r/20260130205935.2559335-9-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 41bcc348f23feacb2b6c16dd0b7aa7d024ce93cc Author: Liam R. Howlett Date: Fri Jan 30 15:59:12 2026 -0500 maple_tree: remove l_wr_mas from mas_wr_spanning_rebalance Use the wr_mas instead of creating another variable on the stack. Take the opportunity to remove l_mas from being used anywhere but in the maple_subtree_state. Link: https://lkml.kernel.org/r/20260130205935.2559335-8-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3dd3dbaac179e36861ca065cbbd7b89860ef883a Author: Liam R. Howlett Date: Fri Jan 30 15:59:11 2026 -0500 maple_tree: make ma_wr_states reliable for reuse in spanning store mas_extend_spanning_null() was not modifying the range min and range max of the resulting store operation. The result was that the maple write state no longer matched what the write was doing. This was not an issue as the values were previously not used, but to make the ma_wr_state usable in future changes, the range min/max stored in the ma_wr_state for left and right need to be consistent with the operation. Link: https://lkml.kernel.org/r/20260130205935.2559335-7-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6f2e522186cbd06fef61921a55375dfeb7885f2a Author: Liam R. Howlett Date: Fri Jan 30 15:59:10 2026 -0500 maple_tree: inline mas_spanning_rebalance() into mas_wr_spanning_rebalance() Copy the contents of mas_spanning_rebalance() into mas_wr_spanning_rebalance(), in preparation of removing initial big node use. No functional changes intended. Link: https://lkml.kernel.org/r/20260130205935.2559335-6-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit a2ac9935d3305a558cd16f7fb1521146fe86fe74 Author: Liam R. Howlett Date: Fri Jan 30 15:59:09 2026 -0500 maple_tree: remove unnecessary assignment of orig_l index The index value is already a copy of the maple state so there is no need to set it again. Link: https://lkml.kernel.org/r/20260130205935.2559335-5-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit df11f9ee8f5dbe4d8a0a61c70eb5a5d37d77c8a6 Author: Liam R. Howlett Date: Fri Jan 30 15:59:08 2026 -0500 maple_tree: extract use of big node from mas_wr_spanning_store() Isolate big node to use in its own function. No functional changes intended. Link: https://lkml.kernel.org/r/20260130205935.2559335-4-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3e302560b9b49f76d97f431d7b9de6829344ba87 Author: Liam R. Howlett Date: Fri Jan 30 15:59:07 2026 -0500 maple_tree: move mas_spanning_rebalance loop to function Move the loop over the tree levels to its own function. No intended functional changes. Link: https://lkml.kernel.org/r/20260130205935.2559335-3-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6884832472730e286d476b64882a5f6856625320 Author: Liam R. Howlett Date: Fri Jan 30 15:59:06 2026 -0500 maple_tree: fix mas_dup_alloc() sparse warning Patch series "maple_tree: Replace big node with maple copy", v3. The big node struct was created for simplicity of splitting, rebalancing, and spanning store operations by using a copy buffer to create the data necessary prior to breaking it up into 256B nodes. Certain operations were rather tricky due to the restriction of keeping NULL entries together and never at the end of a node (except the right-most node). The big node struct is incompatible with future features that are currently in development. Specifically different node types and different data type sizes for pivots. The big node struct was also a stack variable, which caused issues with certain configurations of kernel build. This series removes big node by introducing another node type which will never be written to the tree: maple_copy. The maple copy node operates more like a scatter/gather operation with a number of sources and destinations of allocated nodes. The sources are copied to the destinations, in turn, until the sources are exhausted. The destination is changed if it is filled or the split location is reached prior to the source data end. New data is inserted by using the maple copy node itself as a source with up to 3 slots and pivots. The data in the maple copy node is the data being written to the tree along with any fragment of the range(s) being overwritten. As with all nodes, the maple copy node is of size 256B. Using a node type allows for the copy operation to treat the new data stored in the maple copy node the same as any other source node. Analysis of the runtime shows no regression or benefit of removing the larger stack structure. The motivation is the ground work to use new node types and to help those with odd configurations that have had issues. The change was tested by myself using mm_tests on amd64 and by Suren on android (arm64). Limited testing on s390 qemu was also performed using stress-ng on the virtual memory, which should cover many corner cases. This patch (of 30): Use RCU_INIT_POINTER to initialize an rcu pointer to an initial value since there are no readers within the tree being created during duplication. There is no risk of readers seeing the initialized or uninitialized value until after the synchronization call in mas_dup_buld(). Link: https://lkml.kernel.org/r/20260130205935.2559335-1-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20260130205935.2559335-2-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Alice Ryhl Cc: Andrew Ballance Cc: Arnd Bergmann Cc: Christian Kujau Cc: Geert Uytterhoeven Cc: Kuninori Morimoto Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 0fd66c343ce7fb9bfc2a8ae9f4461e7c610652ad Author: Kevin Lourenco Date: Mon Dec 22 15:18:17 2025 +0100 mm/fadvise: validate offset in generic_fadvise When converted to (u64) for page calculations, a negative offset can produce extremely large page indices. This may lead to issues in certain advice modes (excessive readahead or cache invalidation). Reject negative offsets with -EINVAL for consistent argument validation and to avoid silent misbehavior. POSIX and the man page do not clearly define behavior for negative offset/len. FreeBSD rejects negative offsets as well, so failing with -EINVAL is consistent with existing practice. The man page can be updated separately to document the Linux behavior. Link: https://lkml.kernel.org/r/20260208135738.18992-1-klourencodev@gmail.com Link: https://lkml.kernel.org/r/20251222141817.13335-1-klourencodev@gmail.com Signed-off-by: Kevin Lourenco Acked-by: David Hildenbrand (Arm) Reviewed-by: Jan Kara Cc: Christian Brauner Cc: David Hildenbrand Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 318d87b8fa733bebdc9c803657671df0b7b8b006 Author: xu xin Date: Thu Feb 12 19:29:32 2026 +0800 ksm: initialize the addr only once in rmap_walk_ksm This is a minor performance optimization, especially when there are many for-loop iterations, because the addr variable doesn't change across iterations. Therefore, it only needs to be initialized once before the loop. Link: https://lkml.kernel.org/r/20260212192820223O_r2NQzSEPG_C56cs-z4l@zte.com.cn Link: https://lkml.kernel.org/r/20260212192932941MSsJEAyoRW4YdLBN7_myn@zte.com.cn Signed-off-by: xu xin Acked-by: David Hildenbrand (Arm) Cc: Chengming Zhou Cc: Hugh Dickins Cc: Wang Yaxin Cc: Yang Yang Signed-off-by: Andrew Morton commit 05566ebcc0cd170bd4f50c907ee3ed8e106251e3 Author: Jagadeesh Kona Date: Fri Mar 27 20:36:46 2026 +0530 clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON In Hamoa, SMMU invalidation requires the GCC_AGGRE_USB_NOC_AXI_CLK to be on for the USB QTB to be functional. This is currently explicitly enabled by the DWC3 glue driver, so an invalidation happening while the USB controller is suspended will fault. Solve this by voting for the GCC MMU USB QTB clock. Fixes: 161b7c401f4b ("clk: qcom: Add Global Clock controller (GCC) driver for X1E80100") Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Jagadeesh Kona Reviewed-by: Taniya Das Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260327-hamoa-usb-qtb-clk-always-on-v2-1-7d8a406e650f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 87df31ea43eef5f6b9e7be0fa2555e58a9455e05 Author: Krzysztof Kozlowski Date: Tue Mar 31 11:17:23 2026 +0200 clk: qcom: Constify list of critical CBCR registers The static array 'xxx_critical_cbcrs' contains probe match-like data and is not modified: neither by the driver defining it nor by common.c code using it. Make it const for code safety and code readability. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Vladimir Zapolskiy Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260331091721.61613-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 573ddd0d22aa06f72ea7d4152d65c8bcb0eca24e Author: Krzysztof Kozlowski Date: Tue Mar 31 11:17:22 2026 +0200 clk: qcom: Constify qcom_cc_driver_data The static 'struct qcom_cc_driver_data' contains probe match-like data and is not modified: neither by the driver defining it nor by common.c code using it. Make it const for code safety and code readability. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Vladimir Zapolskiy Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260331091721.61613-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 03aa6ed7069f4872333d410303ae8dd341bb096d Author: Krzysztof Kozlowski Date: Tue Mar 31 10:55:22 2026 +0200 clk: qcom: videocc-glymur: Constify qcom_cc_desc Static 'struct qcom_cc_desc' is not modified by drivers and can be made const for code safety. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Taniya Das Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260331085521.37337-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ee69d9e32bdb0044b9444f1ae12107ff8b5ff95f Author: Srinivas Pandruvada Date: Sun Apr 5 11:54:25 2026 -0700 tools/power/x86/intel-speed-select: v1.26 release This version includes the following changes: - Setting current base frequency as maximum for SST-BF with kernel QOS changes - Harmonize extended family decoded with the rest of the kernel - Minor changes for error codes and messages Signed-off-by: Srinivas Pandruvada commit 1b25f03f3daf7c26c37050a7b2b5858ad5f99cfc Author: Zhang Rui Date: Thu Mar 19 13:52:56 2026 +0800 tools/power/x86/intel-speed-select: Fix output when running on unsupported CLX platforms When running intel-speed-select on unsupported CLX platforms, it prints intel-speed-select: Invalid CPU model (85) : Success Because this is not a system error and errno is not set. Replace err() with exit(). Signed-off-by: Zhang Rui Signed-off-by: Srinivas Pandruvada commit 93f5b44b416c7419a76a5e1311fb750fca585638 Author: Zhang Rui Date: Thu Mar 19 13:52:55 2026 +0800 tools/power/x86/intel-speed-select: Print Version info when Incompatible API version is detected When running an old version intel-speed-select tool on newer platforms, even with "intel-speed-select -v", the tool only complains about "Incompatible API version", without giving the current version info. Print Version info whenever Incompatible API version is detected. Signed-off-by: Zhang Rui Signed-off-by: Srinivas Pandruvada commit 3e244dd513e26728577f1e4deca6fdf749b6f244 Author: Zhang Rui Date: Thu Mar 19 13:52:54 2026 +0800 tools/power/x86/intel-speed-select: Fix some program return value When running the "intel-speed-select -h" command, it returns 1. 0 when using a version that is API incompatible. 2. 1 when using a version that is API compatible. And this is confusing. Fix the program to return 0 for "-h" parameter, and return 1 whenever "Incompatible API versions" is detected. Signed-off-by: Zhang Rui Signed-off-by: Srinivas Pandruvada commit df4a83543117c7fc27077fd7f4ffe870556b257b Author: Zhang Rui Date: Mon Jan 26 08:27:01 2026 +0800 tools/power/x86/intel-speed-select: Fix cpu extended family ID decoding When decode and use CPU extended family ID in intel-speed-select, there are several potential issues, 1. Mask with 0x0f to get CPU extended family ID is bogus because CPU extended family ID takes 8 bits (bit 27:20). 2. Use CPU extended family ID fields without checking CPU family ID is risky. Because Intel SDM says, "The Extended Family ID needs to be examined only when the Family ID is 0FH." 3. Saving cpu family ID and cpu extended family ID separately doesn't align with Linux kernel. And it may bring extra complexity when making family specific changes in the future. Signed-off-by: Zhang Rui Signed-off-by: Srinivas Pandruvada commit ae67f582398611b9f67c06961e292e3a2612346d Author: Srinivas Pandruvada Date: Thu Mar 12 12:41:08 2026 -0700 tools/power/x86/intel-speed-select: Avoid current base freq as maximum SST-PP level change results in online/offline of CPUs with -o option. The Linux intel-pstate driver internally stores the current HWP_REQ MSR value during offline and restores them during online. It is possible that during SST-PP level change, the new HWP_CAP limits can be updated. So, when a CPU is online, the HWP_REQ MSR should be updated to new values based on HWP_CAP values. This is particularly problematic when either turbo is disabled or the current HWP_REQ value (stored before online) is less than the base frequency from the updated HWP_CAP MSR guaranteed value. If the HWP_REQ MSR is not updated, then the performance will be limited to the value before perf level change. Hence the tool updates cpufreq scaling_max_freq to the newer base_frequency value in this case. This step is not required when HWP interrupts are enabled, as the perf level change should result in a new interrupt with HWP_GUARANTEED_PERF_CHANGE_STATUS and the intel_pstate driver will update to new limits. But the tool needs to handle the case when HWP interrupts are not enabled but there is no way for the tool to know that HWP interrupts are enabled or not. So, it has to still update the scaling_max_freq. With the QOS changes in the kernel, user space writes to scaling_max_freq are treated as hard limits. So, when base frequency is increased with SST-BF enabled, the cpufreq subsystem will still not allow setting to the SST-BF high priority core frequency. So, the HWP_REQ MSR will still be capped to the user-set scaling_max_freq after SST-PP level change. To address this, instead of setting scaling_max_freq to the current HWP_CAP highest frequency, set it to the maximum integer value to set the QOS limit as unconstrained. In this case, the actual HWP_REQ maximum frequency will still be capped to HWP_CAP highest performance by the intel-pstate driver. So, it will not result in invalid HWP_REQ values. Signed-off-by: Srinivas Pandruvada commit 6b9a10d6f0a131a8ea6beae559a31084840b063d Author: John Hubbard Date: Sat Apr 4 14:28:29 2026 -0700 gpu: nova-core: vbios: use from_le_bytes() for PCI ROM header parsing Clippy fires two clippy::precedence warnings on the manual byte-shifting expression: warning: operator precedence can trip the unwary --> drivers/gpu/nova-core/vbios.rs:511:17 | 511 | / u32::from(data[29]) << 24 512 | | | u32::from(data[28]) << 16 513 | | | u32::from(data[27]) << 8 | |______________________________________________^ Clear the warnings by replacing manual byte-shifting with u32::from_le_bytes(). Using from_le_bytes() is also a tiny code improvement, because it uses less code and is clearer about the intent. Signed-off-by: John Hubbard Link: https://patch.msgid.link/20260404212831.78971-2-jhubbard@nvidia.com Signed-off-by: Danilo Krummrich commit de0aca13509bf47a2d49bc7a26d56079c758c95f Author: Eliot Courtney Date: Wed Apr 1 10:42:28 2026 +0900 gpu: nova-core: bitfield: fix broken Default implementation The current implementation does not actually set the default values for the fields in the bitfield. Fixes: 3fa145bef533 ("gpu: nova-core: register: generate correct `Default` implementation") Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260401-fix-bitfield-v2-1-2fa68c98114a@nvidia.com Signed-off-by: Danilo Krummrich commit 0e0ffbcd0e8ef7a6919be5ff240b170f596815ca Author: Alexandre Courbot Date: Sun Apr 5 11:22:54 2026 +0900 gpu: nova-core: falcon: pad firmware DMA object size to required block alignment Commit a88831502c8f ("gpu: nova-core: falcon: use dma::Coherent") dropped the nova-local `DmaObject` device memory type for the kernel-global `Coherent` one. This switch had a side-effect: `DmaObject` always aligned the requested size to `PAGE_SIZE`, and also reported that adjusted size when queried. `Coherent`, on the other hand, does page-align allocation sizes but only allows CPU access on the exact size provided by the caller. This change runs into a limitation of falcon DMA copies, namely that DMA accesses are done on blocks of exactly 256 bytes. If the provided data does not have a length that is a multiple of 256, `dma_wr` returns an error. It was expected that all firmwares would present the proper adjusted size, but this is not the case at least on my GA107: NovaCore 0000:08:00.0: DMA transfer goes beyond range of DMA object NovaCore 0000:08:00.0: Failed to load FWSEC firmware: EINVAL NovaCore 0000:08:00.0: probe with driver NovaCore failed with error -22 Fix this by padding the `Coherent`'s size to `MEM_BLOCK_ALIGNMENT` (i.e. 256) when allocating it and filling it with zeroes, before copying the firmware on top of it. Fixes: a88831502c8f ("gpu: nova-core: falcon: use dma::Coherent") Reviewed-by: John Hubbard Reviewed-by: Gary Guo Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20260405-falcon-dma-roundup-v2-1-4af5b2ff9c16@nvidia.com Signed-off-by: Danilo Krummrich commit 8e6c34785a30012a53417b6d92e0ced71b9115a7 Author: Alexandre Courbot Date: Sat Apr 4 14:04:24 2026 +0900 gpu: nova-core: gsp: fix undefined behavior in command queue code `driver_read_area` and `driver_write_area` are internal methods that return slices containing the area of the command queue buffer that the driver has exclusive read or write access, respectively. While their returned value is correct and safe to use, internally they temporarily create a reference to the whole command-buffer slice, including GSP-owned regions. These regions can change without notice, and thus creating a slice to them, even if never accessed, is undefined behavior. Fix this by making these methods create slices to valid regions only. Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling") Reported-by: Danilo Krummrich Closes: https://lore.kernel.org/all/DH47AVPEKN06.3BERUSJIB4M1R@kernel.org/ Signed-off-by: Alexandre Courbot Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260404-cmdq-ub-fix-v5-1-53d21f4752f5@nvidia.com Signed-off-by: Danilo Krummrich commit d13a089d823e6b9a5a63728c4d1617ba1aca2740 Author: Masahiro Yamada Date: Mon Mar 30 20:57:35 2026 +0900 kconfig: forbid multiple entries with the same symbol in a choice Commit 6a859f1a19d1 ("powerpc: unify two CONFIG_POWERPC64_CPU entries in the same choice block") removed the only occurrence of this tricky use case. Disallow this pattern in choice_check_sanity() and revert commit 4d46b5b623e0 ("kconfig: fix infinite loop in sym_calc_choice()"). Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260330115736.1559962-1-masahiroy@kernel.org Reviewed-by: Nicolas Schier Signed-off-by: Nicolas Schier commit 2fb62d915476e3c2253f009ed0f45b82f5f46124 Author: Nathan Chancellor Date: Fri Mar 13 16:37:29 2026 -0700 Documentation: kbuild: Update the debug information notes in reproducible-builds.rst The debug information part of the "Absolute filenames" section in the reproducible builds document only mentions providing '-fdebug-prefix-map' to KCFLAGS but it needs to be provided to KAFLAGS as well since debug information has been generated for assembly files for a long time. Additionally, mention that the build directory may also appear as an absolute path in the debug information (via DW_AT_comp_dir), so it needs to be overridden via '-fdebug-prefix-map' as well. Reported-by: Alexander Coffin Closes: https://lore.kernel.org/b8dfe7035d19fd611b9be55ee3145fdb@purelymail.com/ Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20260313-kbuild-docs-repro-builds-fdebug-prefix-map-updates-v1-1-3aeeef7fa710@kernel.org Signed-off-by: Nicolas Schier commit c7c55f0e1667aa25c0ac047bd873159722358f6c Author: Thomas Weißschuh Date: Thu Apr 2 16:36:20 2026 +0200 checksyscalls: move instance functionality into generic code On MIPS the checksyscalls.sh script may be executed multiple times. Currently these multiple executions are executed on each build as kbuild see that the commands have changed each time. Use a dedicated stamp file for each different invocation to avoid the spurious executions. Signed-off-by: Thomas Weißschuh Acked-by: Arnd Bergmann Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20260402-kbuild-missing-syscalls-v3-3-6641be1de2db@weissschuh.net Signed-off-by: Nicolas Schier commit b34db3fa85c4d34ceee5231cd27e587153bc25ab Author: Thomas Weißschuh Date: Thu Apr 2 16:36:19 2026 +0200 checksyscalls: only run when necessary Currently checksyscalls.sh is unconditionally executed during each build. Most of these executions are unnecessary. Only run checksyscalls.sh if one of its inputs have changed. This new logic does not work for the multiple invocations done for MIPS. The effect is that checksyscalls.sh is still executed unconditionally. However this is not worse than before. Signed-off-by: Thomas Weißschuh Acked-by: Arnd Bergmann Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20260402-kbuild-missing-syscalls-v3-2-6641be1de2db@weissschuh.net Signed-off-by: Nicolas Schier commit e856b6ca14765501a47eb497f7e35dc7efefce5f Author: Thomas Weißschuh Date: Sat Apr 4 14:23:10 2026 +0200 checksyscalls: fail on all intermediate errors Make sure that a failure of any intermediate step also fails the overall execution. Link: https://sashiko.dev/#/patchset/20260402-kbuild-missing-syscalls-v3-0-6641be1de2db%40weissschuh.net Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260404-checksyscalls-set-e-v1-1-206400e78668@weissschuh.net Signed-off-by: Nicolas Schier commit 9fba6131aeaec0637fd8636b9fb49b6596214525 Author: Thomas Weißschuh Date: Thu Apr 2 16:36:18 2026 +0200 checksyscalls: move path to reference table to a variable An upcoming patch will need to reuse this path. Move it into a reusable variable. Signed-off-by: Thomas Weißschuh Acked-by: Arnd Bergmann Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20260402-kbuild-missing-syscalls-v3-1-6641be1de2db@weissschuh.net Signed-off-by: Nicolas Schier commit 7e629348df81b339dbc233313f0f36ff5a25fc3d Author: Marc Zyngier Date: Wed Apr 1 18:00:17 2026 +0100 KVM: arm64: Advertise ID_AA64PFR2_EL1.GCIE As we are missing ID_AA64PFR2_EL1.GCIE from the kernel feature set, userspace cannot write ID_AA64PFR2_EL1 with GCIE set, even if we are on a GICv5 host. Add the required field description. Acked-by: Catalin Marinas Link: https://patch.msgid.link/20260401170017.369529-1-maz@kernel.org Signed-off-by: Marc Zyngier commit e252ed8988578f01da5a4f5aa4c2269f96f03951 Author: Al Viro Date: Sun Feb 1 12:33:37 2026 -0500 coda_flag_children(): fix a UAF if de goes negative right under us, there's nothing to prevent inode getting freed just as we call coda_flag_inode(). We are not holding ->d_lock, so it's not impossible. Not going to be reproducible on bare hardware unless it's a realtime config, but it could happen on KVM. Trivial to fix - just hold rcu_read_lock() over that loop. Signed-off-by: Al Viro commit e6d683673167763ac364108b0b0eb10d0c605868 Author: Al Viro Date: Sun Feb 1 12:18:30 2026 -0500 sanitize coda_dentry_delete() d_really_is_negative(dentry) is a check for d_inode(dentry) being NULL; rechecking that is pointless (and no, it can't race - the caller is holding ->d_lock, so ->d_inode is stable) Signed-off-by: Al Viro commit 6fa6e4e21afd9360c7cdc24b8c1bdf6df274940c Author: Al Viro Date: Sun Feb 1 12:10:54 2026 -0500 coda: is_bad_inode() is always false there ... since dbd822046445 ("[PATCH] Coda FS update") back in 2002 Signed-off-by: Al Viro commit 9b3a2be84803cf18c4b4d1efc695991f0daa153c Author: Nam Cao Date: Fri Apr 3 19:28:48 2026 -0600 riscv: Remove support for XIP kernel XIP has a history of being broken for long periods of time. In 2023, it was broken for 18 months before getting fixed [1]. In 2024 it was 4 months [2]. And now it is broken again since commit a44fb5722199 ("riscv: Add runtime constant support"), 10 months ago. These are clear signs that XIP feature is not being used. I occasionally looked after XIP, but mostly because I was bored and had nothing better to do. Remove XIP support. Revert is possible if someone shows up complaining. Link: https://lore.kernel.org/linux-riscv/20231212-customary-hardcover-e19462bf8e75@wendy/ [1] Link: https://lore.kernel.org/linux-riscv/20240526110104.470429-1-namcao@linutronix.de/ [2] Signed-off-by: Nam Cao Cc: Frederik Haxel Cc: Vitaly Wool Reviewed-by: Jisheng Zhang Acked-by: Conor Dooley Link: https://patch.msgid.link/20260202115403.2119218-1-namcao@linutronix.de [pjw@kernel.org: updated to apply] Signed-off-by: Paul Walmsley commit 74aefe1387bdf015c0814cc1617aa94318db5710 Author: Nam Cao Date: Fri Apr 3 19:28:48 2026 -0600 riscv: Reuse compare_unaligned_access() in check_vector_unaligned_access() check_vector_unaligned_access() duplicates the logic in compare_unaligned_access(). Use compare_unaligned_access() and deduplicate. Signed-off-by: Nam Cao Link: https://patch.msgid.link/f18ca7e1efc2e4f231779a4b0bfae04b29f9dc62.1770830596.git.namcao@linutronix.de Signed-off-by: Paul Walmsley commit 4e062ef174929e2891ab5015d53fd5fdeaebd478 Author: Nam Cao Date: Fri Apr 3 19:28:47 2026 -0600 riscv: Split out compare_unaligned_access() Scalar misaligned access probe and vector misaligned access probe share very similar code. Split out this similar part from scalar probe into compare_unaligned_access(), which will be reused for vector probe in a follow-up commit. Signed-off-by: Nam Cao Link: https://patch.msgid.link/3695f77279d473eead8ed6210d97c941321cd4f1.1770830596.git.namcao@linutronix.de Signed-off-by: Paul Walmsley commit c03ad15f7cf60999681a3e5784404a73a93e6506 Author: Nam Cao Date: Fri Apr 3 19:28:47 2026 -0600 riscv: Reuse measure_cycles() in check_vector_unaligned_access() check_vector_unaligned_access() duplicates the logic in measure_cycles(). Reuse measure_cycles() and deduplicate. Signed-off-by: Nam Cao Link: https://patch.msgid.link/be4c66fd4120952195fdcd0e62d245c55f0711e2.1770830596.git.namcao@linutronix.de Signed-off-by: Paul Walmsley commit 67bdd7b01387d1620247e0c02b3396b7ff516f19 Author: Nam Cao Date: Fri Apr 3 19:28:47 2026 -0600 riscv: Split out measure_cycles() for reuse Byte cycle measurement and word cycle measurement of scalar misaligned access are very similar. Split these parts out into a common measure_cycles() function to avoid duplication. This function will also be reused for vector misaligned access probe in a follow-up commit. Signed-off-by: Nam Cao Link: https://patch.msgid.link/50d0598e45acc56c95176e52fbbe56e1f4becc84.1770830596.git.namcao@linutronix.de Signed-off-by: Paul Walmsley commit 6455c6c11827d3cd1b5f796047b562e51e4818e5 Author: Nam Cao Date: Fri Apr 3 19:28:47 2026 -0600 riscv: Clean up & optimize unaligned scalar access probe check_unaligned_access_speed_all_cpus() is more complicated than it should be: - It uses on_each_cpu() to probe unaligned memory access on all CPUs but excludes CPU0 with a check in the callback function. So an IPI to CPU0 is wasted. - Probing on CPU0 is done with smp_call_on_cpu(), which is not as fast as on_each_cpu(). The reason for this design is because the probe is timed with jiffies. Therefore on_each_cpu() excludes CPU0 because that CPU needs to tend to jiffies. Instead, replace jiffies usage with ktime_get_mono_fast_ns(). With jiffies out of the way, on_each_cpu() can be used for all CPUs and smp_call_on_cpu() can be dropped. To make ktime_get_mono_fast_ns() usable, move this probe to late_initcall. Anything after clocksource's fs_initcall works, but avoid depending on clocksource staying at fs_initcall. The choice of probe time is now 8000000 ns, which is the same as before (2 jiffies) for riscv defconfig. This is excessive for the CPUs I have, and probably should be reduced; but that's a different discussion. Suggested-by: Sebastian Andrzej Siewior Signed-off-by: Nam Cao Link: https://patch.msgid.link/9b9a20affe2e4f5c380926ceb885a47e20a59395.1770830596.git.namcao@linutronix.de Signed-off-by: Paul Walmsley commit bef64bcb940269a503d12eb1bc180d1aa9adf74d Author: Feng Jiang Date: Fri Apr 3 19:28:47 2026 -0600 riscv: lib: add strrchr() implementation Add an assembly implementation of strrchr() for RISC-V. This implementation minimizes instruction count and avoids unnecessary memory access to the stack. The performance benefits are most visible on small workloads (1-16 bytes) where the architectural savings in function overhead outweigh the execution time of the scan loop. Benchmark results (QEMU TCG, rv64): Length | Original (MB/s) | Optimized (MB/s) | Improvement -------|-----------------|------------------|------------ 1 B | 20 | 21 | +5.0% 7 B | 111 | 120 | +8.1% 16 B | 189 | 199 | +5.3% 512 B | 361 | 382 | +5.8% 4096 B | 388 | 391 | +0.8% Signed-off-by: Feng Jiang Tested-by: Joel Stanley Link: https://patch.msgid.link/20260130025018.172925-9-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit adf542133960d402f63c976b00e46be4d986d4c3 Author: Feng Jiang Date: Fri Apr 3 19:28:47 2026 -0600 riscv: lib: add strchr() implementation Add an assembly implementation of strchr() for RISC-V. By eliminating stack frame management (prologue/epilogue) and optimizing the function entries, the assembly version provides significant relative gains for short strings where the fixed overhead of the C function is most prominent. As string length increases, performance converges with the generic C implementation. Benchmark results (QEMU TCG, rv64): Length | Original (MB/s) | Optimized (MB/s) | Improvement -------|-----------------|------------------|------------ 1 B | 21 | 22 | +4.8% 7 B | 113 | 121 | +7.1% 16 B | 195 | 202 | +3.6% 512 B | 376 | 389 | +3.5% 4096 B | 394 | 393 | -0.3% Signed-off-by: Feng Jiang Tested-by: Joel Stanley Link: https://patch.msgid.link/20260130025018.172925-8-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit 5ba15d419fab848a3813eb56bbcad00e291fbc49 Author: Feng Jiang Date: Fri Apr 3 19:28:47 2026 -0600 riscv: lib: add strnlen() implementation Add an optimized strnlen() implementation for RISC-V. This version includes a generic optimization and a Zbb-powered optimization using the 'orc.b' instruction, derived from the strlen() implementation. Benchmark results (QEMU TCG, rv64): Length | Original (MB/s) | Optimized (MB/s) | Improvement -------|-----------------|------------------|------------ 16 B | 179 | 309 | +72.6% 512 B | 347 | 1562 | +350.1% 4096 B | 356 | 1878 | +427.5% Suggested-by: Qingfang Deng Signed-off-by: Feng Jiang Link: https://patch.msgid.link/20260130025018.172925-7-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit e73bcb3708a69369d506e5bc6a63d4fc13d8e28a Author: Feng Jiang Date: Fri Apr 3 19:28:47 2026 -0600 lib/string_kunit: extend benchmarks to strnlen() and chr searches Extend the string benchmarking suite to include strnlen(), strchr(), and strrchr(). For character search functions strchr() and strrchr(), the benchmark targets the NUL character. This ensures the entire string is scanned, providing a consistent measure of full-length processing efficiency comparable to strlen(). Suggested-by: Andy Shevchenko Suggested-by: Eric Biggers Signed-off-by: Feng Jiang Acked-by: Andy Shevchenko Reviewed-by: Kees Cook Link: https://patch.msgid.link/20260130025018.172925-6-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit 0020240a431187628e2636284023e63b9b7a2aa1 Author: Feng Jiang Date: Fri Apr 3 19:28:47 2026 -0600 lib/string_kunit: add performance benchmark for strlen() Introduce a benchmarking framework to the string_kunit test suite to measure the execution efficiency of string functions. The implementation is inspired by crc_benchmark(), measuring throughput (MB/s) and latency (ns/call) across a range of string lengths. It includes a warm-up phase, disables preemption during measurement, and uses a fixed seed for reproducible results. This framework allows for comparing different implementations (e.g., generic C vs. architecture-optimized assembly) within the KUnit environment. Initially, provide a benchmark for strlen(). Suggested-by: Andy Shevchenko Suggested-by: Eric Biggers Signed-off-by: Feng Jiang Reviewed-by: Kees Cook Link: https://patch.msgid.link/20260130025018.172925-5-jiangfeng@kylinos.cn [pjw@kernel.org: fixed a checkpatch issue] Signed-off-by: Paul Walmsley commit 27b2810a4a3dcd1545ec8bafc82f967eda591c47 Author: Feng Jiang Date: Fri Apr 3 19:28:47 2026 -0600 lib/string_kunit: add correctness test for strrchr() Add a KUnit test for strrchr() to verify correctness across different string lengths and memory alignments. Use vmalloc() to place the NUL character at the page boundary to ensure over-reads are detected. Suggested-by: Kees Cook Signed-off-by: Feng Jiang Reviewed-by: Kees Cook Link: https://patch.msgid.link/20260130025018.172925-4-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit 263dca234e5cc12aa8b434592ceb655538bf4ea4 Author: Feng Jiang Date: Fri Apr 3 19:28:47 2026 -0600 lib/string_kunit: add correctness test for strnlen() Add a KUnit test for strnlen() to verify correctness across different string lengths and memory alignments. Use vmalloc() to place the NUL character at the page boundary to ensure over-reads are detected. Suggested-by: Andy Shevchenko Suggested-by: Kees Cook Signed-off-by: Feng Jiang Reviewed-by: Kees Cook Link: https://patch.msgid.link/20260130025018.172925-3-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit ae45f896a40a07449d9b45d0395fb7245fdd75fc Author: Feng Jiang Date: Fri Apr 3 19:28:47 2026 -0600 lib/string_kunit: add correctness test for strlen() Add a KUnit test for strlen() to verify correctness across different string lengths and memory alignments. Use vmalloc() to place the NUL character at the page boundary to ensure over-reads are detected. Suggested-by: Kees Cook Signed-off-by: Feng Jiang Reviewed-by: Kees Cook Link: https://patch.msgid.link/20260130025018.172925-2-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit d7df0505478a3e479e914f0554b6b774a07a1b88 Author: Chen Pei Date: Fri Apr 3 19:28:47 2026 -0600 riscv: vdso_cfi: Add .gitignore for build artifacts The vdso_cfi build process copies source files (*.c, *.S) from the main vdso directory to the build directory. Without a .gitignore file, these copied files appear as untracked files in git status, cluttering the working directory. Add a .gitignore file to exclude: - Copied source files (*.c, *.S) - Temporary build files (vdso.lds, *.tmp, vdso-syms.S) - While preserving vdso-cfi.S which is the original entry point This follows the same pattern used in the main vdso directory and keeps the working directory clean. Signed-off-by: Chen Pei Link: https://patch.msgid.link/20260320021850.1877-3-cp0613@linux.alibaba.com Signed-off-by: Paul Walmsley commit 382cf7b75b05ee28b9ac2a27b6b8c7c4eb8910dc Author: Chen Pei Date: Fri Apr 3 19:28:47 2026 -0600 riscv: vdso_cfi: Add clean rule for copied sources When building VDSO with CFI support, source files are copied from the main VDSO directory to the CFI build directory as part of the build process. However, these copied source files were not removed during 'make clean', leaving temporary files in the build directory. Add the clean-files variable to ensure that these copied .c and .S files are properly cleaned up. The notdir() function is used to strip the path prefix, as clean-files expects relative file names without directory components. This ensures the build directory is left in a clean state after make clean. Signed-off-by: Chen Pei Link: https://patch.msgid.link/20260320021850.1877-2-cp0613@linux.alibaba.com Signed-off-by: Paul Walmsley commit d1f014012571323f3857873d94c2abf9343ef62d Author: Yufeng Wang Date: Fri Apr 3 19:28:47 2026 -0600 riscv: enable HAVE_IOREMAP_PROT RISC-V has implemented pte_pgprot() and selects GENERIC_IOREMAP, which provides a generic ioremap_prot() implementation. Enable HAVE_IOREMAP_PROT to activate generic_access_phys() support, which is useful for debugging (e.g., accessing /dev/mem via gdb). Also update the architecture support documentation accordingly. Signed-off-by: Yufeng Wang Link: https://patch.msgid.link/20260306112734.108186-1-r4o5m6e8o@163.com Signed-off-by: Paul Walmsley commit b0217d97eeeaca199eff23102b3fa72ea8c4ddea Author: Vivian Wang Date: Fri Apr 3 19:28:47 2026 -0600 riscv: mm: WARN_ON() for bad addresses in vmemmap_populate() Similarly to the same check in arch/arm64/mm/mmu.c, in vmemmap_populate(), add a warning for start and end being outside of the range of vmemmap. Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20260309-riscv-sparsemem-vmemmap-limits-v1-1-f40efe18e3cd@iscas.ac.cn Signed-off-by: Paul Walmsley commit dd598449338212f9262424fa67e40b5643ab6c06 Author: Yufeng Wang Date: Fri Apr 3 19:28:47 2026 -0600 riscv: acpi: update FADT revision check to 6.6 ACPI 6.6 is required for RISC-V as it introduces RISC-V specific tables such as RHCT (RISC-V Hart Capabilities Table) and RIMT (RISC-V I/O Mapping Table). Update the FADT revision check from 6.5 to 6.6 and remove the TODO comment since ACPI 6.6 has been officially released. Signed-off-by: Yufeng Wang Reviewed-by: Sunil V L Acked-by: Heinrich Schuchardt Reviewed-by: Yao Zi Link: https://patch.msgid.link/20260305091433.83983-1-r4o5m6e8o@163.com Signed-off-by: Paul Walmsley commit 5d5c5d0f2be9cf0351ad8e90516c519a8db22981 Author: Rui Qi Date: Fri Apr 3 19:28:47 2026 -0600 riscv: add hardware error trap handler support Add support for handling hardware error traps (exception code 19) in the RISC-V architecture. The changes include: - Add do_trap_hardware_error function declaration in asm-prototypes.h - Add hardware error trap vector entry in entry.S exception vector table - Implement do_trap_hardware_error handler in traps.c that generates SIGBUS with BUS_MCEERR_AR for hardware errors This enables proper handling of hardware error exceptions that may occur in RISC-V systems, providing appropriate error reporting and signal generation for user space processes. Signed-off-by: Rui Qi Link: https://patch.msgid.link/20260202094200.53735-1-qirui.001@bytedance.com [pjw@kernel.org: clean up commit message slightly] Signed-off-by: Paul Walmsley commit 580e626dd0304b4cafb2a5d21c6f0401b44f0ffb Author: Austin Kim Date: Fri Apr 3 19:28:47 2026 -0600 riscv: increase COMMAND_LINE_SIZE value to 2048 SoC people may send many parameters to configure the drivers via kernel command line. If COMMAND_LINE_SIZE is not enough, they may go through unexpected error. To avoid the potential pain, we had better increase COMMAND_LINE_SIZE. Signed-off-by: Austin Kim Link: https://patch.msgid.link/aW3gFmOlA/Z4kmfJ@adminpc-PowerEdge-R7525 Signed-off-by: Paul Walmsley commit ca1dd5c4a54b8aab9ea07680337c4c194f49861f Author: Zishun Yi Date: Sat Apr 4 18:42:42 2026 -0600 riscv: Fix typo in purgatory end label Fix the spelling of 'purgatory' in the .Lkexec_purgatroy_end label. Signed-off-by: Zishun Yi Link: https://patch.msgid.link/20260325083139.15638-1-vulab@iscas.ac.cn Signed-off-by: Paul Walmsley commit e8c98b3f810d8f880dba2a682e63c53810d2eae3 Author: Hui Wang Date: Sat Apr 4 18:42:41 2026 -0600 riscv: remove redundant #ifdef check in cpu-hotplug The cpu-hotplug.c only is built when CONFIG_HOTPLUG_CPU is defined, it is not needed to check HOTPLUG_CPU in this file. Signed-off-by: Hui Wang Link: https://patch.msgid.link/20260304033403.238012-2-hui.wang@canonical.com [pjw@kernel.org: removed extra whitespace at EOF] Signed-off-by: Paul Walmsley commit 22a9c228afb609bb7413eb5d26e6a672c939aa59 Author: Hui Wang Date: Sat Apr 4 18:42:41 2026 -0600 riscv: remove redundant check for CONFIG_SMP In the arch/riscv/Kconfig, the HOTPLUG_CPU depends on SMP, hence if the HOTPLUG_CPU is defined, the SMP has to be defined, it is not necessary to check SMP here. Signed-off-by: Hui Wang Link: https://patch.msgid.link/20260304033403.238012-1-hui.wang@canonical.com Signed-off-by: Paul Walmsley commit 7eb2e2954687bae09ca1b813df5d338744e7e538 Author: Charlie Jenkins Date: Sat Apr 4 18:42:41 2026 -0600 selftests: riscv: Add license to cfi selftest The cfi selftest was missing a license so add it. Signed-off-by: Charlie Jenkins Reviewed-by: Deepak Gupta Link: https://patch.msgid.link/20260309-fix_selftests-v2-4-9d5a553a531e@gmail.com Signed-off-by: Paul Walmsley commit c8d0c36d852ccd7caf9d5a44f3090f80a060c28d Author: Uwe Kleine-König Date: Sat Apr 4 18:42:40 2026 -0600 riscv: Simplify assignment for UTS_MACHINE The BITS variable conveniently allows to simplify the assignment for UTS_MACHINE. Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://patch.msgid.link/20260313164012.1153936-2-u.kleine-koenig@baylibre.com Signed-off-by: Paul Walmsley commit d8e99133eb4a8d09dcbf71f7277dc948d3413227 Author: Austin Kim Date: Sat Apr 4 18:42:40 2026 -0600 riscv: export kaslr offset and satp in VMCOREINFO ELF notes The following options are required by the kdump crash utility for RISC-V based vmcore file: - kaslr: If the vmcore is generated from a KASLR-enabled Linux kernel, the KASLR offset is required for the crash utility to load the vmcore. Without the proper kaslr option, the crash utility fails to load the vmcore file. - satp: The exact root page table address helps determine the correct base PGD address. With this patch, RISC-V VMCOREINFO ELF notes now include both kaslr and satp information. Signed-off-by: Austin Kim Link: https://patch.msgid.link/aYwKUE3ZzN7/ZY/A@adminpc-PowerEdge-R7525 Signed-off-by: Paul Walmsley commit ce3a360a6d0b3d2b2a23238ff1b7a4ac1280d196 Author: Austin Kim Date: Sat Apr 4 18:42:40 2026 -0600 riscv: move kaslr_offset() to page.h as a static inline function The kaslr_offset() function is a simple accessor that returns kernel_map.virt_offset. This commit change also ensures that kaslr_offset() is consistently available across various kernel configurations without requiring explicit linkage to mm/init.c. Signed-off-by: Austin Kim Link: https://patch.msgid.link/aYwJ76yHaMbbQVJA@adminpc-PowerEdge-R7525 Signed-off-by: Paul Walmsley commit 31454cb5f1a37eefe2465601418a978b7668424e Author: Vivian Wang Date: Sat Apr 4 18:42:40 2026 -0600 riscv: smp: Clarify comment "cache" -> "instruction cache" local_flush_icache_all() only flushes and synchronizes the *instruction* cache, not the data cache. Since RISC-V does have a cbo.flush instruction for data cache flush, clarify the comment to avoid confusion. Fixes: 58661a30f1bc ("riscv: Flush the instruction cache during SMP bringup") Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20260204-riscv-smp-comment-update-2026-01-v1-2-8b77aa181530@iscas.ac.cn Signed-off-by: Paul Walmsley commit fe0cf82fdeb318e8b2c78a4142385f42f467ff8c Author: Vivian Wang Date: Sat Apr 4 18:42:39 2026 -0600 riscv: smp: Remove outdated comment about disabling preemption Commit f1a0a376ca0c ("sched/core: Initialize the idle task with preemption disabled") removed a call to preempt_disable(), but not the associated comment. Remove the outdated comment. Fixes: f1a0a376ca0c ("sched/core: Initialize the idle task with preemption disabled") Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20260204-riscv-smp-comment-update-2026-01-v1-1-8b77aa181530@iscas.ac.cn Signed-off-by: Paul Walmsley commit 7d7c2d1c48790799568d06d1d4b1ca9ac7c900fb Author: Sean Chang Date: Sat Apr 4 18:42:39 2026 -0600 riscv: fix various typos in comments and code Fix various typos in RISC-V architecture code and comments. The following changes are included: - arch/riscv/errata/thead/errata.c: "futher" → "further" - arch/riscv/include/asm/atomic.h: "therefor" → "therefore", "arithmatic" → "arithmetic" - arch/riscv/include/asm/elf.h: "availiable" → "available", "coorespends" → "corresponds" - arch/riscv/include/asm/processor.h: "requries" → "is required" - arch/riscv/include/asm/thread_info.h: "returing" → "returning" - arch/riscv/kernel/acpi.c: "compliancy" → "compliance" - arch/riscv/kernel/ftrace.c: "therefor" → "therefore" - arch/riscv/kernel/head.S: "intruction" → "instruction" - arch/riscv/kernel/mcount-dyn.S: "localtion → "location" - arch/riscv/kernel/module-sections.c: "maxinum" → "maximum" - arch/riscv/kernel/probes/kprobes.c: "reenabled" → "re-enabled" - arch/riscv/kernel/probes/uprobes.c: "probbed" → "probed" - arch/riscv/kernel/soc.c: "extremly" → "extremely" - arch/riscv/kernel/suspend.c: "incosistent" → "inconsistent" - arch/riscv/kvm/tlb.c: "cahce" → "cache" - arch/riscv/kvm/vcpu_pmu.c: "indicies" → "indices" - arch/riscv/lib/csum.c: "implmentations" → "implementations" - arch/riscv/lib/memmove.S: "ammount" → "amount" - arch/riscv/mm/cacheflush.c: "visable" → "visible" - arch/riscv/mm/physaddr.c: "aginst" → "against" Signed-off-by: Sean Chang Acked-by: Conor Dooley Link: https://patch.msgid.link/20260212163325.60389-1-seanwascoding@gmail.com Signed-off-by: Paul Walmsley commit e8be82c2d77ec1bb0148406e54b105028a83537e Author: Michael Kelley Date: Thu Apr 2 13:24:00 2026 -0700 Drivers: hv: Move add_interrupt_randomness() to hypervisor callback sysvec The Hyper-V ISRs, for normal guests and when running in the hypervisor root patition, are calling add_interrupt_randomness() as a primary source of entropy. The call is currently in the ISRs as a common place to handle both x86/x64 and arm64. On x86/x64, hypervisor interrupts come through a custom sysvec entry, and do not go through a generic interrupt handler. On arm64, hypervisor interrupts come through an emulated GICv3. GICv3 uses the generic handler handle_percpu_devid_irq(), which does not do add_interrupt_randomness() -- unlike its counterpart handle_percpu_irq(). But handle_percpu_devid_irq() is now updated to do the add_interrupt_randomness(). So add_interrupt_randomness() is now needed only in Hyper-V's x86/x64 custom sysvec path. Move add_interrupt_randomness() from the Hyper-V ISRs into the Hyper-V x86/x64 custom sysvec path, matching the existing STIMER0 sysvec path. With this change, add_interrupt_randomness() is no longer called from any device drivers, which is appropriate. Signed-off-by: Michael Kelley Signed-off-by: Thomas Gleixner Acked-by: Wei Liu Link: https://patch.msgid.link/20260402202400.1707-3-mhklkml@zohomail.com commit bad28e01f206c533a8ff7fec5efe8ab9607a8364 Merge: fd7400cfcbaaa1 7aaa8047eafd0b Author: Thomas Gleixner Date: Sat Apr 4 20:59:34 2026 +0200 Merge tag 'v7.0-rc6' into irq/core to be able to merge the hyper-v patch related to randomness. commit 6e6e1e3be6d864332e520afd440bf4bbb52d0c90 Merge: 3aae9383f42f68 cd905830ea6184 Author: Rafael J. Wysocki Date: Sat Apr 4 20:58:54 2026 +0200 Merge tag 'devfreq-next-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux Pull devfreq updates for v7.1 from Chanwoo Choi: "- Remove unneeded casting for HZ_PER_KHZ on devfreq.c - Use _visible attribute to replace create/remove_sysfs_files() to fix sysfs attribute race conditions on devfreq.c - Add support for Tegra114 activity monitor device on tegra30-devfreq.c" * tag 'devfreq-next-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux: PM / devfreq: tegra30-devfreq: add support for Tegra114 PM / devfreq: use _visible attribute to replace create/remove_sysfs_files() PM / devfreq: Remove unneeded casting for HZ_PER_KHZ commit 5cdfedf68e6ee3905d36e387d49699d4d0848637 Merge: 35ed8fa05fb81f 9487e2a00e7b3c Author: Rafael J. Wysocki Date: Sat Apr 4 20:55:56 2026 +0200 Merge tag 'amd-pstate-v7.1-2026-04-02' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Pull amd-pstate new content for 7.1 (2026-04-02) from Mario Limonciello: "Add support for new features: * CPPC performance priority * Dynamic EPP * Raw EPP * New unit tests for new features Fixes for: * PREEMPT_RT * sysfs files being present when HW missing * Broken/outdated documentation" * tag 'amd-pstate-v7.1-2026-04-02' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: (22 commits) MAINTAINERS: amd-pstate: Step down as maintainer, add Prateek as reviewer cpufreq: Pass the policy to cpufreq_driver->adjust_perf() cpufreq/amd-pstate: Pass the policy to amd_pstate_update() cpufreq/amd-pstate-ut: Add a unit test for raw EPP cpufreq/amd-pstate: Add support for raw EPP writes cpufreq/amd-pstate: Add support for platform profile class cpufreq/amd-pstate: add kernel command line to override dynamic epp cpufreq/amd-pstate: Add dynamic energy performance preference Documentation: amd-pstate: fix dead links in the reference section cpufreq/amd-pstate: Cache the max frequency in cpudata Documentation/amd-pstate: Add documentation for amd_pstate_floor_{freq,count} Documentation/amd-pstate: List amd_pstate_prefcore_ranking sysfs file Documentation/amd-pstate: List amd_pstate_hw_prefcore sysfs file amd-pstate-ut: Add a testcase to validate the visibility of driver attributes amd-pstate-ut: Add module parameter to select testcases amd-pstate: Introduce a tracepoint trace_amd_pstate_cppc_req2() amd-pstate: Add sysfs support for floor_freq and floor_count amd-pstate: Add support for CPPC_REQ2 and FLOOR_PERF x86/cpufeatures: Add AMD CPPC Performance Priority feature. amd-pstate: Make certain freq_attrs conditionally visible ... commit 629be87e0d6be4c3683d3b39811804f42a78f04b Author: Huisong Li Date: Fri Apr 3 16:45:42 2026 +0800 cpuidle: Simplify cpuidle_register_device() with guard() Use guard() macro for mutex to simplify the control flow in cpuidle_register_device(). Signed-off-by: Huisong Li Link: https://patch.msgid.link/20260403084542.708104-1-lihuisong@huawei.com Signed-off-by: Rafael J. Wysocki commit 47e6a863a88034be102bde11197f2ca1bc18cbaf Author: Huisong Li Date: Fri Apr 3 17:02:53 2026 +0800 ACPI: processor: idle: Fix NULL pointer dereference in hotplug path A cpuidle_device might fail to register during boot, but the system can continue to run. In such cases, acpi_processor_hotplug() can trigger a NULL pointer dereference when accessing the per-cpu acpi_cpuidle_device. So add NULL pointer check for the per-cpu acpi_cpuidle_device in acpi_processor_hotplug. Signed-off-by: Huisong Li Link: https://patch.msgid.link/20260403090253.998322-1-lihuisong@huawei.com Signed-off-by: Rafael J. Wysocki commit 6c8dfb0362732bf1e4829867a2a5239fedc592d0 Author: Danilo Krummrich Date: Tue Mar 24 01:59:06 2026 +0100 bus: fsl-mc: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Tested-by: Ioana Ciornei Acked-by: Ioana Ciornei Acked-by: Christophe Leroy (CS GROUP) Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus") Link: https://patch.msgid.link/20260324005919.2408620-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 02c68ed11ceed569ad2d029a4138aead8ff13229 Author: Huisong Li Date: Fri Apr 3 16:53:43 2026 +0800 ACPI: processor: idle: Reset power_setup_done flag on initialization failure The 'power_setup_done' flag is a key indicator used across the ACPI processor driver to determine if cpuidle are properly configured and available for a given CPU. Currently, this flag is set during the early stages of initialization. However, if the subsequent registration of the cpuidle driver in acpi_processor_register_idle_driver() or the per-CPU device registration in acpi_processor_power_init() fails, this flag remains set. This may lead to some issues where other functions in ACPI idle driver use these flags. Fix this by explicitly resetting this flag to 0 in these error paths. Signed-off-by: Huisong Li Link: https://patch.msgid.link/20260403085343.866440-1-lihuisong@huawei.com Signed-off-by: Rafael J. Wysocki commit 7572dcabe38d904dd501e652b504a9ad364ba1cc Author: Rafael J. Wysocki Date: Tue Mar 31 21:38:52 2026 +0200 ACPI: TAD: Add alarm support to the RTC class device interface Add alarm support, based on Section 9.17 of ACPI 6.6 [1], to the RTC class device interface of the driver. The ACPI time and alarm device (TAD) can support two separate alarm timers, one for waking up the system when it is on AC power, and one for waking it up when it is on DC power. In principle, each of them can be set to a different value representing the number of seconds till the given alarm timer expires. However, the RTC class device can only set one alarm, so it will set both the alarm timers of the ACPI TAD (if the DC one is supported) to the same value. That is somewhat cumbersome because there is no way in the ACPI TAD firmware interface to set both timers in one go, so they need to be set sequentially, but that's how it goes. On the alarm read side, the driver assumes that both timers have been set to the same value, so it is sufficient to access one of them (the AC one specifically). Link: https://uefi.org/specs/ACPI/6.6/09_ACPI_Defined_Devices_and_Device_Specific_Objects.html#time-and-alarm-device [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Alexandre Belloni Link: https://patch.msgid.link/2076980.usQuhbGJ8B@rafael.j.wysocki commit 2ffc8bf29e4d7dff0e6c94f245d5a757be6c013d Author: Rafael J. Wysocki Date: Tue Mar 31 21:26:23 2026 +0200 ACPI: TAD: Split acpi_tad_rtc_read_time() Move the code converting a struct acpi_tad_rt into a struct rtc_time from acpi_tad_rtc_read_time() into a new function, acpi_tad_rt_to_tm(), to facilitate adding alarm support to the driver's RTC class device interface going forward. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Alexandre Belloni [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/9619488.CDJkKcVGEf@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit 9bcdd4ef4cd24ff360c6d0df3b8efad35d82bd94 Author: Rafael J. Wysocki Date: Tue Mar 31 21:25:40 2026 +0200 ACPI: TAD: Relocate two functions Move two functions introduced previously, __acpi_tad_wake_set() and __acpi_tad_wake_read(), to the part of the code preceding the sysfs interface implementation, since subsequently they will be used by the RTC device interface too. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Alexandre Belloni Link: https://patch.msgid.link/3960639.kQq0lBPeGt@rafael.j.wysocki commit b14b77bbea0a82cb66f1538824783e63d4128510 Author: Rafael J. Wysocki Date: Tue Mar 31 21:24:44 2026 +0200 ACPI: TAD: Split three functions to untangle runtime PM handling Move the core functionality of acpi_tad_get_real_time(), acpi_tad_wake_set(), and acpi_tad_wake_read() into separate functions called __acpi_tad_get_real_time(), __acpi_tad_wake_set(), and __acpi_tad_wake_read(), respectively, which can be called from code blocks following a single runtime resume of the device. This will facilitate adding alarm support to the RTC class device interface of the driver going forward. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Alexandre Belloni Link: https://patch.msgid.link/23076728.EfDdHjke4D@rafael.j.wysocki commit 00154eede77616d5c95206728ee36a1e5bbe52e1 Author: Rafael J. Wysocki Date: Tue Mar 31 21:09:42 2026 +0200 ACPI: processor: Rearrange and clean up acpi_processor_errata_piix4() In acpi_processor_errata_piix4() it is not necessary to use three struct pci_dev pointers. One is sufficient, so use it everywhere and drop the other two. Additionally, define the auxiliary local variables value1 and value2 in the code block in which they are used. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2846888.mvXUDI8C0e@rafael.j.wysocki commit d9cf7154deed71a4f23e81101571c79cdc77be00 Author: Aksh Garg Date: Thu Apr 2 14:25:45 2026 +0530 PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access The commit 18ac51ae9df9 ("PCI: cadence: Implement capability search using PCI core APIs") assumed all the platforms using Cadence PCIe controller support byte and word register accesses. This is not true for all platforms (e.g., TI J721E SoC, which only supports dword register accesses). This causes capability searches via cdns_pcie_find_capability() to fail on such platforms. Fix this by using cdns_pcie_read_sz() for config read functions, which properly handles size-aligned accesses. Remove the now-unused byte and word read wrapper functions (cdns_pcie_readw and cdns_pcie_readb). Fixes: 18ac51ae9df9 ("PCI: cadence: Implement capability search using PCI core APIs") Signed-off-by: Aksh Garg Signed-off-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260402085545.284457-1-a-garg7@ti.com commit f706a63fd82242a21cb5248b76c21d3c302a4b54 Author: Rafael J. Wysocki Date: Mon Mar 23 16:26:37 2026 +0100 ACPI: TAD: Use DC wakeup only if AC wakeup is supported According to Section 9.17.2 of ACPI 6.6 [1], setting ACPI_TAD_DC_WAKE in the capabilities without setting ACPI_TAD_AC_WAKE is invalid, so don't support wakeup if that's the case. Moreover, it is sufficient to check ACPI_TAD_AC_WAKE alone to determine if wakeup is supported at all, so use this observation to simplify one check. Link: https://uefi.org/specs/ACPI/6.6/09_ACPI_Defined_Devices_and_Device_Specific_Objects.html#gcp-get-capability [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2833494.mvXUDI8C0e@rafael.j.wysocki commit 93afe8ba9b0179b8e42777dad530db3ad9c9e835 Author: Rafael J. Wysocki Date: Tue Mar 10 21:29:29 2026 +0100 ACPI: TAD: Use dev_groups in struct device_driver Instead of creating and removing the device sysfs attributes directly during probe and remove of the driver, respectively, use dev_groups in struct device_driver to point to the attribute definitions and let the core take care of creating and removing them. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2836803.mvXUDI8C0e@rafael.j.wysocki commit 6db176eb41ad51e48a97431c9fbc0680aa338e5f Author: Rafael J. Wysocki Date: Wed Mar 4 19:16:48 2026 +0100 ACPI: TAD: Update the driver description comment Update the preamble comment describing the driver to match the code after previous changes along with the copyright information. No functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/23034847.EfDdHjke4D@rafael.j.wysocki commit 8a1e7f4b176401ae015516a3cf4a71af3615f7c2 Author: Rafael J. Wysocki Date: Wed Mar 4 19:16:01 2026 +0100 ACPI: TAD: Add RTC class device interface Add an RTC class device interface allowing to read and set the real time value to the ACPI TAD driver. Signed-off-by: Rafael J. Wysocki Reviewed-by: Alexandre Belloni Link: https://patch.msgid.link/2352027.iZASKD2KPV@rafael.j.wysocki commit fca4f233a247986db24b451682c3c6d52be4ff45 Author: Rafael J. Wysocki Date: Wed Mar 4 19:15:21 2026 +0100 ACPI: TAD: Clear unused RT data in acpi_tad_set_real_time() Move the clearing of the fields in struct acpi_tad_rt that are not used on the real time setting side to acpi_tad_set_real_time(). No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/8660506.T7Z3S40VBb@rafael.j.wysocki commit 3329a1416c3350449081ca5daaa94802a65b2992 Author: Rafael J. Wysocki Date: Wed Mar 4 19:14:44 2026 +0100 ACPI: TAD: Rearrange RT data validation checking Move RT data validation checks from acpi_tad_set_real_time() to a separate function called acpi_tad_rt_is_invalid() and use it also in acpi_tad_get_real_time() to validate data coming from the platform firmware. Also make acpi_tad_set_real_time() return -EINVAL when the RT data passed to it is invalid (instead of -ERANGE which is somewhat confusing) and introduce ACPI_TAD_TZ_UNSPEC to represent the "unspecified timezone" value. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3409319.aeNJFYEL58@rafael.j.wysocki commit e64ab3e217cf5e16301a73d5a5230265454b15c1 Author: Rafael J. Wysocki Date: Wed Mar 4 19:14:01 2026 +0100 ACPI: TAD: Use __free() for cleanup in time_store() Use __free() for the automatic freeing of memory pointed to by local variable str in time_store() which allows the code to become somewhat easier to follow. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/13971300.uLZWGnKmhe@rafael.j.wysocki commit 6c711fde3a1ce00165e3423eb8b7fa7888f0f313 Author: Rafael J. Wysocki Date: Wed Mar 4 19:13:15 2026 +0100 ACPI: TAD: Support RTC without wakeup The ACPI TAD can provide a functional RTC without wakeup capabilities, so stop failing probe if AC wakeup is not supported. Also, if _PRW is missing, do not fail probe, but clear the wakeup bits in capabilities. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/1959268.tdWV9SEqCh@rafael.j.wysocki commit 8be4a29b495ec8b1ed1e38a7db2e9160317b1ce8 Author: Rafael J. Wysocki Date: Wed Mar 4 19:12:22 2026 +0100 ACPI: TAD: Create one attribute group Instead of creating three attribute groups, one for each supported subset of capabilities, create just one and use an .is_visible() callback in it to decide which attributes to use. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2412153.ElGaqSPkdT@rafael.j.wysocki commit b48ee1f7404a17138785cb3ceb6a95e96b489c0d Author: Rafael J. Wysocki Date: Sat Mar 14 13:12:44 2026 +0100 rtc: cmos: Do not require IRQ if ACPI alarm is used If the ACPI RTC fixed event is used, a dedicated IRQ is not required for the CMOS RTC alarm to work, so allow the driver to use the alarm without a valid IRQ in that case. Signed-off-by: Rafael J. Wysocki Acked-by: Alexandre Belloni Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/6168746.MhkbZ0Pkbq@rafael.j.wysocki commit db5dab0784a8e8477598b52f3de7bdfbed733b3f Author: Rafael J. Wysocki Date: Sat Mar 14 13:11:20 2026 +0100 rtc: cmos: Enable ACPI alarm if advertised in ACPI FADT If the ACPI_FADT_FIXED_RTC flag is unset, the platform is declaring that it supports the ACPI RTC fixed event which should be used instead of a dedicated CMOS RTC IRQ. However, the driver only enables it when is_hpet_enabled() returns true, which is questionable because there is no clear connection between enabled HPET and signaling wakeup via the ACPI RTC fixed event (for instance, the latter can be expected to work on systems that don't include a functional HPET). Moreover, since use_hpet_alarm() returns false if use_acpi_alarm is set, the ACPI RTC fixed event is effectively used instead of the HPET alarm if the latter is functional, but there is no particular reason why it could not be used otherwise. Accordingly, on x86 systems with ACPI, set use_acpi_alarm if ACPI_FADT_FIXED_RTC is unset without looking at whether or not HPET is enabled. Also, do the ACPI FADT check in use_acpi_alarm_quirks() before the DMI BIOS year checks which are more expensive and it's better to skip them if ACPI_FADT_FIXED_RTC is set. Signed-off-by: Rafael J. Wysocki Acked-by: Alexandre Belloni Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/9618535.CDJkKcVGEf@rafael.j.wysocki commit 5573c44cb3fd01a9f62d569ae9ac870ef5f0e0ba Author: Chen-Yu Tsai Date: Tue Mar 24 17:35:41 2026 +0800 PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without cleaning up the allocated domains. Hence, reverse the order so that the IRQ domains are allocated after the controller's IRQ is found. This was flagged by Sashiko during a review of "[PATCH v6 0/7] PCI: mediatek-gen3: add power control support". Fixes: 814cceebba9b ("PCI: mediatek-gen3: Add INTx support") Signed-off-by: Chen-Yu Tsai Signed-off-by: Manivannan Sadhasivam Link: https://sashiko.dev/#/patchset/20260324052002.4072430-1-wenst%40chromium.org Link: https://patch.msgid.link/20260324093542.18523-1-wenst@chromium.org commit 3ef628c3f37f1dcef0da51e73ad6e458ec74bddb Merge: 16695153f8af94 e4ffa98a02f4d1 Author: Krzysztof Kozlowski Date: Sat Apr 4 17:34:56 2026 +0200 Merge tag 'microchip-soc-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/arm Microchip ARM64 SoC updates for v7.1 This update includes: - use a top-level configuration flag for all Microchip platforms * tag 'microchip-soc-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux: arm64: Kconfig: provide a top-level switch for Microchip platforms Signed-off-by: Krzysztof Kozlowski commit b5bfa8a92161dadb98d4b864f70ef8ba2edd9293 Merge: cefb8fb6482d1c 711cca0f1cfef5 Author: Krzysztof Kozlowski Date: Sat Apr 4 17:32:55 2026 +0200 Merge tag 'microchip-dt64-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt Microchip ARM64 device tree updates for v7.1 This update includes: - device tree files for the Microchip LAN9691 SoC and its evaluation board (Microchip EV23X71A) * tag 'microchip-dt64-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux: arm64: dts: microchip: add EV23X71A board dt-bindings: arm: AT91: document EV23X71A board arm64: dts: microchip: add LAN969x support arm64: dts: microchip: add LAN969x clock header file Signed-off-by: Krzysztof Kozlowski commit 98bc7682ffa3951cbade81c5a67fca3b5adabdd2 Merge: d7dbdadad23871 f3ae0049ff8a3d Author: Krzysztof Kozlowski Date: Sat Apr 4 17:30:56 2026 +0200 Merge tag 'at91-soc-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/drivers Microchip AT91 SoC updates for v7.1 This update includes: - device tree bindings conversion to DT schema for CHIPID, RAM controller and PIT, PIT64b, ST timers * tag 'at91-soc-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux: dt-bindings: arm: atmel,at91rm9200-sdramc: convert to DT schema dt-bindings: arm: atmel,at91rm9200-st: convert to DT schema dt-bindings: arm: microchip,sam9x60-pit64b : convert to DT schema dt-bindings: arm: atmel,at91sam9260-pit: convert to DT schema dt-bindings: arm: microchip,sama7g5-chipid : convert to DT schema Signed-off-by: Krzysztof Kozlowski commit cefb8fb6482d1cbb6ff9dd9681b94cc95c1f1e5b Merge: 55fbbbbed63136 7d7a9fc1310a0a Author: Krzysztof Kozlowski Date: Sat Apr 4 17:27:46 2026 +0200 Merge tag 'at91-dt-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt Microchip AT91 device tree updates for v7.1 This update includes: - enable LVDS, LCD and PMU for SAMA7D64 SoC - drop unused #address-cells, #size-cells for SAM9X60 UDC node * tag 'at91-dt-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: microchip: sama7d65: add Cortex-A7 PMU node arm: dts: microchip: remove unused #address-cells/#size-cells from sam9x60 udc node ARM: dts: microchip: sama7d65: add LVDS controller ARM: dts: microchip: sama7d65: add LCD controller Signed-off-by: Krzysztof Kozlowski commit 07e1a498ee9a9e715208c06b39edd8f7d22f3b50 Merge: 95c3f54db1e464 1f17fce8bf19a4 Author: Krzysztof Kozlowski Date: Sat Apr 4 17:24:37 2026 +0200 Merge tag 'at91-defconfig-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/defconfig Microchip AT91 defconfig updates for v7.1 This update includes: - LCD controller, LVDS controller, backlight, simple pannel, touchscreen configuration flags required by SAMA7D65 SoC * tag 'at91-defconfig-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: configs: at91: sama7: enable LVDS serializer support ARM: configs: at91: sama7: enable config for atmel maxtouch ARM: configs: at91: sama7: enable DRM hlcdc support Signed-off-by: Krzysztof Kozlowski commit 55fbbbbed631368cdcb77564f362cf75d2f12a0e Merge: d6192162958ea0 825b8c7e1d2918 Author: Krzysztof Kozlowski Date: Sat Apr 4 16:30:40 2026 +0200 Merge tag 'imx-dt64-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt Krzysztof notes: 1. This might impact users of i.MX8MM SPDIF as compatible is being replaced. Frank Li writes: i.MX arm64 device tree changes for 7.1: - New Board Support S32N79-RDB, Variscite DART-MX95, DART-MX91 with Sonata carrier boards, Verdin iMX95 with multiple carrier boards (Yavia, Mallow, Ivy, Dahlia) TQMa93xx/MBa93xxLA-MINI, SolidRun i.MX8MP HummingBoard IIoT, SolidRun i.MX8MM SOM and EVB, SolidRun SolidSense-N8 board Ka-Ro Electronics tx8m-1610 COM, GOcontroll Moduline IV and Moduline Mini, NXP FRDM-IMX91S board, i.MX93 Wireless EVK board with Wireless SiP, NXP i.MX8MP audio board v2. - USB & Type-C Support Type-C and USB nodes for imx943, correct power-fole for imx8qxp-mek/imx8qm-mek. - Audio Enhancements PDM microphone, bt-sco, and WM8962 sound card support for i.MX952. AONMIX MQS for i.MX95. Use audio-graph-card2 for imx8dxl-evk. WM8904 audio codec for imx8mm-var-som. - Thermal & Cooling PF09/53 thermal zone, fan node, active cooling on A55, SCMI sensor/lmm/cpu for imx943/imx94. - Display Support Multiple LVDS and parallel display overlays for TQ boards (imx91/imx93). Parallel display for i.MX93. ontat,kd50g21-40nt-a1 panel for imx93-9x9-qsb. pixpaper display overlay for i.MX93 FRDM. - Networking Multiple queue configuration on eqos for TQMa8MPxL. MaxLinear PHY support, MCP251xFD CAN controller for imx8mm-var-som. SDIO WiFi support (imx91-evk, imx8mp-evk, imx943-evk) - Bluetooth Support imx943-evk, imx93-14x14-evk, imx95-19x19-evk, imx8mp-evk, imx8mn-evk, imx8mm-evk. - Miscellaneous xspi and MT35XU01G SPI NOR flash for i.MX952. V2X/ELE mailbox nodes, SCMI misc ctrl-ids for imx94. eDMA channel reservation for V2X, Cortex M7 support for imx95. Ethos-U65 NPU and SRAM nodes for imx93. Wire up DMA IRQ for PCIe for imx8qm-ss-hsio. - Bug Fixes & Improvements Complete pinmux for rcwsr12 to fix I2C bus recovery affect other module pinmux for layscape platform. Multiple bug fixes for GPIO polarity, IRQ types, pinmux configurations. GICv3 PPI interrupt CPU mask cleanup across multiple SoCs. Fixed Ethernet PHY IRQ types on TQ boards. Fixed UART RTS/CTS muxing issues. Fixed SD card issues on Kontron boards. Fixed touch reset configuration. Removed fallback ethernet-phy-ieee802.3-c22 where appropriate. Move funnel outside from soc. TMU sensor ID cleanup. Change usdhc tuning step for eMMC and SD. Hexadecimal format, readability improvements, duplicate removal. * tag 'imx-dt64-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: (139 commits) arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual arm64: dts: imx8qm-mek: switch Type-C connector power-role to dual arm64: dts: lx2162a-clearfog: set sfp connector leds function and source arm64: dts: lx2162a-sr-som: add crypto & rtc aliases, model arm64: dts: lx2160a-cex7: add rtc alias arm64: dts: lx2160a: complete pinmux for rcwsr12 configuration word arm64: dts: lx2160a: change zeros to hexadecimal in pinmux nodes arm64: dts: lx2160a: add sda gpio references for i2c bus recovery arm64: dts: lx2160a: rename pinmux nodes for readability arm64: dts: lx2160a: remove duplicate pinmux nodes arm64: dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux arm64: dts: freescale: imx8mp-moduline-display-106: add typec-power-opmode property arm64: dts: imx8mp-tqma8mpql: Add DT overlays to explicit list arm64: dts: imx8mp-evk: Specify ADV7535 register addresses arm64: dts: imx8dxl-evk: Use audio-graph-card2 for wm8960-2 and wm8960-3 arm64: dts: imx943-evk: Add pf09/53 thermal zone arm64: dts: imx943-evk: Add fan node and enable active cooling on A55 arm64: dts: imx943-evk: Add nxp,ctrl-ids for scmi_misc arm64: dts: imx943: Add thermal support ... Signed-off-by: Krzysztof Kozlowski commit d6192162958ea0c4f847d27fe39918a3e9eb9351 Merge: 9c5a54409b6adb c70e6bc11d2008 Author: Krzysztof Kozlowski Date: Sat Apr 4 16:13:27 2026 +0200 Merge tag 'tegra-for-7.1-arm64-dt' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt arm64: tegra: Device tree changes for v7.1-rc1 Various fixes and new additions across a number of devices. GPIO and PCI are enabled on Tegra264 and the Jetson AGX Thor Developer Kit, allowing it to boot via network and mass storage. * tag 'tegra-for-7.1-arm64-dt' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: Add Tegra264 GPIO controllers arm64: tegra: smaug: Enable SPI-NOR flash arm64: tegra: Add Jetson AGX Thor Developer Kit support arm64: tegra: Add PCI controllers on Tegra264 arm64: tegra: Fix RTC aliases arm64: tegra: Drop redundant clock and reset names for TSEC arm64: tegra: Fix snps,blen properties dt-bindings: pci: Document the NVIDIA Tegra264 PCIe controller Signed-off-by: Krzysztof Kozlowski commit 8b155f2e4a91f3507951e6ace4b413688ac28b96 Author: Caleb Sander Mateos Date: Fri Apr 3 12:48:51 2026 -0600 block: remove unused BVEC_ITER_ALL_INIT This macro no longer has any users, so remove it. Signed-off-by: Caleb Sander Mateos Link: https://patch.msgid.link/20260403184852.2140919-1-csander@purestorage.com Signed-off-by: Jens Axboe commit d7dbdadad2387147fa22c62faa66f3d9d1421ee8 Merge: a66cc657ef52c7 bed2f5b4de6c6f Author: Krzysztof Kozlowski Date: Sat Apr 4 16:09:43 2026 +0200 Merge tag 'tegra-for-7.1-dt-bindings' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers dt-bindings: Changes for v7.1-rc1 This contains a few conversions to DT schema along with various additions and fixes to reduce the amount of validation warnings. Included are also a new binding for the PCIe controller found on Tegra264 as well as compatible strings for the Jetson AGX Thor Developer Kit. * tag 'tegra-for-7.1-dt-bindings' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: dt-bindings: arm: tegra: Document Jetson AGX Thor DevKit dt-bindings: display: tegra: Document Tegra20 HDMI port dt-bindings: arm: tegra: Add Tegra238 CBB compatible strings dt-bindings: memory: tegra210: Mark EMC as cooling device dt-bindings: memory: Add Tegra210 memory controller bindings dt-bindings: phy: tegra: Document Tegra210 USB PHY dt-bindings: arm: tegra: Add missing compatible strings dt-bindings: interrupt-controller: tegra: Fix reg entries dt-bindings: clock: tegra124-dfll: Convert to json-schema dt-bindings: phy: tegra-xusb: Document Type C support dt-bindings: pci: Document the NVIDIA Tegra264 PCIe controller Signed-off-by: Krzysztof Kozlowski commit 9c5a54409b6adbffcaedcaffa70521ee24441234 Merge: 8366b60cbea2fb ce74a6c6d88ba9 Author: Krzysztof Kozlowski Date: Sat Apr 4 16:03:22 2026 +0200 Merge tag 'tegra-for-7.1-arm-dt' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt ARM: tegra: Device tree changes for v7.1-rc1 Various improvements for Tegra114 boards, as well as some legacy cleanup for PAZ00 and Transformers devices. * tag 'tegra-for-7.1-arm-dt' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: ARM: tegra: paz00: Configure WiFi rfkill switch through device tree ARM: tegra: transformers: Add connector node ARM: tegra: Add External Memory Controller node on Tegra114 ARM: tegra: Add ACTMON node to Tegra114 device tree ARM: tegra: lg-x3: Add node for capacitive buttons ARM: tegra: lg-x3: Add USB and power related nodes ARM: tegra: lg-x3: Add panel and bridge nodes ARM: tn7: Adjust panel node ARM: tegra: Add SOCTHERM support on Tegra114 Signed-off-by: Krzysztof Kozlowski commit 761fdf4c8c1c0bd8427f8226be3a3eb5cf896386 Author: Daniel Lezcano Date: Thu Apr 2 10:44:25 2026 +0200 thermal/core: Remove pointless variable when registering a cooling device The 'id' variable is set to store the ida_alloc() value which is already stored into cdev->id. It is pointless to use it because cdev->id can be used instead. Signed-off-by: Daniel Lezcano Signed-off-by: Daniel Lezcano Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/20260402084426.1360086-1-daniel.lezcano@kernel.org Signed-off-by: Rafael J. Wysocki commit 49c7db1f0b4fbc52435c0f042d95c62a56e9be14 Merge: 9e07e3b81807ed 945471425a374e Author: Rafael J. Wysocki Date: Sat Apr 4 14:59:43 2026 +0200 Merge back earlier thermal core updates for 7.1 commit 35ed8fa05fb81fae4eb92ccc55dd6007d409e2f3 Merge: 6dcf9d0064ce2f 2e00c2dcc5325a Author: Rafael J. Wysocki Date: Sat Apr 4 14:58:58 2026 +0200 Merge back earlier cpufreq material for 7.1 commit f44cc3a48acaf9909e3953eb69299e3c773c9111 Author: Borislav Petkov (AMD) Date: Sat Apr 4 13:12:09 2026 +0200 x86/fpu: Correct misspelled xfeaures_to_write local var It happens. Fix it. No functional changes. Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260404120048.14765-1-bp@kernel.org commit 5ab7a225888baa5474def18ba3b0a298d27e6ba0 Author: Manikanta Maddireddy Date: Tue Mar 24 13:38:57 2026 +0530 misc: pci_endpoint_test: Add Tegra194 and Tegra234 device table entries Add PCI device IDs for Tegra194 (0x1ad4) and Tegra234(0x229b) Endpoint controllers, so that pci_endpoint_test can bind and run on these controllers. Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260324080857.916263-5-mmaddireddy@nvidia.com commit 12a22fb38cbba1991a3f174912b343cdb6afa186 Author: Manikanta Maddireddy Date: Tue Mar 24 13:38:56 2026 +0530 PCI: tegra194: Expose BAR2 (MSI-X) and BAR4 (DMA) as 64-bit BAR_RESERVED Tegra Endpoint exposes three 64-bit BARs at indices 0, 2, and 4: - BAR0+BAR1: EPF test/data (programmable 64-bit BAR) - BAR2+BAR3: MSI-X table (hardware-backed) - BAR4+BAR5: DMA registers (hardware-backed) Update tegra_pcie_epc_features so that BAR2 is BAR_RESERVED with PCI_EPC_BAR_RSVD_MSIX_TBL_RAM (64 KB) & PCI_EPC_BAR_RSVD_MSIX_PBA_RAM (64 KB) and BAR4 is BAR_RESERVED with PCI_EPC_BAR_RSVD_DMA_CTRL_MMIO (4KB). This keeps CONSECUTIVE_BAR_TEST working while allowing the host to use 64-bit BAR2 (MSI-X) and BAR4 (DMA). Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260324080857.916263-4-mmaddireddy@nvidia.com commit 5aec1f18b326ddc455ae9d9d0f5394efc20eee9b Author: Manikanta Maddireddy Date: Tue Mar 24 13:38:55 2026 +0530 PCI: tegra194: Make BAR0 programmable and remove 1MB size limit The Tegra194/234 Endpoint does not support the Resizable BAR capability, but BAR0 can be programmed to different sizes via the DBI2 BAR registers in dw_pcie_ep_set_bar_programmable(). The BAR0 size is set once during initialization. Remove the fixed 1MB limit from pci_epc_features so Endpoint function drivers can configure the BAR0 size they need. Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260324080857.916263-3-mmaddireddy@nvidia.com commit 5f352433ea39171e19fbb3a7e18d983510176854 Author: Manikanta Maddireddy Date: Tue Mar 24 13:38:54 2026 +0530 PCI: endpoint: Add reserved region type for MSI-X Table and PBA Add PCI_EPC_BAR_RSVD_MSIX_TBL_RAM and PCI_EPC_BAR_RSVD_MSIX_PBA_RAM to enum pci_epc_bar_rsvd_region_type so that Endpoint controllers can describe hardware-owned MSI-X Table and PBA (Pending Bit Array) regions behind a BAR_RESERVED BAR. Signed-off-by: Manikanta Maddireddy Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260324080857.916263-2-mmaddireddy@nvidia.com commit 4d7937d8cc32b027a14cb8152d9df64d17e9392c Author: Richard Zhu Date: Tue Mar 24 10:30:33 2026 +0800 dt-bindings: PCI: imx6q-pcie: Add i.MX94 and i.MX943 SoCs Add bindings support for PCIe endpoint controllers in i.MX94 and i.MX943 SoCs with fallback to the i.MX95 SoC. Signed-off-by: Richard Zhu [mani: commit log] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260324023036.784466-3-hongxing.zhu@nxp.com commit 401359ef44af43b6b775dc01bb7b31396db67aab Author: Richard Zhu Date: Tue Mar 24 10:30:32 2026 +0800 dt-bindings: PCI: imx6q-pcie: Fix maxItems of clocks and clock-names Commit 1352f58d7c8d ("dt-bindings: PCI: pci-imx6: Add external reference clock input") that added reference clock to the binding was incomplete. The constraints for "clocks" and "clock-names" still enforce an incorrect number of items. Update maxItems for both properties to 6 to match the actual hardware configuration. Fixes: 1352f58d7c8d ("dt-bindings: PCI: pci-imx6: Add external reference clock input") Signed-off-by: Richard Zhu [mani: commit log] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260324023036.784466-2-hongxing.zhu@nxp.com commit c54d5f5b33990f2649c20f35407f340bcadb8a53 Author: Felix Gu Date: Tue Mar 24 01:57:59 2026 +0800 PCI: aspeed: Fix IRQ domain leak on platform_get_irq() failure The aspeed_pcie_probe() function calls aspeed_pcie_init_irq_domain() which allocates pcie->intx_domain and initializes MSI. However, if platform_get_irq() fails afterwards, the cleanup action was not yet registered via devm_add_action_or_reset(), causing the IRQ domain resources to leak. Fix this by registering the devm cleanup action immediately after aspeed_pcie_init_irq_domain() succeeds, before calling platform_get_irq(). This ensures proper cleanup on any subsequent failure. Fixes: 9aa0cb68fcc1 ("PCI: aspeed: Add ASPEED PCIe RC driver") Signed-off-by: Felix Gu Signed-off-by: Manivannan Sadhasivam Tested-by: Jacky Chou Link: https://patch.msgid.link/20260324-aspeed-v1-1-354181624c00@gmail.com commit e9f850ba66cdf6b77fb4f005e46c4b605c4de434 Author: Rafael J. Wysocki Date: Wed Mar 4 13:55:43 2026 +0100 rtc: cmos: Use platform_get_irq_optional() in cmos_platform_probe() The rtc-cmos driver can live without an IRQ and returning an error code from platform_get_irq() is not a problem for it in general, so make it call platform_get_irq_optional() in cmos_platform_probe() instead of platform_get_irq() to avoid a confusing error message printed by the latter if an IRQ cannot be found for index 0, which is possible on x86 platforms. Additionally, on x86, if the IRQ is not defined and the system has a legacy PIC, hardcode it to RTC_IRQ, which should be safe then (and which is what the dropped PNP code did). Fixes: d15f1c2e413e ("ACPI: PNP: Drop CMOS RTC PNP device support") Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/linux-acpi/20260303060752.GA2749263@ax162/ Tested-by: Nathan Chancellor Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12857714.O9o76ZdvQC@rafael.j.wysocki Signed-off-by: Alexandre Belloni commit fd2e9f820005d63769a6662c276b1f52a72ed041 Author: Thomas Weißschuh Date: Wed Apr 1 17:07:27 2026 +0200 tools/nolibc: use __builtin_offsetof() The current custom implementation of offsetof() fails UBSAN: runtime error: member access within null pointer of type 'struct ...' This means that all its users, including container_of(), free() and realloc(), fail. Use __builtin_offsetof() instead which does not have this issue and has been available since GCC 4 and clang 3. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260401-nolibc-asprintf-v1-1-46292313439f@weissschuh.net commit bf9c95f3eeefb7fc4b4a6380cc23f1dca744e379 Author: Sam Daly Date: Fri Apr 3 19:28:39 2026 +0200 staging: rtl8723bs: remove redundant & parentheses Remove redundant parentheses around the '&' operator to comply with kernel style guidelines, as reported by checkpatch: CHECK: Unnecessary parentheses around adapter->securitypriv Signed-off-by: Sam Daly Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260403172839.367663-1-sam@samdaly.ie Signed-off-by: Greg Kroah-Hartman commit 867fb336a65ac59260674382168d2d93896ffa8d Author: Thomas Weißschuh Date: Sat Apr 4 10:08:23 2026 +0200 tools/nolibc: use makedev() in fstatat() fstatat() contains two open-coded copies of makedev() to handle minor numbers >= 256. Now that the regular makedev() handles both large minor and major numbers correctly use the common function. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260404-nolibc-makedev-v2-6-456a429bf60c@weissschuh.net commit 572246dcddb5455d62d5d152fe31105542b10ff5 Author: Thomas Weißschuh Date: Sat Apr 4 10:08:22 2026 +0200 tools/nolibc: handle all major and minor numbers in makedev() and friends Remove the limitation of only handling small major and minor numbers. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260404-nolibc-makedev-v2-5-456a429bf60c@weissschuh.net commit df4ef52c1d4737ca68ce8f1ade5f61abad219055 Author: Thomas Weißschuh Date: Sat Apr 4 10:08:21 2026 +0200 tools/nolibc: make dev_t 64 bits wide statx() returns both 32-bit minor and major numbers. For both of them to fit into the 'dev_t' in 'struct stat', that needs to be 64 bits wide. The other uses of 'dev_t' in nolibc are makedev() and friends and mknod(). makedev() and friends are going to be adapted in an upcoming commit and mknod() will silently truncate 'dev_t' to 'unsigned int' in the kernel, similar to other libcs. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260404-nolibc-makedev-v2-4-456a429bf60c@weissschuh.net commit 70091eada34c9ebc650dc88dd0e8c9246c5df8f8 Author: Thomas Weißschuh Date: Sat Apr 4 10:08:20 2026 +0200 tools/nolibc: move the logic of makedev() and friends into functions Functions make it easier to keep the input and output types straight and avoid duplicate evaluations of their arguments. Also these functions will become a bit more complex to handle full 64-bit 'dev_t' which is easier to read in a function. Still stay compatible with code which expects these to be macros. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260404-nolibc-makedev-v2-3-456a429bf60c@weissschuh.net commit 5afc7e9b90b82e0c43615dcf2ff0559909714d83 Author: Thomas Weißschuh Date: Sat Apr 4 10:08:19 2026 +0200 selftests/nolibc: add a test for stat().st_rdev The handling of 'dev_t' values is about to be changed. Add a test to make sure they are returned correctly from stat(). Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260404-nolibc-makedev-v2-2-456a429bf60c@weissschuh.net commit 9c0ff257fbbe7f42a81c7b4eeefe8dfc9e8f52b3 Author: Thomas Weißschuh Date: Sat Apr 4 10:08:18 2026 +0200 selftests/nolibc: add some tests for makedev() and friends These functions/macros are about to be changed. Add some tests to make sure they continue working. As they only handle small dev_t values, only test those for now. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260404-nolibc-makedev-v2-1-456a429bf60c@weissschuh.net commit 7263b4fdb0b240e67e3ebd802e0df761d35a7fdf Author: Fangyu Yu Date: Fri Apr 3 23:30:18 2026 +0800 RISC-V: KVM: Reuse KVM_CAP_VM_GPA_BITS to select HGATP.MODE Reuse KVM_CAP_VM_GPA_BITS to advertise and select the effective G-stage GPA width for a VM. KVM_CHECK_EXTENSION(KVM_CAP_VM_GPA_BITS) returns the effective GPA bits for a VM, KVM_ENABLE_CAP(KVM_CAP_VM_GPA_BITS) allows userspace to downsize the effective GPA width by selecting a smaller G-stage page table format: - gpa_bits <= 41 selects Sv39x4 (pgd_levels=3) - gpa_bits <= 50 selects Sv48x4 (pgd_levels=4) - gpa_bits <= 59 selects Sv57x4 (pgd_levels=5) Reject the request with -EINVAL for unsupported values and with -EBUSY if vCPUs have been created or any memslot is populated. Signed-off-by: Fangyu Yu Reviewed-by: Andrew Jones Reviewed-by: Guo Ren Reviewed-by: Nutty Liu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260403153019.9916-4-fangyu.yu@linux.alibaba.com Signed-off-by: Anup Patel commit ec92248431be7ad08742e0d1dff5109cec5ef905 Author: Fangyu Yu Date: Fri Apr 3 23:30:17 2026 +0800 RISC-V: KVM: Cache gstage pgd_levels in struct kvm_gstage Gstage page-table helpers frequently chase gstage->kvm->arch to fetch pgd_levels. This adds noise and repeats the same dereference chain in hot paths. Add pgd_levels to struct kvm_gstage and initialize it from kvm->arch when setting up a gstage instance. Introduce kvm_riscv_gstage_init() to centralize initialization and switch gstage code to use gstage->pgd_levels. Suggested-by: Anup Patel Signed-off-by: Fangyu Yu Reviewed-by: Anup Patel Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20260403153019.9916-3-fangyu.yu@linux.alibaba.com Signed-off-by: Anup Patel commit 14a51045e10d3087b8374deef02a9d3a694132d6 Author: Al Viro Date: Wed Jan 21 18:17:12 2026 -0500 get rid of busy-waiting in shrink_dcache_tree() If shrink_dcache_tree() runs into a potential victim that is already dying, it must wait for that dentry to go away. To avoid busy-waiting we need some object to wait on and a way for dentry_unlist() to see that we need to be notified. The obvious place for the object to wait on would be on our stack frame. We will store a pointer to that object (struct completion_list) in victim dentry; if there's more than one thread wanting to wait for the same dentry to finish dying, we'll have their instances linked into a list, with reference in dentry pointing to the head of that list. * new object - struct completion_list. A pair of struct completion and pointer to the next instance. That's what shrink_dcache_tree() will wait on if needed. * add a new member (->waiters, opaque pointer to struct completion_list) to struct dentry. It is defined for negative live dentries that are not in-lookup ones and it will remain NULL for almost all of them. It does not conflict with ->d_rcu (defined for killed dentries), ->d_alias (defined for positive dentries, all live) or ->d_in_lookup_hash (defined for in-lookup dentries, all live negative). That allows to colocate all four members. * make sure that all places where dentry enters the state where ->waiters is defined (live, negative, not-in-lookup) initialize ->waiters to NULL. * if select_collect2() runs into a dentry that is already dying, have its caller insert a local instance of struct completion_list into the head of the list hanging off dentry->waiters and wait for completion. * if dentry_unlist() sees non-NULL ->waiters, have it carefully walk through the completion_list instances in that list, calling complete() for each. For now struct completion_list is local to fs/dcache.c; it's obviously dentry-agnostic, and it can be trivially lifted into linux/completion.h if somebody finds a reason to do so... Signed-off-by: Al Viro commit efcac8424ba6ab75f2e16be9b0ccfdf60b13b294 Author: Fangyu Yu Date: Fri Apr 3 23:30:16 2026 +0800 RISC-V: KVM: Support runtime configuration for per-VM's HGATP mode Introduces one per-VM architecture-specific fields to support runtime configuration of the G-stage page table format: - kvm->arch.pgd_levels: the corresponding number of page table levels for the selected mode. These fields replace the previous global variables kvm_riscv_gstage_mode and kvm_riscv_gstage_pgd_levels, enabling different virtual machines to independently select their G-stage page table format instead of being forced to share the maximum mode detected by the kernel at boot time. Signed-off-by: Fangyu Yu Reviewed-by: Andrew Jones Reviewed-by: Anup Patel Reviewed-by: Guo Ren Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20260403153019.9916-2-fangyu.yu@linux.alibaba.com Signed-off-by: Anup Patel commit 84e7a17d1813394b48b0641fce8217fc0bba1960 Author: Sanjay Govind Date: Fri Apr 3 22:35:50 2026 -0700 Input: xpad - add RedOctane Games vendor id Add vendor ID for RedOctane Games to xpad driver. Signed-off-by: Sanjay Govind Link: https://patch.msgid.link/20260311213106.271577-2-sanjay.govind9@gmail.com Signed-off-by: Dmitry Torokhov commit 802b4c158cf57d615dae50000be4c6063a7db7ba Author: Elliot Tester Date: Wed Mar 25 23:16:17 2026 +0100 Input: xpad - remove stale TODO and changelog header All items in the TODO block have since been addressed: axis tuning, analog button handling, rumble support, and dance pad USB IDs are all implemented. The manual changelog is also removed as history is tracked in git. Signed-off-by: Elliot Tester Link: https://patch.msgid.link/20260325221618.135833-1-elliotctester1@gmail.com Signed-off-by: Dmitry Torokhov commit 36f5a2b09e650b82d7b2a106e3b93af48c2010d9 Author: Miguel Ojeda Date: Sun Feb 8 23:46:58 2026 +0100 rust: prelude: use the "kernel vertical" imports style Format the Rust prelude to use the "kernel vertical" imports style [1]. No functional changes intended. Link: https://docs.kernel.org/rust/coding-guidelines.html#imports [1] Link: https://patch.msgid.link/20260208224659.18406-2-ojeda@kernel.org [ Rebased. - Miguel ] Signed-off-by: Miguel Ojeda commit 663385f9155f27892a97a5824006f806a32eb8dc Author: Lucas De Marchi Date: Mon Mar 30 08:13:52 2026 -0500 module: Simplify warning on positive returns from module_init() It should now be rare to trigger this warning - it doesn't need to be so verbose. Make it follow the usual style in the module loading code. For the same reason, drop the dump_stack(). Suggested-by: Petr Pavlu Signed-off-by: Lucas De Marchi Reviewed-by: Aaron Tomlin Reviewed-by: Petr Pavlu Reviewed-by: Daniel Gomez Signed-off-by: Sami Tolvanen commit 743f8cae549affe8eafb021b8c0e78a9f3bc23fa Author: Lucas De Marchi Date: Mon Mar 30 08:13:51 2026 -0500 module: Override -EEXIST module return The -EEXIST errno is reserved by the module loading functionality. When userspace calls [f]init_module(), it expects a -EEXIST to mean that the module is already loaded in the kernel. If module_init() returns it, that is not true anymore. Override the error when returning to userspace: it doesn't make sense to change potentially long error propagation call chains just because it's will end up as the return of module_init(). Closes: https://lore.kernel.org/all/aKLzsAX14ybEjHfJ@orbyte.nwl.cc/ Cc: Greg Kroah-Hartman Cc: Aaron Tomlin Cc: Petr Pavlu Cc: Daniel Gomez Cc: Phil Sutter Cc: Christophe Leroy Signed-off-by: Lucas De Marchi [Sami: Fixed a typo.] Signed-off-by: Sami Tolvanen commit 3741f8fa004bf598cd5032b0ff240984332d6f05 Merge: 353d8e7989b6ba bfc923b642874e Author: Jakub Kicinski Date: Fri Apr 3 16:48:03 2026 -0700 Merge branch 'dpll-add-frequency-monitoring-feature' Ivan Vecera says: ==================== dpll: add frequency monitoring feature This series adds support for monitoring the measured input frequency of DPLL input pins via the DPLL netlink interface. Some DPLL devices can measure the actual frequency being received on input pins. The approach mirrors the existing phase-offset-monitor feature: a device-level attribute (DPLL_A_FREQUENCY_MONITOR) enables or disables monitoring, and a per-pin attribute (DPLL_A_PIN_MEASURED_FREQUENCY) exposes the measured frequency in millihertz (mHz) when monitoring is enabled. Patch 1 adds the new attributes to the DPLL netlink spec (dpll.yaml), the DPLL_PIN_MEASURED_FREQUENCY_DIVIDER constant, regenerates the auto-generated UAPI header and netlink policy, and updates Documentation/driver-api/dpll.rst. Patch 2 adds the callback operations (freq_monitor_get/set for devices, measured_freq_get for pins) and the corresponding netlink GET/SET handlers in the DPLL core. The core only invokes measured_freq_get when the frequency monitor is enabled on the parent device. The freq_monitor_get callback is required when measured_freq_get is provided. Patch 3 implements the feature in the ZL3073x driver by extracting a common measurement latch helper from the existing FFO update path, adding a frequency measurement function, and wiring up the new callbacks. ==================== Link: https://patch.msgid.link/20260402184057.1890514-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit bfc923b642874ea6f94763d6060782072944ebd5 Author: Ivan Vecera Date: Thu Apr 2 20:40:57 2026 +0200 dpll: zl3073x: implement frequency monitoring Extract common measurement latch logic from zl3073x_ref_ffo_update() into a new zl3073x_ref_freq_meas_latch() helper and add zl3073x_ref_freq_meas_update() that uses it to latch and read absolute input reference frequencies in Hz. Add meas_freq field to struct zl3073x_ref and the corresponding zl3073x_ref_meas_freq_get() accessor. The measured frequencies are updated periodically alongside the existing FFO measurements. Add freq_monitor boolean to struct zl3073x_dpll and implement the freq_monitor_set/get device callbacks to enable/disable frequency monitoring via the DPLL netlink interface. Implement measured_freq_get pin callback for input pins that returns the measured input frequency in mHz. Reviewed-by: Petr Oros Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260402184057.1890514-4-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 15ed91aa84ea7bacef3c24286d5136055b4335a8 Author: Ivan Vecera Date: Thu Apr 2 20:40:56 2026 +0200 dpll: add frequency monitoring callback ops Add new callback operations for a dpll device: - freq_monitor_get(..) - to obtain current state of frequency monitor feature from dpll device, - freq_monitor_set(..) - to allow feature configuration. Add new callback operation for a dpll pin: - measured_freq_get(..) - to obtain the measured frequency in mHz. Obtain the feature state value using the get callback and provide it to the user if the device driver implements callbacks. The measured_freq_get pin callback is only invoked when the frequency monitor is enabled. The freq_monitor_get device callback is required when measured_freq_get is provided by the driver. Execute the set callback upon user requests. Reviewed-by: Vadim Fedorenko Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260402184057.1890514-3-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 3fdea79c09d169b6ea172b8d36232c3773f39973 Author: Ivan Vecera Date: Thu Apr 2 20:40:55 2026 +0200 dpll: add frequency monitoring to netlink spec Add DPLL_A_FREQUENCY_MONITOR device attribute to allow control over the frequency monitor feature. The attribute uses the existing dpll_feature_state enum (enable/disable) and is present in both device-get reply and device-set request. Add DPLL_A_PIN_MEASURED_FREQUENCY pin attribute to expose the measured input frequency in millihertz (mHz). The attribute is present in the pin-get reply. Add DPLL_PIN_MEASURED_FREQUENCY_DIVIDER constant to allow userspace to extract integer and fractional parts. Reviewed-by: Vadim Fedorenko Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260402184057.1890514-2-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 052ca584bd7c51de0de96e684631570459d46cda Author: Yosry Ahmed Date: Mon Mar 16 20:27:32 2026 +0000 KVM: selftests: Drop 'invalid' from svm_nested_invalid_vmcb12_gpa's name The test checks both invalid GPAs as well as unmappable GPAs, so drop 'invalid' from its name. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260316202732.3164936-10-yosry@kernel.org Signed-off-by: Sean Christopherson commit 428543fbf06c498d9835d549920c2206befc1589 Author: Yosry Ahmed Date: Mon Mar 16 20:27:31 2026 +0000 KVM: selftests: Rework svm_nested_invalid_vmcb12_gpa The test currently allegedly makes sure that VMRUN causes a #GP in vmcb12 GPA is valid but unmappable. However, it calls run_guest() with an the test vmcb12 GPA, and the #GP is produced from VMLOAD, not VMRUN. Additionally, the underlying logic just changed to match architectural behavior, and all of VMRUN/VMLOAD/VMSAVE fail emulation if vmcb12 cannot be mapped. The CPU still injects a #GP if the vmcb12 GPA exceeds maxphyaddr. Rework the test such to use the KVM_ONE_VCPU_TEST[_SUITE] harness, and test all of VMRUN/VMLOAD/VMSAVE with both an invalid GPA (-1ULL) causing a #GP, and a valid but unmappable GPA causing emulation failure. Execute the instructions directly from L1 instead of run_guest() to make sure the #GP or emulation failure is produced by the right instruction. Leave the #VMEXIT with unmappable GPA test case as-is, but wrap it with a test harness as well. Opportunisitically drop gp_triggered, as the test already checks that a #GP was injected through a SYNC. Also, use the first unmapped GPA instead of the maximum legal GPA, as some CPUs inject a #GP for the maximum legal GPA (likely in a reserved area). Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260316202732.3164936-9-yosry@kernel.org Signed-off-by: Sean Christopherson commit 2daf71bfd77d0b7ba7b81d1a6ac872ebb338ff31 Author: Yosry Ahmed Date: Mon Mar 16 20:27:30 2026 +0000 KVM: nSVM: Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12 fails KVM currently injects a #GP if mapping vmcb12 fails when emulating VMRUN/VMLOAD/VMSAVE. This is not architectural behavior, as #GP should only be injected if the physical address is not supported or not aligned. Instead, handle it as an emulation failure, similar to how nVMX handles failures to read/write guest memory in several emulation paths. When virtual VMLOAD/VMSAVE is enabled, if vmcb12's GPA is not mapped in the NPTs a VMEXIT(#NPF) will be generated, and KVM will install an MMIO SPTE and emulate the instruction if there is no corresponding memslot. x86_emulate_insn() will return EMULATION_FAILED as VMLOAD/VMSAVE are not handled as part of the twobyte_insn cases. Even though this will also result in an emulation failure, it will only result in a straight return to userspace if KVM_CAP_EXIT_ON_EMULATION_FAILURE is set. Otherwise, it would inject #UD and only exit to userspace if not in guest mode. So the behavior is slightly different if virtual VMLOAD/VMSAVE is enabled. Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") Reported-by: Jim Mattson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260316202732.3164936-8-yosry@kernel.org Signed-off-by: Sean Christopherson commit 878b8efa2adbbfffc97f68cbba243cdf18d943c0 Author: Yosry Ahmed Date: Mon Mar 16 20:27:29 2026 +0000 KVM: SVM: Treat mapping failures equally in VMLOAD/VMSAVE emulation Currently, a #GP is only injected if kvm_vcpu_map() fails with -EINVAL. But it could also fail with -EFAULT if creating a host mapping failed. Inject a #GP in all cases, no reason to treat failure modes differently. Similar to commit 01ddcdc55e09 ("KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN"), treat all failures equally. Fixes: 8c5fbf1a7231 ("KVM/nSVM: Use the new mapping API for mapping guest memory") Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260316202732.3164936-7-yosry@kernel.org Signed-off-by: Sean Christopherson commit 783cf7d01fb8788f37735c0a6c3955024189287c Author: Yosry Ahmed Date: Mon Mar 16 20:27:28 2026 +0000 KVM: SVM: Check EFER.SVME and CPL on #GP intercept of SVM instructions When KVM intercepts #GP on an SVM instruction from L2, it checks the legality of RAX, and injects a #GP if RAX is illegal, or otherwise synthesizes a #VMEXIT to L1. However, checking EFER.SVME and CPL takes precedence over both the RAX check and the intercept. Call nested_svm_check_permissions() first to cover both. Note that if #GP is intercepted on SVM instruction in L1, the intercept handlers of VMRUN/VMLOAD/VMSAVE already perform these checks. Note #2, if KVM does not intercept #GP, the check for EFER.SVME is not done in the correct order, because KVM handles it by intercepting the instructions when EFER.SVME=0 and injecting #UD. However, a #GP injected by hardware would happen before the instruction intercept, leading to #GP taking precedence over #UD from the guest's perspective. Opportunistically add a FIXME for this. Fixes: 82a11e9c6fa2 ("KVM: SVM: Add emulation support for #GP triggered by SVM instructions") Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260316202732.3164936-6-yosry@kernel.org Signed-off-by: Sean Christopherson commit d2fbeb61e1451eba09eb3249aaf1f01d4c5c1f8b Author: Yosry Ahmed Date: Mon Mar 16 20:27:27 2026 +0000 KVM: SVM: Move RAX legality check to SVM insn interception handlers When #GP is intercepted by KVM, the #GP interception handler checks whether the GPA in RAX is legal and reinjects the #GP accordingly. Otherwise, it calls into the appropriate interception handler for VMRUN/VMLOAD/VMSAVE. The intercept handlers do not check RAX. However, the intercept handlers need to do the RAX check, because if the guest has a smaller MAXPHYADDR, RAX could be legal from the hardware perspective (i.e. CPU does not inject #GP), but not from the vCPU's perspective. Note that with allow_smaller_maxphyaddr, both NPT and VLS cannot be used, so VMLOAD/VMSAVE have to be intercepted, and RAX can always be checked against the vCPU's MAXPHYADDR. Move the check into the interception handlers for VMRUN/VMLOAD/VMSAVE as the CPU does not check RAX before the interception. Read RAX using kvm_register_read() to avoid a false negative on page_address_valid() on 32-bit due to garbage in the higher bits. Keep the check in the #GP intercept handler in the nested case where a #VMEXIT is synthesized into L1, as the RAX check is still needed there and takes precedence over the intercept. Opportunistically add a FIXME about the #VMEXIT being synthesized into L1, as it needs to be conditional. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260316202732.3164936-5-yosry@kernel.org Signed-off-by: Sean Christopherson commit 435741a4e766e3704af03c9ac634a73b9e75fc4c Author: Yosry Ahmed Date: Mon Mar 16 20:27:26 2026 +0000 KVM: SVM: Properly check RAX on #GP intercept of SVM instructions When KVM intercepts #GP on an SVM instruction, it re-injects the #GP if the instruction was executed with a mis-algined RAX. However, a #GP should also be reinjected if RAX contains an illegal GPA, according to the APM, one of #GP conditions is: rAX referenced a physical address above the maximum supported physical address. Replace the PAGE_MASK check with page_address_valid(), which checks both page-alignment as well as the legality of the GPA based on the vCPU's MAXPHYADDR. Use kvm_register_read() to read RAX to so that bits 63:32 are dropped when the vCPU is in 32-bit mode, i.e. to avoid a false positive when checking the validity of the address. Note that this is currently only a problem if KVM is running an L2 guest and ends up synthesizing a #VMEXIT to L1, as the RAX check takes precedence over the intercept. Otherwise, if KVM emulates the instruction, kvm_vcpu_map() should fail on illegal GPAs and inject a #GP anyway. However, following patches will change the failure behavior of kvm_vcpu_map(), so make sure the #GP interception handler does this appropriately. Opportunistically drop a teaser FIXME about the SVM instructions handling on #GP belonging in the emulator. Fixes: 82a11e9c6fa2 ("KVM: SVM: Add emulation support for #GP triggered by SVM instructions") Fixes: d1cba6c92237 ("KVM: x86: nSVM: test eax for 4K alignment for GP errata workaround") Suggested-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260316202732.3164936-4-yosry@kernel.org [sean: massage wording with respect to kvm_register_read()] Signed-off-by: Sean Christopherson commit 27f70eaa8661c031f6c5efa4d72c7c4544cc41fc Author: Yosry Ahmed Date: Mon Mar 16 20:27:25 2026 +0000 KVM: SVM: Refactor SVM instruction handling on #GP intercept Instead of returning an opcode from svm_instr_opcode() and then passing it to emulate_svm_instr(), which uses it to find the corresponding exit code and intercept handler, return the exit code directly from svm_instr_opcode(), and rename it to svm_get_decoded_instr_exit_code(). emulate_svm_instr() boils down to synthesizing a #VMEXIT or calling the intercept handler, so open-code it in gp_interception(), and use svm_invoke_exit_handler() to call the intercept handler based on the exit code. This allows for dropping the SVM_INSTR_* enum, and the const array mapping its values to exit codes and intercept handlers. In gp_intercept(), handle SVM instructions and first with an early return, and invert is_guest_mode() checks, un-indenting the rest of the code. No functional change intended. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260316202732.3164936-3-yosry@kernel.org [sean: add BUILD_BUG_ON(), tweak formatting/naming] Signed-off-by: Sean Christopherson commit c85aaff26d55920d783adac431a59ec738a35aef Author: Yosry Ahmed Date: Mon Mar 16 20:27:24 2026 +0000 KVM: SVM: Properly check RAX in the emulator for SVM instructions Architecturally, VMRUN/VMLOAD/VMSAVE should generate a #GP if the physical address in RAX is not supported. check_svme_pa() hardcodes this to checking that bits 63-48 are not set. This is incorrect on HW supporting 52 bits of physical address space. Additionally, the emulator does not check if the address is not aligned, which should also result in #GP. Use page_address_valid() which properly checks alignment and the address legality based on the guest's MAXPHYADDR. Plumb it through x86_emulate_ops, similar to is_canonical_addr(), to avoid directly accessing the vCPU object in emulator code. Fixes: 01de8b09e606 ("KVM: SVM: Add intercept checks for SVM instructions") Suggested-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260316202732.3164936-2-yosry@kernel.org Signed-off-by: Sean Christopherson commit 353d8e7989b6babe8fe4ae06272230c7941c3f73 Author: Yoshihiro Shimoda Date: Wed Apr 1 20:36:08 2026 +0200 net: ethernet: ravb: Suspend and resume the transmission flow The current driver does not follow the latest datasheet and does not suspend the flow when stopping DMA and resume it when starting. Update the driver to do so. Signed-off-by: Yoshihiro Shimoda [Niklas: Rebase from BSP and reword commit message] Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20260401183608.1852225-1-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 5635c8bfd3ab0757c5461d2165f6b284862826bf Author: Naveen N Rao (AMD) Date: Wed Apr 1 10:26:32 2026 +0530 x86/apic: Drop AMD Extended Interrupt LVT macros AMD defines Extended Interrupt Local Vector Table (EILVT) registers to allow for additional interrupt sources. While the APIC registers for those are unique to AMD, the format of those registers follows the standard LVT registers. Drop EILVT-specific macros in favor of the standard APIC LVT macros. Drop unused APIC_EILVT_NR_AMD_K8 and APIC_EILVT_LVTOFF while at it. No functional change. [ bp: Merge the two cleanup patches into one. ] Signed-off-by: Naveen N Rao (AMD) Signed-off-by: Borislav Petkov (AMD) Tested-by: Manali Shukla Link: https://patch.msgid.link/b98d69037c0102d2ccd082a941888a689cd214c9.1775019269.git.naveen@kernel.org commit bfbb6cb1b6e4086b00584c4269324bb15f7d9221 Merge: 202432ae8a6948 9b6e1ed28a7f23 Author: Dave Jiang Date: Fri Apr 3 15:55:34 2026 -0700 Merge branch 'for-7.1/cxl-misc' into cxl-for-next MAINTAINERS: Update address for Dan Williams commit 9b6e1ed28a7f239cc9184101cedc6fec4c3b3dc9 Author: Dan Williams Date: Fri Apr 3 14:48:46 2026 -0700 MAINTAINERS: Update address for Dan Williams Update MAINTAINERS and .mailmap to point to my kernel.org address: djbw@kernel.org. Signed-off-by: Dan Williams Link: https://patch.msgid.link/20260403214846.1062341-1-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 48a5e77b49ff304f5ad76d07c864e4b2257493c3 Merge: 779fae61a3c84b 6637c03f35fa75 Author: Jakub Kicinski Date: Fri Apr 3 15:51:07 2026 -0700 Merge branch 'net-macb-remove-dedicated-irq-handler-for-wol' Kevin Hao says: ==================== net: macb: Remove dedicated IRQ handler for WoL During debugging of a suspend/resume issue, I observed that the macb driver employs a dedicated IRQ handler for Wake-on-LAN (WoL) support. To my knowledge, no other Ethernet driver adopts this approach. This implementation unnecessarily complicates the suspend/resume process without providing any clear benefit. Instead, we can easily modify the existing IRQ handler to manage WoL events, avoiding any overhead in the TX/RX hot path. The net throughput shows no significant difference following these changes. The following data(net throughput and execution time of macb_interrupt) were collected from my AMD Zynqmp board using the commands: taskset -c 1,2,3 iperf3 -c 192.168.3.4 -t 60 -Z -P 3 -R cat /sys/kernel/debug/tracing/trace_stat/function0 Before: ------- [SUM] 0.00-60.00 sec 5.99 GBytes 858 Mbits/sec 0 sender [SUM] 0.00-60.00 sec 5.99 GBytes 857 Mbits/sec receiver Function Hit Time Avg s^2 -------- --- ---- --- --- macb_interrupt 217996 678425.2 us 3.112 us 1.446 us After: ------ [SUM] 0.00-60.00 sec 6.00 GBytes 858 Mbits/sec 0 sender [SUM] 0.00-60.00 sec 5.99 GBytes 857 Mbits/sec receiver Function Hit Time Avg s^2 -------- --- ---- --- --- macb_interrupt 218212 668107.3 us 3.061 us 1.413 us ==================== Link: https://patch.msgid.link/20260402-macb-irq-v2-0-942d98ab1154@gmail.com Signed-off-by: Jakub Kicinski commit 6637c03f35fa75447d5c2c31db610929cff05813 Author: Kevin Hao Date: Thu Apr 2 21:41:25 2026 +0800 net: macb: Remove dedicated IRQ handler for WoL In the current implementation, the suspend/resume path frees the existing IRQ handler and sets up a dedicated WoL IRQ handler, then restores the original handler upon resume. This approach is not used by any other Ethernet driver and unnecessarily complicates the suspend/resume process. After adjusting the IRQ handler in the previous patches, we can now handle WoL interrupts without introducing any overhead in the TX/RX hot path. Therefore, the dedicated WoL IRQ handler is removed. I have verified WoL functionality on my AMD ZynqMP board using the following steps: root@amd-zynqmp:~# ifconfig end0 192.168.3.3 root@amd-zynqmp:~# ethtool -s end0 wol a root@amd-zynqmp:~# echo mem >/sys/power/state Signed-off-by: Kevin Hao Link: https://patch.msgid.link/20260402-macb-irq-v2-4-942d98ab1154@gmail.com Signed-off-by: Jakub Kicinski commit 6d55ce805b267400e682aa335787775bf253e5d8 Author: Kevin Hao Date: Thu Apr 2 21:41:24 2026 +0800 net: macb: Factor out the handling of non-hot IRQ events into a separate function In the current code, the IRQ handler checks each IRQ event sequentially. Since most IRQ events are related to TX/RX operations, while other events occur infrequently, this approach introduces unnecessary overhead in the hot path for TX/RX processing. This patch reduces such overhead by extracting the handling of all non-TX/RX events into a new function and consolidating these events under a new flag. As a result, only a single check is required to determine whether any non-TX/RX events have occurred. If such events exist, the handler jumps to the new function. This optimization reduces four conditional checks to one and prevents the instruction cache from being polluted with rarely used code in the hot path. Signed-off-by: Kevin Hao Link: https://patch.msgid.link/20260402-macb-irq-v2-3-942d98ab1154@gmail.com Signed-off-by: Jakub Kicinski commit 5986ff6e4136105f16d481bd0532b7da2c6344ae Author: Kevin Hao Date: Thu Apr 2 21:41:23 2026 +0800 net: macb: Introduce macb_queue_isr_clear() helper function The current implementation includes several occurrences of the following pattern: if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE) queue_writel(queue, ISR, value); Introduces a helper function to consolidate these repeated code segments. No functional changes are made. Suggested-by: Jakub Kicinski Signed-off-by: Kevin Hao Link: https://patch.msgid.link/20260402-macb-irq-v2-2-942d98ab1154@gmail.com Signed-off-by: Jakub Kicinski commit dc3bd465ea36af7fd6f9197c05353effc616145c Author: Kevin Hao Date: Thu Apr 2 21:41:22 2026 +0800 net: macb: Replace open-coded implementation with napi_schedule() The driver currently duplicates the logic of napi_schedule() primarily to include additional debug information. However, these debug details are not essential for a specific driver and can be effectively obtained through existing tracepoints in the networking core, such as /sys/kernel/tracing/events/napi/napi_poll. Therefore, this patch replaces the open-coded implementation with napi_schedule() to simplify the driver's code. Signed-off-by: Kevin Hao Link: https://patch.msgid.link/20260402-macb-irq-v2-1-942d98ab1154@gmail.com Signed-off-by: Jakub Kicinski commit 81d6f7c3a70b10ff757ee8b5f8114a190871cf1e Author: Danilo Krummrich Date: Tue Mar 24 01:59:14 2026 +0100 s390/ap: use generic driver_override infrastructure When the AP masks are updated via apmask_store() or aqmask_store(), ap_bus_revise_bindings() is called after ap_attr_mutex has been released. This calls __ap_revise_reserved(), which accesses the driver_override field without holding any lock, racing against a concurrent driver_override_store() that may free the old string, resulting in a potential UAF. Fix this by using the driver-core driver_override infrastructure, which protects all accesses with an internal spinlock. Note that unlike most other buses, the AP bus does not check driver_override in its match() callback; the override is checked in ap_device_probe() and __ap_revise_reserved() instead. Also note that we do not enable the driver_override feature of struct bus_type, as AP - in contrast to most other buses - passes "" to sysfs_emit() when the driver_override pointer is NULL. Thus, printing "\n" instead of "(null)\n". Additionally, AP has a custom counter that is modified in the corresponding custom driver_override_store(). Fixes: d38a87d7c064 ("s390/ap: Support driver_override for AP queue devices") Tested-by: Holger Dengler Reviewed-by: Holger Dengler Reviewed-by: Harald Freudenberger Link: https://patch.msgid.link/20260324005919.2408620-11-dakr@kernel.org Signed-off-by: Danilo Krummrich commit ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4 Author: Danilo Krummrich Date: Tue Mar 24 01:59:13 2026 +0100 s390/cio: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: ebc3d1791503 ("s390/cio: introduce driver_override on the css bus") Reviewed-by: Vineeth Vijayan Link: https://patch.msgid.link/20260324005919.2408620-10-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 85bb534ff12aab6916058897b39c748940a7a4c6 Author: Danilo Krummrich Date: Tue Mar 24 01:59:12 2026 +0100 vdpa: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 539fec78edb4 ("vdpa: add driver_override support") Acked-by: Eugenio Pérez Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260324005919.2408620-9-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 8a700b1fc94df4d847a04f14ebc7f8532592b367 Author: Danilo Krummrich Date: Tue Mar 24 01:59:10 2026 +0100 platform/wmi: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 12046f8c77e0 ("platform/x86: wmi: Add driver_override support") Reviewed-by: Armin Wolf Acked-by: Ilpo Järvinen Link: https://patch.msgid.link/20260324005919.2408620-7-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 10a4206a24013be4d558d476010cbf2eb4c9fa64 Author: Danilo Krummrich Date: Tue Mar 24 01:59:09 2026 +0100 PCI: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 782a985d7af2 ("PCI: Introduce new device binding path using pci_dev.driver_override") Acked-by: Bjorn Helgaas Acked-by: Alex Williamson Tested-by: Gui-Dong Han Reviewed-by: Gui-Dong Han Link: https://patch.msgid.link/20260324005919.2408620-6-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 779fae61a3c84bf5a086509558eb5b432fa5ab62 Author: Qingfang Deng Date: Thu Apr 2 13:00:50 2026 +0800 ppp: update Kconfig help message Both links of the PPPoE section are no longer valid, and the CVS version is no longer relevant. - Replace the TLDP URL with the pppd project homepage. - Update pppd version requirement for PPPoE. - Update RP-PPPoE project homepage, and clarify that it's only needed for server mode. Signed-off-by: Qingfang Deng Reviewed-by: Julian Braha Link: https://patch.msgid.link/20260402050053.144250-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski commit 1cf996ac307e4d8d86f07d72b55528df88b56ce6 Author: Bartosz Golaszewski Date: Thu Apr 2 16:15:04 2026 +0200 driver core: make software nodes available earlier Software nodes are currently initialized in a function registered as a postcore_initcall(). However, some devices may want to register software nodes earlier than that (or also in a postcore_initcall() where they're at the mercy of the link order). Move the initialization to driver_init() making swnode available much earlier as well as making their initialization time deterministic. Suggested-by: Dmitry Torokhov Signed-off-by: Bartosz Golaszewski Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20260402-nokia770-gpio-swnodes-v5-3-d730db3dd299@oss.qualcomm.com [ Fix typo in the commit message: "s/merci/mercy/". - Danilo ] Signed-off-by: Danilo Krummrich commit 1666d945b57b5a10bdea2d229b8ac43d2970f5f8 Author: Eric Dumazet Date: Thu Apr 2 17:44:30 2026 +0000 inet: remove leftover EXPORT_SYMBOL() IPv6 is no longer a module, we no longer need to export these symbols. Signed-off-by: Eric Dumazet Reviewed-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260402174430.2462800-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 071fe8b5d535f3379edc8992d7f7b031a71502b9 Merge: 789ec16eb397e7 764d0833e79591 Author: Jakub Kicinski Date: Fri Apr 3 15:05:47 2026 -0700 Merge branch 'selftests-drv-net-gro-more-test-cases' Jakub Kicinski says: ==================== selftests: drv-net: gro: more test cases Add a few more test cases for GRO. First 4 patches are unchanged from v1. Patches 5 and 6 are new. Willem pointed out that the defines are duplicated and all these imprecise defines have been annoying me for a while so I decided to clean them up. With the defines cleaned up and now more precise patch 7 (was 5) no longer has to play any games with the MTU for ip6ip6. The last patch now sends 3 segments as requested. ==================== Link: https://patch.msgid.link/20260402210000.1512696-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 764d0833e795916ffe33906ace17bab027c093f8 Author: Jakub Kicinski Date: Thu Apr 2 14:00:00 2026 -0700 selftests: drv-net: gro: add a test for bad IPv4 csum We have a test for coalescing with bad TCP checksum, let's also test bad IPv4 header checksum. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260402210000.1512696-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9a84a4047df79f7f58a4915abaf09d1089103233 Author: Jakub Kicinski Date: Thu Apr 2 13:59:59 2026 -0700 selftests: drv-net: gro: test ip6ip6 We explicitly test ipip encap. Let's add ip6ip6, too. Having just ipip seems like favoring IPv4 which we should not do :) Testing all combinations is left for future work, not sure it's actually worth it. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260402210000.1512696-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 024597cc2077e36dc69327e46fa6dfb1cd0885cd Author: Jakub Kicinski Date: Thu Apr 2 13:59:58 2026 -0700 selftests: drv-net: gro: make large packet math more precise When constructing the packets for large_* test cases we use a static value for packet count and MSS. It works okay for ipv4 vs ipv6 but the gap between ipv4 and ip6ip6 is going to be quite significant. Make the defines calculate the worst case values, those are only used for sizing stack arrays. Create helpers for calculating precise values based on the exact test case. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260402210000.1512696-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 166b0cc6df8c8bd961058aa3ed0c2d1a2bdaffca Author: Jakub Kicinski Date: Thu Apr 2 13:59:57 2026 -0700 selftests: drv-net: gro: remove TOTAL_HDR_LEN Willem points out TOTAL_HDR_LEN is identical to MAX_HDR_LEN. This seems to have been the case ever since the test was added. Replace the uses of TOTAL_HDR_LEN with MAX_HDR_LEN, MAX seems more common for what this value is. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260402210000.1512696-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5469b695f23642611c47e31329025a21de86c629 Author: Jakub Kicinski Date: Thu Apr 2 13:59:56 2026 -0700 selftests: drv-net: gro: prepare for ip6ip6 support Try to use already calculated offsets and not depend on the ipip flag as much. This patch should not change any functionality, it's just a cleanup to make ip6ip6 support easier. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260402210000.1512696-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d97348474708d5f67bec6da28c2e14e12598b965 Author: Jakub Kicinski Date: Thu Apr 2 13:59:55 2026 -0700 selftests: drv-net: gro: always wait for FIN in the capacity test The new capacity/order test exits as soon as it sees the expected packet sequence. This may allow the "flushing" FIN packet to spill over to the next test. Let's always wait for the FIN before exiting. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260402210000.1512696-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 436ea8a1b7ed1328cf24cebb3ebaa21aa0c6a81a Author: Jakub Kicinski Date: Thu Apr 2 13:59:54 2026 -0700 selftests: drv-net: gro: add 1 byte payload test Small IPv4 packets get padded to 60B, this may break / confuse some buggy implementations. Add a test to coalesce a 1B payload. Keep this separate from the lrg_sml test because I suspect some implementations may not handle this case (treat padded frames as ineligible for coalescing). Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260402210000.1512696-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 30f831b44a98a660ccaf608f88d8bb945318dc59 Author: Jakub Kicinski Date: Thu Apr 2 13:59:53 2026 -0700 selftests: drv-net: gro: add data burst test case Add a test trying to induce a GRO context timeout followed by another sequence of packets for the same flow. The second burst arrives 100ms after the first one so any implementation (SW or HW) must time out waiting at that point. We expect both bursts to be aggregated successfully but separately. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260402210000.1512696-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3a4e8302e72f83fd5cc8a916fc6f5c8fe5c8690e Author: Richard Zhu Date: Tue Mar 31 16:52:52 2026 +0800 PCI: imx6: Keep Root Port MSI capability with iMSI-RX to work around hardware bug On NXP i.MX7D, i.MX8MM, and i.MX8MQ chipsets, MSIs from the endpoints won't be received by the iMSI-RX MSI controller if the Root Port MSI capability is disabled. Even though the Root Port MSIs won't be received by the iMSI-RX controller due to design, these chipsets have some weird hardware bug that prevents the endpoint MSIs from reaching when the Root Port MSI capability is disabled. Hence, introduce a new flag, 'dw_pcie_rp::keep_rp_msi_en', set it for the above mentioned SoCs, and always keep the Root Port MSI capability when this flag is set. Note that by keeping Root Port MSI capability, Root Port MSIs such as AER, PME and others won't be received by default. So users need to use workarounds such as passing 'pcie_pme=nomsi' cmdline param. Fixes: f5cd8a929c825 ("PCI: dwc: Remove MSI/MSIX capability for Root Port if iMSI-RX is used as MSI controller") Suggested-by: Manivannan Sadhasivam Signed-off-by: Richard Zhu [mani: commit log] Signed-off-by: Manivannan Sadhasivam [bhelgaas: fix typos] Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li Link: https://patch.msgid.link/20260331085252.1243108-1-hongxing.zhu@nxp.com commit 8e69214402397fcbb17f25ac5acb178195aca4bc Author: Gerd Bayer Date: Mon Mar 30 15:09:46 2026 +0200 PCI: Update PCIe spec references for AtomicOps Point to the relevant sections in the most recent release 7.0 of the PCIe spec. Text has mostly just moved around without any semantic change. Signed-off-by: Gerd Bayer Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260330-fix_pciatops-v7-3-f601818417e8@linux.ibm.com commit 1ae8c4ce157037e266184064a182af9ef9af278b Author: Gerd Bayer Date: Mon Mar 30 15:09:45 2026 +0200 PCI: Enable AtomicOps only if Root Port supports them When inspecting the config space of a Connect-X physical function in an s390 system after it was initialized by the mlx5_core device driver, we found the function to be enabled to request AtomicOps despite the Root Port lacking support for completing them: 00:00.1 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx] Subsystem: Mellanox Technologies Device 0002 DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- AtomicOpsCtl: ReqEn+ On s390 and many virtualized guests, the Endpoint is visible but the Root Port is not. In this case, pci_enable_atomic_ops_to_root() previously enabled AtomicOps in the Endpoint even though it can't tell whether the Root Port supports them as a completer. Change pci_enable_atomic_ops_to_root() to fail if there's no Root Port or the Root Port doesn't support AtomicOps. Fixes: 430a23689dea ("PCI: Add pci_enable_atomic_ops_to_root()") Reported-by: Alexander Schmidt Signed-off-by: Gerd Bayer [bhelgaas: commit log, check RP first to simplify flow] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260330-fix_pciatops-v7-2-f601818417e8@linux.ibm.com commit 03ec922f00250817a11b6b829601932d5f777998 Author: Gerd Bayer Date: Mon Mar 30 15:09:44 2026 +0200 PCI: Do not enable AtomicOps by RCiEPs Since Root Complex Integrated Endpoints (RCiEPs) attach to a bus that has no bridge device describing the Root Port, the capability to complete AtomicOps requests cannot be determined with PCIe methods. Change default of pci_enable_atomic_ops_to_root() to not enable AtomicOps requests on RCiEPs. As far as we know, there are no RCiEPs that need AtomicOps (see Link below). Signed-off-by: Gerd Bayer Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260330-fix_pciatops-v7-1-f601818417e8@linux.ibm.com commit 789ec16eb397e7d1286e92a859859493f35878fe Author: Russell King (Oracle) Date: Thu Apr 2 15:47:53 2026 +0100 net: stmmac: qcom-ethqos: set clk_csr The clocks for qcom-ethqos return a rate of zero as firmware manages their rate. According to hardware documentation, the clock which is fed to the slave AHB interface can range between 50 to 100MHz for non-RGMII and 30 to 75MHz for boards with a RGMII interfaces. Currently, stmmac uses an undefined divisor value. Instead, use STMMAC_CSR_60_100M which will mean we meet IEEE 802.3 specification since this will generate: 714kHz @ 30MHz 1.19MHz @ 50MHz 1.79MHz @ 75MHz 2.42MHz @ 100MHz This gives MDC rates within the IEEE 802.3 specification, although the 30MHz case is particularly slow. Selecting the next lowest divisor, STMMAC_CSR_35_60M, which is /26 will give: 1.15MHz @ 30MHz 1.92MHz @ 50MHz 2.88MHz @ 75MHz (exceeding 802.3 spec) 3.85MHz @ 100MHz (exceeding 802.3 spec) Unfortunately, this divisor makes the upper bound of both ranges exeed the IEEE 802.3 specification, and thus we can not use it without knowing for certain what the current CSR clock rate actually is. So, STMMAC_CSR_60_100M is the best fit for all boards based on the information provided thus far. Link: https://lore.kernel.org/r/acGhQ0oui+dVRdLY@oss.qualcomm.com Link: https://lore.kernel.org/r/acw1habUsiSqlrky@oss.qualcomm.com Reviewed-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w8JKr-0000000EdLC-41Bt@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e2f152c822cf5d37b3fc5db8e10ce25448dc12d5 Author: Julian Braha Date: Thu Apr 2 15:58:58 2026 +0100 stmmac: cleanup dead dependencies on STMMAC_PLATFORM and STMMAC_ETH in Kconfig There are already 'if STMMAC_ETH' and 'STMMAC_PLATFORM' conditions wrapping these config options, making the 'depends on' statements duplicate dependencies (dead code). I propose leaving the outer 'if STMMAC_PLATFORM...endif' and 'if STMMAC_ETH...endif' conditions, and removing the individual 'depends on' statements. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260402145858.240231-1-julianbraha@gmail.com Signed-off-by: Jakub Kicinski commit a9b460225e47a3d98296eba71c62ff0ad58a2032 Author: Eric Dumazet Date: Thu Apr 2 15:26:54 2026 +0000 net: always inline some skb helpers Some performance critical helpers from include/linux/skbuff.h are not inlined by clang. Use __always_inline hint for: - __skb_fill_netmem_desc() - __skb_fill_page_desc() - skb_fill_netmem_desc() - skb_fill_page_desc() - __skb_pull() - pskb_may_pull_reason() - pskb_may_pull() - pskb_pull() - pskb_trim() - skb_orphan() - skb_postpull_rcsum() - skb_header_pointer() - skb_clear_delivery_time() - skb_tstamp_cond() - skb_warn_if_lro() This increases performance and saves ~1200 bytes of text. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 4/24 grow/shrink: 66/12 up/down: 4104/-5306 (-1202) Function old new delta ip_multipath_l3_keys - 303 +303 tcp_sendmsg_locked 4560 4848 +288 xfrm_input 6240 6455 +215 esp_output_head 1516 1711 +195 skb_try_coalesce 696 866 +170 bpf_prog_test_run_skb 1951 2091 +140 tls_strp_read_copy 528 667 +139 gue_udp_recv 738 871 +133 __ip6_append_data 4159 4279 +120 __bond_xmit_hash 1019 1122 +103 ip6_multipath_l3_keys 394 495 +101 bpf_lwt_seg6_action 1096 1197 +101 input_action_end_dx2 344 442 +98 vxlan_remcsum 487 581 +94 udpv6_queue_rcv_skb 393 480 +87 udp_queue_rcv_skb 385 471 +86 gue_remcsum 453 539 +86 udp_lib_checksum_complete 84 168 +84 vxlan_xmit 2777 2857 +80 nf_reset_ct 456 532 +76 igmp_rcv 1902 1978 +76 mpls_forward 1097 1169 +72 tcp_add_backlog 1226 1292 +66 nfulnl_log_packet 3091 3156 +65 tcp_rcv_established 1966 2026 +60 __strp_recv 1547 1603 +56 eth_type_trans 357 411 +54 bond_flow_ip 392 444 +52 __icmp_send 1584 1630 +46 ip_defrag 1636 1681 +45 tpacket_rcv 2793 2837 +44 refcount_add 132 176 +44 nf_ct_frag6_gather 1959 2003 +44 napi_skb_free_stolen_head 199 240 +41 __pskb_trim - 41 +41 napi_reuse_skb 319 358 +39 icmpv6_rcv 1877 1916 +39 br_handle_frame_finish 1672 1711 +39 ip_rcv_core 841 879 +38 ip_check_defrag 377 415 +38 br_stp_rcv 909 947 +38 qdisc_pkt_len_segs_init 366 399 +33 mld_query_work 2945 2975 +30 bpf_sk_assign_tcp_reqsk 607 637 +30 udp_gro_receive 1657 1686 +29 ip6_rcv_core 1170 1193 +23 ah_input 1176 1197 +21 tun_get_user 5174 5194 +20 llc_rcv 815 834 +19 __pfx_udp_lib_checksum_complete 16 32 +16 __pfx_refcount_add 48 64 +16 __pfx_nf_reset_ct 96 112 +16 __pfx_ip_multipath_l3_keys - 16 +16 __pfx___pskb_trim - 16 +16 packet_sendmsg 5771 5781 +10 esp_output_tail 1460 1470 +10 alloc_skb_with_frags 433 443 +10 xsk_generic_xmit 3477 3486 +9 mptcp_sendmsg_frag 2250 2259 +9 __ip_append_data 4166 4175 +9 __ip6_tnl_rcv 1159 1168 +9 skb_zerocopy 1215 1220 +5 gre_parse_header 1358 1362 +4 __iptunnel_pull_header 405 407 +2 skb_vlan_untag 692 693 +1 psp_dev_rcv 701 702 +1 netkit_xmit 1263 1264 +1 gre_rcv 2776 2777 +1 gre_gso_segment 1521 1522 +1 bpf_skb_net_hdr_pop 535 536 +1 udp6_ufo_fragment 888 884 -4 br_multicast_rcv 9154 9148 -6 snap_rcv 312 305 -7 skb_copy_ubufs 1841 1834 -7 __pfx_skb_tstamp_cond 16 - -16 __pfx_skb_clear_delivery_time 16 - -16 __pfx_pskb_trim 16 - -16 __pfx_pskb_pull 16 - -16 ipv6_gso_segment 1400 1383 -17 ipv6_frag_rcv 2511 2492 -19 erspan_xmit 1221 1190 -31 __pfx_skb_warn_if_lro 32 - -32 __pfx___skb_fill_page_desc 32 - -32 skb_tstamp_cond 42 - -42 pskb_trim 46 - -46 __pfx_skb_postpull_rcsum 48 - -48 tcp_gso_segment 1524 1475 -49 skb_clear_delivery_time 54 - -54 __pfx_skb_fill_page_desc 64 - -64 __pfx_skb_header_pointer 80 - -80 pskb_pull 91 - -91 skb_warn_if_lro 110 - -110 tcp_v6_rcv 3288 3170 -118 __pfx___skb_pull 128 - -128 __pfx_skb_orphan 144 - -144 __pfx_pskb_may_pull 160 - -160 tcp_v4_rcv 3334 3153 -181 __skb_fill_page_desc 231 - -231 udp_rcv 1809 1553 -256 skb_postpull_rcsum 318 - -318 skb_header_pointer 367 - -367 fib_multipath_hash 3399 3018 -381 skb_orphan 513 - -513 skb_fill_page_desc 534 - -534 __skb_pull 568 - -568 pskb_may_pull 604 - -604 Total: Before=29652698, After=29651496, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260402152654.1720627-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 438700e92db69af148b9e136855b115379ad2a83 Author: Miguel Ojeda Date: Tue Mar 31 22:58:49 2026 +0200 rust: macros: simplify `format!` arguments Clippy in Rust 1.88.0 (only) reported [1] up to the previous commit: warning: variables can be used directly in the `format!` string --> rust/macros/module.rs:112:23 | 112 | let content = format!("{param}:{content}", param = param, content = content); | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#uninlined_format_args = note: `-W clippy::uninlined-format-args` implied by `-W clippy::all` = help: to override `-W clippy::all` add `#[allow(clippy::uninlined_format_args)]` help: change this to | 112 - let content = format!("{param}:{content}", param = param, content = content); 112 + let content = format!("{param}:{content}"); The reason it only triggers in that version is that the lint was moved from `pedantic` to `style` in Rust 1.88.0 and then back to `pedantic` in Rust 1.89.0 [2][3]. In this case, the suggestion is fair and a pure simplification, thus just apply it. In addition, do the same for another place in the file that Clippy does not report because it is multi-line. Link: https://lore.kernel.org/rust-for-linux/CANiq72=drAtf3y_DZ-2o4jb6Az9J3Yj4QYwWnbRui4sm4AJD3Q@mail.gmail.com/ [1] Link: https://github.com/rust-lang/rust-clippy/pull/15287 [2] Link: https://github.com/rust-lang/rust-clippy/issues/15151 [3] Reviewed-by: Gary Guo Acked-by: Sami Tolvanen Link: https://patch.msgid.link/20260331205849.498295-2-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 82544d36b1729153c8aeb179e84750f0c085d3b1 Author: Paul Moore Date: Thu Jan 1 17:19:18 2026 -0500 selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "user" file) and the mounter's credentials are sufficient to access the lower level file (the "backing" file). Unfortunately, the current code does not properly enforce these access controls for both mmap() and mprotect() operations on overlayfs filesystems. This patch makes use of the newly created security_mmap_backing_file() LSM hook to provide the missing backing file enforcement for mmap() operations, and leverages the backing file API and new LSM blob to provide the necessary information to properly enforce the mprotect() access controls. Cc: stable@vger.kernel.org Acked-by: Amir Goldstein Signed-off-by: Paul Moore commit 6af36aeb147a06dea47c49859cd6ca5659aeb987 Author: Paul Moore Date: Fri Dec 19 13:18:22 2025 -0500 lsm: add backing_file LSM hooks Stacked filesystems such as overlayfs do not currently provide the necessary mechanisms for LSMs to properly enforce access controls on the mmap() and mprotect() operations. In order to resolve this gap, a LSM security blob is being added to the backing_file struct and the following new LSM hooks are being created: security_backing_file_alloc() security_backing_file_free() security_mmap_backing_file() The first two hooks are to manage the lifecycle of the LSM security blob in the backing_file struct, while the third provides a new mmap() access control point for the underlying backing file. It is also expected that LSMs will likely want to update their security_file_mprotect() callback to address issues with their mprotect() controls, but that does not require a change to the security_file_mprotect() LSM hook. There are a three other small changes to support these new LSM hooks: * Pass the user file associated with a backing file down to alloc_empty_backing_file() so it can be included in the security_backing_file_alloc() hook. * Add getter and setter functions for the backing_file struct LSM blob as the backing_file struct remains private to fs/file_table.c. * Constify the file struct field in the LSM common_audit_data struct to better support LSMs that need to pass a const file struct pointer into the common LSM audit code. Thanks to Arnd Bergmann for identifying the missing EXPORT_SYMBOL_GPL() and supplying a fixup. Cc: stable@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Cc: linux-unionfs@vger.kernel.org Cc: linux-erofs@lists.ozlabs.org Reviewed-by: Amir Goldstein Reviewed-by: Serge Hallyn Reviewed-by: Christian Brauner Signed-off-by: Paul Moore commit 880bd496ec72a6dcb00cb70c430ef752ba242ae7 Author: Amir Goldstein Date: Mon Mar 30 10:27:51 2026 +0200 fs: prepare for adding LSM blob to backing_file In preparation to adding LSM blob to backing_file struct, factor out helpers init_backing_file() and backing_file_free(). Cc: stable@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Cc: linux-unionfs@vger.kernel.org Cc: linux-erofs@lists.ozlabs.org Signed-off-by: Amir Goldstein Reviewed-by: Serge Hallyn [PM: use the term "LSM blob", fix comment style to match file] Signed-off-by: Paul Moore commit 7b15fc2d1f1a00fb99f0146e404ff2600999ec74 Author: Pierre-Eric Pelloux-Prayer Date: Wed Feb 4 16:45:36 2026 +0100 drm/amdgpu: dump job ibs in the devcoredump Now that we have a worker thread, we can try to access the IBs of the job. The process is: * get the VM from the PASID * get the BO from its VA and the VM * map the BO for CPU access * copy everything, then add it to the dump Each step can fail so we have to be cautious. These operations can be slow so when amdgpu_devcoredump_format is called only to determine the size of the buffer we skip all of them and assume they will succeed. --- v3: use kvfree --- Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 32ab301b89b30d71a2e68d86f564eca66f7c52c5 Author: Pierre-Eric Pelloux-Prayer Date: Wed Feb 4 14:05:07 2026 +0100 drm/amdgpu: store ib info for devcoredump Store the basic state of IBs so we can read it back in the amdgpu_devcoredump_format function. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 202432ae8a6948ab6c88b56eaf2848a23637d9f0 Merge: 303d32843b831b 29990ab5cb408d Author: Dave Jiang Date: Fri Apr 3 12:30:57 2026 -0700 Merge branch 'for-7.1/cxl-region-refactor' into cxl-for-next Refactor CXL core/region code to make region code more manageable by splitting out DAX and PMEM code from RAM handling code. cxl/core: use cleanup.h for devm_cxl_add_dax_region cxl/core/region: move dax region device logic into region_dax.c cxl/core/region: move pmem region driver logic into region_pmem.c commit 303d32843b831ba86c28aea188db95da65d88f31 Merge: 7aacc625576d4d 549b5c12ef0644 Author: Dave Jiang Date: Fri Apr 3 12:21:27 2026 -0700 Merge branch 'for-7.1/dax-hmem' into cxl-for-next The series addresses conflicts between HMEM and CXL when handling Soft Reserved memory ranges. CXL will try best effort in claiming the Soft Reserved memory region that are CXL regions. If fails, it will punt back to HMEM. tools/testing/cxl: Test dax_hmem takeover of CXL regions tools/testing/cxl: Simulate auto-assembly failure dax/hmem: Parent dax_hmem devices dax/hmem: Fix singleton confusion between dax_hmem_work and hmem devices dax/hmem: Reduce visibility of dax_cxl coordination symbols cxl/region: Constify cxl_region_resource_contains() cxl/region: Limit visibility of cxl_region_contains_resource() dax/cxl: Fix HMEM dependencies cxl/region: Fix use-after-free from auto assembly failure dax/hmem, cxl: Defer and resolve Soft Reserved ownership cxl/region: Add helper to check Soft Reserved containment by CXL regions dax: Track all dax_region allocations under a global resource tree dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding dax/hmem: Gate Soft Reserved deferral on DEV_DAX_CXL dax/hmem: Request cxl_acpi and cxl_pci before walking Soft Reserved ranges dax/hmem: Factor HMEM registration into __hmem_register_device() dax/bus: Use dax_region_put() in alloc_dax_region() error path commit 7aacc625576d4dc9c7d8a687f168ff72b30ca353 Merge: 2fb3bdeb001115 64584273dfb8a1 Author: Dave Jiang Date: Fri Apr 3 12:18:23 2026 -0700 Merge branch 'for-7.1/cxl-type2-support' into cxl-for-next Prep patches for CXL type2 accelerator basic support cxl/region: Factor out interleave granularity setup cxl/region: Factor out interleave ways setup cxl: Make region type based on endpoint type cxl/pci: Remove redundant cxl_pci_find_port() call cxl: Move pci generic code from cxl_pci to core/cxl_pci cxl: export internal structs for external Type2 drivers cxl: support Type2 when initializing cxl_dev_state commit 2fb3bdeb00111519965601389a7b60afb97bafc0 Merge: f3b1d2260703f8 e8069c66d09309 Author: Dave Jiang Date: Fri Apr 3 12:15:11 2026 -0700 Merge branch 'for-7.1/cxl-consolidate-endpoint' into cxl-for-next Add code to ensure the endpoint has completed initialization before usage. cxl/pci: Check memdev driver binding status in cxl_reset_done() cxl/pci: Hold memdev lock in cxl_event_trace_record() commit 1b135c6da061cdb3322dc0e92ca5a7c58825c77b Author: Pierre-Eric Pelloux-Prayer Date: Wed Feb 4 16:41:11 2026 +0100 drm/amdgpu: extract amdgpu_vm_lock_by_pasid from amdgpu_vm_handle_fault This is tricky to implement right and we're going to need it from the devcoredump. Signed-off-by: Pierre-Eric Pelloux-Prayer Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit f3b1d2260703f8fb39fd667a26d931d63d2dd10e Author: Alison Schofield Date: Fri Mar 13 23:19:50 2026 -0700 tools/testing/cxl: Enable replay of user regions as auto regions The cxl_test module currently hard-codes auto regions in the mock topology, limiting coverage of the driver's region auto-assembly logic. Teach cxl_test to replay previously committed decoder programming across a cxl_acpi unbind/bind cycle. Decoder programming is recorded in a registry keyed by a stable port identity and decoder id. The registry is updated on decoder commit and reset events and consulted during enumeration to restore previously enabled decoders. This allows regions created through the user interface to be replayed during enumeration and treated as auto-discovered regions, enabling testing of region auto-assembly using configurations created in the cxl_test topology. Example workflow: # cxl create-region ... # echo 1 > /sys/bus/platform/devices/cxl_acpi.0/decoder_reset_preserve_registry # echo cxl_acpi.0 > /sys/bus/platform/drivers/cxl_acpi/unbind # echo cxl_acpi.0 > /sys/bus/platform/drivers/cxl_acpi/bind # echo 0 > /sys/bus/platform/devices/cxl_acpi.0/decoder_reset_preserve_registry The NDCTL CXL unit test, cxl-region-replay.sh, demonstrates the usage. Co-developed-by: Dan Williams Signed-off-by: Dan Williams Co-developed-by: Dave Jiang Signed-off-by: Alison Schofield Link: https://patch.msgid.link/20260314061952.2221030-1-alison.schofield@intel.com Signed-off-by: Dave Jiang commit cd905830ea6184d6678386ce2d652bec324034d1 Author: Svyatoslav Ryhel Date: Mon Jan 26 20:54:23 2026 +0200 PM / devfreq: tegra30-devfreq: add support for Tegra114 Lets add Tegra114 support to activity monitor device as a preparation to upcoming EMC controller support. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Acked-by: Dmitry Osipenko Acked-by: MyungJoo Ham Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20260126185423.77786-1-clamor95@gmail.com/ commit 943a872fe41a8352d64b20de77d8b707978e5732 Author: Pengjie Zhang Date: Tue Dec 16 11:11:53 2025 +0800 PM / devfreq: use _visible attribute to replace create/remove_sysfs_files() Previously, non-generic attributes (polling_interval, timer) used separate create/delete logic, leading to race conditions during concurrent access in creation/deletion. Multi-threaded operations also caused inconsistencies between governor capabilities and attribute states. 1.Use is_visible + sysfs_update_group() to unify management of these attributes, eliminating creation/deletion races. 2.Add locks and validation to these attributes, ensuring consistency between current governor capabilities and attribute operations in multi-threaded environments. Reviewed-by: Jonathan Cameron Reviewed-by: Jie Zhan Signed-off-by: Pengjie Zhang Signed-off-by: Chanwoo Choi Link: https://www.spinics.net/lists/kernel/msg5967745.html commit 82bb8dc953c2203bb710b7358f030b1d9bdf698d Author: Andy Shevchenko Date: Wed Jan 14 10:31:15 2026 +0100 PM / devfreq: Remove unneeded casting for HZ_PER_KHZ HZ_PER_KHZ is defined as UL (unsigned long), no need to repeat that. Signed-off-by: Andy Shevchenko Reviewed-by: Lifeng Zheng Acked-by: MyungJoo Ham Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20260114093115.276818-1-andriy.shevchenko@linux.intel.com/ commit 7db0b82754140c76774ce01f6110ff0d1c0f2b67 Author: Robert Marko Date: Thu Apr 2 14:34:24 2026 +0200 hwmon: (sparx5) Make it selectable for ARCH_LAN969X LAN969x uses the same sensor and driver, so make it selectable for ARCH_LAN969X. Signed-off-by: Robert Marko Link: https://lore.kernel.org/r/20260402123436.47856-1-robert.marko@sartura.hr Signed-off-by: Guenter Roeck commit 92842776cc45f134a6a965cfe875e14633cb9a47 Author: Flaviu Nistor Date: Fri Apr 3 17:06:54 2026 +0300 hwmon: (tmp102) add support for update interval Since the sensor supports different sampling intervals via bits CR0 and CR1 from the CONFIG register, add support in order for the conversion rate to be changed from user space. Default is 4 conv/sec. Signed-off-by: Flaviu Nistor Link: https://lore.kernel.org/r/20260403140654.10368-1-flaviu.nistor@gmail.com Signed-off-by: Guenter Roeck commit 6d50ae25666d5433108b1cd11965c0f53c355a83 Author: Randy Dunlap Date: Mon Mar 30 14:46:24 2026 -0700 hwmon: (yogafan) fix markup warning Add a blank line between the License and heading lines to prevent a documentation build warning: Documentation/hwmon/yogafan.rst:2: WARNING: Explicit markup ends without a blank line; unexpected unindent. [docutils] Fixes: c67c248ca406 ("hwmon: (yogafan) Add support for Lenovo Yoga/Legion fan monitoring") Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20260330214624.3781789-1-rdunlap@infradead.org Signed-off-by: Guenter Roeck commit c67c248ca406a86cf8b20bf1b3af5e7f3e36581f Author: Sergio Melas Date: Fri Mar 27 23:16:02 2026 +0100 hwmon: (yogafan) Add support for Lenovo Yoga/Legion fan monitoring This driver provides fan speed monitoring for Lenovo Yoga, Legion, and IdeaPad laptops by interfacing with the Embedded Controller (EC) via ACPI. To address low-resolution sampling in Lenovo EC firmware, a Rate-Limited Lag (RLLag) filter is implemented. The filter ensures a consistent physical curve regardless of userspace polling frequency. Hardware identification is performed via DMI-based quirk tables, which map specific ACPI object paths and register widths (8-bit vs 16-bit) deterministically. Signed-off-by: Sergio Melas Link: https://lore.kernel.org/r/20260327221602.18832-1-sergiomelas@gmail.com [groeck: Dropped double empty line in Kconfig] Signed-off-by: Guenter Roeck commit d1f188b182c92b71d1bdd03436d7c6b08fbc86be Author: Timur Kristóf Date: Fri Apr 3 04:22:08 2026 +0200 drm/amdgpu: Use amdgpu by default for CIK APUs too CIK APUs are: Kaveri, Kabini and Mullins from 2013~2015, which all have a second generation GCN based integrated GPU. The amdgpu driver has been working well on CIK APUs for years. Features which were previously missing have been added recently, specifically DC support for analog connectors and DP bridge encoders. Now amdgpu is at feature parity with the old radeon driver on CIK APUs. Enabling the amdgpu driver by default for CIK APUs has the following benefits: - More stable OpenGL support through RadeonSI - Vulkan support through RADV - Improved performance - Better display features through DC Users who want to keep using the old driver can do so using: amdgpu.cik_support=0 radeon.cik_support=1 Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit a097dd7059cb1d4efb436092196885e3abd56518 Author: Linus Probert Date: Fri Apr 3 10:22:07 2026 +0200 drm/amd/display: Remove unused NUM_ELEMENTS macros Removes unused NUM_ELEMENTS macros. Discovered while removing cases where ARRAY_SIZE from the header can be used. This also aligns with the array_size.cocci coccinelle check. Suggested-by: Robert P. J. Day Signed-off-by: Linus Probert Signed-off-by: Alex Deucher commit 2d23661764450fc37208c2888c91fa320e830d63 Author: Linus Probert Date: Fri Apr 3 10:22:06 2026 +0200 drm/amd/display: Replace inline NUM_ELEMENTS macro with ARRAY_SIZE Replaces the use of local NUM_ELEMENTS macro with the ARRAY_SIZE macro defined in . This aligns with existing coccinelle script array_size.cocci which has been applied to other sources in order to remove inline sizeof(a)/sizeof(a[0]) patterns from other source files. Suggested-by: Robert P. J. Day Signed-off-by: Linus Probert Signed-off-by: Alex Deucher commit eea85914d15bfe3bdf9f8f80a479f0dee0aa7d73 Author: Pierre-Eric Pelloux-Prayer Date: Wed Feb 4 13:11:47 2026 +0100 drm/amdgpu: save ring content before resetting the device Otherwise the content might not be relevant. When a coredump is generated the rings with outstanding fences are saved and then printed to the final devcoredump from the worker thread. Since this requires memory allocation, the ring capture might be missing from the generated devcoredump. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 48c33af0b62d8bbc67e4897438573f59da8ebe17 Author: Prike Liang Date: Fri Mar 27 14:33:31 2026 +0800 drm/amdgpu: make userq fence_drv drop explicit in queue destroy amdgpu_userq_fence_driver_free() is now responsible only for releasing per-queue ancillary state (last_fence, fence_drv_xa) and no longer touches the ownership reference, making each function's contract clear. v2: Get the userq fence driver from amdgpu_userq_fence_driver_alloc() directly and dropping the userq fence driver reference after removing userq_doorbell_xa entry.(Christian) Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 34f31fe40f3a19cd3427130ac7558ca2504853ae Author: Prike Liang Date: Tue Mar 17 11:54:55 2026 +0100 drm/amdgpu: rework userq fence driver alloc/destroy The correct fix is to tie the global xa entry lifetime to the queue lifetime: insert in amdgpu_userq_create() and erase in amdgpu_userq_cleanup(), both at the well-defined doorbell_index key, making the operation O(1) and resolve the fence driver UAF problem by binding the userq driver fence to per queue. v2: clean up the local variables initialization. (Christian) Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 05ce444171cf2ec89ce0f8c37700375b817454b0 Author: Sunil Khatri Date: Thu Mar 26 22:50:56 2026 +0530 drm/amdgpu/userq: use dma_fence_wait_timeout without test for signalled In function amdgpu_userq_wait_for_last_fence use dma_fence_wait to wait infinitely. Also there is no need to print error as we wont be timing out anymore. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 38476bde59948fe85e20bb1e7f3f66525d0c10cd Author: Sunil Khatri Date: Thu Mar 26 13:22:20 2026 +0530 drm/amdgpu/userq: call dma_resv_wait_timeout without test for signalled In function amdgpu_userq_gem_va_unmap_validate call dma_resv_wait_timeout directly. Also since we are waiting forever we should not be having any return value and hence no handling needed. Suggested-by: Christian König Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 4c86e12ab1be971ddb0748e373cf6d25d68bdc22 Author: Sunil Khatri Date: Thu Mar 26 13:06:07 2026 +0530 drm/amdgpu/userq: add the return code too in error condition In function amdgpu_userq_restore a. amdgpu_userq_vm_validate: add return code in error condition b. amdgpu_userq_restore_all: It already prints the error log, just update the erorr log in the function and remove it from caller. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 1e57e72ae3c34144ccecb0a0b77e5c397ec0668a Author: Sunil Khatri Date: Thu Mar 26 12:59:31 2026 +0530 drm/amdgpu/userq: fence wait for max time in amdgpu_userq_wait_for_signal wait for infinite time for fences in function amdgpu_userq_wait_for_signal and for that use dma_fence_wait(f, false); Suggested-by: Christian König Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit d65bfb1782304b03862c8c725fac608015dffd36 Author: Mario Kleiner Date: Sat Mar 21 06:20:33 2026 +0100 drm/amd/display: Change dither policy for 10 bpc output back to dithering Commit d5df648ec830 ("drm/amd/display: Change dither policy for 10bpc to round") degraded display of 12 bpc color precision output to 10 bpc sinks by switching 10 bpc output from dithering to "truncate to 10 bpc". I don't find the argumentation in that commit convincing, but the consequences highly unfortunate, especially for applications that require effective > 10 bpc precision output of > 10 bpc framebuffers. The argument wasn't something strong like "there are hardware design defects or limitations which require us to work around broken dithering to 10 bpc", or "there are some special use cases which do require truncation to 10 bpc", but essentially "at some point in the past we used truncation in Polaris/Vega times and it looks like it got inadvertently changed for Navi, so let's do that again". I couldn't find evidence for that in the git commit logs for this. The commit message also acknowledges that using dithering "...makes some sense for FP16... ...but not for ARGB2101010 surfaces..." The problem with this is that it makes fp16 surfaces, and especially rgba16 fixed point surfaces, less useful. These are now well supported by Mesa 25.3 and later via OpenGL + EGL, Vulkan/WSI, and by OSS AMDVLK Vulkan/WSI/display, and also by GNOME 50 mutter under Wayland, and they used to provide more than 10 bpc effective precision at the output. Even for 8 or 10 bpc surfaces, the color pipeline behind the framebuffer, e.g., gamma tables, CTM, can be used for color correction and will benefit from an effective > 10 bpc output precision via dithering, retaining some precision that would get lost on the way through the pipeline, e.g., due to non-linear gamma functions. Scientific apps rely on this for > 10 bpc display precision. Truncating to 10 bpc, instead of dithering the pipeline internal 12 bpc precision down to 10 bpc, causes a serious loss of precision. This also creates the undesirable and slightly absurd situation that using a cheap monitor with only 8 bpc input and display panel will yield roughly 12 bpc precision via dithering from 12 -> 8 bpc, whereas investment into a more expensive monitor with 10 bpc input and native 10 bpc display will only yield 10 bpc, even if a fp16 or rgb16 framebuffer and/or a properly set up color pipeline (gamma tables, CTM's etc. with more than 10 bpc out precision) would allow effective 12 bpc precision output. Therefore this patch proposes reverting that commit and going back to dithering down to 10 bpc, consistent with the behaviour for 6 bpc or 8 bpc output. Successfully tested on AMD Polaris DCE 11.2 and Raven Ridge DCN 1.0 with a native 10 bpc capable monitor, outputting a RGBA16 unorm framebuffer and measuring resulting color precision with a photometer. No apparent visual artifacts or problems were observed, and effective precision was measured to be 12 bpc again, as expected. Fixes: d5df648ec830 ("drm/amd/display: Change dither policy for 10bpc to round") Signed-off-by: Mario Kleiner Tested-by: Mario Kleiner Cc: stable@vger.kernel.org Cc: Aric Cyr Cc: Anthony Koo Cc: Rodrigo Siqueira Cc: Krunoslav Kovac Cc: Alex Deucher Reported-by: Mario Kleiner Signed-off-by: Harry Wentland Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 3c863ff920b45fa7a9b7d4cb932f466488a87a58 Author: Mikhail Gavrilov Date: Tue Mar 31 19:21:26 2026 +0500 drm/amdgpu: replace PASID IDR with XArray Replace the PASID IDR + spinlock with XArray as noted in the TODO left by commit ea56aa262570 ("drm/amdgpu: fix the idr allocation flags"). The IDR conversion still has an IRQ safety issue: amdgpu_pasid_free() can be called from hardirq context via the fence signal path, but amdgpu_pasid_idr_lock is taken with plain spin_lock() in process context, creating a potential deadlock: CPU0 ---- spin_lock(&amdgpu_pasid_idr_lock) // process context, IRQs on spin_lock(&amdgpu_pasid_idr_lock) // deadlock The hardirq call chain is: sdma_v6_0_process_trap_irq -> amdgpu_fence_process -> dma_fence_signal -> drm_sched_job_done -> dma_fence_signal -> amdgpu_pasid_free_cb -> amdgpu_pasid_free Use XArray with XA_FLAGS_LOCK_IRQ (all xa operations use IRQ-safe locking internally) and XA_FLAGS_ALLOC1 (zero is not a valid PASID). Both xa_alloc_cyclic() and xa_erase() then handle locking consistently, fixing the IRQ safety issue and removing the need for an explicit spinlock. v8: squash in irq safe fix Reviewed-by: Christian König Suggested-by: Lijo Lazar Fixes: ea56aa262570 ("drm/amdgpu: fix the idr allocation flags") Fixes: 8f1de51f49be ("drm/amdgpu: prevent immediate PASID reuse case") Signed-off-by: Mikhail Gavrilov Signed-off-by: Alex Deucher commit 1d4ade3646eb063ecc82060b607329730cca100c Author: Sunil Khatri Date: Tue Mar 31 18:14:57 2026 +0530 drm/amdgpu/userq: dont need check for return values in amdgpu_userq_evict Function of amdgpu_userq_evict function do not need to check for return values as we dont use them and no need to log errors as we are already logging in called functions. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 48d1a5b33a5a946fca3e444c4f3df13ef847f40d Author: Yang Wang Date: Mon Mar 30 22:12:57 2026 -0400 drm/amd/pm: fix memleak issue in smu_v15_0_8_get_gpu_metrics() remove unsued code to avoid memleak issue. (NOTE: This bug occurs during internal branch switching) Fixes: 0a66ca3b351f ("drm/amd/pm: add get_gpu_metrics support for 15.0.8") Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit e4465c0464a3d1b8d66d84c440ab1d49c483c01a Author: Yang Wang Date: Mon Mar 30 22:39:17 2026 -0400 drm/amd/pm: optimize logic and remove unnecessary checks in smu v15.0.8 the following two sets of logic are clearly mutually exclusive in smu_v15_0_8_set_soft_freq_limited_range. remove unnecessary code logic to keep the code logic clear. e.g: if (smu_dpm->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL) return -EINVAL; if (smu_dpm->dpm_level == AMD_DPM_FORCED_LEVEL_MANUAL) { ... } Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 95e21dff4717c0525f80c225884ddc391911b1c3 Author: Yang Wang Date: Mon Mar 30 22:23:06 2026 -0400 drm/amd/pm: fix null pointer dereference issue in smu_v15_0_8_get_power_limit() Fix null pointer issues caused by coding errors Fixes: e20e47bcb3f1 ("drm/amd/pm: add set{get}_power_limit support for smu 15.0.8") Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 592713a8960ed661bd9fcb7c256921c53eadeb49 Author: Yang Wang Date: Wed Mar 25 21:41:46 2026 -0400 drm/amd/pm: correct mem_busy_percent display due to calculation errors PMFW may return invalid values due to internal calculation errors. so, the kmd driver must validate and sanitize the returned values to prevent issues caused by firmware calculation errors. For example, values 0xfffe (-2) and 0xffff (-1) are treated as invalid and clamped to 0. this applies to devices with CAB (Cache As Buffer) functionality. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4905 Signed-off-by: Yang Wang Reviewed-by: Kenneth Feng Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 95a599c8a25a60a63b710ea863577ee51a8b62a2 Author: Marco Crivellari Date: Wed Dec 24 15:47:08 2025 +0100 drm/radeon: add WQ_PERCPU to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Suggested-by: Tejun Heo Acked-by: Christian König Signed-off-by: Marco Crivellari Signed-off-by: Alex Deucher commit 505b1c7342aed9cc3c35c8043fe6bc5ccbeb6b0b Author: Marco Crivellari Date: Wed Dec 24 15:47:07 2025 +0100 amd/amdkfd: add WQ_UNBOUND to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. This specific workload has no benefit being per-cpu, so its behavior has been changed using explicitly WQ_UNBOUND. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Alex Deucher commit 53140a0d591298adeb6758ca57ab3334cbe35d6e Author: Marco Crivellari Date: Wed Dec 24 15:47:06 2025 +0100 drm/amdgpu: replace use of system_wq with system_dfl_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo Acked-by: Christian König Signed-off-by: Marco Crivellari Signed-off-by: Alex Deucher commit 7f0fc003688e22553c16a4740ce5c6297ef9c0e3 Author: Marco Crivellari Date: Wed Dec 24 15:47:05 2025 +0100 drm/amdgpu: replace use of system_unbound_wq with system_dfl_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo Acked-by: Christian König Signed-off-by: Marco Crivellari Signed-off-by: Alex Deucher commit 3ecee2073cac99c629725f63a033c16ebac17e59 Author: Lijo Lazar Date: Fri Mar 27 13:20:40 2026 +0530 drm/amd/pm: Use smu vram copy in SMUv15 Use smu vram copy wrapper function for vram copy operations in SMUv15.0.8 Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 3bec582562a17ff16c4e3b8ac5cac8a6713976f2 Author: Lijo Lazar Date: Fri Mar 27 13:16:33 2026 +0530 drm/amd/pm: Use smu vram copy in SMUv13 Use smu vram copy wrapper function for vram copy operations in SMUv13.0.6 and SMUv13.0.12. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit f2275ea90be581f599e7c88a9dbfc5dd4383087d Author: Lijo Lazar Date: Fri Mar 27 13:13:00 2026 +0530 drm/amd/pm: Add smu vram copy function Add a wrapper function for copying data/to from vram. This additionally checks for any RAS fatal error. Copy cannot be trusted if any RAS fatal error happened as VRAM becomes inaccessible. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 1d0a26cf37c1b2e9928d2b61af6f282232b5daea Author: Vitaly Prosyak Date: Tue Mar 24 19:53:59 2026 -0400 drm/amdgpu: add CONFIG_GCOV_PROFILE_AMDGPU Kconfig option Add a Kconfig option to enable GCOV code coverage profiling for the amdgpu driver, following the established upstream pattern used by CONFIG_GCOV_PROFILE_FTRACE (kernel/trace), CONFIG_GCOV_PROFILE_RDS (net/rds), and CONFIG_GCOV_PROFILE_URING (io_uring). This allows CI systems to enable amdgpu code coverage entirely via .config (e.g., scripts/config --enable GCOV_PROFILE_AMDGPU) without manually editing the amdgpu Makefile. The option depends on both DRM_AMDGPU and GCOV_KERNEL, defaults to n, and is therefore never enabled in production or distro builds. Cc: Christian König Cc: Alex Deucher Signed-off-by: Vitaly Prosyak Acked-by: Christian König Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit d290d6ee90b48b346978e8549b0bc0ba28c047fc Author: Marco Crivellari Date: Fri Mar 13 15:47:15 2026 +0100 drm/amd/display: Replace use of system_wq with system_percpu_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Alex Deucher commit e0e9792ea2d4bc72634c0ba77472c3d4ef01fc8e Author: Xiaogang Chen Date: Tue Mar 31 13:24:17 2026 -0500 drm/amdgpu: add an option to allow gpu partition allocate all available memory Current driver reports and limits memory allocation for each partition equally among partitions using same memory partition. Application may not be able to use all available memory when run on a partitioned gpu though system still has enough free memory. Add an option that app can use to have gpu partition allocate all available memory. Signed-off-by: Xiaogang Chen Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit f315099fd26ae8e9ab7718fbc8f66b157828313a Author: Lijo Lazar Date: Thu Mar 26 11:21:15 2026 +0530 drm/amdgpu: Consolidate reserve region allocations Move marking reserve regions to a single function. It loops through all the reserve region ids. The ones with non-zero size are reserved. There are still some reservations which could happen later during runtime like firmware extended reservation region. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 6845355a08c2dc7e5af3c37b7d8f61afbfec1939 Author: Lijo Lazar Date: Thu Mar 26 11:11:39 2026 +0530 drm/amdgpu: Move validation of reserve region info Keep validation of reserved regions also as part of filling details. If the information is invalid, size is kept as 0 so that it's not considered for reservation. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 7b0af16044b7669685f923d2c83c20d3aba72e18 Author: Lijo Lazar Date: Thu Mar 26 11:06:10 2026 +0530 drm/amdgpu: Add function to fill training region Add a function to fill in memory training reservation region. Only if the reservation for the region is successful, memory training context will be initialized. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 2c7b0e37835cc4522debba57b31b491025e9728c Author: Lijo Lazar Date: Thu Mar 26 10:54:38 2026 +0530 drm/amdgpu: Add function to fill fw reserve region Add a function to fill in details for firmware reserve region. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 5dad4394229953cae4e040107a4fd1886dc01f30 Author: Lijo Lazar Date: Thu Mar 26 10:39:16 2026 +0530 drm/amdgpu: Group filling reserve region details Add a function which groups filling of reserve region information. It may not cover all as info on some regions are still filled outside like those from atomfirmware tables. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit bb92be605290d11b5bab307f76ab85013beba847 Author: Lijo Lazar Date: Wed Mar 25 19:10:16 2026 +0530 drm/amdgpu: Add memory training reserve-region Use reserve region helpers for initializing/reserving memory training region. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 4c616e8446b916d8888415c76a91b36a00f94f79 Author: Lijo Lazar Date: Wed Mar 25 18:40:24 2026 +0530 drm/amdgpu: Add host driver reserved-region Use reserve region helpers for initializing/reserving host driver reserved region in virtualization environment. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit daaf24d1fc538fc713ffc4a84949af0d92f06fb4 Author: Lijo Lazar Date: Wed Mar 25 18:32:25 2026 +0530 drm/amdgpu: Add fw vram usage reserve-region Use reserve region helpers for initializing/reserving firmware usage region in virtualized environments. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 14a517e37a575da79681c9b5e3b39d3755cbd94d Author: Lijo Lazar Date: Wed Mar 25 17:20:11 2026 +0530 drm/amdgpu: Add firmware extended reserve-region Use reserve region helpers for initializing/reserving extended firmware reservation area. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit b2155aaef0eae56ff1a3583dff38e7b92e99f8ed Author: Lijo Lazar Date: Wed Mar 25 17:17:10 2026 +0530 drm/amdgpu: Add fw_reserved reserve-region Use reserve region helpers for initializing/reserving fw_reserved region. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 272a9c8f6f711c283f18aa954e54ede7ed32bdd8 Author: Lijo Lazar Date: Wed Mar 25 17:08:45 2026 +0530 drm/amdgpu: Add stolen_reserved reserve-region Use reserve region helpers for initializing/reserving stolen_reserved region. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 941c50330ec4ab07b67abd37749da0687aadab1e Author: Lijo Lazar Date: Wed Mar 25 17:04:36 2026 +0530 drm/amdgpu: Add extended stolen vga reserve-region Use reserve region helpers for initializing/reserving extended stolen vga region. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 9bb16dabb09116d3308772569e850477f2d803b5 Author: Lijo Lazar Date: Wed Mar 25 17:00:31 2026 +0530 drm/amdgpu: Add stolen vga reserve-region Use reserve region helpers for initializing/reserving stolen vga region. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit c9042a4dd6ac311281fc2d95d0d9f8e3278608c5 Author: Lijo Lazar Date: Wed Mar 25 16:36:16 2026 +0530 drm/amdgpu: Add reserved region ids Add reserved regions and helper functions to memory manager. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 8d45d88e0b3d17c9f847cef8171c95c19d2cbdf5 Author: Ce Sun Date: Mon Mar 30 14:22:03 2026 +0800 drm/amd/ras: enable uniras via IP version check enable uniras via IP version check Signed-off-by: Ce Sun Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher commit 2444eb0ec8283f4a3845eb7febad378476e1ba3c Author: Benjamin Cheng Date: Tue Mar 24 16:42:05 2026 -0400 drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the bounds checks. Signed-off-by: Benjamin Cheng Acked-by: Christian König Reviewed-by: Ruijing Dong Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 0a78f2bac1424deb7c9d5e09c6b8e849d8e8b648 Author: Benjamin Cheng Date: Wed Mar 25 09:09:27 2026 -0400 drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg. Signed-off-by: Benjamin Cheng Reviewed-by: Christian König Reviewed-by: Ruijing Dong Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit b193019860d61e92da395eae2011f2f6716b182f Author: Benjamin Cheng Date: Tue Mar 24 16:25:56 2026 -0400 drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg. Signed-off-by: Benjamin Cheng Reviewed-by: Christian König Reviewed-by: Ruijing Dong Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit de2a02cc28d6d5d37db07d00a9a684c754a5fd74 Author: Benjamin Cheng Date: Mon Mar 30 15:01:27 2026 -0400 drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW. Signed-off-by: Benjamin Cheng Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 744ab12a5bd1a0dc59c5ba5354ae40030c834a46 Merge: b905ee77d5f557 7e0ffb72de8aa3 Author: Tejun Heo Date: Fri Apr 3 07:48:28 2026 -1000 Merge branch 'for-7.0-fixes' into for-7.1 Conflict in kernel/sched/ext.c between: 7e0ffb72de8a ("sched_ext: Fix stale direct dispatch state in ddsp_dsq_id") which clears ddsp state at individual call sites instead of dispatch_enqueue(), and sub-sched related code reorg and API updates on for-7.1. Resolved by applying the ddsp fix with for-7.1's signatures. Signed-off-by: Tejun Heo commit 66085e206431ef88ce36f53c1f53d570790ccc9e Author: Benjamin Cheng Date: Wed Mar 25 08:39:19 2026 -0400 drm/amdgpu: Add bounds checking to ib_{get,set}_value The uvd/vce/vcn code accesses the IB at predefined offsets without checking that the IB is large enough. Check the bounds here. The caller is responsible for making sure it can handle arbitrary return values. Also make the idx a uint32_t to prevent overflows causing the condition to fail. Signed-off-by: Benjamin Cheng Reviewed-by: Christian König Reviewed-by: Ruijing Dong Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 4e8197426f8f10a9afc9a50fc2970b733ed22d85 Author: Srinivasan Shanmugam Date: Sun Mar 29 15:26:42 2026 +0530 drm/amd/display: Fix missing parameter details in amdgpu_dm_ism Update comments in dm_ism_get_idle_allow_delay() and dm_ism_insert_record() to better reflect their behavior and inputs. dm_ism_get_idle_allow_delay() computes the delay before allowing idle optimizations based on history and stream timing. dm_ism_insert_record() stores idle duration records in the circular history buffer. These functions explain what they do, but they do not explain what their inputs mean. Fixes the below with gcc W=1: ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'current_state' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'event' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'next_state' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:153 function parameter 'ism' not described in 'dm_ism_get_idle_allow_delay' ../display/amdgpu_dm/amdgpu_dm_ism.c:153 function parameter 'stream' not described in 'dm_ism_get_idle_allow_delay' ../display/amdgpu_dm/amdgpu_dm_ism.c:216 function parameter 'ism' not described in 'dm_ism_insert_record' ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'current_state' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'event' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'next_state' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:153 function parameter 'ism' not described in 'dm_ism_get_idle_allow_delay' ../display/amdgpu_dm/amdgpu_dm_ism.c:153 function parameter 'stream' not described in 'dm_ism_get_idle_allow_delay' ../display/amdgpu_dm/amdgpu_dm_ism.c:216 function parameter 'ism' not described in 'dm_ism_insert_record' Fixes: 754003486c3c ("drm/amd/display: Add Idle state manager(ISM)") Cc: Ray Wu Cc: Leo Li Cc: Roman Li Cc: Alex Hung Cc: Tom Chung Cc: Aurabindo Pillai Cc: Mario Limonciello (AMD) Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit f2483b3f39c8e20d2de0cc16e512a1b2aa14baf9 Author: Srinivasan Shanmugam Date: Mon Mar 30 08:42:29 2026 +0530 drm/amd/display: Fix parameter mismatch in panel self-refresh helper Align parameter names with function arguments. The function controls panel self-refresh enable/disable based on vblank and VRR state. Fixes the below with gcc W=1: ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'dm' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'acrtc' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'stream' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'dm' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'acrtc' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'stream' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' Fixes: 754003486c3c ("drm/amd/display: Add Idle state manager(ISM)") Cc: Ray Wu Cc: Leo Li Cc: Roman Li Cc: Alex Hung Cc: Tom Chung Cc: Aurabindo Pillai Cc: Mario Limonciello (AMD) Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit bf3fc94cd72abe6fc6cd88691fa98f817f4cd6db Author: Chenyu Chen Date: Tue Mar 31 11:15:02 2026 +0800 drm/amd/display: Use drm_display_info for AMD VSDB data Replace the raw EDID byte-walking in parse_amd_vsdb() with a read from connector->display_info.amd_vsdb, now populated by drm_edid. Factor out panel type determination into dm_set_panel_type(), which checks VSDB panel_type, DPCD ext caps, and a luminance heuristic as fallbacks. Signed-off-by: Chenyu Chen Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher commit 118362a96286367b04b31cebb25c6ca3601644a4 Author: Chenyu Chen Date: Tue Mar 31 11:14:26 2026 +0800 drm/edid: Parse AMD Vendor-Specific Data Block Parse the AMD VSDB v3 from CTA extension blocks and store the result in struct drm_amd_vsdb_info, a new field of drm_display_info. This includes replay mode, panel type, and luminance ranges. Signed-off-by: Chenyu Chen Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher commit 57ce498faa1e4d358bf44b5df575874c22922786 Author: Srinivasan Shanmugam Date: Mon Mar 30 08:26:03 2026 +0530 drm/amd/display: Fix dc_is_fp_enabled name mismatch Fix incorrect function name in comment to match dc_is_fp_enabled. This function checks if FPU is currently active by reading a counter. The FPU helpers manage safe usage of FPU in the kernel by tracking when it starts and stops, avoiding misuse or crashes. Fixes: 3539437f354b ("drm/amd/display: Move FPU Guards From DML To DC - Part 1") Cc: Roman Li Cc: Alex Hung Cc: Tom Chung Cc: Dillon Varone Cc: Rafal Ostrowski Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit b3eb6a25b969910852bacbed9408afba4fc09c91 Author: Bartosz Golaszewski Date: Thu Apr 2 16:15:03 2026 +0200 software node: remove software_node_exit() software_node_exit() is an __exitcall() in a built-in compilation unit so effectively dead code. Remove it. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260402-nokia770-gpio-swnodes-v5-2-d730db3dd299@oss.qualcomm.com Signed-off-by: Danilo Krummrich commit 9617b5b62c7cf4284740ba5efdbf083aa5a87e5f Author: Bartosz Golaszewski Date: Thu Apr 2 16:15:02 2026 +0200 kernel: ksysfs: initialize kernel_kobj earlier Software nodes depend on kernel_kobj which is initialized pretty late into the boot process - as a core_initcall(). Ahead of moving the software node initialization to driver_init() we must first make kernel_kobj available before it. Make ksysfs_init() visible in a new header - ksysfs.h - and call it in do_basic_setup() right before driver_init(). Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260402-nokia770-gpio-swnodes-v5-1-d730db3dd299@oss.qualcomm.com Signed-off-by: Danilo Krummrich commit fc0ed906f1eaf189eff76f586bb898eaa4193ba9 Author: Ionut Nechita Date: Mon Mar 23 23:13:43 2026 +0200 drm/amd/display: Wire up dcn10_dio_construct() for all pre-DCN401 generations Description: - Commit b82f0759346617b2 ("drm/amd/display: Migrate DIO registers access from hwseq to dio component") moved DIO_MEM_PWR_CTRL register access behind the new dio abstraction layer but only created the dio object for DCN 4.01. On all other generations (DCN 10/20/21/201/30/301/302/303/ 31/314/315/316/32/321/35/351/36), the dio pointer is NULL, causing the register write to be silently skipped. This results in AFMT HDMI memory not being powered on during init_hw, which can cause HDMI audio failures and display issues on affected hardware including Renoir/Cezanne (DCN 2.1) APUs that use dcn10_init_hw. Call dcn10_dio_construct() in each older DCN generation's resource.c to create the dio object, following the same pattern as DCN 4.01. This ensures the dio pointer is non-NULL and the mem_pwr_ctrl callback works through the dio abstraction for all DCN generations. Fixes: b82f07593466 ("drm/amd/display: Migrate DIO registers access from hwseq to dio component.") Reviewed-by: Ivan Lipski Signed-off-by: Ionut Nechita Signed-off-by: Alex Deucher (cherry picked from commit a4983968fa5b3179ab090407d325a71cdc96874e) commit c6890f36fc49848c61d2113a3442eb1b59e0bc4b Author: Arnd Bergmann Date: Thu Apr 2 22:59:03 2026 +0200 workqueue: avoid unguarded 64-bit division The printk() requires a division that is not allowed on 32-bit architectures: x86_64-linux-ld: lib/test_workqueue.o: in function `test_workqueue_init': test_workqueue.c:(.init.text+0x36f): undefined reference to `__udivdi3' Use div_u64() to print the resulting elapsed microseconds. Fixes: 24b2e73f9700 ("workqueue: add test_workqueue benchmark module") Signed-off-by: Arnd Bergmann Signed-off-by: Tejun Heo commit 624bf3440d7214b62c22d698a0a294323f331d5d Author: Sean Christopherson Date: Tue Mar 10 16:48:12 2026 -0700 KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created Reject LAUNCH_FINISH for SEV-ES and SNP VMs if KVM is actively creating one or more vCPUs, as KVM needs to process and encrypt each vCPU's VMSA. Letting userspace create vCPUs while LAUNCH_FINISH is in-progress is "fine", at least in the current code base, as kvm_for_each_vcpu() operates on online_vcpus, LAUNCH_FINISH (all SEV+ sub-ioctls) holds kvm->mutex, and fully onlining a vCPU in kvm_vm_ioctl_create_vcpu() is done under kvm->mutex. I.e. there's no difference between an in-progress vCPU and a vCPU that is created entirely after LAUNCH_FINISH. However, given that concurrent LAUNCH_FINISH and vCPU creation can't possibly work (for any reasonable definition of "work"), since userspace can't guarantee whether a particular vCPU will be encrypted or not, disallow the combination as a hardening measure, to reduce the probability of introducing bugs in the future, and to avoid having to reason about the safety of future changes related to LAUNCH_FINISH. Cc: Jethro Beekman Closes: https://lore.kernel.org/all/b31f7c6e-2807-4662-bcdd-eea2c1e132fa@fortanix.com Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260310234829.2608037-5-seanjc@google.com Signed-off-by: Sean Christopherson commit b6408b6cec5df76a165575777800ef2aba12b109 Author: Sean Christopherson Date: Tue Mar 10 16:48:11 2026 -0700 KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock Take and hold kvm->lock for before checking sev_guest() in sev_mem_enc_register_region(), as sev_guest() isn't stable unless kvm->lock is held (or KVM can guarantee KVM_SEV_INIT{2} has completed and can't rollack state). If KVM_SEV_INIT{2} fails, KVM can end up trying to add to a not-yet-initialized sev->regions_list, e.g. triggering a #GP Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 110 UID: 0 PID: 72717 Comm: syz.15.11462 Tainted: G U W O 6.16.0-smp-DEV #1 NONE Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024 RIP: 0010:sev_mem_enc_register_region+0x3f0/0x4f0 ../include/linux/list.h:83 Code: <41> 80 3c 04 00 74 08 4c 89 ff e8 f1 c7 a2 00 49 39 ed 0f 84 c6 00 RSP: 0018:ffff88838647fbb8 EFLAGS: 00010256 RAX: dffffc0000000000 RBX: 1ffff92015cf1e0b RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff888367870000 RBP: ffffc900ae78f050 R08: ffffea000d9e0007 R09: 1ffffd4001b3c000 R10: dffffc0000000000 R11: fffff94001b3c001 R12: 0000000000000000 R13: ffff8982ab0bde00 R14: ffffc900ae78f058 R15: 0000000000000000 FS: 00007f34e9dc66c0(0000) GS:ffff89ee64d33000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe180adef98 CR3: 000000047210e000 CR4: 0000000000350ef0 Call Trace: kvm_arch_vm_ioctl+0xa72/0x1240 ../arch/x86/kvm/x86.c:7371 kvm_vm_ioctl+0x649/0x990 ../virt/kvm/kvm_main.c:5363 __se_sys_ioctl+0x101/0x170 ../fs/ioctl.c:51 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x6f/0x1f0 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f34e9f7e9a9 Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f34e9dc6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f34ea1a6080 RCX: 00007f34e9f7e9a9 RDX: 0000200000000280 RSI: 000000008010aebb RDI: 0000000000000007 RBP: 00007f34ea000d69 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f34ea1a6080 R15: 00007ffce77197a8 with a syzlang reproducer that looks like: syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000180)=ANY=[], 0x70}) (async) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="..."], 0x4f}) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r3, 0xc008aeba, &(0x7f0000000040)={0x1, 0x8, 0x0, 0x5625e9b0}) (async) ioctl$KVM_SET_PIT2(r3, 0x8010aebb, &(0x7f0000000280)={[...], 0x5}) (async) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, 0x0) (async) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) (async) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) close(r0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) (async) ioctl$KVM_SET_GUEST_DEBUG(r5, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d46549b, 0x0, [0x46, 0x0, 0x0, 0x0, 0x0, 0x1000]}) (async) ioctl$KVM_RUN(r5, 0xae80, 0x0) Opportunistically use guard() to avoid having to define a new error label and goto usage. Fixes: 1e80fdc09d12 ("KVM: SVM: Pin guest memory when SEV is active") Cc: stable@vger.kernel.org Reported-by: Alexander Potapenko Tested-by: Alexander Potapenko Link: https://patch.msgid.link/20260310234829.2608037-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 9b9f7962e3e879d12da2bf47e02a24ec51690e3d Author: Sean Christopherson Date: Tue Mar 10 16:48:10 2026 -0700 KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU Reject synchronizing vCPU state to its associated VMSA if the vCPU has already been launched, i.e. if the VMSA has already been encrypted. On a host with SNP enabled, accessing guest-private memory generates an RMP #PF and panics the host. BUG: unable to handle page fault for address: ff1276cbfdf36000 #PF: supervisor write access in kernel mode #PF: error_code(0x80000003) - RMP violation PGD 5a31801067 P4D 5a31802067 PUD 40ccfb5063 PMD 40e5954063 PTE 80000040fdf36163 SEV-SNP: PFN 0x40fdf36, RMP entry: [0x6010fffffffff001 - 0x000000000000001f] Oops: Oops: 0003 [#1] SMP NOPTI CPU: 33 UID: 0 PID: 996180 Comm: qemu-system-x86 Tainted: G OE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R7625/0H1TJT, BIOS 1.5.8 07/21/2023 RIP: 0010:sev_es_sync_vmsa+0x54/0x4c0 [kvm_amd] Call Trace: snp_launch_update_vmsa+0x19d/0x290 [kvm_amd] snp_launch_finish+0xb6/0x380 [kvm_amd] sev_mem_enc_ioctl+0x14e/0x720 [kvm_amd] kvm_arch_vm_ioctl+0x837/0xcf0 [kvm] kvm_vm_ioctl+0x3fd/0xcc0 [kvm] __x64_sys_ioctl+0xa3/0x100 x64_sys_call+0xfe0/0x2350 do_syscall_64+0x81/0x10f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7ffff673287d Note, the KVM flaw has been present since commit ad73109ae7ec ("KVM: SVM: Provide support to launch and run an SEV-ES guest"), but has only been actively dangerous for the host since SNP support was added. With SEV-ES, KVM would "just" clobber guest state, which is totally fine from a host kernel perspective since userspace can clobber guest state any time before sev_launch_update_vmsa(). Fixes: ad27ce155566 ("KVM: SEV: Add KVM_SEV_SNP_LAUNCH_FINISH command") Reported-by: Jethro Beekman Closes: https://lore.kernel.org/all/d98692e2-d96b-4c36-8089-4bc1e5cc3d57@fortanix.com Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260310234829.2608037-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 25a642b6abc98bbbabbf2baef9fc498bbea6aee6 Author: Sean Christopherson Date: Tue Mar 10 16:48:09 2026 -0700 KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test Drop the explicit KVM_SEV_LAUNCH_UPDATE_VMSA call when creating an SEV-ES VM in the SEV migration test, as sev_vm_create() automatically updates the VMSA pages for SEV-ES guests. The only reason the duplicate call doesn't cause visible problems is because the test doesn't actually try to run the vCPUs. That will change when KVM adds a check to prevent userspace from re-launching a VMSA (which corrupts the VMSA page due to KVM writing encrypted private memory). Fixes: 69f8e15ab61f ("KVM: selftests: Use the SEV library APIs in the intra-host migration test") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260310234829.2608037-2-seanjc@google.com Signed-off-by: Sean Christopherson commit a7f53694d591675fba26ef24b9ac3c2748e5499b Author: Sean Christopherson Date: Thu Mar 12 17:33:02 2026 -0700 KVM: SEV: Use kvzalloc_objs() when pinning userpages Use kvzalloc_objs() instead of sev_pin_memory()'s open coded (rough) equivalent to harden the code and Note! This sanity check in __kvmalloc_node_noprof() /* Don't even allow crazy sizes */ if (unlikely(size > INT_MAX)) { WARN_ON_ONCE(!(flags & __GFP_NOWARN)); return NULL; } will artificially limit the maximum size of any single pinned region to just under 1TiB. While there do appear to be providers that support SEV VMs with more than 1TiB of _total_ memory, it's unlikely any KVM-based providers pin 1TiB in a single request. Allocate with NOWARN so that fuzzers can't trip the WARN_ON_ONCE() when they inevitably run on systems with copious amounts of RAM, i.e. when they can get by KVM's "total_npages > totalram_pages()" restriction. Note #2, KVM's usage of vmalloc()+kmalloc() instead of kvmalloc() predates commit 7661809d493b ("mm: don't allow oversized kvmalloc() calls") by 4+ years (see commit 89c505809052 ("KVM: SVM: Add support for KVM_SEV_LAUNCH_UPDATE_DATA command"). I.e. the open coded behavior wasn't intended to avoid the aforementioned sanity check. The implementation appears to be pure oversight at the time the code was written, as it showed up in v3[1] of the early RFCs, whereas as v2[2] simply used kmalloc(). Cc: Liam Merwick Link: https://lore.kernel.org/all/20170724200303.12197-17-brijesh.singh@amd.com [1] Link: https://lore.kernel.org/all/148846786714.2349.17724971671841396908.stgit__25299.4950431914$1488470940$gmane$org@brijesh-build-machine [2] Reviewed-by: Liam Merwick Tested-by: Liam Merwick Link: https://patch.msgid.link/20260313003302.3136111-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 7ad02ff1e4a4d1a06483ec839cff26ea232db70f Author: Sean Christopherson Date: Thu Mar 12 17:33:01 2026 -0700 KVM: SEV: Use PFN_DOWN() to simplify "number of pages" math when pinning memory Use PFN_DOWN() instead of open coded equivalents in sev_pin_memory() to simplify the code and make it easier to read. No functional change intended (verified before and after versions of the generated code are identical). Reviewed-by: Liam Merwick Tested-by: Liam Merwick Link: https://patch.msgid.link/20260313003302.3136111-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 6d71f9349d9bf09bf82309bdc46704b4b6f6b314 Author: Sean Christopherson Date: Thu Mar 12 17:33:00 2026 -0700 KVM: SEV: Disallow pinning more pages than exist in the system Explicitly disallow pinning more pages for an SEV VM than exist in the system to defend against absurd userspace requests without relying on somewhat arbitrary kernel functionality to prevent truly stupid KVM behavior. E.g. even with the INT_MAX check, userspace can request that KVM pin nearly 8TiB of memory, regardless of how much RAM exists in the system. Opportunistically rename "locked" to a more descriptive "total_npages". Reviewed-by: Liam Merwick Tested-by: Liam Merwick Link: https://patch.msgid.link/20260313003302.3136111-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 12a8ff869ddc284f95fe111ababab166b05e1c57 Author: Sean Christopherson Date: Thu Mar 12 17:32:59 2026 -0700 KVM: SEV: Drop useless sanity checks in sev_mem_enc_register_region() Drop sev_mem_enc_register_region()'s sanity checks on the incoming address and size, as SEV is 64-bit only, making ULONG_MAX a 64-bit, all-ones value, and thus making it impossible for kvm_enc_region.{addr,size} to be greater than ULONG_MAX. Note, sev_pin_memory() verifies the incoming address is non-NULL (which isn't strictly required, but whatever), and that addr+size don't wrap to zero (which _is_ needed and what really needs to be guarded against). Note #2, pin_user_pages_fast() guards against the end address walking into kernel address space, so lack of an access_ok() check is also safe (maybe not ideal, but safe). No functional change intended (the generated code is literally the same, i.e. the compiler was smart enough to know the checks were useless). Reviewed-by: Liam Merwick Tested-by: Liam Merwick Link: https://patch.msgid.link/20260313003302.3136111-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 8acffeef5ef720c35e513e322ab08e32683f32f2 Author: Sean Christopherson Date: Thu Mar 12 17:32:58 2026 -0700 KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION Drop the WARN in sev_pin_memory() on npages overflowing an int, as the WARN is comically trivially to trigger from userspace, e.g. by doing: struct kvm_enc_region range = { .addr = 0, .size = -1ul, }; __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &range); Note, the checks in sev_mem_enc_register_region() that presumably exist to verify the incoming address+size are completely worthless, as both "addr" and "size" are u64s and SEV is 64-bit only, i.e. they _can't_ be greater than ULONG_MAX. That wart will be cleaned up in the near future. if (range->addr > ULONG_MAX || range->size > ULONG_MAX) return -EINVAL; Opportunistically add a comment to explain why the code calculates the number of pages the "hard" way, e.g. instead of just shifting @ulen. Fixes: 78824fabc72e ("KVM: SVM: fix svn_pin_memory()'s use of get_user_pages_fast()") Cc: stable@vger.kernel.org Reviewed-by: Liam Merwick Tested-by: Liam Merwick Link: https://patch.msgid.link/20260313003302.3136111-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 9c55d0eb4e9d1bf229d691363fb0641a9b05d904 Author: Koichiro Den Date: Fri Mar 20 23:01:39 2026 +0900 misc: pci_endpoint_test: Use -EINVAL for small subrange size The sub_size check ensures that each subrange is large enough for 32-bit accesses. Subranges smaller than sizeof(u32) do not satisfy this assumption, so this is a local sanity check rather than a resource exhaustion case. Return -EINVAL instead of -ENOSPC for this case. Suggested-by: Niklas Cassel Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260320140139.2415480-1-den@valinux.co.jp commit 7212094baef5acabef1969d77781a6527c09d743 Author: Sean Christopherson Date: Thu Mar 12 16:48:23 2026 -0700 KVM: x86: Suppress WARNs on nested_run_pending after userspace exit To end an ongoing game of whack-a-mole between KVM and syzkaller, WARN on illegally cancelling a pending nested VM-Enter if and only if userspace has NOT gained control of the vCPU since the nested run was initiated. As proven time and time again by syzkaller, userspace can clobber vCPU state so as to force a VM-Exit that violates KVM's architectural modelling of VMRUN/VMLAUNCH/VMRESUME. To detect that userspace has gained control, while minimizing the risk of operating on stale data, convert nested_run_pending from a pure boolean to a tri-state of sorts, where '0' is still "not pending", '1' is "pending", and '2' is "pending but untrusted". Then on KVM_RUN, if the flag is in the "trusted pending" state, move it to "untrusted pending". Note, moving the state to "untrusted" even if KVM_RUN is ultimately rejected is a-ok, because for the "untrusted" state to matter, KVM must get past kvm_x86_vcpu_pre_run() at some point for the vCPU. Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20260312234823.3120658-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 3d4470d71fbf70576636947aba1ae51adbad5225 Author: Yosry Ahmed Date: Thu Mar 12 16:48:22 2026 -0700 KVM: x86: Move nested_run_pending to kvm_vcpu_arch Move nested_run_pending field present in both svm_nested_state and nested_vmx to the common kvm_vcpu_arch. This allows for common code to use without plumbing it through per-vendor helpers. nested_run_pending remains zero-initialized, as the entire kvm_vcpu struct is, and all further accesses are done through vcpu->arch instead of svm->nested or vmx->nested. No functional change intended. Suggested-by: Sean Christopherson Signed-off-by: Yosry Ahmed [sean: expand the commend in the field declaration] Link: https://patch.msgid.link/20260312234823.3120658-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 41fa04327384148b0e2e828c9be9862c5240e9fa Author: Oleg Nesterov Date: Fri Apr 3 15:30:40 2026 +0200 selftests/seccomp: Add hard-coded __NR_uprobe for x86_64 This complements the commit 18f7686a1ce6 ("selftests/seccomp: Add hard-coded __NR_uretprobe for x86_64"). Signed-off-by: Oleg Nesterov Link: https://patch.msgid.link/ac_BAMSggw-_ABPE@redhat.com Signed-off-by: Kees Cook commit 6a14beefab457f267b8cedc6ac697a9562ec1244 Merge: 891a05ccba9270 1a1cadbd5d50b3 Author: Alexei Starovoitov Date: Fri Apr 3 08:33:48 2026 -0700 Merge branch 'bpf-prep-patches-for-static-stack-liveness' Alexei Starovoitov says: ==================== bpf: Prep patches for static stack liveness. v4->v5: - minor test fixup v3->v4: - fixed invalid recursion detection when calback is called multiple times v3: https://lore.kernel.org/bpf/20260402212856.86606-1-alexei.starovoitov@gmail.com/ v2->v3: - added recursive call detection - fixed ubsan warning - removed double declaration in the header - added Acks v2: https://lore.kernel.org/bpf/20260402061744.10885-1-alexei.starovoitov@gmail.com/ v1->v2: . fixed bugs spotted by Eduard, Mykyta, claude and gemini . fixed selftests that were failing in unpriv . gemini(sashiko) found several precision improvements in patch 6, but they made no difference in real programs. v1: https://lore.kernel.org/bpf/20260401021635.34636-1-alexei.starovoitov@gmail.com/ First 6 prep patches for static stack liveness. . do src/dst_reg validation early and remove defensive checks . sort subprog in topo order. We wanted to do this long ago to process global subprogs this way and in other cases. . Add constant folding pass that computes map_ptr, subprog_idx, loads from readonly maps, and other constants that fit into 32-bit . Use these constants to eliminate dead code. Replace predicted conditional branches with "jmp always". That reduces JIT prog size. . Add two helpers that return access size from their arguments. ==================== Link: https://patch.msgid.link/20260403024422.87231-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 1a1cadbd5d50b31ae1340c2a9938947719696ca0 Author: Alexei Starovoitov Date: Thu Apr 2 19:44:21 2026 -0700 bpf: Add helper and kfunc stack access size resolution The static stack liveness analysis needs to know how many bytes a helper or kfunc accesses through a stack pointer argument, so it can precisely mark the affected stack slots as stack 'def' or 'use'. Add bpf_helper_stack_access_bytes() and bpf_kfunc_stack_access_bytes() which resolve the access size for a given call argument. Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260403024422.87231-7-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 19dbb1347481105e8aabc7479af35c09a65333a9 Author: Alexei Starovoitov Date: Thu Apr 2 19:44:20 2026 -0700 bpf: Move verifier helpers to header Move several helpers to header as preparation for the subsequent stack liveness patches. Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260403024422.87231-6-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit f1606dd0ac49230f5a5fa1a279210fdf0249c20f Author: Alexei Starovoitov Date: Thu Apr 2 19:44:19 2026 -0700 bpf: Add bpf_compute_const_regs() and bpf_prune_dead_branches() passes Add two passes before the main verifier pass: bpf_compute_const_regs() is a forward dataflow analysis that tracks register values in R0-R9 across the program using fixed-point iteration in reverse postorder. Each register is tracked with a six-state lattice: UNVISITED -> CONST(val) / MAP_PTR(map_index) / MAP_VALUE(map_index, offset) / SUBPROG(num) -> UNKNOWN At merge points, if two paths produce the same state and value for a register, it stays; otherwise it becomes UNKNOWN. The analysis handles: - MOV, ADD, SUB, AND with immediate or register operands - LD_IMM64 for plain constants, map FDs, map values, and subprogs - LDX from read-only maps: constant-folds the load by reading the map value directly via bpf_map_direct_read() Results that fit in 32 bits are stored per-instruction in insn_aux_data and bitmasks. bpf_prune_dead_branches() uses the computed constants to evaluate conditional branches. When both operands of a conditional jump are known constants, the branch outcome is determined statically and the instruction is rewritten to an unconditional jump. The CFG postorder is then recomputed to reflect new control flow. This eliminates dead edges so that subsequent liveness analysis doesn't propagate through dead code. Also add runtime sanity check to validate that precomputed constants match the verifier's tracked state. Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260403024422.87231-5-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 427c07ddb9e63dc96488bbf51bb196e7aca19825 Author: Alexei Starovoitov Date: Thu Apr 2 19:44:18 2026 -0700 selftests/bpf: Add tests for subprog topological ordering Add few tests for topo sort: - linear chain: main -> A -> B - diamond: main -> A, main -> B, A -> C, B -> C - mixed global/static: main -> global -> static leaf - shared callee: main -> leaf, main -> global -> leaf - duplicate calls: main calls same subprog twice - no calls: single subprog Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260403024422.87231-4-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit e6898ec751e4d8577b210f8e816ea9f8c2a7158a Author: Alexei Starovoitov Date: Thu Apr 2 19:44:17 2026 -0700 bpf: Sort subprogs in topological order after check_cfg() Add a pass that sorts subprogs in topological order so that iterating subprog_topo_order[] walks leaf subprogs first, then their callers. This is computed as a DFS post-order traversal of the CFG. The pass runs after check_cfg() to ensure the CFG has been validated before traversing and after postorder has been computed to avoid walking dead code. Reviewed-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260403024422.87231-3-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 503d21ef8eac1437d76919921115acf0aef328a0 Author: Alexei Starovoitov Date: Thu Apr 2 19:44:16 2026 -0700 bpf: Do register range validation early Instead of checking src/dst range multiple times during the main verifier pass do them once. Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260403024422.87231-2-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit d4464694f2a409fadbe17a70202242ff6b72ee30 Author: Jian Zhang Date: Fri Apr 3 22:39:38 2026 +0800 ipmi: ssif_bmc: add unit test for state machine Add some unit test for state machine when in SSIF_ABORTING state. Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver") Signed-off-by: Jian Zhang Message-ID: <20260403143939.434017-1-zhangjian.3032@bytedance.com> Signed-off-by: Corey Minyard commit 891a05ccba927050cee17eb90c74692fe083ddaf Merge: 6f6c794d0ff05d d8a9a4b11a1379 Author: Alexei Starovoitov Date: Fri Apr 3 08:12:58 2026 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.0-rc6+ Cross-merge BPF and other fixes after downstream PR. Minor conflict in kernel/bpf/verifier.c Signed-off-by: Alexei Starovoitov commit d1b091aaba8c6a61950ac8bd15be61418f8dbf88 Author: Anushka Badhe Date: Wed Mar 25 15:00:03 2026 +0530 dt-bindings: rtc: add olpc,xo1-rtc to trivial-rtc Add the OLPC XO-1 RTC compatible string to the trivial-rtc schema instead of creating a standalone binding file, as it only requires a compatible property with no additional configuration. Signed-off-by: Anushka Badhe Acked-by: Conor Dooley Link: https://patch.msgid.link/20260325093003.44051-1-anushkabadhe@gmail.com Signed-off-by: Alexandre Belloni commit b2b0dcaa28d2d7389e5845285a50d0151dd6c017 Author: Otto Pflüger Date: Sun Mar 29 09:27:45 2026 +0200 dt-bindings: rtc: sc2731: Add compatible for SC2730 The RTC block found in the SC2730 PMIC is compatible with the one found in the SC2731 PMIC. Acked-by: Rob Herring (Arm) Signed-off-by: Otto Pflüger Link: https://patch.msgid.link/20260329-sc27xx-mfd-cells-v3-1-9158dee41f74@abscue.de Signed-off-by: Alexandre Belloni commit d5759519805c54786c00765ca1303e6d7a0676ca Author: Mike Rapoport (Microsoft) Date: Mon Mar 30 22:10:00 2026 +0300 x86/alternative: delay freeing of smp_locks section On SMP systems alternative_instructions() frees memory occupied by smp_locks section immediately after patching the lock instructions. The memory is freed using free_init_pages() that calls free_reserved_area() that essentially does __free_page() for every page in the range. Up until recently it didn't update memblock state so in cases when CONFIG_ARCH_KEEP_MEMBLOCK is enabled (on x86 it is selected by INTEL_TDX_HOST), the state of memblock and the memory map would be inconsistent. Additionally, with CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, freeing of smp_locks happens before the memory map is fully initialized and freeing reserved memory may cause an access to not-yet-initialized struct page when __free_page() searches for a buddy page. Following the discussion in [1], implementation of memblock_free_late() and free_reserved_area() was unified to ensure that reserved memory that's freed after memblock transfers the pages to the buddy allocator is actually freed and that the memblock and the memory map are consistent. As a part of these changes, free_reserved_area() now WARN()s when it is called before the initialization of the memory map is complete. The memory map is fully initialized in page_alloc_init_late() that completes before initcalls are executed, so it is safe to free reserved memory in any initcall except early_initcall(). Move freeing of smp_locks section to an initcall to ensure it will happen after the memory map is fully initialized. Since it does not matter which exactly initcall to use and the code lives in arch/, pick arch_initcall. [1] https://lore.kernel.org/all/ec2aaef14783869b3be6e3c253b2dcbf67dbc12a.camel@kernel.crashing.org Reported-By: Bert Karwatzki Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202603302154.b50adaf1-lkp@intel.com Tested-By: Bert Karwatzki Link: https://lore.kernel.org/r/20260327140109.7561-1-spasswolf@web.de Acked-by: Borislav Petkov (AMD) Fixes: b2129a39511b ("memblock: make free_reserved_area() update memblock if ARCH_KEEP_MEMBLOCK=y") Signed-off-by: Mike Rapoport (Microsoft) commit cba9ce8c1afeef4bbfa29891ff76634f6236c697 Merge: ccd7e53b7d6f06 85c38c2fa17da2 Author: Mark Brown Date: Fri Apr 3 15:15:04 2026 +0100 ASoC: Intel: Fix MCLK leaks and clean up error aravindanilraj0702@gmail.com says: From: Aravind Anilraj This series fixes MCLK resource leaks in the platform_clock_control() implementations for bytcr_rt5640, bytcr_rt5651, and cht_bsw_rt5672. In the SND_SOC_DAPM_EVENT_ON() path, clk_prepare_enable() is called to enable MCLK, but subsequent failures in codec clock configuration (eg: *_prepare_and_enable_pll1() or snd_soc_dai_set_sysclk()) return without disabling the clock, leaking a reference. Patches 1-3 fix this by adding the missing clk_disable_unprepare() calls in the relevant error paths, ensuring proper symmetry between enable and disable operations within the EVENT_ON scope. Patch 4 moves unrelated logging changes into a separate patch and standardizes error messages. commit 85c38c2fa17da23b2258edd96c89e63f92426ba5 Author: Aravind Anilraj Date: Wed Apr 1 18:05:07 2026 -0400 ASoC: Intel: Standardize MCLK error logs across RT boards Standardize the error logging in platform_clock_control() by adding missing newline characters to dev_err() strings. Additionally, include the return code in the error messages to assist with debugging. Signed-off-by: Aravind Anilraj Reviewed-by: Cezary Rojewski Link: https://patch.msgid.link/20260401220507.23557-5-aravindanilraj0702@gmail.com Signed-off-by: Mark Brown commit dced5a373a96cfd9f3bd0ffcf5339a7579d1473a Author: Aravind Anilraj Date: Wed Apr 1 18:05:06 2026 -0400 ASoC: Intel: cht_bsw_rt5672: Fix MCLK leak on platform_clock_control error If snd_soc_dai_set_pll() or snd_soc_dai_set_sysclk() fail inside the EVENT_ON path, the function returns without calling clk_disable_unprepare() on ctx->mclk, which was already enabled earlier in the same code path. Add the missing clk_disable_unprepare() calls before returning the error. Signed-off-by: Aravind Anilraj Reviewed-by: Cezary Rojewski Link: https://patch.msgid.link/20260401220507.23557-4-aravindanilraj0702@gmail.com Signed-off-by: Mark Brown commit b022e5c142efe4c5497e6cfda1f143618b4b9254 Author: Aravind Anilraj Date: Wed Apr 1 18:05:05 2026 -0400 ASoC: Intel: bytcr_rt5651: Fix MCLK leak on platform_clock_control error If byt_rt5651_prepare_and_enable_pll1() fails, the function returns without calling clk_disable_unprepare() on priv->mclk, which was already enabled earlier in the same code path. Add the missing cleanup call to prevent the clock from leaking. Signed-off-by: Aravind Anilraj Reviewed-by: Cezary Rojewski Link: https://patch.msgid.link/20260401220507.23557-3-aravindanilraj0702@gmail.com Signed-off-by: Mark Brown commit a02496a29463e7f0d1643e83aab28adb3dd03f1a Author: Aravind Anilraj Date: Wed Apr 1 18:05:04 2026 -0400 ASoC: Intel: bytcr_rt5640: Fix MCLK leak on platform_clock_control error If byt_rt5640_prepare_and_enable_pll1() fails, the function returns without calling clk_disable_unprepare() on priv->mclk, which was already enabled earlier in the same code path. Add the missing cleanup call to prevent the clock from leaking. Signed-off-by: Aravind Anilraj Reviewed-by: Cezary Rojewski Link: https://patch.msgid.link/20260401220507.23557-2-aravindanilraj0702@gmail.com Signed-off-by: Mark Brown commit ccd7e53b7d6f06b0fef0f657c8cf377be2e8978d Author: Chancel Liu Date: Thu Mar 26 14:56:14 2026 +0900 ASoC: imx-rpmsg: Add DSD format support with dynamic DAI format switching Add hw_params callback to dynamically switch DAI format between I2S and PDM based on audio stream format. When DSD formats are detected, the DAI format is switched to PDM mode. Signed-off-by: Chancel Liu Link: https://patch.msgid.link/20260326055614.3614104-1-chancel.liu@nxp.com Signed-off-by: Mark Brown commit ba2a0e81d4d71c3bbc61c420b6fac5abaeddd77d Author: Niranjan H Y Date: Wed Apr 1 18:51:45 2026 +0530 ASoC: SDCA: Export Q7.8 volume control helpers Export the Q7.8 volume control helpers to allow reuse by other ASoC drivers. These functions handle 16-bit signed Q7.8 fixed-point format values for volume controls. Changes include: - Rename q78_get_volsw to sdca_asoc_q78_get_volsw - Rename q78_put_volsw to sdca_asoc_q78_put_volsw - Add a convenience macro SDCA_SINGLE_Q78_TLV and SDCA_DOUBLE_Q78_TLV for creating mixer controls This allows other ASoC drivers to easily implement controls using the Q7.8 fixed-point format without duplicating code. Signed-off-by: Niranjan H Y Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260401132148.2367-1-niranjan.hy@ti.com Signed-off-by: Mark Brown commit 04cc47624a33a6b56c62bfd65ad6b2d1c42e17c4 Author: Rosen Penev Date: Wed Apr 1 19:50:40 2026 -0700 ASoC: codecs: tlv320dac33: remove kmemdup_array Use a flexible array member and struct_size to use one allocation. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260402025040.93569-1-rosenp@gmail.com Signed-off-by: Mark Brown commit 9557ec3f9c9fc9ca737f0bc963088193132fd967 Author: Charles Keepax Date: Fri Mar 27 16:27:32 2026 +0000 ASoC: SDCA: Add RJ support to class driver Add the retaskable jack Function to the list of Functions supported by the class driver, it shouldn't require anything that isn't already supported. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260327162732.877257-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 08cf4a8181b4378a0a50ea370391f30032c4e4ec Author: Chi Zhiling Date: Fri Apr 3 16:05:38 2026 +0800 exfat: use exfat_chain_advance helper Replace open-coded cluster chain walking logic with exfat_chain_advance() across exfat_readdir, exfat_find_dir_entry, exfat_count_dir_entries, exfat_search_empty_slot and exfat_check_dir_empty. Signed-off-by: Chi Zhiling Reviewed-by: Sungjong Seo Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 227468fc82e4ce43b6ccc1111aa479948f3dd38c Author: Chi Zhiling Date: Fri Apr 3 16:05:37 2026 +0800 exfat: introduce exfat_chain_advance helper Introduce exfat_chain_advance() to walk a exfat_chain structure by a given step, updating both ->dir and ->size fields atomically. This helper handles both ALLOC_NO_FAT_CHAIN and ALLOC_FAT_CHAIN modes with proper boundary checking. Suggested-by: Yuezhang Mo Signed-off-by: Chi Zhiling Reviewed-by: Sungjong Seo Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit f764c5897fc2d2eccce05dba86f32aac94bcd28c Author: Chi Zhiling Date: Fri Apr 3 16:05:36 2026 +0800 exfat: remove NULL cache pointer case in exfat_ent_get Since exfat_get_next_cluster has been updated, no callers pass a NULL pointer to exfat_ent_get, so remove the handling logic for this case. Signed-off-by: Chi Zhiling Reviewed-by: Sungjong Seo Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 6f2cbe45c675d21e104856fc5917048e772a0dcf Author: Chi Zhiling Date: Fri Apr 3 16:05:35 2026 +0800 exfat: use exfat_cluster_walk helper Replace the custom exfat_walk_fat_chain() function and open-coded FAT chain walking logic with the exfat_cluster_walk() helper across exfat_find_location, __exfat_get_dentry_set, and exfat_map_cluster. Suggested-by: Sungjong Seo Signed-off-by: Chi Zhiling Reviewed-by: Sungjong Seo Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit f5e5177fd751529a3c951a0f4f7a05fdfadab775 Author: Chi Zhiling Date: Fri Apr 3 16:05:34 2026 +0800 exfat: introduce exfat_cluster_walk helper Introduce exfat_cluster_walk() to walk the FAT chain by a given step, handling both ALLOC_NO_FAT_CHAIN and ALLOC_FAT_CHAIN modes. Also redefine exfat_get_next_cluster as a thin wrapper around it for backward compatibility. Signed-off-by: Chi Zhiling Reviewed-by: Sungjong Seo Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit ff37797badd831797b8a27830fe5046d7e23fdc3 Author: Chi Zhiling Date: Fri Apr 3 16:05:33 2026 +0800 exfat: fix incorrect directory checksum after rename to shorter name When renaming a file in-place to a shorter name, exfat_remove_entries marks excess entries as DELETED, but es->num_entries is not updated accordingly. As a result, exfat_update_dir_chksum iterates over the deleted entries and computes an incorrect checksum. This does not lead to persistent corruption because mark_inode_dirty() is called afterward, and __exfat_write_inode later recomputes the checksum using the correct num_entries value. Fix by setting es->num_entries = num_entries in exfat_init_ext_entry. Signed-off-by: Chi Zhiling Reviewed-by: Sungjong Seo Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit d644a698de12e996778657f65a4608299368e138 Author: Randy Dunlap Date: Wed Mar 18 15:21:05 2026 -0700 NFSD: Docs: clean up pnfs server timeout docs Make various changes to the documentation formatting to avoid docs build errors and otherwise improve the produced output format: - use bullets for lists - don't use a '.' at the end of echo commands - fix indentation Documentation/admin-guide/nfs/pnfs-block-server.rst:55: ERROR: Unexpected indentation. [docutils] Documentation/admin-guide/nfs/pnfs-scsi-server.rst:37: ERROR: Unexpected indentation. [docutils] Fixes: 6a97f70b45e7 ("NFSD: Enforce timeout on layout recall and integrate lease manager fencing") Signed-off-by: Randy Dunlap Signed-off-by: Chuck Lever commit 124f9af22ce27d146f11e37f826671a0a1953ad5 Author: Joseph Salisbury Date: Mon Mar 16 14:28:45 2026 -0400 nfsd: fix comment typo in nfsxdr The file contains a spelling error in a source comment (occured). Typos in comments reduce readability and make text searches less reliable for developers and maintainers. Replace 'occured' with 'occurred' in the affected comment. This is a comment-only cleanup and does not change behavior. Signed-off-by: Joseph Salisbury Signed-off-by: Chuck Lever commit fa6966fd05a122b413823c579a1f898427e2cdd4 Author: Joseph Salisbury Date: Mon Mar 16 14:25:16 2026 -0400 nfsd: fix comment typo in nfs3xdr The file contains a spelling error in a source comment (occured). Typos in comments reduce readability and make text searches less reliable for developers and maintainers. Replace 'occured' with 'occurred' in the affected comment. This is a comment-only cleanup and does not change behavior. Signed-off-by: Joseph Salisbury Signed-off-by: Chuck Lever commit 42cc13995967c1f3790cb106916eed8fab2a37b1 Author: Dai Ngo Date: Fri Mar 13 12:31:48 2026 -0400 NFSD: convert callback RPC program to per-net namespace The callback channel's rpc_program, rpc_version, rpc_stat, and per-procedure counts are declared as file-scope statics in nfs4callback.c, shared across all network namespaces. Forechannel RPC statistics are already maintained per-netns (via nfsd_svcstats in struct nfsd_net); the backchannel has no such separation. When backchannel statistics are eventually surfaced to userspace, the global counters would expose cross-namespace data. Allocate per-netns copies of these structures through a new opaque struct nfsd_net_cb, managed by nfsd_net_cb_init() and nfsd_net_cb_shutdown(). The struct definition is private to nfs4callback.c; struct nfsd_net holds only a pointer. Signed-off-by: Dai Ngo Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 39bd1bfe92a1a9450e1d6397f845020581090836 Author: Chuck Lever Date: Fri Mar 13 12:31:47 2026 -0400 NFSD: use per-operation statidx for callback procedures The callback RPC procedure table uses NFSPROC4_CB_##call for p_statidx, which maps CB_NULL to index 0 and every compound-based callback (CB_RECALL, CB_LAYOUT, CB_OFFLOAD, etc.) to index 1. All compound callback operations therefore share a single statistics counter, making per-operation accounting impossible. Assign p_statidx from the NFSPROC4_CLNT_##proc enum instead, giving each callback operation its own counter slot. The counts array is already sized by ARRAY_SIZE(nfs4_cb_procedures), so no allocation change is needed. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 18755b8c2f241648b951d3772e0742cc59834d5a Author: Chuck Lever Date: Tue Mar 10 15:39:25 2026 -0400 svcrdma: Use contiguous pages for RDMA Read sink buffers svc_rdma_build_read_segment() constructs RDMA Read sink buffers by consuming pages one-at-a-time from rq_pages[] and building one bvec per page. A 64KB NFS READ payload produces 16 separate bvecs, 16 DMA mappings, and potentially multiple RDMA Read WRs (on platforms with 4KB pages). A single higher-order allocation followed by split_page() yields physically contiguous memory while preserving per-page refcounts. A single bvec spanning the contiguous range causes rdma_rw_ctx_init_bvec() to take the rdma_rw_init_single_wr_bvec() fast path: one DMA mapping, one SGE, one WR. The split sub-pages replace the original rq_pages[] entries, so all downstream page tracking, completion handling, and xdr_buf assembly remain unchanged. Allocation uses __GFP_NORETRY | __GFP_NOWARN and falls back through decreasing orders. If even order-1 fails, the existing per-page path handles the segment. When nr_pages is not a power of two, get_order() rounds up and the allocation yields more pages than needed. The extra split pages replace existing rq_pages[] entries (freed via put_page() first), so there is no net increase in per- request page consumption. Successive segments reuse the same padding slots, preventing accumulation. The rq_maxpages guard rejects any allocation that would overrun the array, falling back to the per-page path. Under memory pressure, __GFP_NORETRY causes the higher- order allocation to fail without stalling. The contiguous path is attempted when the segment starts page-aligned (rc_pageoff == 0) and spans at least two pages. NFS WRITE segments carry application-modified byte ranges of arbitrary length, so the optimization is not restricted to power-of-two page counts. Signed-off-by: Chuck Lever commit 4e2866b2baaddfff6069a2f18fc134c1d5a08f2b Author: Chuck Lever Date: Wed Mar 11 12:18:54 2026 -0400 SUNRPC: Add svc_rqst_page_release() helper svc_rqst_replace_page() releases displaced pages through a per-rqst folio batch, but exposes the add-or-flush sequence directly. svc_tcp_restore_pages() releases displaced pages individually with put_page(). Introduce svc_rqst_page_release() to encapsulate the batched release mechanism. Convert svc_rqst_replace_page() and svc_tcp_restore_pages() to use it. The latter now benefits from the same batched release that svc_rqst_replace_page() already uses. Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit c9c99b7b7051eb7121b3224bfce181fb023b0269 Author: Jian Zhang Date: Fri Apr 3 17:06:01 2026 +0800 ipmi: ssif_bmc: change log level to dbg in irq callback Long-running tests indicate that this logging can occasionally disrupt timing and lead to request/response corruption. Irq handler need to be executed as fast as possible, most I2C slave IRQ implementations are byte-level, logging here can significantly affect transfer behavior and timing. It is recommended to use dev_dbg() for these messages. Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver") Signed-off-by: Jian Zhang Message-ID: <20260403090603.3988423-4-zhangjian.3032@bytedance.com> Signed-off-by: Corey Minyard commit 1d38e849adb6851ee280aa1a1d687b2181549a66 Author: Jian Zhang Date: Fri Apr 3 17:06:00 2026 +0800 ipmi: ssif_bmc: fix message desynchronization after truncated response A truncated response, caused by host power-off, or other conditions, can lead to message desynchronization. Raw trace data (STOP loss scenario, add state transition comment): 1. T-1: Read response phase (SSIF_RES_SENDING) 8271.955342 WR_RCV [03] <- Read polling cmd 8271.955348 RD_REQ [04] <== SSIF_RES_SENDING <- start sending response 8271.955436 RD_PRO [b4] 8271.955527 RD_PRO [00] 8271.955618 RD_PRO [c1] 8271.955707 RD_PRO [00] 8271.955814 RD_PRO [ad] <== SSIF_RES_SENDING <- last byte <- !! STOP lost (truncated response) 2. T: New Write request arrives, BMC still in SSIF_RES_SENDING 8271.967973 WR_REQ [] <== SSIF_RES_SENDING >> SSIF_ABORTING <- log: unexpected WR_REQ in RES_SENDING 8271.968447 WR_RCV [02] <== SSIF_ABORTING <- do nothing 8271.968452 WR_RCV [02] <== SSIF_ABORTING <- do nothing 8271.968454 WR_RCV [18] <== SSIF_ABORTING <- do nothing 8271.968456 WR_RCV [01] <== SSIF_ABORTING <- do nothing 8271.968458 WR_RCV [66] <== SSIF_ABORTING <- do nothing 8271.978714 STOP [] <== SSIF_ABORTING >> SSIF_READY <- log: unexpected SLAVE STOP in state=SSIF_ABORTING 3. T+1: Next Read polling, treated as a fresh transaction 8271.979125 WR_REQ [] <== SSIF_READY >> SSIF_START 8271.979326 WR_RCV [03] <== SSIF_START >> SSIF_SMBUS_CMD <- smbus_cmd=0x03 8271.979331 RD_REQ [04] <== SSIF_RES_SENDING <- sending response 8271.979427 RD_PRO [b4] <- !! this is T's stale response -> desynchronization When in SSIF_ABORTING state, a newly arrived command should still be handled to avoid dropping the request or causing message desynchronization. Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver") Signed-off-by: Jian Zhang Message-ID: <20260403090603.3988423-3-zhangjian.3032@bytedance.com> Signed-off-by: Corey Minyard commit ea641be7a4faee4351f9c5ed6b188e1bbf5586a6 Author: Jian Zhang Date: Fri Apr 3 17:05:59 2026 +0800 ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure copy_to_user() returns the number of bytes that could not be copied, with a non-zero value indicating a partial or complete failure. The current code only checks for negative return values and treats all non-negative results as success. Treating any positive return value from copy_to_user() as an error and returning -EFAULT. Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver") Signed-off-by: Jian Zhang Message-ID: <20260403090603.3988423-2-zhangjian.3032@bytedance.com> Signed-off-by: Corey Minyard commit 7fc3e2546cf3fa9a28a2acc92a512c779a8e5038 Author: Jian Zhang Date: Fri Apr 3 17:05:58 2026 +0800 ipmi: ssif_bmc: cancel response timer on remove The response timer can stay armed across device teardown. If it fires after remove, the callback dereferences the SSIF context and the i2c client after teardown has started. Cancel the timer in remove so the callback cannot run after the device is unregistered. Signed-off-by: Jian Zhang Message-ID: <20260403090603.3988423-1-zhangjian.3032@bytedance.com> Signed-off-by: Corey Minyard commit f9e437cddf6cf9e603bdaefe148c1f4792aaf39c Author: Denis Rastyogin Date: Fri Mar 27 13:33:11 2026 +0300 ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] component_dais[RSND_MAX_COMPONENT] is initially zero-initialized and later populated in rsnd_dai_of_node(). However, the existing boundary check: if (i >= RSND_MAX_COMPONENT) does not guarantee that the last valid element remains zero. As a result, the loop can rely on component_dais[RSND_MAX_COMPONENT] being zero, which may lead to an out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 547b02f74e4a ("ASoC: rsnd: enable multi Component support for Audio Graph Card/Card2") Signed-off-by: Denis Rastyogin Acked-by: Kuninori Morimoto Link: https://patch.msgid.link/20260327103311.459239-1-gerben@altlinux.org Signed-off-by: Mark Brown commit 0178e64123129f56fc153b9d53121318fd71bdfc Author: Vijendar Mukunda Date: Fri Apr 3 12:04:25 2026 +0530 ASoC: amd: acp-sdw-legacy: remove unnecessary condition check Currently there is no mechanism to read dmic_num in mach_params structure. In this scenario mach_params->dmic_num check always returns 0. Remove unnecessary condition check for mach_params->dmic_num. Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20260403063452.159800-1-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 9805ed3c91478b08a586861b874bd8b6a2fed648 Author: Kan Liang Date: Fri Mar 27 13:28:44 2026 +0800 perf/x86/msr: Make SMI and PPERF on by default The MSRs, SMI_COUNT and PPERF, are model-specific MSRs. A very long CPU ID list is maintained to indicate the supported platforms. With more and more platforms being introduced, new CPU IDs have to be kept adding. Also, the old kernel has to be updated to apply the new CPU ID. The MSRs have been introduced for a long time. There is no plan to change them in the near future. Furthermore, the current code utilizes rdmsr_safe() to check the availability of MSRs before using it. Make them on by default. It should be good enough to only rely on the rdmsr_safe() to check their availability for both existing and future platforms. Signed-off-by: Kan Liang Co-developed-by: Dapeng Mi Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260327052844.818218-1-dapeng1.mi@linux.intel.com commit 059258b0d424510202b6f2796279dbdbf0c6a83d Author: Vincent Guittot Date: Tue Mar 31 18:23:52 2026 +0200 sched/fair: Prevent negative lag increase during delayed dequeue Delayed dequeue feature aims to reduce the negative lag of a dequeued task while sleeping but it can happens that newly enqueued tasks will move backward the avg vruntime and increase its negative lag. When the delayed dequeued task wakes up, it has more neg lag compared to being dequeued immediately or to other tasks that have been dequeued just before theses new enqueues. Ensure that the negative lag of a delayed dequeued task doesn't increase during its delayed dequeued phase while waiting for its neg lag to diseappear. Similarly, we remove any positive lag that the delayed dequeued task could have gain during thsi period. Short slice tasks are particularly impacted in overloaded system. Test on snapdragon rb5: hackbench -T -p -l 16000000 -g 2 1> /dev/null & cyclictest -t 1 -i 2777 -D 333 --policy=fair --mlock -h 20000 -q The scheduling latency of cyclictest is: tip/sched/core tip/sched/core +this patch cyclictest slice (ms) (default)2.8 8 8 hackbench slice (ms) (default)2.8 20 20 Total Samples | 115632 119733 119806 Average (us) | 364 64(-82%) 61(- 5%) Median (P50) (us) | 60 56(- 7%) 56( 0%) 90th Percentile (us) | 1166 62(-95%) 62( 0%) 99th Percentile (us) | 4192 73(-98%) 72(- 1%) 99.9th Percentile (us) | 8528 2707(-68%) 1300(-52%) Maximum (us) | 17735 14273(-20%) 13525(- 5%) Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260331162352.551501-1-vincent.guittot@linaro.org commit 2d4cc371baa5881da45120a65d264a59b486f486 Author: Vincent Guittot Date: Fri Mar 27 14:20:13 2026 +0100 sched/fair: Use sched_energy_enabled() Use helper sched_energy_enabled() everywhere we want to test if EAS is enabled instead of mixing sched_energy_enabled() and direct call to static_branch_unlikely(). No functional change Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260327132013.2800517-1-vincent.guittot@linaro.org commit b049b81bdff6fc6794200a4c7d7d910e2008d57f Author: John Stultz Date: Tue Mar 24 19:13:25 2026 +0000 sched: Handle blocked-waiter migration (and return migration) Add logic to handle migrating a blocked waiter to a remote cpu where the lock owner is runnable. Additionally, as the blocked task may not be able to run on the remote cpu, add logic to handle return migration once the waiting task is given the mutex. Because tasks may get migrated to where they cannot run, also modify the scheduling classes to avoid sched class migrations on mutex blocked tasks, leaving find_proxy_task() and related logic to do the migrations and return migrations. This was split out from the larger proxy patch, and significantly reworked. Credits for the original patch go to: Peter Zijlstra (Intel) Juri Lelli Valentin Schneider Connor O'Brien Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260324191337.1841376-11-jstultz@google.com commit dec9554dc036183c715d02e9cfe48986d453427a Author: John Stultz Date: Tue Mar 24 19:13:24 2026 +0000 sched: Move attach_one_task and attach_task helpers to sched.h The fair scheduler locally introduced attach_one_task() and attach_task() helpers, but these could be generically useful so move this code to sched.h so we can use them elsewhere. One minor tweak made to utilize guard(rq_lock)(rq) to simplifiy the function. Suggested-by: K Prateek Nayak Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Link: https://patch.msgid.link/20260324191337.1841376-10-jstultz@google.com commit 48fda62de67a1e88fc8bada12caf0fc9b45116df Author: John Stultz Date: Tue Mar 24 19:13:23 2026 +0000 sched: Add logic to zap balance callbacks if we pick again With proxy-exec, a task is selected to run via pick_next_task(), and then if it is a mutex blocked task, we call find_proxy_task() to find a runnable owner. If the runnable owner is on another cpu, we will need to migrate the selected donor task away, after which we will pick_again can call pick_next_task() to choose something else. However, in the first call to pick_next_task(), we may have had a balance_callback setup by the class scheduler. After we pick again, its possible pick_next_task_fair() will be called which calls sched_balance_newidle() and sched_balance_rq(). This will throw a warning: [ 8.796467] rq->balance_callback && rq->balance_callback != &balance_push_callback [ 8.796467] WARNING: CPU: 32 PID: 458 at kernel/sched/sched.h:1750 sched_balance_rq+0xe92/0x1250 ... [ 8.796467] Call Trace: [ 8.796467] [ 8.796467] ? __warn.cold+0xb2/0x14e [ 8.796467] ? sched_balance_rq+0xe92/0x1250 [ 8.796467] ? report_bug+0x107/0x1a0 [ 8.796467] ? handle_bug+0x54/0x90 [ 8.796467] ? exc_invalid_op+0x17/0x70 [ 8.796467] ? asm_exc_invalid_op+0x1a/0x20 [ 8.796467] ? sched_balance_rq+0xe92/0x1250 [ 8.796467] sched_balance_newidle+0x295/0x820 [ 8.796467] pick_next_task_fair+0x51/0x3f0 [ 8.796467] __schedule+0x23a/0x14b0 [ 8.796467] ? lock_release+0x16d/0x2e0 [ 8.796467] schedule+0x3d/0x150 [ 8.796467] worker_thread+0xb5/0x350 [ 8.796467] ? __pfx_worker_thread+0x10/0x10 [ 8.796467] kthread+0xee/0x120 [ 8.796467] ? __pfx_kthread+0x10/0x10 [ 8.796467] ret_from_fork+0x31/0x50 [ 8.796467] ? __pfx_kthread+0x10/0x10 [ 8.796467] ret_from_fork_asm+0x1a/0x30 [ 8.796467] This is because if a RT task was originally picked, it will setup the rq->balance_callback with push_rt_tasks() via set_next_task_rt(). Once the task is migrated away and we pick again, we haven't processed any balance callbacks, so rq->balance_callback is not in the same state as it was the first time pick_next_task was called. To handle this, add a zap_balance_callbacks() helper function which cleans up the balance callbacks without running them. This should be ok, as we are effectively undoing the state set in the first call to pick_next_task(), and when we pick again, the new callback can be configured for the donor task actually selected. Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Link: https://patch.msgid.link/20260324191337.1841376-9-jstultz@google.com commit f9530b3183358bbf945f7c20d4a6e2048061ec50 Author: John Stultz Date: Tue Mar 24 19:13:22 2026 +0000 sched: Add assert_balance_callbacks_empty helper With proxy-exec utilizing pick-again logic, we can end up having balance callbacks set by the preivous pick_next_task() call left on the list. So pull the warning out into a helper function, and make sure we check it when we pick again. Suggested-by: Peter Zijlstra Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Link: https://patch.msgid.link/20260324191337.1841376-8-jstultz@google.com commit 2d7622669836dcbbb449741b4e6c503ffe005c25 Author: John Stultz Date: Tue Mar 24 19:13:21 2026 +0000 sched/locking: Add special p->blocked_on==PROXY_WAKING value for proxy return-migration As we add functionality to proxy execution, we may migrate a donor task to a runqueue where it can't run due to cpu affinity. Thus, we must be careful to ensure we return-migrate the task back to a cpu in its cpumask when it becomes unblocked. Peter helpfully provided the following example with pictures: "Suppose we have a ww_mutex cycle: ,-+-* Mutex-1 <-. Task-A ---' | | ,-- Task-B `-> Mutex-2 *-+-' Where Task-A holds Mutex-1 and tries to acquire Mutex-2, and where Task-B holds Mutex-2 and tries to acquire Mutex-1. Then the blocked_on->owner chain will go in circles. Task-A -> Mutex-2 ^ | | v Mutex-1 <- Task-B We need two things: - find_proxy_task() to stop iterating the circle; - the woken task to 'unblock' and run, such that it can back-off and re-try the transaction. Now, the current code [without this patch] does: __clear_task_blocked_on(); wake_q_add(); And surely clearing ->blocked_on is sufficient to break the cycle. Suppose it is Task-B that is made to back-off, then we have: Task-A -> Mutex-2 -> Task-B (no further blocked_on) and it would attempt to run Task-B. Or worse, it could directly pick Task-B and run it, without ever getting into find_proxy_task(). Now, here is a problem because Task-B might not be runnable on the CPU it is currently on; and because !task_is_blocked() we don't get into the proxy paths, so nobody is going to fix this up. Ideally we would have dequeued Task-B alongside of clearing ->blocked_on, but alas, [the lock ordering prevents us from getting the task_rq_lock() and] spoils things." Thus we need more than just a binary concept of the task being blocked on a mutex or not. So allow setting blocked_on to PROXY_WAKING as a special value which specifies the task is no longer blocked, but needs to be evaluated for return migration *before* it can be run. This will then be used in a later patch to handle proxy return-migration. Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Link: https://patch.msgid.link/20260324191337.1841376-7-jstultz@google.com commit 56f4b24267a643b0b9ab73f09feaaabfee5a37ae Author: John Stultz Date: Tue Mar 24 19:13:20 2026 +0000 sched: Fix modifying donor->blocked on without proper locking Introduce an action enum in find_proxy_task() which allows us to handle work needed to be done outside the mutex.wait_lock and task.blocked_lock guard scopes. This ensures proper locking when we clear the donor's blocked_on pointer in proxy_deactivate(), and the switch statement will be useful as we add more cases to handle later in this series. Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Link: https://patch.msgid.link/20260324191337.1841376-6-jstultz@google.com commit fa4a1ff8ab235a308d8c983827657a69649185fd Author: John Stultz Date: Tue Mar 24 19:13:19 2026 +0000 locking: Add task::blocked_lock to serialize blocked_on state So far, we have been able to utilize the mutex::wait_lock for serializing the blocked_on state, but when we move to proxying across runqueues, we will need to add more state and a way to serialize changes to this state in contexts where we don't hold the mutex::wait_lock. So introduce the task::blocked_lock, which nests under the mutex::wait_lock in the locking order, and rework the locking to use it. Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Link: https://patch.msgid.link/20260324191337.1841376-5-jstultz@google.com commit f4fe6be82e6d27349de66a42d6d1b2b11dc97a14 Author: John Stultz Date: Tue Mar 24 19:13:18 2026 +0000 sched: Fix potentially missing balancing with Proxy Exec K Prateek pointed out that with Proxy Exec, we may have cases where we context switch in __schedule(), while the donor remains the same. This could cause balancing issues, since the put_prev_set_next() logic short-cuts if (prev == next). With proxy-exec prev is the previous donor, and next is the next donor. Should the donor remain the same, but different tasks are picked to actually run, the shortcut will have avoided enqueuing the sched class balance callback. So, if we are context switching, add logic to catch the same-donor case, and trigger the put_prev/set_next calls to ensure the balance callbacks get enqueued. Closes: https://lore.kernel.org/lkml/20ea3670-c30a-433b-a07f-c4ff98ae2379@amd.com/ Reported-by: K Prateek Nayak Suggested-by: Peter Zijlstra Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260324191337.1841376-4-jstultz@google.com commit 37341ec573da7c16fdd45222b1bfb7b421dbdbcb Author: John Stultz Date: Tue Mar 24 19:13:17 2026 +0000 sched: Minimise repeated sched_proxy_exec() checking Peter noted: Compilers are really bad (as in they utterly refuse) optimizing (even when marked with __pure) the static branch things, and will happily emit multiple identical in a row. So pull out the one obvious sched_proxy_exec() branch in __schedule() and remove some of the 'implicit' ones in that path. Suggested-by: Peter Zijlstra Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Link: https://patch.msgid.link/20260324191337.1841376-3-jstultz@google.com commit e0ca8991b2de6c9dfe6fcd8a0364951b2bd56797 Author: John Stultz Date: Tue Mar 24 19:13:16 2026 +0000 sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() With proxy-execution, the scheduler selects the donor, but for blocked donors, we end up running the lock owner. This caused some complexity, because the class schedulers make sure to remove the task they pick from their pushable task lists, which prevents the donor from being migrated, but there wasn't then anything to prevent rq->curr from being migrated if rq->curr != rq->donor. This was sort of hacked around by calling proxy_tag_curr() on the rq->curr task if we were running something other then the donor. proxy_tag_curr() did a dequeue/enqueue pair on the rq->curr task, allowing the class schedulers to remove it from their pushable list. The dequeue/enqueue pair was wasteful, and additonally K Prateek highlighted that we didn't properly undo things when we stopped proxying, leaving the lock owner off the pushable list. After some alternative approaches were considered, Peter suggested just having the RT/DL classes just avoid migrating when task_on_cpu(). So rework pick_next_pushable_dl_task() and the rt pick_next_pushable_task() functions so that they skip over the first pushable task if it is on_cpu. Then just drop all of the proxy_tag_curr() logic. Fixes: be39617e38e0 ("sched: Fix proxy/current (push,pull)ability") Closes: https://lore.kernel.org/lkml/e735cae0-2cc9-4bae-b761-fcb082ed3e94@amd.com/ Reported-by: K Prateek Nayak Suggested-by: Peter Zijlstra Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260324191337.1841376-2-jstultz@google.com commit b4464d8f313f903ba72db06042f3958a9a1e464a Author: Arnd Bergmann Date: Wed Apr 1 21:10:13 2026 +0200 power: sequencing: pcie-m2: add SERIAL_DEV_BUS dependency The newly added serdev code fails to link when serdev is turned off: arm-linux-gnueabi-ld: drivers/power/sequencing/pwrseq-pcie-m2.o: in function `pwrseq_pcie_m2_remove_serdev': pwrseq-pcie-m2.c:(.text+0xc8): undefined reference to `serdev_device_remove' arm-linux-gnueabi-ld: drivers/power/sequencing/pwrseq-pcie-m2.o: in function `pwrseq_m2_pcie_notify': pwrseq-pcie-m2.c:(.text+0x69c): undefined reference to `of_find_serdev_controller_by_node' arm-linux-gnueabi-ld: pwrseq-pcie-m2.c:(.text+0x6f8): undefined reference to `serdev_device_alloc' arm-linux-gnueabi-ld: pwrseq-pcie-m2.c:(.text+0x724): undefined reference to `serdev_device_add' Add another Kconfig dependency for this Fixes: 3f736aecbdc8 ("power: sequencing: pcie-m2: Create serdev device for WCN7850 bluetooth") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260401191030.948046-1-arnd@kernel.org Signed-off-by: Bartosz Golaszewski commit 19b8c8fc83f755cd52a2aa3dbdb091234592252e Author: Arnd Bergmann Date: Wed Apr 1 11:16:25 2026 +0200 power: sequencing: pcie-m2: enforce PCI and OF dependencies The driver fails to build when PCI is disabled: drivers/power/sequencing/pwrseq-pcie-m2.c: In function 'pwrseq_pcie_m2_register_notifier': drivers/power/sequencing/pwrseq-pcie-m2.c:368:54: error: 'pci_bus_type' undeclared (first use in this function); did you mean 'pci_pcie_type'? 368 | ret = bus_register_notifier(&pci_bus_type, &ctx->nb); | ^~~~~~~~~~~~ | pci_pcie_type Similarly, when CONFIG_OF is disabled: drivers/power/sequencing/pwrseq-pcie-m2.c: In function 'pwrseq_m2_pcie_create_bt_node': drivers/power/sequencing/pwrseq-pcie-m2.c:191:9: error: implicit declaration of function 'of_changeset_init' [-Wimplicit-function-declaration] 191 | of_changeset_init(ctx->ocs); | ^~~~~~~~~~~~~~~~~ Make both dependencies unconditional to prevent compile-testing in either configuration. Fixes: 3f736aecbdc8 ("power: sequencing: pcie-m2: Create serdev device for WCN7850 bluetooth") Signed-off-by: Arnd Bergmann Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/20260401091847.305294-1-arnd@kernel.org Signed-off-by: Bartosz Golaszewski commit e2494f83f9d717a7f607cfaefb4e69e55b8e024d Author: Anup Patel Date: Tue Jan 20 13:29:55 2026 +0530 RISC-V: KVM: Don't check hstateen0 when updating sstateen0 CSR The hstateen0 will be programmed differently for guest HS-mode and guest VS/VU-mode so don't check hstateen0.SSTATEEN0 bit when updating sstateen0 CSR in kvm_riscv_vcpu_swap_in_guest_state() and kvm_riscv_vcpu_swap_in_host_state(). Signed-off-by: Anup Patel Reviewed-by: Radim Krčmář Link: https://lore.kernel.org/r/20260120080013.2153519-10-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel commit 6ed523e2b6129d7dd4aab801a610930d85b2d3f8 Author: Anup Patel Date: Tue Jan 20 13:29:54 2026 +0530 RISC-V: KVM: Factor-out VCPU config into separate sources The VCPU config deals with hideleg, hedeleg, henvcfg, and hstateenX CSR configuration for each VCPU. Factor-out VCPU config into separate sources so that VCPU config can do things differently for guest HS-mode and guest VS/VU-mode. Signed-off-by: Anup Patel Reviewed-by: Radim Krčmář Link: https://lore.kernel.org/r/20260120080013.2153519-9-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel commit d733fb463834cf97a0c667681e236fea0e833a05 Author: Maciej Strozek Date: Fri Apr 3 09:23:35 2026 +0100 ASoC: intel: sof_sdw: Prepare for configuration without a jack In certain setups of cs42l43 UAJ function may be removed from ACPI and physically unconnected. Prepare a driver for that configuration by setting a system clock in the speaker path too. Signed-off-by: Maciej Strozek Link: https://patch.msgid.link/20260403082335.40798-1-mstrozek@opensource.cirrus.com Signed-off-by: Mark Brown commit 1df7a7652f032cf1abe1c102a031c2128e24c31d Author: Greg Kroah-Hartman Date: Fri Apr 3 14:06:20 2026 +0200 Revert "dt-bindings: usb: cdns,usb3: document USBSSP controller support" This reverts commit fb14e7f7cbb4abbcde5576282d91352deaff2887. There were some build issues as reported by Arnd, so revert this for now. Cc: Peter Chen Cc: Pawel Laszczak Reported-by: Arnd Bergmann Link: https://lore.kernel.org/r/ac+LEWMCQpLSnfoD@nchen-desktop Signed-off-by: Greg Kroah-Hartman commit 0ee5501441cc7536271073063f13390164148e25 Author: Anup Patel Date: Tue Jan 20 13:29:53 2026 +0530 RISC-V: KVM: Add hideleg to struct kvm_vcpu_config The hideleg CSR state when VCPU is running in guest VS/VU-mode will be different from when it is running in guest HS-mode. To achieve this, add hideleg to struct kvm_vcpu_config and re-program hideleg CSR upon every kvm_arch_vcpu_load(). Signed-off-by: Anup Patel Reviewed-by: Radim Krčmář Link: https://lore.kernel.org/r/20260120080013.2153519-8-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel commit b1834e5afbcd463c83f99dc12e1863803d5a1803 Author: Anup Patel Date: Tue Jan 20 13:29:52 2026 +0530 RISC-V: KVM: Move timer state defines closer to struct in UAPI header The KVM_RISCV_TIMER_STATE_xyz defines specify possible values of the "state" member in struct kvm_riscv_timer so move these defines closer to struct kvm_riscv_timer in uapi/asm/kvm.h. Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20260120080013.2153519-7-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel commit 29fea9f4ece6d071a906187d768a87ac41e6e041 Author: Greg Kroah-Hartman Date: Fri Apr 3 14:05:13 2026 +0200 Revert "usb: cdns3: Add USBSSP platform driver support" This reverts commit 6076388ca1eda808b95f9479f3b04839d348a2f7. There were some build issues as reported by Arnd, so revert this for now. Cc: Peter Chen Cc: Pawel Laszczak Reported-by: Arnd Bergmann Link: https://lore.kernel.org/r/ac+LEWMCQpLSnfoD@nchen-desktop Signed-off-by: Greg Kroah-Hartman commit e0b5cfc316f1d36e22b0745d20360b4719b89209 Author: Anup Patel Date: Tue Jan 20 13:29:51 2026 +0530 RISC-V: KVM: Factor-out ISA checks into separate sources The KVM ISA extension related checks are not VCPU specific and should be factored out of vcpu_onereg.c into separate sources. Signed-off-by: Anup Patel Reviewed-by: Radim Krčmář Link: https://lore.kernel.org/r/20260120080013.2153519-6-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel commit 49eac82653e13243cec5f8c25e35161b922a9c80 Author: Greg Kroah-Hartman Date: Fri Apr 3 14:03:37 2026 +0200 Revert "usb: cdnsp: Add support for device-only configuration" This reverts commit 7b7f2dd913829e06705035dfc41ca25fa6ec68d3. There was some problems with an earlier cdns3 change, so this one needs to be backed out as well. Cc: Pawel Laszczak Cc: Bjorn Helgaas Reported-by: Peter Chen Link: https://lore.kernel.org/r/ac+LEWMCQpLSnfoD@nchen-desktop Signed-off-by: Greg Kroah-Hartman commit 68c6d134edbf085ce63038b630c63f056279225a Merge: 94e731cbe84533 ac12b852b4ead4 Author: Greg Kroah-Hartman Date: Fri Apr 3 13:56:03 2026 +0200 Merge tag 'mhi-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next Manivannan writes: MHI Host -------- - Add support for Qualcomm SDX35 and Telit FE912C04 modems reusing the existing channel and event configurations. - Enable IP_SW and IP_ETH MHI channels for Qualcomm 5G DU X100 Accelerator device (QDU100). These channels are used to carry O-RAN specific M-Plane, S-Plane and Netconf packets. The drivers making use of these channels is being reviewed. - Add NMEA channels to Telit FN920C04 and FN990A modems for GPS/GNSS support - Switch to mhi_async_power_up() API in pci_generic driver to avoid boot delays as some Qcom modems take a while start. This API ensures that the pci_generic driver powers up the modem asynchronously and doesn't block the system boot. - Add pm_runtime_forbid() in remove callback to balance the pm_runtime_allow() call made during the Mission Mode transition. - Used kzalloc_flex() to simplify kzalloc() + kzalloc() calls MHI Endpoint ------------ - Test for non-zero return value 'if (ret)' in the endpoint stack where applicable to maintain code uniformity. * tag 'mhi-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi: bus: mhi: host: pci_generic: Add Telit FE912C04 modem support bus: mhi: ep: Test for non-zero return value where applicable bus: mhi: host: Use kzalloc_flex bus: mhi: host: pci_generic: Add pm_runtime_forbid() in remove callback bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays bus: mhi: host: pci_generic: Add NMEA channels to FN920C04 and FN990A bus: mhi: host: pci_generic: Enable IP_SW and IP_ETH channels for Qcom QDU100 device bus: mhi: host: pci_generic: Add Qualcomm SDX35 modem commit cf05b059d59fff0207d93d7d21b34dad9b460b20 Author: Anup Patel Date: Tue Jan 20 13:29:50 2026 +0530 RISC-V: KVM: Introduce common kvm_riscv_isa_check_host() Rename kvm_riscv_vcpu_isa_check_host() to kvm_riscv_isa_check_host() and use it as common function with KVM RISC-V to check isa extensions supported by host. Signed-off-by: Anup Patel Reviewed-by: Radim Krčmář Link: https://lore.kernel.org/r/20260120080013.2153519-5-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel commit 20a8e451ec1c7e99060b1bbaaad03ce88c39ddb8 Author: Mingzhe Zou Date: Fri Apr 3 12:21:35 2026 +0800 bcache: fix uninitialized closure object In the previous patch ("bcache: fix cached_dev.sb_bio use-after-free and crash"), we adopted a simple modification suggestion from AI to fix the use-after-free. But in actual testing, we found an extreme case where the device is stopped before calling bch_write_bdev_super(). At this point, struct closure sb_write has not been initialized yet. For this patch, we ensure that sb_bio has been completed via sb_write_mutex. Signed-off-by: Mingzhe Zou Signed-off-by: Coly Li Link: https://patch.msgid.link/20260403042135.2221247-1-colyli@fnnas.com Fixes: fec114a98b87 ("bcache: fix cached_dev.sb_bio use-after-free and crash") Signed-off-by: Jens Axboe commit fec114a98b8735ee89c75216c45a78e28be0f128 Author: Mingzhe Zou Date: Sun Mar 22 21:41:02 2026 +0800 bcache: fix cached_dev.sb_bio use-after-free and crash In our production environment, we have received multiple crash reports regarding libceph, which have caught our attention: ``` [6888366.280350] Call Trace: [6888366.280452] blk_update_request+0x14e/0x370 [6888366.280561] blk_mq_end_request+0x1a/0x130 [6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd] [6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd] [6888366.280903] __complete_request+0x22/0x70 [libceph] [6888366.281032] osd_dispatch+0x15e/0xb40 [libceph] [6888366.281164] ? inet_recvmsg+0x5b/0xd0 [6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph] [6888366.281405] ceph_con_process_message+0x79/0x140 [libceph] [6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph] [6888366.281661] ceph_con_workfn+0x329/0x680 [libceph] ``` After analyzing the coredump file, we found that the address of dc->sb_bio has been freed. We know that cached_dev is only freed when it is stopped. Since sb_bio is a part of struct cached_dev, rather than an alloc every time. If the device is stopped while writing to the superblock, the released address will be accessed at endio. This patch hopes to wait for sb_write to complete in cached_dev_free. It should be noted that we analyzed the cause of the problem, then tell all details to the QWEN and adopted the modifications it made. Signed-off-by: Mingzhe Zou Fixes: cafe563591446 ("bcache: A block layer cache") Cc: stable@vger.kernel.org # 3.10+ Signed-off-by: Coly Li Link: https://patch.msgid.link/20260322134102.480107-1-colyli@fnnas.com Signed-off-by: Jens Axboe commit a175ee8273319547a4be7584da03831a2fb2f835 Author: Thorsten Blum Date: Thu Apr 2 18:50:00 2026 +0200 block: use sysfs_emit in sysfs show functions Replace sprintf() with sysfs_emit() in sysfs show functions. sysfs_emit() is preferred for formatting sysfs output because it provides safer bounds checking. Signed-off-by: Thorsten Blum Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260402164958.894879-4-thorsten.blum@linux.dev Signed-off-by: Jens Axboe commit 10eea3c147141c90cf409b8df56d245c9d7f88d9 Author: Miguel Ojeda Date: Tue Mar 31 22:58:48 2026 +0200 kbuild: rust: allow `clippy::uninlined_format_args` Clippy in Rust 1.88.0 (only) reports [1]: warning: variables can be used directly in the `format!` string --> rust/macros/module.rs:112:23 | 112 | let content = format!("{param}:{content}", param = param, content = content); | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#uninlined_format_args = note: `-W clippy::uninlined-format-args` implied by `-W clippy::all` = help: to override `-W clippy::all` add `#[allow(clippy::uninlined_format_args)]` help: change this to | 112 - let content = format!("{param}:{content}", param = param, content = content); 112 + let content = format!("{param}:{content}"); warning: variables can be used directly in the `format!` string --> rust/macros/module.rs:198:14 | 198 | t => panic!("Unsupported parameter type {}", t), | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#uninlined_format_args = note: `-W clippy::uninlined-format-args` implied by `-W clippy::all` = help: to override `-W clippy::all` add `#[allow(clippy::uninlined_format_args)]` help: change this to | 198 - t => panic!("Unsupported parameter type {}", t), 198 + t => panic!("Unsupported parameter type {t}"), | The reason it only triggers in that version is that the lint was moved from `pedantic` to `style` in Rust 1.88.0 and then back to `pedantic` in Rust 1.89.0 [2][3]. In the first case, the suggestion is fair and a pure simplification, thus we will clean it up separately. To keep the behavior the same across all versions, and since the lint does not work for all macros (e.g. custom ones like `pr_info!`), disable it globally. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Link: https://lore.kernel.org/rust-for-linux/CANiq72=drAtf3y_DZ-2o4jb6Az9J3Yj4QYwWnbRui4sm4AJD3Q@mail.gmail.com/ [1] Link: https://github.com/rust-lang/rust-clippy/pull/15287 [2] Link: https://github.com/rust-lang/rust-clippy/issues/15151 [3] Link: https://patch.msgid.link/20260331205849.498295-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit b80dc74cd6b8f50b4c5cf5923a9726995d787bd8 Author: Alice Ryhl Date: Thu Apr 2 10:55:34 2026 +0000 rust_binder: override crate name to rust_binder The Rust Binder object file is called rust_binder_main.o because the name rust_binder.o is used for the result of linking together rust_binder_main.o with rust_binderfs.o and a few others. However, the crate name is supposed to be rust_binder without a _main suffix. Thus, override the crate name accordingly. Signed-off-by: Alice Ryhl Acked-by: Gary Guo Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260402-binder-crate-name-v4-2-ec3919b87909@google.com Signed-off-by: Miguel Ojeda commit 7e9535ebd05d7e8de155164b7c97a370d4646e06 Author: Alice Ryhl Date: Thu Apr 2 10:55:33 2026 +0000 rust: support overriding crate_name Currently you cannot filter out the crate-name argument RUSTFLAGS_REMOVE_stem.o because the Rust filter-out invocation does not include that particular argument. Since --crate-name is an argument that can't be passed multiple times, this means that it's currently not possible to override the crate name. Thus, remove the --crate-name argument for drivers. This allows them to override the crate name using the #![crate_name] annotation. This affects symbol names, but has no effect on the filenames of object files and other things generated by the build, as we always use --emit with a fixed output filename. The --crate-name argument is kept for the crates under rust/ for simplicity and to avoid changing many of them by adding #![crate_name]. The rust analyzer script is updated to use rustc to obtain the crate name of the driver crates, which picks up the right name whether it is configured via #![crate_name] or not. For readability, the logic to invoke 'rustc' is extracted to its own function. Note that the crate name in the python script is not actually that important - the only place where the name actually affects anything is in the 'deps' array which specifies an index and name for each dependency, and determines what that dependency is called in *this* crate. (The same crate may be called different things in each dependency.) Since driver crates are leaf crates, this doesn't apply and the rustc invocation only affects the 'display_name' parameter. Acked-by: Gary Guo Signed-off-by: Alice Ryhl Reviewed-by: Jesung Yang Acked-by: Tamir Duberstein Link: https://patch.msgid.link/20260402-binder-crate-name-v4-1-ec3919b87909@google.com [ Applied Python type hints. - Miguel ] Signed-off-by: Miguel Ojeda commit 96f4e74cab632ea5c7e7fa996a28337283ecca11 Author: Alice Ryhl Date: Mon Feb 23 10:08:27 2026 +0000 pwm: th1520: remove impl Send/Sync for Th1520PwmDriverData Now that clk implements Send and Sync, we no longer need to manually implement these traits for Th1520PwmDriverData. Thus remove the implementations. Reviewed-by: Gary Guo Reviewed-by: Daniel Almeida Acked-by: Uwe Kleine-König Reviewed-by: Michal Wilczynski Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260223-clk-send-sync-v5-3-181bf2f35652@google.com Signed-off-by: Miguel Ojeda commit ef90b103e8f767ffc31b1ddfef012358ea873d85 Author: Alice Ryhl Date: Mon Feb 23 10:08:26 2026 +0000 tyr: remove impl Send/Sync for TyrData Now that clk implements Send and Sync, we no longer need to manually implement these traits for TyrData. Thus remove the implementations. The comment also mentions the regulator. However, the regulator had the traits added in commit 9a200cbdb543 ("rust: regulator: implement Send and Sync for Regulator"), which is already in mainline. Reviewed-by: Danilo Krummrich Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Reviewed-by: Daniel Almeida Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260223-clk-send-sync-v5-2-181bf2f35652@google.com Signed-off-by: Miguel Ojeda commit 0c0695a9d8c97f63d71dc890faa6999eef728f57 Author: Alice Ryhl Date: Mon Feb 23 10:08:25 2026 +0000 rust: clk: implement Send and Sync These traits are required for drivers to embed the Clk type in their own data structures because driver data structures are usually required to be Send. Since the Clk type is thread-safe, implement the relevant traits. Reviewed-by: Daniel Almeida Reviewed-by: Danilo Krummrich Acked-by: Viresh Kumar Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Acked-by: Brian Masney # Active contributor to clk Link: https://patch.msgid.link/20260223-clk-send-sync-v5-1-181bf2f35652@google.com Signed-off-by: Miguel Ojeda commit 0a51b384e0decfe9dfe65d721a5e9cd39cabc152 Author: John Hubbard Date: Wed Mar 25 18:38:47 2026 -0700 rust: ptr: add const_align_up() Add const_align_up() to kernel::ptr as the const-compatible equivalent of Alignable::align_up(). Suggested-by: Danilo Krummrich Suggested-by: Gary Guo Suggested-by: Miguel Ojeda Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Signed-off-by: John Hubbard Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260326013902.588242-17-jhubbard@nvidia.com [ Adjusted imports style. - Miguel ] Signed-off-by: Miguel Ojeda commit 7ccef29b5d93d6e235dc8ace27cfbbfbbede9908 Author: Mirko Adzic Date: Sun Mar 29 12:41:10 2026 +0200 rust: error: clarify that `from_err_ptr` can return `Ok(NULL)` Improve the doc comment of `from_err_ptr` by explicitly stating that it will return `Ok(NULL)` when passed a null pointer, as it isn't an error value. Add a doctest case that tests the behavior described above, as well as other scenarios (non-null/non-error pointer, error value). Suggested-by: Miguel Ojeda Link: https://lore.kernel.org/rust-for-linux/20260322193830.89324-1-ojeda@kernel.org/ Link: https://github.com/Rust-for-Linux/linux/issues/1231 Signed-off-by: Mirko Adzic Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260329104319.131057-1-adzicmirko97@gmail.com [ - Added `expect` for `clippy::missing_safety_doc`. - Simplified and removed unsafe block using `Error::to_ptr()`. - Added intra-doc link. - Miguel ] Signed-off-by: Miguel Ojeda commit 779ae2232cd1fd80661327e503606df004b4cda4 Author: Jon Hunter Date: Wed Apr 1 14:34:41 2026 +0100 gpiolib: Make deferral warnings debug messages With the recent addition of the shared GPIO support, warning messages such as the following are being observed ... reg-fixed-voltage regulator-vdd-3v3-pcie: cannot find GPIO chip gpiolib_shared.proxy.6, deferring These are seen even with GPIO_SHARED_PROXY=y. Given that the GPIOs are successfully found a bit later during boot and the code is intentionally returning -EPROBE_DEFER when they are not found, downgrade these messages to debug prints to avoid unnecessary warnings being observed. Note that although the 'cannot find GPIO line' warning has not been observed in this case, it seems reasonable to make this print a debug print for consistency too. Signed-off-by: Jon Hunter Link: https://patch.msgid.link/20260401133441.47641-1-jonathanh@nvidia.com Signed-off-by: Bartosz Golaszewski commit 512f9f150f367176fa9e5f4613b4863409a6f686 Merge: cdd65e8bb9540b a972d1b864e8ef Author: Dave Airlie Date: Fri Apr 3 18:56:58 2026 +1000 Merge tag 'drm-msm-next-2026-04-02' of https://gitlab.freedesktop.org/drm/msm into drm-next Changes for v7.1 CI: - Uprev mesa - Restore CI jobs for Qualcomm APQ8016 and APQ8096 devices Core: - Switched to of_get_available_child_by_name() DPU: - Fixes for DSC panels - Fixed brownout because of the frequency / OPP mismatch - Quad pipe preparation (not enabled yet) - Switched to virtual planes by default - Dropped VBIF_NRT support - Added support for Eliza platform - Reworked alpha handling - Switched to correct CWB definitions on Eliza - Dropped dummy INTF_0 on MSM8953 - Corrected INTFs related to DP-MST DP: - Removed debug prints looking into PHY internals DSI: - Fixes for DSC panels - RGB101010 support - Support for SC8280XP - Moved PHY bindings from display/ to phy/ GPU: - Preemption support for x2-85 and a840 - IFPC support for a840 - SKU detection support for x2-85 and a840 - Expose AQE support (VK ray-pipeline) - Avoid locking in VM_BIND fence signaling path - Fix to avoid reclaim in GPU snapshot path - Disallow foreign mapping of _NO_SHARE BOs - Couple a6xx gpu snapshot fixes - Various other fixes HDMI: - Fixed infoframes programming MDP5: - Dropped support for MSM8974v1 - Dropped now unused code for MSM8974 v1 and SDM660 / MSM8998 Also misc small fixes Signed-off-by: Dave Airlie From: Rob Clark Link: https://patch.msgid.link/CACSVV012vn73BaUfk=Hw4WkQHZNPHiqfifWEunAqMc2EGOWUEQ@mail.gmail.com commit 94e731cbe84533a37701b4089b685d39e584fbea Author: Johan Hovold Date: Fri Apr 3 10:44:51 2026 +0200 w1: ds2490: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305111613.18546-1-johan@kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260403084450.6314-2-krzk@kernel.org Signed-off-by: Greg Kroah-Hartman commit a1ed2cbb79e67dc0e4b821b78b17fb4e82482ffa Merge: 0a18c3bc8d294f cbf8db23fc58db Author: Greg Kroah-Hartman Date: Fri Apr 3 10:52:52 2026 +0200 Merge tag 'counter-updates-for-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-next William writes: Counter updates for 7.1 A cleanup patch for sysfs to remove a superfluous return statement in counter_sysfs_attr_add() that was unintentionally left during an earlier refactor. * tag 'counter-updates-for-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: sysfs: remove double return in counter_sysfs_attr_add() commit 704b2a7d756d0886a1388456ab41415a45973588 Author: Bartosz Golaszewski Date: Fri Apr 3 10:09:17 2026 +0200 MAINTAINERS: add ksysfs.c to the DRIVER CORE entry kernel/ksysfs.c is part of the driver core infrastructure but is missing rom the relevant MAINTAINERS entry. Add it. Suggested-by: Danilo Krummrich Closes: https://lore.kernel.org/all/DHITFGL3J4IE.2WZU3K2CSYL7I@kernel.org/ Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260403080917.7484-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit e1f7a0e196e293c223a882788c6d1a884d06d6d8 Author: Abhishek Dubey Date: Wed Apr 1 11:21:33 2026 -0400 selftest/bpf: Enable gotox tests for powerpc64 With gotox instruction and jumptable now supported, enable corresponding bpf selftest on powerpc. Signed-off-by: Abhishek Dubey Tested-by: Venkat Rao Bagalkote Acked-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260401152133.42544-5-adubey@linux.ibm.com commit a32325c0e623d594992c4e4616fa685c0e765a33 Author: Abhishek Dubey Date: Wed Apr 1 11:21:32 2026 -0400 powerpc64/bpf: Add support for indirect jump Add support for a new instruction BPF_JMP|BPF_X|BPF_JA, SRC=0, DST=Rx, off=0, imm=0 which does an indirect jump to a location stored in Rx. The register Rx should have type PTR_TO_INSN. This new type ensures that the Rx register contains a value (or a range of values) loaded from a correct jump table – map of type instruction array. Support indirect jump to all registers in powerpc64 JIT using the ctr register. Move Rx content to ctr register, then invoke bctr instruction to branch to address stored in ctr register. Skip save and restore of TOC as the jump is always within the program context. Signed-off-by: Abhishek Dubey Acked-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260401152133.42544-4-adubey@linux.ibm.com commit 66cad93ad325b332868c062bbd0de65ca4e59657 Author: Abhishek Dubey Date: Wed Apr 1 11:21:31 2026 -0400 selftest/bpf: Enable instruction array test for powerpc With instruction array now supported, enable corresponding bpf selftest for powerpc. Signed-off-by: Abhishek Dubey Tested-by: Venkat Rao Bagalkote Acked-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260401152133.42544-3-adubey@linux.ibm.com commit 1e4bac7eb95a5a1aed5b39971ef77dca5b0f8a9f Author: Abhishek Dubey Date: Wed Apr 1 11:21:30 2026 -0400 powerpc/bpf: Add support for instruction array On loading the BPF program, the verifier might adjust/omit some instructions. The adjusted instruction offset is accounted in the map containing original instruction -> xlated mapping. This patch add ppc64 JIT support to additionally build the xlated->jitted mapping for every instruction present in instruction array. This change is needed to enable support for indirect jumps, added in a subsequent patch. Invoke bpf_prog_update_insn_ptrs() with offset pair of xlated_offset and jited_offset. The offset mapping is already available, which is being used for bpf_prog_fill_jited_linfo() and can be directly used for bpf_prog_update_insn_ptrs() as well. Additional details present at: commit b4ce5923e780 ("bpf, x86: add new map type: instructions array") Signed-off-by: Abhishek Dubey Acked-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260401152133.42544-2-adubey@linux.ibm.com commit 92258b5bf1ec10204c23a793793a65dc92d17014 Author: Abhishek Dubey Date: Wed Apr 1 10:10:43 2026 -0400 powerpc32/bpf: Add fsession support Extend JIT support of fsession in powerpc64 trampoline, since ppc64 and ppc32 shares common trampoline implementation. Arch specific helpers handle 64-bit data copy using 32 bit regs. Need to validate fsession support along with trampoline support. Signed-off-by: Abhishek Dubey Acked-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260401141043.41513-2-adubey@linux.ibm.com commit 6fab063bd8d64f15cde2d194c08a159ad3afdf27 Author: Abhishek Dubey Date: Wed Apr 1 10:10:42 2026 -0400 powerpc64/bpf: Implement fsession support Implement JIT support for fsession in powerpc64 trampoline. The trampoline stack now accommodate session cookies and function metadata in place of function argument. fentry/fexit programs consume corresponding function metadata. This mirrors existing x86 behavior and enable session cookies on powerpc64. # ./test_progs -t fsession #135/1 fsession_test/fsession_test:OK #135/2 fsession_test/fsession_reattach:OK #135/3 fsession_test/fsession_cookie:OK #135 fsession_test:OK Summary: 1/3 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Abhishek Dubey Tested-by: Venkat Rao Bagalkote Acked-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260401141043.41513-1-adubey@linux.ibm.com commit e640bcd1bf83dbdaa967b20cd98a782d52ec89cf Author: Abhishek Dubey Date: Wed Apr 1 06:32:15 2026 -0400 selftests/bpf: Enable private stack tests for powerpc64 With support of private stack, relevant tests must pass on powerpc64. #./test_progs -t struct_ops_private_stack #434/1 struct_ops_private_stack/private_stack:OK #434/2 struct_ops_private_stack/private_stack_fail:OK #434/3 struct_ops_private_stack/private_stack_recur:OK #434 struct_ops_private_stack:OK Summary: 1/3 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Abhishek Dubey Tested-by: Venkat Rao Bagalkote Reviewed-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260401103215.104438-2-adubey@linux.ibm.com commit 156d985123b6d6e5189cfd0286b93c12167ae798 Author: Abhishek Dubey Date: Wed Apr 1 06:32:14 2026 -0400 powerpc64/bpf: Implement JIT support for private stack Provision the private stack as a per-CPU allocation during bpf_int_jit_compile(). Align the stack to 16 bytes and place guard regions at both ends to detect runtime stack overflow and underflow. Round the private stack size up to the nearest 16-byte boundary. Make each guard region 16 bytes to preserve the required overall 16-byte alignment. When private stack is set, skip bpf stack size accounting in kernel stack. There is no stack pointer in powerpc. Stack referencing during JIT is done using frame pointer. Frame pointer calculation goes like: BPF frame pointer = Priv stack allocation start address + Overflow guard + Actual stack size defined by verifier Memory layout: High Addr +--------------------------------------------------+ | | | 16 bytes Underflow guard (0xEB9F12345678eb9fULL) | | | BPF FP -> +--------------------------------------------------+ | | | Private stack - determined by verifier | | 16-bytes aligned | | | +--------------------------------------------------+ | | Lower Addr | 16 byte Overflow guard (0xEB9F12345678eb9fULL) | | | Priv stack alloc ->+--------------------------------------------------+ start Update BPF_REG_FP to point to the calculated offset within the allocated private stack buffer. Now, BPF stack usage reference in the allocated private stack. Signed-off-by: Abhishek Dubey Tested-by: Venkat Rao Bagalkote Acked-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260401103215.104438-1-adubey@linux.ibm.com commit cb2a2a5b37adb34ec46d39346b1c71e255827116 Author: Boris Brezillon Date: Fri Mar 20 16:19:13 2026 +0100 drm/shmem_helper: Make sure PMD entries get the writeable upgrade Unlike PTEs which are automatically upgraded to writeable entries if .pfn_mkwrite() returns 0, the PMD upgrades go through .huge_fault(), and we currently pretend to have handled the make-writeable request even though we only ever map things read-only. Make sure we pass the proper "write" info to vmf_insert_pfn_pmd() in that case. This also means we have to record the mkwrite event in the .huge_fault() path now. Move the dirty tracking logic to a drm_gem_shmem_record_mkwrite() helper so it can also be called from drm_gem_shmem_pfn_mkwrite(). Note that this wasn't a problem before commit 28e3918179aa ("drm/gem-shmem: Track folio accessed/dirty status in mmap"), because the pgprot were not lowered to read-only before this commit (see the vma_wants_writenotify() in vma_set_page_prot()). Fixes: 28e3918179aa ("drm/gem-shmem: Track folio accessed/dirty status in mmap") Cc: Biju Das Cc: Thomas Zimmermann Cc: Tommaso Merciai Reviewed-by: Loïc Molinari Tested-by: Biju Das Acked-by: Thomas Zimmermann Tested-by: Tommaso Merciai Link: https://patch.msgid.link/20260320151914.586945-1-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon commit 6692ed9b4ced29aa819c95cc4ad9e2dc8720c081 Author: Cássio Gabriel Date: Fri Apr 3 00:21:34 2026 -0300 ALSA: hda: Notify IEC958 Default PCM switch state changes The "IEC958 Default PCM Playback Switch" control is backed directly by mout->share_spdif. The share-switch callbacks currently access that state without serialization, and spdif_share_sw_put() always returns 0, so normal userspace writes never emit the standard ALSA control value notification. snd_hda_multi_out_analog_open() may also clear mout->share_spdif when the analog PCM capabilities and the SPDIF capabilities no longer intersect. That fallback is still needed to avoid creating an impossible hw constraint set, but it changes the mixer backing value without notifying subscribers. Protect the share-switch callbacks with spdif_mutex like the other SPDIF control handlers, return the actual change value from spdif_share_sw_put(), and notify the cached control when the open path forcibly disables shared SPDIF mode after dropping spdif_mutex. This keeps the existing auto-disable behavior while making switch state changes visible to userspace. Fixes: 9a08160bdbe3 ("[ALSA] hda-codec - Add "IEC958 Default PCM" switch") Fixes: 022b466fc353 ("ALSA: hda - Avoid invalid formats and rates with shared SPDIF") Suggested-by: Takashi Iwai Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260403-hda-spdif-share-notify-v3-1-4eb1356b0f17@gmail.com Signed-off-by: Takashi Iwai commit e5d5aef802a5f41283084f7d443ef4fd4b65d86d Author: wangdicheng Date: Fri Apr 3 09:47:36 2026 +0800 ALSA: aoa/onyx: Fix OF node leak on probe failure Add missing of_node_put() in the error path. Signed-off-by: wangdicheng Link: https://patch.msgid.link/20260403014736.33014-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit 797f629856c56595e138d69b8b0701ffe3cece21 Author: Haoyu Lu Date: Fri Apr 3 10:07:09 2026 +0800 ata: pata_arasan_cf: fix missing newline in dev_err() messages Add missing trailing newlines to dev_err() messages in pata_arasan_cf.c. This keeps the error output as properly terminated log lines. Acked-by: Viresh Kumar Signed-off-by: Haoyu Lu Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit e3a84be1ec2fd6f06e54bb31642412864d65280f Author: Coiby Xu Date: Wed Feb 25 14:03:46 2026 +0800 arm64,ppc64le/kdump: pass dm-crypt keys to kdump kernel CONFIG_CRASH_DM_CRYPT has been introduced to support LUKS-encrypted device dump target by addressing two challenges [1], - Kdump kernel may not be able to decrypt the LUKS partition. For some machines, a system administrator may not have a chance to enter the password to decrypt the device in kdump initramfs after the 1st kernel crashes - LUKS2 by default use the memory-hard Argon2 key derivation function which is quite memory-consuming compared to the limited memory reserved for kdump. To also enable this feature for ARM64 and PowerPC, the missing piece is to let the kdump kernel know where to find the dm-crypt keys which are randomly stored in memory reserved for kdump. Introduce a new device tree property dmcryptkeys [2] as similar to elfcorehdr to pass the memory address of the stored info of dm-crypt keys to the kdump kernel. Since this property is only needed by the kdump kernel, it won't be exposed to userspace. Link: https://lkml.kernel.org/r/20260225060347.718905-4-coxu@redhat.com Link: https://lore.kernel.org/all/20250502011246.99238-1-coxu@redhat.com/ [1] Link: https://github.com/devicetree-org/dt-schema/pull/181 [2] Signed-off-by: Coiby Xu Acked-by: Rob Herring (Arm) Reviewed-by: Sourabh Jain Cc: Arnaud Lefebvre Cc: Baoquan he Cc: Dave Young Cc: Kairui Song Cc: Pingfan Liu Cc: Krzysztof Kozlowski Cc: Thomas Staudt Cc: Will Deacon Cc: Christophe Leroy (CS GROUP) Signed-off-by: Andrew Morton commit fe74eb289163d10b34f8ee571cdc3257306f343f Author: Coiby Xu Date: Wed Feb 25 14:03:45 2026 +0800 crash: align the declaration of crash_load_dm_crypt_keys with CONFIG_CRASH_DM_CRYPT This will prevent a compilation failure when CONFIG_CRASH_DUMP is enabled but CONFIG_CRASH_DM_CRYPT is disabled, arch/powerpc/kexec/elf_64.c: In function 'elf64_load': >> arch/powerpc/kexec/elf_64.c:82:23: error: implicit declaration of function 'crash_load_dm_crypt_keys' [-Werror=implicit-function-declaration] 82 | ret = crash_load_dm_crypt_keys(image); | ^~~~~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors Link: https://lkml.kernel.org/r/20260225060347.718905-3-coxu@redhat.com Signed-off-by: Coiby Xu Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602120648.RgQALnnI-lkp@intel.com/ Acked-by: Baoquan He Cc: Arnaud Lefebvre Cc: Christophe Leroy (CS GROUP) Cc: Dave Young Cc: Kairui Song Cc: Krzysztof Kozlowski Cc: Pingfan Liu Cc: Rob Herring Cc: Sourabh Jain Cc: Thomas Staudt Cc: Will Deacon Signed-off-by: Andrew Morton commit 03738dd159db60a27378e9b5b93fd187218519ba Author: Coiby Xu Date: Wed Feb 25 14:03:44 2026 +0800 crash_dump/dm-crypt: don't print in arch-specific code Patch series "kdump: Enable LUKS-encrypted dump target support in ARM64 and PowerPC", v5. CONFIG_CRASH_DM_CRYPT has been introduced to support LUKS-encrypted device dump target by addressing two challenges [1], - Kdump kernel may not be able to decrypt the LUKS partition. For some machines, a system administrator may not have a chance to enter the password to decrypt the device in kdump initramfs after the 1st kernel crashes - LUKS2 by default use the memory-hard Argon2 key derivation function which is quite memory-consuming compared to the limited memory reserved for kdump. To also enable this feature for ARM64 and PowerPC, we need to add a device tree property dmcryptkeys [2] as similar to elfcorehdr to pass the memory address of the stored info of dm-crypt keys to the kdump kernel. This patch (of 3): When the vmcore dumping target is not a LUKS-encrypted target, it's expected that there is no dm-crypt key thus no need to return -ENOENT. Also print more logs in crash_load_dm_crypt_keys. The benefit is arch-specific code can be more succinct. Link: https://lkml.kernel.org/r/20260225060347.718905-1-coxu@redhat.com Link: https://lkml.kernel.org/r/20260225060347.718905-2-coxu@redhat.com Link: https://lore.kernel.org/all/20250502011246.99238-1-coxu@redhat.com/ [1] Link: https://github.com/devicetree-org/dt-schema/pull/181 [2] Signed-off-by: Coiby Xu Suggested-by: Will Deacon Acked-by: Baoquan He Cc: Arnaud Lefebvre Cc: Christophe Leroy (CS GROUP) Cc: Dave Young Cc: Kairui Song Cc: Krzysztof Kozlowski Cc: Pingfan Liu Cc: Rob Herring Cc: Sourabh Jain Cc: Thomas Staudt Signed-off-by: Andrew Morton commit d01684a2f0f84a3d4210bb76a7ca62c4253b8e93 Author: Inseob Kim Date: Thu Mar 26 11:06:04 2026 +0900 lib: parser: fix match_wildcard to correctly handle trailing stars This fixes a bug in match_wildcard that incorrectly handles trailing asterisks. For example, `match_wildcard("abc**", "abc")` must return true, but it returns false. Link: https://lkml.kernel.org/r/20260326020630.4139520-1-inseob@google.com Signed-off-by: Inseob Kim Cc: Changbin Du Cc: Jason Baron Cc: Joe Perches Cc: Josh Law Signed-off-by: Andrew Morton commit 0913b7554726aac089cab89b6f0877dafc30b2a0 Author: Christian A. Ehrhardt Date: Thu Mar 26 22:49:05 2026 +0100 lib: kunit_iov_iter: add tests for extract_iter_to_sg Add test cases that test extract_iter_to_sg. For each iterator type an iterator is loaded with a suitable buffer. The iterator is then extracted to a scatterlist with multiple calls to extract_iter_to_sg. The final scatterlist is copied into a scratch buffer. The test passes if the scratch buffer contains the same data as the original buffer. The new tests demonstrate bugs in extract_iter_to_sg for kvec and user iterators that are fixed by the previous commits. Link: https://lkml.kernel.org/r/20260326214905.818170-6-lk@c--e.de Signed-off-by: Christian A. Ehrhardt Cc: David Howells Cc: David Gow Cc: Kees Cook Cc: Petr Mladek Signed-off-by: Andrew Morton commit 7278aa840b69e5a31826329ef893230d67cae811 Author: Christian A. Ehrhardt Date: Thu Mar 26 22:49:04 2026 +0100 lib: kunit_iov_iter: improve error detection In the kunit_iov_iter test prevent the kernel buffer from being a single physically contiguous region. Additionally, make sure that the test pattern written to a page in the buffer depends on the offset of the page within the buffer. Link: https://lkml.kernel.org/r/20260326214905.818170-5-lk@c--e.de Signed-off-by: Christian A. Ehrhardt Cc: David Howells Cc: David Gow Cc: Kees Cook Cc: Petr Mladek Signed-off-by: Andrew Morton commit 0b49c7d0ae697fcecd7377cb7dda220f7cd096ff Author: Christian A. Ehrhardt Date: Thu Mar 26 22:49:03 2026 +0100 lib: kunit_iov_iter: fix memory leaks Use vfree() instead of vunmap() to free the buffer allocated by iov_kunit_create_buffer() because vunmap() does not honour VM_MAP_PUT_PAGES. In order for this to work the page array itself must not be managed by kunit. Remove the folio_put() when destroying a folioq. This is handled by vfree(), now. Pointed out by sashiko.dev on a previous iteration of this series. Tested by running the kunit test 10000 times in a loop. Link: https://lkml.kernel.org/r/20260326214905.818170-4-lk@c--e.de Fixes: 2d71340ff1d4 ("iov_iter: Kunit tests for copying to/from an iterator") Signed-off-by: Christian A. Ehrhardt Cc: David Howells Cc: David Gow Cc: Kees Cook Cc: Petr Mladek Signed-off-by: Andrew Morton commit 118cf3f55975352ac357fb194405031458186819 Author: Christian A. Ehrhardt Date: Thu Mar 26 22:49:02 2026 +0100 lib/scatterlist: fix temp buffer in extract_user_to_sg() Instead of allocating a temporary buffer for extracted user pages extract_user_to_sg() uses the end of the to be filled scatterlist as a temporary buffer. Fix the calculation of the start address if the scatterlist already contains elements. The unused space starts at sgtable->sgl + sgtable->nents not directly at sgtable->nents and the temporary buffer is placed at the end of this unused space. A subsequent commit will add kunit test cases that demonstrate that the patch is necessary. Pointed out by sashiko.dev on a previous iteration of this series. Link: https://lkml.kernel.org/r/20260326214905.818170-3-lk@c--e.de Fixes: 018584697533 ("netfs: Add a function to extract an iterator into a scatterlist") Signed-off-by: Christian A. Ehrhardt Cc: David Howells Cc: David Gow Cc: Kees Cook Cc: Petr Mladek Cc: [v6.5+] Signed-off-by: Andrew Morton commit 07b7d66e65d9cfe6b9c2c34aa22cfcaac37a5c45 Author: Christian A. Ehrhardt Date: Thu Mar 26 22:49:01 2026 +0100 lib/scatterlist: fix length calculations in extract_kvec_to_sg Patch series "Fix bugs in extract_iter_to_sg()", v3. Fix bugs in the kvec and user variants of extract_iter_to_sg. This series is growing due to useful remarks made by sashiko.dev. The main bugs are: - The length for an sglist entry when extracting from a kvec can exceed the number of bytes in the page. This is obviously not intended. - When extracting a user buffer the sglist is temporarily used as a scratch buffer for extracted page pointers. If the sglist already contains some elements this scratch buffer could overlap with existing entries in the sglist. The series adds test cases to the kunit_iov_iter test that demonstrate all of these bugs. Additionally, there is a memory leak fix for the test itself. The bugs were orignally introduced into kernel v6.3 where the function lived in fs/netfs/iterator.c. It was later moved to lib/scatterlist.c in v6.5. Thus the actual fix is only marked for backports to v6.5+. This patch (of 5): When extracting from a kvec to a scatterlist, do not cross page boundaries. The required length was already calculated but not used as intended. Adjust the copied length if the loop runs out of sglist entries without extracting everything. While there, return immediately from extract_iter_to_sg if there are no sglist entries at all. A subsequent commit will add kunit test cases that demonstrate that the patch is necessary. Link: https://lkml.kernel.org/r/20260326214905.818170-1-lk@c--e.de Link: https://lkml.kernel.org/r/20260326214905.818170-2-lk@c--e.de Fixes: 018584697533 ("netfs: Add a function to extract an iterator into a scatterlist") Signed-off-by: Christian A. Ehrhardt Cc: David Gow Cc: David Howells Cc: Kees Cook Cc: Petr Mladek Cc: [v6.5+] Signed-off-by: Andrew Morton commit 86bda539fbcf17c077b7ff4899968a2dc7c31e2d Author: Kuan-Wei Chiu Date: Fri Mar 20 18:09:38 2026 +0000 lib/list_sort: remove dummy cmp() calls to speed up merge_final() Historically, list_sort() implemented a hack in merge_final(): if (unlikely(!++count)) cmp(priv, b, b); This was introduced 16 years ago in commit 835cc0c8477f ("lib: more scalable list_sort()") so that callers could periodically invoke cond_resched() within their comparison functions when merging highly unbalanced lists. An audit of the kernel tree reveals that fs/ubifs/ was the sole user of this mechanism. Recent discussions and inspections by Richard Weinberger confirm that UBIFS lists are strictly bounded in size (a few thousand elements at most), meaning it does not strictly rely on these dummy callbacks to prevent soft lockups. For the vast majority of list_sort() users (such as block layer IO schedulers and file systems), this hack results in completely wasted function calls. In the worst-case scenario (merging an already sorted list where 'a' is exhausted quickly), it results in approximately (N/2)/256 unnecessary cmp() invocations. Remove the dummy cmp(priv, b, b) fallback from merge_final(). This saves unnecessary function calls, avoids branching overhead in the tight loop, and slightly speeds up the final merge step for all generic list_sort() users. [akpm@linux-foundation.org: remove now-unused local] Link: https://lkml.kernel.org/r/20260320180938.1827148-3-visitorckw@gmail.com Signed-off-by: Kuan-Wei Chiu Reviewed-by: Christoph Hellwig Cc: Ching-Chun (Jim) Huang Cc: Mars Cheng Cc: Richard Weinberger Cc: Yu-Chun Lin Cc: Zhihao Cheng Signed-off-by: Andrew Morton commit 237213776d0fd62487da513b55732cfb20f7eee8 Author: Kuan-Wei Chiu Date: Fri Mar 20 18:09:37 2026 +0000 ubifs: remove unnecessary cond_resched() from list_sort() compare Patch series "lib/list_sort: Clean up list_sort() scheduling workarounds", v3. Historically, list_sort() included a hack in merge_final() that periodically invoked dummy cmp(priv, b, b) calls when merging highly unbalanced lists. This allowed the caller to invoke cond_resched() within their comparison callbacks to avoid soft lockups. However, an audit of the kernel tree shows that fs/ubifs/ has been the sole user of this mechanism. For all other generic list_sort() users, this results in wasted function calls and unnecessary overhead in a tight loop. Recent discussions and code inspection confirmed that the lists being sorted in UBIFS are bounded in size (a few thousand elements at most), and the comparison functions are extremely lightweight. Therefore, UBIFS does not actually need to rely on this mechanism. This patch (of 2): Historically, UBIFS embedded cond_resched() calls inside its list_sort() comparison callbacks (data_nodes_cmp, nondata_nodes_cmp, and replay_entries_cmp) to prevent soft lockups when sorting long lists. However, further inspection by Richard Weinberger reveals that these compare functions are extremely lightweight and do not perform any blocking MTD I/O. Furthermore, the lists being sorted are strictly bounded in size: - In the GC case, the list contains at most the number of nodes that fit into a single LEB. - In the replay case, the list spans across a few LEBs from the UBIFS journal, amounting to at most a few thousand elements. Since the compare functions are called a few thousand times at most, the overhead of frequent scheduling points is unjustified. Removing the cond_resched() calls simplifies the comparison logic and reduces unnecessary context switch checks during the sort. Link: https://lkml.kernel.org/r/20260320180938.1827148-1-visitorckw@gmail.com Link: https://lkml.kernel.org/r/20260320180938.1827148-2-visitorckw@gmail.com Signed-off-by: Kuan-Wei Chiu Reviewed-by: Zhihao Cheng Acked-by: Richard Weinberger Cc: Ching-Chun (Jim) Huang Cc: Christoph Hellwig Cc: Mars Cheng Cc: Yu-Chun Lin Signed-off-by: Andrew Morton commit af53e85ef797d45b364edf330eb008639b5c98c2 Author: Christoph Hellwig Date: Fri Mar 27 07:17:00 2026 +0100 xor: add a kunit test case Add a test case for the XOR routines loosely based on the CRC kunit test. Link: https://lkml.kernel.org/r/20260327061704.3707577-29-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit a21921dd02d305a440ab0e8f6d991a797db04f85 Author: Christoph Hellwig Date: Fri Mar 27 07:16:59 2026 +0100 xor: use static_call for xor_gen Avoid the indirect call for xor_generation by using a static_call. Link: https://lkml.kernel.org/r/20260327061704.3707577-28-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 80dcf0a7832a5acde0f0701a4dc7b586fc8bcc88 Author: Christoph Hellwig Date: Fri Mar 27 07:16:58 2026 +0100 xor: pass the entire operation to the low-level ops Currently the high-level xor code chunks up all operations into small units for only up to 1 + 4 vectors, and passes it to four different methods. This means the FPU/vector context is entered and left a lot for wide stripes, and a lot of indirect expensive indirect calls are performed. Switch to passing the entire gen_xor request to the low-level ops, and provide a macro to dispatch it to the existing helper. This reduce the number of indirect calls and FPU/vector context switches by a factor approaching nr_stripes / 4, and also reduces source and binary code size. Link: https://lkml.kernel.org/r/20260327061704.3707577-27-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 0f629e7283ad50b2efe4451914ddf06c89de463e Author: Christoph Hellwig Date: Fri Mar 27 07:16:57 2026 +0100 btrfs: use xor_gen Use the new xor_gen helper instead of open coding the loop around xor_blocks. This helper is very similar to the existing run_xor helper in btrfs, except that the destination buffer is passed explicitly. Link: https://lkml.kernel.org/r/20260327061704.3707577-26-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: David Sterba Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 7c12c32b9f73f64bbdb71abdbd6524b9489063dd Author: Christoph Hellwig Date: Fri Mar 27 07:16:56 2026 +0100 async_xor: use xor_gen Replace use of the loop around xor_blocks with the easier to use xor_gen API. Link: https://lkml.kernel.org/r/20260327061704.3707577-25-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit e420f0a88b24b80302f57965ceb7387aa3f12488 Author: Christoph Hellwig Date: Fri Mar 27 07:16:54 2026 +0100 xor: add a better public API xor_blocks is very annoying to use, because it is limited to 4 + 1 sources / destinations, has an odd argument order and is completely undocumented. Lift the code that loops around it from btrfs and async_tx/async_xor into common code under the name xor_gen and properly document it. [hch@lst.de: make xor_blocks less annoying to use] Link: https://lkml.kernel.org/r/20260327061704.3707577-24-hch@lst.de Link: https://lkml.kernel.org/r/20260327061704.3707577-23-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit e20043b4765cdf7ec8e963d706bb91469cba8cb8 Author: Christoph Hellwig Date: Fri Mar 27 07:16:53 2026 +0100 xor: make xor.ko self-contained in lib/raid/ Move the asm/xor.h headers to lib/raid/xor/$(SRCARCH)/xor_arch.h and include/linux/raid/xor_impl.h to lib/raid/xor/xor_impl.h so that the xor.ko module implementation is self-contained in lib/raid/. As this remove the asm-generic mechanism a new kconfig symbol is added to indicate that a architecture-specific implementations exists, and xor_arch.h should be included. Link: https://lkml.kernel.org/r/20260327061704.3707577-22-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 352ebd066b625a5058bd988e5b32e6992f4d5b88 Author: Christoph Hellwig Date: Fri Mar 27 07:16:52 2026 +0100 xor: avoid indirect calls for arm64-optimized ops Remove the inner xor_block_templates, and instead have two separate actual template that call into the neon-enabled compilation unit. Link: https://lkml.kernel.org/r/20260327061704.3707577-21-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 77fd47e57a0931eb462ea7b76228df6624b563e9 Author: Christoph Hellwig Date: Fri Mar 27 07:16:51 2026 +0100 x86: move the XOR code to lib/raid/ Move the optimized XOR code out of line into lib/raid. Link: https://lkml.kernel.org/r/20260327061704.3707577-20-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 95c104cc55713b90012810e8965c27b9ef990097 Author: Christoph Hellwig Date: Fri Mar 27 07:16:50 2026 +0100 s390: move the XOR code to lib/raid/ Move the optimized XOR into lib/raid and include it it in xor.ko instead of unconditionally building it into the main kernel image. Link: https://lkml.kernel.org/r/20260327061704.3707577-19-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Heiko Carstens Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 7f96362396ee27fbe3aafc0d49943367258d5fdd Author: Christoph Hellwig Date: Fri Mar 27 07:16:49 2026 +0100 sparc: move the XOR code to lib/raid/ Move the optimized XOR into lib/raid and include it it in xor.ko instead of always building it into the main kernel image. The code should probably be split into separate files for the two implementations, but for now this just does the trivial move. Link: https://lkml.kernel.org/r/20260327061704.3707577-18-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 5265d55b214647f56b46330ec1b30641073608c8 Author: Christoph Hellwig Date: Fri Mar 27 07:16:48 2026 +0100 riscv: move the XOR code to lib/raid/ Move the optimized XOR into lib/raid and include it it in xor.ko instead of always building it into the main kernel image. Link: https://lkml.kernel.org/r/20260327061704.3707577-17-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 3f276cece4dd9e8bf199d9bf3901eef8ca904c2d Author: Christoph Hellwig Date: Fri Mar 27 07:16:47 2026 +0100 powerpc: move the XOR code to lib/raid/ Move the optimized XOR into lib/raid and include it it in xor.ko instead of always building it into the main kernel image. Link: https://lkml.kernel.org/r/20260327061704.3707577-16-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 033bee3e49631bd0c7e081aeafeadc7623495107 Author: Christoph Hellwig Date: Fri Mar 27 07:16:46 2026 +0100 loongarch: move the XOR code to lib/raid/ Move the optimized XOR into lib/raid and include it it in xor.ko instead of always building it into the main kernel image. Link: https://lkml.kernel.org/r/20260327061704.3707577-15-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 3786f2ad009549c9e5e2af86e5829b31ad788eb4 Author: Christoph Hellwig Date: Fri Mar 27 07:16:45 2026 +0100 arm64: move the XOR code to lib/raid/ Move the optimized XOR into lib/raid and include it it in the main xor.ko instead of building a separate module for it. Note that this drops the CONFIG_KERNEL_MODE_NEON dependency, as that is always set for arm64. Link: https://lkml.kernel.org/r/20260327061704.3707577-14-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 0d64a24ec0c02f75e5068065b503d98e10a60d01 Author: Christoph Hellwig Date: Fri Mar 27 07:16:44 2026 +0100 arm: move the XOR code to lib/raid/ Move the optimized XOR into lib/raid and include it it in the main xor.ko instead of building a separate module for it. Link: https://lkml.kernel.org/r/20260327061704.3707577-13-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 503793b1340e3622f7464c2717a8e4f6f8424cca Author: Christoph Hellwig Date: Fri Mar 27 07:16:43 2026 +0100 alpha: move the XOR code to lib/raid/ Move the optimized XOR code out of line into lib/raid. Note that the giant inline assembly block might be better off as a separate assembly source file now, but I'll leave that to the alpha maintainers. Link: https://lkml.kernel.org/r/20260327061704.3707577-12-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Magnus Lindholm Tested-by: Magnus Lindholm Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit c46928fdcfa01b6ca422e9c2b49e8a1072260cf3 Author: Christoph Hellwig Date: Fri Mar 27 07:16:42 2026 +0100 xor: move generic implementations out of asm-generic/xor.h Move the generic implementations from asm-generic/xor.h to per-implementaion .c files in lib/raid. This will build them unconditionally even when an architecture forces a specific implementation, but as we'll need at least one generic version for the static_call optimization later on we'll pay that price. Note that this would cause the second xor_block_8regs instance created by arch/arm/lib/xor-neon.c to be generated instead of discarded as dead code, so add a NO_TEMPLATE symbol to disable it for this case. Link: https://lkml.kernel.org/r/20260327061704.3707577-11-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 35ebc4de105989034f1250e40eb6dbf5e136b04e Author: Christoph Hellwig Date: Fri Mar 27 07:16:41 2026 +0100 xor: remove macro abuse for XOR implementation registrations Drop the pretty confusing historic XOR_TRY_TEMPLATES and XOR_SELECT_TEMPLATE, and instead let the architectures provide a arch_xor_init that calls either xor_register to register candidates or xor_force to force a specific implementation. Link: https://lkml.kernel.org/r/20260327061704.3707577-10-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 54e20be48fd4bc1df5f6fbca552b5be8c47dbd18 Author: Christoph Hellwig Date: Fri Mar 27 07:16:40 2026 +0100 xor: split xor.h Keep xor.h for the public API, and split the struct xor_block_template definition that is only needed by the xor.ko core and architecture-specific optimizations into a separate xor_impl.h header. Link: https://lkml.kernel.org/r/20260327061704.3707577-9-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 0471415f3fd6007bf435dbf158060bc646d7813f Author: Christoph Hellwig Date: Fri Mar 27 07:16:39 2026 +0100 xor: cleanup registration and probing Originally, the XOR code benchmarked all algorithms at load time, but it has since then been hacked multiple times to allow forcing an algorithm, and then commit 524ccdbdfb52 ("crypto: xor - defer load time benchmark to a later time") changed the logic to a two-step process or registration and benchmarking, but only when built-in. Rework this, so that the XOR_TRY_TEMPLATES macro magic now always just deals with adding the templates to the list, and benchmarking is always done in a second pass; for modular builds from module_init, and for the built-in case using a separate init call level. Link: https://lkml.kernel.org/r/20260327061704.3707577-8-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 7c6e6b2b48e8e9f3a1ad57dc78a8d33947cb5dda Author: Christoph Hellwig Date: Fri Mar 27 07:16:38 2026 +0100 xor: small cleanups Update the to of file comment to be correct and non-redundant, and drop the unused BH_TRACE define. Link: https://lkml.kernel.org/r/20260327061704.3707577-7-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 9e229025e2474115c151f08bdbdd3d8d5f159af3 Author: Christoph Hellwig Date: Fri Mar 27 07:16:37 2026 +0100 xor: move to lib/raid/ Move the RAID XOR code to lib/raid/ as it has nothing to do with the crypto API. Link: https://lkml.kernel.org/r/20260327061704.3707577-6-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 3ea16a98518a39f85bcf62ce59c115c988e85457 Author: Christoph Hellwig Date: Fri Mar 27 07:16:36 2026 +0100 um/xor: cleanup xor.h Since commit c055e3eae0f1 ("crypto: xor - use ktime for template benchmarking") the benchmarking works just fine even for TT_MODE_INFCPU, so drop the workarounds. Note that for CPUs supporting AVX2, which includes almost everything built in the last 10 years, the AVX2 implementation is forced anyway. CONFIG_X86_32 is always correctly set for UM in arch/x86/um/Kconfig, so don't override it either. Link: https://lkml.kernel.org/r/20260327061704.3707577-5-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Richard Weinberger Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit 675a0dd596e712404557286d0a883b54ee28e4f4 Author: Christoph Hellwig Date: Fri Mar 27 07:16:35 2026 +0100 arm64/xor: fix conflicting attributes for xor_block_template Commit 2c54b423cf85 ("arm64/xor: use EOR3 instructions when available") changes the definition to __ro_after_init instead of const, but failed to update the external declaration in xor.h. This was not found because xor-neon.c doesn't include , and can't easily do that due to current architecture of the XOR code. Link: https://lkml.kernel.org/r/20260327061704.3707577-4-hch@lst.de Fixes: 2c54b423cf85 ("arm64/xor: use EOR3 instructions when available") Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit b7ca705758b956f78eb776fbc85c99ee501674a2 Author: Christoph Hellwig Date: Fri Mar 27 07:16:34 2026 +0100 arm/xor: remove in_interrupt() handling xor_blocks can't be called from interrupt context, so remove the handling for that. Link: https://lkml.kernel.org/r/20260327061704.3707577-3-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit d8593b8f93541d9fef81130f2f33f25c47593094 Author: Christoph Hellwig Date: Fri Mar 27 07:16:33 2026 +0100 xor: assert that xor_blocks is not call from interrupt context Patch series "cleanup the RAID5 XOR library", v4. The XOR library used for the RAID5 parity is a bit of a mess right now. The main file sits in crypto/ despite not being cryptography and not using the crypto API, with the generic implementations sitting in include/asm-generic and the arch implementations sitting in an asm/ header in theory. The latter doesn't work for many cases, so architectures often build the code directly into the core kernel, or create another module for the architecture code. Change this to a single module in lib/ that also contains the architecture optimizations, similar to the library work Eric Biggers has done for the CRC and crypto libraries later. After that it changes to better calling conventions that allow for smarter architecture implementations (although none is contained here yet), and uses static_call to avoid indirection function call overhead. This patch (of 27): Most of the optimized xor_blocks versions require FPU/vector registers, which generally are not supported in interrupt context. Both callers already are in user context, so enforce this at the highest level. Link: https://lkml.kernel.org/r/20260327061704.3707577-1-hch@lst.de Link: https://lkml.kernel.org/r/20260327061704.3707577-2-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Tested-by: Eric Biggers Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anton Ivanov Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David S. Miller Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Li Nan Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: Matt Turner Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Richard Henderson Cc: Richard Weinberger Cc: Russell King Cc: Song Liu Cc: Sven Schnelle Cc: Ted Ts'o Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton commit ac12b852b4ead4a586299c8f68cdcbcaf1bf6cbc Author: Daniele Palmas Date: Mon Mar 23 13:28:37 2026 +0100 bus: mhi: host: pci_generic: Add Telit FE912C04 modem support Add SDX35 based modem Telit FE912C04, reusing FN920C04 configuration. 01:00.0 Unassigned class [ff00]: Qualcomm Device 011a Subsystem: Device 1c5d:2045 Signed-off-by: Daniele Palmas Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260323122837.3406521-1-dnlplm@gmail.com commit 210259987d9a7bb8506f3e93c2ddbece15c13b15 Author: Ian Rogers Date: Wed Mar 18 18:01:03 2026 -0700 perf metrics: Make common stalled metrics conditional on having the event The metric code uses the event parsing code but it generally assumes all events are supported. Arnaldo reported AMD supporting stalled-cycles-frontend but not stalled-cycles-backend [1]. An issue with this is that before parsing happens the metric code tries to share events within groups to reduce the number of events and multiplexing. If the group has some supported and not supported events, the whole group will become broken. To avoid this situation add has_event tests to the metrics for stalled-cycles-frontend and stalled-cycles-backend. has_events is evaluated when parsing the metric and its result constant propagated (with if-elses) to reduce the number of events. This means when the metric code considers sharing the events, only supported events will be shared. Note for backporting. This change updates tools/perf/pmu-events/empty-pmu-events.c a convenience file for builds on systems without python present. While the metrics.json code should backport easily there can be conflicts on empty-pmu-events.c. In this case the build will have left a file test-empty-pmu-events.c that can be copied over empty-pmu-events.c to resolve issues and make an appropriate empty-pmu-events.c for the json in the source tree at the time of the build. [1] https://lore.kernel.org/lkml/abm1nR-2xjOUBroD@x1/ Reported-by: Arnaldo Carvalho de Melo Closes: https://lore.kernel.org/lkml/abm1nR-2xjOUBroD@x1/ Fixes: c7adeb0974f1 ("perf jevents: Add set of common metrics based on default ones") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit aa0c2bb09bdc5423aa6a0da41762ea0703ed567c Author: Ian Rogers Date: Tue Dec 9 09:08:11 2025 -0800 perf tests kwork: Add basic kwork coverage tests Add basic kwork coverage tests for record, report, latency, timehist and top. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 43c0901edaabb59f94d7f136be9b6afcfbc36df8 Author: Ian Rogers Date: Wed Apr 1 09:13:24 2026 -0700 perf data convert ctf: Pipe mode improvements Handle the finished_round event. Set up the CTF events when the feature event desc is read. In pipe mode the attr events will create the evsels and the feature event desc events will name the evsels. The CTF events need the evsel name, so wait until feature event descs are read (in pipe mode) before setting up the events except for tracepoint events. Handle the tracing_data event so that tracepoint information is available when setting up tracepoint events. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit b1e814f860c758c289dc63825caf322e2cb5e298 Author: Ian Rogers Date: Wed Apr 1 09:13:23 2026 -0700 perf evsel: Make unknown event names more unique In situations like the perf data converter the evsel__name will be used to create babeltrace events. If the events have the same name then creation can fail. Avoid these failures by including more information into the unknown event names. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit fbfdf3143271ca695061fa5882651bb512832044 Author: Ian Rogers Date: Wed Apr 1 09:13:22 2026 -0700 perf ordered-events: Event processing consistency with the regular reader Some event processing functions like perf_event__process_tracing_data return a zero or positive value on success. Ordered event processing handles any non-zero value as an error, which is inconsistent with reader__process_events and reader__read_event that only treat negative values as errors. Make the ordered events error handling consistent with that of the events reader. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 8a4aab17c350f7c2ca7c459a9977f8e18f2878f6 Author: Ian Rogers Date: Wed Apr 1 09:13:21 2026 -0700 perf header: Refactor pipe mode end marker handling In non-pipe/data mode the header has a 256-bit bitmap representing whether a feature is enabled or not. In pipe mode features are written out in perf_event__synthesize_features as PERF_RECORD_HEADER_FEATURE events with a special zero sized marker for the last feature. If a new feature is added the last feature marker event appears as that feature from old pipe mode perf data. As the event is zero sized it will fail to be processed and generally terminate perf. Add a last_feat variable to the header that in non-pipe/data mode is just HEADER_LAST_FEATURE. In pipe mode compute the last_feat by handling zero sized feature events, assuming they are the marker and updating last_feat accordingly. Potentially a feature event could be zero sized and so still process the feature event, just ignore the error if it fails. As perf_event__process_feature can properly handle pipe mode data, migrate users to it except for report that still wants to group events and stop header printing with the last feature marker. Make perf_event__process_feature non-fatal in the case of a newer feature than this version of perf's HEADER_LAST_FEATURE, which was the behavior all users wanted. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit cdaebccc1cb5c0f635f6db7fb1570f11b5c9f985 Author: Ian Rogers Date: Wed Apr 1 09:13:20 2026 -0700 perf session: Extra logging for failed to process events Print log information in ordered event processing so that the cause of finished round failing is clearer. Print the event name along with its number when an event isn't processed. Add extra detail about where the failure happened. The following log lines come from running `perf data convert`. Before: 0xa250 [0x10]: failed to process type: 80 After: 0xa250 [0x10]: piped event processing failed for event of type: FEATURE (80) Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 598de368375ed4ffaa23086524ea7dbb5b7fd256 Author: Ian Rogers Date: Wed Apr 1 09:13:19 2026 -0700 perf header: Properly warn/print when libtraceevent/libbpf support is missing By removing the features from feat_ops with ifdefs the previous logic would print "# (null)" when perf processed a feature that lacked builtin support. Remove the ifdefs from feat_ops and in the relevant functions print errors/messages about the lack of support. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 8cc518735beb879c51df712a5ce5893c02f81b12 Author: Ian Rogers Date: Wed Apr 1 09:13:18 2026 -0700 perf header: Add utility to convert feature number to a string For logging and debug messages it can be convenient to convert a feature number to a name. Add header_feat__name for this and reuse the data already within the feat_ops struct. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 623030fd0ad59ecc4197b0c0f8dd066a0f0598b3 Author: Ian Rogers Date: Wed Apr 1 09:13:17 2026 -0700 perf clockid: Add missing include clockid_t is declared in time.h but the include is missing. Reordering header files may result in build breakages. Add the include to avoid this. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 42a9f5a16328ed78a88e0498556965b6c6ec515c Author: Peng Fan Date: Sun Mar 29 21:00:13 2026 +0800 arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there might be interrupt storm for this board. Need to set PAD PUE and PU together to make pull up work properly. Fixes: dfcd1b6f7620e ("arm64: dts: freescale: add initial device tree for TQMa8MQML with i.MX8MM") Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 0fb37990774113afd943eaa91323679388584b6d Author: Peng Fan Date: Sun Mar 29 21:00:12 2026 +0800 arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there might be interrupt storm for this board. Need to set PAD PUE and PU together to make pull up work properly. Fixes: 3e56e354db6d3 ("arm64: dts: freescale: add initial device tree for TQMa8MQNL with i.MX8MN") Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 721dec3ee9ff5231d13a412ff87df63b966d137b Author: Peng Fan Date: Sun Mar 29 21:00:11 2026 +0800 arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there might be interrupt storm for this board. Need to set PAD PUE and PU together to make pull up work properly. While at here, also correct interrupt type as IRQ_TYPE_LEVEL_LOW. Fixes: cbd3ef64eb9d1 ("arm64: dts: Add support for Emtop SoM & Baseboard") Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 11e8d234d4be7af401e8a24e078005ecd9bc1d1a Author: Michael Petlan Date: Thu Apr 2 16:51:18 2026 +0200 perf trace: Fix potential u64 underflow in duration calculation Although it happens very rarely, in case of out-of-order events (i.e. due to CPU migration when a syscall is executed), the calculation of event duration might underflow and thus a bogus value is printed: 2.804 ( 0.001 ms): :49553/49553 rt_sigaction(sig: QUIT, act: 0x7fff403ed6e0, oact: 0x7fff403ed780, sigsetsize: 8) = 0 2.807 ( 0.001 ms): :49553/49553 rt_sigaction(sig: CHLD, act: 0x7fff403ed6e0, oact: 0x7fff403ed780, sigsetsize: 8) = 0 2.815 (18446744073709.438 ms): :49553/49553 execve(filename: 0xbb173a30, argv: 0x55aabb171930, envp: 0x55aabb171120) = 0 2.815 ( 0.534 ms): pwd/49553 ... [continued]: execve()) = 0 Check for possible underflow first and in case of a bogus value, do not print it. 2.804 ( 0.001 ms): :49553/49553 rt_sigaction(sig: QUIT, act: 0x7fff403ed6e0, oact: 0x7fff403ed780, sigsetsize: 8) = 0 2.807 ( 0.001 ms): :49553/49553 rt_sigaction(sig: CHLD, act: 0x7fff403ed6e0, oact: 0x7fff403ed780, sigsetsize: 8) = 0 2.815 ( ): :49553/49553 execve(filename: 0xbb173a30, argv: 0x55aabb171930, envp: 0x55aabb171120) = 0 2.815 ( 0.534 ms): pwd/49553 ... [continued]: execve()) = 0 Signed-off-by: Michael Petlan Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 927722dcfe0a5294433bb087387cc52a46cbf675 Merge: 6daa8dd037459a 7f1e2c1cce1cad Author: Martin K. Petersen Date: Thu Apr 2 21:35:53 2026 -0400 Merge patch series "Update lpfc to revision 15.0.0.0" Justin Tee says: Update lpfc to revision 15.0.0.0 This patch set adds support for the G8 ASIC found on the LPe42100 series adapter models. Updates are made to irq affinity assignment, mailbox command handling related to initialization, SGL construction, firmware download diagnostics, and the removal of an outdated performance feature. We also add 128G link speed selection and support. The patches were cut against Martin's 7.1/scsi-queue tree. Link: https://patch.msgid.link/20260331205928.119833-1-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 7f1e2c1cce1cad097d14f384c2461c1ff6cac0d0 Author: Justin Tee Date: Tue Mar 31 13:59:28 2026 -0700 scsi: lpfc: Update lpfc version to 15.0.0.0 Update lpfc version to 15.0.0.0 Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260331205928.119833-11-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 49b9f31e52b2125125318cb60fe9f5e7fa9c6755 Author: Justin Tee Date: Tue Mar 31 13:59:27 2026 -0700 scsi: lpfc: Add PCI ID support for LPe42100 series adapters Update supported pci_device_id table to include the values for the G8 ASIC Device ID utilized by LPe42100 series of adapters. The default reporting string will be "LPe42100". Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260331205928.119833-10-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 39d1d94166da32d6aa4abb898ef7f3217c3a17d0 Author: Justin Tee Date: Tue Mar 31 13:59:26 2026 -0700 scsi: lpfc: Introduce 128G link speed selection and support 128G link speed selection and support is added for various mailbox commands, defines, and ACQE handling. The default behavior to autonegotiate supported link speed remains the same. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260331205928.119833-9-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit a1421afa0ddb6e6dfc3639f11f1b8dd83c7f9759 Author: Justin Tee Date: Tue Mar 31 13:59:25 2026 -0700 scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates When WRITE_OBJECT mailbox command fails during firmware update, the lpfc_log_write_firmware_error() routine is used to log and parse commonly found error codes. Update this routine to also include ASIC_ID register checks for notifying users of incompatible images. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260331205928.119833-8-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit ba6dec7e703e84152f049a7a1b4d33f3c1051226 Author: Justin Tee Date: Tue Mar 31 13:59:24 2026 -0700 scsi: lpfc: Update construction of SGL when XPSGL is enabled The construction of SGLs is updated to safeguard ASIC boundary requirements when using XPSGL. The LSP type SGE is used to notify where a continuing SGL resides. Typically, this means that the LSP is the last SGE in an SGL because the current SGL has reached its maximum size and the LSP is used to refer to the next follow up SGL. Due to ASIC boundary requirements, there is a need to ensure a 4 KB boundary is not crossed. Thus, for a maximum size of 256 byte SGLs or 16 SGEs, this means restricting the LSP to being the 12th SGE for the very first SGL that is used for pre-registration. If additional SGEs are needed, the LSP will be the last SGE position within that follow up SGL as was previously implemented. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260331205928.119833-7-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 384075eb19b2218cbece4a1a758577f1ee0a5e40 Author: Justin Tee Date: Tue Mar 31 13:59:23 2026 -0700 scsi: lpfc: Remove deprecated PBDE feature The PBDE feature is no longer supported and its related fields are removed in this patch. There are no expected side effects with regards to existing functionality. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260331205928.119833-6-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 5b402a8aceb15682457b7e65eef1a133d6dfe7e3 Author: Justin Tee Date: Tue Mar 31 13:59:22 2026 -0700 scsi: lpfc: Add REG_VFI mailbox cmd error handling If lpfc_issue_reg_vfi() returns an error in lpfc_rcv_plogi(), then execution of lpfc_rcv_plogi() continues and lpfc_reg_rpi() is called, which allocates an mbuf. When this REG_RPI mailbox is issued, it inevitably fails because the VFI is not registered. However, the REG_RPI failure does not free the mbuf that was allocated in lpfc_reg_rpi() because there is no check for mbox error status in lpfc_defer_plogi_acc(). Fix by adding a check in lpfc_rcv_plogi() if lpfc_reg_vfi() fails, then exit early. Also, add mailbox status check in lpfc_defer_plogi_acc to enter the REG_RPI mbox_cmpl functions and free the allocated mbuf. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260331205928.119833-5-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit f75754f2feaa3be2f07838ef53914d15a10fd587 Author: Justin Tee Date: Tue Mar 31 13:59:21 2026 -0700 scsi: lpfc: Log MCQE contents for mbox commands with no context Update log message to display the entirety of an MCQE for which there is no submission context. This log message is not expected to occur and hence is tagged as a LOG_TRACE_EVENT. As such, move the hbalock release to before this log message so that the trace event process does not hold the hbalock for too long. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260331205928.119833-4-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 35f22f84bed13e122e549ffae490487122f3c3a8 Author: Justin Tee Date: Tue Mar 31 13:59:20 2026 -0700 scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type When specifying rq version, it is preferred to refer to SLI4 interface type instead of the get_sli4_parameters mailbox command response. If SLI4 if_type is 2 or above, then the newer version 1 is used for rq_create mailbox commands. Otherwise, version 0 is used and is meant for older adapters. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260331205928.119833-3-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit e32b5e8f09503be680bed75da51bb584134a1390 Author: Justin Tee Date: Tue Mar 31 13:59:19 2026 -0700 scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids The purpose of the lpfc_next_online_cpu() call is to save the CPU index for the next iteration of the for (index = 0; index < vectors; index++) loop. Because we’ve reached the last iteration of the loop, cpumask_next(cpu, aff_mask) returns nr_cpu_ids. Thus, if we already know we've reached the last iteration of the IRQ affinity assignment loop, then we can just break and exit. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260331205928.119833-2-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 6daa8dd037459a1d1b105bd1008fa2a32f8708e5 Author: Bart Van Assche Date: Wed Apr 1 13:25:01 2026 -0700 scsi: ufs: core: Make the header files self-contained Add the include directives and forward declarations that are missing from the UFS core header files. This prevents compilation failures if include directives are reordered. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260401202506.1445324-4-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit efa1f6a9d7ce9246cb98c85335bba6a797e17584 Author: Bart Van Assche Date: Wed Apr 1 13:25:00 2026 -0700 scsi: ufs: core: Remove an include directive from ufshcd-crypto.h Nothing in the ufshcd-crypto.h header file depends on the ufshcd-priv.h header file. Hence, stop including that header file. This include directive was introduced by commit 4bc26113c603 ("scsi: ufs: Split the ufshcd.h header file"). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260401202506.1445324-3-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 1373df88d53594a32534fd8960c51d1d09be8ecb Author: Bart Van Assche Date: Wed Apr 1 13:24:59 2026 -0700 scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock() Document the aspects of ufshcd_mcq_compl_all_cqes_lock() that are nontrivial in a comment block above this function. Signed-off-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260401202506.1445324-2-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 6f6c794d0ff05dab1fa4677f39043de8a6a80da3 Merge: 7e85ca02ef3aa2 7cbded6ed98f36 Author: Alexei Starovoitov Date: Thu Apr 2 18:23:25 2026 -0700 Merge branch 'fix-invariant-violations-and-improve-branch-detection' Paul Chaignon says: ==================== Fix invariant violations and improve branch detection This patchset fixes invariant violations on register bounds. These invariant violations cause a warning and happen when reg_bounds_sync is trying to refine register bounds while walking an impossible branch. This patchset takes this situation as an opportunity to improve verification performance. That is, the verifier will use the invariant violations as a signal that a branch cannot be taken and process it as dead code. This patchset implements this approach and covers it in selftests with a new invariant violation case. Some of the logic in reg_bounds_sync likely acts as a duplicate with logic from is_scalar_branch_taken. This patchset does not attempt to remove superfluous logic from is_scalar_branch_taken and leaves it to a future patchset (ex. once syzbot has confirmed that all invariant violations are fixed). In the future, there is also a potential opportunity to simplify existing logic by merging reg_bounds_sync and range_bounds_violation (have reg_bounds_sync error out on invariant violation). That is however not needed to fix invariant violation, which we focus on in this patchset. Changes in v3: - Rename and refactor the helper functions checking for tnum-related invariant violations (Mykyta). - Small changes to comment style in verifier changes and new selftest (Mykyta). - Rebased. Changes in v2: - Moved tmp registers to env in preparatory commit (Eduard). - Updated reg_bounds_sync to bail out in case of ill-formed registers, thus avoiding one set of invariant violation checks in simulate_both_branches_taken (Eduard). - Drop the Fixes tag to avoid misleading backporters (Shung-Hsi). - Improve wording of commit descriptions (Shung-Hsi, Hari). - Fix error in code comments (AI bot). - Rebased. ==================== Link: https://patch.msgid.link/cover.1775142354.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 7cbded6ed98f363cc7fa84304da1f03eefa03f67 Author: Paul Chaignon Date: Thu Apr 2 17:12:48 2026 +0200 selftests/bpf: Remove invariant violation flags With the changes to the verifier in previous commits, we're not expecting any invariant violations anymore. We should therefore always enable BPF_F_TEST_REG_INVARIANTS to fail on invariant violations. Turns out that's already the case and we've been explicitly setting this flag in selftests when it wasn't necessary. This commit removes those flags from selftests, which should hopefully make clearer that it's always enabled. Signed-off-by: Paul Chaignon Acked-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/9afce92510a7d44569dc3af63c9b8c608e69298a.1775142354.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 2ba199067b89edcf4dcc760941b26753494eb668 Author: Paul Chaignon Date: Thu Apr 2 17:11:41 2026 +0200 selftests/bpf: Cover invariant violation case from syzbot This patch adds a selftest for the change in the previous patch. The selftest is derived from a syzbot reproducer from [1] (among the 22 reproducers on that page, only 4 still reproduced on latest bpf tree, all being small variants of the same invariant violation). The test case failure without the previous patch is shown below. 0: R1=ctx() R10=fp0 0: (85) call bpf_get_prandom_u32#7 ; R0=scalar() 1: (bf) r5 = r0 ; R0=scalar(id=1) R5=scalar(id=1) 2: (57) r5 &= -4 ; R5=scalar(smax=0x7ffffffffffffffc,umax=0xfffffffffffffffc,smax32=0x7ffffffc,umax32=0xfffffffc,var_off=(0x0; 0xfffffffffffffffc)) 3: (bf) r7 = r0 ; R0=scalar(id=1) R7=scalar(id=1) 4: (57) r7 &= 1 ; R7=scalar(smin=smin32=0,smax=umax=smax32=umax32=1,var_off=(0x0; 0x1)) 5: (07) r7 += -43 ; R7=scalar(smin=smin32=-43,smax=smax32=-42,umin=0xffffffffffffffd5,umax=0xffffffffffffffd6,umin32=0xffffffd5,umax32=0xffffffd6,var_off=(0xffffffffffffffd4; 0x3)) 6: (5e) if w5 != w7 goto pc+1 verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0xffffffd5, 0xffffffffffffffd4] s64=[0x80000000ffffffd5, 0x7fffffffffffffd4] u32=[0xffffffd5, 0xffffffd4] s32=[0xffffffd5, 0xffffffd4] var_off=(0xffffffd4, 0xffffffff00000000) R5 and R7 are prepared such that their tnums intersection results in a known constant but that constant isn't within R7's u32 bounds. is_branch_taken isn't able to detect this case today, so the verifier walks the impossible fallthrough branch. After regs_refine_cond_op and reg_bounds_sync refine R5 on the assumption that the branch is taken, the impossibility becomes apparent and results in an invariant violation for R5: umin32 is greater than umax32. The previous patch fixes this by using regs_refine_cond_op and reg_bounds_sync in is_branch_taken to detect the impossible branch. The fallthrough branch is therefore correctly detected as dead code. Link: https://syzkaller.appspot.com/bug?extid=c950cc277150935cc0b5 [1] Signed-off-by: Paul Chaignon Acked-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/b1e22233a3206ead522f02eda27b9c5c991a0de9.1775142354.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit b254c6d816e53ca02856b6f46b4dc56caf6e7713 Author: Harishankar Vishwanathan Date: Thu Apr 2 17:10:43 2026 +0200 bpf: Simulate branches to prune based on range violations This patch fixes the invariant violations that can happen after we refine ranges & tnum based on an incorrectly-detected branch condition. For example, the branch is always true, but we miss it in is_branch_taken; we then refine based on the branch being false and end up with incoherent ranges (e.g. umax < umin). To avoid this, we can simulate the refinement on both branches. More specifically, this patch simulates both branches taken using regs_refine_cond_op and reg_bounds_sync. If the resulting register states are ill-formed on one of the branches, is_branch_taken can mark that branch as "never taken". On a more formal note, we can deduce a branch is not taken when regs_refine_cond_op or reg_bounds_sync returns an ill-formed state because the branch operators are sound (verified with Agni [1]). Soundness means that the verifier is guaranteed to produce sound outputs on the taken branches. On the non-taken branch (explored because of imprecision in the bounds), the verifier is free to produce any output. We use ill-formedness as a signal that the branch is dead and prune that branch. This patch moves the refinement logic for both branches from reg_set_min_max to their own function, simulate_both_branches_taken, which is called from is_scalar_branch_taken. As a result, reg_set_min_max now only runs sanity checks and has been renamed to reg_bounds_sanity_check_branches to reflect that. We have had five patches fixing specific cases of invariant violations in the past, all added with selftests: - commit fbc7aef517d8 ("bpf: Fix u32/s32 bounds when ranges cross min/max boundary") - commit efc11a667878 ("bpf: Improve bounds when tnum has a single possible value") - commit f41345f47fb2 ("bpf: Use tnums for JEQ/JNE is_branch_taken logic") - commit 00bf8d0c6c9b ("bpf: Improve bounds when s64 crosses sign boundary") - commit 6279846b9b25 ("bpf: Forget ranges when refining tnum after JSET") To confirm that this patch addresses all invariant violations, we have also reverted those five commits and verified that their related selftests don't cause any invariant violation warnings anymore. Those selftests still fail but only because of misdetected branches or less-precise bounds than expected. This demonstrates that the current patch is enough to avoid the invariant violation warning AND that the previous five patches are still useful to improve branch detection. In addition to the selftests, this change was also tested with the Cilium complexity test suite: all programs were successfully loaded and it didn't change the number of processed instructions. Link: https://github.com/bpfverif/agni [1] Reported-by: syzbot+c950cc277150935cc0b5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c950cc277150935cc0b5 Co-developed-by: Paul Chaignon Signed-off-by: Paul Chaignon Co-developed-by: Srinivas Narayana Signed-off-by: Srinivas Narayana Co-developed-by: Santosh Nagarakatte Signed-off-by: Santosh Nagarakatte Signed-off-by: Harishankar Vishwanathan Acked-by: Shung-Hsi Yu Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/a166b54a3cbbbdbcdf8a87f53045f1097176218b.1775142354.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit a2a14e874b4e7ec4c4ef226f93edb94be687f7e6 Author: Harishankar Vishwanathan Date: Thu Apr 2 17:10:09 2026 +0200 bpf: Exit early if reg_bounds_sync gets invalid inputs In the subsequent commit, to prune dead branches we will rely on detecting ill-formed ranges using range_bounds_violations() (e.g., umin > umax) after refining register bounds using regs_refine_cond_op(). However, reg_bounds_sync() can sometimes "repair" ill-formed bounds, potentially masking a violation that was produced by regs_refine_cond_op(). This commit modifies reg_bounds_sync() to exit early if an invariant violation is already present in the input. This ensures ill-formed reg_states remain ill-formed after reg_bounds_sync(), allowing simulate_both_branches_taken() to correctly identify dead branches with a single check to range_bounds_violation(). Suggested-by: Eduard Zingerman Signed-off-by: Harishankar Vishwanathan Signed-off-by: Paul Chaignon Acked-by: Shung-Hsi Yu Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/73127d628841c59cb7423d6bdcd204bf90bcdc80.1775142354.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit ec1d77cb0ee98249142dcd0376d76e7a48ba0b31 Author: Paul Chaignon Date: Thu Apr 2 17:09:15 2026 +0200 bpf: Use bpf_verifier_env buffers for reg_set_min_max In a subsequent patch, the regs_refine_cond_op and reg_bounds_sync functions will be called in is_branch_taken instead of reg_set_min_max, to simulate each branch's outcome. Since they will run before we branch out, these two functions will need to work on temporary registers for the two branches. This refactoring patch prepares for that change, by introducing the temporary registers on bpf_verifier_env and using them in reg_set_min_max. This change also allows us to save one fake_reg slot as we don't need to allocate an additional temporary buffer in case of a BPF_K condition. Finally, you may notice that this patch removes the check for "false_reg1 == false_reg2" in reg_set_min_max. That check was introduced in commit d43ad9da8052 ("bpf: Skip bounds adjustment for conditional jumps on same scalar register") to avoid an invariant violation. Given that "env->false_reg1 == env->false_reg2" doesn't make sense and invariant violations are addressed in a subsequent commit, this patch just removes the check. Suggested-by: Eduard Zingerman Co-developed-by: Harishankar Vishwanathan Signed-off-by: Harishankar Vishwanathan Signed-off-by: Paul Chaignon Acked-by: Shung-Hsi Yu Acked-by: Mykyta Yatsenko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/260b0270052944a420e1c56e6a92df4d43cadf03.1775142354.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit a1311b94ef85c61b600a1ffd3b7b1ea169392115 Author: Harishankar Vishwanathan Date: Thu Apr 2 17:08:19 2026 +0200 bpf: Refactor reg_bounds_sanity_check This commit refactors reg_bounds_sanity_check to factor out the logic that performs the sanity check from the logic that does the reporting. Signed-off-by: Harishankar Vishwanathan Signed-off-by: Paul Chaignon Acked-by: Shung-Hsi Yu Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/198ec3e69343e2c46dc9cbe2b1bc9be9ae2df5bd.1775142354.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 1821f77fdaec87b31bea950ca465a96601d78ab7 Author: Bart Van Assche Date: Thu Apr 2 08:33:33 2026 -0700 scsi: aic7xxx: Fix compiler warnings triggered by user space code Fix the following compiler warnings: aicasm_gram.y:1107:24: warning: comparison of different enumeration types ('scope_type' and 'enum yytokentype') [-Wenum-compare] 1107 | || last_scope->type == T_ELSE) { | ~~~~~~~~~~~~~~~~ ^ ~~~~~~ aicasm_scan.l:392:14: warning: using the result of an assignment as a condition without parentheses [-Wparentheses] 392 | while (c = *yptr++) { | ~~^~~~~~~~~ aicasm_macro_scan.l:153:1: warning: non-void function does not return a value [-Wreturn-type] 153 | } | ^ Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260402153341.2909184-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 23c29ca113e3838e9c8473c65dbc147bd058d757 Author: Colin Ian King Date: Tue Mar 31 16:30:49 2026 +0100 scsi: ufs: ufs-qcom: Fix spelling mistake "retore" -> "restore" There is a spelling mistake in a dev_err() message. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260331153049.1344957-1-colin.i.king@gmail.com Signed-off-by: Martin K. Petersen commit 85a9a4abcdc09ee941273c99d3ad0bc2ddef09ea Author: SeungJu Cheon Date: Fri Apr 3 01:04:10 2026 +0900 perf header: Validate build_id filename length to prevent buffer overflow The build_id parsing functions calculate a filename length from the event header size and read directly into a stack buffer of PATH_MAX bytes without bounds checking. A malformed perf.data file with a crafted header.size can cause the length to be negative or exceed PATH_MAX, resulting in a stack buffer overflow. Add bounds checking for the filename length in both perf_header__read_build_ids() and the ABI quirk variant. Print a warning message when invalid length is detected. Signed-off-by: SeungJu Cheon Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit e0f4767bf403131f7ec7378d0d23ad6c29b01936 Author: Leo Yan Date: Thu Apr 2 17:04:49 2026 +0100 perf metricgroup: Refine error logs Return -ENOENT when no metric/group matches, and directly use the return value from expr__find_ids(), so -EINVAL is reserved for parse failures. Print separate logs to make it clear. Before: perf stat -C 5 -vvv Using CPUID 0x00000000410fd490 metric expr 100 * (STALL_SLOT_BACKEND / (CPU_CYCLES * #slots) - BR_MIS_PRED * 3 / CPU_CYCLES) for backend_bound parsing metric: 100 * (STALL_SLOT_BACKEND / (CPU_CYCLES * #slots) - BR_MIS_PRED * 3 / CPU_CYCLES) Failure to read '#slots' literal: #slots = nan syntax error Cannot find metric or group `Default' After: perf stat -C 5 -vvv Using CPUID 0x00000000410fd490 metric expr 100 * (STALL_SLOT_BACKEND / (CPU_CYCLES * #slots) - BR_MIS_PRED * 3 / CPU_CYCLES) for backend_bound parsing metric: 100 * (STALL_SLOT_BACKEND / (CPU_CYCLES * #slots) - BR_MIS_PRED * 3 / CPU_CYCLES) Failure to read '#slots' literal: #slots = nan syntax error Fail to parse metric or group `Default' Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit d148934beeacaf074e1e6f00fae3be737bbc4089 Author: Leo Yan Date: Thu Apr 2 17:04:48 2026 +0100 perf expr: Add '\n' in literal parse errors Add a trailing newline for logs. Before: perf stat -C 5 Failure to read '#slots'Cannot find metric or group `Default' After: perf stat -C 5 Failure to read '#slots' Cannot find metric or group `Default' Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 3a61fd866ef9aaa1d3158b460f852b74a2df07f4 Author: Leo Yan Date: Thu Apr 2 17:04:47 2026 +0100 perf expr: Return -EINVAL for syntax error in expr__find_ids() expr__find_ids() propagates the parser return value directly. For syntax errors, the parser can return a positive value, but callers treat it as success, e.g., for below case on Arm64 platform: metric expr 100 * (STALL_SLOT_BACKEND / (CPU_CYCLES * #slots) - BR_MIS_PRED * 3 / CPU_CYCLES) for backend_bound parsing metric: 100 * (STALL_SLOT_BACKEND / (CPU_CYCLES * #slots) - BR_MIS_PRED * 3 / CPU_CYCLES) Failure to read '#slots' literal: #slots = nan syntax error Convert positive parser returns in expr__find_ids() to -EINVAL, as a result, the error value will be respected by callers. Before: perf stat -C 5 Failure to read '#slots'Failure to read '#slots'Failure to read '#slots'Failure to read '#slots'Segmentation fault After: perf stat -C 5 Failure to read '#slots'Cannot find metric or group `Default' Fixes: ded80bda8bc9 ("perf expr: Migrate expr ids table to a hashmap") Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 8e8cb6f39930e836144f51cdb6d409c9e4cb71fe Author: Pengpeng Hou Date: Wed Apr 1 20:05:52 2026 +0800 scsi: hpsa: Enlarge controller and IRQ name buffers hpsa formats the controller name into h->devname[8] and derives interrupt names from it in h->intrname[][16]. Once host_no reaches four digits, "hpsa%d" no longer fits in devname, and the derived IRQ names can then overrun the interrupt-name buffers as well. The previous fix switched these builders to bounded formatting, but that would truncate user-visible controller and IRQ names. Keep the existing names intact instead by enlarging the fixed buffers to cover the current formatted strings. Fixes: 2946e82bdd76 ("hpsa: use scsi host_no as hpsa controller number") Fixes: 8b47004a5512 ("hpsa: add interrupt number to /proc/interrupts interrupt name") Acked-by: Don Brace Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260401120552.78541-1-pengpeng@iscas.ac.cn Signed-off-by: Martin K. Petersen commit 8b0e64d6c9e7feec5ba5643b4fa8b7fd54464778 Merge: 0ea7e61f65538a 4368f5fab419b4 Author: Jakub Kicinski Date: Thu Apr 2 18:05:08 2026 -0700 Merge branch 'enic-sr-iov-v2-preparatory-infrastructure' Satish Kharat says: ==================== enic: SR-IOV V2 preparatory infrastructure This is the first of four series adding SR-IOV V2 support to the enic driver for Cisco VIC 14xx/15xx adapters. The existing V1 SR-IOV implementation has VFs that interact directly with the VIC firmware, leaving the PF driver with no visibility or control over VF behavior. V2 introduces a PF-mediated model where VFs communicate with the PF through a mailbox over a dedicated admin channel. This brings enic in line with the standard Linux SR-IOV model, enabling full PF management of VFs via ip link (MAC, VLAN, link state, spoofchk, trust, and per-VF statistics). This preparatory series adds detection and resource helper code with no functional change to existing driver behavior: - Extend BAR resource discovery for admin channel resources - Register the V2 VF PCI device ID - Detect VF type (V1/V2/usNIC) from SR-IOV PCI capability - Make enic_dev_enable/disable ref-counted for shared use by data path and admin channel - Add type-aware resource allocation for admin WQ/RQ/CQ/INTR - Detect presence of admin channel resources at probe time Tested on VIC 14xx and 15xx series adapters with V2 VFs under KVM (sriov_numvfs, VF passthrough, ip link VF configuration, VF traffic). Based in part on initial work by Christian Benvenuti. ==================== Link: https://patch.msgid.link/20260401-enic-sriov-v2-prep-v4-0-d5834b2ef1b9@cisco.com Signed-off-by: Jakub Kicinski commit 4368f5fab419b43068dea912536b1f4a724b4bba Author: Satish Kharat Date: Wed Apr 1 08:31:16 2026 -0700 enic: detect admin channel resources for SR-IOV Check for the presence of admin channel BAR resources (RES_TYPE_ADMIN_WQ, ADMIN_RQ, ADMIN_CQ, SRIOV_INTR) during resource discovery. Set has_admin_channel when all four are available. Use ARRAY_SIZE(enic->admin_cq) for the admin CQ count check since the driver allocates two admin CQs (one for WQ completions, one for RQ completions) and both must be backed by hardware resources. Add admin WQ, RQ, CQ and INTR fields to struct enic for use by the upcoming admin channel open/close paths. Signed-off-by: Satish Kharat Link: https://patch.msgid.link/20260401-enic-sriov-v2-prep-v4-6-d5834b2ef1b9@cisco.com Signed-off-by: Jakub Kicinski commit 730ce15d44971204866575549683c956b3fcfe39 Author: Satish Kharat Date: Wed Apr 1 08:31:15 2026 -0700 enic: add type-aware alloc for WQ, RQ, CQ and INTR resources The existing vnic_wq_alloc(), vnic_rq_alloc(), vnic_cq_alloc() and vnic_intr_alloc() hardcode data-path resource types (RES_TYPE_WQ, RES_TYPE_RQ, RES_TYPE_CQ, RES_TYPE_INTR_CTRL). The upcoming admin channel uses different BAR resource types (RES_TYPE_ADMIN_WQ/RQ/CQ, RES_TYPE_SRIOV_INTR) for its queues. Add _with_type() variants that accept an explicit resource type parameter. Refactor the original functions as thin wrappers that pass the default data-path type. No functional change. Signed-off-by: Satish Kharat Link: https://patch.msgid.link/20260401-enic-sriov-v2-prep-v4-5-d5834b2ef1b9@cisco.com Signed-off-by: Jakub Kicinski commit 0266ecb59d5242a5d66261a671e42d53a1372f69 Author: Satish Kharat Date: Wed Apr 1 08:31:14 2026 -0700 enic: make enic_dev_enable/disable ref-counted Both the data path (ndo_open/ndo_stop) and the upcoming admin channel need to enable and disable the vNIC device independently. Without reference counting, closing the admin channel while the netdev is up would inadvertently disable the entire device. Add an enable_count to struct enic, protected by the existing devcmd_lock. enic_dev_enable() issues CMD_ENABLE_WAIT only on the first caller (0 -> 1 transition), and enic_dev_disable() issues CMD_DISABLE only when the last caller releases (1 -> 0 transition). Also check the return value of enic_dev_enable() in enic_open() and fail the open if the firmware enable command fails. Without this check, a failed enable leaves enable_count at zero while the interface appears up, which can cause a later admin channel enable/disable cycle to incorrectly disable the hardware under the active data path. Signed-off-by: Satish Kharat Link: https://patch.msgid.link/20260401-enic-sriov-v2-prep-v4-4-d5834b2ef1b9@cisco.com Signed-off-by: Jakub Kicinski commit 56a4d7a865860ac0e52e26a4c8d13de78e7a9707 Author: Satish Kharat Date: Wed Apr 1 08:31:13 2026 -0700 enic: detect SR-IOV VF type from PCI capability Read the VF device ID from the SR-IOV PCI capability at probe time to determine whether the PF is configured for V1, USNIC, or V2 virtual functions. Store the result in enic->vf_type for use by subsequent SR-IOV operations. The VF type is a firmware-configured property (set via UCSM, CIMC, Intersight etc) that is immutable from the driver's perspective. Only PFs are probed for this capability; VFs and dynamic vnics skip detection. Signed-off-by: Satish Kharat Link: https://patch.msgid.link/20260401-enic-sriov-v2-prep-v4-3-d5834b2ef1b9@cisco.com Signed-off-by: Jakub Kicinski commit 803a1b02027918450b58803190aa7cacb8056265 Author: Satish Kharat Date: Wed Apr 1 08:31:12 2026 -0700 enic: add V2 SR-IOV VF device ID Register the V2 VF PCI device ID (0x02b7) so the driver binds to V2 virtual functions created via sriov_configure. Update enic_is_sriov_vf() to recognize V2 VFs alongside the existing V1 type. Signed-off-by: Satish Kharat Link: https://patch.msgid.link/20260401-enic-sriov-v2-prep-v4-2-d5834b2ef1b9@cisco.com Signed-off-by: Jakub Kicinski commit 74fb32ed733ceacd2daa3d22471f4b10705abbbd Author: Satish Kharat Date: Wed Apr 1 08:31:11 2026 -0700 enic: extend resource discovery for SR-IOV admin channel VIC firmware exposes admin channel resources (WQ, RQ, CQ) for PF-VF communication when SR-IOV is active. Add the corresponding resource type definitions and teach the discovery and access functions to handle them. Signed-off-by: Satish Kharat Link: https://patch.msgid.link/20260401-enic-sriov-v2-prep-v4-1-d5834b2ef1b9@cisco.com Signed-off-by: Jakub Kicinski commit 0ea7e61f65538a0e6524d8781c2cea34c8073634 Merge: 86f5dd4e0ff282 70180f72d91144 Author: Jakub Kicinski Date: Thu Apr 2 18:03:07 2026 -0700 Merge branch 'net-phy-microchip-add-downshift-support-for-lan88xx' Nicolai Buchwitz says: ==================== net: phy: microchip: add downshift support for LAN88xx Add standard ETHTOOL_PHY_DOWNSHIFT tunable support for the Microchip LAN88xx PHY, following the same pattern used by Marvell and other PHY drivers. Ethernet cables with faulty or missing pairs (specifically C and D) can successfully auto-negotiate 1000BASE-T but fail to establish a stable link. The LAN88xx PHY supports automatic downshift to 100BASE-TX after a configurable number of failed attempts (2-5). Patch 1 adds the get/set tunable implementation. Patch 2 enables downshift by default with a count of 2. The setting is stored in the driver's private data so that user changes via ethtool are preserved across suspend/resume cycles. Based on an earlier downstream implementation by Phil Elwell. Tested on Raspberry Pi 3B+ (LAN7515/LAN88xx). ==================== Link: https://patch.msgid.link/20260401123848.696766-1-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit 70180f72d91144f4c7b308ffa87bbf3592cd8d65 Author: Nicolai Buchwitz Date: Wed Apr 1 14:38:45 2026 +0200 net: phy: microchip: enable downshift by default on LAN88xx Enable auto-downshift from 1000BASE-T to 100BASE-TX after 2 failed auto-negotiation attempts by default. This ensures that links with faulty or missing cable pairs (C and D) fall back to 100Mbps without requiring userspace configuration. The downshift count is stored in the driver's private data and applied in config_init, so user changes via ethtool are preserved across suspend/resume cycles. Users can override or disable downshift at runtime: ethtool --set-phy-tunable eth0 downshift off Signed-off-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260401123848.696766-3-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit e417ac73d24ae68b8dd6a1b02f9db03a7a5c184b Author: Nicolai Buchwitz Date: Wed Apr 1 14:38:44 2026 +0200 net: phy: microchip: add downshift tunable support for LAN88xx Implement the standard ETHTOOL_PHY_DOWNSHIFT tunable for the LAN88xx PHY. This allows runtime configuration of the auto-downshift feature via ethtool: ethtool --set-phy-tunable eth0 downshift on count 3 The LAN88xx PHY supports downshifting from 1000BASE-T to 100BASE-TX after 2-5 failed auto-negotiation attempts. Valid count values are 2, 3, 4 and 5. This is based on an earlier downstream implementation by Phil Elwell. Signed-off-by: Nicolai Buchwitz Reviewed-by: Andrew Lunn Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260401123848.696766-2-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit 86f5dd4e0ff282a0acf1f058e947fd5f4ba58a9d Author: Chih Kai Hsu Date: Wed Apr 1 19:55:41 2026 +0800 r8152: Add helper functions for SRAM2 Add the following helper functions for SRAM2 access to simplify the code and improve readability: - sram2_write() - write data to SRAM2 address - sram2_read() - read data from SRAM2 address - sram2_write_w0w1() - read-modify-write operation Signed-off-by: Chih Kai Hsu Reviewed-by: Hayes Wang Link: https://patch.msgid.link/20260401115542.34601-1-nic_swsd@realtek.com Signed-off-by: Jakub Kicinski commit 7eaff1eff003dc9c5881edc37741795a5dfc5ff8 Author: Daniel Wagner Date: Wed Apr 1 12:49:31 2026 +0100 net: phy: bcm84881: add LED framework support for BCM84891/BCM84892 Expose LED1 and LED2 pins via the PHY LED framework. Each pin has a source mask (MASK_LOW + MASK_EXT registers) selecting which hardware events light it, plus a CTL field in the shared 0xA83B register (RMW; LED4 is firmware-controlled per the datasheet). Hardware can offload per-speed link triggers (1000/2500/5000/10000), RX/TX activity, and force-on. LINK_100 is accepted only alongside LINK_1000: source bit 4 lights at both speeds and 100-alone isn't representable, so the unrepresentable case falls to software. The chip has five LED pins; only LED1/LED2 are exposed here as those are the only ones characterized on tested hardware. LED4 is firmware- controlled regardless of strap configuration. Tested on TRENDnet TEG-S750 (LED1/LED2 wired to an antiparallel bicolor LED): brightness_set via sysfs; netdev trigger offloaded=1 with amber lit at 100M/1G/2.5G and green lit at 10G via respective link_* modes; LED off immediately on cable unplug with no software involvement. Signed-off-by: Daniel Wagner Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260401114931.3091818-1-wagner.daniel.t@gmail.com Signed-off-by: Jakub Kicinski commit 9b79da5d691e79de2186c36400276132d31b81a5 Merge: f35340f2d653f1 0d5dc1d7aad144 Author: Jakub Kicinski Date: Thu Apr 2 17:56:37 2026 -0700 Merge branch 'macvlan-broadcast-delivery-changes' Eric Dumazet says: ==================== macvlan: broadcast delivery changes First patch adds data-race annotations. Second patch changes macvlan_broadcast_enqueue() to return early if the queue is full. ==================== Link: https://patch.msgid.link/20260401103809.3038139-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 0d5dc1d7aad144b6c561e72e96f3107d812c6026 Author: Eric Dumazet Date: Wed Apr 1 10:38:09 2026 +0000 macvlan: avoid spinlock contention in macvlan_broadcast_enqueue() Under high stress, we spend a lot of time cloning skbs, then acquiring a spinlock, then freeing the clone because the queue is full. Add a shortcut to avoid these costs under pressure. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260401103809.3038139-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1ef5789d9906df3771c99b7f413caaf2bf473ca5 Author: Eric Dumazet Date: Wed Apr 1 10:38:08 2026 +0000 macvlan: annotate data-races around port->bc_queue_len_used port->bc_queue_len_used is read and written locklessly, add READ_ONCE()/WRITE_ONCE() annotations. While WRITE_ONCE() in macvlan_fill_info() is not yet needed, it is a prereq for future RTNL avoidance. Fixes: d4bff72c8401 ("macvlan: Support for high multicast packet rate") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260401103809.3038139-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 879a4f78ea3f8ce113fb0e99b8ead85542133ceb Author: Giovanni Cabiddu Date: Sat Mar 28 22:29:47 2026 +0000 crypto: qat - add support for zstd Add support for the ZSTD algorithm for QAT GEN4, GEN5 and GEN6 via the acomp API. For GEN4 and GEN5, compression is performed in hardware using LZ4s, a QAT-specific variant of LZ4. The compressed output is post-processed to generate ZSTD sequences, and the ZSTD library is then used to produce the final ZSTD stream via zstd_compress_sequences_and_literals(). Only inputs between 8 KB and 512 KB are offloaded to the device. The minimum size restriction will be relaxed once polling support is added. The maximum size is limited by the use of pre-allocated per-CPU scratch buffers. On these generations, only compression is offloaded to hardware; decompression always falls back to software. For GEN6, both compression and decompression are offloaded to the accelerator, which natively supports the ZSTD algorithm. There is no limit on the input buffer size supported. However, since GEN6 is limited to a history size of 64 KB, decompression of frames compressed with a larger history falls back to software. Since GEN2 devices do not support ZSTD or LZ4s, add a mechanism that prevents selecting GEN2 compression instances for ZSTD or LZ4s when a GEN2 plug-in card is present on a system with an embedded GEN4, GEN5 or GEN6 device. In addition, modify the algorithm registration logic to allow registering the correct implementation, i.e. LZ4s based for GEN4 and GEN5 or native ZSTD for GEN6. Co-developed-by: Suman Kumar Chakraborty Signed-off-by: Suman Kumar Chakraborty Signed-off-by: Giovanni Cabiddu Reviewed-by: Laurent M Coquerel Signed-off-by: Herbert Xu commit 35ecb77ae0749a2f1b04872c9978d9d7ddbbeb79 Author: Giovanni Cabiddu Date: Sat Mar 28 22:29:46 2026 +0000 crypto: qat - use swab32 macro Replace __builtin_bswap32() with swab32 in icp_qat_hw_20_comp.h to fix the following build errors on architectures without native byte-swap support: alpha-linux-ld: drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.o: in function `adf_gen4_build_decomp_block': drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:141:(.text+0xeec): undefined reference to `__bswapsi2' alpha-linux-ld: drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:141:(.text+0xef8): undefined reference to `__bswapsi2' alpha-linux-ld: drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.o: in function `adf_gen4_build_comp_block': drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:57:(.text+0xf64): undefined reference to `__bswapsi2' alpha-linux-ld: drivers/crypto/intel/qat/qat_common/icp_qat_hw_20_comp.h:57:(.text+0xf7c): undefined reference to `__bswapsi2' Fixes: 5b14b2b307e4 ("crypto: qat - enable deflate for QAT GEN4") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603290259.Ig9kDOmI-lkp@intel.com/ Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit f2e25a4cf57d1d24a6920d9cb0f2bcf2b434bd8c Author: Thorsten Blum Date: Sat Mar 28 11:20:46 2026 +0100 crypto: img-hash - drop redundant return variable In img_hash_digest(), remove the redundant return variable 'err' and return img_hash_handle_queue() directly. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 3a31b7fda695da81a2e2fe6812af94e8bf61624a Author: Thorsten Blum Date: Sat Mar 28 11:20:44 2026 +0100 crypto: img-hash - use list_first_entry_or_null to simplify digest Use list_first_entry_or_null() to simplify img_hash_digest() and remove the now-unused local 'struct img_hash_dev *' variables. Use 'ctx->hdev' when calling img_hash_handle_queue() instead of 'tctx->hdev'. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit cdadc14359378c0cf02251c86ffbc606f55bfadd Author: Eric Biggers Date: Fri Mar 27 16:08:18 2026 -0700 crypto: cryptomgr - Select algorithm types only when CRYPTO_SELFTESTS Enabling any template selects CRYPTO_MANAGER, which causes CRYPTO_MANAGER2 to enable itself, which selects every algorithm type option. However, pulling in all algorithm types is needed only when the self-tests are enabled. So condition the selections accordingly. To make this possible, also add the missing selections to various symbols that were relying on transitive selections via CRYPTO_MANAGER. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 51d0f5020deeef1c678b7e3e71420b2842215662 Author: Paul Louvel Date: Fri Mar 27 10:24:18 2026 +0100 crypto: aspeed - Use memcpy_from_sglist() in aspeed_ahash_dma_prepare() Replace scatterwalk_map_and_copy() with memcpy_from_sglist() in aspeed_ahash_dma_prepare(). The latter provides a simpler interface without requiring a direction parameter, making the code easier to read and less error-prone. No functional change intended. Signed-off-by: Paul Louvel Reviewed-by: Neal Liu Signed-off-by: Herbert Xu commit 5469d16e71d65e2a71b68e0bb46eae63f9cb8965 Author: Thorsten Blum Date: Fri Mar 27 01:17:27 2026 +0100 crypto: kconfig - fix typos in atmel-ecc and atmel-sha204a help s/Microhip/Microchip/ Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 9a73869cb55051a2cdd4b039d75298e32014b25f Author: Eric Biggers Date: Thu Mar 26 13:12:45 2026 -0700 crypto: x86 - Remove des and des3_ede code Since DES and Triple DES are obsolete, there is very little point in maintining architecture-optimized code for them. Remove it. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 0e28a1a644c15f2f7786ec825220d3f28b8476b5 Author: Eric Biggers Date: Thu Mar 26 13:12:44 2026 -0700 crypto: sparc - Remove des and des3_ede code Since DES and Triple DES are obsolete, there is very little point in maintining architecture-optimized code for them. Remove it. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 622d42ef977adeae3d5a5d0eb893e4aaf1d5330c Author: Eric Biggers Date: Thu Mar 26 13:12:43 2026 -0700 crypto: s390 - Remove des and des3_ede code Since DES and Triple DES are obsolete, there is very little point in maintining architecture-optimized code for them. Remove it. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 4061bc8c03975e6491fbe9e3cd5e53d2c003c812 Author: Eric Biggers Date: Wed Mar 25 17:15:07 2026 -0700 crypto: rng - Don't pull in DRBG when CRYPTO_FIPS=n crypto_stdrng_get_bytes() is now always available: - When CRYPTO_FIPS=n it is an inline function that always calls into the always-built-in drivers/char/random.c. - When CRYPTO_FIPS=y it is an inline function that calls into either random.c or crypto/rng.c, depending on the value of fips_enabled. The former is again always built-in. The latter is built-in as well in this case, due to CRYPTO_FIPS=y. Thus, the CRYPTO_RNG_DEFAULT symbol is no longer needed. Remove it. This makes it so that CRYPTO_DRBG_MENU (and hence also CRYPTO_DRBG, CRYPTO_JITTERENTROPY, and CRYPTO_LIB_SHA3) no longer gets unnecessarily pulled into CRYPTO_FIPS=n kernels. I.e. CRYPTO_FIPS=n kernels are no longer bloated with code that is relevant only to FIPS certifications. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 7339b0e0b75eb56c3b9402bc831799138d219144 Author: Eric Biggers Date: Wed Mar 25 17:15:06 2026 -0700 crypto: fips - Depend on CRYPTO_DRBG=y Currently, the callers of crypto_stdrng_get_bytes() do 'select CRYPTO_RNG_DEFAULT', which does 'select CRYPTO_DRBG_MENU'. However, due to the change in how crypto_stdrng_get_bytes() is implemented, CRYPTO_DRBG_MENU is now needed only when CRYPTO_FIPS. But, 'select CRYPTO_DRBG_MENU if CRYPTO_FIPS' would cause a recursive dependency, since CRYPTO_FIPS 'depends on CRYPTO_DRBG'. Solve this by just making CRYPTO_FIPS depend on CRYPTO_DRBG=y (rather than CRYPTO_DRBG i.e. CRYPTO_DRBG=y || CRYPTO_DRBG=m). The distros that use CRYPTO_FIPS=y already set CRYPTO_DRBG=y anyway, which makes sense. This makes the CRYPTO_RNG_DEFAULT symbol (and its corresponding selection of CRYPTO_DRBG_MENU) unnecessary. A later commit removes it. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 65b3c2f6278516397bebcdbf4698bd3102120ca5 Author: Eric Biggers Date: Wed Mar 25 17:15:05 2026 -0700 crypto: rng - Make crypto_stdrng_get_bytes() use normal RNG in non-FIPS mode "stdrng" is needed only in "FIPS mode". Therefore, make crypto_stdrng_get_bytes() delegate to either the normal Linux RNG or to "stdrng", depending on the current mode. This will eliminate the need to built the SP800-90A DRBG and its dependencies into CRYPTO_FIPS=n kernels. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit bdd2cc93bfd051f05084115faad35f9b5402a194 Author: Eric Biggers Date: Wed Mar 25 17:15:04 2026 -0700 crypto: rng - Unexport "default RNG" symbols Now that crypto_default_rng, crypto_get_default_rng(), and crypto_put_default_rng() have no users outside crypto/rng.c itself, unexport them and make them static. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 117c3c4df23d973357a523f6dce1f63d28bbf8aa Author: Eric Biggers Date: Wed Mar 25 17:15:03 2026 -0700 net: tipc: Use crypto_stdrng_get_bytes() Replace the sequence of crypto_get_default_rng(), crypto_rng_get_bytes(), and crypto_put_default_rng() with the equivalent helper function crypto_stdrng_get_bytes(). Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit eba92a2d7e51601adae3d3b37df2e5a8a3c0de5b Author: Eric Biggers Date: Wed Mar 25 17:15:02 2026 -0700 crypto: intel/keembay-ocs-ecc - Use crypto_stdrng_get_bytes() Replace the sequence of crypto_get_default_rng(), crypto_rng_get_bytes(), and crypto_put_default_rng() with the equivalent helper function crypto_stdrng_get_bytes(). Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit c30e1bbc9549b39c33f61310302eb8ccb98c7de4 Author: Eric Biggers Date: Wed Mar 25 17:15:01 2026 -0700 crypto: hisilicon/hpre - Use crypto_stdrng_get_bytes() Replace the sequence of crypto_get_default_rng(), crypto_rng_get_bytes(), and crypto_put_default_rng() with the equivalent helper function crypto_stdrng_get_bytes(). Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit c7373a6ba57e13999af590703b63071e4f13d652 Author: Eric Biggers Date: Wed Mar 25 17:15:00 2026 -0700 crypto: geniv - Use crypto_stdrng_get_bytes() Replace the sequence of crypto_get_default_rng(), crypto_rng_get_bytes(), and crypto_put_default_rng() with the equivalent helper function crypto_stdrng_get_bytes(). Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit d6ea871d73abbb6a1e00e71ed5762e394d06cb2b Author: Eric Biggers Date: Wed Mar 25 17:14:59 2026 -0700 crypto: ecc - Use crypto_stdrng_get_bytes() Replace the sequence of crypto_get_default_rng(), crypto_rng_get_bytes(), and crypto_put_default_rng() with the equivalent helper function crypto_stdrng_get_bytes(). Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 9e9ff291c9776c109a198eab5b5ac3828abf8507 Author: Eric Biggers Date: Wed Mar 25 17:14:58 2026 -0700 crypto: dh - Use crypto_stdrng_get_bytes() Replace the sequence of crypto_get_default_rng(), crypto_rng_get_bytes(), and crypto_put_default_rng() with the equivalent helper function crypto_stdrng_get_bytes(). Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 52b84667bbdc656b380983262ac6303caf49ef2c Author: Eric Biggers Date: Wed Mar 25 17:14:57 2026 -0700 crypto: rng - Add crypto_stdrng_get_bytes() All callers of crypto_get_default_rng() use the following sequence: crypto_get_default_rng() crypto_rng_get_bytes(crypto_default_rng, ...) crypto_put_default_rng() While it may have been intended that callers amortize the cost of getting and putting the "default RNG" (i.e. "stdrng") over multiple calls, in practice that optimization is never used. The callers just want a function that gets random bytes from the "stdrng". Therefore, add such a function: crypto_stdrng_get_bytes(). Importantly, this decouples the callers from the crypto_rng API. That allows a later commit to make this function simply call get_random_bytes_wait() unless the kernel is in "FIPS mode". Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 590fa5d69c27cfaecd2e8287aec78f902417c877 Author: Giovanni Cabiddu Date: Tue Mar 24 18:29:05 2026 +0000 crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() The cpu counter used to compute the IAA device index is reset to zero at the start of each NUMA node iteration. This causes CPUs on every node to map starting from IAA index 0 instead of continuing from the previous node's last index. On multi-node systems, this results in all nodes mapping their CPUs to the same initial set of IAA devices, leaving higher-indexed devices unused. Move the cpu counter initialization before the for_each_node_with_cpus() loop so that the IAA index computation accumulates correctly across all nodes. Fixes: 714ca27e9bf4 ("crypto: iaa - Optimize rebalance_wq_table()") Signed-off-by: Giovanni Cabiddu Acked-by: Vinicius Costa Gomes Signed-off-by: Herbert Xu commit 6bd87f2ea5b2d44ed1f43a90f220be34f7c1ce4e Author: Atharv Dubey Date: Tue Mar 24 18:17:24 2026 +0000 crypto: qat - replace scnprintf() with sysfs_emit() Replace scnprintf() with sysfs_emit() in the three RAS error counter sysfs show callbacks. sysfs_emit() is the recommended API for sysfs show functions as per Documentation/filesystems/sysfs.rst; it enforces the PAGE_SIZE limit implicitly, removing the need to pass it explicitly. Signed-off-by: Atharv Dubey Signed-off-by: Giovanni Cabiddu Reviewed-by: Ahsan Atta Reviewed-by: Andy Shevchenko Signed-off-by: Herbert Xu commit ec23d75c4b77ae42af0777ea59599b1d4f611371 Author: Giovanni Cabiddu Date: Tue Mar 24 18:17:23 2026 +0000 crypto: qat - fix type mismatch in RAS sysfs show functions ADF_RAS_ERR_CTR_READ() expands to atomic_read(), which returns int. The local variable 'counter' was declared as 'unsigned long', causing a type mismatch on the assignment. The format specifier '%ld' was consequently wrong in two ways: wrong length modifier and wrong signedness. Use int to match the return type of atomic_read() and update the format specifier to '%d' accordingly. Fixes: 532d7f6bc458 ("crypto: qat - add error counters") Signed-off-by: Giovanni Cabiddu Reviewed-by: Ahsan Atta Reviewed-by: Andy Shevchenko Signed-off-by: Herbert Xu commit 795c24c677c7a1c12f5768daf22a874a2890662f Author: Giovanni Cabiddu Date: Tue Mar 24 17:59:40 2026 +0000 crypto: qat - fix compression instance leak qat_comp_alg_init_tfm() acquires a compression instance via qat_compression_get_instance_node() before calling qat_comp_build_ctx() to initialize the compression context. If qat_comp_build_ctx() fails, the function returns an error without releasing the compression instance, causing a resource leak. When qat_comp_build_ctx() fails, release the compression instance with qat_compression_put_instance() and clear the context to avoid leaving a stale reference to the released instance. The issue was introduced when build_deflate_ctx() (which always returned void) was replaced by qat_comp_build_ctx() (which can return an error) without adding error handling for the failure path. Fixes: cd0e7160f80f ("crypto: qat - refactor compression template logic") Signed-off-by: Giovanni Cabiddu Reviewed-by: Laurent M Coquerel Reviewed-by: Ahsan Atta Reviewed-by: Wojciech Drewek Signed-off-by: Herbert Xu commit 4e04f469b41f527fffa5dc92aae437b1f1d8bff1 Author: Giovanni Cabiddu Date: Tue Mar 24 16:52:11 2026 +0000 crypto: qat - use acomp_tfm_ctx() Replace the usage of crypto_acomp_tfm() followed by crypto_tfm_ctx() with a single call to the equivalent acomp_tfm_ctx(). This does not introduce any functional changes. Signed-off-by: Giovanni Cabiddu Reviewed-by: Laurent M Coquerel Reviewed-by: Andy Shevchenko Signed-off-by: Herbert Xu commit ee31b703e808f75a98b958305fbf2765a4e172a9 Author: Thorsten Blum Date: Tue Mar 24 12:30:07 2026 +0100 crypto: ccp - Replace snprintf("%s") with strscpy Replace snprintf("%s") with the faster and more direct strscpy(). Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit d7f3162ff802b5c39e3c449be8bccd297a4d7267 Author: Thorsten Blum Date: Tue Mar 24 12:27:05 2026 +0100 crypto: hifn_795x - Replace snprintf("%s") with strscpy Replace snprintf("%s", ...) with the faster and more direct strscpy(). Check if the return value is less than 0 to detect string truncation. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit f216e0f2d1787e662bb6662c9c522185aa3b855a Author: Ahsan Atta Date: Tue Mar 24 11:12:34 2026 +0000 crypto: qat - disable 420xx AE cluster when lead engine is fused off The get_ae_mask() function only disables individual engines based on the fuse register, but engines are organized in clusters of 4. If the lead engine of a cluster is fused off, the entire cluster must be disabled. Replace the single bitmask inversion with explicit test_bit() checks on the lead engine of each group, disabling the full ADF_AE_GROUP when the lead bit is set. Signed-off-by: Ahsan Atta Reviewed-by: Giovanni Cabiddu Fixes: fcf60f4bcf54 ("crypto: qat - add support for 420xx devices") Signed-off-by: Herbert Xu commit b260d53561dd69b29505222ec44cf386ac2c2ca6 Author: Ahsan Atta Date: Tue Mar 24 11:11:12 2026 +0000 crypto: qat - disable 4xxx AE cluster when lead engine is fused off The get_ae_mask() function only disables individual engines based on the fuse register, but engines are organized in clusters of 4. If the lead engine of a cluster is fused off, the entire cluster must be disabled. Replace the single bitmask inversion with explicit test_bit() checks on the lead engine of each group, disabling the full ADF_AE_GROUP when the lead bit is set. Signed-off-by: Ahsan Atta Reviewed-by: Giovanni Cabiddu Fixes: 8c8268166e834 ("crypto: qat - add qat_4xxx driver") Signed-off-by: Herbert Xu commit c8aadd63ab58ee75713ab487730563e7a160cc35 Author: Aleksander Jan Bajkowski Date: Tue Mar 3 19:48:44 2026 +0100 crypto: testmgr - Add test vectors for authenc(hmac(md5),cbc(aes)) Test vectors were generated starting from existing CBC(AES) test vectors (RFC3602, NIST SP800-38A) and adding HMAC(MD5) computed with Python script. Then, the results were double-checked on Mediatek MT7981 (safexcel) and NXP P2020 (talitos). Both platforms pass self-tests. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit fc0a1d05e494fd218a51e46f6664d1e14d4327ea Merge: 2dfb80cc3580dc 01f784fc9d0ab2 Author: Martin K. Petersen Date: Thu Apr 2 20:31:22 2026 -0400 Merge branch 7.0/scsi-fixes into 7.1/scsi-staging Pull in fixes to resolve mpi3mr merge conflict. Signed-off-by: Martin K. Petersen commit 8fdef85d601db670e9c178314eedffe7bbb07e52 Author: Ard Biesheuvel Date: Mon Mar 30 16:46:35 2026 +0200 lib/crc: arm64: Simplify intrinsics implementation NEON intrinsics are useful because they remove the need for manual register allocation, and the resulting code can be re-compiled and optimized for different micro-architectures, and shared between arm64 and 32-bit ARM. However, the strong typing of the vector variables can lead to incomprehensible gibberish, as is the case with the new CRC64 implementation. To address this, let's repaint all variables as uint64x2_t to minimize the number of vreinterpretq_xxx() calls, and to be able to rely on the ^ operator for exclusive OR operations. This makes the code much more concise and readable. While at it, wrap the calls to vmull_p64() et al in order to have a more consistent calling convention, and encapsulate any remaining vreinterpret() calls that are still needed. Signed-off-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260330144630.33026-11-ardb@kernel.org Signed-off-by: Eric Biggers commit f956dc813144baf8bd2d77eec61b90bc00c10894 Author: Ard Biesheuvel Date: Mon Mar 30 16:46:33 2026 +0200 lib/crc: arm64: Use existing macros for kernel-mode FPU cflags Use the existing CC_FPU_CFLAGS and CC_NO_FPU_CFLAGS to pass the appropriate compiler command line options for building kernel mode NEON intrinsics code. This is tidier, and will make it easier to reuse the code for 32-bit ARM. Signed-off-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260330144630.33026-9-ardb@kernel.org Signed-off-by: Eric Biggers commit e0718ed60d60299840cfc2a408eb26042a20d186 Author: Ard Biesheuvel Date: Mon Mar 30 16:46:32 2026 +0200 lib/crc: arm64: Drop unnecessary chunking logic from crc64 On arm64, kernel mode NEON executes with preemption enabled, so there is no need to chunk the input by hand. Signed-off-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260330144630.33026-8-ardb@kernel.org Signed-off-by: Eric Biggers commit 5276ea17a23c829d4e4417569abff71a1c8342d9 Author: Eric Biggers Date: Tue Mar 31 17:44:31 2026 -0700 lib/crc: arm64: Assume a little-endian kernel Since support for big-endian arm64 kernels was removed, the CPU_LE() macro now unconditionally emits the code it is passed, and the CPU_BE() macro now unconditionally discards the code it is passed. Simplify the assembly code in lib/crc/arm64/ accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260401004431.151432-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 3177779ae17db4c66c851f799505fb95c7530c03 Author: Jori Koolstra Date: Fri Mar 6 19:33:17 2026 +0100 virt: coco: change tsm_class to a const struct The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Change tsm_class to be a const struct class and drop the class_create() call. Compile tested only. Link: https://lore.kernel.org/all/2023040244-duffel-pushpin-f738@gregkh/ Changes with v1: - Removed redundant int err variable. Suggested-by: Greg Kroah-Hartman Signed-off-by: Jori Koolstra Reviewed-by: Thomas Weißschuh Link: https://patch.msgid.link/20260306183325.245254-1-jkoolstra@xs4all.nl Signed-off-by: Dan Williams commit 98d68b74ebb9d5f145960ff7d96ce8e7a39fb965 Author: Casey Connolly Date: Sun Mar 15 20:40:16 2026 +0100 power: supply: qcom_smbx: allow disabling charging Hook up USBIN_CMD_IL so that writing "0" to the status register will disable charging, this is useful to let users limit charging automatically. Signed-off-by: Casey Connolly Reviewed-by: Konrad Dybcio Signed-off-by: David Heidelberg Link: https://patch.msgid.link/20260315-smb2-cherry-pick-v1-1-b2710e470490@ixit.cz Signed-off-by: Sebastian Reichel commit 0629c33fe1873a48e1e06078409de76c5a159fdb Author: Bartosz Golaszewski Date: Mon Mar 16 10:45:28 2026 +0100 power: reset: drop unneeded dependencies on OF_GPIO OF_GPIO is selected automatically on all OF systems. Any symbols it controls also provide stubs so there's really no reason to select it explicitly. For Kconfig entries that have no other dependencies: convert it to requiring OF to avoid new symbols popping up for everyone in make config, for others just drop it altogether. Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260316-gpio-of-kconfig-v2-8-de2f4b00a0e4@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit 7487d8db3336839567aabae24618a4f2f2f2adad Author: Alex Williamson Date: Tue Mar 31 14:24:41 2026 -0600 vfio/pci: Require vfio_device_ops.name vfio-pci-core code makes use of the vfio_device_ops.name field in order to set a default driver_override for VFs created on a user-owned PF. This avoids default driver matching, which might otherwise bind those VFs to native drivers. The mechanism for this currently uses kasprintf(), which will set driver_override to the literal "(null)" if name is NULL. This is effective in sequestering the device, but presents a challenging debug situation to differentiate driver_override being set to "(null)" versus being NULL and interpreted as "(null)" via the sysfs show attribute. There's also a tree-wide effort to convert to generic driver_override support, where passing NULL will generate an error, resulting in a WARN_ON without setting any driver_override. All drivers making use of vfio-pci-core already set a driver name, therefore by requiring this behavior, all of these corner cases are rendered moot. This is expected to have no impact on current in-kernel drivers. Suggested-by: Danilo Krummrich Signed-off-by: Alex Williamson Reviewed-by: Danilo Krummrich Link: https://lore.kernel.org/r/20260331202443.2598404-1-alex.williamson@nvidia.com Signed-off-by: Alex Williamson commit be353c6729d087925da702cf8c0ad3cb1ae53dec Author: Andreas Kemnade Date: Wed Apr 1 23:17:05 2026 +0200 power: supply: bd71828: add input current limit property Add input current property to be able to work around issues created by automatic input limiting and have some control. Disabling the automatic management is another step. Signed-off-by: Andreas Kemnade Link: https://patch.msgid.link/20260401-bd-inp-limit-v1-1-689eb22531e2@kemnade.info Signed-off-by: Sebastian Reichel commit cd3b3094df0ee0f147957e7a7a1103990fdd6641 Author: Thorsten Blum Date: Mon Mar 30 12:35:17 2026 +0200 ecryptfs: Drop TODO comment in ecryptfs_derive_iv Remove the TODO from 2006. eCryptfs is generally not receiving new features and changing the IV derivation is only likely to happen to address security concerns in the future. Signed-off-by: Thorsten Blum [tyhicks: Add the reasoning to the commit message] Signed-off-by: Tyler Hicks commit c8717a7fa5d2ea9048f398c16ab61d8e4c8f83b8 Author: Thorsten Blum Date: Mon Mar 30 12:35:15 2026 +0200 ecryptfs: Fix typo in ecryptfs_derive_iv function comment s/vale/value/ Signed-off-by: Thorsten Blum Signed-off-by: Tyler Hicks commit 7e85ca02ef3aa2f37ce6dbba820f55b385330ce9 Merge: e8aec1058ca598 63f5156a9c3e85 Author: Alexei Starovoitov Date: Thu Apr 2 15:11:08 2026 -0700 Merge branch 'task-local-data-bug-fixes-and-improvement' Amery Hung says: ==================== Task local data bug fixes and improvement This patchset fixed three task local data bugs, improved the memory allocation code, and dropped unnecessary TLD_READ_ONCE. Please find the detail in each patch's commit msg. One thing worth mentioning is that Patch 3 allows us to renable task local data selftests as the library now always calls aligned_alloc() with size matching alignment under default configuration. v1 -> v2 - Fix potential memory leak - Drop TLD_READ_ONCE() Link: https://lore.kernel.org/bpf/20260326052437.590158-1-ameryhung@gmail.com/ ==================== Link: https://patch.msgid.link/20260331213555.1993883-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 63f5156a9c3e85ecfcc0127df6069cd7baa7eeb0 Author: Amery Hung Date: Tue Mar 31 14:35:55 2026 -0700 selftests/bpf: Improve task local data documentation and fix potential memory leak If TLD_FREE_DATA_ON_THREAD_EXIT is not enabled in a translation unit that calls __tld_create_key() first, another translation unit that enables it will not get the auto cleanup feature as pthread key is only created once when allocation metadata. Fix it by always try to create the pthread key when __tld_create_key() is called. Also improve the documentation: - Discourage user from using different options in different translation units - Specify calling tld_free() before thread exit as undefined behavior Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260331213555.1993883-6-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 0b481a6915ed649f12ae0a9625206781bfdcc705 Author: Amery Hung Date: Tue Mar 31 14:35:54 2026 -0700 selftests/bpf: Remove TLD_READ_ONCE() in the user space header TLD_READ_ONCE() is redundant as the only reference passed to it is defined as _Atomic. The load is guaranteed to be atomic in C11 standard (6.2.6.1). Drop the macro. Signed-off-by: Amery Hung Acked-by: Sun Jian Link: https://lore.kernel.org/r/20260331213555.1993883-5-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 80aa8e9c64d0351f8bb215816e1b2277240c9e11 Author: Amery Hung Date: Tue Mar 31 14:35:53 2026 -0700 selftests/bpf: Make sure TLD_DEFINE_KEY runs first Without specifying constructor priority of the hidden constructor function defined by TLD_DEFINE_KEY, __tld_create_key(..., dyn_data = false) may run after tld_get_data() called from other constructors. Threads calling tld_get_data() before __tld_create_key(..., dyn_data = false) will not allocate enough memory for all TLDs and later result in OOB access. Therefore, set it to the lowest value available to users. Note that lower means higher priority and 0-100 is reserved to the compiler. Acked-by: Mykyta Yatsenko Signed-off-by: Amery Hung Acked-by: Sun Jian Link: https://lore.kernel.org/r/20260331213555.1993883-4-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit bb6d9f5cf1d407150658dc5c0dfa566ab2ec09ab Author: Amery Hung Date: Tue Mar 31 14:35:52 2026 -0700 selftests/bpf: Simplify task_local_data memory allocation Simplify data allocation by always using aligned_alloc() and passing size_pot, size rounded up to the closest power of two to alignment. Currently, aligned_alloc(page_size, size) is only intended to be used with memory allocators that can fulfill the request without rounding size up to page_size to conserve memory. This is enabled by defining TLD_DATA_USE_ALIGNED_ALLOC. The reason to align to page_size is due to the limitation of UPTR where only a page can be pinned to the kernel. Otherwise, malloc(size * 2) is used to allocate memory for data. However, we don't need to call aligned_alloc(page_size, size) to get a contiguous memory of size bytes within a page. aligned_alloc(size_pot, ...) will also do the trick. Therefore, just use aligned_alloc(size_pot, ...) universally. As for the size argument, create a new option, TLD_DONT_ROUND_UP_DATA_SIZE, to specify not rounding up the size. This preserves the current TLD_DATA_USE_ALIGNED_ALLOC behavior, allowing memory allocators with low overhead aligned_alloc() to not waste memory. To enable this, users need to make sure it is not an undefined behavior for the memory allocator to have size not being an integral multiple of alignment. Compared to the current implementation, !TLD_DATA_USE_ALIGNED_ALLOC used to always waste size-byte of memory due to malloc(size * 2). Now the worst case becomes size - 1 and the best case is 0 when the size is already a power of two. Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260331213555.1993883-3-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 7c8ca532a7413b9ecf533d870641e9cff333d685 Author: Amery Hung Date: Tue Mar 31 14:35:51 2026 -0700 selftests/bpf: Fix task_local_data data allocation size Currently, when allocating memory for data, size of tld_data_u->start is not taken into account. This may cause OOB access. Fixed it by adding the non-flexible array part of tld_data_u. Besides, explicitly align tld_data_u->data to 8 bytes in case some fields are added before data in the future. It could break the assumption that every data field is 8 byte aligned and sizeof(tld_data_u) will no longer be equal to offsetof(struct tld_data_u, data), which we use interchangeably. Signed-off-by: Amery Hung Acked-by: Sun Jian Link: https://lore.kernel.org/r/20260331213555.1993883-2-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 8366b60cbea2fbf4263e68da39dc848ea1793568 Merge: 197da801f1f5f9 b683730e27ba4f Author: Arnd Bergmann Date: Fri Apr 3 00:08:34 2026 +0200 Merge tag 'qcom-arm64-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm64 DeviceTree updates for v7.1 Introduce the Eliza, Glymur, Mahua, and IPQ5210 Qualcomm SoCs. Introduce the Redmi 4A, Redmi Go, Arduino Monza (VENTUNO Q), Redmi Note 8T, Purwa EVK, ECS Liva QCS710, additional variants of the DB820c, Ayaneo Pocket S2, Thundercomm AI Mini PC G1, Samsung Galaxy Core Prime LTE Verizon Wireless, Wiko Pulp 4G, the Purwa-variant of ASUS Vivobook S15, the Eliza MTP, and the Glymur and Mahua CRDs. Introduce UFS support and flatten the DWC3 node on Hamoa. Enable UFS, SDC, DisplayPort audio playback, and an EL2 overlay for the Hamoa IoT EVK. Enable DisplayPort audio on the Hamoa CRD and add HDMI support on the ASUS Zenbook A14. Reduce the duplication of thermal sensors across Purwa and Hamoa. Add the QPIC SPI NAND controller on IPQ5332 and IPQ9574. Describe and enable the eMMC controller on IPQ9574. Add display, audio/compute remoteprocs, QUP devices, thermal sensors, display, and CoreSight on the Kaanapali platform. Enable audio, compute display, PMIC, Bluetooth, and WiFi on the MTP. Describe PMIC, audio and compute remoteprocs on QRD. Add role-switching support for the tertiary USB controller on Lemans. Enable the tertiary USB controller and the GPIO expander on the Lemans EVK, and add an overlay for the IFP Mezzanine. Add UFS, camera control interface, audio GPR, and FastRPC support on Milos. Enable UFS, camera EEPROMs, and hall effect sensor on the Fairphone FP6. Add camera control interface and fix a variety of things on the Monaco platform, add missing FastRPC compute banks. Add eMMC support, describe the DisplayPort bridge and GPIO expander on the Monaco EVK. Add overlay for EVK camera and the IFP mezzanine. Add touchscreen to the Xiaomi Redmi 4A, 5A, and Go, and fix the board-id on the 4A. Add the ambient light and proximity sensor on the Asus ZenFone 2 Laser/Selfie. On Kodiak-based boards, enable the ethernet and USB Type-A ports on the Rb3Gen2, correct the LT9611 routing on the RubikPi3, add Bluetooth on the IDP, and add front camera support on the Fairphone FP5. Introduce an overlay for the Rb3Gen2 Industrial Mezzanine. Describe DSI on the Monaco SoC and enable Bluetooth, WiFi and DSI/DP bridge on the Ride board. Describe the WiFi/BT combo chip properly on the QRB2210 RB1 and QRB4210. The describe the DSI/DP bringde on the Arduino UnoQ. 01022af2d218 arm64: dts: qcom: sc7280-chrome-common: disable Venus Introduce DSI display support on SC8280XP. Add LLCC on SDM670 and another SPI controller on SDM630. Properly describe the WiFi/BT chip on a variety of SDM845-based devices. Introduce the "alert slider" on the OnePlus 6 and OnePlus 6T devices. Introduce the PRNG, describe the debug UART, and add the MDSS core reset on SM6125. Enable the debug UART and fix various issues on the Xiaomi Redmi Note 8. Describe the touchscreen on the Xiaomi Mi A3. Properly describe the WiFi/BT combo chip in SM8150 HDK. Improve the EAS properties on SM8550, in addition to various other fixes. Introduce a new overlay for the HDK display card. Introduce various smaller fixes across SM8450 and SM8650. Add display support on SM8750 and enable DSI and DisplayPort on the MTP. Also add tsens and thermal-zones. Add ETR devices, flatten the USB controller node, and mark USB controllers as wakeup-capable devices, on Talos. Properly describe the IPA IMEM slice on a variety of platforms. Drop redundant non-controllable regulator definitions from a variety of boards. Drop redundant VSYNC pin state definition from various platforms. * tag 'qcom-arm64-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (254 commits) arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP arm64: dts: qcom: sm8550-hdk: add support for the Display Card overlay arm64: dts: qcom: msm8916-samsung-coreprimeltevzw: add device tree dt-bindings: qcom: Document samsung,coreprimeltevzw arm64: dts: qcom: msm8916-samsung-fortuna: Move SM5504 from rossa and refactor MUIC arm64: dts: qcom: sdm670: add llcc arm64: dts: qcom: qcm6490-fairphone-fp5: Add front camera support arm64: dts: qcom: qcm6490-fairphone-fp5: Sort pinctrl nodes by pins arm64: dts: qcom: milos-fairphone-fp6: Add camera EEPROMs on CCI busses arm64: dts: qcom: milos: Add CCI busses arm64: dts: qcom: purwa-iot-evk: Enable UFS arm64: dts: qcom: eliza: Add thermal sensors arm64: dts: qcom: sc8280xp: Add dsi nodes on SC8280XP arm64: dts: qcom: sdm845-oneplus: Describe Wi-Fi/BT properly arm64: dts: qcom: sdm845-google: Describe Wi-Fi/BT properly arm64: dts: qcom: drop redundant zap-shader memory-region arm64: dts: qcom: fix remaining gpu_zap_shader labels arm64: dts: qcom: msm8996: fix indentation in sdhc2 node arm64: dts: qcom: monaco-evk: enable UART6 for robot expansion board arm64: dts: qcom: lemans-evk: enable UART0 for robot expansion board ... Signed-off-by: Arnd Bergmann commit 197da801f1f5f91e15d282a919288348a11fedb0 Merge: 13c4068f84d600 2c4059f54f65ff Author: Arnd Bergmann Date: Thu Apr 2 23:23:51 2026 +0200 Merge tag 'omap-for-v7.1/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/arm ARM: soc/omap updates for v7.1 * tag 'omap-for-v7.1/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: omap2: dead code cleanup in kconfig for ARCH_OMAP4 ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX ARM: omap: fix all kernel-doc warnings ARM: omap2: Replace scnprintf with strscpy in omap3_cpuinfo Signed-off-by: Arnd Bergmann commit 13c4068f84d600a76ebb55ba42416712ba393f0e Merge: 44b5179e092426 6cb4ec63ba9a58 Author: Arnd Bergmann Date: Thu Apr 2 23:34:43 2026 +0200 Merge tag 'v7.1-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/arm New board, the Khadas Edge 2L. Newly added peripherals are the OTP nvmem controllers for RK3528, RK3562 and RK3566/8, SPDIF on RK3576. The RK3566/8 SoCs now also control the Pipe-clocks on their PCIe controllers and UFSHC controller on RK3576 got an additional reset line. Apart from that are of course individual board changes and fixes for older issues that are not specific to the current development cycle. * tag 'v7.1-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (44 commits) arm64: dts: rockchip: configure hdmirx in Rock 5 ITX arm64: dts: rockchip: assign pipe clock to rk356x PCIe lanes arm64: dts: rockchip: Add mphy reset to ufshc node arm64: dts: rockchip: Enable OTP controller for RK3528 arm64: dts: rockchip: Enable OTP controller for RK356x arm64: dts: rockchip: Enable OTP controller for RK3562 arm64: dts: rockchip: Enable PCIe CLKREQ# for RK3588 on Rock 5b-5bp-5t series arm64: dts: rockchip: add SD/eMMC aliases for ArmSom Sige5 arm64: dts: rockchip: Add SPDIF nodes to RK3576 device tree arm64: dts: rockchip: Add Khadas Edge 2L board dt-bindings: arm: rockchip: Add Khadas Edge 2L board arm64: dts: rockchip: Fix RK3562 EVB2 model name arm64: dts: rockchip: Correct Joystick Axes on Gameforce Ace arm64: dts: rockchip: Correct Fan Supply for Gameforce Ace Revert "arm64: dts: rockchip: add SPDIF audio to Beelink A1" arm64: dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi arm64: dts: rockchip: enable vicap dvp on wolfvision pf5 io expander arm64: dts: rockchip: Add analog audio switches to RK3576 EVB1 arm64: dts: rockchip: Enable GPU on rk3566-pinenote arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config ... Signed-off-by: Arnd Bergmann commit 44b5179e09242620a2be5a9099dcc0f146d0aba3 Merge: e00482b58f6da2 47c806de9e9cf1 Author: Arnd Bergmann Date: Fri Apr 3 00:03:46 2026 +0200 Merge tag 'ti-k3-dt-for-v7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/arm TI K3 device tree updates for v7.1 Generic Fixes/Cleanups: - k3-pinctrl: Cleanup alignment and reorder macros - ti,min-output-impedance addition to all K3 board DT files SoC Specific Features and Fixes: AM62L: - Add RNG node - Support cpufreq scaling J721S2: - Make MAIN domain system control bus a simple-bus - Add second DSI node J722S: - Add main_i2c4 device node J7200: - Make MAIN domain system control bus a simple-bus Board Specific Features and Fixes: AM642 EVM: - Add ICSSG0 overlay for dual EMAC support AM62: - LP-SK: Enable internal pulls for MMC0 data pins - SK: Enable Main UART wakeup - phycore-som: Add 128MiB of global CMA - Verdin: Add Zinnia board support and misc cleanup AM62A7-SK: - Enable Main UART wakeup - Fix pin name in comment from M19 to N22 AM62D2 EVM: - Enable Main UART wakeup and set wakeup-source system-states AM62L3 EVM: - Disable MMC1 internal pulls on data pins - Enable Main UART wakeup and enable wkup_uart0 pins/target node AM62P: - SK: Disable MMC1 internal pulls on data pins and enable Main UART wakeup - Verdin: Add Zinnia support and misc cleanup AM68 PHYBoard: - Add DSI->LVDS bridge, LVDS-Display overlay and PEB-AV-15 overlay AM69 Aquila: - Fix DP regulator enable GPIO J721S2 CPB: - Add QSPI flash partition details Removal of SMARC-sAM67 board: - Kontron SMARC-sAM67 board support along with all bindings are dropped as board is no longer planned for production * tag 'ti-k3-dt-for-v7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: (47 commits) arm64: dts: ti: k3-pinctrl: sort shift values numerically arm64: dts: ti: k3-pinctrl: consistently use tabs for alignment arm64: dts: ti: k3-am642-evm: Add ICSSG0 overlay for dual EMAC support arm64: dts: ti: k3-am62p-verdin: Add Zinnia arm64: dts: ti: k3-am62p-verdin: Add SPI_1_CS as GPIO arm64: dts: ti: k3-am62p-verdin: Split UART_2 pinctrl group arm64: dts: ti: k3-am62-verdin: Add Zinnia arm64: dts: ti: k3-am62-verdin: Split UART_2 pinctrl group arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label dt-bindings: arm: ti: Add verdin am62/am62p zinnia board arm64: dts: ti: k3-j721s2: Make MAIN domain system control bus a simple-bus arm64: dts: ti: k3-j7200: Make MAIN domain system control bus a simple-bus arm64: dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins arm64: dts: ti: k3-am62l3-evm: Disable MMC1 internal pulls on data pins arm64: dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins arm64: dts: ti: k3-am62d2-evm: Enable Main UART wakeup arm64: dts: ti: k3-am62l3-evm: Enable Main UART wakeup arm64: dts: ti: k3-am62p5-sk: Enable Main UART wakeup arm64: dts: ti: k3-am62a7-sk: Enable Main UART wakeup arm64: dts: ti: k3-am62x-sk-common: Enable Main UART wakeup ... Signed-off-by: Arnd Bergmann commit e00482b58f6da2417e7e606189632bc0b547cd06 Author: Gopi Krishna Menon Date: Sun Mar 29 18:04:44 2026 +0530 ARM: dts: st: spear: remove undocumented thermal_flags property spear13xx.dtsi defines a thermal_flags property in spear thermal sensor node which is both unused in kernel and undocumented in spear thermal sensor's binding. There were no dtbs_check warnings associated with this property as the underlying spear thermal binding was not converted to DTSchema. Most likely st,thermal-flags is a misspelling of thermal_flags in spear13xx.dtsi. Since both st/spear1310.dtsi and st/spear1340.dtsi define st,thermal-flags property in spear thermal sensor node, we can safely remove this property from spear13xx.dtsi. Signed-off-by: Gopi Krishna Menon Reviewed-by: Krzysztof Kozlowski Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20260329123449.309814-3-krishnagopi487@gmail.com Signed-off-by: Arnd Bergmann commit 16695153f8af940c55d21ee270ca0faef7414b30 Merge: 9ac420358dd8e0 9ceb17ccd15ea3 Author: Arnd Bergmann Date: Thu Apr 2 23:23:51 2026 +0200 Merge tag 'omap-for-v7.1/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/arm ARM: soc/omap updates for v7.1 * tag 'omap-for-v7.1/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: omap2: dead code cleanup in kconfig for ARCH_OMAP4 ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX ARM: omap: fix all kernel-doc warnings ARM: omap2: Replace scnprintf with strscpy in omap3_cpuinfo Signed-off-by: Arnd Bergmann commit a66cc657ef52c7b9028b4d4d79af7b7ce31b32f2 Merge: fbf57f25f032bf d6e766e391ef0b Author: Arnd Bergmann Date: Thu Apr 2 23:19:51 2026 +0200 Merge tag 'qcom-drivers-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers Qualcomm driver updates for v7.1 Add ECS LIVA QC710, Glymur CRD, Mahua CRD, Purwa IoT EVK, and Asus Vivobook to the QSEECOM allow-list, to enable UEFI variable access through uefisecapp. Register the Gunyah watchdog device if the SCM driver finds itself running under Gunyah. Clean up some locking using guards. Handle possible cases where AOSS cooling state is given a non-boolean state. Replace LLCC per-slice activation bitmap with reference counting. Also add SDM670 support. Improve probe deferral handling in the OCMEM driver. Add Milos, QCS615, Eliza, Glymur, and Mahua support to the pd-mapper. Add support for SoCCP-based pmic-glink, as found in Glymur and Kaanapali. Add common QMI service ids to the main qmi headerfile, to avoid spreading these constants in various drivers. Add support for version 2 of SMP2P and implement the irqchip state reading support. Add CQ7790, SA8650P, SM7450, SM7450P, and IPQ5210 SoC and the PM7550BA PMIC identifiers to the socinfo driver. Add Eliza and Mahua support to the UBWC driver, introduce helpers for drivers to read out min_acc length and other programmable values, and disable bank swizzling for Glymur. Simplify the logic related to allocation of NV download request in the WCNSS control driver. * tag 'qcom-drivers-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (51 commits) soc: qcom: ubwc: add helpers to get programmable values soc: qcom: ubwc: add helper to get min_acc length firmware: qcom: scm: Register gunyah watchdog device soc: qcom: socinfo: Add SoC ID for SA8650P dt-bindings: arm: qcom,ids: Add SoC ID for SA8650P firmware: qcom: scm: Allow QSEECOM on Mahua CRD soc: qcom: wcnss: simplify allocation of req soc: qcom: pd-mapper: Add support for Eliza soc: qcom: aoss: compare against normalized cooling state soc: qcom: llcc: fix v1 SB syndrome register offset dt-bindings: firmware: qcom,scm: Document ipq9650 SCM soc: qcom: ubwc: Add support for Mahua soc: qcom: pd-mapper: Add support for Glymur and Mahua soc: qcom: ubwc: Add configuration Eliza SoC soc: qcom: ubwc: Remove redundant x1e80100_data dt-bindings: firmware: qcom,scm: document Eliza SCM Firmware Interface soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available soc: qcom: ocmem: register reasons for probe deferrals soc: qcom: ocmem: make the core clock optional soc: qcom: ubwc: disable bank swizzling for Glymur platform ... Signed-off-by: Arnd Bergmann commit fbf57f25f032bfccbf74eb1898646c9fbd862d2f Merge: 62513d2213a6af d373605cd51483 Author: Arnd Bergmann Date: Thu Apr 2 23:15:26 2026 +0200 Merge tag 'reset-for-v7.1' of https://git.pengutronix.de/git/pza/linux into soc/drivers Reset controller updates for v7.1 * Rework the reset core to support firmware nodes, add more fine grained locking, and use guard() helpers. * Change the reset-gpio driver to use firmware nodes. * Add support for the Cix Sky1 SoC reset controller. * Add support for the RZ/G3E SoC to the reset-rzv2h-usb2phy driver and convert it to regmap. Prepare registering a VBUS mux controller. * Replace use of the deprecated register_restart_handler() function in the ath79, intel-gw, lpc18xx, ma35d1, npcm, and sunplus reset drivers. * Combine two allocations into one in the sti/reset-syscfg driver. * Fix the reset-rzg2l-usbphy-ctrl MODULE_AUTHOR email. * Fix the reset_control_rearm() kerneldoc comment. The last commit is a merge of reset-fixes-for-v7.0-2 into reset/next, to solve a merge conflict between commits a9b95ce36de4 ("reset: gpio: add a devlink between reset-gpio and its consumer") and fbffb8c7c7bb ("reset: gpio: fix double free in reset_add_gpio_aux_device() error path"). * tag 'reset-for-v7.1' of https://git.pengutronix.de/git/pza/linux: (35 commits) reset: rzv2h-usb2phy: Add support for VBUS mux controller registration reset: rzv2h-usb2phy: Convert to regmap API dt-bindings: reset: renesas,rzv2h-usb2phy: Document RZ/G3E USB2PHY reset dt-bindings: reset: renesas,rzv2h-usb2phy: Add '#mux-state-cells' property reset: core: Drop unnecessary double quote reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime reset: spacemit: k3: Decouple composite reset lines reset: gpio: fix double free in reset_add_gpio_aux_device() error path reset: rzg2l-usbphy-ctrl: Fix malformed MODULE_AUTHOR string reset: sti: kzalloc + kcalloc to kzalloc reset: don't overwrite fwnode_reset_n_cells reset: core: Fix indentation reset: add Sky1 soc reset support dt-bindings: soc: cix: document the syscon on Sky1 SoC reset: gpio: make the driver fwnode-agnostic reset: convert reset core to using firmware nodes reset: convert the core API to using firmware nodes reset: convert of_reset_control_get_count() to using firmware nodes reset: protect struct reset_control with its own mutex reset: protect struct reset_controller_dev with its own mutex ... Signed-off-by: Arnd Bergmann commit 62513d2213a6af4640342a8959638cbf2a740c13 Merge: f1aa30a4b23d90 e54390aae68871 Author: Arnd Bergmann Date: Thu Apr 2 23:14:13 2026 +0200 Merge tag 'imx-bindings-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/drivers i.MX dt-bindings update for 7.1: - New board support: Verdin iMX95, MBa93xxLA-MINI, TQMa95xxLA, S32N79 SoC/RDB, i.MX8MP audio board (version 2), SolidRun i.MX8M, TQMa8x, GOcontroll Moduline IV/Mini, FRDM-IMX91S, Variscite DART-MX91, i.MX93 Wireless EVK, Variscite DART-MX95. - fsl,irqsteer add nxp,s32n79-irqsteer support. - fsl,imx93-media-blk-ctrl add dbi-bridge. * tag 'imx-bindings-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: dt-bindings: arm: fsl: add Verdin iMX95 dt-bindings: arm: fsl: add MBa93xxLA-MINI dt-bindings: arm: add bindings for TQMa95xxLA dt-bindings: arm: lpc: add missed lpc43xx board dt-bindings: arm: fsl: Add NXP S32N79 SoC and RDB board dt-bindings: interrupt-controller: fsl,irqsteer: add S32N79 support dt-bindings: arm: fsl: Add compatible for i.MX8MP audio board (version 2) dt-bindings: arm: fsl: Add various solidrun i.MX8M boards dt-bindings: arm: fsl: add bindings for TQMa8x dt-bindings: fsl: imx7ulp-smc1: Add #clock-cells property dt-bindings: arm: fsl: Add GOcontroll Moduline IV/Mini dt-bindings: arm: fsl: Add FRDM-IMX91S board dt-bindings: arm: fsl: add Variscite DART-MX91 Boards dt-bindings: arm: fsl: Add i.MX93 Wireless EVK board dt-bindings: arm: fsl: add Variscite DART-MX95 Boards dt-bindings: soc: imx93-media-blk-ctrl: Add PDFC subnode to schema and example Signed-off-by: Arnd Bergmann commit f1aa30a4b23d905dd39944cdffdf68c8cc3e28a9 Merge: 86f9823daf5f99 e68d494b8946e9 Author: Arnd Bergmann Date: Thu Apr 2 23:13:02 2026 +0200 Merge tag 'tegra-for-7.1-firmware' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers firmware: tegra: Changes for v7.1-rc1 This introduces a new API for the BPMP to be pass along a specifier from DT when getting a reference from a phandle. This is used to reference specific instances of the PCI controller on Tegra264. The ABI header for BPMP is updated to the latest version and BPMP APIs now use the more intuitive ENODEV instead of the non SUSV4 ENOTSUPP error code for stub implementations. * tag 'tegra-for-7.1-firmware' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: bpmp: Use ENODEV instead of ENOTSUPP firmware: tegra: bpmp: Add tegra_bpmp_get_with_id() function soc/tegra: Update BPMP ABI header firmware: tegra: bpmp: Rename Tegra239 to Tegra238 Signed-off-by: Arnd Bergmann commit 86f9823daf5f99190f15c6007017af38de125c87 Merge: 84a5fe2ee01f1c 4b23febb6b11cd Author: Arnd Bergmann Date: Thu Apr 2 23:11:41 2026 +0200 Merge tag 'tegra-for-7.1-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers soc/tegra: Changes for v7.1-rc1 A number of fixes went into this for the PMC and CBB drivers. The PMC driver also gains support for Tegra264 and a Kconfig symbol for the upcoming Tegra238 is added. The various per-generation Kconfig symbols are now also enabled by default for ARCH_TEGRA in order to reduce the number of configuration options that need to be explicitly enabled. * tag 'tegra-for-7.1-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: MAINTAINERS: Change email address for Thierry Reding soc/tegra: pmc: Add IO pads for Tegra264 soc/tegra: pmc: Rename has_impl_33v_pwr flag soc/tegra: pmc: Refactor IO pad voltage control soc/tegra: pmc: Add Tegra264 wake events soc/tegra: pmc: Add AOWAKE regs for Tegra264 soc/tegra: pmc: Add support for SoC specific AOWAKE offsets soc/tegra: pmc: Remove unused AOWAKE definitions soc/tegra: pmc: Add kerneldoc for wake-up variables soc/tegra: pmc: Correct function names in kerneldoc soc/tegra: pmc: Add kerneldoc for reboot notifier soc/tegra: common: Add Tegra114 support to devm_tegra_core_dev_init_opp_table soc/tegra: pmc: Enable core domain support for Tegra114 soc/tegra: cbb: Fix cross-fabric target timeout lookup soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables soc/tegra: cbb: Set ERD on resume for err interrupt soc/tegra: cbb: Add support for CBB fabrics in Tegra238 soc/tegra: Add Tegra238 Kconfig symbol soc/tegra: Make ARCH_TEGRA_SOC_FOO defaults for NVIDIA Tegra Signed-off-by: Arnd Bergmann commit a31ad9339eff4ce401dec816b01a94b4e3c47898 Author: Bjorn Andersson Date: Wed Apr 1 21:31:27 2026 -0500 firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaCentre Mini X The Hamoa-based Lenovo IdeaCentre Mini X provides the same UEFI variable access through uefisecapp as other Hamoa devices, add it to the allowlist. Reviewed-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20260401-ideacentre-v2-3-5745fe2c764e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit af241225893ac4933bb8f0615f2dfda8ea2326ce Author: Bjorn Andersson Date: Wed Apr 1 21:31:26 2026 -0500 arm64: dts: qcom: Add the Lenovo IdeaCentre Mini X The Lenovo IdeaCentre Mini X (Snapdragon) Desktop is a Hamoa-based ultracompact desktop PC. It provides HDMI, DisplayPort, USB Type-C display outputs, 5 additional USB ports, Ethernet, dual NVME slots, headphone jack, WiFi, and Bluetooth. Introduce a DeviceTree describing this device. Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20260401-ideacentre-v2-2-5745fe2c764e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2e80b497497c0d49d7809702f0e70465f88fe7a4 Author: Bjorn Andersson Date: Wed Apr 1 21:31:25 2026 -0500 dt-bindings: arm: qcom: Document the Lenovo IdeaCentre Mini X The Lenovo IdeaCentre Mini X (Snapdragon) Desktop is a Hamoa-based ultracompact desktop PC. It provides HDMI, DisplayPort, USB Type-C display outputs, 5 additional USB ports, Ethernet, dual NVME slots, headphone jack, WiFi, and Bluetooth. Document the compatible for this device. Acked-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20260401-ideacentre-v2-1-5745fe2c764e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 95c3f54db1e4641307785e4c071f3a4426ab7a2e Merge: e2813075322f29 c655a14958363a Author: Arnd Bergmann Date: Thu Apr 2 23:06:17 2026 +0200 Merge tag 'tegra-for-7.1-arm64-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/defconfig arm64: tegra: Default configuration changes for v7.1-rc1 Drop the various ARCH_TEGRA_*_SOC options from the default configurations since they are now enabled by default for ARCH_TEGRA. * tag 'tegra-for-7.1-arm64-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC Signed-off-by: Arnd Bergmann commit 2b676b5a13d28eb038b4e54dae8e161a7be58d96 Author: Alexander Martinz Date: Thu Apr 2 11:54:08 2026 +0200 arm64: dts: qcom: sdm845-shift-axolotl: Enable TFA9890 codec Audio amplifier TFA9890 is present on the board. Signed-off-by: Alexander Martinz Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: David Heidelberg Link: https://lore.kernel.org/r/20260402-axolotl-misc-p1-v3-3-8934e9db6831@ixit.cz Signed-off-by: Bjorn Andersson commit 8a53d5aa0d1179ac14aa7da58351848c2e709dcc Author: Casey Connolly Date: Thu Apr 2 11:54:07 2026 +0200 arm64: dts: qcom: sdm845-shift-axolotl: Set higher touchscreen i2c clock Sets a higher rate than the default for good responsiveness of touchscreen. Signed-off-by: Casey Connolly Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: David Heidelberg Link: https://lore.kernel.org/r/20260402-axolotl-misc-p1-v3-2-8934e9db6831@ixit.cz Signed-off-by: Bjorn Andersson commit 338b4158e877f116d404262098bbdcd1eaf6fd88 Author: Casey Connolly Date: Thu Apr 2 11:54:06 2026 +0200 arm64: dts: qcom: sdm845-shift-axolotl: Enable sdcard The SHIFT6mq features an sdcard slot, add it. Signed-off-by: Casey Connolly Reviewed-by: Konrad Dybcio Co-developed-by: David Heidelberg Signed-off-by: David Heidelberg Link: https://lore.kernel.org/r/20260402-axolotl-misc-p1-v3-1-8934e9db6831@ixit.cz Signed-off-by: Bjorn Andersson commit e2813075322f298b3c03423cd08347aa0e52b16f Merge: feb46c1b19c062 21e380f2724153 Author: Arnd Bergmann Date: Thu Apr 2 23:04:59 2026 +0200 Merge tag 'tegra-for-7.1-arm-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/defconfig ARM: tegra: Default configuration changes for v7.1-rc1 Drop the various ARCH_TEGRA_*_SOC options from the default configurations since they are now enabled by default for ARCH_TEGRA. * tag 'tegra-for-7.1-arm-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: ARM: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC soc/tegra: Make ARCH_TEGRA_SOC_FOO defaults for NVIDIA Tegra Signed-off-by: Arnd Bergmann commit 9b7d6b6c5cef6c578e976a1a605985c255779327 Author: Odelu Kukatla Date: Wed Mar 11 16:05:48 2026 +0530 arm64: dts: qcom: talos: Add clocks for QoS configuration Add clocks which need to be enabled for configuring QoS on talos SoC. Signed-off-by: Odelu Kukatla Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260311103548.1823044-4-odelu.kukatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit fd7400cfcbaaa1f3d1b904711d9daf029e996364 Author: Michael Kelley Date: Thu Apr 2 13:23:59 2026 -0700 genirq/chip: Invoke add_interrupt_randomness() in handle_percpu_devid_irq() handle_percpu_devid_irq() is a version of handle_percpu_irq() but with the addition of a pointer to a per-CPU devid. However, handle_percpu_irq() invokes add_interrupt_randomness(), while handle_percpu_devid_irq() currently does not. Add the missing add_interrupt_randomness(), as it is needed when per-CPU interrupts with devid's are used in VMs for interrupts from the hypervisor. Signed-off-by: Michael Kelley Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260402202400.1707-2-mhklkml@zohomail.com commit 594be93cdc9dcfec5d10882ed3fccce1e3af9015 Author: Wenmeng Liu Date: Thu Mar 5 17:48:16 2026 +0800 arm64: dts: qcom: talos-evk-camera: Add DT overlay Enable IMX577 via CCI on Talos EVK Core Kit. The Talos EVK board does not include a camera sensor by default. This DTSO has enabled the Arducam 12.3MP IMX577 Mini Camera Module on the CSI-1 interface. CSI-1 interface using mclk2 as the MCLK source on this board. Reviewed-by: Vladimir Zapolskiy Signed-off-by: Wenmeng Liu Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260305-sm6150_evk-v6-5-38ce4360d5e0@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit fd3850cde71f284ca69f70b904df78f561ece103 Author: Wenmeng Liu Date: Thu Mar 5 17:48:15 2026 +0800 arm64: dts: qcom: talos: Add camera MCLK pinctrl Define pinctrl definitions to enable camera master clocks on Talos. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Vladimir Zapolskiy Signed-off-by: Wenmeng Liu Link: https://lore.kernel.org/r/20260305-sm6150_evk-v6-4-38ce4360d5e0@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 17ba0a3c874684c9ca5a41ddf9f167648b10aad2 Author: Wenmeng Liu Date: Thu Mar 5 17:48:14 2026 +0800 arm64: dts: qcom: talos: Add CCI definitions Qualcomm Talos SoC contains single controller, containing 2 I2C hosts. Reviewed-by: Vladimir Zapolskiy Signed-off-by: Wenmeng Liu Link: https://lore.kernel.org/r/20260305-sm6150_evk-v6-3-38ce4360d5e0@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c0b357d5d059812e5b48fab81270d8f4c8f62162 Author: Wenmeng Liu Date: Thu Mar 5 17:48:13 2026 +0800 arm64: dts: qcom: talos: Add camss node Add node for the SM6150 camera subsystem. Reviewed-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Signed-off-by: Wenmeng Liu Link: https://lore.kernel.org/r/20260305-sm6150_evk-v6-2-38ce4360d5e0@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1bb533d644a2c56a3314351721445ea43fac9ff1 Author: Mukesh Ojha Date: Tue Jan 27 17:13:50 2026 +0530 arm64: dts: qcom: talos: Add EL2 overlay All the existing variants Talos boards are using Gunyah hypervisor which means that, so far, Linux-based OS could only boot in EL1 on those devices. However, it is possible for us to boot Linux at EL2 on these devices [1]. When running under Gunyah, the remote processor firmware IOMMU streams are controlled by Gunyah. However, without Gunyah, the IOMMU is managed by the consumer of this DeviceTree. Therefore, describe the firmware streams for each remote processor. Add a EL2-specific DT overlay and apply it to Talos IOT variant devices to create -el2.dtb for each of them alongside "normal" dtb. [1] https://docs.qualcomm.com/bundle/publicresource/topics/80-70020-4/boot-developer-touchpoints.html#uefi Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20260127-talos-el2-overlay-v2-3-b6a2266532c4@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0f9e6db8a2237e41209322017e2e9c45729d6d45 Author: Sudarshan Shetty Date: Tue Mar 31 11:31:07 2026 +0530 arm64: dts: qcom: talos-evk: Add support for QCS615 talos evk board Add the device tree for the QCS615-based Talos EVK platform. The platform is composed of a System-on-Module following the SMARC standard, and a Carrier Board. The Carrier Board supports several display configurations, HDMI and LVDS. Both configurations use the same base hardware, with the display selection controlled by a DIP switch. Use a DTBO file, talos-evk-lvds-auo,g133han01.dtso, which defines an overlay that disables HDMI and adds LVDS. The DTs file talos-evk can describe the HDMI display configurations. According to the hardware design and vendor guidance, the WiFi PA supplies VDD_PA_A and VDD_PA_B only need to be enabled at the same time as asserting WLAN_EN. On this platform, WiFi enablement is controlled via the WLAN_EN GPIO (GPIO84), which also drives the VDD_PA_A and VDD_PA_B power enables. Remove the VDD_PA_A and VDD_PA_B regulator nodes from the device tree and rely on WLAN_EN to enable WiFi functionality. Add talos-evk-usb1-peripheral.dtso overlay to enable USB0 peripheral (EDL) mode. The base DTS will keep USB0 host-only due to hardware routing through the EDL DIP switch, and the overlay switches the configuration for device-mode operation. The LVDS backlight hardware has been updated to use a simplified design. The backlight enable signal is now permanently pulled up to 3.3V and is no longer controlled via GPIO59. Remove the GPIO59 based backlight configuration from the device tree, as it is no longer routed to the LVDS interface. The initial device tree includes support for: - CPU and memory - UART - GPIOs - Regulators - PMIC - Early console - AT24MAC602 EEPROM - MCP2515 SPI to CAN - ADV7535 DSI-to-HDMI bridge - DisplayPort interface - SN65DSI84ZXHR DSI-to-LVDS bridge - Wi-Fi/BT Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Sudarshan Shetty Link: https://lore.kernel.org/r/20260331060107.501561-4-tessolveupstream@gmail.com Signed-off-by: Bjorn Andersson commit 83a679d61e8d18787ddc6c2f406546bb80dd2a8d Author: Sudarshan Shetty Date: Tue Mar 31 11:31:06 2026 +0530 arm64: dts: qcom: talos/qcs615-ride: Fix inconsistent USB PHY node naming The USB PHY nodes has inconsistent labels as 'usb_1_hsphy' and 'usb_hsphy_2' across talos.dtsi and qcs615-ride.dts. This patch renames them to follow a consistent naming scheme. No functional changes, only label renaming. Reviewed-by: Dmitry Baryshkov Signed-off-by: Sudarshan Shetty Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260331060107.501561-3-tessolveupstream@gmail.com Signed-off-by: Bjorn Andersson commit 44a47bd49a574bd6365f64d5d6f724c2e8d466df Author: Sudarshan Shetty Date: Tue Mar 31 11:31:05 2026 +0530 dt-bindings: arm: qcom: talos-evk: Add QCS615 Talos EVK SMARC platform Add binding support for the Qualcomm Technologies, Inc. Talos EVK SMARC platform based on the QCS615 SoC. Acked-by: Krzysztof Kozlowski Signed-off-by: Sudarshan Shetty Link: https://lore.kernel.org/r/20260331060107.501561-2-tessolveupstream@gmail.com Signed-off-by: Bjorn Andersson commit ed5ee207bc075d774ecc837acc90d02548cd5061 Author: Jie Zhang Date: Thu Mar 12 04:39:56 2026 +0530 arm64: dts: qcom: qcs615-ride: Enable Adreno 612 GPU Enable GPU for qcs615-ride platform and provide path for zap shader. Signed-off-by: Jie Zhang Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260312-qcs615-spin-2-v8-4-fca38edcd6e6@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a74c7b347d7e1094bf16e5053889c9ba4d9a3ac5 Author: Gaurav Kohli Date: Thu Mar 12 04:39:55 2026 +0530 arm64: dts: qcom: talos: Add GPU cooling Unlike the CPU, the GPU does not throttle its speed automatically when it reaches high temperatures. Set up GPU cooling by throttling the GPU speed when it reaches 105°C. Signed-off-by: Gaurav Kohli Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Akhil P Oommen Link: https://lore.kernel.org/r/20260312-qcs615-spin-2-v8-3-fca38edcd6e6@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8de397a5618aaea810e447946a1f1d19c610fdc2 Author: Jie Zhang Date: Thu Mar 12 04:39:54 2026 +0530 arm64: dts: qcom: talos: Add gpu and rgmu nodes Add gpu and rgmu nodes for Talos chipset. Signed-off-by: Jie Zhang Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Akhil P Oommen Link: https://lore.kernel.org/r/20260312-qcs615-spin-2-v8-2-fca38edcd6e6@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1d5c82f19b8a079767622191fa7478028a6ce79f Author: Qingqing Zhou Date: Thu Mar 12 04:39:53 2026 +0530 arm64: dts: qcom: talos: add the GPU SMMU node Add the Adreno GPU SMMU node for Talos chipset. Signed-off-by: Qingqing Zhou Signed-off-by: Jie Zhang Signed-off-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260312-qcs615-spin-2-v8-1-fca38edcd6e6@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit feb46c1b19c062c824bff370ad2cfbe700b3eeb4 Merge: 1c4c5c50ec5887 adcf290f9de2fc Author: Arnd Bergmann Date: Thu Apr 2 23:00:36 2026 +0200 Merge tag 'omap-for-v7.1/defconfig-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/defconfig arm: OMAP defconfig updates for v7.1 * tag 'omap-for-v7.1/defconfig-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: arm: multi_v7_defconfig: Enable more OMAP 3/4 related configs ARM: multi_v7_defconfig: omap2plus_defconfig: Enable ITE IT66121 driver Signed-off-by: Arnd Bergmann commit 1c4c5c50ec5887929c016524cea95dead7b3dd05 Merge: 757b23c2cb20de 079a2e18b776f3 Author: Arnd Bergmann Date: Thu Apr 2 22:58:55 2026 +0200 Merge tag 'ti-k3-config-for-v7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/defconfig TI K3 defconfig updates for v7.1 Generic Fixes/Cleanups: - Remove SENSORS_SA67MCU as the driver is dropped Board Specific Features and Fixes: AM69: - Enable configurations for Toradex Aquila AM69 AM64 / AM62: - Enable DP83TG720 PHY driver * tag 'ti-k3-config-for-v7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: defconfig: Enable DP83TG720 PHY driver arm64: defconfig: Enable configurations for Toradex Aquila AM69 arm64: defconfig: remove SENSORS_SA67MCU Signed-off-by: Arnd Bergmann commit 757b23c2cb20dee6692144f2b5fff71cabca9834 Author: Thomas Zimmermann Date: Wed Apr 1 10:25:28 2026 +0200 arch/arm: Drop CONFIG_FIRMWARE_EDID from defconfig files CONFIG_FIRMWARE_EDID=y depends on X86 or EFI_GENERIC_STUB. Neither is true here, so drop the lines from the defconfig files. Signed-off-by: Thomas Zimmermann Suggested-by: Arnd Bergmann Acked-by: Kevin Hilman (TI) Link: https://lore.kernel.org/r/20260401082533.214103-1-tzimmermann@suse.de Signed-off-by: Arnd Bergmann commit ba5d247871d23bee99c54b789d4a2eae52d76306 Merge: bb57e36b0a30d9 fdeb077b8ae53a Author: Arnd Bergmann Date: Thu Apr 2 22:48:40 2026 +0200 Merge tag 'qcom-arm64-defconfig-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Qualcomm Arm64 defconfig updates for v7.1 Enable base drivers for booting boards based on Kaanapali, Glymur, Eliza, SM8750, and IPQ5210 SoCs. Enable the Milos LPASS LPI driver. Enable the Qualcomm WCD937x headphone codec driver, used on QCM6490 boards. Enable the QCOMTEE driver, to support the interface found in various Qualcomm SoCs. Enable ethernet and analog codecs used on the Arduino Ventuno Q. Enable the Lontium LT8713sx driver, used for the Monaco EVK board. Enable the PCI pwrctrl generic driver used in a few different Qualcomm-based boards with USB controllers on PCI buses. * tag 'qcom-arm64-defconfig-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: enable pci-pwrctrl-generic as module arm64: defconfig: Enable Lontium LT8713sx driver arm64: defconfig: Enable Qualcomm Eliza SoC display clock controller arm64: defconfig: enable IPQ5210 RDP504 base configs arm64: defconfig: Enable Milos LPASS LPI pinctrl driver arm64: defconfig: Enable Kaanapali clock controllers arm64: defconfig: Enable configs for Arduino VENTUNO Q arm64: defconfig: Enable Qualcomm Eliza basic resource providers arm64: defconfig: Enable S5KJN1 camera sensor arm64: defconfig: Enable Qualcomm WCD937x headphone codec as module arm64: defconfig: Enable QCOMTEE module for QTEE-enabled Qualcomm SoCs arm64: defconfig: Enable configs for Qualcomm Glymur SoC arm64: defconfig: Enable SM8750 clock controllers Signed-off-by: Arnd Bergmann commit 85b6f920a8691d96441da9da7fc55ec93b906fe6 Author: Mark Brown Date: Fri Mar 6 17:00:53 2026 +0000 arm64/sysreg: Update SMIDR_EL1 to DDI0601 2025-06 Update the definition of SMIDR_EL1 in the sysreg definition to reflect the information in DD0601 2025-06. This includes somewhat more generic ways of describing the sharing of SMCUs, more information on supported priorities and provides additional resolution for describing affinity groups. Reviewed-by: Fuad Tabba Signed-off-by: Mark Brown Acked-by: Catalin Marinas Reviewed-by: Alex Bennée Signed-off-by: Catalin Marinas commit df5ead915b19a6c1fa25f44419f28e1228677b02 Author: Rosen Penev Date: Wed Apr 1 14:57:18 2026 -0700 HSI: omap_ssi_port: remove depends on ARM This has both ARM and COMPILE_TEST. The latter will never get hit on a non ARM system. Allows compilation on at least x86. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260401215718.11375-1-rosenp@gmail.com Signed-off-by: Sebastian Reichel commit 1e7269aa6880b3d6b458b8618431292091199718 Author: Rosen Penev Date: Wed Apr 1 14:56:18 2026 -0700 HSI: omap_ssi_port: remove set but unused variables W=1 build warns that these are set and unused. eg: error: variable ‘mode’ set but not used [-Werror=unused-but-set-variable] Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260401215618.11251-1-rosenp@gmail.com Signed-off-by: Sebastian Reichel commit e8aec1058ca598fe2013ef3489ae729a8070801b Merge: 1cc96e0e204891 9d77cefe8fcd4b Author: Andrii Nakryiko Date: Thu Apr 2 13:23:19 2026 -0700 Merge branch 'libbpf-clarify-raw-address-single-kprobe-attach-behavior' Hoyeon Lee says: ==================== libbpf: clarify raw-address single kprobe attach behavior Today libbpf documents single-kprobe attach through func_name, with an optional offset. For the PMU-based path, func_name = NULL with an absolute address in offset already works as well, but that is not described in the API. This patchset clarifies this behavior. First commit fixes kprobe and uprobe attach error handling to use direct error codes. Next adds kprobe API comments for the raw-address form and rejects it explicitly for legacy tracefs/debugfs kprobes. Last adds PERF and LINK selftests for the raw-address form, and checks that LEGACY rejects it. --- Changes in v7: - Change selftest line wrapping and assertions Changes in v6: - Split the kprobe/uprobe direct error-code fix into a separate patch Changes in v5: - Add kprobe API docs, use -EOPNOTSUPP, and switch selftests to LIBBPF_OPTS Changes in v4: - Inline raw-address error formatting and remove the probe_target buffer Changes in v3: - Drop bpf_kprobe_opts.addr and reuse offset when func_name is NULL - Make legacy tracefs/debugfs kprobes reject the raw-address form - Update selftests to cover PERF/LINK raw-address attach and LEGACY reject Changes in v2: - Fix line wrapping and indentation ==================== Link: https://patch.msgid.link/20260401143116.185049-1-hoyeon.lee@suse.com Signed-off-by: Andrii Nakryiko commit 9d77cefe8fcd4bd1c0bcfd4073fe6cd4325c8d9e Author: Hoyeon Lee Date: Wed Apr 1 23:29:31 2026 +0900 selftests/bpf: Add test for raw-address single kprobe attach Currently, attach_probe covers manual single-kprobe attaches by func_name, but not the raw-address form that the PMU-based single-kprobe path can accept. This commit adds PERF and LINK raw-address coverage. It resolves SYS_NANOSLEEP_KPROBE_NAME through kallsyms, passes the absolute address in bpf_kprobe_opts.offset with func_name = NULL, and verifies that kprobe and kretprobe are still triggered. It also verifies that LEGACY rejects the same form. Signed-off-by: Hoyeon Lee Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20260401143116.185049-4-hoyeon.lee@suse.com commit e1621c752865dcd682d9f52c3566ba3c6b9ee589 Author: Hoyeon Lee Date: Wed Apr 1 23:29:30 2026 +0900 libbpf: Clarify raw-address single kprobe attach behavior bpf_program__attach_kprobe_opts() documents single-kprobe attach through func_name, with an optional offset. For the PMU-based path, func_name = NULL with an absolute address in offset already works as well, but that is not described in the API. This commit clarifies this existing non-legacy behavior. For PMU-based attach, callers can use func_name = NULL with an absolute address in offset as the raw-address form. For legacy tracefs/debugfs kprobes, reject this form explicitly. Signed-off-by: Hoyeon Lee Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20260401143116.185049-3-hoyeon.lee@suse.com commit f547cf79475fdfee39dcab07a2b381026427a0b3 Author: Hoyeon Lee Date: Wed Apr 1 23:29:29 2026 +0900 libbpf: Use direct error codes for kprobe/uprobe attach perf_event_open_probe() and perf_event_{k,u}probe_open_legacy() helpers are returning negative error codes directly on failure. This commit changes bpf_program__attach_{k,u}probe_opts() to use those return values directly instead of re-reading possibly changed errno. Signed-off-by: Hoyeon Lee Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20260401143116.185049-2-hoyeon.lee@suse.com commit 1cc96e0e20489159398009d2f453e59c10e413c9 Author: Mykyta Yatsenko Date: Wed Apr 1 16:16:40 2026 +0100 libbpf: Fix BTF handling in bpf_program__clone() Align bpf_program__clone() with bpf_object_load_prog() by gating BTF func/line info on FEAT_BTF_FUNC kernel support, and resolve caller-provided prog_btf_fd before checking obj->btf so that callers with their own BTF can use clone() even when the object has no BTF loaded. While at it, treat func_info and line_info fields as atomic groups to prevent mismatches between pointer and count from different sources. Move bpf_program__clone() to libbpf 1.8. Fixes: 970bd2dced35 ("libbpf: Introduce bpf_program__clone()") Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260401151640.356419-1-mykyta.yatsenko5@gmail.com commit eb27e1c885ea75c1661188a548d100c8bce5970a Author: Thomas Richter Date: Wed Apr 1 14:21:01 2026 +0200 perf test: Skip perf data type profiling tests for s390 Test case 'perf data type profiling tests' fails on s390 with this error: # ./perf mem record -- ./perf test -w code_with_type failed: no PMU supports the memory events # echo $? 255 # because s390 does not support memory events at all. According to the man page, perf annotate --code-with-type only works with memory instructions only. As command 'perf mem record ...' is not supported on s390, skip this test for s390. Output before: # ./perf test 'perf data type profiling tests' 77: perf data type profiling tests : FAILED! Output after: # ./perf test 'perf data type profiling tests' 77: perf data type profiling tests : Skip Fixes: f60a5c22967b8 ("perf tests: Test annotate with data type profiling and rust") Signed-off-by: Thomas Richter Reviewed-by: Ian Rogers Cc: Dmitrii Dolgov <9erthalion6@gmail.com> Suggested-by: Namhyung Kim Suggested-by: Ian Rogers Signed-off-by: Namhyung Kim commit ff6be45adb1989698867938157f9317ae0bba936 Author: Anubhav Shelat Date: Wed Apr 1 09:24:43 2026 -0400 perf tools: prevent null dsos from being added When sorting the dso array we sometimes get a crash due to null comparisons in comparator functions. So prevent __dsos__add from adding null to the dso array to avoid out-of-memory related errors. Signed-off-by: Anubhav Shelat Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 77cb9b443b7fff2a93d78cd2e309db030046772f Author: Thomas Falcon Date: Thu Mar 26 20:59:27 2026 -0500 perf test: Fix ratio_to_prev event parsing test test__ratio_to_prev() assumed the first event in a group is the leader, which is not the case when the event is expanded into two event groups on hybrid PMU's with auto counter reload support. Instead, iterate over the event group generated for each core PMU. Also update "wrong leader" test to check that the subordinate event has the correct leader instead of checking that it is not the group leader. Finally, do not exit immediately if a PMU without auto counter reload support is found. Signed-off-by: Thomas Falcon Reviewed-by: Dapeng Mi Reviewed-by: Ian Rogers Fixes: 56be0fe5f62c ("perf record: Add auto counter reload parse and regression tests") Signed-off-by: Namhyung Kim commit 9a82bfde4775b7a87cd1a7e791f46f83ae442848 Author: Chuck Lever Date: Mon Mar 23 11:58:04 2026 -0400 perf tools: Fix module symbol resolution for non-zero .text sh_addr When perf resolves symbols from kernel module ELF files (ET_REL), it converts symbol addresses to file offsets so that sample IPs can be matched to the correct symbol. The conversion adjusts each symbol's st_value: sym->st_value -= shdr->sh_addr - shdr->sh_offset; For vmlinux (ET_EXEC), st_value is a virtual address and sh_addr is the section's virtual base, so subtracting sh_addr and adding sh_offset correctly yields a file offset. For kernel modules (ET_REL), st_value is a section-relative offset. The module loader ignores sh_addr entirely and places symbols at module_base + st_value. Converting to file offset requires only adding sh_offset; subtracting sh_addr introduces an error equal to sh_addr bytes. When .text has sh_addr == 0 -- the historical norm for simple modules -- both formulas produce the same result and the bug is latent. As modules gain more metadata sections before .text (.note, .static_call.text, etc.), the linker assigns .text a non-zero sh_addr, exposing the defect. For example, nfsd.ko on this kernel has sh_addr=0xa80, kvm-intel.ko has sh_addr=0x1e90. The effect is that all .text symbols in affected modules shift by sh_addr bytes relative to sample IPs, causing perf report to attribute samples to incorrect, nearby symbols. This was observed as 13% of LLC-load-miss samples misattributed to nfsd_file_get_dio_attrs when the actual hot function was nfsd_cache_lookup, approximately 0xa80 bytes away in the symbol table. Use the existing dso__rel() flag (already set for ET_REL modules) to select the correct adjustment: add sh_offset for ET_REL, subtract (sh_addr - sh_offset) for ET_EXEC/ET_DYN. Fixes: 0131c4ec794a ("perf tools: Make it possible to read object code from kernel modules") Signed-off-by: Chuck Lever Reviewed-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit 4cbceeca56386256dbb5d1ce657c81ba03275ee0 Author: Namhyung Kim Date: Wed Apr 1 16:05:09 2026 -0700 perf trace: Skip unnecessary synthesis for summary-only mode It needs to synthesize task info for the comm name. The mmap information is only needed for callchain symbolization which is not used by the summary mode. Also total or cgroup summary mode don't require the task info. Let's skip the processing if possible. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit b5708a308a5602d4a3caf0720dce452082d443ec Author: Breno Leitao Date: Wed Mar 25 03:24:30 2026 -0700 perf stat: Fix crash on arm64 Perf stat is crashing on arm64 hosts with the following issue: # make -C tools/perf DEBUG=1 # perf stat sleep 1 perf: util/evsel.c:2034: get_group_fd: Assertion `!(!leader->core.fd)' failed. [1] 1220794 IOT instruction (core dumped) ./perf stat The sorting function introduced by commit a745c0831c15c ("perf stat: Sort default events/metrics") compares events based on their individual properties. This can cause events from different groups to be interleaved, resulting in group members appearing before their leaders in the sorted evlist. When the iterator opens events in list order, a group member may be processed before its leader has been opened. For example, CPU_CYCLES (idx=32) with leader STALL_SLOT_BACKEND (idx=37) could be sorted before its leader, causing the crash when CPU_CYCLES tries to get its group fd from the not-yet-opened leader. Fix this by comparing events based on their leader's attributes instead of their own attributes when the events are in different groups. This ensures all members of a group share the same sort key as their leader, keeping groups together and guaranteeing leaders are opened before their members. Fixes: a745c0831c15c ("perf stat: Sort default events/metrics") Reported-by: Denis Yaroshevskiy Tested-by: Dmitry Ilvokhin Tested-by: Ian Rogers Signed-off-by: Breno Leitao Signed-off-by: Namhyung Kim commit 1d37713fa83780f3f500fa4c4f6c43945dd17137 Author: Ryan Roberts Date: Mon Mar 30 17:17:04 2026 +0100 arm64: mm: Remove pmd_sect() and pud_sect() The semantics of pXd_leaf() are very similar to pXd_sect(). The only difference is that pXd_sect() only considers it a section if PTE_VALID is set, whereas pXd_leaf() permits both "valid" and "present-invalid" types. Using pXd_sect() has caused issues now that large leaf entries can be present-invalid since commit a166563e7ec37 ("arm64: mm: support large block mapping when rodata=full"), so let's just remove the API and standardize on pXd_leaf(). There are a few callsites of the form pXd_leaf(READ_ONCE(*pXdp)). This was previously fine for the pXd_sect() macro because it only evaluated its argument once. But pXd_leaf() evaluates its argument multiple times. So let's avoid unintended side effects by reimplementing pXd_leaf() as an inline function. Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit 15bfba1ad77fad8e45a37aae54b3c813b33fe27c Author: Ryan Roberts Date: Mon Mar 30 17:17:03 2026 +0100 arm64: mm: Handle invalid large leaf mappings correctly It has been possible for a long time to mark ptes in the linear map as invalid. This is done for secretmem, kfence, realm dma memory un/share, and others, by simply clearing the PTE_VALID bit. But until commit a166563e7ec37 ("arm64: mm: support large block mapping when rodata=full") large leaf mappings were never made invalid in this way. It turns out various parts of the code base are not equipped to handle invalid large leaf mappings (in the way they are currently encoded) and I've observed a kernel panic while booting a realm guest on a BBML2_NOABORT system as a result: [ 15.432706] software IO TLB: Memory encryption is active and system is using DMA bounce buffers [ 15.476896] Unable to handle kernel paging request at virtual address ffff000019600000 [ 15.513762] Mem abort info: [ 15.527245] ESR = 0x0000000096000046 [ 15.548553] EC = 0x25: DABT (current EL), IL = 32 bits [ 15.572146] SET = 0, FnV = 0 [ 15.592141] EA = 0, S1PTW = 0 [ 15.612694] FSC = 0x06: level 2 translation fault [ 15.640644] Data abort info: [ 15.661983] ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 [ 15.694875] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 15.723740] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 15.755776] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081f3f000 [ 15.800410] [ffff000019600000] pgd=0000000000000000, p4d=180000009ffff403, pud=180000009fffe403, pmd=00e8000199600704 [ 15.855046] Internal error: Oops: 0000000096000046 [#1] SMP [ 15.886394] Modules linked in: [ 15.900029] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-rc4-dirty #4 PREEMPT [ 15.935258] Hardware name: linux,dummy-virt (DT) [ 15.955612] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 15.986009] pc : __pi_memcpy_generic+0x128/0x22c [ 16.006163] lr : swiotlb_bounce+0xf4/0x158 [ 16.024145] sp : ffff80008000b8f0 [ 16.038896] x29: ffff80008000b8f0 x28: 0000000000000000 x27: 0000000000000000 [ 16.069953] x26: ffffb3976d261ba8 x25: 0000000000000000 x24: ffff000019600000 [ 16.100876] x23: 0000000000000001 x22: ffff0000043430d0 x21: 0000000000007ff0 [ 16.131946] x20: 0000000084570010 x19: 0000000000000000 x18: ffff00001ffe3fcc [ 16.163073] x17: 0000000000000000 x16: 00000000003fffff x15: 646e612065766974 [ 16.194131] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 16.225059] x11: 0000000000000000 x10: 0000000000000010 x9 : 0000000000000018 [ 16.256113] x8 : 0000000000000018 x7 : 0000000000000000 x6 : 0000000000000000 [ 16.287203] x5 : ffff000019607ff0 x4 : ffff000004578000 x3 : ffff000019600000 [ 16.318145] x2 : 0000000000007ff0 x1 : ffff000004570010 x0 : ffff000019600000 [ 16.349071] Call trace: [ 16.360143] __pi_memcpy_generic+0x128/0x22c (P) [ 16.380310] swiotlb_tbl_map_single+0x154/0x2b4 [ 16.400282] swiotlb_map+0x5c/0x228 [ 16.415984] dma_map_phys+0x244/0x2b8 [ 16.432199] dma_map_page_attrs+0x44/0x58 [ 16.449782] virtqueue_map_page_attrs+0x38/0x44 [ 16.469596] virtqueue_map_single_attrs+0xc0/0x130 [ 16.490509] virtnet_rq_alloc.isra.0+0xa4/0x1fc [ 16.510355] try_fill_recv+0x2a4/0x584 [ 16.526989] virtnet_open+0xd4/0x238 [ 16.542775] __dev_open+0x110/0x24c [ 16.558280] __dev_change_flags+0x194/0x20c [ 16.576879] netif_change_flags+0x24/0x6c [ 16.594489] dev_change_flags+0x48/0x7c [ 16.611462] ip_auto_config+0x258/0x1114 [ 16.628727] do_one_initcall+0x80/0x1c8 [ 16.645590] kernel_init_freeable+0x208/0x2f0 [ 16.664917] kernel_init+0x24/0x1e0 [ 16.680295] ret_from_fork+0x10/0x20 [ 16.696369] Code: 927cec03 cb0e0021 8b0e0042 a9411c26 (a900340c) [ 16.723106] ---[ end trace 0000000000000000 ]--- [ 16.752866] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 16.792556] Kernel Offset: 0x3396ea200000 from 0xffff800080000000 [ 16.818966] PHYS_OFFSET: 0xfff1000080000000 [ 16.837237] CPU features: 0x0000000,00060005,13e38581,957e772f [ 16.862904] Memory Limit: none [ 16.876526] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--- This panic occurs because the swiotlb memory was previously shared to the host (__set_memory_enc_dec()), which involves transitioning the (large) leaf mappings to invalid, sharing to the host, then marking the mappings valid again. But pageattr_p[mu]d_entry() would only update the entry if it is a section mapping, since otherwise it concluded it must be a table entry so shouldn't be modified. But p[mu]d_sect() only returns true if the entry is valid. So the result was that the large leaf entry was made invalid in the first pass then ignored in the second pass. It remains invalid until the above code tries to access it and blows up. The simple fix would be to update pageattr_pmd_entry() to use !pmd_table() instead of pmd_sect(). That would solve this problem. But the ptdump code also suffers from a similar issue. It checks pmd_leaf() and doesn't call into the arch-specific note_page() machinery if it returns false. As a result of this, ptdump wasn't even able to show the invalid large leaf mappings; it looked like they were valid which made this super fun to debug. the ptdump code is core-mm and pmd_table() is arm64-specific so we can't use the same trick to solve that. But we already support the concept of "present-invalid" for user space entries. And even better, pmd_leaf() will return true for a leaf mapping that is marked present-invalid. So let's just use that encoding for present-invalid kernel mappings too. Then we can use pmd_leaf() where we previously used pmd_sect() and everything is magically fixed. Additionally, from inspection kernel_page_present() was broken in a similar way, so I'm also updating that to use pmd_leaf(). The transitional page tables component was also similarly broken; it creates a copy of the kernel page tables, making RO leaf mappings RW in the process. It also makes invalid (but-not-none) pte mappings valid. But it was not doing this for large leaf mappings. This could have resulted in crashes at kexec- or hibernate-time. This code is fixed to flip "present-invalid" mappings back to "present-valid" at all levels. Finally, I have hardened split_pmd()/split_pud() so that if it is passed a "present-invalid" leaf, it will maintain that property in the split leaves, since I wasn't able to convince myself that it would only ever be called for "present-valid" leaves. Fixes: a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full") Cc: stable@vger.kernel.org Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit f12b435de2f2bb09ce406467020181ada528844c Author: Ryan Roberts Date: Mon Mar 30 17:17:02 2026 +0100 arm64: mm: Fix rodata=full block mapping support for realm guests Commit a166563e7ec37 ("arm64: mm: support large block mapping when rodata=full") enabled the linear map to be mapped by block/cont while still allowing granular permission changes on BBML2_NOABORT systems by lazily splitting the live mappings. This mechanism was intended to be usable by realm guests since they need to dynamically share dma buffers with the host by "decrypting" them - which for Arm CCA, means marking them as shared in the page tables. However, it turns out that the mechanism was failing for realm guests because realms need to share their dma buffers (via __set_memory_enc_dec()) much earlier during boot than split_kernel_leaf_mapping() was able to handle. The report linked below showed that GIC's ITS was one such user. But during the investigation I found other callsites that could not meet the split_kernel_leaf_mapping() constraints. The problem is that we block map the linear map based on the boot CPU supporting BBML2_NOABORT, then check that all the other CPUs support it too when finalizing the caps. If they don't, then we stop_machine() and split to ptes. For safety, split_kernel_leaf_mapping() previously wouldn't permit splitting until after the caps were finalized. That ensured that if any secondary cpus were running that didn't support BBML2_NOABORT, we wouldn't risk breaking them. I've fix this problem by reducing the black-out window where we refuse to split; there are now 2 windows. The first is from T0 until the page allocator is inititialized. Splitting allocates memory for the page allocator so it must be in use. The second covers the period between starting to online the secondary cpus until the system caps are finalized (this is a very small window). All of the problematic callers are calling __set_memory_enc_dec() before the secondary cpus come online, so this solves the problem. However, one of these callers, swiotlb_update_mem_attributes(), was trying to split before the page allocator was initialized. So I have moved this call from arch_mm_preinit() to mem_init(), which solves the ordering issue. I've added warnings and return an error if any attempt is made to split in the black-out windows. Note there are other issues which prevent booting all the way to user space, which will be fixed in subsequent patches. Reported-by: Jinjiang Tu Closes: https://lore.kernel.org/all/0b2a4ae5-fc51-4d77-b177-b2e9db74f11d@huawei.com/ Fixes: a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full") Cc: stable@vger.kernel.org Reviewed-by: Kevin Brodsky Signed-off-by: Ryan Roberts Reviewed-by: Suzuki K Poulose Tested-by: Suzuki K Poulose Signed-off-by: Catalin Marinas commit c636ae346d196b71e972188f91b3260ae522ade6 Author: Karol Wachowski Date: Thu Apr 2 14:55:26 2026 +0200 accel/ivpu: Trigger recovery on TDR with OS scheduling With OS scheduling mode the driver cannot determine which context caused the timeout, so context abort cannot be used. Instead of queuing context_abort_work, directly trigger full device recovery when a job timeout (TDR) occurs in OS scheduling mode. Fixes: ade00a6c903f ("accel/ivpu: Perform engine reset instead of device recovery on TDR") Reviewed-by: Jeff Hugo Reviewed-by: Lizhi Hou Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260402125526.845210-1-karol.wachowski@linux.intel.com commit b905ee77d5f557a83a485b4146210f54f13365fc Author: Samuele Mariotti Date: Thu Apr 2 19:00:25 2026 +0200 sched_ext: Fix missing warning in scx_set_task_state() default case In scx_set_task_state(), the default case was setting the warn flag, but then returning immediately. This is problematic because the only purpose of the warn flag is to trigger WARN_ONCE, but the early return prevented it from ever firing, leaving invalid task states undetected and untraced. To fix this, a WARN_ONCE call is now added directly in the default case. The fix addresses two aspects: - Guarantees the invalid task states are properly logged and traced. - Provides a distinct warning message ("sched_ext: Invalid task state") specifically for states outside the defined scx_task_state enum values, making it easier to distinguish from other transition warnings. This ensures proper detection and reporting of invalid states. Signed-off-by: Samuele Mariotti Signed-off-by: Paolo Valente Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 7bf6ddc3345663beef7766a804fe9b73909fba57 Author: Heiner Kallweit Date: Thu Apr 2 15:32:13 2026 +0200 ata: libata-transport: remove static variable ata_scsi_transport_template Simplify the code by making struct ata_scsi_transportt public, instead of using separate variable ata_scsi_transport_template. Reviewed-by: Damien Le Moal Signed-off-by: Heiner Kallweit Signed-off-by: Niklas Cassel commit 359942ba4c1dfa3795e6137a5c09e2bfd1c444e5 Author: Heiner Kallweit Date: Thu Apr 2 15:31:22 2026 +0200 ata: libata-transport: split struct ata_internal There's no need for an umbrella struct, so remove it. It's also a prerequisite for making the embedded struct scsi_transport_template public. Reviewed-by: Damien Le Moal Signed-off-by: Heiner Kallweit Signed-off-by: Niklas Cassel commit 365da8c68739a28b44e414696a5ff0ee4c58e7d3 Author: Heiner Kallweit Date: Thu Apr 2 15:30:48 2026 +0200 ata: libata-transport: use static struct ata_transport_internal to simplify match functions Both matching functions can make use of static struct ata_transport_internal. This eliminates the dependency on static variable ata_scsi_transport_template, and it allows to remove helper to_ata_internal(). Small drawback is that a forward declaration of both functions is needed. Reviewed-by: Damien Le Moal Signed-off-by: Heiner Kallweit Signed-off-by: Niklas Cassel commit 2339f9cc9f080eff40432c0343d358ead39a4988 Author: Miklos Szeredi Date: Thu Mar 12 20:30:08 2026 +0100 fuse: support FSCONFIG_SET_FD for "fd" option This is not only cleaner to use in userspace (no need to sprintf the fd to a string) but also allows userspace to detect that the devfd can be closed after the fsconfig call. Signed-off-by: Miklos Szeredi Reviewed-by: "Darrick J. Wong" commit 4ae404afd92e36be378eb120a2dc13031cdac7a6 Author: Miklos Szeredi Date: Thu Mar 12 12:19:10 2026 +0100 fuse: clean up device cloning - fuse_mutex is not needed for device cloning, because fuse_dev_install() uses cmpxcg() to set fud->fc, which prevents races between clone/mount or clone/clone. This makes the logic simpler - Drop fc->dev_count. This is only used to check in release if the device is the last clone, but checking list_empty(&fc->devices) is equivalent after removing the released device from the list. Removing the fuse_dev before calling fuse_abort_conn() is okay, since the processing and io lists are now empty for this device. Signed-off-by: Miklos Szeredi commit f2122465398a875ef5a31bde85602e6dfac17a83 Author: Heiner Kallweit Date: Thu Apr 2 15:30:05 2026 +0200 ata: libata-transport: inline ata_attach|release_transport Both functions are helpers which are used only once. So remove them and merge their code into libata_transport_init() and libata_transport_exit() respectively. Reviewed-by: Damien Le Moal Signed-off-by: Heiner Kallweit Signed-off-by: Niklas Cassel commit ee1ed7a864389ba727ac9b3549beab08e3966735 Author: Heiner Kallweit Date: Thu Apr 2 15:29:21 2026 +0200 ata: libata-transport: instantiate struct ata_internal statically Struct ata_internal is only instantiated once, in module init code. So we can also instantiate it statically, which allows simplifying the code. Reviewed-by: Damien Le Moal Signed-off-by: Heiner Kallweit Signed-off-by: Niklas Cassel commit d42eb23b2ef9fbe66ea7fd4b3153c3244818d47c Author: Miklos Szeredi Date: Wed Mar 11 22:27:44 2026 +0100 fuse: don't require /dev/fuse fd to be kept open during mount With the new mount API the sequence of syscalls would be: fs_fd = fsopen("fuse", 0); snprintf(opt, sizeof(opt), "%i", devfd); fsconfig(fs_fd, FSCONFIG_SET_STRING, "fd", opt, 0); /* ... */ fsconfig(fs_fd, FSCONFIG_CMD_CREATE, 0, 0, 0); Current mount code just stores the value of devfd in the fs_context and uses it in during FSCONFIG_CMD_CREATE, which is inelegant. Instead grab a reference to the underlying fuse_dev, and use that during the filesystem creation. Signed-off-by: Miklos Szeredi commit e9bf38500ed9aec7cfdf9219c75d353645b41168 Author: Miklos Szeredi Date: Wed Mar 11 22:05:17 2026 +0100 fuse: add refcount to fuse_dev This will make it possible to grab the fuse_dev and subsequently release the file that it came from. In the above case, fud->fc will be set to FUSE_DEV_FC_DISCONNECTED to indicate that this is no longer a functional device. When trying to assign an fc to such a disconnected fuse_dev, the fc is set to the disconnected state. Use atomic operations xchg() and cmpxchg() to prevent races. Signed-off-by: Miklos Szeredi commit a8dd5f1b73bc533e1192d38c82fc144595d3ce9a Author: Miklos Szeredi Date: Wed Mar 11 21:02:41 2026 +0100 fuse: create fuse_dev on /dev/fuse open instead of mount Allocate struct fuse_dev when opening the device. This means that unlike before, ->private_data is always set to a valid pointer. The use of USE_DEV_SYNC_INIT magic pointer for the private_data is now replaced with a simple bool sync_init member. If sync INIT is not set, I/O on the device returns error before mount. Keep this behavior by checking for the ->fc member. If fud->fc is set, the mount has succeeded. Testing this used READ_ONCE(file->private_data) and smp_mb() to try and provide the necessary semantics. Switch this to smp_store_release() and smp_load_acquire(). Setting fud->fc is protected by fuse_mutex, this is unchanged. Will need this later so the /dev/fuse open file reference is not held during FSCONFIG_CMD_CREATE. Signed-off-by: Miklos Szeredi Reviewed-by: "Darrick J. Wong" commit e45f591f704aecec31dc738694a5e43acdfd020b Author: Miklos Szeredi Date: Thu Mar 26 11:45:44 2026 +0100 fuse: check connection state on notification Check if the connection is fully initialized and connected before trying to process a notification form the fuse server. Signed-off-by: Miklos Szeredi commit da6fcc6dbddbef80e603d2f0c1554a9f2ac03742 Author: Miklos Szeredi Date: Thu Apr 2 20:19:55 2026 +0200 fuse: fuse_dev_ioctl_clone() should wait for device file to be initialized Use fuse_get_dev() not __fuse_get_dev() on the old fd, since in the case of synchronous INIT the caller will want to wait for the device file to be available for cloning, just like I/O wants to wait instead of returning an error. Fixes: dfb84c330794 ("fuse: allow synchronous FUSE_INIT") Cc: stable@vger.kernel.org # v6.18 Signed-off-by: Miklos Szeredi commit f35340f2d653f1003602878403c901396ab03c17 Merge: 8ffb33d7709b59 0f96212a5142cd Author: Jakub Kicinski Date: Thu Apr 2 11:28:23 2026 -0700 Merge branch 'net-stmmac-tso-fixes-cleanups' Russell King says: ==================== net: stmmac: TSO fixes/cleanups This is a more refined version of the previous patch series fixing and cleaning up the TSO code. I'm not sure whether "TSO" or "GSO" should be used to describe this feature - although it primarily handles TCP, dwmac4 appears to also be able to handle UDP. In essence, this series adds a .ndo_features_check() method to handle whether TSO/GSO can be used for a particular skbuff - checking which queue the skbuff is destined for and whether that has TBS available which precludes TSO being enabled on that channel. I'm also adding a check that the header is smaller than 1024 bytes, as documented in those sources which have TSO support - this is due to the hardware buffering the header in "TSO memory" which I guess is limited to 1KiB. I expect this test never to trigger, but if the headers ever exceed that size, the hardware will likely fail. While IPv4 headers are unlikely to be anywhere near this, there is nothing in the protocol which prevents IPv6 headers up to 64KiB. As we now have a .ndo_features_check() method, I'm moving the VLAN insertion for TSO packets into core code by unpublishing the VLAN insertion features when we use TSO. Another move is for checksumming, which is required for TSO, but stmmac's requirements for offloading checksums are more strict - and this seems to be a bug in the TSO path. I've changed the hardware initialisation to always enable TSO support on the channels even if the user requests TSO/GSO to be disabled - this fixes another issue as pointed out by Jakub in a previous review. I'm moving the setup of the GSO features, cleaning those up, and adding a warning if platform glue requests this to be enabled but the hardware has no support. Hopefully this will never trigger if everyone got the STMMAC_FLAG_TSO_EN flag correct. Also adding a check for TxPBL value. Finally, moving the "TSO supported" message to the new stmmac_set_gso_features() function so keep all this TSO stuff together. ==================== Link: https://patch.msgid.link/aczHVF04LIGq_lYO@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0f96212a5142cdacdc4133024f0e82626a23209c Author: Russell King (Oracle) Date: Wed Apr 1 08:22:20 2026 +0100 net: stmmac: move "TSO supported" message to stmmac_set_gso_features() Move the "TSO supported" message to stmmac_set_gso_features() so that we group all probe-time TSO stuff in one place. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7pu8-0000000Eau5-3Zne@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 33f5cc83bbbdf73bd0c145403b30b49eec4b0311 Author: Russell King (Oracle) Date: Wed Apr 1 08:22:15 2026 +0100 net: stmmac: check txpbl for TSO Documentation states that TxPBL must be >= 4 to allow TSO support, but the driver doesn't check this. TxPBL comes from the platform glue code or DT. Add a check with a warning if platform glue code attempts to enable TSO support with TxPBL too low. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7pu3-0000000Eatz-39ts@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f8c70ab540c1a15e281baa10eec270396aa04d1a Author: Russell King (Oracle) Date: Wed Apr 1 08:22:10 2026 +0100 net: stmmac: add warning when TSO is requested but unsupported Add a warning message if TSO is requested by the platform glue code but the core wasn't configured for TSO. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7pty-0000000Eatt-2TjZ@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6ad0044428973f1d5e311c77e2e4f54192a37248 Author: Russell King (Oracle) Date: Wed Apr 1 08:22:05 2026 +0100 net: stmmac: make stmmac_set_gso_features() more readable Make stmmac_set_gso_features() more readable by adding some whitespace and getting rid of the indentation. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7ptt-0000000Eatn-1ziK@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c04939cb9851a1f024f03784dec71cd7a7ea4004 Author: Russell King (Oracle) Date: Wed Apr 1 08:22:00 2026 +0100 net: stmmac: split out gso features setup Move the GSO features setup into a separate function, co-loated with other GSO/TSO support. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7pto-0000000Eath-1VDH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 2e4082e4b739191d71e03fe6c55cec68d36f67fe Author: Russell King (Oracle) Date: Wed Apr 1 08:21:55 2026 +0100 net: stmmac: simplify GSO/TSO test in stmmac_xmit() The test in stmmac_xmit() to see whether we should pass the skbuff to stmmac_tso_xmit() is more complex than it needs to be. This test can be simplified by storing the mask of GSO types that we will pass, and setting it according to the enabled features. Note that "tso" is a mis-nomer since commit b776620651a1 ("net: stmmac: Implement UDP Segmentation Offload"). Also note that this commit controls both via the TSO feature. We preserve this behaviour in this commit. Also, this commit unconditionally accessed skb_shinfo(skb)->gso_type for all frames, even when skb_is_gso() was false. This access is eliminated. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7ptj-0000000Eatb-11zK@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b55dfb173ce808ecc8c598f2c378a9b04c5ce241 Author: Russell King (Oracle) Date: Wed Apr 1 08:21:50 2026 +0100 net: stmmac: move check for hardware checksum supported Add a check in .ndo_features_check() to indicate whether hardware checksum can be performed on the skbuff. Where hardware checksum is not supported - either because the channel does not support Tx COE or the skb isn't suitable (stmmac uses a tighter test than can_checksum_protocol()) we also need to disable TSO, which will be done by harmonize_features() in net/core/dev.c This fixes a bug where a channel which has COE disabled may still receive TSO skbuffs. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7pte-0000000EatU-0ILt@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3f6a6eb9ef21b2eb30b3a3ea096759b37368b257 Author: Russell King (Oracle) Date: Wed Apr 1 08:21:44 2026 +0100 net: stmmac: move TSO VLAN tag insertion to core code stmmac_tso_xmit() checks whether the skbuff is trying to offload vlan tag insertion to hardware, which from the comment in the code appears to be buggy when the TSO feature is used. Rather than stmmac_tso_xmit() inserting the VLAN tag, handle this in stmmac_features_check() which will then use core net code to handle this. See net/core/dev.c::validate_xmit_skb() Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7ptY-0000000EatO-42Qv@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c05a81cbee87e511b823a6f64f9315aef41eab57 Author: Russell King (Oracle) Date: Wed Apr 1 08:21:39 2026 +0100 net: stmmac: add GSO MSS checks Add GSO MSS checks to stmmac_features_check(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7ptT-0000000EatI-3feh@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6732e474f880468435a79d05811c8c814c5d71f8 Author: Russell King (Oracle) Date: Wed Apr 1 08:21:34 2026 +0100 net: stmmac: add TSO check for header length According to the STM32MP151 documentation which covers dwmac v4.2, the hardware TSO feature can handle header lengths up to a maximum of 1023 bytes. Add a .ndo_features_check() method implementation to check the header length meets these requirements, otherwise fall back to software GSO. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7ptO-0000000EatC-39il@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f799b5dab9c98a4b52a93d1c357916e0f0b7e663 Author: Russell King (Oracle) Date: Wed Apr 1 08:21:29 2026 +0100 net: stmmac: add stmmac_tso_header_size() We will need to compute the size of the protocol headers in two places, so move this into a separate function. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7ptJ-0000000Eat5-2ZlA@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e32820264c2949a3e75bc5083e49c885e3bbaf62 Author: Russell King (Oracle) Date: Wed Apr 1 08:21:24 2026 +0100 net: stmmac: fix TSO support when some channels have TBS available According to the STM32MP25xx manual, which is dwmac v5.3, TBS (time based scheduling) is not permitted for channels which have hardware TSO enabled. Intel's commit 5e6038b88a57 ("net: stmmac: fix TSO and TBS feature enabling during driver open") concurs with this, but it is incomplete. This commit avoids enabling TSO support on the channels which have TBS available, which, as far as the hardware is concerned, means we do not set the TSE bit in the DMA channel's transmit control register. However, the net device's features apply to all queues(channels), which means these channels may still be handed TSO skbs to transmit, and the driver will pass them to stmmac_tso_xmit(). This will generate the descriptors for TSO, even though the channel has the TSE bit clear. Fix this by checking whether the queue(channel) has TBS available, and if it does, fall back to software GSO support. Fixes: 5e6038b88a57 ("net: stmmac: fix TSO and TBS feature enabling during driver open") Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7ptE-0000000Easz-28tv@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit afe840ddf15c9960e4c4522c95dea459f4fa055b Author: Russell King (Oracle) Date: Wed Apr 1 08:21:19 2026 +0100 net: stmmac: fix .ndo_fix_features() netdev features documentation requires that .ndo_fix_features() is stateless: it shouldn't modify driver state. Yet, stmmac_fix_features() does exactly that, changing whether GSO frames are processed by the driver. Move this code to stmmac_set_features() instead, which is the correct place for it. We don't need to check whether TSO is supported; this is already handled via the setup of netdev->hw_features, and we are guaranteed that if netdev->hw_features indicates that a feature is not supported, .ndo_set_features() won't be called with it set. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7pt9-0000000East-1YAO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 989a9c20f63e378e0bb8b05bf82560d7da945de4 Author: Russell King (Oracle) Date: Wed Apr 1 08:21:14 2026 +0100 net: stmmac: fix channel TSO enable on resume Rather than configuring the channels depending on whether GSO/TSO is currently enabled by the user, always enable if the hardware has TSO support and the platform wants TSO to be enabled. This avoids the channel TSO enable bit being disabled after a resume when the user has disabled TSO features. This will cause problems when the user re-enables TSO. This bug goes back to commit f748be531d70 ("stmmac: support new GMAC4") Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w7pt4-0000000Easn-14WL@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 87ac077d6ea8613b7c1debdf3b5e92c78618fd23 Author: Deepanshu Kartikey Date: Mon Mar 23 10:51:48 2026 +0530 ntfs3: fix memory leak in indx_create_allocate() When indx_create_allocate() fails after attr_allocate_clusters() succeeds, run_deallocate() frees the disk clusters but never frees the memory allocated by run_add_entry() via kvmalloc() for the runs_tree structure. Fix this by adding run_close() at the out: label to free the run.runs memory on all error paths. The success path is unaffected as it returns 0 directly without going through out:, transferring ownership of the run memory to indx->alloc_run via memcpy(). Reported-by: syzbot+7adcddaeeb860e5d3f2f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7adcddaeeb860e5d3f2f Signed-off-by: Deepanshu Kartikey Signed-off-by: Konstantin Komarov commit 182caa17360dd48e6df08e18f00ebda0be87ab24 Author: Igor Pylypiv Date: Thu Apr 2 09:07:05 2026 -0700 ata: libata-eh: Do not retry reset if the device is gone If a device is hot-unplugged or otherwise disappears during error handling, ata_eh_reset() may fail with -ENODEV. Currently, the error handler will continue to retry the reset operation up to max_tries times. Prevent unnecessary reset retries by exiting the loop early when ata_do_reset() returns -ENODEV. Reviewed-by: Damien Le Moal Signed-off-by: Igor Pylypiv Signed-off-by: Niklas Cassel commit 8ffb33d7709b59ff60560f48960a73bd8a55be95 Merge: 269389ba539834 f8f5627a8aeab1 Author: Jakub Kicinski Date: Thu Apr 2 10:57:09 2026 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-7.0-rc7). Conflicts: net/vmw_vsock/af_vsock.c b18c83388874 ("vsock: initialize child_ns_mode_locked in vsock_net_init()") 0de607dc4fd8 ("vsock: add G2H fallback for CIDs not owned by H2G transport") Adjacent changes: drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ceee35e5674a ("bnxt_en: Refactor some basic ring setup and adjustment logic") 57cdfe0dc70b ("bnxt_en: Resize RSS contexts on channel count change") drivers/net/wireless/intel/iwlwifi/mld/mac80211.c 4d56037a02bd ("wifi: iwlwifi: mld: block EMLSR during TDLS connections") 687a95d204e7 ("wifi: iwlwifi: mld: correctly set wifi generation data") drivers/net/wireless/intel/iwlwifi/mld/scan.h b6045c899e37 ("wifi: iwlwifi: mld: Refactor scan command handling") ec66ec6a5a8f ("wifi: iwlwifi: mld: Fix MLO scan timing") drivers/net/wireless/intel/iwlwifi/mvm/fw.c 078df640ef05 ("wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v 2") 323156c3541e ("wifi: iwlwifi: mvm: don't send a 6E related command when not supported") Signed-off-by: Jakub Kicinski commit 445588a3b18bb0702d746cb61f7a443639027651 Author: Hans Zhang <18255117159@163.com> Date: Wed Apr 1 10:30:48 2026 +0800 PCI: dwc: Fix type mismatch for kstrtou32_from_user() return value kstrtou32_from_user() returns int, but the return value was stored in a u32 variable 'val', risking sign loss. Use a dedicated int variable to correctly handle the return code. Fixes: 4fbfa17f9a07 ("PCI: dwc: Add debugfs based Silicon Debug support for DWC") Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260401023048.4182452-1-18255117159@163.com commit 3515572dd068895ffd241b8a69399a0ebfac7593 Author: Steven Rostedt Date: Tue Mar 31 16:39:24 2026 -0400 tracing: Allow backup to save persistent ring buffer before it starts When the persistent ring buffer was first introduced, it did not make sense to start tracing for it on the kernel command line. That's because if there was a crash, the start of events would invalidate the events from the previous boot that had the crash. But now that there's a "backup" instance that can take a snapshot of the persistent ring buffer when boot starts, it is possible to have the persistent ring buffer start events at boot up and not lose the old events. Update the code where the boot events start after all boot time instances are created. This will allow the backup instance to copy the persistent ring buffer from the previous boot, and allow the persistent ring buffer to start tracing new events for the current boot. reserve_mem=100M:12M:trace trace_instance=boot_mapped^@trace,sched trace_instance=backup=boot_mapped The above will create a boot_mapped persistent ring buffer and enabled the scheduler events. If there's a crash, a "backup" instance will be created holding the events of the persistent ring buffer from the previous boot, while the persistent ring buffer will once again start tracing scheduler events of the current boot. Now the user doesn't have to remember to start the persistent ring buffer. It will always have the events started at each boot. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: John Stultz Link: https://patch.msgid.link/20260331163924.6ccb3896@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit e53ba177c24280630b07f844aa370d9a2da50665 Author: Masami Hiramatsu (Google) Date: Wed Apr 1 15:38:05 2026 +0900 tracing/Documentation: Add a section about backup instance Add a section about backup instance to the debugging.rst. Cc: Mathieu Desnoyers Link: https://patch.msgid.link/177502548479.1311542.7062269603547001007.stgit@mhiramat.tok.corp.google.com Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 29cbf826d5674a0ea1b101c13861416c7f217304 Author: Thorsten Blum Date: Thu Apr 2 18:56:18 2026 +0200 thermal/drivers/brcmstb_thermal: Use max to simplify brcmstb_get_temp Use max() to simplify brcmstb_get_temp() and improve its readability. Since avs_tmon_code_to_temp() returns an int, change the data type of the local variable 't' from long to int. No functional changes. Signed-off-by: Thorsten Blum Signed-off-by: Daniel Lezcano Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260402165616.895305-3-thorsten.blum@linux.dev commit eca33fdab47b61dd7341178cf8c693ae51f5e67b Author: Masami Hiramatsu (Google) Date: Wed Apr 1 15:37:57 2026 +0900 tracing: Remove the backup instance automatically after read Since the backup instance is readonly, after reading all data via pipe, no data is left on the instance. Thus it can be removed safely after closing all files. This also removes it if user resets the ring buffer manually via 'trace' file. Cc: Mathieu Desnoyers Link: https://patch.msgid.link/177502547711.1311542.12572973358010839400.stgit@mhiramat.tok.corp.google.com Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 2c79da099aac174e1c0e8e22b249f49e9256e966 Author: Masami Hiramatsu (Google) Date: Wed Apr 1 15:37:49 2026 +0900 tracing: Make the backup instance non-reusable Since there is no reason to reuse the backup instance, make it readonly (but erasable). Note that only backup instances are readonly, because other trace instances will be empty unless it is writable. Only backup instances have copy entries from the original. With this change, most of the trace control files are removed from the backup instance, including eventfs enable/filter etc. # find /sys/kernel/tracing/instances/backup/events/ | wc -l 4093 # find /sys/kernel/tracing/instances/boot_map/events/ | wc -l 9573 Cc: Mathieu Desnoyers Link: https://patch.msgid.link/177502546939.1311542.1826814401724828930.stgit@mhiramat.tok.corp.google.com Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 20ad8b0888be392eb2c4c3654805eb8594952373 Author: Vincent Donnefort Date: Wed Apr 1 06:36:59 2026 +0100 ring-buffer: Enforce read ordering of trace_buffer cpumask and buffers On CPU hotplug, if it is the first time a trace_buffer sees a CPU, a ring_buffer_per_cpu will be allocated and its corresponding bit toggled in the cpumask. Many readers check this cpumask to know if they can safely read the ring_buffer_per_cpu but they are doing so without memory ordering and may observe the cpumask bit set while having NULL buffer pointer. Enforce the memory read ordering by sending an IPI to all online CPUs. The hotplug path is a slow-path anyway and it saves us from adding read barriers in numerous call sites. Link: https://patch.msgid.link/20260401053659.3458961-1-vdonnefort@google.com Signed-off-by: Vincent Donnefort Suggested-by: Steven Rostedt (Google) Signed-off-by: Steven Rostedt (Google) commit d373605cd514837d8a6de3d00c786d4bae6dbaf8 Merge: f62fcdf8ab826f a0e0c2f8c5f32b Author: Philipp Zabel Date: Thu Apr 2 14:30:10 2026 +0200 Merge tag 'reset-fixes-for-v7.0-2' into reset/next Reset controller fixes for v7.0, part 2 * Decouple spacemit K3 reset lines that were incorrectly coupled together as one, but are in fact separate resets in hardware. * Fix a double free in the reset_add_gpio_aux_device() error path. This has already been fixed on reset/next by commit a9b95ce36de4 ("reset: gpio: add a devlink between reset-gpio and its consumer"). * Fix the MODULE_AUTHOR string in the rzg2l-usbphy-ctrl driver. We merge this into reset/next to resolve a conflict between commits a9b95ce36de4 ("reset: gpio: add a devlink between reset-gpio and its consumer") and fbffb8c7c7bb ("reset: gpio: fix double free in reset_add_gpio_aux_device() error path"). Signed-off-by: Philipp Zabel commit e25cfbec08558e15fdf0f31f229b9f2a491e8288 Merge: f7601044020ac1 cc878b414450d4 Author: Alexei Starovoitov Date: Thu Apr 2 09:31:42 2026 -0700 Merge branch 'bpf-migrate-bpf_task_work-and-file-dynptr-to-kmalloc_nolock' Mykyta Yatsenko says: ==================== bpf: Migrate bpf_task_work and file dynptr to kmalloc_nolock Now that kmalloc can be used from NMI context via kmalloc_nolock(), migrate BPF internal allocations away from bpf_mem_alloc to use the standard slab allocator. Use kfree_rcu() for deferred freeing, which waits for a regular RCU grace period before the memory is reclaimed. Sleepable BPF programs hold rcu_read_lock_trace but not regular rcu_read_lock, so patch 1 adds explicit rcu_read_lock/unlock around the pointer-to-refcount window to prevent kfree_rcu from freeing memory while a sleepable program is still between reading the pointer and acquiring a reference. Patch 1 migrates bpf_task_work_ctx from bpf_mem_alloc/bpf_mem_free to kmalloc_nolock/kfree_rcu. Patch 2 migrates bpf_dynptr_file_impl from bpf_mem_alloc/bpf_mem_free to kmalloc_nolock/kfree. Signed-off-by: Mykyta Yatsenko --- Changes in v2: - Switch to scoped_guard in patch 1 (Kumar) - Remove rcu gp wait in patch 2 (Kumar) - Defer to irq_work when irqs disabled in patch 1 - use bpf_map_kmalloc_nolock() for bpf_task_work - use kmalloc_nolock() for file dynptr - Link to v1: https://lore.kernel.org/all/20260325-kmalloc_special-v1-0-269666afb1ea@meta.com/ ==================== Link: https://patch.msgid.link/20260330-kmalloc_special-v2-0-c90403f92ff0@meta.com Signed-off-by: Alexei Starovoitov commit cc878b414450d4d49f57b2d5812b44697c7090d5 Author: Mykyta Yatsenko Date: Mon Mar 30 15:27:57 2026 -0700 bpf: Migrate dynptr file to kmalloc_nolock Replace bpf_mem_alloc/bpf_mem_free with kmalloc_nolock/kfree_nolock for bpf_dynptr_file_impl, continuing the migration away from bpf_mem_alloc now that kmalloc can be used from NMI context. freader_cleanup() runs before kfree_nolock() while the dynptr still holds exclusive access, so plain kfree_nolock() is safe — no concurrent readers can access the object. Signed-off-by: Mykyta Yatsenko Acked-by: Andrii Nakryiko Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260330-kmalloc_special-v2-2-c90403f92ff0@meta.com Signed-off-by: Alexei Starovoitov commit 90f51ebff242e9446a9bbd3ce1a04d50c30e8b96 Author: Mykyta Yatsenko Date: Mon Mar 30 15:27:56 2026 -0700 bpf: Migrate bpf_task_work to kmalloc_nolock Replace bpf_mem_alloc/bpf_mem_free with kmalloc_nolock/kfree_rcu for bpf_task_work_ctx. Replace guard(rcu_tasks_trace)() with guard(rcu)() in bpf_task_work_irq(). The function only accesses ctx struct members (not map values), so tasks trace protection is not needed - regular RCU is sufficient since ctx is freed via kfree_rcu. The guard in bpf_task_work_callback() remains as tasks trace since it accesses map values from process context. Sleepable BPF programs hold rcu_read_lock_trace but not regular rcu_read_lock. Since kfree_rcu waits for a regular RCU grace period, the ctx memory can be freed while a sleepable program is still running. Add scoped_guard(rcu) around the pointer read and refcount tryget in bpf_task_work_acquire_ctx to close this race window. Since kfree_rcu uses call_rcu internally which is not safe from NMI context, defer destruction via irq_work when irqs are disabled. For the lost-cmpxchg path the ctx was never published, so kfree_nolock is safe. Signed-off-by: Mykyta Yatsenko Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260330-kmalloc_special-v2-1-c90403f92ff0@meta.com Signed-off-by: Alexei Starovoitov commit 9487e2a00e7b3c6f258c5c99953f470eba6fb61d Author: Gautham R. Shenoy Date: Thu Apr 2 15:56:11 2026 +0530 MAINTAINERS: amd-pstate: Step down as maintainer, add Prateek as reviewer Mario Limonciello has led amd-pstate maintenance in recent years and has done excellent work. The amd-pstate driver is in good hands with him. I am stepping down as co-maintainer as I move on to other things. Add K Prateek Nayak as a reviewer. He has been actively contributing to the driver including preferred-core and ITMT improvements, and has been helping review amd-pstate patches for a while now. Signed-off-by: Gautham R. Shenoy Acked-by: K Prateek Nayak Acked-by: Mario Limonciello (AMD) Link: https://lore.kernel.org/r/20260402102611.16519-1-gautham.shenoy@amd.com Signed-off-by: Mario Limonciello (AMD) commit c03791085adcd61fa9b766ab303c7d0941d7378d Author: K Prateek Nayak Date: Mon Mar 16 08:18:49 2026 +0000 cpufreq: Pass the policy to cpufreq_driver->adjust_perf() cpufreq_cpu_get() can sleep on PREEMPT_RT in presence of concurrent writer(s), however amd-pstate depends on fetching the cpudata via the policy's driver data which necessitates grabbing the reference. Since schedutil governor can call "cpufreq_driver->update_perf()" during sched_tick/enqueue/dequeue with rq_lock held and IRQs disabled, fetching the policy object using the cpufreq_cpu_get() helper in the scheduler fast-path leads to "BUG: scheduling while atomic" on PREEMPT_RT [1]. Pass the cached cpufreq policy object in sg_policy to the update_perf() instead of just the CPU. The CPU can be inferred using "policy->cpu". The lifetime of cpufreq_policy object outlasts that of the governor and the cpufreq driver (allocated when the CPU is onlined and only reclaimed when the CPU is offlined / the CPU device is removed) which makes it safe to be referenced throughout the governor's lifetime. Closes:https://lore.kernel.org/all/20250731092316.3191-1-spasswolf@web.de/ [1] Fixes: 1d215f0319c2 ("cpufreq: amd-pstate: Add fast switch function for AMD P-State") Reported-by: Bert Karwatzki Acked-by: Viresh Kumar Signed-off-by: K Prateek Nayak Acked-by: Gary Guo # Rust Reviewed-by: Gautham R. Shenoy Reviewed-by: Zhongqiu Han Link: https://lore.kernel.org/r/20260316081849.19368-3-kprateek.nayak@amd.com Signed-off-by: Mario Limonciello (AMD) commit 86d71f1d7686cecebbafb371ad58c6ad7f80a93a Author: K Prateek Nayak Date: Mon Mar 16 08:18:48 2026 +0000 cpufreq/amd-pstate: Pass the policy to amd_pstate_update() All callers of amd_pstate_update() already have a reference to the cpufreq_policy object. Pass the entire policy object and grab the cpudata using "policy->driver_data" instead of passing the cpudata and unnecessarily grabbing another read-side reference to the cpufreq policy object when it is already available in the caller. No functional changes intended. Reviewed-by: Mario Limonciello (AMD) Acked-by: Viresh Kumar Signed-off-by: K Prateek Nayak Reviewed-by: Gautham R. Shenoy Link: https://lore.kernel.org/r/20260316081849.19368-2-kprateek.nayak@amd.com Signed-off-by: Mario Limonciello (AMD) commit 7e173bc310d2b1df018edc66334a5304305889a2 Author: Mario Limonciello (AMD) Date: Sun Mar 29 15:38:11 2026 -0500 cpufreq/amd-pstate-ut: Add a unit test for raw EPP Ensure that all supported raw EPP values work properly. Export the driver helpers used by the test module so the test can drive raw EPP writes and temporarily disable dynamic EPP while it runs. Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit f7601044020ac1c55675ee59422ef75b25a31bed Merge: 0eeb0094ba0321 da77f3a9aa5557 Author: Alexei Starovoitov Date: Thu Apr 2 09:29:49 2026 -0700 Merge branch 'bpf-fix-abuse-of-kprobe_write_ctx-via-freplace' Leon Hwang says: ==================== bpf: Fix abuse of kprobe_write_ctx via freplace The potential issue of kprobe_write_ctx+freplace was mentioned in "bpf: Disallow !kprobe_write_ctx progs tail-calling kprobe_write_ctx progs" [1]. It is true issue, that the test in patch #2 verifies that kprobe_write_ctx=false kprobe progs can be abused to modify struct pt_regs via kprobe_write_ctx=true freplace progs. When struct pt_regs is modified, bpf_prog_test_run_opts() gets -EFAULT instead of 0. test_freplace_kprobe_write_ctx:FAIL:bpf_prog_test_run_opts unexpected error: -14 (errno 14) We will disallow attaching freplace programs on kprobe programs with different kprobe_write_ctx values. Links: [1] https://lore.kernel.org/bpf/CAP01T74w4KVMn9bEwpQXrk+bqcUxzb6VW1SQ_QvNy0A4EY-9Jg@mail.gmail.com/ Changes: v2 -> v3: * Add comment to the rejection of kprobe_write_ctx (per Jiri). * Use libbpf_get_error() instead of errno in test (per Jiri). * Collect Acked-by tags from Jiri and Song, thanks. v2: https://lore.kernel.org/bpf/20260326141718.17731-1-leon.hwang@linux.dev/ v1 -> v2: * Drop patch #1 in v1, as it wasn't an issue (per Toke). * Check kprobe_write_ctx value at attach time instead of at load time, to prevent attaching kprobe_write_ctx=true freplace progs on kprobe_write_ctx=false kprobe progs (per Gemini/sashiko). * Move kprobe_write_ctx test code to attach_probe.c and kprobe_write_ctx.c. v1: https://lore.kernel.org/bpf/20260324150444.68166-1-leon.hwang@linux.dev/ ==================== Link: https://patch.msgid.link/20260331145353.87606-1-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit da77f3a9aa55575cdc74aa5736f31ce6b4091cf7 Author: Leon Hwang Date: Tue Mar 31 22:53:53 2026 +0800 selftests/bpf: Add test to verify the fix of kprobe_write_ctx abuse Add a test to verify the issue: kprobe_write_ctx can be abused to modify struct pt_regs of kernel functions via kprobe_write_ctx=true freplace progs. Without the fix, the issue is verified: kprobe_write_ctx=true freplace prog is allowed to attach to kprobe_write_ctx=false kprobe prog. Then, the first arg of bpf_fentry_test1 will be set as 0, and bpf_prog_test_run_opts() gets -EFAULT instead of 0. With the fix, the issue is rejected at attach time. Acked-by: Jiri Olsa Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260331145353.87606-3-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 611fe4b79af72d00d80f2223354284447daafae9 Author: Leon Hwang Date: Tue Mar 31 22:53:52 2026 +0800 bpf: Fix abuse of kprobe_write_ctx via freplace uprobe programs are allowed to modify struct pt_regs. Since the actual program type of uprobe is KPROBE, it can be abused to modify struct pt_regs via kprobe+freplace when the kprobe attaches to kernel functions. For example, SEC("?kprobe") int kprobe(struct pt_regs *regs) { return 0; } SEC("?freplace") int freplace_kprobe(struct pt_regs *regs) { regs->di = 0; return 0; } freplace_kprobe prog will attach to kprobe prog. kprobe prog will attach to a kernel function. Without this patch, when the kernel function runs, its first arg will always be set as 0 via the freplace_kprobe prog. To fix the abuse of kprobe_write_ctx=true via kprobe+freplace, disallow attaching freplace programs on kprobe programs with different kprobe_write_ctx values. Fixes: 7384893d970e ("bpf: Allow uprobe program to change context registers") Acked-by: Jiri Olsa Acked-by: Song Liu Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260331145353.87606-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 6927f21852f38db2975b5d5539cbe5241c25a99b Author: Mario Limonciello (AMD) Date: Sun Mar 29 15:38:10 2026 -0500 cpufreq/amd-pstate: Add support for raw EPP writes The energy performance preference field of the CPPC request MSR supports values from 0 to 255, but the strings only offer 4 values. The other values are useful for tuning the performance of some workloads. Add support for writing the raw energy performance preference value to the sysfs file. If the last value written was an integer then an integer will be returned. If the last value written was a string then a string will be returned. Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 798c47593ccae7dd36c033e557f3f364a2056b9e Author: Mario Limonciello (AMD) Date: Sun Mar 29 15:38:09 2026 -0500 cpufreq/amd-pstate: Add support for platform profile class The platform profile core allows multiple drivers and devices to register platform profile support. When the legacy platform profile interface is used all drivers will adjust the platform profile as well. Add support for registering every CPU with the platform profile handler when dynamic EPP is enabled. The end result will be that changing the platform profile will modify EPP accordingly. Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit da8afb1c666a4a966f0ab91dc336df4c855bc7b2 Author: Mario Limonciello (AMD) Date: Sun Mar 29 15:38:08 2026 -0500 cpufreq/amd-pstate: add kernel command line to override dynamic epp Add `amd_dynamic_epp=enable` and `amd_dynamic_epp=disable` to override the kernel configuration option `CONFIG_X86_AMD_PSTATE_DYNAMIC_EPP` locally. Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit e30ca6dd5345c5b8ba05f346a8e81105352fe571 Author: Mario Limonciello (AMD) Date: Sun Mar 29 15:38:07 2026 -0500 cpufreq/amd-pstate: Add dynamic energy performance preference Dynamic energy performance preference changes the EPP profile based on whether the machine is running on AC or DC power. A notification chain from the power supply core is used to adjust EPP values on plug in or plug out events. When enabled, the driver exposes a sysfs toggle for dynamic EPP, blocks manual writes to energy_performance_preference while it "owns" the EPP updates. For non-server systems: * the default EPP for AC mode is `performance`. * the default EPP for DC mode is `balance_performance`. For server systems dynamic EPP is mostly a no-op. Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit a362ae6e7e85bca4c870c37085d7793c4beec360 Author: Ninad Naik Date: Tue Mar 31 00:38:55 2026 +0530 Documentation: amd-pstate: fix dead links in the reference section The links for AMD64 Architecture Programmer's Manual and PPR for AMD Family 19h Model 51h, Revision A1 Processors redirect to a generic page. Update the links to the working ones. Signed-off-by: Ninad Naik Link: https://lore.kernel.org/r/20260330190855.1115304-1-ninadnaik07@gmail.com Acked-by: Mario Limonciello (AMD) Signed-off-by: Mario Limonciello (AMD) commit 8cdc494013dfcd48f31eafe19b18fd67c224dd8a Author: Mario Limonciello (AMD) Date: Thu Mar 26 14:36:20 2026 -0500 cpufreq/amd-pstate: Cache the max frequency in cpudata The value of maximum frequency is fixed and never changes. Doing calculations every time based off of perf is unnecessary. Reviewed-by: Gautham R. Shenoy Link: https://lore.kernel.org/r/20260326193620.649441-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello (AMD) commit 88d2ca6a68fcc43d65b3b056cb8c481804b100b0 Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:56 2026 +0530 Documentation/amd-pstate: Add documentation for amd_pstate_floor_{freq,count} Add documentation for the sysfs files /sys/devices/system/cpu/cpufreq/policy*/amd_pstate_floor_freq and /sys/devices/system/cpu/cpufreq/policy*/amd_pstate_floor_count. Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit a5bc4c44aeec2920931e17db7f93965fcd69ee2f Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:55 2026 +0530 Documentation/amd-pstate: List amd_pstate_prefcore_ranking sysfs file Add the missing amd_pstate_prefcore_ranking filenames in the sysfs listing example leading to the descriptions of these parameters. Clarify when will the file be visible. Fixes: 15a2b764ea7c ("amd-pstate: Add missing documentation for `amd_pstate_prefcore_ranking`") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 7e1cf24efba4b59a275e87372267dadcb7fd1850 Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:54 2026 +0530 Documentation/amd-pstate: List amd_pstate_hw_prefcore sysfs file Add the missing amd_pstate_hw_prefcore filenames in the sysfs listing example leading to the descriptions of these parameters. Clarify when will the file be visible. Fixes: b96b82d1af7f ("cpufreq: amd-pstate: Add documentation for `amd_pstate_hw_prefcore`") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 3b90e5a4176acacc6781b9ac84cdc5ac53671eee Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:53 2026 +0530 amd-pstate-ut: Add a testcase to validate the visibility of driver attributes amd-pstate driver has per-attribute visibility functions to dynamically control which sysfs freq_attrs are exposed based on the platform capabilities and the current amd_pstate mode. However, there is no test coverage to validate that the driver's live attribute list matches the expected visibility for each mode. Add amd_pstate_ut_check_freq_attrs() to the amd-pstate unit test module. For each enabled mode (passive, active, guided), the test independently derives the expected visibility of each attribute: - Core attributes (max_freq, lowest_nonlinear_freq, highest_perf) are always expected. - Prefcore attributes (prefcore_ranking, hw_prefcore) are expected only when cpudata->hw_prefcore indicates platform support. - EPP attributes (energy_performance_preference, energy_performance_available_preferences) are expected only in active mode. - Floor frequency attributes (floor_freq, floor_count) are expected only when X86_FEATURE_CPPC_PERF_PRIO is present. Compare these independent expectations against the live driver's attr array, catching bugs such as attributes leaking into wrong modes or visibility functions checking incorrect conditions. Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit c6a2b750de13db9103db29c64927bec3919232b5 Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:52 2026 +0530 amd-pstate-ut: Add module parameter to select testcases Currently when amd-pstate-ut test module is loaded, it runs all the tests from amd_pstate_ut_cases[] array. Add a module parameter named "test_list" that accepts a comma-delimited list of test names, allowing users to run a selected subset of tests. When the parameter is omitted or empty, all tests are run as before. Signed-off-by: Gautham R. Shenoy Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Mario Limonciello (AMD) commit 30c63f723440f12626a19da5a93e094da29af51e Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:51 2026 +0530 amd-pstate: Introduce a tracepoint trace_amd_pstate_cppc_req2() Introduce a new tracepoint trace_amd_pstate_cppc_req2() to track updates to MSR_AMD_CPPC_REQ2. Invoke this while changing the Floor Perf. Reviewed-by: Mario Limonciello Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit b9f103d0968bc5b33bff1b1eb11c756b2ac07c6c Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:50 2026 +0530 amd-pstate: Add sysfs support for floor_freq and floor_count When Floor Performance feature is supported by the platform, expose two sysfs files: * amd_pstate_floor_freq to allow userspace to request the floor frequency for each CPU. * amd_pstate_floor_count which advertises the number of distinct levels of floor frequencies supported on this platform. Reset the floor_perf to bios_floor_perf in the suspend, offline, and exit paths, and restore the value to the cached user-request floor_freq on the resume and online paths mirroring how bios_min_perf is handled for MSR_AMD_CPPC_REQ. Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 97838281f587a9e98e74b913201f7408214b5999 Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:49 2026 +0530 amd-pstate: Add support for CPPC_REQ2 and FLOOR_PERF Some future AMD processors have feature named "CPPC Performance Priority" which lets userspace specify different floor performance levels for different CPUs. The platform firmware takes these different floor performance levels into consideration while throttling the CPUs under power/thermal constraints. The presence of this feature is indicated by bit 16 of the EDX register for CPUID leaf 0x80000007. More details can be found in AMD Publication titled "AMD64 Collaborative Processor Performance Control (CPPC) Performance Priority" Revision 1.10. The number of distinct floor performance levels supported on the platform will be advertised through the bits 32:39 of the MSR_AMD_CPPC_CAP1. Bits 0:7 of a new MSR MSR_AMD_CPPC_REQ2 (0xc00102b5) will be used to specify the desired floor performance level for that CPU. Add support for the aforementioned MSR_AMD_CPPC_REQ2, and macros for parsing and updating the relevant bits from MSR_AMD_CPPC_CAP1 and MSR_AMD_CPPC_REQ2. On boot if the default value of the MSR_AMD_CPPC_REQ2[7:0] (Floor Perf) is lower than CPPC.lowest_perf, and thus invalid, initialize it to MSR_AMD_CPPC_CAP1.nominal_perf which is a sane default value. Save the boot-time floor_perf during amd_pstate_init_floor_perf(). In a subsequent patch it will be restored in the suspend, offline, and exit paths, mirroring how bios_min_perf is handled for MSR_AMD_CPPC_REQ. Link: https://docs.amd.com/v/u/en-US/69206_1.10_AMD64_CPPC_PUB Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 172100088f9b131b88bcde70724485470c20e7d2 Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:48 2026 +0530 x86/cpufeatures: Add AMD CPPC Performance Priority feature. Some future AMD processors have feature named "CPPC Performance Priority" which lets userspace specify different floor performance levels for different CPUs. The platform firmware takes these different floor performance levels into consideration while throttling the CPUs under power/thermal constraints. The presence of this feature is indicated by bit 16 of the EDX register for CPUID leaf 0x80000007. More details can be found in AMD Publication titled "AMD64 Collaborative Processor Performance Control (CPPC) Performance Priority" Revision 1.10. Define a new feature bit named X86_FEATURE_CPPC_PERF_PRIO to map to CPUID 0x80000007.EDX[16]. Reviewed-by: Borislav Petkov (AMD) Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit e67a5b6541831bbf1c40b6042a867a4594ec6b55 Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:47 2026 +0530 amd-pstate: Make certain freq_attrs conditionally visible Certain amd_pstate freq_attrs such as amd_pstate_hw_prefcore and amd_pstate_prefcore_ranking are enabled even when preferred core is not supported on the platform. Similarly there are common freq_attrs between the amd-pstate and the amd-pstate-epp drivers (eg: amd_pstate_max_freq, amd_pstate_lowest_nonlinear_freq, etc.) but are duplicated in two different freq_attr structs. Unify all the attributes in a single place and associate each of them with a visibility function that determines whether the attribute should be visible based on the underlying platform support and the current amd_pstate mode. Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit fcc25a291fbdca2c06c2c6602532050873f0c9de Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:46 2026 +0530 amd-pstate: Update cppc_req_cached in fast_switch case The function msr_update_perf() does not cache the new value that is written to MSR_AMD_CPPC_REQ into the variable cpudata->cppc_req_cached when the update is happening from the fast path. Fix that by caching the value everytime the MSR_AMD_CPPC_REQ gets updated. This issue was discovered by Claude Opus 4.6 with the aid of Chris Mason's AI review-prompts (https://github.com/masoncl/review-prompts/tree/main/kernel). Assisted-by: Claude:claude-opus-4.6 review-prompts/linux Reviewed-by: Mario Limonciello (AMD) Fixes: fff395796917 ("cpufreq/amd-pstate: Always write EPP value when updating perf") Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit beda3b363546a423e4e29a7395e04c0ac4ff677e Author: Gautham R. Shenoy Date: Thu Mar 26 17:17:45 2026 +0530 amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() On failure to set the epp, the function amd_pstate_epp_cpu_init() returns with an error code without freeing the cpudata object that was allocated at the beginning of the function. Ensure that the cpudata object is freed before returning from the function. This memory leak was discovered by Claude Opus 4.6 with the aid of Chris Mason's AI review-prompts (https://github.com/masoncl/review-prompts/tree/main/kernel). Assisted-by: Claude:claude-opus-4.6 review-prompts/linux Fixes: f9a378ff6443 ("cpufreq/amd-pstate: Set different default EPP policy for Epyc and Ryzen") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 01968164d94762db2f703647c5acfa28613844f1 Author: Zhiguo Niu Date: Thu Mar 5 11:22:46 2026 +0800 f2fs: fix to preserve previous reserve_{blocks,node} value when remount The following steps will change previous value of reserve_{blocks,node}, this dones not match the original intention. 1.mount -t f2fs -o reserve_root=8192 imgfile test_mount/ F2FS-fs (loop56): Mounted with checkpoint version = 1b69f8c7 mount info: /dev/block/loop56 on /data/test_mount type f2fs (xxx,reserve_root=8192,reserve_node=0,resuid=0,resgid=0,xxx) 2.mount -t f2fs -o remount,reserve_root=4096 /data/test_mount F2FS-fs (loop56): Preserve previous reserve_root=8192 check mount info: reserve_root change to 4096 /dev/block/loop56 on /data/test_mount type f2fs (xxx,reserve_root=4096,reserve_node=0,resuid=0,resgid=0,xxx) Prior to commit d18535132523 ("f2fs: separate the options parsing and options checking"), the value of reserve_{blocks,node} was only set during the first mount, along with the corresponding mount option F2FS_MOUNT_RESERVE_{ROOT,NODE} . If the mount option F2FS_MOUNT_RESERVE_{ROOT,NODE} was found to have been set during the mount/remount, the previously value of reserve_{blocks,node} would also be preserved, as shown in the code below. if (test_opt(sbi, RESERVE_ROOT)) { f2fs_info(sbi, "Preserve previous reserve_root=%u", F2FS_OPTION(sbi).root_reserved_blocks); } else { F2FS_OPTION(sbi).root_reserved_blocks = arg; set_opt(sbi, RESERVE_ROOT); } But commit d18535132523 ("f2fs: separate the options parsing and options checking") only preserved the previous mount option; it did not preserve the previous value of reserve_{blocks,node}. Since value of reserve_{blocks,node} value is assigned or not depends on ctx->spec_mask, ctx->spec_mask should be alos handled in f2fs_check_opt_consistency. This patch will clear the corresponding ctx->spec_mask bits in f2fs_check_opt_consistency to preserve the previously values of reserve_{blocks,node} if it already have a value. Fixes: d18535132523 ("f2fs: separate the options parsing and options checking") Signed-off-by: Zhiguo Niu Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8979bc3d2a252940a277392b5eb6e52be7a3e1a5 Author: Yongpeng Yang Date: Tue Mar 24 17:47:08 2026 +0800 f2fs: invalidate block device page cache on umount Neither F2FS nor VFS invalidates the block device page cache, which results in reading stale metadata. An example scenario is shown below: Terminal A Terminal B mount /dev/vdb /mnt/f2fs touch mx // ino = 4 sync dump.f2fs -i 4 /dev/vdb// block on "[Y/N]" touch mx2 // ino = 5 sync umount /mnt/f2fs dump.f2fs -i 5 /dev/vdb // block addr is 0 After umount, the block device page cache is not purged, causing `dump.f2fs -i 5 /dev/vdb` to read stale metadata and see inode 5 with block address 0. Btrfs has encountered a similar issue before, the solution there was to call sync_blockdev() and invalidate_bdev() when the device is closed: mail-archive.com/linux-btrfs@vger.kernel.org/msg54188.html For the root user, the f2fs kernel calls sync_blockdev() on umount to flush all cached data to disk, and f2fs-tools can release the page cache by issuing ioctl(fd, BLKFLSBUF) when accessing the device. However, non-root users are not permitted to drop the page cache, and may still observe stale data. This patch calls sync_blockdev() and invalidate_bdev() during umount to invalidate the block device page cache, thereby preventing stale metadata from being read. Note that this may result in an extra sync_blockdev() call on the first device, in both f2fs_put_super() and kill_block_super(). The second call do nothing, as there are no dirty pages left to flush. It ensures that non-root users do not observe stale data. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 02d91398a602c394d72cd61a67c84e2730c5f79b Author: Daeho Jeong Date: Mon Mar 16 11:59:54 2026 -0700 f2fs: fix to freeze GC and discard threads quickly Suspend can fail if kernel threads do not freeze for a while. f2fs_gc and f2fs_discard threads can perform long-running operations that prevent them from reaching a freeze point in a timely manner. This patch adds explicit freezing checks in the following locations: 1. f2fs_gc: Added a check at the 'retry' label to exit the loop quickly if freezing is requested, especially during heavy GC rounds. 2. __issue_discard_cmd: Added a 'suspended' flag to break both inner and outer loops during discard command issuance if freezing is detected after at least one command has been issued. 3. __issue_discard_cmd_orderly: Added a similar check for orderly discard to ensure responsiveness. These checks ensure that the threads release locks safely and enter the frozen state. Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7b9161a605e91d0987e2596a245dc1f21621b23f Author: Chao Yu Date: Mon Mar 9 02:22:37 2026 +0000 f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer syzbot reported a f2fs bug as below: BUG: KMSAN: uninit-value in f2fs_sanity_check_node_footer+0x374/0xa20 fs/f2fs/node.c:1520 f2fs_sanity_check_node_footer+0x374/0xa20 fs/f2fs/node.c:1520 f2fs_finish_read_bio+0xe1e/0x1d60 fs/f2fs/data.c:177 f2fs_read_end_io+0x6ab/0x2220 fs/f2fs/data.c:-1 bio_endio+0x1006/0x1160 block/bio.c:1792 submit_bio_noacct+0x533/0x2960 block/blk-core.c:891 submit_bio+0x57a/0x620 block/blk-core.c:926 blk_crypto_submit_bio include/linux/blk-crypto.h:203 [inline] f2fs_submit_read_bio+0x12c/0x360 fs/f2fs/data.c:557 f2fs_submit_page_bio+0xee2/0x1450 fs/f2fs/data.c:775 read_node_folio+0x384/0x4b0 fs/f2fs/node.c:1481 __get_node_folio+0x5db/0x15d0 fs/f2fs/node.c:1576 f2fs_get_inode_folio+0x40/0x50 fs/f2fs/node.c:1623 do_read_inode fs/f2fs/inode.c:425 [inline] f2fs_iget+0x1209/0x9380 fs/f2fs/inode.c:596 f2fs_fill_super+0x8f5a/0xb2e0 fs/f2fs/super.c:5184 get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1694 get_tree_bdev+0x38/0x50 fs/super.c:1717 f2fs_get_tree+0x35/0x40 fs/f2fs/super.c:5436 vfs_get_tree+0xb3/0x5d0 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline] do_new_mount_fc fs/namespace.c:3763 [inline] do_new_mount+0x885/0x1dd0 fs/namespace.c:3839 path_mount+0x7a2/0x20b0 fs/namespace.c:4159 do_mount fs/namespace.c:4172 [inline] __do_sys_mount fs/namespace.c:4361 [inline] __se_sys_mount+0x704/0x7f0 fs/namespace.c:4338 __x64_sys_mount+0xe4/0x150 fs/namespace.c:4338 x64_sys_call+0x39f0/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:166 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is: in f2fs_finish_read_bio(), we may access uninit data in folio if we failed to read the data from device into folio, let's add a check condition to avoid such issue. Cc: stable@kernel.org Fixes: 50ac3ecd8e05 ("f2fs: fix to do sanity check on node footer in {read,write}_end_io") Reported-by: syzbot+9aac813cdc456cdd49f8@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/69a9ca26.a70a0220.305d9a.0000.GAE@google.com Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 6a5e3de9c2bb0b691d16789a5d19e9276a09b308 Author: Chao Yu Date: Fri Mar 6 12:24:20 2026 +0000 f2fs: fix false alarm of lockdep on cp_global_sem lock lockdep reported a potential deadlock: a) TCMU device removal context: - call del_gendisk() to get q->q_usage_counter - call start_flush_work() to get work_completion of wb->dwork b) f2fs writeback context: - in wb_workfn(), which holds work_completion of wb->dwork - call f2fs_balance_fs() to get sbi->gc_lock c) f2fs vfs_write context: - call f2fs_gc() to get sbi->gc_lock - call f2fs_write_checkpoint() to get sbi->cp_global_sem d) f2fs mount context: - call recover_fsync_data() to get sbi->cp_global_sem - call f2fs_check_and_fix_write_pointer() to call blkdev_report_zones() that goes down to blk_mq_alloc_request and get q->q_usage_counter Original callstack is in Closes tag. However, I think this is a false alarm due to before mount returns successfully (context d), we can not access file therein via vfs_write (context c). Let's introduce per-sb cp_global_sem_key, and assign the key for cp_global_sem, so that lockdep can recognize cp_global_sem from different super block correctly. A lot of work are done by Shin'ichiro Kawasaki, thanks a lot for the work. Fixes: c426d99127b1 ("f2fs: Check write pointer consistency of open zones") Cc: stable@kernel.org Reported-and-tested-by: Shin'ichiro Kawasaki Closes: https://lore.kernel.org/linux-f2fs-devel/20260218125237.3340441-1-shinichiro.kawasaki@wdc.com Signed-off-by: Shin'ichiro Kawasaki Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 238e14eb7226f883b72caccd2d37bf5707df066b Author: Yongpeng Yang Date: Tue Mar 10 17:36:14 2026 +0800 f2fs: fix data loss caused by incorrect use of nat_entry flag Data loss can occur when fsync is performed on a newly created file (before any checkpoint has been written) concurrently with a checkpoint operation. The scenario is as follows: create & write & fsync 'file A' write checkpoint - f2fs_do_sync_file // inline inode - f2fs_write_inode // inode folio is dirty - f2fs_write_checkpoint - f2fs_flush_merged_writes - f2fs_sync_node_pages - f2fs_flush_nat_entries - f2fs_fsync_node_pages // no dirty node - f2fs_need_inode_block_update // return false SPO and lost 'file A' f2fs_flush_nat_entries() sets the IS_CHECKPOINTED and HAS_LAST_FSYNC flags for the nat_entry, but this does not mean that the checkpoint has actually completed successfully. However, f2fs_need_inode_block_update() checks these flags and incorrectly assumes that the checkpoint has finished. The root cause is that the semantics of IS_CHECKPOINTED and HAS_LAST_FSYNC are only guaranteed after the checkpoint write fully completes. This patch modifies f2fs_need_inode_block_update() to acquire the sbi->node_write lock before reading the nat_entry flags, ensuring that once IS_CHECKPOINTED and HAS_LAST_FSYNC are observed to be set, the checkpoint operation has already completed. Fixes: e05df3b115e7 ("f2fs: add node operations") Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit dccd324fa9bd1a2907a63fa4cc2651f687b2b5d0 Author: Daeho Jeong Date: Mon Mar 16 11:59:21 2026 -0700 f2fs: fix to skip empty sections in f2fs_get_victim In age-based victim selection (ATGC, AT_SSR, or GC_CB), f2fs_get_victim can encounter sections with zero valid blocks. This situation often arises when checkpoint is disabled or due to race conditions between SIT updates and dirty list management. In such cases, f2fs_get_section_mtime() returns INVALID_MTIME, which subsequently triggers a fatal f2fs_bug_on(sbi, mtime == INVALID_MTIME) in add_victim_entry() or get_cb_cost(). This patch adds a check in f2fs_get_victim's selection loop to skip sections with no valid blocks. This prevents unnecessary age calculations for empty sections and avoids the associated kernel panic. This change also allows removing redundant checks in add_victim_entry(). Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit fe9b8b30b97102859a9102be7bd2a09803bd90bd Author: Yongpeng Yang Date: Wed Mar 18 16:46:35 2026 +0800 f2fs: fix inline data not being written to disk in writeback path When f2fs_fiemap() is called with `fileinfo->fi_flags` containing the FIEMAP_FLAG_SYNC flag, it attempts to write data to disk before retrieving file mappings via filemap_write_and_wait(). However, there is an issue where the file does not get mapped as expected. The following scenario can occur: root@vm:/mnt/f2fs# dd if=/dev/zero of=data.3k bs=3k count=1 root@vm:/mnt/f2fs# xfs_io data.3k -c "fiemap -v 0 4096" data.3k: EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS 0: [0..5]: 0..5 6 0x307 The root cause of this issue is that f2fs_write_single_data_page() only calls f2fs_write_inline_data() to copy data from the data folio to the inode folio, and it clears the dirty flag on the data folio. However, it does not mark the data folio as writeback. When __filemap_fdatawait_range() checks for folios with the writeback flag, it returns early, causing f2fs_fiemap() to report that the file has no mapping. To fix this issue, the solution is to call f2fs_write_single_node_folio() in f2fs_inline_data_fiemap() when getting fiemap with FIEMAP_FLAG_SYNC flags. This patch ensures that the inode folio is written back and the writeback process completes before proceeding. Cc: stable@kernel.org Fixes: 9ffe0fb5f3bb ("f2fs: handle inline data operations") Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c3e238bd1f56993f205ef83889d406dfeaf717a8 Author: Yongpeng Yang Date: Wed Mar 18 16:45:34 2026 +0800 f2fs: fix fsck inconsistency caused by FGGC of node block During FGGC node block migration, fsck may incorrectly treat the migrated node block as fsync-written data. The reproduction scenario: root@vm:/mnt/f2fs# seq 1 2048 | xargs -n 1 ./test_sync // write inline inode and sync root@vm:/mnt/f2fs# rm -f 1 root@vm:/mnt/f2fs# sync root@vm:/mnt/f2fs# f2fs_io gc_range // move data block in sync mode and not write CP SPO, "fsck --dry-run" find inode has already checkpointed but still with DENT_BIT_SHIFT set The root cause is that GC does not clear the dentry mark and fsync mark during node block migration, leading fsck to misinterpret them as user-issued fsync writes. In BGGC mode, node block migration is handled by f2fs_sync_node_pages(), which guarantees the dentry and fsync marks are cleared before writing. This patch move the set/clear of the fsync|dentry marks into __write_node_folio to make the logic clearer, and ensures the fsync|dentry mark is cleared in FGGC. Cc: stable@kernel.org Fixes: da011cc0da8c ("f2fs: move node pages only in victim section during GC") Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 019f9dda7f66e55eb94cd32e1d3fff5835f73fbc Author: Yongpeng Yang Date: Tue Mar 10 17:36:12 2026 +0800 f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage f2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion with the checkpoint path, which can result in an incorrect inode block marking state. The scenario is as follows: create & write & fsync 'file A' write checkpoint - f2fs_do_sync_file // inline inode - f2fs_write_inode // inode folio is dirty - f2fs_write_checkpoint - f2fs_flush_merged_writes - f2fs_sync_node_pages - f2fs_fsync_node_pages // no dirty node - f2fs_need_inode_block_update // return true - f2fs_fsync_node_pages // inode dirtied - f2fs_need_dentry_mark //return true - f2fs_flush_nat_entries - f2fs_write_checkpoint end - __write_node_folio // inode with DENT_BIT_SHIFT set SPO, "fsck --dry-run" find inode has already checkpointed but still with DENT_BIT_SHIFT set The state observed by f2fs_need_dentry_mark() can differ from the state observed in __write_node_folio() after acquiring sbi->node_write. The root cause is that the semantics of IS_CHECKPOINTED and HAS_FSYNCED_INODE are only guaranteed after the checkpoint write has fully completed. This patch moves set_dentry_mark() into __write_node_folio() and protects it with the sbi->node_write lock. Cc: stable@kernel.org Fixes: 88bd02c9472a ("f2fs: fix conditions to remain recovery information in f2fs_sync_file") Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 6af249c996f7d73a3435f9e577956fa259347d18 Author: Chao Yu Date: Wed Mar 11 21:35:42 2026 +0800 f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Syzbot reported a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:1900! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 6527 Comm: syz.5.110 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:f2fs_issue_discard_timeout+0x59b/0x5a0 fs/f2fs/segment.c:1900 Code: d9 80 e1 07 80 c1 03 38 c1 0f 8c d6 fe ff ff 48 89 df e8 a8 5e fa fd e9 c9 fe ff ff e8 4e 46 94 fd 90 0f 0b e8 46 46 94 fd 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 RSP: 0018:ffffc9000494f940 EFLAGS: 00010283 RAX: ffffffff843009ca RBX: 0000000000000001 RCX: 0000000000080000 RDX: ffffc9001ca78000 RSI: 00000000000029f3 RDI: 00000000000029f4 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed100893a431 R12: 1ffff1100893a430 R13: 1ffff1100c2b702c R14: dffffc0000000000 R15: ffff8880449d2160 FS: 00007ffa35fed6c0(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2b68634000 CR3: 0000000039f62000 CR4: 00000000003526f0 Call Trace: __f2fs_remount fs/f2fs/super.c:2960 [inline] f2fs_reconfigure+0x108a/0x1710 fs/f2fs/super.c:5443 reconfigure_super+0x227/0x8a0 fs/super.c:1080 do_remount fs/namespace.c:3391 [inline] path_mount+0xdc5/0x10e0 fs/namespace.c:4151 do_mount fs/namespace.c:4172 [inline] __do_sys_mount fs/namespace.c:4361 [inline] __se_sys_mount+0x31d/0x420 fs/namespace.c:4338 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ffa37dbda0a The root cause is there will be race condition in between f2fs_ioc_fitrim() and f2fs_remount(): - f2fs_remount - f2fs_ioc_fitrim - f2fs_issue_discard_timeout - __issue_discard_cmd - __drop_discard_cmd - __wait_all_discard_cmd - f2fs_trim_fs - f2fs_write_checkpoint - f2fs_clear_prefree_segments - f2fs_issue_discard - __issue_discard_async - __queue_discard_cmd - __update_discard_tree_range - __insert_discard_cmd - __create_discard_cmd : atomic_inc(&dcc->discard_cmd_cnt); - sanity check on dcc->discard_cmd_cnt (expect discard_cmd_cnt to be zero) This will only happen when fitrim races w/ remount rw, if we remount to readonly filesystem, remount will wait until mnt_pcp.mnt_writers to zero, that means fitrim is not in process at that time. Cc: stable@kernel.org Fixes: 2482c4325dfe ("f2fs: detect bug_on in f2fs_wait_discard_bios") Reported-by: syzbot+62538b67389ee582837a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/69b07d7c.050a0220.8df7.09a1.GAE@google.com Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 68cb1a6bf3895dedc8540caf2d459b7d9249b3b0 Author: Yongpeng Yang Date: Wed Mar 18 16:45:33 2026 +0800 f2fs: refactor node footer flag setting related code This patch refactors the node footer flag setting code to simplify redundant logic and adjust function parameters and return types. No logical changes. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 92c20989366e023b74fa0c1028af9436c1917dbf Author: Yongpeng Yang Date: Wed Mar 18 16:45:32 2026 +0800 f2fs: refactor f2fs_move_node_folio function This patch refactor the f2fs_move_node_folio() function. No logical changes. Cc: stable@kernel.org Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1ec8bea903f439acca927144570e1e419d2f9c9a Author: Mayuresh Chitale Date: Thu Apr 2 15:48:14 2026 +0530 KVM: riscv: selftests: Implement kvm_arch_has_default_irqchip kvm_arch_has_default_irqchip is required for irqfd_test and returns true if an in-kernel interrupt controller is supported. Fixes: a133052666bed ("KVM: selftests: Fix irqfd_test for non-x86 architectures") Signed-off-by: Mayuresh Chitale Link: https://lore.kernel.org/r/20260402101818.2982071-1-mayuresh.chitale@oss.qualcomm.com Signed-off-by: Anup Patel commit 5471878477a3e9d4851f39c8becbb39d290d0192 Author: Thomas Weißschuh Date: Tue Mar 31 19:50:22 2026 +0200 kbuild: vdso_install: drop build ID architecture allow-list Many architectures which do generate build IDs are missing from this list. For example arm64, riscv, loongarch, mips. Now that errors from readelf and binaries without any build ID are handled gracefully, the allow-list is not necessary anymore, drop it. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260331-kbuild-vdso-install-v2-4-606d0dc6beca@weissschuh.net Signed-off-by: Nicolas Schier commit e4fb2342358c36b461632382fae9dfa11a957897 Author: Thomas Weißschuh Date: Tue Mar 31 19:50:21 2026 +0200 kbuild: vdso_install: gracefully handle images without build ID If the vDSO does not contain a build ID, skip the symlink step. This will allow the removal of the explicit list of architectures. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260331-kbuild-vdso-install-v2-3-606d0dc6beca@weissschuh.net Signed-off-by: Nicolas Schier commit ec2137476df8c9551d8bad4c3b22b540035164c1 Author: Thomas Weißschuh Date: Tue Mar 31 19:50:20 2026 +0200 kbuild: vdso_install: hide readelf warnings If 'readelf -n' encounters a note it does not recognize it emits a warning. This for example happens when inspecting a compat vDSO for which the main kernel toolchain was not used. However the relevant build ID note is always readable, so the warnings are pointless. Hide the warnings to make it possible to extract build IDs for more architectures in the future. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260331-kbuild-vdso-install-v2-2-606d0dc6beca@weissschuh.net Signed-off-by: Nicolas Schier commit efa13f43c550e612c78e5dba7d776a6d5d5fed9f Author: Thomas Weißschuh Date: Tue Mar 31 19:50:19 2026 +0200 kbuild: vdso_install: split out the readelf invocation Split up the logic as some upcoming changes to the readelf invocation would create a very long line otherwise. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260331-kbuild-vdso-install-v2-1-606d0dc6beca@weissschuh.net Signed-off-by: Nicolas Schier commit e8f504c790103a3221a2f2082704b9f2245d81e8 Merge: dee5680d3e4210 8ea6e25c853603 Author: Mark Brown Date: Thu Apr 2 16:33:51 2026 +0100 ASoC: qcom: q6dsp: few fixes and enhancements Srinivas Kandagatla says: This patchset contains few fixes for the bugs hit during testing with Monza EVK platform - around array out of bounds access on dai ids which keep extending but the drivers seems to have hardcoded some numbers, fix this and clean the mess up - fix few issues discovered while trying to shut down dsp. - flooding rpmsg with write requests due to not resetting queue pointer, fix this resetting the pointer in trigger stop. - possible multiple graph opens which can result in open failures. Apart from this few new enhancements to the dsp side - add new LPI MI2S and senary dai entries - handle pipewire and Displayport issues by moving graph start to trigger level, which should fix outstanding pipewire and DP issues on Qualcomm SoCs. - remove some unnessary loops in hot path - support early memory map on DSP. Tested this on top of linux-next on VENTUNO-Q platform. commit 8ea6e25c8536031604d95dc29a90ef0f114012d7 Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:18 2026 +0000 ASoC: qcom: q6apm: Add support for early buffer mapping on DSP Buffers are allocated on pcm_new and mapped in the dsp on every prepare call, which is inefficient and unnecessary. Add new functions q6apm_[un]map_memory_fixed_region to map it on to dsp only once after allocation. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260402081118.348071-14-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit d8b4163038dc02114474d96acefcb48adb4c6e0f Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:17 2026 +0000 ASoC: qcom: qdsp6: remove search for module iid in hot path Remove searching for Shared Memory module instance id on every read/write call, this is un-necessary if we can cache the shared memory module instance id per PCM graph. Add new member to graph struct to store shared memory module instance id to avoid searching for this in hot path. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260402081118.348071-13-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit b54a38af713830e76f60bab967fd06ee4301eaee Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:16 2026 +0000 ASoC: qcom: q6apm-lpass-dai: move graph start to trigger Start the graph at trigger callback. Staring the graph at prepare does not make sense as there is no data transfer at this point. Moving this to trigger will also help cope situation where pipewire is not happy if display port is not connected during start. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260402081118.348071-12-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 8f542c7c4aa969331b9be2bad1a1c29883555ab8 Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:15 2026 +0000 ASoC: qcom: qdapm-lpass-dai: correct the error message Fix the error message to reflect the actual graph stop error instead of graph close error. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260402081118.348071-11-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit ae0de4e50f8fbd828aff2d79e778ee0e171366ee Author: Mohammad Rafi Shaik Date: Thu Apr 2 08:11:14 2026 +0000 ASoC: qcom: q6dsp: Add Senary MI2S audio interface support Introduces support for the Senary MI2S audio interface in the Qualcomm q6dsp. Add new AFE port IDs for Senary MI2S RX and TX and include the necessary mappings in the port configuration to allow audio routing over the Senary MI2S interface. Signed-off-by: Mohammad Rafi Shaik Signed-off-by: Srinivas Kandagatla Tested-by: Val Packett # sm7325-motorola-dubai Link: https://patch.msgid.link/20260402081118.348071-10-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit bcd0df1ebc9d71e2d53e47fd41ff1482753649b0 Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:13 2026 +0000 ASoC: qcom: qdsp6: lpass-ports: add support for LPASS LPI MI2S dais Add support for LPASS LPI MI2S dais in the dai-driver, these dais are used in Monaco based platform devices. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260402081118.348071-9-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit d49ee8faefecd4d2eb5c6c9f419f4db9488d68aa Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:12 2026 +0000 ASoC: qcom: common: validate cpu dai id during parsing lpass ports numbers have been added but the afe/apm driver never got updated with new max port value that it uses to store dai specific data. There are more than one places these values are cached and always become out of sync. This will result in array out of bounds and weird driver behaviour. To catch such issues, first add a single place where we can define max port and second add a check in common parsing code which can error out before corrupting the memory with out of bounds array access. This should help both avoid and catch these type of mistakes in future. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260402081118.348071-8-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit e46957f27c6004f3ab5ec456f4e848950364ebc1 Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:11 2026 +0000 ASoC: dt-bindings: qcom: add LPASS LPI MI2S dai ids Add new dai ids entries for LPASS LPI MI2S and SENARY MI2S audio lines. Co-developed-by: Mohammad Rafi Shaik Signed-off-by: Mohammad Rafi Shaik Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260402081118.348071-7-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit cab45ab95ce7600fc0ff84585c77fd45b7b0d67c Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:10 2026 +0000 ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Reset queue pointer on SNDRV_PCM_TRIGGER_STOP event to be inline with resetting appl_ptr. Without this we will end up with a queue_ptr out of sync and driver could try to send data that is not ready yet. Fix this by resetting the queue_ptr. Fixes: 3d4a4411aa8bb ("ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260402081118.348071-6-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 69acc488aaf39d0ddf6c3cf0e47c1873d39919a2 Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:09 2026 +0000 ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens As prepare can be called mulitple times, this can result in multiple graph opens for playback path. This will result in a memory leaks, fix this by adding a check before opening. Fixes: be1fae62cf25 ("ASoC: q6apm-lpass-dai: close graph on prepare errors") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260402081118.348071-5-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit d5bfdd28e0cdd45043ae6e0ac168a451d59283dc Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:08 2026 +0000 ASoC: qcom: qdsp6: topology: check widget type before accessing data Check widget type before accessing the private data, as this could a virtual widget which is no associated with a dsp graph, container and module. Accessing witout check could lead to incorrect memory access. Fixes: 36ad9bf1d93d ("ASoC: qdsp6: audioreach: add topology support") Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260402081118.348071-4-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 4a0e1bcc98f7281d1605768bd2fe71eacc34f9b7 Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:07 2026 +0000 ASoC: qcom: q6apm: remove child devices when apm is removed looks like q6apm driver does not remove the child driver q6apm-dai and q6apm-bedais when the this driver is removed. Fix this by depopulating them in remove callback. With this change when the dsp is shutdown all the devices associated with q6apm will now be removed. Fixes: 5477518b8a0e ("ASoC: qdsp6: audioreach: add q6apm support") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260402081118.348071-3-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 6ec1235fc941dac6c011b30ee01d9220ff87e0cd Author: Srinivas Kandagatla Date: Thu Apr 2 08:11:06 2026 +0000 ASoC: qcom: q6apm: move component registration to unmanaged version q6apm component registers dais dynamically from ASoC toplology, which are allocated using device managed version apis. Allocating both component and dynamic dais using managed version could lead to incorrect free ordering, dai will be freed while component still holding references to it. Fix this issue by moving component to unmanged version so that the dai pointers are only freeded after the component is removed. ================================================================== BUG: KASAN: slab-use-after-free in snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core] Read of size 8 at addr ffff00084493a6e8 by task kworker/u48:0/3426 Tainted: [W]=WARN Hardware name: LENOVO 21N2ZC5PUS/21N2ZC5PUS, BIOS N42ET57W (1.31 ) 08/08/2024 Workqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface] Call trace: show_stack+0x28/0x7c (C) dump_stack_lvl+0x60/0x80 print_report+0x160/0x4b4 kasan_report+0xac/0xfc __asan_report_load8_noabort+0x20/0x34 snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core] snd_soc_unregister_component_by_driver+0x50/0x88 [snd_soc_core] devm_component_release+0x30/0x5c [snd_soc_core] devres_release_all+0x13c/0x210 device_unbind_cleanup+0x20/0x190 device_release_driver_internal+0x350/0x468 device_release_driver+0x18/0x30 bus_remove_device+0x1a0/0x35c device_del+0x314/0x7f0 device_unregister+0x20/0xbc apr_remove_device+0x5c/0x7c [apr] device_for_each_child+0xd8/0x160 apr_pd_status+0x7c/0xa8 [apr] pdr_notifier_work+0x114/0x240 [pdr_interface] process_one_work+0x500/0xb70 worker_thread+0x630/0xfb0 kthread+0x370/0x6c0 ret_from_fork+0x10/0x20 Allocated by task 77: kasan_save_stack+0x40/0x68 kasan_save_track+0x20/0x40 kasan_save_alloc_info+0x44/0x58 __kasan_kmalloc+0xbc/0xdc __kmalloc_node_track_caller_noprof+0x1f4/0x620 devm_kmalloc+0x7c/0x1c8 snd_soc_register_dai+0x50/0x4f0 [snd_soc_core] soc_tplg_pcm_elems_load+0x55c/0x1eb8 [snd_soc_core] snd_soc_tplg_component_load+0x4f8/0xb60 [snd_soc_core] audioreach_tplg_init+0x124/0x1fc [snd_q6apm] q6apm_audio_probe+0x10/0x1c [snd_q6apm] snd_soc_component_probe+0x5c/0x118 [snd_soc_core] soc_probe_component+0x44c/0xaf0 [snd_soc_core] snd_soc_bind_card+0xad0/0x2370 [snd_soc_core] snd_soc_register_card+0x3b0/0x4c0 [snd_soc_core] devm_snd_soc_register_card+0x50/0xc8 [snd_soc_core] x1e80100_platform_probe+0x208/0x368 [snd_soc_x1e80100] platform_probe+0xc0/0x188 really_probe+0x188/0x804 __driver_probe_device+0x158/0x358 driver_probe_device+0x60/0x190 __device_attach_driver+0x16c/0x2a8 bus_for_each_drv+0x100/0x194 __device_attach+0x174/0x380 device_initial_probe+0x14/0x20 bus_probe_device+0x124/0x154 deferred_probe_work_func+0x140/0x220 process_one_work+0x500/0xb70 worker_thread+0x630/0xfb0 kthread+0x370/0x6c0 ret_from_fork+0x10/0x20 Freed by task 3426: kasan_save_stack+0x40/0x68 kasan_save_track+0x20/0x40 __kasan_save_free_info+0x4c/0x80 __kasan_slab_free+0x78/0xa0 kfree+0x100/0x4a4 devres_release_all+0x144/0x210 device_unbind_cleanup+0x20/0x190 device_release_driver_internal+0x350/0x468 device_release_driver+0x18/0x30 bus_remove_device+0x1a0/0x35c device_del+0x314/0x7f0 device_unregister+0x20/0xbc apr_remove_device+0x5c/0x7c [apr] device_for_each_child+0xd8/0x160 apr_pd_status+0x7c/0xa8 [apr] pdr_notifier_work+0x114/0x240 [pdr_interface] process_one_work+0x500/0xb70 worker_thread+0x630/0xfb0 kthread+0x370/0x6c0 ret_from_fork+0x10/0x20 Fixes: 5477518b8a0e ("ASoC: qdsp6: audioreach: add q6apm support") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260402081118.348071-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 7933969e1f733e18795a755cd9822ccf510140a1 Author: Thomas Weißschuh Date: Wed Apr 1 17:08:31 2026 +0200 tools/nolibc: explicitly list architecture headers Relying on $(wildcard) is brittle and non-deterministic. similar to all the other headers. Switch the list of architecture headers to an explicit list, Link: https://patch.msgid.link/20260401-nolibc-cleanup-v1-4-bcf4c9f5c1be@weissschuh.net Signed-off-by: Thomas Weißschuh commit b972b37cb6b8216922c1e817b0bab4cfed55fc44 Author: Thomas Weißschuh Date: Wed Apr 1 17:08:30 2026 +0200 tools/nolibc: drop superfluous definition of Q Q is already defined by tools/scripts/Makefile.include which is included at the top of tools/include/nolibc/Makefile. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260401-nolibc-cleanup-v1-3-bcf4c9f5c1be@weissschuh.net commit 010d03d0e8fb0a2690d5a79c6580d8c4f32c937e Author: Thomas Weißschuh Date: Wed Apr 1 17:08:29 2026 +0200 tools/nolibc: drop superfluous invocation of mkdir The call to 'mkdir -p $(OUTPUT)sysroot/include' will also create the sysroot directory. Drop the unnecessary explicit invocation of mkdir. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260401-nolibc-cleanup-v1-2-bcf4c9f5c1be@weissschuh.net commit 5bf4b30ed49b9af281bdf11c788f382faa432cfd Author: Thomas Weißschuh Date: Wed Apr 1 17:08:28 2026 +0200 tools/nolibc: drop superfluous invocation of 'make headers' The headers_install target of the toplevel Makefile will already make sure that the headers are up-to-date. Drop the superfluous explicit invocation. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260401-nolibc-cleanup-v1-1-bcf4c9f5c1be@weissschuh.net commit e4cabc973133c0623a63e6e3bc3d64e53a2e6d62 Author: Kexin Sun Date: Sat Mar 21 18:57:04 2026 +0800 drivers/base/memory: fix stale reference to memory_block_add_nid() The function memory_block_add_nid() was renamed to memory_block_add_nid_early() by commit 0a947c14e48c ("drivers/base: move memory_block_add_nid() into the caller"). Update the stale reference in add_memory_block(). Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Reviewed-by: David Hildenbrand (Arm) Link: https://patch.msgid.link/20260321105704.6093-1-kexinsun@smail.nju.edu.cn Signed-off-by: Greg Kroah-Hartman commit 70fa0c308aa2db6859c2ea22473d421bdde56668 Author: Andy Shevchenko Date: Wed Mar 18 15:21:40 2026 +0100 device property: Document how to check for the property presence Currently it's unclear if one may or may not rely on the error codes returned from the property getters to check for the property presence. Clarify this by updating kernel-doc for fwnode_property_*() and device_property_*() where it's applicable. Reported-by: Guenter Roeck Closes: https://lore.kernel.org/r/4b24f1f4-b395-467a-81b7-1334a2d48845@roeck-us.net Signed-off-by: Andy Shevchenko Reviewed-by: Sakari Ailus Link: https://patch.msgid.link/20260318142404.2526642-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 0a18c3bc8d294f1f23daa9f9ee44e5dd2c2994d6 Author: Alexander Usyskin Date: Sun Feb 1 11:43:58 2026 +0200 mei: csc: wake device while reading firmware status The CSC has firmware status registers in MMIO and they may be unaccessible while device is suspended. Wake device while reading firmware status via sysfs. Reviewed-by: Mika Westerberg Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260201094358.1440593-8-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 72fdf0bbd3574a67148fb41473593196687a9a0e Author: Alexander Usyskin Date: Sun Feb 1 11:43:57 2026 +0200 mei: csc: support controller with separate PCI device Intel PCI driver for chassis controller embedded in Intel graphics devices. An MEI device here called CSC can be embedded in discrete Intel graphics devices having separate PCI device, to support a range of chassis tasks such as graphics card firmware update and security tasks. Reviewed-by: Mika Westerberg Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260201094358.1440593-7-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 60ca15971a9aa0647d20488b450d095c81c5b70a Author: Alexander Usyskin Date: Sun Feb 1 11:43:56 2026 +0200 mei: convert PCI error to common errno Ensure that callers receive only < 0 return value on error. Convert PCI error returned by pci_read_config_dword() to common errno before returning from function. Reviewed-by: Mika Westerberg Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260201094358.1440593-6-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit eb1b5fc76a940ce309ecc57dbc465dda09171229 Author: Alexander Usyskin Date: Sun Feb 1 11:43:55 2026 +0200 mei: trace: print return value of pci_cfg_read Extend debug capabilities. Add return value print in the trace_mei_pci_cfg_read(). Reviewed-by: Andy Shevchenko Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260201094358.1440593-5-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit bf025a8447796e51b944ec87ac96f680fa4022e1 Author: Alexander Usyskin Date: Sun Feb 1 11:43:54 2026 +0200 mei: me: move trace into firmware status read Move register trace near it actual read in the firmware status callback and make it adhere to the actual read type. Reviewed-by: Mika Westerberg Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260201094358.1440593-4-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit f3d0423d4150614c0f6b68c307daa1a6b29730ea Author: Alexander Usyskin Date: Sun Feb 1 11:43:53 2026 +0200 mei: fix idle print specifiers %01d is equal to %d, simplify the format. Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260201094358.1440593-3-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 9e7a2409ecf4d411b7cc91615b08f6a7576f0aaa Author: Alexander Usyskin Date: Sun Feb 1 11:43:52 2026 +0200 mei: me: use PCI_DEVICE_DATA macro Drop old local MEI_PCI_DEVICE macro and use common PCI_DEVICE_DATA instead. Update defines to adhere to current naming convention. Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260201094358.1440593-2-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 7e488b0af0216f40159cc19d5db1b614c80f5134 Author: Rafael J. Wysocki Date: Mon Feb 23 16:59:14 2026 +0100 sonypi: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the sonypi ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/2277493.Mh6RI2rZIc@rafael.j.wysocki Signed-off-by: Greg Kroah-Hartman commit 2d7ce8eb59ec880774c7500ac949f0100acba521 Author: Randy Dunlap Date: Wed Feb 25 21:12:07 2026 -0800 misc: apds990x: fix all kernel-doc warnings Move a #define so that it is not between kernel-doc and its struct declaration. Spell one struct member correctly. Warning: include/linux/platform_data/apds990x.h:33 #define APDS_PARAM_SCALE 4096; error: Cannot parse struct or union! Warning: include/linux/platform_data/apds990x.h:62 struct member 'pdrive' not described in 'apds990x_platform_data' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260226051207.547152-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit bdb6189600cd0ac8d048550a7cdd773ce5516cca Author: Thorsten Blum Date: Wed Feb 25 19:03:29 2026 +0100 most: usb: Use kzalloc_objs for endpoint address array Replace kcalloc() with kzalloc_objs() when allocating the endpoint address array to keep the size type-safe and match nearby allocations. Reformat ->busy_urbs allocation to a single line. No functional change. Signed-off-by: Thorsten Blum Reviewed-by: Kees Cook Link: https://patch.msgid.link/20260225180329.712101-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman commit 71f0a267346b330ab1c4d15d98fe6fa64b3b091b Author: Rafael J. Wysocki Date: Mon Feb 23 16:49:45 2026 +0100 hpet: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the HPET ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3611505.QJadu78ljV@rafael.j.wysocki Signed-off-by: Greg Kroah-Hartman commit b1c7f7aaabc81ea8a6be2e5cf7d0c5959306f197 Author: Tomasz Unger Date: Fri Feb 20 13:09:04 2026 +0100 misc: vmw_vmci: Fix spelling mistakes in comments 'occured' -> 'occurred' (two instances) Found by manual inspection. Signed-off-by: Tomasz Unger Link: https://patch.msgid.link/20260220120904.1907108-1-tomasz.unger@yahoo.pl Signed-off-by: Greg Kroah-Hartman commit e4599c1d2b0e5f50e6c317a5e045e986a43f30e4 Author: Ethan Nelson-Moore Date: Fri Jan 30 19:24:03 2026 -0800 parport: Remove completed item from to-do list A driver for the Sun BPP hardware exists in the kernel. Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260131032403.11118-1-enelsonmoore@gmail.com Signed-off-by: Greg Kroah-Hartman commit 16cf2e54cb5e2bf563fc11c1bebc662a49f2eeba Author: Ethan Nelson-Moore Date: Fri Jan 30 18:00:26 2026 -0800 char: remove unnecessary module_init/exit functions Two char drivers have unnecessary module_init and module_exit functions that are empty or just print a message. Remove them. Note that if a module_init function exists, a module_exit function must also exist; otherwise, the module cannot be unloaded. Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260131020027.45775-1-enelsonmoore@gmail.com Signed-off-by: Greg Kroah-Hartman commit 138f2ea90b66efafb6612d0a34346b56099b1c71 Author: Henry Zhang Date: Tue Jan 27 20:45:01 2026 -0500 speakup: Document bleeps parameter values The speakup documentation had a TODO about accepted values for the bleeps parameter. drivers/accessibility/speakup/main.c indicates that it's a bitmasked param where bit 0 controls beeping and bit 1 controls announcements. Signed-off-by: Henry Zhang Reviewed-by: Samuel Thibault Link: https://patch.msgid.link/20260128014501.1600263-1-zeri@umich.edu Signed-off-by: Greg Kroah-Hartman commit c230ae1f9480cf9d363ded8179b14b49c5d3dd69 Author: Jori Koolstra Date: Mon Mar 2 16:11:32 2026 +0100 pps: change pps_class to a const struct The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Change pps_class to be a const struct class and drop the class_create() call. Suggested-by: Greg Kroah-Hartman Signed-off-by: Jori Koolstra Acked-by: Rodolfo Giometti Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260302151132.3302993-1-jkoolstra@xs4all.nl Signed-off-by: Greg Kroah-Hartman commit f7a1fec4de122bba0872addf757dd8c26efc2917 Author: Jori Koolstra Date: Wed Apr 1 19:00:43 2026 +0200 most: replace cdev_component->class with a const struct class The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Replace cdev_component->class with a const struct class and drop the class_create() call. Compile tested only. Link: https://lore.kernel.org/all/2023040244-duffel-pushpin-f738@gregkh/ Suggested-by: Greg Kroah-Hartman Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20260401170043.3844117-1-jkoolstra@xs4all.nl Signed-off-by: Greg Kroah-Hartman commit 4dc0c899b14c3ea2c9b5f42b523301040d1c8100 Author: Jori Koolstra Date: Mon Mar 2 15:24:36 2026 +0100 pps: change pps_gen_class to a const struct The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Change pps_gen_class to be a const struct class and drop the class_create() call. Signed-off-by: Jori Koolstra Reviewed-by: Greg Kroah-Hartman Acked-by: Rodolfo Giometti Link: https://patch.msgid.link/20260302142436.3292766-1-jkoolstra@xs4all.nl Signed-off-by: Greg Kroah-Hartman commit 9aad71144fa3682cca3837a06c8623016790e7ec Author: Tyllis Xu Date: Sat Mar 14 11:58:05 2026 -0500 ibmasm: fix heap over-read in ibmasm_send_i2o_message() The ibmasm_send_i2o_message() function uses get_dot_command_size() to compute the byte count for memcpy_toio(), but this value is derived from user-controlled fields in the dot_command_header (command_size: u8, data_size: u16) and is never validated against the actual allocation size. A root user can write a small buffer with inflated header fields, causing memcpy_toio() to read up to ~65 KB past the end of the allocation into adjacent kernel heap, which is then forwarded to the service processor over MMIO. Silently clamping the copy size is not sufficient: if the header fields claim a larger size than the buffer, the SP receives a dot command whose own header is inconsistent with the I2O message length, which can cause the SP to desynchronize. Reject such commands outright by returning failure. Validate command_size before calling get_mfa_inbound() to avoid leaking an I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardware frame from the controller's free pool, and returning without a corresponding set_mfa_inbound() call would permanently exhaust it. Additionally, clamp command_size to I2O_COMMAND_SIZE before the memcpy_toio() so the MMIO write stays within the I2O message frame, consistent with the clamping already performed by outgoing_message_size() for the header field. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Tyllis Xu Link: https://patch.msgid.link/20260314165805.548293-1-LivelyCarpet87@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0eb09f737428e482a32a2e31e5e223f2b35a71d3 Author: Tyllis Xu Date: Sat Mar 14 11:53:54 2026 -0500 ibmasm: fix OOB reads in command_file_write due to missing size checks The command_file_write() handler allocates a kernel buffer of exactly count bytes and copies user data into it, but does not validate the buffer against the dot command protocol before passing it to get_dot_command_size() and get_dot_command_timeout(). Since both the allocation size (count) and the header fields (command_size, data_size) are independently user-controlled, an attacker can cause get_dot_command_size() to return a value exceeding the allocation, triggering OOB reads in get_dot_command_timeout() and an out-of-bounds memcpy_toio() that leaks kernel heap memory to the service processor. Fix with two guards: reject writes smaller than sizeof(struct dot_command_header) before allocation, then after copying user data reject commands where the buffer is smaller than the total size declared by the header (sizeof(header) + command_size + data_size). This ensures all subsequent header and payload field accesses stay within the buffer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Tyllis Xu Link: https://patch.msgid.link/20260314165355.548119-1-LivelyCarpet87@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4b6e6ead556734bdc14024c5f837132b1e7a4b84 Author: Tyllis Xu Date: Sun Mar 8 00:21:08 2026 -0600 misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() ibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read when the queue reader or writer index from hardware exceeds REMOTE_QUEUE_SIZE (60). A compromised service processor can trigger this by writing an out-of-range value to the reader or writer MMIO register before asserting an interrupt. Since writer is re-read from hardware on every loop iteration, it can also be set to an out-of-range value after the loop has already started. The root cause is that get_queue_reader() and get_queue_writer() return raw readl() values that are passed directly into get_queue_entry(), which computes: queue_begin + reader * sizeof(struct remote_input) with no bounds check. This unchecked MMIO address is then passed to memcpy_fromio(), reading 8 bytes from unintended device registers. For sufficiently large values the address falls outside the PCI BAR mapping entirely, triggering a machine check exception. Fix by checking both indices against REMOTE_QUEUE_SIZE at the top of the loop body, before any call to get_queue_entry(). On an out-of-range value, reset the reader register to 0 via set_queue_reader() before breaking, so that normal queue operation can resume if the corrupted hardware state is transient. Reported-by: Yuhao Jiang Fixes: 278d72ae8803 ("[PATCH] ibmasm driver: redesign handling of remote control events") Cc: stable@vger.kernel.org Cc: ychen@northwestern.edu Signed-off-by: Tyllis Xu Link: https://patch.msgid.link/20260308062108.258940-1-LivelyCarpet87@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2a8c2080b1a52ed70e01c29363539d15eca0a37b Author: Romain Gantois Date: Tue Mar 31 11:20:58 2026 +0200 misc: ti_fpc202: Support special-purpose GPIO lines with LED features The FPC202 dual port controller has 20 regular GPIO lines and 8 special GPIO lines with LED features. Each one of these "LED GPIOs" can output PWM and blink signals. Add support for the eight special-purpose GPIO lines to the existing FPC202 driver's GPIO support. Add support for registering led-class devices on these GPIO lines. Signed-off-by: Romain Gantois Link: https://patch.msgid.link/20260331-fpc202-leds-v3-3-74b173537d42@bootlin.com Signed-off-by: Greg Kroah-Hartman commit 7bc515285086837c6737c0b4ecaadd7de631d221 Author: Romain Gantois Date: Tue Mar 31 11:20:57 2026 +0200 dt-bindings: misc: Describe FPC202 LED features The FPC202 dual port controller has 20 regular GPIO lines and 8 special GPIO lines with LED features. Each one of these "LED GPIOs" can output PWM and blink signals. Describe these special-purpose GPIO lines. Acked-by: Conor Dooley Signed-off-by: Romain Gantois Link: https://patch.msgid.link/20260331-fpc202-leds-v3-2-74b173537d42@bootlin.com Signed-off-by: Greg Kroah-Hartman commit 01a80abdb204942bad1ef966e559cc92bd74279a Author: Romain Gantois Date: Tue Mar 31 11:20:56 2026 +0200 misc: ti_fpc202: Depend on GPIOLIB instead of selecting it Selecting a foreign subsystem such as GPIOLIB may lead to dependency loops. Use a "depends on" instead. Signed-off-by: Romain Gantois Link: https://patch.msgid.link/20260331-fpc202-leds-v3-1-74b173537d42@bootlin.com Signed-off-by: Greg Kroah-Hartman commit f485ae8e9a251b7698f04270b9226fa05135fc43 Author: Felix Gu Date: Sat Feb 21 01:20:32 2026 +0800 misc: ti_fpc202: remove dead code in fpc202_detach_addr() val is assigned from addr_caches, which is a u8 array. So the check will never be true. Found by code review, compile pass. Signed-off-by: Felix Gu Reviewed-by: Romain Gantois Link: https://patch.msgid.link/20260221-fp202-v1-2-4d28cb8b28fb@gmail.com Signed-off-by: Greg Kroah-Hartman commit 84664e43ef87413f81b779b6433f43e14bc558cb Author: Felix Gu Date: Sat Feb 21 01:20:31 2026 +0800 misc: ti_fpc202: fix off-by-one error in port ID bounds check FPC202_NUM_PORTS is 2, valid port IDs should be 0 and 1. A port_id of 2 would incorrectly pass the check, potentially causing out-of-bounds access to the port-related arrays. Found by code review, compile pass. Fixes: 1e5c9b1efa1c ("misc: add FPC202 dual port controller driver") Signed-off-by: Felix Gu Reviewed-by: Romain Gantois Acked-by: Arnd Bergmann Reviewed-by: Andi Shyti Link: https://patch.msgid.link/20260221-fp202-v1-1-4d28cb8b28fb@gmail.com Signed-off-by: Greg Kroah-Hartman commit eef2a8ddfaf80ecca82800f40bce8647ac1bdf57 Author: Akshay Gupta Date: Wed Mar 18 16:57:11 2026 +0530 misc: amd-sbi: Add device tree mapping for AMD SBRMI devices Add device tree mapping to enable SBRMI device support across different models and steppings on the AMD Venice platform. Reviewed-by: Naveen Krishna Chatradhi Signed-off-by: Akshay Gupta Link: https://patch.msgid.link/20260318112711.2757467-3-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman commit 82e1288701c0b746397f2a133b1f93d3d48eee23 Author: Akshay Gupta Date: Wed Mar 18 16:57:10 2026 +0530 misc: amd-sbi: Add check to probe only SBRMI devices AMD OOB devices are differentiated by their Instance ID, with SBRMI assigned Instance ID 1. Since the device ID match does not consider the Instance ID, add an explicit check to restrict probing to only the SBRMI device and exclude other OOB devices. Reviewed-by: Naveen Krishna Chatradhi Signed-off-by: Akshay Gupta Link: https://patch.msgid.link/20260318112711.2757467-2-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman commit b5e7fb39819aec09a27c89f203774ffc6b13a78d Author: Akshay Gupta Date: Wed Mar 18 16:57:09 2026 +0530 misc: amd-sbi: Add revision support for AMD Venice platform The AMD Venice platform uses revision 0x31 and a two-byte register address size. Add the revision to the CPUID and MCAMSR protocol functions to ensure correct protocol identification. Reviewed-by: Naveen Krishna Chatradhi Signed-off-by: Akshay Gupta Link: https://patch.msgid.link/20260318112711.2757467-1-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman commit ac7460c6037e45c72703cbe9a96ee6668601c80f Author: Akshay Gupta Date: Wed Mar 18 15:17:06 2026 +0530 misc: amd-sbi: Address CPUID extended function bits According to the UAPI header (amd-apml.h), the CPUID extended function capability is indicated by bits [55:48], but the driver currently checks bits [63:56]. Adjust the driver to use bits [55:48] so that extended function capability is detected correctly. Fixes: bb13a84ed6b7 ("misc: amd-sbi: Add support for CPUID protocol") Tested-by: Prathima L K Reviewed-by: Naveen Krishna Chatradhi Signed-off-by: Akshay Gupta Link: https://patch.msgid.link/20260318094706.2623258-1-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman commit dd3a68a74b29af20e63c1de98f3f175dc1aa7854 Author: Andrew Donnellan Date: Wed Dec 10 21:49:34 2025 +1100 MAINTAINERS: Update ocxl maintainer details I am leaving IBM, and Fred isn't working on OpenCAPI either. Mahesh has kindly agreed to take over as maintainer to review the odd fixes that still come in, and he has plenty of powerpc-specific experience. Add Mahesh as ocxl maintainer, remove Fred as a maintainer, and downgrade myself to reviewer using my personal email address. Signed-off-by: Andrew Donnellan Acked-by: Frederic Barrat Acked-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251210-ocxl-maintainer-status-v1-1-d73981866db9@linux.ibm.com Signed-off-by: Greg Kroah-Hartman commit a255f352b0e0c06d4b91233f112ddd35eac89947 Author: Jonas Karlman Date: Fri Mar 27 13:17:51 2026 +0000 nvmem: rockchip-otp: Add support for RK3528 Add support for the OTP controller in RK3528. The OTPC is similar to the OTPC in RK3562 and RK3568, exept for a missing phy clock and reset. Signed-off-by: Jonas Karlman Signed-off-by: Heiko Stuebner Tested-by: Willy Tarreau Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-10-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7efe11aace70faa2199bc42d8949cd289b2998da Author: Finley Xiao Date: Fri Mar 27 13:17:50 2026 +0000 nvmem: rockchip-otp: Add support for RK3562 This adds the necessary data for handling otp on the rk3562. Signed-off-by: Finley Xiao Signed-off-by: Kever Yang Signed-off-by: Heiko Stuebner Tested-by: Willy Tarreau Reviewed-by: Heiko Stuebner Signed-off-by: Srinivas Kandagatla Signed-off-by: Jonas Karlman Link: https://patch.msgid.link/20260327131751.3026030-9-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 902fa931a2095566de6be12c8153f7fa9b31ab5f Author: Finley Xiao Date: Fri Mar 27 13:17:49 2026 +0000 nvmem: rockchip-otp: Add support for RK3568 This adds the necessary data for handling otp the rk3568. Signed-off-by: Finley Xiao Signed-off-by: Kever Yang Signed-off-by: Heiko Stuebner Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-8-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6c403594354d59fb288978c5a23008da89ba2741 Author: Jonas Karlman Date: Fri Mar 27 13:17:48 2026 +0000 nvmem: rockchip-otp: Handle internal word_size in main reg_read op Rockchip SoCs RK3576 and RK3588 read data from the OTP using 32-bit words instead of normal 8-bit bytes. Similar RK3506, RK3528, RK3562 and RK3568 will read data from OTP using 16-bit words. The nvmem core stride and word_size cannot fully be used as cells is not always aligned. Continue to report a stride=1 and word_size=1 in nvmem_config and instead handle use of SoC specific word_size internally in the driver. Move current SoC specific word_size handling from the RK3588 read_reg operation to the main read_reg operation to help simplify the SoC specific read_reg operation and allow code reuse in a future RK3568 reg_read operation. Signed-off-by: Jonas Karlman Tested-by: Willy Tarreau Signed-off-by: Heiko Stuebner Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-7-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit c5bc6d815c8d733bc8d915ffaf6fc9c248865216 Author: Jonas Karlman Date: Fri Mar 27 13:17:47 2026 +0000 dt-bindings: nvmem: rockchip,otp: Add compatible for RK3528 Add compatible string for the OTP controller in RK3528. Compared to the RK3562 and RK3568 the OTP in RK3528 does not have a phy clock or reset. Signed-off-by: Jonas Karlman Signed-off-by: Heiko Stuebner Reviewed-by: Rob Herring (Arm) Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-6-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 18cd01d24fb21fc601f9f9102d28379630db716d Author: Kever Yang Date: Fri Mar 27 13:17:46 2026 +0000 dt-bindings: nvmem: rockchip,otp: Add support for RK3562 and RK3568 Add compatible entry for the otp controller in RK3562 and RK3568, add schema for different clock names for new entry. Signed-off-by: Kever Yang Reviewed-by: Rob Herring (Arm) Signed-off-by: Heiko Stuebner Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-5-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 63aad6176d644c733d77f390b87fafd4839e056b Author: Michael Walle Date: Fri Mar 27 13:17:45 2026 +0000 dt-bindings: nvmem: sl28cpld: Drop sa67mcu compatible I was just informed that this product is discontinued (without being ever released to the market). Pull the plug and let's not waste any more maintainers time and revert commit 4a9b344e90c7 ("dt-bindings: nvmem: sl28cpld: add sa67mcu compatible"). Acked-by: Conor Dooley Signed-off-by: Michael Walle Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 4e012d4cb6d5bac43fc3e188b02dda42384ea89e Author: Felix Gu Date: Fri Mar 27 13:17:44 2026 +0000 nvmem: qnap-mcu-eeprom: Fix struct assignments using commas instead of semicolons The nvcfg struct member assignments were incorrectly using commas instead of semicolons. Signed-off-by: Felix Gu Reviewed-by: Heiko Stuebner Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 58b140a67ae197b7cee4c768a05bc056dae74f36 Author: Jingyi Wang Date: Fri Mar 27 13:17:43 2026 +0000 dt-bindings: nvmem: qfprom: Add Kaanapali compatible Document compatible string for the QFPROM on Kaanapali platform. Signed-off-by: Jingyi Wang Acked-by: Krzysztof Kozlowski Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131751.3026030-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7215e4552f31e53595eae56a834f7e286beecccc Author: Gui-Dong Han Date: Mon Mar 23 16:58:46 2026 +0800 soundwire: debugfs: initialize firmware_file to empty string Passing NULL to debugfs_create_str() causes a NULL pointer dereference, and creating debugfs nodes with NULL string pointers is no longer permitted. Additionally, firmware_file is a global pointer. Previously, adding every new slave blindly overwrote it with NULL. Fix these issues by initializing firmware_file to an allocated empty string once in the subsystem init path (sdw_debugfs_init), and freeing it in the exit path. Existing driver code handles empty strings correctly. Fixes: fe46d2a4301d ("soundwire: debugfs: add interface to read/write commands") Reported-by: yangshiguang Closes: https://lore.kernel.org/lkml/17647e4c.d461.19b46144a4e.Coremail.yangshiguang1011@163.com/ Signed-off-by: Gui-Dong Han Link: https://patch.msgid.link/20260323085930.88894-4-hanguidong02@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4afc929c0f74c4f22b055a82b371d50586da58ca Author: Gui-Dong Han Date: Mon Mar 23 16:58:45 2026 +0800 debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() The EXPORT_SYMBOL_GPL() for debugfs_create_str was placed incorrectly away from the function definition. Move it immediately below the debugfs_create_str() function where it belongs. Fixes: d60b59b96795 ("debugfs: Export debugfs_create_str symbol") Signed-off-by: Gui-Dong Han Link: https://patch.msgid.link/20260323085930.88894-3-hanguidong02@gmail.com Signed-off-by: Greg Kroah-Hartman commit 31de83980d3764d784f79ff1bc93c42b324f4013 Author: Gui-Dong Han Date: Mon Mar 23 16:58:44 2026 +0800 debugfs: check for NULL pointer in debugfs_create_str() Passing a NULL pointer to debugfs_create_str() leads to a NULL pointer dereference when the debugfs file is read. Following upstream discussions, forbid the creation of debugfs string files with NULL pointers. Add a WARN_ON() to expose offending callers and return early. Fixes: 9af0440ec86e ("debugfs: Implement debugfs_create_str()") Reported-by: yangshiguang Closes: https://lore.kernel.org/lkml/2025122221-gag-malt-75ba@gregkh/ Suggested-by: Greg Kroah-Hartman Signed-off-by: Gui-Dong Han Link: https://patch.msgid.link/20260323085930.88894-2-hanguidong02@gmail.com Signed-off-by: Greg Kroah-Hartman commit a1a81aef99e853dec84241d701fbf587d713eb5b Author: Thomas Bogendoerfer Date: Thu Apr 2 12:21:53 2026 +0200 tty: serial: ip22zilog: Fix section mispatch warning ip22zilog_prepare() is now called by driver probe routine, so it shouldn't be in the __init section any longer. Fixes: 3fc36ae6abd2 ("tty: serial: ip22zilog: Use platform device for probing") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604020945.c9jAvCPs-lkp@intel.com/ Signed-off-by: Thomas Bogendoerfer Link: https://patch.msgid.link/20260402102154.136620-1-tbogendoerfer@suse.de Signed-off-by: Greg Kroah-Hartman commit 25e531b422dc2ac90cdae3b6e74b5cdeb081440d Author: Michal Pecio Date: Thu Apr 2 16:13:42 2026 +0300 usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() xHCI hardware maintains its endpoint state between add_endpoint() and drop_endpoint() calls followed by successful check_bandwidth(). So does the driver. Core may call endpoint_disable() during xHCI endpoint life, so don't clear host_ep->hcpriv then, because this breaks endpoint_reset(). If a driver calls usb_set_interface(), submits URBs which make host sequence state non-zero and calls usb_clear_halt(), the device clears its sequence state but xhci_endpoint_reset() bails out. The next URB malfunctions: USB2 loses one packet, USB3 gets Transaction Error or may not complete at all on some (buggy?) HCs from ASMedia and AMD. This is triggered by uvcvideo on bulk video devices. The code was copied from ehci_endpoint_disable() but it isn't needed here - hcpriv should only be NULL on emulated root hub endpoints. It might prevent resetting and inadvertently enabling a disabled and dropped endpoint, but core shouldn't try to reset dropped endpoints. Document xhci requirements regarding hcpriv. They are currently met. Fixes: 18b74067ac78 ("xhci: Fix use-after-free regression in xhci clear hub TT implementation") Cc: stable@vger.kernel.org Signed-off-by: Michal Pecio Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-26-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit dad6711b9eac38ffe6fc4bebc7c6b7a721692497 Author: Niklas Neronin Date: Thu Apr 2 16:13:41 2026 +0300 usb: xhci: remove duplicate '0x' prefix Prefix "0x" is automatically added by '%pad'. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-25-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 9a7ad750a8fbd274e27c1f045271bb2f876e0569 Author: Niklas Neronin Date: Thu Apr 2 16:13:40 2026 +0300 usb: xhci: move roothub port limit validation Function xhci_setup_port_arrays() limits the number of roothub ports for both USB 2 and 3, this causes code repetition. Solve this by moving roothub port limits validation to xhci_create_rhub_port_array(). Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-24-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit d81a5580845875de1f3e7156b2317f89bf81a936 Author: Niklas Neronin Date: Thu Apr 2 16:13:39 2026 +0300 usb: xhci: simpilfy resume root hub code Resume roothubs without checking 'retval' value, as it is always '0'. Due to changes made in commit 79989bd4ab86 ("xhci: always resume roothubs if xHC was reset during resume") the check is redundant. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-23-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 5dfc7f985f09f998fa3a384d79ea6c64fbc7afd8 Author: Niklas Neronin Date: Thu Apr 2 16:13:38 2026 +0300 usb: xhci: cleanup xhci_hub_report_usb3_link_state() Improve readability of xhci_hub_report_usb3_link_state(). Comments are shortened and clarified, and the code now makes it explicit when the Port Link State (PLS) value is modified versus when other status bits are updated. No functional changes. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-22-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit aef5305da27e79818e752a97d3d08516aa892d0a Author: Niklas Neronin Date: Thu Apr 2 16:13:37 2026 +0300 usb: xhci: rename parameter to match argument 'portsc' A previous patch renamed the temporary variable holding the value read from the PORTSC register from 'temp' to 'portsc'. This patch follows up by updating the parameter names of all helper functions called from xhci_hub_control() that receive a PORTSC value, as well as the functions they call. Function changed: xhci_get_port_status() L xhci_get_usb3_port_status() L xhci_hub_report_usb3_link_state() L xhci_del_comp_mod_timer() xhci_get_ext_port_status() xhci_port_state_to_neutral() xhci_clear_port_change_bit() xhci_port_speed() The reason for the rename is to differentiate between port status/change bit to be written to PORTSC and replying to hub-class USB requests. Each of them use their specific macros. Use "portsc" name for PORTSC values and "status" for values intended for replying to hub-class USB request. A dedicated structure for USB hub port status responses ('struct usb_port_status' from ch11.h) exists and will be integrated in a later patch. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-21-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 58a5bfc4aaac4a232e21a8155dec7c6070379193 Author: Niklas Neronin Date: Thu Apr 2 16:13:36 2026 +0300 usb: xhci: add PORTSC variable to xhci_hub_control() The variable 'temp' is used multiple times throughout xhci_hub_control() for holding only PORTSC register values. As a follow-up to introducing a dedicated variable for PORTPMSC, rename all remaining 'temp' to 'portsc'. This improves readability and clarifies what is being modified. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-20-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f84965acad118b19ddaa02fbea0a4c2d079c3fb7 Author: Niklas Neronin Date: Thu Apr 2 16:13:35 2026 +0300 usb: xhci: add PORTPMSC variable to xhci_hub_control() The code handling U1/U2 timeout updates reads and modifies the PORTPMSC register using the generic 'temp' variable, which is also used for PORTSC. This makes the code hard to read and increases the risk of mixing up register contents. Introduce a dedicated 'portpmsc' variable for PORTPMSC accesses and use it in both U1 and U2 timeout handlers. This makes the intent clearer and keeps register operations logically separated. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-19-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 4515039a8a1bea2055e8f10e88560684d0ea0257 Author: Niklas Neronin Date: Thu Apr 2 16:13:34 2026 +0300 usb: xhci: separate use of USB Chapter 11 PLS macros from xHCI-specific PLS macros The xhci driver uses two different sources for Port Link State (PLS): 1. The PLS field in the PORTSC register (bits 8:5). 2. The PLS value encoded in bits 15:8 of the USB request wIndex, received by xhci_hub_control(). While both represent similar link states, they differ in a few details, for example, xHCI's Resume State. Because of these differences, the xhci driver defines its own set of PLS macros in xhci-port.h, which are intended to be used when reading and writing PORTSC. The generic USB Chapter 11 macros in ch11.h should only be used when parsing or replying to hub-class USB requests. To avoid mixing these two representations and prevent incorrect state reporting, replace all uses of Chapter 11 PLS macros with the xHCI versions when interacting with the PORTSC register. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-18-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 995e2af1656882294cbf86396f74c308806f33dc Author: Niklas Neronin Date: Thu Apr 2 16:13:33 2026 +0300 usb: xhci: clean up 'wValue' handling in xhci_hub_control() Several hub control requests encode a descriptor type in the upper byte of 'wValue'. Clean this up by extracting the descriptor type into a local variable and using it for all relevant requests. Replace magic value (0x02) with the appropriate macro (HUB_EXT_PORT_STATUS) This improves readability and makes the handling of 'wValue' consistent. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-17-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit b7a56f8652d00a8c4d94c2214301f6475989339e Author: Niklas Neronin Date: Thu Apr 2 16:13:32 2026 +0300 usb: xhci: clean up handling of upper bits in SetPortFeature wIndex In Set Port Feature requests, the upper byte of 'wIndex' encodes feature-specific parameters. The current code reads these upper bits in an early pre-processing block, and then the same feature is handled again later in the main switch statement. This results in duplicated condition checks and makes the control flow harder to follow. Move all feature-specific extraction of 'wIndex' upper bits into the main SetPortFeature logic so that each feature is handled in exactly one place. This reduces duplication, makes the handling clearer, and keeps 'wIndex' parsing local to the code that actually uses the values. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-16-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit ec5521a77167cc258bd4a587756f11d66b05a4c2 Author: Niklas Neronin Date: Thu Apr 2 16:13:31 2026 +0300 usb: xhci: rename 'wIndex' parameters to 'portnum' Several helper functions take a parameter named 'wIndex', but the value they receive is not the raw USB request wIndex field. The only function that actually processes the USB hub request parameter is xhci_hub_control(), which extracts the relevant port number (and other upper-byte fields) before passing them down. To avoid confusion between the USB request parameter and the derived 0-based port index, rename all such function parameters from 'wIndex' to 'portnum'. This improves readability and makes the call intentions clearer. When a function accept struct 'xhci_port' pointer, use its port number instead. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-15-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1e6138c0654334d42b3984f1154ee35234f35302 Author: Niklas Neronin Date: Thu Apr 2 16:13:30 2026 +0300 usb: xhci: stop treating 'wIndex' as a mutable port number The USB request parameter 'wIndex' is a 16-bit field whose meaning depends on the request type. For hub port operations, only bits 7:0 encode the port number (1..MaxPorts). Despite this, the current code extracts the port number into 'portnum1' while also modifying and using 'wIndex' directly as a 0-based port index. This dual use is both confusing and error-prone, since 'wIndex' is not always a pure port number. Clean this up by deriving a single 0-based 'portnum' from 'wIndex' and using it throughout the function. The original 'wIndex' value is no longer modified or treated as a port number. This also matches existing xhci code. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-14-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2a70e5dc0301ad961b198f086a39e2479f6b8933 Author: Niklas Neronin Date: Thu Apr 2 16:13:29 2026 +0300 usb: xhci: optimize resuming from S4 (suspend-to-disk) On resume from S4 (power loss after suspend/hibernation), the xHCI driver previously freed, reallocated, and fully reinitialized all data structures. Most of this is unnecessary because the data is restored from a saved image; only the xHCI registers lose their values. This patch optimizes S4 resume by performing only a host controller reset, which includes: * Freeing or clearing runtime-created data. * Rewriting xHCI registers. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-13-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 951564d2cabd36fa3ee09d89c61bd33e6b73791b Author: Niklas Neronin Date: Thu Apr 2 16:13:28 2026 +0300 usb: xhci: improve debug messages during suspend Improve debug output for suspend failures, particularly when the controller handshake does not complete. This will become important as upcoming patches significantly rework the resume path, making more detailed suspend-side messages valuable for debugging. Add an explicit check of the Save/Restore Error (SRE) flag after a successful Save State (CSS) operation. The xHCI specification (note in section 4.23.2) states: "After a Save or Restore State operation completes, the Save/Restore Error (SRE) flag in USBSTS should be checked to ensure the operation completed successfully." Currently, the SRE error is only observed and warning is printed. This patch does not introduce deeper error handling, as the correct response is unclear and changes to suspend behavior may risk regressions once the resume path is updated. Additionally, simplify and clean up the suspend USBSTS CSS/SSS handling code, improving readability and quirk handling for AMD SNPS xHC controllers that occasionally do not clear the SSS bit. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-12-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit b4dd01eb9bd162193b250dc6d6b7e6b5eb688564 Author: Niklas Neronin Date: Thu Apr 2 16:13:27 2026 +0300 usb: xhci: split core allocation and initialization Separate allocation and initialization in the xHCI core: * xhci_mem_init() now only handles memory allocation. * xhci_init() now only handles initialization. This split allows xhci_init() to be reused when resuming from S4 suspend-to-disk. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-11-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 45484754a0ddfec798c8ddf0de489e68f4be4bcf Author: Niklas Neronin Date: Thu Apr 2 16:13:26 2026 +0300 usb: xhci: move initialization for lifetime objects Initialize objects that exist for the lifetime of the driver only once, rather than repeatedly. These objects do not require re-initialization after events such as S4 (suspend-to-disk). Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-10-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit e4573f49378f610ee4805ebc60896470ca54747a Author: Niklas Neronin Date: Thu Apr 2 16:13:25 2026 +0300 usb: xhci: move ring initialization Move ring initialization from xhci_ring_alloc() to xhci_ring_init(). Call xhci_ring_init() after xhci_ring_alloc(); in the future, it can also be used to re-initialize the ring during resume. Additionally, remove xhci_dbg_trace() from xhci_mem_init(). The command ring's first segment DMA address is now printed during the trace call in xhci_ring_init(). This refactoring lays also the groundwork for eventually replacing: * xhci_dbc_ring_init() * xhci_clear_command_ring() Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-9-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit b1ebf19216c84f13b4f56f271548a62101d75d9d Author: Niklas Neronin Date: Thu Apr 2 16:13:24 2026 +0300 usb: xhci: move reserving command ring trb Move the command ring TRB reservation from xhci_mem_init() to xhci_init(). Function xhci_mem_init() is intended for memory allocation, while xhci_init() is for initialization. This split allows xhci_init() to be reused when resuming from S4 suspend-to-disk. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-8-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 0837c87f95295798bcb16981271fbb9adf766eb1 Author: Niklas Neronin Date: Thu Apr 2 16:13:23 2026 +0300 usb: xhci: factor out roothub bandwidth cleanup Introduce xhci_rh_bw_cleanup() to release all bandwidth tracking structures associated with xHCI roothub ports. The new helper clears: * TT bandwidth entries * Per-interval endpoint lists This refactors and consolidates the existing per-port cleanup logic previously embedded in xhci_mem_cleanup(), reducing duplication and making the teardown sequence easier to follow. The helper will also be reused for upcoming S4 resume handling. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-7-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit ab915ec99c06f04edfac40976613a809e0edbfa6 Author: Niklas Neronin Date: Thu Apr 2 16:13:22 2026 +0300 usb: xhci: relocate Restore/Controller error check A Restore Error or Host Controller Error indicates that the host controller failed to resume after suspend. In such cases, the xhci driver is fully re-initialized, similar to a post-hibernation scenario. The existing error check is only relevant when 'power_lost' is false. If 'power_lost' is true, a Restore or Controller error has no effect: no warning is printed and the 'power_lost' state remains unchanged. Move the entire error check into the if '!power_lost' condition to make this dependency explicit and simplify the resume logic. Reviewed-by: Andy Shevchenko Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-6-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 5ef760cf1c83f456b699196e5ad5c3a33b2d76f6 Author: Niklas Neronin Date: Thu Apr 2 16:13:21 2026 +0300 usb: xhci: simplify CMRT initialization logic The function compliance_mode_recovery_timer_init() is called from xhci_init() because the Compliance Mode Recovery Timer (CMRT) must be set up before xhci_run() when the xhci driver is re-initialized. To handle this case, the boolean flag 'comp_timer_running' was introduced to track whether xhci_run() had already been called, ensuring that xhci_resume() would not invoke compliance_mode_recovery_timer_init() a second time. This can be simplified by moving the 'done' label in xhci_resume() to after the compliance_mode_recovery_timer_init() call. With this change, the timer initialization runs only when the xhci driver has not been re-initialized, making the 'comp_timer_running' flag unnecessary and allowing it to be removed. Reviewed-by: Andy Shevchenko Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 452af0f9ffe1b25cb63698aac24e2fc782c928a8 Author: Michal Pecio Date: Thu Apr 2 16:13:20 2026 +0300 usb: xhci: Fix debugfs bandwidth reporting Replace kernel USB speed numbers with xHCI protocol IDs expected by HW. They are numerically equal up to high speed, but instead of SuperSpeed we were querying SuperSpeed+. Gen1 hardware rejects such commands with TRB Error, which resulted in zero available bandwidth being shown. While at that, report failures properly. No attempt made at "tunneling" all possible comp codes through errno, debugfs users may inspect the result through event-ring/trbs. Signed-off-by: Michal Pecio Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 88a985cf9533c6585ee3a784cb8320df409be389 Author: Michal Pecio Date: Thu Apr 2 16:13:19 2026 +0300 usb: xhci: Simplify clearing the Event Interrupt bit USBSTS is mostly RW1C, so to clear EINT we should write just this one bit. Remove pointless code which ORs the bit with current value of the register, even though the bit is already known to be set, and writes the result back, which clears all active RW1C flags. We used to inadvertently clear PCD and SRE in this way. PCD isn't used by the driver and SRE is only used at resume, so clearing them should make no difference. Don't clear them anymore. Tested by connecting and mounting a storage device on a few HCs. Before: xhci_irq USBSTS 0x00000018 EINT PCD -> 0x00000000 xhci_irq USBSTS 0x00000008 EINT -> 0x00000000 After: xhci_irq USBSTS 0x00000018 EINT PCD -> 0x00000010 PCD xhci_irq USBSTS 0x00000018 EINT PCD -> 0x00000010 PCD Some flags are RsvdZ - should be written as zero regardless of the value read, so technically it was a bug. But no problems are known. Signed-off-by: Michal Pecio Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit abe93f27cdd7838007703ff02d0c5f7fc0e5d7f6 Author: Oliver Neukum Date: Thu Apr 2 16:13:18 2026 +0300 xhci: use BIT macro We have the macro. Use it. Signed-off-by: Oliver Neukum Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260402131342.2628648-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1214bf28965ceaf584fb20d357731264dd2e10e1 Author: Pengpeng Hou Date: Thu Apr 2 13:40:16 2026 +0800 greybus: gb-beagleplay: bound bootloader receive buffering cc1352_bootloader_rx() appends each serdev chunk into the fixed rx_buffer before parsing bootloader packets. The helper can keep leftover bytes between callbacks and may receive multiple packets in one callback, so a single count value is not constrained by one packet length. Check that the incoming chunk fits in the remaining receive buffer space before memcpy(). If it does not, drop the staged data and consume the bytes instead of overflowing rx_buffer. Fixes: 0cf7befa3ea2 ("greybus: gb-beagleplay: Add firmware upload API") Cc: stable Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260402054016.38587-1-pengpeng@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 21a8995cdbc7de4a57215a57095003d0e08ca1a3 Author: Sibi Sankar Date: Tue Mar 31 08:51:21 2026 +0530 dt-bindings: misc: qcom,fastrpc: Add compatible for Glymur Document compatible for Qualcomm Glymur fastrpc which is fully compatible with Qualcomm Kaanapali fastrpc. Signed-off-by: Sibi Sankar Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260331032121.1279203-1-sibi.sankar@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 58fa2357f5b5eb3a394571dd2fee6c6a1db242c3 Author: Weigang He Date: Mon Mar 30 12:08:01 2026 +0000 greybus: gb-beagleplay: propagate hdlc_tx_frames() errors to callers Now that hdlc_tx_frames() can drop frames when the circular buffer is full, make the failure visible to callers: - Change hdlc_tx_frames() return type from void to int (-EAGAIN on buffer full). - Change gb_beagleplay_start_svc() / gb_beagleplay_stop_svc() to return int so probe and firmware-upload paths can detect failures. - gb_message_send(): propagate the error so the greybus core can handle the transport failure. - hdlc_tx_s_frame_ack(): log with dev_warn_ratelimited on failure (ACK loss is recoverable by HDLC retransmission). - Probe path: propagate start_svc failure via new free_greybus label. - Firmware upload paths: return FW_UPLOAD_ERR_RW_ERROR when SVC restart fails instead of silently continuing. - Remove path: best-effort stop_svc, ignore failure. Cc: Ayush Singh Cc: Johan Hovold Cc: Alex Elder Cc: Greg Kroah-Hartman Signed-off-by: Weigang He Link: https://patch.msgid.link/20260330120801.981506-2-geoffreyhe2@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6b526dca0966f2370835765019a54319b78fca8d Author: Weigang He Date: Mon Mar 30 12:08:00 2026 +0000 greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() hdlc_append() calls usleep_range() to wait for circular buffer space, but it is called with tx_producer_lock (a spinlock) held via hdlc_tx_frames() -> hdlc_append_tx_frame()/hdlc_append_tx_u8()/etc. Sleeping while holding a spinlock is illegal and can trigger "BUG: scheduling while atomic". Fix this by moving the buffer-space wait out of hdlc_append() and into hdlc_tx_frames(), before the spinlock is acquired. The new flow: 1. Pre-calculate the worst-case encoded frame length. 2. Wait (with sleep) outside the lock until enough space is available, kicking the TX consumer work to drain the buffer. 3. Acquire the spinlock, re-verify space, and write the entire frame atomically. This ensures that sleeping only happens without any lock held, and that frames are either fully enqueued or not written at all. This bug is found by CodeQL static analysis tool (interprocedural sleep-in-atomic query) and my code review. Fixes: ec558bbfea67 ("greybus: Add BeaglePlay Linux Driver") Cc: stable Cc: Ayush Singh Cc: Johan Hovold Cc: Alex Elder Cc: Greg Kroah-Hartman Signed-off-by: Weigang He Link: https://patch.msgid.link/20260330120801.981506-1-geoffreyhe2@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6597a08dbd825fadf0da2e2552358dd95776c8dd Author: Johan Hovold Date: Wed Mar 11 09:22:26 2026 +0100 greybus: es2: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260311082226.14865-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit cbc96a916b1a3be7039b0166c0fc56ec1632ba01 Author: Pengpeng Hou Date: Sun Mar 22 11:19:23 2026 +0800 greybus: beagleplay: bound bootloader RX buffer copy When `flashing_mode` is set, `gb_tty_receive()` routes incoming bytes to `cc1352_bootloader_rx()`. That helper appends the new bytes to the shared `rx_buffer` with `memcpy()` but does not check that the chunk fits in the remaining space first. The normal HDLC receive path already enforces `MAX_RX_HDLC`, so do the same here before appending bootloader data. If a packet would overflow the receive buffer, drop it and reset the bootloader receive state instead of copying past the end of `rx_buffer`. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260322031923.58013-1-pengpeng@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 8ca3d3b1c3383f5f23efe01c3fd9113ed06007bd Author: Rosen Penev Date: Mon Mar 16 20:14:58 2026 -0700 greybus: svc: use kzalloc_flex Avoid manual sizeof math by using the proper helper. Also use struct_size for the buffer size. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260317031458.93315-1-rosenp@gmail.com Signed-off-by: Greg Kroah-Hartman commit 41837c1deaa1c5f4adc02ecbd77fe6e3adb7150c Author: Johan Hovold Date: Mon Mar 30 11:46:46 2026 +0200 comedi: ni_usb6501: refactor endpoint lookup Use the common USB helper for looking up bulk and interrupt endpoints instead of open coding. Signed-off-by: Johan Hovold Reviewed-by: Ian Abbott Link: https://patch.msgid.link/20260330094646.1623523-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6c561848ee5246f083770aaf39b2666f940d60dd Author: Rosen Penev Date: Wed Mar 11 16:24:59 2026 -0700 comedi: isadma: use kzalloc_flex Switched struct pointer member to a flexible array member to get rid of kzalloc_objs as there's no need for them to be separately allocated. AAdded __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260311232459.18407-1-rosenp@gmail.com Signed-off-by: Greg Kroah-Hartman commit b06e78190f6fa58a4b53651aa6e4f8dfaec7bdd9 Author: Ethan Nelson-Moore Date: Fri Jan 30 17:36:52 2026 -0800 comedi: remove unnecessary module_init/exit functions Many Comedi drivers have unnecessary empty module_init and module_exit functions. Remove them. Note that if a module_init function exists, a module_exit function must also exist; otherwise, the module cannot be unloaded. Signed-off-by: Ethan Nelson-Moore Reviewed-by: Ian Abbott Link: https://patch.msgid.link/20260131013810.32265-1-enelsonmoore@gmail.com Signed-off-by: Greg Kroah-Hartman commit b5720dabb04263c8fffc24983023a4e1f384049f Author: Ian Abbott Date: Thu Jan 29 11:44:02 2026 +0000 comedi: Correct name of ACCES I/O Products Commit 6cd5a9a35c3d ("staging/trivial: fix typos concerning "access"") accidentally changed "Acces I/O Products" to "Access I/O Products", although "Acces" should actually be a capitalized acronym "ACCES" (standing for "Acquisition, Control, and Communication: Engineering & Systems"). Change it in the "aio_aio12_8" and "aio_iiro_16" drivers and change the Kconfig file to match. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260129114402.11033-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit ae377d6afbd5618500edf0954edfc15aa28b162c Author: Ian Abbott Date: Fri Jan 30 16:48:11 2026 +0000 comedi: s526: Add sanity checks for I/O base address The "s526" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a Sensoray 526 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board DIP switches) in the range 0 to 0xFFC0 on 64-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-47-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 63c1983136d784d95054accd31d03006f518e71f Author: Ian Abbott Date: Fri Jan 30 16:48:10 2026 +0000 comedi: rti802: Add sanity checks for I/O base address The "rti800" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a RTI-802 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board DIP switches) in the range 0 to 0x3FC on 4-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-46-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit e2b311504acd03b5e720c763fcd41ccd928de3b3 Author: Ian Abbott Date: Fri Jan 30 16:48:09 2026 +0000 comedi: rti800: Add sanity checks for I/O base address The "rti800" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a RTI-800 or RTI-815 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board DIP switches) in the range 0 to 0x3F0 on 16-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-45-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 3d4ab5484aa249f4950eba7f697cff6b3f024c7c Author: Ian Abbott Date: Fri Jan 30 16:48:08 2026 +0000 comedi: pcmuio: Add sanity checks for I/O base address The "pcmmio" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a PCM-UIO48A or PCM-UIO96A board. It will probably work with the later PCM-UIO48C and PCM-UIO96C boards. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board jumpers) in the range 0 to 0xFFF0 on 16-byte boundaries (for PCM-UIO48C) or 0 to 0xFFE0 on 32-byte boundaries (for PCM-UIO96C). (The PCM-UIO48A supports base addresses up to 0xFF0 and the PCI-UIO96A supports base addresses up to 0x7E0.) Add a sanity check to ensure the device is not configured at an unsupported base address (allowing for the extended range of the "C" models). Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-44-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 78ba300a999179d79f4b8f479e58345c05e17baa Author: Ian Abbott Date: Fri Jan 30 16:48:07 2026 +0000 comedi: pcmmio: Add sanity checks for I/O base address The "pcmmio" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a PCM-MIO board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board jumpers) in the range 0 to 0xFFE0 on 32-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-43-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit c375d40dc77c449ded79675b6ae00d82e67559bd Author: Ian Abbott Date: Fri Jan 30 16:48:06 2026 +0000 comedi: pcmda12: Add sanity checks for I/O base address The "pcmda12" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a PCM-D/A-12 or PCM-A/D-16 board. It currently allows any base address to be configured. I cannot find a full manual, but the short datasheet says it uses 15 consecutive I/O addresses on "any even sixteen port boundary", so assume it supports base addresses (configured by on-board jumpers) in the range 0 to 0x3E0 on 32-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-42-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 0ca9f8150ce5a41a3b4bb65f043f0335e7ef67b5 Author: Ian Abbott Date: Fri Jan 30 16:48:05 2026 +0000 comedi: pcmad: Add sanity checks for I/O base address The "pcmad" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a PCM-A/D-12 or PCM-A/D-16 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board jumpers) in the range 0 to 0x3FC on 4-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-41-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit ddd5b28744322f9434ab71661a1280f5069983fd Author: Ian Abbott Date: Fri Jan 30 16:48:04 2026 +0000 comedi: pcm3724: Add sanity checks for I/O base address The "pcm3724" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a PCM-3724 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board DIP switches) in the range 0 to 0x3F0 on 16-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-40-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit aaddeab27c324f2885f5b2ca9f64f6ebd60df688 Author: Ian Abbott Date: Fri Jan 30 16:48:03 2026 +0000 comedi: pcl818: Add sanity checks for I/O base address The "pcl818" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a board in the PCL-818 series. It currently allows any base address to be configured but the hardware devices only support base addresses (configured by on-board DIP switches) from 0 to 0x3F0 on 16-byte boundaries. If the board has a FIFO and jumper JP6 is in the "Enabled" (default) position, then the base address needs to be on a 32-byte boundary and the length of the I/O port region will be 32 (to allow access to the FIFO registers) instead of 16. The state of jumper JP6 is unknown, so if the board has a FIFO device and is being configured on an odd 16-byte boundary, assume that jumper JP6 is in the "Disabled" position (to disallow access to the FIFO registers). Add a sanity check to ensure the device is not configured at an unsupported base address. If the board has a FIFO and is configured on an odd 16-byte boundary, log a reminder that JP6 needs to be in the "Disabled" position for correct operation. If the board has a FIFO and is configured on an even 16-byte boundary and the configuration option has been set to use the FIFO (`it->options[2] == -1`), log a reminder that JP6 needs to be in the "Enabled" position. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-39-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 55e39df167cbeaedc5744ba595514b7745454948 Author: Ian Abbott Date: Fri Jan 30 16:48:02 2026 +0000 comedi: pcl816: Add sanity checks for I/O base address The "pcl816" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a PCL-816 or PCL-814B ISA board. It currently allows any base address to be configured but the hardware devices only support base addresses (configured by on-board DIP switches) from 0 to 0x3F0 on 16-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-38-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit c24543463720ae8eb3aa1b35ff957fc96870cb94 Author: Ian Abbott Date: Fri Jan 30 16:48:01 2026 +0000 comedi: pcl812: Add sanity checks for I/O base address The "pcl812" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of various analog/digital I/O ISA boards from Advantech, ADLINK, and ICP DAS. It currently allows any base address to be configured but the hardware devices only support base addresses (configured by on-board DIP switches) from 0 or 0x200 (depending on the model) to 0x3F0 on 16-byte boundaries. Store the minimum supported I/O base addresses in the static board information array elements and add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-37-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit b5218a9897f5c381f513ea906a65655977a9c1b3 Author: Ian Abbott Date: Fri Jan 30 16:48:00 2026 +0000 comedi: pcl730: Add sanity checks for I/O base address The "pcl730" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of various relay output and digital input ISA board from Advantech, ADLINK, ICP DAS, and Diamond Systems. It currently allows any base address to be configured but the hardware devices have restrictions on the base addresses (configured by on-board DIP switches or jumpers), including the alignment, which can be larger than the board's I/O register address span. The Diamond Systems IR104-PBF board is particularly restricted to 4 different base addresses with different sized gaps between the possible addresses. Store the minimum supported I/O base addresses and alignment in the static board information array elements and add a sanity check to ensure the device is not configured at an unsupported base address. For the IR104-PBF board, add a special check that the base address is one of the 4 supported base addresses for that board. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-36-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 588b6ffa7775ed90d4afd4d2903fd49a6bb3cfbb Author: Ian Abbott Date: Fri Jan 30 16:47:59 2026 +0000 comedi: pcl726: Add sanity checks for I/O base address The "pcl726" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of various analog output ISA boards from Advantech (PCL-726/727/728) and ADLINK (ACL-6126/6128). (Most of them also have digital I/O.) It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board DIP switches) from 0 or 0x200 up to nearly 0x3FF, depending on the model. Store the minimum and maximum supported I/O address ranges in the static board information array elements (the required alignment is already stored in the `io_len` member), and add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-35-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit b9723ebe043b49a93f4777173e202c2be5b53dcd Author: Ian Abbott Date: Fri Jan 30 16:47:58 2026 +0000 comedi: pcl724: Add sanity checks for I/O base address The "pcl724" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of various 8255 chip-based digital I/O ISA boards from Advantech, ADLINK, WinSystems, and Diamond Systems. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board DIP switches or jumpers) in various ranges, and on various alignment boundaries, depending on the model. Store the minimum and maximum supported I/O address ranges in the static board information array elements (the required alignment is already stored in the `io_range` member), and add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-34-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 7e33ddd6d0282f34e63393e38110a3441a79f20a Author: Ian Abbott Date: Fri Jan 30 16:47:57 2026 +0000 comedi: pcl711: Add sanity checks for I/O base address The "pcl711" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of an Advantech PCL-711 series board or an Adlink ACL-8112 series board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board DIP switches) in the range 0 to 0x3F0 (for PCL-711) or 0x200 to 0x3F0 (for ACL-8112) on 16-byte boundaries. Store the minimum supported I/O base address in the static board information array elements, and add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-33-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 2555cab1cb79fe41fadca2eaf6674fddaf5f1404 Author: Ian Abbott Date: Fri Jan 30 16:47:56 2026 +0000 comedi: ni_labpc: Add sanity checks for I/O base address The "ni_labpc" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a Lab-PC-1200 series or Lab-PC+ board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by a configuration utility and stored in nonvolatile memory) in the range 0 to 0x3E0 on 32-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-32-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit df05bcfcbd32669dfa7e3d4a3d0f0b46ded5e61a Author: Ian Abbott Date: Fri Jan 30 16:47:55 2026 +0000 comedi: ni_atmio16d: Add sanity checks for I/O base address The "ni_atmio16d" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of an AT-MIO-16 o AT-MIO-16D board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board DIP switches) in the range 0 to 0x3E0 on 32-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-31-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 68fc1eebe9525bd6c2334d1394e4c46692c09806 Author: Ian Abbott Date: Fri Jan 30 16:47:54 2026 +0000 comedi: ni_atmio: Add sanity checks for I/O base address The "ni_atmio" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of an AT E Series board. Or, if the option value is zero, it can search ISA PNP devices to look for a compatible board. If the base address is configured manually, it currently allows any base address to be configured but the hardware only supports base addresses (configured by a configuration utility and stored in nonvolatile memory) in the range 0x20 to 0xFFE0 on 32-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-30-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit f0995260a89e5a59cc9e24749c50ec20ec907dbc Author: Ian Abbott Date: Fri Jan 30 16:47:53 2026 +0000 comedi: ni_at_ao: Add sanity checks for I/O base address The "ni_at_ao" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of an AT-AO-6 or AT-AO-10 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board jumpers) in the range 0 to 0x3E0 on 32-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-29-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 3389e476ec87fd210eaa0b071e148c8dbe0515ba Author: Ian Abbott Date: Fri Jan 30 16:47:52 2026 +0000 comedi: ni_at_a2150: Add sanity checks for I/O base address The "ni_at_a2150" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of an AT-A2150 series board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board jumpers) in the range 0 to 0x3E0 on 32-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-28-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 66563dd6e3c5860e0a8b4b64a92f2ea1daf603b3 Author: Ian Abbott Date: Fri Jan 30 16:47:51 2026 +0000 comedi: multiq3: Add sanity checks for I/O base address The "multiq3" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a Multiq-3 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board jumpers) in the range 0 to 0x3F0 on 16-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-27-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit a9df1524dfcff792881556d9ab2fd17b38b330e1 Author: Ian Abbott Date: Fri Jan 30 16:47:50 2026 +0000 comedi: mpc624: Add sanity checks for I/O base address The "mpc624" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a MPC624 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board jumpers) in the range 0 to 0x3F0 on 16-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-26-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 7bd294e569114f05ed76d3fd3f0d1da9392bf89a Author: Ian Abbott Date: Fri Jan 30 16:47:49 2026 +0000 comedi: fl512: Add sanity checks for I/O base address The "fl512" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of an FL512 board. It currently allows any base address to be configured and uses a 16-byte register region. I cannot find any information about this board, but assume it needs to be aligned to a 16-byte boundary. I have no idea about the allowed range, so allow anything in a 32-bit range and add a "FIXME" comment (although most ancient ISA cards only support 10-bit address decoding). Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-25-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 3742ff1605d50c8c2ea78a896f2e281b1f785c37 Author: Ian Abbott Date: Fri Jan 30 16:47:48 2026 +0000 comedi: dt2817: Add sanity checks for I/O base address The "dt2817" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a DT2817 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board jumpers) in the range 0x200 to 0x3f8 on 8-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-24-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 4804bacd9d7bfa56670d4449ef034234384afc93 Author: Ian Abbott Date: Fri Jan 30 16:47:47 2026 +0000 comedi: dt2815: Add sanity checks for I/O base address The "dt2815" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a DT2815 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by an on-board DIP switch) in the range 0x200 to 0x3fe on 2-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-23-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 576067b4c05c3f5470a35be2414f2b421042df3c Author: Ian Abbott Date: Fri Jan 30 16:47:46 2026 +0000 comedi: dt2814: Add sanity checks for I/O base address The "dt2814" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a DT2814 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by an on-board DIP switch) in the range 0x200 to 0x3fe on 2-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-22-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 408bece94e7bdba3b420f1bf4607a2d2dbab1faf Author: Ian Abbott Date: Fri Jan 30 16:47:45 2026 +0000 comedi: dt2811: Add sanity checks for I/O base address The "dt2811" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported board in the DT2811 family. It currently allows any base address to be configured but the hardware only supports base addresses (configured by on-board jumpers) in the range 0x200 to 0x3f8 on 8-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-21-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 4ede1d2e697bef66d068058bbe3ff5d9c392b56b Author: Ian Abbott Date: Fri Jan 30 16:47:44 2026 +0000 comedi: dt2801: Add sanity checks for I/O base address The "dt2801" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported board in the DT2801 family. It currently allows any base address to be configured but the hardware only supports base addresses (configured by an on-board DIP switch) in the range 0x200 to 0x3fe on 2-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-20-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 40f86ce1d117ee8defe7fc6b54e3fb355cde25e5 Author: Ian Abbott Date: Fri Jan 30 16:47:43 2026 +0000 comedi: dmm32at: Add sanity check for I/O base address The "dmm32at" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a Diamond-MM-32-AT board. It currently allows any base address to be configured but the hardware only supports 8 possible base addresses (selected by 3 on-board jumpers). These are 0x100, 0x140, 0x180, 0x200, 0x280, 0x300, 0x340, and 0x380. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-19-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 46fe103de0af2707381a32974407a562b4f6e85a Author: Ian Abbott Date: Fri Jan 30 16:47:42 2026 +0000 comedi: das800: Add sanity checks for I/O base address The "das800" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported board in the DAS800 family. It currently allows any base address to be configured but the hardware only supports base addresses (configured by an on-board DIP switch) in the range 0 to 0x3f8 on 8-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-18-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 2ddb4c5699129d8fc9ce8ae0855f47ca2c6b9509 Author: Ian Abbott Date: Fri Jan 30 16:47:41 2026 +0000 comedi: das6402: Add sanity checks for I/O base address The "das6402" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported board in the DAS6402 family. It currently allows any base address to be configured but the hardware only supports base addresses (configured by an on-board DIP switch) in the range 0 to 0x3f0 on 16-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-17-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit b07802b8572601c01c6fc84e01c4af50b21da7f4 Author: Ian Abbott Date: Fri Jan 30 16:47:40 2026 +0000 comedi: das1800: Add sanity checks for I/O base address The "das1800" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a board compatible with the DAS1800 series. It currently allows any base address to be configured but the hardware only supports base addresses (configured by an on-board DIP switch) in the range 0 to 0x3f0 on 16-byte boundaries. Some boards have an additional span of up to 0x10 registers at offset 0x400 from the main 0x10 byte region. Add a sanity check to ensure the device is not configured at an unsupported base address. If the main base address is correctly aligned and within range, then the additional region at offset 0x400 from the configured base address will naturally be within range and correctly aligned. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-16-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit f8f950e030bee31b4a69ef29a6c2eeb57d31f7ae Author: Ian Abbott Date: Fri Jan 30 16:47:39 2026 +0000 comedi: das16m1: Add sanity checks for I/O base address The "das16m1" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a DAS16/M1 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by an on-board DIP switch) in the range 0 to 0x3f0 on 16-byte boundaries. It has an additional span of 0x8 registers at offset 0x400 from the main 0x10 byte region. Add a sanity check to ensure the device is not configured at an unsupported base address. If the main base address is correctly aligned and within range, then the additional region at offset 0x400 from the configured base address will naturally be within range and correctly aligned. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-15-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit d0c1eee1975b582865b63f66901a6e50fcc6a299 Author: Ian Abbott Date: Fri Jan 30 16:47:38 2026 +0000 comedi: das16: Add sanity checks for I/O base address The "das16" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a various DAS16 compatible boards. It currently allows any base address to be configured but the hardware only supports base addresses (configured by an on-board DIP switch) in the range 0 to 0x3f0 on 16- or 32-byte boundaries. Some of the boards have an 8255 chip at offset 0x10 and require the board to be configured on a 32-byte boundary unless some on-board jumpers are set to limit the board to decoding only the first 0x10 registers, disabling access to the 8255. Some other boards place the 8255 chip (and some other registers) at offset 0x400 from the base address, decoding 0x10 registers at the base address and 0x8 registers at the base address plus 0x400. Add a sanity check to ensure the device is not configured at an unsupported base address. If the device has the 8255 chip at offset 0x10, and is being configured with the base address at an odd 16-byte boundary, limit the size of the region to 0x10 and disable the 8255 subdevice. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-14-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 9a27a33cd9b80a7304637356e8a5a9c5b846734f Author: Ian Abbott Date: Fri Jan 30 16:47:37 2026 +0000 comedi: das08_isa: Add sanity checks for I/O base address The "das08_isa" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported board in the DAS08 family. It currently allows any base address to be configured but the hardware only supports base addresses (configured by an on-board DIP switch) in the range 0 to 0x3f0 on 16-byte boundaries. (Technically, the DIP switches allow 8-byte boundaries, but I do not think that is advisable given that the boards decode an 16-byte address range.) Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-13-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 2750aecdf60524a7d58ecdaaa6e9728ad008cadb Author: Ian Abbott Date: Fri Jan 30 16:47:36 2026 +0000 comedi: dac02: Add sanity checks for I/O base address The "dac02" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported DAC-02 board. It currently allows any base address to be configured but the hardware only supports base addresses (configured by an on-board DIP switch) in the range 0x200 to 0x3f8 on 8-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-12-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 118fb051de0129e0565880119dd7fe64b233f969 Author: Ian Abbott Date: Fri Jan 30 16:47:35 2026 +0000 comedi: comedi_parport: Add sanity checks for I/O base address The "comedi_parport" driver treats a standard printer parallel port as a COMEDI digital I/O device, driving the port's I/O registers directly. It uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of the device. Currently, the driver allows any I/O base address to be specified as long as the I/O region can be reserved, and it converts the specified `int` option value holding the base address to `unsigned long`. It doesn't make sense to allow base addresses that are not aligned to 4-byte boundaries (for SPP printer ports, although printer ports with EPP/ECP support actually need to be aligned on 8-byte boundaries), so add a check for 4-byte alignment. Convert the option value that specifies the base address from `int` to `unsigned int` instead of `unsigned long` so it ends up the same on 32-bit and 64-bit systems. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-11-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 7f318c7223a27a80bf9e449d8c60db852ecd7814 Author: Ian Abbott Date: Fri Jan 30 16:47:34 2026 +0000 comedi: c6xdigio: Add sanity checks for I/O base address The "c6xdigio" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported C6x_DIGIO DSP device connected to a PC printer parallel port (driving the port's I/O registers directly). Currently, the driver allows any I/O base address to be specified as long as the I/O region can be reserved, and it converts the specified `int` option value holding the base address to `unsigned long`. It doesn't make sense to allow base addresses that are not aligned to 4-byte boundaries (for SPP printer ports, although printer ports with EPP/ECP support actually need to be aligned on 8-byte boundaries), so add a check for 4-byte alignment. Convert the option value that specifies the base address from `int` to `unsigned int` instead of `unsigned long` so it ends up the same on 32-bit and 64-bit systems. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-10-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 052b102e2d0b188f5d87699b6f89da8c77bb7f20 Author: Ian Abbott Date: Fri Jan 30 16:47:33 2026 +0000 comedi: amplc_pc263: Add sanity checks for I/O base address The "amplc_pc263" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported PC263 board. It currently allows any base address to be configured but the hardware only supports base addresses (set by on-board DIP switches) in the range 0 to 0x7FE on 2-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-9-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit c1eedf0a0fb1d53eba8f92fc8ac3c96de6f9c97e Author: Ian Abbott Date: Fri Jan 30 16:47:32 2026 +0000 comedi: amplc_pc236: Add sanity checks for I/O base address The "amplc_pc236" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported PC36AT board. It currently allows any base address to be configured but the hardware only supports base addresses (set by on-board DIP switches) in the range 0 to 0xFFC on 4-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-8-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 8e6b36f43465558dc8d6956dd8ef54f7c4046d03 Author: Ian Abbott Date: Fri Jan 30 16:47:31 2026 +0000 comedi: amplc_dio200: Add sanity checks for I/O base address The "amplc_dio200" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported board (PC212E, PC214E, PC215E, PC218E, or PC272E). It currently allows any base address to be configured but the hardware only supports base addresses (set by on-board DIP switches) in the range 0 to 0xFE0 on 32-byte boundaries. (Technically, the DIP switches allow 16-byte boundaries, but I do not think that is advisable given that the boards decode a 32-byte address range.) Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-7-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 81c2e0c8b7933b434163bcddb544094f609d4e1c Author: Ian Abbott Date: Fri Jan 30 16:47:30 2026 +0000 comedi: aio_iiro_16: Add sanity checks for I/O base address The "aio_iiro_16" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported board (IIRO-16). It currently allows any base address to be configured but the hardware only supports base addresses (set by on-board jumpers) in the range 0x100 to 0x3F8 on 8-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-6-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 254ae67d39ab49945aa1ce0a711a499f63965a2c Author: Ian Abbott Date: Fri Jan 30 16:47:29 2026 +0000 comedi: aio_aio12_8: Add sanity checks for I/O base address The "aio_aio12_8" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of a supported board (AIO12-8, AI12-8, or AO12-4). It currently allows any base address to be configured but the hardware only supports base addresses (set by on-board jumpers) in the range 0x100 to 0x3C0 on 32-byte boundaries. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-5-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit a02b67b23e2f1839498b040675c9c8ad864b6aea Author: Ian Abbott Date: Fri Jan 30 16:47:28 2026 +0000 comedi: adq12b: Add sanity checks for I/O base address The "adq12b" driver uses an admin-supplied configuration option (`it->options[0]`) to configure the I/O port base address of the ADQ12-B board. It currently allows any base address to be configured but the hardware only supports the following base addresses (set by an on-board jumper): 0x300, 0x320, 0x340, 0x360, 0x380, 0x3A0. Add a sanity check to ensure the device is not configured at an unsupported base address. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-4-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit cb51837eeeddac2da41f4c202597c534bb9d8dc9 Author: Ian Abbott Date: Fri Jan 30 16:47:27 2026 +0000 comedi: 8255: Add some I/O base address sanity checks The "8255" driver allows a COMEDI device to be constructed from one or more 8255 chips, each at an I/O port base address specified by the admin-supplied configuration options (`it->options[]`). Currently, the driver allows any I/O base addresses to be specified as long as the I/O regions can be reserved, and it converts the specified `int` option values holding the base address to `unsigned long`. It doesn't make sense to allow base addresses that are not aligned to 4-byte boundaries because the hardware register addresses would not be decoded properly, so add a check for valid alignment. Convert the option values that specify the base addresses from `int` to `unsigned int` instead of `unsigned long` so they end up the same on 32-bit and 64-bit systems. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-3-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 241cb8dee0f83856c728f4fe2c29e331386c92f2 Author: Ian Abbott Date: Fri Jan 30 16:47:26 2026 +0000 comedi: add comedi_check_request_region() There is an existing comedi_request_region(dev, start, len) function used by COMEDI drivers for legacy devices to request an I/O port region starting at a specified base address (which must be non-zero) and with a specified length. It uses request_region(). On success, it sets dev->iobase and dev->iolen and returns 0. There is a alternative function __comedi_request_region(dev, start, len) which does the same thing without setting dev->iobase and dev->iolen. Most hardware devices have restrictions on the allowed I/O port base address and alignment, so add new functions comedi_check_request_region(dev, start, len, minstart, maxend, minalign) and __comedi_check_request_region(dev, start, len, minstart, maxend, minalign) to perform these additional checks. Turn the original functions into static inline wrapper functions that call the new functions. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260130170416.49994-2-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 4aebd7d5c72f805ef59985958ad76b8dbce60d8f Author: Hendrik Brueckner Date: Wed Apr 1 17:12:21 2026 +0200 KVM: s390: Add KVM capability for ESA mode guests Now that all the bits are properly addressed, provide a mechanism for testing ESA mode guests in nested configurations. Signed-off-by: Hendrik Brueckner [farman@us.ibm.com: Updated commit message] Reviewed-by: Janosch Frank Signed-off-by: Eric Farman Signed-off-by: Janosch Frank commit c0dcada088ffb5bbac3fc17a416ed2c225f49b9c Author: Eric Farman Date: Wed Apr 1 17:12:20 2026 +0200 KVM: s390: vsie: Accommodate ESA prefix pages The prefix page address occupies a different number of bits for z/Architecture versus ESA mode. Adjust the definition to cover both, and permit an ESA mode address within the nested codepath. Signed-off-by: Eric Farman Reviewed-by: Hendrik Brueckner Signed-off-by: Janosch Frank commit a9640e2eb7110f0aafda8905acbf5b4ae8db07a4 Author: Eric Farman Date: Wed Apr 1 17:12:19 2026 +0200 KVM: s390: vsie: Disable some bits when in ESA mode In the event that a nested guest is put in ESA mode, ensure that some bits are scrubbed from the shadow SCB. Reviewed-by: Christian Borntraeger Signed-off-by: Eric Farman Reviewed-by: Hendrik Brueckner Signed-off-by: Janosch Frank commit b0ad874d9852967dafdb94b1632e0732e01e6cd8 Author: Eric Farman Date: Wed Apr 1 17:12:18 2026 +0200 KVM: s390: vsie: Allow non-zarch guests Linux/KVM runs in z/Architecture-only mode. Although z/Architecture is built upon a long history of hardware refinements, any other CPU mode is not permitted. Allow a userspace to explicitly enable the use of ESA mode for nested guests, otherwise usage will be rejected. Reviewed-by: Janosch Frank Signed-off-by: Eric Farman Reviewed-by: Hendrik Brueckner Reviewed-by: Christian Borntraeger Signed-off-by: Janosch Frank commit ec07906bdc52848bd7dc93d1d44e642dcdc7a15a Author: Vincent Donnefort Date: Wed Apr 1 05:51:00 2026 +0100 tracing: selftests: Extend hotplug testing for trace remotes The hotplug testing only tries reading a trace remote buffer, loaded before a CPU is offline. Extend this testing to cover: * A trace remote buffer loaded after a CPU is offline. * A trace remote buffer loaded before a CPU is online. Because of these added test cases, move the hotplug testing into a separate hotplug.tc file. Acked-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260401045100.3394299-3-vdonnefort@google.com Signed-off-by: Marc Zyngier commit ce47b798ed1e44a6ae2c2966cdf7cba6b428083e Author: Vincent Donnefort Date: Wed Apr 1 05:50:59 2026 +0100 tracing: Non-consuming read for trace remotes with an offline CPU When a trace_buffer is created while a CPU is offline, this CPU is cleared from the trace_buffer CPU mask, preventing the creation of a non-consuming iterator (ring_buffer_iter). For trace remotes, it means the iterator fails to be allocated (-ENOMEM) even though there are available ring buffers in the trace_buffer. For non-consuming reads of trace remotes, skip missing ring_buffer_iter to allow reading the available ring buffers. Acked-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260401045100.3394299-2-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 269389ba539834ec80e4d55583fca2cd70e4dc9c Author: Lorenzo Bianconi Date: Tue Mar 31 12:33:24 2026 +0200 net: airoha: Set REG_RX_CPU_IDX() once in airoha_qdma_fill_rx_queue() It is not necessary to update REG_RX_CPU_IDX register for each iteration of the descriptor loop in airoha_qdma_fill_rx_queue routine. Move REG_RX_CPU_IDX configuration out of the descriptor loop and rely on the last queue head value updated in the descriptor loop. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260331-airoha-cpu-idx-out-off-loop-v1-1-75c66b428f50@kernel.org Signed-off-by: Paolo Abeni commit 4e56428ed4782e9e1356875af8e714b24c5a8783 Author: Christoph Hellwig Date: Wed Apr 1 15:58:51 2026 +0200 blk-crypto: fix name of the bio completion callback Fix a simple naming issue in the documentation: the completion routine is called bi_end_io and not bi_complete. Signed-off-by: Christoph Hellwig Reviewed-by: Eric Biggers Link: https://patch.msgid.link/20260401135854.125109-1-hch@lst.de Signed-off-by: Jens Axboe commit f847bf6d29304087f94ef4b4a8646f69d96945f9 Author: Yang Xiuwei Date: Thu Apr 2 09:49:52 2026 +0800 io_uring/timeout: use 'ctx' consistently There's already a local ctx variable, yet cq_timeouts accounting uses req->ctx. Use ctx consistently. Signed-off-by: Yang Xiuwei Link: https://patch.msgid.link/20260402014952.260414-1-yangxiuwei@kylinos.cn Signed-off-by: Jens Axboe commit c691e4b0d80be423f0a7443b53898eafe9c8754b Author: Ming Lei Date: Thu Mar 26 22:40:58 2026 +0800 bio: fix kmemleak false positives from percpu bio alloc cache When a bio is allocated from the mempool with REQ_ALLOC_CACHE set and later completed, bio_put() places it into the per-cpu bio_alloc_cache via bio_put_percpu_cache() instead of freeing it back to the mempool/slab. The slab allocation remains tracked by kmemleak, but the only reference to the bio is through the percpu cache's free_list, which kmemleak fails to trace through percpu memory. This causes kmemleak to report the cached bios as unreferenced objects. Use symmetric kmemleak_free()/kmemleak_alloc() calls to properly track bios across percpu cache transitions: - bio_put_percpu_cache: call kmemleak_free() when a bio enters the cache, unregistering it from kmemleak tracking. - bio_alloc_percpu_cache: call kmemleak_alloc() when a bio is taken from the cache for reuse, re-registering it so that genuine leaks of reused bios remain detectable. - __bio_alloc_cache_prune: call kmemleak_alloc() before bio_free() so that kmem_cache_free()'s internal kmemleak_free() has a matching allocation to pair with. Tested-by: Yi Zhang Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260326144058.2392319-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 9853914c08e00d2ccbffbceaaada5ad7c6e4db4c Merge: 265439eb88fda0 e08d007f9d8136 Author: Ingo Molnar Date: Thu Apr 2 15:03:51 2026 +0200 Merge branch 'sched/urgent' into sched/core, to resolve conflicts The following fix in sched/urgent: e08d007f9d81 ("sched/debug: Fix avg_vruntime() usage") is in conflict with this pending commit in sched/core: 4823725d9d1d ("sched/fair: Increase weight bits for avg_vruntime") Both modify the same variable definition and initialization blocks, resolve it by merging the two. Conflicts: kernel/sched/debug.c Signed-off-by: Ingo Molnar commit 1323a5cfe52c7937ea3cd7a75e0355cacd805da4 Author: Jinyu Tang Date: Fri Feb 27 20:10:08 2026 +0800 KVM: riscv: Skip CSR restore if VCPU is reloaded on the same core Currently, kvm_arch_vcpu_load() unconditionally restores guest CSRs, HGATP, and AIA state. However, when a VCPU is loaded back on the same physical CPU, and no other KVM VCPU has run on this CPU since it was last put, the hardware CSRs and AIA registers are still valid. This patch optimizes the vcpu_load path by skipping the expensive CSR and AIA writes if all the following conditions are met: 1. It is being reloaded on the same CPU (vcpu->arch.last_exit_cpu == cpu). 2. The CSRs are not dirty (!vcpu->arch.csr_dirty). 3. No other VCPU used this CPU (vcpu == __this_cpu_read(kvm_former_vcpu)). To ensure this fast-path doesn't break corner cases: - Live migration and VCPU reset are naturally safe. KVM initializes last_exit_cpu to -1, which guarantees the fast-path won't trigger. - The 'csr_dirty' flag tracks runtime userspace interventions. If userspace modifies guest configurations (e.g., hedeleg via KVM_SET_GUEST_DEBUG, or CSRs including AIA via KVM_SET_ONE_REG), the flag is set to skip the fast path. With the 'csr_dirty' safeguard proven effective, it is safe to include kvm_riscv_vcpu_aia_load() inside the skip logic now. Signed-off-by: Jinyu Tang Reviewed-by: Nutty Liu Reviewed-by: Andrew Jones Reviewed-by: Radim Krčmář Link: https://lore.kernel.org/r/20260227121008.442241-1-tjytimi@163.com Signed-off-by: Anup Patel commit c7f3aaf3e835f2dc0f3f293ae3739b844b909595 Author: Joanne Koong Date: Wed Apr 1 10:35:11 2026 -0700 io_uring/rw: clean up __io_read() obsolete comment and early returns After commit a9165b83c193 ("io_uring/rw: always setup io_async_rw for read/write requests") which moved the iovec allocation into the prep path and stores it in req->async_data where it now gets freed as part of the request lifecycle, this comment is now outdated. Remove it and clean up the goto as well. Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20260401173511.4052303-1-joannelkoong@gmail.com Signed-off-by: Jens Axboe commit 4c6f93951b8fc556f2a37d45b32cb7f7e76b0e91 Author: Pavel Begunkov Date: Tue Mar 31 22:07:43 2026 +0100 io_uring/zcrx: use correct mmap off constants zcrx was using IORING_OFF_PBUF_SHIFT during first iterations, but there is now a separate constant it should use. Both are 16 so it doesn't change anything, but improve it for the future. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/fe16ebe9ba4048a7e12f9b3b50880bd175b1ce03.1774780198.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 7120b87bed922ae2f1968c081377162380e1547e Author: Pavel Begunkov Date: Tue Mar 31 22:07:42 2026 +0100 io_uring/zcrx: use dma_len for chunk size calculation Buffers are now dma-mapped earlier and we can sg_dma_len(), otherwise, since it's walking with for_each_sgtable_dma_sg(), it might wrongfully reject some configurations. As a bonus, it'd now be able to use larger chunks if dma addresses are coalesced e.g by iommu. Fixes: 8c0cab0b7bf7 ("io_uring/zcrx: always dma map in advance") Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/03b219af3f6cfdd1cf64679b8bab7461e47cc123.1774780198.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 52dcd1776bed614c6a270d9237df6105feab4c14 Author: Pavel Begunkov Date: Tue Mar 31 22:07:41 2026 +0100 io_uring/zcrx: don't clear not allocated niovs Now that area->is_mapped is set earlier before niovs array is allocated, io_zcrx_free_area -> io_zcrx_unmap_area in an error path can try to clear dma addresses for unallocated niovs, fix it. Fixes: 8c0cab0b7bf7 ("io_uring/zcrx: always dma map in advance") Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/cbcb7749b5a001ecd4d1c303515ce9403215640c.1774780198.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit f1fa1157f426c92c0189e62487f631bb5905b31d Merge: ae04bff949c509 0d8647bc74cb50 Author: Paolo Abeni Date: Thu Apr 2 13:31:39 2026 +0200 Merge branch 'net-mctp-improvements-for-null-eid-addressing' Jeremy Kerr says: ==================== net: mctp: improvements for NULL-EID addressing Currently, our focus for the MCTP routing implementation has been for MCTP bus-owner devices. In this case, we will generally have an EID assigned during local transmit, and have routes established before expecting to receive. We also want to handle non-bus-owner cases, where: - we may need to send control protocol messages (like Discovery Notify) before any local addresses have been assigned, particularly as part of acquiring a local address assignment; and - we will likely want to receive incoming messages before we have routing established. This series improves handling for these cases, by handling NULL EIDs as source / destination addresses where possible. Signed-off-by: Jeremy Kerr ==================== Link: https://patch.msgid.link/20260331-dev-mctp-null-eids-v1-0-b4d047372eaf@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 0d8647bc74cb50edf02e8c88977657596f20fb17 Author: Jeremy Kerr Date: Tue Mar 31 15:41:08 2026 +0800 net: mctp: don't require a route for null-EID ingress Currently, if we receive a physically-addressed packet for the local stack, we perform a route_lookup_null to find a matching device-based route. If a route is present, it will always have the ->output fn set to mctp_dst_input, which provides our delivery mechanism. However, if we don't yet have any local addresses assigned, we won't have any local routes to lookup, so this will fail. One of the use-cases for physical addressing is initial address assignment on endpoint nodes, where we would have no addresses, and therefore no local routes. Instead of iterating routes (looking for one matching the dev), just create a suitable mctp_dst for the device directly. Add a testcase for the no-route case too. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20260331-dev-mctp-null-eids-v1-3-b4d047372eaf@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 8af20defc4edb9e5ded39d36e1c7541569cd84d2 Author: Jeremy Kerr Date: Tue Mar 31 15:41:07 2026 +0800 net: mctp: allow local TX with no address assigned If we're operating as a non-bus-owner endpoint, we may want to perform MCTP communication to get an address assigned. In this case, we'll have no local addresses, but can TX just fine either with extended routing, or where a direct route exists. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20260331-dev-mctp-null-eids-v1-2-b4d047372eaf@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 22cb45afd221b9e4f2a1dcc74a8ff645b7293aa1 Author: Jeremy Kerr Date: Tue Mar 31 15:41:06 2026 +0800 net: mctp: perform source address lookups when we populate our dst Rather than querying the output device for its address in mctp_local_output, set up the source address when we're populating the dst structure. If no address is assigned, use MCTP_ADDR_NULL. This will allow us more flexibility when routing for NULL-source-eid cases. For now though, we still reject a NULL source address in the output path. We need to update the tests a little, so that addresses are assigned before we do the dst lookups. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20260331-dev-mctp-null-eids-v1-1-b4d047372eaf@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 4513d3e0bbc0585b86ccf2631902593ff97e88f5 Author: Cryolitia PukNgae Date: Thu Apr 2 13:36:57 2026 +0800 ALSA: usb-audio: apply quirk for MOONDROP JU Jiu It(ID 31b2:0111 JU Jiu) reports a MIN value -12800 for volume control, but will mute when setting it less than -10880. Thanks to my girlfriend Kagura for reporting this issue. Cc: Kagura Cc: stable@vger.kernel.org Signed-off-by: Cryolitia PukNgae Link: https://patch.msgid.link/20260402-syy-v1-1-068d3bc30ddc@linux.dev Signed-off-by: Takashi Iwai commit 1558905669e4da922fbaa7cf6507eb14779bffbd Author: wangdicheng Date: Thu Apr 2 10:36:04 2026 +0800 ALSA: aoa/tas: Fix OF node leak on probe failure Add missing of_node_put() in the error path. Signed-off-by: wangdicheng Link: https://patch.msgid.link/20260402023604.54682-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit ae04bff949c50921c2af2a14def112a2c47e649d Merge: cee10a01e286e8 3016574ea2f8a8 Author: Paolo Abeni Date: Thu Apr 2 12:11:05 2026 +0200 Merge branch 'selftests-drivers-bash-support-for-remote-traffic-generators' Ioana Ciornei says: ==================== selftests: drivers: bash support for remote traffic generators This patch set aims to add the necessary support so that bash written selftests are also able to easily run with a remote traffic generator system, either be it in another netns or one accessible through ssh. This patch set is a result of the discussion from v1: https://lore.kernel.org/all/20260303084330.340b6459@kernel.org/ Even though the python infrastructure is already established, some things are easier in bash and it would be a shame to leave behind the bash tests that we already have. This support is based on the requirements described in the tools/testing/selftests/drivers/net/README.rst file. Mainly, the drivers/net selftests should be able to run on a interface specified through the NETIF env variable. On top of that, variables such as REMOTE_TYPE and REMOTE_ARGS define how the remote traffic generator can be accessed. Patch 3/10 parses these env variables and constructs the NETIFS array that bash tests are accustomed to. This is with the intention of enabling already written tests to incur minimal changes. The second patch also defines the TARGETS array which will hold the necessary information about the target on which a specific interface is located. For example, a net.config which looks like below: NETIF=eth0 LOCAL_V4=192.168.1.1 REMOTE_V4=192.168.1.2 REMOTE_TYPE=ssh REMOTE_ARGS=root@192.168.1.2 will generate the NETIFS and TARGETS arrays with the following data. NETIFS[p1]="eth0" NETIFS[p2]="eth2" TARGETS[eth0]="local:" TARGETS[eth2]="ssh:root@192.168.1.2" The above will be true if on the remote target, the interface which has the 192.168.1.2 address is named eth2. The values held in the TARGETS array will be used by the new 'run_on' helper added in patch 2/10 to know how to run a specific command, on the local system, on another netns or by using ssh. Patch 4/10 updates some helpers to use run_on so that, for example, lib.sh is able to ensure stable MAC addresses even with the remote interface located in another netns. The next 5 patches, 5/10-9/10 update the ethtool_rmon.sh script so that it can work with the kselftest infrastructure and the new NETIF/REMOTE_TYPE etc way of working. Beside updating each ip link or ethtool command to use the run_on helper, the patches also remove any testing done on the remote interface. The last patch adds a new test which checks the standard counters - eth-ctrl, eth-mac and pause - and uses the new infrastructure put in place by the first patches. With this patch set, both tests can be run using a net.config file and run_kselftest.sh as shown below. $ make -C tools/testing/selftests/ TARGETS="drivers/net drivers/net/hw" \ install INSTALL_PATH=/tmp/ksft-net-drv $ cd /tmp/ksft-net-drv/ $ cat > ./drivers/net/net.config < commit 3016574ea2f8a8cff69286574ac027fa5aed5a81 Author: Ioana Ciornei Date: Mon Mar 30 18:29:33 2026 +0300 selftests: drivers: hw: add test for the ethtool standard counters Add a new selftest - ethtool_std_stats.sh - which validates the eth-ctrl, eth-mac and pause standard statistics exported by an interface. Collision related eth-mac counters as well as the error ones will be checked against zero since that is the most likely correct scenario. The central part of this patch is the traffic_test() function which gathers the 'before' counter values, sends a batch of traffic and then interrogates again the same counters in order to determine if the delta is on target. The function receives an array through which the caller can request what counters to be interrogated and, for each of them, what is their target delta value. The output from this selftest looks as follows on a LX2160ARDB board: $ ./run_kselftest.sh -t drivers/net/hw:ethtool_std_stats.sh TAP version 13 1..1 # timeout set to 0 # selftests: drivers/net/hw: ethtool_std_stats.sh # TAP version 13 # 1..26 # ok 1 ethtool_std_stats.eth-ctrl-MACControlFramesTransmitted # ok 2 ethtool_std_stats.eth-ctrl-MACControlFramesReceived # ok 3 ethtool_std_stats.eth-mac-FrameCheckSequenceErrors # ok 4 ethtool_std_stats.eth-mac-AlignmentErrors # ok 5 ethtool_std_stats.eth-mac-FramesLostDueToIntMACXmitError # ok 6 ethtool_std_stats.eth-mac-CarrierSenseErrors # SKIP # ok 7 ethtool_std_stats.eth-mac-FramesLostDueToIntMACRcvError # ok 8 ethtool_std_stats.eth-mac-InRangeLengthErrors # SKIP # ok 9 ethtool_std_stats.eth-mac-OutOfRangeLengthField # SKIP # ok 10 ethtool_std_stats.eth-mac-FrameTooLongErrors # SKIP # ok 11 ethtool_std_stats.eth-mac-FramesAbortedDueToXSColls # SKIP # ok 12 ethtool_std_stats.eth-mac-SingleCollisionFrames # SKIP # ok 13 ethtool_std_stats.eth-mac-MultipleCollisionFrames # SKIP # ok 14 ethtool_std_stats.eth-mac-FramesWithDeferredXmissions # SKIP # ok 15 ethtool_std_stats.eth-mac-LateCollisions # SKIP # ok 16 ethtool_std_stats.eth-mac-FramesWithExcessiveDeferral # SKIP # ok 17 ethtool_std_stats.eth-mac-BroadcastFramesXmittedOK # ok 18 ethtool_std_stats.eth-mac-OctetsTransmittedOK # ok 19 ethtool_std_stats.eth-mac-BroadcastFramesReceivedOK # ok 20 ethtool_std_stats.eth-mac-OctetsReceivedOK # ok 21 ethtool_std_stats.eth-mac-FramesTransmittedOK # ok 22 ethtool_std_stats.eth-mac-MulticastFramesXmittedOK # ok 23 ethtool_std_stats.eth-mac-FramesReceivedOK # ok 24 ethtool_std_stats.eth-mac-MulticastFramesReceivedOK # ok 25 ethtool_std_stats.pause-tx_pause_frames # ok 26 ethtool_std_stats.pause-rx_pause_frames # # 10 skipped test(s) detected. Consider enabling relevant config options to improve coverage. # # Totals: pass:16 fail:0 xfail:0 xpass:0 skip:10 error:0 ok 1 selftests: drivers/net/hw: ethtool_std_stats.sh Please note that not all MACs are counting the software injected pause frames as real Tx pause. For example, on a LS1028ARDB the selftest output will reflect the fact that neither the ENETC MAC, nor the Felix switch MAC are able to detect Tx pause frames injected by software. $ ./run_kselftest.sh -t drivers/net/hw:ethtool_std_stats.sh (...) # # software sent pause frames not detected # ok 25 ethtool_std_stats.pause-tx_pause_frames # XFAIL # ok 26 ethtool_std_stats.pause-rx_pause_frames Signed-off-by: Ioana Ciornei Acked-by: Petr Machata Link: https://patch.msgid.link/20260330152933.2195885-10-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit abe4929bc7d0e29c5dda8b0bb0f6beeec76fd7b6 Author: Ioana Ciornei Date: Mon Mar 30 18:29:32 2026 +0300 selftests: drivers: hw: update ethtool_rmon to work with a single local interface This patch finalizes the transition to work with a single local interface for the ethtool_rmon.sh test. Each 'ip link' and 'ethtool' command used by the test is annotated with the necessary run_on in order to be executed on the necessary target system, be it local, in another network namespace or through ssh. Since we need NETIF up and running also for control traffic, we now expect that the interfaces are up and running and do not touch bring them up or down at the end of the test. This is also documented in the drivers/net/README.rst. The ethtool_rmon.sh script can still be used in the older fashion by passing two interfaces as command line arguments, the only restriction is that those interfaces need to be already up. $ DRIVER_TEST_CONFORMANT=no ./ethtool_rmon.sh eth0 eth1 As part of the kselftest infrastructure, this test can be run in the following manner: $ make -C tools/testing/selftests/ TARGETS="drivers/net drivers/net/hw" \ install INSTALL_PATH=/tmp/ksft-net-drv $ cd /tmp/ksft-net-drv/ $ cat > ./drivers/net/net.config < Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260330152933.2195885-9-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit eec1b9057c24d3f7c37d98208bb0c9be7130d3c6 Author: Ioana Ciornei Date: Mon Mar 30 18:29:31 2026 +0300 selftests: drivers: hw: move to KTAP output Update the ethtool_rmon.sh test so that it uses the KTAP format for its output. This is achieved by using the helpers found in ktap_helpers.sh. An example output can be found below. $ ./ethtool_rmon.sh endpmac3 endpmac4 TAP version 13 1..14 ok 1 ethtool_rmon.rx-pkts64to64 ok 2 ethtool_rmon.rx-pkts65to127 ok 3 ethtool_rmon.rx-pkts128to255 ok 4 ethtool_rmon.rx-pkts256to511 ok 5 ethtool_rmon.rx-pkts512to1023 ok 6 ethtool_rmon.rx-pkts1024to1518 ok 7 ethtool_rmon.rx-pkts1519to10240 ok 8 ethtool_rmon.tx-pkts64to64 ok 9 ethtool_rmon.tx-pkts65to127 ok 10 ethtool_rmon.tx-pkts128to255 ok 11 ethtool_rmon.tx-pkts256to511 ok 12 ethtool_rmon.tx-pkts512to1023 ok 13 ethtool_rmon.tx-pkts1024to1518 ok 14 ethtool_rmon.tx-pkts1519to10240 # Totals: pass:14 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Ioana Ciornei Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260330152933.2195885-8-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit 557c067c0001b2e1538633d921790a1094e675ff Author: Ioana Ciornei Date: Mon Mar 30 18:29:30 2026 +0300 selftests: drivers: hw: replace counter upper limit with UINT32_MAX in rmon test The ethtool_rmon.sh script checks that the number of packets sent / received during a test matches the expected value with a 1% tolerance. Since in the next patches this test will gain the capability to also be run on systems with a single interface where the traffic generator is accesible through ssh, use the UINT32_MAX as the upper limit. This is necessary since the same interface will be used also for control traffic (the ssh commands) as well as the mausezahn generated one. Signed-off-by: Ioana Ciornei Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260330152933.2195885-7-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit e76c71483a5600eb9ef8f1741c92fe1282bfd461 Author: Ioana Ciornei Date: Mon Mar 30 18:29:29 2026 +0300 selftests: drivers: hw: test rmon counters only on first interface The selftests in drivers/net are slowly transitioning to being able to be used on systems with a single network interface. The first step for the ethtool_rmon.sh test is to only validate that the rmon counters are properly exported on the first interface supplied as an argument. Remove the rmon_histogram calls which intend to test also the rmon counters on the 2nd interface. This also removes the need for the remote system, which should be used only to inject traffic, to also support rmon counters. Signed-off-by: Ioana Ciornei Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260330152933.2195885-6-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit afd1b9bf7529d853284205f618e314134a5ad9ad Author: Ioana Ciornei Date: Mon Mar 30 18:29:28 2026 +0300 selftests: drivers: hw: cleanup shellcheck warnings in the rmon test If run on the ethtool_rmon.sh script, shellcheck generates a bunch of false positive errors. Suppress those checks that generate them. Also cleanup the remaining warnings by using double quoting around the used variables. Signed-off-by: Ioana Ciornei Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260330152933.2195885-5-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit 7db9da4c67c7781c2c917657d5d9bdc171836d5f Author: Ioana Ciornei Date: Mon Mar 30 18:29:27 2026 +0300 selftests: net: update some helpers to use run_on Update some helpers so that they are capable to run commands on different targets than the local one. This patch makes the necesasy modification for those helpers / sections of code which are needed for the ethtool_rmon.sh test that will be converted in the next patches. For example, mac_addr_prepare() and mac_addr_restore() used when STABLE_MAC_ADDRS=yes need to ensure stable MAC addresses on interfaces located even in other namespaces. In order to do that, append the 'ip link' commands with a 'run_on $dev' tag. The same run_on is necessary also when verifying if all the interfaces listed in NETIFS are indeed available. Signed-off-by: Ioana Ciornei Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260330152933.2195885-4-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit 2de16ebe78f0509d5fa0b41ed6e841603058b6a6 Author: Ioana Ciornei Date: Mon Mar 30 18:29:26 2026 +0300 selftests: net: extend lib.sh to parse drivers/net/net.config Extend lib.sh so that it's able to parse driver/net/net.config and environment variables such as NETIF, REMOTE_TYPE, LOCAL_V4 etc described in drivers/net/README.rst. In order to make the transition towards running with a single local interface smoother for the bash networking driver tests, beside sourcing the net.config file also translate the new env variables into the old style based on the NETIFS array. Since the NETIFS array only holds the network interface names, also add a new array - TARGETS - which keeps track of the target on which a specific interfaces resides - local, netns or accesible through an ssh command. For example, a net.config which looks like below: NETIF=eth0 LOCAL_V4=192.168.1.1 REMOTE_V4=192.168.1.2 REMOTE_TYPE=ssh REMOTE_ARGS=root@192.168.1.2 will generate the NETIFS and TARGETS arrays with the following data. NETIFS[p1]="eth0" NETIFS[p2]="eth2" TARGETS[eth0]="local:" TARGETS[eth2]="ssh:root@192.168.1.2" The above will be true if on the remote target, the interface which has the 192.168.1.2 address is named eth2. Since the TARGETS array is indexed by the network interface name, document a new restriction README.rst which states that the remote interface cannot have the same name as the local one. Keep the old way of populating the NETIFS variable based on the command line arguments. This will be invoked in case DRIVER_TEST_CONFORMANT = "no". Also add a couple of helpers which can be used by tests which need to run a specific bash command on a different target than the local system, be it either another netns or a remote system accessible through ssh. The __run_on() function is passed through $1 the target on which the command should be executed while run_on() is passed the name of the interface that is then used to retrieve the target from the TARGETS array. Also add a stub run_on() function in net/lib.sh so that users of the net/lib.sh are going through the stub only since neither NETIFS nor TARGETS are valid in that circumstance. Signed-off-by: Ioana Ciornei Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260330152933.2195885-3-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit 4799ff80c68a76e408b8dadd4aeaa5311962033c Author: Ioana Ciornei Date: Mon Mar 30 18:29:25 2026 +0300 selftests: forwarding: extend ethtool_std_stats_get with pause statistics Even though pause frame statistics are not exported through the same ethtool command, there is no point in adding another helper just for them. Extent the ethtool_std_stats_get() function so that we are able to interrogate using the same helper all the standard statistics. And since we are touching the function, convert the initial ethtool call as well to the jq --arg form in order to be easier to read. Signed-off-by: Ioana Ciornei Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260330152933.2195885-2-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit e3d074b5e642ed40c31876816a2af0ddcf9b94a3 Author: Harald Freudenberger Date: Tue Mar 24 13:57:36 2026 +0100 s390/pkey: Add comment about synchronize_rcu() to pkey base Add a comment about the use of the synchronize_rcu() invocation. There are two invocations of the synchronize_rcu() call in the pkey base code. On one place it is optional but used to enforce a fast path update to the other CPUs. As some people and code checkers complain about this redundant invocation the suggestion came up to add a comment to explain why the call is meaningful at that place. Closes: https://lore.kernel.org/linux-s390/20260313052312.2389-1-lirongqing@baidu.com/ Suggested-by: Li Rongqing Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Vasily Gorbik commit 052abf9ac00b69da50342698679a67c3c0901f7f Author: Jori Koolstra Date: Sun Mar 8 11:32:51 2026 +0100 s390/hmcdrv: Remove commented out code The create_class() api is retiring in favor of class_register() (see: https://lore.kernel.org/all/2023040244-duffel-pushpin-f738@gregkh/). The HMCDRV_DEV_CLASS define is hiding a use of create_class(), but it is permanently disabled as it is commented out. To avoid supporting code that is disabled, the suggestion is to remove all code hiding be behind any #ifdef HMCDRV_DEV_CLASS. Suggested-by: Greg Kroah-Hartman Signed-off-by: Jori Koolstra Reviewed-by: Heiko Carstens Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20260308103255.757461-1-jkoolstra@xs4all.nl Signed-off-by: Vasily Gorbik commit 5aac28784dca6819e96e5f93e644cdee59e50f6e Author: Magnus Kalland Date: Thu Apr 2 09:42:50 2026 +0200 iommu/amd: Invalidate IRT cache for DMA aliases DMA aliasing causes interrupt remapping table entries (IRTEs) to be shared between multiple device IDs. See commit 3c124435e8dd ("iommu/amd: Support multiple PCI DMA aliases in IRQ Remapping") for more information on this. However, the AMD IOMMU driver currently invalidates IRTE cache entries on a per-device basis whenever an IRTE is updated, not for each alias. This approach leaves stale IRTE cache entries when an IRTE is cached under one DMA alias but later updated and invalidated through a different alias. In such cases, the original device ID is never invalidated, since it is programmed via aliasing. This incoherency bug has been observed when IRTEs are cached for one Non-Transparent Bridge (NTB) DMA alias, later updated via another. Fix this by invalidating the interrupt remapping table cache for all DMA aliases when updating an IRTE. Co-developed-by: Lars B. Kristiansen Signed-off-by: Lars B. Kristiansen Co-developed-by: Jonas Markussen Signed-off-by: Jonas Markussen Co-developed-by: Tore H. Larsen Signed-off-by: Tore H. Larsen Signed-off-by: Magnus Kalland Link: https://lore.kernel.org/linux-iommu/9204da81-f821-4034-b8ad-501e43383b56@amd.com/ Signed-off-by: Joerg Roedel commit 61327f3d817cb5820559ad4f8d0d9abed3d379b1 Author: Mark Brown Date: Wed Apr 1 17:57:35 2026 +0100 ALSA: compress: Pay attention if drivers error out retrieving pointers Currently we have a return code on the driver pointer operation but the core ignores that. Let's start paying attention. Reported-by: Péter Ujfalusi Signed-off-by: Mark Brown Acked-by: Vinod Koul Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260401-alsa-unconfigured-tstamp-v1-2-694c2cb5f71d@kernel.org commit cf6c18cf83e48986ac40a053d09d3c33624135f6 Author: Mark Brown Date: Wed Apr 1 17:57:34 2026 +0100 ALSA: compress: Refuse to update timestamps for unconfigured streams There are a number of mechanisms, including the userspace accessible timestamp and buffer availability ioctl()s, which allow us to trigger a timestamp update on a stream before it has been configured. Since drivers might rely on stream configuration for reporting of pcm_io_frames, including potentially doing a division by the number of channels, and these operations are not meaningful for an unconfigured stream reject attempts to read timestamps before any configuration is done. Signed-off-by: Mark Brown Acked-by: Vinod Koul Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260401-alsa-unconfigured-tstamp-v1-1-694c2cb5f71d@kernel.org commit 3418d862679ac6da0b6bd681b18b3189c4fad20d Merge: 3a2486cc1da5cf 5c8d16ac49405c Author: Miguel Ojeda Date: Thu Apr 2 10:28:41 2026 +0200 Merge tag 'rust-analyzer-v7.1' of https://github.com/Rust-for-Linux/linux into rust-next Pull rust-analyzer updates from Tamir Duberstein: - Add type annotations to 'generate_rust_analyzer.py'. - Add support for scripts written in Rust ('generate_rust_target.rs', 'rustdoc_test_builder.rs', 'rustdoc_test_gen.rs'). - Refactor 'generate_rust_analyzer.py' to explicitly identify host and target crates, improve readability, and reduce duplication. * tag 'rust-analyzer-v7.1' of https://github.com/Rust-for-Linux/linux: scripts: generate_rust_analyzer.py: reduce cfg plumbing scripts: generate_rust_analyzer.py: rename cfg to generated_cfg scripts: generate_rust_analyzer.py: avoid FD leak scripts: generate_rust_analyzer.py: define scripts scripts: generate_rust_analyzer.py: identify crates explicitly scripts: generate_rust_analyzer.py: add type hints scripts: generate_rust_analyzer.py: drop `"is_proc_macro": false` scripts: generate_rust_analyzer.py: extract `{build,register}_crate` commit 5408c22b816f7012cc5ba80469389a088ab13663 Author: Al Viro Date: Sat Jan 24 01:32:07 2026 -0500 dcache.c: more idiomatic "positives are not allowed" sanity checks Several functions have BUG_ON/WARN_ON sanity checks that want to verify that dentry is not positive and instead of looking at ->d_inode (as we do in all other places that check that) they look at ->d_alias. Just use the normal helpers instead - that way we no longer even look at ->d_alias for negative dentries Signed-off-by: Al Viro commit d6250d49da4d8f11afc0d8991c84e0307949f92e Author: Zhan Xusheng Date: Wed Apr 1 14:13:42 2026 +0800 erofs: include the trailing NUL in FS_IOC_GETFSLABEL erofs_ioctl_get_volume_label() passes strlen(sbi->volume_name) as the length to copy_to_user(), which copies the label string without the trailing NUL byte. Since FS_IOC_GETFSLABEL callers expect a NUL-terminated string in the FSLABEL_MAX-sized buffer and may not pre-zero the buffer, this can cause userspace to read past the label into uninitialised stack memory. Fix this by using strlen() + 1 to include the NUL terminator, consistent with how ext4 and xfs implement FS_IOC_GETFSLABEL. Signed-off-by: Zhan Xusheng Fixes: 1cf12c717741 ("erofs: Add support for FS_IOC_GETFSLABEL") Reviewed-by: Gao Xiang Reviewed-by: Chunhai Guo Signed-off-by: Gao Xiang commit 5de6951fedb29700ace53b283ccb951c8f712d12 Author: Zhan Xusheng Date: Tue Mar 31 13:02:49 2026 +0800 erofs: ensure all folios are managed in erofs_try_to_free_all_cached_folios() folio_trylock() in erofs_try_to_free_all_cached_folios() may successfully acquire the folio lock, but the subsequent check for erofs_folio_is_managed() can skip unlocking when the folio is not managed by EROFS. As Gao Xiang pointed out, this condition should not happen in practice because compressed_bvecs[] only holds valid cached folios at this point — any non-managed folio would have already been detached by z_erofs_cache_release_folio() under folio lock. Fix this by adding DBG_BUGON() to catch unexpected folios and ensure folio_unlock() is always called. Suggested-by: Gao Xiang Signed-off-by: Zhan Xusheng Reviewed-by: Gao Xiang Reviewed-by: Chunhai Guo Signed-off-by: Gao Xiang commit 307210c262a29f41d7177851295ea1703bd04175 Author: Gao Xiang Date: Mon Mar 30 10:29:29 2026 +0800 erofs: verify metadata accesses for file-backed mounts For file-backed mounts, metadata is fetched via the page cache of backing inodes to avoid double caching and redundant copy ops out of RO uptodate folios, which is used by Android APEXes, ComposeFS, containerd. However, rw_verify_area() was missing prior to metadata accesses. Similar to vfs_iocb_iter_read(), fix this by: - Enabling fanotify pre-content hooks on metadata accesses; - security_file_permission() for security modules. Verified that fanotify pre-content hooks now works correctly. Fixes: fb176750266a ("erofs: add file-backed mount support") Acked-by: Amir Goldstein Reviewed-by: Chunhai Guo Signed-off-by: Gao Xiang commit 74a2287209a858470d15e2996ead2337bd293ff4 Author: Kelvin Mbogo Date: Wed Mar 25 13:36:40 2026 +0300 usb: usbip: fix OOB read/write in usbip_pad_iso() usbip_pad_iso() repositions ISO frame data within the transfer buffer via memmove(). Neither the source offset (actualoffset, derived by subtracting wire-supplied actual_length values) nor the destination offset (iso_frame_desc[i].offset, taken directly from the wire) is bounds-checked. If a crafted actual_length wraps actualoffset negative through the subtraction (see patch 2/3 for the root cause), the memmove source points before the allocation - slab OOB read, data returned to userspace. Independently, iso_frame_desc[i].offset is never validated against transfer_buffer_length. Setting offset past the end of the buffer gives a fully controlled OOB write into whatever sits next in the slab - confirmed with offset=400 on a 392-byte buffer, 64-byte write. Add bounds checks for both the source and destination ranges before each memmove call. Use unsigned comparisons after the sign check on actualoffset to avoid signed/unsigned conversion surprises. Signed-off-by: Kelvin Mbogo Link: https://patch.msgid.link/20260325103640.8090-3-addcontent08@gmail.com Signed-off-by: Greg Kroah-Hartman commit 591c1d972d8f19862ecd7279c7ef4df48b0a9b33 Author: Kelvin Mbogo Date: Wed Mar 25 13:36:39 2026 +0300 usb: usbip: validate iso frame actual_length in usbip_recv_iso() usbip_recv_iso() sums each frame's actual_length into an int accumulator without checking the individual values first: total_length += urb->iso_frame_desc[i].actual_length; A malicious server can send actual_length = 0xFFFFFFFC for one frame and a small value for the other, making the signed sum wrap around to match urb->actual_length. The sanity check passes, and usbip_pad_iso() later computes a negative actualoffset, feeding it to memmove() as a source pointer - reads before the allocation, leaked to userspace via USBDEVFS_REAPURB. Reject any frame whose actual_length exceeds transfer_buffer_length (one frame can't carry more data than the whole buffer), and widen the accumulator to u32 so that many moderately-large frames can't wrap it either. Signed-off-by: Kelvin Mbogo Link: https://patch.msgid.link/20260325103640.8090-2-addcontent08@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1897852293faca4c2be51e0a19f739622f771623 Author: Kelvin Mbogo Date: Wed Mar 25 13:36:38 2026 +0300 usb: usbip: fix integer overflow in usbip_recv_iso() usbip_recv_iso() computes the iso descriptor buffer size as: int size = np * sizeof(*iso); where np comes straight from the wire (urb->number_of_packets, set by usbip_pack_ret_submit() before we get here). With np = 0x10000001 and sizeof(*iso) == 16 the product is 0x100000010 which truncates to 16 on a 32-bit int. kzalloc(16) succeeds but the following receive loop writes np * 16 bytes into it - game over. USBIP_MAX_ISO_PACKETS (1024) already exists in usbip_common.h for the submit path but was never enforced on the receive side. Clamp np to [1, USBIP_MAX_ISO_PACKETS] and switch to kcalloc() so the allocator itself can catch overflows in the future. Fold the existing np == 0 early return into the new bounds check. usbip_pack_ret_submit() already copied the bogus np into urb->number_of_packets before we run, so just returning -EPROTO is not enough - processcompl() in the HCD will still iterate that many iso_frame_desc entries when it completes the failed URB. Zero out urb->number_of_packets before bailing to prevent that secondary crash (confirmed on 6.12.0, processcompl+0x63 with CR2 in unmapped slab). Signed-off-by: Kelvin Mbogo Link: https://patch.msgid.link/20260325103640.8090-1-addcontent08@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2420067cecacb1d1bf6dc39294d0c9f04066ff98 Author: Al Viro Date: Tue Jan 27 22:51:37 2026 -0500 struct dentry: make ->d_u anonymous Making ->d_rcu and (then) ->d_child overlapping dates back to 2006; anon unions support had been added to gcc only in 4.6 (2011) and the minimal gcc version hadn't been bumped to that until 4.19 (2018). These days there's no reason not to keep that union named. Signed-off-by: Al Viro commit 408d8af01f3a4d666620029a85e741906ff96f47 Author: Al Viro Date: Sat Jan 24 17:58:48 2026 -0500 for_each_alias(): helper macro for iterating through dentries of given inode Most of the places using d_alias are loops iterating through all aliases for given inode; introduce a helper macro (for_each_alias(dentry, inode)) and convert open-coded instances of such loop to it. They are easier to read that way and it reduces the noise on the next steps. You _must_ hold inode->i_lock over that thing. Signed-off-by: Al Viro commit 0436cd305d0be28cde59efb137d15d1bc6af4b12 Author: Kuan-Wei Chiu Date: Fri Mar 20 19:06:23 2026 +0000 MAINTAINERS: Add interconnect kunit test entry Add an entry for the interconnect Kunit tests. As the original author of this test suite, I would like to be notified of future related patches so I can help review them. Signed-off-by: Kuan-Wei Chiu Link: https://msgid.link/20260320190623.1846992-1-visitorckw@gmail.com Signed-off-by: Georgi Djakov commit 028f3d0168f83be903f34a8b52cd6254d9695a57 Author: Gui-Dong Han Date: Wed Mar 18 10:48:15 2026 +0800 interconnect: debugfs: fix devm_kstrdup and kfree mismatch debugfs_write_file_str() uses standard kfree() to release old strings. Initializing src_node and dst_node with devm_kstrdup() creates a memory management mismatch. If a user writes to these debugfs nodes, the devm-allocated memory is freed via kfree(), leaving a dangling pointer in the device resource list that can lead to a double free. Fix this by using standard kstrdup() instead. Since the interconnect subsystem is strictly built-in and cannot be unloaded as a module, there is no exit path requiring manual cleanup of these strings. The error handling path is also simplified by taking advantage of the fact that kfree(NULL) is a safe no-op. Fixes: 8cc27f5c6dd1 ("interconnect: debugfs: initialize src_node and dst_node to empty strings") Signed-off-by: Gui-Dong Han Reviewed-by: Kuan-Wei Chiu Link: https://msgid.link/20260318024815.7655-1-hanguidong02@gmail.com Signed-off-by: Georgi Djakov commit 40a13b49957937427bc23e78eb50679df4396a47 Author: Jason Gunthorpe Date: Fri Mar 27 12:22:10 2026 -0300 iommu/riscv: Remove overflows on the invalidation path Since RISC-V supports a sign extended page table it should support a gather->end of ULONG_MAX, but if this happens it will infinite loop because of the overflow. Also avoid overflow computing the length by moving the +1 to the other side of the < Fixes: 488ffbf18171 ("iommu/riscv: Paging domain support") Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit faad224fe0f0857a04ff2eb3c90f0de57f47d0f3 Author: Vasant Hegde Date: Wed Apr 1 08:00:17 2026 +0000 iommu/amd: Fix clone_alias() to use the original device's devid Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for_each_dma_alias() which based on topology decides to send original or alias device details in first argument. This meant that the source devid used to look up and copy the DTE may be incorrect, leading to wrong or stale DTE entries being propagated to alias device. Fix this by passing the original pdev as the opaque data argument to both the direct clone_alias() call and pci_for_each_dma_alias(). Inside clone_alias(), retrieve the original device from data and compute devid from it. Fixes: 3332364e4ebc ("iommu/amd: Support multiple PCI DMA aliases in device table") Signed-off-by: Vasant Hegde Signed-off-by: Joerg Roedel commit b334d7f7e230ff742993629a7a5181f33d9c54af Author: Jason Gunthorpe Date: Thu Apr 2 14:57:32 2026 +0800 iommu/vt-d: Remove the remaining pages along the invalidation path This was only being used to signal that a flush all should be used. Use mask/size_order >= 52 to signal this instead. Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/3-v1-f175e27af136+11647-iommupt_inv_vtd_jgg@nvidia.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit e36ee89679f4869c6deffd5392967820464dcbc6 Author: Jason Gunthorpe Date: Thu Apr 2 14:57:31 2026 +0800 iommu/vt-d: Pass size_order to qi_desc_piotlb() not npages It doesn't make sense for the caller to compute mask, throw it away and then have qi_desc_piotlb() compute it again. Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/2-v1-f175e27af136+11647-iommupt_inv_vtd_jgg@nvidia.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit b6fd468a052e43fa4e3a00837fbf44a05cc1ca11 Author: Jason Gunthorpe Date: Thu Apr 2 14:57:30 2026 +0800 iommu/vt-d: Split piotlb invalidation into range and all Currently these call chains are muddled up by using npages=-1, but only one caller has the possibility to do both options. Simplify qi_flush_piotlb() to qi_flush_piotlb_all() since all callers pass npages=-1. Split qi_batch_add_piotlb() into qi_batch_add_piotlb_all() and related helpers. Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/1-v1-f175e27af136+11647-iommupt_inv_vtd_jgg@nvidia.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 51234c4e57c8cee33dfcbdd07e65ab06c86eb326 Author: Bjorn Helgaas Date: Thu Apr 2 14:57:29 2026 +0800 iommu/vt-d: Remove dmar_writel() and dmar_writeq() dmar_writel() and dmar_writeq() do nothing other than expand to the generic writel() and writeq(), and the dmar_write*() wrappers are used inconsistently. Remove the dmar_write*() wrappers and use writel() and writeq() directly. Signed-off-by: Bjorn Helgaas Reviewed-by: Samiullah Khawaja Link: https://lore.kernel.org/r/20260217214438.3395039-3-bhelgaas@google.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 973009137138aa6372c2346d389601e26659645b Author: Bjorn Helgaas Date: Thu Apr 2 14:57:28 2026 +0800 iommu/vt-d: Remove dmar_readl() and dmar_readq() dmar_readl() and dmar_readq() do nothing other than expand to the generic readl() and readq(), and the dmar_read*() wrappers are used inconsistently. Remove the dmar_read*() wrappers and use readl() and readq() directly. Signed-off-by: Bjorn Helgaas Reviewed-by: Samiullah Khawaja Link: https://lore.kernel.org/r/20260217214438.3395039-2-bhelgaas@google.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit c9587216d991120c3cf546bcd708422b26334888 Author: Zhenzhong Duan Date: Thu Apr 2 14:57:27 2026 +0800 iommufd/selftest: Test dirty tracking on PASID Add test case for dirty tracking on a domain attached to PASID, also confirm attachment to PASID fail if device doesn't support dirty tracking. Suggested-by: Lu Baolu Signed-off-by: Zhenzhong Duan Reviewed-by: Yi Liu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260330101108.12594-5-zhenzhong.duan@intel.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit ae2fafc19e7bfcdd00920888468546f35286e715 Author: Zhenzhong Duan Date: Thu Apr 2 14:57:26 2026 +0800 iommu/vt-d: Support dirty tracking on PASID In order to support passthrough device with PASID capability in QEMU, e.g., DSA device, kernel needs to support attaching PASID to a domain. But attaching is not allowed if the domain is a second stage domain or nested domain with dirty tracking. The reason is kernel lacking support for dirty tracking on such domain attached to PASID. By adding dirty tracking on PASID, the check can be removed. Signed-off-by: Zhenzhong Duan Reviewed-by: Yi Liu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260330101108.12594-4-zhenzhong.duan@intel.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 922e2598a40f1851620144b3997aeefe066bd4de Author: Zhenzhong Duan Date: Thu Apr 2 14:57:25 2026 +0800 iommu/vt-d: Rename device_set_dirty_tracking() and pass dmar_domain pointer device_set_dirty_tracking() sets dirty tracking on all devices attached to a domain, also on all PASIDs attached to same domain in subsequent patch. So rename it as domain_set_dirty_tracking() and pass dmar_domain pointer to better align to what it does. No functional changes intended. Suggested-by: Lu Baolu Signed-off-by: Zhenzhong Duan Reviewed-by: Yi Liu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260330101108.12594-3-zhenzhong.duan@intel.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit cc5bd898ff70710ffc41cd8e5c2741cb64750047 Author: Zhenzhong Duan Date: Thu Apr 2 14:57:24 2026 +0800 iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Kernel lacks dirty tracking support on nested domain attached to PASID, fails the attachment early if nesting parent domain is dirty tracking configured, otherwise dirty pages would be lost. Cc: stable@vger.kernel.org Fixes: 67f6f56b5912 ("iommu/vt-d: Add set_dev_pasid callback for nested domain") Suggested-by: Kevin Tian Signed-off-by: Zhenzhong Duan Reviewed-by: Kevin Tian Reviewed-by: Yi Liu Link: https://lore.kernel.org/r/20260330101108.12594-2-zhenzhong.duan@intel.com Signed-off-by: Lu Baolu Fixes: 67f6f56b5912 ("iommu/vt-d: Add set_dev_pasid callback for nested domain") Signed-off-by: Joerg Roedel commit 7b7f2dd913829e06705035dfc41ca25fa6ec68d3 Author: Pawel Laszczak Date: Tue Mar 31 10:19:11 2026 +0200 usb: cdnsp: Add support for device-only configuration This patch introduces support for operating the Cadence USBSSP (cdnsp) controller in a peripheral-only mode, bypassing the Dual-Role Device (DRD) logic. The change in BAR indexing (from BAR 2 to BAR 1) is a direct consequence of switching from 64-bit to 32-bit addressing in the Peripheral-only configuration. Tested on PCI platform with Device-only configuration. Platform-side changes are included to support the PCI glue layer's property injection. Signed-off-by: Pawel Laszczak Acked-by: Bjorn Helgaas # pci_ids.h Link: https://patch.msgid.link/20260331-device_only-v1-1-00378b80365c@cadence.com Signed-off-by: Greg Kroah-Hartman commit 3c7df5079cfc6133d01ae144ae76a980276cc726 Author: Amit Sunil Dhamne Date: Wed Apr 1 21:02:08 2026 +0000 mfd: max77759: fix comment style for enums Fix comment style for enums so they're kernel-doc compliant. Signed-off-by: Amit Sunil Dhamne Link: https://patch.msgid.link/20260401-fix-mfd-max77759-usb-next-v1-1-174ec23ad824@google.com Signed-off-by: Greg Kroah-Hartman commit 80119a77e5b03747b8886505df1b3cb26f49168d Author: Lucid Duck Date: Wed Apr 1 22:22:16 2026 -0700 wifi: rtw89: usb: fix TX flow control by tracking in-flight URBs rtw89_usb_ops_check_and_reclaim_tx_resource() returns a hardcoded placeholder value (42) instead of actual TX resource availability. This violates mac80211's flow control contract, preventing backpressure and causing uncontrolled URB accumulation under sustained TX load. Fix by adding per-channel atomic counters (tx_inflight[]) that track in-flight URBs. Increment before usb_submit_urb() with rollback on failure, decrement in the completion callback, and return the remaining capacity to mac80211. The firmware command channel (CH12) always returns 1 since it has its own flow control. The pre-increment pattern prevents a race where USB core completes the URB on another CPU before the submitting code increments the counter. 128 URBs per channel provides headroom for RTL8832CU at 160 MHz bandwidth. Tested on RTL8852AU (USB3 80 MHz) where 64 and 128 showed equivalent throughput, and on RTL8832AU where 128 sustained full throughput under 8-stream parallel load. Tested on D-Link DWA-X1850 (RTL8832AU), kernel 6.19.8, Fedora 43: Unpatched -> Patched (128 URBs) USB3 5GHz UL: 844 -> 837 Mbps (no regression) USB3 5GHz retx: 3 -> 0 USB3 2.4GHz UL: 162 -> 164 Mbps (no regression) 4-stream UL: 858 -> 826 Mbps (within variance) 8-stream UL: 872 -> 826 Mbps (within variance) UDP flood: 0% loss (690K datagrams) 60-second soak: 855 Mbps, 0 retransmits Reported-by: morrownr Signed-off-by: Lucid Duck Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260402052216.207858-1-lucid_duck@justthetip.ca commit 78b30c50a7ac9b8fbec678d71f81dec80bf8eed6 Author: Jiri Pirko Date: Wed Mar 25 20:23:52 2026 +0100 dma-buf: heaps: system: add system_cc_shared heap for explicitly shared memory Add a new "system_cc_shared" dma-buf heap to allow userspace to allocate shared (decrypted) memory for confidential computing (CoCo) VMs. On CoCo VMs, guest memory is private by default. The hardware uses an encryption bit in page table entries (C-bit on AMD SEV, "shared" bit on Intel TDX) to control whether a given memory access is private or shared. The kernel's direct map is set up as private, so pages returned by alloc_pages() are private in the direct map by default. To make this memory usable for devices that do not support DMA to private memory (no TDISP support), it has to be explicitly shared. A couple of things are needed to properly handle shared memory for the dma-buf use case: - set_memory_decrypted() on the direct map after allocation: Besides clearing the encryption bit in the direct map PTEs, this also notifies the hypervisor about the page state change. On free, the inverse set_memory_encrypted() must be called before returning pages to the allocator. If re-encryption fails, pages are intentionally leaked to prevent shared memory from being reused as private. - pgprot_decrypted() for userspace and kernel virtual mappings: Any new mapping of the shared pages, be it to userspace via mmap or to kernel vmalloc space via vmap, creates PTEs independent of the direct map. These must also have the encryption bit cleared, otherwise accesses through them would see encrypted (garbage) data. - DMA_ATTR_CC_SHARED for DMA mapping: Since the pages are already shared, the DMA API needs to be informed via DMA_ATTR_CC_SHARED so it can map them correctly as unencrypted for device access. On non-CoCo VMs, the system_cc_shared heap is not registered to prevent misuse by userspace that does not understand the security implications of explicitly shared memory. Signed-off-by: Jiri Pirko Reviewed-by: T.J. Mercier Reviewed-by: Jason Gunthorpe Acked-by: Sumit Semwal Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260325192352.437608-3-jiri@resnulli.us commit f0548044a02630402d374df195ed3af4cc5e4711 Author: Jiri Pirko Date: Wed Mar 25 20:23:51 2026 +0100 dma-mapping: introduce DMA_ATTR_CC_SHARED for shared memory Current CC designs don't place a vIOMMU in front of untrusted devices. Instead, the DMA API forces all untrusted device DMA through swiotlb bounce buffers (is_swiotlb_force_bounce()) which copies data into shared memory on behalf of the device. When a caller has already arranged for the memory to be shared via set_memory_decrypted(), the DMA API needs to know so it can map directly using the unencrypted physical address rather than bounce buffering. Following the pattern of DMA_ATTR_MMIO, add DMA_ATTR_CC_SHARED for this purpose. Like the MMIO case, only the caller knows what kind of memory it has and must inform the DMA API for it to work correctly. Signed-off-by: Jiri Pirko Reviewed-by: Jason Gunthorpe Acked-by: Sumit Semwal Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260325192352.437608-2-jiri@resnulli.us commit 4e4fc2149b0a983670fd99bbd549012839bda79e Author: Zenm Chen Date: Mon Mar 30 17:34:39 2026 +0800 wifi: rtw89: Add support for Elecom WDC-XE2402TU3-B Add the ID 056e:4024 to the table to support an additional RTL8832CU adapter: Elecom WDC-XE2402TU3-B. Link: https://github.com/morrownr/rtw89/commit/55c059e2bd49acd5cf93edbc8eda7b9e042f4efd Signed-off-by: Zenm Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260330093440.3615-1-zenmchen@gmail.com commit a16ca7d91e4eb37a4faf0a2d2b44603489021725 Author: Ping-Ke Shih Date: Mon Mar 30 14:58:47 2026 +0800 wifi: rtw89: 8922d: add PCI ID of RTL8922DE and RTL8922DE-VS Add PCI ID tables with RTL8922DE whose ID is 10EC:895D, and with RTL8922DE-VS whose ID are 10EC:892D and 10EC:882D. Also, add pci_info struct to describe the hardware capabilities and registers accordingly. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260330065847.48946-10-pkshih@realtek.com commit 0737a803bae462e69ef030dc9d050a29c1d6d265 Author: Ping-Ke Shih Date: Mon Mar 30 14:58:46 2026 +0800 wifi: rtw89: 8922d: add chip_info and chip_ops struct Add remaining functions including calculate RX gain for power saving, channel frequency and RSSI from PPDU status, and WoWLAN declaration. Then fill chip_info and chip_ops tables, which RTL8922D has two variants RTL8922D and RTL8922DS supporting 4096 and 1024 QAM respectively. Other features, such as support of 2/5/6 GHz and up to 160 MHz bandwidth, for variants are the same, Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260330065847.48946-9-pkshih@realtek.com commit 553fd44ce8ce3caccf580aa8286d8c211fea2a4a Author: Ping-Ke Shih Date: Mon Mar 30 14:58:45 2026 +0800 wifi: rtw89: 8922d: add ops related to BT coexistence mechanism The ops is used by shared BT coexistence mechanism to set WiFi TX power, get BT RSSI, and TX/RX parameters. The RTL8922D uses TX/RX parameter v9, so define it and fill NULL for other chips. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260330065847.48946-8-pkshih@realtek.com commit 9c2f79b4d912dc96bbe5b4dadccd1099d430436d Author: Ping-Ke Shih Date: Mon Mar 30 14:58:44 2026 +0800 wifi: rtw89: 8922d: add RF ops of init hardware and get thermal One is to initialize hardware for RF circuit, and the ops of get thermal is used to monitor temperature to re-calibrate RF or reduce TX duty to prevent overheating. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260330065847.48946-7-pkshih@realtek.com commit cdd65e8bb9540b67d164cec760614ff74c560c49 Merge: 9bdbf7eb25b312 8b3e8fa6d7bdab Author: Dave Airlie Date: Thu Apr 2 13:00:58 2026 +1000 Merge tag 'amd-drm-next-7.1-2026-04-01' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-7.1-2026-04-01: amdgpu: - UserQ fixes - PASID handling fix - S4 fix for smu11 chips - devcoredump fixes - RAS fixes - Misc small fixes - DCN 4.2 updates - DVI fixes - DML fixes - DC pipe validation fixes - eDP DSC seamless boot - DC FP rework - swsmu cleanups - GC 11.5.4 updates - Add DC idle state manager - Add support for using multiple engines for buffer fills and clears - Misc SMU7 fixes amdkfd: - Non-4K page fixes - Logging cleanups - sysfs fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260401184456.3576660-1-alexander.deucher@amd.com commit 2b19199952e6f2d6fbddd20c81d48180e98a3c3e Author: Ping-Ke Shih Date: Mon Mar 30 14:58:43 2026 +0800 wifi: rtw89: 8922d: configure TX/RX path assisting in BT coexistence The BT coexistence mechanism needs to control TX/RX path to co-work with BT well, and these helpers are provided by BB to configure path. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260330065847.48946-6-pkshih@realtek.com commit baa6ea4e5e034c59fd8899d200ead348e148ea06 Author: Ping-Ke Shih Date: Mon Mar 30 14:58:42 2026 +0800 wifi: rtw89: 8922d: add set TX power callback Set TX power depends on operating channel. The Tx power factors are data rate, channel, bandwidth and etc. Also, consider SAR as a factor of TX power limit. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260330065847.48946-5-pkshih@realtek.com commit cee10a01e286e88e0949979e91231270ca9fdb8e Author: Conor Dooley Date: Tue Mar 31 14:10:21 2026 +0100 net: macb: fix use of at91_default_usrio without CONFIG_OF If CONFIG_OF is not enabled, at91_default_usrio is used undeclared in gem_default_config. Move at91_default_usrio back above the CONFIG_OF section where macb_default_usrio used to be, so that it is unconditionally defined and defined prior to any of the users. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603280028.wQjUrIvv-lkp@intel.com/ Reported-by: Jiawen Wu Closes: https://lore.kernel.org/all/06a701dcc014$86def5b0$949ce110$@trustnetic.com/ Fixes: a17871778ee28 ("net: macb: rename macb_default_usrio to at91_default_usrio as not all platforms have mii mode control in usrio") Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260331-enroll-sensation-50901318a419@spud Signed-off-by: Jakub Kicinski commit 2ef4363f1388258f8073cd38d2ba059963f25fcf Author: Ping-Ke Shih Date: Mon Mar 30 14:58:41 2026 +0800 wifi: rtw89: 8922d: add RF calibration ops The chips ops related to RF calibration include init, init_late, channel, band_change, scan, and track. The init_late is similar to init, but HCI is ready, so receiving C2H event is possible. The ops channel is the main function that do all RF calibration on operating channel. The ops band_change and scan are to reset RF calibration because channel is switching at these moment, we need to reset RF state. The ops track is to monitor temperature to check if re-calibrate RF again. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260330065847.48946-4-pkshih@realtek.com commit edf9f583c05cebe8933903dc3e96ffa2acc62c5b Author: Ping-Ke Shih Date: Mon Mar 30 14:58:40 2026 +0800 wifi: rtw89: 8922d: add set channel with pre-/post- helpers The main set channel function calls MAC/BB/RF ones, and pre-/post- helpers are called before/after the main function to backup/restore and stop/restart circuits, including TX scheduler, PPDU status, DACK and TSSI. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260330065847.48946-3-pkshih@realtek.com commit 347fbc602795f9595a226585968bc23f0073cf77 Author: Ping-Ke Shih Date: Mon Mar 30 14:58:39 2026 +0800 wifi: rtw89: 8922d: BB hardware pre-/post-init, TX/RX path and power settings More settings related to BB pre-/post-initial settings, the TX/RX path settings, and digital power compensation. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260330065847.48946-2-pkshih@realtek.com commit a77fb1ace44ed11874b9bf064208cad5fc0d94a5 Author: Marco Crivellari Date: Mon Mar 30 11:54:05 2026 +0200 Octeontx2-af: add WQ_PERCPU to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20260330095405.116990-1-marco.crivellari@suse.com Signed-off-by: Jakub Kicinski commit 127ea8d0b0687509e3067b1e90a38067d2298f49 Author: Christos Longros Date: Sun Mar 29 09:45:50 2026 +0200 wifi: rtw89: fix typo "frome" -> "from" in rx_freq_frome_ie The chip_info field rx_freq_frome_ie (RX frequency from Information Element) has a typo. The function that uses it is already spelled correctly: rtw89_core_update_rx_freq_from_ie. Rename the field to match. Signed-off-by: Christos Longros Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260329074550.114787-1-chris.longros@gmail.com commit 48c6255cda812b04a23d92bdc82eb523d9abd712 Author: Julian Braha Date: Sun Mar 29 19:53:48 2026 +0100 net: microchip: dead code cleanup in kconfig for FDMA The Kconfig in the parent directory already has the first 'if NET_VENDOR_MICROCHIP' gating the inclusion of this Kconfig, meaning that the second 'if NET_VENDOR_MICROCHIP' condition is effectively dead code. I propose removing the second 'if NET_VENDOR_MICROCHIP' in drivers/net/ethernet/microchip/fdma/Kconfig This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha Link: https://patch.msgid.link/20260329185348.526893-1-julianbraha@gmail.com Signed-off-by: Jakub Kicinski commit c2ca7b9d27f8806772687b547ae08a1127fbe3f9 Author: Bitterblue Smith Date: Thu Mar 26 17:22:33 2026 +0200 wifi: rtw89: Fill fw_version member of struct wiphy Let userspace tools like lshw show the firmware version by filling the fw_version member of struct wiphy. Before: configuration: broadcast=yes driver=rtw89_8852au driverversion=6.19.6-arch1-1 firmware=N/A link=no multicast=yes wireless=IEEE 802.11 After: configuration: broadcast=yes driver=rtw89_8852au driverversion=6.19.6-arch1-1 firmware=0.13.36.2 link=no multicast=yes wireless=IEEE 802.11 Signed-off-by: Bitterblue Smith Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/a46ed12c-387c-4063-849c-c6457bf97810@gmail.com commit 249716daa9955f9fb8a9a80ed99b3b9071a838de Author: Bitterblue Smith Date: Thu Mar 26 17:21:19 2026 +0200 wifi: rtw88: Fill fw_version member of struct wiphy Let userspace tools like lshw show the firmware version by filling the fw_version member of struct wiphy. Before: configuration: broadcast=yes driver=rtw88_8814au driverversion=6.19.6-arch1-1 firmware=N/A link=no multicast=yes wireless=IEEE 802.11 After: configuration: broadcast=yes driver=rtw88_8814au driverversion=6.19.6-arch1-1 firmware=33.6.0 link=no multicast=yes wireless=IEEE 802.11 Signed-off-by: Bitterblue Smith Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/3701cce1-42c4-4382-9120-cd21012c1b21@gmail.com commit 6152f40d4f9337b3f2090d0cffeb13831c3cefc6 Merge: 6c3dec3e3d205c 50b4927288144f Author: Jakub Kicinski Date: Wed Apr 1 19:15:39 2026 -0700 Merge tag 'linux-can-next-for-7.1-20260401' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2026-04-01 The first patch is by Ethan Nelson-Moore and removes a useless copy of PCI_DEVICE_DATA from the ctucanfd driver. Geert Uytterhoeven's patch for the rcar_can converts the driver to use the FIELD_MODIFY macro. Viken Dadhaniya contributes 2 patches for the mcp251xfd driver that add transceiver standby control. The last 2 aptches are by Johan Hovold and refactor the usb endpoint lookup of the kvaser_usb and ucan driver. * tag 'linux-can-next-for-7.1-20260401' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: can: ucan: refactor endpoint lookup can: rcar_can: Convert to FIELD_MODIFY() can: mcp251xfd: add support for XSTBYEN transceiver standby control can: kvaser_usb: leaf: refactor endpoint lookup net: can: ctucanfd: remove useless copy of PCI_DEVICE_DATA macro dt-bindings: can: mcp251xfd: add microchip,xstbyen property ==================== Link: https://patch.msgid.link/20260401073338.5592-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 6c3dec3e3d205c0560fc25e36488ddfb5fbad6a5 Merge: 2897c697b3266c 64c535db769e9a Author: Jakub Kicinski Date: Wed Apr 1 19:02:43 2026 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Martin KaFai Lau says: ==================== pull-request: bpf-next 2026-04-01 We've added 2 non-merge commits during the last 2 day(s) which contain a total of 3 files changed, 139 insertions(+), 23 deletions(-). The main changes are: 1) skb_dst_drop(skb) when bpf prog does a encap or decap, from Jakub Kicinski * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: selftests/bpf: Test that dst is cleared on same-protocol encap net: Clear the dst when performing encap / decap ==================== Link: https://patch.msgid.link/20260401233956.4133413-1-martin.lau@linux.dev Signed-off-by: Jakub Kicinski commit 2897c697b3266cae753e2349098cd98f36891c19 Author: Li RongQing Date: Tue Mar 31 08:26:04 2026 -0400 net/mlx5: Move command entry freeing outside of spinlock Move the kfree() call outside the critical section to reduce lock holding time. This aligns with the general principle of minimizing work under locks. Signed-off-by: Li RongQing Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260331122604.1933-1-lirongqing@baidu.com Signed-off-by: Jakub Kicinski commit 4cbcf82e26b6324a56c6d9c5bc49d59b6076b54d Author: Julian Braha Date: Mon Mar 30 22:32:58 2026 +0100 ppp: dead code cleanup in Kconfig There is already an 'if PPP' condition wrapping several config options e.g. PPP_MPPE and PPPOE, making the 'depends on PPP' statement for each of these a duplicate dependency (dead code). I propose leaving the outer 'if PPP...endif' and removing the individual 'depends on PPP' statement from each option. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha Reviewed-by: Qingfang Deng Link: https://patch.msgid.link/20260330213258.13982-1-julianbraha@gmail.com Signed-off-by: Jakub Kicinski commit 63081dec9e370ac0a1f53565ffa693274630380e Author: Eric Dumazet Date: Tue Mar 31 17:47:22 2026 +0000 ipv6: move ip6_dst_hoplimit() to net/ipv6/ip6_output.c Move ip6_dst_hoplimit() to net/ipv6/ip6_output.c so that compiler can (auto)inline it from ip6_xmit(). $ scripts/bloat-o-meter -t vmlinux.0 vmlinux.1 add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-11 (-11) Function old new delta ip6_xmit 1684 1673 -11 Total: Before=29655407, After=29655396, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Fernando Fernandez Mancera Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260331174722.4128061-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d57e74f10461b80c77d1678f646720f616fb8553 Author: Yury Norov Date: Sun Mar 1 20:11:55 2026 -0500 bitmap: introduce bitmap_weighted_xor() The function helps to XOR bitmaps and calculate Hamming weight of the result in one pass. Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Signed-off-by: Yury Norov commit dd0422eb1566a823587ede7780aef9c9c7a45b04 Author: Abdurrahman Hussain Date: Mon Feb 23 15:59:22 2026 +0000 i2c: xiic: skip input clock setup on non-OF systems Currently Linux does not implement ACPI ClockInput() resource to describe clocks, unlike DT. However the xiic driver is happy if something magically enables the clock before the driver probes, and does not turn it off again. The clock should always be considered optional for ACPI. Signed-off-by: Abdurrahman Hussain Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260223-i2c-xiic-v12-7-b6c9ce4e4f3c@nexthop.ai commit 91430a8ea9cebbe47c1723871492d5c135faf999 Author: Abdurrahman Hussain Date: Mon Feb 23 15:59:21 2026 +0000 i2c: xiic: use numbered adapter registration Switch from i2c_add_adapter() to i2c_add_numbered_adapter() to enable platforms to specify fixed I2C bus numbers via the platform device ID. This allows systems to maintain consistent bus numbering across reboots. On platforms where the device ID is PLATFORM_DEVID_NONE (the default), the adapter falls back to dynamic allocation, preserving backward compatibility. Signed-off-by: Abdurrahman Hussain Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260223-i2c-xiic-v12-6-b6c9ce4e4f3c@nexthop.ai commit f715b059d442d524d45f8ec91ebe63c4c0d0ad00 Author: Abdurrahman Hussain Date: Mon Feb 23 15:59:20 2026 +0000 i2c: xiic: cosmetic: use resource format specifier in debug log Use standard resource format specifier %pR in debug log. Signed-off-by: Abdurrahman Hussain Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260223-i2c-xiic-v12-5-b6c9ce4e4f3c@nexthop.ai commit b698377976bc4de60360bbde104e50c503c3a330 Author: Abdurrahman Hussain Date: Mon Feb 23 15:59:19 2026 +0000 i2c: xiic: cosmetic cleanup Re-use dev pointer instead of referencing &pdev->dev everywhere. Signed-off-by: Abdurrahman Hussain Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260223-i2c-xiic-v12-4-b6c9ce4e4f3c@nexthop.ai commit b621a966fbe6b937792a5ec43dc2c5dd68898c60 Author: Abdurrahman Hussain Date: Mon Feb 23 15:59:18 2026 +0000 i2c: xiic: switch to generic device property accessors Use generic device property accessors making them work for ACPI platforms. Signed-off-by: Abdurrahman Hussain Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260223-i2c-xiic-v12-3-b6c9ce4e4f3c@nexthop.ai commit e1d98e42b4b701b193f7c2142901f553734acc6a Author: Abdurrahman Hussain Date: Mon Feb 23 15:59:17 2026 +0000 i2c: xiic: remove duplicate error message The devm_request_threaded_irq() already prints an error message. Remove the duplicate. Signed-off-by: Abdurrahman Hussain Reviewed-by: Andy Shevchenko Reviewed-by: Andrew Lunn Reviewed-by: Jonathan Cameron Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260223-i2c-xiic-v12-2-b6c9ce4e4f3c@nexthop.ai commit 50c63491ff267f2860a6d8cb70c9a30ab701b9d3 Author: Abdurrahman Hussain Date: Mon Feb 23 15:59:16 2026 +0000 i2c: xiic: switch to devres managed APIs Simplify the error code paths by switching to devres managed helper functions. Signed-off-by: Abdurrahman Hussain Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260223-i2c-xiic-v12-1-b6c9ce4e4f3c@nexthop.ai commit d2bf45d067c728b0fe6e8f99a7386b8291e391e3 Author: Aaron Tomlin Date: Tue Mar 24 20:11:59 2026 -0400 fs/resctrl: Add "*" shorthand to set io_alloc CBM for all domains Configuring the io_alloc_cbm interface requires an explicit domain ID for each cache domain. On systems with high core counts and numerous cache clusters, this requirement becomes cumbersome for automation and management tasks that aim to apply a uniform policy. Introduce a wildcard domain ID selector "*" for the io_alloc_cbm interface. This enables users to set the same Capacity Bitmask (CBM) across all cache domains in a single operation. Signed-off-by: Aaron Tomlin Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Reviewed-by: Babu Moger Tested-by: Babu Moger Link: https://patch.msgid.link/20260325001159.447075-3-atomlin@atomlin.com commit d06b8e7c97c3290e61006e30b32beb9e715fab82 Author: Aaron Tomlin Date: Tue Mar 24 20:11:58 2026 -0400 fs/resctrl: Report invalid domain ID when parsing io_alloc_cbm The last_cmd_status file is intended to report details about the most recent resctrl filesystem operation, specifically to aid in diagnosing failures. However, when parsing io_alloc_cbm, if a user provides a domain ID that does not exist in the resource, the operation fails with -EINVAL without updating last_cmd_status. This results in inconsistent behaviour where the system call returns an error, but last_cmd_status misleadingly reports "ok", leaving the user unaware that the failure was caused by an invalid domain ID. Write an error message to last_cmd_status when the target domain ID cannot be found. Fixes: 28fa2cce7a83 ("fs/resctrl: Introduce interface to modify io_alloc capacity bitmasks") Suggested-by: Reinette Chatre Signed-off-by: Aaron Tomlin Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Reviewed-by: Babu Moger Tested-by: Babu Moger Link: https://patch.msgid.link/20260325001159.447075-2-atomlin@atomlin.com commit 40890b5fe72b1a0d4913883844854f6641a2f4b3 Author: Rustam Adilov Date: Wed Apr 1 23:06:48 2026 +0500 i2c: rtl9300: add RTL9607C i2c controller support Add support for the internal I2C controllers of RTL9607C series based SoCs. Add register definitions, chip-specific functions and macros too. Make use of the clk introduced from the previous patch to get the clk_div value and use it during the rtl9607c channel configuration. Introduce a new EXT_SCK_5MS field to the reg fields struct which is going to be initialized by rtl9607c init function at the end of the probe. This patch depends on all the previous patches in this patch series. Signed-off-by: Rustam Adilov Reviewed-by: Chris Packham Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260401180648.337834-9-adilov@disroot.org commit 991cd899ecd03a1c3ef7d177a0b99e824c6be581 Author: Rustam Adilov Date: Wed Apr 1 23:06:47 2026 +0500 i2c: rtl9300: introduce new function properties to driver data Due to the very nature of differences between RTL9607C i2c controller and RTL9300 / RTL9310 that are incompatible with each other in some areas of this driver, for example in clock configuration, channel configuration and initialization at the end of the probe, introduce new function properties to the driver data struct to handle those differences. With these new properties, create configuration functions for RTL9300 and RTL9310 and assign them to their respective driver data structs. Signed-off-by: Rustam Adilov Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260401180648.337834-8-adilov@disroot.org commit f60d27926c9e2d547200fb0d26f61eec9b8291a6 Author: Rustam Adilov Date: Wed Apr 1 23:06:46 2026 +0500 i2c: rtl9300: introduce clk struct for upcoming rtl9607 support In RTL9607C i2c controller, there is 10 bit CLK_DIV field for setting the clock of i2c interface which depends on the rate of i2c clk (which seems be fixed to 62.5MHz according to Realtek SDK). Introduce the clk struct and the respective F_CLK_DIV and clk_div which are going to be used in the upcoming patch for rtl9607c i2c controller support addition. devm_clk_get_optional_enabled() function was used for cleaner code as it automatically returns NULL if the clk is not present, which is going to be the case for RTL9300 and RTL9310 i2c controllers. Signed-off-by: Rustam Adilov Reviewed-by: Chris Packham Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260401180648.337834-7-adilov@disroot.org commit 1211ce1e11d23ec05d80a85b7187baa6abed3232 Author: Rustam Adilov Date: Wed Apr 1 23:06:45 2026 +0500 dt-bindings: i2c: realtek,rtl9301-i2c: extend for clocks and RTL9607C support Add the "realtek,rtl9607-i2c" compatible for i2c controller on the RTL9607C SoC series. Add a clocks property to the properties to describe the i2c reference clock and make it available for all the compatibles. This i2c reference clock is assumed to be coming from switchcore region via Lexra bus as the other SoC peripherals. According to the info available about the existing devices, they also have the i2c master controller clocks. RTL9607C requires the "realtek,scl" and "clocks" to be specified and so handle it under separate if check for "realtek,rtl9607-i2c". Signed-off-by: Rustam Adilov Acked-by: Conor Dooley Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260401180648.337834-6-adilov@disroot.org commit 6afde011baaf722aa66c11696b6383f9ce85b653 Author: Rustam Adilov Date: Wed Apr 1 23:06:44 2026 +0500 i2c: rtl9300: introduce a property for 8 bit width reg address In RTL9607C i2c controller, in order to indicate that the width of memory address is 8 bits, 0 is written to MEM_ADDR_WIDTH field as opposed to 1 for RTL9300 and RTL9310. Introduce a new property to a driver data to indicate what value need to written to MEM_ADDR_WIDTH field for this case. Signed-off-by: Rustam Adilov Reviewed-by: Chris Packham Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260401180648.337834-5-adilov@disroot.org commit 55284a806b63a412846b9ecd3846f2639eaeaff4 Author: Rustam Adilov Date: Wed Apr 1 23:06:43 2026 +0500 i2c: rtl9300: introduce F_BUSY to the reg_fields struct In RTL9607C i2c controller the busy check operation is done on the separate bit of the command register as opposed to self clearing command trigger bit on the rtl9300 and rtl9310 i2c controllers. Introduce a new F_BUSY field to the reg_fields struct for that and change the regmap read poll function to use F_BUSY instead of I2C_TRIG. Signed-off-by: Rustam Adilov Reviewed-by: Chris Packham Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260401180648.337834-4-adilov@disroot.org commit 98773df61f8416594ac993e8464df596755ee1b8 Author: Rustam Adilov Date: Wed Apr 1 23:06:42 2026 +0500 i2c: rtl9300: introduce max length property to driver data In RTL9607C i2c controller, theoretical maximum the data length can be is 4 bytes as opposed to 16 bytes on rtl9300 and rtl9310. Introduce a new property to the driver data struct for that. Adjust if statement in prepare_xfer function to follow that new property instead of the hardcoded value. Signed-off-by: Rustam Adilov Reviewed-by: Chris Packham Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260401180648.337834-3-adilov@disroot.org commit 4c53b2eb4f18102c36d4bcaf8c604a1825701ffb Author: Rustam Adilov Date: Wed Apr 1 23:06:41 2026 +0500 i2c: rtl9300: split data_reg into read and write reg In RTL9607C i2c controller, there are 2 separate registers for reads and writes as opposed the combined 1 on rtl9300 and rtl9310. In preparation for RTL9607C support, split it up into rd_reg and wd_reg properties and change the i2c read and write functions accordingly. Signed-off-by: Rustam Adilov Reviewed-by: Chris Packham Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260401180648.337834-2-adilov@disroot.org commit 9ac420358dd8e0ff4c2d8f34818b3f9183b1c34a Merge: 23e4b0532da611 d784bbad7fcbfa Author: Arnd Bergmann Date: Thu Apr 2 00:00:31 2026 +0200 Merge tag 'renesas-arm-soc-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/arm Renesas ARM SoC updates for v7.1 - Use the of_phandle_args_equal() helper. * tag 'renesas-arm-soc-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: ARM: shmobile: rcar-gen2: Use of_phandle_args_equal() helper Signed-off-by: Arnd Bergmann commit 23e4b0532da611a33f37bc38fb294ef535dbb755 Merge: 6de23f81a5e08b 32d4b991f25eef Author: Arnd Bergmann Date: Wed Apr 1 23:59:32 2026 +0200 Merge tag 'samsung-soc-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/arm Samsung mach/soc changes for v7.1 Fix booting of secondary CPU on Exynos5250 based Google Manta board - difference in TZ firmware. * tag 'samsung-soc-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: samsung: exynos5250: Allow CPU1 to boot Signed-off-by: Arnd Bergmann commit 84a5fe2ee01f1c99f98227b76dbbc0017fc746bd Merge: 78b06e0a76cb8a 1b7c834dedf993 Author: Arnd Bergmann Date: Wed Apr 1 23:56:24 2026 +0200 Merge tag 'imx-soc-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/drivers i.MX SoC update for 7.1: - Updates MAINTAINERS file to include i.MX team coverage for ARM NXP platforms - Sets default values for OPACR (Off-Platform Peripheral Access Control Register) in the i.MX AIPSTZ bus driver * tag 'imx-soc-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: MAINTAINERS: Add i.MX team to all arm NXP platforms bus: imx-aipstz: set default value for opacr registers Signed-off-by: Arnd Bergmann commit 879766b58ea5cba79ff5fe46f062ed8e05e715aa Author: Jan Kantert Date: Fri Feb 27 12:11:34 2026 +0100 i2c: rtl9300: add support for 50 kHz and 2.5 MHz bus speeds Some SFP modules on certain switches (for example the ONTi ONT-S508CL-8S and XikeStor SKS8300-8X) exhibit unreliable I2C communication at the currently supported speeds. Add support for 50 kHz and 2.5 MHz I2C bus modes on the RTL9300 to improve compatibility with these devices. Signed-off-by: Jan Kantert Reviewed-by: Chris Packham Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260227111134.2163701-1-jan-kernel@kantert.net commit 78b06e0a76cb8a5db7bc511356977a50a837827c Merge: 95ff410d15e6fd abf3502033cfc2 Author: Arnd Bergmann Date: Wed Apr 1 23:52:57 2026 +0200 Merge tag 'renesas-drivers-for-v7.1-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v7.1 (take two) - Mark remaining rz_sysc_init_data structures __initconst. * tag 'renesas-drivers-for-v7.1-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: r9a09g056-sys: Mark rzv2n_sys_init_data as __initconst soc: renesas: r9a09g047-sys: Mark rzg3e_sys_init_data as __initconst soc: renesas: r9a09g057-sys: Mark rzv2h_sys_init_data as __initconst Signed-off-by: Arnd Bergmann commit 95ff410d15e6fdbda62999c3d4872e1d9e99b70c Merge: d752790a4bc971 8c6e843f1c26a0 Author: Arnd Bergmann Date: Wed Apr 1 23:52:18 2026 +0200 Merge tag 'optee-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers OP-TEE update for 7.1 Simplify TEE implementor ID match logic * tag 'optee-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: optee: simplify OP-TEE context match Signed-off-by: Arnd Bergmann commit ad6ed97f8c0ffefd9383a62d19a564e8e0a2c814 Author: Julian Ruess Date: Wed Mar 25 14:31:25 2026 +0100 MAINTAINERS: add VFIO ISM PCI DRIVER section ism_vfio_pci is a new kernel component that allows to use the ISM device from userspace. Add myself as a maintainer. Reviewed-by: Niklas Schnelle Signed-off-by: Julian Ruess Link: https://lore.kernel.org/r/20260325-vfio_pci_ism-v8-3-ddc504cde914@linux.ibm.com Signed-off-by: Alex Williamson commit d752790a4bc971aa21b45026cb788702643eb061 Merge: 033d5c6cea0b35 e416e7fa417b2d Author: Arnd Bergmann Date: Wed Apr 1 23:51:34 2026 +0200 Merge tag 'tee-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers TEE update for 7.1 Clean up tee_core.h kernel-doc to eliminate build warnings * tag 'tee-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: clean up tee_core.h kernel-doc Signed-off-by: Arnd Bergmann commit bf4197be96d0839963d28e1812d9edc71086a580 Author: Julian Ruess Date: Wed Mar 25 14:31:24 2026 +0100 vfio/ism: Implement vfio_pci driver for ISM devices Add a vfio_pci variant driver for the s390-specific Internal Shared Memory (ISM) devices used for inter-VM communication. This enables the development of vfio-pci-based user space drivers for ISM devices. On s390, kernel primitives such as ioread() and iowrite() are switched over from function-handle-based PCI load/stores instructions to PCI memory-I/O (MIO) loads/stores when these are available and not explicitly disabled. Since these instructions cannot be used with ISM devices, ensure that classic function-handle-based PCI instructions are used instead. The driver is still required even when MIO instructions are disabled, as the ISM device relies on the PCI store block (PCISTB) instruction to perform write operations. Stores are not fragmented, therefore one ioctl corresponds to exactly one PCISTB instruction. User space must ensure to not write more than 4096 bytes at once to an ISM BAR which is the maximum payload of the PCISTB instruction. Reviewed-by: Alexandra Winter Reviewed-by: Niklas Schnelle Signed-off-by: Julian Ruess Reviewed-by: Farhan Ali Link: https://lore.kernel.org/r/20260325-vfio_pci_ism-v8-2-ddc504cde914@linux.ibm.com Signed-off-by: Alex Williamson commit 033d5c6cea0b3528ca7710e9dc19e0291ba9a8b4 Merge: dc26ea325f9c8d a8f5c98517c7c8 Author: Arnd Bergmann Date: Wed Apr 1 23:50:55 2026 +0200 Merge tag 'hisi-drivers-for-7.1' of https://github.com/hisilicon/linux-hisi into soc/drivers HiSilicon driver updates for v7.1 - Fix two compiler warnings on kunpeng_hccs driver * tag 'hisi-drivers-for-7.1' of https://github.com/hisilicon/linux-hisi: soc: hisilicon: kunpeng_hccs: Remove unused input parameter soc: hisilicon: kunpeng_hccs: Fix discard ‘const’ qualifier compiling warning Signed-off-by: Arnd Bergmann commit d9db9c8db56c3e378aa5c91637664f77ca5a6f72 Author: Namhyung Kim Date: Wed Mar 18 23:45:13 2026 -0700 perf test: Fix perf stat --bpf-counters on hybrid machines The test constantly fails on my Intel hybrid machine. The issue was it has two events in the output even if I only gave it one event. $ perf stat -e instructions -- perf test -w sqrtloop Performance counter stats for 'perf test -w sqrtloop': 910,856,421 cpu_atom/instructions/ (28.05%) 14,852,865,997 cpu_core/instructions/ (96.79%) 1.014313341 seconds time elapsed 1.004114000 seconds user 0.008174000 seconds sys Let's modify the awk script to add the values for each line and print the total. The variable 'i' has a number of input lines that have valid output and variable 'c' has the sum of actual counter values. That way it should work on any platforms. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 9b6c479c5f418e6174f528f0b25d944f74172c61 Author: Ian Rogers Date: Tue Mar 31 11:05:20 2026 -0700 perf tests: Write test files to tmpdir Writing to the test output files in the current working directory can fail in various contexts such as continual test. Other tests write to a mktemp-ed file, make the "perf script task-analyszer tests" follow this convention too. Currently this isn't possible for the perf.data file due to a lack of perf script support, add a variable for when this support is available. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 83c338369a88eeab8cc64446c7ba9bb8ffb37e4a Author: Ian Rogers Date: Tue Mar 31 11:29:48 2026 -0700 libperf cpumap: Make index and nr types unsigned The index into the cpumap array and the number of entries within the array can never be negative, so let's make them unsigned. This is prompted by reports that gcc 13 with -O6 is giving a alloc-size-larger-than errors. The change makes the cpumap changes and then updates the declaration of index variables throughout perf and libperf to be unsigned. The two things are hard to separate as compiler warnings about mixing signed and unsigned types breaks the build. Reported-by: Chingbin Li Closes: https://lore.kernel.org/lkml/20260212025127.841090-1-liqb365@163.com/ Tested-by: Chingbin Li Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit dc26ea325f9c8d264bffd7d7600a31d01065302d Merge: 720d813b5371d4 348741a97c28d7 Author: Arnd Bergmann Date: Wed Apr 1 23:49:16 2026 +0200 Merge tag 'stm32-bus-firewall-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/drivers STM32 Firewall bus for v7.1, round 1 Highlights: ---------- Stm32 SoCs embed debug peripherals such as Coresight. These peripherals can monitor the activity of the cores. Because of that, they can be used only if some features in the debug configuration are enabled. Else, errors or firewall exceptions can be observed. Similarly to the ETZPC(on stm32mp1x platforms) or the RIFSC(on stm32mp2x platforms), debug-related peripherals access can be assessed at bus level to prevent these issues from happening. The debug configuration can only be accessed by the secure world. That means that a service must be implemented in the secure world for the kernel to check the firewall configuration. On OpenSTLinux, it is done through a Debug access PTA in OP-TEE [1]. To represent the debug peripherals present on a dedicated debug bus, create a debug bus node in the device tree and the associated driver that will interact with this PTA. Plus some fixes. * tag 'stm32-bus-firewall-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: pinctrl: stm32: add firewall checks before probing the HDP driver drivers: bus: add the stm32 debug bus driver bus: stm32_firewall: add stm32_firewall_get_grant_all_access() API bus: stm32_firewall: allow check on different firewall controllers dt-bindings: bus: document the stm32 debug bus dt-bindings: pinctrl: document access-controllers property for stm32 HDP dt-bindings: document access-controllers property for coresight peripherals bus: rifsc: fix RIF configuration check for peripherals bus: rifsc: Replace snprintf("%s") with strscpy bus: stm32_firewall: Simplify with scoped for each OF child loop bus: firewall: move stm32_firewall header file in include folder Signed-off-by: Arnd Bergmann commit 720d813b5371d4a63555d333cc88aa1ab2ba35ce Merge: a0ac82cbed1007 0a7ec808abecaf Author: Arnd Bergmann Date: Wed Apr 1 23:48:30 2026 +0200 Merge tag 'scmi-updates-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers Arm SCMI updates for v7.1 This batch mainly improves SCMI robustness on systems where the SCP does not generate completion interrupts, and includes two small follow-up cleanups in the SCMI core. The main functional change adds support for the new DT property 'arm,no-completion-irq'. When present for mailbox/shared-memory based SCMI implementations, the driver forces SCMI operations into polling mode so affected platforms can continue to operate even with broken firmware interrupt behavior. In addition, it - replaces open-coded size rounding in the base protocol path with round_up() for clarity, with no functional change - updates the SCMI quirk snippet macro implementation so quirk handlers can use break and continue directly when invoked inside loop contexts * tag 'scmi-updates-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Support loop control in quirk code snippets firmware: arm_scmi: Use round_up() for base protocol list size calculation firmware: arm_scmi: Implement arm,no-completion-irq property dt-bindings: firmware: arm,scmi: Document arm,no-completion-irq property Signed-off-by: Arnd Bergmann commit a0ac82cbed1007afd89e30940fe2335b61666783 Author: Haoxiang Li Date: Wed Mar 25 14:22:04 2026 +0800 clk: spear: fix resource leak in clk_register_vco_pll() Add a goto label in clk_register_vco_pll(), unregister vco_clk if tpll_clk is failed to be registered. Signed-off-by: Haoxiang Li Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20260325062204.169648-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Arnd Bergmann commit c7091fd5ebda16a67a121f64cf37014332de965d Merge: fb5fee1cbc2902 82169065ffb075 Author: Arnd Bergmann Date: Wed Apr 1 23:44:55 2026 +0200 Merge tag 'memory-controller-drv-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers Memory controller drivers for v7.1 1. TegraMC: - Few fixes for older issues - missing clock on Tegra264, missing enabling of DLL for Tegra30 and Tegra124. - Simplify the code in a few places. - Rework handling interrupts on different variants and add support for error logging on Tegra 264. 2. Drop Baikal SoC bt1-l2-ctl driver, because SoC support is being removed tree-wide. * tag 'memory-controller-drv-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: tegra: Add MC error logging support for Tegra264 memory: tegra: Prepare for supporting multiple intmask registers memory: tegra: Group SoC specific fields memory: tegra: Add support for multiple IRQs memory: tegra: Group register and fields memory: tegra: Group error handling related registers memory: tegra-mc: Use %pe format memory: tegra-mc: Simplify printing PTR_ERR with dev_err_probe memory: tegra-mc: Drop tegra_mc_setup_latency_allowance() return value memory: renesas-rpc-if: Simplify printing PTR_ERR with dev_err_probe memory: brcmstb_memc: Expand LPDDR4 check to cover for LPDDR5 dt-bindings: cache: bt1-l2-ctl: Remove unused bindings memory: bt1-l2-ctl: Remove not-going-to-be-supported code for Baikal SoC memory: tegra30-emc: Fix dll_change check memory: tegra124-emc: Fix dll_change check memory: tegra: Add support for DBB clock on Tegra264 Signed-off-by: Arnd Bergmann commit fb5fee1cbc2902981e33a6082de55007531e5b45 Merge: c9da2648790306 a2be37eedb52ea Author: Arnd Bergmann Date: Wed Apr 1 23:43:58 2026 +0200 Merge tag 'samsung-drivers-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers Samsung SoC drivers for v7.1 Few cleanups in ACPM firmware drivers, used on Google GS101 and newer Samsung Exynos SoCs. Notable change is removing 'const' in 'struct acpm_handle' pointers, because even though the code does not modify pointed data, it immediately drops the const via cast. Also code is not logically readable when a reference getters/putters (e.g. acpm_handle_put()) take a pointer to const, because the meaning of "get" and "put" implies changing the memory, even if that changeable field is outside of pointed data. * tag 'samsung-drivers-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: firmware: exynos-acpm: Drop fake 'const' on handle pointer dt-bindings: firmware: google,gs101-acpm-ipc: add S2MPG11 secondary PMIC firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr firmware: exynos-acpm: Count number of commands in acpm_xfer firmware: exynos-acpm: Use unsigned int for acpm_pmic_linux_errmap index Signed-off-by: Arnd Bergmann commit 29afd0c70d9cd77da62b1105a0553c24e42c0df1 Author: Julian Ruess Date: Wed Mar 25 14:31:23 2026 +0100 vfio/pci: Rename vfio_config_do_rw() to vfio_pci_config_rw_single() and export it A follow-up patch adds a new variant driver for s390 ISM devices. Since this device uses a 256 TiB BAR 0 that is never mapped, the variant driver needs its own ISM_VFIO_PCI_OFFSET_MASK. To minimally mirror the functionality of vfio_pci_config_rw() with such a custom mask, export vfio_config_do_rw(). To better distinguish the now exported function from vfio_pci_config_rw(), rename it to vfio_pci_config_rw_single() emphasizing that it does a single config space read or write. Reviewed-by: Niklas Schnelle Signed-off-by: Julian Ruess Link: https://lore.kernel.org/r/20260325-vfio_pci_ism-v8-1-ddc504cde914@linux.ibm.com Signed-off-by: Alex Williamson commit 0a1f536c9ffdad35dc19f21b7d4772f858b15b68 Merge: 710c166c0fc377 b912e48bee355b Author: Arnd Bergmann Date: Wed Apr 1 23:08:16 2026 +0200 Merge tag 'sunxi-dt-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner device tree changes for 7.1 - part 1 Only minor additions this cycle. Allwinner A523 SoC family had LED controller enabled. Avaota A1 board had SPI NAND enabled. New board added: - TaiqiCat (TQC) A01 * tag 'sunxi-dt-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: h6: Add TaiqiCat (TQC) A01 support dt-bindings: arm: sunxi: Add TaiqiCat (TQC) A01 dt-bindings: vendor-prefixes: Add Beijing Ultrapower Software Co., Ltd. arm64: dts: allwinner: sun55i-t527: avaota-a1: Add SPI NAND arm64: dts: allwinner: sun55i-a523: Add pinmux for spi0 on PJ pins arm64: dts: allwinner: sun55i-t527: avaota-a1: Enable LEDs arm64: dts: allwinner: sun55i-a523: Add LED controller dt-bindings: leds: sun50i-a100: Add compatible for Allwinner A523 SoC Signed-off-by: Arnd Bergmann commit 710c166c0fc377433906f1f2979eca657e9a50c3 Merge: e0c2f14a368002 6453ad0865b68a Author: Arnd Bergmann Date: Wed Apr 1 23:05:35 2026 +0200 Merge tag 'qcom-arm32-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm32 DeviceTree updates for v7.1 Qualcomm APQ8084 is incomplete and hasn't seen functional contributions since 2016, so drop the platform (for now?). Also drop a number of unused IPQ-related dtsi files. Lastly clean up the RPM bus clocks in MSM8974 interconnect nodes. * tag 'qcom-arm32-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: msm8974: Drop RPM bus clocks ARM: dts: qcom: drop apq8084 support ARM: dts: qcom: Drop unused .dtsi Signed-off-by: Arnd Bergmann commit e0c2f14a36800288ef12da14825d3354ad8ee931 Merge: 6935cce658e0e7 f17d7a0f8ff6f9 Author: Arnd Bergmann Date: Wed Apr 1 23:04:56 2026 +0200 Merge tag 'hisi-arm64-dt-for-7.1' of https://github.com/hisilicon/linux-hisi into soc/dt ARM64: DT: HiSilicon ARM64 DT updates for v7.1 - Rename dwmmc nodes to mmc to comply with the schema * tag 'hisi-arm64-dt-for-7.1' of https://github.com/hisilicon/linux-hisi: arm64: dts: hisilicon: Rename dwmmc nodes to mmc Signed-off-by: Arnd Bergmann commit 6935cce658e0e73f61be83b9a3c48f0edcf35350 Merge: 9988201705c5b0 625af11fb9885f Author: Arnd Bergmann Date: Wed Apr 1 23:03:49 2026 +0200 Merge tag 'socfpga_updates_for_v7.1_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into soc/dt SoCFPGA DTS updates for v7.1 - dt-bindings updates: - Document fallback compatible for Stratix10 SoCDK eMMC board - Document compatible for the Agilex5 SoCFPGA modular board - Add emmc support for the Stratix10 - Drop CPU masks from the GICv3 PPI interrupts for Agilex5 * tag 'socfpga_updates_for_v7.1_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: arm64: dts: intel: agilex5: Drop CPU masks from GICv3 PPI interrupts dt-bindings: intel: Add Agilex5 SoCFPGA modular board arm64: dts: socfpga: stratix10: Add emmc support dt-bindings: altera: Add fallback compatible for Stratix 10 SoCDK eMMC variant Signed-off-by: Arnd Bergmann commit 9988201705c5b0bbf3ff1e0857792e41f7996385 Merge: d2be897ff93117 74ec3d52c0035b Author: Arnd Bergmann Date: Wed Apr 1 23:02:51 2026 +0200 Merge tag 'thead-dt-for-v7.1-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt T-HEAD Devicetrees for 7.1, part 2 Additional updates to T-Head device trees for v7.1: - Enable the display pipeline for the TH1520-based BeagleV Ahead board by adding the HDMI connector node, connecting it to the HDMI controller, and activating the DPU and HDMI nodes. - Add coefficients to the TH1520 PVT node as the values in the TH1520 manual differ from the defaults in the driver. * tag 'thead-dt-for-v7.1-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: riscv: dts: thead: beaglev-ahead: enable HDMI output riscv: dts: thead: th1520: add coefficients to the PVT node Signed-off-by: Arnd Bergmann commit d2be897ff93117cc71adec3deeab73961db049ad Merge: cce3c4db864438 64b00da69ef6e2 Author: Arnd Bergmann Date: Wed Apr 1 22:59:28 2026 +0200 Merge tag 'cix-dt-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/dt - Add power domain and reset for SoC - Add GPIO for both SoC and Radxa Orion O6 board * tag 'cix-dt-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix: arm64: dts: cix: add FCH(S0)/S5 GPIO controllers for sky1 arm64: dts: cix: Add scmi powerdomain nodes for sky1 arm64: dts: cix: add support for cix sky1 resets Signed-off-by: Arnd Bergmann commit 93e8fd1a565eb5d0c0bbcb18d00095ad255b6ecb Author: Andrey Grodzovsky Date: Mon Mar 2 15:08:36 2026 -0500 ftrace: Use kallsyms binary search for single-symbol lookup When ftrace_lookup_symbols() is called with a single symbol (cnt == 1), use kallsyms_lookup_name() for O(log N) binary search instead of the full linear scan via kallsyms_on_each_symbol(). ftrace_lookup_symbols() was designed for batch resolution of many symbols in a single pass. For large cnt this is efficient: a single O(N) walk over all symbols with O(log cnt) binary search into the sorted input array. But for cnt == 1 it still decompresses all ~200K kernel symbols only to match one. kallsyms_lookup_name() uses the sorted kallsyms index and needs only ~17 decompressions for a single lookup. This is the common path for kprobe.session with exact function names, where libbpf sends one symbol per BPF_LINK_CREATE syscall. If binary lookup fails (duplicate symbol names where the first match is not ftrace-instrumented), the function falls through to the existing linear scan path. Before (cnt=1, 50 kprobe.session programs): Attach: 858 ms (kallsyms_expand_symbol 25% of CPU) After: Attach: 52 ms (16x faster) Cc: Link: https://patch.msgid.link/20260302200837.317907-3-andrey.grodzovsky@crowdstrike.com Signed-off-by: Andrey Grodzovsky Signed-off-by: Steven Rostedt (Google) commit 41e3ccca00b374b7f39cf68e818b59a921cd7069 Author: Breno Leitao Date: Wed Apr 1 06:03:57 2026 -0700 docs: workqueue: document WQ_AFFN_CACHE_SHARD affinity scope Update kernel-parameters.txt and workqueue.rst to reflect the new cache_shard affinity scope and the default change from cache to cache_shard. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 24b2e73f9700e0682575feb34556b756e59d4548 Author: Breno Leitao Date: Wed Apr 1 06:03:56 2026 -0700 workqueue: add test_workqueue benchmark module Add a kernel module that benchmarks queue_work() throughput on an unbound workqueue to measure pool->lock contention under different affinity scope configurations (cache vs cache_shard). The module spawns N kthreads (default: num_online_cpus()), each bound to a different CPU. All threads start simultaneously and queue work items, measuring the latency of each queue_work() call. Results are reported as p50/p90/p95 latencies for each affinity scope. The affinity scope is switched between runs via the workqueue's sysfs affinity_scope attribute (WQ_SYSFS), avoiding the need for any new exported symbols. The module runs as __init-only, returning -EAGAIN to auto-unload, and can be re-run via insmod. Example of the output: running 50 threads, 50000 items/thread cpu 6806017 items/sec p50=2574 p90=5068 p95=5818 ns smt 6821040 items/sec p50=2624 p90=5168 p95=5949 ns cache_shard 1633653 items/sec p50=5337 p90=9694 p95=11207 ns cache 286069 items/sec p50=72509 p90=82304 p95=85009 ns numa 319403 items/sec p50=63745 p90=73480 p95=76505 ns system 308461 items/sec p50=66561 p90=75714 p95=78048 ns Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 738390a5321c7d34f468bc69f7232db711210bc0 Author: Breno Leitao Date: Wed Apr 1 06:03:55 2026 -0700 tools/workqueue: add CACHE_SHARD support to wq_dump.py The WQ_AFFN_CACHE_SHARD affinity scope was added to the kernel but wq_dump.py was not updated to enumerate it. Add the missing constant lookup and include it in the affinity scopes iteration so that drgn output shows the CACHE_SHARD pod topology alongside the other scopes. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 4cdc8a7389d5025051f6c4a60fb5b7cb9b7960bb Author: Breno Leitao Date: Wed Apr 1 06:03:54 2026 -0700 workqueue: set WQ_AFFN_CACHE_SHARD as the default affinity scope Set WQ_AFFN_CACHE_SHARD as the default affinity scope for unbound workqueues. On systems where many CPUs share one LLC, the previous default (WQ_AFFN_CACHE) collapses all CPUs to a single worker pool, causing heavy spinlock contention on pool->lock. WQ_AFFN_CACHE_SHARD subdivides each LLC into smaller groups, providing a better balance between locality and contention. Users can revert to the previous behavior with workqueue.default_affinity_scope=cache. On systems with 8 or fewer cores per LLC, CACHE_SHARD produces a single shard covering the entire LLC, making it functionally identical to the previous CACHE default. The sharding only activates when an LLC has more than 8 cores. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 5920d046f7ae3bf9cf51b9d915c1fff13d299d84 Author: Breno Leitao Date: Wed Apr 1 06:03:53 2026 -0700 workqueue: add WQ_AFFN_CACHE_SHARD affinity scope On systems where many CPUs share one LLC, unbound workqueues using WQ_AFFN_CACHE collapse to a single worker pool, causing heavy spinlock contention on pool->lock. For example, Chuck Lever measured 39% of cycles lost to native_queued_spin_lock_slowpath on a 12-core shared-L3 NFS-over-RDMA system. The existing affinity hierarchy (cpu, smt, cache, numa, system) offers no intermediate option between per-LLC and per-SMT-core granularity. Add WQ_AFFN_CACHE_SHARD, which subdivides each LLC into groups of at most wq_cache_shard_size cores (default 8, tunable via boot parameter). Shards are always split on core (SMT group) boundaries so that Hyper-Threading siblings are never placed in different pods. Cores are distributed across shards as evenly as possible -- for example, 36 cores in a single LLC with max shard size 8 produces 5 shards of 8+7+7+7+7 cores. The implementation follows the same comparator pattern as other affinity scopes: precompute_cache_shard_ids() pre-fills the cpu_shard_id[] array from the already-initialized WQ_AFFN_CACHE and WQ_AFFN_SMT topology, and cpus_share_cache_shard() is passed to init_pod_type(). Benchmark on NVIDIA Grace (72 CPUs, single LLC, 50k items/thread), show cache_shard delivers ~5x the throughput and ~6.5x lower p50 latency compared to cache scope on this 72-core single-LLC system. Suggested-by: Tejun Heo Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 9dc42c9070282c81058a875fea5acae057610980 Author: Breno Leitao Date: Wed Apr 1 06:03:52 2026 -0700 workqueue: fix typo in WQ_AFFN_SMT comment Fix "poer" -> "per" in the WQ_AFFN_SMT enum comment. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 12b11e47f126d097839fd2f077636e2139b0151b Author: Eric Biggers Date: Tue Mar 31 17:33:31 2026 -0700 lib/crypto: arm64: Assume a little-endian kernel Since support for big-endian arm64 kernels was removed, the CPU_LE() macro now unconditionally emits the code it is passed, and the CPU_BE() macro now unconditionally discards the code it is passed. Simplify the assembly code in lib/crypto/arm64/ accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260401003331.144065-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 180e92df9a4f7498d6549c8c23839bd9554b3449 Author: Eric Biggers Date: Tue Mar 31 17:05:48 2026 -0700 arm64: fpsimd: Remove obsolete cond_yield macro All invocations of the cond_yield macro have been removed, so remove the macro definition as well. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260401000548.133151-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6d575f11c70b0ceff7db47813ebb7aec09e8d01f Author: Eric Biggers Date: Tue Mar 31 17:05:47 2026 -0700 lib/crypto: arm64/sha3: Remove obsolete chunking logic Since commit aefbab8e77eb ("arm64: fpsimd: Preserve/restore kernel mode NEON at context switch"), kernel-mode NEON sections have been preemptible on arm64. And since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes"), voluntary preemption is no longer supported on arm64 either. Therefore, there's no longer any need to limit the length of kernel-mode NEON sections on arm64. Simplify the SHA-3 code accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260401000548.133151-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 7116418f6b00faf43e56f0e052b968b04fc75989 Author: Eric Biggers Date: Tue Mar 31 17:05:46 2026 -0700 lib/crypto: arm64/sha512: Remove obsolete chunking logic Since commit aefbab8e77eb ("arm64: fpsimd: Preserve/restore kernel mode NEON at context switch"), kernel-mode NEON sections have been preemptible on arm64. And since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes"), voluntary preemption is no longer supported on arm64 either. Therefore, there's no longer any need to limit the length of kernel-mode NEON sections on arm64. Simplify the SHA-512 code accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260401000548.133151-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit fe1233c2eb69c040f737dd10b881efff5f4ccee0 Author: Eric Biggers Date: Tue Mar 31 17:05:45 2026 -0700 lib/crypto: arm64/sha256: Remove obsolete chunking logic Since commit aefbab8e77eb ("arm64: fpsimd: Preserve/restore kernel mode NEON at context switch"), kernel-mode NEON sections have been preemptible on arm64. And since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes"), voluntary preemption is no longer supported on arm64 either. Therefore, there's no longer any need to limit the length of kernel-mode NEON sections on arm64. Simplify the SHA-256 code accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260401000548.133151-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit fd5017138ce03f34d0e67758df51e8bb30c0d91b Author: Eric Biggers Date: Tue Mar 31 17:05:44 2026 -0700 lib/crypto: arm64/sha1: Remove obsolete chunking logic Since commit aefbab8e77eb ("arm64: fpsimd: Preserve/restore kernel mode NEON at context switch"), kernel-mode NEON sections have been preemptible on arm64. And since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes"), voluntary preemption is no longer supported on arm64 either. Therefore, there's no longer any need to limit the length of kernel-mode NEON sections on arm64. Simplify the SHA-1 code accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260401000548.133151-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit dec1061f0ae9e00f13b9e141f3b5cae053da1346 Author: Eric Biggers Date: Tue Mar 31 17:05:43 2026 -0700 lib/crypto: arm64/poly1305: Remove obsolete chunking logic Since commit aefbab8e77eb ("arm64: fpsimd: Preserve/restore kernel mode NEON at context switch"), kernel-mode NEON sections have been preemptible on arm64. And since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes"), voluntary preemption is no longer supported on arm64 either. Therefore, there's no longer any need to limit the length of kernel-mode NEON sections on arm64. Simplify the Poly1305 code accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260401000548.133151-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit d3a5cc5c9237cd6ffd1f84c1af306e315cf0cf3d Author: Eric Biggers Date: Tue Mar 31 17:05:42 2026 -0700 lib/crypto: arm64/gf128hash: Remove obsolete chunking logic Since commit aefbab8e77eb ("arm64: fpsimd: Preserve/restore kernel mode NEON at context switch"), kernel-mode NEON sections have been preemptible on arm64. And since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes"), voluntary preemption is no longer supported on arm64 either. Therefore, there's no longer any need to limit the length of kernel-mode NEON sections on arm64. Simplify the GHASH and POLYVAL code accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260401000548.133151-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 63fcc765e1a30b7e04d395d7adc440443ae00338 Author: Eric Biggers Date: Tue Mar 31 17:05:41 2026 -0700 lib/crypto: arm64/chacha: Remove obsolete chunking logic Since commit aefbab8e77eb ("arm64: fpsimd: Preserve/restore kernel mode NEON at context switch"), kernel-mode NEON sections have been preemptible on arm64. And since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes"), voluntary preemption is no longer supported on arm64 either. Therefore, there's no longer any need to limit the length of kernel-mode NEON sections on arm64. Simplify the ChaCha code accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260401000548.133151-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 11d6bc70fff310cf0c4bbfa740144b0e350cd706 Author: Eric Biggers Date: Tue Mar 31 17:05:40 2026 -0700 lib/crypto: arm64/aes: Remove obsolete chunking logic Since commit aefbab8e77eb ("arm64: fpsimd: Preserve/restore kernel mode NEON at context switch"), kernel-mode NEON sections have been preemptible on arm64. And since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes"), voluntary preemption is no longer supported on arm64 either. Therefore, there's no longer any need to limit the length of kernel-mode NEON sections on arm64. Simplify the AES-CBC-MAC code accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260401000548.133151-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 9bf092c97b86af63694d9902b9e14047214ba76d Author: Thorsten Blum Date: Wed Apr 1 17:20:41 2026 +0200 sched: update task_struct->comm comment Since commit 3a3f61ce5e0b ("exec: Make sure task->comm is always NUL-terminated"), __set_task_comm() is unlocked and no longer uses strscpy_pad() - update the stale comment accordingly. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260401152039.724811-4-thorsten.blum@linux.dev Signed-off-by: Kees Cook commit 10cd6758e054e4002ccb409fef7dd2c6b7bbd549 Author: Thorsten Blum Date: Wed Apr 1 17:20:40 2026 +0200 exec: use strnlen() in __set_task_comm Use strnlen() to limit source string scanning to 'TASK_COMM_LEN - 1' bytes. Signed-off-by: Thorsten Blum Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260401152039.724811-3-thorsten.blum@linux.dev Signed-off-by: Kees Cook commit bc91133e260c8113c1119073c03b93c12aa41738 Author: Yazen Ghannam Date: Sat Mar 7 08:10:24 2026 -0600 x86/CPU/AMD: Print AGESA string from DMI additional information entry Type 40 entries (Additional Information) are summarized in section 7.41 as part of the SMBIOS specification. Generally, these entries aren't interesting to save. However on some AMD Zen systems, the AGESA version is stored here. This is useful to save to the kernel message logs for debugging. It can be used to cross-reference issues. Implement an iterator for the Additional Information entries. Use this to find and print the AGESA string. Do so in AMD code, since the use case is AMD-specific. [ bp: Match only "AGESA". ] Signed-off-by: Yazen Ghannam Co-developed-by: "Mario Limonciello (AMD)" Signed-off-by: "Mario Limonciello (AMD)" Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Jean Delvare Link: https://patch.msgid.link/20260307141024.819807-6-superm1@kernel.org commit da55ebe166d71c8c6925c5cfd77fc74bed40aaef Author: Mario Limonciello (AMD) Date: Sat Mar 7 08:10:23 2026 -0600 firmware: dmi: Add pr_fmt() for dmi_scan.c Several prints inconsistently use DMI: or dmi: or nothing. To make it clear which prints come from dmi_scan.c, add a pr_fmt() macro. Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Jean Delvare Link: https://patch.msgid.link/20260307141024.819807-5-superm1@kernel.org commit 28189e95712b70008754c993ecd3531d1c7018d1 Author: Mario Limonciello (AMD) Date: Sat Mar 7 08:10:21 2026 -0600 firmware: dmi: Adjust dmi_decode() to use enums dmi_decode() has hardcoded values with comments for each DMI entry type. The same information is already in dmi.h though, so drop the comments and use the definitions instead. Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Jean Delvare Reviewed-by: Yazen Ghannam Link: https://patch.msgid.link/20260307141024.819807-3-superm1@kernel.org commit c064abc68e009d2cc18416e7132d9c25e03125b6 Author: Mario Limonciello (AMD) Date: Sat Mar 7 08:10:20 2026 -0600 firmware: dmi: Correct an indexing error in dmi.h The entries later in enum dmi_entry_type don't match the SMBIOS specification¹. The entry for type 33: `64-Bit Memory Error Information` is not present and thus the index for all later entries is incorrect. Add it. Also, add missing entry types 43-46, while at it. ¹ Search for "System Management BIOS (SMBIOS) Reference Specification" [ bp: Drop the flaky SMBIOS spec URL. ] Fixes: 93c890dbe5287 ("firmware: Add DMI entry types to the headers") Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Jean Delvare Reviewed-by: Yazen Ghannam Link: https://patch.msgid.link/20260307141024.819807-2-superm1@kernel.org commit f13b7800929df0df0ba2407226ba1b627b482c92 Author: Johan Hovold Date: Wed Apr 1 10:22:12 2026 +0200 Input: usbtouchscreen - refactor endpoint lookup Use the common USB helpers for looking up bulk and interrupt endpoints (and determining endpoint numbers) instead of open coding. Note that the NEXIO data interface has two bulk endpoints (see commit 5197424cdccc ("Input: usbtouchscreen - add NEXIO (or iNexio) support") for the descriptors). The lookup in probe handles both bulk-in and interrupt-in endpoints and was added to handle NEXIO devices. Replace the open coded lookup with a lookup for the common interrupt endpoint and an explicit fallback accepting a bulk endpoint. This iterates over the (two) endpoints twice for NEXIO devices but makes it more clear what is going on. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260401082212.2180434-1-johan@kernel.org Signed-off-by: Dmitry Torokhov commit dee5680d3e42101f7035b650f02f84a660f7e8ab Merge: aeac022e4de78b 47f28a5bd154a9 Author: Mark Brown Date: Wed Apr 1 18:24:31 2026 +0100 ASoC: fsl: fix mixer-test failures Shengjiu Wang says: Fix mixer-test failures. Mostly the issues are that event is not generated in put operation. commit 47f28a5bd154a95d5aa563dde02a801bd32ddb81 Author: Shengjiu Wang Date: Wed Apr 1 17:42:26 2026 +0800 ASoC: fsl_easrc: Change the type for iec958 channel status controls Use the type SNDRV_CTL_ELEM_TYPE_IEC958 for iec958 channel status controls, the original type will cause mixer-test to iterate all 32bit values, which costs a lot of time. And using IEC958 type can reduce the control numbers. Also enable pm runtime before updating registers to make the regmap cache data align with the value in hardware. Fixes: 955ac624058f ("ASoC: fsl_easrc: Add EASRC ASoC CPU DAI drivers") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260401094226.2900532-12-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit aa21fe4a81458cf469c2615b08cbde5997dde25a Author: Shengjiu Wang Date: Wed Apr 1 17:42:25 2026 +0800 ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() The value type of controls "Context 0 IEC958 Bits Per Sample" should be integer, not enumerated, the issue is found by the mixer-test. Fixes: 955ac624058f ("ASoC: fsl_easrc: Add EASRC ASoC CPU DAI drivers") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260401094226.2900532-11-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 00541b86fb578d4949cfdd6aff1f82d43fcf07af Author: Shengjiu Wang Date: Wed Apr 1 17:42:24 2026 +0800 ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() Add check of input value's range in fsl_easrc_iec958_put_bits(), otherwise the wrong value may be written from user space. Fixes: 955ac624058f ("ASoC: fsl_easrc: Add EASRC ASoC CPU DAI drivers") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260401094226.2900532-10-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 64a496ba976324615b845d60739dfcdae3d57434 Author: Shengjiu Wang Date: Wed Apr 1 17:42:23 2026 +0800 ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() ALSA controls should return 1 if the value in the control changed but the control put operation fsl_xcvr_mode_put() only returns 0 or a negative error code, causing ALSA to not generate any change events. Add a suitable check in the function before updating the mode variable. Fixes: 28564486866f ("ASoC: fsl_xcvr: Add XCVR ASoC CPU DAI driver") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260401094226.2900532-9-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 1b61c8103c9317a9c37fe544c2d83cee1c281149 Author: Shengjiu Wang Date: Wed Apr 1 17:42:22 2026 +0800 ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() ALSA controls should return 1 if the value in the control changed but the control put operation fsl_xcvr_arc_mode_put() only returns 0 or a negative error code, causing ALSA to not generate any change events. Add a suitable check in the function before updating the arc_mode variable. Fixes: 28564486866f ("ASoC: fsl_xcvr: Add XCVR ASoC CPU DAI driver") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260401094226.2900532-8-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit e5785093b1b45af7ee57d18619b2854a8aed073a Author: Shengjiu Wang Date: Wed Apr 1 17:42:21 2026 +0800 ASoC: fsl_micfil: Fix event generation in micfil_quality_set() ALSA controls should return 1 if the value in the control changed but the control put operation micfil_quality_set() only returns 0 or a negative error code, causing ALSA to not generate any change events. Add a suitable check in the function before updating the quality variable. Also enable pm runtime before calling the function micfil_set_quality() to make the regmap cache data align with the value in hardware. Fixes: bea1d61d5892 ("ASoC: fsl_micfil: rework quality setting") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260401094226.2900532-7-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 7d2bd35100de370dc326b250e8f6b66bee06a2f3 Author: Shengjiu Wang Date: Wed Apr 1 17:42:20 2026 +0800 ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() ALSA controls should return 1 if the value in the control changed but the control put operation micfil_put_dc_remover_state() only returns 0 or a negative error code, causing ALSA to not generate any change events. return the value of snd_soc_component_update_bits() directly, as it has the capability of return check status of changed or not. Also enable pm runtime before calling the function snd_soc_component_update_bits() to make the regmap cache data align with the value in hardware. Fixes: 29dbfeecab85 ("ASoC: fsl_micfil: Add Hardware Voice Activity Detector support") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260401094226.2900532-6-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit fc4daaddb276d370b7da3819872044df446a1911 Author: Shengjiu Wang Date: Wed Apr 1 17:42:19 2026 +0800 ASoC: fsl_micfil: Fix event generation in micfil_range_set() ALSA controls should return 1 if the value in the control changed but the control put operation micfil_range_set() only returns 0 or a negative error code, causing ALSA to not generate any change events. Use snd_soc_component_update_bits() function to replace the regmap_update_bits(), for snd_soc_component_update_bits() has the capability of return check status. Also enable pm runtime before calling the function snd_soc_component_update_bits() to make the regmap cache data align with the value in hardware. Fixes: ef1a7e02fdb7 ("ASoC: fsl_micfil: Set channel range control") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260401094226.2900532-5-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 7e226209906906421f0d952d7304e48fdb0adabc Author: Shengjiu Wang Date: Wed Apr 1 17:42:18 2026 +0800 ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() ALSA controls should return 1 if the value in the control changed but the control put operation hwvad_put_init_mode() only returns 0 or a negative error code, causing ALSA to not generate any change events. Add a suitable check in the function before updating the vad_init_mode variable. Fixes: 29dbfeecab85 ("ASoC: fsl_micfil: Add Hardware Voice Activity Detector support") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260401094226.2900532-4-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 59b9061824f2179fe133e2636203548eaba3e528 Author: Shengjiu Wang Date: Wed Apr 1 17:42:17 2026 +0800 ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() ALSA controls should return 1 if the value in the control changed but the control put operation hwvad_put_enable() only returns 0 or a negative error code, causing ALSA to not generate any change events. Add a suitable check in the function before updating the vad_enabled variable. Fixes: 29dbfeecab85 ("ASoC: fsl_micfil: Add Hardware Voice Activity Detector support") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260401094226.2900532-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit c7661bfc7422443df394c01e069ae4e5c3a7f04c Author: Shengjiu Wang Date: Wed Apr 1 17:42:16 2026 +0800 ASoC: fsl_micfil: Add access property for "VAD Detected" Add access property SNDRV_CTL_ELEM_ACCESS_READ for control "VAD Detected", which doesn't support put operation, otherwise there will be issue with mixer-test. Fixes: 29dbfeecab85 ("ASoC: fsl_micfil: Add Hardware Voice Activity Detector support") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260401094226.2900532-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit abe572f630bc1f0e77041012ab075869036ede4f Author: Johan Hovold Date: Fri Mar 27 11:43:05 2026 +0100 spi: ch341: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes). Fix the controller and driver data lifetime so that they are released on driver unbind. Note that this also makes sure that the SPI controller is placed correctly under the USB interface in the device tree. Fixes: 8846739f52af ("spi: add ch341a usb2spi driver") Cc: stable@vger.kernel.org # 6.11 Cc: Johannes Thumshirn Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260327104305.1309915-3-johan@kernel.org Signed-off-by: Mark Brown commit b99e3ddb91b499d920e63a2daff8880be68cfe9e Author: Johan Hovold Date: Fri Mar 27 11:43:04 2026 +0100 spi: ch341: fix memory leaks on probe failures Make sure to deregister the controller, disable pins, and kill and free the RX URB on probe failures to mirror disconnect and avoid memory leaks and use-after-free. Also add an explicit URB kill on disconnect for symmetry (even if that is not strictly required as USB core would have stopped it in the current setup). Fixes: 8846739f52af ("spi: add ch341a usb2spi driver") Cc: stable@vger.kernel.org # 6.11 Cc: Johannes Thumshirn Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260327104305.1309915-2-johan@kernel.org Signed-off-by: Mark Brown commit cce3c4db864438b2a5565e69a48c2660e24320cd Merge: 9e17f8e9ccdc63 be3810a2ebc0c8 Author: Arnd Bergmann Date: Wed Apr 1 19:20:09 2026 +0200 Merge tag 'renesas-dts-for-v7.1-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v7.1 (take two) - Add DT overlay support for the MayQueen PixPaper display on the Yuridenki-Shokai Kakip board, - Add Ethernet PHY interrupt support for the RZ/T2H and RZ/N2H EVK boards, - Add SPI and PCIe support for the RZ/G3E SoC and the RZ/G3E SMARC EVK board, - Add DT overlay support for the WaveShare 13.3" 1920x1080 DSI Capacitive Touch Display and the Olimex MIPI-HDMI adapter on the Retronix Sparrow Hawk board, - Drop several superfluous C22 Ethernet PHY compatible strings, - Remove WDT nodes meant for other CPU cores on the RZ/V2N SoC, - Remove unavailable LVDS panel support for the Beacon ReneSoM base board, - Add initial support for the RZ/G3L (R9A08G046) SoC, and the RZ/G3L SMARC SoM and EVK boards, - Add Versa3 clock generator support for the RZ/V2H EVK development board, - Miscellaneous fixes and improvements. * tag 'renesas-dts-for-v7.1-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (29 commits) ARM: dts: renesas: Drop KSZ8041 PHY C22 compatible strings ARM: dts: renesas: rza2mevb: Drop RTL8201F PHY C22 compatible string ARM: dts: renesas: r8a7742-iwg21d-q7-dbcm-ca: Drop KSZ8081 PHY C22 compatible string arm64: dts: renesas: Add initial device tree for RZ/G3L SMARC EVK board arm64: dts: renesas: renesas-smarc2: Move usb3 nodes to board DTS arm64: dts: renesas: Add initial support for RZ/G3L SMARC SoM arm64: dts: renesas: Add initial DTSI for RZ/G3L SoC arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Add versa3 clock generator node dt-bindings: clock: renesas,rzg2l-cpg: Document RZ/G3L SoC arm64: dts: renesas: beacon-renesom: Remove LVDS Panel ARM: dts: r9a06g032: Add #address-cells to the GIC node arm64: dts: renesas: r9a09g056: Remove wdt{0,2,3} nodes arm64: dts: renesas: sparrow-hawk: Add overlay for Olimex MIPI-HDMI adapter arm64: dts: renesas: r9a09g047e57-smarc: Enable PCIe arm64: dts: renesas: r9a09g047e57-smarc-som: Add PCIe reference clock arm64: dts: renesas: r9a09g047: Add PCIe node arm64: dts: renesas: Fix KSZ9131 PHY bogus txdv-skew-psec properties arm64: dts: renesas: Drop KSZ9131 PHY C22 compatible strings arm64: dts: renesas: Drop RTL8211F PHY C22 compatible strings arm64: dts: renesas: Drop RTL8211E PHY C22 compatible strings ... Signed-off-by: Arnd Bergmann commit 5e0deb0a6b4e07825c3b1c4317c5e413421266ed Author: Kevin Brodsky Date: Wed Mar 18 09:25:43 2026 +0000 arm64: mm: Use generic enum pgtable_level enum pgtable_type was introduced for arm64 by commit c64f46ee1377 ("arm64: mm: use enum to identify pgtable level instead of *_SHIFT"). In the meantime, the generic enum pgtable_level got introduced by commit b22cc9a9c7ff ("mm/rmap: convert "enum rmap_level" to "enum pgtable_level""). Let's switch to the generic enum pgtable_level. The only difference is that it also includes PGD level; __pgd_pgtable_alloc() isn't expected to create PGD tables so we add a VM_WARN_ON() for that case. Suggested-by: David Hildenbrand (Arm) Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Ryan Roberts Signed-off-by: Kevin Brodsky Reviewed-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit 95a58852b0e5413b6ef4c93da60a80e89da9986a Author: Anshuman Khandual Date: Mon Mar 9 02:57:25 2026 +0000 arm64/mm: Reject memory removal that splits a kernel leaf mapping Linear and vmemmap mappings that get torn down during a memory hot remove operation might contain leaf level entries on any page table level. If the requested memory range's linear or vmemmap mappings falls within such leaf entries, new mappings need to be created for the remaining memory mapped on the leaf entry earlier, following standard break before make aka BBM rules. But kernel cannot tolerate BBM and hence remapping to fine grained leaves would not be possible on systems without BBML2_NOABORT. Currently memory hot remove operation does not perform such restructuring, and so removing memory ranges that could split a kernel leaf level mapping need to be rejected. While memory_hotplug.c does appear to permit hot removing arbitrary ranges of memory, the higher layers that drive memory_hotplug (e.g. ACPI, virtio, ...) all appear to treat memory as fixed size devices. So it is impossible to hot unplug a different amount than was previously hot plugged, and hence we should never see a rejection in practice, but adding the check makes us robust against a future change. Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/ Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Ryan Roberts Suggested-by: Ryan Roberts Signed-off-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit 48478b9f791376b4b89018d7afdfd06865498f65 Author: Anshuman Khandual Date: Mon Mar 9 02:57:24 2026 +0000 arm64/mm: Enable batched TLB flush in unmap_hotplug_range() During a memory hot remove operation, both linear and vmemmap mappings for the memory range being removed, get unmapped via unmap_hotplug_range() but mapped pages get freed only for vmemmap mapping. This is just a sequential operation where each table entry gets cleared, followed by a leaf specific TLB flush, and then followed by memory free operation when applicable. This approach was simple and uniform both for vmemmap and linear mappings. But linear mapping might contain CONT marked block memory where it becomes necessary to first clear out all entire in the range before a TLB flush. This is as per the architecture requirement. Hence batch all TLB flushes during the table tear down walk and finally do it in unmap_hotplug_range(). Prior to this fix, it was hypothetically possible for a speculative access to a higher address in the contiguous block to fill the TLB with shattered entries for the entire contiguous range after a lower address had already been cleared and invalidated. Due to the table entries being shattered, the subsequent TLB invalidation for the higher address would not then clear the TLB entries for the lower address, meaning stale TLB entries could persist. Besides it also helps in improving the performance via TLBI range operation along with reduced synchronization instructions. The time spent executing unmap_hotplug_range() improved 97% measured over a 2GB memory hot removal in KVM guest. This scheme is not applicable during vmemmap mapping tear down where memory needs to be freed and hence a TLB flush is required after clearing out page table entry. Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Closes: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/ Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove") Cc: stable@vger.kernel.org Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Ryan Roberts Signed-off-by: Ryan Roberts Signed-off-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit d585bc86fb9f405ed1f2f56cc50c82d9aaada297 Author: Li Ming Date: Wed Apr 1 20:49:51 2026 +0800 cxl/region: Add a region sysfs interface for region lock status There are 3 scenarios that leads to a locked region: 1. A region is created on a root decoder with Fixed Device Confiuration attribute. 2. CXL_HDM_DECODER0_CTRL_LOCK. Both 1 & 1 are well described in: commit 2230c4bdc412 ("cxl: Add handling of locked CXL decoder") 3) Platform that has region creation with PRMT address translation always locks the region, regardless of the FIXED attribute or decoder ctrl bit. Region locked means region destroy operations are not permitted. CXL region driver returns -EPERM for region destroy operations. Although the locked status of the corresponding root decoder implies the region is also locked, exposing the region lock status directly to userspace improves usability for users who may not be aware of this relationship. [ dj: Amended commit log with additional locking scenarios. ] Signed-off-by: Li Ming Reviewed-by: Dave Jiang Reviewed-by: Alejandro Lucero Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260401124951.1290041-1-ming.li@zohomail.com Signed-off-by: Dave Jiang commit 9e17f8e9ccdc63f6278e4bf5624b5f61829f0bd6 Merge: 5e9c551265f9b7 407b861f4d0cd3 Author: Arnd Bergmann Date: Wed Apr 1 18:56:32 2026 +0200 Merge tag 'stm32-dt-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/dt STM32 DT for v7.1, round 1 Highlights: ---------- - MPU: - STM32MP13: - Introduce and enable debug bus on DK board. - Enable Coresight on DK board. - Add DT overlays for DH board. - Add Wakeup capabilities on I2C nodes. - STMP32MP15: - ST: - Enable DCMI DMA chaining to improve performances. - Introduce and enable debug bus on EV and DK board. - Enable Coresight on EV and DK board. - DH: - Add DT overlays for DH board. - Phytec: - Rename "Phycore" to "phyboard-sargas" DT files and introduce SOM device tree file. - Fix and enhance current support. - STM32MP21: - Add Bsec support. - STM32MP23: - Add LTDC and LVDS support and enable display on STM32MP235F-DK board. - STM32MP25: - Enable display on STM32MP235F-DK board. * tag 'stm32-dt-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: (42 commits) arm64: defconfig: Enable STMicroelectronics STM32 display support arm64: dts: st: enable display support on stm32mp257f-dk board arm64: dts: st: describe power supplies for stm32mp257f-dk board arm64: dts: st: enable display support on stm32mp235f-dk board arm64: dts: st: describe power supplies for stm32mp235f-dk board arm64: dts: st: add clock-cells to syscfg node on stm32mp231 arm64: dts: st: add lvds support on stm32mp235 arm64: dts: st: add ltdc support on stm32mp235 arm64: dts: st: add ltdc support on stm32mp231 arm64: dts: st: omit unused pinctrl groups from stm32mp25 dtb files arm64: dts: st: add bootph-all in bsec node to stm32mp215f-dk arm64: dts: st: add bsec support to stm32mp21 ARM: dts: stm32: fix misalignments in nodes of stm32mp131 ARM: dts: stm32: fix misalignments in nodes of stm32mp151 arm64: dts: st: describe i2c2 / i2c8 on stm32mp235f-dk arm64: dts: st: describe i2c2 / i2c8 on stm32mp257f-dk arm64: dts: st: disable DMA usage for i2c on stm32mp257f-ev1 arm64: dts: st: add i2c2 pinmux nodes in stm32mp25-pinctrl.dtsi arm64: dts: st: update i2c nodes interrupt/wakeup-source in stm32mp231 arm64: dts: st: update i2c nodes interrupt/wakeup-source in stm32mp251 ... Signed-off-by: Arnd Bergmann commit 5e9c551265f9b739c778a05aa9befddcba799b9e Merge: 2feb6df85c64e5 44ee52a030a6dd Author: Arnd Bergmann Date: Wed Apr 1 18:53:19 2026 +0200 Merge tag 'samsung-dt-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM changes for v7.1 1. New board: Exynos5250 based Google Manta (Nexus 10). 2. Few cleanups. * tag 'samsung-dt-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: exyons4412: Drop duplicated I2C address/size-cells ARM: dts: exynos4210-smdkv310: Drop duplicated I2C address/size-cells ARM: dts: exynos3250: Drop duplicated I2C address/size-cells ARM: dts: exynos: Add Google Manta (Nexus 10) dt-bindings: ARM: samsung: Add Google Manta (Nexus 10) Signed-off-by: Arnd Bergmann commit 9c1ac77ddfc90b6292ef63a4fa5ab6f9e4b29981 Author: Sascha Bischoff Date: Wed Apr 1 16:21:57 2026 +0000 KVM: arm64: vgic-v5: Fold PPI state for all exposed PPIs GICv5 supports up to 128 PPIs, which would introduce a large amount of overhead if all of them were actively tracked. Rather than keeping track of all 128 potential PPIs, we instead only consider the set of architected PPIs (the first 64). Moreover, we further reduce that set by only exposing a subset of the PPIs to a guest. In practice, this means that only 4 PPIs are typically exposed to a guest - the SW_PPI, PMUIRQ, and the timers. When folding the PPI state, changed bits in the active or pending were used to choose which state to sync back. However, this breaks badly for Edge interrupts when exiting the guest before it has consumed the edge. There is no change in pending state detected, and the edge is lost forever. Given the reduced set of PPIs exposed to the guest, and the issues around tracking the edges, drop the tracking of changed state, and instead iterate over the limited subset of PPIs exposed to the guest directly. This change drops the second copy of the PPI pending state used for detecting edges in the pending state, and reworks vgic_v5_fold_ppi_state() to iterate over the VM's PPI mask instead. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260401162152.932243-1-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit c5283a1ffdd5a877120279d164e9d5761e8455af Author: Zhan Xusheng Date: Tue Mar 31 15:48:11 2026 +0800 hrtimer: Fix incorrect #endif comment for BITS_PER_LONG check The #endif comment says "BITS_PER_LONG >= 64", but the corresponding #if guard is "BITS_PER_LONG < 64". The comment was originally correct when the block had a three-way #if/#else/#endif structure, where the #else branch provided a 64-bit inline version. Commit 79bf2bb335b8 ("[PATCH] tick-management: dyntick / highres functionality") removed the #else branch but did not update the #endif comment, leaving it inconsistent with the remaining #if condition. Fix the comment to match the preprocessor guard. Signed-off-by: Zhan Xusheng Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260331074811.26147-1-zhanxusheng@xiaomi.com commit 0e5988549dc73d985cc12c4cb438771ced74f522 Author: Biju Das Date: Wed Apr 1 12:45:00 2026 +0100 irqchip/renesas-rzg2l: Add NMI support The RZ/G2L SoC has an NMI interrupt. Add support for the NMI interrupt. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260401114504.332825-1-biju.das.jz@bp.renesas.com commit 2feb6df85c64e56d95caf7416a706e10220f05c7 Merge: d6b92b6b74fc7a 90f771a9745476 Author: Arnd Bergmann Date: Wed Apr 1 18:34:43 2026 +0200 Merge tag 'samsung-dt64-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM64 changes for v7.1 1. Add initial support for Axis ARTPEC-9 SoC and Alfred board using it. Just like ARTPEC-8, this is a derivative of Samsung Exynos SoC made for Axis, sharing most or all of core SoC blocks with Samsung designs. 2. New boards: Exynos7870 based Samsung Galaxy J7 (2016) and Samsung Galaxy J5 (2017). 3. Google GS101 Pixel phone: describe all PMIC regulators and Maxim fuel-gauge. 4. ExynosAutov920: add G3D (GPU) clock controller (CMU). * tag 'samsung-dt64-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: dts: exynos8895: Move I2C address/size-cells to DTSI arm64: dts: exynos7870: Move I2C address/size-cells to DTSI arm64: dts: exynos: gs101-pixel-common: add Maxim MAX77759 fuel gauge arm64: dts: exynos: add initial support for Samsung Galaxy J5 dt-bindings: arm: samsung: add compatible for samsung-j5y17lte arm64: dts: exynosautov920: add CMU_G3D clock DT nodes arm64: dts: exynos: gs101-pixel: add all S2MPG1x regulators arm64: dts: exynos: add initial support for Samsung Galaxy J7 (2016) dt-bindings: arm: samsung: add compatible for samsung-j7xelte arm64: dts: axis: artpec9: Fix missing soc unit address arm64: dts: axis: Add ARTPEC-9 Alfred board support arm64: dts: exynos: axis: Add initial ARTPEC-9 SoC support dt-bindings: arm: axis: Add ARTPEC-9 alfred board dt-bindings: clock: Add ARTPEC-9 clock controller Signed-off-by: Arnd Bergmann commit 03db5f05d4c76d76b32a9d26001e2ec6252f74f8 Author: Zenghui Yu (Huawei) Date: Tue Mar 17 21:15:58 2026 +0800 KVM: arm64: selftests: Avoid testing the IMPDEF behavior It turned out that we can't really force KVM to use the "slow" path when emulating AT instructions [1]. We should therefore avoid testing the IMPDEF behavior (i.e., TEST_ACCESS_FLAG - address translation instructions are permitted to update AF but not required). Remove it and improve the comment a bit. [1] https://lore.kernel.org/r/b951dcfb-0ad1-4d7b-b6ce-d54b272dd9be@linux.dev Signed-off-by: Zenghui Yu (Huawei) Link: https://patch.msgid.link/20260317131558.52751-1-zenghui.yu@linux.dev Signed-off-by: Marc Zyngier commit d6b92b6b74fc7ae8cb2c79ea960ad6efa8928673 Merge: 185fb140508b0e 0acb1de2b4df42 Author: Arnd Bergmann Date: Wed Apr 1 18:25:57 2026 +0200 Merge tag 'arm-soc/for-7.1/devicetree-arm64' of https://github.com/Broadcom/stblinux into soc/dt This pull request contains Broadcom ARM64-based SoCs Device Tree updates for 7.1, please pull the following: - Maira adds the V3D DT node to the 2712 (Raspberry Pi 5) SoC - Gergor adds the I2C controller, CSI (camera), ISP (image signal processor), fixes the pinctrl node and updates the UART10 interrupt for the RP1 sister chip to the 2712 (Raspberry Pi 5) - Rob moves the firmware and GPU to the root level to fix DTC warnings * tag 'arm-soc/for-7.1/devicetree-arm64' of https://github.com/Broadcom/stblinux: arm64: dts: broadcom: bcm2712: Move non simple-bus nodes to root level arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon arm64: dts: broadcom: bcm2712-rpi-5-b: add pinctrl properties for csi i2cs arm64: dts: broadcom: bcm2712: add camera backend node pispbe arm64: dts: broadcom: rp1: add csi nodes arm64: dts: broadcom: rp1: add i2c controller arm64: dts: broadcom: bcm2712: Add V3D device node Signed-off-by: Arnd Bergmann commit 8ae2837d5a97644b729a889951127da98111a32d Author: Pavel Begunkov Date: Tue Mar 31 22:07:40 2026 +0100 io_uring/zcrx: don't use mark0 for allocating xarray XA_MARK_0 is not compatible with xarray allocating entries, use XA_MARK_1. Fixes: fda90d43f4fac ("io_uring/zcrx: return back two step unregistration") Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/f232cfd3c466047d333b474dd2bddd246b6ebb82.1774780198.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 77d8c8d0f1b76a005267ee9714ed98964c87ecc5 Author: Anas Iqbal Date: Tue Mar 31 22:07:39 2026 +0100 io_uring: cast id to u64 before shifting in io_allocate_rbuf_ring() Smatch warns: io_uring/zcrx.c:393 io_allocate_rbuf_ring() warn: should 'id << 16' be a 64 bit type? The expression 'id << IORING_OFF_PBUF_SHIFT' is evaluated using 32-bit arithmetic because id is a u32. This may overflow before being promoted to the 64-bit mmap_offset. Cast id to u64 before shifting to ensure the shift is performed in 64-bit arithmetic. Signed-off-by: Anas Iqbal Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/52400e1b343691416bef3ed3ae287fb1a88d407f.1774780198.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit a9d008489f0c5304ca7f705348324e47824a7454 Author: Pavel Begunkov Date: Tue Mar 31 22:07:38 2026 +0100 io_uring/zcrx: reject REG_NODEV with large rx_buf_size The copy fallback path doesn't care about the actual niov size and only uses first PAGE_SIZE bytes, and any additional space will be wasted. Since ZCRX_REG_NODEV solely relies on the copy path, it doesn't make sense to support non-standard rx_buf_len. Reject it for now, and re-enable once improved. Fixes: c11728021d5cd ("io_uring/zcrx: implement device-less mode for zcrx") Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/3e7652d9c27f8ac5d2b141e3af47971f2771fb05.1774780198.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 85a58309c0d5b5f5a4b65658312ceaf2c34c9bbf Author: Amir Mohammad Jahangirzad Date: Wed Apr 1 02:51:13 2026 +0330 io_uring/cancel: validate opcode for IORING_ASYNC_CANCEL_OP io_async_cancel_prep() reads the opcode selector from sqe->len and stores it in cancel->opcode, which is an 8-bit field. Since sqe->len is a 32-bit value, values larger than U8_MAX are implicitly truncated. This can cause unintended opcode matches when the truncated value corresponds to a valid io_uring opcode. For example, submitting a value such as 0x10b will be truncated to 0x0b (IORING_OP_TIMEOUT), allowing a cancel request to match operations it did not intend to target. Validate the opcode value before assigning it to the 8-bit field and reject values outside the valid io_uring opcode range. Signed-off-by: Amir Mohammad Jahangirzad Link: https://patch.msgid.link/20260331232113.615972-1-a.jahangirzad@gmail.com Signed-off-by: Jens Axboe commit 19a8cc6cda580a3726ab8f117e7c6de507376d9b Author: Jackie Liu Date: Tue Mar 31 18:45:09 2026 +0800 io_uring/rsrc: use io_cache_free() to free node Replace kfree(node) with io_cache_free() in io_buffer_register_bvec() to match all other error paths that free nodes allocated via io_rsrc_node_alloc(). The node is allocated through io_cache_alloc() internally, so it should be returned to the cache via io_cache_free() for proper object reuse. Signed-off-by: Jackie Liu Link: https://patch.msgid.link/20260331104509.7055-1-liu.yun@linux.dev [axboe: remove fixes tag, it's not a fix, it's a cleanup] Signed-off-by: Jens Axboe commit 7c713dd0078651d040a0251eab6e29e3c2e4ee11 Author: Pavel Begunkov Date: Mon Mar 23 12:44:05 2026 +0000 io_uring/zcrx: rename zcrx [un]register functions Drop "ifqs" from function names, as it refers to an interface queue and there might be none once a device-less mode is introduced. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/657874acd117ec30fa6f45d9d844471c753b5a0f.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit de6ed1b323fc50eaa3d7847274cff51055b5c498 Author: Pavel Begunkov Date: Mon Mar 23 12:44:04 2026 +0000 io_uring/zcrx: check ctrl op payload struct sizes Add a build check that ctrl payloads are of the same size and don't grow struct zcrx_ctrl. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/af66caf9776d18e9ff880ab828eb159a6a03caf5.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 5c727ce042988df45232cfdb6599bb46116fd69c Author: Pavel Begunkov Date: Mon Mar 23 12:44:03 2026 +0000 io_uring/zcrx: cache fallback availability in zcrx ctx Store a flag in struct io_zcrx_ifq telling if the backing memory is normal page or dmabuf based. It was looking it up from the area, however it logically allocates from the zcrx ctx and not a particular area, and once we add more than one area it'll become a mess. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/65e75408a7758fe7e60fae89b7a8d5ae4857f515.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit f0b92207a00c731cfbfdefdcf9f9350a11e30ab3 Author: Pavel Begunkov Date: Mon Mar 23 12:44:02 2026 +0000 io_uring/zcrx: warn on a repeated area append We only support a single area, no path should be able to call io_zcrx_append_area() twice. Warn if that happens instead of just returning an error. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/28eb67fb8c48445584d7c247a36e1ad8800f0c8b.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 61cfadaae6612830b1d4c3457a9935d362af8839 Author: Pavel Begunkov Date: Mon Mar 23 12:44:01 2026 +0000 io_uring/zcrx: consolidate dma syncing Split refilling into two steps, first allocate niovs, and then do DMA sync for them. This way dma synchronisation code can be better optimised. E.g. we don't need to call dma_dev_need_sync() for each every niov, and maybe we can coalesce sync for adjacent netmems in the future as well. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/19f2d50baa62ff2e0c6cd56dd7c394cab728c567.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit c0989138c0515fbffbff2d9b9093853a874440cc Author: Pavel Begunkov Date: Mon Mar 23 12:44:00 2026 +0000 io_uring/zcrx: netmem array as refiling format Instead of peeking into page pool allocation cache directly or via net_mp_netmem_place_in_cache(), pass a netmem array around. It's a better intermediate format, e.g. you can have it on stack and reuse the refilling code and decouples it from page pools a bit more. It still points into the page pool directly, there will be no additional copies. As the next step, we can change the callback prototype to take the netmem array from page pool. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/9d8549adb7ef6672daf2d8a52858ce5926279a82.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 48f253d65d39a45d2eed395bf6b8ac3bb8b1e992 Author: Pavel Begunkov Date: Mon Mar 23 12:43:59 2026 +0000 io_uring/zcrx: warn on alloc with non-empty pp cache Page pool ensures the cache is empty before asking to refill it. Warn if the assumption is violated. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/9c9792d6e65f3780d57ff83b6334d341ed9a5f29.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 7df542a6657534694779948195cc4d36ace575b5 Author: Pavel Begunkov Date: Mon Mar 23 12:43:58 2026 +0000 io_uring/zcrx: move count check into zcrx_get_free_niov Instead of relying on the caller of __io_zcrx_get_free_niov() to check that there are free niovs available (i.e. free_count > 0), move the check into the function and return NULL if can't allocate. It consolidates the free count checks, and it'll be easier to extend the niov free list allocator in the future. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/6df04a6b3a6170f86d4345da9864f238311163f9.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 898ad80d1207cbdb22b21bafb6de4adfd7627bd0 Author: Pavel Begunkov Date: Mon Mar 23 12:43:57 2026 +0000 io_uring/zcrx: use guards for locking Convert last several places using manual locking to guards to simplify the code. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/eb4667cfaf88c559700f6399da9e434889f5b04a.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 6a55a0a7ebcc8496c81827a2e9287de80f86dd57 Author: Pavel Begunkov Date: Mon Mar 23 12:43:56 2026 +0000 io_uring/zcrx: add a struct for refill queue Add a new structure that keeps the refill queue state. It's cleaner and will be useful once we introduce multiple refill queues. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/4ce200da1ff0309c377293b949200f95f80be9ae.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit ebae09bce495a0bfbf177f1972411c9a99dfcf07 Author: Pavel Begunkov Date: Mon Mar 23 12:43:55 2026 +0000 io_uring/zcrx: use better name for RQ region Rename "region" to "rq_region" to highlight that it's a refill queue region. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/ac815790d2477a15826aecaa3d94f2a94ef507e6.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 825f2764919fca61a88ab2f93dfdfd1d22566264 Author: Pavel Begunkov Date: Mon Mar 23 12:43:54 2026 +0000 io_uring/zcrx: implement device-less mode for zcrx Allow creating a zcrx instance without attaching it to a net device. All data will be copied through the fallback path. The user is also expected to use ZCRX_CTRL_FLUSH_RQ to handle overflows as it normally should even with a netdev, but it becomes even more relevant as there will likely be no one to automatically pick up buffers. Apart from that, it follows the zcrx uapi for the I/O path, and is useful for testing, experimentation, and potentially for the copy receive path in the future if improved. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/674f8ad679c5a0bc79d538352b3042cf0999596e.1774261953.git.asml.silence@gmail.com [axboe: fix spelling error in uapi header and commit message] Signed-off-by: Jens Axboe commit 06fc3b6d388dfa9c3df62830e07be828324b99e3 Author: Pavel Begunkov Date: Mon Mar 23 12:43:53 2026 +0000 io_uring/zcrx: extract netdev+area init into a helper In preparation to following patches, add a function that is responsibly for looking up a netdev, creating an area, DMA mapping it and opening a queue. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/88cb6f746ecb496a9030756125419df273d0b003.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit b8d6eb6c1c80852dfcad8642f346c26aabf34833 Author: Pavel Begunkov Date: Mon Mar 23 12:43:52 2026 +0000 io_uring/zcrx: always dma map in advance zcrx was originally establisihing dma mappings at a late stage when it was being bound to a page pool. Dma-buf couldn't work this way, so it's initialised during area creation. It's messy having them do it at different spots, just move everything to the area creation time. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/334092a2cbdd4aabd7c025050aa99f05ace89bb5.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 41041562a7d6acd5a8ce918be8da7e26337f379f Author: Pavel Begunkov Date: Mon Mar 23 12:43:51 2026 +0000 io_uring/zcrx: fully clean area on error in io_import_umem() When accounting fails, io_import_umem() sets the page array, etc. and returns an error expecting that the error handling code will take care of the rest. To make the next patch simpler, only return a fully initialised areas from the function. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/3a602b7fb347dbd4da6797ac49b52ea5dedb856d.1774261953.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit e5361d25e241ac3a23177fa74ae91d049bad00d3 Author: Pavel Begunkov Date: Mon Mar 23 12:43:50 2026 +0000 io_uring/zcrx: return back two step unregistration There are reports where io_uring instance removal takes too long and an ifq reallocation by another zcrx instance fails. Split zcrx destruction into two steps similarly how it was before, first close the queue early but maintain zcrx alive, and then when all inflight requests are completed, drop the main zcrx reference. For extra protection, mark terminated zcrx instances in xarray and warn if we double put them. Cc: stable@vger.kernel.org # 6.19+ Link: https://github.com/axboe/liburing/issues/1550 Reported-by: Youngmin Choi Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/0ce21f0565ab4358668922a28a8a36922dfebf76.1774261953.git.asml.silence@gmail.com [axboe: NULL ifq before break inside scoped guard] Signed-off-by: Jens Axboe commit f62fcdf8ab826ffc811552e29a6dd8544281fd97 Author: Tommaso Merciai Date: Wed Apr 1 17:16:11 2026 +0200 reset: rzv2h-usb2phy: Add support for VBUS mux controller registration The RZ/V2H USB2 PHY requires control of the VBUS selection line (VBENCTL) through a mux controller described in the device tree as "mux-controller". This change adds support for registering the rzv2h-usb-vbenctl auxiliary driver during probe. This enables proper management of USB2.0 VBUS source selection on platforms using the RZ/V2H SoC. Reviewed-by: Philipp Zabel Signed-off-by: Tommaso Merciai Signed-off-by: Philipp Zabel commit 890628c8d0f156a80a0aea02803d31fd8dd83fc0 Author: Tommaso Merciai Date: Wed Apr 1 17:16:10 2026 +0200 reset: rzv2h-usb2phy: Convert to regmap API Replace raw MMIO accesses (readl/writel) with regmap_read() and regmap_multi_reg_write() via devm_regmap_init_mmio(). Drop the manual spinlock as regmap provides internal locking. Replace the custom rzv2h_usb2phy_regval struct with the standard reg_sequence, and encode assert/deassert sequences as reg_sequence arrays rather than individual scalar fields in the of_data descriptor. Use the reg_sequence .delay_us field to encode the 11 µs post-assert delay, replacing the explicit usleep_range(11, 20) call in rzv2h_usbphy_reset_assert(). Select REGMAP_MMIO in Kconfig. Signed-off-by: Tommaso Merciai Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 63be00249dd9f42a51fa164fa4eab920cb44f122 Author: Tommaso Merciai Date: Wed Apr 1 17:16:09 2026 +0200 dt-bindings: reset: renesas,rzv2h-usb2phy: Document RZ/G3E USB2PHY reset Document USB2PHY reset controller bindings for RZ/G3E ("R9A09G047") SoC. The RZ/G3E USB2PHY reset controller is functionally identical to the one found on the RZ/V2H(P), so no driver changes are needed. The existing "renesas,r9a09g057-usb2phy-reset" will be used as a fallback compatible for this IP. Acked-by: Conor Dooley Signed-off-by: Tommaso Merciai Signed-off-by: Philipp Zabel commit 6a1b6f7e56dc72ff8b4a83c728a2bed6d834e4cb Author: Tommaso Merciai Date: Wed Apr 1 17:16:08 2026 +0200 dt-bindings: reset: renesas,rzv2h-usb2phy: Add '#mux-state-cells' property Add the '#mux-state-cells' property to support describing the USB VBUS_SEL multiplexer as a mux-controller in the Renesas RZ/V2H(P) USB2PHY binding. The mux-controller cannot be integrated into the parent USB2PHY node because the VBUS source selector is part of a separate hardware block, not the USB2PHY block itself. This is required to properly configure USB PHY power selection on RZ/V2H(P) and RZ/G3E SoCs. Acked-by: Krzysztof Kozlowski Signed-off-by: Tommaso Merciai Signed-off-by: Philipp Zabel commit df53055c540fe8850f587a6ef0d6944bdd909483 Author: Griffin Kroah-Hartman Date: Tue Mar 3 17:40:41 2026 -0800 Input: aw86927 - add support for Awinic AW86938 Add support for the I2C-connected Awinic AW86938 LRA haptic controller. The AW86938 has a similar but slightly different register layout. In particular, the boost mode register values. The AW86938 also has some extra features that aren't implemented in this driver yet. Signed-off-by: Griffin Kroah-Hartman Link: https://patch.msgid.link/20260302-aw86938-driver-v4-3-92c865df9cca@fairphone.com Signed-off-by: Dmitry Torokhov commit b73724b1defe253fa9d76be4bcb585ef37ef4d68 Author: Griffin Kroah-Hartman Date: Tue Mar 3 17:40:10 2026 -0800 dt-bindings: input: awinic,aw86927: Add Awinic AW86938 Add bindings for the Awinic AW86938 haptic chip which can be found in smartphones. These two chips require a similar devicetree configuration, but have a register layout that's not 100% compatible. Still, because chip model is fully detectable via ID register, these chips can be documnented in the same file. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Griffin Kroah-Hartman Link: https://patch.msgid.link/20260302-aw86938-driver-v4-2-92c865df9cca@fairphone.com Signed-off-by: Dmitry Torokhov commit 53ba7a47d3783192e6846cbb42f246f0fb9f9488 Author: Griffin Kroah-Hartman Date: Tue Mar 3 17:37:18 2026 -0800 Input: aw86927 - respect vibration magnitude levels Previously the gain value was hardcoded. Take the magnitude passed via the input API and configure the gain register accordingly. Signed-off-by: Griffin Kroah-Hartman Link: https://patch.msgid.link/20260302-aw86938-driver-v4-1-92c865df9cca@fairphone.com Signed-off-by: Dmitry Torokhov commit 1dff9ac2c85860af67a74777fa6d31c2ad07a15a Author: David Laight Date: Mon Mar 23 11:22:47 2026 +0000 tools/nolibc/printf: Support negative variable width and precision For (eg) "%*.*s" treat a negative field width as a request to left align the output (the same as the '-' flag), and a negative precision to request the default precision. Set the default precision to -1 (not INT_MAX) and add explicit checks to the string handling for negative values (makes the tet unsigned). For numeric output check for 'precision >= 0' instead of testing _NOLIBC_PF_FLAGS_CONTAIN(flags, '.'). This needs an inverted test, some extra goto and removes an indentation. The changed conditionals fix printf("%0-#o", 0) - but '0' and '-' shouldn't both be specified. Signed-off-by: David Laight Link: https://patch.msgid.link/20260323112247.3196-1-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit a3ca3bfd01b7ee9f54ed85718a6d553cdd87050e Author: Will Deacon Date: Fri Mar 27 19:27:57 2026 +0000 KVM: arm64: Destroy stage-2 page-table in kvm_arch_destroy_vm() kvm_arch_destroy_vm() can be called on the kvm_create_vm() error path after we have failed to register the MMU notifiers for the new VM. In this case, we cannot rely on the MMU ->release() notifier to call kvm_arch_flush_shadow_all() and so the stage-2 page-table allocated in kvm_arch_init_vm() will be leaked. Explicitly destroy the stage-2 page-table in kvm_arch_destroy_vm(), so that we clean up after kvm_arch_destroy_vm() without relying on the MMU notifiers. Link: https://sashiko.dev/#/patchset/20260327140039.21228-1-will%40kernel.org?patch=12265 Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260327192758.21739-3-will@kernel.org Signed-off-by: Marc Zyngier commit 2fc0f3e2b9a9f397554ffe86e8f6eb0e2507ec6e Author: Will Deacon Date: Fri Mar 27 19:27:56 2026 +0000 KVM: arm64: Don't leave mmu->pgt dangling on kvm_init_stage2_mmu() error If kvm_init_stage2_mmu() fails to allocate 'mmu->last_vcpu_ran', it destroys the newly allocated stage-2 page-table before returning ENOMEM. Unfortunately, it also leaves a dangling pointer in 'mmu->pgt' which points at the freed 'kvm_pgtable' structure. This is likely to confuse the kvm_vcpu_init_nested() failure path which can double-free the structure if it finds it via kvm_free_stage2_pgd(). Ensure that the dangling 'mmu->pgt' pointer is cleared when returning an error from kvm_init_stage2_mmu(). Link: https://sashiko.dev/#/patchset/20260327140039.21228-1-will%40kernel.org?patch=12265 Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260327192758.21739-2-will@kernel.org Signed-off-by: Marc Zyngier commit cf6348af645bd8e38758114e6afcc406c5bb515f Author: Sebastian Ene Date: Mon Mar 30 10:54:41 2026 +0000 KVM: arm64: Prevent the host from using an smc with imm16 != 0 The ARM Service Calling Convention (SMCCC) specifies that the function identifier and parameters should be passed in registers, leaving the 16-bit immediate field un-handled in pKVM when an SMC instruction is trapped. Since the HVC is a private interface between EL2 and the host, enforce the host kernel running under pKVM to use an immediate value of 0 only when using SMCs to make it clear for non-compliant software talking to Trustzone that we only use SMCCC. Signed-off-by: Sebastian Ene Reviewed-by: Vincent Donnefort Link: https://patch.msgid.link/20260330105441.3226904-1-sebastianene@google.com Signed-off-by: Marc Zyngier commit 7138a8698a39e81eb153e05500823fff76d5b3bd Author: Thomas Weißschuh Date: Mon Mar 30 09:07:58 2026 +0200 timens: Use task_lock guard in timens_get*() Simplify the logic in timens_get*() by converting the task_lock usage to a guard(). Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260330-timens-cleanup-v1-4-936e91c9dd30@linutronix.de commit 6d89dc8b1c559ee2662db86f7490ac52cab3030c Author: Thomas Weißschuh Date: Mon Mar 30 09:07:57 2026 +0200 timens: Use mutex guard in proc_timens_set_offset() Simplify the logic in proc_timens_set_offset() by converting the mutex usage to a guard(). Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260330-timens-cleanup-v1-3-936e91c9dd30@linutronix.de commit 3fa3aeb4a5cb19e372680ef8860a0381cd5409e9 Author: Thomas Weißschuh Date: Mon Mar 30 09:07:56 2026 +0200 timens: Simplify some calls to put_time_ns() Use the new __free() based cleanup helpers to simplify some functions. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260330-timens-cleanup-v1-2-936e91c9dd30@linutronix.de commit c2de5a5be4d60af5f928a2dd2b0f73e17358e346 Author: Thomas Weißschuh Date: Mon Mar 30 09:07:55 2026 +0200 timens: Add a __free() wrapper for put_time_ns() The wrapper will be used to simplify cleanups of 'struct time_namespace'. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260330-timens-cleanup-v1-1-936e91c9dd30@linutronix.de commit 549b5c12ef06441dbde4718f16e23c547f5592d7 Author: Dan Williams Date: Thu Mar 26 22:28:21 2026 -0700 tools/testing/cxl: Test dax_hmem takeover of CXL regions When platform firmware is committed to publishing EFI_CONVENTIONAL_MEMORY in the memory map, but CXL fails to assemble the region, dax_hmem can attempt to attach a dax device to the memory range. Take advantage of the new ability to support multiple "hmem_platform" devices, and to enable regression testing of several scenarios: * CXL correctly assembles a region, check dax_hmem fails to attach dax * CXL fails to assemble a region, check dax_hmem successfully attaches dax * Check that loading the dax_cxl driver loads the dax_hmem driver * Attempt to race cxl_mock_mem async probe vs dax_hmem probe flushing. Check that both positive and negative cases. Signed-off-by: Dan Williams Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Tested-by: Alison Schofield Link: https://patch.msgid.link/20260327052821.440749-10-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 78b8f1a7a4ab39cecd926d50627db3537e0f2ee9 Author: Dan Williams Date: Thu Mar 26 22:28:20 2026 -0700 tools/testing/cxl: Simulate auto-assembly failure Add a cxl_test module option to skip setting up one of the members of the default auto-assembled region. This simulates a device failing between firmware setup and OS boot, or region configuration interrupted by an event like kexec. Signed-off-by: Dan Williams Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260327052821.440749-9-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 059edcc405e46cc10ee65ab2c039aa6bccfbb3a0 Author: Dan Williams Date: Thu Mar 26 22:28:19 2026 -0700 dax/hmem: Parent dax_hmem devices For test purposes it is useful to be able to determine which "hmem_platform" device is hosting a given sub-device. Register hmem devices underneath "hmem_platform". Signed-off-by: Dan Williams Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260327052821.440749-8-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit f8dc1bde187310e0345beb08df949e0c2a4c86ce Author: Dan Williams Date: Thu Mar 26 22:28:18 2026 -0700 dax/hmem: Fix singleton confusion between dax_hmem_work and hmem devices dax_hmem (ab)uses a platform device to allow for a module to autoload in the presence of "Soft Reserved" resources. The dax_hmem driver had no dependencies on the "hmem_platform" device being a singleton until the recent "dax_hmem vs dax_cxl" takeover solution. Replace the layering violation of dax_hmem_work assuming that there will never be more than one "hmem_platform" device associated with a global work item with a dax_hmem local workqueue that can theoretically support any number of hmem_platform devices. Fixup the reference counting to only pin the device while it is live in the queue. Signed-off-by: Dan Williams Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260327052821.440749-7-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 3cba30eed56df3af80ae8d4fde9cf4039eace82a Author: Dan Williams Date: Thu Mar 26 22:28:17 2026 -0700 dax/hmem: Reduce visibility of dax_cxl coordination symbols No other module or use case should be using dax_hmem_initial_probe or dax_hmem_flush_work(). Limit their use to dax_hmem, and dax_cxl respectively. Signed-off-by: Dan Williams Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260327052821.440749-6-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 471d88441eb990ef1b64713e6975cb3549b1824b Author: Dan Williams Date: Thu Mar 26 22:28:16 2026 -0700 cxl/region: Constify cxl_region_resource_contains() The call to cxl_region_resource_contains() in hmem_register_cxl_device() need not cast away 'const'. The problem is the usage of the bus_for_each_dev() API which does not mark its @data parameter as 'const'. Switch to bus_find_device() which does take 'const' @data, fixup cxl_region_resource_contains() and its caller. Signed-off-by: Dan Williams Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260327052821.440749-5-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit b6a61d5baf99c012c61ee93f8295185942cd7495 Author: Dan Williams Date: Thu Mar 26 22:28:15 2026 -0700 cxl/region: Limit visibility of cxl_region_contains_resource() The dax_hmem dependency on cxl_region_contains_resource() is a one-off special case. It is not suitable for other use cases. Move the definition to the other CONFIG_CXL_REGION guarded definitions in drivers/cxl/cxl.h and include that by a relative path include. This matches what drivers/dax/cxl.c does for its limited private usage of CXL core symbols. Reduce the symbol export visibility from global to just dax_hmem, to further clarify its applicability. Signed-off-by: Dan Williams Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260327052821.440749-4-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 1eaef15b2349087d9ce583b9153970d5cf5c5329 Author: Dan Williams Date: Thu Mar 26 22:28:14 2026 -0700 dax/cxl: Fix HMEM dependencies The expectation is that DEV_DAX_HMEM=y should be disallowed if any of CXL_ACPI, or CXL_PCI are set =m. Also DEV_DAX_CXL=y should be disallowed if DEV_DAX_HMEM=m. Use "$config || !$config" syntax for each dependency. Otherwise, the invalid DEV_DAX_HMEM=m && DEV_DAX_CXL=y configuration is allowed. Lastly, dax_hmem depends on the availability of the cxl_region_contains_resource() symbol published by the cxl_core.ko module. So, also prevent DEV_DAX_HMEM from being built-in when the cxl_core module is not built-in. Signed-off-by: Dan Williams Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260327052821.440749-3-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 87805c32e6ad7b5ce2d9f7f47e76081857a4a335 Author: Dan Williams Date: Thu Mar 26 22:28:13 2026 -0700 cxl/region: Fix use-after-free from auto assembly failure The following crash signature results from region destruction while an endpoint decoder is staged, but not fully attached. [ dj: Moved bus_find_device( to next line. ] Signed-off-by: Dan Williams Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260327052821.440749-2-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit a972d1b864e8efcfda0b387debac8ea2875a182c Author: Biju Das Date: Sat Feb 1 15:58:28 2025 +0000 drm/msm: Use of_get_available_child_by_name() Simplify zap_shader_load_mdt() by using of_get_available_child_by_name(). Signed-off-by: Biju Das Patchwork: https://patchwork.freedesktop.org/patch/635020/ Link: https://lore.kernel.org/r/20250201155830.39366-1-biju.das.jz@bp.renesas.com Signed-off-by: Dmitry Baryshkov commit f94aa7e9cf6821d28808d80e5c4f20e491d59a26 Author: Dmitry Baryshkov Date: Thu Mar 5 01:47:12 2026 +0200 dt-bindings: display/msm: move DSI PHY bindings to phy/ subdir Historically DSI PHY bindings landed to the display/msm subdir, however they describe PHYs and as such they should be in the phy/ subdir. Follow the example of other Qualcomm display-related PHYs (HDMI, eDP) and move bindings for the Qualcomm DSI PHYs to the correct subdir. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Neil Armstrong Acked-by: Vinod Koul Patchwork: https://patchwork.freedesktop.org/patch/709008/ Link: https://lore.kernel.org/r/20260305-msm-dsi-phy-v1-1-0a99ac665995@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 502455d8bef2f8502540102218c47fc12da2a04e Author: Krzysztof Kozlowski Date: Tue Mar 31 18:11:57 2026 +0200 drm/msm/dpu: eliza: Use Eliza-specific CWB array The driver references CWB array from SM8650, but should use the Eliza specific, which has different register space sizes. This should not have noticeable impact on function but is indeed confusing, since the Eliza table is used for .cwb_count. Fixes: 0eb707bbc7fc ("drm/msm/dpu: Add support for Eliza SoC") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/715623/ Link: https://lore.kernel.org/r/20260331161156.211623-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 2a0ffcd5456c4d9c395ad995d0298e3672d14ac9 Author: Vladimir Oltean Date: Fri Mar 27 20:46:53 2026 +0200 drm/msm/dp: remove debugging prints with internal struct phy state These do not provide much value, and will become hard to maintain once the Generic PHY framework starts hiding the contents of struct phy from consumers. Signed-off-by: Vladimir Oltean Acked-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/714986/ Link: https://lore.kernel.org/r/20260327184706.1600329-16-vladimir.oltean@nxp.com Signed-off-by: Dmitry Baryshkov commit 7090420420d5a7d7c88b21d16962f2a230be3ef3 Author: Dmitry Baryshkov Date: Wed Mar 25 07:35:44 2026 +0200 drm/msm/dpu: drop INTF_0 on MSM8953 There is no INTF_0 on MSM8953. Currently catalog lists dummy INTF_NONE entry for it. Drop it from the catalog. Fixes: 7a6109ce1c2c ("drm/msm/dpu: Add support for MSM8953") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/713990/ Link: https://lore.kernel.org/r/20260325-drop-8953-intf-v1-1-d80e214a1a75@oss.qualcomm.com commit 469df8c2b571bb243d0da30424686aac14a8f068 Author: Dmitry Baryshkov Date: Wed Mar 25 07:32:27 2026 +0200 drm/msm/dpu: correct DP MST interface configuration Due to historical reasons we ended up with dummy values being specified for MST-related interfaces some of them had INTF_NONE, others had non-existing DP controller indices. Those workarounds are no longer necessary. Fix types and indices for all DP-MST related INTF instances. The only exception is INTF_3 on SC8180X, which has unique design. It can be used either with INTF_0 / DP0 or with INTF_4 / DP1. This interface is left with the dummy value until somebody implements necessary bits for that platform. Co-developed-by: Abhinav Kumar Signed-off-by: Abhinav Kumar Signed-off-by: Yongxing Mou Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/713988/ Link: https://lore.kernel.org/r/20260325-fix-dp-mst-interfaces-v1-1-186d1de3fa1b@oss.qualcomm.com commit e224e3a167bc97ed2a5a603acf7e16e4319437de Author: Dmitry Baryshkov Date: Wed Mar 25 05:06:06 2026 +0200 drm/msm/mdp5: drop workarounds specific to MDP5 1.0 With support for MSM8974v1 being removed from the driver, there is no need to keep workarounds specific to that particular MDP5 revision. Drop them, slightly simplifying the logic. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/713918/ Link: https://lore.kernel.org/r/20260325-mdp5-further-drop-mdp1-0-v1-1-5ccee47fd1aa@oss.qualcomm.com commit 429ebd815bbc06a0adbe8f1ffd0f328610381847 Author: Dmitry Baryshkov Date: Wed Mar 25 04:59:02 2026 +0200 drm/msm/mdp5: drop single flush support Support for using a single CTL for flushing both interfaces was not in use since the MDP5 driver dropped support for dual DSI configurations in the commit df3c7899946c ("drm/msm/mdp5: drop split display support"). Having the MDP 3.x support migrated to the DPU driver the single CTL flush is applicable to the platforms suspproted by the MDP5 driver. Drop it alltogether. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/713916/ Link: https://lore.kernel.org/r/20260325-mdp5-drop-single-flush-v1-1-862a38b4d2ec@oss.qualcomm.com commit b3265a1b2bd00335308f27477cecb7702f4bb615 Author: Marc Zyngier Date: Wed Apr 1 11:36:11 2026 +0100 KVM: arm64: set_id_regs: Allow GICv3 support to be set at runtime set_id_regs creates a GIC3 guest when possible, and then proceeds to write the ID registers as if they were not affected by the presence of a GIC. As it turns out, ID_AA64PFR1_EL1 is the proof of the contrary. KVM now makes a point in exposing the GIC support to the guest, no matter what userspace says (userspace such as QEMU is known to write silly things at times). Accommodate for this level of nonsense by teaching set_id_regs about fields that are mutable, and only compare registers that have been re-sanitised first. Reported-by: Mark Brown Link: https://patch.msgid.link/20260401103611.357092-17-maz@kernel.org Signed-off-by: Marc Zyngier commit f4626281c6bb563ef5ad9d3a59a1449b45a3dc30 Author: Marc Zyngier Date: Wed Apr 1 11:36:10 2026 +0100 KVM: arm64: Don't advertises GICv3 in ID_PFR1_EL1 if AArch32 isn't supported Although the AArch32 ID regs are architecturally UNKNOWN when AArch32 isn't supported at any EL, KVM makes a point in making them RAZ. Therefore, advertising GICv3 in ID_PFR1_EL1 must be gated on AArch32 being supported at least at EL0. Reviewed-by: Sascha Bischoff Fixes: a258a383b9177 ("KVM: arm64: gic-v5: Sanitize ID_AA64PFR2_EL1.GCIE") Reported-by: Mark Brown Tested-by: Mark Brown Link: https://patch.msgid.link/20260401103611.357092-16-maz@kernel.org Signed-off-by: Marc Zyngier commit be46a408f376df31762e8a9914dc6d082755e686 Author: Marc Zyngier Date: Wed Apr 1 11:36:09 2026 +0100 KVM: arm64: Correctly plumb ID_AA64PFR2_EL1 into pkvm idreg handling While we now compute ID_AA64PFR2_EL1 to a glorious 0, we never use that data and instead return the 0 that corresponds to an allocated idreg. Not a big deal, but we might as well be consistent. Reviewed-by: Sascha Bischoff Fixes: 5aefaf11f9af5 ("KVM: arm64: gic: Hide GICv5 for protected guests") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-15-maz@kernel.org Signed-off-by: Marc Zyngier commit 06c85b58e0b13e67f4e56cbba346201bfe95ad00 Author: Marc Zyngier Date: Wed Apr 1 11:36:08 2026 +0100 KVM: arm64: Move GICv5 timer PPI validation into timer_irqs_are_valid() Userspace can set the timer PPI numbers way before a GIC has been created, leading to odd behaviours on GICv5 as we'd accept non architectural PPI numbers. Move the v5 check into timer_irqs_are_valid(), which aligns the behaviour with the pre-v5 GICs, and is also guaranteed to run only once a GIC has been configured. Reviewed-by: Sascha Bischoff Fixes: 9491c63b6cd7b ("KVM: arm64: gic-v5: Enlighten arch timer for GICv5") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-14-maz@kernel.org Signed-off-by: Marc Zyngier commit fbcbf259d97d340376a176de20bdc04687356949 Author: Marc Zyngier Date: Wed Apr 1 11:36:07 2026 +0100 KVM: arm64: Remove evaluation of timer state in kvm_cpu_has_pending_timer() The vgic-v5 code added some evaluations of the timers in a helper funtion (kvm_cpu_has_pending_timer()) that is called to determine whether the vcpu can wake-up. But looking at the timer there is wrong: - we want to see timers that are signalling an interrupt to the vcpu, and not just that have a pending interrupt - we already have kvm_arch_vcpu_runnable() that evaluates the state of interrupts - kvm_cpu_has_pending_timer() really is about WFIT, as the timeout does not generate an interrupt, and is therefore distinct from the point above As a consequence, revert these changes and teach vgic_v5_has_pending_ppi() about checking for pending HW interrupts instead. Fixes: 9491c63b6cd7b ("KVM: arm64: gic-v5: Enlighten arch timer for GICv5") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-13-maz@kernel.org Signed-off-by: Marc Zyngier commit 8fe30434a81d36715ab83fdb4a5e6c967d2e3ecf Author: Marc Zyngier Date: Wed Apr 1 11:36:06 2026 +0100 KVM: arm64: Kill arch_timer_context::direct field The newly introduced arch_timer_context::direct field is a bit pointless, as it is always set on timers that are... err... direct, while we already have a way to get to that by doing a get_map() operation. Additionally, this field is: - only set when get_map() is called - never cleared and the single point where it is actually checked doesn't call get_map() at all. At this stage, it is probably better to just kill it, and rely on get_map() to give us the correct information. Reviewed-by: Sascha Bischoff Fixes: 9491c63b6cd7b ("KVM: arm64: gic-v5: Enlighten arch timer for GICv5") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-12-maz@kernel.org Signed-off-by: Marc Zyngier commit 848fa8373a53b0e5d871560743e13278da56fabc Author: Marc Zyngier Date: Wed Apr 1 11:36:05 2026 +0100 KVM: arm64: vgic-v5: Correctly set dist->ready once initialised kvm_vgic_map_resources() targetting a v5 model results in vgic->dist_ready never being set. This doesn't result in anything really bad, only some more heavy locking as we go and re-init something for no good reason. Rejig the code to correctly set the ready flag in all non-failing cases. Reviewed-by: Sascha Bischoff Fixes: f4d37c7c35769 ("KVM: arm64: gic-v5: Create and initialise vgic_v5") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-11-maz@kernel.org Signed-off-by: Marc Zyngier commit a4a645584793dbbb4e5a1a876800654a8883326e Author: Marc Zyngier Date: Wed Apr 1 11:36:04 2026 +0100 KVM: arm64: vgic-v5: Make the effective priority mask a strict limit The way the effective priority mask is compared to the priority of an interrupt to decide whether to wake-up or not, is slightly odd, and breaks at the limits. This could result in spurious wake-ups that are undesirable. Make the computed priority mask comparison a strict inequality, so that interrupts that have the same priority as the mask are not signalled. Fixes: 933e5288fa971 ("KVM: arm64: gic-v5: Check for pending PPIs") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-10-maz@kernel.org Signed-off-by: Marc Zyngier commit 42d7eac8291d2724b3897141ab2f226c69b7923e Author: Marc Zyngier Date: Wed Apr 1 11:36:03 2026 +0100 KVM: arm64: vgic-v5: Cast vgic_apr to u32 to avoid undefined behaviours Passing a u64 to __builtin_ctz() is odd, and requires some digging to figure out why this construct is indeed safe as long as the HW is correct. But it is much easier to make it clear to the compiler by casting the u64 into an intermediate u32, and be done with the UD. Reviewed-by: Sascha Bischoff Fixes: 933e5288fa971 ("KVM: arm64: gic-v5: Check for pending PPIs") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-9-maz@kernel.org Signed-off-by: Marc Zyngier commit 170a77b4185a87cc7e02e404d22b9bf3f9923884 Author: Marc Zyngier Date: Wed Apr 1 11:36:02 2026 +0100 KVM: arm64: vgic-v5: Transfer edge pending state to ICH_PPI_PENDRx_EL2 While it is perfectly correct to leave the pending state of a level interrupt as is when queuing it (it is, after all, only driven by the line), edge pending state must be transfered, as nothing will lower it. Reviewed-by: Sascha Bischoff Fixes: 4d591252bacb2 ("KVM: arm64: gic-v5: Implement PPI interrupt injection") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-8-maz@kernel.org Signed-off-by: Marc Zyngier commit e63d0a32e7368f3eb935755db87add1bf000ea90 Author: Marc Zyngier Date: Wed Apr 1 11:36:01 2026 +0100 KVM: arm64: vgic-v5: Hold config_lock while finalizing GICv5 PPIs Finalizing the PPI state is done without holding any lock, which means that two vcpus can race against each other and have one zeroing the state while another one is setting it, or even maybe using it. Fixing this is done by: - holding the config lock while performing the initialisation - checking if SW_PPI has already been advertised, meaning that we have already completed the initialisation once Reviewed-by: Sascha Bischoff Fixes: 8f1fbe2fd2792 ("KVM: arm64: gic-v5: Finalize GICv5 PPIs and generate mask") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-7-maz@kernel.org Signed-off-by: Marc Zyngier commit d70d4323dd9636e35696639f6b4c2b2735291516 Author: Marc Zyngier Date: Wed Apr 1 11:36:00 2026 +0100 KVM: arm64: Account for RESx bits in __compute_fgt() When computing Fine Grained Traps, it is preferable to account for the reserved bits. The HW will most probably ignore them, unless the bits have been repurposed to do something else. Use caution, and fold our view of the reserved bits in, Reviewed-by: Sascha Bischoff Fixes: c259d763e6b09 ("KVM: arm64: Account for RES1 bits in DECLARE_FEAT_MAP() and co") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260401103611.357092-6-maz@kernel.org Signed-off-by: Marc Zyngier commit 76efe94b1c5cc9b5fac7c5c1096d03f1596c7267 Author: Marc Zyngier Date: Wed Apr 1 11:35:59 2026 +0100 KVM: arm64: Fix writeable mask for ID_AA64PFR2_EL1 The writeable mask for fields in ID_AA64PFR2_EL1 has been accidentally inverted, which isn't a very good idea. Restore the expected polarity. Reviewed-by: Sascha Bischoff Fixes: a258a383b9177 ("KVM: arm64: gic-v5: Sanitize ID_AA64PFR2_EL1.GCIE") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-5-maz@kernel.org Signed-off-by: Marc Zyngier commit 77acae60be60adddf33e4c7e9cf73291f64fb9e8 Author: Marc Zyngier Date: Wed Apr 1 11:35:58 2026 +0100 arm64: Fix field references for ICH_PPI_DVIR[01]_EL2 The ICH_PPI_DVIR[01]_EL2 registers should refer to the ICH_PPI_DVIRx_EL2 fields, instead of ICH_PPI_DVIx_EL2. Reviewed-by: Sascha Bischoff Fixes: 2808a8337078f ("arm64/sysreg: Add remaining GICv5 ICC_ & ICH_ sysregs for KVM support") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-4-maz@kernel.org Signed-off-by: Marc Zyngier commit d82d09d5ba4be0b5eb053b2ba2bc0e82c49cf2c8 Author: Marc Zyngier Date: Wed Apr 1 11:35:57 2026 +0100 KVM: arm64: Don't skip per-vcpu NV initialisation Some GICv5-related rework have resulted in the NV sanitisation of registers being skipped for secondary vcpus, which is a pretty bad idea. Hoist the NV init early so that it is always executed. Reviewed-by: Sascha Bischoff Fixes: cbd8c958be54a ("KVM: arm64: Return early from kvm_finalize_sys_regs() if guest has run") Link: https://sashiko.dev/#/patchset/20260319154937.3619520-1-sascha.bischoff%40arm.com Link: https://patch.msgid.link/20260401103611.357092-3-maz@kernel.org Signed-off-by: Marc Zyngier commit ecc7f02499544ae879716be837af78260a6a10f7 Author: Marc Zyngier Date: Wed Apr 1 11:35:56 2026 +0100 KVM: arm64: vgic: Don't reset cpuif/redist addresses at finalize time Although we are OK with rewriting idregs at finalize time, resetting the guest's cpuif (GICv3) or redistributor (GICv3) addresses once we start running the guest is a pretty bad idea. Move back this initialisation to vgic creation time. Reviewed-by: Sascha Bischoff Fixes: a258a383b9177 ("KVM: arm64: gic-v5: Sanitize ID_AA64PFR2_EL1.GCIE") Link: https://patch.msgid.link/20260323174713.3183111-1-maz@kernel.org Link: https://patch.msgid.link/20260401103611.357092-2-maz@kernel.org Signed-off-by: Marc Zyngier commit a5a5ad9848980e1019ca841fe057afb83debecfa Author: Paul Sajna Date: Tue Mar 31 20:15:17 2026 -0700 arm64: dts: qcom: sdm845-lg-common: Add chassis-type The sdm845-lg devices are all phones, therefore handset chassis Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Paul Sajna Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-12-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit eb8fa32085261a07d763e9d616b3c206d0be82ff Author: Paul Sajna Date: Tue Mar 31 20:15:16 2026 -0700 arm64: dts: qcom: sdm845-lg: Add wifi nodes Wi-Fi now works with this patch, relevant firmware and qcom,snoc-host-cap-skip-quirk qcom,snoc-host-cap-skip-quirk has not been approved/merged in mainline, so it is not included here. ath10k_snoc 18800000.wifi: qmi chip_id 0x30214 chip_family 0x4001 board_id 0xff soc_id 0x40030001 ath10k_snoc 18800000.wifi: qmi fw_version 0x20060285 fw_build_timestamp 2020-10-12 23:35 fw_build_id QC_IMAGE_VERSION_STRING=WLAN.HL.2.0.c4-00645-QCAHLSWMTPLZ-1.336037.2 ath10k_snoc 18800000.wifi: wcn3990 hw1.0 target 0x00000008 chip_id 0x00000000 sub 0000:0000 ath10k_snoc 18800000.wifi: kconfig debug 1 debugfs 1 tracing 0 dfs 0 testmode 0 ath10k_snoc 18800000.wifi: firmware ver api 5 features wowlan,mgmt-tx-by-reference,non-bmi crc32 b3d4b790 ath10k_snoc 18800000.wifi: htt-ver 3.83 wmi-op 4 htt-op 3 cal file max-sta 32 raw 0 hwcrypto 1 ath10k_snoc 18800000.wifi: invalid MAC address; choosing random Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Paul Sajna Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-11-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit c6c66aa3ef33dc3076c6dac64003b29bd9515b58 Author: Paul Sajna Date: Tue Mar 31 20:15:15 2026 -0700 arm64: dts: qcom: sdm845-lg-judyln: Add display panel Also include other supporting msm drm nodes, gpio and backlight Co-developed-by: Amir Dahan Signed-off-by: Amir Dahan Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Paul Sajna Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-10-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit 2e7cdd400b6a4e67c27fc3e839342824b51d01ff Author: Paul Sajna Date: Tue Mar 31 20:15:14 2026 -0700 arm64: dts: qcom: sdm845-lg-judyln: Add lab/ibb These regulators are required for the LCD Reviewed-by: Konrad Dybcio Signed-off-by: Paul Sajna Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-9-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit b49722c8a18cdd11f49357f3b8be23549f76a506 Author: Amir Dahan Date: Tue Mar 31 20:15:13 2026 -0700 arm64: dts: qcom: sdm845-lg-common: Add LEDs Add the multicolor status LED in the phone's notch. Signed-off-by: Amir Dahan Reviewed-by: Pavel Machek Reviewed-by: Konrad Dybcio Signed-off-by: Paul Sajna Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-8-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit 995c258982429db93db103fc26fcb3a0acd6a5ee Author: Christopher Brown Date: Tue Mar 31 20:15:12 2026 -0700 arm64: dts: qcom: sdm845-lg-judyln: Add battery and charger Values based on lineageos kernel https://github.com/LineageOS/android_kernel_lge_sdm845/blob/lineage-22.2/arch/arm64/boot/dts/lge/sdm845-battery/LGE_BLT39_LGC_3000mAh.dtsi Signed-off-by: Christopher Brown Reviewed-by: Konrad Dybcio Signed-off-by: Paul Sajna Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-7-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit e746ed5af3084e9534135679c55e69eced0c657f Author: Paul Sajna Date: Tue Mar 31 20:15:11 2026 -0700 arm64: dts: qcom: sdm845-lg: Add uarts and Bluetooth uart9 is debug serial on USB SBU1/2 UART RX is SBU1 and UART TX is SBU2 of the USB-C port). 1.8V Logic Level Tested using pololu usb07a https://www.pololu.com/product/2585 and CH340 USB-UART uart6 is bluetooth Bluetooth: hci0: setting up wcn399x Bluetooth: hci0: QCA Product ID :0x0000000a Bluetooth: hci0: QCA SOC Version :0x40010214 Bluetooth: hci0: QCA ROM Version :0x00000201 Bluetooth: hci0: QCA Patch Version:0x00000001 Bluetooth: hci0: QCA controller version 0x02140201 Bluetooth: hci0: QCA Downloading qca/crbtfw21.tlv Bluetooth: hci0: QCA Downloading qca/judyln/crnv21.bin Bluetooth: hci0: QCA setup on UART is completed Reviewed-by: Dmitry Baryshkov Signed-off-by: Paul Sajna Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-6-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit 4ec3045c969a326c458c53ca65bde5749e575d52 Author: Paul Sajna Date: Tue Mar 31 20:15:10 2026 -0700 arm64: dts: qcom: sdm845-lg-common: Enable qups and their dma controllers Qualcomm serial communicators required for i2c, serial, and spi Signed-off-by: Paul Sajna Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-5-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit e9f611de7ab51540c0cf246df6b7d4d99f4cec64 Author: Paul Sajna Date: Tue Mar 31 20:15:09 2026 -0700 arm64: dts: qcom: sdm845-lg-common: Enable venus Qualcomm video en/de-coder Signed-off-by: Paul Sajna Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-4-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit 8f4c53ae286bd6a113245ad53ce957e623374cf0 Author: Paul Sajna Date: Tue Mar 31 20:15:08 2026 -0700 arm64: dts: qcom: sdm845-lg-judyp: Define firmware paths for judyp For consistency with judyln and new naming scheme for firmware Signed-off-by: Paul Sajna Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-3-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit b9afe8581c0e14b7b56e2314dc7f9597bf23ef67 Author: Paul Sajna Date: Tue Mar 31 20:15:07 2026 -0700 arm64: dts: qcom: sdm845-lg-judyln: Add firmware nodes, change path Add paths for Qualcomm firmware, including: ipa, modem, venus, gpu GPU and bluetooth are confirmed working, others may need more testing/fixes But regardless they will need the firmware paths specified here and firmware added upstream before they will work, so might as well get started on it now. Signed-off-by: Paul Sajna Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-2-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit 6a9e8df732014c1c758bd3cd6254b5b4cb273c7f Author: Paul Sajna Date: Tue Mar 31 20:15:06 2026 -0700 arm64: dts: qcom: sdm845-lg-common: Sort nodes and properties Improve adherance to style guidelines below: https://docs.kernel.org/devicetree/bindings/dts-coding-style.html Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Paul Sajna Link: https://lore.kernel.org/r/20260331-judyln-dts-v7-1-87217b15fefb@postmarketos.org Signed-off-by: Bjorn Andersson commit b4cfbee0df3540b36b78e9d8e3c6d93f3206fecc Author: Abel Vesa Date: Mon Mar 30 17:24:08 2026 +0300 arm64: dts: qcom: glymur-crd: Enable DisplayPort support The two Type-C ports found on Glymur CRD are DisplayPort alternate mode capable. Everything is in place already for the USB, but for DisplayPort the controllers need to be enabled. So enable the related DisplayPort controller for each of these two ports. Also define the supported link frequencies for each output. Signed-off-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260330-glymur-enable-displayport-v1-1-1543ad6dac3a@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 185fb140508b0e060dbf8bebcab4c188a5e85e6b Merge: 5ac16e6593f46c 220bdfcb4b4788 Author: Arnd Bergmann Date: Wed Apr 1 16:33:13 2026 +0200 Merge tag 'arm-soc/for-7.1/devicetree' of https://github.com/Broadcom/stblinux into soc/dt This pull request contains Broadcom ARM-based SoCs Device Tree updates for 7.1, please pull the following: - Rafal provides a complete description of the PCIe Root Complex nodes in order to silence a number of dtc warnings - Rosen provides the necessary NVMEM properties to allow describing the WAN device MAC address from NVRAM, also adds better LEDs, USB GPIOs and Wi-Fi buttons for the Linksys EA9200 router - Linus completes the BCA devices description by adding the I2C block and fixing interrupts for the DMA block on 63138 and 6878 * tag 'arm-soc/for-7.1/devicetree' of https://github.com/Broadcom/stblinux: ARM: dts: BCM5301X: EA9200: specify partitions ARM: dts: BCM5301X: EA9200: add LEDs ARM: dts: BCM5301X: EA9200: add USB GPIOs ARM: dts: BCM5301X: EA9200: add WiFi button ARM: dts: broadcom: bcm2835-rpi: Move non simple-bus nodes to root level ARM: dts: bcm63148: Add I2C block ARM: dts: bcm63138: Add I2C block ARM: dts: bcm6878: Add I2C bus block ARM: dts: bcm6855: Add I2C bus blocks ARM: dts: bcm6846: Add I2C bus block ARM: dts: bcm63138: Fix DMA IRQ ARM: dts: bcm6878: Fix PL081 DMA block IRQ ARM: dts: BCM5301X: AC5300: set WAN MAC from nvram ARM: dts: BCM5301X: AC3100: set WAN MAC from nvram ARM: dts: BCM5301X: panamera: set WAN MAC from nvram ARM: dts: BCM5301X: EA9200: set WAN MAC from nvram ARM: dts: BCM5301X: add root pcie bridges ARM: dts: BCM5301X: Drop extra NAND controller compatible ARM: dts: BCM5301X: Describe PCIe controllers fully Signed-off-by: Arnd Bergmann commit 82bbd447199ff1441031d2eaf9afe041550cf525 Author: Stefan Berger Date: Wed Mar 25 17:33:49 2026 -0400 evm: Enforce signatures version 3 with new EVM policy 'bit 3' Enable the configuration of EVM so that it requires that asymmetric signatures it accepts are of version 3 (sigv3). To enable this, introduce bit 3 (value 0x0008) that the user may write to EVM's securityfs policy configuration file 'evm' for sigv3 enforcement. Mention bit 3 in the documentation. Signed-off-by: Stefan Berger Signed-off-by: Mimi Zohar commit bab8e90bca64a87dd058527ae1d02596d35dc601 Author: Stefan Berger Date: Tue Mar 24 20:10:51 2026 -0400 integrity: Allow sigv3 verification on EVM_XATTR_PORTABLE_DIGSIG Allow sigv3 verification on EVM_XATTR_PORTABLE_DIGSIG on RSA, ECDSA, ECRDSA, and SM2 signatures. Signed-off-by: Stefan Berger Signed-off-by: Mimi Zohar commit de4c44a7f559ceae19f7a70febf49e87bdfb125c Author: Mimi Zohar Date: Tue Mar 10 09:16:25 2026 -0400 ima: add support to require IMA sigv3 signatures Defining a policy rule with the "appraise_type=imasig" option allows either v2 or v3 signatures. Defining an IMA appraise rule with the "appraise_type=sigv3" option requires a file sigv3 signature. Define a new appraise type: IMA_SIGV3_REQUIRED Example: appraise func=BPRM_CHECK appraise_type=sigv3 Tested-by: Stefan Berger Acked-by: Eric Biggers Signed-off-by: Mimi Zohar commit 64c658f358ec6ed6e992d4cf05482eaa2ab4b1a4 Author: Mimi Zohar Date: Tue Mar 10 21:36:44 2026 -0400 ima: add regular file data hash signature version 3 support Instead of directly verifying the signature of a file data hash, signature v3 verifies the signature of the ima_file_id structure containing the file data hash. To disambiguate the signature usage, the ima_file_id structure also includes the hash algorithm and the type of data (e.g. regular file hash or fs-verity root hash). Tested-by: Stefan Berger Acked-by: Eric Biggers Signed-off-by: Mimi Zohar commit dccfbafb1f34a98898ac685e0f3f86eeaf25ecc6 Author: Mimi Zohar Date: Tue Mar 10 19:42:07 2026 -0400 ima: Define asymmetric_verify_v3() to verify IMA sigv3 signatures Define asymmetric_verify_v3() to calculate the hash of the struct ima_file_id, before calling asymmetric_verify() to verify the signature. Move and update the existing calc_file_id_hash() function with a simpler, self contained version. In addition to the existing hash data and hash data length arguments, also pass the hash algorithm. Suggested-by: Stefan Berger Tested-by: Stefan Berger Acked-by: Eric Biggers Signed-off-by: Mimi Zohar commit 34d85ad42604fbb5a8903488c6a7e2862e2d0254 Author: Sebastian Andrzej Siewior Date: Wed Apr 1 14:13:34 2026 +0200 genirq/affinity: Remove cpus_read_lock() while reading cpu_possible_mask cpu_possible_mask is set early during boot based on information from the firmware. After that it remains read only and is never changed. Therefore there is no need to acquire the CPU-hotplug lock while reading it. Remove cpus_read_*() while accessing cpu_possible_mask. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260401121334.xeMOSC1v@linutronix.de commit c3bb8d4f5d802ec1a16f018e82030bccb7a053a4 Author: Kuppuswamy Sathyanarayanan Date: Tue Mar 31 14:19:50 2026 -0700 powercap: intel_rapl: Consolidate PL4 and PMU support flags into rapl_defaults Currently, PL4 and MSR-based RAPL PMU support are detected using separate CPU ID tables (pl4_support_ids and pmu_support_ids) in the MSR driver probe path. This creates a maintenance burden since adding a new CPU requires updates in two places: the rapl_ids table and one or both of these capability tables. Consolidate PL4 and PMU capability information directly into struct rapl_defaults by adding msr_pl4_support and msr_pmu_support flags. This allows per-CPU capability to be expressed in a single place alongside other per-CPU defaults, eliminating the duplicate CPU ID tables entirely. No functional changes are intended. Co-developed-by: Zhang Rui Signed-off-by: Zhang Rui Acked-by: Srinivas Pandruvada Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20260331211950.3329932-8-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit b0ee5110ef1c684eab41bd03fbe8bf2a8f964054 Author: Kuppuswamy Sathyanarayanan Date: Tue Mar 31 14:19:49 2026 -0700 powercap: intel_rapl: Move MSR primitives to MSR driver MSR-specific RAPL primitives differ from those used by TPMI and MMIO interfaces. Keeping them in the common driver requires interface-specific handling logic and makes the common layer unnecessarily complex. Move the MSR primitive definitions and associated bitmasks into the MSR interface driver. This change includes: 1. Move MSR-specific bitmask definitions to RAPL MSR driver. 2. Add MSR-local struct rapl_primitive_info instance and assign it to priv->rpi during MSR probe. 3. Remove the primitive assignment logic from rapl_config() in the common driver. No functional changes are intended. Co-developed-by: Zhang Rui Signed-off-by: Zhang Rui Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20260331211950.3329932-7-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit d7a718fff34b8b4a2d54672f2c685aef7a281b5e Author: Kuppuswamy Sathyanarayanan Date: Tue Mar 31 14:19:48 2026 -0700 thermal: intel: int340x: processor: Move MMIO primitives to MMIO driver MMIO-specific primitives differ from those used by the TPMI interface. The MSR and MMIO interfaces shared the same primitives in the common driver, but MMIO does not require many MSR-specific entries (like PSYS). Keeping these in the common driver does not add any value and requires interface-specific handling logic that makes the common layer unnecessarily complex. Move the MMIO primitive definitions and associated bitmasks into the MMIO interface driver. This change includes: 1. Add MMIO-local struct rapl_primitive_info instance without MSR-specific entries and assign it to priv->rpi during MMIO initialization. 2. Remove the RAPL MMIO case from rapl_config() in the common driver. No functional changes are intended. Co-developed-by: Zhang Rui Signed-off-by: Zhang Rui Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20260331211950.3329932-6-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit b874996a7c54fbcf684003442936a9711e353482 Author: Kuppuswamy Sathyanarayanan Date: Tue Mar 31 14:19:47 2026 -0700 powercap: intel_rapl: Move TPMI primitives to TPMI driver TPMI-specific RAPL primitives differ from those used by MSR and MMIO interfaces. Keeping them in the common RAPL driver requires interface-specific handling logic and makes the common layer unnecessarily complex. Move the TPMI primitive definitions and associated bitmasks into the TPMI interface driver. This change includes: 1. Move TPMI-specific bitmask definitions from intel_rapl_common.c to intel_rapl_tpmi.c. 2. Add TPMI-local struct rapl_primitive_info instance and assign it to priv->rpi during TPMI probe. 3. Remove the RAPL TPMI related definitions from the common driver. No functional changes are intended. Co-developed-by: Zhang Rui Signed-off-by: Zhang Rui Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20260331211950.3329932-5-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 04bcbed4cd33495d05ba98857a748e416ab603b7 Author: Kuppuswamy Sathyanarayanan Date: Tue Mar 31 14:19:46 2026 -0700 powercap: intel_rapl: Move primitive info to header for interface drivers RAPL primitive information varies across different RAPL interfaces (MSR, TPMI, MMIO). Keeping them in the common code adds no benefit, but requires interface-specific handling logic and makes the common layer unnecessarily complex. Move the primitive info infrastructure to the shared header to allow interface drivers to configure RAPL primitives. Specific changes: 1. Move struct rapl_primitive_info, enum unit_type, and PRIMITIVE_INFO_INIT macro to intel_rapl.h. 2. Change the @rpi field in struct rapl_if_priv from void * to struct rapl_primitive_info * to improve type safety and eliminate unnecessary casts. No functional changes. This is a preparatory refactoring to allow interface drivers to supply their own RAPL primitive settings. Co-developed-by: Zhang Rui Signed-off-by: Zhang Rui Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20260331211950.3329932-4-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 3e6996c0cbdbc32cfef4646660b994c1e0d96387 Author: Kuppuswamy Sathyanarayanan Date: Tue Mar 31 14:19:45 2026 -0700 powercap: intel_rapl: Remove unused macro definitions Remove the following unused macro definitions from the RAPL common driver: * DOMAIN_STATE_INACTIVE and DOMAIN_STATE_POWER_LIMIT_SET * IOSF_CPU_POWER_BUDGET_CTL_BYT and IOSF_CPU_POWER_BUDGET_CTL_TNG * MAX_PRIM_NAME No functional changes. Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20260331211950.3329932-3-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit e648c7acc1e3507520af16cf5e6e9472878ec0a4 Author: Kuppuswamy Sathyanarayanan Date: Tue Mar 31 14:19:44 2026 -0700 powercap: intel_rapl: Move MSR default settings into MSR interface driver MSR-specific RAPL defaults differ from those used by the TPMI interface. The MMIO and MSR interfaces shared the same rapl_defaults pointer in the common driver, but MMIO does not require the CPU-specific variations needed by MSR. Keeping these in the common driver adds unnecessary complexity and MSR-specific initialization. Move MSR defaults and CPU matching into the MSR interface driver. Moves ----- * Move rapl_check_unit_atom(), set_floor_freq_atom(), and rapl_compute_time_window_atom() into intel_rapl_msr.c. * Move MSR unit-field GENMASK definitions and local constants. * Move all MSR-related rapl_defaults tables and the CPU-ID matching logic (rapl_ids[]) into the MSR driver. * Move iosf_mbi dependencies (floor-frequency control and related MBI register definitions) as they are MSR-platform specific. Modifications ------------- * Replace the common driver's platform-device manual alloc/add sequence with platform_device_register_data() in the MSR driver to pass matching rapl_defaults as platform_data. * Update MSR driver probe to assign pdev->dev.platform_data to priv->defaults. * Update Atom helper functions to use rp->lead_cpu directly for MSR reads/writes instead of the generic get_rid(). * Update Atom floor frequency logic to access defaults via the package private data pointer. * Convert MSR device creation from fs_initcall() to module_init(). This preserves existing enumeration behavior as the driver was already using module_init(). * Since rapl_ids need to exist after boot, remove __initconst specifier. No functional changes are expected. Co-developed-by: Zhang Rui Signed-off-by: Zhang Rui Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260331211950.3329932-2-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 9d3a068cc80c9ed374cb78ab8c861668c835a6bc Author: Julian Braha Date: Tue Mar 31 08:49:20 2026 +0100 cpuidle: clean up dead dependencies on CPU_IDLE in Kconfig The Kconfig in the parent directory already has the first 'if CPU_IDLE' gating the inclusion of this Kconfig, meaning that the 'depends on CPUIDLE' statements in these config options are effectively dead code. Leave the 'if CPU_IDLE...endif' condition, and remove the individual 'depends on' statements in Kconfig.mips and Kconfig.powerpc This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260331074920.41269-1-julianbraha@gmail.com Signed-off-by: Rafael J. Wysocki commit 2e00c2dcc5325af04e2dfbb29281ced1c724ab81 Author: Julian Braha Date: Tue Mar 31 08:42:42 2026 +0100 cpufreq: clean up dead code in Kconfig There is already an 'if CPU_FREQ' condition wrapping these config options, making the 'depends on' statement for each a duplicate dependency (dead code). Leave the outer 'if CPU_FREQ...endif' and remove the individual 'depends on' statement from each option. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha Acked-by: Viresh Kumar [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260331074242.39986-1-julianbraha@gmail.com Signed-off-by: Rafael J. Wysocki commit 9266b4da051a410d9e6c5c0b0ef0c877855aa1b8 Author: Viresh Kumar Date: Tue Mar 31 10:33:46 2026 +0530 cpufreq: Allocate QoS freq_req objects with policy A recent change exposed a bug in the error path: if freq_qos_add_request(boost_freq_req) fails, min_freq_req may remain a valid pointer even though it was never successfully added. During policy teardown, this leads to an unconditional call to freq_qos_remove_request(), triggering a WARN. The current design allocates all three freq_req objects together, making the lifetime rules unclear and error handling fragile. Simplify this by allocating the QoS freq_req objects at policy allocation time. The policy itself is dynamically allocated, and two of the three requests are always needed anyway. This ensures consistent lifetime management and eliminates the inconsistent state in failure paths. Reported-by: Zhongqiu Han Fixes: 6e39ba4e5a82 ("cpufreq: Add boost_freq_req QoS request") Signed-off-by: Viresh Kumar Reviewed-by: Lifeng Zheng Tested-by: Pierre Gondois Reviewed-by: Zhongqiu Han Link: https://patch.msgid.link/a293f29d841b86c51f34699c6e717e01858d8ada.1774933424.git.viresh.kumar@linaro.org Signed-off-by: Rafael J. Wysocki commit aeac022e4de78b20736d55acb98180c798a6a1ae Merge: c8ef13d692f19c b015ef4eaeff76 Author: Mark Brown Date: Wed Apr 1 14:53:29 2026 +0100 ASoC: tegra: Add error logging for probe and callback failures Sheetal says: Resend pending v3 patches with fixes and add remaining dev_err_probe() conversions. Patch 1 replaces v3 patch 03/14 (ADMAIF). Patch 2 replaces v3 patch 09/14 (OPE/PEQ/MBDRC). Patch 3 is new - adds regmap init conversions across 10 drivers. Patch 4 is new - adds clock error conversions in tegra_asoc_machine. commit b015ef4eaeff76466a359b3f53175fc11502fd8f Author: Sheetal Date: Wed Apr 1 11:25:00 2026 +0000 ASoC: tegra: Use dev_err_probe() in tegra_asoc_machine probe Use dev_err_probe() for clock errors in the tegra_asoc_machine probe path. Signed-off-by: Sheetal Link: https://patch.msgid.link/20260401112500.4076861-5-sheetal@nvidia.com Signed-off-by: Mark Brown commit 4a8fe27e122e5a1bb1896837ed47f99abaa965a0 Author: Sheetal Date: Wed Apr 1 11:24:59 2026 +0000 ASoC: tegra: Use dev_err_probe() for regmap init failures Use dev_err_probe() for regmap init failures in Tegra audio driver probe paths. Signed-off-by: Sheetal Link: https://patch.msgid.link/20260401112500.4076861-4-sheetal@nvidia.com Signed-off-by: Mark Brown commit 2333abb25c7e2ba823d2113b83a22be4c2ba63c1 Author: Sheetal Date: Wed Apr 1 11:24:58 2026 +0000 ASoC: tegra: Use dev_err_probe() in OPE, PEQ and MBDRC drivers Log errors in the Tegra210 OPE, PEQ and MBDRC probe paths using dev_err_probe(). Drop redundant dev_err() at tegra210_peq_regmap_init() and tegra210_mbdrc_regmap_init() call sites in ope_probe() since these functions already log errors internally. Signed-off-by: Sheetal Link: https://patch.msgid.link/20260401112500.4076861-3-sheetal@nvidia.com Signed-off-by: Mark Brown commit 00d6070ec02c55731c7655b3227edd8b84bbcdbc Author: Sheetal Date: Wed Apr 1 11:24:57 2026 +0000 ASoC: tegra: Add error logging in tegra210_admaif driver Log errors in the Tegra210 ADMAIF probe and runtime callback paths. Drop redundant dev_err() at tegra_isomgr_adma_register() call site since it already logs errors internally. Signed-off-by: Sheetal Link: https://patch.msgid.link/20260401112500.4076861-2-sheetal@nvidia.com Signed-off-by: Mark Brown commit bc20692f528b2ac8226bafe5b1db9a1f8be96dbf Author: Will Deacon Date: Tue Mar 31 16:50:55 2026 +0100 KVM: arm64: Don't hold 'vm_table_lock' across guest page reclaim Now that the teardown of a VM cannot be finalised as long as a reference is held on the VM, rework __pkvm_reclaim_dying_guest_page() to hold a reference to the dying VM rather than take the global 'vm_table_lock' during the reclaim operation. Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260331155056.28220-4-will@kernel.org Signed-off-by: Marc Zyngier commit 2400696883870ec3fb0fb9925426c62a3383ca36 Author: Will Deacon Date: Tue Mar 31 16:50:54 2026 +0100 KVM: arm64: Allow get_pkvm_hyp_vm() to take a reference to a dying VM Now that completion of the teardown path requires a refcount of zero for the target VM, we can allow get_pkvm_hyp_vm() to take a reference on a dying VM, which is necessary to unshare pages with a non-protected VM during the teardown process itself. Note that vCPUs belonging to a dying VM cannot be loaded and pages can only be reclaimed from a protected VM (via __pkvm_reclaim_dying_guest_page()) if the target VM is in the dying state. Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260331155056.28220-3-will@kernel.org Signed-off-by: Marc Zyngier commit 760299a1d8102b36bed5c25c5a3f94b5a0eee081 Author: Will Deacon Date: Tue Mar 31 16:50:53 2026 +0100 KVM: arm64: Prevent teardown finalisation of referenced 'hyp_vm' Destroying a 'hyp_vm' with an elevated referenced count in __pkvm_finalize_teardown_vm() is only going to lead to tears. In preparation for allowing limited references to be acquired on dying VMs during the teardown process, factor out the handle-to-vm logic for the teardown path and reuse it for both the 'start' and 'finalise' stages of the teardown process. Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260331155056.28220-2-will@kernel.org Signed-off-by: Marc Zyngier commit 00f0dadde8c5036fe6462621a6920549036dce70 Author: Nam Cao Date: Wed Apr 1 15:08:28 2026 +0200 rv: Allow epoll in rtapp-sleep monitor Since commit 0c43094f8cc9 ("eventpoll: Replace rwlock with spinlock"), epoll_wait is real-time-safe syscall for sleeping. Add epoll_wait to the list of rt-safe sleeping APIs. Signed-off-by: Nam Cao Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260401130828.3115428-1-namcao@linutronix.de Signed-off-by: Gabriele Monaco commit c8ef13d692f19cdbbf195fb845421a5b71801704 Author: Haoxiang Li Date: Wed Apr 1 13:30:51 2026 +0800 ASoC: mxs-sgtl5000: disable MCLK on error paths of mxs_sgtl5000_probe() Call mxs_saif_put_mclk() to disable MCLK on error paths of mxs_sgtl5000_probe(). Signed-off-by: Haoxiang Li Link: https://patch.msgid.link/20260401053051.586290-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Mark Brown commit 872c7433582a3570dd0c827967ba291450096bf0 Author: Cássio Gabriel Date: Wed Apr 1 08:45:37 2026 -0300 ALSA: es1688: add ISA suspend and resume callbacks The ISA ES1688 driver still carries a disabled suspend/resume block in its isa_driver definition, while the same file already provides minimal power-management handling for the PnP ES968 path. Add ISA-specific PM callbacks and factor the existing ES1688 suspend and resume sequence into common card-level helpers shared by both probe paths. Suspend moves the card to D3hot. Resume reinitializes the chip with snd_es1688_reset() and restores the card to D0, propagating reset failures to the caller. This wires up power-management callbacks for the ISA path and keeps the PM handling consistent between the ISA and PnP probe paths. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260401-alsa-es1688-pm-v1-1-510767628fe6@gmail.com Signed-off-by: Takashi Iwai commit 80449e1966cb9df57617a1d22bccd1e29cbc4222 Author: Harin Lee Date: Wed Apr 1 18:01:59 2026 +0900 ALSA: ctxfi: Precompute SRC allocation loop bound Replace the capability checks in the SRC and SRCIMP allocation loops with a precomputed loop bound. Cards with a dedicated mic input (SB1270, OK0010) allocate all NUM_ATC_SRCS entries, otherwise stop at 4. Signed-off-by: Harin Lee Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260401090159.2404387-4-me@harin.net commit 07b116b44e52d78af40c2d39a8e1e34ef1283d0d Author: Harin Lee Date: Wed Apr 1 18:01:58 2026 +0900 ALSA: ctxfi: Use correct DAIO type for da_desc Skip the unused DAIO type per model (SPDIFIO on CTSB073X, SPDIFI_BAY on all others) and use the correct DAIO type directly as da_desc type. This removes the mismatch and misleading between the actual DAIO resource and the da_desc type like SPDIFI_BAY (formerly SPDIFI1). Update related functions accordingly, and drop the unreachable SPDIFI_BAY case from the hw20k2 daio_device_index(). Signed-off-by: Harin Lee Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260401090159.2404387-3-me@harin.net commit c6cd83cceec5f2a1e2dd319d98640b1f0007d668 Author: Harin Lee Date: Wed Apr 1 18:01:57 2026 +0900 ALSA: ctxfi: Rename SPDIFI1 to SPDIFI_BAY Rename the SPDIFI1 enum value to SPDIFI_BAY to better reflect its purpose as the S/PDIF input on the internal drive bay, as opposed to the S/PDIF input via Flexijack or optical (SPDIFIO; not SPDIFI-zero). Signed-off-by: Harin Lee Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260401090159.2404387-2-me@harin.net commit 0542972950ef26670a5696e43c0ea2b7b6ac96d4 Merge: 579e7b820de5dd a0dafdbd1049a8 Author: Takashi Iwai Date: Wed Apr 1 14:42:56 2026 +0200 Merge branch 'for-linus' into for-next Pull 7.0 devel branch for further cleanups of ctxfi driver & co. Signed-off-by: Takashi Iwai commit 9b4f93a8b1a5d058ff42000a226fa3a237078425 Author: Kuninori Morimoto Date: Wed Apr 1 00:19:23 2026 +0000 ASoC: ak5558: remove unused snd_soc_component ak5558_priv::component has never been used. Remove it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/875x6bttv8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5a77906982df26975aa26caefb81b7d6f53d9b3f Author: Kuninori Morimoto Date: Wed Apr 1 00:19:06 2026 +0000 ASoC: soc.h: remove snd_soc_of_parse_audio_prefix() No one is using snd_soc_of_parse_audio_prefix(). Remove it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/877bqrttvp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5ac16e6593f46c1fa50183bd498228ef38a163be Merge: 08b67f170f4644 6ee3f20368a4a6 Author: Krzysztof Kozlowski Date: Wed Apr 1 13:38:29 2026 +0200 Merge tag 'nuvoton-arm64-7.1-devicetree-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt nuvoton: first batch of arm64 devicetree changes for v7.1 Just the one change this time, dropping syscon properties where they weren't defined. * tag 'nuvoton-arm64-7.1-devicetree-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux: arm64: dts: nuvoton: drop unused syscon property from watchdog node Signed-off-by: Krzysztof Kozlowski commit 08b67f170f4644213c645e35b79b2a9229b4f7ad Merge: dadfceb3bcc7a3 76b4ec8efdc388 Author: Krzysztof Kozlowski Date: Wed Apr 1 13:35:29 2026 +0200 Merge tag 'aspeed-7.1-devicetree-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt aspeed: first batch of devicetree changes for v7.1 New platforms: - Asus Kommando IPMI card - Asrock Paul IPMI card Updated platforms: - Anacapa (Meta): NFC and EEPROMs - MSX4 (Nvidia): 128M layout for the alternate boot flash * tag 'aspeed-7.1-devicetree-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux: ARM: dts: aspeed: anacapa: Add retimer EEPROMs ARM: dts: aspeed: anacapa: add NFC device ARM: dts: aspeed: Add Asrock Paul IPMI card dt-bindings: arm: aspeed: Add Asrock Paul IPMI card ARM: dts: aspeed: Add 128M alt flash layout to NVIDIA MSX4 ARM: dts: aspeed: Add Asus Kommando IPMI card dt-bindings: arm: aspeed: Add Asus Kommando IPMI card Signed-off-by: Krzysztof Kozlowski commit 9d862ccfda32755888e4a9a91d2bde04f8857ed7 Merge: cb400df12256d7 e91d5f94acf686 Author: Ulf Hansson Date: Wed Apr 1 13:34:40 2026 +0200 pmdomain: Merge branch fixes into next Merge the pmdomain fixes for v7.0-rc[n] into the next branch, to allow them to get tested together with the pmdomain changes that are targeted for the next release. Signed-off-by: Ulf Hansson commit cb400df12256d74c057a9eff7811574d4680dff2 Merge: 66ab322c618cd4 1877d3f258cbb5 Author: Ulf Hansson Date: Wed Apr 1 13:33:35 2026 +0200 pmdomain: Merge branch pmdomain into next Merge the immutable branch pmdomain into next to get the changes queued and tested for the next release. The pmdomain branch hosts minor core changes for pmdomain. Signed-off-by: Ulf Hansson commit 1877d3f258cbb57d64e275754fb9b18b089ce72d Author: Dmitry Baryshkov Date: Sun Feb 1 12:48:59 2026 +0200 PM: domains: De-constify fields in struct dev_pm_domain_attach_data It doesn't really make sense to keep u32 fields to be marked as const. Having the const fields prevents their modification in the driver. Instead the whole struct can be defined as const, if it is constant. Fixes: 161e16a5e50a ("PM: domains: Add helper functions to attach/detach multiple PM domains") Signed-off-by: Dmitry Baryshkov Signed-off-by: Ulf Hansson commit 66ab322c618cd4581917e2981ddece5db7fb52a3 Author: Rosen Penev Date: Sun Mar 15 14:41:53 2026 -0700 pmdomain: qcom: cpr: simplify main allocation Remove kcalloc by using a flexible array member to combine allocations. Signed-off-by: Rosen Penev Reviewed-by: Konrad Dybcio Signed-off-by: Ulf Hansson commit d797ecf3ffc5cc3e622bfee4cee6b17372c5bcc7 Author: Maíra Canal Date: Tue Mar 17 19:41:50 2026 -0300 pmdomain: bcm: bcm2835-power: Replace open-coded polling with readl_poll_timeout_atomic() Replace hand-rolled ktime_get_ns()/cpu_relax() polling loops with readl_poll_timeout_atomic() for the power-on (POWOK), and memory repair (MRDONE) waits. No functional change intended. Signed-off-by: Maíra Canal Signed-off-by: Ulf Hansson commit a46e905cd14a0a82b6f1fbf2f720fe5f13755050 Author: Yuanshen Cao Date: Thu Mar 5 03:34:08 2026 +0000 pmdomain: sunxi: Add support for A733 to Allwinner PCK600 driver The Allwinner A733 PCK600, similar to A523 PCK600, is likely a customized version of ARM PCK-600 power controller. It shares the same BSP driver with A523. According to the BSP provided by Radxa, unlike A523, it doesn't require reset, as well as a different pair of delay values. Make reset optional in the sunxi pck600 driver and add support for A733. Signed-off-by: Yuanshen Cao Reviewed-by: Chen-Yu Tsai # matched against BSP driver Acked-by: Jernej Skrabec Signed-off-by: Ulf Hansson commit f387ecdd492f64b6c4ab561095fbc02666262ef3 Author: Abel Vesa Date: Mon Mar 2 15:29:32 2026 +0200 pmdomain: qcom: rpmhpd: Add Eliza RPMh Power Domains Add RPMh Power Domains support for the Eliza platform. The list of power domains is taken from downstream. Even though the cmd-db does list MMCX and MXC, they are not used, so they should not be describe. Reviewed-by: Taniya Das Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Signed-off-by: Ulf Hansson commit 6c70e42fc4faf591c08aba6e5620343207ff55a9 Author: Ulf Hansson Date: Wed Mar 4 11:14:57 2026 +0100 pmdomain: arm: Add print after a successful probe for SCMI power domains It can be discussed how useful a print is after a successful probe. In the SCMI power domain case it's seems valuable, as it let us inform about the number of initialized power domains too, which is fetched from firmware. Therefore, let's add a print about this, which also aligns with the behaviour of the SCMI perf domain driver. Signed-off-by: Ulf Hansson Reviewed-by: Cristian Marussi Acked-by: Sudeep Holla commit 8d2cacb20eb1bc613839a3c0e375835c83fb629f Author: Chris Morgan Date: Fri Jan 30 10:31:01 2026 -0600 pmdomain: rockchip: quiet regulator error on -EPROBE_DEFER Change the dev_err() to dev_err_probe() under rockchip_pd_power_on() to prevent errors early in the boot process when the requested regulator is not yet available. This converts errors like the following to debug messages: rockchip-pm-domain fd8d8000.power-management:power-controller: Failed to enable supply: -517 Signed-off-by: Chris Morgan Tested-by: Diederik de Haas Reviewed-by: Anand Moon Reviewed-by: Shawn Lin Signed-off-by: Ulf Hansson commit 6734a5e86b57fb6f500aea08626bb9b42b6d5d05 Author: Irving-CH Lin Date: Mon Feb 2 14:48:15 2026 +0800 pmdomain: mediatek: Add power domain driver for MT8189 SoC Introduce a new power domain (pmd) driver for the MediaTek mt8189 SoC. This driver ports and refines the power domain framework, dividing hardware blocks (CPU, GPU, peripherals, etc.) into independent power domains for precise and energy-efficient power management. Signed-off-by: Irving-CH Lin Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Signed-off-by: Ulf Hansson commit 35e09ed76b7f1dcc1d0a8f0897cb77f0c2ab028e Author: Irving-CH Lin Date: Mon Feb 2 14:48:14 2026 +0800 pmdomain: mediatek: Add bus protect control flow for MT8189 In MT8189 mminfra power domain, the bus protect policy separates into two parts, one is set before subsys clocks enabled, and another need to enable after subsys clocks enable. Signed-off-by: Irving-CH Lin Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Signed-off-by: Ulf Hansson commit f67866701d74c4362b7ea74e7015922ad338375b Author: Ulf Hansson Date: Mon Jan 19 15:31:15 2026 +0100 pmdomain: core: Extend statistics for domain idle states with s2idle data To allow user space to monitor the selection of the domain idle state during s2idle for a CPU PM domain, let's extend the debugfs support in genpd with this information. Suggested-by: Dhruva Gole Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman Signed-off-by: Ulf Hansson commit 68831a9ef9d216985d6f51ea84a647a658ace9ba Author: Ulf Hansson Date: Mon Jan 19 15:31:14 2026 +0100 pmdomain: core: Show latency/residency for domain idle states in debugfs Similar to how cpuidle provides the values for latency and residency for CPU's idle states through sysfs, let's make the corresponding data for PM domain's idle states available for user space, via genpd's debugfs support. Suggested-by: Dhruva Gole Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman Signed-off-by: Ulf Hansson commit 32d731611a6e9d1456f9fa2c1ec7742f25190c61 Author: Ulf Hansson Date: Mon Jan 19 15:31:13 2026 +0100 pmdomain: core: Restructure domain idle states data for genpd in debugfs To prepare for additional information to be added for the domain idle states in genpd's debugfs, let's make the existing information denser. To allow that, let's move the static information of the domain idle states into a separate debugfs file. Reviewed-by: Kevin Hilman Signed-off-by: Ulf Hansson commit a8a1c77a5059e6dd98f55d3bcddb2f3c1f31a774 Author: Gabor Juhos Date: Wed Jan 21 17:18:25 2026 +0100 pmdomain: qcom: rpmpd: drop stray semicolon Drop the unnecessary semicolon after the rpmpd_send_corner() function's declaration. Signed-off-by: Gabor Juhos Reviewed-by: Konrad Dybcio Signed-off-by: Ulf Hansson commit c8e9b6a55702be6c6d034e973d519c52c3848415 Author: Felix Gu Date: Wed Jan 21 22:17:17 2026 +0800 pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device node. In imx_sc_pd_get_console_rsrc(), it does not release the reference. Fixes: 893cfb99734f ("firmware: imx: scu-pd: do not power off console domain") Signed-off-by: Felix Gu Reviewed-by: Peng Fan Signed-off-by: Ulf Hansson commit 44c28e1c52764fef6dd1c1ada3a248728812e67f Author: Felix Gu Date: Fri Jan 16 20:27:47 2026 +0800 pmdomain: ti: omap_prm: Fix a reference leak on device node When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device node. In omap_prm_domain_attach_dev, it does not release the reference. Fixes: 58cbff023bfa ("soc: ti: omap-prm: Add basic power domain support") Signed-off-by: Felix Gu Signed-off-by: Ulf Hansson commit 6d1fdcfeb026bc3efbe2f06bf2204152b21c401e Author: AngeloGioacchino Del Regno Date: Tue Jan 13 12:00:10 2026 +0100 pmdomain: mediatek: scpsys: Add MT7622 Audio power domain to legacy driver Add the Audio power domain of the MT7622 SoC to the legacy mtk-scpsys driver (as this legacy SoC is supported only there). Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Ulf Hansson commit ecd2f0eaffad8cb8245d11b64bb1ccc7a40da565 Author: Krzysztof Kozlowski Date: Fri Jan 2 13:48:41 2026 +0100 pmdomain: mediatek: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit adff6abbdcf9ecabd9bdf299ace6b5f85160e5f4 Author: Kendall Willis Date: Tue Dec 30 15:37:18 2025 -0600 pmdomain: ti_sci: handle wakeup constraint for out-of-band wakeup For devices capable of out-of-band system wakeups via I/O daisy chaining, prevent sending wakeup constraints to the PM co-processor. This allows the system to enter deeper low power modes, as the device is not marked as requiring power. Replaces the logic from commit b06bc4727991 ("pmdomain: ti_sci: handle wake IRQs for IO daisy chain wakeups") since checking out-of-band wakeup will cover the same functionality. Detect out-of-band wakeup in the suspend path, and if it exists, skip sending the constraint. Signed-off-by: Kendall Willis Signed-off-by: Ulf Hansson commit aeb6d7c676f9938e59798b4203e6bb4e8b9f6d2d Author: Nicolas Frattaroli Date: Sat Dec 20 19:49:55 2025 +0100 pmdomain: mediatek: mtk-mfg: Expose shader_present as nvmem cell Implement nvmem-provider functionality in mtk-mfg-pmdomain, such that it can expose its GF_REG_SHADER_PRESENT value in the shared memory as an nvmem cell for panthor. Signed-off-by: Nicolas Frattaroli Signed-off-by: Ulf Hansson commit 007028ed90564b75272d35199a767b2032677ed6 Author: Karel Balej Date: Sat Dec 13 09:48:13 2025 +0100 pmdomain: add audio power island for Marvell PXA1908 SoC Define power domain which needs to be enabled in order for audio to work on the PXA1908-based samsung,coreprimevelte smartphone. In the downstream code, this power-on method is marked as specific to the ULCx series which is allegedly a codename of sorts with ULC1 corresponding to the PXA1908. No other audio components needed for sound to work on this phone are currently available mainline but some successful testing was performed with the vendor variants of the respective drivers and with the domain forced always-on. Signed-off-by: Karel Balej Reviewed-by: Duje Mihanović Signed-off-by: Ulf Hansson commit 6cc5a233293a8de47a9f754c6cd70c7fa25e0312 Author: Marco Felsch Date: Mon Dec 15 20:18:27 2025 +0100 pmdomain: imx93-blk-ctrl: add support for optional subnodes This particular block can have DT subnodes describing the LVDS LDB, MIPI DSI and parallel DPI bridge. Scan for possible sub-devices within the driver, instead of misusing the simple-bus to perform the scan. Reviewed-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Marco Felsch Signed-off-by: Ulf Hansson commit 52becc142280eeef828d19f9cd01fd653b588786 Author: Marco Felsch Date: Mon Dec 15 20:18:26 2025 +0100 pmdomain: imx93-blk-ctrl: convert to devm_* only Convert the driver to devm_ APIs only by making use of devm_add_action_or_reset() and devm_pm_runtime_enable() to simplify the probe error path and to drop the .remove() callback. This also ensures that the device release order equals the device probe error path order. Furthermore drop the dev_set_drvdata() usage since the only user was the .remove() callback which is removed by this commit. Reviewed-by: Frank Li Signed-off-by: Marco Felsch Signed-off-by: Ulf Hansson commit 279eb2dd550f829e1497901146bd2214a28bcd88 Author: Marco Felsch Date: Mon Dec 15 20:18:25 2025 +0100 pmdomain: imx93-blk-ctrl: cleanup error path Call dev_err_probe() directly during return to make the code more compact. Reviewed-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Marco Felsch Signed-off-by: Ulf Hansson commit f151e47d190f1b6c3486dbcb0b66858644c8627d Merge: 7aaa8047eafd0b f287826fd7e406 Author: Ulf Hansson Date: Wed Apr 1 13:04:25 2026 +0200 pmdomain: Merge branch dt into next Merge the immutable branch dt into next, to allow the updated DT bindings to be tested together with the pmdomain changes that are targeted for the next release. Signed-off-by: Ulf Hansson commit 8f3481028b05e3418b6fe7119428ab44a5b2eb20 Author: Mohamad Alsadhan Date: Tue Mar 17 17:49:47 2026 +0300 rust_binder: add `command`/`return` tracepoints Add Rust Binder `command` and `return` tracepoint declarations and wire them in where BC commands are parsed and BR return codes are emitted to userspace. Signed-off-by: Mohamad Alsadhan Link: https://patch.msgid.link/20260317-rust-binder-trace-v3-6-6fae4fbcf637@sdhn.cc Signed-off-by: Greg Kroah-Hartman commit 25917c05ab477bf60f8cf09acb1e9e89de3df61f Author: Mohamad Alsadhan Date: Tue Mar 17 17:49:46 2026 +0300 rust_binder: add fd translation tracepoints Add Rust Binder tracepoint declarations for both `transaction_fd_send` and `transaction_fd_recv`. Also, wire in the corresponding trace calls where fd objects are serialised/deserialised. Signed-off-by: Mohamad Alsadhan Link: https://patch.msgid.link/20260317-rust-binder-trace-v3-5-6fae4fbcf637@sdhn.cc Signed-off-by: Greg Kroah-Hartman commit caf3719f335dac62e5626baadb66836907176337 Author: Mohamad Alsadhan Date: Tue Mar 17 17:49:45 2026 +0300 rust_binder: add `transaction_received` tracepoint Add Rust Binder `transaction_received` tracepoint decalaration and wire in the corresponding trace call when a transaction work item is accepted for execution. Signed-off-by: Mohamad Alsadhan Link: https://patch.msgid.link/20260317-rust-binder-trace-v3-4-6fae4fbcf637@sdhn.cc Signed-off-by: Greg Kroah-Hartman commit 2335167a614eceb506453dc27cc99a186b6eca76 Author: Mohamad Alsadhan Date: Tue Mar 17 17:49:44 2026 +0300 rust_binder: add `wait_for_work` tracepoint Add the Rust Binder `wait_for_work` tracepoint declaration and wire it into the thread read path before selecting the work source. Signed-off-by: Mohamad Alsadhan Link: https://patch.msgid.link/20260317-rust-binder-trace-v3-3-6fae4fbcf637@sdhn.cc Signed-off-by: Greg Kroah-Hartman commit be3953bb2655fe4571a1b2cd1705bcc5a241a58e Author: Mohamad Alsadhan Date: Tue Mar 17 17:49:43 2026 +0300 rust_binder: add ioctl/read/write done tracepoints Add Rust Binder tracepoints declarations for `ioctl_done`, `read_done` and `write_done`. Additionally, wire in the new tracepoints into the corresponding Binder call sites. Note that the new tracepoints report final errno-style return values, matching the existing C model for operation completion. Signed-off-by: Mohamad Alsadhan Link: https://patch.msgid.link/20260317-rust-binder-trace-v3-2-6fae4fbcf637@sdhn.cc Signed-off-by: Greg Kroah-Hartman commit e3007a92332d15b085c5d1157ffeea26f03f0aa6 Author: Mohamad Alsadhan Date: Tue Mar 17 17:49:42 2026 +0300 rust_binder: remove "rust_" prefix from tracepoints Remove the "rust_" prefix as the name is part of the uapi, and userspace expects tracepoints to have the old names. Link: https://github.com/Rust-for-Linux/linux/issues/1226 Suggested-by: Alice Ryhl Reviewed-by: Alice Ryhl Signed-off-by: Mohamad Alsadhan Link: https://patch.msgid.link/20260317-rust-binder-trace-v3-1-6fae4fbcf637@sdhn.cc Signed-off-by: Greg Kroah-Hartman commit f698a253e3936ed516aa234495861eb707d608b9 Author: Pedro Montes Alcalde Date: Fri Mar 27 22:02:51 2026 -0300 rust_binder: drop startup init log message The "Loaded Rust Binder." message is logged during normal initialization and does not indicate an error/warning condition. Logging it creates unnecessary noise and is inconsistent with other drivers, so this change fixes that Signed-off-by: Pedro Montes Alcalde Acked-by: Carlos Llamas Acked-by: Alice Ryhl Link: https://patch.msgid.link/20260328010250.249131-2-pedro.montes.alcalde@gmail.com Signed-off-by: Greg Kroah-Hartman commit fc74559e2dd4405492102ada28afa60d012a662f Author: Alice Ryhl Date: Tue Mar 24 20:02:38 2026 +0000 rust_binder: check current before closing fds This list gets populated once the transaction is delivered to the target process, at which point it's not touched again except in BC_FREE_BUFFER and process exit, so if the list has been populated then this code should not run in the context of the wrong userspace process. However, why tempt fate? The function itself can run in the context of both the sender and receiver, and if someone can engineer a scenario where it runs in the sender and this list is non-empty (or future Rust Binder changes make such a scenario possible), then that'd be a problem because we'd be closing random unrelated fds in the wrong process. Note that on process exit, the == comparison may actually fail because it's called from a kthread. The fd closing code is a no-op on kthreads, so there is no actual behavior different though. Suggested-by: Jann Horn Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260324-close-fd-check-current-v3-4-b94274bedac7@google.com Signed-off-by: Greg Kroah-Hartman commit ed72cfffc491c88996addd387586234dd8141ee4 Author: Alice Ryhl Date: Tue Mar 24 20:02:37 2026 +0000 rust_binder: make use of == for Task Now that we have implemented the == operator for Task, replace the two raw pointer comparisons in Binder with the == operator. Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260324-close-fd-check-current-v3-3-b94274bedac7@google.com Signed-off-by: Greg Kroah-Hartman commit 12c688086f091c24e62504f5a26c009a6a8dd8bc Author: Alice Ryhl Date: Tue Mar 24 20:02:36 2026 +0000 rust: task: implement == operator for Task It's useful to compare if two tasks are the same task or not. Rust Binder wants this to check if a certain task is equal to the group leader of current. Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260324-close-fd-check-current-v3-2-b94274bedac7@google.com Signed-off-by: Greg Kroah-Hartman commit 18e9fafb2672cb976edfe51e899484c2ea892170 Author: Alice Ryhl Date: Tue Mar 24 20:02:35 2026 +0000 rust: sync: implement == operator for ARef Rust Binder wants to perform a comparison between ARef and &Task, so define the == operator for ARef<_> when compared with another ARef<_> or just a reference. The operator is implemented in terms of the same operator applied to the inner type. Note that PartialEq cannot be implemented because it would overlap with the impl for ARef. Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260324-close-fd-check-current-v3-1-b94274bedac7@google.com Signed-off-by: Greg Kroah-Hartman commit aff12041b4b2f4f2c164a0cf1b9688408515d036 Author: Horst Birthelmer Date: Fri Mar 27 18:28:54 2026 +0100 fuse: fix inode initialization race Fix a race between fuse_iget() and fuse_reverse_inval_inode() where invalidation can arrive while an inode is being initialized, causing the invalidation to be lost. By keeping the inode state I_NEW as long as the attributes are not valid the invalidation can wait until the inode is fully initialized. Suggested-by: Joanne Koong Signed-off-by: Horst Birthelmer Signed-off-by: Miklos Szeredi commit 36776b7f8a8955b4e75b5d490a75fee0c7a2a7ef Author: Geert Uytterhoeven Date: Tue Mar 31 17:21:43 2026 +0200 lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() print_hex_dump_bytes() claims to be a simple wrapper around print_hex_dump(), but it actally calls print_hex_dump_debug(), which means no output is printed if (dynamic) DEBUG is disabled. Update the documentation to match the implementation. Fixes: 091cb0994edd20d6 ("lib/hexdump: make print_hex_dump_bytes() a nop on !DEBUG builds") Signed-off-by: Geert Uytterhoeven Reviewed-by: Petr Mladek Link: https://patch.msgid.link/3d5c3069fd9102ecaf81d044b750cd613eb72a08.1774970392.git.geert+renesas@glider.be Signed-off-by: Petr Mladek commit 579e7b820de5dd5124585413bb5e9c278d255436 Author: wangdicheng Date: Wed Apr 1 16:26:25 2026 +0800 ALSA: hda/cmedia: Remove duplicate pin configuration parsing The cmedia_probe() function calls snd_hda_parse_pin_defcfg() and snd_hda_gen_parse_auto_config() twice unnecessarily. Remove The duplicate code. Fixes: 0f1e8306dcbe ("ALSA: hda/cmedia: Rewrite to new probe method") Signed-off-by: wangdicheng Link: https://patch.msgid.link/20260401082625.157868-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit 59bd1d914bb51ab99a33ce32420403ccd035ad29 Author: Mike Rapoport (Microsoft) Date: Mon Mar 23 09:48:36 2026 +0200 memblock: warn when freeing reserved memory before memory map is initialized When CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled, freeing of reserved memory before the memory map is fully initialized in deferred_init_memmap() would cause access to uninitialized struct pages and may crash when accessing spurious list pointers, like was recently discovered during discussion about memory leaks in x86 EFI code [1]. The trace below is from an attempt to call free_reserved_page() before page_alloc_init_late(): [ 0.076840] BUG: unable to handle page fault for address: ffffce1a005a0788 [ 0.078226] #PF: supervisor read access in kernel mode [ 0.078226] #PF: error_code(0x0000) - not-present page [ 0.078226] PGD 0 P4D 0 [ 0.078226] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI [ 0.078226] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.68-92.123.amzn2023.x86_64 #1 [ 0.078226] Hardware name: Amazon EC2 t3a.nano/, BIOS 1.0 10/16/2017 [ 0.078226] RIP: 0010:__list_del_entry_valid_or_report+0x32/0xb0 ... [ 0.078226] __free_one_page+0x170/0x520 [ 0.078226] free_pcppages_bulk+0x151/0x1e0 [ 0.078226] free_unref_page_commit+0x263/0x320 [ 0.078226] free_unref_page+0x2c8/0x5b0 [ 0.078226] ? srso_return_thunk+0x5/0x5f [ 0.078226] free_reserved_page+0x1c/0x30 [ 0.078226] memblock_free_late+0x6c/0xc0 Currently there are not many callers of free_reserved_area() and they all appear to be at the right timings. Still, in order to protect against problematic code moves or additions of new callers add a warning that will inform that reserved pages cannot be freed until the memory map is fully initialized. [1] https://lore.kernel.org/all/e5d5a1105d90ee1e7fe7eafaed2ed03bbad0c46b.camel@kernel.crashing.org/ Link: https://patch.msgid.link/20260323074836.3653702-10-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit 87ce9e83ab8be5daf64351cd481ffa6537778e6b Author: Mike Rapoport (Microsoft) Date: Mon Mar 23 09:48:35 2026 +0200 memblock, treewide: make memblock_free() handle late freeing It shouldn't be responsibility of memblock users to detect if they free memory allocated from memblock late and should use memblock_free_late(). Make memblock_free() and memblock_phys_free() take care of late memory freeing and drop memblock_free_late(). Link: https://patch.msgid.link/20260323074836.3653702-9-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit b2129a39511b71b5ed0ae923d6eebd9398c6184e Author: Mike Rapoport (Microsoft) Date: Mon Mar 23 09:48:34 2026 +0200 memblock: make free_reserved_area() update memblock if ARCH_KEEP_MEMBLOCK=y On architectures that keep memblock after boot, freeing of reserved memory with free_reserved_area() is paired with an update of memblock arrays, usually by a call to memblock_free(). Make free_reserved_area() directly update memblock.reserved when ARCH_KEEP_MEMBLOCK is enabled. Remove the now-redundant explicit memblock_free() call from arm64::free_initmem() and the #ifdef CONFIG_ARCH_KEEP_MEMBLOCK block from the generic free_initrd_mem(). Link: https://patch.msgid.link/20260323074836.3653702-8-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit 7fbc5e26123e5fee1f0eb59e6fabf5ce4cf4f475 Author: Mike Rapoport (Microsoft) Date: Mon Mar 23 09:48:33 2026 +0200 memblock: extract page freeing from free_reserved_area() into a helper There are two functions that release pages to the buddy allocator late in the boot: free_reserved_area() and memblock_free_late(). Currently they are using different underlying functionality, free_reserved_area() runs each page being freed via free_reserved_page() and memblock_free_late() uses memblock_free_pages() -> __free_pages_core(), but in the end they both boil down to a loop that frees a range page by page. Extract the loop frees pages from free_reserved_area() into a helper and use that helper in memblock_free_late(). Link: https://patch.msgid.link/20260323074836.3653702-7-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit b8de9573e6aea8e0be666288ee4427eb07369187 Author: Mike Rapoport (Microsoft) Date: Mon Mar 23 09:48:32 2026 +0200 memblock: make free_reserved_area() more robust There are two potential problems in free_reserved_area(): * it may free a page with not-existent buddy page * it may be passed a virtual address from an alias mapping that won't be properly translated by virt_to_page(), for example a symbol on arm64 While first issue is quite theoretical and the second one does not manifest itself because all the callers do the right thing, it is easy to make free_reserved_area() robust enough to avoid these potential issues. Replace the loop by virtual address with a loop by pfn that uses for_each_valid_pfn() and use __pa() or __pa_symbol() depending on the virtual mapping alias to correctly determine the loop boundaries. Link: https://patch.msgid.link/20260323074836.3653702-6-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit 0510bdab538e2af07a67bc58a0c6c4547b83f8d5 Author: Mike Rapoport (Microsoft) Date: Mon Mar 23 09:48:31 2026 +0200 mm: move free_reserved_area() to mm/memblock.c free_reserved_area() is related to memblock as it frees reserved memory back to the buddy allocator, similar to what memblock_free_late() does. Move free_reserved_area() to mm/memblock.c to prepare for further consolidation of the functions that free reserved memory. No functional changes. Link: https://patch.msgid.link/20260323074836.3653702-5-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Vlastimil Babka (SUSE) commit 8ff5d8f2008889bb6f46125d5a0638e8749e29bd Author: Mike Rapoport (Microsoft) Date: Mon Mar 23 09:48:30 2026 +0200 powerpc: opal-core: pair alloc_pages_exact() with free_pages_exact() opal-core allocates buffers with alloc_pages_exact(), but then marks them as reserved and frees using free_reserved_area(). This is completely unnecessary and the pages allocated with alloc_pages_exact() can be naturally freed with free_pages_exact(). Replace freeing of memory in opalcore_cleanup() with free_pages_exact() and simplify allocation code so that it won't mark allocated pages as reserved. Link: https://patch.msgid.link/20260323074836.3653702-4-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit 25ee3aff9996f22e1b8b27fb284efb285e2fb025 Author: Mike Rapoport (Microsoft) Date: Mon Mar 23 09:48:29 2026 +0200 powerpc: fadump: pair alloc_pages_exact() with free_pages_exact() fadump allocates buffers with alloc_pages_exact(), but then marks them as reserved and frees using free_reserved_area(). This is completely unnecessary and the pages allocated with alloc_pages_exact() can be naturally freed with free_pages_exact(). Replace freeing of memory in fadump_free_buffer() with free_pages_exact() and simplify allocation code so that it won't mark allocated pages as reserved. Link: https://patch.msgid.link/20260323074836.3653702-3-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit c12c3e1507809ad1fc0448f51c933f52e17d13cd Author: Mike Rapoport (Microsoft) Date: Mon Mar 23 09:48:28 2026 +0200 memblock: reserve_mem: fix end caclulation in reserve_mem_release_by_name() free_reserved_area() expects end parameter to point to the first address after the area, but reserve_mem_release_by_name() passes it the last address inside the area. Remove subtraction of one in calculation of the area end. Fixes: 74e2498ccf7b ("mm/memblock: Add reserved memory release function") Link: https://patch.msgid.link/20260323074836.3653702-2-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit 8b7b85384fad6e21e8a28628e7ebacb5a6329de4 Author: Mike Rapoport (Microsoft) Date: Mon Mar 23 09:20:42 2026 +0200 memblock: move reserve_bootmem_range() to memblock.c and make it static reserve_bootmem_region() is only called from memmap_init_reserved_pages() and it was in mm/mm_init.c because of its dependecies on static init_deferred_page(). Since init_deferred_page() is not static anymore, move reserve_bootmem_region(), rename it to memmap_init_reserved_range() and make it static. Update the comment describing it to better reflect what the function does and drop bogus comment about reserved pages in free_bootmem_page(). Update memblock test stubs to reflect the core changes. Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: David Hildenbrand (Arm) Link: https://patch.msgid.link/20260323072042.3651061-1-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit 0709682cdb4ac77e3f78ea9c10d7f74b41a12518 Author: Guilherme G. Piccoli Date: Mon Mar 23 22:22:18 2026 -0300 memblock: Add reserve_mem debugfs info When using the "reserve_mem" parameter, users aim at having an area that (hopefully) persists across boots, so pstore infrastructure (like ramoops module) can make use of that to save oops/ftrace logs, for example. There is no easy way to determine if this kernel parameter is properly set though; the kernel doesn't show information about this memory in memblock debugfs, neither in /proc/iomem nor dmesg. This is a relevant information for tools like kdumpst[0], to determine if it's reliable to use the reserved area as ramoops persistent storage; checking only /proc/cmdline is not sufficient as it doesn't tell if the reservation effectively succeeded or not. Add here a new file under memblock debugfs showing properly set memory reservations, with name and size as passed to "reserve_mem". Notice that if no "reserve_mem=" is passed on command-line or if the reservation attempts fail, the file is not created. [0] https://aur.archlinux.org/packages/kdumpst Reviewed-by: SeongJae Park Signed-off-by: Guilherme G. Piccoli Link: https://patch.msgid.link/20260324012839.1991765-2-gpiccoli@igalia.com Signed-off-by: Mike Rapoport (Microsoft) commit f7f4a21c2a51710a06965cc9c1252821fc925544 Author: Guilherme G. Piccoli Date: Mon Mar 23 22:22:17 2026 -0300 memblock: Print out errors on reserve_mem parser The parsing of kernel parameter "reserve_mem=" is subject to multiple failures, like duplicate naming, malformed expression or even lack of available memory. Right now, all of these fail silently. Let's add some messages so the kernel log can provide useful information in case of failures. Reviewed-by: SeongJae Park Signed-off-by: Guilherme G. Piccoli Link: https://patch.msgid.link/20260324012839.1991765-1-gpiccoli@igalia.com Signed-off-by: Mike Rapoport (Microsoft) commit bf86059874ab651eaba9e6e0dd9aa0bc072d2648 Author: Wander Lairson Costa Date: Mon Feb 23 13:18:02 2026 -0300 rv/rvgen: fix _fill_states() return type annotation The _fill_states() method returns a list of strings, but the type annotation incorrectly specified str. Update the annotation to list[str] to match the actual return value. Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-20-wander@redhat.com Signed-off-by: Gabriele Monaco commit 5d98f7f5b96c4abc9325c0d851b7d287d24aee93 Author: Wander Lairson Costa Date: Mon Feb 23 13:18:01 2026 -0300 rv/rvgen: fix unbound loop variable warning Pyright static analysis reports a "possibly unbound variable" warning for the loop variable `i` in the `abbreviate_atoms` function. The variable is accessed after the inner loop terminates to slice the atom string. While the loop logic currently ensures execution, the analyzer flags the reliance on the loop variable persisting outside its scope. Refactor the prefix length calculation into a nested `find_share_length` helper function. This encapsulates the search logic and uses explicit return statements, ensuring the length value is strictly defined. This satisfies the type checker and improves code readability without altering the runtime behavior. Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-19-wander@redhat.com Signed-off-by: Gabriele Monaco commit 957dcbf0b663385dddb3eaa5cf5de5109255696f Author: Wander Lairson Costa Date: Mon Feb 23 13:18:00 2026 -0300 rv/rvgen: enforce presence of initial state The __get_state_variables() method parses DOT files to identify the automaton's initial state. If the input file lacks a node with the required initialization prefix, the initial_state variable is referenced before assignment, causing an UnboundLocalError or a generic error during the state removal step. Initialize the variable explicitly and validate that a start node was found after parsing. Raise a descriptive AutomataError if the definition is missing to improve debugging and ensure the automaton is valid. Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-18-wander@redhat.com Signed-off-by: Gabriele Monaco commit 2074723f518173cbad400a48021971cb82481e81 Author: Wander Lairson Costa Date: Mon Feb 23 13:17:59 2026 -0300 rv/rvgen: extract node marker string to class constant Add a node_marker class constant to the Automata class to replace the hardcoded "{node" string literal used throughout the DOT file parsing logic. This follows the existing pattern established by the init_marker and invalid_state_str class constants in the same class. The "{node" string is used as a marker to identify node declaration lines in DOT files during state variable extraction and cursor positioning. Extracting it to a named constant improves code maintainability and makes the marker's purpose explicit. Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-17-wander@redhat.com Signed-off-by: Gabriele Monaco commit 8aee49c5a53a57014af08de6687a67de7fb679d8 Author: Wander Lairson Costa Date: Mon Feb 23 13:17:58 2026 -0300 rv/rvgen: fix isinstance check in Variable.expand() The Variable.expand() method in ltl2ba.py performs contradiction detection by checking if a negated variable already exists in the graph node's old set. However, the isinstance check was incorrectly testing the ASTNode wrapper instead of the wrapped operator, causing the check to always return False. The old set contains ASTNode instances which wrap LTL operators via their .op attribute. The fix changes isinstance(f, NotOp) to isinstance(f.op, NotOp) to correctly examine the wrapped operator type. This follows the established pattern used elsewhere in the file, such as the iteration at lines 572-574 which accesses o.op.is_temporal() on items from node.old. Signed-off-by: Wander Lairson Costa Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260223162407.147003-16-wander@redhat.com Signed-off-by: Gabriele Monaco commit d7ee96234b2ae6ed86a68f5e3792cb17829698ef Author: Wander Lairson Costa Date: Mon Feb 23 13:17:57 2026 -0300 rv/rvgen: make monitor arguments required in rvgen Add required=True to the monitor subcommand arguments for class, spec, and monitor_type in rvgen. These arguments are essential for monitor generation and attempting to run without them would cause AttributeError exceptions later in the code when the script tries to access them. Making these arguments explicitly required provides clearer error messages to users at parse time rather than cryptic exceptions during execution. This improves the user experience by catching missing arguments early with helpful usage information. Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260223162407.147003-15-wander@redhat.com Signed-off-by: Gabriele Monaco commit 1b615bb0f0bf0290302ad8d37ecf7e1e0102e5b4 Author: Wander Lairson Costa Date: Mon Feb 23 13:17:56 2026 -0300 rv/rvgen: remove unused __get_main_name method The __get_main_name() method in the generator module is never called from anywhere in the codebase. Remove this dead code to improve maintainability. Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-14-wander@redhat.com Signed-off-by: Gabriele Monaco commit 0f57f9ad9fbef9a51438ca4153a4059d8169fc1e Author: Wander Lairson Costa Date: Mon Feb 23 13:17:55 2026 -0300 rv/rvgen: remove unused sys import from dot2c The sys module was imported in the dot2c frontend script but never used. This import was likely left over from earlier development or copied from a template that required sys for exit handling. Remove the unused import to clean up the code and satisfy linters that flag unused imports as errors. Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-13-wander@redhat.com Signed-off-by: Gabriele Monaco commit 0c25d8c8dcdde32db8f8c0c3a42c7e8ff2803a0f Author: Wander Lairson Costa Date: Mon Feb 23 13:17:54 2026 -0300 rv/rvgen: refactor automata.py to use iterator-based parsing Refactor the DOT file parsing logic in automata.py to use Python's iterator-based patterns instead of manual cursor indexing. The previous implementation relied on while loops with explicit cursor management, which made the code prone to off-by-one errors and would crash on malformed input files containing empty lines. The new implementation uses enumerate and itertools.islice to iterate over lines, eliminating manual cursor tracking. Functions that search for specific markers now use for loops with early returns and explicit AutomataError exceptions for missing markers, rather than assuming the markers exist. Additional bounds checking ensures that split line arrays have sufficient elements before accessing specific indices, preventing IndexError exceptions on malformed DOT files. The matrix creation and event variable extraction methods now use functional patterns with map combined with itertools.islice, making the intent clearer while maintaining the same behavior. Minor improvements include using extend instead of append in a loop, adding empty file validation, and replacing enumerate with range where the enumerated value was unused. Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-12-wander@redhat.com Signed-off-by: Gabriele Monaco commit d474fedcc53aebd584dfc1a42ccb78329ca68aa0 Author: Wander Lairson Costa Date: Mon Feb 23 13:17:53 2026 -0300 rv/rvgen: use class constant for init marker Replace hardcoded string literal and magic number with a class constant for the initial state marker in DOT file parsing. The previous implementation used the magic string "__init_" directly in the code along with a hardcoded length of 7 for substring extraction, which made the code less maintainable and harder to understand. This change introduces a class constant init_marker to serve as a single source of truth for the initial state prefix. The code now uses startswith() for clearer intent and calculates the substring position dynamically using len(), eliminating the magic number. If the marker value needs to change in the future, only the constant definition requires updating rather than multiple locations in the code. The refactoring improves code readability and maintainability while preserving the exact same runtime behavior. Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260223162407.147003-11-wander@redhat.com Signed-off-by: Gabriele Monaco commit 5d5a7d88185bc7c99328a29498efb3154e2d23d7 Author: Wander Lairson Costa Date: Mon Feb 23 13:17:52 2026 -0300 rv/rvgen: fix DOT file validation logic error Fix incorrect boolean logic in automata DOT file format validation that allowed malformed files to pass undetected. The previous implementation used a logical AND operator where OR was required, causing the validation to only reject files when both the first token was not "digraph" AND the second token was not "state_automaton". This meant a file starting with "digraph" but having an incorrect second token would incorrectly pass validation. The corrected logic properly rejects DOT files where either the first token is not "digraph" or the second token is not "state_automaton", ensuring that only properly formatted automaton definition files are accepted for processing. Without this fix, invalid DOT files could cause downstream parsing failures or generate incorrect C code for runtime verification monitors. Signed-off-by: Wander Lairson Costa Reviewed-by: Nam Cao Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-10-wander@redhat.com Signed-off-by: Gabriele Monaco commit 0d5c9f1091350328d903f4aed5de31f493a2f55b Author: Wander Lairson Costa Date: Mon Feb 23 13:17:51 2026 -0300 rv/rvgen: fix PEP 8 whitespace violations Fix whitespace violations throughout the rvgen codebase to comply with PEP 8 style guidelines. The changes address missing whitespace after commas, around operators, and in collection literals that were flagged by pycodestyle. The fixes include adding whitespace after commas in string replace chains and function arguments, adding whitespace around arithmetic operators, removing extra whitespace in list comprehensions, and fixing dictionary literal spacing. These changes improve code readability and consistency with Python coding standards. Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260223162407.147003-9-wander@redhat.com Signed-off-by: Gabriele Monaco commit 76ad28af8e6b23e39bf7e1342887533db4271ae9 Author: Wander Lairson Costa Date: Mon Feb 23 13:17:50 2026 -0300 rv/rvgen: fix typos in automata and generator docstring and comments Fix two typos in the Automata class documentation that have been present since the initial implementation. Fix the class docstring: "part it" instead of "parses it". Additionally, a comment describing transition labels contained the misspelling "lables" instead of "labels". Fix a typo in the comment describing the insertion of the initial state into the states list: "bein og" should be "beginning of". Fix typo in the module docstring: "Abtract" should be "Abstract". Fix several occurrences of "automata" where it should be the singular form "automaton". Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-8-wander@redhat.com Signed-off-by: Gabriele Monaco commit 5ed060d5491597490fb53ec69da3edc4b1e8c165 Author: Cássio Gabriel Date: Tue Mar 31 18:14:04 2026 -0300 ALSA: aoa: i2sbus: clear stale prepared state The i2sbus PCM code uses pi->active to constrain the sibling stream to an already prepared duplex format and rate in i2sbus_pcm_open(). That state is set from i2sbus_pcm_prepare(), but the current code only clears it on close. As a result, the sibling stream can inherit stale constraints after the prepared state has been torn down. Clear pi->active when hw_params() or hw_free() tears down the prepared state, and set it again only after prepare succeeds. Replace the stale FIXME in the duplex constraint comment with a description of the current driver behavior: i2sbus still programs a single shared transport configuration for both directions, so mixed formats are not supported in duplex mode. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604010125.AvkWBYKI-lkp@intel.com/ Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260331-aoa-i2sbus-clear-stale-active-v2-1-3764ae2889a1@gmail.com Signed-off-by: Takashi Iwai commit 1c18a1212c772b6a19e8583f2fca73f3a47b60fd Author: Jason Gunthorpe Date: Thu Mar 26 16:30:32 2026 -0300 iommu/dma: Always allow DMA-FQ when iommupt provides the iommu_domain iommupt always supports the semantics required for DMA-FQ, when drivers are converted to use it they automatically get support. Detect iommpt directly instead of using IOMMU_CAP_DEFERRED_FLUSH and remove IOMMU_CAP_DEFERRED_FLUSH from converted drivers. This will also enable DMA-FQ on RISC-V. Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Signed-off-by: Joerg Roedel commit 50b4927288144fbd2f947b0e4c0ef32949587e67 Merge: 572a36d279d664 581281cb5a1b72 Author: Marc Kleine-Budde Date: Mon Mar 30 12:41:36 2026 +0200 Merge patch series "can: refactor USB endpoint lookups" Johan Hovold says: Use the common USB helper for looking up bulk and interrupt endpoints instead of open coding. Link: https://patch.msgid.link/20260330101817.1664787-1-johan@kernel.org Signed-off-by: Marc Kleine-Budde commit 572a36d279d66487bedb55fc9fb5cce29df72905 Merge: 11d94d3516c0c5 ae20301b611925 Author: Marc Kleine-Budde Date: Tue Mar 24 09:22:48 2026 +0100 Merge patch series "can: mcp251xfd: add XSTBYEN transceiver standby control" Viken Dadhaniya says: The MCP251xFD provides a dedicated transceiver standby control function via the INT0/GPIO0/XSTBY pin, controlled by the XSTBYEN bit in IOCON. When enabled, the hardware automatically drives the pin low while the controller is active and high when it enters Sleep mode, allowing automatic standby control of an external CAN transceiver without software intervention. This series adds driver support for the XSTBYEN-based transceiver standby control feature. Tested on QCS6490 RB3 Gen2 with a PCAN-USB FD adapter: the transceiver is active in normal mode, CAN communication works correctly, and the pin is automatically managed across sleep and wake transitions. Link: https://patch.msgid.link/20260321135031.3107408-1-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Marc Kleine-Budde commit 581281cb5a1b72fe31ab67e0074feabb1b5abcc7 Author: Johan Hovold Date: Mon Mar 30 12:18:17 2026 +0200 can: ucan: refactor endpoint lookup Use the common USB helpers for looking up bulk and interrupt endpoints (and determining endpoint numbers and max packet sizes) instead of open coding. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260330101817.1664787-3-johan@kernel.org Signed-off-by: Marc Kleine-Budde commit 11d94d3516c0c549752061b6a576e6c547d61e86 Author: Geert Uytterhoeven Date: Thu Mar 5 11:14:37 2026 +0100 can: rcar_can: Convert to FIELD_MODIFY() Use the FIELD_MODIFY() helper instead of open-coding the same operation. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/ee2e6aaacd5e061c972716ecaf8a929be7ef5f2e.1772705647.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit ae20301b6119257f533332836c46d8e8824433dd Author: Viken Dadhaniya Date: Sat Mar 21 19:20:31 2026 +0530 can: mcp251xfd: add support for XSTBYEN transceiver standby control The MCP251xFD has a dedicated transceiver standby control function on the INT0/GPIO0/XSTBY pin, controlled by the XSTBYEN bit in IOCON. When enabled, the hardware automatically manages the transceiver standby state: the pin is driven low when the controller is active and high when it enters Sleep mode. Enable this feature when the 'microchip,xstbyen' device tree property is present. Signed-off-by: Viken Dadhaniya Link: https://patch.msgid.link/20260321135031.3107408-3-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Marc Kleine-Budde commit 495fac90b8ec3d6de11539b2b05c55ba360586ab Author: Johan Hovold Date: Mon Mar 30 12:18:16 2026 +0200 can: kvaser_usb: leaf: refactor endpoint lookup Use the common USB helper for looking up bulk and interrupt endpoints instead of open coding. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260330101817.1664787-2-johan@kernel.org Signed-off-by: Marc Kleine-Budde commit 1e41cbbe68e6753e786ddff528de15050bc52803 Author: Ethan Nelson-Moore Date: Fri Jan 30 03:41:33 2026 -0800 net: can: ctucanfd: remove useless copy of PCI_DEVICE_DATA macro The ctucanfd driver has its own copy of the PCI_DEVICE_DATA macro. I assume this was done to support older kernel versions where it didn't exist, but that is irrelevant once the driver is in the mainline kernel. Remove it. Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260130114134.47421-1-enelsonmoore@gmail.com Signed-off-by: Marc Kleine-Budde commit 2f41d7867800a78f339fbec3ab3a64147c33a9f1 Author: Viken Dadhaniya Date: Sat Mar 21 19:20:30 2026 +0530 dt-bindings: can: mcp251xfd: add microchip,xstbyen property Add the boolean property 'microchip,xstbyen' to enable the dedicated transceiver standby control function on the INT0/GPIO0/XSTBY pin of the MCP251xFD family. Signed-off-by: Viken Dadhaniya Acked-by: Conor Dooley Link: https://patch.msgid.link/20260321135031.3107408-2-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Marc Kleine-Budde commit bd77a34e9a619ee92c03cbb227ca86d814aa6601 Author: Yury Norov (NVIDIA) Date: Thu Aug 14 15:09:36 2025 -0400 powerpc: pci-ioda: Optimize pnv_ioda_pick_m64_pe() bitmap_empty() in pnv_ioda_pick_m64_pe() is O(N) and useless because the following find_next_bit() does the same work. Drop it, and while there replace a while() loop with the dedicated for_each_set_bit(). Reviewed-by: Andrew Donnellan Signed-off-by: Yury Norov (NVIDIA) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250814190936.381346-3-yury.norov@gmail.com commit f73338d089deedb4f4f1e49751c30b8b7f595ecd Author: Yury Norov (NVIDIA) Date: Thu Aug 14 15:09:35 2025 -0400 powerpc: pci-ioda: use bitmap_alloc() in pnv_ioda_pick_m64_pe() Use the dedicated bitmap_alloc() in pnv_ioda_pick_m64_pe() and drop some housekeeping code. Because pe_alloc is local, annotate it with __free() and get rid of the explicit kfree() calls. Suggested-by: Jiri Slaby Signed-off-by: Yury Norov (NVIDIA) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250814190936.381346-2-yury.norov@gmail.com commit cae734710dd156e2fbb4d66cdb22bbd5080beb52 Author: Christophe Leroy (CS GROUP) Date: Tue Mar 10 11:05:54 2026 +0100 powerpc/net: Inline checksum wrappers and convert to scoped user access Commit 861574d51bbd ("powerpc/uaccess: Implement masked user access") provides optimised user access by avoiding the cost of access_ok(). Convert csum_and_copy_to_user() and csum_and_copy_from_user() to scoped user access to benefit from masked user access. csum_and_copy_to_user() and csum_and_copy_from_user() are only called respectively by csum_and_copy_to_iter() and csum_and_copy_from_iter_full() and they are only called twice. Those functions used to be large but they were first reduced by commit c693cc4676a0 ("saner calling conventions for csum_and_copy_..._user()") then commit 70d65cd555c5 ("ppc: propagate the calling conventions change down to csum_partial_copy_generic()"). With the additional size reduction provided by conversion to scoped user access they are not worth being kept out of line. $ ./scripts/bloat-o-meter vmlinux.0 vmlinux.1 add/remove: 0/2 grow/shrink: 2/0 up/down: 136/-176 (-40) Function old new delta csum_and_copy_to_iter 2416 2488 +72 csum_and_copy_from_iter_full 2272 2336 +64 csum_and_copy_to_user 88 - -88 csum_and_copy_from_user 88 - -88 Total: Before=11514471, After=11514431, chg -0.00% Signed-off-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/f44e1b2760dbed35b237040001a91bc8304b726b.1773137098.git.chleroy@kernel.org commit cd54714e938d4951abc671e562d10c2308613901 Author: Christophe Leroy (CS GROUP) Date: Tue Mar 10 11:03:41 2026 +0100 powerpc/sstep: Convert to scoped user access Commit 861574d51bbd ("powerpc/uaccess: Implement masked user access") provides optimised user access by avoiding the cost of access_ok(). Convert single step emulation functions to scoped user access to benefit from masked user access. Scoped user access also make the code simpler. Signed-off-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/8f2d85bddacff18046096dc255fd94f6a0f8b230.1773137010.git.chleroy@kernel.org commit bf53ede0038fe2a7b02cad85f337aba43ced572a Author: Christophe Leroy (CS GROUP) Date: Tue Mar 10 11:01:31 2026 +0100 powerpc/align: Convert emulate_spe() to scoped user access Commit 861574d51bbd ("powerpc/uaccess: Implement masked user access") provides optimised user access by avoiding the cost of access_ok(). Convert emulate_spe() to scoped user access to benefit from masked user access. Scoped user access also make the code simpler. Signed-off-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/4ff83cb240da4e2d0c34e2bce4b8b6ef19a33777.1773136880.git.chleroy@kernel.org commit 679fa9c756c7d6fcb6ae611f695d286c53dca076 Author: Christophe Leroy (CS GROUP) Date: Tue Mar 10 11:00:53 2026 +0100 powerpc/ptrace: Convert gpr32_set_common_user() to scoped user access Commit 861574d51bbd ("powerpc/uaccess: Implement masked user access") provides optimised user access by avoiding the cost of access_ok(). Convert gpr32_set_common_user() to scoped user access to benefit from masked user access. Scoped user access also make the code simpler. Also changes label from Efault to efault to avoid checkpatch complaining about CamelCase. Signed-off-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/2409643daab08b4bc07004c2b88f42085d1ef45a.1773136838.git.chleroy@kernel.org commit 40a1b9d044c7dbbc2976f0432e32dc57d4896b00 Author: Christophe Leroy (CS GROUP) Date: Tue Mar 10 10:59:58 2026 +0100 powerpc/futex: Use masked user access Commit 861574d51bbd ("powerpc/uaccess: Implement masked user access") provides optimised user access by avoiding the cost of access_ok(). Use masked user access in arch_futex_atomic_op_inuser() Signed-off-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/e29f6a5c14e5938df68d94bfac6b2f762fb922aa.1773136636.git.chleroy@kernel.org commit f26ad12356a275ab303d5d3af4790ad94acc20d7 Author: Christophe Leroy Date: Tue Mar 10 16:08:07 2026 +0100 powerpc/audit: Convert powerpc to AUDIT_ARCH_COMPAT_GENERIC Commit e65e1fc2d24b ("[PATCH] syscall class hookup for all normal targets") added generic support for AUDIT but that didn't include support for bi-arch like powerpc. Commit 4b58841149dc ("audit: Add generic compat syscall support") added generic support for bi-arch. Convert powerpc to that bi-arch generic audit support. With this change generated text is similar. Thomas has confirmed that the previously failing filter_exclude/test is now successful both without and with this patch, see [1] [1] https://lore.kernel.org/all/20260306115350-ef265661-6d6b-4043-9bd0-8e6b437d0d67@linutronix.de/ Link: https://github.com/linuxppc/issues/issues/412 Signed-off-by: Christophe Leroy Reviewed-by: Cédric Le Goater Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/261b1be5b8dc526b83d73e8281e682a73536ea28.1773155031.git.chleroy@kernel.org commit 64ed1e3e728afb57ba9acb59e69de930ead847d9 Author: Shrikanth Hegde Date: Wed Mar 11 11:47:09 2026 +0530 cpuidle: powerpc: avoid double clear when breaking snooze snooze_loop is done often in any system which has fair bit of idle time. So it qualifies for even micro-optimizations. When breaking the snooze due to timeout, TIF_POLLING_NRFLAG is cleared twice. Clearing the bit invokes atomics. Avoid double clear and thereby avoid one atomic write. dev->poll_time_limit indicates whether the loop was broken due to timeout. Use that instead of defining a new variable. Fixes: 7ded429152e8 ("cpuidle: powerpc: no memory barrier after break from idle") Cc: stable@vger.kernel.org Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Shrikanth Hegde Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260311061709.1230440-1-sshegde@linux.ibm.com commit 26d76caac47f44b3ee4cdf080614bbee07713007 Author: Randy Dunlap Date: Tue Feb 24 21:53:28 2026 -0800 powerpc/ps3: spu.c: fix enum and Return kernel-doc warnings Fix enum and function return value kernel-doc warnings: Warning: spu.c:36 Excess enum value '%spe_type_logical' description in 'spe_type' Warning: spu.c:78 Excess enum value '%spe_ex_state_unexecutable' description in 'spe_ex_state' Warning: spu.c:78 Excess enum value '%spe_ex_state_executable' description in 'spe_ex_state' Warning: spu.c:78 Excess enum value '%spe_ex_state_executed' description in 'spe_ex_state' Warning: spu.c:190 No description found for return value of 'setup_areas' Fixes: de91a5342995 ("[POWERPC] ps3: add spu support") Fixes: b47027795a22 ("powerpc/ps3: Fix ioremap of spu shadow regs") Signed-off-by: Randy Dunlap Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260225055328.249204-1-rdunlap@infradead.org commit 7695a4e12e5506ddd17b05a5e1ef61a9bd315a14 Author: Randy Dunlap Date: Tue Feb 24 21:53:14 2026 -0800 powerpc: kgdb: fix kernel-doc warnings Remove empty comment line at the beginning of a kernel-doc function block. Add a "Return:" section for this function. These changes prevent 2 kernel-doc warnings: Warning: ../arch/powerpc/kernel/kgdb.c:103 Cannot find identifier on line: * Warning: kgdb.c:113 No description found for return value of 'kgdb_skipexception' Fixes: 949616cf2d30 ("powerpc/kgdb: Bail out of KGDB when we've been triggered") Signed-off-by: Randy Dunlap Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260225055314.247966-1-rdunlap@infradead.org commit d1e6f90d6befb970dd6eb7fb5922c8690bf12623 Author: Randy Dunlap Date: Sat Nov 29 10:36:36 2025 -0800 powerpc/ps3: fix ps3.h kernel-doc warnings Fix some kernel-doc warnings in ps3.h: - add @dev to struct ps3_dma_region - don't mark a function as "struct" - add Returns: description for one function - add a short description for ps3_system_bus_set_drvdata() - correct an enum @name - move intervening "struct ps3_system_bus_device;" from between kernel-doc for ps3_dma_region_init() and the function declaration to eliminate these warnings: Warning: arch/powerpc/include/asm/ps3.h:96 struct member 'dev' not described in 'ps3_dma_region' Warning: arch/powerpc/include/asm/ps3.h:118 struct ps3_system_bus_device; error: Cannot parse struct or union! Warning: arch/powerpc/include/asm/ps3.h:166 int ps3_mmio_region_init(struct ps3_system_bus_device *dev, struct ps3_mmio_region *r, unsigned long bus_addr, unsigned long len, enum ps3_mmio_page_size page_size); error: Cannot parse struct or union! Warning: arch/powerpc/include/asm/ps3.h:167 No description found for return value of 'ps3_mmio_region_init' Warning: arch/powerpc/include/asm/ps3.h:407 missing initial short description on line: * ps3_system_bus_set_drvdata - Warning: arch/powerpc/include/asm/ps3.h:473 Enum value 'PS3_LPM_TB_TYPE_INTERNAL' not described in enum 'ps3_lpm_tb_type' Warning: arch/powerpc/include/asm/ps3.h:473 Excess enum value '@PS3_LPM_RIGHTS_USE_TB' description in 'ps3_lpm_tb_type' This leaves struct members in several structs and function parameters in one function still undescribed. Signed-off-by: Randy Dunlap Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251129183636.1893634-1-rdunlap@infradead.org commit 47a05517c6edbf5160ce1bff107c10b76aa09ef7 Author: J. Neuschäfer Date: Wed Mar 11 18:35:58 2026 +0100 powerpc: wii: Fix LED name pattern Adjust the name of the drive slot LED node to comply with the schema in Documentation/devicetree/bindings/leds/leds-gpio.yaml. arch/powerpc/boot/dts/wii.dtb: gpio-leds: 'drive-slot' does not match any of the regexes: '(^led-[0-9a-f]$|led)', 'pinctrl-[0-9]+' Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260311-wii-schema-v1-3-1563ac4aefa8@posteo.net commit 4a03d824b3204bae7e19cdf47a85ac01027603bb Author: J. Neuschäfer Date: Wed Mar 11 18:35:57 2026 +0100 powerpc: wii: Fix GPIO key name pattern Adjust the names of GPIO key nodes to comply with the schema in Documentation/devicetree/bindings/input/gpio-keys.yaml. Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260311-wii-schema-v1-2-1563ac4aefa8@posteo.net commit d1620f27ed1aa3be4255513e1a213ab1805ec892 Author: J. Neuschäfer Date: Wed Mar 11 18:35:56 2026 +0100 powerpc: wii: Add unit address to /memory This fixes the following dtschema warning: arch/powerpc/boot/dts/wii.dtb: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 25165824], [268435456, 67108864]]} Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260311-wii-schema-v1-1-1563ac4aefa8@posteo.net commit 89f46b578694f1549426277c370488479d20e1ad Author: J. Neuschäfer Date: Tue Mar 3 16:09:49 2026 +0100 powerpc: Move GameCube/Wii options under EMBEDDED6xx Move CONFIG_GAMECUBE and CONFIG_WII directly below other embedded6xx boards, and above options such as TSI108_BRIDGE. This has two advantages for the GC/Wii options: - They won't be moved around by USBGECKO_UDBG appearing or disappearing - They will be intendented in menuconfig/nconfig, to make it clear they are part of the embedded6xx platforms Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303-gcwii-kconfig-v1-1-636b288e7270@posteo.net commit 5716cacebac887b45091c658caa6d1ea25c238dc Author: Chen Ni Date: Mon Jan 19 14:35:07 2026 +0800 powerpc/44x/uic: Consolidate chained IRQ handler install/remove The driver currently sets the handler data and the chained handler in two separate steps. This creates a theoretical race window where an interrupt could fire after the handler is set but before the data is assigned, leading to a NULL pointer dereference. Replace the two calls with irq_set_chained_handler_and_data() to set both the handler and its data atomically under the irq_desc->lock. Signed-off-by: Chen Ni Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260119063507.940782-1-nichen@iscas.ac.cn commit 7593721cd7c1315557956d5241bbb65fb33115eb Author: Chen Ni Date: Mon Jan 19 14:12:32 2026 +0800 powerpc/52xx/mpc52xx_gpt: consolidate chained IRQ handler install/remove The driver currently sets the handler data and the chained handler in two separate steps. This creates a theoretical race window where an interrupt could fire after the handler is set but before the data is assigned, leading to a NULL pointer dereference. Replace the two calls with irq_set_chained_handler_and_data() to set both the handler and its data atomically under the irq_desc->lock. Signed-off-by: Chen Ni Reviewed-by: Bartosz Golaszewski Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260119061232.889236-1-nichen@iscas.ac.cn commit 1ef8cf10cdbe79823fd6de0f0b93ca996045d1cc Author: Chen Ni Date: Mon Jan 19 14:04:50 2026 +0800 powerpc/52xx/media5200: Consolidate chained IRQ handler install/remove The driver currently sets the handler data and the chained handler in two separate steps. This creates a theoretical race window where an interrupt could fire after the handler is set but before the data is assigned, leading to a NULL pointer dereference. Replace the two calls with irq_set_chained_handler_and_data() to set both the handler and its data atomically under the irq_desc->lock. Signed-off-by: Chen Ni Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260119060450.889119-1-nichen@iscas.ac.cn commit 6e65886fceb23605eff952d6b1975737b4c4b154 Author: Amit Machhiwal Date: Fri Mar 13 22:24:26 2026 +0530 selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 GCC 15 reports the below false positive '-Wmaybe-uninitialized' warning in vphn_unpack_associativity() when building the powerpc selftests. # make -C tools/testing/selftests TARGETS="powerpc" [...] CC test-vphn In file included from test-vphn.c:3: In function ‘vphn_unpack_associativity’, inlined from ‘test_one’ at test-vphn.c:371:2, inlined from ‘test_vphn’ at test-vphn.c:399:9: test-vphn.c:10:33: error: ‘be_packed’ may be used uninitialized [-Werror=maybe-uninitialized] 10 | #define be16_to_cpup(x) bswap_16(*x) | ^~~~~~~~ vphn.c:42:27: note: in expansion of macro ‘be16_to_cpup’ 42 | u16 new = be16_to_cpup(field++); | ^~~~~~~~~~~~ In file included from test-vphn.c:19: vphn.c: In function ‘test_vphn’: vphn.c:27:16: note: ‘be_packed’ declared here 27 | __be64 be_packed[VPHN_REGISTER_COUNT]; | ^~~~~~~~~ cc1: all warnings being treated as errors When vphn_unpack_associativity() is called from hcall_vphn() in kernel the error is not seen while building vphn.c during kernel compilation. This is because the top level Makefile includes '-fno-strict-aliasing' flag always. The issue here is that GCC 15 emits '-Wmaybe-uninitialized' due to type punning between __be64[] and __b16* when accessing the buffer via be16_to_cpup(). The underlying object is fully initialized but GCC 15 fails to track the aliasing due to the strict aliasing violation here. Please refer [1] and [2]. This results in a false positive warning which is promoted to an error under '-Werror'. This problem is not seen when the compilation is performed with GCC 13 and 14. An issue [1] has also been created on GCC bugzilla. The selftest compiles fine with '-fno-strict-aliasing'. Since this GCC flag is used to compile vphn.c in kernel too, the same flag should be used to build vphn tests when compiling vphn.c in the selftest as well. Fix this by including '-fno-strict-aliasing' during vphn.c compilation in the selftest. This keeps the build working while limiting the scope of the suppression to building vphn tests. [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124427 [2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99768 Fixes: 58dae82843f5 ("selftests/powerpc: Add test for VPHN") Reviewed-by: Vaibhav Jain Signed-off-by: Amit Machhiwal Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260313165426.43259-1-amachhiw@linux.ibm.com commit ce7c43b0871989b4c665cceb9720d79b933c1818 Author: Yury Norov Date: Wed Mar 18 23:36:46 2026 -0400 powerpc/xive: rework xive_find_target_in_mask() Switch the function to using modern cpumask API and drop most of the housekeeping code. Notice, if first >= nr_cpu_ids, for_each_cpu_wrap() iterator behaves just like for_each_cpu(), i.e. begins from 0. So even if WARN_ON() is triggered, no special handling is needed. Signed-off-by: Yury Norov Tested-by: Mukesh Kumar Chaurasiya (IBM) Reviewed-by: Shrikanth Hegde Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260319033647.881246-3-ynorov@nvidia.com commit cad2a72c29e037f1ade0079f7e4b925508680e20 Author: Yury Norov Date: Wed Mar 18 23:36:45 2026 -0400 Revert "powerpc/xive: Fix the size of the cpumask used in xive_find_target_in_mask()" This reverts commit a9dadc1c512807f955f0799e85830b420da47932. The commit message states: When called from xive_irq_startup(), the size of the cpumask can be larger than nr_cpu_ids. This can result in a WARN_ON. [...] This happens because we're being called with our affinity mask set to irq_default_affinity. That in turn was populated using cpumask_setall(), which sets NR_CPUs worth of bits, not nr_cpu_ids worth. Finally cpumask_weight() will return > nr_cpu_ids when passed a mask which has > nr_cpu_ids bits set. In modern kernel, cpumask_weight() can't return > nr_cpu_ids. In inline case, cpumask_setall() explicitly clears all bits above nr_cpu_ids, see commit 63355b9884b3 ("cpumask: be more careful with 'cpumask_setall()'"). So, despite that cpumask_weight() is passed with small_cpumask_bits, which is NR_CPUS in this case, it can't count over the nr_cpu_ids. In outline case, cpumask_setall() may set bits beyond the limit up to the next byte alignment, but in this case small_cpumask_bits is wired to nr_cpu_ids, thus making overcounting impossible. Signed-off-by: Yury Norov Tested-by: Mukesh Kumar Chaurasiya (IBM) Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260319033647.881246-2-ynorov@nvidia.com commit f53b24d1fa263f56155213eabab734c18d884aff Author: Sourabh Jain Date: Thu Mar 12 14:00:50 2026 +0530 powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug When elfcorehdr is prepared for kdump, the program header representing the first 64 KB of memory is expected to have its offset point to the backup region. This is required because purgatory copies the first 64 KB of the crashed kernel memory to this backup region following a kernel crash. This allows the capture kernel to use the first 64 KB of memory to place the exception vectors and other required data. When elfcorehdr is recreated due to memory hotplug, the offset of the program header representing the first 64 KB is not updated. As a result, the capture kernel exports the first 64 KB at offset 0, even though the data actually resides in the backup region. Fix this by calling sync_backup_region_phdr() to update the program header offset in the elfcorehdr created during memory hotplug. sync_backup_region_phdr() works for images loaded via the kexec_file_load syscall. However, it does not work for kexec_load, because image->arch.backup_start is not initialized in that case. So introduce machine_kexec_post_load() to process the elfcorehdr prepared by kexec-tools and initialize image->arch.backup_start for kdump images loaded via kexec_load syscall. Rename update_backup_region_phdr() to sync_backup_region_phdr() and extend it to synchronize the backup region offset between the kdump image and the ELF core header. The helper now supports updating either the kdump image from the ELF program header or updating the ELF program header from the kdump image, avoiding code duplication. Define ARCH_HAS_KIMAGE_ARCH and struct kimage_arch when CONFIG_KEXEC_FILE or CONFIG_CRASH_DUMP is enabled so that kimage->arch.backup_start is available with the kexec_load system call. This patch depends on the patch titled "powerpc/crash: fix backup region offset update to elfcorehdr". Fixes: 849599b702ef ("powerpc/crash: add crash memory hotplug support") Reviewed-by: Aditya Gupta Signed-off-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260312083051.1935737-3-sourabhjain@linux.ibm.com commit 789335cacdf37da93bb7c70322dff8c7e82881df Author: Sourabh Jain Date: Thu Mar 12 14:00:49 2026 +0530 powerpc/crash: fix backup region offset update to elfcorehdr update_backup_region_phdr() in file_load_64.c iterates over all the program headers in the kdump kernel’s elfcorehdr and updates the p_offset of the program header whose physical address starts at 0. However, the loop logic is incorrect because the program header pointer is not updated during iteration. Since elfcorehdr typically contains PT_NOTE entries first, the PT_LOAD program header with physical address 0 is never reached. As a result, its p_offset is not updated to point to the backup region. Because of this behavior, the capture kernel exports the first 64 KB of the crashed kernel’s memory at offset 0, even though that memory actually lives in the backup region. When a crash happens, purgatory copies the first 64 KB of the crashed kernel’s memory into the backup region so the capture kernel can safely use it. This has not caused problems so far because the first 64 KB is usually identical in both the crashed and capture kernels. However, this is just an assumption and is not guaranteed to always hold true. Fix update_backup_region_phdr() to correctly update the p_offset of the program header with a starting physical address of 0 by correcting the logic used to iterate over the program headers. Fixes: cb350c1f1f86 ("powerpc/kexec_file: Prepare elfcore header for crashing kernel") Reviewed-by: Aditya Gupta Signed-off-by: Sourabh Jain Reviewed-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260312083051.1935737-2-sourabhjain@linux.ibm.com commit 7f8969aa739da4d2096f2e6f87e030de6efad9dc Author: Arnaldo Carvalho de Melo Date: Tue Mar 31 18:06:34 2026 -0300 perf beauty: Move copy of fadvise.h from tools/include/ to tools/perf/trace/beauty/include/ As it is not really used when compiling anything, just being parsed to collect number->string tables for 'perf trace'. $ git grep fadvise.h tools/ tools/perf/Makefile.perf:$(fadvise_advice_array): $(beauty_uapi_linux_dir)/fadvise.h $(fadvise_advice_tbl) tools/perf/check-headers.sh: "include/uapi/linux/fadvise.h" tools/perf/trace/beauty/fadvise.sh:grep -E $regex ${header_dir}/fadvise.h | \ tools/perf/trace/beauty/fadvise.sh:# tools/include/uapi/linux/fadvise.h for details. $ Link: https://lore.kernel.org/r/CAP-5=fVBNQVF8k3JUQjH1nkP69ZVp8BqP+uwygcx=xO0zC4xrg@mail.gmail.com Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit a8e11416ffdcddb3bb3adb265f10b67591d21de8 Author: Arnaldo Carvalho de Melo Date: Tue Mar 31 18:06:33 2026 -0300 perf beauty: Move tools/include/uapi/drm to tools/perf/trace/beauty/include/uapi As it is used only to parse ioctl numbers, not to build perf and so far no other tools/ living tool uses it, so to clean up tools/include/ to be used just for building tools, to have access to things available in the kernel and not yet in the system headers, move it to the directory where just the tools/perf/trace/beauty/ scripts can use to generate tables used by perf. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit be867c49fe62d56b5a4c2e08ce47dd396d13714f Author: Ian Rogers Date: Fri Mar 6 11:19:08 2026 -0800 perf build: Add -funsigned-char to default CFLAGS Commit 3bc753c06dd0 ("kbuild: treat char as always unsigned") made chars unsigned by default in the Linux kernel. To avoid similar kinds of bugs and warnings, make unsigned chars the default for the perf tool. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 8c0e0b4628e5fd98bc614378f1aff4c1c8c26310 Author: Thomas Hellström Date: Tue Mar 31 11:20:20 2026 +0200 drm/msm: Remove abuse of drm_exec internals The code was reading drm_exec internal state to determine whether the drm_exec structure had been initialized or not, and therefore needed cleaning up, relying on undocumented behaviour. Instead add a bool to struct msm_gem_submit to indicate whether drm_exec cleaning up is needed. Signed-off-by: Thomas Hellström Acked-by: Christian König Reviewed-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/715502/ Message-ID: <20260331092023.81616-3-thomas.hellstrom@linux.intel.com> Signed-off-by: Rob Clark commit f1359c240191e686614847905fc861cbda480b47 Author: Nagamani PV Date: Mon Mar 30 13:44:36 2026 +0200 net/iucv: Add missing kernel-doc return value descriptions Add missing return value descriptions for several functions in net/iucv/af_iucv.c and net/iucv/iucv.c to address kernel-doc warnings. Warnings detected with: scripts/kernel-doc -none -Wall net/iucv/* Warning: net/iucv/af_iucv.c:131 No description found for return value of 'iucv_msg_length' Warning: net/iucv/af_iucv.c:150 No description found for return value of 'iucv_sock_in_state' ... No functional change. Reviewed-by: Aswin Karuvally Reviewed-by: Alexandra Winter Signed-off-by: Nagamani PV Signed-off-by: Alexandra Winter Link: https://patch.msgid.link/20260330114436.2010108-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski commit 58e416e283284c15b8daf0b2b425f43242f62b0a Author: Fernando Fernandez Mancera Date: Mon Mar 30 14:10:33 2026 +0200 net: vxlan: check ipv6_mod_enabled() on neigh_reduce() IPv6 must be enabled or otherwise neigh_reduce() might cause a kernel panic. This was prevented by a check on in6_dev. Use ipv6_mod_enabled() instead as it is cleaner and also consistent with the code at route_shortcircuit(). Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260330121033.4479-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit d7709812e13d06132ddae3d21540472ea5cb11c5 Author: Erni Sri Satya Vennela Date: Thu Mar 26 10:30:56 2026 -0700 net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG As a part of MANA hardening for CVM, validate the adapter_mtu value returned from the MANA_QUERY_DEV_CONFIG HWC command. The adapter_mtu value is used to compute ndev->max_mtu via: gc->adapter_mtu - ETH_HLEN. If hardware returns a bogus adapter_mtu smaller than ETH_HLEN (e.g. 0), the unsigned subtraction wraps to a huge value, silently allowing oversized MTU settings. Add a validation check to reject adapter_mtu values below ETH_MIN_MTU + ETH_HLEN, returning -EPROTO to fail the device configuration early with a clear error message. Signed-off-by: Erni Sri Satya Vennela Link: https://patch.msgid.link/20260326173101.2010514-1-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski commit e5a3f10ed7c97decd61b3274982f048b58ce69bc Merge: a94ddc191f1957 aae5efaeb8aa4a Author: Jakub Kicinski Date: Tue Mar 31 19:32:44 2026 -0700 Merge branch 'declance-improve-dma-error-reporting' Maciej W. Rozycki says: ==================== declance: Improve DMA error reporting Inspired by a recent discussion[1] I have come up with this pair of small improvements to DMA error reporting with declance. [1] Sebastian Andrzej Siewior, "declance: Remove IRQF_ONESHOT", ==================== Link: https://patch.msgid.link/alpine.DEB.2.21.2603291835550.60268@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit aae5efaeb8aa4ada710d5b0cdbab77b9539c69eb Author: Maciej W. Rozycki Date: Sun Mar 29 19:07:41 2026 +0100 declance: Include the offending address with DMA errors The address latched in the I/O ASIC LANCE DMA Pointer Register uses the TURBOchannel bus address encoding and therefore bits 33:29 of location referred occupy bits 4:0, bits 28:2 are left-shifted by 3, and bits 1:0 are hardwired to zero. In reality no TURBOchannel system exceeds 1GiB of RAM though, so the address reported will always fit in 8 hex digits. Signed-off-by: Maciej W. Rozycki Link: https://patch.msgid.link/alpine.DEB.2.21.2603291839220.60268@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit ee769323b1bf60c0ec0338cc5ee6b1c725624ec6 Author: Maciej W. Rozycki Date: Sun Mar 29 19:07:24 2026 +0100 declance: Rate-limit DMA errors Prevent the system from becoming unusable due to a flood of DMA error messages. Signed-off-by: Maciej W. Rozycki Link: https://patch.msgid.link/alpine.DEB.2.21.2603291838370.60268@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit a94ddc191f19579a7e0a5da2c012f1048ce10262 Author: Lorenzo Bianconi Date: Mon Mar 30 00:03:49 2026 +0200 net: airoha: Fix typo in airoha_set_gdm2_loopback routine name Rename airhoha_set_gdm2_loopback() in airoha_set_gdm2_loopback() Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260330-airoha_set_gdm2_loopback-fix-typo-v1-1-a1320ff6b6cc@kernel.org Signed-off-by: Jakub Kicinski commit 0cbd743aad9076c349334264774bcb9f9af1e40f Merge: 177750206f9d59 771a627ddd3b31 Author: Jakub Kicinski Date: Tue Mar 31 19:24:32 2026 -0700 Merge branch 'nfc-refactor-usb-endpoint-lookups' Johan Hovold says: ==================== nfc: refactor USB endpoint lookups Use the common USB helper for looking up bulk and interrupt endpoints instead of open coding. ==================== Link: https://patch.msgid.link/20260330103655.1672331-1-johan@kernel.org Signed-off-by: Jakub Kicinski commit 771a627ddd3b31fc5a27dc7af28a0e59ba13aea1 Author: Johan Hovold Date: Mon Mar 30 12:36:55 2026 +0200 nfc: port100: refactor endpoint lookup Use the common USB helpers for looking up bulk and interrupt endpoints (and determining endpoint numbers) instead of open coding. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260330103655.1672331-4-johan@kernel.org Signed-off-by: Jakub Kicinski commit 13f2e141b944cf24171db83ae4ee07caf83d2123 Author: Johan Hovold Date: Mon Mar 30 12:36:54 2026 +0200 nfc: pn533: refactor endpoint lookup Use the common USB helpers for looking up bulk and interrupt endpoints (and determining endpoint numbers) instead of open coding. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260330103655.1672331-3-johan@kernel.org Signed-off-by: Jakub Kicinski commit dba69cba4a5d827a0d05b9692bf8b4d9cbfe9206 Author: Johan Hovold Date: Mon Mar 30 12:36:53 2026 +0200 nfc: nfcmrvl: refactor endpoint lookup Use the common USB helper for looking up bulk and interrupt endpoints instead of open coding. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260330103655.1672331-2-johan@kernel.org Signed-off-by: Jakub Kicinski commit 177750206f9d59463c45e95701e3e56c6f3577c6 Merge: 6730f184abdcf0 abfca6b13bcfe4 Author: Jakub Kicinski Date: Tue Mar 31 19:23:42 2026 -0700 Merge branch 'net-refactor-usb-endpoint-lookups' Johan Hovold says: ==================== net: refactor USB endpoint lookups Use the common USB helpers for looking up bulk and interrupt endpoints instead of open coding. ==================== Link: https://patch.msgid.link/20260330102611.1671546-1-johan@kernel.org Signed-off-by: Jakub Kicinski commit abfca6b13bcfe4f2b70a88190d61f162656ed44e Author: Johan Hovold Date: Mon Mar 30 12:26:11 2026 +0200 net: ipeth: refactor endpoint lookup Use the common USB helper for looking up bulk and interrupt endpoints instead of open coding. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260330102611.1671546-3-johan@kernel.org Signed-off-by: Jakub Kicinski commit da45a55748f2cd89fb6100df46821af69bdcea99 Author: Johan Hovold Date: Mon Mar 30 12:26:10 2026 +0200 net: hso: refactor endpoint lookup Use the common USB helpers for looking up bulk and interrupt endpoints instead of a custom implementation. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260330102611.1671546-2-johan@kernel.org Signed-off-by: Jakub Kicinski commit 6730f184abdcf0cc9b6ee20f97c467ab497a900d Author: Izabela Bakollari Date: Mon Mar 30 08:32:35 2026 +0200 sfc: add transmit timestamping support Add ethtool op to advertise TX timestamping. Insert a skb_tx_timestamp call in __efx_enqueue_skb. Signed-off-by: Izabela Bakollari Reviewed-by: Edward Cree Link: https://patch.msgid.link/20260330063236.247057-1-ibakolla@redhat.com Signed-off-by: Jakub Kicinski commit f843687c30272d55739ef153ace29c58db2575ee Author: Jakub Kicinski Date: Mon Mar 30 17:19:30 2026 -0700 selftests: drv-net: update the README with variants Test authors need to know about variants, existing tests don't use them because variants are relatively recent. Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260331001930.3411279-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 75171eeff3538c6859b50f6a516342c8f1ed6e00 Author: Daniel Wagner Date: Mon Mar 30 23:53:10 2026 +0100 net: phy: bcm84881: add BCM84891/BCM84892 support The BCM84891 and BCM84892 are 10GBASE-T PHYs in the same family as the BCM84881, sharing the register map and most callbacks. They add USXGMII as a host interface mode. bcm8489x_config_init() is separate from bcm84881_config_init(): it allows only USXGMII (the only host mode available on the tested hardware) and clears MDIO_CTRL1_LPOWER, which is set at boot on the tested platform. Does not recur on ifdown/ifup, cable events, or link-partner advertisement changes, so config_init is sufficient. For USXGMII, read_status() skips the 0x4011 host-mode register: it returns the same value regardless of negotiated copper speed (USXGMII symbol replication). Speed comes from phy_resolve_aneg_linkmode() via standard C45 AN resolution. Tested on TRENDnet TEG-S750 (RTL9303 + 1x BCM84891 + 4x BCM84892) running OpenWrt, where the MDIO controller driver is currently OpenWrt-specific. Link verified at 100M, 1G, 2.5G, 10G. Signed-off-by: Daniel Wagner Reviewed-by: Florian Fainelli Reviewed-by: Nicolai Buchwitz Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260330225310.2801264-1-wagner.daniel.t@gmail.com Signed-off-by: Jakub Kicinski commit e9abf1da0af3f787a03b249945e5ca726c1b8013 Author: Daniel Golle Date: Mon Mar 30 23:52:09 2026 +0100 net: dsa: mxl862xx: cancel pending work on probe error Call mxl862xx_host_shutdown() in case dsa_register_switch() returns an error, so any still pending crc_err_work get canceled. Fixes: a319d0c8c8ce ("net: dsa: mxl862xx: add CRC for MDIO communication") Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/3fd163f5bb88de426ca9847549f94b4296170ef0.1774911025.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 8aeeb5255d5e0001f2af6786e2a7564fef416acf Author: Eric Biggers Date: Mon Mar 30 19:44:38 2026 -0700 lib/crypto: Include instead of Since the lib/crypto/ files that include need it only for the transitive inclusion of (and not all the traditional crypto API stuff that the rest of is filled with), replace these inclusions with direct inclusions of . Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260331024438.51783-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 8f45af945fce60c8656b5113d80af7fe221c88f5 Author: Eric Biggers Date: Mon Mar 30 19:44:30 2026 -0700 lib/crypto: aesgcm: Don't disable IRQs during AES block encryption aes_encrypt() now uses AES instructions when available instead of always using table-based code. AES instructions are constant-time and don't benefit from disabling IRQs as a constant-time hardening measure. In fact, on two architectures (arm and riscv) disabling IRQs is counterproductive because it prevents the AES instructions from being used. (See the may_use_simd() implementation on those architectures.) Therefore, let's remove the IRQ disabling/enabling and leave the choice of constant-time hardening measures to the AES library code. Note that currently the arm table-based AES code (which runs on arm kernels that don't have ARMv8 CE) disables IRQs, while the generic table-based AES code does not. So this does technically regress in constant-time hardening when that generic code is used. But as discussed in commit a22fd0e3c495 ("lib/crypto: aes: Introduce improved AES library") I think just leaving IRQs enabled is the right choice. Disabling them is slow and can cause problems, and AES instructions (which modern CPUs have) solve the problem in a much better way anyway. Link: https://lore.kernel.org/r/20260331024430.51755-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1aa82df3eb4d1a28c02a9d0062c6ed0db1a59bac Author: Eric Biggers Date: Mon Mar 30 19:44:14 2026 -0700 lib/crypto: aescfb: Don't disable IRQs during AES block encryption aes_encrypt() now uses AES instructions when available instead of always using table-based code. AES instructions are constant-time and don't benefit from disabling IRQs as a constant-time hardening measure. In fact, on two architectures (arm and riscv) disabling IRQs is counterproductive because it prevents the AES instructions from being used. (See the may_use_simd() implementation on those architectures.) Therefore, let's remove the IRQ disabling/enabling and leave the choice of constant-time hardening measures to the AES library code. Note that currently the arm table-based AES code (which runs on arm kernels that don't have ARMv8 CE) disables IRQs, while the generic table-based AES code does not. So this does technically regress in constant-time hardening when that generic code is used. But as discussed in commit a22fd0e3c495 ("lib/crypto: aes: Introduce improved AES library") I think just leaving IRQs enabled is the right choice. Disabling them is slow and can cause problems, and AES instructions (which modern CPUs have) solve the problem in a much better way anyway. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260331024414.51545-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2c4059f54f65ff1ee2d430fa023d25487cfb5b99 Author: Kory Maincent (TI) Date: Mon Feb 16 17:55:54 2026 +0100 ARM: dts: am335x: Add Seeed Studio BeagleBone HDMI cape overlay Add devicetree overlay for the Seeed Studio BeagleBone HDMI cape, which provides HDMI output via an ITE IT66121 HDMI bridge and audio support through McASP. The cape is designed for BeagleBone Green but is also compatible with BeagleBone and BeagleBone Black due to pin compatibility. Link: https://www.seeedstudio.com/Seeed-Studio-BeagleBoner-Green-HDMI-Cape.html Signed-off-by: Kory Maincent (TI) Signed-off-by: Kevin Hilman (TI) commit cf2f06f7152d5e38a87aa2e9b8b452714789f6ba Author: Kees Cook Date: Mon Mar 23 19:07:30 2026 -0700 lkdtm/fortify: Drop unneeded FORTIFY_STR_OBJECT test The str* family of fortified functions all use member-sized limits for a while now, so the FORTIFY_STR_OBJECT test is redundant to FORTIFY_STR_MEMBER. While here, replace the strncpy() use with strscpy(), as strncpy() is being removed. Link: https://patch.msgid.link/20260324020726.work.624-kees@kernel.org Signed-off-by: Kees Cook commit 3b1299f25b07ef83e020d049dfc62ced9c09450d Author: Siddharth Nayyar Date: Thu Mar 26 21:25:08 2026 +0000 documentation: remove references to *_gpl sections *_gpl sections are no longer present in the kernel binary. Signed-off-by: Siddharth Nayyar Reviewed-by: Petr Pavlu Signed-off-by: Sami Tolvanen commit f18540256b70c9e1f0e26e2c38f3d43a131926d9 Author: Siddharth Nayyar Date: Thu Mar 26 21:25:07 2026 +0000 module: remove *_gpl sections from vmlinux and modules These sections are not used anymore and can be removed from vmlinux and modules during linking. Signed-off-by: Siddharth Nayyar Reviewed-by: Petr Pavlu Signed-off-by: Sami Tolvanen commit b4760ff2a5e4351c59d185967735f59c0b0bd7f6 Author: Siddharth Nayyar Date: Thu Mar 26 21:25:06 2026 +0000 module: deprecate usage of *_gpl sections in module loader The *_gpl section are not being used populated by modpost anymore. Hence the module loader doesn't need to find and process these sections in modules. This patch also simplifies symbol finding logic in module loader since *_gpl sections don't have to be searched anymore. Signed-off-by: Siddharth Nayyar Reviewed-by: Petr Pavlu Signed-off-by: Sami Tolvanen commit 55fcb926b6d8b5cfb40873e4840a69961db1bb69 Author: Siddharth Nayyar Date: Thu Mar 26 21:25:05 2026 +0000 module: use kflagstab instead of *_gpl sections Read kflagstab section for vmlinux and modules to determine whether kernel symbols are GPL only. This patch eliminates the need for fragmenting the ksymtab for infering the value of GPL-only symbol flag, henceforth stop populating *_gpl versions of the ksymtab and kcrctab in modpost. Signed-off-by: Siddharth Nayyar Reviewed-by: Petr Pavlu Signed-off-by: Sami Tolvanen commit 16d0e04f546ffba78c74bbfeb57d93147bcaf2c5 Author: Siddharth Nayyar Date: Thu Mar 26 21:25:04 2026 +0000 module: populate kflagstab in modpost This patch adds the ability to create entries for kernel symbol flag bitsets in kflagstab. Modpost populates only the GPL-only flag for now. Signed-off-by: Siddharth Nayyar Reviewed-by: Petr Pavlu Signed-off-by: Sami Tolvanen commit 9743311b4535dc76ce81f46303da0f69bfaa5fd6 Author: Siddharth Nayyar Date: Thu Mar 26 21:25:03 2026 +0000 module: add kflagstab section to vmlinux and modules This patch introduces a __kflagstab section to store symbol flags in a dedicated data structure, similar to how CRCs are handled in the __kcrctab. The flags for a given symbol in __kflagstab will be located at the same index as the symbol's entry in __ksymtab and its CRC in __kcrctab. This design decouples the flags from the symbol table itself, allowing us to maintain a single, sorted __ksymtab. As a result, the symbol search remains an efficient, single lookup, regardless of the number of flags we add in the future. The motivation for this change comes from the Android kernel, which uses an additional symbol flag to restrict the use of certain exported symbols by unsigned modules, thereby enhancing kernel security. This __kflagstab can be implemented as a bitmap to efficiently manage which symbols are available for general use versus those restricted to signed modules only. This section will contain read-only data for values of kernel symbol flags in the form of an 8-bit bitsets for each kernel symbol. Each bit in the bitset represents a flag value defined by ksym_flags enumeration. Petr Pavlu ran a small test to get a better understanding of the different section sizes resulting from this patch series. He used v6.17-rc6 together with the openSUSE x86_64 config [1], which is fairly large. The resulting vmlinux.bin (no debuginfo) had an on-disk size of 58 MiB, and included 5937 + 6589 (GPL-only) exported symbols. The following table summarizes his measurements and calculations regarding the sizes of all sections related to exported symbols: | HAVE_ARCH_PREL32_RELOCATIONS | !HAVE_ARCH_PREL32_RELOCATIONS Section | Base [B] | Ext. [B] | Sep. [B] | Base [B] | Ext. [B] | Sep. [B] ---------------------------------------------------------------------------------------- __ksymtab | 71244 | 200416 | 150312 | 142488 | 400832 | 300624 __ksymtab_gpl | 79068 | NA | NA | 158136 | NA | NA __kcrctab | 23748 | 50104 | 50104 | 23748 | 50104 | 50104 __kcrctab_gpl | 26356 | NA | NA | 26356 | NA | NA __ksymtab_strings | 253628 | 253628 | 253628 | 253628 | 253628 | 253628 __kflagstab | NA | NA | 12526 | NA | NA | 12526 ---------------------------------------------------------------------------------------- Total | 454044 | 504148 | 466570 | 604356 | 704564 | 616882 Increase to base [%] | NA | 11.0 | 2.8 | NA | 16.6 | 2.1 The column "HAVE_ARCH_PREL32_RELOCATIONS -> Base" contains the measured numbers. The rest of the values are calculated. The "Ext." column represents an alternative approach of extending __ksymtab to include a bitset of symbol flags, and the "Sep." column represents the approach of having a separate __kflagstab. With HAVE_ARCH_PREL32_RELOCATIONS, each kernel_symbol is 12 B in size and is extended to 16 B. With !HAVE_ARCH_PREL32_RELOCATIONS, it is 24 B, extended to 32 B. Note that this does not include the metadata needed to relocate __ksymtab*, which is freed after the initial processing. Adding __kflagstab as a separate section has a negligible impact, as expected. When extending __ksymtab (kernel_symbol) instead, the worst case with !HAVE_ARCH_PREL32_RELOCATIONS increases the export data size by 16.6%. Note that the larger increase in size for the latter approach is due to 4-byte alignment of kernel_symbol data structure, instead of 1-byte alignment for the flags bitset in __kflagstab in the former approach. Based on the above, it was concluded that introducing __kflagstab makes sense, as the added complexity is minimal over extending kernel_symbol, and there is overall simplification of symbol finding logic in the module loader. Signed-off-by: Siddharth Nayyar Reviewed-by: Petr Pavlu [Sami: Updated commit message to include details from the cover letter.] Signed-off-by: Sami Tolvanen commit 10a4eb5882ba16164ece86d99486084f02f148bb Author: Siddharth Nayyar Date: Thu Mar 26 21:25:02 2026 +0000 module: define ksym_flags enumeration to represent kernel symbol flags The core architectural issue with kernel symbol flags is our reliance on splitting the main symbol table, ksymtab. To handle a single boolean property, such as GPL-only, all exported symbols are split across two separate tables: __ksymtab and __ksymtab_gpl. This design forces the module loader to perform a separate search on each of these tables for every symbol it needs, for vmlinux and for all previously loaded modules. This approach is fundamentally not scalable. If we were to introduce a second flag, we would need four distinct symbol tables. For n boolean flags, this model requires an exponential growth to 2^n tables, dramatically increasing complexity. Another consequence of this fragmentation is degraded performance. For example, a binary search on the symbol table of vmlinux, that would take only 14 comparison steps (assuming ~2^14 or 16K symbols) in a unified table, can require up to 26 steps when spread across two tables (assuming both tables have ~2^13 symbols). This performance penalty worsens as more flags are added. To address this, symbol flags is an enumeration used to represent flags as a bitset, for example a flag to tell if a symbol is GPL only. The said bitset is introduced in subsequent patches and will contain values of kernel symbol flags. These bitset will then be used to infer flag values rather than fragmenting ksymtab for separating symbols with different flag values, thereby eliminating the need to fragment the ksymtab. Link: https://lore.kernel.org/r/20260326-kflagstab-v5-0-fa0796fe88d9@google.com Signed-off-by: Siddharth Nayyar Reviewed-by: Petr Pavlu [Sami: Updated the commit message to explain the use case for the series.] Signed-off-by: Sami Tolvanen commit 64a97c98f93e344be00d4ff10fef4119973938bd Author: Khushal Chitturi Date: Mon Mar 30 16:31:34 2026 +0530 dt-bindings: power: reset: cortina,gemini-power-controller: convert to DT schema Convert the Cortina Systems Gemini Poweroff Controller bindings to DT schema. Signed-off-by: Khushal Chitturi Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260330110135.10316-2-khushalchitturi@gmail.com Signed-off-by: Sebastian Reichel commit 0eeb0094ba0321f0927806857b5f01c1577bc245 Author: Mykyta Yatsenko Date: Tue Mar 31 18:26:34 2026 +0100 selftests/bpf: Suppress veristat error messages in non-verbose mode When running veristat across many BPF objects, expected load failures produce noisy stderr output that obscures actual issues. Gate these diagnostic messages behind --verbose. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260331172634.57402-2-mykyta.yatsenko5@gmail.com commit 3e6475dc60853456e1aca2b85bd6603eadb3f6a1 Author: Menglong Dong Date: Tue Mar 31 15:04:34 2026 +0800 selftests/bpf: Test access to ringbuf position with map pointer Add the testing to access the bpf_ringbuf with the map pointer. "consumer_pos" and "producer_pos" is accessed in this testing. We reserve 128 bytes in the ringbuf to test the producer_pos, which should be "128 + BPF_RINGBUF_HDR_SZ". It will be helpful if we want to evaluate the usage of the ringbuf in bpf prog with the consumer and producer position. Signed-off-by: Menglong Dong Signed-off-by: Andrii Nakryiko Reviewed-by: Emil Tsalapatis Acked-by: Jiri Olsa Acked-by: Leon Hwang Link: https://lore.kernel.org/bpf/20260331070434.10037-1-dongml2@chinatelecom.cn commit f9a80c7ce49e2a77b769264712fe2f59479b5f5a Author: Eyal Birger Date: Tue Mar 31 06:06:12 2026 -0700 bpf: Clarify BPF_RB_NO_WAKEUP behavior for bpf_ringbuf_discard() Clarify bpf_ringbuf_discard() documentation for BPF_RB_NO_WAKEUP. Discarded ring buffer records are still left in the ring buffer and are only skipped when user space consumes them. This can matter when BPF_RB_NO_WAKEUP is used: a later submit relying on adaptive wakeup might not wake the consumer, because the discarded record still needs to be consumed first. Scenario: epoll_wait(rb_fd); // blocks rec = bpf_ringbuf_reserve(&rb, ...); bpf_ringbuf_discard(rec, BPF_RB_NO_WAKEUP); rec = bpf_ringbuf_reserve(&rb, ...); bpf_ringbuf_submit(rec, 0); // valid record, but no wakeup Document this in bpf_ringbuf_discard() to make the interaction between discarded records, user-space consumption, and adaptive wakeups explicit. Reported-by: Shmulik Ladkani Signed-off-by: Eyal Birger Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260331130612.3762433-1-eyal.birger@gmail.com ---- v2: adapt wording per feedback from Andrii. commit dbb6153c1395a0f310411f440330efe4ee3f4d82 Author: Ricardo B. Marlière Date: Fri Mar 20 15:29:16 2026 -0300 selftests/run_kselftest.sh: Remove unused $ROOT Fix the following shellcheck warning: ROOT appears unused. Verify use (or export if used externally). [SC2034] Signed-off-by: Ricardo B. Marlière Link: https://lore.kernel.org/r/20260320-selftests-fixes-v1-1-79144f76be01@suse.com Signed-off-by: Shuah Khan commit d3e2c7476e378089d56067202f4d29969fbd47b3 Author: Shi Hao Date: Mon Mar 30 11:14:39 2026 +0530 dt-bindings: i2c: intel,ixp4xx-i2c: Convert to DT schema Convert the IOP3xx and IXP4xx XScale bindings to DT schema. This conversion also adds the interrupts property, as it is used by the driver and existing DTS files but was not documented in the original binding. Signed-off-by: Shi Hao Reviewed-by: Krzysztof Kozlowski Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260330054439.9545-1-i.shihao.999@gmail.com commit 261a02b93d9b6dfdc49b3e675be1a0e677cf71f3 Author: Alison Schofield Date: Mon Mar 30 17:50:45 2026 -0700 cxl/core: Check existence of cxl_memdev_state in poison test Before now, all CXL memdevs were assumed to have a mailbox-backed cxl_memdev_state, so poison command checks could safely dereference the @mds. With the introduction of Type 2 devices, a memdev may not implement a mailbox interface, and so there is no associated cxl_memdev_state. Guard against this case by returning false when @mds is absent. Signed-off-by: Alison Schofield Reviewed-by: Alejandro Lucero Link: https://patch.msgid.link/20260331005047.2813980-1-alison.schofield@intel.com Signed-off-by: Dave Jiang commit 9d2dbd3d59d8fb9cfd98bf857975fcd151fb3946 Author: Dmytro Maluka Date: Thu Mar 19 16:38:12 2026 +0100 selftests/cpu-hotplug: Fix check for cpu hotplug not supported If CONFIG_HOTPLUG_CPU is disabled, /sys/devices/system/cpu/cpu* directories are still populated, so the test fails to correctly detect that CPU hotplug is not supported. Fix this by checking for the presence of 'online' files in those directories instead. The 'online' node is created for the given CPU if and only if this CPU supports hotplug. So if none of the CPUs have 'online' nodes, it means CPU hotplug is not supported. Signed-off-by: Dmytro Maluka Link: https://lore.kernel.org/r/20260319153825.2813576-1-dmaluka@chromium.org Signed-off-by: Shuah Khan commit 421a41c485dde449cbf90ba610b805bd99e3ae78 Author: Guilherme G. Piccoli Date: Sun Mar 1 16:26:36 2026 -0300 pstore/ftrace: Keep ftrace module parameter and debugfs switch in sync Commit a5d05b07961a ("pstore/ftrace: Allow immediate recording") introduced a kernel parameter to enable early-boot collection for ftrace frontend. But then, if we enable the debugfs later, the parameter remains set as N. This is not a biggie, things work fine; but at the same time, why not have both in sync if possible, right? Cc: Uwe Kleine-König Signed-off-by: Guilherme G. Piccoli Link: https://patch.msgid.link/20260301192704.1263589-1-gpiccoli@igalia.com Signed-off-by: Kees Cook commit 2ddb69f686ef7a621645e97fc7329c50edf5d0e5 Author: Cole Leavitt Date: Wed Feb 25 16:54:06 2026 -0700 pstore/ram: fix resource leak when ioremap() fails In persistent_ram_iomap(), ioremap() or ioremap_wc() may return NULL on failure. Currently, if this happens, the function returns NULL without releasing the memory region acquired by request_mem_region(). This leads to a resource leak where the memory region remains reserved but unusable. Additionally, the caller persistent_ram_buffer_map() handles NULL correctly by returning -ENOMEM, but without this check, a NULL return combined with request_mem_region() succeeding leaves resources in an inconsistent state. This is the ioremap() counterpart to commit 05363abc7625 ("pstore: ram_core: fix incorrect success return when vmap() fails") which fixed a similar issue in the vmap() path. Fixes: 404a6043385d ("staging: android: persistent_ram: handle reserving and mapping memory") Signed-off-by: Cole Leavitt Link: https://patch.msgid.link/20260225235406.11790-1-cole@unwrap.rs Signed-off-by: Kees Cook commit b22462c79179f228327b98313b47369129114d6a Author: Guilherme G. Piccoli Date: Wed Feb 18 16:37:32 2026 -0300 pstore/ramoops: Fix ECC parameter help text In order to set ECC on ramoops, the parameter "ecc" should be used. The variable that carries this information is "ramoops_ecc". Due to some confusion in the parameter setting functions, modinfo ends-up showing both "ecc" and "ramoops_ecc" as valid parameters, but only "ecc" is the valid one, hence this fix to the parameter help text. Signed-off-by: Guilherme G. Piccoli Link: https://patch.msgid.link/20260218193940.912143-3-gpiccoli@igalia.com Signed-off-by: Kees Cook commit 80632e333b0bd3cf188cff4e7ff52114506f5612 Author: Guilherme G. Piccoli Date: Wed Feb 18 16:37:31 2026 -0300 pstore/ramoops: Remove useless memblock header Seems the linux/memblock.h inclusion was added early on due to usage of some memblock allocation routine. But that was removed, header was forgotten, hence let's remove that. Signed-off-by: Guilherme G. Piccoli Link: https://patch.msgid.link/20260218193940.912143-2-gpiccoli@igalia.com Signed-off-by: Kees Cook commit 4ef6255cc56343bc90d82420b49dab1b11dee414 Author: Andrey Skvortsov Date: Sun Feb 15 21:51:55 2026 +0300 pstore: fix ftrace dump, when ECC is enabled total_size is sum of record->size and record->ecc_notice_size (ECC: No errors detected). When ECC is not used, then there is no problem. When ECC is enabled, then ftrace dump is decoded incorrectly after restart. First this affects starting offset calculation, that breaks reading of all ftrace records. CPU:66 ts:51646260179894273 3818ffff80008002 fe00ffff800080f0 0x3818ffff80008002 <- 0xfe00ffff800080f0 CPU:66 ts:56589664458375169 3818ffff80008002 ff02ffff800080f0 0x3818ffff80008002 <- 0xff02ffff800080f0 CPU:67 ts:13194139533313 afe4ffff80008002 1ffff800080f0 0xafe4ffff80008002 <- 0x1ffff800080f0 CPU:67 ts:13194139533313 b7d0ffff80008001 100ffff80008002 0xb7d0ffff80008001 <- 0x100ffff80008002 CPU:67 ts:51646260179894273 8de0ffff80008001 202ffff80008002 0x8de0ffff80008001 <- 0x202ffff80008002 Second ECC notice message is printed like ftrace record and as a result couple of last records are completely wrong. For example, when the starting offset is fixed: CPU:0 ts:113 ffffffc00879bd04 ffffffc0080dc08c cpuidle_enter <- do_idle+0x20c/0x290 CPU:0 ts:114 ffffffc00879bd04 ffffffc0080dc08c cpuidle_enter <- do_idle+0x20c/0x290 CPU:100 ts:28259048229270629 6f4e203a4343450a 2073726f72726520 0x6f4e203a4343450a <- 0x2073726f72726520 Signed-off-by: Andrey Skvortsov Tested-by: Guilherme G. Piccoli Link: https://patch.msgid.link/20260215185156.317394-1-andrej.skvortzov@gmail.com Signed-off-by: Kees Cook commit 2ab739383113107a1335ce7bcbc93110afb69267 Author: Waiman Long Date: Tue Mar 31 14:35:22 2026 -0400 workqueue: Remove HK_TYPE_WQ from affecting wq_unbound_cpumask For historical reason, wq_unbound_cpumask is initially set as intersection of HK_TYPE_DOMAIN, HK_TYPE_WQ and workqueue.unbound_cpus boot command line option. At run time, users can update the unbound cpumask via the /sys/devices/virtual/workqueue/cpumask sysfs file. Creation and modification of cpuset isolated partitions will also update wq_unbound_cpumask based on the latest HK_TYPE_DOMAIN cpumask. The HK_TYPE_WQ cpumask is out of the picture with these runtime updates. Complete the transition by taking HK_TYPE_WQ out from the workqueue code and make it depends on HK_TYPE_DOMAIN only from the housekeeping side. The final goal is to eliminate HK_TYPE_WQ as a housekeeping cpumask type. Signed-off-by: Waiman Long Acked-by: Frederic Weisbecker Signed-off-by: Tejun Heo commit 00247cbf173a9e1e2304db8e3f9172d36366b255 Author: Kees Cook Date: Tue Mar 31 09:37:19 2026 -0700 refcount: Remove unused __signed_wrap function annotations With CONFIG_UBSAN_INTEGER_WRAP being replaced by Overflow Behavior Types, remove the __signed_wrap function annotation as it is already unused, and any future work here will use OBT annotations instead. Link: https://patch.msgid.link/20260331163725.2765789-1-kees@kernel.org Signed-off-by: Kees Cook commit 9bdbf7eb25b3121ef19533df4fb70f2c39fc0d6a Merge: 28899037b85e77 7c50d748b4a635 Author: Dave Airlie Date: Wed Apr 1 07:20:59 2026 +1000 Merge tag 'drm-rust-next-2026-03-30' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-next DRM Rust changes for v7.1-rc1 - DMA: - Rework the DMA coherent API: introduce Coherent as a generalized container for arbitrary types, replacing the slice-only CoherentAllocation. Add CoherentBox for memory initialization before exposing a buffer to hardware (converting to Coherent when ready), and CoherentHandle for allocations without kernel mapping. - Add Coherent::init() / init_with_attrs() for one-shot initialization via pin-init, and from-slice constructors for both Coherent and CoherentBox - Add uaccess write_dma() for copying from DMA buffers to userspace and BinaryWriter support for Coherent - DRM: - Add GPU buddy allocator abstraction - Add DRM shmem GEM helper abstraction - Allow drm::Device to dispatch work and delayed work items to driver private data - Add impl_aref_for_gem_obj!() macro to reduce GEM refcount boilerplate, and introduce DriverObject::Args for constructor context - Add dma_resv_lock helper and raw_dma_resv() accessor on GEM objects - Clean up imports across the DRM module - I/O: - Merged via a signed tag from the driver-core tree: register!() macro and I/O infrastructure improvements (IoCapable refactor, RelaxedMmio wrapper, IoLoc trait, generic accessors, write_reg / LocatedRegister) - Nova (Core): - Fix and harden the GSP command queue: correct write pointer advancing, empty slot handling, and ring buffer indexing; add mutex locking and make Cmdq a pinned type; distinguish wait vs no-wait commands - Add support for large RPCs via continuation records, splitting oversized commands across multiple queue slots - Simplify GSP sequencer and message handling code: remove unused trait and Display impls, derive Debug and Zeroable where applicable, warn on unconsumed message data - Refactor Falcon firmware handling: create DMA objects lazily, add PIO upload support, and use the Generic Bootloader to boot FWSEC on Turing - Convert all register definitions (PMC, PBUS, PFB, GC6, FUSE, PDISP, Falcon) to the kernel register!() macro; add bounded_enum macro to define enums usable as register fields - Migrate all DMA usage to the new Coherent, CoherentBox, and CoherentHandle APIs - Harden firmware parsing with checked arithmetic throughout FWSEC, Booter, RISC-V parsing paths - Add debugfs support for reading GSP-RM log buffers; replace module_pci_driver!() with explicit module init to support module-level debugfs setup - Fix auxiliary device registration for multi-GPU systems - Various cleanups: import style, firmware parsing refactoring, framebuffer size logging - Rust: - Add interop::list module providing a C linked list interface - Extend num::Bounded with shift operations, into_bool(), and const get() to support register bitfield manipulation - Enable the generic_arg_infer Rust feature and add EMSGSIZE error code - Tyr: - Adopt vertical import style per kernel Rust guidelines - Clarify driver/device type names and use DRM device type alias consistently across the driver - Fix GPU model/version decoding in GpuInfo - Workqueue: - Add ARef support for work and delayed work Signed-off-by: Dave Airlie From: "Danilo Krummrich" Link: https://patch.msgid.link/DHGH4BLT03BU.ZJH5U52WE8BY@kernel.org commit 64fac99037689020ad97e472ae898e96ea3616dc Author: Simon Liebold Date: Thu Mar 12 14:02:00 2026 +0000 selftests/mqueue: Fix incorrectly named file Commit 85506aca2eb4 ("selftests/mqueue: Set timeout to 180 seconds") intended to increase the timeout for mq_perf_tests from the default kselftest limit of 45 seconds to 180 seconds. Unfortunately, the file storing this information was incorrectly named `setting` instead of `settings`, causing the kselftest runner not to pick up the limit and keep using the default 45 seconds limit. Fix this by renaming it to `settings` to ensure that the kselftest runner uses the increased timeout of 180 seconds for this test. Fixes: 85506aca2eb4 ("selftests/mqueue: Set timeout to 180 seconds") Cc: # 5.10.y Signed-off-by: Simon Liebold Link: https://lore.kernel.org/r/20260312140200.2224850-1-simonlie@amazon.de Signed-off-by: Shuah Khan commit 6453ad0865b68ab0de5873c1a8bb4addbbde5c19 Author: Dmitry Baryshkov Date: Tue Mar 24 02:10:45 2026 +0200 ARM: dts: qcom: msm8974: Drop RPM bus clocks Some nodes are abusingly referencing some of the internal bus clocks, that were recently removed in Linux (because the original implementation did not make much sense), managing them as if they were the only devices on an NoC bus. These clocks are now handled from within the icc framework and are no longer registered from within the CCF. Remove them. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Tested-by: Luca Weiss # fairphone-fp2 Tested-by: Alexandre Messier Link: https://lore.kernel.org/r/20260324-msm8974-icc-v2-9-527280043ad8@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2964f6b816c25ee094df4a143eb5b8828910045f Author: Hangbin Liu Date: Wed Feb 25 01:08:33 2026 +0000 selftests: Use ktap helpers for runner.sh Instead of manually writing ktap messages, we should use the formal ktap helpers in runner.sh. Brendan did some work in commit d9e6269e3303 ("selftests/run_kselftest.sh: exit with error if tests fail") to make run_kselftest.sh exit with the correct return value. However, the output does not include the total results, such as how many tests passed or failed. Let’s convert all manually printed messages in runner.sh to use the formal ktap helpers. Here are what I changed: 1. Move TAP header from runner.sh to run_kselftest.sh, since run_kselftest.sh is the only caller of run_many(). 2. In run_kselftest.sh, call run_many() in main process to count the pass/fail numbers. 3. In run_kselftest.sh, do not generate kselftest_failures_file. Just use ktap_print_totals to report the result. 4. In runner.sh run_one(), get the return value and use ktap helpers for all pass/fail reporting. This allows counting pass/fail numbers in the main process. 5. In runner.sh run_in_netns(), also return the correct rc, so we can count results during wait. After the change, the printed result looks like: not ok 4 4 selftests: clone3: clone3_cap_checkpoint_restore # exit=1 # Totals: pass:3 fail:1 xfail:0 xpass:0 skip:0 error:0 ]# echo $? 1 Fixed change log commit description errors and long lines: Shuah Khan Tested-by: Brendan Jackman Signed-off-by: Hangbin Liu Reviewed-by: Brendan Jackman Link: https://lore.kernel.org/r/20260225010833.11301-1-liuhangbin@gmail.com Signed-off-by: Shuah Khan commit 64ac64bb62064dbfbb66964331f5a2af6adeb03b Author: Akhil P Oommen Date: Fri Mar 27 05:44:06 2026 +0530 drm/msm/adreno: Expose a PARAM to check AQE support AQE (Applicaton Qrisc Engine) is required to support VK ray-pipeline. Two conditions should be met to use this HW: 1. AQE firmware should be loaded and programmed 2. Preemption support Expose a new MSM_PARAM to allow userspace to query its support. Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/714685/ Message-ID: <20260327-a8xx-gpu-batch2-v2-17-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit 7fad33097e67781ad2a295652702788a5ab8e065 Author: Akhil P Oommen Date: Fri Mar 27 05:44:05 2026 +0530 drm/msm/a6xx: Enable Preemption on X2-85 Add the save-restore register lists and set the necessary quirk flags in the catalog to enable the Preemption feature on Adreno X2-85 GPU. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714684/ Message-ID: <20260327-a8xx-gpu-batch2-v2-16-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit a693602ef56f6bf89fb497f3e3410785b8ef05cc Author: Akhil P Oommen Date: Fri Mar 27 05:44:04 2026 +0530 drm/msm/a8xx: Preemption support for A840 The programing sequence related to preemption is unchanged from A7x. But there is some code churn due to register shuffling in A8x. So, split out the common code into a header file for code sharing and add/update additional changes required to support preemption feature on A8x GPUs. Finally, enable the preemption quirk in A840's catalog to enable this feature. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714682/ Message-ID: <20260327-a8xx-gpu-batch2-v2-15-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit ee37487ffecff1de834fa05b0e4b1c1d920a8189 Author: Akhil P Oommen Date: Fri Mar 27 05:44:03 2026 +0530 drm/msm/a8xx: Implement IFPC support for A840 Implement pwrup reglist support and add the necessary register configurations to enable IFPC support on A840 Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714679/ Message-ID: <20260327-a8xx-gpu-batch2-v2-14-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit dd108bb9da731d1d68245a7460c6a54a584c913d Author: Akhil P Oommen Date: Fri Mar 27 05:44:02 2026 +0530 drm/msm/a6xx: Add SKU detection support for X2-85 Add the Speedbin table to the catalog to enable SKU detection support for X2-85 GPU found in Glymur chipset. As this chipset support the SOFT FUSE mechanism, enable the ADRENO_QUIRK_SOFTFUSE quirk too. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714677/ Message-ID: <20260327-a8xx-gpu-batch2-v2-13-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit 4ac686bfd1929ef659a99f893ebe8faf7f35c76c Author: Akhil P Oommen Date: Fri Mar 27 05:44:01 2026 +0530 drm/msm/a6xx: Add soft fuse detection support Recent chipsets like Glymur supports a new mechanism for SKU detection. A new CX_MISC register exposes the combined (or final) speedbin value from both HW fuse register and the Soft Fuse register. Implement this new SKU detection along with a new quirk to identify the GPUs that has soft fuse support. There is a side effect of this patch on A4x and older series. The speedbin field in the MSM_PARAM_CHIPID will be 0 instead of 0xffff. This should be okay as Mesa correctly handles it. Speedbin was not even a thing when those GPUs' support were added. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714676/ Message-ID: <20260327-a8xx-gpu-batch2-v2-12-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit bb79a606321ae63cb086bd34d38de7bb1a1231f7 Author: Akhil P Oommen Date: Fri Mar 27 05:44:00 2026 +0530 drm/msm/a8xx: Add SKU table for A840 Add the SKU table in the catalog for A840 GPU. This data helps to pick the correct bin from the OPP table based on the speed_bin fuse value. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714673/ Message-ID: <20260327-a8xx-gpu-batch2-v2-11-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit 742b4e88cddb9840234623db9f3dc06a4d7c9135 Author: Akhil P Oommen Date: Fri Mar 27 05:43:59 2026 +0530 drm/msm/a6xx: Update HFI definitions Update the HFI definitions to support additional GMU based power features. Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/714671/ Message-ID: <20260327-a8xx-gpu-batch2-v2-10-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit 29c1d7e5db01e870b11fb40126d5044f9da9e92b Author: Akhil P Oommen Date: Fri Mar 27 05:43:58 2026 +0530 drm/msm/a6xx: Use packed structs for HFI HFI related structs define the ABI between the KMD and the GMU firmware. So, use packed structures to avoid unintended compiler inserted padding. Reviewed-by: Konrad Dybcio Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714669/ Message-ID: <20260327-a8xx-gpu-batch2-v2-9-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit 61957ab99d8c47a74a44fa85740ec0d922359554 Author: Akhil P Oommen Date: Fri Mar 27 05:43:56 2026 +0530 drm/msm/a6xx: Add support for Debug HFI Q Add the Debug HFI Queue which contains the F2H messages posted from the GMU firmware. Having this data in coredump is useful to debug firmware issues. Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/714666/ Message-ID: <20260327-a8xx-gpu-batch2-v2-7-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit bb9b1d6e945ea90459bda1aac7e2aa7179119887 Author: Akhil P Oommen Date: Fri Mar 27 05:43:55 2026 +0530 drm/msm/a6xx: Fix gpu init from secure world A7XX_GEN2 and newer GPUs requires initialization of few configurations related to features/power from secure world. The SCM call to do this should be triggered after GDSC and clocks are enabled. So, keep this sequence to a6xx_gmu_resume instead of the probe. Also, simplify the error handling in a6xx_gmu_resume() using 'goto' labels. Fixes: 14b27d5df3ea ("drm/msm/a7xx: Initialize a750 "software fuse"") Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714664/ Message-ID: <20260327-a8xx-gpu-batch2-v2-6-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit ae25e6e9cdcac4cfef102b9d6de8bff13ca4d13b Author: Akhil P Oommen Date: Fri Mar 27 05:43:54 2026 +0530 drm/msm/adreno: Implement gx_is_on() for A8x A8x has a diverged enough for a separate implementation of gx_is_on() check. Add that and move them to the adreno func table. Fixes: 288a93200892 ("drm/msm/adreno: Introduce A8x GPU Support") Reviewed-by: Konrad Dybcio Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714661/ Message-ID: <20260327-a8xx-gpu-batch2-v2-5-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit d34b6919798c1a8c93e1d7cca297d0e068146bd5 Author: Akhil P Oommen Date: Fri Mar 27 05:43:53 2026 +0530 drm/msm/a6xx: Correct OOB usage During the GMU resume sequence, using another OOB other than OOB_GPU may confuse the internal state of GMU firmware. To align more strictly with the downstream sequence, move the sysprof related OOB setup after the OOB_GPU is cleared. Fixes: 62cd0fa6990b ("drm/msm/adreno: Disable IFPC when sysprof is active") Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714659/ Message-ID: <20260327-a8xx-gpu-batch2-v2-4-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit 0c59f258ffd4c9c2a6bd37d71a0ade1db8bc03b7 Author: Akhil P Oommen Date: Fri Mar 27 05:43:52 2026 +0530 drm/msm/a6xx: Switch to preemption safe AO counter CP_ALWAYS_ON_COUNTER is not save-restored during preemption, so it won't provide accurate data about the 'submit' when preemption is enabled. Switch to CP_ALWAYS_ON_CONTEXT which is preemption safe. Fixes: e7ae83da4a28 ("drm/msm/a6xx: Implement preemption for a7xx targets") Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714657/ Message-ID: <20260327-a8xx-gpu-batch2-v2-3-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit cfc8b48649e159ff394fb4b7b08e5006c5c1c234 Author: Akhil P Oommen Date: Fri Mar 27 05:43:51 2026 +0530 drm/msm/a8xx: Fix the ticks used in submit traces GMU_ALWAYS_ON_COUNTER_* registers got moved in A8x, but currently, A6x register offsets are used in the submit traces instead of A8x offsets. To fix this, refactor a bit and use adreno_gpu->funcs->get_timestamp() everywhere. While we are at it, update a8xx_gmu_get_timestamp() to use the GMU AO counter. Fixes: 288a93200892 ("drm/msm/adreno: Introduce A8x GPU Support") Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714655/ Message-ID: <20260327-a8xx-gpu-batch2-v2-2-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit dc78b35d5ec09d1b0b8a937e6e640d2c5a030915 Author: Akhil P Oommen Date: Fri Mar 27 05:43:50 2026 +0530 drm/msm/a6xx: Use barriers while updating HFI Q headers To avoid harmful compiler optimizations and IO reordering in the HW, use barriers and READ/WRITE_ONCE helpers as necessary while accessing the HFI queue index variables. Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support") Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/714653/ Message-ID: <20260327-a8xx-gpu-batch2-v2-1-2b53c38d2101@oss.qualcomm.com> Signed-off-by: Rob Clark commit 47cbfe2608314b833ad61a65827d8fb363bc2d2d Author: Yasuaki Torimaru Date: Wed Mar 25 20:46:34 2026 +0900 drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not. Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call. Add the missing NULL check for kmemdup() and return ret instead of 0. Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret. Fixes: 9902cb999e4e ("drm/msm/gem: Add metadata") Cc: stable@vger.kernel.org Signed-off-by: Yasuaki Torimaru Patchwork: https://patchwork.freedesktop.org/patch/714478/ Message-ID: <20260325114635.383241-1-yasuakitorimaru@gmail.com> Signed-off-by: Rob Clark commit cc83f71c9be0715fe93b963ffa9767d5d84354ed Author: Connor Abbott Date: Wed Mar 25 16:58:37 2026 -0400 drm/msm/a6xx: Fix dumping A650+ debugbus blocks These should be appended after the existing debugbus blocks, instead of replacing them. Fixes: 1e05bba5e2b8 ("drm/msm/a6xx: Update a6xx gpu coredump") Signed-off-by: Connor Abbott Patchwork: https://patchwork.freedesktop.org/patch/714270/ Message-ID: <20260325-drm-msm-a650-debugbus-v1-1-dfbf358890a7@gmail.com> Signed-off-by: Rob Clark commit df0f439e3926817cf577ca6272aad68468ff7624 Author: Rob Clark Date: Wed Mar 25 11:41:05 2026 -0700 drm/msm/shrinker: Fix can_block() logic The intention here was to allow blocking if DIRECT_RECLAIM or if called from kswapd and KSWAPD_RECLAIM is set. Reported by Claude code review: https://lore.gitlab.freedesktop.org/drm-ai-reviews/review-patch9-20260309151119.290217-10-boris.brezillon@collabora.com/ on a panthor patch which had copied similar logic. Reported-by: Boris Brezillon Fixes: 7860d720a84c ("drm/msm: Fix build break with recent mm tree") Signed-off-by: Rob Clark Reviewed-by: Boris Brezillon Patchwork: https://patchwork.freedesktop.org/patch/714238/ Message-ID: <20260325184106.1259528-1-robin.clark@oss.qualcomm.com> commit c289a6db9ba6cb974f0317da142e4f665d589566 Author: Rob Clark Date: Wed Mar 25 11:40:42 2026 -0700 drm/msm/a6xx: Fix HLSQ register dumping Fix the bitfield offset of HLSQ_READ_SEL state-type bitfield. Otherwise we are always reading TP state when we wanted SP or HLSQ state. Reported-by: Connor Abbott Suggested-by: Connor Abbott Fixes: 1707add81551 ("drm/msm/a6xx: Add a6xx gpu state") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/714236/ Message-ID: <20260325184043.1259312-1-robin.clark@oss.qualcomm.com> commit 85042c2cd970a6b0e686329387096fe19989ae62 Author: Rob Clark Date: Tue Mar 24 15:05:18 2026 -0700 drm/msm: Fix VM_BIND UNMAP locking Wrong argument meant that the objs involved in UNMAP ops were not always getting locked. Since _NO_SHARE objs share a common resv with the VM (which is always locked) this would only show up with non-_NO_SHARE BOs. Reported-by: Victoria Brekenfeld Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/94 Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/713898/ Message-ID: <20260324220519.1221471-2-robin.clark@oss.qualcomm.com> commit c07612365087c8873f3faa2a47642ffa73b12c54 Author: Rob Clark Date: Tue Mar 24 15:05:17 2026 -0700 drm/msm: Disallow foreign mapping of _NO_SHARE This restriction applies to mapping of _NO_SHARE objs in the kms vm as well as importing/exporting BOs. Since the DPU has it's own VM, scanout counts as "exporting" a BO from outside of it's host VM. Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/713897/ Message-ID: <20260324220519.1221471-1-robin.clark@oss.qualcomm.com> commit cf50ccdb765b3a6f1cd8e75642b0439fea0263a5 Author: Rob Clark Date: Wed Mar 25 11:59:26 2026 -0700 drm/msm: Reject fb creation from _NO_SHARE objs It would be an error to map these into kms->vm. So reject this as early as possible, when creating an fb. Fixes: b58e12a66e47 ("drm/msm: Add _NO_SHARE flag") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/714264/ Message-ID: <20260325185926.1265661-1-robin.clark@oss.qualcomm.com> commit d4ef6d77bb1ef92bdbfb70c7a5d08072848357d8 Author: Rob Clark Date: Mon Mar 23 09:16:02 2026 -0700 drm/msm/a6xx: Add missing aperture_lock init Looks like this was somehow missed when introducing gen8 support. Fixes: 288a93200892 ("drm/msm/adreno: Introduce A8x GPU Support") Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Reviewed-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/713545/ Message-ID: <20260323161603.1165108-1-robin.clark@oss.qualcomm.com> commit 8a7023b035355ef5bfa096bd323256fa8abbbc6a Author: Rob Clark Date: Mon Mar 16 11:44:42 2026 -0700 drm/msm/vma: Avoid lock in VM_BIND fence signaling path Use msm_gem_unpin_active(), similar to what is used in the GEM_SUBMIT path. This avoids needing to hold the obj lock, and the end result is the same. (As with GEM_SUBMIT, we know the fence isn't signaled yet.) Reported-by: Akhil P Oommen Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/712230/ Message-ID: <20260316184442.673558-1-robin.clark@oss.qualcomm.com> commit 9d24ec327690d8b27190331386319a5c98ec61e7 Author: Rob Clark Date: Mon Mar 16 11:34:34 2026 -0700 drm/msm/a8xx: Update GPU name with slice_mask Once we've updated the chip_id after reading the slice_mask, also update the GPU name so it matches. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/712225/ Message-ID: <20260316183436.671482-3-robin.clark@oss.qualcomm.com> commit cc53487e01fc209079b703730e0c513b06975545 Author: Rob Clark Date: Mon Mar 16 11:34:33 2026 -0700 drm/msm/adreno: Change chip_id format The "ipv4-style" %u.%u.%u.%u used to make sense when the chip_id was simply encoding gen.major.minor.patch. But this hasn't been true for at least a couple years. Switch to %08x, which is still easy enough to read for older devices, and much easier to read with the new scheme. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/712222/ Message-ID: <20260316183436.671482-2-robin.clark@oss.qualcomm.com> commit cb9af17e11ec82ca729660f7e9f536bd6d6928a6 Author: Krzysztof Kozlowski Date: Sun Mar 1 15:20:34 2026 +0100 dt-bindings: display/msm/gpu: Drop redundant reg-names in one if:then: Top-level reg-names defines already proper order for "reg-names" with minItems: 1, so no need to repeat it again in one of "if:then:" cases. Signed-off-by: Krzysztof Kozlowski Reviewed-by: David Heidelberg Reviewed-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/707987/ Message-ID: <20260301142033.88851-2-krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Rob Clark commit 01a0d6cd7032e9993feea19fadb03ef9d5b488f2 Author: Anna Maniscalco Date: Tue Feb 10 17:29:42 2026 +0100 drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted. Recover_worker will first increment the fence of the hung ring so, if there's only one job submitted to a ring and that causes an hang, it will early out. There's no guarantee that the gpu will suspend and resume before more work is submitted and if the gpu is in a hung state it will stay in that state and probably trigger a timeout again. Just stop checking and always recover the gpu. Signed-off-by: Anna Maniscalco Cc: stable@vger.kernel.org Patchwork: https://patchwork.freedesktop.org/patch/704066/ Message-ID: <20260210-recovery_suspend_fix-v1-1-00ed9013da04@gmail.com> Signed-off-by: Rob Clark commit 6a0b843a16751e3b1ebac794984d4e48384f9078 Author: Richard Acayan Date: Mon Feb 9 20:46:03 2026 -0500 dt-bindings: display/msm/gmu: Add SDM670 compatible The Snapdragon 670 has a GMU. Add its compatible. Signed-off-by: Richard Acayan Acked-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/703803/ Message-ID: <20260210014603.1372-2-mailingradian@gmail.com> Signed-off-by: Rob Clark commit 4625fe5bbdaccd45be274c30ff0a42e30d4e38cf Author: Sergey Senozhatsky Date: Tue Jan 27 16:33:34 2026 +0900 drm: gpu: msm: forbid mem reclaim from reset We sometimes get into a situtation where GPU hangcheck fails to recover GPU: [..] msm_dpu ae01000.display-controller: [drm:hangcheck_handler] *ERROR* (IPv4: 1): hangcheck detected gpu lockup rb 0! msm_dpu ae01000.display-controller: [drm:hangcheck_handler] *ERROR* (IPv4: 1): completed fence: 7840161 msm_dpu ae01000.display-controller: [drm:hangcheck_handler] *ERROR* (IPv4: 1): submitted fence: 7840162 msm_dpu ae01000.display-controller: [drm:hangcheck_handler] *ERROR* (IPv4: 1): hangcheck detected gpu lockup rb 0! msm_dpu ae01000.display-controller: [drm:hangcheck_handler] *ERROR* (IPv4: 1): completed fence: 7840162 msm_dpu ae01000.display-controller: [drm:hangcheck_handler] *ERROR* (IPv4: 1): submitted fence: 7840163 [..] The problem is that msm_job worker is blocked on gpu->lock INFO: task ring0:155 blocked for more than 122 seconds. Not tainted 6.6.99-08727-gaac38b365d2c #1 task:ring0 state:D stack:0 pid:155 ppid:2 flags:0x00000008 Call trace: __switch_to+0x108/0x208 schedule+0x544/0x11f0 schedule_preempt_disabled+0x30/0x50 __mutex_lock_common+0x410/0x850 __mutex_lock_slowpath+0x28/0x40 mutex_lock+0x5c/0x90 msm_job_run+0x9c/0x140 drm_sched_main+0x514/0x938 kthread+0x114/0x138 ret_from_fork+0x10/0x20 which is owned by recover worker, which is waiting for DMA fences from a memory reclaim path, under the very same gpu->lock INFO: task ring0:155 is blocked on a mutex likely owned by task gpu-worker:154. task:gpu-worker state:D stack:0 pid:154 ppid:2 flags:0x00000008 Call trace: __switch_to+0x108/0x208 schedule+0x544/0x11f0 schedule_timeout+0x1f8/0x770 dma_fence_default_wait+0x108/0x218 dma_fence_wait_timeout+0x6c/0x1c0 dma_resv_wait_timeout+0xe4/0x118 active_purge+0x34/0x98 drm_gem_lru_scan+0x1d0/0x388 msm_gem_shrinker_scan+0x1cc/0x2e8 shrink_slab+0x228/0x478 shrink_node+0x380/0x730 try_to_free_pages+0x204/0x510 __alloc_pages_direct_reclaim+0x90/0x158 __alloc_pages_slowpath+0x1d4/0x4a0 __alloc_pages+0x9f0/0xc88 vm_area_alloc_pages+0x17c/0x260 __vmalloc_node_range+0x1c0/0x420 kvmalloc_node+0xe8/0x108 msm_gpu_crashstate_capture+0x1e4/0x280 recover_worker+0x1c0/0x638 kthread_worker_fn+0x150/0x2d8 kthread+0x114/0x138 So no one can make any further progress. Forbid recover/fault worker to enter memory reclaim (under gpu->lock) to address this deadlock scenario. Cc: Tomasz Figa Signed-off-by: Sergey Senozhatsky Reviewed-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/700978/ Message-ID: <20260127073341.2862078-1-senozhatsky@chromium.org> Signed-off-by: Rob Clark commit f91ffe89b2016d280995a9c28d73288b02d83615 Author: Jialin Wang Date: Tue Mar 31 10:05:09 2026 +0000 blk-iocost: fix busy_level reset when no IOs complete When a disk is saturated, it is common for no IOs to complete within a timer period. Currently, in this case, rq_wait_pct and missed_ppm are calculated as 0, the iocost incorrectly interprets this as meeting QoS targets and resets busy_level to 0. This reset prevents busy_level from reaching the threshold (4) needed to reduce vrate. On certain cloud storage, such as Azure Premium SSD, we observed that iocost may fail to reduce vrate for tens of seconds during saturation, failing to mitigate noisy neighbor issues. Fix this by tracking the number of IO completions (nr_done) in a period. If nr_done is 0 and there are lagging IOs, the saturation status is unknown, so we keep busy_level unchanged. The issue is consistently reproducible on Azure Standard_D8as_v5 (Dasv5) VMs with 512GB Premium SSD (P20) using the script below. It was not observed on GCP n2d VMs (with 100G pd-ssd and 1.5T local-ssd), and no regressions were found with this patch. In this script, cgA performs large IOs with iodepth=128, while cgB performs small IOs with iodepth=1 rate_iops=100 rw=randrw. With iocost enabled, we expect it to throttle cgA, the submission latency (slat) of cgA should be significantly higher, cgB can reach 200 IOPS and the completion latency (clat) should below. BLK_DEVID="8:0" MODEL="rbps=173471131 rseqiops=3566 rrandiops=3566 wbps=173333269 wseqiops=3566 wrandiops=3566" QOS="rpct=90 rlat=3500 wpct=90 wlat=3500 min=80 max=10000" echo "$BLK_DEVID ctrl=user model=linear $MODEL" > /sys/fs/cgroup/io.cost.model echo "$BLK_DEVID enable=1 ctrl=user $QOS" > /sys/fs/cgroup/io.cost.qos CG_A="/sys/fs/cgroup/cgA" CG_B="/sys/fs/cgroup/cgB" FILE_A="/path/to/sda/A.fio.testfile" FILE_B="/path/to/sda/B.fio.testfile" RESULT_DIR="./iocost_results_$(date +%Y%m%d_%H%M%S)" mkdir -p "$CG_A" "$CG_B" "$RESULT_DIR" get_result() { local file=$1 local label=$2 local results=$(jq -r ' .jobs[0].mixed | ( .iops | tonumber | round ) as $iops | ( .bw_bytes / 1024 / 1024 ) as $bps | ( .slat_ns.mean / 1000000 ) as $slat | ( .clat_ns.mean / 1000000 ) as $avg | ( .clat_ns.max / 1000000 ) as $max | ( .clat_ns.percentile["90.000000"] / 1000000 ) as $p90 | ( .clat_ns.percentile["99.000000"] / 1000000 ) as $p99 | ( .clat_ns.percentile["99.900000"] / 1000000 ) as $p999 | ( .clat_ns.percentile["99.990000"] / 1000000 ) as $p9999 | "\($iops)|\($bps)|\($slat)|\($avg)|\($max)|\($p90)|\($p99)|\($p999)|\($p9999)" ' "$file") IFS='|' read -r iops bps slat avg max p90 p99 p999 p9999 <<<"$results" printf "%-8s %-6s %-7.2f %-8.2f %-8.2f %-8.2f %-8.2f %-8.2f %-8.2f %-8.2f\n" \ "$label" "$iops" "$bps" "$slat" "$avg" "$max" "$p90" "$p99" "$p999" "$p9999" } run_fio() { local cg_path=$1 local filename=$2 local name=$3 local bs=$4 local qd=$5 local out=$6 shift 6 local extra=$@ ( pid=$(sh -c 'echo $PPID') echo $pid >"${cg_path}/cgroup.procs" fio --name="$name" --filename="$filename" --direct=1 --rw=randrw --rwmixread=50 \ --ioengine=libaio --bs="$bs" --iodepth="$qd" --size=4G --runtime=10 \ --time_based --group_reporting --unified_rw_reporting=mixed \ --output-format=json --output="$out" $extra >/dev/null 2>&1 ) & } echo "Starting Test ..." for bs_b in "4k" "32k" "256k"; do echo "Running iteration: BS=$bs_b" out_a="${RESULT_DIR}/cgA_1m.json" out_b="${RESULT_DIR}/cgB_${bs_b}.json" # cgA: Heavy background (BS 1MB, QD 128) run_fio "$CG_A" "$FILE_A" "cgA" "1m" 128 "$out_a" # cgB: Latency sensitive (Variable BS, QD 1, Read/Write IOPS limit 100) run_fio "$CG_B" "$FILE_B" "cgB" "$bs_b" 1 "$out_b" "--rate_iops=100" wait SUMMARY_DATA+="$(get_result "$out_a" "cgA-1m")"$'\n' SUMMARY_DATA+="$(get_result "$out_b" "cgB-$bs_b")"$'\n\n' done echo -e "\nFinal Results Summary:\n" printf "%-8s %-6s %-7s %-8s %-8s %-8s %-8s %-8s %-8s %-8s\n" \ "" "" "" "slat" "clat" "clat" "clat" "clat" "clat" "clat" printf "%-8s %-6s %-7s %-8s %-8s %-8s %-8s %-8s %-8s %-8s\n\n" \ "CGROUP" "IOPS" "MB/s" "avg(ms)" "avg(ms)" "max(ms)" "P90(ms)" "P99" "P99.9" "P99.99" echo "$SUMMARY_DATA" echo "Results saved in $RESULT_DIR" Before: slat clat clat clat clat clat clat CGROUP IOPS MB/s avg(ms) avg(ms) max(ms) P90(ms) P99 P99.9 P99.99 cgA-1m 166 166.37 3.44 748.95 1298.29 977.27 1233.13 1300.23 1300.23 cgB-4k 5 0.02 0.02 181.74 761.32 742.39 759.17 759.17 759.17 cgA-1m 167 166.51 1.98 748.68 1549.41 809.50 1451.23 1551.89 1551.89 cgB-32k 6 0.18 0.02 169.98 761.76 742.39 759.17 759.17 759.17 cgA-1m 166 165.55 2.89 750.89 1540.37 851.44 1451.23 1535.12 1535.12 cgB-256k 5 1.30 0.02 191.35 759.51 750.78 759.17 759.17 759.17 After: slat clat clat clat clat clat clat CGROUP IOPS MB/s avg(ms) avg(ms) max(ms) P90(ms) P99 P99.9 P99.99 cgA-1m 162 162.48 6.14 749.69 850.02 826.28 834.67 843.06 851.44 cgB-4k 199 0.78 0.01 1.95 42.12 2.57 7.50 34.87 42.21 cgA-1m 146 146.20 6.83 833.04 908.68 893.39 901.78 910.16 910.16 cgB-32k 200 6.25 0.01 2.32 31.40 3.06 7.50 16.58 31.33 cgA-1m 110 110.46 9.04 1082.67 1197.91 1182.79 1199.57 1199.57 1199.57 cgB-256k 200 49.98 0.02 3.69 22.20 4.88 9.11 20.05 22.15 Signed-off-by: Jialin Wang Acked-by: Tejun Heo Link: https://patch.msgid.link/20260331100509.182882-1-wjl.linux@gmail.com Signed-off-by: Jens Axboe commit 23308af722fefed00af5f238024c11710938fba3 Author: Jackie Liu Date: Tue Mar 31 16:50:54 2026 +0800 blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() Add the missing put_disk() on the error path in blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or blkg_tryget() fails, the function jumps to the out label which only calls rcu_read_unlock() but does not release the disk reference acquired by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk is already set to NULL before the lookup, blkcg_exit() cannot release this reference either, causing the disk to never be freed. Restore the reference release that was present as blk_put_queue() in the original code but was inadvertently dropped during the conversion from request_queue to gendisk. Fixes: f05837ed73d0 ("blk-cgroup: store a gendisk to throttle in struct task_struct") Signed-off-by: Jackie Liu Acked-by: Tejun Heo Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260331085054.46857-1-liu.yun@linux.dev Signed-off-by: Jens Axboe commit 132618c5b69364b888b9cefc6c2ef6ee3f965ae6 Author: Thomas Weißschuh Date: Mon Mar 2 15:13:32 2026 +0100 selftests: harness: Validate intermixing of kselftest and harness functionality Make sure that calling ksft_test_result_*() functions from harness tests work as expected. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20260302-kselftest-harness-v2-5-3143aa41d989@linutronix.de Signed-off-by: Shuah Khan commit a0877a3590013e65acaf4929485b524b76b4e60d Author: Thomas Weißschuh Date: Mon Mar 2 15:13:31 2026 +0100 selftests: harness: Detect illegal mixing of kselftest and harness functionality Users may accidentally use the kselftest_test_result_*() functions in their harness tests. If ksft_finished() is not used, the results reported in this way are silently ignored. Detect such false-positive cases and fail the test. A more correct test would be to reject *any* usage of the ksft APIs but that would force code churn on users. Correct usages, which do use ksft_finished() will not trigger this validation as the test will exit before it. Reported-by: Yuwen Chen Link: https://lore.kernel.org/lkml/tencent_56D79AF3D23CEFAF882E83A2196EC1F12107@qq.com/ Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20260302-kselftest-harness-v2-4-3143aa41d989@linutronix.de Signed-off-by: Shuah Khan commit d431ea8695f4fed4aaf4f0cb81ec7d460a093dda Author: Thomas Weißschuh Date: Mon Mar 2 15:13:30 2026 +0100 selftests: kselftest: Add ksft_reset_state() Add a helper to reset the internal state of the kselftest framework. It will be used by the selftest harness. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20260302-kselftest-harness-v2-2-3143aa41d989@linutronix.de Signed-off-by: Shuah Khan commit 758b8905ec68afb80500321bcf0f22cadf715b51 Author: Thomas Weißschuh Date: Mon Mar 2 15:13:29 2026 +0100 selftests: harness: Validate that explicit kselftest exitcodes are handled The test programs can directly call exit with one of the KSFT_* constants. Add tests for this functionality. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20260302-kselftest-harness-v2-2-3143aa41d989@linutronix.de Signed-off-by: Shuah Khan commit fd1b4eb837c5d133139eeaf7ec8a330ed1bd13c5 Author: Thomas Weißschuh Date: Mon Mar 2 15:13:28 2026 +0100 selftests: kselftest: Treat xpass as successful result The harness treats these tests as successful, as does pytest. Align kselftest.h to the rest of the ecosystem. None of the Linux selftests seem to actually use this anyways. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20260302-kselftest-harness-v2-1-3143aa41d989@linutronix.de Signed-off-by: Shuah Khan commit 3d0b8e45075d398369eb07e11f529c17a63cf5e1 Author: Masami Hiramatsu (Google) Date: Tue Feb 10 18:54:22 2026 +0900 selftests/tracing: Fix to check awk supports non POSIX strtonum() Check the awk command supports non POSIX strtonum() function in the trace_marker_raw test case. Fixes: 37f46601383a ("selftests/tracing: Add basic test for trace_marker_raw file") Signed-off-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/r/177071726229.2369897.11506524546451139051.stgit@mhiramat.tok.corp.google.com Signed-off-by: Shuah Khan commit e011853dd78f97898ae8e0b0b949603987e24c4b Author: Masami Hiramatsu (Google) Date: Tue Feb 10 18:54:12 2026 +0900 selftests/tracing: Fix to make --logdir option work again Since commit a0aa283c53a7 ("selftest/ftrace: Generalise ftracetest to use with RV") moved the default LOG_DIR setting after --logdir option parser, it overwrites the user given LOG_DIR. This fixes it to check the --logdir option parameter when setting new default LOG_DIR with a new TOP_DIR. Fixes: a0aa283c53a7 ("selftest/ftrace: Generalise ftracetest to use with RV") Signed-off-by: Masami Hiramatsu (Google) Tested-by: Gabriele Monaco Link: https://lore.kernel.org/r/177071725191.2369897.14781037901532893911.stgit@mhiramat.tok.corp.google.com Signed-off-by: Shuah Khan commit 8053f49fed581c40fcc87fa54904f4fa473f46b7 Author: Steven Rostedt Date: Mon Mar 30 20:58:59 2026 -0400 tracing: Remove duplicate latency_fsnotify() stub When the SNAPSHOT is defined but FSNOTIFY is not the latency_fsnotify() function is turned into a static inline stub. But this stub was defined in both trace.h and trace_snapshot.c causing a error in build when CONFIG_SNAPSHOT is defined but FSNOTIFY is not. The stub is not needed in trace_snapshot.c as it will be defined in trace.h, remove it from the C file. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260330205859.24c0aae3@gandalf.local.home Fixes: bade44fe5462 ("tracing: Move snapshot code out of trace.c and into trace_snapshot.c") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603310604.lGE9LDBK-lkp@intel.com/ Signed-off-by: Steven Rostedt (Google) commit d1a03c2906c5debac79a810d5621fc242e2a7206 Author: Wesley Atwell Date: Mon Mar 30 12:11:03 2026 -0600 tracing: Preserve repeated trace_trigger boot parameters trace_trigger= tokenizes bootup_trigger_buf in place and stores pointers into that buffer for later trigger registration. Repeated trace_trigger= parameters overwrite the buffer contents from earlier calls, leaving only the last set of parsed event and trigger strings. Keep each new trace_trigger= string at the end of bootup_trigger_buf and parse only the appended range. That preserves the earlier event and trigger strings while still letting repeated parameters queue additional boot-time triggers. This also lets Bootconfig array values work naturally when they expand to repeated trace_trigger= entries. Before this change, only the last trace_trigger= instance survived boot. Link: https://patch.msgid.link/20260330181103.1851230-2-atwellwea@gmail.com Signed-off-by: Wesley Atwell Signed-off-by: Steven Rostedt (Google) commit 842b74e5ce05bb12f270689937092333c6c73f0e Author: Wesley Atwell Date: Mon Mar 30 12:11:02 2026 -0600 tracing: Append repeated boot-time tracing parameters Some tracing boot parameters already accept delimited value lists, but their __setup() handlers keep only the last instance seen at boot. Make repeated instances append to the same boot-time buffer in the format each parser already consumes. Use a shared trace_append_boot_param() helper for the ftrace filters, trace_options, and kprobe_event boot parameters. This also lets Bootconfig array values work naturally when they expand to repeated param=value entries. Before this change, only the last instance from each repeated parameter survived boot. Link: https://patch.msgid.link/20260330181103.1851230-1-atwellwea@gmail.com Signed-off-by: Wesley Atwell Signed-off-by: Steven Rostedt (Google) commit be3e5d10643d3be1cbac9d9939f220a99253f980 Author: Deepanshu Kartikey Date: Wed Apr 1 02:52:09 2026 +0900 nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() nilfs_ioctl_mark_blocks_dirty() uses bd_oblocknr to detect dead blocks by comparing it with the current block number bd_blocknr. If they differ, the block is considered dead and skipped. However, bd_oblocknr should never be 0 since block 0 typically stores the primary superblock and is never a valid GC target block. A corrupted ioctl request with bd_oblocknr set to 0 causes the comparison to incorrectly match when the lookup returns -ENOENT and sets bd_blocknr to 0, bypassing the dead block check and calling nilfs_bmap_mark() on a non-existent block. This causes nilfs_btree_do_lookup() to return -ENOENT, triggering the WARN_ON(ret == -ENOENT). Fix this by rejecting ioctl requests with bd_oblocknr set to 0 at the beginning of each iteration. [ryusuke: slightly modified the commit message and comments for accuracy] Fixes: 7942b919f732 ("nilfs2: ioctl operations") Reported-by: syzbot+98a040252119df0506f8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=98a040252119df0506f8 Suggested-by: Ryusuke Konishi Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+466a45fcfb0562f5b9a0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=466a45fcfb0562f5b9a0 Cc: Junjie Cao Signed-off-by: Ryusuke Konishi Signed-off-by: Viacheslav Dubeyko commit 62ba6d66b22356a6a78fd015c37fd108710dfc32 Author: Rosen Penev Date: Thu Mar 26 19:48:28 2026 -0700 EDAC/mc: Use kzalloc_flex() Convert struct mem_ctl_info to use flex array and use the new flex array helpers to enable runtime bounds checking, including annotating the array length member with __counted_by() for extra runtime analysis when requested. Move memcpy() after the counter assignment so that it is initialized before the first reference to the flex array, as the new attribute requires. [ bp: Heavily massage commit message. ] Signed-off-by: Rosen Penev Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Yazen Ghannam Reviewed-by: Qiuxu Zhuo Link: https://patch.msgid.link/20260327024828.7377-1-rosenp@gmail.com commit 44230bb342ffba040d56b0dc24c478797aad9b38 Author: Pavan Chebbi Date: Sat Mar 14 08:16:05 2026 -0700 fwctl/bnxt_fwctl: Add documentation entries Add bnxt_fwctl to the driver and fwctl documentation pages. Link: https://patch.msgid.link/r/20260314151605.932749-6-pavan.chebbi@broadcom.com Reviewed-by: Andy Gospodarek Reviewed-by: Dave Jiang Signed-off-by: Pavan Chebbi Signed-off-by: Jason Gunthorpe commit e782efb830cd8c1879ee15d80c6441ac9fa6c8a8 Author: Pavan Chebbi Date: Sat Mar 14 08:16:04 2026 -0700 fwctl/bnxt_fwctl: Add bnxt fwctl device Create bnxt_fwctl device. This will bind to bnxt's aux device. On the upper edge, it will register with the fwctl subsystem. It will make use of bnxt's ULP functions to send FW commands. Link: https://patch.msgid.link/r/20260314151605.932749-5-pavan.chebbi@broadcom.com Reviewed-by: Andy Gospodarek Reviewed-by: Dave Jiang Signed-off-by: Pavan Chebbi Signed-off-by: Jason Gunthorpe commit d3689cd02c5de52ff5f3044169c482aee0dd5a78 Author: Biju Das Date: Sat Mar 28 10:33:18 2026 +0000 irqchip/renesas-rzg2l: Clear the shared interrupt bit in rzg2l_irqc_free() rzg2l_irqc_free() invokes irq_domain_free_irqs_common(), which internally calls irq_domain_reset_irq_data(). That explicitly sets irq_data->hwirq to 0. Consequently, irqd_to_hwirq(d) returns 0 when called after it. Since 0 falls outside the valid shared IRQ ranges, rzg2l_irqc_is_shared_and_get_irq_num() evaluates to false, completely bypassing the test_and_clear_bit() operation. This leaves the bit set in priv->used_irqs, causing future allocations to fail with -EBUSY. Fix this by retrieving irq_data and caching hwirq before calling irq_domain_free_irqs_common(). Fixes: e0fcae27ff57 ("irqchip/renesas-rzg2l: Add shared interrupt support") Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260328103324.134131-2-biju.das.jz@bp.renesas.com commit 3a96c7915d93231e128df74901fe8fcb960b0ecb Author: Rafael J. Wysocki Date: Tue Mar 24 21:03:01 2026 +0100 platform/x86: toshiba_haps: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Toshiba HDD Active Protection Sensor driver from an ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Note that the sysfs attributes in haps_attr_group will still be there in the sysfs directory of the ACPI companion of the platform device used for driver binding in case there are tools in user space expecting them to be present there. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2045343.PYKUYFuaPT@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 32156fd2fbb8fc2d049ad459336cd71b2556f75a Author: Rafael J. Wysocki Date: Tue Mar 24 21:02:14 2026 +0100 platform/x86: toshiba_haps: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/10834562.nUPlyArG6x@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 553b2ac59fbb434330287fde0cabc64bc6f11ceb Author: Rafael J. Wysocki Date: Tue Mar 24 21:01:28 2026 +0100 platform/x86: toshiba_bluetooth: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Toshiba Bluetooth Enable driver from an ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3420881.44csPzL39Z@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4315abf338301090eec70c68117afa854fddb264 Author: Rafael J. Wysocki Date: Tue Mar 24 21:00:50 2026 +0100 platform/x86: toshiba_bluetooth: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3048289.e9J7NaK4W3@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 246d6cefe525f3fc760017e717bd77a3e751a260 Author: Rafael J. Wysocki Date: Tue Mar 24 21:00:03 2026 +0100 platform/x86: toshiba_acpi: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Toshiba Laptop ACPI Extras driver from an ACPI driver to a platform one. After this change, all of the subordinate hwmon, IIO, and LED class devices will be registered under the platform device used for driver binding instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. However, the sysfs attributes in toshiba_attr_group will still be there in the sysfs directory of the ACPI companion of the platform device used for driver binding to maintain backwards compatibility with possibly existing user space utilities depending on the presence of those attributes. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2269772.irdbgypaU6@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b0bcf48c74cc7f72d1b6effc7cecdae871b1785e Author: Rafael J. Wysocki Date: Tue Mar 24 20:58:48 2026 +0100 platform/x86: toshiba_acpi: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5070377.GXAFRqVoOG@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 99aef5d711c6e463ceff34d0657eca4b4558996a Author: Rafael J. Wysocki Date: Tue Mar 24 20:58:05 2026 +0100 platform/x86: toshiba_acpi: Reorder code to avoid forward declaration Move the definition of toshiba_acpi_notify() before the definitions of the functions that will refer to it after subsequent updates to avoid having to add a forward declarations of it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/4734258.LvFx2qVVIh@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8c4dc1a5025f5c35beef43fbf8ce50bb7e93b762 Author: Pranjal Shrivastava Date: Mon Mar 30 09:26:09 2026 +0000 iommufd/selftest: Remove MOCK_IOMMUPT_AMDV1 format syzbot found that allocating a mock domain with AMDV1 format could cause a WARN_ON because the selftest enabled DYNAMIC_TOP without providing the required driver_ops. The AMDV1 format in the selftest was a placeholder and was not actually used by any of the existing selftests. Instead of adding dummy driver_ops to satisfy the requirements of a format we don't currently test, remove the AMDV1 format option from the selftest. The MOCK_IOMMUPT_DEFAULT and MOCK_IOMMUPT_HUGE formats are unaffected as they use the amdv1_mock variant which does not enable DYNAMIC_TOP. Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op") Link: https://patch.msgid.link/r/20260330092609.2659235-1-praan@google.com Reported-by: syzbot+453eb7add07c3767adab@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69c1d50b.a70a0220.3cae05.0001.GAE@google.com/ Signed-off-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe commit aaca2aa92785a6ab8e3183e7184bca447a99cd76 Author: Zhenzhong Duan Date: Sun Mar 29 23:07:55 2026 -0400 iommufd: Fix return value of iommufd_fault_fops_write() copy_from_user() may return number of bytes failed to copy, we should not pass over this number to user space to cheat that write() succeed. Instead, -EFAULT should be returned. Link: https://patch.msgid.link/r/20260330030755.12856-1-zhenzhong.duan@intel.com Cc: stable@vger.kernel.org Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object") Signed-off-by: Zhenzhong Duan Reviewed-by: Lu Baolu Reviewed-by: Pranjal Shrivastava Reviewed-by: Shuai Xue Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe commit 6cbc8360f51a3df2ea16a786b262b9fe44d4c68c Author: Ethan Tidmore Date: Tue Mar 24 12:38:30 2026 -0500 ASoC: SOF: Intel: hda: Place check before dereference The struct hext_stream is dereferenced before it is checked for NULL. Although it can never be NULL due to a check prior to hda_dsp_iccmax_stream_hw_params() being called, this change clears any confusion regarding hext_stream possibly being NULL. Check hext_stream for NULL and then assign its members. Detected by Smatch: sound/soc/sof/intel/hda-stream.c:488 hda_dsp_iccmax_stream_hw_params() warn: variable dereferenced before check 'hext_stream' (see line 486) Fixes: aca961f196e5d ("ASoC: SOF: Intel: hda: Add helper function to program ICCMAX stream") Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260324173830.17563-1-ethantidmore06@gmail.com Signed-off-by: Mark Brown commit cf6788aed0cd911c2e7dded6f28214996dfabc30 Author: Haoyu Lu Date: Tue Mar 31 17:53:51 2026 +0800 mtd: spi-nor: micron-st: Enable die erase support for MT35XU02GCBA The MT35XU02GCBA flash device does not support chip erase according to its datasheet, but supports die erase. The existing code had a TODO comment noting that the SPI_NOR_IO_MODE_EN_VOLATILE flag probably needs to be enabled and the driver implementation needs to be converted to use die erase. This patch enables the SPI_NOR_IO_MODE_EN_VOLATILE flag and adds the mt35_two_die_fixups to the MT35XU02GCBA entry, which includes the micron_st_nor_two_die_late_init() function that sets up die erase support. With these changes, the flash device can properly use die erase operations instead of chip erase. Signed-off-by: Haoyu Lu Reviewed-by: Pratyush Yadav (Google) [pratyush@kernel.org: drop the whole comment instead of just the TODO line] Signed-off-by: Pratyush Yadav (Google) commit 7ed020d84a7b748f322f8e9d57ad7d60a5057130 Author: Xu Yang Date: Mon Mar 30 14:35:18 2026 +0800 dt-bindings: connector: add pd-disable dependency When Power Delivery is not supported, the source is unable to obtain the current capability from the Source PDO. As a result, typec-power-opmode needs to be added to advertise such capability. Acked-by: Conor Dooley Fixes: 7a4440bc0d86 ("dt-bindings: connector: Add pd-disable property") Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260330063518.719345-1-xu.yang_2@nxp.com Signed-off-by: Rob Herring (Arm) commit 8e0a2fc68ec369f2b6755994da1d318d0898a9d9 Author: Srinivas Pandruvada Date: Thu Mar 26 11:24:46 2026 -0700 platform/x86/intel/tpmi: Use 32 bit aligned address for debugfs mem write The memory write feature supports 32-bit writes to any TPMI offset. However, future hardware generations may not allow writes to non-32-bit aligned addresses due to hardware optimizations. Since all TPMI addresses are 64-bit aligned and correspond to 64-bit registers, enforce 32-bit alignment for write operations. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260326182446.3478672-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit bf56987c111372a54ae877934a42f7fb0953a6ca Author: Loïc Grégoire Date: Fri Mar 27 22:18:54 2026 -0400 printk: ringbuffer: fix errors in comments The printk ringbuffer implementation is described in the comment as using three ringbuffers, but the current implementation uses two (desc and data). Update the comment so it matches the code. Fix few more known issues in the comments. Signed-off-by: Loïc Grégoire Reviewed-by: John Ogness Link: https://patch.msgid.link/20260328021855.53956-1-loicgre@gmail.com [pmladek@suse.com: Fixed few more issues in the comments by John Ogness.] Signed-off-by: John Ogness Reviewed-by: Petr Mladek Signed-off-by: Petr Mladek commit 9797524ef2b69c6b187b55bd844eb72a8c1cbd99 Author: Ronald Claveau Date: Tue Mar 31 16:24:04 2026 +0200 reset: amlogic: t7: Fix null reset ops Fix missing reset ops causing kernel null pointer dereference. This SOC's reset is currently not used yet. Signed-off-by: Ronald Claveau Fixes: fb4c31587adf ("reset: amlogic: add auxiliary reset driver support") Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit b0258f69f1e0ed98e8506706da9ef538389b27ea Author: Conor Dooley Date: Tue Feb 10 10:51:17 2026 +0000 riscv: dts: microchip: update mpfs gpio interrupts to better match the SoC There are 3 GPIO controllers on this SoC, of which: - GPIO controller 0 has 14 GPIOs - GPIO controller 1 has 24 GPIOs - GPIO controller 2 has 32 GPIOs All GPIOs are capable of generating interrupts, for a total of 70. There are only 41 IRQs available however, so a configurable mux is used to ensure all GPIOs can be used for interrupt generation. 38 of the 41 interrupts are in what the documentation calls "direct mode", as they provide an exclusive connection from a GPIO to the PLIC. The 3 remaining interrupts are used to mux the interrupts which do not have a exclusive connection, one for each GPIO controller. The mux was overlooked when the bindings and driver were originally written for the GPIO controllers on Polarfire SoC, and the interrupts property in the GPIO nodes used to try and convey what the mapping was. Instead, the mux should be a device in its own right, and the GPIO controllers should be connected to it, rather than to the PLIC. Now that a binding exists for that mux, fix the inaccurate description of the interrupt controller hierarchy. GPIO controllers 0 and 1 do not have all 32 possible GPIO lines, so ngpios needs to be set to match the number of lines/interrupts. The m100pfsevp has conflicting interrupt mappings for controllers 0 and 2, as they cannot both be using an interrupt in "direct mode" at the same time, so the default replaces this impossible configuration. Reviewed-by: Linus Walleij Signed-off-by: Conor Dooley commit 6c7e548e313dcfbb8a4965b9b93c5c59537b35d9 Author: Wander Lairson Costa Date: Mon Feb 23 13:17:49 2026 -0300 rv/rvgen: use context managers for file operations Replace manual file open and close operations with context managers throughout the rvgen codebase. The previous implementation used explicit open() and close() calls, which could lead to resource leaks if exceptions occurred between opening and closing the file handles. This change affects three file operations: reading DOT specification files in the automata parser, reading template files in the generator base class, and writing generated monitor files. All now use the with statement to ensure proper resource cleanup even in error conditions. Context managers provide automatic cleanup through the with statement, which guarantees that file handles are closed when the with block exits regardless of whether an exception occurred. This follows PEP 343 recommendations and is the standard Python idiom for resource management. The change also reduces code verbosity while improving safety and maintainability. Signed-off-by: Wander Lairson Costa Reviewed-by: Nam Cao Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-7-wander@redhat.com Signed-off-by: Gabriele Monaco commit c4258d8160b2a40732f3fe5272a9ec524e0a5e94 Author: Wander Lairson Costa Date: Mon Feb 23 13:17:48 2026 -0300 rv/rvgen: remove unnecessary semicolons Remove unnecessary semicolons from Python code in the rvgen tool. Python does not require semicolons to terminate statements, and their presence goes against PEP 8 style guidelines. These semicolons were likely added out of habit from C-style languages. This cleanup improves consistency with Python coding standards and aligns with the recent improvements to remove other Python anti-patterns from the codebase. Signed-off-by: Wander Lairson Costa Reviewed-by: Nam Cao Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-6-wander@redhat.com Signed-off-by: Gabriele Monaco commit b70bc5cca0e8873504cf3764f281b2d9094f9653 Author: Wander Lairson Costa Date: Mon Feb 23 13:17:47 2026 -0300 rv/rvgen: replace __len__() calls with len() Replace all direct calls to the __len__() dunder method with the idiomatic len() built-in function across the rvgen codebase. This change eliminates a Python anti-pattern where dunder methods are called directly instead of using their corresponding built-in functions. The changes affect nine instances across two files. In automata.py, the empty string check is further improved by using truthiness testing instead of explicit length comparison. In dot2c.py, all length checks in the get_minimun_type, __get_max_strlen_of_states, and get_aut_init_function methods now use the standard len() function. Additionally, spacing around keyword arguments has been corrected to follow PEP 8 guidelines. Direct calls to dunder methods like __len__() are discouraged in Python because they bypass the language's abstraction layer and reduce code readability. Using len() provides the same functionality while adhering to Python community standards and making the code more familiar to Python developers. Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260223162407.147003-5-wander@redhat.com Signed-off-by: Gabriele Monaco commit 908f377f4a0fa4b0b86352af9cb858e6ffcc6e2d Author: Wander Lairson Costa Date: Mon Feb 23 13:17:46 2026 -0300 rv/rvgen: replace % string formatting with f-strings Replace all instances of percent-style string formatting with f-strings across the rvgen codebase. This modernizes the string formatting to use Python 3.6+ features, providing clearer and more maintainable code while improving runtime performance. The conversion handles all formatting cases including simple variable substitution, multi-variable formatting, and complex format specifiers. Dynamic width formatting is converted from "%*s" to "{var:>{width}}" using proper alignment syntax. Template strings for generated C code properly escape braces using double-brace syntax to produce literal braces in the output. F-strings provide approximately 2x performance improvement over percent formatting and are the recommended approach in modern Python. Signed-off-by: Wander Lairson Costa Reviewed-by: Nam Cao Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-4-wander@redhat.com Signed-off-by: Gabriele Monaco commit 3f305f86373d5940e5105110415e97b4a4c3cf92 Author: Wander Lairson Costa Date: Mon Feb 23 13:17:45 2026 -0300 rv/rvgen: remove bare except clauses in generator Remove bare except clauses from the generator module that were catching all exceptions including KeyboardInterrupt and SystemExit. This follows the same exception handling improvements made in the previous AutomataError commit and addresses PEP 8 violations. The bare except clause in __create_directory was silently catching and ignoring all errors after printing a message, which could mask serious issues. For __write_file, the bare except created a critical bug where the file variable could remain undefined if open() failed, causing a NameError when attempting to write to or close the file. These methods now let OSError propagate naturally, allowing callers to handle file system errors appropriately. This provides clearer error reporting and allows Python's exception handling to show complete stack traces with proper error types and locations. Signed-off-by: Wander Lairson Costa Reviewed-by: Nam Cao Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-3-wander@redhat.com Signed-off-by: Gabriele Monaco commit a115ee5a32275d5f171506dc65e2130e218d2117 Author: Wander Lairson Costa Date: Mon Feb 23 13:17:44 2026 -0300 rv/rvgen: introduce AutomataError exception class Replace the generic except Exception block with a custom AutomataError class that inherits from Exception. This provides more precise exception handling for automata parsing and validation errors while avoiding overly broad exception catches that could mask programming errors like SyntaxError or TypeError. The AutomataError class is raised when DOT file processing fails due to invalid format, I/O errors, or malformed automaton definitions. The main entry point catches this specific exception and provides a user-friendly error message to stderr before exiting. Also, replace generic exceptions raising in HA and LTL with AutomataError. Co-authored-by: Gabriele Monaco Signed-off-by: Wander Lairson Costa Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260223162407.147003-2-wander@redhat.com Signed-off-by: Gabriele Monaco commit b133207deb72609ad4da40c4d50128a5e150677b Author: Gabriele Monaco Date: Mon Mar 30 13:10:10 2026 +0200 rv: Add nomiss deadline monitor Add the deadline monitors collection to validate the deadline scheduler, both for deadline tasks and servers. The currently implemented monitors are: * nomiss: validate dl entities run to completion before their deadiline Reviewed-by: Nam Cao Reviewed-by: Juri Lelli Link: https://lore.kernel.org/r/20260330111010.153663-13-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit c85dbddad705babfbddfef182495994f7f5262c9 Author: Gabriele Monaco Date: Mon Mar 30 13:10:09 2026 +0200 sched/deadline: Move some utility functions to deadline.h Some utility functions on sched_dl_entity can be useful outside of deadline.c , for instance for modelling, without relying on raw structure fields. Move functions like dl_task_of and dl_is_implicit to deadline.h to make them available outside. Acked-by: Juri Lelli Link: https://lore.kernel.org/r/20260330111010.153663-12-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 820725b0eb59f6011e379cc526ae90a6f3efeb50 Author: Gabriele Monaco Date: Mon Mar 30 13:10:08 2026 +0200 sched: Add deadline tracepoints Add the following tracepoints: * sched_dl_throttle(dl_se, cpu, type): Called when a deadline entity is throttled * sched_dl_replenish(dl_se, cpu, type): Called when a deadline entity's runtime is replenished * sched_dl_update(dl_se, cpu, type): Called when a deadline entity updates without throttle or replenish * sched_dl_server_start(dl_se, cpu, type): Called when a deadline server is started * sched_dl_server_stop(dl_se, cpu, type): Called when a deadline server is stopped Those tracepoints can be useful to validate the deadline scheduler with RV and are not exported to tracefs. Reviewed-by: Phil Auld Acked-by: Juri Lelli Link: https://lore.kernel.org/r/20260330111010.153663-11-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit da282bf7fadb095ee0a40c32ff0126429c769b45 Author: Gabriele Monaco Date: Mon Mar 30 13:10:07 2026 +0200 verification/rvgen: Add support for per-obj monitors The special per-object monitor type was just introduced in RV, this requires the user to define some functions and type specific to the object. Adapt rvgen to add stub definitions for the monitor_target type and other modifications required to create per-object monitors. Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260330111010.153663-10-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 4a24127bd6cbf03fb17de8b43f2d8db3f55ca333 Author: Gabriele Monaco Date: Mon Mar 30 13:10:06 2026 +0200 rv: Add support for per-object monitors in DA/HA RV deterministic and hybrid automata currently only support global, per-cpu and per-task monitors. It isn't possible to write a model that would follow some different type of object, like a deadline entity or a lock. Define the generic per-object monitor implementation which shares part of the implementation with the per-task monitors. The user needs to provide an id for the object (e.g. pid for tasks) and define the data type for the monitor_target (e.g. struct task_struct * for tasks). Both are supplied to the event handlers, as the id may not be easily available in the target. The monitor storage (e.g. the rv monitor, pointer to the target, etc.) is stored in a hash table indexed by id. Monitor storage objects are automatically allocated unless specified otherwise (e.g. if the creation context is unsafe for allocation). Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260330111010.153663-9-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 2b406fdb33387713cb9f880e58e5ff09901c6ebc Author: Gabriele Monaco Date: Mon Mar 30 13:10:05 2026 +0200 rv: Convert the opid monitor to a hybrid automaton The opid monitor validates that wakeup and need_resched events only occur with interrupts and preemption disabled by following the preemptirq tracepoints. As reported in [1], those tracepoints might be inaccurate in some situations (e.g. NMIs). Since the monitor doesn't validate other ordering properties, remove the dependency on preemptirq tracepoints and convert the monitor to a hybrid automaton to validate the constraint during event handling. This makes the monitor more robust by also removing the workaround for interrupts missing the preemption tracepoints, which was working on PREEMPT_RT only and allows the monitor to be built on kernels without the preemptirqs tracepoints. [1] - https://lore.kernel.org/lkml/20250625120823.60600-1-gmonaco@redhat.com Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260330111010.153663-8-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 13578a087152b85e53b1fa11639c814cb427808a Author: Gabriele Monaco Date: Mon Mar 30 13:10:04 2026 +0200 rv: Add sample hybrid monitor stall Add a sample monitor to showcase hybrid/timed automata. The stall monitor identifies tasks stalled for longer than a threshold and reacts when that happens. Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260330111010.153663-7-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 708340c2714c4770f1cfac09f20fe7fc8a3acd09 Author: Gabriele Monaco Date: Mon Mar 30 13:10:03 2026 +0200 Documentation/rv: Add documentation about hybrid automata Describe theory and implementation of hybrid automata in the dedicated page hybrid_automata.rst Include a section on how to integrate a hybrid automaton in monitor_synthesis.rst Also remove a hanging $ in deterministic_automata.rst Reviewed-by: Nam Cao Reviewed-by: Juri Lelli Link: https://lore.kernel.org/r/20260330111010.153663-6-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit a82adadb16894852fc8bc5a681f2070bea33b6b6 Author: Gabriele Monaco Date: Mon Mar 30 13:10:02 2026 +0200 verification/rvgen: Add support for Hybrid Automata Add the possibility to parse dot files as hybrid automata and generate the necessary code from rvgen. Hybrid automata are very similar to deterministic ones and most functionality is shared, the dot files include also constraints together with event names (separated by ;) and state names (separated by \n). The tool can now generate the appropriate code to validate constraints at runtime according to the dot specification. Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260330111010.153663-5-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit c707b1da1043f89e3368835c77a1f8a14a4a8843 Author: Gabriele Monaco Date: Mon Mar 30 13:10:01 2026 +0200 verification/rvgen: Allow spaces in and events strings Currently the automata parser assumes event strings don't have any space, this stands true for event names, but can be a wrong assumption if we want to store other information in the event strings (e.g. constraints for hybrid automata). Adapt the parser logic to allow spaces in the event strings. Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260330111010.153663-4-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit f5587d1b6ec938afb2f74fe399a68020d66923e4 Author: Gabriele Monaco Date: Mon Mar 30 13:10:00 2026 +0200 rv: Add Hybrid Automata monitor type Deterministic automata define which events are allowed in every state, but cannot define more sophisticated constraint taking into account the system's environment (e.g. time or other states not producing events). Add the Hybrid Automata monitor type as an extension of Deterministic automata where each state transition is validating a constraint on a finite number of environment variables. Hybrid automata can be used to implement timed automata, where the environment variables are clocks. Also implement the necessary functionality to handle clock constraints (ns or jiffy granularity) on state and events. Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260330111010.153663-3-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 9da38a69da30ae16982f1dcf55890d159cf38cf4 Author: Gabriele Monaco Date: Mon Mar 30 13:09:59 2026 +0200 rv: Unify DA event handling functions across monitor types The DA event handling functions are mostly duplicated because the per-task monitors need to propagate the task struct while others do not. Unify the functions, handle the difference by always passing an identifier which is the task's pid for per-task monitors but is ignored for the other types. Only keep the actual tracepoint calling separated. Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260330111010.153663-2-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit a9cdba5c35c5cca6bd0b922bc235b843a41b3a57 Author: Geert Uytterhoeven Date: Mon Mar 30 11:44:59 2026 +0200 fbdev: atyfb: Remove unused fb_list With clang and W=1: drivers/video/fbdev/aty/atyfb_base.c:2327:24: warning: variable 'fb_list' set but not used [-Wunused-but-set-global] 2327 | static struct fb_info *fb_list = NULL; Indeed, the last user of fb_list was removed in 2004, while the actual linked list was removed in 2002. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603300931.osMYxYZ7-lkp@intel.com/ Signed-off-by: Geert Uytterhoeven Signed-off-by: Helge Deller commit b2a78fec344ead9ffca63ee13018f482392bf09d Author: Damien Le Moal Date: Fri Mar 27 05:32:45 2026 +0900 zloop: add max_open_zones option Introduce the new max_open_zones option to allow specifying a limit on the maximum number of open zones of a zloop device. This change allows creating a zloop device that can more closely mimick the characteristics of a physical SMR drive. When set to a non zero value, only up to max_open_zones zones can be in the implicit open (BLK_ZONE_COND_IMP_OPEN) and explicit open (BLK_ZONE_COND_EXP_OPEN) conditions at any time. The transition to the implicit open condition of a zone on a write operation can result in an implicit close of an already implicitly open zone. This is handled in the function zloop_do_open_zone(). This function also handles transitions to the explicit open condition. Implicit close transitions are handled using an LRU ordered list of open zones which is managed using the helper functions zloop_lru_rotate_open_zone() and zloop_lru_remove_open_zone(). Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260326203245.946830-1-dlemoal@kernel.org Signed-off-by: Jens Axboe commit 83725f1d980b92789f99db0ea756979017c37ac3 Author: Jonathan Corbet Date: Tue Mar 31 08:31:58 2026 -0600 Revert "scripts/checkpatch: add Assisted-by: tag validation" This reverts commit 8545d9bc4bd0801e0bdfbfdfdc2532ff31236ddf. Unbeknownst to me, and unremarked upon by the checkpatch maintainer, this same problem was also solved in the mm tree. Fixing it once is enough, so this one comes out. Signed-off-by: Jonathan Corbet commit 9ec6bf62cf98e30c7126a0f51ee7cdf2e8d458b6 Author: Werner Sembach Date: Tue Mar 24 21:32:12 2026 +0100 Documentation: laptops: Update documentation for uniwill laptops Adds short description for two new sysfs entries, ctgp_offset and usb_c_power_priority, to the documentation of uniwill laptops. Reviewed-by: Armin Wolf Reviewed-by: Shuah Khan Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20260324203413.454361-6-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a5ee4c959b0efc347cdf6565ebcbc81131ff3677 Author: Werner Sembach Date: Tue Mar 24 21:32:11 2026 +0100 platform/x86: uniwill-laptop: Apply features across all TUXEDO devices Uses the more fine granular and/or new feature defines to enable more features across the TUXEDO device lineup. Also adds features to TUXEDO devices that where already present in the driver, but not tested until now. Reviewed-by: Armin Wolf Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20260324203413.454361-5-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ab97e28be21181a7f08300de1088f48e9f8274a9 Author: Werner Sembach Date: Tue Mar 24 21:32:10 2026 +0100 platform/x86: uniwill-laptop: Fix XMG Fusion 15 (L19) entries Add alternative XMG Fusion system vendor name and clarify edition in ident. Reviewed-by: Armin Wolf Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20260324203413.454361-4-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 03ae0a0d0973b9e584a05136aab08fee2ef8e455 Author: Werner Sembach Date: Tue Mar 24 21:32:09 2026 +0100 platform/x86: uniwill-laptop: Implement USB-C power priority setting On some devices Uniwill offers the option to set the USB-C port to prioritise charging or performance. This patch exposes this setting to the userspace via sysfs for all TUXEDO devices supporting it. Reviewed-by: Armin Wolf Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20260324203413.454361-3-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f3660b13495ae47d0ab2755a7b32999fb718ee5c Author: Armin Wolf Date: Tue Mar 24 21:32:08 2026 +0100 platform/x86: uniwill-laptop: Rework hwmon feature defines Split hwmon feature define in smaller parts to accommodate for diverse hardware. You can now specify the presence of a cpu and/or a gpu temp sensor separately and if one or 2 fans exists. Signed-off-by: Armin Wolf Reviewed-by: Werner Sembach Tested-by: Werner Sembach Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20260324203413.454361-2-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a67a469cece4c46a729c1bb0fbe19e9572cda405 Merge: 8d95d1f4aa5c76 fbddf68d7b4e1e Author: Ilpo Järvinen Date: Tue Mar 31 17:24:54 2026 +0300 Merge tag 'fixes' into 'for-next' Allows uniwill-laptop feature work that depends on changes in the fixes branch proceed. commit 9229cb5a941c981633a79c9867f339c4589a9da9 Author: Alexander Duyck Date: Fri Mar 27 13:44:45 2026 -0700 fbnic: Set Relaxed Ordering PCIe TLP attributes for DMA engines Add ATTR CSR bit field definitions for the DMA engine TLP header configuration registers: AW_CFG: RDE_ATTR[17:15], RQM_ATTR[14:12], TQM_ATTR[11:9] AR_CFG: TDE_ATTR[17:15], RQM_ATTR[14:12], TQM_ATTR[11:9] These fields control the PCIe TLP attribute bits for outbound transactions from the TQM, RQM, RDE (write path), and TDE (read path) DMA engines. An enum is added with standard PCIe TLP attribute values: NS (No Snoop), RO (Relaxed Ordering), and IDO (ID-based Ordering). Read the PCIe Relaxed Ordering capability at probe time and store it in fbnic_dev. Configure Relaxed Ordering on the PCIe TLP attributes in fbnic_mbx_init_desc_ring when the capability is enabled. For the write path (AW_CFG), set RO on RDE and TQM attributes. For the read path (AR_CFG), set RO on all three attributes (TDE, RQM, TQM). This allows the PCIe fabric to reorder these transactions for improved throughput. Signed-off-by: Alexander Duyck Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20260327204445.3074446-1-dimitri.daskalakis1@gmail.com Signed-off-by: Paolo Abeni commit 4129a3a2751cba8511cee5d13145223662a8e019 Author: David Timber Date: Tue Mar 17 06:41:37 2026 +0900 exfat: fix s_maxbytes With fallocate support, xfstest unit generic/213 fails with QA output created by 213 We should get: fallocate: No space left on device Strangely, xfs_io sometimes says "Success" when something went wrong -fallocate: No space left on device +fallocate: File too large because sb->s_maxbytes is set to the volume size. To be in line with other non-extent-based filesystems, set to max volume size possible with the cluster size of the volume. Signed-off-by: David Timber Signed-off-by: Namjae Jeon commit 9968aad12f362dc686f139e1525d322a768f8ddb Author: Kuninori Morimoto Date: Tue Mar 31 01:25:04 2026 +0000 ASoC: soc-core: remove duplicate snd_soc_flush_all_delayed_work() snd_soc_unbind_card() calls snd_soc_flush_all_delayed_work() (A), but it will be called in soc_cleanup_card_resources() (B). It is duplicated, let's remove it. (B) static void soc_cleanup_card_resources(...) { ... /* flush delayed work before removing DAIs and DAPM widgets */ (A)' snd_soc_flush_all_delayed_work(card); ... } static void snd_soc_unbind_card(...) { if (snd_soc_card_is_instantiated(card)) { card->instantiated = false; (A) snd_soc_flush_all_delayed_work(card); (B) soc_cleanup_card_resources(card); } } Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87h5pwdc3z.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5326a18e3e640061ca4b65c1b732feaeace61c39 Author: Alice Ryhl Date: Fri Mar 6 11:28:46 2026 +0000 rust_binder: introduce TransactionInfo Rust Binder exposes information about transactions that are sent in various ways: printing to the kernel log, tracepoints, files in binderfs, and the upcoming netlink support. Currently all these mechanisms use disparate ways of obtaining the same information, so let's introduce a single Info struct that collects all the required information in a single place, so that all of these different mechanisms can operate in a more uniform way. For now, the new info struct is only used to replace a few things: * The BinderTransactionDataSg struct that is passed as an argument to several methods is removed as the information is moved into the new info struct and passed down that way. * The oneway spam detection fields on Transaction and Allocation can be removed, as the information can be returned to the caller via the mutable info struct instead. But several other uses of the info struct are planned in follow-up patches. Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260306-transaction-info-v1-1-fda58fca558b@google.com Signed-off-by: Greg Kroah-Hartman commit bd34cdd6d214f815570986ce55978fd7ddd8d8ac Author: Conor Dooley Date: Wed Mar 18 11:04:35 2026 +0000 soc: microchip: add mpfs gpio interrupt mux driver On PolarFire SoC there are more GPIO interrupts than there are interrupt lines available on the PLIC, and a runtime configurable mux is used to decide which interrupts are assigned direct connections to the PLIC & which are relegated to sharing a line. Add a driver so that Linux can set the mux based on the interrupt mapping in the devicetree. Reviewed-by: Herve Codina Reviewed-by: Linus Walleij Reviewed-by: Bartosz Golaszewski Signed-off-by: Conor Dooley commit 5f3575cc73dc64dc0912d1f8ccf6d00c20aedd5b Author: Conor Dooley Date: Wed Mar 18 11:04:34 2026 +0000 dt-bindings: soc: microchip: document PolarFire SoC's gpio interrupt mux On PolarFire SoC there are more GPIO interrupts than there are interrupt lines available on the PLIC, and a runtime configurable mux is used to decide which interrupts are assigned direct connections to the PLIC & which are relegated to sharing a line. Reviewed-by: Herve Codina Reviewed-by: Rob Herring (Arm) Reviewed-by: Linus Walleij Signed-off-by: Conor Dooley commit e57b53f0f36ae0a3b13a101f135027c4aebc1bee Author: Conor Dooley Date: Wed Mar 18 11:04:33 2026 +0000 gpio: mpfs: Add interrupt support Add support for interrupts to the PolarFire SoC GPIO driver. Each GPIO has an independent interrupt that is wired to an interrupt mux that sits between the controllers and the PLIC. The SoC has more GPIO lines than connections from the mux to the PLIC, so some GPIOs must share PLIC interrupts. The configuration is not static and is set at runtime, conventionally by the platform's firmware. CoreGPIO, the version intended for use in the FPGA fabric has two interrupt output ports, one is IO_NUM bits wide, as is used in the hardened cores, and the other is a single bit with all lines ORed together. Acked-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Signed-off-by: Conor Dooley commit 2a2f520fda824b5a25c93f2249578ea150c24e06 Author: Jackie Liu Date: Tue Mar 31 19:12:16 2026 +0800 block: fix zones_cond memory leak on zone revalidation error paths When blk_revalidate_disk_zones() fails after disk_revalidate_zone_resources() has allocated args.zones_cond, the memory is leaked because no error path frees it. Fixes: 6e945ffb6555 ("block: use zone condition to determine conventional zones") Suggested-by: Damien Le Moal Signed-off-by: Jackie Liu Link: https://patch.msgid.link/20260331111216.24242-1-liu.yun@linux.dev Signed-off-by: Jens Axboe commit 267ec4d7223a783f029a980f41b93c39b17996da Author: Daan De Meyer Date: Tue Mar 31 10:51:28 2026 +0000 loop: fix partition scan race between udev and loop_reread_partitions() When LOOP_CONFIGURE is called with LO_FLAGS_PARTSCAN, the following sequence occurs: 1. disk_force_media_change() sets GD_NEED_PART_SCAN 2. Uevent suppression is lifted and a KOBJ_CHANGE uevent is sent 3. loop_global_unlock() releases the lock 4. loop_reread_partitions() calls bdev_disk_changed() to scan There is a race between steps 2 and 4: when udev receives the uevent and opens the device before loop_reread_partitions() runs, blkdev_get_whole() in bdev.c sees GD_NEED_PART_SCAN set and calls bdev_disk_changed() for a first scan. Then loop_reread_partitions() does a second scan. The open_mutex serializes these two scans, but does not prevent both from running. The second scan in bdev_disk_changed() drops all partition devices from the first scan (via blk_drop_partitions()) before re-adding them, causing partition block devices to briefly disappear. This breaks any systemd unit with BindsTo= on the partition device: systemd observes the device going dead, fails the dependent units, and does not retry them when the device reappears. Fix this by removing the GD_NEED_PART_SCAN set from disk_force_media_change() entirely. None of the current callers need the lazy on-open partition scan triggered by this flag: - floppy: sets GENHD_FL_NO_PART, so disk_has_partscan() is always false and GD_NEED_PART_SCAN has no effect. - loop (loop_configure, loop_change_fd): when LO_FLAGS_PARTSCAN is set, loop_reread_partitions() performs an explicit scan. When not set, GD_SUPPRESS_PART_SCAN prevents the lazy scan path. - loop (__loop_clr_fd): calls bdev_disk_changed() explicitly if LO_FLAGS_PARTSCAN is set. - nbd (nbd_clear_sock_ioctl): capacity is set to zero immediately after; nbd manages GD_NEED_PART_SCAN explicitly elsewhere. With GD_NEED_PART_SCAN no longer set by disk_force_media_change(), udev opening the loop device after the uevent no longer triggers a redundant scan in blkdev_get_whole(), and only the single explicit scan from loop_reread_partitions() runs. A regression test for this bug has been submitted to blktests: https://github.com/linux-blktests/blktests/pull/240. Fixes: 9f65c489b68d ("loop: raise media_change event") Signed-off-by: Daan De Meyer Acked-by: Christian Brauner Link: https://patch.msgid.link/20260331105130.1077599-1-daan@amutable.com Signed-off-by: Jens Axboe commit 499d2d2f4cf9f16634db47b06dee9676611b897f Author: Milan Broz Date: Tue Mar 10 10:53:49 2026 +0100 sed-opal: Add STACK_RESET command The TCG Opal device could enter a state where no new session can be created, blocking even Discovery or PSID reset. While a power cycle or waiting for the timeout should work, there is another possibility for recovery: using the Stack Reset command. The Stack Reset command is defined in the TCG Storage Architecture Core Specification and is mandatory for all Opal devices (see Section 3.3.6 of the Opal SSC specification). This patch implements the Stack Reset command. Sending it should clear all active sessions immediately, allowing subsequent commands to run successfully. While it is a TCG transport layer command, the Linux kernel implements only Opal ioctls, so it makes sense to use the IOC_OPAL ioctl interface. The Stack Reset takes no arguments; the response can be success or pending. If the command reports a pending state, userspace can try to repeat it; in this case, the code returns -EBUSY. Signed-off-by: Milan Broz Reviewed-by: Ondrej Kozina Link: https://patch.msgid.link/20260310095349.411287-1-gmazyland@gmail.com Signed-off-by: Jens Axboe commit 8d95d1f4aa5c76202b0833a70998769384612488 Author: Denis Benato Date: Mon Mar 2 18:44:31 2026 +0100 platform/x86: asus-wmi: fix screenpad brightness range Fix screenpad brightness range being too limited without reason: testing this patch on a Zenbook Duo showed the hardware minimum not being too low, therefore allow the user to configure the entire range, and expose to userspace the hardware brightness range and value. Fixes: 2c97d3e55b70 ("platform/x86: asus-wmi: add support for ASUS screenpad") Signed-off-by: Denis Benato Signed-off-by: Luke Jones Link: https://patch.msgid.link/20260302174431.349816-3-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 130d29c5627cd50e786e926ad7ef66322c5a0c09 Author: Denis Benato Date: Mon Mar 2 18:44:30 2026 +0100 platform/x86: asus-wmi: adjust screenpad power/brightness handling Fix illogical screen off control by hardcoding 0 and 1 depending on the requested brightness and also do not rely on the last screenpad power state to issue screen brightness commands. Fixes: 2c97d3e55b70 ("platform/x86: asus-wmi: add support for ASUS screenpad") Signed-off-by: Denis Benato Signed-off-by: Luke Jones Link: https://patch.msgid.link/20260302174431.349816-2-denis.benato@linux.dev Link: https://patch.msgid.link/20260326231154.856729-2-ethantidmore06@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 27e2e9b9b49c5d5260969168b86cd238254b9105 Merge: ed734125ea6c72 7e72a8f8bb0d5b Author: Marek Szyprowski Date: Tue Mar 31 13:31:53 2026 +0200 Merge branch 'dma-contig-for-7.1-modules-prep-v4' into dma-mapping-for-next Signed-off-by: Marek Szyprowski commit caa5a5d44d8ae4fd13b744857d66c9313b712d1f Author: Brian Mak Date: Wed Mar 25 15:30:24 2026 -0700 mfd: core: Preserve OF node when ACPI handle is present Switch device_set_node to set_primary_fwnode, so that the ACPI fwnode does not overwrite the of_node with NULL. This allows MFD children with both OF nodes and ACPI handles to have OF nodes again. Cc: stable@vger.kernel.org Fixes: 51e3b257099d ("mfd: core: Make use of device_set_node()") Signed-off-by: Brian Mak Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260325223024.35992-1-makb@juniper.net Signed-off-by: Lee Jones commit 7e72a8f8bb0d5ba89027d64e3e2aad1984d2e20d Author: Maxime Ripard Date: Tue Mar 31 12:00:14 2026 +0200 mm: cma: Export cma_alloc(), cma_release() and cma_get_name() The CMA dma-buf heap uses cma_alloc() and cma_release() to allocate and free, respectively, its CMA buffers, and cma_get_name() to get the name of the heap instance it's going to create. However, these functions are not exported. Since we want to turn the CMA heap into a module, let's export them both. Reviewed-by: T.J. Mercier Acked-by: David Hildenbrand (Arm) Signed-off-by: Maxime Ripard Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260331-dma-buf-heaps-as-modules-v4-5-e18fda504419@kernel.org commit 6207948f389ec1b938a39aa43fb4aedd58d65e0d Author: Maxime Ripard Date: Tue Mar 31 12:00:13 2026 +0200 dma: contiguous: Export dev_get_cma_area() The CMA dma-buf heap uses the dev_get_cma_area() function to retrieve the default contiguous area. Now that this function is no longer inlined, and since we want to turn the CMA heap into a module, let's export it. Signed-off-by: Maxime Ripard Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260331-dma-buf-heaps-as-modules-v4-4-e18fda504419@kernel.org commit 633040f853467a490437ace26d6a5413e64c0dd0 Author: Maxime Ripard Date: Tue Mar 31 12:00:12 2026 +0200 dma: contiguous: Make dma_contiguous_default_area static Now that dev_get_cma_area() is no longer inline, we don't have any user of dma_contiguous_default_area() outside of contiguous.c so we can make it static. Signed-off-by: Maxime Ripard Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260331-dma-buf-heaps-as-modules-v4-3-e18fda504419@kernel.org commit b3707be95f045c4e526e419435af29dc9dd1c267 Author: Maxime Ripard Date: Tue Mar 31 12:00:11 2026 +0200 dma: contiguous: Make dev_get_cma_area() a proper function As we try to enable dma-buf heaps, and the CMA one in particular, to compile as modules, we need to export dev_get_cma_area(). It's currently implemented as an inline function that returns either the content of device->cma_area or dma_contiguous_default_area. Thus, it means we need to export dma_contiguous_default_area, which isn't really something we want any module to have access to. Instead, let's make dev_get_cma_area() a proper function we will be able to export so we can avoid exporting dma_contiguous_default_area. Signed-off-by: Maxime Ripard Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260331-dma-buf-heaps-as-modules-v4-2-e18fda504419@kernel.org commit 25bd73562941b04cfba1a278d8c84f2b1c69b8e9 Author: Maxime Ripard Date: Tue Mar 31 12:00:10 2026 +0200 dma: contiguous: Turn heap registration logic around The CMA heap instantiation was initially developed by having the contiguous DMA code call into the CMA heap to create a new instance every time a reserved memory area is probed. Turning the CMA heap into a module would create a dependency of the kernel on a module, which doesn't work. Let's turn the logic around and do the opposite: store all the reserved memory CMA regions into the contiguous DMA code, and provide an iterator for the heap to use when it probes. Signed-off-by: Maxime Ripard Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260331-dma-buf-heaps-as-modules-v4-1-e18fda504419@kernel.org commit f924224650e6e8fc79609218c5cf67d5988d733a Author: Johan Hovold Date: Fri Mar 27 11:52:08 2026 +0100 mmc: vub300: clean up module init Clean up module init by dropping redundant error messages (e.g. allocation and USB driver registration failure will already have been logged) and naming error labels after what they do. Signed-off-by: Johan Hovold Signed-off-by: Ulf Hansson commit 5b8b35d6f4fa758dd5e8ae18526ea1c73f6787e0 Author: Johan Hovold Date: Fri Mar 27 11:52:07 2026 +0100 mmc: vub300: rename probe error labels Error labels should be named after what they do. Rename the probe error labels. Signed-off-by: Johan Hovold Signed-off-by: Ulf Hansson commit fe0179f325a6eab0672f6f3d2eea9832c5d08eff Merge: e89e7d2fff89ac 8f4d20a710225e Author: Ulf Hansson Date: Tue Mar 31 13:12:29 2026 +0200 mmc: Merge branch fixes into next Merge the mmc fixes for v7.0-rc[n] into the next branch, to allow them to get tested together with the mmc changes that are targeted for the next release. Signed-off-by: Ulf Hansson commit ec687ba84000d7d50cf243558041f6729d1d8119 Author: Jie Gan Date: Tue Mar 31 18:05:22 2026 +0800 coresight: tpdm: add traceid_show for checking traceid Save the trace ID in drvdata during TPDM enablement and expose it to userspace to support trace data parsing. The TPDM device’s trace ID corresponds to the trace ID allocated to the connected TPDA device. Signed-off-by: Jie Gan Reviewed-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260331-add-traceid-show-for-tpdm-v4-1-ed3dda24a562@oss.qualcomm.com commit 7338419a5e4454cc7a2c9df6af712d6f5ab471e9 Author: Ravi Singh Date: Mon Mar 30 14:14:14 2026 +0800 xfs: return default quota limits for IDs without a dquot When an ID has no dquot on disk, Q_XGETQUOTA returns -ENOENT even though default quota limits are configured and enforced against that ID. This means unprivileged users who have never used any resources cannot see the limits that apply to them. When xfs_qm_dqget() returns -ENOENT for a non-zero ID, return a zero-usage response with the default limits filled in from m_quotainfo rather than propagating the error. This is consistent with the enforcement behavior in xfs_qm_adjust_dqlimits(), which pushes the same default limits into a dquot when it is first allocated. Reviewed-by: Jan Kara Signed-off-by: Ravi Singh Reviewed-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 04d8f3fd0b52ead84eb722989afa094b8fca9129 Author: Rafael J. Wysocki Date: Sat Mar 14 12:50:11 2026 +0100 backlight: apple_bl: Convert to a platform driver In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Apple Backlight ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/5084777.GXAFRqVoOG@rafael.j.wysocki Signed-off-by: Lee Jones commit e89e7d2fff89ac5b7da5521c239e1417d3977af3 Author: Shawn Lin Date: Tue Mar 31 15:54:50 2026 +0800 mmc: dw_mmc: Remove dw_mci_start_request wrapper and rename core function The function dw_mci_start_request() was just a thin wrapper around __dw_mci_start_request(). Since it serves almost no functional purpose, remove the wrapper to simplify the code flow. Consequently, rename __dw_mci_start_request() to dw_mci_start_request() so that the core implementation uses the primary name. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 0801cebde7b9a65c3ec081f4c7220bbfc1e351b9 Author: Shawn Lin Date: Tue Mar 31 15:54:49 2026 +0800 mmc: dw_mmc: Inline dw_mci_queue_request() into dw_mci_request() With the removal of queue support, the function dw_mci_queue_request() is now just a wrapper with a confusing name that doesn't suggest anything about queue. Removes the function and moves its body into dw_mci_request(). No functional changes intended. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit d34124edffdbd88ce21ed49c84d984b1c34e4670 Author: Shawn Lin Date: Mon Mar 30 11:28:32 2026 +0800 mmc: block: Use MQRQ_XFER_SINGLE_BLOCK for both read and write recovery Currently, the code uses the MQRQ_XFER_SINGLE_BLOCK flag to handle write failures by retrying with single-block transfers. However, read failures bypass this mechanism and instead use a dedicated legacy path mmc_blk_read_single() that performs sector-by-sector retries. Extend the MQRQ_XFER_SINGLE_BLOCK logic to cover multi-block read failures as well. By doing so, we can remove the redundant and complex mmc_blk_read_single() function, unifying the retry logic for both read and write operations under a single, consistent, easier-to-maintain mechanism. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 058dbcf3ec2446a4deb094e0e22f2c345cd9816e Author: Shawn Lin Date: Mon Mar 30 11:28:31 2026 +0800 mmc: mmc_test: Replace hard-coded values with macros and consolidate test parameters Replacing hard-coded values with standardized macros to improve code clarity, simplify future maintenance. Meanwhile, introduce global bs and sg_len arrays for block sizes and SG lengths, eliminating redundant local definitions in multiple test functions. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 554b0674f22feb76d9198f2f1fa23b610f548548 Author: Shawn Lin Date: Mon Mar 30 11:28:30 2026 +0800 mmc: block: Convert to use DEFINE_SIMPLE_DEV_PM_OPS() Convert to use DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() to drop the CONFIG_PM_SLEEP to handle the conditional compilation when PM support is disabled. This allows the compiler to automatically optimize away the unused code paths when CONFIG_PM_SLEEP is not selected. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit a38ad7e173bc68c54f7afae7f669a824e313b1bb Author: Shawn Lin Date: Mon Mar 30 11:28:29 2026 +0800 mmc: core: Replace the hard-coded shift value 9 with SECTOR_SHIFT These shift-by-9 operations are for converting between bytes and sectors. Use the SECTOR_SHIFT macro to improve code readability and maintainability. No functional changes intended. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 257373c25ed7115f824588f20b3363d9e95640c4 Author: Shawn Lin Date: Sat Mar 28 08:29:22 2026 +0800 mmc: sdhci-dwcmshc: Refactor Rockchip platform data for controller revisions The driver previously used an enum (dwcmshc_rk_type) to distinguish platforms like the RK3568 and RK3588 based on DT compatible names. This approach is inflexible, scales poorly for future revisions or mixed-revision platforms, and conflates SoC names with controller revisions. One example is RK3576 which lists "rockchip,rk3588-dwcmshc" as a secondary compatible string just in order to claim it uses the same controller revision as RK3588. This is confusing and makes it error-prone to add new SoC support. Introduces a new struct rockchip_pltfm_data containing a dedicated revision field. The old enum is removed, and all code paths are updated to use the revision-based data. Signed-off-by: Shawn Lin Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit b6de441f8ce22e3ead3b858342fe5652598a3572 Author: Dmitry Torokhov Date: Sun Mar 22 18:54:23 2026 -0700 leds: led-class: Switch to using class_find_device_by_fwnode() In preparation to class_find_device_by_of_node() going away switch to using class_find_device_by_fwnode(). Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260322-remove-device-find-by-of-node-v1-5-b72eb22a1215@gmail.com Signed-off-by: Lee Jones commit 70910aadff34625994e15bb4a1f26a60b2e4d663 Author: Krzysztof Kozlowski Date: Mon Mar 23 10:20:53 2026 +0100 mfd: ene-kb3930: Use of_device_is_system_power_controller() wrapper Instead of checking for exact device node property, use the of_device_is_system_power_controller() wrapper. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260323092052.64684-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Lee Jones commit 1f1651d6dc2ac282d07043358824273c15a1cac4 Author: Mateusz Guzik Date: Sat Mar 28 18:37:28 2026 +0100 fs: hide file and bfile caches behind runtime const machinery s/cachep/cache/ for consistency with namei and dentry caches. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20260328173728.3388070-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 18f2e0ea200cdacf59a1c19a3ac4790d2ebe59af Author: Mateusz Guzik Date: Sat Mar 28 18:58:40 2026 +0100 fs: write a better comment in step_into() concerning .mnt assignment Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20260328175841.3390950-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 9eccdd38fb50b0fab24dd29497e50d0c0425cc84 Author: Jiri Olsa Date: Mon Mar 30 23:03:44 2026 +0200 bpf: Fix block device hooks names Use proper names for block device hooks names. Fixes: 46df585fcff7 ("bpf: classify block device hooks appropriately") Reported-by: Venkat Rao Bagalkote Closes: https://lore.kernel.org/bpf/acrVKUy_EPiFFmV9@krava/T/#m7c7906a1ff4029e29185aec3266dbf5c8996dbf7 Signed-off-by: Jiri Olsa Signed-off-by: Daniel Borkmann Tested-by: Venkat Rao Bagalkote Reviewed-by: Christian Brauner Acked-by: Song Liu Link: https://lore.kernel.org/bpf/20260330210344.3073712-1-jolsa@kernel.org commit e87946666e47d4b6f615e9ba0075375493194810 Author: Gabriel Rondon Date: Mon Mar 30 19:22:55 2026 +0100 staging: most: dim2: replace BUG_ON() in poison_channel() Replace BUG_ON() range check on ch_idx with a return of -EINVAL. BUG_ON() is deprecated as it crashes the entire kernel on assertion failure (see Documentation/process/deprecated.rst). Signed-off-by: Gabriel Rondon Link: https://patch.msgid.link/20260330182255.75241-6-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman commit e922cb40026c7ab788d1955f8977e354167f6496 Author: Gabriel Rondon Date: Mon Mar 30 19:22:54 2026 +0100 staging: most: dim2: replace BUG_ON() in enqueue() Replace BUG_ON() range check on ch_idx with a return of -EINVAL. BUG_ON() is deprecated as it crashes the entire kernel on assertion failure (see Documentation/process/deprecated.rst). Signed-off-by: Gabriel Rondon Link: https://patch.msgid.link/20260330182255.75241-5-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman commit adb44bab0ac96391dc9d0e4b3604b65e558f23ec Author: Gabriel Rondon Date: Mon Mar 30 19:22:53 2026 +0100 staging: most: dim2: replace BUG_ON() in configure_channel() Replace BUG_ON() range check on ch_idx with a return of -EINVAL. BUG_ON() is deprecated as it crashes the entire kernel on assertion failure (see Documentation/process/deprecated.rst). Signed-off-by: Gabriel Rondon Link: https://patch.msgid.link/20260330182255.75241-4-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2466b3dd4045cd9f5e3f74803a00284bdaf2e493 Author: Gabriel Rondon Date: Mon Mar 30 19:22:52 2026 +0100 staging: most: dim2: replace BUG_ON() in service_done_flag() Replace BUG_ON() calls with an early return since the function returns void. BUG_ON() is deprecated as it crashes the entire kernel on assertion failure (see Documentation/process/deprecated.rst). Signed-off-by: Gabriel Rondon Link: https://patch.msgid.link/20260330182255.75241-3-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman commit f3dc6732fd52b59bab522c5095290bca0d5f5555 Author: Gabriel Rondon Date: Mon Mar 30 19:22:51 2026 +0100 staging: most: dim2: replace BUG_ON() in try_start_dim_transfer() Replace BUG_ON() calls with graceful error handling. For the null/uninitialized channel checks, return -EINVAL instead of crashing the kernel. For the zero bus_address check, release the spinlock and return -EFAULT. BUG_ON() is deprecated as it crashes the entire kernel on assertion failure (see Documentation/process/deprecated.rst). Signed-off-by: Gabriel Rondon Link: https://patch.msgid.link/20260330182255.75241-2-grondon@gmail.com Signed-off-by: Greg Kroah-Hartman commit f019e98a2f35ec022872d8843ff9c9c9af90e6ec Author: Mashiro Chen Date: Tue Mar 31 13:04:34 2026 +0800 staging: rtl8723bs: remove unused RTL8188E antenna selection macros Remove the SET_TX_DESC_ANTSEL_{A,B,C}_88E macros from odm_types.h. These are leftover dead code for the RTL8188E chip and have no callers in the rtl8723bs driver. The RTL8188E is a different chip family and has its own driver at drivers/net/wireless/realtek/rtl8xxxu This addresses the TODO item "find and remove any code for other chips that is left over". Signed-off-by: Mashiro Chen Link: https://patch.msgid.link/20260331050434.102744-1-mashiro.chen@mailbox.org Signed-off-by: Greg Kroah-Hartman commit 27d51f066072e415ef46bc09ac7a326305dafbca Author: Mashiro Chen Date: Mon Mar 30 19:42:32 2026 +0800 staging: rtl8723bs: remove redundant blank lines in basic_types.h Remove redundant blank lines at the top of the file to improve code cleanliness. Signed-off-by: Mashiro Chen Reviewed-by: Luka Gejak Link: https://patch.msgid.link/20260330114232.91431-4-mashiro.chen@mailbox.org Signed-off-by: Greg Kroah-Hartman commit e8fa04fd77d5dd3ed164d6926242129d1e45777b Author: Mashiro Chen Date: Mon Mar 30 19:42:31 2026 +0800 staging: rtl8723bs: wrap complex macros with parentheses Fix "COMPLEX_MACRO" errors reported by checkpatch.pl by wrapping macro values in parentheses to ensure correct operator precedence. Signed-off-by: Mashiro Chen Reviewed-by: Luka Gejak Link: https://patch.msgid.link/20260330114232.91431-3-mashiro.chen@mailbox.org Signed-off-by: Greg Kroah-Hartman commit e2b69a082c701e4f4bfad7d8039314626b9ef574 Author: Mashiro Chen Date: Mon Mar 30 19:42:30 2026 +0800 staging: rtl8723bs: remove unused WRITEEF/READEF byte macros The WRITEEF4BYTE, WRITEEF2BYTE, WRITEEF1BYTE, READEF4BYTE, READEF2BYTE and READEF1BYTE macros are never used in the driver. Remove them entirely. Suggested-by: Dan Carpenter Signed-off-by: Mashiro Chen Reviewed-by: Luka Gejak Link: https://patch.msgid.link/20260330114232.91431-2-mashiro.chen@mailbox.org Signed-off-by: Greg Kroah-Hartman commit 1653545abc6835ab723c02697a5e2964e98e2c53 Author: Janosch Frank Date: Mon Mar 23 15:35:22 2026 +0000 KVM: s390: Fix lpsw/e breaking event handling LPSW and LPSWE need to set the gbea on completion but currently don't. Time to fix this up. LPSWEY was designed to not set the bear. Fixes: 48a3e950f4cee ("KVM: s390: Add support for machine checks.") Reported-by: Christian Borntraeger Reviewed-by: Claudio Imbrenda Reviewed-by: Christian Borntraeger Signed-off-by: Janosch Frank commit 2623c96f1172ae249b67de1dfc4eacebc8673876 Author: Eric Farman Date: Wed Feb 25 16:20:13 2026 +0100 KVM: s390: only deliver service interrupt with payload Routine __inject_service() may set both the SERVICE and SERVICE_EV pending bits, and in the case of a pure service event the corresponding trip through __deliver_service_ev() will clear the SERVICE_EV bit only. This necessitates an additional trip through __deliver_service() for the other pending interrupt bit, however it is possible that the external interrupt parameters are zero and there is nothing to be delivered to the guest. To avoid sending empty data to the guest, let's only write out the SCLP data when there is something for the guest to do, otherwise bail out. Signed-off-by: Eric Farman Acked-by: Christian Borntraeger Signed-off-by: Christian Borntraeger Signed-off-by: Janosch Frank commit 07ddb1d5d69cbfaeeb0d8835b9311cbec1843972 Author: Bhavya Gupta Date: Sat Mar 21 18:46:00 2026 +0530 staging: rtl8723bs: rename camelCase variable Rename the "pIE" variable to "ie" to comply with the linux kernel coding style. This fixes the following checkpatch.pl warnings: CHECK: Avoid CamelCase: Signed-off-by: Bhavya Gupta Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/ab6aELnTA0EnQI6X@gamin8ing Signed-off-by: Greg Kroah-Hartman commit 65978823ceeb290eaf5add2c36d8d04613160b78 Author: Haoyu Lu Date: Mon Mar 30 16:34:25 2026 +0800 staging: greybus: audio: fix error message for BTN_3 button In gbaudio_init_jack(), when setting SND_JACK_BTN_3 key, the error message incorrectly says "Failed to set BTN_0". This should be "Failed to set BTN_3" to match the button being configured. Signed-off-by: Haoyu Lu Reviewed-by: Johan Hovold Link: https://patch.msgid.link/20260330083425.266-1-hechushiguitu666@gmail.com Signed-off-by: Greg Kroah-Hartman commit a5a1b468de7555c15f4b1a14d4ca443bd194a299 Author: David Holland Date: Fri Mar 27 16:36:36 2026 -0400 staging: rtl8723bs: rename variables to snake_case The Linux kernel coding style guidelines prohibit the use of CamelCase variable names. All variables should be snakecase. Rename the 'ChipVersion' parameter to 'chip_version' and the 'AutoLoadFail' parameter to 'auto_load_fail' in hal_com.c to adhere to the standard snakecase naming convention. Signed-off-by: David Holland Link: https://patch.msgid.link/20260327203636.24891-1-david@cardinalsystem.net Signed-off-by: Greg Kroah-Hartman commit d915dde6cf913f90efd74efbadf5f1219c7072ae Author: Haoyu Lu Date: Fri Mar 27 19:14:54 2026 +0800 staging: rtl8723bs: fix spelling in comment Change "co-existance" to "co-existence" in comment. Signed-off-by: Haoyu Lu Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260327111455.3260-1-hechushiguitu666@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7088561c8fbf71db2070d7f5fe23bd0ec7b7f75c Author: Omer El Idrissi Date: Thu Mar 26 10:36:07 2026 +0100 staging: rtl8723bs: cleanup return in sdio_init() Make sdio_init() return errno from sdio_enable_func or sdio_set_block_size instead of _SUCCESS/_FAIL vendor-defined macros. Let rtw_resume_process_normal return errno returned by sdio_init instead of -1. sdio_dvobj_init returns NULL on error so leave that as is. Let sdio_dvobj_init use a slightly more readable and conventional error check for sdio_init(). Signed-off-by: Omer El Idrissi Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260326093607.13011-3-omer.e.idrissi@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2b0da1fafb675f761dcabaa773a6ff7fb1da10a1 Author: Omer El Idrissi Date: Thu Mar 26 10:36:06 2026 +0100 staging: rtl8723bs: use direct returns in sdio_dvobj_init() Make sdio_dvobj_init() use direct returns Signed-off-by: Omer El Idrissi Signed-off-by: Omer El Idrissi Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260326093607.13011-2-omer.e.idrissi@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6671dbbb12513e79ccaccbf799b7b56ae28bb20f Author: Rodrigo Gobbi Date: Wed Mar 25 18:21:08 2026 -0300 staging: rtl8723bs: remove unused arg at odm_interface.h The header file uses some macros to create proper constants for ODM_REG and ODM_SET but current macros were not using _ic_type, leading to a checkpatch warn: WARNING: Argument '_ic_type' is not used in function-like macro Remove that arg, currently there is no support for per ic type Signed-off-by: Rodrigo Gobbi Link: https://patch.msgid.link/20260325212826.20309-1-rodrigo.gobbi.7@gmail.com Signed-off-by: Greg Kroah-Hartman commit 84265cbd96b97058ef67e3f8be3933667a000835 Author: Damien Riégel Date: Tue Mar 24 10:00:39 2026 -0400 greybus: raw: fix use-after-free if write is called after disconnect If a user writes to the chardev after disconnect has been called, the kernel panics with the following trace (with CONFIG_INIT_ON_FREE_DEFAULT_ON=y): BUG: kernel NULL pointer dereference, address: 0000000000000218 ... Call Trace: gb_operation_create_common+0x61/0x180 gb_operation_create_flags+0x28/0xa0 gb_operation_sync_timeout+0x6f/0x100 raw_write+0x7b/0xc7 [gb_raw] vfs_write+0xcf/0x420 ? task_mm_cid_work+0x136/0x220 ksys_write+0x63/0xe0 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f Disconnect calls gb_connection_destroy, which ends up freeing the connection object. When gb_operation_sync is called in the write file operations, its gets a freed connection as parameter and the kernel panics. The gb_connection_destroy cannot be moved out of the disconnect function, as the Greybus subsystem expect all connections belonging to a bundle to be destroyed when disconnect returns. To prevent this bug, use a rw lock to synchronize access between write and disconnect. This guarantees that the write function doesn't try to use a disconnected connection. Fixes: e806c7fb8e9b ("greybus: raw: add raw greybus kernel driver") Reviewed-by: Johan Hovold Signed-off-by: Damien Riégel Link: https://patch.msgid.link/20260324140039.40001-2-damien.riegel@silabs.com Signed-off-by: Greg Kroah-Hartman commit 983cc2c7efbce04ecbf6328448d895044dd6ab31 Author: Damien Riégel Date: Tue Mar 24 10:00:38 2026 -0400 greybus: raw: fix use-after-free on cdev close This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y): refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 139 at lib/refcount.c:28 refcount_warn_saturate+0xd0/0x130 ... Call Trace: cdev_put+0x18/0x30 __fput+0x255/0x2a0 __x64_sys_close+0x3d/0x80 do_syscall_64+0xa4/0x290 entry_SYSCALL_64_after_hwframe+0x77/0x7f The cdev is contained in the "gb_raw" structure, which is freed in the disconnect operation. When the cdev is released at a later time, cdev_put gets an address that points to freed memory. To fix this use-after-free, convert the struct device from a pointer to being embedded, that makes the lifetime of the cdev and of this device the same. Then, use cdev_device_add, which guarantees that the device won't be released until all references to the cdev have been released. Finally, delegate the freeing of the structure to the device release function, instead of freeing immediately in the disconnect callback. Fixes: e806c7fb8e9b ("greybus: raw: add raw greybus kernel driver") Reviewed-by: Johan Hovold Signed-off-by: Damien Riégel Link: https://patch.msgid.link/20260324140039.40001-1-damien.riegel@silabs.com Signed-off-by: Greg Kroah-Hartman commit d6696ce7201b586197637dae3d050cd395c2c238 Author: Sajal Gupta Date: Tue Mar 24 17:47:47 2026 +0530 staging: rtl8723bs: fix logical continuations in xmit_linux.c Simplify the conditional by removing redundant boolean comparisons and fixing the continuation line indentation. Signed-off-by: Sajal Gupta Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260324121828.14675-1-sajal2005gupta@gmail.com Signed-off-by: Greg Kroah-Hartman commit 75a1621e4f91310673c9acbcbb25c2a7ff821cd3 Author: Junrui Luo Date: Mon Mar 23 15:31:56 2026 +0800 staging: sm750fb: fix division by zero in ps_to_hz() ps_to_hz() is called from hw_sm750_crtc_set_mode() without validating that pixclock is non-zero. A zero pixclock passed via FBIOPUT_VSCREENINFO causes a division by zero. Fix by rejecting zero pixclock in lynxfb_ops_check_var(), consistent with other framebuffer drivers. Fixes: 81dee67e215b ("staging: sm750fb: add sm750 to staging") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB7881AFBFCE28CCF528B35D0CAF4BA@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Greg Kroah-Hartman commit 2541d1822954b6629cf4bbc0d20fea82143452b3 Author: Nikolay Kulikov Date: Mon Mar 23 18:06:08 2026 +0300 staging: rtl8723bs: remove custom is_multicast_mac_addr() function is_multicast_mac_addr() is redundant reimplementation of standard is_multicast_ether_addr() func. Remove it and switch to use is_multicast_ether_addr(). Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260323150650.7168-7-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1ee677634567ac4ca9d6141e89f08ca0e5f5d7ae Author: Nikolay Kulikov Date: Mon Mar 23 18:06:07 2026 +0300 staging: rtl8723bs: remove custom is_broadcast_mac_addr() function Replace the custom broadcast address checking function with standard kernel is_broadcast_ether_addr() func for this. Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260323150650.7168-6-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit 93854e4dd543e2818d7afe91ada55442cb820646 Author: Nikolay Kulikov Date: Mon Mar 23 18:06:06 2026 +0300 staging: rtl8723bs: remove custom is_zero_mac_addr() function Remove the custom function is_zero_mac_addr() and replace all calls to it with the default kernel function is_zero_ether_addr() to avoid duplicating existing code. Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260323150650.7168-5-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4fa02e833e0d7935753d18854c37e628dc83a221 Author: Nikolay Kulikov Date: Mon Mar 23 18:06:05 2026 +0300 staging: rtl8723bs: move logical operators to end of previous line Change the position of logical operators '||' and remove unnecessary curly braces around single expression to fix checkpatch.pl warnings. Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260323150650.7168-4-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit b5f801a42445d48a63fcde97fc17421b2d849639 Author: Nikolay Kulikov Date: Mon Mar 23 18:06:04 2026 +0300 staging: rtl8723bs: remove dead code in validate_recv_mgnt_frame() Remove unused code from the validate_recv_mgnt_frame() function. This code was previously commented out and is no longer needed. Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260323150650.7168-3-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit c4587d059ee74b2c216a49451ca47b39fe2789f6 Author: Nikolay Kulikov Date: Mon Mar 23 18:06:03 2026 +0300 staging: rtl8723bs: replace deeply nested if-else with switch-case The main logic of the validate_recv_mgnt_frame() function is deeply nested due to multiple if-else statements and additional block scope. Fix this by replacing identical if-else with switch-case statements, which will improve code readability and correct checkpatch.pl warnings about line lengths. Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260323150650.7168-2-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8c964b82a4e97ec7f25e17b803ee196009b38a57 Author: Lin YuChen Date: Sat Mar 21 01:25:02 2026 +0800 staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Initialize le_tmp64 to zero in rtw_BIP_verify() to prevent using uninitialized data. Smatch warns that only 6 bytes are copied to this 8-byte (u64) variable, leaving the last two bytes uninitialized: drivers/staging/rtl8723bs/core/rtw_security.c:1308 rtw_BIP_verify() warn: not copying enough bytes for '&le_tmp64' (8 vs 6 bytes) Initializing the variable at the start of the function fixes this warning and ensures predictable behavior. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-staging/abvwIQh0CHTp4wNJ@stanley.mountain/ Signed-off-by: Lin YuChen Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260320172502.167332-1-starpt.official@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3fc7b932b709dda62220f83b872f223c29a71af5 Author: Oskar Ray-Frayssinet Date: Sat Mar 21 23:33:46 2026 +0100 staging: rtl8723bs: remove unused function declarations Remove unused declarations of MRateToHwRate8723B() and HwRateToMRate8723B() from rtl8723b_hal.h as they have no implementation and are never called. Signed-off-by: Oskar Ray-Frayssinet Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260321223347.7054-1-rayfraytech@gmail.com Signed-off-by: Greg Kroah-Hartman commit ff97e01144fa4a1149c6352d35e8ead74c436460 Author: Jose A. Perez de Azpillaga Date: Sat Mar 21 19:27:00 2026 +0100 staging: rtl8723bs: refactor rtw_joinbss_event_prehandle to reduce indentation The rtw_joinbss_event_prehandle function has excessive indentation due to deeply nested if-statements. Refactor the function using early returns and guard clauses for the failure paths. This flattens the code and significantly improves readability. Signed-off-by: Jose A. Perez de Azpillaga Reviewed-by: Luka Gejak Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260321182713.665872-3-azpijr@gmail.com Signed-off-by: Greg Kroah-Hartman commit 96e82c72feef0b76ebd2b5ec4ae9e5e03595ca78 Author: Jose A. Perez de Azpillaga Date: Sat Mar 21 19:26:59 2026 +0100 staging: rtl8723bs: remove dead REJOIN code The REJOIN macro is not defined anywhere in the kernel tree. Remove this dead code to simplify the function. Signed-off-by: Jose A. Perez de Azpillaga Reviewed-by: Luka Gejak Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260321182713.665872-2-azpijr@gmail.com Signed-off-by: Greg Kroah-Hartman commit e23ad15700284b63ab5d8ae1370e93f7c1723863 Author: Lin YuChen Date: Thu Mar 19 20:07:37 2026 +0800 staging: rtl8723bs: use guard clause for stainfo check Continue the refactor of rtw_aes_decrypt() by introducing a guard clause for the stainfo check. This allows the subsequent multicast and unicast decryption logic to be moved one indentation level to the left, further improving code readability. Signed-off-by: Lin YuChen Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260319120737.29692-3-starpt.official@gmail.com Signed-off-by: Greg Kroah-Hartman commit d359ab14db75ea485b3c0788f85eb9cebacd4add Author: Lin YuChen Date: Thu Mar 19 20:07:36 2026 +0800 staging: rtl8723bs: use guard clause for AES check Refactor the AES encryption check by using a guard clause to reduce the indentation level of the subsequent logic. Signed-off-by: Lin YuChen Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260319120737.29692-2-starpt.official@gmail.com Signed-off-by: Greg Kroah-Hartman commit 29372c18c7f7416397aca91c17541d4d522e5e34 Author: Marco Antonio Solis Segura Date: Thu Mar 19 00:26:26 2026 -0600 staging: rtl8723bs: split multiple assignment in rtw_mgmt_xmitframe_coalesce Cleanup the multiple assignment of tmp_buf and BIP_AAD to fix the checkpatch.pl CHECK: "Multiple assignments should be avoided". Additionally, reorder the assignments to ensure tmp_buf is assigned only after BIP_AAD has been validated as non-NULL. Signed-off-by: Marco Antonio Solis Segura Link: https://patch.msgid.link/20260319062626.605200-1-mshdevv@gmail.com Signed-off-by: Greg Kroah-Hartman commit d5d286154b6cc1729b5aa0bc579902e2dbe9be5c Author: Rosen Penev Date: Mon Mar 30 13:37:37 2026 -0700 ata: libahci_platform: use flex array for platform PHYs Modify struct ahci_host_priv to use a flexible array member for an adapter port PHYs and use struct_size to combine the allocation of this array together with the adapter private data structure. __counted_by() annotation is added for the phys field to support runtime analysis. Signed-off-by: Rosen Penev Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit 092ba18dddaa0ac5be82d1d747764cdb5eafeab0 Author: Bera Yüzlü Date: Wed Mar 18 22:50:05 2026 +0300 staging: rtl8723bs: Remove dead code Clean up the dm_odm_t structure by removing commented-out members and related legacy comments. Signed-off-by: Bera Yüzlü Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260318195005.23962-1-b9788213@gmail.com Signed-off-by: Greg Kroah-Hartman commit 93d04e76bcf1e81f36f5ea7ad620a07747f1527c Merge: 7fae6616704a17 7db154aa58e18b Author: Paolo Abeni Date: Tue Mar 31 10:28:57 2026 +0200 Merge branch 'r8152-add-helper-functions-for-pla-usb-phy-ocp-registers' Chih Kai Hsu says: ==================== r8152: add helper functions for PLA/USB/PHY OCP registers ==================== Link: https://patch.msgid.link/20260326073925.32976-453-nic_swsd@realtek.com Signed-off-by: Paolo Abeni commit 7db154aa58e18bb663cc317f0b62631f8b3d2b87 Author: Chih Kai Hsu Date: Thu Mar 26 15:39:25 2026 +0800 r8152: add helper functions for PHY OCP registers Add the following bitwise operation functions for PHY OCP registers to simplify the code. - ocp_reg_w0w1() - ocp_reg_clr_bits() - ocp_reg_set_bits() - sram_write_w0w1() - sram_clr_bits() - sram_set_bits() - r8152_mdio_clr_bit() - r8152_mdio_set_bit() - r8152_mdio_test_and_clr_bit() In addition, remove variable set but not used from r8153_init(), r8153b_init() and r8153c_init(). Signed-off-by: Chih Kai Hsu Reviewed-by: Hayes Wang Link: https://patch.msgid.link/20260326073925.32976-456-nic_swsd@realtek.com Signed-off-by: Paolo Abeni commit d16133f177fea620d6b413990683b6a8b2641be5 Author: Chih Kai Hsu Date: Thu Mar 26 15:39:24 2026 +0800 r8152: add helper functions for PLA/USB OCP registers Add the following bitwise operation functions for PLA/USB OCP registers to simplify the code. - ocp_dword_w0w1() - ocp_word_w0w1() - ocp_byte_w0w1() - ocp_dword_clr_bits() - ocp_dword_set_bits() - ocp_word_clr_bits() - ocp_word_set_bits() - ocp_word_test_and_clr_bits() - ocp_byte_clr_bits() - ocp_byte_set_bits() Signed-off-by: Chih Kai Hsu Reviewed-by: Hayes Wang Link: https://patch.msgid.link/20260326073925.32976-455-nic_swsd@realtek.com Signed-off-by: Paolo Abeni commit 48afd5124fd6129c46fd12cb06155384b1c4a0c4 Author: Chih Kai Hsu Date: Thu Mar 26 15:39:23 2026 +0800 r8152: fix incorrect register write to USB_UPHY_XTAL The old code used ocp_write_byte() to clear the OOBS_POLLING bit (BIT(8)) in the USB_UPHY_XTAL register, but this doesn't correctly clear a bit in the upper byte of the 16-bit register. Fix this by using ocp_write_word() instead. Fixes: 195aae321c82 ("r8152: support new chips") Signed-off-by: Chih Kai Hsu Reviewed-by: Hayes Wang Link: https://patch.msgid.link/20260326073925.32976-454-nic_swsd@realtek.com Signed-off-by: Paolo Abeni commit d1888bf848ade6a9e71c7ba516fd215aa1bd8d65 Author: Lei Huang Date: Tue Mar 31 15:54:05 2026 +0800 ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') Fix checkpatch code style errors: ERROR: else should follow close brace '}' #2300: FILE: sound/hda/codecs/realtek/alc269.c:2300: + } + else Fixes: 31278997add6 ("ALSA: hda/realtek - Add headset quirk for Dell DT") Signed-off-by: Lei Huang Link: https://patch.msgid.link/20260331075405.78148-1-huanglei814@163.com Signed-off-by: Takashi Iwai commit 6ccd0843b939669159f7148dfb84e6794ca6f4a8 Author: Thomas Weißschuh Date: Tue Mar 31 09:58:54 2026 +0200 x86/vdso: Drop pointless #ifdeffery in vvar_vclock_fault() Sparse complains rightfully when CONFIG_PARAVIRT_CLOCK and CONFIG_HYPERV_TIMER are both not set: arch/x86/entry/vdso/vma.c:94:9: warning: switch with no cases The #ifdeffery is not actually necessary as the compiler can optimize away the branches already if these config options are not set. Remove the #ifdeffery to make the code simpler and Sparse happy. Closes: https://lore.kernel.org/lkml/20260117215542.405790227@kernel.org/ Reported-by: Thomas Gleixner Signed-off-by: Thomas Weißschuh Signed-off-by: Ingo Molnar Cc: H. Peter Anvin Cc: Andy Lutomirski Link: https://patch.msgid.link/20260331-vdso-x86-ifdef-v1-1-6be9a58b1e7e@linutronix.de commit 3b19e22cffe61bcdf10ee5e7584cfa3c1c54dc92 Author: Uros Bizjak Date: Mon Mar 30 10:59:23 2026 +0200 x86/tls: Clean up 'sel' variable usage in do_set_thread_area() The top-level 'sel' variable in do_set_thread_area() was previously marked __maybe_unused, but it is now only needed locally when updating the current task. Remove the unused top-level declaration and introduce a local 'sel' variable where it is actually used No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Ingo Molnar Cc: H. Peter Anvin Cc: Linus Torvalds Link: https://patch.msgid.link/20260330085938.67985-4-ubizjak@gmail.com commit 6829f19810e96903d7b532145c3d1701b4d9a0f6 Author: Uros Bizjak Date: Mon Mar 30 10:59:22 2026 +0200 x86/process/32: Use correct type for 'gs' variable in __show_regs() to avoid zero-extension Change the type of 'gs' variable in __show_regs() from 'unsigned short' to 'unsigned int'. This prevents unwanted zero-extension when storing the 16-bit segment register into a wider general purpose register. The code improves from: 50: 8c ee mov %gs,%esi 52: 0f b7 f6 movzwl %si,%esi ... be: 89 74 24 14 mov %esi,0x14(%esp) to: 50: 8c ef mov %gs,%edi ... bb: 89 7c 24 14 mov %edi,0x14(%esp) No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Ingo Molnar Cc: H. Peter Anvin Cc: Linus Torvalds Link: https://patch.msgid.link/20260330085938.67985-3-ubizjak@gmail.com commit 81310ce4287a23b8ff6e8684de73cfaae88782ca Author: Uros Bizjak Date: Mon Mar 30 10:59:21 2026 +0200 x86/process/64: Use savesegment() in __show_regs() instead of inline asm Replace direct 'movl' instructions for DS, ES, FS, and GS read in __show_regs() with the savesegment() helper. This improves readability, consistency, and ensures proper handling of segment registers on x86_64. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Ingo Molnar Cc: H. Peter Anvin Cc: Linus Torvalds Link: https://patch.msgid.link/20260330085938.67985-2-ubizjak@gmail.com commit 47d2f007615ace34c5ec9026cd5f286833c62c1b Author: Uros Bizjak Date: Mon Mar 30 10:59:20 2026 +0200 x86/elf: Use savesegment() for segment register reads in ELF core dump ELF_CORE_COPY_REGS() currently reads %ds, %es, %fs, and %gs using inline assembly and manual zero-extension. This results in redundant instructions like `mov %eax,%eax`. Replace the inline assembly with the `savesegment()` helper, which automatically zero-extends the value to the full register width, eliminating unnecessary instructions. For example, the %ds load sequence changes from: d03: 8c d8 mov %ds,%eax d05: 89 c0 mov %eax,%eax d07: 48 89 84 24 38 01 00 mov %rax,0x138(%rsp) d0e: 00 to: ce8: 8c d8 mov %ds,%eax cea: 48 89 84 24 38 01 00 mov %rax,0x138(%rsp) cf1: 00 thus eliminating the unnecessary zero-extending `mov %eax,%eax`. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Ingo Molnar Cc: H. Peter Anvin Cc: Linus Torvalds Link: https://patch.msgid.link/20260330085938.67985-1-ubizjak@gmail.com commit 3f736aecbdc8e4faf2ed82c981812a6bfc76ea98 Author: Manivannan Sadhasivam Date: Thu Mar 26 13:36:36 2026 +0530 power: sequencing: pcie-m2: Create serdev device for WCN7850 bluetooth For supporting bluetooth over the non-discoverable UART interface of WCN7850, create the serdev device after enumerating the PCIe interface. This is mandatory since the device ID is only known after the PCIe enumeration and the ID is used for creating the serdev device. Since by default there is no OF or ACPI node for the created serdev, create a dynamic OF 'bluetooth' node with the 'compatible' property and attach it to the serdev device. This will allow the serdev device to bind to the existing bluetooth driver. Tested-by: Hans de Goede # ThinkPad T14s gen6 (arm64) Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260326-pci-m2-e-v7-8-43324a7866e6@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 0d38285a12a283e12cd589ad5bb46c6f4a8cc647 Author: Manivannan Sadhasivam Date: Thu Mar 26 13:36:35 2026 +0530 power: sequencing: pcie-m2: Add support for PCIe M.2 Key E connectors Add support for handling the power sequence of the PCIe M.2 Key E connectors. These connectors are used to attach the Wireless Connectivity devices to the host machine including combinations of WiFi, BT, NFC using interfaces such as PCIe/SDIO for WiFi, USB/UART for BT and I2C for NFC. Currently, this driver supports only the PCIe interface for WiFi and UART interface for BT. The driver also only supports driving the 3.3v/1.8v power supplies and W_DISABLE{1/2}# GPIOs. The optional signals of the Key E connectors are not currently supported. Tested-by: Hans de Goede # ThinkPad T14s gen6 (arm64) Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260326-pci-m2-e-v7-7-43324a7866e6@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 5970c1dafb8adbeab5f6d9a22a4ad5b1c0067888 Author: Manivannan Sadhasivam Date: Thu Mar 26 13:36:33 2026 +0530 dt-bindings: connector: Add PCIe M.2 Mechanical Key E connector Add the devicetree binding for PCIe M.2 Mechanical Key E connector defined in the PCI Express M.2 Specification, r4.0, sec 5.1.2. This connector provides interfaces like PCIe or SDIO to attach the WiFi devices to the host machine, USB or UART+PCM interfaces to attach the Bluetooth (BT) devices. Spec also provides an optional interface to connect the UIM card, but that is not covered in this binding. The connector provides a primary power supply of 3.3v, along with an optional 1.8v VIO supply for the Adapter I/O buffer circuitry operating at 1.8v sideband signaling. The connector also supplies optional signals in the form of GPIOs for fine grained power management. Reviewed-by: Rob Herring (Arm) Signed-off-by: Manivannan Sadhasivam Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260326-pci-m2-e-v7-5-43324a7866e6@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 1785c7bc1495e4e22377edffaf0ff8c3c697647d Author: Manivannan Sadhasivam Date: Thu Mar 26 13:36:32 2026 +0530 dt-bindings: serial: Document the graph port A serial controller could be connected to an external connector like PCIe M.2 for controlling the serial interface of the card. Hence, document the OF graph port. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bartosz Golaszewski Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260326-pci-m2-e-v7-4-43324a7866e6@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 92fa16ecad07dddc5703f7e2ff342441b04c45af Author: Manivannan Sadhasivam Date: Thu Mar 26 13:36:31 2026 +0530 serdev: Do not return -ENODEV from of_serdev_register_devices() if external connector is used If an external connector like M.2 is connected to the serdev controller in DT, then the serdev devices may be created dynamically by the connector driver. So do not return -ENODEV from of_serdev_register_devices() if the static nodes are not found and the graph node is used. Tested-by: Hans de Goede # ThinkPad T14s gen6 (arm64) Reviewed-by: Bartosz Golaszewski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260326-pci-m2-e-v7-3-43324a7866e6@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit a2b4814190af5944b276c5fd708d95ea146106b3 Author: Manivannan Sadhasivam Date: Thu Mar 26 13:36:30 2026 +0530 serdev: Add an API to find the serdev controller associated with the devicetree node Add of_find_serdev_controller_by_node() API to find the serdev controller device associated with the devicetree node. Tested-by: Hans de Goede # ThinkPad T14s gen6 (arm64) Reviewed-by: Bartosz Golaszewski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260326-pci-m2-e-v7-2-43324a7866e6@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit e7fef85039ccdba67d97b2a09f313aceeb6691c8 Author: Manivannan Sadhasivam Date: Thu Mar 26 13:36:29 2026 +0530 serdev: Convert to_serdev_*() helpers to macros and use container_of_const() If these helpers receive the 'const struct device' pointer, then the const qualifier will get dropped, leading to below warning: warning: passing argument 1 of ‘to_serdev_device_driver’ discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] This is not an issue as of now, but with the future commits adding serdev device based driver matching, this warning will get triggered. Hence, convert these helpers to macros so that the qualifier get preserved and also use container_of_const() as container_of() is deprecated. Tested-by: Hans de Goede # ThinkPad T14s gen6 (arm64) Reviewed-by: Bartosz Golaszewski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260326-pci-m2-e-v7-1-43324a7866e6@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 6517f293b2c6774d21b6e7e26a55fae60c6ec4cf Author: Thomas Weißschuh Date: Mon Mar 30 14:07:55 2026 +0200 x86/vdso: Clean up remnants of VDSO32_NOTE_MASK VDSO32_NOTE_MASK is not used or provided anymore, remove it. Fixes: a13f2ef168cb ("x86/xen: remove 32-bit Xen PV guest support") Signed-off-by: Thomas Weißschuh Signed-off-by: Ingo Molnar Cc: H. Peter Anvin Cc: Boris Ostrovsky Cc: Juergen Gross Link: https://patch.msgid.link/20260330-vdso-x86-vdso32_note_mask-v1-1-2f5c473327bf@linutronix.de commit fdcbddcd3aa13c05ac99fe1de2d5d9eeb1af0c49 Author: Jason Gunthorpe Date: Wed Mar 25 18:27:02 2026 -0300 RDMA/hns: Remove the duplicate calls to ib_copy_validate_udata_in() A udata should be read only once per ioctl, not multiple times. Multiple reads make it unclear what the content is since userspace can change it between the reads. Lift the ib_copy_validate_udata_in() out of alloc_srq_buf()/alloc_srq_db() and into hns_roce_create_srq(). Found by AI. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit 8e3e07cca00434d6430e44c310b2ab2965dfb794 Author: Jason Gunthorpe Date: Wed Mar 25 18:27:01 2026 -0300 RDMA: Remove redundant = {} for udata req structs Now that all of the udata request structs are loaded with the helpers the callers should not pre-zero them. The helpers all guarantee that the entire struct is filled with something. Reviewed-by: Long Li Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit 69309e17293cad7a90947fd4be45fb907a036074 Author: Jason Gunthorpe Date: Wed Mar 25 18:27:00 2026 -0300 RDMA/irdma: Add missing comp_mask check in alloc_ucontext irdma has a comp_mask field that was never checked for validity, check it. Signed-off-by: Jason Gunthorpe Reviewed-by: Jacob Moroni Signed-off-by: Leon Romanovsky commit 67820de3167992d1c6071014737872c1c82a7f67 Author: Jason Gunthorpe Date: Wed Mar 25 18:26:59 2026 -0300 RDMA/hns: Add missing comp_mask check in create_qp hns has a comp_mask field that was never checked for validity, check it. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit 676b570707be0d7e1cd011ceeab651ab243cf505 Author: Jason Gunthorpe Date: Wed Mar 25 18:26:58 2026 -0300 RDMA/mlx5: Pull comp_mask validation into ib_copy_validate_udata_in_cm() Directly check the supported comp_mask bitmap using ib_copy_validate_udata_in_cm() and remove the open coding. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit 604caebc7f069aef602bc75c5f0e6cf7a3ec456b Author: Jason Gunthorpe Date: Wed Mar 25 18:26:57 2026 -0300 RDMA: Use ib_copy_validate_udata_in_cm() for zero comp_mask All of these cases require a 0 comp_mask. Consolidate these into using ib_copy_validate_udata_in_cm() and remove the open coded comp_mask test. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit d5c8f2f399077d8e6f706d00f42c89407d66e9c6 Author: Jason Gunthorpe Date: Wed Mar 25 18:26:56 2026 -0300 RDMA/hns: Use ib_copy_validate_udata_in() Follow the last struct member from the commit when the struct was added to the kernel. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit 0453bf09a68b11f7561d8266b3221e147743afce Author: Jason Gunthorpe Date: Wed Mar 25 18:26:55 2026 -0300 RDMA/mlx4: Use ib_copy_validate_udata_in() for QP Move the validation of the udata to the same function that copies it. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit f899787095cdb537cf1b5710b1e7b243da655e8b Author: Jason Gunthorpe Date: Wed Mar 25 18:26:54 2026 -0300 RDMA/mlx4: Use ib_copy_validate_udata_in() Follow the last member of each struct at the point MLX4_IB_UVERBS_ABI_VERSION was set to 4. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit 530b251b0f7a44d10bc493d970fa3663962ba16f Author: Jason Gunthorpe Date: Wed Mar 25 18:26:53 2026 -0300 RDMA/mlx5: Use ib_copy_validate_udata_in() for MW The userspace side on MW made a mistake and never actually used the udata driver structure that was defined so it always passes 0 length. Keep the kernel structure but this conversion has to permit 0 length as well. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit c8f9a7a96e9a95e7b2bc3cc95371e0d75a5872ec Author: Jason Gunthorpe Date: Wed Mar 25 18:26:52 2026 -0300 RDMA/mlx5: Use ib_copy_validate_udata_in() for SRQ flags is the last member for mlx5_ib_create_srq, the uidx is a later extension. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit 3268330fa84ff7bb678f86ee082116c1c5c150bb Author: Jason Gunthorpe Date: Wed Mar 25 18:26:51 2026 -0300 RDMA/pvrdma: Use ib_copy_validate_udata_in() for srq struct pvrdma_create_srq was introduced when the driver was first merged but was never used. At that point it had only buf_addr. Later when SRQ was introduced the struct was expanded. So unlike the other cases that grab the first struct member based on git blame this uses the entire struct. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit 54b3bce9721141f6aee4909591b5c02e7ba4bd7b Author: Jason Gunthorpe Date: Wed Mar 25 18:26:50 2026 -0300 RDMA: Use ib_copy_validate_udata_in() for implicit full structs All of these cases have git blames that say the entire current struct was introduced at once, so the last member is the right choice. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit e910d98dc440f1d9965289f52d455dc7a81fae82 Author: Jason Gunthorpe Date: Wed Mar 25 18:26:49 2026 -0300 RDMA: Consolidate patterns with sizeof() to ib_copy_validate_udata_in() Similar to the prior patch, these patterns are open coding an offsetofend() using sizeof(), which targets the last member of the current struct. Reviewed-by: Long Li Signed-off-by: Jason Gunthorpe Reviewed-by: Bernard Metzler Signed-off-by: Leon Romanovsky commit 8d7573b194021b0b2baee9a8c563af488be733be Author: Jason Gunthorpe Date: Wed Mar 25 18:26:48 2026 -0300 RDMA: Consolidate patterns with offsetof() to ib_copy_validate_udata_in() Similar to the prior patch, these patterns are open coding an offsetofend(). The use of offsetof() targets the prior field as the last field in the struct. Reviewed-by: Long Li Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit ae638288b2026224ab56c18b980935b4f2dfd8d0 Author: Jason Gunthorpe Date: Wed Mar 25 18:26:47 2026 -0300 RDMA: Consolidate patterns with offsetofend() to ib_copy_validate_udata_in() Go treewide and consolidate all existing patterns using: * offsetofend() and variations * ib_is_udata_cleared() * ib_copy_from_udata() into a direct call to the new ib_copy_validate_udata_in(). Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit c1258a2924d3a2453a6e7a6581acd8d6e5c6ba70 Author: Lei Huang Date: Tue Mar 31 10:40:36 2026 +0800 ALSA: hda/realtek: fix bad indentation for alc269 Mention complains about this coding style: ERROR: code indent should use tabs where possible #6640: FILE: sound/hda/codecs/realtek/alc269.c:6640: + [ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY] = {$ fix it up. Fixes: 5de5db35350d ("ALSA: hda/realtek - Enable Mute LED for Lenovo platform") Signed-off-by: Lei Huang Link: https://patch.msgid.link/20260331024036.30782-1-huanglei814@163.com Signed-off-by: Takashi Iwai commit 28899037b85e77490f202fa9361c3c2780be3ec2 Merge: f6225b546dfccf e012fa31f90de0 Author: Dave Airlie Date: Tue Mar 31 16:38:49 2026 +1000 Merge tag 'drm-intel-next-2026-03-30' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 feature pull #2 for v7.1: Refactoring and cleanups: - Refactor LT PHY PLL handling to use the DPLL framework (Mika) - Implement display register polling and waits in display code (Ville) - Move PCH clock gating in display PCH file (Luca) - Add shared stepping info header for i915 and display (Jani) - Clean up GVT I2C command decoding (Jonathan) - NV12 plane unlinking cleanups (Ville) - Clean up NV12 DDB/watermark handling for pre-ICL platforms (Ville) Fixes: - An assortment of DSI fixes (Ville) - Handle PORT_NONE in assert_port_valid() (Jonathan) - Fix link failure without FBDEV emulation (Arnd Bergmann) - Quirk disable panel replay on certain Dell XPS models (Jouni) - Check if VESA DPCD AUX backlight is possible (Suraj) Other: - Mailmap update for Christoph (Christoph) Signed-off-by: Dave Airlie # Conflicts: # drivers/gpu/drm/i915/display/intel_plane.c From: Jani Nikula Link: https://patch.msgid.link/ac9dfdb745d5a67c519ea150a6f36f8f74b8760e@intel.com commit 4a4e0328edd9e9755843787d28f16dd4165f8b48 Author: Deepanshu Kartikey Date: Tue Mar 31 09:47:21 2026 +0900 nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map The DAT inode's btree node cache (i_assoc_inode) is initialized lazily during btree operations. However, nilfs_mdt_save_to_shadow_map() assumes i_assoc_inode is already initialized when copying dirty pages to the shadow map during GC. If NILFS_IOCTL_CLEAN_SEGMENTS is called immediately after mount before any btree operation has occurred on the DAT inode, i_assoc_inode is NULL leading to a general protection fault. Fix this by calling nilfs_attach_btree_node_cache() on the DAT inode in nilfs_dat_read() at mount time, ensuring i_assoc_inode is always initialized before any GC operation can use it. Reported-by: syzbot+4b4093b1f24ad789bf37@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4b4093b1f24ad789bf37 Tested-by: syzbot+4b4093b1f24ad789bf37@syzkaller.appspotmail.com Fixes: e897be17a441 ("nilfs2: fix lockdep warnings in page operations for btree nodes") Signed-off-by: Deepanshu Kartikey Signed-off-by: Ryusuke Konishi Cc: stable@vger.kernel.org Signed-off-by: Viacheslav Dubeyko commit 331e5fd5bfd7aae3ab4eb947367b9d609ebb3fb3 Author: Bartosz Golaszewski Date: Thu Mar 26 10:30:00 2026 +0100 hwmon: (ina2xx) drop unused platform data Nobody defines struct ina2xx_platform_data. Remove platform data support from the drivers which still have it (it's effectively dead code) and remove the header. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Acked-by: Jonathan Cameron Link: https://lore.kernel.org/r/20260326-drop-ina2xx-pdata-v1-1-c159437bb2df@oss.qualcomm.com [groeck: Fixed continuation line alignment] Signed-off-by: Guenter Roeck commit b95ba51883fdfb60ab2633e0a5320a2f26f5298e Author: Rong Zhang Date: Fri Mar 27 03:19:50 2026 +0800 hwmon: Add label support for 64-bit energy attributes Since commit 0bcd01f757bc ("hwmon: Introduce 64-bit energy attribute support"), devices can report 64-bit energy values by selecting the sensor type "energy64". However, such sensors can't report their labels since is_string_attr() was not updated to match it. Add label support for 64-bit energy attributes by updating is_string_attr() to match hwmon_energy64 in addition to hwmon_energy. Signed-off-by: Rong Zhang Link: https://lore.kernel.org/r/20260327-b4-hwmon-witrn-v1-1-8d2f1896c045@rong.moe Signed-off-by: Guenter Roeck commit bd1c178affd7d1ca86eaf97cf797e0d15e57eb0a Author: Guenter Roeck Date: Fri Mar 20 07:45:55 2026 -0700 hwmon: (pmbus_core) Use guard() for mutex protection Simplify the code by using guard() and scoped_guard() instead of mutex_lock()/mutex_unlock() sequences. This patch changes semantics for debugfs accesses. Previously, those used mutex_lock_interruptible() and not mutex_lock(). This change is intentional and should have little if any impact since locks should not be held for a significant amount of time and debugfs accesses are less critical than sysfs accesses (which never used interruptable locks). Reviewed-by: Sanman Pradhan Signed-off-by: Guenter Roeck commit 1814f4d3ff358277a5b6957e7f133c2812dc80ec Author: Guenter Roeck Date: Fri Mar 20 07:18:37 2026 -0700 hwmon: (pmbus) Add support for guarded PMBus lock Add support for guard(pmbus_lock)() and scoped_guard(pmbus_lock)() to be able to simplify the PMBus code. Also introduce pmbus_lock() as pre-requisite for supporting guard(). Reviewed-by: Sanman Pradhan Signed-off-by: Guenter Roeck commit 7c760db74c9f30da7281c7f450d0676ec78ec3e6 Author: Dawei Liu Date: Wed Mar 25 17:02:08 2026 +0800 hwmon: (pmbus/isl68137) Add support for Renesas RAA228942 and RAA228943 Add I2C device IDs for Renesas RAA228942 and RAA228943. At the Linux PMBus hwmon interface level currently supported by this driver, these devices are compatible with the existing 2-rail non-TC controllers, so devicetree will use fallback compatibles and no dedicated OF match entries are needed. Signed-off-by: Dawei Liu Link: https://lore.kernel.org/r/20260325090208.857-3-dawei.liu.jy@renesas.com Signed-off-by: Guenter Roeck commit b8960e3e2cd56aebce382bde5676cb8adfd4ad5e Author: Dawei Liu Date: Wed Mar 25 17:02:07 2026 +0800 dt-bindings: hwmon: isl68137: Add compatible strings for RAA228942 and RAA228943 RAA228942 and RAA228943 are Renesas digital dual-output 16-phase (X+Y <= 16) PWM controllers with 2-rail non-TC driver configuration. At the PMBus hwmon interface level, they are compatible with existing 2-rail non-TC controllers and use renesas,raa228244 as fallback compatible Signed-off-by: Dawei Liu Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260325090208.857-2-dawei.liu.jy@renesas.com Signed-off-by: Guenter Roeck commit 9ca750883a13244b9d6f3607d6aa56002ae2e928 Author: Flaviu Nistor Date: Sun Mar 22 18:26:16 2026 +0200 hwmon: lm75: Add support for label Add support for label sysfs attribute similar to other hwmon devices. This is particularly useful for systems with multiple sensors on the same board, where identifying individual sensors is much easier since labels can be defined via device tree. Signed-off-by: Flaviu Nistor Link: https://lore.kernel.org/r/20260322162616.102229-1-flaviu.nistor@gmail.com Signed-off-by: Guenter Roeck commit 66b8eaf8def2d51dab49c4921b93f1bf1c7638dc Author: Markus Hoffmann Date: Sun Mar 22 10:33:01 2026 +0000 hwmon: (it87) Add support for IT8689E Add support for the ITE IT8689E Super I/O chip. The IT8689E supports newer autopwm, 12mV ADC, 16-bit fans, six fans, six PWM channels, PWM frequency 2, six temperature inputs, AVCC3, temperature offset, and fan on/off control. Give it8689 its own GPIO configuration block in it87_find() rather than sharing the it8620/it8628 block. The shared block reads IT87_SIO_PINX2_REG and either marks IN3 as internal AVCC or skips IN9. Because it8689 declares FEAT_AVCC3, IN9 is already marked as always-internal before the GPIO block is reached; applying the PINX2 check would either create duplicate AVCC labels on IN3 and IN9 or incorrectly skip IN9. Also update Documentation/hwmon/it87.rst and drivers/hwmon/Kconfig to document the newly supported chip. Signed-off-by: Markus Hoffmann Link: https://lore.kernel.org/r/20260322103301.18112-1-markus@thehoffs.at Signed-off-by: Guenter Roeck commit 21518579cbdeb4e86a6fffbc3d52f52bd74ab87e Author: Denis Pauk Date: Sun Mar 22 15:18:45 2026 +0200 hwmon: (nct6775) Add ASUS X870/W480 to WMI monitoring list Boards such as * G15CE, * PRIME X870-P WIFI, * PRIME X870-P, * Pro WS W480-ACE, * ProArt X870E-CREATOR WIFI, * ROG CROSSHAIR X870E APEX, * ROG CROSSHAIR X870E DARK HERO, * ROG CROSSHAIR X870E EXTREME, * ROG CROSSHAIR X870E GLACIAL, * ROG CROSSHAIR X870E HERO BTF, * ROG CROSSHAIR X870E HERO, * ROG STRIX X870-A GAMING WIFI, * ROG STRIX X870-F GAMING WIFI, * ROG STRIX X870-I GAMING WIFI, * ROG STRIX X870E-E GAMING WIFI, * ROG STRIX X870E-E GAMING WIFI7 R2, * TUF GAMING X870-PLUS WIFI, * TUF GAMING X870-PRO WIFI7 W NEO, * TUF GAMING X870E-PLUS WIFI7, * W480/SYS, * X870 AYW GAMING WIFI W, * X870 MAX GAMING WIFI7 W, * X870 MAX GAMING WIFI7 have got a nct6775 chip, but by default there's no use of it because of resource conflict with WMI method. Add the boards to the WMI monitoring list. Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 Signed-off-by: Denis Pauk Tested-by: Tomáš Bžatek Tested-by: Theunis Scheepers Link: https://lore.kernel.org/r/20260322131848.6261-1-pauk.denis@gmail.com Signed-off-by: Guenter Roeck commit 80306ba88ba6891f8cd16d4042beec69e9044de7 Author: Sanman Pradhan Date: Sat Mar 21 18:12:05 2026 +0000 hwmon: (pmbus/max31785) check for partial i2c_transfer in read_long_data i2c_transfer() returns the number of messages successfully transferred, not only a negative errno on failure. When called with two messages (write command byte followed by a read of the 4-byte response), a return value of 1 means the command write succeeded but the read did not complete. In that case, rspbuf remains uninitialized and must not be interpreted as valid data. Treat any return value other than ARRAY_SIZE(msg) as an error, and return -EIO for partial completion. Also return 0 on success instead of the message count, since the caller only needs to distinguish success from failure. Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260321181052.27129-4-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit 6be9b04ef3fff87bf329fecae4647196ffefc539 Author: Sanman Pradhan Date: Sat Mar 21 18:11:47 2026 +0000 hwmon: (pmbus/max31785) use access_delay for PMBus-mediated accesses The MAX31785 driver currently uses driver-local wrappers around PMBus core accesses to enforce a 250us inter-access delay needed to work around occasional NACKs from the device. This duplicates the PMBus core delay mechanism already provided by pmbus_driver_info.access_delay and adds unnecessary complexity. Replace the PMBus wrapper approach with access_delay for normal PMBus-mediated accesses, while keeping the minimal local delay handling needed for raw pre-probe SMBus operations. For the raw i2c_transfer() long-read path, use pmbus_wait() and pmbus_update_ts() to keep the PMBus core timing state consistent with the raw transfer. Also: - allow PMBUS_FAN_CONFIG_12 physical-page accesses to fall back to the PMBus core, while remapping only virtual pages - use pmbus_update_fan() directly for fan configuration updates - use the delayed raw read helper for MFR_REVISION during probe - add a final max31785_wait() before pmbus_do_probe() to bridge the timing gap between pre-probe accesses and PMBus core registration - rename 'virtual' to 'vpage', 'driver_data' to 'data', and drop the unused to_max31785_data() macro Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260321181052.27129-3-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit dc4acb718ed9b292aec93b91ae95d71e85705c72 Author: Sanman Pradhan Date: Sat Mar 21 18:11:30 2026 +0000 hwmon: (pmbus) export pmbus_wait and pmbus_update_ts Export pmbus_wait() and pmbus_update_ts() so that PMBus device drivers which perform raw I2C transfers outside the core helpers can keep the PMBus core delay bookkeeping in sync. Move PMBUS_OP_WRITE and PMBUS_OP_PAGE_CHANGE from pmbus_core.c to pmbus.h so device drivers can pass the correct operation type flags to pmbus_update_ts(). This is needed by the max31785 driver, which performs raw i2c_transfer() calls for its 4-byte extended fan speed reads that cannot use the standard PMBus word read path. Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260321181052.27129-2-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit 709cc8ff1b6276c01cdd811578062d4b1deb3452 Author: Dawei Liu Date: Wed Mar 18 10:19:19 2026 +0800 hwmon: (pmbus/isl68137) Remove unused enum chips The enum chips is not used anywhere in the driver. Device matching relies on the variants enum instead. Remove it to clean up the code. Signed-off-by: Dawei Liu Link: https://lore.kernel.org/r/20260318021921.75-2-dawei.liu.jy@renesas.com Signed-off-by: Guenter Roeck commit 46fef8583daa1bf78fda7eaa523c64d4440322ac Author: Billy Tsai Date: Mon Mar 9 10:33:24 2026 +0800 hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback Drops the remove callback as it only asserts reset and the probe already registers a devres action (devm_add_action_or_reset()) to call aspeed_pwm_tach_reset_assert(). Fixes: 7e1449cd15d1 ("hwmon: (aspeed-g6-pwm-tacho): Support for ASPEED g6 PWM/Fan tach") Signed-off-by: Billy Tsai Link: https://lore.kernel.org/r/20260309-pwm_fixes-v2-1-ca9768e70470@aspeedtech.com Signed-off-by: Guenter Roeck commit 967ee29c103a44c6e584a5e37401968a69e54a0c Author: Icenowy Zheng Date: Tue Mar 10 00:24:56 2026 +0800 dt-bindings: hwmon: moortec,mr75203: adapt multipleOf for T-Head TH1520 The G and J coefficients provided by T-Head TH1520 manual (which calls them A and C coefficients and calls H coefficient in the binding as B) have 1/100 degree Celsius precision (the values are 42.74 and -0.16 respectively), however the binding currently only allows coefficients as precise as 100 milli-Celsius (1/10 degree Celsius). Change the multipleOf value of these two coefficients to 10 (in the unit of milli-Celsius) to satisfy the need of TH1520. Signed-off-by: Icenowy Zheng Reviewed-by: Drew Fustini Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20260309162457.4128205-2-zhengxingda@iscas.ac.cn Signed-off-by: Guenter Roeck commit ffa2ad0aa64697c29d501f76cb7b7187cbbb147a Author: Colin Huang Date: Mon Mar 16 16:39:34 2026 +0800 hwmon: (pmbus) Add Delta Q54SN120A1 Q54SW120A7 chip Add the DELTA chips Q54SN120A1, Q54SW120A7 in q54sj108a2, 1/4 Brick DC/DC Regulated Power Module with PMBus support Signed-off-by: Colin Huang Link: https://lore.kernel.org/r/20260316-add-q54sn120a1-q54q54sw120a7-v2-2-60e6182cc4a7@gmail.com Signed-off-by: Guenter Roeck commit 32a7bdbd201be809c690c64a3a233c7bb640c48c Author: Colin Huang Date: Mon Mar 16 16:39:33 2026 +0800 dt-bindings: trivial-devices: Add Delta Q54SN120A1 and Q54SW120A7 Add two additional Delta 1/4-brick DC/DC power modules, Q54SN120A1 and Q54SW120A7, to the trivial-devices list. Acked-by: Conor Dooley Signed-off-by: Colin Huang Link: https://lore.kernel.org/r/20260316-add-q54sn120a1-q54q54sw120a7-v2-1-60e6182cc4a7@gmail.com Signed-off-by: Guenter Roeck commit 487a9ab28fdd4df773b68c953e69a6f6ecc2fe68 Author: Tabrez Ahmed Date: Sun Mar 8 18:17:14 2026 +0530 hwmon: (ads7871) Propagate SPI errors in voltage_show The voltage_show() function previously ignored negative error codes returned by the underlying SPI read/write functions. Because negative numbers have their most significant bits set in two's complement, a failed SPI read returning -EIO (-5) would incorrectly evaluate to true when masked with MUX_CNV_BM (0x80). This would cause the driver to enter the polling loop even when the SPI bus failed, eventually returning a misleading -ETIMEDOUT error to userspace instead of the actual hardware error. Furthermore, the return values of the initial SPI write and the final 16-bit SPI read were completely ignored. Add proper error checking after every SPI operation to ensure hardware failures are immediately propagated back to userspace. Suggested-by: Guenter Roeck Signed-off-by: Tabrez Ahmed Link: https://lore.kernel.org/r/20260308124714.84715-1-tabreztalks@gmail.com Signed-off-by: Guenter Roeck commit 0a42986b65776759490ac960910651c1e4634b17 Author: Sanman Pradhan Date: Sat Mar 7 14:45:19 2026 -0800 hwmon: (pmbus/max31785) fix argument type for i2c_smbus_write_byte_data wrapper The local wrapper max31785_i2c_write_byte_data() declares its data parameter as u16 but passes it directly to i2c_smbus_write_byte_data() which takes u8. Fix the type to match the underlying API. No functional change; all current callers pass values that fit in u8. Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260307224517.38316-2-sanman.p211993@gmail.com Signed-off-by: Guenter Roeck commit 69694e9622118e546a735affc311ac8e652111d6 Author: Tabrez Ahmed Date: Sat Mar 7 17:22:26 2026 +0530 hwmon: (ads7871) Fix incorrect error code in voltage_show The voltage_show() function returns -1 when the A/D conversion fails to complete within the polling loop. -1 maps to -EPERM (operation not permitted), which does not describe the actual failure. Replace this -1 error code with -ETIMEDOUT to better indicate the timeout condition to userspace. Drop the else block after return. Note: not runtime tested due to lack of hardware. Signed-off-by: Tabrez Ahmed Link: https://lore.kernel.org/r/20260307115226.25757-1-tabreztalks@gmail.com Signed-off-by: Guenter Roeck commit 4cd4489493531fce9046a135c6b99ce1abdb9053 Author: Tabrez Ahmed Date: Sat Mar 7 14:08:15 2026 +0530 hwmon: (ads7871) Replace sprintf() with sysfs_emit() Use sysfs_emit() instead of sprintf() in the sysfs show function voltage_show() to comply with the preferred kernel interface for writing to sysfs buffers, which ensures PAGE_SIZE buffer limits are respected. No functional change intended. Note: Not runtime tested due to lack of hardware. Signed-off-by: Tabrez Ahmed Link: https://lore.kernel.org/r/20260307083815.12095-1-tabreztalks@gmail.com Signed-off-by: Guenter Roeck commit 9828c651c62525e20afb73d35cd89869e561145a Author: Andrew Davis Date: Fri Mar 6 11:16:52 2026 -0600 hwmon: (pmbus/max16601) Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This can instead be done with i2c_client_get_device_id(). For this driver functionality should not change. Switch over to remove the last couple users of the i2c_match_id() function from kernel. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260306171652.951274-12-afd@ti.com Signed-off-by: Guenter Roeck commit 7e9d6299a2a952636af23cd8e9c8118f2e5efc22 Author: Andrew Davis Date: Fri Mar 6 11:16:51 2026 -0600 hwmon: (pmbus/ltc2978) Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This can instead be done with i2c_client_get_device_id(). For this driver functionality should not change. Switch over to remove the last couple users of the i2c_match_id() function from kernel. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260306171652.951274-11-afd@ti.com Signed-off-by: Guenter Roeck commit 6f0a5e6d52234043ffd01324cae1d5da87607b5b Author: Andrew Davis Date: Fri Mar 6 11:16:50 2026 -0600 hwmon: (pmbus/fsp-3y) Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This can be done instead with i2c_client_get_device_id() which doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to move the i2c_device_id table down to its more natural spot with the other module info. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260306171652.951274-10-afd@ti.com Signed-off-by: Guenter Roeck commit 8ec910b1709ced46188c12afc9fd2ef6634d6245 Author: Andrew Davis Date: Fri Mar 6 11:16:49 2026 -0600 hwmon: (pmbus/tps53679) Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has another benefit: * It also checks for device match data, which means we do not have to manually check that first. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260306171652.951274-9-afd@ti.com Signed-off-by: Guenter Roeck commit 1ca93dd91b5072301d9f9dada7b2057178d8c738 Author: Andrew Davis Date: Fri Mar 6 11:16:48 2026 -0600 hwmon: (pmbus/q54sj108a2) Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has another benefit: * It also checks for device match data, which means we do not have to manually check that first. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260306171652.951274-8-afd@ti.com Signed-off-by: Guenter Roeck commit 241662082bc554fe9500d1258d70064d4a008905 Author: Andrew Davis Date: Fri Mar 6 11:16:47 2026 -0600 hwmon: (pmbus) Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has another benefit: * It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove that. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260306171652.951274-7-afd@ti.com Signed-off-by: Guenter Roeck commit 6235e025343e3768c83e1a4a551589190b44916e Author: Andrew Davis Date: Fri Mar 6 11:16:46 2026 -0600 hwmon: (pmbus/max34440) Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has another benefit: * It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove that. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260306171652.951274-6-afd@ti.com Signed-off-by: Guenter Roeck commit 13bb2cbceccb3c0b1a254e894c50d96efcfdd906 Author: Andrew Davis Date: Fri Mar 6 11:16:45 2026 -0600 hwmon: (pmbus/max20730) Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has another benefit: * It also checks for device match data. That means we do not have to manually check that first. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260306171652.951274-5-afd@ti.com Signed-off-by: Guenter Roeck commit cfea13489052b164355f8da76fbd363992fb9752 Author: Andrew Davis Date: Fri Mar 6 11:16:44 2026 -0600 hwmon: (pmbus/isl68137) Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has a couple other benefits: * It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove that. * It also checks for device match data, which allows for OF and ACPI based probing. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260306171652.951274-4-afd@ti.com Signed-off-by: Guenter Roeck commit ea0c1194ffe89c9957bc9ca098a4d6bba14c7233 Author: Andrew Davis Date: Fri Mar 6 11:16:43 2026 -0600 hwmon: (pmbus/ibm-cffps) Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has another benefit: * It also checks for device match data, which allows for OF based probing. That means we do not have to manually check those first and can remove that check. As i2c_get_match_data() return NULL/0 on failure which also matches the enum for "cffps1", switch around the enum order so cffps_unknown is index 0 and existing behavior is preserved. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260306171652.951274-3-afd@ti.com Signed-off-by: Guenter Roeck commit 3ea44f8d76411c1f240062a16298668dd8907400 Author: Andrew Davis Date: Fri Mar 6 11:16:42 2026 -0600 hwmon: (pmbus/bel-pfe) Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has another benefit: * It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove that. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260306171652.951274-2-afd@ti.com Signed-off-by: Guenter Roeck commit ee175259073320139aa8b94ab1225d98e8c6bcfc Author: Rafael J. Wysocki Date: Wed Mar 4 19:26:52 2026 +0100 hwmon: (asus_atk0110) Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the asus_atk0110 ACPI driver to a platform one. After this change, the subordinate hwmon device will be registered under the platform device used for driver binding and messages will be printed relative to that device instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/3691136.iIbC2pHGDl@rafael.j.wysocki Signed-off-by: Guenter Roeck commit d0cf6a161f5c777e74f3d27020ec24a852dafcab Author: Nuno Sá Date: Wed Mar 4 10:17:48 2026 +0000 hwmon: (ltc4282) Add default rsense value Instead of failing probe when the "adi,rsense-nano-ohms" firmware property is not provided, default rsense to (NANO/MILLI), or 1 milli-Ohm. This allows the device to probe without requiring firmware properties, which might be useful for some high level testing. Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20260304-hwmon-ltc4282-minor-improvs-v1-2-344622924d3a@analog.com [groeck: Clarify that the default is 1 milli-Ohm. No functional change.] Signed-off-by: Guenter Roeck commit d782715ae7103bb0627093444dcbc01db6878e37 Author: Nuno Sá Date: Wed Mar 4 10:17:47 2026 +0000 docs: hwmon: ltc4282: Fix scanned addresses The LTC4282 driver does not implement an I2C .detect() callback, meaning no I2C address scanning is performed. Update the documentation to reflect this by replacing the listed I2C address ranges with "-". Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20260304-hwmon-ltc4282-minor-improvs-v1-1-344622924d3a@analog.com Signed-off-by: Guenter Roeck commit a105ba85246f124e2a0b00c75c420bc4ece66620 Author: Bartosz Golaszewski Date: Wed Mar 4 10:02:30 2026 +0100 hwmon: (gpio-fan) Drop unneeded dependency on OF_GPIO OF_GPIO is selected automatically on all OF systems. Any symbols it controls also provide stubs so there's really no reason to select it explicitly. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20260304-gpio-of-kconfig-v1-9-d597916e79e7@oss.qualcomm.com Signed-off-by: Guenter Roeck commit 987bf9bd9d6ceb2f6e6f73414e35cd573999fc3d Author: Amay Agarwal Date: Tue Mar 3 20:54:56 2026 +0530 hwmon: (emc1403) Replace sprintf() with sysfs_emit() Replace sprintf() with sysfs_emit() when writing to sysfs buffers. sysfs_emit() performs proper bounds checking and is the preferred helper for sysfs output. No functional change intended. Signed-off-by: Amay Agarwal Link: https://lore.kernel.org/r/20260303152456.35763-6-tt@turingtested.xyz Signed-off-by: Guenter Roeck commit c9d468ba1bf222e61f886b46748696cd940e43a4 Author: Amay Agarwal Date: Tue Mar 3 20:54:55 2026 +0530 hwmon: (max6650) Replace sprintf() with sysfs_emit() Replace sprintf() with sysfs_emit() when writing to sysfs buffers. sysfs_emit() performs proper bounds checking and is the preferred helper for sysfs output. No functional change intended. Signed-off-by: Amay Agarwal Link: https://lore.kernel.org/r/20260303152456.35763-5-tt@turingtested.xyz Signed-off-by: Guenter Roeck commit 5de81d9b9ff6a26f3f7e75f0aa93b26cc81acd86 Author: Amay Agarwal Date: Tue Mar 3 20:54:54 2026 +0530 hwmon: (ads7828) Replace sprintf() with sysfs_emit() Replace sprintf() with sysfs_emit() when writing to sysfs buffers. sysfs_emit() performs proper bounds checking and is the preferred helper for sysfs output. No functional change intended. Signed-off-by: Amay Agarwal Link: https://lore.kernel.org/r/20260303152456.35763-4-tt@turingtested.xyz [groeck: Fixed continuation line alignment] Signed-off-by: Guenter Roeck commit aeb651cc95e83ccf129ba9151dd22101619dea1e Author: Amay Agarwal Date: Tue Mar 3 20:54:53 2026 +0530 hwmon: (max31722) Replace sprintf() with sysfs_emit() Replace sprintf() with sysfs_emit() when writing to sysfs buffers. sysfs_emit() performs proper bounds checking and is the preferred helper for sysfs output. No functional change intended. Signed-off-by: Amay Agarwal Link: https://lore.kernel.org/r/20260303152456.35763-3-tt@turingtested.xyz Signed-off-by: Guenter Roeck commit 8baa5fc554f342d35e679fdf6b375d0cbdc8c0b4 Author: Amay Agarwal Date: Tue Mar 3 20:54:52 2026 +0530 hwmon: (tc74) Replace sprintf() with sysfs_emit() Replace sprintf() with sysfs_emit() when writing to sysfs buffers. sysfs_emit() performs proper bounds checking and is the preferred helper for sysfs output. No functional change intended Signed-off-by: Amay Agarwal Link: https://lore.kernel.org/r/20260303152456.35763-2-tt@turingtested.xyz Signed-off-by: Guenter Roeck commit eeca1114d1e2cc0eacaebb80f3f2afbaebfc60be Author: Jonas Rebmann Date: Tue Mar 3 12:07:02 2026 +0100 hwmon: (ina2xx) Shift INA234 shunt and current registers The INA219 has the lowest three bits of the bus voltage register zero-reserved, the bus_voltage_shift ina2xx_config field was introduced to accommodate for that. The INA234 has four bits of the bus voltage, of the shunt voltage, and of the current registers zero-reserved but the latter two were implemented by choosing a 16x higher shunt_div instead of a separate field specifying a bit shift. This is possible because shunt voltage and current are divided by shunt_div, hence a 16x higher shunt_div results in a 16x smaller LSB for both the shunt voltage and the current register, perfectly accounting for the missing bit shift. For consistency and correctness, account for the reserved bits via shunt_voltage_shift and current_shift configuration fields as already done for voltage registers and use the conversion constants given in the INA234 datasheet. Signed-off-by: Jonas Rebmann Link: https://lore.kernel.org/r/20260303-ina234-shift-v1-2-318c33ac4480@pengutronix.de Signed-off-by: Guenter Roeck commit 932ca40b10e94923dc6447f8e9026838793fd188 Author: Jonas Rebmann Date: Tue Mar 3 12:07:01 2026 +0100 hwmon: (ina2xx) clean up unused define and outdated comment The list of supported chips in the header is incomplete and contains no other information not readily available. Remove the list and instead hint that the chips supported by this driver have 219/226 compatible register layout [unlike the ones supported by e.g. ina238]. Remove the unused INA226_DIE_ID define. Signed-off-by: Jonas Rebmann Link: https://lore.kernel.org/r/20260303-ina234-shift-v1-1-318c33ac4480@pengutronix.de [groeck: macro -> define in commit message] Signed-off-by: Guenter Roeck commit a28b088ede9df9fd9f5be6e54b4a7d9fc70d9f35 Author: Mariano Abad Date: Mon Mar 2 21:46:04 2026 -0300 hwmon: Add LattePanda Sigma EC driver Add hardware monitoring support for the LattePanda Sigma SBC (DFRobot, ITE IT8613E EC). The driver reads fan speed and temperatures via direct port I/O, as the BIOS disables the ACPI EC interface. Signed-off-by: Mariano Abad Signed-off-by: Guenter Roeck commit afc6c4aedea5717b7cb4a14b4bcc094892ea8d89 Author: Rafael J. Wysocki Date: Sun Mar 1 14:18:49 2026 +0100 hwmon: (acpi_power_meter) Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the hwmon ACPI power meter driver to a platform one. After this change, the subordinate hwmon device will be registered under the platform device representing the ACPI power meter, sysfs notifications will trigger on that device, and diagnostic messages will be printed relative to it instead of its ACPI companion. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/1952740.tdWV9SEqCh@rafael.j.wysocki Signed-off-by: Guenter Roeck commit a5445f75443dba37698f336c2b28daba606e86cf Author: Rafael J. Wysocki Date: Sun Mar 1 14:18:05 2026 +0100 hwmon: (acpi_power_meter) Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/2405555.ElGaqSPkdT@rafael.j.wysocki Signed-off-by: Guenter Roeck commit de19682f9ecbe02a5287060b59e83c3ded8f0a39 Author: Rafael J. Wysocki Date: Sun Mar 1 14:17:19 2026 +0100 hwmon: (acpi_power_meter) Drop redundant checks from three functions Since acpi_power_meter_notify() and acpi_power_meter_remove() are .notify() and .remove() callback functions of an ACPI driver, respectively, the first argument of the former and the only argument of the latter cannot be NULL. Likewise, the acpi_power_meter_resume() argument cannot be NULL because it is a system resume callback function. Moreover, since all of these functions can only run after acpi_power_meter_add() has returned 0, the driver_data field in the struct acpi_device object used by them cannot be NULL either. Accordingly, drop the redundant "device" checks against NULL from acpi_power_meter_notify() and acpi_power_meter_remove(), drop the redundant "dev" check against NULL from acpi_power_meter_resume(), and drop the redundant acpi_driver_data() checks against NULL from all of these functions. Additionally, combine the initialization of the "resource" local variable in acpi_power_meter_notify() and acpi_power_meter_remove() with its declaration. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/5085645.31r3eYUQgx@rafael.j.wysocki Signed-off-by: Guenter Roeck commit 0600919f8c25b31042281d1053ac9d88a2caf3fd Author: Flaviu Nistor Date: Wed Feb 25 11:51:32 2026 +0200 hwmon: tmp102: Add support for TMP110 and TMP113 devices TMP110 and TMP113 temperature sensors are software compatible with TMP102 sensor but have different accuracy (maximum error). Signed-off-by: Flaviu Nistor Link: https://lore.kernel.org/r/20260225095132.29954-1-flaviu.nistor@gmail.com Signed-off-by: Guenter Roeck commit 03f40ff2a0ab1a2df461e47771ad86e5da24bda8 Author: Volodimir Buchakchiyskiy Date: Sat Feb 28 12:44:02 2026 +0100 hwmon: (asus-ec-sensors) add ROG STRIX Z790-H GAMING WIFI Add limited support for ROG STRIX Z790-H GAMING WIFI (VRM temp and T_Sensor only). Signed-off-by: Volodimir Buchakchiyskiy Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20260228114412.358148-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 7b7ee707d61ff5a29af5270dd0505438c86e71e8 Author: Tomer Maimon Date: Sun Feb 15 18:35:53 2026 +0200 dt-bindings: hwmon: convert npcm750-pwm-fan to DT schema Convert the Nuvoton HWMON PWM and FAN controllers binding to schema format. Signed-off-by: Tomer Maimon Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260215163553.1334475-1-tmaimon77@gmail.com Signed-off-by: Guenter Roeck commit 34b66c7ed11c639a1efc02201e8c46382d5463ee Author: Ashish Yadav Date: Mon Feb 23 10:38:04 2026 +0530 hwmon:(pmbus/xdpe1a2g7b) Add support for xdpe1a2g5b/7b controllers Add the pmbus driver for Infineon Digital Multi-phase XDPE1A2G5B and XDPE1A2G7B controllers. Signed-off-by: Ashish Yadav Link: https://lore.kernel.org/r/20260223050804.4287-4-Ashish.Yadav@infineon.com Signed-off-by: Guenter Roeck commit 969a4ec86ca5fbd9952d5262b5a63ff434ccd63b Author: Ashish Yadav Date: Mon Feb 23 10:38:03 2026 +0530 hwmon: (pmbus/core) Add support for NVIDIA nvidia195mv mode Extend the PMBus core vrm_version handling to support NVIDIA nvidia195mv VID mode. This adds a new VRM/VID encoding type and the corresponding voltage conversion logic so devices reporting nvidia195mv can have their VOUT/VID values interpreted correctly by the hwmon PMBus core. Signed-off-by: Ashish Yadav Link: https://lore.kernel.org/r/20260223050804.4287-3-Ashish.Yadav@infineon.com Signed-off-by: Guenter Roeck commit 4c9d861b423b488312327728532b7ea7a2b8fb5c Author: Ashish Yadav Date: Mon Feb 23 10:38:02 2026 +0530 dt-bindings: trivial-devices: Add support for XDPE1A2G5B/7B Add Infineon Digital Multi-phase XDPE1A2G5B and XDPE1A2G7B Controllers to trivial devices. Signed-off-by: Ashish Yadav Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260223050804.4287-2-Ashish.Yadav@infineon.com Signed-off-by: Guenter Roeck commit f88aac547b628e28e75d0c8bed51c6773a34cc72 Author: Hao Yu Date: Tue Feb 24 01:38:53 2026 +0800 hwmon: (aht10) add device tree ID matching Add of_device_id table to allow the driver to be matched via Device Tree. This is required for supporting the AHT10/20/DHT20 sensors on platforms using DT. Signed-off-by: Hao Yu Link: https://lore.kernel.org/r/20260223173853.30617-3-haoyufine@gmail.com Signed-off-by: Guenter Roeck commit 9c9f86da4a03e2072be8c28cb3346563dc117a3f Author: Hao Yu Date: Tue Feb 24 01:38:52 2026 +0800 dt-bindings: hwmon: add Aosong AHT10/AHT20/DHT20 to trivial devices Add Aosong AHT10, AHT20 and DHT20 temperature and humidity sensors to the trivial-devices documentation. These sensors use a standard I2C interface and do not require complex binding definitions. Signed-off-by: Hao Yu Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260223173853.30617-2-haoyufine@gmail.com Signed-off-by: Guenter Roeck commit 88a928eebccdc5445d874ddcbf1683b76c9f1431 Author: Ian Ray Date: Fri Feb 20 13:20:22 2026 +0200 hwmon: (ina2xx) Add support for INA234 INA234 is register compatible to INA226 (excepting manufacturer and die or device id registers) but has different scaling. Signed-off-by: Ian Ray Reviewed-by: Bence Csókás # v2 Tested-by: Jens Almer Tested-by: Jonas Rebmann Link: https://lore.kernel.org/r/20260220112024.97446-4-ian.ray@gehealthcare.com Signed-off-by: Guenter Roeck commit f6e14b5bcabf4ee97a2d535c3c2d7e72c8da4c15 Author: Ian Ray Date: Fri Feb 20 13:20:21 2026 +0200 hwmon: (ina2xx) Make it easier to add more devices * Make sysfs entries documentation easier to maintain. * Use multi-line enum. * Correct "has_power_average" comment. Create a new "has_update_interval" member for chips which support averaging. Signed-off-by: Ian Ray Reviewed-by: Bence Csókás # v2 Tested-by: Jens Almer Link: https://lore.kernel.org/r/20260220112024.97446-3-ian.ray@gehealthcare.com Signed-off-by: Guenter Roeck commit ddc3dea2e4248c6f4692c0e70fe96f9ff76aad0e Author: Ian Ray Date: Fri Feb 20 13:20:20 2026 +0200 dt-bindings: hwmon: ti,ina2xx: Add INA234 device Add a compatible string for the INA234 device, which is like INA226 but has different scaling. Note that the device tree compatible must be different since the driver uses the compatible to configure the scaling. Signed-off-by: Ian Ray Reviewed-by: Krzysztof Kozlowski # v1 Tested-by: Jens Almer Link: https://lore.kernel.org/r/20260220112024.97446-2-ian.ray@gehealthcare.com Signed-off-by: Guenter Roeck commit 4853b53264869e51378cad7bf1556d4e8049d445 Author: Antheas Kapenekakis Date: Fri Feb 20 17:16:01 2026 +0100 hwmon: (gpd-fan) Add GPD Win 5 The GPD Win 5 is a new device by GPD with an AMD AI MAX 385/395 chip. It uses the same fan control registers as the GPD Win Duo. This information was provided by GPD. Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20260220161601.2344291-1-lkml@antheas.dev Signed-off-by: Guenter Roeck commit 940c92c40ecaec1b2d417d924e8273cc480bf358 Author: Varasina Farmadani Date: Sun Feb 15 16:16:19 2026 +0100 hwmon: (asus-ec-sensors) add ROG STRIX X470-F GAMING Add support for ROG STRIX X470-F GAMING Signed-off-by: Varasina Farmadani Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20260215151743.20138-4-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit ab4b7071ae0a831e4c2fd45c626c3b1d66cc1201 Author: Timothy C. Sweeney-Fanelli Date: Sun Feb 15 16:16:18 2026 +0100 hwmon: (asus-ec-sensors )add ROG CROSSHAIR X670E EXTREME Add support for ROG CROSSHAIR X670E EXTREME Signed-off-by: Timothy C. Sweeney-Fanelli Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20260215151743.20138-3-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 7c3a3b29dea6f246aaf1d8cb369e7cbf48a49f3c Author: Andy Shevchenko Date: Fri Feb 20 15:35:00 2026 +0100 hwmon: (bt1-pvt) Remove not-going-to-be-supported code for Baikal SoC As noticed in the discussion [1] the Baikal SoC and platforms are not going to be finalized, hence remove stale code. Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1] Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20260220143500.2401057-1-andriy.shevchenko@linux.intel.com Signed-off-by: Guenter Roeck commit 625af11fb9885f202e028ea5afa0037f3014e376 Author: Geert Uytterhoeven Date: Wed Mar 4 18:11:02 2026 +0100 arm64: dts: intel: agilex5: Drop CPU masks from GICv3 PPI interrupts Unlike older GIC variants, the GICv3 DT bindings do not support specifying a CPU mask in PPI interrupt specifiers. Drop the masks. Signed-off-by: Geert Uytterhoeven Signed-off-by: Dinh Nguyen commit bb5f66f36bebb3404307a737973a573c0c05f98a Author: Dinh Nguyen Date: Wed Feb 25 23:21:45 2026 -0600 dt-bindings: intel: Add Agilex5 SoCFPGA modular board Add compatible for Agilex5 SoCFPGA modular board. Signed-off-by: Niravkumar L Rabara Acked-by: Krzysztof Kozlowski Signed-off-by: Dinh Nguyen commit 7fae6616704a17c64438ad4b73a6effa6c03ffda Author: Maciej W. Rozycki Date: Sun Mar 29 13:32:25 2026 +0100 FDDI: defxx: Rate-limit memory allocation errors Prevent the system from becoming unstable or unusable due to a flood of memory allocation error messages under memory pressure, e.g.: [...] fddi0: Could not allocate receive buffer. Dropping packet. fddi0: Could not allocate receive buffer. Dropping packet. fddi0: Could not allocate receive buffer. Dropping packet. fddi0: Could not allocate receive buffer. Dropping packet. rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-...!: (332 ticks this GP) idle=255c/1/0x40000000 softirq=16420123/16420123 fqs=0 rcu: (t=2103 jiffies g=35680089 q=4 ncpus=1) rcu: rcu_sched kthread timer wakeup didn't happen for 2102 jiffies! g35680089 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 rcu: Possible timer handling issue on cpu=0 timer-softirq=12779658 rcu: rcu_sched kthread starved for 2103 jiffies! g35680089 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0 rcu: Unless rcu_sched kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_sched state:I stack:0 pid:14 tgid:14 ppid:2 flags:0x00004000 Call Trace: __schedule+0x258/0x580 schedule+0x19/0xa0 schedule_timeout+0x4a/0xb0 ? hrtimers_cpu_dying+0x1b0/0x1b0 rcu_gp_fqs_loop+0xb1/0x450 rcu_gp_kthread+0x9d/0x130 kthread+0xb2/0xe0 ? rcu_gp_init+0x4a0/0x4a0 ? kthread_park+0x90/0x90 ret_from_fork+0x2d/0x50 ? kthread_park+0x90/0x90 ret_from_fork_asm+0x12/0x20 entry_INT80_32+0x10d/0x10d CPU: 0 UID: 500 PID: 21895 Comm: 31370.exe Not tainted 6.13.0-dirty #2 (here running the libstdc++-v3 testsuite). Signed-off-by: Maciej W. Rozycki Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/alpine.DEB.2.21.2603291236590.60268@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit f4ef5b1c13316fa518b7a41e6bff82c33239823c Author: Maciej W. Rozycki Date: Sun Mar 29 13:32:34 2026 +0100 FDDI: defza: Rate-limit memory allocation errors Prevent the system from becoming unstable or unusable due to a flood of memory allocation error messages under memory pressure. Signed-off-by: Maciej W. Rozycki Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/alpine.DEB.2.21.2603291252380.60268@angie.orcam.me.uk Signed-off-by: Jakub Kicinski commit 0fb03e7038e4f91d44776021ce301af8d4efe0ce Merge: 911e2c050963cc 7f9f3016600513 Author: Jakub Kicinski Date: Mon Mar 30 17:36:52 2026 -0700 Merge branch 'net-stmmac-qcom-ethqos-more-cleanups' Russell King says: ==================== net: stmmac: qcom-ethqos: more cleanups Further cleanups to qcom-ethqos, mainly concentrating on the RGMII code, making it clearer what the differences are for each speed, thus making the code more readable. I'm still not really happy with this. The speed specific configuration remains split between ethqos_fix_mac_speed_rgmii() and ethqos_rgmii_macro_init(), where the latter is only ever called from the former. So, I think further work is needed here - maybe it needs restructuring into the various componenet parts of the RGMII block? ==================== Link: https://patch.msgid.link/acZDEg9wdjhBTHlL@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7f9f301660051353282e579affcd40e7075ab223 Author: Russell King (Oracle) Date: Fri Mar 27 08:44:39 2026 +0000 net: stmmac: qcom-ethqos: move phase_shift to register update site Move the determination of the phase shift enable alongside the register update, and make "phase_shift" unsigned. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62o3-0000000E3DE-3Vf8@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 2d350a892aad3b3dfdcfc170e7681f4095808a0c Author: Russell King (Oracle) Date: Fri Mar 27 08:44:34 2026 +0000 net: stmmac: qcom-ethqos: correct prg_rclk_dly comment The comment for calculating the prg_rclk_dly value is incorrect as it omits the brackets around the divisor. Add the brackets to allow the reader to correctly evaluate the value. Validated with the values given in the driver. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62ny-0000000E3D8-38Yp@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 67343aa24e595ac2522d9f7e2daba7ec29f32926 Author: Russell King (Oracle) Date: Fri Mar 27 08:44:29 2026 +0000 net: stmmac: qcom-ethqos: move loopback decision next to reg update Move the loopback decision next to the register update, and make the local variable unsigned. As a result, there is now no need for the comment referring to the programming being later. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62nt-0000000E3D2-2fWk@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3df0e86f8f8d708a820f7844f1a5830839f78efd Author: Russell King (Oracle) Date: Fri Mar 27 08:44:24 2026 +0000 net: stmmac: qcom-ethqos: simplify prg_rclk_dly programming Rather than coding the entire register update twice with different values, use a local variable to specify the value and have one register update statement that uses this local variable. This results in neater code. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62no-0000000E3Cw-2EmH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 439a27f21ecc1c7c59d6e00c7c6b9be380f66a64 Author: Russell King (Oracle) Date: Fri Mar 27 08:44:19 2026 +0000 net: stmmac: qcom-ethqos: finally eliminate the switch Move the RCLK delay configuration out of the switch, which just leaves the RGMII_CONFIG_LOOPBACK_EN setting in all three paths. This makes it trivial to eliminate the switch. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62nj-0000000E3Cq-1lPL@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 432c8a9f5528e362cc42de46901f25373a3a9928 Author: Russell King (Oracle) Date: Fri Mar 27 08:44:14 2026 +0000 net: stmmac: qcom-ethqos: move RGMII_CONFIG2_RX_PROG_SWAP Move RGMII_CONFIG2_RX_PROG_SWAP out of the switch. 1G speed always sets this field. 100M and 10M sets it for has_emac_ge_3 devices, otherwise it is cleared. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62ne-0000000E3Ck-1Haf@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit dae1de3df3e17b98fe78c4b1ba26322b03cd9f46 Author: Russell King (Oracle) Date: Fri Mar 27 08:44:09 2026 +0000 net: stmmac: qcom-ethqos: move RGMII_CONFIG2_RSVD_CONFIG15 out All paths through the switch clear the RGMII_CONFIG2_RSVD_CONFIG15 field. move it out of the switch statement. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62nZ-0000000E3Ce-0lyP@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 8b19a91844203db70584a2e56ad97d117e2c0277 Author: Russell King (Oracle) Date: Fri Mar 27 08:44:04 2026 +0000 net: stmmac: qcom-ethqos: move 100M/10M speed programming Move the speed programming for 100M and 10M out of the switch. There is no programming done for 1G speed. It looks like there are two fields, 7:6 which are programemd to '1' to select a /2 divisor for 100M, and bits 16:8 which are programmed to '19' to select a /20 divisor. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62nU-0000000E3CX-0KF9@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit dd07f2f9149a885ea2d8d19f95439227ec558106 Author: Russell King (Oracle) Date: Fri Mar 27 08:43:58 2026 +0000 net: stmmac: qcom-ethqos: move two more RGMII_IO_MACRO_CONFIG2 out RGMII_CONFIG2_DATA_DIVIDE_CLK_SEL is always cleared, and RGMII_CONFIG2_TX_CLK_PHASE_SHIFT_EN is always updated with the phase shift in each path through the switch, so these are independent of the speed. Move them out. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62nO-0000000E3CR-445p@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 82d5fdc82a33bea93baec4795e835b016d2dc87e Author: Russell King (Oracle) Date: Fri Mar 27 08:43:53 2026 +0000 net: stmmac: qcom-ethqos: move 1G vs 100M/10M RGMII settings Move RGMII_CONFIG_BYPASS_TX_ID_EN, RGMII_CONFIG_POS_NEG_DATA_SEL and RGMII_CONFIG_PROG_SWAP. There are two states for these: one group for 1G, and the logical inversion for 100M and 10M. Move this out of the switch into an if-else clause. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62nJ-0000000E3CL-3YSr@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6be23c4c636acc08c691e2b7371f341b13de23f7 Author: Russell King (Oracle) Date: Fri Mar 27 08:43:48 2026 +0000 net: stmmac: qcom-ethqos: move RGMII_CONFIG_DDR_MODE RGMII_CONFIG_DDR_MODE is always set irrespective of the speed. Move this out of the switch. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62nE-0000000E3CF-331r@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 426ce4677e8101996d1ff230464ea696eba2d853 Author: Russell King (Oracle) Date: Fri Mar 27 08:43:43 2026 +0000 net: stmmac: qcom-ethqos: move detection of invalid RGMII speed Move detection of invalid RGMII speeds (which will never be triggered) before the switch() to allow register modifications that are common to all speeds to be moved out of the switch. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62n9-0000000E3C9-2Zkr@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e9ed46a0b129d743f6ca008101b055fdd2e5ea2e Author: Russell King (Oracle) Date: Fri Mar 27 08:43:38 2026 +0000 net: stmmac: qcom-ethqos: eliminate configure_func Since ethqos_fix_mac_speed() is called via a function pointer, and only indirects via the configure_func function pointer, eliminate this unnecessary indirection. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62n4-0000000E3C3-251S@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 673416fb5b410b536f45e738ac34e482efd94e81 Author: Russell King (Oracle) Date: Fri Mar 27 08:43:33 2026 +0000 net: stmmac: qcom-ethqos: pass ethqos to ethqos_pcs_set_inband() Rather than getting the stmmac_priv pointer in ethqos_configure_sgmii(), move it into ethqos_pcs_set_inband() and pass the struct qcom_ethqos pointer instead. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62mz-0000000E3Bx-1Xd8@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c3dd3b1e76e0ff20ce97e99bc8d1f3152eb177b9 Author: Russell King (Oracle) Date: Fri Mar 27 08:43:28 2026 +0000 net: stmmac: qcom-ethqos: remove ethqos_configure() ethqos_configure() does nothing more than indirect via ethqos->configure_func, and is only called from ethqos_fix_mac_speed() just below. Move the indirect call into ethqos_fix_mac_speed(). Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1w62mu-0000000E3Bq-15wa@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 4bc04eb90b7c76216bdbe00f48e36967abb8c7af Author: Ng Tze Yee Date: Mon Feb 23 22:01:55 2026 -0800 arm64: dts: socfpga: stratix10: Add emmc support The Stratix10 devkit supports a separate eMMC daughter card. The eMMC daughter card replaces the SDMMC slot that is on the default daughter card and thus requires a separate board dts file. Signed-off-by: Ng Tze Yee Signed-off-by: Dinh Nguyen commit ee0a4604858261114f05c40b081c8236f45478ef Author: Ng Tze Yee Date: Mon Feb 23 22:01:54 2026 -0800 dt-bindings: altera: Add fallback compatible for Stratix 10 SoCDK eMMC variant Stratix 10 devkit support a separate eMMC daughter card. Add compatible string for the Stratix 10 SoCDK eMMC daughter board with "altr,socfpga-stratix10-socdk" as a fallback, since this variant is based on the standard SoCDK board. Acked-by: Rob Herring (Arm) Acked-by: Krzysztof Kozlowski Signed-off-by: Ng Tze Yee Signed-off-by: Dinh Nguyen commit 4decd8f4ae06a6d82079186b6ad3fe51d4654a1d Author: Johan Hovold Date: Mon Mar 30 11:59:47 2026 +0200 Input: synaptics_usb - refactor endpoint lookup Use the common USB helper for looking up interrupt-in endpoints instead of open coding. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260330095948.1663141-4-johan@kernel.org Signed-off-by: Dmitry Torokhov commit 5bb3ab0daaabedb67b142835b6905bce126df6ec Author: Johan Hovold Date: Mon Mar 30 11:59:46 2026 +0200 Input: appletouch - refactor endpoint lookup Use the common USB helpers for looking up interrupt-in endpoints (and determining endpoint numbers) instead of open coding. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260330095948.1663141-3-johan@kernel.org Signed-off-by: Dmitry Torokhov commit a7675c1f1fa38c559f267b0452ae9d7a736fa743 Author: Johan Hovold Date: Mon Mar 30 11:59:45 2026 +0200 Input: keyspan-remote - refactor endpoint lookup Use the common USB helper for looking up interrupt-in endpoints instead of open coding. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260330095948.1663141-2-johan@kernel.org Signed-off-by: Dmitry Torokhov commit 911e2c050963ccf239faec6ae9dee0f5e8f1cc5c Author: Jan Hoffmann Date: Sun Mar 29 21:11:11 2026 +0200 net: sfp: add quirk for ZOERAX SFP-2.5G-T This is a 2.5G copper module which appears to be based on a Motorcomm YT8821 PHY. There doesn't seem to be a usable way to to access the PHY (I2C address 0x56 provides only read-only C22 access, and Rollball is also not working). The module does not report the correct extended compliance code for 2.5GBase-T, and instead claims to support SONET OC-48 and Fibre Channel: Identifier : 0x03 (SFP) Extended identifier : 0x04 (GBIC/SFP defined by 2-wire interface ID) Connector : 0x07 (LC) Transceiver codes : 0x00 0x01 0x00 0x00 0x40 0x40 0x04 0x00 0x00 Transceiver type : FC: Multimode, 50um (M5) Encoding : 0x05 (SONET Scrambled) BR Nominal : 2500MBd Despite this, the kernel still enables the correct 2500Base-X interface mode. However, for the module to actually work, it is also necessary to disable inband auto-negotiation. Enable the existing "sfp_quirk_oem_2_5g" for this module, which handles that and also sets the bit for 2500Base-T link mode. Signed-off-by: Jan Hoffmann Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260329191304.720160-1-jan@3e8.eu Signed-off-by: Jakub Kicinski commit 64c535db769e9ab917343d61045802e832d621ed Author: Jakub Kicinski Date: Sun Mar 29 11:04:28 2026 -0700 selftests/bpf: Test that dst is cleared on same-protocol encap Verify that bpf_skb_adjust_room() clears the routing dst even when the encap L3 protocol matches the original packet (e.g. IPIP). The dst selected for the inner packet is not valid for the encapsulated result; a stale dst could lead to misrouting. Signed-off-by: Jakub Kicinski Signed-off-by: Martin KaFai Lau Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20260329180428.2657785-2-kuba@kernel.org commit 555aa178f8d22261d71da74df6267e6e6e97f95a Author: Arnd Bergmann Date: Fri Mar 27 17:55:08 2026 +0100 vfio: unhide vdev->debug_root When debugfs is disabled, the hisilicon driver now fails to build: drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c: In function 'hisi_acc_vfio_debug_init': drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c:1671:62: error: 'struct vfio_device' has no member named 'debug_root' 1671 | vfio_dev_migration = debugfs_lookup("migration", vdev->debug_root); | ^~ The driver otherwise relies on dead-code elimination, but this reference fails. The single struct member is not going to make much of a difference for memory consumption, so just keep this visible unconditionally. Signed-off-by: Arnd Bergmann Fixes: b398f91779b8 ("hisi_acc_vfio_pci: register debugfs for hisilicon migration driver") Link: https://lore.kernel.org/r/20260327165521.3779707-1-arnd@kernel.org Signed-off-by: Alex Williamson commit 699f47e616fed11d5074e7bbee2f4f920028c4a2 Author: Jakub Kicinski Date: Sun Mar 29 11:04:27 2026 -0700 net: Clear the dst when performing encap / decap Commit ba9db6f907ac ("net: clear the dst when changing skb protocol") added dst clearing when a BPF program changes the skb protocol (e.g. IPv4 to IPv6). Since that was a fix we only cleared the dst when the L3 protocol actually changes to keep it minimal. As suggested during the discussion (see Link) encap or decap operation which wraps or unwraps a same-protocol header may also render the existing dst incorrect - even if that doesn't result in a crash, just the wrong route for the now-outermost IP dst. Make dropping dst unconditional for bpf_skb_change_proto() and all L3 encap / decap ops. Signed-off-by: Jakub Kicinski Signed-off-by: Martin KaFai Lau Reviewed-by: Willem de Bruijn Acked-by: Daniel Borkmann Link: https://lore.kernel.org/CANP3RGfRaYwve_xgxH6Tp2zenzKn2-DjZ9tg023WVzfdJF3p_w@mail.gmail.com Link: https://patch.msgid.link/20260329180428.2657785-1-kuba@kernel.org commit 7010f13acd3828056e50badb5138bf9ca21ddd8f Author: Julian Braha Date: Mon Mar 30 22:45:49 2026 +0100 PCI: Clean up dead code in Kconfig There is already an 'if PCI' condition wrapping several config options, e.g., PCI_DOMAINS and VGA_ARB, making the 'depends on PCI' statement for each of these a duplicate dependency (dead code). Leave the outer 'if PCI...endif' and remove the individual 'depends on PCI' statement from each option. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260330214549.16157-1-julianbraha@gmail.com commit 809b997a5ce945ab470f70c187048fe4f5df20bf Author: Linus Torvalds Date: Mon Mar 30 14:52:45 2026 -0700 x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache This finishes the work on these odd functions that were only implemented by a handful of architectures. The 'flushcache' function was only used from the iterator code, and let's make it do the same thing that the nontemporal version does: remove the two underscores and add the user address checking. Yes, yes, the user address checking is also done at iovec import time, but we have long since walked away from the old double-underscore thing where we try to avoid address checking overhead at access time, and these functions shouldn't be so special and old-fashioned. The arm64 version already did the address check, in fact, so there it's just a matter of renaming it. For powerpc and x86-64 we now do the proper user access boilerplate. Signed-off-by: Linus Torvalds commit 5de7bcaadf160c1716b20a263cf8f5b06f658959 Author: Linus Torvalds Date: Mon Mar 30 13:11:07 2026 -0700 x86: rename and clean up __copy_from_user_inatomic_nocache() Similarly to the previous commit, this renames the somewhat confusingly named function. But in this case, it was at least less confusing: the __copy_from_user_inatomic_nocache is indeed copying from user memory, and it is indeed ok to be used in an atomic context, so it will not warn about it. But the previous commit also removed the NTB mis-use of the __copy_from_user_inatomic_nocache() function, and as a result every call-site is now _actually_ doing a real user copy. That means that we can now do the proper user pointer verification too. End result: add proper address checking, remove the double underscores, and change the "nocache" to "nontemporal" to more accurately describe what this x86-only function actually does. It might be worth noting that only the target is non-temporal: the actual user accesses are normal memory accesses. Also worth noting is that non-x86 targets (and on older 32-bit x86 CPU's before XMM2 in the Pentium III) we end up just falling back on a regular user copy, so nothing can actually depend on the non-temporal semantics, but that has always been true. Signed-off-by: Linus Torvalds commit d187a86de793f84766ea40b9ade7ac60aabbb4fe Author: Linus Torvalds Date: Mon Mar 30 10:39:09 2026 -0700 x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal "start user space access" logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC and all) to do kernel copies without ever even caring about the exception handling, _just_ for the non-temporal destination. Rename it as a first small step to actually make it halfway sane, and change the prototype to be more normal: it doesn't take a user pointer unless the caller has done the proper conversion, and the argument size is the full size_t (it still won't actually copy more than 4GB in one go, but there's also no reason to silently truncate the size argument in the caller). Finally, use this now sanely named function in the NTB code, which mis-used a user copy version (with STAC/CLAC and all) of this interface despite it not actually being a user copy at all. Signed-off-by: Linus Torvalds commit 97970e7c694356e3386a10e3b936d61eafd06bce Author: Kuppuswamy Sathyanarayanan Date: Wed Mar 18 10:04:49 2026 -0700 PCI/DPC: Log AER error info for DPC/EDR uncorrectable errors aer_print_error() skips printing if ratelimit_print[i] is not set. In the native AER path, ratelimit_print is initialized by add_error_device() during source device discovery, and is set to 1 for fatal errors to bypass rate limiting since fatal errors should always be logged. The DPC/EDR path uses the DPC-capable port as the error source and reads its AER uncorrectable error status registers directly in dpc_get_aer_uncorrect_severity(). Since it does not go through add_error_device(), ratelimit_print[0] is left uninitialized and zero. As a result, aer_print_error() silently drops all AER error messages for DPC/EDR triggered events. Set ratelimit_print[0] to 1 to bypass rate limiting and always print AER logs for uncorrectable errors detected by the DPC port. Fixes: a57f2bfb4a58 ("PCI/AER: Ratelimit correctable and non-fatal error logging") Co-developed-by: Goudar Manjunath Ramanagouda Signed-off-by: Goudar Manjunath Ramanagouda Signed-off-by: Kuppuswamy Sathyanarayanan [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260318170449.2733581-1-sathyanarayanan.kuppuswamy@linux.intel.com commit f6225b546dfccfc322b18c0d757b7b9c767a1e27 Merge: a51973c5dff8a0 7aaa8047eafd0b Author: Dave Airlie Date: Tue Mar 31 07:47:05 2026 +1000 BackMerge tag 'v7.0-rc6' into drm-next Linux 7.0-rc6 Requested by a few people on irc to resolve conflicts in other tress. Signed-off-by: Dave Airlie commit 47e2a338222c902dc44f4f6e29eb236a68600ef4 Author: Li RongQing Date: Mon Mar 16 20:28:03 2026 -0400 PCI/sysfs: Suppress FW_BUG warning when NUMA node already matches The numa_node sysfs interface allows users to manually override a PCI device's NUMA node assignment. Currently, every write triggers a FW_BUG warning and taints the kernel, even when writing the same value that is already set. Check if the requested node is already assigned to the device. If it matches, return success immediately without tainting the kernel or printing a warning. Signed-off-by: Li RongQing Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260317002803.2353-1-lirongqing@baidu.com commit 9ceb17ccd15ea32f19c9066f5f1b340d8340bd0b Author: Julian Braha Date: Sun Mar 29 19:30:18 2026 +0100 ARM: omap2: dead code cleanup in kconfig for ARCH_OMAP4 The same kconfig 'select OMAP_INTERCONNECT' appears twice for ARCH_OMAP4. I propose removing the second instance, as it is effectively dead code. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha Link: https://patch.msgid.link/20260329183018.519560-1-julianbraha@gmail.com Signed-off-by: Kevin Hilman commit 7e74b606dd39c46d4378d6f6563f560a00ab8694 Author: Aaro Koskinen Date: Fri Mar 27 19:15:10 2026 +0200 ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX On OMAP16XX, the UART enable bit shifts are written instead of the actual bits. This breaks the boot when DEBUG_LL and earlyprintk is enabled; the UART gets disabled and some random bits get enabled. Fix that. Fixes: 34c86239b184 ("ARM: OMAP1: clock: Fix early UART rate issues") Signed-off-by: Aaro Koskinen Link: https://patch.msgid.link/aca7HnXZ-aCSJPW7@darkstar.musicnaut.iki.fi Signed-off-by: Kevin Hilman commit 8b3e8fa6d7bdab292447a43f70532db437d5d4f5 Author: Timur Kristóf Date: Sun Mar 29 18:03:06 2026 +0200 drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled UVD 4.2 doesn't work at all when DPM is disabled because the SMU is responsible for ungating it. So, Linux fails to boot with CIK GPUs when using the amdgpu.dpm=0 parameter. Fix this by returning -ENOENT from uvd_v4_2_early_init() when amdgpu_dpm isn't enabled. Note: amdgpu.dpm=0 is often suggested as a workaround for issues and is useful for debugging. Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts") Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 4724bc5b8d78c34b993594f9406135408ccb312a Author: Timur Kristóf Date: Sun Mar 29 18:03:05 2026 +0200 drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board On a specific Radeon R9 390X board, the GPU can "randomly" hang while gaming. Initially I thought this was a RADV bug and tried to work around this in Mesa: commit 8ea08747b86b ("radv: Mitigate GPU hang on Hawaii in Dota 2 and RotTR") However, I got some feedback from other users who are reporting that the above mitigation causes a significant performance regression for them, and they didn't experience the hang on their GPU in the first place. After some further investigation, it turns out that the problem is that the highest SCLK DPM level on this board isn't stable. Lowering SCLK to 1040 MHz (from 1070 MHz) works around the issue, and has a negligible impact on performance compared to the Mesa patch. (Note that increasing the voltage can also work around it, but we felt that lowering the SCLK is the safer option.) To solve the above issue, add an "sclk_cap" field to smu7_hwmgr and set this field for the affected board. The capped SCLK value correctly appears on the sysfs interface and shows up in GUI tools such as LACT. Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)") Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit baf28ec5795c077406d6f52b8ad39e614153bce6 Author: Timur Kristóf Date: Sun Mar 29 18:03:04 2026 +0200 drm/amd/pm/ci: Fill DW8 fields from SMC In ci_populate_dw8() we currently just read a value from the SMU and then throw it away. Instead of throwing away the value, we should use it to fill other fields in DW8 (like radeon). Otherwise the value of the other fiels is just cleared when we copy this data to the SMU later. Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)") Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 5facfd4c4c67e8500116ffec0d9da35d92b9c787 Author: Timur Kristóf Date: Sun Mar 29 18:03:03 2026 +0200 drm/amd/pm/ci: Clear EnabledForActivity field for memory levels Follow what radeon did and what amdgpu does for other GPUs with SMU7. Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)") Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit d784759c07924280f3c313f205fc48eb62d7cb71 Author: Timur Kristóf Date: Sun Mar 29 18:03:02 2026 +0200 drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 There is no AMD GPU with the ID 0x66B0, this looks like a typo. It should be 0x67B0 which is actually part of the PCI ID list, and should use the Hawaii XT powertune defaults according to the old radeon driver. Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)") Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 9f49e3d4cb86859a4e5fde3f2060ed4f09bddaed Author: Timur Kristóf Date: Sun Mar 29 18:03:01 2026 +0200 drm/amd/pm/smu7: Remove non-functional SMU7 voltage dependency on DAL It looks like this was written for an old version of DC (DAL) and was never adapted afterwards. This was non-functional because it relied on the "dal_power_level" field which was never assigned anywhere in the code base. Also, it was not implemented for CI ASICs. Now superseded by the newer voltage dependency on display clock table added by the previous commit, let's remove. Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 0138610c14130425be53423b35336561829965e0 Author: Timur Kristóf Date: Sun Mar 29 18:03:00 2026 +0200 drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock The DCE (display controller engine) requires a minimum voltage in order to function correctly, depending on which clock level it currently uses. Add a new table that contains display clock frequency levels and the corresponding required voltages. The clock frequency levels are taken from DC (and the old radeon driver's voltage dependency table for CI in cases where its values were lower). The voltage levels are taken from the following function: phm_initializa_dynamic_state_adjustment_rule_settings(). Furthermore, in case of CI, call smu7_patch_vddc() on the new table to account for leakage voltage (like in radeon). Use the display clock value from amd_pp_display_configuration to look up the voltage level needed by the DCE. Send the voltage to the SMU via the PPSMC_MSG_VddC_Request command. The previous implementation of this feature was non-functional because it relied on a "dal_power_level" field which was never assigned; and it was not at all implemented for CI ASICs. I verified this on a Radeon R9 M380 which previously booted to a black screen with DC enabled (default since Linux 6.19), but now works correctly. Fixes: 599a7e9fe1b6 ("drm/amd/powerplay: implement smu7 hwmgr to manager asics with smu ip version 7.") Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 9851f29cb06c09f7dad3867d8b0feec3fc71b6c8 Author: Timur Kristóf Date: Sun Mar 29 18:02:59 2026 +0200 drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs There are two known cases where MCLK DPM can causes issues: Radeon R9 M380 found in iMac computers from 2015. The SMU in this GPU just hangs as soon as we send it the PPSMC_MSG_MCLKDPM_Enable command, even when MCLK switching is disabled, and even when we only populate one MCLK DPM level. Apply workaround to all devices with the same subsystem ID. Radeon R7 260X due to old memory controller microcode. We only flash the MC ucode when it isn't set up by the VBIOS, therefore there is no way to make sure that it has the correct ucode version. I verified that this patch fixes the SMU hang on the R9 M380 which would previously fail to boot. This also fixes the UVD initialization error on that GPU which happened because the SMU couldn't ungate the UVD after it hung. Fixes: 86457c3b21cb ("drm/amd/powerplay: Add support for CI asics to hwmgr") Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 894f0d34d66cb47fe718fe2ae5c18729d22c5218 Author: Timur Kristóf Date: Sun Mar 29 18:02:58 2026 +0200 drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled When MCLK DPM is disabled for any reason, populate the MCLK table with the highest MCLK DPM level, so that the ASIC can use the highest possible memory clock to get good performance even when MCLK DPM is disabled. Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)") Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 6e39ba4e5a82aa5469b2ac517b74a71accb0540f Author: Pierre Gondois Date: Thu Mar 26 21:44:01 2026 +0100 cpufreq: Add boost_freq_req QoS request The Power Management Quality of Service (PM QoS) allows to aggregate constraints from multiple entities. It is currently used to manage the min/max frequency of a given policy. Frequency constraints can come for instance from: - Thermal framework: acpi_thermal_cpufreq_init() - Firmware: _PPC objects: acpi_processor_ppc_init() - User: by setting policyX/scaling_[min|max]_freq The minimum of the max frequency constraints is used to compute the resulting maximum allowed frequency. When enabling boost frequencies, the same frequency request object (policy->max_freq_req) as to handle requests from users is used. As a result, when setting: - scaling_max_freq - boost The last sysfs file used overwrites the request from the other sysfs file. To avoid this, create a per-policy boost_freq_req to save the boost constraints instead of overwriting the last scaling_max_freq constraint. policy_set_boost() calls the cpufreq set_boost callback. Update the newly added boost_freq_req request from there: - whenever boost is toggled - to cover all possible paths In the existing .set_boost() callbacks: - Don't update policy->max as this is done through the qos notifier cpufreq_notifier_max() which calls cpufreq_set_policy(). - Remove freq_qos_update_request() calls as the qos request is now done in policy_set_boost() and updates the new boost_freq_req $ ## Init state scaling_max_freq:1000000 cpuinfo_max_freq:1000000 $ echo 700000 > scaling_max_freq scaling_max_freq:700000 cpuinfo_max_freq:1000000 $ echo 1 > ../boost scaling_max_freq:1200000 cpuinfo_max_freq:1200000 $ echo 800000 > scaling_max_freq scaling_max_freq:800000 cpuinfo_max_freq:1200000 $ ## Final step: $ ## Without the patches: $ echo 0 > ../boost scaling_max_freq:1000000 cpuinfo_max_freq:1000000 $ ## With the patches: $ echo 0 > ../boost scaling_max_freq:800000 cpuinfo_max_freq:1000000 Note: cpufreq_frequency_table_cpuinfo() updates policy->min and max from: A. cpufreq_boost_set_sw() \-cpufreq_frequency_table_cpuinfo() B. cpufreq_policy_online() \-cpufreq_table_validate_and_sort() \-cpufreq_frequency_table_cpuinfo() Keep these updates as some drivers expect policy->min and max to be set through B. Reviewed-by: Lifeng Zheng Signed-off-by: Pierre Gondois Acked-by: Viresh Kumar Link: https://patch.msgid.link/20260326204404.1401849-3-pierre.gondois@arm.com Signed-off-by: Rafael J. Wysocki commit 04aa9d0726cc6a23b348498815a9722b42d27c91 Author: Pierre Gondois Date: Thu Mar 26 21:44:00 2026 +0100 cpufreq: Remove max_freq_req update for pre-existing policy policy->max_freq_req QoS constraint represents the maximal allowed frequency than can be requested. It is set by: - writing to policyX/scaling_max sysfs file - toggling the cpufreq/boost sysfs file Upon calling freq_qos_update_request(), a successful update of the max_freq_req value triggers cpufreq_notifier_max(), followed by cpufreq_set_policy() which update the requested frequency for the policy. If the new max_freq_req value is not different from the original value, no frequency update is triggered. In a specific sequence of toggling: - cpufreq/boost sysfs file - CPU hot-plugging a CPU could end up with boost enabled but running at the maximal non-boost frequency, cpufreq_notifier_max() not being triggered. The following fixed that: commit 1608f0230510 ("cpufreq: Fix re-boost issue after hotplugging a CPU") The following: commit dd016f379ebc ("cpufreq: Introduce a more generic way to set default per-policy boost flag") also fixed the issue by correctly setting the max_freq_req constraint of a policy that is re-activated. This makes the first fix unnecessary. As the original issue is fixed by another method, this patch reverts: commit 1608f0230510 ("cpufreq: Fix re-boost issue after hotplugging a CPU") Reviewed-by: Lifeng Zheng Signed-off-by: Pierre Gondois Acked-by: Viresh Kumar Link: https://patch.msgid.link/20260326204404.1401849-2-pierre.gondois@arm.com Signed-off-by: Rafael J. Wysocki commit 95c7d025cc8c3c6c41206e2a18332eb04878b7ef Author: Paul E. McKenney Date: Sat Mar 14 06:18:48 2026 -0700 rcutorture: Test call_srcu() with preemption disabled and not This commit tests invoking call_srcu() with preemption both enabled and disabled, via acquiring of pi lock. [ Joel: reword commit message. ] Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit ab875b3e179ff7ca2a982bc14f7fe810862c7594 Author: Gustavo Luiz Duarte Date: Tue Mar 17 17:41:17 2026 -0400 rcu: Add BOOTPARAM_RCU_STALL_PANIC Kconfig option Add a Kconfig option to set the default value of the kernel.panic_on_rcu_stall sysctl, allowing the kernel to be built with panic-on-RCU-stall enabled by default. This is useful for high-availability systems that require automatic recovery (via panic_timeout) when a CPU stall is detected, without needing userspace to configure the sysctl at boot. This follows the pattern established by BOOTPARAM_SOFTLOCKUP_PANIC and BOOTPARAM_HUNG_TASK_PANIC. The runtime sysctl can still override the Kconfig default. Reviewed-by: Paul E. McKenney Signed-off-by: Gustavo Luiz Duarte Signed-off-by: Joel Fernandes commit a18396219ba52b524d8b86bf9e2515b01c068614 Author: Paul E. McKenney Date: Wed Mar 4 15:40:39 2026 -0800 torture: Avoid modulo-zero error in torture_hrtimeout_ns() Currently, all calls to torture_hrtimeout_ns() either provide a non-zero fuzzt_ns or a NULL trsp, either of which avoids taking the modulus of a zero-valued fuzzt_ns. But this code should do a better job of defending itself, so this commit explicitly checks fuzzt_ns and avoids the modulus when its value is zero. Reviewed-by: Joel Fernandes Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit 2243517a5440caa635b945deb7915397ef39b29b Author: Joel Fernandes Date: Sat Jan 3 15:54:37 2026 -0500 rcu/nocb: Extract nocb_bypass_needs_flush() to reduce duplication The bypass flush decision logic is duplicated in rcu_nocb_try_bypass() and nocb_gp_wait() with similar conditions. This commit therefore extracts the functionality into a common helper function nocb_bypass_needs_flush() improving the code readability. A flush_faster parameter is added to controlling the flushing thresholds and timeouts. This design was in the original commit d1b222c6be1f ("rcu/nocb: Add bypass callback queueing") to avoid having the GP kthread aggressively flush the bypass queue. Reviewed-by: Frederic Weisbecker Signed-off-by: Joel Fernandes commit 18d01ff3b9812b785673689780bb3868c4c1e2fa Author: Joel Fernandes Date: Sat Jan 3 10:37:54 2026 -0500 rcu/nocb: Consolidate rcu_nocb_cpu_offload/deoffload functions The rcu_nocb_cpu_offload() and rcu_nocb_cpu_deoffload() functions are nearly duplicates. Therefore, extract the common logic into rcu_nocb_cpu_toggle_offload() which takes an 'offload' boolean, and make both exported functions simple wrappers. This eliminates a bunch of duplicate code at the call sites, namely mutex locking, CPU hotplug locking and CPU online checks. Reviewed-by: Frederic Weisbecker Signed-off-by: Joel Fernandes commit 3e3d7d8f3ad35deaf3f8150f66555ef54cf1754e Author: Zqiang Date: Mon Jan 5 09:19:51 2026 +0800 rcu-tasks: Remove unnecessary smp_store_release() in cblist_init_generic() The cblist_init_generic() is executed during the CPU early boot phase due to commit:30ef09635b9e ("rcu-tasks: Initialize callback lists at rcu_init() time"), at this time, only one boot CPU is online and the irq is disabled. this commit therefore use routine assignment replace of smp_store_release() and WRITE_ONCE() in the cblist_init_generic(). Signed-off-by: Zqiang Reviewed-by: Paul E. McKenney Reviewed-by: Frederic Weisbecker Signed-off-by: Joel Fernandes commit 6c3d9ad795a212ccfdfc0359524ab0d040c58757 Author: Joel Fernandes Date: Mon Jan 5 03:42:56 2026 -0500 rcutorture: Add NOCB02 config for nocb poll mode testing Add new rcutorture config NOCB02 that enables rcu_nocb_poll boot parameter combined with CONFIG_RCU_NOCB_CPU to exercise the polling mode code paths in the NOCB implementation. This config exercises poll-mode paths not covered by other configs, where callback invocation uses active polling instead of kthread wakeups. This config is not added to CFLIST to avoid increasing the default test duration; it can be run explicitly when poll-mode testing is needed. Acked-by: Frederic Weisbecker Reviewed-by: Paul E. McKenney Tested-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit 18a6770f1f9899d3ce2d54dba0bdaa5a7e2bdd24 Author: Joel Fernandes Date: Mon Jan 5 03:42:41 2026 -0500 rcutorture: Add NOCB01 config for RCU_LAZY torture testing Add new rcutorture config NOCB01 that enables CONFIG_RCU_LAZY combined with CONFIG_RCU_NOCB_CPU to exercise the lazy callback code paths in the NOCB implementation. This config exercises lazy callback paths not covered by other configs, including lazy-only wake and lazy defer logic. This config is not added to CFLIST to avoid increasing the default test duration; it can be run explicitly when lazy callback testing is needed. Acked-by: Frederic Weisbecker Reviewed-by: Paul E. McKenney Tested-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit ad6ef775cbefffd6c614dfc57429c364192b5de0 Author: Paul E. McKenney Date: Wed Jan 14 16:18:30 2026 -0800 rcu-tasks: Document that RCU Tasks Trace grace periods now imply RCU grace periods Now that RCU Tasks Trace is implemented in terms of SRCU-fast, the fact that each SRCU-fast grace period implies at least two RCU grace periods in turn means that each RCU Tasks Trace grace period implies at least two grace periods. This commit therefore updates the documentation accordingly. Reviewed-by: Frederic Weisbecker Reported-by: Alexei Starovoitov Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit 4968907016c2a54800a67273b92b3b66245bd372 Author: Paul E. McKenney Date: Tue Jan 6 10:28:10 2026 -0800 srcu: Fix s/they disables/they disable/ typo in srcu_read_unlock_fast() Typo fix in srcu_read_unlock_fast() header comment. Reported-by: Mathieu Desnoyers Signed-off-by: Paul E. McKenney Reviewed-by: Mathieu Desnoyers Signed-off-by: Joel Fernandes commit d978d3fc0488691f3b10919594d1d7d465fa568b Author: Paul E. McKenney Date: Tue Jan 27 15:24:24 2026 -0800 srcu: Fix SRCU read flavor macro comments The SRCU_READ_FLAVOR_FAST and SRCU_READ_FLAVOR_FAST_UPDOWN comments need repair. The former fails to not that SRCU-fast can be used in NMI handlers, and the latter says that it goes with srcu_read_lock_fast() when it really goes with srcu_read_lock_fast_updown(). This commit therefore fixes both comments. Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit 359cf5c942b8fce9cf2b7f3c1eb5b8186f0d9b30 Author: Paul E. McKenney Date: Sun Feb 8 19:03:30 2026 -0800 rcuscale: Ditch rcu_scale_shutdown in favor of torture_shutdown_init() The torture_shutdown_init() function spawns a shutdown kthread in a manner very similar to that implemented by rcu_scale_shutdown(). This commit therefore re-implements rcu_scale_shutdown() in terms of torture_shutdown_init(). This patch was generated by Claude given as input the patch making the same transformation of ref_scale_shutdown(). Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit b0c8dd5097aaa7bfc70c8933de6be0dcdc995592 Author: Paul E. McKenney Date: Thu Feb 5 13:43:32 2026 -0800 refscale: Ditch ref_scale_shutdown in favor of torture_shutdown_init() The torture_shutdown_init() function spawns a shutdown kthread in a manner very similar to that implemented by ref_scale_shutdown(). This commit therefore re-implements ref_scale_shutdown in terms of torture_shutdown_init(). The initial draft of this patch was generated by version 2.1.16 of the Claude AI/LLM, but trained and configured for use by my employer, and prompted to refer to Linux-kernel source code. This initial draft failed to provide a forward reference to ref_scale_cleanup(), passed zero to torture_shutdown_init() for an unwelcome insta-shutdown, and failed to pass the kvm.sh --duration argument in as a refscale module parameter. On the other hand, it did catch the need to NULL main_task on the post-test self-shutdown code path, which I might well have forgotten to do. This version of the patch fixes those problems, and in fact very little of the initial draft remains. Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit df6e6ae18fe776e1ae5dfa8e5104980df608912d Author: Paul E. McKenney Date: Wed Jan 28 12:42:24 2026 -0800 rcutorture: Fix numeric "test" comparison in srcu_lockdep.sh This commit switches from "-eq" to "=" to handle the non-numeric comparisons in srcu_lockdep.sh. While in the area, adjust SRCU flavor to improve coverage. Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit 6778178c3b07c926d8a9af515c5af73f6bdebacf Author: Paul E. McKenney Date: Mon Jan 26 17:50:48 2026 -0800 torture: Print informative message for test without recheck file If a type of torture test lacks a recheck file, a bash diagnostic is printed, which looks like a torture-test bug. This commit gets rid of this false positive by explicitly checking for the file, invoking it if it exists, otherwise printing an informative non-diagnostic message. Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit 08d5cade666dc4a0f8e9a43a738796a92336f276 Author: Paul E. McKenney Date: Mon Jan 19 20:33:48 2026 -0800 torture: Make hangs more visible in torture.sh output This commit labels "QEMU killed" lines so that they will be picked up by torture.sh processing. Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit 69642000bbc57c2e42708d7186b3ba0deca53f6d Author: Paul E. McKenney Date: Sun Dec 28 16:27:18 2025 -0800 kvm-check-branches.sh: Remove in favor of kvm-series.sh The kvm-series.sh script is an order-of-magnitude optimization of kvm-check-branches.sh, so remove the old script. Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes commit c6f4e552e1eae4a5726230254108213b085e1ae3 Author: Paul E. McKenney Date: Sat Nov 15 19:07:41 2025 -0800 rcutorture: Add a textbook-style trivial preemptible RCU This commit adds a trivial textbook implementation of preemptible RCU to rcutorture ("torture_type=trivial-preempt"), similar in spirit to the existing "torture_type=trivial" textbook implementation of non-preemptible RCU. Neither trivial RCU implementation has any value for production use, and are intended only to keep Paul honest in his introductory writings and presentations. [ paulmck: Apply kernel test robot feedback. ] Signed-off-by: Joel Fernandes commit d2a68aba8505ce88b39c34ecb3b707c776af79d4 Author: Eric Biggers Date: Fri Mar 27 15:42:29 2026 -0700 lib/crypto: tests: Migrate ChaCha20Poly1305 self-test to KUnit Move the ChaCha20Poly1305 test from an ad-hoc self-test to a KUnit test. Keep the same test logic for now, just translated to KUnit. Moving to KUnit has multiple benefits, such as: - Consistency with the rest of the lib/crypto/ tests. - Kernel developers familiar with KUnit, which is used kernel-wide, can quickly understand the test and how to enable and run it. - The test will be automatically run by anyone using lib/crypto/.kunitconfig or KUnit's all_tests.config. - Results are reported using the standard KUnit mechanism. - It eliminates one of the few remaining back-references to crypto/ from lib/crypto/, specifically a reference to CONFIG_CRYPTO_SELFTESTS. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260327224229.137532-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 23e5c306a207360bfda4f8e96a229dd5fde81cbd Author: Eric Biggers Date: Thu Mar 26 13:33:41 2026 -0700 lib/crypto: sparc: Drop optimized MD5 code MD5 is obsolete. Continuing to maintain architecture-optimized implementations of MD5 is unnecessary and risky. It diverts resources from the modern algorithms that are actually important. While there was demand for continuing to maintain the PowerPC optimized MD5 code to accommodate userspace programs that are misusing AF_ALG (https://lore.kernel.org/linux-crypto/c4191597-341d-4fd7-bc3d-13daf7666c41@csgroup.eu/), no such demand has been seen for the SPARC optimized MD5 code. Thus, let's drop it and focus effort on the more modern SHA algorithms, which already have optimized code for SPARC. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260326203341.60393-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 91cd9a03372be647fff09acab525c15e9c9b66f0 Author: Eric Biggers Date: Thu Mar 26 13:48:24 2026 -0700 lib/crypto: mips: Drop optimized MD5 code MD5 is obsolete. Continuing to maintain architecture-optimized implementations of MD5 is unnecessary and risky. It diverts resources from the modern algorithms that are actually important. While there was demand for continuing to maintain the PowerPC optimized MD5 code to accommodate userspace programs that are misusing AF_ALG (https://lore.kernel.org/linux-crypto/c4191597-341d-4fd7-bc3d-13daf7666c41@csgroup.eu/), no such demand has been seen for the MIPS Cavium Octeon optimized MD5 code. Note that this code runs on only one particular line of SoCs. Thus, let's drop it and focus effort on the more modern SHA algorithms, which already have optimized code for the same SoCs. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260326204824.62010-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1ab4a3c805084d752ec571efc78272295a9f2f74 Author: Lukas Wunner Date: Fri Mar 27 10:56:43 2026 +0100 PCI/AER: Stop ruling out unbound devices as error source When searching for the error source, the AER driver rules out devices whose enable_cnt is zero. This was introduced in 2009 by commit 28eb27cf0839 ("PCI AER: support invalid error source IDs") without providing a rationale. Drivers typically call pci_enable_device() on probe, hence the enable_cnt check essentially filters out unbound devices. At the time of the commit, drivers had to opt in to AER by calling pci_enable_pcie_error_reporting() and so any AER-enabled device could be assumed to be bound to a driver. The check thus made sense because it allowed skipping config space accesses to devices which were known not to be the error source. But since 2022, AER is universally enabled on all devices when they are enumerated, cf. commit f26e58bf6f54 ("PCI/AER: Enable error reporting when AER is native"). Errors may very well be reported by unbound devices, e.g. due to link instability. By ruling them out as error source, errors reported by them are neither logged nor cleared. When they do get bound and another error occurs, the earlier error is reported together with the new error, which may confuse users. Stop doing so. Fixes: f26e58bf6f54 ("PCI/AER: Enable error reporting when AER is native") Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Reviewed-by: Stefan Roese Cc: stable@vger.kernel.org # v6.0+ Link: https://patch.msgid.link/734338c2e8b669db5a5a3b45d34131b55ffebfca.1774605029.git.lukas@wunner.de commit 860fd1dd2d47d9d448e01ab39a9c4016cd068862 Author: Pierre-Eric Pelloux-Prayer Date: Tue Feb 3 11:22:12 2026 +0100 drm/amdgpu: use multiple entities in amdgpu_move_blit Thanks to "drm/ttm: rework pipelined eviction fence handling", ttm can deal correctly with moves and evictions being executed from different contexts. Signed-off-by: Pierre-Eric Pelloux-Prayer Acked-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher commit a3e14436304392fbada359edd0f1d1659850c9b7 Author: Donet Tom Date: Mon Mar 23 09:58:39 2026 +0530 drm/amdkfd: Fix queue preemption/eviction failures by aligning control stack size to GPU page size The control stack size is calculated based on the number of CUs and waves, and is then aligned to PAGE_SIZE. When the resulting control stack size is aligned to 64 KB, GPU hangs and queue preemption failures are observed while running RCCL unit tests on systems with more than two GPUs. amdgpu 0048:0f:00.0: amdgpu: Queue preemption failed for queue with doorbell_id: 80030008 amdgpu 0048:0f:00.0: amdgpu: Failed to evict process queues amdgpu 0048:0f:00.0: amdgpu: GPU reset begin!. Source: 4 amdgpu 0048:0f:00.0: amdgpu: Queue preemption failed for queue with doorbell_id: 80030008 amdgpu 0048:0f:00.0: amdgpu: Failed to evict process queues amdgpu 0048:0f:00.0: amdgpu: Failed to restore process queues This issue is observed on both 4 KB and 64 KB system page-size configurations. This patch fixes the issue by aligning the control stack size to AMDGPU_GPU_PAGE_SIZE instead of PAGE_SIZE, so the control stack size will not be 64 KB on systems with a 64 KB page size and queue preemption works correctly. Additionally, In the current code, wg_data_size is aligned to PAGE_SIZE, which can waste memory if the system page size is large. In this patch, wg_data_size is aligned to AMDGPU_GPU_PAGE_SIZE. The cwsr_size, calculated from wg_data_size and the control stack size, is aligned to PAGE_SIZE. Reviewed-by: Felix Kuehling Signed-off-by: Donet Tom Signed-off-by: Alex Deucher commit 6ab4054fda924dabc88e78b13c76043d55d257e0 Author: Pierre-Eric Pelloux-Prayer Date: Tue Feb 3 11:22:11 2026 +0100 drm/amdgpu: use TTM_NUM_MOVE_FENCES when reserving fences Use TTM_NUM_MOVE_FENCES as an upperbound of how many fences ttm might need to deal with moves/evictions. Signed-off-by: Pierre-Eric Pelloux-Prayer Acked-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher commit e2b0c863d3861c3c564d837ba60cd8765fe0163b Author: Pierre-Eric Pelloux-Prayer Date: Tue Feb 3 11:22:10 2026 +0100 drm/amdgpu: round robin through clear_entities in amdgpu_fill_buffer This makes clear of different BOs run in parallel. Partial jobs to clear a single BO still execute sequentially. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit ab5dd4dcc57effc8ab8b4185740a0e3441754f13 Author: Pierre-Eric Pelloux-Prayer Date: Tue Feb 3 11:22:09 2026 +0100 drm/amdgpu: allocate move entities dynamically No functional change for now, as we always allocate a single entity. Signed-off-by: Pierre-Eric Pelloux-Prayer Acked-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 0f1fbe746cf8bad0a5af9b62f17aad35193d44fc Author: Pierre-Eric Pelloux-Prayer Date: Tue Feb 3 11:22:08 2026 +0100 drm/amdgpu: allocate clear entities dynamically No functional change for now, as we always allocate a single entity and use it everywhere. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 4ea64d482fc2cc85009fce5abdf4780ece00c31c Author: Eric Huang Date: Fri Mar 27 09:46:42 2026 -0400 drm/amdkfd: fix kernel crash on releasing NULL sysfs entry there is an abnormal case that When a process re-opens kfd with different mm_struct(execve() called by user), the allocated p->kobj will be freed, but missed setting it to NULL, that will cause sysfs/kernel crash with NULL pointers in p->kobj on kfd_process_remove_sysfs() when releasing process, and the similar error on kfd_procfs_del_queue() as well. Signed-off-by: Eric Huang Reviewed-by: Kent Russell Signed-off-by: Alex Deucher commit 964e532d58378e6b942d2ba12fc3e25920fd4f80 Author: Lijo Lazar Date: Fri Mar 20 11:20:44 2026 +0530 drm/amd/pm: Unify version check in SMUv14 Use common helper function for firmware version check and logging in SMUv14 Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 754003486c3cc95f2fcb9d6b71a779047d6db95c Author: Ray Wu Date: Wed Dec 17 16:36:02 2025 +0800 drm/amd/display: Add Idle state manager(ISM) [Why] Rapid allow/disallow of idle optimization calls, whether it be IPS or self-refresh features, can end up using more power if actual time-in-idle is low. It can also spam DMUB command submission in a way that prevents it from servicing other requestors. [How] Introduce the Idle State Manager (ISM) to amdgpu. It maintains a finite state machine that uses a hysteresis to determine if a delay should be inserted between a caller allowing idle, and when the actual idle optimizations are programmed. A second timer is also introduced to enable static screen optimizations (SSO) such as PSR1 and Replay low HZ idle mode. Rapid SSO enable/disable can have a negative power impact on some low hz video playback, and can introduce user lag for PSR1 (due to up to 3 frames of sync latency). This effectively rate-limits idle optimizations, based on hysteresis. This also replaces the existing delay logic used for PSR1, allowing drm_vblank_crtc_config.disable_immediate = true, and thus allowing drm_crtc_vblank_restore(). v2: * Loosen criteria for ISM to exit idle optimizations; it failed to exit idle correctly on cursor updates when there are no drm_vblank requestors, * Document default_ism_config * Convert pr_debug to trace events to reduce overhead on frequent codepaths * checkpatch.pl fixes Link: https://gitlab.freedesktop.org/drm/amd/-/issues/4527 Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3709 Fixes: 58a261bfc967 ("drm/amd/display: use a more lax vblank enable policy for older ASICs") Signed-off-by: Ray Wu Signed-off-by: Leo Li Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher commit a8006eb599bb6c47bd9cfb58fb7ff8caab77a572 Merge: d3d75c76768055 371f6a1d2a972f Author: Mark Brown Date: Mon Mar 30 20:14:01 2026 +0100 ASoC: amd: acp: update dmic_num logic for acp pdm dmic Vijendar Mukunda says: This patch series updates the dmic_num logic for acp pdm dmic and renames the dmic component name in acp soundwire legacy machine driver. commit 371f6a1d2a972f2d749b9fdff1a453904f43dfce Author: Vijendar Mukunda Date: Mon Mar 30 12:50:28 2026 +0530 ASoC: amd: acp-sdw-legacy: rename the dmic component name For acp pdm dmic use case, user space needs a reliable identifier to select the correct UCM configuration. Rename component string as acp-dmic to select the correct UCM configuration for acp pdm dmic. Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20260330072431.3512358-3-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 5902e1f3c501375797dcd7ca21b58e2c9abbe317 Author: Vijendar Mukunda Date: Mon Mar 30 12:50:27 2026 +0530 ASoC: amd: acp: update dmic_num logic for acp pdm dmic Currently there is no mechanism to read dmic_num in mach_params structure. In this scenario mach_params->dmic_num check always returns 0 which fails to add component string for dmic. Update the condition check with acp pdm dmic quirk check and pass the dmic_num as 1. Fixes: 2981d9b0789c ("ASoC: amd: acp: add soundwire machine driver for legacy stack") Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20260330072431.3512358-2-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit e4b1715a87ab1e9ef1aa1f6ea82889eafba4a119 Author: Srinivasan Shanmugam Date: Thu Mar 26 09:55:08 2026 +0530 drm/amdgpu/gfx11: Add Cleaner Shader Support for GFX11.5.4 The Cleaner Shader is responsible for clearing LDS, VGPRs and SGPRs between GPU workloads to enforce process isolation and avoid data leakage. The cleaner shader clears per-wave GPU state (LDS, VGPRs and SGPRs) between workloads, improving process isolation and preventing stale data from being observed by subsequent tasks. This reuses the existing cleaner shader used on GFX11.0.3 and enables it for GFX11.5.4 GPUs when firmware requirements are met. Cc: Muhammad Adam Cc: Mario Sopena-Novales Cc: Tom Wu Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 2fb4883b884a437d760bd7bdf7695a7e5a60bba3 Author: Lijo Lazar Date: Fri Mar 27 14:29:17 2026 +0530 drm/amdgpu: Fix wait after reset sequence in S4 For a mode-1 reset done at the end of S4 on PSPv11 dGPUs, only check if TOS is unloaded. Fixes: 32f73741d6ee ("drm/amdgpu: Wait for bootloader after PSPv11 reset") Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4853 Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 054695c0e236fd12a634b87c63d1ffa72ed59426 Author: Lang Yu Date: Thu Mar 26 21:38:58 2026 +0800 drm/amdkfd: Switch to dev_* printk stuff in kfd_int_process_v12_1.c dev_* printk stuff is multi-GPU friendly. Use dev_warn_ratelimited() for print_sq_intr_info_error() which is consistent with previous IPs. Use dev_dbg_ratelimited() for irrelevant node interrupt print to avoid too much noise. Signed-off-by: Lang Yu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 353f200825051920ac81dcba2d4d5ccd1501acad Author: Lijo Lazar Date: Fri Mar 20 11:06:40 2026 +0530 drm/amd/pm: Unify version check in SMUv12 Use common helper function for firmware version check and logging in SMUv12. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 6b0a6116286ef25f7916e7affed9de246be80a81 Author: Lijo Lazar Date: Fri Mar 20 11:01:02 2026 +0530 drm/amd/pm: Unify version check in SMUv11 Use common helper function for firmware version check and logging in SMUv11 Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit c842980a2126f1e2a856aa0db8b090dd011cca74 Author: Taimur Hassan Date: Fri Mar 20 17:38:34 2026 -0500 drm/amd/display: Promote DC to 3.2.376 This version brings along following fixes: - correct unknown plane state patch - Revert "Refactor DC update checks" - Revert "Add 3DLUT DMA broadcast support" - Remove invalid DPSTREAMCLK mask usage - enable eDP DSC seamless boot support - Revert "Rework HDMI link training and YCbCr422 with DSC policy" - Disable PSR & Replay CRTC disable by default - Fix Silence Compiler Warnings - Add link output control for DPIA - eliminate clock manager code duplication - Don't set 4to1MPC config dynamically - Merge pipes for validate - Fix bounds checking in dml2_0 clock table array - Avoid turning off the PHY when OTG is running for DVI - Should support p-state under dcn21 - Enable Replay support for dcn42 - Remove check for DC_DMCUB_ENABLE on DCN42 Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 1b0f1459ab0b5816a2974b1ad33746bdfb333352 Author: Taimur Hassan Date: Fri Mar 20 16:24:47 2026 -0400 drm/amd/display: [FW Promotion] Release 0.1.53.0 [Why] dmu: Parse freesync mccs vcp code Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 3722df98c2e724121c40ea7ad59988262dbdb98f Author: Gaghik Khachatrian Date: Mon Mar 16 11:34:49 2026 -0400 drm/amd/display: Silence type conversion warnings in dml2 [Why] Compiler build generates type conversion warnings throughout dc/dml2_0 where values are implicitly narrowed (e.g. int/uint32_t/uint64_t assigned to uint8_t, unsigned char, char, bool, or dml_bool_t), cluttering build output and masking genuine issues. [How] Add explicit casts at each narrowing assignment with ASSERT guards to catch out-of-range values in debug builds: - uint8_t: otg_inst, num_planes, pipe_idx, vblank_index fields - unsigned char: pipe_dlg_param.otg_inst from tg->inst - char: mcache num_pipes from num_dpps_required - bool/dml_bool_t: INTERLACE bitfield and fams2 enable flag use != 0 - uint64_t: widen min_hardware_refresh_in_uhz to hold div64_u64 result, then cast to unsigned long for min_refresh_uhz with ASSERT Reviewed-by: Austin Zheng Signed-off-by: Gaghik Khachatrian Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit c3f327a9a306444cd91b904d7fcdba9406017390 Author: Gaghik Khachatrian Date: Sat Mar 7 18:37:04 2026 -0500 drm/amd/display: Fix Compiler warnings in dmub [Why] Resolve compiler warnings by marking unused parameters explicitly. [How] In .c and .h files, keep parameter names in signatures and add a line with`(void)param;` inside the function body Preserved function signatures and avoids breaking code paths that may reference the parameter under conditional compilation. Reviewed-by: Aric Cyr Signed-off-by: Gaghik Khachatrian Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit f82480fafedf622541276d48a3b4fed20ce5d866 Author: Gaghik Khachatrian Date: Mon Mar 9 17:18:25 2026 -0400 drm/amd/display: Fixed Silence complier warnings in dc [Why] Resolve compiler warnings by marking unused parameters explicitly. [How] In .c and .h function definitions, keep parameter names in signatures and add a line with `(void)param;` in function body Preserved function signatures and avoids breaking code paths that may reference the parameter under conditional compilation. Reviewed-by: Dillon Varone Reviewed-by: Austin Zheng Signed-off-by: Gaghik Khachatrian Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit d3d75c767680557f0bf8ca58c69ec490e9e248e2 Author: Rosen Penev Date: Wed Mar 25 19:30:53 2026 -0700 ASoC: SOF: topology: use kzalloc_flex Simplify allocation by using a flexible array member. Add __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260326023053.53493-1-rosenp@gmail.com Signed-off-by: Mark Brown commit 32c1c35b6d8bd8b7ea9ab3d1454b56b605f17dd1 Author: Rafal Ostrowski Date: Mon Feb 23 06:13:32 2026 +0100 drm/amd/display: Move FPU Guards From DML To DC - Part 3 [Why] FPU guards (DC_FP_START/DC_FP_END) are required to wrap around code that can manipulates floats. To do this properly, the FPU guards must be used in a file that is not compiled as a FPU unit. If the guards are used in a file that is a FPU unit, other sections in the file that aren't guarded may be end up being compiled to use FPU operations. [How] Added DC_FP_START and DC_FP_END to DC functions that call DML functions using FPU. Reviewed-by: Dillon Varone Signed-off-by: Rafal Ostrowski Signed-off-by: Alex Hung Signed-off-by: Alex Deucher commit aa173b70d3720afabd2ba333838339ca24bc40da Author: Cássio Gabriel Date: Fri Mar 27 14:16:27 2026 -0300 ASoC: generic: keep fallback dai_name stable across rebind simple_parse_dai() and graph_util_parse_dai() first try to identify a DAI via dai_args. When that works the card can rebind without relying on dlc->dai_name. The fallback path still calls snd_soc_get_dlc(), which returns a borrowed dai_name pointer. If the CPU or codec component is unbound while the sound card stays registered, the generic card keeps that pointer and the next rebind may compare stale memory while matching the DAI. Stage the fallback result in a temporary dai_link_component and move only a card-owned copy of dai_name into the live link component. Use devm_kstrdup_const() so static names are reused and dynamic ones remain valid for the lifetime of the card device. Suggested-by: Kuninori Morimoto Acked-by: Kuninori Morimoto Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260327-asoc-generic-fallback-dai-name-rebind-v3-1-c206e44f40c8@gmail.com Signed-off-by: Mark Brown commit 4bb2f0721ed8a2a70f864b9358bd6cd4d92199b3 Author: Rafal Ostrowski Date: Wed Feb 18 16:19:47 2026 +0100 drm/amd/display: Move FPU Guards From DML To DC - Part 2 [Why] FPU guards (DC_FP_START/DC_FP_END) are required to wrap around code that can manipulates floats. To do this properly, the FPU guards must be used in a file that is not compiled as a FPU unit. If the guards are used in a file that is a FPU unit, other sections in the file that aren't guarded may be end up being compiled to use FPU operations. [How] Removed DC_FP_START and DC_FP_END. Reviewed-by: Dillon Varone Signed-off-by: Rafal Ostrowski Signed-off-by: Alex Hung Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 3539437f354bd24c98928a80d4db3a23fa2a7b19 Author: Rafal Ostrowski Date: Tue Feb 24 15:36:09 2026 +0100 drm/amd/display: Move FPU Guards From DML To DC - Part 1 [Why] FPU guards (DC_FP_START/DC_FP_END) are required to wrap around code that can manipulates floats. To do this properly, the FPU guards must be used in a file that is not compiled as a FPU unit. If the guards are used in a file that is a FPU unit, other sections in the file that aren't guarded may be end up being compiled to use FPU operations. [How] Added DC_FP_START and DC_FP_END to DC functions that call DML functions using FPU. Reviewed-by: Dillon Varone Signed-off-by: Rafal Ostrowski Signed-off-by: Alex Hung Signed-off-by: Alex Deucher commit 02c3060ee303846cea79910738753735d39067d4 Author: Gangliang Xie Date: Wed Mar 18 16:09:39 2026 +0800 drm/amdgpu: add support to query vram info from firmware add support to query vram info from firmware v2: change APU vram type, add multi-aid check v3: seperate vram info query function into 3 parts and call them in a helper func when requirements are met. v4: calculate vram_width for v9.x Signed-off-by: Gangliang Xie Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 94555ca6d0bb41a7cb3c12ad2a7cacb6fdbdca0b Merge: 238aa43f0b77ea 090d34f0f02851 Author: Tejun Heo Date: Mon Mar 30 08:52:33 2026 -1000 Merge branch 'for-7.0-fixes' into for-7.1 Conflict in kernel/sched/ext.c init_sched_ext_class() between: 415cb193bb97 ("sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback") which adds cpus_to_sync cpumask allocation, and: 84b1a0ea0b7c ("sched_ext: Implement scx_bpf_dsq_reenq() for user DSQs") 8c1b9453fde6 ("sched_ext: Convert deferred_reenq_locals from llist to regular list") which add deferred_reenq init code at the same location. Both are independent additions. Include both. Signed-off-by: Tejun Heo commit 7b82e92da0d4fd686901edd9f649c51fcbcb9894 Author: Charlene Liu Date: Thu Mar 19 18:23:43 2026 -0400 drm/amd/display: correct unknown plane state patch [why] dcn42x is using same gfx as dcn35, i.e. not use gfx_address3. Reviewed-by: Ovidiu Bunea Signed-off-by: Charlene Liu Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 4e91f4322ebefc93a1f23d101595a45530d5de1f Author: Dillon Varone Date: Thu Mar 19 11:31:17 2026 -0400 Revert "drm/amd/display: Refactor DC update checks" Revert commit c24bb00cc6cf ("drm/amd/display: Refactor DC update checks") [WHY] Causing issues with PSR/Replay, reverting until those can be fixed. Reviewed-by: Martin Leung Signed-off-by: Dillon Varone Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 60c741a13fd17ae2ec668442bd5a0cc9dd73e261 Author: Dillon Varone Date: Thu Mar 19 11:28:19 2026 -0400 Revert "drm/amd/display: Add 3DLUT DMA broadcast support" Revert commit 7d59465de38e ("drm/amd/display: Add 3DLUT DMA broadcast support") [WHY&HOW] Dependencies of this change are still causing issues, so reverting until those can be fixed. Reviewed-by: Martin Leung Signed-off-by: Dillon Varone Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 8de2559ec172b04301d6e53c4f30388e40fad08c Author: Roman Li Date: Mon Mar 16 16:45:47 2026 -0400 drm/amd/display: Remove invalid DPSTREAMCLK mask usage [Why] The invalid register field access causes ASSERT(mask != 0) to fire in set_reg_field_values() during display enable. WARNING: at drivers/gpu/drm/amd/amdgpu/../display/dc/dc_helper.c:100 set_reg_field_values.isra.0+0xcf/0xf0 [amdgpu] Call Trace: generic_reg_update_ex+0x66/0x1d0 [amdgpu] dccg401_set_dpstreamclk+0xed/0x350 [amdgpu] dcn401_enable_stream+0x165/0x370 [amdgpu] link_set_dpms_on+0x6e9/0xe90 [amdgpu] dce110_apply_single_controller_ctx_to_hw+0x343/0x530 [amdgpu] dce110_apply_ctx_to_hw+0x1f6/0x2d0 [amdgpu] dc_commit_state_no_check+0x49a/0xe20 [amdgpu] dc_commit_streams+0x354/0x570 [amdgpu] amdgpu_dm_atomic_commit_tail+0x6f8/0x3fc0 [amdgpu] DCN4.x hardware does not have DPSTREAMCLK_GATE_DISABLE and DPSTREAMCLK_ROOT_GATE_DISABLE fields in DCCG_GATE_DISABLE_CNTL3. These global fields only exist in DCN3.1.x hardware. [How] Remove the call that tries to update non-existent fields in CNTL3. DCN4.x uses per-instance fields in CNTL5 instead, which are already correctly programmed in the switch cases above. Reviewed-by: Dillon Varone Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 0b577cd658510b1c2acbee6b089b2a94407cf3ff Author: Dillon Varone Date: Tue Mar 24 09:09:09 2026 +0800 drm/amd/display: using cm structure for lut3d related info [Why] Using the alternative implementation via cm structure of config lut3d data Reviewed-by: Austin Zheng Signed-off-by: Dillon Varone Signed-off-by: ChuanYu Tseng Signed-off-by: Alex Deucher commit add9aee8d889a7ffbff9d5ddbf1f5472a7cbfb82 Author: Mohit Bawa Date: Wed Nov 5 13:58:35 2025 -0500 drm/amd/display: enable eDP DSC seamless boot support [Why] VBIOS supports DSC for seamless boot on newer hardware. Reading hardware state allows proper DSC validation without breaking existing boot display. [What] Remove DSC block for boot timing validation and implement hardware state reading to populate DSC configuration from VBIOS-configured state. Enhance dsc_read_state function in DCN401 to read additional DSC parameters. Reviewed-by: Yihan Zhu Signed-off-by: Mohit Bawa Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 246808e7922056594311ad6ca11d31d2d8c27b01 Author: Relja Vojvodic Date: Tue Mar 17 16:47:07 2026 -0400 Revert "drm/amd/display: Rework YCbCr422 DSC policy" Revert commit 19b79e4f2182 ("drm/amd/display: Rework YCbCr422 DSC policy") Reason for Revert: This commit is causing compliance failures Reviewed-by: Wenjing Liu Signed-off-by: Relja Vojvodic Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 4d55784b9153f9463fed0be011b61d3e4265a4e4 Author: Ovidiu Bunea Date: Wed Mar 18 09:23:43 2026 -0400 drm/amd/dc: Disable PSR & Replay CRTC disable by default [why & how] Let IPS FSM handle OTG disable. Reviewed-by: Leo Chen Reviewed-by: Nicholas Kazlauskas Signed-off-by: Ovidiu Bunea Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 724cf8ae6353c47ef762efd1342f0eb447e16e61 Author: Clay King Date: Tue Mar 17 15:17:48 2026 -0400 drm/amd/display: Fixed silence signed/unsigned mismatch warnings Fix compiler warnings by consistently use the same signedness for a given value Reviewed-by: Joshua Aberback Signed-off-by: Clay King Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 096bff6706eb105954bb45f8e8f3e37f05d10d0e Author: Lincheng Ku Date: Wed Mar 18 03:58:35 2026 +0800 drm/amd/dc: Add link output control for DPIA [Why] To support specific sequencing requirements for DPIA link output [How] Implement the dpia_link_hwss structure and define the necessary control function pointers. The initialization order is aligned with the core link_hwss definition to ensure consistency Reviewed-by: Wenjing Liu Signed-off-by: Lincheng Ku Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 5efcf63aa63809b96b6d3230f1151b07e7f5120e Author: Clay King Date: Mon Mar 16 17:37:31 2026 -0400 drm/amd/display: Fix silence signed/unsigned mismatch warnings in dml [Why & How] Fix signed/unsigned mismatch warnings by using the same signedness for a given value Reviewed-by: Austin Zheng Signed-off-by: Clay King Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 26ebcac0566b78a9e6bfb71fb6b3436e0fe251a6 Author: Gaghik Khachatrian Date: Thu Mar 12 15:42:01 2026 -0400 drm/amd/display: Fix Silence signed/unsighed mismatch warning in dc [Why] Implicit signed-to-unsigned conversions caused compiler warnings in DC paths. [How] Added explicit (unsigned int)/(uint32_t) casts for sentinel -1 assignments and IRQ ~MASK initializers, with small cast alignment in logging/DPCD code. Functionality and behavior is unchanged; only type intent is explicit. Reviewed-by: Dillon Varone Signed-off-by: Gaghik Khachatrian Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 8424ee7d524965c2ce245d30f7c778763e8c6f54 Author: Gabe Teeger Date: Wed Mar 11 14:34:30 2026 -0400 drm/amd/display: eliminate clock manager code duplication [Why] Clock manager contained significant duplicate code between variants with identical logic for functions using only SMU calls or shared registers. This increases maintenance overhead and potential for bugs. [How] Expose clock constants and internal functions in header for sharing. Remove duplicate implementations and update function pointers to use shared functions. Refactor remaining variant-specific functions to use shared constants and helper functions. Add compatibility comments for hardware differences. Reviewed-by: Dmytro Laktyushkin Signed-off-by: Gabe Teeger Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit d77ff7331fc34ba84a70914b316a55056d94827d Author: Gaghik Khachatrian Date: Mon Mar 16 16:05:31 2026 -0400 drm/amd/display: Fix Silence Conversion Warnings in Dmub Fix Conversion that might result in a loss of data warnings in dmub/src/: - dmub_dcn20/31/32/35/42/60/401.c: Add ASSERT(value <= 0xFF) and explicit (uint8_t) cast when storing REG_GET results into uint8_t debug struct fields. Add != 0 for bool assignments from uint32_t bitfield reads. - dmub_reg.c: Cast va_arg shift value to uint8_t with ASSERT guard before passing to set_reg_field_value_masks(). - dmub_srv.c: Widen num_pending to uint64_t to match uint64_t arithmetic; use != 0 for bool assignments from unsigned expressions. No functional change intended. Reviewed-by: Dillon Varone Signed-off-by: Gaghik Khachatrian Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 4c3aeb11d504b68c63a1caeecf5517385e6e7bdb Author: Harry Wentland Date: Fri Jan 16 11:47:50 2026 -0500 drm/amd/display: Don't set 4to1MPC config dynamically We were previously modifying the global dc->config.enable_4to1MPC dynamically. These variables are meant as global configs, not to by dynamically modified. Modifying them dynamically prevents us from enabling/disabling functionality for debug purposes and can easily lead to bad things since we're not operating on the current state but on DC-wide variables. Instead we should look at the existing split4mpc decision in dcn20_validate_apply_split_flags and make the decision there, if the global config.enable_4to1MPC is set to true for the DCN version we're running. This fixes corruption that is observed when running a new IGT kms_colorop test for color-space-conversion that uses a YUV plane and outputs to a writeback connector. Co-developed by Claude Sonnet 4.5. Assisted-by: Claude:claude-sonnet-4.5 Reviewed-by: Nicholas Kazlauskas Signed-off-by: Harry Wentland Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 86117c5ab42f21562fedb0a64bffea3ee5fcd477 Author: Srinivasan Shanmugam Date: Sat Mar 21 17:25:14 2026 +0530 drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() dcn401_init_hw() assumes that update_bw_bounding_box() is valid when entering the update path. However, the existing condition: ((!fams2_enable && update_bw_bounding_box) || freq_changed) does not guarantee this, as the freq_changed branch can evaluate to true independently of the callback pointer. This can result in calling update_bw_bounding_box() when it is NULL. Fix this by separating the update condition from the pointer checks and ensuring the callback, dc->clk_mgr, and bw_params are validated before use. Fixes the below: ../dc/hwss/dcn401/dcn401_hwseq.c:367 dcn401_init_hw() error: we previously assumed 'dc->res_pool->funcs->update_bw_bounding_box' could be null (see line 362) Fixes: ca0fb243c3bb ("drm/amd/display: Underflow Seen on DCN401 eGPU") Cc: Daniel Sa Cc: Alvin Lee Cc: Roman Li Cc: Alex Hung Cc: Tom Chung Cc: Dan Carpenter Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 56e3ee721b33bdc4ce0765d370983aa4384f8a59 Author: Hans de Goede Date: Sat Mar 14 09:49:16 2026 +0100 driver core: Make deferred_probe_timeout default a Kconfig option Code using driver_deferred_probe_check_state() differs from most EPROBE_DEFER handling in the kernel. Where other EPROBE_DEFER handling (e.g. clks, gpios and regulators) waits indefinitely for suppliers to show up, code using driver_deferred_probe_check_state() will fail after the deferred_probe_timeout. This is a problem for generic distro kernels which want to support many boards using a single kernel build. These kernels want as much drivers to be modular as possible. The initrd also should be as small as possible, so the initrd will *not* have drivers not needing to get the rootfs. Combine this with waiting for a full-disk encryption password in the initrd and it is pretty much guaranteed that the default 10s timeout will be hit, causing probe() failures when drivers on the rootfs happen to get modprobe-d before other rootfs modules providing their suppliers. Make the default timeout configurable from Kconfig to allow distro kernel configs where many of the supplier drivers are modules to set the default through Kconfig. Reviewed-by: Saravana Kannan Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20260314084916.10868-1-johannes.goede@oss.qualcomm.com [ Drop deferred_probe_timeout documentation change in kernel-parameters.txt. - Danilo ] Signed-off-by: Danilo Krummrich commit 606f6b171326152ef08d0ef0ad49f52034edca07 Author: Harry Wentland Date: Fri Jan 16 11:48:11 2026 -0500 drm/amd/display: Merge pipes for validate Validation expects to operate on non-split pipes. This is seen in dcn20_fast_validate_bw, which merges pipes for validation. We weren't doing that in the non-fast path which lead to validation failures when operating with 4-to-1 MPC and a writeback connector. Co-developed by Claude Sonnet 4.5 Assisted-by: Claude:claude-sonnet-4.5 Reviewed-by: Nicholas Kazlauskas Signed-off-by: Harry Wentland Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit c34cb0d8247458ead7184547220dbc6d285fb4e3 Author: Srinivasan Shanmugam Date: Mon Mar 23 10:08:57 2026 +0530 drm/amd/display: Add update_descriptor param info in 'update_planes_and_stream_state' Add missing info for the update_descriptor parameter in update_planes_and_stream_state(). Fixes the below with gcc W=1: ../display/dc/core/dc.c:3630 function parameter 'update_descriptor' not described in 'update_planes_and_stream_state' Fixes: c24bb00cc6cf ("drm/amd/display: Refactor DC update checks") Cc: Nicholas Kazlauskas Cc: Dillon Varone Cc: Chuanyu Tseng Cc: Roman Li Cc: Alex Hung Cc: Tom Chung Cc: Dan Carpenter Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit fbe3a5743a4f34f57f25ab68d701d38d3b24ac3a Author: Srinivasan Shanmugam Date: Mon Mar 23 10:24:15 2026 +0530 drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct clk_mgr_construct() initializes display clock and memory bandwidth settings during driver bring-up. As part of this, the driver selects a watermark table based on the memory type (DDR4, LPDDR4, LPDDR5) from ctx->dc_bios->integrated_info. The display pipeline continuously reads pixel data from memory, processes it (such as scaling, color conversion, and blending), and sends it to the screen. To keep this pipeline running smoothly, the driver must ensure there is enough memory bandwidth and that clocks are increased when needed. Watermark tables define when the GPU should increase clocks to ensure there is enough bandwidth to feed pixel data without underflow. However, ctx->dc_bios->integrated_info is dereferenced without checking for NULL in multiple clk_mgr_construct() implementations. On some platforms, BIOS may not provide this information, and accessing it directly can cause a NULL pointer dereference during initialization. Fix this by adding a NULL check before accessing integrated_info. If integrated_info is not available, the driver safely falls back to default watermark tables. Fixes: ../dcn21/rn_clk_mgr.c:775 rn_clk_mgr_construct() warn: variable dereferenced before check 'ctx->dc_bios->integrated_info' (see line 743) ../dcn301/vg_clk_mgr.c:750 vg_clk_mgr_construct() warn: variable dereferenced before check 'ctx->dc_bios->integrated_info' (see line 736) ../dcn31/dcn31_clk_mgr.c:789 dcn31_clk_mgr_construct() warn: variable dereferenced before check 'ctx->dc_bios->integrated_info' (see line 728) ../dcn314/dcn314_clk_mgr.c:906 dcn314_clk_mgr_construct() warn: variable dereferenced before check 'ctx->dc_bios->integrated_info' (see line 845) ../dcn315/dcn315_clk_mgr.c:716 dcn315_clk_mgr_construct() warn: variable dereferenced before check 'ctx->dc_bios->integrated_info' (see line 655) ../dcn316/dcn316_clk_mgr.c:660 dcn316_clk_mgr_construct() warn: variable dereferenced before check 'ctx->dc_bios->integrated_info' (see line 639) ../dcn35/dcn35_clk_mgr.c:1540 dcn35_clk_mgr_construct() warn: variable dereferenced before check 'ctx->dc_bios->integrated_info' (see line 1467) Fixes: 25879d7b4986 ("drm/amd/display: Clean FPGA code in dc") Cc: Roman Li Cc: Alex Hung Cc: Tom Chung Cc: Dan Carpenter Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 18cc8cc30b71feaec4d80724917f91782987a4a7 Merge: b81f6310825081 7dcb79e5c03f2d Author: Mark Brown Date: Mon Mar 30 19:40:31 2026 +0100 ASoC: jz47xx: Convert to devm_clk_get_enabled() Jihed Chaibi says: The jz4725b, jz4760 and jz4770 Ingenic codec drivers all share the same clock management pattern: the clock is obtained with devm_clk_get() in the platform probe, then manually enabled in the component probe and disabled in the component remove. The clk_prepare_enable() call in the component probe is unchecked, meaning clock enable failures are silently ignored and can lead to register access on unpowered hardware. This series converts all three drivers to devm_clk_get_enabled(), which combines the get, prepare and enable steps and ties the clock lifetime to the device via devres. The now-redundant component remove callbacks and the struct clk pointers in the private structs are removed. commit 7dcb79e5c03f2df84f780469a10e92c6a126314f Author: Jihed Chaibi Date: Mon Mar 23 17:15:51 2026 +0100 ASoC: jz4770: Convert to devm_clk_get_enabled() The clock is obtained with devm_clk_get() in the platform probe, then manually enabled in the component probe and disabled in the component remove without checking the return value of clk_prepare_enable(). Use devm_clk_get_enabled() instead, which combines the get, prepare and enable operations into one call whose lifetime is tied to the device. This removes the need for explicit enable/disable in the component probe/remove callbacks, and ensures that clock enable failures are propagated as errors rather than silently ignored. Remove the now-unused struct clk pointer from struct jz_codec and drop the empty component remove callback. Signed-off-by: Jihed Chaibi Link: https://patch.msgid.link/20260323161551.47181-4-jihed.chaibi.dev@gmail.com Signed-off-by: Mark Brown commit 00df61cbc78ecad5b4bf8552eab5bbf4301bfc0d Author: Jihed Chaibi Date: Mon Mar 23 17:15:50 2026 +0100 ASoC: jz4760: Convert to devm_clk_get_enabled() The clock is obtained with devm_clk_get() in the platform probe, then manually enabled in the component probe and disabled in the component remove without checking the return value of clk_prepare_enable(). Use devm_clk_get_enabled() instead, which combines the get, prepare and enable operations into one call whose lifetime is tied to the device. This removes the need for explicit enable/disable in the component probe/remove callbacks, and ensures that clock enable failures are propagated as errors rather than silently ignored. Remove the now-unused struct clk pointer from struct jz_codec and drop the empty component remove callback. Signed-off-by: Jihed Chaibi Link: https://patch.msgid.link/20260323161551.47181-3-jihed.chaibi.dev@gmail.com Signed-off-by: Mark Brown commit 9644e7f83d4441eca392c7dacb37bc4b6e412660 Author: Jihed Chaibi Date: Mon Mar 23 17:15:49 2026 +0100 ASoC: jz4725b: Convert to devm_clk_get_enabled() The clock is obtained with devm_clk_get() in the platform probe, then manually enabled in the component probe and disabled in the component remove without checking the return value of clk_prepare_enable(). Use devm_clk_get_enabled() instead, which combines the get, prepare and enable operations into one call whose lifetime is tied to the device. This removes the need for explicit enable/disable in the component probe/remove callbacks, and ensures that clock enable failures are propagated as errors rather than silently ignored. Remove the now-unused struct clk pointer from struct jz_icdc and drop the empty component remove callback. Signed-off-by: Jihed Chaibi Link: https://patch.msgid.link/20260323161551.47181-2-jihed.chaibi.dev@gmail.com Signed-off-by: Mark Brown commit 4ae3e16f4b3bf64140f773629b765d605ee079a9 Author: Srinivasan Shanmugam Date: Mon Mar 23 13:02:09 2026 +0530 drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths In dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace(). Both functions check: if (!dc_dmub_srv || !dc_dmub_srv->dmub) and then call DC_LOG_ERROR() inside that block. DC_LOG_ERROR() uses dc_dmub_srv->ctx internally. So if dc_dmub_srv is NULL, the logging itself can dereference a NULL pointer and cause a crash. Fix this by splitting the checks. First check if dc_dmub_srv is NULL and return immediately. Then check dc_dmub_srv->dmub and log the error only when dc_dmub_srv is valid. Fixes the below: ../display/dc/dc_dmub_srv.c:962 dc_dmub_srv_log_diagnostic_data() error: we previously assumed 'dc_dmub_srv' could be null (see line 961) ../display/dc/dc_dmub_srv.c:1167 dc_dmub_srv_enable_dpia_trace() error: we previously assumed 'dc_dmub_srv' could be null (see line 1166) Fixes: 2631ac1ac328 ("drm/amd/display: add DMUB registers to crash dump diagnostic data.") Fixes: 71ba6b577a35 ("drm/amd/display: Add interface to enable DPIA trace") Cc: Roman Li Cc: Alex Hung Cc: Tom Chung Cc: Dan Carpenter Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 1f991ceb2c0bd37214387a645a1d3a260d423f7d Author: Gabe Teeger Date: Mon Mar 16 10:41:27 2026 -0400 drm/amd/display: Fix bounds checking in dml2_0 clock table array [Why] Multiple locations in dml2_0 used num_clk_values-1 as array index without checking if num_clk_values > 0. When num_clk_values is 0, this results in accessing array index -1, which wraps to 255 for unsigned types, causing out-of-bounds memory access and potential crashes. [How] Add proper bounds checking using ternary operators to guard all num_clk_values-1 array accesses. When num_clk_values is 0, return 0 as fallback value instead of accessing invalid memory. This prevents buffer overflows while maintaining backward compatibility and provides sensible default behavior for empty clock tables. Reviewed-by: Dillon Varone Signed-off-by: Gabe Teeger Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit ee212b0208a18831d2b537865da56708c17af90d Author: Nicholas Kazlauskas Date: Fri Mar 13 16:25:25 2026 -0400 drm/amd/display: Avoid turning off the PHY when OTG is running for DVI [Why] The OTG's virtual pixel clock source for DVI comes from the PHY. If the signal type is DVI then the OTG can become stuck on pre DCN401 ASIC when DPMS off occurs because the OTG remains running but the PHY transmitter is disabled. [How] There exists logic to keep track of the OTG running refcount on the link to determine if the link needs to go to PLL_EN instead of TX_EN but the logic only checks for HDMI TMDS on older ASIC. DVI is still a TMDS signal type so the constraint should also apply. Replace the checks for dc_is_hdmi_tmds_signal with dc_is_tmds_signal to cover both HDMI and DVI for the symclk refcount workaround. Reviewed-by: Dillon Varone Reviewed-by: Charlene Liu Signed-off-by: Nicholas Kazlauskas Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit a808615c2f6cf3d67b30414b6626f1d139029077 Author: Gaghik Khachatrian Date: Wed Mar 11 13:23:52 2026 -0400 drm/amd/display: Fix Compiler Warning - unused func parameters Handling unused function parameter due to cause compiler warning Reviewed-by: Clayton King Reviewed-by: Dillon Varone Signed-off-by: Gaghik Khachatrian Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit b96150a70696582e1e49dcdefb2d101c109610d7 Author: Wayne Lin Date: Thu Feb 5 15:36:18 2026 +0800 drm/amd/display: Should support p-state under dcn21 [Why] Under DCN21, observe flip_done timeout issue while running 3D benchmark under MPO case. Timeout is caused by driver fails validate_bandwidth() during atomic_commit_tail but passes atomic_check. Under further analysis, indicates the delta of atomic_check and atomic_commit_tail are dc->current_state->bw_ctx.dml.soc.sr_exit_time_us and dc->current_state->bw_ctx.dml.soc.sr_enter_plus_exit_time_us. We set validate_mode as DC_VALIDATE_MODE_ONLY while calling dc_validate_global_state() at atomic_check, but set mode as DC_VALIDATE_MODE_AND_PROGRAMMING during atomic_commit_tail. If dc_validate_mode set as DC_VALIDATE_MODE_ONLY, validate_bandwidth() will skip the wm and dlg calculation. During commit_tail, validate_bandwidth() is called with dc_validate_mode set as DC_VALIDATE_MODE_AND_PROGRAMMING and dc_state->bw_ctx.dml.soc.sr_exit_time_us might get modified after the wm_calculation and stored into dc->current_state. Which means dc->current_state->bw_ctx.dml.soc.sr_exit_time_us might not aligned with the one stored in dm_state->context. That causes duplicated dm_state->context not aligned with dc->current_state, and might have bandwidth validation pass in atomic_check and fail in commit_tail later. [How] When the issue occurs, it fails dml_get_voltage_level() with the condition dm_allow_self_refresh_and_mclk_switch but pass with the condition dm_allow_self_refresh. However, we should support p-state. So we should not pass validate_bandwidth by allowing self refresh only. Change the policy under DCN21. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Wayne Lin Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 06bc20d26f38dcb12cc8d92fa599a6b7fc58d2a3 Author: Roman Li Date: Fri Mar 20 17:02:33 2026 -0400 drm/amd/display: Enable Replay support for dcn42 Add DCN4.2 to the list that supports Panel Replay feature. Reviewed-by: Alex Hung Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit e6d5acad7112b5987afd1e583c84b14017c7ff4a Author: Gabe Teeger Date: Wed Dec 31 15:19:22 2025 -0500 drm/amd/display: Remove check for DC_DMCUB_ENABLE on DCN42 [why] DCN without DMCUB is not a supported configuration on DCN42. [how] Remove the DC_DMCUB_ENABLE fuse register check and remove the corresponding entries in the DCN42 DMUB register list. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Gabe Teeger Signed-off-by: Matthew Stewart Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 12fa1fd6dffff4eed15f1414eb7474127b2c5a24 Author: Pengpeng Hou Date: Tue Mar 24 16:51:30 2026 +0800 drm/amd/display: bios_parser: fix GPIO I2C line off-by-one get_gpio_i2c_info() computes the number of GPIO I2C assignment records present in the BIOS table and then uses bfI2C_LineMux as an array index into header->asGPIO_Info[]. The current check only rejects values strictly larger than the record count, so an index equal to count still falls through and reaches the fixed table one element past the end. Reject indices at or above the number of available records before using them as an array index. Signed-off-by: Pengpeng Hou Signed-off-by: Alex Deucher commit 31b8de5e55666f26ea7ece5f412b83eab3f56dbb Author: Donet Tom Date: Thu Mar 26 17:51:28 2026 +0530 drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB Currently, AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while KFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On systems with 4K pages, both values match (8KB), so allocation and reserved space are consistent. However, on 64K page-size systems, KFD_CWSR_TBA_TMA_SIZE becomes 128KB, while the reserved trap area remains 8KB. This mismatch causes the kernel to crash when running rocminfo or rccl unit tests. Kernel attempted to read user page (2) - exploit attempt? (uid: 1001) BUG: Kernel NULL pointer dereference on read at 0x00000002 Faulting instruction address: 0xc0000000002c8a64 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries CPU: 34 UID: 1001 PID: 9379 Comm: rocminfo Tainted: G E 6.19.0-rc4-amdgpu-00320-gf23176405700 #56 VOLUNTARY Tainted: [E]=UNSIGNED_MODULE Hardware name: IBM,9105-42A POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.30 (ML1060_896) hv:phyp pSeries NIP: c0000000002c8a64 LR: c00000000125dbc8 CTR: c00000000125e730 REGS: c0000001e0957580 TRAP: 0300 Tainted: G E MSR: 8000000000009033 CR: 24008268 XER: 00000036 CFAR: c00000000125dbc4 DAR: 0000000000000002 DSISR: 40000000 IRQMASK: 1 GPR00: c00000000125d908 c0000001e0957820 c0000000016e8100 c00000013d814540 GPR04: 0000000000000002 c00000013d814550 0000000000000045 0000000000000000 GPR08: c00000013444d000 c00000013d814538 c00000013d814538 0000000084002268 GPR12: c00000000125e730 c000007e2ffd5f00 ffffffffffffffff 0000000000020000 GPR16: 0000000000000000 0000000000000002 c00000015f653000 0000000000000000 GPR20: c000000138662400 c00000013d814540 0000000000000000 c00000013d814500 GPR24: 0000000000000000 0000000000000002 c0000001e0957888 c0000001e0957878 GPR28: c00000013d814548 0000000000000000 c00000013d814540 c0000001e0957888 NIP [c0000000002c8a64] __mutex_add_waiter+0x24/0xc0 LR [c00000000125dbc8] __mutex_lock.constprop.0+0x318/0xd00 Call Trace: 0xc0000001e0957890 (unreliable) __mutex_lock.constprop.0+0x58/0xd00 amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x6fc/0xb60 [amdgpu] kfd_process_alloc_gpuvm+0x54/0x1f0 [amdgpu] kfd_process_device_init_cwsr_dgpu+0xa4/0x1a0 [amdgpu] kfd_process_device_init_vm+0xd8/0x2e0 [amdgpu] kfd_ioctl_acquire_vm+0xd0/0x130 [amdgpu] kfd_ioctl+0x514/0x670 [amdgpu] sys_ioctl+0x134/0x180 system_call_exception+0x114/0x300 system_call_vectored_common+0x15c/0x2ec This patch changes AMDGPU_VA_RESERVED_TRAP_SIZE to 64 KB and KFD_CWSR_TBA_TMA_SIZE to the AMD GPU page size. This means we reserve 64 KB for the trap in the address space, but only allocate 8 KB within it. With this approach, the allocation size never exceeds the reserved area. Fixes: 34a1de0f7935 ("drm/amdkfd: Relocate TBA/TMA to opposite side of VM hole") Reviewed-by: Christian König Suggested-by: Felix Kuehling Suggested-by: Christian König Signed-off-by: Donet Tom Signed-off-by: Alex Deucher commit 4eaf5d2c31f9075171f5dfc3bed9b285a1810726 Author: Sunil Khatri Date: Thu Mar 26 13:39:05 2026 +0530 drm/amdgpu/userq: Fix the code alignment for readability Fix the code alignment for if condition and also provide a line space between multiline if condition and next statement. Signed-off-by: Sunil Khatri Acked-by: Christian König Signed-off-by: Alex Deucher commit 5c36fd7fc6a84f36bebbef72fe29bec0682a6589 Author: Gangliang Xie Date: Tue Mar 17 15:31:48 2026 +0800 drm/amdgpu: reset ras eeprom table when it is invalid reset ras eeprom table when it is invalid Signed-off-by: Gangliang Xie Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit b81f63108250818ed17fc7df9fdf9a7fb84f3f69 Author: Jihed Chaibi Date: Tue Mar 24 23:39:07 2026 +0100 ASoC: samsung: spdif: Convert to devm_ioremap_resource() Replace the open-coded request_mem_region() + ioremap() sequence with devm_ioremap_resource(), which handles both the region claim and mapping under devres lifetime management. This eliminates the manual iounmap() and release_mem_region() calls in the error path (err3/err4 labels) and in spdif_remove(), simplifying the probe error handling. Signed-off-by: Jihed Chaibi Link: https://patch.msgid.link/20260324223907.98897-1-jihed.chaibi.dev@gmail.com Signed-off-by: Mark Brown commit 27f5ff9e4a4150d7cf8b4085aedd3b77ddcc5d08 Author: Junrui Luo Date: Sat Mar 14 23:33:53 2026 +0800 drm/amdgpu/userq: fix memory leak in MQD creation error paths In mes_userq_mqd_create(), the memdup_user() allocations for IP-specific MQD structs are not freed when subsequent VA validation fails. The goto free_mqd label only cleans up the MQD BO object and userq_props. Fix by adding kfree() before each goto free_mqd on VA validation failure in the COMPUTE, GFX, and SDMA branches. Fixes: 9e46b8bb0539 ("drm/amdgpu: validate userq buffer virtual address and size") Reported-by: Yuhao Jiang Signed-off-by: Junrui Luo Reviewed-by: Prike Liang Signed-off-by: Alex Deucher commit 998d6781410de1c4b787fdbf6c56e851ea7fa553 Author: Donet Tom Date: Mon Mar 23 09:58:38 2026 +0530 drm/amd: Fix MQD and control stack alignment for non-4K For gfxV9, due to a hardware bug ("based on the comments in the code here [1]"), the control stack of a user-mode compute queue must be allocated immediately after the page boundary of its regular MQD buffer. To handle this, we allocate an enlarged MQD buffer where the first page is used as the MQD and the remaining pages store the control stack. Although these regions share the same BO, they require different memory types: the MQD must be UC (uncached), while the control stack must be NC (non-coherent), matching the behavior when the control stack is allocated in user space. This logic works correctly on systems where the CPU page size matches the GPU page size (4K). However, the current implementation aligns both the MQD and the control stack to the CPU PAGE_SIZE. On systems with a larger CPU page size, the entire first CPU page is marked UC—even though that page may contain multiple GPU pages. The GPU treats the second 4K GPU page inside that CPU page as part of the control stack, but it is incorrectly mapped as UC. This patch fixes the issue by aligning both the MQD and control stack sizes to the GPU page size (4K). The first 4K page is correctly marked as UC for the MQD, and the remaining GPU pages are marked NC for the control stack. This ensures proper memory type assignment on systems with larger CPU page sizes. [1]: https://elixir.bootlin.com/linux/v6.18/source/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c#L118 Acked-by: Felix Kuehling Signed-off-by: Donet Tom Signed-off-by: Alex Deucher commit b01cd158a2f5230b137396c5f8cda3fc780abbc2 Author: Donet Tom Date: Mon Mar 23 09:58:35 2026 +0530 drm/amdkfd: Align expected_queue_size to PAGE_SIZE The AQL queue size can be 4K, but the minimum buffer object (BO) allocation size is PAGE_SIZE. On systems with a page size larger than 4K, the expected queue size does not match the allocated BO size, causing queue creation to fail. Align the expected queue size to PAGE_SIZE so that it matches the allocated BO size and allows queue creation to succeed. Reviewed-by: Felix Kuehling Signed-off-by: Donet Tom Signed-off-by: Alex Deucher commit 3cfe23b6b04515b07b61c48f8b769c13d5439c9b Author: Asad Kamal Date: Wed Mar 25 17:20:41 2026 +0800 drm/amd/pm: Use str_enabled_disabled in amdgpu_pm sysfs Coccinelle flags hand-rolled "enabled"/"disabled" strings; use the shared str_enabled_disabled() helper from string_choices.h for npm_status and thermal throttling logging sysfs text. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603251434.zIN2QYWn-lkp@intel.com/ Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit ea56aa2625708eaf96f310032391ff37746310ef Author: Prike Liang Date: Mon Mar 23 16:07:02 2026 +0800 drm/amdgpu: fix the idr allocation flags Fix the IDR allocation flags by using atomic GFP flags in non‑sleepable contexts to avoid the __might_sleep() complaint. 268.290239] [drm] Initialized amdgpu 3.64.0 for 0000:03:00.0 on minor 0 [ 268.294900] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:323 [ 268.295355] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1744, name: modprobe [ 268.295705] preempt_count: 1, expected: 0 [ 268.295886] RCU nest depth: 0, expected: 0 [ 268.296072] 2 locks held by modprobe/1744: [ 268.296077] #0: ffff8c3a44abd1b8 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xe4/0x210 [ 268.296100] #1: ffffffffc1a6ea78 (amdgpu_pasid_idr_lock){+.+.}-{3:3}, at: amdgpu_pasid_alloc+0x26/0xe0 [amdgpu] [ 268.296494] CPU: 12 UID: 0 PID: 1744 Comm: modprobe Tainted: G U OE 6.19.0-custom #16 PREEMPT(voluntary) [ 268.296498] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [ 268.296499] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 268.296501] Call Trace: Fixes: 8f1de51f49be ("drm/amdgpu: prevent immediate PASID reuse case") Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit bf89091035e38baf0bba277450f54904e134f113 Author: Jesse Zhang Date: Tue Mar 24 17:31:43 2026 +0800 drm/amdgpu: flush coredump work before HW teardown In amdgpu_device_fini_hw(), deferred coredump formatting work may still be pending when hardware and IP components are being torn down. Since the work may access device registers and memory that will be freed or powered off, it must be completed before proceeding. Add a flush_work() call for adev->coredump_work, guarded by CONFIG_DEV_COREDUMP, to ensure any pending coredump work finishes before the device enters the early IP fini stage. This avoids potential use-after-free or accessing hardware resources that are no longer available. Reviewed-by: Lijo Lazar Suggested-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 557fa5a453c9ccb49a22f30a7ad0545573d434b7 Author: Jesse Zhang Date: Tue Mar 24 15:28:59 2026 +0800 drm/amdgpu: guard atom_context in devcoredump VBIOS dump During GPU reset coredump generation, amdgpu_devcoredump_fw_info() unconditionally dereferences adev->mode_info.atom_context to print VBIOS fields. On reset/teardown paths this pointer can be NULL, causing a kernel page fault from the deferred coredump workqueue. Fix by checking ctx before printing VBIOS fields: if ctx is valid, print full VBIOS information as before; This prevents NULL-dereference crashes while preserving coredump output. Observed page fault log: [ 667.933329] RIP: 0010:amdgpu_devcoredump_format+0x780/0xc00 [amdgpu] [ 667.941517] amdgpu 0002:01:00.0: Dumping IP State [ 667.949660] Code: 8d 57 74 48 c7 c6 01 65 9f c2 48 8d 7d 98 e8 97 96 7a ff 49 8d 97 b4 00 00 00 48 c7 c6 18 65 9f c2 48 8d 7d 98 e8 80 96 7a ff <41> 8b 97 f4 00 00 00 48 c7 c6 2f 65 9f c2 48 8d 7d 98 e8 69 96 7a [ 667.949666] RSP: 0018:ffffc9002302bd50 EFLAGS: 00010246 [ 667.949673] RAX: 0000000000000000 RBX: ffff888110600000 RCX: 0000000000000000 [ 667.949676] RDX: 000000000000a9b5 RSI: 0000000000000405 RDI: 000000000000a999 [ 667.949680] RBP: ffffc9002302be00 R08: ffffffffc09c3084 R09: ffffffffc09c3085 [ 667.949684] R10: 0000000000000000 R11: 0000000000000004 R12: 00000000000048e0 [ 667.993908] amdgpu 0002:01:00.0: Dumping IP State Completed [ 667.994229] R13: 0000000000000025 R14: 000000000000000c R15: 0000000000000000 [ 667.994233] FS: 0000000000000000(0000) GS:ffff88c44c2c9000(0000) knlGS:0000000000000000 [ 668.000076] amdgpu 0002:01:00.0: [drm] AMDGPU device coredump file has been created [ 668.008025] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 668.008030] CR2: 00000000000000f4 CR3: 000000011195f001 CR4: 0000000000770ef0 [ 668.008035] PKRU: 55555554 [ 668.008040] Call Trace: [ 668.008045] [ 668.016010] amdgpu 0002:01:00.0: [drm] Check your /sys/class/drm/card16/device/devcoredump/data [ 668.023967] ? srso_alias_return_thunk+0x5/0xfbef5 [ 668.023988] ? __pfx___drm_printfn_coredump+0x10/0x10 [drm] [ 668.031950] amdgpu 0003:01:00.0: Dumping IP State [ 668.038159] ? __pfx___drm_puts_coredump+0x10/0x10 [drm] [ 668.083017] amdgpu 0003:01:00.0: Dumping IP State Completed [ 668.083824] amdgpu_devcoredump_deferred_work+0x26/0xc0 [amdgpu] [ 668.086163] amdgpu 0003:01:00.0: [drm] AMDGPU device coredump file has been created [ 668.095863] process_scheduled_works+0xa6/0x420 [ 668.095880] worker_thread+0x12a/0x270 [ 668.101223] amdgpu 0003:01:00.0: [drm] Check your /sys/class/drm/card24/device/devcoredump/data [ 668.107441] kthread+0x10d/0x230 [ 668.107451] ? __pfx_worker_thread+0x10/0x10 [ 668.107458] ? __pfx_kthread+0x10/0x10 [ 668.112709] amdgpu 0000:01:00.0: ring vcn_unified_1 timeout, signaled seq=9, emitted seq=10 [ 668.118630] ret_from_fork+0x17c/0x1f0 [ 668.118640] ? __pfx_kthread+0x10/0x10 [ 668.118647] ret_from_fork_asm+0x1a/0x30 Reviewed-by: Lijo Lazar Suggested-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit de95eda05f193e051bc7689805f152d075157bd0 Author: Sunil Khatri Date: Tue Mar 24 20:28:54 2026 +0530 drm/amdgpu/userq: amdgpu_userq_vm_validate does not need userq mutex amdgpu_userq_vm_validate function does not need userq_mutex and exec lock is good enough to locking all bos and updating the eviction fence. Also since we only need userq_mutex for amdgpu_userq_restore_all so move the locks in the function itself. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec Author: Junrui Luo Date: Tue Mar 24 17:39:02 2026 +0800 drm/amdgpu: validate doorbell_offset in user queue creation amdgpu_userq_get_doorbell_index() passes the user-provided doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds checking. An arbitrarily large doorbell_offset can cause the calculated doorbell index to fall outside the allocated doorbell BO, potentially corrupting kernel doorbell space. Validate that doorbell_offset falls within the doorbell BO before computing the BAR index, using u64 arithmetic to prevent overflow. Fixes: f09c1e6077ab ("drm/amdgpu: generate doorbell index for userqueue") Reported-by: Yuhao Jiang Signed-off-by: Junrui Luo Signed-off-by: Alex Deucher commit cef2842c922cb762e9cca7bb26b9ef06ef090b52 Author: Rosen Penev Date: Thu Mar 26 20:01:24 2026 -0700 RDMA/core: Use kzalloc_flex for GID table Simplifies allocations by using a flexible array member in struct ib_gid_table. Add __counted_by to get extra runtime analysis. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260327030124.8385-1-rosenp@gmail.com Signed-off-by: Leon Romanovsky commit dbeb256e8dd87233d891b170c0b32a6466467036 Author: Long Li Date: Wed Mar 25 12:40:57 2026 -0700 RDMA/mana_ib: Disable RX steering on RSS QP destroy When an RSS QP is destroyed (e.g. DPDK exit), mana_ib_destroy_qp_rss() destroys the RX WQ objects but does not disable vPort RX steering in firmware. This leaves stale steering configuration that still points to the destroyed RX objects. If traffic continues to arrive (e.g. peer VM is still transmitting) and the VF interface is subsequently brought up (mana_open), the firmware may deliver completions using stale CQ IDs from the old RX objects. These CQ IDs can be reused by the ethernet driver for new TX CQs, causing RX completions to land on TX CQs: WARNING: mana_poll_tx_cq+0x1b8/0x220 [mana] (is_sq == false) WARNING: mana_gd_process_eq_events+0x209/0x290 (cq_table lookup fails) Fix this by disabling vPort RX steering before destroying RX WQ objects. Note that mana_fence_rqs() cannot be used here because the fence completion is delivered on the CQ, which is polled by user-mode (e.g. DPDK) and not visible to the kernel driver. Refactor the disable logic into a shared mana_disable_vport_rx() in mana_en, exported for use by mana_ib, replacing the duplicate code. The ethernet driver's mana_dealloc_queues() is also updated to call this common function. Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") Cc: stable@vger.kernel.org Signed-off-by: Long Li Link: https://patch.msgid.link/20260325194100.1929056-1-longli@microsoft.com Signed-off-by: Leon Romanovsky commit 911e5ca3e16975866739f49b6e24c858110110bc Author: Leon Romanovsky Date: Wed Mar 25 20:16:03 2026 +0200 RDMA/mlx4: Restrict external umem for CQ when copy_to_user() is used When the mlx4 firmware reports the MLX4_DEV_CAP_FLAG2_SW_CQ_INIT capability, libmlx4 from the rdma-core package expects the driver to initialize memory at the address provided in the buf_addr parameter of ucmd. This behavior cannot be supported by any external umem implementation, so restrict it accordingly. Fixes: f45f195af521 ("RDMA/mlx4: Introduce a modern CQ creation interface") Reported-by: Jiri Pirko Link: https://patch.msgid.link/20260325-fix-mlx4-external-umem-v1-1-1c7c0e779329@nvidia.com Signed-off-by: Leon Romanovsky commit 179b32095854d44749dd535502f05d95bbf43775 Author: Leon Romanovsky Date: Mon Mar 23 22:10:18 2026 +0200 RDMA/umem: Use consistent DMA attributes when unmapping entries The DMA API expects that mapping and unmapping use the same DMA attributes. The RDMA umem code did not meet this requirement, so fix the mismatch. Fixes: f03d9fadfe13 ("RDMA/core: Add weak ordering dma attr to dma mapping") Signed-off-by: Leon Romanovsky commit e6fd2491789745ed8c3df86a660dfa7207129d22 Merge: adc09d7fbbb9d2 7aaa8047eafd0b Author: Leon Romanovsky Date: Mon Mar 30 05:02:58 2026 -0400 Merge branch 'master' into rdma-next Let's bring v7.0-rc6 to the -next branch, so we can merge the DMA attributes fix [1] without merge conflicts. [1] https://lore.kernel.org/all/20260323-umem-dma-attrs-v1-1-d6890f2e6a1e@nvidia.com Signed-off-by: Leon Romanovsky * master: (1688 commits) Linux 7.0-rc6 ... commit adc09d7fbbb9d286057c98675994c445d81c27fa Author: Kexin Sun Date: Mon Mar 23 21:44:50 2026 +0800 RDMA: Remove outdated comments referencing hfi1_destroy_qp() The function hfi1_destroy_qp() was removed in commit 75261cc6ab66 ("staging/rdma/hfi1: Remove destroy qp verb") in favor of the rdmavt generic rvt_destroy_qp(). Two comments still reference hfi1_destroy_qp() as the waiter that rvt_put_qp() will wake up. As Leon Romanovsky noted, these comments add no value. Remove them. Suggested-by: Leon Romanovsky Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260323134450.2478-1-kexinsun@smail.nju.edu.cn Signed-off-by: Leon Romanovsky commit 2f49e159034478af3b5e3ab761066cb876e48343 Author: Leon Romanovsky Date: Wed Mar 18 12:08:53 2026 +0200 RDMA/bnxt_re: Clean up uverbs CQ creation path Remove unnecessary checks, user‑visible prints that can flood dmesg, superfluous assignments, and convoluted goto label. Acked-by: Selvin Xavier Signed-off-by: Leon Romanovsky commit e69609c5d46917000a6195910928cc077e79dbd4 Author: Leon Romanovsky Date: Wed Mar 18 12:08:52 2026 +0200 RDMA/bnxt_re: Replace kcalloc() with kzalloc_objs() New code should use kzalloc_objs() instead of kcalloc(). Update the driver accordingly. Acked-by: Selvin Xavier Signed-off-by: Leon Romanovsky commit 345f842771ff36aac14dd25628922be4fd72d6ba Author: Leon Romanovsky Date: Wed Mar 18 12:08:51 2026 +0200 RDMA/bnxt_re: Remove unnecessary checks in kernel CQ creation path bnxt_re_create_cq() is a kernel verb, which means udata will always be NULL and attr->cqe is valid. Remove the code handling this unreachable case. Acked-by: Selvin Xavier Signed-off-by: Leon Romanovsky commit 2b2f078236a4451f495482d49194f1fda0970776 Author: Leon Romanovsky Date: Wed Mar 18 12:08:50 2026 +0200 RDMA/bnxt_re: Simplify bnxt_re_init_depth() callers and implementation All callers of bnxt_re_init_depth() compute the minimum between its return value and another internal variable, often mixing variable types in the process. Clean this up by making the logic simpler and more readable. Acked-by: Selvin Xavier Signed-off-by: Leon Romanovsky commit b247ed6f60bdc61616b0243024e118b0659ce78f Author: Kexin Sun Date: Sat Mar 21 18:58:59 2026 +0800 RDMA/uverbs: Update outdated reference to remove_commit_idr_uobject() The function remove_commit_idr_uobject() was split into destroy_hw_idr_uobject() and remove_handle_idr_uobject() by commit 0f50d88a6e9a ("IB/uverbs: Allow all DESTROY commands to succeed after disassociate"). The kref put that the comment refers to now lives in remove_handle_idr_uobject(). Update the stale reference. Also update "allocated this IDR with a NULL object" to "allocated this XArray entry with a NULL pointer" to match the actual data structure (xa_store) and the wording already used two lines below ("transfers our kref on uobj to the XArray"). Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260321105859.7642-1-kexinsun@smail.nju.edu.cn Signed-off-by: Leon Romanovsky commit dc76086a2d94d09aea9fd41a65ed56e0f7a6ec50 Author: Leon Romanovsky Date: Thu Mar 19 17:22:21 2026 +0200 RDMA: Properly propagate the number of CQEs as unsigned int Instead of checking whether the number of CQEs is negative or zero, fix the .resize_user_cq() declaration to use unsigned int. This better reflects the expected value range. The sanity check is then handled correctly in ib_uvbers. Link: https://patch.msgid.link/20260319-resize_cq-cqe-v1-1-b78c6efc1def@nvidia.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit ce68351be075db89ff68de17e57dbe9b48374110 Author: Leon Romanovsky Date: Wed Mar 18 12:02:37 2026 +0200 RDMA: Clarify that CQ resize is a user‑space verb The CQ resize operation is used only by uverbs. Make this explicit. Link: https://patch.msgid.link/20260318-resize_cq-type-v1-2-b2846ed18846@nvidia.com Signed-off-by: Leon Romanovsky commit 6c45efd8f9bb8813524c3b8f904989af448bdd72 Author: Leon Romanovsky Date: Wed Mar 18 12:02:36 2026 +0200 RDMA/core: Remove unused ib_resize_cq() implementation There are no in-kernel users of the CQ resize functionality, so drop it. Link: https://patch.msgid.link/20260318-resize_cq-type-v1-1-b2846ed18846@nvidia.com Signed-off-by: Leon Romanovsky commit e01027cab38a1a52828eecff447ca5e015b20f92 Author: Zhu Yanjun Date: Thu Mar 12 19:30:58 2026 -0700 RDMA/rxe: Add testcase for net namespace rxe Add 4 testcases for rxe with net namespace. Reviewed-by: David Ahern Signed-off-by: Zhu Yanjun Link: https://patch.msgid.link/20260313023058.13020-5-yanjun.zhu@linux.dev Signed-off-by: Leon Romanovsky commit f1327abd6abed031ae4146825c6b28bdd1456474 Author: Zhu Yanjun Date: Thu Mar 12 19:30:57 2026 -0700 RDMA/rxe: Support RDMA link creation and destruction per net namespace After introducing dellink handling and per-net namespace management for IPv4 and IPv6 sockets, extend rxe to create and destroy RDMA links within each network namespace. With this change, RDMA links can be instantiated both in init_net and in other network namespaces. The lifecycle of the RDMA link is now tied to the corresponding namespace and is properly cleaned up when the namespace or link is removed. This ensures rxe behaves correctly in multi-namespace environments and keeps socket and RDMA link resources consistent across namespace creation and teardown. Reviewed-by: David Ahern Signed-off-by: Zhu Yanjun Link: https://patch.msgid.link/20260313023058.13020-4-yanjun.zhu@linux.dev Signed-off-by: Leon Romanovsky commit 13f2a53c2a71e12478279261b35e2abf393523b3 Author: Zhu Yanjun Date: Thu Mar 12 19:30:56 2026 -0700 RDMA/rxe: Add net namespace support for IPv4/IPv6 sockets Add a net namespace implementation file to rxe to manage the lifecycle of IPv4 and IPv6 sockets per network namespace. This implementation handles the creation and destruction of the sockets both for init_net and for dynamically created network namespaces. The sockets are initialized when a namespace becomes active and are properly released when the namespace is removed. This change provides the infrastructure needed for rxe to operate correctly in environments using multiple network namespaces. Reviewed-by: David Ahern Signed-off-by: Zhu Yanjun Link: https://patch.msgid.link/20260313023058.13020-3-yanjun.zhu@linux.dev Signed-off-by: Leon Romanovsky commit a60e3f3d6fbab9dc45c653e5046307e0e7fcde98 Author: Zhu Yanjun Date: Thu Mar 12 19:30:55 2026 -0700 RDMA/nldev: Add dellink function pointer Add a dellink function pointer to rdma_link_ops to allow drivers to clean up resources created during newlink. Reviewed-by: David Ahern Signed-off-by: Zhu Yanjun Link: https://patch.msgid.link/20260313023058.13020-2-yanjun.zhu@linux.dev Signed-off-by: Leon Romanovsky commit 5aa437c93d90f486ff5428183323c971cfeb4294 Author: Konstantin Taranov Date: Wed Mar 18 10:39:39 2026 -0700 RDMA/mana_ib: cleanup the usage of mana_gd_send_request() Do not check the status of the response header returned by mana_gd_send_request(), as the returned error code already indicates the request status. The mana_gd_send_request() may return no error code and have the response status GDMA_STATUS_MORE_ENTRIES, which is a successful completion. It is used for checking the correctness of multi-request operations, such as creation of a dma region with mana_ib_gd_create_dma_region(). Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/20260318173939.1417856-1-kotaranov@linux.microsoft.com Signed-off-by: Leon Romanovsky commit 2bb02691df656257eb373cf9052f80c196785916 Author: Marco Crivellari Date: Wed Mar 18 16:27:48 2026 +0100 RDMA/rxe: Replace use of system_unbound_wq with rxe_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. This specific driver already allocate an unbound workqueue named "rxe_wq", so replace system_unbound_wq with this one instead of system_dfl_wq. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20260318152748.837388-1-marco.crivellari@suse.com Signed-off-by: Leon Romanovsky commit f3cf74933c9ca62a46e51c69412c93c9df816b4b Author: Jacob Moroni Date: Mon Mar 16 13:39:49 2026 -0500 RDMA/irdma: Add support for GEN4 hardware GEN4 hardware is similar to GEN3 and requires only a few special cases. Signed-off-by: Jacob Moroni Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 9d6ba4ced73433df3d3c5909d73a49945bedd5c6 Author: Jay Bhat Date: Mon Mar 16 13:39:48 2026 -0500 RDMA/irdma: Provide scratch buffers to firmware for internal use For GEN3 and higher, FW requires scratch buffers for bookkeeping during cleanup, specifically during QP and MR destroy ops. Signed-off-by: Jay Bhat Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit d6e766e391ef0b2be62682e007223fc72ba7764f Merge: 07b9712339e3ce b2571ef8d4ec9b Author: Bjorn Andersson Date: Mon Mar 30 12:45:07 2026 -0500 Merge branch '20260125-iris-ubwc-v4-1-1ff30644ac81@oss.qualcomm.com' into drivers-for-7.1 Merge the new helpers in UBWC driver through a topic branch, to allow them to be shared with display and video branches as well. commit b2571ef8d4ec9bb636889a9132090bcc3449792e Author: Dmitry Baryshkov Date: Sun Jan 25 13:30:04 2026 +0200 soc: qcom: ubwc: add helpers to get programmable values Currently the database stores macrotile_mode in the data. However it can be derived from the rest of the data: it should be used for UBWC encoding >= 3.0 except for several corner cases (SM8150 and SC8180X). The ubwc_bank_spread field seems to be based on the impreside data we had for the MDSS and DPU programming. In some cases UBWC engine inside the display controller doesn't need to program it, although bank spread is to be enabled. Bank swizzle is also currently stored as is, but it is almost standard (banks 1-3 for UBWC 1.0 and 2-3 for other versions), the only exception being Lemans (it uses only bank 3). Add helpers returning values from the config for now. They will be rewritten later, in a separate series, but having the helper now simplifies refacroring the code later. Tested-by: Wangao Wang Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260125-iris-ubwc-v4-2-1ff30644ac81@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 68a66a44af6e196ca426d1250104d3018ed9e74b Author: Dmitry Baryshkov Date: Sun Jan 25 13:30:03 2026 +0200 soc: qcom: ubwc: add helper to get min_acc length MDSS and GPU drivers use different approaches to get min_acc length. Add helper function that can be used by all the drivers. The helper reflects our current best guess, it blindly copies the approach adopted by the MDSS drivers and it matches current values selected by the GPU driver. Reviewed-by: Bryan O'Donoghue Acked-by: Bjorn Andersson Reviewed-by: Konrad Dybcio Reviewed-by: Dikshita Agarwal Tested-by: Wangao Wang Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260125-iris-ubwc-v4-1-1ff30644ac81@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4663a5a2a3483b5f6b049cf7e9705773ab35e6c7 Author: Zenghui Yu (Huawei) Date: Wed Mar 11 15:09:40 2026 +0800 docs: proc: remove description of prof_cpu_mask Commit 2e5449f4f21a ("profiling: Remove create_prof_cpu_mask().") said that no one would create /proc/irq/prof_cpu_mask since commit 1f44a225777e ("s390: convert interrupt handling to use generic hardirq", 2013). Remove the outdated description. While at it, fix another minor typo (s/DMS/DMA/). Signed-off-by: Zenghui Yu (Huawei) Signed-off-by: Jonathan Corbet Message-ID: <20260311070940.94838-1-zenghui.yu@linux.dev> commit 2a740dc5892a0e90e32ddae4d0ece501ace2adfc Merge: 1e28cdeec31333 8ec017cf31299c Author: Mark Brown Date: Mon Mar 30 17:59:52 2026 +0100 ASoC: Merge up fixes Merge branch 'for-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into asoc-7.1 for both ASoC and general bug fixes to support testing. commit 999084ee0b111aaeb3e0b37b25d180c53ff6b702 Author: Akira Yokosawa Date: Thu Mar 26 20:46:37 2026 +0900 docs/ja_JP: submitting-patches: Amend "Describe your changes" To make the translation of "Describe your changes" (into "変更内容を記述する") easier to follow, do some rewording and rephrasing, as well as fixing a couple of mistranslations. Signed-off-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Message-ID: <20260326114637.144601-1-akiyks@gmail.com> commit 210a923aab5b81b6930715c4e845d58d406b154d Author: Mauro Carvalho Chehab Date: Thu Mar 26 20:09:43 2026 +0100 docs: kdoc_diff: add a helper tool to help checking kdoc regressions Checking for regressions at kernel-doc can be hard. Add a helper tool to make such task easier. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <24b3116a78348b13a74d1ff5e141160ef9705dd3.1774551940.git.mchehab+huawei@kernel.org> commit 07f6cb18c5dd627023e0810cfd51203392f55990 Author: Mauro Carvalho Chehab Date: Thu Mar 26 20:09:42 2026 +0100 tools: unittest_helper: add a quiet mode On quiet mode, only report errors. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <27556792ff70e6267ecd19c258149d380db8d423.1774551940.git.mchehab+huawei@kernel.org> commit ece7e57afd51e0b807bef5a43e2d0b1cd6e9c86f Author: Manuel Ebner Date: Wed Mar 25 20:48:12 2026 +0100 docs: changes.rst and ver_linux: sort the lists Sort the lists of tools in both scripts/ver_linux and Documentation/process/changes.rst into alphabetical order, facilitating comparison between the two. Signed-off-by: Manuel Ebner [jc: rewrote changelog] Signed-off-by: Jonathan Corbet Message-ID: <20260325194811.78509-2-manuelebner@mailbox.org> commit d8a224f519c6e7079ca3471e32c1e55fde7a2fdd Author: Manuel Ebner Date: Wed Mar 25 20:46:17 2026 +0100 docs: changes/ver_linux: fix entries and add several tools Some of the entries in both Documentation/process/changes.rst and script/ver_linux were obsolete; update them to reflect the current way of getting version information. Many were missing altogether; add the relevant information for: bash, bc, bindgen, btrfs-progs, Clang, gdb, GNU awk, GNU tar, GRUB, GRUB2, gtags, iptables, kmod, mcelog, mkimage, openssl, pahole, Python, Rust, Sphinx, squashfs-tools Signed-off-by: Manuel Ebner [jc: rewrote changelog] Signed-off-by: Jonathan Corbet Message-ID: <20260325194616.78093-2-manuelebner@mailbox.org> commit 06dbdc5da152e30fbd09b37afdca2fdec9da2165 Author: Jonathan Corbet Date: Mon Mar 30 10:29:54 2026 -0600 Revert "scripts: ver_linux: expand and fix list" This reverts commit 98e7b5752898f74788098bef51f53205e365ab9d. I had not intended to apply this version of this patch; take it out and we'll try again later. Signed-off-by: Jonathan Corbet commit 66a6333ba5087b00b7d6cb9ff671f4e2739383b3 Author: Stefan Binding Date: Mon Mar 30 14:46:18 2026 +0100 ALSA: hda/realtek: Add support for ASUS 2026 Commercial laptops using CS35L41 HDA Add support for laptops: - ASUS PM5406CGA - ASUS PM5606CGA - ASUS P5406CCA - ASUS P5606CCA Laptops use 2 CS35L41 Amps with HDA, using Internal boost, with I2C or SPI. Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20260330134651.443439-3-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 8dbbd39d0605b93a176f2c775dd2b6bb7c7a8adb Author: Stefan Binding Date: Mon Mar 30 14:46:17 2026 +0100 ALSA: hda/realtek: Add support for HP Laptops Add support for HP Auster, Trekker and Agusta G7KX. Laptops use 2 CS35L41 Amps with HDA, using Internal boost, with I2C Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20260330134651.443439-2-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 6389dbd5c4a2d819ec342f89bd65883ab021278e Author: Leonard Lausen Date: Fri Mar 27 22:25:15 2026 +0000 ALSA: hda: cs35l41: Fix boost type for HP Dragonfly 13.5 inch G4 The HP Dragonfly 13.5 inch G4 (SSID 103C8B63) has _DSD properties in ACPI firmware with valid reset-gpios and cs-gpios for the four CS35L41 amplifiers on SPI. However, the _DSD specifies cirrus,boost-type as Internal (0), while the hardware requires External Boost. With Internal Boost configured, the amplifiers trigger "Amp short error" when audio is played at moderate-to-high volume, eventually shutting down entirely. Add a configuration table entry to override the boost type to External, similar to the existing workaround for 103C89C6. All GPIO indices are set to -1 since the _DSD provides valid reset-gpios and cs-gpios. Confirmed on BIOS V90 01.11.00 (January 2026), the latest available. Link: https://bugzilla.kernel.org/show_bug.cgi?id=219520 Originally-by: Nicholas Wang Signed-off-by: Leonard Lausen Link: https://patch.msgid.link/db84dcf91bc8dbd217b35572b177d967655ff903@lausen.nl Signed-off-by: Takashi Iwai commit 7f7f468548cee80d221cbc77e639fe99e113ff99 Author: Florian Fainelli Date: Thu Mar 26 16:32:24 2026 -0700 Documentation: Provide hints on how to debug Python GDB scripts By default GDB does not print a full stack of its integrated Python interpreter, thus making the debugging of GDB scripts more painful than it has to be. Suggested-by: Radu Rendec Signed-off-by: Florian Fainelli Reviewed-by: Radu Rendec Signed-off-by: Jonathan Corbet Message-ID: <20260326233226.2248817-1-florian.fainelli@broadcom.com> commit d642acfd597e3ec37138f9a8f5a634845e3612fd Author: Mauro Carvalho Chehab Date: Fri Mar 27 06:57:48 2026 +0100 doc tools: better handle KBUILD_VERBOSE As reported by Jacob, there are troubles when KBUILD_VERBOSE is set at the environment. Fix it on both kernel-doc and sphinx-build-wrapper. Reported-by: Jacob Keller Closes: https://lore.kernel.org/linux-doc/9367d899-53af-4d9c-9320-22fc4dbadca5@intel.com/ Signed-off-by: Mauro Carvalho Chehab Tested-by: Jacob Keller Signed-off-by: Jonathan Corbet Message-ID: <7a99788db75630fb14828d612c0fd77c45ec1891.1774591065.git.mchehab+huawei@kernel.org> commit 3a6143946217d377b0c3c35f155861528e7a2afa Merge: 0a4f3ef9880e50 8545d9bc4bd080 Author: Jonathan Corbet Date: Mon Mar 30 10:01:39 2026 -0600 Merge branch 'docs-fixes' into docs-mw Bring the checkpatch Assisted-by fix into docs-next as well. commit 8545d9bc4bd0801e0bdfbfdfdc2532ff31236ddf Author: Harry Wentland Date: Fri Mar 27 11:41:57 2026 -0400 scripts/checkpatch: add Assisted-by: tag validation The coding-assistants.rst documentation defines the Assisted-by: tag format for AI-assisted contributions as: Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2] This format does not use an email address, so checkpatch currently reports a false positive about an invalid email when encountering this tag. Add Assisted-by: to the recognized signature tags and standard signature list. When an Assisted-by: tag is found, validate it instead of checking for an email address. Examples of passing tags: - Claude:claude-3-opus coccinelle sparse - FOO:BAR.baz - Copilot Github:claude-3-opus - GitHub Copilot:Claude Opus 4.6 - My Cool Agent:v1.2.3 coccinelle sparse Examples of tags triggering the new warning: - Claude coccinelle sparse - JustAName - :missing-agent Cc: Jani Nikula Assisted-by: Claude:claude-opus-4.6 Co-developed-by: Alex Hung Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Cc: stable@vger.kernel.org Signed-off-by: Jonathan Corbet Message-ID: <20260327154157.162962-1-harry.wentland@amd.com> commit 61135967fa76d37883d90ccccc5a1cb73e90b94d Author: Will Deacon Date: Mon Mar 30 15:48:39 2026 +0100 drivers/virt: pkvm: Add Kconfig dependency on DMA_RESTRICTED_POOL pKVM guests practically rely on CONFIG_DMA_RESTRICTED_POOL=y in order to establish shared memory regions with the host for virtio buffers. Make CONFIG_ARM_PKVM_GUEST depend on CONFIG_DMA_RESTRICTED_POOL to avoid the inevitable segmentation faults experience if you have the former but not the latter. Reported-by: Marc Zyngier Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-39-will@kernel.org Signed-off-by: Marc Zyngier commit 5bae7bc6360a7297e0be2c37017fe863b965646d Author: Will Deacon Date: Mon Mar 30 15:48:38 2026 +0100 KVM: arm64: Rename PKVM_PAGE_STATE_MASK Rename PKVM_PAGE_STATE_MASK to PKVM_PAGE_STATE_VMEMMAP_MASK to make it clear that the mask applies to the page state recorded in the entries of the 'hyp_vmemmap', rather than page states stored elsewhere (e.g. in the ptes). Suggested-by: Alexandru Elisei Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-38-will@kernel.org Signed-off-by: Marc Zyngier commit feae58b6ee45096b1d8c29076f0d8098d9788e57 Author: Will Deacon Date: Mon Mar 30 15:48:37 2026 +0100 KVM: arm64: Extend pKVM page ownership selftests to cover guest hvcs Now that the guest can share and unshare memory with the host using hypercalls, extend the pKVM page ownership selftest to exercise these new transitions. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-37-will@kernel.org Signed-off-by: Marc Zyngier commit f4a5a6770af9b87a8e87717e1b97af052979f4ec Author: Will Deacon Date: Mon Mar 30 15:48:36 2026 +0100 KVM: arm64: Extend pKVM page ownership selftests to cover forced reclaim Extend the pKVM page ownership selftests to forcefully reclaim a donated page and check that it cannot be re-donated at the same IPA. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-36-will@kernel.org Signed-off-by: Marc Zyngier commit 8972a991606bc021249ae53a95c131a79fdeda4a Author: Will Deacon Date: Mon Mar 30 15:48:35 2026 +0100 KVM: arm64: Register 'selftest_vm' in the VM table In preparation for extending the pKVM page ownership selftests to cover forceful reclaim of donated pages, rework the creation of the 'selftest_vm' so that it is registered in the VM table while the tests are running. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-35-will@kernel.org Signed-off-by: Marc Zyngier commit c290df5278fe8c9844b93751620664c3ca3b6e00 Author: Will Deacon Date: Mon Mar 30 15:48:34 2026 +0100 KVM: arm64: Extend pKVM page ownership selftests to cover guest donation Extend the pKVM page ownership selftests to donate and reclaim a page to/from a guest. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-34-will@kernel.org Signed-off-by: Marc Zyngier commit 287c6981f12a008bafc46f18a3e48540a1172a52 Author: Will Deacon Date: Mon Mar 30 15:48:33 2026 +0100 KVM: arm64: Add some initial documentation for pKVM Add some initial documentation for pKVM to help people understand what is supported, the limitations of protected VMs when compared to non-protected VMs and also what is left to do. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-33-will@kernel.org Signed-off-by: Marc Zyngier commit 8800dbf6614aad1013ea5f348520a2ce5ba4b6c8 Author: Will Deacon Date: Mon Mar 30 15:48:32 2026 +0100 KVM: arm64: Allow userspace to create protected VMs when pKVM is enabled Introduce a new VM type for KVM/arm64 to allow userspace to request the creation of a "protected VM" when the host has booted with pKVM enabled. For now, this feature results in a taint on first use as many aspects of a protected VM are not yet protected! Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-32-will@kernel.org Signed-off-by: Marc Zyngier commit 246c976c370de9380660e2bb641758dc0aae8c5c Author: Will Deacon Date: Mon Mar 30 15:48:31 2026 +0100 KVM: arm64: Implement the MEM_UNSHARE hypercall for protected VMs Implement the ARM_SMCCC_KVM_FUNC_MEM_UNSHARE hypercall to allow protected VMs to unshare memory that was previously shared with the host using the ARM_SMCCC_KVM_FUNC_MEM_SHARE hypercall. Reviewed-by: Vincent Donnefort Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-31-will@kernel.org Signed-off-by: Marc Zyngier commit 03313efed5e2ca55e862bf514b907a431ebf642a Author: Will Deacon Date: Mon Mar 30 15:48:30 2026 +0100 KVM: arm64: Implement the MEM_SHARE hypercall for protected VMs Implement the ARM_SMCCC_KVM_FUNC_MEM_SHARE hypercall to allow protected VMs to share memory (e.g. the swiotlb bounce buffers) back to the host. Reviewed-by: Vincent Donnefort Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-30-will@kernel.org Signed-off-by: Marc Zyngier commit 94c525051542c54907e2d3e9d2b008575829cdc8 Author: Will Deacon Date: Mon Mar 30 15:48:29 2026 +0100 KVM: arm64: Add hvc handler at EL2 for hypercalls from protected VMs Add a hypercall handler at EL2 for hypercalls originating from protected VMs. For now, this implements only the FEATURES and MEMINFO calls, but subsequent patches will implement the SHARE and UNSHARE functions necessary for virtio. Unhandled hypercalls (including PSCI) are passed back to the host. Reviewed-by: Vincent Donnefort Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-29-will@kernel.org Signed-off-by: Marc Zyngier commit 5991916392d844ba6ed6c0d320ac6578f52e39b6 Author: Will Deacon Date: Mon Mar 30 15:48:28 2026 +0100 KVM: arm64: Return -EFAULT from VCPU_RUN on access to a poisoned pte If a protected vCPU faults on an IPA which appears to be mapped, query the hypervisor to determine whether or not the faulting pte has been poisoned by a forceful reclaim. If the pte has been poisoned, return -EFAULT back to userspace rather than retrying the instruction forever. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-28-will@kernel.org Signed-off-by: Marc Zyngier commit 281a38ad2920b5ccfbbc2a0ca0caeee110ad5d6b Author: Will Deacon Date: Mon Mar 30 15:48:27 2026 +0100 KVM: arm64: Reclaim faulting page from pKVM in spurious fault handler Host kernel accesses to pages that are inaccessible at stage-2 result in the injection of a translation fault, which is fatal unless an exception table fixup is registered for the faulting PC (e.g. for user access routines). This is undesirable, since a get_user_pages() call could be used to obtain a reference to a donated page and then a subsequent access via a kernel mapping would lead to a panic(). Rework the spurious fault handler so that stage-2 faults injected back into the host result in the target page being forcefully reclaimed when no exception table fixup handler is registered. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-27-will@kernel.org Signed-off-by: Marc Zyngier commit 56080f53a6ad779b971eb7f4f7a232498805d867 Author: Will Deacon Date: Mon Mar 30 15:48:26 2026 +0100 KVM: arm64: Introduce hypercall to force reclaim of a protected page Introduce a new hypercall, __pkvm_force_reclaim_guest_page(), to allow the host to forcefully reclaim a physical page that was previous donated to a protected guest. This results in the page being zeroed and the previous guest mapping being poisoned so that new pages cannot be subsequently donated at the same IPA. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-26-will@kernel.org Signed-off-by: Marc Zyngier commit 70346d632b4d98dd33391fa263ab8bed7d9d934f Author: Will Deacon Date: Mon Mar 30 15:48:25 2026 +0100 KVM: arm64: Annotate guest donations with handle and gfn in host stage-2 Handling host kernel faults arising from accesses to donated guest memory will require an rmap-like mechanism to identify the guest mapping of the faulting page. Extend the page donation logic to encode the guest handle and gfn alongside the owner information in the host stage-2 pte. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-25-will@kernel.org Signed-off-by: Marc Zyngier commit 44887977ab0fdaa0af4d1cc97cda413884c0ef86 Author: Will Deacon Date: Mon Mar 30 15:48:24 2026 +0100 KVM: arm64: Change 'pkvm_handle_t' to u16 'pkvm_handle_t' doesn't need to be a 32-bit type and subsequent patches will rely on it being no more than 16 bits so that it can be encoded into a pte annotation. Change 'pkvm_handle_t' to a u16 and add a compile-type check that the maximum handle fits into the reduced type. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-24-will@kernel.org Signed-off-by: Marc Zyngier commit afa72d207e6b5d49ac597fcd04f0865af63cf589 Author: Will Deacon Date: Mon Mar 30 15:48:23 2026 +0100 KVM: arm64: Introduce host_stage2_set_owner_metadata_locked() Rework host_stage2_set_owner_locked() to add a new helper function, host_stage2_set_owner_metadata_locked(), which will allow us to store additional metadata alongside a 3-bit owner ID for invalid host stage-2 entries. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-23-will@kernel.org Signed-off-by: Marc Zyngier commit c6ba94640cf7b6da902d1d8a1383c7cf2303ca1f Author: Will Deacon Date: Mon Mar 30 15:48:22 2026 +0100 KVM: arm64: Generalise kvm_pgtable_stage2_set_owner() kvm_pgtable_stage2_set_owner() can be generalised into a way to store up to 59 bits in the page tables alongside a 4-bit 'type' identifier specific to the format of the 59-bit payload. Introduce kvm_pgtable_stage2_annotate() and move the existing invalid ptes (for locked ptes and donated pages) over to the new scheme. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-22-will@kernel.org Signed-off-by: Marc Zyngier commit 664d61690357ac2154cd01d859d97455aa49a81d Author: Will Deacon Date: Mon Mar 30 15:48:21 2026 +0100 KVM: arm64: Avoid pointless annotation when mapping host-owned pages When a page is transitioned to host ownership, we can eagerly map it into the host stage-2 page-table rather than going via the convoluted step of a faulting annotation to trigger the mapping. Call host_stage2_idmap_locked() directly when transitioning a page to be owned by the host. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-21-will@kernel.org Signed-off-by: Marc Zyngier commit 9ff714a09222128da16900fc7c15dea65692fc26 Author: Quentin Perret Date: Mon Mar 30 15:48:20 2026 +0100 KVM: arm64: Inject SIGSEGV on illegal accesses The pKVM hypervisor will currently panic if the host tries to access memory that it doesn't own (e.g. protected guest memory). Sadly, as guest memory can still be mapped into the VMM's address space, userspace can trivially crash the kernel/hypervisor by poking into guest memory. To prevent this, inject the abort back in the host with S1PTW set in the ESR, hence allowing the host to differentiate this abort from normal userspace faults and inject a SIGSEGV cleanly. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Quentin Perret Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-20-will@kernel.org Signed-off-by: Marc Zyngier commit be9ed3529e0599f036a425d83ecc6dd4a085c9d2 Author: Will Deacon Date: Mon Mar 30 15:48:19 2026 +0100 KVM: arm64: Support translation faults in inject_host_exception() Extend inject_host_exception() to support the injection of translation faults on both the data and instruction side to 32-bit and 64-bit EL0 as well as 64-bit EL1. This will be used in a subsequent patch when resolving an unhandled host stage-2 abort. Cc: Fuad Tabba Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-19-will@kernel.org Signed-off-by: Marc Zyngier commit 90c59c4d920f3ea6e7b4dd8702b87b38c7162755 Author: Will Deacon Date: Mon Mar 30 15:48:18 2026 +0100 KVM: arm64: Factor out pKVM host exception injection logic inject_undef64() open-codes the logic to inject an exception into the pKVM host. In preparation for reusing this logic to inject a data abort on an unhandled stage-2 fault from the host, factor out the meat and potatoes of the function into a new inject_host_exception() function which takes the ESR as a parameter. Cc: Fuad Tabba Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-18-will@kernel.org Signed-off-by: Marc Zyngier commit 4e6e03f9eaddb6be5ca8477dc5642e94ddece47e Author: Will Deacon Date: Mon Mar 30 15:48:17 2026 +0100 KVM: arm64: Hook up reclaim hypercall to pkvm_pgtable_stage2_destroy() During teardown of a protected guest, its memory pages must be reclaimed from the hypervisor by issuing the '__pkvm_reclaim_dying_guest_page' hypercall. Add a new helper, __pkvm_pgtable_stage2_reclaim(), which is called during the VM teardown operation to reclaim pages from the hypervisor and drop the GUP pin on the host. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-17-will@kernel.org Signed-off-by: Marc Zyngier commit 0bf5f4d400cd11ab86b25a56b101726e35f3e7cb Author: Will Deacon Date: Mon Mar 30 15:48:16 2026 +0100 KVM: arm64: Introduce __pkvm_reclaim_dying_guest_page() To enable reclaim of pages from a protected VM during teardown, introduce a new hypercall to reclaim a single page from a protected guest that is in the dying state. Since the EL2 code is non-preemptible, the new hypercall deliberately acts on a single page at a time so as to allow EL1 to reschedule frequently during the teardown operation. Reviewed-by: Vincent Donnefort Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Co-developed-by: Quentin Perret Signed-off-by: Quentin Perret Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-16-will@kernel.org Signed-off-by: Marc Zyngier commit ea03466e806fea942841a41cfaab8db8c851aa71 Author: Will Deacon Date: Mon Mar 30 15:48:15 2026 +0100 KVM: arm64: Handle aborts from protected VMs Introduce a new abort handler for resolving stage-2 page faults from protected VMs by pinning and donating anonymous memory. This is considerably simpler than the infamous user_mem_abort() as we only have to deal with translation faults at the pte level. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-15-will@kernel.org Signed-off-by: Marc Zyngier commit 5fef16ef49126b0f71fb3e401aae4dca1865e6f9 Author: Will Deacon Date: Mon Mar 30 15:48:14 2026 +0100 KVM: arm64: Hook up donation hypercall to pkvm_pgtable_stage2_map() Mapping pages into a protected guest requires the donation of memory from the host. Extend pkvm_pgtable_stage2_map() to issue a donate hypercall when the target VM is protected. Since the hypercall only handles a single page, the splitting logic used for the share path is not required. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-14-will@kernel.org Signed-off-by: Marc Zyngier commit 1e579adca1774b3713d1efa67d92a88ec86c04fa Author: Will Deacon Date: Mon Mar 30 15:48:13 2026 +0100 KVM: arm64: Introduce __pkvm_host_donate_guest() In preparation for supporting protected VMs, whose memory pages are isolated from the host, introduce a new pKVM hypercall to allow the donation of pages to a guest. Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-13-will@kernel.org Signed-off-by: Marc Zyngier commit 6c58f914eb9c4ce5225d03183ae1290d72b5f639 Author: Will Deacon Date: Mon Mar 30 15:48:12 2026 +0100 KVM: arm64: Split teardown hypercall into two phases In preparation for reclaiming protected guest VM pages from the host during teardown, split the current 'pkvm_teardown_vm' hypercall into separate 'start' and 'finalise' calls. The 'pkvm_start_teardown_vm' hypercall puts the VM into a new 'is_dying' state, which is a point of no return past which no vCPU of the pVM is allowed to run any more. Once in this new state, 'pkvm_finalize_teardown_vm' can be used to reclaim meta-data and page-table pages from the VM. A subsequent patch will add support for reclaiming the individual guest memory pages. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Co-developed-by: Quentin Perret Signed-off-by: Quentin Perret Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-12-will@kernel.org Signed-off-by: Marc Zyngier commit 73c55be08932a348f8b0a44f561c33eaa2cf1ad2 Author: Will Deacon Date: Mon Mar 30 15:48:11 2026 +0100 KVM: arm64: Ignore -EAGAIN when mapping in pages for the pKVM host If the host takes a stage-2 translation fault on two CPUs at the same time, one of them will get back -EAGAIN from the page-table mapping code when it runs into the mapping installed by the other. Rather than handle this explicitly in handle_host_mem_abort(), pass the new KVM_PGTABLE_WALK_IGNORE_EAGAIN flag to kvm_pgtable_stage2_map() from __host_stage2_idmap() and return -EEXIST if host_stage2_adjust_range() finds a valid pte. This will avoid having to test for -EAGAIN on the reclaim path in subsequent patches. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-11-will@kernel.org Signed-off-by: Marc Zyngier commit f0877a1455cc6a93be14e4da741ce26ac0d6ca6d Author: Will Deacon Date: Mon Mar 30 15:48:10 2026 +0100 KVM: arm64: Prevent unsupported memslot operations on protected VMs Protected VMs do not support deleting or moving memslots after first run nor do they support read-only or dirty logging. Return -EPERM to userspace if such an operation is attempted. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-10-will@kernel.org Signed-off-by: Marc Zyngier commit 7250533ad2c1f0e49567077e9b0f66b0349b357e Author: Will Deacon Date: Mon Mar 30 15:48:09 2026 +0100 KVM: arm64: Ignore MMU notifier callbacks for protected VMs In preparation for supporting the donation of pinned pages to protected VMs, return early from the MMU notifiers when called for a protected VM, as the necessary hypercalls are exposed only for non-protected guests. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-9-will@kernel.org Signed-off-by: Marc Zyngier commit 733774b5204553ab5524c0330f262184d9d573f6 Author: Will Deacon Date: Mon Mar 30 15:48:08 2026 +0100 KVM: arm64: Remove is_protected_kvm_enabled() checks from hypercalls When pKVM is not enabled, the host shouldn't issue pKVM-specific hypercalls and so there's no point checking for this in the pKVM hypercall handlers. Remove the redundant is_protected_kvm_enabled() checks from each hypercall and instead rejig the hypercall table so that the pKVM-specific hypercalls are unreachable when pKVM is not being used. Reviewed-by: Quentin Perret Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-8-will@kernel.org Signed-off-by: Marc Zyngier commit 3a81a814437d187ac893b3d937985d6503ff3841 Author: Fuad Tabba Date: Mon Mar 30 15:48:07 2026 +0100 KVM: arm64: Expose self-hosted debug regs as RAZ/WI for protected guests Debug and trace are not currently supported for protected guests, so trap accesses to the related registers and emulate them as RAZ/WI for now. Although this isn't strictly compatible with the architecture, it's sufficient for Linux guests and means that debug support can be added later on. Tested-by: Mostafa Saleh Signed-off-by: Fuad Tabba Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-7-will@kernel.org Signed-off-by: Marc Zyngier commit be3473c338d23c87485d7728818005f32b58009f Author: Will Deacon Date: Mon Mar 30 15:48:06 2026 +0100 KVM: arm64: Don't advertise unsupported features for protected guests Both SVE and PMUv3 are treated as "restricted" features for protected guests and attempts to access their corresponding architectural state from a protected guest result in an undefined exception being injected by the hypervisor. Since these exceptions are unexpected and typically fatal for the guest, don't advertise these features for protected guests. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-6-will@kernel.org Signed-off-by: Marc Zyngier commit ff1e7f9897947ea79ece7eb587c8d93957af5ee8 Author: Will Deacon Date: Mon Mar 30 15:48:05 2026 +0100 KVM: arm64: Rename __pkvm_pgtable_stage2_unmap() In preparation for adding support for protected VMs, where pages are donated rather than shared, rename __pkvm_pgtable_stage2_unmap() to __pkvm_pgtable_stage2_unshare() to make it clearer about what is going on. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-5-will@kernel.org Signed-off-by: Marc Zyngier commit 9f02deef471e1b6637a6641ce6bf9e2a1dd7d2c1 Author: Will Deacon Date: Mon Mar 30 15:48:04 2026 +0100 KVM: arm64: Move handle check into pkvm_pgtable_stage2_destroy_range() When pKVM is enabled, a VM has a 'handle' allocated by the hypervisor in kvm_arch_init_vm() and released later by kvm_arch_destroy_vm(). Consequently, the only time __pkvm_pgtable_stage2_unmap() can run into an uninitialised 'handle' is on the kvm_arch_init_vm() failure path, where we destroy the empty stage-2 page-table if we fail to allocate a handle. Move the handle check into pkvm_pgtable_stage2_destroy_range(), which will additionally handle protected VMs in subsequent patches. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-4-will@kernel.org Signed-off-by: Marc Zyngier commit 5e66f723d4de432a5acb481293d81dc88c7f61a4 Author: Will Deacon Date: Mon Mar 30 15:48:03 2026 +0100 KVM: arm64: Don't leak stage-2 page-table if VM fails to init under pKVM If pkvm_init_host_vm() fails, we should free the stage-2 page-table previously allocated by kvm_init_stage2_mmu(). Cc: Fuad Tabba Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Tested-by: Mostafa Saleh Fixes: 07aeb70707b1 ("KVM: arm64: Reserve pKVM handle during pkvm_init_host_vm()") Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-3-will@kernel.org Signed-off-by: Marc Zyngier commit 660b208e8b5ea0f5a68a8333e18960d89d484a27 Author: Will Deacon Date: Mon Mar 30 15:48:02 2026 +0100 KVM: arm64: Remove unused PKVM_ID_FFA definition Commit 7cbf7c37718e ("KVM: arm64: Drop pkvm_mem_transition for host/hyp sharing") removed the last users of PKVM_ID_FFA, so drop the definition altogether. Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260330144841.26181-2-will@kernel.org Signed-off-by: Marc Zyngier commit 5b6471fc72a42e6110adca54f46fd2c287dc49d4 Author: Simon Richter Date: Sun Mar 8 02:35:37 2026 +0900 PCI/VGA: Fail pci_set_vga_state() if VGA decoding not supported PCI bridges are allowed to refuse activating VGA decoding, by simply ignoring attempts to set the bit that enables it, so after setting the bit, read it back to verify. One example of such a bridge is the root bridge in IBM PowerNV, but this is also useful for GPU passthrough into virtual machines, where it is difficult to set up routing for legacy IO through IOMMU. Signed-off-by: Simon Richter [bhelgaas: subject, add comment about VGA Enable writability] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260307173538.763188-5-Simon.Richter@hogyros.de commit d50dd728ced93a1900ff0be924b6f273baf59fb2 Author: Jason Andryuk Date: Wed Mar 18 19:53:26 2026 -0400 hvc/xen: Check console connection flag When the console out buffer is filled, __write_console() will return 0 as it cannot send any data. domU_write_console() will then spin in `while (len)` as len doesn't decrement until xenconsoled attaches. This would block a domU and nullify the parallelism of Hyperlaunch until dom0 userspace starts xenconsoled, which empties the buffer. Xen 4.21 added a connection field to the xen console page. This is set to XENCONSOLE_DISCONNECTED (1) when a domain is built, and xenconsoled will set it to XENCONSOLE_CONNECTED (0) when it connects. Update the hvc_xen driver to check the field. When the field is disconnected, drop the write with -ENOTCONN. We only drop the write when the field is XENCONSOLE_DISCONNECTED (1) to try for maximum compatibility. The Xen toolstack has historically zero initialized the console, so it should see XENCONSOLE_CONNECTED (0) by default. If an implemenation used uninitialized memory, only checking for XENCONSOLE_DISCONNECTED could have the lowest chance of not connecting. This lets the hyperlaunched domU boot without stalling. Once dom0 starts xenconsoled, xl console can be used to access the domU's hvc0. Paritally sync console.h from xen.git to bring in the new field. Reviewed-by: Stefano Stabellini Signed-off-by: Jason Andryuk Link: https://patch.msgid.link/20260318235326.14568-1-jason.andryuk@amd.com Signed-off-by: Greg Kroah-Hartman commit 8f18d3cbd92065146147e958afa912ca94a237b0 Author: Biju Das Date: Thu Mar 12 08:26:59 2026 +0000 serial: sh-sci: Add support for RZ/G3L RSCI Add support for RZ/G3L RSCI. The RSCI IP found on the RZ/G3L SoC is similar to RZ/G3E, but it has 3 clocks (2 module clocks + 1 external clock) instead of 6 clocks (5 module clocks + 1 external clock) on the RZ/G3E. Both RZ/G3L and RZ/G3E have a 32-bit FIFO, but RZ/G3L has a single TCLK with internal dividers, whereas the RZ/G3E has explicit clocks for TCLK and its dividers. Add a new port type RSCI_PORT_SCIF32_SINGLE_TCLK to handle this clock difference. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260312082708.98835-3-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 6672462c97ed29f1cf04317663ae0bffff261c3b Author: Biju Das Date: Thu Mar 12 08:26:58 2026 +0000 dt-bindings: serial: renesas,rsci: Document RZ/G3L SoC Document the serial communication interface (RSCI) used on the Renesas RZ/G3L (R9A08G046) SoC. This SoC integrates the same RSCI IP block as the RZ/G3E (R9A09G047), but it has 3 clocks compared to 6 clocks on the RZ/G3E SoC. The RZ/G3L has a single TCLK with internal dividers, whereas the RZ/G3E has explicit clocks for TCLK and its dividers. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260312082708.98835-2-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit fdb19f4ede3bf41c48721889114441389d1ad403 Author: Kexin Sun Date: Tue Mar 24 10:48:57 2026 +0800 tty: atmel_serial: update outdated reference to atmel_tasklet_func() The modem-status comparison that used irq_status_prev was moved from atmel_tasklet_func() into atmel_handle_status() in commit d033e82db9a5 ("tty/serial: at91: handle IRQ status more safely"). Update the comment accordingly. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260324024857.3244-1-kexinsun@smail.nju.edu.cn Signed-off-by: Greg Kroah-Hartman commit da6dbbf11c01aba88233c5be247ed2918183b387 Author: Andy Shevchenko Date: Fri Mar 20 23:08:27 2026 +0100 serial: xilinx_uartps: Drop unused include This driver includes the legacy header but does not use any symbols from it. Drop the inclusion. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260320220827.3237499-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2d2640712455fc1c9a0bab0196404e27cf48d1af Author: Kathiravan Thirumoorthy Date: Thu Mar 19 15:18:08 2026 +0530 serial: qcom-geni: drop stray newline format specifier Drop the newline character from the middle of the printk message. This avoids breaking the message into two lines unnecessarily. Signed-off-by: Kathiravan Thirumoorthy Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260319-drop_stray_n-v1-1-37fb619538bb@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 502c6b95b8b7827ddcaca38a5befb3b68c55de01 Author: Rong Zhang Date: Mon Mar 16 02:42:57 2026 +0800 serial: 8250: loongson: Enable building on MIPS Loongson64 Loongson 3A4000 is a MIPS-based Loongson64 CPU which also supports 8250_loongson (loongson-uart). Enable building on MIPS Loongson64 so that Loongson 3A4000 can benefit from it. Signed-off-by: Rong Zhang Reviewed-by: Jiaxun Yang Link: https://patch.msgid.link/20260315184301.412844-3-rongrong@oss.cipunited.com Signed-off-by: Greg Kroah-Hartman commit 17fb51a90efc0b0f756c52bed241d17cfedd0cab Author: Rong Zhang Date: Mon Mar 16 02:42:56 2026 +0800 dt-bindings: serial: 8250: Add Loongson 3A4000 uart compatible The UART controller on Loongson 3A4000 is compatible with Loongson 2K1500, which is NS16550A-compatible with an additional fractional frequency divisor register. Add loongson,ls3a4000-uart as compatible with loongson,ls2k1500-uart. Acked-by: Krzysztof Kozlowski Signed-off-by: Rong Zhang Reviewed-by: Jiaxun Yang Link: https://patch.msgid.link/20260315184301.412844-2-rongrong@oss.cipunited.com Signed-off-by: Greg Kroah-Hartman commit c8f3ac729f827b655e0a239a3967b47c9dfce606 Author: Ravi Rama Date: Fri Mar 13 14:47:27 2026 -0500 serial: 8250_fintek: Add support for F81214E The F81214E is a LPC/eSPI to 2 UART Super I/O chip. Functionally, it is the same as the F81216E. The only difference is that the F81216E has 4 UART ports, whereas the F81214E has 2 UART ports. Signed-off-by: Ravi Rama Link: https://patch.msgid.link/20260313194731.2671-1-ravi.rama@nexthop.ai Signed-off-by: Greg Kroah-Hartman commit 760e8c382c2de149b84e69fb60cccc32f6725a3f Author: Eliav Farber Date: Wed Feb 18 14:35:22 2026 +0000 mtd: spi-nor: winbond: Fix locking support for w25q256jw The Winbond w25q256jw device: - Supports lock/unlock via SR. - Has Top/Bottom (TB) protect bit. - Uses Status Register bit 6 as the Top/Bottom (TB) protect bit. - Supports four Block Protect (BP) bits. Update the flash parameters by enabling SPI_NOR_HAS_LOCK, SPI_NOR_HAS_TB, SPI_NOR_TB_SR_BIT6 and SPI_NOR_4BIT_BP. Without these flags, the locking configuration is incorrect. Reference: https://www.winbond.com/hq/support/documentation/levelOne.jsp?__locale=en&DocNo=DA00-W25Q256JW.1 Signed-off-by: Eliav Farber Reviewed-by: Michael Walle Signed-off-by: Pratyush Yadav (Google) commit 81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d Author: Michael Zimmermann Date: Fri Mar 27 20:22:09 2026 +0100 usb: gadget: f_hid: don't call cdev_init while cdev in use When calling unbind, then bind again, cdev_init reinitialized the cdev, even though there may still be references to it. That's the case when the /dev/hidg* device is still opened. This obviously unsafe behavior like oopes. This fixes this by using cdev_alloc to put the cdev on the heap. That way, we can simply allocate a new one in hidg_bind. Closes: https://lore.kernel.org/linux-usb/CAN9vWDKZn0Ts5JyV2_xcAmbnBEi0znMLg_USMFrShRryXrgWGQ@mail.gmail.com/T/#m2cb0dba3633b67b2a679c98499508267d1508881 Cc: stable Signed-off-by: Michael Zimmermann Link: https://patch.msgid.link/20260327192209.59945-1-sigmaepsilon92@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0c8935642cb08c2b64cc4264ac751298994edd8a Author: Amit Sunil Dhamne Date: Wed Mar 25 22:22:27 2026 +0000 usb: typec: tcpm/tcpci_maxim: deprecate WAR for setting charger mode TCPCI maxim driver directly writes to the charger's register space to set charger mode depending on the power role. As MAX77759 chg driver exists, this WAR is not required. Instead, use a regulator interface to source vbus when typec is in source power mode. In other power modes, this regulator will be turned off if active. Signed-off-by: Amit Sunil Dhamne Reviewed-by: Heikki Krogerus Reviewed-by: André Draszik Link: https://patch.msgid.link/20260325-max77759-charger-v9-6-4486dd297adc@google.com Signed-off-by: Greg Kroah-Hartman commit 70d7dd27f6dc9bada652c3a84ba7e6688a96f8db Author: Amit Sunil Dhamne Date: Wed Mar 25 22:22:26 2026 +0000 power: supply: max77759: add charger driver Add support for MAX77759 battery charger driver. This is a 4A 1-Cell Li+/LiPoly dual input switch mode charger. While the device can support USB & wireless charger inputs, this implementation only supports USB input. This implementation supports both buck and boost modes. Signed-off-by: Amit Sunil Dhamne Reviewed-by: André Draszik Link: https://patch.msgid.link/20260325-max77759-charger-v9-5-4486dd297adc@google.com Signed-off-by: Greg Kroah-Hartman commit f23388d0f6523cc3a72edf6e78cb11931a07da10 Author: Amit Sunil Dhamne Date: Wed Mar 25 22:22:25 2026 +0000 lib/linear_ranges: Add linear_range_get_selector_high_array Add a helper function to find the selector for a given value in a linear range array. The selector should be such that the value it represents should be higher or equal to the given value. Signed-off-by: Amit Sunil Dhamne Reviewed-by: Matti Vaittinen Acked-by: Mark Brown Link: https://patch.msgid.link/20260325-max77759-charger-v9-4-4486dd297adc@google.com Signed-off-by: Greg Kroah-Hartman commit b422f7c072ac8d9b83c3d22e03709b92626ca88a Author: Amit Sunil Dhamne Date: Wed Mar 25 22:22:24 2026 +0000 mfd: max77759: add register bitmasks and modify irq configs for charger Add register bitmasks for charger function. In addition split the charger IRQs further such that each bit represents an IRQ downstream of charger regmap irq chip. In addition populate the ack_base to offload irq ack to the regmap irq chip framework. Signed-off-by: Amit Sunil Dhamne Reviewed-by: André Draszik Link: https://patch.msgid.link/20260325-max77759-charger-v9-3-4486dd297adc@google.com Signed-off-by: Greg Kroah-Hartman commit 47f8ba232a17977f41c01e4f50934440f951395a Author: Amit Sunil Dhamne Date: Wed Mar 25 22:22:23 2026 +0000 dt-bindings: usb: maxim,max33359: Add supply property for vbus Add a regulator supply property for vbus. This notifies the regulator provider to source vbus when Type-C operates in Source power mode, while turn off sourcing vbus when operating in Sink mode or disconnected. Signed-off-by: Amit Sunil Dhamne Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260325-max77759-charger-v9-2-4486dd297adc@google.com Signed-off-by: Greg Kroah-Hartman commit 1afaec82e12168fe5ec18c145b1499fc61979833 Author: Amit Sunil Dhamne Date: Wed Mar 25 22:22:22 2026 +0000 dt-bindings: mfd: maxim,max77759: reference power-supply schema and add regulator property Extend the max77759 binding to reference power-supply schema, so that PMIC node can reference its supplier. Also, add regulator property to control CHGIN (OTG) voltage. Signed-off-by: Amit Sunil Dhamne Reviewed-by: Krzysztof Kozlowski Reviewed-by: André Draszik Link: https://patch.msgid.link/20260325-max77759-charger-v9-1-4486dd297adc@google.com Signed-off-by: Greg Kroah-Hartman commit 698f54d4eb9034bb4366985659bd77ae471b6c4e Author: Oliver Neukum Date: Wed Mar 25 15:55:20 2026 +0100 usb: translate ENOSPC for user space In case of insufficient bandwidth usb_submit_urb() returns -ENOSPC. Translating this to -EIO is not optimal. There are insufficient resources not an error. EBUSY is a better fit. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260325145537.372993-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit dd13bda7338608c981da5ca79506b6fb902c8815 Author: Oliver Neukum Date: Thu Mar 19 15:46:24 2026 +0100 USB: uapi: add BULK_MAX_PACKET_UPDATE The spec for Embedded USB2 Version 2.0 adds a new feature request. This needs to be added to uapi for monitoring. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260319144715.2957358-2-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit ee90b493e0a04605b8976bf085dacc19d38e1e8f Author: Oliver Neukum Date: Thu Mar 19 15:46:23 2026 +0100 usb: uapi: add usb 3.0 authentication declarations This adds the USB authentication extensions to the uapi chapter 9 declarations, so that user space tools correctly operate on the descriptor and commands. This is necessary for sniffing and debugging in gadget mode to correctly work, even though the kernel does not use these requests in host mode. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260319144715.2957358-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 00b4fe5be06aecd6426930de86b7cffc2330f4b8 Author: Yixun Lan Date: Thu Mar 19 07:51:04 2026 +0000 usb: misc: onboard_usb_dev: Add Terminus FE1.1s USB2.0 Hub (1a40:0101) Terminus FE1.1s is USB2.0 protocol compliant 4-port USB HUB, It support MTT (Multiple Transaction Translator) mode, the upstream port supports high-speed 480MHz and full-speed 12MHz modes, also it has integrated 5V to 3.3V/1.8V regulator and Power-On-Reset circuit. Link: https://terminus-usa.com/wp-content/uploads/2024/06/FE1.1s-Product-Brief-Rev.-2.0-2023.pdf [1] Signed-off-by: Yixun Lan Link: https://patch.msgid.link/20260319-03-usb-hub-fe1-v2-2-e4e26809dd7d@kernel.org Signed-off-by: Greg Kroah-Hartman commit e972256f256c5ae908e15e2c6880f9144fbcae93 Author: Yixun Lan Date: Thu Mar 19 07:51:03 2026 +0000 dt-bindings: usb: Add support for Terminus FE1.1s USB2.0 Hub controller Terminus FE1.1s is USB2.0 protocol compliant 4-port USB HUB, It support MTT (Multiple Transaction Translator) mode, the upstream port supports high-speed 480MHz and full-speed 12MHz modes, also has integrated 5V to 3.3V, 1.8V regulator and Power-On-Reset circuit. Introduce the DT binding for it. Link: https://terminus-usa.com/wp-content/uploads/2024/06/FE1.1s-Product-Brief-Rev.-2.0-2023.pdf [1] Signed-off-by: Yixun Lan Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260319-03-usb-hub-fe1-v2-1-e4e26809dd7d@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5b99bcbae2d3bea8dc785593ebf7246854f7b90f Author: Krzysztof Kozlowski Date: Mon Mar 23 09:54:16 2026 +0100 dt-bindings: usb: qcom,snps-dwc3: Add constraints for IPQ5424 and IPQ9574 The qcom,ipq5424-dwc3 and qcom,ipq9574-dwc3 are already documented in top level part, but they miss specific constraints for clocks (IPQ5424) and interrupts (both). Closes: https://sashiko.dev/#/patchset/20260319092348.35237-2-krzysztof.kozlowski%40oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260323-dt-bindings-snps-qcom-dwc3-cleanup-v2-5-3bcd37c0a5b5@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 2bd012e02be7b136b0198a0c7be6c49585d6ca13 Author: Krzysztof Kozlowski Date: Mon Mar 23 09:54:15 2026 +0100 dt-bindings: usb: qcom,snps-dwc3: Add constraints for SM4250 The qcom,sm4250-dwc3 is already documented in top level part, but it misses specific constraints for clocks. The SoC is derivative of SM6115 (or vice versa), so the interrupts part is incorrectly placed and should be same as for SM6115. Closes: https://sashiko.dev/#/patchset/20260319092348.35237-2-krzysztof.kozlowski%40oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260323-dt-bindings-snps-qcom-dwc3-cleanup-v2-4-3bcd37c0a5b5@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit eb06a0a15771c4b4a1ce80396e9bdbee0374855c Author: Krzysztof Kozlowski Date: Mon Mar 23 09:54:14 2026 +0100 dt-bindings: usb: qcom,snps-dwc3: Add constraints for SM6375 The qcom,sm6375-dwc3 is already documented in top level part, but it misses specific constraints for clocks and interrupts. Closes: https://sashiko.dev/#/patchset/20260319092348.35237-2-krzysztof.kozlowski%40oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260323-dt-bindings-snps-qcom-dwc3-cleanup-v2-3-3bcd37c0a5b5@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 2c0471192910263d4e6dc964f307c915f56d7a3a Author: Krzysztof Kozlowski Date: Mon Mar 23 09:54:13 2026 +0100 dt-bindings: usb: qcom,snps-dwc3: Add missing clocks and interrupts constraints The top-level part defines variable number of clocks and interrupts, and each "if:then:" block narrows them. It however narrows only the maxItems leaving minItems undefined, which then takes different values depending on dtschema being used. Recommended style is to avoid ambiguity in such case, thus if top-level part has broad constraints, then each "if:then:" must specify both upper and lower limits. Add missing constraints, mostly minItems but also maxItems for one variant. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260323-dt-bindings-snps-qcom-dwc3-cleanup-v2-2-3bcd37c0a5b5@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 2a6bfe9e46eebc17f7bf734c0232e173aae4f86b Author: Krzysztof Kozlowski Date: Mon Mar 23 09:54:12 2026 +0100 dt-bindings: usb: qcom,snps-dwc3: Drop stale child node comment After moving the binding to style with combined wrapper+device (so one node) there is no child node required. Drop the stale comment about it. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260323-dt-bindings-snps-qcom-dwc3-cleanup-v2-1-3bcd37c0a5b5@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 6076388ca1eda808b95f9479f3b04839d348a2f7 Author: Peter Chen Date: Mon Mar 16 14:48:31 2026 +0800 usb: cdns3: Add USBSSP platform driver support The Cadence USBSSP (CDNSP) controller was previously only accessible through PCI, coupling the gadget driver with the PCI glue layer into a single monolithic module (cdnsp-udc-pci). This prevented using the CDNSP IP on SoC/platform designs that expose the controller through device tree. It restructures the driver to decouple the CDNSP gadget from PCI. - Introduce CONFIG_USB_CDNSP as a standalone tristate (analogous to CONFIG_USB_CDNS3), with USB_CDNSP_GADGET and USB_CDNSP_HOST as bool sub-options. The gadget code builds as a separate cdnsp.ko module. - Regroup USBSSP and CDNS3 Kconfig options under the USB_CDNS_SUPPORT menu so they appear properly grouped in menuconfig. - Refactor cdnsp-pci.c into a thin PCI-to-platform wrapper (similar to cdns3-pci-wrap.c) that registers a platform device and passes PCI resources and platform data to the common platform driver. - Auto-detect the controller version (USBSS vs USBSSP) at runtime by reading the DRD/OTG Device ID register in cdns_drd_init(), and select the appropriate gadget init function (cdns3_gadget_init or cdnsp_gadget_init) based on cdns->version. This follows the same pattern already used for host initialization. - Fix gadget-export.h to use IS_REACHABLE() keyed on the tristate module config (CONFIG_USB_CDNS3/CONFIG_USB_CDNSP) instead of IS_ENABLED() on the bool gadget config. The bool configs are always 'y' when enabled, causing IS_ENABLED/IS_REACHABLE to always return true and resulting in link errors when cdns-usb-common is built-in but the gadget module is loadable. - Add missing MODULE_LICENSE()/MODULE_DESCRIPTION() and EXPORT_SYMBOL_GPL() to the cdns3 and cdnsp gadget modules, required by modpost. - Pass override_apb_timeout through cdns3_platform_data so the PCI wrapper can communicate PCI-specific APB timeout values to the common driver. This patch is Assisted-by: Cursor:claude-4.6-opus Signed-off-by: Peter Chen Acked-by: Pawel Laszczak Link: https://patch.msgid.link/20260316064831.274865-3-peter.chen@cixtech.com Signed-off-by: Greg Kroah-Hartman commit fb14e7f7cbb4abbcde5576282d91352deaff2887 Author: Peter Chen Date: Mon Mar 16 14:48:30 2026 +0800 dt-bindings: usb: cdns,usb3: document USBSSP controller support Update the Cadence USBSS DRD binding to document that it also covers the USBSSP (SuperSpeed Plus, USB 3.1 gen2x1) controller. Both USBSS and USBSSP share the same DRD/OTG register interface, so the driver auto-detects the controller version at runtime — no additional compatible string is needed. Changes to the binding: - Update title and add description - maximum-speed: add super-speed-plus This patch is Assisted-by: Cursor:claude-4.6-opus Signed-off-by: Peter Chen Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260316064831.274865-2-peter.chen@cixtech.com Signed-off-by: Greg Kroah-Hartman commit 479ba9d293f5fa32cfd2a14a502690eca769e5ee Author: Markus Schneider-Pargmann (TI) Date: Wed Mar 18 16:13:08 2026 +0100 dt-bindings: remoteproc: k3-r5f: Add memory-region-names Add names to the memory-region-names for easier identification of memory regions. As the meaning of the second memory region can be different also require the use of memory-region-names if memory-region is in use. Signed-off-by: Markus Schneider-Pargmann (TI) Link: https://lore.kernel.org/r/20260318-topic-am62a-ioddr-dt-v6-19-v3-2-c41473cb23c3@baylibre.com Signed-off-by: Mathieu Poirier commit 91ddd97e1bb26937a5c15fb51ec8f6b65dbe94b8 Author: Markus Schneider-Pargmann (TI) Date: Wed Mar 18 16:13:07 2026 +0100 dt-bindings: remoteproc: k3-r5f: Split up memory regions Split up the region reserved for the firmware image in more specific sections to expose the full fixed layout. Especially the LPM metadata section is important for bootloaders as it contains information about how to exit IO+DDR. This is read by the bootloader but is written by the firmware. Signed-off-by: Markus Schneider-Pargmann (TI) Link: https://lore.kernel.org/r/20260318-topic-am62a-ioddr-dt-v6-19-v3-1-c41473cb23c3@baylibre.com Signed-off-by: Mathieu Poirier commit 6b9db53197094f38a18797495df2e3c758ec51dc Author: Alexey Charkov Date: Tue Mar 17 20:30:15 2026 +0400 usb: typec: fusb302: Switch to threaded IRQ handler FUSB302 fails to probe with -EINVAL if its interrupt line is connected via an I2C GPIO expander, such as TI TCA6416. Switch the interrupt handler to a threaded one, which also works behind such GPIO expanders. Cc: stable Fixes: 309b6341d557 ("usb: typec: fusb302: Revert incorrect threaded irq fix") Signed-off-by: Alexey Charkov Reviewed-by: Hans de Goede Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260317-fusb302-irq-v2-1-dbabd5c5c961@flipper.net Signed-off-by: Greg Kroah-Hartman commit b41470c6b4d4177adf8968015514cf240e37d226 Author: Alexey Charkov Date: Wed Mar 18 18:32:56 2026 +0400 usb: typec: tcpci_rt1711h: Drop unnecessary VID/PID/DID checks Existing checks for VID/PID/DID in the driver are redundant since the driver is already matched to the device via I2C device ID and OF compatible strings, and they preclude the use of fallback compatibles. Remove them to make the driver slimmer and adding new clones easier. Reviewed-by: Heikki Krogerus Signed-off-by: Alexey Charkov Link: https://patch.msgid.link/20260318-husb311-v4-4-69e029255430@flipper.net Signed-off-by: Greg Kroah-Hartman commit aa9de45cdba50540412d619de50c666137d946e7 Author: Alexey Charkov Date: Wed Mar 18 18:32:55 2026 +0400 dt-bindings: usb: richtek,rt1711h: Add Hynetek HUSB311 HUSB311 is a pin-compatible and register-compatible drop-in replacement for RT1711H, so add its compatible string to the existing binding. Link: https://www.hynetek.com/uploadfiles/site/219/news/0863c0c7-f535-4f09-bacd-0440d2c21088.pdf Link: https://dl.xkwy2018.com/downloads/RK3588S/03_Product%20Line%20Branch_Tablet/02_Key%20Device%20Specifications/HUSB311%20introduction%2020210526.pdf Link: https://www.richtek.com/assets/product_file/RT1711H/DS1711H-04.pdf Signed-off-by: Alexey Charkov Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260318-husb311-v4-3-69e029255430@flipper.net Signed-off-by: Greg Kroah-Hartman commit 8d6efc4a46b6b839cdcdd37313d60335ba5d8309 Author: Alexey Charkov Date: Wed Mar 18 18:32:54 2026 +0400 dt-bindings: usb: richtek,rt1711h: Switch ETEK ET7304 to use a fallback compatible As stated in [1], ETEK ET7304 is identical to Richtek RT1715, except for the VID value in its registers, so reflect it in the bindings via a fallback compatible. As there are various TCPCI chips by different vendors reimplementing the registers and behavior of the RT1711H/RT1715, fallback compatibles will scale better. Link: https://lore.kernel.org/all/20260220-et7304-v3-2-ede2d9634957@gmail.com/ [1] Signed-off-by: Alexey Charkov Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260318-husb311-v4-2-69e029255430@flipper.net Signed-off-by: Greg Kroah-Hartman commit 5bda9c0261bce6a70bd7cb9afa0551c2fdf4ebc1 Author: Alexey Charkov Date: Wed Mar 18 18:32:53 2026 +0400 dt-bindings: vendor-prefixes: Add Hynetek Semiconductor Co., Ltd. Hynetek Semiconductor Co., Ltd. focuses on intelligent energy control technology, mainly for the intelligent fast charging and digital energy fields. Link: https://en.hynetek.com/ Acked-by: Conor Dooley Signed-off-by: Alexey Charkov Link: https://patch.msgid.link/20260318-husb311-v4-1-69e029255430@flipper.net Signed-off-by: Greg Kroah-Hartman commit 764c2e6e60bf17910d84e7179fee14129e053b96 Author: Chukun Pan Date: Thu Mar 26 18:00:10 2026 +0800 usb: dwc3: Add optional VBUS regulator support to SpacemiT K1 Some SpacemiT K1 boards (like OrangePi R2S) provide USB VBUS through a controllable regulator. Add support for the optional vbus-supply property so the regulator can be properly managed in host mode instead of left always-on. Note that this doesn't apply to USB Hub downstream ports with different VBUS supplies. The enabled and disabled actions of the regulator are handled automatically by devm_regulator_get_enable_optional(). Signed-off-by: Chukun Pan Acked-by: Thinh Nguyen Reviewed-by: Anand Moon Link: https://patch.msgid.link/20260326100010.3588454-2-amadeus@jmu.edu.cn Signed-off-by: Greg Kroah-Hartman commit c05cf9d274daf72dc7e433480cf2e0e888f6bd89 Author: Yixun Lan Date: Fri Mar 20 07:15:38 2026 +0000 usb: dwc3: dwc3-generic-plat: spacemit: add support for K3 SoC Add support for the DWC3 USB controller which found in SpacemiT K3 SoC. Acked-by: Thinh Nguyen Signed-off-by: Yixun Lan Link: https://patch.msgid.link/20260320-02-k3-usb20-support-v2-2-308ea0e44038@kernel.org Signed-off-by: Greg Kroah-Hartman commit e7e86965a69d0f6797116e54dda01b56deca71c0 Author: Yixun Lan Date: Fri Mar 20 07:15:37 2026 +0000 dt-bindings: usb: dwc3: spacemit: add support for K3 SoC Add compatible string for DWC3 USB controller found in SpacemiT K3 SoC. The USB2.0 host controller in K3 SoC actually use DWC3 IP but only support USB2.0 functionality, thus in the hardware layer, it has only one USB2 PHY. While in K1 SoC, the USB controller has both USB2 and USB3 Combo PHY connected, but able to work in a reduced USB2.0 mode which requres only one USB2 PHY, leaves the USB3 Combo PHY to PCIe controller. So both K1 and K3 SoC are able to work in the USB2.0 mode which requires one PHY. Explicitly reduce number of phy property to minimal one. Signed-off-by: Yixun Lan Acked-by: Conor Dooley Link: https://patch.msgid.link/20260320-02-k3-usb20-support-v2-1-308ea0e44038@kernel.org Signed-off-by: Greg Kroah-Hartman commit 091ef6f503f49cdb3b19542b23f3cfd3e80a5f11 Author: Kexin Sun Date: Sat Mar 21 19:00:06 2026 +0800 usb: gadget: udc: update outdated comment for renamed usb_gadget_udc_start() The function usb_gadget_udc_start() was renamed to usb_gadget_udc_start_locked() by commit 286d9975a838 ("usb: gadget: udc: core: Prevent soft_connect_store() race"). Update the comment in usb_gadget_udc_set_speed() accordingly. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260321110006.8484-1-kexinsun@smail.nju.edu.cn Signed-off-by: Greg Kroah-Hartman commit 35a99b690c9e0cf7e2ff70934e7a985839193948 Author: Xu Yang Date: Thu Mar 19 17:48:49 2026 +0800 usb: typec: tcpci: support setting orientation via GPIO If the chip indicates its "Connection Orientation" standard output control in STANDARD_OUTPUT_CAPABILITIES register, it can do the thing by programming CONFIG_STANDARD_OUTPUT register. Due to the optional feature, the chip which not present this capability currently doesn't have a way to correctly set the data path. This add the support to set orientation via a simple GPIO. Signed-off-by: Xu Yang Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260319-support-setting-orientation-use-gpio-v4-2-ab6dfa8610c2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 7ef80d637e8da8ae6a0a277068ebc6a56451a9b3 Author: Xu Yang Date: Thu Mar 19 17:48:48 2026 +0800 dt-bindings: usb: nxp,ptn5110: add optional orientation-gpios property The Type-C chip know the cable orientation and then normally will set the switch channel to correctly configure the data path. Some chips itself support to output the control signal by indicating the capability in bit[0] of STANDARD_OUTPUT_CAPABILITIES register and do it in CONFIG_STANDARD_OUTPUT register. For PTN5110 which doesn't present this capability currently there is no way to achieve the orientation setting. Add an optional "orientation-gpios" property to achieve the same purpose. Acked-by: Rob Herring (Arm) Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260319-support-setting-orientation-use-gpio-v4-1-ab6dfa8610c2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 4f95526e65fadb06595e4e57c68fce97a361d13f Author: Neil Armstrong Date: Tue Mar 24 10:23:22 2026 +0100 dt-bindings: usb: document the Renesas UPD720201/UPD720202 USB 3.0 xHCI Host Controller Document the Renesas UPD720201/UPD720202 USB 3.0 xHCI Host Controller, which connects over PCIe and requires specific power supplies to start up. Reviewed-by: Rob Herring (Arm) Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260324-topic-sm8650-ayaneo-pocket-s2-upd-bindings-v2-1-b86a1543b76b@linaro.org Signed-off-by: Greg Kroah-Hartman commit e44297dd2b75e4929a44cc0242d05f6f83d7c177 Author: Alexander Stein Date: Fri Mar 13 15:12:19 2026 +0100 dt-bindings: usb: ti,usb8041: Support nested USB hubs Onboard USB hubs might be nested. Add the reference for the generic usb-hub.yaml binding and lift the restriction on peer-hub. A (downstream) hub might only be connected on USB High-Speed lines. Signed-off-by: Alexander Stein Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260313141220.1843488-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman commit edcef7bf2cef8ef0c6bdc0ca1ad7e3b2405cd6fd Author: Abel Vesa Date: Wed Mar 18 10:13:22 2026 +0200 dt-bindings: usb: qcom,snps-dwc3: Document the Eliza compatible Document the compatible for the Qualcomm Synopsys DWC3 glue controller found on Eliza SoC. It follows the same binding requirements as other recent Qualcomm SoCs, so add it to the existing schema conditionals covering the required properties. Signed-off-by: Abel Vesa Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260318-eliza-bindings-dwc3-v1-1-92bdf233cb87@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 448f428a4b54bb589a6da1f23edcb941098e2953 Author: Nicolas Chauvet Date: Mon Mar 23 15:02:48 2026 +0100 usb: tegra: use MODULE_FIRMWARE if SOC is ENABLED This allows to reduce the size of the initramfs by only selecting the related firmware when a given SOC is enabled. Signed-off-by: Nicolas Chauvet Link: https://patch.msgid.link/20260323140249.173603-1-kwizart@gmail.com Signed-off-by: Greg Kroah-Hartman commit a402532ab855620e02a16950aea86fc621c6f87c Author: Pengpeng Hou Date: Mon Mar 23 20:17:30 2026 +0800 usb: gadget: bdc: validate status-report endpoint indices bdc_sr_xsf() decodes a 5-bit endpoint number from the hardware status report and uses it to index bdc->bdc_ep_array[] directly. The array is only allocated to bdc->num_eps for the current controller instance, so a status report can carry an endpoint number that still fits the 5-bit field but does not fit the runtime-sized endpoint table. Reject status reports whose endpoint number is outside bdc->num_eps before indexing the endpoint array. Signed-off-by: Pengpeng Hou Reviewed-by: Florian Fainelli Tested-by: Justin Chen Link: https://patch.msgid.link/20260323121730.75245-1-pengpeng@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit d4cdecadbd400a017c3d2a0150fd16d973950e5d Author: Oliver Neukum Date: Wed Mar 25 18:12:57 2026 +0100 usb: misc: iowarrior: use HID includes The driver uses its own definitions for HID requests. This leads to duplication and obfuscation. Use HID's definitions. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260325171311.384010-2-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 0f93a753f9fbd6d9674393714f8663cff2168b93 Author: Oliver Neukum Date: Wed Mar 25 18:12:56 2026 +0100 usb: misc: appledisplay: use HID includes The driver uses its own definitions for HID requests. This leads to duplication and obfuscation. Use HID's definitions. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260325171311.384010-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 922b9937db0e22d2bc4bac1e61df63679671c56c Merge: 5a623ef758d0a8 292d64fb98a267 Author: Mark Brown Date: Mon Mar 30 15:45:39 2026 +0100 regulator: mt6315: add regulator supplies Chen-Yu Tsai says: This series is part of a broader collection of regulator related cleanups for MediaTek Chromebooks. This one covers the MT6315 PMIC. Patch 1 adds the names of the power supply inputs to the binding. Patch 2 adds the supply names from the DT binding change in patch 1 to the regulator descriptions in the driver. This patch has a checkpatch.pl warnings, but I wonder if it's because the context size for checking complex macros is not large enough. Device tree changes will be sent separately. The goal is to get the regulator tree as complete as possible. This includes adding supply names to other regulator DT bindings, and adding all the supply links to the existing DTs. commit 292d64fb98a267450113b696f1ffcc24548cc2fe Author: Chen-Yu Tsai Date: Thu Mar 26 16:10:49 2026 +0800 regulator: mt6315: Add regulator supplies The MT6315 family of PMICs has 4 buck regulators. Each regulator has a separate supply. Add these supplies to the driver. Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260326081050.1115201-3-wenst@chromium.org Signed-off-by: Mark Brown commit d15d0f1a27b29cc39bce2a7cdcde46c40db68d07 Author: Chen-Yu Tsai Date: Thu Mar 26 16:10:48 2026 +0800 regulator: dt-bindings: mt6315: Add regulator supplies The MT6315 family of PMICs has 4 buck regulators. Each regulator has a separate supply. Add these supplies to the device tree binding. Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260326081050.1115201-2-wenst@chromium.org Signed-off-by: Mark Brown commit 5a623ef758d0a8384da548bb3f026e623544b2cf Author: Luca Weiss Date: Mon Mar 30 16:14:13 2026 +0200 regulator: devres: Use enum regulator_get_type in internal functions The enum regulator_get_type has been available since 2017, so use that enum instead of an "untyped" int in the three functions where "get_type" is used. No functional change intended. Suggested-by: Griffin Kroah-Hartman Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20260330-regulator-devres-type-v1-1-d2c244576845@fairphone.com Signed-off-by: Mark Brown commit b683730e27ba4f91986c4c92f5cb7297f1e01a6d Author: Alexander Koskovich Date: Sun Mar 8 04:26:37 2026 +0000 arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP This resolves the following error seen on the ASUS ROG Phone 3: cpu cpu7: Voltage update failed freq=3091200 cpu cpu7: failed to update OPP for freq=3091200 Fixes: 8e0e8016cb79 ("arm64: dts: qcom: sm8250: Add CPU opp tables") Signed-off-by: Alexander Koskovich Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260307-sm8250-cpu7-opp-v1-1-435f5f6628a1@pm.me Signed-off-by: Bjorn Andersson commit 40c15162c873a481cb0e57f8aaa743a4bc66432f Author: Vladimir Zapolskiy Date: Wed Mar 11 02:12:38 2026 +0200 arm64: dts: qcom: sm8550-hdk: add support for the Display Card overlay The SM8550-HDK board may be connected to a Display Card external PCB, which is identical to the already supported SM8650-HDK Display Card, it provides a VTDR6130 display with Goodix Berlin Touch controller, see also commit bc90f56a1699 ("arm64: dts: sm8650-hdk: add support for the Display Card overlay") for additional details. Two overlays are added to support SM8550-HDK plus Display Card and SM8550-HDK plus Display Card plus Rear Camera Card setups. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260311001238.4191034-1-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit 181ea4e2de422aa0a66f355bd59bccccdd169826 Author: Hans Holmberg Date: Wed Mar 25 13:43:12 2026 +0100 xfs: start gc on zonegc_low_space attribute updates Start gc if the agressiveness of zone garbage collection is changed by the user (if the file system is not read only). Without this change, the new setting will not be taken into account until the gc thread is woken up by e.g. a write. Cc: stable@vger.kernel.org # v6.15 Fixes: 845abeb1f06a8a ("xfs: add tunable threshold parameter for triggering zone GC") Signed-off-by: Hans Holmberg Reviewed-by: Christoph Hellwig Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 8166876aadef90744bb26addc9c5a16b1c8341b5 Author: Christoph Hellwig Date: Mon Mar 23 08:50:54 2026 +0100 xfs: don't decrement the buffer LRU count for in-use buffers XFS buffers are added to the LRU when they are unused, but are only removed from the LRU lazily when the LRU list scan finds a used buffer. So far this only happen when the LRU counter hits 0, which is suboptimal as buffers that were added to the LRU, but are in use again still consume LRU scanning resources and are aged while actually in use. Fix this by checking for in-use buffers and removing the from the LRU before decrementing the LRU counter. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 497560b9ef42a4ab22ada7f1ea975a89cd3c5dfa Author: Christoph Hellwig Date: Mon Mar 23 08:50:53 2026 +0100 xfs: switch (back) to a per-buftarg buffer hash The per-AG buffer hashes were added when all buffer lookups took a per-hash look. Since then we've made lookups entirely lockless and removed the need for a hash-wide lock for inserts and removals as well. With this there is no need to sharding the hash, so reduce the used resources by using a per-buftarg hash for all buftargs. Long after writing this initially, syzbot found a problem in the buffer cache teardown order, which this happens to fix as well by doing the entire buffer cache teardown in one places instead of splitting it between destroying the buftarg and the perag structures. Link: https://lore.kernel.org/linux-xfs/aLeUdemAZ5wmtZel@dread.disaster.area/ Reported-by: syzbot+0391d34e801643e2809b@syzkaller.appspotmail.com Reviewed-by: Darrick J. Wong Tested-by: syzbot+0391d34e801643e2809b@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig Reviewed-by: Brian Foster Signed-off-by: Carlos Maiolino commit d02ee47bbeedd10d36cc408f92e645447cf5495d Author: Christoph Hellwig Date: Mon Mar 23 08:50:52 2026 +0100 xfs: use a lockref for the buffer reference count The lockref structure allows incrementing/decrementing counters like an atomic_t for the fast path, while still allowing complex slow path operations as if the counter was protected by a lock. The only slow path operations that actually need to take the lock are the final put, LRU evictions and marking a buffer stale. Signed-off-by: Christoph Hellwig Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 67fe4303972eb6f911f62e2fe6ac7628b17d95c0 Author: Christoph Hellwig Date: Mon Mar 23 08:50:51 2026 +0100 xfs: don't keep a reference for buffers on the LRU Currently the buffer cache adds a reference to b_hold for buffers that are on the LRU. This seems to go all the way back and allows releasing buffers from the LRU using xfs_buf_rele. But it makes xfs_buf_rele really complicated in differs from how other LRUs are implemented in Linux. Switch to not having a reference for buffers in the LRU, and use a separate negative hold value to mark buffers as dead. This simplifies xfs_buf_rele, which now just deal with the last "real" reference, and prepares for using the lockref primitive. This also removes the b_lock protection for removing buffers from the buffer hash. This is the desired outcome because the rhashtable is fully internally synchronized, and previously the lock was mostly held out of ordering constrains in xfs_buf_rele_cached. Signed-off-by: Christoph Hellwig Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a0f64241d3566a49c0a9b33ba7ae458ae22003a9 Author: Sanjaikumar V S Date: Wed Mar 11 10:30:56 2026 +0000 mtd: spi-nor: sst: Fix write enable before AAI sequence When writing to SST flash starting at an odd address, a single byte is first programmed using the byte program (BP) command. After this operation completes, the flash hardware automatically clears the Write Enable Latch (WEL) bit. If an AAI (Auto Address Increment) word program sequence follows, it requires WEL to be set. Without re-enabling writes, the AAI sequence fails. Add spi_nor_write_enable() after the odd-address byte program when more data needs to be written. Use a local boolean for clarity. Fixes: b199489d37b2 ("mtd: spi-nor: add the framework for SPI NOR") Cc: stable@vger.kernel.org Signed-off-by: Sanjaikumar V S Tested-by: Hendrik Donner Reviewed-by: Hendrik Donner Signed-off-by: Pratyush Yadav (Google) commit 07b9712339e3ce1d183adef996c0f317adc9848d Author: Hrishabh Rajput Date: Wed Mar 11 11:16:30 2026 +0530 firmware: qcom: scm: Register gunyah watchdog device To restrict Gunyah watchdog initialization to Qualcomm platforms running under the Gunyah Hypervisor, register the watchdog device in the QCOM SCM driver. When Gunyah is not present or Gunyah emulates MMIO-based watchdog, we expect Qualcomm watchdog or ARM SBSA watchdog device to be present in the devicetree. First, we make sure we're running under the Gunyah Hypervisor. Then we move to check if any of the above mentioned watchdog device nodes are present, if not then we proceed to register the SMC-based Gunyah watchdog device. Reviewed-by: Dmitry Baryshkov Tested-by: Shivendra Pratap Tested-by: Neil Armstrong Signed-off-by: Hrishabh Rajput Signed-off-by: Pavankumar Kondeti Tested-by: Mukesh Ojha Link: https://lore.kernel.org/r/20260311-gunyah_watchdog-v8-1-4c1c0689de22@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5af11acae6608d3b1175aea86bac06f267c6db14 Author: Konrad Dybcio Date: Thu Mar 5 16:10:09 2026 +0530 clk: qcom: Add a driver for SM8750 GPU clocks Support the graphics clock controller for SM8750 for Graphics SW driver to use the clocks. GXCLKCTL (Graphics GX Clock Controller) is a block dedicated to managing clocks for the GPU subsystem on GX power domain. The GX clock controller driver manages only the GX GDSC and the rest of the resources of the controller are managed by the firmware. Update the compatible for Graphics GX Clock Controller for SM8750 as the GX clock controller is a reuse of the Kaanapali driver. Reviewed-by: Abel Vesa Signed-off-by: Konrad Dybcio Co-developed-by: Taniya Das Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20260305-gpucc_sm8750_v2-v5-2-78292b40b053@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4aeadf8a18dbbe4fbe2f8e6f03f48f3492c8d1d1 Author: Konrad Dybcio Date: Thu Mar 5 16:10:08 2026 +0530 dt-bindings: clock: qcom: Add SM8750 GPU clocks The SM8750 features a "traditional" GPU_CC block, much of which is controlled through the GMU microcontroller. GPU_CC block requires the MX and CX rail control and thus add the corresponding power-domains and require-opps. Additionally, there's an separate GX_CC block, where the GX GDSC is moved. Update the bindings to accommodate for SM8750 SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Konrad Dybcio Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20260305-gpucc_sm8750_v2-v5-1-78292b40b053@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5eb130177693c3470cafaf721af41c60dd891cc7 Author: Eliav Farber Date: Wed Feb 18 14:35:23 2026 +0000 mtd: spi-nor: winbond: Fix locking support for w25q64jvm The Winbond w25q64jvm supports block protection through the Status Register (SR) and provides a Top/Bottom (TB) protection bit. Enable SPI_NOR_HAS_LOCK and SPI_NOR_HAS_TB for this device to properly describe its locking capabilities. The device uses Status Register bit 5 as the TB bit and supports only three Block Protect (BP) bits. Therefore, do not set SPI_NOR_TB_SR_BIT6 or SPI_NOR_4BIT_BP. Reference: https://www.winbond.com/hq/support/documentation/levelOne.jsp?__locale=en&DocNo=DA00-W25Q64JV.1 Signed-off-by: Eliav Farber Reviewed-by: Michael Walle Signed-off-by: Pratyush Yadav (Google) commit 0f0b444be36c098d34a155bbe9e5a2f714a462fb Author: Eliav Farber Date: Wed Feb 18 14:35:21 2026 +0000 mtd: spi-nor: winbond: Fix locking support for w25q256jwm The Winbond w25q256jwm device supports four Block Protect (BP) bits and uses Status Register bit 6 as the Top/Bottom (TB) protect bit. Update the flash parameters by enabling SPI_NOR_4BIT_BP and SPI_NOR_TB_SR_BIT6. Without these flags, the locking configuration is incorrect. Reference: https://www.winbond.com/hq/support/documentation/levelOne.jsp?__locale=en&DocNo=DA00-W25Q256JW.1 Signed-off-by: Eliav Farber Reviewed-by: Michael Walle Signed-off-by: Pratyush Yadav (Google) commit 1e28cdeec31333b165f72b6ad647652c4c6f6ff2 Author: Thorsten Blum Date: Sun Mar 29 18:31:46 2026 +0200 ASoC: codecs: inline i2c_check_functionality checks Inline i2c_check_functionality() checks, since the function returns a boolean status rather than an error code. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260329163152.366356-2-thorsten.blum@linux.dev Signed-off-by: Mark Brown commit 2ce450f77f1de5eb7b489fcd829a7f494952e1bf Author: Max McNamee Date: Mon Feb 23 22:05:14 2026 +0000 arm64: dts: qcom: msm8916-samsung-coreprimeltevzw: add device tree Samsung Galaxy Core Prime Verizon Wireless is a phone based on MSM8916. They are similar to the other Samsung devices based on MSM8916 with only a few minor differences. The device trees contain initial support with: - GPIO keys - Regulator haptic - SDHCI (internal and external storage) - USB Device Mode - UART (on USB connector via the SM5502 MUIC) - WCNSS (WiFi/BT) - Regulators - QDSP6 audio - Speaker/earpiece/headphones/microphones via digital/analog codec in MSM8916/PM8916 - WWAN Internet via BAM-DMUX - PMIC and charger - Touchscreen There are different variants of Core Prime, with some differences in NFC and MUIC. The common parts are shared in msm8916-samsung-fortuna-common.dtsi and msm8916-samsung-rossa-common.dtsi to reduce duplication. Signed-off-by: Max McNamee [Raymond: Refactor touchscreen and MUIC. Add commit messages.] Signed-off-by: Raymond Hackley Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260223220514.2556033-4-wonderfulshrinemaidenofparadise@postmarketos.org Signed-off-by: Bjorn Andersson commit bb0a09a4fa4821a5a1da1b707e0e169d6a4e8cd2 Author: Raymond Hackley Date: Mon Feb 23 22:05:13 2026 +0000 dt-bindings: qcom: Document samsung,coreprimeltevzw Document the new samsung,coreprimeltevzw device tree bindings used in msm8916-samsung-coreprimeltevzw. Signed-off-by: Raymond Hackley Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260223220514.2556033-3-wonderfulshrinemaidenofparadise@postmarketos.org Signed-off-by: Bjorn Andersson commit 21450547506ece7e36bef75681479a52e518c53b Author: Raymond Hackley Date: Mon Feb 23 22:05:12 2026 +0000 arm64: dts: qcom: msm8916-samsung-fortuna: Move SM5504 from rossa and refactor MUIC MUIC varies on fortuna/rossa devices, which could be either SM5502 or SM5504. Move SM5504 from msm8916-samsung-rossa-common to msm8916-samsung-fortuna-common and refactor MUIC. Disable MUIC by default in msm8916-samsung-fortuna-common, and explicitly specify them in each fortuna/rossa board. Signed-off-by: Raymond Hackley Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260223220514.2556033-2-wonderfulshrinemaidenofparadise@postmarketos.org Signed-off-by: Bjorn Andersson commit ada4280812a7a40455a842b1de24f8450e04254e Author: Jie Gan Date: Fri Mar 20 15:31:12 2026 +0800 coresight: platform: check the availability of the endpoint before parse Check endpoint availability before parsing it. If parsing a connected endpoint fails, the probe is deferred until the endpoint becomes available, or eventually fails. In some legacy cases, a replicator has two output ports where one is disabled and the other is available. The replicator probe always fails because the disabled endpoint never becomes available for parsing. In addition, there is no need to defer probing a device that is connected to a disabled device, which improves probe performance. Signed-off-by: Jie Gan Reviewed-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260320-add-availability-check-v1-1-b2e39cdeb6e0@oss.qualcomm.com commit 4e36f8ab45c406420f2c2ce6ee3988e0d13ba1c9 Author: John Crispin Date: Wed Mar 11 19:39:41 2026 +0100 clk: qcom: ipq-cmn-pll: Add IPQ8074 SoC support The CMN PLL in IPQ8074 SoC supplies fixed clocks to the networking subsystem: bias_pll_cc_clk at 300 MHz and bias_pll_nss_noc_clk at 416.5 MHz. Signed-off-by: John Crispin Signed-off-by: Christian Marangi Link: https://lore.kernel.org/r/20260311183942.10134-5-ansuelsmth@gmail.com Signed-off-by: Bjorn Andersson commit 7156c65030006e6930dd99c5b8c5e84e69ca5f0b Author: John Crispin Date: Wed Mar 11 19:39:40 2026 +0100 dt-bindings: clock: qcom: Add CMN PLL support for IPQ8074 The CMN PLL block in the IPQ8074 SoC takes 48 MHz as the reference input clock. Its output clocks are the bias_pll_cc_clk (300 MHz) and bias_pll_nss_noc_clk (416.5 MHz) clocks used by the networking subsystem. Add the related compatible for IPQ8074 to the ipq9574-cmn-pll generic schema. Signed-off-by: John Crispin Signed-off-by: Christian Marangi Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260311183942.10134-4-ansuelsmth@gmail.com Signed-off-by: Bjorn Andersson commit 97eb2ac52726fbb702ced40d552a3f6f2683b664 Author: John Crispin Date: Wed Mar 11 19:39:39 2026 +0100 clk: qcom: ipq-cmn-pll: Add IPQ6018 SoC support The CMN PLL in IPQ6018 SoC supplies fixed clocks to the networking subsystem: bias_pll_cc_clk at 300 MHz and bias_pll_nss_noc_clk at 416.5 MHz. Signed-off-by: John Crispin Signed-off-by: Christian Marangi Link: https://lore.kernel.org/r/20260311183942.10134-3-ansuelsmth@gmail.com Signed-off-by: Bjorn Andersson commit a57666004f49fa5031d6bf388834213e6f961922 Author: John Crispin Date: Wed Mar 11 19:39:38 2026 +0100 dt-bindings: clock: qcom: Add CMN PLL support for IPQ6018 The CMN PLL block in the IPQ6018 SoC takes 48 MHz as the reference input clock. Its output clocks are the bias_pll_cc_clk (300 MHz) and bias_pll_nss_noc_clk (416.5 MHz) clocks used by the networking subsystem. Add the related compatible for IPQ6018 to the ipq9574-cmn-pll generic schema. Signed-off-by: John Crispin Signed-off-by: Christian Marangi Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260311183942.10134-2-ansuelsmth@gmail.com Signed-off-by: Bjorn Andersson commit 3aa997129993135ff1e11128e216af814e72f0a0 Author: Richard Acayan Date: Mon Feb 9 21:19:57 2026 -0500 arm64: dts: qcom: sdm670: add llcc Add the Last Level Cache Controller (LLCC) for the SDM670. Signed-off-by: Richard Acayan Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260210021957.13357-4-mailingradian@gmail.com Signed-off-by: Bjorn Andersson commit 1d44de258d34f33aadda67d69dae5a8427b9d2c7 Author: Luca Weiss Date: Thu Mar 19 16:36:29 2026 +0100 arm64: dts: qcom: qcm6490-fairphone-fp5: Add front camera support Add and configure the necessary nodes to enable the front camera (Samsung S5KJN1), connected to CSIPHY 3. Reviewed-by: Konrad Dybcio Reviewed-by: Vladimir Zapolskiy Signed-off-by: Luca Weiss Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20260319-fp5-s5kjn1-v3-2-9cf4b8c09567@fairphone.com Signed-off-by: Bjorn Andersson commit e7fc3c46dc09c1c5f901f1a627d9bffc6321081c Author: Luca Weiss Date: Thu Mar 19 16:36:28 2026 +0100 arm64: dts: qcom: qcm6490-fairphone-fp5: Sort pinctrl nodes by pins As per DTS Coding Style, sort pinctrl subnodes by the "pins" property, in preparation to add more pinctrl states. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260319-fp5-s5kjn1-v3-1-9cf4b8c09567@fairphone.com Signed-off-by: Bjorn Andersson commit 924d734960062b0665d551c82489ad2cb4d96e80 Author: Luca Weiss Date: Fri Mar 20 09:09:51 2026 +0100 arm64: dts: qcom: milos-fairphone-fp6: Add camera EEPROMs on CCI busses Enable the CCI I2C busses and add nodes for the EEPROMs found on the camera that are connected there. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20260320-milos-cci-v2-3-1947fc83f756@fairphone.com Signed-off-by: Bjorn Andersson commit e9e75b3e622bccefe3ccc7e167e36f58369a388d Author: Luca Weiss Date: Fri Mar 20 09:09:50 2026 +0100 arm64: dts: qcom: milos: Add CCI busses Add the nodes and the pinctrl for the CCI I2C busses on the Milos SoC. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20260320-milos-cci-v2-2-1947fc83f756@fairphone.com Signed-off-by: Bjorn Andersson commit f55fa3e3dcd8f766266fdf878994f0ec09459a7d Author: Lei wang Date: Sat Mar 21 11:23:07 2026 -0400 soc: qcom: socinfo: Add SoC ID for SA8650P Add SoC ID table entry for Qualcomm SA8650P. Signed-off-by: Lei wang Signed-off-by: Radu Rendec Reviewed-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260321152307.9131-3-rrendec@redhat.com Signed-off-by: Bjorn Andersson commit a559a742c95c55ae3b347f2b57d26830c0cdd566 Author: Lei wang Date: Sat Mar 21 11:23:06 2026 -0400 dt-bindings: arm: qcom,ids: Add SoC ID for SA8650P Add unique ID for Qualcomm SA8650P SoC. Signed-off-by: Lei wang Signed-off-by: Radu Rendec Reviewed-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260321152307.9131-2-rrendec@redhat.com Signed-off-by: Bjorn Andersson commit 0ff62b7f1b355d4cc0568d73e5911683bdcfe1e7 Author: Gopikrishna Garmidi Date: Sun Mar 22 23:27:39 2026 -0700 firmware: qcom: scm: Allow QSEECOM on Mahua CRD Add Mahua CRD board to the QSEECOM allowlist for enabling access to efivars and uefi bootloader. Signed-off-by: Gopikrishna Garmidi Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260322-mahua-qcom_scm-support-v1-1-00c50db332ee@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7658e9b94849ca861ded82d641f52fcec303210d Author: Pradeep P V K Date: Mon Mar 23 18:17:53 2026 +0530 arm64: dts: qcom: purwa-iot-evk: Enable UFS Enable UFS for purwa-iot-evk board. Signed-off-by: Pradeep P V K Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260323-purwa-ufs-v2-1-58fb2c168786@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 908061f0ad30aa08ce211c6a8f95d29102e570bd Author: Rosen Penev Date: Thu Mar 26 19:55:34 2026 -0700 soc: qcom: wcnss: simplify allocation of req Get rid of automatic kfree and move allocation down to where it's used. Use kzalloc_flex as we're dealing with a flexible array member. Use struct_size to avoid some pointer math. Add __counted_by for extra runtime analysis. Move the counting variable assignment to right after allocation as required by __counted_by. Signed-off-by: Rosen Penev Link: https://lore.kernel.org/r/20260327025534.7864-1-rosenp@gmail.com Signed-off-by: Bjorn Andersson commit 7f390d6ccbaa3313758b172fd8cbadc6c652c48a Author: Krzysztof Kozlowski Date: Fri Mar 27 11:12:26 2026 +0100 arm64: dts: qcom: eliza: Add thermal sensors Add TSENS thermal sensors to Qualcomm Eliza SoC among with thermal zones. The TSENS is compatible with previous generations. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260327101225.382493-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2f4c5dea9a285cc24a80e9fef8d7014bffce967b Author: Pengyu Luo Date: Sun Mar 8 14:48:35 2026 +0800 arm64: dts: qcom: sc8280xp: Add dsi nodes on SC8280XP The DT configuration follows other Samsung 5nm-based Qualcomm SOCs, utilizing the same register layouts and clock structures. However, DSI won't work properly for now until we submit dispcc fixes. And some DSC enabled panels require DPU timing calculation fixes too. (hdisplay / width timing round errors cause the fifo error) Co-developed-by: Tianyu Gao Signed-off-by: Tianyu Gao Signed-off-by: Pengyu Luo Tested-by: White Lewis # HUAWEI Gaokun3 Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260308064835.479356-5-mitltlatltl@gmail.com Signed-off-by: Bjorn Andersson commit 57000fe6a60421b35ce51a338cc33caf057f5795 Author: Pablo Alessandro Santos Hugen Date: Fri Mar 20 17:11:17 2026 -0300 selftests/livepatch: add test for module function patching Add a target module and livepatch pair that verify module function patching via a proc entry. Two test cases cover both the klp_enable_patch path (target loaded before livepatch) and the klp_module_coming path (livepatch loaded before target). Signed-off-by: Pablo Alessandro Santos Hugen Acked-by: Miroslav Benes Acked-by: Joe Lawrence Reviewed-by: Petr Mladek Tested-by: Petr Mladek Link: https://patch.msgid.link/20260320201135.1203992-1-phugen@redhat.com Signed-off-by: Petr Mladek commit 79c9ede455820e179608f9d52584c74d19e13fb0 Author: Abel Vesa Date: Fri Mar 27 16:22:33 2026 +0200 soc: qcom: pd-mapper: Add support for Eliza Add support for the Qualcomm Eliza SoC to the protection domain mapper. It has the same exact protection domain configuration as SM8550 SoC, so reuse that. Signed-off-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260327-eliza-soc-pd-mapper-v1-1-17334d6ab82d@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7a4790b1a2c9ff66bd7a95d8761d5e9fc9334ba9 Author: David Heidelberg Date: Fri Mar 27 14:07:09 2026 +0100 arm64: dts: qcom: sdm845-oneplus: Describe Wi-Fi/BT properly The onboard Wi-Fi / BT device, WCN3990, has a simple on-chip PMU, which further spreads generated voltage. Describe the PMU in the device tree and rewire Bluetooth and WiFi supply properties to use the PMU LDO outputs instead of referencing the SoC regulators directly. Verified against the datasheet. Assisted-by: Claude:claude-opus-4.6 Signed-off-by: David Heidelberg Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260327-wcn3990-pwrctl-sdm845-v1-2-3f5c34e3fdd0@ixit.cz Signed-off-by: Bjorn Andersson commit 0a9c8715663998dc4d8eaa8f1a40440214906d96 Author: David Heidelberg Date: Fri Mar 27 14:07:08 2026 +0100 arm64: dts: qcom: sdm845-google: Describe Wi-Fi/BT properly The onboard Wi-Fi / BT device, WCN3990, has a simple on-chip PMU, which further spreads generated voltage. Describe the PMU in the device tree and rewire Bluetooth and Wi-Fi supply properties to use the PMU LDO outputs instead of referencing the SoC regulators directly. Couldn't verify the swctrl GPIO thus omitted. Assisted-by: Claude:claude-opus-4.6 Signed-off-by: David Heidelberg Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260327-wcn3990-pwrctl-sdm845-v1-1-3f5c34e3fdd0@ixit.cz Signed-off-by: Bjorn Andersson commit c7c8ed27b71272fad8049d34257cf8ce3e37b097 Author: Tobias Heider Date: Sat Mar 28 16:49:22 2026 +0100 arm64: dts: qcom: drop redundant zap-shader memory-region This is already defined in the gpu_zap_shader node in hamoa.dtsi, there is no need to redefine it. Signed-off-by: Tobias Heider Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260328-zap-v1-2-f6810b9b4930@canonical.com Signed-off-by: Bjorn Andersson commit 79772ce80eb9615b69b00e77135bbfc6e4b6f158 Author: Tobias Heider Date: Sat Mar 28 16:49:21 2026 +0100 arm64: dts: qcom: fix remaining gpu_zap_shader labels Most qcom DTs were converted to use the gpu_zap_shader label instead of patching the gpu node in commit 2377626fd216 ("arm64: dts: qcom: add gpu_zap_shader label"). This fixes the remaining ones. Signed-off-by: Tobias Heider Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260328-zap-v1-1-f6810b9b4930@canonical.com Signed-off-by: Bjorn Andersson commit 16ba98dace9e7cfe25ad8a314e34befacd91f86f Author: Vladimir Zapolskiy Date: Sat Mar 28 03:26:19 2026 +0200 clk: qcom: gdsc: Fix error path on registration of multiple pm subdomains Some pm subdomains may be left in added to a parent domain state, if gdsc_add_subdomain_list() function fails in the middle and bails from a GDSC power domain controller registration out. Fixes: b489235b4dc0 ("clk: qcom: Support attaching GDSCs to multiple parents") Signed-off-by: Vladimir Zapolskiy Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20260328012619.832770-1-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit 25e7cc37cff444030250abea1ba875c26ff59e9a Author: Christopher Obbard Date: Sun Mar 29 14:12:26 2026 +0100 arm64: dts: qcom: msm8996: fix indentation in sdhc2 node Drop stray leading whitespace from sdhc2 node. No functional change. Signed-off-by: Christopher Obbard Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260329-wip-obbardc-msm8996-whitespace-v1-1-ba3a278f043c@linaro.org Signed-off-by: Bjorn Andersson commit 74620bf0c3c6091ecd7972075f5ddeba29994407 Author: Canfeng Zhuang Date: Fri Mar 27 16:31:01 2026 +0800 arm64: dts: qcom: monaco-evk: enable UART6 for robot expansion board The monaco-evk mezzanine connector supports a robot expansion board that requires UART6, which is currently disabled. This prevents the expansion board from exchanging data and control commands. Enable UART6 and assign the serial2 alias to provide stable device enumeration for the expansion board. Signed-off-by: Canfeng Zhuang Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260327083101.1343613-3-canfeng.zhuang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0be638f326c2015ae9406f4238d9bc54b5b7a584 Author: Canfeng Zhuang Date: Fri Mar 27 16:31:00 2026 +0800 arm64: dts: qcom: lemans-evk: enable UART0 for robot expansion board The lemans-evk mezzanine connector supports a robot expansion board that requires UART0, which is currently disabled. This prevents the expansion board from exchanging data and control commands. Enable UART0 and assign the serial2 alias to provide stable device enumeration for the expansion board. Signed-off-by: Canfeng Zhuang Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260327083101.1343613-2-canfeng.zhuang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e46b48b853122626806d989d5db4ce97eaaac2ca Author: Abel Vesa Date: Fri Mar 27 14:13:41 2026 +0200 arm64: dts: qcom: milos: Add missing CX power domain to GCC Unless CX is declared as the power-domain of GCC, votes (power and performance) on the GDSCs it provides will not propagate to the CX, which might result in under-voltage conditions. Add the missing power-domains property to associate GCC with RPMHPD_CX. Fixes: d9d59d105f98 ("arm64: dts: qcom: Add initial Milos dtsi") Signed-off-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260327-dt-fix-milos-eliza-gcc-power-domains-v1-2-f14a22c73fe9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c412c6b13e2b17bf6a8573a113634f69982e2b0e Author: Abel Vesa Date: Fri Mar 27 14:13:40 2026 +0200 dt-bindings: clock: qcom: Add missing power-domains property In order for the GCC votes on the GDSCs it provides to be propagated to CX, CX needs to be declared as power domain of the GCC. Document the missing power-domains property to that purpose. Fixes: 95ba6820a665 ("dt-bindings: clock: qcom: document the Milos Global Clock Controller") Signed-off-by: Abel Vesa Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260327-dt-fix-milos-eliza-gcc-power-domains-v1-1-f14a22c73fe9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f757451504c4eaa77b3f87fdbed7a11d1f80df29 Author: Erikas Bitovtas Date: Mon Mar 30 02:37:57 2026 +0300 arm64: dts: qcom: msm8939-asus-z00t: add regulators for ambient light and proximity sensor VCNL4000 includes support for regulators. Add regulators listed in the downstream device tree so they can be powered in during initialization. VLED supply is missing downstream, so it will be powered on by a dummy. Signed-off-by: Erikas Bitovtas Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260330-z00t-cm36686-regulators-v1-1-03e23b03bd70@gmail.com Signed-off-by: Bjorn Andersson commit cd3c4670db3ffe997be9548c7a9db3952563cf14 Author: Alok Tiwari Date: Sun Mar 29 12:53:23 2026 -0700 soc: qcom: aoss: compare against normalized cooling state qmp_cdev_set_cur_state() normalizes the requested state to a boolean (cdev_state = !!state). The existing early-return check compares qmp_cdev->state == state, which can be wrong if state is non-boolean (any non-zero value). Compare qmp_cdev->state against cdev_state instead, so the check matches the effective state and avoids redundant updates. Signed-off-by: Alok Tiwari Fixes: 05589b30b21a ("soc: qcom: Extend AOSS QMP driver to support resources that are used to wake up the SoC.") Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260329195333.1478090-1-alok.a.tiwari@oracle.com Signed-off-by: Bjorn Andersson commit 45ac3ced1b79fe25e135a0c5e5ad063166b8fd51 Author: Jingyi Wang Date: Mon Mar 30 02:39:42 2026 -0700 arm64: dts: qcom: kaanapali: Duplicate whitespace cleanup Exactly one space is expected before '{' characters, clean up duplicate whitespaces. Signed-off-by: Jingyi Wang Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260330-knp-space-cleanup-v1-1-0995302f7557@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 24e7625df5ce065393249b78930781be593bc381 Author: Alok Tiwari Date: Mon Mar 30 02:51:11 2026 -0700 soc: qcom: llcc: fix v1 SB syndrome register offset The llcc_v1_edac_reg_offset table uses 0x2304c for trp_ecc_sb_err_syn0, which is inconsistent with the surrounding TRP ECC registers (0x2034x) and with llcc_v2_1_edac_reg_offset, where trp_ecc_sb_err_syn0 is 0x2034c adjacent to trp_ecc_error_status0/1 at 0x20344/0x20348. Use 0x2034c for llcc v1 so the SB syndrome register follows the expected +0x4 progression from trp_ecc_error_status1. This fixes EDAC reading the wrong register for SB syndrome reporting. Fixes: c13d7d261e36 ("soc: qcom: llcc: Pass LLCC version based register offsets to EDAC driver") Signed-off-by: Alok Tiwari Reviewed-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260330095118.2657362-1-alok.a.tiwari@oracle.com Signed-off-by: Bjorn Andersson commit af0d19ea5a31261e1e3aebbe7c7e45c57c4df999 Author: Srinivas Kandagatla Date: Thu Mar 26 15:41:11 2026 +0000 arm64: dts: monaco: extend fastrpc compute cb For some reason we ended up adding only 4 out of 11 compute cb's for CDSP, add the missing compute cb. This will also improve the end user-experience by enabling running multiple AI usecases in parallel. Signed-off-by: Srinivas Kandagatla Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260326154111.2781802-1-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2ae624d5a555d47a735fb3f4d850402859a4db77 Author: John Groves Date: Fri Mar 27 21:05:21 2026 +0000 dax: export dax_dev_get() famfs needs to look up a dax_device by dev_t when resolving fmap entries that reference character dax devices. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: John Groves Link: https://patch.msgid.link/0100019d311daab5-bb212f0b-4e05-4668-bf53-d76fab56be68-000000@email.amazonses.com Signed-off-by: Ira Weiny commit eec38f5d86d27535509c99f02ccc642ceb0c3e2a Author: John Groves Date: Fri Mar 27 21:05:12 2026 +0000 dax: Add fs_dax_get() func to prepare dax for fs-dax usage The fs_dax_get() function should be called by fs-dax file systems after opening a fsdev dax device. This adds holder_operations, which provides a memory failure callback path and effects exclusivity between callers of fs_dax_get(). fs_dax_get() is specific to fsdev_dax, so it checks the driver type (which required touching bus.[ch]). fs_dax_get() fails if fsdev_dax is not bound to the memory. This function serves the same role as fs_dax_get_by_bdev(), which dax file systems call after opening the pmem block device. This can't be located in fsdev.c because struct dax_device is opaque there. This will be called by fs/fuse/famfs.c in a subsequent commit. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: John Groves Link: https://patch.msgid.link/0100019d311d8750-75395c22-031b-4d5f-aebe-790dca656b87-000000@email.amazonses.com Signed-off-by: Ira Weiny commit 700ecbc1f5aa02ba9ad68d7be1ef7a9c8eae07e9 Author: John Groves Date: Fri Mar 27 21:05:03 2026 +0000 dax: Add dax_set_ops() for setting dax_operations at bind time Add a new dax_set_ops() function that allows drivers to set the dax_operations after the dax_device has been allocated. This is needed for fsdev_dax where the operations need to be set during probe and cleared during unbind. The fsdev driver uses devm_add_action_or_reset() for cleanup consistency, avoiding the complexity of mixing devm-managed resources with manual cleanup in a remove() callback. This ensures cleanup happens automatically in the correct reverse order when the device is unbound. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: John Groves Link: https://patch.msgid.link/0100019d311d65a0-b9c1419e-f3a0-4afd-b0bd-848f18ff5950-000000@email.amazonses.com Signed-off-by: Ira Weiny commit 099c81a1f0ab3e948d73c5ab2b7a3b702af36e64 Author: John Groves Date: Fri Mar 27 21:04:54 2026 +0000 dax: Add dax_operations for use by fs-dax on fsdev dax fsdev: Add dax_operations for use by famfs. This replicates the functionality from drivers/nvdimm/pmem.c that conventional fs-dax file systems (e.g. xfs) use to support dax read/write/mmap to a daxdev - without which famfs can't sit atop a daxdev. - These methods are based on pmem_dax_ops from drivers/nvdimm/pmem.c - fsdev_dax_direct_access() returns the hpa, pfn and kva. The kva was newly stored as dev_dax->virt_addr by dev_dax_probe(). - The hpa/pfn are used for mmap (dax_iomap_fault()), and the kva is used for read/write (dax_iomap_rw()) - fsdev_dax_recovery_write() and dev_dax_zero_page_range() have not been tested yet. I'm looking for suggestions as to how to test those. - dax-private.h: add dev_dax->cached_size, which fsdev needs to remember. The dev_dax size cannot change while a driver is bound (dev_dax_resize returns -EBUSY if dev->driver is set). Caching the size at probe time allows fsdev's direct_access path can use it without acquiring dax_dev_rwsem (which isn't exported anyway). Signed-off-by: John Groves Link: https://patch.msgid.link/0100019d311d415a-bd6af0fe-5445-484c-9d39-210b8170b686-000000@email.amazonses.com Signed-off-by: Ira Weiny commit 759455848df0b9ac3acabdbedcdc4a55af67935f Author: John Groves Date: Fri Mar 27 21:04:44 2026 +0000 dax: Save the kva from memremap Save the kva from memremap because we need it for iomap rw support. Prior to famfs, there were no iomap users of /dev/dax - so the virtual address from memremap was not needed. Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: John Groves Link: https://patch.msgid.link/0100019d311d1d08-dd372cb9-5934-43b8-bef8-089660d04a81-000000@email.amazonses.com Signed-off-by: Ira Weiny commit d5406bd458b0ac10b1301a4d5801d85c8f648637 Author: John Groves Date: Fri Mar 27 21:04:35 2026 +0000 dax: add fsdev.c driver for fs-dax on character dax The new fsdev driver provides pages/folios initialized compatibly with fsdax - normal rather than devdax-style refcounting, and starting out with order-0 folios. When fsdev binds to a daxdev, it is usually (always?) switching from the devdax mode (device.c), which pre-initializes compound folios according to its alignment. Fsdev uses fsdev_clear_folio_state() to switch the folios into a fsdax-compatible state. A side effect of this is that raw mmap doesn't (can't?) work on an fsdev dax instance. Accordingly, The fsdev driver does not provide raw mmap - devices must be put in 'devdax' mode (drivers/dax/device.c) to get raw mmap capability. In this commit is just the framework, which remaps pages/folios compatibly with fsdax. Enabling dax changes: - bus.h: add DAXDRV_FSDEV_TYPE driver type - bus.c: allow DAXDRV_FSDEV_TYPE drivers to bind to daxdevs - dax.h: prototype inode_dax(), which fsdev needs Suggested-by: Dan Williams Suggested-by: Gregory Price Reviewed-by: Jonathan Cameron Signed-off-by: John Groves Link: https://patch.msgid.link/0100019d311cf904-419e9526-bdaf-4daa-97f1-5060b31a5c9f-000000@email.amazonses.com Signed-off-by: Ira Weiny commit 59eb73b98ae0b12fc9b39c08f0f5a5552cb02d1e Author: John Groves Date: Fri Mar 27 21:04:22 2026 +0000 dax: Factor out dax_folio_reset_order() helper Both fs/dax.c:dax_folio_put() and drivers/dax/fsdev.c: fsdev_clear_folio_state() (the latter coming in the next commit after this one) contain nearly identical code to reset a compound DAX folio back to order-0 pages. Factor this out into a shared helper function. The new dax_folio_reset_order() function: - Clears the folio's mapping and share count - Resets compound folio state via folio_reset_order() - Clears PageHead and compound_head for each sub-page - Restores the pgmap pointer for each resulting order-0 folio - Returns the original folio order (for callers that need to advance by that many pages) Two intentional differences from the original dax_folio_put() logic: 1. folio->share is cleared unconditionally. This is correct because the DAX subsystem maintains the invariant that share != 0 only when mapping == NULL (enforced by dax_folio_make_shared()). dax_folio_put() ensures share has reached zero before calling this helper, so the unconditional clear is safe. 2. folio->pgmap is now explicitly restored for order-0 folios. For the dax_folio_put() caller this is a no-op (reads and writes back the same field). It is intentional for the upcoming fsdev_clear_folio_state() caller, which converts previously-compound folios and needs pgmap re-established for all pages regardless of order. This simplifies fsdev_clear_folio_state() from ~50 lines to ~15 lines. Suggested-by: Jonathan Cameron Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: John Groves Link: https://patch.msgid.link/0100019d311cc6b9-5be7428a-7f16-4774-8f90-a44b88ac5660-000000@email.amazonses.com Signed-off-by: Ira Weiny commit a73cc506ad9f3798d33c78b212149b80d212111a Author: John Groves Date: Fri Mar 27 21:04:08 2026 +0000 dax: move dax_pgoff_to_phys from [drivers/dax/] device.c to bus.c This function will be used by both device.c and fsdev.c, but both are loadable modules. Moving to bus.c puts it in core and makes it available to both. No code changes - just relocated. Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: John Groves Link: https://patch.msgid.link/0100019d311c90eb-a582ff97-93ba-49f3-8140-6c5c4bf8bc62-000000@email.amazonses.com Signed-off-by: Ira Weiny commit 73e65c424867fb9396de6d1265228b75e1ee0718 Author: Johan Hovold Date: Mon Mar 9 09:12:59 2026 +0100 i2c: tegra: enable compile testing on all archs Commit 4a2d5f663dab ("i2c: Enable compile testing for more drivers") enabled compile testing of the Tegra i2c driver only for architectures that explicitly provide readsX() and writesX(). This limitation appears to have been too restrictive since the generic implementation of these primitives added by commit 9ab3a7a0d2b4 ("asm-generic/io.h: Implement generic {read,write}s*()") predates the commit in question. Allow compile testing of the driver on all architectures. Cc: Krzysztof Kozlowski Signed-off-by: Johan Hovold Signed-off-by: Wolfram Sang commit 802c51a83e9a0617d1e97ecd383471f4c6fd5437 Author: Bartosz Golaszewski Date: Mon Mar 30 10:36:03 2026 +0200 gpiolib: fix hogs with multiple lines After moving GPIO hog handling into GPIOLIB core, we accidentally stopped supporting devicetree hog definitions with multiple lines like so: hog { gpio-hog; gpios = <3 0>, <4 GPIO_ACTIVE_LOW>; output-high; line-name = "foo"; }; Restore this functionality to fix reported regressions. Fixes: d1d564ec4992 ("gpio: move hogs into GPIO core") Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/all/CAMuHMdX6RuZXAozrF5m625ZepJTVVr4pcyKczSk12MedWvoejw@mail.gmail.com/ Tested-by: Geert Uytterhoeven Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260330-gpio-hogs-multiple-v3-1-175c3839ad9f@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit cde64269eeb8099b4405aef8b19b90892a05352e Author: Bjorn Andersson Date: Mon Mar 23 21:32:39 2026 -0500 arm64: dts: qcom: qcs6490-rb3gen2: Enable uPD720201 and GL3590 The QCS6490 Rb3Gen2 has a Renesas μPD720201 XHCI controller hanging off the TC9563 PCIe switch, on this a Genesys Logic GL3590 USB hub provides two USB Type-A ports and an ASIX AX88179 USB 3.0 Gigabit Ethernet interface. The Renesas chip is powered by two regulators controlled through PM7250B GPIOs 1 and 4, and the power/reset pin is pulled down by PM8350C GPIO 4. The Genesys chip power is always-on, but the reset pin is controlled through TLMM GPIO 162. Describe the Renesas chip on the PCIe bus, with supplies and reset, to allow it to be brought out of reset and discovered. Then describe the two peers of the USB hub, with its reset GPIO, to allow this to be brought out of reset. The USB Type-A connectors are not described, as they are in no regard controlled by the operating system. Signed-off-by: Bjorn Andersson Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260323-rb3gen2-upd-gl3590-v2-1-073514bf9ed5@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3210dabba4e4aff7395b68914bad95153dda6db7 Author: Gui-Dong Han Date: Wed Mar 25 17:09:05 2026 +0800 driver core: simplify __device_set_driver_override() clearing logic Currently, __device_set_driver_override() handles clearing the override via empty string ("") and newline ("\n") in two separate paths. The "\n" case also performs an unnecessary memory allocation and immediate free. Simplify the logic by initializing 'new' to NULL and only allocating memory if the string length remains non-zero after stripping the trailing newline. Reduce code size, improve readability, and avoid unnecessary memory operations. No functional change intended. Suggested-by: Geert Uytterhoeven Link: https://lore.kernel.org/driver-core/DGS82WWLXPJ0.2EH4VJSF30UR5@kernel.org/ Signed-off-by: Gui-Dong Han Link: https://patch.msgid.link/20260325090905.169000-1-hanguidong02@gmail.com [ Narrow cp's scope to the newline handling block; use scoped_guard(). - Danilo ] Signed-off-by: Danilo Krummrich commit 8765715b4e8a1dd24ab5d507c42fc0bcd3d83f5c Author: Kuppuswamy Sathyanarayanan Date: Fri Mar 13 11:53:27 2026 -0700 powercap: intel_rapl: Remove unused AVERAGE_POWER primitive The AVERAGE_POWER primitive and RAPL_PRIMITIVE_DERIVED flag are not used anywhere in the code. Remove them to simplify the primitive handling logic. No functional changes. Co-developed-by: Zhang Rui Signed-off-by: Zhang Rui Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260313185333.2370733-2-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit f3b536878a3cf47e5193a96176a3ca2aaf0d848f Author: Randy Dunlap Date: Wed Mar 11 22:14:44 2026 -0700 powercap: correct kernel-doc function parameter names Use the correct function parameter names in kernel-doc comments to avoid these warnings: Warning: include/linux/powercap.h:254 function parameter 'name' not described in 'powercap_register_control_type' Warning: include/linux/powercap.h:298 function parameter 'nr_constraints' not described in 'powercap_register_zone' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260312051444.685136-1-rdunlap@infradead.org Signed-off-by: Rafael J. Wysocki commit 5247c783dc11eba298b3a6c03470125a67bf8cda Author: Thomas Weißschuh Date: Sat Mar 14 13:16:28 2026 +0100 m68k: uapi: Add ucontext.h ucontext.h should be an UAPI header as it is used for the kernel's signal handling interface. Move the header to the uapi/ directory. While at it, also add some necessary includes to the new header. Signed-off-by: Thomas Weißschuh Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260314-uapi-ucontext-m68k-v1-1-1b8b0e082b79@weissschuh.net Signed-off-by: Geert Uytterhoeven commit 1ba5f6fb44e9c7094a4ae4b4f79a4cc4d7ba188f Author: Geert Uytterhoeven Date: Mon Mar 2 11:25:19 2026 +0100 m68k: defconfig: hp300: Enable monochrome and 16-color linux logos According to "HP 9000 Series 300 Computers: Video Signals and Monitors"[1], HP Topcat and Catseye graphics hardware varieties support monochrome, 16-color, 64-color, and 256-color displays. Hence enable the standard black-and-white and 16-color Linux logos, too. [1] https://www.hp-series300.net/docs/monitors.pdf Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/51190cab2bb1adb9554aaaba9fae54342653a338.1772446429.git.geert@linux-m68k.org commit f89a28ec1aa8e768587a1cd0d22df8f63ee52834 Author: Thorsten Blum Date: Mon Feb 23 08:43:10 2026 +0100 m68k: q40: Remove commented out code The pr_info() call has been commented out and printq40() has been disabled ever since commit 1da177e4c3f4 ("Linux-2.6.12-rc2"). Remove both. Signed-off-by: Thorsten Blum Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260223074311.322070-2-thorsten.blum@linux.dev Signed-off-by: Geert Uytterhoeven commit 6771c54728c278bf1e4bfdab4fddbbb186e33498 Author: Nilay Shroff Date: Wed Mar 11 19:13:31 2026 +0530 powerpc/xive: fix kmemleak caused by incorrect chip_data lookup The kmemleak reports the following memory leak: Unreferenced object 0xc0000002a7fbc640 (size 64): comm "kworker/8:1", pid 540, jiffies 4294937872 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 09 04 00 04 00 00 ................ 00 00 a7 81 00 00 0a c0 00 00 08 04 00 04 00 00 ................ backtrace (crc 177d48f6): __kmalloc_cache_noprof+0x520/0x730 xive_irq_alloc_data.constprop.0+0x40/0xe0 xive_irq_domain_alloc+0xd0/0x1b0 irq_domain_alloc_irqs_parent+0x44/0x6c pseries_irq_domain_alloc+0x1cc/0x354 irq_domain_alloc_irqs_parent+0x44/0x6c msi_domain_alloc+0xb0/0x220 irq_domain_alloc_irqs_locked+0x138/0x4d0 __irq_domain_alloc_irqs+0x8c/0xfc __msi_domain_alloc_irqs+0x214/0x4d8 msi_domain_alloc_irqs_all_locked+0x70/0xf8 pci_msi_setup_msi_irqs+0x60/0x78 __pci_enable_msix_range+0x54c/0x98c pci_alloc_irq_vectors_affinity+0x16c/0x1d4 nvme_pci_enable+0xac/0x9c0 [nvme] nvme_probe+0x340/0x764 [nvme] This occurs when allocating MSI-X vectors for an NVMe device. During allocation the XIVE code creates a struct xive_irq_data and stores it in irq_data->chip_data. When the MSI-X irqdomain is later freed, xive_irq_free_data() is responsible for retrieving this structure and freeing it. However, after commit cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers"), xive_irq_free_data() retrieves the chip_data using irq_get_chip_data(), which looks up the data through the child domain. This is incorrect because the XIVE-specific irq data is associated with the XIVE (parent) domain. As a result the lookup fails and the allocated struct xive_irq_data is never freed, leading to the kmemleak report shown above. Fix this by retrieving the irq_data from the correct domain using irq_domain_get_irq_data() and then accessing the chip_data via irq_data_get_irq_chip_data(). Cc: stable@vger.kernel.org Fixes: cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers") Signed-off-by: Nilay Shroff Tested-by: Venkat Rao Bagalkote Reviewed-by: Nam Cao Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260311134336.326996-1-nilay@linux.ibm.com commit d1503aa9ab8057cb93367e0184528f61f7510845 Author: Ritesh Harjani (IBM) Date: Mon Mar 9 18:08:38 2026 +0530 powerpc/64s: Add support for huge pfnmaps This uses _RPAGE_SW2 bit for the PMD and PUDs similar to PTEs. This also adds support for {pte,pmd,pud}_pgprot helpers needed for follow_pfnmap APIs. This allows us to extend the PFN mappings, e.g. PCI MMIO bars where it can grow as large as 8GB or even bigger, to map at PMD / PUD level. VFIO PCI core driver already supports fault handling at PMD / PUD level for more efficient BAR mappings. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/6fca726574236f556dd4e1e259692e82a4c29e85.1773058761.git.ritesh.list@gmail.com commit 948b71aa81cd89b222942db6055e8d9c51c54e78 Author: Ritesh Harjani (IBM) Date: Mon Mar 9 18:08:37 2026 +0530 drivers/vfio_pci_core: Change PXD_ORDER check from switch case to if/else block Architectures like PowerPC uses runtime defined values for PMD_ORDER/PUD_ORDER. This is because it can use either RADIX or HASH MMU at runtime using kernel cmdline. So the pXd_index_size is not known at compile time. Without this fix, when we add huge pfn support on powerpc in the next patch, vfio_pci_core driver compilation can fail with the following errors. CC [M] drivers/vfio/vfio_main.o CC [M] drivers/vfio/group.o CC [M] drivers/vfio/container.o CC [M] drivers/vfio/virqfd.o CC [M] drivers/vfio/vfio_iommu_spapr_tce.o CC [M] drivers/vfio/pci/vfio_pci_core.o CC [M] drivers/vfio/pci/vfio_pci_intrs.o CC [M] drivers/vfio/pci/vfio_pci_rdwr.o CC [M] drivers/vfio/pci/vfio_pci_config.o CC [M] drivers/vfio/pci/vfio_pci.o AR kernel/built-in.a ../drivers/vfio/pci/vfio_pci_core.c: In function ‘vfio_pci_vmf_insert_pfn’: ../drivers/vfio/pci/vfio_pci_core.c:1678:9: error: case label does not reduce to an integer constant 1678 | case PMD_ORDER: | ^~~~ ../drivers/vfio/pci/vfio_pci_core.c:1682:9: error: case label does not reduce to an integer constant 1682 | case PUD_ORDER: | ^~~~ make[6]: *** [../scripts/Makefile.build:289: drivers/vfio/pci/vfio_pci_core.o] Error 1 make[6]: *** Waiting for unfinished jobs.... make[5]: *** [../scripts/Makefile.build:546: drivers/vfio/pci] Error 2 make[5]: *** Waiting for unfinished jobs.... make[4]: *** [../scripts/Makefile.build:546: drivers/vfio] Error 2 make[3]: *** [../scripts/Makefile.build:546: drivers] Error 2 Fixes: f9e54c3a2f5b7 ("vfio/pci: implement huge_fault support") Signed-off-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Reviewed-by: Alex Williamson Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/b155e19993ee1f5584c72050192eb468b31c5029.1773058761.git.ritesh.list@gmail.com commit c3aa64ab6a5ea553ee70526579908936a3ff9392 Author: Tom Lendacky Date: Tue Mar 24 10:13:01 2026 -0600 crypto/ccp: Update HV_FIXED page states to allow freeing of memory After SNP is disabled, any pages allocated as HV_FIXED can now be freed. Update the page state of these pages and the snp_leak_hv_fixed_pages() function to free pages on SNP_SHUTDOWN. Signed-off-by: Tom Lendacky Signed-off-by: Tycho Andersen (AMD) Signed-off-by: Borislav Petkov (AMD) Acked-by: Herbert Xu Link: https://patch.msgid.link/20260324161301.1353976-8-tycho@kernel.org commit 43fd83c0b1dc127cf13b4c05303665924e63ef94 Author: Eric Biggers Date: Sun Mar 29 13:49:52 2026 -0700 dm-crypt: Make crypt_iv_operations::post return void Since all implementations of crypt_iv_operations::post now return 0, change the return type to void. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit a1cf2bd5b6424ead3d75d09c822f665907094a80 Author: Colin Ian King Date: Sat Mar 28 12:33:20 2026 +0000 dm vdo: Fix spelling mistake "postive" -> "positive" There is a spelling mistake in a vdo_log_error message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Mikulas Patocka commit f995fc377ac7d3757e1d94e6403940c4b8f3d76e Author: Tycho Andersen (AMD) Date: Tue Mar 24 10:13:00 2026 -0600 crypto/ccp: Implement SNP x86 shutdown The SEV firmware has support to disable SNP during an SNP_SHUTDOWN_EX command. Verify that this support is available and set the flag so that SNP is disabled when it is not being used. In cases where SNP is disabled, skip the call to amd_iommu_snp_disable(), as all of the IOMMU pages have already been made shared. Also skip the panic case, since snp_shutdown() does IPIs. Signed-off-by: Tycho Andersen (AMD) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Acked-by: Herbert Xu Link: https://patch.msgid.link/20260324161301.1353976-7-tycho@kernel.org commit 6e1a833df9524e05889cf0fe02879b02d85776fd Author: Andreas Gruenbacher Date: Sat Mar 14 00:41:05 2026 +0100 gfs2: bufdata allocation race The locking in gfs2_trans_add_data() and gfs2_trans_add_meta() doesn't follow the usual coding pattern of checking bh->b_private under lock, allocating a new bufdata object with the locks dropped, and re-checking once the lock has been reacquired. Both functions set bh->b_private without holding the buffer lock. Fix that. Also, in gfs2_trans_add_meta(), taking the folio lock during the allocation doesn't actually do anything useful. Signed-off-by: Andreas Gruenbacher commit 8b793a92d862c89055daa97ffa61a6929cf732f9 Author: Ingo Molnar Date: Sun Dec 14 09:46:49 2025 +0100 x86/cpu: Remove M486/M486SX/ELAN support In the x86 architecture we have various complicated hardware emulation facilities on x86-32 to support ancient 32-bit CPUs that very very few people are using with modern kernels. This compatibility glue is sometimes even causing problems that people spend time to resolve, which time could be spent on other things. As Linus recently remarked: > I really get the feeling that it's time to leave i486 support behind. > There's zero real reason for anybody to waste one second of > development effort on this kind of issue. Implement the first step and remove M486/M486SX/ELAN support: CONFIG_M486SX CONFIG_M486 CONFIG_MELAN [ There's no recent M486=y kernel package for any mainstream x86 32-bit distribution available that I've been able to find, so actual users should not be impacted, and any legacy users can keep using older kernels. ] Suggested-by: Linus Torvalds Signed-off-by: Ingo Molnar Reviewed-by: Arnd Bergmann Acked-by: Dave Hansen Cc: Ahmed S. Darwish Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: H. Peter Anvin Cc: John Ogness Link: https://patch.msgid.link/20251214084710.3606385-2-mingo@kernel.org commit a549fe22376f5c312d9f61965184265425c8fd28 Author: Kathiravan Thirumoorthy Date: Mon Mar 30 10:21:05 2026 +0530 pinctrl: qcom: Introduce IPQ5210 TLMM driver Qualcomm's IPQ5210 SoC comes with a TLMM block, like all other platforms, so add a driver for it. Reviewed-by: Konrad Dybcio Reviewed-by: Bjorn Andersson Signed-off-by: Kathiravan Thirumoorthy [linusw@kernel.org: Dropped intr_target_reg] Signed-off-by: Linus Walleij commit c0dd33f0e9ab253ac45a1df74f9933f399e9115f Author: Kathiravan Thirumoorthy Date: Mon Mar 30 10:21:04 2026 +0530 dt-bindings: pinctrl: qcom: add IPQ5210 pinctrl Add device tree bindings for IPQ5210 TLMM block. Reviewed-by: Bjorn Andersson Reviewed-by: Krzysztof Kozlowski Signed-off-by: Kathiravan Thirumoorthy Signed-off-by: Linus Walleij commit 6ad36f39a7691bb59d2486efd467710fcbebee62 Author: Wang Yechao Date: Mon Mar 30 16:12:58 2026 +0800 RISC-V: KVM: Split huge pages during fault handling for dirty logging During dirty logging, all huge pages are write-protected. When the guest writes to a write-protected huge page, a page fault is triggered. Before recovering the write permission, the huge page must be split into smaller pages (e.g., 4K). After splitting, the normal mapping process proceeds, allowing write permission to be restored at the smaller page granularity. If dirty logging is disabled because migration failed or was cancelled, only recover the write permission at the 4K level, and skip recovering the huge page mapping at this time to avoid the overhead of freeing page tables. The huge page mapping can be recovered in the ioctl context, similar to x86, in a later patch. Signed-off-by: Wang Yechao Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/202603301612587174XZ6QMCrymBqv30S6BN50@zte.com.cn Signed-off-by: Anup Patel commit a216e24fc947573bfbd56471bd7c1f1d8c7a2b19 Author: Wang Yechao Date: Mon Mar 30 16:10:52 2026 +0800 RISC-V: KVM: Fix lost write protection on huge pages during dirty logging When enabling dirty log in small chunks (e.g., QEMU default chunk size of 256K), the chunk size is always smaller than the page size of huge pages (1G or 2M) used in the gstage page tables. This caused the write protection to be incorrectly skipped for huge PTEs because the condition `(end - addr) >= page_size` was not satisfied. Remove the size check in `kvm_riscv_gstage_wp_range()` to ensure huge PTEs are always write-protected regardless of the chunk size. Additionally, explicitly align the address down to the page size before invoking `kvm_riscv_gstage_op_pte()` to guarantee that the address passed to the operation function is page-aligned. This fixes the issue where dirty pages might not be tracked correctly when using huge pages. Fixes: 9d05c1fee837 ("RISC-V: KVM: Implement stage2 page table programming") Signed-off-by: Wang Yechao Reviewed-by: Nutty Liu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/202603301610527120YZ-pAJY6x9SBpSRo1Wg4@zte.com.cn Signed-off-by: Anup Patel commit 0720208b37ae4f1193dc7103ee269b180a8f8943 Author: Mukesh Ojha Date: Fri Mar 27 22:42:40 2026 +0530 pinctrl: qcom: Drop redundant intr_target_reg on modern SoCs On all Qualcomm TLMM generations from APQ8084 onwards, the interrupt target routing bits are located in the same register as the interrupt configuration bits (intr_cfg_reg). Only five older SoCs — APQ8064, IPQ8064, MDM9615, MSM8660 and MSM8960 — have a genuinely separate interrupt target routing register at a different offset (0x400 + 0x4 * id). Replace MSM_ACCESSOR(intr_target) with a custom accessor that falls back to intr_cfg_reg when intr_target_reg is zero. Apply the same fallback in the SCM path. Drop the now-redundant .intr_target_reg initializer from all SoC drivers where it duplicated intr_cfg_reg, keeping it only in the five drivers where it genuinely differs. Signed-off-by: Mukesh Ojha Signed-off-by: Linus Walleij commit fe8933c5b3e2e5294f82da546792268e5687391e Author: Mukesh Ojha Date: Fri Mar 27 22:42:39 2026 +0530 pinctrl: qcom: eliza: Fix interrupt target bit The intr_target_bit for Eliza was incorrectly set to 5, which is the value used by older Qualcomm SoCs (e.g. SM8250, MSM8996, X1E80100). Newer SoCs such as SM8650, SM8750, Milos, and Kaanapali all use bit 8 for the interrupt target field in the TLMM interrupt configuration register. Eliza belongs to the newer generation and should use bit 8 to correctly route interrupts to the KPSS (Applications Processor). Using the wrong bit position means the interrupt target routing is silently misconfigured, which can result in GPIO interrupts not being delivered to the expected processor. Fix this by aligning Eliza with the correct value used by its peer SoCs. Fixes: 6f26989e15fb ("pinctrl: qcom: Add Eliza pinctrl driver") Signed-off-by: Mukesh Ojha Reviewed-by: Abel Vesa Signed-off-by: Linus Walleij commit 6fdfd24017756bbe27ccc786051e97f3bf0c3d62 Merge: 3bce3fdd1ff2ba 7aaa8047eafd0b Author: Maxime Ripard Date: Mon Mar 30 10:05:36 2026 +0200 Merge drm/drm-fixes into drm-misc-next-fixes Boris needs 7.0-rc6 for a shmem helper fix. Signed-off-by: Maxime Ripard commit 8f271fe15eaef9eeed6229a78adf6565cc554b63 Author: Gopi Krishna Menon Date: Sun Mar 29 18:04:43 2026 +0530 dt-bindings: thermal: st,thermal-spear1340: convert to dtschema Convert the SPEAr Thermal Sensor bindings to DT schema. Signed-off-by: Gopi Krishna Menon Signed-off-by: Daniel Lezcano Reviewed-by: Krzysztof Kozlowski Acked-by: Viresh Kumar Link: https://patch.msgid.link/20260329123449.309814-2-krishnagopi487@gmail.com commit 1762ac42eed653557d2feb9e37f45995ac238ce6 Author: Jiakai Xu Date: Thu Mar 19 03:59:02 2026 +0000 RISC-V: KVM: Fix integer overflow in kvm_pmu_validate_counter_mask() When a guest initiates an SBI_EXT_PMU_COUNTER_CFG_MATCH call with ctr_base=0xfffffffffffffffe, ctr_mask=0xeb5f and flags=0x1 (SBI_PMU_CFG_FLAG_SKIP_MATCH), kvm_riscv_vcpu_pmu_ctr_cfg_match() first invokes kvm_pmu_validate_counter_mask() to verify whether ctr_base and ctr_mask are valid, by evaluating: !ctr_mask || (ctr_base + __fls(ctr_mask) >= kvm_pmu_num_counters(kvpmu)) With the above inputs, __fls(0xeb5f) equals 15, and adding 15 to 0xfffffffffffffffe causes an integer overflow, wrapping around to 13. Since 13 is less than kvm_pmu_num_counters(), the validation wrongly succeeds. Thereafter, since flags & SBI_PMU_CFG_FLAG_SKIP_MATCH is satisfied, the code evaluates: !test_bit(ctr_base + __ffs(ctr_mask), kvpmu->pmc_in_use) Here __ffs(0xeb5f) equals 0, so test_bit() receives 0xfffffffffffffffe as the bit index and attempts to access the corresponding element of the kvpmu->pmc_in_use, which results in an invalid memory access. This triggers the following Oops: Unable to handle kernel paging request at virtual address e3ebffff12abba89 generic_test_bit include/asm-generic/bitops/generic-non-atomic.h:128 kvm_riscv_vcpu_pmu_ctr_cfg_match arch/riscv/kvm/vcpu_pmu.c:758 kvm_sbi_ext_pmu_handler arch/riscv/kvm/vcpu_sbi_pmu.c:49 kvm_riscv_vcpu_sbi_ecall arch/riscv/kvm/vcpu_sbi.c:608 kvm_riscv_vcpu_exit arch/riscv/kvm/vcpu_exit.c:240 The root cause is that kvm_pmu_validate_counter_mask() does not account for the case where ctr_base itself is out of range, allowing the subsequent addition to silently overflow and bypass the check. Fix this by explicitly validating ctr_base against kvm_pmu_num_counters() before performing the addition. This bug was found by fuzzing the KVM RISC-V PMU interface. Fixes: 0cb74b65d2e5e6 ("RISC-V: KVM: Implement perf support without sampling") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Nutty Liu Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20260319035902.924661-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 4ec93f070eda6b765b62efcaed9241c3b3b0b6ad Author: Cássio Gabriel Date: Mon Mar 30 01:00:34 2026 -0300 ALSA: aoa: i2sbus: fix OF node lifetime handling i2sbus_add_dev() keeps the matched "sound" child pointer after for_each_child_of_node() has dropped the iterator reference. Take an extra reference before saving that node and drop it after the layout-id/device-id lookup is complete. The function also stores np in dev->sound.ofdev.dev.of_node without taking a reference for the embedded soundbus device. Since i2sbus overrides the embedded platform device release callback, balance that reference explicitly in the local error path and in i2sbus_release_dev(). Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260330-aoa-i2sbus-ofnode-lifetime-v1-1-51c309f4ff06@gmail.com Signed-off-by: Takashi Iwai commit 472571498baaa67b6ea70d6c0154730be3da3c36 Author: wangdicheng Date: Mon Mar 30 13:41:31 2026 +0800 ALSA: hda/cs8409: Fix error message in cs8409_i2c_bulk_read() The error message in cs8409_i2c_bulk_read() incorrectly says "I2C Bulk Write Failed" when it should say "I2C Bulk Read Failed". This is a copy-paste error from cs8409_i2c_bulk_write(). Signed-off-by: wangdicheng Link: https://patch.msgid.link/20260330054131.434994-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit ec631bc3fb342ad7a2ec09433821e7201b7b15f9 Author: Uros Bizjak Date: Mon Mar 30 07:57:45 2026 +0200 x86/asm/segment: Implement loadsegment()/savesegment() macros with static inline helpers Convert the __loadsegment_simple() and savesegment() macro implementations into static inline helper functions generated via small helper macros. Historically loadsegment() and savesegment() relied on macros that embedded inline assembly. This approach obscures types, complicates debugging, and makes the call sites harder for the compiler and static analysis tools to reason about. This change is purely mechanical and does not alter the generated code, but improves readability, type safety, and compiler visibility of the helpers. Suggested-by: H. Peter Anvin Signed-off-by: Uros Bizjak Signed-off-by: Ingo Molnar Cc: Linus Torvalds Link: https://patch.msgid.link/20260330055823.5793-4-ubizjak@gmail.com commit caf3cb2ef22e4b4ff9f6bb48f71ce30dae663326 Author: Uros Bizjak Date: Mon Mar 30 07:57:44 2026 +0200 x86/asm/segment: Use ASM_INPUT_RM in __loadsegment_fs() Use the ASM_INPUT_RM macro in __loadsegment_fs() to work around Clang problems with the "rm" asm constraint. Clang seems to always chose the memory input, while it is almost always the worst choice. Signed-off-by: Uros Bizjak Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Acked-by: Nathan Chancellor Cc: Linus Torvalds Cc: H. Peter Anvin Link: https://patch.msgid.link/20260330055823.5793-3-ubizjak@gmail.com commit 8379ca68a01c38485b620d36a72d8aeeca86e743 Author: Uros Bizjak Date: Mon Mar 30 07:57:43 2026 +0200 x86/asm/segment: Remove unnecessary "memory" clobber from savesegment() The savesegment() macro uses inline assembly to copy a segment register into a general-purpose register: movl %seg, reg This instruction does not access memory, yet the inline asm currently declares a "memory" clobber, which unnecessarily acts as a compiler barrier and may inhibit optimization. Remove the "memory" clobber and mark the asm as `asm volatile` instead. Segment register loads in the kernel are implemented using `asm volatile`, so the compiler will not schedule segment register reads before those loads. Using `asm volatile` preserves the intended ordering with other segment register operations without imposing an unnecessary global memory barrier. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: H. Peter Anvin Link: https://patch.msgid.link/20260330055823.5793-2-ubizjak@gmail.com commit d9576c9cd6a3056435e8e974c36ef576816a6c99 Author: Uros Bizjak Date: Mon Mar 30 07:57:42 2026 +0200 x86/asm/fsgsbase: Remove unnecessary "memory" clobbers from FS/GS base (read-) accessors The rdfsbase() and rdgsbase() helpers currently include a "memory" clobber in their inline assembly definitions. However, the RDFSBASE and RDGSBASE instructions only read the FS/GS base MSRs into a general-purpose register and do not access memory. The "memory" clobber, which acts as a compiler barrier and may inhibit optimization, is therefore unnecessary. The "memory" clobber was historically used as a scheduling constraint to prevent the compiler from moving the instructions before preceding segment register loads. This is not required because both the segment register loads and the RDFSBASE/RDGSBASE accessors are implemented with `asm volatile`, which already prevents reordering between them. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: H. Peter Anvin Link: https://patch.msgid.link/20260330055823.5793-1-ubizjak@gmail.com commit 310e2096b082ae0010e7afef666073b966ac2fa7 Author: Jiakai Xu Date: Wed Mar 18 09:29:56 2026 +0000 RISC-V: KVM: Fix double-free of sdata in kvm_pmu_clear_snapshot_area() In kvm_riscv_vcpu_pmu_snapshot_set_shmem(), when kvm_vcpu_write_guest() fails, kvpmu->sdata is freed but not set to NULL. This leaves a dangling pointer that will be freed again when kvm_pmu_clear_snapshot_area() is called during vcpu teardown, triggering a KASAN double-free report. First free occurs in kvm_riscv_vcpu_pmu_snapshot_set_shmem(): kvm_riscv_vcpu_pmu_snapshot_set_shmem arch/riscv/kvm/vcpu_pmu.c:443 kvm_sbi_ext_pmu_handler arch/riscv/kvm/vcpu_sbi_pmu.c:74 kvm_riscv_vcpu_sbi_ecall arch/riscv/kvm/vcpu_sbi.c:608 kvm_riscv_vcpu_exit arch/riscv/kvm/vcpu_exit.c:240 kvm_arch_vcpu_ioctl_run arch/riscv/kvm/vcpu.c:1008 kvm_vcpu_ioctl virt/kvm/kvm_main.c:4476 Second free (double-free) occurs in kvm_pmu_clear_snapshot_area(): kvm_pmu_clear_snapshot_area arch/riscv/kvm/vcpu_pmu.c:403 [inline] kvm_riscv_vcpu_pmu_deinit.part arch/riscv/kvm/vcpu_pmu.c:905 kvm_riscv_vcpu_pmu_deinit arch/riscv/kvm/vcpu_pmu.c:893 kvm_arch_vcpu_destroy arch/riscv/kvm/vcpu.c:199 kvm_vcpu_destroy virt/kvm/kvm_main.c:469 [inline] kvm_destroy_vcpus virt/kvm/kvm_main.c:489 kvm_arch_destroy_vm arch/riscv/kvm/vm.c:54 kvm_destroy_vm virt/kvm/kvm_main.c:1301 [inline] kvm_put_kvm virt/kvm/kvm_main.c:1338 kvm_vm_release virt/kvm/kvm_main.c:1361 Fix it by setting kvpmu->sdata to NULL after kfree() in kvm_riscv_vcpu_pmu_snapshot_set_shmem(), so that the subsequent kfree(NULL) in kvm_pmu_clear_snapshot_area() becomes a safe no-op. This bug was found by fuzzing the KVM RISC-V PMU interface. Fixes: c2f41ddbcdd756 ("RISC-V: KVM: Implement SBI PMU Snapshot feature") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Nutty Liu Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20260318092956.708246-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 9b33ab1e8c189bd0aced0d07545b0f31a459d40e Author: Yufeng Wang Date: Tue Mar 17 19:47:59 2026 +0800 riscv: kvm: add null pointer check for vector datap Add WARN_ON check before accessing cntx->vector.datap in kvm_riscv_vcpu_vreg_addr() to detect potential null pointer dereferences early, consistent with the pattern used in kvm_riscv_vcpu_vector_reset(). This helps catch initialization issues where vector context allocation may have failed. Signed-off-by: Yufeng Wang Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260317114759.53165-1-r4o5m6e8o@163.com Signed-off-by: Anup Patel commit b3c26ea81ccc522e77ed0b1707add61fc9206216 Author: Ethan Nelson-Moore Date: Mon Mar 9 00:41:48 2026 -0700 pcmcia: remove obsolete host controller drivers PCMCIA is almost completely obsolete (the last computers supporting it natively were from ~2009), and the general consensus [1] seems to be that support for it should be gradually removed from the kernel. In 2023, an initial step of removing all the PCMCIA char drivers was taken in commit 9b12f050c76f ("char: pcmcia: remove all the drivers"), and that has not been reverted, so it seems logical to continue this process by removing more low-hanging fruit. These host controller drivers have had no meaningful changes since their status was discussed in 2022 [2], and are unlikely to have any remaining users. Remove them and a couple references to them in comments. The i82365 and tcic drivers are for ISA-attached host controllers, which are even less likely to be used nowadays than ones on other buses. The i82092 driver has almost certainly not been used in over 20 years. It was broken by a null pointer dereference since the dawn of Git history (2.6.12-rc2 in 2005) until someone fixed it in 2021 in commit e39cdacf2f66 ("pcmcia: i82092: fix a null pointer dereference bug"). From their dmesg log [3], it is clear they were testing in an emulated environment and not on real hardware. i82365.h is used by drivers other than i82365 and is therefore retained. [1] https://lore.kernel.org/all/c5b39544-a4fb-4796-a046-0b9be9853787@app.fastmail.com/ [2] https://lore.kernel.org/all/Y07d7rMvd5++85BJ@owl.dominikbrodowski.net/ [3] https://lore.kernel.org/all/1624345891-4215-1-git-send-email-zheyuma97@gmail.com/ Signed-off-by: Ethan Nelson-Moore Acked-by: Dave Hansen # for x86 Signed-off-by: Dominik Brodowski commit bfcde6240500d5f2bdf9632aef92ebefcf1decab Author: Andy Shevchenko Date: Mon Oct 30 13:50:53 2023 +0200 pcmcia: Convert to use less arguments in pci_bus_for_each_resource() The pci_bus_for_each_resource() can hide the iterator loop since it may be not used otherwise. With this, we may drop that iterator variable definition. Reviewed-by: Krzysztof Wilczyński Signed-off-by: Andy Shevchenko Signed-off-by: Dominik Brodowski commit bfeaa6814bd3f9a1f6d525b3b35a03b9a0368961 Author: René Rebe Date: Wed Nov 26 17:42:56 2025 +0100 PCMCIA: Fix garbled log messages for KERN_CONT For years the PCMCIA info messages are messed up by superfluous newlines. While f2e6cf76751d ("pcmcia: Convert dev_printk to dev_") converted the code to pr_cont(), dev_info enforces a \n via vprintk_store setting LOG_NEWLINE, breaking subsequent pr_cont. Fix by logging the device name manually to allow pr_cont to work for more readable and not \n distorted logs. Fixes: f2e6cf76751d ("pcmcia: Convert dev_printk to dev_") Signed-off-by: René Rebe Signed-off-by: Dominik Brodowski commit 7c50d748b4a635bc39802ea3f6b120e66b1b9067 Author: John Hubbard Date: Wed Mar 25 18:38:39 2026 -0700 gpu: nova-core: firmware: factor out an elf_str() function Factor out a chunk of complexity into a new subroutine. This is an incremental step in adding ELF32 support to the existing ELF64 section support, for handling GPU firmware. Signed-off-by: John Hubbard Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260326013902.588242-9-jhubbard@nvidia.com [acourbot: use fuller prefix in commit message.] Signed-off-by: Alexandre Courbot commit b3d24269b3c7e764b694689b5fd7517546625150 Author: John Hubbard Date: Wed Mar 25 18:38:38 2026 -0700 gpu: nova-core: firmware: move firmware image parsing code to firmware.rs Up until now, only the GSP required parsing of its firmware headers. However, upcoming support for Hopper/Blackwell+ adds another firmware image (FMC), along with another format (ELF32). Therefore, the current ELF64 section parsing support needs to be moved up a level, so that both of the above can use it. There are no functional changes. This is pure code movement. Reviewed-by: Gary Guo Signed-off-by: John Hubbard Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260326013902.588242-8-jhubbard@nvidia.com [acourbot: use fuller prefix in commit message.] Signed-off-by: Alexandre Courbot commit af62a095eb0c3359d477b55ef72d2afd94c83c8f Author: Yixun Lan Date: Fri Mar 27 11:51:18 2026 +0000 dts: riscv: spacemit: k3: add P1 PMIC regulator tree Add the P1 PMIC's regulator topology tree for pico-itx board. Link: https://lore.kernel.org/r/20260327-02-k3-i2c-v2-1-9c6b374470c6@kernel.org Signed-off-by: Yixun Lan commit cb322cbffb1e70b4ca1be7955ed19fe486de8295 Author: Yixun Lan Date: Fri Mar 27 11:40:40 2026 +0000 dts: riscv: spacemit: k3: Add i2c nodes Populate all I2C devicetree nodes for SpacemiT K3 SoC. The controller of i2c3 is reserved for secure domain, and not available from Linux. The controller of i2c7 simply doesn't exist from hardware perspective, as vendor directly name the i2c controller used for PMIC as i2c8. Reviewed-by: Troy Mitchell Link: https://lore.kernel.org/r/20260327-02-k3-i2c-v2-1-2119c0918868@kernel.org Signed-off-by: Yixun Lan commit 6a01f5478d208544c8ba5ddbd674ea660f1b7047 Author: Utkal Singh Date: Tue Mar 17 15:24:39 2026 +0000 erofs: harden h_shared_count in erofs_init_inode_xattrs() `u8 h_shared_count` indicates the shared xattr count of an inode. It is read from the on-disk xattr ibody header, which should be corrupted if the size of the shared xattr array exceeds the space available in `xattr_isize`. It does not cause harmful consequence (e.g. crashes), since the image is already considered corrupted, it indeed results in the silent processing of garbage metadata. Let's harden it to report -EFSCORRUPTED earlier. Signed-off-by: Utkal Singh Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 658e3c836969e1624a7572c75684f54ec503c2ed Author: Bitterblue Smith Date: Thu Mar 26 00:27:15 2026 +0200 wifi: rtw88: coex: Ignore BT info byte 5 from RTL8821A Sometimes while watching a Youtube video with Bluetooth headphones the audio has a lot of interruptions, because the 5th byte of the BT info sent by RTL8821AU has strange values, which result in coex_stat->bt_hid_pair_num being 2 or 3. When this happens rtw_coex_freerun_check() returns true, which causes rtw_coex_action_wl_connected() to call rtw_coex_action_freerun() instead of rtw_coex_action_bt_a2dp(). The RTL8821AU vendor driver doesn't do anything with the 5th byte of the BT info, so ignore it here as well. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/bbf06c83-d2ee-4205-8fbb-829e2347586f@gmail.com commit e0da9859cfbc9a8cf9a879b00931b89f590de0c1 Author: Zong-Zhe Yang Date: Wed Mar 25 15:21:30 2026 +0800 wifi: rtw89: fw: load TX power elements according to AID For different A-die, there will be different TX power parameters. In FW element header, the corresponding A-die ID will be described. So, compare runtime AID with that to load the target TX power parameters. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260325072130.41751-9-pkshih@realtek.com commit 9c52ad439e6c50dc54175f180d177f9be73f3e98 Author: Ping-Ke Shih Date: Wed Mar 25 15:21:29 2026 +0800 wifi: rtw89: phy: load RF parameters relying on ACV for RTL8922D RF parameters are conditional formats with RFE type and CV as arguments, but RTL8922D has many variants and use ACV as argument instead of CV. Add to select proper register values. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260325072130.41751-8-pkshih@realtek.com commit e0b88e052e4c6ca5789c61cef00a90caf08cfc08 Author: Eric Huang Date: Wed Mar 25 15:21:28 2026 +0800 wifi: rtw89: phy: expand PHY page for RTL8922D PHY page range is to define offset from PHY0 to PHY1, and RTL8922D needs to expand page to 0x2E0. Signed-off-by: Eric Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260325072130.41751-7-pkshih@realtek.com commit ce945fb377ce8620272536d734c99064de91dfd0 Author: Ping-Ke Shih Date: Wed Mar 25 15:21:27 2026 +0800 wifi: rtw89: mac: disable pre-load function for RTL8922DE The pre-load function is a MAC function to pre-load TX packets into WiFi device's memory, so it can enhance performance. However, RTL8922DE has not fully verified and fine tune this function, temporarily disable this function. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260325072130.41751-6-pkshih@realtek.com commit ba42bb2813aa9574d67ba0f4612ff0acba972d67 Author: Ping-Ke Shih Date: Wed Mar 25 15:21:26 2026 +0800 wifi: rtw89: mac: add specific case to dump mac memory for RTL8922D The RTL8922D can reuse most mac memory addresses, but only RTW89_MAC_MEM_SECURITY_CAM is different from existing one. Add a function to return the specific memory address for RTL8922D. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260325072130.41751-5-pkshih@realtek.com commit bdc607a67edfb35a671eb3405ce5a750a5ef28b2 Author: Ping-Ke Shih Date: Wed Mar 25 15:21:25 2026 +0800 wifi: rtw89: pci: clear SER ISR when initial and leaving WoWLAN for WiFi 7 chips The PCIE SER is to diagnose PCIE becomes abnormal, relying on IMR settings to trigger interrupt when status is weird. Update settings to disable PHY error flag 9, and clear ISR when initial and leaving WoWLAN. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260325072130.41751-4-pkshih@realtek.com commit 4e7a7f57718eaeb07be7d7fcec800e88338fb1ad Author: Chin-Yen Lee Date: Wed Mar 25 15:21:24 2026 +0800 wifi: rtw89: wow: enable MLD address for Magic packet wakeup Under MLO connections, the original Magic Packet configuration only supported Link Addresses for wakeup. Update the setting to support both MLD Address and Link Addresses for wakeup process. Signed-off-by: Chin-Yen Lee Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260325072130.41751-3-pkshih@realtek.com commit 86a4c63c01e4c0ca4f47952e371c7219c09bfc9e Author: Chin-Yen Lee Date: Wed Mar 25 15:21:23 2026 +0800 wifi: rtw89: wow: use struct style to fill WOW wakeup control H2C command The WOW wakeup control command is used to tell firmware the content of wakeup feature. Use struct instead of macros to fill the data. Signed-off-by: Chin-Yen Lee Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260325072130.41751-2-pkshih@realtek.com commit 1b622535a577ab24e07de8bb68bd5dc20b50ccf0 Author: Ping-Ke Shih Date: Tue Mar 24 14:20:49 2026 +0800 wifi: rtw89: 8922d: add set channel of RF part The set channel of RF part is to configure channel and bandwidth on a register. The function to encode channel and bandwidth into register value will be implemented by coming patch. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260324062049.52266-8-pkshih@realtek.com commit 521f3a653dbe52b290607b5e0adf4730a3fcd9d6 Author: Ping-Ke Shih Date: Tue Mar 24 14:20:48 2026 +0800 wifi: rtw89: 8922d: add set channel of BB part The set channel of BB part is the main part, which according to channel and bandwidth to configure CCK SCO, RX gain of LNA and TIA programmed in efuse for CCK and OFDM rate, and spur elimination of CSI and NBI tones. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260324062049.52266-7-pkshih@realtek.com commit 56f48df95e7a0d2325ef1ead73228d413c713100 Author: Ping-Ke Shih Date: Tue Mar 24 14:20:47 2026 +0800 wifi: rtw89: 8922d: add set channel of MAC part The set channel is a key function to switch to specific operating channel. For MAC part, configure hardware according to channel bandwidth, and enable CCK rate for 2GHz band only. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260324062049.52266-6-pkshih@realtek.com commit 5b04b8049828d27b23ba5798f35bef835acc7fb1 Author: Ping-Ke Shih Date: Tue Mar 24 14:20:46 2026 +0800 wifi: rtw89: 8922d: read and configure RF by calibration data from efuse physical map The calibration data is from physical map, including 1) thermal trim to align output thermal value across chips, and 2) PA bias to transmit expected power by controller. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260324062049.52266-5-pkshih@realtek.com commit 199e4235d33f01d3205d40a056e506ac4964da28 Author: Ping-Ke Shih Date: Tue Mar 24 14:20:45 2026 +0800 wifi: rtw89: 8922d: define efuse map and read necessary fields Define specific efuse map for RTL8922D, including TSSI, RX gain, MAC address, RFE type and etc. The additional fields comparing to existing chips are BT setting (define BT switch GPIO, antenna number and etc) and gain offset2 (define more fields like existing RX gain offset). Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260324062049.52266-4-pkshih@realtek.com commit bbbde3d0fbe1005cffa45a7803c17589e2011107 Author: Ping-Ke Shih Date: Tue Mar 24 14:20:44 2026 +0800 wifi: rtw89: 8922d: add power on/off functions The power on function is the first entry to power on hardware including all MAC/BB/RF circuits, and then it becomes possible to do high level operations, such as WiFi scan, connection. If connection becomes unavailable, device stays into idle mode, calling power off function to cut power. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260324062049.52266-3-pkshih@realtek.com commit e51df91b894a583f03e35168d2082786f6dff1bd Author: Ping-Ke Shih Date: Tue Mar 24 14:20:43 2026 +0800 wifi: rtw89: 8922d: add definition of quota, registers and efuse block The quota is used to configure memory size for TX/RX, and the definition of registers includes H2C command, C2H event, WoWLAN reason, IMR of CMAC and DMAC, ACK rate selector, RF kill GPIO, and BB functions of dynamic initial gain and EDCCA. The layout of efuse block is to define logic map of efuse, such as MAC address and RF calibration values. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260324062049.52266-2-pkshih@realtek.com commit bf14367719fa86f7c6922c64d37a2df347954c66 Author: Ping-Ke Shih Date: Tue Mar 24 09:10:01 2026 +0800 wifi: rtw88: validate RX rate to prevent out-of-bound The reported RX rate might be unexpected, causing kernel warns: Rate marked as a VHT rate but data is invalid: MCS: 0, NSS: 0 WARNING: net/mac80211/rx.c:5491 at ieee80211_rx_list+0x183/0x1020 [mac80211] As the RX rate can be index of an array under certain conditions, validate it to prevent accessing array out-of-bound potentially. Tested on HP Notebook P3S95EA#ACB (kernel 6.19.9-1-cachyos): - No WARNING: net/mac80211/rx.c:5491 observed after the v2 patch. The unexpected `NSS: 0, MCS: 0` VHT rate warnings are successfully mitigated. - The system remains fully stable through prolonged idle periods, high network load, active Bluetooth A2DP usage, and multiple deep suspend/resume cycles. - Zero h2c timeouts or firmware lps state errors observed in dmesg. Reported-by: Oleksandr Havrylov Closes: https://lore.kernel.org/linux-wireless/CALdGYqSMUPnPfW-_q1RgYr0_SjoXUejAaJJr-o+jpwCk1S7ndQ@mail.gmail.com/ Tested-by: Oleksandr Havrylov Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260324011001.5742-1-pkshih@realtek.com commit 047cddf88c611e616d49a00311d4722e46286234 Author: Alexey Velichayshiy Date: Mon Mar 23 17:05:53 2026 +0300 wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() In the rtw89_phy_cfo_set_crystal_cap() function, for chips other than RTL8852A/RTL8851B, the values read by rtw89_mac_read_xtal_si() are stored into the local variables sc_xi_val and sc_xo_val. If either read fails, these variables remain uninitialized, they are later used to update cfo->crystal_cap and in debug print statements. This can lead to undefined behavior. Fix the issue by initializing sc_xi_val and sc_xo_val to zero, like is implemented in vendor driver. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 8379fa611536 ("rtw89: 8852c: add write/read crystal function in CFO tracking") Signed-off-by: Alexey Velichayshiy Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260323140613.1615574-1-a.velichayshiy@ispras.ru commit aefb20749074731c4f35444761e730991f1b8c77 Author: Zenm Chen Date: Fri Mar 20 23:41:36 2026 +0800 wifi: rtw89: Add support for Buffalo WI-U3-2400XE2 Add the ID 0411:03a6 to the table to support an additional RTL8832CU adapter: Buffalo WI-U3-2400XE2. Link: https://github.com/morrownr/rtw89/commit/506d193b8cb7d6394509aebcf8de1531629f6100 Signed-off-by: Zenm Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260320154136.5750-1-zenmchen@gmail.com commit 6678828eb78f3ae0bc6db90436068d5fd0387703 Author: Zenm Chen Date: Fri Mar 20 17:31:22 2026 +0800 wifi: rtw89: Add support for TP-Link Archer TX50U Add the ID 37ad:0103 to the table to support an additional RTL8832CU adapter: TP-Link Archer TX50U. Link: https://github.com/morrownr/rtl8852cu-20251113/issues/2 Signed-off-by: Zenm Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260320093122.6754-1-zenmchen@gmail.com commit d92f6ad6483e6d430c8273eeb7be97ce85244bd5 Author: Christian Hewitt Date: Tue Mar 17 11:21:55 2026 +0000 wifi: rtw89: retry efuse physical map dump on transient failure On Radxa Rock 5B with a RTL8852BE combo WiFi/BT card, the efuse physical map dump intermittently fails with -EBUSY during probe. The failure occurs in rtw89_dump_physical_efuse_map_ddv() where read_poll_timeout_atomic() times out waiting for the B_AX_EF_RDY bit after 1 second. The root cause is a timing race during boot: the WiFi driver's chip initialization (firmware download via PCIe) overlaps with Bluetooth firmware download to the same combo chip via USB. This can leave the efuse controller temporarily unavailable when the WiFi driver attempts to read the efuse map. The firmware download path retries up to 5 times, but the efuse read that follows has no similar logic. Address this by adding retry loop logic (also up to 5 attempts) around physical efuse map dump. Signed-off-by: Christian Hewitt Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260317112155.1939569-1-christianshewitt@gmail.com commit 737e980e12983bb7420a2c00b981a1e607079a84 Author: Bitterblue Smith Date: Wed Mar 18 19:45:13 2026 +0200 wifi: rtw88: TX QOS Null data the same way as Null data When filling out the TX descriptor, Null data frames are treated like management frames, but QOS Null data frames are treated like normal data frames. Somehow this causes a problem for the firmware. When connected to a network in the 2.4 GHz band, wpa_supplicant (or NetworkManager?) triggers a scan every five minutes. During these scans mac80211 transmits many QOS Null frames in quick succession. Because these frames are marked with IEEE80211_TX_CTL_REQ_TX_STATUS, rtw88 asks the firmware to report the TX ACK status for each of these frames. Sometimes the firmware can't process the TX status requests quickly enough, they add up, it only processes some of them, and then marks every subsequent TX status report with the wrong number. The symptom is that after a while the warning "failed to get tx report from firmware" appears every five minutes. This problem apparently happens only with the older RTL8723D, RTL8821A, RTL8812A, and probably RTL8703B chips. Treat QOS Null data frames the same way as Null data frames. This seems to avoid the problem. Tested with RTL8821AU, RTL8723DU, RTL8811CU, and RTL8812BU. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/2b53fb0d-b1ed-47b6-8caa-2bb9ae2acb80@gmail.com commit b2bf9d61e14af4129362aeb9c10034229a6d8f08 Author: Ping-Ke Shih Date: Mon Mar 16 11:56:35 2026 +0800 wifi: rtw88: add quirks to disable PCI ASPM and deep LPS for HP P3S95EA#ACB On an HP laptop (P3S95EA#ACB) equipped with a Realtek RTL8821CE 802.11ac PCIe adapter (PCI ID: 10ec:c821), the system experiences a hard lockup (complete freeze of the UI and kernel, sysrq doesn't work, requires holding the power button) when the WiFi adapter enters the power saving state. Disable PCI ASPM to avoid system freeze. In addition, driver throws messages periodically. Though this doesn't always cause unstable connection, missing H2C commands might cause unpredictable results. Disable deep LPS to avoid this as well. rtw88_8821ce 0000:13:00.0: firmware failed to leave lps state rtw88_8821ce 0000:13:00.0: failed to send h2c command rtw88_8821ce 0000:13:00.0: failed to send h2c command Tested on HP Notebook P3S95EA#ACB (kernel 6.19.7-1-cachyos): - No hard freeze observed during idle or active usage. - Zero h2c or lps errors in dmesg across idle (10 min), load stress (100MB download), and suspend/resume cycle. - Both quirk flags confirmed active via sysfs without any manual modprobe parameters. Reported-by: Oleksandr Havrylov Closes: https://lore.kernel.org/linux-wireless/CALdGYqSQ1Ko2TTBhUizMu_FvLMUAuQfFrVwS10n_C-LSQJQQkQ@mail.gmail.com/ Signed-off-by: Ping-Ke Shih Tested-by: Oleksandr Havrylov Link: https://patch.msgid.link/20260316035635.16550-1-pkshih@realtek.com commit 3603bf99062c6d563df4fba3848f829d5401d959 Author: Randy Dunlap Date: Sat Feb 28 14:09:22 2026 -0800 SUNRPC: xdr.h: fix all kernel-doc warnings Correct a function parameter name (s/page/folio/) and add function return value sections for multiple functions to eliminate kernel-doc warnings: Warning: include/linux/sunrpc/xdr.h:298 function parameter 'folio' not described in 'xdr_set_scratch_folio' Warning: include/linux/sunrpc/xdr.h:337 No description found for return value of 'xdr_stream_remaining' Warning: include/linux/sunrpc/xdr.h:357 No description found for return value of 'xdr_align_size' Warning: include/linux/sunrpc/xdr.h:374 No description found for return value of 'xdr_pad_size' Warning: include/linux/sunrpc/xdr.h:387 No description found for return value of 'xdr_stream_encode_item_present' Signed-off-by: Randy Dunlap Signed-off-by: Chuck Lever commit 2239535fb062b404871556b3bbbe4e27579f5edb Author: Chuck Lever Date: Fri Feb 27 09:03:32 2026 -0500 svcrdma: Factor out WR chain linking into helper svc_rdma_prepare_write_chunk() and svc_rdma_prepare_reply_chunk() contain identical code for linking RDMA R/W work requests onto a Send context's WR chain. This duplication increases maintenance burden and risks divergent bug fixes. Introduce svc_rdma_cc_link_wrs() to consolidate the WR chain linking logic. The helper walks the chunk context's rwctxts list, chains each WR via rdma_rw_ctx_wrs(), and updates the Send context's chain head and SQE count. Completion signaling is requested only for the tail WR (posted first). No functional change. Signed-off-by: Chuck Lever commit d16f060f3ee297424c0aba047b1d49208adb9318 Author: Chuck Lever Date: Fri Feb 27 09:03:31 2026 -0500 svcrdma: Add Write chunk WRs to the RPC's Send WR chain Previously, Write chunk RDMA Writes were posted via a separate ib_post_send() call with their own completion handler. Each Write chunk incurred a doorbell and generated a completion event. Link Write chunk WRs onto the RPC Reply's Send WR chain so that a single ib_post_send() call posts both the RDMA Writes and the Send WR. A single completion event signals that all operations have finished. This reduces both doorbell rate and completion rate, as well as eliminating the latency of a round-trip between the Write chunk completion and the subsequent Send WR posting. The lifecycle of Write chunk resources changes: previously, the svc_rdma_write_done() completion handler released Write chunk resources when RDMA Writes completed. With WR chaining, resources remain live until the Send completion. A new sc_write_info_list tracks Write chunk metadata attached to each Send context, and svc_rdma_write_chunk_release() frees these resources when the Send context is released. The svc_rdma_write_done() handler now handles only error cases. On success it returns immediately since the Send completion handles resource release. On failure (WR flush), it closes the connection to signal to the client that the RPC Reply is incomplete. Signed-off-by: Chuck Lever commit c553983efad2ef0f1a8728a7a9104136297d8a0d Author: Chuck Lever Date: Fri Feb 27 09:03:30 2026 -0500 svcrdma: Clean up use of rdma->sc_pd->device I can't think of a reason why svcrdma is using the PD's device. Most other consumers of the IB DMA API use the ib_device pointer from the connection's rdma_cm_id. I don't think there's any functional difference between the two, but it is a little confusing to see some uses of rdma_cm_id and some of ib_pd. Signed-off-by: Chuck Lever commit a5f2087f3762bbf0c54f0a7796dc95bd39863c5f Author: Chuck Lever Date: Fri Feb 27 09:03:29 2026 -0500 svcrdma: Clean up use of rdma->sc_pd->device in Receive paths I can't think of a reason why svcrdma is using the PD's device. Most other consumers of the IB DMA API use the ib_device pointer from the connection's rdma_cm_id. I don't believe there's any functional difference between the two, but it is a little confusing to see some uses of rdma_cm_id->device and some of ib_pd->device. Signed-off-by: Chuck Lever commit ccc89b9d1ed233349cfe8d87b842e7351b74d8de Author: Chuck Lever Date: Fri Feb 27 09:03:28 2026 -0500 svcrdma: Add fair queuing for Send Queue access When the Send Queue fills, multiple threads may wait for SQ slots. The previous implementation had no ordering guarantee, allowing starvation when one thread repeatedly acquires slots while others wait indefinitely. Introduce a ticket-based fair queuing system. Each waiter takes a ticket number and is served in FIFO order. This ensures forward progress for all waiters when SQ capacity is constrained. The implementation has two phases: 1. Fast path: attempt to reserve SQ slots without waiting 2. Slow path: take a ticket, wait for turn, then wait for slots The ticket system adds two atomic counters to the transport: - sc_sq_ticket_head: next ticket to issue - sc_sq_ticket_tail: ticket currently being served A dedicated wait queue (sc_sq_ticket_wait) handles ticket ordering, separate from sc_send_wait which handles SQ capacity. This separation ensures that send completions (the high-frequency wake source) wake only the current ticket holder rather than all queued waiters. Ticket handoff wakes only the ticket wait queue, and each ticket holder that exits via connection close propagates the wake to the next waiter in line. When a waiter successfully reserves slots, it advances the tail counter and wakes the next waiter. This creates an orderly handoff that prevents starvation while maintaining good throughput on the fast path when contention is low. Signed-off-by: Chuck Lever commit d7f3efd9ff474867b04e1ea784690f02450a245b Author: Chuck Lever Date: Thu Feb 26 09:47:39 2026 -0500 SUNRPC: Optimize rq_respages allocation in svc_alloc_arg svc_alloc_arg() invokes alloc_pages_bulk() with the full rq_maxpages count (~259 for 1MB messages) for the rq_respages array, causing a full-array scan despite most slots holding valid pages. svc_rqst_release_pages() NULLs only the range [rq_respages, rq_next_page) after each RPC, so only that range contains NULL entries. Limit the rq_respages fill in svc_alloc_arg() to that range instead of scanning the full array. svc_init_buffer() initializes rq_next_page to span the entire rq_respages array, so the first svc_alloc_arg() call fills all slots. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 7ed7504287a627834f2a35ef04e5dfd26d1c8986 Author: Chuck Lever Date: Thu Feb 26 09:47:38 2026 -0500 SUNRPC: Track consumed rq_pages entries The rq_pages array holds pages allocated for incoming RPC requests. Two transport receive paths NULL entries in rq_pages to prevent svc_rqst_release_pages() from freeing pages that the transport has taken ownership of: - svc_tcp_save_pages() moves partial request data pages to svsk->sk_pages during multi-fragment TCP reassembly. - svc_rdma_clear_rqst_pages() moves request data pages to head->rc_pages because they are targets of active RDMA Read WRs. A new rq_pages_nfree field in struct svc_rqst records how many entries were NULLed. svc_alloc_arg() uses it to refill only those entries rather than scanning the full rq_pages array. In steady state, the transport NULLs a handful of entries per RPC, so the allocator visits only those entries instead of the full ~259 slots (for 1MB messages). Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 26c8e6eb759e736e254a99f727aeda7a514eaa5c Author: Chuck Lever Date: Thu Feb 26 09:47:37 2026 -0500 svcrdma: preserve rq_next_page in svc_rdma_save_io_pages svc_rdma_save_io_pages() transfers response pages to the send context and sets those slots to NULL. It then resets rq_next_page to equal rq_respages, hiding the NULL region from svc_rqst_release_pages(). Now that svc_rqst_release_pages() handles NULL entries, this reset is no longer necessary. Removing it preserves the invariant that the range [rq_respages, rq_next_page) accurately describes how many response pages were consumed, enabling a subsequent optimization in svc_alloc_arg() that refills only the consumed range. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 22cc2ba5c27a500040d13cecb1dbfc3e4bccab81 Author: Chuck Lever Date: Thu Feb 26 09:47:36 2026 -0500 SUNRPC: Handle NULL entries in svc_rqst_release_pages svc_rqst_release_pages() releases response pages between rq_respages and rq_next_page. It currently passes the entire range to release_pages(), which does not expect NULL entries. A subsequent patch preserves the rq_next_page pointer in svc_rdma_save_io_pages() so that it accurately records how many response pages were consumed. After that change, the range [rq_respages, rq_next_page) can contain NULL entries where pages have already been transferred to a send context. Iterate through the range entry by entry, skipping NULLs, to handle this case correctly. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit ee66b9e3e1c69efc986f3932555f07121c3460a7 Author: Chuck Lever Date: Thu Feb 26 09:47:35 2026 -0500 SUNRPC: Allocate a separate Reply page array struct svc_rqst uses a single dynamically-allocated page array (rq_pages) for both the incoming RPC Call message and the outgoing RPC Reply message. rq_respages is a sliding pointer into rq_pages that each transport receive path must compute based on how many pages the Call consumed. This boundary tracking is a source of confusion and bugs, and prevents an RPC transaction from having both a large Call and a large Reply simultaneously. Allocate rq_respages as its own page array, eliminating the boundary arithmetic. This decouples Call and Reply buffer lifetimes, following the precedent set by rq_bvec (a separate dynamically- allocated array for I/O vectors). Each svc_rqst now pins twice as many pages as before. For a server running 16 threads with a 1MB maximum payload, the additional cost is roughly 16MB of pinned memory. The new dynamic svc thread count facility keeps this overhead minimal on an idle server. A subsequent patch in this series limits per-request repopulation to only the pages released during the previous RPC, avoiding a full-array scan on each call to svc_alloc_arg(). Note: We've considered several alternatives to maintaining a full second array. Each alternative reintroduces either boundary logic complexity or I/O-path allocation pressure. rq_next_page is initialized in svc_alloc_arg() and svc_process() during Reply construction, and in svc_rdma_recvfrom() as a precaution on error paths. Transport receive paths no longer compute it from the Call size. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 46ca8dd2441ffa49a7f31b9070f972f52c5779c3 Author: Chuck Lever Date: Thu Feb 26 09:47:34 2026 -0500 SUNRPC: Tighten bounds checking in svc_rqst_replace_page svc_rqst_replace_page() builds the Reply buffer by advancing rq_next_page through the response page range. The bounds check validates rq_next_page against the full rq_pages array, but the valid range for rq_next_page is [rq_respages, rq_page_end]. Use those bounds instead. This is correct today because rq_respages and rq_page_end both point into rq_pages, and it prepares for a subsequent change that separates the Reply page array from rq_pages. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 2a83ffc5575013784ea41739daf9e10200e44e7c Author: Benjamin Coddington Date: Wed Feb 25 07:51:38 2026 -0500 NFSD: Sign filehandles NFS clients may bypass restrictive directory permissions by using open_by_handle() (or other available OS system call) to guess the filehandles for files below that directory. In order to harden knfsd servers against this attack, create a method to sign and verify filehandles using SipHash-2-4 as a MAC (Message Authentication Code). According to https://cr.yp.to/siphash/siphash-20120918.pdf, SipHash can be used as a MAC, and our use of SipHash-2-4 provides a low 1 in 2^64 chance of forgery. Filehandles that have been signed cannot be tampered with, nor can clients reasonably guess correct filehandles and hashes that may exist in parts of the filesystem they cannot access due to directory permissions. Append the 8 byte SipHash to encoded filehandles for exports that have set the "sign_fh" export option. Filehandles received from clients are verified by comparing the appended hash to the expected hash. If the MAC does not match the server responds with NFS error _STALE. If unsigned filehandles are received for an export with "sign_fh" they are rejected with NFS error _STALE. Signed-off-by: Benjamin Coddington Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit a002ad8a9bc89c084bc40933065c88336700837e Author: Benjamin Coddington Date: Wed Feb 25 07:51:37 2026 -0500 NFSD/export: Add sign_fh export option In order to signal that filehandles on this export should be signed, add a "sign_fh" export option. Filehandle signing can help the server defend against certain filehandle guessing attacks. Setting the "sign_fh" export option sets NFSEXP_SIGN_FH. In a future patch NFSD uses this signal to append a MAC onto filehandles for that export. While we're in here, tidy a few stray expflags to more closely align to the export flag order. Link: https://lore.kernel.org/linux-nfs/cover.1772022373.git.bcodding@hammerspace.com Signed-off-by: Benjamin Coddington Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 62346217fd722510c3551858ad7d0fcfab8cce7e Author: Benjamin Coddington Date: Wed Feb 25 07:51:36 2026 -0500 NFSD: Add a key for signing filehandles A future patch will enable NFSD to sign filehandles by appending a Message Authentication Code(MAC). To do this, NFSD requires a secret 128-bit key that can persist across reboots. A persisted key allows the server to accept filehandles after a restart. Enable NFSD to be configured with this key via the netlink interface. Link: https://lore.kernel.org/linux-nfs/cover.1772022373.git.bcodding@hammerspace.com Signed-off-by: Benjamin Coddington Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 116b6b7acdd82605ed530232cd7509d1b5282f5c Author: Chuck Lever Date: Tue Feb 24 12:10:34 2026 -0500 nfsd: use dynamic allocation for oversized NFSv4.0 replay cache Commit 1e8e9913672a ("nfsd: fix heap overflow in NFSv4.0 LOCK replay cache") capped the replay cache copy at NFSD4_REPLAY_ISIZE to prevent a heap overflow, but set rp_buflen to zero when the encoded response exceeded the inline buffer. A retransmitted LOCK reaching the replay path then produced only a status code with no operation body, resulting in a malformed XDR response. When the encoded response exceeds the 112-byte inline rp_ibuf, a buffer is kmalloc'd to hold it. If the allocation fails, rp_buflen remains zero, preserving the behavior from the capped-copy fix. The buffer is freed when the stateowner is released or when a subsequent operation's response fits in the inline buffer. Fixes: 1e8e9913672a ("nfsd: fix heap overflow in NFSv4.0 LOCK replay cache") Signed-off-by: Chuck Lever commit 8be12e0cf21110f1e0b7fd21711ff13fb75bee72 Author: Jeff Layton Date: Tue Feb 24 08:28:11 2026 -0500 nfsd: convert global state_lock to per-net deleg_lock Replace the global state_lock spinlock with a per-nfsd_net deleg_lock. The state_lock was only used to protect delegation lifecycle operations (the del_recall_lru list and delegation hash/unhash), all of which are scoped to a single network namespace. Making the lock per-net removes a source of unnecessary contention between containers. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit facc4e3c80420e3466003ce09b576e005b56a015 Author: Jeff Layton Date: Mon Feb 23 12:10:01 2026 -0500 sunrpc: split cache_detail queue into request and reader lists Replace the single interleaved queue (which mixed cache_request and cache_reader entries distinguished by a ->reader flag) with two dedicated lists: cd->requests for upcall requests and cd->readers for open file handles. Readers now track their position via a monotonically increasing sequence number (next_seqno) rather than by their position in the shared list. Each cache_request is assigned a seqno when enqueued, and a new cache_next_request() helper finds the next request at or after a given seqno. This eliminates the cache_queue wrapper struct entirely, simplifies the reader-skipping loops in cache_read/cache_poll/cache_ioctl/ cache_release, and makes the data flow easier to reason about. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 552d0e17ea042fc4f959c4543cbbd0e54de7a8e9 Author: Jeff Layton Date: Mon Feb 23 12:10:00 2026 -0500 sunrpc: convert queue_wait from global to per-cache-detail waitqueue The queue_wait waitqueue is currently a file-scoped global, so a wake_up for one cache_detail wakes pollers on all caches. Convert it to a per-cache-detail field so that only pollers on the relevant cache are woken. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 17c1d66579ff27a7a8f2f407d1425272ff6fdd8c Author: Jeff Layton Date: Mon Feb 23 12:09:59 2026 -0500 sunrpc: convert queue_lock from global spinlock to per-cache-detail lock The global queue_lock serializes all upcall queue operations across every cache_detail instance. Convert it to a per-cache-detail spinlock so that different caches (e.g. auth.unix.ip vs nfsd.fh) no longer contend with each other on queue operations. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 6b4f16a532e794e0df90baf15173e2166f863864 Author: Chuck Lever Date: Sat Feb 21 13:39:59 2026 -0500 sunrpc: Add XPT flags missing from SVC_XPRT_FLAG_LIST Commit eccbbc7c00a5 ("nfsd: don't use sv_nrthreads in connection limiting calculations.") and commit 898374fdd7f0 ("nfsd: unregister with rpcbind when deleting a transport") added new XPT flags but neglected to update the show_svc_xprt_flags() macro. Signed-off-by: Chuck Lever commit 4f406a2c1e23b03c8f5920318a0effb15ba238da Author: Chuck Lever Date: Tue Feb 17 17:07:21 2026 -0500 lockd: Remove dead code from fs/lockd/xdr4.c Now that all NLMv4 server-side procedures use XDR encoder and decoder functions generated by xdrgen, the hand-written code in fs/lockd/xdr4.c is no longer needed. This file contained the original XDR processing logic that has been systematically replaced throughout this series. Remove the file and its Makefile reference to eliminate the dead code. The helper function nlm4svc_set_file_lock_range() is still needed by the generated code, so move it to xdr4.h as an inline function where it remains accessible. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit b131a424b0860d14b2778a5d3a8295f19e816291 Author: Chuck Lever Date: Tue Feb 17 17:07:20 2026 -0500 lockd: Remove C macros that are no longer used The conversion of all NLMv4 procedures to xdrgen-generated XDR functions is complete. The hand-rolled XDR size calculation macros (Ck, No, St, Rg) and the nlm_void structure definition served only the older implementations and are now unused. Also removes NLMDBG_FACILITY, which was set to the client debug flag in server-side code but never referenced, and corrects a comment to specify "NLMv4 Server procedures". Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 515788fa985fee596ddc9f8cd1e295e01883bb9e Author: Chuck Lever Date: Tue Feb 17 17:07:19 2026 -0500 lockd: Add LOCKD_SHARE_SVID constant for DOS sharing mode Replace the magic value ~(u32)0 with a named constant. This value is used as a synthetic svid when looking up lockowners for DOS share operations, which have no real process ID associated with them. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit b201ce7af2a28d8d6c43a3b5bd099a44f98c1c3e Author: Chuck Lever Date: Tue Feb 17 17:07:18 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 FREE_ALL procedure With all other NLMv4 procedures now converted to xdrgen-generated XDR functions, the FREE_ALL procedure can be converted as well. This conversion allows the removal of nlm4svc_retrieve_args(), a 79-line helper function that was used only by FREE_ALL to retrieve client information from lockd's internal data structures. Replace the NLMPROC4_FREE_ALL entry in the nlm_procedures4 array with an entry that uses xdrgen-built XDR decoders and encoders. The procedure handler is updated to use the new wrapper structure (nlm4_notify_wrapper) and call nlm4svc_lookup_host() directly, eliminating the need for the now-removed helper function. The .pc_argzero field is set to zero because xdrgen decoders fully initialize all fields in argp->xdrgen, making the early defensive memset unnecessary. The remaining argp fields that fall outside the xdrgen structures are cleared explicitly as needed. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit eedae4430122c5799f3d33bbd26dcbafc7d02cd1 Author: Chuck Lever Date: Tue Feb 17 17:07:17 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 NM_LOCK procedure Now that nlm4svc_do_lock() has been introduced to handle both monitored and non-monitored lock requests, the NLMv4 NM_LOCK procedure can be converted to use xdrgen-generated XDR functions. This conversion allows the removal of __nlm4svc_proc_lock(), a helper function that was previously shared between the LOCK and NM_LOCK procedures. Replace the NLMPROC4_NM_LOCK entry in the nlm_procedures4 array with an entry that uses xdrgen-built XDR decoders and encoders. The procedure handler is updated to call nlm4svc_do_lock() directly and access arguments through the argp->xdrgen hierarchy. The .pc_argzero field is set to zero because xdrgen decoders fully initialize all fields in argp->xdrgen, making the early defensive memset unnecessary. The remaining argp fields that fall outside the xdrgen structures are cleared explicitly as needed. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 985d022db383a2d750a63a0e828cf41fa649512a Author: Chuck Lever Date: Tue Feb 17 17:07:16 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 UNSHARE procedure Now that the share helpers have been decoupled from the NLMv3-specific struct nlm_args and file_lock initialization has been hoisted into the procedure handler, the NLMv4 UNSHARE procedure can be converted to use xdrgen-generated XDR functions. Replace the NLMPROC4_UNSHARE entry in the nlm_procedures4 array with an entry that uses xdrgen-built XDR decoders and encoders. The procedure handler is updated to use the new wrapper structures (nlm4_shareargs_wrapper and nlm4_shareres_wrapper) and access arguments through the argp->xdrgen hierarchy. The .pc_argzero field is set to zero because xdrgen decoders fully initialize all fields in argp->xdrgen, making the early defensive memset unnecessary. The remaining argp fields that fall outside the xdrgen structures are cleared explicitly as needed. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 57c7bb3bd22ce14167f8c83441fc68b3bb80133b Author: Chuck Lever Date: Tue Feb 17 17:07:15 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 SHARE procedure Now that the share helpers have been decoupled from the NLMv3-specific struct nlm_args and file_lock initialization has been hoisted into the procedure handler, the NLMv4 SHARE procedure can be converted to use xdrgen-generated XDR functions. Replace the NLMPROC4_SHARE entry in the nlm_procedures4 array with an entry that uses xdrgen-built XDR decoders and encoders. The procedure handler is updated to use the new wrapper structures (nlm4_shareargs_wrapper and nlm4_shareres_wrapper) and access arguments through the argp->xdrgen hierarchy. The .pc_argzero field is set to zero because xdrgen decoders fully initialize all fields in argp->xdrgen, making the early defensive memset unnecessary. The remaining argp fields that fall outside the xdrgen structures are cleared explicitly as needed. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4e6814b1750770213ab5b81bc04d8b941435a7b2 Author: Chuck Lever Date: Tue Feb 17 17:07:14 2026 -0500 lockd: Prepare share helpers for xdrgen conversion In order to convert the NLMv4 server-side XDR functions to use xdrgen, the internal share helpers need to be decoupled from the NLMv3-specific struct nlm_args. NLMv4 procedures will use different argument structures once they are converted. Refactor nlmsvc_share_file() and nlmsvc_unshare_file() to accept individual arguments (oh, access, mode) instead of the common struct nlm_args. This allows both protocol versions to call these helpers without forcing a common argument structure. While here, add kdoc comments to both functions and fix a comment typo in the unshare path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit bb2a70b610810874838f176a0d157d5cd0226c18 Author: Chuck Lever Date: Tue Feb 17 17:07:13 2026 -0500 lockd: Hoist file_lock init out of nlm4svc_decode_shareargs() The xdrgen-generated XDR decoders cannot initialize the file_lock structure because it is an internal kernel type, not part of the wire protocol. To prepare for converting SHARE and UNSHARE procedures to use xdrgen, the file_lock initialization must be moved from nlm4svc_decode_shareargs() into the procedure handlers themselves. This change removes one more dependency on the "struct nlm_lock::fl" field in fs/lockd/xdr4.c, allowing the XDR decoder to focus solely on unmarshalling wire data. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5eae0e00dc4bdc5a56a1e5e405332622d0942e89 Author: Chuck Lever Date: Tue Feb 17 17:07:12 2026 -0500 lockd: Convert server-side undefined procedures to xdrgen The NLMv4 protocol defines several procedure slots that are not implemented. These undefined procedures need proper handling to return rpc_proc_unavail to clients that mistakenly invoke them. This patch converts the three undefined procedure entries (slots 17, 18, and 19) to use xdrgen functions nlm4_svc_decode_void and nlm4_svc_encode_void. The nlm4svc_proc_unused function is also moved earlier in the file to follow the convention of placing procedure implementations before the procedure table. The pc_argsize, pc_ressize, and pc_argzero fields are now correctly set to zero since no arguments or results are processed. The pc_xdrressize field is updated to XDR_void to accurately reflect the response size. This conversion completes the migration of all NLMv4 server-side procedures to use xdrgen-generated XDR functions, improving type safety and eliminating hand-written XDR code. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 16099e1002728558d792eaba8c565e8892b57041 Author: Chuck Lever Date: Tue Feb 17 17:07:11 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 SM_NOTIFY procedure Convert the SM_NOTIFY procedure to use xdrgen functions nlm4_svc_decode_nlm4_notifyargs and nlm4_svc_encode_void. SM_NOTIFY is a private callback from statd to notify lockd when a remote host has rebooted. This patch introduces struct nlm4_notifyargs_wrapper to bridge between the xdrgen-generated nlm4_notifyargs and the nlm_reboot structure expected by nlm_host_rebooted(). The wrapper contains both the xdrgen-decoded arguments and a reboot field for the existing API. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments, making the early defensive memset unnecessary. This change also corrects the pc_xdrressize field, which previously contained a placeholder value. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5076fff93ce68cd13890b8f86099571ac2442ae3 Author: Chuck Lever Date: Tue Feb 17 17:07:10 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 GRANTED_RES procedure Convert the GRANTED_RES procedure to use xdrgen functions nlm4_svc_decode_nlm4_res and nlm4_svc_encode_void. GRANTED_RES is a callback procedure where the client sends granted lock results back to the server after an async GRANTED request. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments, making the early defensive memset unnecessary. This change also corrects the pc_xdrressize field, which previously contained a placeholder value. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d4fc8bc100353096f87ad1c052df9e7073696510 Author: Chuck Lever Date: Tue Feb 17 17:07:09 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 UNLOCK_RES procedure Update the NLMPROC4_UNLOCK_RES entry in nlm_procedures4 to invoke xdrgen-generated XDR functions. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit f0eec0eb509a11880ed8b28148734962cf382a93 Author: Chuck Lever Date: Tue Feb 17 17:07:08 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 CANCEL_RES procedure Convert the CANCEL_RES procedure to use xdrgen functions nlm4_svc_decode_nlm4_res and nlm4_svc_encode_void. CANCEL_RES is a callback procedure where the client sends cancel results back to the server after an async CANCEL request. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments, making the early defensive memset unnecessary. This change also corrects the pc_xdrressize field, which previously contained a placeholder value. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 50976ab9792af23f9a8672e415ca0d0bc93bd9d3 Author: Chuck Lever Date: Tue Feb 17 17:07:07 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 LOCK_RES procedure Convert the LOCK_RES procedure to use xdrgen functions nlm4_svc_decode_nlm4_res and nlm4_svc_encode_void. LOCK_RES is a callback procedure where the client sends lock results back to the server after an async LOCK request. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments, making the early defensive memset unnecessary. This change also corrects the pc_xdrressize field, which previously contained a placeholder value. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4764124811717650ecdef7a121768522683cafd7 Author: Chuck Lever Date: Tue Feb 17 17:07:06 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 TEST_RES procedure Convert the TEST_RES procedure to use xdrgen functions nlm4_svc_decode_nlm4_testres and nlm4_svc_encode_void. TEST_RES is a callback procedure where the client sends test lock results back to the server after an async TEST request. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments, making the early defensive memset unnecessary. This change also corrects the pc_xdrressize field, which previously contained a placeholder value. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 62721885e8610425403bc17e358b67db466e3cf8 Author: Chuck Lever Date: Tue Feb 17 17:07:05 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 GRANTED_MSG procedure Convert the GRANTED_MSG procedure to use xdrgen functions nlm4_svc_decode_nlm4_testargs and nlm4_svc_encode_void. The procedure handler uses the nlm4_testargs_wrapper structure that bridges between xdrgen types and the legacy nlm_lock representation. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments, making the early defensive memset unnecessary. The NLM async callback mechanism uses client-side functions which continue to take legacy struct nlm_res, preventing GRANTED and GRANTED_MSG from sharing code for now. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit eff7d82f89afc8b4fd133055a28ffd7158f8947a Author: Chuck Lever Date: Tue Feb 17 17:07:04 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 UNLOCK_MSG procedure Convert the UNLOCK_MSG procedure to use xdrgen functions nlm4_svc_decode_nlm4_unlockargs and nlm4_svc_encode_void. The procedure handler uses the nlm4_unlockargs_wrapper structure that bridges between xdrgen types and the legacy nlm_lock representation. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments, making the early defensive memset unnecessary. The NLM async callback mechanism uses client-side functions which continue to take legacy struct nlm_res, preventing UNLOCK and UNLOCK_MSG from sharing code for now. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit dea5b7ac0e9beabc5d4f54cec629e1dce9e69c5e Author: Chuck Lever Date: Tue Feb 17 17:07:03 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 CANCEL_MSG procedure The CANCEL_MSG procedure is part of NLM's asynchronous lock request flow, where clients send CANCEL_MSG to cancel pending lock requests. This patch continues the xdrgen migration by converting CANCEL_MSG to use generated XDR functions. This patch converts the CANCEL_MSG procedure to use xdrgen functions nlm4_svc_decode_nlm4_cancargs and nlm4_svc_encode_void generated from the NLM version 4 protocol specification. The procedure handler uses xdrgen types through the nlm4_cancargs_wrapper structure that bridges between generated code and the legacy nlm_lock representation. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments in the argp->xdrgen field, making the early defensive memset unnecessary. Remaining argp fields are cleared as needed. The NLM async callback mechanism uses client-side functions which continue to take legacy results like struct nlm_res, preventing CANCEL and CANCEL_MSG from sharing code for now. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit b2be4e28c23a47b3d4bd87ce1caacdbc4606d087 Author: Chuck Lever Date: Tue Feb 17 17:07:02 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 LOCK_MSG procedure The LOCK_MSG procedure is part of NLM's asynchronous lock request flow, where clients send LOCK_MSG to request locks that may block. This patch continues the xdrgen migration by converting LOCK_MSG to use generated XDR functions. This patch converts the LOCK_MSG procedure to use xdrgen functions nlm4_svc_decode_nlm4_lockargs and nlm4_svc_encode_void generated from the NLM version 4 protocol specification. The procedure handler uses xdrgen types through the nlm4_lockargs_wrapper structure that bridges between generated code and the legacy nlm_lock representation. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments in the argp->xdrgen field, making the early defensive memset unnecessary. Remaining argp fields are cleared as needed. The NLM async callback mechanism uses client-side functions which continue to take legacy results like struct nlm_res, preventing LOCK and LOCK_MSG from sharing code for now. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 331f2b6acb409a87105f4b0247a76e84d9472566 Author: Chuck Lever Date: Tue Feb 17 17:07:01 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 TEST_MSG procedure The TEST_MSG procedure is part of NLM's asynchronous lock request flow, where clients send TEST_MSG to check lock availability without blocking. This patch continues the xdrgen migration by converting TEST_MSG to use generated XDR functions. This patch converts the TEST_MSG procedure to use xdrgen functions nlm4_svc_decode_nlm4_testargs and nlm4_svc_encode_void generated from the NLM version 4 protocol specification. The procedure handler uses xdrgen types through the nlm4_testargs_wrapper structure that bridges between generated code and the legacy nlm_lock representation. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments in the argp->xdrgen field, making the early defensive memset unnecessary. Remaining argp fields are cleared as needed. The NLM async callback mechanism uses client-side functions which continue to take legacy results like struct nlm_res, preventing TEST and TEST_MSG from sharing code for now. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 3086ad11ab6ca4a95d7d65b87c40b8cbb60921a0 Author: Chuck Lever Date: Tue Feb 17 17:07:00 2026 -0500 lockd: Refactor nlm4svc_callback() The xdrgen-based XDR conversion requires each RPC procedure to handle its own argument extraction, since xdrgen generates distinct argument structures for each procedure rather than using a single shared type. This patch moves the host lookup logic from nlm4svc_callback() into each of the five MSG procedure handlers (TEST_MSG, LOCK_MSG, CANCEL_MSG, UNLOCK_MSG, and GRANTED_MSG). Each handler now performs its own host lookup from rqstp->rq_argp and passes the resulting host pointer to nlm4svc_callback(), which is reduced to a simpler helper that only dispatches the callback. This refactoring enables the subsequent xdrgen conversion patches by establishing the pattern where each procedure handles its own argument extraction, while preserving existing callback behavior unchanged. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 8de56f61e2d2f2534620e2f8ffc32243c13e139e Author: Chuck Lever Date: Tue Feb 17 17:06:59 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 GRANTED procedure The NLM GRANTED procedure provides server-to-client notification when a previously blocked lock request has been granted, completing the asynchronous lock request flow. This patch completes the xdrgen migration for basic NLMv4 procedures by converting the GRANTED procedure, the final one in this conversion series. This patch converts the GRANTED procedure to use xdrgen functions nlm4_svc_decode_nlm4_testargs and nlm4_svc_encode_nlm4_res generated from the NLM version 4 protocol specification. The procedure handler uses xdrgen types through a wrapper structure that bridges between generated code and the legacy nlm_lock representation still used by the core lockd logic. A new helper function nlm4_lock_to_nlm_lock() is introduced to convert xdrgen nlm4_lock structures to the legacy nlm_lock format. This helper complements the existing nlm4svc_lookup_host() and nlm4svc_lookup_file() functions used throughout this series. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments in the argp->xdrgen field, making the early defensive memset unnecessary. Remaining argp fields are cleared as needed. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit a2ac36e79b5db35367b1b269bf0a2aed9ba27be3 Author: Chuck Lever Date: Tue Feb 17 17:06:58 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 UNLOCK procedure UNLOCK releases locks acquired via the LOCK procedure. Conversion of TEST, LOCK, CANCEL, and UNLOCK provides the complete set of lock lifecycle operations required by the NLM protocol, enabling clients to test for conflicts, acquire locks, abort pending lock requests, and release held locks. The procedure handler converts arguments from the xdrgen-generated nlm4_unlockargs structure to the legacy nlm_lock representation through nlm4_unlockargs_wrapper. This maintains compatibility with core lockd logic while using XDR decoders and encoders generated from the NLMv4 protocol specification. The original __nlm4svc_proc_unlock function is retained because the asynchronous callback path invokes it directly, bypassing the RPC dispatch mechanism. The pc_argzero field is zero because nlm4_svc_decode_nlm4_unlockargs initializes all fields in argp->xdrgen, eliminating the need for early memset of the argument buffer. Remaining argp fields outside the xdrgen structure are cleared explicitly where needed. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 496a0e971ace1fa68b0fd5d00b2706ac61e7bc6c Author: Chuck Lever Date: Tue Feb 17 17:06:57 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 CANCEL procedure The NLM CANCEL procedure allows clients to cancel outstanding blocked lock requests, completing the set of lock-related operations that share common lookup patterns. This patch continues the xdrgen migration by converting the CANCEL procedure, leveraging the same nlm4svc_lookup_host() and nlm4svc_lookup_file() helpers established in the TEST procedure conversion to maintain consistency across the series. This patch converts the CANCEL procedure to use xdrgen functions nlm4_svc_decode_nlm4_cancargs and nlm4_svc_encode_nlm4_res generated from the NLM version 4 protocol specification. The procedure handler uses xdrgen types through a wrapper structure that bridges between generated code and the legacy nlm_lock representation still used by the core lockd logic. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments in the argp->xdrgen field, making the early defensive memset unnecessary. Remaining argp fields are cleared as needed. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 6cb785ab81bcb76c6ac985f9684c1d9118154427 Author: Chuck Lever Date: Tue Feb 17 17:06:56 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 LOCK procedure Replace legacy XDR handling in the LOCK procedure with xdrgen- generated functions nlm4_svc_decode_lockargs and nlm4_svc_encode_res. The new nlm4svc_do_lock() handler replaces __nlm4svc_proc_lock() at the NLMPROC4_LOCK entry point. Wrapper structures bridge xdrgen types to the legacy nlm_lock representation used by core lockd. The nlm4svc_lookup_host() and nlm4svc_lookup_file() helpers from the TEST conversion handle host and file lookup. The pc_argzero field is set to zero: xdrgen-generated decoders initialize all fields in argp->xdrgen, so a defensive memset is unnecessary. The wrapper's cookie and lock fields are cleared by nlm4svc_do_lock() before use. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 3de744ee4e4557da0d63be8a97ad44b4dad58912 Author: Chuck Lever Date: Tue Feb 17 17:06:55 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 TEST procedure The NLM TEST procedure requires host and file lookups to check lock state, operations that will be common across multiple NLM procedures being migrated to xdrgen. By introducing the helper functions nlm4svc_lookup_host() and nlm4svc_lookup_file() now, we establish reusable patterns for subsequent conversions in this series. This patch converts the TEST procedure to use xdrgen functions nlm4_svc_decode_testargs and nlm4_svc_encode_testres generated from the NLM version 4 protocol specification. The procedure handler is rewritten to use xdrgen types through wrapper structures that bridge between generated code and the legacy nlm_lock representation still used by the core lockd logic. TEST_MSG is to be converted in a subsequent patch. The pc_argzero field is set to zero because xdrgen decoders reliably initialize all arguments in the argp->xdrgen field, making the early defensive memset unnecessary. Remaining argp fields are cleared as needed. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 3b4839f09ca2615f7f6c99c9f9891a1a5b62071e Author: Chuck Lever Date: Tue Feb 17 17:06:54 2026 -0500 lockd: Use xdrgen XDR functions for the NLMv4 NULL procedure Hand-written XDR encoders and decoders are difficult to maintain and can inadvertently diverge from protocol specifications. By migrating to xdrgen-generated code, we improve type safety and ensure the implementation exactly matches the NLM version 4 protocol specification. This patch begins the migration by converting the NULL procedure to use nlm4_svc_decode_void and nlm4_svc_encode_void generated from Documentation/sunrpc/xdr/nlm4.x. The NULL procedure is straightforward as it has no arguments or results, making it an ideal starting point for this series. The pc_xdrressize field is set to XDR_void (zero) to reflect that this procedure returns no XDR-encoded data. The argzero field is also set to zero since xdrgen decoders reliably initialize all decoded values. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5bc37b759ec0cdde2c652a2637d704f2d6306617 Author: Chuck Lever Date: Tue Feb 17 17:06:53 2026 -0500 Documentation: Add the RPC language description of NLM version 4 In order to generate source code to encode and decode NLMv4 protocol elements, include a copy of the RPC language description of NLMv4 for xdrgen to process. The language description is an amalgam of RFC 1813 and the Open Group's XNFS specification: https://pubs.opengroup.org/onlinepubs/9629799/chap10.htm The C code committed here was generated from the new nlm4.x file using tools/net/sunrpc/xdrgen/xdrgen. The goals of replacing hand-written XDR functions with ones that are tool-generated are to improve memory safety and make XDR encoding and decoding less brittle to maintain. The xdrgen utility derives both the type definitions and the encode/decode functions directly from protocol specifications, using names and symbols familiar to anyone who knows those specs. Unlike hand-written code that can inadvertently diverge from the specification, xdrgen guarantees that the generated code matches the specification exactly. We would eventually like xdrgen to generate Rust code as well, making the conversion of the kernel's NFS stacks to use Rust just a little easier for us. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit f52792f484ba2316853736856dde19b7e7458861 Author: Dai Ngo Date: Fri Feb 13 10:36:30 2026 -0800 NFSD: Enforce timeout on layout recall and integrate lease manager fencing When a layout conflict triggers a recall, enforcing a timeout is necessary to prevent excessive nfsd threads from being blocked in __break_lease ensuring the server continues servicing incoming requests efficiently. This patch introduces a new function to lease_manager_operations: lm_breaker_timedout: Invoked when a lease recall times out and is about to be disposed of. This function enables the lease manager to inform the caller whether the file_lease should remain on the flc_list or be disposed of. For the NFSD lease manager, this function now handles layout recall timeouts. If the layout type supports fencing and the client has not been fenced, a fence operation is triggered to prevent the client from accessing the block device. While the fencing operation is in progress, the conflicting file_lease remains on the flc_list until fencing is complete. This guarantees that no other clients can access the file, and the client with exclusive access is properly blocked before disposal. Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit b48f44f36e6607b2f818560f19deb86b4a9c717b Author: Dai Ngo Date: Wed Feb 4 13:07:43 2026 -0800 NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg In nfsd4_add_rdaccess_to_wrdeleg, if fp->fi_fds[O_RDONLY] is already set by another thread, __nfs4_file_get_access should not be called to increment the nfs4_file access count since that was already done by the thread that added READ access to the file. The extra fi_access count in nfs4_file can prevent the corresponding nfsd_file from being freed. When stopping nfs-server service, these extra access counts trigger a BUG in kmem_cache_destroy() that shows nfsd_file object remaining on __kmem_cache_shutdown. This problem can be reproduced by running the Git project's test suite over NFS. Fixes: 8072e34e1387 ("nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg()") Signed-off-by: Dai Ngo Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 6f57293abb8d087de830dd3f02e66d94b3e59973 Author: Andy Shevchenko Date: Wed Feb 4 21:21:51 2026 +0100 sunrpc: Fix compilation error (`make W=1`) when dprintk() is no-op Clang compiler is not happy about set but unused variables: .../flexfilelayout/flexfilelayoutdev.c:56:9: error: variable 'ret' set but not used [-Werror,-Wunused-but-set-variable] .../flexfilelayout/flexfilelayout.c:1505:6: error: variable 'err' set but not used [-Werror,-Wunused-but-set-variable] .../nfs4proc.c:9244:12: error: variable 'ptr' set but not used [-Werror,-Wunused-but-set-variable] Fix these by forwarding parameters of dprintk() to no_printk(). The positive side-effect is a format-string checker enabled even for the cases when dprintk() is no-op. Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") Fixes: fc931582c260 ("nfs41: create_session operation") Acked-by: Geert Uytterhoeven Reviewed-by: Jeff Layton Signed-off-by: Andy Shevchenko Signed-off-by: Chuck Lever commit adcc59114ccd402259c089b0fea24da5e4974563 Author: Andy Shevchenko Date: Wed Feb 4 21:21:50 2026 +0100 sunrpc: Kill RPC_IFDEBUG() RPC_IFDEBUG() is used in only two places. In one the user of the definition is guarded by ifdeffery, in the second one it's implied due to dprintk() usage. Kill the macro and move the ifdeffery to the regular condition with the variable defined inside, while in the second case add the same conditional and move the respective code there. Reviewed-by: Jeff Layton Signed-off-by: Andy Shevchenko Signed-off-by: Chuck Lever commit f83c8dda456ce4863f346aa26d88efa276eda35d Author: Andy Shevchenko Date: Wed Feb 4 21:21:49 2026 +0100 nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() Clang compiler is not happy about set but unused variable (when dprintk() is no-op): .../blocklayout/blocklayout.c:384:9: error: variable 'count' set but not used [-Werror,-Wunused-but-set-variable] Remove a leftover from the previous cleanup. Fixes: 3a6fd1f004fc ("pnfs/blocklayout: remove read-modify-write handling in bl_write_pagelist") Acked-by: Anna Schumaker Reviewed-by: Jeff Layton Signed-off-by: Andy Shevchenko Signed-off-by: Chuck Lever commit 45cd458b57feeec639af3d7da05ce8c290d0179b Author: Chuck Lever Date: Wed Jan 28 10:19:35 2026 -0500 lockd: Relocate svc_version definitions to XDR layer Public RPC server interfaces become cluttered when internal XDR implementation details leak into them. The procedure count, maximum XDR buffer size, and per-CPU call counters serve no purpose outside the code that encodes and decodes NLM protocol messages. Exposing these values through global headers creates unnecessary coupling between the RPC dispatch logic and the XDR layer. Relocating the svc_version structure definitions confines this implementation information to the files where XDR encoding and decoding occur. In svc.c, the buffer size computation now reads vs_xdrsize from the version structures rather than relying on a preprocessor constant. This calculation occurs at service initialization, after the linker has resolved the version structure definitions. The dispatch function becomes non-static because both the version structures and the dispatcher reside in different translation units. The NLMSVC_XDRSIZE macro is removed from xdr.h because buffer size is now computed from the union of XDR argument and result structures, matching the pattern used in other RPC services. Version 1 and 3 share the same procedure table but maintain separate counter arrays. Version 4 remains separate due to its distinct procedure definitions. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit b3f76a9b13f014edcba9eaae2bc09a6af7267cee Author: Chuck Lever Date: Wed Jan 28 10:19:34 2026 -0500 lockd: Move nlm4svc_set_file_lock_range() Both client-side and server-side NLMv4 code convert lock byte ranges from the wire format (start, length) to the kernel's file_lock format (start, end). The current nlm4svc_set_file_lock_range() performs this conversion, but the "svc" prefix incorrectly suggests server-only use, and client code must include server-internal headers to access it. Rename to lockd_set_file_lock_range4() and relocate to the shared lockd.h header, making it accessible to both client and server code. This eliminates the need for client code to include xdr4.h, reducing coupling between the XDR implementation files. While relocating the function, add input validation: clamp the starting offset to OFFSET_MAX before use. Without this, a malformed lock request with off > OFFSET_MAX results in fl_start > fl_end, violating file_lock invariants and potentially causing incorrect lock conflict detection. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5829352e568d24dd04ae112128a4f44748d073bc Author: Chuck Lever Date: Wed Jan 28 10:19:33 2026 -0500 lockd: Make linux/lockd/nlm.h an internal header The NLM protocol constants and status codes in nlm.h are needed only by lockd's internal implementation. NFS client code and NFSD interact with lockd through the stable API in bind.h and have no direct use for protocol-level definitions. Exposing these definitions globally via bind.h creates unnecessary coupling between lockd internals and its consumers. Moving nlm.h from include/linux/lockd/ to fs/lockd/ clarifies the API boundary: bind.h provides the lockd service interface, while nlm.h remains available only to code within fs/lockd/ that implements the protocol. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 615384a24b1e6b0f091ebc1dfbf7ec8b4c27fa81 Author: Chuck Lever Date: Wed Jan 28 10:19:32 2026 -0500 lockd: Move xdr.h from include/linux/lockd/ to fs/lockd/ The lockd subsystem unnecessarily exposes internal NLM XDR type definitions through the global include path. These definitions are not used by any code outside fs/lockd/, making them inappropriate for include/linux/lockd/. Moving xdr.h to fs/lockd/ narrows the API surface and clarifies that these types are internal implementation details. The comment in linux/lockd/bind.h stating xdr.h was needed for "xdr-encoded error codes" is stale: no lockd API consumers use those codes. Forward declarations for struct nfs_fh and struct file_lock are added to bind.h because their definitions were previously pulled in transitively through xdr.h. Additionally, nfs3proc.c and proc.c need explicit includes of filelock.h for FL_CLOSE and for accessing struct file_lock members, respectively. Built and tested with lockd client/server operations. No functional change. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 236f3171ac690f632e13d391f47c68c3a8519bd2 Author: Chuck Lever Date: Wed Jan 28 10:19:31 2026 -0500 lockd: Remove lockd/debug.h The lockd include structure has unnecessary indirection. The header include/linux/lockd/debug.h is consumed only by fs/lockd/lockd.h, creating an extra compilation dependency and making the code harder to navigate. Fold the debug.h definitions directly into lockd.h and remove the now-redundant header. This reduces the include tree depth and makes the debug-related definitions easier to find when working on lockd internals. Build-tested with lockd built as module and built-in. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 2c562c6e6715619ce34bb37d8a0a5e40fdcc7a44 Author: Chuck Lever Date: Wed Jan 28 10:19:30 2026 -0500 lockd: Relocate include/linux/lockd/lockd.h Headers placed in include/linux/ form part of the kernel's internal API and signal to subsystem maintainers that other parts of the kernel may depend on them. By moving lockd.h into fs/lockd/, lockd becomes a more self-contained module whose internal interfaces are clearly distinguished from its public contract with the rest of the kernel. This relocation addresses a long-standing XXX comment in the header itself that acknowledged the file's misplacement. Future changes to lockd internals can now proceed with confidence that external consumers are not inadvertently coupled to implementation details. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4db2f8a016dc9f9b357bfbf5c507c2582bb36730 Author: Chuck Lever Date: Wed Jan 28 10:19:29 2026 -0500 lockd: Move share.h from include/linux/lockd/ to fs/lockd/ The share.h header defines struct nlm_share and declares the DOS share management functions used by the NLM server to implement NLM_SHARE and NLM_UNSHARE operations. These interfaces are used exclusively within the lockd subsystem. A git grep search confirms no external code references them. Relocating this header from include/linux/lockd/ to fs/lockd/ narrows the public API surface of the lockd module. Out-of-tree code cannot depend on these internal interfaces after this change. Future refactoring of the share management implementation thus requires no consideration of external consumers. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit f4d5f8caadd858f11b21e8a9e5c85290fc21a568 Author: Chuck Lever Date: Wed Jan 28 10:19:28 2026 -0500 lockd: Move xdr4.h from include/linux/lockd/ to fs/lockd/ The xdr4.h header declares NLMv4-specific XDR encoder/decoder functions and error codes that are used exclusively within the lockd subsystem. Moving it from include/linux/lockd/ to fs/lockd/ clarifies the intended scope of these declarations and prevents external code from depending on lockd-internal interfaces. This change reduces the public API surface of the lockd module and makes it easier to refactor NLMv4 internals without risk of breaking out-of-tree consumers. The header's contents are implementation details of the NLMv4 wire protocol handling, not a contract with other kernel subsystems. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 840621fd2ff23ada8b9262d90477e75232566e6b Author: Chuck Lever Date: Wed Jan 28 10:19:27 2026 -0500 NFS: Use nlmclnt_shutdown_rpc_clnt() to safely shut down NLM A race condition exists in shutdown_store() when writing to the sysfs "shutdown" file concurrently with nlm_shutdown_hosts_net(). Without synchronization, the following sequence can occur: 1. shutdown_store() reads server->nlm_host (non-NULL) 2. nlm_shutdown_hosts_net() acquires nlm_host_mutex, calls rpc_shutdown_client(), sets h_rpcclnt to NULL, and potentially frees the host via nlm_gc_hosts() 3. shutdown_store() dereferences the now-stale or freed host Introduce nlmclnt_shutdown_rpc_clnt(), which acquires nlm_host_mutex before accessing h_rpcclnt. This synchronizes with nlm_shutdown_hosts_net() and ensures the rpc_clnt pointer remains valid during the shutdown operation. This change also improves API layering: NFS client code no longer needs to include the internal lockd header to access nlm_host fields. The new helper resides in bind.h alongside other public lockd interfaces. Reported-by: Jeff Layton Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit efb5b15e3b78f5644dd2d4ddec8880e0c9aa5b5f Author: Chuck Lever Date: Wed Jan 28 10:19:26 2026 -0500 lockd: Relocate nlmsvc_unlock API declarations The nlmsvc_unlock_all_by_sb() and nlmsvc_unlock_all_by_ip() functions are part of lockd's external API, consumed by other kernel subsystems. Their declarations currently reside in linux/lockd/lockd.h alongside internal implementation details, which blurs the boundary between lockd's public interface and its private internals. Moving these declarations to linux/lockd/bind.h groups them with other external API functions and makes the separation explicit. This clarifies which functions are intended for external use and reduces the risk of internal implementation details leaking into the public API surface. Build-tested with allyesconfig; no functional changes. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 7db001e03d7a668ca6c3789fee42a24236ca90f6 Author: Chuck Lever Date: Wed Jan 28 10:19:25 2026 -0500 lockd: Have nlm_fopen() return errno values The nlm_fopen() function is part of the API between nfsd and lockd. Currently its return value is an on-the-wire NLM status code. But that forces NFSD to include NLM wire protocol definitions despite having no other dependency on the NLM wire protocol. In addition, a CONFIG_LOCKD_V4 Kconfig symbol appears in the middle of NFSD source code. Refactor: Let's not use on-the-wire values as part of a high-level API between two Linux kernel modules. That's what we have errno for, right? And, instead of simply moving the CONFIG_LOCKD_V4 check, we can get rid of it entirely and let the decision of what actual NLM status code goes on the wire to be left up to NLM version-specific code. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 9e0d0c61940796893e0c2200cdc7be0684218238 Author: Chuck Lever Date: Wed Jan 28 10:19:24 2026 -0500 lockd: Introduce nlm__int__deadlock The use of CONFIG_LOCKD_V4 in combination with a later cast_status() in the NLMv3 code is difficult to reason about. Instead, replace the use of nlm_deadlock with an implementation-defined status value that version-specific code translates appropriately. The new approach establishes a translation boundary: generic lockd code returns nlm__int__deadlock when posix_lock_file() yields -EDEADLK. Version-specific handlers (svc4proc.c for NLMv4, svcproc.c for NLMv3) translate this internal status to the appropriate wire protocol value. NLMv4 maps to nlm4_deadlock; NLMv3 maps to nlm_lck_denied (since NLMv3 lacks a deadlock-specific status code). Later this modification will also remove the need to include NLMv4 headers in NLMv3 and generic code. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 153b9e025308417d167332c93e1bcc11174178de Author: Chuck Lever Date: Wed Jan 28 10:19:23 2026 -0500 lockd: Relocate and rename nlm_drop_reply The nlm_drop_reply status code is internal to the kernel's lockd implementation and must never appear on the wire. Its previous location in xdr.h grouped it with legitimate NLM protocol status codes, obscuring this critical distinction. Relocate the definition to lockd.h with a comment block for internal status codes, and rename to nlm__int__drop_reply to make its internal-only nature explicit. This prepares for adding additional internal status codes in subsequent patches. Signed-off-by: Chuck Lever commit aa772bcc40e1722302b05045d96c0169ac5a2717 Author: Chuck Lever Date: Wed Jan 28 10:19:22 2026 -0500 lockd: Simplify cast_status() in svcproc.c Clean up: The svcproc.c file handles only NLM v1 and v3 requests. NLMv4 requests are routed to a separate procedure table in svc4proc.c, so rqstp->rq_vers can never be 4 in this context. Remove the unused vers parameter and the dead "vers != 4" check from cast_to_nlm(). This eliminates the need for the macro wrapper. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 01afb9008527d2be96046a6859de2951306a93e9 Author: Jeff Layton Date: Mon Jan 26 07:10:14 2026 -0500 nfsd: remove NFSD_V4_DELEG_TIMESTAMPS Kconfig option Now that there is a runtime debugfs switch, eliminate the compile-time switch and always build in support for delegated timestamps. Administrators who previously disabled this feature at compile time can disable it at runtime via: echo 0 > /sys/kernel/debug/nfsd/delegated_timestamps Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 6237a17fb8b150b6f2e5d243b2d4f23f85931c2e Author: Jeff Layton Date: Mon Jan 26 07:10:13 2026 -0500 nfsd: add a runtime switch for disabling delegated timestamps The delegated timestamp code seems to be working well enough now that we want to make it always be built in. In the event that there are problems though, we still want to be able to disable them for debugging purposes. Add a switch to debugfs to enable them at runtime. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit ed7f4d323b5c86cfe9ca6eb3a955416aaa335a9c Author: Ryota Sakamoto Date: Sat Jan 24 14:17:19 2026 +0900 SUNRPC: Replace KUnit tests for memcmp() with KUNIT_EXPECT_MEMEQ_MSG() Replace KUnit tests for memcmp() with KUNIT_EXPECT_MEMEQ_MSG() to improve debugging that prints the hex dump of the buffers when the assertion fails, whereas memcmp() only returns an integer difference. Signed-off-by: Ryota Sakamoto Signed-off-by: Chuck Lever commit a0ed7975de5e47091ab16aaece75d1b64c5709e7 Author: Dai Ngo Date: Mon Jan 19 10:41:26 2026 -0500 NFSD: Track SCSI Persistent Registration Fencing per Client with xarray When a client holding pNFS SCSI layouts becomes unresponsive, the server revokes access by preempting the client's SCSI persistent reservation key. A layout recall is issued for each layout the client holds; if the client fails to respond, each recall triggers a fence operation. The first preempt for a given device succeeds and removes the client's key registration. Subsequent preempts for the same device fail because the key is no longer registered. Update the NFS server to handle SCSI persistent registration fencing on a per-client and per-device basis by utilizing an xarray associated with the nfs4_client structure. Each xarray entry is indexed by the dev_t of a block device registered by the client. The entry maintains a flag indicating whether this device has already been fenced for the corresponding client. When the server issues a persistent registration key to a client, it creates a new xarray entry at the dev_t index with the fenced flag initialized to 0. Before performing a fence via nfsd4_scsi_fence_client, the server checks the corresponding entry using the device's dev_t. If the fenced flag is already set, the fence operation is skipped; otherwise, the flag is set to 1 and fencing proceeds. The xarray is destroyed when the nfs4_client is released in __destroy_client. Signed-off-by: Dai Ngo Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit 7b546bd89975cfbd60d4b86f2d1a3b6be5f9e558 Author: NeilBrown Date: Sat Oct 18 11:11:23 2025 +1100 sunrpc/cache: improve RCU safety in cache_list walking. 1/ consistently use hlist_add_head_rcu() when adding to the cachelist to reflect the fact that it can be concurrently walked using RCU. In fact hlist_add_head() has all the needed barriers so this is no safety issue, primarily a clarity issue. 2/ call cache_get() *before* adding the list with hlist_add_head_rcu(). It is generally safest to inc the refcount before publishing a reference. In this case it doesn't have any behavioural effect as code which does an RCU walk does not depend on precision of the refcount, and it will always be at least one. But it looks more correct to use this order. 3/ avoid possible races between NULL tests and hlist_entry_safe() calls. It is possible that a test will find that .next or .head is not NULL, but hlist_entry_safe() will find that it is NULL. This can lead to incorrect behaviour with the list-walk terminating early. It is safest to always call hlist_entry_safe() and test the result. Also simplify the *ppos calculation by simply assigning the hash shifted 32, rather than masking out low bits and incrementing high bits. Signed-off-by: NeilBrown Signed-off-by: Chuck Lever commit 322ecd01bf8ad7e0da21e174679aff1759e68b2c Author: Jeff Layton Date: Tue Jan 13 13:37:40 2026 -0500 nfsd/sunrpc: move rq_cachetype into struct nfsd_thread_local_info The svc_rqst->rq_cachetype field is only accessed by nfsd. Move it into the nfsd_thread_local_info instead. Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Chuck Lever commit 55b6dd54c3bcb6edf7ad630a4510759f4b0cf1cd Author: Jeff Layton Date: Tue Jan 13 13:37:39 2026 -0500 nfsd/sunrpc: add svc_rqst->rq_private pointer and remove rq_lease_breaker rq_lease_breaker has always been a NFSv4 specific layering violation in svc_rqst. The reason it's there though is that we need a place that is thread-local, and accessible from the svc_rqst pointer. Add a new rq_private pointer to struct svc_rqst. This is intended for use by the threads that are handling the service. sunrpc code doesn't touch it. In nfsd, define a new struct nfsd_thread_local_info. nfsd declares one of these on the stack and puts a pointer to it in rq_private. Add a new ntli_lease_breaker field to the new struct and convert all of the places that access rq_lease_breaker to use the new field instead. Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Chuck Lever commit 3a2486cc1da5cf637fe5da4540929d67c4540022 Author: Gary Guo Date: Tue Feb 3 11:34:10 2026 +0000 kbuild: rust: provide an option to inline C helpers into Rust A new experimental Kconfig option, `RUST_INLINE_HELPERS` is added to allow C helpers (which were created to allow Rust to call into inline/macro C functions without having to re-implement the logic in Rust) to be inlined into Rust crates without performing global LTO. If the option is enabled, the following is performed: * For helpers, instead of compiling them to an object file to be linked into vmlinux, they're compiled to LLVM IR bitcode. Two versions are generated: one for built-in code (`helpers.bc`) and one for modules (`helpers_module.bc`, with -DMODULE defined). This ensures that C macros/inlines that behave differently for modules (e.g. static calls) function correctly when inlined. * When a Rust crate or object is compiled, instead of generating an object file, LLVM bitcode is generated. * llvm-link is invoked with --internalize to combine the helper bitcode with the crate bitcode. This step is similar to LTO, but this is much faster since it only needs to inline the helpers. * clang is invoked to turn the combined bitcode into a final object file. * Since clang may produce LLVM bitcode when LTO is enabled, and objtool requires ELF input, $(cmd_ld_single) is invoked to ensure the object is converted to ELF before objtool runs. The --internalize flag tells llvm-link to treat all symbols in helpers.bc using `internal` linkage [1]. This matches the behavior of `clang` on `static inline` functions, and avoids exporting the symbol from the object file. To ensure that RUST_INLINE_HELPERS is not incompatible with BTF, we pass the -g0 flag when building helpers. See commit 5daa0c35a1f0 ("rust: Disallow BTF generation with Rust + LTO") for details. We have an intended triple mismatch of `aarch64-unknown-none` vs `aarch64-unknown-linux-gnu`, so we pass --suppress-warnings to llvm-link to suppress it. I considered adding some sort of check that KBUILD_MODNAME is not present in helpers_module.bc, but this is actually not so easy to carry out because .bc files store strings in a weird binary format, so you cannot just grep it for a string to check whether it ended up using KBUILD_MODNAME anywhere. [ Andreas writes: For the rnull driver, enabling helper inlining with this patch gives an average speedup of 2% over the set of 120 workloads that we publish on [2]. Link: https://rust-for-linux.com/null-block-driver [2] This series also uncovered a pre-existing UB instance thanks to an `objtool` warning which I noticed while testing the series (details in the mailing list). - Miguel ] Link: https://github.com/llvm/llvm-project/pull/170397 [1] Co-developed-by: Boqun Feng Signed-off-by: Boqun Feng Co-developed-by: Matthew Maurer Signed-off-by: Matthew Maurer Signed-off-by: Gary Guo Co-developed-by: Alice Ryhl Signed-off-by: Alice Ryhl Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Tested-by: Andreas Hindborg Reviewed-by: Andreas Hindborg Link: https://patch.msgid.link/20260203-inline-helpers-v2-3-beb8547a03c9@google.com [ Some changes, apart from the rebase: - Added "(EXPERIMENTAL)" to Kconfig as the commit mentions. - Added `depends on ARM64 || X86_64` and `!UML` for now, since this is experimental, other architectures may require other changes (e.g. the issues I mentioned in the mailing list for ARM and UML) and they are not really tested so far. So let arch maintainers pick this up if they think it is worth it. - Gated the `cmd_ld_single` step also into the new mode, which also means that any possible future `objcopy` step is done after the translation, as expected. - Added `.gitignore` for `.bc` with exception for existing script. - Added `part-of-*` for helpers bitcode files as discussed, and dropped `$(if $(filter %_module.bc,$@),-DMODULE)` since `-DMODULE` is already there (would be duplicated otherwise). - Moved `LLVM_LINK` to keep binutils list alphabetized. - Fixed typo in title. - Dropped second `cmd_ld_single` commit message paragraph. - Miguel ] Signed-off-by: Miguel Ojeda commit db702816ad4d1d0ae54a5443c8865448f2dde75f Author: Gary Guo Date: Tue Feb 3 11:34:09 2026 +0000 rust: helpers: #define __rust_helper Because of LLVM inling checks, it's generally not possible to inline a C helper into Rust code, even with LTO: * LLVM doesn't want to inline functions compiled with `-fno-delete-null-pointer-checks` with code compiled without. The C CGUs all have this enabled and Rust CGUs don't. Inlining is okay since this is one of the hardening features that does not change the ABI, and we shouldn't have null pointer dereferences in these helpers. * LLVM doesn't want to inline functions with different list of builtins. C side has `-fno-builtin-wcslen`; `wcslen` is not a Rust builtin, so they should be compatible, but LLVM does not perform inlining due to attributes mismatch. * clang and Rust doesn't have the exact target string. Clang generates `+cmov,+cx8,+fxsr` but Rust doesn't enable them (in fact, Rust will complain if `-Ctarget-feature=+cmov,+cx8,+fxsr` is used). x86-64 always enable these features, so they are in fact the same target string, but LLVM doesn't understand this and so inlining is inhibited. This can be bypassed with `--ignore-tti-inline-compatible`, but this is a hidden option. To fix this, we can add __always_inline on every helper, which skips these LLVM inlining checks. For this purpose, introduce a new __rust_helper macro that needs to be added to every helper. Most helpers already have __rust_helper specified, but there are a few missing. The only consequence of this is that those specific helpers do not get inlined. Signed-off-by: Gary Guo Signed-off-by: Alice Ryhl Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Tested-by: Andreas Hindborg Reviewed-by: Andreas Hindborg Link: https://patch.msgid.link/20260203-inline-helpers-v2-2-beb8547a03c9@google.com Signed-off-by: Miguel Ojeda commit e90f97ce20575cd0cdbe01db588f907448b6d9f2 Author: Gary Guo Date: Tue Feb 3 11:34:08 2026 +0000 kbuild: rust: add `CONFIG_RUSTC_CLANG_LLVM_COMPATIBLE` This config detects if Rust and Clang have matching LLVM major version. All IR or bitcode operations (e.g. LTO) rely on LLVM major version to be matching, otherwise it may generate errors, or worse, miscompile silently due to change of IR semantics. It's usually suggested to use the exact same LLVM version, but this can be difficult to guarantee. Rust's suggestion [1] is also major-version only, so I think this check is sufficient for the kernel. Link: https://doc.rust-lang.org/rustc/linker-plugin-lto.html [1] Reviewed-by: Andreas Hindborg Signed-off-by: Gary Guo Signed-off-by: Matthew Maurer Signed-off-by: Alice Ryhl Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Tested-by: Andreas Hindborg Link: https://patch.msgid.link/20260203-inline-helpers-v2-1-beb8547a03c9@google.com [ Fixed typo. - Miguel ] Signed-off-by: Miguel Ojeda commit 889c8c934d175f55a3415abe5472c88a5612e89d Author: Gary Guo Date: Thu Mar 19 12:16:47 2026 +0000 rust: rework `build_assert!` documentation Add a detailed comparison and recommendation of the three types of build-time assertion macro as module documentation (and un-hide the module to render them). The documentation on the macro themselves are simplified to only cover the scenarios where they should be used; links to the module documentation is added instead. Reviewed-by: Yury Norov Signed-off-by: Gary Guo Reviewed-by: Alexandre Courbot Reviewed-by: Alice Ryhl Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260319121653.2975748-4-gary@kernel.org [ Added periods on comments. - Miguel ] Signed-off-by: Miguel Ojeda commit 560a7a9b9267fbe31a68270ca0ad22b6a4db44a5 Author: Gary Guo Date: Thu Mar 19 12:16:46 2026 +0000 rust: add `const_assert!` macro The macro is a more powerful version of `static_assert!` for use inside function contexts. This is powered by inline consts, so enable the feature for old compiler versions that does not have it stably. While it is possible already to write `const { assert!(...) }`, this provides a short hand that is more uniform with other assertions. It also formats nicer with rustfmt where it will not be formatted into multiple lines. Two users that would route via the Rust tree are converted. Reviewed-by: Yury Norov Signed-off-by: Gary Guo Reviewed-by: Alexandre Courbot Reviewed-by: Alice Ryhl Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260319121653.2975748-3-gary@kernel.org [ Rebased. Fixed period typo. - Miguel ] Signed-off-by: Miguel Ojeda commit cf0d9080c6f795bc6be08babbffa29b62c06e9b0 Merge: 686aad8353a5a4 137ac69c15fd2a Author: Jakub Kicinski Date: Sun Mar 29 14:37:52 2026 -0700 Merge branch 'net-hsr-subsystem-cleanups-and-modernization' Luka Gejak says: ==================== net: hsr: subsystem cleanups and modernization This series contains two focused HSR cleanups with practical benefit. It constifies protocol operation tables and replaces a hardcoded function name with __func__ to keep diagnostics correct across refactoring. ==================== Link: https://patch.msgid.link/20260326174600.136232-1-luka.gejak@linux.dev Signed-off-by: Jakub Kicinski commit 137ac69c15fd2a9acf5d4d95456fe75f23c9ffc5 Author: Luka Gejak Date: Thu Mar 26 18:46:00 2026 +0100 net: hsr: use __func__ instead of hardcoded function name Replace the hardcoded string "hsr_get_untagged_frame" with the standard __func__ macro in netdev_warn_once() call to make the code more robust to refactoring. Signed-off-by: Luka Gejak Reviewed-by: Felix Maurer Link: https://patch.msgid.link/20260326174600.136232-3-luka.gejak@linux.dev Signed-off-by: Jakub Kicinski commit 3e09b370f830d6f00336390a5f622f7202dcd7cc Author: Luka Gejak Date: Thu Mar 26 18:45:59 2026 +0100 net: hsr: constify hsr_ops and prp_ops protocol operation structures The hsr_ops and prp_ops structures are assigned to hsr->proto_ops during device initialization and are never modified at runtime. Declaring them as const allows the compiler to place these structures in read-only memory, which improves security by preventing accidental or malicious modification of the function pointers they contain. The proto_ops field in struct hsr_priv is also updated to a const pointer to maintain type consistency. Signed-off-by: Luka Gejak Reviewed-by: Felix Maurer Link: https://patch.msgid.link/20260326174600.136232-2-luka.gejak@linux.dev Signed-off-by: Jakub Kicinski commit 686aad8353a5a4d3358deaba08b748a6b6e6d6c2 Merge: 57ec1622b62ae8 cd1082a96f9a1f Author: Jakub Kicinski Date: Sun Mar 29 14:35:29 2026 -0700 Merge branch 'macb-usrio-tsu-patches' Conor Dooley says: ==================== macb usrio/tsu patches At the very least, it'd be good of the soc vendor folks could check their platforms and see if their usrio stuff actually lines up with what the driver currently calls "macb_default_usrio". Ours didn't and it was a nasty surprise. Ryan and I figured out that the sama7g5 stuff is not actually using the same usrio bits as earlier devices, so there's now more patches in this series to split them apart. I've not tested the split or the new property due to lack of hardware, but Ryan has. Marking this stuff net-next, because although they're fixes I don't see any particular urgency, and it avoids creating some dependencies between cleanup items and the fixes. ==================== Link: https://patch.msgid.link/20260325-unsterile-flail-4c7729750dc4@spud Signed-off-by: Jakub Kicinski commit cd1082a96f9a1ffe053e48ac0a1b4fffb189c30e Author: Théo Lebrun Date: Wed Mar 25 16:28:18 2026 +0000 net: macb: drop usrio pointer on EyeQ5 config USRIO is disabled on this platform, drop its inherited usrio config. We will end up with MACB_CAPS_USRIO_DISABLED on this platform: - We have no config->usrio so macb_configure_caps() deduces that the feature is disabled. - Anecdotally, we would also land in the runtime detection codepath that reads DCFG1. Signed-off-by: Théo Lebrun Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-stillness-undertake-d83054057b8d@spud Signed-off-by: Jakub Kicinski commit 32fc6a9f6e7585b2b39999a22635c06aa810d1bc Author: Théo Lebrun Date: Wed Mar 25 16:28:17 2026 +0000 net: macb: set MACB_CAPS_USRIO_DISABLED if no usrio config is provided bp->usrio is copied directly from dt_conf->usrio in macb_probe(). If dt_conf->usrio is NULL, we do not want to land in USRIO write codepaths which dereference bp->usrio. Inherit automatically MACB_CAPS_USRIO_DISABLED to avoid those. This means a macb_config that wants to disable usrio can simply drop its .usrio field, rather than add the disabled capability explicitly. Nit: drop the dt_conf NULL check because the pointer is always valid. Signed-off-by: Théo Lebrun Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-husband-cape-ec4945b9184c@spud Signed-off-by: Jakub Kicinski commit 47c86c463612edc3107eb7c0fd25b463f1756adf Author: Théo Lebrun Date: Wed Mar 25 16:28:16 2026 +0000 net: macb: runtime detect MACB_CAPS_USRIO_DISABLED DCFG1 (design config 1 register) carries a bit indicating whether User I/O feature has been enabled or not. The MACB/GEM driver has a cap flag indicating that HW has the feature disabled (default is enabled). Add the missing connection between DCFG1 bit and MACB_CAPS_USRIO_DISABLED. Indirect impact: avoid useless writel() on USERIO register; this is not an important fix because USERIO is anyway read-only when feature is disabled. If for some reason a compatible sets USRIO_DISABLED but DCFG1 indicates it is enabled, we still keep the disabled capability flag. This ensures we don't break "cdns,np4-macb" that sets the flag from compatible match data. Signed-off-by: Théo Lebrun Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-compactly-glue-f426a2e68904@spud Signed-off-by: Jakub Kicinski commit 41adda8764fd4d5e0f4e40cdcf47d60344dc4c4d Author: Conor Dooley Date: Wed Mar 25 16:28:15 2026 +0000 net: macb: timer adjust mode is not supported The ptp portion of this driver controls the tsu's timer using the controls for "increment mode", which is not compatible with the hardware trying to control it via the gem_tsu_inc_ctrl and gem_tsu_ms inputs in "timer adjust mode". Abort probe if the property signalling that the relevant signals have been wired up is present. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-facebook-chop-cf792c53f1da@spud Signed-off-by: Jakub Kicinski commit 09a6164a4f1d1b5364069bd290dba1d808718016 Author: Conor Dooley Date: Wed Mar 25 16:28:14 2026 +0000 dt-bindings: net: macb: add property indicating timer adjust mode The GEM IP has two methods for modifying the ptp timer. The first of these, named "increment mode", relies on software controlling the timer by setting tsu_timer_incr and tsu_timer_incr_sub_nsec and performing once-off adjustments via the tsu_timer_adjust register. This is what the macb driver uses. The second mechanism, "timer adjust mode" uses the gem_tsu_inc_ctrl and gem_tsu_ms signals to control the timer. These modes are not intended to be used in parallel, but both can be possible on the same device and which mode is used cannot be determined from the compatible on all devices, because some users of the GEM IP are SoC FPGAs that permit configuring how the IP is wired up. Add a property to indicate that gem_tsu_inc_ctrl and gem_tsu_ms are wired up for timer adjust mode. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-daily-entitle-3640f7254da4@spud Signed-off-by: Jakub Kicinski commit b698a1e397ab9371911a130605908d26510e83c6 Author: Conor Dooley Date: Wed Mar 25 16:28:13 2026 +0000 net: macb: clean up tsu clk rate acquisition tsu_clk is grabbed during probe, so doesn't need to be re-grabbed here. pclk is mandatory, probe will fail if it is err/NULL, so there's no need to check it here or have a !pclk 3rd arm. Simplify gem_get_tsu_rate() to account for these facts. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-hazing-penniless-14ba803efbb6@spud Signed-off-by: Jakub Kicinski commit 3fe13d858f8391e38c75698719198d15a6a962dc Author: Conor Dooley Date: Wed Mar 25 16:28:12 2026 +0000 net: macb: warn on pclk use as a tsu_clk fallback The Candence GEM IP has a configuration parameter which determines the source of the clock used for the timestamp unit (if it is enabled), switching it between using the pclk and a dedicated input. When ptp support was added to the macb driver, a new tsu_clk was added to represent the dedicated input. While this is understandable, I think it is bug prone and that the tsu_clk should represent whatever clock is used for the timestamper and not just that specific input. >From a driver point of view, the benefit of taking the conceptual approach is avoiding misconfiguring the driver when the hardware supports ptp (and it is set as a capability in the relevant per-device structure) but no tsu_clk is provided in devicetree. At the moment, the timestamper will be registered and programmed with an increment that reflects the pclk in these cases, but will malfunction if the pclk and tsu_clk frequencies do not match. Obviously, this means the devicetree incorrectly represents the hardware, but this change in approach would make the driver more resilient without meaningfully impacting correctly described users. Out of the devices that claim MACB_CAPS_GEM_HAS_PTP the fu540, mpfs, sama5d2 and sama7g5-emac (but not sama7g5-gem) are at risk of having this problem with the in-kernel devicetrees. mpfs and sama7g5-emac have been confirmed to be incorrect, and sama5d2 is correct. It may be that the other platforms actually do use the pclk for the timestamper (either by supplying pclk to the tsu_clk input of the IP, or by having the IP block configured to use pclk instead of the tsu_clk input), but at least two are wrong, as they do not use pclk for the tsu_clk, so the driver is registering the ptp clock incorrectly. Add a warning if no tsu_clk is provided on a platform that uses the timerstamper, to encourage people to specifically provide a tsu_clk and avoid silently registering the timerstamper with the wrong clock. If the pclk is actually used, it can be provided as a tsu_clk for improved clarity in devicetrees. While this changes the meaning of the devicetree property, it is backwards compatible as there's no functional change for platforms that didn't provide a tsu_clk and the changed meaning of providing a tsu_clk in the devicetree does not impact platforms that already provided one as the decision about the tsu clock source is at IP instantiation time rather than at runtime, so there's no driver behaviour that needs to change based on the input to the IP used for the timestamping unit. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-dust-revision-368053e82d0e@spud Signed-off-by: Jakub Kicinski commit c711311d6ba359ece75c77cca973f4c3b78e25b8 Author: Conor Dooley Date: Wed Mar 25 16:28:11 2026 +0000 net: macb: add mpfs specific usrio configuration On mpfs the driver needs to make sure the tsu clock source is not the fabric, as this requires that the hardware is in Timer Adjust mode, which is not compatible with the linux driver trying to control the hardware. It is unlikely that this will be set, as the peripheral is reset during probe, but if the resets are not provided in devicetree it's probable that this bit is set incorrectly, as U-Boot's macb driver has the same issue with using usrio settings for at91 platforms as the default. Fixes: 8aad66aa59be5 ("net: macb: add polarfire soc reset support") Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-excavate-jester-798e7cfe02b5@spud Signed-off-by: Jakub Kicinski commit 826cbe636e10581ea6a78541d756bce6049e5087 Author: Conor Dooley Date: Wed Mar 25 16:28:10 2026 +0000 net: macb: np4 doesn't need a usrio pointer USRIO is disabled on this platform, having a pointer to a usrio config structure doesn't actually do anything other than look weird. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-passover-rimless-73c19c67d94b@spud Signed-off-by: Jakub Kicinski commit 6c5b565d7d41561709f3fe969e4eca1ba9e7f6f7 Author: Conor Dooley Date: Wed Mar 25 16:28:09 2026 +0000 net: macb: rework usrio refclk selection code The USRIO based refclk selection code abuses a capability flag to set the refclk to an external source based on match data/compatible on sama7g5-emac and use an internal source for the gmac. Ryan previously added a property in an attempt to decouple the refclk source from the compatible, because this is not fixed by compatible and there's variance based on the choices made by board designers. Originally when Ryan added it, he removed the capability flag entirely from match data, but this changed the default for the sama7g5-emac and the removal had to be reverted for these devices. Because these devices default to an external refclk, and the current property is only capable of communicating external refclks, there's no way to make the sama7g5-emac use an internal refclk. Additionally, this property has no limiting based on compatible, and if used on a platform with an external refclk that is not controlled by USRIO the capability would be erroneously set. Because of the reuse of the at91_default_usrio struct by non-at91 devices, this could cause the refclk bit to be set in error, on a system where the refclk is externally provided without usrio settings being required. Change the new capability flag so that it actually represents the hardware being capable of controlling the refclk source via USRIO, and move the selection of default behaviour into the macb_usrio_config struct provided as part of match data. Modify the devicetree code to support a new property, "cdns,refclk-source" which will support devices with either default, retaining support for "cdns,refclk-external" for compatibility reasons. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-tarantula-bullring-6ac44b39dd52@spud Signed-off-by: Jakub Kicinski commit dfa36d7e860c2f008d92d91903f2d41ed0c88f3d Author: Conor Dooley Date: Wed Mar 25 16:28:08 2026 +0000 dt-bindings: net: cdns,macb: replace cdns,refclk-ext with cdns,refclk-source Ryan added cdns,refclk-ext with the intent of decoupling the source of the reference clock on sama7g5 (and related platforms) from the compatible. Unfortunately, the default for sama7g5-emac is an external reference clock, so this property had no effect there, so that compatibility with older devicetrees is preserved. Replace cdns,refclk-ext with one that supports both default states and therefore is usable for sama7g5-emac. For now, limit it to only the platforms that have USRIO controlled reference clock selection, but this could be generalised in the future. The existing property only works on devices that are compatible with sama7g5-gem, so mark it deprecated, and limit its use to that specific scenario. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-savior-untainted-03057ee0a917@spud Signed-off-by: Jakub Kicinski commit 039f185a00602fe4e760216ffb50dda6d1ed863a Author: Conor Dooley Date: Wed Mar 25 16:28:07 2026 +0000 net: macb: split USRIO_HAS_CLKEN capability in two While trying to rework the internal/external refclk selection on sama7g5, Ryan and I noticed that the sama7g5 was "overloading" the meaning of MACB_CAPS_USRIO_HAS_CLKEN, using it differently to how it was originally intended. Originally, on the macb hardware on sam9620 et al, MACB_CAPS_USRIO_HAS_CLKEN represented the hardware having a bit that needed to be set to turn on the input clock to the transceivers. The sama7g5 doesn't have this bit, so for some reason the decision was made to reuse this capability flag to control selection of internal/external references. Split the caps in two, so that capabilities do what they say on the tin, and allow reworking the refclk selection handling without impacting the older devices that use MACB_CAPS_USRIO_CLKEN for its original purpose. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-gradient-grading-b23b9e6ef9ff@spud Signed-off-by: Jakub Kicinski commit a17871778ee28e4df054521e966e9f37c61f541b Author: Conor Dooley Date: Wed Mar 25 16:28:06 2026 +0000 net: macb: rename macb_default_usrio to at91_default_usrio as not all platforms have mii mode control in usrio Calling this structure macb_default_usrio is misleading, I believe, as it implies that it should be used if your platform has nothing special to do in usrio. Since usrio is platform dependent, the default here is probably for each usrio to do nothing, with the macb documentation I have access to prescribing no standard behaviour here. We noticed that this was problematic because on mpfs, a bit that macb_default_usrio sets to deal with the MII mode actually changes the source for the tsu_clk to something with how the majority of mpfs devices are actually configured! Rename it to at91_default_usrio, since that's where the values actually come from for these. I have no idea if any of the other platforms that use the default actually copied at91's usrio configuration or if they have usrio configurations where what the driver does has no impact. Gate touching these bits behind a capability, like the clken refclock usrio knob, so that platforms without the MII mode stuff can avoid running this code. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-landowner-preformed-2922ce736337@spud Signed-off-by: Jakub Kicinski commit 8ccf062c6770618cb19f72ec0202463e01e2c7b8 Author: Conor Dooley Date: Wed Mar 25 16:28:05 2026 +0000 Revert "net: macb: Clean up the .usrio settings in macb_config instances" Commit 0ae998c4efd69 ("net: macb: Clean up the .usrio settings in macb_config instances") was a misguided attempt to clean up the driver that actually just propagated problematic code. The default for usrio is actually no usrio, and already there are issues with people using the problematically named "macb_default_usrio" on platforms where the usrio does not have this so-called default behaviour. usrio is platform specific and using the default at91 usrio settings should be opt-in only. Revert the "cleanup" patch. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260325-rundown-unrushed-dd82c9f5c56c@spud Signed-off-by: Jakub Kicinski commit 57ec1622b62ae8dcd88a0084c49c5b72b1850e68 Author: Tomas Alvarez Vanoli Date: Thu Mar 26 11:02:32 2026 +0100 net: wan/fsl_ucc_hdlc: cleanup ucc_hdlc_poll Immediately after setting to 0 we are adding to it, and subtracting 0 from budget. Replace with just assignment and no subtraction. Signed-off-by: Tomas Alvarez Vanoli Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260326100232.904289-1-tomas.alvarez-vanoli@hitachienergy.com Signed-off-by: Jakub Kicinski commit 22e49419d4fab568c74e8e9b1aeb69c187d74d1e Merge: d4383c7c78635e e3cdf6cf5fc6db Author: Jakub Kicinski Date: Sun Mar 29 14:09:10 2026 -0700 Merge branch 'bnxt_en-add-xdp-rss-hash-metadata-support' Chris J Arges says: ==================== bnxt_en: Add XDP RSS hash metadata support This series adds XDP RSS hash metadata extraction support for the bnxt_en driver and includes selftests to validate the functionality. I was able to test this on a BCM57414 NIC. ==================== Link: https://patch.msgid.link/20260325201139.2501937-1-carges@cloudflare.com Signed-off-by: Jakub Kicinski commit e3cdf6cf5fc6db0643723083e2c70fffe098e249 Author: Chris J Arges Date: Wed Mar 25 15:09:52 2026 -0500 selftests: drv-net: xdp: Add rss_hash metadata tests This test loads xdp_metadata.bpf which calls bpf_xdp_metadata_rx_hash() on incoming packets. The metadata from that packet is then sent to a BPF map for validation. It borrows structure from xdp.py, reusing common functions. The test checks the device's xdp-rx-metadata-features via netlink before running and skips on devices that do not advertise hash support. This can be run on veth devices as well as real hardware. The test is fairly simple and just verifies that a TCP or UDP packet can be identified as an L4 flow. This minimal test also passes if run on a veth device. Signed-off-by: Chris J Arges Link: https://patch.msgid.link/20260325201139.2501937-7-carges@cloudflare.com Signed-off-by: Jakub Kicinski commit 4ce06406958b67fdddcc2e6948237dd6ff6ba112 Author: Chris J Arges Date: Wed Mar 25 15:09:51 2026 -0500 selftests: net: move common xdp.py functions into lib This moves a few functions which can be useful to other python programs that manipulate XDP programs. This also refactors xdp.py to use the refactored functions. Signed-off-by: Chris J Arges Link: https://patch.msgid.link/20260325201139.2501937-6-carges@cloudflare.com Signed-off-by: Jakub Kicinski commit 5ec22d5f2afcf2f9d7d631dcc2f848dda64a4933 Author: Chris J Arges Date: Wed Mar 25 15:09:50 2026 -0500 bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP This adds another conditional when cmp_type is CMP_TYPE_RX_L2_V3_CMP for drivers that support this completion format. This re-uses bnxt_rss_ext_op to provide similar functionality. One limitation is for L4 hash-types, protocol-specific bits can't be determined. Reviewed-by: Joe Damato Signed-off-by: Chris J Arges Link: https://patch.msgid.link/20260325201139.2501937-5-carges@cloudflare.com Signed-off-by: Jakub Kicinski commit 4a037aeb6bc8e1fbf4d131d4d06544a9857ad604 Author: Chris J Arges Date: Wed Mar 25 15:09:49 2026 -0500 bnxt_en: Move bnxt_rss_ext_op into header This allows bnxt_rss_ext_op to be used by other functions. In addition this modifies the rxcmp argument to be const since the function only reads from this structure. Reviewed-by: Joe Damato Signed-off-by: Chris J Arges Link: https://patch.msgid.link/20260325201139.2501937-4-carges@cloudflare.com Signed-off-by: Jakub Kicinski commit e5648b08cbfc9e7921138d9ace830b48824608f2 Author: Chris J Arges Date: Wed Mar 25 15:09:48 2026 -0500 bnxt_en: Implement XDP RSS hash metadata extraction Add support for extracting RSS hash values and hash types from hardware completion descriptors in XDP programs for bnxt_en. Add IP_TYPE definition for determining if completion is ipv4 or ipv6. In addition add ITYPE_ICMP flag for identifying ICMP completions. Signed-off-by: Chris J Arges Reviewed-by: Joe Damato Reviewed-by: Andy Gospodarek Signed-off-by: Jakub Kicinski commit 542d3ec4508f02c9d5d9cdf92f7f3ae6958ca67c Author: Chris J Arges Date: Wed Mar 25 15:09:47 2026 -0500 bnxt_en: use bnxt_xdp_buff for xdp context This adds bnxt_xdp_buff which embeds the xdp_buff struct and stores pointers to hardware RX completion descriptors (rx_cmp and rx_cmp_ext) along with the completion type. Signed-off-by: Chris J Arges Link: https://patch.msgid.link/20260325201139.2501937-2-carges@cloudflare.com Signed-off-by: Jakub Kicinski commit 63432fd625372a0e79fb00a4009af204f4edc013 Author: Demian Shulhan Date: Sun Mar 29 07:43:38 2026 +0000 lib/crc: arm64: add NEON accelerated CRC64-NVMe implementation Implement an optimized CRC64 (NVMe) algorithm for ARM64 using NEON Polynomial Multiply Long (PMULL) instructions. The generic shift-and-XOR software implementation is slow, which creates a bottleneck in NVMe and other storage subsystems. The acceleration is implemented using C intrinsics () rather than raw assembly for better readability and maintainability. Key highlights of this implementation: - Uses 4KB chunking inside scoped_ksimd() to avoid preemption latency spikes on large buffers. - Pre-calculates and loads fold constants via vld1q_u64() to minimize register spilling. - Benchmarks show the break-even point against the generic implementation is around 128 bytes. The PMULL path is enabled only for len >= 128. Performance results (kunit crc_benchmark on Cortex-A72): - Generic (len=4096): ~268 MB/s - PMULL (len=4096): ~1556 MB/s (nearly 6x improvement) Signed-off-by: Demian Shulhan Link: https://lore.kernel.org/r/20260329074338.1053550-1-demyansh@gmail.com Signed-off-by: Eric Biggers commit a51973c5dff8a0f01cc7d1b2007306ea0004fa16 Merge: 0d270f0df6170f 05c8b1cdc54036 Author: Dave Airlie Date: Mon Mar 30 06:04:57 2026 +1000 Merge tag 'drm-xe-next-2026-03-26-1' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Hi Dave and Sima, Here goes our late, final drm-xe-next PR towards 7.1. We just purgeable BO uAPI in today, hence the late pull. In the big things we have: - Add support for purgeable buffer objects Thanks, Matt UAPI Changes: - Add support for purgeable buffer objects (Arvind, Himal) Driver Changes: - Remove useless comment (Maarten) - Issue GGTT invalidation under lock in ggtt_node_remove (Brost, Fixes) - Fix mismatched include guards in header files (Shuicheng) Signed-off-by: Dave Airlie From: Matthew Brost Link: https://patch.msgid.link/acX4fWxPkZrrfwnT@gsse-cloud1.jf.intel.com commit d4383c7c78635ed96b89646eeb000d66022f06f4 Author: Linus Walleij Date: Fri Mar 27 13:23:45 2026 +0100 net: dsa: qca8k: Use the right GPIO header The driver header for qca8k includes the legacy GPIO header but does not use any symbols from it and actually wants so fix this up. Signed-off-by: Linus Walleij Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260327-net-dsa-qca8k-v1-1-94e613a5c369@kernel.org Signed-off-by: Jakub Kicinski commit 02d0e59e36e06fb728eb4dea8479f502c67b9fbc Author: Eric Dumazet Date: Fri Mar 27 04:06:46 2026 +0000 tcp: use __jhash_final() in inet6_ehashfn() I misread jhash2() implementation. Last round should use __jhash_final() instead of __jhash_mix(). Using __jhash_mix() here leaves entropy distributed across a, b, and c, which might lead to incomplete diffusion of the faddr and fport bits into the bucket index. Replacing this last __jhash_mix() with __jhash_final() provides the correct avalanche properties for the returned value in c. $ scripts/bloat-o-meter -t vmlinux.0 vmlinux add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-4 (-4) Function old new delta inet6_ehashfn 306 302 -4 Total: Before=25155089, After=25155085, chg -0.00% Fixes: 854587e69ef3 ("tcp: improve inet6_ehashfn() entropy") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260327040646.3849503-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 30fcf28d83ee30494454b3f62f89a86e9e67bc25 Author: 谢致邦 (XIE Zhibang) Date: Sat Mar 28 13:43:31 2026 +0000 net: stmmac: dwmac-rk: Fix typo in comment Correct the typo "rk3520" to "rk3528" in comment. Signed-off-by: 谢致邦 (XIE Zhibang) Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/tencent_833D2AD6577F21CF38ED1C3FE8814EB4B308@qq.com Signed-off-by: Jakub Kicinski commit e531a081065d274a14f54441a38e1849453d06ec Merge: ced629dc8e5c51 b2c981e7c4653e Author: Jakub Kicinski Date: Sun Mar 29 11:21:29 2026 -0700 Merge branch 'convert-config_ipv6-to-built-in-and-remove-stubs' Fernando Fernandez Mancera says: ==================== Convert CONFIG_IPV6 to built-in and remove stubs Historically, the Linux kernel has supported compiling the IPv6 stack as a loadable module. While this made sense in the early days of IPv6 adoption, modern deployments and distributions overwhelmingly either build IPv6 directly into the kernel (CONFIG_IPV6=y) or disable it entirely (CONFIG_IPV6=n). The modular IPv6 use-case offers image size and memory savings for specific setups, this benefit is outweighed by the architectural burden it imposes on the subsystems on implementation and maintenance. In addition, most of the distributions are already using CONFIG_IPV6=y by default [1], including openWRT [2] and Android gki_defconfig [3]. So this won't have an impact on them. The most impacted architecture would probably be arm64 as their default config is still using CONFIG_IPV6=m. To allow core networking, BPF, Netfilter, and various device drivers to safely interact with a potentially unloaded IPv6 module, the kernel relies on indirect call structures like ipv6_stub, ipv6_bpf_stub, and nf_ipv6_ops, along with dynamic RCU registrations for things like ICMPv6 senders. This patch series addresses this by changing CONFIG_IPV6 from a tristate to a boolean, enforcing that IPv6 is either built-in or disabled. This allows us to completely rip out the stub infrastructures and safely replace them with direct function calls. The bloat-o-meter report the following results for m68k, arm64, x86_64 defconfig. m68k (keep on mind that CONFIG_IPV6 is disabled now): add/remove: 65/938 grow/shrink: 36/254 up/down: 3022/-49692 (-46670) arm64: add/remove: 1251/265 grow/shrink: 81/46 up/down: 448740/-71519 (377221) x86_64: add/remove: 62/98 grow/shrink: 10/39 up/down: 2497/-4357 (-1860) Considering that each new kernel release increases sizes by 30-40KiB on average, this size increase isn't a huge jump for the distributions that are still using CONFIG_IPV6=m. For the ones that are already using CONFIG_IPV6=y, the size is reduced actually. All the patches has been independently build tested. With allmodconfig and allmodconfig + CONFIG_IPV6=n. In addition, net selftest has been run against them on virtme-ng. The series applied as a whole as been tested with allyesconfig and also allyesconfig + CONFIG_IPV6=n but not all patches has been independently tested this way. [1] https://github.com/nyrahul/linux-kernel-configs [2] https://github.com/openwrt/openwrt/commit/832e7b817221d288df76b763ca12c585365db5d8 [3] https://android.googlesource.com/kernel/common/+/refs/heads/android-mainline/arch/arm64/configs/gki_defconfig ==================== Link: https://patch.msgid.link/20260325120928.15848-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit b2c981e7c4653e3c276d5f3a0e012711d3596418 Author: Fernando Fernandez Mancera Date: Wed Mar 25 13:08:52 2026 +0100 netfilter: remove nf_ipv6_ops and use direct function calls As IPv6 is built-in only, nf_ipv6_ops can be removed completely as it is not longer necessary. Convert all nf_ipv6_ops usage to direct function calls instead. In addition, remove the ipv6_netfilter_init/fini() functions as they are not necessary any longer. Signed-off-by: Fernando Fernandez Mancera Tested-by: Ricardo B. Marlière Link: https://patch.msgid.link/20260325120928.15848-12-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 964870b4b9012bd42f29336f32b5c8be8ef3c00d Author: Fernando Fernandez Mancera Date: Wed Mar 25 13:08:51 2026 +0100 ipv6: remove ipv6_stub infrastructure completely As IPv6 is built-in only and there are no more users of ipv6_stub, the ipv6_stub is now entirely obsolete. Remove all the code related to the definition, initialization and usage. Signed-off-by: Fernando Fernandez Mancera Tested-by: Ricardo B. Marlière Link: https://patch.msgid.link/20260325120928.15848-11-fmancera@suse.de Signed-off-by: Jakub Kicinski commit ad84b1eefe28cee96c572b84bfa4f0fbfd425b68 Author: Fernando Fernandez Mancera Date: Wed Mar 25 13:08:50 2026 +0100 bpf: remove ipv6_bpf_stub completely and use direct function calls As IPv6 is built-in only, the ipv6_bpf_stub can be removed completely. Convert all ipv6_bpf_stub usage to direct function calls instead. The fallback functions introduced previously will prevent linkage errors when CONFIG_IPV6 is disabled. Signed-off-by: Fernando Fernandez Mancera Tested-by: Ricardo B. Marlière Acked-by: Daniel Borkmann Reviewed-by: Martin KaFai Lau Link: https://patch.msgid.link/20260325120928.15848-10-fmancera@suse.de Signed-off-by: Jakub Kicinski commit d76f6b170a10414a9c674b6db4bd0473b1b30050 Author: Fernando Fernandez Mancera Date: Wed Mar 25 13:08:49 2026 +0100 net: convert remaining ipv6_stub users to direct function calls As IPv6 is built-in only, the ipv6_stub infrastructure is no longer necessary. Convert remaining ipv6_stub users to make direct function calls. The fallback functions introduced previously will prevent linkage errors when CONFIG_IPV6 is disabled. Signed-off-by: Fernando Fernandez Mancera Tested-by: Ricardo B. Marlière Link: https://patch.msgid.link/20260325120928.15848-9-fmancera@suse.de Signed-off-by: Jakub Kicinski commit d98adfbdd5c014f73d5f5e6b43735cc1b2d9450a Author: Fernando Fernandez Mancera Date: Wed Mar 25 13:08:48 2026 +0100 ipv4: drop ipv6_stub usage and use direct function calls As IPv6 is built-in only, the ipv6_stub infrastructure is no longer necessary. The IPv4 stack interacts with IPv6 mainly to support IPv4 routes with IPv6 next-hops (RFC 8950). Convert all these cross-family calls from ipv6_stub to direct function calls. The fallback functions introduced previously will prevent linkage errors when CONFIG_IPV6 is disabled. Signed-off-by: Fernando Fernandez Mancera Tested-by: Ricardo B. Marlière Link: https://patch.msgid.link/20260325120928.15848-8-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 29ae61b2fe7eeafc921a1481230aac4431520418 Author: Fernando Fernandez Mancera Date: Wed Mar 25 13:08:47 2026 +0100 drivers: net: drop ipv6_stub usage and use direct function calls As IPv6 is built-in only, the ipv6_stub infrastructure is no longer necessary. Convert all drivers currently utilizing ipv6_stub to make direct function calls. The fallback functions introduced previously will prevent linkage errors when CONFIG_IPV6 is disabled. Signed-off-by: Fernando Fernandez Mancera Tested-by: Ricardo B. Marlière Reviewed-by: Jason A. Donenfeld Reviewed-by: Antonio Quartulli Reviewed-by: Edward Cree Link: https://patch.msgid.link/20260325120928.15848-7-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 4b70b20215049472f200ed563a7a0d44a7188fd3 Author: Fernando Fernandez Mancera Date: Wed Mar 25 13:08:46 2026 +0100 ipv6: prepare headers for ipv6_stub removal In preparation for dropping ipv6_stub and converting its users to direct function calls, introduce static inline dummy functions and fallback macros in the IPv6 networking headers. In addition, introduce checks on fib6_nh_init(), ip6_dst_lookup_flow() and ip6_fragment() to avoid a crash due to ipv6.disable=1 set during booting. The other functions are safe as they cannot be called with ipv6.disable=1 set. These fallbacks ensure that when CONFIG_IPV6 is completely disabled, there are no compiling or linking errors due to code paths not guarded by preprocessor macro IS_ENABLED(CONFIG_IPV6). In addition, export ndisc_send_na(), ip6_route_input() and ip6_fragment(). Signed-off-by: Fernando Fernandez Mancera Tested-by: Ricardo B. Marlière Link: https://patch.msgid.link/20260325120928.15848-6-fmancera@suse.de Signed-off-by: Jakub Kicinski commit d2042d35f413b7131cc571655bbcb2c049489fe7 Author: Fernando Fernandez Mancera Date: Wed Mar 25 13:08:45 2026 +0100 ipv6: remove dynamic ICMPv6 sender registration infrastructure As IPv6 is built-in only, there is no need to maintain the sender registration infrastructure used to allow built-in subsystems to send ICMPv6 messages when IPv6 was compiled as a module. Drop the registration mechanism and the __icmpv6_send() sender implementation. While icmpv6_send() users could be converted to icmp6_send() that doesn't seems necessary as none of them are using the force_saddr parameter. Signed-off-by: Fernando Fernandez Mancera Tested-by: Ricardo B. Marlière Link: https://patch.msgid.link/20260325120928.15848-5-fmancera@suse.de Signed-off-by: Jakub Kicinski commit fde39f7df10b3dc150abb87c4718efba93cbc755 Author: Fernando Fernandez Mancera Date: Wed Mar 25 13:08:44 2026 +0100 ipv6: replace IS_BUILTIN(CONFIG_IPV6) with IS_ENABLED(CONFIG_IPV6) As IPv6 is built-in only, it does not make sense to continue using IS_BUILTIN(CONFIG_IPV6). Therefore, replace it with IS_ENABLED() when necessary and drop it if it isn't valid anymore. Notice that there is still one instance related to ICMPv6, as it requires more changes it will be handle separately. Signed-off-by: Fernando Fernandez Mancera Tested-by: Ricardo B. Marlière Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20260325120928.15848-4-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 0557a34487b10f3e600a3a20b98ea164f36a3ad2 Author: Fernando Fernandez Mancera Date: Wed Mar 25 13:08:43 2026 +0100 net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros As IPv6 is built-in only, the macro is always evaluating to an empty one. Remove it completely from the code. Signed-off-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260325120928.15848-3-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 309b905deee595619cc38719f48d63d57b8bff3d Author: Fernando Fernandez Mancera Date: Wed Mar 25 13:08:42 2026 +0100 ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs Maintaining a modular IPv6 stack offers image size savings for specific setups, this benefit is outweighed by the architectural burden it imposes on the subsystems on implementation and maintenance. Therefore, drop it. Change CONFIG_IPV6 from tristate to bool. Remove all Kconfig dependencies across the tree that explicitly checked for IPV6=m. In addition, remove MODULE_DESCRIPTION(), MODULE_ALIAS(), MODULE_AUTHOR() and MODULE_LICENSE(). This is also replacing module_init() by device_initcall(). It is not possible to use fs_initcall() as IPv4 does because that creates a race condition on IPv6 addrconf. Finally, modify the default configs from CONFIG_IPV6=m to CONFIG_IPV6=y except for m68k as according to the bloat-o-meter the image is increasing by 330KB~ and that isn't acceptable. Instead, disable IPv6 on this architecture by default. This is aligned with m68k RAM requirements and recommendations [1]. [1] http://www.linux-m68k.org/faq/ram.html Signed-off-by: Fernando Fernandez Mancera Tested-by: Ricardo B. Marlière Acked-by: Krzysztof Kozlowski # arm64 Link: https://patch.msgid.link/20260325120928.15848-2-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 7b2bc5f0ab983a7aad7fa5180cede4b3e91fc164 Author: Tycho Andersen (AMD) Date: Tue Mar 24 10:12:59 2026 -0600 x86/sev, crypto/ccp: Move HSAVE_PA setup to arch/x86/ Now that there is snp_prepare() that indicates when the CCP driver wants to prepare the architecture for SNP_INIT(_EX), move this architecture-specific bit of code to a more sensible place. Signed-off-by: Tycho Andersen (AMD) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://patch.msgid.link/20260324161301.1353976-6-tycho@kernel.org commit 220045247712ddfda1fcedfa61e91dae24e63bcf Author: Abel Vesa Date: Fri Mar 27 14:36:00 2026 +0200 dt-bindings: mailbox: qcom-ipcc: Document the Eliza Inter-Processor Communication Controller Document the Inter-Processor Communication Controller (IPCC) found in the Qualcomm Eliza SoC. It is used to route interrupts across various subsystems. Signed-off-by: Abel Vesa Acked-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Signed-off-by: Jassi Brar commit b6b5e0ebd429d66ce37ae5af649a74ea1f041d92 Author: haoyu.lu Date: Tue Mar 24 20:27:02 2026 +0800 bpf,arc_jit: Fix missing newline in pr_err messages Add missing newline to pr_err messages in ARC JIT. Fixes: f122668ddcce ("ARC: Add eBPF JIT support") Signed-off-by: haoyu.lu Link: https://lore.kernel.org/r/20260324122703.641-1-hechushiguitu666@gmail.com Signed-off-by: Alexei Starovoitov commit 398ad123e83045cd187c74689cd46851b0a0459f Author: Daniel Borkmann Date: Fri Mar 27 23:06:29 2026 +0100 selftests/bpf: Add few tests for alu32 shift value tracking and zext Add few more alu32 shift tests using div-by-zero on provably dead paths to check both verifier and JIT xlation resp. runtime correctness. If the verifier mistracks the result, it rejects due to the div by 0; if the JIT computes a wrong value, then runtime hits the dead path and retval changes. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_subreg [...] #644/76 verifier_subreg/arsh32_imm1_value:OK #644/77 verifier_subreg/lsh32_reg0_zero_extend_check:OK #644/78 verifier_subreg/rsh32_reg0_zero_extend_check:OK #644/79 verifier_subreg/arsh32_reg0_zero_extend_check:OK #644/80 verifier_subreg/lsh32_imm31_value:OK #644/81 verifier_subreg/rsh32_imm31_value:OK #644/82 verifier_subreg/arsh32_imm31_value:OK #644/83 verifier_subreg/lsh32_unknown_precise_bounds:OK #644/84 verifier_subreg/rsh32_unknown_bounds:OK #644 verifier_subreg:OK Summary: 1/84 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260327220629.343327-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 101a9d9df8e794af8bf06e1e09c176e2dab2abf6 Author: Ihor Solodrai Date: Fri Mar 27 13:32:41 2026 -0700 selftests/bpf: Update kfuncs using btf_struct_meta to new variants Update selftests to use the new non-_impl kfuncs marked with KF_IMPLICIT_ARGS by removing redundant declarations and macros from bpf_experimental.h (the new kfuncs are present in the vmlinux.h) and updating relevant callsites. Fix spin_lock verifier-log matching for lock_id_kptr_preserve by accepting variable instruction numbers. The calls to kfuncs with implicit arguments do not have register moves (e.g. r5 = 0) corresponding to dummy arguments anymore, so the order of instructions has shifted. Acked-by: Mykyta Yatsenko Signed-off-by: Ihor Solodrai Acked-by: Jiri Olsa Link: https://lore.kernel.org/r/20260327203241.3365046-2-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit d457072576a6a60ba853b1d815f123da57b48021 Author: Ihor Solodrai Date: Fri Mar 27 13:32:40 2026 -0700 bpf: Support struct btf_struct_meta via KF_IMPLICIT_ARGS The following kfuncs currently accept void *meta__ign argument: * bpf_obj_new_impl * bpf_obj_drop_impl * bpf_percpu_obj_new_impl * bpf_percpu_obj_drop_impl * bpf_refcount_acquire_impl * bpf_list_push_back_impl * bpf_list_push_front_impl * bpf_rbtree_add_impl The __ign suffix is an indicator for the verifier to skip the argument in check_kfunc_args(). Then, in fixup_kfunc_call() the verifier may set the value of this argument to struct btf_struct_meta * kptr_struct_meta from insn_aux_data. BPF programs must pass a dummy NULL value when calling these kfuncs. Additionally, the list and rbtree _impl kfuncs also accept an implicit u64 argument, which doesn't require __ign suffix because it's a scalar, and BPF programs explicitly pass 0. Add new kfuncs with KF_IMPLICIT_ARGS [1], that correspond to each _impl kfunc accepting meta__ign. The existing _impl kfuncs remain unchanged for backwards compatibility. To support this, add "btf_struct_meta" to the list of recognized implicit argument types in resolve_btfids. Implement is_kfunc_arg_implicit() in the verifier, that determines implicit args by inspecting both a non-_impl BTF prototype of the kfunc. Update the special_kfunc_list in the verifier and relevant checks to support both the old _impl and the new KF_IMPLICIT_ARGS variants of btf_struct_meta users. [1] https://lore.kernel.org/bpf/20260120222638.3976562-1-ihor.solodrai@linux.dev/ Signed-off-by: Ihor Solodrai Acked-by: Jiri Olsa Link: https://lore.kernel.org/r/20260327203241.3365046-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 80784b427970219ebc338a6fb4118cde67a6c317 Author: Dylan Wu Date: Mon Feb 9 16:34:52 2026 +0800 mailbox: cix: Add IRQF_NO_SUSPEND to mailbox interrupt During the system suspend process, device interrupts are masked in the noirq phase. However, SCMI often needs to exchange final messages with the firmware to complete the power-down transition. Without the IRQF_NO_SUSPEND flag, the mailbox ISR cannot run during this late stage, leading to SCMI communication timeouts and error messages like "SCMI protocol wait for resp timeout" during suspend. Add the IRQF_NO_SUSPEND flag to the interrupt request to ensure the mailbox can continue to handle responses during the noirq stages of suspend and resume, thereby ensuring a reliable power state transition. Signed-off-by: Dylan Wu Signed-off-by: Jassi Brar commit c58e9456e30c7098cbcd9f04571992be8a2e4e63 Author: Jassi Brar Date: Fri Mar 27 17:00:40 2026 -0500 mailbox: Fix NULL message support in mbox_send_message() The active_req field serves double duty as both the "is a TX in flight" flag (NULL means idle) and the storage for the in-flight message pointer. When a client sends NULL via mbox_send_message(), active_req is set to NULL, which the framework misinterprets as "no active request". This breaks the TX state machine by: - tx_tick() short-circuits on (!mssg), skipping the tx_done callback and the tx_complete completion - txdone_hrtimer() skips the channel entirely since active_req is NULL, so poll-based TX-done detection never fires. Fix this by introducing a MBOX_NO_MSG sentinel value that means "no active request," freeing NULL to be valid message data. The sentinel is defined in the subsystem-internal mailbox.h so that controller drivers within drivers/mailbox/ can reference it, but it is not exposed to clients outside the subsystem. Fifteen in-tree callers send NULL (doorbell-style IPCs on Qualcomm, Tegra, TI, Xilinx, i.MX, SCMI, and PCC platforms). All were audited for regression: - Most already work around the bug via knows_txdone=true with a manual mbox_client_txdone() call, making the framework's tracking irrelevant. These are unaffected. - Poll-based callers (Xilinx zynqmp/r5) are strictly better off: the poll timer now correctly detects NULL-active channels instead of silently skipping them. - irq-qcom-mpm.c was a pre-existing bug -- the only Qualcomm caller that omitted the knows_txdone + mbox_client_txdone() pattern. Fixed in a companion commit ("irqchip/qcom-mpm: Fix missing mailbox TX done acknowledgment"). - No caller sets both a tx_done callback and sends NULL, nor combines tx_block=true with NULL sends, so the newly reachable callback/completion paths are never exercised. Also update tegra-hsp's flush callback, which directly inspects active_req to wait for the channel to drain: the old "!= NULL" check becomes "!= MBOX_NO_MSG", otherwise flush spins until timeout since the sentinel is non-NULL. The only tradeoff is that 'MBOX_NO_MSG' can not be used as a message by clients. Reported-by: Joonwon Kang Reviewed-by: Douglas Anderson Signed-off-by: Jassi Brar commit 89e5d7d616009e5fada5da081b1d79cdd59150ab Author: Wolfram Sang Date: Fri Mar 27 16:10:21 2026 +0100 mailbox: remove superfluous internal header Quite some controller drivers use the defines from the internal header already. This prevents controller drivers outside the mailbox directory. Move the defines to the public controller header to allow this again as the defines are not strictly internal anyhow. Signed-off-by: Wolfram Sang Reviewed-by: Sudeep Holla Reviewed-by: Daniel Baluta Signed-off-by: Jassi Brar commit d81e6703b8f12bbb885967933d1730600bce02c7 Author: Wolfram Sang Date: Mon Feb 23 13:21:33 2026 +0100 mailbox: correct kdoc title for mbox_bind_client "Request" is wrong, there is a separate function for requesting. This functions binds, so describe this. Signed-off-by: Wolfram Sang Signed-off-by: Jassi Brar commit 9efbbf810ee3e50360daa83cb8e0cc5ab998cef3 Author: Wolfram Sang Date: Fri Mar 27 16:11:44 2026 +0100 mailbox: test: really ignore optional memory resources Memory resources are optional but if the resource is empty devm_platform_get_and_ioremap_resource() prints an error nonetheless. Refactor the code to check the resources locally first and process them only if they are present. The -EBUSY error message of ioremap_resource() is still kept because it is correct. The comment which explains that a plain ioremap() is tried as a workaround is turned into a info message. So, a user will be informed about it, too. Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Signed-off-by: Jassi Brar commit 8a19c5aa2f04c38926318d128f57f0c350bab4c6 Author: Wolfram Sang Date: Fri Mar 27 16:12:46 2026 +0100 mailbox: exynos: drop superfluous mbox setting per channel The core initializes the 'mbox' field exactly like this, so don't duplicate it in the driver. Signed-off-by: Wolfram Sang Reviewed-by: Tudor Ambarus Tested-by: Tudor Ambarus Signed-off-by: Jassi Brar commit d2591db9c8ef19fbb4d24ed15e0c6edfa6bc7917 Author: Jason-JH Lin Date: Mon Mar 23 17:07:11 2026 +0800 mailbox: mtk-cmdq: Fix CURR and END addr for task insert case Fix CURR and END address calculation for inserting a cmdq task into the task list by using cmdq_reg_shift_addr() for proper address converting. This ensures both CURR and END addresses are set correctly when enabling the thread. Fixes: a195c7ccfb7a ("mailbox: mtk-cmdq: Refine DMA address handling for the command buffer") Signed-off-by: Jason-JH Lin Signed-off-by: Jassi Brar commit 1e0ec9719f58d53da61adf830e81f4af892e4582 Author: Felix Gu Date: Thu Feb 26 00:33:24 2026 +0800 mailbox: mtk-vcp-mailbox: Fix the return value in mtk_vcp_mbox_xlate() The return value of mtk_vcp_mbox_xlate() is checked by IS_ERR(), so return NULL is incorrect and could lead to a NULL pointer dereference. Fixes: b562abd95672 ("mailbox: mediatek: Add mtk-vcp-mailbox driver") Signed-off-by: Felix Gu Signed-off-by: Jassi Brar commit df1de2abf907ab4fef991eaddab1981c1a9354cf Author: Rosen Penev Date: Tue Mar 10 17:35:59 2026 -0700 mailbox: hi6220: kzalloc + kcalloc to kzalloc Reduce allocations to a single one by using a flexible array member. Allows using __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Signed-off-by: Jassi Brar commit f9f0df23193a8afee3bfb5fc34970c93792d7163 Author: Rosen Penev Date: Tue Mar 10 17:37:44 2026 -0700 mailbox: rockchip: kzalloc + kcalloc to kzalloc Use a flexible array member to reduce allocations. Signed-off-by: Rosen Penev Signed-off-by: Jassi Brar commit 079a2e18b776f391d6b16b8710af79976fba14aa Author: Meghana Malladi Date: Mon Mar 23 14:33:58 2026 +0530 arm64: defconfig: Enable DP83TG720 PHY driver Enable DP83TG720 PHY driver as a module to support TI's DP83TG720 1000BASE-T1 Automotive Ethernet PHY. This is required for the DP83TG720-IND-SPE-EVM daughter card used with AM642 EVM ICSSG0 interface. Signed-off-by: Meghana Malladi Link: https://patch.msgid.link/20260323090358.632329-3-m-malladi@ti.com Signed-off-by: Vignesh Raghavendra commit c755e39836ec492b0bc210fd96c2b720b5b4a690 Author: Michal Piekos Date: Sun Mar 29 13:43:04 2026 +0200 arm64: dts: allwinner: enable h616 timer support Add support for timer by reusing existing sun4i timer driver. H616 timer is compatible with earlier sunxi timer variants and provides both clocksource and clockevent functionality. It runs from 24 MHz oscillator. It can serve as broadcast clockevent for wake up from idle states. Tested on Orange Pi Zero 3: - timer is registered as clocksource: - switching clocksource at runtime works - timer operates as a broadcast clockevent device - no regression observed compared to arch_sys_counter Signed-off-by: Michal Piekos Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20260329-h616-timer-v1-1-5966d0420a66@mmpsystems.pl Signed-off-by: Chen-Yu Tsai commit 2e4858d2f027080827c5fc557306a06fbfcecd0a Author: Chen-Yu Tsai Date: Wed Mar 25 00:19:29 2026 +0800 arm64: dts: allwinner: sun50i-h6: add UART DMA channels All the UARTs support DMA and are hooked up to the DMA controller. Add the DMA channels for the UARTs Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20260324161930.1602083-2-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 1e80a0367bca7ffe3dfff41948474fe3c3ad3587 Author: Chen-Yu Tsai Date: Wed Mar 25 00:19:28 2026 +0800 arm64: dts: allwinner: sun50i-a64: add UART DMA channels All the UARTs support DMA and are hooked up to the DMA controller. Add the DMA channels for the UARTs Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20260324161930.1602083-1-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit a8a37957f2bc4e4af250390c57de6c8371cb5edd Merge: 88cf8a9ad32f85 d2a4ec19d2a2e5 Author: Greg Kroah-Hartman Date: Sun Mar 29 14:35:31 2026 +0200 Merge tag 'iio-for-7.1a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: IIO: New devices support, features and cleanup for 7.1 Includes merge of v7.0-rc4 to pull in a fix and a merge of ib-iio-thermal-qcom-pmic5 immutable branch (provided from the IIO tree so thermal could also pick this up and add thermal specific remainder of the series on top. New device support ------------------ adi,ad4030 - Add support for ADA4316 and ADAQ4224 ADCs with PGAs. adi,ad4080 - Add support for AD4082, AD4085 and AD4088 ADCs. adi,ad8366 - Add ADRF5702 and ADRF5703 digital step attenuators. adi,adxl372 - Add support for the ADXL371 accelerometer after refactors to allow multiple device variants to be supported by the driver. In particular a silicon issue means the hardware FIFO doesn't work on the ADXL371 bosch,bma255/bmg160 - Add support for BMX055 gyroscope and magnetometer (effectively separate devices from point of view of interface). lltc,ltc2309 - Add support for LTC2305 2 channel 12-bit ADC. lltc,ltc2532 - Add support for 4 variants of the LTC2654 quad DAC. maxim,ds4424 - Add IDs for DS4402 and DS4404 parts. Initially patch is ID only but additional features also added that are device dependent. qcom,spmi-adc-gen3 - New driver supporting this generation of Qualcomm's SoC ADC. st,vl53l1 - New driver for this Time Of Flight (TOF) sensor. ti,ina2xx - Support the INA236 digital power monitor. vishay,vcnl4000 - Add support for CM36686 ambient light and proximity sensor. - Add support for CM36672P proximity sensors. ID only additions. amlogic,meson-adc - Support the Meson S4. Features -------- iio-backend framework - Add capability discovery so front end drivers can know what features are available from the backend and adjust how they operate. adi,ad4030 - Add SPI offload support requiring a non trivial PWM setup. adi,ad7380 - Add support for multiple SPI lanes to improve throughput. adi,ad7768-1 - Support SPI offload and always use continuous mode, enabling more filter options. adi,ad8366 - Device tree bindings and support. aspeed,adc - Handle battery channel. maxim,ds4424 - Add external resistor controlled scale and per-variant limits. - Handle per variant range limits. - Move it to regmap. motorola,cpcap-adc - Support for the ADC found on the Motorola Mot board. Effectively some board specific configuration handled in the driver. vishay,vcnl4000 - Support explicit power supply regulators. tyhx,hx9023s - Allow device tree specification of firmware file name. Cleanup and minor fixes ----------------------- treewide - Remove a bunch of unused structure elements. - Replaces standard fixed width integers with kernel types. - Replace some other error values that were returned on allocation failure with -ENOMEM iio-core - Replace a few custom devm implementations for devm_add_action_or_reset() iio-trigger - Use put_device() to cleanup on error. iio-backend - Use __free(fwmode_handle) to simplify some code. hw-consumer - Use separate allocation for scan mask bitmap to simplify code. acpi-als - Switch from ACPI driver to platform driver. adi,ad4030 - Use BIT() to replace values that are always a power of 2 to slightly improve readability. adi,ad4062 - Add a missing check for error form iio_get_current_scan_type() adi,ad5933 - Use div64_ul() rather than do_div() as remainder was not used. adi,ad7191 - Documentation fixes related to clocks adi,ad7816 - Use sysfs_emit() adi,ad8366 - General driver modernization adi,adf4350 - Change a TOOD to NOTE in a comment to avoid anyone from walking into a tricky to improve corner case. adi,admv1013 - Avoid a null pointer dereference if device_property_read_string() fails. adi,admv4420 - Return error code rather than -1.. adi,adxl345 - Add separate scaling for events from that of raw channels. amlogic,meson-adc - Don't bother keeping nvmem cell access around when only used in probe. atmel,at91-sama5d - Don't bother keeping nvmem cell access around when only used in probe. bosch,bmc150 - Use sysfs_emit() in a few places. honeywell,hsc030pa - Improve handling of return values from i2c_transfer. liteon,ltr501 - Return error values rather than -1 replaced by -EINVAL at higher levels of the callstack. maxim,ds4424 - A bunch of general minor improvements prior to adding new features. maxim,max11410 - Make some const string arrays static. maxim,max5522 - Use devm_regulator_get_enable_read_voltage() at probe to cache the voltage rather than keeping the regulator around to access and query later. vishay,vcnl4000 - Various code improvements. sharp,gp2ap020a00f - General driver modernization. silabs,si7210 - Use devm_regulator_get_enable_read_voltage() at probe to cache the voltage rather than keeping the regulator around to access and query later. st,lsm6dsx - Add SMOCF00 ACPI ID seen on products by SHIFT. st,st_sensors - Fix up various kernel-doc issues. - Avoid kmalloc of a single use buffer and instead reused existing buffer_data. taos,tsl2772 - Fix some kernel-doc warnings due to missing : ti,ads7950 - Use iio_push_to_buffers_with_ts_unaligned() as first few elements of array are not the data that is pushed. - Move from array of chip_info structures to individual named ones. This is part of slowly replacing use of a code pattern that we don't want replicated in new drivers. vti,sca3000 - General driver modernization included use of devm and guard(). Various other more minor stuff not called out explicitly. Includes things like typo fixes, use of dev_err_probe() and local variables to avoid repeated dereferencing of the same member as well as increasing use of guard() to simplify release of locks. Another slow improvement to code quality is both standardizing on header order and ensure all appropriate headers are included. * tag 'iio-for-7.1a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (217 commits) Docs: iio: ad7191 Correct clock configuration iio: amplifiers: ad8366: add support for adrf5702/3 dt-bindings: iio: amplifiers: ad8366: add adrf5702/3 support iio: adc: meson-saradc: add support for Meson S4 dt-bindings: iio: adc: amlogic,meson-saradc: add S4 compatible iio: imu: st_lsm6dsx: Add ACPI ID for SHIFT13mi gyroscope iio: proximity: add driver for ST VL53L1X ToF sensor dt-bindings: iio: proximity: add ST VL53L1X ToF sensor iio: adc: max11410: make vref register name arrays static const iio: accel: bmc150-accel-core: use sysfs_emit() in show functions iio: frequency: adf4350: replace TODO with NOTE in adf4350_set_freq() iio: adc: ltc2309: add support for ltc2305 iio: adc: ltc2309: explicitly assign hex values to channel enums dt-bindings: adc: ltc2497: add support for ltc2305 iio: accel: adxl380: fix typo in PART_ID register macro iio: dac: ds4424: add Rfs-based scale and per-variant limits dt-bindings: iio: dac: maxim,ds4424: add maxim,rfs-ohms property iio: dac: ds4424: convert to regmap iio: dac: ds4424: support per-variant output range limits iio: dac: ds4424: add DS4402/DS4404 device IDs ... commit 299933b118d1bcf8b93d58076aed34582718b0dd Author: Tycho Andersen (AMD) Date: Tue Mar 24 10:12:58 2026 -0600 x86/sev, crypto/ccp: Move SNP init to ccp driver Use the new snp_prepare() to initialize SNP from the ccp driver instead of at boot time. This means that SNP is not enabled unless it is really going to be used (i.e. kvm_amd loads the ccp driver automatically). Signed-off-by: Tycho Andersen (AMD) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://patch.msgid.link/20260324161301.1353976-5-tycho@kernel.org commit b65546b14d273dde2a56c0313da36a6aeb5c3f32 Author: Tycho Andersen (AMD) Date: Tue Mar 24 10:12:57 2026 -0600 x86/sev: Create snp_shutdown() After SNP_SHUTDOWN, two things should be done: 1. clear the RMP table 2. disable MFDM to prevent the FW_WARN in k8_check_syscfg_dram_mod_en() in the event of a kexec Create and export to the CCP driver a function that does them. Also change the MFDM helper to allow for disabling the bit, since the SNP x86 shutdown path needs to disable MFDM. The comment for k8_check_syscfg_dram_mod_en() notes, the "BIOS" is supposed clear it, or the kernel in the case of module unload and shutdown followed by kexec. Signed-off-by: Tycho Andersen (AMD) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://patch.msgid.link/20260324161301.1353976-4-tycho@kernel.org commit 9220b8cc51c960e98a9532ec990c55bc546e3b46 Author: Cássio Gabriel Date: Sat Mar 28 20:42:01 2026 -0300 ALSA: hda: intel: Drop obsolete probe-work unlock workaround Commit ab949d519601 ("ALSA: hda - Fix deadlock of controller device lock at unbinding") added a temporary device_unlock()/device_lock() pair around probe-work cancellation to avoid a deadlock between controller unbind and codec probe. That deadlock depended on the driver core taking both a device lock and its parent lock during bind and unbind. Since commit 8c97a46af04b ("driver core: hold dev's parent lock when needed") and follow-up fixes, the parent lock is only taken when bus->need_parent_lock is set. The HDA bus does not set that flag, so codec binding no longer locks the controller device as the codec's parent. Keep cancel_delayed_work_sync(), since the async probe/remove race still needs to be serialized, but drop the stale unlock/relock workaround and its outdated FIXME comment. Keeping it around only opens an unnecessary unlocked window inside azx_remove(). Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260328-hda-intel-drop-obsolete-probe-workaround-v1-1-bc43aeafc98b@gmail.com Signed-off-by: Takashi Iwai commit 31183edd9cb3465af5c8b9cb16f42259cbf27109 Author: Phil Willoughby Date: Sat Mar 28 16:02:58 2026 +0000 ALSA: usb-audio: tidy up the AF16Rig quirks Use macros to make the AF16Rig quirk table smaller. Add a disabled block containing the theoretical quirks for the other clock sources that the AF16Rig has. It's disabled because I cannot test it. Fixes: 0da18c2dd1cc ("ALSA: usb-audio: Add quirks for Arturia AF16Rig") Tested-By: Phil Willoughby Signed-off-by: Phil Willoughby Link: https://patch.msgid.link/20260328160326.23665-1-willerz@gmail.com Signed-off-by: Takashi Iwai commit aa8f35172ab66c57d4355a8c4e28d05b44c938e3 Author: Miguel Ojeda Date: Wed Jan 21 19:37:19 2026 +0100 pwm: th1520: fix `CLIPPY=1` warning The Rust kernel code should be kept `CLIPPY=1`-clean [1]. Clippy reports: error: this pattern reimplements `Option::unwrap_or` --> drivers/pwm/pwm_th1520.rs:64:5 | 64 | / (match ns.checked_mul(rate_hz) { 65 | | Some(product) => product, 66 | | None => u64::MAX, 67 | | }) / NSEC_PER_SEC_U64 | |______^ help: replace with: `ns.checked_mul(rate_hz).unwrap_or(u64::MAX)` | = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.92.0/index.html#manual_unwrap_or = note: `-D clippy::manual-unwrap-or` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(clippy::manual_unwrap_or)]` Applying the suggestion then triggers: error: manual saturating arithmetic --> drivers/pwm/pwm_th1520.rs:64:5 | 64 | ns.checked_mul(rate_hz).unwrap_or(u64::MAX) / NSEC_PER_SEC_U64 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: consider using `saturating_mul`: `ns.saturating_mul(rate_hz)` | = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.92.0/index.html#manual_saturating_arithmetic = note: `-D clippy::manual-saturating-arithmetic` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(clippy::manual_saturating_arithmetic)]` Thus fix it by using saturating arithmetic, which simplifies the code as well. Link: https://rust-for-linux.com/contributing#submit-checklist-addendum [1] Fixes: e03724aac758 ("pwm: Add Rust driver for T-HEAD TH1520 SoC") Signed-off-by: Miguel Ojeda Reviewed-by: Danilo Krummrich Reviewed-by: Michal Wilczynski Link: https://patch.msgid.link/20260121183719.71659-1-ojeda@kernel.org Signed-off-by: Uwe Kleine-König commit abfe5ee9971249b91020b5053afcaad43837336a Author: Gary Guo Date: Thu Mar 19 12:16:45 2026 +0000 rust: move `static_assert` into `build_assert` Conceptually, `static_assert` is also a build-time assertion that occurs earlier in the pipeline. Consolidate the implementation so that we can use this as the canonical place to add more useful build-time assertions. Reviewed-by: Yury Norov Signed-off-by: Gary Guo Reviewed-by: Alice Ryhl Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260319121653.2975748-2-gary@kernel.org [ Used kernel vertical style. - Miguel ] Signed-off-by: Miguel Ojeda commit ca2ca373ec854d203c74e6ac1c4e08a70e8d2509 Author: Tycho Andersen (AMD) Date: Thu Mar 26 10:11:05 2026 -0600 x86/sev: Create snp_prepare() In preparation for delayed SNP initialization, create a function snp_prepare() that does the necessary architecture setup. Export this function for the ccp module to allow it to do the setup as necessary. Introduce a cpu_read_lock/unlock() wrapper around the MFDM and SNP enable. While CPU hotplug is not supported, this makes sure that the bit setting happens on the same set of CPUs in both cases. This improvement was suggested by Sashiko: https://sashiko.dev/#/patchset/20260324161301.1353976-1-tycho%40kernel.org Also move {mfd,snp}_enable() out of the __init section, since these will be called later. Signed-off-by: Tycho Andersen (AMD) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://patch.msgid.link/20260326161110.1764303-3-tycho@kernel.org commit 9c016c3f4928f436b9ad20f30a5a9d538490fbb4 Author: Tom Lendacky Date: Tue Mar 24 10:12:55 2026 -0600 x86/sev: Create a function to clear/zero the RMP In preparation for delayed SNP initialization and disablement on shutdown, create a function, clear_rmp(), that clears the RMP bookkeeping area and the RMP entries. Signed-off-by: Tom Lendacky Signed-off-by: Tycho Andersen (AMD) Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260324161301.1353976-2-tycho@kernel.org commit e197453eb0c110d3d83fd1d2b324a93d5fcfa314 Author: David Laight Date: Thu Mar 26 20:18:24 2026 +0000 tracing: Remove spurious default precision from show_event_trigger/filter formats Change 2d8b7f9bf8e6e ("tracing: Have show_event_trigger/filter format a bit more in columns") added space padding to align the output. However it used ("%*.s", len, "") which requests the default precision. It doesn't matter here whether the userspace default (0) or kernel default (no precision) is used, but the format should be "%*s". Cc: Mathieu Desnoyers Cc: Rasmus Villemoes Cc: Andy Shevchenko Cc: Sergey Senozhatsky Cc: Andrew Morton Link: https://patch.msgid.link/20260326201824.3919-1-david.laight.linux@gmail.com Signed-off-by: David Laight Acked-by: Masami Hiramatsu (Google) Reviewed-by: Petr Mladek Reviewed-by: Aaron Tomlin Signed-off-by: Steven Rostedt (Google) commit ad8363ebf851599489e8821f5278f784df154398 Author: Vineeth Pillai (Google) Date: Mon Mar 23 12:00:25 2026 -0400 cpufreq: Use trace_call__##name() at guarded tracepoint call sites Replace trace_foo() with the new trace_call__foo() at sites already guarded by trace_foo_enabled(), avoiding a redundant static_branch_unlikely() re-evaluation inside the tracepoint. trace_call__foo() calls the tracepoint callbacks directly without utilizing the static branch again. Cc: Huang Rui Cc: Mario Limonciello Cc: Perry Yuan Cc: "Rafael J. Wysocki" Cc: Viresh Kumar Cc: Srinivas Pandruvada Cc: Len Brown Link: https://patch.msgid.link/20260323160052.17528-7-vineeth@bitbyteword.org Suggested-by: Steven Rostedt Suggested-by: Peter Zijlstra Signed-off-by: Vineeth Pillai (Google) Assisted-by: Claude:claude-sonnet-4-6 Acked-by: Rafael J. Wysocki (Intel) # cpufreq core Reviewed-by: Gautham R. Shenoy Signed-off-by: Steven Rostedt (Google) commit 7aba10efef1d972fc82b00b84911f07f6afbdb78 Author: Will Deacon Date: Fri Mar 27 13:00:46 2026 +0000 KVM: arm64: Don't pass host_debug_state to BRBE world-switch routines Now that the SPE and BRBE nVHE world-switch routines operate on the host_debug_state directly, tweak the BRBE code to do the same for consistency. This is purely cosmetic. Cc: Marc Zyngier Cc: Oliver Upton Cc: James Clark Cc: Leo Yan Cc: Suzuki K Poulose Cc: Fuad Tabba Cc: Alexandru Elisei Signed-off-by: Will Deacon Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Link: https://patch.msgid.link/20260327130047.21065-4-will@kernel.org Signed-off-by: Marc Zyngier commit 07695f7dc1e141601254057a00bf4e23301eb0b2 Author: Will Deacon Date: Fri Mar 27 13:00:45 2026 +0000 KVM: arm64: Disable SPE Profiling Buffer when running in guest context The nVHE world-switch code relies on zeroing PMSCR_EL1 to disable profiling data generation in guest context when SPE is in use by the host. Unfortunately, this may leave PMBLIMITR_EL1.E set and consequently we can end up running in guest/hypervisor context with the Profiling Buffer enabled. The current "known issues" document for Rev M.a of the Arm ARM states that this can lead to speculative, out-of-context translations: | 2.18 D23136: | | When the Profiling Buffer is enabled, profiling is not stopped, and | Discard mode is not enabled, the Statistical Profiling Unit might | cause speculative translations for the owning translation regime, | including when the owning translation regime is out-of-context. In a similar fashion to TRBE, ensure that the Profiling Buffer is disabled during the nVHE world switch before we start messing with the stage-2 MMU and trap configuration. Cc: Marc Zyngier Cc: Oliver Upton Cc: James Clark Cc: Leo Yan Cc: Suzuki K Poulose Cc: Fuad Tabba Cc: Alexandru Elisei Reviewed-by: Alexandru Elisei Reviewed-by: Fuad Tabba Tested-by: Alexandru Elisei Tested-by: Fuad Tabba Fixes: f85279b4bd48 ("arm64: KVM: Save/restore the host SPE state when entering/leaving a VM") Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260327130047.21065-3-will@kernel.org Signed-off-by: Marc Zyngier commit d133aa75e39dd72e0b8577ab1f5fc17c72246536 Author: Will Deacon Date: Fri Mar 27 13:00:44 2026 +0000 KVM: arm64: Disable TRBE Trace Buffer Unit when running in guest context The nVHE world-switch code relies on zeroing TRFCR_EL1 to disable trace generation in guest context when self-hosted TRBE is in use by the host. Per D3.2.1 ("Controls to prohibit trace at Exception levels"), clearing TRFCR_EL1 means that trace generation is prohibited at EL1 and EL0 but per R_YCHKJ the Trace Buffer Unit will still be enabled if TRBLIMITR_EL1.E is set. R_SJFRQ goes on to state that, when enabled, the Trace Buffer Unit can perform address translation for the "owning exception level" even when it is out of context. Consequently, we can end up in a state where TRBE performs speculative page-table walks for a host VA/IPA in guest/hypervisor context depending on the value of MDCR_EL2.E2TB, which changes over world-switch. The potential result appears to be a heady mixture of SErrors, data corruption and hardware lockups. Extend the TRBE world-switch code to clear TRBLIMITR_EL1.E after draining the buffer, restoring the register on return to the host. This unfortunately means we need to tackle CPU errata #2064142 and #2038923 which add additional synchronisation requirements around manipulations of the limit register. Hopefully this doesn't need to be fast. Cc: Marc Zyngier Cc: Oliver Upton Cc: James Clark Cc: Leo Yan Cc: Suzuki K Poulose Cc: Fuad Tabba Cc: Alexandru Elisei Tested-by: Leo Yan Tested-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Reviewed-by: Fuad Tabba Fixes: a1319260bf62 ("arm64: KVM: Enable access to TRBE support for host") Signed-off-by: Will Deacon Link: https://patch.msgid.link/20260327130047.21065-2-will@kernel.org Signed-off-by: Marc Zyngier commit 124ad3034ec0029b65178f3ab8a6cdca5a0b0519 Author: Ahmed S. Darwish Date: Fri Mar 27 03:15:17 2026 +0100 tools/x86/kcpuid: Update bitfields to x86-cpuid-db v3.0 Update kcpuid's CSV to version 3.0, as generated by x86-cpuid-db. Summary of the v2.5 changes: - Reduce the verbosity of leaf and bitfields descriptions, as formerly requested by Boris. - Leaf 0x8000000a: Add Page Modification Logging (PML) bit. Summary of the v3.0 changes: - Leaf 0x23: Introduce subleaf 2, Auto Counter Reload (ACR) - Leaf 0x23: Introduce subleaf 4/5, PEBS capabilities and counters - Leaf 0x1c: Return LBR depth as a bitmask instead of individual bits - Leaf 0x0a: Use more descriptive PMU bitfield names - Leaf 0x0a: Add various missing PMU events - Leaf 0x06: Add missing IA32_HWP_CTL flag - Leaf 0x0f: Add missing non-CPU (IO) Intel RDT bits Thanks to Dave Hansen for reporting multiple missing bits. Signed-off-by: Ahmed S. Darwish Signed-off-by: Borislav Petkov (AMD) Link: https://gitlab.com/x86-cpuid.org/x86-cpuid-db/-/blob/v2.5/CHANGELOG.rst Link: https://gitlab.com/x86-cpuid.org/x86-cpuid-db/-/blob/v3.0/CHANGELOG.rst commit a91cbf52c115e52392729a855ddb9d85da0517df Merge: b4e93cbc60641c 3f92867ce3ee2a Author: Linus Walleij Date: Sat Mar 28 17:14:58 2026 +0100 Merge tag 'renesas-pinctrl-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel pinctrl: renesas: Updates for v7.1 - Add pin configuration support for RZ/T2H and RZ/N2H, - Fix save/restore of registers for ports with variable pincfg per pin on RZ/G3E, RZ/V2H(P), RZ/V2N, and RZ/Five, - Drop a superfluous blank line. Signed-off-by: Linus Walleij commit 724d197aaea19e4f2012fca5b0e30ae690458de3 Author: Steven Rostedt Date: Sat Mar 28 10:19:46 2026 -0400 tracing: Remove tracing_alloc_snapshot() when snapshot isn't defined The function tracing_alloc_snapshot() is only used between trace.c and trace_snapshot.c. When snapshot isn't configured, it's not used at all. The stub function was defined as a global with no users and no prototype causing build issues. Remove the function when snapshot isn't configured as nothing is calling it. Also remove the EXPORT_SYMBOL_GPL() that was associated with it as it's not used outside of the tracing subsystem which also includes any modules. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260328101946.2c4ef4a5@robin Reported-by: Mark Brown Closes: https://lore.kernel.org/all/acb-IuZ4vDkwwQLW@sirena.co.uk/ Fixes: bade44fe546212 (tracing: Move snapshot code out of trace.c and into trace_snapshot.c) Signed-off-by: Steven Rostedt (Google) commit 38f6e93dedbc1b6c2a6e97110ab7e872c257a5e3 Author: Takashi Iwai Date: Sat Mar 28 14:43:05 2026 +0100 ALSA: hda: Add missing SET_GPI_* and SET_GPO_* verb definitions We've added the definitions of the missing GPI and GPO verbs for reading in the previous commit, but the counter-part for setting values is missing. Add the definitions of missing verbs for comprehensiveness. Link: https://patch.msgid.link/20260328134319.207482-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit e10dcb9d654177270b48119fa79f3924aef9ff48 Author: Alexandre Courbot Date: Fri Mar 27 00:22:13 2026 +0900 gpu: nova-core: firmware: gsp: use dma::Coherent for level0 table Replace the nova-core local `DmaObject` with a `CoherentBox` that can fulfill the same role. Since `CoherentBox` is more flexible than `DmaObject`, we can use the native `u64` type for page table entries instead of messing with bytes. The `dma` module becomes unused with that change, so remove it as well. Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260327-b4-nova-dma-removal-v2-7-616e1d0b5cb3@nvidia.com Signed-off-by: Alexandre Courbot commit 371db8bcb925bfb0ac68db2f66aeaa0350ac1d06 Author: Alexandre Courbot Date: Fri Mar 27 00:22:12 2026 +0900 gpu: nova-core: firmware: gsp: use dma::Coherent for signatures Replace the nova-core local `DmaObject` with a `Coherent` that can fulfill the same role. Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260327-b4-nova-dma-removal-v2-6-616e1d0b5cb3@nvidia.com Signed-off-by: Alexandre Courbot commit c1c79e3bebc6f8b634fcf11d08d72a0df1cb85a0 Author: Alexandre Courbot Date: Fri Mar 27 00:22:11 2026 +0900 gpu: nova-core: fb: use dma::CoherentHandle Replace the nova-core local `DmaObject` with a `CoherentHandle` that can fulfill the same role. Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260327-b4-nova-dma-removal-v2-5-616e1d0b5cb3@nvidia.com Signed-off-by: Alexandre Courbot commit a88831502c8f0530e1390a5f704fbc5e73f19b8c Author: Alexandre Courbot Date: Fri Mar 27 00:22:10 2026 +0900 gpu: nova-core: falcon: use dma::Coherent Replace the nova-core local `DmaObject` with a `Coherent` that can fulfill the same role. Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260327-b4-nova-dma-removal-v2-4-616e1d0b5cb3@nvidia.com Signed-off-by: Alexandre Courbot commit 1f9283afd3f1780bd629f02e149afe7b0c78fc5b Author: Alexandre Courbot Date: Fri Mar 27 00:22:09 2026 +0900 gpu: nova-core: firmware: fwsec: use dma::Coherent Replace the nova-core local `DmaObject` with a `Coherent` that can fulfill the same role. Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260327-b4-nova-dma-removal-v2-3-616e1d0b5cb3@nvidia.com Signed-off-by: Alexandre Courbot commit 308eb645b57a91fe78d3065b8924f5c92b69a4a0 Author: Alexandre Courbot Date: Fri Mar 27 00:22:08 2026 +0900 gpu: nova-core: firmware: riscv: use dma::Coherent Replace the nova-core local `DmaObject` with a `Coherent` that can fulfill the same role. Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260327-b4-nova-dma-removal-v2-2-616e1d0b5cb3@nvidia.com Signed-off-by: Alexandre Courbot commit 816718c611cab2164d718b91ad8204afcd0af81f Author: Alexandre Courbot Date: Fri Mar 27 00:22:07 2026 +0900 rust: dma: add from-slice constructors for Coherent and CoherentBox A very common pattern is to create a block of coherent memory with the content of an already-existing slice of bytes (e.g. a loaded firmware blob). `CoherentBox` makes this easier, but still implies a potentially panicking operation with `copy_from_slice` that requires a `PANIC` comment. Add `from_slice_with_attrs` and `from_slice` methods to both `Coherent` and `CoherentBox` to turn this into a trivial one-step operation. Reviewed-by: Andreas Hindborg Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260327-b4-nova-dma-removal-v2-1-616e1d0b5cb3@nvidia.com Signed-off-by: Alexandre Courbot commit 3bd246d1cf609a80cae19e4aefb599256a72b1a6 Author: Cássio Gabriel Date: Sat Mar 28 01:53:35 2026 -0300 ALSA: hda/proc: show GPI and GPO state in codec proc output print_gpio() prints the GPIO capability header and the bidirectional GPIO state, but it never reports the separate GPI and GPO pins even though AC_PAR_GPIO_CAP exposes their counts. The HD-audio specification defines dedicated GPI and GPO verbs alongside the GPIO ones, so codecs with input-only or output-only general-purpose pins currently lose that state from /proc/asound/card*/codec#* altogether. Add the missing read verb definitions and extend print_gpio() to dump the GPI and GPO pins, too, while leaving the existing IO[] output unchanged. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260328-hda-proc-gpi-gpo-v1-1-fabb36564bee@gmail.com Signed-off-by: Takashi Iwai commit e9fb60a780fe7eae6a5d73e647208b2a7d3e3b54 Author: Zhan Xusheng Date: Thu Mar 26 22:22:10 2026 +0800 posix-timers: Fix stale function name in comment The comment in exit_itimers() still refers to itimer_delete(), which was replaced by posix_timer_delete(). Update the comment accordingly. Signed-off-by: Zhan Xusheng Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260326142210.98632-1-zhanxusheng@xiaomi.com commit 9fd2170d70178faa0427adaa9d2dfdbfa231d1b7 Author: Biju Das Date: Sat Mar 28 10:33:19 2026 +0000 irqchip/renesas-rzg2l: Replace raw_spin_{lock,unlock} with guard() in rzg2l_irq_set_type() Simplify the locking logic in rzg2l_irq_set_type() by using guard(), eliminating the need for an explicit unlock call. [ tglx: Remove the pointless cleanup.h include. The spinlock guards come from spinlock.h ] Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260328103324.134131-3-biju.das.jz@bp.renesas.com commit 6dd782af1eb6be16a80349ea7822f0f8a23bb3e8 Author: Danilo Krummrich Date: Sat Mar 21 18:27:47 2026 +0100 rust: dma: add CoherentHandle for DMA allocations without kernel mapping Add CoherentHandle, an opaque DMA allocation type for buffers that are only ever accessed by hardware. Unlike Coherent, it does not provide CPU access to the allocated memory. CoherentHandle implicitly sets DMA_ATTR_NO_KERNEL_MAPPING and stores the value returned by dma_alloc_attrs() as an opaque handle (NonNull) rather than a typed pointer, since with this flag the C API returns an opaque cookie (e.g. struct page *), not a CPU pointer to the allocated memory. Only the DMA bus address is exposed to drivers; the opaque handle is used solely to free the allocation on drop. This commit is for reference only; there is currently no in-tree user. Signed-off-by: Danilo Krummrich Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260321172749.592387-2-dakr@kernel.org [acourbot: fix conflict in dma.rs.] Signed-off-by: Alexandre Courbot commit 0da18c2dd1cc2a026416222ed206e2f269edf055 Author: Phil Willoughby Date: Sat Mar 28 11:08:41 2026 +0000 ALSA: usb-audio: Add quirks for Arturia AF16Rig The AF16Rig supports 34 channels at 44.1k/48k, 18 channels at 88.2k/96k and 10 channels at 176.4k/192k. This quirks is necessary because the automatic probing process we would otherwise use fails. The root cause of that is that the AF16Rig clock is not readable (its descriptor says that it is but the reads fail). Except as described below, the values in the audio format quirks were copied from the USB descriptors of the device. The rate information is from the datasheet of the device. The clock is the internal clock of the AF16Rig. Tested-By: Phil Willoughby I have tested all the configurations enabled by this patch. Cc: Jaroslav Kysela Cc: Takashi Iwai Signed-off-by: Phil Willoughby Link: https://patch.msgid.link/20260328112426.14816-1-willerz@gmail.com Signed-off-by: Takashi Iwai commit 18d4969e22cc3ff738257e1d7738aafc65a6d2d2 Author: Pengpeng Hou Date: Sat Mar 28 18:28:08 2026 +0800 ALSA: asihpi: detect truncated control names asihpi_ctl_init() builds mixer control names in the fixed 44-byte hpi_ctl->name buffer with sprintf(). This is not only a defensive cleanup. The current in-tree name tables and format strings can already exceed 44 bytes. For example, "Bitstream 0 Internal 0 Monitor Playback Volume" is 46 characters before the trailing NUL, so the current sprintf() call writes past the end of hpi_ctl->name. The generated control name is used as the ALSA control element key, so blindly truncating it is not sufficient. Switch the formatting to snprintf() and emit an error if truncation happens, showing the truncated name while still keeping the write bounded to hpi_ctl->name. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260328102808.33969-1-pengpeng@iscas.ac.cn Signed-off-by: Takashi Iwai commit 18fb5f1f0289b8217c0c43d54d12bccc201dd640 Author: Danilo Krummrich Date: Sat Mar 21 18:27:46 2026 +0100 rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs When DMA_ATTR_NO_KERNEL_MAPPING is passed to dma_alloc_attrs(), the returned CPU address is not a pointer to the allocated memory but an opaque handle (e.g. struct page *). Coherent (or CoherentAllocation respectively) stores this value as NonNull and exposes methods that dereference it and even modify its contents. Remove the flag from the public attrs module such that drivers cannot pass it to Coherent (or CoherentAllocation respectively) in the first place. Instead DMA_ATTR_NO_KERNEL_MAPPING can be supported with an additional opaque type (e.g. CoherentHandle) which does not provide access to the allocated memory. Cc: stable@vger.kernel.org Fixes: ad2907b4e308 ("rust: add dma coherent allocator abstraction") Signed-off-by: Danilo Krummrich Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260321172749.592387-1-dakr@kernel.org Signed-off-by: Alexandre Courbot commit e9550374d13a4bfd0b8a711733f5d423c2e56b96 Author: Marc Zyngier Date: Sun Mar 15 15:45:22 2026 +0000 KVM: arm64: Convert gmem_abort() to struct kvm_s2_fault_desc Having fully converted user_mem_abort() to kvm_s2_fault_desc and co, convert gmem_abort() to it as well. The change is obviously much simpler. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit fb9888fdfada0b5ad977f08f7550432a08aacbb1 Author: Marc Zyngier Date: Sun Mar 15 14:58:44 2026 +0000 KVM: arm64: Simplify integration of adjust_nested_*_perms() Instead of passing pointers to adjust_nested_*_perms(), allow them to return a new set of permissions. With some careful moving around so that the canonical permissions are computed before the nested ones are applied, we end-up with a bit less code, and something a bit more readable. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit adb70b3a8b31e9eb05f2ec3c76d85f9a7a8c8cbc Author: Marc Zyngier Date: Sun Mar 15 14:26:27 2026 +0000 KVM: arm64: Directly expose mapping prot and kill kvm_s2_fault The 'prot' field is the only one left in kvm_s2_fault. Expose it directly to the functions needing it, and get rid of kvm_s2_fault. It has served us well during this refactoring, but it is now no longer needed. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit e314a4dbdb8b29b7e9a69afb8831a15a6d15c1ed Author: Marc Zyngier Date: Sat Mar 14 09:44:36 2026 +0000 KVM: arm64: Move device mapping management into kvm_s2_fault_pin_pfn() Attributes computed for devices are computed very late in the fault handling process, meanning they are mutable for that long. Introduce both 'device' and 'map_non_cacheable' attributes to the vma_info structure, allowing that information to be set in stone earlier, in kvm_s2_fault_pin_pfn(). Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 29a5681843a52570ca9597bf355be33fe8753eb0 Author: Marc Zyngier Date: Fri Mar 13 09:22:04 2026 +0000 KVM: arm64: Replace force_pte with a max_map_size attribute force_pte is annoyingly limited in what it expresses, and we'd be better off with a more generic primitive. Introduce max_map_size instead, which does the trick and can be moved into the vma_info structure. This firther allows it to reduce the scopes in which it is mutable. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit f8dad9602ff305b879fa23688becd578102ba547 Author: Marc Zyngier Date: Mon Mar 9 15:55:38 2026 +0000 KVM: arm64: Move kvm_s2_fault.{pfn,page} to kvm_s2_vma_info Continue restricting the visibility/mutability of some attributes by moving kvm_s2_fault.{pfn,page} to kvm_s2_vma_info. This is a pretty mechanical change. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 08abf09f4d763565ee9ed084401b7ac92f8b4952 Author: Marc Zyngier Date: Mon Mar 9 15:35:27 2026 +0000 KVM: arm64: Restrict the scope of the 'writable' attribute The 'writable' field is ambiguous, and indicates multiple things: - whether the underlying memslot is writable - whether we are resolving the fault with writable attributes Add a new field to kvm_s2_fault_vma_info (map_writable) to indicate the former condition, and have local writable variables to track the latter. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 18e1312879db0af5bfd1b1a8b6771d314ccd3ca9 Author: Marc Zyngier Date: Mon Mar 9 14:32:25 2026 +0000 KVM: arm64: Kill logging_active from kvm_s2_fault There are only two spots where we evaluate whether logging is active. Replace the boolean with calls to the relevant helper. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 4ff2ce512063ae79976c23b6fe2130611bcbae62 Author: Marc Zyngier Date: Mon Mar 9 14:31:06 2026 +0000 KVM: arm64: Move VMA-related information to kvm_s2_fault_vma_info Mecanically extract a bunch of VMA-related fields from kvm_s2_fault and move them to a new kvm_s2_fault_vma_info structure. This is not much, but it already allows us to define which functions can update this structure, and which ones are pure consumers of the data. Those in the latter camp are updated to take a const pointer to that structure. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 1a3cd7cb5547979f96ec2a0920b8e39939c58db3 Author: Marc Zyngier Date: Mon Mar 9 11:52:40 2026 +0000 KVM: arm64: Kill topup_memcache from kvm_s2_fault The topup_memcache field can be easily replaced by the equivalent conditions, and the resulting code is not much worse. While at it, split prepare_mmu_memcache() into get/topup helpers, which makes the code more readable. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit c0d699915a835364b1c8d1eca11e11e7b82f0705 Author: Marc Zyngier Date: Mon Mar 9 11:28:11 2026 +0000 KVM: arm64: Kill exec_fault from kvm_s2_fault Similarly to write_fault, exec_fault can be advantageously replaced by the kvm_vcpu_trap_is_exec_fault() predicate where needed. Another one bites the dust... Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 49902d7e010614888253a90252f4704edb2fe3e3 Author: Marc Zyngier Date: Mon Mar 9 11:22:59 2026 +0000 KVM: arm64: Kill write_fault from kvm_s2_fault We already have kvm_is_write_fault() as a predicate indicating a S2 fault on a write, and we're better off just using that instead of duplicating the state. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 31571929e8a894d06291a9501b2be22cffe14443 Author: Marc Zyngier Date: Mon Mar 9 10:57:04 2026 +0000 KVM: arm64: Constrain fault_granule to kvm_s2_fault_map() The notion of fault_granule is specific to kvm_s2_fault_map(), and is unused anywhere else. Move this variable locally, removing it from kvm_s2_fault. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit fe4b6f824f267739ef2c5f2f047c317eceb587c3 Author: Marc Zyngier Date: Mon Mar 9 09:59:38 2026 +0000 KVM: arm64: Replace fault_is_perm with a helper Carrying a boolean to indicate that a given fault is a permission fault is slightly odd, as this is a property of the fault itself, and we'd better avoid duplicating state. For this purpose, introduce a kvm_s2_fault_is_perm() predicate that can take a fault descriptor as a parameter. fault_is_perm is therefore dropped from kvm_s2_fault. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Reviewed-by: Joey Gouly Signed-off-by: Marc Zyngier commit c6f4d84643498bc855e2f6719a3233ded0e2dc63 Author: Marc Zyngier Date: Sun Mar 8 15:03:49 2026 +0000 KVM: arm64: Move fault context to const structure In order to make it clearer what gets updated or not during fault handling, move a set of information that losely represents the fault context. This gets populated early, from handle_mem_abort(), and gets passed along as a const pointer. user_mem_abort()'s signature is majorly improved in doing so, and kvm_s2_fault loses a bunch of fields. gmem_abort() will get a similar treatment down the line. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit f583a53c2b8a4bd77f090bb76512eb87bc80f2c4 Author: Marc Zyngier Date: Sun Mar 8 12:18:29 2026 +0000 KVM: arm64: Make fault_ipa immutable Updating fault_ipa is conceptually annoying, as it changes something that is a property of the fault itself. Stop doing so and instead use fault->gfn as the sole piece of state that can be used to represent the faulting IPA. At the same time, introduce get_canonical_gfn() for the couple of case we're we are concerned with the memslot-related IPA and not the faulting one. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 5729560e2c3cb67a22a1d72688e0bb8e96798313 Author: Marc Zyngier Date: Sat Mar 7 11:39:49 2026 +0000 KVM: arm64: Kill fault->ipa fault->ipa, in a nested contest, represents the output of the guest's S2 translation for the fault->fault_ipa input, and is equal to fault->fault_ipa otherwise, Given that this is readily available from kvm_s2_trans_output(), drop fault->ipa and directly compute fault->gfn instead, which is really what we want. Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier commit 11f8f1b8a97b63b180f7aa021ec9abdead283025 Author: Fuad Tabba Date: Fri Mar 6 14:02:32 2026 +0000 KVM: arm64: Clean up control flow in kvm_s2_fault_map() Clean up the KVM MMU lock retry loop by pre-assigning the error code. Add clear braces to the THP adjustment integration for readability, and safely unnest the transparent hugepage logic branches. Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit 84699747aa554197f6d5b4f4c9d1bcb6cb28e21f Author: Fuad Tabba Date: Fri Mar 6 14:02:31 2026 +0000 KVM: arm64: Hoist MTE validation check out of MMU lock path Simplify the non-cacheable attributes assignment by using a ternary operator. Additionally, hoist the MTE validation check (mte_allowed) out of kvm_s2_fault_map() and into kvm_s2_fault_compute_prot(). This allows us to fail faster and avoid acquiring the KVM MMU lock unnecessarily when the VMM introduces a disallowed VMA for an MTE-enabled guest. Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit 3456943e8786d56aa2bd3f99e9ad2d735a9879c8 Author: Fuad Tabba Date: Fri Mar 6 14:02:30 2026 +0000 KVM: arm64: Optimize early exit checks in kvm_s2_fault_pin_pfn() Optimize the early exit checks in kvm_s2_fault_pin_pfn by grouping all error responses under the generic is_error_noslot_pfn check first, avoiding unnecessary branches in the hot path. Reviewed-by: Joey Gouly Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit 975bad4bb21e4eea7ecc0f32f4cbbb91a9c8d48f Author: Fuad Tabba Date: Fri Mar 6 14:02:29 2026 +0000 KVM: arm64: Initialize struct kvm_s2_fault completely at declaration Simplify the initialization of struct kvm_s2_fault in user_mem_abort(). Instead of partially initializing the struct via designated initializers and then sequentially assigning the remaining fields (like write_fault and topup_memcache) further down the function, evaluate those dependencies upfront. This allows the entire struct to be fully initialized at declaration. It also eliminates the need for the intermediate fault_data variable and its associated fault pointer, reducing boilerplate. Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit 3825373b91b0fbedc65205a59f95379aaf596aad Author: Fuad Tabba Date: Fri Mar 6 14:02:28 2026 +0000 KVM: arm64: Simplify return logic in user_mem_abort() With the refactoring done, the final return block of user_mem_abort() can be tidied up a bit more. Clean up the trailing edge by dropping the unnecessary assignment, collapsing the return evaluation for kvm_s2_fault_compute_prot(), and tail calling kvm_s2_fault_map() directly. Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit 9a57bc1b3c6b1f583f43acf7719d66e6b30ef2a9 Author: Fuad Tabba Date: Fri Mar 6 14:02:27 2026 +0000 KVM: arm64: Remove redundant state variables from struct kvm_s2_fault Remove redundant variables vma_shift and vfio_allow_any_uc from struct kvm_s2_fault as they are easily derived or checked when needed. Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit 2175ca5384ba9f3d1f45745522cdeb5865488400 Author: Fuad Tabba Date: Fri Mar 6 14:02:26 2026 +0000 KVM: arm64: Simplify nested VMA shift calculation In the kvm_s2_resolve_vma_size() helper, the local variable vma_pagesize is calculated from vma_shift, only to be used to bound the vma_pagesize by max_map_size and subsequently convert it back to a shift via __ffs(). Because vma_pagesize and max_map_size are both powers of two, we can simplify the logic by omitting vma_pagesize entirely and bounding the vma_shift directly using the shift of max_map_size. This achieves the same result while keeping the size-to-shift conversion out of the helper logic. Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit 5557a3f843bcef3de9a1237020348b2859812170 Author: Fuad Tabba Date: Fri Mar 6 14:02:25 2026 +0000 KVM: arm64: Extract page table mapping in user_mem_abort() Extract the code responsible for locking the KVM MMU and mapping the PFN into the stage-2 page tables into a new helper, kvm_s2_fault_map(). This helper manages the kvm_fault_lock, checks for MMU invalidation retries, attempts to adjust for transparent huge pages (THP), handles MTE sanitization if needed, and finally maps or relaxes permissions on the stage-2 entries. With this change, the main user_mem_abort() function is now a sequential dispatcher that delegates to specialized helper functions. Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit a6e11bd6e1bd9ea9a42738c5a6ac12881b5fcb36 Author: Fuad Tabba Date: Fri Mar 6 14:02:24 2026 +0000 KVM: arm64: Extract stage-2 permission logic in user_mem_abort() Extract the logic that computes the stage-2 protections and checks for various permission faults (e.g., execution faults on non-cacheable memory) into a new helper function, kvm_s2_fault_compute_prot(). This helper also handles injecting atomic/exclusive faults back into the guest when necessary. This refactoring step separates the permission computation from the mapping logic, making the main fault handler flow clearer. Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit f5a5bb8de11863bd92f4188b7e823e3fca4d68e6 Author: Fuad Tabba Date: Fri Mar 6 14:02:23 2026 +0000 KVM: arm64: Isolate mmap_read_lock inside new kvm_s2_fault_get_vma_info() helper Extract the VMA lookup and metadata snapshotting logic from kvm_s2_fault_pin_pfn() into a tightly-scoped sub-helper. This refactoring structurally fixes a TOCTOU (Time-Of-Check to Time-Of-Use) vulnerability and Use-After-Free risk involving the vma pointer. In the previous layout, the mmap_read_lock is taken, the vma is looked up, and then the lock is dropped before the function continues to map the PFN. While an explicit vma = NULL safeguard was present, the vma variable was still lexically in scope for the remainder of the function. By isolating the locked region into kvm_s2_fault_get_vma_info(), the vma pointer becomes a local variable strictly confined to that sub-helper. Because the pointer's scope literally ends when the sub-helper returns, it is not possible for the subsequent page fault logic in kvm_s2_fault_pin_pfn() to accidentally access the vanished VMA, eliminating this bug class by design. Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit bae99813c6a9ce474cbb7b6553dc6e379b2f4375 Author: Fuad Tabba Date: Fri Mar 6 14:02:22 2026 +0000 KVM: arm64: Extract PFN resolution in user_mem_abort() Extract the section of code responsible for pinning the physical page frame number (PFN) backing the faulting IPA into a new helper, kvm_s2_fault_pin_pfn(). This helper encapsulates the critical section where the mmap_read_lock is held, the VMA is looked up, the mmu invalidate sequence is sampled, and the PFN is ultimately resolved via __kvm_faultin_pfn(). It also handles the early exits for hardware poisoned pages and noslot PFNs. By isolating this region, we can begin to organize the state variables required for PFN resolution into the kvm_s2_fault struct, clearing out a significant amount of local variable clutter from user_mem_abort(). Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit 0b236c72c02df36992b7d6ff29cbe5abef973250 Author: Fuad Tabba Date: Fri Mar 6 14:02:21 2026 +0000 KVM: arm64: Introduce struct kvm_s2_fault to user_mem_abort() The user_mem_abort() function takes many arguments and defines a large number of local variables. Passing all these variables around to helper functions would result in functions with too many arguments. Introduce struct kvm_s2_fault to encapsulate the stage-2 fault state. This structure holds both the input parameters and the intermediate state required during the fault handling process. Update user_mem_abort() to initialize this structure and replace the usage of local variables with fields from the new structure. This prepares the ground for further extracting parts of user_mem_abort() into smaller helper functions that can simply take a pointer to the fault state structure. Reviewed-by: Joey Gouly Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit 570428601ba506e76c265a65626524ef3c5cbc04 Author: Zenghui Yu (Huawei) Date: Sat Mar 28 13:31:55 2026 +0800 KVM: arm64: ptdump: Initialize parser_state before pgtable walk If we go through the "need a bigger buffer" path in seq_read_iter(), which is likely to happen as we're dumping page tables, we will pass the populated-by-last-run st::parser_state to kvm_pgtable_walk()/kvm_ptdump_visitor(). As a result, the output of stage2_page_tables on my box looks like 0x0000000240000000-0x0000000000000000 17179869175G 1 0x0000000000000000-0x0000000000200000 2M 2 R px ux AF BLK 0x0000000000200000-0x0000000040000000 1022M 2 0x0000000040000000-0x0000000040200000 2M 2 R W PXNUXN AF BLK [...] Fix it by always initializing st::parser_state before starting a new pgtable walk. Besides, remove st::range as it's not used by note_page(); remove the explicit initialization of parser_state::start_address as it will be initialized in note_page() anyway. Signed-off-by: Zenghui Yu (Huawei) Link: https://patch.msgid.link/20260328053155.12219-1-zenghui.yu@linux.dev [maz: rebased on top of NV support] Signed-off-by: Marc Zyngier commit 796e119e9b14763be905ad0d023c71a14bc2e931 Author: Cássio Gabriel Date: Wed Mar 25 02:24:04 2026 -0300 ALSA: core: Validate compress device numbers without dynamic minors Without CONFIG_SND_DYNAMIC_MINORS, ALSA reserves only two fixed minors for compress devices on each card: comprD0 and comprD1. snd_find_free_minor() currently computes the compress minor as type + dev without validating dev first, so device numbers greater than 1 spill into the HWDEP minor range instead of failing registration. ASoC passes rtd->id to snd_compress_new(), so this can happen on real non-dynamic-minor builds. Add a dedicated fixed-minor check for SNDRV_DEVICE_TYPE_COMPRESS in snd_find_free_minor() and reject out-of-range device numbers with -EINVAL before constructing the minor. Also remove the stale TODO in compress_offload.c that still claims multiple compress nodes are missing. Fixes: 3eafc959b32f ("ALSA: core: add support for compressed devices") Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260325-alsa-compress-static-minors-v1-1-0628573bee1c@gmail.com Signed-off-by: Takashi Iwai commit 929cc1a53a6f5a09e78451ba359e870727751f9e Author: Linus Walleij Date: Tue Feb 24 11:26:32 2026 +0100 fork: zero vmap stack using clear_pages() instead of memset() After the introduction of clear_pages() we exploit the fact that the process vm_area is allocated in contiguous pages to just clear them all in one swift operation. Link: https://lkml.kernel.org/r/20260224-mm-fork-clear-pages-v1-1-184c65a72d49@kernel.org Signed-off-by: Linus Walleij Suggested-by: Mateusz Guzik Link: https://lore.kernel.org/linux-mm/dpnwsp7dl4535rd7qmszanw6u5an2p74uxfex4dh53frpb7pu3@2bnjjavjrepe/ Suggested-by: Pasha Tatashin Link: https://lore.kernel.org/20240311164638.2015063-7-pasha.tatashin@soleen.com Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Ankur Arora Cc: Ben Segall Cc: David Hildenbrand Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: Liam Howlett Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 01b61e8dda9b0fdb0d4cda43de25f4e390554d7b Author: Junrui Luo Date: Sat Mar 7 15:21:09 2026 +0800 ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr_regions. The other loops in the same function correctly use '<'. Fix the loop condition to use '<' for consistency and correctness. Link: https://lkml.kernel.org/r/SYBPR01MB78813DA26B50EC5E01F00566AF7BA@SYBPR01MB7881.ausprd01.prod.outlook.com Fixes: ea2034416b54 ("ocfs2/dlm: Add message DLM_QUERY_REGION") Signed-off-by: Junrui Luo Reported-by: Yuhao Jiang Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 7ab3fbb01bc6d79091bc375e5235d360cd9b78be Author: Junrui Luo Date: Sat Mar 7 15:21:08 2026 +0800 ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION network message is used to drive loops over the qr_regions buffer without sufficient validation. This series fixes two issues: - Patch 1 adds a bounds check to reject messages where qr_numregions exceeds O2NM_MAX_REGIONS. The o2net layer only validates message byte length; it does not constrain field values, so a crafted message can set qr_numregions up to 255 and trigger out-of-bounds reads past the 1024-byte qr_regions buffer. - Patch 2 fixes an off-by-one in the local-vs-remote comparison loop, which uses '<=' instead of '<', reading one entry past the valid range even when qr_numregions is within bounds. This patch (of 2): The qr_numregions field from a DLM_QUERY_REGION network message is used directly as loop bounds in dlm_match_regions() without checking against O2NM_MAX_REGIONS. Since qr_regions is sized for at most O2NM_MAX_REGIONS (32) entries, a crafted message with qr_numregions > 32 causes out-of-bounds reads past the qr_regions buffer. Add a bounds check for qr_numregions before entering the loops. Link: https://lkml.kernel.org/r/SYBPR01MB7881A334D02ACEE5E0645801AF7BA@SYBPR01MB7881.ausprd01.prod.outlook.com Link: https://lkml.kernel.org/r/SYBPR01MB788166F524AD04E262E174BEAF7BA@SYBPR01MB7881.ausprd01.prod.outlook.com Fixes: ea2034416b54 ("ocfs2/dlm: Add message DLM_QUERY_REGION") Signed-off-by: Junrui Luo Reported-by: Yuhao Jiang Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 010d7d9846504f97da649595c61985137ca67cd4 Author: Josh Law Date: Wed Mar 18 07:48:06 2026 +0000 lib/bch: fix signed shift overflow in build_mod8_tables Cast loop variable to unsigned int before left-shifting to avoid undefined behavior when i >= 128 and b == 3 (i << 24 overflows signed int). Link: https://lkml.kernel.org/r/20260318074806.16527-3-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Cc: Ivan Djelic Signed-off-by: Andrew Morton commit f42b510990030bbc0d6e4ba4486decbcd952b924 Author: Josh Law Date: Wed Mar 18 07:48:05 2026 +0000 lib/bch: fix signed left-shift undefined behavior Patch series "lib/bch: fix undefined behavior from signed left-shifts". Fix two instances of undefined behavior in lib/bch.c caused by left-shifting signed integers into or past the sign bit. While the kernel's -fno-strict-overflow flag prevents miscompilation today, these are formally UB per C11 6.5.7p4 and trivial to fix. This patch (of 2): Use 1u instead of 1 to avoid undefined behavior when left-shifting into the sign bit of a signed int. deg() can return up to 31, and 1 << 31 is UB per C11. Link: https://lkml.kernel.org/r/20260318074806.16527-2-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Cc: Ivan Djelic Signed-off-by: Andrew Morton commit b8822d73d6fe0d43de3b98ccc995b7032993b1b7 Author: Patrick Bellasi Date: Wed Mar 18 15:05:45 2026 +0000 scripts/decodecode: return 0 on success The decodecode script always returns an exit code of 1, regardless of whether the operation was successful or not. This is because the "cleanup" function, which is registered to run on any script exit via "trap cleanup EXIT", contains an unconditional "exit 1". Remove the "exit 1" from the "cleanup" function so that it only performs the necessary file cleanup without forcing a non-zero exit status. Do that to ensure successful script executions now exit with code 0. Exits due to errors are all handled by the "die()" function and will still correctly exit with code 1. Link: https://lkml.kernel.org/r/20260318150545.2809311-1-derkling@google.com Signed-off-by: Patrick Bellasi Acked-by: Randy Dunlap Signed-off-by: Andrew Morton commit 0f8e38eeb995bf818a7f220de109d6b6b96038b4 Author: Oleg Nesterov Date: Tue Mar 17 14:58:18 2026 +0100 do_notify_parent: sanitize the valid_signal() checks Now that kernel_clone() checks valid_signal(args->exit_signal), the "sig" argument of do_notify_parent() must always be valid or we have a bug. However, do_notify_parent() only checks that sig != -1 at the start, then it does another valid_signal() check before __send_signal_locked(). This is confusing. Change do_notify_parent() to WARN and return early if valid_signal(sig) is false. Link: https://lkml.kernel.org/r/abld-ilvMEZ7VgMw@redhat.com Signed-off-by: Oleg Nesterov Acked-by: Deepanshu Kartikey Signed-off-by: Andrew Morton commit 4580900fe184dcb2a4e32e28951a3aa0726dc48b Author: Petr Mladek Date: Mon Mar 23 18:21:38 2026 +0100 doc: watchdog: futher improvements Make further additions and alterations to the watchdog documentation. Link: https://lkml.kernel.org/r/acF3tXBxSr0KOP9b@pathway.suse.cz Signed-off-by: Petr Mladek Reviewed-by: Douglas Anderson Cc: Ian Rogers Cc: Jonathan Corbet Cc: Li Huafei Cc: Max Kellermann Cc: Mayank Rungta Cc: Shuah Khan Cc: Stephane Erainan Cc: Wang Jinchao Cc: Yunhui Cui Signed-off-by: Andrew Morton commit cb8615f3cb00210a27237e1c97cefe3aaf27f0cb Author: Mayank Rungta Date: Thu Mar 12 16:22:06 2026 -0700 doc: watchdog: document buddy detector The current documentation generalizes the hardlockup detector as primarily NMI-perf-based and lacks details on the SMP "Buddy" detector. Update the documentation to add a detailed description of the Buddy detector, and also restructure the "Implementation" section to explicitly separate "Softlockup Detector", "Hardlockup Detector (NMI/Perf)", and "Hardlockup Detector (Buddy)". Clarify that the softlockup hrtimer acts as the heartbeat generator for both hardlockup mechanisms and centralize the configuration details in a "Frequency and Heartbeats" section. Link: https://lkml.kernel.org/r/20260312-hardlockup-watchdog-fixes-v2-5-45bd8a0cc7ed@google.com Signed-off-by: Mayank Rungta Reviewed-by: Douglas Anderson Cc: Ian Rogers Cc: Jonathan Corbet Cc: Li Huafei Cc: Max Kellermann Cc: Petr Mladek Cc: Shuah Khan Cc: Stephane Erainan Cc: Wang Jinchao Cc: Yunhui Cui Signed-off-by: Andrew Morton commit 077ba03600faea5f2aa15afbb83580878cc8b500 Author: Mayank Rungta Date: Thu Mar 12 16:22:05 2026 -0700 watchdog/hardlockup: improve buddy system detection timeliness Currently, the buddy system only performs checks every 3rd sample. With a 4-second interval. If a check window is missed, the next check occurs 12 seconds later, potentially delaying hard lockup detection for up to 24 seconds. Modify the buddy system to perform checks at every interval (4s). Introduce a missed-interrupt threshold to maintain the existing grace period while reducing the detection window to 8-12 seconds. Best and worst case detection scenarios: Before (12s check window): - Best case: Lockup occurs after first check but just before heartbeat interval. Detected in ~8s (8s till next check). - Worst case: Lockup occurs just after a check. Detected in ~24s (missed check + 12s till next check + 12s logic). After (4s check window with threshold of 3): - Best case: Lockup occurs just before a check. Detected in ~8s (0s till 1st check + 4s till 2nd + 4s till 3rd). - Worst case: Lockup occurs just after a check. Detected in ~12s (4s till 1st check + 4s till 2nd + 4s till 3rd). Link: https://lkml.kernel.org/r/20260312-hardlockup-watchdog-fixes-v2-4-45bd8a0cc7ed@google.com Signed-off-by: Mayank Rungta Reviewed-by: Douglas Anderson Reviewed-by: Petr Mladek Cc: Ian Rogers Cc: Jonathan Corbet Cc: Li Huafei Cc: Max Kellermann Cc: Shuah Khan Cc: Stephane Erainan Cc: Wang Jinchao Cc: Yunhui Cui Signed-off-by: Andrew Morton commit de832583435c3500d94d8aea16fb998021fc1a57 Author: Mayank Rungta Date: Thu Mar 12 16:22:04 2026 -0700 doc: watchdog: clarify hardlockup detection timing The current documentation implies that a hardlockup is strictly defined as looping for "more than 10 seconds." However, the detection mechanism is periodic (based on `watchdog_thresh`), meaning detection time varies significantly depending on when the lockup occurs relative to the NMI perf event. Update the definition to remove the strict "more than 10 seconds" constraint in the introduction and defer details to the Implementation section. Additionally, add a "Detection Overhead" section illustrating the Best Case (~6s) and Worst Case (~20s) detection scenarios to provide administrators with a clearer understanding of the watchdog's latency. Link: https://lkml.kernel.org/r/20260312-hardlockup-watchdog-fixes-v2-3-45bd8a0cc7ed@google.com Signed-off-by: Mayank Rungta Reviewed-by: Petr Mladek Reviewed-by: Douglas Anderson Cc: Ian Rogers Cc: Jonathan Corbet Cc: Li Huafei Cc: Max Kellermann Cc: Shuah Khan Cc: Stephane Erainan Cc: Wang Jinchao Cc: Yunhui Cui Signed-off-by: Andrew Morton commit 746bb7fa915c33f8a0560764709a228f352999e8 Author: Mayank Rungta Date: Thu Mar 12 16:22:03 2026 -0700 watchdog: update saved interrupts during check Currently, arch_touch_nmi_watchdog() causes an early return that skips updating hrtimer_interrupts_saved. This leads to stale comparisons and delayed lockup detection. I found this issue because in our system the serial console is fairly chatty. For example, the 8250 console driver frequently calls touch_nmi_watchdog() via console_write(). If a CPU locks up after a timer interrupt but before next watchdog check, we see the following sequence: * watchdog_hardlockup_check() saves counter (e.g., 1000) * Timer runs and updates the counter (1001) * touch_nmi_watchdog() is called * CPU locks up * 10s pass: check() notices touch, returns early, skips update * 10s pass: check() saves counter (1001) * 10s pass: check() finally detects lockup This delays detection to 30 seconds. With this fix, we detect the lockup in 20 seconds. Link: https://lkml.kernel.org/r/20260312-hardlockup-watchdog-fixes-v2-2-45bd8a0cc7ed@google.com Signed-off-by: Mayank Rungta Reviewed-by: Douglas Anderson Reviewed-by: Petr Mladek Cc: Ian Rogers Cc: Jonathan Corbet Cc: Li Huafei Cc: Max Kellermann Cc: Shuah Khan Cc: Stephane Erainan Cc: Wang Jinchao Cc: Yunhui Cui Signed-off-by: Andrew Morton commit 3e811cae321904c111f3e963b165c1eb0bc17ae0 Author: Mayank Rungta Date: Thu Mar 12 16:22:02 2026 -0700 watchdog: return early in watchdog_hardlockup_check() Patch series "watchdog/hardlockup: Improvements to hardlockup", v2. This series addresses limitations in the hardlockup detector implementations and updates the documentation to reflect actual behavior and recent changes. The changes are structured as follows: Refactoring (Patch 1) ===================== Patch 1 refactors watchdog_hardlockup_check() to return early if no lockup is detected. This reduces the indentation level of the main logic block, serving as a clean base for the subsequent changes. Hardlockup Detection Improvements (Patches 2 & 4) ================================================= The hardlockup detector logic relies on updating saved interrupt counts to determine if the CPU is making progress. Patch 1 ensures that the saved interrupt count is updated unconditionally before checking the "touched" flag. This prevents stale comparisons which can delay detection. This is a logic fix that ensures the detector remains accurate even when the watchdog is frequently touched. Patch 3 improves the Buddy detector's timeliness. The current checking interval (every 3rd sample) causes high variability in detection time (up to 24s). This patch changes the Buddy detector to check at every hrtimer interval (4s) with a missed-interrupt threshold of 3, narrowing the detection window to a consistent 8-12 second range. Documentation Updates (Patches 3 & 5) ===================================== The current documentation does not fully capture the variable nature of detection latency or the details of the Buddy system. Patch 3 removes the strict "10 seconds" definition of a hardlockup, which was misleading given the periodic nature of the detector. It adds a "Detection Overhead" section to the admin guide, using "Best Case" and "Worst Case" scenarios to illustrate that detection time can vary significantly (e.g., ~6s to ~20s). Patch 5 adds a dedicated section for the Buddy detector, which was previously undocumented. It details the mechanism, the new timing logic, and known limitations. This patch (of 5): Invert the `is_hardlockup(cpu)` check in `watchdog_hardlockup_check()` to return early when a hardlockup is not detected. This flattens the main logic block, reducing the indentation level and making the code easier to read and maintain. This refactoring serves as a preparation patch for future hardlockup changes. Link: https://lkml.kernel.org/r/20260312-hardlockup-watchdog-fixes-v2-0-45bd8a0cc7ed@google.com Link: https://lkml.kernel.org/r/20260312-hardlockup-watchdog-fixes-v2-1-45bd8a0cc7ed@google.com Signed-off-by: Mayank Rungta Reviewed-by: Douglas Anderson Reviewed-by: Petr Mladek Cc: Ian Rogers Cc: Jonathan Corbet Cc: Li Huafei Cc: Max Kellermann Cc: Shuah Khan Cc: Stephane Erainan Cc: Wang Jinchao Cc: Yunhui Cui Signed-off-by: Andrew Morton commit ea2976032df9d520ef97d71f12dafdedf9a72ed8 Author: Eric Biggers Date: Sat Mar 14 13:41:44 2026 -0700 kernel/kexec: remove inclusion of crypto/hash.h kexec_core.c does not do any cryptographic hashing, so the header crypto/hash.h is not needed at all. Link: https://lkml.kernel.org/r/20260314204144.44884-1-ebiggers@kernel.org Signed-off-by: Eric Biggers Cc: Baoquan He Signed-off-by: Andrew Morton commit 231bb8c1be040044f14ed74b30e4e1a26db550f8 Author: Eric Biggers Date: Sat Mar 14 13:42:43 2026 -0700 kernel/crash: remove inclusion of crypto/sha1.h Several files related to kernel crash dumps include crypto/sha1.h but never use any of its functionality. Remove these includes so that these files don't unnecessarily come up in searches for which kernel code is still using the obsolete SHA-1 algorithm. Link: https://lkml.kernel.org/r/20260314204243.45001-1-ebiggers@kernel.org Signed-off-by: Eric Biggers Cc: Baoquan He Cc: Dave Young Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 8b140131bf341704ca8f56c9e1a69a27d3ba225d Author: Hisam Mehboob Date: Thu Mar 12 06:17:42 2026 +0500 CREDITS: simplify the end-of-file alphabetical order comment The existing comment references specific individuals by name which becomes outdated as new entries are added. Simplify it to state the alphabetical ordering rule clearly without depending on who happens to be the last entry. Link: https://lkml.kernel.org/r/20260312011741.846664-2-hisamshar@gmail.com Signed-off-by: Hisam Mehboob Suggested-by: Randy Dunlap Acked-by: Randy Dunlap Cc: Jakub Kacinski Cc: Simon Horman Signed-off-by: Andrew Morton commit c9ba82624b684679b37c5062b697c85f932089b9 Author: Josh Law Date: Thu Mar 12 21:52:49 2026 +0000 lib/glob: initialize back_str to silence uninitialized variable warning back_str is only used when back_pat is non-NULL, and both are always set together, so it is safe in practice. Initialize back_str to NULL to make this safety invariant explicit and silence compiler/static analysis warnings. Link: https://lkml.kernel.org/r/20260312215249.50165-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit d1db4118489fffd2b2f612140b7acbb477880839 Author: Sasha Levin Date: Wed Mar 11 17:58:17 2026 -0400 checkpatch: add support for Assisted-by tag The Assisted-by tag was introduced in Documentation/process/coding-assistants.rst for attributing AI tool contributions to kernel patches. However, checkpatch.pl did not recognize this tag, causing two issues: WARNING: Non-standard signature: Assisted-by: ERROR: Unrecognized email address: 'AGENT_NAME:MODEL_VERSION' Fix this by: 1. Adding Assisted-by to the recognized $signature_tags list 2. Skipping email validation for Assisted-by lines since they use the AGENT_NAME:MODEL_VERSION format instead of an email address 3. Warning when the Assisted-by value doesn't match the expected format Link: https://lkml.kernel.org/r/20260311215818.518930-1-sashal@kernel.org Signed-off-by: Sasha Levin Reported-by: Bart Van Assche Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Dwaipayan Ray Cc: Jonathan Corbet Cc: Lukas Bulwahn Signed-off-by: Andrew Morton commit ecfad171221447f3fe53f3d634765ef15d3e7232 Author: Masami Hiramatsu (Google) Date: Fri Mar 6 09:50:16 2026 +0900 decode_stacktrace: decode caller address Decode the caller address instead of the return address by default. This also introduced -R option to provide return address decoding mode. This changes the decode_stacktrace.sh to decode the line info 1byte before the return address which will be the call(branch) instruction address. If the return address is a symbol address (zero offset from it), it falls back to decoding the return address. This improves results especially when optimizations have changed the order of the lines around the return address, or when the return address does not have the actual line information. With this change; Call Trace: dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) lockdep_rcu_suspicious (kernel/locking/lockdep.c:6876) event_filter_pid_sched_process_fork (kernel/trace/trace_events.c:1057) kernel_clone (include/trace/events/sched.h:396 include/trace/events/sched.h:396 kernel/fork.c:2664) __x64_sys_clone (kernel/fork.c:2795 kernel/fork.c:2779 kernel/fork.c:2779) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) ? trace_irq_disable (include/trace/events/preemptirq.h:36) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Without this (or give -R option); Call Trace: dump_stack_lvl (lib/dump_stack.c:122) lockdep_rcu_suspicious (kernel/locking/lockdep.c:6877) event_filter_pid_sched_process_fork (kernel/trace/trace_events.c:?) kernel_clone (include/trace/events/sched.h:? include/trace/events/sched.h:396 kernel/fork.c:2664) __x64_sys_clone (kernel/fork.c:2779) do_syscall_64 (arch/x86/entry/syscall_64.c:?) ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) ? trace_irq_disable (include/trace/events/preemptirq.h:36) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [akpm@linux-foundation.org: fix spello] Link: https://lkml.kernel.org/r/177275821652.1557019.18367881408364381866.stgit@mhiramat.tok.corp.google.com Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Matthieu Baerts (NGI0) Tested-by: Luca Ceresoli [arm64] Cc: Carlos Llamas Cc: Sasha Levin (Microsoft) Signed-off-by: Andrew Morton commit 5a1292137e89c8c4b12076b17427eb00f788a4ed Author: Aleksei Oladko Date: Mon Mar 9 20:51:45 2026 +0000 selftests: fix ARCH normalization to handle command-line argument Several selftests Makefiles (e.g. prctl, breakpoints, etc) attempt to normalize the ARCH variable by converting x86_64 and i.86 to x86. However, it uses the conditional assignment operator '?='. When ARCH is passed as a command-line argument (e.g., during an rpmbuild process), the '?=' operator ignores the shell command and the sed transformation. This leads to an incorrect ARCH value being used, which causes build failures # make -C tools/testing/selftests TARGETS=prctl ARCH=x86_64 make: Entering directory '/build/tools/testing/selftests' make[1]: Entering directory '/build/tools/testing/selftests/prctl' make[1]: *** No targets. Stop. make[1]: Leaving directory '/build/tools/testing/selftests/prctl' make: *** [Makefile:197: all] Error 2 Change the assignment to use 'override' and ':=' to ensure the normalization logic is applied regardless of how the ARCH variable was initially defined. Link: https://lkml.kernel.org/r/20260309205145.572778-1-aleksey.oladko@virtuozzo.com Signed-off-by: Aleksei Oladko Cc: Shuah Khan Cc: Wei Yang Cc: Bala-Vignesh-Reddy Cc: Chelsy Ratnawat Signed-off-by: Andrew Morton commit 8cdf30813ea8ce881cecc08664144416dbdb3e16 Author: Josh Law Date: Sun Mar 8 20:20:28 2026 +0000 lib/ts_kmp: fix integer overflow in pattern length calculation The ts_kmp algorithm stores its prefix_tbl[] table and pattern in a single allocation sized from the pattern length. If the prefix_tbl[] size calculation wraps, the resulting allocation can be too small and subsequent pattern copies can overflow it. Fix this by rejecting zero-length patterns and by using overflow helpers before calculating the combined allocation size. This fixes a potential heap overflow. The pattern length calculation can wrap during a size_t addition, leading to an undersized allocation. Because the textsearch library is reachable from userspace via Netfilter's xt_string module, this is a security risk that should be backported to LTS kernels. Link: https://lkml.kernel.org/r/20260308202028.2889285-2-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Cc: Signed-off-by: Andrew Morton commit 9003ec6f7f394943880618737d797a9f257e6e1e Author: Josh Law Date: Sun Mar 8 20:20:27 2026 +0000 lib/ts_bm: fix integer overflow in pattern length calculation The ts_bm algorithm stores its good_shift[] table and pattern in a single allocation sized from the pattern length. If the good_shift[] size calculation wraps, the resulting allocation can be too small and subsequent pattern copies can overflow it. Fix this by rejecting zero-length patterns and by using overflow helpers before calculating the combined allocation size. This fixes a potential heap overflow. The pattern length calculation can wrap during a size_t addition, leading to an undersized allocation. Because the textsearch library is reachable from userspace via Netfilter's xt_string module, this is a security risk that should be backported to LTS kernels. Link: https://lkml.kernel.org/r/20260308202028.2889285-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Cc: Signed-off-by: Andrew Morton commit 7aa89307fcbff038a13c3891e2e94674adc59237 Author: Alexey Velichayshiy Date: Sun Mar 8 02:47:53 2026 +0300 ocfs2: remove redundant error code assignment Remove the error assignment for variable 'ret' during correct code execution. In subsequent execution, variable 'ret' is overwritten. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lkml.kernel.org/r/20260307234809.88421-1-a.velichayshiy@ispras.ru Signed-off-by: Alexey Velichayshiy Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 9b93f7e3277490f0356309c9b241eeeaa27ba859 Author: Thomas Weißschuh Date: Sat Mar 7 09:47:53 2026 +0100 tools/getdelays: use the static UAPI headers from tools/include/uapi The include directory ../../usr/include is only present if an in-tree kernel build with CONFIG_HEADERS_INSTALL was done before. Otherwise the system UAPI headers are used, which most likely are not the most recent ones. To make sure to always have access to up-to-date UAPI headers, use the static copy in tools/include/uapi. Link: https://lkml.kernel.org/r/20260307-accounting-taskstats-h-v1-2-0b75915c6ce5@weissschuh.net Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202603062103.Z5fecwZD-lkp@intel.com/ Signed-off-by: Thomas Weißschuh Cc: Arnd Bergmann Cc: Balbir Singh Cc: Jiang Kun Cc: Wang Yaxin Cc: xu xin Cc: Yang Yang Signed-off-by: Andrew Morton commit e5bbb35a07b3b9fe7b5e70b641344db68593215d Author: Thomas Weißschuh Date: Sat Mar 7 09:47:52 2026 +0100 tools headers UAPI: sync linux/taskstats.h Patch series "tools/getdelays: use the static UAPI headers from tools/include/uapi". The include directory ../../usr/include is only present if an in-tree kernel build with CONFIG_HEADERS_INSTALL was done before. Otherwise the system UAPI headers are used, which most likely are not the most recent ones. To make sure to always have access to up-to-date UAPI headers, use the static copy in tools/include/uapi. This patch (of 2): To give the accounting tools access to the new fields introduced in commit 503efe850c74 ("delayacct: add timestamp of delay max") Link: https://lkml.kernel.org/r/20260307-accounting-taskstats-h-v1-0-0b75915c6ce5@weissschuh.net Link: https://lkml.kernel.org/r/20260307-accounting-taskstats-h-v1-1-0b75915c6ce5@weissschuh.net Signed-off-by: Thomas Weißschuh Cc: Arnd Bergmann Cc: Balbir Singh Cc: Jiang Kun Cc: Wang Yaxin Cc: xu xin Cc: Yang Yang Cc: kernel test robot Signed-off-by: Andrew Morton commit d4dba3b9c03a326cfa73833d6b166aeb442f82b5 Author: Josh Law Date: Sun Mar 8 16:50:12 2026 +0000 lib: decompress_bunzip2: fix 32-bit shift undefined behavior Fix undefined behavior caused by shifting a 32-bit integer by 32 bits during decompression. This prevents potential kernel decompression failures or corruption when parsing malicious or malformed bzip2 archives. Link: https://lkml.kernel.org/r/20260308165012.2872633-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit b02da26a992db0c0e2559acbda0fc48d4a2fd337 Author: Joseph Qi Date: Fri Mar 6 11:22:11 2026 +0800 ocfs2: fix possible deadlock between unlink and dio_end_io_write ocfs2_unlink takes orphan dir inode_lock first and then ip_alloc_sem, while in ocfs2_dio_end_io_write, it acquires these locks in reverse order. This creates an ABBA lock ordering violation on lock classes ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] and ocfs2_file_ip_alloc_sem_key. Lock Chain #0 (orphan dir inode_lock -> ip_alloc_sem): ocfs2_unlink ocfs2_prepare_orphan_dir ocfs2_lookup_lock_orphan_dir inode_lock(orphan_dir_inode) <- lock A __ocfs2_prepare_orphan_dir ocfs2_prepare_dir_for_insert ocfs2_extend_dir ocfs2_expand_inline_dir down_write(&oi->ip_alloc_sem) <- Lock B Lock Chain #1 (ip_alloc_sem -> orphan dir inode_lock): ocfs2_dio_end_io_write down_write(&oi->ip_alloc_sem) <- Lock B ocfs2_del_inode_from_orphan() inode_lock(orphan_dir_inode) <- Lock A Deadlock Scenario: CPU0 (unlink) CPU1 (dio_end_io_write) ------ ------ inode_lock(orphan_dir_inode) down_write(ip_alloc_sem) down_write(ip_alloc_sem) inode_lock(orphan_dir_inode) Since ip_alloc_sem is to protect allocation changes, which is unrelated with operations in ocfs2_del_inode_from_orphan. So move ocfs2_del_inode_from_orphan out of ip_alloc_sem to fix the deadlock. Link: https://lkml.kernel.org/r/20260306032211.1016452-1-joseph.qi@linux.alibaba.com Reported-by: syzbot+67b90111784a3eac8c04@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=67b90111784a3eac8c04 Fixes: a86a72a4a4e0 ("ocfs2: take ip_alloc_sem in ocfs2_dio_get_block & ocfs2_dio_end_io_write") Signed-off-by: Joseph Qi Reviewed-by: Heming Zhao Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit 228491c380cf0d569634587d4042f9a2ebb9f93e Author: Josh Law Date: Fri Mar 6 16:24:18 2026 +0000 lib/bug: remove unnecessary variable initializations Remove the unnecessary initialization of 'rcu' to false in report_bug_entry() and report_bug(), as it is assigned by warn_rcu_enter() before its first use. Link: https://lkml.kernel.org/r/20260306162418.2815979-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit 6a2804112d98d351df664d9209aa459a2e2fa0d0 Author: Josh Law Date: Fri Mar 6 16:23:27 2026 +0000 lib/bug: fix inconsistent capitalization in BUG message Use lowercase "kernel BUG" consistently in pr_crit() messages. The verbose path already uses "kernel BUG at %s:%u!" but the non-verbose fallback uses "Kernel BUG" with an uppercase 'K'. Link: https://lkml.kernel.org/r/20260306162327.2815553-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit 5ab288ffab948a8201bdac5c5845abe4d36005f1 Author: Josh Law Date: Fri Mar 6 16:17:32 2026 +0000 lib/inflate: fix typo "This results" to "The results" in comment Fix "This results of this trade" to "The results of this trade" in the comment describing the lbits and dbits tuning parameters. Link: https://lkml.kernel.org/r/20260306161732.2812132-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit b2a7f5f88ae45e1b18793f58788059c8a61ecfb9 Author: Josh Law Date: Fri Mar 6 16:17:07 2026 +0000 lib/inflate: fix grammar in comment: "variable" to "variables" Fix "all variable" to "all variables" in the file header comment. Link: https://lkml.kernel.org/r/20260306161707.2812005-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit 84f24da3544abb7b6db102191bf7f98230a3af30 Author: Josh Law Date: Fri Mar 6 16:16:47 2026 +0000 lib/inflate: fix memory leak in inflate_dynamic() on inflate_codes() failure When inflate_codes() fails in inflate_dynamic(), the code jumps to the 'out' label which only frees 'll', leaking the Huffman tables 'tl' and 'td'. Restructure the code so that the decoding tables are always freed before reaching the 'out' label. Link: https://lkml.kernel.org/r/20260306161647.2811874-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit bc6cc36855e9ebcf0c7e01f980ad67bcb0e50bdb Author: Josh Law Date: Fri Mar 6 16:16:12 2026 +0000 lib/inflate: fix memory leak in inflate_fixed() on inflate_codes() failure When inflate_codes() fails in inflate_fixed(), only the length list 'l' is freed, but the Huffman tables 'tl' and 'td' are leaked. Add the missing huft_free() calls on the error path. Link: https://lkml.kernel.org/r/20260306161612.2811703-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit e54f7f67e9b361b3213b5b75e0cf7167c1105fc7 Author: Josh Law Date: Fri Mar 6 16:12:50 2026 +0000 lib/uuid: fix typo "reversion" to "revision" in comment Fix a typo in __uuid_gen_common() where "reversion" (meaning to revert) was used instead of "revision" when describing the UUID variant field. Link: https://lkml.kernel.org/r/20260306161250.2811500-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andy Shevchenko Signed-off-by: Andrew Morton commit 8e4513303b8726e4434f718ab39749cbb4c142b1 Author: Benjamin Berg Date: Wed Mar 4 12:06:43 2026 +0100 scripts/gdb/symbols: handle module path parameters commit 581ee79a2547 ("scripts/gdb/symbols: make BPF debug info available to GDB") added support to make BPF debug information available to GDB. However, the argument handling loop was slightly broken, causing it to fail if further modules were passed. Fix it to append these passed modules to the instance variable after expansion. Link: https://lkml.kernel.org/r/20260304110642.2020614-2-benjamin@sipsolutions.net Fixes: 581ee79a2547 ("scripts/gdb/symbols: make BPF debug info available to GDB") Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Cc: Ilya Leoshkevich Cc: Jan Kiszka Cc: Kieran Bingham Cc: Signed-off-by: Andrew Morton commit 73d40c42f6aa1702f685261911429bf5265f78d5 Author: Aaron Tomlin Date: Tue Mar 3 17:13:24 2026 -0500 hung_task: explicitly report I/O wait state in log output Currently, the hung task reporting mechanism indiscriminately labels all TASK_UNINTERRUPTIBLE (D) tasks as "blocked", irrespective of whether they are awaiting I/O completion or kernel locking primitives. This ambiguity compels system administrators to manually inspect stack traces to discern whether the delay stems from an I/O wait (typically indicative of hardware or filesystem anomalies) or software contention. Such detailed analysis is not always immediately accessible to system administrators or support engineers. To address this, this patch utilises the existing in_iowait field within struct task_struct to augment the failure report. If the task is blocked due to I/O (e.g., via io_schedule_prepare()), the log message is updated to explicitly state "blocked in I/O wait". Examples: - Standard Block: "INFO: task bash:123 blocked for more than 120 seconds". - I/O Block: "INFO: task dd:456 blocked in I/O wait for more than 120 seconds". Theoretically, concurrent executions of io_schedule_finish() could result in a race condition where the read flag does not precisely correlate with the subsequently printed backtrace. However, this limitation is deemed acceptable in practice. The entire reporting mechanism is inherently racy by design; nevertheless, it remains highly reliable in the vast majority of cases, particularly because it primarily captures protracted stalls. Consequently, introducing additional synchronisation to mitigate this minor inaccuracy would be entirely disproportionate to the situation. Link: https://lkml.kernel.org/r/20260303221324.4106917-1-atomlin@atomlin.com Signed-off-by: Aaron Tomlin Acked-by: Masami Hiramatsu (Google) Reviewed-by: Petr Mladek Cc: Greg Kroah-Hartman Cc: Lance Yang Signed-off-by: Andrew Morton commit 5eaef7f8ee40150cbd78a7b445001929bb2d2031 Author: Petr Mladek Date: Tue Mar 3 15:30:31 2026 -0500 hung_task: increment the global counter immediately A recent change allowed to reset the global counter of hung tasks using the sysctl interface. A potential race with the regular check has been solved by updating the global counter only once at the end of the check. However, the hung task check can take a significant amount of time, particularly when task information is being dumped to slow serial consoles. Some users monitor this global counter to trigger immediate migration of critical containers. Delaying the increment until the full check completes postpones these high-priority rescue operations. Update the global counter as soon as a hung task is detected. Since the value is read asynchronously, a relaxed atomic operation is sufficient. Link: https://lkml.kernel.org/r/20260303203031.4097316-4-atomlin@atomlin.com Signed-off-by: Petr Mladek Signed-off-by: Aaron Tomlin Reported-by: Lance Yang Closes: https://lore.kernel.org/r/f239e00f-4282-408d-b172-0f9885f4b01b@linux.dev Reviewed-by: Aaron Tomlin Reviewed-by: Lance Yang Cc: Greg Kroah-Hartman Cc: Joel Granados Cc: Masami Hiramatsu (Google) Signed-off-by: Andrew Morton commit 49085e1b70f898695b63594ff559f5a243589b83 Author: Aaron Tomlin Date: Tue Mar 3 15:30:30 2026 -0500 hung_task: enable runtime reset of hung_task_detect_count Currently, the hung_task_detect_count sysctl provides a cumulative count of hung tasks since boot. In long-running, high-availability environments, this counter may lose its utility if it cannot be reset once an incident has been resolved. Furthermore, the previous implementation relied upon implicit ordering, which could not strictly guarantee that diagnostic metadata published by one CPU was visible to the panic logic on another. This patch introduces the capability to reset the detection count by writing "0" to the hung_task_detect_count sysctl. The proc_handler logic has been updated to validate this input and atomically reset the counter. The synchronisation of sysctl_hung_task_detect_count relies upon a transactional model to ensure the integrity of the detection counter against concurrent resets from userspace. The application of atomic_long_read_acquire() and atomic_long_cmpxchg_release() is correct and provides the following guarantees: 1. Prevention of Load-Store Reordering via Acquire Semantics By utilising atomic_long_read_acquire() to snapshot the counter before initiating the task traversal, we establish a strict memory barrier. This prevents the compiler or hardware from reordering the initial load to a point later in the scan. Without this "acquire" barrier, a delayed load could potentially read a "0" value resulting from a userspace reset that occurred mid-scan. This would lead to the subsequent cmpxchg succeeding erroneously, thereby overwriting the user's reset with stale increment data. 2. Atomicity of the "Commit" Phase via Release Semantics The atomic_long_cmpxchg_release() serves as the transaction's commit point. The "release" barrier ensures that all diagnostic recordings and task-state observations made during the scan are globally visible before the counter is incremented. 3. Race Condition Resolution This pairing effectively detects any "out-of-band" reset of the counter. If sysctl_hung_task_detect_count is modified via the procfs interface during the scan, the final cmpxchg will detect the discrepancy between the current value and the "acquire" snapshot. Consequently, the update will fail, ensuring that a reset command from the administrator is prioritised over a scan that may have been invalidated by that very reset. Link: https://lkml.kernel.org/r/20260303203031.4097316-3-atomlin@atomlin.com Signed-off-by: Aaron Tomlin Reviewed-by: Masami Hiramatsu (Google) Reviewed-by: Joel Granados Reviewed-by: Petr Mladek Cc: Greg Kroah-Hartman Cc: Lance Yang Signed-off-by: Andrew Morton commit 00b5cdeb9fe761654d5a76a411c79b8ff04a81e5 Author: Aaron Tomlin Date: Tue Mar 3 15:30:29 2026 -0500 hung_task: refactor detection logic and atomicise detection count Patch series "hung_task: Provide runtime reset interface for hung task detector", v9. This series introduces the ability to reset /proc/sys/kernel/hung_task_detect_count. Writing a "0" value to this file atomically resets the counter of detected hung tasks. This functionality provides system administrators with the means to clear the cumulative diagnostic history following incident resolution, thereby simplifying subsequent monitoring without necessitating a system restart. This patch (of 3): The check_hung_task() function currently conflates two distinct responsibilities: validating whether a task is hung and handling the subsequent reporting (printing warnings, triggering panics, or tracepoints). This patch refactors the logic by introducing hung_task_info(), a function dedicated solely to reporting. The actual detection check, task_is_hung(), is hoisted into the primary loop within check_hung_uninterruptible_tasks(). This separation clearly decouples the mechanism of detection from the policy of reporting. Furthermore, to facilitate future support for concurrent hung task detection, the global sysctl_hung_task_detect_count variable is converted from unsigned long to atomic_long_t. Consequently, the counting logic is updated to accumulate the number of hung tasks locally (this_round_count) during the iteration. The global counter is then updated atomically via atomic_long_cmpxchg_relaxed() once the loop concludes, rather than incrementally during the scan. These changes are strictly preparatory and introduce no functional change to the system's runtime behaviour. Link: https://lkml.kernel.org/r/20260303203031.4097316-1-atomlin@atomlin.com Link: https://lkml.kernel.org/r/20260303203031.4097316-2-atomlin@atomlin.com Signed-off-by: Aaron Tomlin Reviewed-by: Masami Hiramatsu (Google) Reviewed-by: Petr Mladek Cc: Greg Kroah-Hartman Cc: Lance Yang Cc: Masami Hiramatsu Cc: Joel Granados Signed-off-by: Andrew Morton commit c8f42847514afa4dfa7f9c953e62386fddd32b8d Author: Guru Das Srinagesh Date: Sun Mar 1 18:44:20 2026 -0800 mailmap: update Guru Das Srinagesh's email address Add my current email address and map previous addresses to it. Link: https://lkml.kernel.org/r/20260301-gds-mailmap-update-2-v1-1-5691415be73c@gurudas.dev Signed-off-by: Guru Das Srinagesh Signed-off-by: Andrew Morton commit 118d86a32422c30861f75835ebb926289fc71941 Author: Andy Shevchenko Date: Mon Mar 2 10:28:09 2026 +0100 lib: math: polynomial: remove link to non-exist file and fix spelling The Baikal SoC and platform support was dropped from the kernel, remove the reference to non-exist file. While at it, fix spelling. Link: https://lkml.kernel.org/r/20260302092831.2267785-4-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Randy Dunlap Reviewed-by: Kuan-Wei Chiu Signed-off-by: Andrew Morton commit 512e19a82bee561b8adf11fc37413d24b01382c8 Author: Andy Shevchenko Date: Mon Mar 2 10:28:08 2026 +0100 lib: math: polynomial: don't use 'proxy' headers Update header inclusions to follow IWYU (Include What You Use) principle. Link: https://lkml.kernel.org/r/20260302092831.2267785-3-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Kuan-Wei Chiu Cc: Randy Dunlap Signed-off-by: Andrew Morton commit 7eece6917c541af24a6161b10a150b5744695f80 Author: Andy Shevchenko Date: Mon Mar 2 10:28:07 2026 +0100 lib: polynomial: move to math/ subfolder Patch series "lib: polynomial: Move to math/ and clean up", v2. While removing Baikal SoC and platform code pieces I found that this code belongs to lib/math/ rather than generic lib/. Hence the move and followed up cleanups. This patch (of 3): The algorithm behind polynomial belongs to our collection of math equations and expressions handling. Move it to math/ subfolder where others of the kind are located. Link: https://lkml.kernel.org/r/20260302092831.2267785-2-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Kuan-Wei Chiu Cc: Randy Dunlap Signed-off-by: Andrew Morton commit 19aa667ace53c7398b08d01def44f96f03708bda Author: Heming Zhao Date: Mon Mar 2 14:17:05 2026 +0800 ocfs2: fix deadlock when creating quota file syzbot detected a circular locking dependency. the scenarios: CPU0 CPU1 ---- ---- lock(&ocfs2_quota_ip_alloc_sem_key); lock(&ocfs2_sysfile_lock_key[USER_QUOTA_SYSTEM_INODE]); lock(&ocfs2_quota_ip_alloc_sem_key); lock(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]); or: CPU0 CPU1 ---- ---- lock(&ocfs2_quota_ip_alloc_sem_key); lock(&dquot->dq_lock); lock(&ocfs2_quota_ip_alloc_sem_key); lock(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]); Following are the code paths for above scenarios: path_openat ocfs2_create ocfs2_mknod + ocfs2_reserve_new_inode | ocfs2_reserve_suballoc_bits | inode_lock(alloc_inode) //C0: hold INODE_ALLOC_SYSTEM_INODE | //ocfs2_free_alloc_context(inode_ac) is called at the end of | //caller ocfs2_mknod to handle the release | + ocfs2_get_init_inode __dquot_initialize dqget ocfs2_acquire_dquot + ocfs2_lock_global_qf | down_write(&OCFS2_I(oinfo->dqi_gqinode)->ip_alloc_sem)//A2:grabbing + ocfs2_create_local_dquot down_write(&OCFS2_I(lqinode)->ip_alloc_sem)//A3:grabbing evict ocfs2_evict_inode ocfs2_delete_inode ocfs2_wipe_inode + inode_lock(orphan_dir_inode) //B0:hold + ... + ocfs2_remove_inode inode_lock(inode_alloc_inode) //INODE_ALLOC_SYSTEM_INODE down_write(&inode->i_rwsem) //C1:grabbing generic_file_direct_write ocfs2_direct_IO __blockdev_direct_IO dio_complete ocfs2_dio_end_io ocfs2_dio_end_io_write + down_write(&oi->ip_alloc_sem) //A0:hold + ocfs2_del_inode_from_orphan inode_lock(orphan_dir_inode) //B1:grabbing Root cause for the circular locking: DIO completion path: holds oi->ip_alloc_sem and is trying to acquire the orphan_dir_inode lock. evict path: holds the orphan_dir_inode lock and is trying to acquire the inode_alloc_inode lock. ocfs2_mknod path: Holds the inode_alloc_inode lock (to allocate a new quota file) and is blocked waiting for oi->ip_alloc_sem in ocfs2_acquire_dquot(). How to fix: Replace down_write() with down_write_trylock() in ocfs2_acquire_dquot(). If acquiring oi->ip_alloc_sem fails, return -EBUSY to abort the file creation routine and break the deadlock. Link: https://lkml.kernel.org/r/20260302061707.7092-1-heming.zhao@suse.com Signed-off-by: Heming Zhao Reported-by: syzbot+78359d5fbb04318c35e9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=78359d5fbb04318c35e9 Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 420849332f9f9f1ce6ff142868ae2e6ae9f98f65 Author: Matteo Croce Date: Mon Mar 2 11:38:22 2026 +0100 get_maintainer: add ** glob pattern support Add support for the ** glob operator in MAINTAINERS F: and X: patterns, matching any number of path components (like Python's ** glob). The existing * to .* conversion with slash-count check is preserved. ** is converted to (?:.*), a non-capturing group used as a marker to bypass the slash-count check in file_match_pattern(), allowing the pattern to cross directory boundaries. This enables patterns like F: **/*[_-]kunit*.c to match files at any depth in the tree. Link: https://lkml.kernel.org/r/20260302103822.77343-1-teknoraver@meta.com Signed-off-by: Matteo Croce Acked-by: Joe Perches Signed-off-by: Andrew Morton commit defec2ca7cd743c9b8a29be5012ad7381a5ecbb3 Author: Thorsten Blum Date: Sun Mar 1 13:51:07 2026 +0100 crash_dump: use sysfs_emit in sysfs show functions Replace sprintf() with sysfs_emit() in sysfs show functions. sysfs_emit() is preferred for formatting sysfs output because it provides safer bounds checking. No functional changes. Link: https://lkml.kernel.org/r/20260301125106.911980-2-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Acked-by: Baoquan He Cc: Dave Young Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 90c73d0bfa36ea80f3a55f5426daa46fa2795957 Author: Josh Law Date: Sun Mar 1 20:38:45 2026 +0000 lib/glob: clean up "bool abuse" in pointer arithmetic Replace the implicit 'bool' to 'int' conversion with an explicit ternary operator. This makes the pointer arithmetic clearer and avoids relying on boolean memory representation for logic flow. Link: https://lkml.kernel.org/r/20260301203845.2617217-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit 33a3dd9bfd410044225aa9f812102055d0e21d59 Author: Josh Law Date: Sun Mar 1 15:21:42 2026 +0000 lib: glob: replace bitwise OR with logical operation on boolean Using bitwise OR (|=) on a boolean variable is valid C, but replacing it with a direct logical assignment makes the intent clearer and appeases strict static analysis tools. Link: https://lkml.kernel.org/r/20260301152143.2572137-2-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit f5e74cbdbea32e3bf0bcd8d32e7ac8c90518e359 Author: Josh Law Date: Sun Mar 1 15:21:41 2026 +0000 lib: glob: add explicit include for export.h Include explicitly instead of relying on it being implicitly included by for the EXPORT_SYMBOL macro. Link: https://lkml.kernel.org/r/20260301152143.2572137-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit 3a1c3be1789580a8d15e810f8fb1958c7185680c Author: Josh Law Date: Sun Mar 1 15:45:53 2026 +0000 lib: glob: fix grammar and replace non-inclusive terminology Fix a missing article ('a') in the comment describing the glob implementation, and replace 'blacklists' with 'denylists' to align with the kernel's inclusive terminology guidelines. Link: https://lkml.kernel.org/r/20260301154553.2592681-1-objecting@objecting.org Signed-off-by: Josh Law Signed-off-by: Andrew Morton commit 80266c154f7fa4a900136e17e3b813c7a1a78304 Author: Mark Brown Date: Thu Feb 26 22:24:43 2026 +0000 selftests/fchmodat2: use ksft_finished() The fchmodat2 test program open codes a version of ksft_finished(), use the standard version. Link: https://lkml.kernel.org/r/20260226-selftests-fchmodat2-v4-2-a6419435f2e8@kernel.org Signed-off-by: Mark Brown Acked-by: Alexey Gladkov Cc: Christian Brauner Signed-off-by: Andrew Morton commit 04e23830b8f312324f148ccd8289d9cc78992cc1 Author: Mark Brown Date: Thu Feb 26 22:24:42 2026 +0000 selftests/fchmodat2: clean up temporary files and directories Patch series "selftests/fchmodat2: Error handling and general", v4. I looked at the fchmodat2() tests since I've been experiencing some random intermittent segfaults with them in my test systems, while doing so I noticed these two issues. Unfortunately I didn't figure out the original yet, unless I managed to fix it unwittingly. This patch (of 2): The fchmodat2() test program creates a temporary directory with a file and a symlink for every test it runs but never cleans these up, resulting in ${TMPDIR} getting left with stale files after every run. Restructure the program a bit to ensure that we clean these up, this is more invasive than it might otherwise be due to the extensive use of ksft_exit_fail_msg() in the program. As a side effect this also ensures that we report a consistent test name for the tests and always try both tests even if they are skipped. Link: https://lkml.kernel.org/r/20260226-selftests-fchmodat2-v4-0-a6419435f2e8@kernel.org Link: https://lkml.kernel.org/r/20260226-selftests-fchmodat2-v4-1-a6419435f2e8@kernel.org Signed-off-by: Mark Brown Acked-by: Alexey Gladkov Cc: Christian Brauner Signed-off-by: Andrew Morton commit ac2428c141c06528703b9f7ca182cf4b35d9d22e Author: Josh Law Date: Sat Feb 28 19:53:00 2026 +0000 lib: glob: add missing SPDX-License-Identifier Add the missing dual MIT/GPL license identifier to glob.c. Link: https://lkml.kernel.org/r/20260228195300.2468310-1-objecting@objecting.org Signed-off-by: Josh Law Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit 8fba1920ac9fa571dff9aba7157bb7c327719b54 Author: Oleg Nesterov Date: Fri Feb 27 13:04:20 2026 +0100 pid: document the PIDNS_ADDING checks in alloc_pid() and copy_process() Both copy_process() and alloc_pid() do the same PIDNS_ADDING check. The reasons for these checks, and the fact that both are necessary, are not immediately obvious. Add the comments. Link: https://lkml.kernel.org/r/aaGIRElc78U4Er42@redhat.com Signed-off-by: Oleg Nesterov Cc: Adrian Reber Cc: Aleksa Sarai Cc: Alexander Mikhalitsyn Cc: Andrei Vagin Cc: Christian Brauner Cc: David Hildenbrand Cc: Ingo Molnar Cc: Jan Kara Cc: Juri Lelli Cc: Kees Cook Cc: Kirill Tkhai Cc: Pavel Tikhomirov Cc: Peter Zijlstra Cc: Shuah Khan Cc: Vincent Guittot Signed-off-by: Andrew Morton commit 040261b118420c523600f7e0421f76143943f948 Author: Oleg Nesterov Date: Fri Feb 27 13:03:41 2026 +0100 pid: make sub-init creation retryable Patch series "pid: make sub-init creation retryable". This patch (of 2): Currently we allow only one attempt to create init in a new namespace. If the first fork() fails after alloc_pid() succeeds, free_pid() clears PIDNS_ADDING and thus disables further PID allocations. Nowadays this looks like an unnecessary limitation. The original reason to handle "case PIDNS_ADDING" in free_pid() is gone, most probably after commit 69879c01a0c3 ("proc: Remove the now unnecessary internal mount of proc"). Change free_pid() to keep ns->pid_allocated == PIDNS_ADDING, and change alloc_pid() to reset the cursor early, right after taking pidmap_lock. Test-case: #define _GNU_SOURCE #include #include #include #include #include #include int main(void) { struct clone_args args = { .exit_signal = SIGCHLD, .flags = CLONE_PIDFD, .pidfd = 0, }; unsigned long pidfd; int pid; assert(unshare(CLONE_NEWPID) == 0); pid = syscall(__NR_clone3, &args, sizeof(args)); assert(pid == -1 && errno == EFAULT); args.pidfd = (unsigned long)&pidfd; pid = syscall(__NR_clone3, &args, sizeof(args)); if (pid) assert(pid > 0 && wait(NULL) == pid); else assert(getpid() == 1); return 0; } Link: https://lkml.kernel.org/r/aaGHu3ixbw9Y7kFj@redhat.com Link: https://lkml.kernel.org/r/aaGIHa7vGdwhEc_D@redhat.com Signed-off-by: Oleg Nesterov Acked-by: Andrei Vagin Cc: Adrian Reber Cc: Aleksa Sarai Cc: Alexander Mikhalitsyn Cc: Christian Brauner Cc: David Hildenbrand Cc: Ingo Molnar Cc: Jan Kara Cc: Juri Lelli Cc: Kees Cook Cc: Kirill Tkhai Cc: Pavel Tikhomirov Cc: Peter Zijlstra Cc: Shuah Khan Cc: Vincent Guittot Signed-off-by: Andrew Morton commit 26430489b10107f0e45333dcf115ec631bd57b08 Author: Thorsten Blum Date: Sat Feb 28 00:04:21 2026 +0100 crash_dump: fix typo in function name read_key_from_user_keying The function read_key_from_user_keying() is missing an 'r' in its name. Fix the typo by renaming it to read_key_from_user_keyring(). Link: https://lkml.kernel.org/r/20260227230422.859423-1-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Andrew Morton Acked-by: Baoquan He Cc: Dave Young Cc: Vivek Goyal Signed-off-by: Andrew Morton commit c02474fe1a62bb20548abd37b1d492a43a8b906e Author: Thorsten Blum Date: Sat Feb 28 09:51:36 2026 +0100 crash_dump: remove redundant less-than-zero check 'key_count' is an 'unsigned int' and cannot be less than zero. Remove the redundant condition. Link: https://lkml.kernel.org/r/20260228085136.861971-2-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Cc: Baoquan He Cc: Dave Young Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 380369ea2e9d3c41855b0d8c41898dcd564209fd Author: Thorsten Blum Date: Mon Dec 15 15:21:52 2025 +0100 fork: replace simple_strtoul with kstrtoul in coredump_filter_setup Replace simple_strtoul() with the recommended kstrtoul() for parsing the 'coredump_filter=' boot parameter. Check the return value of kstrtoul() and reject invalid values. This adds error handling while preserving behavior for existing values, and removes use of the deprecated simple_strtoul() helper. The current code silently sets 'default_dump_filter = 0' if parsing fails, instead of leaving the default value (MMF_DUMP_FILTER_DEFAULT) unchanged. Rename the static variable 'default_dump_filter' to 'coredump_filter' since it does not necessarily contain the default value and the current name can be misleading. Link: https://lkml.kernel.org/r/20251215142152.4082-2-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Andrew Morton Cc: Ben Segall Cc: David Hildenbrand Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 162e4fd97dc6c4f56c7e94b82651e95a57674091 Author: Oleg Nesterov Date: Sun Feb 22 16:24:00 2026 +0100 complete_signal: kill always-true "core_state || !SIGNAL_GROUP_EXIT" check The "(signal->core_state || !(signal->flags & SIGNAL_GROUP_EXIT))" check in complete_signal() is not obvious at all, and in fact it only adds unnecessary confusion: this condition is always true. prepare_signal() does: if (signal->flags & SIGNAL_GROUP_EXIT) { if (signal->core_state) return sig == SIGKILL; /* * The process is in the middle of dying, drop the signal. */ return false; } This means that "!signal->core_state && (signal->flags & SIGNAL_GROUP_EXIT)" in complete_signal() is never possible. If SIGNAL_GROUP_EXIT is set, prepare_signal() can only return true if signal->core_state is not NULL. Link: https://lkml.kernel.org/r/aZsfkDhnqJ4s1oTs@redhat.com Signed-off-by: Oleg Nesterov Cc: Christian Brauner Cc: Kees Cook Cc: Mateusz Guzik Cc; Deepanshu Kartikey Signed-off-by: Andrew Morton commit 617ab884b893032765fbc0ebf656fa3015016648 Author: Oleg Nesterov Date: Sun Feb 22 16:23:37 2026 +0100 exit: kill unnecessary thread_group_leader() checks in exit_notify() and do_notify_parent() thread_group_empty(tsk) is only possible if tsk is a group leader, and thread_group_empty() already does the thread_group_leader() check. So it makes no sense to check "thread_group_leader() && thread_group_empty()"; thread_group_empty() alone is enough. Link: https://lkml.kernel.org/r/aZsfeegKZPZZszJh@redhat.com Signed-off-by: Oleg Nesterov Cc: Christian Brauner Cc: Mateusz Guzik Cc: Kees Cook Cc; Deepanshu Kartikey Signed-off-by: Andrew Morton commit 225ba47fb9ec17440781563ea729f3fe67f1b5b8 Author: UYeol Jo Date: Tue Feb 10 22:53:59 2026 +0900 selftests/ipc: skip msgque test when MSG_COPY is unsupported msgque kselftest uses msgrcv(..., MSG_COPY) to copy messages. When the kernel is built without CONFIG_CHECKPOINT_RESTORE, prepare_copy() is stubbed out and msgrcv() returns -ENOSYS. The test currently reports this as a failure even though it is simply a missing feature/configuration. Skip the test when msgrcv() fails with ENOSYS. Link: https://lkml.kernel.org/r/20260210135359.178636-1-jouyeol8739@gmail.com Signed-off-by: UYeol Jo Cc: Shuah Khan Cc: Wei Yang Signed-off-by: Andrew Morton commit 513d08ace4e51d320ecc19e0a50b1192b217269b Author: Petr Vorel Date: Thu Feb 12 15:40:05 2026 +0100 scripts/spelling.txt: add "exaclty" typo Link: https://lkml.kernel.org/r/20260212144005.45052-2-pvorel@suse.cz Signed-off-by: Petr Vorel Cc: Jonathan Camerom Cc: WangYuli Signed-off-by: Andrew Morton commit a75ae1d5bd15abca737d936926e9dd4b5dc126c1 Author: Petr Vorel Date: Thu Feb 12 15:40:04 2026 +0100 scripts/spelling.txt: sort alphabetically Easier to add new entries. It was sorted when added in 66b47b4a9dad0, but later got wrong order for few entries. Sorted with en_US.UTF-8 locale. Link: https://lkml.kernel.org/r/20260212144005.45052-1-pvorel@suse.cz Signed-off-by: Petr Vorel Cc: Jonathan Camerom Cc: WangYuli Signed-off-by: Andrew Morton commit 48d76a8282c9d99ec123d5f09cf6e485e5cb8734 Author: Rio Date: Mon Feb 23 09:29:14 2026 +0530 kernel/panic: mark init_taint_buf as __initdata and panic instead of warning in alloc_taint_buf() However there's a convention of assuming that __init-time allocations cannot fail. Because if a kmalloc() were to fail at this time, the kernel is hopelessly messed up anyway. So simply panic() if that kmalloc failed, then make that 350-byte buffer __initdata. Link: https://lkml.kernel.org/r/20260223035914.4033-1-rioo.tsukatsukii@gmail.com Signed-off-by: Rio Cc: Joel Granados Cc: Petr Mladek Cc: Wang Jinchao Signed-off-by: Andrew Morton commit a9dff0d0d11ce9aeebdd52ecf1469895e336c87e Author: Rio Date: Sun Feb 22 19:38:04 2026 +0530 kernel/panic: allocate taint string buffer dynamically The buffer used to hold the taint string is statically allocated, which requires updating whenever a new taint flag is added. Instead, allocate the exact required length at boot once the allocator is available in an init function. The allocation sums the string lengths in taint_flags[], along with space for separators and formatting. print_tainted() is switched to use this dynamically allocated buffer. If allocation fails, print_tainted() warns about the failure and continues to use the original static buffer as a fallback. Link: https://lkml.kernel.org/r/20260222140804.22225-1-rioo.tsukatsukii@gmail.com Signed-off-by: Rio Cc: Joel Granados Cc: Petr Mladek Cc: Wang Jinchao Signed-off-by: Andrew Morton commit a75d207916de0909e2244bc66a44d72fadbcf383 Author: Rio Date: Fri Feb 20 20:45:00 2026 +0530 kernel/panic: increase buffer size for verbose taint logging The verbose 'Tainted: ...' string in print_tainted_seq can total to 327 characters while the buffer defined in _print_tainted is 320 bytes. Increase its size to 350 characters to hold all flags, along with some headroom. [akpm@linux-foundation.org: fix spello, add comment] Link: https://lkml.kernel.org/r/20260220151500.13585-1-rioo.tsukatsukii@gmail.com Signed-off-by: Rio Cc: Joel Granados Cc: Petr Mladek Cc: Wang Jinchao Signed-off-by: Andrew Morton commit 3f80aa1a2a44298c59e8e2ab9b10d9971cfd8c48 Author: Valtteri Koskivuori Date: Thu Feb 12 23:39:33 2026 +0200 scripts/bloat-o-meter: rename file arguments to match output The output of bloat-o-meter already uses the words 'old' and 'new' for symbol size in the table header, so reflect that in the corresponding argument names. Link: https://lkml.kernel.org/r/20260212213941.3984330-1-vkoskiv@gmail.com Signed-off-by: Valtteri Koskivuori Signed-off-by: Andrew Morton commit a98621a0f187a934c115dcfe79a49520ae892111 Author: Michal Grzedzicki Date: Fri Feb 13 11:39:59 2026 -0800 unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure When set_cred_ucounts() fails in ksys_unshare() new_nsproxy is leaked. Let's call put_nsproxy() if that happens. Link: https://lkml.kernel.org/r/20260213193959.2556730-1-mge@meta.com Fixes: 905ae01c4ae2 ("Add a reference to ucounts for each cred") Signed-off-by: Michal Grzedzicki Reviewed-by: Andrew Morton Cc: Alexey Gladkov (Intel) Cc: Ben Segall Cc: David Hildenbrand Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit c970a863ac17386fe56d493cb56cbd0944f1351b Author: Günther Noack Date: Sat Feb 14 15:08:54 2026 +0100 scripts/spelling.txt: add "binded||bound" The correct passive of "to bind" is "bound", not "binded". This is often used in the context of the BSD socket bind(2) operation. Link: https://lkml.kernel.org/r/20260214140854.42247-1-gnoack3000@gmail.com Signed-off-by: Günther Noack Signed-off-by: Andrew Morton commit 38d581ba76545b4712ecdb63f2b2612d5b7601c9 Author: Jaime Saguillo Revilla Date: Sun Feb 15 12:45:11 2026 +0000 proc: array: drop stale FIXME about RCU in task_sig() task_sig() already wraps the SigQ rlimit read in an explicit RCU read-side critical section. Drop the stale FIXME comment and keep using task_ucounts() for the ucounts access. No functional change. Link: https://lkml.kernel.org/r/20260215124511.14227-1-jaime.saguillo@gmail.com Signed-off-by: Jaime Saguillo Revilla Acked-by: Oleg Nesterov Cc: Christian Brauner Signed-off-by: Andrew Morton commit ced629dc8e5c51ff2b5d847adeeb1035cd655d58 Merge: 77a347f82a8043 075196489a3797 Author: Jakub Kicinski Date: Fri Mar 27 21:07:26 2026 -0700 Merge branch 'vrf-a-few-cleanups' Ido Schimmel says: ==================== vrf: A few cleanups Perform a few cleanups in the VRF driver. Noticed these while reviewing a recent patch [1]. See individual patches for more details. [1] https://lore.kernel.org/netdev/20260310105331.2371-1-lirongqing@baidu.com/ ==================== Link: https://patch.msgid.link/20260326203233.1128554-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 075196489a3797c2a931de68c438e06f8303dd5c Author: Ido Schimmel Date: Thu Mar 26 22:32:33 2026 +0200 vrf: Remove unnecessary RCU protection around dst entries During initialization of a VRF device, the VRF driver creates two dst entries (for IPv4 and IPv6). They are attached to locally generated packets that are transmitted out of the VRF ports (via the l3mdev_l3_out() hook). Their purpose is to redirect packets towards the VRF device instead of having the packets egress directly out of the VRF ports. This is useful, for example, when a queuing discipline is configured on the VRF device. In order to avoid a NULL pointer dereference, commit b0e95ccdd775 ("net: vrf: protect changes to private data with rcu") made the pointers to the dst entries RCU protected. As far as I can tell, this was needed because back then the dst entries were released (and the pointers reset to NULL) before removing the VRF ports. Later on, commit f630c38ef0d7 ("vrf: fix bug_on triggered by rx when destroying a vrf") moved the removal of the VRF ports to the VRF device's dellink() callback. As such, the tear down sequence of a VRF device looks as follows: 1. VRF ports are removed. 2. VRF device is unregistered. a. Device is closed. b. An RCU grace period passes. c. ndo_uninit() is called. i. dst entries are released. Given the above, the Tx path will always see the same fully initialized dst entries and will never race with the ndo_uninit() callback. Therefore, there is no need to make the pointers to the dst entries RCU protected. Remove it as well as the unnecessary NULL checks in the Tx path. Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20260326203233.1128554-4-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 50504e2579c1e0379bc0ffeaec67884e1d6c9212 Author: Ido Schimmel Date: Thu Mar 26 22:32:32 2026 +0200 vrf: Use dst_dev_put() instead of using loopback device Use dst_dev_put() to clean up the device referenced by the dst entry instead of partially open coding it. Internally, the helper uses the blackhole device instead of the loopback device. Reviewed-by: Petr Machata Reviewed-by: David Ahern Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20260326203233.1128554-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit ae3cdfd4e0b86e5d23b46b80e8b010f5392c9635 Author: Ido Schimmel Date: Thu Mar 26 22:32:31 2026 +0200 vrf: Remove unnecessary NULL check The VRF driver always allocates an IPv4 dst entry for a VRF device and prevents the device from being registered if the allocation fails. Therefore, there is no need to check if the entry exists when tearing down a VRF device. Remove the check. Note that the same is not true for the IPv6 dst entry. Its creation can be skipped if IPv6 is administratively disabled (i.e., 'ipv6.disable=1'). Reviewed-by: Petr Machata Reviewed-by: David Ahern Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20260326203233.1128554-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 77a347f82a8043c2ee77edf50cb585fb7b604325 Merge: fb4b4a05aeeb8b 394863097e3603 Author: Jakub Kicinski Date: Fri Mar 27 20:57:40 2026 -0700 Merge branch 'net-stmmac-disable-eee-on-i-mx' Laurent Pinchart says: ==================== net: stmmac: Disable EEE on i.MX This small patch series fixes a long-standing interrupt storm issue with stmmac on NXP i.MX platforms. The initial attempt to fix^Wwork around the problem in DT ([1]) was painfully but rightfully rejected by Russell, who helped me investigate the issue in depth. It turned out that the root cause is a mistake in how interrupts are wired in the SoC, a hardware bug that has been replicated in all i.MX SoCs that integrate an stmmac. The only viable solution is to disable EEE on those devices. Individual patches explain the issue in more details. Patch 1/2, authored by Russell, adds a new STMMAC_FLAG to disable EEE, and patch 2/2 sets the flag for i.MX platforms. [1] https://lore.kernel.org/r/20251026122905.29028-1-laurent.pinchart@ideasonboard.com ==================== Link: https://patch.msgid.link/20260325210003.2752013-1-laurent.pinchart@ideasonboard.com Signed-off-by: Jakub Kicinski commit 394863097e3603eafe819ab4085cbd0ddf371dd9 Author: Laurent Pinchart Date: Wed Mar 25 23:00:03 2026 +0200 net: stmmac: imx: Disable EEE The i.MX8MP suffers from an interrupt storm related to the stmmac and EEE. A long and tedious analysis ([1]) concluded that the SoC wires the stmmac lpi_intr_o signal to an OR gate along with the main dwmac interrupts, which causes an interrupt storm for two reasons. First, there's a race condition due to the interrupt deassertion being synchronous to the RX clock domain: - When the PHY exits LPI mode, it restarts generating the RX clock (clk_rx_i input signal to the GMAC). - The MAC detects exit from LPI, and asserts lpi_intr_o. This triggers the ENET_EQOS interrupt. - Before the CPU has time to process the interrupt, the PHY enters LPI mode again, and stops generating the RX clock. - The CPU processes the interrupt and reads the GMAC4_LPI_CTRL_STATUS registers. This does not clear lpi_intr_o as there's no clk_rx_i. An attempt was made to fixing the issue by not stopping RX_CLK in Rx LPI state ([2]). This alleviates the symptoms but doesn't fix the issue. Since lpi_intr_o takes four RX_CLK cycles to clear, an interrupt storm can still occur during that window. In 1000T mode this is harder to notice, but slower receive clocks cause hundreds to thousands of spurious interrupts. Fix the issue by disabling EEE completely on i.MX8MP. [1] https://lore.kernel.org/all/20251026122905.29028-1-laurent.pinchart@ideasonboard.com/ [2] https://lore.kernel.org/all/20251123053518.8478-1-laurent.pinchart@ideasonboard.com/ Signed-off-by: Laurent Pinchart Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260325210003.2752013-3-laurent.pinchart@ideasonboard.com Signed-off-by: Jakub Kicinski commit 187b00a26679ae58a79f56c0024df1e3dbd7dff0 Author: Russell King (Oracle) Date: Wed Mar 25 23:00:02 2026 +0200 net: stmmac: provide flag to disable EEE Some platforms have problems when EEE is enabled, and thus need a way to disable stmmac EEE support. Add a flag before the other LPI related flags which tells stmmac to avoid populating the phylink LPI capabilities, which causes phylink to call phy_disable_eee() for any PHY that is attached to the affected phylink instance. iMX8MP is an example - the lpi_intr_o signal is wired to an OR gate along with the main dwmac interrupts. Since lpi_intr_o is synchronous to the receive clock domain, and takes four clock cycles to clear, this leads to interrupt storms as the interrupt remains asserted for some time after the LPI control and status register is read. This problem becomes worse when the receive clock from the PHY stops when the receive path enters LPI state - which means that lpi_intr_o can not deassert until the clock restarts. Since the LPI state of the receive path depends on the link partner, this is out of our control. We could disable RX clock stop at the PHY, but that doesn't get around the slow-to-deassert lpi_intr_o mentioned in the above paragraph. Previously, iMX8MP worked around this by disabling gigabit EEE, but this is insufficient - the problem is also visible at 100M speeds, where the receive clock is slower. There is extensive discussion and investigation in the thread linked below, the result of which is summarised in this commit message. Reported-by: Laurent Pinchart Closes: https://lore.kernel.org/r/20251026122905.29028-1-laurent.pinchart@ideasonboard.com Signed-off-by: Russell King (Oracle) Tested-by: Ovidiu Panait Signed-off-by: Laurent Pinchart Reviewed-by: Laurent Pinchart Reviewed-by: Kieran Bingham Link: https://patch.msgid.link/20260325210003.2752013-2-laurent.pinchart@ideasonboard.com Signed-off-by: Jakub Kicinski commit fb4b4a05aeeb8b0f253c5ddce21f4635dadc9550 Author: Erni Sri Satya Vennela Date: Wed Mar 25 11:04:17 2026 -0700 net: mana: Use at least SZ_4K in doorbell ID range check mana_gd_ring_doorbell() accesses offsets up to DOORBELL_OFFSET_EQ (0xFF8) + 8 bytes = 4KB within each doorbell page. A db_page_size smaller than SZ_4K is fundamentally incompatible with the driver: doorbell pages would overlap and the device cannot function correctly. Validate db_page_size at the source and fail the probe early if the value is below SZ_4K. This ensures the doorbell ID range check in mana_gd_register_device() can rely on db_page_size being valid. Fixes: 89fe91c65992 ("net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response") Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260325180423.1923060-1-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski commit b8f9410aefc15e55304788b958a796d22bcabb7e Author: Jiri Pirko Date: Wed Mar 25 16:28:01 2026 +0100 mlx5: shd: Gracefully avoid shared devlink creation when no usable SN is found On some HW, not even fall-back "SERIALNO" is found in VPD data. Unify the behavior with the case there are no VPD data at all and avoid creation of shared devlink instance. Fixes: 2a8c8a03f306 ("net/mlx5: Add a shared devlink instance for PFs on same chip") Reported-by: Adam Young Closes: https://lore.kernel.org/all/bab5b6bc-aa42-4af1-80d1-e56bcef06bc2@amperemail.onmicrosoft.com/ Reported-by: Ben Copeland Closes: https://lore.kernel.org/all/20260324151014.860376-1-ben.copeland@linaro.org/ Signed-off-by: Jiri Pirko Tested-by: Ben Copeland Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260325152801.236343-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 4b23febb6b11cd06183bed3d21b87ba7d6a8a1e0 Author: Thierry Reding Date: Thu Jan 22 14:25:35 2026 +0100 MAINTAINERS: Change email address for Thierry Reding Use the kernel.org email address as a level of indirection to enable transparent switching of providers if necessary. Signed-off-by: Thierry Reding commit c70e6bc11d2008fbb19695394b69fd941ab39030 Author: Prathamesh Shete Date: Wed Jan 28 08:51:14 2026 +0000 arm64: tegra: Add Tegra264 GPIO controllers Add device tree nodes for MAIN, AON and UPHY GPIO controller instances. Signed-off-by: Prathamesh Shete Reviewed-by: Jon Hunter Signed-off-by: Thierry Reding commit e4722f5510930df0ae2467132f558b90fdc81ee0 Author: Diogo Ivo Date: Tue Feb 3 17:01:17 2026 +0000 arm64: tegra: smaug: Enable SPI-NOR flash Add support for the SPI-NOR flash found in Pixel C devices. Signed-off-by: Diogo Ivo Signed-off-by: Thierry Reding commit d748047af1355df044faf8df0eedf0ef75f87de8 Author: Michael S. Tsirkin Date: Wed Mar 25 13:36:00 2026 -0400 ptr_ring: disable KCSAN warnings Eric Dumazet reported KCSAN warnings: BUG: KCSAN: data-race in pfifo_fast_dequeue / pfifo_fast_enqueue write to 0xffff88811d5ccc00 of 8 bytes by interrupt on cpu 0: __ptr_ring_zero_tail include/linux/ptr_ring.h:259 [inline] __ptr_ring_discard_one include/linux/ptr_ring.h:291 [inline] __ptr_ring_consume include/linux/ptr_ring.h:311 [inline] __skb_array_consume include/linux/skb_array.h:98 [inline] pfifo_fast_dequeue+0x770/0x8f0 net/sched/sch_generic.c:770 dequeue_skb net/sched/sch_generic.c:297 [inline] qdisc_restart net/sched/sch_generic.c:402 [inline] __qdisc_run+0x189/0xc80 net/sched/sch_generic.c:420 qdisc_run include/net/pkt_sched.h:120 [inline] net_tx_action+0x379/0x590 net/core/dev.c:5793 handle_softirqs+0xb9/0x280 kernel/softirq.c:622 do_softirq+0x45/0x60 kernel/softirq.c:523 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] bpf_test_run+0x2db/0x620 net/bpf/test_run.c:426 bpf_prog_test_run_skb+0x9a4/0xef0 net/bpf/test_run.c:1159 bpf_prog_test_run+0x204/0x340 kernel/bpf/syscall.c:4721 __sys_bpf+0x52e/0x7e0 kernel/bpf/syscall.c:6246 __do_sys_bpf kernel/bpf/syscall.c:6341 [inline] __se_sys_bpf kernel/bpf/syscall.c:6339 [inline] __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6339 x64_sys_call+0x10cb/0x3020 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff88811d5ccc00 of 8 bytes by task 22632 on cpu 1: __ptr_ring_produce include/linux/ptr_ring.h:106 [inline] ptr_ring_produce include/linux/ptr_ring.h:129 [inline] skb_array_produce include/linux/skb_array.h:44 [inline] pfifo_fast_enqueue+0xd5/0x2c0 net/sched/sch_generic.c:741 dev_qdisc_enqueue net/core/dev.c:4144 [inline] __dev_xmit_skb net/core/dev.c:4188 [inline] __dev_queue_xmit+0x6a4/0x1f20 net/core/dev.c:4795 dev_queue_xmit include/linux/netdevice.h:3384 [inline] __bpf_tx_skb net/core/filter.c:2153 [inline] __bpf_redirect_common net/core/filter.c:2197 [inline] __bpf_redirect+0x862/0x990 net/core/filter.c:2204 ____bpf_clone_redirect net/core/filter.c:2487 [inline] bpf_clone_redirect+0x20c/0x290 net/core/filter.c:2450 bpf_prog_53f18857bc887b09+0x22/0x2a bpf_dispatcher_nop_func include/linux/bpf.h:1402 [inline] __bpf_prog_run include/linux/filter.h:723 [inline] bpf_prog_run include/linux/filter.h:730 [inline] bpf_test_run+0x29d/0x620 net/bpf/test_run.c:423 bpf_prog_test_run_skb+0x9a4/0xef0 net/bpf/test_run.c:1159 bpf_prog_test_run+0x204/0x340 kernel/bpf/syscall.c:4721 __sys_bpf+0x52e/0x7e0 kernel/bpf/syscall.c:6246 __do_sys_bpf kernel/bpf/syscall.c:6341 [inline] __se_sys_bpf kernel/bpf/syscall.c:6339 [inline] __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6339 x64_sys_call+0x10cb/0x3020 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0xffff888104a93a00 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 22632 Comm: syz.0.4135 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 There is no race on ring accesses: reading/writing a partial pointer would be fine, because the reading is done by the producer which merely cares about NULL/non NULL. Document and disable the warnings using data_race(). Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/dd3984b3bce9df3591927f927668cb31cc7ecf34.1774460059.git.mst@redhat.com Signed-off-by: Jakub Kicinski commit f369289d46e7d8c2335c218f5d0ddf417e8fec4d Author: Thierry Reding Date: Sat Mar 21 00:43:29 2026 +0100 arm64: tegra: Add Jetson AGX Thor Developer Kit support Add basic support for the Jetson AGX Thor Developer Kit. It's quite similar to the existing reference platform but has a slightly different carrier board with different mass storage options and I/O. Signed-off-by: Thierry Reding commit bed2f5b4de6c6fd8f8928f6373ad92e8795c370f Author: Thierry Reding Date: Sat Mar 21 00:43:28 2026 +0100 dt-bindings: arm: tegra: Document Jetson AGX Thor DevKit The Jetson AGX Thor Developer Kit uses the same module (P3834) as the P3971 reference platform but a slightly different carrier board (P4071). Acked-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit e8014b2c83f598e15f5ae48fb56ad9a8d1484965 Author: Jon Hunter Date: Wed Mar 25 19:26:00 2026 +0000 soc/tegra: pmc: Add IO pads for Tegra264 Populate the IO pads and pins for Tegra264. Tegra264 has internal 1.8V and 0.6V regulators that must be enabled when selecting the 1.8V mode for the sdmmc1-hv IO pad. To support this a new 'ena_1v8' member is added to the 'tegra_io_pad_vctrl' structure to populate the bits that need to be set to enable these internal regulators. Although this is enabling 1.8V (bit 1) and 0.6V (bit 2) regulators, it is simply called 'ena_1v8' because these are both enabled for 1.8V operation. Note that these internal regulators are disabled when not using 1.8V mode. Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit db3c16b2b90b0f56a94f9780f9dd10b50b648860 Author: Jon Hunter Date: Wed Mar 25 19:25:59 2026 +0000 soc/tegra: pmc: Rename has_impl_33v_pwr flag The flag 'has_impl_33v_pwr' is now only used to determine if we need to set the write-enable bit before we can set the bit to select if 3.3V IO is used or not. Therefore, rename the flag to 'has_io_pad_wren' to indicate that the SoC supports the write-enable register. Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit edded7a9033a77c9b8a66176daa5e0b601e7c474 Author: Jon Hunter Date: Wed Mar 25 19:25:58 2026 +0000 soc/tegra: pmc: Refactor IO pad voltage control For Tegra devices, only a subset of IO pads can be configured for 1.8V or 3.3V. Therefore, in the 'tegra_io_pad_soc' structure for Tegra SoCs either all or most of the 'voltage' entries are set to UINT_MAX to indicate the IO pad voltage cannot be configured. So for the majority of IO pads this configuration is not applicable. However, refactoring the IO pad data to move this parameter into a separate structure does not make sense because the benefits are marginal. Support for the Tegra264 IO pads is currently missing and the control for configuring the voltage for the IO pads for Tegra264 has changed. Instead of having a single register that is used for setting the IO pad voltage for all IO pads, there is now a register associated with the specific IO pad. For Tegra264, there is now only one IO pad that can be configured for 1.8V or 3.3V which is the sdmmc1-hv. While we could make this work with by adding a new SoC flag, the implementation will be a bit cumbersome. Therefore, it now seems reasonable to refactor the IO pad code. Hence, introduce a new 'tegra_io_pad_vctrl' structure that contains the register offset and bit for enabling/disabling 3.3V mode and move the existing voltage control data for supported SoCs to this structure. This has an added benefit of simplifying the code in the functions tegra_io_pad_get_voltage and tegra_io_pad_set_voltage. Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit 91d5b17fd387d9822ef9fa64e8dd2c1d231c9aca Author: Jon Hunter Date: Wed Mar 25 19:25:57 2026 +0000 soc/tegra: pmc: Add Tegra264 wake events Populate the various wake events for the Tegra264 device. Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit bc8b07878cef6273aa1135630cad05227a4b223b Author: Jon Hunter Date: Wed Mar 25 19:25:56 2026 +0000 soc/tegra: pmc: Add AOWAKE regs for Tegra264 Populate the AOWAKE register offsets for Tegra264. Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit 5f87dac89270f7bf5c65eaa2dc884ba1fa2de4e2 Author: Jon Hunter Date: Wed Mar 25 19:25:55 2026 +0000 soc/tegra: pmc: Add support for SoC specific AOWAKE offsets For Tegra264, some of the AOWAKE registers have different register offsets. Prepare for adding the Tegra264 AOWAKE register by moving the offsets for the AOWAKE registers that are different for Tegra264 into the 'tegra_pmc_regs' structure and populate these offsets for the SoCs that support these registers. Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit 8b3e944ee16ce9061b632ccab207e9a9dd540ad9 Author: Jon Hunter Date: Wed Mar 25 19:25:54 2026 +0000 soc/tegra: pmc: Remove unused AOWAKE definitions For Tegra264, the offsets for the AOWAKE registers have changed. Before adding support for the Tegra264 AOWAKE register offsets, remove the unused AOWAKE definitions. Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit e6ad1988e56834d641ba4aa0d58970723c1c9c9b Author: Jon Hunter Date: Wed Mar 25 19:25:53 2026 +0000 soc/tegra: pmc: Add kerneldoc for wake-up variables Commit e6d96073af68 ("soc/tegra: pmc: Fix unsafe generic_handle_irq() call") added the variables 'wake_work' and 'wake_status' to the 'tegra_pmc' structure but did not add the associated kerneldoc for these new variables. Add the kerneldoc for these variables. Fixes: e6d96073af68 ("soc/tegra: pmc: Fix unsafe generic_handle_irq() call") Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit ec0e4da5d679f9da1cc198927951f70fdf28f001 Author: Jon Hunter Date: Wed Mar 25 19:25:52 2026 +0000 soc/tegra: pmc: Correct function names in kerneldoc Commit 70f752ebb08c ("soc/tegra: pmc: Add PMC contextual functions") added the functions devm_tegra_pmc_get() and tegra_pmc_io_pad_power_enable(), but the names of the functions in the associated kerneldoc is incorrect. Update the kerneldoc for these functions to correct their names. Fixes: 70f752ebb08c ("soc/tegra: pmc: Add PMC contextual functions") Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit 21669619e4c17a5f097e0415bc64b1d400c54fcb Author: Jon Hunter Date: Wed Mar 25 19:25:51 2026 +0000 soc/tegra: pmc: Add kerneldoc for reboot notifier Commit 48b7f802fb78 ("soc/tegra: pmc: Embed reboot notifier in PMC context") added the reboot_notifier structure to the PMC SoC structure but did not update the kerneldoc accordingly. Add this missing kerneldoc description to fix this. Fixes: 48b7f802fb78 ("soc/tegra: pmc: Embed reboot notifier in PMC context") Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit 656275069fad4bd90b39d5fc163cc5757986900d Author: Svyatoslav Ryhel Date: Mon Jan 26 21:02:06 2026 +0200 soc/tegra: common: Add Tegra114 support to devm_tegra_core_dev_init_opp_table Determine the Tegra114 hardware version using the SoC Speedo ID bit macro, mirroring the approach already used for Tegra30 and Tegra124. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit 8e2a2f5851d33f99a475c1dbd8eae74ef72c517c Author: Svyatoslav Ryhel Date: Mon Jan 26 21:20:30 2026 +0200 soc/tegra: pmc: Enable core domain support for Tegra114 Enable core domain support for Tegra114 since now it has power domains fully configured. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit ce74a6c6d88ba9ee29a6b99ac97ffcded577c85d Author: Dmitry Torokhov Date: Wed Mar 25 16:29:54 2026 -0700 ARM: tegra: paz00: Configure WiFi rfkill switch through device tree As of d64c732dfc9e ("net: rfkill: gpio: add DT support") rfkill-gpio device can be instantiated via device tree. Add the declaration there and drop board-paz00.c file and relevant Makefile fragments. Tested-by: Marc Dietrich Signed-off-by: Dmitry Torokhov Reviewed-by: Bartosz Golaszewski Signed-off-by: Thierry Reding commit 464aac3a99e2522c25f0a005bc8413f3beea06eb Author: Svyatoslav Ryhel Date: Mon Feb 23 08:55:00 2026 +0200 ARM: tegra: transformers: Add connector node All ASUS Transformers have micro-HDMI connector directly available. After Tegra HDMI got bridge/connector support, we should use connector framework for proper HW description. Tested-by: Andreas Westman Dorcsak # ASUS TF T30 Tested-by: Robert Eckelmann # ASUS TF101 T20 Tested-by: Svyatoslav Ryhel # ASUS TF201 T30 Signed-off-by: Svyatoslav Ryhel Signed-off-by: Thierry Reding commit 7f78e0b46e9984e955cb73ffada8dace8b4dd059 Author: Ahmed S. Darwish Date: Fri Mar 27 03:15:16 2026 +0100 ASoC: Intel: avs: Include CPUID header at file scope Commit cbe37a4d2b3c ("ASoC: Intel: avs: Configure basefw on TGL-based platforms") includes the main CPUID header from within a C function. This works by luck and forbids valid refactoring inside that header. Include the CPUID header at file scope instead. Remove the COMPILE_TEST build flag so that the CONFIG_X86 conditionals can be removed. The driver gets enough compilation testing already on x86. For clarity, refactor the CPUID(0x15) code into its own function without changing any of the driver's logic. Fixes: cbe37a4d2b3c ("ASoC: Intel: avs: Configure basefw on TGL-based platforms") Suggested-by: Borislav Petkov # CONFIG_X86 removal Signed-off-by: Ahmed S. Darwish Signed-off-by: Borislav Petkov (AMD) Acked-by: Cezary Rojewski Link: https://lore.kernel.org/all/20250612234010.572636-3-darwi@linutronix.de commit 93a1f0e61329f538cfc7122d7fa0e7a1803e326d Author: Ahmed S. Darwish Date: Fri Mar 27 03:15:15 2026 +0100 ASoC: Intel: avs: Check maximum valid CPUID leaf The Intel AVS driver queries CPUID(0x15) before checking if the CPUID leaf is available. Check the maximum-valid CPU standard leaf beforehand. Use the CPUID_LEAF_TSC macro instead of the custom local one for the CPUID(0x15) leaf number. Fixes: cbe37a4d2b3c ("ASoC: Intel: avs: Configure basefw on TGL-based platforms") Signed-off-by: Ahmed S. Darwish Signed-off-by: Borislav Petkov (AMD) Acked-by: Cezary Rojewski Link: https://patch.msgid.link/20260327021645.555257-2-darwi@linutronix.de commit 2dfb80cc3580dc02be83246bcd5446e6f3a231b9 Merge: 1801c8284d34d7 57b7943fd87f08 Author: Martin K. Petersen Date: Fri Mar 27 17:21:28 2026 -0400 Merge patch series "scsi: ufs: Add TX Equalization support for UFS 5.0" Can Guo says: Hi, The UFS v5.0 and UFSHCI v5.0 standards have published, introducing support for HS-G6 (46.6 Gbps per lane) through the new UniPro V3.0 interconnect layer and M-PHY V6.0 physical layer specifications. To achieve reliable operation at these higher speeds, UniPro V3.0 introduces TX Equalization and Pre-Coding mechanisms that are essential for signal integrity. This patch series implements TX Equalization support in the UFS core driver as specified in UFSHCI v5.0, along with the necessary vendor operations and a reference implementation for Qualcomm UFS host controllers. Background ========== TX Equalization is a signal conditioning technique that compensates for channel impairments at high data rates (HS-G4 through HS-G6). It works by adjusting two key parameters: - PreShoot: Pre-emphasis applied before the main signal transition - DeEmphasis: De-emphasis applied after the main signal transition UniPro V3.0 defines TX Equalization Training (EQTR) procedure to automatically discover optimal TX Equalization settings. The EQTR procedure: 1. Starts from the most reliable link state (HS-G1) 2. Iterates through all possible PreShoot and DeEmphasis combinations 3. Evaluates signal quality using Figure of Merit (FOM) measurements 4. Selects the best settings for both host and device TX lanes For HS-G6, Pre-Coding is also introduced to further improve signal quality. Pre-Coding must be enabled on both transmitter and receiver when the RX_FOM indicates it is required. Implementation Overview ======================= The implementation follows the UFSHCI v5.0 specification and consists of: Core Infrastructure (Patches 1-6): - New vops callback negotiate_pwr_mode() to allow vendors to negotiate power mode parameters before applying TX Equalization settings - Support for HS-G6 gear enumeration - Complete TX EQTR procedure implementation in ufs-txeq.c - Debugfs interface for TX Equalization parameter inspection and manual retraining - Module parameters for adaptive TX Equalization control Qualcomm Implementation (Patches 7-11): - PHY-specific configurations for TX EQTR procedure - Vendor-specific FOM measurement support - TX Equalization settings application - Enable TX Equalization for HW version 0x7 and onwards The implementation is designed to be vendor-agnostic, with platform- specific details handled through the vops callbacks. Other vendors can add support by implementing the three new vops: - tx_eqtr_notify(): Called before/after TX EQTR for vendor setup - apply_tx_eqtr_settings(): Apply vendor-specific PHY configurations - get_rx_fom(): Retrieve vendor-specific FOM measurements if needed Module Parameters ================= The implementation provides several module parameters for flexibility: - use_adaptive_txeq: Enable/disable adaptive TX Equalization (default: false) - adaptive_txeq_gear: Minimum gear for adaptive TX EQ (default: HS-G6) - use_txeq_presets: Use only the 8 standaird presets (default: false) - txeq_presets_selected[]: Select specific presets for EQTR Testing ======= This patch series has been tested on Qualcomm platforms with UFS 5.0 devices, validating: - Successful TX EQTR completion for HS-G6 - Proper FOM evaluation and optimal settings selection - Pre-Coding enablement for HS-G6 - Power mode changes with TX Equalization settings applied - Report of TX Equalization settings via debugfs entries - Report of TX EQTR histories via debug entries (see next section) - Re-training TX Equalization via debugfs entry Example of TX EQTR history ========================== Device TX EQTR record summary - Target Power Mode: HS-G6, Rate-B Most recent record index: 2 Most recent record timestamp: 219573378 us TX Lane 0 FOM - PreShoot\DeEmphasis \ 0 1 2 3 4 5 6 7 0 50 70 65 - - - - x 1 x x x x x x x x 2 100 90 70 - - - - x 3 x x x x x x x x 4 95 90 - - - - - x 5 - - - - - - - x 6 x x x x x x x x 7 x x x x x x x x TX Lane 1 FOM - PreShoot\DeEmphasis \ 0 1 2 3 4 5 6 7 0 50 70 60 - - - - x 1 x x x x x x x x 2 100 80 65 - - - - x 3 x x x x x x x x 4 95 85 - - - - - x 5 - - - - - - - x 6 x x x x x x x x 7 x x x x x x x x Patch Structure =============== Patches 1-3: Preparatory changes for power mode negotiation and HS-G6 Patch 4: Core TX Equalization and EQTR implementation Patches 5-7: Debugfs support for TX Equalization Patches 8-12: Qualcomm vendor implementation Next ==== One more series has been developed to enhance TX Equalization support, which will be submitted for review after this series is accepted: - Provide board specific (static) TX Equalization settings from DTS - Parse static TX Equalization settings from DTS if provided - Apply static TX Equalization settings if use_adaptive_txeq is disabled - Add support for UFS v5.0 attributes qTxEQGnSettings & wTxEQGnSettingsExt - Enable persistent storage and retrieval of optimal TX Equalization settings Link: https://patch.msgid.link/20260325152154.1604082-1-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 489b33708eda8b5f6a0cddb5a4964b56c12f52e2 Author: Marilene Andrade Garcia Date: Fri Mar 27 11:55:57 2026 -0300 EDAC/ie31200: Make rpl_s_cfg static The rpl_s_cfg variable is only used within this file, so mark it static, as Sparse reports: drivers/edac/ie31200_edac.c:709:19: warning: symbol 'rpl_s_cfg' was not declared. Should it be static? [ bp: Massage commit message. ] Signed-off-by: Marilene Andrade Garcia Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/f353c3aff47abd88bafc46a1c0c5eb9917e11b28.1774619301.git.marilene.agarcia@gmail.com commit 57b7943fd87f086a3497ecbecc502b7418ed4ab8 Author: Can Guo Date: Wed Mar 25 08:21:54 2026 -0700 scsi: ufs: ufs-qcom: Enable TX Equalization Enable TX Equalization for hosts with HW version 0x7 and onwards. Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-13-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 16cbdc8308776270d76340cd52ac63ac4fbf9968 Author: Can Guo Date: Wed Mar 25 08:21:53 2026 -0700 scsi: ufs: ufs-qcom: Implement vops apply_tx_eqtr_settings() On some platforms, when Host Software triggers TX Equalization Training, HW does not take TX EQTR settings programmed in PA_TxEQTRSetting, instead HW takes TX EQTR settings from PA_TxEQG1Setting. Implement vops apply_tx_eqtr_setting() to work around it by programming TX EQTR settings to PA_TxEQG1Setting during TX EQTR procedure. Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-12-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 26605db7604deb18cf004cf3ad51e72e5d9b7add Author: Can Guo Date: Wed Mar 25 08:21:52 2026 -0700 scsi: ufs: ufs-qcom: Implement vops get_rx_fom() On some platforms, host's M-PHY RX_FOM Attribute always reads 0, meaning SW cannot rely on Figure of Merit (FOM) to identify the optimal TX Equalization settings for device's TX Lanes. Implement the vops ufs_qcom_get_rx_fom() such that SW can utilize the UFS Eye Opening Monitor (EOM) to evaluate the TX Equalization settings for device's TX Lanes. Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-11-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 385b95893e799885ec54a4ec2e240b1d814205be Author: Can Guo Date: Wed Mar 25 08:21:51 2026 -0700 scsi: ufs: ufs-qcom: Implement vops tx_eqtr_notify() On some platforms, HW does not support triggering TX EQTR from the most reliable High-Speed (HS) Gear (HS Gear1), but only allows to trigger TX EQTR for the target HS Gear from the same HS Gear. To work around the HW limitation, implement vops tx_eqtr_notify() to change Power Mode to the target TX EQTR HS Gear prior to TX EQTR procedure and change Power Mode back to HS Gear1 (the most reliable gear) post TX EQTR procedure. Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-10-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 53c94067efa252e20f813c6eb714dc1cddf06aaa Author: Can Guo Date: Wed Mar 25 08:21:50 2026 -0700 scsi: ufs: ufs-qcom: Fixup PAM-4 TX L0_L1_L2_L3 adaptation pattern length If HS-G6 Power Mode change handshake is successful and outbound data Lanes are expected to transmit ADAPT, M-TX Lanes shall be configured as if (Adapt Type == REFRESH) TX_HS_ADAPT_LENGTH_L0_L1_L2_L3 = PA_PeerRxHsG6AdaptRefreshL0L1L2L3. else if (Adapt Type == INITIAL) TX_HS_ADAPT_LENGTH_L0_L1_L2_L3 = PA_PeerRxHsG6AdaptInitialL0L1L2L3. On some platforms, the ADAPT_L0_L1_L2_L3 duration on Host TX Lanes is only a half of theoretical ADAPT_L0_L1_L2_L3 duration TADAPT_L0_L1_L2_L3 (in PAM-4 UI) calculated from TX_HS_ADAPT_LENGTH_L0_L1_L2_L3. For such platforms, the workaround is to double the ADAPT_L0_L1_L2_L3 duration by uplifting TX_HS_ADAPT_LENGTH_L0_L1_L2_L3. UniPro initializes TX_HS_ADAPT_LENGTH_L0_L1_L2_L3 during HS-G6 Power Mode change handshake, it would be too late for SW to update TX_HS_ADAPT_LENGTH_L0_L1_L2_L3 post HS-G6 Power Mode change. Update PA_PeerRxHsG6AdaptRefreshL0L1L2L3 and PA_PeerRxHsG6AdaptInitialL0L1L2L3 post Link Startup and before HS-G6 Power Mode change, so that the UniPro would use the updated value during HS-G6 Power Mode change handshake. Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-9-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit adbabdcf0db0f929e642f95d7528dce0f6bd3a11 Author: Can Guo Date: Wed Mar 25 08:21:49 2026 -0700 scsi: ufs: core: Add support to retrain TX Equalization via debugfs Drastic environmental changes, such as significant temperature shifts, can impact link signal integrity. In such cases, retraining TX Equalization is necessary to compensate for these environmental changes. Add a debugfs entry, 'tx_eq_ctrl', to allow userspace to manually trigger the TX Equalization training (EQTR) procedure and apply the identified optimal settings on the fly. These entries are created on a per-gear basis for High Speed Gear 4 (HS-G4) and above, as TX EQTR is not supported for lower gears. The 'tx_eq_ctrl' entry currently accepts the 'retrain' command to initiate the procedure. The interface is designed to be scalable to support additional commands in the future. Reading the 'tx_eq_ctrl' entry provides a usage hint to the user, ensuring the interface is self-documenting. The ufshcd's debugfs folder structure will look like below: /sys/kernel/debug/ufshcd/*ufs*/ |--tx_eq_hs_gear1/ | |--device_tx_eq_params | |--host_tx_eq_params |--tx_eq_hs_gear2/ |--tx_eq_hs_gear3/ |--tx_eq_hs_gear4/ |--tx_eq_hs_gear5/ |--tx_eq_hs_gear6/ |--device_tx_eq_params |--device_tx_eqtr_record |--host_tx_eq_params |--host_tx_eqtr_record |--tx_eq_ctrl Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-8-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit dc5dcac5327832bffc1971b1445553823bdebc08 Author: Can Guo Date: Wed Mar 25 08:21:48 2026 -0700 scsi: ufs: core: Add helpers to pause and resume command processing In preparation for supporting TX Equalization refreshing, introduce helper functions to safely pause and resume command processing. ufshcd_pause_command_processing() ensures the host is in a quiescent state by stopping the block layer tagset, acquiring the necessary locks (scan_mutex and clk_scaling_lock), and waiting for any in-flight commands to complete within a specified timeout. ufshcd_resume_command_processing() restores the host to its previous operational state by reversing these steps in the correct order. Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-7-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 10c40143f369a601cc54dd39777843e000b730a6 Author: Can Guo Date: Wed Mar 25 08:21:47 2026 -0700 scsi: ufs: core: Add debugfs entries for TX Equalization params Add debugfs support for UFS TX Equalization and UFS TX Equalization Training (EQTR) to facilitate runtime inspection of link quality. These entries allow developers to monitor and optimize TX Equalization parameters and EQTR records during live operation. The debugfs entries are organized on a per-gear basis under the HBA's debugfs root. Since TX EQTR is only defined for High Speed Gear 4 (HS-G4) and above, EQTR-related entries are explicitly excluded for HS-G1 through HS-G3 to avoid exposing unsupported attributes. The ufshcd's debugfs folder structure will look like below: /sys/kernel/debug/ufshcd/*ufs*/ |--tx_eq_hs_gear1/ | |--device_tx_eq_params | |--host_tx_eq_params |--tx_eq_hs_gear2/ |--tx_eq_hs_gear3/ |--tx_eq_hs_gear4/ |--tx_eq_hs_gear5/ |--tx_eq_hs_gear6/ |--device_tx_eq_params |--device_tx_eqtr_record |--host_tx_eq_params |--host_tx_eqtr_record Reviewed-by: Bart Van Assche Reviewed-by: Bean Huo Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-6-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 03e5d38e2f985d8d0b0a60508c0b422f664808e3 Author: Can Guo Date: Wed Mar 25 08:21:46 2026 -0700 scsi: ufs: core: Add support for TX Equalization MIPI Unipro3.0 introduced PA_TxEQGnSetting and PA_PreCodeEn attributes for TX Equalization and Pre-Coding. It is Host Software's responsibility to configure these attributes for both host and device before initiating Power Mode Change to High-Speed Gears. MIPI Unipro3.0 also introduced TX Equalization Training (EQTR) to identify optimal TX Equalization settings for use by both Host's and Device's UniPro. TX EQTR shall be initiated from the most reliable High-Speed Gear (HS-G1) targeting High-Speed Gears (HS-G4 to HS-G6). Implement TX Equalization configuration and TX EQTR procedure as defined in UFSHCI v5.0 specification. The TX EQTR procedure determines the optimal TX Equalization settings by iterating through all possible PreShoot and DeEmphasis combinations and selecting the best combinations for both Host and Device based on Figure of Merit (FOM) evaluation. Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-5-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 6669ab18c2238299a685ada1acea1c7d4f1da1d5 Author: Can Guo Date: Wed Mar 25 08:21:45 2026 -0700 scsi: ufs: core: Add UFS_HS_G6 and UFS_HS_GEAR_MAX to enum ufs_hs_gear_tag Add UFS_HS_G6 to enum ufs_hs_gear_tag. In addition, add UFS_HS_GEAR_MAX to enum ufs_hs_gear_tag to facilitate iteration over valid High Speed Gears. Reviewed-by: Bart Van Assche Reviewed-by: Bean Huo Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-4-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit c91c83671642d6140b703e999e2aff2d7ad57c74 Author: Can Guo Date: Wed Mar 25 08:21:44 2026 -0700 scsi: ufs: core: Pass force_pmc to ufshcd_config_pwr_mode() as a parameter Currently, callers must manually toggle hba->force_pmc before and after calling ufshcd_config_pwr_mode() to force a Power Mode change. Introduce enum ufshcd_pmc_policy and refactor ufshcd_config_pwr_mode() to accept pmc_policy as a parameter to force a Power Mode change. Reviewed-by: Bart Van Assche Reviewed-by: Bean Huo Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit d3eba21c71708746672587f1de2cc33e6a10d61a Author: Can Guo Date: Wed Mar 25 08:21:43 2026 -0700 scsi: ufs: core: Introduce a new ufshcd vops negotiate_pwr_mode() Most vendor specific implemenations of vops pwr_change_notify(PRE_CHANGE) are fulfilling two things at once: - Vendor specific target power mode negotiation - Vendor specific power mode change preparation When TX Equalization is added into consideration, before power mode change to a target power mode, TX Equalization Training (EQTR) needs be done for that target power mode. In addition, UFSHCI spec requires to start TX EQTR from HS-G1 (the most reliable High Speed Gear). Adding TX EQTR before pwr_change_notify(PRE_CHANGE) is not applicable because we don't know the negotiated power mode yet. Adding TX EQTR post pwr_change_notify(PRE_CHANGE) is inappropriate because pwr_change_notify(PRE_CHANGE) has finished preparation for a power mode change to negotiated power mode, yet we are changing power mode to HS-G1 for TX EQTR. Add a new vops negotiate_pwr_mode() so that vendor specific power mode negotiation can be fulfilled in its vendor specific implementations. Later on, TX EQTR can be added post vops negotiate_pwr_mode() and before vops pwr_change_notify(PRE_CHANGE). Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Can Guo Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260325152154.1604082-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 33eded29319d41fcba5d0257b126a48b449aad47 Author: Keith Busch Date: Wed Mar 25 12:36:08 2026 -0700 dm: provide helper to set stacked limits There are multiple device mappers that set up their stacking limits exactly the same for the logical, physical and minimum IO queue limits. Provide a helper for it. Signed-off-by: Keith Busch Signed-off-by: Mikulas Patocka commit cbc1532d2b0ec2a842bd459f01b590bbf16b7443 Author: Keith Busch Date: Wed Mar 25 12:36:07 2026 -0700 dm-integrity: always set the io hints Don't depend on the defaults to be what is desired if the integrity device was set up with 512b sector size. Always set the queue limits to be at least what the device mapper wants. Signed-off-by: Keith Busch Signed-off-by: Mikulas Patocka commit 6ebf3b6c6f16fda0568aa4207c6cd398f983c354 Author: Keith Busch Date: Wed Mar 25 12:36:06 2026 -0700 dm-integrity: fix mismatched queue limits A user can integritysetup a device with a backing device using a 4k logical block size, but request the dm device use 1k or 2k. This mismatch creates an inconsistency such that the dm device would report limits for IO that it can't actually execute. Fix this by using the backing device's limits if they are larger. Signed-off-by: Keith Busch Signed-off-by: Mikulas Patocka commit d47059dcc472ae823c7eebe87fb7cec9148b9f06 Author: Zilin Guan Date: Fri Mar 27 16:47:42 2026 +0800 hfsplus: extract hidden directory search into a helper function In hfsplus_fill_super(), the process of looking up the hidden directory involves initializing a catalog search, building a search key, reading the b-tree record, and releasing the search data. Currently, this logic is open-coded directly within the main superblock initialization routine. This makes hfsplus_fill_super() quite lengthy and its error handling paths less straightforward. Extract the hidden directory search sequence into a new helper function, hfsplus_get_hidden_dir_entry(). This improves overall code readability, cleanly encapsulates the hfs_find_data lifecycle, and simplifies the error exits in hfsplus_fill_super(). Signed-off-by: Zilin Guan Reviewed-by: Viacheslav Dubeyko Tested-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko commit 90c500e4fd83fa33c09bc7ee23b6d9cc487ac733 Author: Zilin Guan Date: Fri Mar 27 16:47:41 2026 +0800 hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which acquires tree->tree_lock. If the subsequent call to hfsplus_cat_build_key() fails, the function jumps to the out_put_root error label without releasing the lock. The later cleanup path then frees the tree data structure with the lock still held, triggering a held lock freed warning. Fix this by adding the missing hfs_find_exit(&fd) call before jumping to the out_put_root error label. This ensures that tree->tree_lock is properly released on the error path. The bug was originally detected on v6.13-rc1 using an experimental static analysis tool we are developing, and we have verified that the issue persists in the latest mainline kernel. The tool is specifically designed to detect memory management issues. It is currently under active development and not yet publicly available. We confirmed the bug by runtime testing under QEMU with x86_64 defconfig, lockdep enabled, and CONFIG_HFSPLUS_FS=y. To trigger the error path, we used GDB to dynamically shrink the max_unistr_len parameter to 1 before hfsplus_asc2uni() is called. This forces hfsplus_asc2uni() to naturally return -ENAMETOOLONG, which propagates to hfsplus_cat_build_key() and exercises the faulty error path. The following warning was observed during mount: ========================= WARNING: held lock freed! 7.0.0-rc3-00016-gb4f0dd314b39 #4 Not tainted ------------------------- mount/174 is freeing memory ffff888103f92000-ffff888103f92fff, with a lock still held there! ffff888103f920b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0 2 locks held by mount/174: #0: ffff888103f960e0 (&type->s_umount_key#42/1){+.+.}-{4:4}, at: alloc_super.constprop.0+0x167/0xa40 #1: ffff888103f920b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0 stack backtrace: CPU: 2 UID: 0 PID: 174 Comm: mount Not tainted 7.0.0-rc3-00016-gb4f0dd314b39 #4 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x82/0xd0 debug_check_no_locks_freed+0x13a/0x180 kfree+0x16b/0x510 ? hfsplus_fill_super+0xcb4/0x18a0 hfsplus_fill_super+0xcb4/0x18a0 ? __pfx_hfsplus_fill_super+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? bdev_open+0x65f/0xc30 ? srso_return_thunk+0x5/0x5f ? pointer+0x4ce/0xbf0 ? trace_contention_end+0x11c/0x150 ? __pfx_pointer+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? bdev_open+0x79b/0xc30 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? vsnprintf+0x6da/0x1270 ? srso_return_thunk+0x5/0x5f ? __mutex_unlock_slowpath+0x157/0x740 ? __pfx_vsnprintf+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? mark_held_locks+0x49/0x80 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? irqentry_exit+0x17b/0x5e0 ? trace_irq_disable.constprop.0+0x116/0x150 ? __pfx_hfsplus_fill_super+0x10/0x10 ? __pfx_hfsplus_fill_super+0x10/0x10 get_tree_bdev_flags+0x302/0x580 ? __pfx_get_tree_bdev_flags+0x10/0x10 ? vfs_parse_fs_qstr+0x129/0x1a0 ? __pfx_vfs_parse_fs_qstr+0x3/0x10 vfs_get_tree+0x89/0x320 fc_mount+0x10/0x1d0 path_mount+0x5c5/0x21c0 ? __pfx_path_mount+0x10/0x10 ? trace_irq_enable.constprop.0+0x116/0x150 ? trace_irq_enable.constprop.0+0x116/0x150 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? kmem_cache_free+0x307/0x540 ? user_path_at+0x51/0x60 ? __x64_sys_mount+0x212/0x280 ? srso_return_thunk+0x5/0x5f __x64_sys_mount+0x212/0x280 ? __pfx___x64_sys_mount+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? trace_irq_enable.constprop.0+0x116/0x150 ? srso_return_thunk+0x5/0x5f do_syscall_64+0x111/0x680 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ffacad55eae Code: 48 8b 0d 85 1f 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 8 RSP: 002b:00007fff1ab55718 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffacad55eae RDX: 000055740c64e5b0 RSI: 000055740c64e630 RDI: 000055740c651ab0 RBP: 000055740c64e380 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000055740c64e5b0 R14: 000055740c651ab0 R15: 000055740c64e380 After applying this patch, the warning no longer appears. Fixes: 89ac9b4d3d1a ("hfsplus: fix longname handling") CC: stable@vger.kernel.org Signed-off-by: Zilin Guan Reviewed-by: Viacheslav Dubeyko Tested-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko commit 1801c8284d34d7927f1a158226e427c195936746 Merge: 5b44c3757ca36e 02ff1d2bcf2d67 Author: Martin K. Petersen Date: Fri Mar 27 17:10:03 2026 -0400 Merge patch series "mpi3mr: Enhancements for mpi3mr" Ranjan Kumar says: Enhancements for mpi3mr driver Link: https://patch.msgid.link/20260320090326.47544-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 02ff1d2bcf2d67bfa08ce7135bd3b33d1fffca61 Author: Ranjan Kumar Date: Fri Mar 20 14:33:26 2026 +0530 scsi: mpi3mr: Add retry mechanism for IOC shutdown with timeout reset Enhance the IOC shutdown process to handle transient failures during controller cleanup. Add retry logic with configurable maximum retry count (MPI3MR_MAX_SHUTDOWN_RETRY_COUNT) and proper timeout management that resets on each retry attempt. This ensures shutdown can recover from temporary issues without failing completely. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260320090326.47544-4-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 9d660e482071bf0bb51f8fe3937eec7448bc8f6a Author: Ranjan Kumar Date: Fri Mar 20 14:33:25 2026 +0530 scsi: mpi3mr: Add queue-full tracking for operational request queues Track queue-full conditions on operational request queues in the driver. Record the last host tag returned to the SCSI mid-layer and count I/Os affected by queue-full conditions. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260320090326.47544-3-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 31693fbbfa212bc48eed1b0b20935d3eeb81180c Author: Ranjan Kumar Date: Fri Mar 20 14:33:24 2026 +0530 scsi: mpi3mr: Reset controller on invalid I/O completion Operational replies without a valid scsi_cmnd indicate an invalid I/O completion and a potentially inconsistent controller state. Track this condition and allow the watchdog to trigger a soft reset to safely recover. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260320090326.47544-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 74e2dbe7be5037a5e5eed6bc1ad562747ac88566 Author: Qinxin Xia Date: Tue Mar 10 12:06:07 2026 +0800 perf tools: Add --pmu-filter option for filtering PMUs This patch adds a new --pmu-filter option to perf-stat command to allow filtering events on specific PMUs. This is useful when there are multiple PMUs with same type (e.g. hisi_sicl2_cpa0 and hisi_sicl0_cpa0). [root@localhost tmp]# perf stat -M cpa_p0_avg_bw Performance counter stats for 'system wide': 19,417,779,115 hisi_sicl0_cpa0/cpa_cycles/ # 0.00 cpa_p0_avg_bw 0 hisi_sicl0_cpa0/cpa_p0_wr_dat/ 0 hisi_sicl0_cpa0/cpa_p0_rd_dat_64b/ 0 hisi_sicl0_cpa0/cpa_p0_rd_dat_32b/ 19,417,751,103 hisi_sicl10_cpa0/cpa_cycles/ # 0.00 cpa_p0_avg_bw 0 hisi_sicl10_cpa0/cpa_p0_wr_dat/ 0 hisi_sicl10_cpa0/cpa_p0_rd_dat_64b/ 0 hisi_sicl10_cpa0/cpa_p0_rd_dat_32b/ 19,417,730,679 hisi_sicl2_cpa0/cpa_cycles/ # 0.31 cpa_p0_avg_bw 75,635,749 hisi_sicl2_cpa0/cpa_p0_wr_dat/ 18,520,640 hisi_sicl2_cpa0/cpa_p0_rd_dat_64b/ 0 hisi_sicl2_cpa0/cpa_p0_rd_dat_32b/ 19,417,674,227 hisi_sicl8_cpa0/cpa_cycles/ # 0.00 cpa_p0_avg_bw 0 hisi_sicl8_cpa0/cpa_p0_wr_dat/ 0 hisi_sicl8_cpa0/cpa_p0_rd_dat_64b/ 0 hisi_sicl8_cpa0/cpa_p0_rd_dat_32b/ 19.417734480 seconds time elapsed [root@localhost tmp]# perf stat --pmu-filter hisi_sicl2_cpa0 -M cpa_p0_avg_bw Performance counter stats for 'system wide': 6,234,093,559 cpa_cycles # 0.60 cpa_p0_avg_bw 50,548,465 cpa_p0_wr_dat 7,552,182 cpa_p0_rd_dat_64b 0 cpa_p0_rd_dat_32b 6.234139320 seconds time elapsed Signed-off-by: Qinxin Xia Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 5b44c3757ca36e49959cf6819b77d7079de75705 Author: Kexin Sun Date: Sat Mar 21 18:59:04 2026 +0800 scsi: iscsi_tcp: update outdated comment for renamed iscsi_conn_set_callbacks() The function iscsi_conn_set_callbacks() was renamed to iscsi_sw_tcp_conn_set_callbacks() by commit 38e1a8f5479d ("[SCSI] iscsi_tcp: hook iscsi_tcp into new libiscsi_tcp module"). Update the stale reference in iscsi_sw_tcp_conn_restore_callbacks(). Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260321105904.7726-1-kexinsun@smail.nju.edu.cn Signed-off-by: Martin K. Petersen commit 3d1a36afa49da89c414e991e4d497e8dce2c1d02 Author: Kexin Sun Date: Sat Mar 21 18:59:09 2026 +0800 scsi: lpfc: Update outdated comment for renamed lpfc_freenode() The function lpfc_freenode() was renamed to lpfc_cleanup_node() by commit 685f0bf7afe0 ("[SCSI] lpfc 8.1.12 : Collapse discovery lists to a single node list"), and commit a70e63eee1c1 ("scsi: lpfc: Fix NPIV Fabric Node reference counting") later removed the lpfc_unreg_rpi() call from lpfc_cleanup_node(). Remove the now-inaccurate "called from lpfc_freenode()" sentence and reflow the remaining comment text for lpfc_unreg_rpi(). Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260321105909.7804-1-kexinsun@smail.nju.edu.cn Signed-off-by: Martin K. Petersen commit 15a4bb87abac5229a4c36e34d388c4279d984b96 Author: Danilo Krummrich Date: Wed Mar 25 01:39:17 2026 +0100 gpu: nova-core: use sized array for GSP log buffers Switch LogBuffer from Coherent<[u8]> (unsized) to Coherent<[u8; LOG_BUFFER_SIZE]> (sized). The buffer size is a compile-time constant (RM_LOG_BUFFER_NUM_PAGES * GSP_PAGE_SIZE), so a fixed-size array is more precise and avoids the need for the runtime length parameter of zeroed_slice(). Acked-by: Gary Guo Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260325003921.3420-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit d1619a433806c61d240a1eb9b4f03cb33ac40fce Author: Danilo Krummrich Date: Wed Mar 25 01:39:16 2026 +0100 rust: dma: generalize BinaryWriter impl for Coherent Generalize the BinaryWriter implementation from Coherent<[u8]> to Coherent where T: KnownSize + AsBytes + ?Sized. The implementation only uses size() and write_dma(), neither of which depends on the inner type being a byte slice. This allows any Coherent allocation with an AsBytes inner type to be exposed as a debugfs binary file. Acked-by: Gary Guo Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260325003921.3420-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 25fe63db0024da172457055532c96bef924a8c78 Author: Danilo Krummrich Date: Wed Mar 25 01:39:15 2026 +0100 rust: uaccess: generalize write_dma() to accept any Coherent Generalize write_dma() from &Coherent<[u8]> to &Coherent where T: KnownSize + AsBytes + ?Sized. The function body only uses as_ptr() and size(), which work for any such T, so there is no reason to restrict it to byte slices. Acked-by: Miguel Ojeda Acked-by: Gary Guo Reviewed-by: Alexandre Courbot Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260325003921.3420-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 0019a3a5756b9030970c31338a1f1d82c045a4b1 Author: Joshua Daley Date: Wed Mar 25 19:08:57 2026 +0100 scsi: virtio_scsi: Kick event_list unconditionally The event_list processes non-hotplug events (such as LUN capacity changes), so remove the conditions that guard the initial kicks in _probe() and _restore(), as well as the work cancellation in _remove(). Suggested-by: Stefan Hajnoczi Signed-off-by: Joshua Daley Reviewed-by: Stefan Hajnoczi Link: https://patch.msgid.link/20260325180857.3675854-3-jdaley@linux.ibm.com Signed-off-by: Martin K. Petersen commit da3159a3b3fdc05c6bdba2fd4f4802a6718d879a Author: Joshua Daley Date: Wed Mar 25 19:08:56 2026 +0100 scsi: virtio_scsi: Move INIT_WORK calls to virtscsi_probe() The last step of virtscsi_handle_event() is to call virtscsi_kick_event(), which calls INIT_WORK on its own work item. INIT_WORK resets the work item's data bits to 0. If this occurs while the work item is being flushed by cancel_work_sync(), then kernel/workqueue.c/work_offqd_enable triggers a kernel warning, as it expects the "disable" bit to be 1: [ 21.450115] workqueue: work disable count underflowed [ 21.450117] WARNING: CPU: 1 PID: 56 at kernel/workqueue.c:4328 enable_work+0x10a/0x120 ... [ 21.450171] Call Trace: [ 21.450173] [<000003db2e5bdc3e>] enable_work+0x10e/0x120 [ 21.450176] ([<000003db2e5bdc3a>] enable_work+0x10a/0x120) [ 21.450178] [<000003db2e5bdd86>] cancel_work_sync+0x86/0xa0 [ 21.450181] [<000003daae97d9e4>] virtscsi_remove+0xb4/0xd0 [virtio_scsi] [ 21.450184] [<000003db2ef3b5ca>] virtio_dev_remove+0x6a/0xd0 [ 21.450186] [<000003db2ef9106c>] device_release_driver_internal+0x1ac/0x260 [ 21.450190] [<000003db2ef8edc8>] bus_remove_device+0xf8/0x190 [ 21.450192] [<000003db2ef88d72>] device_del+0x142/0x340 [ 21.450194] [<000003db2ef88fa0>] device_unregister+0x30/0xa0 [ 21.450196] [<000003db2ef3b2fa>] unregister_virtio_device+0x2a/0x40 This warning may occur if a controller is detached immediately following a disk detach. Move the INIT_WORK call to prevent this. Don't re-init event list work items in virtscsi_kick_event(), init them only once in virtscsi_probe() instead. Signed-off-by: Joshua Daley Reviewed-by: Stefan Hajnoczi Link: https://patch.msgid.link/20260325180857.3675854-2-jdaley@linux.ibm.com Signed-off-by: Martin K. Petersen commit 80df573af9ef3aa63e1bacb6e17d57a7cd69afe2 Author: Asahi Lina Date: Mon Mar 16 17:16:13 2026 -0400 rust: drm: gem: shmem: Add DRM shmem helper abstraction The DRM shmem helper includes common code useful for drivers which allocate GEM objects as anonymous shmem. Add a Rust abstraction for this. Drivers can choose the raw GEM implementation or the shmem layer, depending on their needs. Signed-off-by: Asahi Lina Signed-off-by: Daniel Almeida Reviewed-by: Daniel Almeida Signed-off-by: Lyude Paul Reviewed-by: Janne Grunau Tested-by: Deborah Brouwer Link: https://patch.msgid.link/20260316211646.650074-6-lyude@redhat.com [ * DRM_GEM_SHMEM_HELPER is a tristate; when a module driver selects it, it becomes =m. The Rust kernel crate and its C helpers are always built into vmlinux and can't reference symbols from a module, causing link errors. Thus, add RUST_DRM_GEM_SHMEM_HELPER bool Kconfig that selects DRM_GEM_SHMEM_HELPER, forcing it built-in when Rust drivers need it; use cfg(CONFIG_RUST_DRM_GEM_SHMEM_HELPER) for the shmem module. * Add cfg_attr(not(CONFIG_RUST_DRM_GEM_SHMEM_HELPER), expect(unused)) on pub(crate) use impl_aref_for_gem_obj and BaseObjectPrivate, so that unused warnings are suppressed when shmem is not enabled. * Enable const_refs_to_static (stabilized in 1.83) to prevent build errors with older compilers. * Use &raw const for bindings::drm_gem_shmem_vm_ops and add #[allow(unused_unsafe, reason = "Safe since Rust 1.82.0")]. * Fix incorrect C Header path and minor spelling and formatting issues. * Drop shmem::Object::sg_table() as the current implementation is unsound. - Danilo ] Signed-off-by: Danilo Krummrich commit 89b4964c0456d9939a9f5187891a36bb87111e58 Author: Lyude Paul Date: Mon Mar 16 17:16:10 2026 -0400 rust: drm: gem: Add raw_dma_resv() function For retrieving a pointer to the struct dma_resv for a given GEM object. We also introduce it in a new trait, BaseObjectPrivate, which we automatically implement for all gem objects and don't expose to users outside of the crate. Signed-off-by: Lyude Paul Reviewed-by: Janne Grunau Tested-by: Janne Grunau Tested-by: Deborah Brouwer Link: https://patch.msgid.link/20260316211646.650074-3-lyude@redhat.com [ Fix incorrect reference in safety comment. - Danilo ] Signed-off-by: Danilo Krummrich commit a08d2e05a46f04cb545fd32ec081dfa8330cdd66 Author: Dave Marquardt Date: Tue Mar 24 11:56:25 2026 -0500 scsi: fc: Fix typo in fc_els.h Fixed spelling error in fe_els.h. Change "caause" to "cause". Signed-off-by: Dave Marquardt Link: https://patch.msgid.link/20260324-fix-typo-v1-1-601f4fde35bc@linux.ibm.com Signed-off-by: Martin K. Petersen commit 665fb6a64319412f0b811e7d32b25920a177d0ff Author: Kees Cook Date: Mon Mar 23 10:13:15 2026 -0700 scsi: target: Replace strncpy() with strscpy() in VPD dump functions Replace the deprecated[1] strncpy() with strscpy() in transport_dump_vpd_proto_id(), transport_dump_vpd_assoc(), transport_dump_vpd_ident_type(), and transport_dump_vpd_ident(). All four functions follow the same pattern: a local buf[VPD_TMP_BUF_SIZE] (254 bytes) is zeroed with memset(), populated via sprintf()/snprintf() (always NUL-terminated), then conditionally copied to p_buf with strncpy(). The p_buf destination is used as a C string by all callers in target_core_configfs.c: strlen(buf) and sprintf(page+len, "%s", buf) to build sysfs output. NUL-padding is not required: callers in target_core_configfs.c pre-zero p_buf with memset() or initializer before calling these functions, and consume p_buf only as a NUL-terminated C string via strlen() and "%s", never exposing trailing bytes. No behavioral change: the source buf is always NUL-terminated and shorter than VPD_TMP_BUF_SIZE, so strscpy() produces identical output. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook Reviewed-by: Kees Cook Link: https://patch.msgid.link/20260323171311.work.101-kees@kernel.org Signed-off-by: Martin K. Petersen commit 67557418905b103eaa7bacf81999be83accda334 Author: Arnd Bergmann Date: Mon Mar 23 10:57:39 2026 +0100 scsi: esas2r: Fix __printf annotation on esas2r_log_master() clang-22 started warning about functions that take printf format strings: drivers/scsi/esas2r/esas2r_log.c:160:50: error: diagnostic behavior may be improved by adding the 'format(printf, 3, 0)' attribute to the declaration of 'esas2r_log_master' [-Werror,-Wmissing-format-attribute] 121 | retval = vsnprintf(buffer, buflen, format, args); | ^ drivers/scsi/esas2r/esas2r_log.c:121:12: note: 'esas2r_log_master' declared here 121 | static int esas2r_log_master(const long level, | ^ The warning already got silenced for gcc but not clang in the past. Rather than modify that hack to turn it off for both, just add the attribute as suggested and remove the pragma again. Signed-off-by: Arnd Bergmann Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260323100027.1975646-1-arnd@kernel.org Signed-off-by: Martin K. Petersen commit 8ad1ddc50d15e35c4b38a207a6856eddfa731194 Author: Andy Shevchenko Date: Fri Mar 20 22:56:06 2026 +0100 scsi: ufs: rockchip: Drop unused include This driver includes the legacy header but does not use any symbols from it. Drop the inclusion. Signed-off-by: Andy Shevchenko Reviewed-by: Bart Van Assche Reviewed-by: Shawn Lin Link: https://patch.msgid.link/20260320215606.3236516-1-andriy.shevchenko@linux.intel.com Signed-off-by: Martin K. Petersen commit 9b836641d3bfa1ab096ec6263f0fa6880cb9c5ef Author: Asahi Lina Date: Fri Mar 20 16:08:26 2026 +0000 rust: helpers: Add bindings/wrappers for dma_resv_lock This is just for basic usage in the DRM shmem abstractions for implied locking, not intended as a full DMA Reservation abstraction yet. Cc: Sumit Semwal Cc: Christian König Signed-off-by: Asahi Lina Signed-off-by: Daniel Almeida Reviewed-by: Alice Ryhl Signed-off-by: Lyude Paul Reviewed-by: Janne Grunau Reviewed-by: Daniel Almeida Acked-by: David Airlie Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260320-gpuvm-rust-v5-2-76fd44f17a87@google.com Signed-off-by: Danilo Krummrich commit ebbe5d957efa09b6636065eeb984078d8e302e5f Author: Sachin Mokashi Date: Tue Mar 24 12:34:00 2026 -0400 ASoC: Intel: ehl_rt5660: remove unused macro definitions DUAL_CHANNEL and NAME_SIZE macros are not being used (anymore) but the macros are still defined. Remove them to clean up dead code. Signed-off-by: Sachin Mokashi Link: https://patch.msgid.link/20260324163400.1276247-1-sachin.mokashi@intel.com Signed-off-by: Mark Brown commit ae00200acb870ac00551350f26f03ced188bad6f Author: Shuming Fan Date: Fri Mar 27 16:23:31 2026 +0800 ASoC: SDCA: fix the register to ctl value conversion for Q7.8 format The division calculation should be implemented using signed integer format. This patch changes mc->shift from an unsigned type to a signed integer during the calculation. Fixes: 501efdcb3b3a ("ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops") Signed-off-by: Shuming Fan Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260327082331.2277498-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 553a127cb66523089bc10eb54640205495f4bb5b Author: Ethan Tidmore Date: Thu Mar 19 13:26:44 2026 -0500 iommu/riscv: Fix signedness bug The function platform_irq_count() returns negative error codes and iommu->irqs_count is an unsigned integer, so the check (iommu->irqs_count <= 0) is always impossible. Make the return value of platform_irq_count() be assigned to ret, check for error, and then assign iommu->irqs_count to ret. Detected by Smatch: drivers/iommu/riscv/iommu-platform.c:119 riscv_iommu_platform_probe() warn: 'iommu->irqs_count' unsigned <= 0 Signed-off-by: Ethan Tidmore Fixes: 5c0ebbd3c6c6 ("iommu/riscv: Add RISC-V IOMMU platform device driver") Reviewed-by: Andrew Jones Signed-off-by: Joerg Roedel commit 29990ab5cb408d5aa15939d6535e3291aeef748b Author: Gregory Price Date: Thu Mar 26 22:02:03 2026 -0400 cxl/core: use cleanup.h for devm_cxl_add_dax_region Cleanup the gotos in the function. No functional change. Signed-off-by: Gregory Price Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260327020203.876122-4-gourry@gourry.net Signed-off-by: Dave Jiang commit d747cf98f091e56beeed5233e8992fea59401011 Author: Gregory Price Date: Thu Mar 26 22:02:02 2026 -0400 cxl/core/region: move dax region device logic into region_dax.c core/region.c is overloaded with per-region control logic (pmem, dax, sysram, etc). Move the CXL DAX region device infrastructure from region.c into a new region_dax.c file. This will also allow us to add additional dax-driver integration paths that don't further dirty the core region.c logic. No functional changes. Signed-off-by: Gregory Price Co-developed-by: Ira Weiny Signed-off-by: Ira Weiny Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260327020203.876122-3-gourry@gourry.net Signed-off-by: Dave Jiang commit 8a1ec5fb2360d6fc0183cbe7de68c7a4e611d120 Author: Gregory Price Date: Thu Mar 26 22:02:01 2026 -0400 cxl/core/region: move pmem region driver logic into region_pmem.c core/region.c is overloaded with per-region control logic (pmem, dax, sysram, etc). Move the pmem region driver logic from region.c into region_pmem.c make it clear that this code only applies to pmem regions. No functional changes. [ dj: Fixed up some tabbing issues, may be from original code. ] Signed-off-by: Gregory Price Co-developed-by: Ira Weiny Signed-off-by: Ira Weiny Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260327020203.876122-2-gourry@gourry.net Signed-off-by: Dave Jiang commit 7caae0aed04137545e9f8c146d8d1dbb7a8e9865 Author: Kuninori Morimoto Date: Fri Mar 27 02:43:31 2026 +0000 ASoC: soc-core: remove unused dobj_list commit 8a9782346dccd ("ASoC: topology: Add topology core") added dobj_list to Component and Card, but Card side has never been used. Remove it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/874im2xa98.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9800e7741facc041d61490ae0d648a12687aae5d Merge: 472d77bdc511d9 00e981c7c0a1e7 Author: Mark Brown Date: Fri Mar 27 18:37:57 2026 +0000 ASoC: Drop some unused GPIO includes Linus Walleij says: This drops the unnecessary legacy includes from three more codecs. Link: https://patch.msgid.link/20260327-asoc-rt1318-v1-0-9fcecf868fda@kernel.org Signed-off-by: Mark Brown commit 00e981c7c0a1e7672a33fbe8c0b91e2fc6676782 Author: Linus Walleij Date: Fri Mar 27 00:26:40 2026 +0100 ASoC: ts3a227e: Drop unused include The driver includes the legacy GPIO header but does not use any symbols from it so drop the include. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260327-asoc-rt1318-v1-3-9fcecf868fda@kernel.org Signed-off-by: Mark Brown commit 175b2d025874d2798d34f670319e63fb5570cb2c Author: Linus Walleij Date: Fri Mar 27 00:26:39 2026 +0100 ASoC: nau8315: Drop unused include The driver includes the legacy GPIO header but does not use any symbols from it so drop the include. (It is already using the consumer header as is proper.) Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260327-asoc-rt1318-v1-2-9fcecf868fda@kernel.org Signed-off-by: Mark Brown commit 486c06451590fde1d4285fef744d419e46dba407 Author: Linus Walleij Date: Fri Mar 27 00:26:38 2026 +0100 ASoC: rt1318: Drop unused include The driver includes the legacy GPIO header but does not use any symbols from it so drop the include. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260327-asoc-rt1318-v1-1-9fcecf868fda@kernel.org Signed-off-by: Mark Brown commit 238aa43f0b77ea7db7f306e010f688c77439ee62 Author: Cheng-Yang Chou Date: Fri Mar 27 17:50:39 2026 +0800 sched_ext: Document why built-in DSQs are unsupported sources in scx_bpf_dsq_move_to_local() Add a comment explaining the design intent behind rejecting built-in DSQs (%SCX_DSQ_GLOBAL and %SCX_DSQ_LOCAL*) as sources. Local DSQs support reenqueueing but the BPF scheduler cannot directly iterate or move tasks from them. %SCX_DSQ_GLOBAL is similar but also doesn't support reenqueueing because it maps to multiple per-node DSQs, making the scope difficult to define. Also annotate @dsq_id to make clear it must be a user-created DSQ. Suggested-by: Tejun Heo Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit d6edb15ad92cb61386c46662a5ae245c7feac5f0 Author: Zhao Mengmeng Date: Fri Mar 27 14:17:57 2026 +0800 scx_central: Defer timer start to central dispatch to fix init error scx_central currently assumes that ops.init() runs on the selected central CPU and aborts otherwise. This is no longer true, as ops.init() is invoked from the scx_enable_helper thread, which can run on any CPU. As a result, sched_setaffinity() from userspace doesn't work, causing scx_central to fail when loading with: [ 1985.319942] sched_ext: central: scx_central.bpf.c:314: init from non-central CPU [ 1985.320317] scx_exit+0xa3/0xd0 [ 1985.320535] scx_bpf_error_bstr+0xbd/0x220 [ 1985.320840] bpf_prog_3a445a8163fa8149_central_init+0x103/0x1ba [ 1985.321073] bpf__sched_ext_ops_init+0x40/0xa8 [ 1985.321286] scx_root_enable_workfn+0x507/0x1650 [ 1985.321461] kthread_worker_fn+0x260/0x940 [ 1985.321745] kthread+0x303/0x3e0 [ 1985.321901] ret_from_fork+0x589/0x7d0 [ 1985.322065] ret_from_fork_asm+0x1a/0x30 DEBUG DUMP =================================================================== central: root scx_enable_help[134] triggered exit kind 1025: scx_bpf_error (scx_central.bpf.c:314: init from non-central CPU) Fix this by: - Defer bpf_timer_start() to the first dispatch on the central CPU. - Initialize the BPF timer in central_init() and kick the central CPU to guarantee entering the dispatch path on the central CPU immediately. - Remove the unnecessary sched_setaffinity() call in userspace. Suggested-by: Tejun Heo Signed-off-by: Zhao Mengmeng Signed-off-by: Tejun Heo commit e223258ed8a683d9debbb03ca1be0736f2c12e5b Author: Yeoreum Yun Date: Sat Mar 14 17:51:31 2026 +0000 arm64: armv8_deprecated: Disable swp emulation when FEAT_LSUI present The purpose of supporting LSUI is to eliminate PAN toggling. CPUs that support LSUI are unlikely to support a 32-bit runtime. Rather than emulating the SWP instruction using LSUI instructions in order to remove PAN toggling, simply disable SWP emulation. Signed-off-by: Yeoreum Yun [catalin.marinas@arm.com: some tweaks to the in-code comment] Signed-off-by: Catalin Marinas commit e4de6b910bf3645c224cd873d4e03ce3dd81fbe0 Author: Smita Koralahalli Date: Sun Mar 22 19:53:41 2026 +0000 dax/hmem, cxl: Defer and resolve Soft Reserved ownership The current probe time ownership check for Soft Reserved memory based solely on CXL window intersection is insufficient. dax_hmem probing is not always guaranteed to run after CXL enumeration and region assembly, which can lead to incorrect ownership decisions before the CXL stack has finished publishing windows and assembling committed regions. Introduce deferred ownership handling for Soft Reserved ranges that intersect CXL windows. When such a range is encountered during the initial dax_hmem probe, schedule deferred work to wait for the CXL stack to complete enumeration and region assembly before deciding ownership. Once the deferred work runs, evaluate each Soft Reserved range individually: if a CXL region fully contains the range, skip it and let dax_cxl bind. Otherwise, register it with dax_hmem. This per-range ownership model avoids the need for CXL region teardown and alloc_dax_region() resource exclusion prevents double claiming. Introduce a boolean flag dax_hmem_initial_probe to live inside device.c so it survives module reload. Ensure dax_cxl defers driver registration until dax_hmem has completed ownership resolution. dax_cxl calls dax_hmem_flush_work() before cxl_driver_register(), which both waits for the deferred work to complete and creates a module symbol dependency that forces dax_hmem.ko to load before dax_cxl. Co-developed-by: Dan Williams Signed-off-by: Smita Koralahalli Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260322195343.206900-9-Smita.KoralahalliChannabasappa@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 8e65f99b525b3f49b87db0db0d0e0fc1a0c53e40 Author: Smita Koralahalli Date: Sun Mar 22 19:53:40 2026 +0000 cxl/region: Add helper to check Soft Reserved containment by CXL regions Add a helper to determine whether a given Soft Reserved memory range is fully contained within the committed CXL region. This helper provides a primitive for policy decisions in subsequent patches such as co-ordination with dax_hmem to determine whether CXL has fully claimed ownership of Soft Reserved memory ranges. Signed-off-by: Smita Koralahalli Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260322195343.206900-8-Smita.KoralahalliChannabasappa@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 34f80bb969cc1710f336ea1878781780a59fc8e7 Author: Smita Koralahalli Date: Sun Mar 22 19:53:39 2026 +0000 dax: Track all dax_region allocations under a global resource tree Introduce a global "DAX Regions" resource root and register each dax_region->res under it via request_resource(). Release the resource on dax_region teardown. By enforcing a single global namespace for dax_region allocations, this ensures only one of dax_hmem or dax_cxl can successfully register a dax_region for a given range. Suggested-by: Dan Williams Signed-off-by: Smita Koralahalli Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260322195343.206900-7-Smita.KoralahalliChannabasappa@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 472d77bdc511d96434b3679ad022bfa35d3861c1 Author: Khushal Chitturi Date: Fri Mar 27 19:16:49 2026 +0530 ASoC: dt-bindings: mediatek,mt8173-rt5650-rt5514: convert to DT schema Convert the Mediatek MT8173 with RT5650 and RT5514 sound card bindings to DT schema. Signed-off-by: Khushal Chitturi Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260327134649.31376-1-khushalchitturi@gmail.com Signed-off-by: Mark Brown commit 39aa1d4be12bf9f685adaa06aa2d997c1c611b16 Author: Dan Williams Date: Sun Mar 22 19:53:38 2026 +0000 dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding Move hmem/ earlier in the dax Makefile so that hmem_init() runs before dax_cxl. In addition, defer registration of the dax_cxl driver to a workqueue instead of using module_cxl_driver(). This ensures that dax_hmem has an opportunity to initialize and register its deferred callback and make ownership decisions before dax_cxl begins probing and claiming Soft Reserved ranges. Mark the dax_cxl driver as PROBE_PREFER_ASYNCHRONOUS so its probe runs out of line from other synchronous probing avoiding ordering dependencies while coordinating ownership decisions with dax_hmem. Signed-off-by: Smita Koralahalli Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Tested-by: Tomasz Wolski Link: https://patch.msgid.link/20260322195343.206900-6-Smita.KoralahalliChannabasappa@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit edfcf1e21e79ddd6990a1330597c2eb072330832 Author: Dan Williams Date: Sun Mar 22 19:53:37 2026 +0000 dax/hmem: Gate Soft Reserved deferral on DEV_DAX_CXL Replace IS_ENABLED(CONFIG_CXL_REGION) with IS_ENABLED(CONFIG_DEV_DAX_CXL) so that HMEM only defers Soft Reserved ranges when CXL DAX support is enabled. This makes the coordination between HMEM and the CXL stack more precise and prevents deferral in unrelated CXL configurations. Signed-off-by: Smita Koralahalli Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260322195343.206900-5-Smita.KoralahalliChannabasappa@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 7b4bcaadfe00e2447c84378291e854ea87a2a41c Author: Dan Williams Date: Sun Mar 22 19:53:36 2026 +0000 dax/hmem: Request cxl_acpi and cxl_pci before walking Soft Reserved ranges Ensure cxl_acpi has published CXL Window resources before HMEM walks Soft Reserved ranges. Replace MODULE_SOFTDEP("pre: cxl_acpi") with an explicit, synchronous request_module("cxl_acpi"). MODULE_SOFTDEP() only guarantees eventual loading, it does not enforce that the dependency has finished init before the current module runs. This can cause HMEM to start before cxl_acpi has populated the resource tree, breaking detection of overlaps between Soft Reserved and CXL Windows. Also, request cxl_pci before HMEM walks Soft Reserved ranges. Unlike cxl_acpi, cxl_pci attach is asynchronous and creates dependent devices that trigger further module loads. Asynchronous probe flushing (wait_for_device_probe()) is added later in the series in a deferred context before HMEM makes ownership decisions for Soft Reserved ranges. Add an additional explicit Kconfig ordering so that CXL_ACPI and CXL_PCI must be initialized before DEV_DAX_HMEM. This prevents HMEM from consuming Soft Reserved ranges before CXL drivers have had a chance to claim them. Signed-off-by: Smita Koralahalli Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Tested-by: Tomasz Wolski Link: https://patch.msgid.link/20260322195343.206900-4-Smita.KoralahalliChannabasappa@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit d8d3e49b3821b30b8c6bc6d64d3242238c6386a6 Merge: 7dfe9846016b15 40927abf2fed04 Author: Rafael J. Wysocki Date: Fri Mar 27 18:15:53 2026 +0100 Merge back earlier Intel thermal drivers updates for 7.1 commit 116be1e112cbcb664887e44b74f27316a5fef861 Author: Smita Koralahalli Date: Sun Mar 22 19:53:35 2026 +0000 dax/hmem: Factor HMEM registration into __hmem_register_device() Separate the CXL overlap check from the HMEM registration path and keep the platform-device setup in a dedicated __hmem_register_device(). This makes hmem_register_device() the policy entry point for deciding whether a range should be deferred to CXL, while __hmem_register_device() handles the HMEM registration flow. No functional changes. Signed-off-by: Smita Koralahalli Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260322195343.206900-3-Smita.KoralahalliChannabasappa@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 14f2e2ebf31157a873536a7212502bd955b69647 Author: Smita Koralahalli Date: Sun Mar 22 19:53:34 2026 +0000 dax/bus: Use dax_region_put() in alloc_dax_region() error path alloc_dax_region() calls kref_init() on the dax_region early in the function, but the error path for sysfs_create_groups() failure uses kfree() directly to free the dax_region. This bypasses the kref lifecycle. Use dax_region_put() instead to handle kref lifecycle correctly. Suggested-by: Jonathan Cameron Signed-off-by: Smita Koralahalli Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260322195343.206900-2-Smita.KoralahalliChannabasappa@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 407f666db2b12c71744e5c897a74284768450578 Author: John Ogness Date: Thu Mar 26 14:44:02 2026 +0106 printk_ringbuffer: Add sanity check for 0-size data get_data() has a sanity check for regular data blocks to ensure at least space for the ID exists. But a regular block should also have at least 1 byte of data (otherwise it would be data-less instead of regular). Expand the get_data() block size sanity check to additionally expect at least 1 byte of data. Signed-off-by: John Ogness Reviewed-by: Petr Mladek Tested-by: Petr Mladek Link: https://patch.msgid.link/20260326133809.8045-2-john.ogness@linutronix.de Signed-off-by: Petr Mladek commit 8e81ecbf1cb46b8d2d13e772d5924b09bd60169a Author: John Ogness Date: Thu Mar 26 14:44:01 2026 +0106 printk_ringbuffer: Fix get_data() size sanity check Commit cc3bad11de6e ("printk_ringbuffer: Fix check of valid data size when blk_lpos overflows") added sanity checking to get_data() to avoid returning data of illegal sizes (too large or too small). It uses the helper function data_check_size() for the check. However, data_check_size() expects the size of the data, not the size of the data block. get_data() is providing the size of the data block. This means that if the data size (text_buf_size) is at or near the maximum legal size: sizeof(prb_data_block) + text_buf_size == DATA_SIZE(data_ring) / 2 data_check_size() will report failure because it adds sizeof(prb_data_block) to the provided size. The sanity check in get_data() is counting the data block header twice. The result is that the reader fails to read the legal record. Since get_data() subtracts the data block header size before returning, move the sanity check to after the subtraction. Luckily printk() is not vulnerable to this problem because truncate_msg() limits printk-messages to 1/4 of the ringbuffer. Indeed, by adjusting the printk_ringbuffer KUnit test, which does not use printk() and its truncate_msg() check, it is easy to see that the reader fails and the WARN_ON is triggered. Fixes: cc3bad11de6e ("printk_ringbuffer: Fix check of valid data size when blk_lpos overflows") Signed-off-by: John Ogness Reviewed-by: Petr Mladek Tested-by: Petr Mladek Link: https://patch.msgid.link/20260326133809.8045-1-john.ogness@linutronix.de Signed-off-by: Petr Mladek commit 5e961eebef3011697cfc0f0b7d8c4f31c5563c74 Merge: 01504da43e67f8 96f4c251a08721 Author: Alexei Starovoitov Date: Fri Mar 27 09:05:13 2026 -0700 Merge branch 'bpf-classify-block-device-hooks-and-add-selftests' Christian Brauner says: ==================== bpf: classify block device hooks and add selftests A bunch of new hooks for managing block devices were added a while ago but they weren't appropriately classified. Classify them and add a test program so we catch regressions. Note that for whatever reason building the bpf selftests locally seems to fail for all kinds of arcane reasons for me. That might just be my fault. I added a pr against the ci to have the selftests run but to test this meaningfully it needs veritysetup and dmverity support. I'm not sure if that's available already. Signed-off-by: Christian Brauner --- Changes in v2: - No changes. - Link to v1: https://patch.msgid.link/20260220-work-bpf-bdev-v1-0-c53e852c4702@kernel.org --- ==================== Link: https://patch.msgid.link/20260326-work-bpf-bdev-v2-0-5e3c58963987@kernel.org Signed-off-by: Alexei Starovoitov commit 96f4c251a08721ff4e0014f7b92ba12b44051b20 Author: Christian Brauner Date: Thu Mar 26 17:09:15 2026 +0100 selftests/bpf: add block device management selftests Add selftests to test block device tracking for bpf lsm programs. Signed-off-by: Christian Brauner Link: https://lore.kernel.org/r/20260326-work-bpf-bdev-v2-2-5e3c58963987@kernel.org Signed-off-by: Alexei Starovoitov commit 46df585fcff7a0de75c3752becc451934927db29 Author: Christian Brauner Date: Thu Mar 26 17:09:14 2026 +0100 bpf: classify block device hooks appropriately A bunch of new hooks for managing block devices were added a while ago but they weren't actually appropriately classified. * bpf_lsm_bdev_alloc() is called when the inode for the block device is allocated. This happens from a sleepable context so mark the function as sleepable. When this function is called the memory for the block device storage embedded into the inode is zeroed. That block device cannot be meaningfully reference or interacted with at this point. So mark it as untrusted for now. * bpf_lsm_bdev_free() is called when the inode for the block device is freed. A bunch of memory associated with the block device has already been freed and there's dangling pointers in there. So mark it as untrusted. It cannot be meaningfully referenced or interacted with anymore. It is also called from sb->s_op->free_inode:: which means it runs in rcu context (most of the times). So leave it as non-sleepable. * bpf_lsm_bdev_setintegrity() is called when a dm-verity device is instantiated (glossing over details for simplicity of the commit message). The block device is very much alive so it remains a trusted hook. It's also called with device mapper's suspend lock held and so the hook is able to sleep so mark it sleepable. Signed-off-by: Christian Brauner Link: https://lore.kernel.org/r/20260326-work-bpf-bdev-v2-1-5e3c58963987@kernel.org Signed-off-by: Alexei Starovoitov commit 70becc1a9b453ce04f97507585afc2cf47e67b11 Author: Koichiro Den Date: Fri Mar 6 12:14:43 2026 +0900 PCI: endpoint: pci-epf-vntb: Implement .get_dma_dev() When vNTB is used as a PCI endpoint function, the NTB device is backed by a virtual PCI function. For DMA API allocations and mappings, NTB clients must use the device that is associated with the IOMMU domain. Implement ntb_dev_ops->get_dma_dev() for pci-epf-vntb and return the EPC parent device. Suggested-by: Frank Li Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260306031443.1911860-4-den@valinux.co.jp commit 852b94ff92cbe26a0dbb15eed9474f5493767f3b Author: Koichiro Den Date: Fri Mar 6 12:14:42 2026 +0900 NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers ntb_transport currently uses ndev->pdev->dev for coherent allocations and frees. Switch the coherent buffer allocation/free paths to use ntb_get_dma_dev(), so ntb_transport can work with NTB implementations where the NTB PCI function is not the right device to use for DMA mappings. Suggested-by: Frank Li Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260306031443.1911860-3-den@valinux.co.jp commit 362a4549f2acfb03390ddfcd91041e65a11a739f Author: Koichiro Den Date: Fri Mar 6 12:14:41 2026 +0900 NTB: core: Add .get_dma_dev() callback to ntb_dev_ops Some NTB implementations are backed by a PCI function that is not the right struct device to use with DMA API helpers (e.g. due to IOMMU topology, or because the NTB device is virtual). Add an optional .get_dma_dev() callback to struct ntb_dev_ops and provide a helper, ntb_get_dma_dev(), so NTB clients can use the appropriate struct device for DMA allocations and mappings. If the callback is not implemented, ntb_get_dma_dev() returns the current default (ntb->dev.parent). Drivers that implement .get_dma_dev() must return a non-NULL device. Suggested-by: Frank Li Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam [bhelgaas: format doc] Signed-off-by: Bjorn Helgaas Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260306031443.1911860-2-den@valinux.co.jp commit 75e75445b9f39029c74d9071073745b5bf5315f4 Merge: 2b31e86387e60b 886f35201591de Author: Jens Axboe Date: Fri Mar 27 09:51:17 2026 -0600 Merge tag 'nvme-7.1-2026-03-27' of git://git.infradead.org/nvme into for-7.1/block Pull NVMe updates from Keith: "- Fabrics authentication updates (Eric, Alistar) - Enanced block queue limits support (Caleb) - Workqueue usage updates (Marco) - A new write zeroes device quirk (Robert) - Tagset cleanup fix for loop device (Nilay)" * tag 'nvme-7.1-2026-03-27' of git://git.infradead.org/nvme: (41 commits) nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown nvme: add WQ_PERCPU to alloc_workqueue users nvmet-fc: add WQ_PERCPU to alloc_workqueue users nvmet: replace use of system_wq with system_percpu_wq nvme-auth: Don't propose NVME_AUTH_DHGROUP_NULL with SC_C nvme: Add the DHCHAP maximum HD IDs nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set nvmet: report NPDGL and NPDAL nvmet: use NVME_NS_FEAT_OPTPERF_SHIFT nvme: set discard_granularity from NPDG/NPDA nvme: add from0based() helper nvme: always issue I/O Command Set specific Identify Namespace nvme: update nvme_id_ns OPTPERF constants nvme: fold nvme_config_discard() into nvme_update_disk_info() nvme: add preferred I/O size fields to struct nvme_id_ns_nvm nvme: Allow reauth from sysfs nvme: Expose the tls_configured sysfs for secure concat connections nvmet-tcp: Don't free SQ on authentication success nvmet-tcp: Don't error if TLS is enabed on a reset ... commit f0958d588e6de263224ca92087b45ce72fa25c91 Author: Sohil Mehta Date: Wed Mar 25 16:01:49 2026 -0700 x86/fred: Remove kernel log message when initializing exceptions When FRED is enabled, its initialization message is printed for every CPU during boot as well as during suspend-resume. This debug message can be noisy and it isn't very useful unless someone is debugging FRED itself. As FRED is enabled by default, remove the log message as mentioned in the code comment. Signed-off-by: Sohil Mehta Signed-off-by: H. Peter Anvin (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260325230151.1898287-4-hpa@zytor.com commit 4ce0a2ccc0358f3f746fa50815a599f861fd5d68 Author: Ben Horgan Date: Fri Mar 13 14:46:17 2026 +0000 arm64: mpam: Add initial MPAM documentation MPAM (Memory Partitioning and Monitoring) is now exposed to user-space via resctrl. Add some documentation so the user knows what features to expect. Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ben Horgan Reviewed-by: Gavin Shan Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Jesse Chick Signed-off-by: James Morse commit aeb8595a5f8ba4aac8b5c265a8bcc3f18b473cb5 Author: James Morse Date: Fri Mar 13 14:46:16 2026 +0000 arm_mpam: Quirk CMN-650's CSU NRDY behaviour CMN-650 is afflicted with an erratum where the CSU NRDY bit never clears. This tells us the monitor never finishes scanning the cache. The erratum document says to wait the maximum time, then ignore the field. Add a flag to indicate whether this is the final attempt to read the counter, and when this quirk is applied, ignore the NRDY field. This means accesses to this counter will always retry, even if the counter was previously programmed to the same values. The counter value is not expected to be stable, it drifts up and down with each allocation and eviction. The CSU register provides the value for a point in time. Tested-by: Punit Agrawal Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit dc48eb1ff27cc3169c3c5cca5eb20645d04d9e22 Author: Shanker Donthineni Date: Fri Mar 13 14:46:15 2026 +0000 arm_mpam: Add workaround for T241-MPAM-6 The registers MSMON_MBWU_L and MSMON_MBWU return the number of requests rather than the number of bytes transferred. Bandwidth resource monitoring is performed at the last level cache, where each request arrive in 64Byte granularity. The current implementation returns the number of transactions received at the last level cache but does not provide the value in bytes. Scaling by 64 gives an accurate byte count to match the MPAM specification for the MSMON_MBWU and MSMON_MBWU_L registers. This patch fixes the issue by reporting the actual number of bytes instead of the number of transactions from __ris_msmon_read(). Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Punit Agrawal Tested-by: Peter Newman Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Gavin Shan Signed-off-by: Shanker Donthineni Signed-off-by: Ben Horgan Signed-off-by: James Morse commit a7efe23ed6dd08259ad1b238e9c33bb511666fd4 Author: Shanker Donthineni Date: Fri Mar 13 14:46:14 2026 +0000 arm_mpam: Add workaround for T241-MPAM-4 In the T241 implementation of memory-bandwidth partitioning, in the absence of contention for bandwidth, the minimum bandwidth setting can affect the amount of achieved bandwidth. Specifically, the achieved bandwidth in the absence of contention can settle to any value between the values of MPAMCFG_MBW_MIN and MPAMCFG_MBW_MAX. Also, if MPAMCFG_MBW_MIN is set zero (below 0.78125%), once a core enters a throttled state, it will never leave that state. The first issue is not a concern if the MPAM software allows to program MPAMCFG_MBW_MIN through the sysfs interface. This patch ensures program MBW_MIN=1 (0.78125%) whenever MPAMCFG_MBW_MIN=0 is programmed. In the scenario where the resctrl doesn't support the MBW_MIN interface via sysfs, to achieve bandwidth closer to MBW_MAX in the absence of contention, software should configure a relatively narrow gap between MBW_MIN and MBW_MAX. The recommendation is to use a 5% gap to mitigate the problem. Clear the feature MBW_MIN feature from the class to ensure we don't accidentally change behaviour when resctrl adds support for a MBW_MIN interface. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Signed-off-by: Shanker Donthineni Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 70e81fbedc6570b2397e07a645136af0a0eec907 Author: Shanker Donthineni Date: Fri Mar 13 14:46:13 2026 +0000 arm_mpam: Add workaround for T241-MPAM-1 The MPAM bandwidth partitioning controls will not be correctly configured, and hardware will retain default configuration register values, meaning generally that bandwidth will remain unprovisioned. To address the issue, follow the below steps after updating the MBW_MIN and/or MBW_MAX registers. - Perform 64b reads from all 12 bridge MPAM shadow registers at offsets (0x360048 + slice*0x10000 + partid*8). These registers are read-only. - Continue iterating until all 12 shadow register values match in a loop. pr_warn_once if the values fail to match within the loop count 1000. - Perform 64b writes with the value 0x0 to the two spare registers at offsets 0x1b0000 and 0x1c0000. In the hardware, writes to the MPAMCFG_MBW_MAX MPAMCFG_MBW_MIN registers are transformed into broadcast writes to the 12 shadow registers. The final two writes to the spare registers cause a final rank of downstream micro-architectural MPAM registers to be updated from the shadow copies. The intervening loop to read the 12 shadow registers helps avoid a race condition where writes to the spare registers occur before all shadow registers have been updated. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Gavin Shan Signed-off-by: Shanker Donthineni Signed-off-by: Ben Horgan Signed-off-by: James Morse commit fa7745218c9828ac4849ef62bccad684aec0f422 Author: Shanker Donthineni Date: Fri Mar 13 14:46:12 2026 +0000 arm_mpam: Add quirk framework The MPAM specification includes the MPAMF_IIDR, which serves to uniquely identify the MSC implementation through a combination of implementer details, product ID, variant, and revision. Certain hardware issues/errata can be resolved using software workarounds. Introduce a quirk framework to allow workarounds to be enabled based on the MPAMF_IIDR value. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Signed-off-by: Shanker Donthineni Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Co-developed-by: James Morse Signed-off-by: James Morse commit 16ee07bfa935f4f36deba896956f57d388221944 Author: Takashi Iwai Date: Fri Mar 27 16:30:54 2026 +0100 ALSA: usb-audio: Extend max number of channels to 64 The current limitation of 16 as MAX_CHANNELS is rather historical at the time of UAC1 definition. As there seem already devices with a higher number of mixer channels, we should extend it too. As an ad hoc update, let's raise it to 64 so that it can still fit in a single long-long integer. Link: https://lore.kernel.org/F1B104A5-CD6A-4A26-AB46-14BF233C0579@getmailspring.com Tested-by: Phil Willoughby Link: https://patch.msgid.link/20260327153056.691575-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit fb481ec08699e9daf08ab839a79ab37b1bcca94d Author: James Morse Date: Fri Mar 13 14:46:11 2026 +0000 arm_mpam: resctrl: Call resctrl_init() on platforms that can support resctrl Now that MPAM links against resctrl, call resctrl_init() to register the filesystem and setup resctrl's structures. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 4aab135bda1661a795e4fe96418bf840833e1119 Author: James Morse Date: Fri Mar 13 14:46:10 2026 +0000 arm64: mpam: Select ARCH_HAS_CPU_RESCTRL Enough MPAM support is present to enable ARCH_HAS_CPU_RESCTRL. Let it rip^Wlink! ARCH_HAS_CPU_RESCTRL indicates resctrl can be enabled. It is enabled by the arch code simply because it has 'arch' in its name. This removes ARM_CPU_RESCTRL as a mimic of X86_CPU_RESCTRL. While here, move the ACPI dependency to the driver's Kconfig file. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Acked-by: Catalin Marinas Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit ec9a788620be1c11535fe99e9b2779f9eef2b099 Author: Takashi Iwai Date: Fri Mar 27 16:30:53 2026 +0100 ALSA: usb-audio: Replace hard-coded number with MAX_CHANNELS One place in mixer.c still used a hard-coded number 16 instead of MAX_CHANNELS. Replace with it, so that we can extend the max number of channels gracefully. Link: https://lore.kernel.org/F1B104A5-CD6A-4A26-AB46-14BF233C0579@getmailspring.com Tested-by: Phil Willoughby Link: https://patch.msgid.link/20260327153056.691575-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit efc775eadce2c6e0921c21d9c29a7b6686022281 Author: James Morse Date: Fri Mar 13 14:46:09 2026 +0000 arm_mpam: resctrl: Add empty definitions for assorted resctrl functions A few resctrl features and hooks need to be provided, but aren't needed or supported on MPAM platforms. resctrl has individual hooks to separately enable and disable the closid/partid and rmid/pmg context switching code. For MPAM this is all the same thing, as the value in struct task_struct is used to cache the value that should be written to hardware. arm64's context switching code is enabled once MPAM is usable, but doesn't touch the hardware unless the value has changed. For now event configuration is not supported, and can be turned off by returning 'false' from resctrl_arch_is_evt_configurable(). The new io_alloc feature is not supported either, always return false from the enable helper to indicate and fail the enable. Add this, and empty definitions for the other hooks. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 49b04e401825431529e866470d8d2dcd8e9ef058 Author: James Morse Date: Fri Mar 13 14:46:08 2026 +0000 arm_mpam: resctrl: Update the rmid reallocation limit resctrl's limbo code needs to be told when the data left in a cache is small enough for the partid+pmg value to be re-allocated. x86 uses the cache size divided by the number of rmid users the cache may have. Do the same, but for the smallest cache, and with the number of partid-and-pmg users. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit fb56b29932ca276df268806ad52ed80f40f99a6e Author: James Morse Date: Fri Mar 13 14:46:07 2026 +0000 arm_mpam: resctrl: Add resctrl_arch_rmid_read() resctrl uses resctrl_arch_rmid_read() to read counters. CDP emulation means the counter may need reading in three different ways. The helpers behind the resctrl_arch_ functions will be re-used for the ABMC equivalent functions. Add the rounding helper for checking monitor values while we're here. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Jesse Chick Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 2a3c79c61539779a09928893518c8286d7774b54 Author: James Morse Date: Fri Mar 13 14:46:06 2026 +0000 arm_mpam: resctrl: Allow resctrl to allocate monitors When resctrl wants to read a domain's 'QOS_L3_OCCUP', it needs to allocate a monitor on the corresponding resource. Monitors are allocated by class instead of component. Add helpers to allocate a CSU monitor. These helper return an out of range value for MBM counters. Allocating a montitor context is expected to block until hardware resources become available. This only makes sense for QOS_L3_OCCUP as unallocated MBM counters are losing data. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 1458c4f053355f88cc5d190ca02243d2c60fa010 Author: James Morse Date: Fri Mar 13 14:46:05 2026 +0000 arm_mpam: resctrl: Add support for csu counters resctrl exposes a counter via a file named llc_occupancy. This isn't really a counter as its value goes up and down, this is a snapshot of the cache storage usage monitor. Add some picking code which will only find an L3. The resctrl counter file is called llc_occupancy but we don't check it is the last one as it is already identified as L3. Tested-by: Shaopeng Tan Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Gavin Shan Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Dave Martin Signed-off-by: Dave Martin Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 264c285999fce128fc52743bce582468b26e9f65 Author: Ben Horgan Date: Fri Mar 13 14:46:04 2026 +0000 arm_mpam: resctrl: Add monitor initialisation and domain boilerplate Add the boilerplate that tells resctrl about the mpam monitors that are available. resctrl expects all (non-telemetry) monitors to be on the L3 and so advertise them there and invent an L3 resctrl resource if required. The L3 cache itself has to exist as the cache ids are used as the domain ids. Bring the resctrl monitor domains online and offline based on the cpus they contain. Support for specific monitor types is left to later. Tested-by: Punit Agrawal Reviewed-by: Zeng Heng Reviewed-by: Jonathan Cameron Signed-off-by: Ben Horgan Reviewed-by: Gavin Shan Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Jesse Chick Signed-off-by: James Morse commit 5dc8f73eaa5dfccb229b9a25c797720e6379f8e0 Author: Dave Martin Date: Fri Mar 13 14:46:03 2026 +0000 arm_mpam: resctrl: Add kunit test for control format conversions resctrl specifies the format of the control schemes, and these don't match the hardware. Some of the conversions are a bit hairy - add some kunit tests. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Signed-off-by: Dave Martin [morse: squashed enough of Dave's fixes in here that it's his patch now!] Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 36528c7681b8093f5f9270d2af7c4326d771f181 Author: James Morse Date: Fri Mar 13 14:46:02 2026 +0000 arm_mpam: resctrl: Add support for 'MB' resource resctrl supports 'MB', as a percentage throttling of traffic from the L3. This is the control that mba_sc uses, so ideally the class chosen should be as close as possible to the counters used for mbm_total. If there is a single L3, it's the last cache, and the topology of the memory matches then the traffic at the memory controller will be equivalent to that at egress of the L3. If these conditions are met allow the memory class to back MB. MB's percentage control should be backed either with the fixed point fraction MBW_MAX or bandwidth portion bitmaps. The bandwidth portion bitmaps is not used as its tricky to pick which bits to use to avoid contention, and may be possible to expose this as something other than a percentage in the future. Tested-by: Shaopeng Tan Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Gavin Shan Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Dave Martin Signed-off-by: Dave Martin Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit e68d494b8946e9060e60427f365107194f90ba0d Author: Thierry Reding Date: Thu Mar 26 12:28:31 2026 +0100 soc/tegra: bpmp: Use ENODEV instead of ENOTSUPP ENOTSUPP is not a SUSV4 error code and checkpatch will warn about it. It is also not very descriptive in the context of BPMP, so use the ENODEV error code instead. For the stub implementations this is a more accurate description of what the failure is. Signed-off-by: Thierry Reding commit 1c1e2968a860c5af9fca67f1c0e88aab83ace0b3 Author: Ben Horgan Date: Fri Mar 13 14:46:01 2026 +0000 arm_mpam: resctrl: Wait for cacheinfo to be ready In order to calculate the rmid realloc threshold the size of the cache needs to be known. Cache domains will also be named after the cache id. So that this information can be extracted from cacheinfo we need to wait for it to be ready. The cacheinfo information is populated in device_initcall() so we wait for that. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 3e9b35823aabcb85cc039960256426e50f1fd601 Author: Ben Horgan Date: Fri Mar 13 14:46:00 2026 +0000 arm_mpam: resctrl: Add rmid index helpers Because MPAM's pmg aren't identical to RDT's rmid, resctrl handles some data structures by index. This allows x86 to map indexes to RMID, and MPAM to map them to partid-and-pmg. Add the helpers to do this. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Suggested-by: James Morse Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 80d147d293130ee3c8a395cbbea1813e26ab9a1b Author: Dave Martin Date: Fri Mar 13 14:45:59 2026 +0000 arm_mpam: resctrl: Convert to/from MPAMs fixed-point formats MPAM uses a fixed-point formats for some hardware controls. Resctrl provides the bandwidth controls as a percentage. Add helpers to convert between these. Ensure bwa_wd is at most 16 to make it clear higher values have no meaning. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Signed-off-by: Dave Martin Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 01a0021f6c39557037bfc41ede7230a0696677ff Author: Ben Horgan Date: Fri Mar 13 14:45:58 2026 +0000 arm_mpam: resctrl: Hide CDP emulation behind CONFIG_EXPERT When CDP is not enabled, the 'rmid_entry's in the limbo list, rmid_busy_llc, map directly to a (PARTID,PMG) pair and when CDP is enabled the mapping is to two different pairs. As the limbo list is reused between mounts and CDP disabled on unmount this can lead to stale mapping and the limbo handler will then make monitor reads with potentially out of range PARTID. This may then cause an MPAM error interrupt and the driver will disable MPAM. No problems are expected if you just mount the resctrl file system once with CDP enabled and never unmount it. Hide CDP emulation behind CONFIG_EXPERT to protect the unwary. Signed-off-by: Ben Horgan Reviewed-by: Gavin Shan Reviewed-by: Zeng Heng Reviewed-by: James Morse Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Jesse Chick Signed-off-by: James Morse commit 6789fb99282c0a8e8e84701b7edf456f4a9e71e2 Author: James Morse Date: Fri Mar 13 14:45:57 2026 +0000 arm_mpam: resctrl: Add CDP emulation Intel RDT's CDP feature allows the cache to use a different control value depending on whether the accesses was for instruction fetch or a data access. MPAM's equivalent feature is the other way up: the CPU assigns a different partid label to traffic depending on whether it was instruction fetch or a data access, which causes the cache to use a different control value based solely on the partid. MPAM can emulate CDP, with the side effect that the alternative partid is seen by all MSC, it can't be enabled per-MSC. Add the resctrl hooks to turn this on or off. Add the helpers that match a closid against a task, which need to be aware that the value written to hardware is not the same as the one resctrl is using. Update the 'arm64_mpam_global_default' variable the arch code uses during context switch to know when the per-cpu value should be used instead. Also, update these per-cpu values and sync the resulting mpam partid/pmg configuration to hardware. resctrl can enable CDP for L2 caches, L3 caches or both. When it is enabled by one and not the other MPAM globally enabled CDP but hides the effect on the other cache resource. This hiding is possible as CPOR is the only supported cache control and that uses a resource bitmap; two partids with the same bitmap act as one. Awkwardly, the MB controls don't implement CDP and CDP can't be hidden as the memory bandwidth control is a maximum per partid which can't be modelled with more partids. If the total maximum is used for both the data and instruction partids then then the maximum may be exceeded and if it is split in two then the one using more bandwidth will hit a lower limit. Hence, hide the MB controls completely if CDP is enabled for any resource. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Cc: Dave Martin Cc: Amit Singh Tomar Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 9d2e1a99fae58ce992f147bdf83b5d9089f70b27 Author: James Morse Date: Fri Mar 13 14:45:56 2026 +0000 arm_mpam: resctrl: Add plumbing against arm64 task and cpu hooks arm64 provides helpers for changing a task's and a cpu's mpam partid/pmg values. These are used to back a number of resctrl_arch_ functions. Connect them up. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 9cd2b522be2cc64fab179d75537d2e8df38d26a6 Author: James Morse Date: Fri Mar 13 14:45:55 2026 +0000 arm_mpam: resctrl: Implement helpers to update configuration resctrl has two helpers for updating the configuration. resctrl_arch_update_one() updates a single value, and is used by the software-controller to apply feedback to the bandwidth controls, it has to be called on one of the CPUs in the resctrl:domain. resctrl_arch_update_domains() copies multiple staged configurations, it can be called from anywhere. Both helpers should update any changes to the underlying hardware. Implement resctrl_arch_update_domains() to use resctrl_arch_update_one(). Neither need to be called on a specific CPU as the mpam driver will send IPIs as needed. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 02cc661687886563a0e08ecee51c5ef7d1737237 Author: James Morse Date: Fri Mar 13 14:45:54 2026 +0000 arm_mpam: resctrl: Add resctrl_arch_get_config() Implement resctrl_arch_get_config() by testing the live configuration for a CPOR bitmap. For any other configuration type return the default. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 370d166d878d0c0aa06568d67387a1151a200501 Author: James Morse Date: Fri Mar 13 14:45:53 2026 +0000 arm_mpam: resctrl: Implement resctrl_arch_reset_all_ctrls() We already have a helper for resetting an mpam class and component. Hook it up to resctrl_arch_reset_all_ctrls() and the domain offline path. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Shaopeng Tan Reviewed-by: Zeng Heng Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 06c3b6c594625a2ca0ed292c889c427aa9914ae2 Author: Thierry Reding Date: Thu Mar 26 14:58:53 2026 +0100 arm64: tegra: Add PCI controllers on Tegra264 A total of six PCIe controllers can be found on Tegra264. One of them is used internally for the integrated GPU while the other five can go to a variety of connectors like full PCIe slots or M.2. Signed-off-by: Thierry Reding commit 52a4edb16121d07734e4e392767d26d286f08c35 Author: James Morse Date: Fri Mar 13 14:45:52 2026 +0000 arm_mpam: resctrl: Pick the caches we will use as resctrl resources Systems with MPAM support may have a variety of control types at any point of their system layout. We can only expose certain types of control, and only if they exist at particular locations. Start with the well-known caches. These have to be depth 2 or 3 and support MPAM's cache portion bitmap controls, with a number of portions fewer than resctrl's limit. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 69ec77b3f1074f3000d28f67f7629303e7999b84 Author: Jon Hunter Date: Thu Mar 5 15:16:59 2026 +0000 arm64: tegra: Fix RTC aliases The following warning is observed on the Tegra234 Jetson platforms ... rtc-nvidia-vrs10 4-003c: /aliases ID 0 not available This happens because the 'rtc@c2a0000' device is registered before the vrs10 RTC and so is assigned the 'rtc0' alias. We want the vrs10 RTC to be the default RTC because this RTC maintains time across power cycles. Fix this by adding a 'rtc1' alias for the 'rtc@c2a0000' device. Fixes: b1806f2b4e78 ("arm64: tegra: Add device-tree node for NVVRS RTC") Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit 8231b3dbd6c1343084cde94d38084f3b8160d1e1 Author: Thierry Reding Date: Mon Feb 23 15:33:05 2026 +0100 arm64: tegra: Drop redundant clock and reset names for TSEC The DT bindings don't allow the clock and reset names to be specified since there is only a single entry for each. Signed-off-by: Thierry Reding commit 51f10c527a63dc4a71bce4b40fc53eee78bbbd52 Author: Thierry Reding Date: Mon Feb 23 15:33:04 2026 +0100 arm64: tegra: Fix snps,blen properties The snps,blen property of stmmac-axi-config nodes needs to have 7 entries in total, with unsupported burst lengths listed as 0. Signed-off-by: Thierry Reding commit 09e61daf8e96b9bdb04dd112bdecf9382fd3f919 Author: James Morse Date: Fri Mar 13 14:45:51 2026 +0000 arm_mpam: resctrl: Add boilerplate cpuhp and domain allocation resctrl has its own data structures to describe its resources. We can't use these directly as we play tricks with the 'MBA' resource, picking the MPAM controls or monitors that best apply. We may export the same component as both L3 and MBA. Add mpam_resctrl_res[] as the array of class->resctrl mappings we are exporting, and add the cpuhp hooks that allocated and free the resctrl domain structures. Only the mpam control feature are considered here and monitor support will be added later. While we're here, plumb in a few other obvious things. CONFIG_ARM_CPU_RESCTRL is used to allow this code to be built even though it can't yet be linked against resctrl. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit ce651cd8e04d398902efe3ae08c78a4a943c1180 Merge: 6de23f81a5e08b 307ae94ef22f2b Author: Thierry Reding Date: Fri Mar 27 16:29:21 2026 +0100 Merge branch for-7.1/dt-bindings into for-7.1/pci commit 67faed4ccb4f4b8055f50e9cc5670f1fc09ea287 Author: James Morse Date: Fri Mar 13 14:45:50 2026 +0000 KVM: arm64: Force guest EL1 to use user-space's partid configuration While we trap the guest's attempts to read/write the MPAM control registers, the hardware continues to use them. Guest-EL0 uses KVM's user-space's configuration, as the value is left in the register, and guest-EL1 uses either the host kernel's configuration, or in the case of VHE, the UNKNOWN reset value of MPAM1_EL1. We want to force the guest-EL1 to use KVM's user-space's MPAM configuration. On nVHE rely on MPAM0_EL1 and MPAM1_EL1 always being programmed the same and on VHE copy MPAM0_EL1 into the guest's MPAM1_EL1. There is no need to restore as this is out of context once TGE is set. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Acked-by: Marc Zyngier Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 2cf9ca3fae38b7894e7f1435cec92f9a679b42f9 Author: James Morse Date: Fri Mar 13 14:45:49 2026 +0000 arm64: mpam: Add helpers to change a task or cpu's MPAM PARTID/PMG values Care must be taken when modifying the PARTID and PMG of a task in any per-task structure as writing these values may race with the task being scheduled in, and reading the modified values. Add helpers to set the task properties, and the CPU default value. These use WRITE_ONCE() that pairs with the READ_ONCE() in mpam_get_regval() to avoid causing torn values. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Cc: Dave Martin Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Catalin Marinas Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 37fe0f984d9ca60e8d95fc9a85d37f4300159625 Author: Ben Horgan Date: Fri Mar 13 14:45:48 2026 +0000 arm64: mpam: Initialise and context switch the MPAMSM_EL1 register The MPAMSM_EL1 sets the MPAM labels, PMG and PARTID, for loads and stores generated by a shared SMCU. Disable the traps so the kernel can use it and set it to the same configuration as the per-EL cpu MPAM configuration. If an SMCU is not shared with other cpus then it is implementation defined whether the configuration from MPAMSM_EL1 is used or that from the appropriate MPAMy_ELx. As we set the same, PMG_D and PARTID_D, configuration for MPAM0_EL1, MPAM1_EL1 and MPAMSM_EL1 the resulting configuration is the same regardless. The range of valid configurations for the PARTID and PMG in MPAMSM_EL1 is not currently specified in Arm Architectural Reference Manual but the architect has confirmed that it is intended to be the same as that for the cpu configuration in the MPAMy_ELx registers. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: Catalin Marinas Reviewed-by: James Morse Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 735dad999905dfd246be1994bb8d203063aeb0d6 Author: James Morse Date: Fri Mar 13 14:45:47 2026 +0000 arm64: mpam: Add cpu_pm notifier to restore MPAM sysregs The MPAM system registers will be lost if the CPU is reset during PSCI's CPU_SUSPEND. Add a PM notifier to restore them. mpam_thread_switch(current) can't be used as this won't make any changes if the in-memory copy says the register already has the correct value. In reality the system register is UNKNOWN out of reset. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: Catalin Marinas Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 831a7f16728c5ceef04ab99a699c3d9e519dc4b8 Author: James Morse Date: Fri Mar 13 14:45:46 2026 +0000 arm64: mpam: Advertise the CPUs MPAM limits to the driver Requesters need to populate the MPAM fields for any traffic they send on the interconnect. For the CPUs these values are taken from the corresponding MPAMy_ELx register. Each requester may have a limit on the largest PARTID or PMG value that can be used. The MPAM driver has to determine the system-wide minimum supported PARTID and PMG values. To do this, the driver needs to be told what each requestor's limit is. CPUs are special, but this infrastructure is also needed for the SMMU and GIC ITS. Call the helper to tell the MPAM driver what the CPUs can do. The return value can be ignored by the arch code as it runs well before the MPAM driver starts probing. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Catalin Marinas Reviewed-by: Gavin Shan Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan [ morse: requestor->requester as argued by ispell ] Signed-off-by: James Morse commit c544f00a473239835d22e7109b403314d8b85974 Author: Ben Horgan Date: Fri Mar 13 14:45:45 2026 +0000 arm64: mpam: Drop the CONFIG_EXPERT restriction In anticipation of MPAM being useful remove the CONFIG_EXPERT restriction. This was done to prevent the driver being enabled before the user-space interface was wired up. Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: James Morse Acked-by: Catalin Marinas Signed-off-by: Ben Horgan [ morse: Added second paragraph ] Signed-off-by: James Morse commit 87b78a5d70e83d4dbe31e1afda2be736a3330b31 Author: James Morse Date: Fri Mar 13 14:45:44 2026 +0000 arm64: mpam: Re-initialise MPAM regs when CPU comes online Now that the MPAM system registers are expected to have values that change, reprogram them based on the previous value when a CPU is brought online. Previously MPAM's 'default PARTID' of 0 was always used for MPAM in kernel-space as this is the PARTID that hardware guarantees to reset. Because there are a limited number of PARTID, this value is exposed to user-space, meaning resctrl changes to the resctrl default group would also affect kernel threads. Instead, use the task's PARTID value for kernel work on behalf of user-space too. The default of 0 is kept for both user-space and kernel-space when MPAM is not enabled. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: Catalin Marinas Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 8e06d04ff1cf764066c62e5677bfb0b0c1d1fbbc Author: James Morse Date: Fri Mar 13 14:45:43 2026 +0000 arm64: mpam: Context switch the MPAM registers MPAM allows traffic in the SoC to be labeled by the OS, these labels are used to apply policy in caches and bandwidth regulators, and to monitor traffic in the SoC. The label is made up of a PARTID and PMG value. The x86 equivalent calls these CLOSID and RMID, but they don't map precisely. MPAM has two CPU system registers that is used to hold the PARTID and PMG values that traffic generated at each exception level will use. These can be set per-task by the resctrl file system. (resctrl is the defacto interface for controlling this stuff). Add a helper to switch this. struct task_struct's separate CLOSID and RMID fields are insufficient to implement resctrl using MPAM, as resctrl can change the PARTID (CLOSID) and PMG (sort of like the RMID) separately. On x86, the rmid is an independent number, so a race that writes a mismatched closid and rmid into hardware is benign. On arm64, the pmg bits extend the partid. (i.e. partid-5 has a pmg-0 that is not the same as partid-6's pmg-0). In this case, mismatching the values will 'dirty' a pmg value that resctrl believes is clean, and is not tracking with its 'limbo' code. To avoid this, the partid and pmg are always read and written as a pair. This requires a new u64 field. In struct task_struct there are two u32, rmid and closid for the x86 case, but as we can't use them here do something else. Add this new field, mpam_partid_pmg, to struct thread_info to avoid adding more architecture specific code to struct task_struct. Always use READ_ONCE()/WRITE_ONCE() when accessing this field. Resctrl allows a per-cpu 'default' value to be set, this overrides the values when scheduling a task in the default control-group, which has PARTID 0. The way 'code data prioritisation' gets emulated means the register value for the default group needs to be a variable. The current system register value is kept in a per-cpu variable to avoid writing to the system register if the value isn't going to change. Writes to this register may reset the hardware state for regulating bandwidth. Finally, there is no reason to context switch these registers unless there is a driver changing the values in struct task_struct. Hide the whole thing behind a static key. This also allows the driver to disable MPAM in response to errors reported by hardware. Move the existing static key to belong to the arch code, as in the future the MPAM driver may become a loadable module. All this should depend on whether there is an MPAM driver, hide it behind CONFIG_ARM64_MPAM. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick CC: Amit Singh Tomar Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: Catalin Marinas Co-developed-by: Ben Horgan Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 2e7c684bdb50cfaf98da80ebaab4a961fdcd1aa2 Author: Ben Horgan Date: Fri Mar 13 14:45:42 2026 +0000 KVM: arm64: Make MPAMSM_EL1 accesses UNDEF The MPAMSM_EL1 register controls the MPAM labeling for an SMCU, Streaming Mode Compute Unit. As there is no MPAM support in KVM, make sure MPAMSM_EL1 accesses trigger an UNDEF. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Acked-by: Marc Zyngier Signed-off-by: Ben Horgan Signed-off-by: James Morse commit eda1cd1f9d29b382a07d757cf8b29f9ee636355f Author: Ben Horgan Date: Fri Mar 13 14:45:41 2026 +0000 KVM: arm64: Preserve host MPAM configuration when changing traps When KVM enables or disables MPAM traps to EL2 it clears all other bits in MPAM2_EL2. Notably, it clears the partition ids (PARTIDs) and performance monitoring groups (PMGs). Avoid changing these bits in anticipation of adding support for MPAM in the kernel. Otherwise, on a VHE system with the host running at EL2 where MPAM2_EL2 and MPAM1_EL1 access the same register, any attempt to use MPAM to monitor or partition resources for kernel space would be foiled by running a KVM guest. Additionally, MPAM2_EL2.EnMPAMSM is always set to 0 which causes MPAMSM_EL1 to always trap. Keep EnMPAMSM set to 1 when not in a guest so that the kernel can use MPAMSM_EL1. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Acked-by: Marc Zyngier Signed-off-by: Ben Horgan Signed-off-by: James Morse commit 29fa1be82b83f87e603ed4c21fe86c6e05fd0282 Author: Ben Horgan Date: Fri Mar 13 14:45:40 2026 +0000 arm64/sysreg: Add MPAMSM_EL1 register The MPAMSM_EL1 register determines the MPAM configuration for an SMCU. Add the register definition. Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Zeng Heng Tested-by: Punit Agrawal Tested-by: Jesse Chick Reviewed-by: Zeng Heng Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Acked-by: Catalin Marinas Signed-off-by: Ben Horgan Signed-off-by: James Morse commit a1cb6577f575ba5ec2583caf4f791a86754dbf69 Author: Ben Horgan Date: Fri Mar 13 14:45:39 2026 +0000 arm_mpam: Reset when feature configuration bit unset To indicate that the configuration, of the controls used by resctrl, in a RIS need resetting to driver defaults the reset flags in mpam_config are set. However, these flags are only ever set temporarily at RIS scope in mpam_reset_ris() and hence mpam_cpu_online() will never reset these controls to default. As the hardware reset is unknown this leads to unknown configuration when the control values haven't been configured away from the defaults. Use the policy that an unset feature configuration bit means reset. In this way the mpam_config in the component can encode that it should be in reset state and mpam_reprogram_msc() will reset controls as needed. Fixes: 09b89d2a72f3 ("arm_mpam: Allow configuration to be applied and restored during cpu online") Signed-off-by: Ben Horgan Reviewed-by: Gavin Shan Reviewed-by: James Morse Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Jesse Chick [ morse: Removed unused reset flags from config structure ] Signed-off-by: James Morse commit be09645037b43dffb2efe3c1b6c408ce0ed70c1c Author: Svyatoslav Ryhel Date: Mon Feb 23 08:54:59 2026 +0200 dt-bindings: display: tegra: Document Tegra20 HDMI port Tegra HDMI can be modeled using an OF graph. Reflect this in the bindings. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit c65fe807b8469210b17461dd71b7bc0a1db37765 Author: Sumit Gupta Date: Wed Mar 25 18:27:25 2026 +0530 dt-bindings: arm: tegra: Add Tegra238 CBB compatible strings Add compatible strings for CBB v2.0 based fabrics (APE, AON, BPMP and CBB) on Tegra238. Signed-off-by: Sumit Gupta Acked-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 307ae94ef22f2b0e11e3fd9237c1157ae6fc10f5 Author: Thierry Reding Date: Thu Mar 26 14:58:50 2026 +0100 dt-bindings: pci: Document the NVIDIA Tegra264 PCIe controller The six PCIe controllers found on Tegra264 are of two types: one is used for the internal GPU and therefore is not connected to a UPHY and the remaining five controllers are typically routed to a PCI slot and have additional controls for the physical link. While these controllers can be switched into endpoint mode, this binding describes the root complex mode only. Reviewed-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit ffff5e7275516f274fac53ab5496f26481b4b1b9 Author: Thierry Reding Date: Mon Feb 23 15:33:03 2026 +0100 dt-bindings: memory: tegra210: Mark EMC as cooling device The external memory controller found on Tegra210 can use throttling of the EMC frequency in order to reduce the memory chip temperature. Mark the memory controller as a cooling device to take advantage of this functionality. Reviewed-by: Rob Herring Signed-off-by: Thierry Reding commit 834e6bd48dd440b292d741138a7a87118ae9d95a Author: Thierry Reding Date: Mon Feb 23 15:33:02 2026 +0100 dt-bindings: memory: Add Tegra210 memory controller bindings Document the bindings for the memory controller found on Tegra210 SoCs. Reviewed-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit 99250f7553ea8e09b160ac290f5f22ac986e7c4a Author: Thierry Reding Date: Mon Feb 23 15:33:01 2026 +0100 dt-bindings: phy: tegra: Document Tegra210 USB PHY Add a compatible string for the USB PHY found on Tegra210 SoCs. Acked-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit 37420acce494ca69e30c0a98e868f357ae2509f5 Author: Thierry Reding Date: Mon Feb 23 15:33:00 2026 +0100 dt-bindings: arm: tegra: Add missing compatible strings The Nyan Blaze and Nyan Big, as well as Jetson Nano (P3450-0000), Darcy (P2894-0050-A08) and Pixel C (Smaug) were never mentioned. Add them. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit cafacd15e84d0b8163f2df92555a265e0b84e236 Author: Thierry Reding Date: Mon Feb 23 15:32:59 2026 +0100 dt-bindings: interrupt-controller: tegra: Fix reg entries Tegra210 takes exactly 6 "reg" property entries, as opposed to Tegra30 which supports only 5 entries. Reviewed-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit 6413bfc1f6aea376d953760f5dacc59cef481bdc Author: Thierry Reding Date: Mon Feb 23 15:32:58 2026 +0100 dt-bindings: clock: tegra124-dfll: Convert to json-schema Convert the Tegra124 (and later) DFLL bindings from the free-form text format to json-schema. Co-developed-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) Reviewed-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit d4e0199bb5545acdfe5ce9d8046f4f35c95d6b8a Author: Thierry Reding Date: Mon Feb 23 15:32:56 2026 +0100 dt-bindings: phy: tegra-xusb: Document Type C support Each XUSB PHY can be hooked up to a Type C controller via a port property, so document this in the bindings accordingly. Reviewed-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit f91e913355f49c878fc77f995fd71b7800352bd2 Author: Zeng Heng Date: Fri Mar 13 14:45:38 2026 +0000 arm_mpam: Ensure in_reset_state is false after applying configuration The per-RIS flag, in_reset_state, indicates whether or not the MSC registers are in reset state, and allows avoiding resetting when they are already in reset state. However, when mpam_apply_config() updates the configuration it doesn't update the in_reset_state flag and so even after the configuration update in_reset_state can be true and mpam_reset_ris() will skip the actual register restoration on subsequent resets. Once resctrl has a MPAM backend it will use resctrl_arch_reset_all_ctrls() to reset the MSC configuration on unmount and, if the in_reset_state flag is bogusly true, fail to reset the MSC configuration. The resulting non-reset MSC configuration can lead to persistent performance restrictions even after resctrl is unmounted. Fix by clearing in_reset_state to false immediately after successful configuration application, ensuring that the next reset operation properly restores MSC register defaults. Fixes: 09b89d2a72f3 ("arm_mpam: Allow configuration to be applied and restored during cpu online") Signed-off-by: Zeng Heng Acked-by: Ben Horgan [Horgan: rewrite commit message to not be specific to resctrl unmount] Signed-off-by: Ben Horgan Reviewed-by: Gavin Shan Reviewed-by: Jonathan Cameron Reviewed-by: James Morse Tested-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Jesse Chick Signed-off-by: James Morse commit 77344118720e31dcbac47d13c35da3b1de663529 Author: Thierry Reding Date: Thu Mar 26 14:58:49 2026 +0100 firmware: tegra: bpmp: Add tegra_bpmp_get_with_id() function Some device tree bindings need to specify a parameter along with a BPMP phandle reference to designate the ID associated with a given controller that needs to interoperate with BPMP. Typically this is specified as an extra cell in the nvidia,bpmp property, so add a helper to parse this ID while resolving the phandle reference. Signed-off-by: Thierry Reding commit 83c18a324570193140cafc12c88eb1e370564078 Author: Thierry Reding Date: Thu Mar 26 14:58:48 2026 +0100 soc/tegra: Update BPMP ABI header This update primarily adds various new commands and MRQs for Tegra264, but also contains a few new annotations and fixes. Signed-off-by: Thierry Reding commit 8cb081667377709f4924ab6b3a88a0d7a761fe91 Author: Ilpo Järvinen Date: Tue Mar 24 18:56:33 2026 +0200 PCI: Fix alignment calculation for resource size larger than align The commit bc75c8e50711 ("PCI: Rewrite bridge window head alignment function") did not use if (r_size <= align) check from pbus_size_mem() for the new head alignment bookkeeping structure (aligns2[]). In some configurations, this can result in producing a gap into the bridge window which the resource larger than its alignment cannot fill. The old alignment calculation algorithm was removed by the subsequent commit 3958bf16e2fe ("PCI: Stop over-estimating bridge window size") which renamed the aligns2[] array leaving only aligns[] array. Add the if (r_size <= align) check back to avoid this problem. Fixes: bc75c8e50711 ("PCI: Rewrite bridge window head alignment function") Reported-by: Guenter Roeck Closes: https://lore.kernel.org/all/b05a6f14-979d-42c9-924c-d8408cb12ae7@roeck-us.net/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Xifer Link: https://patch.msgid.link/20260324165633.4583-11-ilpo.jarvinen@linux.intel.com commit 9036bd0efcb6162a77f3bf9bacbafba7686c7275 Author: Ilpo Järvinen Date: Tue Mar 24 18:56:32 2026 +0200 PCI: Align head space better When a bridge window contains big and small resource(s), the small resource(s) may not amount to the half of the size of the big resource which would allow calculate_head_align() to shrink the head alignment. This results in always placing the small resource(s) after the big resource. In general, it would be good to be able to place the small resource(s) before the big resource to achieve better utilization of the address space. In the cases where the large resource can only fit at the end of the window, it is even required. However, carrying the information over from pbus_size_mem() and calculate_head_align() to __pci_assign_resource() and pcibios_align_resource() is not easy with the current data structures. A somewhat hacky way to move the non-aligning tail part to the head is possible within pcibios_align_resource(). The free space between the start of the free space span and the aligned start address can be compared with the non-aligning remainder of the size. If the free space is larger than the remainder, placing the remainder before the start address is possible. This relocation should generally work, because PCI resources consist only power-of-2 atoms. Various arch requirements may still need to override the relocation, so the relocation is only applied selectively in such cases. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221205 Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Xifer Link: https://patch.msgid.link/20260324165633.4583-10-ilpo.jarvinen@linux.intel.com commit 8bbe8cec891f88dd3de8cae44812a884e10f1446 Author: Ilpo Järvinen Date: Tue Mar 24 18:56:31 2026 +0200 PCI: Rename window_alignment() to pci_min_window_alignment() window_alignment() lacks prefix. Rename it to pci_min_window_alignment() in order to include the prefix and also add min to indicate the returned window alignment is the minimum PCI spec and arch allows. Also make it available in drivers/pci/pci.h as upcoming changes will need to call it from outside of setup-bus.c. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Xifer Link: https://patch.msgid.link/20260324165633.4583-9-ilpo.jarvinen@linux.intel.com commit 38ec53e16fe51c427bd1c7ed50be2bcc3db4f01a Author: Ilpo Järvinen Date: Tue Mar 24 18:56:30 2026 +0200 parisc/PCI: Clean up align handling Caller of pcibios_align_resource() (__find_resource_space()) already aligns the start address by 'alignment' so aligning is only necessary if align > alignment. Change also to use ALIGN() instead of open-coding. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260324165633.4583-8-ilpo.jarvinen@linux.intel.com commit 3fa40d305ba185882479ee90ff71b9034622bf85 Author: Ilpo Järvinen Date: Tue Mar 24 18:56:29 2026 +0200 MIPS: PCI: Remove unnecessary second application of align Aligning res->start by align inside pcibios_align_resource() is unnecessary because caller of pcibios_align_resource() is __find_resource_space() that aligns res->start with align before calling pcibios_align_resource(). Aligning by align in case of IORESOURCE_IO && start & 0x300 cannot ever result in changing start either because 0x300 bits would have not survived the earlier alignment if align was large enough to have an impact. Thus, remove the duplicated aligning from pcibios_align_resource(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260324165633.4583-7-ilpo.jarvinen@linux.intel.com commit 4dd6e1aa35dcf616805eaf330bd731fd8f0da6d1 Author: Ilpo Järvinen Date: Tue Mar 24 18:56:28 2026 +0200 m68k/PCI: Remove unnecessary second application of align Aligning res->start by align inside pcibios_align_resource() is unnecessary because caller of pcibios_align_resource() is __find_resource_space() that aligns res->start with align before calling pcibios_align_resource(). Aligning by align in case of IORESOURCE_IO && start & 0x300 cannot ever result in changing start either because 0x300 bits would have not survived the earlier alignment if align was large enough to have an impact. Thus, remove the duplicated aligning from pcibios_align_resource(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Acked-by: Greg Ungerer Link: https://patch.msgid.link/20260324165633.4583-6-ilpo.jarvinen@linux.intel.com commit 0734cb2412f5fdc06fac6c1e6f3046085a4fdf23 Author: Ilpo Järvinen Date: Tue Mar 24 18:56:27 2026 +0200 ARM/PCI: Remove unnecessary second application of align Aligning res->start by align inside pcibios_align_resource() is unnecessary because caller of pcibios_align_resource() is __find_resource_space() that aligns res->start with align before calling pcibios_align_resource(). Aligning by align in case of IORESOURCE_IO && start & 0x300 cannot ever result in changing start either because 0x300 bits would have not survived the earlier alignment if align was large enough to have an impact. Thus, remove the duplicated aligning from pcibios_align_resource(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260324165633.4583-5-ilpo.jarvinen@linux.intel.com commit 66475b5dc4e4f88f1ed6f403067e08bd90286af5 Author: Ilpo Järvinen Date: Tue Mar 24 18:56:26 2026 +0200 resource: Rename 'tmp' variable to 'full_avail' __find_resource_space() has variable called 'tmp'. Rename it to 'full_avail' to better indicate its purpose. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Xifer Link: https://patch.msgid.link/20260324165633.4583-4-ilpo.jarvinen@linux.intel.com commit f699bcc8bcdf99565928a7b1fc7ee656f6c81815 Author: Ilpo Järvinen Date: Tue Mar 24 18:56:25 2026 +0200 resource: Pass full extent of empty space to resource_alignf callback __find_resource_space() calculates the full extent of empty space but only passes the aligned space to resource_alignf callback. In some situations, the callback may choose take advantage of the free space before the requested alignment. Pass the full extent of the calculated empty space to resource_alignf callback as an additional parameter. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Xifer Link: https://patch.msgid.link/20260324165633.4583-3-ilpo.jarvinen@linux.intel.com commit 48170e7e39f8b165c2ef2e5056994623a78e3ee8 Author: Svyatoslav Ryhel Date: Mon Jan 26 21:15:33 2026 +0200 ARM: tegra: Add External Memory Controller node on Tegra114 Add External Memory Controller node to the device-tree. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit 8577a898af63d2ecfa121bd7270aecf5b65dd23d Author: Svyatoslav Ryhel Date: Mon Jan 26 21:15:32 2026 +0200 ARM: tegra: Add ACTMON node to Tegra114 device tree Add support for ACTMON on Tegra114. This is used to monitor activity from different components. Based on the collected statistics, the rate at which the external memory needs to be clocked can be derived. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit ac66a73be03a0a72aeeb33d3610cfc43cb101a0b Author: H. Peter Anvin Date: Wed Mar 25 16:01:47 2026 -0700 x86/fred: Enable FRED by default When FRED was added to the mainline kernel, it was set up as an explicit opt-in due to the risk of regressions before hardware was available publicly. Now, Panther Lake (Core Ultra 300 series) has been released, and benchmarking by Phoronix has shown that it provides a significant performance benefit on most workloads: https://www.phoronix.com/review/intel-fred-panther-lake Accordingly, enable FRED by default if the CPU supports it. FRED can of course still be disabled via the fred=off command line option. Touch up Kconfig help too. Signed-off-by: H. Peter Anvin (Intel) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Sohil Mehta Link: https://patch.msgid.link/20260325230151.1898287-2-hpa@zytor.com commit f22416f4f139d1d61613b0a305534a8c1a7273d1 Author: Svyatoslav Ryhel Date: Mon Jan 26 12:10:17 2026 +0200 ARM: tegra: lg-x3: Add node for capacitive buttons Both smartphones have capacitive buttons but only P895 supports RMI4 function 1A (0D touch), while P880 exposes buttons area as a region of the touchscreen. Signed-off-by: Svyatoslav Ryhel Signed-off-by: Thierry Reding commit 52b266ffbe3987279893bdaa0e5e70054a4f5f8c Author: Svyatoslav Ryhel Date: Mon Jan 26 12:10:16 2026 +0200 ARM: tegra: lg-x3: Add USB and power related nodes Add missing charger, MUIC and ADC sensor nodes. Reconfigure USB, set one of the ADC channels as the fuel gauge temperature sensor and add a battery thermal zone. Signed-off-by: Svyatoslav Ryhel Signed-off-by: Thierry Reding commit e045ba8a5684ec7a7821ede67c5f305609d6236c Author: Svyatoslav Ryhel Date: Mon Jan 26 12:10:15 2026 +0200 ARM: tegra: lg-x3: Add panel and bridge nodes Add RGB-DSI bridge and panel nodes to LG Optimus 4X and Vu device trees. Signed-off-by: Svyatoslav Ryhel Signed-off-by: Thierry Reding commit 6369fd1d0e69b17664b553bd45c3d03d1cdcd214 Author: Svyatoslav Ryhel Date: Thu Dec 4 08:06:19 2025 +0200 ARM: tn7: Adjust panel node Adjust panel node in Tegra Note 7 according to the updated schema. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit 4fba78552c9367fd27fb9fbc492e20212bff4735 Author: Svyatoslav Ryhel Date: Thu Aug 28 08:51:04 2025 +0300 ARM: tegra: Add SOCTHERM support on Tegra114 Add SOCTHERM and thermal zones nodes into common Tegra 4 device tree. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit 886f35201591ded7958e16fe3750871d3ca0bcdf Author: Nilay Shroff Date: Fri Mar 13 17:08:48 2026 +0530 nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown Cancelling the I/O and admin tagsets during nvme-loop controller reset or shutdown is unnecessary. The subsequent destruction of the I/O and admin queues already waits for all in-flight target operations to complete. Cancelling the tagsets first also opens a race window. After a request tag has been cancelled, a late completion from the target may still arrive before the queues are destroyed. In that case the completion path may access a request whose tag has already been cancelled or freed, which can lead to a kernel crash. Please see below the kernel crash encountered while running blktests nvme/040: run blktests nvme/040 at 2026-03-08 06:34:27 loop0: detected capacity change from 0 to 2097152 nvmet: adding nsid 1 to subsystem blktests-subsystem-1 nvmet: Created nvm controller 1 for subsystem blktests-subsystem-1 for NQN nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349. nvme nvme6: creating 96 I/O queues. nvme nvme6: new ctrl: "blktests-subsystem-1" nvme_log_error: 1 callbacks suppressed block nvme6n1: no usable path - requeuing I/O nvme6c6n1: Read(0x2) @ LBA 2096384, 128 blocks, Host Aborted Command (sct 0x3 / sc 0x71) blk_print_req_error: 1 callbacks suppressed I/O error, dev nvme6c6n1, sector 2096384 op 0x0:(READ) flags 0x2880700 phys_seg 1 prio class 2 block nvme6n1: no usable path - requeuing I/O Kernel attempted to read user page (236) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000236 Faulting instruction address: 0xc000000000961274 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: nvme_loop nvme_fabrics loop nvmet null_blk rpadlpar_io rpaphp xsk_diag bonding rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink pseries_rng dax_pmem vmx_crypto drm drm_panel_orientation_quirks xfs mlx5_core nvme bnx2x sd_mod nd_pmem nd_btt nvme_core sg papr_scm tls libnvdimm ibmvscsi ibmveth scsi_transport_srp nvme_keyring nvme_auth mdio hkdf pseries_wdt dm_mirror dm_region_hash dm_log dm_mod fuse [last unloaded: loop] CPU: 25 UID: 0 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 7.0.0-rc3+ #14 PREEMPT Hardware name: IBM,9043-MRX Power11 (architected) 0x820200 0xf000007 of:IBM,FW1120.00 (RF1120_128) hv:phyp pSeries NIP: c000000000961274 LR: c008000009af1808 CTR: c00000000096124c REGS: c0000007ffc0f910 TRAP: 0300 Not tainted (7.0.0-rc3+) MSR: 8000000000009033 CR: 22222222 XER: 00000000 CFAR: c008000009af232c DAR: 0000000000000236 DSISR: 40000000 IRQMASK: 0 GPR00: c008000009af17fc c0000007ffc0fbb0 c000000001c78100 c0000000be05cc00 GPR04: 0000000000000001 0000000000000000 0000000000000007 0000000000000000 GPR08: 0000000000000000 0000000000000000 0000000000000002 c008000009af2318 GPR12: c00000000096124c c0000007ffdab880 0000000000000000 0000000000000000 GPR16: 0000000000000010 0000000000000000 0000000000000004 0000000000000000 GPR20: 0000000000000001 c000000002ca2b00 0000000100043bb2 000000000000000a GPR24: 000000000000000a 0000000000000000 0000000000000000 0000000000000000 GPR28: c000000084021d40 c000000084021d50 c0000000be05cd60 c0000000be05cc00 NIP [c000000000961274] blk_mq_complete_request_remote+0x28/0x2d4 LR [c008000009af1808] nvme_loop_queue_response+0x110/0x290 [nvme_loop] Call Trace: 0xc00000000502c640 (unreliable) nvme_loop_queue_response+0x104/0x290 [nvme_loop] __nvmet_req_complete+0x80/0x498 [nvmet] nvmet_req_complete+0x24/0xf8 [nvmet] nvmet_bio_done+0x58/0xcc [nvmet] bio_endio+0x250/0x390 blk_update_request+0x2e8/0x68c blk_mq_end_request+0x30/0x5c lo_complete_rq+0x94/0x110 [loop] blk_complete_reqs+0x78/0x98 handle_softirqs+0x148/0x454 do_softirq_own_stack+0x3c/0x50 __irq_exit_rcu+0x18c/0x1b4 irq_exit+0x1c/0x34 do_IRQ+0x114/0x278 hardware_interrupt_common_virt+0x28c/0x290 Since the queue teardown path already guarantees that all target-side operations have completed, cancelling the tagsets is redundant and unsafe. So avoid cancelling the I/O and admin tagsets during controller reset and shutdown. Reviewed-by: Christoph Hellwig Signed-off-by: Nilay Shroff Signed-off-by: Keith Busch commit e8e1a4c0fb2571e19277edc0292bee6102f3652a Author: Marco Crivellari Date: Mon Feb 23 11:23:28 2026 +0100 nvme: add WQ_PERCPU to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Reviewed-by: Christoph Hellwig Signed-off-by: Marco Crivellari Signed-off-by: Keith Busch commit 12f5fb5ee124da68220ed9646ee1ebe3a88f0c89 Author: Marco Crivellari Date: Mon Feb 23 11:23:29 2026 +0100 nvmet-fc: add WQ_PERCPU to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Cc: Justin Tee Cc: Naresh Gottumukkala CC: Paul Ely Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Reviewed-by: Christoph Hellwig Signed-off-by: Marco Crivellari Signed-off-by: Keith Busch commit 3d553be6d295b6cca8fd35cb673fd13934ac4cbc Author: Marco Crivellari Date: Mon Feb 23 11:23:27 2026 +0100 nvmet: replace use of system_wq with system_percpu_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Reviewed-by: Christoph Hellwig Signed-off-by: Marco Crivellari Signed-off-by: Keith Busch commit 33eb451044498098babb93b4161e896e0a3e9291 Author: Alistair Francis Date: Fri Mar 20 10:20:45 2026 +1000 nvme-auth: Don't propose NVME_AUTH_DHGROUP_NULL with SC_C Section 8.3.4.5.2 of the NVMe 2.1 base spec states that """ The 00h identifier shall not be proposed in an AUTH_Negotiate message that requests secure channel concatenation (i.e., with the SC_C field set to a non-zero value). """ We need to ensure that we don't set the NVME_AUTH_DHGROUP_NULL idlist if SC_C is set. Reviewed-by: Hannes Reinecke Reviewed-by: Chris Leech Reviewed-by: Christoph Hellwig Signed-off-by: Kamaljit Singh Signed-off-by: Alistair Francis Signed-off-by: Keith Busch commit 09e8f0f93491c6be867f32d4edc0b16fb5da785e Author: Alistair Francis Date: Fri Mar 20 10:20:44 2026 +1000 nvme: Add the DHCHAP maximum HD IDs In preperation for using DHCHAP length in upcoming host and target patches let's add the hash and diffie-hellman ID length macros. Reviewed-by: Christoph Hellwig Reviewed-by: Yunje Shin Reviewed-by: Hannes Reinecke Reviewed-by: Chris Leech Signed-off-by: Alistair Francis Signed-off-by: Keith Busch commit a8eebf9699d69987cc49cec4e4fdb4111ab32423 Author: Robert Beckett Date: Fri Mar 20 19:22:09 2026 +0000 nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 The Kingston OM3SGP42048K2-A00 (PCI ID 2646:502f) firmware has a race condition when processing concurrent write zeroes and DSM (discard) commands, causing spurious "LBA Out of Range" errors and IOMMU page faults at address 0x0. The issue is reliably triggered by running two concurrent mkfs commands on different partitions of the same drive, which generates interleaved write zeroes and discard operations. Disable write zeroes for this device, matching the pattern used for other Kingston OM* drives that have similar firmware issues. Cc: stable@vger.kernel.org Signed-off-by: Robert Beckett Assisted-by: claude-opus-4-6-v1 Signed-off-by: Keith Busch commit 40f0496b617b431f8d2dd94d7f785c1121f8a68a Author: Robert Beckett Date: Fri Mar 20 19:22:08 2026 +0000 nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set The NVM Command Set Identify Controller data may report a non-zero Write Zeroes Size Limit (wzsl). When present, nvme_init_non_mdts_limits() unconditionally overrides max_zeroes_sectors from wzsl, even if NVME_QUIRK_DISABLE_WRITE_ZEROES previously set it to zero. This effectively re-enables write zeroes for devices that need it disabled, defeating the quirk. Several Kingston OM* drives rely on this quirk to avoid firmware issues with write zeroes commands. Check for the quirk before applying the wzsl override. Fixes: 5befc7c26e5a ("nvme: implement non-mdts command limits") Cc: stable@vger.kernel.org Signed-off-by: Robert Beckett Assisted-by: claude-opus-4-6-v1 Signed-off-by: Keith Busch commit c4cfe8c328aee9e3519a04810480ce8e1fcaeeb7 Author: Caleb Sander Mateos Date: Fri Feb 27 13:23:53 2026 -0700 nvmet: report NPDGL and NPDAL A block device with a very large discard_granularity queue limit may not be able to report it in the 16-bit NPDG and NPDA fields in the Identify Namespace data structure. For this reason, version 2.1 of the NVMe specs added 32-bit fields NPDGL and NPDAL to the NVM Command Set Specific Identify Namespace structure. So report the discard_granularity there too and set OPTPERF to 11b to indicate those fields are supported. Signed-off-by: Caleb Sander Mateos Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit e0d56e7055d3762732504eddc059a4a142227e0f Author: Caleb Sander Mateos Date: Fri Feb 27 13:23:52 2026 -0700 nvmet: use NVME_NS_FEAT_OPTPERF_SHIFT Use the NVME_NS_FEAT_OPTPERF_SHIFT constant in nvmet_bdev_set_limits() to set the OPTPERF bits of the nvme_id_ns NSFEAT field instead of the magic number 4. Signed-off-by: Caleb Sander Mateos Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 1029298da36559866ecb5ddaa3d78deb02f2ab9b Author: Caleb Sander Mateos Date: Fri Feb 27 13:23:51 2026 -0700 nvme: set discard_granularity from NPDG/NPDA Currently, nvme_config_discard() always sets the discard_granularity queue limit to the logical block size. However, NVMe namespaces can advertise a larger preferred discard granularity in the NPDG or NPDA field of the Identify Namespace structure or the NPDGL or NPDAL fields of the I/O Command Set Specific Identify Namespace structure. Use these fields to compute the discard_granularity limit. The logic is somewhat involved. First, the fields are optional. NPDG is only reported if the low bit of OPTPERF is set in NSFEAT. NPDA is reported if any bit of OPTPERF is set. And NPDGL and NPDAL are reported if the high bit of OPTPERF is set. NPDGL and NPDAL can also each be set to 0 to opt out of reporting a limit. I/O Command Set Specific Identify Namespace may also not be supported by older NVMe controllers. Another complication is that multiple values may be reported among NPDG, NPDGL, NPDA, and NPDAL. The spec says to prefer the values reported in the L variants. The spec says NPDG should be a multiple of NPDA and NPDGL should be a multiple of NPDAL, but it doesn't specify a relationship between NPDG and NPDAL or NPDGL and NPDA. So use the maximum of the reported NPDG(L) and NPDA(L) values as the discard_granularity. Signed-off-by: Caleb Sander Mateos Signed-off-by: Keith Busch commit b465046c8cca9e418c7b39cfb41bb8e3b62f22f6 Author: Caleb Sander Mateos Date: Fri Feb 27 13:23:50 2026 -0700 nvme: add from0based() helper The NVMe specifications are big fans of "0's based"/"0-based" fields for encoding values that must be positive. The encoded value is 1 less than the value it represents. nvmet already provides a helper to0based() for encoding 0's based values, so add a corresponding helper to decode these fields on the host side. Suggested-by: Christoph Hellwig Signed-off-by: Caleb Sander Mateos Signed-off-by: Keith Busch commit 823340b7e877b410a814177360df34810878e916 Author: Caleb Sander Mateos Date: Fri Feb 27 13:23:49 2026 -0700 nvme: always issue I/O Command Set specific Identify Namespace Currently, the I/O Command Set specific Identify Namespace structure is only fetched for controllers that support extended LBA formats. This is because struct nvme_id_ns_nvm is only used by nvme_configure_pi_elbas(), which is only called when the ELBAS bit is set in the CTRATT field of the Identify Controller structure. However, the I/O Command Set specific Identify Namespace structure will soon be used in nvme_update_disk_info(), so always try to obtain it in nvme_update_ns_info_block(). This Identify structure is first defined in NVMe spec version 2.0, but controllers reporting older versions could still implement it. Signed-off-by: Caleb Sander Mateos Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit d3c04a6ea5fd7a3d81f7c80880125108df9a4cbd Author: Caleb Sander Mateos Date: Fri Feb 27 13:23:48 2026 -0700 nvme: update nvme_id_ns OPTPERF constants In NVMe verson 2.0 and below, OPTPERF comprises only bit 4 of NSFEAT in the Identify Namespace structure. Since version 2.1, OPTPERF includes both bits 4 and 5 of NSFEAT. Replace the NVME_NS_FEAT_IO_OPT constant with NVME_NS_FEAT_OPTPERF_SHIFT, NVME_NS_FEAT_OPTPERF_MASK, and NVME_NS_FEAT_OPTPERF_MASK_2_1, representing the first bit, pre-2.1 bit width, and post-2.1 bit width of OPTPERF. Update nvme_update_disk_info() to check both OPTPERF bits for controllers that report version 2.1 or newer, as NPWG and NOWS are supported even if only bit 5 is set. Signed-off-by: Caleb Sander Mateos Signed-off-by: Keith Busch commit 9110b85244f142ca4bcaea27be408c778d3c48d0 Author: Caleb Sander Mateos Date: Fri Feb 27 13:23:47 2026 -0700 nvme: fold nvme_config_discard() into nvme_update_disk_info() The choice of what queue limits are set in nvme_update_disk_info() vs. nvme_config_discard() seems a bit arbitrary. A subsequent commit will compute the discard_granularity limit using struct nvme_id_ns, which is only passed to nvme_update_disk_info() currently. So move the logic in nvme_config_discard() to nvme_update_disk_info(). Replace several instances of ns->ctrl in nvme_update_disk_info() with the ctrl variable brought from nvme_config_discard(). Signed-off-by: Caleb Sander Mateos Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit ac61e869bef13a43d624893559acbac3a4e2a341 Author: Caleb Sander Mateos Date: Fri Feb 27 13:23:46 2026 -0700 nvme: add preferred I/O size fields to struct nvme_id_ns_nvm A subsequent change will use the NPDGL and NPDAL fields of the NVM Command Set Specific Identify Namespace structure, so add them (and the handful of intervening fields) to struct nvme_id_ns_nvm. Add an assertion that the size is still 4 KB. Signed-off-by: Caleb Sander Mateos Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit ed6a9f7dabf84a9f2bed418e66eda6f8239b7f60 Author: Alistair Francis Date: Tue Dec 2 15:17:55 2025 +1000 nvme: Allow reauth from sysfs Allow userspace to trigger a reauth (REPLACETLSPSK) from sysfs. This can be done by writing a zero to the sysfs file. echo 0 > /sys/devices/virtual/nvme-fabrics/ctl/nvme0/tls_configured_key In order to use the new keys for the admin queue we call controller reset. This isn't ideal, but I can't find a simpler way to reset the admin queue TLS connection. Signed-off-by: Alistair Francis Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Wilfred Mallawa Signed-off-by: Keith Busch commit 56d25f1a6e312e36ee07c605c4102e0848245381 Author: Alistair Francis Date: Tue Dec 2 15:17:54 2025 +1000 nvme: Expose the tls_configured sysfs for secure concat connections Signed-off-by: Alistair Francis Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Wilfred Mallawa Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch commit 2e6eb6b277f593b98f151ea8eff1beb558bbea3b Author: Alistair Francis Date: Tue Dec 2 15:17:53 2025 +1000 nvmet-tcp: Don't free SQ on authentication success Curently after the host sends a REPLACETLSPSK we free the TLS keys as part of calling nvmet_auth_sq_free() on success. This means when the host sends a follow up REPLACETLSPSK we return CONCAT_MISMATCH as the check for !nvmet_queue_tls_keyid(req->sq) fails. This patch ensures we don't free the TLS key on success as we might need it again in the future. Signed-off-by: Alistair Francis Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Wilfred Mallawa Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch commit ecf4d2d883515850ba838df2537ff1c32d0c4217 Author: Alistair Francis Date: Tue Dec 2 15:17:52 2025 +1000 nvmet-tcp: Don't error if TLS is enabed on a reset If the host sends a AUTH_Negotiate Message on the admin queue with REPLACETLSPSK set then we expect and require a TLS connection and shouldn't report an error if TLS is enabled. This change only enforces the nvmet_queue_tls_keyid() check if we aren't resetting the negotiation. Signed-off-by: Alistair Francis Reviewed-by: Wilfred Mallawa Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch commit 6d888db2cfd910ad5b2070659e9b2598bbe4081f Author: Eric Biggers Date: Sun Mar 1 23:59:59 2026 -0800 crypto: remove HKDF library Remove crypto/hkdf.c, since it's no longer used. Originally it had two users, but now both of them just inline the needed HMAC computations using the HMAC library APIs. That ends up being better, since it eliminates all the complexity and performance issues associated with the crypto_shash abstraction and multi-step HMAC input formatting. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit 26c8c2dddecb016a6115b30cf2cee633b311222b Author: Eric Biggers Date: Sun Mar 1 23:59:58 2026 -0800 nvme-auth: common: remove selections of no-longer used crypto modules Now that nvme-auth uses the crypto library instead of crypto_shash, remove obsolete selections from the NVME_AUTH kconfig option. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit 844d950bb2cb1fc5b8973369de59cbfb7eecd94d Author: Eric Biggers Date: Sun Mar 1 23:59:57 2026 -0800 nvme-auth: common: remove nvme_auth_digest_name() Since nvme_auth_digest_name() is no longer used, remove it and the associated data from the hash_map array. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit 16977e77554b203cbc1d29ca64cd53c5166e7c56 Author: Eric Biggers Date: Sun Mar 1 23:59:56 2026 -0800 nvme-auth: target: use crypto library in nvmet_auth_ctrl_hash() For the HMAC computation in nvmet_auth_ctrl_hash(), use the crypto library instead of crypto_shash. This is simpler, faster, and more reliable. Notably, this eliminates the crypto transformation object allocation for every call, which was very slow. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit e501533f671f6576c032fa40376e413cba4bfb25 Author: Eric Biggers Date: Sun Mar 1 23:59:55 2026 -0800 nvme-auth: target: use crypto library in nvmet_auth_host_hash() For the HMAC computation in nvmet_auth_host_hash(), use the crypto library instead of crypto_shash. This is simpler, faster, and more reliable. Notably, this eliminates the crypto transformation object allocation for every call, which was very slow. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit efe8df9f9ce12903244e42038346de6afec473de Author: Eric Biggers Date: Sun Mar 1 23:59:54 2026 -0800 nvme-auth: target: remove obsolete crypto_has_shash() checks Since nvme-auth is now doing its HMAC computations using the crypto library, it's guaranteed that all the algorithms actually work. Therefore, remove the crypto_has_shash() checks which are now obsolete. However, the caller in nvmet_auth_negotiate() seems to have also been relying on crypto_has_shash(nvme_auth_hmac_name(host_hmac_id)) to validate the host_hmac_id. Therefore, make it validate the ID more directly by checking whether nvme_auth_hmac_hash_len() returns 0 or not. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit ac9a49cf6e0c230e81de1c91b59e4ad912ee98c1 Author: Eric Biggers Date: Sun Mar 1 23:59:53 2026 -0800 nvme-auth: host: remove allocation of crypto_shash Now that the crypto_shash that is being allocated in nvme_auth_process_dhchap_challenge() and stored in the struct nvme_dhchap_queue_context is no longer used, remove it. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit c4f216c2a95c16ad2cd61eeb91229103002a0f6d Author: Eric Biggers Date: Sun Mar 1 23:59:52 2026 -0800 nvme-auth: host: use crypto library in nvme_auth_dhchap_setup_ctrl_response() For the HMAC computation in nvme_auth_dhchap_setup_ctrl_response(), use the crypto library instead of crypto_shash. This is simpler, faster, and more reliable. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit 6be8d3f043a12d208d8c5c08fc9c5f54082c87b2 Author: Eric Biggers Date: Sun Mar 1 23:59:51 2026 -0800 nvme-auth: host: use crypto library in nvme_auth_dhchap_setup_host_response() For the HMAC computation in nvme_auth_dhchap_setup_host_response(), use the crypto library instead of crypto_shash. This is simpler, faster, and more reliable. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit d126cbaa7d9a971dedc8535d4f2529c799de8f85 Author: Eric Biggers Date: Sun Mar 1 23:59:50 2026 -0800 nvme-auth: common: use crypto library in nvme_auth_derive_tls_psk() For the HKDF-Expand-Label computation in nvme_auth_derive_tls_psk(), use the crypto library instead of crypto_shash and crypto/hkdf.c. While this means the HKDF "helper" functions are no longer utilized, they clearly weren't buying us much: it's simpler to just inline the HMAC computations directly, and this code needs to be tested anyway. (A similar result was seen in fs/crypto/. As a result, this eliminates the last user of crypto/hkdf.c, which we'll be able to remove as well.) As usual this is also a lot more efficient, eliminating the allocation of a transformation object and multiple other dynamic allocations. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit 0002764c2faa769cd41b45e95af3dd5e1777df9f Author: Eric Biggers Date: Sun Mar 1 23:59:49 2026 -0800 nvme-auth: common: use crypto library in nvme_auth_generate_digest() For the HMAC computation in nvme_auth_generate_digest(), use the crypto library instead of crypto_shash. This is simpler, faster, and more reliable. Notably, this eliminates the crypto transformation object allocation for every call, which was very slow. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit be01b841d3dd667d873cbcd984d9839b7e98ef4f Author: Eric Biggers Date: Sun Mar 1 23:59:48 2026 -0800 nvme-auth: common: use crypto library in nvme_auth_generate_psk() For the HMAC computation in nvme_auth_generate_psk(), use the crypto library instead of crypto_shash. This is simpler, faster, and more reliable. Notably, this eliminates the crypto transformation object allocation for every call, which was very slow. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit a67d096fe9761e3e503f40643228bca6d69c7c4e Author: Eric Biggers Date: Sun Mar 1 23:59:47 2026 -0800 nvme-auth: common: use crypto library in nvme_auth_augmented_challenge() For the hash and HMAC computations in nvme_auth_augmented_challenge(), use the crypto library instead of crypto_shash. This is simpler, faster, and more reliable. Notably, this eliminates two crypto transformation object allocations for every call, which was very slow. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit 092c05f8de3d2f83242d70f6f044f339b8ba5df1 Author: Eric Biggers Date: Sun Mar 1 23:59:46 2026 -0800 nvme-auth: common: use crypto library in nvme_auth_transform_key() For the HMAC computation in nvme_auth_transform_key(), use the crypto library instead of crypto_shash. This is simpler, faster, and more reliable. Notably, this eliminates the transformation object allocation for every call, which was very slow. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit 4263ca1cae5cebc09ba95375c4a8927bf4b39d49 Author: Eric Biggers Date: Sun Mar 1 23:59:45 2026 -0800 nvme-auth: common: add HMAC helper functions Add some helper functions for computing HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512 values using the crypto library instead of crypto_shash. These will enable some significant simplifications and performance improvements in nvme-auth. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit 4454820b4ee59154d0c271722bbe48bb4f554e3e Author: Eric Biggers Date: Sun Mar 1 23:59:44 2026 -0800 nvme-auth: common: explicitly verify psk_len == hash_len nvme_auth_derive_tls_psk() is always called with psk_len == hash_len. And based on the comments above nvme_auth_generate_psk() and nvme_auth_derive_tls_psk(), this isn't an implementation choice but rather just the length the spec uses. Add a check which makes this explicit, so that when cleaning up nvme_auth_derive_tls_psk() we don't have to retain support for arbitrary values of psk_len. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit 0beeca72cf21c7c1d9d232148fdeef8e5e242f62 Author: Eric Biggers Date: Sun Mar 1 23:59:43 2026 -0800 nvme-auth: rename nvme_auth_generate_key() to nvme_auth_parse_key() This function does not generate a key. It parses the key from the string that the caller passes in. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit f990ad67f0febc51274adb604d5bdeab0d06d024 Author: Eric Biggers Date: Sun Mar 1 23:59:42 2026 -0800 nvme-auth: common: add KUnit tests for TLS key derivation Unit-test the sequence of function calls that derive tls_psk, so that we can be more confident that changes in the implementation don't break it. Since the NVMe specification doesn't seem to include any test vectors for this (nor does its description of the algorithm seem to match what was actually implemented, for that matter), I just set the expected values to the values that the code currently produces. In the case of SHA-512, nvme_auth_generate_digest() currently returns -EINVAL, so for now the test tests for that too. If it is later determined that some other behavior is needed, the test can be updated accordingly. Tested with: tools/testing/kunit/kunit.py run --kunitconfig drivers/nvme/common/ Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit bf0e2567a639c455110f9be5db8c92032175e222 Author: Eric Biggers Date: Sun Mar 1 23:59:41 2026 -0800 nvme-auth: use proper argument types For input parameters, use pointer to const. This makes it easier to understand which parameters are inputs and which are outputs. In addition, consistently use char for strings and u8 for binary. This makes it easier to understand what is a string and what is binary data. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit e57406c07b790005feaccc9f2bd75b827566e141 Author: Eric Biggers Date: Sun Mar 1 23:59:40 2026 -0800 nvme-auth: common: constify static data Fully constify the dhgroup_map and hash_map arrays. Remove 'const' from individual fields, as it is now redundant. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit 9100a28c8bb4270744942cf834efcd80f1acda7d Author: Eric Biggers Date: Sun Mar 1 23:59:39 2026 -0800 nvme-auth: add NVME_AUTH_MAX_DIGEST_SIZE constant Define a NVME_AUTH_MAX_DIGEST_SIZE constant and use it in the appropriate places. Acked-by: Ard Biesheuvel Acked-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Eric Biggers Signed-off-by: Keith Busch commit 198c7ce9801abd63c44176c3f034577b887c0070 Author: Jiakai Xu Date: Mon Mar 16 01:45:33 2026 +0000 RISC-V: KVM: selftests: Fix firmware counter read in sbi_pmu_test The current sbi_pmu_test attempts to read firmware counters without configuring them first with SBI_EXT_PMU_COUNTER_CFG_MATCH. Previously this did not fail because KVM incorrectly allowed the read and accessed fw_event[] with an out-of-bounds index when the counter was unconfigured. After fixing that bug, the read now correctly returns SBI_ERR_INVALID_PARAM, causing the selftest to fail. Update the test to configure a firmware event before reading the counter. Also add a negative test to ensure that attempting to read an unconfigured firmware counter fails gracefully. Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Andrew Jones Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20260316014533.2312254-3-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 99594f75b49edc7046057bca06d892c16967a9b3 Author: Jiakai Xu Date: Mon Mar 16 01:45:32 2026 +0000 RISC-V: KVM: Fix array out-of-bounds in pmu_ctr_read() and pmu_fw_ctr_read_hi() When a guest invokes SBI_EXT_PMU_COUNTER_FW_READ or SBI_EXT_PMU_COUNTER_FW_READ_HI on a firmware counter that has not been configured via SBI_EXT_PMU_COUNTER_CFG_MATCH, the pmc->event_idx remains SBI_PMU_EVENT_IDX_INVALID (0xFFFFFFFF). get_event_code() extracts the lower 16 bits, yielding 0xFFFF (65535), which is then used to index into kvpmu->fw_event[]. Since fw_event is only RISCV_KVM_MAX_FW_CTRS (32) entries, this triggers an array-index-out-of-bounds: UBSAN: array-index-out-of-bounds in arch/riscv/kvm/vcpu_pmu.c:255:37 index 65535 is out of range for type 'kvm_fw_event [32]' Add a check for the known unconfigured case (SBI_PMU_EVENT_IDX_INVALID) and a WARN_ONCE guard for any unexpected out-of-bounds event codes, returning -EINVAL in both cases. Fixes: badc386869e2c ("RISC-V: KVM: Support firmware events") Fixes: 08fb07d6dcf71 ("RISC-V: KVM: Support 64 bit firmware counters on RV32") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20260316014533.2312254-2-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit a5f51b04cbb3ae0f9cb2c4488952b775ebb0ccbf Author: Sumit Gupta Date: Wed Jan 21 15:42:05 2026 +0530 soc/tegra: cbb: Fix cross-fabric target timeout lookup When a fabric receives an error interrupt, the error may have occurred on a different fabric. The target timeout lookup was using the wrong base address (cbb->regs) with offsets from a different fabric's target map, causing a kernel page fault. Unable to handle kernel paging request at virtual address ffff80000954cc00 pc : tegra234_cbb_get_tmo_slv+0xc/0x28 Call trace: tegra234_cbb_get_tmo_slv+0xc/0x28 print_err_notifier+0x6c0/0x7d0 tegra234_cbb_isr+0xe4/0x1b4 Add tegra234_cbb_get_fabric() to look up the correct fabric device using fab_id, and use its base address for accessing target timeout registers. Fixes: 25de5c8fe0801 ("soc/tegra: cbb: Improve handling for per SoC fabric data") Signed-off-by: Sumit Gupta Signed-off-by: Thierry Reding commit 499f7e5ebbdd9ff0c4d532b1c432f8a61ff585b3 Author: Sumit Gupta Date: Wed Jan 21 15:42:04 2026 +0530 soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables Fix incorrect ARRAY_SIZE usage in fabric lookup tables which could cause out-of-bounds access during target timeout lookup. Fixes: 25de5c8fe0801 ("soc/tegra: cbb: Improve handling for per SoC fabric data") Signed-off-by: Sumit Gupta Signed-off-by: Thierry Reding commit b6ff71c5d1d4ad858ddf6f39394d169c96689596 Author: Sumit Gupta Date: Wed Jan 21 15:42:03 2026 +0530 soc/tegra: cbb: Set ERD on resume for err interrupt Set the Error Response Disable (ERD) bit to mask SError responses and use interrupt-based error reporting. When the ERD bit is set, inband error responses to the initiator via SError are suppressed, and fabric errors are reported via an interrupt instead. The register is set during boot but the info is lost during system suspend and needs to be set again on resume. Fixes: fc2f151d2314 ("soc/tegra: cbb: Add driver for Tegra234 CBB 2.0") Signed-off-by: Sumit Gupta Signed-off-by: Thierry Reding commit 47c806de9e9cf171d197f2f0df86df7f2bd1aa56 Author: Rasmus Villemoes Date: Fri Mar 27 15:15:13 2026 +0100 arm64: dts: ti: k3-pinctrl: sort shift values numerically The macros are easier to read when the values are sorted numerically. Signed-off-by: Rasmus Villemoes Link: https://patch.msgid.link/20260327141513.1250499-3-linux@rasmusvillemoes.dk Signed-off-by: Vignesh Raghavendra commit 51ccf3e4628594c6b865a0d7e1363b0799555ab7 Author: Rasmus Villemoes Date: Fri Mar 27 15:15:12 2026 +0100 arm64: dts: ti: k3-pinctrl: consistently use tabs for alignment Currently, there's a mix of spaces and tabs used for aligning the bodies of the macros, even within the same block. Use tabs throughout for consistency. No functional change; 'git diff -w' produces no output. Signed-off-by: Rasmus Villemoes Link: https://patch.msgid.link/20260327141513.1250499-2-linux@rasmusvillemoes.dk Signed-off-by: Vignesh Raghavendra commit ad7ffe102a52141a0da19ca766c5103bec28ddb6 Author: Sumit Gupta Date: Wed Mar 25 18:27:26 2026 +0530 soc/tegra: cbb: Add support for CBB fabrics in Tegra238 Add support for CBB 2.0 based fabrics in Tegra238 SoC using DT. Fabrics reporting errors are: CBB, AON, BPMP, APE. Signed-off-by: Sumit Gupta Signed-off-by: Thierry Reding commit 1a56641b7ae4f19216774a59d68024be3e6197d0 Author: Cássio Gabriel Date: Fri Mar 27 10:59:45 2026 -0300 ALSA: pcm: Serialize snd_pcm_suspend_all() with open_mutex snd_pcm_suspend_all() walks all PCM substreams and uses a lockless runtime check to skip closed streams. It then calls snd_pcm_suspend() for each remaining substream and finally runs snd_pcm_sync_stop() in a second pass. The runtime lifetime is still controlled by pcm->open_mutex in the open/release path. That means a concurrent close can clear or free substream->runtime after the initial check in snd_pcm_suspend_all(), leaving the later suspend or sync-stop path to dereference a stale or NULL runtime pointer. Serialize snd_pcm_suspend_all() with pcm->open_mutex so the runtime pointer stays stable across both loops. This matches the existing PCM runtime lifetime rule already used by other core paths that access substream->runtime outside the stream lock. Suggested-by: Takashi Iwai Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260327-alsa-pcm-suspend-open-close-lock-v2-1-cc4baca4dcd6@gmail.com Signed-off-by: Takashi Iwai commit 825b8c7e1d2918d89eb378b761530d1e51dba82e Author: Xu Yang Date: Tue Mar 24 19:04:59 2026 +0800 arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual When attach to PC Type-A port, the USB device controller does not function at all. Because it is configured as source-only and a Type-A port doesn't support PD capability, a data role swap is impossible. Actually, PTN5110THQ is configured for Source role only at POR, but after POR it can operate as a DRP (Dual-Role Power). By switching the power-role to dual, the port can operate as a sink and enter device mode when attach to Type-A port. Since the board design uses EN_SRC to control the 5V VBUS path and EN_SNK to control the 12V VBUS output, to avoid outputting a higher VBUS when in sink role, we set the operation current limit to 0mA so that SW will not control EN_SNK at all. Fixes: 2faf4ebcee2e5 ("arm64: dts: freescale: imx8qxp-mek: enable cadence usb3") Signed-off-by: Xu Yang Signed-off-by: Frank Li commit e3d3d19d1c0050789a4813ce836a641a3387d916 Author: Xu Yang Date: Tue Mar 24 19:04:58 2026 +0800 arm64: dts: imx8qm-mek: switch Type-C connector power-role to dual When attach to PC Type-A port, the USB device controller does not function at all. Because it is configured as source-only and a Type-A port doesn't support PD capability, a data role swap is impossible. Actually, PTN5110THQ is configured for Source role only at POR, but after POR it can operate as a DRP (Dual-Role Power). By switching the power-role to dual, the port can operate as a sink and enter device mode when attach to Type-A port. Since the board design uses EN_SRC to control the 5V VBUS path and EN_SNK to control the 12V VBUS output, to avoid outputting a higher VBUS when in sink role, we set the operation current limit to 0mA so that SW will not control EN_SNK at all. Fixes: b237975b2cd58 ("arm64: dts: imx8qm-mek: add usb 3.0 and related type C nodes") Signed-off-by: Xu Yang Signed-off-by: Frank Li commit a43212e427b540b39e22511a0a993e7d3e578d56 Author: Josua Mayer Date: Tue Mar 24 13:41:04 2026 +0100 arm64: dts: lx2162a-clearfog: set sfp connector leds function and source LX2162A Clearfog has four LEDs attached physically to the 4-port SFP connector. They are intended to show information relating to network interface status. Select "netdev" as default trigger for each LED, and link each one to the respective dpmac instance as trigger-source. Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit fcf67ca2b23cda0ea4711f6b87ffb9c9c5e54a5e Author: Josua Mayer Date: Tue Mar 24 13:41:03 2026 +0100 arm64: dts: lx2162a-sr-som: add crypto & rtc aliases, model Add aliases for crypto accelerator and rtc0 ensuring that on-SoM RTC and the SoC A72 domain crypto accelerator are assigned first index. Further set model and compatible strings which are informative but overridden by actual boards. Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit e2f31bffa1f5fa1f6628abc59020a0c30b0a3ce9 Author: Josua Mayer Date: Tue Mar 24 13:41:02 2026 +0100 arm64: dts: lx2160a-cex7: add rtc alias Add alias for rtc0 ensuring that on-COM RTC is assigned first index. Note that fsl-lx2160a.dtsi already defines an alias for rtc1 which implicitly achieved the same result. Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 284ad7064aaa1badde022785cd925af29c696b21 Author: Josua Mayer Date: Tue Mar 24 13:41:01 2026 +0100 arm64: dts: lx2160a: complete pinmux for rcwsr12 configuration word Commit 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") introduced pinmux nodes for lx2160 i2c interfaces, allowing runtime change between i2c and gpio functions implementing bus recovery. However, the dynamic configuration area (overwrite MUX) used by the pinctrl-single driver initially reads as zero and does not reflect the actual hardware state set by the Reset Configuration Word (RCW) at power-on. Because multiple groups of pins are configured from a single 32-bit register, the first write from the pinctrl driver unintentionally clears all other bits to zero. Add description for all bits of RCWSR12 register, allowing boards to explicitly define and restore their intended hardware state. This includes i2c, gpio, flextimer, spi, can and sdhc functions. Other configuration words, i.e. RCWSR13 & RCWSR14 may be added in the future for boards setting non-zero values there. Fixes: 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 03241620d2b9915c9e3463dbc56e9eb95ad43c08 Author: Josua Mayer Date: Tue Mar 24 13:41:00 2026 +0100 arm64: dts: lx2160a: change zeros to hexadecimal in pinmux nodes Replace some stray zeros from decimal to hexadecimal format within pinmux nodes. No functional change intended. Fixes: 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 89ea0dbd701f89805499d26bd90657468c789545 Author: Josua Mayer Date: Tue Mar 24 13:40:59 2026 +0100 arm64: dts: lx2160a: add sda gpio references for i2c bus recovery LX2160A pinmux is done in groups by various length bitfields within configuration registers. In particular i2c sda/scl pins are always configured together. Therefore bus recovery may control both sda and scl. When pinmux nodes and bus recovery was enabled originally for LX2160, only the scl-gpios were added to the i2c controller nodes. Add references to sda-gpios for each i2c controller. Fixes: 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 456eb494746afd56d3a9dc30271300136e55b96e Author: Josua Mayer Date: Tue Mar 24 13:40:58 2026 +0100 arm64: dts: lx2160a: rename pinmux nodes for readability LX2160A pinmux is done in groups by various length bitfields within configuration registers. Each group of pins is named in the reference manual after a primary function using soc-specific naming, e.g. IIC1 (for i2c0). Hardware block numbering starts from zero in device-tree but one in the reference manual. Rename the already defined pinmux nodes originally added for changing i2c pins between i2c and gpio functions reflecting the reference manual name (IIC) in the node name, and the device-tree name (i2c, gpio) in the label. Specifically, drop the "_scl" suffix from the I2C labels because the nodes actually configure both SDA and SCL pins together. Instead add "_pins" suffix to avoid conflicts with I2C controller labels. For GPIO functions, include the specific controller and pin numbers in the label to clarify they are generic GPIOs and help spot mistakes. No functional change intended. Fixes: 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 325ca511ca3dda936207ce737e0afe837d45a674 Author: Josua Mayer Date: Tue Mar 24 13:40:57 2026 +0100 arm64: dts: lx2160a: remove duplicate pinmux nodes LX2160A pinmux is done in groups by various length bitfields within configuration registers. The pinmux nodes i2c7-scl-pins and i2c7-scl-gpio-pins are duplicates of i2c6-scl-gpio and i2c6-scl-gpio-pins, writing to the same register and bits. These two i2c buses i2c6/i2c7 (IIC7/IIC8) are configured together in register RCWSR13 bits 3-0. Drop the duplicate node name and change references to the i2c6 node. Fixes: 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 7a3cc49ad1fc8d063abb7f5de8f1b981b99d2978 Author: Josua Mayer Date: Tue Mar 24 13:40:56 2026 +0100 arm64: dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit LX2160A pinmux is done in groups by various length bitfields within configuration registers. The first i2c bus (called IIC1 in reference manual) is configured through field IIC1_PMUX in register RCWSR14 bit 10 which is described in the reference manual as a single bit, unlike the other i2c buses. Change the bitmask for the pinmux nodes from 0x7 to 0x1 to ensure only single bit is modified. Further change the zero in the same line to hexadecimal format for consistency. Align with documentation by avoiding writes to reserved bits. No functional change, as writing the extra two reserved bits is not known to cause issues. Fixes: 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 8461f5e3887404b19ba073fd1cc92e2f8f73185b Author: Martin Aberer Date: Tue Mar 24 15:05:56 2026 +0100 i2c: ocores: Use read_poll_timeout_atomic to avoid false poll timeouts Replace the manual polling loop in ocores_wait() with the kernel helper read_poll_timeout_atomic(). This simplifies the code and ensures robust timeout handling. In particular, the helper guarantees a condition check after the delay, even if the delay exceeds the timeout, avoiding spurious timeout errors under load or preemption. Signed-off-by: Martin Aberer Reviewed-by: Andrew Lunn Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260324140556.2249039-1-martin.aberer@bachmann.info commit 70008aee892bbb5c2969bbe9e5778fc081b14bd2 Author: Josua Mayer Date: Tue Mar 24 13:40:55 2026 +0100 arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Commit 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") introduced pinmux nodes for lx2160 i2c interfaces, allowing runtime change between i2c and gpio functions implementing bus recovery. However, the dynamic configuration area (overwrite MUX) used by the pinctrl-single driver initially reads as zero and does not reflect the actual hardware state set by the Reset Configuration Word (RCW) at power-on. Because multiple groups of pins are configured from a single 32-bit register, the first write from the pinctrl driver unintentionally clears all other bits to zero. For example, on the LX2162A Clearfog, RCWSR12 is initialized to 0x08000006. When any i2c pinmux is applied, it clears all other fields. This inadvertently disables SD card-detect (IIC2_PMUX) and some GPIOs (SDHC1_DIR_PMUX): LX2162-CF RCWSR12: 0b0000100000000000 0000000000000110 IIC2_PMUX ||| ||| || | ||| |||XXX : I2C/GPIO/CD-WP SDHC1_DIR_PMUX XXX ||| || | ||| ||| : SDHC/GPIO/SPI Reverting the commit in question was considered but bus recovery is an important feature. Instead add pinmux nodes for those pins that were unintentionally reconfigured on SolidRun LX2160A Clearfog-CX and LX2162A Clearfog boards. Fixes: 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery") Cc: stable@vger.kernel.org Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 4074753df3952c2af5373b46337ad93ccb86ef73 Author: Xu Yang Date: Thu Mar 12 15:16:09 2026 +0800 arm64: dts: freescale: imx8mp-moduline-display-106: add typec-power-opmode property Add typec-power-opmode property to avoid dtbs_check warning. Signed-off-by: Xu Yang Signed-off-by: Frank Li commit f15bfdc18a010a8f5433ef43f1c942793f8f4671 Author: Alexander Stein Date: Tue Mar 24 08:58:41 2026 +0100 arm64: dts: imx8mp-tqma8mpql: Add DT overlays to explicit list Armbian installs DT overlays using dtbs_install. For it to work all the overlays have to be added to dtb-y explicitly. Add the overlays for platforms supported by Armbian. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit bfb91be0eba426913f2950ed8b3d963f0de53fcc Author: Liu Ying Date: Tue Mar 24 13:52:03 2026 +0800 arm64: dts: imx8mp-evk: Specify ADV7535 register addresses MIPI DSI to HDMI bridge ADV7535 CEC default register address is 0x3c on an I2C bus. And, OV5640 camera uses the same address on the same I2C bus. To resolve this conflict, use 0x3b as ADV7535 CEC register address by specifying all ADV7535 register addresses. Fixes: 6f6c18cba16f ("arm64: dts: imx8mp-evk: add camera ov5640 and related nodes") Signed-off-by: Liu Ying Signed-off-by: Frank Li commit e8341b0245736619f8d6a2cc311c9e8ad8e82390 Author: Shengjiu Wang Date: Tue Mar 17 13:37:38 2026 +0800 arm64: dts: imx8dxl-evk: Use audio-graph-card2 for wm8960-2 and wm8960-3 The sound card wm8960-2 and wm8960-3 only support capture mode for the reason of connection on the EVK board. But fsl-asoc-card don't support capture_only setting, the sound card creation will fail. fsl-sai 59060000.sai: Missing dma channel for stream: 0 fsl-sai 59060000.sai: ASoC error (-22): at snd_soc_pcm_component_new() on 59060000.sai fsl-sai 59070000.sai: Missing dma channel for stream: 0 fsl-sai 59070000.sai: ASoC error (-22): at snd_soc_pcm_component_new() on 59070000.sai so switch to use audio-graph-card2 which supports 'capture_only' property for wm8960-2 and wm8960-3 cards. Fixes: b41c45eb990a ("arm64: dts: imx8dxl-evk: add audio nodes") Signed-off-by: Shengjiu Wang Signed-off-by: Frank Li commit 9af6eed8eeb01bf501b4d82155b221b37b0141ec Author: Peng Fan Date: Tue Mar 24 13:44:13 2026 +0800 arm64: dts: imx943-evk: Add pf09/53 thermal zone Add PF09 and PF53 thermal nodes. Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 6bc554ff0d951103d286a12d4c2d7b9105ac35e3 Author: Florin Leotescu Date: Tue Mar 24 13:44:12 2026 +0800 arm64: dts: imx943-evk: Add fan node and enable active cooling on A55 Add pwm fan node and use it for A55 cooling. Signed-off-by: Florin Leotescu Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 44b580a74fcd39d0c53b8c9d6b865cfbd05a947e Author: Peng Fan Date: Tue Mar 24 13:44:11 2026 +0800 arm64: dts: imx943-evk: Add nxp,ctrl-ids for scmi_misc Add nxp,ctrl-ids for scmi_misc to support wakeup from the peripherals. Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 5b1f0603b56371899d8a6cb77a89fd44c2962b92 Author: Joy Zou Date: Tue Mar 24 13:44:10 2026 +0800 arm64: dts: imx943: Add thermal support Add A55 and ANA thermal including cooling-maps. Signed-off-by: Joy Zou Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 531d1c767d7f913c58ed6b46bb313dac0719250b Author: Peng Fan Date: Tue Mar 24 13:44:09 2026 +0800 arm64: dts: imx94: Add SCMI sensor/lmm/cpu nodes Add SCMI sensor/lmm/cpu nodes to allow Linux use thermal, i.MX System Manager Logical Machine API and CPU API Signed-off-by: Peng Fan Signed-off-by: Frank Li commit c07b414ff2538daee6b055106020cb596e9820cb Author: Peng Fan Date: Tue Mar 24 13:44:08 2026 +0800 arm64: dts: imx94: Add V2X/ELE mailbox nodes Add V2X and ELE Message Unit nodes for i.MX94. One extra V2X MU which is dedicated for V2X fast crypto engine is not included, because it requires a new compatible string. Signed-off-by: Peng Fan Signed-off-by: Frank Li commit c045ff8d3d915b76091cb9e37a4f463b1e2e9a98 Author: Ranjani Vaidyanathan Date: Tue Mar 24 13:44:07 2026 +0800 arm64: dts: imx94: Update pin headers Update the pin headers to include pins that has special mux options: The MUX value field in the IOMUX table is extended to 16 bits where the lower 8 bits represent the current IOMUX value and the upper 8 bits represent the new extended mux. Signed-off-by: Ranjani Vaidyanathan Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 95d7d7d2ad27d2c1246fbb486628567b47109a21 Author: Fabian Pfitzner Date: Wed Mar 25 17:01:49 2026 +0100 arm64: dts: imx8mp-frdm: add sd, ethernet, wifi, usb and hdmi support Add support for the following new features: - SD Card - Ethernet (FEC + EQOS) - Wifi - USB - HDMI Signed-off-by: Fabian Pfitzner Signed-off-by: Frank Li commit e77f8e6bba733392896b978548cc771c143280d8 Author: Ernest Van Hoecke Date: Wed Mar 25 15:46:07 2026 +0100 arm64: dts: freescale: imx95-verdin: Add Yavia carrier board Add support for the Verdin i.MX95 SoM mated with the Yavia carrier board. Link: https://www.toradex.com/computer-on-modules/verdin-arm-family/nxp-imx95 Link: https://www.toradex.com/products/carrier-board/yavia Signed-off-by: Ernest Van Hoecke Signed-off-by: Frank Li commit 2f71fba0a082df525037473568743f1e5454107b Author: Ernest Van Hoecke Date: Wed Mar 25 15:46:06 2026 +0100 arm64: dts: freescale: imx95-verdin: Add Mallow carrier board Add support for the Verdin i.MX95 SoM mated with the Mallow carrier board. Link: https://www.toradex.com/computer-on-modules/verdin-arm-family/nxp-imx95 Link: https://www.toradex.com/products/carrier-board/mallow-carrier-board Signed-off-by: Ernest Van Hoecke Signed-off-by: Frank Li commit f33a1f9a942cba6c7454c5c2290395961a986f6f Author: Ernest Van Hoecke Date: Wed Mar 25 15:46:05 2026 +0100 arm64: dts: freescale: imx95-verdin: Add Ivy carrier board Add support for the Verdin i.MX95 SoM mated with the Ivy carrier board. Link: https://www.toradex.com/computer-on-modules/verdin-arm-family/nxp-imx95 Link: https://www.toradex.com/products/carrier-board/ivy-carrier-board Signed-off-by: Ernest Van Hoecke Signed-off-by: Frank Li commit e79c2c016b4389c762678bb4078fb262dccb00b5 Author: Ernest Van Hoecke Date: Wed Mar 25 15:46:04 2026 +0100 arm64: dts: freescale: imx95-verdin: Add Dahlia carrier board Add support for the Verdin i.MX95 mated with the Verdin Dahlia carrier board. Link: https://www.toradex.com/computer-on-modules/verdin-arm-family/nxp-imx95 Link: https://www.toradex.com/products/carrier-board/dahlia-carrier-board-kit Signed-off-by: Ernest Van Hoecke Signed-off-by: Frank Li commit 676d7ce22f002685ae624d922357fddbd2288cfe Author: Ernest Van Hoecke Date: Wed Mar 25 15:46:03 2026 +0100 arm64: dts: freescale: Add Verdin iMX95 support Add support for the Toradex Verdin iMX95 and its development carrier board. The module consists of an NXP i.MX95 family SoC, up to 16GB LPDDR4x RAM, up to 128GB of storage, a USB 3.2 OTG and USB 2.0 Host, a Gigabit Ethernet PHY, an I2C EEPROM and Temperature Sensor, an RX8130 RTC, an I3C bus, one Quad lane CSI interface, one Quad lane DSI or CSI interface, one LVDS interface (one or two channels), and some optional addons: TPM 2.0, and a WiFi/BT module. Link: https://www.toradex.com/computer-on-modules/verdin-arm-family/nxp-imx95 Link: https://www.toradex.com/products/carrier-board/verdin-development-board-kit Co-developed-by: Emanuele Ghidoli Signed-off-by: Emanuele Ghidoli Co-developed-by: Francesco Dolcini Signed-off-by: Francesco Dolcini Signed-off-by: Ernest Van Hoecke Signed-off-by: Frank Li commit 70db6463c920e059cc3edfe7dfeb9c33c742da82 Author: Alexander Stein Date: Mon Mar 23 13:59:50 2026 +0100 arm64: dts: imx8mp-tqma8mpql-mba8mp-ras314: add vcc supply for BT device Add the vcc power supply for the BT device. Fixes the warning: btnxpuart serial0-0: supply vcc not found, using dummy regulator Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 9754620110bf352e1c6f7ccd83c5388610157fd2 Author: Martin Schmiedel Date: Thu Mar 19 13:50:10 2026 +0100 arm64: dts: freescale: imx93-tqma9352-mba93xxla-mini: Add WLAN/BT overlay This overlay enables the LWB5+ M.2 wlan module from ezurio. Signed-off-by: Martin Schmiedel Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 20288505481c083d76f706319aa58159b779bf41 Author: Martin Schmiedel Date: Thu Mar 19 13:50:09 2026 +0100 arm64: dts: freescale: add initial device tree for TQMa93xx/MBa93xxLA-MINI Add support for TQMa93xx module attached to MBa93xxLA-MINI board. TQMa93xx is a SOM series using i.MX93 SOC. The MBa93xxLA-MINI has a small form factor and is designed with WLAN, Bluetooth and WWAN applications in mind. Signed-off-by: Martin Schmiedel Signed-off-by: Alexander Stein Reviewed-by: Andrew Lunn Signed-off-by: Frank Li commit 18955d59419de7da1bc29247f0c854e4785b94fd Author: Alexander Stein Date: Mon Mar 16 14:58:19 2026 +0100 arm64: dts: freescale: tqma8mqml/tqma8mxnl-mba8mx: Add dual-channel LVDS overlay Add an overlay for the supported LVDS display AUO G133HAN01. Apply it for both TQMa8MxML and TQMa8MxNL. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 0083b7be1b3e097209de38c0eb9abd5b3e9dc2f1 Author: Alexander Stein Date: Mon Mar 16 14:58:18 2026 +0100 arm64: dts: mba8mx: Add DSI->LVDS bridge IRQ Now that the bindings supports IRQ, add the IRQ line. Add a GPIO label as well. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit e2bb524f4bff2f9cd8bafc62daba02cb6558fe9e Author: Sherry Sun Date: Tue Mar 17 11:04:18 2026 +0800 arm64: dts: imx95-15x15-evk: remove regulator-always-on for reg_m2_pwr Now we use vpcie3v3aux-supply to keep 3.3Vaux supply enabled for the entire PCIe controller lifecycle, no need regulator-always-on property. Signed-off-by: Sherry Sun Signed-off-by: Frank Li commit ae96aa9e0a2325db622dcc8f070fde286b5498da Author: Shengjiu Wang Date: Mon Mar 16 10:14:39 2026 +0800 arm64: dts: imx952-evk: Add PDM microphone sound card support Add PDM micphone sound card support, configure the pinmux. This sound card supports recording sound from PDM microphone and convert the PDM format data to PCM data. Signed-off-by: Shengjiu Wang Reviewed-by: Daniel Baluta Signed-off-by: Frank Li commit 27a0f0487b0eaa8eb1d663b61b56b5670cec8112 Author: Shengjiu Wang Date: Mon Mar 16 10:14:38 2026 +0800 arm64: dts: imx952-evk: Add bt-sco sound card support Add bt-sco sound card, which is used by BT HFP case. It supports wb profile as default. Signed-off-by: Shengjiu Wang Reviewed-by: Daniel Baluta Signed-off-by: Frank Li commit 1e191b6cd973fe331873b845400d1dc66d50547f Author: Shengjiu Wang Date: Mon Mar 16 10:14:37 2026 +0800 arm64: dts: imx952-evk: Add sound-wm8962 support Add wm8962 sound card. By connecting with ASRC1, the sound card support sample rate conversion. ASRC2 is also enabled, which can provide memory to memory user interface. Signed-off-by: Shengjiu Wang Reviewed-by: Daniel Baluta Signed-off-by: Frank Li commit ab092e22218d2135e22660a931ad3588e0bb2b94 Author: Shengjiu Wang Date: Mon Mar 16 10:14:36 2026 +0800 arm64: dts: imx952: Add audio device nodes Add audio device nodes, include SAI, MICFIL, ASRC, Audio Mixer. Signed-off-by: Shengjiu Wang Signed-off-by: Frank Li commit 496d258cf339743ba7fade3c6949b0cca64af80b Author: Stefano Radaelli Date: Fri Mar 13 18:47:03 2026 +0100 arm64: dts: imx95-var-dart: Add support for Variscite Sonata board Add device tree support for the Variscite Sonata carrier board with the DART-MX95 system on module. The Sonata board includes - uSD Card support - USB ports and OTG - Additional Gigabit Ethernet interface - 10Gb Ethernet SFP+ connector - Uart interfaces - OV5640 Camera support - GPIO Expanders - RTC module - TPM module - PCIE support Link: https://variscite.com/carrier-boards/sonata-board/ Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit bec2988b470ef278c2e7238e8d7edd097853a4ea Author: Stefano Radaelli Date: Fri Mar 13 18:47:02 2026 +0100 arm64: dts: freescale: Add support for Variscite DART-MX95 Add device tree support for the Variscite DART-MX95 system on module. This SOM is designed to be used with various carrier boards. The module includes: - NXP i.MX95 MPU processor - Up to 16GB of LPDDR5 memory - Up to 128GB of eMMC storage memory - Integrated 10/100/1000 Mbps Ethernet Transceiver - Codec audio WM8904 - WIFI6 dual-band 802.11ax/ac/a/b/g/n with optional 802.15.4 and Bluetooth Only SOM-specific peripherals are enabled by default. Carrier board specific interfaces are left disabled to be enabled in the respective carrier board device trees. Link: https://variscite.com/system-on-module-som/i-mx-9/i-mx-95/dart-mx95/ Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit a69ba865a7c12bdbec6f4d9c346da31d5f577d4b Author: Stefano Radaelli Date: Fri Mar 13 17:20:03 2026 +0100 arm64: dts: imx91-var-dart: Add support for Variscite Sonata board Add device tree support for the Variscite Sonata carrier board with the DART-MX91 system on module. The Sonata board includes - uSD Card support - USB ports and OTG - Additional Gigabit Ethernet interface - Uart interfaces - GPIO Expanders - RTC module - TPM module Link: https://variscite.com/carrier-boards/sonata-board/ Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit d3ad2ce2116f1de4616a17414a186eb671cb83cf Author: Stefano Radaelli Date: Fri Mar 13 17:20:02 2026 +0100 arm64: dts: freescale: Add support for Variscite DART-MX91 Add device tree support for the Variscite DART-MX91 system on module. This SOM is designed to be used with various carrier boards. The module includes: - NXP i.MX91 MPU processor - Up to 2GB of LPDDR4 memory - Up to 128GB of eMMC storage memory - Integrated 10/100/1000 Mbps Ethernet Transceiver - Codec audio WM8904 - WIFI6 dual-band 802.11ax/ac/a/b/g/n with optional 802.15.4 and Bluetooth Only SOM-specific peripherals are enabled by default. Carrier board specific interfaces are left disabled to be enabled in the respective carrier board device trees. Link: https://variscite.com/system-on-module-som/i-mx-9/i-mx-91/dart-mx91/ Signed-off-by: Stefano Radaelli Reviewed-by: Frank Li Signed-off-by: Frank Li commit c7af54e6944be1508b251a255386e256bea14e99 Author: Alexander Stein Date: Fri Mar 13 15:13:04 2026 +0100 arm64: dts: imx95: Move funnel outside from soc The 'funnel' node does not contain a register range, so it should be placed outside of the soc node to fix schema warnings from simple-bus.yaml. Change is similar to commit 9cfe3c892b761 ("arm64: dts: imx8mp: Move funnel outside from soc") Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 1bc7c90aa1cec5ef098d8f686c3f555addcc3509 Author: Alexander Stein Date: Fri Mar 13 08:10:25 2026 +0100 arm64: dts: imx8mn-tqma8mqnl-mba8mx: LVDS overlay: Reduce DSI burst clock to 600Mhz The DSI burst clock frequency is too high resulting in flickering. Reduce the frequency. While at it, remove the burst clock from board configuration as it is display specific. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 70c6b1b4261a9bdded32821773cea9a7b14657e1 Author: Alexander Stein Date: Fri Mar 13 08:10:24 2026 +0100 arm64: dts: imx8mm-tqma8mqml-mba8mx: LVDS overlay: Reduce DSI burst clock to 600Mhz The DSI burst clock frequency is too high resulting in flickering. Reduce the frequency. While at it, remove the burst clock from board configuration as it is display specific. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 248d61177b10d6cbc952c07f5a34ff434350462f Author: Alexander Stein Date: Fri Mar 13 08:10:23 2026 +0100 arm64: dts: imx8mm: Explicitly set DSI_PHY_REF clock as a child of CLK_24M Since commit a0deedcc0cf0 ("arm64: dts: imx8mm: Slow default video_pll1 clock rate") and commit 5fe6ec93f10b0 ("clk: imx8mm: Let IMX8MM_CLK_LCDIF_PIXEL set parent rate") VIDEO_PLL1 is dynamically programmed by CLK_LCDIF_PIXEL. On imx8mm-tqma8mqml-mba8mx-lvds-tm070jvhg33.dtso this results in a VIDEO_PLL1 frequency of 68.2 MHz and DSI_PHY_REF of 17.05MHz (1/4). Instead use the 24 MHz clock as parent for DSI PHY reference clock. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 21f0002238a534e1060db6218617fd6eab13b253 Author: Josua Mayer Date: Fri Mar 13 14:31:00 2026 +0200 arm64: dts: freescale: add support for solidrun i.mx8mm som and evb Add support for the SolidRun i.MX8M Mini SoM on HummingBoard Ripple. The SoM features: - 1Gbps Ethernet with PHY - eMMC - 1/2GB DDR - NPU (assembly option) - WiFi + Bluetooth The HummingBoard Ripple features: - 2x USB-2.0 Type-A connector - 1Gbps RJ45 Ethernet with PoE - microSD connector - microHDMI connector - mpcie connector with USB-2.0 interface + SIM card holder - microUSB connector for console (using fdtdi chip) - RTC with backup battery Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 79f63593c7b07109f79c1d3fc54bb4fc3eeaf29e Author: Josua Mayer Date: Fri Mar 13 14:30:59 2026 +0200 arm64: dts: freescale: add support for solidrun solidsense-n8 board Add support for the SolidRun SolidSense N8 Compact. The board is designed around the i.MX8MN SoC and comes as a complete product including enclosure and labels. Features: - USB-2.0 Type A connector - 1Gbps RJ45 Ethernet with PoE - microSD connector - eMMC - Cellular Modem + SIM holder - WiFi + Bluetooth - RS485 - CAN - 802.15.1 radio - supercapacitor backup power supply This is a headless design without display. The board includes an internal expansion connector for daughterboards which may be described by dt addon. The supercap is not currently described due to lack of suitable bindings. Vendor BSP uses gpio-keys driver to trigger shutdown on power loss. Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 514a34d75b9d16760971472af4f5f6550bf575ed Author: Josua Mayer Date: Fri Mar 13 14:30:58 2026 +0200 arm64: dts: imx8mp-hummingboard-iiot: add dt overlays for muxable ports The SolidRun i.MX8MP HummingBoard IIoT has a variety of connectors, and configurable ports: - 2x RS232 - 2x RS485 - DSI Panel Connector - LVDS Panel Connector RS232 and RS485 each share a single UART from the SoC via a mux, which are configured from the base dts for RS232 by default. Provide addons for: 1. Reconfigure UART A from RS232 to RS485. 2. Reconfigure UART B from RS232 to RS485. 3. Configure DSI Connector for Winstar WJ70N3TYJHMNG0 Panel. 4. Configure LVDS Connector for Winstar WF70A8SYJHLNGA Panel. A variation of the base dtb is generated for each addon to ensure that make dtbs_check covers the resulting dtb, and applying overlay is tested during build. It is however expected that bootloader should apply any combination of addons based on runtime configuration. Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 8da7bfdcda753ef4d7890f55966ffdbda785e72e Author: Josua Mayer Date: Fri Mar 13 14:30:57 2026 +0200 arm64: dts: freescale: add support for SolidRun i.MX8MP HummingBoard IIoT Introduce support for the SolidRun i.MX8MP HummingBoard IIoT platform. This board is a new design based on the i.MX8MP System on Module and does not share much hardware with previous HummingBoard variants. It comes with some common features: - 3x USB-3.0 Type A connector - 2x 1Gbps RJ45 Ethernet - USB Type-C Console Port - microSD connector - RTC with backup battery - RGB Status LED - 1x M.2 M-Key connector with PCI-E Gen. 3 x1 - 1x M.2 B-Key connector with USB-2.0/3.0 + SIM card holder - 1x LVDS Display Connector - 1x DSI Display Connector - GPIO header - 2x RS232/RS485 ports (configurable) - 2x CAN In addition there is a board-to-board expansion connector to support custom daughter boards with access to SPI, a range of GPIOs and - notably - CAN and UART. Both 2x CAN and 2x UART can be muxed either to this b2b connector, or a terminal block connector on the base board. The routing choice for UART and CAN is expressed through gpio mux-controllers in DT and can be changed by applying dtb overlays. Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit b06c76fcd88c4c3f7ec2dc88c368d1fd2770ad91 Author: Stefano Radaelli Date: Thu Mar 19 19:40:31 2026 +0100 arm64: dts: imx8mm-var-som-symphony: Enable PCIe Enable PCIe support on the VAR-SOM Symphony carrier board by adding the external reference clock, configuring the PHY and providing the required clock and reset properties. Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit 47fc77cb042d48712d9dee6068066abff4d3e737 Author: Stefano Radaelli Date: Thu Mar 19 19:40:30 2026 +0100 arm64: dts: imx8mm-var-som-symphony: Enable I2C4 Enable I2C4 on the Symphony carrier and add pinctrl configuration, including GPIO-based bus recovery support. Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit 9681db803b0544c66eacc062ac29cc80b27c0fd0 Author: Stefano Radaelli Date: Thu Mar 19 19:40:29 2026 +0100 arm64: dts: imx8mm-var-som-symphony: Add TPM2 support Add support for the TPM2 device on the VAR-SOM Symphony carrier board. The ST33K TPM2 is connected over I2C, and A PCA6408 GPIO expander is used to control the reset signal required to release the TPM from reset. Add the PCA6408 GPIO expander and the ST33K TPM2 device node. Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit 20aa2aee5050473d83bd96a6ebbde9f3735e8b84 Author: Stefano Radaelli Date: Thu Mar 19 19:40:28 2026 +0100 arm64: dts: imx8mm-var-som-symphony: Enable uSD on USDHC2 Enable the microSD slot on the VAR-SOM Symphony carrier board. Configure USDHC2 with card-detect GPIO, pinctrl states for the supported bus speeds and the required VMMC supply. Update the VMMC regulator to match the latest carrier revision by moving the enable GPIO to GPIO4_IO22 and adding the required off-on delay. Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit 4e9088abeacb9fca16c3774bd3d57a696924a0f2 Author: Stefano Radaelli Date: Thu Mar 19 19:40:27 2026 +0100 arm64: dts: imx8mm-var-som-symphony: Move USB configuration from SOM Move the USB controller configuration out of the i.MX8MM VAR-SOM dtsi and into the VAR-SOM Symphony carrier board dts. The SOM does not provide any USB connectors and carrier boards may choose whether and how to route USB, therefore USB should be described in the carrier-specific device tree instead of the SOM include. While moving the nodes, align the Symphony USB description with the carrier design by enabling both USB controllers, wiring USB1 to the PTN5150 Type-C controller for dual-role operation, and updating the PHY tuning and VBUS regulator pinctrl (including a sleep state). Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit 8e7ce17e6df46e33857a1d1b416ccea2504988bc Author: Stefano Radaelli Date: Thu Mar 19 19:40:26 2026 +0100 arm64: dts: freescale: imx8mm-var-som: Rework WiFi/BT and add legacy dts The VAR-SOM-MX8MM currently integrates the NXP IW61x wireless module, providing WiFi over SDIO and Bluetooth over UART. Move the wireless module configuration out of the base imx8mm-var-som.dtsi and provide dedicated variant includes. The IW61x configuration is moved to imx8mm-var-som-wifi-bt-iw61x.dtsi and used by the Symphony evaluation board device tree. A separate imx8mm-var-som-wifi-brcm-legacy.dtsi include is added to keep the configuration for the legacy Broadcom SDIO WiFi module used on earlier SOM revisions. To preserve compatibility with older SOM revisions, add a separate imx8mm-var-som-symphony-legacy.dtb, which disables the IW61x setup and applies the Broadcom-specific configuration. The Broadcom-based SOM revision is no longer in production, but support is kept for existing users. Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit 4c2d9f56f49667362c31b5426e083de3666b33b4 Author: Stefano Radaelli Date: Thu Mar 19 19:40:25 2026 +0100 arm64: dts: freescale: imx8mm-var-som: Add MCP251xFD CAN controller Add support for the Microchip MCP251xFD CAN-FD controller connected to the SPI bus on the i.MX8MM VAR-SOM. The controller uses a 40 MHz external oscillator and requires an interrupt line and a dedicated RX interrupt GPIO. Add the fixed clock, the MCP251xFD device node with the required properties, and the corresponding pinctrl configuration. Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit 3eb24db8fadfcf9c22a1534e4da2824c80e5f97b Author: Stefano Radaelli Date: Thu Mar 19 19:40:24 2026 +0100 arm64: dts: freescale: imx8mm-var-som: Add support for WM8904 audio codec The VAR-SOM-MX8MM can integrate the WM8904, a high-performance ultra-low-power stereo codec optimized for portable audio applications. Add the WM8904 device to the appropriate I2C bus, enable the SAI peripheral, and introduce the sound node to expose the sound card to the system. Add I3C recovery gpio properties. Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit b58a110d8efe944315a29c0bc1af0d77b86e7bd5 Author: Stefano Radaelli Date: Thu Mar 19 19:40:23 2026 +0100 arm64: dts: freescale: imx8mm-var-som: Update FEC support with MaxLinear PHY Update the FEC Ethernet controller on the i.MX8MM VAR-SOM to match the latest SOM hardware revision using the integrated MaxLinear MXL86110 PHY. Add the PHY VDDIO supply regulator, adjust reset timings and add a pinctrl sleep state for low-power operation. The PHY LED signals originate on the SOM, but the actual LEDs are part of the carrier implementation (RJ45 connector). Move the LED configuration to the Symphony carrier device tree, matching the evaluation board LED wiring. Wake-on-LAN via magic packet is not supported at the VAR-SOM level and is therefore not enabled in the SOM device tree nor in the official evaluation carrier board configuration (symphony). Designs requiring WoL support may enable it in their own carrier-specific device trees if properly integrated at the hardware level. Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit af88e34bf2374b638393f84f3f50b0453361041e Author: Stefano Radaelli Date: Thu Mar 19 19:40:22 2026 +0100 arm64: dts: freescale: imx8mm-var-som: Align fsl,pins tables Reformat the fsl,pins tables in the i.MX8MM VAR-SOM device tree to use consistent column alignment across all pinctrl groups. Align the entries to match the formatting already used in the pinctrl_fec1 group, which contains the longest pin definitions, for improved readability and consistency. No functional changes intended. Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit d89573876d9fa8ddc7ca50e005a4896ed890ece2 Author: Stefano Radaelli Date: Thu Mar 19 19:40:21 2026 +0100 arm64: dts: freescale: imx8mm-var-som: Move UART4 description to Symphony The VAR-SOM-MX8MM module does not provide an onboard debug console. UART4 is routed and exposed only on the Symphony carrier board, while custom carrier designs may choose to expose a different UART. Move the UART4 node from the SOM device tree to the imx8mm-var-som-symphony.dts, keeping the SOM dtsi limited to hardware present on the module itself. Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit accb1e186434f8fb40a722b61e74a5888113e58e Author: Geert Uytterhoeven Date: Wed Mar 4 18:11:01 2026 +0100 arm64: dts: freescale: imx: Drop CPU masks from GICv3 PPI interrupts Unlike older GIC variants, the GICv3 DT bindings do not support specifying a CPU mask in PPI interrupt specifiers. Drop the masks. Signed-off-by: Geert Uytterhoeven Signed-off-by: Frank Li commit 2cf0902ca88d489d50346464b8c71545561b61b9 Author: Geert Uytterhoeven Date: Wed Mar 4 18:11:00 2026 +0100 arm64: dts: fsl-ls1028a: Drop CPU masks from GICv3 PPI interrupts Unlike older GIC variants, the GICv3 DT bindings do not support specifying a CPU mask in PPI interrupt specifiers. Drop the masks. Signed-off-by: Geert Uytterhoeven Signed-off-by: Frank Li commit 130d90114c5255a7a729158da8fd8298a02017f1 Author: Annette Kobou Date: Mon Mar 9 09:57:43 2026 +0100 arm64: dts: imx8mp-kontron: Fix boot order for PMIC and RTC The PMIC provides a level-shifter for the I2C lines to the RTC. As the level shifter needs to be enabled before the RTC can be accessed, make sure that the PMIC driver is probed first. As the PMIC also provides the supply voltage for the RTC through the 3.3V regulator, simply express this in the DT to create the required dependency. Avoid sporadic boot hangs that occurred when the RTC was accessed before the level-shifter was enabled. Fixes: 946ab10e3f40f ("arm64: dts: Add support for Kontron OSM-S i.MX8MP SoM and BL carrier board") Signed-off-by: Annette Kobou Signed-off-by: Frieder Schrempf Signed-off-by: Frank Li commit d213404642af732fe73f35dfd1c7ed6801556362 Author: Rob Herring (Arm) Date: Fri Mar 6 14:31:02 2026 -0600 arm64: dts: freescale: imx93: Add Ethos-U65 NPU and SRAM nodes i.MX93 contains an Arm Ethos-U65 NPU. The NPU uses the internal SRAM for temporary buffers. The SRAM is larger than 96KB, but that is all that is available to non-secure world. Signed-off-by: Rob Herring (Arm) Reviewed-by: Peter Robinson Tested-by: Peter Robinson # Tested on a NXP Signed-off-by: Frank Li commit b426ee9833092e193d8ead13ceba467df14565be Author: Alexander Stein Date: Fri Mar 13 08:07:36 2026 +0100 arm64: dts: imx91-tqma9131-mba91xxca: Add LVDS display overlay Add support for Tianma TM070JVHG33 LVDS display on interface X11/X12 on MBa91xxCA. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 5c0bf61401b4ab0150245566555e043193654ee1 Author: Alexander Stein Date: Fri Mar 13 08:07:35 2026 +0100 arm64: dts: imx91-tqma9131-mba91xxca: Add parallel display overlay Add support for CDTech S070SWV29HG-DC44 display on parallel interface X3 on MBa91xxCA. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 00ffd51cf5322bdce771acf07f95d5ce485410c0 Author: Alexander Stein Date: Fri Mar 13 08:07:34 2026 +0100 arm64: dts: imx93-tqma9352-mba91xxca: Add LVDS display overlay This adds support for Tianma TM070JVHG33 LVDS display on interface X11/X12 on MBa91xxCA. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 6bacabb9580aeec6f22ea029c0060197a5e47f07 Author: Alexander Stein Date: Fri Mar 13 08:07:33 2026 +0100 arm64: dts: imx93-tqma9352-mba91xxca: Add parallel display overlay Add support for CDTech S070SWV29HG-DC44 display on parallel interface X3 on MBa91xxCA. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 6b7a9871e171e374d208822a02f02aa9d9a4d102 Author: Emanuele Ghidoli Date: Tue Mar 3 22:01:07 2026 +0100 arm64: dts: freescale: imx95-toradex-smarc: Support Cortex M7 Enable Cortex M7, the vring nodes, a mailbox and reserve DDR memory for the M7. The remoteproc framework is so capable to load and run the M7 firmware. Signed-off-by: Emanuele Ghidoli Signed-off-by: Frank Li commit d5b16c79260d88fae73d0538cbb4826aa11e8bf0 Author: Alexander Stein Date: Fri Mar 13 08:02:24 2026 +0100 arm64: dts: imx8mm-tqma8mqml-mba8mx-tm070jvhg33: Remove compatible from overlay Override of board compatible is unexpected, especially when the same dtso override difference mainboard. So remove it and update the copyright year. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 404ef04083541fb5e052f2e32aa6f470666558d0 Author: Alexander Stein Date: Fri Mar 13 08:02:23 2026 +0100 arm64: dts: imx8mn-tqma8mqnl-mba8mx-tm070jvhg33: Remove compatible from overlay Override of board compatible is unexpected, especially when the same dtso override difference mainboard. So remove it and update the copyright year. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 4aa57a1c8eb6cd5ee7e53bb76813ddd788d0d14f Author: Alexander Stein Date: Fri Mar 13 08:02:22 2026 +0100 arm64: dts: imx8mq-tqma8mq-mba8mx-tm070jvhg33: Remove compatible from overlay Override of board compatible is unexpected, especially when the same dtso override difference mainboard. So remove it and update the copyright year. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 793b851ac90fff31fc6628a8582520fc65733122 Author: Alexander Stein Date: Fri Mar 13 08:02:21 2026 +0100 arm64: dts: imx8mp-tqma8mpql-mba8mpxl-tm070jvhg33: Remove compatible from overlay Override of board compatible is unexpected, especially when the same dtso override difference mainboard. So remove it and update the copyright year. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 496c73bd62cc451030c763aa6f8c352273a1f3a9 Author: Alexander Stein Date: Fri Mar 13 08:02:20 2026 +0100 arm64: dts: imx8mp-tqma8mpql-mba8mpxl-g133han01: Remove compatible from overlay Override of board compatible is unexpected, especially when the same dtso override difference mainboard. So remove it and update the copyright year. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit cb7b1131885b6a1ee2a60969d433d66069151bb5 Author: Ciprian Marian Costea Date: Wed Mar 11 09:11:54 2026 +0100 arm64: dts: freescale: Add NXP S32N79-RDB board support Add device tree support for the NXP S32N79 Reference Design Board (RDB) [1]. The S32N79-RDB enables the following peripherals: - PL011 UART controllers (uart0, uart5, uart6, uart7) - uSDHC controller - IRQ steering controller The board has 32GB of DRAM memory with 28GB usable and 4GB reserved for ECC logic. [1] https://www.nxp.com/products/processors-and-microcontrollers/s32-automotive-platform/s32n-vehicle-super-integration-processors:S32N Co-developed-by: Larisa Grigore Signed-off-by: Larisa Grigore Co-developed-by: Andra-Teodora Ilie Signed-off-by: Andra-Teodora Ilie Signed-off-by: Ciprian Marian Costea Signed-off-by: Frank Li commit b6219083012756cd77966caf1c2b408178ee5a79 Author: Ciprian Marian Costea Date: Wed Mar 11 09:11:53 2026 +0100 arm64: dts: freescale: Add NXP S32N79 SoC support Add device tree support for the NXP S32N79 automotive SoC [1]. The S32N79 features eight Arm Cortex-A78AE cores organized in four dual-core clusters, with a three-level cache hierarchy (L1/L2 per core, L3 per dual-core cluster) and 32GB of DRAM memory. It includes an SMMUv3 for IOMMU functionality. On S32N79 SoC, peripherals are organized into subsystems, such as: - CIS (Coherent Interconnect Subsystem) - COSS (Connectivity Subsystem) - FSS (Foundation Subsystem) This initial support includes basic peripherals: - GICv3, SMMUv3 from CIS Subsystem - PL011 UARTs and IRQ steering controller from COSS Subsystem - uSDHC from FSS Subsystem Clock and Pin multiplexing settings for the chip are managed over SCMI. [1] https://www.nxp.com/products/processors-and-microcontrollers/s32-automotive-platform/s32n-vehicle-super-integration-processors:S32N Co-developed-by: Larisa Grigore Signed-off-by: Larisa Grigore Co-developed-by: Andra-Teodora Ilie Signed-off-by: Andra-Teodora Ilie Co-developed-by: Andrei Cherechesu Signed-off-by: Andrei Cherechesu Signed-off-by: Ciprian Marian Costea Signed-off-by: Frank Li commit ca2932ae84f47da0fc0963fd83746b47933151eb Author: Eduard Bostina Date: Mon Mar 9 20:15:23 2026 +0200 arm64: dts: imx8mp-dhcom-pdk3: Use symbolic macro for IOMUXC_SAI2_TXC__GPIO4_IO25 Currently, in order to configure IOMUXC_SAI2_TXC__GPIO4_IO25 a magic raw value is written in this register. This makes the code not obvious to read and modify. Use the MX8MP_SION symbolic macro instead of the magic value to improve code readability. Signed-off-by: Eduard Bostina Reviewed-by: Daniel Baluta Signed-off-by: Frank Li commit ae823891de84c2a03751094dbaafae5c2b7c16b9 Author: Xu Yang Date: Mon Mar 9 18:08:07 2026 +0800 arm64: dts: imx943-evk: add Type-C and USB related nodes Add Type-C and USB related nodes. There are two Type-C ports, one is USB2 only and another is USB3. Signed-off-by: Xu Yang Signed-off-by: Frank Li commit 8c021406cbbf89332d21daf8882f26af98362f13 Author: Xu Yang Date: Mon Mar 9 18:08:06 2026 +0800 arm64: dts: imx94: add USB nodes add USB2.0, USB3.0 controller and USB phy nodes. Signed-off-by: Xu Yang Signed-off-by: Frank Li commit 53a0485304f11f5371fddf9fb06b95268154bf82 Author: Alexander Stein Date: Thu Mar 5 17:42:22 2026 +0100 arm64: dts: imx91: Remove TMU's superfluous sensor ID Currently a sensor ID is added to the reference, but thermal-sensor@44482000 has #thermal-sensor-cells = <0>, so parsing fails. This also has the effect that other hwmon sensors (jc42) fail to probe. Fix this by removing the superfluous sensor ID. Fixes: f0ed0e844452 ("arm64: dts: imx91: Add thermal-sensor and thermal-zone support") Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 5397ea118c111f1cb5b4bd7dac6503365d79f6c3 Author: Alexander Stein Date: Thu Mar 5 12:10:37 2026 +0100 arm64: dts: tqma9352-mba91xxca: Change Ethernet PHY IRQ to IRQ_TYPE_LEVEL_LOW Ethernet PHY interrupt mode is level triggered. Adjust the mode accordingly. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 5bc539bb19b7bfc1273018dde63215bf5f2c2810 Author: Alexander Stein Date: Thu Mar 5 12:10:36 2026 +0100 arm64: dts: tqma9352-mba93xx*: Change Ethernet PHY IRQ to IRQ_TYPE_LEVEL_LOW Ethernet PHY interrupt mode is level triggered. Adjust the mode accordingly. Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 2b5b97cd3978f230ee57b1d1b6abbf0f984e466e Author: Daniel Baluta Date: Mon Mar 2 15:38:05 2026 +0200 arm64: dts: imx8mp-frdm: Use symbolic macros for IOMUXC_SW_PAD_CTL_PAD Currently, in order to configure IOMUXC_SW_PAD_CTL_PAD a magic raw value is written in this register. This makes code not obvious to read and modify. Use symbolic macros instead of the magic values to improve code readability. Signed-off-by: Daniel Baluta Signed-off-by: Frank Li commit 95f56afadb0905e2181f3e966b4e5173780a05a6 Author: Daniel Baluta Date: Mon Mar 2 15:38:04 2026 +0200 arm64: dts: imx8mp: Make MX8MP_I2C_DEFAULT independent on drive strength Currently MX8MP_I2C_DEFAULT macro includes a fixed drive strength (MX8MP_DSE_X6) thus limiting its use to only I2C pins that require X6 drive. There are many pinctrl configurations for I2C that use different drive strength while still using the common I2C default configurations (pull-up, Schmitt input, pull enable, SION). So make the MX8MP_I2C_DEFAULT macro more flexible and reusable by removing DSE_X6 drive strength from it's definition but add or it in all places it is necessary. Reviewed-by: Maud Spierings Signed-off-by: Daniel Baluta Signed-off-by: Frank Li commit b8d785a9f360abcd6a6f8f10a2adf222f8494d66 Author: Nora Schiffer Date: Mon Mar 2 09:45:48 2026 +0100 arm64: dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS muxing UART1 operates in DCE mode, but the RTS/CTS pins were incorrectly configured using the DTE pinmux setting. Correct the pinmux to match DCE mode. Switching the RTS and CTS signals is fine for this board, as UART1 is routed to a pin header. Existing functionality is unaffected, as RTS/CTS could never have worked with the incorrect pinmux. Fixes: ddabb3ce3f90 ("arm64: dts: freescale: add TQMa8MPQL on MBa8MP-RAS314") Signed-off-by: Nora Schiffer Reviewed-by: Alexander Stein Signed-off-by: Frank Li commit bef7b4f58d4a93e6e4d37e46b6c5dea536d10aee Author: Liu Ying Date: Fri Feb 27 10:14:05 2026 +0800 arm64: dts: imx93-9x9-qsb: Add ontat,kd50g21-40nt-a1 panel Support ontat,kd50g21-40nt-a1 DPI panel on i.MX93 9x9 QSB. The panel connects with the QSB board through Adafruit DPI Display Kippah adapter board[1]. Link: https://learn.adafruit.com/adafruit-dpi-display-kippah-ttl-tft/downloads [1] Signed-off-by: Liu Ying Signed-off-by: Frank Li commit 5aee26a0e7ae87136c13034cf917333eba92f49d Author: Frank Li Date: Thu Feb 26 15:19:47 2026 -0500 arm64: dts: imx8mp-beacon: remove fallback ethernet-phy-ieee802.3-c22 Remove the fallback compatible string "ethernet-phy-ieee802.3-c22" from the Ethernet PHY node to fix below CHECK_DTB warning: arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dtb: ethernet-phy@3 (ethernet-phy-id0022.1640): compatible: ['ethernet-phy-id0022.1640', 'ethernet-phy-ieee802.3-c22'] is too long from schema $id: http://devicetree.org/schemas/net/micrel,gigabit.yaml Signed-off-by: Frank Li commit bf68c18150efcd24b5b18522dd40700837af30e1 Author: Shengjiu Wang Date: Fri Feb 27 09:58:37 2026 +0800 arm64: dts: imx8mp-ab2: add support for NXP i.MX8MP audio board (version 2) i.MX Audio Board is a configurable and functional audio processing platform. Integrating a variety of audio input and output interfaces into the system, the i.MX Audio Board supports HDMI input, HDMI eARC, S/PDIF I/O, 2-ch ADC line-in, 24-ch DAC line-out and more. Based on these features, rich audio application cases can be realized. This is a basic device tree supporting with i.MX8M Plus SoC and Audio board (version 2). - Quad Cortex-A53 - 6GB LPDDR4 DRAM - PCA9450C PMIC with regulators - NXP PCAL6416 GPIO expanders - RGB LEDs via GPIO expander - I2C1, I2C2, I2C3 controllers - UART2 (console) and UART3 (with RTS/CTS) - USDHC3 (8-bit eMMC) - SNVS power key (onboard power button) - Three DAC (AK4458) - One ADC (AK5552) Squash Correct PAD settings (enable PUE and PU) for PMIC_nINT (GPIO1_IO3) to avoid irq storm. Signed-off-by: Viorel Suman Signed-off-by: Shengjiu Wang Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 8ff145577e93f312ff398cb950ee3bd44835f5be Author: Peng Fan Date: Thu Mar 26 15:28:16 2026 +0800 arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT PMIC_nINT is low level triggered, but the current PAD settings is PE=0,PUE=0,FSEL_1_FAST_SLEW_RATE=1,SION=1. So PAD needs to be configured as PULL UP with PULL Enable, no need SION. Correct it. Fixes: 562d222f23f0f ("arm64: dts: imx8mp: Add support for Data Modul i.MX8M Plus eDM SBC") Signed-off-by: Peng Fan Signed-off-by: Frank Li commit f9ed5afc988da3e22543725e35be6addbb0497bc Author: Peng Fan Date: Thu Mar 26 15:28:15 2026 +0800 arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT PMIC_nINT is low level triggered, but the current PAD settings is PE=0,PUE=0,FSEL_1_FAST_SLEW_RATE=1,SION=1. So PAD needs to be configured as PULL UP with PULL Enable, no need SION. Correct it. Fixes: 8d6712695bc8e ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2") Signed-off-by: Peng Fan Signed-off-by: Frank Li commit daaf41ee72fb5fad936e7051a015cccae9b33937 Author: Peng Fan Date: Thu Mar 26 15:28:14 2026 +0800 arm64: dts: imx8mp-ultra-mach-sbc: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there might be interrupt storm for this board. Need to set PAD PUE and PU together to make pull up work properly. Fixes: d1c1400bd3b8b ("arm64: dts: imx8mp: Add initial support for Ultratronik imx8mp-ultra-mach-sbc board") Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 695a476275cfb9c798a696aeaa43967701d5c78a Author: Peng Fan Date: Thu Mar 26 15:28:13 2026 +0800 arm64: dts: imx8mp-sr-som: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there might be interrupt storm for this board. Need to set PAD PUE and PU together to make pull up work properly. Fixes: a009c0c66ecb4 ("arm64: dts: add description for solidrun imx8mp som and cubox-m") Signed-off-by: Peng Fan Reviewed-by: Josua Mayer Signed-off-by: Frank Li commit 16611eda2c7584a1a7d6f80511d825e5108f026c Author: Peng Fan Date: Thu Mar 26 15:28:12 2026 +0800 arm64: dts: imx8mp-nitrogen-som: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there might be interrupt storm for this board. Need to set PAD PUE and PU together to make pull up work properly. Fixes: ab4d874c9f44e ("arm64: dts: imx8mp: Add device tree for Nitrogen8M Plus ENC Carrier Board") Signed-off-by: Peng Fan Signed-off-by: Frank Li commit e6d2d8e49ca34bb39126a69128794d08ffd7c83e Author: Peng Fan Date: Thu Mar 26 15:28:11 2026 +0800 arm64: dts: imx8mp-aristainetos3a-som-v1: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there might be interrupt storm for this board. Need to set PAD PUE and PU together to make pull up work properly. Fixes: eead8f3536d5c ("arm64: dts: imx8mp: add aristainetos3 board support") Signed-off-by: Peng Fan Signed-off-by: Frank Li commit c46c5a54443440ce0f71de9f4df9dd860f5c2afd Author: Peng Fan Date: Thu Mar 26 15:28:10 2026 +0800 arm64: dts: imx8mp-edm-g: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there might be interrupt storm for this board. Need to set PAD PUE and PU together to make pull up work properly. Fixes: 95e882c021c8b ("arm64: dts: imx8mp: Add TechNexion EDM-G-IMX8M-PLUS SOM on WB-EDM-G carrier board") Signed-off-by: Peng Fan Signed-off-by: Frank Li commit ea8c90f5c7ceeb6657a8fe564aa7b190dce298a6 Author: Peng Fan Date: Thu Mar 26 15:28:09 2026 +0800 arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there might be interrupt storm for this board. Need to set PAD PUE and PU together to make pull up work properly. Fixes: eefe06b295087 ("arm64: dts: imx8mp: Add Engicam i.Core MX8M Plus SoM") Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 741d6ac1a2a2e0f3e2cae5eef3516cdd75119e83 Author: Peng Fan Date: Thu Mar 26 15:28:07 2026 +0800 arm64: dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there will be interrupt storm for i.MX8MP NAVQP. Per schematic, there is no on board PULL-UP resistors for GPIO1_IO03, so need to set PAD PUE and PU together to make pull up work properly. Fixes: 682729a9d506d ("arm64: dts: freescale: Add device tree for Emcraft Systems NavQ+ Kit") Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 2ea7872048a179b0ea8dadc67771961df3f0fc4a Author: Peng Fan Date: Thu Mar 26 15:28:06 2026 +0800 arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there is interrupt storm for i.MX8MP DEBIX SOM A. Need to set PAD PUE and PU together to make pull up work properly. Fixes: 21baf0b47f81b ("arm64: dts: freescale: Add DEBIX SOM A and SOM A I/O Board support") Reported-by: Laurent Pinchart Closes: https://lore.kernel.org/all/20260323105858.GA2185714@killaraus.ideasonboard.com/ Reported-by: Kieran Bingham Closes: https://lore.kernel.org/imx/20260324194353.GB2352505@killaraus.ideasonboard.com/T/#m9a07fdc75496369a7d76d52c5e34ed140dcabfe3 Signed-off-by: Peng Fan Reviewed-by: Kieran Bingham Signed-off-by: Frank Li commit 3b778178997aee24537b521a8cb60970bc1ce01c Author: Peng Fan Date: Thu Mar 26 15:28:05 2026 +0800 arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT With commit 5d0efaf47ee90 ("regulator: pca9450: Correct interrupt type"), there is interrupt storm for i.MX8MP DEBIX Model A. Per schematic, there is no on board PULL-UP resistors for GPIO1_IO03, so need to set PAD PUE and PU together to make pull up work properly. Fixes: c86d350aae68e ("arm64: dts: Add device tree for the Debix Model A Board") Reported-by: Laurent Pinchart Closes: https://lore.kernel.org/all/20260323105858.GA2185714@killaraus.ideasonboard.com/ Reviewed-by: Laurent Pinchart Tested-by: Laurent Pinchart Signed-off-by: Peng Fan Signed-off-by: Frank Li commit bbc6c0dda54fc0ad8f8aed0b796c23e186e1a188 Author: Cássio Gabriel Date: Tue Mar 24 16:59:41 2026 -0300 ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes snd_seq_oss_write() currently returns the raw load_patch() callback result for SEQ_FULLSIZE events. That callback is documented as returning 0 on success and -errno on failure, but snd_seq_oss_write() is the file write path and should report the number of user bytes consumed on success. Some in-tree backends also return backend-specific positive values, which can still be shorter than the original write size. Return the full byte count for successful SEQ_FULLSIZE writes. Preserve negative errors and convert any nonnegative completion to the original count. Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260324-alsa-seq-oss-fullsize-write-return-v1-1-66d448510538@gmail.com Signed-off-by: Takashi Iwai commit a213b6b019519063ce10569b19da20eac6ab884f Author: Cássio Gabriel Date: Mon Mar 23 10:46:24 2026 -0300 ALSA: usb-audio: rotate standard MIDI output port scan snd_usbmidi_standard_output() iterates output ports in ascending order and drains each active port until the URB is full. On interfaces where multiple USB-MIDI cables share one endpoint, sustained traffic on a lower-numbered port can consume every refill before higher-numbered ports are even examined. That behavior dates back to the original implementation and still applies with the current multi-URB output path. snd_usbmidi_do_output() can refill several idle URBs in one pass, but each refill restarts the scan at port 0, so a busy lower-numbered port can keep higher-numbered ports from making progress at all. Use ep->current_port as the starting point of the scan and advance it after each URB fill. This keeps the existing packet formatting and per-port state handling intact while preventing persistent starvation of higher-numbered ports. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260323-usbmidi-port-fairness-v1-1-2d68e97592a1@gmail.com Signed-off-by: Takashi Iwai commit 32f35f9d8e457f5b2ee1df3f7a45af42965bedfe Author: songxiebing Date: Wed Mar 25 09:51:19 2026 +0800 ALSA: core/seq: Optimize the return logic in cc_ev_to_ump_midi2 There are multiple early return branches within the func, and compiler optimizations(such as -O2/-O3)lead to abnormal stack frame analysis - objtool cannot comfirm that the stack frames of all branches can be correctly restored, thus generating false warnings. Below: >> sound/core/seq/seq_ump_convert.o: warning: objtool: cc_ev_to_ump_midi2+0x589: return with modified stack frame So we modify it by uniformly returning at the and of the function. Signed-off-by: songxiebing Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202503200535.J3hAvcjw-lkp@intel.com/ Link: https://patch.msgid.link/20260325015119.175835-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai commit 1e512ac1254c8e370dd18efe9da4dfc92492cdc5 Author: Cássio Gabriel Date: Sat Mar 21 20:02:21 2026 -0300 ALSA: pcm: Use pcm_lib_apply_appl_ptr() in x32 sync_ptr snd_pcm_ioctl_sync_ptr_x32() still handles incoming appl_ptr updates differently from the other SYNC_PTR paths. The native handler and the 32-bit compat handler both pass appl_ptr through pcm_lib_apply_appl_ptr(), but the x32 handler still writes control->appl_ptr directly. That direct assignment skips the common appl_ptr validation against runtime->boundary and also bypasses the substream ack() callback. This makes the x32 ioctl path behave differently from the native and compat32 cases, and it can miss the driver notification that explicit appl_ptr synchronization relies on. Use pcm_lib_apply_appl_ptr() for x32 too, so appl_ptr updates are validated consistently and drivers relying on ack() notifications see the same behavior. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260321-alsa-pcm-x32-sync-ptr-v1-1-02ce655657c6@gmail.com Signed-off-by: Takashi Iwai commit 4b097a7b25a01a3732f0e7569921efc9ad22bc81 Author: Ben Copeland Date: Thu Mar 19 12:45:21 2026 +0000 selftests: ALSA: Skip utimer test when CONFIG_SND_UTIMER is not enabled The timer_f.utimer test hard-fails with ASSERT_EQ when SNDRV_TIMER_IOCTL_CREATE returns -1 on kernels without CONFIG_SND_UTIMER. This causes the entire alsa kselftest suite to report a failure rather than skipping the unsupported test. When CONFIG_SND_UTIMER is not enabled, the ioctl is not recognised and the kernel returns -ENOTTY. If the timer device or subdevice does not exist, -ENXIO is returned. Skip the test in both cases, but still fail on any other unexpected error. Suggested-by: Mark Brown Link: https://lore.kernel.org/linux-kselftest/0e9c25d3-efbd-433b-9fb1-0923010101b9@stanley.mountain/ Signed-off-by: Ben Copeland Reviewed-by: Mark Brown Link: https://patch.msgid.link/20260319124521.191491-1-ben.copeland@linaro.org Signed-off-by: Takashi Iwai commit 3762e535f2c9b31716a982d9fdd5c51d5ec7aa42 Author: Vladimir Zapolskiy Date: Thu Mar 26 18:53:45 2026 +0200 i2c: qcom-cci: Remove unused CCI_RES_MAX macro definition Trivial change, a never used macro CCI_RES_MAX can be removed from the CCI driver. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Loic Poulain Reviewed-by: Konrad Dybcio Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260326165345.762807-1-vladimir.zapolskiy@linaro.org commit cfb839de4eb3443e37996388943cc7482b83a022 Author: Moritz Fischer Date: Thu Mar 26 20:04:51 2026 +0000 i2c: designware: Add a new ACPI HID for GOOG5000 I2C controller Define a new ACPI HID for GOOG5000 as used on Google Axion. This has been validated on Silicon. Signed-off-by: Moritz Fischer Acked-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260326200451.2904375-1-moritzf@google.com commit b7c958d7c1eb1cb9b2be7b5ee4129fcd66cec978 Author: Osama Abdelkader Date: Mon Mar 16 16:16:11 2026 +0100 riscv: kvm: fix vector context allocation leak When the second kzalloc (host_context.vector.datap) fails in kvm_riscv_vcpu_alloc_vector_context, the first allocation (guest_context.vector.datap) is leaked. Free it before returning. Fixes: 0f4b82579716 ("riscv: KVM: Add vector lazy save/restore support") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader Reviewed-by: Andy Chiu Link: https://lore.kernel.org/r/20260316151612.13305-1-osama.abdelkader@gmail.com Signed-off-by: Anup Patel commit aa35bcf2e76234fef7bbca9bf364039692a27661 Author: Osama Abdelkader Date: Thu Mar 12 00:18:32 2026 +0100 RISC-V: KVM: fix PMU snapshot_set_shmem on 32-bit hosts When saddr_high != 0 on RV32, the goto out was unconditional, causing valid 64-bit addresses to be rejected. Only goto out when the address is invalid (64-bit host with saddr_high != 0). Fixes: c2f41ddbcdd7 ("RISC-V: KVM: Implement SBI PMU Snapshot feature") Signed-off-by: Osama Abdelkader Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20260311231833.13189-1-osama.abdelkader@gmail.com Signed-off-by: Anup Patel commit 377609ae8b6ac2ef522c9dcecfa20a7123116dbf Author: Yeoreum Yun Date: Sat Mar 14 17:51:33 2026 +0000 arm64: Kconfig: Add support for LSUI Since Armv9.6, FEAT_LSUI supplies the load/store instructions for previleged level to access to access user memory without clearing PSTATE.PAN bit. Add Kconfig option entry for FEAT_LSUI. Signed-off-by: Yeoreum Yun Reviewed-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 16dbe77a5be2defe5797cc33da87e33f72ef150c Author: Yeoreum Yun Date: Sat Mar 14 17:51:32 2026 +0000 KVM: arm64: Use CAST instruction for swapping guest descriptor Use the CAST instruction to swap the guest descriptor when FEAT_LSUI is enabled, avoiding the need to clear the PAN bit. FEAT_LSUI is introduced in Armv9.6, where FEAT_PAN is mandatory. However, this assumption may not always hold: - Some CPUs may advertise FEAT_LSUI but lack FEAT_PAN. - Virtualization or ID register overrides may expose invalid feature combinations. Therefore, instead of disabling FEAT_LSUI when FEAT_PAN is absent, wrap LSUI instructions with uaccess_ttbr0_enable()/disable() when ARM64_SW_TTBR0_PAN is enabled. Signed-off-by: Yeoreum Yun Reviewed-by: Marc Zyngier Signed-off-by: Catalin Marinas commit 44adf2bf40efe56c68c1563779ab2047eb0a57ea Author: Yeoreum Yun Date: Sat Mar 14 17:51:30 2026 +0000 arm64: futex: Support futex with FEAT_LSUI Current futex atomic operations are implemented using LL/SC instructions while temporarily clearing PSTATE.PAN and setting PSTATE.TCO (if KASAN_HW_TAGS is enabled). With Armv9.6, FEAT_LSUI provides atomic instructions for user memory access in the kernel without the need for PSTATE bits toggling. Use the FEAT_LSUI instructions to implement the futex atomic operations. Note that some futex operations do not have a matching LSUI instruction, (eor or word-sized cmpxchg). For such cases, use cas{al}t to implement the operation. Signed-off-by: Yeoreum Yun [catalin.marinas@arm.com: add comment on -EAGAIN in __lsui_futex_cmpxchg()] Signed-off-by: Catalin Marinas commit ccef9ef0aa2b9a7814e4def6f18b25211b8ae530 Author: Claudiu Beznea Date: Thu Mar 26 21:29:24 2026 +0200 reset: core: Drop unnecessary double quote Drop unnecessary double quote. Reported-by: Pavel Machek Closes: https://lore.kernel.org/all/acJbYxKGAB4lxGQr@duo.ucw.cz Signed-off-by: Claudiu Beznea Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 88919bedabb8d34b6b76c00238310b7deca33a2d Author: Even Xu Date: Wed Mar 18 11:22:04 2026 +0800 HID: intel-thc-hid: Intel-thc: Add more frequency support for SPI The Nova Lake platform enhances THC with half divider capability for clock division, allowing more granular frequency control for the THC SPI port. Supported frequencies include 50MHz (125MHz/2.5), 35MHz (125MHz/3.5), and 10MHz (125MHz/8/1.5). Signed-off-by: Even Xu Tested-by: Rui Zhang Signed-off-by: Jiri Kosina commit 4ba38ee380555a5aeb4291d5111faaf7852d63bd Author: Even Xu Date: Wed Mar 18 11:25:47 2026 +0800 HID: intel-thc-hid: Intel-quickspi: Improve power management for touch devices Enhance power management with two key improvements: 1. Hibernate support: Send POWER_OFF command when entering hibernate mode. 2. Conditional sleep commands: Only send POWER_SLEEP/POWER_ON commands during system suspend/resume when the touch device is not configured as a wake source, preserving Wake-on-Touch (WoT) functionality. This ensures proper power states while maintaining expected wake behavior. Signed-off-by: Even Xu Tested-by: Rui Zhang Signed-off-by: Jiri Kosina commit 8889b289ce1bd11a5102b9617742a1b93bb4843e Author: Tommaso Merciai Date: Thu Mar 12 15:50:38 2026 +0100 reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime The driver was disabling the USB2 PHY clock immediately after register initialization in probe() and after each reset operation. This left the PHY unclocked even though it must remain active for USB functionality. The behavior appeared to work only when another driver (e.g., USB controller) had already enabled the clock, making operation unreliable and hardware-dependent. In configurations where this driver is the sole clock user, USB functionality would fail. Fix this by: - Enabling the clock once in probe() via pm_runtime_resume_and_get() - Removing all pm_runtime_put() calls from assert/deassert/status - Registering a devm cleanup action to release the clock at removal - Removed rzv2h_usbphy_assert_helper() and its call in rzv2h_usb2phy_reset_probe() This ensures the PHY clock remains enabled for the entire device lifetime, preventing instability and aligning with hardware requirements. Cc: stable@vger.kernel.org Fixes: e3911d7f865b ("reset: Add USB2PHY port reset driver for Renesas RZ/V2H(P)") Signed-off-by: Tommaso Merciai Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 5102836da8397deb2a3d8b9e574238781ea47390 Author: Pavan Chebbi Date: Sat Mar 14 08:16:03 2026 -0700 fwctl/bnxt_en: Create an aux device for fwctl Create an additional auxiliary device to support fwctl. The next patch will create bnxt_fwctl and bind to this device. Link: https://patch.msgid.link/r/20260314151605.932749-4-pavan.chebbi@broadcom.com Reviewed-by: Andy Gospodarek Reviewed-by: Leon Romanovsky Signed-off-by: Pavan Chebbi Signed-off-by: Jason Gunthorpe commit 2c7c85c8c7881d57c5fa1114f4b0dbd7fc53a36f Author: Pavan Chebbi Date: Sat Mar 14 08:16:02 2026 -0700 fwctl/bnxt_en: Refactor aux bus functions to be more generic Up until now there was only one auxiliary device that bnxt created and that was for RoCE driver. bnxt fwctl is also going to use an aux bus device that bnxt should create. This requires some nomenclature changes and refactoring of the existing bnxt aux dev functions. Convert 'aux_priv' and 'edev' members of struct bnxt into arrays where each element contains supported auxbus device's data. Move struct bnxt_aux_priv from bnxt.h to ulp.h because that is where it belongs. Make aux bus init/uninit/add/del functions more generic which will loop through all the aux device types. Make bnxt_ulp_start/stop functions (the only other common functions applicable to any aux device) loop through the aux devices to update their config and states. Make callers of bnxt_ulp_start() call it only when there are no errors. Also, as an improvement in code, bnxt_register_dev() can skip unnecessary dereferencing of edev from bp, instead use the edev pointer from the function parameter. Future patches will reuse these functions to add an aux bus device for fwctl. Link: https://patch.msgid.link/r/20260314151605.932749-3-pavan.chebbi@broadcom.com Reviewed-by: Andy Gospodarek Reviewed-by: Leon Romanovsky Signed-off-by: Pavan Chebbi Signed-off-by: Jason Gunthorpe commit 7be18a1fa00eab5283b35c13e26c6b76fcaab9ce Author: Pavan Chebbi Date: Sat Mar 14 08:16:01 2026 -0700 fwctl/bnxt_en: Move common definitions to include/linux/bnxt/ We have common definitions that are now going to be used by more than one component outside of bnxt (bnxt_re and fwctl) Move bnxt_ulp.h to include/linux/bnxt/ as ulp.h. Link: https://patch.msgid.link/r/20260314151605.932749-2-pavan.chebbi@broadcom.com Reviewed-by: Andy Gospodarek Reviewed-by: Leon Romanovsky Cc: linux-rdma@vger.kernel.org Signed-off-by: Pavan Chebbi Signed-off-by: Jason Gunthorpe commit e4cf6087cab382c7031e6b436ec55202fa9f2d7b Author: Alexander Wilhelm Date: Thu Mar 26 08:17:52 2026 +0100 net: qrtr: fix endian handling of confirm_rx field Convert confirm_rx to little endian when enqueueing and convert it back on receive. This fixes control flow on big endian hosts, little endian is unaffected. On transmit, store confirm_rx as __le32 using cpu_to_le32(). On receive, apply le32_to_cpu() before using the value. !! ensures the value is 0 or 1 in native endianness, so the conversion isn’t strictly required here, but it is kept for consistency and clarity. Reviewed-by: Manivannan Sadhasivam Signed-off-by: Alexander Wilhelm Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit dadfceb3bcc7a3a3f7ebe23ff4fe05af030a4ef8 Merge: b33ad6bc6ee93f 87599f1843d3ba Author: Krzysztof Kozlowski Date: Fri Mar 27 12:59:34 2026 +0100 Merge tag 'juno-updates-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/dt Armv8 Juno/FVP/Vexpress updates for v7.1 1. The primary addition is initial support for Zena CSS that includes: a new binding compatibility, a shared `zena-css.dtsi` description, and an FVP device tree. 2. Extension of Corstone-1000 FVP platform support with binding updates to add the new `arm,corstone1000-a320-fvp` platform, and the `arm,corstone1000-ethos-u85` NPU integration. Overall, this combines new platform enablement with some DTS layout cleanup for Arm reference FVP based systems. * tag 'juno-updates-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: arm64: dts: arm/corstone1000: Add corstone-1000-a320 arm64: dts: arm/corstone1000: Move FVP peripherals to separate .dtsi arm64: dts: arm/corstone1000: Move cpu nodes dt-bindings: npu: arm,ethos: Add "arm,corstone1000-ethos-u85" dt-bindings: arm,corstone1000: Add "arm,corstone1000-a320-fvp" arm64: dts: zena: Move SRAM into SoC and memory node out of SoC arm64: dts: zena: Add support for Zena CSS dt-bindings: arm: Add Zena CSS compatibility Signed-off-by: Krzysztof Kozlowski commit 4f13c93497e366cd8e41561a8e30ad4da887cb82 Author: Alistair Francis Date: Thu Mar 26 12:04:06 2026 +1000 rust: kernel: mark as `#[inline]` all `From::from()`s for `Error` There was a recent request [1] to mark as `#[inline]` the simple `From::from()` functions implemented for `Error`. Thus mark all of the existing impl From<...> for Error { fn from(err: ...) -> Self { ... } } functions in the `kernel` crate as `#[inline]`. Suggested-by: Gary Guo Link: https://lore.kernel.org/all/8403c8b7a832b5274743816eb77abfa4@garyguo.net/ [1] Signed-off-by: Alistair Francis Acked-by: Danilo Krummrich Acked-by: Andreas Hindborg Link: https://patch.msgid.link/20260326020406.1438210-1-alistair.francis@wdc.com [ Dropped `projection.rs` since it is in another tree and already marked as `inline(always)` and reworded accordingly. Changed Link tag to Gary's original message and added Suggested-by. - Miguel ] Signed-off-by: Miguel Ojeda commit b33ad6bc6ee93f7159f6efb37f6ab01a8906df6d Merge: 789ca08f3164b6 5978ff33cc6f09 Author: Krzysztof Kozlowski Date: Fri Mar 27 12:47:09 2026 +0100 Merge tag 'mtk-dts32-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt MediaTek ARM32 Device Tree Updates This adds a single commit fixing a dtbs_check validation error by changing the fallback compatible of the efuse node to the correct one in MT7623. * tag 'mtk-dts32-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: ARM: dts: mediatek: mt7623: fix efuse fallback compatible Signed-off-by: Krzysztof Kozlowski commit 789ca08f3164b691a0b2b9c15328ea478d6b984f Merge: c4d677691dce1f 820ed0c1a13c5f Author: Krzysztof Kozlowski Date: Fri Mar 27 12:45:33 2026 +0100 Merge tag 'mtk-dts64-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt MediaTek ARM64 DeviceTree updates This adds fixes and improvements for already supported devices. In particular: - The gpio-ranges pin could was fixed in MT6795, MT7981B, and MT7986A SoCs, as the very last GPIO was unusable; Even though anyway unused, this fixes the hardware description. - Model string fixes for Bananapi BPI-R4 Pro 4E/8X: now the correct model is shown. - The MT6359 PMIC gets disambiguation for two default regulator names, mainly fixing issues seen on U-Boot, but also making the regulators visually distinguishable in a summary...! - Aliases for eMMC/SD controllers added in MT8365 EVK board, MT8395 Radxa NIO-12L and Genio 1200 for consistency - Fixes to the MediaTek AUDSYS devicetree binding ....and honorable mention goes to: - MT8195 Cherry Chromebooks get their WiFi on PCI Express and Bluetooth on USB described with the proper power supplies now tied to the correct devices (USB VBUS and PCIE3v3): this is now described almost perfectly, or at least links the right resources in the right places. This is also done as a preparation for when the M.2 E-Key connector binding will be upstreamed. - MT8195 Cherry Dojo gets its M.2 M-Key slot correctly described with the new pcie-m2-m-connector binding. * tag 'mtk-dts64-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count arm64: dts: mediatek: mt7981b: Fix gpio-ranges pin count arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count dt-bindings: arm: mediatek: audsys: fix formatting issues arm64: dts: mediatek: mt8195-cherry-dojo: Describe M.2 M-key NVMe slot arm64: dts: mediatek: mt8195-cherry: add WiFi PCIe and BT USB power supplies arm64: dts: mediatek: mt7988a-bpi-r4pro: fix model string arm64: dts: mt8167: Reorder nodes according to mmio address arm64: dts: mediatek: mt6359: give regulators unique names arm64: dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon arm64: dts: mediatek: mt8365-evk: add mmc aliases arm64: dts: mediatek: mt8395-radxa-nio-12l: add mmc aliases arm64: dts: mediatek: mt8395-genio-common: add mmc aliases arm64: dts: mediatek: mt8195-cherry: Disable xhci1 completely Signed-off-by: Krzysztof Kozlowski commit c4d677691dce1f7558deb56e390a3ea8a5469977 Merge: 45ffabad4b5306 9c99a784d9117a Author: Krzysztof Kozlowski Date: Fri Mar 27 12:40:55 2026 +0100 Merge tag 'thead-dt-for-v7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt T-HEAD Devicetrees for 7.1 Update the T-Head TH1520 RISC-V SoC device tree to support the Verisilicon DC8200 display controller (called DPU in manual) and the Synopsys DesignWare HDMI TX controller. In addition, enable HDMI output for the LicheePi 4a board. * tag 'thead-dt-for-v7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: riscv: dts: thead: lichee-pi-4a: enable HDMI riscv: dts: thead: add DPU and HDMI device tree nodes Signed-off-by: Krzysztof Kozlowski commit d58f0f146a6e3fe3c6fcf6db1e0d385414bc8713 Author: Gary Guo Date: Thu Mar 12 17:46:59 2026 +0000 rust: list: hide macros from top-level kernel doc Due to Rust macro scoping rules, all macros defined in a crate using `#[macro_export]` end up in the top-level. For the list macros, we re-export them inside the list module, and expect users to use `kernel::list::macro_name!()`. Use `#[doc(hidden)]` on the macro definition, and use `#[doc(inline)]` on the re-export to make the macro appear to be defined at module-level inside documentation. The other exported types are already automatically `#[doc(inline)]` because they are defined in a non-public module, so there is no need to split the macro re-exports out. Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260312174700.4016015-1-gary@kernel.org Signed-off-by: Miguel Ojeda commit 9bf32bc60cb2561f8e27fea2cb24c86d5ab99997 Author: Miguel Ojeda Date: Mon Mar 23 03:42:06 2026 +0100 MAINTAINERS: add `.rustfmt.toml` to "RUST" entry `.rustfmt.toml` is not covered by `MAINTAINERS`, so tools like `scripts/get_maintainer.pl` do not report it properly, e.g.: $ scripts/get_maintainer.pl -f .rustfmt.toml linux-kernel@vger.kernel.org (open list) It should have been there since the beginning, and while it is not a big deal since the file has not changed at all since it was added in commit 80db40bac8f4 ("rust: add `.rustfmt.toml`") back in 2022, this will be especially useful to catch unintended unstable features if upstream `rustfmt` started to allow them in stable toolchains [1][2]. Thus add it. Link: https://github.com/rust-lang/rustfmt/issues/6829#issuecomment-4084325200 [1] Link: https://github.com/rust-lang/rustfmt/issues/4884 [2] Fixes: 80db40bac8f4 ("rust: add `.rustfmt.toml`") Link: https://patch.msgid.link/20260323024206.129401-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit e012fa31f90de0928d85ab22d9cc5fc8fe84c5b0 Author: Ville Syrjälä Date: Mon Mar 23 12:16:09 2026 +0200 drm/i915/uncore: Do GT FIFO checks in early sanitize and forcewake get We're mixing up the GT FIFO debug checks (overflows and such) with RMbus unclaimed register checks. The two are quite different things as RMbus is only relevant for display registers, and the GT FIFO only relevant for GT registers. Split the GT FIFO debugs out from the unclaimed register logic and just do the checks during forcewake_get() and early init. That is still sufficient to detect if any errors have happened. Any errors would anyway be caused by overflowing the FIFO rather than accessing specific registers, so trying to figure out exactly when the error happened isn't particularly useful. To fix such issues we'd rather have to do something to slow down the rate at which registers are accessed (eg. increase GT_FIFO_NUM_RESERVED_ENTRIES or something). Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260323101609.8391-3-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit fde38b106d50f59f904c72544aa34e41adb14fcb Author: Ville Syrjälä Date: Mon Mar 23 12:16:08 2026 +0200 drm/i915/selftests: Nuke live_forcewake_domains selftest The live_forcewake_domains selftest doesn't really test anything particularly sensible. It only runs on platforms that have RMbus unclaimer error detection, but that only catches display registers which the test doesn't even access. I suppose if we really wanted to we might try to make the test exercise the GT FIFO instead by writing GT registers as fast as possible, and then checking GTFIFODBG to see if the FIFO has overflowed. But dunno if there's much point in that. I think a GT FIFO overflow might even be fatal to the machine. So in its current for the test doesn't really make sense, and it's in the way of moving all the RMbus noclaim stuff to the display driver side. So let's just get rid of it. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260323101609.8391-2-ville.syrjala@linux.intel.com Acked-by: Jani Nikula commit 8c58be287604da91a4da6b0b1af866c1c193576c Author: Dmitry Torokhov Date: Wed Mar 25 23:25:38 2026 -0700 HID: core: use __free(kfree) and __free(kvfree) to clean up temporary buffers This simplifies error handling and protects against memory leaks. Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Kosina commit d7db259bd6df56f9540ef92535a5c709b375c4d5 Author: Dmitry Torokhov Date: Wed Mar 25 23:25:37 2026 -0700 HID: core: factor out hid_parse_collections() In preparation to making use of __free(...) cleanup facilities to clean up temporary buffers, factor out code parsing collections into a separate function to make the code simpler. Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Kosina commit e8a7efa81d734e1c8f4d91e658a162ea32f39dcb Author: Ville Syrjälä Date: Thu Mar 26 13:18:14 2026 +0200 drm/i915/dsi: Place clock into LP during LPM if requested TGL/ADL DSI can be configured to place the clock lane into LP state during LPM, if otherwise configured for continuous HS clock. Hook that up. VBT tells us whether this should be done. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260326111814.9800-6-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 765a2635cd257545e732eee13f1e75774c0b79f9 Author: Ville Syrjälä Date: Thu Mar 26 13:18:13 2026 +0200 drm/i915/dsi: Fill BLLPs with blanking packets if requested TGL/ADL DSI can be configured to fill all BLLPs with blanking packets. Currently we enable that always, but the VBT actually tells us whether this is desired or not. Hook that up. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260326111814.9800-5-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit a1fa010b3c9f0adae252986ddb54a449df45f700 Author: Rafael J. Wysocki Date: Fri Mar 27 10:51:59 2026 +0100 driver core: auxiliary bus: Drop auxiliary_dev_pm_ops Since the PM core automatically falls back to using the driver PM callbacks directly if no bus type callbacks are present, it is not necessary to define a struct dev_pm_ops for a bus type that will only invoke driver PM callbacks from its PM callbacks. Accordingly, auxiliary_dev_pm_ops is redundant, so drop it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/4738700.LvFx2qVVIh@rafael.j.wysocki Signed-off-by: Greg Kroah-Hartman commit 81ec9556ad69444899e8255652ec80972c09df14 Author: Ville Syrjälä Date: Thu Mar 26 13:18:12 2026 +0200 drm/i915/dsi: Make 'clock_stop' boolean The DSI 'clock_stop' parameter is a boolean, so use a real 'bool' for it. And pimp the debug print while at it. Note that we also remove the incorrect negation of the value in the debug print. That has been there since the code was introduced in commit 2ab8b458c6a1 ("drm/i915: Add support for Generic MIPI panel driver"). An earlier version of the patch https://lore.kernel.org/intel-gfx/1397454507-10273-5-git-send-email-shobhit.kumar@intel.com/ got it right, but looks like it got fumbled while dealing with other review comments. v2: Highlight the removal of the '!' (Jani) Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260326111814.9800-4-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 65dea11925b9e2af4f5bfec460b89a5dba548207 Merge: 6a28fb8cb28b9e 16fb8d8a0e050e Author: Rafael J. Wysocki Date: Fri Mar 27 11:57:31 2026 +0100 Merge back earlier cpufreq material for 7.1 commit 949a5ed0826b4270ced45af9d86d74e1505be923 Merge: a8d51efb5929ae 2b27ea5b644d7d Author: Rafael J. Wysocki Date: Fri Mar 27 11:56:38 2026 +0100 Merge back earlier material related to system sleep for 7.1 commit ca7fc6a8ae28eaec8c194dc5f8db03f928b2e454 Author: Ville Syrjälä Date: Thu Mar 26 13:18:11 2026 +0200 drm/i915/dsi: s/eotp_pkt/eot_pkt/ eotp == "End of Transmission Packet". Drop the redundant extra 'p' from 'eotp_pkt', and make the thing a boolean while at it. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260326111814.9800-3-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 0b475e91ecc2313207196c6d7fd5c53e1a878525 Author: Ville Syrjälä Date: Thu Mar 26 13:18:10 2026 +0200 drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode Stop adjusting the horizontal timing values based on the compression ratio in command mode. Bspec seems to be telling us to do this only in video mode, and this is also how the Windows driver does things. This should also fix a div-by-zero on some machines because the adjusted htotal ends up being so small that we end up with line_time_us==0 when trying to determine the vtotal value in command mode. Note that this doesn't actually make the display on the Huawei Matebook E work, but at least the kernel no longer explodes when the driver loads. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12045 Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260326111814.9800-2-ville.syrjala@linux.intel.com Fixes: 53693f02d80e ("drm/i915/dsi: account for DSC in horizontal timings") Reviewed-by: Jani Nikula commit 19acad732afbfb23bd0d4d5830d7553889e739f8 Author: Arnd Bergmann Date: Tue Mar 24 20:20:28 2026 +0100 HID: hid-lenovo-go: fix LEDS dependencies The newly added hid-lenovo-go and hid-lenovo-go-s drivers attempt to 'select LEDS_CLASS', which has a dependency on NEW_LEDS, causing a build failure when NEW_LEDS itself it disabled: WARNING: unmet direct dependencies detected for LEDS_CLASS Depends on [n]: NEW_LEDS [=n] Selected by [m]: - HID_LENOVO_GO [=m] && HID_SUPPORT [=y] && HID [=m] && USB_HID [=m] - HID_LENOVO_GO_S [=m] && HID_SUPPORT [=y] && HID [=m] && USB_HID [=m] WARNING: unmet direct dependencies detected for LEDS_CLASS_MULTICOLOR Depends on [n]: NEW_LEDS [=n] && LEDS_CLASS [=m] Selected by [m]: - HID_LENOVO_GO [=m] && HID_SUPPORT [=y] && HID [=m] && USB_HID [=m] - HID_LENOVO_GO_S [=m] && HID_SUPPORT [=y] && HID [=m] && USB_HID [=m] ERROR: modpost: "led_set_brightness_nopm" [drivers/leds/led-class.ko] undefined! ERROR: modpost: "led_set_brightness" [drivers/leds/led-class.ko] undefined! ERROR: modpost: "led_get_color_name" [drivers/leds/led-class-multicolor.ko] undefined! ERROR: modpost: "led_set_brightness" [drivers/leds/led-class-multicolor.ko] undefined! Device drivers generally should not select other subsystems like this, as that tends to cause dependency problems including loops in the dependency graph. Change these two and the older hid-lenovo driver to behave the same way as all other HID drivers and use 'depends on LEDS_CLASS' or 'depends on LEDS_CLASS_MULTICOLOR' instead, which itself has NEW_LEDS and LEDS_CLASS as dependencies. Fixes: a23f3497bf20 ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver") Fixes: d69ccfcbc955 ("HID: hid-lenovo-go: Add Lenovo Legion Go Series HID Driver") Signed-off-by: Arnd Bergmann Reviewed-by: Mark Pearson Signed-off-by: Jiri Kosina commit da2c4f332a0504d9c284e7626a561d343c8d6f57 Author: Gopi Krishna Menon Date: Fri Mar 27 14:35:24 2026 +0530 thermal/drivers/spear: Fix error condition for reading st,thermal-flags of_property_read_u32 returns 0 on success. The current check returns -EINVAL if the property is read successfully. Fix the check by removing ! from of_property_read_u32 Fixes: b9c7aff481f1 ("drivers/thermal/spear_thermal.c: add Device Tree probing capability") Signed-off-by: Gopi Krishna Menon Signed-off-by: Daniel Lezcano Suggested-by: Daniel Baluta Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/20260327090526.59330-1-krishnagopi487@gmail.com commit 85f18eddf0761c8f9d9af93251febf4b8813d659 Author: Krzysztof Kozlowski Date: Fri Mar 27 11:07:34 2026 +0100 dt-bindings: thermal: qcom-tsens: Add Eliza SoC TSENS Document the compatible for Qualcomm Eliza SoC TSENS module, fully compatible with TSENS v2 generation (e.g. SM8650). Acked-by: Rob Herring (Arm) Reviewed-by: Konrad Dybcio Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260327100733.365573-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Daniel Lezcano commit 66fcf492008db407e8d600ceaefd2c8a8070c5ae Author: Fuad Tabba Date: Fri Mar 6 14:02:20 2026 +0000 KVM: arm64: Extract VMA size resolution in user_mem_abort() As part of an effort to refactor user_mem_abort() into smaller, more focused helper functions, extract the logic responsible for determining the VMA shift and page size into a new static helper, kvm_s2_resolve_vma_size(). Reviewed-by: Joey Gouly Signed-off-by: Fuad Tabba Signed-off-by: Marc Zyngier commit be0df73d5fa059d4e39b7903f71291576b3e4a05 Merge: 9bc3b976eb9db5 39ecfef48384b3 Author: Georgi Djakov Date: Fri Mar 27 11:50:52 2026 +0200 Merge branch 'icc-msm8974' into icc-next Commit d6edc31f3a68 ("clk: qcom: smd-rpm: Separate out interconnect bus clocks") moved control over several RPM resources from the clk-smd-rpm driver to the icc-rpm.c interconnect helpers. Most of the platforms were fixed before that commit or shortly after. However the MSM8974 was left as a foster child in broken state. Fix the loose ends and reenable interconnects on that platform. * icc-msm8974 dt-bindings: interconnect: qcom,msm8974: drop bus clocks dt-bindings: interconnect: qcom,msm8974: use qcom,rpm-common interconnect: qcom: drop unused is_on flag interconnect: qcom: icc-rpm: allow overwriting get_bw callback interconnect: qcom: define OCMEM bus resource interconnect: qcom: let platforms declare their bugginess interconnect: qcom: msm8974: switch to the main icc-rpm driver interconnect: qcom: msm8974: expand DEFINE_QNODE macros Link: https://msgid.link/20260324-msm8974-icc-v2-0-527280043ad8@oss.qualcomm.com Tested-by: Alexandre Messier Tested-by: Luca Weiss # fairphone-fp2 Signed-off-by: Georgi Djakov commit 08643a8760e81fe0bf91c58f7ee9e19b4db3a24f Author: Jie Gan Date: Fri Mar 27 14:24:14 2026 +0800 coresight: cti: fix the check condition in inout_sel_store Correct the upper bound from CTIINOUTEN_MAX to config->nr_trig_max, since nr_trig_max varies across CTI devices. An out-of-bounds issue occurs when a value greater than config->nr_trig_max is provided, leading to unexpected errors. Fixes: b5213376c240 ("coresight: cti: Add sysfs access to program function registers") Signed-off-by: Jie Gan Reviewed-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260327-fix-cti-issue-v1-1-2c8921e21fc8@oss.qualcomm.com commit 82374995b63d2de21414163828a32d52610dcaf2 Author: Tomas Glozar Date: Tue Mar 24 13:32:29 2026 +0100 Documentation/rtla: Document SIGINT behavior The behavior of RTLA on receiving SIGINT is currently undocumented. Describe it in RTLA's common appendix that appears in man pages for all RTLA tools to avoid confusion. Suggested-by: Attila Fazekas Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20260324123229.152424-1-tglozar@redhat.com Signed-off-by: Tomas Glozar commit be0240f65705b0b125de60d4fc952c013ef74e26 Author: Thorsten Blum Date: Sat Mar 21 14:14:39 2026 +0100 crypto: qce - use memcpy_and_pad in qce_aead_setkey Replace memset() followed by memcpy() with memcpy_and_pad() to simplify the code and to write to ->auth_key only once. Signed-off-by: Thorsten Blum Reviewed-by: Konrad Dybcio Signed-off-by: Herbert Xu commit fdacdc8cf897703a5a3e8b521448befbb6620034 Author: Mieczyslaw Nalewaj Date: Sat Mar 21 11:23:06 2026 +0100 crypto: inside-secure/eip93 - add missing address terminator character Add the missing > characters to the end of the email address Signed-off-by: Mieczyslaw Nalewaj Signed-off-by: Herbert Xu commit 9503ab5a1d0ef4cad2731d88699d7e6bb1a8a85d Author: Mieczyslaw Nalewaj Date: Sat Mar 21 10:59:37 2026 +0100 crypto: inside-secure/eip93 - correct ecb(des-eip93) typo Correct the typo in the name "ecb(des-eip93)". Signed-off-by: Mieczyslaw Nalewaj Signed-off-by: Herbert Xu commit 67b53a660e6bf0da2fa8d8872e897a14d8059eaf Author: Wenkai Lin Date: Sat Mar 21 15:00:38 2026 +0800 crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission, if the system is under heavy load, the hardware might complete processing the packet and free the request memory (req) before the transmission function finishes. If the software subsequently accesses this req, a use-after-free error will occur. The qp_ctx memory exists throughout the packet sending process, so replace the req with the qp_ctx. Fixes: f0ae287c5045 ("crypto: hisilicon/sec2 - implement full backlog mode for sec") Signed-off-by: Wenkai Lin Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 07fa25957a18cff13f1943ecd213c88c0878b968 Author: Eric Biggers Date: Fri Mar 20 15:17:27 2026 -0700 crypto: cryptd - Remove unused functions Many functions in cryptd.c no longer have any caller. Remove them. Also remove several associated structs and includes. Finally, inline cryptd_shash_desc() into its only caller, allowing it to be removed too. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 5c8009f3c1885d5d996acdcd7e884aff25ac26a4 Author: Aleksander Jan Bajkowski Date: Fri Mar 20 22:19:23 2026 +0100 crypto: inside-secure/eip93 - make it selectable for ECONET Econet SoCs feature an integrated EIP93 in revision 3.0p1. It is identical to the one used by the Airoha AN7581 and the MediaTek MT7621. Ahmed reports that the EN7528 passes testmgr's self-tests. This driver should also work on other little endian Econet SoCs. CC: Ahmed Naseef Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Antoine Tenart Tested-by: Ahmed Naseef Signed-off-by: Herbert Xu commit a09c5e06498f6a62c89ca56ccdfbfead96e63732 Author: T Pratham Date: Fri Mar 20 16:20:52 2026 +0530 crypto: ti - Add support for AES-CCM in DTHEv2 driver AES-CCM is an AEAD algorithm supporting both encryption and authentication of data. This patch introduces support for AES-CCM AEAD algorithm in the DTHEv2 driver. Signed-off-by: T Pratham Signed-off-by: Herbert Xu commit 37b902c60304291b30b417ab5b9531b9c662aacd Author: T Pratham Date: Fri Mar 20 16:20:51 2026 +0530 crypto: ti - Add support for AES-GCM in DTHEv2 driver AES-GCM is an AEAD algorithm supporting both encryption and authentication of data. This patch introduces support for AES-GCM as the first AEAD algorithm supported by the DTHEv2 driver. Signed-off-by: T Pratham Signed-off-by: Herbert Xu commit 92c0a9bbcde6a748a40182fe32e3a1b2f9f1a23d Author: Thorsten Blum Date: Fri Mar 20 09:49:14 2026 +0100 crypto: stm32 - use list_first_entry_or_null to simplify cryp_find_dev Use list_first_entry_or_null() to simplify stm32_cryp_find_dev() and remove the now-unused local variable 'struct stm32_cryp *tmp'. Signed-off-by: Thorsten Blum Reviewed-by: Kees Cook Signed-off-by: Herbert Xu commit 1a9670df56eac0a374cc2a5e9a63775de4c61837 Author: Thorsten Blum Date: Fri Mar 20 09:49:13 2026 +0100 crypto: stm32 - use list_first_entry_or_null to simplify hash_find_dev Use list_first_entry_or_null() to simplify stm32_hash_find_dev() and remove the now-unused local variable 'struct stm32_hash_dev *tmp'. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit d0c0a414cc1893b195b9523ecdfbeee00b98fd0d Author: Aleksander Jan Bajkowski Date: Thu Mar 19 18:11:21 2026 +0100 crypto: testmgr - Add test vectors for authenc(hmac(md5),rfc3686(ctr(aes))) Test vectors were generated starting from existing RFC3686(CTR(AES)) test vectors and adding HMAC(MD5) computed with software implementation. Then, the results were double-checked on Mediatek MT7986 (safexcel). Platform pass self-tests. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit 6ac142bf267ecf0aee5038abd00072ab583ce0de Author: Suman Kumar Chakraborty Date: Thu Mar 19 11:02:57 2026 +0000 crypto: qat - add anti-rollback support for GEN6 devices Anti-Rollback (ARB) is a QAT GEN6 hardware feature that prevents loading firmware with a Security Version Number (SVN) lower than an authorized minimum. This protects against downgrade attacks by ensuring that only firmware at or above a committed SVN can run on the acceleration device. During firmware loading, the driver checks the SVN validation status via a hardware CSR. If the check reports a failure, firmware authentication is aborted. If it reports a retry status, the driver reissues the authentication command up to a maximum number of retries. Extend the firmware admin interface with two new messages, ICP_QAT_FW_SVN_READ and ICP_QAT_FW_SVN_COMMIT, to query and commit the SVN, respectively. Integrate the SVN check into the firmware authentication path in qat_uclo.c so the driver can react to anti-rollback status during device bring-up. Expose SVN information to userspace via a new sysfs attribute group, qat_svn, under the PCI device directory. The group provides read-only attributes for the active, enforced minimum, and permanent minimum SVN values, as well as a write-only commit attribute that allows a system administrator to commit the currently active SVN as the new authorized minimum. This is based on earlier work by Ciunas Bennett. Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 177730a273b18e195263ed953853273e901b5064 Author: Thorsten Blum Date: Thu Mar 19 10:29:33 2026 +0100 crypto: caam - guard HMAC key hex dumps in hash_digest_key Use print_hex_dump_devel() for dumping sensitive HMAC key bytes in hash_digest_key() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG is enabled. Fixes: 045e36780f11 ("crypto: caam - ahash hmac support") Fixes: 3f16f6c9d632 ("crypto: caam/qi2 - add support for ahash algorithms") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit d134feeb5df33fbf77f482f52a366a44642dba09 Author: Thorsten Blum Date: Thu Mar 19 10:29:32 2026 +0100 printk: add print_hex_dump_devel() Add print_hex_dump_devel() as the hex dump equivalent of pr_devel(), which emits output only when DEBUG is enabled, but keeps call sites compiled otherwise. Suggested-by: Herbert Xu Signed-off-by: Thorsten Blum Reviewed-by: John Ogness Signed-off-by: Herbert Xu commit b0bfa49c03e3c65737eafa73d8a698eaf55379a6 Author: Gustavo A. R. Silva Date: Tue Mar 17 17:40:02 2026 -0600 crypto: nx - Fix packed layout in struct nx842_crypto_header struct nx842_crypto_header is declared with the __packed attribute, however the fields grouped with struct_group_tagged() were not packed. This caused the grouped header portion of the structure to lose the packed layout guarantees of the containing structure. Fix this by replacing struct_group_tagged() with __struct_group(..., ..., __packed, ...) so the grouped fields are packed, and the original layout is preserved, restoring the intended packed layout of the structure. Before changes: struct nx842_crypto_header { union { struct { __be16 magic; /* 0 2 */ __be16 ignore; /* 2 2 */ u8 groups; /* 4 1 */ }; /* 0 6 */ struct nx842_crypto_header_hdr hdr; /* 0 6 */ }; /* 0 6 */ struct nx842_crypto_header_group group[]; /* 6 0 */ /* size: 6, cachelines: 1, members: 2 */ /* last cacheline: 6 bytes */ } __attribute__((__packed__)); After changes: struct nx842_crypto_header { union { struct { __be16 magic; /* 0 2 */ __be16 ignore; /* 2 2 */ u8 groups; /* 4 1 */ } __attribute__((__packed__)); /* 0 5 */ struct nx842_crypto_header_hdr hdr; /* 0 5 */ }; /* 0 5 */ struct nx842_crypto_header_group group[]; /* 5 0 */ /* size: 5, cachelines: 1, members: 2 */ /* last cacheline: 5 bytes */ } __attribute__((__packed__)); Fixes: 1e6b251ce175 ("crypto: nx - Avoid -Wflex-array-member-not-at-end warning") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Reviewed-by: Thorsten Blum Signed-off-by: Herbert Xu commit 928c5e894ca907b11c0b3cda7c37441d863018fd Author: Thorsten Blum Date: Tue Mar 17 21:18:06 2026 +0100 crypto: nx - annotate struct nx842_crypto_header with __counted_by Add the __counted_by() compiler attribute to the flexible array member 'group' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Signed-off-by: Thorsten Blum Reviewed-by: Gustavo A. R. Silva Signed-off-by: Herbert Xu commit 914b0c68d4decebe52b31929f89364de32d0156e Author: Thorsten Blum Date: Tue Mar 17 17:52:57 2026 +0100 crypto: marvell/cesa - use memcpy_and_pad in mv_cesa_ahash_export Replace memset() followed by memcpy() with memcpy_and_pad() to simplify the code and to write to 'cache' only once. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit f30579bbae86c860a642621322d90d3d4c60c9b5 Author: Thorsten Blum Date: Tue Mar 17 09:04:52 2026 +0100 crypto: s5p-sss - use unregister_{ahashes,skciphers} in probe/remove Replace multiple for loops with calls to crypto_unregister_ahashes() and crypto_unregister_skciphers(). If crypto_register_skcipher() fails in s5p_aes_probe(), log the error directly instead of checking 'i < ARRAY_SIZE(algs)' later. Also drop now-unused local index variables. No functional changes. Signed-off-by: Thorsten Blum Reviewed-by: Krzysztof Kozlowski Reviewed-by: Vladimir Zapolskiy Signed-off-by: Herbert Xu commit eaa3babcceaaf191228d6ea897f677ed7549d0e2 Author: Yeoreum Yun Date: Sat Mar 14 17:51:29 2026 +0000 arm64: futex: Refactor futex atomic operation Refactor the futex atomic operations using ll/sc instructions in preparation for FEAT_LSUI support. In addition, use named operands for the inline asm. No functional change. Signed-off-by: Yeoreum Yun [catalin.marinas@arm.com: remove unnecessary stringify.h include] Signed-off-by: Catalin Marinas commit 0aa7a5723c96d23a21291b5683ce90a13e2d3046 Author: Shawn Lin Date: Fri Mar 27 12:11:23 2026 +0800 mmc: core: Switch to use pm_ptr() for mmc_host_class_dev_pm_ops Currently, the mmc_host_class_dev_pm_ops and its callback functions are wrapped in #ifdef CONFIG_PM_SLEEP to handle the conditional compilation when PM support is disabled. Replace this #ifdef usage with the standard pm_ptr() helpers. This allows the compiler to automatically optimize away the unused code paths when CONFIG_PM_SLEEP is not selected, resulting in cleaner and more maintainable code. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 3c3b759be1e11868a1224623657fad8761d91640 Author: Shawn Lin Date: Fri Mar 27 12:07:29 2026 +0800 mmc: core: Remove legacy 'enable-sdio-wakeup' DT property support The 'enable-sdio-wakeup' device tree property was marked as legacy and superseded by the standard 'wakeup-source' property in commit 71a0151c5c82 ("Documentation: devicetree: fix reference to legacy wakeup properties") back in 2015. Since it has been a decade and the migration to the standard property has long been completed, remove this obsolete legacy support. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit c3126dccfd7b8e61dc6b6eb093f57dc44a92eb22 Author: Rosen Penev Date: Thu Mar 26 19:58:49 2026 -0700 mmc: mmc_test: use kzalloc_flex Simplifies allocations by using a flexible array member in these structs. Add __counted_by to get extra runtime analysis. Signed-off-by: Rosen Penev Signed-off-by: Ulf Hansson commit b4e93cbc60641ce2d02d3438cdf59657c8c268b6 Author: Andy Shevchenko Date: Mon Mar 23 14:41:23 2026 +0100 pinctrl: core: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 127e98c05c46654867faf5f578cb56d375b89092 Author: Basavaraj Natikar Date: Fri Mar 27 10:36:16 2026 +0530 pinctrl: amd: Support new ACPI ID AMDI0033 Add AMDI0033 to the AMD GPIO ACPI match table. This lets the driver bind on new AMD platforms that expose this HID. Signed-off-by: Basavaraj Natikar Signed-off-by: Linus Walleij commit 0e59645683b7b6fa20eceb21a6f420e4f7412943 Author: Guanghui Feng Date: Thu Mar 19 15:37:54 2026 +0800 iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs In the current AMD IOMMU debugfs, when multiple processes simultaneously access the IOMMU mmio/cap registers using the IOMMU debugfs, illegal access issues can occur in the following execution flow: 1. CPU1: Sets a valid access address using iommu_mmio/capability_write, and verifies the access address's validity in iommu_mmio/capability_show 2. CPU2: Sets an invalid address using iommu_mmio/capability_write 3. CPU1: accesses the IOMMU mmio/cap registers based on the invalid address, resulting in an illegal access. This patch modifies the execution process to first verify the address's validity and then access it based on the same address, ensuring correctness and robustness. Signed-off-by: Guanghui Feng Signed-off-by: Joerg Roedel commit e4172c5b53fba04fa48b13bc3afde809d0087a7f Author: Guanghui Feng Date: Thu Mar 19 15:37:53 2026 +0800 iommu/amd: Fix illegal device-id access in IOMMU debugfs In the current AMD IOMMU debugFS, when multiple processes use the IOMMU debugFS process simultaneously, illegal access issues can occur in the following execution flow: 1. CPU1: Sets a valid sbdf via devid_write, then checks the sbdf's validity in execution flows such as devid_show, iommu_devtbl_show, and iommu_irqtbl_show. 2. CPU2: Sets an invalid sbdf via devid_write, at which point the sbdf value is -1. 3. CPU1: accesses the IOMMU device table, IRQ table, based on the invalid SBDF value of -1, resulting in illegal access. This is especially problematic in monitoring scripts, where multiple scripts may access debugFS simultaneously, and some scripts may unexpectedly set invalid values, which triggers illegal access in debugfs. This patch modifies the execution flow of devid_show, iommu_devtbl_show, and iommu_irqtbl_show to ensure that these processes determine the validity and access based on the same device-id, thus guaranteeing correctness and robustness. Signed-off-by: Guanghui Feng Signed-off-by: Joerg Roedel commit ed734125ea6c7276aaac6e24b8fff72e51a47b18 Merge: 15d6dd1ed3d586 34e0e2a8ea9e9e Author: Marek Szyprowski Date: Fri Mar 27 08:48:43 2026 +0100 Merge branch 'dt-reserved-mem-cleanups' into dma-mapping-for-next Signed-off-by: Marek Szyprowski commit d2a4ec19d2a2e54c23b5180e939994d3da4a6b91 Author: Ammar Mustafa Date: Fri Feb 27 14:08:33 2026 -0500 Docs: iio: ad7191 Correct clock configuration Correct the ad7191 documentation to match the datasheet: - Fix inverted CLKSEL pin logic: device uses external clock when pin is inactive, and internal CMOS/crystal when high. - Correct CMOS-compatible clock pin from MCLK2 to MCLK1. Signed-off-by: Ammar Mustafa Signed-off-by: Jonathan Cameron commit 8aae2da6104ab98799b203c10cb3e0bd719fe02b Author: Kees Cook Date: Mon Mar 23 10:17:14 2026 -0700 um: Replace strncpy() with strnlen()+memcpy_and_pad() in strncpy_chunk_from_user() Replace the deprecated[1] strncpy() with strnlen() on the source followed by memcpy_and_pad(). This function is a chunk callback for UML's strncpy_from_user() implementation, called by buffer_op() to process userspace memory one page at a time. The source is a kernel-mapped userspace address that is not guaranteed to be NUL-terminated; "len" bounds how many bytes to read from it. By measuring the source string length first with strnlen(), we avoid reading past the NUL terminator in the source. memcpy_and_pad() then copies the string content and zero-fills the remainder of the chunk, preserving the original strncpy() behavior exactly: copy up to the first NUL, then pad with zeros to the full length. strtomem_pad() would be the idiomatic helper for this strnlen() + memcpy_and_pad() pattern, but it requires a compile-time-determinable destination size (via ARRAY_SIZE()). Here the destination is a char * into a caller-provided buffer and the chunk length is a runtime value, so the explicit two-step is necessary. No behavioral change: the same bytes are written to the destination (string content followed by zero padding), the pointer advances by the same amount, and the NUL-found return condition is unchanged. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook Link: https://patch.msgid.link/20260323171713.work.839-kees@kernel.org Signed-off-by: Johannes Berg commit 0d270f0df6170fa56eefbb836577c961a791b1fd Merge: cf2d1b5b0158a4 e1c3bc324407e8 Author: Dave Airlie Date: Fri Mar 27 17:04:55 2026 +1000 Merge tag 'mediatek-drm-next-20260325' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-next Mediatek DRM Next - 20260325 1. mtk_dsi: enable hs clock during pre-enable 2. Remove all conflicting aperture devices during probe 3. Add support for mt8167 display blocks Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patch.msgid.link/20260325160721.4891-1-chunkuang.hu@kernel.org commit f17d7a0f8ff6f9864d8f82e99c46cee1088e945b Author: Bhargav Joshi Date: Thu Mar 26 04:24:39 2026 +0530 arm64: dts: hisilicon: Rename dwmmc nodes to mmc The core mmc devicetree schema expects mmc controller nodes to be named using '^mmc(@.*)?$' pattern. The legacy Hisilicon SoC files (hi3660, hi3670, and hi6220) previously used the 'dwmmc' prefix for their nodes. This caused warnings during dtbs_check. Rename the 'dwmmc' nodes to 'mmc' to comply with the standard schema and dtbs_check warnings. The legacy phandle labels are kept intact. Signed-off-by: Bhargav Joshi Acked-by: Zhangfei Gao Reviewed-by: Krzysztof Kozlowski Signed-off-by: Wei Xu commit 8bafdf5dd89b961b698d8bd2cfcebc8e4d3764fd Author: Meghana Malladi Date: Mon Mar 23 14:33:57 2026 +0530 arm64: dts: ti: k3-am642-evm: Add ICSSG0 overlay for dual EMAC support Add device tree overlay to enable ICSSG0 dual EMAC support on AM642 EVM. This overlay enables both ICSSG0 Ethernet interfaces (port0 and port1) in dual EMAC mode. Users can combine this with the existing ICSSG1 overlay to enable all four ICSSG interfaces if needed. Signed-off-by: Meghana Malladi Link: https://patch.msgid.link/20260323090358.632329-2-m-malladi@ti.com Signed-off-by: Vignesh Raghavendra commit 71c2a8124527a19af06b8d0f5061701d851e15bb Author: Francesco Dolcini Date: Tue Mar 24 10:37:02 2026 +0100 arm64: dts: ti: k3-am62p-verdin: Add Zinnia Add Zinnia Carrier Board mated with Verdin AM62P. It features 1 x RS232, 1 x RS485, 1 x CAN, 3 x isolated digital I/O, 2 x 1GBit/s Ethernet, a mini PCIe slot with USB / SIM card connector for a modem, USB and SD card interfaces. Link: https://www.toradex.com/products/carrier-board/zinnia-carrier-board Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20260324093705.26730-8-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit 15da9d2915d0ce705538052edf9552f37c253263 Author: Francesco Dolcini Date: Tue Mar 24 10:37:01 2026 +0100 arm64: dts: ti: k3-am62p-verdin: Add SPI_1_CS as GPIO Add a pinctrl to use SPI_1 CS as GPIO. Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20260324093705.26730-7-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit cbbda853615f09ca9c9f92efd8b75393a94c988a Author: Francesco Dolcini Date: Tue Mar 24 10:37:00 2026 +0100 arm64: dts: ti: k3-am62p-verdin: Split UART_2 pinctrl group Some carrier board reuse the UART_2 control signals as GPIO, split the pinctrl RTS/CTS in separated nodes to maximize flexibility. Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20260324093705.26730-6-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit 4abc2f22e469d8ebcf56e334d2223095cd472f26 Author: Francesco Dolcini Date: Tue Mar 24 10:36:59 2026 +0100 arm64: dts: ti: k3-am62-verdin: Add Zinnia Add Zinnia Carrier Board mated with Verdin AM62. It features 1 x RS232, 1 x RS485, 1 x CAN, 3 x isolated digital I/O, 2 x 1GBit/s Ethernet, a mini PCIe slot with USB / SIM card connector for a modem, USB and SD card interfaces. Link: https://www.toradex.com/products/carrier-board/zinnia-carrier-board Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20260324093705.26730-5-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit 903c29493e6a0c5d9d34d13e162fb2ce6182d88b Author: Francesco Dolcini Date: Tue Mar 24 10:36:58 2026 +0100 arm64: dts: ti: k3-am62-verdin: Split UART_2 pinctrl group Some carrier board reuse the UART_2 control signals as GPIO, split the pinctrl RTS/CTS in separated nodes to maximize flexibility. Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20260324093705.26730-4-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit 944dffaec1ef0f21c203728de77b5618ed70df6e Author: Francesco Dolcini Date: Tue Mar 24 10:36:57 2026 +0100 arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label Fix SPI_1_CS GPIO pinmux label, this is spi1_cs, not qspi1_io4. There are no user of this label yet, therefore this change does not create any compatibility issue. Fixes: fcb335934c51 ("arm64: dts: ti: verdin-am62: Improve spi1 chip-select pinctrl") Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20260324093705.26730-3-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit bae382fc0c9555d21bc125a0310c2b0895489f87 Author: Francesco Dolcini Date: Tue Mar 24 10:36:56 2026 +0100 dt-bindings: arm: ti: Add verdin am62/am62p zinnia board Add Toradex Verdin Zinnia carrier board mated with Verdin AM62 and AM62P. Link: https://www.toradex.com/products/carrier-board/zinnia-carrier-board Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20260324093705.26730-2-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit 552994294fe27b42a6a735b0388029b45d776b38 Author: Jiayuan Chen Date: Wed Mar 25 15:18:54 2026 +0800 tcp: Fix inconsistent indenting warning Suppress such warning reported by test robot: include/net/tcp.h:1449 tcp_ca_event() warn: inconsistent indenting Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603251430.gQ3VuiKV-lkp@intel.com/ Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260325071854.805-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 5fffa6fe40f07e831dc387170405b7f3486d14d0 Merge: f8844dfeeae88d af0331e1ac51f4 Author: Jakub Kicinski Date: Thu Mar 26 20:39:47 2026 -0700 Merge branch 'net-stmmac-remove-unused-and-unimplemented-axi-properties' Russell King says: ==================== net: stmmac: remove unused and unimplemented AXI properties commit afea03656add ("stmmac: rework DMA bus setting and introduce new platform AXI structure") added support for parsing all the stmmac AXI attributes, and added code to set most of the appropriate register bits with three exceptions: snps,kbbe snps,mb snps,rb These were parsed by the driver, but the result of parsing was never used by any of the cores. Moreover, no DTS in the kernel makes use of these properties. Thus, it doesn't make sense for the driver to parse these, so let's remove them. Also remove them from the DT binding document. ==================== Link: https://patch.msgid.link/acJh4z3pRKkeaFbR@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit af0331e1ac51f48d0cc6bb09547b8c8ae467a019 Author: Russell King (Oracle) Date: Tue Mar 24 10:05:45 2026 +0000 dt-bindings: remove unimplemented AXI snps,kbbe snps,mb and snps,rb Remove the AXI snps,kbbe snps,mb and snps,rb properties as they have not been used, and although the driver parses these, the code hasn't ever used the parsed result. This parsing has now been removed. These were introduced by commit afea03656add ("stmmac: rework DMA bus setting and introduce new platform AXI structure"). Signed-off-by: Russell King (Oracle) Acked-by: Conor Dooley Link: https://patch.msgid.link/E1w4ydt-0000000Dlph-3WvI@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a800398e746f8c9010c626a71d92a05b708f7622 Author: Russell King (Oracle) Date: Tue Mar 24 10:05:40 2026 +0000 net: stmmac: remove axi_kbbe, axi_mb and axi_rb members axi_kbbe, axi_mb and axi_rb are all written, but nothing ever reads their values. Remove the code that sets these and the struct members. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w4ydo-0000000Dlpb-34jd@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f8844dfeeae88db074146e3f8a865b5565f61b40 Author: Di Zhu Date: Mon Mar 23 12:17:30 2026 +0800 virtio-net: enable NETIF_F_GRO_HW only if GRO-related offloads are supported Negotiating VIRTIO_NET_F_CTRL_GUEST_OFFLOADS indicates the device allows control over offload support, but the offloads that can be controlled may have nothing to do with GRO (e.g., if neither GUEST_TSO4 nor GUEST_TSO6 is supported). In such a setup, reporting NETIF_F_GRO_HW as available for the device is too optimistic and misleading to the user. Improve the situation by masking off NETIF_F_GRO_HW unless the device possesses actual GRO-related offload capabilities. Out of an abundance of caution, this does not change the current behaviour for hardware with just v6 or just v4 GRO: current interfaces do not allow distinguishing between v6/v4 GRO, so we can't expose them to userspace precisely. Signed-off-by: Di Zhu Acked-by: Jason Wang Link: https://patch.msgid.link/20260323041730.986351-1-zhud@hygon.cn Signed-off-by: Jakub Kicinski commit 6a539eee855cbfe9c32507c70003b7710604fcfb Author: Eric Dumazet Date: Wed Mar 25 21:24:39 2026 +0000 tcp: tcp_vegas: use tcp_vegas_cwnd_event_tx_start() While net/ipv4/tcp_yeah.c is correctly setting .cwnd_event_tx_start to tcp_vegas_cwnd_event_tx_start(), I forgot to do the same in tcp_vegas.c Fixes: d1e59a469737 ("tcp: add cwnd_event_tx_start to tcp_congestion_ops") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260325212440.4146579-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit fe3e54253f0b04ec9e85d46e10aadbdbb31d29b2 Author: Michael S. Tsirkin Date: Tue Mar 24 11:15:54 2026 -0400 virtio_net: sync RX buffer before reading the header receive_buf() reads the virtio header through buf before page_pool_dma_sync_for_cpu() runs in receive_small() or receive_mergeable(). The header buffer is thus unsynchronized at the point where flags and, for mergeable buffers, num_buffers are consumed. Omar Elghoul reported that on s390x Secure Execution this showed up as greatly reduced virtio-net performance together with "bad gso" and "bad csum" messages in dmesg. This is because with SE sync actually copies data, so the header is uninitialized. Move the sync into receive_buf() so the header is synchronized before any access through buf. Tool use: Cursor with GPT-5.4 drafted the initial code move from prompt: "in drivers/net/virtio_net.c, move page_pool_dma_sync_for_cpu on receive path to before memory is accessed through buf". The result and the commit log were reviewed and edited manually. Fixes: 24fbd3967f3f ("virtio_net: add page_pool support for buffer allocation") Reported-by: Omar Elghoul Tested-by: Srikanth Aithal Tested-by: Omar Elghoul Link: https://lore.kernel.org/r/20260323150136.14452-1-oelghoul@linux.ibm.com Signed-off-by: Michael S. Tsirkin Tested-by: Vishwanath Seshagiri Acked-by: Jason Wang Link: https://patch.msgid.link/f4caa9be9e5addae7851c012cab0a733be7f0974.1774365273.git.mst@redhat.com Signed-off-by: Jakub Kicinski commit 05c8b1cdc54036465ea457a0501a8c2f9409fce7 Author: Arvind Yadav Date: Thu Mar 26 18:38:38 2026 +0530 drm/xe/madvise: Accept canonical GPU addresses in xe_vm_madvise_ioctl Userspace passes canonical (sign-extended) GPU addresses where bits 63:48 mirror bit 47. The internal GPUVM uses non-canonical form (upper bits zeroed), so passing raw canonical addresses into GPUVM lookups causes mismatches for addresses above 128TiB. Strip the sign extension with xe_device_uncanonicalize_addr() at the top of xe_vm_madvise_ioctl(). Non-canonical addresses are unaffected. Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe") Suggested-by: Matthew Brost Cc: Thomas Hellström Reviewed-by: Matthew Brost Signed-off-by: Himal Prasad Ghimiray Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-13-arvind.yadav@intel.com commit 4def73ec3d000a8347b2b63f4ecc5b1e3b476941 Author: Arvind Yadav Date: Thu Mar 26 18:38:37 2026 +0530 drm/xe/madvise: Enable purgeable buffer object IOCTL support Hook the madvise_purgeable() handler into the madvise IOCTL now that all supporting infrastructure is complete: - Core purge implementation (patch 3) - BO state tracking and helpers (patches 1-2) - Per-VMA purgeable state tracking (patch 6) - Shrinker integration for memory reclamation (patch 10) This final patch enables userspace to use the DRM_XE_VMA_ATTR_PURGEABLE_STATE madvise type to mark buffers as WILLNEED/DONTNEED and receive the retained status indicating whether buffers were purged. The feature was kept disabled in earlier patches to maintain bisectability and ensure all components are in place before exposing to userspace. Userspace can detect kernel support for purgeable BOs by checking the DRM_XE_QUERY_CONFIG_FLAG_HAS_PURGING_SUPPORT flag in the query_config response. Suggested-by: Matthew Brost Cc: Matthew Brost Reviewed-by: Thomas Hellström Signed-off-by: Himal Prasad Ghimiray Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-12-arvind.yadav@intel.com commit 536a2ead3a8f2048643da3e8340a4d73fdf71903 Author: Arvind Yadav Date: Thu Mar 26 18:38:36 2026 +0530 drm/xe/bo: Add purgeable shrinker state helpers Encapsulate TTM purgeable flag updates and shrinker page accounting into helper functions to prevent desynchronization between the TTM tt->purgeable flag and the shrinker's page bucket counters. Without these helpers, direct manipulation of xe_ttm_tt->purgeable risks forgetting to update the corresponding shrinker counters, leading to incorrect memory pressure calculations. Update purgeable BO state to PURGED after successful shrinker purge for DONTNEED BOs. Cc: Matthew Brost Cc: Himal Prasad Ghimiray Reviewed-by: Thomas Hellström Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-11-arvind.yadav@intel.com commit da857c9a48874dff183a10348ab1a49ffba1ec1e Author: Arvind Yadav Date: Thu Mar 26 18:38:35 2026 +0530 drm/xe/dma_buf: Block export of DONTNEED/purged BOs Don't allow exporting BOs marked DONTNEED or PURGED as dma-bufs. DONTNEED BOs can have their contents discarded at any time, making the exported dma-buf unusable for external devices. PURGED BOs have no backing store and are permanently invalid. Return -EBUSY for DONTNEED BOs (temporary purgeable state) and -EINVAL for purged BOs (permanent, no backing store). The export path now checks the BO's purgeable state before creating the dma-buf, preventing external devices from accessing memory that may be purged at any time. Cc: Thomas Hellström Cc: Himal Prasad Ghimiray Reviewed-by: Matthew Brost Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-10-arvind.yadav@intel.com commit 975bc3ea4cca58deadfaf64121eb71e2da39571d Author: Arvind Yadav Date: Thu Mar 26 18:38:34 2026 +0530 drm/xe/bo: Block mmap of DONTNEED/purged BOs Don't allow new CPU mmaps to BOs marked DONTNEED or PURGED. DONTNEED BOs can have their contents discarded at any time, making CPU access undefined behavior. PURGED BOs have no backing store and are permanently invalid. Return -EBUSY for DONTNEED BOs (temporary purgeable state) and -EINVAL for purged BOs (permanent, no backing store). The mmap offset ioctl now checks the BO's purgeable state before allowing userspace to establish a new CPU mapping. This prevents the race where userspace gets a valid offset but the BO is purged before actual faulting begins. Existing mmaps (established before DONTNEED) may still work until pages are purged, at which point CPU faults fail with SIGBUS. Cc: Thomas Hellström Cc: Himal Prasad Ghimiray Reviewed-by: Matthew Brost Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-9-arvind.yadav@intel.com commit 63cf199c0c3274fc0efde11cd854632b64b1113a Author: Arvind Yadav Date: Thu Mar 26 18:38:33 2026 +0530 drm/xe/madvise: Block imported and exported dma-bufs Prevent marking imported or exported dma-bufs as purgeable. External devices may be accessing these buffers without our knowledge, making purging unsafe. Check drm_gem_is_imported() for buffers created by other drivers and obj->dma_buf for buffers exported to other drivers. Silently skip these BOs during madvise processing. This follows drm_gem_shmem's purgeable implementation and prevents data corruption from purging actively-used shared buffers. Cc: Matthew Brost Cc: Himal Prasad Ghimiray Reviewed-by: Thomas Hellström Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-8-arvind.yadav@intel.com commit 5bfb7e6a7fc0056a974ce13a81c95602a2cae859 Author: Arvind Yadav Date: Thu Mar 26 18:38:32 2026 +0530 drm/xe/madvise: Implement per-VMA purgeable state tracking Track purgeable state per-VMA instead of using a coarse shared BO check. This prevents purging shared BOs until all VMAs across all VMs are marked DONTNEED. Add xe_bo_all_vmas_dontneed() to check all VMAs before marking a BO purgeable. Add xe_bo_recheck_purgeable_on_vma_unbind() to handle state transitions when VMAs are destroyed - if all remaining VMAs are DONTNEED the BO can become purgeable, or if no VMAs remain it transitions to WILLNEED. The per-VMA purgeable_state field stores the madvise hint for each mapping. Shared BOs can only be purged when all VMAs unanimously indicate DONTNEED. This prevents the bug where unmapping the last VMA would incorrectly flip a DONTNEED BO back to WILLNEED. The enum-based state check preserves BO state when no VMAs remain, only updating when VMAs provide explicit hints. Cc: Matthew Brost Cc: Himal Prasad Ghimiray Reviewed-by: Thomas Hellström Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-7-arvind.yadav@intel.com commit 4f44961eab8474a47de419113e1d46095f9b44e0 Author: Arvind Yadav Date: Thu Mar 26 18:38:31 2026 +0530 drm/xe/vm: Prevent binding of purged buffer objects Add purge checking to vma_lock_and_validate() to block new mapping operations on purged BOs while allowing cleanup operations to proceed. Purged BOs have their backing pages freed by the kernel. New mapping operations (MAP, PREFETCH, REMAP) must be rejected with -EINVAL to prevent GPU access to invalid memory. Cleanup operations (UNMAP) must be allowed so applications can release resources after detecting purge via the retained field. REMAP operations require mixed handling - reject new prev/next VMAs if the BO is purged, but allow the unmap portion to proceed for cleanup. The check_purged flag in struct xe_vma_lock_and_validate_flags distinguishes between these cases: true for new mappings (must reject), false for cleanup (allow). Cc: Himal Prasad Ghimiray Cc: Matthew Brost Reviewed-by: Thomas Hellström Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-6-arvind.yadav@intel.com commit 9a16fdf5dca53326a4234826ce97727d53511aa2 Author: Arvind Yadav Date: Thu Mar 26 18:38:30 2026 +0530 drm/xe/bo: Block CPU faults to purgeable buffer objects Block CPU page faults to buffer objects marked as purgeable (DONTNEED) or already purged. Once a BO is marked DONTNEED, its contents can be discarded by the kernel at any time, making access undefined behavior. Return VM_FAULT_SIGBUS immediately to fail consistently instead of allowing erratic behavior where access sometimes works (if not yet purged) and sometimes fails (if purged). For DONTNEED BOs: - Block new CPU faults with SIGBUS to prevent undefined behavior. - Existing CPU PTEs may still work until TLB flush, but new faults fail immediately. For PURGED BOs: - Backing store has been reclaimed, making CPU access invalid. - Without this check, accessing existing mmap mappings would trigger xe_bo_fault_migrate() on freed backing store, causing kernel hangs or crashes. The purgeable check is added to both CPU fault paths: - Fastpath (xe_bo_cpu_fault_fastpath): Returns VM_FAULT_SIGBUS immediately under dma-resv lock, preventing attempts to migrate/validate DONTNEED/purged pages. - Slowpath (xe_bo_cpu_fault): Returns -EFAULT under drm_exec lock, converted to VM_FAULT_SIGBUS. Cc: Matthew Brost Cc: Himal Prasad Ghimiray Reviewed-by: Thomas Hellström Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-5-arvind.yadav@intel.com commit ad9843aac91a1eda12912a4922042ea04cfc29dc Author: Arvind Yadav Date: Thu Mar 26 18:38:29 2026 +0530 drm/xe/madvise: Implement purgeable buffer object support This allows userspace applications to provide memory usage hints to the kernel for better memory management under pressure: Add the core implementation for purgeable buffer objects, enabling memory reclamation of user-designated DONTNEED buffers during eviction. This patch implements the purge operation and state machine transitions: Purgeable States (from xe_madv_purgeable_state): - WILLNEED (0): BO should be retained, actively used - DONTNEED (1): BO eligible for purging, not currently needed - PURGED (2): BO backing store reclaimed, permanently invalid Design Rationale: - Async TLB invalidation via trigger_rebind (no blocking xe_vm_invalidate_vma) - i915 compatibility: retained field, "once purged always purged" semantics - Shared BO protection prevents multi-process memory corruption - Scratch PTE reuse avoids new infrastructure, safe for fault mode Note: The madvise_purgeable() function is implemented but not hooked into the IOCTL handler (madvise_funcs[] entry is NULL) to maintain bisectability. The feature will be enabled in the final patch when all supporting infrastructure (shrinker, per-VMA tracking) is complete. Cc: Matthew Brost Cc: Himal Prasad Ghimiray Reviewed-by: Thomas Hellström Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-4-arvind.yadav@intel.com commit b67427f939ccf038a658badb02dd948c7b516248 Author: Arvind Yadav Date: Thu Mar 26 18:38:28 2026 +0530 drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo Add infrastructure for tracking purgeable state of buffer objects. This includes: Introduce enum xe_madv_purgeable_state with three states: - XE_MADV_PURGEABLE_WILLNEED (0): BO is needed and should not be purged. This is the default state for all BOs. - XE_MADV_PURGEABLE_DONTNEED (1): BO is not currently needed and can be purged by the kernel under memory pressure to reclaim resources. Only non-shared BOs can be marked as DONTNEED. - XE_MADV_PURGEABLE_PURGED (2): BO has been purged by the kernel. Accessing a purged BO results in error. Follows i915 semantics where once purged, the BO remains permanently invalid ("once purged, always purged"). Add madv_purgeable field to struct xe_bo for state tracking of purgeable state across concurrent access paths Cc: Thomas Hellström Cc: Himal Prasad Ghimiray Reviewed-by: Matthew Brost Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-3-arvind.yadav@intel.com commit f99a05cc0b85fadd109fb3250fceccc5eaad3830 Author: Himal Prasad Ghimiray Date: Thu Mar 26 18:38:27 2026 +0530 drm/xe/uapi: Add UAPI support for purgeable buffer objects Extend the DRM_XE_MADVISE ioctl to support purgeable buffer object management by adding DRM_XE_VMA_ATTR_PURGEABLE_STATE attribute type. This allows userspace applications to provide memory usage hints to the kernel for better memory management under pressure: - WILLNEED: Buffer is needed and should not be purged. If the BO was previously purged, retained field returns 0 indicating backing store was lost (once purged, always purged semantics matching i915). - DONTNEED: Buffer is not currently needed and may be purged by the kernel under memory pressure to free resources. Only applies to non-shared BOs. To prevent undefined behavior, the following operations are blocked while a BO is in DONTNEED state: - New mmap() operations return -EBUSY - VM_BIND operations return -EBUSY - New dma-buf exports return -EBUSY - CPU page faults return SIGBUS - GPU page faults fail with -EACCES This ensures applications cannot use a BO while marked as DONTNEED, preventing erratic behavior when the kernel purges the backing store. The implementation includes a 'retained' output field (matching i915's drm_i915_gem_madvise.retained) that indicates whether the BO's backing store still exists (1) or has been purged (0). Added DRM_XE_QUERY_CONFIG_FLAG_HAS_PURGING_SUPPORT flag to allow userspace to detect kernel support for purgeable buffer objects before attempting to use the feature. Cc: Matthew Brost Acked-by: José Roberto de Souza Reviewed-by: Thomas Hellström Signed-off-by: Himal Prasad Ghimiray Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-2-arvind.yadav@intel.com commit cf2d1b5b0158a42182b50e8c797ba171c995c726 Merge: 72b585da5587f7 3bce3fdd1ff2ba Author: Dave Airlie Date: Fri Mar 27 12:45:28 2026 +1000 Merge tag 'drm-misc-next-2026-03-26' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.1: UAPI Changes: amdxdna: - support per-BO memory-usage queries docs: - Improve UAPI documentation panthor: - extend timestamp query with flags Core Changes: edid: - provide enum drm_output_color_format; mass-convert drivers gem-dma: - use drm_dev_dma_dev() for DMA mappings - set VM_DONTDUMP on mmap mipi-dbi: - drop simple-display; mass-convert drivers prime: - use drm_dev_dma_dev() for DMA mappings ttm: - improve handling of gfp_retry_mayfail Driver Changes: amdgpu: - use atomic_create_state for private_obj amdxdna: - refactor GEM implementation - fixes bridge: - provide clear-and-put helper for reliable cleanup - analogix_dp: Use DP helpers for link training - lontium-lt8713sx: Fix 64-bit division and Kconfig - samsung-dsim: Use clear-and-put imagination: - improve power-off sequence - support context-reset notification from firmware komeda: - support Arm China Linlon D6 plus DT bindings mediatek: - use drm_dev_dma_dev() for DMA mappings panel: - support Himax HX83121A plus DT bindings - support JuTouch JT070TM041 plus DT bindings - support Samsung S6E8FC0 plus DT bindings - himax-hx83102c: support Samsung S6E8FC0 plus DT bindings; support backlight - ili9806e: support Rocktech RK050HR345-CT106A plus DT bindings - simple: support Tianma TM050RDH03 plus DT bindings panthor: - support various sources for timestamp queries - fixes omapdrm: - use atomic_create_state for private_obj rcar-du: - fix suspend/resume wrt VSP interface - fix leak of device_link - clean up sun4i: - use drm_dev_dma_dev() for DMA mappings tegra: - use atomic_create_state for private_obj xe: - send 'none' recovery method for XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260326151812.GA76082@linux.fritz.box commit 2b8bd26bbfcdeb1a06127dcd8f9101080133f2a1 Author: Aurelien Jarno Date: Thu Mar 26 19:35:34 2026 +0100 riscv: dts: spacemit: enable PCIe ports on Milk-V Jupiter Enable the two PCIe controller along with and their associated PHY. They are routed to the M.2 M-key connector and to the PCIe x8 slot. Add an always-on regulator sourcing 3.3V from the DC-IN input, to power the PCIe ports. Signed-off-by: Aurelien Jarno Reviewed-by: Javier Martinez Canillas Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260326183745.1370642-7-aurelien@aurel32.net Signed-off-by: Yixun Lan commit dce01d8585a22f708b5f1eb621cacd9878258ac8 Author: Aurelien Jarno Date: Thu Mar 26 19:35:33 2026 +0100 riscv: dts: spacemit: enable USB 3 ports on Milk-V Jupiter Enable the DWC3 USB 3.0 controller (USB#2 port in the K1 datasheet) and its associated combo_phy (USB 3 PHY) and usbphy2 (USB 2 PHY) on the Milk-V Jupiter board. The board uses a VLI VL817 hub, providing four ports. Two are routed to the 3.0 type-A connectors, and two to the F_USB3 front USB header. The hub requires two separate 5V power supplies: one for the hub itself and one for the USB connectors. Add an always-on regulator sourcing 5V from the DC-IN input, along with two GPIO-controlled fixed regulators to manage the hub and connectors power supplies. Note that the board also provides four USB 2.0 ports (two via type-A connectors and two via the F_USB2 front USB header), but these are handled by a different controller (USB#1 port in the K1 datasheet). Signed-off-by: Aurelien Jarno Reviewed-by: Javier Martinez Canillas Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260326183745.1370642-6-aurelien@aurel32.net Signed-off-by: Yixun Lan commit 2829823956f0f590f5c6b4eafed2dab7a96f69b3 Author: Aurelien Jarno Date: Thu Mar 26 19:35:32 2026 +0100 riscv: dts: spacemit: enable QSPI and add SPI NOR on Milk-V Jupiter Add the QSPI controller node for the Milk-V Jupiter board and describe the attached SPI NOR flash (GD25Q64E). The flash supports a frequency up to 133MHz (80 MHz for reads), and the SoC supports a frequency up to 104 MHz. However tests have shown that the flash is not reliably detected above 26.5 MHz, consistent with frequency used in the vendor kernel. Therefore, use this frequency. The m25p,fast-read properties is taken from the vendor kernel, and the GD25Q64E datasheet confirms tha the fast read opcodes are supported. Add a corresponding flash partition layout, matching the layout and the names used in the vendor U-Boot. Signed-off-by: Aurelien Jarno Reviewed-by: Javier Martinez Canillas Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260326183745.1370642-5-aurelien@aurel32.net Signed-off-by: Yixun Lan commit 7af5edec73d5d69618541f91600adeb6f35b7d17 Author: Aurelien Jarno Date: Thu Mar 26 19:35:31 2026 +0100 riscv: dts: spacemit: add i2c aliases on Milk-V Jupiter Add i2c aliases for i2c2 and i2c8 on Milk-V Jupiter. This is useful to keep a stable number for the /dev entries after loading the i2c-dev module. Signed-off-by: Aurelien Jarno Reviewed-by: Javier Martinez Canillas Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260326183745.1370642-4-aurelien@aurel32.net Signed-off-by: Yixun Lan commit 77156216f1d0f57e1cfce3452410db20468edca4 Author: Aurelien Jarno Date: Thu Mar 26 19:35:30 2026 +0100 riscv: dts: spacemit: add 24c04 eeprom on Milk-V Jupiter The Milk-V Jupiter board includes a 24c04 eeprom on the i2c2 bus. The eeprom contains an ONIE TLV table, which on the board I tested only provides a product-name entry. Expose it via an onie,tlv-layout nvmem layout. The eeprom is marked as read-only since its contents are not supposed to be modified. Signed-off-by: Aurelien Jarno Reviewed-by: Javier Martinez Canillas Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260326183745.1370642-3-aurelien@aurel32.net Signed-off-by: Yixun Lan commit 334e64abacd3df4005de80b082d0dbf02b453c76 Author: Aurelien Jarno Date: Thu Mar 26 19:35:29 2026 +0100 riscv: dts: spacemit: add LEDs for Milk-V Jupiter board The Milk-V Jupiter board provides support for two LEDs through the front panel header. The "Power LED" indicates the system is running, and the "HDD LED" shows disk activity. Configure the corresponding LED triggers accordingly. Caveats: - The LEDs are driven through a 4.7k series resistor, making them quite faint. - The disk activity trigger requires a storage controller on the M.2 or PCIe interface. That said, it matches the purpose and the vendor kernel. Signed-off-by: Aurelien Jarno Reviewed-by: Javier Martinez Canillas Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260326183745.1370642-2-aurelien@aurel32.net Signed-off-by: Yixun Lan commit af704cad18c0e973c758f41c9337411168de3681 Author: Andrew Davis Date: Tue Mar 3 14:52:24 2026 -0600 arm64: dts: ti: k3-j721s2: Make MAIN domain system control bus a simple-bus This node describes a memory address range containing several sub-regions with control registers for various IP in the MAIN domain of this SoC. It was described as a "ti,j721e-system-controller" but this is a J721S2 SoC with is not compatible with the system controller region found in J721e. No project consuming this DT has been found that makes use of the syscon compatible for this region, to prevent any from using this node like a generic syscon region in the future, make this a normal simple-bus as it should have been from the start. Signed-off-by: Andrew Davis Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/20260303205224.108217-2-afd@ti.com Signed-off-by: Vignesh Raghavendra commit 830e0b0e15ee3d676539346b019f97f9bfae16b5 Author: Andrew Davis Date: Tue Mar 3 14:52:23 2026 -0600 arm64: dts: ti: k3-j7200: Make MAIN domain system control bus a simple-bus This node describes a memory address range containing several sub-regions with control registers for various IP in the MAIN domain of this SoC. It was described as a "ti,j721e-system-controller" but this is a J7200 SoC with is not compatible with the system controller region found in J721e. No project consuming this DT has been found that makes use of the syscon compatible for this region, to prevent any from using this node like a generic syscon region in the future, make this a normal simple-bus as it should have been from the start. Signed-off-by: Andrew Davis Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/20260303205224.108217-1-afd@ti.com Signed-off-by: Vignesh Raghavendra commit ee2a9d9c9e6c9643fb7e45febcaedfbc038e483a Author: Judith Mendez Date: Mon Feb 23 17:37:31 2026 -0600 arm64: dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins AM62 LP SK board does not have external pullups on MMC0 DAT1-DAT7 pins [0]. Enable internal pullups on DAT1-DAT7 considering: - without a host-side pullup, these lines rely solely on the eMMC device's internal pullup (R_int, 10-150K per JEDEC), which may exceed the recommended 50K max for 1.8V VCCQ - JEDEC JESD84-B51 Table 200 requires host-side pullups (R_DAT, 10K-100K) on all data lines to prevent bus floating [0] https://www.ti.com/lit/zip/SPRR471 Fixes: a0b8da04153e ("arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file") Signed-off-by: Judith Mendez Reviewed-by: Moteen Shah Link: https://patch.msgid.link/20260223233731.2690472-4-jm@ti.com Signed-off-by: Vignesh Raghavendra commit 02532ba56362907b6aca3e8289c4a9247ef83325 Author: Judith Mendez Date: Mon Feb 23 17:37:30 2026 -0600 arm64: dts: ti: k3-am62l3-evm: Disable MMC1 internal pulls on data pins AM62L EVM has external 47K pullups on MMC1 DAT1-DAT3 pins [0]. Disable internal pullups on DAT1-DAT3 so that each line has a single pullup source: - with both pullups enabled, the effective parallel resistance on DAT1-3 (~24.2K) creates a ~2x mismatch vs DAT0 (47K external only). Removing internal pullups results in DAT1-3 matching DAT0 at 47K - 47K external alone is within the recommended range for 1.8V signaling (10K min, 50K recommended max) - both internal and external pullups enabled equals unnecessary power consumption [0] https://www.ti.com/lit/zip/SPRCAL6 Fixes: 00fb4c73b67d ("arm64: dts: ti: k3-am62l: add initial reference board file") Signed-off-by: Judith Mendez Reviewed-by: Moteen Shah Link: https://patch.msgid.link/20260223233731.2690472-3-jm@ti.com Signed-off-by: Vignesh Raghavendra commit 6d4441be969bea89bb9702781f5dfb3a8f2a02a4 Author: Judith Mendez Date: Mon Feb 23 17:37:29 2026 -0600 arm64: dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins AM62P SK has external 10K pullups on MMC1 DAT1-DAT3 pins [0]. Disable internal pullups on DAT1-DAT3 so that each line has a single pullup source: - with both pullups enabled, the effective parallel resistance on DAT1-3 (~8.33K) drops below the 10K minimum pullup requirement for data lines (per SD Physical Layer Specification) - removing internal pullups makes DAT1-3 match DAT0 10K external pullup so its consistent and within spec - both internal and external pullups enabled equals unnecessary power consumption [0] https://www.ti.com/lit/zip/SPRR487 Fixes: c00504ea42c0 ("arm64: dts: ti: k3-am62p5-sk: Updates for SK EVM") Signed-off-by: Judith Mendez Reviewed-by: Moteen Shah Link: https://patch.msgid.link/20260223233731.2690472-2-jm@ti.com Signed-off-by: Vignesh Raghavendra commit 8cb06da086ae530de7eaf4f44e33e46fa4e78c53 Author: Kendall Willis Date: Thu Feb 12 11:27:24 2026 -0600 arm64: dts: ti: k3-am62d2-evm: Enable Main UART wakeup The Main UART can resume from suspend to RAM states when PIN_WKUP_EN is enabled. Add the necessary pins needed to wakeup the system. Add the system idle states that the Main UART can wakeup the system from. The UART driver uses the "default" pinctrl state when the system is active. In the suspend hook, if the UART is wakeup enabled, the "wakeup" pinctrl state is selected by the UART driver in order to allow wakeup. Upon resume, the default pinctrl state is selected again. Signed-off-by: Kendall Willis Link: https://patch.msgid.link/20260212-b4-uart-daisy-chain-dts-v5-5-26c7f534e567@ti.com Signed-off-by: Vignesh Raghavendra commit f6861318c5393a309ac8907a27a4f09f3518b20d Author: Kendall Willis Date: Thu Feb 12 11:27:23 2026 -0600 arm64: dts: ti: k3-am62l3-evm: Enable Main UART wakeup The Main UART can resume from suspend to RAM states when PIN_WKUP_EN is enabled. Add the necessary pins needed to wakeup the system. Add the system idle states that the Main UART can wakeup the system from. The UART driver uses the "default" pinctrl state when the system is active. In the suspend hook, if the UART is wakeup enabled, the "wakeup" pinctrl state is selected by the UART driver in order to allow wakeup. Upon resume, the default pinctrl state is selected again. Reviewed-by: Markus Schneider-Pargmann Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman Signed-off-by: Kendall Willis Link: https://patch.msgid.link/20260212-b4-uart-daisy-chain-dts-v5-4-26c7f534e567@ti.com Signed-off-by: Vignesh Raghavendra commit f298ada021e10d07972b5de703c7c8ceeeaa7bc6 Author: Kendall Willis Date: Thu Feb 12 11:27:22 2026 -0600 arm64: dts: ti: k3-am62p5-sk: Enable Main UART wakeup The Main UART can resume from suspend to RAM states when PIN_WKUP_EN is enabled. Add the necessary pins needed to wakeup the system. Add the system idle states that the Main UART can wakeup the system from. The UART driver uses the "default" pinctrl state when the system is active. In the suspend hook, if the UART is wakeup enabled, the "wakeup" pinctrl state is selected by the UART driver in order to allow wakeup. Upon resume, the default pinctrl state is selected again. Reviewed-by: Markus Schneider-Pargmann Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman Signed-off-by: Kendall Willis Link: https://patch.msgid.link/20260212-b4-uart-daisy-chain-dts-v5-3-26c7f534e567@ti.com Signed-off-by: Vignesh Raghavendra commit 005a2d075caa1cdd95cb6b580f542b64bf41e944 Author: Kendall Willis Date: Thu Feb 12 11:27:21 2026 -0600 arm64: dts: ti: k3-am62a7-sk: Enable Main UART wakeup The Main UART can resume from suspend to RAM states when PIN_WKUP_EN is enabled. Add the necessary pins needed to wakeup the system. Add the system idle states that the Main UART can wakeup the system from. The UART driver uses the "default" pinctrl state when the system is active. In the suspend hook, if the UART is wakeup enabled, the "wakeup" pinctrl state is selected by the UART driver in order to allow wakeup. Upon resume, the default pinctrl state is selected again. Reviewed-by: Markus Schneider-Pargmann Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman Signed-off-by: Kendall Willis Link: https://patch.msgid.link/20260212-b4-uart-daisy-chain-dts-v5-2-26c7f534e567@ti.com Signed-off-by: Vignesh Raghavendra commit 6b0b73c9fecf343ad95f761b3f781c6064eb31fb Author: Kendall Willis Date: Thu Feb 12 11:27:20 2026 -0600 arm64: dts: ti: k3-am62x-sk-common: Enable Main UART wakeup The Main UART can resume from suspend to RAM states when PIN_WKUP_EN is enabled. Add the necessary pins needed to wakeup the system. Add the system idle states that the Main UART can wakeup the system from. The UART driver uses the "default" pinctrl state when the system is active. In the suspend hook, if the UART is wakeup enabled, the "wakeup" pinctrl state is selected by the UART driver in order to allow wakeup. Upon resume, the default pinctrl state is selected again. Reviewed-by: Markus Schneider-Pargmann Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman Signed-off-by: Kendall Willis Link: https://patch.msgid.link/20260212-b4-uart-daisy-chain-dts-v5-1-26c7f534e567@ti.com Signed-off-by: Vignesh Raghavendra commit a771cddbd6541587b2b423576a57e4217ec11a38 Merge: 5f70b0aa08ada1 588cd4e7d22cf8 Author: Jakub Kicinski Date: Thu Mar 26 18:55:22 2026 -0700 Merge branch 'net-dsa-microchip-small-cleanups-for-ksz9477-sgmii' Maxime Chevallier says: ==================== net: dsa: microchip: Small cleanups for ksz9477 SGMII While working with ksz9477, I've done some very minor cleanups around the PCS code for the SGMII port. No changes intended. ==================== Link: https://patch.msgid.link/20260324180826.524327-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 588cd4e7d22cf82081865a6677a468c88d93b4ba Author: Maxime Chevallier Date: Tue Mar 24 19:08:25 2026 +0100 net: dsa: microchip: drop an outdated comment about SGMII support SGMII support has been added to ksz9477, we can drop the comment saying that it'll be added later. Signed-off-by: Maxime Chevallier Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260324180826.524327-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit e1da0e1859c612ca81d05518cb908642c00c2e93 Author: Maxime Chevallier Date: Tue Mar 24 19:08:24 2026 +0100 net: dsa: microchip: Drop unnecessary check in ksz9477 PCS setup The ksz_dev_ops .pcs_create() is called under the assumption that the switch has a PCS port : if (ksz_has_sgmii_port(dev) && dev->dev_ops->pcs_create) { ret = dev->dev_ops->pcs_create(dev); [...] } The KSZ9477 implementation of .pcs_create() does the same check on ksz_has_sgmii_port(), and protects the entire function with it. Drop it, saving a level of indentation and increasing readability. Signed-off-by: Maxime Chevallier Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260324180826.524327-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 5f70b0aa08ada1004259902dbee3b401ac2f7dcb Author: Yohei Kojima Date: Wed Mar 25 02:20:28 2026 +0900 selftests: net: Remove unnecessary backslashes in fq_band_pktlimit.sh Address "grep: warning: stray \ before white space" warning from GNU grep 3.12. This warns the misplaced backslashes before whitespaces (e.g. \\' ' or '\ ') which leads to unspecified behavior [1]. We can just remove the backslashes before whitespaces as POSIX says: Enclosing characters in single-quotes ('') shall preserve the literal value of each character within the single-quotes. and bourne-compatible shells behave so. [1]: https://lists.gnu.org/r/bug-gnulib/2022-05/msg00057.html Signed-off-by: Yohei Kojima Reviewed-by: Simon Horman Link: https://patch.msgid.link/dd0bbd48cdf468da56ec34fd61cecd4d2111d7ba.1774372510.git.yk@y-koj.net Signed-off-by: Jakub Kicinski commit e1877cf6231152ff4686bd9900a6a88ffdd90f84 Author: Jeremy Kerr Date: Tue Mar 24 15:19:56 2026 +0800 net: mctp: avoid copy in fragmentation loop for near-MTU messages Currently, we incorrectly send messages that are within 4 bytes (a struct mctp_hdr) smaller than the MTU through mctp_do_fragment_route(). This has no effect on the actual fragmentation, as we will still send as one packet, but unnecessarily copies the original skb into a new single-fragment skb. Instead of having the MTU comparisons in both mctp_local_output() and mctp_do_fragment_route(), feed all local messages through the latter, and add the single-packet optimisation there. This means we can coalesce the routing path of mctp_local_output, so our out_release path is now solely for errors, so rename the label accordingly. Include a check in the route tests for the single-packet case too. Reported-by: yuanzhaoming Closes: https://github.com/openbmc/linux/commit/269936db5eb3962fe290b1dc4dbf1859cd5a04dd#r175836230 Signed-off-by: Jeremy Kerr Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260324-dev-mtu-copy-v1-1-7af6bd7027d3@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit 2b8e147c006ef2b40863be1911e29dd5731c205d Merge: ed8edcd47529d9 2d047673d374e1 Author: Jakub Kicinski Date: Thu Mar 26 18:45:32 2026 -0700 Merge branch 'add-support-for-per-route-seg6-tunsrc' Justin Iurman says: ==================== Add support for per-route seg6 tunsrc This series adds support for the new per-route seg6 "tunsrc" parameter. Selftests are extended to make sure it works as expected. Example with the iproute2-next companion patch: ip -6 r a 2001:db8:1::/64 encap seg6 mode encap tunsrc 2001:db8:ab:: segs 2001:db8:42::1,2001:db8:ffff::2 dev eth0 ==================== Link: https://patch.msgid.link/20260324091434.359341-1-justin.iurman@6wind.com Signed-off-by: Jakub Kicinski commit 2d047673d374e1d808b345fddcbebe4f2a86d2f2 Author: Justin Iurman Date: Tue Mar 24 10:14:34 2026 +0100 selftests: add check for seg6 tunsrc Extend srv6_hencap_red_l3vpn_test.sh to include checks for the new "tunsrc" feature. If there is no support for tunsrc, it silently falls back to the encap config without tunsrc. Cc: Shuah Khan Signed-off-by: Justin Iurman Reviewed-by: Andrea Mayer Link: https://patch.msgid.link/20260324091434.359341-3-justin.iurman@6wind.com Signed-off-by: Jakub Kicinski commit 78723a62b969af404fde2468bb9782519d5f8ba7 Author: Justin Iurman Date: Tue Mar 24 10:14:33 2026 +0100 seg6: add per-route tunnel source address Add SEG6_IPTUNNEL_SRC in the uapi for users to configure a specific tunnel source address. Make seg6_iptunnel handle the new attribute correctly. It has priority over the configured per-netns tunnel source address, if any. Cc: David Ahern Signed-off-by: Justin Iurman Reviewed-by: Andrea Mayer Link: https://patch.msgid.link/20260324091434.359341-2-justin.iurman@6wind.com Signed-off-by: Jakub Kicinski commit ed8edcd47529d9ad6558ca2c00dccf21fc0abc08 Author: Ryohei Kinugawa Date: Tue Mar 24 14:34:10 2026 +0900 docs/mlx5: Fix typo subfuction Fix two typos: - 'Subfunctons' -> 'Subfunctions' - 'subfuction' -> 'subfunction' Reviewed-by: Joe Damato Signed-off-by: Ryohei Kinugawa Reviewed-by: Tariq Toukan Acked-by: Randy Dunlap Link: https://patch.msgid.link/20260324053416.70166-1-ryohei.kinugawa@gmail.com Signed-off-by: Jakub Kicinski commit b83c28328fee90ba8c8380f0637846b316694edb Author: Russell King (Oracle) Date: Tue Mar 24 10:46:52 2026 +0000 net: phylink: use phylink_expects_phy() in phylink_fwnode_phy_connect() The tests in phylink_expects_phy() and phylink_fwnode_phy_connect() are identical (by intention). Use phylink_expects_phy() to decide whether to ignore a call to phylink_fwnode_phy_connect(). Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1w4zHg-0000000DmC4-2oyb@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3b58247933cc8d3aaa5f47581d33f0c011870127 Merge: dbd94b9831bc52 9bd1af853750af Author: Jakub Kicinski Date: Thu Mar 26 18:19:44 2026 -0700 Merge branch 'net-stmmac-dwmac-socfpga-cleanup-fix_mac_speed' Maxime Chevallier says: ==================== net: stmmac: dwmac-socfpga: Cleanup .fix_mac_speed This small series does a bit of cleanup in the dwmad-socfpga glue driver, especially around the .fix_mac_speed() operation. It's mostly about re-using existing helpers from the glue driver, as well as reorganizing the code to make the local private structures a little bit smaller. No functionnal changes are intended, this was tested on cyclone V. ==================== Link: https://patch.msgid.link/20260324092102.687082-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 9bd1af853750af99f7038af239bc7d8a525fb720 Author: Maxime Chevallier Date: Tue Mar 24 10:21:00 2026 +0100 net: stmmac: dwmac-sofcpga: Drop the struct device reference We keep a reference to our the struct device in the socfpga_dwmac priv structure, but now it's only ever used to produce logs in the .set_phy_mode() ops, that are specific to this driver. When we call that ops, we always have a ref to the struct device around, so let's pass it to .set_phy_mode(). We can now discard that reference from struct socfpga_dwmac. Signed-off-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260324092102.687082-6-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit adf1536f79a5699b2fbece74d175af43320ec404 Author: Maxime Chevallier Date: Tue Mar 24 10:20:59 2026 +0100 net: stmmac: dwmac-socfpga: get the phy_mode with the dedicated helper We enable/disable the sgmii_adapter in the .fix_mac_speed() ops based on the phy_mode used in the plat_data. We currently get it with : socfpga_dwmac ->dev ->drv_data ->netdev ->priv ->stmmac_priv ->plat ->phy_interface where we can get it with : socfpga_dwmac ->plat_data ->phy_interface (done by socfpga_get_plat_phymode) Use that helper here. Note that we are also being passed a phy_interface_t from the .fix_mac_speed() callback, provided by phylink. We can handle that in the future when dynamic interface selection is supported. We'd need to guarantee that we have a Lynx PCS to handle it. Signed-off-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260324092102.687082-5-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 9b04ecdfb8768a754db4bdb4a9073d0a650c0b53 Author: Maxime Chevallier Date: Tue Mar 24 10:20:58 2026 +0100 net: stmmac: dwmac-socfpga: Use the correct type for interface modes The internal helper socfpga_get_plat_phymode() returns an int where we actually return a PHY_INTERFACE_MODE_xxx, use the correct type for this. Signed-off-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260324092102.687082-4-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit a7be7cc12442479f44e3c17c6070cff03f6f8f02 Author: Maxime Chevallier Date: Tue Mar 24 10:20:57 2026 +0100 net: stmmac: dwmac-socfpga: Use the socfpga_sgmii_config() helper Use the existing socfpga_sgmii_config() helper in socfpga_dwmac_fix_mac_speed(), instead of re-coding the register access. Signed-off-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260324092102.687082-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 845a0441111812a540c928e3264602ecf1c17df9 Author: Maxime Chevallier Date: Tue Mar 24 10:20:56 2026 +0100 net: stmmac: dwmac-socfpga: Move internal helpers This is preparatory work to allow reusing the SGMII configuration helper and the wrapper to get the interface in the fix_mac_speed() callback. Signed-off-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260324092102.687082-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit dbd94b9831bc52a1efb7ff3de841ffc3457428ce Merge: 7d89349fb8849a 7dd6f81f4ef801 Author: Jakub Kicinski Date: Thu Mar 26 18:17:14 2026 -0700 Merge tag 'wireless-next-2026-03-26' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== A fairly big set of changes all over, notably with: - cfg80211: new APIs for NAN (Neighbor Aware Networking, aka Wi-Fi Aware) so less work must be in firmware - mt76: - mt7996/mt7925 MLO fixes/improvements - mt7996 NPU support (HW eth/wifi traffic offload) - iwlwifi: UNII-9 and continuing UHR work * tag 'wireless-next-2026-03-26' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (230 commits) wifi: mac80211: ignore reserved bits in reconfiguration status wifi: cfg80211: allow protected action frame TX for NAN wifi: ieee80211: Add some missing NAN definitions wifi: nl80211: Add a notification to notify NAN channel evacuation wifi: nl80211: add NL80211_CMD_NAN_ULW_UPDATE notification wifi: nl80211: allow reporting spurious NAN Data frames wifi: cfg80211: allow ToDS=0/FromDS=0 data frames on NAN data interfaces wifi: nl80211: define an API for configuring the NAN peer's schedule wifi: nl80211: add support for NAN stations wifi: cfg80211: separately store HT, VHT and HE capabilities for NAN wifi: cfg80211: add support for NAN data interface wifi: cfg80211: make sure NAN chandefs are valid wifi: cfg80211: Add an API to configure local NAN schedule wifi: mac80211: cleanup error path of ieee80211_do_open wifi: mac80211: extract channel logic from link logic wifi: iwlwifi: mld: set RX_FLAG_RADIOTAP_TLV_AT_END generically wifi: iwlwifi: reduce the number of prints upon firmware crash wifi: iwlwifi: fix the description of SESSION_PROTECTION_CMD wifi: iwlwifi: mld: introduce iwl_mld_vif_fw_id_valid wifi: iwlwifi: mld: block EMLSR during TDLS connections ... ==================== Link: https://patch.msgid.link/20260326152021.305959-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 7d89349fb8849a6147cc7310fcf9059c1504f50f Merge: 9ebcf66cd6bcaa 4d7c557f58efda Author: Jakub Kicinski Date: Thu Mar 26 18:15:39 2026 -0700 Merge branch 'add-support-for-nuvoton-ma35d1-gmac' Joey Lu says: ==================== Add support for Nuvoton MA35D1 GMAC This patch series is submitted to add GMAC support for Nuvoton MA35D1 SoC platform. This work involves implementing a GMAC driver glue layer based on Synopsys DWMAC driver framework to leverage MA35D1's dual GMAC interface capabilities. Overview: 1. Added a GMAC driver glue layer for MA35D1 SoC, providing support for the platform's two GMAC interfaces. 2. Added device tree settings, with specific configurations for our development boards: a. SOM board: Configured for two RGMII interfaces. b. IoT board: Configured with one RGMII and one RMII interface. 3. Added dt-bindings for the GMAC interfaces. ==================== Link: https://patch.msgid.link/20260323101756.81849-1-a0987203069@gmail.com Signed-off-by: Jakub Kicinski commit 4d7c557f58efda70ecf11e80cebf8fbbc9e08282 Author: Joey Lu Date: Mon Mar 23 18:17:56 2026 +0800 net: stmmac: dwmac-nuvoton: Add dwmac glue for Nuvoton MA35 family Add support for Gigabit Ethernet on Nuvoton MA35 series using dwmac driver. Reviewed-by: Andrew Lunn Signed-off-by: Joey Lu Link: https://patch.msgid.link/20260323101756.81849-4-a0987203069@gmail.com Signed-off-by: Jakub Kicinski commit 8454478ef9abd4b4acb657160d9587a94cdae180 Author: Joey Lu Date: Mon Mar 23 18:17:54 2026 +0800 dt-bindings: net: nuvoton: Add schema for Nuvoton MA35 family GMAC Create initial schema for Nuvoton MA35 family Gigabit MAC. Reviewed-by: Rob Herring (Arm) Signed-off-by: Joey Lu Link: https://patch.msgid.link/20260323101756.81849-2-a0987203069@gmail.com Signed-off-by: Jakub Kicinski commit 72b585da5587f79cb72c89e8a88ae3d2bcbbceb3 Merge: 3f4207256ef421 3d4939c0ec011a Author: Dave Airlie Date: Fri Mar 27 11:01:44 2026 +1000 Merge tag 'drm-xe-next-2026-03-25' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Hi Dave and Sima, Here goes our third, perhaps, final drm-xe-next PR towards 7.1. In the big things we have: - THP support in drm_pagemap - xe_vm_get_property_ioctl Thanks, Matt UAPI Changes: - Implement xe_vm_get_property_ioctl (Jonathan) Cross-subsystem Changes: - Enable THP support in drm_pagemap (Francois, Brost) Core Changes: - Improve VF FLR synchronization for Xe VFIO (Piotr) Driver Changes: - Fix confusion with locals on context creation (Tomasz, Fixes) - Add new SVM copy GT stats per size (Francois) - always keep track of remap prev/next (Auld, Fixes) - AuxCCS handling and render compression modifiers (Tvrtko) - Implement recent spec updates to Wa_16025250150 (Roper) - xe3p_lpg: L2 flush optimization (Tejas) - vf: Improve getting clean NULL context (Wajdeczko) - pf: Fix use-after-free in migration restore (Winiarski. Fixes) - Fix format specifier for printing pointer differences (Nathan Chancellor, Fixes) - Extend Wa_14026781792 for xe3lpg (Niton) - xe3p_lpg: Add Wa_16029437861 (Varun) - Fix spelling mistakes and comment style in ttm_resource.c (Varun) - Merge drm/drm-next into drm-xe-next (Thomas) - Fix missing runtime PM reference in ccs_mode_store (Sanjay, Fixes) - Fix uninitialized new_ts when capturing context timestamp (Umesh) - Allow reading after disabling OA stream (Ashutosh) - Page Reclamation Fixes (Brian Nguyen, Fixes) - Include running dword offset in default_lrc dumps (Roper) - Assert/Deassert I2C IRQ (Raag) - Fixup reset, wedge, unload corner cases (Zhanjun, Brost) - Fail immediately on GuC load error (Daniele) - Fix kernel-doc for DRM_XE_VM_BIND_FLAG_DECOMPRESS (Niton, Fixes) - Drop redundant entries for Wa_16021867713 & Wa_14019449301 (Roper, Fixes) Signed-off-by: Dave Airlie From: Matthew Brost Link: https://patch.msgid.link/acS5xmWC3ivPTmyV@gsse-cloud1.jf.intel.com commit c6f99d0ecc900ceea27eeaba6c431ae97e7b5599 Author: Tejun Heo Date: Thu Mar 26 14:45:37 2026 -1000 Revert "selftests/sched_ext: Add tests for SCX_ENQ_IMMED and scx_bpf_dsq_reenq()" This reverts commit c50dcf533149. The tests are superficial, likely AI-generated slop, and flaky. They don't add actual value and just churn the selftests. Signed-off-by: Tejun Heo commit 1f51b42bf9784dd012b8f0c135140b047eb5c6bf Author: Tejun Heo Date: Thu Mar 26 14:32:07 2026 -1000 Revert "docs: Raise minimum pahole version to 1.26 for KF_IMPLICIT_ARGS kfuncs" This reverts commit 9edd04c4189e047d4b4f6efd1255e2a32cb167b8. The doc-only change is insufficient. The actual fix requires bumping the minimum pahole version to 1.27 with proper Kconfig and Makefile.btf changes, and should be routed through the BPF tree. Link: https://lore.kernel.org/all/e0ca748d-3204-4160-b37d-0f76cbac8c6c@linux.dev Signed-off-by: Tejun Heo commit 3f4207256ef421db03fd583e1954ab5fa6cf9919 Merge: 13c072b8e91a5c 68178644c35fca Author: Dave Airlie Date: Fri Mar 27 09:30:34 2026 +1000 Merge tag 'amd-drm-next-7.1-2026-03-25' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-7.1-2026-03-25: amdgpu: - DSC fix - Module parameter parsing fix - PASID reuse fix - drm_edid leak fix - SMU 13.x fixes - SMU 14.x fix - Fence fix in amdgpu_amdkfd_submit_ib() - LVDS fixes - GPU page fault fix for non-4K pages - Misc cleanups - UserQ fixes - SMU 15.0.8 support - RAS updates - Devcoredump fixes - GFX queue priority fixes - DPIA fixes - DCN 4.2 updates - Add debugfs interface for pcie64 registers - SMU 15.x fixes - VCN reset fixes - Documentation fixes amdkfd: - Ordering fix in kfd_ioctl_create_process() Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260325175012.4185721-1-alexander.deucher@amd.com commit 59717f260183712af5ce537fee71687e3ba010a5 Author: Kartik Rajput Date: Tue Mar 24 11:28:43 2026 +0530 i2c: tegra: Add support for Tegra410 Add support for the Tegra410 SoC, which has 4 I2C controllers. The controllers are feature-equivalent to Tegra264; only the register offsets differ. Signed-off-by: Kartik Rajput Reviewed-by: Jon Hunter Tested-by: Jon Hunter Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260324055843.549808-4-kkartik@nvidia.com commit 0c0e440b0c93785847d60e89198869c969fb56ec Author: Kartik Rajput Date: Tue Mar 24 11:28:42 2026 +0530 i2c: tegra: Add logic to support different register offsets Tegra410 use different offsets for existing I2C registers, update the logic to use appropriate offsets per SoC. As the register offsets are now defined in the SoC-specific tegra_i2c_regs structures, the tegra_i2c_reg_addr() function is no longer needed to translate register offsets and has been removed. Signed-off-by: Kartik Rajput Reviewed-by: Jon Hunter Tested-by: Jon Hunter Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260324055843.549808-3-kkartik@nvidia.com commit 4eeb19aaff5580da0b2d0c1897e1dbd016755499 Author: Kartik Rajput Date: Tue Mar 24 11:28:41 2026 +0530 i2c: tegra: Introduce tegra_i2c_variant to identify DVC and VI Replace the per-instance DVC/VI boolean flags with a tegra_i2c_variant enum and move the variant field into tegra_i2c_hw_feature so it is populated via SoC match data. Add dedicated SoC data entries for the "nvidia,tegra20-i2c-dvc" and "nvidia,tegra210-i2c-vi" compatibles and drop compatible-string checks from tegra_i2c_parse_dt. Suggested-by: Jon Hunter Signed-off-by: Kartik Rajput Reviewed-by: Jon Hunter Tested-by: Jon Hunter Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260324055843.549808-2-kkartik@nvidia.com commit 4f1e5c967231fefcd04290396724d519961ecffb Author: Yixun Lan Date: Wed Mar 25 09:49:24 2026 +0000 dt-bindings: i2c: spacemit: k3: Add compatible Add a compatible string for the I2C controller found in SpacemiT K3 SoC which use same I2C IP as K1, so make it fallback to K1 compatible. Signed-off-by: Yixun Lan Acked-by: Conor Dooley Reviewed-by: Troy Mitchell Link: https://lore.kernel.org/r/20260325-02-k3-i2c-v1-1-78f29c83d9ac@kernel.org Signed-off-by: Andi Shyti commit e397dd81bc45a991c43a97e010aa3fbe72ac833b Author: Stephen Brennan Date: Fri Mar 20 16:45:53 2026 -0700 perf report: Add comm_nodigit sort key The "comm" column allows grouping events by the process command. It is intended to group like programs, despite having different PIDs. But some workloads may adjust their own command, so that a unique identifier (e.g. a PID or some other numeric value) is part of the command name. This destroys the utility of "comm", forcing perf to place each unique process name into its own bucket, which can contribute to a combinatorial explosion of memory use in perf report. Create a less strict version of this column, which ignores digits when comparing command names. Commands whose names are the same (ignoring digits) are sorted into the same histogram buckets, and displayed with the placeholder value "" in the place of digits. For example, hypothetical command names "kworker/1" "kworker/2" "kworker/3" would sort into the same bucket and be represented as "kworker/". Committer testing: $ perf report -s comm,comm_nodigit | grep -F "" 0.01% CPU 6/TCG CPU /TCG 0.01% kworker/53:2-mm kworker/:-mm 0.01% migration/24 migration/ 0.01% kworker/24:1-ev kworker/:-ev 0.01% llvmpipe-8 llvmpipe- Signed-off-by: Stephen Brennan Signed-off-by: Namhyung Kim commit 2b31e86387e60b3689339f0f0fbb4d3623d9d494 Author: Bart Van Assche Date: Thu Mar 26 14:40:54 2026 -0700 drbd: Balance RCU calls in drbd_adm_dump_devices() Make drbd_adm_dump_devices() call rcu_read_lock() before rcu_read_unlock() is called. This has been detected by the Clang thread-safety analyzer. Tested-by: Christoph Böhmwalder Reviewed-by: Christoph Hellwig Cc: Andreas Gruenbacher Fixes: a55bbd375d18 ("drbd: Backport the "status" command") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260326214054.284593-1-bvanassche@acm.org Signed-off-by: Jens Axboe commit 44311ae84ad9177fb311aee856027861c22f17b2 Author: Ian Rogers Date: Thu Mar 19 16:33:49 2026 -0700 perf stat: Fix opt->value type for parse_cache_level Commit f5803651b4a4 ("perf stat: Choose the most disaggregate command line option") changed aggregation option handling for `perf stat` but not `perf stat report` leading to parse_cache_level being passed a struct in the `perf stat` case but erroneously an aggr_mode enum value for `perf stat report`. Change the `perf stat report` aggregation handling to use the same opt_aggr_mode as `perf stat`. Also, just pass the boolean for consistency with other boolean argument handling. Fixes: f5803651b4a4 ("perf stat: Choose the most disaggregate command line option") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit cfaade34b52aa1ec553044255702c4b31b57c005 Author: Ian Rogers Date: Thu Mar 19 16:33:48 2026 -0700 perf lock: Fix option value type in parse_max_stack The value is a void* and the address of an int, max_stack_depth, is set up in the perf lock options. The parse_max_stack function treats the int* as a long*, make this more correct by declaring the value to be an int*. Fixes: 0a277b622670 ("perf lock contention: Check --max-stack option") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 46a009cf0d85cba05d4667214db18a4c20dd6b8e Author: Thomas Richter Date: Thu Mar 19 09:47:54 2026 +0100 perf record: Add support for arch_sdt_arg_parse_op() on s390 commit e5e66adfe45a6 ("perf regs: Remove __weak attributive arch_sdt_arg_parse_op() function") removes arch_sdt_arg_parse_op() functions and reveals missing s390 support. The following warning is printed: Unknown ELF machine 22, standard arguments parse will be skipped. ELF machine 22 is the EM_S390 host. This happens with command # ./perf record -v -- stress-ng -t 1s --matrix 0 when the event is not specified. Add s390 specific __perf_sdt_arg_parse_op_s390() function to support -architecture calls to arch_sdt_arg_parse_op() for s390. The warning disappears. Signed-off-by: Thomas Richter Reviewed-by: Ian Rogers Tested-by: Jan Polensky Cc: Dapeng Mi Signed-off-by: Namhyung Kim commit 4fbeef21f5387234111b5d52924e77757626faa5 Author: Bradford Love Date: Thu Mar 26 12:10:23 2026 -0500 Revert "media: cx231xx: add USB ID 2040:8360 for Hauppauge WinTV-HVR-935" This reverts commit bb2a3912549d3b5cef5ed27200402fe8f6fb0694. The USB ID 2040:8360 was reported as a new revision of Hauppauge HVR-935 and requested to be added to the cx231xx driver. The issue is current generation of Hauppauge 9x5 devices including 935, 955, and 975 have moved to em2828x usb bridge. Support for the em2828x usb bridge and USB ID's for the new devices has been submitted. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 5c980ab238c8a9e2b24221603f11eadc98a7f45e Author: Leo Yan Date: Tue Mar 17 18:58:00 2026 +0000 tools build: Correct link flags for libopenssl The perf static build reports that the BPF skeleton is disabled due to the missing libopenssl feature. Use PKG_CONFIG to determine the link flags for libopenssl. Add "--static" to the PKG_CONFIG command for static linking. Fixes: 7678523109d1 ("tools/build: Add a feature test for libopenssl") Signed-off-by: Leo Yan Signed-off-by: Namhyung Kim commit b6df77f40c83d02fad6e58f84391417cb7d8f7a5 Author: Shuicheng Lin Date: Mon Mar 16 16:04:45 2026 +0000 drm/xe: Fix mismatched include guards in header files Fix include guard macros that don't match their respective file names: - xe_gt_idle_types.h: _XE_GT_IDLE_SYSFS_TYPES_H_ -> _XE_GT_IDLE_TYPES_H_ - xe_guc_exec_queue_types.h: _XE_GUC_ENGINE_TYPES_H_ -> _XE_GUC_EXEC_QUEUE_TYPES_H_ - xe_heci_gsc.h: __XE_HECI_GSC_DEV_H__ -> _XE_HECI_GSC_H_ - xe_hw_engine_class_sysfs.h: _XE_ENGINE_CLASS_SYSFS_H_ -> _XE_HW_ENGINE_CLASS_SYSFS_H_ - xe_late_bind_fw_types.h: _XE_LATE_BIND_TYPES_H_ -> _XE_LATE_BIND_FW_TYPES_H_ - xe_platform_types.h: _XE_PLATFORM_INFO_TYPES_H_ -> _XE_PLATFORM_TYPES_H_ - xe_tile_printk.h: _xe_tile_printk_H_ -> _XE_TILE_PRINTK_H_ These guards appear to be leftovers from file renames or copy-paste errors. Correcting them to follow the standard convention of matching the file name prevents potential include guard collisions. No functional change expected. Signed-off-by: Shuicheng Lin Reviewed-by: Nitin Gote Link: https://patch.msgid.link/20260316160451.1688247-2-shuicheng.lin@intel.com commit f72e77c33e4b5657af35125e75bab249256030f3 Author: Douglas Anderson Date: Tue Mar 17 09:01:20 2026 -0700 device property: Make modifications of fwnode "flags" thread safe In various places in the kernel, we modify the fwnode "flags" member by doing either: fwnode->flags |= SOME_FLAG; fwnode->flags &= ~SOME_FLAG; This type of modification is not thread-safe. If two threads are both mucking with the flags at the same time then one can clobber the other. While flags are often modified while under the "fwnode_link_lock", this is not universally true. Create some accessor functions for setting, clearing, and testing the FWNODE flags and move all users to these accessor functions. New accessor functions use set_bit() and clear_bit(), which are thread-safe. Cc: stable@vger.kernel.org Fixes: c2c724c868c4 ("driver core: Add fw_devlink_parse_fwtree()") Reviewed-by: Andy Shevchenko Acked-by: Mark Brown Reviewed-by: Wolfram Sang Signed-off-by: Douglas Anderson Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Saravana Kannan Link: https://patch.msgid.link/20260317090112.v2.1.I0a4d03104ecd5103df3d76f66c8d21b1d15a2e38@changeid [ Fix fwnode_clear_flag() argument alignment, restore dropped blank line in fwnode_dev_initialized(), and remove unnecessary parentheses around fwnode_test_flag() calls. - Danilo ] Signed-off-by: Danilo Krummrich commit 01504da43e67f823fbd22f4ec9e4469236a34b5c Merge: 400ff899c336c2 5e1942eb1c010a Author: Andrii Nakryiko Date: Thu Mar 26 13:53:57 2026 -0700 Merge branch 'add-btf-layout-to-btf' Alan Maguire says: ==================== Add BTF layout to BTF Update struct btf_header to add a new "layout" section containing a description of how to parse the BTF kinds known about at BTF encoding time. This provides the opportunity for tools that might not know all of these kinds - as is the case when older tools run on more newly-generated BTF - to still parse the BTF provided, even if it cannot all be used. The ideas here were discussed at [1], with further discussion at [2]. Patches for pahole will enable the layout addition during BTF generation are at [3], but even absent these the addition of the layout feature in the final patch in this series should not break anything since such unknown features are simply ignored during pahole BTF generation. Separately tested sanitization of BTF location info with separate small series which simulates feature absence to support testing of features for older kernels; will follow up with that shortly. Changes since v15 [4]: - Fixed endian issues for layout section by swapping flags fields where needed (sashiko.dev, patch 2) - Fixed string size issue with swapped endian case, use btf->magic for comparison to determine endian mismatch (bpf review bot, sashiko.dev, patch 6) Changes since v14 [5]: - Fix potential overflow for swapped endian case (BPF review bot, patch 2) - Add global: keyword to libbpf.map (sashiko.dev, patch 4) - Fix endian issues in sanitization; we use the endian safe btf->hdr and check for endian mismatch between it and raw original BTF header to inform how we write the change str_off. Also fix potential truncation issues due to not including hdr->type_off (sashiko.dev, patch 6) - Fix issues with selftests raw BTF file interactions (sashiko.dev, patch 8) - Drop feature test test since it will be covered by another series Changes since v13: [6]: - add feature check/sanitization of BTF with layout info (Andrii, patch 6) - added feature check test for layout support (patch 9) Changes since v12: [7]: - add logging of layout off/len to kernel header logging (review bot, patch 6) - add mode to open() in selftest (review bot, patch 7) Changes since v11 [8]: - Revert unneeded changes to btf__new_empty() (Eduard, review bot, patch 4) - Reorder btf_parse_layout_sec() checks to ensure min size check occurs before multiple check (review bot, patch 6) Changes since v10 [9]: - deal with read overflow with small header (review bot, patch 2) - validate layout length is a multiple of sizeof(struct btf_layout) (review bot, patch 6) - fix comment style (Alexei, patches 4,7) - remove bpftool BTF metadata subcommands for now (Alexei) Changes since v9: [10]: - fix memcpy header size overrun (review bot, patch 2) - return size computation directly (Andrii, patch 333) - revert to original unknown kind logging (Alexei/review bot, patch 6) - gap-checking logic can be simplified now that we have 4-byte aligned types and layout together (patch 6) - fix naming of layout offset, unconditionally emit a layouts array in json (Quentin, review bot, patch 8) - fix metadata output in man page to include flags (review bot, patch 9) Changes since v8: [11]: - updated name from "kind_layout" to "layout" (Andrii) - moved layout info to inbetween types and strings since both types and layout info align on 4 bytes (Andrii) - use embedded btf_header (Eduard) - when consulting layout, fall back to base BTF if none found in split BTF; this will allow us to only encode layout info in vmlinux rather than repeating it for each module. Changes since v7: [12]: - Fixed comment style in UAPI headers (Mykyta, patch 1) - Simplify calcuation of header size using min() (Mykyta, patch 2) - simplify computation of bounds for kind (Mykyta, patch 3) - Added utility functions for updating type, string offsets when data is added; this simplifies the code and encapsulates such updates more clearly (patch 2) Changes since v6: [13]: - BPF review bot caught some memory leaks around freeing of kind layout; more importantly, it noted that we were breaking with the contiguous BTF representation for btf_new_empty_opts(). Doing so meant that freeing kind_layout could not be predicated on having btf->modifiable set, so adpoted the contiguous raw data layout for BTF to be consistent with type/string storage (patches 2,4) - Moved checks for kind overflow prior to referencing kinds to avoid any risk of overrun (patches 3, 8) - Tightened up kind layout header offset/len header validation to catch invalid combinations early in btf_parse_hdr() (patch 2) - Fixed selftest to verify calloc success (patch 7) Changes since v5: [14]: - removed flags field from kind layout; it is not really workable since we would have to define semantics of all possible future flags today to be usable. Instead stick to parsing only, which means each kind just needs the length of the singular and vlen-specified objects (Alexei) - added documentation for bpftool BTF metadata dump (Quentin, patch 9) Changes since v4: [15]: - removed CRC generation since it is not needed to handle modules built at different time than kernel; distilled base BTF supports this now - fixed up bpftool display of empty kind names, comment/documentation indentation (Quentin, patches 8, 9) Changes since v3 [16]: - fixed mismerge issues with kbuild changes for BTF generation (patches 9, 14) - fixed a few small issues in libbpf with kind layout representation (patches 2, 4) Changes since v2 [17]: - drop "optional" kind flag (Andrii, patch 1) - allocate "struct btf_header" for struct btf to ensure we can always access new fields (Andrii, patch 2) - use an internal BTF kind array in btf.c to simplify kind encoding (Andrii, patch 2) - drop use of kind layout information for in-kernel parsing, since the kernel needs to be strict in what it accepts (Andrii, patch 6) - added CRC verification for BTF objects and for matching with base object (Alexei, patches 7,8) - fixed bpftool json output (Quentin, patch 10) - added standalone module BTF support, tests (patches 13-17) Changes since RFC - Terminology change from meta -> kind_layout (Alexei and Andrii) - Simplify representation, removing meta header and just having kind layout section (Alexei) - Fixed bpftool to have JSON support, support prefix match, documented changes (Quentin) - Separated metadata opts into add_kind_layout and add_crc - Added additional positive/negative tests to cover basic unknown kind, one with an info_sz object following it and one with N elem_sz elements following it. - Updated pahole-flags to use help output rather than version to see if features are present [1] https://lore.kernel.org/bpf/CAEf4BzYjWHRdNNw4B=eOXOs_ONrDwrgX4bn=Nuc1g8JPFC34MA@mail.gmail.com/ [2] https://lore.kernel.org/bpf/20230531201936.1992188-1-alan.maguire@oracle.com/ [3] https://lore.kernel.org/dwarves/20260226085240.1908874-1-alan.maguire@oracle.com/ [4] https://lore.kernel.org/bpf/20260324174450.1570809-1-alan.maguire@oracle.com/ [5] https://lore.kernel.org/bpf/20260318132927.1142388-1-alan.maguire@oracle.com/ [6] https://lore.kernel.org/bpf/20260306113630.1281527-1-alan.maguire@oracle.com/ [7] https://lore.kernel.org/bpf/20260303182003.117483-1-alan.maguire@oracle.com/ [8] https://lore.kernel.org/bpf/20260302114059.3697879-1-alan.maguire@oracle.com/ [9] https://lore.kernel.org/bpf/20260227100426.2585191-1-alan.maguire@oracle.com/ [10] https://lore.kernel.org/bpf/20260226085624.1909682-1-alan.maguire@oracle.com/ [11] https://lore.kernel.org/bpf/20251215091730.1188790-1-alan.maguire@oracle.com/ [12] https://lore.kernel.org/dwarves/20251211164646.1219122-1-alan.maguire@oracle.com/ [13] https://lore.kernel.org/bpf/20251210203243.814529-1-alan.maguire@oracle.com/ [14] https://lore.kernel.org/bpf/20250528095743.791722-1-alan.maguire@oracle.com/ [15] https://lore.kernel.org/bpf/20231112124834.388735-1-alan.maguire@oracle.com/ [16] https://lore.kernel.org/bpf/20231110110304.63910-1-alan.maguire@oracle.com/ [17] https://lore.kernel.org/bpf/20230616171728.530116-1-alan.maguire@oracle.com/ ==================== Link: https://patch.msgid.link/20260326145444.2076244-1-alan.maguire@oracle.com Signed-off-by: Andrii Nakryiko commit 5e1942eb1c010a13e011c88640b67f3727dda0b3 Author: Alan Maguire Date: Thu Mar 26 14:54:44 2026 +0000 kbuild, bpf: Specify "layout" optional feature The "layout" feature will add metadata about BTF kinds to the generated BTF; its absence in pahole will not trigger an error so it is safe to add unconditionally as it will simply be ignored if pahole does not support it. Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260326145444.2076244-10-alan.maguire@oracle.com commit 0467491617cb35157d6905745331e6338213dba5 Author: Alan Maguire Date: Thu Mar 26 14:54:43 2026 +0000 selftests/bpf: Test kind encoding/decoding verify btf__new_empty_opts() adds layouts for all kinds supported, and after adding kind-related types for an unknown kind, ensure that parsing uses this info when that kind is encountered rather than giving up. Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260326145444.2076244-9-alan.maguire@oracle.com commit 626e88c070eef03412f3e2ce109013e797657784 Author: Alan Maguire Date: Thu Mar 26 14:54:42 2026 +0000 btf: Support kernel parsing of BTF with layout info Validate layout if present, but because the kernel must be strict in what it accepts, reject BTF with unsupported kinds, even if they are in the layout information. Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260326145444.2076244-8-alan.maguire@oracle.com commit 081677d03d8b8aea528cd8f14f4767c641457e2d Author: Alan Maguire Date: Thu Mar 26 14:54:41 2026 +0000 libbpf: Support sanitization of BTF layout for older kernels Add a FEAT_BTF_LAYOUT feature check which checks if the kernel supports BTF layout information. Also sanitize BTF if it contains layout data but the kernel does not support it. The sanitization requires rewriting raw BTF data to update the header and eliminate the layout section (since it lies between the types and strings), so refactor sanitization to do the raw BTF retrieval and creation of updated BTF, returning that new BTF on success. Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260326145444.2076244-7-alan.maguire@oracle.com commit 6ad89285996add14b5d69cb302980bff9032ba2c Author: Alan Maguire Date: Thu Mar 26 14:54:40 2026 +0000 libbpf: BTF validation can use layout for unknown kinds BTF parsing can use layout to navigate unknown kinds, so btf_validate_type() should take layout information into account to avoid failure when an unrecognized kind is met. Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260326145444.2076244-6-alan.maguire@oracle.com commit d686d92c40803f255af162601d0db38db3efa7fb Author: Alan Maguire Date: Thu Mar 26 14:54:39 2026 +0000 libbpf: Add layout encoding support Support encoding of BTF layout data via btf__new_empty_opts(). Current supported opts are base_btf and add_layout. Layout information is maintained in btf.c in the layouts[] array; when BTF is created with the add_layout option it represents the current view of supported BTF kinds. Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260326145444.2076244-5-alan.maguire@oracle.com commit 2ecbe53e0e991ce640478c552e564ff99043a29f Author: Alan Maguire Date: Thu Mar 26 14:54:38 2026 +0000 libbpf: Use layout to compute an unknown kind size This allows BTF parsing to proceed even if we do not know the kind. Fall back to base BTF layout if layout information is not in split BTF. Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260326145444.2076244-4-alan.maguire@oracle.com commit 087f3964f4b3031dbd0a98844b225add8e1e1169 Author: Alan Maguire Date: Thu Mar 26 14:54:37 2026 +0000 libbpf: Support layout section handling in BTF Support reading in layout fixing endian issues on reading; also support writing layout section to raw BTF object. There is not yet an API to populate the layout with meaningful information. As part of this, we need to consider multiple valid BTF header sizes; the original or the layout-extended headers. So to support this, the "struct btf" representation is modified to contain a "struct btf_header" and we copy the valid portion from the raw data to it; this means we can always safely check fields like btf->hdr.layout_len . Note if parsed-in BTF has extra header information beyond sizeof(struct btf_header) - if so we make that BTF ineligible for modification by setting btf->has_hdr_extra . Ensure that we handle endianness issues for BTF layout section, though currently only field that needs this (flags) is unused. Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260326145444.2076244-3-alan.maguire@oracle.com commit 222edc843c158666d2d71793b4b7d0bbb9801883 Author: Alan Maguire Date: Thu Mar 26 14:54:36 2026 +0000 btf: Add BTF kind layout encoding to UAPI BTF kind layouts provide information to parse BTF kinds. By separating parsing BTF from using all the information it provides, we allow BTF to encode new features even if they cannot be used by readers. This will be helpful in particular for cases where older tools are used to parse newer BTF with kinds the older tools do not recognize; the BTF can still be parsed in such cases using kind layout. The intent is to support encoding of kind layouts optionally so that tools like pahole can add this information. For each kind, we record - length of singular element following struct btf_type - length of each of the btf_vlen() elements following - a (currently unused) flags field The ideas here were discussed at [1], [2]; hence Suggested-by: Andrii Nakryiko Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260326145444.2076244-2-alan.maguire@oracle.com [1] https://lore.kernel.org/bpf/CAEf4BzYjWHRdNNw4B=eOXOs_ONrDwrgX4bn=Nuc1g8JPFC34MA@mail.gmail.com/ [2] https://lore.kernel.org/bpf/20230531201936.1992188-1-alan.maguire@oracle.com/ commit d185324efadc1e75acc6be2e4351ecfe8957b3a7 Author: Rodrigo Alencar Date: Thu Mar 26 18:32:17 2026 +0000 iio: amplifiers: ad8366: add support for adrf5702/3 Add chip info structs and device table entries for ADRF5702 and ADRF5703 Digital Step Attenuators. Reviewed-by: Nuno Sá Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit 94e6fb6261a4b13b1ddbe8e5368334903cec40b3 Author: Rodrigo Alencar Date: Thu Mar 26 18:32:16 2026 +0000 dt-bindings: iio: amplifiers: ad8366: add adrf5702/3 support Add compatible entries for ADRF5702 and ADRF5703 Digital Attenuators. ADRF5702 is an 8-bit DSA with a step of 0.125 dB and ADRF5703 is a 7-bit DSA with a step 0.25 dB. Then, each device ends up with its own gain range, hence no fallback compatibles are used. Reviewed-by: Nuno Sá Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit ea70239320394266ec8ccf43ff3a6415e43b8163 Author: Tejun Heo Date: Thu Mar 26 10:07:42 2026 -1000 tools/sched_ext: Remove redundant SCX_ENQ_IMMED compat definition compat.bpf.h defined a fallback SCX_ENQ_IMMED macro using __COMPAT_ENUM_OR_ZERO(). After 6bf36c68b0a2 ("tools/sched_ext: Regenerate autogen enum headers") added SCX_ENQ_IMMED to the autogen headers, including both triggers -Wmacro-redefined warnings. The autogen definition through const volatile __weak already resolves to 0 on older kernels, providing the same backward compatibility. Remove the now-redundant compat fallback. Fixes: 6bf36c68b0a2 ("tools/sched_ext: Regenerate autogen enum headers") Link: https://lore.kernel.org/r/20260326100313.338388-1-zhaomzhao@126.com Reported-by: Zhao Mengmeng Signed-off-by: Tejun Heo commit edfaa81d5da5fbfe3c73fece3ca0417a04cc4ba2 Author: Ilpo Järvinen Date: Tue Mar 24 18:56:24 2026 +0200 resource: Add __resource_contains_unbound() for internal contains checks __find_resource_space() currently uses resource_contains() but for tentative resources that are not yet crafted into the resource tree. As resource_contains() checks that IORESOURCE_UNSET is not set for either of the resources, the caller has to hack around this problem by clearing the IORESOURCE_UNSET flag (essentially lying to resource_contains()). Instead of the hack, introduce __resource_contains_unbound() for cases like this. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Xifer Link: https://patch.msgid.link/20260324165633.4583-2-ilpo.jarvinen@linux.intel.com commit 1ee4716a5a28eaef81ae1f280d983258bee49623 Author: Ilpo Järvinen Date: Fri Mar 13 10:45:50 2026 +0200 PCI: Fix premature removal from realloc_head list during resource assignment reassign_resources_sorted() checks for two things: a) Resource assignment failures for mandatory resources by checking if the resource remains unassigned, which are known to always repeat, and does not attempt to assign them again. b) That resource is not among the ones being processed/assigned at this stage, leading to skip processing such resources in reassign_resources_sorted() as well (resource assignment progresses one PCI hierarchy level at a time). The problem here is that a) is checked before b), but b) also implies the resource is not being assigned yet, making also a) true. As a) only skips resource assignment but still removes the resource from realloc_head, the later stages that would need to process the information in realloc_head cannot obtain the optional size information anymore. This leads to considering only non-optional part for bridge windows deeper in the PCI hierarchy. This problem has been observed during rescan (add_size is not considered while attempting assignment for 0000:e2:00.0 indicating the corresponding entry was removed from realloc_head while processing resource assignments for 0000:e1): pci_bus 0000:e1: scanning bus ... pci 0000:e3:01.0: bridge window [mem 0x800000000-0x1000ffffff 64bit pref] to [bus e4] add_size 60c000000 add_align 800000000 pci 0000:e3:01.0: bridge window [mem 0x00100000-0x000fffff] to [bus e4] add_size 200000 add_align 200000 pci 0000:e3:02.0: disabling bridge window [mem 0x00000000-0x000fffff 64bit pref] to [bus e5] (unused) pci 0000:e2:00.0: bridge window [mem 0x800000000-0x1000ffffff 64bit pref] to [bus e3-e5] add_size 60c000000 add_align 800000000 pci 0000:e2:00.0: bridge window [mem 0x00100000-0x001fffff] to [bus e3-e5] add_size 200000 add_align 200000 pcieport 0000:e1:02.0: bridge window [io size 0x2000]: can't assign; no space pcieport 0000:e1:02.0: bridge window [io size 0x2000]: failed to assign pcieport 0000:e1:02.0: bridge window [io 0x1000-0x2fff]: resource restored pcieport 0000:e1:02.0: bridge window [io 0x1000-0x2fff]: resource restored pcieport 0000:e1:02.0: bridge window [io size 0x2000]: can't assign; no space pcieport 0000:e1:02.0: bridge window [io size 0x2000]: failed to assign pci 0000:e2:00.0: bridge window [mem 0x28f000000000-0x28f800ffffff 64bit pref]: assigned Fixes: 96336ec70264 ("PCI: Perform reset_resource() and build fail list in sync") Reported-by: Peter Nisbet Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Peter Nisbet Link: https://patch.msgid.link/20260313084551.1934-1-ilpo.jarvinen@linux.intel.com commit 8175ffc989d51c383c044a07bb54179a6e93437e Author: Nick Xie Date: Wed Mar 25 15:06:16 2026 +0800 iio: adc: meson-saradc: add support for Meson S4 Add support for the SARADC found on the Amlogic Meson S4 SoC. According to the documentation and current testing, it is fully compatible with the G12A parameter set, so we reuse `meson_sar_adc_g12a_data` for this new compatible string. Although the device tree fallback mechanism could handle the match, a dedicated entry is added to ensure the userspace ABI correctly reports the specific part name ("meson-s4-saradc"). This allows userspace to accurately identify the exact device and maintains consistency across different firmware types where automatic fallback parsing might be problematic. Reviewed-by: Martin Blumenstingl Signed-off-by: Nick Xie Signed-off-by: Jonathan Cameron commit ab8293caad03a6a0cc83c7451ecfbe31f5f257f6 Author: Nick Xie Date: Wed Mar 25 15:06:15 2026 +0800 dt-bindings: iio: adc: amlogic,meson-saradc: add S4 compatible Add the compatible string for the SARADC (Successive Approximation Register ADC) IP block found in the Amlogic Meson S4 SoC. There are no known differences between the SARADC on S4 and the one on G12A. Therefore, it uses "amlogic,meson-g12a-saradc" as a proper specific fallback. Also add a comment indicating that "amlogic,meson-saradc" must not be used for new devices. It's a made up compatible string that does not correspond to a specific hardware generation and is not used to match any driver. For old devices we keep it as it's part of the ABI. Signed-off-by: Nick Xie Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jonathan Cameron commit 7913c1de9c3cbe3018fc29ce25a4d462ac2eaa82 Author: Milan Misic Date: Tue Mar 24 20:36:26 2026 +0100 iio: imu: st_lsm6dsx: Add ACPI ID for SHIFT13mi gyroscope The SHIFT13mi or SHIFTbook tablet device by the German manufacturer SHIFT contains an STM LSM6DSO IMU declared in the DSDT with the hardware ID SMOCF00. Add this ID to the ACPI match table so that the driver binds correctly to this device. WHO_AM_I register returns 0x6c, confirming LSM6DSO. Signed-off-by: Milan Misic Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit dc4b4d04e1caa3552f000d84d832779ebe51b093 Author: Ilpo Järvinen Date: Thu Feb 19 17:39:51 2026 +0200 PCI: Prevent shrinking bridge window from its required size Steve reported an eGPU (either Radeon Instinct MI50 32GB or NVIDIA 3080 10GB) connected via Thunderbolt was not assigned sufficient BAR space in v6.11, so the amdgpu and nvidia drivers were unable to initialize the device. pci_bridge_distribute_available_resources() -> ... -> adjust_bridge_window() is called between __pci_bus_size_bridges() and assigning the resources. Since the commit 948675736a77 ("PCI: Allow adjust_bridge_window() to shrink resource if necessary") adjust_bridge_window() can also shrink the bridge window. The shrunken size, however, conflicts with what __pci_bus_size_bridges() -> pbus_size_mem() calculated as the required bridge window size. By shrinking the size, adjust_bridge_window() prevents the rest of the resource fitting algorithm from working as intended. Resource fitting logic is expecting assignment failures when bridge windows need resizing, but there are cases where failures are no longer happening after the commit 948675736a77 ("PCI: Allow adjust_bridge_window() to shrink resource if necessary"). The commit 948675736a77 ("PCI: Allow adjust_bridge_window() to shrink resource if necessary") justifies the change by the extra reservation made due to hpmemsize parameter, however, the kernel code contradicts that statement. (For simplicity, finer-grained hpmmiosize and hpmmiopref parameters that can be used to the same effect as hpmemsize are ignored in this description.) pbus_size_mem() calls calculate_memsize() twice. First with add_size=0 to find out the minimal required resource size. The second call occurs with add_size=hpmemsize (effectively) but the result does not directly affect the resource size only resulting in an entry on the realloc_head list (a.k.a. add_list). Yet, adjust_bridge_window() directly changes the resource size which does not include what is reserved due to hpmemsize. Also, if the required size for the bridge window exceeds hpmemsize, the parameter does not have any effect even on the second size calculation made by pbus_size_mem(); from calculate_memsize(): size = max(size, add_size) + children_add_size; The commit ae4611f1d7e9 ("PCI: Set resource size directly in adjust_bridge_window()") that precedes the commit 948675736a77 ("PCI: Allow adjust_bridge_window() to shrink resource if necessary") is also related to causing this problem. Its changelog explicitly states adjust_bridge_window() wants to "guarantee" allocation success. Guaranteed allocations, however, are incompatible with how the other parts of the resource fitting algorithm work. The given justification fails to explain why guaranteed allocations at this stage are required nor why forcing window to a smaller value than what was calculated by pbus_size_mem() is correct. While the change might have worked by chance in some test scenario, too small bridge window does not "guarantee" success from the point of view of the endpoint device resource assignments. No issue is mentioned within the changelog so it's unclear if the change was made to fix some observed issue nor and what that issue was. The unwanted shrinking of a bridge window occurs, e.g., when a device with large BARs such as eGPU is attached using Thunderbolt and the Root Port holds less than enough resource space for the eGPU. The GPU resources are in order of GBs and the default hotplug allocation is a mere 2MB (DEFAULT_HOTPLUG_MMIO_PREF_SIZE). The problem is illustrated by this log (filtered to the relevant content only): pci 0000:00:07.0: PCI bridge to [bus 03-2c] pci 0000:00:07.0: bridge window [mem 0x6000000000-0x601bffffff 64bit pref] pci 0000:03:00.0: PCI bridge to [bus 00] pci 0000:03:00.0: bridge window [mem 0x00000000-0x000fffff 64bit pref] pci 0000:03:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring pci 0000:03:00.0: PCI bridge to [bus 04-2c] pcieport 0000:00:07.0: Assigned bridge window [mem 0x6000000000-0x601bffffff 64bit pref] to [bus 03-2c] cannot fit 0xc00000000 required for 0000:03:00.0 bridging to [bus 04-2c] pci 0000:03:00.0: bridge window [mem 0x800000000-0x10003fffff 64bit pref] to [bus 04-2c] add_size 100000 add_align 100000 pcieport 0000:00:07.0: distributing available resources pci 0000:03:00.0: bridge window [mem 0x800000000-0x10003fffff 64bit pref] shrunken by 0x00000007e4400000 pci 0000:03:00.0: bridge window [mem 0x6000000000-0x601bffffff 64bit pref]: assigned The initial size of the Root Port's window is 448MB (0x601bffffff - 0x6000000000). __pci_bus_size_bridges() -> pbus_size_mem() calculates the required size to be 32772 MB (0x10003fffff - 0x800000000) which would fit the eGPU resources. adjust_bridge_window() then shrinks the bridge window down to what is guaranteed to fit into the Root Port's bridge window. The bridge window for 03:00.0 is also eliminated from the add_list (a.k.a. realloc_head) list by adjust_bridge_window(). After adjustment, the resources are assigned and as the bridge window for 03:00.0 is assigned successfully, no failure is recorded. Without a failure, no attempt to resize the window of the Root Port is required. The end result is eGPU not having large enough resources to work. The commit 948675736a77 ("PCI: Allow adjust_bridge_window() to shrink resource if necessary") also claims nested bridge windows are sized the same, which is false. pbus_size_mem() calculates the size for the parent bridge window by summing all the downstream resources so the resource fitting calculates larger bridge window for the parent to accommodate the childen. That is, hpmemsize does not result the same size for the case where there are nested bridge windows. In order to fix the most immediate problem, don't shrink the resource size in adjust_bridge_window() as hpmemsize had nothing to do with it. When considering add_size, only reduce it up to what is added due to hpmemsize (if required size is larger than hpmemsize, the parameter has no impact, see calculate_memsize()). Unfortunately, if the tail of the bridge window was aligned in calculate_memsize() from below hpmemsize to above it, the size check will falsely match but the check at least errs to the side of caution. There's not enough information available in adjust_bridge_window() to know the calculated size precisely. This is not exactly a revert of the commits e4611f1d7e9 ("PCI: Set resource size directly in adjust_bridge_window()") and 948675736a77 ("PCI: Allow adjust_bridge_window() to shrink resource if necessary") as shrinking still remains in place but is implemented differently, and the end result behaves very differently. It is possible that those two commits fixed some other issue that is not described with enough detail in the changelog and undoing parts of them results in another regression due to behavioral change. Nonetheless, as described above, the solution by those two commits was flawed and the issue, if one exists, should be solved in a way that is compatible with the rest of the resource fitting algorithm instead of working against it. Besides shrinking, the case where adjust_bridge_window() expands the bridge window is likely somewhat wrong as well because it removes the entry from add_list (a.k.a. realloc_head), but it is less damaging as that only impacts optional resources and may have no impact if expanding by hpmemsize is larger than what add_size was. Fixing it is left as further work. Fixes: 948675736a77 ("PCI: Allow adjust_bridge_window() to shrink resource if necessary") Fixes: ae4611f1d7e9 ("PCI: Set resource size directly in adjust_bridge_window()") Reported-by: Steve Oswald Closes: https://lore.kernel.org/linux-pci/CAN95MYEaO8QYYL=5cN19nv_qDGuuP5QOD17pD_ed6a7UqFVZ-g@mail.gmail.com/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260219153951.68869-1-ilpo.jarvinen@linux.intel.com commit 92427ab4378faa168d6953d0f8574b8fc1edcc14 Author: Ahmed Naseef Date: Thu Mar 12 16:53:32 2026 +0000 PCI: Prevent assignment to unsupported bridge windows Previously, pci_read_bridge_io() and pci_read_bridge_mmio_pref() unconditionally set resource type flags (IORESOURCE_IO or IORESOURCE_MEM | IORESOURCE_PREFETCH) when reading bridge window registers. For windows that are not implemented in hardware, this may cause the allocator to assign space for a window that doesn't exist. For example, the EcoNET EN7528 SoC Root Port doesn't support the prefetchable window, but since a downstream device had a prefetchable BAR, the allocator mistakenly assigned a prefetchable window: pci 0001:00:01.0: [14c3:0811] type 01 class 0x060400 PCIe Root Port pci 0001:00:01.0: PCI bridge to [bus 01-ff] pci 0001:00:01.0: bridge window [mem 0x28000000-0x280fffff]: assigned pci 0001:00:01.0: bridge window [mem 0x28100000-0x282fffff pref]: assigned pci 0001:01:00.0: BAR 0 [mem 0x28100000-0x281fffff 64bit pref]: assigned pci_read_bridge_windows() already detects unsupported windows by testing register writability and sets dev->io_window/pref_window accordingly. Check dev->io_window/pref_window so we don't set the resource flags for unsupported windows, which prevents the allocator from assigning space to them. After this commit, the prefetchable BAR is correctly allocated from the non-prefetchable window: pci 0001:00:01.0: bridge window [mem 0x28000000-0x281fffff]: assigned pci 0001:01:00.0: BAR 0 [mem 0x28000000-0x280fffff 64bit pref]: assigned Suggested-by: Bjorn Helgaas Link: https://lore.kernel.org/all/20260113210259.GA715789@bhelgaas/ Signed-off-by: Ahmed Naseef Signed-off-by: Caleb James DeLisle Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260312165332.569772-4-cjd@cjdns.fr commit 908c80894f4aca7fbd66d8f7ebc8648ec6d8a340 Merge: 8880c2028558ad 34e0e2a8ea9e9e Author: Rob Herring (Arm) Date: Thu Mar 26 14:14:44 2026 -0500 Merge branch 'dt-reserved-mem-cleanups' into dt/next commit 8880c2028558adcf7a48df0cd67162a98d7afb7b Author: Abel Vesa Date: Fri Mar 13 14:22:38 2026 +0200 dt-bindings: spmi: qcom,x1e80100-spmi-pmic-arb: Document Eliza compatible The SPMI multi-master Arbiter found on Eliza is version 7.2.0, yet driver-wise, still compatible with the one featured on Hamoa (X1E80100), which is 7.0.1. So document the Eliza compatible and allow Hamoa one as fallback. Signed-off-by: Abel Vesa Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260313-eliza-bindings-spmi-v3-1-b8ff1e0a6171@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 34e0e2a8ea9e9e4f4dceb33072103dffaa1366b3 Author: Marek Szyprowski Date: Wed Mar 25 10:00:23 2026 +0100 of: reserved_mem: rework fdt_init_reserved_mem_node() Move the content of fdt_reserved_mem_save_node() to fdt_init_reserved_mem_node() function. Initialization is no longer performed in two steps as it was initially, so fdt_reserved_mem_save_node() name is a bit misleading and that function now performs full initialization of the reserved memory region. This also fixes the problem of keeping pointers to the regions, which failed to initialize, what might cause issues when such region is assigned to the device. Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20260325090023.3175348-8-m.szyprowski@samsung.com Signed-off-by: Rob Herring (Arm) commit bf66171579ce738d3dccce78b7dd37de2ba947f2 Author: Marek Szyprowski Date: Wed Mar 25 10:00:22 2026 +0100 of: reserved_mem: clarify fdt_scan_reserved_mem*() functions Rename fdt_scan_reserved_mem_reg_nodes() to fdt_scan_reserved_mem_late() to clearly show how it differs from fdt_scan_reserved_mem() and update description of both functions. Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20260325090023.3175348-7-m.szyprowski@samsung.com Signed-off-by: Rob Herring (Arm) commit 427864f793eb69ae3f33aed0fcbe625809412366 Author: Marek Szyprowski Date: Wed Mar 25 10:00:21 2026 +0100 of: reserved_mem: rearrange code a bit Move __rmem_check_for_overlap() and __rmem_cmp() functions before fdt_scan_reserved_mem_reg_nodes() to avoid forward declaration and keep related code close together. Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20260325090023.3175348-6-m.szyprowski@samsung.com Signed-off-by: Rob Herring (Arm) commit 7fd3981202b9aef8862aa06ca0d75496c0f9681f Author: Marek Szyprowski Date: Wed Mar 25 10:00:20 2026 +0100 of: reserved_mem: replace CMA quirks by generic methods Add optional reserved memory callbacks to perform region verification and early fixup, then move all CMA related code in of_reserved_mem.c to them. Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20260325090023.3175348-5-m.szyprowski@samsung.com Signed-off-by: Rob Herring (Arm) commit c640cad6a5382ea08a4e052156cfefc8021c51b7 Author: Marek Szyprowski Date: Wed Mar 25 10:00:19 2026 +0100 of: reserved_mem: switch to ops based OF_DECLARE() Move init function from OF_DECLARE() argument to the given reserved memory region ops structure and then pass that structure to the OF_DECLARE() initializer. This node_init callback is mandatory for the reserved mem driver. Such change makes it possible in the future to add more functions called by the generic code before given memory region is initialized and rmem object is created. Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20260325090023.3175348-4-m.szyprowski@samsung.com Signed-off-by: Rob Herring (Arm) commit 9d5149b3f2e7e80378907a8d3e4f7a94dfbbbdb8 Author: Marek Szyprowski Date: Wed Mar 25 10:00:18 2026 +0100 of: reserved_mem: use -ENODEV instead of -ENOENT When given reserved memory region doesn't really support given node, return -ENODEV instead of -ENOENT. Then fix __reserved_mem_init_node() function to properly propagate error code different from -ENODEV instead of silently ignoring it. Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20260325090023.3175348-3-m.szyprowski@samsung.com Signed-off-by: Rob Herring (Arm) commit abdd23c8849d45c6bdef0ab6facbbc63bddebbe1 Author: Marek Szyprowski Date: Wed Mar 25 10:00:17 2026 +0100 of: reserved_mem: remove fdt node from the structure FDT node is not needed for anything besides the initialization, so it can be simply passed as an argument to the reserved memory region init function. Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20260325090023.3175348-2-m.szyprowski@samsung.com Signed-off-by: Rob Herring (Arm) commit 9ebcf66cd6bcaa6c8275c18b7799507156361218 Merge: 45b2b84ac6fde3 453a4a5f97f0c9 Author: Jakub Kicinski Date: Thu Jan 8 11:37:07 2026 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-7.0-rc6). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski commit 3f92867ce3ee2a274ebb7e7d5de7f6ee85da21f6 Author: Geert Uytterhoeven Date: Thu Mar 26 19:17:11 2026 +0100 pinctrl: renesas: rzg2l: Drop superfluous blank line No need for a blank line after a "case" statement. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/7bfa105cf72d3b3e72a45d6218b5d88c8a7f520f.1774548955.git.geert+renesas@glider.be commit d9a60e367919752a1d398ebeba667f1e200fae1e Author: Biju Das Date: Thu Mar 26 16:24:51 2026 +0000 pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers The rzg2l_pinctrl_pm_setup_regs() handles save/restore of {IOLH,IEN,PUPD,SMT} registers during s2ram, but only for ports where all pins share the same pincfg. Extend the code to also support ports with variable pincfg per pin, so that {IOLH,IEN,PUPD,SMT} registers are correctly saved and restored for all pins. Fixes: 254203f9a94c ("pinctrl: renesas: rzg2l: Add suspend/resume support") Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260326162459.101414-1-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 494feecd60e876a4310cdda279d918e91f930091 Author: Lad Prabhakar Date: Thu Mar 19 14:15:15 2026 +0000 pinctrl: renesas: rzt2h: Add pin configuration support Add pin configuration support for the Renesas RZ/T2H SoC. The RZ/T2H SoC allows configuring several electrical characteristics through the DRCTLm (I/O Buffer Function Switching) registers. These registers control bias configuration, Schmitt trigger input, output slew rate, and drive strength. Implement pinconf_ops to allow reading and updating these properties through the generic pin configuration framework. The implementation supports bias-disable, bias-pull-up, bias-pull-down, input-schmitt-enable, slew-rate, and drive-strength-microamp. Signed-off-by: Lad Prabhakar Reviewed-by: Linus Walleij Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260319141515.2053556-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 9efe63b74e9c30777db9815dc5d38d667576ac6f Author: Lad Prabhakar Date: Thu Mar 19 14:15:14 2026 +0000 dt-bindings: pinctrl: renesas,r9a09g077: Document pin configuration properties Document the pin configuration properties supported by the RZ/T2H pinctrl driver. The RZ/T2H SoC allows configuring several electrical characteristics through the DRCTLm (I/O Buffer Function Switching) registers. These registers control drive strength, bias configuration, Schmitt trigger input, and output slew rate. Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Reviewed-by: Linus Walleij Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260319141515.2053556-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 225d02cb46d0e567eb788308168159f61735c8fe Author: Matthew Brost Date: Wed Mar 25 18:12:07 2026 -0700 drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove Async work (e.g., GuC queue teardowns) can call ggtt_node_remove, so the operation must be performed under the GGTT lock to ensure the GGTT online check remains stable. GGTT insertion and removal are heavyweight operations (e.g., queue create/destroy), so the additional serialization cost is negligible compared to ensuring correctness. Fixes: 4f3a998a173b ("drm/xe: Open-code GGTT MMIO access protection") Signed-off-by: Matthew Brost Reviewed-by: Dnyaneshwar Bhadane Link: https://patch.msgid.link/20260326011207.62373-1-matthew.brost@intel.com commit be3810a2ebc0c81303a15392097bac9ee0cd6297 Author: Marek Vasut Date: Thu Mar 26 05:54:59 2026 +0100 ARM: dts: renesas: Drop KSZ8041 PHY C22 compatible strings The Microchip KSZ8041 PHY schema indicates that the compatible string "ethernet-phy-id0022.1537" must not be followed by any other compatible string. Drop trailing "ethernet-phy-ieee802.3-c22" to match the schema. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260326045523.223620-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 5729a1acad0a701e930f65f721ddf6c2821331fc Author: Marek Vasut Date: Thu Mar 26 05:54:01 2026 +0100 ARM: dts: renesas: rza2mevb: Drop RTL8201F PHY C22 compatible string The Realtek RTL8201F PHY schema indicates that the compatible string "ethernet-phy-id001c.c816" must not be followed by any other compatible string. Drop trailing "ethernet-phy-ieee802.3-c22" to match the schema. Signed-off-by: Marek Vasut Reviewed-by: Andrew Lunn Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260326045416.223556-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 9d3e7e58b8b5d345e88cc849298b0204ad115021 Author: Marek Vasut Date: Thu Mar 26 05:53:38 2026 +0100 ARM: dts: renesas: r8a7742-iwg21d-q7-dbcm-ca: Drop KSZ8081 PHY C22 compatible string The Microchip KSZ8081 PHY schema indicates that the compatible string "ethernet-phy-id0022.1560" must not be followed by any other compatible string. Drop trailing "ethernet-phy-ieee802.3-c22" to match the schema. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260326045355.223529-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit abe27c6b2e9adff7ada54ce434207c87abe40f5d Author: Biju Das Date: Tue Mar 24 11:43:16 2026 +0000 arm64: dts: renesas: Add initial device tree for RZ/G3L SMARC EVK board Add the initial device tree for the Renesas RZ/G3L SMARC EVK board. Added placeholders to avoid compilation error with the common code in renesas-smarc2.dtsi. Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20260324114329.268249-12-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 7eeed6cd6a419f2f412aab29344a129e1c5c37f7 Author: Biju Das Date: Tue Mar 24 11:43:15 2026 +0000 arm64: dts: renesas: renesas-smarc2: Move usb3 nodes to board DTS The SMARC2 board DTSI is common to multiple SoCs. Move the USB3 nodes to the board DTS, as some SoCs (e.g. RZ/G3[SL]) do not support USB3. Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20260324114329.268249-11-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit e130dde0ab3ea21932cac19c27cf7650f53fa78d Author: Biju Das Date: Tue Mar 24 11:43:14 2026 +0000 arm64: dts: renesas: Add initial support for RZ/G3L SMARC SoM Add initial support for the RZ/G3L SMARC SoM with 2GiB memory and extal clk. Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20260324114329.268249-10-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a57349a7a108b2ba824036de9c191a1d8080e517 Author: Biju Das Date: Tue Mar 24 11:43:13 2026 +0000 arm64: dts: renesas: Add initial DTSI for RZ/G3L SoC Add the initial DTSI for the RZ/G3L SoC. The files in this commit have the following meaning: - r9a08g046.dtsi: RZ/G3L family SoC common parts - r9a08g046l48.dtsi: RZ/G3L R9A08G046L48 SoC-specific parts Add placeholders to reuse the code for the Renesas SMARC II carrier board. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260324114329.268249-9-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit eba48cde284653541b90f2129c2a1da93257f603 Merge: d26e1c84c0203b b822fb82505af4 Author: Geert Uytterhoeven Date: Thu Mar 26 19:55:57 2026 +0100 Merge tag 'renesas-r9a08g046-dt-binding-defs-tag1' into renesas-dts-for-v7.1 Renesas RZ/G3L DT Binding Definitions DT bindings and binding definitions for the Renesas RZ/G3L (R9A08G046) SoC, shared by driver and DT source files. commit d26e1c84c0203b58f766b8f28317d6e485c9f241 Author: Ovidiu Panait Date: Mon Mar 2 16:54:41 2026 +0000 arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Add versa3 clock generator node Add versa3 clock generator node. It provides clocks for the RTC, PCIe and audio devices. Signed-off-by: Ovidiu Panait Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260302165441.4457-8-ovidiu.panait.rb@renesas.com Signed-off-by: Geert Uytterhoeven commit 77894661c00ab99053c9606f0f7ec673065f86ac Author: Biju Das Date: Tue Mar 24 11:43:12 2026 +0000 clk: renesas: Add support for RZ/G3L SoC The clock structure for RZ/G3L is almost identical to that of the RZ/G3S SoC with more IP blocks such as LCDC, CRU, LVDS, and GPU. Add minimal clock and reset entries required to boot the system on Renesas RZ/G3L SMARC EVK and bind it with the RZ/G2L CPG core driver. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260324114329.268249-8-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 30e7ff3598bb9d686a6e56a56b06cf2f07180bef Merge: bf497e7babb5d1 b822fb82505af4 Author: Geert Uytterhoeven Date: Thu Mar 26 19:45:42 2026 +0100 Merge tag 'renesas-r9a08g046-dt-binding-defs-tag1' into renesas-clk-for-v7.1 Renesas RZ/G3L DT Binding Definitions DT bindings and binding definitions for the Renesas RZ/G3L (R9A08G046) SoC, shared by driver and DT source files. commit b822fb82505af4cc3f14fed05b8069c67d2ed5fb Author: Biju Das Date: Tue Mar 24 11:43:06 2026 +0000 dt-bindings: clock: renesas,rzg2l-cpg: Document RZ/G3L SoC Document the device tree bindings for the Renesas RZ/G3L SoC Clock Pulse Generator (CPG). RZ/G3L CPG is similar to RZ/G2L CPG but has 5 clocks compared to 1 clock on other SoCs. Also define RZ/G3L (R9A08G046) Clock Pulse Generator Core Clocks, as listed in section 4.4.4.1 ("Block Diagram of the Clock System"), module clock outputs, as listed in section 4.4.2 ("Clock List r1.00") and add Reset definitions referring to registers CPG_RST_* in Section 4.4.3 ("Register") of the RZ/G3L Hardware User's Manual (Rev.1.00 Oct, 2025). Acked-by: Conor Dooley Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260324114329.268249-2-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit bf497e7babb5d14570b18b5d2c8a6bb14d4a733b Author: Biju Das Date: Tue Mar 24 11:43:11 2026 +0000 clk: renesas: rzg2l: Re-enable critical module clocks during resume After a suspend/resume cycle, critical module clocks (CLK_IS_CRITICAL) may be left disabled as there is no owning driver to restore them, unlike regular clocks. Add rzg2l_mod_enable_crit_clock_init_mstop() which walks all module clocks on resume, re-enables any critical clock found disabled, and then restores the MSTOP state for clocks that have one via the existing helper. This replaces the direct call to rzg2l_mod_clock_init_mstop() in rzg2l_cpg_resume(), preserving the correct clock-before-MSTOP restore ordering. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260324114329.268249-7-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit fa3e973ca2d7a46b9f4ad5611b42d1885d7a77b6 Author: Biju Das Date: Tue Mar 24 11:43:10 2026 +0000 clk: renesas: rzg2l: Add rzg2l_mod_clock_init_mstop_helper() Refactor the mstop initialisation logic in rzg2l_mod_clock_init_mstop() into a dedicated helper function rzg2l_mod_clock_init_mstop_helper(). This decouples the logic for setting module stop state on disabled clocks from the iteration loop, allowing it to be reused during resume to re-enable critical clocks. No functional change. Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20260324114329.268249-6-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 867fb0bc60602cb3c2458fcd25c841650d37563f Author: Biju Das Date: Tue Mar 24 11:43:09 2026 +0000 clk: renesas: rzg2l: Add helper for mod clock enable/disable Refactor rzg2l_mod_clock_endisable() by extracting its logic into a new helper function rzg2l_mod_clock_endisable_helper(), which accepts an additional set_mstop_state boolean parameter. This allows callers to control whether the module stop state is updated alongside the clock enable/disable operation. No functional change for existing callers. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260324114329.268249-5-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 5865d2525a38a261e20633cb4171f5f731c9f1bd Author: Biju Das Date: Tue Mar 24 11:43:08 2026 +0000 clk: renesas: r9a0{7g04[34],8g045}: Add critical reset entries The RZ/G2L SoC family requires DMA resets to be deasserted for routing some peripheral interrupts to the CPU. Asserting these resets after boot would silently break interrupt delivery with no driver to restore them. Mark the DMA resets as critical by adding them to the crit_resets table in the SoC-specific rzg2l_cpg_info for r9a07g043, r9a07g044, and r9a08g045, preventing __rzg2l_cpg_assert() from asserting them and ensuring they are deasserted during probe and resume. Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20260324114329.268249-4-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 3d700746d76bedb9f3de505494994cd3f2afb59f Author: Biju Das Date: Tue Mar 24 11:43:07 2026 +0000 clk: renesas: rzg2l: Add support for critical resets Some reset lines must remain deasserted at all times after boot, as asserting them would disable critical system functionality with no owning driver to restore them. This mirrors the existing crit_mod_clks mechanism which protects critical module clocks from being disabled. On RZ/G2L family SoCs, the DMA reset must be remain deasserted for routing some peripheral interrupts to CPU. Add crit_resets and num_crit_resets fields to struct rzg2l_cpg_info to allow SoC-specific data tables to declare reset IDs that must never be asserted. Introduce rzg2l_cpg_deassert_crit_resets() to iterate over all critical resets and deassert them. Call it both at probe time and during resume to ensure critical peripherals are held out of reset after power-on and suspend/resume cycles. Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20260324114329.268249-3-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c8b610341914cb62899e31b41f724b5c4831a645 Author: Hans Zhang <18255117159@163.com> Date: Sat Mar 14 00:55:22 2026 +0800 PCI: of: Remove max-link-speed generation validation The of_pci_get_max_link_speed() function currently validates the "max-link-speed" DT property to be in the range 1..4 (Gen1..Gen4). This imposes a maintenance burden because each new PCIe generation would require updating this validation. Remove the range check so the function returns the raw property value (or a negative error code if the property is missing or malformed). Since the callers are now validating the returned speed against the range they support, this check can now be safely removed. Removing the validation from this common function also allows future PCIe generations to be supported without modifying drivers/pci/of.c. Signed-off-by: Hans Zhang <18255117159@163.com> [mani: commit log and kernel doc fix] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260313165522.123518-6-18255117159@163.com commit 03f920936977b5133a0e57a7c9fdeb4e584eeb06 Author: Hans Zhang <18255117159@163.com> Date: Sat Mar 14 00:55:21 2026 +0800 PCI: controller: Validate max-link-speed Add validation for the "max-link-speed" DT property in three more drivers, using the pcie_get_link_speed() helper. - brcmstb: If the value is missing or invalid, fall back to no limitation (pcie->gen = 0). Fix the previous incorrect logic. - mediatek-gen3: If the value is missing or invalid, use the maximum speed supported by the controller. - rzg3s-host: If the value is missing or invalid, fall back to Gen2. This ensures that all users of of_pci_get_max_link_speed() are ready for the removal of the central range check. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260313165522.123518-5-18255117159@163.com commit 126d04398cd4e29743828c38c21f39f46fc2e004 Author: Hans Zhang <18255117159@163.com> Date: Sat Mar 14 00:55:20 2026 +0800 PCI: j721e: Validate max-link-speed from DT Use the new pcie_get_link_speed() helper to validate the value read from the "max-link-speed" DT property. If the value is missing or invalid, fall back to Gen2 (speed = 2). This prepares for the removal of the range check in of_pci_get_max_link_speed(). Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260313165522.123518-4-18255117159@163.com commit 0f34f647f19465b475b13e889dcb33526e166d24 Author: Hans Zhang <18255117159@163.com> Date: Sat Mar 14 00:55:19 2026 +0800 PCI: dwc: Use pcie_get_link_speed() helper for safe array access Replace direct indexing of pcie_link_speed[] with the new helper pcie_get_link_speed() in all DesignWare core and glue drivers. This ensures that out-of-range generation numbers do not cause out-of-bounds accesses when the helper returns PCI_SPEED_UNKNOWN, and prepares for the removal of the range check in of_pci_get_max_link_speed(). The actual validation of the "max-link-speed" DT property (e.g., fallback to a safe default and warning) is added in subsequent patches for each driver that reads the property. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260313165522.123518-3-18255117159@163.com commit 28d20b0d895849ce3fe8c6f77baffc08886c2157 Author: Hans Zhang <18255117159@163.com> Date: Sat Mar 14 00:55:18 2026 +0800 PCI: Add pcie_get_link_speed() helper for safe array access The pcie_link_speed[] array is indexed by PCIe generation numbers (1 = 2.5 GT/s, 2 = 5 GT/s, ...). Several drivers use it directly, which can lead to out-of-bounds accesses if an invalid generation number is used. Introduce a helper function pcie_get_link_speed() that returns the pci_bus_speed value for a given generation number, or PCI_SPEED_UNKNOWN if the generation is out of range. This will allow us to safely handle invalid values after the range check is removed from of_pci_get_max_link_speed(). Signed-off-by: Hans Zhang <18255117159@163.com> [mani: Fixed kernel-doc] Signed-off-by: Manivannan Sadhasivam Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/20260313165522.123518-2-18255117159@163.com commit 42550d7d8aa66632c75f22095cb210dd431e8d71 Author: Yeoreum Yun Date: Sat Mar 14 17:51:28 2026 +0000 KVM: arm64: kselftest: set_id_regs: Add test for FEAT_LSUI Add test coverage for FEAT_LSUI. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Signed-off-by: Catalin Marinas commit f6bff18d05ed40e5b06bfe9f9e5c2c7fe247164d Author: Yeoreum Yun Date: Sat Mar 14 17:51:27 2026 +0000 KVM: arm64: Expose FEAT_LSUI to guests Expose the FEAT_LSUI ID register field to guests. Signed-off-by: Yeoreum Yun Acked-by: Marc Zyngier Reviewed-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 7181f718cb0fd47b37d13aad8744cbd6da9f1cbe Author: Yeoreum Yun Date: Sat Mar 14 17:51:26 2026 +0000 arm64: cpufeature: Add FEAT_LSUI Since Armv9.6, FEAT_LSUI introduces atomic instructions that allow privileged code to access user memory without clearing the PSTATE.PAN bit. Add CPU feature detection for FEAT_LSUI. Signed-off-by: Yeoreum Yun [catalin.marinas@arm.com: Remove commit log references to SW_PAN] Signed-off-by: Catalin Marinas commit 39ecfef48384b3b8795df37a8211462a6666d9a6 Author: Dmitry Baryshkov Date: Tue Mar 24 02:10:44 2026 +0200 interconnect: qcom: msm8974: expand DEFINE_QNODE macros The rest of Qualcomm Interconnect drivers have stopped using DEFINE_QNODE long ago for the sake of readability. Stop using it inside the msm8974 interconnect driver too. Acked-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://msgid.link/20260324-msm8974-icc-v2-8-527280043ad8@oss.qualcomm.com Signed-off-by: Georgi Djakov commit aa60d907b3c289832d2188e079fc126a700389fa Author: Dmitry Baryshkov Date: Tue Mar 24 02:10:43 2026 +0200 interconnect: qcom: msm8974: switch to the main icc-rpm driver In preparation to restoring the ability of MSM8974 driver to work with the modern kernels, switch the driver to the main icc-rpm set of helper code. As platform-specific workarounds, set the get_bw callback (returning 0) to prevent initial setup from programming INT_MAX into the RPM (which otherwise might hang the platform) and tell RPM programming code to ignore -ENXIO errors from the firmware (until the QoS programming is sorted out). Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://msgid.link/20260324-msm8974-icc-v2-7-527280043ad8@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 91cfd1604f9ec73d3fde18204de263d0e2c79a3b Author: Dmitry Baryshkov Date: Tue Mar 24 02:10:42 2026 +0200 interconnect: qcom: let platforms declare their bugginess On MSM8974 programming some of the RPM resources results in the "resource does not exist" messages from the firmware. This occurs even with the downstream bus driver, which happily ignores the errors. My assumption is that these resources existed in the earlier firmware revisions but were later switched to be programmed differently (for the later platforms corresponding nodes use qos.ap_owned, which prevents those resources from being programmed. In preparation for conversion of the MSM8974 driver (which doesn't have QoS code yet) to the main icc-rpm set of helpers, let the driver declare that those -ENXIO errors must be ignored (for now). Later, when the QoS programming is sorted out (and more interconnects are added to the DT), this quirk might be removed. Reviewed-by: Brian Masney Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://msgid.link/20260324-msm8974-icc-v2-6-527280043ad8@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 1d5b5f7d755be846e7b3a236855ee148b80b4fa3 Author: Dmitry Baryshkov Date: Tue Mar 24 02:10:41 2026 +0200 interconnect: qcom: define OCMEM bus resource Some of the platforms (MSM8974, MSM8x26) require voting on the OCMEM clock. Add new resource for that clock. Reviewed-by: Brian Masney Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://msgid.link/20260324-msm8974-icc-v2-5-527280043ad8@oss.qualcomm.com Signed-off-by: Georgi Djakov commit fba5454ef58bbdf2334fc94c29ae3053acac574c Author: Dmitry Baryshkov Date: Tue Mar 24 02:10:40 2026 +0200 interconnect: qcom: icc-rpm: allow overwriting get_bw callback MSM8974 requires a separate get_bw callback, since on that platform increasing the clock rate for some of the NoCs during boot may lead to hangs. For the details see commit 9caf2d956cfa ("interconnect: qcom: msm8974: Don't boost the NoC rate during boot"). Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://msgid.link/20260324-msm8974-icc-v2-4-527280043ad8@oss.qualcomm.com Signed-off-by: Georgi Djakov commit b8498af901684912bd87a39c7b95ad955d9bc543 Author: Dmitry Baryshkov Date: Tue Mar 24 02:10:39 2026 +0200 interconnect: qcom: drop unused is_on flag The commit 2e2113c8a64f ("interconnect: qcom: rpm: Handle interface clocks") has added the is_on flag to the qcom_icc_provider, but failed to actually utilize it. Drop the flag. Fixes: 2e2113c8a64f ("interconnect: qcom: rpm: Handle interface clocks") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://msgid.link/20260324-msm8974-icc-v2-3-527280043ad8@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 199363ed2f6a351360fbc353e20059c763965130 Author: Dmitry Baryshkov Date: Tue Mar 24 02:10:38 2026 +0200 dt-bindings: interconnect: qcom,msm8974: use qcom,rpm-common Use qcom,rpm-common schema to declare interconnects property instead describing it again. In future this will allow the platform to switch to the two-cell interconnects, adding the tag to the specification. Signed-off-by: Dmitry Baryshkov Link: https://msgid.link/20260324-msm8974-icc-v2-2-527280043ad8@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 99d986686331ba3fd58dffb312e282d2bf81ee72 Author: Hans Zhang <18255117159@163.com> Date: Sun Mar 15 23:53:51 2026 +0800 PCI: sky1: Use boolean true for is_rc field The is_rc field in struct cdns_pcie is of type bool. Replace the integer assignment (1) with the boolean literal true to improve code clarity and maintain consistency with the type definition. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260315155351.127078-1-18255117159@163.com commit f64f37521c3492ea32dee9bce513145360f30f57 Author: Dmitry Baryshkov Date: Tue Mar 24 02:10:37 2026 +0200 dt-bindings: interconnect: qcom,msm8974: drop bus clocks Remove the wrong internal RPM bus clock representation that we've been carrying for years. They are an internal part of the interconnect fabric. They are not exported by any device and are not supposed to be used. Signed-off-by: Dmitry Baryshkov Link: https://msgid.link/20260324-msm8974-icc-v2-1-527280043ad8@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 33a76fc3c3e61386524479b99f35423bd3d9a895 Author: Krishna Chaitanya Chundru Date: Sat Mar 14 07:26:34 2026 +0530 PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support Qcom PCIe Root Ports advertise hotplug capability in hardware, but do not support hotplug command completion. As a result, the hotplug commands issued by the pciehp driver never gets completion notification, leading to repeated timeout warnings and multi-second delays during boot and suspend/resume. Commit a54db86ddc153 ("PCI: qcom: Do not advertise hotplug capability for IPs v2.7.0 and v1.9.0") mistakenly assumed that the Root Ports doesn't support Hotplug due to timeouts and disabled the Hotplug functionality altogether. But the Root Ports does support reporting Hotplug events like DL_Up/Down events. So to fix the command completion timeout issues, just set the No Command Completed Support (NCCS) bit and enable Hotplug in Slot Capability field back. Fixes: a54db86ddc153 ("PCI: qcom: Do not advertise hotplug capability for IPs v2.7.0 and v1.9.0") Signed-off-by: Krishna Chaitanya Chundru [mani: renamed function, commit log and added comment] Signed-off-by: Manivannan Sadhasivam Tested-by: Konrad Dybcio # Hamoa CRD, tunneled link Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260314-hotplug-v1-1-96ac87d93867@oss.qualcomm.com commit 5387815aa821a8d6dd87ba3aa6869e3c9c709b2a Author: Rosen Penev Date: Wed Mar 25 21:13:54 2026 -0700 dm-bufio: use kzalloc_flex Avoid manual size calculations and use the proper helper. Add __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Signed-off-by: Mikulas Patocka commit 698dab284b9d1c8aace73af8aaf0cfb74fc8ce92 Author: Hans Zhang <18255117159@163.com> Date: Sat Mar 7 10:01:52 2026 +0800 PCI: dwc: Expose PCIe event counters for groups 5 to 7 over debugfs Extend the DesignWare PCIe controller's debugfs statistical counter interface with event definitions from groups 5 through 7 as documented in the DWC PCIe Databook (version 6.30a, section 3.8.2.3, Tables 3-59, 3-60, 3-61). These counters provide visibility into Layer1 non-error events (link state transitions,ASPM, L1 substates), Layer2 DLLP exchanges, and Layer3 TLP transactions. The counters are exposed under the debugfs statistical counter directory, allowing users to monitor link behavior and diagnose PCIe protocol issues more effectively. Co-developed-by: Cheng Xin Signed-off-by: Cheng Xin Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam Reviewed-by: Shawn Lin Link: https://patch.msgid.link/20260307020152.1224518-1-18255117159@163.com commit fc1d43826702d8c14845c187d3ea0743fdf8f223 Author: Bruce Johnston Date: Tue Mar 24 14:06:52 2026 -0400 dm vdo: save the formatted metadata to disk Add vdo_save_super_block() and vdo_save_geometry_block() to perform asynchronous writes of the super block and geometry block respectively. Add vdo_clear_layout() to zero the UDS index's first block, the block map partition, and the recovery journal partition. These operations are driven by new phases in the pre-load state machine (PRE_LOAD_PHASE_FORMAT_*), ensuring that disk writes happen during pre-resume rather than during dmsetup create. Signed-off-by: Bruce Johnston Reviewed-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit defce4e039bc0100164964f79e896d05cb45dc76 Author: Bruce Johnston Date: Tue Mar 24 14:06:51 2026 -0400 dm vdo: add formatting logic and initialization Add the core formatting logic. The initialization path is updated to read the geometry block (block 0 on the storage device). If the block is entirely zeroed, the device is treated as unformatted and vdo_format() is called. Otherwise, the existing geometry is parsed and the VDO is loaded as before. The vdo_format() function initializes the volume geometry and super block, and marks the VDO as needing it's layout saved to disk. Signed-off-by: Bruce Johnston Reviewed-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit 9d9c28aa867ae3ffdd967a8caeb4e3fb6d4003cd Author: Bruce Johnston Date: Tue Mar 24 14:06:50 2026 -0400 dm vdo: add synchronous metadata I/O submission helper Add vdo_submit_metadata_vio_wait(), a synchronous I/O submission helper that blocks until completion. This is needed for I/O during early initialization before work queues are available. Refactor read_geometry_block() to use it. Signed-off-by: Bruce Johnston Reviewed-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit b5d1f45c5fea9fa112f0dddebd95fadad06d3bd8 Author: Bruce Johnston Date: Tue Mar 24 14:06:49 2026 -0400 dm vdo: add geometry block structure Introduce a vdo_geometry_block structure, containing a vio and buffer, mirroring the existing vdo_super_block structure. Both are now initialized at VDO startup and freed at shutdown, establishing the infrastructure needed to read and write the geometry block using the same mechanisms as the super block. Refactor read_geometry_block() to use the new structure. Signed-off-by: Bruce Johnston Reviewed-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit 427bf2c1f77435b36749a03e4f9d4549e3807e2d Author: Bruce Johnston Date: Tue Mar 24 14:06:48 2026 -0400 dm vdo: add geometry block encoding Add vdo_encode_volume_geometry() to write the geometry block into a buffer so that it can be written to disk. The corresponding decode path already exists. Signed-off-by: Bruce Johnston Reviewed-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit beced130a367e0b99fa9424505ee7f07ddea86de Author: Bruce Johnston Date: Tue Mar 24 14:06:47 2026 -0400 dm vdo: add upfront validation for logical size Add a validation check that the logical size passed via the table line does not exceed MAXIMUM_VDO_LOGICAL_BLOCKS. Signed-off-by: Bruce Johnston Reviewed-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit 2fb98e4170c4a0d9ebe091ca2421121daa352de0 Author: Bruce Johnston Date: Tue Mar 24 14:06:46 2026 -0400 dm vdo: add formatting parameters to table line Extend the dm table line with three new optional parameters: indexMemory (UDS index memory size), indexSparse (dense vs sparse index), and slabSize (blocks per allocation slab). These values are parsed, validated, and stored in the device configuration for use during formatting. Rework the slab size constants from the single MAX_VDO_SLAB_BITS into explicit MIN_VDO_SLAB_BLOCKS, MAX_VDO_SLAB_BLOCKS, and DEFAULT_VDO_SLAB_BLOCKS values. Bump the target version from 9.1.0 to 9.2.0 to reflect this table line change. Signed-off-by: Bruce Johnston Reviewed-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit e073bb098ae28a909ece08ec05a6c59dbd282b12 Author: Bruce Johnston Date: Tue Mar 24 14:06:45 2026 -0400 dm vdo: add super block initialization to encodings.c Add vdo_initialize_component_states() to populate the super block, computing the space required for the main VDO components on disk. Those include the slab depot, block map, and recovery journal. Signed-off-by: Bruce Johnston Reviewed-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit 4b4a8d9560d987f4df17b7248ab1c8146138d0f5 Author: Bruce Johnston Date: Tue Mar 24 14:06:44 2026 -0400 dm vdo: add geometry block initialization to encodings.c Add vdo_initialize_volume_geometry() to populate the geometry block, computing the space required for the two main regions on disk. Add uds_compute_index_size() to calculate the space required for the UDS indexer from the UDS configuration. Signed-off-by: Bruce Johnston Reviewed-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit 180ea823bb45eb71dd5ed0dc0b78633accd21096 Author: Sherry Sun Date: Fri Mar 6 11:04:56 2026 +0800 PCI: imx6: Separate PERST# assertion from core reset functions The imx_pcie_assert_core_reset() and imx_pcie_deassert_core_reset() functions are primarily intended to reset the RC controller itself, not the remote PCIe endpoint devices. However, the PERST# GPIO control was previously embedded within these functions, which conflates two distinct reset operations. Move the PERST# GPIO handling into a dedicated function imx_pcie_assert_perst(). This makes the code more maintainable and prepares for parsing the reset-gpios property according to the new Root Port DT binding in subsequent patches. No functional change is intended. Signed-off-by: Sherry Sun Signed-off-by: Manivannan Sadhasivam Reviewed-by: Richard Zhu Link: https://patch.msgid.link/20260306030456.1032815-1-sherry.sun@nxp.com commit 192b8a1bf81c17852b6cf540c95b0a3bcc9c58c4 Author: Sherry Sun Date: Fri Mar 6 10:12:47 2026 +0800 PCI: imx6: Change imx_pcie_deassert_core_reset() return type to void The function imx_pcie_deassert_core_reset() always returns 0 and the return value is not used meaningfully by its callers. Change the return type from int to void to simplify the code and remove unnecessary error handling paths. No functional change intended. Signed-off-by: Sherry Sun Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Reviewed-by: Richard Zhu Link: https://patch.msgid.link/20260306021247.991976-1-sherry.sun@nxp.com commit 025b245f0bc193c81679201b95940e96f8e42133 Merge: df236c996bb465 e31c53a8060e13 Author: Carlos Maiolino Date: Thu Mar 26 18:06:56 2026 +0100 Merge branch 'xfs-7.0-fixes' into for-next Signed-off-by: Carlos Maiolino commit 396d44dcaf8d367ed15ecec30e2f69c62f93306c Author: Manivannan Sadhasivam Date: Thu Mar 5 12:42:35 2026 +0530 PCI: endpoint: Improve error messages Include errno in the error prints and also use dev_err() where applicable. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260305071236.23792-2-mani@kernel.org commit ff5387d4f0798cf1d1a4f548427bd9142cf35b66 Author: Manivannan Sadhasivam Date: Thu Mar 5 12:42:34 2026 +0530 PCI: endpoint: Print the EPF name in the error log of pci_epf_make() Merely printing the error log without the actual EPF name will not give much clue to the users about the failure. Hence, print the EPF name also. Suggested-by: Bjorn Helgaas Signed-off-by: Manivannan Sadhasivam Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260305071236.23792-1-mani@kernel.org commit 5f73cf1db829c21b7fd44a8d2587cd395b1b2d76 Author: Richard Zhu Date: Sat Feb 28 16:09:25 2026 +0800 PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX On i.MX6SX, the LTSSM registers become inaccessible after the PME_Turn_Off message is sent to the link. So there is no way to verify whether the link has entered L2/L3 Ready state or not. Hence, set IMX_PCIE_FLAG_SKIP_L23_READY flag for i.MX6SX SoC to skip the L2/L3 Ready state polling and let the DWC core wait for 10ms after sending the PME_Turn_Off message as per the PCIe spec r6.0, sec 5.3.3.2.1. Fixes: a528d1a72597 ("PCI: imx6: Use DWC common suspend resume method") Signed-off-by: Richard Zhu [mani: commit log] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260228080925.1558395-1-hongxing.zhu@nxp.com commit 7eb28030f641d5bc7682c98602f896304efd31d2 Author: Marco Crivellari Date: Mon Nov 10 18:03:32 2025 +0100 smp: Use system_percpu_wq instead of system_wq When a caller enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() uses WORK_CPU_UNBOUND (used when no target CPU is specified). The same applies to schedule_work() that is using system_wq and queue_work(), which again makes use of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. Continue the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue() flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") and switch smp_call_on_cpu() to use system_percpu_wq because system_wq is going away once the ongoing workqueue restructuring is done. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://patch.msgid.link/20251110170332.319314-1-marco.crivellari@suse.com commit 42972b5464295450ce55f457645917aba4d54ead Author: Geert Uytterhoeven Date: Fri Mar 6 13:13:32 2026 +0100 irqchip/gic-v3: Print a warning for out-of-range interrupt numbers gic_irq_domain_translate() does not check if an interrupt number lies within the valid range of the specified interrupt type. Add these checks, and print a warning if the interrupt number is out of range. This can help flagging incorrectly described Extended SPI and PPI interrupts in DT. Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Gleixner Acked-by: Marc Zyngier Link: https://patch.msgid.link/ce695ea46decc816974179314a86f2b9b5cad6a9.1772799134.git.geert+renesas@glider.be commit 52dac22f0a13f61fe180e0237473c4d072043931 Merge: 3b6f4cfc7152fe ae2cb3384337a5 Author: Mark Brown Date: Thu Mar 26 16:22:45 2026 +0000 ASoC: add rt1320/rt1321 dmic dai and fix the wrong name prefix Bard Liao says: The new rt722 + rt1320 configuration uses the DMIC on the rt1320. This series adds support for such configurations, where the DMIC is provided by the rt1320 instead of the rt722. commit ae2cb3384337a556ce02e557fecd39db78c36e7d Author: Derek Fang Date: Thu Mar 26 15:53:02 2026 +0800 ASoC: sdw_utils: add rt1320 and rt1321 dmic dai in codec_info_list Add 'rt1320-aif2' dai infos for rt1320 and rt1321 dmic function. Signed-off-by: Derek Fang Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260326075303.1083567-4-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit dd4a1963ddf0d0f5e129efec03f34ea37109b4b7 Author: Derek Fang Date: Thu Mar 26 15:53:01 2026 +0800 ASoC: SOF: Intel: Add a is_amp flag to fix the wrong name prefix According to the Intel sof design, it will create the name prefix appended with amp index for the amp codec only, such as: rt1318-1, rt1318-2, etc... But the rt1320 is a codec with amp and mic codec functions, it doesn't have the amp index in its name prefix as above. And then it will be hard to identify the codec if in multi-rt1320 case. So we add a flag to force the amp index to be appended. Signed-off-by: Derek Fang Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260326075303.1083567-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 9033f7b7f27d09d468c98ed2b811d0f2495c70c1 Author: Mac Chiang Date: Thu Mar 26 15:53:00 2026 +0800 ASoC: Intel: soc-acpi-intel-ptl-match: drop rt722 monolithic match tables Use functional topologies to support RT722 topologies with/without amplifiers, e.g. sof-ptl-rt722.tplg, sof-ptl-rt722-rt1320.tplg... If these entries are not removed, they will find the first same link of sof-ptl-rt722.tplg. Signed-off-by: Mac Chiang Co-developed-by: Derek Fang Signed-off-by: Derek Fang Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260326075303.1083567-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit e54390aae6887151ff67526af45382beb889f99a Author: Ernest Van Hoecke Date: Wed Mar 25 15:46:02 2026 +0100 dt-bindings: arm: fsl: add Verdin iMX95 Add DT compatible strings for the Verdin i.MX95 SoM and its supported carrier boards: the Verdin Development Board, and the Dahlia, Ivy, Mallow and Yavia carrier boards. Link: https://www.toradex.com/computer-on-modules/verdin-arm-family/nxp-imx95 Link: https://www.toradex.com/products/carrier-board/verdin-development-board-kit Link: https://www.toradex.com/products/carrier-board/dahlia-carrier-board-kit Link: https://www.toradex.com/products/carrier-board/ivy-carrier-board Link: https://www.toradex.com/products/carrier-board/mallow-carrier-board Link: https://www.toradex.com/products/carrier-board/yavia Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ernest Van Hoecke Signed-off-by: Frank Li commit 53210b46cd11260334f4025769c3c74886015fef Author: Martin Schmiedel Date: Thu Mar 19 13:50:08 2026 +0100 dt-bindings: arm: fsl: add MBa93xxLA-MINI Adds support for the MBa93xxLA-MINI SBC. https://www.tq-group.com/en/products/tq-embedded/arm-architecture/mba93xxla-mini/ Signed-off-by: Martin Schmiedel Signed-off-by: Alexander Stein Reviewed-by: Daniel Baluta Acked-by: Conor Dooley Signed-off-by: Frank Li commit d44627c13049ea347d59ef5c75b1ceef27725bde Author: Markus Niebel Date: Mon Mar 16 16:04:51 2026 +0100 dt-bindings: arm: add bindings for TQMa95xxLA TQMa95xxLA is a SOM using NXP i.MX95 CPU. MBa95xxCA is a carrier reference design / starter kit board. [1] https://www.tq-group.com/en/products/tq-embedded/arm-architecture/tqma95xxla/ Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Acked-by: Krzysztof Kozlowski Signed-off-by: Frank Li commit 43dcd2c99ff4f4370eb22b61968204890d7e94be Author: Frank Li Date: Wed Oct 15 14:48:45 2025 -0400 dt-bindings: arm: lpc: add missed lpc43xx board Add missed legancy lpc43xx board compatible string to fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/lpc/lpc4337-ciaa.dtb: /: failed to match any schema with compatible: ['ciaa,lpc4337', 'nxp,lpc4337', 'nxp,lpc4350'] Reviewed-by: Vladimir Zapolskiy Reviewed-by: Krzysztof Kozlowski Signed-off-by: Frank Li commit bda4af7c7811382ab477421a83c29b5ef187fee9 Author: Ciprian Marian Costea Date: Wed Mar 11 09:11:51 2026 +0100 dt-bindings: arm: fsl: Add NXP S32N79 SoC and RDB board Add device tree binding documentation for the NXP S32N79 automotive SoC and the S32N79 Reference Design Board (S32N79-RDB). The S32N79 is an automotive-grade SoC featuring eight ARM Cortex-A78AE cores organized for high-performance networking and gateway applications in vehicles. Co-developed-by: Larisa Grigore Signed-off-by: Larisa Grigore Signed-off-by: Ciprian Marian Costea Acked-by: Krzysztof Kozlowski Signed-off-by: Frank Li commit 0b7973dfb7467f69843fb56bf62c7cb440a0bc3c Author: Ciprian Marian Costea Date: Wed Mar 11 09:11:50 2026 +0100 dt-bindings: interrupt-controller: fsl,irqsteer: add S32N79 support Add compatible string for the interrupt steering controller used in NXP S32N79 SoC. The S32N79 SoC differs from the i.MX version by not implementing the CHANCTRL register, but otherwise maintains the same programming model and register layout. Co-developed-by: Larisa Grigore Signed-off-by: Larisa Grigore Signed-off-by: Ciprian Marian Costea Reviewed-by: Krzysztof Kozlowski Signed-off-by: Frank Li commit f2c05ff2fe69ebbd63038160b063b0bc88dbe4e9 Author: Shengjiu Wang Date: Fri Feb 27 09:58:36 2026 +0800 dt-bindings: arm: fsl: Add compatible for i.MX8MP audio board (version 2) Introduce a new DT compatible string for the NXP i.MX8MP audio board (version 2). i.MX Audio Board is a configurable and functional audio processing platform. Integrating a variety of audio input and output interfaces into the system, the i.MX Audio Board supports HDMI input, HDMI eARC, S/PDIF I/O, 2-ch ADC line-in, 24-ch DAC line-out and more. Based on these features, rich audio application cases can be realized. Signed-off-by: Shengjiu Wang Acked-by: Conor Dooley Signed-off-by: Frank Li commit 05452c58ef4f308f67b9bc7b37e8dcb7e5aa988d Author: Josua Mayer Date: Thu Feb 26 18:36:30 2026 +0200 dt-bindings: arm: fsl: Add various solidrun i.MX8M boards Add bindings for various SolidRun boards: - i.MX8MP HummingBoard IIoT - based on the SolidRun i.MX8M Plus SoM - SolidSense N8 - single-board design with i.MX8M Nano - i.MX8M Mini System on Module - i.MX8M Mini HummingBoard Ripple Acked-by: Krzysztof Kozlowski Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit e0fcae27ff572212c39b1078e7aa0795ce5970e7 Author: Biju Das Date: Wed Mar 25 19:24:31 2026 +0000 irqchip/renesas-rzg2l: Add shared interrupt support The RZ/G3L SoC has 16 external interrupts, of which 8 are shared with TINT (GPIO interrupts), whereas RZ/G2L has only 8 external interrupts with no sharing. The shared interrupt line selection between external interrupt and GPIO interrupt is based on the INTTSEL register. Add shared_irq_cnt variable to struct rzg2l_hw_info handle these differences. Add used_irqs bitmap to struct rzg2l_irqc_priv to track allocation state. In the alloc callback, use test_and_set_bit() to enforce mutual exclusion and configure the INTTSEL register to route to either the external interrupt or TINT. In the free callback, use test_and_clear_bit() to release the shared interrupt line and reset the INTTSEL. Also add INTTSEL register save/restore support to the suspend/resume path. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-17-biju.das.jz@bp.renesas.com commit 98b24d39c852d2498aae24c9aa0a3b11edb8cc2c Author: Biju Das Date: Wed Mar 25 19:24:30 2026 +0000 irqchip/renesas-rzg2l: Add RZ/G3L support The IRQC block on the RZ/G3L SoC is almost identical to the one found on the RZ/G2L SoC, with the following differences: - The number of GPIO interrupts for TINT selection is 113 instead of 123. - The pin index and TINT selection index are not in the 1:1 map. - The number of external interrupts are 16 instead of 8, out of these 8 external interrupts are shared with TINT. Add support for the RZ/G3L driver by filling the rzg2l_hw_info table and adding LUT for mapping between pin index and TINT selection index. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-16-biju.das.jz@bp.renesas.com commit f9544cad3600f251a7d24c2fb77e7f2abdceb42e Author: Biju Das Date: Wed Mar 25 19:24:29 2026 +0000 irqchip/renesas-rzg2l: Drop IRQC_IRQ_COUNT macro The total number of external interrupts in RZ/G2L and RZ/G3L SoC are different. The RZ/G3L has 16 external interrupts whereas RZ/G2L has only 8 external interrupts. Add irq_count variable in struct rzg2l_hw_info to handle these differences and drop the macro IRQC_IRQ_COUNT. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-15-biju.das.jz@bp.renesas.com commit 87404cb8cae43b680caaaa621280e71969a09147 Author: Biju Das Date: Wed Mar 25 19:24:28 2026 +0000 irqchip/renesas-rzg2l: Drop IRQC_TINT_START macro The IRQC_TINT_START value is different for RZ/G3L and RZ/G2L SoC. Add tint_start variable in struct rzg2l_hw_info to handle this difference and drop the macro IRQC_TINT_START. While at it, update the variable type of titseln, tssr_offset, tssr_index, index, and sense to unsigned int, in rzg2l_tint_set_edge() as these variables are used only for calculation. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-14-biju.das.jz@bp.renesas.com commit 2f814778950ecc99ca5e71472b626dddb2d2b756 Author: Biju Das Date: Wed Mar 25 19:24:27 2026 +0000 irqchip/renesas-rzg2l: Drop IRQC_NUM_IRQ macro The total number of interrupts in RZ/G2L and RZ/G3L SoC are different. Introduce struct rzg2l_hw_info to handle the hardware differences and replace the macro IRQC_NUM_IRQ with num_irq variable in struct rzg2l_hw_info. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-13-biju.das.jz@bp.renesas.com commit b8e06e4e419bd3dd99f832d728f17007ada3359c Author: Biju Das Date: Wed Mar 25 19:24:26 2026 +0000 irqchip/renesas-rzg2l: Dynamically allocate fwspec array The total number of interrupts in RZ/G2L and RZ/G3L SoC are different. The RZ/G3L has 16 external interrupts whereas RZ/G2L has only 8 external interrupts. Dynamically allocate fwspec memory instead of static allocation to support both SoCs. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-12-biju.das.jz@bp.renesas.com commit bcb30669088a69cc8de2a5cf446b8b72f6b6e8eb Author: Biju Das Date: Wed Mar 25 19:24:25 2026 +0000 irqchip/renesas-rzg2l: Split rzfive_irqc_{mask,unmask} into separate IRQ and TINT handlers rzfive_irqc_mask() and rzfive_irqc_unmask() use hw_irq range checks to dispatch between IRQ and TINT masking operations. Split each into two dedicated handlers — rzfive_irqc_irq_mask(), rzfive_irqc_tint_mask(), rzfive_irqc_irq_unmask(), and rzfive_irqc_tint_unmask() — each operating unconditionally on its respective interrupt type, removing the runtime conditionals. Assign the IRQ-specific handlers to rzfive_irqc_irq_chip and the TINT-specific handlers to rzfive_irqc_tint_chip, consistent with the separation applied to the EOI, set_type, and enable/disable callbacks in previous patches. While at it, simplify rzfive_irqc_{irq,tint}_{mask,unmask}() by replacing raw_spin_lock locking/unlocking with scoped_guard(). Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-11-biju.das.jz@bp.renesas.com commit 0b2675fadf4fdfdb69c492b38cc0d6f6a3e2f937 Author: Biju Das Date: Wed Mar 25 19:24:24 2026 +0000 irqchip/renesas-rzg2l: Split rzfive_tint_irq_endisable() into separate IRQ and TINT helpers rzfive_tint_irq_endisable() handles both IRQ and TINT enable/disable paths via a hw_irq range check. Split this into two dedicated helpers, rzfive_irq_endisable() for IRQ interrupts and rzfive_tint_endisable() for TINT interrupts, each operating unconditionally on their respective interrupt type. While at it, simplify rzfive_{irq,tint}_endisable by replacing raw_spin_lock locking/unlocking with guard() and update the variable types of offset, tssr_offset, and tssr_index to unsigned int, as these variables are used only for calculation. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-10-biju.das.jz@bp.renesas.com commit 83ed8efca07a076906c4c24749ee2fd5835c0ade Author: Biju Das Date: Wed Mar 25 19:24:23 2026 +0000 irqchip/renesas-rzg2l: Replace rzg2l_irqc_irq_{enable,disable} with TINT-specific handlers rzg2l_irqc_irq_disable() and rzg2l_irqc_irq_enable() are used by both the IRQ and TINT chips, but only perform TINT-specific work via rzg2l_tint_irq_endisable(), guarded by a hw_irq range check. Since the IRQ chip does not require this extra enable/disable handling, replace its callbacks with the generic irq_chip_disable_parent() and irq_chip_enable_parent() directly. While at it, simplify rzfive_irqc_irq_enable() by replacing raw_spin_lock locking/unlocking with guard() and update the variable types of offset, tssr_offset, and tssr_index to unsigned int, as these variables are used only for calculation. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-9-biju.das.jz@bp.renesas.com commit d196aeb35efa2f2339b31f107c0ce35387946009 Author: Biju Das Date: Wed Mar 25 19:24:22 2026 +0000 irqchip/renesas-rzg2l: Split set_type handler into separate IRQ and TINT functions The common rzg2l_irqc_set_type() handler uses hw_irq range checks to dispatch to either rzg2l_irq_set_type() or rzg2l_tint_set_edge(). Split this into two dedicated handlers, rzg2l_irqc_irq_set_type() and rzg2l_irqc_tint_set_type(), each calling only their respective type configuration function without runtime conditionals. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-8-biju.das.jz@bp.renesas.com commit 6e5e0331dea48bbd6955af562aab4972a3950fa2 Author: Biju Das Date: Wed Mar 25 19:24:21 2026 +0000 irqchip/renesas-rzg2l: Split EOI handler into separate IRQ and TINT functions The common rzg2l_irqc_eoi() handler uses a conditional to determine whether to clear an IRQ or an TINT interrupt. Split this into two dedicated handlers, rzg2l_irqc_irq_eoi() and rzg2l_irqc_tint_eoi(), each handling only their respective interrupt type without the need for range checks. While at it, simplify rzg2l_irqc_{irq,tint}_eoi() by replacing raw_spin_lock locking/unlocking with scoped_guard(). Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-7-biju.das.jz@bp.renesas.com commit 4b11d14cac6ae198ea855b871c73dc208a177a0e Author: Biju Das Date: Wed Mar 25 19:24:20 2026 +0000 irqchip/renesas-rzg2l: Replace single irq_chip with per-region irq_chip instances The driver uses a single irq_chip instance shared across all interrupt types, relying on dispatcher callbacks to differentiate between IRQ and TINT regions at runtime. Replace the per-SoC irq_chip and its dispatcher callbacks with dedicated irq_chip instances for each interrupt region: IRQ and TINT. Subsequent patches will add per-region callbacks for IRQ and TINT from the common code. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-6-biju.das.jz@bp.renesas.com commit 0109d24b4cdc2cdbc127f86cbede83adae2187d7 Author: Biju Das Date: Wed Mar 25 19:24:19 2026 +0000 irqchip/renesas-rzg2l: Drop redundant IRQC_TINT_START check in rzg2l_irqc_alloc() The check `hwirq < IRQC_TINT_START` in rzg2l_irqc_alloc() is unnecessary as the condition is already guaranteed to be false at that point in the code. The outer `if (hwirq > IRQC_IRQ_COUNT)` block ensures that hwirq is always above IRQC_IRQ_COUNT before reaching this check, and since IRQC_TINT_START <= IRQC_IRQ_COUNT, the guard can never trigger. Remove the dead code to simplify the allocation path. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-5-biju.das.jz@bp.renesas.com commit fb74e35f78105efd8635c89b39f4389f567edbdc Author: Biju Das Date: Wed Mar 25 19:24:18 2026 +0000 irqchip/renesas-rzg2l: Fix error path in rzg2l_irqc_common_probe() Replace pm_runtime_put() with pm_runtime_put_sync() when irq_domain_create_hierarchy() fails to ensure the device suspends synchronously before devres cleanup disables runtime PM via pm_runtime_disable(). [ tglx: Fix up subject and change log to be precise ] Fixes: 7de11369ef30 ("irqchip/renesas-rzg2l: Use devm_pm_runtime_enable()") Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260325192451.172562-4-biju.das.jz@bp.renesas.com commit 3aa78b828e5d68bc8231a70ed295bcc6227bc611 Author: Biju Das Date: Wed Mar 25 19:24:17 2026 +0000 dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Document RZ/G3L SoC Document RZ/G3L (R9A08G046) IRQC. The IRQC block on the RZ/G3L SoC is nearly identical to that found on the RZ/G3S SoC, with the following differences: it supports more external interrupts and GPT error interrupts, and adds registers for GPT/MTU interrupt selection and shared interrupt selection between external interrupt and TINT. A new compatible string "renesas,r9a08g046-irqc" is therefore introduced for the RZ/G3L SoC. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260325192451.172562-3-biju.das.jz@bp.renesas.com commit 7b7d32d93e9879480ec6f00b9310b2d64c2161db Author: Biju Das Date: Wed Mar 25 19:24:16 2026 +0000 dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Use pattern for interrupt-names Simplify the bindings by using pattern property for interrupt-names. It also allows to change the ordering of interrupts. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260325192451.172562-2-biju.das.jz@bp.renesas.com commit dc67808832d3a1d337c314a2c950f9bf774a21b2 Author: Kathiravan Thirumoorthy Date: Wed Mar 25 17:09:43 2026 +0530 dt-bindings: firmware: qcom,scm: Document ipq9650 SCM Document the scm compatible for ipq9650 SoC. Signed-off-by: Kathiravan Thirumoorthy Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260325-ipq9650_scm-v1-1-ad6a3fe53f38@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7c61e7433b49ca948dc8cc2b70a20b3dbc36363d Author: Jiakai Xu Date: Tue Mar 3 01:08:59 2026 +0000 RISC-V: KVM: selftests: Add RISC-V SBI STA shmem alignment tests Add RISC-V KVM selftests to verify the SBI Steal-Time Accounting (STA) shared memory alignment requirements. The SBI specification requires the STA shared memory GPA to be 64-byte aligned, or set to all-ones to explicitly disable steal-time accounting. This test verifies that KVM enforces the expected behavior when configuring the SBI STA shared memory via KVM_SET_ONE_REG. Specifically, the test checks that: - misaligned GPAs are rejected with -EINVAL - 64-byte aligned GPAs are accepted - all-ones GPA is accepted Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20260303010859.1763177-4-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 40351ed924dd30ded1b43c7333ce695a4a835f7b Author: Jiakai Xu Date: Tue Mar 3 01:08:58 2026 +0000 KVM: selftests: Refactor UAPI tests into dedicated function Move steal time UAPI tests from steal_time_init() into a separate check_steal_time_uapi() function for better code organization and maintainability. Previously, x86 and ARM64 architectures performed UAPI validation tests within steal_time_init(), mixing initialization logic with uapi tests. Changes by architecture: x86_64: - Extract MSR reserved bits test from steal_time_init() - Move to check_steal_time_uapi() which tests that setting MSR_KVM_STEAL_TIME with KVM_STEAL_RESERVED_MASK fails ARM64: - Extract three UAPI tests from steal_time_init(): Device attribute support check Misaligned IPA rejection (EINVAL) Duplicate IPA setting rejection (EEXIST) - Move all tests to check_steal_time_uapi() RISC-V: - Add empty check_steal_time_uapi() stub for future use - No changes to steal_time_init() (had no tests to extract) The new check_steal_time_uapi() function: - Is called once before the per-VCPU test loop No functional change intended. Suggested-by: Andrew Jones Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20260303010859.1763177-3-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit fa9681ed5c6ae980af18545690e31d8f9c088c33 Author: Jiakai Xu Date: Tue Mar 3 01:08:57 2026 +0000 RISC-V: KVM: Validate SBI STA shmem alignment in kvm_sbi_ext_sta_set_reg() The RISC-V SBI Steal-Time Accounting (STA) extension requires the shared memory physical address to be 64-byte aligned, or set to all-ones to explicitly disable steal-time accounting. KVM exposes the SBI STA shared memory configuration to userspace via KVM_SET_ONE_REG. However, the current implementation of kvm_sbi_ext_sta_set_reg() does not validate the alignment of the configured shared memory address. As a result, userspace can install a misaligned shared memory address that violates the SBI specification. Such an invalid configuration may later reach runtime code paths that assume a valid and properly aligned shared memory region. In particular, KVM_RUN can trigger the following WARN_ON in kvm_riscv_vcpu_record_steal_time(): WARNING: arch/riscv/kvm/vcpu_sbi_sta.c:49 at kvm_riscv_vcpu_record_steal_time WARN_ON paths are not expected to be reachable during normal runtime execution, and may result in a kernel panic when panic_on_warn is enabled. Fix this by validating the computed shared memory GPA at the KVM_SET_ONE_REG boundary. A temporary GPA is constructed and checked before committing it to vcpu->arch.sta.shmem. The validation allows either a 64-byte aligned GPA or INVALID_GPA (all-ones), which disables STA as defined by the SBI specification. This prevents invalid userspace state from reaching runtime code paths that assume SBI STA invariants and avoids unexpected WARN_ON behavior. Fixes: f61ce890b1f074 ("RISC-V: KVM: Add support for SBI STA registers") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20260303010859.1763177-2-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit bdf6b22fd52954f5ac88689eeaf960ac9687b78c Author: Alice Ryhl Date: Thu Mar 26 15:25:37 2026 +0000 rust: drm: use new sync::aref path for imports ARef and AlwaysRefCounted are being moved to sync::aref, and the re-exports under types are planned to be removed. Thus, update imports to the new path. Acked-by: Danilo Krummrich Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260326-drm-rust-next-fix-aref-v1-2-7f6f58d2828a@google.com Signed-off-by: Alice Ryhl commit d4cf576672fbfee061d6f4f70c74b3b3d163447c Author: Alice Ryhl Date: Thu Mar 26 15:25:36 2026 +0000 rust: workqueue: use new sync::aref path for imports ARef and AlwaysRefCounted are being moved to sync::aref, and the re-exports under types are planned to be removed. Thus, update imports to the new path. Acked-by: Danilo Krummrich Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260326-drm-rust-next-fix-aref-v1-1-7f6f58d2828a@google.com Signed-off-by: Alice Ryhl commit 3006f7fbc7ef53bf8316b02d7f23f647b24c3eca Author: Abel Vesa Date: Mon Mar 23 20:57:12 2026 +0200 clk: qcom: gcc-eliza: Enable FORCE_MEM_CORE_ON for UFS AXI PHY clock According to internal documentation, the UFS AXI PHY clock requires FORCE_MEM_CORE_ON to be enabled for UFS MCQ mode to work. Without this, the UFS controller fails when operating in MCQ mode, which is already enabled in the device tree. The UFS PHY ICE core clock already has this bit set, so apply the same configuration to the UFS PHY AXI clock. Fixes: 3d356ab4a1ec ("clk: qcom: Add support for Global clock controller on Eliza") Reported-by: Nitin Rawat Signed-off-by: Abel Vesa Reviewed-by: Taniya Das Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260323-eliza-gcc-set-ufs-axi-phyforce-mem-core-on-v1-1-b6b7a6f3f8c5@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 47f06ebbe8dad695002e5d9a2ab436411f88e985 Author: Nathan Chancellor Date: Wed Mar 25 19:19:26 2026 -0700 perf/arm-cmn: Fix resource_size_t printk specifier in arm_cmn_init_dtc() When building for 32-bit ARM, there is a warning when using the %llx specifier to print a resource_size_t variable: drivers/perf/arm-cmn.c: In function 'arm_cmn_init_dtc': drivers/perf/arm-cmn.c:2149:73: error: format '%llx' expects argument of type 'long long unsigned int', but argument 4 has type 'resource_size_t' {aka 'unsigned int'} [-Werror=format=] 2149 | "Failed to request DTC region 0x%llx\n", base); | ~~~^ ~~~~ | | | | | resource_size_t {aka unsigned int} | long long unsigned int | %x Use the %pa specifier to handle the possible sizes of phys_addr_t properly. This requires passing the variable by reference. Fixes: 5394396ff548 ("perf/arm-cmn: Stop claiming entire iomem region") Signed-off-by: Nathan Chancellor Reviewed-by: Robin murphy Signed-off-by: Will Deacon commit d49802b6617b96f55d4b61fed81f4cc43858ed3f Author: Chen Ni Date: Thu Mar 26 17:08:56 2026 +0800 perf/arm-cmn: Fix incorrect error check for devm_ioremap() Check devm_ioremap() return value for NULL instead of ERR_PTR and return -ENOMEM on failure. devm_ioremap() never returns ERR_PTR, using IS_ERR() skips the error path and may cause a NULL pointer dereference. Fixes: 5394396ff548 ("perf/arm-cmn: Stop claiming entire iomem region") Signed-off-by: Chen Ni Signed-off-by: Will Deacon commit 20eb0aa76f7ceebbf897019e3eeeca0a1d24e3f5 Author: Le Qi Date: Tue Feb 10 10:40:37 2026 +0800 arm64: dts: qcom: hamoa-evk: Add DP0/DP1 audio playback support The hamoa-evk DTS currently lacks DAI links for DP0 and DP1, preventing the sound card from exposing these playback paths. Add the missing links to enable audio output on both DP interfaces. Reviewed-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Signed-off-by: Le Qi Link: https://lore.kernel.org/r/20260210024037.3719191-1-le.qi@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5d994fd7e2f2e11f134fce0abd900bd02b655f70 Author: Icenowy Zheng Date: Sat Mar 21 17:20:32 2026 +0800 irqchip/loongson-pch-lpc: Enable building on MIPS Loongson64 As the driver now supports OF-based platforms, it's now possible to use it on MIPS Loongson64 machines. Drop the requirement of LOONGARCH for this driver, to allow build on both MIPS-based and LoongArch-based Loongson systems. Signed-off-by: Icenowy Zheng Signed-off-by: Thomas Gleixner Reviewed-by: Jiaxun Yang Reviewed-by: Huacai Chen Link: https://patch.msgid.link/20260321092032.3502701-7-zhengxingda@iscas.ac.cn commit ed3772aa48cf84ae313156cfe6544e8cba5aa043 Author: Icenowy Zheng Date: Sat Mar 21 17:20:31 2026 +0800 irqchip/loongson-pch-lpc: Add OF init code The OF-based MIPS Loongson-3 systems can also have a PCH LPC interrupt controller. Add OF-based initialization code for this driver. Co-developed-by: Jiaxun Yang Signed-off-by: Jiaxun Yang Signed-off-by: Icenowy Zheng Signed-off-by: Thomas Gleixner Reviewed-by: Huacai Chen Link: https://patch.msgid.link/20260321092032.3502701-6-zhengxingda@iscas.ac.cn commit 29c10a0af04e9b3eb7b06e72e9f75fccca45205e Author: Icenowy Zheng Date: Sat Mar 21 17:20:30 2026 +0800 irqchip/loongson-pch-lpc: Extract non-ACPI-related code from ACPI init A lot of code can be shared between the existing ACPI init flow with the upcoming OF init flow. Extract it into a dedicated function. The re-ordering of parent interrupt allocation requires the architecture code to reserve legacy interrupts from the dynamic allocation by overriding arch_dynirq_lower_bound(), otherwise the parent of LPC irqchip will be allocated in the intended static range of LPC interrupts, which leads to allocation failure of LPC interrupts. Co-developed-by: Jiaxun Yang Signed-off-by: Jiaxun Yang Signed-off-by: Icenowy Zheng Signed-off-by: Thomas Gleixner Reviewed-by: Huacai Chen Link: https://patch.msgid.link/20260321092032.3502701-5-zhengxingda@iscas.ac.cn commit 41bf87bcac02cd788d4325415d4b2e31bf2a694d Author: Icenowy Zheng Date: Sat Mar 21 17:20:29 2026 +0800 dt-bindings: interrupt-controller: Add LS7A PCH LPC Loongson 7A series PCH contains an LPC controller with an interrupt controller. Add the device tree binding for the interrupt controller. Signed-off-by: Icenowy Zheng Signed-off-by: Thomas Gleixner Reviewed-by: Jiaxun Yang Reviewed-by: Huacai Chen Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260321092032.3502701-4-zhengxingda@iscas.ac.cn commit dc30127cd050dbc9d8452846ee7fa6692a1093d2 Author: Icenowy Zheng Date: Sat Mar 21 17:20:28 2026 +0800 LoongArch: Override arch_dynirq_lower_bound to reserve LPC IRQs Loongson 7A PCH chips all contain a LPC controller, which is used in some devices to connect legacy ISA devices (e.g. 8259 PS/2 controller). The LPC irqchip driver will register LPC interrupts at the fixed range 0~15, and the PCH PIC irqchip driver uses dynamic allocation. However the LPC interrupt numbers are currently not exempted from dynamic allocation. The current setup work by accident because the LPC interrupt controller is the first consumer of PIC interrupt controller, and the PIC interrupt number is allocated after LPC interrupts are registered. Such setup is fragile and will stop to work when the LPC irqchip driver is reworked. Override arch_dynirq_lower_bound() to reserve LPC interrupts from dynamic allocation, to prevent interrupt number collision and allow rework of the LPC irqchip driver. Signed-off-by: Icenowy Zheng Signed-off-by: Thomas Gleixner Reviewed-by: Huacai Chen Link: https://patch.msgid.link/20260321092032.3502701-3-zhengxingda@iscas.ac.cn commit 57c9c7bf52c8473a6b9b7fa3547b468c0a91bc60 Author: Icenowy Zheng Date: Sat Mar 21 17:20:27 2026 +0800 MIPS: loongson64: Override arch_dynirq_lower_bound to reserve LPC IRQs On some Loongson 3A devices, a LPC bus is present and some legacy devices (e.g. 8259) on it expect hardcoded low interrupt numbers. However currently the expected low range interrupt numbers are not exempted from the dynamic allocation, which leads to conflicts when registering LPC interrupts in the fixed range. Override arch_dynirq_lower_bound() to reserve these low range interrupt numbers and prevent them from being dynamically allocated. Signed-off-by: Icenowy Zheng Signed-off-by: Thomas Gleixner Reviewed-by: Huacai Chen Link: https://patch.msgid.link/20260321092032.3502701-2-zhengxingda@iscas.ac.cn commit 87c6dfe308afb9d514006bb42ca2dad301f4ad75 Merge: 1f0cf051551758 897cf98926429c Author: Thomas Gleixner Date: Thu Mar 26 16:14:33 2026 +0100 Merge branch 'irq/urgent' into irq/drivers to fixup a trivial conflict with pending upstream fixes. commit fad2964471e98c126ac688004b721a5a03064417 Author: Nate DeSimone Date: Tue Mar 24 16:14:55 2026 -0700 Documentation: ABI: add FBPT and S3PT entries to sysfs-firmware-acpi Document the FBPT and S3PT sysfs attributes located under /sys/firmware/acpi/fpdt/. Signed-off-by: Nate DeSimone [ rjw: Changelog tweak ] Link: https://patch.msgid.link/20260324231456.701-3-nathaniel.l.desimone@intel.com Signed-off-by: Rafael J. Wysocki commit 8dcb4485e7672d3abe9fac03b843dff7bb8a1582 Author: Nate DeSimone Date: Tue Mar 24 16:14:54 2026 -0700 ACPI: FPDT: expose FBPT and S3PT subtables via sysfs Add sysfs files at /sys/firmware/acpi/fpdt/FBPT and /sys/firmware/acpi/fpdt/S3PT that expose the raw contents of the FPDT subtables. Note that /sys/firmware/acpi/tables/FPDT only provides the top level table, not the subtables. Adding access to the subtables enables a usage model similar to /sys/firmware/dmi/tables/DMI, allowing userspace tools to interpret newer record types (e.g. String Event Records, Microcontroller Boot Performance Data Records, etc.) defined in recent ACPI specifications [1] without requiring kernel changes. Link: https://uefi.org/specs/ACPI/6.6/05_ACPI_Software_Programming_Model.html#performance-event-record-types [1] Signed-off-by: Nate DeSimone [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260324231456.701-2-nathaniel.l.desimone@intel.com Signed-off-by: Rafael J. Wysocki commit 1b6c89285d37114d7efe8ab04102a542581cd7da Author: Thomas Weißschuh Date: Thu Mar 26 12:42:31 2026 +0100 timens: Remove dependency on the vDSO Previously, missing time namespace support in the vDSO meant that time namespaces needed to be disabled globally. This was expressed in a hard dependency on the generic vDSO library. This also meant that architectures without any vDSO or only a stub vDSO could not enable time namespaces. Now that all architectures using a real vDSO are using the generic library, that dependency is not necessary anymore. Remove the dependency and let all architectures enable time namespaces. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260326-vdso-timens-decoupling-v2-2-c82693a7775f@linutronix.de commit 5dc9cf835aba73c882348aa4f99be83b6e45ad9b Author: Thomas Weißschuh Date: Thu Mar 26 12:42:30 2026 +0100 vdso/timens: Move functions to new file As a preparation of the untangling of time namespaces and the vDSO, move the glue functions between those subsystems into a new file. While at it, switch the mutex lock and mmap_read_lock() in the vDSO namespace code to guard(). Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260326-vdso-timens-decoupling-v2-1-c82693a7775f@linutronix.de commit ec6944df7b58045ecbdbf6962b89c7f28df9c5b6 Author: Geert Uytterhoeven Date: Wed Mar 4 18:11:04 2026 +0100 arm64: dts: qcom: Drop CPU masks from GICv3 PPI interrupts Unlike older GIC variants, the GICv3 DT bindings do not support specifying a CPU mask in PPI interrupt specifiers. Drop the masks. Signed-off-by: Geert Uytterhoeven Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/226c5d1005a6e295e0581b2c89e5510dbb7aa9d1.1772643434.git.geert+renesas@glider.be Signed-off-by: Bjorn Andersson commit 6b25a72abaf0aaaecc3820b8253d809246fc7ed3 Author: Abel Vesa Date: Tue Mar 24 17:29:43 2026 +0200 arm64: dts: qcom: eliza: Add missing msi-parent for UFS Wire up the UFS controller to the GIC ITS by specifying the msi-parent property. The UFS host uses MSI and requires a valid ITS mapping in order to allocate and receive interrupts. Add the ITS reference along with the device ID to match the SMMU stream ID. Fixes: db7fe6963466 ("arm64: dts: qcom: Introduce Eliza Soc base dtsi") Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260324-eliza-base-dt-fixes-v3-3-3a4a03e72f8f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 13aadeca9e7bb9b48ac68f96b97cdad60bf9f4b2 Author: Abel Vesa Date: Tue Mar 24 17:29:42 2026 +0200 arm64: dts: qcom: eliza: Add missing CX power domain to GCC Unless CX is declared the power-domain of GCC votes (power and performance) on the GDSCs provided by GCC will not propagate to the CX, which might result in under-voltage conditions. Add the missing power-domains property to associate GCC with RPMHPD_CX. Fixes: db7fe6963466 ("arm64: dts: qcom: Introduce Eliza Soc base dtsi") Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260324-eliza-base-dt-fixes-v3-2-3a4a03e72f8f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit fa095e0b69c5629718d86d8bff7fccd56c0762e0 Author: Abel Vesa Date: Tue Mar 24 17:29:41 2026 +0200 arm64: dts: qcom: eliza: Coding style clean-ups Some coding style issues were raised during review but the devicetree was merged meanwhile. Address them here. These changes are non-functional. Fixes: db7fe6963466 ("arm64: dts: qcom: Introduce Eliza Soc base dtsi") Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260324-eliza-base-dt-fixes-v3-1-3a4a03e72f8f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit fee828abbd9dd4af41a7aa2b9671e5c23cfc3635 Author: Dmitry Baryshkov Date: Fri Mar 20 04:51:00 2026 +0200 arm64: dts: qcom: patch mahua thermal zones by label Updating DT nodes by the full path is fragile and frowned upon, it's easy to miss the rename of the node in the main tree. Add necessary labels and patch thermal zones for Mahua using those labels. Signed-off-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260320-mahua-fix-thermals-v1-1-8957bf976c90@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2c098c2bae7177779c1801319d019a23e312d482 Author: Dmitry Baryshkov Date: Fri Mar 20 04:33:15 2026 +0200 arm64: dts: qcom: purwa: deduplicate thermal sensors with Hamoa Hamoa and Purwa have pretty close thermal zones definitions. The major difference is that several zones are absent (because of the lack of the CPU cluster) and several zones use tsens2 instead of tsens3. Instead of completely duplicating thermal zones for Purwa, reuse themal zones from Hamoa, patching them where required. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260320-purwa-drop-thermals-v1-1-2c9fe046cd02@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit eb5fa758f795e7d610221d126b005eb23c10f82b Author: Abel Vesa Date: Tue Mar 24 17:12:19 2026 +0200 arm64: dts: qcom: glymur-crd: Enable WLAN and Bluetooth Both Glymur and Mahua CRDs feature a WCN7850 M.2 WLAN and Bluetooth combo card. So describe both the 0.9V and the 3.3V regulators, then WCN7850 PMU and the PCIe WLAN and the UART Bluetooth nodes. Do this in the Glymur CRD generic dtsi so that both Glymur and Mahua CRDs benefit from it towards enabling WLAN and Bluetooth functionality. Signed-off-by: Abel Vesa Tested-by: Gopikrishna Garmidi Reviewed-by: Zijun Hu Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260324-glymur-dts-crd-enable-bt-wlan-v2-1-6afcf1ac277a@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c88d3aa52ae6519ce0d16ecc08d568c9468fc12a Author: Val Packett Date: Mon Mar 23 06:40:47 2026 -0300 arm64: dts: qcom: kodiak: Add LPASS I2S2 pinctrl definitions Add the pinctrl definitions to configure gpio10-gpio13 of the lpass_tlmm for I2S output. Signed-off-by: Val Packett Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260323095247.92890-1-val@packett.cool Signed-off-by: Bjorn Andersson commit 4073cf900eb9adc71f13656abf2aa968147337cd Author: Kathiravan Thirumoorthy Date: Wed Mar 25 14:49:10 2026 +0530 arm64: dts: qcom: add IPQ5210 SoC and rdp504 board support Add initial device tree support for the Qualcomm IPQ5210 SoC and rdp504 board. Signed-off-by: Kathiravan Thirumoorthy Link: https://lore.kernel.org/r/20260325-ipq5210_boot_to_shell-v3-2-9c7360d19d10@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 703d08de53f425e7907c734179ed9e6bfb1ac05c Author: Kathiravan Thirumoorthy Date: Wed Mar 25 14:49:09 2026 +0530 dt-bindings: qcom: add ipq5210 boards Document the new ipq5210 SoC/board device tree bindings. Acked-by: Krzysztof Kozlowski Signed-off-by: Kathiravan Thirumoorthy Link: https://lore.kernel.org/r/20260325-ipq5210_boot_to_shell-v3-1-9c7360d19d10@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4d059454d3fd1747e4b96d8b2d28d60b62da3947 Merge: 746ad6b00c4dcd 20a107bca2a16c Author: Bjorn Andersson Date: Wed Mar 25 22:07:52 2026 -0500 Merge branch '20260318-ipq5210_boot_to_shell-v2-1-a87e27c37070@oss.qualcomm.com' into HEAD Merge the IPQ5210 global clock controller DeviceTree binding, in order to gain access to the constants. commit 746ad6b00c4dcda768253f063bfe1c6cbf338444 Author: Manaf Meethalavalappu Pallikunhi Date: Wed Mar 25 16:50:00 2026 +0530 arm64: dts: qcom: sm8750: Enable TSENS and thermal zones The sm8750 includes four TSENS instances, with a total of 47 thermal sensors distributed across various locations on the SoC. The TSENS max/reset threshold is configured to 130°C in the hardware. Enable all TSENS instances, and define the thermal zones with a hot trip at 120°C and critical trip at 125°C. Signed-off-by: Manaf Meethalavalappu Pallikunhi Signed-off-by: Gaurav Kohli Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260325-sm8750_tsens-v2-1-8a554e54dc1b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit bcd42e405cae149663157c20080a7c5f5de7c7af Author: Pragnesh Papaniya Date: Wed Mar 25 21:51:51 2026 +0530 arm64: dts: qcom: mahua: Fix mahua bwmon Delete the bwmon node that corresponds to non-existent cpu cluster 2 on Mahua SoCs. Fixes: 598eedb21ddd ("arm64: dts: qcom: Add Mahua SoC and CRD") Tested-by: Gopikrishna Garmidi Signed-off-by: Pragnesh Papaniya Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260325-bwmon_fixes-v1-2-9433f9d4c276@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit bf2a06f36e32a3802842ebc7e1fc87e8e7ce2e72 Author: Pragnesh Papaniya Date: Wed Mar 25 21:51:50 2026 +0530 arm64: dts: qcom: glymur: Add missing opp entry Add missing opp entry that corresponds to highest ddr frequency for Glymur/Mahua SoCs. Fixes: e4945894c1cb ("arm64: dts: qcom: glymur: Add glymur BWMONs") Signed-off-by: Pragnesh Papaniya Link: https://lore.kernel.org/r/20260325-bwmon_fixes-v1-1-9433f9d4c276@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c5b22c88cc09b180e3a23010b29f4d02ec117a44 Author: Viken Dadhaniya Date: Wed Mar 25 18:30:37 2026 +0530 arm64: dts: qcom: lemans: Correct QUP interrupt numbers Fix GIC_SPI interrupt numbers for QUPv3 SE6 nodes on Lemans SoC. Using incorrect interrupt lines can prevent IRQs from triggering and break I2C, SPI, and UART operation. Fixes: 34a407316b7d3 ("arm64: dts: qcom: sa8775p: Populate additional UART DT nodes") Fixes: 1b2d7ad5ac14d ("arm64: dts: qcom: sa8775p: add missing spi nodes") Fixes: ee2f5f906d69d ("arm64: dts: qcom: sa8775p: add missing i2c nodes") Cc: stable@vger.kernel.org Signed-off-by: Viken Dadhaniya Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260325-lemans-irq-num-v1-1-a470d544966a@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit aad054ab206ac71bc0d951dbf14a7fe1b212f096 Author: Krzysztof Kozlowski Date: Tue Mar 10 14:08:48 2026 +0100 arm64: dts: qcom: qrb5165-rb5: Drop redundant non-controllable supplies Drop completely redundant non-controllable chain of "regulator-fixed" supplies, which serve no purpose except growing DTS and kernel boot time. They represent no added value and because of being completely transparent for any users of DTS (except the bloat), they should not be represented in DTS, just like we do not represent every transistor there. For the few regulators being actively used and supplied by removed dummies, change the supply to match the actual final source without these dummy intermediaries. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260310-qcom-dts-supplies-v1-5-5071a7052ea9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d568df4fde3da60c684799e3b9eb68313c5cd5eb Author: Krzysztof Kozlowski Date: Tue Mar 10 14:08:47 2026 +0100 arm64: dts: qcom: qrb4210-rb2: Drop redundant non-controllable supplies Drop completely redundant non-controllable chain of "regulator-fixed" supplies, which serve no purpose except growing DTS and kernel boot time. They represent no added value and because of being completely transparent for any users of DTS (except the bloat), they should not be represented in DTS, just like we do not represent every transistor there. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260310-qcom-dts-supplies-v1-4-5071a7052ea9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 657317a5807d49ea54334c11384607cee0102fbc Author: Krzysztof Kozlowski Date: Tue Mar 10 14:08:46 2026 +0100 arm64: dts: qcom: qrb2210-rb1: Drop redundant non-controllable supplies Drop completely redundant non-controllable chain of "regulator-fixed" supplies, which serve no purpose except growing DTS and kernel boot time. They represent no added value and because of being completely transparent for any users of DTS (except the bloat), they should not be represented in DTS, just like we do not represent every transistor there. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260310-qcom-dts-supplies-v1-3-5071a7052ea9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 733a768eb8e1137381aeb1c9a748b786e8e164d1 Author: Krzysztof Kozlowski Date: Tue Mar 10 14:08:45 2026 +0100 arm64: dts: qcom: qcs615-ride: Drop redundant non-controllable supplies Drop completely redundant non-controllable chain of "regulator-fixed" supplies, which serve no purpose except growing DTS and kernel boot time. They represent no added value and because of being completely transparent for any users of DTS (except the bloat), they should not be represented in DTS, just like we do not represent every transistor there. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260310-qcom-dts-supplies-v1-2-5071a7052ea9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 02e92424f6dcda432734f4f2258183c4be45b57a Author: Krzysztof Kozlowski Date: Tue Mar 10 14:08:44 2026 +0100 arm64: dts: qcom: lemans-ride: Drop redundant non-controllable supplies Drop completely redundant non-controllable chain of "regulator-fixed" supplies, which serve no purpose except growing DTS and kernel boot time. They represent no added value and because of being completely transparent for any users of DTS (except the bloat), they should not be represented in DTS, just like we do not represent every transistor there. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260310-qcom-dts-supplies-v1-1-5071a7052ea9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1328665d28de5e8caa2a800f7c38a7177a62b4c8 Author: Krzysztof Kozlowski Date: Tue Mar 10 14:03:23 2026 +0100 arm64: dts: qcom: sm8650: Drop redundant VSYNC pin state The active and suspend pin state of VSYNC is exactly the same, so just use one node for both states. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260310-qcom-dts-redundant-pins-v1-5-98e2ef430717@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 040118364258bb470f0b0e1dcf45bbcdd64b9761 Author: Krzysztof Kozlowski Date: Tue Mar 10 14:03:22 2026 +0100 arm64: dts: qcom: sm8550: Drop redundant VSYNC pin state The active and suspend pin state of VSYNC is exactly the same, so just use one node for both states. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260310-qcom-dts-redundant-pins-v1-4-98e2ef430717@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 6143662888db05ca4afcc8ecd6fcf6add178e17a Author: Krzysztof Kozlowski Date: Tue Mar 10 14:03:21 2026 +0100 arm64: dts: qcom: sdm845-axolotl: Drop redundant VSYNC pin state The active and suspend pin state of VSYNC is exactly the same, so just use one node for both states. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260310-qcom-dts-redundant-pins-v1-3-98e2ef430717@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c0f7cd7b14ff8a7cc2f07673e76e1bce44b61a88 Author: Krzysztof Kozlowski Date: Tue Mar 10 14:03:20 2026 +0100 arm64: dts: qcom: msm8998: Drop redundant VSYNC pin state The active and suspend pin state of VSYNC is exactly the same, so just use one node for both states. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260310-qcom-dts-redundant-pins-v1-2-98e2ef430717@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 778b5aa8a249be4be38a896b7f10042853e5d2af Author: Krzysztof Kozlowski Date: Tue Mar 10 14:03:19 2026 +0100 arm64: dts: qcom: msm8996: Drop redundant VSYNC pin state The active and suspend pin state of VSYNC is exactly the same, so just use one node for both states. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260310-qcom-dts-redundant-pins-v1-1-98e2ef430717@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 34219ea5994aba653d8298b09820002095681f78 Author: Md Sadre Alam Date: Fri Mar 6 17:09:40 2026 +0530 arm64: dts: qcom: pq5332-rdp-common: Enable QPIC SPI NAND support Enable QPIC SPI NAND flash controller support on the IPQ5332 reference design platform. Reviewed-by: Konrad Dybcio Signed-off-by: Md Sadre Alam Link: https://lore.kernel.org/r/20260306113940.1654304-5-quic_mdalam@quicinc.com Signed-off-by: Bjorn Andersson commit f879314bff96b563c9d3a6811013799ae641ee81 Author: Md Sadre Alam Date: Fri Mar 6 17:09:39 2026 +0530 arm64: dts: qcom: ipq5424-rdp466: Enable QPIC SPI NAND support Enable QPIC SPI NAND flash controller support on the IPQ5424 RDP466 reference design platform. The RDP466 board features a SPI NAND flash device connected to the QPIC controller for primary storage. This patch enables the QPIC BAM DMA controller and SPI NAND interface of QPIC, and configures the necessary pin control settings for proper operation. Reviewed-by: Konrad Dybcio Signed-off-by: Md Sadre Alam Link: https://lore.kernel.org/r/20260306113940.1654304-4-quic_mdalam@quicinc.com Signed-off-by: Bjorn Andersson commit 2a3cd909b8a4c7c4360413cf78e01ba2970fbba4 Author: Md Sadre Alam Date: Fri Mar 6 17:09:38 2026 +0530 arm64: dts: qcom: ipq5332: Add QPIC SPI NAND controller support Add device tree nodes for QPIC SPI NAND flash controller support on IPQ5332 SoC. The IPQ5332 SoC includes a QPIC controller that supports SPI NAND flash devices with hardware ECC capabilities and DMA support through BAM (Bus Access Manager). Signed-off-by: Md Sadre Alam Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260306113940.1654304-3-quic_mdalam@quicinc.com Signed-off-by: Bjorn Andersson commit 0f4990c86810028fb970872d1624a409b91f097d Author: Md Sadre Alam Date: Fri Mar 6 17:09:37 2026 +0530 arm64: dts: qcom: ipq5424: Add QPIC SPI NAND controller support Add device tree nodes for QPIC SPI NAND flash controller support on IPQ5424 SoC. The IPQ5424 SoC includes a QPIC controller that supports SPI NAND flash devices with hardware ECC capabilities and DMA support through BAM (Bus Access Manager). Reviewed-by: Konrad Dybcio Signed-off-by: Md Sadre Alam Link: https://lore.kernel.org/r/20260306113940.1654304-2-quic_mdalam@quicinc.com Signed-off-by: Bjorn Andersson commit 766617011b6e8cab221b242a1a7a0caa11cfad20 Author: Swati Agarwal Date: Fri Mar 6 14:43:55 2026 +0530 arm64: dts: qcom: lemans-evk: Enable the tertiary USB controller Enable the tertiary usb controller connected to micro usb port in OTG mode on Lemans EVK platform. Reviewed-by: Konrad Dybcio Signed-off-by: Swati Agarwal Link: https://lore.kernel.org/r/20260306091355.1178333-5-swati.agarwal@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0e2e3818404d014f4640d7abd5cf732a73fcec8b Author: Swati Agarwal Date: Fri Mar 6 14:43:54 2026 +0530 arm64: dts: qcom: lemans: Add role-switch support and HS endpoint for tertiary USB controller Enable usb-role-switch for the tertiary USB controller on Lemans. Additionally, add a port node with an HS endpoint so the controller can be linked through the DT graph to the corresponding connector. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Swati Agarwal Link: https://lore.kernel.org/r/20260306091355.1178333-4-swati.agarwal@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f87af8fe83c6b4f7d0472dcebf611eef3d009430 Author: Swati Agarwal Date: Fri Mar 6 14:43:53 2026 +0530 arm64: dts: qcom: lemans-evk: Rename vbus regulator for Primary USB controller Rename vbus regulator for Primary USB controller as per Lemans EVK schematics. Reviewed-by: Konrad Dybcio Signed-off-by: Swati Agarwal Link: https://lore.kernel.org/r/20260306091355.1178333-3-swati.agarwal@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 845ea0fca67bb8833356a550251fc3833752a9de Author: Swati Agarwal Date: Fri Mar 6 14:43:52 2026 +0530 arm64: dts: qcom: lemans-evk: Enable GPIO expander interrupt for Lemans EVK Enable PCA9538 expander as interrupt controller on Lemans EVK and configure the corresponding TLMM pins via pinctrl to operate as GPIO inputs with internal pull-ups. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Swati Agarwal Link: https://lore.kernel.org/r/20260306091355.1178333-2-swati.agarwal@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 581fc5d5ade68c0c43c432cbfdf244f3877ef1e5 Author: Konrad Dybcio Date: Thu Mar 5 11:55:46 2026 +0100 arm64: dts: qcom: sm8650: Explicitly describe the IPA IMEM slice As part of stepping away from crazy hardcoding in the driver, move define the slice explicitly and pass it to the IPA node. Reviewed-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260305-topic-ipa_mem_dts-v2-7-5cb5b90902bf@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c864afc8e9f18caeb4ee64fa8340e16cd0c894c4 Author: Konrad Dybcio Date: Thu Mar 5 11:55:45 2026 +0100 arm64: dts: qcom: sm8550: Explicitly describe the IPA IMEM slice As part of stepping away from crazy hardcoding in the driver, move define the slice explicitly and pass it to the IPA node. Reviewed-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260305-topic-ipa_mem_dts-v2-6-5cb5b90902bf@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d168d147d705d41c19958b994404a7e35102107b Author: Konrad Dybcio Date: Thu Mar 5 11:55:44 2026 +0100 arm64: dts: qcom: sm8350: Explicitly describe the IPA IMEM slice As part of stepping away from crazy hardcoding in the driver, move define the slice explicitly and pass it to the IPA node. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260305-topic-ipa_mem_dts-v2-5-5cb5b90902bf@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit bf8abf362bfea323ec11609aeae6f916a714d037 Author: Konrad Dybcio Date: Thu Mar 5 11:55:43 2026 +0100 arm64: dts: qcom: sm6350: Explicitly describe the IPA IMEM slice As part of stepping away from crazy hardcoding in the driver, move define the slice explicitly and pass it to the IPA node. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260305-topic-ipa_mem_dts-v2-4-5cb5b90902bf@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a418e4f8b79e9096af751c3d1b3a224718d8ad13 Author: Konrad Dybcio Date: Thu Mar 5 11:55:42 2026 +0100 arm64: dts: qcom: sdm845: Explicitly describe the IPA IMEM slice As part of stepping away from crazy hardcoding in the driver, move define the slice explicitly and pass it to the IPA node. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260305-topic-ipa_mem_dts-v2-3-5cb5b90902bf@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit fdef6bddf79585cf06bdc05baca4915235ae0023 Author: Konrad Dybcio Date: Thu Mar 5 11:55:41 2026 +0100 arm64: dts: qcom: sc7280: Explicitly describe the IPA IMEM slice As part of stepping away from crazy hardcoding in the driver, move define the slice explicitly and pass it to the IPA node. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260305-topic-ipa_mem_dts-v2-2-5cb5b90902bf@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 67eb57330166a411c00863434d381b7b32d96b34 Author: Konrad Dybcio Date: Thu Mar 5 11:55:40 2026 +0100 arm64: dts: qcom: sc7180: Explicitly describe the IPA IMEM slice As part of stepping away from crazy hardcoding in the driver, move define the slice explicitly and pass it to the IPA node. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260305-topic-ipa_mem_dts-v2-1-5cb5b90902bf@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b64abb26a2916e33cc9dcc00a48fa31fef255697 Author: Umang Chheda Date: Wed Mar 4 22:29:25 2026 +0530 arm64: dts: qcom: lemans-evk: Add IFP Mezzanine The Interface Plus [IFP] Mezzanine is an hardware expansion add-on board designed to be stacked on top of Lemans EVK. It has following peripherals : - 4x Type A USB ports in host mode. - TC9563 PCIe switch, which has following three downstream ports (DSP) : - 1st DSP is routed to an M.2 E-key connector, intended for WLAN modules. - 2nd DSP is routed to an M.2 B-key connector, intended for cellular modems. - 3rd DSP with support for Dual Ethernet ports. - eMMC. - Additional 2.5GbE Ethernet PHY connected to native EMAC with support for MAC Address configuration via NVMEM. - EEPROM. - LVDS Display. - 2*mini DP. Add support for following peripherals : - TC9563 PCIe Switch. - Additional 2.5GbE Ethernet Port. - EEPROM. Enable support for USB hub, LVDS display and mini-DP later once dependent changes are available in lemans-evk core-kit. Written with inputs from : Mohd Ayaan Anwar - Ethernet. Krishna Chaitanya Chundru - PCIe Monish Chunara - EEPROM. Signed-off-by: Umang Chheda Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260304165925.1535938-2-umang.chheda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5a67924d2fc5787d894bdbd8a87ad6794487060d Author: Umang Chheda Date: Tue Mar 3 22:13:14 2026 +0530 arm64: dts: qcom: monaco-evk: Add IFP Mezzanine The IFP Mezzanine is an hardware expansion add-on board designed to be stacked on top of Monaco EVK. It has following peripherals : - 4x Type A USB ports in host mode. - TC9563 PCIe switch, which has following three downstream ports (DSP) : - 1st DSP is routed to an M.2 E-Key connector, intended for WLAN modules. - 2nd DSP is routed to an M.2 B-key connector, intended for cellular modems. - 3rd DSP with support for Dual Ethernet ports. - EEPROM. - LVDS Display. - 2*mini DP. Add support for following peripherals : - TC9563 PCIe Switch. - EEPROM. Enable support for USB hub, LVDS display and mini-DP later once dependent changes are available in monaco-evk core-kit. Written with inputs from : Krishna Chaitanya Chundru - PCIe Monish Chunara - EEPROM. Signed-off-by: Umang Chheda Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260303164314.886733-2-umang.chheda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 01022af2d218a307163d14a2479cfcd4105245c8 Author: Dmitry Baryshkov Date: Sat Jan 31 15:58:50 2026 +0200 arm64: dts: qcom: sc7280-chrome-common: disable Venus Iris driver doesn't support non-PAS/TZ setup for setting up the Iris core. It's expected that the ABI that is going to be used in a long-term would be different from the defined venus-firmware subnode. Granted that the SC7280 Chromebooks were cancelled before reaching wide audience and granted the feature ABI changes, drop venus configuration for SC7280 ChromeOS devices. Suggested-by: Stephan Gerhold Cc: Douglas Anderson Reviewed-by: Konrad Dybcio Acked-by: Douglas Anderson Acked-by: Krzysztof Kozlowski Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260131-venus-iris-flip-switch-v4-1-e10b886771e1@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8cec14e690039a54a27952bf91200d7a5dc45664 Author: Dmitry Baryshkov Date: Tue Jan 6 03:01:24 2026 +0200 arm64: dts: qcom: sm8150-hdk: describe WiFi/BT properly Properly describe the PMU present as a part of the onboard WCN3998 WiFi/BT chip. Enable Bluetooth part of the chip too. [ 5.479978] Bluetooth: hci0: setting up wcn399x [ 5.633763] Bluetooth: hci0: QCA Product ID :0x0000000a [ 5.645350] Bluetooth: hci0: QCA SOC Version :0x40010224 [ 5.650906] Bluetooth: hci0: QCA ROM Version :0x00001001 [ 5.665173] Bluetooth: hci0: QCA Patch Version:0x00006699 [ 5.679356] Bluetooth: hci0: QCA controller version 0x02241001 [ 5.691109] Bluetooth: hci0: QCA Downloading qca/crbtfw21.tlv [ 6.680102] Bluetooth: hci0: QCA Downloading qca/crnv21.bin [ 6.842948] Bluetooth: hci0: QCA setup on UART is completed [ 81.510709] ath10k_snoc 18800000.wifi: qmi chip_id 0x30224 chip_family 0x4001 board_id 0x55 soc_id 0x40060000 [ 81.521713] ath10k_snoc 18800000.wifi: qmi fw_version 0x32040163 fw_build_timestamp 2019-10-08 05:42 fw_build_id QC_IMAGE_VERSION_STRING=WLAN.HL.3.2.0-00355-QCAHLSWMTPLZ-1 [ 81.554143] ath10k_snoc 18800000.wifi: failed to fetch board data for bus=snoc,qmi-board-id=55,qmi-chip-id=30224,variant=Qualcomm_sm8150hdk from ath10k/WCN3990/hw1.0/board-2.bin [ 85.467464] ath10k_snoc 18800000.wifi: wcn3990 hw1.0 target 0x00000008 chip_id 0x00000000 sub 0000:0000 [ 85.478132] ath10k_snoc 18800000.wifi: kconfig debug 0 debugfs 0 tracing 0 dfs 0 testmode 0 [ 85.487223] ath10k_snoc 18800000.wifi: firmware ver api 5 features wowlan,mgmt-tx-by-reference,non-bmi crc32 b3d4b790 [ 85.758168] ath10k_snoc 18800000.wifi: htt-ver 3.73 wmi-op 4 htt-op 3 cal file max-sta 32 raw 0 hwcrypto 1 [ 85.901630] ath10k_snoc 18800000.wifi: invalid MAC address; choosing random Reviewed-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260106-wcn3990-pwrctl-v2-14-0386204328be@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a8aef26417963f66a98f03f5473033fc2b022863 Author: Dmitry Baryshkov Date: Tue Jan 6 03:01:23 2026 +0200 arm64: dts: qcom: sdm845-db845c: describe WiFi/BT properly The onboard WiFi / BT device, WCN3990, has a simple on-chip PMU, which further spreads generated voltage. Describe the PMU in the device tree. Reviewed-by: Bartosz Golaszewski Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260106-wcn3990-pwrctl-v2-13-0386204328be@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c81ed57f613986df12009024c2674be1953bf6c9 Author: Dmitry Baryshkov Date: Tue Jan 6 03:01:22 2026 +0200 arm64: dts: qcom: sda660-ifc6560: describe WiFi/BT properly The onboard WiFi / BT device, WCN3990, has a simple on-chip PMU, which further spreads generated voltage. Describe the PMU in the device tree. Reviewed-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260106-wcn3990-pwrctl-v2-12-0386204328be@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 60664dddd1abf32d6d5a7fa54b7a20fc06fe3a4c Author: Dmitry Baryshkov Date: Tue Jan 6 03:01:21 2026 +0200 arm64: dts: qcom: qrb4210-rb2: describe WiFi/BT properly The onboard WiFi / BT device, WCN3988, has a simple on-chip PMU, which further spreads generated voltage. Describe the PMU in the device tree. Reviewed-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260106-wcn3990-pwrctl-v2-11-0386204328be@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f985b64096cf37b1548dfada6c1a698e3bb3ac4d Author: Dmitry Baryshkov Date: Tue Jan 6 03:01:20 2026 +0200 arm64: dts: qcom: qrb2210-rb1: describe WiFi/BT properly The onboard WiFi / BT device, WCN3950, has a simple on-chip PMU, which further spreads generated voltage. Describe the PMU in the device tree. Reviewed-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260106-wcn3990-pwrctl-v2-10-0386204328be@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 707c7592486ef62d736af1a135fadf478cf665fa Author: Barnabás Czémán Date: Sun Mar 15 17:26:24 2026 +0100 arm64: dts: qcom: Add Redmi Go Redmi Go (tiare) is like Redmi 5A with small differences like charging, fuel gauge and different speaker codec. Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260315-riva-common-v3-6-897f130786ed@mainlining.org Signed-off-by: Bjorn Andersson commit fc24904b93e22757ba54215d174b17ec3d656522 Author: Barnabás Czémán Date: Sun Mar 15 17:26:23 2026 +0100 arm64: dts: qcom: Add Redmi 4A Redmi 4A (rolex) is like Redmi 5A with small differences like charging, fuel gauge, different speaker codec configuration and display. Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260315-riva-common-v3-5-897f130786ed@mainlining.org Signed-off-by: Bjorn Andersson commit 0ddd790a9687d35b234fa6a8f6075ea2668d350d Author: Barnabás Czémán Date: Sun Mar 15 17:26:22 2026 +0100 dt-bindings: arm: qcom: Add Redmi 4A and Go Add Redmi 4A (rolex) and Redmi Go (tiare). Acked-by: Krzysztof Kozlowski Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260315-riva-common-v3-4-897f130786ed@mainlining.org Signed-off-by: Bjorn Andersson commit f6a8c753ed6a37489e3c34376d842fc53f650f10 Author: Barnabás Czémán Date: Sun Mar 15 17:26:21 2026 +0100 arm64: dts: qcom: msm8917-xiaomi-wingtech: Add goodix touch There are variants from MSM8917 wingtech xiaomis what are using goodix touch controller instead of focaltech. Add goodix node for make it able to use touch on all variants. Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260315-riva-common-v3-3-897f130786ed@mainlining.org Signed-off-by: Bjorn Andersson commit d6ec51450938f486ec4c98449e8de0b87ea4881a Author: Barnabás Czémán Date: Sun Mar 15 17:26:20 2026 +0100 arm64: dts: qcom: Make a common base from Redmi 5A Redmi 5A was made by wingtech like Redmi 4A (rolex) and Redmi GO (tiare). They are very similar, make a common base from riva for avoid unnecessary code duplications. Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260315-riva-common-v3-2-897f130786ed@mainlining.org Signed-off-by: Bjorn Andersson commit a49cd243503c528ea99e31a7853cf438ccc9032d Author: Barnabás Czémán Date: Sun Mar 15 17:26:19 2026 +0100 arm64: dts: qcom: msm8917-xiaomi-riva: Fix board-id for all bootloader Redmi 5A comes with multiple bootloader versions where the expected board-id is different. Change the board-id to unified form what works on both bootloader version. Fixes: 26633b582056 ("arm64: dts: qcom: Add Xiaomi Redmi 5A") Reviewed-by: Konrad Dybcio Signed-off-by: Barnabás Czémán Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260315-riva-common-v3-1-897f130786ed@mainlining.org Signed-off-by: Bjorn Andersson commit 1b052060bde83bd53974c2da564f6cd4ee273121 Author: Luca Weiss Date: Thu Mar 19 09:23:19 2026 +0100 arm64: dts: qcom: milos-fairphone-fp6: Enable UFS Configure and enable the nodes for UFS, so that we can access the internal storage. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20260319-milos-ufs-v3-2-b7c60bdd0d48@fairphone.com Signed-off-by: Bjorn Andersson commit 04bb37433330ef49e5939d78298ce8615744e076 Author: Luca Weiss Date: Thu Mar 19 09:23:18 2026 +0100 arm64: dts: qcom: milos: Add UFS nodes Add the nodes for the UFS PHY and UFS host controller, along with the ICE used for UFS. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20260319-milos-ufs-v3-1-b7c60bdd0d48@fairphone.com Signed-off-by: Bjorn Andersson commit df260487f33c8583bb78a28ef98b3b6c49265860 Author: KancyJoe Date: Thu Mar 19 09:55:11 2026 +0100 arm64: dts: qcom: add basic devicetree for Ayaneo Pocket S2 gaming console Add initial Device Tree for the Ayaneo Pocket S2 gaming console based on the Qualcomm Snapdragon 8 Gen 3 platform. The design is similar to a phone without the modem, the game control is handled via a standalone controller connected to a PCIe USB controller. Display panel support will be added in a second time. Signed-off-by: KancyJoe Reviewed-by: Konrad Dybcio Reviewed-by: Bartosz Golaszewski Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20260319-topic-sm8650-ayaneo-pocket-s2-base-v6-5-797bf96df771@linaro.org Signed-off-by: Bjorn Andersson commit d5391c94cf48fff33fe3d79e50c6354b8c636f87 Author: Neil Armstrong Date: Thu Mar 19 09:55:10 2026 +0100 arm64: dts: qcom: sm8650: Add sound DAI prefix for DP Sound DAI devices exposing same set of mixers, e.g. each DisplayPort controller, need to add dedicated prefix for these mixers to avoid conflicts and to allow ALSA to properly configure given instance. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Bartosz Golaszewski Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20260319-topic-sm8650-ayaneo-pocket-s2-base-v6-4-797bf96df771@linaro.org Signed-off-by: Bjorn Andersson commit f05914ec14e0aa43e5335ed1a1462d9a1a5a48f5 Author: Neil Armstrong Date: Thu Mar 19 09:55:09 2026 +0100 dt-bindings: arm: qcom: document the Ayaneo Pocket S2 Document the Qualcomm SM8650 based Ayaneo Pocket S2 gaming console. Acked-by: Rob Herring (Arm) Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20260319-topic-sm8650-ayaneo-pocket-s2-base-v6-3-797bf96df771@linaro.org Signed-off-by: Bjorn Andersson commit d24dbb3ea5f1dbce4b7f4fb7b6a5dfb094cb45a2 Author: Neil Armstrong Date: Thu Mar 19 09:55:08 2026 +0100 dt-binding: vendor-prefixes: document the Ayaneo brand Document the Ayaneo from the Anyun Intelligent Technology (Hong Kong) Co., Ltd company. Website: https://www.ayaneo.com/product/ayaneobrand.html Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20260319-topic-sm8650-ayaneo-pocket-s2-base-v6-2-797bf96df771@linaro.org Signed-off-by: Bjorn Andersson commit 3b0dd81eea6b7a239fce456ce4545af76f1a9715 Author: David Heidelberg Date: Fri Mar 20 18:33:11 2026 +0100 arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot The regulator must be on, since it provides the display subsystem and therefore the bootloader had turned it on before Linux booted. Fixes: 77809cf74a8c ("arm64: dts: qcom: Add support for Xiaomi Poco F1 (Beryllium)") Signed-off-by: David Heidelberg Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260320-beryllium-booton-v2-1-931d1be21eae@ixit.cz Signed-off-by: Bjorn Andersson commit 4793de55d313baeefd86db2107ab88847344b8a5 Author: Krishna Kurapati Date: Mon Mar 23 16:01:19 2026 +0530 arm64: dts: qcom: hamoa/purwa: Flatten usb controller nodes Flatten usb controller nodes and update to using latest bindings and flattened driver approach. Tested this patch on CRD platform. For testing purpose, modified dr_mode property and added usb-role-switch property to the 3 super speed capable DRD controllers and valdiated both host and device mode. Also validated host mode on the multiport controller. Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/20260323103119.1801139-1-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 80de83eafd9a22a7c06c79bf06bc74a01c5a691e Author: Sarthak Garg Date: Mon Mar 23 16:30:17 2026 +0530 arm64: dts: qcom: purwa-iot-evk: Add SDC2 node for purwa iot evk board Enable SD Card host controller for purwa iot evk board. Signed-off-by: Sarthak Garg Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260323110017.2527956-1-sarthak.garg@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit be7c1badb0b934cfe88427b1d4ec3eb9f52ba587 Author: Luca Weiss Date: Thu Mar 19 09:55:00 2026 +0100 arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl The pinctrl nodes from sm6350.dtsi already contain a bias-* property, so that needs to be deleted, otherwise the dtb will contain two conflicting bias-* properties. Reported-by: Conor Dooley Closes: https://lore.kernel.org/r/20260310-maritime-silly-05e7b7e03aa6@spud/ Fixes: c4ef464b24c5 ("arm64: dts: qcom: sm7225-fairphone-fp4: Add Bluetooth") Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20260319-fp4-uart1-fix-v1-1-f6b3fedef583@fairphone.com Signed-off-by: Bjorn Andersson commit e50db17fe84626540d8bf4528d5ccba0215d443d Author: Vishnu Saini Date: Thu Mar 19 00:38:19 2026 +0530 arm64: dts: qcom: monaco-evk: add lt8713sx bridge with displayport Monaco-evk has LT8713sx which act as DP to 3 DP output converter. Edp PHY from monaco soc is connected to lt8713sx as input and output of lt8713sx is connected to 3 mini DP ports. Two ports are available in mainboard and one port is available on Mezz board. lt8713sx is connected to soc over i2c0 and with reset gpio connected to pin6 of ioexpander5. Enable the edp nodes from monaco and enable lontium lt8713sx bridge node. Co-developed-by: Prahlad Valluru Signed-off-by: Prahlad Valluru Signed-off-by: Vishnu Saini Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260319-lt8713sx-bridge-linux-for-next-v4-1-da886ec78fe3@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3272916a7c9f15825365a78322d2dd921a3f7733 Author: Luca Weiss Date: Fri Mar 6 15:22:18 2026 +0100 arm64: dts: qcom: milos: Add LPASS LPI pinctrl node Add a node for the LPASS LPI pinctrl found on the Milos SoC and define a few pinctrl states that will be used in the future. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20260306-milos-pinctrl-lpi-v1-4-086946dbb855@fairphone.com Signed-off-by: Bjorn Andersson commit d54331131cde21ae5be18e4c0fb089d0e107e72f Author: Petr Hodina Date: Tue Jan 20 13:24:25 2026 +0100 arm64: dts: qcom: sdm845-sony-xperia-tama: Add bluetooth Enable the bluetooth interface on the uart6 Reviewed-by: Dmitry Baryshkov Signed-off-by: Petr Hodina Reviewed-by: Konrad Dybcio Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20260120-akatsuki-uart-v2-2-867ee7f042d0@protonmail.com Signed-off-by: Bjorn Andersson commit 1a20b7da1295384fcdca267790dd08b4633fd4ca Author: Petr Hodina Date: Tue Jan 20 13:24:24 2026 +0100 arm64: dts: qcom: sdm845-sony-xperia-tama: Correct uart instances Change the uart instances: - uart6 is for bluetooth - uart9 is for serial console (available on the uSD pinout) Most OSes assume serial0 is for console UART. Bluetooth interface uses UART interface. uart6 is standard debug console and uart9 bluetooth on SDM845 devices. Reviewed-by: Konrad Dybcio Reviewed-by: David Heidelberg Signed-off-by: Petr Hodina Link: https://lore.kernel.org/r/20260120-akatsuki-uart-v2-1-867ee7f042d0@protonmail.com Signed-off-by: Bjorn Andersson commit 456ce97ccc73b32b774c154513e9a3e4c0606bbc Author: Gergo Koteles Date: Thu Nov 13 17:02:59 2025 +0100 arm64: dts: qcom: sdm845-oneplus: Add alert-slider The alert-slider is a tri-state sound profile switch found on the OnePlus 6, Android maps the states to "silent", "vibrate" and "ring". Expose them as ABS_SND_PROFILE events. The previous GPIO numbers were wrong. Update them to the correct ones. Co-developed-by: Casey Connolly Signed-off-by: Casey Connolly Signed-off-by: Gergo Koteles Reviewed-by: Konrad Dybcio Tested-by: Guido Günther # oneplus,fajita & oneplus,enchilada Reviewed-by: Guido Günther Signed-off-by: David Heidelberg Reviewed-by: Pavel Machek Link: https://lore.kernel.org/r/20251113-op6-tri-state-v8-2-54073f3874bc@ixit.cz Signed-off-by: Bjorn Andersson commit e6bf559f7eb92858795b7aaecf67ad98dbb43a49 Author: Abel Vesa Date: Fri Mar 20 13:35:03 2026 +0200 arm64: dts: qcom: glymur-crd: Enable keyboard, trackpad and touchscreen On CRD, the keyboard, trackpad and touchscreen are connected over I2C and all share a 3.3V regulator. So describe the regulator and each input device along with their pinctrl states. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260320-glymur-dts-crd-enable-kbd-tp-ts-v6-1-626d008534d9@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit db08965820b4199b703a29aa019b021e9ef1dbf8 Author: Abel Vesa Date: Fri Mar 20 13:16:44 2026 +0200 arm64: dts: qcom: glymur-crd: Enable eDP display support Enable the MDSS (Mobile Display SubSystem), the third DisplayPort controller, and its PHY to drive the onboard eDP panel on the Glymur CRD platform. Also describe the regulator supplying panel power. Signed-off-by: Abel Vesa Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260320-dts-qcom-glymur-crd-add-edp-v7-2-ca415560447e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 652b7210b8b92eaf121d4ed12f99e81cedbacb0a Author: Abel Vesa Date: Fri Mar 20 13:16:43 2026 +0200 arm64: dts: qcom: glymur: Describe display-related nodes The MDSS (Mobile Display SubSystem) on Glymur provides four DisplayPort controllers. Describe them together with the display controller and eDP PHY. Also add the combo PHY link and vco_div clocks to the display clock controller, and connect the PHYs and DP endpoints in the graph. Signed-off-by: Abel Vesa Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260320-dts-qcom-glymur-crd-add-edp-v7-1-ca415560447e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c8b63029455b88627b9c28584cf882037c476d79 Author: Wesley Cheng Date: Fri Mar 20 12:56:53 2026 +0200 arm64: dts: qcom: glymur-crd: Enable USB support The Qualcomm Glymur Compute Reference Device comes with two Type-C ports, one USB Type-A port, and a fingerprint reader connected over USB. Each Type-C port is connected to one USB combo PHY and one M31 eUSB2 PHY. The Type-A port is connected to the USB multi-port controller through one M31 eUSB2 PHY and one USB3 UNI PHY. The fingerprint reader is connected to the USB_2 controller. All M31 eUSB2 PHYs have associated eUSB2-to-USB 2.0 repeaters, which are either integrated in SMB2370 PMICs or provided by dedicated NXP PTN3222 devices. Enable all required controllers, PHYs, and repeaters, while specifying their supplies. Also describe the PMIC GLINK graph for the Type-C connectors. Signed-off-by: Wesley Cheng Co-developed-by: Abel Vesa Reviewed-by: Konrad Dybcio Tested-by: Pankaj Patil Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260320-dts-qcom-glymur-add-usb-support-v7-2-ba367eda6010@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4eee57dd4df9f388cb2d7369205e1d51b83c341b Author: Wesley Cheng Date: Fri Mar 20 12:56:52 2026 +0200 arm64: dts: qcom: glymur: Add USB related nodes The Glymur USB subsystem contains three USB 3.2 Gen 2 controllers, one USB 3.2 multi-port controller, and one USB 2.0-only controller. This includes five SS USB QMP PHYs (three combo and two UNI) and six M31 eUSB2 PHYs. All controllers are based on SNPS DWC3, so describe them as Qualcomm flattened DWC3 nodes. Signed-off-by: Wesley Cheng Co-developed-by: Abel Vesa Reviewed-by: Konrad Dybcio Tested-by: Pankaj Patil Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260320-dts-qcom-glymur-add-usb-support-v7-1-ba367eda6010@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 73b24193e71a7bb934c21e660e8f331960e2cfd0 Author: Pragnesh Papaniya Date: Mon Mar 2 17:16:56 2026 +0530 arm64: dts: qcom: glymur: Add glymur BWMONs Add the CPU BWMON nodes for glymur SoCs. Co-developed-by: Sibi Sankar Signed-off-by: Sibi Sankar Signed-off-by: Pragnesh Papaniya Link: https://lore.kernel.org/r/20260302-glymur_bwmon_dt-v1-1-f4939d75bd47@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 06d6965d229226e79f3cc4bd25434d002e516e61 Author: Yuanjie Yang Date: Sun Mar 22 23:19:46 2026 -0700 arm64: dts: qcom: kaanapali-mtp: Enable display DSI devices Enable MDSS/DPU/DSI0 and add Novatek NT37801 panel on Kaanapali MTP board. NT37801 Spec V1.0 chapter "5.7.1 Power On Sequence" states VDDI ranges 1.65V~1.95V, but ldo12 ranges 1.2V~1.8V, so change ldo12 range to 1.65V~1.8V. pmh0110_d_e0_gpios and pmh0110_f_e0_gpios are configured for level shifters. Kaanapali need configure these pinctrl for panel function. Signed-off-by: Yuanjie Yang Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260322-knp-pmic-dt-v1-6-70bc40ea4428@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 855b7da59d8eedfca7c0415bc8e8a61e5d176196 Author: Yuanjie Yang Date: Sun Mar 22 23:19:45 2026 -0700 arm64: dts: qcom: kaanapali: add display hardware devices Add MDSS/MDP/DSI controllers and DSI PHYs for Kaanapali. DP controllers are not included. Signed-off-by: Yuanjie Yang Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260322-knp-pmic-dt-v1-5-70bc40ea4428@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 28327eec75ad83873047f1bfa3ff301d9cacb0fc Author: Zijun Hu Date: Sun Mar 22 23:19:44 2026 -0700 arm64: dts: qcom: kaanapali-mtp: Enable bluetooth and Wifi Enable bluetooth WCN785x and Wi-Fi on Kaanapali MTP board. Co-developed-by: Yijie Yang Signed-off-by: Yijie Yang Signed-off-by: Zijun Hu Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260322-knp-pmic-dt-v1-4-70bc40ea4428@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit cb6763a078f052cda54e3058c3448b3bdddcfe7a Author: Jishnu Prakash Date: Sun Mar 22 23:19:43 2026 -0700 arm64: dts: qcom: kaanapali-qrd: Add PMIC support Include PMIC files used on Kaanapali QRD boards. Add configurations for keys (volume up and volume down), RGB LEDs and flash LEDs. Reviewed-by: Konrad Dybcio Reviewed-by: Shawn Guo Signed-off-by: Jishnu Prakash Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260322-knp-pmic-dt-v1-3-70bc40ea4428@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 45ddb3f3c28940aab9c84a7b9dea5f76358c90f7 Author: Jishnu Prakash Date: Sun Mar 22 23:19:42 2026 -0700 arm64: dts: qcom: kaanapali-mtp: Add PMIC support Include PMIC files used on Kaanapali MTP boards. Add configurations for keys (volume up and volume down), RGB LEDs and flash LEDs. Reviewed-by: Konrad Dybcio Reviewed-by: Shawn Guo Signed-off-by: Jishnu Prakash Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260322-knp-pmic-dt-v1-2-70bc40ea4428@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit fe2a1e9de3a7223b075d8b888c6b58341f10e8f3 Author: Jishnu Prakash Date: Sun Mar 22 23:19:41 2026 -0700 arm64: dts: qcom: kaanapali: Add PMIC devices Add a spmi-pmic-arb device for the SPMI PMIC arbiter found on Kaanapali. It has two subnodes corresponding to the SPMI0 bus controller and the SPMI1 bus controller. Also add dtsi files for PMH0104, PMH0110, PMD8028, PMIH0108, PMR735D and PM8010 along with temp-alarm and GPIO nodes under them, which are needed on Kaanapali. Signed-off-by: Jishnu Prakash Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260322-knp-pmic-dt-v1-1-70bc40ea4428@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1ee6f0fa1dd9f49651feeb4784e08d1fd1a9f474 Author: Taniya Das Date: Tue Feb 24 23:19:24 2026 -0800 arm64: dts: qcom: kaanapali: Add support for MM clock controllers for Kaanapali Add the device nodes for the multimedia clock controllers (cambistmclkcc, camcc, dispcc, videocc, gpucc and gxclkctl). Signed-off-by: Taniya Das Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260224-knp-dts-misc-v6-9-79d20dab8a60@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 25b3a0d85fc27108a41e71cb7ad7117ca334bdb0 Author: Prasad Kumpatla Date: Tue Feb 24 23:19:23 2026 -0800 arm64: dts: qcom: kaanapali-mtp: Add audio support (WSA8845, WCD9395, DMIC) Add support for audio on the Kaanapali MTP platform by introducing device tree nodes for WSA8845 smart speaker amplifier for playback, DMIC microphone for capture, and sound card routing. The WCD9395 codec is add to supply MIC-BIAS, for enabling onboard microphone capture. Signed-off-by: Prasad Kumpatla Reviewed-by: Konrad Dybcio Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260224-knp-dts-misc-v6-8-79d20dab8a60@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d9cf70c91a25c3f7fe58d2ba7d13b5c60c5c81ca Author: Jingyi Wang Date: Tue Feb 24 23:19:22 2026 -0800 arm64: dts: qcom: kaanapali-qrd: Enable ADSP and CDSP Enable ADSP and CDSP on Kaanapali QRD board. Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260224-knp-dts-misc-v6-7-79d20dab8a60@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 181a339087e98c5663a094065d2bdb0a42b68638 Author: Jingyi Wang Date: Tue Feb 24 23:19:21 2026 -0800 arm64: dts: qcom: kaanapali-mtp: Enable ADSP and CDSP Enable ADSP and CDSP on Kaanapali MTP board. Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260224-knp-dts-misc-v6-6-79d20dab8a60@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f037fd005f04ae234b4162bb751902a153a71df9 Author: Prasad Kumpatla Date: Tue Feb 24 23:19:20 2026 -0800 arm64: dts: qcom: kaanapali: Add support for audio Introduce audio support for Kaanapali SoC by adding LPASS macro codecs, TLMM pin controller and SoundWire controller with similar hardware implementation to SM8750 platform. Also add GPR (Generic Pack Router) node along with support for APM (Audio Process Manager) and PRM (Proxy Resource Manager) audio services. Signed-off-by: Prasad Kumpatla Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260224-knp-dts-misc-v6-5-79d20dab8a60@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit bc7b4b4ab2f05d5a4d29d3514f25be6d59dee2aa Author: Jingyi Wang Date: Tue Feb 24 23:19:19 2026 -0800 arm64: dts: qcom: kaanapali: Add ADSP and CDSP for Kaanapali SoC Add remoteproc PAS loader for ADSP and CDSP with its SMP2P and fastrpc nodes. Co-developed-by: Kumari Pallavi Signed-off-by: Kumari Pallavi Reviewed-by: Dmitry Baryshkov Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260224-knp-dts-misc-v6-4-79d20dab8a60@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 366ab28df00aa21ec1d3fd9fa3ff6a72b549f890 Author: Manaf Meethalavalappu Pallikunhi Date: Tue Feb 24 23:19:18 2026 -0800 arm64: dts: qcom: kaanapali: Add TSENS and thermal zones The Kaanapali includes seven TSENS instances, with a total of 55 thermal sensors distributed across various locations on the SoC. The TSENS max/reset threshold is configured to 130°C in the hardware. Enable all TSENS instances, and define the thermal zones with a hot trip at 120°C and critical trip at 125°C. Signed-off-by: Manaf Meethalavalappu Pallikunhi Reviewed-by: Konrad Dybcio Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260224-knp-dts-misc-v6-3-79d20dab8a60@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2f96483435e9deb8bebf677298fbe6b0cf28ef95 Author: Jyothi Kumar Seerapu Date: Tue Feb 24 23:19:17 2026 -0800 arm64: dts: qcom: kaanapali: Add QUPv3 configuration for serial engines Add device tree support for QUPv3 serial engine protocols on Kaanapali. Kaanapali has 24 QUP serial engines across 4 QUP wrappers, each with support of GPI DMA engines, and it also includes 5 I2C hubs. Signed-off-by: Jyothi Kumar Seerapu Reviewed-by: Dmitry Baryshkov Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260224-knp-dts-misc-v6-2-79d20dab8a60@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f73959d86c1573777a72ce878a26a1c1cb451ef9 Author: Jie Gan Date: Tue Feb 24 23:19:16 2026 -0800 arm64: dts: qcom: kaanapali: add coresight nodes Add CoreSight nodes to enable trace paths such as TPDM->ETF and STM->ETF. These devices are part of the AOSS, CDSP, QDSS, modem and some small subsystems, such as DCC, GCC, ipcc and so on. Signed-off-by: Jie Gan Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260224-knp-dts-misc-v6-1-79d20dab8a60@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 94e223bf12fb12a07ab371a7fa5b4e50959b46df Author: Pradeep P V K Date: Wed Feb 11 18:59:26 2026 +0530 arm64: dts: qcom: hamoa-iot-evk: Enable UFS Enable UFS for HAMOA-IOT-EVK board. Reviewed-by: Konrad Dybcio Reviewed-by: Manivannan Sadhasivam Signed-off-by: Pradeep P V K Link: https://lore.kernel.org/r/20260211132926.3716716-4-pradeep.pragallapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9d405544da9147057175f468b3fe0d11e13eae51 Author: Pradeep P V K Date: Wed Feb 11 18:59:25 2026 +0530 arm64: dts: qcom: hamoa: Add UFS nodes for x1e80100 SoC Add UFS host controller and PHY nodes for x1e80100 SoC. Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Reviewed-by: Taniya Das Reviewed-by: Manivannan Sadhasivam Signed-off-by: Pradeep P V K Link: https://lore.kernel.org/r/20260211132926.3716716-3-pradeep.pragallapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 70e3a6120ef7d3943be4ab291031d0bf10a954ab Author: Loic Poulain Date: Fri Mar 13 10:38:21 2026 +0000 arm64: dts: qcom: Add Arduino Monza (VENTUNO Q) board support Add device tree support for the Arduino VENTUNO Q board, based on the Qualcomm QCS8300 (Monaco) SoC. The board features a Qualcomm Monza SoM and integrates various peripherals, including: - USB Type‑C connector with dual‑role support - ADV7535 DSI‑to‑HDMI bridge - MAX98091 audio codec - 2.5G Ethernet PHY (HSGMII) - PCIe0 (to onboard WiFi chipset and USB bridge) - PCIe1 (to M2/nvme) - Button (via GPIO‑keys) Signed-off-by: Loic Poulain Co-developed-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260313103824.2634519-7-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f2915f6721e770ea7a00cf20c6488ac1f95d826f Author: Loic Poulain Date: Fri Mar 13 10:38:20 2026 +0000 dt-bindings: arm: qcom: add Arduino Monza, VENTUNO Q Document Arduino monza, VENTUNO Q codename. It combines Monaco based SoM with STMicroelectronics STM32H5 microcontroller. Signed-off-by: Loic Poulain Co-developed-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260313103824.2634519-6-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5238f4e7169fe908379ef991e320b1641c21fcbe Author: Loic Poulain Date: Fri Mar 13 10:38:19 2026 +0000 arm64: dts: qcom: Add Monaco Monza SoM The Monaco Monza SoM is a compact computing module that integrates a Monaco/QCS8300 System on Chip (SoC), along with essential components optimized for IoT applications. It is designed to be mounted on carrier boards, enabling the development of complete embedded systems. The following components are described: - Fixed S2S 1.8V rail - PMM8654AU RPMh regulators (PMIC A and PMIC C) - Display subsystem/phy supplies (DSI, DP) - Enable GPU, GPI DMA, IRIS - PCIe Gen4 for both controllers and PHY supply hookups - QUPv3 firmware declarations - REFGEN always-on workaround for USB2 HS PHY - Remoteproc firmware names for ADSP, CDSP and GPDSP - Ethernet SERDES supplies - USB HS/SS PHY regulators - On-SoM eMMC Signed-off-by: Loic Poulain Co-developed-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260313103824.2634519-5-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit faf08fd43411d8ebcc30bd96a05ac4aa31aac66b Author: Srinivas Kandagatla Date: Fri Mar 13 10:38:18 2026 +0000 arm64: dts: qcom: monaco: add dt entry for lpass lpi pinctrl Add LPASS LPI pinctrl node used for setting MI2S and soundwire pin configs. Co-developed-by: Loic Poulain Signed-off-by: Loic Poulain Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260313103824.2634519-4-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2f5a32f4488ea9ea9ce50d0946ab88cf86e8b3b8 Author: Srinivas Kandagatla Date: Fri Mar 13 10:38:17 2026 +0000 arm64: dts: qcom: monaco: Add missing usb-role-switch property Add missing usb-role-switch property to usb controller node. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260313103824.2634519-3-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7ceeb30c33ce1e33cfc4087e8370df4801ce82bd Author: Loic Poulain Date: Fri Mar 13 10:38:16 2026 +0000 arm64: dts: qcom: monaco: Add HS/SS endpoints for USB1 controller Add a port node exposing the High‑Speed and Super‑Speed endpoints, allowing the USB controller to be linked through the device‑tree graph. Signed-off-by: Loic Poulain Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260313103824.2634519-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0b63fb8c3e085df3118192e688ed98b91cfc1c87 Author: Paul Adam Date: Wed Mar 11 19:46:07 2026 +0100 arm64: dts: qcom: msm8916-wiko-chuppito: add initial devicetree Add an initial device tree for Wiko PULP 4G. Includes support for: - UART - USB (no OTG) - Internal storage - MicroSD - Volume keys + Power button - Touchscreen - Backlight - Accelerometer: Invensense MPU6880 - Magnetometer: Asahi Kasei AK09911 - Hall sensor: Rohm BU52021HFV - Proximity sensor - Vibrator - Earpiece - Microphone 1 - Headphones - Wifi - Bluetooth - GPU Signed-off-by: Paul Adam Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260311-wiko-chuppito-v5-3-0a8656cca1b3@posteo.de Signed-off-by: Bjorn Andersson commit 598e1f16d80cf2e4429bff973bf4e90219ce01ef Author: Paul Adam Date: Wed Mar 11 19:46:06 2026 +0100 dt-bindings: arm: qcom: add wiko,chuppito compatible string Add a compatible for Wiko PULP 4G, a phone from 2015. Acked-by: Krzysztof Kozlowski Signed-off-by: Paul Adam Link: https://lore.kernel.org/r/20260311-wiko-chuppito-v5-2-0a8656cca1b3@posteo.de Signed-off-by: Bjorn Andersson commit e8d7d22ae4449e35d8e3e14378efb8ba45fe6b2c Author: Paul Adam Date: Wed Mar 11 19:46:05 2026 +0100 dt-bindings: vendor-prefixes: add WIKO SAS Wiko is a french smartphone company: https://wiko.com Acked-by: Krzysztof Kozlowski Signed-off-by: Paul Adam Link: https://lore.kernel.org/r/20260311-wiko-chuppito-v5-1-0a8656cca1b3@posteo.de Signed-off-by: Bjorn Andersson commit 6e4043dd98ad803277dbb72ba365ee2f7ce32059 Author: Sushrut Shree Trivedi Date: Tue Mar 17 13:07:08 2026 +0530 arm64: dts: qcom: qcs6490-rb3gen2-industrial-mezzanine: Add second TC9563 PCIe switch node for PCIe1 Add a node for the second TC9563 PCIe switch on PCIe1, which is connected in cascade to the first TC9563 switch via the former's downstream port. Two embedded Ethernet devices are present on one of the downstream ports of this second switch as well. All the ports present in the node represent the downstream ports and embedded endpoints. The second TC9563 is powered up via the same LDO regulators as the first one, and these can be controlled via two GPIOs, which are already present as fixed regulators. This TC9563 can also be configured through I2C. Signed-off-by: Sushrut Shree Trivedi Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260317-industrial-mezzanine-pcie-v5-2-1358978517fe@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4559b435f741bb6389a30aa440307729a018ce92 Author: Sushrut Shree Trivedi Date: Tue Mar 17 13:07:07 2026 +0530 arm64: dts: qcom: qcs6490-rb3gen2-industrial-mezzanine: Add TC9563 PCIe switch node for PCIe0 Add a node for the TC9563 PCIe switch connected to PCIe0. The switch has three downstream ports.Two embedded Ethernet devices are present on one of the downstream ports. The other downstream ports route to M.2 E key and PCIe x4 connector respectively. All the ports present in the node represent the downstream ports and embedded endpoints. Power to the TC9563 is supplied through two LDO regulators, which are on by default and are added as fixed regulators. TC9563 can be configured through I2C. Since PCIe0 now routes to TC9563 instead of WCN6750, disable the WCN6750 and WPSS device tree nodes to reflect the actual hardware configuration and avoid probing issues. Signed-off-by: Sushrut Shree Trivedi Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260317-industrial-mezzanine-pcie-v5-1-1358978517fe@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 93f823e7d48232e62fb8fb74481696609c90244a Author: Vladimir Zapolskiy Date: Sat Mar 14 04:37:15 2026 +0200 arm64: dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes The restriction on UHS-I speed modes was added to all SM8650 platforms by copying it from SM8450 and SM8550 dtsi files, and it was an actually reproducible problem due to the overclocking of SD cards. Since the latter issue has been fixed in the SM8650 GCC driver, UHS-I speed modes are working fine on SM8650 boards, below is the test performed on SM8650-HDK: SDR50 speed mode: mmc0: new UHS-I speed SDR50 SDHC card at address 0001 mmcblk0: mmc0:0001 00000 14.6 GiB mmcblk0: p1 % dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024 1024+0 records in 1024+0 records out 1073741824 bytes (1.1 GB, 1.0 GiB) copied, 24.8086 s, 43.3 MB/s SDR104 speed mode: mmc0: new UHS-I speed SDR104 SDHC card at address 59b4 mmcblk0: mmc0:59b4 USDU1 28.3 GiB mmcblk0: p1 % dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024 1024+0 records in 1024+0 records out 1073741824 bytes (1.1 GB, 1.0 GiB) copied, 12.9448 s, 82.9 MB/s Unset the UHS-I speed mode restrictions from the SM8550 platform dtsi file, there is no indication that the SDHC controller is broken. Fixes: 10e024671295 ("arm64: dts: qcom: sm8650: add interconnect dependent device nodes") Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Signed-off-by: Vladimir Zapolskiy Link: https://lore.kernel.org/r/20260314023715.357512-7-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit 66b0f024fba0728ddce6916dce173bb1bdd4eab0 Author: Vladimir Zapolskiy Date: Sat Mar 14 04:37:14 2026 +0200 arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes The restriction on UHS-I speed modes was added to all SM8550 platforms by copying it from SM8450 dtsi file, and due to the overclocking of SD cards it was an actually reproducible problem. Since the latter issue has been fixed, UHS-I speed modes are working fine on SM8550 boards, below is the test performed on SM8550-HDK: SDR50 speed mode: mmc0: new UHS-I speed SDR50 SDHC card at address 0001 mmcblk0: mmc0:0001 00000 14.6 GiB mmcblk0: p1 % dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024 1024+0 records in 1024+0 records out 1073741824 bytes (1.1 GB, 1.0 GiB) copied, 23.5468 s, 45.6 MB/s SDR104 speed mode: mmc0: new UHS-I speed SDR104 SDHC card at address 59b4 mmcblk0: mmc0:59b4 USDU1 28.3 GiB mmcblk0: p1 % dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024 1024+0 records in 1024+0 records out 1073741824 bytes (1.1 GB, 1.0 GiB) copied, 11.9819 s, 89.6 MB/s Unset the UHS-I speed mode restrictions from the SM8550 platform dtsi file, there is no indication that the SDHC controller is broken. Fixes: ffc50b2d3828 ("arm64: dts: qcom: Add base SM8550 dtsi") Reviewed-by: Neil Armstrong Signed-off-by: Vladimir Zapolskiy Link: https://lore.kernel.org/r/20260314023715.357512-6-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit db0c5ef1abda6effdc5c85d6688fb6af2b351ae5 Author: Vladimir Zapolskiy Date: Sat Mar 14 04:37:13 2026 +0200 arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes The reported problem of some non-working UHS-I speed modes on SM8450 originates in commit 0a631a36f724 ("arm64: dts: qcom: Add device tree for Sony Xperia 1 IV"), and then it was spread to all SM8450 powered platforms by commit 9d561dc4e5cc ("arm64: dts: qcom: sm8450: disable SDHCI SDR104/SDR50 on all boards"). The tests show that the rootcause of the problem was related to an overclocking of SD cards, and it's fixed later on by commit a27ac3806b0a ("clk: qcom: gcc-sm8450: Use floor ops for SDCC RCGs"). Since then both SDR50 and SDR104 speed modes are working fine on SM8450, tested on SM8450-HDK: SDR50 speed mode: mmc0: new UHS-I speed SDR50 SDHC card at address 0001 mmcblk0: mmc0:0001 00000 14.6 GiB mmcblk0: p1 % dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024 1024+0 records in 1024+0 records out 1073741824 bytes (1.1 GB, 1.0 GiB) copied, 24.6254 s, 43.6 MB/s SDR104 speed mode: mmc0: new UHS-I speed SDR104 SDHC card at address 59b4 mmcblk0: mmc0:59b4 USDU1 28.3 GiB mmcblk0: p1 % dd if=/dev/mmcblk0p1 of=/dev/null bs=1M count=1024 1024+0 records in 1024+0 records out 1073741824 bytes (1.1 GB, 1.0 GiB) copied, 12.3266 s, 87.1 MB/s Remove the restrictions on SD card speed modes from the SM8450 platform dtsi file and enable UHS-I speed modes. Fixes: 9d561dc4e5cc ("arm64: dts: qcom: sm8450: disable SDHCI SDR104/SDR50 on all boards") Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Signed-off-by: Vladimir Zapolskiy Link: https://lore.kernel.org/r/20260314023715.357512-5-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit d094f79960e1da20c1380083c95945371baa3668 Author: Vladimir Zapolskiy Date: Sat Mar 14 04:37:12 2026 +0200 arm64: dts: qcom: hamoa: Fix xo clock supply of platform SD host controller The expected frequency of SD host controller core supply clock is 19.2MHz, while RPMH_CXO_CLK clock frequency on SM8650 platform is 38.4MHz. Apparently the overclocked supply clock could be good enough on some boards and even with the most of SD cards, however some low-end UHS-I SD cards in SDR104 mode of the host controller produce I/O errors in runtime, fortunately this problem is gone, if the "xo" clock frequency matches the expected 19.2MHz clock rate. Fixes: ffb21c1e19b1 ("arm64: dts: qcom: x1e80100: Describe the SDHC controllers") Reported-by: Neil Armstrong Signed-off-by: Vladimir Zapolskiy Reviewed-by: Konrad Dybcio Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20260314023715.357512-4-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit 390903efaa057c44fd80e7d9839419c50092018e Author: Vladimir Zapolskiy Date: Sat Mar 14 04:37:11 2026 +0200 arm64: dts: qcom: sm8650: Fix xo clock supply of SD host controller The expected frequency of SD host controller core supply clock is 19.2MHz, while RPMH_CXO_CLK clock frequency on SM8650 platform is 38.4MHz. Apparently the overclocked supply clock could be good enough on some boards and even with the most of SD cards, however some low-end UHS-I SD cards in SDR104 mode of the host controller produce I/O errors in runtime, fortunately this problem is gone, if the "xo" clock frequency matches the expected 19.2MHz clock rate. Fixes: 10e024671295 ("arm64: dts: qcom: sm8650: add interconnect dependent device nodes") Signed-off-by: Vladimir Zapolskiy Reviewed-by: Konrad Dybcio Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20260314023715.357512-3-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit 30ac651c69bddbc83cab6d52fc5d2e03bed83282 Author: Vladimir Zapolskiy Date: Sat Mar 14 04:37:10 2026 +0200 arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller The expected frequency of SD host controller core supply clock is 19.2MHz, while RPMH_CXO_CLK clock frequency on SM8650 platform is 38.4MHz. Apparently the overclocked supply clock could be good enough on some boards and even with the most of SD cards, however some low-end UHS-I SD cards in SDR104 mode of the host controller produce I/O errors in runtime, fortunately this problem is gone, if the "xo" clock frequency matches the expected 19.2MHz clock rate. Fixes: ffc50b2d3828 ("arm64: dts: qcom: Add base SM8550 dtsi") Signed-off-by: Vladimir Zapolskiy Reviewed-by: Konrad Dybcio Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20260314023715.357512-2-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit c2f1f8874fda674af1efaa9a90efbdea8b6834ff Author: Konrad Dybcio Date: Tue Mar 17 15:41:19 2026 +0100 arm64: dts: qcom: sm8750: Fix GIC_ITS range length Currently, the GITS_SGIR register is cut off. Fix it up. Fixes: 068c3d3c83be ("arm64: dts: qcom: Add base SM8750 dtsi") Signed-off-by: Konrad Dybcio Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260317-topic-its_range_fixup-v1-6-49be8076adb1@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 6c8e2ca1263d0da5976418ed285eaec430e8d87f Author: Konrad Dybcio Date: Tue Mar 17 15:41:18 2026 +0100 arm64: dts: qcom: sm8650: Fix GIC_ITS range length Currently, the GITS_SGIR register is cut off. Fix it up. Fixes: d2350377997f ("arm64: dts: qcom: add initial SM8650 dtsi") Signed-off-by: Konrad Dybcio Reviewed-by: Neil Armstrong Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260317-topic-its_range_fixup-v1-5-49be8076adb1@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 357c559e386705609b6b9dc0544c420e3f91f3a0 Author: Konrad Dybcio Date: Tue Mar 17 15:41:17 2026 +0100 arm64: dts: qcom: sm8550: Fix GIC_ITS range length Currently, the GITS_SGIR register is cut off. Fix it up. Fixes: ffc50b2d3828 ("arm64: dts: qcom: Add base SM8550 dtsi") Signed-off-by: Konrad Dybcio Reviewed-by: Neil Armstrong Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260317-topic-its_range_fixup-v1-4-49be8076adb1@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 14044fa192c50265bc1f636108371044bbdcf7b7 Author: Konrad Dybcio Date: Tue Mar 17 15:41:16 2026 +0100 arm64: dts: qcom: sm8450: Fix GIC_ITS range length Currently, the GITS_SGIR register is cut off. Fix it up. Fixes: fc8b0b9b630d ("arm64: dts: qcom: sm8450 add ITS device tree node") Signed-off-by: Konrad Dybcio Reviewed-by: Neil Armstrong Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260317-topic-its_range_fixup-v1-3-49be8076adb1@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1831b64854bd8adfccfef4f949534f9e8163293a Author: Konrad Dybcio Date: Tue Mar 17 15:41:15 2026 +0100 arm64: dts: qcom: milos: Fix GIC_ITS range length Currently, the GITS_SGIR register is cut off. Fix it up. Fixes: d9d59d105f98 ("arm64: dts: qcom: Add initial Milos dtsi") Signed-off-by: Konrad Dybcio Reviewed-by: Luca Weiss Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260317-topic-its_range_fixup-v1-2-49be8076adb1@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 51cf2818376f5ebbc5f8753d5be547b1e7206021 Author: Konrad Dybcio Date: Tue Mar 17 15:41:14 2026 +0100 arm64: dts: qcom: kaanapali: Fix GIC_ITS range length Currently, the GITS_SGIR register is cut off. Fix it up. Fixes: 2eeb5767d53f ("arm64: dts: qcom: Introduce Kaanapali SoC") Signed-off-by: Konrad Dybcio Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260317-topic-its_range_fixup-v1-1-49be8076adb1@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f54b2d81a7255f6fbb92cb738c5e615d5d3c0d92 Author: Krzysztof Kozlowski Date: Tue Mar 17 18:08:22 2026 +0100 arm64: dts: qcom: sm8750-mtp: Enable DisplayPort over USB Hook up DisplayPort parts over Type-C USB on MTP8750. Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260317-sm8750-display-dts-v5-4-fb53371e251c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 79dd160c673294a7cc655b8af129ea068bf6528f Author: Krzysztof Kozlowski Date: Tue Mar 17 18:08:21 2026 +0100 arm64: dts: qcom: sm8750-mtp: Enable USB headset and Type-C accessory mode MTP8750 does not have audio jack connected and relies on USB mux (WCD9395). Add necessary nodes for proper audio headset support along with USB Type-C accessory mode and orientation. Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260317-sm8750-display-dts-v5-3-fb53371e251c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 20a76121163049fabc97669ca428bc28101074d4 Author: Krzysztof Kozlowski Date: Tue Mar 17 18:08:20 2026 +0100 arm64: dts: qcom: sm8750-mtp: Enable display Enable display on MTP8750 board with Novatek NT37801 panel. Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260317-sm8750-display-dts-v5-2-fb53371e251c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 818ae2b389bc51ceb66f00a2ff0ad05fd3423408 Author: Krzysztof Kozlowski Date: Tue Mar 17 18:08:19 2026 +0100 arm64: dts: qcom: sm8750: Add display (MDSS) with Display CC Add device nodes for entire display: MDSS, DPU, DSI, DSI PHYs, DisplayPort and Display Clock Controller. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260317-sm8750-display-dts-v5-1-fb53371e251c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2755bdd02a43c204fb0ca02b93787a863c1cf9d2 Author: Dmitry Baryshkov Date: Fri Mar 13 17:27:13 2026 +0200 arm64: dts: qcom: sm8750: correct Iris corners for the MXC rail The corners of the MVS0 / MVS0C clocks on the MMCX rail don't always match the PLL corners on the MXC rail. Correct the performance corners for the MXC rail following the PLL documentation. Fixes: c0d11ff90475 ("arm64: dts: qcom: sm8750: Add Iris VPU v3.5") Signed-off-by: Dmitry Baryshkov Reviewed-by: Dikshita Agarwal Link: https://lore.kernel.org/r/20260313-iris-fix-corners-v1-6-32a393c25dda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7c302a2a6c1a4644e798ecfc4e72ddc4acec653f Author: Dmitry Baryshkov Date: Fri Mar 13 17:27:12 2026 +0200 arm64: dts: qcom: sm8650: correct Iris corners for the MXC rail The corners of the MVS0 / MVS0C clocks on the MMCX rail don't always match the PLL corners on the MXC rail. Correct the performance corners for the MXC rail following the PLL documentation. Fixes: 56cf5ad39a55 ("arm64: dts: qcom: sm8650: add iris DT node") Signed-off-by: Dmitry Baryshkov Reviewed-by: Dikshita Agarwal Link: https://lore.kernel.org/r/20260313-iris-fix-corners-v1-5-32a393c25dda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ff8edb5bc8bdf8bdf4573d8dc062b09cc1e6bc76 Author: Dmitry Baryshkov Date: Fri Mar 13 17:27:11 2026 +0200 arm64: dts: qcom: sm8550: correct Iris corners for the MXC rail The corners of the MVS0 / MVS0C clocks on the MMCX rail don't always match the PLL corners on the MXC rail. Correct the performance corners for the MXC rail following the PLL documentation. Fixes: 41661853ae8e ("arm64: dts: qcom: sm8550: add iris DT node") Signed-off-by: Dmitry Baryshkov Reviewed-by: Dikshita Agarwal Link: https://lore.kernel.org/r/20260313-iris-fix-corners-v1-4-32a393c25dda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit bba8d9ba7df8f6592552377049fc84958fd0575a Author: Dmitry Baryshkov Date: Fri Mar 13 17:27:10 2026 +0200 arm64: dts: qcom: monaco: correct Iris corners for the MXC rail The corners of the MVS0 / MVS0C clocks on the MMCX rail don't always match the PLL corners on the MXC rail. Correct the performance corners for the MXC rail following the PLL documentation. Fixes: bf6ec39c3f36 ("arm64: dts: qcom: qcs8300: add video node") Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260313-iris-fix-corners-v1-3-32a393c25dda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 85a6cf5ef8cf6e6de948fbba56101fa05049417f Author: Dmitry Baryshkov Date: Fri Mar 13 17:27:09 2026 +0200 arm64: dts: qcom: lemans: correct Iris corners for the MXC rail The corners of the MVS0 / MVS0C clocks on the MMCX rail don't always match the PLL corners on the MXC rail. Correct the performance corners for the MXC rail following the PLL documentation. Fixes: 7bc95052c64f ("arm64: dts: qcom: sa8775p: add support for video node") Signed-off-by: Dmitry Baryshkov Reviewed-by: Dikshita Agarwal Link: https://lore.kernel.org/r/20260313-iris-fix-corners-v1-2-32a393c25dda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit baac8b5e43f42b632b912a6a837d94fd5bca48f2 Author: Dmitry Baryshkov Date: Fri Mar 13 17:27:08 2026 +0200 arm64: dts: qcom: hamoa: correct Iris corners for the MXC rail The corners of the MVS0 / MVS0C clocks on the MMCX rail don't always match the PLL corners on the MXC rail. Correct the performance corners for the MXC rail following the PLL documentation. Fixes: 9065340ac04d ("arm64: dts: qcom: x1e80100: Add IRIS video codec") Signed-off-by: Dmitry Baryshkov Reviewed-by: Dikshita Agarwal Link: https://lore.kernel.org/r/20260313-iris-fix-corners-v1-1-32a393c25dda@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit cf11d156133b7f3955121056f694f1cc822c0ee7 Author: Luca Weiss Date: Fri Mar 6 15:01:20 2026 +0100 arm64: dts: qcom: milos: add ADSP GPR Add the ADSP Generic Packet Router (GPR) device node as part of audio subsystem in Qualcomm Milos SoC. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260306-milos-fastrpc-gpr-v1-2-893eb98869ce@fairphone.com Signed-off-by: Bjorn Andersson commit a6a2c01db720b90c97080287906bbc05b8d637c0 Author: Luca Weiss Date: Fri Mar 6 15:01:19 2026 +0100 arm64: dts: qcom: milos: Add fastrpc nodes Add fastrpc nodes for both ADSP and CDSP. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260306-milos-fastrpc-gpr-v1-1-893eb98869ce@fairphone.com Signed-off-by: Bjorn Andersson commit 2a5d4fc6f3f78554643e557adf95cdf1a75ae5b6 Author: Abel Vesa Date: Wed Mar 18 12:19:34 2026 +0200 arm64: dts: qcom: eliza: Enable Eliza MTP board support The MTP is a one of the boards that comes with the Eliza SoC. So add dedicated board dts for it. The initial support enables: - UART debug console - Ob-board UFS storage - Qualcomm RPMh regulators (PMIC) and VPH_PWR - board specific clocks & reserved GPIO ranges Co-developed-by: Krzysztof Kozlowski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Reviewed-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260318-eliza-base-dt-v3-3-8a50bd2201ed@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit af20af39fc09b5255a3adc2fba4b6d5fe6257c5a Author: Abel Vesa Date: Wed Mar 18 12:19:33 2026 +0200 arm64: dts: qcom: Introduce Eliza Soc base dtsi Introduce the initial support for the Qualcomm Eliza SoC. It comes in different flavors. There is SM7750 for mobiles and then QC7790S/M for IoT. Describe the common parts under a common dtsi. The initial submission enables support for: - CPU nodes with cpufreq and cpuidle support - Global Clock Controller (GCC) - Resource State Coordinator (RSC) with clock controller & genpd provider - Interrupt controller - Power Domain Controller (PDC) - Vendor specific SMMU - SPMI bus arbiter - Top Control and Status Register (TCSR) - Top Level Mode Multiplexer (TLMM) - Debug UART - Reserved memory nodes - Interconnect providers - System timer - UFS Reviewed-by: Dmitry Baryshkov Co-developed-by: Krzysztof Kozlowski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260318-eliza-base-dt-v3-2-8a50bd2201ed@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 38ddb6110d9c8d617f7c2ee8c1731a6faade0761 Author: Abel Vesa Date: Wed Mar 18 12:19:32 2026 +0200 dt-bindings: arm: qcom: Document Eliza SoC and its MTP board Qualcomm Eliza SoC comes with different flavors. There is SM7750 for mobiles and then QC7790S/M for IoT. One of the boards that comes with Eliza SoC is the MTP. So document both the SoC and MTP board compatibles. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260318-eliza-base-dt-v3-1-8a50bd2201ed@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c6d976b89d1dc6e151de029dfd4173650c31996c Merge: c10e71b0b785e6 8300438dc424f3 Author: Bjorn Andersson Date: Wed Mar 18 21:26:37 2026 -0500 Merge branch 'icc-eliza' of https://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into HEAD Merge the Eliza interconnect DeviceTree bindings from topic branch, in order to introduce the interconnect constants used in the Eliza DeviceTree source. commit c10e71b0b785e61c989177f1730f6fac73e13883 Merge: c1014a629d0181 b8a86146da5f33 Author: Bjorn Andersson Date: Wed Mar 18 21:02:40 2026 -0500 Merge branch '20260311-eliza-clocks-v6-1-453c4cf657a2@oss.qualcomm.com' into HEAD Merge Eliza Global, RPMH, and TCSR clock controller bindings from topic branch, in order to gain access to the clock defines. commit c1014a629d0181ce7739caf1448fb8e22d4cba9c Author: Gopikrishna Garmidi Date: Wed Mar 18 05:41:00 2026 -0700 arm64: dts: qcom: Add Mahua SoC and CRD Introduce support for the Mahua SoC and the CRD based on it. Some of the notable differences are the absent CPU cluster, interconnect, TLMM, thermal zones and adjusted PCIe west clocks. Everything else should work as-is. Co-developed-by: Raviteja Laggyshetty Signed-off-by: Raviteja Laggyshetty Co-developed-by: Kamal Wadhwa Signed-off-by: Kamal Wadhwa Co-developed-by: Manaf Meethalavalappu Pallikunhi Signed-off-by: Manaf Meethalavalappu Pallikunhi Signed-off-by: Gopikrishna Garmidi Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260318124100.212992-4-gopikrishna.garmidi@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a5ad8a8e473ce761226b5ff3e26a557c7b74eaf5 Author: Gopikrishna Garmidi Date: Wed Mar 18 05:40:59 2026 -0700 arm64: dts: qcom: Commonize Glymur CRD DTSI Commonize the existing Glymur CRD DTSI to allow reuse with Mahua CRDs. Leave the PCIe3b nodes disabled by default, since the UEFI has the instance disabled to avoid boot delays due to link failures. Signed-off-by: Gopikrishna Garmidi Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260318124100.212992-3-gopikrishna.garmidi@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2c93d2986f3ab13656ec125b50b24e3ab4548102 Author: Gopikrishna Garmidi Date: Wed Mar 18 05:40:58 2026 -0700 dt-bindings: arm: qcom: Document Mahua SoC and board Mahua is a derivative of Glymur SoC with the third CPU cluster disabled. Document the compatible strings for the Mahua SoC and the Compute Reference Device (CRD) board based on it. Signed-off-by: Gopikrishna Garmidi Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260318124100.212992-2-gopikrishna.garmidi@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 71ede5c790bc41e22160e9b02adf20267d9d0ece Author: Gaurav Kohli Date: Mon Mar 2 17:00:28 2026 +0530 arm64: dts: qcom: hamoa-iot-evk: Update TSENS thermal zone configuration Hamoa IOT boards support a different thermal junction temperature specification compared to the base Hamoa platform due to package level differences. Update the passive trip thresholds to 105°C to align with the higher temperature specification. Signed-off-by: Gaurav Kohli Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260302-higher_tj-v1-1-4c0d288f8e7f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ca4d6e4b83fe5f89cfcca0589769e22daec70720 Author: Wei Deng Date: Mon Mar 2 08:16:58 2026 +0530 arm64: dts: qcom: qcs8300-ride: Enable Bluetooth support Enable BT on qcs8300-ride by adding a BT device tree node. Since the platform uses the QCA6698 Bluetooth chip. While the QCA6698 shares the same IP core as the WCN6855, it has different RF components and RAM sizes, requiring new firmware files. Use the firmware-name property to specify the NVM and rampatch firmware to load. Reviewed-by: Konrad Dybcio Signed-off-by: Wei Deng Reviewed-by: Bartosz Golaszewski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260302024658.2836798-1-wei.deng@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1752a96fe7becad90c2d971f8d2ba585c030dc78 Author: Wei Zhang Date: Tue Feb 24 23:14:59 2026 -0800 arm64: dts: qcom: qcs8300-ride: enable WLAN on qcs8300-ride Enable WLAN on qcs8300-ride by adding a node for the PMU module of the WCN6855 and assigning its LDO power outputs to the existing WiFi module. On the qcs8300-ride platform, the corresponding firmware and BDF are QCA6698AQ instead of WCN6855, which have been added in the 20250211 release. Signed-off-by: Wei Zhang Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260225071459.1600394-1-wei.zhang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c679452028e7bc4a4e79f0c916c8909974ea8af6 Author: Sarthak Garg Date: Fri Feb 27 09:32:01 2026 +0530 arm64: dts: qcom: hamoa-iot-evk: Add SDC2 node for hamoa iot evk board Enable SD Card host controller for hamoa iot evk board. Signed-off-by: Sarthak Garg Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260227040201.3700324-1-sarthak.garg@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9ffb2dfcc955faa5072cf8de547ae5909544fdad Author: Tobias Heider Date: Thu Feb 26 15:04:30 2026 +0100 arm64: dts: qcom: add missing denali-oled.dtb to Makefile The DeviceTree for the OLED variant of the Microsoft Surface Pro 11th Edition was originally added in commit '0d72ccaa1e84 ("arm64: dts: qcom: Add support for X1-based Surface Pro 11")'. The original patch on the mailing list also added the new device tree to the Makefile but that part seems to have been dropped (by accident) when it got merged. Signed-off-by: Tobias Heider Fixes: 0d72ccaa1e84 ("arm64: dts: qcom: Add support for X1-based Surface Pro 11") Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260226140429.232544-3-tobias.heider@canonical.com [bjorn: Rewrote commit message reference to offending commit] Signed-off-by: Bjorn Andersson commit 6c4b960981ddc676cecd929dd76d6e01bc5c424b Author: Erikas Bitovtas Date: Wed Feb 25 16:43:24 2026 +0200 arm64: dts: qcom: msm8939-asus-z00t: add ambient light and proximity sensor This device uses Capella CM36686 as its ambient light and proximity sensor. It is fully compatible with Vishay VCNL4040. Downstream device tree reports Capella CM36283, but upon probe, a device ID for CM36686 is actually found. This commit adds support for Capella CM36686 ambient light and proximity sensor. Signed-off-by: Erikas Bitovtas Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260225-z00t-capella-sensor-v1-1-99f767bc326a@gmail.com Signed-off-by: Bjorn Andersson commit b2c79f35836ed85de4c7509cf27ff72636fe2853 Author: Biswapriyo Nath Date: Wed Jan 21 13:26:21 2026 +0000 arm64: dts: qcom: pm6125: Enable RTC by default sm6125 soc uses this for real time clock. Signed-off-by: Biswapriyo Nath Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260121-xiaomi-ginkgo-features-v2-5-fb3ee94922d0@gmail.com Signed-off-by: Bjorn Andersson commit 20b50a46157066e20e6700921973a6cb3e93adb7 Author: Biswapriyo Nath Date: Wed Jan 21 13:26:20 2026 +0000 arm64: dts: qcom: sm6125-xiaomi-ginkgo: Enable debug UART Enable the debug uart node in xiaomi ginkgo exposed as test points. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Biswapriyo Nath Link: https://lore.kernel.org/r/20260121-xiaomi-ginkgo-features-v2-4-fb3ee94922d0@gmail.com Signed-off-by: Bjorn Andersson commit ec6896cfa0aed7b2614915fcbf216b324905df26 Author: Biswapriyo Nath Date: Wed Jan 21 13:26:19 2026 +0000 arm64: dts: qcom: sm6125: Add debug UART node qup0 on sm6125 has 6 SEs and SE4 is used as debug uart. The uart node and the associated pinctrl are added here. Reviewed-by: Konrad Dybcio Signed-off-by: Biswapriyo Nath Link: https://lore.kernel.org/r/20260121-xiaomi-ginkgo-features-v2-3-fb3ee94922d0@gmail.com Signed-off-by: Bjorn Andersson commit 0a586c2c8ea1a583af66edc12be089eea9bf4d84 Author: Biswapriyo Nath Date: Wed Jan 21 13:26:18 2026 +0000 arm64: dts: qcom: sm6125: Add PRNG node Add a node for the PRNG to enable hardware accelerated pseudo random number generation. Signed-off-by: Biswapriyo Nath Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260121-xiaomi-ginkgo-features-v2-2-fb3ee94922d0@gmail.com Signed-off-by: Bjorn Andersson commit c0580b57a3d7607a59f60b18d96ea2608c326d8c Author: Biswapriyo Nath Date: Wed Jan 21 13:26:17 2026 +0000 arm64: dts: qcom: sm6125-xiaomi-ginkgo: Fix volume up button gpio6 in pm6125 is used for EMMC and UFS thermal monitoring. It is changed to the correct gpio for volume up button. Fixes: 9b1a6c925c88 ("arm64: dts: qcom: sm6125: Initial support for xiaomi-ginkgo") Reviewed-by: Konrad Dybcio Signed-off-by: Biswapriyo Nath Link: https://lore.kernel.org/r/20260121-xiaomi-ginkgo-features-v2-1-fb3ee94922d0@gmail.com Signed-off-by: Bjorn Andersson commit 95b97fe01097ed2e9e45171c3c5217ff0d047155 Author: Nihal Kumar Gupta Date: Fri Feb 13 18:50:58 2026 +0530 arm64: dts: qcom: monaco-evk-camera: Add DT overlay Monaco EVK board does not include a camera sensor in its default hardware configuration. Introducing a device tree overlay to support optional integration of the IMX577 sensor via CSIPHY1. Camera reset is handled through an I2C expander, and power is enabled via TLMM GPIO74. An example media-ctl pipeline for the imx577 is: media-ctl --reset media-ctl -V '"imx577 3-001a":0[fmt:SRGGB10/4056x3040 field:none]' media-ctl -V '"msm_csiphy1":0[fmt:SRGGB10/4056x3040]' media-ctl -V '"msm_csid0":0[fmt:SRGGB10/4056x3040]' media-ctl -V '"msm_vfe0_rdi0":0[fmt:SRGGB10/4056x3040]' media-ctl -l '"msm_csiphy1":1->"msm_csid0":0[1]' media-ctl -l '"msm_csid0":1->"msm_vfe0_rdi0":0[1]' yavta -B capture-mplane -c -I -n 5 -f SRGGB10P -s 4056x3040 -F /dev/video1 Co-developed-by: Ravi Shankar Signed-off-by: Ravi Shankar Co-developed-by: Vishal Verma Signed-off-by: Vishal Verma Signed-off-by: Nihal Kumar Gupta Reviewed-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260213132058.521474-6-quic_nihalkum@quicinc.com Signed-off-by: Bjorn Andersson commit 66e70dea6576fc1c6aaea90bdc7f2427f069eda2 Author: Nihal Kumar Gupta Date: Fri Feb 13 18:50:57 2026 +0530 arm64: dts: qcom: monaco-evk: Add camera AVDD regulators Define three fixed regulators for camera AVDD rails, each gpio-controlled with corresponding pinctrl definitions. Signed-off-by: Nihal Kumar Gupta Reviewed-by: Konrad Dybcio Reviewed-by: Vladimir Zapolskiy Link: https://lore.kernel.org/r/20260213132058.521474-5-quic_nihalkum@quicinc.com Signed-off-by: Bjorn Andersson commit 14733a228b2e5269109f28852954bab215f85f71 Author: Nihal Kumar Gupta Date: Fri Feb 13 18:50:56 2026 +0530 arm64: dts: qcom: monaco: Add camera MCLK pinctrl Define pinctrl definitions to enable camera master clocks on Monaco. Signed-off-by: Nihal Kumar Gupta Reviewed-by: Konrad Dybcio Reviewed-by: Vladimir Zapolskiy Link: https://lore.kernel.org/r/20260213132058.521474-4-quic_nihalkum@quicinc.com Signed-off-by: Bjorn Andersson commit a16f9d5373880f3ec5004385197e1f51097c46c8 Author: Nihal Kumar Gupta Date: Fri Feb 13 18:50:55 2026 +0530 arm64: dts: qcom: monaco: Add CCI definitions Qualcomm QCS8300 SoC contains three Camera Control Interface (CCI). Compared to Lemans, the key difference is in SDA/SCL GPIO assignments and number of CCIs. Co-developed-by: Ravi Shankar Signed-off-by: Ravi Shankar Co-developed-by: Vishal Verma Signed-off-by: Vishal Verma Co-developed-by: Suresh Vankadara Signed-off-by: Suresh Vankadara Signed-off-by: Nihal Kumar Gupta Reviewed-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260213132058.521474-3-quic_nihalkum@quicinc.com Signed-off-by: Bjorn Andersson commit 9fc67d20c9a6c6d6fe2f859672ead18898d4c45a Author: Luca Weiss Date: Fri Feb 13 15:21:06 2026 +0100 arm64: dts: qcom: milos-fairphone-fp6: Add Hall Effect sensor Add a node for the Hall Effect sensor, used to detect whether the Flip Cover is closed or not. The sensor is powered through vreg_l10b, so let's put a regulator-always-on on that to make sure the sensor gets power. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260213-fp6-hall-sensor-v2-1-ecd113d4919c@fairphone.com Signed-off-by: Bjorn Andersson commit 8540abbf33a1ca04f0ab11b0a5ab651af8ba7632 Author: Ayushi Makhija Date: Tue Feb 17 14:39:55 2026 +0530 arm64: dts: qcom: qcs8300-ride: add anx7625 DSI to DP bridge node Add anx7625 DSI to DP bridge device node. Signed-off-by: Ayushi Makhija Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260217090955.2446470-3-quic_amakhija@quicinc.com Signed-off-by: Bjorn Andersson commit 3333dfc08a769f61ab496efbbe591a286150092e Author: Ayushi Makhija Date: Tue Feb 17 14:39:54 2026 +0530 arm64: dts: qcom: qcs8300: add Display Serial Interface device nodes Add device tree nodes for the DSI0 controller with their corresponding PHY found on Qualcomm QCS8300 SoC. Signed-off-by: Ayushi Makhija Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260217090955.2446470-2-quic_amakhija@quicinc.com Signed-off-by: Bjorn Andersson commit ed9d9012539b09caa8a6b18a625dc4e5b68d4a20 Author: Luca Weiss Date: Fri Feb 13 15:03:19 2026 +0100 arm64: dts: qcom: milos: Sort pinctrl subnodes by pins As documented in the "Devicetree Sources (DTS) Coding Style" document, pinctrl subnodes should be sorted by the pins property. Do this once for milos.dtsi so that future additions can be added at the right places. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260213-milos-pinctrl-sort-v1-1-799bae597074@fairphone.com Signed-off-by: Bjorn Andersson commit d5574bb935e38c208bb7a20acaa4233b935f1ef9 Author: Dmitry Baryshkov Date: Fri Feb 13 19:25:25 2026 +0200 arm64: dts: qcom: qrb2210-arduino-imola: describe DSI / DP bridge Aruino Uno-Q uses Analogix ANX7625 DSI-to-DP bridge to convert DSI signals to the connected USB-C DisplayPort dongles. Decribe the chip, USB-C connector and routing of USB and display signals. Co-developed-by: Martino Facchin Signed-off-by: Martino Facchin Tested-by: Loic Poulain Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260213-uno-q-anx7625-v2-1-c23359616528@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1a040df09fab28b31399fce14a76455b536a2b08 Author: Riccardo Mereu Date: Fri Feb 13 11:10:02 2026 +0100 arm64: dts: qcom: arduino-imola: fix faulty spidev node CS pin added on pinctrl0 property is causing spidev to return -ENODEV since that GPIO is already part of spi5 pinmuxing. Fixes: 3f745bc0f11f ("arm64: dts: qcom: qrb2210: add dts for Arduino unoq") Signed-off-by: Riccardo Mereu Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260213101002.105238-1-r.mereu.kernel@arduino.cc Signed-off-by: Bjorn Andersson commit 99e38f568321ab3a372f952ae11893968c943b7e Author: Xilin Wu Date: Thu Feb 12 10:41:25 2026 -0600 arm64: dts: qcom: sm8550: Add UART15 Add uart15 node for UART bus present on sm8550 SoC. Signed-off-by: Molly Sophia Signed-off-by: Xilin Wu Reviewed-by: Dmitry Baryshkov Signed-off-by: Aaron Kling Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260212-sm8550-uart15-v3-1-b90405f94bec@gmail.com Signed-off-by: Bjorn Andersson commit 8cbbb339048a85f7762ea21ebe96a679347dc0dc Author: Yedaya Katsman Date: Sun Feb 8 23:24:23 2026 +0200 arm64: dts: qcom: sm6125-xiaomi-laurel-sprout: Add Focaltech FT3518 touchscreen Add device tree node for the Focaltech FT3518 touchscreen on Xiaomi Mi A3 (laurel-sprout). Enable qupv3_id_0 and i2c2 bus that the touchscreen is on. Downstream references: Link: https://github.com/MiCode/Xiaomi_Kernel_OpenSource/blob/laurel-r-oss/arch/arm64/boot/dts/qcom/trinket-pinctrl.dtsi Link: https://github.com/MiCode/Xiaomi_Kernel_OpenSource/blob/laurel-r-oss/arch/arm64/boot/dts/qcom/laurel_sprout-qrd.dtsi Co-developed-by: Kamil Gołda Signed-off-by: Kamil Gołda Signed-off-by: Yedaya Katsman Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260208-touchscreen-patches-v5-1-5821dff9c9a2@gmail.com Signed-off-by: Bjorn Andersson commit 09d72b0ef8b99adb6fc999a6f70e160c7ced932d Author: Aleksandrs Vinarskis Date: Wed Feb 11 01:16:25 2026 +0100 arm64: dts: qcom: x1-asus-zenbook-a14: add HDMI port Add HDMI port that utilizes qmpphy via Parade PS185HDM DP-HDMI bridge. Based on commit 34d76723c410 ("arm64: dts: qcom: x1e80100-vivobook-s15: add HDMI port") Signed-off-by: Aleksandrs Vinarskis Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260211-zenbook-a14-improvements-v1-1-d970af6e25a3@vinarskis.com Signed-off-by: Bjorn Andersson commit cb7db0f4010f8b7392b007b803b1b3c718d7baeb Author: Xueyao An Date: Thu Feb 12 16:25:57 2026 +0800 arm64: dts: qcom: hamoa-iot-som: Add firmware-name to QUPv3 nodes Traditionally, firmware loading for Serial Engines (SE) in the QUP hardware of Qualcomm SoCs has been managed by TrustZone (TZ). While this approach ensures secure SE assignment and access control, it limits flexibility for developers who need to enable various protocols on different SEs. Add the firmware-name property to QUPv3 nodes in the device tree to enable firmware loading from the Linux environment. Handle SE assignments and access control permissions directly within Linux, removing the dependency on TrustZone. Signed-off-by: Xueyao An Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260212082558.2811953-1-xueyao.an@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 73feb0d1e24ac31048a04c752b7a1267c7bc7d22 Author: Luca Weiss Date: Wed Feb 11 13:18:57 2026 +0100 arm64: dts: qcom: kodiak: Add I2S1 pinctrl definitions Add the pinctrl definitions to configure gpio6-gpio9 of the lpass_tlmm for I2S output. Co-developed-by: Bharadwaj Raju Signed-off-by: Bharadwaj Raju Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260211-kodiak-i2s1-v1-1-b3a7fad8014e@fairphone.com Signed-off-by: Bjorn Andersson commit bade44fe546212e142befb69ba22f34944030a99 Author: Steven Rostedt Date: Tue Mar 24 14:01:45 2026 -0400 tracing: Move snapshot code out of trace.c and into trace_snapshot.c The trace.c file was a dumping ground for most tracing code. Start organizing it better by moving various functions out into their own files. Move all the snapshot code, including the max trace code into its own trace_snapshot.c file. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260324140145.36352d6a@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit 8ec4e50aa07fe9081c28eec8b29c75441f3f868b Author: Vineeth Pillai (Google) Date: Mon Mar 23 12:00:37 2026 -0400 mm: damon: Use trace_call__##name() at guarded tracepoint call sites Replace trace_damos_stat_after_apply_interval() with trace_call__damos_stat_after_apply_interval() at a site already guarded by an early return when !trace_damos_stat_after_apply_interval_enabled(), avoiding a redundant static_branch_unlikely() re-evaluation inside the tracepoint. Cc: Andrew Morton Link: https://patch.msgid.link/20260323160052.17528-19-vineeth@bitbyteword.org Suggested-by: Steven Rostedt Suggested-by: Peter Zijlstra Signed-off-by: Vineeth Pillai (Google) Reviewed-by: SeongJae Park Signed-off-by: Steven Rostedt (Google) commit d7447f2dce46e1237e7908f49703803ffc0ef19f Author: Vineeth Pillai (Google) Date: Mon Mar 23 12:00:34 2026 -0400 btrfs: Use trace_call__##name() at guarded tracepoint call sites Replace trace_foo() with the new trace_call__foo() at sites already guarded by trace_foo_enabled(), avoiding a redundant static_branch_unlikely() re-evaluation inside the tracepoint. trace_call__foo() calls the tracepoint callbacks directly without utilizing the static branch again. Cc: Chris Mason Link: https://patch.msgid.link/20260323160052.17528-16-vineeth@bitbyteword.org Suggested-by: Steven Rostedt Suggested-by: Peter Zijlstra Signed-off-by: Vineeth Pillai (Google) Assisted-by: Claude:claude-sonnet-4-6 Acked-by: David Sterba Signed-off-by: Steven Rostedt (Google) commit 47f570fcfd5a5a8c58913fee8fa2db2f99591ae9 Author: Vineeth Pillai (Google) Date: Mon Mar 23 12:00:32 2026 -0400 spi: Use trace_call__##name() at guarded tracepoint call sites Replace trace_foo() with the new trace_call__foo() at sites already guarded by trace_foo_enabled(), avoiding a redundant static_branch_unlikely() re-evaluation inside the tracepoint. trace_call__foo() calls the tracepoint callbacks directly without utilizing the static branch again. Cc: Michael Hennerich Cc: Nuno Sá Cc: David Lechner Link: https://patch.msgid.link/20260323160052.17528-14-vineeth@bitbyteword.org Suggested-by: Steven Rostedt Suggested-by: Peter Zijlstra Signed-off-by: Vineeth Pillai (Google) Assisted-by: Claude:claude-sonnet-4-6 Acked-by: Mark Brown Signed-off-by: Steven Rostedt (Google) commit fa9ac2fdb605bbf318bb2cbbc76b855341b7c115 Author: Vineeth Pillai (Google) Date: Mon Mar 23 12:00:31 2026 -0400 i2c: Use trace_call__##name() at guarded tracepoint call sites Replace trace_foo() with the new trace_call__foo() at sites already guarded by trace_foo_enabled(), avoiding a redundant static_branch_unlikely() re-evaluation inside the tracepoint. trace_call__foo() calls the tracepoint callbacks directly without utilizing the static branch again. Link: https://patch.msgid.link/20260323160052.17528-13-vineeth@bitbyteword.org Suggested-by: Steven Rostedt Suggested-by: Peter Zijlstra Signed-off-by: Vineeth Pillai (Google) Assisted-by: Claude:claude-sonnet-4-6 Acked-by: Wolfram Sang Signed-off-by: Steven Rostedt (Google) commit 935a04923ad293cd89bf6ec23fc4efc9cf1a0142 Author: Mickaël Salaün Date: Thu Mar 12 11:04:36 2026 +0100 nsproxy: Add FOR_EACH_NS_TYPE() X-macro and CLONE_NS_ALL Introduce the FOR_EACH_NS_TYPE(X) macro as the single source of truth for the set of (struct type, CLONE_NEW* flag) pairs that define Linux namespace types. Currently, the list of CLONE_NEW* flags is duplicated inline in multiple call sites and would need another copy in each new consumer. This makes it easy to miss one when a new namespace type is added. Derive two things from the X-macro: - CLONE_NS_ALL: Bitmask of all known CLONE_NEW* flags, usable as a validity mask or iteration bound. - ns_common_type(): Rewritten to use the X-macro via a leading-comma _Generic pattern, so the struct-to-flag mapping stays in sync with the flag set automatically. Replace the inline flag enumerations in copy_namespaces(), unshare_nsproxy_namespaces(), check_setns_flags(), and ksys_unshare() with CLONE_NS_ALL. When a new namespace type is added, only FOR_EACH_NS_TYPE needs to be updated; CLONE_NS_ALL, ns_common_type(), and all the call sites pick up the change automatically. Cc: Christian Brauner Cc: Günther Noack Signed-off-by: Mickaël Salaün Link: https://patch.msgid.link/20260312100444.2609563-4-mic@digikod.net Reviewed-by: Christian Brauner Signed-off-by: Christian Brauner commit 3c1fc671d3968e847a20d7c2a4f9997f57e147c7 Merge: 388727ef1cdb5b 2ecd46d161faf4 Author: Christian Brauner Date: Thu Mar 26 15:17:00 2026 +0100 Merge patch series "trivial ->setattr cleanups" Christoph Hellwig says: I've been looking into changes to ->setattr and noticed that we still have a few instances where the method has the ages old notify_change name. Fix this up and include dusting off outdated comments. * patches from https://patch.msgid.link/20260325063711.3298685-1-hch@lst.de: proc: rename proc_notify_change to proc_setattr proc: rename proc_setattr to proc_nochmod_setattr affs: rename affs_notify_change to affs_setattr adfs: rename adfs_notify_change to adfs_setattr hfs: update comments on hfs_inode_setattr Link: https://patch.msgid.link/20260325063711.3298685-1-hch@lst.de Signed-off-by: Christian Brauner commit 2ecd46d161faf4b038e02950c9d621a1ffcbd321 Author: Christoph Hellwig Date: Wed Mar 25 07:36:52 2026 +0100 proc: rename proc_notify_change to proc_setattr Make the function name match the method that it implements. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260325063711.3298685-6-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 690005b0b1e6b567c88b7790e6d90d4d6c9e09cc Author: Christoph Hellwig Date: Wed Mar 25 07:36:51 2026 +0100 proc: rename proc_setattr to proc_nochmod_setattr What is currently proc_setattr is a special version added after the more general procfs ->seattr in commit 6d76fa58b050 ("Don't allow chmod() on the /proc// files"). Give it a name that reflects that to free the proc_setattr name and better describe what is doing. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260325063711.3298685-5-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit d0fdc1c0d0f6bb844fdf1c135d6b0f310e58d794 Author: Christoph Hellwig Date: Wed Mar 25 07:36:50 2026 +0100 affs: rename affs_notify_change to affs_setattr Make the function name match the method that it implements. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260325063711.3298685-4-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 9c71de5f4ddc978782f7ceb60c8cfee4db64f286 Author: Christoph Hellwig Date: Wed Mar 25 07:36:49 2026 +0100 adfs: rename adfs_notify_change to adfs_setattr Make the function name match the method that it implements. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260325063711.3298685-3-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit d1312979f155597cad51ad61f845e59114bba0f8 Author: Christoph Hellwig Date: Wed Mar 25 07:36:48 2026 +0100 hfs: update comments on hfs_inode_setattr The top of function comment about hfs_inode_setattr is severely out of date and reference a previous name for this function. Remove it, and update the comments in the file to record the still relevant bits directly. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260325063711.3298685-2-hch@lst.de Reviewed-by: Viacheslav Dubeyko Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 45b2b84ac6fde39c427018d6cdf7d44258938faa Author: Long Li Date: Mon Mar 23 12:49:25 2026 -0700 net: mana: Set default number of queues to 16 Set the default number of queues per vPort to MANA_DEF_NUM_QUEUES (16), as 16 queues can achieve optimal throughput for typical workloads. The actual number of queues may be lower if it exceeds the hardware reported limit. Users can increase the number of queues up to max_queues via ethtool if needed. Signed-off-by: Long Li Link: https://patch.msgid.link/20260323194925.1766385-1-longli@microsoft.com Signed-off-by: Paolo Abeni commit 6e22726900ea54d72cbc6f053c0fa581de023de6 Merge: 1f318b96cc84d7 f219798ce294e3 Author: Christian Brauner Date: Thu Mar 26 15:03:38 2026 +0100 Merge patch series "fs: Move metadata bh tracking from address_space" Jan Kara says: This patch series cleans up the mess that has accumulated over the years in metadata buffer_head tracking for inodes, moves the tracking into dedicated structure in filesystem-private part of the inode (so that we don't use private_list, private_data, and private_lock in struct address_space), and also moves couple other users of private_data and private_list so these are removed from struct address_space saving 3 longs in struct inode for 99% of inodes. I would like to get rid of private_lock in struct address_space as well however the locking changes for buffer_heads are non-trivial there and the patch series is long enough as is. So let's leave that for another time. * patches from https://patch.msgid.link/20260326082428.31660-1-jack@suse.cz: (42 commits) fs: Drop i_private_list from address_space fs: Drop mapping_metadata_bhs from address space ext4: Track metadata bhs in fs-private inode part minix: Track metadata bhs in fs-private inode part udf: Track metadata bhs in fs-private inode part fat: Track metadata bhs in fs-private inode part bfs: Track metadata bhs in fs-private inode part affs: Track metadata bhs in fs-private inode part ext2: Track metadata bhs in fs-private inode part fs: Provide functions for handling mapping_metadata_bhs directly fs: Switch inode_has_buffers() to take mapping_metadata_bhs fs: Make bhs point to mapping_metadata_bhs fs: Move metadata bhs tracking to a separate struct fs: Fold fsync_buffers_list() into sync_mapping_buffers() fs: Drop osync_buffers_list() kvm: Use private inode list instead of i_private_list fs: Remove i_private_data aio: Stop using i_private_data and i_private_lock hugetlbfs: Stop using i_private_data fs: Stop using i_private_data for metadata bh tracking ... Link: https://patch.msgid.link/20260326082428.31660-1-jack@suse.cz Signed-off-by: Christian Brauner commit f219798ce294e346031022a85670f68eb2dec10e Author: Jan Kara Date: Thu Mar 26 10:54:36 2026 +0100 fs: Drop i_private_list from address_space Nobody is using i_private_list anymore. Remove it. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-84-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit cb6d109b9ccc374d09812c2387ab826499ee6562 Author: Jan Kara Date: Thu Mar 26 10:54:35 2026 +0100 fs: Drop mapping_metadata_bhs from address space Nobody uses mapping_metadata_bhs in struct address_space anymore. Just remove it and with it all helper functions using it. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-83-jack@suse.cz Signed-off-by: Christian Brauner commit 41189b49bcf1c2af57fbc385da46a4906562b167 Author: Jan Kara Date: Thu Mar 26 10:54:34 2026 +0100 ext4: Track metadata bhs in fs-private inode part Track metadata bhs for an inode in fs-private part of the inode. We need the tracking only for nojournal mode so this is somewhat wasteful. We can relatively easily make the mapping_metadata_bhs struct dynamically allocated similarly to how we treat jbd2_inode but let's leave that for ext4 specific series once the dust settles a bit. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-82-jack@suse.cz Signed-off-by: Christian Brauner commit caaa184b424322beb9dfd05ec3485de665362c94 Author: Jan Kara Date: Thu Mar 26 10:54:33 2026 +0100 minix: Track metadata bhs in fs-private inode part Track metadata bhs for an inode in fs-private part of the inode. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-81-jack@suse.cz Signed-off-by: Christian Brauner commit d0874a580a4b6409b5a78edc9472732b2c1f4cda Author: Jan Kara Date: Thu Mar 26 10:54:32 2026 +0100 udf: Track metadata bhs in fs-private inode part Track metadata bhs for an inode in fs-private part of the inode. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-80-jack@suse.cz Signed-off-by: Christian Brauner commit 439959848b404cd8942f783a3712d54a06f5b3ac Author: Jan Kara Date: Thu Mar 26 10:54:31 2026 +0100 fat: Track metadata bhs in fs-private inode part Track metadata bhs for an inode in fs-private part of the inode. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-79-jack@suse.cz Signed-off-by: Christian Brauner commit b0806ac078e21e9dea5c87ee4e3463e0c0161390 Author: Jan Kara Date: Thu Mar 26 10:54:30 2026 +0100 bfs: Track metadata bhs in fs-private inode part Track metadata bhs for an inode in fs-private part of the inode. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-78-jack@suse.cz Signed-off-by: Christian Brauner commit 6874973e720f68ed4ae14d4d3adf6f9001117cc1 Author: Jan Kara Date: Thu Mar 26 10:54:29 2026 +0100 affs: Track metadata bhs in fs-private inode part Track metadata bhs for an inode in fs-private part of the inode. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-77-jack@suse.cz Signed-off-by: Christian Brauner commit b0439bbc29f020101ae19f1deca451422fdba953 Author: Jan Kara Date: Thu Mar 26 10:54:28 2026 +0100 ext2: Track metadata bhs in fs-private inode part Track metadata bhs for an inode in fs-private part of the inode. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-76-jack@suse.cz Signed-off-by: Christian Brauner commit a8c8122a3dac55d25a1912b8fec9b8cd7366c37a Author: Jan Kara Date: Thu Mar 26 10:54:27 2026 +0100 fs: Provide functions for handling mapping_metadata_bhs directly As part of transition toward moving mapping_metadata_bhs to fs-private part of the inode, provide functions for operations on this list directly instead of going through the inode / mapping. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-75-jack@suse.cz Signed-off-by: Christian Brauner commit 025c9af1a20c8353f586c9bfd30705dfe4a277de Author: Jan Kara Date: Thu Mar 26 10:54:26 2026 +0100 fs: Switch inode_has_buffers() to take mapping_metadata_bhs As part of a move towards placing mapping_metadata_bhs in fs-private inode part, switch inode_has_buffers() to take mapping_metadata_bhs and rename the function to mmb_has_buffers(). Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-74-jack@suse.cz Signed-off-by: Christian Brauner commit c86f5d25514c2a60fcf5ea0aa11c5d8bd1a313ef Author: Jan Kara Date: Thu Mar 26 10:54:25 2026 +0100 fs: Make bhs point to mapping_metadata_bhs Make buffer heads point to mapping_metadata_bhs instead of struct address_space. This makes the code more self contained. For the (only) case of IO error handling where we really need to reach struct address_space add a pointer to the mapping from mapping_metadata_bhs. Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-73-jack@suse.cz Signed-off-by: Christian Brauner commit 521bea7cec8a79684402d555caab408ed43171d5 Author: Jan Kara Date: Thu Mar 26 10:54:24 2026 +0100 fs: Move metadata bhs tracking to a separate struct Instead of tracking metadata bhs for a mapping using i_private_list and i_private_lock create a dedicated mapping_metadata_bhs struct for it. So far this struct is embedded in address_space but that will be switched for per-fs private inode parts later in the series. This also changes the locking from bdev mapping's i_private_lock to a new lock embedded in mapping_metadata_bhs to untangle the i_private_lock locking for maintaining lists of metadata bhs and the locking for looking up / reclaiming bdev's buffer heads. The locking in remove_assoc_map() gets more complex due to this but overall this looks like a reasonable tradeoff. Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-72-jack@suse.cz Signed-off-by: Christian Brauner commit 8fed8176312ba4cdb8169caf96bc552d4c1435d2 Author: Jan Kara Date: Thu Mar 26 10:54:23 2026 +0100 fs: Fold fsync_buffers_list() into sync_mapping_buffers() There's only single caller of fsync_buffers_list() so untangle the code a bit by folding fsync_buffers_list() into sync_mapping_buffers(). Also merge the comments and update them to reflect current state of code. Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-71-jack@suse.cz Signed-off-by: Christian Brauner commit cae6b7a03c7ecb71729e3c6c0755310f734e1e44 Author: Jan Kara Date: Thu Mar 26 10:54:22 2026 +0100 fs: Drop osync_buffers_list() The function only waits for already locked buffers in the list of metadata bhs. fsync_buffers_list() has just waited for all outstanding IO on buffers so this isn't adding anything useful. Comment in front of fsync_buffers_list() mentions concerns about buffers being moved out from tmp list back to mappings i_private_list but these days mark_buffer_dirty_inode() doesn't touch inodes with b_assoc_map set so that cannot happen. Just delete the stale code. Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-70-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit d15c987d1226411345269c20e69b9eb2e39e866a Author: Jan Kara Date: Thu Mar 26 10:54:21 2026 +0100 kvm: Use private inode list instead of i_private_list Instead of using mapping->i_private_list use a list in private part of the inode. CC: kvm@vger.kernel.org CC: Paolo Bonzini Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-69-jack@suse.cz Signed-off-by: Christian Brauner commit cd336f2e275de14866101d3395c7d2be0a0c1b04 Author: Jan Kara Date: Thu Mar 26 10:54:20 2026 +0100 fs: Remove i_private_data Nobody is using it anymore. Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-68-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 3833d335d7be89ea7bbb3d86a9ff19e364b12b0f Author: Jan Kara Date: Thu Mar 26 10:54:19 2026 +0100 aio: Stop using i_private_data and i_private_lock Instead of using i_private_data and i_private_lock, just create aio inodes with appropriate necessary fields. Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-67-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 2811f2a82fafff40867b318360cc06143b088a7c Author: Jan Kara Date: Thu Mar 26 10:54:18 2026 +0100 hugetlbfs: Stop using i_private_data Instead of using i_private_data for resv_map pointer add the pointer into hugetlbfs private part of the inode. Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-66-jack@suse.cz Signed-off-by: Christian Brauner commit 0f46a9e2743cb3ac813553dcef451d57d9c9dbab Author: Jan Kara Date: Thu Mar 26 10:54:17 2026 +0100 fs: Stop using i_private_data for metadata bh tracking All filesystem using generic metadata bh tracking are using bdev mapping as a backing for these bhs. Stop using i_private_data for it and get to bdev mapping directly. Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-65-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 972b9dd4e4180fbb2352bf2f0e015b7b63f5cca0 Author: Jan Kara Date: Thu Mar 26 10:54:16 2026 +0100 fs: Ignore inode metadata buffers in inode_lru_isolate() There are only a few filesystems that use generic tracking of inode metadata buffer heads. As such the logic to reclaim tracked metadata buffer heads in inode_lru_isolate() doesn't bring a benefit big enough to justify intertwining of inode reclaim and metadata buffer head tracking. Just treat tracked metadata buffer heads as any other metadata filesystem has to properly clean up on inode eviction and stop handling it in inode_lru_isolate(). As a result filesystems using generic tracking of metadata buffer heads may now see dirty metadata buffers in their .evict methods more often which can slow down inode reclaim but given these filesystems aren't used in performance demanding setups we should be fine. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-64-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 23dae9e189de56c462a99c1695c1a2b3c499251b Author: Jan Kara Date: Thu Mar 26 10:54:15 2026 +0100 affs: Sync and invalidate metadata buffers from affs_evict_inode() There are only very few filesystems using generic metadata buffer head tracking and everybody is paying the overhead. When we remove this tracking for inode reclaim code .evict will start to see inodes with metadata buffers attached so write them out and prune them. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-63-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 4a7fd1823efc39eb94022a068394c7063764fea8 Author: Jan Kara Date: Thu Mar 26 10:54:14 2026 +0100 bfs: Sync and invalidate metadata buffers from bfs_evict_inode() There are only very few filesystems using generic metadata buffer head tracking and everybody is paying the overhead. When we remove this tracking for inode reclaim code .evict will start to see inodes with metadata buffers attached so write them out and prune them. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-62-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 77ff1ff2f3c5b333ac9d049e90570eb404549a4a Author: Jan Kara Date: Thu Mar 26 10:54:13 2026 +0100 ext4: Sync and invalidate metadata buffers from ext4_evict_inode() There are only very few filesystems using generic metadata buffer head tracking and everybody is paying the overhead. When we remove this tracking for inode reclaim code .evict will start to see inodes with metadata buffers attached so write them out and prune them. Acked-by: Theodore Ts'o Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-61-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 4211dc89c31cb2a896a48de935e036775310380e Author: Jan Kara Date: Thu Mar 26 10:54:12 2026 +0100 ext2: Sync and invalidate metadata buffers from ext2_evict_inode() There are only very few filesystems using generic metadata buffer head tracking and everybody is paying the overhead. When we remove this tracking for inode reclaim code .evict will start to see inodes with metadata buffers attached so write them out and prune them. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-60-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 61aa62ddfb5d631b34436b7e3c05d1faeab738df Author: Jan Kara Date: Thu Mar 26 10:54:11 2026 +0100 minix: Sync and invalidate metadata buffers from minix_evict_inode() There are only very few filesystems using generic metadata buffer head tracking and everybody is paying the overhead. When we remove this tracking for inode reclaim code .evict will start to see inodes with metadata buffers attached so write them out and prune them. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-59-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 153e5960450a4303ace8f01f5c77f2ff5f38ba32 Author: Jan Kara Date: Thu Mar 26 10:54:10 2026 +0100 udf: Sync and invalidate metadata buffers from udf_evict_inode() There are only very few filesystems using generic metadata buffer head tracking and everybody is paying the overhead. When we remove this tracking for inode reclaim code .evict will start to see inodes with metadata buffers attached so write them out and prune them. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-58-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 63f1f4b6c9c805e0eebbf49de5fb19deea1bcdd8 Author: Jan Kara Date: Thu Mar 26 10:54:09 2026 +0100 fat: Sync and invalidate metadata buffers from fat_evict_inode() There are only very few filesystems using generic metadata buffer head tracking and everybody is paying the overhead. When we remove this tracking for inode reclaim code .evict will start to see inodes with metadata buffers attached so write them out and prune them. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-57-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 5f36c9ca33336036a087b270e68e8236c733f448 Author: Jan Kara Date: Thu Mar 26 10:54:08 2026 +0100 fs: Rename generic_file_fsync() to simple_fsync() The implementation is now really basic so rename generic_file_fsync() simple_fsync() and __generic_file_fsync() to simple_fsync_noflush(). Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-56-jack@suse.cz Signed-off-by: Christian Brauner commit aec4fe7cce0c1857ea238d14b6ec6d29e9cd3feb Author: Jan Kara Date: Thu Mar 26 10:54:07 2026 +0100 fs: Drop sync_mapping_buffers() from __generic_file_fsync() No filesystem calling __generic_file_fsync() uses metadata bh tracking. Drop sync_mapping_buffers() call from __generic_file_fsync() as it's pointless now which untangles buffer head handling from fs/libfs.c. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-55-jack@suse.cz Signed-off-by: Christian Brauner commit 635aa2f6781729f86200fb92ca1d6fc123e88f52 Author: Jan Kara Date: Thu Mar 26 10:54:06 2026 +0100 fat: Switch to generic_buffers_fsync_noflush() FAT uses a list of metadata bhs attached to an inode. Switch it to use generic_buffers_fsync_noflush() instead of __generic_file_fsync() as we'll be removing metadata bh handling from __generic_file_fsync(). Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-54-jack@suse.cz Signed-off-by: Christian Brauner commit 235cddee85906f8d4f9139a64e793ce4d20815cf Author: Jan Kara Date: Thu Mar 26 10:54:05 2026 +0100 bfs: Switch to generic_buffers_fsync() BFS uses list of metadata bhs attached to an inode. Switch it to use generic_buffers_fsync() instead of generic_file_fsync() as we'll be removing metadata bh handling from generic_file_fsync(). Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-53-jack@suse.cz Signed-off-by: Christian Brauner commit f3873f90b4c80dc4ea797fb279be2116f4131271 Author: Jan Kara Date: Thu Mar 26 10:54:04 2026 +0100 minix: Switch to generic_buffers_fsync() Minix uses list of metadata bhs attached to an inode. Switch it to generic_buffers_fsync() instead of generic_file_fsync() as we'll be removing metadata bh handling from generic_file_fsync(). Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-52-jack@suse.cz Signed-off-by: Christian Brauner commit f3216337d96e1b66b5c91594c024c041e4de7875 Author: Jan Kara Date: Thu Mar 26 10:54:03 2026 +0100 udf: Switch to generic_buffers_fsync() UDF uses metadata bh list attached to inode. Switch it to generic_buffers_fsync() instead of generic_file_fsync() as we'll be removing metadata bh handling from generic_file_fsync(). Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-51-jack@suse.cz Signed-off-by: Christian Brauner commit ba31a330b4c191c44abc158e8d9682705e8fc1dd Author: Jan Kara Date: Thu Mar 26 10:54:02 2026 +0100 fs: Remove inode lock from __generic_file_fsync() Inode lock in __generic_file_fsync() protects sync_mapping_buffers() and sync_inode_metadata() calls. Neither sync_mapping_buffers() nor sync_inode_metadata() themselves need the protection by inode_lock and both metadata buffer head writeback and inode writeback can happen without inode lock (either in case of background writeback or sync(2) calls). The only protection inode_lock can possibly provide is that write(2) or other inode modifying calls cannot happen in the middle of bh+inode writeout and thus result in writeout of inconsistent metadata. However if writes and fsyncs race, background writeback can submit inconsistent metadata just after fsync completed even with inode_lock protecting fsync so this seems moot as well. So let's remove the apparently pointless inode_lock protection. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-50-jack@suse.cz Signed-off-by: Christian Brauner commit 2cbfeb4c8a43783e697d51f70f6246bdb2fbe0a4 Author: Jan Kara Date: Thu Mar 26 10:54:01 2026 +0100 exfat: Drop pointless invalidate_inode_buffers() call EXFAT never calls mark_buffer_dirty_inode() and thus invalidate_inode_buffers() never has anything to evict. Drop the pointless call. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-49-jack@suse.cz Signed-off-by: Christian Brauner commit 09a23f3a040100e77dedfe79ca046b991070f46b Author: Jan Kara Date: Thu Mar 26 10:54:00 2026 +0100 ufs: Drop pointless invalidate_mapping_buffers() call UFS doesn't call mark_buffer_dirty_inode() and thus invalidate_mapping_buffers() never has anything to drop. Remove the pointless call. Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-48-jack@suse.cz Signed-off-by: Christian Brauner commit f9480ecf939d67a2e0cc5915a82fb1f3c5fcd1d4 Author: Jan Kara Date: Thu Mar 26 10:53:59 2026 +0100 bdev: Drop pointless invalidate_inode_buffers() call Nobody is calling mark_buffer_dirty_inode() with internal bdev inode and it doesn't make sense for internal bdev inode to have any metadata buffer heads. Just drop the pointless invalidate_inode_buffers() call and consequently the whole bdev_evict_inode() because generic code takes care of the rest. CC: linux-block@vger.kernel.org Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-47-jack@suse.cz Signed-off-by: Christian Brauner commit 70450fcfd28ad3d5a6ac77986497be1c28721eb2 Author: Jan Kara Date: Thu Mar 26 10:53:58 2026 +0100 ocfs2: Drop pointless sync_mapping_buffers() calls ocfs2 never calls mark_buffer_dirty_inode() and thus its metadata buffers list is always empty. Drop the pointless sync_mapping_buffers() calls. CC: Joel Becker CC: Joseph Qi CC: ocfs2-devel@lists.linux.dev Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-46-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Reviewed-by: Joseph Qi Signed-off-by: Christian Brauner commit ddd6761f8777c0f310e00164190077a0db32fbb8 Author: Jan Kara Date: Thu Mar 26 10:53:57 2026 +0100 ntfs3: Drop pointless sync_mapping_buffers() and invalidate_inode_buffers() calls ntfs3 never calls mark_buffer_dirty_inode() and thus its metadata buffers list is always empty. Drop the pointless sync_mapping_buffers() and invalidate_inode_buffers() calls. CC: Konstantin Komarov CC: ntfs3@lists.linux.dev Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-45-jack@suse.cz Signed-off-by: Christian Brauner commit 7e5ccdd88c5a97172b729a1a2e5d8f2840795c54 Author: Jan Kara Date: Thu Mar 26 10:53:56 2026 +0100 gfs2: Don't zero i_private_data Remove the explicit zeroing of mapping->i_private_data since this field is no longer used. CC: Andreas Gruenbacher CC: gfs2@lists.linux.dev Reviewed-by: Andreas Gruenbacher Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-44-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit ab856368582b9b97b35e1a98e5bf3b0b300a583d Author: Jan Kara Date: Thu Mar 26 10:53:55 2026 +0100 ext4: Use inode_has_buffers() Instead of checking i_private_list directly use appropriate wrapper inode_has_buffers(). Also delete stale comment. Acked-by: Theodore Ts'o Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260326095354.16340-43-jack@suse.cz Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 1600b49b0819599b138f92c72e6c6ebb43c40378 Author: Maarten Lankhorst Date: Thu Mar 26 13:18:14 2026 +0100 drm/xe: Remove useless comment. Commit 792d2b9a1259 ("drm: drop mtrr from i915"), added this comment, drop it since it was carried over from i915. Reviewed-by: Ville Syrjälä Link: https://patch.msgid.link/20260326121818.122401-2-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 3b6f4cfc7152feb5641678ea254988fdce70a91b Author: Jihed Chaibi Date: Tue Mar 24 23:45:30 2026 +0100 ASoC: fsl: mpc5200_dma: Convert to devm_ioremap() Replace ioremap() with devm_ioremap() so the mapping is released automatically when the device is unbound. Remove the corresponding iounmap() calls from the error path in mpc5200_audio_dma_create() and from mpc5200_audio_dma_destroy(). Since devm_ioremap() failure already returns directly and no other cleanup is needed at that point, simplify the kzalloc error path to return -ENOMEM directly instead of jumping to the now-removed out_unmap label. Signed-off-by: Jihed Chaibi Link: https://patch.msgid.link/20260324224530.102164-1-jihed.chaibi.dev@gmail.com Signed-off-by: Mark Brown commit 94505767bd32f8a240cf3590776b16a12d75d98e Author: Christian Brauner Date: Wed Mar 25 17:34:00 2026 +0100 fat: fix stack frame size warnings in KUnit tests The kernel test robot reported that on hexagon with clang, several test functions in fat_test.c exceed the 1280-byte stack frame limit. The root cause is the compound literal assignment in fat_test_set_time_offset(): *sbi = (struct msdos_sb_info){}; struct msdos_sb_info contains two hash tables of 256 hlist_head entries (FAT_HASH_SIZE), making it several kilobytes. The compound literal creates a temporary on the stack, and when clang inlines fat_test_set_time_offset() into each test function, the large temporary inflates every caller's stack frame beyond the limit. Replace the compound literal with memset() which zeroes the struct in-place without a stack temporary. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603251755.4UYY1Rcd-lkp@intel.com/ Signed-off-by: Christian Brauner commit ec40b431f0abe682db2e443b857d638cd3653330 Author: Frank Li Date: Mon Feb 16 14:18:44 2026 -0500 media: synopsys: csi2rx: add i.MX93 support The i.MX93 uses a newer version of the DW CSI-2 controller with a changed register layout and an integrated Image Pixel Interface (IPI), which converts the received CSI-2 packets from byte to pixel format and produces a pixel data bus containing vertical and horizontal synchronization information. The reset flow also differs, so add the .assert_reset(), .deassert_reset(), and .idi_enable() callbacks to support it. Reviewed-by: Michael Riesch Signed-off-by: Frank Li [Sakari Ailus: include missing linux/bitfield.h.] Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 7425b2eaf50a90f57cde586a4a7a0e2e9c2fc0d1 Author: Frank Li Date: Mon Feb 16 14:18:43 2026 -0500 media: dt-bindings: add NXP i.MX93 compatible string The i.MX93 uses the DW CSI-2 RX controller, which is similar to the Rockchip RK3568 implementation. The i.MX93 variant provides one IRQ, two clocks, and no resets. Add the "fsl,imx93-mipi-csi2" compatible string and keep the same constraints for RK3568. Reviewed-by: Krzysztof Kozlowski Acked-by: Michael Riesch Signed-off-by: Frank Li Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2b301f534883ee1eed1a78a5d43e49ead72c2a0c Author: Frank Li Date: Mon Feb 16 14:18:42 2026 -0500 media: synopsys: csi2rx: Use enum and u32 array for register offsets Use enum dw_mipi_csi2rx_regs_index together with a u32 array to describe register offsets. This allows supporting new IP versions with different register layouts in a structured way. Add rk3568_regs matching the previous macro definitions and pass it as driver data during probe. No functional change intended. Reviewed-by: Michael Riesch Signed-off-by: Frank Li Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 6f4699ae1e012f807af73617405fcc755d1343ad Author: Frank Li Date: Mon Feb 16 14:18:41 2026 -0500 media: synopsys: csi2rx: implement .get_frame_desc() callback Implement the .get_frame_desc() callback to fetch information from the remote endpoint. Signed-off-by: Frank Li Reviewed-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 6fb44d14929036ca4d10ed5d1df47af8a6b642b6 Author: Frank Li Date: Mon Feb 16 14:18:40 2026 -0500 media: synopsys: csi2rx: only check errors from devm_clk_bulk_get_all() devm_clk_bulk_get_all() returns all clocks described in the DT, which are already validated by the binding. Do not need enforce an expected clock count. Only check for error returns (< 0) to support more SoCs. Reviewed-by: Michael Riesch Signed-off-by: Frank Li Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 6c03c1c4e8a4d9873432134fb7d22f3c02df7226 Author: Frank Li Date: Mon Feb 16 14:18:39 2026 -0500 media: synopsys: csi2rx: use devm_reset_control_get_optional_exclusive() The DW MIPI CSI-2 RX is used on different SoCs, not all of which provide a reset controller. Switch to devm_reset_control_get_optional_exclusive() to support such platforms. Reset presence and numbering are validated by the DT binding. Reviewed-by: Michael Riesch Signed-off-by: Frank Li Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit bac5990b8848d984b011d2d83569cae1f0c56ba0 Author: Matthias Fend Date: Mon Jan 12 15:59:28 2026 +0100 media: i2c: imx283: add support for non-continuous MIPI clock mode Add support for selecting between continuous and non-continuous MIPI clock mode. Previously, the CSI-2 non-continuous clock endpoint flag was ignored and the sensor was always configured for non-continuous clock mode. For existing device tree nodes that do not have this property enabled, this update will therefore change the actual clock mode. Reviewed-by: Kieran Bingham Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit cb70fee76eeefc0984910700797c8dc14ad6e12c Author: Matthias Fend Date: Tue Mar 24 11:41:43 2026 +0100 media: i2c: ov08d10: add support for 24 MHz input clock The sensor supports an input clock in the range of 6 to 27 MHz. Currently, the driver only supports a 19.2 MHz clock. Extend the driver so that at least 24 MHz, which is a typical frequency for this sensor, can also be used. Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 6b4bff99c0371ccdd0869c5a690580b41ec78b69 Author: Matthias Fend Date: Tue Mar 24 11:41:42 2026 +0100 media: i2c: ov08d10: add support for reset and power management Add support for the required power supplies as well as the control of an optional sensor reset. Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 76b56fc0d736e8578d48089518ba0f7f69f2f684 Author: Matthias Fend Date: Tue Mar 24 11:41:41 2026 +0100 media: i2c: ov08d10: add support for binding via device tree The OV08D10 can be used also on embedded designs using device tree so allow the sensor to bind to a device tree node. Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 097d2be74ad02d8fba4a4d03bf714ced7e9cb074 Author: Matthias Fend Date: Tue Mar 24 11:41:40 2026 +0100 dt-bindings: media: i2c: document Omnivision OV08D10 CMOS image sensor Add bindings for the Omnivision OV08D10 CMOS image sensor. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit cf30b64be16b91e7e648c5e31dca5264fb3b60e9 Author: Matthias Fend Date: Tue Mar 24 11:41:39 2026 +0100 media: i2c: ov08d10: add missing newline to prints Add trailing \n to dev_* prints where missing. Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 1c4e20d2c2c8979096911e9b4094192d25b5e574 Author: Matthias Fend Date: Tue Mar 24 11:41:38 2026 +0100 media: i2c: ov08d10: fix some typos in comments Fix some spelling errors in comments. Reviewed-by: Philipp Zabel Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 97534fccf13a89160d795b829733949e8bc2939e Author: Matthias Fend Date: Tue Mar 24 11:41:37 2026 +0100 media: i2c: ov08d10: remove duplicate register write Register P1:0x33 is written twice with the same value in the 'lane_2_mode_1632x1224' sequence. Remove one unnecessary write access. Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 5d150fa0f16096d736bd24d13e04495da5116fab Author: Matthias Fend Date: Tue Mar 24 11:41:36 2026 +0100 media: i2c: ov08d10: fix image vertical start setting The current settings for the "image vertical start" register appear to be incorrect. While this only results in an incorrect start line for native modes, this faulty setting causes actual problems in binning mode. At least on an i.MX8MP test system, only corrupted frames could be received. To correct this, the recommended settings from the reference register sets are used for all modes. Since this shifts the start by one line, the Bayer pattern also changes, which has also been corrected. Fixes: 7be91e02ed57 ("media: i2c: Add ov08d10 camera sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 35c7046be2be5e60be8128facb359a47f39e99cd Author: Matthias Fend Date: Tue Mar 24 11:41:35 2026 +0100 media: i2c: ov08d10: fix runtime PM handling in probe Set the device's runtime PM status and enable runtime PM before registering the async sub-device. This is needed to avoid the case where the device is runtime PM resumed while runtime PM has not been enabled yet. Remove the related, non-driver-specific comment while at it. Fixes: 7be91e02ed57 ("media: i2c: Add ov08d10 camera sensor driver") Cc: stable@vger.kernel.org Reviewed-by: Philipp Zabel Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit b7efb57ac9baad60f1ca67e7cceac853c7e9026c Author: Sakari Ailus Date: Mon Mar 23 12:42:53 2026 +0200 staging: media: ipu7: Update TODO Remove cleanup of the register definitions from the TODO file. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 388727ef1cdb5b92c482f53d6636557372c2ea1a Author: haoyu.lu Date: Thu Mar 26 13:56:27 2026 +0800 kernel: acct: fix duplicate word in comment Fix the duplicate word "kernel" in the comment on line 247. Signed-off-by: haoyu.lu Link: https://patch.msgid.link/20260326055628.10773-1-hechushiguitu666@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 3bce3fdd1ff2ba242f76ab66659fff27207299f1 Author: Laurent Pinchart Date: Mon Mar 23 18:45:26 2026 +0200 drm: rcar-du: Don't leak device_link to CMM The DU driver creates device_link instances between the DU and CMMs, but never deletes them. Fix it by introducing a rcar_du_cmm structure to group the CMM device and device_link, and deleting the links at cleanup time. Signed-off-by: Laurent Pinchart Link: https://patch.msgid.link/20260323164526.2292491-5-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Tomi Valkeinen commit a93b8739b5265d7cb9d8592806bad1df818567e8 Author: Laurent Pinchart Date: Mon Mar 23 18:45:25 2026 +0200 drm: rcar-du: Use __free() to simplify device_node handling Replace manual of_node_put() calls with __free(). This simplifies error handling code and makes it less bug-prone. Signed-off-by: Laurent Pinchart Link: https://patch.msgid.link/20260323164526.2292491-4-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Tomi Valkeinen commit 0f6f28c8d88e33ccab524b3c8a86e629e12e3276 Author: Laurent Pinchart Date: Mon Mar 23 18:45:24 2026 +0200 drm: rcar-du: Store CMM device pointer instead of platform_device The DU driver stores the CMM devices as pointers to struct platform_device, and passes them to the API exposed by the CMM driver. This is similar to how the VSP is handled, except that the VSP uses struct device pointers. Replace the CMM platform_device pointers with device pointers for consistency. Signed-off-by: Laurent Pinchart Link: https://patch.msgid.link/20260323164526.2292491-3-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Tomi Valkeinen commit db5be3a7d6bd5c0e9694803a489d4d1689d6d5ef Author: Laurent Pinchart Date: Mon Mar 23 18:45:23 2026 +0200 drm: rcar-du: Ensure correct suspend/resume ordering with VSP The VSP serves as an interface to memory and a compositor to the DU. It therefore needs to be suspended after and resumed before the DU, to be properly stopped and restarted in a controlled fashion driven by the DU driver. This currently works by chance. Avoid relying on luck by enforcing the correct suspend/resume ordering with device links. Signed-off-by: Laurent Pinchart Reviewed-by: Biju Das Tested-by: Tommaso Merciai Reviewed-by: Tommaso Merciai Link: https://patch.msgid.link/20260323164526.2292491-2-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Tomi Valkeinen commit 206bada308d0d715d62ac841784af34a2ca22ff6 Author: Daniel Almeida Date: Mon Mar 23 20:27:02 2026 -0300 rust: drm: dispatch delayed work items to the private data Much like the patch that dispatched (regular) work items, we also need to dispatch delayed work items in order not to trigger the orphan rule. This allows a drm::Device to dispatch the delayed work to T::Data. Reviewed-by: Alice Ryhl Acked-by: Danilo Krummrich Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20260323-aref-workitem-v3-4-f59729b812aa@collabora.com Signed-off-by: Alice Ryhl commit 332666484f06cd85ad382329f5b3165aa627e9f8 Author: Daniel Almeida Date: Mon Mar 23 20:27:01 2026 -0300 rust: workqueue: add delayed work support for ARef The preceding patches added support for ARef work items. By the same token, add support for delayed work items too. The rationale is the same: it may be convenient or even necessary at times to implement HasDelayedWork directly on ARef. A follow up patch will also implement support for drm::Device as the first user. Reviewed-by: Alice Ryhl Acked-by: Danilo Krummrich Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20260323-aref-workitem-v3-3-f59729b812aa@collabora.com Signed-off-by: Alice Ryhl commit 72a723df8decf70e04f799a6defda8bb62d41848 Author: Daniel Almeida Date: Mon Mar 23 20:27:00 2026 -0300 rust: drm: dispatch work items to the private data This implementation dispatches any work enqueued on ARef> to its driver-provided handler. It does so by building upon the newly-added ARef support in workqueue.rs in order to call into the driver implementations for work_container_of and raw_get_work. This is notably important for work items that need access to the drm device, as it was not possible to enqueue work on a ARef> previously without failing the orphan rule. The current implementation needs T::Data to live inline with drm::Device in order for work_container_of to function. This restriction is already captured by the trait bounds. Drivers that need to share their ownership of T::Data may trivially get around this: // Lives inline in drm::Device struct DataWrapper { work: ..., // Heap-allocated, shared ownership. data: Arc, } Reviewed-by: Alice Ryhl Acked-by: Danilo Krummrich Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20260323-aref-workitem-v3-2-f59729b812aa@collabora.com Signed-off-by: Alice Ryhl commit f5e841e4966c1873b9bb2c69d07947a54284e5eb Author: Daniel Almeida Date: Mon Mar 23 20:26:59 2026 -0300 rust: workqueue: add support for ARef Add support for the ARef smart pointer. This allows an instance of ARef to handle deferred work directly, which can be convenient or even necessary at times, depending on the specifics of the driver or subsystem. The implementation is similar to that of Arc, and a subsequent patch will implement support for drm::Device as the first user. This is notably important for work items that need access to the drm device, as it was not possible to enqueue work on a ARef> previously without failing the orphan rule. Reviewed-by: Alice Ryhl Acked-by: Danilo Krummrich Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20260323-aref-workitem-v3-1-f59729b812aa@collabora.com Signed-off-by: Alice Ryhl commit e113ed3e73b91194a39bf6a9207a3598827f0033 Author: songxiebing Date: Wed Mar 25 10:28:04 2026 +0800 ASoC: renesas: Fix non-static global variable When using global variables in a .c file only,it is necessary to add the keyword "static", so here fix the warning. sparse warnings: (new ones prefixed by >>) >> sound/soc/renesas/dma-sh7760.c:62:3: sparse: sparse: symbol 'cam_pcm_data' was not declared. Should it be static? Signed-off-by: songxiebing Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202412171210.7a4vH3Ew-lkp@intel.com/ Link: https://patch.msgid.link/20260325022804.253353-1-songxiebing@kylinos.cn Signed-off-by: Mark Brown commit 7b1c2d7547943ddb0d425138b3b42262ff92eea3 Author: Vineeth Pillai (Google) Date: Mon Mar 23 12:00:21 2026 -0400 kernel: Use trace_call__##name() at guarded tracepoint call sites Replace trace_foo() with the new trace_call__foo() at sites already guarded by trace_foo_enabled(), avoiding a redundant static_branch_unlikely() re-evaluation inside the tracepoint. trace_call__foo() calls the tracepoint callbacks directly without utilizing the static branch again. Cc: David Vernet Cc: Andrea Righi Cc: Changwoo Min Cc: Ingo Molnar Cc: Juri Lelli Cc: Vincent Guittot Cc: Dietmar Eggemann Cc: Ben Segall Cc: Mel Gorman Cc: Valentin Schneider Cc: Thomas Gleixner Cc: "Yury Norov [NVIDIA]" Cc: "Paul E. McKenney" Cc: Rik van Riel Cc: Roman Kisel Cc: Joel Fernandes Cc: "Rafael J. Wysocki" Cc: Ulf Hansson Link: https://patch.msgid.link/20260323160052.17528-3-vineeth@bitbyteword.org Suggested-by: Steven Rostedt Suggested-by: Peter Zijlstra Signed-off-by: Vineeth Pillai (Google) Assisted-by: Claude:claude-sonnet-4-6 Acked-by: Tejun Heo Acked-by: Thomas Gleixner Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 677a3d82b6407522d922705209c311e043a17813 Author: Vineeth Pillai (Google) Date: Mon Mar 23 12:00:20 2026 -0400 tracepoint: Add trace_call__##name() API Add trace_call__##name() as a companion to trace_##name(). When a caller already guards a tracepoint with an explicit enabled check: if (trace_foo_enabled() && cond) trace_foo(args); trace_foo() internally repeats the static_branch_unlikely() test, which the compiler cannot fold since static branches are patched binary instructions. This results in two static-branch evaluations for every guarded call site. trace_call__##name() calls __do_trace_##name() directly, skipping the redundant static-branch re-check. This avoids leaking the internal __do_trace_##name() symbol into call sites while still eliminating the double evaluation: if (trace_foo_enabled() && cond) trace_invoke_foo(args); /* calls __do_trace_foo() directly */ Three locations are updated: - __DECLARE_TRACE: invoke form omits static_branch_unlikely, retains the LOCKDEP RCU-watching assertion. - __DECLARE_TRACE_SYSCALL: same, plus retains might_fault(). - !TRACEPOINTS_ENABLED stub: empty no-op so callers compile cleanly when tracepoints are compiled out. Cc: Dmitry Ilvokhin Cc: Mathieu Desnoyers Cc: Ingo Molnar Cc: Jens Axboe Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Marcelo Ricardo Leitner Cc: Xin Long Cc: Jon Maloy Cc: Aaron Conole Cc: Eelco Chaudron Cc: Ilya Maximets Cc: Jiri Pirko Cc: Oded Gabbay Cc: Koby Elbaz Cc: "Rafael J. Wysocki" Cc: Viresh Kumar Cc: "Gautham R. Shenoy" Cc: Huang Rui Cc: Mario Limonciello Cc: Len Brown Cc: Srinivas Pandruvada Cc: MyungJoo Ham Cc: Kyungmin Park Cc: Chanwoo Choi Cc: Christian König Cc: Sumit Semwal Cc: Eddie James Cc: Andrew Jeffery Cc: Joel Stanley Cc: David Airlie Cc: Simona Vetter Cc: Alex Deucher Cc: Danilo Krummrich Cc: Matthew Brost Cc: Philipp Stanner Cc: Harry Wentland Cc: Leo Li Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: Wolfram Sang Cc: Mark Brown Cc: Michael Hennerich Cc: Nuno Sá Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Cc: Chris Mason Cc: David Sterba Cc: Thomas Gleixner Cc: Andrew Morton Cc: SeongJae Park Cc: Borislav Petkov Cc: Dave Hansen Link: https://patch.msgid.link/20260323160052.17528-2-vineeth@bitbyteword.org Suggested-by: Steven Rostedt Suggested-by: Peter Zijlstra Acked-by: Masami Hiramatsu (Google) Signed-off-by: Vineeth Pillai (Google) Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Steven Rostedt (Google) commit b727ba2560a8a806680b45c9acc5a49bc39b8e43 Author: Bartosz Golaszewski Date: Mon Mar 16 10:45:24 2026 +0100 leds: Kconfig: Drop unneeded dependency on OF_GPIO OF_GPIO is selected automatically on all OF systems. Any symbols it controls also provide stubs so there's really no reason to select it explicitly. Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260316-gpio-of-kconfig-v2-4-de2f4b00a0e4@oss.qualcomm.com Signed-off-by: Lee Jones commit 32a4cd3d451ddec7c9ec04a2ec3f379ed7c5ff20 Author: Bhargav Joshi Date: Thu Mar 26 04:35:59 2026 +0530 regulator: dt-bindings: mps,mp8859: convert to DT schema Convert the Monolithic Power Systems MP8859 voltage regulator binding from legacy text format to DT schema. This patch does not change any functionality, the bindings remain the same. Signed-off-by: Bhargav Joshi Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260325230559.73527-1-rougueprince47@gmail.com Signed-off-by: Mark Brown commit b08a76290c4ec132114f629d7efe104d355aef92 Merge: 8f303194b241c2 dd1d4ccb860289 Author: Paolo Abeni Date: Thu Mar 26 12:47:30 2026 +0100 Merge branch 'net-dpaa2-mac-export-standard-statistics' Ioana Ciornei says: ==================== net: dpaa2-mac: export standard statistics This patch set adds support for standard ethtool statistics - rmon, eth-ctrl, eth-mac and pause - to dpaa2-mac and its users dpaa2-eth and dpaa2-switch. The first patch extends the firmware APIs related to MAC counters and adds dpmac_get_statistics() which can be used to retrieve multiple counter values through a single firmware call. This new API is put in use in the second patch by gathering all previously exported ethtool statistics through a single MC firmware call. In this patch we are also adding the setup and cleanup infrastructure which will be also used for the standard ethtool counters. The third patch adds the actual suppord for rmon, eth-ctrl, eth-mac and pause statistics in dpaa2-mac and its users. ==================== Link: https://patch.msgid.link/20260323115039.3932600-1-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit dd1d4ccb860289ad3dee33178cc2705c5ed1143b Author: Ioana Ciornei Date: Mon Mar 23 13:50:39 2026 +0200 net: dpaa2-mac: export standard statistics Take advantage of all the newly added MAC counters available through the MC API and export them through the standard statistics structures - rmon, eth-ctrl, eth-mac and pause. A new version based feature is added into dpaa2-mac - DPAA2_MAC_FEATURE_STANDARD_STATS - and based on the two memory zones needed for gathering the MAC counters are setup for each statistics group. The dpmac_counter structure is extended with a new field - size_t offset - which is being used to instruct the dpaa2_mac_transfer_stats() function where exactly to store a counter value inside the standard statistics structure. The newly added support is used both in the dpaa2-eth driver as well as the dpaa2-switch one. Signed-off-by: Ioana Ciornei Link: https://patch.msgid.link/20260323115039.3932600-4-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit d369154d9d7fa7530a2520b945905fbecd35b05b Author: Ioana Ciornei Date: Mon Mar 23 13:50:38 2026 +0200 net: dpaa2-mac: retrieve MAC statistics in one firmware command The latest MC firmware version added a new command to retrieve all DPMAC counters in a single firmware call. Use this new command, when possible, in dpaa2-mac as well. In order to use the dpmac_get_statistics() API, two DMA memory areas are used: one to transmit what counters the driver is requesting and one to receive the values of those counters. These memory areas are allocated and DMA mapped at probe time so that we don't waste time at runtime. And since we are planning to add rmon, eth-ctrl and other standard statistics using the same infrastructure, make the setup and cleanup processes as generic as possibile through the dpaa2_mac_setup_stats() and dpaa2_mac_clear_stats() functions. Signed-off-by: Ioana Ciornei Link: https://patch.msgid.link/20260323115039.3932600-3-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit fbf3fecf6ae1c9f429c2450f5a10d5640d7c5f9c Author: Ioana Ciornei Date: Mon Mar 23 13:50:37 2026 +0200 net: dpaa2-mac: extend APIs related to statistics Extend the dpmac_counter_id enum with the newly added counters which can be interrogated through the MC firmware. Also add the dpmac_get_statistics() API which can be used to retrieve multiple MAC counters through a single firmware command. Signed-off-by: Ioana Ciornei Link: https://patch.msgid.link/20260323115039.3932600-2-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni commit a55e941e2283e931c8a292adc030c834f8ea0873 Author: Richard Lyu Date: Fri Mar 20 11:54:52 2026 +0800 leds: lm3642: Use guard to simplify locking The mutex_lock()/mutex_unlock() pattern requires explicitly pairing lock and unlock calls. Use guard(mutex) instead so the lock is automatically released when the scope exits. Convert to guard(mutex) in lm3642_torch_brightness_set(), lm3642_strobe_brightness_set(), and lm3642_indicator_brightness_set(). Add #include to support scoped guards. Signed-off-by: Richard Lyu Link: https://patch.msgid.link/20260320035451.31071-1-richard.lyu@suse.com Signed-off-by: Lee Jones commit 73f01258002fe35d6c6b20f92c75b891e7215b06 Author: Yang Wen Date: Sun Mar 22 23:32:06 2026 +0800 exfat: fix passing zero to ERR_PTR() in exfat_mkdir() Detected by Smatch. namei.c:890 exfat_mkdir() warn: passing zero to 'ERR_PTR' Signed-off-by: Yang Wen Signed-off-by: Namjae Jeon commit fd55319692151de2b89c21356d1445bce364769b Author: Kate Hsuan Date: Wed Mar 25 15:56:42 2026 +0800 media: Add t4ka3 camera sensor driver Add the t4ka3 driver from: https://github.com/kitakar5525/surface3-atomisp-cameras.git With many cleanups / changes (almost a full rewrite) to make it suitable for upstream: * Remove the VCM and VCM-OTP support, the mainline kernel models VCMs and calibration data eeproms as separate v4l2-subdev-s. * Remove the integration-factor t4ka3_get_intg_factor() support and IOCTL, this provided info to userspace through an atomisp private IOCTL. * Turn atomisp specific exposure/gain IOCTL into standard v4l2 controls. * Use normal ACPI power-management in combination with runtime-pm support instead of atomisp specific GMIN power-management code. * Turn into a standard V4L2 sensor driver using v4l2_async_register_subdev_sensor(). * Add vblank, hblank, and link-freq controls; drop get_frame_interval(). * Use CCI register helpers. * Calculate values for modes instead of using fixed register-value lists, allowing arbritrary modes. * Add get_selection() and set_selection() support * Add a CSI2 bus configuration check This was tested on a Xiaomi Mipad2 tablet which has a T4KA3 sensor with DW9761 VCM as back sensor. Reviewed-by: Hans de Goede Co-developed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Kate Hsuan Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 247b8b85587639f090cdf9c4ddc755ca68b3a862 Author: Walter Werner Schneider Date: Mon Jan 5 14:30:53 2026 +0200 media: i2c: Add ov2732 image sensor driver Add a V4L2 subdevice driver for the Omnivision OV2732 sensor. The OV2732 is a 1/4" color CMOS 1080p (1920x1080) HD image sensor with programmable controls like: gain, exposure, frame rate, image and windowing size, horizontal mirror, vertical flip, cropping. Signed-off-by: Walter Werner Schneider Reviewed-by: Jacopo Mondi [Sakari Ailus: Squashed Walter's fixup.] Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 631dd79305ab2022de645a538f9969ac97e176eb Author: Walter Werner Schneider Date: Mon Jan 5 14:30:52 2026 +0200 dt-bindings: media: i2c: Add ov2732 image sensor Add bindings for OmniVision OV2732 image sensor. Signed-off-by: Walter Werner Schneider Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 951a4e8589b3ee6e889ed97fb9896df197dd88e7 Author: Richard Fitzgerald Date: Thu Mar 26 10:08:53 2026 +0000 ASoC: wm_adsp_fw_find_test: Fix missing NULL terminator on file name list The array wm_adsp_fw_find_test_dir_all_files[] needs a NULL terminator. It was documented at line 41 that dir_files points to a NULL-terminated array. /* NULL-terminated array of pointers to filenames ... */ const char * const *dir_files; This fixes the error reported by KASAN: [17:46:43] BUG: KASAN: global-out-of-bounds in wm_adsp_fw_find_test_pick_file+0x8cc/0xc80 [17:46:43] Read of size 8 at addr ffff800081e5ffe8 by task kunit_try_catch/18349 Signed-off-by: Richard Fitzgerald Fixes: bf2d44d07de7 ("ASoC: wm_adsp: Add kunit test for firmware file search") Link: https://patch.msgid.link/20260326100853.1582886-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 59b0efd867fbbcad6d378e8aa08dda44d1f48651 Author: Cathy Xu Date: Thu Mar 26 11:05:16 2026 +0800 mmc: mtk-sd: disable new_tx/rx and modify related settings for mt8189 Disable new_tx/rx to avoid data transmission instability, and adjust .data_tune, .stop_dly_sel, and .pop_en_cnt to fit the overall configuration after disabling new_tx/rx, making it more compatible with mt8189. Fixes: 846a3a2fdff5 ("mmc: mtk-sd: add support for MT8189 SoC") Tested-by: Louis-Alexis Eyraud Signed-off-by: Cathy Xu Signed-off-by: Ulf Hansson commit 49eb823cbe648dba791cfe1c16e4f6fcfd32f5ca Author: Bhargav Joshi Date: Thu Mar 26 04:24:38 2026 +0530 dt-bindings: mmc: hisilicon,hi3660-dw-mshc: Convert to DT schema Convert the Hisilicon DesignWare Mobile Storage Host Controller (dw-mshc) bindings from text format to DT schema. As part of this conversion, the binding file is renamed from k3-dw-mshc.txt to hisilicon,hi3660-dw-mshc.yaml to align with compatible string naming conventions. Examples have been updated to pass schema validation. Note: synopsys-dw-mshc binding specifies clock names as "biu" followed by "ciu". However, this Hisilicon binding reverses the order to 'ciu' then 'biu' to match both the legacy text binding and in-kernel Hisilicon DTS board files. Signed-off-by: Bhargav Joshi Acked-by: Zhangfei Gao Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit 19fe6c02f480e86962f928e298c3f51040da5411 Author: Kathiravan Thirumoorthy Date: Wed Mar 25 17:10:19 2026 +0530 dt-bindings: mmc: sdhci-msm: add IPQ9650 compatible The IPQ9650 supports eMMC with an SDHCI controller. Add the appropriate compatible to the documentation. Signed-off-by: Kathiravan Thirumoorthy Acked-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit 7b907b55eb180f89b5ce9d66ed230892aef30e33 Merge: 8a6391ec669366 ee7d655dbaf5e5 Author: Mark Brown Date: Thu Mar 26 10:20:46 2026 +0000 ASoC: cs35l56: Support for factory calibration through ALSA controls Richard Fitzgerald says: Factory calibration is normally done through debugfs files. Google have requested that factory calibration can be performed by repair shops. These repair shops only have access to the standard "user" kernel, which does not include debugfs. Patch #1 adds a new control definition macro to create a boolean control with specified access permissions. (new in V2) Patch #2 is the implementation in the cs35l56 driver. commit ee7d655dbaf5e57145c73fd3925b5f44f7a1a5cc Author: Richard Fitzgerald Date: Wed Mar 25 17:08:41 2026 +0000 ASoC: cs35l56: Allow factory calibration through ALSA controls Add support for using ALSA controls to trigger a factory calibration. This is protected by a new Kconfig option so that it is only available if explicitly enabled in the kernel. By default it is not enabled. Factory calibration is normally done through debugfs files. Google have requested that factory calibration can be performed by repair shops. These repair shops only have access to the standard "user" kernel, which does not include debugfs. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260325170841.1405368-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 37c277f050e8d24cb3db6d090d4e9cdd263ba1a3 Author: Richard Fitzgerald Date: Wed Mar 25 17:08:40 2026 +0000 ASoC: soc.h: Add SOC_SINGLE_BOOL_EXT_ACC() to allow setting access flags Add a macro SOC_SINGLE_BOOL_EXT_ACC() to allow the access permission flags to be set. This is the same as SOC_SINGLE_BOOL_EXT() but with an extra argument for the access flags. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260325170841.1405368-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit c7c6d4f5103864f73ee3a78bfd6da241f84197dd Author: Bin Liu Date: Wed Mar 25 08:49:47 2026 -0500 mmc: block: use single block write in retry Due to errata i2493[0], multi-block write would still fail in retries. With i2493, the MMC interface has the potential of write failures when issuing multi-block writes operating in HS200 mode with excessive IO supply noise. While the errata provides guidance in hardware design and layout to minimize the IO supply noise, in theory the write failure cannot be resolved in hardware. The software solution to ensure the data integrity is to add minimum 5us delay between block writes. Single-block write is the practical way to introduce the delay. This patch reuses recovery_mode flag, and switches to single-block write in retry when multi-block write fails. It covers both CQE and non-CQE cases. [0] https://www.ti.com/lit/pdf/sprz582 Cc: stable@vger.kernel.org Suggested-by: Jens Axboe Signed-off-by: Bin Liu Signed-off-by: Ulf Hansson commit 2ce454acfc41d145a0977fdeead9076f84c7b692 Author: Ronald Claveau Date: Thu Mar 26 10:59:13 2026 +0100 dt-bindings: mmc: amlogic: Add compatible for T7 mmc Add amlogic,t7-mmc compatible string, falling back to amlogic,meson-axg-mmc as the T7 MMC controller is compatible with the AXG implementation. Acked-by: Conor Dooley Acked-by: Rob Herring (Arm) Reviewed-by: Xianwei Zhao Signed-off-by: Ronald Claveau Signed-off-by: Ulf Hansson commit a767c98c89653a1acf3ecf427e76a738aa2dd9c2 Author: Shawn Lin Date: Tue Mar 24 16:42:16 2026 +0800 mmc: sdhci-of-arasan: Use standard mmc_clk_phase_map infrastructure Convert the Arasan SDHCI driver to use the mainline standard mmc_clk_phase_map infrastructure instead of custom clk_phase_in/out arrays as well as arasan_dt_read_clk_phase(). The phase values for ZynqMP, Versal, and Versal-NET platforms are still initialized from the predefined tables. Signed-off-by: Shawn Lin Reviewed-by: Sai Krishna Potthuri Signed-off-by: Ulf Hansson commit 265439eb88fda0bf77821e10aafed22cdd450f9d Author: John Stultz Date: Wed Mar 25 17:26:04 2026 +0000 MAINTAINERS: Add K Prateek Nayak to scheduler reviewers I've been fortunate to have K Prateek take an active interest in my Proxy Execution patches. He's provided great review insights and productive feedback, sometimes remembering the subtleties of the patch series better than I do myself! And he has done all this with great kindness and humility. I've really appreciated his reviews, and I think everyone should be so lucky, so I wanted to propose adding him to the scheduler reviewers list. Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Acked-by: Steven Rostedt (Google) Acked-by: K Prateek Nayak Acked-by: Juri Lelli Acked-by: Vincent Guittot Acked-by: Dietmar Eggemann Link: https://patch.msgid.link/20260325172615.2895622-1-jstultz@google.com commit 8f303194b241c2795bb9b79ee80bc93e7876879c Author: Eric Biggers Date: Sat Mar 21 15:52:08 2026 -0700 octeontx2-pf: macsec: Use AES library instead of ecb(aes) skcipher cn10k_ecb_aes_encrypt() just encrypts a single block with AES. That is much more easily and efficiently done with the AES library than crypto_skcipher. Use the AES library instead. Signed-off-by: Eric Biggers Reviewed-by: Subbaraya Sundeep Link: https://patch.msgid.link/20260321225208.64508-1-ebiggers@kernel.org Signed-off-by: Paolo Abeni commit 91dc0c2a152373c4004df7e36de45190b82089ab Author: Dmitry Torokhov Date: Wed Mar 11 18:43:28 2026 -0700 leds: core: Fix formatting issues Fix formatting issues reported by checkpatch.pl, such as extra empty lines, lack of braces on some branches, and misaligned function arguments. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260311-led-swnode-name-v1-2-798a49e041c6@gmail.com Signed-off-by: Lee Jones commit 4f530c65487636dc1536b3fa1041f9a877a66a7f Author: Dmitry Torokhov Date: Wed Mar 11 18:43:27 2026 -0700 leds: core: Implement fallback to software node name for LED names If a software node defining an LED is missing explicit 'label', 'color', or 'function' properties, led_compose_name() currently fails with -EINVAL, because fallback to using node name in place of LED name/label is only implemented for OF nodes. Implement similar fallback for software nodes. Unlike OF nodes, which use the short 'name' attribute of the device tree node to avoid including the address block, use fwnode_get_name() directly since swnodes do not include an address block and always have a valid name. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260311-led-swnode-name-v1-1-798a49e041c6@gmail.com Signed-off-by: Lee Jones commit d37690b5e02418a2365548300628ef3895a24ed2 Author: Mithil Bavishi Date: Tue Mar 3 15:30:13 2026 -0500 dt-bindings: display: panel-lvds: Add compatibles for Samsung LTN070NL01 and LTN101AL03 panels The LTN070NL01 is a 7.0 inch 1024x600, 24 bit, VESA Compatible, TFT display panel The LTN101AL03 is a 10.1 inch 800x1280, 24 bit, VESA Compatible, TFT display panel Signed-off-by: Mithil Bavishi Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260303203017.511-5-bavishimithil@gmail.com commit f1080f82570b797598c1ba7e9c800ae9e94aafc6 Author: Sebastian Reichel Date: Tue Feb 17 16:25:26 2026 +0200 drm/panel: simple: Correct G190EAN01 prepare timing The prepare timing specified by the G190EAN01 datasheet should be between 30 and 50 ms. Considering it might take some time for the LVDS encoder to enable the signal, we should only wait the min. required time in the panel driver and not the max. allowed time. Fixes: 2f7b832fc992 ("drm/panel: simple: Add support for AUO G190EAN01 panel") Signed-off-by: Sebastian Reichel Signed-off-by: Ian Ray Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260217142528.68613-1-ian.ray@gehealthcare.com commit 987170d0b8da06a399d867c609b5689f3e8dfdb0 Author: Val Packett Date: Tue Feb 17 04:00:12 2026 -0300 drm/panel: himax-hx83102: Add support for DSI DCS backlight control The HTF065H045 panel based on the HX83102 controller does use DCS commands for controlling backlight brightness. Make the driver fall back to DCS when no external backlight has been defined in the device tree, like many other drivers do. Signed-off-by: Val Packett Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260217070121.190108-5-val@packett.cool commit cc72a4734829648465d52484620951199d2ab1e7 Author: Val Packett Date: Tue Feb 17 04:00:11 2026 -0300 drm/panel: himax-hx83102: Add support for Holitech HTF065H045 This 720x1600 panel is found in several Motorola/Lenovo smartphones like the Moto G9 Play (guamp). The initialization sequence is based on the datasheet. Add it to the existing HX83102 panel driver. Signed-off-by: Val Packett Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260217070121.190108-4-val@packett.cool commit 896e7b8c1780734833abaa795fad7eec0cae8125 Author: Val Packett Date: Tue Feb 17 04:00:10 2026 -0300 dt-bindings: display: panel: Add compatible for Holitech HTF065H045 Add a new compatible for the Holitech HTF065H045 panel that uses the Himax HX83102 controller IC. Signed-off-by: Val Packett Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260217070121.190108-3-val@packett.cool commit c122ddd573a90363d18d5f08aefc48f98b40c3d4 Author: Val Packett Date: Tue Feb 17 04:00:09 2026 -0300 dt-bindings: vendor-prefixes: Add Holitech Jiangxi Holitech Technology Co., Ltd. is a manufacturer of display panels. Signed-off-by: Val Packett Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260217070121.190108-2-val@packett.cool commit 49837b6babe71fac84cda2a0d3cf9c085bf3a2f9 Author: Yedaya Katsman Date: Fri Mar 20 16:41:39 2026 +0200 drm: panel: Add Samsung S6E8FC0 DSI controller for M1906F9 panel Add driver for Samsung S6E8FC0 DSI controller for M1906F9 video mode panel, found in Xiaomi Mi A3 mobile phone. Co-developed-by: Kamil Gołda Signed-off-by: Kamil Gołda Reviewed-by: David Heidelberg Reviewed-by: Dmitry Baryshkov Signed-off-by: Yedaya Katsman Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260320-panel-patches-v7-2-3eaefc4b3878@gmail.com commit f4693b88bc730cddc6d69f6f11b64e6d93a8e373 Author: Yedaya Katsman Date: Fri Mar 20 16:41:38 2026 +0200 dt-bindings: display: panel: Add Samsung S6E8FC0-M1906F9 Add Samsung S6E8FC0 DTS binding used with the M1906F9 6.09" 720x1560 panel found in the Xiaomi Mi A3 smartphone. Co-developed-by: Kamil Gołda Signed-off-by: Kamil Gołda Reviewed-by: Krzysztof Kozlowski Signed-off-by: Yedaya Katsman Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260320-panel-patches-v7-1-3eaefc4b3878@gmail.com commit c222177d7c7e1b2e0433d9e47ec2da7015345d50 Author: Dmitry Baryshkov Date: Mon Mar 23 03:21:49 2026 +0200 drm/panel: sharp-ls043t1le01: make use of prepare_prev_first The DSI link must be powered up to let panel driver to talk to the panel during prepare() callback execution. Set the prepare_prev_first flag to guarantee this. Fixes: 9e15123eca79 ("drm/msm/dsi: Stop unconditionally powering up DSI hosts at modeset") Signed-off-by: Dmitry Baryshkov Reviewed-by: Douglas Anderson Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260323-panel-fix-v1-1-9f12b09161e8@oss.qualcomm.com commit a00e773b4a5ce23dd831044283e134466e3f337a Author: Krzysztof Kozlowski Date: Fri Mar 13 09:20:54 2026 +0100 dt-bindings: display: panel: Align style of "true" properties For code readability, several bindings which list allowed properties with ": true" syntax group them in one place, without line breaks between each. Align a few bindings to match this style. No functional impact. Reviewed-by: Neil Armstrong Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260313-dt-bindings-display-panel-clean-v2-1-d49615218f92@oss.qualcomm.com commit 310b05505cc346e091ea6ab0d2cab0663855500a Author: Liu Ying Date: Fri Feb 27 17:31:36 2026 +0800 drm/panel: simple: Add Tianma TM050RDH03 panel Add the Tianma Micro-electronics TM050RDH03 5.0" WVGA TFT LCD panel. Reuse panel ontat,kd50g21-40nt-a1's panel description as they are identical. Signed-off-by: Liu Ying Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260227-tianma-tm050rdh03-v1-2-cab78a0d765d@nxp.com commit dfefca41a4d38e8ddba78176978d679d7af01ab7 Author: Liu Ying Date: Fri Feb 27 17:31:35 2026 +0800 dt-bindings: display: simple: Add Tianma TM050RDH03 panel Add the Tianma Micro-electronics TM050RDH03 5.0" WVGA TFT LCD panel. Signed-off-by: Liu Ying Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260227-tianma-tm050rdh03-v1-1-cab78a0d765d@nxp.com commit a05f291175f2cc01fa95c29dba4493cd3f8de594 Author: Dario Binacchi Date: Wed Mar 18 08:32:53 2026 +0100 drm/panel: ilitek-ili9806e: add Rocktech RK050HR345-CT106A SPI panel Add support for the Rocktech RK050HR345-CT106A panel based on the Ilitek ILI9806E controller using the SPI bus. The driver is designed to be easily extensible to support other panels with different initialization sequences and display timings by providing a specific descriptor structure for each model. Signed-off-by: Dario Binacchi Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260318073346.18041-5-dario.binacchi@amarulasolutions.com commit 7cad20e339ea0493fad76db27e4675b2a9629e7c Author: Dario Binacchi Date: Wed Mar 18 08:32:52 2026 +0100 dt-bindings: ili9806e: add Rocktech RK050HR345-CT106A display Document the Rocktech 5" 480x854 panel based on the Ilitek ILI9806E controller. This panel uses SPI for control and an RGB interface for display data, so adjust the binding requirements accordingly. Signed-off-by: Dario Binacchi Reviewed-by: Rob Herring (Arm) Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260318073346.18041-4-dario.binacchi@amarulasolutions.com commit 0efa7924243e461a643a44904653f200bfd40ee0 Author: Dario Binacchi Date: Wed Mar 18 08:32:51 2026 +0100 drm/panel: ilitek-ili9806e: split core and DSI logic Split the driver to support multiple transport buses. The core logic (power, GPIO, backlight) is moved to a dedicated core module, while DSI-specific code is restricted to the DSI module. Introduce DRM_PANEL_ILITEK_ILI9806E_CORE as a hidden Kconfig symbol selected by the bus-specific configuration. Signed-off-by: Dario Binacchi Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260318073346.18041-3-dario.binacchi@amarulasolutions.com commit 3bdd847ac2278d675e86000fced794fd61159974 Author: Dario Binacchi Date: Wed Mar 18 08:32:50 2026 +0100 drm/panel: ilitek-ili9806e: rename to specific DSI driver The Ilitek ILI9806E controller can support different transport buses, such as MIPI-DSI and SPI. The current implementation is specific to the MIPI-DSI interface. In preparation for adding SPI support, rename the current Kconfig symbol and files to be DSI-specific, clarifying the current scope of the code. Since DRM_PANEL_ILITEK_ILI9806E is not used in any in-tree defconfig, the symbol is renamed directly to DRM_PANEL_ILITEK_ILI9806E_DSI without providing a legacy compatibility alias. Signed-off-by: Dario Binacchi Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260318073346.18041-2-dario.binacchi@amarulasolutions.com commit a7c61963b7278cbe2c27e35ce93f3787a0d5b5bf Author: Pengyu Luo Date: Mon Mar 16 16:40:40 2026 +0800 drm/panel: Add Himax HX83121A panel driver Add a driver for panels using the Himax HX83121A Display Driver IC, including support for the BOE/CSOT PPC357DB1-4, found in HUAWEI Matebook E Go series (Gaokun2/3). Signed-off-by: Pengyu Luo Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260316084040.728106-3-mitltlatltl@gmail.com commit 9f96a50d61ecb0ec07c4133b99eed99b72108887 Author: Pengyu Luo Date: Mon Mar 16 16:40:39 2026 +0800 dt-bindings: display: panel: Add Himax HX83121A HX83121A is a driver IC used to drive MIPI-DSI panels. It is found in HUAWEI Matebook E Go series (Gaokun2/3) with BOE or CSOT panels. Signed-off-by: Pengyu Luo Reviewed-by: Rob Herring (Arm) Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260316084040.728106-2-mitltlatltl@gmail.com commit 7a5b966952c0232d7083a496261880fc11cc8c4a Author: Steffen Trumtrar Date: Wed Mar 25 12:32:00 2026 +0100 drm/panel: simple: add JuTouch JT070TM041 Add JuTouch Technology JT070TM041 7" 1024x600 LVDS panel support. Signed-off-by: Steffen Trumtrar Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260325-v7-0-topic-imx8mp-skov-dts-jutouch-7inch-v1-2-10255d236439@pengutronix.de commit 87535f27061f3443e813a64f59fb1b0fcb916e08 Author: Steffen Trumtrar Date: Wed Mar 25 12:31:59 2026 +0100 dt-bindings: display: simple: Add JuTouch JT070TM041 panel Add the JuTouch Technology Co. 7" JT070TM041 LVDS panel. Signed-off-by: Steffen Trumtrar Acked-by: Conor Dooley Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260325-v7-0-topic-imx8mp-skov-dts-jutouch-7inch-v1-1-10255d236439@pengutronix.de commit 0c74f4e8d7592122c9e2c7b6f0bbdd8fd51b7fb3 Author: Mithil Bavishi Date: Mon Feb 23 08:49:35 2026 -0500 dt-bindings: display: bridge: lvds-codec: add doestek,dtc34lm85am Add compatible strings for the Doestek DTC34LM85AM Flat Panel Display Transmitter Signed-off-by: Mithil Bavishi Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260223134941.427-4-bavishimithil@gmail.com commit af475c16bc02a08ed6af6ca0c920f98a45611fe6 Author: Arnd Bergmann Date: Wed Mar 25 11:01:14 2026 +0100 gpio: fix up CONFIG_OF dependencies A number of GPIO drivers that used to have a CONFIG_OF_GPIO dependency now fail to build on targets without CONFIG_OF: WARNING: unmet direct dependencies detected for GPIO_SYSCON Depends on [n]: GPIOLIB [=y] && HAS_IOMEM [=y] && MFD_SYSCON [=y] && OF [=n] Selected by [y]: - GPIO_SAMA5D2_PIOBU [=y] && GPIOLIB [=y] && HAS_IOMEM [=y] && MFD_SYSCON [=y] && (ARCH_AT91 || COMPILE_TEST [=y]) drivers/gpio/gpio-mt7621.c: In function 'mediatek_gpio_bank_probe': drivers/gpio/gpio-mt7621.c:254:20: error: 'struct gpio_chip' has no member named 'of_gpio_n_cells' 254 | rg->chip.gc.of_gpio_n_cells = 2; | ^ drivers/gpio/gpio-tegra186.c: In function 'tegra186_gpio_of_xlate': drivers/gpio/gpio-tegra186.c:502:25: error: 'struct gpio_chip' has no member named 'of_gpio_n_cells' 502 | if (WARN_ON(chip->of_gpio_n_cells < 2)) | ^~ drivers/gpio/gpio-lpc32xx.c: In function 'lpc32xx_gpio_probe': drivers/gpio/gpio-lpc32xx.c:523:49: error: 'struct gpio_chip' has no member named 'of_xlate' 523 | lpc32xx_gpiochip[i].chip.of_xlate = lpc32xx_of_xlate; | ^ drivers/gpio/gpio-spacemit-k1.c: In function 'spacemit_gpio_add_bank': drivers/gpio/gpio-spacemit-k1.c:234:11: error: 'struct gpio_chip' has no member named 'of_gpio_n_cells' 234 | gc->of_gpio_n_cells = 3; | ^~ Bring that back as a dependency. Fixes: 7803501e5754 ("gpio: drop unneeded Kconfig dependencies on OF_GPIO") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260325100144.1696731-1-arnd@kernel.org Signed-off-by: Bartosz Golaszewski commit e1f4ecd21f04f766f2cad5cca806147f47553d2f Author: Mithil Bavishi Date: Mon Feb 23 08:49:34 2026 -0500 dt-bindings: vendor-prefixes: Add Doestek Add vendor prefix for Doestek Co., Ltd. Link: http://www.doestek.co.kr/ Signed-off-by: Mithil Bavishi Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260223134941.427-3-bavishimithil@gmail.com commit 128e5ebec856ef8d30d4244751165ef50b41d2d2 Author: Siratul Islam Date: Thu Mar 26 02:19:42 2026 +0600 iio: proximity: add driver for ST VL53L1X ToF sensor Add support for the STMicroelectronics VL53L1X Time-of-Flight ranging sensor with I2C interface. Reviewed-by: Andy Shevchenko Signed-off-by: Siratul Islam Signed-off-by: Jonathan Cameron commit 2c9225e8d2ca91f106c7b48cb97b0f745e7784a8 Author: Siratul Islam Date: Thu Mar 26 02:19:41 2026 +0600 dt-bindings: iio: proximity: add ST VL53L1X ToF sensor Add device tree binding documentation for the STMicroelectronics VL53L1X Time-of-Flight ranging sensor connected via I2C. vdd-supply is not made globally required to maintain backwards compatibility with existing st,vl53l0x devicetrees that do not specify it. Signed-off-by: Siratul Islam Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jonathan Cameron commit 059b7b5b79009af10eeeb24fb942de6fb6bea677 Author: Christoph Manszewski Date: Wed Mar 25 22:23:42 2026 +0100 mailmap: update email address for Christoph Manszewski Since I am moving from intel, map the intel mail to my personal Gmail address. Signed-off-by: Christoph Manszewski Signed-off-by: Joonas Lahtinen Link: https://patch.msgid.link/20260325212342.4388-1-c.manszewski@gmail.com commit 74657a376960252e248089e518cfaaf813906989 Author: Inochi Amaoto Date: Thu Mar 26 09:46:17 2026 +0800 riscv: dts: spacemit: Add ethernet device for K3 Add all ethernet device nodes for K3 SoC. Signed-off-by: Inochi Amaoto Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260326014617.1011732-1-inochiama@gmail.com Signed-off-by: Yixun Lan commit e3eb0e70815cc02ea15298818e37d8b0a0930ab1 Author: Chen-Yu Tsai Date: Tue Mar 17 12:00:32 2026 +0800 drm/gem-dma: set VM_DONTDUMP for mmap When the mmap function was converted from a file op to a GEM object function in commit f5ca8eb6f9bd ("drm/cma-helper: Implement mmap as GEM CMA object functions") some VM flags were not lifted from drm_gem_mmap(): - VM_IO - VM_DONTEXPAND - VM_DONTDUMP VM_DONTEXPAND was added back in commit 59f39bfa6553 ("drm/cma-helper: Set VM_DONTEXPAND for mmap"). VM_IO doesn't make sense since these are memory buffers, while "IO tells people not to look at these pages (accesses can have side effects)". Add back VM_DONTDUMP. This matches the behavior of most other GEM implementations. Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260317040034.617585-1-wenst@chromium.org Signed-off-by: Chen-Yu Tsai commit 1998e6be8239cd37817e05bdc21439de17b904df Author: Alexandre Courbot Date: Wed Mar 25 11:46:23 2026 +0900 Documentation: nova: remove register abstraction task The `register!` macro has been implemented and all nova-core code converted to use it. Remove the corresponding task in todo.rst. Reviewed-by: Eliot Courtney Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260325-b4-nova-register-v4-10-bdf172f0f6ca@nvidia.com Signed-off-by: Alexandre Courbot commit 2278f97bb3e121504fe7f6ecbcfc11e8b6a3dc6e Author: Alexandre Courbot Date: Wed Mar 25 11:46:22 2026 +0900 gpu: nova-core: remove `io::` qualifier to register macro invocations The kernel's `register` macro would clash with nova-core's own version if it was imported directly, so it was accessed through its `io` module during the conversion phase. Now that nova-core's `register` macro doesn't exist anymore, we can import and use it directly without risk of name collision. Reviewed-by: Eliot Courtney Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260325-b4-nova-register-v4-9-bdf172f0f6ca@nvidia.com Signed-off-by: Alexandre Courbot commit 38f7e5450ebfc6f2e046a249a3f629ea7bec8c31 Author: Alexandre Courbot Date: Wed Mar 25 11:46:21 2026 +0900 gpu: nova-core: convert falcon registers to kernel register macro Convert all PFALCON, PFALCON2 and PRISCV registers to use the kernel's register macro and update the code accordingly. Because they rely on the same types to implement relative registers, they need to be updated in lockstep. nova-core's local register macro is now unused, so remove it. Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260325-b4-nova-register-v4-8-bdf172f0f6ca@nvidia.com [acourbot@nvidia.com: remove unused import.] Signed-off-by: Alexandre Courbot commit 02ade2557eba91143f56837593ed821da4144e82 Author: Alexandre Courbot Date: Wed Mar 25 11:46:20 2026 +0900 gpu: nova-core: convert PDISP registers to kernel register macro Convert all PDISP registers to use the kernel's register macro and update the code accordingly. Reviewed-by: Eliot Courtney Reviewed-by: Joel Fernandes Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260325-b4-nova-register-v4-7-bdf172f0f6ca@nvidia.com Signed-off-by: Alexandre Courbot commit 1a8f58c5e125d61c597d420237750d2dcea32ce8 Author: Alexandre Courbot Date: Wed Mar 25 11:46:19 2026 +0900 gpu: nova-core: convert FUSE registers to kernel register macro Convert all FUSE registers to use the kernel's register macro and update the code accordingly. Reviewed-by: Eliot Courtney Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260325-b4-nova-register-v4-6-bdf172f0f6ca@nvidia.com Signed-off-by: Alexandre Courbot commit ffabad08e46e425781a5d3a7f9e6a64c12e36de2 Author: Alexandre Courbot Date: Wed Mar 25 11:46:18 2026 +0900 gpu: nova-core: convert GC6 registers to kernel register macro Convert all GC6 registers to use the kernel's register macro and update the code accordingly. Reviewed-by: Eliot Courtney Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260325-b4-nova-register-v4-5-bdf172f0f6ca@nvidia.com Signed-off-by: Alexandre Courbot commit 797385890759d6a011ccd7a028eed6c43142450b Author: Alexandre Courbot Date: Wed Mar 25 11:46:17 2026 +0900 gpu: nova-core: convert PFB registers to kernel register macro Convert all PFB registers to use the kernel's register macro and update the code accordingly. NV_PGSP_QUEUE_HEAD was somehow caught in the PFB section, so move it to its own section and convert it as well. Reviewed-by: Eliot Courtney Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260325-b4-nova-register-v4-4-bdf172f0f6ca@nvidia.com Signed-off-by: Alexandre Courbot commit 4e7588dcb0a7fef0e709f6907fc42bb7d7458038 Author: Alexandre Courbot Date: Wed Mar 25 11:46:16 2026 +0900 gpu: nova-core: convert PBUS registers to kernel register macro Convert all PBUS registers to use the kernel's register macro and update the code accordingly. Reviewed-by: Eliot Courtney Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260325-b4-nova-register-v4-3-bdf172f0f6ca@nvidia.com Signed-off-by: Alexandre Courbot commit 1b155edcab0832a887387dd77e209e37beb7b49c Author: Alexandre Courbot Date: Wed Mar 25 11:46:15 2026 +0900 gpu: nova-core: convert PMC registers to kernel register macro Convert all PMC registers to use the kernel's register macro and update the code accordingly. Reviewed-by: Eliot Courtney Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260325-b4-nova-register-v4-2-bdf172f0f6ca@nvidia.com Signed-off-by: Alexandre Courbot commit b525d0c5e9ec4e51b54b8853047303957e8afbc4 Author: Alexandre Courbot Date: Wed Mar 25 11:46:14 2026 +0900 gpu: nova-core: introduce `bounded_enum` macro Introduce a powered-up version of our ad-hoc `impl_from_enum_to_u8` macro that allows the definition of an enum type associated to a `Bounded` of a given width, and provides the `From` and `TryFrom` implementations required to use that enum as a register field member. This allows us to generate the required conversion implementations for using the kernel register macro and skip some tedious boilerplate. Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260325-b4-nova-register-v4-1-bdf172f0f6ca@nvidia.com Signed-off-by: Alexandre Courbot commit 1de647abdfda9dc307503d0a85152161850ba52c Author: Jouni Högander Date: Fri Mar 20 10:04:03 2026 +0200 drm/i915/psr: Fixes for Dell XPS DA14260 quirk Dell seems to be changing device ID even within same device model. Due to this we need to ignore device ID when applying quirk for Dell XPS 14 DA14260. Do this by adding DEVICE_ID_ANY and assign it to Dell XPS 14 DA14260 quirk. Also apply the quirk only for eDP Panel Replay. Fixes: 45c77d4bf8d4 ("drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk") Cc: Mika Kahola Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://patch.msgid.link/20260320080403.1396926-1-jouni.hogander@intel.com commit f546c77038ab898726e7344255217fbec382b97f Author: Zhao Mengmeng Date: Thu Mar 26 10:51:55 2026 +0800 tools/sched_ext: scx_pair: fix pair_ctx indexing for CPU pairs scx_pair sizes pair_ctx to nr_cpu_ids / 2, so valid pair_ctx keys are dense pair indexes in the range [0, nr_cpu_ids / 2). However, the userspace setup code stores pair_id as the first CPU number in each pair. On an 8-CPU system with "-S 1", that produces pair IDs 0, 2, 4 and 6 for pairs [0,1], [2,3], [4,5] and [6,7]. CPUs in the latter half then look up pair_ctx with out-of-range keys and the BPF scheduler aborts with: EXIT: scx_bpf_error (scx_pair.bpf.c:328: failed to lookup pairc and in_pair_mask for cpu[5]) Assign pair_id using a dense pair counter instead so that each CPU pair maps to a valid pair_ctx entry. Besides, reject odd CPU configuration, as scx_pair requires all CPUs to be paired. Fixes: f0262b102c7c ("tools/sched_ext: add scx_pair scheduler") Signed-off-by: Zhao Mengmeng Signed-off-by: Tejun Heo commit 1601fe9e0423d813b1158a52e051bd3059f74197 Author: Thorsten Blum Date: Tue Mar 10 11:26:53 2026 +0100 ecryptfs: Log function name only once in decode_and_decrypt_filename ecryptfs_printk() already prints the function name using %s and __func__. Drop the redundant function name from the debug log message. Signed-off-by: Thorsten Blum Signed-off-by: Tyler Hicks commit fb1b02dc02da0ff63a5965056db0c9f77842bd19 Author: Thorsten Blum Date: Mon Mar 9 23:48:24 2026 +0100 ecryptfs: Remove redundant if checks in encrypt_and_encode_filename The outer if already checks if 'mount_crypt_stat' is true. Drop checking 'mount_crypt_stat' again. Use ecryptfs_printk() while we're at it. Signed-off-by: Thorsten Blum Signed-off-by: Tyler Hicks commit 3b7f363b7bba203318c77d91c131123cf059cdbb Author: Thorsten Blum Date: Thu Feb 5 14:25:32 2026 +0100 ecryptfs: Fix tag number in encrypt_filename() error message Report the correct tag number (70) instead of tag 72. Use ecryptfs_printk() and reformat the string to silence the checkpatch warning: "WARNING: quoted string split across lines". Signed-off-by: Thorsten Blum Signed-off-by: Tyler Hicks commit 8b9bf58bc3a6f148d990bb697a3b6dbb11672f86 Author: Thorsten Blum Date: Thu Feb 5 14:24:51 2026 +0100 ecryptfs: Use struct_size to improve process_response + send_miscdev Use struct_size(), which provides additional compile-time checks for structures with flexible array members (e.g., __must_be_array()), to determine the allocation size for a new 'struct ecryptfs_message'. In send_miscdev(), reuse 'msg_size' instead of recalculating it. Signed-off-by: Thorsten Blum Signed-off-by: Tyler Hicks commit f7a1c0283f135833db164cc0fac8d422fed2079e Author: Thorsten Blum Date: Thu Feb 5 13:51:00 2026 +0100 ecryptfs: Replace memcpy + manual NUL termination with strscpy Use strscpy() to copy the NUL-terminated '->token.password.signature' and 'sig' to the destination buffers instead of using memcpy() followed by manual NUL terminations. Signed-off-by: Thorsten Blum Signed-off-by: Tyler Hicks commit 7d9ebf33d85317f3f258c627de51701e2bf7642d Author: Frank Hsiao 蕭法宣 Date: Fri May 17 10:09:55 2024 +0000 ecryptfs: Set s_time_gran to get correct time granularity Set the eCryptfs superblock time granularity, using the lower filesystem's s_time_gran value, to prevent unnecessary inode timestamp truncation to the granularity of a full second. The use of utimensat(2) to set a timestamp with nanosecond precision would trigger this bug. That occurred when using the following utilities to update timestamps of a file: * cp -p: copy a file and preserve its atime and mtime * touch -r: touch a file and use a reference file's timestamps Closes: https://bugs.launchpad.net/ecryptfs/+bug/1890486 Signed-off-by: Frank Hsiao 蕭法宣 [tyhicks: Partially rewrite the commit message] Signed-off-by: Tyler Hicks commit 85adc680c60bcd3b3ff83296410f13eee49f5df0 Author: Gopikrishna Garmidi Date: Tue Mar 24 10:14:57 2026 -0700 soc: qcom: ubwc: Add support for Mahua Mahua is a derivative of the Glymur SoC. Add the Mahua compatible to the UBWC configuration table to enable support. Signed-off-by: Gopikrishna Garmidi Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260324-mahua_ubwc_config_support-v1-1-037d35ff2317@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2725be96755b6f9c5a1fa41a1a675a86d9e8a019 Author: Srinivas Kandagatla Date: Tue Mar 24 12:53:49 2026 +0000 soc: qcom: pd-mapper: Add support for Glymur and Mahua Add Protection Domains for Qualcomm Glymur and Mahua SoC which have both ADSP and CDSP. Adding this entry to the kernel will avoid the need for userspace to provide this service. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260324125349.2380904-1-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3eb8f022919187e2fe786f677569d2bd5a0b1915 Author: Cheng-Yang Chou Date: Thu Mar 26 09:48:27 2026 +0800 sched_ext: Fix missing SCX_EV_SUB_BYPASS_DISPATCH aggregation in scx_read_events() 025b1bd41965 introduced SCX_EV_SUB_BYPASS_DISPATCH to track scheduling of bypassed descendant tasks, and correctly increments it per-CPU and displays it in sysfs and dump output. However, scx_read_events() which aggregates per-CPU counters into a summary was not updated to include this event, causing it to always read as zero in sysfs, in debug dumps, and via the scx_bpf_events() kfunc. Add the missing scx_agg_event() call for SCX_EV_SUB_BYPASS_DISPATCH. Fixes: 025b1bd41965 ("sched_ext: Implement hierarchical bypass mode") Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 3d6379196d5fc9698b683ec40ffd9452d2183c4a Author: Cheng-Yang Chou Date: Thu Mar 26 09:29:03 2026 +0800 sched_ext: Fix missing return after scx_error() in scx_dsq_move() When scx_bpf_dsq_move[_vtime]() is called on a task that belongs to a different scheduler, scx_error() is invoked to flag the violation. scx_error() schedules an asynchronous scheduler teardown via irq_work and returns immediately, so execution falls through and the DSQ move proceeds on a cross-scheduler task regardless, potentially corrupting DSQ state. Add the missing return false so the function exits right after reporting the error, consistent with the other early-exit checks in the same function (e.g. scx_vet_enq_flags() failure at the top). Fixes: bb4d9fd55158 ("sched_ext: scx_dsq_move() should validate the task belongs to the right scheduler") Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 3d4939c0ec011ad6dfda7c13362b3d2013425789 Author: Tomasz Lis Date: Fri Mar 20 15:57:33 2026 +0100 drm/xe: Fix confusion with locals on context creation After setting a local variable, check that local value rather that checking destination at which the value will be stored later. This fixes the obvious mistake in error path; without it, allocation fail would lead to NULL dereference during context creation. Fixes: 89340099c6a4 ("drm/xe/lrc: Refactor context init into xe_lrc_ctx_init()") Signed-off-by: Tomasz Lis Cc: Raag Jadav Cc: Matthew Brost Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260320145733.1337682-1-tomasz.lis@intel.com commit 4e966014ce8826bb7d0180394f40b643b1405925 Author: Francois Dugast Date: Wed Mar 25 17:01:52 2026 +0100 drm/xe: Add new SVM copy GT stats per size Breakdown the GT stats for copy to host and copy to device per size (4K, 64K 2M) to make it easier for user space to track memory migrations. This is helpful to verify allocation alignment is correct when porting applications to SVM. Cc: Matthew Brost Signed-off-by: Francois Dugast Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260325160152.1057556-1-francois.dugast@intel.com commit 442ba16a5a51368f5bafd011609f40782aec6d65 Author: Lyude Paul Date: Mon Mar 16 17:16:12 2026 -0400 rust: gem: Introduce DriverObject::Args This is an associated type that may be used in order to specify a data-type to pass to gem objects when constructing them, allowing for drivers to more easily initialize their private-data for gem objects. Signed-off-by: Lyude Paul Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Reviewed-by: Janne Grunau Tested-by: Deborah Brouwer Link: https://patch.msgid.link/20260316211646.650074-5-lyude@redhat.com [ Resolve merge conflicts in Tyr. - Danilo ] Signed-off-by: Danilo Krummrich commit 50c577eab051638fbe8989fae1f826ecc1d2e2c7 Author: Jonathan Cavitt Date: Tue Mar 24 15:29:40 2026 +0000 drm/xe/xe_vm: Implement xe_vm_get_property_ioctl Add support for userspace to request a list of observed faults from a specified VM. v2: - Only allow querying of failed pagefaults (Matt Brost) v3: - Remove unnecessary size parameter from helper function, as it is a property of the arguments. (jcavitt) - Remove unnecessary copy_from_user (Jainxun) - Set address_precision to 1 (Jainxun) - Report max size instead of dynamic size for memory allocation purposes. Total memory usage is reported separately. v4: - Return int from xe_vm_get_property_size (Shuicheng) - Fix memory leak (Shuicheng) - Remove unnecessary size variable (jcavitt) v5: - Rename ioctl to xe_vm_get_faults_ioctl (jcavitt) - Update fill_property_pfs to eliminate need for kzalloc (Jianxun) v6: - Repair and move fill_faults break condition (Dan Carpenter) - Free vm after use (jcavitt) - Combine assertions (jcavitt) - Expand size check in xe_vm_get_faults_ioctl (jcavitt) - Remove return mask from fill_faults, as return is already -EFAULT or 0 (jcavitt) v7: - Revert back to using xe_vm_get_property_ioctl - Apply better copy_to_user logic (jcavitt) v8: - Fix and clean up error value handling in ioctl (jcavitt) - Reapply return mask for fill_faults (jcavitt) v9: - Future-proof size logic for zero-size properties (jcavitt) - Add access and fault types (Jianxun) - Remove address type (Jianxun) v10: - Remove unnecessary switch case logic (Raag) - Compress size get, size validation, and property fill functions into a single helper function (jcavitt) - Assert valid size (jcavitt) v11: - Remove unnecessary else condition - Correct backwards helper function size logic (jcavitt) v12: - Use size_t instead of int (Raag) v13: - Remove engine class and instance (Ivan) v14: - Map access type, fault type, and fault level to user macros (Matt Brost, Ivan) v15: - Remove unnecessary size assertion (jcavitt) v16: - Nit fixes (Matt Brost) v17: - Rebase and refactor (jcavitt) v18: - Do not copy_to_user in critical section (Matt Brost) - Assert args->size is multiple of sizeof(struct xe_vm_fault) (Matt Brost) v19: - Remove unnecessary memset (Matt Brost) v20: - Report canonicalized address (Jose) - Mask out prefetch data from access type (Jose, jcavitt) v21: - s/uAPI/Link in the commit log links - Align debug parameters Link: https://github.com/intel/compute-runtime/pull/878 Signed-off-by: Jonathan Cavitt Suggested-by: Matthew Brost Reviewed-by: Matthew Brost Acked-by: Michal Mrozek Cc: Jainxun Zhang Cc: Shuicheng Lin Cc: Raag Jadav Cc: Ivan Briano Cc: Jose Souza Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260324152935.72444-10-jonathan.cavitt@intel.com commit 64c732ee2a00a2d6a2693ed25663fa0544c56ba8 Author: Jonathan Cavitt Date: Tue Mar 24 15:29:39 2026 +0000 drm/xe/xe_vm: Add per VM fault info Add additional information to each VM so they can report up to the first 50 seen faults. Only pagefaults are saved this way currently, though in the future, all faults should be tracked by the VM for future reporting. Additionally, of the pagefaults reported, only failed pagefaults are saved this way, as successful pagefaults should recover silently and not need to be reported to userspace. v2: - Free vm after use (Shuicheng) - Compress pf copy logic (Shuicheng) - Update fault_unsuccessful before storing (Shuicheng) - Fix old struct name in comments (Shuicheng) - Keep first 50 pagefaults instead of last 50 (Jianxun) v3: - Avoid unnecessary execution by checking MAX_PFS earlier (jcavitt) - Fix double-locking error (jcavitt) - Assert kmemdump is successful (Shuicheng) v4: - Rename xe_vm.pfs to xe_vm.faults (jcavitt) - Store fault data and not pagefault in xe_vm faults list (jcavitt) - Store address, address type, and address precision per fault (jcavitt) - Store engine class and instance data per fault (Jianxun) - Add and fix kernel docs (Michal W) - Properly handle kzalloc error (Michal W) - s/MAX_PFS/MAX_FAULTS_SAVED_PER_VM (Michal W) - Store fault level per fault (Micahl M) v5: - Store fault and access type instead of address type (Jianxun) v6: - Store pagefaults in non-fault-mode VMs as well (Jianxun) v7: - Fix kernel docs and comments (Michal W) v8: - Fix double-locking issue (Jianxun) v9: - Do not report faults from reserved engines (Jianxun) v10: - Remove engine class and instance (Ivan) v11: - Perform kzalloc outside of lock (Auld) v12: - Fix xe_vm_fault_entry kernel docs (Shuicheng) v13: - Rebase and refactor (jcavitt) v14: - Correctly ignore fault mode in save_pagefault_to_vm (jcavitt) v15: - s/save_pagefault_to_vm/xe_pagefault_save_to_vm (Matt Brost) - Use guard instead of spin_lock/unlock (Matt Brost) - GT was added to xe_pagefault struct. Use xe_gt_hw_engine instead of creating a new helper function (Matt Brost) v16: - Set address precision programmatically (Matt Brost) v17: - Set address precision to fixed value (Matt Brost) v18: - s/uAPI/Link in commit log links - Use kzalloc_obj Link: https://github.com/intel/compute-runtime/pull/878 Signed-off-by: Jonathan Cavitt Suggested-by: Matthew Brost Reviewed-by: Matthew Brost Cc: Shuicheng Lin Cc: Jianxun Zhang Cc: Michal Wajdeczko Cc: Michal Mzorek Cc: Ivan Briano Cc: Matthew Auld Cc: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260324152935.72444-9-jonathan.cavitt@intel.com commit 716c11d462c598328edca2565e8d25457c6ee3d6 Author: Jonathan Cavitt Date: Tue Mar 24 15:29:38 2026 +0000 drm/xe/uapi: Define drm_xe_vm_get_property Add initial declarations for the drm_xe_vm_get_property ioctl. v2: - Expand kernel docs for drm_xe_vm_get_property (Jianxun) v3: - Remove address type external definitions (Jianxun) - Add fault type to xe_drm_fault struct (Jianxun) v4: - Remove engine class and instance (Ivan) v5: - Add declares for fault type, access type, and fault level (Matt Brost, Ivan) v6: - Fix inconsistent use of whitespace in defines v7: - Rebase and refactor (jcavitt) v8: - Rebase (jcavitt) v9: - Clarify address is canonical (José) v10: - s/uAPI/Link in the commit log links Link: https://github.com/intel/compute-runtime/pull/878 Signed-off-by: Jonathan Cavitt Reviewed-by: Shuicheng Lin Acked-by: Matthew Brost Acked-by: Ivan Briano Acked-by: José Roberto de Souza Cc: Zhang Jianxun Cc: Ivan Briano Cc: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260324152935.72444-8-jonathan.cavitt@intel.com commit 714ee6754ac5fa3dc078856a196a6b124cd797a0 Author: Jonathan Cavitt Date: Tue Mar 24 15:29:37 2026 +0000 drm/xe/xe_pagefault: Disallow writes to read-only VMAs The page fault handler should reject write/atomic access to read only VMAs. Add code to handle this in xe_pagefault_service after the VMA lookup. v2: - Apply max line length (Matthew) Fixes: fb544b844508 ("drm/xe: Implement xe_pagefault_queue_work") Signed-off-by: Jonathan Cavitt Suggested-by: Matthew Brost Cc: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260324152935.72444-7-jonathan.cavitt@intel.com commit e64b9cc293ae710c815c2de1ec9dcaa0784a8017 Author: Lyude Paul Date: Mon Mar 16 17:16:09 2026 -0400 rust: drm: Add gem::impl_aref_for_gem_obj! In the future we're going to be introducing more GEM object types in rust then just gem::Object. Since all types of GEM objects have refcounting, let's introduce a macro that we can use in the gem crate in order to copy this boilerplate implementation for each type: impl_aref_for_gem_obj!(). Signed-off-by: Lyude Paul Reviewed-by: Daniel Almeida Reviewed-by: Janne Grunau Tested-by: Deborah Brouwer Link: https://patch.msgid.link/20260316211646.650074-2-lyude@redhat.com [ Resolve merge conflicts. - Danilo ] Signed-off-by: Danilo Krummrich commit a313357a346839d40b3a4dec393c71bf30cbb34c Author: Andrea Righi Date: Wed Mar 25 22:21:00 2026 +0100 sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle ops.dispatch() is invoked when a CPU becomes available. This can occur when a task voluntarily yields the CPU, exhausts its time slice, or is preempted for other reasons. If the task is still runnable, refilling its time slice in ops.dispatch() (either by the BPF scheduler or the sched_ext core) allows it to continue running without triggering ops.stopping(). However, this behavior is not clearly reflected in the current task lifecycle diagram. Update the diagram to better represent this interaction. Fixes: 9465f44d2df2 ("sched_ext: Documentation: Clarify time slice handling in task lifecycle") Cc: stable@vger.kernel.org # v6.17+ Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 13c072b8e91a5ccb5855ca1ba6fe3ea467dbf94d Merge: 74919e27977275 f338e77383789c Author: Dave Airlie Date: Thu Mar 26 09:41:26 2026 +1000 BackMerge tag 'v7.0-rc4' into drm-next Linux 7.0-rc4 Needed for rust tree. Signed-off-by: Dave Airlie commit 6cb4ec63ba9a5831621cf951b7af55c67beeb97b Author: Pedro Alves Date: Mon Mar 23 09:25:33 2026 +0000 arm64: dts: rockchip: configure hdmirx in Rock 5 ITX The Radxa Rock 5 ITX board exposes an HDMI input exactly the same way as the Rock 5B, but this was not reflected in its DTS. Change the rk3588-rock-5-itx to configure and enable the hdmi_receiver and hdmi_receiver_cma nodes. The hot-plug detection (HPD) pin keeps the hdmirx_det name rather than the hdmirx_hpd name used in other boards since that is what matches the official schematics (HDMIIRX_DET_L). The configurations were confirmed to be identical on the downstream Radxa kernel, and this has been tested to work on a Rock 5 ITX board running kernel 6.19.3. Signed-off-by: Pedro Alves Link: https://patch.msgid.link/20260323-radxa-r5-itx-hdmirx-v2-1-c52501909577@pta2002.com Signed-off-by: Heiko Stuebner commit 15ca411bd93675e5283f43a2a73b13f5e57406e3 Author: Dmitry Baryshkov Date: Wed Mar 25 03:45:12 2026 +0200 ARM: dts: qcom: drop apq8084 support APQ8084 is one of the platforms which gained very little interest upstream. It doesn't look like the there was any interest in these devices since December 2019. Two devices supported upstream have very minumal DT files. Start forgetting about the platform by removing DT files. Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260325-drop-8084-dt-v1-1-a0255a404355@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9a116af73a3c90cbfc78d6b007325539056f83be Author: Krzysztof Kozlowski Date: Wed Mar 25 13:16:49 2026 +0100 soc: qcom: ubwc: Add configuration Eliza SoC Add configuration data and an entry to OF table for matching the Eliza SoC. Reviewed-by: Konrad Dybcio Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260325-drm-display-eliza-v3-8-dc2b2f0c74a2@oss.qualcomm.com [bjorn: Reordered device_id list] Signed-off-by: Bjorn Andersson commit 624a97208904ed50288f32e8b1ecc9ff9aeddf1b Author: Krzysztof Kozlowski Date: Wed Mar 25 13:08:47 2026 +0100 soc: qcom: ubwc: Remove redundant x1e80100_data UBWC data for X1E80100 is exactly the same as one for SM8550, so reduce code duplication by reusing older entry. Reviewed-by: Konrad Dybcio Cc: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260325120846.139836-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 865867a6652adeae23b64a9735bb727b49eb92a0 Author: Colin Ian King Date: Wed Mar 25 20:35:55 2026 +0000 EDAC/i10nm: Fix spelling mistake "readd" -> "read" There is a spelling mistake in a i10nm_printk error message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Tony Luck Link: https://patch.msgid.link/20260325203556.1228975-1-colin.i.king@gmail.com commit 6b4cd7b76ee7ed4fb6c74d3876a73979b3669536 Author: Giorgi Tchankvetadze Date: Mon Mar 23 10:46:41 2026 +0400 iio: adc: max11410: make vref register name arrays static const The vrefp_regs and vrefn_regs arrays are constant lookup tables and are not modified. Make them static const so they are not reinitialized on each probe call and are placed in read-only memory. Mark the pointer array as const as well to prevent unintended modification. Signed-off-by: Giorgi Tchankvetadze Signed-off-by: Jonathan Cameron commit 7198b881fb00526f6e1125bba0a24e7dc8d95a90 Author: Gabriel Rondon Date: Mon Mar 23 21:56:19 2026 +0000 iio: accel: bmc150-accel-core: use sysfs_emit() in show functions Replace sprintf() with sysfs_emit() in sysfs attribute show callbacks. sysfs_emit() is the preferred API as it is aware of the sysfs buffer page size limit. Signed-off-by: Gabriel Rondon Signed-off-by: Jonathan Cameron commit 7dd6f81f4ef801b57f6ce7b0eee32aef5c488538 Author: Benjamin Berg Date: Wed Mar 25 21:57:39 2026 +0200 wifi: mac80211: ignore reserved bits in reconfiguration status The Link ID Info field in the Reconfiguration Status Duple subfield of the Reconfiguration Response frame only uses the lower four bits for the link ID. The upper bits are reserved and should therefore be ignored. Signed-off-by: Benjamin Berg Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260325215404.ab5ccf4bc62e.I9aef8f4fb6f1b06671bb6cf0e2bd4ec6e4c8bda4@changeid Signed-off-by: Johannes Berg commit 8abf158b84ca34d5a37566b8d9a641f8a06f7eae Author: Neel Bullywon Date: Mon Mar 23 19:33:16 2026 -0400 iio: frequency: adf4350: replace TODO with NOTE in adf4350_set_freq() Replace the TODO comment in adf4350_set_freq() with a NOTE explaining that a constant-time approach using fls_long() was attempted but deemed more complex without meaningful benefit for initialization code. Signed-off-by: Neel Bullywon Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit e465ce0a8801e37d3092b2b364be59cd7f9ad49a Author: Avraham Stern Date: Wed Mar 18 14:39:26 2026 +0200 wifi: cfg80211: allow protected action frame TX for NAN Allow transmitting protected dual of public action frames on NAN device and NAN data interfaces, since NAN action frames may be protected and can be sent on both. Signed-off-by: Avraham Stern Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260318143604.73801a92180c.I16000c3e1e2bbc320457db1ac728d789bb2f36c6@changeid Signed-off-by: Johannes Berg commit 15d6dacdc97dce5ca8a0baf40f5fe8f3dcfef516 Author: Ilan Peer Date: Wed Mar 18 14:39:25 2026 +0200 wifi: ieee80211: Add some missing NAN definitions Add some missing NAN Device capabilities definitions. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260318143604.5f6b36d2b208.I7ef571682d5add96eabfcf87f81285893021e851@changeid Signed-off-by: Johannes Berg commit 154b0296c0ecd3edb05555f824b6061438de2cd4 Author: Miri Korenblit Date: Wed Mar 18 14:39:24 2026 +0200 wifi: nl80211: Add a notification to notify NAN channel evacuation If all available channel resources are used for NAN channels, and one of them is shared with another interface, and that interface needs to move to a different channel (for example STA interface that needs to do a channel or a link switch), then the driver can evacuate one of the NAN channels (i.e. detach it from its channel resource and announce to the peers that this channel is ULWed). In that case, the driver needs to notify user space about the channel evacuation, so the user space can adjust the local schedule accordingly. Add a notification to let userspace know about it. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219114327.d5bebfd5ff73.Iaaf5ef17e1ab7a38c19d60558e68fcf517e2b400@changeid Link: https://patch.msgid.link/20260318123926.206536-11-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit 44ea50a5bf304d3d6b55e4a2f946ce3c45a4e648 Author: Miri Korenblit Date: Wed Mar 18 14:39:23 2026 +0200 wifi: nl80211: add NL80211_CMD_NAN_ULW_UPDATE notification Add a new notification command that allows drivers to notify user space when the device's ULW (Unaligned Schedule) blob has been updated. This enables user space to attach the updated ULW blob to frames sent to NAN peers. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219114327.32b715af4ebb.Ibdb6e33941afd94abf77245245f87e4338d729d3@changeid Link: https://patch.msgid.link/20260318123926.206536-10-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit f826534483bac96320a3686694e3e1a033087240 Author: Miri Korenblit Date: Wed Mar 18 14:39:22 2026 +0200 wifi: nl80211: allow reporting spurious NAN Data frames Currently we have this ability for AP and GO. But it is now needed also for NAN_DATA mode - as per Wi-Fi Aware (TM) 4.0 specification 6.2.5: "If a NAN Device receives a unicast NAN Data frame destined for it, but with A1 address and A2 address that are not assigned to the NDP, it shall discard the frame, and should send a Data Path Termination NAF to the frame transmitter" To allow this, change NL80211_CMD_UNEXPECTED_FRAME to support also NAN_DATA, so drivers can report such cases and the user space can act accordingly. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260108102921.5cf9f1351655.I47c98ce37843730b8b9eb8bd8e9ef62ed6c17613@changeid Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219094725.3846371-6-miriam.rachel.korenblit@intel.com Link: https://patch.msgid.link/20260318123926.206536-9-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit 21ade3eed33e055aa67e0b99ff33b6eafb57a5ec Author: Daniel Gabay Date: Wed Mar 18 14:39:21 2026 +0200 wifi: cfg80211: allow ToDS=0/FromDS=0 data frames on NAN data interfaces According to Wi-Fi Aware (TM) specification Table 3, data frame should have 0 in the FromDS/ToDS fields. Don't drop received frames with 0 FromDS/ToDS if they are received on NAN_DATA interface. While at it, fix a double indent. Signed-off-by: Daniel Gabay Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260108102921.de5f318a790a.Id34dd69552920b579e6881ffd38fa692a491b601@changeid Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219094725.3846371-5-miriam.rachel.korenblit@intel.com Link: https://patch.msgid.link/20260318123926.206536-8-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit c4aa273ff6b5dae62f4981763bd91047ea6ffdda Author: Miri Korenblit Date: Wed Mar 18 14:39:20 2026 +0200 wifi: nl80211: define an API for configuring the NAN peer's schedule Add an NL80211 command to configure the NAN schedule of a NAN peer. Such a schedule contains a list of NAN channels, and a mapping from each time slots to the corresponding channel (or unscheduled). Also contains more information about the schedule, such as sequence ID and map ID. Not all of the restrictions are validated in this patch. In particular, comparison of two maps of the same peer requires storing/retrieving each map of each peer, only for validation. Therefore, it is the responsibilty of the driver to check that. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219114327.5b13fa5af4f6.If0e214ff5b52c9666e985fefa3f7be0ad14d93fb@changeid Link: https://patch.msgid.link/20260318123926.206536-7-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit 1f1101c29e55195db7b52bef47d11978442998e0 Author: Miri Korenblit Date: Wed Mar 18 14:39:19 2026 +0200 wifi: nl80211: add support for NAN stations There are 2 types of logical links with a NAN peer: - management (NMI), which is used for Tx/Rx of NAN management frames. - data (NDI), which is used for Tx/Rx of data frames, or non-NAN management frames. The NMI station has two roles: - representation of the NAN peer - for example, the peer's schedule and the HT, VHT, HE capabilities - belong to the NMI station, and not to the NDI ones. - Tx/Rx of NAN management frames to/from the peer. The NDI station is used for Tx/Rx data frames of a specific NDP that was established with the NAN peer. Note that a peer can choose to reuse its NMI address as the NDI address. In that case, it is expected that two stations will be added even though they will have the same address. - An NDI station can only be added after the corresponding NMI station was configured with capabilities. - All the NDI stations will be removed before the NDI interface is brought down. - All NMI stations will be removed before NAN is stopped. - Before NMI sta removal, all corresponding NDI stations will be removed Add support for adding, removing, and changing NMI and NDI stations. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219114327.d280936ee832.I6d859eee759bb5824a9ffd2984410faf879ba00e@changeid Link: https://patch.msgid.link/20260318123926.206536-6-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit bd11c96604693723297c403625c3059b33fb0618 Author: Miri Korenblit Date: Wed Mar 18 14:39:18 2026 +0200 wifi: cfg80211: separately store HT, VHT and HE capabilities for NAN In NAN, unlike in other modes, there is only one set of (HT, VHT, HE) capabilities that is used for all channels (and bands) used in the NAN data path. This set of capabilities will have to be a special one, for example - have the minimum of (HT-for-5 GHz, HT-for-2.4 GHz), careful handling of the bits that have a different meaning for each band, etc. While we could use the exiting sband/iftype capabilities, and require identical capabilities for all bands (makes no sense since this means that we will have VHT capabilities in the 2.4 GHz slot), or require that only one of the sbands will be set, or have logic to extract the minimum and handle the conflicting bits - it seems simpler to add a dedicated set of capabilities which is special for NAN, and is band agnostic, to be populated by the driver. That way we also let the driver decide how it wants to handle the conflicting bits. Add this special set of these capabilities to wiphy:nan_capabilities, to be populated by the driver. Send it to user space. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219114327.4b6f3e4a81b4.I45422adc0df3ad4101d857a92e83f0de5cf241e1@changeid Link: https://patch.msgid.link/20260318123926.206536-5-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit 0e8ec738a71ee4e8da7c56d21dd7bb54f954c38b Author: Miri Korenblit Date: Wed Mar 18 14:39:17 2026 +0200 wifi: cfg80211: add support for NAN data interface This new interface type represents a NAN data interface (NDI). It is used for data communication with NAN peers. Note that the existing NL80211_IFTYPE_NAN interface, which is the NAN Management Interface (NMI), is used for management communication. An NDI interface is started when a new NAN data path is about to be established, and is stopped after the NAN data path is terminated. - An NDI interface can only be started if the NMI is running, and NAN is started. - Before the NMI is stopped, the NDI interfaces will be stopped. Add the new interface type, handle add/remove operations for it, and makes sure of the conditions above. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219114327.0d681335c2e2.I92973483e927820ae2297853c141842fdb262747@changeid Link: https://patch.msgid.link/20260318123926.206536-4-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit 763a5a580f9532d58b6c9f9e9723ceaa8332d5ca Author: Miri Korenblit Date: Wed Mar 18 14:39:16 2026 +0200 wifi: cfg80211: make sure NAN chandefs are valid Until now there was not handling for NAN in reg_wdev_chan_valid. Now as this wdev might use chandefs, check the validity of those. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260108102921.51b42ffc9a42.Iacb030fc17027afb55707ca1d6dc146631d55767@changeid Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219094725.3846371-4-miriam.rachel.korenblit@intel.com Link: https://patch.msgid.link/20260318123926.206536-3-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit 6e78b70c9a3d2a627229801f93e3f62869922587 Author: Miri Korenblit Date: Wed Mar 18 14:39:15 2026 +0200 wifi: cfg80211: Add an API to configure local NAN schedule Add an nl80211 API to allow user space to configure the local NAN schedule. The local schedule consists of a list of channel definitions and a schedule map, in which each element covers a time slot and indicates on what channel the device should be in that time slot. Channels can be added to schedule even without being scheduled, for reservation purposes. A schedule can be configured either immedietally or be deferred, in case there are already connected peers. When the deferred flag is set, the command is a request from the device to perform an announced schedule update: send the updated NAN Availability - as set in this command - to the peers, and do the actual switch to the new schedule on the right time (i.e. at the end of the slot after the slot in which the update was sent to the peers). In addition, a notification will be sent to indicate a deferred update completion. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219114327.ecca178a2de0.Ic977ab08b4ed5cf9b849e55d3a59b01ad3fbd08e@changeid Link: https://patch.msgid.link/20260318123926.206536-2-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit ed406a28281cec398f2e19617369b0f920f81bec Merge: ad73dea1a4ac26 95d12fc4ef4522 Author: Johannes Berg Date: Wed Mar 25 20:51:16 2026 +0100 Merge tag 'iwlwifi-next-2026-03-25' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next into wireless-next Miri Korenblit says: ==================== wifi: iwlwifi: updates - 2026-03-25 ==================== Looks like among mostly cleanups there's - UNII-9 enablement, - more UHR work, and - various FW API updates Signed-off-by: Johannes Berg commit ad73dea1a4ac26c3ee95dd9c7a01ebe5ce299ac1 Author: Miri Korenblit Date: Wed Mar 25 15:48:23 2026 +0200 wifi: mac80211: cleanup error path of ieee80211_do_open If we failed on drv_start, we currently cleanup AP_VLAN reference to bss. But this is not needed, since AP_VLAN must be tied to a pre-existing AP interface, so open_count cannot be 0, so we will never call drv_start for AP_VLAN interfaces. Remove these cleanup and return immediately instead. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260325154742.3c532a9132c3.Idac5c38d5ad7ce97782a8c05ae72bb0c689c4fa9@changeid Signed-off-by: Johannes Berg commit 506e26881751ad4c7093cb06ba46d312af13e33b Author: Miri Korenblit Date: Wed Mar 25 15:46:09 2026 +0200 wifi: mac80211: extract channel logic from link logic The logic that tries to reuse an existing chanctx or create a new one if such doesn't exist will be used for other types of chanctx users. Extract this logic from _ieee80211_link_use_channel. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260325154550.9a08397a7590.Id24934d14f240f8d38a23f3b1786235bac0b3e60@changeid Signed-off-by: Johannes Berg commit 8625d418d24bc0ff463267b26b7cb2e7a612495f Author: Kyle Hsieh Date: Wed Mar 25 10:24:22 2026 +0800 iio: adc: ltc2309: add support for ltc2305 Add support for the LTC2305 ADC to the LTC2309 driver. The LTC2305 is a 2-channel, 12-bit SAR ADC that is register-compatible with the LTC2309 but has a different channel selection mapping and count. To support multiple chips in this family, introduce ltc2309_chip_info struct to store chip-specific channel specifications and names. The probe function now uses i2c_get_match_data() to retrieve the correct configuration for the detected device. Specific channel addresses for LTC2305 (CH0, CH1, and differential pairs) are added based on the datasheet. Signed-off-by: Kyle Hsieh Signed-off-by: Jonathan Cameron commit 999ca38066302347c94fda49db7a33ce87def5b6 Author: Kyle Hsieh Date: Wed Mar 25 10:24:21 2026 +0800 iio: adc: ltc2309: explicitly assign hex values to channel enums The current ltc2309_channels enum relies on implicit sequential assignment. While this works for the 8-channel LTC2309, it is not intuitive and makes it difficult to support other chips in the same family that might have different bit mappings. Explicitly assign hex values to the enum members based on the channel selection bits defined in the datasheet. This improves code readability and provides a consistent pattern for future chip support. Signed-off-by: Kyle Hsieh Signed-off-by: Jonathan Cameron commit 732df35bbb94c06099cf8c64076233347b278516 Author: Kyle Hsieh Date: Wed Mar 25 10:24:20 2026 +0800 dt-bindings: adc: ltc2497: add support for ltc2305 Add documentation for the 2-channel LTC2305 ADC in the existing ltc2497 binding. This enables automatic device tree matching for LTC2305 while using the LTC2309 driver (drivers/iio/adc/ltc2309.c), since both ADCs share the same I2C interface and 12-bit SAR architecture. The main difference is the number of channels (LTC2305: 2, LTC2309: 8). Reviewed-by: Rob Herring (Arm) Signed-off-by: Kyle Hsieh Signed-off-by: Jonathan Cameron commit 0a4f3ef9880e505d41817419b0255d6552776143 Author: Akiyoshi Kurita Date: Mon Mar 9 19:50:15 2026 +0900 docs: ja_JP: process: translate second half of 'Describe your changes' Translate the remaining part of the "Describe your changes" section in Documentation/translations/ja_JP/process/submitting-patches.rst. Follow review comments on wording and line wrapping, and cover guidance on self-contained patch descriptions, imperative mood, commit references, and Link:/Closes:/Fixes: tags. Signed-off-by: Akiyoshi Kurita Acked-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Message-ID: <20260309105015.309116-1-weibu@redadmin.org> commit aa3bee451dc4217ed5391452dc524b27e813d97a Author: Daniel Pereira Date: Mon Mar 23 14:11:32 2026 -0300 docs: pt_BR: Add translation for KVM x86 maintainer guide Translate the KVM x86 maintainer guidelines (maintainer-kvm-x86.rst) into Portuguese (pt_BR). This document covers the specific workflow, coding style, and testing requirements for the KVM x86 subsystem. Signed-off-by: Daniel Pereira Signed-off-by: Jonathan Corbet Message-ID: <20260323171133.88074-3-danielmaraboo@gmail.com> commit 1329cc0b8d28454c3e87a28c62a4426cc53ba254 Author: Daniel Pereira Date: Mon Mar 23 14:11:31 2026 -0300 docs: pt_BR: Add translation for process/conclave.rst Translate the Linux kernel project continuity documentation (conclave.rst) into Portuguese (pt_BR). Also, update the main pt_BR index to include the link to the new translation. Signed-off-by: Daniel Pereira Signed-off-by: Jonathan Corbet Message-ID: <20260323171133.88074-2-danielmaraboo@gmail.com> commit 897c2beb4a7799154a67942fa85a9678f885f36b Author: Viacheslav Dubeyko Date: Mon Mar 23 17:39:50 2026 -0700 hfsplus: fix generic/523 test-case failure The xfstests' test-case generic/523 fails to execute correctly: FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc4+ #8 SMP PREEMPT_DYNAMIC Thu May 1 16:43:22 PDT 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/523 - output mismatch (see xfstests-dev/results//generic/523.out.bad) The test-case expects to have '/' in the xattr name. However, HFS+ unicode logic makes conversion of '/' into ':'. In HFS+, a filename can contain '/' because ':' is the separator. The slash is a valid filename character on macOS. But on Linux, / is the path separator and it cannot appear in a filename component. But xattr name can contain any of these symbols. It means that this unicode logic conversion doesn't need to be executed for the case of xattr name. This patch adds distinguishing the regular and xattr names. If we have a regular name, then this conversion of special symbols will be executed. Otherwise, the conversion is skipped for the case of xattr names. sudo ./check -g auto FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #24 SMP PREEMPT_DYNAMIC Fri Mar 20 12:36:49 PDT 2026 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/523 33s ... 25s Closes: https://github.com/hfs-linux-kernel/hfs-linux-kernel/issues/178 cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260324003949.417048-2-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 2ca0b54dca438edb0f6b0eec7913d3cab60ddebf Author: Mauro Carvalho Chehab Date: Mon Mar 23 10:10:53 2026 +0100 docs: c_lex.py: store logger on its data By having the logger stored there, any code using CTokenizer can log messages there. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <467979dc18149e4b2a7113c178e0cb07919632f2.1774256269.git.mchehab+huawei@kernel.org> commit 9c3911812b4a719623ea7502b419929eb01b2fc2 Author: Mauro Carvalho Chehab Date: Mon Mar 23 10:10:52 2026 +0100 docs: kdoc_output: raise an error if full_proto not available for var This is mandatory, but if it is missing, we need to know what symbol had problems. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <0c3d9dd25889784b999efdb354ade48264c0e03c.1774256269.git.mchehab+huawei@kernel.org> commit e786fab2cfcc9ab65adf35d2eab4ca94abe1955f Author: Mauro Carvalho Chehab Date: Mon Mar 23 10:10:51 2026 +0100 docs: kdoc_yaml_file: use a better name for the tests Instead of always using a name with a number on it, use the name of the object directly whenever possible. When the name is already used, append a number prefix at the end. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 99ec67a9984fdf38c7ed78695aeb1b99cfee5b50 Author: Mauro Carvalho Chehab Date: Mon Mar 23 10:10:50 2026 +0100 docs: kdoc: better handle source when producing YAML output The current logic was storing symbols source code on a list, not linked to the actual KdocItem. While this works fine when kernel-doc markups are OK, on places where there is a "/**" without a valid kernel-doc markup, it ends that the 1:1 match between source code and KdocItem doesn't happen, causing problems to generate the YAML output. Fix it by storing the source code directly into the KdocItem structure. This shouldn't affect performance or memory footprint, except when --yaml option is used. While here, add a __repr__() function for KdocItem, as it helps debugging it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <77902dafabb5c3250486aa2dc1568d5fafa95c5b.1774256269.git.mchehab+huawei@kernel.org> commit 8326e4a21838593fe67b5d79ba6d0dc8e962ebb9 Author: Mauro Carvalho Chehab Date: Mon Mar 23 10:10:49 2026 +0100 docs: kdoc_output: fix handling of simple tables Fix check for simple table delimiters. ReST simple tables use "=" instead of "-". I ended testing it with a table modified from a complex one, using "--- --- ---", instead of searching for a real Kernel example. Only noticed when adding an unit test and seek for an actual example from kernel-doc markups. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit bc63427c4d1031c761639aa42ae5a77beabfa98b Author: Mauro Carvalho Chehab Date: Mon Mar 23 10:10:48 2026 +0100 docs: kdoc-test.yaml: add more tests Add extra tests to check if the new "var" type is properly handled and to cover mutex context annotations. Co-developed-by: Randy Dunlap Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <75af93a45151b630c94b7f77637d173e6119fd41.1774256269.git.mchehab+huawei@kernel.org> commit 6e0d7b63676b85490bbaf01c9a8ebcd692bed981 Author: Mauro Carvalho Chehab Date: Mon Mar 23 10:10:47 2026 +0100 docs: kdoc_yaml_file: add a representer to make strings look nicer The strings representation is not ok, currently. Add a helper function to improve it, and drop blank lines at beginning and at the end of the dumps Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <422041a8b49b2609de5749092fe074b7948c32a6.1774256269.git.mchehab+huawei@kernel.org> commit e896174e466f593f3a62fd4dd779e6686bf32f40 Author: Mauro Carvalho Chehab Date: Mon Mar 23 10:10:46 2026 +0100 docs: tools: include kdoc_yaml_file at documentation Add an autodoc entry for the new kdoc_yaml_file module. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <32b86abe7acee2dd4f73a35836ec94e8690f04cd.1774256269.git.mchehab+huawei@kernel.org> commit 3f049a5ba920f96df9eeb576d72c99535ab300f2 Author: Mauro Carvalho Chehab Date: Mon Mar 23 10:10:45 2026 +0100 unittests: test_kdoc_parser: add command line arg to read a YAML file The test_kdoc_parser.py already supports loading dynamic tests when running unit tests. Add support to read from a different file. This is useful for: - regression tests before/afer some changes; - preparing new unit tests; - test a different yaml before adding its contents at tools/unittests/kdoc-test.yaml. It should be noticed that passing an argument to a unit test is not too trivial, as unittest core will load itself the runner with a separate environment. The best (only?) way to do it is by setting the system environment. This way, when the class is called by the unit test loader, it can pick the var from the environment without relying on a global variable. The unittest_helper has already provision for it, so let's use its support. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <1d1a56de012c43756f9ca87aa9bf6c285674f113.1774256269.git.mchehab+huawei@kernel.org> commit 625ce45f2c39bf5059d33de573da624f4b2988cb Author: Mauro Carvalho Chehab Date: Mon Mar 23 10:10:44 2026 +0100 MAINTAINERS: update documentation scripts to add unittests Ensure that we'll receive e-mails for attempts to touch tools/unittests. While here, place entries alphabetically sorted. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <6be396b8423372dd006484351ca2dbc54220587e.1774256269.git.mchehab+huawei@kernel.org> commit 8bbd81ddbe174aa8488db7971fe2717cb636a46c Author: Roberto Ricci Date: Tue Mar 24 23:39:04 2026 +0100 cpupower-info.1: describe the --perf-bias option The cpupower-info(1) man page only mentions the short form of the '--perf-bias' option in the synopsys, but the long form is not documented and its effect is not explained. cpupower-info.c: {"perf-bias", optional_argument, NULL, 'b'}, Signed-off-by: Roberto Ricci Link: https://lore.kernel.org/r/20260324223921.14317-5-io@r-ricci.it Signed-off-by: Shuah Khan commit ed2946802bad2ec997383d22edfc14ae44245183 Author: Roberto Ricci Date: Tue Mar 24 23:39:03 2026 +0100 cpupower-frequency-info.1: document --boost and --epp options `cpupower frequency-info` supports the '--boost' option since the program was first added with commit 7fe2f6399a84 ("cpupowerutils - cpufrequtils extended with quite some features"), but the man page lacks it. '--epp' has been added with commit 5f567afc283f ("cpupower: Add support for showing energy performance preference") but it has never been added to the man page. cpufreq-info.c: {"boost", no_argument, NULL, 'b'}, ... {"epp", no_argument, NULL, 'z'}, Signed-off-by: Roberto Ricci Link: https://lore.kernel.org/r/20260324223921.14317-4-io@r-ricci.it Signed-off-by: Shuah Khan commit 10a54e715985baac21bb506f86c5ad1b83a12784 Author: Roberto Ricci Date: Tue Mar 24 23:39:02 2026 +0100 cpupower-frequency-info.1: use the proper name of the --perf option The cpupower-frequency-info(1) man page describes a '--perf' option. Even though this form is accepted by the program, its proper name is '--performance'. cpufreq-info.c: {"performance", no_argument, NULL, 'c'}, Signed-off-by: Roberto Ricci Link: https://lore.kernel.org/r/20260324223921.14317-3-io@r-ricci.it Signed-off-by: Shuah Khan commit 193f41dad3d4197b35be8b4cff13c606eb0e1efe Author: Roberto Ricci Date: Tue Mar 24 23:39:01 2026 +0100 cpupower-idle-info.1: fix short option names The cpupower-idle-info(1) man page describes '-f' as the short form of the '--silent' option and '-e' as the short form of the '--proc' option. But they are not correct: $ cpupower idle-info -f idle-info: invalid option -- 'f' invalid or unknown argument $ cpupower idle-info -e idle-info: invalid option -- 'e' invalid or unknown argument The short form of '--silent' is actually '-s' and the short form of '--proc' is actually '-o': cpuidle-info.c: {"silent", no_argument, NULL, 's'}, {"proc", no_argument, NULL, 'o'}, Signed-off-by: Roberto Ricci Link: https://lore.kernel.org/r/20260324223921.14317-2-io@r-ricci.it Signed-off-by: Shuah Khan commit c464407ada06fdfc4d49bbb86085f02fd7f565c3 Author: Rito Rhymes Date: Mon Mar 23 11:24:27 2026 -0400 docs: allow long links to wrap per character to prevent page overflow Some documentation pages contain long link text without natural break points, which can force page-wide horizontal scroll overflow on small screens. Use overflow-wrap: anywhere for anchor text in the docs stylesheet so links can wrap per character as a fallback when normal word boundaries are unavailable. Examples: https://docs.kernel.org/6.15/firmware-guide/acpi/non-d0-probe.html https://docs.kernel.org/6.15/arch/x86/earlyprintk.html Signed-off-by: Rito Rhymes Assisted-by: Codex:GPT-5.4 Tested-by: Randy Dunlap Acked-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20260323152428.30483-1-rito@ritovision.com> commit 127bdd9f12ae4e77cb74f06aa60e996a2d4baafa Author: Rito Rhymes Date: Mon Mar 23 11:24:28 2026 -0400 docs: allow long table reference links to wrap and prevent overflow Some documentation pages contain docutils tables with reference links that use long unbroken strings. Those strings can expand the table width beyond the content column and cause page-wide horizontal overflow. Allow reference links in docutils tables in the main document body to wrap when needed so the table stays within the content column and does not break page layout. Examples: https://docs.kernel.org/6.15/arch/openrisc/openrisc_port.html https://docs.kernel.org/6.15/filesystems/ext2.html Signed-off-by: Rito Rhymes Assisted-by: Codex:GPT-5.4 Tested-by: Randy Dunlap Acked-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20260323152428.30483-2-rito@ritovision.com> commit 3aff388bc4e8d64583d144f3be9c0aff9a54f14d Author: Rito Rhymes Date: Mon Mar 23 11:33:42 2026 -0400 docs: contain horizontal overflow in C API descriptions Some documentation pages contain long C API signatures that can exceed the content width and cause page-wide horizontal scroll overflow. Apply contained horizontal scrolling to C API description blocks and keep their signature rows on one line. This preserves signature formatting while preventing them from breaking page layout. Contained horizontal scrolling is preferred over wrapping here because code fidelity is the priority. These blocks are intended to remain representative of the code itself. Wrapping distorts spacing and line structure, which affects fidelity, creates misleading renderings, and reduces readability. Examples: https://docs.kernel.org/6.15/driver-api/regulator.html https://docs.kernel.org/6.15/userspace-api/fwctl/fwctl-cxl.html Signed-off-by: Rito Rhymes Assisted-by: Codex:GPT-5.4 Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20260323153342.33447-1-rito@ritovision.com> commit f2679ac773899f5fdea0b68d5077eef5f88dfd42 Author: Rito Rhymes Date: Mon Mar 23 11:14:01 2026 -0400 docs: allow inline literals in paragraphs to wrap to prevent overflow Some documentation pages contain long inline literals in paragraph text that can force page-wide horizontal scroll overflow and break layout on smaller screens. Override the default `span.pre` white-space behavior for inline literals and use `overflow-wrap: anywhere` so they can wrap when needed. For code used as part of a paragraph, wrapping is appropriate because it is stylistically part of the surrounding text. Code blocks, by contrast, are meant to preserve formatting fidelity and are better served by contained horizontal scrolling. Examples: https://docs.kernel.org/6.15/userspace-api/futex2.html https://docs.kernel.org/6.15/security/IMA-templates.html Signed-off-by: Rito Rhymes Assisted-by: Codex:GPT-5.4 Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20260323151401.27415-1-rito@ritovision.com> commit b0473dcd4b1d7e2e44947e7ac1820c73a268821a Author: Paul E. McKenney Date: Fri Mar 20 03:45:36 2026 -0700 smp: Improve smp_call_function_single() CSD-lock diagnostics Both smp_call_function() and smp_call_function_single() use per-CPU call_single_data_t variable to hold the infamous CSD lock. However, while smp_call_function() acquires the destination CPU's CSD lock, smp_call_function_single() instead uses the source CPU's CSD lock. (These are two separate sets of CSD locks, cfd_data and csd_data, respectively.) This otherwise inexplicable pair of choices is explained by their respective queueing properties. If smp_call_function() where to use the sending CPU's CSD lock, that would serialize the destination CPUs' IPI handlers and result in long smp_call_function() latencies, especially on systems with large numbers of CPUs. For its part, if smp_call_function_single() were to use the (single) destination CPU's CSD lock, this would similarly serialize in the case where many CPUs are sending IPIs to a single "victim" CPU. Plus it would result in higher levels of memory contention. Except that if there is no NMI-based stack tracing on a weakly ordered system where remote unsynchronized stack traces are especially unreliable, the improved debugging beats the improved queueing. This improved queueing only matters if a bunch of CPUs are calling smp_call_function_single() concurrently for a single "victim" CPU, which is not the common case. Therefore, make smp_call_function_single() use the destination CPU's csd_data instance in kernels built with CONFIG_CSD_LOCK_WAIT_DEBUG=y where csdlock_debug_enabled is also set. Otherwise, continue to use the source CPU's csd_data. Signed-off-by: Paul E. McKenney Signed-off-by: Thomas Gleixner Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/25c2eb97-77c8-49a5-80ac-efe78dea272c@paulmck-laptop commit ec39780d6a9e05e7e427008603b40efef515b775 Author: Shrikanth Hegde Date: Tue Mar 24 01:06:29 2026 +0530 smp: Get this_cpu once in smp_call_function smp_call_function_single() and smp_call_function_many_cond() disable preemption and cache the CPU number via get_cpu(). Use this cached value throughout the function instead of invoking smp_processor_id() again. [ tglx: Make the copy&pasta'ed change log match the patch ] Signed-off-by: Shrikanth Hegde Signed-off-by: Thomas Gleixner Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Link: https://patch.msgid.link/20260323193630.640311-4-sshegde@linux.ibm.com commit cc5623947f3d86687c39771fcbea641907966d5c Author: Randy Dunlap Date: Mon Mar 9 23:17:26 2026 -0700 smp: Add missing kernel-doc comments Add missing kernel-doc comments and rearrange the order of others to prevent all kernel-doc warnings. - add function Returns: sections or format existing comments as kernel-doc - add missing function parameter comments - use "/**" for smp_call_function_any() and on_each_cpu_cond_mask() - correct the commented function name for on_each_cpu_cond_mask() - use correct format for function short descriptions - add all kernel-doc comments for smp_call_on_cpu() - remove kernel-doc comments for raw_smp_processor_id() since there is no prototype for it here (other than !SMP) - in smp.h, rearrange some lines so that the kernel-doc comments for smp_processor_id() are immediately before the macro (to prevent kernel-doc warnings) - remove "Returns" from smp_call_function() since it doesn't return a value Signed-off-by: Randy Dunlap Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260310061726.1153764-1-rdunlap@infradead.org commit 1546d3feb5e533fbee6710bd51b2847b2ec23623 Author: Eric Biggers Date: Sat Mar 21 00:53:38 2026 -0700 fscrypt: use AES library for v1 key derivation Convert the implementation of the v1 (original / deprecated) fscrypt per-file key derivation algorithm to use the AES library instead of an "ecb(aes)" crypto_skcipher. This is much simpler. While the AES library doesn't support AES-ECB directly yet, we can still simply call aes_encrypt() in a loop. While that doesn't explicitly parallelize the AES encryptions, it doesn't really matter in this case, where a new key is used each time and only 16 to 64 bytes are encrypted. In fact, a quick benchmark (AMD Ryzen 9 9950X) shows that this commit actually greatly improves performance, from ~7000 cycles per key derived to ~1500. The times don't differ much between 32 bytes and 64 bytes either, so clearly the bottleneck is API stuff and key expansion. Granted, performance of the v1 key derivation is no longer very relevant: most users have moved onto v2 encryption policies. The v2 key derivation uses HKDF-SHA512 (which is ~3500 cycles on the same CPU). Still, it's nice that the simpler solution is much faster as well. Compatibility verified with xfstests generic/548. Link: https://lore.kernel.org/r/20260321075338.99809-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1a152e21940a18caf7c9d0d753a46d2ffa3f5010 Author: Chen-Yu Tsai Date: Tue Mar 24 13:19:59 2026 +0800 PCI: mediatek-gen3: Integrate new pwrctrl API With the new PCI pwrctrl API and PCI slot binding and power drivers, we now have a way to describe and power up WiFi/BT adapters connected through a PCIe or M.2 slot, or populated onto the mainboard itself. The latter case has the adapter layout or design copied verbatim, replacing the slot with direct connections. Integrate the PCI pwrctrl API into the PCIe driver, so that power is properly enabled before PCIe link training is done, allowing the card to successfully be detected. Signed-off-by: Chen-Yu Tsai Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Bartosz Golaszewski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260324052002.4072430-8-wenst@chromium.org commit 55482b95792bdaceb513da8a66a911da85d812cb Author: Chen-Yu Tsai Date: Tue Mar 24 13:19:58 2026 +0800 PCI: mediatek-gen3: Disable device if further setup fails If further setup fails after the device is powered on and link training succeeds, we want to place the device back in a quiescence state to avoid unintended activity and save power. This also helps with power state tracking and balancing once pwrctrl API is integrated. Power down the device in the error paths of mtk_pcie_startup_port() and mtk_pcie_probe(). Signed-off-by: Chen-Yu Tsai Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Bartosz Golaszewski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260324052002.4072430-7-wenst@chromium.org commit 69b8d3ccf73222518ce13fe4965c93c9d13ba5d7 Author: Chen-Yu Tsai Date: Tue Mar 24 13:19:57 2026 +0800 PCI: mediatek-gen3: Split out device power helpers In preparation for adding full power on/off control with the pwrctrl API, split out the existing code that only partially deals with device power sequencing into separate helper functions. The existing code only handles PERST#. This is purely moving code around, and brings no functional changes. Signed-off-by: Chen-Yu Tsai [mani: moved the 'err' variable to next commit] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Bartosz Golaszewski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260324052002.4072430-6-wenst@chromium.org commit 867054421c3b94a70ddf51db658e992f19382c2f Author: Chen-Yu Tsai Date: Tue Mar 24 13:19:56 2026 +0800 PCI: mediatek-gen3: Add error path for resume driver callbacks The resume callback currently does teardown in the conditional block directly. This is going to get ugly when the pwrctrl calls are added. Move the teardown to a proper error cleanup path. Signed-off-by: Chen-Yu Tsai Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Bartosz Golaszewski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260324052002.4072430-5-wenst@chromium.org commit cf417e61fc860c496eff37b87e06e8e107d343b5 Author: Chen-Yu Tsai Date: Tue Mar 24 13:19:55 2026 +0800 PCI: mediatek-gen3: Move controller setup steps before PERST# control Setting up the translation windows and enabling MSI involve only the controller, not the link or any downstream device. These can be done before the device is enabled. Move these steps before the existing PERST# control and waiting for the link to come up. This provides a cleaner separation of controller vs device setup. This also allows the later commits that split out PERST# control and add device power control to have cleaner teardown. This change only moves code. No functional change is expected. Suggested-by: Bjorn Helgaas Signed-off-by: Chen-Yu Tsai Signed-off-by: Manivannan Sadhasivam [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260324052002.4072430-4-wenst@chromium.org commit eddbac092e5f1edcf502056348d98acb811dbb31 Author: Chen-Yu Tsai Date: Tue Mar 24 13:19:54 2026 +0800 PCI: mediatek-gen3: Move mtk_pcie_setup_irq() out of mtk_pcie_setup() mtk_pcie_setup_irq() sets up the IRQ domains for PCI INTx and MSI, and chains them to the controller's interrupt. It doesn't touch the PCIe controller itself. Move mtk_pcie_setup_irq() out of mtk_pcie_setup(), do it earlier so there's nothing to clean up if it fails, and add an error message if it does fail. Reorder mtk_pcie_irq_teardown() in the remove callback to follow. Also create an error path in the probe function. Suggested-by: Bjorn Helgaas Signed-off-by: Chen-Yu Tsai Signed-off-by: Manivannan Sadhasivam [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260324052002.4072430-3-wenst@chromium.org commit 98752193de5b3306b6815cba5a217337c2a93876 Author: Chen-Yu Tsai Date: Tue Mar 24 13:19:53 2026 +0800 PCI: mediatek-gen3: Clean up mtk_pcie_parse_port() with dev_err_probe() mtk_pcie_parse_port() in the pcie-mediatek-gen driver has a bunch of if (err) { dev_err(dev, "error message\n"); return err; # or goto } patterns. Simplify these with dev_err_probe(). The system also gains proper deferred probe messages that can be seen in: /sys/kernel/debug/devices_deferred Signed-off-by: Chen-Yu Tsai Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Bartosz Golaszewski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260324052002.4072430-2-wenst@chromium.org commit 1f513a3ec3a945efb30c963681ac32ac7b99928b Author: Max Zhen Date: Tue Mar 24 09:31:59 2026 -0700 accel/amdxdna: Add per-process BO memory usage query support Add support for querying per-process buffer object (BO) memory usage through the amdxdna GET_ARRAY UAPI. Introduce a new query type, DRM_AMDXDNA_BO_USAGE, along with struct amdxdna_drm_bo_usage to report BO memory usage statistics, including heap, total, and internal usage. Track BO memory usage on a per-client basis by maintaining counters in GEM open/close and heap allocation/free paths. This ensures the reported statistics reflect the current memory footprint of each process. Wire the new query into the GET_ARRAY implementation to expose the usage information to userspace. Link: https://github.com/amd/xdna-driver/commit/0546f2aaadbdacf1c3556410ecd71622044cd916 Signed-off-by: Max Zhen Reviewed-by: Lizhi Hou Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260324163159.2425461-1-lizhi.hou@amd.com commit 19dcccbc064d6c58eaafae1ecb94821a2535cc26 Author: Tomás Pando Date: Tue Mar 24 17:36:04 2026 +0100 docs: driver-api: fix 6 spelling typos in Documentation/driver-api Fix minor spelling mistakes in the driver-api documentation. These changes improve readability in ACPI, CXL, DMA and PCI docs. Reviewed-by: Randy Dunlap Signed-off-by: Tomás Pando Signed-off-by: Jonathan Corbet Message-ID: <20260324163604.5710-1-tovictakamine@gmail.com> commit 94555ea9a0488c5c1bba90242cfa149a84a8928d Author: Simon Richter Date: Sun Mar 8 02:35:35 2026 +0900 PCI/VGA: Pass errors from pci_set_vga_state() up pci_set_vga_state() returns an error code, which so far has been ignored by the only caller, __vga_tryget(), so forward it to the caller. As the return type of __vga_tryget() is a pointer, wrap the error in ERR_PTR(). Signed-off-by: Simon Richter Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260307173538.763188-3-Simon.Richter@hogyros.de commit 2a93c9851b2bb38614fadd84aa674b7a5c8181c6 Author: Simon Richter Date: Sun Mar 8 02:35:34 2026 +0900 PCI/VGA: Pass vga_get_uninterruptible() errors to userspace If VGA routing cannot be established, vga_get_uninterruptible() returns an error and does not increment the lock count. Return the error to the caller. Return before incrementing uc->io_cnt/mem_cnt so vga_arb_release() won't call vga_put() when userspace closes the handle. Signed-off-by: Simon Richter [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260307173538.763188-2-Simon.Richter@hogyros.de commit b7d9d2e3a8ab535ff3bc8e9156a917bb8934f856 Author: Ryan Roberts Date: Mon Mar 23 16:39:16 2026 +0000 arm64: mm: __ptep_set_access_flags must hint correct TTL It has been reported that since commit 752a0d1d483e9 ("arm64: mm: Provide level hint for flush_tlb_page()"), the arm64 check_hugetlb_options selftest has been locking up while running "Check child hugetlb memory with private mapping, sync error mode and mmap memory". This is due to hugetlb (and THP) helpers casting their PMD/PUD entries to PTE and calling __ptep_set_access_flags(), which issues a __flush_tlb_page(). Now that this is hinted for level 3, in this case, the TLB entry does not get evicted and we end up in a spurious fault loop. Fix this by creating a __ptep_set_access_flags_anysz() function which takes the pgsize of the entry. It can then add the appropriate hint. The "_anysz" approach is the established pattern for problems of this class. Reported-by: Aishwarya TCV Fixes: 752a0d1d483e ("arm64: mm: Provide level hint for flush_tlb_page()") Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit 49834ae6d6b6f483681585638ca359017ac189a1 Author: Sakari Ailus Date: Tue Mar 17 14:57:59 2026 +0200 platform: int3472: Drop redundant initialisation to 0 and NULL A few fields in structs containing regulator initialisation data for Dell laptops are initialised to 0 and NULL. Drop the explicit initialisation as redundant. Signed-off-by: Sakari Ailus Reviewed-by: Hans de Goede Signed-off-by: Hans Verkuil commit be653ae8110b078cae7cb50646a080f17d35fdb2 Author: Antti Laakso Date: Wed Mar 11 15:19:10 2026 +0200 platform: int3472: Add MSI prestige board data Define regulators and gpio for ov5675 in MSI Prestige 14 AI EVO+ laptop. Signed-off-by: Antti Laakso Acked-by: Ilpo Järvinen Reviewed-by: Daniel Scally Reviewed-by: Bartosz Golaszewski Reviewed-by: Hans de Goede [Sakari Ailus: Drop redundant initialisation to 0 and NULL.] Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit eac4a8e26d57e7d3a3b749c2551ffd13451517cb Author: Antti Laakso Date: Wed Mar 11 15:19:09 2026 +0200 gpio: tps68470: Add i2c daisy chain support The tps68470 daisy chain make use of gpio 1 and 2. When in use, these gpios must be configured as inputs without pull-up. Signed-off-by: Antti Laakso Reviewed-by: Daniel Scally Acked-by: Bartosz Golaszewski Reviewed-by: Bartosz Golaszewski Reviewed-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 13abea47768245365c859e214794b9ac85a2accb Author: Antti Laakso Date: Wed Mar 11 15:19:08 2026 +0200 platform: int3472: Add gpio software node The tps68470 supports i2c daisy chain, which need to be configured by gpio-tps68470 driver. Add daisy chain information to software node. Signed-off-by: Antti Laakso Reviewed-by: Daniel Scally Acked-by: Ilpo Järvinen Reviewed-by: Bartosz Golaszewski Reviewed-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit c409dea36f00ecd3a3ab08fc6d5e8541e9630d79 Author: Antti Laakso Date: Wed Mar 11 15:19:06 2026 +0200 media: i2c: ov5675: Wait for endpoint Defer probe if endpoint is not yet available. And do it before acquiring clock, gpio and regulators. Signed-off-by: Antti Laakso Reviewed-by: Daniel Scally Reviewed-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit ebeec2b000a90cd8aae86d1931ff5ef23af8284e Author: Michael Tretter Date: Fri Nov 7 11:34:34 2025 +0100 media: staging: imx: configure src_mux in csi_start After media_pipeline_start() was called, the media graph is assumed to be validated. It won't be validated again if a second stream starts. The imx-media-csi driver, however, changes hardware configuration in the link_validate() callback. This can result in started streams with misconfigured hardware. In the concrete example, the ipu2_csi1 is driven by a parallel video input. After the media pipeline has been started with this configuration, a second stream is configured to use ipu1_csi0 with MIPI-CSI input from imx6-mipi-csi2. This may require the reconfiguration of ipu1_csi0 with ipu_set_csi_src_mux(). Since the media pipeline is already running, link_validate won't be called, and the ipu1_csi0 won't be reconfigured. The resulting video is broken, because the ipu1_csi0 is misconfigured, but no error is reported. Move ipu_set_csi_src_mux from csi_link_validate to csi_start to ensure that input to ipu1_csi0 is configured correctly when starting the stream. This is a local reconfiguration in ipu1_csi0 and is possible while the media pipeline is running. Since csi_start() is called with priv->lock already locked, csi_set_src() must not lock priv->lock again. Thus, the mutex_lock() is dropped. Signed-off-by: Michael Tretter Fixes: 4a34ec8e470c ("[media] media: imx: Add CSI subdev driver") Cc: stable@vger.kernel.org Reviewed-by: Frank Li Reviewed-by: Philipp Zabel Signed-off-by: Frank Li Signed-off-by: Hans Verkuil commit 9df2aaa64890c0b6226057eb6fcb6352bd2df432 Author: Michael Tretter Date: Fri Nov 7 11:34:33 2025 +0100 media: staging: imx: request mbus_config in csi_start Request the upstream mbus_config in csi_start, which starts the stream, instead of caching it in link_validate. This allows to get rid of the mbus_cfg field in the struct csi_priv and avoids state in the driver. Fixes: 4a34ec8e470c ("[media] media: imx: Add CSI subdev driver") Cc: stable@vger.kernel.org Reviewed-by: Frank Li Signed-off-by: Michael Tretter Reviewed-by: Philipp Zabel Signed-off-by: Frank Li Signed-off-by: Hans Verkuil commit 072a8f60aa50034a724b6ffcd1664ea372eedd7b Author: vivek yadav Date: Tue Dec 2 21:44:13 2025 +0530 media: staging: imx: fix code style issues Applied checkpatch.pl recommendations: - corrected whitespace - fixed line length - adjusted indentation Signed-off-by: vivek yadav Signed-off-by: Frank Li Signed-off-by: Hans Verkuil commit 1cdbadefb7f7bbd70a3c0f2a1621a764c6ca3cd0 Author: Ayush Kumar Date: Tue Nov 25 20:23:31 2025 +0000 media: staging: imx: Remove unnecessary braces from if statement Adhering to Linux kernel coding style guidelines (Chapter 3: Indentation). Signed-off-by: Ayush Kumar Reviewed-by: Frank Li Signed-off-by: Frank Li Signed-off-by: Hans Verkuil commit 1380e36cf8ffd923a4bb0a337abf6473529ce9a2 Author: Adam Ford Date: Wed Mar 25 11:27:35 2026 -0500 arm64: dts: renesas: beacon-renesom: Remove LVDS Panel The LVDS Panel was never shipped from Beacon, and there are device tree errors, so rather than trying to fix them, remove it instead. Signed-off-by: Adam Ford Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260325162735.24467-1-aford173@gmail.com Signed-off-by: Geert Uytterhoeven commit c07065ba878feb94be499990ef76ced77f5702af Author: Herve Codina (Schneider Electric) Date: Wed Mar 25 10:57:18 2026 +0100 ARM: dts: r9a06g032: Add #address-cells to the GIC node When checking dts involving the r9a06g032.dtsi file, the following kind of warnings are reported: Missing property '#address-cells' in node xxx, using 0 as fallback Indeed, #address-cells is not present in the GIC interrupt controller node. Fix it adding the missing property. Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property in PCI node and in IRQ mux node consists of several components and the component related to "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) No functional change. Signed-off-by: Herve Codina (Schneider Electric) Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260325095718.388157-1-herve.codina@bootlin.com Signed-off-by: Geert Uytterhoeven commit 830558b4aabac59d4613be6940afa507ab1cb81d Author: Fabrizio Castro Date: Tue Mar 24 22:52:34 2026 +0000 arm64: dts: renesas: r9a09g056: Remove wdt{0,2,3} nodes The Renesas RZ/V2N SoC (a.k.a. r9a09g056) comes with 4 CA55 cores and 1 CM33 core. While the user manual doesn't explicitly specify which cores should have access to particular watchdogs, it turns out that (similarly to the Renesas RZ/V2H(P)) it only makes sense for Linux to use WDT1. Remove DT nodes wdt{0,2,3} from the RZ/V2N SoC specific dtsi to make it compliant with the original design intent. This change is harmless as there are no users for the nodes being stripped out of this device tree. Signed-off-by: Fabrizio Castro Reviewed-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260324225239.19136-2-fabrizio.castro.jz@renesas.com Signed-off-by: Geert Uytterhoeven commit 7cc36d6d7c59dae31d69b1ad66e1333cbf67e8d8 Author: Scott Murray Date: Fri Mar 20 03:52:57 2026 +0100 arm64: dts: renesas: sparrow-hawk: Add overlay for Olimex MIPI-HDMI adapter Add a DT overlay to bind the Olimex MIPI-HDMI dual-lane DSI-to-HDMI adapter on the Retronix R-Car V4H Sparrow Hawk board. Current device link is at https://www.olimex.com/Products/IoT/ESP32-P4/MIPI-HDMI/open-source-hardware Signed-off-by: Scott Murray Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260320025328.509003-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 092ff7ab721d2a096705b3ebb9501ace31184f50 Author: John Madieu Date: Wed Mar 18 09:51:19 2026 +0100 arm64: dts: renesas: r9a09g047e57-smarc: Enable PCIe The RZ Smarc Carrier-II board has PCIe slots mounted on it. Enable PCIe support. Signed-off-by: John Madieu Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260318085119.44717-5-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 8af9fd59cb7737ca1c707db8e72774f5fa1576fd Author: John Madieu Date: Wed Mar 18 09:51:18 2026 +0100 arm64: dts: renesas: r9a09g047e57-smarc-som: Add PCIe reference clock The RZ/G3E SMARC SoM has a fixed 100 MHz reference clock generator for PCIe. Model it as a fixed-clock and assign it to the PCIe port. Signed-off-by: John Madieu Tested-by: Claudiu Beznea Tested-by: Lad Prabhakar # RZ/V2N EVK Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260318085119.44717-4-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 1ac57c9830cb0b586387367f88dbb10d21ec166c Author: John Madieu Date: Wed Mar 18 09:51:17 2026 +0100 arm64: dts: renesas: r9a09g047: Add PCIe node The RZ/G3E SoC family features an x2 PCIe IP. Add the PCIe node. Signed-off-by: John Madieu Tested-by: Claudiu Beznea Tested-by: Lad Prabhakar # RZ/V2N EVK Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260318085119.44717-3-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 0c3cd7fe2c20b440afb37c056c56260834e6e92c Author: Marek Vasut Date: Fri Mar 13 17:39:06 2026 +0100 arm64: dts: renesas: Fix KSZ9131 PHY bogus txdv-skew-psec properties The KSZ9131 schema does not document the "txdv-skew-psec" property, neither does the kernel driver support this property. It does however document and support the "txen-skew-psec" property. Fix what is likely a copy-paste error from the matching "rxdv-skew-psec" property, use the "txen-skew-psec" property instead of the "txdv-skew-psec" property. Signed-off-by: Marek Vasut Tested-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260313164008.40933-5-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit fab27bffdf60e81ad7ff5e95da00748f82dd1acb Author: Marek Vasut Date: Fri Mar 13 17:39:05 2026 +0100 arm64: dts: renesas: Drop KSZ9131 PHY C22 compatible strings The Microchip KSZ9131 PHY schema indicates that the compatible string "ethernet-phy-id0022.1640" must not be followed by any other compatible string. Drop trailing "ethernet-phy-ieee802.3-c22" to match the schema. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260313164008.40933-4-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 5849a2dc847afcd51def5acd0f47db2ed3e87686 Author: Marek Vasut Date: Fri Mar 13 17:39:04 2026 +0100 arm64: dts: renesas: Drop RTL8211F PHY C22 compatible strings The Realtek RTL8211F PHY schema indicates that the compatible string "ethernet-phy-id001c.c916" must not be followed by any other compatible string. Drop trailing "ethernet-phy-ieee802.3-c22" to match the schema. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260313164008.40933-3-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 070bcb055540e20c6763eead7b51f049866928f4 Author: Marek Vasut Date: Fri Mar 13 17:39:03 2026 +0100 arm64: dts: renesas: Drop RTL8211E PHY C22 compatible strings The Realtek RTL8211E PHY schema indicates that the compatible string "ethernet-phy-id001c.c915" must not be followed by any other compatible string. Drop trailing "ethernet-phy-ieee802.3-c22" to match the schema. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260313164008.40933-2-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 2425780b0ac4fceddf028d8d4fec7d565fdaf78f Author: Marek Vasut Date: Sat Jan 17 01:49:49 2026 +0100 arm64: dts: renesas: sparrow-hawk: Add overlay for WaveShare Display 13.3" Add a DT overlay to bind the WaveShare 13.3inch 1920x1080 DSI Capacitive Touch Display on the Retronix R-Car V4H Sparrow Hawk board. Current device link is at https://www.waveshare.com/13.3inch-dsi-lcd.htm Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260117005028.126361-2-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 44ed098c6ef354dcd56367512f73a8f1e29846fb Author: Fabrizio Castro Date: Tue Mar 24 22:52:35 2026 +0000 clk: renesas: r9a09g056: Remove entries for WDT{0,2,3} The Renesas RZ/V2N SoC (a.k.a. r9a09g056) comes with 4 watchdogs. As it turns out, it only makes sense for Linux to have access to WDT1. Remove the clock and reset entries for WDT{0,2,3} to prevent interfering with the CM33 core. This change is harmless as only WDT1 is currently used in Linux, there are no users for the WDT{0,2,3} IPs. Signed-off-by: Fabrizio Castro Reviewed-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260324225239.19136-3-fabrizio.castro.jz@renesas.com Signed-off-by: Geert Uytterhoeven commit 2fcaaf15e4ab86e7a81e3bd3eaeb8aa2f730ca29 Author: Herve Codina (Schneider Electric) Date: Tue Mar 24 13:04:30 2026 +0100 clk: renesas: r9a06g032: Enable watchdog reset sources The watchdog timeout is signaled using an interrupt and, on this interrupt, a software initiated reset is performed. This software initiated reset performs, in the end, a hardware system reset using SWRST_REQ of RSTCTRL register. The watchdog itself is able to control directly the hardware system reset without any operation done by the interrupt handler. This feature allows the watchdog to not depend on the software to reset the system when a watchdog timeout occurs. Indeed, when the watchdog timeout occurs, the watchdog requests a system reset using its own hardware dedicated line but this reset source is disabled at the reset controller level. To benefit of this feature and be robust against software issues, enable watchdogs reset sources. Suggested-by: Wolfram Sang Signed-off-by: Herve Codina (Schneider Electric) Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260324120435.243641-2-herve.codina@bootlin.com Signed-off-by: Geert Uytterhoeven commit 0e590f4d99e2bd47cfd9e4e49228473548972285 Author: Rosen Penev Date: Mon Mar 23 19:11:03 2026 -0700 clk: renesas: cpg-mssr: Use struct_size() helper struct_size() is what is normally used when a flexible array member is present to avoid accidental mistakes. pm_size is still needed for the memcpy() call below. Added __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260324021103.13651-1-rosenp@gmail.com Signed-off-by: Geert Uytterhoeven commit 08b34f01a9fa6d181d9cf68205aed0799bf98b0d Author: Bradford Love Date: Tue Mar 17 16:49:02 2026 -0500 media: cx23885: Module option to disable analog video Initialized and left to themselves some boards with analog inputs, on some modern platforms can throw critical errors which prevents even digital from working thereafter. If analog is never used this module parameter allows analog to be disabled on a card by card basis. It is already possible to disable analog audio. For example, to disable for Hauppauge QuadHD with analog functionality: options cx23885 disable_analog_video=56,57 can be placed insode of /etc/modprobe.d/cx23885.conf Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 96c6d8e138c02e4bd8467da43192ac52170f7c4a Author: Eric Biggers Date: Mon Mar 16 14:15:42 2026 -0700 media: vidtv: Use crc32_be() instead of open coding dvb_crc32() does exactly the same computation as the crc32_be() library function. Just call crc32_be() instead. Signed-off-by: Eric Biggers Acked-by: Ard Biesheuvel Signed-off-by: Hans Verkuil commit 5a8db3f8f4b67c65393747179ad831d202a438e3 Author: Bradford Love Date: Tue Mar 17 15:57:48 2026 -0500 media: em28xx: Add Hauppauge 461e v3 Same as 461v2, but uses Montage ds3103c instead of ds3103b Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit a05d61fe0a9bf2646a152d494498e42b0b630a58 Author: Bradford Love Date: Tue Mar 17 15:57:47 2026 -0500 media: m88ds3103: Implement 3103c chip support Hauppauge 416e products have moved to using the 3103C satellite demod. This demod behaves mostly like a 3103b, but has different initialization, clocking, and lock operations. This Linux code was reverse egineered entirely using a Windows reference driver. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil [hverkuil: fix a few minor checkpatch issues] [hverkuil: fixed two minor sparse issues] commit 1de7981b2cd49c184538ed370e1a49e5188f4c30 Author: Bradford Love Date: Tue Mar 24 13:25:41 2026 -0500 media: em28xx: Add Hauppauge em2828X based 9x5 revisions The Hauppauge HVR-935, HVR-955, and HVR-975 have moved from cx231xx bridge to em2828x bridge. The following USB device id's are new: 2040:0360 - HVR-935 ISOC transport 2040:8360 - HVR-935 Bulk transport 2040:0366 - HVR-955 ISOC transport 2040:8366 - HVR-955 Bulk transport 2040:036a - HVR-975 ISOC transport 2040:836a - HVR-975 Bulk transport The devices all now utilize si2177 tuner. Capabilities are: - Digital TV - Composite video input - S-Video input - Analog stereo input HVR-935 has DVB-C/T/T2 demod (si2168). HVR-955 has ATSC/QAM demod (lgdt3306a). HVR-975 has both ATSC/QAM and DVB-C/T/T2 demods. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil [hverkuil: a few minor checkpatch fixes] commit 0694082db8a1744c407865e12c738f440cb33fad Author: Bradford Love Date: Tue Mar 24 13:25:02 2026 -0500 media: si2157: Include support for si2177 chip The si2177 is very closely related to si2157, with slight differences when doing analog operations. Digital is left as is, but analog needs to be configured specially because the signal is internally demodulated and CVBS video is output directly from the tuner. Verified locked and working with all supported standards. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 854289044e4be382423b937ccef970ee06ba2575 Author: Bradford Love Date: Tue Mar 24 13:24:25 2026 -0500 media: em28xx: driver supports two frontends, but not i2c clients Fix em28xx driver to accommodate a device with two i2c client demods. The em28xx driver already had a multi frontend aware device struct, with two fe, just not two i2c client demods. Since Hauppauge HVR975 has transitioned from cx231xx to em2828X, this is required for full functionality of the devices. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 58119a0cffa8a597ce5d39587beb0f5a763434a0 Author: Bradford Love Date: Tue Mar 17 16:07:20 2026 -0500 media: au0828: Fix green screen in analog When the driver was converted to VB2 the original function to fix green frame detection was removed and a default vb2 dqbuf function was used instead. This vb2 dqbuf function leads to green frames not being detected and correupting stream captures. The vidioc_dqbuf function checks the greenscreen flag, and, if set resets the stream to discard the green frame and decode a real frame. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit b2aba766bc25ba31dd339de128345312509b738a Author: Bradford Love Date: Tue Mar 17 15:46:45 2026 -0500 media: em28xx: Add Hauppauge USB Live2 New revision of Hauppauge USB Live2 switches from cx231xx usb bridge to Empia em2828X bridge. Inputs for the USB Live2 remain the same: - Composite video - S-Video - Analog stereo audio Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 8e53399c63c3152fd572596acedcdaea4cabbc45 Author: Bradford Love Date: Tue Mar 17 15:45:54 2026 -0500 media: em28xx: Add support for Empia em2828X bridge The empia em2828X usb bridge contains previous functionality, but also contains an embedded video decoder. The implemented capabilities include composite and s-video inputs, as well as analog TV. Analog TV is expected in CVBS format, it must be demodulated already. Media controller decoder entity is included so pipeline verification passes and graph is properly constructed. Analog TV bits based off cx231xx driver. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil [hverkuil: fix a few minor checkpatch issues] commit 15d6dd1ed3d58656bd7b86e9303ad839d6913b2e Merge: d9794c0600f95b 2cdaff22ed26f1 Author: Marek Szyprowski Date: Wed Mar 25 18:24:26 2026 +0100 Merge tag 'dma-mapping-7.0-2026-03-25' into dma-mapping-for-next dma-mapping fixes for Linux 7.0 A set of fixes for DMA-mapping subsystem, which resolve false-positive warnings from KMSAN and DMA-API debug (Shigeru Yoshida and Leon Romanovsky) as well as a simple build fix (Miguel Ojeda). Signed-off-by: Marek Szyprowski commit c0128c7157d639a931353ea344fb44aad6d6e17a Author: Greg Kroah-Hartman Date: Mon Feb 23 18:05:15 2026 +0100 i2c: s3c24xx: check the size of the SMBUS message before using it The first byte of an i2c SMBUS message is the size, and it should be verified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX before processing it. This is the same logic that was added in commit a6e04f05ce0b ("i2c: tegra: check msg length in SMBUS block read") to the i2c tegra driver. Cc: Krzysztof Kozlowski Cc: Alim Akhtar Cc: Andi Shyti Cc: stable Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/2026022314-rely-scrubbed-4839@gregkh commit 723ddce93e8db101e3cf30d9956240b964603c3c Author: Philipp Hahn Date: Tue Mar 10 12:49:25 2026 +0100 debugobjects: Drop likely() around !IS_ERR_OR_NULL() IS_ERR_OR_NULL() already uses likely(!ptr) internally. checkpatch points out the nesting: Remove the explicit use of likely(). Change generated with coccinelle. Signed-off-by: Philipp Hahn Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260310-b4-is_err_or_null-v1-59-bd63b656022d@avm.de commit d78908eae874cc2f18c182ab5718116205dbf2eb Author: Andy Shevchenko Date: Tue Feb 24 12:52:10 2026 +0100 dt-bindings: i2c: dw: Remove unused bindings As stated in the d70f60ad964d ("i2c: designware: Remove not-going-to-be-supported code for Baikal SoC") the Baikal platforms are not supported and the respective driver code was removed. Remove the currently unused bindings. Signed-off-by: Andy Shevchenko Acked-by: Conor Dooley Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260224115210.3499191-1-andriy.shevchenko@linux.intel.com commit 8a6391ec669366cbe7bde92b468c561e8b309fd6 Author: Alexey Charkov Date: Wed Mar 18 18:50:25 2026 +0400 ASoC: rockchip: rockchip_sai: Set slot width for non-TDM mode Currently the slot width in non-TDM mode is always kept at the POR value of 32 bits, regardless of the sample width, which doesn't work well for some codecs such as NAU8822. Set the slot width according to the sample width in non-TDM mode, which is what other CPU DAI drivers do. Tested on the following RK3576 configurations: - SAI2 + NAU8822 (codec as the clock master), custom board - SAI1 + ES8388 (codec as the clock master), RK3576 EVB1 - SAI2 + RT5616 (SAI as the clock master), FriendlyElec NanoPi M5 NAU8822 didn't work prior to this patch but works after the patch. Other two configurations work both before and after the patch. Fixes: cc78d1eaabad ("ASoC: rockchip: add Serial Audio Interface (SAI) driver") Signed-off-by: Alexey Charkov Tested-by: Nicolas Frattaroli Link: https://patch.msgid.link/20260318-sai-slot-width-v1-1-1f68186f71e3@flipper.net Signed-off-by: Mark Brown commit c9b48a451ca8fc36c382e1e05a86e477803e32a5 Author: Fabio Estevam Date: Tue Mar 24 10:55:08 2026 -0300 ASoC: dt-bindings: rockchip: Convert rockchip-max98090.txt to yaml Convert rockchip-max98090.txt to yaml to allow dt-schema validation. Signed-off-by: Fabio Estevam Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260324135508.839142-1-festevam@gmail.com Signed-off-by: Mark Brown commit 348741a97c28d7679fb1e204aeec0d6305fc6817 Author: Gatien Chevallier Date: Thu Feb 26 11:30:27 2026 +0100 pinctrl: stm32: add firewall checks before probing the HDP driver Because the HDP peripheral both depends on debug and firewall configuration, when CONFIG_STM32_FIREWALL is present, use the stm32 firewall framework to be able to check these configuration against the relevant controllers. Signed-off-by: Gatien Chevallier Reviewed-by: Clément Le Goffic Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20260226-debug_bus-v6-12-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit f1939c6a0bed6a4af8339fd0aeb28a17b7a0d4c7 Author: Gatien Chevallier Date: Thu Feb 26 11:30:21 2026 +0100 drivers: bus: add the stm32 debug bus driver Add the stm32 debug bus driver that is responsible of checking the debug subsystem accessibility before probing the related peripheral drivers. This driver is OP-TEE dependent and relies on the STM32 debug access PTA. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20260226-debug_bus-v6-6-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit 4ea96cfc728bbc7c1c3051cce9209bf9a6eeb23e Author: Gatien Chevallier Date: Thu Feb 26 11:30:20 2026 +0100 bus: stm32_firewall: add stm32_firewall_get_grant_all_access() API Add the stm32_firewall_get_grant_all_access() API to be able to fetch all firewall references in an access-controllers property and try to grant access to all of them. Signed-off-by: Gatien Chevallier Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20260226-debug_bus-v6-5-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit 892320d20362b7d567b759aec2bbe9c26b404e00 Author: Gatien Chevallier Date: Thu Feb 26 11:30:19 2026 +0100 bus: stm32_firewall: allow check on different firewall controllers Current implementation restricts the check on the firewall controller being the bus parent. Change this by using the controller referenced in each firewall queries. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20260226-debug_bus-v6-4-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit 2b690a435643bde649a088bfc59be5282acf018f Author: Gatien Chevallier Date: Thu Feb 26 11:30:18 2026 +0100 dt-bindings: bus: document the stm32 debug bus Document the stm32 debug bus. The debug bus is responsible for checking the debug sub-system accessibility before probing any related drivers. Signed-off-by: Gatien Chevallier Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260226-debug_bus-v6-3-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit f7cfd2b29127893982b4f73908df1036cfc0b9ff Author: Gatien Chevallier Date: Thu Feb 26 11:30:17 2026 +0100 dt-bindings: pinctrl: document access-controllers property for stm32 HDP HDP being functional depends on the debug configuration on the platform that can be checked using the access-controllers property, document it. Signed-off-by: Gatien Chevallier Acked-by: Rob Herring (Arm) Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20260226-debug_bus-v6-2-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit c75617dd949b343ade70f35ecd2d4546738b57bf Author: Gatien Chevallier Date: Thu Feb 26 11:30:16 2026 +0100 dt-bindings: document access-controllers property for coresight peripherals Document the access-controllers for coresight peripherals in case some access checks need to be performed to use them. Signed-off-by: Gatien Chevallier Reviewed-by: Rob Herring (Arm) Acked-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260226-debug_bus-v6-1-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit d5ce3b4e951bc41a6ce877c8500bb4fe42146669 Author: Gatien Chevallier Date: Thu Jan 29 13:56:17 2026 +0100 bus: rifsc: fix RIF configuration check for peripherals Peripheral holding CID0 cannot be accessed, remove this completely incorrect check. While there, fix and simplify the semaphore checking that should be performed when the CID filtering is enabled. Fixes: a18208457253 ("bus: rifsc: introduce RIFSC firewall controller driver") Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20260129-fix_cid_check_rifsc-v1-1-ef280ccf764d@foss.st.com Signed-off-by: Alexandre Torgue commit a6e1842be2e4fd590136da5c100fbad6c3129d96 Author: Thorsten Blum Date: Mon Feb 23 22:12:11 2026 +0100 bus: rifsc: Replace snprintf("%s") with strscpy Replace snprintf("%s", ...) with the faster and more direct strscpy(). Signed-off-by: Thorsten Blum Acked-by: Gatien Chevallier Link: https://lore.kernel.org/r/20260223211212.344855-1-thorsten.blum@linux.dev Signed-off-by: Alexandre Torgue commit 256b4efd98b1dcbe80e817a67b17c07becb80969 Author: Krzysztof Kozlowski Date: Mon Jan 5 15:36:59 2026 +0100 bus: stm32_firewall: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Tested-by: Gatien Chevallier Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260105143657.383621-5-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Alexandre Torgue commit 698753e4a51a5a6670d527a3db084c3616253abc Author: Clément Le Goffic Date: Tue Feb 10 20:05:45 2026 +0100 bus: firewall: move stm32_firewall header file in include folder Other driver than RIFSC and ETZPC can implement firewall ops, such as RCC. In order for them to have access to the ops and type of this framework, we need to get the `stm32_firewall.h` file in the include/ folder. Signed-off-by: Clément Le Goffic Signed-off-by: Clément Le Goffic Acked-by: Gatien Chevallier Link: https://lore.kernel.org/r/20260210-b4-firewall-upstream-v8-1-097c1e47af82@gmail.com Signed-off-by: Alexandre Torgue commit 407b861f4d0cd3ac2ce1b98e6e09fbc7aff29b09 Author: Raphael Gallais-Pou Date: Thu Feb 5 16:03:24 2026 +0100 arm64: defconfig: Enable STMicroelectronics STM32 display support Enable STMicroelectronics STM32 display support as module. This includes: * DRM_STM * DRM_STM_LVDS * BACKLIGHT_GPIO * TOUCHSCREEN_ILI210X This display is used on several SoCs and boards such as STM32MP257F-EV1 and STM32MP257F-DK. Signed-off-by: Raphael Gallais-Pou Tested-by: Yannick Fertre Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260205-master-v1-1-dcefcabc2934@foss.st.com Signed-off-by: Alexandre Torgue commit 897b9a36c22c4408240c398e395c4d97e2f1a2d7 Author: Raphael Gallais-Pou Date: Wed Mar 25 15:41:49 2026 +0100 arm64: dts: st: enable display support on stm32mp257f-dk board Enable the following IPs on stm32mp257f-dk in order to get display: * LTDC * LVDS * WSVGA LVDS panel (1024x600) * Panel LVDS backlight as GPIO backlight * ILI2511 i2c touchscreen Signed-off-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20260210-display-v2-9-0592bd514958@foss.st.com Signed-off-by: Alexandre Torgue commit c5dad91c21995f0f677dae9dada7373f7a0c7789 Author: Raphael Gallais-Pou Date: Tue Feb 10 11:04:01 2026 +0100 arm64: dts: st: describe power supplies for stm32mp257f-dk board Describe power supplies for stm32mp257f-dk board. Signed-off-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20260210-display-v2-8-0592bd514958@foss.st.com Signed-off-by: Alexandre Torgue commit 973f230c406214e0f0e29df00be286e8c5e7f1f1 Author: Raphael Gallais-Pou Date: Wed Mar 25 15:36:35 2026 +0100 arm64: dts: st: enable display support on stm32mp235f-dk board Enable the following IPs on stm32mp235f-dk in order to get display: * LTDC * LVDS * WSVGA LVDS panel (1024x600) * Panel LVDS backlight as GPIO backlight * ILI2511 i2c touchscreen Signed-off-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20260210-display-v2-7-0592bd514958@foss.st.com Signed-off-by: Alexandre Torgue commit 963758188e195b1a429cf5b7555d100dd6eddcd5 Author: Raphael Gallais-Pou Date: Tue Feb 10 11:03:59 2026 +0100 arm64: dts: st: describe power supplies for stm32mp235f-dk board Describe power supplies for stm32mp235f-dk board. Signed-off-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20260210-display-v2-6-0592bd514958@foss.st.com Signed-off-by: Alexandre Torgue commit eb0528245f948ae71e5c226e2a1d56f312091a96 Author: Raphael Gallais-Pou Date: Tue Feb 10 11:03:58 2026 +0100 arm64: dts: st: add clock-cells to syscfg node on stm32mp231 Make the syscfg node a clock provider so clock consumers can reach child clocks through device-tree. Signed-off-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20260210-display-v2-5-0592bd514958@foss.st.com Signed-off-by: Alexandre Torgue commit afb3dcfe9636ca624edafd82966cc05a21e193a1 Author: Raphael Gallais-Pou Date: Tue Feb 10 11:03:57 2026 +0100 arm64: dts: st: add lvds support on stm32mp235 The LVDS is used on STM32MP2 as a display interface. Add the LVDS node. Signed-off-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20260210-display-v2-4-0592bd514958@foss.st.com Signed-off-by: Alexandre Torgue commit 5ef22cf564d571402d17883aa313d94842447acf Author: Raphael Gallais-Pou Date: Tue Feb 10 11:03:56 2026 +0100 arm64: dts: st: add ltdc support on stm32mp235 Add the LTDC node for stm32mp235 SoC and handle its loopback clocks. ck_ker_ltdc has the CLK_SET_RATE_PARENT flag. While having this flag is semantically correct, it for now leads to an improper setting of the clock rate. The ck_ker_ltdc parent clock is the flexgen 27, which does not support changing rates yet. To overcome this issue, a fixed clock can be used for the kernel clock. Signed-off-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20260210-display-v2-3-0592bd514958@foss.st.com Signed-off-by: Alexandre Torgue commit e12becdf89d9d56314d043026c4704b0960571bb Author: Raphael Gallais-Pou Date: Tue Feb 10 11:03:55 2026 +0100 arm64: dts: st: add ltdc support on stm32mp231 The LCD-TFT Display Controller (LTDC) handles display composition, scaling and rotation. It provides a parallel digital RGB flow to be used by display interfaces. Add the LTDC node. Signed-off-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20260210-display-v2-2-0592bd514958@foss.st.com Signed-off-by: Alexandre Torgue commit 84c9ed3a7726efc7095a21e4cfbda6dc1982406e Author: Amelie Delaunay Date: Wed Mar 11 12:30:00 2026 +0100 arm64: dts: st: omit unused pinctrl groups from stm32mp25 dtb files stm32mp25-pinctrl.dtsi gathers all pinctrl groups from current and future STM32MP25-based boards. Some groups may remain unused by any board, resulting in wasted binary space. Adding /omit-if-no-ref/ to the groups will remove unused groups from the device tree blobs. Use the following regex to update the file: 's/^\t[^:]\+: [^ ]\+ {$/\t\/omit-if-no-ref\/\n&/' Also, merge the duplicated pinctrl_z node. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20260311-mp25_pinctrl_omit-v1-1-5a3d40046b10@foss.st.com Signed-off-by: Alexandre Torgue commit 908d0138b4ed408dbc23c1cea28aa7937fd5388d Author: Patrice Chotard Date: Wed Feb 11 14:55:02 2026 +0100 arm64: dts: st: add bootph-all in bsec node to stm32mp215f-dk Add bootph-all property in bsec node to ensure that bsec node is included in U-Boot device tree for all phases. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20260211-upstream_stm32mp21_bsec_nodes-v1-2-8379bf97b0bc@foss.st.com Signed-off-by: Alexandre Torgue commit 5cccb3f708417701d0e7e763efb2642d9ee47ac6 Author: Patrice Chotard Date: Wed Feb 11 14:55:01 2026 +0100 arm64: dts: st: add bsec support to stm32mp21 Add BSEC support to STM32MP21 SoC family with SoC information: - RPN = Device part number (BSEC_OTP_DATA9) - PKG = package data register (Bits 2:0 of BSEC_OTP_DATA122) Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20260211-upstream_stm32mp21_bsec_nodes-v1-1-8379bf97b0bc@foss.st.com Signed-off-by: Alexandre Torgue commit b7fc8970e73afa5fbd98fb785d987cf4a4f045ca Author: Amelie Delaunay Date: Wed Mar 4 09:07:00 2026 +0100 ARM: dts: stm32: fix misalignments in nodes of stm32mp131 Since the ETZPC system bus was introduced, misalignments have appeared in some nodes moved under the etzpc parent node. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20260304-mp1x_alignment_issues-v1-2-19a8013782a5@foss.st.com Signed-off-by: Alexandre Torgue commit 9203b1605c60805798be92551abf6cb9d7e0c0af Author: Amelie Delaunay Date: Wed Mar 4 09:06:59 2026 +0100 ARM: dts: stm32: fix misalignments in nodes of stm32mp151 Since the ETZPC system bus was introduced, misalignments have appeared in some nodes moved under the etzpc parent node. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20260304-mp1x_alignment_issues-v1-1-19a8013782a5@foss.st.com Signed-off-by: Alexandre Torgue commit 796766ceba32ad188e11961f2ac555510f78fcf5 Author: Alain Volmat Date: Tue Feb 24 16:48:12 2026 +0100 arm64: dts: st: describe i2c2 / i2c8 on stm32mp235f-dk Add nodes for i2c2 and i2c8 available on stm32mp235f-dk board. Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20260224-stm32-i2c-dt-updates-v1-9-347cf6fca7d1@foss.st.com Signed-off-by: Alexandre Torgue commit 479719088105ccfc7109cd33996f52a168780cf3 Author: Alain Volmat Date: Tue Feb 24 16:48:11 2026 +0100 arm64: dts: st: describe i2c2 / i2c8 on stm32mp257f-dk Add nodes for i2c2 and i2c8 available on stm32mp257f-dk board. Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20260224-stm32-i2c-dt-updates-v1-8-347cf6fca7d1@foss.st.com Signed-off-by: Alexandre Torgue commit dcc792919ceef80b5ab7c328dde6deff7ebe0cc3 Author: Alain Volmat Date: Tue Feb 24 16:48:10 2026 +0100 arm64: dts: st: disable DMA usage for i2c on stm32mp257f-ev1 Keep DMA resources available by avoiding usage of DMA for i2c transfers on stm32mp257f-ev1 board. Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20260224-stm32-i2c-dt-updates-v1-7-347cf6fca7d1@foss.st.com Signed-off-by: Alexandre Torgue commit 7268a782a19d7ab3c146fd39026ee0d4a933866a Author: Alain Volmat Date: Tue Feb 24 16:48:09 2026 +0100 arm64: dts: st: add i2c2 pinmux nodes in stm32mp25-pinctrl.dtsi Add a 2nd set of i2c2 pinmux nodes (i2c2_pins_b/i2c2_sleep_pins_b) in stm32mp25-pinctrl.dtsi in order to be used on the stm32mp257f-dk Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20260224-stm32-i2c-dt-updates-v1-6-347cf6fca7d1@foss.st.com Signed-off-by: Alexandre Torgue commit 2cf2f1b5193f1a513900599497ecc823002c0a41 Author: Alain Volmat Date: Tue Feb 24 16:48:08 2026 +0100 arm64: dts: st: update i2c nodes interrupt/wakeup-source in stm32mp231 Update all i2c nodes with the following properties: - replace interrupts with interrupts-extended and rely on exti - add the wakeup-source property Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20260224-stm32-i2c-dt-updates-v1-5-347cf6fca7d1@foss.st.com Signed-off-by: Alexandre Torgue commit a3fe2ddbb4315328bbd768ce7d6cfa0ba1bc4c30 Author: Alain Volmat Date: Tue Feb 24 16:48:07 2026 +0100 arm64: dts: st: update i2c nodes interrupt/wakeup-source in stm32mp251 Update all i2c nodes with the following properties: - replace interrupts with interrupts-extended and rely on exti - add the wakeup-source property Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20260224-stm32-i2c-dt-updates-v1-4-347cf6fca7d1@foss.st.com Signed-off-by: Alexandre Torgue commit fbd3500613b5184b80a56c1eb16bf419a609081e Author: Olivier Moysan Date: Tue Feb 24 16:48:06 2026 +0100 ARM: dts: stm32: remove i2c dma properties in stm32mp157c-ev1 Since DMA resources are limited, remove the DMA related properties of i2c2 and i2c5 in stm32mp157c-ev1.dts. Signed-off-by: Olivier Moysan Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20260224-stm32-i2c-dt-updates-v1-3-347cf6fca7d1@foss.st.com Signed-off-by: Alexandre Torgue commit fcfab3031fc36c69b2850635d9abc2489095e7e4 Author: Alain Volmat Date: Tue Feb 24 16:48:05 2026 +0100 ARM: dts: stm32: update i2c nodes interrupt/wakeup-source in stm32mp131 Update all i2c nodes with the following properties: - replace interrupts with interrupts-extended and rely on exti - add the wakeup-source property Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20260224-stm32-i2c-dt-updates-v1-2-347cf6fca7d1@foss.st.com Signed-off-by: Alexandre Torgue commit 458d0c1d3a8dd05ae1bcd8daa3af7d50bd6f8587 Author: Alain Volmat Date: Tue Feb 24 16:48:04 2026 +0100 ARM: dts: stm32: update i2c nodes interrupt/dma in stm32mp151 Update all i2c nodes with the following properties: - replace interrupts with interrupts-extended and rely on exti - add dma properties Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20260224-stm32-i2c-dt-updates-v1-1-347cf6fca7d1@foss.st.com Signed-off-by: Alexandre Torgue commit 77a5fde00b9a8c7b78d2833a824eee991152050a Author: Marek Vasut Date: Wed Jan 21 09:53:21 2026 +0100 ARM: dts: stm32: Add DT overlays for DH STM32MP13xx/STM32MP15xx DHSOM The following DTOs are supported on STM32MP15xx DHCOM PDK2: - DH 460-200 SRAM board in header X11 - DH 497-200 adapter card with EDT ETM0700G0EDH6 Parallel RGB panel - DH 505-200 adapter card with Chefree CH101OLHLWH-002 LVDS panel - DH 531-100 SPI/I2C board in header X21 - DH 531-200 SPI/I2C board in header X22 - DH 560-200 7" LCD board in header X12 - DH 638-100 mezzanine card with RPi 7" DSI panel attached on top - DH 672-100 expansion card, which contains CAN/FD transceiver and enables PDK2 to use one more CAN/FD interface The following DTOs are supported on STM32MP15xx DHCOM DRC02: - Enable configuration where the DHSOM inserted into the DRC02 has RSI 9116 WiFi populated on the SoM and where the microSD slot on the bottom of DRC02 must not be used. This permits a non-default configuration of the SoM and DRC02 board used for custom device setup with on-SoM WiFi. The following DTOs are supported on STM32MP15xx DHCOM PicoITX: - DH 548-200 adapter card with Multi-Inno MI0700D4T-6 7" DPI panel - DH 553-100 adapter card with Team Source Display TST043015CMHX 4.3" DPI panel - DH 626-100 adapter card with Chefree CH101OLHLWH-002 LVDS panel The following DTOs are supported on STM32MP15xx DHCOR Avenger96: - FDCAN1 on low-speed expansion X6 - FDCAN2 on low-speed expansion X6 - AT24C04 I2C EEPROM on low-speed expansion X6 I2C1 - AT24C04 I2C EEPROM on low-speed expansion X6 I2C2 - AT25AA010A SPI EEPROM on low-speed expansion X6 SPI2 - 96boards OV5640 mezzanine card with sensor connected to port J3. - DH 644-100 mezzanine card with Orisetech OTM8009A DSI panel - DH 644-100 mezzanine card with RPi 7" DSI panel The following DTOs are supported on STM32MP13xx DHCOR DHSBC: - joy-IT RB-TFT3.2-V2 240x320 SPI LCD and XPT2046 resistive touch controller Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20260121085347.10368-3-marex@nabladev.com Signed-off-by: Alexandre Torgue commit 23c24959de5d1ea0bc4194da1474eed048bf48a1 Author: Gatien Chevallier Date: Thu Feb 26 11:30:26 2026 +0100 arm: dts: stm32: enable CoreSight on the stm32mp135f-dk board Enable CoreSight peripherals on the stm32mp135f-dk board. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20260226-debug_bus-v6-11-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit f33ce4e7a573c30a9e13631cf63ccb36e32694c7 Author: Gatien Chevallier Date: Thu Feb 26 11:30:25 2026 +0100 arm: dts: stm32: enable CoreSight on the stm32mp157c-ev1 board Enable CoreSight peripherals on the stm32mp157c-ev1 board. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20260226-debug_bus-v6-10-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit 65e58aa986e5a997e432f0fcd185fb8759ee65f4 Author: Gatien Chevallier Date: Thu Feb 26 11:30:24 2026 +0100 arm: dts: stm32: enable CoreSight on stm32mp15xx-dkx boards Enable CoreSight peripherals on the stm32mp15xx-dkx boards. All boards including this file are embedding a dual core SoC so this change is applicable. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20260226-debug_bus-v6-9-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit d4dd78de95a5f773e3146c9d6cb05f91ff85c7f4 Author: Gatien Chevallier Date: Thu Feb 26 11:30:23 2026 +0100 arm: dts: stm32: enable the debug bus on stm32mp1x boards On stm32mp1x boards, enable the debug bus so we always try to probe the debug peripherals, if their status and the debug configuration allow it. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20260226-debug_bus-v6-8-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit 672d0510cc1f5697bc9a7242da40c0129f49c849 Author: Gatien Chevallier Date: Thu Feb 26 11:30:22 2026 +0100 arm: dts: stm32: introduce the debug bus for stm32mp1x platforms Some peripherals cannot be probed if a debug configuration is not set in the BSEC. Introduce a debug bus that will check the debug subsystem accessibility before probing these peripheral drivers. Add Coresight peripheral nodes under this bus and add the appropriate access-controllers property to the HDP node. Signed-off-by: Antonio Borneo Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20260226-debug_bus-v6-7-5d794697798d@foss.st.com Signed-off-by: Alexandre Torgue commit 2f5bdca14ce88dd78998699ab25d129b9b3bc200 Author: Nikhil Gautam Date: Wed Mar 25 17:12:51 2026 +0530 iio: accel: adxl380: fix typo in PART_ID register macro Fix a typo in the ADXL380_PART_ID_REG macro name where it was incorrectly defined as ADLX380_PART_ID_REG. Also update its usage in adxl380_setup(). Signed-off-by: Nikhil Gautam Signed-off-by: Jonathan Cameron commit 74ec3d52c0035b662ec295bef2bbffad68446391 Author: Robert Mazur Date: Wed Mar 25 09:18:59 2026 +0100 riscv: dts: thead: beaglev-ahead: enable HDMI output The BeagleV Ahead board includes a micro HDMI connector (Type-D) wired to the TH1520 SoC's HDMI transmitter. Enable the display pipeline by adding the HDMI connector node, connecting it to the HDMI controller, and activating the DPU and HDMI nodes. Signed-off-by: Robert Mazur Signed-off-by: Drew Fustini commit 734fd5ba78cb079ba1873336387da8cb4df60403 Author: Oliver Neukum Date: Wed Mar 25 15:32:47 2026 +0100 Input: pegasus_notetaker - use HID defines The driver uses its own definitions for HID requests. This leads to duplication and obfuscation. Use HID's definitions. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260325143256.371854-2-oneukum@suse.com Signed-off-by: Dmitry Torokhov commit ffd01c3bcc1af4d8c3e7949152af0d9fe3d1fda5 Author: Oliver Neukum Date: Wed Mar 25 15:32:46 2026 +0100 Input: aiptek - use HID headers The driver uses its own definitions for HID requests. This leads to duplication and obfuscation. Use HID's definitions. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260325143256.371854-1-oneukum@suse.com Signed-off-by: Dmitry Torokhov commit 653f3100f551cf01974a18cce66e368f248ee48a Author: Val Packett Date: Sat Mar 21 04:30:07 2026 -0300 Input: goodix-berlin - report a resolution of 10 units/mm Without a reported resolution, userspace was assuming 1 unit/mm which is wildly wrong: a regular smartphone is clearly not 2.4 meters tall. Most applications do not care much for this kind of raw mm value, but Phosh's on-screen keyboard would accidentally trigger swipe-to-close gestures due to misinterpreting small movements as huge ones. Do what the older goodix.c driver does and set the resolution to 10 units/mm to make sure the numbers calculated by userspace are reasonable. Signed-off-by: Val Packett Link: https://patch.msgid.link/20260321073242.556253-1-val@packett.cool Signed-off-by: Dmitry Torokhov commit 6bf36c68b0a23afba108920d21c1c108f83371d6 Author: Cheng-Yang Chou Date: Wed Mar 25 12:51:48 2026 +0800 tools/sched_ext: Regenerate autogen enum headers Regenerate enum_defs.autogen.h, enums.autogen.h and enums.autogen.bpf.h using the upstream scripts [1][2] to sync with recent kernel enum additions. [1] https://github.com/sched-ext/scx/blob/main/scripts/gen_enum_defs.py [2] https://github.com/sched-ext/scx/blob/main/scripts/gen_enums.py Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit afeaa9f2532d1d8d04803d09ac2d4f7107854f29 Author: Breno Leitao Date: Mon Mar 23 03:18:36 2026 -0700 workqueue: unlink pwqs from wq->pwqs list in alloc_and_link_pwqs() error path When alloc_and_link_pwqs() fails partway through the per-cpu allocation loop, some pool_workqueues may have already been linked into wq->pwqs via link_pwq(). The error path frees these pwqs with kmem_cache_free() but never removes them from the wq->pwqs list, leaving dangling pointers in the list. Currently this is not exploitable because the workqueue was never added to the global workqueues list and the caller frees the wq immediately after. However, this makes sure that alloc_and_link_pwqs() doesn't leave any half-baked structure, which may have side effects if not properly cleaned up. Fix this by unlinking each pwq from wq->pwqs before freeing it. No locking is needed as the workqueue has not been published yet, thus no concurrency is possible. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 400ff899c336c24bf4d34479f98cef2fd2d3482a Author: Alexei Starovoitov Date: Tue Mar 24 18:22:42 2026 -0700 selftests/bpf: Make reg_bounds test more robust The verifier log output may contain multiple lines that start with 18: (bf) r0 = r6 teach reg_bounds to look for lines that have ';' in them, since reg_bounds test is looking for: 18: (bf) r0 = r6 ; R0=... R6=... Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260325012242.45606-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 79df764dbecd5c4bf1b1431b865a361ce7bebb2d Author: Dmitry Torokhov Date: Sat Aug 17 19:08:21 2024 -0700 Input: zinitix - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit 35ee82990df219f6f42962c0306c00231b85f238 Author: Dmitry Torokhov Date: Fri Aug 16 15:18:44 2024 -0700 Input: wm97xx - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit da52f4b27a798304a7f4639ac5addc5574242cdf Author: Dmitry Torokhov Date: Wed May 29 11:08:15 2024 -0700 Input: wdt87xx_i2c - switch to using cleanup functions Start using __free() and guard() primitives to simplify the code and error handling. Signed-off-by: Dmitry Torokhov commit e65407f838368fb7ab98fb7f02cbf5b9377976d3 Author: Dmitry Torokhov Date: Tue Aug 6 16:48:00 2024 -0700 Input: tsc2007 - use guard notation when acquiring mutexes This makes the code more compact and error handling more robust. Signed-off-by: Dmitry Torokhov commit 600a2db76bf28ab791774ed378d74c50f16e24d5 Author: Dmitry Torokhov Date: Wed Aug 14 14:22:13 2024 -0700 Input: sx8654 - use IRQF_NOAUTOEN when requesting interrupt Instead of requesting interrupt normally and immediately disabling it with call to disable_irq() use IRQF_NOAUTOEN to keep it disabled until it is needed. This avoids a tiny window when interrupt is enabled but not needed. Signed-off-by: Dmitry Torokhov commit a8f56931c432c8c9a5198887bdd0f5d181b75495 Author: Dmitry Torokhov Date: Wed Aug 14 14:13:33 2024 -0700 Input: sx8654 - use guard notation when acquiring spinlock Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit dc05a01180814440aee1959721528012dcda4461 Author: Dmitry Torokhov Date: Wed Aug 14 14:38:11 2024 -0700 Input: sur40 - use guard notation when acquiring spinlock Guard notation simplifies code. Also use list_first_entry() instead of list_entry() to emphasize intent. Signed-off-by: Dmitry Torokhov commit 8665ceb926ec9d302ca94e46a2fe07afc08f56d0 Author: Dmitry Torokhov Date: Fri Aug 16 14:09:22 2024 -0700 Input: stmfts - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit e3e82a9d08fcfebc9ece8333711658ab8d7f3684 Author: Dmitry Torokhov Date: Wed May 29 11:22:15 2024 -0700 Input: raydium_i2c_ts - switch to using cleanup functions Start using __free() and guard() primitives to simplify the code and error handling. Signed-off-by: Dmitry Torokhov commit 738de07ddf0926b01fd8d3ba24f0c65fa5b418f5 Author: Dmitry Torokhov Date: Sat Aug 17 19:07:03 2024 -0700 Input: pixcir_i2c_ts - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit 9f33f4fd39964d13379af396f3bfe3d3617a33f5 Author: Dmitry Torokhov Date: Sat Aug 17 19:04:21 2024 -0700 Input: novatek-nvt-ts - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit 7c011b6ddbe8350ad9b69295520553d461fcabba Author: Dmitry Torokhov Date: Thu Aug 22 17:12:08 2024 -0700 Input: mxs-lradc-ts - use guard notation when acquiring spinlock Guard notation simplifies code and shows critical section more clearly. Signed-off-by: Dmitry Torokhov commit 3b2a422e23cf1998b85ccbcb90cabff01d17422c Author: Frank Li Date: Tue Mar 24 18:16:20 2026 -0400 dt-bindings: mtd: mxc-nand: add missing compatible string and ref to nand-controller-legacy.yaml Add compatible string fsl,imx51-nand, fsl,imx53-nand and fsl,imx35-nand. Add missinge properties dmas and dma-names. Change reg's maxItems to 2 because i.MX53 have addition NAND flash internal buffer space. Change ref to nand-controller-legacy.yaml allow legacy DT layout. Reviewed-by: Rob Herring (Arm) Signed-off-by: Frank Li Signed-off-by: Miquel Raynal commit 17de8a68ac9807adf551f7d2d980e26d1196e41a Author: Frank Li Date: Tue Mar 24 18:16:19 2026 -0400 dt-bindings: mtd: gpmi-nand: ref to nand-controller-legacy.yaml Ref to nand-controller-legacy.yaml instead nand-controller.yaml to allow legacy DT layout. Reviewed-by: Rob Herring (Arm) Signed-off-by: Frank Li Signed-off-by: Miquel Raynal commit 0ba8da2f318efc006ae5c080a4abfbabb5d110e2 Author: Frank Li Date: Tue Mar 24 18:16:18 2026 -0400 dt-bindings: mtd: refactor NAND bindings and add nand-controller-legacy.yaml The modern NAND controller binding requires NAND chips to be described as child nodes of the controller, for example: nand-controller { ... nand@0 { /* raw NAND chip properties */ }; }; However, many existing device trees place NAND chip properties directly within the controller node because those controllers support only a single chip. This layout is still widely used by older platforms and by other DT consumers such as U-Boot. Migrating all existing users to the new layout will take time. Several kernel drivers, such as ams-delta.c, davinci_nand.c and fsmc_nand.c, still expect the legacy layout where raw NAND properties are defined in the controller node. To support both layouts during the transition: - Extract NAND chip-related properties into separate schemas (nand-property.yaml and raw-nand-property.yaml) from nand-chip.yaml and raw-nand-chip.yaml. - Introduce nand-controller-legacy.yaml to allow both the legacy and modern layouts. - Add a select condition in nand-controller.yaml to prevent node name pattern matching for fsl,* NAND controllers. Keep compatibility with existing device trees while allowing gradual migration to the modern binding structure. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 25a915fad503c2678902075565d47ddc2aa45db9 Author: Miquel Raynal Date: Wed Mar 18 11:47:50 2026 +0100 mtd: spinand: winbond: Clarify when to enable the HS bit Above 104MHz when in fast dual or quad I/O reads, the delay between address and data cycles is too short. It is possible to reach higher frequencies, up to 166MHz, by adding a few more dummy cycles through the setting of the HS bit. Improve the condition for enabling this bit, and also make sure we set it at soon as we go over 104MHz. Fixes: f1a91175faaa ("mtd: spinand: winbond: Enable high-speed modes on w25n0xjw") Signed-off-by: Miquel Raynal commit 54dcd6aa69db541529a083b31f106ef7d147fea1 Author: Richard Genoud Date: Tue Mar 17 15:24:37 2026 +0100 mtd: rawnand: sunxi: introduce maximize variable user data length In Allwinner SoCs, user data can be added in OOB before each ECC data. For older SoCs like A10, the user data size was the size of a register (4 bytes) and was mandatory before each ECC step. So, the A10 OOB Layout is: [4Bytes USER_DATA_STEP0] [ECC_STEP0 bytes] [4bytes USER_DATA_STEP1] [ECC_STEP1 bytes] ... NB: the BBM is stored at the beginning of the USER_DATA_STEP0. Now, for H6/H616 NAND flash controller, this user data can have a different size for each step. So, we are maximizing the user data length to use as many OOB bytes as possible. Fixes: 88fd4e4deae8 ("mtd: rawnand: sunxi: Add support for H616 nand controller") Signed-off-by: Richard Genoud Signed-off-by: Miquel Raynal commit a22f40d9eb1ef587a8201fde3f004173fd8b5e8e Author: Richard Genoud Date: Tue Mar 17 15:24:36 2026 +0100 mtd: rawnand: sunxi: fix typos in comments Fix lenghts -> lengths and chuncks -> chunks Signed-off-by: Richard Genoud Signed-off-by: Miquel Raynal commit a1c967f5d6a568dd24583917774e0178b8e39221 Author: Richard Genoud Date: Tue Mar 17 15:24:35 2026 +0100 mtd: rawnand: sunxi: change error prone variable name In sunxi_nand_hw_ecc_ctrl_init(), i is used as a loop index variable and at the same time as the value used to set ECC mode in ECC control register. To prevent it from being re-used as a loop variable, let's change the naming to ecc_mode. No functional change. Signed-off-by: Richard Genoud Signed-off-by: Miquel Raynal commit 2781542caf681ce52f213152104fb7669263651c Author: Richard Genoud Date: Tue Mar 17 15:24:34 2026 +0100 mtd: rawnand: sunxi: remove dead code sunxi_nand_ooblayout_free() is only used in a code path where engine_type == NAND_ECC_ENGINE_TYPE_ON_HOST So the other cases can be removed. Signed-off-by: Richard Genoud Signed-off-by: Miquel Raynal commit 548f87ed47479e08203bc576cb5020f537e49bce Author: Richard Genoud Date: Tue Mar 17 15:24:33 2026 +0100 mtd: rawnand: sunxi: make the code more self-explanatory In sunxi_nfc_hw_ecc_{read,write}_chunk(), the ECC step was forced to 0, the reason is not trivial to get when reading the code. The explanation is that, from the NAND flash controller perspective, we are indeed at step 0 for user data length and ECC errors. Just add a const value with an explanation to clarify things. Acked-by: Jernej Skrabec Signed-off-by: Richard Genoud Signed-off-by: Miquel Raynal commit e3fd963da4c7469757d4f7741157fc5e23da47ed Author: Richard Genoud Date: Tue Mar 17 15:24:32 2026 +0100 mtd: rawnand: sunxi: replace hard coded value by a define - take2 The user data length (4) has been replaced almost all over the file, but 2 places were forgotten. The user data is placed before the ECC, for each step. So, in sunxi_nfc_hw_ecc_read_extra_oob(), the offset of the user data in OOB is indeed ((ecc->bytes + USER_DATA_SZ) * ecc->steps); And in sunxi_nand_ooblayout_ecc(), the offset of the ECC chunk in OOB is the same offset plus the current user data size: section * (ecc->bytes + USER_DATA_SZ) + USER_DATA_SZ; Reviewed-by: Jernej Skrabec Signed-off-by: Richard Genoud Signed-off-by: Miquel Raynal commit 8fa72836be11ea70cbfa43f7f2253fa57ccc6ecd Author: Richard Genoud Date: Tue Mar 17 15:24:31 2026 +0100 mtd: rawnand: sunxi: do not count BBM bytes twice BBM is already part of USER_DATA section, so we should not remove it twice This was working ok because we are on the safe size, advertising that there was 2 bytes less available than in reality. But we can't change old platforms, since it may lead to a different ECC strength, so, introduce a legacy flag for old platforms, and switch the new platforms to the correct count. Signed-off-by: Richard Genoud Signed-off-by: Miquel Raynal commit 848c13996c55fe4ea6bf5acc3ce6c8c5c944b5f6 Author: Richard Genoud Date: Tue Mar 17 15:24:30 2026 +0100 mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob When dumping the OOB, the bytes at the end where actually copied from the beginning of the OOB instead of current_offset. That leads to something like: OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4 OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4 OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4 OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4 OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b instead of: OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4 OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4 OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff (example with BCH16, user data [8,0], no scrambling) *cur_off (offset from the beginning of the page) was compared to offset (offset from the beginning of the OOB), and then, the nand_change_read_column_op() sets the current position to the beginning of the OOB instead of OOB+offset Fixes: 15d6f118285f ("mtd: rawnand: sunxi: Stop supporting ECC_HW_SYNDROME mode") Reviewed-by: Jernej Skrabec Signed-off-by: Richard Genoud Signed-off-by: Miquel Raynal commit 87f9c59f896fd46d45be76d8a8286a6916ce1f1a Author: Richard Genoud Date: Tue Mar 17 15:24:29 2026 +0100 mtd: rawnand: sunxi: sunxi_nand_ooblayout_free code clarification The available length is really USER_DATA_LEN - 2 instead of just 2 (the user data length minus the BBM length) USER_DATA_LEN being 4, that doesn't change anything now, but if USER_DATA_LEN changes, it will. Signed-off-by: Richard Genoud Reviewed-by: Chen-Yu Tsai Signed-off-by: Miquel Raynal commit e6fbe345b592731479dc2fa48b0b644820fba34e Author: Icenowy Zheng Date: Tue Mar 24 14:08:06 2026 +0800 drm: verisilicon: make vs_dc_platform_driver static The platform_driver struct isn't export and is only used for module init/exit functions generated by module_platform_driver() macro. Make it static to prevent namespace pollution. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603180616.TM6qYvIY-lkp@intel.com/ Signed-off-by: Icenowy Zheng Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260324060806.2047121-1-zhengxingda@iscas.ac.cn commit d6e0ef44688249009dfa24f1cd619d41637de060 Author: Saranya Gopal Date: Fri Mar 13 12:03:37 2026 +0200 mfd: intel-lpss: Add Intel Nova Lake-H PCI IDs Add Intel Nova Lake-H LPSS PCI IDs. Signed-off-by: Saranya Gopal Co-developed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260313100337.3471-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Lee Jones commit 9886005f89028ccdc75fc5a6ad5dc1e5df764221 Author: Thomas Zimmermann Date: Thu Mar 19 16:59:52 2026 +0100 drm/simple-kms: Deprecate simple-kms helpers Deprecate simple-encoder and simple-display-pipe helpers in favor of regular atomic helpers. Remove the related documentation. Add TODO item for converting the remaining drivers. These helpers have been deprecated for years and many drivers have been updated to not use them. Still there are a few left and we occasionally receive new drivers build upon them. Marking them as deprecated will hopefully resolve these problems. The TODO items should be easy enough for getting new voluteers started on DRM driver development. Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-17-tzimmermann@suse.de commit d6cef9bd3d96412f69648d1481d160283047713e Author: Thomas Zimmermann Date: Thu Mar 19 16:59:51 2026 +0100 drm/mipi-dbi: Remove simple-display helpers from mipi-dbi With the conversion to regular atomic helpers, mipi-dbi's support for simple-display helpers is unused. Removed it. v2: - remove unused connector from struct mipi_dbi_dev Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-16-tzimmermann@suse.de commit ec45d958d871620eb5033c3b6124cf06cbbb8077 Author: Thomas Zimmermann Date: Thu Mar 19 16:59:50 2026 +0100 drm/st7735r: Use regular atomic helpers; drop simple-display helpers Replace simple-display helpers with regular atomic helpers. Store the pipeline elements in struct st7735r_device and initialize them as part of probing the device. Use mipi-dbi's existing helpers and initializer macros where possible. Effectively open-codes the modesetting code in the initializer helpers of mipi-dbi and simple-display. St7735r requires a custom helper for CRTC enablement, and non-freeing cleanup of the pipeline. v2: - fix connector initialization Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-15-tzimmermann@suse.de commit efbe96cc329ac8eae73efc2f59dfc4f0794fe701 Author: Thomas Zimmermann Date: Thu Mar 19 16:59:49 2026 +0100 drm/st7735r: Rename priv variable to st7735r Rename the driver's device variable according to DRM conventions. No functional changes. Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-14-tzimmermann@suse.de commit 0ffcfae5eab76b52eed2b8464cc588f98bd29c15 Author: Thomas Zimmermann Date: Thu Mar 19 16:59:48 2026 +0100 drm/st7735r: Rename struct st7735r_priv to struct st7735r_device Rename the driver's device struct according to DRM conventions. Also add a helper to upcast from struct drm_device. No functional changes. Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-13-tzimmermann@suse.de commit 078e60d90a70c14d9756d500ee20ce83e785175b Author: Thomas Zimmermann Date: Thu Mar 19 16:59:47 2026 +0100 drm/st7586: Use regular atomic helpers; drop simple-display helpers Replace simple-display helpers with regular atomic helpers. Store the pipeline elements in struct st7586_device and initialize them as part of probing the device. Use mipi-dbi's existing helpers and initializer macros where possible. Effectively open-codes the modesetting code in the initializer helpers of mipi-dbi and simple-display. St7586 requires custom helpers for various pipeline elements, and non-freeing cleanup of the pipeline. v3: - return early in st7586_plane_helper_atomic_update (David) v2: - fix connector initialization Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Tested-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-12-tzimmermann@suse.de commit 2aa7a49cbb16282fa6ded10c23f1b3fffca138a0 Author: Thomas Zimmermann Date: Thu Mar 19 16:59:46 2026 +0100 drm/panel-mipi-dbi: Use regular atomic helpers; drop simple-display helpers Replace simple-display helpers with regular atomic helpers. Store the pipeline elements in struct panel_mipi_dbi_device and initialize them as part of probing the device. Use mipi-dbi's existing helpers and initializer macros where possible. Effectively open-codes the modesetting code in the initializer helpers of mipi-dbi and simple-display. Panel-mipi-dbi requires a custom helper for CRTC enablement, and non-freeing cleanup of the pipeline. v2: - fix connector initialization Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Tested-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-11-tzimmermann@suse.de commit 2f39d093cc96dec3fc726d0ce9400c5a84c0e11f Author: Thomas Zimmermann Date: Thu Mar 19 16:59:45 2026 +0100 drm/mi0283qt: Use regular atomic helpers; drop simple-display helpers Replace simple-display helpers with regular atomic helpers. Store the pipeline elements in struct mi0283qt_device and initialize them as part of probing the device. Use mipi-dbi's existing helpers and initializer macros where possible. Effectively open-codes the modesetting code in the initializer helpers of mipi-dbi and simple-display. Mi0283qt requires a custom helper for CRTC enablement, and non-freeing cleanup of the pipeline. v3: - set dbi variable (David) v2: - fix connector initialization - fix coding style Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-10-tzimmermann@suse.de commit 2f1a2ce427b848cfca4fd3c5d50e293fda25a088 Author: Thomas Zimmermann Date: Thu Mar 19 16:59:44 2026 +0100 drm/ili9486: Use regular atomic helpers; drop simple-display helpers Replace simple-display helpers with regular atomic helpers. Store the pipeline elements in struct ili9486_device and initialize them as part of probing the device. Use mipi-dbi's existing helpers and initializer macros where possible. Effectively open-codes the modesetting code in the initializer helpers of mipi-dbi and simple-display. Ili9486 requires a custom helper for CRTC enablement, and non-freeing cleanup of the pipeline. v3: - set ili9486 variable (David) v2: - fix connector initialization Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-9-tzimmermann@suse.de commit 35d0679f68f7e0ec28b92de05e1743c027839674 Author: Thomas Zimmermann Date: Thu Mar 19 16:59:43 2026 +0100 drm/ili9341: Use regular atomic helpers; drop simple-display helpers Replace simple-display helpers with regular atomic helpers. Store the pipeline elements in struct ili9341_device and initialize them as part of probing the device. Use mipi-dbi's existing helpers and initializer macros where possible. Effectively open-codes the modesetting code in the initializer helpers of mipi-dbi and simple-display. Ili9341 requires a custom helper for CRTC enablement, and non-freeing cleanup of the pipeline. v3: - set dbi variable (David) v2: - fix connector initialization Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-8-tzimmermann@suse.de commit 70cbb45ee550d5b17f760ec82d123b4d6077f039 Author: Thomas Zimmermann Date: Thu Mar 19 16:59:42 2026 +0100 drm/ili9225: Use regular atomic helpers; drop simple-display helpers Replace simple-display helpers with regular atomic helpers. Store the pipeline elements in struct ili9225_device and initialize them as part of probing the device. Use mipi-dbi's existing helpers and initializer macros where possible. Effectively open-codes the modesetting code in the initializer helpers of mipi-dbi and simple-display. Ili9225 requires custom helpers for various pipeline elements, and non-freeing cleanup of the pipeline. v3: - set dbi variable (David) v2: - fix connector initialization Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Tested-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-7-tzimmermann@suse.de commit baf75ffd2619454f23bf4f684c2544424fe57f39 Author: Thomas Zimmermann Date: Thu Mar 19 16:59:41 2026 +0100 drm/ili9163: Use regular atomic helpers; drop simple-display helpers Replace simple-display helpers with regular atomic helpers. Store the pipeline elements in struct ili9163_device and initialize them as part of probing the device. Use mipi-dbi's existing helpers and initializer macros where possible. Effectively open-codes the modesetting code in the initializer helpers of mipi-dbi and simple-display. Ili9163 requires a custom helper for CRTC enablement, and non-freeing cleanup of the pipeline. v3: - set dbi variable (David) v2: - fix connector initialization Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-6-tzimmermann@suse.de commit e3575c82abd69d307bd310f08b8a32776ab65036 Author: Thomas Zimmermann Date: Thu Mar 19 16:59:40 2026 +0100 drm/hx8357d: Use regular atomic helpers; drop simple-display helpers Replace simple-display helpers with regular atomic helpers. Store the pipeline elements in struct hx8357d_device and initialize them as part of probing the device. Use mipi-dbi's existing helpers and initializer macros where possible. Effectively open-codes the modesetting code in the initializer helpers of mipi-dbi and simple-display. Hx8357d requires a custom helper for CRTC enablement, and non-freeing cleanup of the pipeline. v2: - fix connector initialization Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-5-tzimmermann@suse.de commit 4a1affab9f9d816645b63bd642dccb49196e931d Author: Thomas Zimmermann Date: Thu Mar 19 16:59:39 2026 +0100 drm/mipi-dbi: Provide callbacks for atomic interfaces Refactor the existing simple-display callbacks such that they invoke helpers compatible with regular atomic modesetting. Allows for adding mipi-dbi drives that do not require simple-display helpers. Provide initializer macro for elements of the regular modesetting pipeline. These will be used by drivers to integrate mipi-dbi helpers. Also provide initializer macros for the plane formats. As the new helpers are DRM functions, add the drm_ prefix. Mipi-dbi interfaces currently lack this. v3: - fix uninitialized variable (David) - document public interfaces (David) - mention format macros in commit message (David) Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-4-tzimmermann@suse.de commit 7efb8fd7ca37125f01ec568a9e3f0c1548eb06ab Author: Thomas Zimmermann Date: Thu Mar 19 16:59:38 2026 +0100 drm/mipi-dbi: Support custom pipelines with drm_mipi_dbi_dev_init() Initialize the mipi-dbi device with drm_mipi_dbi_dev_init() without creating a modesetting pipeline. Will allow for mipi-dbi drivers without simple-display helpers. As the new helper is a DRM function, add the drm_ prefix. Mipi-dbi interfaces currently lack this. v3: - document tx_buf_size parameter (David) Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-3-tzimmermann@suse.de commit 514c8451fc5829db3f022f0cb9018c06c570261d Author: Thomas Zimmermann Date: Thu Mar 19 16:59:37 2026 +0100 drm/mipi-dbi: Only modify planes on enabled CRTCs Use drm_atomic_helper_commit_tail_rpm() as commit tail to update the plane after enabling the CRTC. Then remove the plane-update code from mipi_dbi_enable_flush() and inline the remaining backlight code where necessary. Mipi-dbi's current commit tail drm_atomic_helper_commit_tail() first updates the plane and then enables the CRTC. But the CRTC enablement includes power management that prevents the initial plane update from working. Hence, each mipi-dbi driver includes a plane update in their CRTC enablement; in the form of mipi_dbi_enable_flush() or custom code. Using drm_atomic_helper_commit_tail_rpm() enables the CRTC before any plane updates. Hence the additional plane update can be removed from mipi_dbi_enable_flush() and a number of drivers. This leaves backlight_enable() in the helper, which can now be inlined into affected drivers. Drivers now enable the CRTC plus an optional backlight and then automatically update the plane. In the case of disabling the display, drm_atomic_helper_commit_tail_rpm() only disables the CRTC without touching the plane at all. Mipi-dbi's mipi_dbi_pipe_disable() already contains the necessary logic. Removing the plane update from the CRTC enablement will also help with converting mipi-dbi from simple-pipe helpers to regular atomic helpers. v3: - st7586: remove unused variable v2: - ili9225: remove unused variables (David) - st7586: remove unused variables (David) Signed-off-by: Thomas Zimmermann Acked-by: David Lechner Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260319160110.109610-2-tzimmermann@suse.de commit 0e2287999f0432b51a54c235db660789ca657f53 Author: Lukas Kraft Date: Thu Mar 12 22:09:52 2026 +0100 leds: lgm-sso: Fix typo in macro for src offset Replace unused argument pinc with used argument pin. Signed-off-by: Lukas Kraft Link: https://patch.msgid.link/20260312210958.48467-1-rebootrequired42@gmail.com Signed-off-by: Lee Jones commit 16fb8d8a0e050e8f151da7dd2e03ccc500dfd8da Author: Henry Tseng Date: Tue Mar 24 17:09:48 2026 +0800 cpufreq: acpi-cpufreq: use DMI max speed when CPPC is unavailable On AMD Ryzen Embedded V1780B (Family 17h, Zen 1), the BIOS does not provide ACPI _CPC objects and the CPU does not support MSR-based CPPC (X86_FEATURE_CPPC). The _PSS table only lists nominal P-states (P0 = 3350 MHz), so when get_max_boost_ratio() fails at cppc_get_perf_caps(), cpuinfo_max_freq reports only the base frequency instead of the rated boost frequency (3600 MHz). dmesg: ACPI CPPC: No CPC descriptor for CPU:0 acpi_cpufreq: CPU0: Unable to get performance capabilities (-19) cppc-cpufreq already has a DMI fallback (cppc_get_dmi_max_khz()) that reads the processor max speed from SMBIOS Type 4. Export it and reuse it in acpi-cpufreq as a last-resort source for the boost frequency. A sanity check ensures the DMI value is above the _PSS P0 frequency and within 2x of it; values outside that range are ignored and the existing arch_set_max_freq_ratio() path is taken instead. The 2x upper bound is based on a survey of the AMD Ryzen Embedded V1000 series, where the highest boost-to-base ratio is 1.8x (V1404I: 2.0 GHz base / 3.6 GHz boost). The DMI lookup and sanity check are wrapped in a helper, acpi_cpufreq_resolve_max_freq(), which falls through to arch_set_max_freq_ratio() if the DMI value is absent or out of range. Tested on AMD Ryzen Embedded V1780B with v7.0-rc4: Before: cpuinfo_max_freq = 3350000 (base only) After: cpuinfo_max_freq = 3600000 (includes boost) Link: https://www.amd.com/en/products/embedded/ryzen/ryzen-v1000-series.html#specifications Signed-off-by: Henry Tseng Link: https://patch.msgid.link/20260324090948.1667340-1-henrytseng@qnap.com Signed-off-by: Rafael J. Wysocki commit 9b776ddcf3236f860f81f12ba10864ce6e237ff9 Author: Ben Horgan Date: Tue Mar 24 11:33:00 2026 +0000 ACPI: PPTT: Remove duplicate structure, acpi_pptt_cache_v1_full acpi_pptt_cache_v1_full was initially added as a stop gap until the equivalent structure imported from ACPICA, acpi_pptt_v1 in actbl2.h, contained all the fields of the Cache Type Structure. Since commit 091c4af3562d ("ACPICA: ACPI 6.4: PPTT: include all fields in subtable type1"), acpi_pptt_v1 contains all these fields making acpi_pptt_cache_v1_full redundant. Remove acpi_pptt_cache_v1_full. No functional change intended. Signed-off-by: Ben Horgan Reviewed-by: Jeremy Linton Reviewed-by: Sudeep Holla [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260324113300.1002569-1-ben.horgan@arm.com Signed-off-by: Rafael J. Wysocki commit f7d9eb0291ef00ebfb4ff4f0bec63536c15a0071 Author: Sheetal Date: Wed Mar 25 10:14:37 2026 +0000 ASoC: tegra: Use dev_err_probe() in tegra_audio_graph_card probe Log errors in the Tegra audio graph card probe path using dev_err_probe(). Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-15-sheetal@nvidia.com Signed-off-by: Mark Brown commit fa11e1cb2b77946c56e690e431193e64a1e06bda Author: Sheetal Date: Wed Mar 25 10:14:36 2026 +0000 ASoC: tegra: Use dev_err_probe() in tegra_asoc_machine probe Log errors in the Tegra ASoC machine driver probe path using dev_err_probe(). Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-14-sheetal@nvidia.com Signed-off-by: Mark Brown commit 856ffd8f4aae227dd008e718dbb1cf7d3474a626 Author: Sheetal Date: Wed Mar 25 10:14:35 2026 +0000 ASoC: tegra: Use dev_err_probe() in tegra210_sfc probe Log errors in the Tegra210 SFC probe path using dev_err_probe(). Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-13-sheetal@nvidia.com Signed-off-by: Mark Brown commit f2067c1dba07e3816c635601a4b21fbc4a44921c Author: Sheetal Date: Wed Mar 25 10:14:34 2026 +0000 ASoC: tegra: Use dev_err_probe() in tegra210_mvc probe Log errors in the Tegra210 MVC probe path using dev_err_probe(). Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-12-sheetal@nvidia.com Signed-off-by: Mark Brown commit 3d027d4b93b9423d106d85cc82a084032fd2635d Author: Sheetal Date: Wed Mar 25 10:14:33 2026 +0000 ASoC: tegra: Use dev_err_probe() in tegra210_mixer probe Log errors in the Tegra210 Mixer probe path using dev_err_probe(). Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-11-sheetal@nvidia.com Signed-off-by: Mark Brown commit 67b7bcdd9798536ffe2f5d77783d83f40d7e6c27 Author: Sheetal Date: Wed Mar 25 10:14:31 2026 +0000 ASoC: tegra: Add error logging in tegra210_i2s driver Log errors in the Tegra210 I2S probe and runtime callback paths. Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-9-sheetal@nvidia.com Signed-off-by: Mark Brown commit ca069c3403ec4ffd1cfbc9a5b274bd9e799a0281 Author: Sheetal Date: Wed Mar 25 10:14:30 2026 +0000 ASoC: tegra: Use dev_err_probe() in tegra210_dmic probe Log errors in the Tegra210 DMIC probe path using dev_err_probe(). Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-8-sheetal@nvidia.com Signed-off-by: Mark Brown commit d310c08db2d80488435e6cef2b42d09bc63f3f43 Author: Sheetal Date: Wed Mar 25 10:14:29 2026 +0000 ASoC: tegra: Add error logging in tegra210_amx driver Log errors in the Tegra210 AMX probe and set_audio_cif paths. Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-7-sheetal@nvidia.com Signed-off-by: Mark Brown commit 802d0d6c25b3aecc51c336ba784aedf75c592512 Author: Sheetal Date: Wed Mar 25 10:14:28 2026 +0000 ASoC: tegra: Use dev_err_probe() in tegra210_ahub probe Log errors in the Tegra210 AHUB probe path using dev_err_probe(). Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-6-sheetal@nvidia.com Signed-off-by: Mark Brown commit 50e51b84a4b38f2dbffe48e16aef5e0568cc14e9 Author: Sheetal Date: Wed Mar 25 10:14:27 2026 +0000 ASoC: tegra: Add error logging in tegra210_adx driver Log errors in the Tegra210 ADX probe and set_audio_cif paths. Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-5-sheetal@nvidia.com Signed-off-by: Mark Brown commit 6205ca05227f26721b8d5920d976ecae6f8ce83e Author: Sheetal Date: Wed Mar 25 10:14:25 2026 +0000 ASoC: tegra: Use dev_err_probe() in tegra186_dspk probe Log errors in the Tegra186 DSPK probe path using dev_err_probe(). Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-3-sheetal@nvidia.com Signed-off-by: Mark Brown commit 884f3101d1edb2bff463a1a4bae162ab011fe73f Author: Sheetal Date: Wed Mar 25 10:14:24 2026 +0000 ASoC: tegra: Use dev_err_probe() in tegra186_asrc probe Log errors in the Tegra186 ASRC probe path using dev_err_probe(). Signed-off-by: Sheetal Link: https://patch.msgid.link/20260325101437.3059693-2-sheetal@nvidia.com Signed-off-by: Mark Brown commit 630bbba45cfd3e4f9247cefd3e2cdc03fe40421b Author: Christoph Böhmwalder Date: Tue Mar 24 16:29:07 2026 +0100 drbd: use genl pre_doit/post_doit Every doit handler followed the same pattern: stack-allocate an adm_ctx, call drbd_adm_prepare() at the top, call drbd_adm_finish() at the bottom. This duplicated boilerplate across 25 handlers and made error paths inconsistent, since some handlers could miss sending the reply skb on early-exit paths. The generic netlink framework already provides pre_doit/post_doit hooks for exactly this purpose. An old comment even noted "this would be a good candidate for a pre_doit hook". Use them: - pre_doit heap-allocates adm_ctx, looks up per-command flags from a new drbd_genl_cmd_flags[] table, runs drbd_adm_prepare(), and stores the context in info->user_ptr[0]. - post_doit sends the reply, drops kref references for device/connection/resource, and frees the adm_ctx. - Handlers just receive adm_ctx from info->user_ptr[0], set reply_dh->ret_code, and return. All teardown is in post_doit. - drbd_adm_finish() is removed, superseded by post_doit. Signed-off-by: Christoph Böhmwalder Link: https://patch.msgid.link/20260324152907.2840984-1-christoph.boehmwalder@linbit.com Signed-off-by: Jens Axboe commit d84b087c7662dd65cd51b228219987c31b1cee02 Author: Damon Ding Date: Mon Nov 10 16:58:23 2025 +0800 drm/bridge: analogix_dp: Apply DP helper APIs to get adjusted voltages and pre-emphasises Replace analogix_dp_get_adjust_request_voltage() and analogix_dp_get_adjust_request_pre_emphasis() with existing DP helper APIs with the same function. Signed-off-by: Damon Ding Tested-by: Marek Szyprowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20251110085823.1197472-5-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli commit 51eb548ade20158b4f4f8693a95b1f31a2480e8e Author: Damon Ding Date: Mon Nov 10 16:58:22 2025 +0800 drm/bridge: analogix_dp: Apply DP helper API drm_dp_channel_eq_ok() Use existing DP helper API instead of analogix_dp_channel_eq_ok() with the same function. In addtion, remove unused function analogix_dp_get_lane_status() Signed-off-by: Damon Ding Tested-by: Marek Szyprowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20251110085823.1197472-4-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli commit e0735bfd5dd1987d4849c331a2ef0194694a3c5f Author: Damon Ding Date: Mon Nov 10 16:58:21 2025 +0800 drm/bridge: analogix_dp: Apply DP helper API drm_dp_clock_recovery_ok() Use existing DP helper API instead of analogix_dp_clock_recovery_ok() with the same function. Signed-off-by: Damon Ding Tested-by: Marek Szyprowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20251110085823.1197472-3-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli commit b97a424b09b33cbec216706a84006fae6ed7084d Author: Damon Ding Date: Mon Nov 10 16:58:20 2025 +0800 drm/bridge: analogix_dp: Apply DP helper API drm_dp_dpcd_read_link_status() Use existing DP helper API to read link status related DPCDs. Signed-off-by: Damon Ding Tested-by: Marek Szyprowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20251110085823.1197472-2-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli commit 829def1e35ca3a6ef07d53d47089ef7cff0fd127 Author: Christoph Hellwig Date: Mon Mar 23 08:11:50 2026 +0100 zloop: forget write cache on force removal Add a new options that causes zloop to truncate the zone files to the write pointer value recorded at the last cache flush to simulate unclean shutdowns. Signed-off-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Damien Le Moal Reviewed-by: Martin K. Petersen Link: https://patch.msgid.link/20260323071156.2940772-3-hch@lst.de Signed-off-by: Jens Axboe commit eff8d1656e83d186fdf9dd3ad0f229088440e4c6 Author: Christoph Hellwig Date: Mon Mar 23 08:11:49 2026 +0100 zloop: refactor zloop_rw Split out two helpers functions to make the function more readable and to avoid conditional locking. Signed-off-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Damien Le Moal Reviewed-by: Martin K. Petersen Link: https://patch.msgid.link/20260323071156.2940772-2-hch@lst.de Signed-off-by: Jens Axboe commit 3cef6765b75eee653a40f300a0f6f5de66e8c97d Author: Svyatoslav Ryhel Date: Thu Mar 12 10:52:57 2026 +0200 dt-bindings: mfd: max77620: Document optional RTC address for MAX77663 Document an optional second I2C address for the MAX77663 PMIC's RTC device, to be used if the MAX77663 RTC is located at a non-default I2C address. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260312085258.11431-5-clamor95@gmail.com Signed-off-by: Lee Jones commit 4370650b6fdbb1bdc5762916ce08f6b2062c4fd1 Author: Svyatoslav Ryhel Date: Thu Mar 12 10:52:56 2026 +0200 dt-bindings: mfd: max77620: Convert to DT schema Convert max77620 Device Tree bindings from TXT to YAML format. This patch does not change any functionality; the bindings remain the same. The thermal bindings are incorporated into the binding. GPIO controller function in MAX77620 has no dedicated node and is folded into the parent node itself. Signed-off-by: Svyatoslav Ryhel Acked-by: Daniel Lezcano Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260312085258.11431-4-clamor95@gmail.com Signed-off-by: Lee Jones commit 30eedf2446a9ada57a6bda22ec6b89533feb81ed Author: Krzysztof Kozlowski Date: Thu Mar 5 22:45:48 2026 +0100 mfd: ezx-pcap: Avoid rescheduling after destroying workqueue Driver allocates workqueue and then registers additional interrupt handler with devm interface. This means that device removal will not use a reversed order, but first destroy workqueue and then, via devm release handlers, free the interrupt. The interrupt handler registered with devm does not directly use/schedule work items on the workqueue and the remove() function correctly removes other IRQs handlers, however the code mixing devm and non-devm interfaces is difficult to analyze and read. Make the code flow much more obvious by using devm interface for allocating the workqueue, so it will be freed with the rest of devm resources. Change is not equivalent in the workqueue itself: use non-legacy API which does not set (__WQ_LEGACY | WQ_MEM_RECLAIM). The workqueue is used to update device registers, thus there is no point to run it for memory reclaim. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260305-workqueue-devm-v2-9-66a38741c652@oss.qualcomm.com Signed-off-by: Lee Jones commit ef5a54c542f5388df3f142a84de642d33790bd7b Author: Krzysztof Kozlowski Date: Thu Mar 5 22:45:47 2026 +0100 mfd: ezx-pcap: Return directly instead of empty gotos Code is easier to read if empty error paths simply return, instead of jumping to empty label doing only "return ret". Signed-off-by: Krzysztof Kozlowski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260305-workqueue-devm-v2-8-66a38741c652@oss.qualcomm.com Signed-off-by: Lee Jones commit fa9ccb6b7fb4c5ac50613d1412a273a2031dcd2b Author: Krzysztof Kozlowski Date: Thu Mar 5 22:45:46 2026 +0100 mfd: ezx-pcap: Drop memory allocation error message Drivers should not print error messages on memory allocation failures, because core already does it. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260305-workqueue-devm-v2-7-66a38741c652@oss.qualcomm.com Signed-off-by: Lee Jones commit 44fb5d7b9db755e5dd3e9fd1dd09c2db0853c00f Author: Phil Elwell Date: Sat Mar 7 00:41:22 2026 +0100 mfd: bcm2835-pm: Add BCM2712 PM device support The BCM2712 SoC includes a power management block that serves as the power domain for the V3D graphics block. Unlike other PM blocks in the BCM2835 family, it does not feature an ASB register space. Conditionally register the PM device depending on the SoC variant. Signed-off-by: Phil Elwell Co-developed-by: Stanimir Varbanov Signed-off-by: Stanimir Varbanov Signed-off-by: Andrea della Porta Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/c0b5793868f138bf5c928a12b2763d3e183e2e59.1772839224.git.andrea.porta@suse.com Signed-off-by: Lee Jones commit fe0e422cbcf4b7ee35cacc463631092b310a6f6a Author: Phil Elwell Date: Sat Mar 7 00:41:21 2026 +0100 mfd: bcm2835-pm: Introduce SoC-specific type identifier Power management blocks across the BCM2835 family share a common base but require variant-specific handling. For instance, the BCM2712 lacks ASB register space, yet it manages the power domain for the V3D graphics block. Add a hardware type identifier to the driver's private data. This allows the driver to distinguish between SoC models and implement custom quirks or features as needed. Signed-off-by: Phil Elwell Co-developed-by: Stanimir Varbanov Signed-off-by: Stanimir Varbanov Signed-off-by: Andrea della Porta Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/c4bb218654e91f312a01b419d3d408e5131f7673.1772839224.git.andrea.porta@suse.com Signed-off-by: Lee Jones commit c7be85a3cd5c918b0fe8977b3f2ac410eb212a0f Author: Matti Vaittinen Date: Tue Feb 24 15:11:12 2026 +0200 dt-bindings: mfd: bd72720: Add ROHM BD73900 The ROHM BD79300 is almost identical to the BD72720. Main differences are the initial values for some of the registers. Thus, it appears the BD79300 can be handled with same software as BD72720. Adding the compatible for the BD79300 enables people to use the real IC type in the device-tree instead of claiming it is BD72720. This does also help differentiating the ICs if appears it is needed. Add own compatible for the BD73900 and mark BD72720 as a fall-back. Signed-off-by: Matti Vaittinen Acked-by: Conor Dooley Link: https://patch.msgid.link/6eaa9f08848c27c462e156e31ae5bdfd33bf2fe7.1771938507.git.mazziesaccount@gmail.com Signed-off-by: Lee Jones commit 92601fb9d8f61db2ea254965722e379f53d111b5 Author: Randy Dunlap Date: Mon Mar 9 14:42:23 2026 -0700 mfd: si476x: Fix kernel-doc warnings Add kernel-doc entries for missing fields or correct some typos in names to eliminate kernel-doc warnings: Warning: include/linux/mfd/si476x-core.h:156 struct member 'regmap' not described in 'si476x_core' Warning: include/linux/mfd/si476x-core.h:156 struct member 'power_state' not described in 'si476x_core' Warning: include/linux/mfd/si476x-core.h:156 struct member 'supplies' not described in 'si476x_core' Warning: include/linux/mfd/si476x-core.h:156 struct member 'is_alive' not described in 'si476x_core' Warning: include/linux/mfd/si476x-core.h:156 struct member 'rds_fifo_depth' not described in 'si476x_core' Warning: include/linux/mfd/si476x-core.h:170 function parameter 'core' not described in 'si476x_core_lock' Warning: include/linux/mfd/si476x-core.h:179 function parameter 'core' not described in 'si476x_core_unlock' Warning: include/linux/mfd/si476x-core.h:259 struct member 'firmware' not described in 'si476x_func_info' Warning: include/linux/mfd/si476x-core.h:335 struct member 'rds' not described in 'si476x_rds_status_report' I don't know what the 'ble' field is so I didn't add a kernel-doc comment for it: Warning: include/linux/mfd/si476x-core.h:335 struct member 'ble' not described in 'si476x_rds_status_report' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260309214223.749088-5-rdunlap@infradead.org Signed-off-by: Lee Jones commit 5671125a129e97bdd634cf74137cf109d4420a0b Author: Randy Dunlap Date: Mon Mar 9 14:42:22 2026 -0700 mfd: rsmu: Remove a empty kernel-doc line kernel-doc format expects a prototype on the line that immediately follows the "/**" line, so drop this empty line. Warning: include/linux/mfd/rsmu.h:21 Cannot find identifier on line: * Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260309214223.749088-4-rdunlap@infradead.org Signed-off-by: Lee Jones commit 69d7fa1b918d0aa0157aef5f71f757916194f099 Author: Randy Dunlap Date: Mon Mar 9 14:42:21 2026 -0700 mfd: kempld: Fix kernel-doc struct member names Correct the struct member names to avoid kernel-doc warnings: Warning: include/linux/mfd/kempld.h:114 struct member 'gpio_base' not described in 'kempld_platform_data' Warning: include/linux/mfd/kempld.h:114 struct member 'get_hardware_mutex' not described in 'kempld_platform_data' Warning: include/linux/mfd/kempld.h:114 struct member 'release_hardware_mutex' not described in 'kempld_platform_data' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260309214223.749088-3-rdunlap@infradead.org Signed-off-by: Lee Jones commit ee63402eb41a4ffcac72490b3e93de606de8d394 Author: Randy Dunlap Date: Mon Mar 9 14:42:20 2026 -0700 mfd: congatec: Fix kernel-doc struct member names Correct the struct member names to avoid kernel-doc warnings: Warning: include/linux/mfd/cgbc.h:38 struct member 'version' not described in 'cgbc_device_data' Warning: ../include/linux/mfd/cgbc.h:38 struct member 'lock' not described in 'cgbc_device_data' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260309214223.749088-2-rdunlap@infradead.org Signed-off-by: Lee Jones commit 47a069a5de0eb33da04d6672659b587df416f27b Author: Frank Li Date: Wed Feb 11 16:41:05 2026 -0500 dt-bindings: mfd: Convert fsl-imx25-tsadc.txt to yaml format Convert fsl-imx25-tsadc.txt to yaml format. Additional changes: - Add ranges. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260211-yaml_mfd-v1-2-05cb48bc6f09@nxp.com Signed-off-by: Lee Jones commit 1a408a67788867222e9a18910d582e534523c7d3 Author: Johan Hovold Date: Thu Mar 5 11:40:51 2026 +0100 mfd: viperboard: Drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305104051.15727-1-johan@kernel.org Signed-off-by: Lee Jones commit a2753f06e3e448023280189ca3ebd1b46d427263 Author: Subhash Rawat Date: Tue Mar 3 18:32:36 2026 +0000 mfd: dln2: Switch to managed resources and fix bare unsigned types Convert dln2_probe and dln2_setup_rx_urbs to use devm_kzalloc() and devm_kmalloc() respectively. This simplifies resource management by allowing the removal of manual kfree() calls in dln2_free() and dln2_free_rx_urbs(). Additionally, update bare 'unsigned' types to 'unsigned int' to satisfy checkpatch.pl warnings and comply with the Linux kernel coding style. Signed-off-by: Subhash Rawat Link: https://patch.msgid.link/20260303183236.574940-1-rawatsubhash02@gmail.com Signed-off-by: Lee Jones commit 9abc081c94269738ba3d4a0ae09d55a544b3afa7 Author: Hector Martin Date: Tue Feb 17 21:47:26 2026 +1100 mfd: macsmc: Wire up Apple SMC power driver Add the cell for the macsmc-power driver so it is probed by the MFD core. Signed-off-by: Hector Martin Reviewed-by: Neal Gompa Reviewed-by: Sven Peter Signed-off-by: Michael Reeves Link: https://patch.msgid.link/20260217-b4-macsmc-power-v7-2-4a4d63664362@gmail.com Signed-off-by: Lee Jones commit a09506820afa391e0a8ecc4b05c954f21e50b1de Author: Akari Tsuyukusa Date: Mon Mar 2 23:00:45 2026 +0900 mfd: mt6397: Properly fix CID of MT6328, MT6331 and MT6332 CIDs set for MT6328, MT6331 and MT6332 are not appropriate. Many Android downstream kernels define CID as below, MT6328: #define PMIC6328_E1_CID_CODE 0x2810 #define PMIC6328_E2_CID_CODE 0x2820 #define PMIC6328_E3_CID_CODE 0x2830 MT6331/MT6332: #define PMIC6331_E1_CID_CODE 0x3110 #define PMIC6331_E2_CID_CODE 0x3120 #define PMIC6331_E3_CID_CODE 0x3130 #define PMIC6332_E1_CID_CODE 0x3210 #define PMIC6332_E2_CID_CODE 0x3220 #define PMIC6332_E3_CID_CODE 0x3230 The current configuration incorrectly uses the revision code as the CID. Therefore, the driver cannot detect the same PMIC of different revisions. (E1/E2 for MT6328, E1/E3 for MT6331/MT6332) Based on these, the CID of MT6328, MT6331 and MT6332 should be corrected. Additionally, the incorrect MT6331/MT6332 CID overlaps with the MT6320's actual CID: #define PMIC6320_E1_CID_CODE 0x1020 #define PMIC6320_E2_CID_CODE 0x2020 This causes a conflict in the switch-case statement of mt6397-irq.c, this prevents adding support for MT6320. Signed-off-by: Akari Tsuyukusa Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20260302140045.651727-1-akkun11.open@gmail.com Signed-off-by: Lee Jones commit 0995118d864b4b35d9aa576fdbdb03ddbdd0c701 Author: Guodong Xu Date: Fri Feb 6 10:32:02 2026 +0800 dt-bindings: mfd: spacemit,p1: Add individual regulator supply properties Add supply properties that match the P1 PMIC's actual hardware topology where each buck converter has its own VIN pin and LDO groups share common input pins. Supply names are defined according to the pinout names in the P1 datasheet. The existing "vin-supply" is dropped from the binding document as the updated spacemit P1 driver no longer parses it. Only the per-rail names ("vin1-supply", "vin2-supply", ...) are supported. Signed-off-by: Guodong Xu Acked-by: Conor Dooley Reviewed-by: Alex Elder Link: https://patch.msgid.link/20260206-spacemit-p1-v4-1-8f695d93811e@riscstar.com Signed-off-by: Lee Jones commit 0735e3007c1be6cb40372c403a69200d0929c8d7 Author: Bartosz Golaszewski Date: Wed Feb 18 11:48:01 2026 +0100 mfd: lpc_ich: Expose the GPIO controller cell's software node One of the users of this driver - meraki-mx100 - abuses the software node API by setting up a dummy software node without any logical link to this GPIO controller and uses the fact that the GPIO core matches the controller's label against the swnode's name to make the lookup work. We want to remove this behavior from GPIOLIB in favor of actual matching of firmware nodes but that would break this user. To facilitate that: create a software node for the GPIO controller cell and expose its address in the provided MFD header. Signed-off-by: Bartosz Golaszewski Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20260218-meraki-swnodes-v2-1-92c521da241c@oss.qualcomm.com Signed-off-by: Lee Jones commit 239cd6a417b989708da4b39a71f925897ec87287 Author: Manikandan Muralidharan Date: Mon Feb 23 15:49:17 2026 +0530 mfd: atmel-hlcdc: Fetch LVDS PLL clock for LVDS display The XLCDC IP supports parallel RGB, MIPI DSI and LVDS Display. The LCD Generic clock (sys_clk) is used for Parallel RGB and MIPI displays, while the LVDS PLL clock (lvds_pll_clk) is used for LVDS displays.Since both the clocks cannot co-exist together in the DT for a given display, this patch tries sys_clk first (RGB/MIPI), fallback to lvds_pll_clk (LVDS). Signed-off-by: Manikandan Muralidharan Signed-off-by: Dharma Balasubiramani Link: https://patch.msgid.link/20260223101920.284697-2-manikandan.m@microchip.com Signed-off-by: Lee Jones commit c2b06b133c667f46cc7fe81c7df2b6650c74f9c0 Author: Johan Hovold Date: Thu Mar 5 14:03:58 2026 +0100 mfd: dln2: Drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305130358.24681-1-johan@kernel.org Signed-off-by: Lee Jones commit f385ec3259b387e55c8c0c7933813a5ce14374d5 Author: Krzysztof Kozlowski Date: Mon Feb 16 12:04:33 2026 +0100 mfd: max77705: Make max77705_pm_ops variable static File-scope 'max77705_pm_ops' is not used outside of this unit, so make it static to silence sparse warning: max77705.c:160:1: warning: symbol 'max77705_pm_ops' was not declared. Should it be static? Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260216110432.160084-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Lee Jones commit eaa0a41774e7603451a7cd8d480de6374dbbb15d Author: Andreas Kemnade Date: Fri Feb 6 10:37:57 2026 +0100 mfd: rohm-bd71828: Enable wakeup via power button It is normally expected to get out of deeper power saving states by pressing the power button, so enable wakeup for it. Signed-off-by: Andreas Kemnade Acked-by: Matti Vaittinen Link: https://patch.msgid.link/20260206093757.573377-1-andreas@kemnade.info Signed-off-by: Lee Jones commit ffdc5c51f8bcd0e5e8255ca275a0a3b958475d99 Author: Marek Vasut Date: Thu Jan 22 12:13:21 2026 +0100 mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Attempt to shut down again, in case the first attempt failed. The STPMIC1 might get confused and the first regmap_update_bits() returns with -ETIMEDOUT / -110 . If that or similar transient failure occurs, try to shut down again. If the second attempt fails, there is some bigger problem, report it to user. Cc: stable@vger.kernel.org Fixes: 6e9df38f359a ("mfd: stpmic1: Add PMIC poweroff via sys-off handler") Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260122111423.62591-1-marex@nabladev.com Signed-off-by: Lee Jones commit a5a65a7fb2f7796bbe492cd6be59c92cb64377d1 Author: Abdun Nihaal Date: Tue Jan 20 15:56:20 2026 +0530 mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() The memory allocated for cell.name using kmemdup() is not freed when mfd_add_devices() fails. Fix that by using devm_kmemdup(). Fixes: 8e00593557c3 ("mfd: Add mc13892 support to mc13xxx") Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20260120102622.66921-1-nihaal@cse.iitm.ac.in Signed-off-by: Lee Jones commit 67cb50aee082842077a8404337dc21b7d03829d7 Author: Kexin Sun Date: Sat Mar 21 18:57:59 2026 +0800 iommufd: update outdated comment for renamed iommufd_hw_pagetable_alloc() The function iommufd_hw_pagetable_alloc() was renamed to iommufd_hwpt_paging_alloc() by commit 89db31635c87 ("iommufd: Derive iommufd_hwpt_paging from iommufd_hw_pagetable"). Update the stale reference in iommufd_device_auto_get_domain(). Link: https://patch.msgid.link/r/20260321105759.6832-1-kexinsun@smail.nju.edu.cn Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Signed-off-by: Jason Gunthorpe commit 6256628ee819ef28c811e9e86ada2988f5681f95 Author: Krzysztof Kozlowski Date: Wed Mar 25 12:08:51 2026 +0100 ASoC: dt-bindings: mediatek: Adjust style of blocks placement Convention expressed in example-schema.yaml is to place "unevaluatedProperties" part just before example. No functional change. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260325110849.127051-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown commit e0390dc08f1fca9bfd25b7567e794f7a332703bc Author: Krzysztof Kozlowski Date: Wed Mar 25 12:08:50 2026 +0100 ASoC: dt-bindings: mediatek,mt2701-wm8960: Correctly use additionalProperties The binding does not reference any other schema, thus should use "additionalProperties: false" to disallow any undocumented properties. Correct the code and place this after "required:" block to match convention expressed in example-schema.yaml. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260325110849.127051-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown commit dcc99abebfa1e9ca70f8af8695b6682ad7597bf2 Author: Thomas Weißschuh Date: Mon Mar 16 17:52:02 2026 +0100 kbuild: uapi: also test UAPI headers against C++ compilers C++ language requirements differ from those of C. Also test the headers against C++ compilers to make sure no errors creep in accidentally. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260316-kbuild-uapi-c-v2-5-35d6d0ed863f@weissschuh.net Signed-off-by: Nicolas Schier commit b187c1a1a0513593663b1adee0340d41d833d16d Author: Thomas Weißschuh Date: Mon Mar 16 17:52:01 2026 +0100 kbuild: uapi: provide a C++ compatible dummy definition of NULL NULL works differently in C++ compared to C. To allow testing the UAPI headers against C++ compilers, provide a variant of NULL which works with those. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260316-kbuild-uapi-c-v2-4-35d6d0ed863f@weissschuh.net Signed-off-by: Nicolas Schier commit b4ec38cb739e9419ddb7310f6c49fb6d7bc39c1d Author: Thomas Weißschuh Date: Mon Mar 16 17:52:00 2026 +0100 kbuild: uapi: handle UML in architecture-specific exclusion lists When building User Mode Linux SRCARCH is set to 'um', while the actual underlying architecture is provided in HEADER_ARCH. Allow the exclusion lists to work on UML by comparing against HEADER_ARCH when that is available. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260316-kbuild-uapi-c-v2-3-35d6d0ed863f@weissschuh.net Signed-off-by: Nicolas Schier commit cf822413093e4fdf17ce12f10f3983b1d5f8b659 Author: Thomas Weißschuh Date: Mon Mar 16 17:51:59 2026 +0100 kbuild: uapi: move all include path flags together The argument to add the root of the UAPI header tree to the include path is separated from the other arguments concerning the include path. Move all include path arguments together for more consistency and balanced line lengths. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260316-kbuild-uapi-c-v2-2-35d6d0ed863f@weissschuh.net Signed-off-by: Nicolas Schier commit 55d68ec5b9ba004764acaa3291871513102b4fd4 Author: Thomas Weißschuh Date: Mon Mar 16 17:51:58 2026 +0100 kbuild: uapi: move some compiler arguments out of the command definition Simplify the definition of cmd_hdrtest by moving some of it to a new variable. This will both enable the upcoming reuse of those flags and also the extension of cmd_hdrtest. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260316-kbuild-uapi-c-v2-1-35d6d0ed863f@weissschuh.net Signed-off-by: Nicolas Schier commit e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d Author: Jan Kara Date: Fri Feb 27 14:22:16 2026 +0100 quota: Fix race of dquot_scan_active() with quota deactivation dquot_scan_active() can race with quota deactivation in quota_release_workfn() like: CPU0 (quota_release_workfn) CPU1 (dquot_scan_active) ============================== ============================== spin_lock(&dq_list_lock); list_replace_init( &releasing_dquots, &rls_head); /* dquot X on rls_head, dq_count == 0, DQ_ACTIVE_B still set */ spin_unlock(&dq_list_lock); synchronize_srcu(&dquot_srcu); spin_lock(&dq_list_lock); list_for_each_entry(dquot, &inuse_list, dq_inuse) { /* finds dquot X */ dquot_active(X) -> true atomic_inc(&X->dq_count); } spin_unlock(&dq_list_lock); spin_lock(&dq_list_lock); dquot = list_first_entry(&rls_head); WARN_ON_ONCE(atomic_read(&dquot->dq_count)); The problem is not only a cosmetic one as under memory pressure the caller of dquot_scan_active() can end up working on freed dquot. Fix the problem by making sure the dquot is removed from releasing list when we acquire a reference to it. Fixes: 869b6ea1609f ("quota: Fix slow quotaoff") Reported-by: Sam Sun Link: https://lore.kernel.org/all/CAEkJfYPTt3uP1vAYnQ5V2ZWn5O9PLhhGi5HbOcAzyP9vbXyjeg@mail.gmail.com Signed-off-by: Jan Kara commit cebf747abeebbde96a43ddd646d14b55a72673a7 Author: Alexander Koskovich Date: Tue Mar 24 11:48:49 2026 +0000 drm/msm/dsi: Add support for RGB101010 pixel format Add video and command mode destination format mappings for RGB101010, and extend the VID_CFG0 DST_FORMAT bitfield to 3 bits to accommodate the new format value. Make sure this is guarded behind MSM_DSI_6G_VER >= V2.1.0 as anything older does not support this. Required for 10 bit panels such as the BOE BF068MWM-TD0 found on the Nothing Phone (3a). Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Alexander Koskovich Patchwork: https://patchwork.freedesktop.org/patch/713721/ Link: https://lore.kernel.org/r/20260324-dsi-rgb101010-support-v5-5-ff6afc904115@pm.me Signed-off-by: Dmitry Baryshkov commit a65c4d30988e81e7291063f9c473f50ad1e715a1 Author: Alexander Koskovich Date: Tue Mar 24 11:48:38 2026 +0000 drm/msm/dsi: add DSI version >= comparison helper Add a helper for checking if the DSI hardware version is greater than or equal to a given version, for use in a future change. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Alexander Koskovich Patchwork: https://patchwork.freedesktop.org/patch/713719/ Link: https://lore.kernel.org/r/20260324-dsi-rgb101010-support-v5-4-ff6afc904115@pm.me Signed-off-by: Dmitry Baryshkov commit 913a709dea0eff9c7b2e9470f8c8594b9a0114ab Author: Alexander Koskovich Date: Tue Mar 24 11:48:27 2026 +0000 drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 The MSM8998 DSI controller is v2.0.0 as stated in commit 7b8c9e203039 ("drm/msm/dsi: Add support for MSM8998 DSI controller"). The value was always correct just the name was wrong. Rename and reorder to maintain version sorting. Fixes: 7b8c9e203039 ("drm/msm/dsi: Add support for MSM8998 DSI controller") Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Alexander Koskovich Patchwork: https://patchwork.freedesktop.org/patch/713717/ Link: https://lore.kernel.org/r/20260324-dsi-rgb101010-support-v5-3-ff6afc904115@pm.me Signed-off-by: Dmitry Baryshkov commit a780b7f6c8e52c3adb7dd63b1bbbbfae0f3e86c6 Author: Alexander Koskovich Date: Tue Mar 24 11:48:17 2026 +0000 drm/meson: use default case for unsupported DSI pixel formats Use default instead of listing unsupported formats explicitly, so the switch statements don't need updating each time a new pixel format is added. Reviewed-by: Neil Armstrong Signed-off-by: Alexander Koskovich Patchwork: https://patchwork.freedesktop.org/patch/713715/ Link: https://lore.kernel.org/r/20260324-dsi-rgb101010-support-v5-2-ff6afc904115@pm.me Acked-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov commit b50dc1e54750a18265e7e465de38cd1c3c5ea543 Author: Alexander Koskovich Date: Tue Mar 24 11:48:09 2026 +0000 drm/mipi-dsi: add RGB101010 pixel format Add MIPI_DSI_FMT_RGB101010 for 30 bit (10,10,10 RGB) pixel format, corresponding to the packed 30 bit pixel stream defined in MIPI DSI v1.3 Section 8.8.17. Reviewed-by: Dmitry Baryshkov Signed-off-by: Alexander Koskovich Patchwork: https://patchwork.freedesktop.org/patch/713714/ Link: https://lore.kernel.org/r/20260324-dsi-rgb101010-support-v5-1-ff6afc904115@pm.me [Acked by Maxime to be merged through msm-next on IRC on dri-devel] [DB: moved RGB101010 to the end of enum mipi_dsi_pixel_format] Signed-off-by: Dmitry Baryshkov commit 05d09e7f28c8f6e39c54d79fd96643f6faf5dbee Author: Damon Ding Date: Tue Nov 11 10:21:03 2025 +0800 drm/bridge: analogix_dp: Reuse &link_train.training_lane[] to set DPCD DP_TRAINING_LANEx_SET In analogix_dp_link_start(), &link_train.training_lane[] is used to set phy PE/VS configurations, and buf[] is initialized with the same values to set DPCD DP_TRAINING_LANEx_SET. It makes sense to reuse &link_train.training_lane[] to set DPCD DP_TRAINING_LANEx_SET, which can remove the redundant assignments and make codes more concise. Signed-off-by: Damon Ding Tested-by: Marek Szyprowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20251111022103.1350183-1-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli commit aec6969f75afbf4e01fd5fb5850ed3e9c27043ac Author: Matthew Auld Date: Wed Mar 18 10:02:09 2026 +0000 drm/xe: always keep track of remap prev/next During 3D workload, user is reporting hitting: [ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe], CPU#7: vkd3d_queue/9925 [ 413.361944] CPU: 7 UID: 1000 PID: 9925 Comm: vkd3d_queue Kdump: loaded Not tainted 7.0.0-070000rc3-generic #202603090038 PREEMPT(lazy) [ 413.361949] RIP: 0010:vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe] [ 413.362074] RSP: 0018:ffffd4c25c3df930 EFLAGS: 00010282 [ 413.362077] RAX: 0000000000000000 RBX: ffff8f3ee817ed10 RCX: 0000000000000000 [ 413.362078] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 413.362079] RBP: ffffd4c25c3df980 R08: 0000000000000000 R09: 0000000000000000 [ 413.362081] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8f41fbf99380 [ 413.362082] R13: ffff8f3ee817e968 R14: 00000000ffffffef R15: ffff8f43d00bd380 [ 413.362083] FS: 00000001040ff6c0(0000) GS:ffff8f4696d89000(0000) knlGS:00000000330b0000 [ 413.362085] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 413.362086] CR2: 00007ddfc4747000 CR3: 00000002e6262005 CR4: 0000000000f72ef0 [ 413.362088] PKRU: 55555554 [ 413.362089] Call Trace: [ 413.362092] [ 413.362096] xe_vm_bind_ioctl+0xa9a/0xc60 [xe] Which seems to hint that the vma we are re-inserting for the ops unwind is either invalid or overlapping with something already inserted in the vm. It shouldn't be invalid since this is a re-insertion, so must have worked before. Leaving the likely culprit as something already placed where we want to insert the vma. Following from that, for the case where we do something like a rebind in the middle of a vma, and one or both mapped ends are already compatible, we skip doing the rebind of those vma and set next/prev to NULL. As well as then adjust the original unmap va range, to avoid unmapping the ends. However, if we trigger the unwind path, we end up with three va, with the two ends never being removed and the original va range in the middle still being the shrunken size. If this occurs, one failure mode is when another unwind op needs to interact with that range, which can happen with a vector of binds. For example, if we need to re-insert something in place of the original va. In this case the va is still the shrunken version, so when removing it and then doing a re-insert it can overlap with the ends, which were never removed, triggering a warning like above, plus leaving the vm in a bad state. With that, we need two things here: 1) Stop nuking the prev/next tracking for the skip cases. Instead relying on checking for skip prev/next, where needed. That way on the unwind path, we now correctly remove both ends. 2) Undo the unmap va shrinkage, on the unwind path. With the two ends now removed the unmap va should expand back to the original size again, before re-insertion. v2: - Update the explanation in the commit message, based on an actual IGT of triggering this issue, rather than conjecture. - Also undo the unmap shrinkage, for the skip case. With the two ends now removed, the original unmap va range should expand back to the original range. v3: - Track the old start/range separately. vma_size/start() uses the va info directly. Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7602 Fixes: 8f33b4f054fc ("drm/xe: Avoid doing rebinds") Signed-off-by: Matthew Auld Cc: Matthew Brost Cc: # v6.8+ Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260318100208.78097-2-matthew.auld@intel.com commit 541c5b0837468b433e238c3a14481f939ec978a3 Merge: 7803501e5754dc 7671f4949a6c91 Author: Bartosz Golaszewski Date: Wed Mar 25 11:23:06 2026 +0100 Merge branch 'ib-scmi-pinctrl-gpio' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl into gpio/for-next Pull in the SCMI GPIO driver along with its pinctrl dependencies. commit 09808839c7aa6695ceff5cd822c18b0d9550184d Author: Antonio Hickey Date: Thu Mar 19 10:35:28 2026 +0100 rust: pin-init: replace `addr_of_mut!` with `&raw mut` `feature(raw_ref_op)` became stable in Rust 1.82.0 which is the current MSRV of pin-init with no default features. Earlier Rust versions will now need to enable `raw_ref_op` to continue to work with pin-init. This reduces visual complexity and improves consistency with existing reference syntax. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1148 Closes: https://github.com/Rust-for-Linux/pin-init/issues/99 Signed-off-by: Antonio Hickey Link: https://github.com/Rust-for-Linux/pin-init/commit/e27763004e2f6616b089437fbe9b3719cd72bd5c [ Reworded commit message. - Benno ] Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260319093542.3756606-6-lossin@kernel.org Signed-off-by: Benno Lossin commit aa9ec9460dd5c09849e09c3fac8f4286d2dc0312 Author: Hamdan-Khan Date: Thu Mar 19 10:35:27 2026 +0100 rust: pin-init: implement ZeroableOption for NonZero* integer types Add a macro for implementing `ZeroableOption` for `NonZero*` types. `Option` now automatically implements `Zeroable` trait by implementing `ZeroableOption` for `NonZero*` types, which serves as a blanket impl. Closes: https://github.com/Rust-for-Linux/pin-init/issues/95 Signed-off-by: Hamdan-Khan Link: https://github.com/Rust-for-Linux/pin-init/commit/74f772641cd9670848fa360f4ebfd20fdb40bf78 [ Fixed a typo in the commit message. - Benno ] Link: https://patch.msgid.link/20260319093542.3756606-5-lossin@kernel.org Signed-off-by: Benno Lossin commit 44f6fa0dced7babfbfd08683fe376b0c72ebbec7 Author: Gary Guo Date: Thu Mar 19 10:35:26 2026 +0100 rust: pin-init: doc: de-clutter documentation with fake-variadics Currently the doc for `Zeroable` and `ZeroableOption` are filled with the generated impl of tuples and fn pointers. Use the internal "fake_variadics" feature to improve the rendered quality. This makes use of an internal feature, however this is of minimal risk as it's for documentation only, not activated during normal build, gated behind `USE_RUSTC_FEATURES`, and can be removed at any time. This feature is already used by serde and bevy to improve documentation quality. For compilers that cannot use this feature, we still hide most generated impls, and the existence of them are hinted by doc comments on the single non-hidden impl. Signed-off-by: Gary Guo Link: https://github.com/Rust-for-Linux/pin-init/commit/530c4eb79a449599e219821f9397f03250cc2aa4 [ Reordered `#[doc]` attributes and safety comments to avoid errors in older versions of clippy. - Benno ] Link: https://patch.msgid.link/20260319093542.3756606-4-lossin@kernel.org Signed-off-by: Benno Lossin commit 960c37cbcba78730ee175f4887ffcdf523385c53 Author: Benno Lossin Date: Thu Mar 19 10:35:25 2026 +0100 rust: pin-init: properly document let binding workaround The three let bindings (in the bodies of `cast_init`, `cast_pin_init` and the `init!` macro) are used to avoid the following compiler error in Rust 1.78.0, 1.79.0, 1.80.0, 1.80.1, and 1.81.0 (just showing the one for `cast_init`, the others are similar): error[E0391]: cycle detected when computing type of opaque `cast_init::{opaque#0}` --> src/lib.rs:1160:66 | 1160 | pub const unsafe fn cast_init(init: impl Init) -> impl Init { | ^^^^^^^^^^^^^^^ | note: ...which requires borrow-checking `cast_init`... --> src/lib.rs:1160:1 | 1160 | pub const unsafe fn cast_init(init: impl Init) -> impl Init { | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ note: ...which requires const checking `cast_init`... --> src/lib.rs:1160:1 | 1160 | pub const unsafe fn cast_init(init: impl Init) -> impl Init { | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ = note: ...which requires computing whether `cast_init::{opaque#0}` is freeze... = note: ...which requires evaluating trait selection obligation `cast_init::{opaque#0}: core::marker::Freeze`... = note: ...which again requires computing type of opaque `cast_init::{opaque#0}`, completing the cycle note: cycle used when computing type of `cast_init::{opaque#0}` --> src/lib.rs:1160:66 | 1160 | pub const unsafe fn cast_init(init: impl Init) -> impl Init { | ^^^^^^^^^^^^^^^ = note: see https://rustc-dev-guide.rust-lang.org/overview.html#queries and https://rustc-dev-guide.rust-lang.org/query.html for more information Once we raise the nightly-MSRV above 1.81, we can remove this workaround. Link: https://github.com/Rust-for-Linux/pin-init/commit/bb3e96f3e9a4f5fca80a22af883c7e5aa90f0893 [ Moved this commit after the previous one to avoid a build failure due to unstable features. Changed the cfg to use `USE_RUSTC_FEAUTURES`. - Benno ] Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260319093542.3756606-3-lossin@kernel.org Signed-off-by: Benno Lossin commit 002a121b16c3a20c6e0ff24fc8dad6dab59730f9 Author: Gary Guo Date: Thu Mar 19 10:35:24 2026 +0100 rust: pin-init: build: simplify use of nightly features We use some features that are already stable in later versions of Rust, but only available as unstable features in older Rust versions that the kernel needs to support. Instead of checking if a feature is already stable, simply enable them and allow the warning if the feature is already stable. This avoids the need of hardcoding whether a feature has been stabilized at a given version. `#[feature(...)]` is used when cfg `USE_RUSTC_FEATURES` is enabled. The build script automatically does this when a nightly compiler is detected or `RUSTC_BOOTSTRAP` is set. Signed-off-by: Gary Guo Link: https://github.com/Rust-for-Linux/pin-init/commit/885c5d83d7eb778a796d4a17380a0898b0d0a571 [ Added kernel build system changes to always enable USE_RUSTC_FEATURES. Moved this commit earlier (swapped with the next one) to avoid a build error. - Benno ] Link: https://patch.msgid.link/20260319093542.3756606-2-lossin@kernel.org Signed-off-by: Benno Lossin commit c655a14958363aea8a1d0bbf3358fcee7f89a210 Author: Krzysztof Kozlowski Date: Tue Feb 17 10:16:38 2026 +0100 arm64: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC All CONFIG_ARCH_TEGRA_132_SOC-like symbols are now default for ARCH_TEGRA, so drop redundant lines from defconfig. Tested with comparing include/generated/autoconf.h. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij Acked-by: Thierry Reding Signed-off-by: Thierry Reding commit 057a86674eff954517db4ac056ba3258ce73a23c Merge: 6de23f81a5e08b ece67f475887f7 Author: Thierry Reding Date: Wed Mar 25 10:49:24 2026 +0100 Merge branch 'for-7.1/soc' into for-7.1/arm64/defconfig commit 21e380f272415387454d81788f2d62642e1fe93a Author: Krzysztof Kozlowski Date: Tue Feb 17 10:16:37 2026 +0100 ARM: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC All CONFIG_ARCH_TEGRA_2x_SOC-like symbols are now default for ARCH_TEGRA, so drop redundant lines from defconfigs. Tested with comparing include/generated/autoconf.h. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij Acked-by: Thierry Reding Signed-off-by: Thierry Reding commit 2965b16b32bbfef568dd6ae82d8c2bb7858f62a8 Merge: 6de23f81a5e08b ece67f475887f7 Author: Thierry Reding Date: Wed Mar 25 10:48:38 2026 +0100 Merge branch 'for-7.1/soc' into for-7.1/arm/defconfig commit 9514d3f2dd4b8df4505c9104da8ac12fefb0d871 Author: Thierry Reding Date: Thu Feb 26 16:09:32 2026 +0100 soc/tegra: Add Tegra238 Kconfig symbol The NVIDIA Tegra238 SoC is an upcoming new chip. Add a Kconfig symbol to allow fine-grained selection of support code for this chip. Reviewed-by: Jon Hunter Signed-off-by: Thierry Reding commit ece67f475887f77a889ce2ad27a49d12e69aa6be Author: Krzysztof Kozlowski Date: Tue Feb 17 10:16:36 2026 +0100 soc/tegra: Make ARCH_TEGRA_SOC_FOO defaults for NVIDIA Tegra By convention, only one globally selectable ARCH_PLATFORM is expected for given SoC platform, defined in arch/arm64/Kconfig.platforms or arch/arm/mach-*/Kconfig, because we target a single multi-platform kernel image. Platforms wanting different granularity, e.g. due to size constraints on their devices, should be sure that globally only one ARCH_PLATFORM is selected in defconfig. Change Tegra per-SoC Kconfig entries to default to ARCH_TEGRA allowing removal of these per-SoC parts from defconfigs. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij [treding@nvidia.com: Fix ARCH_PLATFORM typo, correct spelling] Signed-off-by: Thierry Reding commit 95d12fc4ef4522757c25cba866cc4b8a5f01760f Author: Johannes Berg Date: Sat Mar 21 19:29:22 2026 +0200 wifi: iwlwifi: mld: set RX_FLAG_RADIOTAP_TLV_AT_END generically Instead of setting this flag in the iwl_mld_radiotap_put_tlv() users, and not even all of them, set it inside the function. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.31eff369ccf2.If5cee8f7c767b937891abb6cccf2692068ba7758@changeid commit d35dafca94d99f9d4adc91830b78d41d3cc9f988 Author: Emmanuel Grumbach Date: Sat Mar 21 19:29:21 2026 +0200 wifi: iwlwifi: reduce the number of prints upon firmware crash When the firmware crashes, we print data to be able to know what happened. The problem is that those prints became excessive as during the course of the years, we added more data without ever removing the prints that were no longer useful. Instead of spamming the log with data that will not help anyone, limit the prints to what is really needed. Signed-off-by: Emmanuel Grumbach Reviewed-by: Eilon Rinat Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.3bb8b142ff48.Ieacb12bf3bc930a4c28824e31d8e06eda177ba78@changeid commit 1d624e0bd26c0c30bed7246dea9145ce7c5b5850 Author: Emmanuel Grumbach Date: Sat Mar 21 19:29:20 2026 +0200 wifi: iwlwifi: fix the description of SESSION_PROTECTION_CMD The struct has been renamed to iwl_session_prot_cmd. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.56545b097d13.If468c6a666dcf3a52601604bfc8a1c4faa9d320c@changeid commit 1a41221f314c70c73f5d1a03744ec013e6d59269 Author: Miri Korenblit Date: Sat Mar 21 19:29:19 2026 +0200 wifi: iwlwifi: mld: introduce iwl_mld_vif_fw_id_valid Introduce a helper function that checks if a vif fw id is valid, and warns if it isn't. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.b68d43db2ddc.I11b2b98e115da9eec8f603c5a01a0a9bcd040884@changeid commit 4d56037a02bda77844f98bfbb2b91e324f86bd7f Author: Avinash Bhatt Date: Sat Mar 21 19:29:18 2026 +0200 wifi: iwlwifi: mld: block EMLSR during TDLS connections TDLS (Tunneled Direct Link Setup) requires single-link operation for direct peer-to-peer communication, which is incompatible with EMLSR (Enhanced Multi-Link Single Radio) mode where the radio switches between multiple links. Block EMLSR when the first TDLS peer is added and unblock when the last TDLS peer is removed. The block/unblock APIs handle exiting EMLSR and triggering link selection automatically. Signed-off-by: Avinash Bhatt Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.c1376b0259dd.I016587eb1570f7a7a64c0c95e0636e955a640350@changeid commit 73a20e5d1ed8cd1328674689221ee8df2104aec5 Author: Emmanuel Grumbach Date: Sat Mar 21 19:29:17 2026 +0200 wifi: iwlwifi: TLC_MNG_CONFIG_CMD can use several structures Depending on the firmware API version, we can use different version of the command. Mention them all in the description. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.2c0b1adb8655.Id0cc6cb6996df53a224d29fa541d19b9ee2aa479@changeid commit b008f2860015c7f72b77ae3c4fa0acd828930001 Author: Emmanuel Grumbach Date: Sat Mar 21 19:29:16 2026 +0200 wifi: iwlwifi: mld: update the TLC when we deactivate a link We hit a problem in the channel switch flow. We had link 0 using PHY 0, so the TLC object in the firmware is using PHY 0. Then we switched channel, so mac80211 / iwlmld: * deactivated link 0 * removed PHY 0 * added PHY 1 * modified link 0 to use PHY 1 * activated link 0. The TLC object was not updated and the firmware was unhappy that the TLC was still trying to use PHY 0. Fix that by letting the TLC know about the PHY context before the link activation. When we are de-activating a link, let the TLC know so that it'll send a TLC configuration command with an invalid PHY context to remove the relationship between the TLC object and the PHY that is going to be removed. That last part is not implemented yet in the firmware, so leave this as a TODO for now. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.317c66b11a31.I591118fa376ed967c0d1a47058c13834bc94605e@changeid commit f2463eff4ad919d1b761eb0db4d4913423dee28d Author: Miri Korenblit Date: Sat Mar 21 19:29:15 2026 +0200 wifi: iwlwifi: add a macro for max FW links Currently we use IWL_FW_MAX_LINK_ID + 1 to indicate the maximum number of link that the fw supports. This is a bit confusing. Add a macro that indicates the number if maximum links that the FW supports and use it instead. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.8da9f991526f.I72709f1db90036265c98c5d45682bcf5f36be7ba@changeid commit 4f1da5cf31cf6345f145e914a0158c2e114bbe27 Author: Miri Korenblit Date: Sat Mar 21 19:29:14 2026 +0200 wifi: iwlwifi: mld: always assign a fw id to a vif We used to have a fw id assignment in iwl_mld_init_vif since all interface types that were added to the driver was immediately added to the FW as well. Since NAN was introduced, this is no longer the case - the NAN interface is not added to the fw until a local schedule is configured. For this vif we don't assign a fw id so it is 0 by default. But later, when the vif is removed from the driver, we think that it has a valid fw id (0) and we point fw_id_to_vif[0] to NULL. fw_id_to_vif[0] might actually point to another vif with a valid fw id 0. In this case, we end up messing fw_id_to_vif. Fix this by initializing a vif with a special invalid fw id, and by exiting iwl_mld_rm_vif early for NAN interfaces. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.f3b5cc59098f.I3d1dbe66bd224cbb786c2b0ab3d1c9f7ec9003e4@changeid commit ab97a6c94c8919373a7a8109a5a27475bd1102bd Author: Miri Korenblit Date: Sat Mar 21 19:29:13 2026 +0200 wifi: iwlwifi: mld: use the dedicated helper to extract a link There is a helper, iwl_mld_fw_id_to_link_conf, that converts a fw link id into the bss_conf structure. Use it in two more places instead of retrieving the bss_conf directly from the fw-id-to-bss_conf mapping array. This required changing the loop bound in iwl_mld_process_per_link_stats() to ucode_capa.num_links, to avoid hitting a IWL_FW_CHECK for link ids > ucode_capa.num_links and < ARRAY_SIZE(fw_id_to_bss_conf), but this change makes sense anyway (there is no reason to iterate links that cannot be valid). Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.f8da2cd2a873.I7fbd3b4a86a5695206bb5083fdac49de9acc9dca@changeid commit 62e4d33c7d6945867062f45d09b99dda0dd04108 Author: Johannes Berg Date: Sat Mar 21 19:29:12 2026 +0200 wifi: iwlwifi: add MAC context command version 4 Due to NAN additions, this command needs to grow. In iwlmvm we just need to use the old _v3 (or v2) version, but iwlmld needs to handle the difference and send both. Do that as a first step towards adding NAN support. Signed-off-by: Johannes Berg Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.5ab609ca1966.I860737f952865bd0b997f1c190c3891864c7c6ba@changeid commit 19a86a3ff3cc400767cd0d23932c763d6e0da53e Author: Avinash Bhatt Date: Sat Mar 21 19:29:11 2026 +0200 wifi: iwlwifi: handle NULL/ERR returns from ptp_clock_register() ptp_clock_register() returns NULL when PTP support is disabled and may return an ERR_PTR() on other failures. Reduce Log severity for NULL return cases to avoid misleading errors when PTP is unavailable. Signed-off-by: Avinash Bhatt Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.adea594600e8.I0e3d3f7ce897c54fff8ace6dd0faf55b4f39832b@changeid commit 350d91a2ae5ae88a5eae257c8f0d2c33e077f9fc Author: Johannes Berg Date: Sat Mar 21 19:29:10 2026 +0200 wifi: iwlwifi: mld: add double-include guards to nan.h This is missing, but needed when we want to add data structures to this file. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.4e09d461db6a.If5c14c495b14a20ce7abadc72be57a40d3462bfb@changeid commit 282fb8c6b1d1a8aa260c467eb067f0c94c80486f Author: Johannes Berg Date: Sat Mar 21 19:29:09 2026 +0200 wifi: iwlwifi: mld: make alloc functions not forced static In preparation for NAN needing the link ID allocation, have the macro not automatically make the ID allocation functions static so we can remove that later from the link allocation function. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.cbfd202c255f.I4dd4d4416d30bed35bc7b7caa3de50071906830a@changeid commit bac6907b2dadae522dfbe25faa365f1b081adf6a Author: Johannes Berg Date: Sat Mar 21 19:29:08 2026 +0200 wifi: iwlwifi: mld: rename iwl_mld_phy_from_mac80211() argument Calling the channel context just "channel" is confusing since it's a different struct, rename it to the more appropriate "chanctx". Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260321192637.b2cf8cfd5902.I9e0006481454445058b96ec3e7ae338e917e2c50@changeid commit f1011219309730a26e13e9b190168fceef6b8679 Author: Johannes Berg Date: Fri Mar 20 10:09:18 2026 +0200 wifi: iwlwifi: mld: remove type argument from iwl_mld_add_sta() This is used only in a single place, and the caller always sets the type to STATION_TYPE_PEER right now. We need to change some of this for NAN in the future, removing the type argument will simplify that. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.71841a054f16.I1851148e582eb710261740459a46d22720788926@changeid commit d86aeb5f6fbcdb4b678380fa4b02c663e394488e Author: Johannes Berg Date: Fri Mar 20 10:09:17 2026 +0200 wifi: iwlwifi: mld: make iwl_mld_mac80211_iftype_to_fw() static This function is only used within the file, so make it static. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.45867b060b3d.Iee64056fab7881ea5146433bacef8c2e936c45b1@changeid commit 4a481720106d6bad1521d0e0322fd74fa2f6c464 Author: Johannes Berg Date: Fri Mar 20 10:09:16 2026 +0200 wifi: iwlwifi: pcie: don't dump on reset handshake in dump When a FW dump happens, possibly even because of a reset handshake timeout, there's no point in attempting to dump again. Since all the callers of the function outside the transport itself are from the FW dump infrastructure, just split the internal function and make the external one not dump on timeout. Signed-off-by: Johannes Berg Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.f36ba3893899.I063ccc3a037ae6dabcde61941acb162c4b33f127@changeid commit 1793f23177b6e0543618051f00a402f0dbf5f88c Author: Johannes Berg Date: Fri Mar 20 10:09:15 2026 +0200 wifi: iwlwifi: use IWL_FW_CHECK for sync timeout This could be a firmware issue, it didn't send all the responses quickly enough. There are other potential issues (interrupts not being delivered, etc.) but the FW debug data will at least give some better information, and it's not a WARN condition anyway. Signed-off-by: Johannes Berg Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.2188e2efbead.I7dc5bd6f581a31ac51d8a854f3b3af4cb980223a@changeid commit 4aece67f1cb049b5f42e18d76979a558a5705890 Author: Pagadala Yesu Anjaneyulu Date: Fri Mar 20 10:09:14 2026 +0200 wifi: iwlwifi: mld: add BIOS revision compatibility check for PPAG command Prevent potential issues when newer BIOS revisions are used with firmware that doesn't support them for PER_PLATFORM_ANT_GAIN_CMD. Without this check, the driver may attempt to use BIOS configurations that are incompatible with the current firmware version, leading to dropping of command in firmware without any failure notification to driver. Signed-off-by: Pagadala Yesu Anjaneyulu Reviewed-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.79bf2bf398d0.I8161dbe1a04af3738e00ab0fc13fe3dbfa9094ec@changeid commit 6e6d8f344dbb00f232e73dbd0813cfabdd35b15f Author: Miri Korenblit Date: Fri Mar 20 10:09:13 2026 +0200 wifi: iwlwifi: validate the channels received in iwl_mcc_update_resp_v* Check with IWL_FW_CHECK that the FW doesn't send a channel that we don't support. Otherwise, the center frequency will be 0, leading to a warning since is_valid_reg_rule will return false, of course. Although the warning is verbose enough, the IWL_FW_CHECK will spare some of the debug. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.0e83cdd88cea.Ic86852e622ed3ec06110f9e6525f72679236cf1e@changeid commit 454e9141ae96691ad380f7f3f7d11fe652a03cb5 Author: Avinash Bhatt Date: Fri Mar 20 10:09:12 2026 +0200 wifi: iwlwifi: add CQM event support for per-link RSSI changes Implement CQM RSSI threshold handling by tracking the last reported RSSI and issuing CQM low/high events when the RSSI crosses the configured threshold with the required hysteresis. This provides proper CQM support and enables userspace to receive per-link RSSI notifications. Signed-off-by: Avinash Bhatt Reviewed-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Reviewed-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.08697e34bf66.Ic1a68537ef0d37be62c73c138efe9c5cf09bd24c@changeid commit 5e35b749fe25ee963b5766d2c217e6f3b0e41b18 Author: Pagadala Yesu Anjaneyulu Date: Fri Mar 20 10:09:11 2026 +0200 wifi: iwlwifi: mld: eliminate duplicate WIDE_ID in PPAG command handling Extract the PER_PLATFORM_ANT_GAIN_CMD command ID into a local variable to avoid duplicating WIDE_ID(PHY_OPS_GROUP, PER_PLATFORM_ANT_GAIN_CMD). Signed-off-by: Pagadala Yesu Anjaneyulu Reviewed-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.7b7e6315e2cc.Icffcc47ac1e876708b6219a89fd546a018797d44@changeid commit 3fd645e6a153e2ce45928ec32442ab4719c3afa6 Author: Pagadala Yesu Anjaneyulu Date: Fri Mar 20 10:09:10 2026 +0200 wifi: iwlwifi: fw: Add TLV support for BIOS revision of command Add support for newer firmware API versions that support multiple BIOS revisions. Use the new TLV provided by firmware to determine which BIOS revision it supports. Future patches will use this information to either drop commands when the BIOS revision is higher than supported or convert commands based on the command specific implementation. Since we are including now nvm-reg.h in img.h, this causes a re-definition error of IWL_NUM_CHANNELS which is also defined in eeprom.c, so rename IWL_NUM_CHANNELS to IWL_NUM_CHANNELS_V2 Signed-off-by: Pagadala Yesu Anjaneyulu Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.76c8a9589ea0.I7f9157115de702e07511f2c3ed5fcb9ae4c667aa@changeid commit c74abe31142db03f942f12b28033f2b8b14e3acb Author: Miri Korenblit Date: Fri Mar 20 10:09:09 2026 +0200 wifi: iwlwifi: bump core version for BZ/SC/DR Start supporting Core 102 FW on these devices. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.3b6540a99c1c.Ie2d3bdb3dc1865ad7c865cdcbeefa41d21ea4482@changeid commit 7fa6fcfca7ac3e09ae279f63111f59e990126a52 Author: Johannes Berg Date: Fri Mar 20 10:09:07 2026 +0200 wifi: iwlwifi: mld: support changing iftype at runtime While the interface isn't really operating, which is already required by mac80211, we can simply remove the MAC and add it again to change the type. Implement this simple handling. We could almost consider moving this to mac80211 itself, as this kind of flow should be supportable by any device, but for now keep it here. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.2fb530f9d825.I7cc68fa36e40c9f3bef3be9c2982061cb9ea2300@changeid commit d60cbe9ef68c0fb2a46a5f89e8f77f419f62a1d6 Author: Johannes Berg Date: Fri Mar 20 10:09:05 2026 +0200 wifi: iwlwifi: mld: set UHR MCS in RX status Handle UHR MCSes in the RX status when receiving UHR frames. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.7d235ea6a4f2.Ibc8c7e1af45cae2756e4ddcdf6dc5424b3992f7b@changeid commit 364273359ef354d315157f78fef1b72f75d08468 Author: Johannes Berg Date: Fri Mar 20 10:09:04 2026 +0200 wifi: iwlwifi: mld: enable UHR in TLC Tell the firmware if UHR is supported, including ELR (enhanced long range) MCS support. Note that the spec currently doesn't differentiate between 1.5 and 3 Mbps ELR MCSes, unlike the firmware. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320100746.7117009d7c39.If4e8cdc63fdf4c5f14d923a5c59fb7b43df72a67@changeid commit a8023eb7038cffb3f7f481ee6c26f7f854b33795 Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:55 2026 +0200 wifi: iwlwifi: mld: remove SCAN_TIMEOUT_MSEC It has no users Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.ea8d4a381474.I82c1d17faa6de6f16f08573ebb180de8db837bee@changeid commit f199ee6078a9677c872e09bd40c4cea8db6fbc28 Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:54 2026 +0200 wifi: iwlwifi: remove IWL_MAX_WD_TIMEOUT This define is not used, remove it. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.15341c4081ed.I639a1d65799ce5502e5c83e8889bcc5eda5ec4dc@changeid commit 769b5b1ed59084b653f423904b7a486b1c86672a Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:53 2026 +0200 wifi: iwlwifi: uefi: mode the comments valid kerneldoc comments This will allow to get warnings if we make mistakes while documenting the uefi structures Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.e9ad48c2cf4a.I867e3eb9581ac2a87772fd2534502c008543bafb@changeid commit f863093a914c4b371f5c82a173d5b804318c91ef Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:52 2026 +0200 wifi: iwlwifi: support PER_CHAIN_LIMIT_OFFSET_CMD v6 This includes support for UNII-9. Store the source of the WGDS table in the firmware runtime object to be able to pass the information to the firmware. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.eaff31760dd7.Ic7f56fbbe310833723094f965e7ba3f8624d0ef9@changeid commit c5cc3d37177835650d0c58609527a7550dfa0a66 Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:51 2026 +0200 wifi: iwlwifi: acpi: add support for WGDS revision 4 This adds support for UNII-9. WGDS tables will now have 4 subbands. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.721e9fbabfc9.Ie8bd641cf84aa659d93893438c172c172b67214b@changeid commit f951689793e6c5e908be143fcc506aafa5bf3c36 Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:50 2026 +0200 wifi: iwlwifi: acpi: validate the WGDS table Prefer to use ARRAY_SIZE when we check array-length. Make sure num_profile isn't bigger than the number of profiles we can actually store in the firmware runtime object. Same of the number of bands. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.a398511514ed.Ie4e62e2008f7e117ae7e305967ffadf1a30fc2b1@changeid commit c30e4e03721dc75adfff6b4c2ad671dab71f319c Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:49 2026 +0200 wifi: iwlwifi: uefi: add support for WGDS rev4 This new revision includes support for UNII-9. It adds a subband. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.ad8e49c3a9e1.I51170ba78a706f976e93918d6473185d41e4306d@changeid commit de985774e2175483bfffb5598bea4e39c12a181a Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:48 2026 +0200 wifi: iwlwifi: uefi: open code the parsing of the WGDS table We will soon add support for UNII-9 band in the WGDS table. We need to decouple the UEFI code from the firmware runtime code. The firmware runtime is just a software object which will need to grow and UEFI objects need a new revision to grow. Existing systems will keep the same UEFI objects. Just like PPAG and SAR, stop using structures to parse the UEFI tables since the layout depends on the revision. The support for the new revision will be added in the next patch, for now, just do the ground work. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.140706e6e91f.I83ca04932bc21aa358119890001e876ced1e1bda@changeid commit c239a0d8d75e83e28e5866f15234fff34f4103c5 Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:47 2026 +0200 wifi: iwlwifi: mld: support version 11 of REDUCE_TX_POWER_CMD This introduces support for UNII-9. After we increased the size of the arrays of the subbands in SAR structure, we now support the new firmware command. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.9cea60b78a1b.Ia91c59829af0dc4d6c351c5b09ce33800c1f9e44@changeid commit 6481a02f94e28dbb88a395db581984457da22683 Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:46 2026 +0200 wifi: iwlwifi: acpi: add support for EWRD rev 3 table This table includes another sub-band for UNII-9. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.9182284f007e.Ibbe7c1f8442933d29695b9bf56b8e775394c71f8@changeid commit 60db0a1a70fa44ac85dcb90fc986235f9d4c9fb0 Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:45 2026 +0200 wifi: iwlwifi: acpi: add support for WRDS rev 3 table This table includes another sub-band for UNII-9. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.06543ec65e00.I73135c7d61bff9b46ad9862d93f4faf923983fd4@changeid commit b00294e66e1faafa16d635580ee1b7c382519758 Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:44 2026 +0200 wifi: iwlwifi: uefi: support the new WRDS and EWRD tables Those tables now have support for UNII-9 subband. Refactor iwl_uefi_set_sar_profile to get an array of values that makes it easier to use when the number of subbands can vary. Revamp a bit the code that fetches the tables to ask for the smaller table, then we can check the size of the object that we got and compare to the expected sizes to determine what revision to expect. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.6948f69e6ae4.Icf990e13de6905c35a8de69f1445f8eb4aa43ee4@changeid commit 5562b3bbeede8be25092064720e4a942e9fd3e3e Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:43 2026 +0200 wifi: iwlwifi: mvm: zero iwl_geo_tx_power_profiles_cmd before sending Otherwise we may send garbage. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.2d494b0f4692.I9afd0fa6b2ea5a27118144ac4e3bbbedc2089c10@changeid commit f473f609164ee9907497ac55934689110c248e23 Author: Johannes Berg Date: Thu Mar 19 20:48:42 2026 +0200 wifi: iwlwifi: restrict TOP reset to some devices Due to the Bluetooth implementation needing to match, not all devices can actually do TOP reset. Restrict it to Sc2/Sc2f or later, with Wh RF or later. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.6c4479f4e49d.I5023d70cb33f1e18f7cb15981fc3acfbb00862b7@changeid commit 1fd4e6478ccde5c89f47191170b6e655808e450d Author: Emmanuel Grumbach Date: Thu Mar 19 20:48:41 2026 +0200 wifi: iwlwifi: uefi: add support for PPAG table rev5 This table has another subband for UNII-9. Add defines for the sizes of rev4 and rev5 to easily know how much data to ask from iwl_uefi_get_verified_variable. In case rev5 doesn't exist, fallback to rev4. Check that the revision advertised by the fetched table matches the size that we got. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319204647.b9ebcff37599.I1e8bb9cee5a028ed416b6094c0fdbf9f859c6dd8@changeid commit f90c8ea27cbe0522e8cd979a32ab8488298e98e6 Author: Emmanuel Grumbach Date: Thu Mar 19 11:09:27 2026 +0200 wifi: iwlwifi: acpi: add support for PPAG rev5 This adds support for UNII9 which requires to add a subband. Just increase the number of subbands that we need to read. Replace the usage of the IWL_NUM_SUB_BANDS_VX macros in acpi.h since those macros are defined in the firmware API and ACPI declarations have nothing to do the firmware API. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.a5e7f805d0f2.I0e3ee3258b77b339234692ceccf0d25d1e6dd67e@changeid commit feb27e5abb72fe8fc0a4e6e672374f4f1cd46ecc Author: Emmanuel Grumbach Date: Thu Mar 19 11:09:26 2026 +0200 wifi: iwlwifi: acpi: check the size of the ACPI PPAG tables We need to make sure we don't have a buffer overflow while reading the PPAG tables from ACPI into the firmware runtime object. Add an ACPI specific define for the number of chains in order to decouple the ACPI layout from the other objects. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.451808698662.I91234c8a662608674679ce490b51be792332cd43@changeid commit 442c707c3c6663e7b3185716a3464dc99e72b727 Author: Emmanuel Grumbach Date: Thu Mar 19 11:09:25 2026 +0200 wifi: iwlwifi: regulatory: support a new command for PPAG Per Platform Antenna Gain is getting support for UNII-9. Add a new version of PER_PLATFORM_ANT_GAIN_CMD. This requires to increase the number of subbands in the firmware runtime object. Pass the number of subbands to iwl_bios_print_ppag to avoid printing invalid values. Introduce BIOS_PPAG_MAX_SUB_BANDS_NUM to avoid impacting BIOS_SAR_MAX_SUB_BANDS_NUM which was used until now for PPAG as well. SAR will get support for the new subband in future patches. While at it, print the PPAG table as it was read from BIOS. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.2e577236d3c9.I042697a73893d79ef761796354b5d1dd8522f734@changeid commit 99d602b2d7906dac4322ad3e50615931a3180d9a Author: Miri Korenblit Date: Thu Mar 19 11:09:23 2026 +0200 wifi: iwlwifi: mld: add support for sta command version 3 In this version, the link_id becomes a link_mask to support multiple links that are used to communicate with the station in question. This is needed for NAN, in which we can communicate on multiple channels with the same station. Also add a new STA type - NAN peer. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.382a30bd1b70.Id6271e7eba233a11dc214ed2e07c2b186b167c66@changeid commit 1a7d1830be843af332081833223f4be536c00e3b Author: Emmanuel Grumbach Date: Thu Mar 19 11:09:22 2026 +0200 wifi: iwlwifi: bring iwl_fill_ppag_table to the iwlmvm iwl_fill_ppag_table fills a command that is sent to the firmware. This command has several versions and handling those different versions is the responsibility of the op_mode. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.1f9b38ff7d22.I5c7482c074d63cd18533ac83289cc0b26c1be3d2@changeid commit f983c7308e271b1b5c70147ab743b587c8362b44 Author: Emmanuel Grumbach Date: Thu Mar 19 11:09:21 2026 +0200 wifi: iwlwifi: uefi: open code the PPAG table store operation The structure in firmware runtime will need to grow because we're adding a subband for UNII-9. This means that we will soon no longer be able to just memcpy the data from the UEFI table. The layout of the array will change. Tediously copy the data byte-byte to make sure things get to the right place even when we'll increase the number of subbands. Make it easier for the uefi_cnv_var_ppag structure to grow by simpiflying the layout it becomes an array of s8. The layout of the structure becomes less obvious from the structure's declaration, but then the code is more flexible. Don't use UEFI_SAR_MAX_SUB_BANDS_NUM for the number of bands for PPAG. Of course, SAR related structures will grow in future patches, but decouple SAR and PPAG to make the work easier. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.61e729ea2bde.I9d9cda29f576290bf966f780bf7ad5af34970e6f@changeid commit 6af32104003e86959044e61821e579b6cf160a48 Author: Ilan Peer Date: Thu Mar 19 11:09:20 2026 +0200 wifi: iwlwifi: mld: Introduce scan command version 18 The FW scan logic was extended to support new channels in the 7 GHz band, as such, the scan command was modified to support scanning more PSC channels. Introduce scan command version 18 handling, which is different from scan command version 17 only in the number of supported channel configurations. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.c995b4e8bbc5.Ie401d9cf02daaa5e6adf2b3c309643589e3ead71@changeid commit b6045c899e371dda801ae33727c9da112f422645 Author: Ilan Peer Date: Thu Mar 19 11:09:19 2026 +0200 wifi: iwlwifi: mld: Refactor scan command handling As a preparation for a new scan command version, refactor the scan command building such that it would allow introducing new scan command structures in a simpler way. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.a3e9589769f0.If458023e234ed79db7474107d98f0b6e28e565e5@changeid commit 5ebf0b1d7bd31996cc3f63e3751c05bef7eaeaae Author: Pagadala Yesu Anjaneyulu Date: Thu Mar 19 11:09:18 2026 +0200 wifi: iwlwifi: mld: remove unused scan expire time constants Remove the unused IWL_MLD_SCAN_EXPIRE_TIME_SEC constant from constants.h and its corresponding IWL_MLD_SCAN_EXPIRE_TIME macro definition from mlo.c. These definitions are no longer referenced. Signed-off-by: Pagadala Yesu Anjaneyulu Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.4be7221113cf.I13e32d575bb854709af374519332b998bc1fed4a@changeid commit 97cbd93e364fcb9bef0db13055a4d2fd103df9d4 Author: Nidhish A N Date: Thu Mar 19 11:09:17 2026 +0200 wifi: iwlwifi: mvm: cleanup some more MLO code iwlmld is now the op mode that is used for EHT devices, so iwlmvm code can never run in MLO. Clean up some more MLO code. Signed-off-by: Nidhish A N Reviewed-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.8efcec472e91.Icaf4f4d6b9008e12310f408cfef7f35643f27ca5@changeid commit 64b992ebf1e8be3dc89611357522d09fcaba5387 Author: Emmanuel Grumbach Date: Thu Mar 19 11:09:16 2026 +0200 wifi: iwlwifi: acpi: better use ARRAY_SIZE than a define Since we'll have to change things in this area, use the safer option to define the size of an array. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.1acfc3b6f2b8.I2185e7850146e15628f8ec2c579d93f536c83d83@changeid commit 5971e08b1324a9a9f3d530ce6dda4982401a6120 Author: Emmanuel Grumbach Date: Thu Mar 19 11:09:15 2026 +0200 wifi: iwlwifi: uefi: decouple UEFI and firmware APIs The APIs in uefi.h are not firmware API files nor are they pure software objects. They really reflect a specific layout we expect to see in the UEFI tables. Since the UEFI objects are encoded into the BIOS, we can't use the same values for the declaration of the UEFI objects and for the pure software object like iwl_sar_profile in the firmware runtime object. Decouple the two types. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.db39a64073db.I21486dedb7357570151437cb0211b697e0efb61d@changeid commit 07c82a4e5beed28a9d2f69bc687a4668ca2754c4 Author: Emmanuel Grumbach Date: Thu Mar 19 11:09:14 2026 +0200 wifi: iwlwifi: ensure we don't read SAR values past the limit When we fill the SAR values, we read values from the BIOS store in the firmware runtime object and write them into the command that we send to the firmware. We assumed that the size of the firmware command is not longer than the BIOS tables. This has been true until now, but this is not really safe. We will soon have an firmware API change that will increase the size of the table in the command and we want to make sure that we don't have a buffer overrun when we read the firmware runtime object. Add this safety measure. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.99aaf2df072a.I5942590b81324b17e2a369f0c354cafee0f70ef5@changeid commit 078df640ef057d57d22c064f5d980aead29ba23d Author: Emmanuel Grumbach Date: Thu Mar 19 11:09:13 2026 +0200 wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2 There is a new version of this command to indicate which AP type in UNII-9 is supported per country. This adds support for a new UEFI table that will include that data to be filled in the new AP type table. Rename the uats_table field in firmware_runtime structure since it includes now the UATS and the new UNEB table coming from UEFI. For the same reason, rename iwl_mld_init_uats. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.b839655712c5.I3dfca54bd19d6bd5f7ca385ea63be086ece9c1d0@changeid commit bb0c0aa30ff8c6f558433ab62a012bd620cec889 Author: Marco Crivellari Date: Tue Feb 10 15:33:32 2026 +0100 wifi: iwlwifi: mvm: replace use of system_wq with system_percpu_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20260210143332.206146-4-marco.crivellari@suse.com Signed-off-by: Miri Korenblit commit 900c899bd8dd06e4fd5343521dfca565b93adfed Author: Marco Crivellari Date: Thu Nov 20 11:08:49 2025 +0100 wifi: iwlwifi: fw: replace use of system_unbound_wq with system_dfl_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251120100850.66192-3-marco.crivellari@suse.com Signed-off-by: Miri Korenblit commit 5dac9abd3f187f0ed9bd3cc4f9c06a0729c8607b Author: Marco Crivellari Date: Thu Nov 20 11:08:48 2025 +0100 wifi: iwlwifi: replace use of system_unbound_wq with system_dfl_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251120100850.66192-2-marco.crivellari@suse.com Signed-off-by: Miri Korenblit commit 133ac42af0a1b389e8b7b3dc7c1cc8c30ff162b6 Author: Laurent Pinchart Date: Thu Mar 19 01:59:07 2026 +0200 media: renesas: vsp1: Initialize format on all pads The state initialization function vsp1_entity_init_state() incorrectly leaves the last entity pad out when initializing formats due to an off by one error. Fix it. Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-14-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 57485b542dbda1303eb1d7ccf6b41c9df7580e6d Author: Laurent Pinchart Date: Thu Mar 19 01:59:06 2026 +0200 media: renesas: vsp1: Implement control events The V4L2 API requires drivers that expose controls to implement control notification events. This is enforced by v4l2-compliance. Add event handling to the VSP1 entities that create controls to fix the compliance failures. Reviewed-by: Jacopo Mondi Tested-by: Niklas Söderlund Reviewed-by: Jacopo Mondi Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-13-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit d17d21bb0e161bdd52135bca5d461b7fe672e0ee Author: Laurent Pinchart Date: Thu Mar 19 01:59:05 2026 +0200 media: renesas: vsp1: histo: Fix format setting The histogram .set_fmt() handler suffers from two problems: - When operating on the source pad, it returns correct information to userspace, but does not store the format in the subdev state. Subsequent calls to .get_fmt(), handled by the vsp1_subdev_get_pad_format() helper, will not return the correct information. - When operating on the sink pad, it uses the vsp1_subdev_set_pad_format(), which propagates the sink format to the source, incorrectly overwriting the fixed source format. The first issue could be fixed by implementing the set format operation with vsp1_subdev_get_pad_format() on the source pad, if it wasn't that .set_fmt() is also used to initialize the subdev state in vsp1_entity_init_state(). The histogram would need a custom .init_state() handler. As the second issue would anyway overwrite the format, and therefore requires a custom .set_fmt() implementation, fix both issues without using the helpers. Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-12-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 1b5db4e308443227ed5b97d8e5c287c6fc34eb4b Author: Laurent Pinchart Date: Thu Mar 19 01:59:04 2026 +0200 media: renesas: vsp1: histo: Fix size enumeration The histogram supports size enumeration on the sink pad only, as the source pad outputs a metadata format. The correct error code when enumeration is not supported is -ENOTTY, not -EINVAL. Fix it. Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-11-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit a7985d28b3b13cd5e23f4271d702a46532f80424 Author: Laurent Pinchart Date: Thu Mar 19 01:59:03 2026 +0200 media: renesas: vsp1: histo: Fix code enumeration The histogram media bus code enumeration does not check the index when operating on the source pad, resulting in an infinite loop if userspace keeps enumerating code without any loop boundary. Fix it by returning an error for indices larger than 0 as the pad supports a single format. Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-10-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit ae16c0d6baabcf2b0779a14508a71a0e742552ff Author: Laurent Pinchart Date: Thu Mar 19 01:59:02 2026 +0200 media: renesas: vsp1: hsit: Fix size enumeration The HSIT entity performs format conversion, which leads to incorrect results with the vsp1_subdev_enum_frame_size() helper. Implement a custom .enum_frame_size() handler that correctly validates the media bus code. Size validation is identical to the helper. Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-9-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 937f3e6b51f1cea079be9ba642665f2bf8bcc31f Author: Laurent Pinchart Date: Thu Mar 19 01:59:01 2026 +0200 media: renesas: vsp1: brx: Fix format propagation The format width and height is never propagated to the BRX source pad, leaving its initial configuration invalid. Propagate the whole format from the first sink pad to the source pad instead of only propagating the media bus code. This fixes compliance with the subdev format propagation rules. Reviewed-by: Jacopo Mondi Tested-by: Niklas Söderlund Reviewed-by: Jacopo Mondi Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-8-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit d9a2bce9ae6a8432cb8febcab85e79368ea32b0b Author: Laurent Pinchart Date: Thu Mar 19 01:59:00 2026 +0200 media: renesas: vsp1: rwpf: Fix media bus code and frame size enumeration The RWPF can't freely convert between all input and output formats. They support RGB <-> YUV conversion, but HSV formats can't be converted. Fix the media bus code and frame size enumeration to take this into account on the source pad. Reviewed-by: Jacopo Mondi Tested-by: Niklas Söderlund Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-7-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 78db71a2adf381ecbc0881b40c01fe30e6c61fbb Author: Laurent Pinchart Date: Thu Mar 19 01:58:59 2026 +0200 media: renesas: vsp1: rpf: Fix crop width and height clamping The vsp1 driver doesn't enforce a minimum value on the RPF crop rectangle width and height. Empty rectangles are accepted, leading to incorrect hardware behaviour. Fix it by adding minimum width and height constraints to the value clamping. Tested-by: Niklas Söderlund Reviewed-by: Jacopo Mondi Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-6-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 55823379e61511d534b099949608677d703f709b Author: Laurent Pinchart Date: Thu Mar 19 01:58:58 2026 +0200 media: renesas: vsp1: rpf: Fix crop left and top clamping The RPF doesn't enforces the alignment constraint on the sink pad format, which could have an odd size, possibly down to 1x1. In that case, the upper bounds for the left and top coordinates clamping would become negative, cast to a very large positive value. Incorrect crop rectangle coordinates would then be incorrectly accepted. A second issue can occur when the requested left and top coordinates are negative. They are cast to a large unsigned value, clamped to the maximum. While the calculation will produce valid values for the hardware, this is not compliant with the V4L2 specification that requires values to be adjusted to the closest valid value. Fix both issues by switching to signed clamping, with an explicit minimum to adjust negative values, and adjusting the clamp bounds to avoid negative upper bounds. Tested-by: Niklas Söderlund Reviewed-by: Jacopo Mondi Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-5-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 46d3ad607037b61747d980fc612d36bf489d3709 Author: Laurent Pinchart Date: Thu Mar 19 01:58:57 2026 +0200 media: renesas: vsp1: Fix code checks in frame size enumeration The media bus code passed to the .enum_frame_size() operation for the sink pad is required to be supported by the device, but not to match the current format. All entities that use the vsp1_subdev_enum_frame_size() helper, as well as the SRU and UDS entities that implement the operation manually, perform the check incorrectly. Fix the issue by implementing the correct code check in the vsp1_subdev_enum_frame_size(). For the SRU and UDS, to avoid duplicating code, use the vsp1_subdev_enum_frame_size() as a base and override the enumerated size on the source pad with entity-specific constraints. While at it, include the missing as the code locks mutexes. Tested-by: Niklas Söderlund Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-4-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 2cbf20a3fd8ffd574977f94b93a797cc02e7c358 Author: Laurent Pinchart Date: Thu Mar 19 01:58:56 2026 +0200 media: renesas: vsp1: Store size limits in vsp1_entity Most entities use the vsp1_subdev_enum_frame_size() and vsp1_subdev_set_pad_format() helper functions to implement the corresponding subdev operations. Both helpers are given the minimum and maximum sizes supported by the entity as arguments, requiring each entity to implement a wrapper. Replace the function arguments with storing the size limits in the vsp1_entity structure. This allows dropping most of the .enum_frame_size() and .set_fmt() wrappers in entities. Reviewed-by: Jacopo Mondi Tested-by: Niklas Söderlund Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-3-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit c247aa0b75d67cc50f66685604755828522f9779 Author: Laurent Pinchart Date: Thu Mar 19 01:58:55 2026 +0200 media: renesas: vsp1: Store supported media bus codes in vsp1_entity Most entities use the vsp1_subdev_enum_mbus_code() and vsp1_subdev_set_pad_format() helper functions to implement the corresponding subdev operations. Both helpers are given the list of supported media bus codes as arguments, requiring each entity to implement a wrapper. Replace the function arguments with storing the supported media bus codes in the vsp1_entity structure. This allows dropping most of the .enum_mbus_code() wrappers from entities. Reviewed-by: Jacopo Mondi Tested-by: Niklas Söderlund Tested-by: Lad Prabhakar # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-2-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 4f7cfb94be61677e8bfb7cbc909496f67bb6a08f Author: Ryan Chen Date: Tue Mar 24 09:58:50 2026 +0800 mmc: sdhci-of-aspeed: Handle optional controller reset Get the optional reset line for the ASPEED SD controller during probe by using devm_reset_control_get_optional_exclusive_deasserted(). This allows platforms such as AST2700, which require the SD controller to be taken out of reset before use, to work with the existing driver. Acked-by: Adrian Hunter Signed-off-by: Ryan Chen Signed-off-by: Ulf Hansson commit 918d627c091683203a76badc88c2cd58b420f107 Author: Ryan Chen Date: Tue Mar 24 09:58:49 2026 +0800 dt-bindings: mmc: sdhci-of-aspeed: Add AST2700 compatible AST2700 SDHCI controller is fully compatible with AST2600. However, it is necessary to take the AST2700 SD controller out of reset, so require the 'resets' property. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ryan Chen Signed-off-by: Ulf Hansson commit 2c8fe1f14240d75f2002e16b2b69c5c2d27ed41c Author: Oliver Collyer Date: Fri Dec 26 06:57:18 2025 +0000 media: uvcvideo: Add support for P010 pixel format Add support for the P010 (10-bit Y/UV 4:2:0) pixel format to the uvcvideo driver. This format is exposed by USB capture devices such as the Magewell USB Capture HDMI 4K Pro when capturing HDR10 content. P010 stores 10-bit Y and interleaved UV samples in 16-bit little-endian words, with data in the upper 10 bits and zeros in the lower 6 bits. This requires 2 bytes per sample, so bytesperline is wWidth * 2. V4L2_PIX_FMT_P010 was added to the V4L2 core in commit 5374d8fb75f3 ("media: Add P010 video format"). Based on the community DKMS patch from awawa-dev/P010_for_V4L2. Link: https://github.com/awawa-dev/P010_for_V4L2 Signed-off-by: Oliver Collyer Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20251226065718.95504-1-ovcollyer@mac.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 45507b100929cac15d4466a3feb29b8a910ffbb3 Author: Yogev Modlin Date: Sun Oct 26 18:43:03 2025 +0200 media: uvcvideo: Add D436 and D555 cameras metadata support Add support for Intel RealSense D436 and D555 depth cameras metadata. These cameras use the D4XX metadata format for transmitting depth and sensor information. The D555 camera uses UVC protocol version 1.5, while the D436 uses an undefined protocol version. Both cameras require the D4XX metadata format flag to properly handle their metadata streams. Signed-off-by: Yogev Modlin Reviewed-by: Ricardo Ribalda Link: https://patch.msgid.link/20251026-fix-uvc-v4-2-610eb1329600@realsenseai.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit bc4da279ef3ef73b7ed50f9016cf7d7143a0a4c0 Author: Yogev Modlin Date: Sun Oct 26 18:43:02 2025 +0200 media: uvcvideo: Change comment to 'Intel RealSense' RealSense branding is now independent of Intel. Update all driver comments referencing "Intel" to "Intel RealSense" to reflect current ownership. No code logic changes. Signed-off-by: Yogev Modlin Reviewed-by: Ricardo Ribalda Link: https://patch.msgid.link/20251026-fix-uvc-v4-1-610eb1329600@realsenseai.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit c3a29052db80f5069486491930409468d7cc2d78 Author: Ricardo Ribalda Date: Wed Mar 18 20:22:36 2026 +0000 media: uvcvideo: Add a stream backpointer in uvc_video_queue It is less prone to errors if we add a backpointer to stream from struct uvc_video_queue. Refactor the code. Suggested-by: Laurent Pinchart Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260318202352.1374443-1-ribalda@chromium.org Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 2ac27db04608a7ce4d46a3bf23d2262c7b20db38 Author: Ricardo Ribalda Date: Mon Mar 9 15:01:56 2026 +0000 media: uvcvideo: Allow userspace to increase the meta buffersize Now we have the metadata size hardcoded to 10 KiB, this is a value that works fine for bulk cameras or frames with no extra metadata. But not for all usecases. We have seen some cameras that produce more metadata per frame. Eg: Frame 1 captured (Bytes: 11154) Frame 2 captured (Bytes: 11616) Frame 3 captured (Bytes: 11374) Frame 4 captured (Bytes: 11132) Frame 5 captured (Bytes: 11594) Frame 6 captured (Bytes: 11352) Frame 7 captured (Bytes: 11110) Frame 8 captured (Bytes: 11572) Frame 9 captured (Bytes: 11308) When this happens, the driver (correctly) marks the metadata as ERROR. This patch let userspace set bigger buffersize via S_FMT. Signed-off-by: Ricardo Ribalda Reviewed-by: Hans de Goede Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-3-fc8b87bd29c5@chromium.org Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 33dd4bb261bd4e539551d60511574cd64845bf84 Author: Ricardo Ribalda Date: Mon Mar 9 15:01:55 2026 +0000 media: uvcvideo: uvc_queue_to_stream(): Support meta queues The stream data structure has two queues: the metadata and the data queues, but uvc_queue_to_stream() only supports the data queue. If we pass the metadata queue the function will return an invalid pointer. This patch add a parameter to the function to explicitly tell the function which queue are we using. Signed-off-by: Ricardo Ribalda Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-2-fc8b87bd29c5@chromium.org Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit fbac03467e53d8d72e5099c03df26d9adae11416 Author: Ricardo Ribalda Date: Mon Mar 9 15:01:54 2026 +0000 media: uvcvideo: Enable VB2_DMABUF for metadata stream The UVC driver has two video streams, one for the frames and another one for the metadata. Both streams share most of the codebase, but only the data stream declares support for DMABUF transfer mode. I have tried the DMABUF transfer mode with CONFIG_DMABUF_HEAPS_SYSTEM and the frames looked correct. This patch announces the support for DMABUF for the metadata stream. This is useful for apps/HALs that only want to support DMABUF. Cc: stable@vger.kernel.org Fixes: 088ead2552458 ("media: uvcvideo: Add a metadata device node") Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-1-fc8b87bd29c5@chromium.org Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 17a9399a61c9ce89771de588f6df43a8ec91f535 Author: Jann Horn Date: Tue Mar 24 22:35:12 2026 +0100 slab,rcu: disable KVFREE_RCU_BATCHED for strict grace period Disable CONFIG_KVFREE_RCU_BATCHED in CONFIG_RCU_STRICT_GRACE_PERIOD builds so that kernel fuzzers have an easier time finding use-after-free involving kfree_rcu(). The intent behind CONFIG_RCU_STRICT_GRACE_PERIOD is that RCU should invoke callbacks and free objects as soon as possible (at a large performance cost) so that kernel fuzzers and such have an easier time detecting use-after-free bugs in objects with RCU lifetime. CONFIG_KVFREE_RCU_BATCHED is a performance optimization that queues RCU-freed objects in ways that CONFIG_RCU_STRICT_GRACE_PERIOD can't expedite; for example, the following testcase doesn't trigger a KASAN splat when CONFIG_KVFREE_RCU_BATCHED is enabled: ``` struct foo_struct { struct rcu_head rcu; int a; }; struct foo_struct *foo = kmalloc(sizeof(*foo), GFP_KERNEL | __GFP_NOFAIL | __GFP_ZERO); pr_info("%s: calling kfree_rcu()\n", __func__); kfree_rcu(foo, rcu); msleep(10); pr_info("%s: start UAF access\n", __func__); READ_ONCE(foo->a); pr_info("%s: end UAF access\n", __func__); ``` Signed-off-by: Jann Horn Acked-by: David Rientjes Reviewed-by: Joel Fernandes Acked-by: Harry Yoo (Oracle) Link: https://patch.msgid.link/20260324-kasan-kfree-rcu-v1-1-ac58a7a13d03@google.com Signed-off-by: Vlastimil Babka (SUSE) commit 78842c1e3b05c1d5b7b32a33ccbfd5fcccc5557d Author: Tvrtko Ursulin Date: Mon Mar 16 09:38:09 2026 +0000 drm/gem: Improve drm_gem_objects_lookup() kerneldoc Make clear that the returned array has to be free using kvfree(). While at it, fix broken reference to non-existant @objs and allow for more error codes on failure. Signed-off-by: Tvrtko Ursulin Cc: Srinivasan Shanmugam Cc: Sunil Khatri Reviewed-by: Srinivasan Shanmugam Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260316093809.97267-1-tvrtko.ursulin@igalia.com [tursulin: fixup spelling] commit 9c171c36d83aa366aaa9d8e03e98a9a2108239c6 Author: Jun Nie Date: Thu Mar 12 16:28:12 2026 +0800 drm/msm/dpu: support plane splitting in quad-pipe case The content of every half of screen is sent out via one interface in dual-DSI case. The content for every interface is blended by a LM pair in quad-pipe case, thus a LM pair should not blend any content that cross the half of screen in this case. Clip plane into pipes per left and right half screen ROI if topology is quad pipe case. The clipped rectangle on every half of screen is futher handled by two pipes if its width exceeds a limit for a single pipe. For non-virtual-plane case, there is always one stage config to serve a LM or LM pair. So the clipping does not occur when interating stages in this case. The plane is mapped to 2 pipes only when width or clock rate exceeds hardware constrain within stage check. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/711324/ Link: https://lore.kernel.org/r/20260312-msm-next-quad-pipe-split-v19-3-4ffa2b06c996@linaro.org Signed-off-by: Dmitry Baryshkov commit 25ee1092775232626e2e85d68aaba97db0b1d51e Author: Jun Nie Date: Thu Mar 12 16:28:11 2026 +0800 drm/msm/dpu: Defer SSPP allocation until CRTC check Currently, mapping plane to SSPP occurs during the plane check phase for non-virtual plane case. The SSPP allocation and plane mapping occurs during CRTC check phase for virtual plane case. Defer these SSPP operations until CRTC check stage to unify the 2 cases, and ease later revisement for quad-pipe change. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/711322/ Link: https://lore.kernel.org/r/20260312-msm-next-quad-pipe-split-v19-2-4ffa2b06c996@linaro.org Signed-off-by: Dmitry Baryshkov commit febcd37fec129316eb96dafb0384e57d910f9508 Author: Jun Nie Date: Thu Mar 12 16:28:10 2026 +0800 drm/msm/dpu: Extract plane splitting into a dedicated function dpu_plane_atomic_check_nosspp() currently handles both plane validation and plane splitting. For better simplicity and to facilitate future refactoring, move the splitting logic into its own dedicated function. Reviewed-by: Dmitry Baryshkov Signed-off-by: Jun Nie Patchwork: https://patchwork.freedesktop.org/patch/711319/ Link: https://lore.kernel.org/r/20260312-msm-next-quad-pipe-split-v19-1-4ffa2b06c996@linaro.org Signed-off-by: Dmitry Baryshkov commit 3bd3d4999f6fbb53631d268af3cdf837601bb77c Author: Alexander Koskovich Date: Sun Mar 22 18:48:09 2026 +0000 drm/msm/dpu: calculate data_width like downstream Derive INTF data_width from dce_bytes_per_line rather than timing->width when DSC is enabled. Use DIV_ROUND_UP to avoid rounding errors. Signed-off-by: Alexander Koskovich Reviewed-by: Dmitry Baryshkov Tested-by: Pengyu Luo # Lenovo Legion Y700 Gen4 (SM8750) Patchwork: https://patchwork.freedesktop.org/patch/713333/ Link: https://lore.kernel.org/r/20260322-fix-data-width-calc-v2-1-d5f28136bc4e@pm.me Signed-off-by: Dmitry Baryshkov commit 54fcc7f6ec3944ae7c1b0246a999744e33839cdb Merge: ca76fb67ebdd5e 493ad070cbcb0d Author: Namhyung Kim Date: Wed Mar 25 00:06:23 2026 -0700 Merge tag 'perf-tools-fixes-for-v7.0-2-2026-03-23' into perf-tools-next To get the various fixes for v7.0. Signed-off-by: Namhyung Kim commit f63ddbcc3299047e7026b9324520aa826794f0c5 Author: Yury Norov Date: Tue Mar 3 15:08:41 2026 -0500 fpga: m10bmc-sec: switch show_canceled_csk() to using sysfs_emit() Switch show_canceled_csk() to use the proper sysfs_emit("%*pbl"). Reviewed-by: Russ Weight Suggested-by: Thomas Weißschuh Signed-off-by: Yury Norov [ Yilun: Remove unnecessary header file ] Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260303200842.124996-6-ynorov@nvidia.com Signed-off-by: Xu Yilun commit 7c5166fd79fcee30b29edc90a504d4a387f256ff Author: Dmitry Baryshkov Date: Fri Feb 27 20:36:46 2026 +0200 drm/msm/dpu: drop VBIF index from the struct dpu_hw_vbif Since we don't support and don't use VBIF_NRT, VBIF_RT is the only possible VBIF type. To simplify the driver, drop vbif_idx from the VBIF instance structure. As the last users of VBIF_RT and enum dpu_vbif are gone, drop them too. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/707779/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-7-2b97d0438182@oss.qualcomm.com commit 1ce61688875da281ab109bb143ec6ba756493c39 Author: Dmitry Baryshkov Date: Fri Feb 27 20:36:45 2026 +0200 drm/msm/dpu: drop VBIF index from the VBIF params Since we don't support and don't use VBIF_NRT, VBIF_RT is the only possible VBIF type. To simplify the driver, drop vbif_idx from the VBIF parameter structures. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/707783/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-6-2b97d0438182@oss.qualcomm.com commit 021fd8ca0cdcba3bf70601e04ea5aad22d1968b9 Author: Dmitry Baryshkov Date: Fri Feb 27 20:36:44 2026 +0200 drm/msm/dpu: drop vbif_idx from WB configuration All MDP / DPU implementations except for MSM8996 use VBIF_RT (or the only VBIF) for WB2. Writeback on MSM8996 is not supported (nor planned to be supported). In order to simplify the driver, drop the field form the struct dpu_wb_cfg. Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/707778/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-5-2b97d0438182@oss.qualcomm.com [DB: also handled Eliza platform] Signed-off-by: Dmitry Baryshkov commit b26bfb5bf1aaba9d1a8e8b729ec6ef352f47441e Author: Dmitry Baryshkov Date: Fri Feb 27 20:36:43 2026 +0200 drm/msm/dpu: drop VBIF id, base and name from the catalog For all the platforms VBIF id is VBIF_RT, the name and base are also fixed. Drop those fields from the catalog. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/707777/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-4-2b97d0438182@oss.qualcomm.com commit 014390e30a7456c9bbdf677427d2a8206ea46f62 Author: Dmitry Baryshkov Date: Fri Feb 27 20:36:42 2026 +0200 drm/msm/dpu: replace VBIF-related array with bare pointers As we no longer have multiple VBIF instances, it doesn't make sense to keep VBIF data as arrays. Drop the extra wrapping and keep only a single instance of each of the structures. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/707776/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-3-2b97d0438182@oss.qualcomm.com commit 2c0c3d9d95cac57e58f4e7171fe200a3fbd0cc82 Author: Dmitry Baryshkov Date: Fri Feb 27 20:36:41 2026 +0200 drm/msm/dpu: stop declaring VBIFs as an array in catalog The driver handles a single VBIF instance, VBIF_RT. Stop declaring VBIFs as an array in the DPU hardware catalog. Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/707774/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-2-2b97d0438182@oss.qualcomm.com [DB: handled Eliza platform] Signed-off-by: Dmitry Baryshkov commit cfb64b0926172b4a48db0005a868674fa6cb2d8f Author: Dmitry Baryshkov Date: Fri Feb 27 20:36:40 2026 +0200 drm/msm/dpu: drop VBIF_NRT handling The second VBIF instance, VBIF_NRT, is only used for the separate inline rotator block. It is unsupported by the DPU driver and will require a separate driver (or separate instance of the DPU device). The only possible user of VBIF_NRT is writeback on MSM8996, however writeback on that platform is currently unsupported and it's not worth keeping extra complexity for the sake of that single legacy platform. None of the hardware catalogs entries actually declare VBIF_NRT, so it is left in its default state. Stop pretending that DPU driver cares about VBIF_NRT and drop it. Reported-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/707773/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-1-2b97d0438182@oss.qualcomm.com commit 82159db4371f5cef56444ebd0b8f96e2a6d709ff Author: Pengyu Luo Date: Sat Mar 7 19:12:49 2026 +0800 drm/msm/dsi: fix hdisplay calculation for CMD mode panel Commit ac47870fd795 ("drm/msm/dsi: fix hdisplay calculation when programming dsi registers") incorrecly broke hdisplay calculation for CMD mode by specifying incorrect number of bytes per transfer, fix it. Fixes: ac47870fd795 ("drm/msm/dsi: fix hdisplay calculation when programming dsi registers") Signed-off-by: Pengyu Luo Patchwork: https://patchwork.freedesktop.org/patch/709917/ Link: https://lore.kernel.org/r/20260307111250.105772-2-mitltlatltl@gmail.com [DB: fixed commit message] Signed-off-by: Dmitry Baryshkov commit 2d51cfb77daa30b10bc68c403f8ace35783d2922 Author: Pengyu Luo Date: Sat Mar 7 19:12:48 2026 +0800 drm/msm/dsi: fix bits_per_pclk mipi_dsi_pixel_format_to_bpp return dst bpp not src bpp, dst bpp may not be the uncompressed data size. use src bpc * 3 to get src bpp, this aligns with pclk rate calculation. Fixes: ac47870fd795 ("drm/msm/dsi: fix hdisplay calculation when programming dsi registers") Signed-off-by: Pengyu Luo Patchwork: https://patchwork.freedesktop.org/patch/709916/ Link: https://lore.kernel.org/r/20260307111250.105772-1-mitltlatltl@gmail.com Signed-off-by: Dmitry Baryshkov commit 961c900628fef77ad07b4bc4c868e47b9a1269c7 Author: Cédric Bellegarde Date: Wed Mar 18 18:17:00 2026 +0100 drm/msm/dpu: fix vblank IRQ registration before atomic_mode_set dpu_encoder_toggle_vblank_for_crtc() can call control_vblank_irq() at any time in response to a userspace vblank request, independently of the atomic commit sequence. If this happens before the encoder's first atomic_mode_set(), irq[INTR_IDX_RDPTR] is still zero. Passing irq_idx=0 to dpu_core_irq_register_callback() is treated as invalid, and DPU_IRQ_REG(0) and DPU_IRQ_BIT(0) produce misleading values of 134217727 and 31 respectively due to unsigned wraparound in the (irq_idx - 1) macros, resulting in the confusing error: [dpu error]invalid IRQ=[134217727, 31] Since irq[INTR_IDX_RDPTR] will be properly populated by atomic_mode_set() and registered by irq_enable() as part of the normal modeset sequence, silently skip the vblank IRQ registration when the index has not yet been initialized. This matches the existing pattern of the master encoder check above it. Signed-off-by: Cédric Bellegarde Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/712752/ Link: https://lore.kernel.org/r/20260318171700.394945-1-cedric.bellegarde@adishatz.org Signed-off-by: Dmitry Baryshkov commit b9699dd862760e642807a2bc226e4d127e35dcb7 Author: Dmitry Baryshkov Date: Tue Mar 17 17:30:05 2026 +0200 drm/msm/dpu: don't try using 2 LMs if only one DSC is available Current topology code will try using 2 LMs with just one DSC, which breaks cases like SC7280 / Fairphone5. Forbid using 2 LMs split in such a case. Fixes: 1ce69c265a53 ("drm/msm/dpu: move resource allocation to CRTC") Reported-by: Luca Weiss Closes: https://lore.kernel.org/r/DH1IKLU0YZYU.2SW4WYO7H3H4R@fairphone.com/ Tested-by: Luca Weiss # qcm6490-fairphone-fp5 Patchwork: https://patchwork.freedesktop.org/patch/712386/ Link: https://lore.kernel.org/r/20260317-fix-3d-dsc-v1-1-88b54f62f659@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 536d2eb2bf8778f4097959bad64cc3735500c3b3 Author: Krzysztof Kozlowski Date: Wed Mar 11 21:17:29 2026 +0100 drm/msm/hdmi: Drop redundant 'int' for longs 'long' type is already an integer, so 'int' is redundant. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/711175/ Link: https://lore.kernel.org/r/20260311-drm-msm-hdmi-cleanup-v1-5-c5535245f6de@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit bc11794cfe00124f8e71da75ab66214948f77af4 Author: Krzysztof Kozlowski Date: Wed Mar 11 21:17:28 2026 +0100 drm/msm/hdmi: Consistently use u32 instead of uint32_t Linux coding style asks to use kernel types like u32 instead of uint32_t and code already has it in other places, so unify the remaining pieces. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/711172/ Link: https://lore.kernel.org/r/20260311-drm-msm-hdmi-cleanup-v1-4-c5535245f6de@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 69c68ab38d67c090ea7660f5f68bcb60d160774f Author: Krzysztof Kozlowski Date: Wed Mar 11 21:17:27 2026 +0100 drm/msm/hdmi: Simplify with local 'dev' variable msm_hdmi_dev_probe() function already stores pdev->dev in local variable, so use it directly to make code simpler. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/711171/ Link: https://lore.kernel.org/r/20260311-drm-msm-hdmi-cleanup-v1-3-c5535245f6de@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit ae505afd62f32045a575f57f43b24b3bb9ec6e54 Author: Krzysztof Kozlowski Date: Wed Mar 11 21:17:26 2026 +0100 drm/msm/hdmi: Avoid double error print on msm_hdmi_get_phy() failure msm_hdmi_get_phy() already prints error messages on each error path using dev_err_probe(), so final DRM_DEV_ERROR() would duplicate it and possibly flood the dmesg on probe deferrals. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/711168/ Link: https://lore.kernel.org/r/20260311-drm-msm-hdmi-cleanup-v1-2-c5535245f6de@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 5a9a712b0b0015b4a9f80699a9a3019a74e929e6 Author: Krzysztof Kozlowski Date: Wed Mar 11 21:17:25 2026 +0100 drm/msm/hdmi: Simplify with dev_of_node() Simplify chain of pointer dereferences with dev_of_node() which also checks if 'dev' argument is non-NULL. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/711167/ Link: https://lore.kernel.org/r/20260311-drm-msm-hdmi-cleanup-v1-1-c5535245f6de@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 8c6c93b7db42d15c6e8c2540a648d32986a04b1a Author: Krzysztof Kozlowski Date: Wed Mar 11 20:16:21 2026 +0100 drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames Commit 384d2b03d0a1 ("drm/msm/hdmi: make use of the drm_connector_hdmi framework") changed the unconditional register writes in few places to updates: read, apply mask, write. The new code reads REG_HDMI_INFOFRAME_CTRL1 register, applies fields/mask for HDMI_INFOFRAME_CTRL0 register and finally writes to HDMI_INFOFRAME_CTRL0. This difference between CTRL1 and CTRL0 looks unintended and may result in wrong data being written to HDMI bridge registers. Cc: Fixes: 384d2b03d0a1 ("drm/msm/hdmi: make use of the drm_connector_hdmi framework") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/711156/ Link: https://lore.kernel.org/r/20260311191620.245394-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit fdbc6391b4d8353865038ede74c9ed56bfb04e96 Author: Ben Dooks Date: Tue Mar 10 13:25:01 2026 +0000 drm/msm/hdmi: make 'msm_hdmi_pm_ops' static The struct 'msm_hdmi_pm_ops' is not used outside of the file it is defined in, so make it static. Fixes the following sparse warning: drivers/gpu/drm/msm/hdmi/hdmi.c:432:1: warning: symbol 'msm_hdmi_pm_ops' was not declared. Should it be static? Signed-off-by: Ben Dooks Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/710583/ Link: https://lore.kernel.org/r/20260310132501.195954-1-ben.dooks@codethink.co.uk Signed-off-by: Dmitry Baryshkov commit d19faa0dcc6abd35ed67084d8e31590a243f77c0 Author: Konrad Dybcio Date: Tue Mar 10 14:20:25 2026 +0100 drm/msm/mdss: Add a TODO for better managing the MDSS clock power state There's a small window where the MDP clock could be set to a high rate (say, from the bootloader) without a corresponding RPM(H)PD vote to back it up. This is normally not an issue, but could be, if rmmod fails to shut down the display driver cleanly, and the module is inserted again, or when the providers' .sync_state has timed out. Mark a TODO to fix it one day. Linking the relevant discussion below. Link: https://lore.kernel.org/linux-arm-msm/d5c4eed5-bd87-4156-b178-2d78140ec8a9@oss.qualcomm.com/ Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/710572/ Link: https://lore.kernel.org/r/20260310-topic-mdss_power_todo-v1-1-59457b8b7486@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 958adefc4c0fddee3b12269da5dd7cb49bac953f Author: Pengyu Luo Date: Mon Mar 9 18:02:53 2026 +0800 drm/msm/dsi: add the missing parameter description Add a description for is_bonded_dsi in dsi_adjust_pclk_for_compression to match the existing kernel-doc comment. Fixes: e4eb11b34d6c ("drm/msm/dsi: fix pclk rate calculation for bonded dsi") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603080314.XeqyRZ7A-lkp@intel.com/ Signed-off-by: Pengyu Luo Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/710112/ Link: https://lore.kernel.org/r/20260309100254.877801-1-mitltlatltl@gmail.com Signed-off-by: Dmitry Baryshkov commit bc1dccc518cc5ab5140fba06c27e7188e0ed342b Author: Yuanjie Yang Date: Mon Mar 9 14:37:20 2026 +0800 drm/msm/dpu: fix mismatch between power and frequency During DPU runtime suspend, calling dev_pm_opp_set_rate(dev, 0) drops the MMCX rail to MIN_SVS while the core clock frequency remains at its original (highest) rate. When runtime resume re-enables the clock, this may result in a mismatch between the rail voltage and the clock rate. For example, in the DPU bind path, the sequence could be: cpu0: dev_sync_state -> rpmhpd_sync_state cpu1: dpu_kms_hw_init timeline 0 ------------------------------------------------> t After rpmhpd_sync_state, the voltage performance is no longer guaranteed to stay at the highest level. During dpu_kms_hw_init, calling dev_pm_opp_set_rate(dev, 0) drops the voltage, causing the MMCX rail to fall to MIN_SVS while the core clock is still at its maximum frequency. When the power is re-enabled, only the clock is enabled, leading to a situation where the MMCX rail is at MIN_SVS but the core clock is at its highest rate. In this state, the rail cannot sustain the clock rate, which may cause instability or system crash. Remove the call to dev_pm_opp_set_rate(dev, 0) from dpu_runtime_suspend to ensure the correct vote is restored when DPU resumes. Fixes: b0530eb11913 ("drm/msm/dpu: Use OPP API to set clk/perf state") Signed-off-by: Yuanjie Yang Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/710077/ Link: https://lore.kernel.org/r/20260309063720.13572-1-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 6113aaf7a5ce2a29e7360bb3dede4781d5966b8d Author: Pengyu Luo Date: Sun Mar 8 14:48:34 2026 +0800 dt-bindings: display: msm: Document DSI controller and DSI PHY on SC8280XP Document DSI controller and DSI phy on SC8280XP platform. Signed-off-by: Pengyu Luo Reviewed-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/709947/ Link: https://lore.kernel.org/r/20260308064835.479356-4-mitltlatltl@gmail.com Signed-off-by: Dmitry Baryshkov commit 1607c084b18f697c06c28e46c3ee301875750fcc Author: Pengyu Luo Date: Sun Mar 8 14:48:33 2026 +0800 dt-bindings: display/msm: dsi-controller-main: Add SC8280XP Since SC8280XP and SA8775P have the same DSI version(2.5.1), then we fallback to SA8775P compatible. Signed-off-by: Pengyu Luo Reviewed-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/709944/ Link: https://lore.kernel.org/r/20260308064835.479356-3-mitltlatltl@gmail.com Signed-off-by: Dmitry Baryshkov commit 59f6bdf913ddc0d0cffbba0f4e6e7db79e37dc5e Author: Pengyu Luo Date: Sun Mar 8 14:48:32 2026 +0800 dt-bindings: display: msm-dsi-phy-7nm: Add SC8280XP Since SC8280XP and SA8775P have the same values for the REVISION_ID registers, then we fallback to SA8775P compatible. Signed-off-by: Pengyu Luo Reviewed-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/709943/ Link: https://lore.kernel.org/r/20260308064835.479356-2-mitltlatltl@gmail.com Signed-off-by: Dmitry Baryshkov commit 3e64e6959d8babd20d837b25bf93abf600fe4cb7 Author: Krzysztof Kozlowski Date: Wed Mar 4 13:58:50 2026 +0100 drm/msm/mdss: Add support for Eliza SoC Add support for the Qualcomm Eliza SoC platform. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/708874/ Link: https://lore.kernel.org/r/20260304-drm-display-eliza-v2-8-ea0579f62358@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 0eb707bbc7fc0b42601560e4fea0698d956a7a9a Author: Krzysztof Kozlowski Date: Wed Mar 4 13:58:49 2026 +0100 drm/msm/dpu: Add support for Eliza SoC Add support for DPU (v12.4) on Qualcomm Eliza SoC, with one incomplete/skipped part: HDMI interface (INT_4). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/708879/ Link: https://lore.kernel.org/r/20260304-drm-display-eliza-v2-7-ea0579f62358@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 0a40e2e91b21d3fd181b58e92d74154b765e6f9f Author: Krzysztof Kozlowski Date: Wed Mar 4 13:58:47 2026 +0100 dt-bindings: display/msm: qcom,eliza-mdss: Add Eliza SoC Add MDSS/MDP display subsystem for Qualcomm Eliza SoC, being overall a minor revision change against SM8750, but coming with few different components, like different DSI PHY, missing DP1 and added HDMI. The binding does not include HDMI description yet. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/708878/ Link: https://lore.kernel.org/r/20260304-drm-display-eliza-v2-5-ea0579f62358@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit df761873418ac306e835d76528279ad504ad3edb Author: Krzysztof Kozlowski Date: Wed Mar 4 13:58:46 2026 +0100 dt-bindings: display/msm: qcom,sm8650-dpu: Add Eliza SoC Add DPU (v12.4) for Qualcomm Eliza SoC which has noticeable differences against SM8750 (v12.0) of mostly removing blocks: - INTF_3 paired with INTF_0 (no DP1), - Removed CTL4-5 blocks, - Removed VIG2-3 and DMA4-5, - Removed LM4-7, DSPP3, PINGPONG4-7, MERGE4-5 and several DSC blocks, - Added HDMI interface. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/708872/ Link: https://lore.kernel.org/r/20260304-drm-display-eliza-v2-4-ea0579f62358@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit c01cca40073e01e480f034f9278f42aa02a7c567 Author: Krzysztof Kozlowski Date: Wed Mar 4 13:58:45 2026 +0100 dt-bindings: display/msm: dsi-controller-main: Add Eliza SoC Add DSI controller Qualcomm Eliza SoC using exactly the same block as SM8750. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/708867/ Link: https://lore.kernel.org/r/20260304-drm-display-eliza-v2-3-ea0579f62358@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 4a0172e8a4d98406f4a86be622a377ed62f42a77 Author: Krzysztof Kozlowski Date: Wed Mar 4 13:58:44 2026 +0100 dt-bindings: display/msm: dsi-phy-7nm: Add Eliza SoC Add DSI PHY 4nm v5.2.4 for the Qualcomm Eliza SoC, fully compatible with SM8650. Note that this DSI PHY, unlike the Eliza MDSS DSI, is not compatible with SM8750. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/708866/ Link: https://lore.kernel.org/r/20260304-drm-display-eliza-v2-2-ea0579f62358@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 069a1db1904fec20d74fc1387e47c4b9fd60426f Author: Krzysztof Kozlowski Date: Wed Mar 4 13:58:43 2026 +0100 dt-bindings: display/msm: dp-controller: Add Eliza SoC Add DisplayPort controller for Qualcomm Eliza SoC fully compatible with SM8650. The device looks very similar to SM8750 (same DP TX block v1.5.1) but with a differences in DP PHY: Eliza and SM8650 use DP PHY 4nm v7.0, SM8750 uses 3nm v8.0. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/708864/ Link: https://lore.kernel.org/r/20260304-drm-display-eliza-v2-1-ea0579f62358@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit a6f081ec4ce65b7097ec346099bd27b0226d5101 Author: Konrad Dybcio Date: Mon Mar 2 14:41:26 2026 +0100 drm/msm/mdp5: Remove MSM8974v1 To the best of my knowledge, the v1 version of this SoC had been superseded before any device was released on the market. Everywhere else in the kernel, there are assumptions about the SoC being revision 2 or the later MSM8974PRO. Remove the config for that flavor of MDP. To bring the naming in line with the rest of the kernel, remove the v2 suffix from the remaining config. Suggested-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/708112/ Link: https://lore.kernel.org/r/20260302-topic-goodnight_8974v1-v1-1-e0006f7a0526@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit b21e85400ce763f2c6ad913e03fea5cadc323c13 Author: Dmitry Baryshkov Date: Sat Feb 28 19:20:37 2026 +0200 drm/msm: add missing MODULE_DEVICE_ID definitions The drm/msm module bundles several drivers, each of them having a separate OF match table, however only MDSS (subsystem), KMS devices and GPU have corresponding MODULE_DEVICE_ID tables. Add MODULE_DEVICE_ID to the display-related driver and to all other drivers in this module, simplifying userspace job. Fixes: 060530f1ea67 ("drm/msm: use componentised device support") Reported-by: Loïc Minier Patchwork: https://patchwork.freedesktop.org/patch/707960/ Link: https://lore.kernel.org/r/20260228-msm-device-id-v2-1-24b085919444@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit b0907ee59e24d3dad572b4ccc6db018b00ca14c8 Author: Dmitry Baryshkov Date: Thu Feb 26 15:49:02 2026 +0200 drm/msm/dpu: enable virtual planes by default Turn on the switch and use virtual planes by default, enhancing utilisation of the display pipelines. It is still possible to use legacy implementation by using `msm.dpu_use_virtual_planes=false` kernel boot parameter. Acked-by: Neil Armstrong Acked-by: Konrad Dybcio Tested-by: Val Packett # x1e80100-dell-latitude-7455, Patchwork: https://patchwork.freedesktop.org/patch/707437/ Link: https://lore.kernel.org/r/20260226-dpu-enable-virt-planes-v2-1-87971236fe86@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit f86b08bf1766e9883bc75a66aeca7d737bf4c093 Author: Luca Coelho Date: Tue Mar 24 10:04:28 2026 +0200 drm/i915: move CNP clock gating init into intel_pch Move the CNP PCH clock gating programming into intel_pch_init_clock_gating() and switch the corresponding CFL/CML caller to the display-specific code. Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260324080441.154609-5-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit cf37495ad17db876c28a824c003133c2e103cd59 Author: Luca Coelho Date: Tue Mar 24 10:04:27 2026 +0200 drm/i915: move LPT clock gating init into intel_pch Move the LPT PCH clock gating programming into intel_pch_init_clock_gating() and switch the corresponding Haswell/Broadwell callers to the display-specific code. Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260324080441.154609-4-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit d129bce3fc820d8f2a4b966a38533b2f0f689ba5 Author: Luca Coelho Date: Tue Mar 24 10:04:26 2026 +0200 drm/i915: move CPT clock gating init into intel_pch Move the CPT PCH clock gating programming into intel_pch_init_clock_gating() and switch the corresponding IVB callers to the display-specific code. Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260324080441.154609-3-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit c80c68e777587330e5d89b4c294a32fe7365879c Author: Luca Coelho Date: Tue Mar 24 10:04:25 2026 +0200 drm/i915/display: move clock-gating init for IBX to display Add a new function in the display code to help initialize clock-gating without reading display PCH registers directly from non-display code. This adds a mini-framework to deal with display-specific PCH registers and uses it for IBX as a start. Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260324080441.154609-2-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit d8b034525fd9541f23c5a3c54cd1dbe716570e97 Author: Caleb James DeLisle Date: Thu Mar 12 16:24:49 2026 +0000 clk: airoha: Add econet EN751221 clock/reset support to en7523-scu EcoNet EN751221 clock/reset driver is significantly similar to the EN7523 / EN7581, however the EN751221 does not have a neat batch of clock divider registers so there are fewer known clocks, and the frequency of each clock is derived differently. This clock driver will probably work correctly on EN751627, EN7528, and EN7580. Signed-off-by: Caleb James DeLisle Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 35af99f7482673bf5f5391fd33caf266f4f62aeb Author: Caleb James DeLisle Date: Thu Mar 12 16:24:48 2026 +0000 dt-bindings: clock, reset: Add econet EN751221 Add clock and reset bindings for EN751221 as well as a "chip-scu" which is an additional regmap that is used by the clock driver as well as others. This split of the SCU across two register areas is the same as the Airoha AN758x family. Signed-off-by: Caleb James DeLisle Reviewed-by: Rob Herring (Arm) Signed-off-by: Stephen Boyd commit 60d4b17e886a90e707eaa06f8b07539f603cec5b Author: Zqiang Date: Wed Mar 25 11:11:00 2026 +0800 sched_ext: Choose the right sch->ops.name to output in the print_scx_info() The print_scx_info() always output scx_root structure's->ops.name, but for built with CONFIG_EXT_SUB_SCHED=y kernels, the tasks may be attach an sub scx_sched structure. this commit therefore use the scx_task_sched_rcu() to correctly get scx_sched structure to output ops.name, and drop state check. Suggested-by: Tejun Heo Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit 03bf327434456c3bde003509d57169ea1ebbe9a3 Author: Dmitry Torokhov Date: Sat Aug 17 19:02:31 2024 -0700 Input: msg2638 - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit 11a64d6bb70bad120468f39ba1358b449dca4167 Author: Dmitry Torokhov Date: Fri Aug 16 13:56:28 2024 -0700 Input: mms114 - use guard notation when acquiring mutex Guard notation simplifies code. Also stop trying to check if input device is opened/in use in the interrupt handler - the interrupt is disabled when device is closed or suspended. Signed-off-by: Dmitry Torokhov commit 7e1e5722e859e6624c9509a55d1f302b44d1853b Author: Dmitry Torokhov Date: Sun Sep 1 16:11:38 2024 -0700 Input: mk712 - use guard notation when acquiring spinlock Using guard notation makes the code more compact and error handling more robust by ensuring that locks are released in all code paths when control leaves critical section. Signed-off-by: Dmitry Torokhov commit 8e4ae01d84cd0879636c333e0707c86074b00405 Author: Dmitry Torokhov Date: Wed May 29 11:58:26 2024 -0700 Input: melfas_mip4 - switch to using cleanup functions Start using __free() and guard() primitives to simplify the code and error handling. Signed-off-by: Dmitry Torokhov commit a00a9fad1c05293859c25b30621dde0f34290121 Author: Dmitry Torokhov Date: Fri Aug 16 14:11:25 2024 -0700 Input: lpc32xx_ts - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit 3092610fdc62b798f648b6de59a83ecd70315913 Author: Dmitry Torokhov Date: Wed Aug 21 15:48:31 2024 -0700 Input: iqs7211 - use cleanup facility for fwnodes Use __free(fwnode_handle) cleanup facility to ensure that references to acquired fwnodes are dropped at appropriate times automatically. Signed-off-by: Dmitry Torokhov commit 3b5e7a62651ec2c1a8b515ffec14cd7262dda4a7 Author: Dmitry Torokhov Date: Mon Apr 28 17:53:02 2025 -0700 Input: iqs5xx - simplify parsing of firmware blob Do not define or use iqs5xx_ihex_rec structure: the original code was using just a couple of fields in it and instead used it to calculate offset to record data. The data field was actually reserving space for checksum. Instead iterate through fields and advance pointer explicitly. Signed-off-by: Dmitry Torokhov commit 582f32aa89e66ab1e16aab157fdd483b5acc86fa Author: Dmitry Torokhov Date: Tue Jan 16 13:52:33 2024 -0800 Input: iqs5xx - switch to using cleanup functions Start using __free() and guard() primitives to simplify the code and error handling. Signed-off-by: Dmitry Torokhov commit f1324109d1a41125815eb4bd1666c6b02a3ac7d4 Author: Dmitry Torokhov Date: Sat Aug 17 19:01:18 2024 -0700 Input: ipaq-micro-ts - use guard notation when acquiring mutex/spinlock Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit 445dcfc7f676842994eb7f011924ff0e3a90c13b Author: Dmitry Torokhov Date: Sat Aug 17 19:00:21 2024 -0700 Input: imx6ul_tsc - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit d2862b87add9966bc23af73a033f27a296bdbb55 Author: Dmitry Torokhov Date: Sat Aug 17 18:58:22 2024 -0700 Input: imagis - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit ded32cc611ef48a47d1ff6d424151e3d0c82a3a8 Author: Dmitry Torokhov Date: Sat Aug 17 18:55:08 2024 -0700 Input: hycon-hy46xx - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit 5568c1aeb33b008b1f643b1fa16360cdb6ccadf7 Author: Dmitry Torokhov Date: Tue Jan 16 11:35:26 2024 -0800 Input: hideep - switch to using cleanup functions Start using __free() and guard() primitives to simplify the code and error handling. Signed-off-by: Dmitry Torokhov commit 777f5b42f895a1c3693ec4968023d02722acdd7c Author: Dmitry Torokhov Date: Wed May 29 14:43:30 2024 -0700 Input: goodix - switch to using cleanup functions in firmware code Start using __free(firmware) to simplify the code and error handling. Signed-off-by: Dmitry Torokhov commit 576c99f1a34da9618a5df8ed8648f2beee7e5411 Author: Dmitry Torokhov Date: Sat Aug 17 17:26:09 2024 -0700 Input: exc3000 - use guard notation when acquiring mutex Guard notation simplifies code. Note that callers of exc3000_vendor_data_request() always expect response, so it was adjusted to always wait for it. Signed-off-by: Dmitry Torokhov commit cec3bcec6fd54cd1bdcb8786ca661912d879d399 Author: Dmitry Torokhov Date: Sat Aug 17 17:20:30 2024 -0700 Input: elo - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit e5c79d9f65a1211c56a41ca27136c985842fb1b5 Author: Dmitry Torokhov Date: Thu Jun 6 23:32:05 2024 -0700 Input: elants_i2c - switch to using cleanup facilities Start using __free() and guard() primitives to simplify the code and error handling. Signed-off-by: Dmitry Torokhov commit 8c187a4c1592c483e95fc14fb800272cb41395a4 Author: Dmitry Torokhov Date: Sat Aug 17 17:17:10 2024 -0700 Input: ektf2127 - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit 6e9b9192d69d5d206afc502a06569a1650e41ef0 Author: Dmitry Torokhov Date: Sun Jun 30 19:26:14 2024 -0700 Input: eeti_ts - use guard notation when acquiring mutexes This makes the code more compact and error handling more robust. Signed-off-by: Dmitry Torokhov commit df2e75e070a82fc02eac99743d0823972da293b1 Author: Dmitry Torokhov Date: Sat Aug 17 17:05:00 2024 -0700 Input: edt-ft5x06 - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit a0a92414af42b79f4e2829adfd55478a8e74eb33 Author: Dmitry Torokhov Date: Sat Aug 17 17:14:57 2024 -0700 Input: cyttsp - use guard notation when acquiring mutex Guard notation simplifies code. Also fix the touchscreen not being marked as suspended when noone has opened/is using it. Signed-off-by: Dmitry Torokhov commit 37115e7df5d0e75c661aa65f7ac9fa0991759c6d Author: Dmitry Torokhov Date: Sat Aug 17 17:10:01 2024 -0700 Input: chipone_icn8318 - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit b29be7bae37086fa04ffc52d6f1d761e5be811a3 Author: Dmitry Torokhov Date: Sat Aug 17 17:08:28 2024 -0700 Input: bu21029_ts - use guard notation when acquiring mutex Guard notation simplifies code. Signed-off-by: Dmitry Torokhov commit 24b3bc4a8f1bf90d742de14b664845deba2e52ab Author: Dmitry Torokhov Date: Sun Jun 30 22:51:52 2024 -0700 Input: auo-pixcir-ts - use guard notation when acquiring mutexes This makes the code more compact and error handling more robust. Signed-off-by: Dmitry Torokhov commit d911a55b29bc393cccdd9236bbbd7333eaeafe3c Author: Dmitry Torokhov Date: Wed May 29 14:37:21 2024 -0700 Input: atmel_mxt_ts - switch to using cleanup functions Start using __free() and guard() primitives to simplify the code and error handling. Signed-off-by: Dmitry Torokhov commit d77c45c8f0fd6a8cbbcaceb181633c092856f1c7 Author: Dmitry Torokhov Date: Sun Jun 30 22:47:44 2024 -0700 Input: ads7846 - switch to using cleanup functions Start using __free() and guard() primitives to simplify the code and error handling. Signed-off-by: Dmitry Torokhov commit ab2a8300179b80c7d05b460cbf319cd56c0eaf4d Author: Dmitry Torokhov Date: Sun Jun 30 22:40:19 2024 -0700 Input: ad7879 - use guard notation when acquiring mutexes This makes the code more compact and error handling more robust. Signed-off-by: Dmitry Torokhov commit f3488759a5c141d68a8660d1ca858353e97994a1 Author: Dmitry Torokhov Date: Sun Jun 30 22:30:26 2024 -0700 Input: ad7877 - use guard notation when acquiring mutexes/locks This makes the code more compact and error handling more robust. Signed-off-by: Dmitry Torokhov commit a96ef5848cb096226bf6aff31a90d8b136d99b71 Author: Ryan Roberts Date: Tue Mar 3 15:08:39 2026 +0000 randomize_kstack: Unify random source across arches Previously different architectures were using random sources of differing strength and cost to decide the random kstack offset. A number of architectures (loongarch, powerpc, s390, x86) were using their timestamp counter, at whatever the frequency happened to be. Other arches (arm64, riscv) were using entropy from the crng via get_random_u16(). There have been concerns that in some cases the timestamp counters may be too weak, because they can be easily guessed or influenced by user space. And get_random_u16() has been shown to be too costly for the level of protection kstack offset randomization provides. So let's use a common, architecture-agnostic source of entropy; a per-cpu prng, seeded at boot-time from the crng. This has a few benefits: - We can remove choose_random_kstack_offset(); That was only there to try to make the timestamp counter value a bit harder to influence from user space [*]. - The architecture code is simplified. All it has to do now is call add_random_kstack_offset() in the syscall path. - The strength of the randomness can be reasoned about independently of the architecture. - Arches previously using get_random_u16() now have much faster syscall paths, see below results. [*] Additionally, this gets rid of some redundant work on s390 and x86. Before this patch, those architectures called choose_random_kstack_offset() under arch_exit_to_user_mode_prepare(), which is also called for exception returns to userspace which were *not* syscalls (e.g. regular interrupts). Getting rid of choose_random_kstack_offset() avoids a small amount of redundant work for the non-syscall cases. In some configurations, add_random_kstack_offset() will now call instrumentable code, so for a couple of arches, I have moved the call a bit later to the first point where instrumentation is allowed. This doesn't impact the efficacy of the mechanism. There have been some claims that a prng may be less strong than the timestamp counter if not regularly reseeded. But the prng has a period of about 2^113. So as long as the prng state remains secret, it should not be possible to guess. If the prng state can be accessed, we have bigger problems. Additionally, we are only consuming 6 bits to randomize the stack, so there are only 64 possible random offsets. I assert that it would be trivial for an attacker to brute force by repeating their attack and waiting for the random stack offset to be the desired one. The prng approach seems entirely proportional to this level of protection. Performance data are provided below. The baseline is v6.18 with rndstack on for each respective arch. (I)/(R) indicate statistically significant improvement/regression. arm64 platform is AWS Graviton3 (m7g.metal). x86_64 platform is AWS Sapphire Rapids (m7i.24xlarge): +-----------------+--------------+---------------+---------------+ | Benchmark | Result Class | per-cpu-prng | per-cpu-prng | | | | arm64 (metal) | x86_64 (VM) | +=================+==============+===============+===============+ | syscall/getpid | mean (ns) | (I) -9.50% | (I) -17.65% | | | p99 (ns) | (I) -59.24% | (I) -24.41% | | | p99.9 (ns) | (I) -59.52% | (I) -28.52% | +-----------------+--------------+---------------+---------------+ | syscall/getppid | mean (ns) | (I) -9.52% | (I) -19.24% | | | p99 (ns) | (I) -59.25% | (I) -25.03% | | | p99.9 (ns) | (I) -59.50% | (I) -28.17% | +-----------------+--------------+---------------+---------------+ | syscall/invalid | mean (ns) | (I) -10.31% | (I) -18.56% | | | p99 (ns) | (I) -60.79% | (I) -20.06% | | | p99.9 (ns) | (I) -61.04% | (I) -25.04% | +-----------------+--------------+---------------+---------------+ I tested an earlier version of this change on x86 bare metal and it showed a smaller but still significant improvement. The bare metal system wasn't available this time around so testing was done in a VM instance. I'm guessing the cost of rdtsc is higher for VMs. Acked-by: Mark Rutland Signed-off-by: Ryan Roberts Link: https://patch.msgid.link/20260303150840.3789438-3-ryan.roberts@arm.com Signed-off-by: Kees Cook commit 37beb42560165869838e7d91724f3e629db64129 Author: Ryan Roberts Date: Tue Mar 3 15:08:38 2026 +0000 randomize_kstack: Maintain kstack_offset per task kstack_offset was previously maintained per-cpu, but this caused a couple of issues. So let's instead make it per-task. Issue 1: add_random_kstack_offset() and choose_random_kstack_offset() expected and required to be called with interrupts and preemption disabled so that it could manipulate per-cpu state. But arm64, loongarch and risc-v are calling them with interrupts and preemption enabled. I don't _think_ this causes any functional issues, but it's certainly unexpected and could lead to manipulating the wrong cpu's state, which could cause a minor performance degradation due to bouncing the cache lines. By maintaining the state per-task those functions can safely be called in preemptible context. Issue 2: add_random_kstack_offset() is called before executing the syscall and expands the stack using a previously chosen random offset. choose_random_kstack_offset() is called after executing the syscall and chooses and stores a new random offset for the next syscall. With per-cpu storage for this offset, an attacker could force cpu migration during the execution of the syscall and prevent the offset from being updated for the original cpu such that it is predictable for the next syscall on that cpu. By maintaining the state per-task, this problem goes away because the per-task random offset is updated after the syscall regardless of which cpu it is executing on. Fixes: 39218ff4c625 ("stack: Optionally randomize kernel stack offset each syscall") Closes: https://lore.kernel.org/all/dd8c37bc-795f-4c7a-9086-69e584d8ab24@arm.com/ Cc: stable@vger.kernel.org Acked-by: Mark Rutland Signed-off-by: Ryan Roberts Link: https://patch.msgid.link/20260303150840.3789438-2-ryan.roberts@arm.com Signed-off-by: Kees Cook commit d1e59a46973719e458bec78d00dd767d7a7ba71f Author: Eric Dumazet Date: Mon Mar 23 23:49:20 2026 +0000 tcp: add cwnd_event_tx_start to tcp_congestion_ops (tcp_congestion_ops)->cwnd_event() is called very often, with @event oscillating between CA_EVENT_TX_START and other values. This is not branch prediction friendly. Provide a new cwnd_event_tx_start pointer dedicated for CA_EVENT_TX_START. Both BBR and CUBIC benefit from this change, since they only care about CA_EVENT_TX_START. No change in kernel size: $ scripts/bloat-o-meter -t vmlinux.0 vmlinux add/remove: 4/4 grow/shrink: 3/1 up/down: 564/-568 (-4) Function old new delta bbr_cwnd_event_tx_start - 450 +450 cubictcp_cwnd_event_tx_start - 70 +70 __pfx_cubictcp_cwnd_event_tx_start - 16 +16 __pfx_bbr_cwnd_event_tx_start - 16 +16 tcp_unregister_congestion_control 93 99 +6 tcp_update_congestion_control 518 521 +3 tcp_register_congestion_control 422 425 +3 __tcp_transmit_skb 3308 3306 -2 __pfx_cubictcp_cwnd_event 16 - -16 __pfx_bbr_cwnd_event 16 - -16 cubictcp_cwnd_event 80 - -80 bbr_cwnd_event 454 - -454 Total: Before=25240512, After=25240508, chg -0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260323234920.1097858-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 112f4c6320070b19e7d49cba758400adc279e377 Author: Bobby Eshleman Date: Mon Mar 23 17:08:10 2026 -0700 selftests: drv-net: add missing tc config options for netkit tests The NetDrvContEnv env context uses tc clsact qdiscs and BPF tc filters for traffic redirection, but the kernel config options are missing from the selftests config. Without them, the tc qdisc installation trips on: CMD: tc qdisc add dev enp1s0 clsact EXIT: 2 STDERR: Error: Specified qdisc kind is unknown. net.lib.py.utils.CmdExitFailure: Command failed Add CONFIG_NET_CLS_ACT and CONFIG_NET_SCH_INGRESS to enable these tc options. Fixes: 3f74d5bb807e ("selftests/net: Add env for container based tests") Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260323-config-fixes-for-nk-tests-v2-1-6c505d83e52d@meta.com Signed-off-by: Jakub Kicinski commit 864ee4eed2d8f9f713e5c2ec5c4ec960d04f7b41 Merge: 10171b938330f6 7c20f6c1cfb15a Author: Jakub Kicinski Date: Tue Mar 24 20:47:24 2026 -0700 Merge branch 'net-dsa-mxl862xx-mdio-bus-integrity-and-optimization' Daniel Golle says: ==================== net: dsa: mxl862xx: MDIO bus integrity and optimization The MxL862xx firmware offers opt-in CRC validation on the MDIO/MMD command interface to guard against bit errors on the bus. The driver has not used this until now. This series enables CRC protection on both the command registers (CRC-6) and data payloads (CRC-16), and reduces MDIO bus traffic by bulk-zeroing registers instead of writing zero-valued words individually. ==================== Link: https://patch.msgid.link/cover.1774185953.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 7c20f6c1cfb15ad6adc9a312973a48113cbf49f0 Author: Daniel Golle Date: Sun Mar 22 13:27:26 2026 +0000 net: dsa: mxl862xx: use RST_DATA to skip writing zero words Issue the firmware's RST_DATA command before writing data payloads that contain many zero words. RST_DATA zeroes both the firmware's internal buffer and the MMD data registers in a single command, allowing the driver to skip individual MDIO writes for zero-valued words. This reduces bus traffic for the common case where API structs have many unused or default-zero fields. The optimization is applied when at least 5 zero words are found in the payload, roughly the break-even point against the cost of the extra RST_DATA command round-trip. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/d10bd6ad5df062d0da342c3e0d330550b3d2432b.1774185953.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit a319d0c8c8cede3b63538c9f111f84651d078bf6 Author: Daniel Golle Date: Sun Mar 22 13:27:20 2026 +0000 net: dsa: mxl862xx: add CRC for MDIO communication Enable the firmware's opt-in CRC validation on the MDIO/MMD command interface to detect bit errors on the bus. The firmware bundles CRC-6 and CRC-16 under a single enable flag, so both are implemented together. CRC-6 protects the ctrl and len_ret command registers using a table- driven 3GPP algorithm. It is applied to every command exchange including SET_DATA/GET_DATA batch transfers. With CRC enabled, the firmware encodes its return value as a signed 11-bit integer within the CRC- protected register fields, replacing the previous 16-bit interpretation. CRC-16 protects the data payload using the kernel's crc16() library. The driver appends a CRC-16 checksum to outgoing data and verifies the firmware-appended checksum on responses. The checksum is placed at the exact byte offset where the struct data ends, correctly handling packed structs with odd sizes by splitting the checksum across word boundaries. SET_DATA/GET_DATA sub-commands carry only CRC-6. Upon detection of a CRC error on either side all conduit interfaces are taken down, triggering all user ports to go down as well. This is the most feasible option: CRC errors are likely caused either by broken hardware, or are symptom of overheating. In either case, trying to resume normal operation isn't reasonable. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/620453b9a150bbe5b7ea4224331cb5dc5e57263b.1774185953.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 10171b938330f6e625e7dc8dd24a15cc96218172 Author: Maxime Chevallier Date: Mon Mar 23 10:58:32 2026 +0100 net: ethtool: pass genl_info to the ethnl parse_request operation The .parse_request() ethnl operation extracts the relevant attributes from the netlink request to populate the private req_info. By passing genl_info as a parameter to this callback, we can use the GENL_REQ_ATTR_CHECK() macro to check for missing mandatory parameters. This macro has the advantage of returning a better error explanation through the netlink_ext_ack struct. Convert the eeprom ethnl code to this macro, as it's the only command yet that has mandatory request parameters. Suggested-by: Jakub Kicinski Signed-off-by: Maxime Chevallier Link: https://patch.msgid.link/20260323095833.136266-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 824d679941c9bf098214e8fbacbce9b7213e07ce Author: Hugo Villeneuve Date: Mon Mar 23 10:00:21 2026 -0400 dt-bindings: input: matrix-keymap: fix key board wording The correct wording is keyboard, without a space. Signed-off-by: Hugo Villeneuve Link: https://patch.msgid.link/20260323140024.104475-1-hugo@hugovil.com Signed-off-by: Dmitry Torokhov commit c196276f7809ac89743e6de61262c1b4b84f78d0 Author: Arnd Bergmann Date: Mon Mar 16 22:56:32 2026 +0100 drm/bridge: lt8713sx: avoid 64-bit division On 32-bit kernels, 64-bit integers cannot be passed to the division operator: ld.lld-22: error: undefined symbol: __aeabi_uldivmod >>> referenced by lontium-lt8713sx.c >>> drivers/gpu/drm/bridge/lontium-lt8713sx.o:(lt8713sx_firmware_store) in archive vmlinux.a Since this is a constant number used to divide a size_t, just change the type to that as well. Fixes: 4037c6adc1f9 ("drm/bridge: add support for lontium lt8713sx bridge driver") Signed-off-by: Arnd Bergmann Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260316215920.1993390-1-arnd@kernel.org Signed-off-by: Dmitry Baryshkov commit 9a9d5ceff9581c92e4758f736dc8e96c22fe643d Author: Arnd Bergmann Date: Wed Mar 18 11:51:15 2026 +0100 drm/bridge: lt8713sx select CONFIG_CRC8 CRC8 needs to be enabled for lt8713sx to build: ld.lld-22: error: undefined symbol: crc8_populate_msb >>> referenced by lontium-lt8713sx.c >>> drivers/gpu/drm/bridge/lontium-lt8713sx.o:(lt8713sx_probe) in archive vmlinux.a Fixes: 4037c6adc1f9 ("drm/bridge: add support for lontium lt8713sx bridge driver") Signed-off-by: Arnd Bergmann Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260318105130.1969966-1-arnd@kernel.org Signed-off-by: Dmitry Baryshkov commit 23d1cfc0216e28140cb0c914814c03d127a3ad6e Author: Steven Rostedt Date: Mon Mar 23 20:22:12 2026 -0400 ring-buffer: Show what clock function is used on timestamp errors The testing for tracing was triggering a timestamp count issue that was always off by one. This has been happening for some time but has never been reported by anyone else. It was finally discovered to be an issue with the "uptime" (jiffies) clock that happened to be traced and the internal recursion caused the discrepancy. This would have been much easier to solve if the clock function being used was displayed when the error was detected. Add the clock function to the error output. Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260323202212.479bb288@gandalf.local.home Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit dc1d9408c961c1c4d4b3b99a1d9390c17e13de71 Merge: a717943d8ecc0e f35dbac6942171 Author: Steven Rostedt Date: Tue Mar 24 22:19:13 2026 -0400 Merge commit 'f35dbac6942171dc4ce9398d1d216a59224590a9' into trace/ring-buffer/core The commit f35dbac69421 ("ring-buffer: Fix to update per-subbuf entries of persistent ring buffer") was a fix and merged upstream. It is needed for some other work in the ring buffer. The current branch has the remote buffer code that is shared with the Arm64 subsystem and can't be rebased. Merge in the upstream commit to allow continuing of the ring buffer work. Signed-off-by: Steven Rostedt (Google) commit 858f6273cf003e97c817903a07d8001b483fe40b Author: Xuyang Dong Date: Tue Mar 3 16:07:29 2026 +0800 MAINTAINERS: Add entry for ESWIN EIC7700 clock driver Add myself as maintainer of ESWIN EIC7700 clock driver Tested-by: Marcel Ziswiler # ebc77 Reviewed-by: Brian Masney Signed-off-by: Xuyang Dong Signed-off-by: Stephen Boyd commit cd44f127c1d42833a32ba0a0965255ee6184f8c1 Author: Xuyang Dong Date: Tue Mar 3 16:07:12 2026 +0800 clk: eswin: Add eic7700 clock driver Add clock drivers for the EIC7700 SoC. The clock controller on the ESWIN EIC7700 provides various clocks to different IP blocks within the SoC. Signed-off-by: Yifeng Huang Tested-by: Marcel Ziswiler # ebc77 Reviewed-by: Brian Masney Signed-off-by: Xuyang Dong Tested-by: Bo Gan # hfp550 Signed-off-by: Stephen Boyd commit 8add6d87dc69c0620c7e60bdc6be6b3b0092d9fa Author: Xuyang Dong Date: Tue Mar 3 16:06:55 2026 +0800 clk: divider: Add devm_clk_hw_register_divider_parent_data Add the devres variant of clk_hw_register_divider_parent_data() for registering a divider clock with parent clk data instead of parent name. Reviewed-by: Brian Masney Signed-off-by: Xuyang Dong Signed-off-by: Stephen Boyd commit 1fb83132603c7c7c1b9431c4e98194a233613a2a Author: Xuyang Dong Date: Tue Mar 3 16:06:37 2026 +0800 dt-bindings: clock: eswin: Documentation for eic7700 SoC Add device tree binding documentation for the ESWIN eic7700 clock controller module. Signed-off-by: Yifeng Huang Acked-by: Conor Dooley Acked-by: Troy Mitchell Tested-by: Marcel Ziswiler # ebc77 Signed-off-by: Xuyang Dong Signed-off-by: Stephen Boyd commit 18417122d6a461a78417784e8f21fab517b39b94 Author: Pengyu Luo Date: Thu Feb 26 20:29:58 2026 +0800 drm/msm/dsi/phy: rename DSI_PHY_7NM_QUIRK_PRE_V4_1 to DSI_PHY_7NM_QUIRK_V4_0 The quirk flag DSI_PHY_7NM_QUIRK_PRE_V4_1 is renamed to DSI_PHY_7NM_QUIRK_V4_0 to better reflect the actual hardware revision it applies to. (Only SM8150 uses it, its hardware revision is 4.0) No functional change. Suggested-by: Dmitry Baryshkov Signed-off-by: Pengyu Luo Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/707416/ Link: https://lore.kernel.org/r/20260226122958.22555-3-mitltlatltl@gmail.com Signed-off-by: Dmitry Baryshkov commit 672299736af6c398e867782708b7400957e62c76 Author: Maíra Canal Date: Thu Mar 12 18:34:23 2026 -0300 clk: bcm: rpi: Manage clock rate in prepare/unprepare callbacks On current firmware versions, RPI_FIRMWARE_SET_CLOCK_STATE doesn't actually power off the clock. To achieve meaningful power savings, the clock rate must be set to the minimum before disabling. This might be fixed in future firmware releases. Rather than pushing rate management to clock consumers, handle it directly in the clock framework's prepare/unprepare callbacks. In unprepare, set the rate to the minimum before disabling the clock. In prepare, for clocks marked with `maximize` (currently v3d), restore the rate to the maximum after enabling. Signed-off-by: Maíra Canal Reviewed-by: Maxime Ripard Signed-off-by: Stephen Boyd commit 7fe04c7c4360d2e7fb85fbe88cbd9b35a4d730ea Author: Dmitry Baryshkov Date: Mon Jan 12 05:23:31 2026 +0200 drm/msm/dpu: use full scale alpha in _dpu_crtc_setup_blend_cfg() Both _dpu_crtc_setup_blend_cfg() and setup_blend_config_alpha() callbacks embed knowledge about platform's alpha range (8-bit or 10-bit). Make _dpu_crtc_setup_blend_cfg() use full 16-bit values for alpha and reduce alpha only in DPU-specific callbacks. Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/697898/ Link: https://lore.kernel.org/r/20260112-dpu-rework-alpha-v2-2-d168785911d5@oss.qualcomm.com commit eef07fd9aa5ba56aad4d803021c9b21d61db89a3 Author: Dmitry Baryshkov Date: Mon Jan 12 05:23:30 2026 +0200 drm/msm/dpu: simplify bg_alpha selection In order to be more obvious in fg_alpha / bg_alpha handling during the blending programming drop the default setting for background alpha value and set it explicitly in all cases. Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/697896/ Link: https://lore.kernel.org/r/20260112-dpu-rework-alpha-v2-1-d168785911d5@oss.qualcomm.com commit 731c634ea95ebf2eb0162174f14c6f341c44f71e Author: Bhushan Shah Date: Sat Mar 14 20:27:58 2026 +0530 dt-bindings: input: touchscreen: edt-ft5x06: Add FocalTech FT3519 Document FocalTech FT3519 support by adding the compatible. It's 10 point touchscreen, which is compatible with FT3518 Signed-off-by: Bhushan Shah Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260314-edt-ft3519-v3-1-5ee91b408ed6@machinesoul.in Signed-off-by: Dmitry Torokhov commit 59b026da003831babb77d5155e82342bce226079 Author: Rosen Penev Date: Fri Mar 20 20:42:27 2026 -0700 HSI: cmt_speech: fix wrong printf format sizeof returns size_t. Use the zu specifier for it. Fixes on x86-64: error: format ‘%u’ expects argument of type ‘unsigned int’, but argument 5 has type ‘long unsigned int’ [-Werror=format=] Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260321034227.3900-1-rosenp@gmail.com Signed-off-by: Sebastian Reichel commit 3416431ed281e1d9c729c66e0509803d3fcc5041 Author: Rosen Penev Date: Fri Mar 20 20:41:17 2026 -0700 HSI: omap_ssi_port: remove null check from FAM A flexible array member is never NULL. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603210057.1LRz5tNA-lkp@intel.com/ Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260321034117.3746-1-rosenp@gmail.com Signed-off-by: Sebastian Reichel commit dff8302ca1d0e773c90dbeeb05e759f995c95482 Author: Timur Tabi Date: Thu Mar 19 16:26:58 2026 -0500 gpu: nova-core: create GSP-RM logging buffers debugfs entries Create read-only debugfs entries for LOGINIT, LOGRM, and LOGINTR, which are the three primary printf logging buffers from GSP-RM. LOGPMU will be added at a later date, as it requires support for its RPC message first. This patch uses the `pin_init_scope` feature to create the entries. `pin_init_scope` solves the lifetime issue over the `DEBUGFS_ROOT` reference by delaying its acquisition until the time the entry is actually initialized. Co-developed-by: Alexandre Courbot Signed-off-by: Alexandre Courbot Signed-off-by: Timur Tabi Tested-by: John Hubbard Tested-by: Eliot Courtney Link: https://patch.msgid.link/20260319212658.2541610-7-ttabi@nvidia.com [ Rebase onto Coherent changes. - Danilo ] Signed-off-by: Danilo Krummrich commit 09691f5d807065a1d3d3042e2d8c2e0c170d7711 Author: Timur Tabi Date: Thu Mar 19 16:26:57 2026 -0500 gpu: nova-core: create debugfs root in module init Create the 'nova_core' root debugfs entry when the driver loads. Normally, non-const global variables need to be protected by a mutex. Instead, we use unsafe code, as we know the entry is never modified after the driver is loaded. This solves the lifetime issue of the mutex guard, which would otherwise have required the use of `pin_init_scope`. Signed-off-by: Timur Tabi Reviewed-by: Gary Guo Reviewed-by: Alexandre Courbot Tested-by: John Hubbard Tested-by: Eliot Courtney Link: https://patch.msgid.link/20260319212658.2541610-6-ttabi@nvidia.com Signed-off-by: Danilo Krummrich commit ea0c83806f790de0b3441ddebbbcfd82196d6cce Author: Timur Tabi Date: Thu Mar 19 16:26:56 2026 -0500 gpu: nova-core: Replace module_pci_driver! with explicit module init Replace the module_pci_driver! macro with an explicit module initialization using the standard module! macro and InPlaceModule trait implementation. No functional change intended, with the exception that the driver now prints a message when loaded. This change is necessary so that we can create a top-level "nova_core" debugfs entry when the driver is loaded. Signed-off-by: Timur Tabi Reviewed-by: Gary Guo Reviewed-by: Alexandre Courbot Tested-by: John Hubbard Tested-by: Eliot Courtney Link: https://patch.msgid.link/20260319212658.2541610-5-ttabi@nvidia.com Signed-off-by: Danilo Krummrich commit 01681851393642e10b5cc3f35eb6a1916ee4aff1 Author: Timur Tabi Date: Thu Mar 19 16:26:55 2026 -0500 rust: dma: implement BinaryWriter for Coherent<[u8]> Implement the BinaryWriter trait for Coherent<[u8]>, enabling DMA coherent allocations to be exposed as readable binary files. The implementation handles offset tracking and bounds checking, copying data from the coherent allocation to userspace via write_dma(). Signed-off-by: Timur Tabi Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Tested-by: John Hubbard Tested-by: Eliot Courtney Link: https://patch.msgid.link/20260319212658.2541610-4-ttabi@nvidia.com [ Rebase onto Coherent changes. - Danilo ] Signed-off-by: Danilo Krummrich commit 69bfce0f25c8f949f7a02c3ed93e36aadad3fa57 Author: Timur Tabi Date: Thu Mar 19 16:26:54 2026 -0500 rust: uaccess: add write_dma() for copying from DMA buffers to userspace Add UserSliceWriter::write_dma() to copy data from a Coherent<[u8]> to userspace. This provides a safe interface for copying DMA buffer contents to userspace without requiring callers to work with raw pointers. Because write_dma() and write_slice() have common code, factor that code out into a helper function, write_raw(). The method handles bounds checking and offset calculation internally, wrapping the unsafe copy_to_user() call. Signed-off-by: Timur Tabi Reviewed-by: Alexandre Courbot Acked-by: Miguel Ojeda Tested-by: John Hubbard Tested-by: Eliot Courtney Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260319212658.2541610-3-ttabi@nvidia.com [ Rebase onto Coherent changes; remove unnecessary turbofish from cast(). - Danilo ] Signed-off-by: Danilo Krummrich commit 6efced27f5df9d7a57e4847fe2898cdd19f72311 Author: Vignesh Raman Date: Tue Feb 10 12:41:34 2026 +0530 drm/ci: add rk3588-rock-5b Add job that executes the IGT test suite for rk3588-rock-5b. Signed-off-by: Vignesh Raman Reviewed-by: Daniel Stone Signed-off-by: Dmitry Baryshkov commit dd3a39aa20b9f06abff31ab0a17eeb6b18d9b3ce Author: Vignesh Raman Date: Tue Feb 10 12:41:33 2026 +0530 drm/ci: move qualcomm baremetal jobs to lava Qualcomm apq8016 and apq8096 DUTS are moved to Collabora lava farm. So enable these jobs to use lava and update expectation files. Signed-off-by: Vignesh Raman Reviewed-by: Daniel Stone Reviewed-by: Dmitry Baryshkov Co-developed-by: Dmitry Baryshkov Signed-off-by: Dmitry Baryshkov commit 0bebb1773d616ab5b3eab741167ad8791fadfbfc Author: Vignesh Raman Date: Tue Feb 10 12:41:32 2026 +0530 drm/ci: uprev mesa Uprev mesa to adapt to the latest changes in Mesa CI, such as: - LAVA overlay-based firmware handling - Container/job rule separation - Removal of the python-artifacts job - Use lava-job-submitter container to submit jobs - Use of the Alpine container for LAVA jobs - Various other CI improvements - Remove bare-metal jobs and disable apq8016 and apq8096 jobs, as these have been migrated to the Collabora LAVA farm - Fix issues with rebase with external fixes branch - Update expectation files Signed-off-by: Vignesh Raman Reviewed-by: Daniel Stone Reviewed-by: Dmitry Baryshkov Co-developed-by: Dmitry Baryshkov Signed-off-by: Dmitry Baryshkov commit f1f2a9a874d1d907cc5a464e6e32143b5517419b Author: Vignesh Raman Date: Tue Feb 10 12:41:31 2026 +0530 drm/ci: i915: cml: update runner tag asus-C436FA-Flip-hatch has fewer devices available in the LAVA lab and drm-ci uses only 2 DUTs, causing tests to time out. Update drm-ci to use puff instead of hatch so the tests can run on 5 DUTs. Also increase parallel count for amly jobs to 3. Signed-off-by: Vignesh Raman Reviewed-by: Daniel Stone Signed-off-by: Dmitry Baryshkov commit 2c9ee79130bcb1da9b355eb894c80cdfa2dea86f Author: Vignesh Raman Date: Tue Feb 10 12:41:30 2026 +0530 drm/ci: reduce sm8350-hdk parallel jobs from 4 to 2 The sm8350-hdk jobs are short and each test takes around 2–3 minutes and the full job completes in about 10 minutes. Running 4 parallel jobs uses 4 devices at once, which is not needed. Set parallel to 2 to reduce device usage. Signed-off-by: Vignesh Raman Reviewed-by: Daniel Stone Reviewed-by: Dmitry Baryshkov Signed-off-by: Dmitry Baryshkov commit 9f7d8fa6817e2709846fc7f5c9f60254e536d138 Author: Alexei Starovoitov Date: Tue Mar 24 14:59:37 2026 -0700 selftests/bpf: Test variable length stack write Add a test to make sure that variable length stack writes scrubs STACK_SPILL into STACK_MISC. Tested-by: Eduard Zingerman Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260324215938.81733-2-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 4639eb9e30ab10c7935c7c19e872facf9a94713f Author: Alexei Starovoitov Date: Tue Mar 24 14:59:36 2026 -0700 bpf: Fix variable length stack write over spilled pointers Scrub slots if variable-offset stack write goes over spilled pointers. Otherwise is_spilled_reg() may == true && spilled_ptr.type == NOT_INIT and valid program is rejected by check_stack_read_fixed_off() with obscure "invalid size of register fill" message. Fixes: 01f810ace9ed ("bpf: Allow variable-offset stack access") Acked-by: Eduard Zingerman Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260324215938.81733-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit d35ae50c5f48dfcd33cb24bf477ce912fa0af1f7 Author: Timur Tabi Date: Thu Mar 19 16:26:53 2026 -0500 rust: device: add device name method Add a name() method to the `Device` type, which returns a CStr that contains the device name. Signed-off-by: Timur Tabi Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Reviewed-by: Gary Guo Tested-by: John Hubbard Tested-by: Eliot Courtney Link: https://patch.msgid.link/20260319212658.2541610-2-ttabi@nvidia.com Signed-off-by: Danilo Krummrich commit 4bbf3f58e00f8671eb384c7df6983d803058b204 Author: avivdaum Date: Mon Mar 16 00:24:04 2026 +0200 fat: add KUnit tests for timestamp conversion helpers Extend fat_test with coverage for FAT timestamp edge cases that are not currently exercised. Add tests for fat_time_unix2fat() clamping at the UTC boundaries and when time_offset pushes an otherwise valid timestamp outside the FAT date range. Also cover the NULL time_cs path used by existing callers, and verify fat_truncate_atime() truncation across timezone offsets. Link: https://patch.msgid.link/20260315222404.9678-1-aviv.daum@gmail.com Acked-by: OGAWA Hirofumi Signed-off-by: avivdaum Signed-off-by: Christian Brauner commit 04eeaf39f86adbb0ca1915d952ccb2189f5e4153 Author: David Heidelberg Date: Wed Mar 4 12:05:27 2026 +0100 arm64: dts: rockchip: assign pipe clock to rk356x PCIe lanes These clocks are used by PCIe lanes, but we're missing from the definition. Suggested-by: Charalampos Mitrodimas Signed-off-by: David Heidelberg Reviewed-by: Shawn Lin Link: https://patch.msgid.link/20260304-rk3568-bri-r2-pro-fix-pcie-v4-1-37abd7ba29d0@ixit.cz Signed-off-by: Heiko Stuebner commit 792c42da47fa199f90492784e3c57280acd57f22 Author: Shawn Lin Date: Thu Mar 12 09:11:53 2026 +0800 arm64: dts: rockchip: Add mphy reset to ufshc node The mphy reset signal is used to reset the physical adapter. Resetting other components while leaving the mphy unreset may occasionally prevent the UFS controller from successfully linking up with the device. This addresses an intermittent hardware bug where the UFS link fails to establish under specific timing conditions with certain chips. While difficult to reproduce initially, this issue was consistently observed in downstream testing and requires explicit mphy reset control for full stability. Fixes: c75e5e010fef ("scsi: arm64: dts: rockchip: Add UFS support for RK3576 SoC") Signed-off-by: Shawn Lin Link: https://patch.msgid.link/1773277913-29580-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Heiko Stuebner commit 8c2c73084bd10237a9bc8f1d5fd49fe3107e4562 Author: Jonas Karlman Date: Thu Mar 12 22:30:19 2026 +0100 arm64: dts: rockchip: Enable OTP controller for RK3528 Enable the One Time Programmable Controller (OTPC) in RK3528 and add an initial nvmem fixed layout. Signed-off-by: Jonas Karlman Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260312213019.13965-4-heiko@sntech.de commit fae36d252e3344eefd95a94c026c170003805917 Author: Heiko Stuebner Date: Thu Mar 12 22:30:18 2026 +0100 arm64: dts: rockchip: Enable OTP controller for RK356x Enable the One Time Programmable Controller (OTPC) in RK356x and add an initial nvmem fixed layout. Tested-by: Diederik de Haas # NanoPi R5S, PineNote Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260312213019.13965-3-heiko@sntech.de commit 2448f33ff93ca9e41ce419e4bc7257010fa70a04 Author: Heiko Stuebner Date: Thu Mar 12 22:30:17 2026 +0100 arm64: dts: rockchip: Enable OTP controller for RK3562 Enable the One Time Programmable Controller (OTPC) in RK3562 and add an initial nvmem fixed layout. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260312213019.13965-2-heiko@sntech.de commit 3c4b46cd26fbfa24f525e702d6e8ed9111922202 Author: Anand Moon Date: Mon Mar 16 13:03:55 2026 +0530 arm64: dts: rockchip: Enable PCIe CLKREQ# for RK3588 on Rock 5b-5bp-5t series Add supports-clkreq and the corresponding pinmux configurations for PCIe ASPM L1 substates on the Rock 5B, 5B+ and 5T. The supports-clkreq flag informs the PCIe controller that the hardware routing for the CLKREQ# sideband signal is present. This enables support for PCIe ASPM (Active State Power Management) L1 substates, allowing for better power efficiency. Cc: Shawn Lin Signed-off-by: Anand Moon Reviewed-by: Shawn Lin Link: https://patch.msgid.link/20260316073621.39027-1-linux.amoon@gmail.com Signed-off-by: Heiko Stuebner commit 5283ad9abd8598389aef67dc60b6423da83a46ec Author: Sebastian Reichel Date: Tue Mar 17 15:39:30 2026 +0100 arm64: dts: rockchip: add SD/eMMC aliases for ArmSom Sige5 Provide aliases for the SD and eMMC interfaces, so that the operating system can assign stable interface names. On Linux this is only relevant when booting without partition UUID based root device identification, e.g. when booting without an initramfs. In that case booting with e.g. root=/dev/mmcblk0p2 is unreliable without this patch as the device numbers changed based on device probe order. Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260317-sige5-mmc-aliases-v1-1-ee93a1571802@collabora.com Signed-off-by: Heiko Stuebner commit 9f65d1da414fcf201b939145ba36f6815652671e Author: Sebastian Reichel Date: Mon Mar 16 19:23:01 2026 +0100 arm64: dts: rockchip: Add SPDIF nodes to RK3576 device tree Add support for all six SPDIF transmitters found in the RK3576. The nodes have been taken over from the BSP kernel and checked against the TRM (power domain descriptions from chapter 6.3.2, addresses from "Table 1-1 Address Mapping", interrupt from "Table 1-3 RK3576 Interrupt Connection List" (TRM numbers are off by 32 due to SGI/PPI not being numbered separately). The TRM lacks a proper clock tree, but fortunately are quite obvious for the SPDIF IP. Note, that the RK3576 also has 3 SPDIF receivers, which need their own binding and are not handled in this patch. A typical use case for the SPDIF transmitters is audio support for the Displayport (DP) controller. DP requires inserting PCUV control bits, which requires software support when using I2S. The SPDIF IP can add it automatically and thus is preferred. Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260316-rk3576-spdif-v1-2-acb75088b560@collabora.com Signed-off-by: Heiko Stuebner commit 0410731663c952035eacaab03c09a1c0fe663561 Author: Gray Huang Date: Tue Mar 17 17:07:31 2026 +0800 arm64: dts: rockchip: Add Khadas Edge 2L board The Khadas Edge 2L is a single board computer based on the Rockchip RK3576 SoC. Add basic device tree support for this board. Currently, only eMMC and UART are enabled, allowing the board to boot into a basic Linux system via the serial console. Signed-off-by: Gray Huang Link: https://patch.msgid.link/20260317090731.600787-3-gray.huang@wesion.com Signed-off-by: Heiko Stuebner commit 00ba2843112cb60f90f0c8d25b437c86f271099c Author: Gray Huang Date: Tue Mar 17 17:07:30 2026 +0800 dt-bindings: arm: rockchip: Add Khadas Edge 2L board The Khadas Edge 2L is a single board computer based on the Rockchip RK3576 SoC. Specification: - Rockchip RK3576 - 8/16GB LPDDR5 - 64/128GB eMMC 5.1 - AP6275P WiFi6 LAN - HDMI2.1 Type-A - MIPI-CSI x2 - MIPI-DSI x2 - USB3.1; USB2.0 - RTC clock - PWM fan - SPI Flash - Pads expansion board (UART, USB) Signed-off-by: Gray Huang Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260317090731.600787-2-gray.huang@wesion.com Signed-off-by: Heiko Stuebner commit 551e49beb1752387aed09eb2a0ea4c82ed1f3a35 Author: Shrikanth Hegde Date: Tue Mar 24 01:06:30 2026 +0530 timers: Get this_cpu once while clearing the idle state Calling smp_processor_id() on: - In CONFIG_DEBUG_PREEMPT=y, if preemption/irq is disabled, then it does not print any warning. - In CONFIG_DEBUG_PREEMPT=n, it doesn't do anything apart from getting __smp_processor_id So with both CONFIG_DEBUG_PREEMPT=y/n, in preemption disabled section it is better to cache the value. It saves a few cycles. Though tiny, repeated adds up. timer_clear_idle() is called with interrupts disabled. So cache the value once. Signed-off-by: Shrikanth Hegde Signed-off-by: Thomas Gleixner Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Link: https://patch.msgid.link/20260323193630.640311-5-sshegde@linux.ibm.com commit 8ed82f807bb09d2c8455aaa665f2c6cb17bc6a19 Author: David Carlier Date: Fri Mar 20 07:26:45 2026 +0000 bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path The DEVMAP_HASH branch in dev_map_redirect_multi() uses hlist_for_each_entry_safe() to iterate hash buckets, but this function runs under RCU protection (called from xdp_do_generic_redirect_map() in softirq context). Concurrent writers (__dev_map_hash_update_elem, dev_map_hash_delete_elem) modify the list using RCU primitives (hlist_add_head_rcu, hlist_del_rcu). hlist_for_each_entry_safe() performs plain pointer dereferences without rcu_dereference(), missing the acquire barrier needed to pair with writers' rcu_assign_pointer(). On weakly-ordered architectures (ARM64, POWER), a reader can observe a partially-constructed node. It also defeats CONFIG_PROVE_RCU lockdep validation and KCSAN data-race detection. Replace with hlist_for_each_entry_rcu() using rcu_read_lock_bh_held() as the lockdep condition, consistent with the rcu_dereference_check() used in the DEVMAP (non-hash) branch of the same functions. Also fix the same incorrect lockdep_is_held(&dtab->index_lock) condition in dev_map_enqueue_multi(), where the lock is not held either. Fixes: e624d4ed4aa8 ("xdp: Extend xdp_redirect_map with broadcast support") Signed-off-by: David Carlier Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260320072645.16731-1-devnexen@gmail.com commit c291cfac49a67debdad766eedc450ef613f41b2d Author: Kit Dallege Date: Sun Mar 15 18:09:41 2026 +0100 entry: Add missing kernel-doc for arch_ptrace_report_syscall functions Document @regs and @step parameters for arch_ptrace_report_syscall_entry() and arch_ptrace_report_syscall_exit() that were missing from the kernel-doc comments. Signed-off-by: Kit Dallege Signed-off-by: Thomas Gleixner Assisted-by: Claude:claude-opus-4-6 Link: https://patch.msgid.link/20260315170941.65913-1-xaum.io@gmail.com commit b374977413e7232520bc53bf934fae3801770849 Author: Davidlohr Bueso Date: Fri Mar 6 10:22:15 2026 -0800 selftests/futex: Bump up libnuma version check numa_set_mempolicy_home_node() was introduced in libnuma 2.0.18, not 2.0.16, via: https://github.com/numactl/numactl/commit/8f2ffc89654c Signed-off-by: Davidlohr Bueso Signed-off-by: Thomas Gleixner Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20260306182215.2088991-1-dave@stgolabs.net commit 3814c4e145b7a315abd83c85caf97585c63035a4 Author: Nylon Chen Date: Sun Mar 1 19:04:34 2026 -0800 selftests/futex: Conditionally include libnuma support Use LIBNUMA_TEST to conditionally add -lnuma to LDLIBS. Guard numa header includes with #ifdef LIBNUMA_VER_SUFFICIENT to allow compilation without libnuma installed. Co-developed-by: Zong Li Signed-off-by: Zong Li Signed-off-by: Nylon Chen Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260301-20260128_nylon_chen_sifive_com-v3-1-995ab4cc71aa@sifive.com commit 55722b3f80377103bac6ac748554129108c75651 Author: Thomas Weißschuh Date: Thu Mar 5 10:31:44 2026 +0100 selftests/bpf: verify_pkcs7_sig: Use 'struct module_signature' from the UAPI headers Now that the UAPI headers provide the required definitions, use those. Some symbols have been renamed, adapt to those. Signed-off-by: Thomas Weißschuh Reviewed-by: Petr Pavlu Reviewed-by: Nicolas Schier Signed-off-by: Sami Tolvanen commit e340db306c3bb85877490f33a78eb80549ac43a7 Author: Thomas Weißschuh Date: Thu Mar 5 10:31:43 2026 +0100 sign-file: use 'struct module_signature' from the UAPI headers Now that the UAPI headers provide the required definitions, use those. Some symbols have been renamed, adapt to those. Also adapt the include path for the custom sign-file rule in the bpf selftests. Signed-off-by: Thomas Weißschuh Reviewed-by: Petr Pavlu Reviewed-by: Nicolas Schier Signed-off-by: Sami Tolvanen commit d2d7561dc656748f592cc34d34bf5db8d5c67f7b Author: Thomas Weißschuh Date: Thu Mar 5 10:31:42 2026 +0100 tools uapi headers: add linux/module_signature.h This header is going to be used from scripts/sign-file. Signed-off-by: Thomas Weißschuh Reviewed-by: Petr Pavlu Reviewed-by: Nicolas Schier Signed-off-by: Sami Tolvanen commit f9909cf0a2dcc9e99377f3fcc965ccd93e518e34 Author: Thomas Weißschuh Date: Thu Mar 5 10:31:41 2026 +0100 module: Move 'struct module_signature' to UAPI This structure definition is used outside the kernel proper. For example in kmod and the kernel build environment. To allow reuse, move it to a new UAPI header. While it is not a true UAPI, it is a common practice to have non-UAPI interface definitions in the kernel's UAPI headers. Signed-off-by: Thomas Weißschuh Reviewed-by: Petr Pavlu Reviewed-by: Nicolas Schier Signed-off-by: Sami Tolvanen commit 2ae4ea2d9aaf25cb74fbc23450b1b8f0a5b7aa89 Author: Thomas Weißschuh Date: Thu Mar 5 10:31:40 2026 +0100 module: Give MODULE_SIG_STRING a more descriptive name The purpose of the constant it is not entirely clear from its name. As this constant is going to be exposed in a UAPI header, give it a more specific name for clarity. As all its users call it 'marker', use that wording in the constant itself. Signed-off-by: Thomas Weißschuh Reviewed-by: Petr Pavlu Reviewed-by: Nicolas Schier Signed-off-by: Sami Tolvanen commit acd87264af525dba6e9355310e8acdf066a5f6b5 Author: Thomas Weißschuh Date: Thu Mar 5 10:31:39 2026 +0100 module: Give 'enum pkey_id_type' a more specific name This enum originates in generic cryptographic code and has a very generic name. Nowadays it is only used for module signatures. As this enum is going to be exposed in a UAPI header, give it a more specific name for clarity and consistency. Signed-off-by: Thomas Weißschuh Reviewed-by: Petr Pavlu Reviewed-by: Nicolas Schier Signed-off-by: Sami Tolvanen commit 8988913aacee82e5401bf3b96839731982dcbde7 Author: Thomas Weißschuh Date: Thu Mar 5 10:31:38 2026 +0100 module: Drop unused signature types Only PKCS#7 signatures are used today. Remove the unused enum values. As this enum is used in on-disk data, preserve the numeric value. Signed-off-by: Thomas Weißschuh Reviewed-by: Petr Pavlu Reviewed-by: Nicolas Schier Signed-off-by: Sami Tolvanen commit 137676d4482d8b8d755890b4ed29fe8223661d20 Author: Thomas Weißschuh Date: Thu Mar 5 10:31:37 2026 +0100 extract-cert: drop unused definition of PKEY_ID_PKCS7 This definition duplicates a definition from an internal kernel header which is going to be renamed. To get rid of an instance of the old name, drop the definition. Signed-off-by: Thomas Weißschuh Reviewed-by: Petr Pavlu Reviewed-by: Nicolas Schier Signed-off-by: Sami Tolvanen commit 34ca46cc6fc954782f859f0fc66e8fe9ce2c24f0 Author: Jiaqi Yan Date: Wed Feb 4 21:47:41 2026 +0000 fs: hugetlb: simplify remove_inode_hugepages() return type When remove_inode_hugepages() was introduced in commit c86272287bc6 ("hugetlb: create remove_inode_single_folio to remove single file folio") it used to return a boolean to indicate if it bailed out due to race with page faults. However, since the race is already solved by [1], remove_inode_hugepages() doesn't have any path to return false anymore. Simplify remove_inode_hugepages() return type to void, remove the unnecessary ret variable, and adjust the call site in remove_inode_hugepages(). No functional change in this commit. Link: https://lkml.kernel.org/r/20260204214741.3161520-1-jiaqiyan@google.com Link: https://lore.kernel.org/all/20220914221810.95771-10-mike.kravetz@oracle.com [1] Signed-off-by: Jiaqi Yan Suggested-by: Jane Chu Reviewed-by: Jane Chu Reviewed-by: Muchun Song Acked-by: David Hildenbrand (arm) Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 260d70819c37cf59383286f8dc6566eaa32776bb Author: Altan Hacigumus Date: Tue Feb 3 19:35:53 2026 -0800 mm/shrinker: fix refcount leak in shrink_slab_memcg() When kmem is disabled for memcg, slab-backed shrinkers are skipped. However, shrink_slab_memcg() doesn't drop the reference acquired via shrinker_try_get() before continuing. Add the missing shrinker_put(). Also, since memcg_kmem_online() and shrinker flags cannot change dynamically, remove the shrinker from the bitmap to avoid unnecessary future scans. Link: https://lkml.kernel.org/r/20260204033553.50039-1-ahacigu.linux@gmail.com Fixes: 50d09da8e119 ("mm: shrinker: make memcg slab shrink lockless") Signed-off-by: Altan Hacigumus Acked-by: Qi Zheng Link: https://lore.kernel.org/r/20260203073757.135088-1-ahacigu.linux@gmail.com Reviewed-by: Muchun Song Cc: Dave Chinner Cc: Roman Gushchin Signed-off-by: Andrew Morton commit b8a4b088381875ff1a93c0c2d5a926b30b1bfe31 Author: qinyu Date: Tue Feb 3 17:54:00 2026 +0800 mm/damon/ops-common: remove redudnant mmu notifier call in pmdp mkold Currently, mmu_notifier_clear_young() is called immediately after pmdp_clear_young_notify(), which already calls mmu_notifier_clear_young() internally. This results in a redundant notifier call. Replace pmdp_clear_young_notify() with the non-notify variant to avoid the duplicate call and make the pmdp path consistent with the corresponding ptep_mkold() code. Link: https://lkml.kernel.org/r/20260203095400.2465255-1-qin.yuA@h3c.com Signed-off-by: qinyu Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 7e74dd031620549174eb287649aa12970ef56589 Author: Shengming Hu Date: Thu Jan 29 22:38:14 2026 +0800 mm/page_alloc: avoid overcounting bulk alloc in watermark check alloc_pages_bulk_noprof() only fills NULL slots and already tracks how many entries are pre-populated via nr_populated. The fast watermark check was adding nr_pages unconditionally, which can overestimate the demand. Use (nr_pages - nr_populated) instead, as an upper bound on the remaining pages this call can still allocate without scanning the whole array. Link: https://lkml.kernel.org/r/tencent_F36C5B5FB4DED98C79D9BDEE1210CD338C06@qq.com Signed-off-by: Shengming Hu Reviewed-by: Vlastimil Babka Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 396f57b5720024638dbb503f6a4abd988a49d815 Author: Kairui Song Date: Mon Feb 16 22:58:02 2026 +0800 mm, swap: speed up hibernation allocation and writeout Since commit 0ff67f990bd4 ("mm, swap: remove swap slot cache"), hibernation has been using the swap slot slow allocation path for simplification, which turns out might cause regression for some devices because the allocator now rotates clusters too often, leading to slower allocation and more random distribution of data. Fast allocation is not complex, so implement hibernation support as well. Test result with Samsung SSD 830 Series (SATA II, 3.0 Gbps) shows the performance is several times better [1]: 6.19: 324 seconds After this series: 35 seconds Link: https://lkml.kernel.org/r/20260216-hibernate-perf-v4-1-1ba9f0bf1ec9@tencent.com Link: https://lore.kernel.org/linux-mm/8b4bdcfa-ce3f-4e23-839f-31367df7c18f@gmx.de/ [1] Signed-off-by: Kairui Song Fixes: 0ff67f990bd4 ("mm, swap: remove swap slot cache") Reported-by: Carsten Grohmann Closes: https://lore.kernel.org/linux-mm/20260206121151.dea3633d1f0ded7bbf49c22e@linux-foundation.org/ Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Kemeng Shi Cc: Nhat Pham Cc: Signed-off-by: Andrew Morton commit 882ac913e67d2462a18bdc2958b496c0f51d1647 Author: Guoniu Zhou Date: Fri Dec 5 17:07:46 2025 +0800 media: imx8mq-mipi-csi2: Add support for i.MX8ULP The CSI-2 receiver in i.MX8ULP is almost same as i.MX8QXP/QM except clocks and resets, so add compatible string for i.MX8ULP to handle the difference and reuse platform data of i.MX8QXP/QM. Reviewed-by: Frank Li Reviewed-by: Laurent Pinchart Signed-off-by: Guoniu Zhou Link: https://patch.msgid.link/20251205-csi2_imx8ulp-v10-4-190cdadb20a3@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 6d79bb8fd2aa25afccbd6aeec2821722fa0b5db5 Author: Guoniu Zhou Date: Fri Dec 5 17:07:45 2025 +0800 media: imx8mq-mipi-csi2: Explicitly release reset Call reset_control_deassert() to explicitly release reset to make sure reset bits are cleared since platform like i.MX8ULP can't clear reset bits automatically. Reviewed-by: Frank Li Reviewed-by: Laurent Pinchart Signed-off-by: Guoniu Zhou Link: https://patch.msgid.link/20251205-csi2_imx8ulp-v10-3-190cdadb20a3@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit c0e5899e1397b091698b6bb47663001924c261bb Author: Guoniu Zhou Date: Fri Dec 5 17:07:44 2025 +0800 media: imx8mq-mipi-csi2: Use devm_clk_bulk_get_all() to fetch clocks Use devm_clk_bulk_get_all() helper to simplify clock handle code. No functional changes intended. Reviewed-by: Frank Li Signed-off-by: Guoniu Zhou Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20251205-csi2_imx8ulp-v10-2-190cdadb20a3@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 20b522e812a38e9e9fc445f0f4ef3c842a41e53a Author: Guoniu Zhou Date: Fri Dec 5 17:07:43 2025 +0800 media: dt-bindings: nxp,imx8mq-mipi-csi2: Add i.MX8ULP compatible string The CSI-2 receiver in the i.MX8ULP is almost identical to the version present in the i.MX8QXP/QM, but i.MX8ULP CSI-2 controller needs pclk clock as the input clock for its APB interface of Control and Status register(CSR). So add compatible string fsl,imx8ulp-mipi-csi2 and increase maxItems of Clocks (clock-names) to 4 from 3. And keep the same restriction for existing compatible. Reviewed-by: Frank Li Acked-by: Conor Dooley Signed-off-by: Guoniu Zhou Link: https://patch.msgid.link/20251205-csi2_imx8ulp-v10-1-190cdadb20a3@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 77458ad25ec087f0dbf2be37f6e8903715d0fa85 Author: Guoniu Zhou Date: Wed Nov 5 13:55:12 2025 +0800 media: nxp: imx8-isi: Add ISI support for i.MX95 The ISI module on i.MX95 supports up to eight channels and four link sources to obtain the image data for processing in its pipelines. It can process up to eight image sources at the same time. Add ISI basic functions support for i.MX95. Reviewed-by: Frank Li Signed-off-by: Guoniu Zhou Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20251105-isi_imx95-v3-3-3987533cca1c@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 38f4ce14dbe9fc611012c32d57fc6fceec5139e5 Author: Guoniu Zhou Date: Wed Nov 5 13:55:11 2025 +0800 media: nxp: imx8-isi: Keep the default value for BLANK_PXL field The field BLANK_PXL provides the value of the blank pixel to be inserted in the image in case an overflow error occurs in the output buffers of the channel. Its default value is 0xff, so no need to set again. Besides, the field only exist in i.MX8QM/XP ISI version. Other versions like i.MX 8M series, remove the field since it won't send data to AXI bus when overflow error occurs and mark BLANK_PXL as reserved. i.MX9 series use it for other purposes. Reviewed-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Guoniu Zhou Link: https://patch.msgid.link/20251105-isi_imx95-v3-2-3987533cca1c@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit a14986949fd58c39436bd18c5bf3eb0c043717a4 Author: Guoniu Zhou Date: Wed Nov 5 13:55:10 2025 +0800 media: dt-bindings: nxp,imx8-isi: Add i.MX95 ISI compatible string The ISI module on i.MX95 supports up to eight channels and four link sources to obtain the image data for processing in its pipelines. It can process up to eight image sources at the same time. Signed-off-by: Guoniu Zhou Reviewed-by: Laurent Pinchart Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251105-isi_imx95-v3-1-3987533cca1c@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 2f38622d0f85f317be9e6b131da6cd511db94fd2 Author: Guoniu Zhou Date: Thu Mar 12 11:12:34 2026 +0800 media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Fix a hang issue when capturing a single frame with applications like cam in libcamera. It would hang waiting for the driver to complete the buffer, but streaming never starts because min_queued_buffers was set to 2. The ISI module uses a ping-pong buffer mechanism that requires two buffers to be programmed at all times. However, when fewer than 2 user buffers are available, the driver use internal discard buffers to fill the remaining slot(s). Reduce minimum queued buffers from 2 to 0 allows streaming to start without any queued buffers. Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") Cc: stable@vger.kernel.org Signed-off-by: Guoniu Zhou Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260312-isi_min_buffers-v2-1-d5ea1c79ad81@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 21ad4e8584ae6538035976eebd569cfdf41d92df Author: Stefan Klug Date: Wed Mar 4 16:50:25 2026 +0100 media: dw100: Merge dw100_device_run and dw100_start The dw100_start() function is only called from dw100_device_run(). As both functions are not too big, move the code directly into dw100_device_run() and drop dw100_start() to improve readability. This patch contains no functional changes. Signed-off-by: Stefan Klug Reviewed-by: Xavier Roumegue Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260304-sklug-v6-16-topic-dw100-v3-1-dev-v5-4-1a7e1f721b50@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 557ec8cc29ade6c72ea768e59389db08cb7742c9 Author: Stefan Klug Date: Wed Mar 4 16:50:24 2026 +0100 media: dw100: Fix kernel oops with PREEMPT_RT enabled On kernels with PREEMPT_RT enabled, a "BUG: scheduling while atomic" kernel oops occurs inside dw100_irq_handler -> vb2_buffer_done. This is because vb2_buffer_done takes a spinlock which is not allowed within interrupt context on PREEMPT_RT. The first attempt to fix this was to just drop the IRQF_ONESHOT so that the interrupt is handled threaded on PREEMPT_RT systems. This introduced a new issue. The dw100 has an internal timeout counter that is gated by the DW100_BUS_CTRL_AXI_MASTER_ENABLE bit. Depending on the time it takes for the threaded handler to run and the geometry of the data being processed it is possible to reach the timeout resulting in DW100_INTERRUPT_STATUS_INT_ERR_TIME_OUT being set and "dw100 32e30000.dwe: Interrupt error: 0x1" errors in dmesg. To properly fix that, split the interrupt into two halves, reset the DW100_BUS_CTRL_AXI_MASTER_ENABLE bit in the hard interrupt handler and do the v4l2 buffer handling in the threaded half. The IRQF_ONESHOT can still be dropped as the interrupt gets disabled in the hard handler and will only be reenabled on the next dw100_device_run which will not be called before the current job has finished. Signed-off-by: Stefan Klug Reviewed-by: Xavier Roumegue Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260304-sklug-v6-16-topic-dw100-v3-1-dev-v5-3-1a7e1f721b50@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit dc4b7a52a064471216382d012df4e02745392729 Author: Stefan Klug Date: Wed Mar 4 16:50:23 2026 +0100 media: dw100: Implement dynamic vertex map update Implement dynamic vertex map updates by handling the V4L2_CID_DW100_DEWARPING_16x16_VERTEX_MAP control during streaming. This allows to implement features like dynamic zoom, pan, rotate and dewarp. To stay compatible with the old version, updates of V4L2_CID_DW100_DEWARPING_16x16_VERTEX_MAP are ignored during streaming when requests are not used. Print a corresponding warning once. Signed-off-by: Stefan Klug Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260304-sklug-v6-16-topic-dw100-v3-1-dev-v5-2-1a7e1f721b50@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 3906de8da72fa65d06df0aa69c1d3274946cba7f Author: Stefan Klug Date: Wed Mar 4 16:50:22 2026 +0100 media: dw100: Implement V4L2 requests support The dw100 dewarper hardware present on the NXP i.MX8MP allows very flexible dewarping using a freely configurable vertex map. Aside from lens dewarping the vertex map can be used to implement things like arbitrary zoom, pan and rotation. The current driver supports setting that vertex map before calling VIDIOC_STREAMON. To control above mentioned features during streaming it is necessary to update the vertex map dynamically. To do that in a race free manner V4L2 requests support is required. Add V4L2 requests support to prepare for dynamic vertex map updates. Signed-off-by: Stefan Klug Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260304-sklug-v6-16-topic-dw100-v3-1-dev-v5-1-1a7e1f721b50@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 5e4eabaded266db816657269864053da97eee30d Author: Frank Li Date: Wed Jan 21 15:42:03 2026 -0500 media: nxp: Add dev_err_probe() to all error paths in *async_register() helpers Add dev_err_probe() to all error branches in the *async_register() helpers to provide clearer diagnostic information when device registration fails. Drop the explicit error message after returning from mipi_csis_async_register(), as the error is already reported by this helper. Signed-off-by: Frank Li Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260121-cam_cleanup-v5-1-01d1ab38db9d@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 4de17cce8f0f65e85b3cec686437355b4452834d Author: Tarang Raval Date: Fri Aug 29 15:44:24 2025 +0530 media: rkisp1: Fix enum_framesizes accepting invalid pixel formats Reject unsupported pixel formats in rkisp1_enum_framesizes() to fix v4l2-compliance failure. v4l2-compliance test failure: fail: ../utils/v4l2-compliance/v4l2-test-formats.cpp(403): Accepted framesize for invalid format test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: FAIL Tested on: Debix i.MX8MP Model A Kernel version: v6.17-rc3 v4l2-compliance: 1.31.0-5387 Signed-off-by: Tarang Raval Tested-by: Laurent Pinchart Reviewed-by: Laurent Pinchart Tested-by: Kieran Bingham Link: https://patch.msgid.link/20250829101425.95442-1-tarang.raval@siliconsignals.io Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 676540d02b2ca4c3a8e550156c72b760c08e387e Author: AnishMulay Date: Fri Mar 6 15:04:58 2026 -0500 tracefs: Use dentry name snapshots instead of heap allocation In fs/tracefs/inode.c, tracefs_syscall_mkdir() and tracefs_syscall_rmdir() previously used a local helper, get_dname(), which allocated a temporary buffer on the heap via kmalloc() to hold the dentry name. This introduced unnecessary overhead, an ENOMEM failure path, and required manual memory cleanup via kfree(). As suggested by Al Viro, replace this heap allocation with the VFS dentry name snapshot API. By stack-allocating a `struct name_snapshot` and using take_dentry_name_snapshot() and release_dentry_name_snapshot(), we safely capture the dentry name locklessly, eliminate the heap allocation entirely, and remove the now-obsolete error handling paths. The get_dname() helper is completely removed. Testing: Booted a custom kernel natively in virtme-ng (ARM64). Triggered tracefs inode and dentry allocation by creating and removing a custom directory under a temporary tracefs mount. Verified that the instance is created successfully and that no memory errors or warnings are emitted in dmesg. Link: https://patch.msgid.link/20260306200458.2264-1-anishm7030@gmail.com Suggested-by: Al Viro Signed-off-by: AnishMulay Signed-off-by: Steven Rostedt (Google) commit 4d9b262031ffef203243e53577a90ae6e1090e67 Author: Steven Rostedt Date: Wed Jun 4 15:16:25 2025 -0400 eventfs: Simplify code using guard()s Use guard(mutex), scoped_guard(mutex) and guard(src) to simplify the code and remove a lot of the jumps to "out:" labels. Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250604151625.250d13e1@gandalf.local.home Signed-off-by: Steven Rostedt (Google) Reviewed-by: Masami Hiramatsu (Google) commit 117f8e71d61dab08b9be84b7dd0dd65916ed13c0 Merge: 0f9bcf224f983e c369299895a591 Author: Dmitry Torokhov Date: Tue Mar 24 13:49:39 2026 -0700 Merge tag 'v7.0-rc5' into next Sync up with mainline to pull in a fix for smb compilation error. commit 7f5b0a60a8b925db0cde62d87f1031dc04acbeb2 Author: Sun Jian Date: Tue Mar 24 12:49:49 2026 +0800 selftests/bpf: move trampoline_count to dedicated bpf_testmod target trampoline_count fills all trampoline attachment slots for a single target function and verifies that one extra attach fails with -E2BIG. It currently targets bpf_modify_return_test, which is also used by other selftests such as modify_return, get_func_ip_test, and get_func_args_test. When such tests run in parallel, they can contend for the same per-function trampoline quota and cause unexpected attach failures. This issue is currently masked by harness serialization. Move trampoline_count to a dedicated bpf_testmod target and register it for fmod_ret attachment. Also route the final trigger through trigger_module_test_read(), so the execution path exercises the same dedicated target. This keeps the test semantics unchanged while isolating it from other selftests, so it no longer needs to run in serial mode. Remove the TODO comment as well. Tested: ./test_progs -t trampoline_count -vv ./test_progs -j$(nproc) -t trampoline_count -vv ./test_progs -j$(nproc) -t \ trampoline_count,modify_return,get_func_ip_test,get_func_args_test -vv 20 runs of: ./test_progs -j$(nproc) -t \ trampoline_count,modify_return,get_func_ip_test,get_func_args_test Signed-off-by: Sun Jian Acked-by: Jiri Olsa Link: https://lore.kernel.org/r/20260324044949.869801-1-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov commit d9d7125e445dc06c2d9bd3dbd070dcbcd41a540f Author: Jiayuan Chen Date: Thu Mar 12 15:25:44 2026 +0800 selftests/bpf: Fix sockmap_multi_channels reliability Previously I added a FIONREAD test for sockmap, but it can occasionally fail in CI [1]. The test sends 10 bytes in two segments (2 + 8). For UDP, FIONREAD only reports the length of the first datagram, not the total queued data. The original code used recv_timeout() expecting all 10 bytes, but under high system load, the second datagram may not yet be processed by the protocol stack, so recv would only return the first 2-byte datagram, causing a size mismatch failure. Fix this by receiving exactly the expected bytes (matching FIONREAD) in the first recv. The remaining datagram is then consumed in a second recv block, which is only reachable for UDP since TCP's expected already equals sizeof(buf). Test: ./test_progs -a sockmap_basic 410/1 sockmap_basic/sockmap create_update_free:OK ... Summary: 1/35 PASSED, 0 SKIPPED, 0 FAILED [1] https://github.com/kernel-patches/bpf/actions/runs/22919385910/job/66515395423 Cc: Jiayuan Chen Fixes: 17e2ce02bf56 ("selftests/bpf: Add tests for FIONREAD and copied_seq") Signed-off-by: Jiayuan Chen Link: https://lore.kernel.org/r/20260312072549.6766-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit 2790db208b44c881d23be745868f2679c3ff1be5 Author: Jiayuan Chen Date: Thu Mar 12 16:35:54 2026 +0800 selftests/bpf: Improve tc_tunnel test reliability A test failure was discovered in BPF CI [1] caused by connection timeout. The current test timeout of 500ms is insufficient for CI environments, particularly under high load. While the optimal timeout is unclear, this test was converted from the original test_tc_tunnel.sh script. The original script used nc with "-w 1" to specify a 1-second timeout [2]. Therefore, this test restores the timeout to 1s. Test: ./test_progs -a tc_tunnel #478/1 tc_tunnel/ipip_none:OK #478/2 tc_tunnel/ipip6_none:OK #478/3 tc_tunnel/ip6tnl_none:OK #478/4 tc_tunnel/sit_none:OK #478/5 tc_tunnel/vxlan_eth:OK #478/6 tc_tunnel/ip6vxlan_eth:OK #478/7 tc_tunnel/gre_none:OK #478/8 tc_tunnel/gre_eth:OK #478/9 tc_tunnel/gre_mpls:OK #478/10 tc_tunnel/ip6gre_none:OK #478/11 tc_tunnel/ip6gre_eth:OK #478/12 tc_tunnel/ip6gre_mpls:OK #478/13 tc_tunnel/udp_none:OK #478/14 tc_tunnel/udp_eth:OK #478/15 tc_tunnel/udp_mpls:OK #478/16 tc_tunnel/ip6udp_none:OK #478/17 tc_tunnel/ip6udp_eth:OK #478/18 tc_tunnel/ip6udp_mpls:OK #478 tc_tunnel:OK Summary: 1/18 PASSED, 0 SKIPPED, 0 FAILED [1] https://github.com/kernel-patches/bpf/actions/runs/22674350732/job/65728072723 [2] https://lore.kernel.org/all/20251027-tc_tunnel-v3-4-505c12019f9d@bootlin.com/ Cc: Jiayuan Chen Signed-off-by: Jiayuan Chen Link: https://lore.kernel.org/r/20260312083615.31835-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit 70b5f3f7822a8737de350ce3731189e724bc45be Author: Kexin Sun Date: Sat Mar 21 18:56:58 2026 +0800 bpf: update outdated comment for refactored btf_check_kfunc_arg_match() The function btf_check_kfunc_arg_match() was refactored into check_kfunc_args() by commit 00b85860feb8 ("bpf: Rewrite kfunc argument handling"). Update the comment accordingly. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Acked-by: Yonghong Song Reviewed-by: Jiayuan Chen Link: https://lore.kernel.org/r/20260321105658.6006-1-kexinsun@smail.nju.edu.cn Signed-off-by: Alexei Starovoitov commit 70275388aeaa85027af76d26a803e9be35aba95e Merge: 7b4f1a29c704f2 e8571de5344561 Author: Alexei Starovoitov Date: Tue Mar 24 13:36:32 2026 -0700 Merge branch 'bpf-add-multi-level-pointer-parameter-support-for-trampolines' Slava Imameev says: ==================== bpf: Add multi-level pointer parameter support for trampolines This is v6 of a series adding support for new pointer types for trampoline parameters. Originally, only support for multi-level pointers was proposed. As suggested during review, it was extended to single-level pointers. During discussion, it was proposed to add support for any single or multi-level pointer type that is not a single-level pointer to a structure, with the condition if (!btf_type_is_struct(t)). The safety of this condition is based on BTF data verification performed for modules and programs, and vmlinux BTF being trusted to not contain invalid types, so it is not possible for invalid types, like PTR->DATASEC, PTR->FUNC, PTR->VAR and corresponding multi-level pointers, to reach btf_ctx_access. These changes appear to be a safe extension since any future support for arrays and output values would require annotation (similar to Microsoft SAL), which differentiates between current unannotated scalar cases and new annotated cases. This series adds BPF verifier support for single- and multi-level pointer parameters and return values in BPF trampolines. The implementation treats these parameters as SCALAR_VALUE. This is consistent with existing pointers to int and void that are already treated as SCALAR. This provides consistent logic for single- and multi-level pointers: if the type is treated as SCALAR for a single-level pointer, the same applies to multi-level pointers, except for pointers to structs which are currently PTR_TO_BTF_ID. However, in the case of multi-level pointers, they are treated as scalar since the verifier lacks the context to infer the size of their target memory regions. Background: Prior to these changes, accessing multi-level pointer parameters or return values through BPF trampoline context arrays resulted in verification failures in btf_ctx_access, producing errors such as: func '%s' arg%d type %s is not a struct For example, consider a BPF program that logs an input parameter of type struct posix_acl **: SEC("fentry/__posix_acl_chmod") int BPF_PROG(trace_posix_acl_chmod, struct posix_acl **ppacl, gfp_t gfp, umode_t mode) { bpf_printk("__posix_acl_chmod ppacl = %px\n", ppacl); return 0; } This program failed BPF verification with the following error: libbpf: prog 'trace_posix_acl_chmod': -- BEGIN PROG LOAD LOG -- 0: R1=ctx() R10=fp0 ; int BPF_PROG(trace_posix_acl_chmod, struct posix_acl **ppacl, gfp_t gfp, umode_t mode) @ posix_acl_monitor.bpf.c:23 0: (79) r6 = *(u64 *)(r1 +16) ; R1=ctx() R6_w=scalar() 1: (79) r1 = *(u64 *)(r1 +0) func '__posix_acl_chmod' arg0 type PTR is not a struct invalid bpf_context access off=0 size=8 processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 -- END PROG LOAD LOG -- The common workaround involved using helper functions to fetch parameter values by passing the address of the context array entry: SEC("fentry/__posix_acl_chmod") int BPF_PROG(trace_posix_acl_chmod, struct posix_acl **ppacl, gfp_t gfp, umode_t mode) { struct posix_acl **pp; bpf_probe_read_kernel(&pp, sizeof(ppacl), &ctx[0]); bpf_printk("__posix_acl_chmod %px\n", pp); return 0; } This approach introduced helper call overhead and created inconsistency with parameter access patterns. Improvements: With this patch, trampoline programs can directly access multi-level pointer parameters, eliminating helper call overhead and explicit ctx access while ensuring consistent parameter handling. For example, the following ctx access with a helper call: SEC("fentry/__posix_acl_chmod") int BPF_PROG(trace_posix_acl_chmod, struct posix_acl **ppacl, gfp_t gfp, umode_t mode) { struct posix_acl **pp; bpf_probe_read_kernel(&pp, sizeof(pp), &ctx[0]); bpf_printk("__posix_acl_chmod %px\n", pp); ... } is replaced by a load instruction: SEC("fentry/__posix_acl_chmod") int BPF_PROG(trace_posix_acl_chmod, struct posix_acl **ppacl, gfp_t gfp, umode_t mode) { bpf_printk("__posix_acl_chmod %px\n", ppacl); ... } The bpf_core_cast macro can be used for deeper level dereferences. v1 -> v2: * corrected maintainer's email v2 -> v3: * Addressed reviewers' feedback: * Changed the register type from PTR_TO_MEM to SCALAR_VALUE. * Modified tests to accommodate SCALAR_VALUE handling. * Fixed a compilation error for loongarch * https://lore.kernel.org/oe-kbuild-all/202602181710.tEK6nOl6-lkp@intel.com/ * Addressed AI bot review * Added a commentary to address a NULL pointer case * Removed WARN_ON * Fixed a commentary v3 -> v4: * Added more consistent support for single and multi-level pointers as suggested by reviewers. * added single level pointers to enum 32 and 64 * added single level pointers to functions * harmonized support for single and multi-level pointer types * added new tests to support the above changes * Removed create_bad_kaddr that allocated and invalidated kernel VA for tests, and replaced it with hardcoded values similar to bpf_testmod_return_ptr as suggested by reviewers. v4 -> v5: * As suggested, extended support to single-level pointers and covered all supported valid pointer (single- and multi-level) types with a wider condition if (!btf_type_is_struct(t)). * As requested, simplified tests by keeping only tests that check the verifier log for scalar(). v5 -> v6: * Fixed the test message based on the bot's feedback. ==================== Link: https://patch.msgid.link/20260314082127.7939-1-slava.imameev@crowdstrike.com Signed-off-by: Alexei Starovoitov commit e8571de53445614997a0352ffb0ac17fd0b3f31c Author: Slava Imameev Date: Sat Mar 14 19:21:27 2026 +1100 selftests/bpf: Add trampolines single and multi-level pointer params test coverage Add single and multi-level pointer parameters and return value test coverage for BPF trampolines. Includes verifier tests for single and multi-level pointers. The tests check verifier logs for pointers inferred as scalar() type. Signed-off-by: Slava Imameev Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260314082127.7939-3-slava.imameev@crowdstrike.com Signed-off-by: Alexei Starovoitov commit 4145203841ba982c031f5717bbd1579d7655941d Author: Slava Imameev Date: Sat Mar 14 19:21:26 2026 +1100 bpf: Support pointer param types via SCALAR_VALUE for trampolines Add BPF verifier support for single- and multi-level pointer parameters and return values in BPF trampolines by treating these parameters as SCALAR_VALUE. This extends the existing support for int and void pointers that are already treated as SCALAR_VALUE. This provides consistent logic for single and multi-level pointers: if a type is treated as SCALAR for a single-level pointer, the same applies to multi-level pointers. The exception is pointer-to-struct, which is currently PTR_TO_BTF_ID for single-level but treated as scalar for multi-level pointers since the verifier lacks context to infer the size of target memory regions. Safety is ensured by existing BTF verification, which rejects invalid pointer types at the BTF verification stage. Signed-off-by: Slava Imameev Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260314082127.7939-2-slava.imameev@crowdstrike.com Signed-off-by: Alexei Starovoitov commit 7ef26d62f3fd841fd18ab6fa93a6bc2de9d17dff Author: Cheng-Yang Chou Date: Wed Mar 25 03:14:04 2026 +0800 selftests/sched_ext: Skip rt_stall on older kernels and list skipped tests rt_stall tests the ext DL server which was introduced in commit cd959a356205 ("sched_ext: Add a DL server for sched_ext tasks"). On older kernels that lack this feature, the test calls ksft_exit_fail() internally which terminates the entire runner process, preventing subsequent tests from running. Add a guard in setup() that checks for the ext_server field in struct rq via __COMPAT_struct_has_field() and returns SCX_TEST_SKIP if not present. Also print the names of skipped tests in the results summary, mirroring the existing behavior for failed tests. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 9edd04c4189e047d4b4f6efd1255e2a32cb167b8 Author: zhidao su Date: Wed Mar 25 02:47:18 2026 +0800 docs: Raise minimum pahole version to 1.26 for KF_IMPLICIT_ARGS kfuncs Since Linux 7.0, kfuncs annotated with KF_IMPLICIT_ARGS require pahole v1.26 or later. Without it, such kfuncs will have incorrect BTF prototypes in vmlinux, causing BPF programs to fail to load with a "func_proto incompatible with vmlinux" error. Many sched_ext kfuncs are affected (e.g. scx_bpf_create_dsq, scx_bpf_kick_cpu). The root cause: scripts/Makefile.btf passes --btf_features=decl_tag_kfuncs to pahole only when pahole >= 1.26. Without that flag, pahole emits no DECL_TAG BTF entries for __bpf_kfunc-annotated functions. As a result, resolve_btfids/main.c::collect_kfuncs() finds no bpf_kfunc DECL_TAGs, short-circuits at line 1002, and btf2btf() never creates the _impl variants or strips the implicit 'aux' argument from the visible proto. The vmlinux BTF retains the 3-param prototype while BPF programs declare the 2-param version, triggering the mismatch. Raise the minimum version in the requirements table from 1.22 to 1.26 and add a note explaining the failure mode, so users understand why their BPF programs fail on distributions shipping pahole v1.25 (e.g. Ubuntu 24.04 LTS). Suggested-by: Jonathan Corbet Signed-off-by: zhidao su Signed-off-by: Tejun Heo commit 2a0a1db5081df02d6753deb1826fd3932a1ab168 Author: Harald Freudenberger Date: Wed Mar 18 17:41:33 2026 +0100 s390/zcrypt: Slight rework on the agent_id field The agent_id field is a two byte ascii field addressing the target agent on the crypto card. Some code however addresses this field as unsigned short. Rework these places to treat this field always as a two byte array. Unfortunately this field also shows up as __u16 in struct ica_xcRB as part of the zcrypt ioctl interface. Leave this untouched as it would break the API. There are two other places (func_id) where a byte array gets assigned with hex values but in fact these are ascii value. So replace these assignments with real ascii values for more readability. Signed-off-by: Harald Freudenberger Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 0e72b785b60e2a33f7bfe1c492f0717e7835b9a4 Author: Harald Freudenberger Date: Wed Mar 18 17:41:32 2026 +0100 s390/zcrypt: Explicitly use a card variable in _zcrypt_send_cprb Use an explicit variable "card" for the card addressing in function _zcrypt_send_cprb instead of the confusing field "user_defined" from the ica_xcRB struct. This makes the code somewhat cleaner and easier to understand. Reviewed-by: Holger Dengler Signed-off-by: Harald Freudenberger Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 227a9197bace4871c64ccd43b4946fc2886083b8 Author: Harald Freudenberger Date: Wed Mar 18 17:41:31 2026 +0100 s390/zcrypt: Rework MKVP fields and handling In general all MKVPs (Master Key Verification Pattern) are binary data - usually some kind of shortened hash value e.g. sha256. Some code parts however used some u64 type which made compares a little bit easier. Anyway this is binary data and so all fields related to MKVP are now u8[] and function parameters use (const) u8 * now. The sysfs emit for the MKVPs also has been adapted to first format the MKVP as hex string into a buffer and then use %s with sysfs_emit_at() to generate the sysfs output. The patch also include a simple whitespace fix. Signed-off-by: Harald Freudenberger Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit ecd2fd113e89978ca750a81dea033a2e9f3347df Author: Harald Freudenberger Date: Wed Mar 18 17:41:30 2026 +0100 s390/zcrypt: Make apfs a real unsigned int field Slight rework on the apfs field: Instead of unsigned char[4] make this a real 32 bit unsigned int field. With that done, some assignments and some printouts can be simplified. With that comes a slight move of the anonymous struct covering the message type 86 header to dedupe some code lines. Reviewed-by: Holger Dengler Signed-off-by: Harald Freudenberger Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit e2c6d91eb8b1533753755f07803e47eceed263d0 Author: Harald Freudenberger Date: Wed Mar 18 17:41:29 2026 +0100 s390/zcrypt: Rework domain processing within zcrypt device driver Slight rework of the domain handling within the zcrypt dd: Remove this curious construct to give a pointer to the domain field within the CPRB struct to the zcrypt API and later fill in the target domain via this pointer. Now the domain is filled in with the send function when the ready constructed AP message is about to be pushed down into the software queue for AP queue processing. So now the domain handling for CCA, EP11 and (internal) rng CPRBs is the same. With this comes a slight reshuffle of the code related to domain processing in the zcrypt API and the message type 60 protocol implementation code. Reviewed-by: Holger Dengler Signed-off-by: Harald Freudenberger Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 23a4757d6d699e602b358808359149d0e8be6db9 Author: Harald Freudenberger Date: Wed Mar 18 17:41:28 2026 +0100 s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code Function rng_type6cprb_msgx() is only used once and thus no need to provide it in header file any more. Move it at the place within the code where it is used. Reviewed-by: Holger Dengler Reviewed-by: Anthony Krowiak Signed-off-by: Harald Freudenberger Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit fa8be59ce23df05d3e1190ce4238f6f875d3868d Author: Heiko Carstens Date: Tue Mar 17 20:54:28 2026 +0100 s390/percpu: Provide arch_raw_cpu_ptr() Provide an s390 specific arch_raw_cpu_ptr() implementation which avoids the detour over get_lowcore() to get the lowcore pointer. The inline assembly is implemented with an alternative so that relocated lowcore (percpu offset is at a different address) is handled correctly. This turns code like this 102f78: a7 39 00 00 lghi %r3,0 102f7c: e3 20 33 b8 00 08 ag %r2,952(%r3) which adds the percpu offset to register r2 into a single instruction 102f7c: e3 20 33 b8 00 08 ag %r2,952(%r0) and also avoids the need of a base register, thus reducing register pressure. With defconfig bloat-o-meter -t provides this result: add/remove: 12/26 grow/shrink: 183/3391 up/down: 14880/-41950 (-27070) Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 762a3847a05c5c229009d36fbd0e2feee9dff81a Author: Kexin Sun Date: Sat Mar 21 18:59:45 2026 +0800 spi: pxa2xx: update outdated reference to pump_transfers() The function pump_transfers() was split into pxa2xx_spi_transfer_one(), pxa2xx_spi_handle_err() and pxa2xx_spi_set_cs() in commit d5898e19c0d7 ("spi: pxa2xx: Use core message processing loop"). The comment in pxa2xx_spi_dma_transfer_complete() still warns about concurrent calls to pump_transfers(), but the actual operation protected by dma_running is now spi_finalize_current_transfer(). Update the reference. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260321105945.8224-1-kexinsun@smail.nju.edu.cn Signed-off-by: Mark Brown commit 3e839947b842b81e3d940044425853477c5a4d7e Author: Kexin Sun Date: Tue Mar 24 12:14:00 2026 +0800 ASoC: update outdated comments for removed snd_soc_new_pcms() The function snd_soc_new_pcms() was removed during the multi-component refactoring in commit f0fba2ad1b6b ("ASoC: multi-component - ASoC Multi-Component Support"). Its PCM creation role is now handled by soc_new_pcm(), which was later moved to sound/soc/soc-pcm.c by commit ddee627cf6bb ("ASoC: core - Separate out PCM operations into new file."). In fsl_dma.c, update the comment to reference soc_new_pcm(). Also remove the stale paragraph about snd_dma_alloc_pages() always allocating in lowmem, since commit e159704f7920 ("ASoC: fsl_dma: Use managed buffer allocation") replaced that call with snd_pcm_set_fixed_buffer_all(). In siu_pcm.c, remove the stale comment referencing snd_soc_new_pcms() and the no-longer-existing socdev structure. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260324041400.16217-1-kexinsun@smail.nju.edu.cn Signed-off-by: Mark Brown commit 3dacdda5e643303a3e56ad303312dfcf72b6fafe Merge: 57fca3a8ed8e8e 6c2505e185b09e Author: Mark Brown Date: Tue Mar 24 19:37:47 2026 +0000 regulator: da91xx: Allow caching of buck registers when no GPIO input control is configured André Svensson says: This series introduces a boolean DT property, dlg,no-gpio-control, for the DA91xx regulators. Use this property to indicate that GPIO control is not configured with the functions DVC/RELOAD/EN, allowing buck registers to be cached. The DA9121 driver checks dlg,no-gpio-control and updates regmap_config's volatile_table if the property is present. Buck registers are removed from the volatile_table if the property is present, enabling caching of the registers, which removes I2C reads when performing an I2C write to the buck registers. Link: https://patch.msgid.link/20260320-no-gpio-control-v2-0-dbc938e462cb@axis.com Signed-off-by: Mark Brown commit 6c2505e185b09e506542956f473631cc09afc403 Author: André Svensson Date: Fri Mar 20 08:33:25 2026 +0100 regulator: da9121: Allow caching BUCK registers Some BUCK registers may change without software writes when GPIO pins are configured for functions DVC/RELOAD/EN. If the board does not use these pin-controlled features, caching is possible. Caching BUCK registers removes unnecessary I2C reads when performing register updates. For example, updating regulator mode can result in two I2C reads, one from the regulator core regulator_set_mode() and one from the DA9121 driver, where da9121_buck_set_mode() uses regmap_update_bits() (read/modify/write). Check for the optional DT property dlg,no-gpio-control. When present, select the regmap configuration that does not mark the BUCK1 register block (DA9121_REG_BUCK_BUCK1_0..DA9121_REG_BUCK_BUCK1_6) as volatile, so that regmap can cache BUCK1 registers and avoid unnecessary I2C reads. The property dlg,no-gpio-control is required to ensure that BUCK1 registers can be cached, as the absence of relevant GPIO DT properties does not imply that the RELOAD/DVC/EN GPIO functions are unused. These functions are provided by DA91xx GPIO pins and may be controlled by external hardware without corresponding GPIO DT properties. The dlg,no-gpio-control property explicitly indicates that none of these GPIO functions are used. The dlg,no-gpio-control property is mutually exclusive with enable-gpios, regardless of whether the referenced GPIO is connected to a GPIO pin or the IC_EN pin, since pulling IC_EN low powers down the regulator and registers are reinitialized at startup, leaving cached values stale. Co-developed-by: Waqar Hameed Signed-off-by: Waqar Hameed Signed-off-by: André Svensson Link: https://patch.msgid.link/20260320-no-gpio-control-v2-2-dbc938e462cb@axis.com Signed-off-by: Mark Brown commit 7795014962fad6cbe11aeb89ccf901b8d7cadcee Author: André Svensson Date: Fri Mar 20 08:33:24 2026 +0100 regulator: dt-bindings: dlg,da9121: Add dlg,no-gpio-control Add the optional boolean property dlg,no-gpio-control. When present, it indicates that no DA91xx GPIO pins are configured/used with functions RELOAD/DVC/EN, which can affect the output voltage control, regulator mode control and enable signal control. The absence of relevant GPIO DT properties does not imply that the RELOAD/DVC/EN GPIO functions are unused. These functions are provided by DA91xx GPIO pins and may be controlled by external hardware without corresponding GPIO DT properties. The dlg,no-gpio-control property explicitly indicates that none of these GPIO functions are used. It is mutually exclusive with enable-gpios, regardless of whether the referenced GPIO is connected to a GPIO pin or the IC_EN pin, since enable-gpios allows the regulator to be controlled via an external hardware signal. Co-developed-by: Waqar Hameed Signed-off-by: Waqar Hameed Signed-off-by: André Svensson Link: https://patch.msgid.link/20260320-no-gpio-control-v2-1-dbc938e462cb@axis.com Signed-off-by: Mark Brown commit 7b4f1a29c704f2c28f32dca5fea6d173891c16a9 Author: Alexei Starovoitov Date: Sun Mar 22 19:24:10 2026 -0700 selftests/bpf: Test 32-bit scalar spill pruning in stacksafe() Add a test verifying that stacksafe() correctly handles 32-bit scalar spills when comparing stack states for equivalence during state pruning. A 32-bit scalar spill creates slot[0-3] = STACK_INVALID and slot[4-7] = STACK_SPILL. Without the im=4 check in stacksafe(), the STACK_SPILL vs STACK_MISC mismatch at byte 4 causes pruning to fail, forcing the verifier to re-explore a path that is provably safe. Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260323022410.75444-2-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 596bef1d718d7a98def7945fad694c3ddbbbfef1 Author: Alexei Starovoitov Date: Sun Mar 22 19:24:09 2026 -0700 bpf: Support 32-bit scalar spills in stacksafe() v1->v2: updated comments v1: https://lore.kernel.org/bpf/20260322225124.14005-1-alexei.starovoitov@gmail.com/ The commit 6efbde200bf3 ("bpf: Handle scalar spill vs all MISC in stacksafe()") in stacksafe() only recognized full 64-bit scalar spills when comparing stack states for equivalence during state pruning and missed 32-bit scalar spill. When 32-bit scalar is spilled the check_stack_write_fixed_off() -> save_register_state() calls mark_stack_slot_misc() for slot[0-3], which preserves STACK_INVALID and STACK_ZERO (on a fresh stack slot[0-3] remain STACK_INVALID), sets slot[4-7] = STACK_SPILL, and updates spilled_ptr. The im=4 path is only reached when im=0 fails: The loop at im=0 already attempts the 64-bit scalar-spill/all-MISC check. If it matches, i advances by 7, skipping the entire 8-byte slot. So im=4 is only reached when bytes 0-3 are neither a scalar spill nor all-MISC — they must pass individual byte-by-byte comparison first. Then bytes 4-7 get the scalar-unit treatment. is_spilled_scalar_after(stack, 4): slot_type[4] == STACK_SPILL from a 64-bit spill would have been caught at im=0 (unless it's a pointer spill, in which case spilled_ptr.type != SCALAR_VALUE -> returns false at im=4 too). A partial overwrite of a 64-bit spill invalidates the entire slot in check_stack_write_fixed_off(). is_stack_misc_after(stack, 4): Only checks bytes 4-7 are MISC/INVALID, returns &unbound_reg. Comparing two unbound regs via regsafe() is safe. Changes to cilium programs: File Program Insns (A) Insns (B) Insns (DIFF) _______________ _________________________________ _________ _________ ________________ bpf_host.o cil_host_policy 49351 45811 -3540 (-7.17%) bpf_host.o cil_to_host 2384 2270 -114 (-4.78%) bpf_host.o cil_to_netdev 112051 100269 -11782 (-10.51%) bpf_host.o tail_handle_ipv4_cont_from_host 61175 60910 -265 (-0.43%) bpf_host.o tail_handle_ipv4_cont_from_netdev 9381 8873 -508 (-5.42%) bpf_host.o tail_handle_ipv4_from_host 12994 7066 -5928 (-45.62%) bpf_host.o tail_handle_ipv4_from_netdev 85015 59875 -25140 (-29.57%) bpf_host.o tail_handle_ipv6_cont_from_host 24732 23527 -1205 (-4.87%) bpf_host.o tail_handle_ipv6_cont_from_netdev 9463 8953 -510 (-5.39%) bpf_host.o tail_handle_ipv6_from_host 12477 11787 -690 (-5.53%) bpf_host.o tail_handle_ipv6_from_netdev 30814 30017 -797 (-2.59%) bpf_host.o tail_handle_nat_fwd_ipv4 8943 8860 -83 (-0.93%) bpf_host.o tail_handle_snat_fwd_ipv4 64716 61625 -3091 (-4.78%) bpf_host.o tail_handle_snat_fwd_ipv6 48299 30797 -17502 (-36.24%) bpf_host.o tail_ipv4_host_policy_ingress 21591 20017 -1574 (-7.29%) bpf_host.o tail_ipv6_host_policy_ingress 21177 20693 -484 (-2.29%) bpf_host.o tail_nodeport_nat_egress_ipv4 16588 16543 -45 (-0.27%) bpf_host.o tail_nodeport_nat_ingress_ipv4 39200 36116 -3084 (-7.87%) bpf_host.o tail_nodeport_nat_ingress_ipv6 50102 48003 -2099 (-4.19%) bpf_lxc.o tail_handle_ipv4_cont 113092 96891 -16201 (-14.33%) bpf_lxc.o tail_handle_ipv6 6727 6701 -26 (-0.39%) bpf_lxc.o tail_handle_ipv6_cont 25567 21805 -3762 (-14.71%) bpf_lxc.o tail_ipv4_ct_egress 28843 15970 -12873 (-44.63%) bpf_lxc.o tail_ipv4_ct_ingress 16691 10213 -6478 (-38.81%) bpf_lxc.o tail_ipv4_ct_ingress_policy_only 16691 10213 -6478 (-38.81%) bpf_lxc.o tail_ipv4_policy 6776 6622 -154 (-2.27%) bpf_lxc.o tail_ipv4_to_endpoint 7523 7219 -304 (-4.04%) bpf_lxc.o tail_ipv6_ct_egress 10275 9999 -276 (-2.69%) bpf_lxc.o tail_ipv6_ct_ingress 6466 6438 -28 (-0.43%) bpf_lxc.o tail_ipv6_ct_ingress_policy_only 6466 6438 -28 (-0.43%) bpf_lxc.o tail_ipv6_policy 6859 5159 -1700 (-24.78%) bpf_lxc.o tail_ipv6_to_endpoint 7039 4427 -2612 (-37.11%) bpf_lxc.o tail_nodeport_ipv6_dsr 1175 1033 -142 (-12.09%) bpf_lxc.o tail_nodeport_nat_egress_ipv4 16318 16292 -26 (-0.16%) bpf_lxc.o tail_nodeport_nat_ingress_ipv4 18907 18490 -417 (-2.21%) bpf_lxc.o tail_nodeport_nat_ingress_ipv6 14624 14556 -68 (-0.46%) bpf_lxc.o tail_nodeport_rev_dnat_ipv4 4776 4588 -188 (-3.94%) bpf_overlay.o tail_handle_inter_cluster_revsnat 15733 15498 -235 (-1.49%) bpf_overlay.o tail_handle_ipv4 124682 105717 -18965 (-15.21%) bpf_overlay.o tail_handle_ipv6 16201 15801 -400 (-2.47%) bpf_overlay.o tail_handle_snat_fwd_ipv4 21280 19323 -1957 (-9.20%) bpf_overlay.o tail_handle_snat_fwd_ipv6 20824 20822 -2 (-0.01%) bpf_overlay.o tail_nodeport_ipv6_dsr 1175 1033 -142 (-12.09%) bpf_overlay.o tail_nodeport_nat_egress_ipv4 16293 16267 -26 (-0.16%) bpf_overlay.o tail_nodeport_nat_ingress_ipv4 20841 20737 -104 (-0.50%) bpf_overlay.o tail_nodeport_nat_ingress_ipv6 14678 14629 -49 (-0.33%) bpf_sock.o cil_sock4_connect 1678 1623 -55 (-3.28%) bpf_sock.o cil_sock4_sendmsg 1791 1736 -55 (-3.07%) bpf_sock.o cil_sock6_connect 3641 3600 -41 (-1.13%) bpf_sock.o cil_sock6_recvmsg 2048 1899 -149 (-7.28%) bpf_sock.o cil_sock6_sendmsg 3755 3721 -34 (-0.91%) bpf_wireguard.o tail_handle_ipv4 31180 27484 -3696 (-11.85%) bpf_wireguard.o tail_handle_ipv6 12095 11760 -335 (-2.77%) bpf_wireguard.o tail_nodeport_ipv6_dsr 1232 1094 -138 (-11.20%) bpf_wireguard.o tail_nodeport_nat_egress_ipv4 16071 16061 -10 (-0.06%) bpf_wireguard.o tail_nodeport_nat_ingress_ipv4 20804 20565 -239 (-1.15%) bpf_wireguard.o tail_nodeport_nat_ingress_ipv6 13490 12224 -1266 (-9.38%) bpf_xdp.o tail_lb_ipv4 49695 42673 -7022 (-14.13%) bpf_xdp.o tail_lb_ipv6 122683 87896 -34787 (-28.36%) bpf_xdp.o tail_nodeport_ipv6_dsr 1833 1862 +29 (+1.58%) bpf_xdp.o tail_nodeport_nat_egress_ipv4 6999 6990 -9 (-0.13%) bpf_xdp.o tail_nodeport_nat_ingress_ipv4 28903 28780 -123 (-0.43%) bpf_xdp.o tail_nodeport_nat_ingress_ipv6 200361 197771 -2590 (-1.29%) bpf_xdp.o tail_nodeport_rev_dnat_ipv4 4606 4454 -152 (-3.30%) Changes to sched-ext: File Program Insns (A) Insns (B) Insns (DIFF) _________________________ ________________ _________ _________ _______________ scx_arena_selftests.bpf.o arena_selftest 236305 236251 -54 (-0.02%) scx_chaos.bpf.o chaos_dispatch 12282 8013 -4269 (-34.76%) scx_chaos.bpf.o chaos_enqueue 11398 7126 -4272 (-37.48%) scx_chaos.bpf.o chaos_init 3854 3828 -26 (-0.67%) scx_flash.bpf.o flash_init 1015 979 -36 (-3.55%) scx_flatcg.bpf.o fcg_dispatch 1143 1100 -43 (-3.76%) scx_lavd.bpf.o lavd_enqueue 35487 35472 -15 (-0.04%) scx_lavd.bpf.o lavd_init 21127 21107 -20 (-0.09%) scx_p2dq.bpf.o p2dq_enqueue 10210 7854 -2356 (-23.08%) scx_p2dq.bpf.o p2dq_init 3233 3207 -26 (-0.80%) scx_qmap.bpf.o qmap_init 20285 20230 -55 (-0.27%) scx_rusty.bpf.o rusty_select_cpu 1165 1148 -17 (-1.46%) scxtop.bpf.o on_sched_switch 2369 2355 -14 (-0.59%) Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260323022410.75444-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov commit 4a1739c30fc66a59450c1f78923f94607e786882 Author: Conor Dooley Date: Thu Nov 20 09:58:45 2025 +0000 riscv: dts: microchip: add tsu clock to macb on mpfs In increment mode, the tsu clock for the macb is provided separately to the pck, usually the same clock as the reference to the rtc provided by an off-chip oscillator. pclk is 150 MHz typically, and the reference is either 100 MHz or 125 MHz, so having the tsu clock is required for correct rate selection. Signed-off-by: Conor Dooley commit feb5dba31a36e22c0ce2be2dcf1ecf9b1c8c61fa Author: Guodong Xu Date: Sun Jan 25 09:36:06 2026 +0800 dt-bindings: riscv: Add Supm extension description Add description for the Supm extension. Supm indicates support for pointer masking in user mode. Supm is mandatory for RVA23S64. Add dependency check that Supm requires either Smnpm or Ssnpm. The Supm extension is ratified in commit d70011dde6c2 ("Update to ratified state") of riscv-j-extension. Signed-off-by: Guodong Xu Acked-by: Conor Dooley Signed-off-by: Conor Dooley commit 0aa19240717879d5ab6f1b7a30e85d93d495f0a3 Author: Pierre-Henry Moussay Date: Mon Nov 17 16:53:24 2025 +0000 riscv: dts: microchip: remove POLARFIRE mention in Makefile Substitute user hidden CONFIG_ARCH_MICROCHIP_POLARFIRE by user visible CONFIG_ARCH_MICROCHIP. Signed-off-by: Pierre-Henry Moussay Signed-off-by: Conor Dooley commit 7219d20f9f421445389eabeb198aca527054fdf9 Author: Pierre-Henry Moussay Date: Mon Nov 17 16:53:23 2025 +0000 riscv: dts: microchip: add pic64gx and its curiosity kit The Curiosity-GX10000 (PIC64GX SoC Curiosity Kit) is a compact SoC prototyping board featuring a Microchip PIC64GX SoC PIC64GC-1000. Features include: - 1 GB DDR4 SDRAM - Gigabit Ethernet - microSD-card slot note: due to issue on some board, the SDHCI is limited to HS (High speed mode, with a clock of 50MHz and 3.3V signals). Signed-off-by: Pierre-Henry Moussay Co-developed-by: Conor Dooley Signed-off-by: Conor Dooley commit 63ddacd42f9eb79582bb47b9236dcf9088b0937d Author: Pierre-Henry Moussay Date: Mon Nov 17 16:53:22 2025 +0000 dt-bindings: riscv: microchip: document the PIC64GX curiosity kit Update devicetree bindings document with PIC64GX Curiosity Kit, known by its "Curiosity-GX1000" product code. Signed-off-by: Pierre-Henry Moussay Reviewed-by: Conor Dooley Acked-by: Rob Herring (Arm) Signed-off-by: Conor Dooley commit 6e9f2cb45d206549a72f07da4a6c464b028c41a1 Author: Pierre-Henry Moussay Date: Mon Nov 17 15:29:54 2025 +0000 dt-bindings: timer: sifive,clint: add pic64gx compatibility As mention in sifive,clint.yaml, a specific compatible should be used for pic64gx, so here it is. Signed-off-by: Pierre-Henry Moussay Acked-by: Conor Dooley Signed-off-by: Conor Dooley commit 123f4276b521a90d3cb47a811b2a91a093ea6815 Author: Conor Dooley Date: Mon Jan 19 11:03:57 2026 +0000 riscv: dts: microchip: add pinctrl nodes for mpfs/icicle kit Add pinctrl nodes to PolarFire to demonstrate their use, matching the default configuration set by the HSS firmware for the Icicle kit's reference design, as a demonstration of use. Signed-off-by: Conor Dooley commit f9963deaa891479da24e32fc614c08f158fe1608 Author: Arnd Bergmann Date: Thu Mar 12 17:49:33 2026 +0100 ntfs3: work around false-postive -Wmaybe-uninitialized warnings gcc sometimes fails to analyse how two local variables in ntfs_write_bh() are initialized, as the initialization happens only in the first pass through the main loop: fs/ntfs3/fsntfs.c: In function 'ntfs_write_bh': fs/ntfs3/fsntfs.c:1443:17: error: 'fixup' may be used uninitialized [-Werror=maybe-uninitialized] 1443 | __le16 *fixup; | ^~~~~ fs/ntfs3/fsntfs.c:1443:17: note: 'fixup' was declared here 1443 | __le16 *fixup; | ^~~~~ fs/ntfs3/fsntfs.c:1487:30: error: 'sample' may be used uninitialized [-Werror=maybe-uninitialized] 1487 | *ptr = sample; | ~~~~~^~~~~~~~ fs/ntfs3/fsntfs.c:1444:16: note: 'sample' was declared here 1444 | __le16 sample; Initializing the two variables to bogus values shuts up the warning and makes it clear that those cannot be used. I tried rearranging the loop to move the initialization in front of it, but couldn't quite figure it out. Fixes: 48d9b57b169f ("fs/ntfs3: add a subset of W=1 warnings for stricter checks") Signed-off-by: Arnd Bergmann Signed-off-by: Konstantin Komarov commit d7ea8495fd307b58f8867acd81a1b40075b1d3ba Author: Deepanshu Kartikey Date: Thu Mar 19 13:15:46 2026 +0530 fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments. The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1). Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup. The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN WARN_ON(1) <- bug fires here! Reported-by: syzbot+c1e9aedbd913fadad617@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c1e9aedbd913fadad617 Fixes: c380b52f6c57 ("fs/ntfs3: Change new sparse cluster processing") Signed-off-by: Deepanshu Kartikey Signed-off-by: Konstantin Komarov commit 81ad9e67eccc0b094a6eef55a19ee56c761416dc Author: Konstantin Komarov Date: Thu Mar 19 14:29:26 2026 +0100 fs/ntfs3: increase CLIENT_REC name field size This patch increases the size of the CLIENT_REC name field from 32 utf-16 chars to 64 utf-16 chars. It fixes the buffer overflow problem in log_replay() reported by Robbert Morris. Reported-by: Signed-off-by: Konstantin Komarov commit 95d324fb1b48434f4c659e4c245c3bdeecdff22c Author: Yury Norov Date: Wed Mar 18 20:43:48 2026 -0400 bitmap: add test_zero_nbits() In most real-life cases, 0-length bitmap provided by user is a sign of an error. The API doesn't provide any guarantees on returned value, and the bitmap pointers are not dereferenced. Signed-off-by: Yury Norov commit 68178644c35fca972ed970dc84933281b4913bff Author: Alex Deucher Date: Fri Mar 20 12:56:20 2026 -0400 drm/amd/display: add a no_hpd link_encoder_funcs variant For link encoders without HPD (analog or LVDS), add a link_encoder_funcs structure with no hpd enable callbacks. The enable and disable hpd callbacks are currently not used outside of a special case in debugfs which checks if the hpd is valid before using it, but this will protect us if they ever are. Reviewed-by: Srinivasan Shanmugam Signed-off-by: Alex Deucher commit a3057aa926ad024e79c6652d891f311d6d0faa5c Author: Sunil Khatri Date: Tue Mar 24 20:46:34 2026 +0530 drm/amdgpu/userq: schedule_delayed_work should be after fence signalled Reorganise the amdgpu_eviction_fence_suspend_worker code so schedule_delayed_work is the last thing we do after amdgpu_userq_evict is complete and the eviction fence is signalled. Suggested-by: Christian König Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 46f4458c236956ad4d185cd46d70d60dfd996f3d Author: Colin Ian King Date: Mon Mar 23 22:43:48 2026 +0000 drm/amdgpu/mes12_1: emove extra ; from declaration statement There is a declaration statement that has a ;; at the end, remove the extraneous ; Reviewed-by: Christian König Signed-off-by: Colin Ian King Signed-off-by: Alex Deucher commit 3b5620f7ee688177fcf65cf61588c5435bce1872 Author: Alex Deucher Date: Thu Feb 26 17:12:08 2026 -0500 drm/amd/display: Fix DCE LVDS handling LVDS does not use an HPD pin so it may be invalid. Handle this case correctly in link encoder creation. Fixes: 7c8fb3b8e9ba ("drm/amd/display: Add hpd_source index check for DCE60/80/100/110/112/120 link encoders") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5012 Cc: Srinivasan Shanmugam Cc: Roman Li Reviewed-by: Roman Li Reviewed-by: Srinivasan Shanmugam Signed-off-by: Alex Deucher commit ab2fcdd7021908d5b1537f97be5a1994339fd6da Author: Kexin Sun Date: Sat Mar 21 18:57:28 2026 +0800 drm/amdgpu: update outdated comment for renamed amdgpu_fence_driver_init() The function amdgpu_fence_driver_init() was renamed to amdgpu_fence_driver_sw_init() by commit 067f44c8b459 ("drm/amdgpu: avoid over-handle of fence driver fini in s3 test (v2)"). Update the stale reference in the amdgpu_fence_driver_init_ring() kdoc. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Signed-off-by: Alex Deucher commit 6d1bb522924a31cf492a0c44f41a8178eba40c90 Author: Chen Ni Date: Fri Mar 20 16:32:47 2026 +0800 drm/amdgpu/userq: convert comma to semicolon Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Signed-off-by: Chen Ni Signed-off-by: Alex Deucher commit 074fe395fb13247b057f60004c7ebcca9f38ef46 Author: Donet Tom Date: Mon Mar 23 09:58:36 2026 +0530 drm/amdgpu: Handle GPU page faults correctly on non-4K page systems During a GPU page fault, the driver restores the SVM range and then maps it into the GPU page tables. The current implementation passes a GPU-page-size (4K-based) PFN to svm_range_restore_pages() to restore the range. SVM ranges are tracked using system-page-size PFNs. On systems where the system page size is larger than 4K, using GPU-page-size PFNs to restore the range causes two problems: Range lookup fails: Because the restore function receives PFNs in GPU (4K) units, the SVM range lookup does not find the existing range. This will result in a duplicate SVM range being created. VMA lookup failure: The restore function also tries to locate the VMA for the faulting address. It converts the GPU-page-size PFN into an address using the system page size, which results in an incorrect address on non-4K page-size systems. As a result, the VMA lookup fails with the message: "address 0xxxx VMA is removed". This patch passes the system-page-size PFN to svm_range_restore_pages() so that the SVM range is restored correctly on non-4K page systems. Acked-by: Christian König Signed-off-by: Donet Tom Signed-off-by: Alex Deucher commit 94c7e9669be1a29b8e44fa6ca3d2d8943b60a91e Author: Kexin Sun Date: Sat Mar 21 18:57:17 2026 +0800 drm/amd/display: update outdated comments for renamed vblank_control_worker() The function vblank_control_worker() was renamed to amdgpu_dm_crtc_vblank_control_worker() by commit 6ce4f9ee25ff ("drm/amd/display: Add prefix to amdgpu crtc functions"). Update the two stale references in amdgpu_dm.c. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Signed-off-by: Alex Deucher commit 392848cdd0aa16e262387c46102eeec821ae866b Author: Adriano Vero Date: Tue Mar 17 21:36:13 2026 +0100 drm/amd/display: clean up typecasts and constants in dcn4_calcs Signed-off-by: Adriano Vero Signed-off-by: Alex Deucher commit 473527e70e73b6f29b54242b8de0dcb459829856 Author: Sunil Khatri Date: Tue Mar 24 13:18:28 2026 +0530 drm/amdgpu/userq: dont use goto to jump when at end of function In function amdgpu_userq_restore_worker we dont need to use goto as we already in the end of function and it will exit naturally. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit a0f0b6d31a53a7607ed44f7623faafc628333258 Author: Prike Liang Date: Thu Mar 19 14:47:11 2026 +0800 drm/amdgpu: fix syncobj leak for amdgpu_gem_va_ioctl() It requires freeing the syncobj and chain alloction resource. Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 16df395a55c635649dd3cf41d61bd685d3fd7a98 Author: Jesse Zhang Date: Fri Mar 20 16:16:16 2026 +0800 drm/amdgpu/vcn4.0.3: gate per-queue reset by PSP SOS program version Add a PSP SOS firmware compatibility check before enabling VCN per-queue reset on vcn_v4_0_3. Per review, program check is sufficient: when PSP SOS program is 0x01, require fw version >= 0x0036015f; otherwise allow per-queue reset. Reviewed-by: Lijo Lazar Suggested-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 6728daa2592788ab040b6e0389f86b197d4d8f6c Author: Jesse.Zhang Date: Thu Mar 19 15:54:38 2026 +0800 drm/amd/pm: Enable VCN reset for pgm=4 with appropriate FW version Extend the VCN reset capability to include pgm=4 variants when the firmware version meets the required threshold (>= 0x04557100). This follows the existing pattern for pgm=0 and pgm=7, ensuring that VCN reset is enabled only on configurations where it is supported by the firmware. Reviewed-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 5c82adf957dcb187add5ee3209439c67b63df538 Author: Jesse.Zhang Date: Mon Mar 23 13:31:54 2026 +0800 drm/amdgpu: use DISCOVERY_TMR_SIZE in ACPI TMR fallback amdgpu_acpi_get_tmr_info() returns the full TMR region size, not the IP discovery table size. Using tmr_size as discovery.size can lead to oversized allocations and probe failure. In the ACPI fallback path, keep discovery.size as DISCOVERY_TMR_SIZE and only use ACPI data for offset calculation. Fixes: 01bdc7e219c4 ("drm/amdgpu: New interface to get IP discovery binary v3") Reviewed-by: Lijo Lazar Suggested-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit bdb2b9e1e08f34a4897c9f2558b4c9941638a6e5 Author: Yang Wang Date: Sun Mar 22 21:48:39 2026 -0400 drm/amd/pm: add dedicated dram addr msg for smu v15 Add dedicated SMU Dram MSG mapping to avoid conflicts in SMU IP v15 common code for upcoming ASICs. add new smu msg: - SMU_MSG_SetDriverDramAddr - SMU_MSG_SetToolsDramAddr Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit ab4905d466b60f170d85e19ca2a5d2b159aeb780 Author: Yang Wang Date: Thu Mar 19 03:36:50 2026 -0400 drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v14 Forcibly disable the OD_FAN_CURVE feature when temperature or PWM range is invalid, otherwise PMFW will reject this configuration on smu v14.0.2/14.0.3. example: $ sudo cat /sys/bus/pci/devices//gpu_od/fan_ctrl/fan_curve OD_FAN_CURVE: 0: 0C 0% 1: 0C 0% 2: 0C 0% 3: 0C 0% 4: 0C 0% OD_RANGE: FAN_CURVE(hotspot temp): 0C 0C FAN_CURVE(fan speed): 0% 0% $ echo "0 50 40" | sudo tee fan_curve kernel log: [ 969.761627] amdgpu 0000:03:00.0: amdgpu: Fan curve temp setting(50) must be within [0, 0]! [ 1010.897800] amdgpu 0000:03:00.0: amdgpu: Fan curve temp setting(50) must be within [0, 0]! Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 5a306bef598886a64712e19b58edeae66e0df408 Merge: 1f0f14aa18e148 cfb385a8dc88d8 Author: Mark Brown Date: Tue Mar 24 17:29:47 2026 +0000 ASoC: Merge up fixes Merge branch 'for-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into asoc-7.1 to get fixes into our development branch and resolve interactions with the match tables. commit 19d4149b22f57094bfc4b86b742381b3ca394ead Author: Srinivasan Shanmugam Date: Mon Mar 23 14:28:57 2026 +0530 drm/amdkfd: Fix NULL pointer check order in kfd_ioctl_create_process In kfd_ioctl_create_process(), the pointer 'p' is used before checking if it is NULL. The code accesses p->context_id before validating 'p'. This can lead to a possible NULL pointer dereference. Move the NULL check before using 'p' so that the pointer is validated before access. Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_chardev.c:3177 kfd_ioctl_create_process() warn: variable dereferenced before check 'p' (see line 3174) Fixes: cc6b66d661fd ("amdkfd: introduce new ioctl AMDKFD_IOC_CREATE_PROCESS") Cc: Zhu Lingshan Cc: Felix Kuehling Cc: Christian König Cc: Alex Deucher Cc: Dan Carpenter Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 3f797396d7f4eb9bb6eded184bbc6f033628a6f6 Author: Alex Deucher Date: Fri Mar 20 12:33:48 2026 -0400 drm/amd/display: check if ext_caps is valid in BL setup LVDS connectors don't have extended backlight caps so check if the pointer is valid before accessing it. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5012 Fixes: 1454642960b0 ("drm/amd: Re-introduce property to control adaptive backlight modulation") Cc: Mario Limonciello Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482 Author: Srinivasan Shanmugam Date: Mon Mar 23 13:41:18 2026 +0530 drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion. Currently, the code drops the fence reference using dma_fence_put() before calling dma_fence_wait(). If dma_fence_put() releases the last reference, the fence may be freed before dma_fence_wait() is called. This can lead to a use-after-free. Fix this by waiting on the fence first and releasing the reference only after dma_fence_wait() completes. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696) Fixes: 9ae55f030dc5 ("drm/amdgpu: Follow up change to previous drm scheduler change.") Cc: Felix Kuehling Cc: Dan Carpenter Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Signed-off-by: Alex Deucher commit be09d78b6d540032fd3841c2708061e13043d7e8 Author: Chao Yu Date: Mon Mar 23 16:38:33 2026 +0800 f2fs: use more generic f2fs_stop_checkpoint() Let's use more generic f2fs_stop_checkpoint() instead of f2fs_handle_critical_error() to handle critical error in f2fs. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit bd882ffdd48a200ca2faa7c3e690ecf765784b16 Author: Chao Yu Date: Mon Mar 23 16:38:32 2026 +0800 f2fs: call f2fs_handle_critical_error() to set cp_error flag f2fs_handle_page_eio() is the only left place we set CP_ERROR_FLAG directly, it missed to update superblock.s_stop_reason, let's call f2fs_handle_critical_error() instead to fix that. Introduce STOP_CP_REASON_READ_{META,NODE,DATA} stop_cp_reason enum variable to indicate which kind of data we failed to read. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5471834a96fb697874be2ca0b052e74bcf3c23d1 Author: Cen Zhang Date: Wed Mar 18 15:32:53 2026 +0800 f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() f2fs_update_inode() reads inode->i_blocks without holding i_lock to serialize it to the on-disk inode, while concurrent truncate or allocation paths may modify i_blocks under i_lock. Since blkcnt_t is u64, this risks torn reads on 32-bit architectures. Following the approach in ext4_inode_blocks_set(), add READ_ONCE() to prevent potential compiler-induced tearing. Fixes: 19f99cee206c ("f2fs: add core inode operations") Cc: stable@vger.kernel.org Signed-off-by: Cen Zhang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1e134c33b931a1b082605b15116403571dab6bbb Author: Yongpeng Yang Date: Thu Mar 19 16:35:27 2026 +0800 f2fs: drop unused ri parameter from truncate_partial_nodes() The ri parameter in truncate_partial_nodes() is unused. Remove it along with the related code. No logical changes. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 95e159ad3e52f7478cfd22e44ec37c9f334f8993 Author: Yongpeng Yang Date: Mon Mar 23 20:06:24 2026 +0800 f2fs: fix fiemap boundary handling when read extent cache is incomplete f2fs_fiemap() calls f2fs_map_blocks() to obtain the block mapping a file, and then merges contiguous mappings into extents. If the mapping is found in the read extent cache, node blocks do not need to be read. However, in the following scenario, a contiguous extent can be split into two extents: $ dd if=/dev/zero of=data.128M bs=1M count=128 $ losetup -f data.128M $ mkfs.f2fs /dev/loop0 -f $ mount -o mode=lfs /dev/loop0 /mnt/f2fs/ $ cd /mnt/f2fs/ $ dd if=/dev/zero of=data.72M bs=1M count=72 && sync $ dd if=/dev/zero of=data.4M bs=1M count=4 && sync $ dd if=/dev/zero of=data.4M bs=1M count=2 seek=2 conv=notrunc && sync $ echo 3 > /proc/sys/vm/drop_caches $ dd if=/dev/zero of=data.4M bs=1M count=2 seek=0 conv=notrunc && sync $ dd if=/dev/zero of=data.4M bs=1M count=2 seek=0 conv=notrunc && sync $ f2fs_io fiemap 0 1024 data.4M Fiemap: offset = 0 len = 1024 logical addr. physical addr. length flags 0 0000000000000000 0000000006400000 0000000000200000 00001000 1 0000000000200000 0000000006600000 0000000000200000 00001001 Although the physical addresses of the ranges 0～2MB and 2M～4MB are contiguous, the mapping for the 2M～4MB range is not present in memory. When the physical addresses for the 0～2MB range are updated, no merge happens because the adjacent mapping is missing from the in-memory cache. As a result, fiemap reports two separate extents instead of a single contiguous one. The root cause is that the read extent cache does not guarantee that all blocks of an extent are present in memory. Therefore, when the extent length returned by f2fs_map_blocks_cached() is smaller than maxblocks, the remaining mappings are retrieved via f2fs_get_dnode_of_data() to ensure correct fiemap extent boundary handling. Cc: stable@kernel.org Fixes: cd8fc5226bef ("f2fs: remove the create argument to f2fs_map_blocks") Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit eb2ca3ca983551a80e16a4a25df5a4ce59df8484 Author: Yongpeng Yang Date: Mon Mar 23 20:06:22 2026 +0800 f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() When f2fs_map_blocks()->f2fs_map_blocks_cached() hits the read extent cache, map->m_multidev_dio is not updated, which leads to incorrect multidevice information being reported by trace_f2fs_map_blocks(). This patch updates map->m_multidev_dio in f2fs_map_blocks_cached() when the read extent cache is hit. Cc: stable@kernel.org Fixes: 0094e98bd147 ("f2fs: factor a f2fs_map_blocks_cached helper") Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 39d4ee19c1e7d753dd655aebee632271b171f43a Author: George Saad Date: Mon Mar 23 11:21:23 2026 +0000 f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() In f2fs_compress_write_end_io(), dec_page_count(sbi, type) can bring the F2FS_WB_CP_DATA counter to zero, unblocking f2fs_wait_on_all_pages() in f2fs_put_super() on a concurrent unmount CPU. The unmount path then proceeds to call f2fs_destroy_page_array_cache(sbi), which destroys sbi->page_array_slab via kmem_cache_destroy(), and eventually kfree(sbi). Meanwhile, the bio completion callback is still executing: when it reaches page_array_free(sbi, ...), it dereferences sbi->page_array_slab — a destroyed slab cache — to call kmem_cache_free(), causing a use-after-free. This is the same class of bug as CVE-2026-23234 (which fixed the equivalent race in f2fs_write_end_io() in data.c), but in the compressed writeback completion path that was not covered by that fix. Fix this by moving dec_page_count() to after page_array_free(), so that all sbi accesses complete before the counter decrement that can unblock unmount. For non-last folios (where atomic_dec_return on cic->pending_pages is nonzero), dec_page_count is called immediately before returning — page_array_free is not reached on this path, so there is no post-decrement sbi access. For the last folio, page_array_free runs while the F2FS_WB_CP_DATA counter is still nonzero (this folio has not yet decremented it), keeping sbi alive, and dec_page_count runs as the final operation. Fixes: 4c8ff7095bef ("f2fs: support data compression") Cc: stable@vger.kernel.org Signed-off-by: George Saad Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1eaf7ee2e682cfd9f9fd48272d50ff5d3a88e9bc Author: Yongpeng Yang Date: Fri Feb 27 15:30:54 2026 +0800 f2fs: drop unused sbi parameter from f2fs_in_warm_node_list() The sbi parameter in f2fs_in_warm_node_list() is not used. Remove it to simplify the function. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53 Author: Yongpeng Yang Date: Fri Feb 27 15:30:52 2026 +0800 f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() The xfstests case "generic/107" and syzbot have both reported a NULL pointer dereference. The concurrent scenario that triggers the panic is as follows: F2FS_WB_CP_DATA write callback umount - f2fs_write_checkpoint - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA) - blk_mq_end_request - bio_endio - f2fs_write_end_io : dec_page_count(sbi, F2FS_WB_CP_DATA) : wake_up(&sbi->cp_wait) - kill_f2fs_super - kill_block_super - f2fs_put_super : iput(sbi->node_inode) : sbi->node_inode = NULL : f2fs_in_warm_node_list - is_node_folio // sbi->node_inode is NULL and panic The root cause is that f2fs_put_super() calls iput(sbi->node_inode) and sets sbi->node_inode to NULL after sbi->nr_pages[F2FS_WB_CP_DATA] is decremented to zero. As a result, f2fs_in_warm_node_list() may dereference a NULL node_inode when checking whether a folio belongs to the node inode, leading to a panic. This patch fixes the issue by calling f2fs_in_warm_node_list() before decrementing sbi->nr_pages[F2FS_WB_CP_DATA], thus preventing the use-after-free condition. Cc: stable@kernel.org Fixes: 50fa53eccf9f ("f2fs: fix to avoid broken of dnode block list") Reported-by: syzbot+6e4cb1cac5efc96ea0ca@syzkaller.appspotmail.com Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 570e2ccc7cb35fe720106964e65060602d3d2ac4 Author: Jianan Huang Date: Thu Mar 5 09:18:10 2026 +0800 f2fs: avoid reading already updated pages during GC We found the following issue during fuzz testing: page: refcount:3 mapcount:0 mapping:00000000b6e89c65 index:0x18b2dc pfn:0x161ba9 memcg:f8ffff800e269c00 aops:f2fs_meta_aops ino:2 flags: 0x52880000000080a9(locked|waiters|uptodate|lru|private|zone=1|kasantag=0x4a) raw: 52880000000080a9 fffffffec6e17588 fffffffec0ccc088 a7ffff8067063618 raw: 000000000018b2dc 0000000000000009 00000003ffffffff f8ffff800e269c00 page dumped because: VM_BUG_ON_FOLIO(folio_test_uptodate(folio)) page_owner tracks the page as allocated post_alloc_hook+0x58c/0x5ec prep_new_page+0x34/0x284 get_page_from_freelist+0x2dcc/0x2e8c __alloc_pages_noprof+0x280/0x76c __folio_alloc_noprof+0x18/0xac __filemap_get_folio+0x6bc/0xdc4 pagecache_get_page+0x3c/0x104 do_garbage_collect+0x5c78/0x77a4 f2fs_gc+0xd74/0x25f0 gc_thread_func+0xb28/0x2930 kthread+0x464/0x5d8 ret_from_fork+0x10/0x20 ------------[ cut here ]------------ kernel BUG at mm/filemap.c:1563! folio_end_read+0x140/0x168 f2fs_finish_read_bio+0x5c4/0xb80 f2fs_read_end_io+0x64c/0x708 bio_endio+0x85c/0x8c0 blk_update_request+0x690/0x127c scsi_end_request+0x9c/0xb8c scsi_io_completion+0xf0/0x250 scsi_finish_command+0x430/0x45c scsi_complete+0x178/0x6d4 blk_mq_complete_request+0xcc/0x104 scsi_done_internal+0x214/0x454 scsi_done+0x24/0x34 which is similar to the problem reported by syzbot: https://syzkaller.appspot.com/bug?extid=3686758660f980b402dc This case is consistent with the description in commit 9bf1a3f ("f2fs: avoid GC causing encrypted file corrupted"): Page 1 is moved from blkaddr A to blkaddr B by move_data_block, and after being written it is marked as uptodate. Then, Page 1 is moved from blkaddr B to blkaddr C, VM_BUG_ON_FOLIO was triggered in the endio initiated by ra_data_block. There is no need to read Page 1 again from blkaddr B, since it has already been updated. Therefore, avoid initiating I/O in this case. Fixes: 6aa58d8ad20a ("f2fs: readahead encrypted block during GC") Signed-off-by: Jianan Huang Signed-off-by: Sheng Yong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 265dccda706667b9c2b6d690636db1df1f751948 Author: liujinbao1 Date: Fri Feb 27 11:02:54 2026 +0800 f2fs: Add defrag_blocks sysfs node Add the defrag_blocks sysfs node to track the amount of data blocks moved during filesystem defragmentation. Signed-off-by: Sheng Yong Signed-off-by: liujinbao1 Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 68a0178981a0f493295afa29f8880246e561494c Author: Yongpeng Yang Date: Tue Feb 3 21:36:35 2026 +0800 f2fs: fix incorrect file address mapping when inline inode is unwritten When `fileinfo->fi_flags` does not have the `FIEMAP_FLAG_SYNC` bit set and inline data has not been persisted yet, the physical address of the extent is calculated incorrectly for unwritten inline inodes. root@vm:/mnt/f2fs# dd if=/dev/zero of=data.3k bs=3k count=1 root@vm:/mnt/f2fs# f2fs_io fiemap 0 100 data.3k Fiemap: offset = 0 len = 100 logical addr. physical addr. length flags 0 0000000000000000 00000ffffffff16c 0000000000000c00 00000301 This patch fixes the issue by checking if the inode's address is valid. If the inline inode is unwritten, set the physical address to 0 and mark the extent with `FIEMAP_EXTENT_UNKNOWN | FIEMAP_EXTENT_DELALLOC` flags. Cc: stable@kernel.org Fixes: 67f8cf3cee6f ("f2fs: support fiemap for inline_data") Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5604129b6504c2d6dfbc02515c43e6186a1285e7 Author: liujinbao1 Date: Fri Feb 13 20:26:30 2026 +0800 f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled During the f2fs_get_victim process, when the f2fs_need_rand_seg is enabled in select_policy, p->offset is a random value, and the search range is from p->offset to MAIN_SECS. When segno >= last_segment, the loop breaks and exits directly without searching the range from 0 to p->offset.This results in an incomplete search when the random offset is not zero. Signed-off-by: liujinbao1 Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 3cf11e6f36c170050c12171dd6fd3142711478fc Author: Chao Yu Date: Wed Mar 4 16:22:31 2026 +0800 f2fs: fix to avoid memory leak in f2fs_rename() syzbot reported a f2fs bug as below: BUG: memory leak unreferenced object 0xffff888127f70830 (size 16): comm "syz.0.23", pid 6144, jiffies 4294943712 hex dump (first 16 bytes): 3c af 57 72 5b e6 8f ad 6e 8e fd 33 42 39 03 ff <.Wr[...n..3B9.. backtrace (crc 925f8a80): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4520 [inline] slab_alloc_node mm/slub.c:4844 [inline] __do_kmalloc_node mm/slub.c:5237 [inline] __kmalloc_noprof+0x3bd/0x560 mm/slub.c:5250 kmalloc_noprof include/linux/slab.h:954 [inline] fscrypt_setup_filename+0x15e/0x3b0 fs/crypto/fname.c:364 f2fs_setup_filename+0x52/0xb0 fs/f2fs/dir.c:143 f2fs_rename+0x159/0xca0 fs/f2fs/namei.c:961 f2fs_rename2+0xd5/0xf20 fs/f2fs/namei.c:1308 vfs_rename+0x7ff/0x1250 fs/namei.c:6026 filename_renameat2+0x4f4/0x660 fs/namei.c:6144 __do_sys_renameat2 fs/namei.c:6173 [inline] __se_sys_renameat2 fs/namei.c:6168 [inline] __x64_sys_renameat2+0x59/0x80 fs/namei.c:6168 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in commit 40b2d55e0452 ("f2fs: fix to create selinux label during whiteout initialization"), we added a call to f2fs_setup_filename() without a matching call to f2fs_free_filename(), fix it. Fixes: 40b2d55e0452 ("f2fs: fix to create selinux label during whiteout initialization") Cc: stable@kernel.org Reported-by: syzbot+cf7946ab25b21abc4b66@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/69a75fe1.a70a0220.b118c.0014.GAE@google.com Suggested-by: Eric Biggers Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d69ee59d38a28ba94347aa8c5cf829825f02f243 Author: Eric Biggers Date: Sat Feb 21 12:13:16 2026 -0800 f2fs: remove unreachable code in f2fs_encrypt_one_page() Since commit 52e7e0d88933 ("fscrypt: Switch to sync_skcipher and on-stack requests") eliminated the dynamic allocation of crypto requests, the only remaining dynamic memory allocation done by fscrypt_encrypt_pagecache_blocks() is the bounce page allocation. The bounce page is allocated from a mempool. Mempool allocations with GFP_NOFS never fail. Therefore, fscrypt_encrypt_pagecache_blocks() can no longer return -ENOMEM when passed GFP_NOFS. Remove the now-unreachable code from f2fs_encrypt_one_page(). Suggested-by: Vlastimil Babka Link: https://lore.kernel.org/all/d9dc2ee1-283d-4467-ad36-a6a4aa557589@suse.cz/ Signed-off-by: Eric Biggers Acked-by: Vlastimil Babka (SUSE) Reviewed-by: Christoph Hellwig Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ede6a05606892bab4f6d785ffcfc124150c2eb32 Author: 谢致邦 (XIE Zhibang) Date: Thu Mar 19 13:55:00 2026 +0000 arm64: dts: rockchip: Fix RK3562 EVB2 model name The model name should be "Rockchip RK3562 EVB2 V10 Board". Fixes: ceb6ef1ea900 ("arm64: dts: rockchip: Add RK3562 evb2 devicetree") Signed-off-by: 谢致邦 (XIE Zhibang) Link: https://patch.msgid.link/tencent_78E7E3F6991FB4403D5ADC9E6A6BC3BF8307@qq.com Signed-off-by: Heiko Stuebner commit 683192d7d5b47e89d920867f7c6997d2c0d1a0ad Author: Fabio Estevam Date: Fri Mar 13 10:10:58 2026 -0300 ARM: dts: rockchip: Add Onion Omega4 Evaluation Board The Onion Omega4 Evaluation Board is based on the RV1103B SoC and has: - 256 MB of RAM - 256 MB of SPI-NAND - Ethernet - USB OTG - Wifi - SD card - Camera connector The details can be found at: https://documentation.onioniot.com/omega4/getting-started/ Add the initial support for this board so that it can fully boot into Linux with the root file system stored in the SPI NAND. Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260313131058.708361-4-festevam@gmail.com Signed-off-by: Heiko Stuebner commit 2ea01fbb1d29d2349aa489eb884938898f10a84d Author: Fabio Estevam Date: Fri Mar 13 10:10:57 2026 -0300 dt-bindings: arm: rockchip: Add Omega4 Evaluation board Onion Omega4 board is a board based on the RV1103B SoC. Document its compatible. Signed-off-by: Fabio Estevam Acked-by: Conor Dooley Link: https://patch.msgid.link/20260313131058.708361-3-festevam@gmail.com Signed-off-by: Heiko Stuebner commit b4dc241c68f5a2a6e312259bf23885d693f91960 Author: Fabio Estevam Date: Fri Mar 13 10:10:56 2026 -0300 ARM: dts: rockchip: Add support for RV1103B Add the initial RV1103B devicetree. Based on the 5.10 Rockchip vendor kernel. Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260313131058.708361-2-festevam@gmail.com Signed-off-by: Heiko Stuebner commit 25c2721f18ff97226a6561aedc9f8f76a51fe2e8 Author: Fabio Estevam Date: Fri Mar 13 10:10:55 2026 -0300 dt-bindings: soc: rockchip: grf: Add RV1103B compatibles Add the PMU GRF and IOC compatible strings for the RV1103B SoC. Signed-off-by: Fabio Estevam Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260313131058.708361-1-festevam@gmail.com Signed-off-by: Heiko Stuebner commit b2038df0b535bc0497eca9db15a08c4586e0033f Merge: 94c8dc1fa8e1ad 75d627e5571a5e Author: Heiko Stuebner Date: Tue Mar 24 17:39:43 2026 +0100 Merge branch 'v7.1-shared/clkids' into v7.1-armsoc/dts32 commit 943cfbca992f44e67a36779d94008d9080ca054f Author: Anas Iqbal Date: Sat Mar 14 11:01:37 2026 +0000 remoteproc: use SIZE_MAX in rproc_u64_fit_in_size_t() Smatch reports: drivers/remoteproc/remoteproc_elf_loader.c:221 warn: always true condition '(val <= -1)' The helper function rproc_u64_fit_in_size_t() compares the value against (size_t)-1, which is equivalent to SIZE_MAX but can confuse static analysis tools and lead to the above warning. Replace (size_t)-1 with SIZE_MAX to make the intent explicit and avoid the Smatch warning without changing the behavior. Signed-off-by: Anas Iqbal Link: https://lore.kernel.org/r/20260314110137.178981-1-mohd.abd.6602@gmail.com Signed-off-by: Mathieu Poirier commit fd4cb4511b5904188a17af73c7533da16420d4e8 Author: Randy Dunlap Date: Wed Jan 28 17:12:12 2026 -0800 tracing: trace_mmap.h: fix a kernel-doc warning Add a description of struct reader to resolve a kernel-doc warning: Warning: include/uapi/linux/trace_mmap.h:43 struct member 'reader' not described in 'trace_buffer_meta' Signed-off-by: Randy Dunlap Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 7109310c5031075ecb9b5da75b1443557c232dcd Merge: 300aaca3435cca e8c819df02436f Author: Johannes Berg Date: Tue Mar 24 17:12:38 2026 +0100 Merge tag 'mt76-next-2026-03-23' of https://github.com/nbd168/wireless Felix Fietkau says: =================== mt76 patches for 7.1 - fixes - mt7996/mt7925 MLO fixes/improvements - mt7996 NPU support - mt7996 external EEPROM support =================== Signed-off-by: Johannes Berg commit 8fd7576fd6d801d2286e1cc5f0c7643e1caeeb32 Author: Cunyuan Liu Date: Fri Mar 13 11:31:19 2026 +0800 drm/komeda: Add support for Arm China Linlon-D6 Arm China Linlon-D6 is register-compatible with the Mali-D71 display pipeline for the purpose of basic modesetting. On Linlon-D6, the PRODUCT_ID register is located at the same offset as on Mali-D71 and reports 0x0060. The IP also exposes the same Komeda top-level block layout expected by the existing d71_identify() probing flow, so we can reuse the D71 function table to bring up the display engine. Reviewed-by: Liviu Dudau Signed-off-by: Cunyuan Liu Signed-off-by: Liviu Dudau Link: https://patch.msgid.link/20260313033119.33686-4-cunyuan.liu@cixtech.com commit bf5348ed7257dafc8d25cc4edb3461c1ee114d4a Author: Cunyuan Liu Date: Fri Mar 13 11:31:18 2026 +0800 dt-bindings: display: arm,komeda: add Arm China Linlon D6 compatible Add the Arm China Linlon D6 display controller compatible string. Linlon D6 is register-compatible with Mali-D71, so describe it as a vendor-specific compatible with a fallback to "arm,mali-d71". Reviewed-by: Liviu Dudau Signed-off-by: Cunyuan Liu Acked-by: Krzysztof Kozlowski Signed-off-by: Liviu Dudau Link: https://patch.msgid.link/20260313033119.33686-3-cunyuan.liu@cixtech.com commit 7aca0fda2ae1759273188480f46ed77bb67ef8c4 Author: Cunyuan Liu Date: Fri Mar 13 11:31:17 2026 +0800 dt-bindings: vendor-prefixes: Add Arm Technology (China) Co., Ltd. Add "armchina" vendor prefix for Arm Technology (China) Co., Ltd. Link: https://www.armchina.com/ Acked-by: Rob Herring (Arm) Signed-off-by: Cunyuan Liu Reviewed-by: Liviu Dudau Signed-off-by: Liviu Dudau Link: https://patch.msgid.link/20260313033119.33686-2-cunyuan.liu@cixtech.com commit 94c8dc1fa8e1ad4037084204152bca1e799d7d1c Author: Fabio Estevam Date: Mon Mar 23 09:57:21 2026 -0300 ARM: dts: rockchip: Pass linux,code to the power key on rk3288-veyron-pinky According to gpio-keys.yaml, linux,code is a required property. Pass it to fix the following dt-schema warning: lid-switch (gpio-keys): key-power: 'linux,code' is a required property Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260323125721.692139-1-festevam@gmail.com Signed-off-by: Heiko Stuebner commit 02bcf8ef264d5a400c811d71ee637a4b6ea49c51 Author: Kumar Kartikeya Dwivedi Date: Tue Mar 24 08:22:30 2026 -0700 bpf: Update MAINTAINERS file for general BPF entry Per discussion with Alexei, add Eduard and myself as maintainers under BPF [GENERAL]. While at it, drop R entries for reviewers who have been inactive. Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260324152230.2916217-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 1dfa2fd98f17d639f47ceb1d3b07926131db5c16 Author: Marcin Slusarz Date: Tue Mar 24 14:25:57 2026 +0100 drm/panthor: extend timestamp query with flags Flags now control which data user space wants to query, there is more information sources, and there's ability to query duration of multiple timestamp reads. New sources: - CPU's monotonic, - CPU's monotonic raw, - GPU's cycle count These changes should make the implementation of VK_KHR_calibrated_timestamps more accurate and much simpler. Signed-off-by: Marcin Slusarz Reviewed-by: Boris Brezillon Reviewed-by: Liviu Dudau Signed-off-by: Liviu Dudau Link: https://patch.msgid.link/20260324132557.1707286-1-marcin.slusarz@arm.com commit 2cd14eb95c392ab88756700c2ddc6c520c9bd56f Author: Christian Hewitt Date: Mon Mar 23 08:11:32 2026 +0000 drm/panthor: correct firmware related messages Some English language corrections to firmware messages. No functional changes. Signed-off-by: Christian Hewitt Reviewed-by: Liviu Dudau Reviewed-by: Boris Brezillon Signed-off-by: Liviu Dudau Link: https://patch.msgid.link/20260323081132.3217646-1-christianshewitt@gmail.com commit b43d574c00324f26732260b378fb473e024e9a21 Author: Varun R Mallya Date: Sun Mar 22 03:10:38 2026 +0530 selftests/bpf: Add test for struct_ops __ref argument in any position Add a selftest to verify that the verifier correctly identifies refcounted arguments in struct_ops programs, even when they are not the first argument. This ensures that the restriction on tail calls for programs with __ref arguments is properly enforced regardless of which argument they appear in. This test verifies the fix for check_struct_ops_btf_id() proposed by Keisuke Nishimura [0], which corrected a bug where only the first argument was checked for the refcounted flag. The test includes: - An update to bpf_testmod to add 'test_refcounted_multi', an operator with three arguments where the third is tagged with "__ref". - A BPF program 'test_refcounted_multi' that attempts a tail call. - A test runner that asserts the verifier rejects the program with "program with __ref argument cannot tail call". [0]: https://lore.kernel.org/bpf/20260320130219.63711-1-keisuke.nishimura@inria.fr/ Signed-off-by: Varun R Mallya Link: https://lore.kernel.org/r/20260321214038.80479-1-varunrmallya@gmail.com Signed-off-by: Alexei Starovoitov commit 25e3e1f1096089a64901ae1faa7b7b13446653db Author: Keisuke Nishimura Date: Fri Mar 20 14:02:20 2026 +0100 bpf: Fix refcount check in check_struct_ops_btf_id() The current implementation only checks whether the first argument is refcounted. Fix this by iterating over all arguments. Signed-off-by: Keisuke Nishimura Fixes: 38f1e66abd184 ("bpf: Do not allow tail call in strcut_ops program with __ref argument") Reviewed-by: Emil Tsalapatis Acked-by: Amery Hung Link: https://lore.kernel.org/r/20260320130219.63711-1-keisuke.nishimura@inria.fr Signed-off-by: Alexei Starovoitov commit e8c819df02436f2c2379766946735e1f06a7c923 Author: Lorenzo Bianconi Date: Sun Mar 15 11:26:29 2026 +0100 wifi: mt76: mt7996: Destroy active sta links in mt7996_mac_sta_remove() Similar to vif link management, postpone sta link destuction in mt7996_mac_sta_remove() introducing mt7996_mac_sta_remove_link utility routine and just disable sta link running mt7996_mac_sta_remove_links routine. This is a preliminary patch in order to support MLO link reconfiguration in MT7996 driver. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-6-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau commit e7ec71d9f8fafe9b431c6b4673465390273d744d Author: Shayne Chen Date: Sun Mar 15 11:26:28 2026 +0100 wifi: mt76: mt7996: Add mcu APIs to enable/disable vif links. Introduce mt7996_mcu_mld_reconf_stop_link and mt7996_mcu_mld_link_oper utility routines in order to communicate to the mcu fw to disable/enable a specific vif link. Please note these APIs are currently supported by the MT7996 firmware only in AP mode. Signed-off-by: Shayne Chen Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-5-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau commit 08813703ac412360e060cc9abd4a60e3c6668781 Author: Lorenzo Bianconi Date: Sun Mar 15 11:26:27 2026 +0100 wifi: mt76: mt7996: Destroy vif active links in mt7996_remove_interface() MT7996 hw requires to remove active links from the mcu BSSINFO table destroying the interface. For this reason introduce mt7996_vif_link_destroy routine and remove active (non-offchannel) vif links running mt7996_remove_interface routine. This is a preliminary patch in order to support MLO link reconfiguration in MT7996 driver. Co-developed-by: Shayne Chen Signed-off-by: Shayne Chen Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-4-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau commit c8d22f28ea583bda31b7db8243e4e1eb042ac38a Author: Shayne Chen Date: Sun Mar 15 11:26:26 2026 +0100 wifi: mt76: mt7996: Move mlink deallocation in mt7996_vif_link_remove() Destroy mt76_vif_link struct in mt7996_vif_link_remove routine and not in mt76_unassign_vif_chanctx(). This is necessary since, in order to properly support MLO link reconfiguration, we will destroy mt76_vif_link struct during AP tear-down process and not running unassign_vif_chanctx mac80211 callback. This patch does not introduce any regression since mt76_assign_vif_chanctx/mt76_unassign_vif_chanctx APIs are currently used just by MT7996 driver. Signed-off-by: Shayne Chen Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-3-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau commit 108cb0c43fdc93bad105dcd00c30d9729520c71f Author: Shayne Chen Date: Sun Mar 15 11:26:25 2026 +0100 wifi: mt76: mt7996: Account active links in valid_links fields Track active vif links in mt7996_vif_link_add and mt7996_vif_link_remove routines. This is a preliminary patch in order to remove AP MLD links from MCU configuration during AP tear-down process and to support MLO link reconfiguration in MT7996 driver. Signed-off-by: Shayne Chen Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-2-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau commit 76ceccd60bdd1e496e0e70700f3e045d7bc339bf Author: Lorenzo Bianconi Date: Sun Mar 15 11:26:24 2026 +0100 wifi: mt76: mt7996: Rely on msta_link link_id in mt7996_vif_link_remove() Rely on msta_link link_id value in mt7996_vif_link_remove routine instead of using link_conf pointer. This assumption is correct since msta_link link_id is set to link_conf link_id value in mt7996_vif_link_add routine. Moreover, fallback to default ieee80211_bss_conf struct if the link_conf pointer in mt7996_vif_link_remove() is NULL. MT7996 hw requires to remove AP MLD links from MCU configuration during AP tear-down process (e.g. running mt7996_remove_interface()). Doing so, we can't assume link_conf pointer is always non-NULL running mt7996_vif_link_remove routine. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-1-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau commit 59a295335021f6973a34566554b2b9371f1c6f7d Author: Peter Chiu Date: Mon Mar 16 12:44:27 2026 +0100 wifi: mt76: mt7996: fix frequency separation for station STR mode Fix frequency separation field for STR in MLD capabilities to get the correct chip capability. Signed-off-by: Peter Chiu Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260316-mt7996-sta-str-v1-1-666814e6ab2d@kernel.org Signed-off-by: Felix Fietkau commit 9fc83205a62eeeb775739ba6d8efcfdda9b7780a Author: Sean Wang Date: Fri Mar 6 17:22:38 2026 -0600 wifi: mt76: mt7925: host-only unwind published links on add failure Release host link resources when mt7925_mac_sta_add_links() fails after partial success. msta->link[] and dev->mt76.wcid[] may already be published, so unwind the host state to avoid leaving stale links behind. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-20-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit db134691924fb19535ad6f27e09354c8ad001964 Author: Sean Wang Date: Fri Mar 6 17:22:37 2026 -0600 wifi: mt76: mt7925: publish msta->link after successful link add Move the msta->link[link_id] publication until after mt7925_mac_link_sta_add() succeeds. msta->link[] is RCU-visible, so publishing it before setup completes can expose a link whose add path later fails. Publish it only after success to avoid partially initialized link state becoming visible. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-19-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 6ace866cf6d2c5db3bcc8a0d55dcb2d705f2e7f8 Author: Sean Wang Date: Fri Mar 6 17:22:36 2026 -0600 wifi: mt76: mt7925: switch link STA allocation to RCU lifetime Allocate mt792x_link_sta with kzalloc() and free it with kfree_rcu() instead of devm-managed memory. msta->link[] is published via RCU, so the link STA must remain valid until readers have quiesced after teardown. Manage the object lifetime with kfree_rcu() to match its RCU-visible publication. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-18-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 52f088a2e6bfae6d30eea274738e82898c246bd6 Author: Sean Wang Date: Fri Mar 6 17:22:35 2026 -0600 wifi: mt76: mt7925: move WCID teardown into link_sta_remove() Move WCID teardown into mt7925_mac_link_sta_remove() to mirror the dev->mt76.wcid[] publish done during link add. This clears the published WCID before the rest of teardown, so WCID lookups no longer expose a link that is being removed. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-17-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 0fff5b5e2786a4fed7c67087bbaa44ff4a2e200d Author: Sean Wang Date: Fri Mar 6 17:22:34 2026 -0600 wifi: mt76: mt7925: drop WCID reinit after publish Remove the redundant mt76_wcid_init() call after publishing the WCID in mt7925_mac_link_sta_add(). WCID is already initialized before publication, so reinitializing it afterward is unnecessary and makes the setup ordering less clear. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-16-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 75e2d6bfd9ac69c79adfe6fa2854558158b260de Author: Sean Wang Date: Fri Mar 6 17:22:33 2026 -0600 wifi: mt76: mt7925: unwind WCID setup on link STA add failure Undo the published WCID state when mt7925_mac_link_sta_add() fails after WCID setup. The add path can fail after dev->mt76.wcid[] is published, so the error path must clear the partial host-side WCID state to avoid leaving stale entries behind. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-15-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit da14a9349746bae246621f4fbab9e2720b800f6c Author: Sean Wang Date: Fri Mar 6 17:22:32 2026 -0600 wifi: mt76: mt7925: make WCID cleanup unconditional in sta_remove_links() Drop the dead pri_link check in mt7925_mac_sta_remove_links() and perform WCID cleanup unconditionally. mlink->pri_link is already cleared before the test, making the branch ineffective. This matches the actual teardown behaviour and simplifies the remove path. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-14-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 9763ead5b9f8fd69033fbe77046a2c5bdd749cf5 Author: Sean Wang Date: Fri Mar 6 17:22:31 2026 -0600 wifi: mt76: mt7925: pass mconf and mlink to wtbl_update_hdr_trans() Drop the mt792x_vif_to_link() lookup in mt7925_mcu_wtbl_update_hdr_trans() and pass the resolved mconf and mlink from the caller instead. The link context is already known at the call site, making the lookup redundant. This keeps the helper lookup-free and makes link ownership explicit. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-13-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit beec58f36983f826fe90287a90edff46b32e8a89 Author: Sean Wang Date: Fri Mar 6 17:22:30 2026 -0600 wifi: mt76: mt7925: resolve link after acquiring mt76 mutex mt792x_sta_to_link() uses rcu_dereference_protected() and therefore expects mt76.mutex to be held. Move the lookup after mt792x_mutex_acquire() to make the locking explicit and correct. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-12-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit cf9db836b1e069a3d6a80c72b9bdc12df78b0dd1 Author: Sean Wang Date: Fri Mar 6 17:22:29 2026 -0600 wifi: mt76: mt7925: pass mlink to set_link_key() Drop the mt792x_sta_to_link() lookup in mt7925_set_link_key() and pass the resolved mlink from the caller instead. The link context is already known at the call site, making the lookup redundant. This keeps the helper lookup-free and makes link ownership explicit. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-11-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 46a2264681500f3fff9ebf7ad64f5704d2b568bb Author: Sean Wang Date: Fri Mar 6 17:22:28 2026 -0600 wifi: mt76: mt7925: pass mlink to wtbl_update_hdr_trans() Drop the mt792x_sta_to_link() lookup in mt7925_mcu_wtbl_update_hdr_trans() and pass the resolved mlink from the caller instead. The link context is already known at the call site, making the lookup redundant. This keeps the helper lookup-free and makes link ownership explicit. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-10-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 292651cafac012ebad3d9d68b38f69117da4685d Author: Sean Wang Date: Fri Mar 6 17:22:27 2026 -0600 wifi: mt76: mt7925: validate mlink in sta_hdr_trans_tlv() Replace the dead wcid NULL check in mt7925_mcu_sta_hdr_trans_tlv() with a WARN_ON_ONCE() guard on mlink before dereferencing mlink->wcid. wcid is always derived from mlink, so mlink is the only meaningful object to validate here. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-9-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 8951131c18979b9d40d0f8a164be0432e8d1083b Author: Sean Wang Date: Fri Mar 6 17:22:26 2026 -0600 wifi: mt76: mt7925: pass mlink to sta_hdr_trans_tlv() Drop the mt792x_sta_to_link() lookup in mt7925_mcu_sta_hdr_trans_tlv() and pass the resolved mlink from the caller instead. The link is already known at the call site, making the lookup redundant. This keeps the helper lookup-free and makes WCID selection explicit. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-8-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 9e4d518a4707175e1154876b760d4f2b39967e9d Author: Sean Wang Date: Fri Mar 6 17:22:25 2026 -0600 wifi: mt76: mt7925: pass mlink to mac_link_sta_remove() Drop the mt792x_sta_to_link() lookup in mt7925_mac_link_sta_remove() and pass mlink from mt7925_mac_sta_remove_links() instead. The link is already resolved there, making the extra lookup redundant. This keeps the remove helper lookup-free and avoids hidden dependence on msta->link[link_id] during teardown. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-7-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit ecc57c9899e60456015fb355bfcf7650af7d13c1 Author: Sean Wang Date: Fri Mar 6 17:22:24 2026 -0600 wifi: mt76: mt7925: resolve primary mlink via def_wcid Use mlink->wcid.def_wcid to obtain the primary mlink in mt7925_mac_link_sta_add() instead of calling mt792x_sta_to_link(). The primary link context is already carried by the WCID, so the extra lookup is redundant. This makes the add path follow the existing WCID association directly. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-6-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit dc019e3294c7e3c6e997bb11732d46ce0d9211e9 Author: Sean Wang Date: Fri Mar 6 17:22:23 2026 -0600 wifi: mt76: mt7925: pass mlink to mcu_sta_update() Drop the mt792x_sta_to_link() lookup in mt7925_mcu_sta_update() and pass the resolved mlink from the caller instead. The link context is already known at the call site, making the lookup redundant. This keeps the helper lookup-free and makes WCID selection explicit. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-5-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit ff643b81bc38eaff6c0ab783a62e4ba9e10d2476 Author: Sean Wang Date: Fri Mar 6 17:22:22 2026 -0600 wifi: mt76: mt7925: pass mlink and mconf to sta_mld_tlv() Drop the mt792x_sta_to_link() lookup in mt7925_mcu_sta_mld_tlv() and pass mlink and mconf from the caller instead. The link context is already known at the call site, making the lookup redundant. This keeps the helper lookup-free and makes MLD link selection explicit. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-4-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit ea757740dd87c0b00c4844dd3282dff4d83fa3c7 Author: Sean Wang Date: Fri Mar 6 17:22:21 2026 -0600 wifi: mt76: mt7925: pass WCID indices to bss_basic_tlv() Drop the mt792x_sta_to_link() lookup in mt7925_mcu_bss_basic_tlv() and pass the resolved WCID indices from the caller instead. The link context is already known, so the lookup is redundant. This makes link ownership explicit and keeps the helper lookup-free. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-3-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit a1353d994c167c818ef4165653a5ccec091ba534 Author: Sean Wang Date: Fri Mar 6 17:22:20 2026 -0600 wifi: mt76: mt7925: pass mlink to sta_amsdu_tlv() Drop the mt792x_sta_to_link() lookup in mt7925_mcu_sta_amsdu_tlv() and pass mlink from the caller instead. The link context is already known so the lookup is redundant. This makes link ownership explicit and keeps the helper lookup-free. No functional change intended. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-2-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit fc4533b5db80792fccc2bf4a14322e7af1e55980 Author: StanleyYP Wang Date: Thu Mar 12 17:57:24 2026 +0800 wifi: mt76: mt7996: fix issues with manually triggered radar detection Disallow triggering radar detection on non-DFS channels to prevent paused TX queues from failing to resume, as a channel switch is not performed in this case. Signed-off-by: StanleyYP Wang Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20260312095724.2117448-6-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 9eeea2984c309f4c21c697e163abbef00c4d2b5e Author: Rex Lu Date: Thu Mar 12 17:57:22 2026 +0800 wifi: mt76: mt7996: adjust timeout value for boot-up calibration commands Align the vendor driver by adjusting the timeout values for the MCU_UNI_CMD_EFUSE_CTRL and MCU_UNI_CMD_EXT_EEPROM_CTRL commands. Without this adjustment, false positive command timeout errors may occur, especially on some iPA variants. Signed-off-by: Rex Lu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20260312095724.2117448-4-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 22f9abaf3656cf08d36196bab950668e7fc64381 Author: Peter Chiu Date: Thu Mar 12 17:57:21 2026 +0800 wifi: mt76: mt7996: update WFSYS reset flow for MT7990 chipsets Skip WFSYS reset during bootup for MT7990 chipsets; only reset if L0.5 recovery is triggered. Without this fix, the following kernel error may occur: Internal error: synchronous external abort. Signed-off-by: Peter Chiu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20260312095724.2117448-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit cf909557c1ba1215328db41f883ca5af5849f2fd Author: Howard Hsu Date: Thu Mar 12 17:57:20 2026 +0800 wifi: mt76: mt7996: support critical packet mode for MT7990 chipsets For MT7990 chipsets, critical packet mode must be enabled. Without this, some higher priority packets may be placed in the wrong AC queue. Signed-off-by: Howard Hsu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20260312095724.2117448-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 73b46379e5231138025b271ce8e158d2a8aa0768 Author: Peter Chiu Date: Thu Mar 12 17:57:19 2026 +0800 wifi: mt76: mt7996: fix RRO EMU configuration Use the correct helper to update specific bitfields instead of overwriting the entire register. Fixes: eedb427eb260 ("wifi: mt76: mt7996: Enable HW RRO for MT7992 chipset") Signed-off-by: Peter Chiu Signed-off-by: Shayne Chen Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260312095724.2117448-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 56154fef47d104effa9f29ed3db4f805cbc0d640 Author: Sean Wang Date: Tue Mar 10 19:28:25 2026 -0500 wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling mt7925u uses different reset/status registers from mt7921u. Reusing the mt7921u register set causes the WFSYS reset to fail. Add a chip-specific descriptor in mt792xu_wfsys_reset() to select the correct registers and fix mt7925u failing to initialize after a warm reboot. Fixes: d28e1a48952e ("wifi: mt76: mt792x: introduce mt792x-usb module") Cc: stable@vger.kernel.org Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260311002825.15502-2-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit e6f48512c1ceebcd1ce6bb83df3b3d56a261507d Author: Sean Wang Date: Tue Mar 10 19:28:24 2026 -0500 wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Prepare mt792xu_wfsys_reset() for chips that share the same USB WFSYS reset flow but use different register definitions. This is a pure refactor of the current mt7921u path and keeps the reset sequence unchanged. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260311002825.15502-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 4df75606ece504a0cef3552ae88217a4af1b7dba Author: Felix Fietkau Date: Mon Mar 9 06:07:30 2026 +0000 wifi: mt76: add per-link beacon monitoring for MLO With chanctx drivers using hardware scan or remain-on-channel, mac80211 does not know when the radio goes off-channel, which breaks its software beacon loss detection. Implement per-link beacon monitoring in the driver. Track the last beacon timestamp per link and check for beacon loss periodically from the mac_work handler. Beacon monitoring is initialized on association and on late link activation, and cleared on disassociation. The beacon_mon_last timestamp is reset when returning from offchannel and after channel switches to prevent false beacon loss detection. Link: https://patch.msgid.link/20260309060730.87840-11-nbd@nbd.name Signed-off-by: Felix Fietkau commit e765bd6708cdeeab01121247165cae04a254868e Author: Felix Fietkau Date: Mon Mar 9 06:07:29 2026 +0000 wifi: mt76: wait for firmware TX completion of mgmt frames before channel switch After flushing software-pending frames to DMA, mt76_has_tx_pending() only checks DMA ring q->queued. For token-based drivers, q->queued is decremented at DMA consumption, but firmware may not have transmitted the frame yet. Waiting for all tokens is not feasible because data frames may be stuck in firmware powersave/aggregation queues. Track PSD queue tokens (firmware ALTX) per phy using an atomic counter. These frames are sent by firmware immediately without PS buffering, so the counter reliably reaches zero after transmission. Increment the counter in mt76_token_consume() and decrement it in mt76_token_release(), only for PSD queue tokens. Include the counter in mt76_has_tx_pending() so channel switch waits for firmware TX completion of management and nullfunc frames. mt7615 (uses mt76_token_get/put) and non-token drivers are unaffected as they never call mt76_token_consume/release. Link: https://patch.msgid.link/20260309060730.87840-10-nbd@nbd.name Signed-off-by: Felix Fietkau commit 331e766e75d2a64b5c1f38aadfcfcf31d264f43e Author: Felix Fietkau Date: Mon Mar 9 06:07:28 2026 +0000 wifi: mt76: route nullfunc frames to PSD/ALTX queue ieee80211_is_data() returns true for nullfunc/QoS-nullfunc frames, so they bypass the PSD queue routing and go through the regular VO data queue. This means firmware processes them through the normal TID queue instead of the ALTX queue, which doesn't guarantee immediate transmission. Use ieee80211_is_data_present() instead, which returns false for both management frames and nullfunc/QoS-nullfunc (no payload), routing them to MT_TXQ_PSD. Firmware maps PSD to the ALTX queue, which transmits immediately without PS buffering. This only affects frames from the mt76_tx() pending path. Regular mac80211 TXQ scheduling is unchanged. Link: https://patch.msgid.link/20260309060730.87840-9-nbd@nbd.name Signed-off-by: Felix Fietkau commit 0dcef1cbae27d806cd29c296cc03ad6e8ece771d Author: Felix Fietkau Date: Mon Mar 9 06:07:27 2026 +0000 wifi: mt76: flush pending TX before channel switch mt76_tx() queues frames on wcid->tx_pending for async processing by tx_worker. In __mt76_set_channel(), the worker gets disabled before it may have run, and the subsequent wait only checks DMA ring queues, not the software pending list. This means frames like nullfunc PS frames from mt76_offchannel_notify() may never be transmitted on the correct channel. Fix this by running mt76_txq_schedule_pending() synchronously after disabling the tx_worker but before setting MT76_RESET, which would otherwise cause mt76_txq_schedule_pending_wcid() to bail out. Link: https://patch.msgid.link/20260309060730.87840-8-nbd@nbd.name Signed-off-by: Felix Fietkau commit 381733b3a14aaef36b421571c1e99856304311f1 Author: Felix Fietkau Date: Mon Mar 9 06:07:26 2026 +0000 wifi: mt76: send nullfunc PS frames on offchannel transitions Since mt76 uses chanctx, mac80211 does not send nullfunc power save notifications when the driver goes offchannel for scan or ROC. Add mt76_offchannel_notify() to send nullfunc PM=1 before going offchannel and PM=0 after returning, so that the AP can buffer frames during the absence. For MLO, iterate all vif links on the phy and set IEEE80211_TX_CTRL_MLO_LINK so that the driver's tx_prepare_skb resolves the correct per-link wcid. Link: https://patch.msgid.link/20260309060730.87840-7-nbd@nbd.name Signed-off-by: Felix Fietkau commit f72dd74dd0b69e3a87b4702f3c860e9a7318d5dd Author: Felix Fietkau Date: Mon Mar 9 06:07:25 2026 +0000 wifi: mt76: optimize ROC for same-channel case mt76_remain_on_channel() always creates an HT20 chandef and goes offchannel, even when the ROC channel matches the operating channel. This unnecessarily narrows bandwidth and triggers beacon stop/restart. When the ROC channel matches the current operating channel, preserve the full chandef and skip the offchannel transition, matching the optimization already present in the scan code. Extract the shared same-channel detection into mt76_offchannel_chandef() and use it in both ROC and scan paths. Link: https://patch.msgid.link/20260309060730.87840-6-nbd@nbd.name Signed-off-by: Felix Fietkau commit de62b24224ac1533c17b3d5bae77164a82ae2e49 Author: Felix Fietkau Date: Mon Mar 9 06:07:24 2026 +0000 wifi: mt76: abort ROC on chanctx changes mt76_change_chanctx() calls mt76_phy_update_channel() which switches the hardware channel. If ROC is active on the same phy, this switches away from the ROC channel and clears offchannel, but leaves ROC state intact. Mac80211 still thinks the phy is on the ROC channel. Abort any active ROC before proceeding, matching the pattern already used in add, remove, assign, unassign, and switch chanctx functions. Link: https://patch.msgid.link/20260309060730.87840-5-nbd@nbd.name Signed-off-by: Felix Fietkau commit f0fb9afb74ec5bec49585772502db62613321fc6 Author: Felix Fietkau Date: Mon Mar 9 06:07:23 2026 +0000 wifi: mt76: check chanctx before restoring channel after ROC mt76_remove_chanctx() sets phy->chanctx to NULL but does not clear phy->main_chandef. If ROC is later performed on that phy, completion tries to restore the stale main_chandef channel, programming the hardware to sit on a channel with no active context. Add a chanctx check to avoid restoring a channel when no context is active. Link: https://patch.msgid.link/20260309060730.87840-4-nbd@nbd.name Signed-off-by: Felix Fietkau commit ec0a9b01ef88b5f5bdf74140f8c987f7a96693af Author: Felix Fietkau Date: Mon Mar 9 06:07:22 2026 +0000 wifi: mt76: add offchannel check to mt76_roc_complete mt76_roc_complete() unconditionally calls __mt76_set_channel() to restore the operating channel. The scan equivalent mt76_scan_complete() checks phy->offchannel first, skipping the restore if the phy is already back on-channel. Without this check, ROC completion performs a redundant full hardware channel switch when something has already moved the phy back. Link: https://patch.msgid.link/20260309060730.87840-3-nbd@nbd.name Signed-off-by: Felix Fietkau commit 360552c8592dab3c69e0bbff786b55137f1a81bb Author: Chad Monroe Date: Mon Mar 9 06:07:21 2026 +0000 wifi: mt76: support upgrading passive scans to active On channels with NO_IR or RADAR flags, wait for beacon before sending probe requests. Allows active scanning and WPS on restricted channels if another AP is already present. Fixes: c56d6edebc1f ("wifi: mt76: mt7996: use emulated hardware scan support") Tested-by: Piotr Kubik Signed-off-by: Chad Monroe Link: https://patch.msgid.link/20251118102723.47997-2-nbd@nbd.name Link: https://patch.msgid.link/20260309060730.87840-2-nbd@nbd.name Signed-off-by: Felix Fietkau commit 0420180df092419a96351fb2afec1e2a74d385c3 Author: Chad Monroe Date: Mon Mar 9 06:07:20 2026 +0000 wifi: mt76: fix multi-radio on-channel scanning avoid unnecessary channel switch when performing an on-channel scan using a multi-radio device. Fixes: c56d6edebc1f ("wifi: mt76: mt7996: use emulated hardware scan support") Signed-off-by: Chad Monroe Link: https://patch.msgid.link/20251118102723.47997-1-nbd@nbd.name Link: https://patch.msgid.link/20260309060730.87840-1-nbd@nbd.name Signed-off-by: Felix Fietkau commit e648051d52afbdb360bd586218961f5fffff63e8 Author: Lorenzo Bianconi Date: Sun Mar 8 14:25:20 2026 +0100 wifi: mt76: mt7996: Decrement sta counter removing the link in mt7996_mac_reset_sta_iter() Fixes tracking per-phy stations for offchannel switching. Fixes: ace5d3b6b49e8 ("wifi: mt76: mt7996: improve hardware restart reliability") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260308-mt7996_mac_reset_vif_iter-fix-v1-1-57f640aa2dcf@kernel.org Signed-off-by: Felix Fietkau commit 5806c91a3f0d21d233f8c386c892e1ffaf64d7b2 Author: Lorenzo Bianconi Date: Fri Mar 6 11:27:55 2026 +0100 wifi: mt76: mt7996: Remove unnecessary phy filed in mt7996_vif_link struct Remove unnecessary phy pointer in mt7996_vif_link struct and rely on mt7996_vif_link_phy() utility routine. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260306-mt7996-deflink-lookup-link-remove-v1-4-7162b332873c@kernel.org Signed-off-by: Felix Fietkau commit 569ce4340268915911fc356ec9ad27e92fb82289 Author: Lorenzo Bianconi Date: Fri Mar 6 11:27:52 2026 +0100 wifi: mt76: mt7996: Remove link pointer dependency in mt7996_mac_sta_remove_links() Remove link pointer dependency in mt7996_mac_sta_remove_links routine to get the mt7996_phy pointer since the link can be already offchannel running mt7996_mac_sta_remove_links(). Rely on __mt7996_phy routine instead. Fixes: 344dd6a4c919 ("wifi: mt76: mt7996: Move num_sta accounting in mt7996_mac_sta_{add,remove}_links") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260306-mt7996-deflink-lookup-link-remove-v1-1-7162b332873c@kernel.org Signed-off-by: Felix Fietkau commit c0a47ffc4caaf5161955add553322112c3a211b0 Author: Lorenzo Bianconi Date: Sun Sep 28 18:27:01 2025 +0200 wifi: mt76: mt7996: Add missing CHANCTX_STA_CSA property Enable missing CHANCTX_STA_CSA property required for MLO. Fixes: f5160304d57c ("wifi: mt76: mt7996: Enable MLO support for client interfaces") Signed-off-by: Lorenzo Bianconi Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20250928-mt7996_chanctx_sta_csa-v1-1-82e455185990@kernel.org Signed-off-by: Felix Fietkau commit 62e037aa8cf5a69b7ea63336705a35c897b9db2b Author: Quan Zhou Date: Wed Feb 25 17:47:22 2026 +0800 wifi: mt76: mt7925: fix incorrect TLV length in CLC command The previous implementation of __mt7925_mcu_set_clc() set the TLV length field (.len) incorrectly during CLC command construction. The length was initialized as sizeof(req) - 4, regardless of the actual segment length. This could cause the WiFi firmware to misinterpret the command payload, resulting in command execution errors. This patch moves the TLV length assignment to after the segment is selected, and sets .len to sizeof(req) + seg->len - 4, matching the actual command content. This ensures the firmware receives the correct TLV length and parses the command properly. Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Cc: stable@vger.kernel.org Signed-off-by: Quan Zhou Acked-by: Sean Wang Link: https://patch.msgid.link/f56ae0e705774dfa8aab3b99e5bbdc92cd93523e.1772011204.git.quan.zhou@mediatek.com Signed-off-by: Felix Fietkau commit f0168f2f9a1eca55d3ae09d8250b94e82b67cac3 Author: Ziyi Guo Date: Sat Jan 31 03:52:10 2026 +0000 wifi: mt76: add missing lock protection in mt76_sta_state for sta_event callback mt76_sta_state() calls the sta_event callback without holding dev->mutex. However, mt7915_mac_sta_event() (MT7915 implementation of this callback) calls mt7915_mac_twt_teardown_flow() which has lockdep_assert_held(&dev->mt76.mutex) indicating that callers must hold this lock. The locking pattern in mt76_sta_state() is inconsistent: - mt76_sta_add() acquires dev->mutex before calling dev->drv->sta_add - mt76_sta_remove() acquires dev->mutex before calling __mt76_sta_remove - But sta_event callback is called without acquiring the lock Add mutex_lock()/mutex_unlock() around the mt7915_mac_twt_teardown_flow invocation to fix the missing lock protection and maintain consistency with the existing locking pattern. Signed-off-by: Ziyi Guo Link: https://patch.msgid.link/20260131035210.2198259-1-n7l8m4@u.northwestern.edu Signed-off-by: Felix Fietkau commit 3dc0c40d7806c72cfe88cf4e1e2650c1673f9db4 Author: Michael Lo Date: Wed Feb 11 17:50:25 2026 +0800 wifi: mt76: mt7921: fix 6GHz regulatory update on connection Call mt7921_regd_update() instead of mt7921_mcu_set_clc() when setting the 6GHz power type after connection, so that regulatory limits and SAR power are also applied. Fixes: 51ba0e3a15eb ("wifi: mt76: mt7921: add 6GHz power type support for clc") Signed-off-by: Michael Lo Link: https://patch.msgid.link/20260211095025.2415624-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau commit 947d63d8cd3b03c7be16875ca90273edbdbe7ce5 Author: Ryder Lee Date: Fri Feb 13 00:00:29 2026 -0800 wifi: mt76: mt7996: Disable Rx hdr_trans in monitor mode Ensure raw frames are captured without header modification. Signed-off-by: Ryder Lee Link: https://patch.msgid.link/04008426d6cd5de3995beefb98f9d13f35526c25.1770969275.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau commit c9ce833d7891804f618c3c8349d9c96e4fe62774 Author: MeiChia Chiu Date: Tue Feb 3 09:32:02 2026 +0100 wifi: mt76: mt7996: Add eMLSR support Implement set_eml_op_mode mac80211 callback in order to introduce eMLSR support. Tested-by: Christian Marangi Signed-off-by: MeiChia Chiu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260203-mt7996-emlsr-v1-1-38ffb3d5110c@kernel.org Signed-off-by: Felix Fietkau commit c8f62f73bbced3a79894655bdb0b625462d956fc Author: Duoming Zhou Date: Sat Jan 31 10:47:31 2026 +0800 wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() When the mt7996 pci chip is detaching, the mt7996_crash_data is released in mt7996_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7996_mac_dump_work(). The race condition can occur as follows: CPU 0 (removal path) | CPU 1 (workqueue) mt7996_pci_remove() | mt7996_sys_recovery_set() mt7996_unregister_device() | mt7996_reset() mt7996_coredump_unregister() | queue_work() vfree(dev->coredump.crash_data) | mt7996_mac_dump_work() | crash_data-> // UAF Fix this by ensuring dump_work is properly canceled before the crash_data is deallocated. Add cancel_work_sync() in mt7996_unregister_device() to synchronize with any pending or executing dump work. Fixes: 878161d5d4a4 ("wifi: mt76: mt7996: enable coredump support") Signed-off-by: Duoming Zhou Link: https://patch.msgid.link/20260131024731.18741-1-duoming@zju.edu.cn Signed-off-by: Felix Fietkau commit 1146d0946b5358fad24812bd39d68f31cd40cc34 Author: Duoming Zhou Date: Fri Jan 30 22:57:59 2026 +0800 wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() When the mt7915 pci chip is detaching, the mt7915_crash_data is released in mt7915_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7915_mac_dump_work(). The race condition can occur as follows: CPU 0 (removal path) | CPU 1 (workqueue) mt7915_pci_remove() | mt7915_sys_recovery_set() mt7915_unregister_device() | mt7915_reset() mt7915_coredump_unregister() | queue_work() vfree(dev->coredump.crash_data) | mt7915_mac_dump_work() | crash_data-> // UAF Fix this by ensuring dump_work is properly canceled before the crash_data is deallocated. Add cancel_work_sync() in mt7915_unregister_device() to synchronize with any pending or executing dump work. Fixes: 4dbcb9125cc3 ("wifi: mt76: mt7915: enable coredump support") Signed-off-by: Duoming Zhou Link: https://patch.msgid.link/20260130145759.84272-1-duoming@zju.edu.cn Signed-off-by: Felix Fietkau commit 964f870e090e9c88a41e2890333421204cc0bdf4 Author: David Bauer Date: Fri Jan 30 00:23:20 2026 +0100 wifi: mt76: don't return TXQ when exceeding max non-AQL packets mt76_txq_send_burst does check if the number of non-AQL frames exceeds the maximum. In this case the queue is returned to ieee80211_return_txq when iterating over the scheduled TXQs in mt76_txq_schedule_list. This has the effect of inserting said TXQ at the head of the list. This means the loop will get the same TXQ again, which will terminate the scheduling round. TXQs following in the list thus never get scheduled for transmission. This can manifest in high latency low throughput or broken connections for said STAs. Check if the non-AQL packet count exceeds the limit and not return the TXQ in this case. Schedule all TXQs for the STA in case the non-AQL limit can be satisfied again. Signed-off-by: David Bauer Link: https://patch.msgid.link/20260129232321.276575-1-mail@david-bauer.net Signed-off-by: Felix Fietkau commit 1f9017d19db38ad2cb9bedb5b078f6f4f60afa94 Author: StanleyYP Wang Date: Tue Feb 3 23:55:32 2026 +0800 wifi: mt76: mt7996: fix queue pause after scan due to wrong channel switch reason Previously, we used the IEEE80211_CONF_IDLE flag to avoid setting the parking channel with the CH_SWITCH_NORMAL reason, which could trigger TX emission before bootup CAC. However, we found that this flag can be set after triggering scanning on a connected station interface, and the reason CH_SWITCH_SCAN_BYPASS_DPD will be used when switching back to the operating channel, which makes the firmware failed to resume paused AC queues. Seems that we should avoid relying on this flag after switching to single multi-radio architecture. Instead, use the existence of chanctx as the condition. Signed-off-by: StanleyYP Wang Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20260203155532.1098290-4-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 169c83d3df95b57e787174454332e01eb1b823ed Author: StanleyYP Wang Date: Tue Feb 3 23:55:31 2026 +0800 wifi: mt76: avoid to set ACK for MCU command if wait_resp is not set When wait_resp is not set but the ACK option is enabled in the MCU TXD, the ACK event is enqueued to the MCU event queue without being dequeued by the original MCU command request. Any orphaned ACK events will only be removed from the queue when another MCU command requests a response. Due to sequence index mismatches, these events are discarded one by one until a matching sequence index is found. However, if several MCU commands that do not require a response continue to fill up the event queue, there is a risk that when an MCU command with wait_resp enabled is issued, it may dequeue the wrong event skb, especially if the queue contains events with all possible sequence indices. Signed-off-by: StanleyYP Wang Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20260203155532.1098290-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit efbd5bf395f4e6b45a87f3835d4c2e28170c77c5 Author: StanleyYP Wang Date: Tue Feb 3 23:55:30 2026 +0800 wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event The cid field is defined as a two-byte value in the firmware. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: StanleyYP Wang Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20260203155532.1098290-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 97b9f9831bf297f3ffa62018721601ed2736f2c3 Author: Shayne Chen Date: Tue Feb 3 23:55:29 2026 +0800 wifi: mt76: mt7996: fix wrong DMAD length when using MAC TXP The struct mt76_connac_fw_txp is used for HIF TXP. Change to use the struct mt76_connac_hw_txp to fix the wrong DMAD length for MAC TXP. Fixes: cb6ebbdffef2 ("wifi: mt76: mt7996: support writing MAC TXD for AddBA Request") Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20260203155532.1098290-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 02b7a65719a00b5edea5b60b00ff85440a3f5d38 Author: Sean Wang Date: Wed Feb 18 18:40:07 2026 -0600 wifi: mt76: mt7921: add MT7902 SDIO device support Register the MT7902 SDIO device ID in the mt7921 driver and add its corresponding firmware and ROM patch names. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260219004007.19733-11-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit c26319afb5fb403a0bb2a604cee95a5bab8bbf18 Author: Sean Wang Date: Wed Feb 18 18:40:06 2026 -0600 wifi: mt76: mt7921: add MT7902 PCIe device support Register the MT7902 PCI device ID in the mt7921 driver and add its corresponding firmware and ROM patch names. Co-developed-by: Xiong Huang Signed-off-by: Xiong Huang Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260219004007.19733-10-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 199443b4015238f46c8a578b84c3834a48246355 Author: Sean Wang Date: Wed Feb 18 18:40:05 2026 -0600 wifi: mt76: mt792x: add MT7902 WFDMA prefetch configuration Configure the RX/TX ring prefetch setting for MT7902 PCIe device. This is a prerequisite patch before enabling MT7902 PCIe support. Co-developed-by: Xiong Huang Signed-off-by: Xiong Huang Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260219004007.19733-9-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 6d32fb25768946cf2bc8eef9ba77acf9406867ef Author: Sean Wang Date: Wed Feb 18 18:40:04 2026 -0600 wifi: mt76: mt7921: add MT7902 MCU support Add MCU support for the MT7902 chipset. runtime pm is not yet supported by the driver, but normal mac80211 operation is unaffected. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260219004007.19733-8-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 9eef868b86db32d40e4a45f407af8aa1e4e4e830 Author: Sean Wang Date: Wed Feb 18 18:40:03 2026 -0600 wifi: mt76: mt792x: ensure MCU ready before ROM patch download Restart the MCU and poll FW state to ensure correct MCU status before downloading the ROM patch. This is a prerequisite for enabling MT7902 PCIe and has been validated on MT7921 and MT7925 since they share the common code path. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260219004007.19733-7-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 14a7ba034fcd9d1766503ef44cc491c6fda8db2c Author: Sean Wang Date: Wed Feb 18 18:40:02 2026 -0600 wifi: mt76: mt792x: add PSE handling barrier for the large MCU cmd Add a dummy register read in mt76_connac_mcu_rate_txpower_band() to act as a PSE barrier. This would release PSE pages and prevents buffer underflow issues when handling MCU commands with larger payloads without the response in mt76_connac_mcu_set_rate_txpower(). This is a prerequisite patch before enabling MT7902 PCIe and SDIO support. Co-developed-by: Xiong Huang Signed-off-by: Xiong Huang Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260219004007.19733-6-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 0a7d2fca06afb036ff2d61540fc68e6e48eb9fbe Author: Sean Wang Date: Wed Feb 18 18:40:01 2026 -0600 wifi: mt76: connac: mark MT7902 as hw txp devices Add MT7902 to is_mt76_fw_txp() so it follows the legacy TX descriptor path like the other connac2 chips that return false. This is a prerequisite patch before enabling MT7902 pcie support. Co-developed-by: Xiong Huang Signed-off-by: Xiong Huang Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260219004007.19733-5-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit d3bb1ca22896a28860009cb83dd8af09748bccac Author: Sean Wang Date: Wed Feb 18 18:40:00 2026 -0600 wifi: mt76: mt7921: add MT7902e DMA layout support Add MT7902 PCIe specific DMA layout overrides for MCU TXQ index, RX ring size, and MCU_WA usage. Common layout remains the default for other chips. This is a prerequisite patch before enabling MT7902 PCIe support. Co-developed-by: Xiong Huang Signed-off-by: Xiong Huang Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260219004007.19733-4-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 222606f43b587c9fb4ae063d04db146100c8951c Author: Sean Wang Date: Wed Feb 18 18:39:59 2026 -0600 wifi: mt76: mt7921: handle MT7902 irq_map quirk with mutable copy MT7902 PCIe requires a different wm2_complete_mask value, so introduce a mutable per-device copy of the default irq_map and override the field only for this chip. Other devices continue using the shared const template. This is a prerequisite patch before enabling MT7902 PCIe support. Co-developed-by: Xiong Huang Signed-off-by: Xiong Huang Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260219004007.19733-3-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 918af1f87f7de988a7e84a7a85390a7d626ee189 Author: Sean Wang Date: Wed Feb 18 18:39:58 2026 -0600 wifi: mt76: mt7921: use mt76_for_each_q_rx() in reset path Replace explicit napi_disable() calls for RX queues with mt76_for_each_q_rx() in mt7921e_mac_reset(). This removes hardcoded queue indices and disables all configured RX queues during reset. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260219004007.19733-2-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 5c81a4f182d9b48f32e2548f4a39dd76eafb5404 Author: Sean Wang Date: Wed Feb 18 18:39:57 2026 -0600 wifi: mt76: connac: use is_connac2() to replace is_mt7921() checks Unify all per-chip conditionals under the new is_connac2() helper. This avoids confusion caused by the previous is_mt7921() check, which implicitly covered multiple connac2 chipsets and no longer reflected its actual scope. This is a clean-up only change with no functional impact. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260219004007.19733-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit fa1063fc649c08b37f9a21d8bc38344ce8a128f5 Author: StanleyYP Wang Date: Thu Feb 12 17:03:10 2026 +0800 wifi: mt76: mt7996: apply calibration-free data from OTP Before sending the current EEPROM data to the firmware, read the calibration-free data (FT data) from the efuse and merge it with the existing EEPROM data. Co-developed-by: Shayne Chen Signed-off-by: Shayne Chen Signed-off-by: StanleyYP Wang Link: https://patch.msgid.link/20260212090310.3335392-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 676d5d009bc68596a88104137a0bf785b8c2562a Author: Shayne Chen Date: Thu Feb 12 17:03:09 2026 +0800 wifi: mt76: mt7996: add variant for MT7992 chipsets Introduce VAR_TYPE_24 for the MT7992 chipsets, a dual-band variant supporting 3T3R/2SS on the 2 GHz band and 5T5R/4SS on the 5GHz band. Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20260212090310.3335392-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit f456e1f56c4cdda1f908f1b97b57f6d45f578f2c Author: StanleyYP Wang Date: Thu Feb 12 17:03:08 2026 +0800 wifi: mt76: add external EEPROM support for mt799x chipsets For the MT7992 and MT7990 chipsets, efuse mode is not supported because there is insufficient space in the efuse to store the calibration data. Therefore, an additional on-chip EEPROM is added to address this limitation. Co-developed-by: Elwin Huang Signed-off-by: Elwin Huang Co-developed-by: Shayne Chen Signed-off-by: Shayne Chen Signed-off-by: StanleyYP Wang Link: https://patch.msgid.link/20260212090310.3335392-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit ad2f7ed0ee91d63792cbe52f2b38325918ae3daa Author: Weixie Cui Date: Sat Mar 21 14:08:00 2026 +0800 bpf: propagate kvmemdup_bpfptr errors from bpf_prog_verify_signature kvmemdup_bpfptr() returns -EFAULT when the user pointer cannot be copied, and -ENOMEM on allocation failure. The error path always returned -ENOMEM, misreporting bad addresses as out-of-memory. Return PTR_ERR(sig) so user space gets the correct errno. Signed-off-by: Weixie Cui Acked-by: Jiri Olsa Link: https://lore.kernel.org/r/tencent_C9C5B2B28413D6303D505CD02BFEA4708C07@qq.com Signed-off-by: Alexei Starovoitov commit 280de43e88c0ed3ac453dde05ccb7e72dca01780 Author: Martin KaFai Lau Date: Mon Mar 23 15:52:50 2026 -0700 bpf: Remove ipv6_bpf_stub usage in test_run bpf_prog_test_run_skb() uses net->ipv6.ip6_null_entry for BPF_PROG_TYPE_LWT_XMIT test runs. It currently checks ipv6_bpf_stub before using ip6_null_entry. ipv6_bpf_stub will be removed by the CONFIG_IPV6=m support removal series posted at [1], so switch this check to ipv6_mod_enabled() instead. This change depends on that series [1]. Without it, CONFIG_IPV6=m is still possible, and net->ipv6.ip6_null_entry remains NULL until the IPv6 module is loaded. [1] https://lore.kernel.org/netdev/20260320185649.5411-1-fmancera@suse.de/ Cc: Jakub Kicinski Cc: Fernando Fernandez Mancera Signed-off-by: Martin KaFai Lau Reviewed-by: Sun Jian Reviewed-by: Fernando Fernandez Mancera Link: https://lore.kernel.org/r/20260323225250.1623542-1-martin.lau@linux.dev Signed-off-by: Alexei Starovoitov commit e0a384434ae1bdfb03954c46c464e3dbd3223ad6 Author: Martin Kaiser Date: Wed Mar 25 00:47:01 2026 +0900 tracing: fprobe: do not zero out unused fgraph_data If fprobe_entry does not fill the allocated fgraph_data completely, the unused part does not have to be zeroed. fgraph_data is a short-lived part of the shadow stack. The preceding length field allows locating the end regardless of the content. Link: https://lore.kernel.org/all/20260324084804.375764-1-martin@kaiser.cx/ Signed-off-by: Martin Kaiser Signed-off-by: Masami Hiramatsu (Google) commit 03b7b389fe88ce07d3b91e2d6b07ee67a3281d4c Author: Amery Hung Date: Mon Mar 23 16:11:33 2026 -0700 selftests/bpf: Fix compiler warnings in task_local_data.h Fix compiler warnings about unused parameter, narrowing non-constant into a smaller type and comparison between integers of different size. Signed-off-by: Amery Hung Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260323231133.859941-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 833ef4a954e12485b9fd44e4e5eeb349ac194c26 Author: Hao Sun Date: Fri Mar 20 17:23:36 2026 +0100 bpf: Simplify tnum_step() Simplify tnum_step() from a 10-variable algorithm into a straight line sequence of bitwise operations. Problem Reduction: tnum_step(): Given a tnum `(tval, tmask)` where `tval & tmask == 0`, and a value `z` with `tval ≤ z < (tval | tmask)`, find the smallest `r > z`, a tnum-satisfying value, i.e., `r & ~tmask == tval`. Every tnum-satisfying value has the form tval | s where s is a subset of tmask bits (s & ~tmask == 0). Since tval and tmask are disjoint: tval | s = tval + s Similarly z = tval + d where d = z - tval, so r > z becomes: tval + s > tval + d s > d The problem reduces to: find the smallest s, a subset of tmask, such that s > d. Notice that `s` must be a subset of tmask, the problem now is simplified. Algorithm: The mask bits of `d` form a "counter" that we want to increment by one, but the counter has gaps at the fixed-bit positions. A normal +1 would stop at the first 0-bit it meets; we need it to skip over fixed-bit gaps and land on the next mask bit. Step 1 -- plug the gaps: d | carry_mask | ~tmask - ~tmask fills all fixed-bit positions with 1. - carry_mask = (1 << fls64(d & ~tmask)) - 1 fills all positions (including mask positions) below the highest non-mask bit of d. After this, the only remaining 0s are mask bits above the highest non-mask bit of d where d is also 0 -- exactly the positions where the carry can validly land. Step 2 -- increment: (d | carry_mask | ~tmask) + 1 Adding 1 flips all trailing 1s to 0 and sets the first 0 to 1. Since every gap has been plugged, that first 0 is guaranteed to be a mask bit above all non-mask bits of d. Step 3 -- mask: ((d | carry_mask | ~tmask) + 1) & tmask Strip the scaffolding, keeping only mask bits. Call the result inc. Step 4 -- result: tval | inc Reattach the fixed bits. A simple 8-bit example: tmask: 1 1 0 1 0 1 1 0 d: 1 0 1 0 0 0 1 0 (d = 162) ^ non-mask 1 at bit 5 With carry_mask = 0b00111111 (smeared from bit 5): d|carry|~tm 1 0 1 1 1 1 1 1 + 1 1 1 0 0 0 0 0 0 & tmask 1 1 0 0 0 0 0 0 The patch passes my local test: test_verifier, test_progs for `-t verifier` and `-t reg_bounds`. CBMC shows the new code is equiv to original one[1], and a lean4 proof of correctness is available[2]: theorem tnumStep_correct (tval tmask z : BitVec 64) -- Precondition: valid tnum and input z (h_consistent : (tval &&& tmask) = 0) (h_lo : tval ≤ z) (h_hi : z < (tval ||| tmask)) : -- Postcondition: r must be: -- (1) tnum member -- (2) z < r -- (3) for any other member w > z, r <= w let r := tnumStep tval tmask z satisfiesTnum64 r tval tmask ∧ tval ≤ r ∧ r ≤ (tval ||| tmask) ∧ z < r ∧ ∀ w, satisfiesTnum64 w tval tmask → z < w → r ≤ w := by -- unfold definition unfold tnumStep satisfiesTnum64 simp only [] refine ⟨?_, ?_, ?_, ?_, ?_⟩ -- the solver proves each conjunct · bv_decide · bv_decide · bv_decide · bv_decide · intro w hw1 hw2; bv_decide [1] https://github.com/eddyz87/tnum-step-verif/blob/master/main.c [2] https://pastebin.com/raw/czHKiyY0 Signed-off-by: Hao Sun Acked-by: Eduard Zingerman Acked-by: Shung-Hsi Yu Reviewed-by: Harishankar Vishwanathan Link: https://lore.kernel.org/r/20260320162336.166542-1-hao.sun@inf.ethz.ch Signed-off-by: Alexei Starovoitov commit 4ea43a43550542eb6751a0d41f2cec999cf3fa6a Author: Puranjay Mohan Date: Wed Mar 18 10:22:57 2026 -0700 bpftool: Enable aarch64 ISA extensions for JIT disassembly The LLVM disassembler needs ISA extension features enabled to correctly decode instructions from those extensions. On aarch64, without these features, instructions like LSE atomics (e.g. ldaddal) are silently decoded as incorrect instructions and disassembly is truncated. Use LLVMCreateDisasmCPUFeatures() with "+all" features for aarch64 targets so that the disassembler can handle any instruction the kernel JIT might emit. Before: int bench_trigger_uprobe(void * ctx): bpf_prog_538c6a43d1c6b84c_bench_trigger_uprobe: ; int cpu = bpf_get_smp_processor_id(); 0: mov x9, x30 4: nop 8: stp x29, x30, [sp, #-16]! c: mov x29, sp 10: stp xzr, x26, [sp, #-16]! 14: mov x26, sp 18: mrs x10, SP_EL0 1c: ldr w7, [x10, #16] ; __sync_add_and_fetch(&hits[cpu & CPU_MASK].value, 1); 20: and w7, w7, #0xff ; __sync_add_and_fetch(&hits[cpu & CPU_MASK].value, 1); 24: lsl x7, x7, #7 28: mov x0, #-281474976710656 2c: movk x0, #32768, lsl #32 30: movk x0, #35407, lsl #16 34: add x0, x0, x7 38: mov x1, #1 ; __sync_add_and_fetch(&hits[cpu & CPU_MASK].value, 1); 3c: mov x1, #1 After: int bench_trigger_uprobe(void * ctx): bpf_prog_538c6a43d1c6b84c_bench_trigger_uprobe: ; int cpu = bpf_get_smp_processor_id(); 0: mov x9, x30 4: nop 8: stp x29, x30, [sp, #-16]! c: mov x29, sp 10: stp xzr, x26, [sp, #-16]! 14: mov x26, sp 18: mrs x10, SP_EL0 1c: ldr w7, [x10, #16] ; __sync_add_and_fetch(&hits[cpu & CPU_MASK].value, 1); 20: and w7, w7, #0xff ; __sync_add_and_fetch(&hits[cpu & CPU_MASK].value, 1); 24: lsl x7, x7, #7 28: mov x0, #-281474976710656 2c: movk x0, #32768, lsl #32 30: movk x0, #35407, lsl #16 34: add x0, x0, x7 38: mov x1, #1 ; __sync_add_and_fetch(&hits[cpu & CPU_MASK].value, 1); 3c: ldaddal x1, x1, [x0] ; return 0; 40: mov w7, #0 44: ldp xzr, x26, [sp], #16 48: ldp x29, x30, [sp], #16 4c: mov x0, x7 50: ret 54: nop 58: ldr x10, #8 5c: br x10 Signed-off-by: Puranjay Mohan Acked-by: Yonghong Song Acked-by: Leon Hwang Acked-by: Quentin Monnet Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260318172259.2882792-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 9b0cf064ea0a6bac5e1a5fb43b004fd52fbe2b3b Author: Carlos Llamas Date: Thu Mar 12 18:38:17 2026 +0000 bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI This was renamed in commit 23ef9d439769 ("kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI") as it is now a compiler-agnostic option. Using the wrong name results in the code getting compiled out. Meaning the CFI failures for btf_dtor_kfunc_t would still trigger. Fixes: 99fde4d06261 ("bpf, btf: Enforce destructor kfunc type with CFI") Signed-off-by: Carlos Llamas Reviewed-by: Sami Tolvanen Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20260312183818.2721750-1-cmllamas@google.com Signed-off-by: Alexei Starovoitov commit a02327413acc141a887fe77b89656e88bcc4f412 Author: Eric Biggers Date: Sat Mar 14 14:45:55 2026 -0700 bpf: Remove inclusions of crypto/sha1.h Since commit 603b44162325 ("bpf: Update the bpf_prog_calc_tag to use SHA256") made BPF program tags use SHA-256 instead of SHA-1, the header no longer needs to be included. Remove the relevant inclusions so that they no longer unnecessarily come up in searches for which kernel code is still using the obsolete SHA-1 algorithm. Since net/ipv6/addrconf.c was relying on the transitive inclusion of (for an unrelated purpose) via , make it include explicitly in order to keep that file building. Signed-off-by: Eric Biggers Acked-by: Paul Chaignon Link: https://lore.kernel.org/r/20260314214555.112386-1-ebiggers@kernel.org Signed-off-by: Alexei Starovoitov commit 300aaca3435cca255517b366bebc9d642da1b8cb Author: Rosen Penev Date: Tue Mar 10 17:47:36 2026 -0700 wifi: b43: kzalloc + kcalloc to kzalloc_flex Simplifies allocation and allows using __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260311004736.32730-1-rosenp@gmail.com Signed-off-by: Johannes Berg commit b5b5ffa94a3b0419193c1a7c35dad6a972a638a9 Author: Miri Korenblit Date: Fri Mar 20 14:15:32 2026 +0200 wifi: mac80211: don't consider the sband when processing capabilities In NAN, we have one set of (HT, VHT, HE) capabilities for all bands, which means that we will need to process those capabilities without a given sband. To prepare for that, remove the sband argument from ieee80211_ht_cap_ie_to_sta_ht_cap and ieee80211_he_cap_ie_to_sta_he_cap and pass our own capabilities instead. For ieee80211_vht_cap_ie_to_sta_vht_cap, make the sband argument optional, since it is also used to check if there is at least one channel that supports 80 MHz. (Note that this check doesn't make much sense, but this can be handled in a different patch.) Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320141504.e42ef1f0eabb.If994d6346f00219437e22043e7bf2395b827b34a@changeid Signed-off-by: Johannes Berg commit 876565d4a826f3f04ef36f1cef6123ed4b150aa3 Author: Miri Korenblit Date: Fri Mar 20 14:13:46 2026 +0200 wifi: mac80211: properly handle error in ieee80211_add_virtual_monitor In case of an error in ieee80211_add_virtual_monitor, SDATA_STATE_RUNNING should be cleared as it was set in this function. Do it there instead of in the error path of ieee80211_do_open. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320141312.5546126313b1.I689dba2f54069b259702e8d246cedf79a73b82c6@changeid Signed-off-by: Johannes Berg commit 763677c52145efc4760c721078d5c0dadb60eb03 Author: Emmanuel Grumbach Date: Fri Mar 20 10:20:40 2026 +0200 wifi: cfg80211: support UNII-9 channels in ieee80211_channel_to_freq_khz Devices that support UNII-9 will call ieee80211_channel_to_freq_khz with a channel number that can go up to 253. Allow the new channel numbers in ieee80211_channel_to_freq_khz. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320102034.efcb7ea1de3c.Ifa4b75a24466de2a1d5707181c9c487618236e4b@changeid Signed-off-by: Johannes Berg commit c209f67233f1c6d895cb893f622e17a505d00397 Author: Miri Korenblit Date: Fri Mar 20 10:19:59 2026 +0200 wifi: mac80211: make ieee80211_find_chanctx link-unaware Currently we have only one user for a channel context: the link. With NAN, a new type of the channel context user will be added - the NAN channel. To prepare for this, we need to separate the channel context code from the link code. Removes the link argument from ieee80211_find_chanctx. Since the issue that led to commit 5e0c422d12b5 ("wifi: mac80211: reserve chanctx during find") - that added the link argument - is relevant for any user of the channel context, add a boolean to the chanctx itself, indicating that the chanctx is in the process of getting used. When this indication is set, the reference count of the channel context will be incremented by one, so even if it is getting released from a link (or another user) it won't be freed. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320101954.232499e2a41f.I0b735a607e1ec7aa5749ab01c794ef99dbe82b7f@changeid Signed-off-by: Johannes Berg commit 4ca2253157925424b3ada17c96fa4a26e664bc0d Author: Johannes Berg Date: Fri Mar 20 10:16:28 2026 +0200 wifi: mac80211_hwsim: advertise basic UHR support Just add support for ELR, and nothing else since the spec isn't really all that well-specified yet. Signed-off-by: Johannes Berg Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320101624.77af6463920e.I257e525a461c350bed87cfaefc52de25e37afcfb@changeid Signed-off-by: Johannes Berg commit 3f451a2cf56c407131c6bd34546348696f4f685e Author: Miri Korenblit Date: Fri Mar 20 10:16:01 2026 +0200 wifi: mac80211: use for_each_chanctx_user_* in one more place for_each_chanctx_user_* is an iterator that visits all types of chanctx users, including the (to be added) NAN channels, and not only the link. ieee80211_get_chanctx_max_required_bw wasn't changed to use this new iterator, do it now. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260320101556.4691916c7877.I9660f3945f4dccdb6d41a06ec4e74161e5ac65a4@changeid Signed-off-by: Johannes Berg commit 6c65b234575610e9795dabe410509a8b61cd4b68 Author: Ilan Peer Date: Mon Mar 23 23:02:50 2026 +0200 wifi: cfg80211: Add support for additional 7 GHz channels Add support for channels 237, 241, 245, 249, 253 and support for additional 320 MHz segment. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260323230242.072942e8e55a.I20eba7b534c6402d5e55f862865ff1e6fef64d83@changeid Signed-off-by: Johannes Berg commit 3f21614c20053e083f07de58202032a73b04a1b7 Author: Kees Cook Date: Mon Mar 23 10:20:16 2026 -0700 wifi: mac80211: Replace strncpy() with strscpy_pad() in drv_switch_vif_chanctx tracepoint Replace the deprecated[1] strncpy() with strscpy_pad() for copying the interface name into a tracepoint entry. The source "sdata->name" is a NUL-terminated char[IFNAMSIZ] buffer populated via NUL-guaranteeing paths: strscpy() in ieee80211_if_add(), snprintf() in ieee80211_add_virtual_monitor(), or memcpy() from ndev->name in ieee80211_if_add() and netdev_notify() (net/mac80211/iface.c). In the memcpy() cases, the source ndev->name is itself always NUL-terminated (populated via snprintf() or strscpy() in __dev_alloc_name() and dev_prep_valid_name() in net/core/dev.c). The destination "local_vifs[i].vif.vif_name" is a char[IFNAMSIZ] field in struct trace_vif_entry, stored in a __dynamic_array within the trace ring buffer. Since ring buffer entries are not zeroed on allocation, strscpy_pad() is used to zero-fill trailing bytes and prevent exposing stale ring buffer contents to userspace readers of tracefs. No behavioral change: since interface names are always at most 15 characters plus a NUL terminator, strscpy_pad() with size IFNAMSIZ (16) produces identical output to the original strncpy(). Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook Link: https://patch.msgid.link/20260323172015.work.146-kees@kernel.org Signed-off-by: Johannes Berg commit 5592d60ef2d83feea4fb1cb8166f94c0acd0cc60 Merge: 9ac76f3d0bb294 7bbb578fc43e7d Author: Johannes Berg Date: Tue Mar 24 16:28:09 2026 +0100 Merge tag 'ath-next-20260324' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.1 (PR #2) A few small cleanups and bug fixes across ath drivers. ================== Signed-off-by: Johannes Berg commit df75430515c33ece3de46562f917acd9792505ad Author: Julian Braha Date: Mon Mar 23 12:41:18 2026 +0000 drm: fix dead default for DRM_TTM_KUNIT_TEST The DRM_TTM_KUNIT_TEST config option should default to KUNIT_ALL_TESTS so that if all tests are enabled then it is included, but currently the 'default KUNIT_ALL_TESTS' statement is shadowed by an unconditional 'default n', meaning that this second default statement is currently dead code. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260323124118.1414913-1-julianbraha@gmail.com commit afa4b9befb3e90d34d2b8b41c6f3cc3c49c3d086 Author: Jacopo Mondi Date: Wed Mar 11 14:41:56 2026 +0100 media: rzv2h-ivc: Replace workqueue with direct function call Scheduling of work items with an async workqueue opens the door to potential races between multiple instances of a work item. While the frame transfer function is now protected against races, using a workqueue doesn't provide much benefit considering the limited cost of creating a job transfer. Replace the usage of the work queue with direct function calls. Reviewed-by: Daniel Scally Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit b1de0940a19c1b0001425f8069d6a82369986af7 Author: Jacopo Mondi Date: Wed Feb 11 15:30:00 2026 +0100 media: rzv2h-ivc: Avoid double job scheduling The scheduling of a new buffer transfer in the IVC driver is triggered by two occurrences of the "frame completed" interrupt. The first interrupt occurrence identifies when all image data have been transferred to the ISP, the second occurrence identifies when the post-transfer VBLANK has completed and a new buffer can be transferred. Under heavy system load conditions the actual execution of the workqueue item might be delayed and two items might happen to run concurrently, leading to a new frame transfer being triggered while the previous one has not yet finished. This error condition is only visible because the driver maintains a status variable that counts the number of interrupts since the last transfer, and warns in case an IRQ happens before the counter has been reset. To ensure sequential execution of the worqueue items and avoid a double buffer transfer to run concurrently, protect the whole function body with the spinlock that so far was solely used to reset the counter and inspect the interrupt counter variable at the beginning of the buffer transfer function. As soon as the ongoing transfer completes, the workqueue item will be re-scheduled and will consume the pending buffer. Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Reviewed-by: Daniel Scally Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 72773ff1cdfaebc593f53b1719b2c1773ecf8c43 Author: Barnabás Pőcze Date: Fri Feb 6 17:30:54 2026 +0100 media: rzv2h-ivc: Fix concurrent buffer list access The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a spinlock (`rzv2h_ivc::buffers.lock`). However, in `rzv2h_ivc_transfer_buffer()`, which runs in a separate workqueue, the `list_del()` call is executed without holding the spinlock, which makes it possible for the list to be concurrently modified Fix that by removing a buffer from the list in the lock protected section. Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Reviewed-by: Daniel Scally Signed-off-by: Barnabás Pőcze [assign ivc->buffers.curr in critical section as reported by Barnabas] Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 562d2e0a672075292e92538dad61664e89b34d30 Author: Barnabás Pőcze Date: Thu Feb 12 16:51:29 2026 +0100 media: rzv2h-ivc: Fix FM_STOP register write Bit 20 should be written in this register to stop frame processing. So fix that, as well as the poll condition. Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Reviewed-by: Daniel Scally Signed-off-by: Barnabás Pőcze Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit d901c428350245f2b26431e03c4ba0bdc7a71243 Author: Barnabás Pőcze Date: Thu Feb 12 16:45:48 2026 +0100 media: rzv2h-ivc: Write AXIRX_PIXFMT once The documentation prescribes that invalid formats should not be set, so do a single write to ensure that both the CLFMT and DTYPE fields are set to valid values. Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Reviewed-by: Daniel Scally Signed-off-by: Barnabás Pőcze Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 6139d018f043a30274071d694276c5ce59fe62d0 Author: Barnabás Pőcze Date: Thu Feb 12 16:41:56 2026 +0100 media: rzv2h-ivc: Fix AXIRX_VBLANK register write According to the documentation there are writable reserved bits in the register and those should not be set to 0. So use `rzv2h_ivc_update_bits()` with a proper bitmask. Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Reviewed-by: Daniel Scally Signed-off-by: Barnabás Pőcze Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 38104fe60ebb6b6cb66e3e9ef0a5c12f1260b1bc Author: Daniel Scally Date: Thu Feb 12 10:08:11 2026 +0000 media: rzv2h-ivc: Revise default VBLANK formula The vertical blanking settings for the IVC block are dependent on settings in the ISP. This was originally set to calculate as the worst-case possible value, but it seems that this can cause the IVC block to hang. Instead calculate the vblank to match the default settings (which are currently all the driver sets anyway). Cc: stable@vger.kernel.org Fixes: f0b3984d821b ("media: platform: Add Renesas Input Video Control block driver") Signed-off-by: Daniel Scally Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 062ae1d031a05a03d193446e82ce1f3ba7e10755 Author: Jacopo Mondi Date: Wed Mar 11 12:29:32 2026 +0100 media: mali-c55: Bypass Purple Fringe Correction The Purple Fringe Correction module is enabled by default with a POR configuration which might not be correct for the lens/sensor combination in use. If the Purple Fringe Correction module has to be used, it needs to be supported in the driver's uAPI and properly configured by userspace. As the driver doesn't support it at the moment, bypass it by default. Reviewed-by: Barnabás Pőcze Reviewed-by: Daniel Scally Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 762ec66e1360bbe9b3dedbddc0f88d9770aac8b9 Author: Jacopo Mondi Date: Wed Mar 11 12:15:56 2026 +0100 media: mali-c55: Bypass the Iridix Tonemap engine The Iridix Tonemap engine, if not bypassed, applies a digital gain in order to compensate under-exposed images. This however breaks the exposure and gain regulation performed on the sensor. If the Iridix Tonemap has to be used, it need to be supported in the ISP uAPI and properly configured by userspace. As the driver doesn't support it at the moment, bypass it by default. Reviewed-by: Barnabás Pőcze Reviewed-by: Daniel Scally Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit db7faf488ecf846c46884310ff1bf28daf2ad39a Author: Daniel Scally Date: Thu Feb 12 11:03:09 2026 +0000 media: mali-c55: Fix Iridix bypass macros The Mali C55 Iridix block has a digital gain function and tone mapping function, whose enablement is controlled by two different bits in the BYPASS_3 register. Unfortunately, the "Gain" and "Tonemap" bypass bit definitions are the wrong way around. Swap them. Cc: stable@vger.kernel.org Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") Signed-off-by: Daniel Scally Reviewed-by: Barnabás Pőcze Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 26ad493bea57efdccc32ffedbf731da2b7463b6c Author: Jacopo Mondi Date: Mon Jan 19 12:50:26 2026 +0100 media: mali-c55: Fully reset the ISP configuration The Mali C55 driver uses an auto-suspend delay of 2000 milli-seconds. As the delay is quite large, it is certainly possible that two consecutive calls to enable_streams() do not go through a suspend of the peripheral, meaning we cannot rely on POW register values for the ISP configuration. To prevent a streaming session to be initialized with settings from the previous one, reset the full ISP configuration to know state disabling or bypassing all the ISP blocks the driver supports. Cc: stable@vger.kernel.org Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") Reviewed-by: Daniel Scally Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit d5c24b71da547fdb5bea51a69d62f9e2a609431d Author: Jacopo Mondi Date: Mon Jan 19 12:20:56 2026 +0100 media: mali-c55: Initialize the ISP in enable_streams() The Mali C55 driver initializes the ISP in two points: 1) At probe time it disables ISP blocks by configuring them in bypass mode 2) At enable_streams() it initializes the crop rectangles and the image processing pipeline using the current image format However, as ISP blocks are configured by userspace, if their configuration is not reset, from the second enable_streams() call onwards the ISP configuration will depend on the previous streaming session configuration. To re-initialize the ISP completely at enable_streams() time consolidate the ISP block bypass configuration and the image processing path configuration in a single function to be called at enabled_streams() time. Cc: stable@vger.kernel.org Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") Reviewed-by: Daniel Scally Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit df16624248296ce4e8890c7ddcc95f0ccb642bcd Author: Jacopo Mondi Date: Mon Jan 19 11:00:23 2026 +0100 media: mali-c55: Fix wrong comment of ISP block types Some bad copy&paste happened in the description of the ISP block types and AWB_CONFIG got mixed up with SHADING_CONFIG. Fix it by assigning to each block the correct type. As only the comment is changed, there is no uABI breakage or regression. Cc: stable@vger.kernel.org Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") Reviewed-by: Daniel Scally Reviewed-by: Barnabás Pőcze Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 1f0f14aa18e14885c02623c07e4c6a816f7a9077 Merge: 4478886310e5a2 e5d5cc44791f72 Author: Mark Brown Date: Tue Mar 24 15:04:01 2026 +0000 ASoc: uda1380: Improve error reporting Wenyuan Li <2063309626@qq.com> says: The driver currently ignores the return values of several I2C operations during register writes, which could lead to silent failures and inconsistent device state. Link: https://patch.msgid.link/tencent_579D057AC557914CF739A2D9EAD045CE7306@qq.com Signed-off-by: Mark Brown commit e5d5cc44791f7275fd1b5329a9dc374d6ad1bf6c Author: Wenyuan Li <2063309626@qq.com> Date: Tue Mar 24 16:36:06 2026 +0800 ASoC: uda1380: use dev_err() and %pe for better error reporting Convert existing debug and error prints to dev_err() to provide better diagnostic information. Use the %pe format specifier to print human-readable error strings for I2C failures. Signed-off-by: Wenyuan Li <2063309626@qq.com> Link: https://patch.msgid.link/tencent_A26B55F062F2B9C282A142BFC8BCDB1B9105@qq.com Signed-off-by: Mark Brown commit 071efde6b7568fc3ce3b76d9e8c01e7b172539ad Author: Wenyuan Li <2063309626@qq.com> Date: Tue Mar 24 16:36:05 2026 +0800 ASoC: uda1380: fix missing return value checks for I2C operations The driver currently ignores the return values of several I2C operations during register writes, which could lead to silent failures and inconsistent device state. Fix this by: - Moving variable declarations to the beginning of the function (C90). - Checking the return value of every i2c_master_send() and recv() call. - Returning the actual error code if it's negative, or -EIO if the transfer was incomplete. Signed-off-by: Wenyuan Li <2063309626@qq.com> Link: https://patch.msgid.link/tencent_579D057AC557914CF739A2D9EAD045CE7306@qq.com Signed-off-by: Mark Brown commit 5c709b376460ff322580c41600e31c02f7cc0307 Author: Felix Gu Date: Mon Mar 23 00:04:08 2026 +0800 EDAC/versalnet: Fix device_node leak in mc_probe() of_parse_phandle() returns a device_node reference that must be released with of_node_put(). The original code never freed r5_core_node on any exit path, causing a memory leak. Fix this by using the automatic cleanup attribute __free(device_node) which ensures of_node_put() is called when the variable goes out of scope. Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller") Signed-off-by: Felix Gu Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Shubhrajyoti Datta Cc: Link: https://patch.msgid.link/20260323-versalnet-v1-1-4ab3012635ef@gmail.com commit 204aa22a686bfee48daca7db620c1e017615f2ff Author: Miklos Szeredi Date: Mon Mar 16 14:10:00 2026 +0100 fuse: abort on fatal signal during sync init When sync init is used and the server exits for some reason (error, crash) while processing FUSE_INIT, the filesystem creation will hang. The reason is that while all other threads will exit, the mounting thread (or process) will keep the device fd open, which will prevent an abort from happening. This is a regression from the async mount case, where the mount was done first, and the FUSE_INIT processing afterwards, in which case there's no such recursive syscall keeping the fd open. Fixes: dfb84c330794 ("fuse: allow synchronous FUSE_INIT") Cc: stable@vger.kernel.org # v6.18 Reviewed-by: Joanne Koong Reviewed-by: Bernd Schubert Reviewed-by: "Darrick J. Wong" Signed-off-by: Miklos Szeredi commit fa0561a1d583caece08d1fb904304c92c561e86a Merge: 1fe7579ab0a515 7f3eb70516c7d3 Author: Mark Brown Date: Tue Mar 24 14:25:52 2026 +0000 spi: Use after free fixes Johan Hovold says: The SPI subsystem frees the controller and any subsystem allocated driver data as part of deregistration (unless the allocation is device managed). This series fixes the IMX driver that got this wrong and then converts it to use device managed allocation. Included are also a (preparatory) deregistration fix for the rockchip driver and related cleanups for the tegre20-slink and rockchip drivers that both take a controller reference during unbind. commit 7f3eb70516c7d3aa30ed8eb609344ffc9885fc51 Author: Johan Hovold Date: Tue Mar 24 09:23:26 2026 +0100 spi: rockchip: switch to managed controller allocation Switch to device managed controller allocation to simplify error handling and to avoid having to take another reference during deregistration. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260324082326.901043-6-johan@kernel.org Signed-off-by: Mark Brown commit 4ba75403fb4ddbca370512f409e56fbda2473d36 Author: Johan Hovold Date: Tue Mar 24 09:23:25 2026 +0100 spi: tegra20-slink: switch to managed controller allocation Switch to device managed controller allocation to simplify error handling and to avoid having to take another reference during deregistration. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260324082326.901043-5-johan@kernel.org Signed-off-by: Mark Brown commit 9c01806506545c3083b7006a6ccd2ac746f1d5a4 Author: Johan Hovold Date: Tue Mar 24 09:23:24 2026 +0100 spi: imx: switch to managed controller allocation Switch to device managed controller allocation to simplify error handling and to avoid having to take another reference during deregistration. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260324082326.901043-4-johan@kernel.org Signed-off-by: Mark Brown commit 53e7a16070feb7d1d4d81a583eaac5e25048b9c3 Author: Johan Hovold Date: Tue Mar 24 09:23:23 2026 +0100 spi: rockchip: fix controller deregistration Make sure to deregister the controller before freeing underlying resources like DMA channels during driver unbind. Fixes: 64e36824b32b ("spi/rockchip: add driver for Rockchip RK3xxx SoCs integrated SPI") Cc: stable@vger.kernel.org # 3.17 Cc: addy ke Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260324082326.901043-3-johan@kernel.org Signed-off-by: Mark Brown commit 1c78c2002380a1fe31bfb01a3d5f29809e55a096 Author: Johan Hovold Date: Tue Mar 24 09:23:22 2026 +0100 spi: imx: fix use-after-free on unbind The SPI subsystem frees the controller and any subsystem allocated driver data as part of deregistration (unless the allocation is device managed). Take another reference before deregistering the controller so that the driver data is not freed until the driver is done with it. Fixes: 307c897db762 ("spi: spi-imx: replace struct spi_imx_data::bitbang by pointer to struct spi_controller") Cc: stable@vger.kernel.org # 5.19 Acked-by: Marc Kleine-Budde Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260324082326.901043-2-johan@kernel.org Signed-off-by: Mark Brown commit 6ee26b7a224b27aa7e8e1ee8a845a31664d2e97c Author: Aldo Conte Date: Fri Mar 20 12:23:02 2026 +0100 perf/x86/intel/p4: Fix unused variable warning in p4_pmu_init() Build the kernel with make W=1 generates the following warning: arch/x86/events/intel/p4.c: In function ‘p4_pmu_init’: arch/x86/events/intel/p4.c:1370:27: error: variable ‘high’ set but not used [-Werror=unused-but-set-variable] 1370 | unsigned int low, high; | ^~~~ This happens because, although both variables are declared and initialized by rdmsr, only `low` is used in the subsequent if statement. This patch uses the rdmsrq() macro instead of the rdmsr() macro. The rdmsrq() macro avoids the use of high and low variables because it reads the msr value in a single u64 variable. Also, replace (1 << 7) with the proper macro. Running `make W=1` again resolves the error. I was unable to test the patch because i do not have the hardware. Suggested-by: Dave Hansen Signed-off-by: Aldo Conte Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260320112302.281549-1-aldocontelk@gmail.com commit a21c1e961de28b95099a9ca2c3774b2eee1a33bb Author: Marco Elver Date: Thu Mar 19 14:52:38 2026 +0100 compiler: Simplify generic RELOC_HIDE() When enabling Context Analysis (CONTEXT_ANALYSIS := y) in arch/x86/kvm code, Clang's Thread Safety Analysis failed to recognize that identical per_cpu() accesses refer to the same lock: | CC [M] arch/x86/kvm/vmx/posted_intr.o | arch/x86/kvm/vmx/posted_intr.c:186:2: error: releasing raw_spinlock '__ptr + __per_cpu_offset[vcpu->cpu]' that was not held [-Werror,-Wthread-safety-analysis] | 186 | raw_spin_unlock(&per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu)); | | ^ | ./include/linux/spinlock.h:276:32: note: expanded from macro 'raw_spin_unlock' | 276 | #define raw_spin_unlock(lock) _raw_spin_unlock(lock) | | ^ | arch/x86/kvm/vmx/posted_intr.c:207:1: error: raw_spinlock '__ptr + __per_cpu_offset[vcpu->cpu]' is still held at the end of function [-Werror,-Wthread-safety-analysis] | 207 | } | | ^ | arch/x86/kvm/vmx/posted_intr.c:182:2: note: raw_spinlock acquired here | 182 | raw_spin_lock_nested(&per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu), | | ^ | ./include/linux/spinlock.h:235:2: note: expanded from macro 'raw_spin_lock_nested' | 235 | _raw_spin_lock(((void)(subclass), (lock))) | | ^ | 2 errors generated. This occurred because the default RELOC_HIDE() implementation (used by the per-CPU macros) is a statement expression containing an intermediate 'unsigned long' variable (this version appears to predate Git history). While the analysis strips away inner casts when resolving pointer aliases, it stops when encountering intermediate non-pointer variables (this is Thread Safety Analysis specific and irrelevant for codegen). This prevents the analysis from concluding that the pointers passed to e.g. raw_spin_lock() and raw_spin_unlock() were identical when per-CPU accessors are used. Simplify RELOC_HIDE() to a single expression. This preserves the intent of obfuscating UB-introducing out-of-bounds pointer calculations from the compiler via the 'unsigned long' cast, but allows the alias analysis to successfully resolve the pointers. Using a recent Clang version, I observe that generated code remains the same for vmlinux; the intermediate variable was already being optimized away (for any respectable modern compiler, not doing so would be an optimizer bug). Note that GCC provides its own version of RELOC_HIDE(), so this change only affects Clang builds. Add a test case to lib/test_context-analysis.c to catch any regressions. Reported-by: Bart Van Assche Reported-by: Sean Christopherson Signed-off-by: Marco Elver Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/all/e3946223-4543-4a76-a328-9c6865e95192@acm.org/ Link: https://patch.msgid.link/20260319135245.1420780-1-elver@google.com commit 9dcef98dbee35b8ae784df04c041efffdd42a69c Author: Nicolin Chen Date: Thu Mar 12 17:36:35 2026 -0700 iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement >From hardware implementation perspective, a guest tegra241-cmdqv hardware is different than the host hardware: - Host HW is backed by a VINTF (HYP_OWN=1) - Guest HW is backed by a VINTF (HYP_OWN=0) The kernel driver has an implementation requirement of the HYP_OWN bit in the VM. So, VMM must follow that to allow the same copy of Linux to work. Add this requirement to the uAPI, which is currently missing. Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support") Signed-off-by: Nicolin Chen Reviewed-by: Eric Auger Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon commit 803e41f36d227022ab9bbe780c82283fd4713b2e Author: Nicolin Chen Date: Thu Mar 12 17:36:34 2026 -0700 iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() vintf->hyp_own is finalized in tegra241_vintf_hw_init(). On the other hand, tegra241_vcmdq_alloc_smmu_cmdq() is called via an init_structures callback, which is earlier than tegra241_vintf_hw_init(). This results in the supports_cmd op always being set to the guest function, although this doesn't break any functionality nor have some noticeable perf impact since non-invalidation commands are not issued in the perf sensitive context. Fix this by moving supports_cmd to tegra241_vcmdq_hw_init(). After this change, - For a guest kernel, this will be a status quo - For a host kernel, non-invalidation commands will be issued to VCMDQ(s) Fixes: a9d40285bdef ("iommu/tegra241-cmdqv: Limit CMDs for VCMDQs of a guest owned VINTF") Reported-by: Eric Auger Reported-by: Shameer Kolothum Closes: https://lore.kernel.org/qemu-devel/CH3PR12MB754836BEE54E39B30C7210C0AB44A@CH3PR12MB7548.namprd12.prod.outlook.com/ Signed-off-by: Nicolin Chen Reviewed-by: Eric Auger Tested-by: Shameer Kolothum Signed-off-by: Will Deacon commit ff854b32b604526100c8468f8915150bd4387288 Author: Ville Syrjälä Date: Mon Mar 23 11:43:04 2026 +0200 drm/i915/de: Implement register polling in the display code The plan is to move all the mmio stuff into the display code itself. As a first step implement the register polling in intel_de.c. Currently i915 and xe implement this stuff in slightly different ways, so there are some functional changes here. Try to go for a reasonable middle ground between the i915 and xe implementations: - the exponential backoff limit is the simpler approach taken by i915 (== just clamp the max sleep duration to 1 ms) - the fast vs. slow timeout handling is similar to i915 where we first try the fast timeout and then again the slow timeout if the condition still isn't satisfied. xe just adds up the timeouts together, which is a bit weird. - the atomic wait variant uses udelay() like xe, whereas i915 has no udelay()s in its atomic loop. As a compromise go for a fixed 1 usec delay for short waits, instead of the somewhat peculiar xe behaviour where it effectively just does one iteration of the loop. - keep the "use udelay() for < 10 usec waits" logic (which more or less mirrors fsleep()), but include an explicit might_sleep() even for these short waits when called from a non-atomic intel_de_wait*() function. This should prevent people from calling the non-atomic functions from the wrong place. Eventually we may want to switch over to poll_timeout*(), but that lacks the exponential backoff, so a bit too radical to change in one go. v2: Initialize ret in intel_de_wait_for_register() to avoid a warning from the compiler. This is actually a false positive since we always have fast_timeout_us!=0 when slow_timeout_us!=0, but the compiler can't see that Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260323094304.8171-1-ville.syrjala@linux.intel.com commit 56d2a47e6b495e7d382d00b91ce182ff2c6a3741 Author: Ville Syrjälä Date: Fri Mar 13 13:10:27 2026 +0200 drm/i915/de: Move intel_de_wait*() into intel_de.c intel_de_wait*() end up doing quite a bit of stuff, so the one function call overhead from them seems insignificant. Move the implementation intel_de.c. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260313111028.25159-3-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 658b3c963de79ce802cd3b68bd0694ceeab4f105 Author: Ville Syrjälä Date: Fri Mar 13 13:10:26 2026 +0200 drm/i915/de: Introduce intel_de.c and move intel_de_{read,write}8() there intel_de_{read,write}8() aren't performance critical so having them as static inline is pointless. Introduce intel_de.c and move the implementation there. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260313111028.25159-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 4478886310e5a2cadb3d07ce2d8564d1fd3e206a Author: Ben Dooks Date: Tue Mar 24 13:34:03 2026 +0000 ASoC: SOF: sof-audio: pcm_id is __le32 The pcm_id value is __le32 so convert it before passing to the dev_dbg function to be printed. Also fixup some other uses of __le32 data and a couple of places where %u should have been used instead of %d Picked up by sparse prototype for variadic and printf function checking. Fixes a large number of sparse warnings, such as: sound/soc/sof/pcm.c:84:25: warning: incorrect type in argument 4 (different base types) sound/soc/sof/pcm.c:84:25: expected unsigned int sound/soc/sof/pcm.c:84:25: got restricted __le32 [usertype] pcm_id Signed-off-by: Ben Dooks Acked-by: Peter Ujfalusi Link: https://patch.msgid.link/20260324133403.107708-1-ben.dooks@codethink.co.uk Signed-off-by: Mark Brown commit 3b793983834e9484a834912548f4786b742abc92 Author: Robin Murphy Date: Thu Mar 19 15:24:34 2026 +0000 iommu/arm-smmu-v3: Update Arm errata MMU-700 r1p1 has subsequently fixed some of the errata for which we've been applying the workarounds unconditionally, so we can now make those conditional. However, there have also been some more new cases identified where we must rely on range invalidation commands, and thus still nominally avoid DVM being inadvertently enabled. Signed-off-by: Robin Murphy Signed-off-by: Will Deacon commit 86bf8580d5b873d165350f61441d0649e4c232f4 Author: Nicolin Chen Date: Sat Mar 21 15:50:41 2026 -0700 iommu/arm-smmu-v3: Fix typos introduced by arm_smmu_invs These are introduced by separate commits, so not submitting with a "Fixes" line, since they aren't critical. Signed-off-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon commit 6a01b9f0a5ec38112db54370ce7794db2be5a5de Author: Nicolin Chen Date: Sat Mar 21 15:50:40 2026 -0700 iommu/arm-smmu-v3: Do not continue in __arm_smmu_domain_inv_range() The loop in the __arm_smmu_domain_inv_range() is a while loop, not a for loop. So, using "continue" is wrong that would fail to move the needle. Meanwhile, though the current command is skipped, the batch still has to go through arm_smmu_invs_end_batch() to be issued accordingly. Thus, use "break" to fix the issue. Fixes: 587bb3e56a2c ("iommu/arm-smmu-v3: Add arm_smmu_invs based arm_smmu_domain_inv_range()") Signed-off-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon commit b98f7363f72ff83b9f5194d26e7f9fe74f45b46a Author: Christophe Leroy (CS GROUP) Date: Tue Mar 24 12:41:16 2026 +0100 fs: Replace user_access_{begin/end} by scoped user access Scoped user access reduces code complexity and seamlessly bring masked user access on architectures that support it. Replace user_access_begin/user_access_end blocks by scoped user access. Signed-off-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/16daf33a8190a771a93e294d050bd8153521ffca.1774350128.git.chleroy@kernel.org Signed-off-by: Christian Brauner commit 4bf798e027d35e4fd9a31b32e6bc2d33a73c0041 Author: Christophe Leroy (CS GROUP) Date: Tue Mar 24 12:41:15 2026 +0100 readdir: Introduce dirent_size() In several places in readdir.c there are calculations of the total size of a dirent, which contains a few fixed fields plus a name field with variable size. To add fun every dirent is of a slightly different type: - struct old_linux_dirent - struct linux_dirent - struct linux_dirent64 - struct compat_old_linux_dirent - struct compat_linux_dirent Replace ugly size calculation by a macro called dirent_size() which calculates the size of the structure based on the pointed type and the name field len. Suggested-by: Linus Torvalds Signed-off-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/c20d2f8f6817a39401155cfc80f0dff88df116e0.1774350128.git.chleroy@kernel.org Reviewed-by: David Laight Signed-off-by: Christian Brauner commit 7d7a9fc1310a0ade8ea61c5eb4d8b29456f8d604 Author: Mihai Sain Date: Tue Mar 24 09:09:27 2026 +0200 ARM: dts: microchip: sama7d65: add Cortex-A7 PMU node Add the Performance Monitoring Unit (PMU) node with the appropriate compatible string and interrupt line so that perf and other PMU-based tooling can function correctly on this SoC. [root@SAMA7D65 ~]$ dmesg | grep -i pmu [ 1.487869] hw-perfevents: enabled with armv7_cortex_a7 PMU driver, 5 (8000000f) counters available [root@SAMA7D65 ~]$ perf list hw List of pre-defined events (to be used in -e or -M): branch-instructions OR branches [Hardware event] branch-misses [Hardware event] bus-cycles [Hardware event] cache-misses [Hardware event] cache-references [Hardware event] cpu-cycles OR cycles [Hardware event] instructions [Hardware event] Signed-off-by: Mihai Sain Link: https://lore.kernel.org/r/20260324070927.1496-2-mihai.sain@microchip.com [claudiu.beznea: keep nodes alphanumerically sorted] Signed-off-by: Claudiu Beznea commit 141efa53b9875c059d0edec5212fbcd311ec4896 Author: DanielePioGenovese Date: Fri Mar 20 16:58:42 2026 +0100 ASoC: amd: yc: Add MSI Thin A15 B7VF to quirk table Add the MSI Thin A15 B7VF to the quirk table to enable the internal microphone, which otherwise does not work out of the box. Signed-off-by: DanielePioGenovese Link: https://patch.msgid.link/20260320155842.55304-1-delitedaniele@gmail.com Signed-off-by: Mark Brown commit 737ec1e81a816731ba74b3f510441b1f4d5068f6 Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:18 2026 +0000 drm/xe/xelp: Expose AuxCCS frame buffer modifiers on Alderlake-P Now that we have implemented all the related missing bits we can enable the AuxCCS compressed modifiers which were disabled in cf48bddd31de ("drm/i915/display: Disable AuxCCS framebuffers if built for Xe"). Tested with KDE Wayland, on Lenovo Carbon X1 ADL-P: [PLANE:32:plane 1A]: type=PRI uapi: [FB:242] AR30 little-endian (0x30335241),0x100000000000008,2880x1800, visible=visible, src=28 hw: [FB:242] AR30 little-endian (0x30335241),0x100000000000008,2880x1800, visible=yes, src=2880.000 Display is working fine - no artefacts, no DMAR/PIPE faults. v2: * Adjust patch title. (Rodrigo) v3: * Complete rewrite based on the display parent interface. Signed-off-by: Tvrtko Ursulin References: cf48bddd31de ("drm/i915/display: Disable AuxCCS framebuffers if built for Xe") Cc: Jani Nikula Cc: José Roberto de Souza Cc: Juha-Pekka Heikkila Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260324084018.20353-13-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit 9110675732a3c2320ec172d17b2b3d78d250aed4 Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:17 2026 +0000 drm/xe/display: Add support for AuxCCS Add support for mapping the auxiliary CCS buffer into the DPT page tables. This will allow for better power efficiency by enabling the render compression frame buffer modifiers such as I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS in a following patch. Signed-off-by: Tvrtko Ursulin Cc: Juha-Pekka Heikkila Cc: Michael J. Ruhl Cc: Rodrigo Vivi Cc: Thomas Hellström Cc: Maarten Lankhorst Reviewed-by: Uma Shankar Link: https://patch.msgid.link/20260324084018.20353-12-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit cce1c47726579f0974e12e03e8471053d29182da Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:16 2026 +0000 drm/xe/display: Respect remapped plane alignment Instead of assuming PAGE_SIZE alignment between the remapped planes respect the value set in the struct intel_remapped_info. Signed-off-by: Tvrtko Ursulin Cc: Juha-Pekka Heikkila Cc: Michael J. Ruhl Cc: Rodrigo Vivi Cc: Thomas Hellström Cc: Maarten Lankhorst Reviewed-by: Uma Shankar Link: https://patch.msgid.link/20260324084018.20353-11-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit 11dbd2d14663450111a6104a6d9aec5267405c86 Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:15 2026 +0000 drm/xe/display: Change write_dpt_remapped_tiled function signature In preparation for adding support for the auxccs plane lets change the function signature of write_dpt_remapped_tiled(). This will enable a tidier way of extending it subsequent patches. Signed-off-by: Tvrtko Ursulin Cc: Juha-Pekka Heikkila Cc: Michael J. Ruhl Cc: Rodrigo Vivi Cc: Thomas Hellström Cc: Maarten Lankhorst Cc: Uma Shankar Reviewed-by: Uma Shankar Link: https://patch.msgid.link/20260324084018.20353-10-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit 7c42193d9049ab7e3069e6e9ff94d8a37b774af9 Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:14 2026 +0000 drm/xe/display: Move remapped plane loop out of __xe_pin_fb_vma_dpt In preparation for adding support for the auxccs plane lets move the plane iteration loop to its own function. Signed-off-by: Tvrtko Ursulin Cc: Juha-Pekka Heikkila Cc: Michael J. Ruhl Cc: Rodrigo Vivi Cc: Thomas Hellström Cc: Maarten Lankhorst Reviewed-by: Uma Shankar Link: https://patch.msgid.link/20260324084018.20353-9-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit 1d5945d74b4d4c8dcc884ad7f0ccbb377d777443 Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:13 2026 +0000 drm/xe/xelp: Add AuxCCS invalidation to the indirect context workarounds Following from the i915 reference implementation, we add the AuxCCS invalidation to the indirect context workarounds page. Signed-off-by: Tvrtko Ursulin Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260324084018.20353-8-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit fd4c1eea1cfe20efc470f01bfb1a04d272e8eb74 Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:12 2026 +0000 drm/xe: Move aux table invalidation to ring ops Implement the suggestion of moving the aux invalidation from a helper to a ring ops vfunc, together with the suggestion to split the vfunc table of video decode and video enhance engines. With this done the LRC code will be able to access the functionality via the newly added ring ops vfunc. Signed-off-by: Tvrtko Ursulin Suggested-by: Matthew Brost Cc: Rodrigo Vivi Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260324084018.20353-7-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit cd1a516234ebb049007ce20c6b6e76936b29bade Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:11 2026 +0000 drm/xe/xelp: Wait for AuxCCS invalidation to complete On AuxCCS platforms we need to wait for AuxCCS invalidations to complete. Signed-off-by: Tvrtko Ursulin Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260324084018.20353-6-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit 458b1e64e7c0594cca8515fae8996bc52619d2f6 Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:10 2026 +0000 drm/xe/xelp: Quiesce memory traffic before invalidating AuxCCS According to i915 commit ad8ebf12217e ("drm/i915/gt: Ensure memory quiesced before invalidation") quiescing of the memory traffic is required before invalidating the AuxCCS tables. Add an extra pipe control flush to achieve that. Signed-off-by: Tvrtko Ursulin Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260324084018.20353-5-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit 88139af77d6acd74bf73f5e36f4bdc63f033f399 Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:09 2026 +0000 drm/xe/xelpg: Limit AuxCCS ring buffer programming to Alderlake At the moment the driver does not support AuxCCS at all due respective modifiers being hidden from userspace. As we are about to start enabling them, starting with Alderlake, let us begin by limiting the ring buffer support to just that initial platform. Signed-off-by: Tvrtko Ursulin Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260324084018.20353-4-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit 36052e56d5943bbd8244321c3b1445ba5db0f12b Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:08 2026 +0000 drm/xe: Use write-combine mapping when populating DPT The fallback case for DPT backing store is a buffer object in system memory buffer, which by default use a write-back CPU caching policy. If this fallback gets triggered, and since there is currently no flushing, the DPT writes made when pinning a buffer to display are not guaranteed to be seen by the display engine. To fix this, since both the local memory and the stolen memory DPT placements already use write-combine, let us make the system memory option follow suit by passing down the appropriate flag. Signed-off-by: Tvrtko Ursulin Suggested-by: Ville Syrjälä Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260324084018.20353-3-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit 2bb026f3fbe8cb59ab70ec21b5cbd729b0c94bac Author: Tvrtko Ursulin Date: Tue Mar 24 08:40:07 2026 +0000 drm/xe: Rename XE_BO_FLAG_SCANOUT to XE_BO_FLAG_FORCE_WC Rename XE_BO_FLAG_SCANOUT to XE_BO_FLAG_FORCE_WC so that the usage of the flag can legitimately be expanded to more than just the actual frame- buffer objects. Signed-off-by: Tvrtko Ursulin Suggested-by: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260324084018.20353-2-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi commit 186bf9031666602d61b40832181b6b6fdc3ba4dc Author: Denis Benato Date: Wed Mar 4 14:26:08 2026 +0100 platform/x86: asus-wmi: do not enforce a battery charge threshold Users are complaining for the battery limit being reset at 100% during the boot process while the general consensus appears to not apply unsolicited hardware changes, therefore stop resetting the battery charge limit at boot and return -ENODATA on charge_end_threshold to signal for an unknown limit. Suggested-by: Antheas Kapenekakis Suggested-by: Derek J. Clark Signed-off-by: Denis Benato Reviewed-by: Derek J. Clark Tested-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260304132608.33815-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f4cf0992be37e6a8bc6cf9108f2c9628a6188381 Author: Shuvam Pandey Date: Tue Mar 17 17:30:48 2026 +0545 printf: add IPv6 address format tests printf_kunit already covers IPv4 address formatting, but the ip6() test case is empty even though printk-formats.rst documents %pI6, %pi6, %pI6c, and generic %pIS variants. Add focused IPv6 checks for raw and generic formatting, compressed output, the single-zero %pI6c corner case, and bracketed port formatting for sockaddr_in6. Signed-off-by: Shuvam Pandey Reviewed-by: Andy Shevchenko Reviewed-by: Petr Mladek Tested-by: Petr Mladek Link: https://patch.msgid.link/20260317114548.98919-1-shuvampandey1@gmail.com [pmladek@suse.com: Removed non-necessary details from the commit message.] Signed-off-by: Petr Mladek commit d12dc8c558b955e74bf3dc9c01926c3c109f2d69 Author: Niranjan H Y Date: Tue Mar 24 09:42:59 2026 +0530 ASoC: sdw_utils: add vendor_id to asoc_sdw_codec_info struct asoc_sdw_codec_info has part_id which is not sufficient to uniquely identify devices. This change adds the vendor_id field and updates the codec_info list with the corresponding vendor id as per the Manufacturer's id in https://mid.mipi.org/ Signed-off-by: Niranjan H Y Reviewed-by: Bard Liao Reviewed-by: Pierre-Louis Bossart Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260324041300.784-1-niranjan.hy@ti.com Signed-off-by: Mark Brown commit dc1ec4fa86b2b8bba2b6122f2b4420217b5bae9e Author: Mingyou Chen Date: Mon Mar 23 21:22:18 2026 +0800 platform/x86: bitland-mifs-wmi: Add new Bitland MIFS WMI driver Add a new driver for Bitland laptops that utilize the MIFS (MiInterface) WMI interface. The driver implements several features through the WMI interface: - Platform Profile: Supports "Quiet", "Balanced", "Performance", and "Full Speed" modes. The "Full Speed" mode is intelligently restricted based on the AC adapter type (requires DC power, not supported on USB-C charging) as required by the hardware. - Hwmon: Provides monitoring for CPU, GPU, and System fan speeds, as well as CPU temperature sensors. - Keyboard Backlight: Integrated with the LED class device for brightness control and provides sysfs attributes for keyboard modes (cyclic, fixed, etc.). - GPU Mode: Allows switching between Hybrid, Discrete, and UMA graphics modes via sysfs. - Hotkeys: Handles WMI events for system hotkeys (Calculator, Browser, App launch) using sparse keymaps and reports status changes for Airplane mode, Touchpad, and CapsLock. - Fan Boost: Provides a sysfs interface to force fans to maximum speed. The driver registers two WMI GUIDs: - B60BFB48-3E5B-49E4-A0E9-8CFFE1B3434B: Control methods - 46C93E13-EE9B-4262-8488-563BCA757FEF: Event notifications Reviewed-by: Armin Wolf Signed-off-by: Mingyou Chen Link: https://patch.msgid.link/20260323132218.444383-1-qby140326@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 00cf406a0abe7cdf61d899d218520f6bc0414979 Author: Maxime Ripard Date: Thu Mar 5 10:05:06 2026 +0100 drm/display: hdmi: Use drm_output_color_format instead of hdmi_colorspace The hdmi_colorspace enum was defined to represent the colorspace value of the HDMI infoframes. It was later used by some HDMI drivers to express the output format they should be setting up. During the introduction of the HDMI helpers, it then was used to represent it in the drm_connector_hdmi_state structure. However, it's always been somewhat redundant with the DRM_COLOR_FORMAT_* defines, and now with the drm_output_color_format enum. Let's consolidate around drm_output_color_format in drm_connector_hdmi_state to facilitate the current effort to provide a global output format selection mechanism. Acked-by: Jani Nikula Reviewed-by: Nicolas Frattaroli Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-14-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit 720c618e383c90c79b4ff3f90e71c4aceb1568d3 Author: Maxime Ripard Date: Thu Mar 5 10:05:05 2026 +0100 drm/connector: Remove DRM_COLOR_FORMAT defines Now that all users of DRM_COLOR_FORMAT_* defines have been converted to the new enum, we can get rid of those defines. Acked-by: Jani Nikula Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-13-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit 01962a191242006c8518f03d6686178d758af371 Author: Maxime Ripard Date: Thu Mar 5 10:05:04 2026 +0100 drm/rockchip: analogix: Convert to drm_output_color_format Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Acked-by: Jani Nikula Reviewed-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-12-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit ae56d616106286afad0de7226c29e11fe6492f63 Author: Maxime Ripard Date: Thu Mar 5 10:05:03 2026 +0100 drm/mediatek: dp: Convert to drm_output_color_format Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Reviewed-by: Philipp Zabel Acked-by: Jani Nikula Acked-by: Chun-Kuang Hu Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-11-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit 7889c1a5766825275cc4f343af86d9eae7d16169 Author: Maxime Ripard Date: Thu Mar 5 10:05:02 2026 +0100 drm/arm: komeda: Convert to drm_output_color_format Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Reviewed-by: Liviu Dudau Acked-by: Jani Nikula Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-10-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit 4bf05805b6810134d29a8ddc4e3b1c76a34bfb77 Author: Maxime Ripard Date: Thu Mar 5 10:05:01 2026 +0100 drm/bridge: synopsys: dw-hdmi: Convert to drm_output_color_format Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Reviewed-by: Philipp Zabel Acked-by: Jani Nikula Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-9-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit 04b4e39a14141e289b253d6348a561ef1a680d3c Author: Maxime Ripard Date: Thu Mar 5 10:05:00 2026 +0100 drm/bridge: synopsys: dw-dp: Convert to drm_output_color_format Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Acked-by: Jani Nikula Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-8-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit a90bd3baff0c64ca22ca420a8e7abcf0f001632c Author: Maxime Ripard Date: Thu Mar 5 10:04:59 2026 +0100 drm/bridge: cadence: Convert to drm_output_color_format Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Acked-by: Jani Nikula Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-7-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit 97f71dac352fb13c10cce92aa130818b629a2f54 Author: Maxime Ripard Date: Thu Mar 5 10:04:58 2026 +0100 drm/bridge: analogix: Convert to drm_output_color_format Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Acked-by: Jani Nikula Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-6-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit be7d12f8785809fc8fe59b43c5503e79d1f28540 Author: Maxime Ripard Date: Thu Mar 5 10:04:57 2026 +0100 drm/bridge: adv7511: Convert to drm_output_color_format Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Acked-by: Jani Nikula Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-5-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit 5332698fa9d5fef2df273ffbcd2d3cd033fd4162 Author: Maxime Ripard Date: Thu Mar 5 10:04:56 2026 +0100 drm/amdgpu: display: Convert to drm_output_color_format Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Acked-by: Jani Nikula Tested-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-4-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit ad8d131680756e4a4e38c7a530d1b4cc188f3987 Author: Maxime Ripard Date: Thu Mar 5 10:04:55 2026 +0100 drm/display: hdmi: Convert to drm_output_color_format Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Acked-by: Jani Nikula Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-3-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit a563653d199187e9d76e5849fbf5b889e7357537 Author: Maxime Ripard Date: Thu Mar 5 10:04:54 2026 +0100 drm/edid: Convert to drm_output_color_format enum Now that we introduced a new drm_output_color_format enum to represent what DRM_COLOR_FORMAT_* bits were representing, we can switch to the new enum. The main difference is that while DRM_COLOR_FORMAT_ was a bitmask, drm_output_color_format is a proper enum. However, the enum was done is such a way than DRM_COLOR_FORMAT_X = BIT(DRM_OUTPUT_COLOR_FORMAT_X) so the transitition is easier. The only thing we need to consider is if the original code meant to use that value as a bitmask, in which case we do need to keep the bit shift, or as a discriminant in which case we don't. Acked-by: Jani Nikula Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-2-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit f3934e12f20c552f764e6488aaa1ab76cdc20343 Author: Maxime Ripard Date: Thu Mar 5 10:04:53 2026 +0100 drm/connector: Introduce drm_output_color_format enum The EDID parsing code initially introduced the DRM_COLOR_FORMAT_* defines to represent the sink capabilities. Since a given sink could support multiple formats, it was first defined as a bitmask. However, the core and drivers have since leveraged those defines to represent both the supported formats but also the current format being used. Considering the latter case, the more natural, and consistent, thing to do would be to create an enum of all the possible formats, and then list the supported formats using a bitmask of the individual enum values. Let's create a new enum following that pattern, drm_output_color_format, while maintaining the DRM_COLOR_FORMAT_* compatibility to make the transition easier. Acked-by: Jani Nikula Reviewed-by: Liviu Dudau Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260305-drm-rework-color-formats-v3-1-f3935f6db579@kernel.org Signed-off-by: Maxime Ripard commit ede3db74c3d07a1aa67e3eebf91c91409c09330e Merge: 34006f77890d05 7671f4949a6c91 Author: Linus Walleij Date: Tue Mar 24 13:50:44 2026 +0100 Merge branch 'ib-scmi-pinctrl-gpio' into devel commit 7671f4949a6c9111234fdbcd577b227ace799f16 Author: AKASHI Takahiro Date: Mon Mar 23 22:01:47 2026 +0300 gpio: gpio-by-pinctrl: add pinctrl based generic GPIO driver The ARM SCMI pinctrl protocol allows GPIO access. Instead of creating a new SCMI GPIO driver, this driver is a generic GPIO driver that uses standard pinctrl interfaces. Signed-off-by: AKASHI Takahiro Signed-off-by: Dan Carpenter Reviewed-by: Linus Walleij Acked-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 05a8a80efaacc42013d78fc3fe41159b7be4333c Author: AKASHI Takahiro Date: Mon Mar 23 22:01:42 2026 +0300 gpio: dt-bindings: Add GPIO on top of generic pin control Traditionally, firmware will provide a GPIO interface or a pin control interface. However, the SCMI protocol provides a generic pin control interface and the GPIO support is built on top of that using the normal pin control interfaces. Potentially, other firmware will adopt a similar generic approach in the future. Document how to configure the GPIO device. Signed-off-by: AKASHI Takahiro Signed-off-by: Dan Carpenter Reviewed-by: Linus Walleij Reviewed-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit bf1fbd189d45216dec1f02f6e12fffde9f3b4ea6 Author: Dan Carpenter Date: Mon Mar 23 22:01:37 2026 +0300 firmware: arm_scmi: Allow PINCTRL_REQUEST to return EOPNOTSUPP The SCMI protocol specification says that the PINCTRL_REQUEST and PINCTRL_RELEASE commands are optional. So if the SCMI server returns -EOPNOTSUPP, then treat that as success and continue. Signed-off-by: Dan Carpenter Reviewed-by: Linus Walleij Reviewed-by: Sudeep Holla Signed-off-by: Linus Walleij commit f20e81322f3a071db248f050c32713b503ae1fa4 Author: Dan Carpenter Date: Mon Mar 23 22:01:22 2026 +0300 pinctrl: scmi: ignore PIN_CONFIG_PERSIST_STATE The PIN_CONFIG_PERSIST_STATE setting ensures that the pin state persists across a sleep or controller reset. The SCMI spec does not have an equivalent command to this so just ignore it. Signed-off-by: Dan Carpenter Reviewed-by: Linus Walleij Signed-off-by: Linus Walleij commit 37a584414d9ceca48f4367dcb829bf9dc6015988 Author: Dan Carpenter Date: Mon Mar 23 22:01:32 2026 +0300 pinctrl: scmi: Delete PIN_CONFIG_OUTPUT_IMPEDANCE_OHMS support The argument for PIN_CONFIG_OUTPUT_IMPEDANCE_OHMS is supposed to be expressed in terms of ohms. But the pinctrl-scmi driver was implementing it the same as PIN_CONFIG_OUTPUT and writing either a zero or one to the pin. The SCMI protocol doesn't have an support configuration type so just delete this code instead of replacing it. Cc: Peng Fan Signed-off-by: Dan Carpenter Reviewed-by: Linus Walleij Signed-off-by: Linus Walleij commit 9ea2647b0089ce8d7e2723eda4c77cbc55f8b7c5 Author: Dan Carpenter Date: Mon Mar 23 22:01:15 2026 +0300 pinctrl: scmi: Add SCMI_PIN_INPUT_VALUE The PIN_CONFIG_LEVEL parameter represents the value of the pin, whether reading or writing to the pin. In SCMI, the parameter is represented by two different values SCMI_PIN_OUTPUT_VALUE for writing to a pin and SCMI_PIN_INPUT_VALUE for reading. The current code translates PIN_CONFIG_LEVEL as SCMI_PIN_OUTPUT_VALUE (writing). Add a function to translate it to either INPUT or OUTPUT depending on whether it is called from a _get or _set() operation. Signed-off-by: Dan Carpenter Reviewed-by: Linus Walleij Acked-by: Sudeep Holla Signed-off-by: Linus Walleij commit 96b76f7bc575ac6c69090f4642e424b04fb6784c Author: AKASHI Takahiro Date: Mon Mar 23 22:01:10 2026 +0300 pinctrl: introduce pinctrl_gpio_get_config() This is a counterpart of pinctrl_gpio_set_config(), which will be used to implement the ->get() interface in a GPIO driver for SCMI. This also requires that we create a stub so pin_config_get_for_pin() can build when CONFIG_PINCONF is disabled. Signed-off-by: AKASHI Takahiro Signed-off-by: Dan Carpenter Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Signed-off-by: Linus Walleij commit e57c36bc1a3e459239ead492ebce731a88a264b1 Author: Alexey Klimov Date: Fri Mar 20 21:15:14 2026 +0000 clk: samsung: exynos850: Add APM-to-AP mailbox clock Add APM mailbox clock for communicating between APM and main application CPUs in CMU_APM unit. This clock is needed to access this mailbox registers. This mailbox is used for ACPM communication between kernel and APM co-processor. Signed-off-by: Alexey Klimov Link: https://patch.msgid.link/20260320-exynos850-ap2apm-mailbox-v1-2-983eb3f296fc@linaro.org Signed-off-by: Krzysztof Kozlowski commit 495920b5d57855d0b9e8082055444e208907f0df Merge: ba75d4dde8ca9f bf9462c82721e4 Author: Krzysztof Kozlowski Date: Tue Mar 24 13:43:09 2026 +0100 Merge branch 'for-v7.1/dt-bindings-clk' into next/clk commit bf9462c82721e42f49e4a62efe96ef7b41a5e42e Author: Alexey Klimov Date: Fri Mar 20 21:15:13 2026 +0000 dt-bindings: clock: exynos850: Add APM_AP MAILBOX clock Add a constant for APM-to-AP mailbox clock. This clock is needed to access this mailbox registers. Signed-off-by: Alexey Klimov Link: https://patch.msgid.link/20260320-exynos850-ap2apm-mailbox-v1-1-983eb3f296fc@linaro.org Signed-off-by: Krzysztof Kozlowski commit b1c803d5c8167026791abfaed96fd3e6a1fcd750 Author: Lorenzo Bianconi Date: Sat Mar 21 15:41:44 2026 +0100 net: airoha: Rework the code flow in airoha_remove() and in airoha_probe() error path As suggested by Simon in [0], rework the code flow in airoha_remove() and in the airoha_probe() error path in order to rely on a more common approach un-registering configured net-devices first and destroying the hw resources at the end of the code. Introduce airoha_qdma_cleanup routine to release QDMA resources. [0] https://lore.kernel.org/netdev/20251214-airoha-fix-dev-registration-v1-1-860e027ad4c6@kernel.org/ Suggested-by: Simon Horman Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260321-airoha-remove-rework-v2-1-16c7bade5fe5@kernel.org Signed-off-by: Paolo Abeni commit 2f89b7f78c50ca973ca035ceb30426f78d9e0996 Author: Besar Wicaksono Date: Tue Mar 24 01:29:51 2026 +0000 perf: add NVIDIA Tegra410 C2C PMU Adds NVIDIA C2C PMU support in Tegra410 SOC. This PMU is used to measure memory latency between the SOC and device memory, e.g GPU Memory (GMEM), CXL Memory, or memory on remote Tegra410 SOC. Reviewed-by: Ilkka Koskinen Signed-off-by: Besar Wicaksono Signed-off-by: Will Deacon commit 429b7638b2df5538e945aaa2cc189cf0d6e8fb3a Author: Besar Wicaksono Date: Tue Mar 24 01:29:50 2026 +0000 perf: add NVIDIA Tegra410 CPU Memory Latency PMU Adds CPU Memory (CMEM) Latency PMU support in Tegra410 SOC. The PMU is used to measure latency between the edge of the Unified Coherence Fabric to the local system DRAM. Reviewed-by: Ilkka Koskinen Signed-off-by: Besar Wicaksono Signed-off-by: Will Deacon commit 3dd73022306bfdb29b1c33cb106fe337f46a6105 Author: Besar Wicaksono Date: Tue Mar 24 01:29:49 2026 +0000 perf/arm_cspmu: nvidia: Add Tegra410 PCIE-TGT PMU Adds PCIE-TGT PMU support in Tegra410 SOC. This PMU is instanced in each root complex in the SOC and it captures traffic originating from any source towards PCIE BAR and CXL HDM range. The traffic can be filtered based on the destination root port or target address range. Reviewed-by: Ilkka Koskinen Signed-off-by: Besar Wicaksono Signed-off-by: Will Deacon commit bf585ba14726788335c640512d11186dab573612 Author: Besar Wicaksono Date: Tue Mar 24 01:29:48 2026 +0000 perf/arm_cspmu: nvidia: Add Tegra410 PCIE PMU Adds PCIE PMU support in Tegra410 SOC. This PMU is instanced in each root complex in the SOC and can capture traffic from PCIE device to various memory types. This PMU can filter traffic based on the originating root port or BDF and the target memory types (CPU DRAM, GPU Memory, CXL Memory, or remote Memory). Reviewed-by: Ilkka Koskinen Signed-off-by: Besar Wicaksono Signed-off-by: Will Deacon commit bc86281fe4bd5d4a78be2f370e8319c9517e40ff Author: Besar Wicaksono Date: Tue Mar 24 01:29:47 2026 +0000 perf/arm_cspmu: Add arm_cspmu_acpi_dev_get Add interface to get ACPI device associated with the PMU. This ACPI device may contain additional properties not covered by the standard properties. Reviewed-by: Ilkka Koskinen Signed-off-by: Besar Wicaksono Signed-off-by: Will Deacon commit f5caf26fd6c71294d0fb254404ed66f8cff6f7f7 Author: Besar Wicaksono Date: Tue Mar 24 01:29:46 2026 +0000 perf/arm_cspmu: nvidia: Add Tegra410 UCF PMU The Unified Coherence Fabric (UCF) contains last level cache and cache coherent interconnect in Tegra410 SOC. The PMU in this device can be used to capture events related to access to the last level cache and memory from different sources. Reviewed-by: Ilkka Koskinen Signed-off-by: Besar Wicaksono Signed-off-by: Will Deacon commit d332424d1d06a9fb03ca04ba3f1092c3990125e8 Author: Besar Wicaksono Date: Tue Mar 24 01:29:45 2026 +0000 perf/arm_cspmu: nvidia: Rename doc to Tegra241 The documentation in nvidia-pmu.rst contains PMUs specific to NVIDIA Tegra241 SoC. Rename the file for this specific SoC to have better distinction with other NVIDIA SoC. Signed-off-by: Besar Wicaksono Signed-off-by: Will Deacon commit 5394396ff5488f007248727988b722c5d4f0638b Author: Robin Murphy Date: Thu Feb 19 17:27:53 2026 +0000 perf/arm-cmn: Stop claiming entire iomem region So far, the PMU has been the only thing of interest in the vast mass of CMN registers, so we've gotten away with simply claiming the entire iomem region. However, now that we can support other features like MPAM controllers for the system caches, the PMU driver needs to stop being selfish and learn to share. Similarly to arm-ni, requesting just the DTC node(s) should suffice for staking our exclusive claim to the PMU features, as requesting hundreds of tiny regions for all the individual pmu_event_sel registers is definitely not worth the considerable bother. As a consequence, we can also streamline the annoying CMN-600 special cases even more. The ACPI binding has in fact always specified a strict order for all resources, so we can reasonably drop the ancient pretence of swapping base and cfg, which IIRC was more just a moment of doubt on my part than anything else. Cc: James Morse Signed-off-by: Robin Murphy Tested-by: Ben Horgan Reviewed-by: Ilkka Koskinen Signed-off-by: Will Deacon commit 15ed3fa23cbcb9b9db842947698c3b4b2aeb706c Author: James Clark Date: Thu Mar 5 16:28:19 2026 +0000 arm64: cpufeature: Use pmuv3_implemented() function Other places that are doing this version comparison are already using pmuv3_implemented(), so might as well use it here too for consistency. Signed-off-by: James Clark Reviewed-by: Marc Zyngier Reviewed-by: Colton Lewis Signed-off-by: Will Deacon commit d1dcc20bcc40efe1f1c71639376c91dafa489222 Author: James Clark Date: Thu Mar 5 16:28:18 2026 +0000 arm64: cpufeature: Make PMUVer and PerfMon unsigned On the host, this change doesn't make a difference because the fields are defined as FTR_EXACT. However, KVM allows userspace to set these fields for a guest and overrides the type to be FTR_LOWER_SAFE. And while KVM used to do an unsigned comparison to validate that the new value is lower than what the hardware provides, since the linked commit it uses the generic sanitization framework which does a signed comparison. Fix it by defining these fields as unsigned. In theory, without this fix, userspace could set a higher PMU version than the hardware supports by providing any value with the top bit set. Fixes: c118cead07a7 ("KVM: arm64: Use generic sanitisation for ID_(AA64)DFR0_EL1") Signed-off-by: James Clark Reviewed-by: Marc Zyngier Reviewed-by: Colton Lewis Signed-off-by: Will Deacon commit 2e30447b233a8e7a561bb51995b8d4944282bf62 Author: James Clark Date: Thu Mar 5 16:28:17 2026 +0000 KVM: arm64: Read PMUVer as unsigned ID_AA64DFR0_EL1.PMUVer is an unsigned field, so this skips initialization of host_data_ptr(nr_event_counters) for PMUv3 for Armv8.8 onwards as they appear as negative values. Fix it by reading it as unsigned. Now ID_AA64DFR0_EL1_PMUVer_IMP_DEF needs to be special cased, so use pmuv3_implemented() which already does it. Fixes: 2417218f2f23 ("KVM: arm64: Get rid of __kvm_get_mdcr_el2() and related warts") Signed-off-by: James Clark Reviewed-by: Marc Zyngier Reviewed-by: Colton Lewis Signed-off-by: Will Deacon commit a4b908c89d88d4b7251c566457979c4167b9664c Author: Kexin Sun Date: Sat Mar 21 18:58:25 2026 +0800 net: phy: update outdated comment for removed phy_package_read/write() The locked convenience functions phy_package_read() and phy_package_write() were removed (as they had no users) by commit e7f984e925d2 ("net: phy: move PHY package related code from phy.h to phy_package.c"). Update the comment to reference the existing unlocked counterparts __phy_package_read() and __phy_package_write(). Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260321105825.7221-1-kexinsun@smail.nju.edu.cn Signed-off-by: Paolo Abeni commit 88c07dff9f6dd0b89b3e5364b202978eab2541c2 Author: Kexin Sun Date: Sat Mar 21 18:57:53 2026 +0800 hv_sock: update outdated comment for renamed vsock_stream_recvmsg() The function vsock_stream_recvmsg() was renamed to vsock_connectible_recvmsg() by commit a9e29e5511b9 ("af_vsock: update functions for connectible socket"). Update the comment accordingly. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260321105753.6751-1-kexinsun@smail.nju.edu.cn Signed-off-by: Paolo Abeni commit b50a48b65cb0c955728894b24ba5ecc3cd4b8c7d Merge: a41a5733e71ac1 cd1f306e28157b Author: Paolo Abeni Date: Tue Mar 24 12:10:46 2026 +0100 Merge branch 'net-stmmac-cleanup-stmmac_xmit' Russell King says: ==================== net: stmmac: cleanup stmmac_xmit() This series continues on from part 2 of the descriptor cleanups, making stmmac_xmit() more readable. Tested-by: Maxime Chevallier ==================== Link: https://patch.msgid.link/ab15_JvLGFtUH_3x@shell.armlinux.org.uk Signed-off-by: Paolo Abeni commit cd1f306e28157bd0900cae52207839d210e61f61 Author: Russell King (Oracle) Date: Fri Mar 20 16:47:37 2026 +0000 net: stmmac: elminate tbs_desc in stmmac_xmit() There is no need to have a local variable for tbs_desc, we can do the conversion when calling stmmac_set_desc_tbs(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w3d0b-0000000DfMD-2hrD@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier Signed-off-by: Paolo Abeni commit 557ccd54ba141650cfd6962296c062089f3c6cd3 Author: Russell King (Oracle) Date: Fri Mar 20 16:47:32 2026 +0000 net: stmmac: use first_desc for TBS Rather than freshly getting a pointer for the TBS descriptor (because we want to access its enhanced fields) convert the existing first_desc basic descriptor to a pointer to the enhanced descriptor. Add a comment explaining why it is safe to convert from the basic descriptor pointer to the enhanced descriptor pointer. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w3d0W-0000000DfM7-2BMA@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier [pabeni@redhat.com: fixed comment typo] Signed-off-by: Paolo Abeni commit 2e3bfeb1bc0c0a7cd51212ecc6533aca73cf8e2d Author: Russell King (Oracle) Date: Fri Mar 20 16:47:27 2026 +0000 net: stmmac: move stmmac_xmit() initial variable init Move tx_q, first_tx and txq_stats just before their first use. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w3d0R-0000000DfM1-1itN@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier Signed-off-by: Paolo Abeni commit 7b8683115034360a2f7f7e5b0dac958249fa810a Author: Russell King (Oracle) Date: Fri Mar 20 16:47:22 2026 +0000 net: stmmac: move stmmac_xmit() first entry index code The handling of the first descriptor index/pointer is split around the checksum handling which makes no sense. Group this code together. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w3d0M-0000000DfLv-1C6S@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier Signed-off-by: Paolo Abeni commit cafacdc48a74e16b2ad727b3f31a06c08d96e0b1 Author: Russell King (Oracle) Date: Fri Mar 20 16:47:17 2026 +0000 net: stmmac: move first xmit descriptor SARC and TBS config Move the first transmit descriptor's SARC and TBS configuration alongside the code which populates the first descriptor, which helps to keep all the code specific to that descriptor together. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w3d0H-0000000DfLp-0gIx@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier Signed-off-by: Paolo Abeni commit fcbf106189aaf69a2a2f6116672d442d473ecbcd Author: Russell King (Oracle) Date: Fri Mar 20 16:47:12 2026 +0000 net: stmmac: move stmmac_xmit() skb head handling The skb head buffer handling is delayed in stmmac_xmit() until after the skb fragments have been populated into the descriptors. The reason is this code used to set the OWN bit on the first descriptor, which then allows the TX DMA to process the first and subsequent descriptors. However, as of commit 579a25a854d4 ("net: stmmac: Initial support for TBS") this is now separated, but the comments weren't updated. Move the code populating the first descriptor along side the jumbo code which also populates the first descriptor. This gives a consistent location where we populate the descriptor(s) for the SKB head. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w3d0C-0000000DfLj-0BLb@rmk-PC.armlinux.org.uk Tested-by: Maxime Chevallier Signed-off-by: Paolo Abeni commit 91193e72ba79b3fc3a6fbfbc931efe2dd2096c3b Author: Sakari Ailus Date: Mon Mar 16 23:34:39 2026 +0200 media: ov02a10, dw9768: Remove Dongchung's e-mail Dongchung's e-mail address returns a permanent error: The following message to was undeliverable. The reason for the problem: 5.1.0 - Unknown address error 550-'Relaying mail to dongchun.zhu@mediatek.com is not allowed' Remove the address. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 64d712aa31f30a125291e7c47209ef7ebd3285a3 Author: Tomi Valkeinen Date: Tue Mar 17 14:09:42 2026 +0200 media: subdev: Split v4l2_subdev_get_frame_desc_passthrough() into locked and unlocked The recently added v4l2_subdev_get_frame_desc_passthrough() can be used directly as an implementation for .get_frame_desc subdev op. However, in some cases the drivers may want to add some customizations, while the bulk of the work is still identical to what v4l2_subdev_get_frame_desc_passthrough() does. Current locking scheme makes this impossible to do properly. Split v4l2_subdev_get_frame_desc_passthrough() into two functions: __v4l2_subdev_get_frame_desc_passthrough(), which takes a locked subdev state as a parameter, instead of locking and getting the active state internally. Other than that, it does the same as v4l2_subdev_get_frame_desc_passthrough() used to do. v4l2_subdev_get_frame_desc_passthrough(), which locks the active state and calls __v4l2_subdev_get_frame_desc_passthrough(). In other words, v4l2_subdev_get_frame_desc_passthrough() works as before, but drivers can now alternatively add custom .get_frame_desc code and call v4l2_subdev_get_frame_desc_passthrough(). An example use case is with DS90UB953 serializer: in normal use the serializer passes through everything, but when test-pattern-generator (TPG) is used, an internal TPG source is used. After this commit, the UB953 get_frame_desc() can lock the state, look at the routing table to see if we're in normal or TPG mode, then either call __v4l2_subdev_get_frame_desc_passthrough() if in normal mode, or construct a TPG frame desc if in TPG mode. Signed-off-by: Tomi Valkeinen [Sakari Ailus: Rebase on an earlier remote source pad error code fix.] Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit f40306e08627bd4a51a1bcdc4ec864209448bdc0 Author: Tomi Valkeinen Date: Tue Mar 17 14:09:41 2026 +0200 media: subdev: Minor v4l2_subdev_get_frame_desc_passthrough() cleanups Minor code cleanups, no functional change. Signed-off-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 754ec1f19614948a0af3484815eec98ef27951c5 Author: Tomi Valkeinen Date: Tue Mar 17 14:09:40 2026 +0200 media: subdev: Improve v4l2_subdev_get_frame_desc_passthrough() kdoc Improve the v4l2_subdev_get_frame_desc_passthrough() kernel doc: - Fix 'v4l2_get_frame_desc' operation to 'get_frame_desc' operation - Rewrite the body text to be more understandable and specific, and specifically mention the frame desc type handling. Signed-off-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 1b065199ea1934e6d06d1a9b2dc7ed7c79321484 Author: Alexander Koskovich Date: Thu Mar 12 17:16:28 2026 +0000 media: i2c: ov8856: parse and register V4L2 device tree properties Parse V4L2 device tree properties and register controls for them. Signed-off-by: Alexander Koskovich Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 78c7ab8af70fbf01b74eaa4d58bbc6b9c0bafe96 Author: Alexander Koskovich Date: Thu Mar 12 17:16:24 2026 +0000 media: dt-bindings: ovti,ov8856: Allow orientation & rotation props Allow the orientation and rotation properties from video-interface-devices to be specified. The sensor can be front or rear facing and can be mounted at any rotation. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Alexander Koskovich Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit f75e160745663ce9b13362ae6e90bd439c58df69 Author: Alexander Koskovich Date: Thu Mar 12 17:16:20 2026 +0000 media: i2c: ov8856: free control handler on error in ov8856_init_controls() The control handler wasn't freed if adding controls failed, add an error exit label and convert the existing error return to use it. Fixes: 879347f0c258 ("media: ov8856: Add support for OV8856 sensor") Cc: stable@vger.kernel.org Signed-off-by: Alexander Koskovich Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit ea9e61deee422e0c781b512967634b8716a1c6ce Author: Alain Volmat Date: Thu Mar 12 19:07:08 2026 +0100 dt-bindings: media: st,stm32-dcmi: add 'power-domains' property STM32 DCMI may be in a power domain which is the case for the STM32MP2x based boards. Allow a single 'power-domains' entry for STM32 DCMI. Signed-off-by: Alain Volmat Acked-by: Conor Dooley Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 9f1af89a75983264706849ecea83cd97f11d1c86 Author: Chen Ni Date: Tue Mar 17 15:20:20 2026 +0800 media: v4l2-subdev: Fix error check in v4l2_subdev_get_frame_desc_passthrough() Use IS_ERR() and PTR_ERR() to properly handle the error return from media_pad_remote_pad_unique(), which returns ERR_PTR() on failure but never NULL. The previous code only checked for NULL, leading to invalid pointer dereference. Detected by Smatch: drivers/media/v4l2-core/v4l2-subdev.c:2588 v4l2_subdev_get_frame_desc_passthrough() warn: 'remote_source_pad' is an error pointer or valid drivers/media/v4l2-core/v4l2-subdev.c:2595 v4l2_subdev_get_frame_desc_passthrough() error: 'remote_source_pad' dereferencing possible ERR_PTR() Fixes: a564839e630c ("media: subdev: Add v4l2_subdev_get_frame_desc_passthrough helper") Reviewed-by: Jacopo Mondi Reviewed-by: Tomi Valkeinen Signed-off-by: Chen Ni Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit d3ac6212df604f7f33c2f5b2de19dbbf7b5aaad6 Author: Richard Acayan Date: Tue Mar 10 22:03:28 2026 -0400 media: i2c: imx355: Restrict data lanes to 4 The IMX355 sensor driver currently supports having 4 data lanes. There can't be more or less, so check if the firmware specifies 4 lanes. Suggested-by: Sakari Ailus Link: https://lore.kernel.org/r/aW3uFcT1zmiF4GUP@kekkonen.localdomain Signed-off-by: Richard Acayan Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 08f9794d9b799b56b301d7537e8771f0d41f51a1 Author: Maxime Ripard Date: Mon Mar 9 16:07:41 2026 +0100 media: bcm2835-unicam: Fix RGB format / mbus code association The Unicam driver is a MIPI-CSI2 Receiver, that can capture RGB 4:4:4, YCbCr 4:2:2, and raw formats. RGB 4:4:4 is converted to the MIPI-CSI2 RGB888 video format, and associated to the MEDIA_BUS_FMT_RGB888_1X24 media bus code. However, V4L2_PIX_FMT_RGB24 is defined as having its color components in the R, G and B order, from left to right. MIPI-CSI2 however defines the RGB888 format with blue first, and that's what MEDIA_BUS_FMT_RGB888_1X24 defines too. This essentially means that the R and B will be swapped compared to what V4L2_PIX_FMT_RGB24 defines. The same situation occurs with V4L2_PIX_FMT_BGR24 being associated to MEDIA_BUS_FMT_BGR888_1X24. In order to fix the swapped components, we need to change the association of V4L2_PIX_FMT_BGR24 to MEDIA_BUS_FMT_RGB888_1X24, and of V4L2_PIX_FMT_RGB24 to MEDIA_BUS_FMT_BGR888_1X24. Since the media bus code is exposed to userspace, and validated by unicam's link_validate implementation, we need to explicitly accept (and warn) the old association still to preserve backward compatibility. Signed-off-by: Maxime Ripard Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 7b0288bc05a7dfd45351692076a292ffc4718477 Author: Maxime Ripard Date: Mon Mar 9 16:07:40 2026 +0100 media: uapi: Clarify MBUS color component order for serial buses The subdev format documentation has a subsection describing how to use the media bus pixel codes for serial buses. While it describes the sampling part well, it doesn't really describe the current convention used for the components order. Let's improve that. Reviewed-by: Laurent Pinchart Signed-off-by: Maxime Ripard Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 40c6da8a9c0f897f99a439330584d93ca7d41226 Author: Tomi Valkeinen Date: Tue Jan 27 10:56:12 2026 +0200 media: renesas: vin: Fix RAW8 (again) Commit e7376745ad5c ("media: rcar-vin: Fix stride setting for RAW8 formats") removed dividing the stride by two for RAW8 formats. It is unclear how this was tested, but in any of the recent tests this does not seem to work and produces quite distorted images. However, reverting the patch fixes the issues only partially. VNIS_REG requires alignment to 16 bytes, and when dividing the stride by 2, in some cases we end up with a non-aligned stride, producing a tilted image. This issue has to be fixed in rvin_format_bytesperline() where we do the alignment for bytesperline. Adding back the stride division and increasing the alignment for RAW8 formats to 0x20 fixes the problems related to RAW8. Fixes: e7376745ad5c ("media: rcar-vin: Fix stride setting for RAW8 formats") Cc: stable@vger.kernel.org Signed-off-by: Tomi Valkeinen Reviewed-by: Niklas Söderlund Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 58b1e9664d8f74d55d8411cc7a7b275a76a6f24f Author: Tomi Valkeinen Date: Thu Jan 15 11:22:35 2026 +0200 media: renesas: vsp1: Fix NULL pointer deref on module unload When unloading the module on gen 4, we hit a NULL pointer dereference. This is caused by the cleanup code calling vsp1_drm_cleanup() where it should be calling vsp1_vspx_cleanup(). Fix this by checking the IP version and calling the drm or vspx function accordingly, the same way as the init code does. Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support") Cc: stable@vger.kernel.org Signed-off-by: Tomi Valkeinen Reviewed-by: Kieran Bingham Reviewed-by: Jacopo Mondi Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 8015a49d8b33f2b1fb191017055ce3de933d547a Author: Sakari Ailus Date: Thu Mar 5 00:16:10 2026 +0200 media: v4l2-fwnode: Return -EPROBE_DEFER on parsing NULL endpoints In general drivers get their firmware graph endpoints from system firmware, but on some systems this information is conveyed to drivers via software nodes. The software nodes may be instantiated only after the drivers are first probed, requiring drivers to explicitly issue -EPROBE_DEFER when endpoints aren't found. Instead of doing this in all (or at least most) drivers, make v4l2-fwnode endpoint parsing functions v4l2_fwnode_endpoint_parse() and v4l2_fwnode_endpoint_alloc_parse() return -EPROBE_DEFER when an endpoint is NULL. Signed-off-by: Sakari Ailus Reviewed-by: Frank Li Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit a41a5733e71ac103ca8a045539f7b56050dae75a Merge: 9d9f21d314933e de69301dc2f6d4 Author: Paolo Abeni Date: Tue Mar 24 11:08:20 2026 +0100 Merge branch 'net-cleanup-bitmaps-printing' Yury Norov says: ==================== net: cleanup bitmaps printing Bitmap API has a bitmap_print_to_pagebuf() function that is intended to print bitmap into a human readable format, making sure that the output string will not get big enough to cross the current page limit. Some drivers use this function immediately before passing the result to scnprintf() with no modification. This is useless because scnprintf(), and helpers based on it like seq_pritf() and sysfs_emit(), take care of not overflowing the buffer by itself, and perfectly print bitmaps with "%*pb[l]". v1: https://lore.kernel.org/all/20260219181407.290201-1-ynorov@nvidia.com/ ==================== Link: https://patch.msgid.link/20260319201713.941956-1-ynorov@nvidia.com Signed-off-by: Paolo Abeni commit de69301dc2f6d4172c69c3d1c7ceaad7af89b0dc Author: Yury Norov Date: Thu Mar 19 16:17:11 2026 -0400 net-sysfs: switch xps_queue_show() to sysfs_emit() Switch the function to use the proper sysfs_emit("%pb"). Suggested-by: Thomas Weißschuh Reviewed-by: Thomas Weißschuh Signed-off-by: Yury Norov Link: https://patch.msgid.link/20260319201713.941956-3-ynorov@nvidia.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit 6e4235adfa8814afc361d26cd630b9af8c4f01a8 Author: Yury Norov Date: Thu Mar 19 16:17:10 2026 -0400 octeontx2-af: simplify rvu_debugfs The driver uses bitmap_print_to_pagebuf() to store human-readable bitmaps representations in a temporary buffers; and then feed seq_printf() with it. Switch to using seq_printf("%*pb") directly and drop intermediate buffer. Signed-off-by: Yury Norov Link: https://patch.msgid.link/20260319201713.941956-2-ynorov@nvidia.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit 9d9f21d314933edaf8180839375a47724cc322fc Merge: 9d463f7863f2cc b7fb3677840d26 Author: Paolo Abeni Date: Tue Mar 24 10:48:09 2026 +0100 Merge branch 'amd-xgbe-tx-resilience-improvements-for-link-down-handling' Raju Rangoju says: ==================== amd-xgbe: TX resilience improvements for link-down handling This series enhances the AMD 10GbE driver's TX queue handling during link-down events to improve resilience, prevent resource leaks, and enable fast failover in link aggregation configurations. The three patches form a complete link-down handling solution: 1. Patch 1: Fast detection (know quickly when link goes down) 2. Patch 2: Quick response (stop TX immediately, skip waits) 3. Patch 3: Clean recovery (reclaim abandoned resources) ==================== Link: https://patch.msgid.link/20260319163251.1808611-1-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit b7fb3677840d26b3fa4c5d0d63b578a2f44077d1 Author: Raju Rangoju Date: Thu Mar 19 22:02:51 2026 +0530 amd-xgbe: add TX descriptor cleanup for link-down Add intelligent TX descriptor cleanup mechanism to reclaim abandoned descriptors when the physical link goes down. When the link goes down while TX packets are in-flight, the hardware stops processing descriptors with the OWN bit still set. The current driver waits indefinitely for these descriptors to complete, which never happens. This causes: - TX ring exhaustion (no descriptors available for new packets) - Memory leaks (skbs never freed) - DMA mapping leaks (mappings never unmapped) - Network stack backpressure buildup Add force-cleanup mechanism in xgbe_tx_poll() that detects link-down state and reclaims abandoned descriptors. The helper functions and DMA optimizations support efficient TX shutdown: - xgbe_wait_for_dma_tx_complete(): Wait for DMA completion with link-down optimization - Restructure xgbe_disable_tx() for proper shutdown sequence Implementation: 1. Check link state at the start of tx_poll 2. If link is down, set force_cleanup flag 3. For descriptors that hardware hasn't completed (!tx_complete): - If force_cleanup: treat as completed and reclaim resources - If link up: break and wait for hardware (normal behavior) The cleanup process: - Frees skbs that will never be transmitted - Unmaps DMA mappings - Resets descriptors for reuse - Does NOT count as successful transmission (correct statistics) Benefits: - Prevents TX ring starvation - Eliminates memory and DMA mapping leaks - Enables fast link recovery when link comes back up - Critical for link aggregation failover scenarios Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260319163251.1808611-4-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 0898849ad9715d163555b8f8bfd13b7691a2b3b8 Author: Raju Rangoju Date: Thu Mar 19 22:02:50 2026 +0530 amd-xgbe: optimize TX shutdown on link-down Optimize the TX shutdown sequence when link goes down by skipping futile hardware wait operations and immediately stopping TX queues. Current behavior creates delays and resource issues during link-down: 1. xgbe_txq_prepare_tx_stop() waits up to XGBE_DMA_STOP_TIMEOUT for TX queues to drain, but when link is down, hardware will never complete the pending descriptors. This causes unnecessary delays during interface shutdown. 2. TX queues remain active after link-down, allowing the network stack to continue queuing packets that cannot be transmitted. This leads to resource buildup and complicates recovery. This patch adds two optimizations: Optimization 1: Skip TX queue drain when link is down In xgbe_txq_prepare_tx_stop(), detect link-down state and return immediately instead of waiting for hardware. Abandoned descriptors will be cleaned up by the force-cleanup mechanism (next patch). Optimization 2: Immediate TX queue stop on link-down In xgbe_phy_adjust_link(), call netif_tx_stop_all_queues() as soon as link-down is detected. Also wake TX queues on link-up to resume transmission. Benefits: - Faster interface shutdown (no pointless timeout waits) - Prevents packet queue buildup in network stack - Cleaner state management during link transitions - Enables orderly descriptor cleanup by NAPI poll Note: We do not call netdev_tx_reset_queue() on link-down because NAPI poll may still be running, which would trigger BQL assertions. BQL state is cleaned up naturally during descriptor reclamation. Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260319163251.1808611-3-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 31b2d4e00260ae3fca50779ac416dd9acaacbfb9 Author: Raju Rangoju Date: Thu Mar 19 22:02:49 2026 +0530 amd-xgbe: add adaptive link status polling Implement adaptive link status polling to enable fast link-down detection while conserving CPU resources during link-down periods. Currently, the driver polls link status at a fixed 1-second interval regardless of link state. This creates a trade-off: - Slow polling (1s): Misses rapid link state changes, causing delays - Fast polling: Wastes CPU when link is stable or down This enhancement introduces state-aware polling: When carrier is UP: Poll every 100ms to enable rapid link-down detection. This provides ~100-200ms response time to link failures, minimizing packet loss and enabling fast failover in link aggregation configurations. When carrier is DOWN: Poll every 1s to conserve CPU resources. Link-up detection is less time-critical since no traffic is flowing. Performance impact: - Link-down detection: 1000ms → 100-200ms (10x improvement) - CPU overhead when link up: 0.1% → 1% (acceptable for active links) - CPU overhead when link down: unchanged at 0.1% This is particularly valuable for: - Link aggregation deployments requiring sub-second failover - Environments with flaky links or cable issues - Applications sensitive to connection recovery time Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260319163251.1808611-2-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 9e60ee0e6dc2c81e0e5b285d09807a361f6745ce Author: Piotr Piórkowski Date: Mon Mar 9 16:24:49 2026 +0100 vfio/xe: Notify PF about VF FLR in reset_prepare Hook into the PCI error handler reset_prepare() callback to notify the PF about an upcoming VF FLR before reset_done() is executed. This enables early FLR_PREPARE signaling and ensures that the PF is aware of the reset before the completion wait begins. Signed-off-by: Piotr Piórkowski Cc: Michał Winiarski Reviewed-by: Michał Winiarski Reviewed-by: Alex Williamson Link: https://patch.msgid.link/20260309152449.910636-3-piotr.piorkowski@intel.com Signed-off-by: Michał Winiarski commit 2de36e3f72dae2035b2742ffe3355e43067a81ad Author: Piotr Piórkowski Date: Mon Mar 9 16:24:48 2026 +0100 drm/xe/pf: Add FLR_PREPARE state to VF control flow Our xe-vfio-pci component relies on the confirmation from the PF that VF FLR processing has finished, but due to the notification latency on the HW/FW side, PF might be unaware yet of the already triggered VF FLR. Update VF state machine with new FLR_PREPARE state that indicate imminent VF FLR notification and treat that as a begin of the FLR sequence. Also introduce function that xe-vfio-pci should call to guarantee correct synchronization. v2: move PREPARE into WIP, update commit msg (Michal) Signed-off-by: Piotr Piórkowski Co-developed-by: Michal Wajdeczko Signed-off-by: Michal Wajdeczko Reviewed-by: Michał Winiarski Link: https://patch.msgid.link/20260309152449.910636-2-piotr.piorkowski@intel.com Signed-off-by: Michał Winiarski commit 0e81fe79fec5a639700f09f39c8ab680c3312ba2 Author: Shrikanth Hegde Date: Tue Mar 24 01:06:28 2026 +0530 sched/core: Get this cpu once in ttwu_queue_cond() Calling smp_processor_id() on: - In CONFIG_DEBUG_PREEMPT=y, if preemption/irq is disabled, then it does not print any warning. - In CONFIG_DEBUG_PREEMPT=n, it doesn't do anything apart from getting __smp_processor_id So with both CONFIG_DEBUG_PREEMPT=y/n, in preemption disabled section it is better to cache the value. It could save a few cycles. Though tiny, repeated could add up to a small value. ttwu_queue_cond is called with interrupt disabled. So preemption is disabled. Hence cache the value once instead. Signed-off-by: Shrikanth Hegde Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Link: https://patch.msgid.link/20260323193630.640311-3-sshegde@linux.ibm.com commit 76504bce4ee6b8757647e07bc1710dcac9acdc2e Author: Shrikanth Hegde Date: Tue Mar 24 01:06:27 2026 +0530 sched/fair: Get this cpu once in find_new_ilb() Calling smp_processor_id() on: - In CONFIG_DEBUG_PREEMPT=y, if preemption/irq is disabled, then it does not print any warning. - In CONFIG_DEBUG_PREEMPT=n, it doesn't do anything apart from getting __smp_processor_id So with both CONFIG_DEBUG_PREEMPT=y/n, in preemption disabled section it is better to cache the value. It could save a few cycles. Though tiny, repeated in loop could add up to a small value. find_new_ilb is called in interrupt context. So preemption is disabled. So Hoist the this_cpu out of loop Signed-off-by: Shrikanth Hegde Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Reviewed-by: K Prateek Nayak Link: https://patch.msgid.link/20260323193630.640311-2-sshegde@linux.ibm.com commit e379dce8af11d8d6040b4348316a499bfd174bfb Author: Peter Zijlstra Date: Mon Mar 23 10:36:27 2026 +0100 sched/topology: Fix sched_domain_span() Commit 8e8e23dea43e ("sched/topology: Compute sd_weight considering cpuset partitions") ends up relying on the fact that structure initialization should not touch the flexible array. However, the official GCC specification for "Arrays of Length Zero" [*] says: Although the size of a zero-length array is zero, an array member of this kind may increase the size of the enclosing type as a result of tail padding. Additionally, structure initialization will zero tail padding. With the end result that since offsetof(*type, member) < sizeof(*type), array initialization will clobber the flex array. Luckily, the way flexible array sizes are calculated is: sizeof(*type) + count * sizeof(*type->member) This means we have the complete size of the flex array *outside* of sizeof(*type), so use that instead of relying on the broken flex array definition. [*] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html Fixes: 8e8e23dea43e ("sched/topology: Compute sd_weight considering cpuset partitions") Reported-by: Nathan Chancellor Debugged-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Tested-by: Jon Hunter Tested-by: Chen Yu Tested-by: K Prateek Nayak Tested-by: Nathan Chancellor Link: https://patch.msgid.link/20260323093627.GY3738010@noisy.programming.kicks-ass.net commit 7803501e5754dc4b295ab22b20562e2b965358ba Author: Bartosz Golaszewski Date: Mon Mar 16 10:45:23 2026 +0100 gpio: drop unneeded Kconfig dependencies on OF_GPIO OF_GPIO is selected automatically on all OF systems. Any symbols it controls also provide stubs so there's really no reason to select it explicitly. Remove all Kconfig dependencies/selects for GPIO drivers. For those that have no other dependencies: convert it to requiring CONFIG_OF instead to avoid new symbols popping up in make config. Link: https://patch.msgid.link/20260316-gpio-of-kconfig-v2-3-de2f4b00a0e4@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit d994acc526c70d40ec9029cfe03d08ee411083c5 Author: Alexandru Dadu Date: Mon Mar 23 20:31:30 2026 +0200 drm/imagination: Implement handling of context reset notification The firmware will send the context reset notification message as part of handling hardware recovery (HWR) events deecoding the message and printing via drm_info(). This eliminates the "Unknown FWCCB command" message that was previously printed. Co-developed-by: Sarah Walker Signed-off-by: Sarah Walker Signed-off-by: Alexandru Dadu Reviewed-by: Matt Coster Link: https://patch.msgid.link/20260323-b4-firmware-context-reset-notification-handling-v3-3-1a66049a9a65@imgtec.com Signed-off-by: Matt Coster commit d2f83a6cd598bf413f1acf34153bd1d71023fbab Author: Alexandru Dadu Date: Mon Mar 23 20:31:29 2026 +0200 drm/imagination: Switch reset_reason fields from enum to u32 Update the reset_reason fwif structure fields from enum to u32 to remove any ambiguity from the interface (enum is not a fixed size thus is unfit for the purpose of the data type). Fixes: a26f067feac1f ("drm/imagination: Add FWIF headers") Signed-off-by: Alexandru Dadu Reviewed-by: Matt Coster Link: https://patch.msgid.link/20260323-b4-firmware-context-reset-notification-handling-v3-2-1a66049a9a65@imgtec.com Signed-off-by: Matt Coster commit da173557a2b090d7d8c155283ba489a287983ced Author: Alexandru Dadu Date: Mon Mar 23 20:31:28 2026 +0200 drm/imagination: Add missing rogue context reset reasons Update the context reset reason enum with the missing reset reasons in the 6-11 value gap: - CDM Mission/safety checksum mismatch; - TRP checksum mismatch; - GPU ECC error (corrected, OK); - GPU ECC error (uncorrected, HWR); - FW ECC error (corrected, OK); - FW ECC error (uncorrected, ERR); Co-developed-by: Sarah Walker Signed-off-by: Sarah Walker Signed-off-by: Alexandru Dadu Reviewed-by: Matt Coster Link: https://patch.msgid.link/20260323-b4-firmware-context-reset-notification-handling-v3-1-1a66049a9a65@imgtec.com Signed-off-by: Matt Coster commit 968e9fd188488d1a4b6981f39554d4117468b6ee Author: Mika Kahola Date: Thu Mar 12 08:06:57 2026 +0000 drm/i915/lt_phy: Replace crtc compute clock The existing DPLL compute clock callback for the XE3PLPD platform (`xe3plpd_crtc_compute_clock`) was specific to that platform. Replace it with the more generic Haswell (`hsw_crtc_compute_clock`) implementation so that the compute clock path does not rely on the XE3PLPD hook. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-25-mika.kahola@intel.com commit 29b37427cdc6a9cc37b060e9e9eea90965936bb5 Author: Mika Kahola Date: Thu Mar 12 10:14:15 2026 +0000 drm/i915/lt_phy: Enable dpll framework for xe3plpd xe3plpd platform is supported by dpll framework remove a separate check for hw comparison and rely solely on dpll framework hw comparison. Finally, all required hooks are now in place so initialize PLL manager for xe3plpd platform and remove the redirections to the legacy code paths for clock enable/disable as well as state mismatch checks that are no longer needed. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312101415.2669387-1-mika.kahola@intel.com commit 35349695ada2d4888a267afbe1f920c069264aa5 Author: Mika Kahola Date: Thu Mar 12 08:06:55 2026 +0000 drm/i915/lt_phy: Remove LT PHY specific state verification Remove LT PHY specific state verification as DPLL framework has state verification check. v2: Reuse intel_lt_phy_pll_compare_hw_state() as only config[0] and config[0] parameters are reliable with LT PHY (Suraj) v3: Rephrase handling of LT PHY case when verifying the state (CI) v4: Fix checkpatch warning of line length exceeding 100 columns Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-23-mika.kahola@intel.com commit a60d70847c5badbe624b0a6a175448ed4ad1073f Author: Mika Kahola Date: Thu Mar 12 08:06:54 2026 +0000 drm/i915/lt_phy: Add xe3plpd Thunderbolt PLL hooks Add the PLL hooks for the TBT PLL on xe3plpd. These are simple stubs similar to the TBT PLL on earlier platforms, since this PLL is always on from the display POV - so no PLL enable/disable programming is required as opposed to the non-TBT PLLs - and the clocks for different link rates are enabled/disabled at a different level, via the intel_encoder::enable_clock()/disable_clock() interface. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-22-mika.kahola@intel.com commit c071495ccd89955ca6c54608bd8d5dc31574ed0a Author: Mika Kahola Date: Thu Mar 12 08:06:53 2026 +0000 drm/i915/lt_phy: Get encoder configuration for xe3plpd platform Reuse mtl_ddi_*_get_config functions now that all hooks are in place. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-21-mika.kahola@intel.com commit ef5aa934a3c962fcd29b41926d41a86d8274239f Author: Mika Kahola Date: Thu Mar 12 08:06:52 2026 +0000 drm/i915/lt_phy: Readout lane count Readout lane count back from HW. Reuse existing function for Cx0 for LT PHY case with minor modification to add lanes as function parameters. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-20-mika.kahola@intel.com commit 7049d9a773f3ec8a15eb873e2017ed5287b8c96c Author: Mika Kahola Date: Thu Mar 12 08:06:51 2026 +0000 drm/i915/lt_phy: Dump lane count for HW state To increase debuggability add lane count as part of HW state dump. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-19-mika.kahola@intel.com commit cfe8715427dad345b3ce78096081354201ad18af Author: Mika Kahola Date: Thu Mar 12 08:06:50 2026 +0000 drm/i915/lt_phy: Add .disable_clock hook on DDI Add new pll_disable_clock functions so that they can be hooked up to dpll->disable. This is just a wrapper over the exitisting intel_xe3plpd_pll_disable to make it compatible With dpll->disable function v2: Revise commit message (Suraj) Drop wrapper for TBT clock disabling and reuse intel_mtl_pll_disable_clock() for DDI clock disabling hook (Suraj) Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-18-mika.kahola@intel.com commit 5ec58d714935c2671ffab58d8ac23b9224b66936 Author: Mika Kahola Date: Thu Mar 12 08:06:49 2026 +0000 drm/i915/lt_phy: Add .enable_clock hook on DDI Enable PLL clock on DDI by moving part of the PLL enabling sequence into a DDI clock enabling function. v2: Reuse intel_mtl_pll_enable_clock for DDI clock enabling Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-17-mika.kahola@intel.com commit 27d911f87f96cd55461acf2468527f98eefce3ed Author: Mika Kahola Date: Thu Mar 12 08:06:48 2026 +0000 drm/i915/lt_phy: Add xe3plpd .crtc_get_dpll Add .crtc_get_dpll function pointer to support xe3plpd platform. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-16-mika.kahola@intel.com commit ff684c7eaca3da6f4436ef268da9ded7d0c4c4d4 Author: Mika Kahola Date: Thu Mar 12 08:06:47 2026 +0000 drm/i915/lt_phy: Add xe3plpd .get_freq hook Add .get_freq function hook to support dpll framework for xe3plpd platform. v2: Restore port clock calculation (Suraj) Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-15-mika.kahola@intel.com commit c62ba60b1098ff05528f13e75eca811b13e2c0c5 Author: Mika Kahola Date: Thu Mar 12 08:06:46 2026 +0000 drm/i915/lt_phy: Add xe3plpd .get_hw_state hook Add .get_hw_state hook to xe3plpd platform for dpll framework and update intel_lt_phy_pll_readout_hw_state() function accordingly to support dpll framework. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-14-mika.kahola@intel.com commit 37115f773c8c16eca0dbcb9399aa435111a7b34e Author: Mika Kahola Date: Thu Mar 12 08:06:45 2026 +0000 drm/i915/lt_phy: Add xe3plpd .compare_hw_state hook Add .compare_hw_state function pointer for xe3plpd platform to support dpll framework. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-13-mika.kahola@intel.com commit a8acd1a61a03191c6426e2bcd2f0b3b576d0d789 Author: Mika Kahola Date: Thu Mar 12 08:06:44 2026 +0000 drm/i915/lt_phy: Add xe3plpd .dump_hw_state hook Add .dump_hw_state function pointer for xe3plpd platform to support dpll framework. While at it, switch to use drm_printer structure to print hw state information. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-12-mika.kahola@intel.com commit 658b554a8b0c6e8306d11f1e074e8445dc002d54 Author: Mika Kahola Date: Thu Mar 12 08:06:43 2026 +0000 drm/i915/lt_phy: Add xe3plpd .update_dpll_ref_clks hook Add .update_dpll_ref_clks function pointer to xe3plpd platform to support dpll framework. Reuse ICL function pointer. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-11-mika.kahola@intel.com commit 1e8988c328e09550f683fa8adc51eb8553ab6fb8 Author: Mika Kahola Date: Thu Mar 12 08:06:42 2026 +0000 drm/i915/lt_phy: Add xe3plpd .update_active_dpll hook Add .update_active_dpll function pointer to support dpll framework for xe3plpd platform. Reuse ICL function pointer. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-10-mika.kahola@intel.com commit a04b8125db835418560fdab82ed47685ab77644d Author: Mika Kahola Date: Thu Mar 12 08:06:41 2026 +0000 drm/i915/lt_phy: Add xe3plpd .put_dplls hook Add .put_dplls function pointer to support xe3plpd platform on dpll framework. Reuse ICL function pointer. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-9-mika.kahola@intel.com commit 565604328606bf6c187007dc1b7dfe151bbc6ba9 Author: Mika Kahola Date: Thu Mar 12 08:06:40 2026 +0000 drm/i915/lt_phy: Add xe3plpd .get_dplls hook Add .get_dplls function pointer for xe3plpd platforms to support dpll framework. Reuse the ICL function pointer. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-8-mika.kahola@intel.com commit 3ce06de38959fdadb2da7350918ff963069463fb Author: Mika Kahola Date: Thu Mar 12 08:06:39 2026 +0000 drm/i915/lt_phy: Add xe3plpd .compute_dplls hook Add compute dpll hook for xe3plpd platform and bring PLL state calculation to support PLL framework. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-7-mika.kahola@intel.com commit 6e1c3b80ee801d1450a20a5420e79f9460bc5f0b Author: Mika Kahola Date: Thu Mar 12 08:06:38 2026 +0000 drm/i915/lt_phy: Add lane_count to PLL state Cache lane count as part of PLL state. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-6-mika.kahola@intel.com commit f52bbb00deaaa137271217e158537151f6c792b6 Author: Mika Kahola Date: Thu Mar 12 08:06:37 2026 +0000 drm/i915/lt_phy: Refactor LT PHY PLL handling to use explicit PLL state The LT PHY implementation currently pulls PLL and port_clock information directly from the CRTC state. This ties the PHY programming logic too tightly to the CRTC state and makes it harder to clearly express the PHY’s own PLL configuration. Introduce an explicit "struct intel_lt_phy_pll_state" argument for the PHY functions and update callers accordingly. No functional change is intended — this is a preparatory cleanup for to bring LT PHY PLL handling as part of PLL framework. v2: DP, HDMI 2.0, and HDMI FRL modes are port of the VDR configuration 0 register. These modes are defined by bits 2:0. Decode these to differentiate DP and HDMI modes when programming PLL's. (Imre, Suraj) v3: Pass port_clock as argument instead of recalculating it (Suraj) v4: Fix checkpatch warning of line length exceeding 100 columns BSpec: 744921 Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-5-mika.kahola@intel.com commit 0bd5b45c92c67ca43263d324d153de855e1fc6ba Author: Mika Kahola Date: Thu Mar 12 08:06:36 2026 +0000 drm/i915/lt_phy: Add PLL information for xe3plpd Start bringing in xe3plpd as part of dpll framework. The work is started by adding PLL information and related function hooks. v2: Fix xe3plpd type (Suraj) Remove empty line between BSpec link and Signed-off-by (Suraj) BSpec: 74304 Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-4-mika.kahola@intel.com commit 78ca669ca5f742eea84495f5f5e2e3c1aed82372 Author: Mika Kahola Date: Thu Mar 12 08:06:35 2026 +0000 drm/i915/lt_phy: Add check if PLL is enabled Add check for PLL enabling and return early if PLL is not enabled. v2: Use PCLK PLL ACK bit to check if PLL is enabled (Suraj) v3: Check only if PCLK PLL ACK bit for lane 0 is enabled (Suraj) Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-3-mika.kahola@intel.com commit 3df7e2feb8f5706eb6d00d043b9613d15c140d38 Author: Mika Kahola Date: Thu Mar 12 08:06:34 2026 +0000 drm/i915/lt_phy: Dump missing PLL state parameters Dump missing PLL structure members ssc_enabled and tbt_mode in order to enhance debugging. v2: Drop addr_lsb and addr_msb printouts Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312080657.2648265-2-mika.kahola@intel.com commit 64b00da69ef6e2cb113868c3ecdccd9bbc1fc91d Author: Zichar Zhang Date: Thu Mar 12 16:08:26 2026 +0800 arm64: dts: cix: add FCH(S0)/S5 GPIO controllers for sky1 Add Cadence GPIO controller nodes for Sky1 FCH(S0) and S5 domains in sky1.dtsi, and enable those controllers on sky1-orion-o6. Signed-off-by: Zichar Zhang Link: https://lore.kernel.org/r/20260312080826.3470205-2-zichar.zhang@cixtech.com Signed-off-by: Peter Chen commit 3403d7cfb3d3c09c79f83ff9e6e67159681bdac4 Author: Gary Yang Date: Fri Mar 13 19:49:14 2026 +0800 arm64: dts: cix: Add scmi powerdomain nodes for sky1 Add a second SCMI channel using SMC transport to communicate with TF-A for power domain management on the Sky1 SoC. Signed-off-by: Gary Yang Link: https://lore.kernel.org/r/20260313114914.1564115-3-gary.yang@cixtech.com Signed-off-by: Peter Chen commit 72e76b63d6ff6d1f96acccbfc6c118656f63e66a Author: Felix Gu Date: Tue Mar 24 00:41:28 2026 +0800 PCI: sky1: Fix missing cleanup of ECAM config on probe failure When devm_kzalloc() for reg_off fails, the code returns -ENOMEM without freeing pcie->cfg, which was allocated earlier by pci_ecam_create(). Add the missing pci_ecam_free() call to properly release the allocated ECAM configuration window on this error path. Fixes: a0d9f2c08f45 ("PCI: sky1: Add PCIe host support for CIX Sky1") Signed-off-by: Felix Gu Signed-off-by: Manivannan Sadhasivam Reviewed-by: Hans Zhang <18255117159@163.com> Link: https://patch.msgid.link/20260324-sky1-v1-1-6a00cb2776b6@gmail.com commit 94c62cf0698c0edbf1f118dd80ea19d0ff5d834e Author: Gary Yang Date: Fri Mar 13 19:49:13 2026 +0800 dt-bindings: PCI: cix,sky1-pcie-host: Add power-domains The Sky1 PCIe controller resides in a dedicated power domain managed via SCMI. Add the power-domains property to the binding to allow describing this dependency. Signed-off-by: Gary Yang Signed-off-by: Manivannan Sadhasivam Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260313114914.1564115-2-gary.yang@cixtech.com commit 44c00b0c1f89032e2c3027b5d7cd9dde402a1bec Author: Gary Yang Date: Mon Mar 2 14:44:07 2026 +0800 arm64: dts: cix: add support for cix sky1 resets There are two reset conctrollers on Cix Sky1 Soc. One is located in S0 domain, and the other is located in S5 domain. Signed-off-by: Gary Yang Link: https://lore.kernel.org/r/20260302064407.1914014-4-gary.yang@cixtech.com Signed-off-by: Peter Chen commit c68360c0d636dae71f766b7b296ddfcf2827ccc7 Author: Aurelien Jarno Date: Sun Mar 22 21:25:01 2026 +0100 riscv: dts: spacemit: drop incorrect pinctrl for combo PHY The combo PHY on the Banana Pi F3 is used for the USB 3.0 port. The high speed differential lanes are always configured as such, and do not require a pinctrl entry. The existing pinctrl entry only configures PCIe secondary pins, which are unused for USB and instead routed to the MIPI CSI1 connector. Remove this incorrect pinctrl entry. Fixes: 0be016a4b5d1b9 ("riscv: dts: spacemit: PCIe and PHY-related updates") Signed-off-by: Aurelien Jarno Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260322202502.2205755-1-aurelien@aurel32.net Signed-off-by: Yixun Lan commit 651c27d6a7e2b92eb30f56738dc45e861c975921 Author: Alexandre Courbot Date: Thu Mar 19 15:00:40 2026 +0900 gpu: nova-core: gsp: move Cmdq's DMA handle to a struct member The command-queue structure has a `dma_handle` method that returns the DMA handle to the memory segment shared with the GSP. This works, but is not ideal for the following reasons: - That method is effectively only ever called once, and is technically an accessor method since the handle doesn't change over time, - It feels a bit out-of-place with the other methods of `Cmdq` which only deal with the sending or receiving of messages, - The method has `pub(crate)` visibility, allowing other driver code to access this highly-sensitive handle. Address all these issues by turning `dma_handle` into a struct member with `pub(super)` visibility. This keeps the method space focused, and also ensures the member is not visible outside of the modules that need it. Reviewed-by: Eliot Courtney Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260319-b4-cmdq-dma-handle-v1-1-57840b4a4f90@nvidia.com Signed-off-by: Alexandre Courbot commit 54e97360b44bed6b4399dd3be3d65f392df940fa Author: Shuwei Wu Date: Thu Mar 5 20:46:08 2026 +0800 clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc() Fix inverted condition that skips frequency change trigger, causing kernel panics during cpufreq scaling. Fixes: 1b72c59db0ad ("clk: spacemit: Add clock support for SpacemiT K1 SoC") Signed-off-by: Shuwei Wu Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260305-k1-clk-fix-v1-1-abca85d6e266@mailbox.org Signed-off-by: Yixun Lan commit eac600d5cc42b04e799fb65169b8f4060773381b Author: Chukun Pan Date: Wed Mar 18 18:00:00 2026 +0800 riscv: dts: spacemit: reorder phy nodes for K1 Reorder the PHY nodes of USB and PCIe to the correct positions based on the register address. This improves the readability and maintainability of the DT. No functional change is introduced by this reordering. Signed-off-by: Chukun Pan Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260318100000.3934516-1-amadeus@jmu.edu.cn Signed-off-by: Yixun Lan commit f3014d7f65dba9e911ca8216be1f14e909816f16 Author: Raag Jadav Date: Thu Mar 5 18:36:49 2026 +0530 drm/xe: Send 'none' recovery method for XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET is intended for debugging hangs, so wedge the device with 'none' recovery method and have it available to the user for debugging. Signed-off-by: Raag Jadav Reviewed-by: Rodrigo Vivi Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260305130720.3685754-4-raag.jadav@intel.com commit 9810e23b7a2cb4840083bc6a630c3fbdfd1675ae Author: Raag Jadav Date: Thu Mar 5 18:36:48 2026 +0530 drm: Update log for 'none' recovery method Update log for 'none' recovery method for wedged event where driver wants to hint "no recovery" without resetting the device from driver context. Signed-off-by: Raag Jadav Reviewed-by: Rodrigo Vivi Reviewed-by: Christian König Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260305130720.3685754-3-raag.jadav@intel.com commit 67a50ae0edd92bca49bca94820cf3011237f6e59 Author: Raag Jadav Date: Thu Mar 5 18:36:47 2026 +0530 drm/doc: Update documentation for 'none' recovery method Expand 'none' recovery method for wedged event to include debug cases where driver wants to hint "no recovery" without resetting the device from driver context. Signed-off-by: Raag Jadav Reviewed-by: Rodrigo Vivi Reviewed-by: Christian König Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260305130720.3685754-2-raag.jadav@intel.com commit b4d4a4f6e2ca171c5f1ef6b9e387943542eded09 Author: Abel Vesa Date: Wed Mar 11 10:43:02 2026 +0200 dt-bindings: firmware: qcom,scm: document Eliza SCM Firmware Interface Document the SCM Firmware Interface on the Eliza SoC. Signed-off-by: Abel Vesa Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260311-eliza-bindings-scm-v2-1-b2d2e69068e3@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b0bc6011c5499bdfddd0390262bfa13dce1eff74 Author: Konrad Dybcio Date: Tue Jan 20 12:19:26 2026 +0100 clk: qcom: dispcc-sc7180: Add missing MDSS resets The MDSS resets have so far been left undescribed. Fix that. Fixes: dd3d06622138 ("clk: qcom: Add display clock controller driver for SC7180") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Taniya Das Tested-by: Val Packett # sc7180-ecs-liva-qc710 Link: https://lore.kernel.org/r/20260120-topic-7180_dispcc_bcr-v1-2-0b1b442156c3@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2064d217689fd047dae230b6d9dba7c32124a67f Merge: 0f5c8f03d990f9 fc6e29d4287268 Author: Bjorn Andersson Date: Mon Mar 23 22:16:44 2026 -0500 Merge branch '20260120-topic-7180_dispcc_bcr-v1-1-0b1b442156c3@oss.qualcomm.com' into clk-for-7.1 Merge the addition of reset constants to the SC7180 display clock controller through a topic branch, in order to make them available to the DeviceTree branch as well. commit fc6e29d42872680dca017f2e5169eefe971f8d89 Author: Konrad Dybcio Date: Tue Jan 20 12:19:25 2026 +0100 dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets The MDSS resets have so far been left undescribed. Fix that. Fixes: 75616da71291 ("dt-bindings: clock: Introduce QCOM sc7180 display clock bindings") Signed-off-by: Konrad Dybcio Reviewed-by: Taniya Das Acked-by: Krzysztof Kozlowski Tested-by: Val Packett # sc7180-ecs-liva-qc710 Link: https://lore.kernel.org/r/20260120-topic-7180_dispcc_bcr-v1-1-0b1b442156c3@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9d463f7863f2cc3722da9c670c88158409cb7c42 Author: Aleksei Oladko Date: Sat Mar 21 21:59:08 2026 +0000 selftests: net: io_uring_zerocopy: enable io_uring for the test The io_uring_zerocopy.sh kselftest assumes that io_uring support is enabled on the host system. When io_uring is disabled via the kernel.io_uring_disabled sysctl, the test fails. Explicitly enable io_uring for the test by setting kernel.io_uring_disabled=0. Save the original value of kernel.io_uring_disabled before changing it and restore it in cleanup handler to ensure the system state is restored regardless of test outcome. Signed-off-by: Aleksei Oladko Signed-off-by: Konstantin Khorenko Link: https://patch.msgid.link/20260321215908.175465-5-aleksey.oladko@virtuozzo.com Signed-off-by: Jakub Kicinski commit a897e194c475d5e0d141e27df600dd43962308f1 Author: Aleksei Oladko Date: Sat Mar 21 21:59:05 2026 +0000 selftests: net: run reuseport in an isolated netns The reuseport_* tests (bpf, bpf_cpu, bpf_numa, dualstack) currently use a fixed port range. This can cause intermittent test failures when the ports are already in use by other services: failed to bind receive socket: Address already in use To avoid conflicts, run these tests in separate network namespaces using unshare. Each test now has its own isolated network stack, preventing port collisions with the host services. Signed-off-by: Aleksei Oladko Link: https://patch.msgid.link/20260321215908.175465-2-aleksey.oladko@virtuozzo.com Signed-off-by: Jakub Kicinski commit fdeb077b8ae53a6ef772c5b3c4d1f3a408dac2a0 Author: Neil Armstrong Date: Thu Mar 19 09:55:07 2026 +0100 arm64: defconfig: enable pci-pwrctrl-generic as module Enable the generic power control driver module since it's required to power up the PCIe USB3 controller found on the Ayaneo Pocket S2 gaming console. Acked-by: Manivannan Sadhasivam Reviewed-by: Bartosz Golaszewski Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20260319-topic-sm8650-ayaneo-pocket-s2-base-v6-1-797bf96df771@linaro.org Signed-off-by: Bjorn Andersson commit ef94e96eaedc63c75d462d0e4dcbea0f6fbd6c74 Merge: e81cf512c1bdee 381a503f0eb3a6 Author: Jakub Kicinski Date: Mon Mar 23 19:39:07 2026 -0700 Merge branch 'selftests-rds-add-config-file-and-config-sh-c-option' Allison Henderson says: ==================== selftests: rds: add config file and config.sh -c option This series adds an RDS-specific config file for ksft CI and extends config.sh with a -c flag to specify an alternate config file path. Users can now specify the path of the config they want to update, or default to .config if none is specified. ==================== Link: https://patch.msgid.link/20260320041834.2761069-1-achender@kernel.org Signed-off-by: Jakub Kicinski commit 381a503f0eb3a69e9a250330e2f09a5ae1688d2c Author: Allison Henderson Date: Thu Mar 19 21:18:34 2026 -0700 selftests: rds: Add -c config option to rds/config.sh This patch adds a new -c flag to config.sh that enables callers to specify the file path of the config they would like to update. If no config is specified, the default will be the .config of the current directory. Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260320041834.2761069-3-achender@kernel.org Signed-off-by: Jakub Kicinski commit 0f5d68004780effdacf14b7346f235e212cf8ba6 Author: Allison Henderson Date: Thu Mar 19 21:18:33 2026 -0700 selftests: rds: add tools/testing/selftests/net/rds/config The ksft CI runtime needs an rds specific config file to build a minimal kernel with the right options enabled. This patch adds an rds selftest config containing the required CONFIG_RDS* and CONFIG_NET_* options. Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260320041834.2761069-2-achender@kernel.org Signed-off-by: Jakub Kicinski commit e81cf512c1bdee07fce4a39854dde78cc2cd7b43 Author: Jiayuan Chen Date: Fri Mar 20 10:22:39 2026 +0800 selftests: bonding: add test for stacked bond header_parse recursion Add a selftest to reproduce the infinite recursion in bond_header_parse() when bonds are stacked (bond1 -> bond0 -> gre). When a packet is received via AF_PACKET SOCK_DGRAM on the topmost bond, dev_parse_header() calls bond_header_parse() which used skb->dev (always the topmost bond) to get the bonding struct. This caused it to recurse back into itself indefinitely, leading to stack overflow. Before commit b7405dcf7385 ("bonding: prevent potential infinite loop in bond_header_parse()"), the test triggers: ./bond_stacked_header_parse.sh [ 71.999481] BUG: MAX_LOCK_DEPTH too low! [ 72.000170] turning off the locking correctness validator. [ 72.001029] Please attach the output of /proc/lock_stat to the bug report [ 72.002079] depth: 48 max: 48! ... After the fix, everything works fine: ./bond_stacked_header_parse.sh TEST: Stacked bond header_parse does not recurse [ OK ] Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260320022245.392384-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 91b59009c7d48b58dbc50fecb27f2ad20749a05a Author: Dmitry Baryshkov Date: Mon Mar 23 03:20:59 2026 +0200 soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available If OCMEM is declared in DT, it is expected that it is present and handled by the driver. The GPU driver will ignore -ENODEV error, which typically means that OCMEM isn't defined in DT. Let ocmem return -EPROBE_DEFER if it supposed to be used, but it is not probed (yet). Fixes: 88c1e9404f1d ("soc: qcom: add OCMEM driver") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260323-ocmem-v1-3-ad9bcae44763@oss.qualcomm.com [bjorn: s/ERR_PTR(dev_err_probe)/dev_err_ptr_probe/ Signed-off-by: Bjorn Andersson commit 9dfd69cd89cd6afa4723be9098979abeef3bb8c6 Author: Dmitry Baryshkov Date: Mon Mar 23 03:20:58 2026 +0200 soc: qcom: ocmem: register reasons for probe deferrals Instead of printing messages to the dmesg, let the message be recorded as a reason for the OCMEM client deferral. Fixes: 88c1e9404f1d ("soc: qcom: add OCMEM driver") Signed-off-by: Dmitry Baryshkov Reviewed-by: Brian Masney Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260323-ocmem-v1-2-ad9bcae44763@oss.qualcomm.com [bjorn: s/ERR_PTR(dev_err_probe)/dev_err_ptr_probe/ Signed-off-by: Bjorn Andersson commit e8a61c51417c679d1a599fb36695e9d3b8d95514 Author: Dmitry Baryshkov Date: Mon Mar 23 03:20:57 2026 +0200 soc: qcom: ocmem: make the core clock optional OCMEM's core clock (aka RPM bus 2 clock) is being handled internally by the interconnect driver. Corresponding clock has been dropped from the SMD RPM clock driver. The users of the ocmem will vote on the ocmemnoc interconnect paths, making sure that ocmem is on. Make the clock optional, keeping it for compatibility with older DT. Fixes: d6edc31f3a68 ("clk: qcom: smd-rpm: Separate out interconnect bus clocks") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260323-ocmem-v1-1-ad9bcae44763@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0f5c8f03d990f9be9908a08a701c324e113554d2 Author: Pengyu Luo Date: Sat Mar 21 17:50:28 2026 +0800 clk: qcom: rcg2: expand frac table for mdss_pixel_clk_src Recently, when testing 10-bit dsi C-PHY panel, clks are different from the usual. (dsi0_phy_pll_out_dsiclk's parent is dsi0_pll_bit_clk now (dsiclk_sel = 0)) And we failed to set dsiclk's children. dsi_link_clk_set_rate_6g: Set clk rates: pclk=172992000, byteclk=108120000 byteclk was set first to 108120000, so the vco rate was set to 108120000 * 7 * 1 * 1 = 756840000. When we was trying to set 172992000 on mdss_pixel_clk_src later. Since there was no matched ratio, we failed to set it. And dsiclk divider ratio was set to 15:1 (wrong cached register value 0xf and didn't update), we finally got 50455997, apparently wrong. dsi0vco_clk 1 1 0 756839941 dsi0_pll_out_div_clk 1 1 0 756839941 dsi0_pll_post_out_div_clk 0 0 0 216239983 dsi0_pll_bit_clk 2 2 0 756839941 dsi0_phy_pll_out_dsiclk 2 2 0 50455997 disp_cc_mdss_pclk1_clk_src 1 1 0 50455997 dsi0_pll_by_2_bit_clk 0 0 0 378419970 dsi0_phy_pll_out_byteclk 2 2 0 108119991 disp_cc_mdss_byte1_clk_src 2 2 0 108119991 Downstream clk_summary shows the mdss_pixel_clk_src support the ratio(35:16) dsi0_phy_pll_out_dsiclk 2 2 0 378420000 disp_cc_mdss_pclk1_clk_src 1 1 0 172992000 dsi0_phy_pll_out_byteclk 2 2 0 108120000 disp_cc_mdss_byte1_clk_src 2 2 0 108120000 After checking downstream source, 15:4 also seems to be supported, add them two. Signed-off-by: Pengyu Luo Reviewed-by: Taniya Das Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260321095029.2259489-1-mitltlatltl@gmail.com Signed-off-by: Bjorn Andersson commit db3bd9e55c3c7b159dbd90772ee39441a3133d16 Author: Daniel Golle Date: Sat Mar 21 04:26:11 2026 +0000 selftests: forwarding: local_termination: fix PTP UDP cksums All six PTP-over-IP test frames (3x IPv4 + 3x IPv6) contain incorrect UDP checksums. The stored values are the ones-complement sums of just the pseudo-headers, not the complete UDP checksums over pseudo-header + UDP header + payload. This is characteristic of frames captured on the sender before TX checksum offload completion. For example, the IPv4 Sync and Follow-Up frames both store checksum 0xa3c8 despite having different UDP payloads and port numbers - 0xa3c8 is their shared pseudo-header sum (same src/dst IP, same protocol and UDP length). While most L2 switches forward frames without verifying transport checksums, hardware that performs deep packet inspection or has PTP awareness may validate UDP checksums and drop frames that fail verification. This causes the 1588v2 over IPv4/IPv6 tests to fail on such hardware even though L2 PTP (which has no UDP checksum) passes fine. Replace all six pseudo-header partial sums with the correctly computed full UDP checksums: IPv4 Sync: 0xa3c8 -> 0x9f41 IPv4 Follow-Up: 0xa3c8 -> 0xeb8a IPv4 Peer Delay Req: 0xa2bc -> 0x9ab9 IPv6 Sync: 0x2e92 -> 0x1476 IPv6 Follow-Up: 0x2e92 -> 0xf047 IPv6 Peer Delay Req: 0xb454 -> 0x891f Signed-off-by: Daniel Golle Reviewed-by: Alexander Sverdlin Link: https://patch.msgid.link/651c3decb80023e4395ec149fd81110afa3869a1.1774067006.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 1a8dd88469bf742fd5eda91cd8e0f720a983ec5a Merge: 9027497a25e3c9 10329ce49285e8 Author: Jakub Kicinski Date: Mon Mar 23 17:59:58 2026 -0700 Merge branch 'ethtool-dynamic-rss-context-indirection-table-resizing' Björn Töpel says: ==================== ethtool: Dynamic RSS context indirection table resizing Some NICs (e.g. bnxt) change their RSS indirection table size based on the queue count, because the hardware table is a shared resource. The ethtool core locks ctx->indir_size at context creation, so drivers have to reject channel changes when RSS contexts exist. This series adds resize helpers and wires them up in bnxt. It also adds tracking of the user provided indirection table size to the ethtool core. Patch 1 tracks the user-provided indirection table size (user_size) in ctx->indir_user_size for non-default RSS contexts and in dev->ethtool->rss_indir_user_size for context 0. It is set when the indirection table is configured via netlink or ioctl, and cleared to zero on reset-to-default. IFF_RXFH_CONFIGURED is removed, and replaced with rss_indir_user_size. The flag is redundant now that user_size captures the same information. Patch 2 adds core resize helpers: ethtool_rxfh_indir_can_resize() - read-only validation for context 0 ethtool_rxfh_indir_resize() - fold/unfold context 0 table in place ethtool_rxfh_ctxs_can_resize() - validate all non-default contexts ethtool_rxfh_ctxs_resize() - resize all non-default contexts, with locking and RSS_NTF notifications Patch 3 uses the resize helpers in bnxt_set_channels(). Patch 4 adds HW tests in rss_drv.py (devices without dynamic table sizing are skipped): resize_periodic - fold/unfold with a non-default [3,2,1,0] sub-table (user_size=4), verifying exact content preservation (main + ctx) resize_below_user_size_reject - periodic sub-table with user_size between big and small device table sizes; verifies that shrinking below user_size is rejected even when the table is periodic (main + ctx) resize_nonperiodic_reject - non-periodic table blocks channel reduction, with an extra periodic context to exercise multi-context validation (main + ctx) resize_nonperiodic_no_corruption - failed resize leaves table contents and channel count unchanged (main + ctx) Running the tests: # On real hardware sudo NETIF=eth0 ./rss_drv.py ==================== Link: https://patch.msgid.link/20260320085826.1957255-1-bjorn@kernel.org Signed-off-by: Jakub Kicinski commit 10329ce49285e8548da25bdb1cdba3badccfb00c Author: Björn Töpel Date: Fri Mar 20 09:58:24 2026 +0100 selftests: rss_drv: Add RSS indirection table resize tests Add resize tests to rss_drv.py. Devices without dynamic table sizing are skipped via _require_dynamic_indir_size(). resize_periodic: set a periodic 4-entry table, shrink channels to fold, grow back to unfold. Check the exact pattern is preserved. Has main and non-default context variants. resize_below_user_size_reject: send a periodic table with user_size between the big and small device table sizes. Verify that shrinking below user_size is rejected even though the table is periodic. Has main and non-default context variants. resize_nonperiodic_reject: set a non-periodic table (equal N), verify that channel reduction is rejected. resize_nonperiodic_no_corruption: verify a failed resize leaves both the indirection table contents and the channel count unchanged. Signed-off-by: Björn Töpel Link: https://patch.msgid.link/20260320085826.1957255-5-bjorn@kernel.org Signed-off-by: Jakub Kicinski commit 57cdfe0dc70ba7cf234707e9e2c63613b9ce1e75 Author: Björn Töpel Date: Fri Mar 20 09:58:23 2026 +0100 bnxt_en: Resize RSS contexts on channel count change bnxt_set_channels() previously rejected channel changes that alter the RSS table size when RSS contexts exist, because non-default context sizes were locked at creation. Replace the rejection with the new resize helpers. RSS table size only changes on P5 chips with older firmware; newer firmware always uses the largest table size. Signed-off-by: Björn Töpel Link: https://patch.msgid.link/20260320085826.1957255-4-bjorn@kernel.org Signed-off-by: Jakub Kicinski commit 02bcb20083b2780772cfb66cd426f31940296783 Author: Björn Töpel Date: Fri Mar 20 09:58:22 2026 +0100 ethtool: Add RSS indirection table resize helpers The core locks ctx->indir_size when an RSS context is created. Some NICs (e.g. bnxt) change their indirection table size based on the channel count, because the hardware table is a shared resource. This forces drivers to reject channel changes when RSS contexts exist. Add driver helpers to resize indirection tables: ethtool_rxfh_indir_can_resize() checks whether the default context indirection table can be resized. ethtool_rxfh_indir_resize() resizes the default context table in place. Folding (shrink) requires the table to be periodic at the new size; non-periodic tables are rejected. Unfolding (grow) replicates the existing pattern. Sizes must be multiples of each other. ethtool_rxfh_ctxs_can_resize() validates all non-default RSS contexts can be resized. ethtool_rxfh_ctxs_resize() applies the resize. Signed-off-by: Björn Töpel Link: https://patch.msgid.link/20260320085826.1957255-3-bjorn@kernel.org Signed-off-by: Jakub Kicinski commit 0475f9e779b456f934adbc44eeb98e3080a1893f Author: Björn Töpel Date: Fri Mar 20 09:58:21 2026 +0100 ethtool: Track user-provided RSS indirection table size Track the number of indirection table entries the user originally provided (context 0/default as well!). Replace IFF_RXFH_CONFIGURED with rss_indir_user_size: the flag is redundant now that user_size captures the same information. Add ethtool_rxfh_indir_lost() for drivers that must reset the indirection table. Convert bnxt and mlx5 to use it. Signed-off-by: Björn Töpel Link: https://patch.msgid.link/20260320085826.1957255-2-bjorn@kernel.org Signed-off-by: Jakub Kicinski commit 9027497a25e3c92b5053b2643e0c18f910865625 Author: Qingfang Deng Date: Fri Mar 20 15:56:04 2026 +0800 team: use netdev_from_priv() Use the new netdev_from_priv() helper to access the net device from struct team. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260320075605.490832-2-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit eb37011395f12138056a4d124159f1a8436662d3 Author: Qingfang Deng Date: Fri Mar 20 15:56:03 2026 +0800 net: add netdev_from_priv() helper Add a helper to get netdev from private data pointer, so drivers won't have to store redundant netdev in priv. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260320075605.490832-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit 7ac21b4032e5b9b8a6a312b6f1d54f4ba24d1c16 Author: Eric Biggers Date: Sat Mar 21 20:24:38 2026 -0700 lib: Move crypto library tests to Runtime Testing menu Currently the kconfig options for the crypto library KUnit tests appear in the menu: -> Library routines -> Crypto library routines However, this is the only content of "Crypto library routines". I.e., it is empty when CONFIG_KUNIT=n. This is because the crypto library routines themselves don't have (or need to have) prompts. Since this usually ends up as an unnecessary empty menu, let's remove this menu and instead source the lib/crypto/tests/Kconfig file from lib/Kconfig.debug inside the "Runtime Testing" menu: -> Kernel hacking -> Kernel Testing and Coverage -> Runtime Testing This puts the prompts alongside the ones for most of the other lib/ KUnit tests. This seems to be a much better match to how the kconfig menus are organized. Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20260322032438.286296-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit e37f28529b380265904af64996d34c647d917ef1 Author: Eric Biggers Date: Fri Mar 20 21:09:35 2026 -0700 crypto: sm3 - Remove 'struct sm3_state' Update one driver that used sizeof(struct sm3_state) to use sizeof(struct sm3_ctx) instead. Then, remove struct sm3_state and SM3_STATE_SIZE. This completes the replacement of struct sm3_state with struct sm3_ctx. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-13-ebiggers@kernel.org Signed-off-by: Eric Biggers commit ef01e1eafb20f74e6d951a42a870a40cd8b914ca Author: Eric Biggers Date: Fri Mar 20 21:09:34 2026 -0700 crypto: sm3 - Remove the original "sm3_block_generic()" Since the architecture-optimized SM3 code was migrated into lib/crypto/, sm3_block_generic() is no longer called. Remove it. Then, since this frees up the name, rename sm3_transform() to sm3_block_generic() (matching the naming convention used in other hash algorithms). Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-12-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 9d7f2a6ed598e82b07582d4f5122f66111ef5c00 Author: Eric Biggers Date: Fri Mar 20 21:09:33 2026 -0700 crypto: sm3 - Remove sm3_base.h Remove include/crypto/sm3_base.h, since it's no longer used. The corresponding logic was reimplemented in a central place in lib/crypto/. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-11-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 17ba6108d3e084652807826cc49c851c00976f1a Author: Eric Biggers Date: Fri Mar 20 21:09:32 2026 -0700 lib/crypto: x86/sm3: Migrate optimized code into library Instead of exposing the x86-optimized SM3 code via an x86-specific crypto_shash algorithm, instead just implement the sm3_blocks() library function. This is much simpler, it makes the SM3 library functions be x86-optimized, and it fixes the longstanding issue where the x86-optimized SM3 code was disabled by default. SM3 still remains available through crypto_shash, but individual architectures no longer need to handle it. Tweak the prototype of sm3_transform_avx() to match what the library expects, including changing the block count to size_t. Note that the assembly code actually already treated this argument as size_t. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 5f6bbba5e9bb7f271557513d0ed77bb7b5a92698 Author: Eric Biggers Date: Fri Mar 20 21:09:31 2026 -0700 lib/crypto: riscv/sm3: Migrate optimized code into library Instead of exposing the riscv-optimized SM3 code via a riscv-specific crypto_shash algorithm, instead just implement the sm3_blocks() library function. This is much simpler, it makes the SM3 library functions be riscv-optimized, and it fixes the longstanding issue where the riscv-optimized SM3 code was disabled by default. SM3 still remains available through crypto_shash, but individual architectures no longer need to handle it. Tweak the prototype of sm3_transform_zvksh_zvkb() to match what the library expects, including changing the block count to size_t. Note that the assembly code already treated it as size_t. Note: to see the diff from arch/riscv/crypto/sm3-riscv64-glue.c to lib/crypto/riscv/sm3.h, view this commit with 'git show -M10'. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 9f69f52b462cdaed83b782d0408ce9286f054f92 Author: Eric Biggers Date: Fri Mar 20 21:09:30 2026 -0700 lib/crypto: arm64/sm3: Migrate optimized code into library Instead of exposing the arm64-optimized SM3 code via arm64-specific crypto_shash algorithms, instead just implement the sm3_blocks() library function. This is much simpler, it makes the SM3 library functions be arm64-optimized, and it fixes the longstanding issue where the arm64-optimized SM3 code was disabled by default. SM3 still remains available through crypto_shash, but individual architectures no longer need to handle it. Tweak the SM3 assembly function prototypes to match what the library expects, including changing the block count from 'int' to 'size_t'. sm3_ce_transform() had to be updated to access 'x2' instead of 'w2', while sm3_neon_transform() already used 'x2'. Remove the CFI stubs which are no longer needed because the SM3 assembly functions are no longer ever indirectly called. Remove the dependency on KERNEL_MODE_NEON. It was unnecessary, because KERNEL_MODE_NEON is always enabled on arm64. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit ed065bd06ebe8d92d1647d230a14b9c035ad5b30 Author: Eric Biggers Date: Fri Mar 20 21:09:29 2026 -0700 crypto: sm3 - Replace with wrapper around library Reimplement the "sm3" crypto_shash on top of the SM3 library, closely mirroring the other hash algorithms (e.g. SHA-*). The result, after later commits migrate the architecture-optimized SM3 code into the library as well, is that crypto/sm3.c will be the single point of integration between crypto_shash and the actual SM3 implementations, simplifying the code. Note: to see the diff from crypto/sm3_generic.c to crypto/sm3.c, view this commit with 'git show -M10'. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit d6781b8ba33ae9f6ab2e88c1158e989a24847c4b Author: Eric Biggers Date: Fri Mar 20 21:09:28 2026 -0700 lib/crypto: tests: Add KUnit tests for SM3 Add a KUnit test suite for the SM3 library. It closely mirrors the test suites for the other cryptographic hash functions. The actual test and benchmark logic is already in hash-test-template.h; this just wires it up for SM3 in the usual way. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 324bb3bb75ac21adbbc7e6ea5cdb0a735fb78a56 Author: Eric Biggers Date: Fri Mar 20 21:09:27 2026 -0700 lib/crypto: sm3: Add SM3 library API Add a straightforward library API for SM3, mirroring the ones for the other hash algorithms. It uses the existing generic implementation of SM3's compression function in lib/crypto/sm3.c. Hooks are added for architecture-optimized implementations, which later commits will wire up to the existing optimized SM3 code for arm64, riscv, and x86. Note that the rationale for this is *not* that SM3 should be used, or that any kernel subsystem currently seems like a candidate for switching from the sm3 crypto_shash to SM3 library. (SM3, in fact, shouldn't be used. Likewise you shouldn't use MD5, SHA-1, RC4, etc...) Rather, it's just that this will simplify how the kernel's existing SM3 code is integrated and make it much easier to maintain and test. SM3 is one of the only hash algorithms with arch-optimized code that is still integrated in the old way. By converting it to the new lib/crypto/ code organization, we'll only have to keep track of one way of doing things. The library will also get a KUnit test suite (as usual for lib/crypto/), so it will become more easily and comprehensively tested as well. Skip adding functions for HMAC-SM3 for now, though. There's not as much point in adding those right now. Note: similar to the other hash algorithms, the library API uses 'struct sm3_ctx', not 'struct sm3_state'. The existing 'struct sm3_state' and the sm3_block_generic() function which uses it are temporarily kept around until their users are updated by later commits. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6dc7fce91041ec8d2f5e6fd589ee2962898d9f44 Author: Eric Biggers Date: Fri Mar 20 21:09:26 2026 -0700 crypto: sm3 - Rename CRYPTO_SM3_GENERIC to CRYPTO_SM3 The kconfig options for generic crypto API modules have traditionally *not* had a "_GENERIC" suffix. Also, the "_GENERIC" suffix will make even less sense once the architecture-optimized SM3 code is moved into lib/crypto/ and the "sm3" crypto_shash is reimplemented on top of that. Thus, rename CRYPTO_SM3_GENERIC to CRYPTO_SM3. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 77e4ca814c2824d7aa0c4170678bfbc6e3caa556 Author: Eric Biggers Date: Fri Mar 20 21:09:25 2026 -0700 crypto: sm3 - Remove sm3_zero_message_hash and SM3_T[1-2] Remove these, since they are unused. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2a6b2dda5c324041e9e7db29a4eb8358c7ac8f9c Author: Eric Biggers Date: Fri Mar 20 21:09:24 2026 -0700 crypto: sm3 - Fold sm3_init() into its caller Fold sm3_init() into its caller to free up the name for use in a library API mirroring the other hash function APIs. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 0e10381626546e3c77a11c7972d1264301abd733 Author: Andy Shevchenko Date: Fri Mar 20 22:52:29 2026 +0100 nfc: microread: Drop unused include This driver includes the legacy header but does not use any symbols from it. Drop the inclusion. Signed-off-by: Andy Shevchenko Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260320215230.3236005-1-andriy.shevchenko@linux.intel.com Signed-off-by: Jakub Kicinski commit 4e9b1994a105fefe558b245f2076a70cc6b498a9 Author: Johan Hovold Date: Thu Mar 5 11:43:13 2026 +0100 ieee802154: atusb: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Reviewed-by: Miquel Raynal Acked-by: Stefan Schmidt Link: https://patch.msgid.link/20260305104313.15898-1-johan@kernel.org Signed-off-by: Jakub Kicinski commit ad6b67ffd2e8d53e5c306ce74b6f0d23b430df8a Merge: fb78a629b4f0eb 365c62c8b5307a Author: Jakub Kicinski Date: Mon Mar 23 17:32:21 2026 -0700 Merge branch 'net-stmmac-improve-pcs-support' Russell King says: ==================== net: stmmac: improve PCS support This series is the next of the three part series sorting out the PCS support in stmmac, building on part 2: net: stmmac: qcom-ethqos: further serdes reorganisation Similar patches have been posted previously. This series does away with the common SerDes PHY support, instead using a flag to indicate whether 2500Mbps mode is supported (STMMAC_FLAG_SERDES_SUPPORTS_2500M.) At this time, I have no plans to resurect the common SerDes PHY support - the generic PHY layer implementations are just too random to consider that, and I certainly do not want the extra work of fixing that. The reasoning here is that these patches should be safe to merge and should not impact qcom-ethqos in any way. We can then figure out how to work around qcom-ethqos hacks without having to keep re-posting these same patches time and time again. ==================== Link: https://patch.msgid.link/abrNYVfZ1Iwff2EI@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 365c62c8b5307ae9f9f976e07bd6b606c54cfabc Author: Russell King (Oracle) Date: Wed Mar 18 16:06:31 2026 +0000 net: stmmac: use integrated PCS for BASE-X modes dwmac-qcom-ethqos supports SGMII and 2500BASE-X using the integrated PCS, so we need to expand the PCS support to include support for BASE-X modes. Add support to the prereset configuration to detect 2500BASE-X, and arrange for stmmac_mac_select_pcs() to return the integrated PCS if its supported_interfaces bitmap reports support for the interface mode. This results in priv->hw->pcs now being write-only, so remove it. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w2tPj-0000000DYAv-2JcZ@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 68cff4fff61fb69ef7bb1f6302d4766822a395cc Author: Russell King (Oracle) Date: Wed Mar 18 16:06:26 2026 +0000 net: stmmac: add BASE-X support to integrated PCS The integrated PCS supports 802.3z (BASE-X) modes when the Synopsys IP is coupled with an appropriate SerDes to provide the electrical interface. The PCS presents a TBI interface to the SerDes for this. Thus, the BASE-X related registers are only present when TBI mode is supported. dwmac-qcom-ethqos added support for using 2.5G with the integrated PCS by calling dwmac_ctrl_ane() directly. Add support for the following to the integrated PCS: - 1000BASE-X protocol unconditionally. - 2500BASE-X if the coupled SerDes supports 2.5G speed. - The above without autonegotiation. - If the PCS supports TBI, then optional BASE-X autonegotiation for each of the above. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w2tPe-0000000DYAp-1qpV@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0837578667358bbeeb0aa2fcc98935f4536696c5 Author: Russell King (Oracle) Date: Wed Mar 18 16:06:21 2026 +0000 net: stmmac: add support for reading inband SGMII status Report the link, speed and duplex for SGMII links, read from the SGMII, RGMII and SMII status and control register. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w2tPZ-0000000DYAj-1MdI@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7d5a2da501e0527f467216a248e28077c7b81153 Author: Russell King (Oracle) Date: Wed Mar 18 16:06:16 2026 +0000 net: stmmac: add struct stmmac_pcs_info We need to describe one more register (offset and field bitmask) to the PCS code. Move the existing PCS offset and interrupt enable bits to a new struct and pass that in to stmmac_integrated_pcs_init(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w2tPU-0000000DYAd-0ssk@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9a475dc71c38d6abc42ba722ace4a72372876d91 Author: Russell King (Oracle) Date: Wed Mar 18 16:06:11 2026 +0000 net: stmmac: move default_an_inband to plat_stmmacenet_data Move the default_an_inband flag from struct mdio_bus_data to struct plat_stmmacenet_data. This is to allow platforms that do not use the integrated MDIO bus to enable inband mode. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w2tPP-0000000DYAX-0TKw@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6b0c7c28f7d1f5bd327981a8b733ca3938fae872 Author: Donglin Peng Date: Mon Feb 9 15:19:49 2026 +0800 tracing: Pretty-print enum parameters in function arguments Currently, print_function_args() prints enum parameter values in decimal format, reducing trace log readability. Use BTF information to resolve enum parameters and print their symbolic names (where available). This improves readability by showing meaningful identifiers instead of raw numbers. Before: mod_memcg_lruvec_state(lruvec=0xffff..., idx=5, val=320) After: mod_memcg_lruvec_state(lruvec=0xffff..., idx=5 [NR_SLAB_RECLAIMABLE_B], val=320) Cc: Steven Rostedt Cc: Masami Hiramatsu Link: https://patch.msgid.link/20260209071949.4040193-1-dolinux.peng@gmail.com Signed-off-by: Donglin Peng Signed-off-by: Steven Rostedt (Google) commit f520a492e07bc6718e26cfb7543ab4cadd8bb0e2 Author: Geert Uytterhoeven Date: Thu Mar 5 11:11:16 2026 +0100 clk: xgene: Fix mapping leak in xgene_pllclk_init() If xgene_register_clk_pll() fails, the mapped register block is never unmapped. Fixes: 308964caeebc45eb ("clk: Add APM X-Gene SoC clock driver") Signed-off-by: Geert Uytterhoeven Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit b2369725b7eb43f70047418ac42e0e993412a4fd Author: Geert Uytterhoeven Date: Thu Mar 5 11:12:33 2026 +0100 clk: Simplify clk_is_match() Linux style is to handle early-on failure. Inverting the first condition lets us simplify the second, and improves readability. Signed-off-by: Geert Uytterhoeven Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 5d6c477687aeb158df9ec95580270146778f6af1 Author: Andy Shevchenko Date: Tue Feb 24 12:17:18 2026 +0100 clk: baikal-t1: Remove not-going-to-be-supported code for Baikal SoC As noticed in the discussion [1] the Baikal SoC and platforms are not going to be finalized, hence remove stale code. Reviewed-by: Brian Masney Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1] Signed-off-by: Andy Shevchenko Acked-by: Rob Herring (Arm) Reviewed-by: Randy Dunlap Signed-off-by: Stephen Boyd commit 4d0f627aa3ab47bd39b1f7e0116ef8f95e67574a Author: Ben Dooks Date: Tue Mar 10 12:36:25 2026 +0000 clk: mvebu: armada-37xx-periph: fix __iomem casts in structure init There are a number of casts to "void __iomem *" in the initialsation of the driver's clk information. Fix this by adding a helper macro for the cast. Silences a number of sparse warnings: drivers/clk/mvebu/armada-37xx-periph.c:254:1: warning: incorrect type in initializer (different address spaces) drivers/clk/mvebu/armada-37xx-periph.c:254:1: expected void [noderef] __iomem *reg drivers/clk/mvebu/armada-37xx-periph.c:254:1: got void * drivers/clk/mvebu/armada-37xx-periph.c:254:1: warning: incorrect type in initializer (different address spaces) drivers/clk/mvebu/armada-37xx-periph.c:254:1: expected void [noderef] __iomem *reg1 drivers/clk/mvebu/armada-37xx-periph.c:254:1: got void * drivers/clk/mvebu/armada-37xx-periph.c:254:1: warning: incorrect type in initializer (different address spaces) drivers/clk/mvebu/armada-37xx-periph.c:254:1: expected void [noderef] __iomem *reg2 drivers/clk/mvebu/armada-37xx-periph.c:254:1: got void * drivers/clk/mvebu/armada-37xx-periph.c:255:1: warning: incorrect type in initializer (different address spaces) drivers/clk/mvebu/armada-37xx-periph.c:255:1: expected void [noderef] __iomem *reg drivers/clk/mvebu/armada-37xx-periph.c:255:1: got void * ... Signed-off-by: Ben Dooks Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit f54f08b1b8f00cfde2be329d93d7bad17ddf9854 Author: Petr Pavlu Date: Thu Feb 19 17:27:05 2026 +0100 tracing: Free up file->private_data for use by individual events The tracing_open_file_tr() function currently copies the trace_event_file pointer from inode->i_private to file->private_data when the file is successfully opened. This duplication is not particularly useful, as all event code should utilize event_file_file() or event_file_data() to retrieve a trace_event_file pointer from a file struct and these access functions read file->f_inode->i_private. Moreover, this setup requires the code for opening hist files to explicitly clear file->private_data before calling single_open(), since this function expects the private_data member to be set to NULL and uses it to store a pointer to a seq_file. Remove the unnecessary setting of file->private_data in tracing_open_file_tr() and simplify the hist code. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Tom Zanussi Link: https://patch.msgid.link/20260219162737.314231-6-petr.pavlu@suse.com Signed-off-by: Petr Pavlu Signed-off-by: Steven Rostedt (Google) commit f0eaed27237f64e19641c5a104b43f5f7d86f65e Author: Petr Pavlu Date: Thu Feb 19 17:27:04 2026 +0100 tracing: Clean up access to trace_event_file from a file pointer The tracing code provides two functions event_file_file() and event_file_data() to obtain a trace_event_file pointer from a file struct. The primary method to use is event_file_file(), as it checks for the EVENT_FILE_FL_FREED flag to determine whether the event is being removed. The second function event_file_data() is an optimization for retrieving the same data when the event_mutex is still held. In the past, when removing an event directory in remove_event_file_dir(), the code set i_private to NULL for all event files and readers were expected to check for this state to recognize that the event is being removed. In the case of event_id_read(), the value was read using event_file_data() without acquiring the event_mutex. This required event_file_data() to use READ_ONCE() when retrieving the i_private data. With the introduction of eventfs, i_private is assigned when an eventfs inode is allocated and remains set throughout its lifetime. Remove the now unnecessary READ_ONCE() access to i_private in both event_file_file() and event_file_data(). Inline the access to i_private in remove_event_file_dir(), which allows event_file_data() to handle i_private solely as a trace_event_file pointer. Add a check in event_file_data() to ensure that the event_mutex is held and that file->flags doesn't have the EVENT_FILE_FL_FREED flag set. Finally, move event_file_data() immediately after event_file_code() since the latter provides a comment explaining how both functions should be used together. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Tom Zanussi Link: https://patch.msgid.link/20260219162737.314231-5-petr.pavlu@suse.com Signed-off-by: Petr Pavlu Signed-off-by: Steven Rostedt (Google) commit f55c09dabbabcbb119d1c0f8182fb4b69338bcd5 Author: Petr Pavlu Date: Thu Feb 19 17:27:03 2026 +0100 tracing: Remove unnecessary check for EVENT_FILE_FL_FREED The event_filter_write() function calls event_file_file() to retrieve a trace_event_file associated with a given file struct. If a non-NULL pointer is returned, the function then checks whether the trace_event_file instance has the EVENT_FILE_FL_FREED flag set. This check is redundant because event_file_file() already performs this validation and returns NULL if the flag is set. The err value is also already initialized to -ENODEV. Remove the unnecessary check for EVENT_FILE_FL_FREED in event_filter_write(). Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Tom Zanussi Link: https://patch.msgid.link/20260219162737.314231-4-petr.pavlu@suse.com Signed-off-by: Petr Pavlu Signed-off-by: Steven Rostedt (Google) commit 473e470f16f98569d59adc11c4a318780fb68fe9 Author: Arnd Bergmann Date: Tue Feb 3 17:45:29 2026 +0100 tracing: move __printf() attribute on __ftrace_vbprintk() The sunrpc change to use trace_printk() for debugging caused a new warning for every instance of dprintk() in some configurations, when -Wformat-security is enabled: fs/nfs/getroot.c: In function 'nfs_get_root': fs/nfs/getroot.c:90:17: error: format not a string literal and no format arguments [-Werror=format-security] 90 | nfs_errorf(fc, "NFS: Couldn't getattr on root"); I've been slowly chipping away at those warnings over time with the intention of enabling them by default in the future. While I could not figure out why this only happens for this one instance, I see that the __trace_bprintk() function is always called with a local variable as the format string, rather than a literal. Move the __printf(2,3) annotation on this function from the declaration to the caller. As this is can only be validated for literals, the attribute on the declaration causes the warnings every time, but removing it entirely introduces a new warning on the __ftrace_vbprintk() definition. The format strings still get checked because the underlying literal keeps getting passed into __trace_printk() in the "else" branch, which is not taken but still evaluated for compile-time warnings. Cc: Masami Hiramatsu Cc: Anna Schumaker Cc: Chuck Lever Cc: Simon Horman Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Yury Norov Cc: Randy Dunlap Link: https://patch.msgid.link/20260203164545.3174910-1-arnd@kernel.org Fixes: ec7d8e68ef0e ("sunrpc: add a Kconfig option to redirect dfprintk() output to trace buffer") Acked-by: Jeff Layton Acked-by: Steven Rostedt (Google) Signed-off-by: Arnd Bergmann Acked-by: Andy Shevchenko Signed-off-by: Steven Rostedt (Google) commit 096abbb6682ee031a0f5ce9f4c71ead9fa63d31e Author: Arnd Bergmann Date: Fri Mar 20 16:18:49 2026 +0100 clk: qoriq: avoid format string warning clang-22 warns about the use of non-variadic format arguments passed into snprintf(): drivers/clk/clk-qoriq.c:925:39: error: diagnostic behavior may be improved by adding the 'format(printf, 7, 8)' attribute to the declaration of 'create_mux_common' [-Werror,-Wmissing-format-attribute] 910 | static struct clk * __init create_mux_common(struct clockgen *cg, | __attribute__((format(printf, 7, 8))) 911 | struct mux_hwclock *hwc, 912 | const struct clk_ops *ops, 913 | unsigned long min_rate, 914 | unsigned long max_rate, 915 | unsigned long pct80_rate, 916 | const char *fmt, int idx) 917 | { 918 | struct clk_init_data init = {}; 919 | struct clk *clk; 920 | const struct clockgen_pll_div *div; 921 | const char *parent_names[NUM_MUX_PARENTS]; 922 | char name[32]; 923 | int i, j; 924 | 925 | snprintf(name, sizeof(name), fmt, idx); | ^ drivers/clk/clk-qoriq.c:910:28: note: 'create_mux_common' declared here 910 | static struct clk * __init create_mux_common(struct clockgen *cg, Rework this to pass the 'int idx' as a varargs argument, allowing the format string to be verified at the caller location. Fixes: 0dfc86b3173f ("clk: qoriq: Move chip-specific knowledge into driver") Signed-off-by: Arnd Bergmann Reviewed-by: Kees Cook Signed-off-by: Stephen Boyd commit 96df81372d0f4eb74903476bf31967cee1df3480 Merge: e7a45dec40c7ad c8d5972a25408b Author: Stephen Boyd Date: Mon Mar 23 17:14:36 2026 -0700 Merge tag 'renesas-clk-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull Renesas clk driver updates from Geert Uytterhoeven: - Add RTC clocks and resets on Renesas RZ/V2N * tag 'renesas-clk-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: r9a09g056: Add clock and reset entries for RTC commit e7a45dec40c7ad963ac4beb67cb763874be54c1b Merge: c369299895a591 1b4f047dc4010d Author: Stephen Boyd Date: Mon Mar 23 17:11:31 2026 -0700 Merge tag 'renesas-clk-fixes-for-v7.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-fixes Pull Renesas clk driver fixes from Geert Uytterhoeven: - Fix ordering of module clocks arrays on Renesas RZ/V2H(P) and RZ/V2N - Remove clocks for watchdogs meant for other CPU cores on the Renesas RZ/V2H(P) SoC * tag 'renesas-clk-fixes-for-v7.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: r9a09g057: Remove entries for WDT{0,2,3} clk: renesas: r9a09g056: Fix ordering of module clocks array clk: renesas: r9a09g057: Fix ordering of module clocks array commit 51b0909d0bc479b37db5f26674a7c41676aa8f80 Author: Chen-Yu Tsai Date: Tue Mar 24 01:24:48 2026 +0800 ASoC: sun4i-spdif: Make reset control non-optional and check for all errors The logic around the reset control is weird. The driver already has quirks describing which compatible strings require a reset control, but the reset control is acquired using the "optional" API. Then any errors other than deferred probe are ignored. Instead, switch to the non-optional variant. Also use the deassered variant to simplify the code. This also fixes a missing reset assert upon removal. Last, clean up the error message printing with dev_err_probe(). Signed-off-by: Chen-Yu Tsai Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20260323172450.1259111-1-wens@kernel.org Signed-off-by: Mark Brown commit ea0c746ffa1e6e701d39a564f6286a3f5740826b Author: Eric Biggers Date: Wed Mar 18 23:17:20 2026 -0700 lib/crypto: aesgcm: Use GHASH library API Make the AES-GCM library use the GHASH library instead of directly calling gf128mul_lle(). This allows the architecture-optimized GHASH implementations to be used, or the improved generic implementation if no architecture-optimized implementation is usable. Note: this means that no longer needs to include . Remove that inclusion, and include explicitly from arch/x86/crypto/aesni-intel_glue.c which previously was relying on the transitive inclusion. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-20-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a78ae6e364aea8aec3996de274c4f5bc98e1d771 Author: Eric Biggers Date: Wed Mar 18 23:17:19 2026 -0700 lib/crypto: gf128hash: Remove unused content from ghash.h Now that the structures in are no longer used, remove them. Since this leaves as just containing constants, include it from to deduplicate these definitions. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-19-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 07241d6c922b6e2b53e072691647e34ef395573f Author: Eric Biggers Date: Wed Mar 18 23:17:18 2026 -0700 lib/crypto: gf128mul: Remove unused 4k_lle functions Remove the 4k_lle multiplication functions and the associated gf128mul_table_le data table. Their only user was the generic implementation of GHASH, which has now been changed to use a different implementation based on standard integer multiplication. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-18-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 662a05a245078e7d03e75895403c851967dc8384 Author: Eric Biggers Date: Wed Mar 18 23:17:17 2026 -0700 crypto: ghash - Remove ghash from crypto_shash API Now that there are no users of the "ghash" crypto_shash algorithm, remove it. GHASH remains supported via the library API. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-17-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 9f4e9553a1f40841ebce9ab749896e9312b1701b Author: Eric Biggers Date: Wed Mar 18 23:17:16 2026 -0700 crypto: gcm - Use GHASH library instead of crypto_ahash Make the "gcm" template access GHASH using the library API instead of crypto_ahash. This is much simpler and more efficient, especially given that all GHASH implementations are synchronous and CPU-based anyway. Note that this allows "ghash" to be removed from the crypto_ahash (and crypto_shash) API, which a later commit will do. This mirrors the similar cleanup that was done with POLYVAL. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-16-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 3e79c8ec49596288c4460029c4971b9c838103b9 Author: Eric Biggers Date: Wed Mar 18 23:17:15 2026 -0700 lib/crypto: x86/ghash: Migrate optimized code into library Remove the "ghash-pclmulqdqni" crypto_shash algorithm. Move the corresponding assembly code into lib/crypto/, and wire it up to the GHASH library. This makes the GHASH library be optimized with x86's carryless multiplication instructions. It also greatly reduces the amount of x86-specific glue code that is needed, and it fixes the issue where this GHASH optimization was disabled by default. Rename and adjust the prototypes of the assembly functions to make them fit better with the library. Remove the byte-swaps (pshufb instructions) that are no longer necessary because the library keeps the accumulator in POLYVAL format rather than GHASH format. Rename clmul_ghash_mul() to polyval_mul_pclmul() to reflect that it really does a POLYVAL style multiplication. Wire it up to both ghash_mul_arch() and polyval_mul_arch(). Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-15-ebiggers@kernel.org Signed-off-by: Eric Biggers commit efd1d2c8f3c073c43d5616d0c2d698cbe8a3ecde Author: Eric Biggers Date: Wed Mar 18 23:17:14 2026 -0700 lib/crypto: s390/ghash: Migrate optimized code into library Remove the "ghash-s390" crypto_shash algorithm, and replace it with an implementation of ghash_blocks_arch() for the GHASH library. This makes the GHASH library be optimized with CPACF. It also greatly reduces the amount of s390-specific glue code that is needed, and it fixes the issue where this GHASH optimization was disabled by default. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-14-ebiggers@kernel.org Signed-off-by: Eric Biggers commit af413d71f09d4dde28277319926c1c3a6ec8b8d4 Author: Eric Biggers Date: Wed Mar 18 23:17:13 2026 -0700 lib/crypto: riscv/ghash: Migrate optimized code into library Remove the "ghash-riscv64-zvkg" crypto_shash algorithm. Move the corresponding assembly code into lib/crypto/, modify it to take the length in blocks instead of bytes, and wire it up to the GHASH library. This makes the GHASH library be optimized with the RISC-V Vector Cryptography Extension. It also greatly reduces the amount of riscv-specific glue code that is needed, and it fixes the issue where this optimized GHASH code was disabled by default. Note that this RISC-V code has multiple opportunities for improvement, such as adding more parallelism, providing an optimized multiplication function, and directly supporting POLYVAL. But for now, this commit simply tweaks ghash_zvkg() slightly to make it compatible with the library, then wires it up to ghash_blocks_arch(). ghash_preparekey_arch() is also implemented to store the copy of the raw key needed by the vghsh.vv instruction. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-13-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 73f315c15d6ec1ef33202e7253af90dd44ff4a3b Author: Eric Biggers Date: Wed Mar 18 23:17:12 2026 -0700 lib/crypto: powerpc/ghash: Migrate optimized code into library Remove the "p8_ghash" crypto_shash algorithm. Move the corresponding assembly code into lib/crypto/, and wire it up to the GHASH library. This makes the GHASH library be optimized for POWER8. It also greatly reduces the amount of powerpc-specific glue code that is needed, and it fixes the issue where this optimized GHASH code was disabled by default. Note that previously the C code defined the POWER8 GHASH key format as "u128 htable[16]", despite the assembly code only using four entries. Fix the C code to use the correct key format. To fulfill the library API contract, also make the key preparation work in all contexts. Note that the POWER8 assembly code takes the accumulator in GHASH format, but it actually byte-reflects it to get it into POLYVAL format. The library already works with POLYVAL natively. For now, just wire up this existing code by converting it to/from GHASH format in C code. This should be cleaned up to eliminate the unnecessary conversion later. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-12-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 631a84e49e5b16ab83098350c2695d806ad54d23 Author: Eric Biggers Date: Wed Mar 18 23:17:11 2026 -0700 crypto: arm64/aes-gcm - Rename struct ghash_key and make fixed-sized Rename the 'struct ghash_key' in arch/arm64/crypto/ghash-ce-glue.c to prevent a naming conflict with the library 'struct ghash_key'. In addition, declare the 'h' field with an explicit size, now that there's no longer any reason for it to be a flexible array. Update the comments in the assembly file to match the C code. Note that some of these were out-of-date. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-11-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a336c01f5b11cc158150d051d612a2f7ad9fd6a8 Author: Eric Biggers Date: Wed Mar 18 23:17:10 2026 -0700 lib/crypto: arm64/ghash: Migrate optimized code into library Remove the "ghash-neon" crypto_shash algorithm. Move the corresponding assembly code into lib/crypto/, and wire it up to the GHASH library. This makes the GHASH library be optimized on arm64 (though only with NEON, not PMULL; for now the goal is just parity with crypto_shash). It greatly reduces the amount of arm64-specific glue code that is needed, and it fixes the issue where this optimization was disabled by default. To integrate the assembly code correctly with the library, make the following tweaks: - Change the type of 'blocks' from int to size_t - Change the types of 'dg' and 'h' to polyval_elem. Note that this simply reflects the format that the code was already using. - Remove the 'head' argument, which is no longer needed. - Remove the CFI stubs, as indirect calls are no longer used. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 57fca3a8ed8e8e42b456bef93055e8b73b1e358f Merge: 9150d79c7a8b32 411eb30f13823c Author: Mark Brown Date: Mon Mar 23 22:38:56 2026 +0000 regulator: cros-ec: cleanup and add supplies Chen-Yu Tsai says: This series is part of a broader collection of regulator related cleanups for MediaTek Chromebooks. This one covers the regulators exposed by the ChromeOS Embedded Controller. Patch 1 adds the names of the power supply inputs to the binding. Patch 2 adds the supply names from the DT binding change in patch 1 to the regulator descriptions in the driver. This patch has a checkpatch.pl warnings, but I wonder if it's because the context size for checking complex macros is not large enough. Device tree changes will be sent separately. The goal is to get the regulator tree as complete as possible. This includes adding supply names to other regulator DT bindings, and adding all the supply links to the existing DTs. commit 411eb30f13823c37cd20d7c0fb7d5c8bdb1d844d Author: Chen-Yu Tsai Date: Fri Mar 20 16:31:33 2026 +0800 regulator: cros-ec: Add regulator supply Even a regulator remotely controlled by the EC will have a power supply input. Add the supply property name from the device tree binding to the regulator description. Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260320083135.2455444-3-wenst@chromium.org Signed-off-by: Mark Brown commit 56b7c08a8b4bfbe622099c0feb0f0f815a15d1e3 Author: Chen-Yu Tsai Date: Fri Mar 20 16:31:32 2026 +0800 regulator: dt-bindings: cros-ec: Add regulator supply Even a regulator remotely controlled by the EC will have a power supply input. Add a property to describe the power supply input. Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260320083135.2455444-2-wenst@chromium.org Signed-off-by: Mark Brown commit e3f473db02dae210f91e8eb8d0423232175639d6 Author: Eric Biggers Date: Wed Mar 18 23:17:09 2026 -0700 crypto: arm64/ghash - Move NEON GHASH assembly into its own file arch/arm64/crypto/ghash-ce-core.S implements pmull_ghash_update_p8(), which is used only by a crypto_shash implementation of GHASH. It also implements other functions, including pmull_ghash_update_p64() and others, which are used only by a crypto_aead implementation of AES-GCM. While some code is shared between pmull_ghash_update_p8() and pmull_ghash_update_p64(), it's not very much. Since pmull_ghash_update_p8() will also need to be migrated into lib/crypto/ to achieve parity in the standalone GHASH support, let's move it into a separate file ghash-neon-core.S. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 71e59795c9f65a30416ed719b4b4da585df3903a Author: Eric Biggers Date: Wed Mar 18 23:17:08 2026 -0700 lib/crypto: arm/ghash: Migrate optimized code into library Remove the "ghash-neon" crypto_shash algorithm. Move the corresponding assembly code into lib/crypto/, and wire it up to the GHASH library. This makes the GHASH library be optimized on arm (though only with NEON, not PMULL; for now the goal is just parity with crypto_shash). It greatly reduces the amount of arm-specific glue code that is needed, and it fixes the issue where this optimization was disabled by default. To integrate the assembly code correctly with the library, make the following tweaks: - Change the type of 'blocks' from int to size_t. - Change the types of 'dg' and 'h' to polyval_elem. Note that this simply reflects the format that the code was already using, at least on little endian CPUs. For big endian CPUs, add byte-swaps. - Remove the 'head' argument, which is no longer needed. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2241228a5492b0c9a1870c59d3887d3a96c735c6 Author: Giovanni Cabiddu Date: Fri Mar 20 21:35:39 2026 +0000 vfio/qat: add support for Intel QAT 420xx VFs Extend the qat_vfio_pci variant driver to support QAT 420xx (GEN 5) Virtual Functions (VFs). Add the relevant VF device ID to the probe table. Signed-off-by: Giovanni Cabiddu Link: https://lore.kernel.org/r/20260320213622.88549-2-giovanni.cabiddu@intel.com Signed-off-by: Alex Williamson commit 1fe7579ab0a51513ba35cfb3cde62706df31912f Merge: ea0e916de13426 579a49aaab0814 Author: Mark Brown Date: Mon Mar 23 22:02:41 2026 +0000 spi: hisi-kunpeng cleanup and fix Pei Xiao says: I might have wasted your valuable time again. Please help check the two modifications. Thank you! commit 579a49aaab0814c55595cddf0be9651e37972f6a Author: Pei Xiao Date: Thu Mar 19 11:06:42 2026 +0800 spi: hisi-kunpeng: Add timeout warning in FIFO flush function When flushing the FIFO, the driver waits for the busy flag to clear with a timeout. Change the loop condition to use pre-decrement (--limit) instead of post-decrement (limit--) so that warning message can show. Add a ratelimited warning message to log SPI busy timeout events, aiding in debugging. Signed-off-by: Pei Xiao Link: https://patch.msgid.link/dad95ce42fb5677edfed32bc1f9b3e54df2cf8de.1773889292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit 9f61daf2c2debe9f5cf4e1a4471e56a89a6fe45a Author: Pei Xiao Date: Thu Mar 19 11:06:41 2026 +0800 spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo The hisi_spi_flush_fifo()'s inner while loop that lacks any timeout mechanism. Maybe the hardware never becomes empty, the loop will spin forever, causing the CPU to hang. Fix this by adding a inner_limit based on loops_per_jiffy. The inner loop now exits after approximately one jiffy if the FIFO remains non-empty, logs a ratelimited warning, and breaks out of the outer loop. Additionally, add a cpu_relax() inside the busy loop to improve power efficiency. Fixes: c770d8631e18 ("spi: Add HiSilicon SPI Controller Driver for Kunpeng SoCs") Signed-off-by: Pei Xiao Link: https://patch.msgid.link/d834ce28172886bfaeb9c8ca00cfd9bf1c65d5a1.1773889292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit ca5ff14c1a70e7eeff5705105554ce8bac643937 Author: Eric Biggers Date: Wed Mar 18 23:17:07 2026 -0700 crypto: arm/ghash - Move NEON GHASH assembly into its own file arch/arm/crypto/ghash-ce-core.S implements pmull_ghash_update_p8(), which is used only by a crypto_shash implementation of GHASH. It also implements other functions, including pmull_ghash_update_p64() and others, which are used only by a crypto_aead implementation of AES-GCM. While some code is shared between pmull_ghash_update_p8() and pmull_ghash_update_p64(), it's not very much. Since pmull_ghash_update_p8() will also need to be migrated into lib/crypto/ to achieve parity in the standalone GHASH support, let's move it into a separate file ghash-neon-core.S. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 39afaff983fe64ea749aafb3ebd63d44212d2860 Author: Eric Biggers Date: Wed Mar 18 23:17:06 2026 -0700 crypto: arm/ghash - Make the "ghash" crypto_shash NEON-only arch/arm/crypto/ghash-ce-glue.c originally provided only a "ghash" crypto_shash algorithm using PMULL if available, else NEON. Significantly later, it was updated to also provide a full AES-GCM implementation using PMULL. This made the PMULL support in the "ghash" crypto_shash largely obsolete. Indeed, the arm64 equivalent of this file unconditionally uses only ASIMD in its "ghash" crypto_shash. Given that inconsistency and the fact that the NEON-only code is more easily separable into the GHASH library than the PMULL based code is, let's align with arm64 and just support NEON-only for the pure GHASH. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 75e34bef53251744d95fd242b0345122fa462c7b Author: Eric Biggers Date: Wed Mar 18 23:17:05 2026 -0700 lib/crypto: tests: Add KUnit tests for GHASH Add a KUnit test suite for the GHASH library functions. It closely mirrors the POLYVAL test suite. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 55fd681cdd8599edc82013674cbf87c2f22d58f8 Author: Danilo Krummrich Date: Sat Mar 21 19:18:08 2026 +0100 rust: dma: remove dma::CoherentAllocation Now that everything has been converted to the new dma::Coherent API, remove dma::CoherentAllocation. Suggested-by: Gary Guo Reviewed-by: Gary Guo Link: https://patch.msgid.link/DH8O47F2GM1Z.3H3E13RSKIV22@kernel.org Signed-off-by: Danilo Krummrich commit f343012ebe80fdd93ed487f41b987a1507894cda Author: Gary Guo Date: Fri Mar 20 20:45:43 2026 +0100 gpu: nova-core: convert to new dma::Coherent API Remove all usages of dma::CoherentAllocation and use the new dma::Coherent type instead. Signed-off-by: Gary Guo Co-developed-by: Danilo Krummrich Signed-off-by: Danilo Krummrich Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260320194626.36263-9-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 7f3e836e4306c2026975fefc150cc0e5c569d5f3 Author: Danilo Krummrich Date: Fri Mar 20 20:45:42 2026 +0100 gpu: nova-core: convert Gsp::new() to use CoherentBox Convert libos (LibosMemoryRegionInitArgument) and rmargs (GspArgumentsPadded) to use CoherentBox / Coherent::init() and simplify the initialization. This also avoids separate initialization on the stack. Reviewed-by: Gary Guo Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260320194626.36263-8-dakr@kernel.org Signed-off-by: Danilo Krummrich commit e21ad5e51c889e4b40a2a3d48363cbed9b047a68 Author: Danilo Krummrich Date: Fri Mar 20 20:45:41 2026 +0100 gpu: nova-core: use Coherent::init to initialize GspFwWprMeta Convert wpr_meta to use Coherent::init() and simplify the initialization. It also avoids a separate initialization of GspFwWprMeta on the stack. Reviewed-by: Gary Guo Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260320194626.36263-7-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 40251bac0e00818b0b632d2d154e4f1f815849eb Author: Danilo Krummrich Date: Fri Mar 20 20:45:40 2026 +0100 rust: dma: add Coherent:init() and Coherent::init_with_attrs() Analogous to Coherent::zeroed() and Coherent::zeroed_with_attrs(), add Coherent:init() and Coherent::init_with_attrs() which both take an impl Init argument initializing the DMA coherent memory. Compared to CoherentInit, Coherent::init() is a one-shot constructor that runs an Init closure and immediately exposes the DMA handle, whereas CoherentInit is a multi-stage initializer that provides safe &mut T access by withholding the DMA address until converted to Coherent. Reviewed-by: Gary Guo Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260320194626.36263-6-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 80f4a7b5138d1c427ee5626e8a796aa6b2994a95 Author: Danilo Krummrich Date: Fri Mar 20 20:45:39 2026 +0100 rust: dma: introduce dma::CoherentBox for memory initialization Currently, dma::Coherent cannot safely provide (mutable) access to its underlying memory because the memory might be concurrently accessed by a DMA device. This makes it difficult to safely initialize the memory before handing it over to the hardware. Introduce dma::CoherentBox, a type that encapsulates a dma::Coherent before its DMA address is exposed to the device. dma::CoherentBox can guarantee exclusive access to the inner dma::Coherent and implement Deref and DerefMut. Once the memory is properly initialized, dma::CoherentBox can be converted into a regular dma::Coherent. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260320194626.36263-5-dakr@kernel.org [ Remove unnecessary trait bounds. - Danilo ] Signed-off-by: Danilo Krummrich commit f84ecffa3f745572164c1269f20eec2589d432c9 Author: Gary Guo Date: Fri Mar 20 20:45:38 2026 +0100 rust: dma: add zeroed constructor to `Coherent` These constructors create a coherent container of a single object instead of slice. They are named `zeroed` and `zeroed_with_attrs` to emphasis that they are created initialized zeroed. It is intended that there'll be new constructors that take `PinInit` instead of zeroing. Signed-off-by: Gary Guo Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260320194626.36263-4-dakr@kernel.org [ Use kernel import style. - Danilo ] Signed-off-by: Danilo Krummrich commit c337c1b561c1c3016d30776d7dc2032ea4979334 Author: Chris Morgan Date: Tue Mar 10 08:49:19 2026 -0500 arm64: dts: rockchip: Correct Joystick Axes on Gameforce Ace The Gameforce Ace's joystick axes were set incorrectly initially, getting the X/Y and RX/RY axes backwards. Additionally, correct the RY axis so that it is inverted. All axes tested with evtest and outputting correct values. Fixes: 4e946c447a04 ("arm64: dts: rockchip: Add GameForce Ace") Reported-by: sydarn Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20260310134919.550023-1-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit c7079215b7dbf88b84a95ff13982bf3dab3cfbe1 Author: Chris Morgan Date: Tue Mar 10 08:46:48 2026 -0500 arm64: dts: rockchip: Correct Fan Supply for Gameforce Ace Correct the regulator providing power to the PWM controlled fan. Without this fix the fan only runs when the audio path is playing audio (because the speaker amplifier and PWM fan share the same regulator). Fixes: 4e946c447a04 ("arm64: dts: rockchip: Add GameForce Ace") Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20260310134648.550006-1-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 03978cb18059ecd27e3d955508b18cf2a1196142 Author: Robin Murphy Date: Mon Jan 26 12:32:04 2026 +0000 Revert "arm64: dts: rockchip: add SPDIF audio to Beelink A1" This reverts commit bdc4d388c6452498ab62ef2564589f40e0c8c262. While Beelink A1 mostly follows the high-end RK3328 reference design, it does not in fact have the S/PDIF connector, only HDMI and a 3.5mm jack for the analog audio/TV codecs - the tiny form factor literally doesn't have room to fit more! Cc: Christian Hewitt Cc: Alex Bee Fixes: bdc4d388c645 ("arm64: dts: rockchip: add SPDIF audio to Beelink A1") Signed-off-by: Robin Murphy Link: https://patch.msgid.link/0af77a02c2b0806d4ca72066392a5453fcc89a8f.1767111968.git.robin.murphy@arm.com Signed-off-by: Heiko Stuebner commit 861a9593e10bb6ab2a492b315c8a2a3aad70ac00 Author: Ming Wang Date: Fri Feb 6 17:04:53 2026 +0800 arm64: dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi The AP6212 WiFi/BT module on the LCKFB TaiShan Pi (RK3566) is prone to communication timeouts and reset failures (error -110) when operating at 3 Mbps. This patch stabilizes the Bluetooth interface by: 1. Updating the compatible string to 'brcm,bcm43430a1-bt' to better reflect the actual chip revision used in the AP6212 module. 2. Lowering the maximum UART baud rate from 3,000,000 to 1,500,000 bps. Tests show that 1.5 Mbps is the reliable upper limit for this board's UART configuration, eliminating the initialization timeouts. Fixes: 251e5ade9ba4 ("arm64: dts: rockchip: add dts for LCKFB Taishan Pi RK3566") Signed-off-by: Ming Wang Link: https://patch.msgid.link/20260206090453.1041919-1-wming126@126.com Signed-off-by: Heiko Stuebner commit 3dc3525dab1a572bc2946f9edd7d149b0fa465b6 Author: Fabio Estevam Date: Wed Mar 11 10:56:04 2026 -0300 ARM: dts: rockchip: Fix LED node names on rk3288-phycore-rdk According to nxp,pca953x.yaml, the pattern for the led names should be: "^led-[0-9a-z]+$". Change it accordingly to fix the following dt-schema warning" leddimmer@62 (nxp,pca9533): 'led1', 'led2', 'led3', 'led4' do not match any of the regexes: '^led-[0-9a-z]+$', '^pinctrl-[0-9]+$' Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260311135604.21634-1-festevam@gmail.com Signed-off-by: Heiko Stuebner commit 729675e91349da6e9a9ddcb0a890c2c28e775a22 Author: Fabio Estevam Date: Tue Mar 3 16:38:55 2026 -0300 ARM: dts: rockchip: Fix GMAC description n RK3288 boards According to rockchip-dwmac.yaml, the mdio node should be 'mdio0' and 'wakeup-source' is not a valid property. Change it accordingly. This fixes the following dt-schema warning: Unevaluated properties are not allowed ('mdio0', 'wakeup-source'\ were unexpected) Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260303193855.828892-3-festevam@gmail.com Signed-off-by: Heiko Stuebner commit bd4a9d6f4cab42511170508c6ada9cd21801d3cd Author: Fabio Estevam Date: Tue Mar 3 16:38:54 2026 -0300 ARM: dts: rockchip: Fix RTC description on rk3288-firefly-reload Node names should be generic, so use 'rtc'. Remove 'clock-frequency' as is not a valid property. This fixes the following dt-schema warnings: 'hym8563@51' does not match '^rtc(@.*|-([0-9]|[1-9][0-9]+))?$' Unevaluated properties are not allowed ('clock-frequency' was unexpected) Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260303193855.828892-2-festevam@gmail.com Signed-off-by: Heiko Stuebner commit ff7875e5f1a3c5d82e0b61d9524a0f21c33a5c99 Author: Fabio Estevam Date: Tue Mar 3 16:38:53 2026 -0300 ARM: dts: rockchip: Add missing the touchscreen interrupt on rk3288-phycore-rdk According to the phyCORE - RK3288 Hardware Manual, GPIO5_B4 corresponds to the touchscreen interrupt line: https://www.phytec.eu/fileadmin/legacy/downloads/Manuals/L-826e_1.pdf Describe it to improve the devicetree representation. This fixes the following dt-schema warning: 'interrupts' is a required property 'interrupts-extended' is a required property Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260303193855.828892-1-festevam@gmail.com Signed-off-by: Heiko Stuebner commit 2d05076e8f3cff5b7f9f12d03b1bfdb24894fc9f Author: Fabio Estevam Date: Wed Mar 4 13:44:48 2026 -0300 ARM: dts: rockchip: Fix the trackpad supply on rk3288-veyron-jerry According to hid-over-i2c.yaml, the correct name for the 3.3V supply is 'vdd-supply'. Fix it accordingly. This fixes the following dt-schema warning: 'vcc-supply' does not match any of the regexes: '^pinctrl-[0-9]+$' Signed-off-by: Fabio Estevam Reviewed-by: Charalampos Mitrodimas Link: https://patch.msgid.link/20260304164448.1024410-1-festevam@gmail.com Signed-off-by: Heiko Stuebner commit e1774b82404ecf4ad6600a913a26875aba51fa6d Author: Fabio Estevam Date: Thu Feb 26 11:48:42 2026 -0300 ARM: dts: rockchip: Fix the Bluetooth node name on rk3288-veyron Node names should be generic, so use 'bluetooth' as the node name. This fixes the following dt-schema warning: 'btmrvl@2' does not match '^bluetooth(@.*)?$' Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260226144842.2727107-2-festevam@gmail.com Signed-off-by: Heiko Stuebner commit 707f54dcab1b242eae4649886013081d4c005563 Author: Fabio Estevam Date: Thu Feb 26 11:48:41 2026 -0300 ARM: dts: rockchip: Remove invalid regulator-property from rk3288-veyron The 'regulator-suspend-mem-disabled' property is not documented nor used anywhere. Remove this invalid property. This fixes the following dt-schema warning: ('regulator-suspend-mem-disabled' was unexpected) Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260226144842.2727107-1-festevam@gmail.com Signed-off-by: Heiko Stuebner commit 0c28011809918e3cc21090c37b001c8cd2140e42 Author: Fabio Estevam Date: Thu Feb 26 11:59:16 2026 -0300 ARM: dts: rockchip: Use mount-matrix on rk3188-bqedison2qc 'rotation-matrix' is not a valid property. Use the documented 'mount-matrix' property instead. This fixes the following dt-schema warning: accelerometer@29 (st,lis3de): 'rotation-matrix' does not match any of the regexes: '^pinctrl-[0-9]+$' accelerometer@29 (st,lis3de): rotation-matrix: b'1\x000\x000\x000\x00-1\x000\x000\x000\x001\x00' is not of type 'object', 'integer', 'array', 'boolean', 'null' Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260226145916.2729492-1-festevam@gmail.com Signed-off-by: Heiko Stuebner commit 1336c328b4a23a45aa04f6fcd9052f006ae1a1c4 Author: Fabio Estevam Date: Sun Mar 1 09:41:56 2026 -0300 ARM: dts: rockchip: Fix RTC compatible on rk3288-phycore-rdk According to st,m41t80.yaml, the correct compatible for the RV4162 RTC is "microcrystal,rv4162". Fix it accordingly. This fixes the following dt-schema warning: rtc@68: failed to match any schema with compatible: ['rv4162'] Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260301124156.473862-1-festevam@gmail.com Signed-off-by: Heiko Stuebner commit 6485417ed921c5db85a89669639d9b2730bd4861 Author: Fabio Estevam Date: Fri Feb 27 22:32:56 2026 -0300 ARM: dts: rockchip: Move PHY reset to ethernet-phy node on rk3036 boards According to rockchip,emac.yaml, 'phy-reset-duration' and 'phy-reset-gpios' are not valid properties. Use the valid 'reset-gpios' and 'reset-assert-us' properties under the etherne-phy node. This fixes the following dt-schema warning: Unevaluated properties are not allowed ('phy-reset-duration', 'phy-reset-gpios' were unexpected) Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260228013257.256973-1-festevam@gmail.com Signed-off-by: Heiko Stuebner commit ba9e4ce2e38292d65f11126173fefec32e372b41 Author: Fabio Estevam Date: Fri Feb 27 22:32:57 2026 -0300 ARM: dts: rockchip: Remove rockchip,grf from rk3288 tsadc According to rockchip-thermal.yaml, RK3288 does not require rockchip,grf, so remove this invalid property. This fixes the following dt-schema warning: tsadc@ff280000 (rockchip,rk3288-tsadc): False schema does not allow [[53]] The rockchip_thermal driver also confirms that grf is not needed as the rk3288_tsadc_data contains: .grf_required = false, Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260228013257.256973-2-festevam@gmail.com Signed-off-by: Heiko Stuebner commit d9aee73c56ee971b08173071ad93fa5ebf00a32e Author: Gary Guo Date: Fri Mar 20 20:45:37 2026 +0100 rust: dma: add generalized container for types other than slices Currently, `CoherentAllocation` is concecptually a DMA coherent container of a slice of `[T]` of runtime-checked length. Generalize it by creating `dma::Coherent` which can hold any value of `T`. `Coherent::alloc_with_attrs` is implemented but not yet exposed, as I believe we should not expose the way to obtain an uninitialized coherent region. `Coherent<[T]>` provides a `len` method instead of the previous `count()` method to be consistent with methods on slices. The existing type is re-defined as a type alias of `Coherent<[T]>` to ease transition. Methods in use are not yet removed. Signed-off-by: Gary Guo Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260320194626.36263-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 7ea1a61129b26709fe85cf5d50da5c47458deb3a Author: Danilo Krummrich Date: Fri Mar 20 20:45:36 2026 +0100 rust: dma: use "kernel vertical" style for imports Convert all imports to use "kernel vertical" style. With this, subsequent patches neither introduce unrelated changes nor leave an inconsistent import pattern. While at it, drop unnecessary imports covered by prelude::*. Link: https://docs.kernel.org/rust/coding-guidelines.html#imports Reviewed-by: Gary Guo Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260320194626.36263-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 4b1948ef1d9802b61cff8ec1e212b18d0af152c1 Author: Joel Fernandes Date: Fri Mar 20 00:57:11 2026 -0400 MAINTAINERS: gpu: buddy: Update reviewer Christian Koenig mentioned he'd like to step down from the reviewer role for the GPU buddy allocator. Joel Fernandes is stepping in as reviewer with agreement from Matthew Auld and Arun Pravin. Signed-off-by: Joel Fernandes Acked-by: Christian König Acked-by: Matthew Auld Link: https://patch.msgid.link/20260320045711.43494-3-joelagnelf@nvidia.com Signed-off-by: Danilo Krummrich commit b9616d9721bf8a56d5038e85d2ebbe0ec9d56a94 Author: Joel Fernandes Date: Fri Mar 20 00:57:10 2026 -0400 rust: gpu: Add GPU buddy allocator bindings Add safe Rust abstractions over the Linux kernel's GPU buddy allocator for physical memory management. The GPU buddy allocator implements a binary buddy system useful for GPU physical memory allocation. nova-core will use it for physical memory allocation. Cc: Nikola Djukic Signed-off-by: Joel Fernandes Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260320045711.43494-2-joelagnelf@nvidia.com [ * Use doc-comments for GpuBuddyAllocMode methods and GpuBuddyGuard, * Fix comma splice in GpuBuddyParams::chunk_size doc-comment, * Remove redundant summary in GpuBuddy::new doc-comment, * Drop Rust helper for gpu_buddy_block_size(). - Danilo ] Signed-off-by: Danilo Krummrich commit 140cfee588af8656822b835ccd28515f0b8c77cf Author: Wendy Liang Date: Mon Mar 23 10:37:19 2026 -0700 accel/amdxdna: Return ERR_PTR on dma_alloc_noncoherent failure dma_alloc_noncoherent() returns NULL on failure, but callers of aie2_alloc_msg_buffer() check for IS_ERR(). Return ERR_PTR(-ENOMEM) instead of NULL to match the amdxdna_iommu_alloc() path and the caller's error checking convention. Fixes: ece3e8980907 ("accel/amdxdna: Allow forcing IOVA-based DMA via module parameter") Signed-off-by: Wendy Liang Reviewed-by: Karol Wachowski Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260323173719.2311474-1-lizhi.hou@amd.com commit c417e7045b70345f59643fb2db67b0e7fbd7fbd0 Author: Eric Biggers Date: Wed Mar 18 23:17:04 2026 -0700 lib/crypto: gf128hash: Add GHASH support Add GHASH support to the gf128hash module. This will replace the GHASH support in the crypto_shash API. It will be used by the "gcm" template and by the AES-GCM library (when an arch-optimized implementation of the full AES-GCM is unavailable). This consists of a simple API that mirrors the existing POLYVAL API, a generic implementation of that API based on the existing efficient and side-channel-resistant polyval_mul_generic(), and the framework for architecture-optimized implementations of the GHASH functions. The GHASH accumulator is stored in POLYVAL format rather than GHASH format, since this is what most modern GHASH implementations actually need. The few implementations that expect the accumulator in GHASH format will just convert the accumulator to/from GHASH format temporarily. (Supporting architecture-specific accumulator formats would be possible, but doesn't seem worth the complexity.) However, architecture-specific formats of struct ghash_key will be supported, since a variety of formats will be needed there anyway. The default format is just the key in POLYVAL format. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b3b6e8f9b38911e9b30a5abe845541ade0797327 Author: Eric Biggers Date: Wed Mar 18 23:17:03 2026 -0700 lib/crypto: gf128hash: Support GF128HASH_ARCH without all POLYVAL functions Currently, some architectures (arm64 and x86) have optimized code for both GHASH and POLYVAL. Others (arm, powerpc, riscv, and s390) have optimized code only for GHASH. While POLYVAL support could be implemented on these other architectures, until then we need to support the case where arch-optimized functions are present only for GHASH. Therefore, update the support for arch-optimized POLYVAL functions to allow architectures to opt into supporting these functions individually. The new meaning of CONFIG_CRYPTO_LIB_GF128HASH_ARCH is that some level of GHASH and/or POLYVAL acceleration is provided. Also provide an implementation of polyval_mul() based on polyval_blocks_arch(), for when polyval_mul_arch() isn't implemented. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 61f66c5216a961784b12307be60a25204525605c Author: Eric Biggers Date: Wed Mar 18 23:17:02 2026 -0700 lib/crypto: gf128hash: Rename polyval module to gf128hash Currently, the standalone GHASH code is coupled with crypto_shash. This has resulted in unnecessary complexity and overhead, as well as the code being unavailable to library code such as the AES-GCM library. Like was done with POLYVAL, it needs to find a new home in lib/crypto/. GHASH and POLYVAL are closely related and can each be implemented in terms of each other. Optimized code for one can be reused with the other. But also since GHASH tends to be difficult to implement directly due to its unnatural bit order, most modern GHASH implementations (including the existing arm, arm64, powerpc, and x86 optimized GHASH code, and the new generic GHASH code I'll be adding) actually reinterpret the GHASH computation as an equivalent POLYVAL computation, pre and post-processing the inputs and outputs to map to/from POLYVAL. Given this close relationship, it makes sense to group the GHASH and POLYVAL code together in the same module. This gives us a wide range of options for implementing them, reusing code between the two and properly utilizing whatever instructions each architecture provides. Thus, GHASH support will be added to the library module that is currently called "polyval". Rename it to an appropriate name: "gf128hash". Rename files, options, functions, etc. where appropriate to reflect the upcoming sharing with GHASH. (Note: polyval_kunit is not renamed, as ghash_kunit will be added alongside it instead.) Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 9e34adb1cc582bbcf1d74b23f1e6d9d71fb99fa1 Author: Andreas Gruenbacher Date: Thu Mar 19 15:35:03 2026 +0100 gfs2: Remove trans_drain code duplication Rename trans_drain() to gfs2_trans_drain(). Add a new gfs2_trans_drain_list() helper and use it in gfs2_trans_drain() to reduce code duplication. Signed-off-by: Andreas Gruenbacher commit 10866892c79159168459289a1288df4163e94d67 Author: Andreas Gruenbacher Date: Fri Mar 13 17:10:19 2026 +0100 gfs2: Move gfs2_remove_from_journal to log.c Move gfs2_remove_from_journal() from meta_io.c to log.c and fix a minor indentation glitch. With that, gfs2_remove_from_ail() is now only used inside log.c, so it can be made static. Signed-off-by: Andreas Gruenbacher commit 5a15907f99e5d93b0133be608a9bbe24fd76f67a Author: Andreas Gruenbacher Date: Fri Mar 20 16:43:15 2026 +0100 gfs2: Get rid of gfs2_log_[un]lock helpers These two helpers only hide the locking operation; they do not make the code more readable. Created with: sed -i -e 's:gfs2_log_unlock(sdp):spin_unlock(\&sdp->sd_log_lock):' \ -e 's:gfs2_log_lock(sdp):spin_lock(\&sdp->sd_log_lock):' Signed-off-by: Andreas Gruenbacher commit 7288185ce87ec70133b7bc3b694b0f74bf46a0ee Author: Andreas Gruenbacher Date: Fri Mar 6 18:05:48 2026 +0100 gfs2: less aggressive low-memory log flushing It turns out that for some workloads, the fix in commit b74cd55aa9a9d ("gfs2: low-memory forced flush fixes") causes the number of forced log flushes to increase to a degree that the overall filesystem performance drops significantly. Address that by forcing a log flush only when gfs2_writepages cannot make any progress rather than when it cannot make "enough" progress. Fixes: b74cd55aa9a9d ("gfs2: low-memory forced flush fixes") Signed-off-by: Andreas Gruenbacher commit bd67f17718ccb3e99ab834f4d32f848a471e6bbf Author: Andreas Gruenbacher Date: Mon Nov 10 21:18:44 2025 +0000 gfs2: Fix data loss during inode evict When gfs2_evict_inode() is called on an inode with unwritten data in the page cache, the page cache needs to be written before it can be truncated. This doesn't always happen. Fix that by changing gfs2_evict_inode() to always either call evict_linked_inode() or evict_unlinked_inode(). Inside evict_unlinked_inode(), first check if the inode is dirty. If it is, make sure the inode glock is held and write back the data and metadata. If it isn't, skip those steps. Also, make sure that gfs2_evict_inode() calls gfs2_evict_inode() and evict_unlinked_inode() only if ip->i_gl is not NULL; this avoids unnecessary complications there. Fixes xfstest generic/211. Signed-off-by: Andreas Gruenbacher commit 2b34a9e760f484a437a768781444da1f67a92768 Author: Andreas Gruenbacher Date: Tue Nov 11 14:32:08 2025 +0000 gfs2: minor evict_[un]linked_inode cleanup Add gl helper variables in evict_unlinked_inode() and evict_linked_inode(). This patch isn't very interesting by itself, but it makes the next patch more readable. Signed-off-by: Andreas Gruenbacher commit e2de65130d6ce599cfc114c515665194fe2dbf1d Author: Andreas Gruenbacher Date: Mon Nov 10 21:18:44 2025 +0000 gfs2: Avoid unnecessary transactions in evict_linked_inode In evict_linked_inode(), the truncate_inode_pages() calls are carried out inside a transaction. This code was added to what was then function gfs2_delete_inode() in commit 16615be18cadf ("[GFS2] Clean up journaled data writing"). These transactions are only used for creating revokes for the jdata buffers in the journal, so don't create such transactions when we know that the address space doesn't contain any jdata buffers for this inode and truncate the metadata address space outside of the transaction. Signed-off-by: Andreas Gruenbacher commit ea0e916de13426dc62fc349f80bf5326adb17cea Author: Pei Xiao Date: Thu Mar 19 10:04:10 2026 +0800 spi: sunplus-sp7021: Simplify clock handling with devm_clk_get_enabled() Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for the clock. This removes the need for explicit clock enable/disable calls and the custom cleanup function, as the managed API automatically handles clock disabling on device removal or probe failure. Remove the now-unnecessary sp7021_spi_disable_unprepare() function and the devm_add_action_or_reset() call. Signed-off-by: Pei Xiao Link: https://patch.msgid.link/fb0bc46107975cfff4eefa9ba96fe7545996ae52.1773885292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit 7da637804805cee6899c9a682227f328e94822a5 Author: Pei Xiao Date: Thu Mar 19 10:04:09 2026 +0800 spi: stm32: Simplify clock handling with devm_clk_get_enabled() Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for the clock. This removes the need for explicit clock enable and disable calls, as the managed API automatically handles clock disabling on device removal or probe failure. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error paths and the remove callback. Also simplify error handling by using dev_err_probe(). Signed-off-by: Pei Xiao Acked-by: Alain Volmat Reviewed-by: Amelie Delaunay Link: https://patch.msgid.link/c8259f582596fd08541b94dce5dbb4cae513e295.1773885292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit 140039c23aca067b9ff0242e3c0ce96276bb95f3 Author: Pei Xiao Date: Thu Mar 19 10:04:05 2026 +0800 spi: sifive: Simplify clock handling with devm_clk_get_enabled() Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for the bus clock. This reduces boilerplate code and error handling, as the managed API automatically disables the clock when the device is removed or if probe fails. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error path and the remove callback. Adjust the error handling to use the existing put_host label. Signed-off-by: Pei Xiao Link: https://patch.msgid.link/73d0d8ecb4e1af5a558d6a7866c0f886d94fe3d1.1773885292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit 8b237cb10e32791e53a13c3e96e88683a736094a Author: Pei Xiao Date: Thu Mar 19 10:03:59 2026 +0800 spi: bcmbca-hsspi: Simplify clock handling with devm_clk_get_enabled() Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for both the "hsspi" and "pll" clocks. This reduces boilerplate code and error handling, as the managed API automatically disables the clocks when the device is removed or if probe fails. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error paths and the remove callback. Simplify the error handling by converting to direct returns with dev_err_probe() where appropriate. Signed-off-by: Pei Xiao Link: https://patch.msgid.link/a3d07ed20d7bdc676fb10c9a73224f80e83b3232.1773885292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit e532e21a246d3fde56b7c74d6f730a16291cc96e Author: Pei Xiao Date: Thu Mar 19 10:03:58 2026 +0800 spi: bcm63xx-hsspi: Simplify clock handling with devm_clk_get_enabled() Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for both the "hsspi" and "pll" clocks. This reduces boilerplate code and error handling, as the managed API automatically disables the clocks when the device is removed or if probe fails. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error paths and the remove callback. Accordingly, adjust the error handling labels to direct returns where possible. Signed-off-by: Pei Xiao Link: https://patch.msgid.link/3a187be6d9963645f01caebc1169e06f8804b7a6.1773885292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit 1001b4735137894a6bd7b5bf73375cfa27b6125e Author: Ben Dooks Date: Mon Mar 23 17:56:04 2026 +0000 ASoC: soc-topology: fix __le32 conversion in printed values A number of dev_dbg() and dev_err() calls get passed values that are of __le32 type which does not get noticed by sparse until my variadic checking patches. There are a number of these, and we should probably fix these up. The sparse warnings are numerous so the first few are listed here that this patch fixes: sound/soc/soc-topology.c:226:9: warning: incorrect type in argument 4 (different base types) sound/soc/soc-topology.c:226:9: expected int sound/soc/soc-topology.c:226:9: got restricted __le32 [usertype] get sound/soc/soc-topology.c:226:9: warning: incorrect type in argument 5 (different base types) sound/soc/soc-topology.c:226:9: expected int sound/soc/soc-topology.c:226:9: got restricted __le32 [usertype] put sound/soc/soc-topology.c:226:9: warning: incorrect type in argument 6 (different base types) sound/soc/soc-topology.c:226:9: expected int sound/soc/soc-topology.c:226:9: got restricted __le32 [usertype] info sound/soc/soc-topology.c:226:9: warning: incorrect type in argument 4 (different base types) sound/soc/soc-topology.c:226:9: expected int sound/soc/soc-topology.c:226:9: got restricted __le32 [usertype] get sound/soc/soc-topology.c:226:9: warning: incorrect type in argument 5 (different base types) sound/soc/soc-topology.c:226:9: expected int sound/soc/soc-topology.c:226:9: got restricted __le32 [usertype] put sound/soc/soc-topology.c:226:9: warning: incorrect type in argument 6 (different base types) sound/soc/soc-topology.c:226:9: expected int sound/soc/soc-topology.c:226:9: got restricted __le32 [usertype] info sound/soc/soc-topology.c:226:9: warning: incorrect type in argument 4 (different base types) sound/soc/soc-topology.c:226:9: expected int sound/soc/soc-topology.c:226:9: got restricted __le32 [usertype] get sound/soc/soc-topology.c:226:9: warning: incorrect type in argument 5 (different base types) sound/soc/soc-topology.c:226:9: expected int sound/soc/soc-topology.c:226:9: got restricted __le32 [usertype] put sound/soc/soc-topology.c:226:9: warning: incorrect type in argument 6 (different base types) sound/soc/soc-topology.c:226:9: expected int sound/soc/soc-topology.c:226:9: got restricted __le32 [usertype] info Signed-off-by: Ben Dooks Link: https://patch.msgid.link/20260323175604.19315-1-ben.dooks@codethink.co.uk Signed-off-by: Mark Brown commit f9f0b4a1f35d39a1a2a2f8ec46eb7b81efc70a63 Author: Joel Fernandes Date: Thu Mar 19 17:07:22 2026 -0400 rust: interop: Add list module for C linked list interface Add a new module `kernel::interop::list` for working with C's doubly circular linked lists. Provide low-level iteration over list nodes. Typed iteration over actual items is provided with a `clist_create` macro to assist in creation of the `CList` type. Cc: Nikola Djukic Reviewed-by: Daniel Almeida Reviewed-by: Alexandre Courbot Reviewed-by: Alice Ryhl Acked-by: Alexandre Courbot Acked-by: Gary Guo Acked-by: Miguel Ojeda Signed-off-by: Joel Fernandes Link: https://patch.msgid.link/20260319210722.1543776-1-joelagnelf@nvidia.com [ * Remove stray empty comment and double blank line in doctest, * Improve wording and fix a few typos, * Use markdown emphasis instead of caps, * Move interop/mod.rs to interop.rs. - Danilo ] Signed-off-by: Danilo Krummrich commit 407f658eec69225d2bf3974b1ed63b0d88a25a6e Merge: a19457958c3018 f08ceb71c5a561 Author: Danilo Krummrich Date: Mon Mar 23 18:26:44 2026 +0100 Merge tag 'drm-misc-next-2026-03-12' into drm-rust-next We need the latest GPU buddy changes from drm-misc-next-2026-03-12 in drm-rust-next as well, as the Rust abstractions are built on top of it. Signed-off-by: Danilo Krummrich commit a31566762d4075646a8a2214586158b681e94305 Author: Matt Roper Date: Thu Mar 19 15:30:34 2026 -0700 drm/xe: Implement recent spec updates to Wa_16025250150 The hardware teams noticed that the originally documented workaround steps for Wa_16025250150 may not be sufficient to fully avoid a hardware issue. The workaround documentation has been augmented to suggest programming one additional register; make the corresponding change in the driver. Fixes: 7654d51f1fd8 ("drm/xe/xe2hpg: Add Wa_16025250150") Reviewed-by: Matt Atwood Link: https://patch.msgid.link/20260319-wa_16025250150_part2-v1-1-46b1de1a31b2@intel.com Signed-off-by: Matt Roper commit bb6da652c585c397fc2c98df9e7534197e1b1cb1 Author: Varun R Mallya Date: Mon Mar 23 13:41:31 2026 +0530 selftests/bpf: Improve connect_force_port test reliability The connect_force_port test fails intermittently in CI because the hardcoded server ports (60123/60124) may already be in use by other tests or processes [1]. Fix this by passing port 0 to start_server(), letting the kernel assign a free port dynamically. The actual assigned port is then propagated to the BPF programs by writing it into the .bss map's initial value (via bpf_map__initial_value()) before loading, so the BPF programs use the correct backend port at runtime. [1] https://github.com/kernel-patches/bpf/actions/runs/22697676317/job/65808536038 Suggested-by: Jiayuan Chen Signed-off-by: Varun R Mallya Signed-off-by: Martin KaFai Lau Reviewed-by: Sun Jian Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260323081131.65604-1-varunrmallya@gmail.com commit 470891606c5a97b1d0d937e0aa67a3bed9fcb056 Author: Yang Wang Date: Thu Mar 19 21:17:38 2026 -0400 drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 Forcibly disable the OD_FAN_CURVE feature when temperature or PWM range is invalid, otherwise PMFW will reject this configuration on smu v13.0.x example: $ sudo cat /sys/bus/pci/devices//gpu_od/fan_ctrl/fan_curve OD_FAN_CURVE: 0: 0C 0% 1: 0C 0% 2: 0C 0% 3: 0C 0% 4: 0C 0% OD_RANGE: FAN_CURVE(hotspot temp): 0C 0C FAN_CURVE(fan speed): 0% 0% $ echo "0 50 40" | sudo tee fan_curve kernel log: [ 756.442527] amdgpu 0000:03:00.0: amdgpu: Fan curve temp setting(50) must be within [0, 0]! [ 777.345800] amdgpu 0000:03:00.0: amdgpu: Fan curve temp setting(50) must be within [0, 0]! Closes: https://github.com/ROCm/amdgpu/issues/208 Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 896ffa9847c3d00895fa7f6da5b7e2c141189c9b Author: Lijo Lazar Date: Mon Feb 23 16:28:22 2026 +0530 drm/amdgpu: Use stack variable to fetch nps info Instead of a dynamic allocation, use stack variable and let the caller pass the maximum ranges that can be held in the buffer. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit d31ed58e2988d4a733242d6900920c9af39db8bb Author: Hou Wenlong Date: Mon Mar 16 11:46:29 2026 +0800 drm/amd/display: Rename enum 'pixel_format' to 'dc_pixel_format' Rename the enum 'pixel_format' to 'dc_pixel_format' to avoid potential name conflicts with the pixel_format struct defined in include/video/pixel_format.h. Signed-off-by: Hou Wenlong Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 7aaa09ab30c788038e3996c17c3fb5a7be53e6cd Author: Asad Kamal Date: Wed Jan 7 11:50:21 2026 +0800 drm/amd/pm: Enable user specified gfx clock ranges Enable user specified gfx clock ranges for smu_15_0_8 Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit df4929d76aa29f32c255f60bab4ebe862dc7c9a3 Author: Hawking Zhang Date: Sun Nov 2 19:55:53 2025 +0800 drm/amdgpu: Add smu v15_0_8 ip block Add smu v15_0_8 ip block Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit 6a609b800c9ed8d4bdb44362c8d04afa41d44d21 Author: Asad Kamal Date: Fri Jan 30 21:20:58 2026 +0800 drm/amd/pm: Add NPM support for smu_v15_0_8 Add node power management support for smu_v15_0_8 Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 8847d59969eb38519b4790404248fa6828956daf Author: Asad Kamal Date: Fri Jan 30 21:18:29 2026 +0800 drm/amd/pm: Add baseboard temperature metrics support Add baseboard temperature metrics support via system metrics table for smu_v15_0_8 v4: Add separate function to fill baseboard temperature, use 16, remove casting v5: Optimize to use single switch case (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit e3b96f5b20ab5178ded733351048ce64bb989a9e Author: Asad Kamal Date: Fri Jan 30 21:10:47 2026 +0800 drm/amd/pm: Add gpuboard temperature metrics support Add gpuboard temperature metrics support via system metrics table for smu_v15_0_8 v3: Use per sensor attr id (Lijo) v4: Use s16 for temp, remove cast, use separate function to fill gpuboard temperature metrics data (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 1415503db03b0e44f2d70d2c2c87c83c6fed9f46 Author: Asad Kamal Date: Fri Dec 26 13:12:56 2025 +0800 drm/amd/pm: Add read sensor support Add read sensor support for smu_v15_0_8 v2: Remove gfx voltage support (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit a6c2ecd95ef0e6e06db4a76fbeafdea1f742e280 Author: Asad Kamal Date: Fri Dec 26 13:00:48 2025 +0800 drm/amd/pm: Add ppt1 support Add ppt1 support for smu_v15_0_8 Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit bc296e6c9564b952d9f2ecae5de6c8c7d38c3a25 Author: Asad Kamal Date: Fri Dec 26 00:30:41 2025 +0800 drm/amd/pm: Add get_thermal_temperature_range support Add get_thermal_temperature_range support smu_v15_0_8 v2: Remove sriov check (Lijo) v3: Restrict to 1VF mode(Lijo) Signed-off-by: Asad Kamal Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 422b399b09c7b4fd60b01a5635fbb73e8d9a1154 Author: Asad Kamal Date: Fri Dec 26 00:13:13 2025 +0800 drm/amd/pm: Add od_edit_dpm_table support Add od_edit_dpm_table support for smu_v15_0_8 v2: Skip Gl2clk/Fclk (Lijo) v3: sqaush in set_performance_support (Asad) Signed-off-by: Asad Kamal Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit c7de5a863c63de621843ed964a10662408e974f2 Author: Asad Kamal Date: Thu Dec 25 23:44:20 2025 +0800 drm/amd/pm: add populate_umd_state_clk support add populate_umd_state_clk support for smu 15.0.8 v2: remove gl2clk/socclk/fclk, restrict to only current min/max (Lijo) Signed-off-by: Asad Kamal Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 3f5c75634fb5dfa4896e74f39e8b04e879fb4de9 Author: Srinivasan Shanmugam Date: Tue Mar 17 08:38:38 2026 +0530 drm/amd/display: Fix NULL pointer assumptions in dcn42_init_hw() dcn42_init_hw() calls update_bw_bounding_box() when FAMS2 is disabled or when the dchub reference clock changes. However the existing condition mixes the callback pointer check with only one side of the || expression: ((!fams2_enable && update_bw_bounding_box) || freq_changed) This allows the block to be entered through the freq_changed path even when update_bw_bounding_box() is NULL. The function is then called unconditionally inside the block, which can lead to a NULL pointer dereference. Additionally, the code dereferences dc->clk_mgr->bw_params without verifying that dc->clk_mgr and bw_params are valid. Restructure the condition so that the update trigger remains the same (FAMS2 disabled or dchub ref clock changed), but guard the call with explicit checks for: - update_bw_bounding_box callback - dc->clk_mgr - dc->clk_mgr->bw_params Also introduce a helper boolean (dchub_ref_freq_changed) to improve readability of the clock-change condition. This fixes Smatch warnings about inconsistent NULL assumptions in dcn42_init_hw(). drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn42/dcn42_hwseq.c:264 dcn42_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 253) drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn42/dcn42_hwseq.c:278 dcn42_init_hw() error: we previously assumed 'dc->res_pool->funcs->update_bw_bounding_box' could be null (see line 274) Cc: Roman Li Cc: Alex Hung Cc: Jerry Zuo Cc: Sun peng Li Cc: Tom Chung Cc: Dan Carpenter Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit b4a8a2aba4e3a02ebbf8d2708fcafd491ebd4644 Author: Srinivasan Shanmugam Date: Sun Mar 15 20:11:54 2026 +0530 drm/amd/display: Add clk_mgr NULL checks in dcn32_initialize_min_clocks() dcn32_init_hw() checks dc->clk_mgr before calling init_clocks(), so the clock manager is not treated as unconditionally present on this path. However, dcn32_initialize_min_clocks() later dereferences dc->clk_mgr, bw_params, and clk_mgr callbacks without validating them. Add the required guards in dcn32_initialize_min_clocks() before accessing clk_mgr-dependent state, and check callback presence before calling get_dispclk_from_dentist() and update_clocks(). Also guard the later update_bw_bounding_box() call in the FAMS2-disabled path since it also dereferences dc->clk_mgr->bw_params. This keeps clk_mgr handling consistent in the DCN32 HW init flow and avoids possible NULL pointer dereferences reported by Smatch. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:1012 dcn32_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 978) Cc: Roman Li Cc: Alex Hung Cc: Jerry Zuo Cc: Sun peng Li Cc: Tom Chung Cc: Dan Carpenter Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit bf39c461ada3f81e2cae487a402c03ce282a545c Author: Asad Kamal Date: Wed Dec 24 03:54:11 2025 +0800 drm/amd/pm: Add emit clock support Add emit clock support and fetching other metrics data like temperature, clock for smu_v15_0_8 v2: Use umc count for hbm stack temperature (Lijo) v3: Use correct logic for hbm stacks (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit e20e47bcb3f1e90e2fd8bd8b543224d1bdd3ba3f Author: Yang Wang Date: Wed Oct 22 21:32:55 2025 +0800 drm/amd/pm: add set{get}_power_limit support for smu 15.0.8 export .set_power_limit & .get_power_limit interface for smu 15.0.8 Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 39e0a73bdeb0890718260d0bde256ef50288bb80 Author: Yang Wang Date: Wed Oct 22 21:08:13 2025 +0800 drm/amd/pm: add get_unique_id support for smu 15.0.8 export .get_unique_id interface for smu 15.0.8 Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 0a66ca3b351f107fdc485cb5c3b4b76ab0c1e4e5 Author: Yang Wang Date: Thu Oct 23 11:04:40 2025 +0800 drm/amd/pm: add get_gpu_metrics support for 15.0.8 export .get_gpu_metrics interface for 15.0.8 v2: Remove members already exposed by other interfaces, use mask, logical conversion (Lijo) v3: Use correct logic for hbm stacks loop (Lijo) Remove buffer allocation v4: Make out of bound check outside loop (Lijo) v5: fix locking in error case (Alex) Signed-off-by: Yang Wang Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 6bcea37ff26bcbfd04d39b00855e72f890412c5b Author: Asad Kamal Date: Wed Nov 26 18:41:34 2025 +0800 drm/amd/pm: Add get_pm_metrics support for smu 15.0.8 export .get_pm_metrics interface for smu 15.0.8. v2: Make tmo as unsigned (Lijo) Signed-off-by: Yang Wang Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 34b19dab0c075e1a715537590af5f4cee5610633 Author: Asad Kamal Date: Wed Dec 24 00:33:49 2025 +0800 drm/amd/pm: Add default dpm table support for smu 15.0.8 Add default dpm table support for smu 15.0.8 v2: Remove lclk, move pptable check up, add missing clk (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit f7bee962d92ad628f0ba8d14db6069547b84bd40 Author: Asad Kamal Date: Tue Dec 23 23:35:32 2025 +0800 drm/amd/pm: Update dpm table structs for smu_v15_0 Update dpm table structs to use common definitions for smu_15_0 Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 611e5af419c2d220c6fc7b45a013382fd1eef49b Author: Yang Wang Date: Wed Nov 26 16:02:41 2025 +0800 drm/amd/pm: Setup driver pptable for smu 15.0.8 Setup driver pptable and initialize data from static metrics table for smu_v15_0_8 v2: Remove unrelated changes and update description (Lijo) v3: Use ARRAY_SIZE (Lijo) v4: Move structure to header file v5: squash in static metrics support (Asad) Signed-off-by: Yang Wang Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit fde815f76fa060ce5540776f2365f1bdf5cda845 Author: Asad Kamal Date: Tue Nov 25 01:19:13 2025 +0800 drm/amd/pm: Add mode2 support for smu_v15_0_8 Add initial mode2 support for smu_v15_0_8 v2: Move out non smu code, remove pci save/restore logic (Lijo) v3: squash in updated msg (Alex) Signed-off-by: Asad Kamal Reviewed-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 2beedc3a92b726f05c81127b7578faa505e4ba1e Author: Hawking Zhang Date: Mon Nov 3 13:39:38 2025 +0800 drm/amd/pm: Add initial support for smu v15_0_8 smu v15_0_8 is the new generation of smu ip block v2: Squash in rebase changes (Alex) v3: Squash in fw version check changes (Alex) Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 8f402ddd4f2321485fff7384c003124681a08146 Author: Sunil Khatri Date: Fri Mar 20 17:29:01 2026 +0530 drm/amdgpu/userq: cleanup amdgpu_userq_get/put where not needed amdgpu_userq_put/get are not needed in case we already holding the userq_mutex and reference is valid already from queue create time or from signal ioctl. These additional get/put could be a potential reason for deadlock in case the ref count reaches zero and destroy is called which again try to take the userq_mutex. Due to the above change we avoid deadlock between suspend/restore calling destroy queues trying to take userq_mutex again. Cc: Prike Liang Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 5da89a8afca14a266e82d2c99e0bd5ae6db23611 Author: Asad Kamal Date: Fri Mar 13 17:11:03 2026 +0800 drm/amd/pm: Add custom fclk setting support Add custom fclk setting support for smu_v13_x_x v2: Move uclk fix to separate patch, return EOPNOTSUPP in case of dpm disabled (Lijo) v3: remove dpm check for filling fclk pstate table (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 069a3b425317de22ac5d14163d4045ad6aba164a Author: Asad Kamal Date: Fri Mar 13 13:39:21 2026 +0800 drm/amd/pm: Add OD_FCLK interface Add OD_FCLK interface to set customa fclk max v2: Merge patch1 & 3, check EOPNOTSUPP for all clks (Lijo) v3: Remove redundant check (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit d82e0a72d9189e8acd353988e1a57f85ce479e37 Author: Asad Kamal Date: Wed Mar 18 13:52:57 2026 +0800 drm/amd/pm: Return -EOPNOTSUPP for unsupported OD_MCLK on smu_v13_0_6 When SET_UCLK_MAX capability is absent, return -EOPNOTSUPP from smu_v13_0_6_emit_clk_levels() for OD_MCLK instead of 0. This makes unsupported OD_MCLK reporting consistent with other clock types and allows callers to skip the entry cleanly. Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 17f11bbbc76c8e83c8474ea708316b1e3631d927 Author: Asad Kamal Date: Wed Mar 18 13:48:30 2026 +0800 drm/amd/pm: Skip redundant UCLK restore in smu_v13_0_6 Only reapply UCLK soft limits during PP_OD_RESTORE_DEFAULT when the current max differs from the DPM table max. This avoids redundant SMC updates and prevents -EINVAL on restore when no change is needed. Fixes: b7a900344546 ("drm/amd/pm: Allow setting max UCLK on SMU v13.0.6") Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit e65e749941bb686bb7a6dce996c44707bb8474be Author: Stanley.Yang Date: Thu Feb 26 11:41:48 2026 +0800 drm/amdgpu: Add amdgpu_regs_pcie64 debugfs node Add amdgpu_regs_pcie64 debugfs node to read/write 64bit PCIE registers. Signed-off-by: Stanley.Yang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 38f471d38be6629a38ed12377937927b8086894e Author: Taimur Hassan Date: Fri Mar 13 17:42:59 2026 -0500 drm/amd/display: Promote DC to 3.2.375 This version brings along following fixes: - Rework YCbCr422 DSC policy - Restore full update for tiling change to linear - add dccg FGCG mask init - Remove unnecessary completion flag for secure display - Agument live + capture with CVT case. - remove dc_clock_limit for apu - Fix Signed/Unsigned Int Usage Compiler Warning - Hardcode dtbclk value in bw_params - Revert inbox0 lock for cursor due to deadlock - Add 3DLUT DMA broadcast support - Fix Silence warnings - export get_power_profile interface for later use - pg cntl update based on previous asic. - remove disable_sutter touch pstate debug code - Refactor DC update checks - Fix drm_edid leak in amdgpu_dm - Add Extra SMU Log for dtbclk - Clamp min DS DCFCLK value to DCN limit - Update dpia supported configuration - Multiple DCN42 updates Acked-by: ChiaHsuan Chung Signed-off-by: Taimur Hassan Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 19b79e4f21825b5e61ac9ac6db76327677dd8b6e Author: Relja Vojvodic Date: Wed Mar 11 17:02:24 2026 -0400 drm/amd/display: Rework YCbCr422 DSC policy - Reworked YCbCr4:2:2 Native/Simple policy decision making with DSC enabled based on DSC caps and stream signal type Reviewed-by: Wenjing Liu Signed-off-by: Relja Vojvodic Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 3967ab83a5075c05be3c614f1dc8460f66ee77ad Author: Joshua Aberback Date: Thu Mar 12 18:33:49 2026 -0400 drm/amd/display: Restore full update for tiling change to linear [Why] There was previously a dc debug flag to indicate that tiling changes should only be a medium update instead of full. The function get_plane_info_type was refactored to not rely on dc state, but in the process the logic was unintentionally changed, which leads to screen corruption in some cases. [How] - add flag to tiling struct to avoid full update when necessary Reviewed-by: Nicholas Kazlauskas Reviewed-by: Aric Cyr Signed-off-by: Joshua Aberback Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 94cd4c4d71e67e84c713492c5eea6c2370601bf2 Author: Charlene Liu Date: Thu Mar 12 19:33:33 2026 -0400 drm/amd/display: add dccg FGCG mask init [why] missing DCCG_GLOBAL_FGCG_REP_DIS mask macro init Reviewed-by: Swapnil Patel Signed-off-by: Charlene Liu Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 601fcb5f05a62c20857a39dac175285c3b664743 Author: Wayne Lin Date: Fri Mar 13 12:05:40 2026 +0800 drm/amd/display: Remove unnecessary completion flag for secure display The completion flag is not used in secure display today. Remove unnecessary code. Reviewed-by: Tom Chung Signed-off-by: Wayne Lin Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 0e4e84de43d6bc8ec04be80d851f9007348702de Author: ChunTao Tso Date: Wed Mar 4 16:37:58 2026 +0800 drm/amd/display: Agument live + capture with CVT case. 1. Add LIVE_CAPTURE_WITH_CVT bit (bit[2]) in union replay_optimization to control this feature via DalRegKey_ReplayOptimization. 2. Check the bit in mod_power_set_live_capture_with_cvt_activate function before enabling live capture with CVT. 3. Use LIVE_CAPTURE_WITH_CVT to control if Replay want to send CVT in live + capture or not. Reviewed-by: Leon Huang Signed-off-by: ChunTao Tso Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit a1d840a51aa3c30c025a581af10058be2ada301c Author: Charlene Liu Date: Wed Mar 11 17:05:19 2026 -0400 drm/amd/display: remove dc_clock_limit for apu [why] current apu pmfw does not support dc_clock_limit Reviewed-by: Roman Li Signed-off-by: Charlene Liu Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 370b132a3ed5c80093b668bb518984bfff6638fb Author: Gaghik Khachatrian Date: Thu Mar 12 10:21:43 2026 -0400 drm/amd/display: Fix Signed/Unsigned Int Usage Compiler Warning [Why] Compiler generates compiler warnings when signed enum constants or literal -1 are implicitly converted to unsigned integer types, cluttering build output and masking genuine issues. [How] Use UINT_MAX as the invalid sentinel for unsigned IDs and align loop/index types to unsigned where appropriate to remove implicit signed-to-unsigned conversions, with no functional behavior change. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Gaghik Khachatrian Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 64fd3f93a85051d765d04efa59c13f03fdc9d286 Author: Matthew Stewart Date: Wed Mar 11 15:16:00 2026 -0400 drm/amd/display: Hardcode dtbclk value in bw_params [why&how] dtbclk should always be 600MHz. Previous logic was to get the real value from SMU, but this returns 0 when dtbclk is off. Not a problem during boot when pre-OS enables dtbclk, but PnP was broken due to this. Reviewed-by: Charlene Liu Reviewed-by: Nicholas Kazlauskas Signed-off-by: Matthew Stewart Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 05112f1fc363d19105ecfce3eec637e63b50cde8 Author: Ivan Lipski Date: Tue Mar 3 20:07:58 2026 -0500 drm/amd/display: Move DPM clk read to clk_mgr_construct in DCN42 [Why&How] The DPM clocks on DCN42 are currently read on every dm_resume, which can cause in gpu memory freeing while the device is still in suspend. Move the DPM clock read functionality to clk_mgr_construct() so it completes once on driver enablement. Reviewed-by: Charlene Liu Signed-off-by: Ivan Lipski Signed-off-by: Dmytro Laktyushkin Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 3cf496080f539b69f069027cece82642b46a6cb5 Author: Nicholas Kazlauskas Date: Tue Mar 10 16:33:44 2026 -0400 drm/amd/display: Revert inbox0 lock for cursor due to deadlock [Why] A deadlock occurs when using inbox0 lock for cursor operations on PSR-SU and Replays that does not when using the inbox1 locking path. This is because of a priority inversion issue where inbox1 work cannot be serviced while holding the HW lock from driver and sending cursor notifications to DMUB. Typically the lower priority of inbox1 for the lock command would allow the PSR and Replay FSMs to complete their transition prior to giving driver the lock but this is no longer the case with inbox0 having the highest priority in servicing. [How] This will reintroduce any synchronization bugs that were there with Replay or PSR-SU touching the cursor at the same time as driver. Reviewed-by: Charlene Liu Signed-off-by: Nicholas Kazlauskas Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 7d59465de38e8cbebf55f122b0514de10f52852c Author: Dillon Varone Date: Sat Mar 7 05:53:03 2026 +0000 drm/amd/display: Add 3DLUT DMA broadcast support [WHY&HOW] A single HUBP can be used to fetch 3DLUT and broadcast to a single HUBP. Add logic to select the top pipe for a given plane and use it's HUBP as the broadcast source for multiple MPC's. Reviewed-by: Ilya Bakoulin Signed-off-by: Dillon Varone Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 60e8ffaf96267e8c520ffa9411f4893ace7a0a11 Author: Gaghik Khachatrian Date: Sat Mar 7 18:57:57 2026 -0500 drm/amd/display: Fix Silence warnings Also affects: freesync, hdcp, info_packet, power [Why] Resolve compiler warnings by marking unused parameters explicitly. [How] In .c/.h keep parameter names in signatures and add a line with `(void)param;` inside the function body Preserved function signatures and avoids breaking code paths that may reference the parameter under conditional compilation. Reviewed-by: Aric Cyr Signed-off-by: Gaghik Khachatrian Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit a3c7ab163ba9ca4f7d9f85d271c7b8dd47e5f540 Author: Charlene Liu Date: Fri Mar 6 10:40:07 2026 -0500 drm/amd/display: export get_power_profile interface for later use [why] export dcn401 get_power_profile for later asic. Reviewed-by: Roman Li Signed-off-by: Charlene Liu Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit fc2591175507709191c2010a7eb466837496750d Author: Charlene Liu Date: Tue Mar 10 10:53:08 2026 -0400 drm/amd/display: pg cntl update based on previous asic. [why] switch to well tested sequence. Reviewed-by: Leo Chen Signed-off-by: Charlene Liu Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 3eb8ae187d35e75bbdcb5c4410b33a70ef6b1355 Author: Charlene Liu Date: Tue Mar 10 13:33:55 2026 -0400 drm/amd/display: remove disable_sutter touch pstate debug code [why] diags is using disable_stutter, this will cause issue when pstate switch enabled Reviewed-by: Ilya Bakoulin Signed-off-by: Charlene Liu Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit c24bb00cc6cfef4afe71de8b9bb5c809a49888f2 Author: Dillon Varone Date: Thu Mar 5 16:42:29 2026 -0500 drm/amd/display: Refactor DC update checks [WHY&HOW] DC currently has fragmented definitions of update types. This changes consolidates them into a single interface, and adds expanded functionality to accommodate all use cases. - adds `dc_check_update_state_and_surfaces_for_stream` to determine update type including state, surface, and stream changes. - adds missing surface/stream update checks to `dc_check_update_surfaces_for_stream` - adds new update type `UPDATE_TYPE_ADDR_ONLY` to accomodate flows where further distinction from `UPDATE_TYPE_FAST` was needed - removes caller reliance on `enable_legacy_fast_update` to determine which commit function to use, instead embedding it in the update type Reviewed-by: Nicholas Kazlauskas Signed-off-by: Dillon Varone Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 52024a94e7111366141cfc5d888b2ef011f879e5 Author: Alex Hung Date: Mon Mar 9 11:16:08 2026 -0600 drm/amd/display: Fix drm_edid leak in amdgpu_dm [WHAT] When a sink is connected, aconnector->drm_edid was overwritten without freeing the previous allocation, causing a memory leak on resume. [HOW] Free the previous drm_edid before updating it. Reviewed-by: Roman Li Signed-off-by: Alex Hung Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 6c006fac2c17797510691c1848320a1659ff58b4 Author: Alexander Chechik Date: Mon Mar 9 13:15:24 2026 -0400 drm/amd/display: Fix DCN42 memory clock table using MemClk instead of UClk [Why] DCN42 was using UClk values instead of MemClk from MemPstateTable, causing DML to see half the actual DRAM bandwidth on DDR5 systems and reject high refresh rate modes. [How] Change dcn42_init_clocks() to use MemPstateTable[i].MemClk instead of MemPstateTable[i].UClk for memclk_mhz initialization. Reviewed-by: Charlene Liu Signed-off-by: Alexander Chechik Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit deab056486f4e9945d403ea0ef812a593b7f438e Author: Charlene Liu Date: Thu Mar 5 20:23:25 2026 -0500 drm/amd/display: Add Extra SMU Log for dtbclk [why] need to check dtbclk in log for confirmation Reviewed-by: Gabe Teeger Signed-off-by: Charlene Liu Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit c096932fd4f72f89fed0b80df473f3af8217d818 Author: Roman Li Date: Mon Mar 16 20:17:57 2026 -0400 drm/amd/display: Update underflow detection for DCN42 [Why] The DCN42 underflow detection functions in dcn42_optc.c use OPTC_RSMU_UNDERFLOW register but the register offset definitions were missing from dcn_4_2_0_offset.h and dcn42_resource.h. [How] Add missing register definitions. Fixes: e56e3cff2a1b ("drm/amd/display: Sync dcn42 with DC 3.2.373") Reviewed-by: Alex Hung Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 68bd4f6b8310f309eb63b41e15088690c9cec0a9 Author: Christian König Date: Tue Feb 3 17:30:57 2026 +0100 drm/amdgpu: fix some more bug in amdgpu_gem_va_ioctl Some illegal combination of input flags were not checked and we need to take the PDEs into account when returning the fence as well. Signed-off-by: Christian König Acked-by: Sunil Khatri Signed-off-by: Alex Deucher commit 5a90bb2160394fc2fb835ad8142891aea194fe3c Author: Roman Li Date: Fri Mar 13 20:34:48 2026 -0400 drm/amd/display: Clamp min DS DCFCLK value to DCN limit [why & how] DCN has a global limit for minimum DS DCFCLK during any operation. Adhere to that limit and add a debug flag. Reviewed-by: Charlene Liu Signed-off-by: Ovidiu Bunea Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit cb50faeb0d7585fed52231627d632462b9f927b0 Author: Nicholas Kazlauskas Date: Mon Mar 2 10:47:34 2026 -0500 drm/amd/display: Split arbiter programming for DCN42 [Why] We don't want to update the timeout threshold for stall recovery in firmware dynamically for DCN42 as we're not using FAMS. Firmware should own programming of this register since the recovery can be broken if driver updates the value to 0. [How] Split program_arbiter for dcn42 and skip the part that updates the timeout threshold. Reviewed-by: Leo Chen Signed-off-by: Nicholas Kazlauskas Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit c446748aa3f233451955bf63ac9887047fe13e73 Author: Roman Li Date: Fri Mar 13 20:27:54 2026 -0400 drm/amd/display: Add missing dcn42 hubbub function pointers This aligning commit combines: - fix dcn42 det programming) - fix missing dcn42 pointers - fix SDPIF_Request_Rate_Limit programming value V2: Add back dchvm_init for DCN42 Reviewed-by: Alex Hung Reviewed-by: Leo Chen Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit b6c0783ff278671e38fed978fefb732101ac8836 Author: Roman Li Date: Fri Mar 13 19:34:02 2026 -0400 drm/amd/display: Add get_default_tiling_info for dcn42 Add DCN42 portion that was stripped during previously. Fixes: 8333f22e44a9 ("drm/amd/display: Query DC for gfx handling when setting linear tiling") Reviewed-by: Alex Hung Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 418e0eaf72caed1938ae4507494f239b8941a8ef Author: Dmytro Laktyushkin Date: Thu Mar 5 14:47:03 2026 -0500 drm/amd/display: move dcn42 bw_params init Move it out of smu present block for cases where it isn't Reviewed-by: Ivan Lipski Signed-off-by: Dmytro Laktyushkin Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 6c36d8b0c93f18c97d26f92d13945ddc56e4fd86 Author: Charlene Liu Date: Thu Mar 5 10:14:39 2026 -0500 drm/amd/display: System Hang When System enters to S0i3 w/ iGPU [why] System Hang when system enters to S0i3 w/ iGPU some link_enc are NULL due to BIOS integration info table not correct, but driver should have enough null pointer protection. Reviewed-by: Leo Chen Signed-off-by: Charlene Liu Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 058cb97b730f2b47f168d843cd82832bca6babf1 Author: Ivan Lipski Date: Tue Mar 3 20:07:58 2026 -0500 drm/amd/display: Move DPM clk read to clk_mgr_construct in DCN42 [Why&How] The DPM clocks on DCN42 are currently read on every dm_resume, which can cause in gpu memory freeing while the device is still in suspend. Move the DPM clock read functionality to clk_mgr_construct() so it completes once on driver enablement. Reviewed-by: Charlene Liu Signed-off-by: Ivan Lipski Signed-off-by: Dmytro Laktyushkin Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 24ccc041f0a8100cc7aae822a3328b276039fe59 Author: Nicholas Kazlauskas Date: Mon Mar 2 15:02:33 2026 -0500 drm/amd/display: Add MRQ programming for DCN42 [Why] DCN401 didn't have a MRQ present so these fields didn't exist. They are still present on DCN42 so we need to continue programming them like we did on DCN35 or we can block have poor meta requesting efficiency which blocks p-state. [How] Add `hubp42_program_requestor` which takes DML21 input and programs the registers like DCN35 and prior. Reviewed-by: Leo Chen Signed-off-by: Nicholas Kazlauskas Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 31ea7b0ef35e6d986cbff2a59e8f3d2cd2ae3810 Author: Charlene Liu Date: Mon Mar 2 15:45:41 2026 -0500 drm/amd/display: dcn42 don't round up disclk and dppclk [why] dml2 based on num_enabled clock != 2 to do clock ramming to dpm. apu has 8 levels dispclk/dppclk/dcfclk/fclk, but only 4 levels of memclk. to avoid mapping dispclk/dppclk to DPM clock, based on arch review, force dispclk/dppclk num_level as 2. Reviewed-by: Dillon Varone Signed-off-by: Charlene Liu Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit a37fb5166be943fa78962f77db00ce5a25366e87 Author: Kexin Sun Date: Sat Mar 21 18:59:40 2026 +0800 spi: pl022: update outdated references to pump_transfers() The pump_transfers tasklet was removed when the driver switched to the SPI core message processing loop in commit 9b2ef250b31d ("spi: spl022: switch to use default spi_transfer_one_message()"). The kdoc of pl022_interrupt_handler() still describes the old flow: scheduling the pump_transfers tasklet, calling giveback(), and flagging STATE_ERROR — none of which exist in the current code. Rewrite the kdoc to reflect the current paths, which flag errors via SPI_TRANS_FAIL_IO and call spi_finalize_current_transfer() directly. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260321105940.8143-1-kexinsun@smail.nju.edu.cn Signed-off-by: Mark Brown commit 71488869d933b49d4a7d4b2b20448b6f285327bb Author: Meenakshikumar Somasundaram Date: Thu Jan 22 11:33:10 2026 -0500 drm/amd/display: Update dpia supported configuration [Why & How] Init a flag to track if dpia enabled previously and update that to boot options. Reviewed-by: Ovidiu Bunea Signed-off-by: Meenakshikumar Somasundaram Signed-off-by: Roman Li Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher commit 8f1de51f49be692de137c8525106e0fce2d1912d Author: Eric Huang Date: Mon Mar 16 11:01:30 2026 -0400 drm/amdgpu: prevent immediate PASID reuse case PASID resue could cause interrupt issue when process immediately runs into hw state left by previous process exited with the same PASID, it's possible that page faults are still pending in the IH ring buffer when the process exits and frees up its PASID. To prevent the case, it uses idr cyclic allocator same as kernel pid's. Signed-off-by: Eric Huang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 94d79f51efecb74be1d88dde66bdc8bfcca17935 Author: Ruijing Dong Date: Tue Mar 17 13:54:11 2026 -0400 drm/amdgpu: fix strsep() corrupting lockup_timeout on multi-GPU (v3) amdgpu_device_get_job_timeout_settings() passes a pointer directly to the global amdgpu_lockup_timeout[] buffer into strsep(). strsep() destructively replaces delimiter characters with '\0' in-place. On multi-GPU systems, this function is called once per device. When a multi-value setting like "0,0,0,-1" is used, the first GPU's call transforms the global buffer into "0\00\00\0-1". The second GPU then sees only "0" (terminated at the first '\0'), parses a single value, hits the single-value fallthrough (index == 1), and applies timeout=0 to all rings — causing immediate false job timeouts. Fix this by copying into a stack-local array before calling strsep(), so the global module parameter buffer remains intact across calls. The buffer is AMDGPU_MAX_TIMEOUT_PARAM_LENGTH (256) bytes, which is safe for the stack. v2: wrap commit message to 72 columns, add Assisted-by tag. v3: use stack array with strscpy() instead of kstrdup()/kfree() to avoid unnecessary heap allocation (Christian). This patch was developed with assistance from Claude (claude-opus-4-6). Assisted-by: Claude:claude-opus-4-6 Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Ruijing Dong Signed-off-by: Alex Deucher commit f9a4e81bcbd04e6f967d851f9fe69d8bb3cc08b3 Author: Alex Deucher Date: Thu Feb 19 18:20:27 2026 -0500 drm/amdgpu/gfx11: look at the right prop for gfx queue priority Look at hqd_queue_priority rather than hqd_pipe_priority. In practice, it didn't matter as both were always set for kernel queues, but that will change in the future. Fixes: 2e216b1e6ba2 ("drm/amdgpu/gfx11: handle priority setup for gfx pipe1") Reviewed-by：Jesse Zhang Signed-off-by: Alex Deucher commit 355d96cdec5c61fd83f7eb54f1a28e38809645d6 Author: Alex Deucher Date: Thu Feb 19 18:18:28 2026 -0500 drm/amdgpu/gfx10: look at the right prop for gfx queue priority Look at hqd_queue_priority rather than hqd_pipe_priority. In practice, it didn't matter as both were always set for kernel queues, but that will change in the future. Fixes: b07d1d73b09e ("drm/amd/amdgpu: Enable high priority gfx queue") Reviewed-by：Jesse Zhang Signed-off-by: Alex Deucher commit e471627d56272a791972f25e467348b611c31713 Author: Alex Deucher Date: Tue Mar 17 16:34:41 2026 -0400 drm/amdgpu/pm: drop SMU driver if version not matched messages It just leads to user confusion. Cc: Yang Wang Cc: Lijo Lazar Reviewed-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 197b69a5677a32b24abb641bf02eec5314ef7732 Author: Srinivasan Shanmugam Date: Thu Mar 19 16:27:19 2026 +0530 drm/amdgpu: Skip discovery dump when topology is unavailable When generating a devcoredump, amdgpu_discovery_dump() prints the IP discovery topology. The function already needs to handle the case where adev->discovery.ip_top is NULL to avoid a crash. Currently, the code prints a section header and an additional message when the topology is unavailable. However, for platforms where discovery is not used, this section is not expected to be present. Printing an extra message adds unnecessary output. Simplify this by skipping the entire section when ip_top is NULL. The NULL check is kept to avoid a crash, but no output is generated when the discovery topology is unavailable. Cc: Pierre-Eric Pelloux-Prayer Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 2ccdefeec7e333e583d99c7619e8fa1d97dde013 Author: Srinivasan Shanmugam Date: Thu Mar 19 11:00:00 2026 +0530 drm/amd/ras: Add input pointer validation in ras core helpers Add NULL checks for helper input/output pointers that are directly dereferenced, such as tm, seqno, dev_info and init_config. Cc: Tao Zhou Cc: YiPeng Chai Cc: Dan Carpenter Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher commit e495c688edf44e140db001dcdb12548093291b84 Author: Srinivasan Shanmugam Date: Thu Mar 19 11:10:10 2026 +0530 drm/amd/ras: Add NULL checks for ras_core sys_fn callbacks Some ras core helper functions access ras_core and its callback table (sys_fn) without validating them first. Cc: Tao Zhou Cc: YiPeng Chai Cc: Dan Carpenter Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher commit fc61df1516178958d7e61ec52c05257d92e9f2e8 Author: Christian König Date: Mon Feb 2 13:06:25 2026 +0100 drm/amdgpu: annotate eviction fence signaling path Make sure lockdep sees the dependencies here. Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit 809773e06692b9feef372c56ca0747cce9bbf860 Author: Srinivasan Shanmugam Date: Wed Mar 18 10:15:09 2026 +0530 drm/amdgpu: Avoid NULL dereference in discovery topology coredump path v3 When a GPU fault or timeout happens, the driver creates a devcoredump to collect debug information. During this, amdgpu_devcoredump_format() calls amdgpu_discovery_dump() to print IP discovery data. amdgpu_discovery_dump() uses: adev->discovery.ip_top and then accesses: ip_top->die_kset amdgpu_discovery_dump() uses adev->discovery.ip_top. However, ip_top may be NULL if the discovery topology was never initialized. The current code does not check for this before using ip_top. As a result, when ip_top is NULL, the coredump worker crashes while taking the spinlock for ip_top->die_kset. Fix this by checking for a missing ip_top before walking the discovery topology. If it is unavailable, print a short message in the dump and return safely. - If ip_top is NULL, print a message and skip the dump - Also add the same check in the cleanup path This makes the coredump and cleanup paths safe even when the discovery topology is not available. KASAN trace: [ 522.228252] [IGT] amd_deadlock: starting subtest amdgpu-deadlock-sdma [ 522.240681] [IGT] amd_deadlock: starting dynamic subtest amdgpu-deadlock-sdma ... [ 522.952317] Write of size 4 at addr 0000000000000050 by task kworker/u129:5/5434 [ 522.937526] BUG: KASAN: null-ptr-deref in _raw_spin_lock+0x66/0xc0 [ 522.967659] Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu] ... [ 522.969445] Call Trace: [ 522.969508] _raw_spin_lock+0x66/0xc0 [ 522.969518] ? __pfx__raw_spin_lock+0x10/0x10 [ 522.969534] amdgpu_discovery_dump+0x61/0x530 [amdgpu] [ 522.971346] ? pick_next_task_fair+0x3f6/0x1c60 [ 522.971363] amdgpu_devcoredump_format+0x84f/0x26f0 [amdgpu] [ 522.973188] ? __pfx_amdgpu_devcoredump_format+0x10/0x10 [amdgpu] [ 522.975012] ? psi_task_switch+0x2b5/0x9b0 [ 522.975027] ? __pfx___drm_printfn_coredump+0x10/0x10 [drm] [ 522.975198] ? __pfx___drm_puts_coredump+0x10/0x10 [drm] [ 522.975366] ? __schedule+0x113c/0x38d0 [ 522.975381] amdgpu_devcoredump_deferred_work+0x4c/0x1f0 [amdgpu] v2: Updated commit message - Clarified that ip_top is not freed, it can just be NULL if discovery was not initialized. (Christian/Lijo) v3: Removed the extra drm_warn() for sysfs init failure as sysfs already reports errors. (Christian) Fixes: e81eff80aad6 ("drm/amdgpu: include ip discovery data in devcoredump") Cc: Pierre-Eric Pelloux-Prayer Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Signed-off-by: Alex Deucher commit cc7c7121ae082b7b82891baa7280f1ff2608f22b Author: Yussuf Khalil Date: Fri Mar 6 12:06:35 2026 +0000 drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check"), amdgpu resets the CRTC state mode_changed flag to false when recomputing the DSC configuration results in no timing change for a particular stream. However, this is incorrect in scenarios where a change in MST/DSC configuration happens in the same KMS commit as another (unrelated) mode change. For example, the integrated panel of a laptop may be configured differently (e.g., HDR enabled/disabled) depending on whether external screens are attached. In this case, plugging in external DP-MST screens may result in the mode_changed flag being dropped incorrectly for the integrated panel if its DSC configuration did not change during precomputation in pre_validate_dsc(). At this point, however, dm_update_crtc_state() has already created new streams for CRTCs with DSC-independent mode changes. In turn, amdgpu_dm_commit_streams() will never release the old stream, resulting in a memory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference to the new stream either, which manifests as a use-after-free when the stream gets disabled later on: BUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu] Write of size 4 at addr ffff88813d836524 by task kworker/9:9/29977 Workqueue: events drm_mode_rmfb_work_fn Call Trace: dump_stack_lvl+0x6e/0xa0 print_address_description.constprop.0+0x88/0x320 ? dc_stream_release+0x25/0x90 [amdgpu] print_report+0xfc/0x1ff ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x225/0x4e0 ? dc_stream_release+0x25/0x90 [amdgpu] kasan_report+0xe1/0x180 ? dc_stream_release+0x25/0x90 [amdgpu] kasan_check_range+0x125/0x200 dc_stream_release+0x25/0x90 [amdgpu] dc_state_destruct+0x14d/0x5c0 [amdgpu] dc_state_release.part.0+0x4e/0x130 [amdgpu] dm_atomic_destroy_state+0x3f/0x70 [amdgpu] drm_atomic_state_default_clear+0x8ee/0xf30 ? drm_mode_object_put.part.0+0xb1/0x130 __drm_atomic_state_free+0x15c/0x2d0 atomic_remove_fb+0x67e/0x980 Since there is no reliable way of figuring out whether a CRTC has unrelated mode changes pending at the time of DSC validation, remember the value of the mode_changed flag from before the point where a CRTC was marked as potentially affected by a change in DSC configuration. Reset the mode_changed flag to this earlier value instead in pre_validate_dsc(). Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5004 Fixes: 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check") Signed-off-by: Yussuf Khalil Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit fd490bb9e1054705e1b35e6f321cdc713e0c7348 Author: Srinivasan Shanmugam Date: Sun Mar 15 11:53:31 2026 +0530 drm/amd/ras: Remove redundant NULL check in pending bad-bank list iteration ras_umc_log_pending_bad_bank() walks through a list of pending ECC bad-bank entries. These entries are saved when a bad-bank error cannot be processed immediately, for example during a GPU reset. Later, this function iterates over the pending list and retries logging each bad-bank error. If logging succeeds, the entry is removed from the list and the memory for that node is freed. The loop uses list_for_each_entry_safe(), which already guarantees that ecc_node points to a valid list entry while the loop body is executing. Checking "ecc_node &&" inside the loop is therefore unnecessary and redundant. Fixes the below: drivers/gpu/drm/amd/amdgpu/../ras/rascore/ras_umc.c:225 ras_umc_log_pending_bad_bank() warn: variable dereferenced before check 'ecc_node' (see line 223) Fixes: 7a3f9c0992c4 ("drm/amd/ras: Add umc common ras functions") Cc: Dan Carpenter Cc: YiPeng Chai Cc: Tao Zhou Cc: Hawking Zhang Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher commit a3175e57235bc4c9accc3a4e845a7ec9972c9370 Author: Hawking Zhang Date: Sun Nov 2 18:58:46 2025 +0800 drm/amd/pm: Add smu v15_0_8 pmfw header Add smu v15_0_8 pmfw header v2: squash in updates (Alex) Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit ad830273db629b7b42e23ffba253cdd5540bb178 Author: Hawking Zhang Date: Sun Nov 2 18:56:52 2025 +0800 drm/amd/pm: Add smu v15_0_8 message header Add smu v15_0_8 message header v2: squash in updates (Alex) Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 5396edca845bbbc0b9e46d278fe288b5aacde846 Author: Hawking Zhang Date: Sun Nov 2 18:55:16 2025 +0800 drm/amd/pm: Add smu v15_0_8 driver interface header Add smu v15_0_8 driver interface header v2: squash in updates (Alex) Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 1cc16538402a69d9d028e0cdb7b3bbe19e64019a Author: Christian König Date: Thu Jan 29 12:58:10 2026 +0100 drm/amdgpu: make amdgpu_user_wait_ioctl more resilent v2 When the memory allocated by userspace isn't sufficient for all the fences then just wait on them instead of returning an error. v2: use correct variable as pointed out by Sunil Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit 79b38858193474d4c35eb17cc238ea8f230f1671 Author: Jesse.Zhang Date: Fri Mar 13 14:17:10 2026 +0800 drm/amdgpu: replace WARN with DRM_ERROR for invalid sched priority amdgpu_sched_ioctl() currently uses WARN(1, ...) when userspace passes an out-of-range context priority value. WARN(1, ...) is unconditional and produces a full stack trace, which is disproportionate for a simple input validation failure -- the invalid value is already rejected with -EINVAL on the next line. Replace WARN(1, ...) with DRM_ERROR() to log the invalid value at an appropriate level without generating a stack dump. The -EINVAL return to userspace is unchanged. No functional change for well-formed userspace callers. v2: - Reworked commit message to focus on appropriate log level for parameter validation - Clarified that -EINVAL behavior is preserved (Vitaly) v3: completely drop that warning. Invalid parameters should never clutter the system log. (Christian) Reviewed-by: Vitaly Prosyak Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit d57fe7b02072ad04a41517e40c737ed7c11f4520 Author: Kexin Sun Date: Sat Mar 21 19:50:18 2026 +0800 ASoC: generic: update outdated comment for removed soc_bind_dai_link() The function soc_bind_dai_link() was first merged into snd_soc_add_dai_link() by commit 63dc47da1f39 ("ASoC: soc-core: merge snd_soc_add_dai_link() and soc_bind_dai_link()"), and later renamed to snd_soc_add_pcm_runtime() by commit 0c04800424c4 ("ASoC: soc-core: rename snd_soc_add_dai_link() to snd_soc_add_pcm_runtime()"). In simple-card.c, also adjust the wording since snd_soc_add_pcm_runtime() no longer uses "xxx_of_node" fields but matches components by of_node through snd_soc_find_dai() and snd_soc_is_matching_component(). In simple-card-utils.c, simply update the function name to its successor snd_soc_add_pcm_runtime(). Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Acked-by: Kuninori Morimoto Link: https://patch.msgid.link/20260321115018.9481-1-kexinsun@smail.nju.edu.cn Signed-off-by: Mark Brown commit 2a4d3706d864d19ba8772b7a5e74328ac5c1007d Author: Yury Norov Date: Wed Mar 18 20:43:47 2026 -0400 bitmap: exclude nbits == 0 cases from bitmap test Bitmap API handles nbits == 0 in most cases correctly, i.e. it doesn't dereferene underlying bitmap and returns a sane value where convenient, or implementation defined, or undef. Implicitly testing nbits == 0 case, however, may make an impression that this is a regular case. This is wrong. In most cases nbits == 0 is a sign of an error on a client side. The tests should not make such an implression. This patch reworks the existing tests to not test nbits == 0. The following patch adds an explicit test for it with an appropriate precaution. Signed-off-by: Yury Norov commit e9cf8f83c9857a32494002c72b5f6e36ff4dfcd5 Author: Yury Norov Date: Wed Mar 18 20:43:46 2026 -0400 bitmap: test bitmap_weight() for more Test the function for correctness when some bits are set in the last word of bitmap beyond nbits. This is motivated by commit a9dadc1c512807f9 ("powerpc/xive: Fix the size of the cpumask used in xive_find_target_in_mask()"). Signed-off-by: Yury Norov commit 4624211bc633481523475d0586a47c0a31c91fa4 Author: Cheng-Yang Chou Date: Mon Mar 23 18:48:29 2026 +0800 sched_ext: Fix invalid kobj cast in scx_uevent() When scx_alloc_and_add_sched() creates the sub-scheduler kset, it sets sch->kobj as the parent. Because sch->kobj.kset points to scx_kset, registering this sub-kset triggers a KOBJ_ADD uevent. The uevent walk finds scx_kset and calls scx_uevent() with the sub-kset's kobject. scx_uevent() unconditionally uses container_of() to cast the incoming kobject to struct scx_sched, producing a wild pointer when the kobject belongs to the kset itself rather than a scheduler instance. Accessing sch->ops.name through this pointer causes a KASAN slab-out-of-bounds read: BUG: KASAN: slab-out-of-bounds in string+0x3b6/0x4c0 Read of size 1 at addr ffff888004d04348 by task scx_enable_help/748 Call Trace: string+0x3b6/0x4c0 vsnprintf+0x3ec/0x1550 add_uevent_var+0x160/0x3a0 scx_uevent+0x22/0x30 kobject_uevent_env+0x5dc/0x1730 kset_register+0x192/0x280 scx_alloc_and_add_sched+0x130d/0x1c60 ... Fix this by checking the kobject's ktype against scx_ktype before performing the cast, and returning 0 for non-matching kobjects. Tested with vng and scx_qmap without triggering any KASAN errors. Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit cb251eae7b0aec8a7924fb27bcb5b0388a3706bc Author: Cheng-Yang Chou Date: Mon Mar 23 23:17:33 2026 +0800 tools/sched_ext: Add scx_bpf_sub_dispatch() compat wrapper Add a transparent compatibility wrapper for the scx_bpf_sub_dispatch() kfunc in compat.bpf.h. This allows BPF schedulers using the sub-sched dispatch feature to build and run on older kernels that lack the kfunc. To avoid requiring code changes in individual schedulers, the transparent wrapper pattern is used instead of a __COMPAT prefix. The kfunc is declared with a ___compat suffix, while the static inline wrapper retains the original scx_bpf_sub_dispatch() name. When the kfunc is unavailable, the wrapper safely falls back to returning false. This is acceptable because the dispatch path cannot do anything useful without underlying sub-sched support anyway. Tested scx_qmap on v6.14 successfully. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit f3e9c1138e9d20677ed085107cd2872d5218e3b1 Author: Kai Huang Date: Fri Mar 20 20:59:38 2026 +1300 asm-generic/bitops: Fix a comment typo in instrumented-atomic.h The comment after the '#endif' at the end of the instrumented-atomic.h is a typo. The "NON_ATOMIC" part should be "ATOMIC". Fix it. Signed-off-by: Kai Huang Signed-off-by: Yury Norov commit 7b52b262f8a8cd96dac33721389a884420c18365 Author: Kit Dallege Date: Sun Mar 15 16:34:14 2026 +0100 bitops: fix kernel-doc parameter name for parity8() The kernel-doc comment for parity8() documents the parameter as @value but the actual parameter name is @val. Fix the mismatch. Assisted-by: Claude Signed-off-by: Kit Dallege Signed-off-by: Yury Norov commit be56db15fcce8bb8bd85f236382276d52ce73d08 Author: Yury Norov Date: Mon Mar 23 12:17:12 2026 -0400 lib: count_zeros: unify count_{leading,trailing}_zeros() The 'leading' helper returns BITS_PER_LONG if x == 0, while 'trailing' one returns COUNT_TRAILING_ZEROS_0, which turns to be -1. None of the current users explicitly check the returned value for COUNT_TRAILING_ZEROS_0, except the loongarch, which tests implicitly for the '>= 0'. So, align count_trailing_zeros() with the count_leading_zeros(), and simplify the loongarch handling. Reviewed-by: Andy Shevchenko Signed-off-by: Yury Norov commit 4e64c91b813f666dffc3962a815a8a50b7d6f468 Author: Yury Norov Date: Thu Mar 12 19:08:16 2026 -0400 lib: count_zeros: fix 32/64-bit inconsistency in count_trailing_zeros() Based on 'sizeof(x) == 4' condition, in 32-bit case the function is wired to ffs(), while in 64-bit case to __ffs(). The difference is substantial: ffs(x) == __ffs(x) + 1. Also, ffs(0) == 0, while __ffs(0) is undefined. The 32-bit behaviour is inconsistent with the function description, so it needs to get fixed. There are 9 individual users for the function in 6 different subsystems. Some arches and drivers are 64-bit only: - arch/loongarch/kvm/intc/eiointc.c; - drivers/hv/mshv_vtl_main.c; - kernel/liveupdate/kexec_handover.c; The others are: - ib_umem_find_best_pgsz(): as per comment, __ffs() should be correct; - rzv2m_csi_reg_write_bit(): ARCH_RENESAS only, unclear; - lz77_match_len(): CIFS_COMPRESSION only, unclear, experimental; IB and CIFS are explicitly OK with the change. The attached patch gets rid of 32-bit explicit support, so that both 32- and 64-bit versions rely on __ffs(). CC: K. Y. Srinivasan CC: Haiyang Zhang CC: Mark Brown CC: Steve French CC: Alexander Graf CC: Mike Rapoport CC: Pasha Tatashin Acked-by: Leon Romanovsky Signed-off-by: Yury Norov commit 18c48899653fa7a04120537c228031b5c7e4e9d6 Author: Yury Norov Date: Tue Mar 10 16:53:02 2026 -0400 lib: crypto: fix comments for count_leading_zeros() count_leading_zeros() is based on fls(), which is defined for x == 0, contrary to __ffs() family. The comment in crypto/mpi erroneously states that the function may return undef in such case. Fix the comment together with the outdated function signature, and now that COUNT_LEADING_ZEROS_0 is not referenced in the codebase, get rid of it too. Reviewed-by: Andy Shevchenko Acked-by: Eric Biggers Signed-off-by: Yury Norov commit c6a98dff41bfb4ccc2c7f4ed596bcbf6994d5d1a Author: Yury Norov Date: Mon Dec 22 14:11:38 2025 -0500 x86/topology: use bitmap_weight_from() Switch topo_unit_count() to use bitmap_weight_from(). Signed-off-by: Yury Norov commit bf31ddc14f8c6bcd4987c31fe2bc9e93e433b41a Author: Yury Norov Date: Mon Dec 22 14:11:37 2025 -0500 bitmap: add bitmap_weight_from() The function calculates a Hamming weight of a bitmap starting from an arbitrary bit. Signed-off-by: Yury Norov commit 6c88ba561cfc2c5f35067519f46310059a9dc39a Author: Akinobu Mita Date: Wed Mar 11 00:21:26 2026 +0900 lib/find_bit_benchmark: avoid clearing randomly filled bitmap in test_find_first_bit() test_find_first_bit() searches for a set bit from the beginning of the test bitmap and clears it repeatedly, eventually clearing the entire bitmap. After test_find_first_bit() is executed, test_find_first_and_bit() and test_find_next_and_bit() are executed without randomly reinitializing the cleared bitmap. In the first phase (testing find_bit() with a random-filled bitmap), test_find_first_bit() only operates on 1/10 of the entire size of the testing bitmap, so this isn't a big problem. However, in the second phase (testing find_bit() with a sparse bitmap), test_find_first_bit() clears the entire test bitmap, so the subsequent test_find_first_and_bit() and test_find_next_and_bit() will not find any set bits. This is probably not the intended benchmark. To fix this issue, test_find_first_bit() operates on a duplicated bitmap and does not clear the original test bitmap. The same is already done in test_find_first_and_bit(). While we're at it, add const qualifiers to the bitmap pointer arguments in the test functions. Signed-off-by: Akinobu Mita Cc: Rasmus Villemoes Signed-off-by: Yury Norov commit a676643709115816d3ce7e50aa5b5a4af1ee6c45 Author: Yury Norov Date: Wed Feb 25 18:58:32 2026 -0500 bitmap: drop __find_nth_andnot_bit() Remove find_nth_andnot_bit() leftovers. CC: Rasmus Villemoes CC: Andrew Morton CC: Shaopeng Tan Fixes: b0c85e99458a ("cpumask: Remove unnecessary cpumask_nth_andnot()") Signed-off-by: Yury Norov commit e63375d39a2e90edc25e96560f14d28193347b04 Author: Yury Norov Date: Thu Feb 19 13:13:58 2026 -0500 bitmap: align test_bitmap output Different subtests print output in slightly different formats. Unify the format for better visual representation. The test output before: [ 0.553474] test_bitmap: parselist: 14: input is '0-2047:128/256' OK, Time: 202 [ 0.555121] test_bitmap: bitmap_print_to_pagebuf: input is '0-32767 [ 0.555121] ', Time: 1278 [ 0.578392] test_bitmap: Time spent in test_bitmap_read_perf: 427864 [ 0.580137] test_bitmap: Time spent in test_bitmap_write_perf: 793554 [ 0.581957] test_bitmap: all 390447 tests passed And after: [ 0.314982] test_bitmap: parselist('0-2047:128/256'): 135 [ 0.315517] test_bitmap: scnprintf("%*pbl", '0-32767'): 342 [ 0.330045] test_bitmap: test_bitmap_read_perf: 252294 [ 0.331132] test_bitmap: test_bitmap_write_perf: 539001 [ 0.332163] test_bitmap: all 390447 tests passed Signed-off-by: Yury Norov commit d1a43793c484e4f1e896dd2fee52b034f8c4f965 Author: Yury Norov Date: Thu Feb 19 13:13:57 2026 -0500 bitmap: switch test to scnprintf("%*pbl") scnprintf("%*pbl") is more verbose than bitmap_print_to_pagebuf(). Switch the test to using it. This also improves the test output because bitmap_print_to_pagebuf() adds \n at the end of the printed bitmap, which breaks the test format. Signed-off-by: Yury Norov commit 6b5a4b68736798df1031404a2fad06d031253ef7 Author: Andy Shevchenko Date: Thu Feb 26 12:16:44 2026 +0100 bitmap: Add test for out-of-boundary modifications for scatter & gather Make sure that bitmap_scatter() and bitmap_gather() do not modify the bits outside of the given nbits span. Signed-off-by: Andy Shevchenko Signed-off-by: Yury Norov commit 97f7d3f9c9acb70d4eef7bcdef3218823d142733 Author: Kees Cook Date: Mon Mar 23 10:24:52 2026 -0700 ACPICA: Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy() Replace the deprecated[1] strncpy() with strscpy_pad() in acpi_ut_safe_strncpy(). The function is a "safe strncpy" wrapper that does strncpy(dest, source, dest_size) followed by manual NUL-termination at dest[dest_size - 1]. strscpy_pad() is a direct replacement: it NUL-terminates, zero-pads the remainder, and the manual termination is no longer needed. All callers pass NUL-terminated source strings (C string literals, __FILE__ via ACPI_MODULE_NAME, or user-provided filenames that have already been validated). The destinations are fixed-size char arrays in ACPICA internal structures (allocation->module, aml_op_name, acpi_gbl_db_debug_filename), all consumed as C strings. No behavioral change: strscpy_pad() produces identical output to strncpy() + manual NUL-termination for NUL-terminated sources that are shorter than dest_size. For sources longer than dest_size, strncpy() wrote dest_size non-NUL bytes then the manual termination overwrote the last byte with NUL; strscpy_pad() writes dest_size-1 bytes plus NUL: same result. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook Link: https://patch.msgid.link/20260323172451.work.079-kees@kernel.org Signed-off-by: Rafael J. Wysocki commit 0be6c2b1c18f1586f0ec68463b85a8d56e4623f5 Author: Eric Biggers Date: Sat Mar 21 16:06:51 2026 -0700 dm-crypt: Make crypt_iv_operations::wipe return void Since all implementations of crypt_iv_operations::wipe now return 0, change the return type to void. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit d1c3b6b8e74393a5b34b91a056bd7ea6ae33938a Author: Eric Biggers Date: Sat Mar 21 16:06:50 2026 -0700 dm-crypt: Reimplement elephant diffuser using AES library Simplify and optimize dm-crypt's implementation of Bitlocker's "elephant diffuser" to use the AES library instead of an "ecb(aes)" crypto_skcipher. Note: struct aes_enckey is fixed-size, so it could be embedded directly in struct iv_elephant_private. But I kept it as a separate allocation so that the size of struct crypt_config doesn't increase. The elephant diffuser is rarely used in dm-crypt. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 0e4c1eb59909ddaef19cd997e646d5d1ce251a6c Author: Eric Biggers Date: Fri Mar 20 14:15:08 2026 -0700 dm-verity-fec: warn even when there were no errors Currently FEC logs a warning message if at least one error was corrected, or an error message if there were uncorrectable errors. However, it doesn't log anything if there were no errors. "No errors" is actually unexpected, though, considering that dm-verity calls verity_fec_decode() only when a block's digest doesn't match. If there were to ever be a bug where verity_fec_decode() is called on blocks with the correct digest, then there would be no indication in the log that FEC is running and degrading performance. Therefore, let's log the warning message even when there were no errors. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit d1c73884858cb3ce2a0f761988a6f279bff32b91 Author: haoyu.lu Date: Mon Mar 23 11:49:32 2026 +0800 accel/amdxdna: fix missing newline in pr_err message Add missing newline to pr_err message in amdxdna_mailbox.c. Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox") Signed-off-by: haoyu.lu Reviewed-by: Lizhi.hou Signed-off-by: Lizhi.hou Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260323034933.216-1-hechushiguitu666@gmail.com commit ac207753f47d7e4e958df1091ae7076e9ef29691 Author: Vishnu Saini Date: Thu Mar 19 00:38:20 2026 +0530 arm64: defconfig: Enable Lontium LT8713sx driver Lontium LT8713sx DP bridge hub can be found on a Qualcomm Monaco EVK board for converting 1 DP to 3 DP outputs. Signed-off-by: Vishnu Saini Link: https://lore.kernel.org/r/20260319-lt8713sx-bridge-linux-for-next-v4-2-da886ec78fe3@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 263aaa90d8aa81310db8a754c86f7299c3df9d8f Author: Krzysztof Kozlowski Date: Thu Mar 19 12:49:44 2026 +0100 arm64: defconfig: Enable Qualcomm Eliza SoC display clock controller Enable the driver for Qualcomm Eliza SoC display clock controller, used for example on Qualcomm Eliza MTP board. Reviewed-by: Konrad Dybcio Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260319-clk-qcom-dispcc-eliza-v3-3-d1f2b19a6e6b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0e66f10942b531a7521da97e4bdab0bdfcfc2e6f Author: Krzysztof Kozlowski Date: Thu Mar 19 12:49:43 2026 +0100 clk: qcom: dispcc-eliza: Add Eliza display clock controller support Add a driver for the display clock controller on Qualcomm Eliza SoC, which is copied from SM8750 driver plus changes: 1. Additional DT_HDMI_PHY_PLL_CLK clock input, 2. Eight new HDMI clocks, 3. Different PLLs (lucid and pongo). Reviewed-by: Konrad Dybcio Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260319-clk-qcom-dispcc-eliza-v3-2-d1f2b19a6e6b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7f9ccf3b9975678509e37217fd4a298a9b4e5fb9 Merge: ecaec77148428f a4f78912aec509 Author: Bjorn Andersson Date: Mon Mar 23 11:29:06 2026 -0500 Merge branch '20260319-clk-qcom-dispcc-eliza-v3-1-d1f2b19a6e6b@oss.qualcomm.com' into clk-for-7.1 Merge the Eliza display clock controller binding through a topic branch, to allow the constants to be shared with the DeviceTree branch. commit a4f78912aec5092ed8ddc09d987e296c01c77353 Author: Krzysztof Kozlowski Date: Thu Mar 19 12:49:42 2026 +0100 dt-bindings: clock: qcom,eliza-dispcc: Add Eliza SoC display CC Add bindings for Qualcomm Eliza SoC display clock controller (dispcc), which is very similar to one in SM8750, except new HDMI-related clocks and additional clock input from HDMI PHY PLL. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260319-clk-qcom-dispcc-eliza-v3-1-d1f2b19a6e6b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2db93889e17e70ab516f13dbd33e1111b85a032a Author: Kathiravan Thirumoorthy Date: Wed Mar 18 14:09:48 2026 +0530 arm64: defconfig: enable IPQ5210 RDP504 base configs Enable GCC, Pinctrl for Qualcomm's IPQ5210 SoC which is required to boot ipq5210-rdp504 board to a console shell. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Kathiravan Thirumoorthy Link: https://lore.kernel.org/r/20260318-ipq5210_boot_to_shell-v2-6-a87e27c37070@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8e23163c38a1032a45dbd8863c46548df0c9e98b Author: Luca Weiss Date: Fri Mar 6 15:22:17 2026 +0100 arm64: defconfig: Enable Milos LPASS LPI pinctrl driver Build the LPASS LPI pinctrl driver as module, as required by devices using the Qualcomm Milos SoC. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20260306-milos-pinctrl-lpi-v1-3-086946dbb855@fairphone.com Signed-off-by: Bjorn Andersson commit 25d676e5b595249f0e8eddc596d6a65f11ece0ad Author: Taniya Das Date: Tue Feb 24 23:19:25 2026 -0800 arm64: defconfig: Enable Kaanapali clock controllers Enable the Kaanapali display, video, camera and gpu clock controller for their respective functionalities on the Qualcomm Kaanapali QRD and MTP boards. Signed-off-by: Taniya Das Reviewed-by: Abel Vesa Signed-off-by: Jingyi Wang Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260224-knp-dts-misc-v6-10-79d20dab8a60@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9150d79c7a8b3287f1dc0108205f067a9249964d Author: Hugo Villeneuve Date: Mon Mar 23 10:02:00 2026 -0400 regulator: fixed: remove unused macro The macro was added in commit ecb6f1f45614 ("regulator: fixed: add support for under-voltage IRQ") but it was never used. Signed-off-by: Hugo Villeneuve Link: https://patch.msgid.link/20260323140206.104908-1-hugo@hugovil.com Signed-off-by: Mark Brown commit 13f55a7ca773c731a1e645934c1ae48577f48785 Author: Koichiro Den Date: Fri Mar 6 00:10:50 2026 +0900 PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation R-Car S4 Series (R8A779F[4-7]*) EP controller uses a 4K minimum iATU region size (CX_ATU_MIN_REGION_SIZE = 4K) as per R19UH0161EJ0130 Rev.1.30. Also, the controller itself can only be configured in the range 4 KB to 64 KB, so the current 1 MB alignment requirement is incorrect. Hence, change the alignment to the min size 4K as per the documentation. This also fixes needless unusability of BAR4 on this platform when the target address is fixed, such as for doorbell targets. Fixes: e311b3834dfa ("PCI: rcar-gen4: Add endpoint mode support") Signed-off-by: Koichiro Den [mani: commit log] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260305151050.1834007-1-den@valinux.co.jp commit 09a1361db3abfcb76d936aa76820c37e0ee36c04 Author: Hugo Villeneuve Date: Mon Mar 23 10:03:35 2026 -0400 regulator: core: fix typo in comments Replace another->other so that the sentence makes sense. Signed-off-by: Hugo Villeneuve Link: https://patch.msgid.link/20260323140340.105362-1-hugo@hugovil.com Signed-off-by: Mark Brown commit 9861e15f6347dcce65795b8dd680b491a54d59a9 Author: Andy Shevchenko Date: Mon Mar 23 15:04:45 2026 +0100 spi: Replace open coded variant of spi_bpw_to_bytes() __spi_validate() open codes the functionality of spi_bpw_to_bytes(). Replace the custom piece by the call to the mentioned function. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260323140445.3496736-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 4c68d150246d7e1d826a807a82e6eb6b4669f42c Author: Kexin Sun Date: Sat Mar 21 18:59:27 2026 +0800 signal: update outdated comment for removed freezable_schedule() The function freezable_schedule() was removed in commit f5d39b020809 ("freezer,sched: Rewrite core freezer logic"), which rewrote the freezer to use a dedicated TASK_FROZEN state instead. do_signal_stop() and ptrace_stop() no longer call freezable_schedule(); they now set TASK_STOPPED/TASK_TRACED and the freezer handles those states directly via TASK_FROZEN. Update the comment to reflect the current mechanism. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260321105927.7979-1-kexinsun@smail.nju.edu.cn Signed-off-by: Christian Brauner commit d29eb5f0ce674cfe71b93f8ff67dc0f66e6a9371 Merge: 3fc66a103395b4 7aaa4915cb6993 Author: Christian Brauner Date: Mon Mar 23 16:29:22 2026 +0100 Merge patch series "pidfds: add coredump_code field to pidfd_info" Emanuele Rocca says: This patchs series adds a new field called coredump_code to struct pidfd_info, as well as the relevant selftests. Note that the coredump selftests are currently not passing. * patches from https://patch.msgid.link/acE5fYOgyVUYahIn@NH27D9T0LF: selftests: check pidfd_info->coredump_code correctness pidfds: add coredump_code field to pidfd_info Link: https://patch.msgid.link/acE5fYOgyVUYahIn@NH27D9T0LF Signed-off-by: Christian Brauner commit 7aaa4915cb699378db1fa2a5c763ebea2caa35da Author: Emanuele Rocca Date: Mon Mar 23 14:03:15 2026 +0100 selftests: check pidfd_info->coredump_code correctness Extend the coredump_socket and coredump_socket_protocol selftests to verify that the field coredump_code is set as expected in struct pidfd_info. Signed-off-by: Emanuele Rocca Link: https://patch.msgid.link/acE6Eyuv2MM75pmk@NH27D9T0LF Signed-off-by: Christian Brauner commit 701f7f4fbabbf4989ba6fbf033b160dd943221d5 Author: Emanuele Rocca Date: Mon Mar 23 14:02:16 2026 +0100 pidfds: add coredump_code field to pidfd_info The struct pidfd_info currently exposes in a field called coredump_signal the signal number (si_signo) that triggered the dump (for example, 11 for SIGSEGV). However, it is also valuable to understand the reason why that signal was sent. This additional context is provided by the signal code (si_code), such as 2 for SEGV_ACCERR. Add a new field to struct pidfd_info called coredump_code with the value of si_code for the benefit of sysadmins who pipe core dumps to user-space programs for later analysis. The following snippet illustrates a simplified C program that consumes coredump_signal and coredump_code, and then logs core dump signals and codes to a file: int pidfd = (int)atoi(argv[1]); struct pidfd_info info = { .mask = PIDFD_INFO_EXIT | PIDFD_INFO_COREDUMP, }; if (ioctl(pidfd, PIDFD_GET_INFO, &info) == 0) if (info.mask & PIDFD_INFO_COREDUMP) fprintf(f, "PID=%d, si_signo: %d si_code: %d\n", info.pid, info.coredump_signal, info.coredump_code); Assuming the program is installed under /usr/local/bin/core-logger, core dump processing can be enabled by setting /proc/sys/kernel/core_pattern to '|/usr/local/bin/dumpstuff %F'. systemd-coredump(8) already uses pidfds to process core dumps, and it could be extended to include the values of coredump_code too. Signed-off-by: Emanuele Rocca Link: https://patch.msgid.link/acE52HIFivNZN3nE@NH27D9T0LF Acked-by: Oleg Nesterov Signed-off-by: Christian Brauner commit 3fc66a103395b4ae8d032dcda5621423d94902f6 Author: Emanuele Rocca Date: Fri Mar 20 20:46:43 2026 +0100 kselftest/coredump: reintroduce null pointer dereference Commit 673a55cc49da replaced the null pointer dereference used in crashing_child() with __builtin_trap to address the following LLVM warnings: coredump_test_helpers.c:59:6: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference] coredump_test_helpers.c:59:6: note: consider using __builtin_trap() or qualifying pointer with 'volatile' All coredump tests expect crashing_child() to result in a SIGSEGV. However, the behavior of __builtin_trap is architecture-dependent. On x86 it yields SIGILL, on aarch64 SIGTRAP. Given that neither of those signals are SIGSEGV, both coredump_socket_test and coredump_socket_protocol_test are currently failing: get_pidfd_info: mask=0xd7, coredump_mask=0x5, coredump_signal=5 socket_coredump_signal_sigsegv: coredump_signal=5, expected SIGSEGV=11 Qualify the pointer with volatile instead of calling __builtin_trap to fix the tests. Signed-off-by: Emanuele Rocca Link: https://patch.msgid.link/ab2kI0PI_Vk6bU88@NH27D9T0LF Reviewed-by: Mark Brown Signed-off-by: Christian Brauner commit 6a9fe1ad908df12ef71dea12373f25826ea29a8d Author: Wei Wang Date: Mon Mar 23 16:07:19 2026 +0800 x86/cpu/topology: Consolidate AMD and Hygon cases in parse_topology() Merge the two separate switch cases for AMD and Hygon as they share the common cpu_parse_topology_amd(). Also drop the IS_ENABLED(CONFIG_CPU_SUP_AMD/HYGON) guards, because 1) they are dead code: when a vendor's CONFIG_CPU_SUP_* is disabled, its vendor detection code (in amd.c / hygon.c) is not compiled, so x86_vendor will never be set to X86_VENDOR_AMD / X86_VENDOR_HYGON, instead it will default to X86_VENDOR_UNKNOWN and those switch cases are unreachable. 2) topology_amd.o is always built (obj-y), so cpu_parse_topology_amd() is always available regardless of CPU_SUP_* configuration. Signed-off-by: Wei Wang Signed-off-by: Borislav Petkov (AMD) Tested-by: Yongwei Xu Link: https://patch.msgid.link/SI2PR01MB4393D6B7E17AB05612AEE925DC4BA@SI2PR01MB4393.apcprd01.prod.exchangelabs.com commit 50d349cb70cdb6db352dec114e6381a31870b4ff Author: Andy Shevchenko Date: Fri Mar 20 23:02:21 2026 +0100 mmc: sdhci-pci: Drop unused include This driver includes the legacy header but does not use any symbols from it. Drop the inclusion. Signed-off-by: Andy Shevchenko Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 4095694c09b99533c7300829c0df993d1d57ed4b Author: Jiayu Du Date: Thu Mar 19 22:07:04 2026 +0800 mmc: sdhci-dwcmshc: Add Canaan K230 DWCMSHC controller support Add SDHCI controller driver for Canaan k230 SoC. Implement custom sdhci_ops for set_clock, phy init, init and reset. Tested-by: Junhui Liu Signed-off-by: Jiayu Du Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit a137e03f81e241656a4c70ea2a54833e9256de16 Author: Jiayu Du Date: Thu Mar 19 22:07:03 2026 +0800 dt-bindings: mmc: Add sdhci support for Canaan k230 The Canaan k230 uses the SDHCI from Synopsys. Add compatible strings to the k230. The k230 has two controllers. MMC0 supports eMMC, while MMC1 supports SDIO. Signed-off-by: Jiayu Du Reviewed-by: Conor Dooley Signed-off-by: Ulf Hansson commit 2ff6cc999a04bcb094b8cbba68a9251f03a5c876 Author: Gabor Juhos Date: Thu Mar 19 10:24:59 2026 +0100 arm64: dts: marvell: armada-37xx: drop 'marvell,usb-misc-reg' from USB host nodes The 'marvell,usb-misc-reg' property is present both in the EHCI and in the XHCI USB host device nodes, however it is not documented. Thus 'make dtbs_check' produces warnings like these: /arch/arm64/boot/dts/marvell/armada-3720-db.dtb: usb@58000 (marvell,armada3700-xhci): Unevaluated properties are not allowed ('marvell,usb-misc-reg' was unexpected) from schema $id: http://devicetree.org/schemas/usb/generic-xhci.yaml /arch/arm64/boot/dts/marvell/armada-3720-db.dtb: usb@5e000 (marvell,armada-3700-ehci): Unevaluated properties are not allowed ('marvell,usb-misc-reg' was unexpected) from schema $id: http://devicetree.org/schemas/usb/generic-ehci.yaml Apart from the fact that the properties are not documented, those are not even used by any USB host drivers. Due to this, drop the properties in order to get rid of the warnings. Note: With the same name, there is a property used for the Armada 3700 USB UTMI PHYs of which dt-bindings documentation has been added in commit e60958699afa ("dt-bindings: phy: mvebu-utmi: add UTMI PHY bindings"). Additionally, the property is handled by the 'phy-mvebu-a3700-utmi' driver since commit cc8b7a0ae866 ("phy: add A3700 UTMI PHY driver"). When the nodes of the UTMI PHYs has been added to the SoC dtsi by commit 05d168a56fae ("arm64: dts: marvell: armada-37xx: declare USB2 UTMI PHYs"), the properties has been added to the USB host controller nodes also. According to the commit message this was unintentional, however in regard to the USB hosts, neither the respective documentation, nor driver support has been added into the tree since that. Reviewed-by: Andrew Lunn Reviewed-by: Miquel Raynal Signed-off-by: Gabor Juhos Signed-off-by: Gregory CLEMENT commit 62a6f98cda4ec75107e96571346349a649fc63d1 Author: Brajesh Gupta Date: Fri Mar 13 06:38:25 2026 +0000 drm/imagination: Skip 2nd thread DM association for non META Firmware Only a META firmware can have two threads. Signed-off-by: Brajesh Gupta Reviewed-by: Matt Coster Link: https://patch.msgid.link/20260313-b4-staging-layout_mars_base-v2-2-9e3c251d278e@imgtec.com Signed-off-by: Matt Coster commit 51e39ceeca7e85a3b9ca533502a404eb5f3b0f02 Author: Brajesh Gupta Date: Fri Mar 13 06:38:24 2026 +0000 drm/imagination: Improve firmware power off for layout_mars config In layout_mars HW config, Firmware MCU moved from Sidekick to new Mars domain so Firmware takes care of powering down Sidekick/Jones and SLC. Skip checks for those from kernel and check idle bits for Firmware MCU and system arbiter excluding SOCIF. Signed-off-by: Brajesh Gupta Reviewed-by: Matt Coster Link: https://patch.msgid.link/20260313-b4-staging-layout_mars_base-v2-1-9e3c251d278e@imgtec.com Signed-off-by: Matt Coster commit e6375787bfe8f69fa17b5778f201ba7291ebcf15 Author: Nick Hawkins Date: Mon Mar 16 10:01:15 2026 -0500 mmc: sdhci-of-dwcmshc: Add HPE GSC eMMC support Add support for the eMMC controller integrated in the HPE GSC (ARM64 Cortex-A53) BMC SoC under the new 'hpe,gsc-dwcmshc' compatible string. The HPE GSC eMMC controller is based on the DesignWare Cores MSHC IP but requires several platform-specific adjustments: Clock mux (dwcmshc_hpe_set_clock): The GSC SoC wires SDHCI_CLOCK_CONTROL.freq_sel directly to a clock mux rather than a divider. Forcing freq_sel = 1 when the requested clock is 200 MHz (HS200) selects the correct high-speed clock source. Using the generic sdhci_set_clock() would otherwise leave the mux on the wrong source after tuning. Auto-tuning / vendor config (dwcmshc_hpe_vendor_specific): Disables the command-conflict check (DWCMSHC_HOST_CTRL3 BIT(0)) and programs the ATCTRL register using existing AT_CTRL_* macros: AT_CTRL_AT_EN auto-tuning circuit enable AT_CTRL_SWIN_TH_EN sampling window threshold enable AT_CTRL_TUNE_CLK_STOP_EN tune-clock-stop enable PRE_CHANGE_DLY = 3 pre-change delay POST_CHANGE_DLY = 3 post-change delay SWIN_TH_VAL = 2 sampling window threshold This combination is required for reliable HS200 signal integrity on the GSC PCB trace topology. eMMC mode (dwcmshc_hpe_set_emmc): Helper that sets DWCMSHC_CARD_IS_EMMC unconditionally. Called from both the reset and UHS-signaling paths. Reset (dwcmshc_hpe_reset): Calls dwcmshc_reset(), re-applies the vendor config above via dwcmshc_hpe_vendor_specific(), and then calls dwcmshc_hpe_set_emmc(). The GSC controller clears the CARD_IS_EMMC bit on every reset; leaving it clear causes card-detect mis-identification on an eMMC-only slot. UHS signaling (dwcmshc_hpe_set_uhs_signaling): Wraps dwcmshc_set_uhs_signaling() and calls dwcmshc_hpe_set_emmc() to ensure CARD_IS_EMMC is set for all timing modes, not just HS400. Init (dwcmshc_hpe_gsc_init): Obtains the SoC register block and MSHCCS offset via the 'hpe,gxp-sysreg' syscon phandle argument and sets SCGSyncDis (BIT(18)) to allow the HS200 RX delay lines to settle while the card clock is stopped during auto-tuning. Enables SDHCI v4 mode. Quirks: SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN: base clock not advertised in capabilities; must be obtained from the DTS 'clocks' property. SDHCI_QUIRK2_PRESET_VALUE_BROKEN: preset-value registers are not populated in the GSC ROM. All HPE-specific code is isolated to the new hpe_gsc_init / hpe_ops / hpe_gsc_pdata symbols. No existing platform (Rockchip, T-Head, sg2042, etc.) is affected. Signed-off-by: Nick Hawkins Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit e65a413a2d4505012fdba2974dca613ac1779d84 Author: Nick Hawkins Date: Mon Mar 16 10:01:14 2026 -0500 dt-bindings: mmc: snps,dwcmshc-sdhci: add HPE GSC dwcmshc compatible Add the 'hpe,gsc-dwcmshc' compatible string for the HPE GSC (ARM64 Cortex-A53) BMC SoC eMMC controller. The HPE GSC requires access to the MSHCCS register in the SoC system register block to configure SCG sync disable for HS200 RX delay-line phase selection. The required 'hpe,gxp-sysreg' property takes a phandle to the existing 'hpe,gxp-sysreg' syscon and the MSHCCS register offset within that block. The HPE GSC eMMC interface only exposes a single 'core' clock (no bus clock), so clocks/clock-names are constrained to a single item. Signed-off-by: Nick Hawkins Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit 3f1628baa51e78c3f0cba6383f00405e5a8c175e Author: Shawn Lin Date: Tue Mar 17 10:14:52 2026 +0800 mmc: dw_mmc-pltfm: Use phase_map for SoCFPGA clock phase configuration This change aligns the SoCFPGA driver with the current dw_mmc core, which now manages clock phases through host->phase_map. The phase values are still scaled by SOCFPGA_DW_MMC_CLK_PHASE_STEP before being written to the system manager registers. No functional changes intended. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 7ee65cdf54fc9eb4eaf2ffc5c5d1409a90ff4efa Author: Fabio Estevam Date: Fri Mar 13 10:08:35 2026 -0300 dt-bindings: mmc: rockchip-dw-mshc: Fix the RV1103B compatible RV1103B uses the same DesignWare MSHC controller IP version as RK3576. They have no "ciu-drive" nor "ciu-sample" clocks and use the phase tuning inside the controller. Fix it accordingly. Fixes: 517b1e3c9455 ("dt-bindings: mmc: rockchip-dw-mshc: Add RV1103B compatible") Suggested-by: Shawn Lin Signed-off-by: Fabio Estevam Reviewed-by: Heiko Stuebner Signed-off-by: Ulf Hansson commit fd78e2b582a05ff3217016bed9c8a3cc632ee61b Author: Neeraj Soni Date: Fri Mar 13 13:45:48 2026 +0530 mmc: sdhci-msm: Add support for wrapped keys Add the wrapped key support for sdhci-msm by implementing the needed methods in struct blk_crypto_ll_ops and setting the appropriate flag in blk_crypto_profile::key_types_supported. Tested on SC7280 eMMC variant. How to test: Use the "v1.3.0" tag from https://github.com/google/fscryptctl and build fscryptctl that supports generating wrapped keys. Enable the following config options: CONFIG_BLK_INLINE_ENCRYPTION=y CONFIG_QCOM_INLINE_CRYPTO_ENGINE=y CONFIG_FS_ENCRYPTION_INLINE_CRYPT=y CONFIG_MMC_CRYPTO=y Enable "qcom_ice.use_wrapped_keys" via kernel command line. $ mkfs.ext4 -F -O encrypt,stable_inodes /dev/disk/by-partlabel/vm-data $ mount /dev/disk/by-partlabel/vm-data -o inlinecrypt /mnt $ fscryptctl generate_hw_wrapped_key /dev/disk/by-partlabel/vm-data > /mnt/key.longterm $ fscryptctl prepare_hw_wrapped_key /dev/disk/by-partlabel/vm-data < /mnt/key.longterm > /tmp/key.ephemeral $ KEYID=$(fscryptctl add_key --hw-wrapped-key < /tmp/key.ephemeral /mnt) $ rm -rf /mnt/dir $ mkdir /mnt/dir $ fscryptctl set_policy --iv-ino-lblk-32 "$KEYID" /mnt/dir $ dmesg > /mnt/dir/test.txt $ sync Reboot the board $ mount /dev/disk/by-partlabel/vm-data -o inlinecrypt /mnt $ ls /mnt/dir # File should be encrypted $ fscryptctl prepare_hw_wrapped_key /dev/disk/by-partlabel/vm-data < /mnt/key.longterm > /tmp/key.ephemeral $ KEYID=$(fscryptctl add_key --hw-wrapped-key < /tmp/key.ephemeral /mnt) $ fscryptctl set_policy --iv-ino-lblk-32 "$KEYID" /mnt/dir $ cat /mnt/dir/test.txt # File should now be decrypted Tested-by: Wenjia Zhang Signed-off-by: Neeraj Soni Acked-by: Adrian Hunter Reviewed-by: Eric Biggers Signed-off-by: Ulf Hansson commit e3f1ce073a0dd2b319bd1541c461f153306ca163 Author: Arnd Bergmann Date: Fri Mar 20 16:17:31 2026 +0100 ASoC: wm_adsp: select CONFIG_SND_SOC_WM_ADSP from all users The addition of the kunit test made it possible to enable the WM_ADSP driver even when there are no users. However, an unintended side-effect was that it is also possible to turn it off when it is actually required, leading to build failures: ERROR: modpost: "wm_halo_init" [sound/soc/codecs/snd-soc-cs35l45.ko] undefined! ERROR: modpost: "wm_adsp2_remove" [sound/soc/codecs/snd-soc-cs35l45.ko] undefined! ERROR: modpost: "wm_adsp_hibernate" [sound/soc/codecs/snd-soc-cs35l45.ko] undefined! ERROR: modpost: "wm_adsp2_component_probe" [sound/soc/codecs/snd-soc-cs35l45.ko] undefined! Reverse the logic to replace the ununual list of 'default y if ....' with the regular 'select' that do the same thing but prevent it from being disabled if that would break the build. Fixes: bf2d44d07de7 ("ASoC: wm_adsp: Add kunit test for firmware file search") Signed-off-by: Arnd Bergmann Reviewed-by: Richard Fitzgerald Link: https://patch.msgid.link/20260320151752.3439218-1-arnd@kernel.org Signed-off-by: Mark Brown commit e031e7ceac4ee04973bd77362c363734e79dd08c Author: Dmitry Baryshkov Date: Sat Feb 28 20:34:27 2026 +0200 soc: qcom: ubwc: disable bank swizzling for Glymur platform Due to the way the DDR controller is organized on Glymur, hardware engineers strongly recommended disabling UBWC bank swizzling on Glymur. Follow that recommendation. Fixes: 9b21c3bd2480 ("soc: qcom: ubwc: Add configuration Glymur platform") Signed-off-by: Dmitry Baryshkov Acked-by: Rob Clark Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Reviewed-by: Akhil P Oommen Reviewed-by: Akhil P Oommen Link: https://lore.kernel.org/r/20260228-fix-glymur-ubwc-v2-1-70819bd6a6b4@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e32701726c0e6312aabd83aa1c00f59b0d7df276 Author: Mukesh Ojha Date: Tue Mar 10 19:32:55 2026 +0530 firmware: qcom_scm: don't opencode kmemdup Lets not opencode kmemdup which is reported by coccinelle tool. Fix it using kmemdup. cocci warnings: (new ones prefixed by >>) >> drivers/firmware/qcom/qcom_scm.c:916:11-18: WARNING opportunity for kmemdup Fixes: 8b9d2050cfa0 ("firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601142144.HvSlBSI9-lkp@intel.com/ Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20260310140255.2520230-1-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 67807fbaf12719fca46a622d759484652b79c7c3 Author: Vasily Gorbik Date: Sun Mar 22 03:35:10 2026 +0100 block: fix bio_alloc_bioset slowpath GFP handling bio_alloc_bioset() first strips __GFP_DIRECT_RECLAIM from the optimistic fast allocation attempt with try_alloc_gfp(). If that fast path fails, the slowpath checks saved_gfp to decide whether blocking allocation is allowed, but then still calls mempool_alloc() with the stripped gfp mask. That can lead to a NULL bio pointer being passed into bio_init(). Fix the slowpath by using saved_gfp for the bio and bvec mempool allocations. Fixes: b520c4eef83d ("block: split bio_alloc_bioset more clearly into a fast and slowpath") Reported-by: syzbot+09ddb593eea76a158f42@syzkaller.appspotmail.com Signed-off-by: Vasily Gorbik Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/p01.gc6e9ad5845ad.ttca29g@ub.hpns Signed-off-by: Jens Axboe commit 945471425a374e15a0d1a85b35913e1acdcd4a99 Author: Anas Iqbal Date: Mon Mar 23 09:40:18 2026 +0000 thermal: devfreq_cooling: avoid unnecessary kfree of freq_table dfc->freq_table is only allocated in the non-EM path via devfreq_cooling_gen_tables(). In the EM path, it remains NULL. Avoid calling kfree() unnecessarily when freq_table was never allocated. This resolves a Smatch warning: calling kfree() when 'dfc->freq_table' is always NULL. Signed-off-by: Anas Iqbal Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/20260323094018.2264-1-mohd.abd.6602@gmail.com Signed-off-by: Rafael J. Wysocki commit 34006f77890d050e6d80cbee365b5d703c1140b4 Author: Yu-Chun Lin Date: Fri Mar 20 23:15:06 2026 +0800 pinctrl: abx500: Fix type of 'argument' variable The argument variable is assigned the return value of pinconf_to_config_argument(), which returns a u32. Change its type from enum pin_config_param to unsigned int to correctly store the configuration argument. Fixes: 03b054e9696c ("pinctrl: Pass all configs to driver on pin_config_set()") Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit f30186b0c7829841744a40f7345e6cc9865f8a67 Author: Breno Leitao Date: Mon Mar 23 04:46:27 2026 -0700 coredump: add tracepoint for coredump events Coredump is a generally useful and interesting event in the lifetime of a process. Add a tracepoint so it can be monitored through the standard kernel tracing infrastructure. BPF-based crash monitoring is an advanced approach that allows real-time crash interception: by attaching a BPF program at this point, tools can use bpf_get_stack() with BPF_F_USER_STACK to capture the user-space stack trace at the exact moment of the crash, before the process is fully terminated, without waiting for a coredump file to be written and parsed. However, there is currently no stable kernel API for this use case. Existing tools rely on attaching fentry probes to do_coredump(), which is an internal function whose signature changes across kernel versions, breaking these tools. Add a stable tracepoint that fires at the beginning of do_coredump(), providing BPF programs a reliable attachment point. At tracepoint time, the crashing process context is still live, so BPF programs can call bpf_get_stack() with BPF_F_USER_STACK to extract the user-space backtrace. The tracepoint records: - sig: signal number that triggered the coredump - comm: process name Example output: $ echo 1 > /sys/kernel/tracing/events/coredump/coredump/enable $ sleep 999 & $ kill -SEGV $! $ cat /sys/kernel/tracing/trace # TASK-PID CPU# ||||| TIMESTAMP FUNCTION # | | | ||||| | | sleep-634 [036] ..... 145.222206: coredump: sig=11 comm=sleep Suggested-by: Andrii Nakryiko Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260323-coredump_tracepoint-v2-1-afced083b38d@debian.org Signed-off-by: Christian Brauner commit e247fd37e597b3536d26cfa5fcc558832586f57c Merge: 3d6bb84f6bb3f4 e8767a3134ca69 Author: Christian Brauner Date: Mon Mar 23 12:41:19 2026 +0100 Merge patch series "fix architecture-specific compat_ftruncate64 implementations" Christoph Hellwig says: This series fixes a really old bug found by code inspection, where the architecture-specific 32-bit compat ftruncate64 implementations enforce the non-LFS file size limit unless opened with O_LARGEFILE. * patches from https://patch.msgid.link/20260323070205.2939118-1-hch@lst.de: fs: remove do_sys_truncate fs: pass on FTRUNCATE_* flags to do_truncate fs: fix archiecture-specific compat_ftruncate64 Link: https://patch.msgid.link/20260323070205.2939118-1-hch@lst.de Signed-off-by: Christian Brauner commit e8767a3134ca69a307b37f7f58ca088dbee6eb82 Author: Christoph Hellwig Date: Mon Mar 23 08:01:46 2026 +0100 fs: remove do_sys_truncate do_sys_truncate ist only used to implement ksys_truncate and the native truncate syscalls. Merge do_sys_truncate into ksys_truncate and return int from it as it only returns 0 or negative errnos. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260323070205.2939118-4-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 0924f6b80d4ac8cc0460fc73de163b562127026d Author: Christoph Hellwig Date: Mon Mar 23 08:01:45 2026 +0100 fs: pass on FTRUNCATE_* flags to do_truncate Pass the flags one level down to replace the somewhat confusing small argument, and clean up do_truncate as a result. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260323070205.2939118-3-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit e43dce8a0bc09083ea1145a1a0c61d83cbe72d97 Author: Christoph Hellwig Date: Mon Mar 23 08:01:44 2026 +0100 fs: fix archiecture-specific compat_ftruncate64 The "small" argument to do_sys_ftruncate indicates if > 32-bit size should be reject, but all the arch-specific compat ftruncate64 implementations get this wrong. Merge do_sys_ftruncate and ksys_ftruncate, replace the integer as boolean small flag with a descriptive one about LFS semantics, and use it correctly in the architecture-specific ftruncate64 implementations. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 3dd681d944f6 ("arm64: 32-bit (compat) applications support") Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260323070205.2939118-2-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 54a3cc145456272b10c1452fe89e1dcf933d5c39 Author: Marc Zyngier Date: Sat Mar 21 21:24:19 2026 +0000 KVM: arm64: Remove extra ISBs when using msr_hcr_el2 The msr_hcr_el2 macro is slightly awkward, as it provides an ISB when CONFIG_AMPERE_ERRATUM_AC04_CPU_23 is present, and none otherwise. Note that this this option is 'default y', meaning that it is likely to be selected. Most instances of msr_hcr_el2 are also immediately followed by an ISB, meaning that in most cases, you end-up with two back-to-back ISBs. This isn't a big deal, but once you have seen that, you can't unsee it. Rework the msr_hcr_el2 macro to always provide the ISB, and drop the superfluous ISBs everywhere else. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260321212419.2803972-6-maz@kernel.org Signed-off-by: Marc Zyngier commit 59c6e12d40a5b05038b68bcdb4690456fee68e8a Author: Marc Zyngier Date: Sat Mar 21 21:24:18 2026 +0000 KVM: arm64: pkvm: Use direct function pointers for cpu_{on,resume} Instead of using a boolean to decide whether a CPU is booting or resuming, just pass an actual function pointer around. This makes the code a bit more straightforward to understand. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260321212419.2803972-5-maz@kernel.org Signed-off-by: Marc Zyngier commit ba64e273eac3d7ec4a2b621b3620c4d3b0399858 Author: Marc Zyngier Date: Sat Mar 21 21:24:17 2026 +0000 KVM: arm64: pkvm: Turn __kvm_hyp_init_cpu into an inner label __kvm_hyp_init_cpu really is an internal label for kvm_hyp_cpu_entry and kvm_hyp_cpu_resume. Make it clear that this is what it is, and drop a pointless branch in kvm_hyp_cpu_resume. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260321212419.2803972-4-maz@kernel.org Signed-off-by: Marc Zyngier commit 1536a0b1386850b67a9ea840e57b7b475e895fed Author: Marc Zyngier Date: Sat Mar 21 21:24:16 2026 +0000 KVM: arm64: pkvm: Simplify BTI handling on CPU boot In order to perform an indirect branch to kvm_host_psci_cpu_entry() on a BTI-aware system, we first branch to a 'BTI j' landing pad, and from there branch again to the target. While this works, this is really not required: - BLR works with 'BTI c' and 'PACIASP' as the landing pad - Even if LR gets clobbered by BLR, we are going to restore the host's registers, so it is pointless to try and avoid touching LR Given the above, drop the veneer and directly call into C code. If we were to come back from it, we'd directly enter the error handler. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260321212419.2803972-3-maz@kernel.org Signed-off-by: Marc Zyngier commit 4ebfa3230b40728638a6acceb709f900f920f921 Author: Marc Zyngier Date: Sat Mar 21 21:24:15 2026 +0000 KVM: arm64: pkvm: Move error handling to the end of kvm_hyp_cpu_entry We currently handle CPUs having booted at EL1 in the middle of the kvm_hyp_cpu_entry function. Not only this adversely affects readability, but this is also at a bizarre spot should more error handling be added (which we're about to do). Move the WFE/WFI loop to the end of the function and fix a comment. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260321212419.2803972-2-maz@kernel.org Signed-off-by: Marc Zyngier commit 78ec06991d2cd564ff45f280e0bb57b369be7587 Author: Heiner Kallweit Date: Fri Mar 20 23:10:59 2026 +0100 ata: libata-transport: remove redundant dynamic sysfs attributes Use the static sysfs attributes directly, this allows to significantly simplify the code. See attribute_container_add_attrs() for why member grp can be used instead of attrs. Signed-off-by: Heiner Kallweit Tested-by: Niklas Cassel Signed-off-by: Niklas Cassel commit a6ac0af4d51081ef63ee588c9b8fa10c0f8e9210 Author: Niklas Cassel Date: Fri Mar 20 11:59:51 2026 +0100 ata: libata-scsi: refactor ata_scsiop_maint_in() ata_scsiop_maint_in() is currently quite confusing to read, because it currently only implements support for the service action REPORT SUPPORTED OPERATION CODES. Thus, when this function is checking for "invalid command format", it is not very clear if it is an invalid command format for the MAINTENANCE IN command itself, or an invalid command format for the (currently one and only) service action/subcommand implemented for this command. Move the service action to a separate function, so it is more clear that the "invalid command format" check is actually specific for the REPORT SUPPORTED OPERATION CODES service action. This also makes it easier and less confusing to add support for additional service actions in the future. Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit f1c5ba960ddddda26880304ba08db11e56d07002 Author: Aniket Limaye Date: Wed Mar 4 14:41:05 2026 +0530 arm64: dts: ti: k3-j722s: Add main_i2c4 device node Add missing device tree node for main_i2c4, and the corresponding ranges in cbass_main. Interrupt for this i2c controller is routed through the Main GPIOMUX Router. Base address, Interrupt IDs are taken from J722S TRM [0]. Device, Clock IDs are taken from TISCI docs [1]. Additionally, the I2C4 is the only interrupt source to the GPIOMUX INTR router that generates level interrupts, while all other sources generate edge interrupts. Due to this, the router needs to handle interrupt-type on a per-line basis. Modify the router node and its consumers to specify the interrupt type corresponding to each interrupt line. [0]: https://www.ti.com/lit/zip/sprujb3 [1]: https://software-dl.ti.com/tisci/esd/latest/5_soc_doc/index.html#j722s Signed-off-by: Jared McArthur Signed-off-by: Aniket Limaye Tested-by: Nora Schiffer Link: https://patch.msgid.link/20260304-j722s-main-i2c4-dt-v1-1-03f79f0cdf97@ti.com Signed-off-by: Vignesh Raghavendra commit 8cd35ceadcfc8c5da2eb7f7ce24525ce9d4ee62e Author: Ming Qian Date: Fri Mar 6 14:59:50 2026 +0800 media: amphion: Fix race between m2m job_abort and device_run Fix kernel panic caused by race condition where v4l2_m2m_ctx_release() frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run with the same context. Race sequence: v4l2_m2m_try_run(): v4l2_m2m_ctx_release(): lock/unlock v4l2_m2m_cancel_job() job_abort() v4l2_m2m_job_finish() kfree(m2m_ctx) <- frees ctx device_run() <- use-after-free crash at 0x538 Crash trace: Unable to handle kernel read from unreadable memory at virtual address 0000000000000538 v4l2_m2m_try_run+0x78/0x138 v4l2_m2m_device_run_work+0x14/0x20 The amphion vpu driver does not rely on the m2m framework's device_run callback to perform encode/decode operations. Fix the race by preventing m2m framework job scheduling entirely: - Add job_ready callback returning 0 (no jobs ready for m2m framework) - Remove job_abort callback to avoid the race condition Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") Cc: stable@vger.kernel.org Signed-off-by: Ming Qian Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 35c8178ed2bd9821a75a406d762b2f2e161f9c70 Author: Cristian Ciocaltea Date: Wed Mar 4 23:00:41 2026 +0200 media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88} With the introduction of the RK3588 SoC, and RK3576 afterwards, three register blocks have been provided for the video decoder unit instead of just one, which are further referenced in vendor's datasheet by 'link table', 'function' and 'cache'. The former is present at the top of the listing, starting at video decoder unit base address. However, while documenting RK3588, the binding broke the convention expecting the unit address to indicate the start of the primary register range, i.e. the 'function' block got listed before the 'link' one. Since the binding changes have been already released and a fix would bring up an ABI break, mark the current 'reg-names' ordering as deprecated and introduce an alternative 'link,function,cache' listing which follows the address-based ordering according to the TRM. Additionally, drop the 'reg' description items as the order is not fixed anymore, while the information they offer is not very relevant anyway. It's worth noting there are currently no (known) users impacted by these binding changes, since the video decoder support for the aforementioned SoCs in mainline driver and devicetrees hasn't been released yet - it landed in v7.0-rc1 while all DTS updates resulting from this will be handled before v7.0 is out. Fixes: c6ffb7e1fb90 ("media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings") Fixes: a5c4a6526476 ("media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings") Cc: stable@vger.kernel.org Reviewed-by: Nicolas Dufresne Reviewed-by: Krzysztof Kozlowski Signed-off-by: Cristian Ciocaltea Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit a11db8d8b403eba1f82728f440727128e9997edd Author: Cristian Ciocaltea Date: Wed Mar 4 23:00:40 2026 +0200 media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88} The Rockchip Video Decoder driver expects reg-names to be mandatory for RK3576 and RK3588 SoCs, however the binding does not currently require the use of them. As a consequence, driver would fail to probe with a hypothetical devicetree that doesn't provide the reg-names for these SoCs, but which is otherwise a perfectly valid DT from the binding perspective. Update the binding and make reg-names required for the aforementioned SoCs. While this change introduces an ABI break, the expected impact on potential users would be minimal, if any, since the old SoCs are unaffected, while the video decoder support for these newer variants in mainline driver and devicetrees hasn't been released yet. Moreover, this is also a prerequisite for a subsequent binding update introducing an alternative reg-names order, according to the address-based listing in the vendor's datasheet. Reported-by: Conor Dooley Closes: https://lore.kernel.org/all/20260227-urologist-gratitude-7984733f2d41@spud/ Fixes: c6ffb7e1fb90 ("media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings") Fixes: a5c4a6526476 ("media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings") Cc: stable@vger.kernel.org Signed-off-by: Cristian Ciocaltea Acked-by: Conor Dooley Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 76e35091ffc722ba39b303e48bc5d08abb59dd56 Author: Fan Wu Date: Wed Mar 4 09:35:06 2026 +0000 media: mediatek: vcodec: fix use-after-free in encoder release path The fops_vcodec_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx->encode_work. This creates a race window where the workqueue handler (mtk_venc_worker) may still be accessing the context memory after it has been freed. Race condition: CPU 0 (release path) CPU 1 (workqueue) --------------------- ------------------ fops_vcodec_release() v4l2_m2m_ctx_release() v4l2_m2m_cancel_job() // waits for m2m job "done" mtk_venc_worker() v4l2_m2m_job_finish() // m2m job "done" // BUT worker still running! // post-job_finish access: other ctx dereferences // UAF if ctx already freed // returns (job "done") kfree(ctx) // ctx freed Root cause: The v4l2_m2m_ctx_release() only waits for the m2m job lifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle. After v4l2_m2m_job_finish() is called, the m2m framework considers the job complete and v4l2_m2m_ctx_release() returns, but the worker function continues executing and may still access ctx. The work is queued during encode operations via: queue_work(ctx->dev->encode_workqueue, &ctx->encode_work) The worker function accesses ctx->m2m_ctx, ctx->dev, and other ctx fields even after calling v4l2_m2m_job_finish(). This vulnerability was confirmed with KASAN by running an instrumented test module that widens the post-job_finish race window. KASAN detected: BUG: KASAN: slab-use-after-free in mtk_venc_worker+0x159/0x180 Read of size 4 at addr ffff88800326e000 by task kworker/u8:0/12 Workqueue: mtk_vcodec_enc_wq mtk_venc_worker Allocated by task 47: __kasan_kmalloc+0x7f/0x90 fops_vcodec_open+0x85/0x1a0 Freed by task 47: __kasan_slab_free+0x43/0x70 kfree+0xee/0x3a0 fops_vcodec_release+0xb7/0x190 Fix this by calling cancel_work_sync(&ctx->encode_work) before kfree(ctx). This ensures the workqueue handler is both cancelled (if pending) and synchronized (waits for any running handler to complete) before the context is freed. Placement rationale: The fix is placed after v4l2_ctrl_handler_free() and before list_del_init(&ctx->list). At this point, all m2m operations are done (v4l2_m2m_ctx_release() has returned), and we need to ensure the workqueue is synchronized before removing ctx from the list and freeing it. Note: The open error path does NOT need cancel_work_sync() because INIT_WORK() only initializes the work structure - it does not schedule it. Work is only scheduled later during device_run() operations. Fixes: 0934d3759615 ("media: mediatek: vcodec: separate decoder and encoder") Cc: stable@vger.kernel.org Signed-off-by: Fan Wu Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 34c519feef3e4fcff1078dc8bdb25fbbbd10303f Author: Fan Wu Date: Wed Mar 4 03:19:34 2026 +0000 media: mtk-jpeg: fix use-after-free in release path due to uncancelled work The mtk_jpeg_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx->jpeg_work. This creates a race window where the workqueue callback may still be accessing the context memory after it has been freed. Race condition: CPU 0 (release) CPU 1 (workqueue) ---------------- ------------------ close() mtk_jpeg_release() mtk_jpegenc_worker() ctx = work->data // accessing ctx kfree(ctx) // freed! access ctx // UAF! The work is queued via queue_work() during JPEG encode/decode operations (via mtk_jpeg_device_run). If the device is closed while work is pending or running, the work handler will access freed memory. Fix this by calling cancel_work_sync() BEFORE acquiring the mutex. This ordering is critical: if cancel_work_sync() is called after mutex_lock(), and the work handler also tries to acquire the same mutex, it would cause a deadlock. Note: The open error path does NOT need cancel_work_sync() because INIT_WORK() only initializes the work structure - it does not schedule it. Work is only scheduled later during ioctl operations. Fixes: 5fb1c2361e56 ("mtk-jpegenc: add jpeg encode worker interface") Cc: stable@vger.kernel.org Signed-off-by: Fan Wu Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit f1670645365515ffeae100073603246a622ad3bf Author: Ming Qian Date: Tue Feb 3 16:23:41 2026 +0800 media: imx-jpeg: Add support for encoder v1 descriptor configuration Support the upgraded JPEG encoder v1 found on i.MX952 SoC. Detect the encoder hardware version via the version register. The v1 encoder uses an expanded descriptor format that allows all encoding parameters, including JPEG quality, to be configured directly in the descriptor. This removes the manual register-based configuration step required by v0 and reduces the interrupt count from two to one per frame. V0 encoding flow: 1. Write quality to registers -> trigger config interrupt 2. Start encoding -> trigger completion interrupt V1 encoding flow: 1. Configure descriptor with all parameters including quality 2. Start encoding -> trigger completion interrupt Reviewed-by: Frank Li Signed-off-by: Ming Qian Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 03b5048a21bb542ee77990890ee1ad67732e94ff Author: Ming Qian Date: Tue Feb 3 16:23:40 2026 +0800 media: imx-jpeg: Add encoder ops layer for hardware abstraction Introduce mxc_jpeg_enc_ops function pointer structure to abstract encoder configuration differences between hardware versions. Extract the existing two-phase manual configuration into dedicated functions (enter_config_mode/exit_config_mode) for v0 hardware. Add setup_desc callback placeholder for future v1 hardware support which will use descriptor-based configuration. Store the extended sequential mode flag in the context to avoid recalculating it during configuration phases. No functional change. Reviewed-by: Frank Li Signed-off-by: Ming Qian Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 809307970960e3de098c7749df86956a304ee126 Author: Ming Qian Date: Tue Feb 3 16:23:39 2026 +0800 media: imx-jpeg: Use devm_pm_runtime_enable() helper Use devm_pm_runtime_enable() to simplify probe and exit paths. No functional change. Signed-off-by: Ming Qian Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit a980f845f2fa6aea51dd0183d9999bbb8b7873c8 Author: Ming Qian Date: Tue Feb 3 16:23:38 2026 +0800 media: imx-jpeg: Simplify descriptor initialization with memset Use memset() to zero-initialize desc and cfg_desc structures instead of assigning individual fields to zero. This is cleaner and ensures all descriptor fields are properly initialized. No functional change. Reviewed-by: Frank Li Signed-off-by: Ming Qian Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit cb8bdd3ffca280d014311ab395651d33f58a8708 Author: Ziyi Guo Date: Sat Jan 31 22:19:07 2026 +0000 media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Add spin_lock_irqsave()/spin_unlock_irqrestore() around the handle_dynamic_resolution_change() call in initialize_sequence() to fix the missing lock protection. initialize_sequence() calls handle_dynamic_resolution_change() without holding inst->state_spinlock. However, handle_dynamic_resolution_change() has lockdep_assert_held(&inst->state_spinlock) indicating that callers must hold this lock. Other callers of handle_dynamic_resolution_change() properly acquire the spinlock: - wave5_vpu_dec_finish_decode() - wave5_vpu_dec_device_run() Signed-off-by: Ziyi Guo Reviewed-by: Nicolas Dufresne Fixes: 9707a6254a8a6b ("media: chips-media: wave5: Add the v4l2 layer") Cc: stable@vger.kernel.org Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit f48050436746be75227fbc90066a8658cbe94d17 Author: Ziyi Guo Date: Sat Jan 31 22:03:23 2026 +0000 media: chips-media: wave5: add missing spinlock protection for send_eos_event() Add spin_lock_irqsave()/spin_unlock_irqrestore() around send_eos_event() calls in the VB2 buffer queue and streamoff callbacks to fix the missing lock protection. wave5_vpu_dec_buf_queue_dst() and streamoff_output() call send_eos_event() without holding inst->state_spinlock. However, send_eos_event() has lockdep_assert_held(&inst->state_spinlock) indicating that callers must hold this lock. Other callers of send_eos_event() properly acquire the spinlock: - wave5_vpu_dec_finish_decode() acquires lock at line 431 - wave5_vpu_dec_encoder_cmd() acquires lock at line 821 - wave5_vpu_dec_device_run() acquires lock at line 1592 Signed-off-by: Ziyi Guo Reviewed-by: Nicolas Dufresne Fixes: 9707a6254a8a6b ("media: chips-media: wave5: Add the v4l2 layer") Cc: stable@vger.kernel.org Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 95bd174a453f77b09ea66e1e22834680754ba501 Author: Haoxiang Li Date: Sun Jan 25 22:19:15 2026 +0800 media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Add wave5_vdi_free_dma_memory() in the error path of wave5_vdi_init() to prevent a potential memory leak. Fixes: 45d1a2b93277 ("media: chips-media: wave5: Add vpuapi layer") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit a5877e921389178f994a5ec15a145d7e7ba3ec65 Author: Dmitry Torokhov Date: Wed Mar 18 19:56:18 2026 -0700 platform/x86: barco-p50-gpio: convert to guard() notation Using guard notation simplifies control flow and makes the code clearer. Suggested-by: Ilpo Järvinen Signed-off-by: Dmitry Torokhov Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260318-barco-p50-gpio-set-v2-2-c0a4a6416163@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1c9d30d37aaffe3454d70b89a77f8aaecda257bf Author: Dmitry Torokhov Date: Wed Mar 18 19:56:17 2026 -0700 platform/x86: barco-p50-gpio: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by p50_gpio_get() is normalized to the [0, 1] range. Fixes: 86ef402d805d606a ("gpiolib: sanitize the return value of gpio_chip::get()") Reviewed-by: Linus Walleij Signed-off-by: Dmitry Torokhov Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260318-barco-p50-gpio-set-v2-1-c0a4a6416163@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit df236c996bb4654a3e2a2358a8b40fecfbb0c6a1 Merge: e9b7a02e5859e5 388bb26b3d33de Author: Carlos Maiolino Date: Mon Mar 23 11:11:13 2026 +0100 Merge branch 'xfs-7.1-merge' into for-next Signed-off-by: Carlos Maiolino commit e9b7a02e5859e56e11579450ded40d66626790a7 Merge: 2c0ff6151c7bc5 c6c56ff975f046 Author: Carlos Maiolino Date: Mon Mar 23 11:10:52 2026 +0100 Merge branch 'xfs-7.0-fixes' into for-next Signed-off-by: Carlos Maiolino commit 388bb26b3d33de3c53a492824a4c5804151a0014 Author: Brian Foster Date: Wed Mar 11 12:25:02 2026 -0400 xfs: report cow mappings with dirty pagecache for iomap zero range XFS has long supported the case where it is possible to have dirty data in pagecache backed by COW fork blocks and a hole in the data fork. This occurs for two reasons. On reflink enabled files, COW fork blocks are allocated with preallocation to help avoid fragmention. Second, if a mapping lookup for a write finds blocks in the COW fork, it consumes those blocks unconditionally. This might mean that COW fork blocks are backed by non-shared blocks or even a hole in the data fork, both of which are perfectly fine. This leaves an odd corner case for zero range, however, because it needs to distinguish between ranges that are sparse and thus do not require zeroing and those that are not. A range backed by COW fork blocks and a data fork hole might either be a legitimate hole in the file or a range with pending buffered writes that will be written back (which will remap COW fork blocks into the data fork). This "COW fork blocks over data fork hole" situation has historically been reported as a hole to iomap, which then has grown a flush hack as a workaround to ensure zeroing occurs correctly. Now that this has been lifted into the filesystem and replaced by the dirty folio lookup mechanism, we can do better and use the pagecache state to decide how to report the mapping. If a COW fork range exists with dirty folios in cache, then report a typical shared mapping. If the range is clean in cache, then we can consider the COW blocks preallocation and call it a hole. This doesn't fundamentally change behavior, but makes mapping reporting more accurate. Note that this does require splitting across the EOF boundary (similar to normal zero range) to ensure we don't spuriously perform post-eof zeroing. iomap will warn about zeroing beyond EOF because folios beyond i_size may not be written back. Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit ce9d27ca8b2eafdd2457a15aafdab74218843138 Author: Brian Foster Date: Wed Mar 11 12:25:01 2026 -0400 xfs: replace zero range flush with folio batch Now that the zero range pagecache flush is purely isolated to providing zeroing correctness in this case, we can remove it and replace it with the folio batch mechanism that is used for handling unwritten extents. This is still slightly odd in that XFS reports a hole vs. a mapping that reflects the COW fork extents, but that has always been the case in this situation and so a separate issue. We drop the iomap warning that assumes the folio batch is always associated with unwritten mappings, but this is mainly a development assertion as otherwise the core iomap fbatch code doesn't care much about the mapping type if it's handed the set of folios to process. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit c770f997a4227b6fc5f62275b2337622213e35af Author: Brian Foster Date: Wed Mar 11 12:25:00 2026 -0400 xfs: only flush when COW fork blocks overlap data fork holes The zero range hole mapping flush case has been lifted from iomap into XFS. Now that we have more mapping context available from the ->iomap_begin() handler, we can isolate the flush further to when we know a hole is fronted by COW blocks. Rather than purely rely on pagecache dirty state, explicitly check for the case where a range is a hole in both forks. Otherwise trim to the range where there does happen to be overlap and use that for the pagecache writeback check. This might prevent some spurious zeroing, but more importantly makes it easier to remove the flush entirely. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a8eb41376df987887b33dbf7078d5b13c85f3e0c Author: Brian Foster Date: Wed Mar 11 12:24:59 2026 -0400 xfs: look up cow fork extent earlier for buffered iomap_begin To further isolate the need for flushing for zero range, we need to know whether a hole in the data fork is fronted by blocks in the COW fork or not. COW fork lookup currently occurs further down in the function, after the zero range case is handled. As a preparation step, lift the COW fork extent lookup to earlier in the function, at the same time as the data fork lookup. Only the lookup logic is lifted. The COW fork branch/reporting logic remains as is to avoid any observable behavior change from an iomap reporting perspective. Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit c35a3e273e86e89f73abc4e75e33648fac20eec9 Author: Brian Foster Date: Wed Mar 11 12:24:58 2026 -0400 xfs: flush eof folio before insert range size update The flush in xfs_buffered_write_iomap_begin() for zero range over a data fork hole fronted by COW fork prealloc is primarily designed to provide correct zeroing behavior in particular pagecache conditions. As it turns out, this also partially masks some odd behavior in insert range (via zero range via setattr). Insert range bumps i_size the length of the new range, flushes, unmaps pagecache and cancels COW prealloc, and then right shifts extents from the end of the file back to the target offset of the insert. Since the i_size update occurs before the pagecache flush, this creates a transient situation where writeback around EOF can behave differently. This appears to be corner case situation, but if happens to be fronted by COW fork speculative preallocation and a large, dirty folio that contains at least one full COW block beyond EOF, the writeback after i_size is bumped may remap that COW fork block into the data fork within EOF. The block is zeroed and then shifted back out to post-eof, but this is unexpected in that it leads to a written post-eof data fork block. This can cause a zero range warning on a subsequent size extension, because we should never find blocks that require physical zeroing beyond i_size. To avoid this quirk, flush the EOF folio before the i_size update during insert range. The entire range will be flushed, unmapped and invalidated anyways, so this should be relatively unnoticeable. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a35bb0dec9552aa2bc69a24e3126c68c257bf55e Author: Brian Foster Date: Wed Mar 11 12:24:57 2026 -0400 iomap, xfs: lift zero range hole mapping flush into xfs iomap zero range has a wart in that it also flushes dirty pagecache over hole mappings (rather than only unwritten mappings). This was included to accommodate a quirk in XFS where COW fork preallocation can exist over a hole in the data fork, and the associated range is reported as a hole. This is because the range actually is a hole, but XFS also has an optimization where if COW fork blocks exist for a range being written to, those blocks are used regardless of whether the data fork blocks are shared or not. For zeroing, COW fork blocks over a data fork hole are only relevant if the range is dirty in pagecache, otherwise the range is already considered zeroed. The easiest way to deal with this corner case is to flush the pagecache to trigger COW remapping into the data fork, and then operate on the updated on-disk state. The problem is that ext4 cannot accommodate a flush from this context due to being a transaction deadlock vector. Outside of the hole quirk, ext4 can avoid the flush for zero range by using the recently introduced folio batch lookup mechanism for unwritten mappings. Therefore, take the next logical step and lift the hole handling logic into the XFS iomap_begin handler. iomap will still flush on unwritten mappings without a folio batch, and XFS will flush and retry mapping lookups in the case where it would otherwise report a hole with dirty pagecache during a zero range. Note that this is intended to be a fairly straightforward lift and otherwise not change behavior. Now that the flush exists within XFS, follow on patches can further optimize it. Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 2f46c239fce617ac26cc40d9520b1c0cf05cd34f Author: Brian Foster Date: Wed Mar 11 12:24:56 2026 -0400 xfs: flush dirty pagecache over hole in zoned mode zero range For zoned filesystems a window exists between the first write to a sparse range (i.e. data fork hole) and writeback completion where we might spuriously observe holes in both the COW and data forks. This occurs because a buffered write populates the COW fork with delalloc, writeback submission removes the COW fork delalloc blocks and unlocks the inode, and then writeback completion remaps the physically allocated blocks into the data fork. If a zero range operation does a lookup during this window where both forks show a hole, it incorrectly reports a hole mapping for a range that contains data. This currently works because iomap checks for dirty pagecache over holes and unwritten mappings. If found, it flushes and retries the lookup. We plan to remove the hole flush logic from iomap, however, so lift the flush into xfs_zoned_buffered_write_iomap_begin() to preserve behavior and document the purpose for it. Zoned XFS filesystems don't support unwritten extents, so if zoned mode can come up with a way to close this transient hole window in the future, this flush can likely be removed. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 92e9dff9ca5026805798b13b967760f8058794e8 Author: Brian Foster Date: Wed Mar 11 12:24:55 2026 -0400 xfs: fix iomap hole map reporting for zoned zero range The hole mapping logic for zero range in zoned mode is not quite correct. It currently reports a hole whenever one exists in the data fork. If the first write to a sparse range has completed and not yet written back, the blocks exist in the COW fork as delalloc until writeback completes, at which point they are allocated and mapped into the data fork. If a zero range occurs on a range that has not yet populated the data fork, we will incorrectly report it as a hole. Note that this currently functions correctly because we are bailed out by the pagecache flush in iomap_zero_range(). If a hole or unwritten mapping is reported with dirty pagecache, it assumes there is pending data, flushes to induce any pending block allocations/remaps, and retries the lookup. We want to remove this hack from iomap, however, so update iomap_begin() to only report a hole for zeroing when one exists in both forks. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 19e15dc73f0fc74eaf63ad9b3a50648450269b4d Author: Wei-Lin Chang Date: Tue Mar 17 18:26:38 2026 +0000 KVM: arm64: nv: Expose shadow page tables in debugfs Exposing shadow page tables in debugfs improves the debugability and testability of NV. With this patch a new directory "nested" is created for each VM created if the host is NV capable. Within the directory each valid s2 mmu will have its shadow page table exposed as a readable file with the file name formatted as 0x-0x-s2-{en,dis}abled. The creation and removal of the files happen at the points when an s2 mmu becomes valid, or the context it represents change. In the future the "nested" directory can also hold other NV related information. This is gated behind CONFIG_PTDUMP_STAGE2_DEBUGFS. Suggested-by: Marc Zyngier Reviewed-by: Sebastian Ene Signed-off-by: Wei-Lin Chang Reviewed-by: Joey Gouly Link: https://patch.msgid.link/20260317182638.1592507-3-weilin.chang@arm.com [maz: minor refactor, full 16 chars addresses] Signed-off-by: Marc Zyngier commit 87599f1843d3baa4083dc9dd01c95826b536de24 Author: Rob Herring (Arm) Date: Fri Mar 20 11:47:18 2026 -0500 arm64: dts: arm/corstone1000: Add corstone-1000-a320 The Corstone-1000-a320 is a Corstone-1000 derivative with Cortex-A320 cores, GIC-600, and Ethos-U85 NPU. Signed-off-by: Rob Herring (Arm) Message-Id: <20260320-dt-corstone1000-a320-v1-5-a549dfcfe8da@kernel.org> Signed-off-by: Sudeep Holla commit 9c3904f94fdbee59cd359d6a267595261d6039c4 Author: Rob Herring (Arm) Date: Fri Mar 20 11:47:17 2026 -0500 arm64: dts: arm/corstone1000: Move FVP peripherals to separate .dtsi The FVPs have a common set of peripherals specific to the FVP. Move these to a separate .dtsi so they can be shared across FVP platforms. Signed-off-by: Rob Herring (Arm) Message-Id: <20260320-dt-corstone1000-a320-v1-4-a549dfcfe8da@kernel.org> Signed-off-by: Sudeep Holla commit 903528ac234ab354b68c5e3008986ee7123b1039 Author: Rob Herring (Arm) Date: Fri Mar 20 11:47:16 2026 -0500 arm64: dts: arm/corstone1000: Move cpu nodes In preparation to add a new Corstone-1000 variation with different CPUs, move the CPU nodes into the specific platforms and out of the common corstone1000.dtsi. Signed-off-by: Rob Herring (Arm) Message-Id: <20260320-dt-corstone1000-a320-v1-3-a549dfcfe8da@kernel.org> Signed-off-by: Sudeep Holla commit 55de145c8ec2d5d8f0813de2f2c5015585089b30 Author: Rob Herring (Arm) Date: Fri Mar 20 11:47:15 2026 -0500 dt-bindings: npu: arm,ethos: Add "arm,corstone1000-ethos-u85" The Corstone-1000-A320 platform contains an Ethos-U85 NPU. Add a specific compatible for it. Signed-off-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Message-Id: <20260320-dt-corstone1000-a320-v1-2-a549dfcfe8da@kernel.org> Signed-off-by: Sudeep Holla commit f9d162866f2f2b76c91d72564d1f93757222c566 Author: Rob Herring (Arm) Date: Fri Mar 20 11:47:14 2026 -0500 dt-bindings: arm,corstone1000: Add "arm,corstone1000-a320-fvp" The Arm Corstone1000-A320 is a variation of the Corstone1000 with Cortex-A320 cores and an Ethos-U85 NPU. An FVP for the platform is available here[1]. [1] https://developer.arm.com/Tools%20and%20Software/Fixed%20Virtual%20Platforms/IoT%20FVPs Signed-off-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Message-Id: <20260320-dt-corstone1000-a320-v1-1-a549dfcfe8da@kernel.org> Signed-off-by: Sudeep Holla commit ececb46fc947705f22cc8c1f9182224e7ec4bb97 Author: Conor Dooley Date: Wed Mar 18 11:04:32 2026 +0000 dt-bindings: gpio: fix microchip,mpfs-gpio interrupt documentation The microchip,mpfs-gpio binding suffered greatly due to being written with a narrow minded view of the controller, and the interrupt bits ended up incorrect. It was mistakenly assumed that the interrupt configuration was set by platform firmware, based on the FPGA configuration, and that the GPIO DT nodes were the only way to really communicate interrupt configuration to software. Instead, the mux should be a device in its own right, and the GPIO controllers should be connected to it, rather than to the PLIC. Now that a binding exists for that mux, try to fix the misconceptions in the GPIO controller binding. Firstly, it's not possible for this controller to have fewer than 14 GPIOs, and thus 14 interrupts also. There are three controllers, with 14, 24 & 32 GPIOs each. The fabric core, CoreGPIO, can of course have a customisable number of GPIOs. The example is wacky too - it follows from the incorrect understanding that the GPIO controllers are connected to the PLIC directly. They are not however, with a mux sitting in between. Update the example to use the mux as a parent, and the interrupt numbers at the mux for GPIO2 as the example - rather than the strange looking, repeated <53>. Signed-off-by: Conor Dooley Acked-by: Rob Herring (Arm) Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260318-fondly-tradition-90b8241f0cc8@spud Signed-off-by: Bartosz Golaszewski commit 9a5bf2f53b76b1619c602f9e751fe4c0e64713ca Author: Rosen Penev Date: Thu Mar 19 17:53:38 2026 -0700 gpio: dwapb: reduce allocation to single kzalloc Instead of kzalloc + kcalloc, Combine the two using a flexible array member. Allows using __counted_by for extra runtime analysis. Move counting variable to right after allocation as required by __counted_by. Signed-off-by: Rosen Penev Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260320005338.30355-1-rosenp@gmail.com Signed-off-by: Bartosz Golaszewski commit 8786af7704e6289c69d2723def3ca406a15c0dff Author: Andy Shevchenko Date: Fri Mar 20 23:20:33 2026 +0100 platform/mellanox: nvsw-sn2201: Drop unused include This driver includes the legacy header but does not use any symbols from it. Drop the inclusion. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260320222033.3238317-1-andriy.shevchenko@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c62bf0b0c7608b0b47548e0f52d65183ad6ce2eb Author: Andy Shevchenko Date: Fri Mar 20 23:11:43 2026 +0100 platform/surface: hotplug: Correct inclusion for GPIO APIs The modern GPIO APIs are available for users via linux/gpio/consumer.h. The linux/gpio.h is legacy header that is subject to remove. Hence replace the latter by the former in the driver. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260320221143.3237791-1-andriy.shevchenko@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e8c3a913c8582d255899212c68492eeb58f06f07 Author: Tejas Upadhyay Date: Thu Mar 5 17:49:07 2026 +0530 drm/xe/xe3p: Skip TD flush Xe3p has HW ability to do transient display flush so the xe driver can enable this HW feature by default and skip the software TD flush. Bspec: 60002 Reviewed-by: Thomas Hellström Reviewed-by: Shekhar Chauhan Link: https://patch.msgid.link/20260305121902.1892593-10-tejas.upadhyay@intel.com Signed-off-by: Tejas Upadhyay commit 4f39a194d41e6b8cb61a91a7bb01b17be59a7d73 Author: Tejas Upadhyay Date: Thu Mar 5 17:49:06 2026 +0530 drm/xe/xe3p_lpg: Restrict UAPI to enable L2 flush optimization When set, starting xe3p_lpg, the L2 flush optimization feature will control whether L2 is in Persistent or Transient mode through monitoring of media activity. To enable L2 flush optimization include new feature flag GUC_CTL_ENABLE_L2FLUSH_OPT for Novalake platforms when media type is detected. Tighten UAPI validation to restrict userptr, svm and dmabuf mappings to be either 2WAY or XA+1WAY V5(Thomas): logic correction V4(MattA): Modify uapi doc and commit V3(MattA): check valid op and pat_index value V2(MattA): validate dma-buf bos and madvise pat-index Acked-by: José Roberto de Souza Acked-by: Michal Mrozek Acked-by: Carl Zhang Reviewed-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://patch.msgid.link/20260305121902.1892593-9-tejas.upadhyay@intel.com Signed-off-by: Tejas Upadhyay commit 19ebacfb442b83aa5fe75f9c6851b4edbfff3760 Author: Rafael J. Wysocki Date: Wed Mar 18 15:36:06 2026 +0100 platform/x86: dell/dell-rbtn: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Dell Airplane Mode Switch (rbtn) ACPI driver to a platform one. After this change, the subordinate rfkill device will be registered under the platform device used for driver binding instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/6141354.MhkbZ0Pkbq@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit da71de1b46bf42075b78e773bd3d3779548ba7a3 Author: Rafael J. Wysocki Date: Wed Mar 18 15:35:05 2026 +0100 platform/x86: dell/dell-rbtn: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/9591832.CDJkKcVGEf@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 411389d29eab5325e2b250b1cd2ddb567abb7bbb Author: Tejas Upadhyay Date: Thu Mar 5 17:49:05 2026 +0530 drm/xe/pat: define coh_mode 2way Defining 2way (two-way coherency) is critical for Xe3p_LPG (Nova Lake P) platforms to support L2 flush optimization safely. This mode allows the driver to skip certain manual cache flushes (L2 flush optimization) without risking memory corruption because the hardware ensures the most recent data is visible to both entities. Reviewed-by: Matthew Auld Link: https://patch.msgid.link/20260305121902.1892593-8-tejas.upadhyay@intel.com Signed-off-by: Tejas Upadhyay commit 4e7ebff69aed345f65f590a17b3119c0cb5eadde Author: Tejas Upadhyay Date: Thu Mar 5 17:49:04 2026 +0530 drm/xe/xe3p_lpg: flush shrinker bo cachelines manually XA, new pat_index introduced post xe3p_lpg, is memory shared between the CPU and GPU is treated differently from other GPU memory when the Media engine is power-gated. XA is *always* flushed, like at the end-of-submssion (and maybe other places), just that internally as an optimisation hw doesn't need to make that a full flush (which will also include XA) when Media is off/powergated, since it doesn't need to worry about GT caches vs Media coherency, and only CPU vs GPU coherency, so can make that flush a targeted XA flush, since stuff tagged with XA now means it's shared with the CPU. The main implication is that we now need to somehow flush non-XA before freeing system memory pages, otherwise dirty cachelines could be flushed after the free (like if Media suddenly turns on and does a full flush) V4: Add comments for L2 flush path V3(Thomas/MattA/MattR): Restrict userptr with non-xa, then no need to flush manually V2(MattA): Expand commit description Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20260305121902.1892593-7-tejas.upadhyay@intel.com Signed-off-by: Tejas Upadhyay commit 8da6fd088472f4db6199fb68af6ec87fa26247ca Author: Lukas Herbolt Date: Tue Mar 10 13:30:22 2026 +0100 xfs: Use xarray to track SB UUIDs instead of plain array. Removing the plain array to track the UUIDs and switch to xarray makes it more readable. Signed-off-by: Lukas Herbolt [cem: remove unneeded return from xfs_uuid_unmount] Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 61e7649a1a253609769063a30018e68b970324d6 Author: Michal Wajdeczko Date: Tue Mar 3 21:13:54 2026 +0100 drm/xe/vf: Improve getting clean NULL context There is a small risk that when fetching a NULL context image the VF may get a tweaked context image prepared by another VF that was previously running on the engine before the GuC scheduler switched the VFs. To avoid that risk, without forcing GuC scheduler to trigger costly engine reset on every VF switch, use a watchdog mechanism that when configured with impossible condition, triggers an interrupt, which GuC will handle by doing an engine reset. Also adjust job size to account for additional dwords with watchdog setup. Signed-off-by: Michal Wajdeczko Reviewed-by: Michał Winiarski Link: https://patch.msgid.link/20260303201354.17948-4-michal.wajdeczko@intel.com commit d95fda29758b59f4279465892905ca57dfd4bb10 Author: Michal Wajdeczko Date: Tue Mar 3 21:13:53 2026 +0100 drm/xe: Add MI_SEMAPHORE_WAIT command definition This command supports memory based Semaphore WAIT. Memory based semaphores will be used for synchronization between the Producer and the Consumer contexts. Producer and Consumer Contexts could be running on different engines or on the same engine inside GT. Bspec: 45749, 60244 Signed-off-by: Michal Wajdeczko Reviewed-by: Michał Winiarski Link: https://patch.msgid.link/20260303201354.17948-3-michal.wajdeczko@intel.com commit 6cd7d168c414fa895c8cf21d81d563ef1f557b51 Author: Michal Wajdeczko Date: Tue Mar 3 21:13:52 2026 +0100 drm/xe: Add PR_CTR_CTRL/THRSH register definitions The Watchdog Counter Control and Watchdog Counter Threshold registers are needed for watchdog programming. This watchdog will generate the "Media Hang Notify" interrupt. Bspec: 45999, 46000 Bspec: 60373, 60374 Signed-off-by: Michal Wajdeczko Reviewed-by: Michał Winiarski Link: https://patch.msgid.link/20260303201354.17948-2-michal.wajdeczko@intel.com commit 80b8f68b94abcf6f2f8c71a685b2a70fd7c502b0 Author: Rafael J. Wysocki Date: Wed Mar 18 14:54:45 2026 +0100 platform/x86: system76: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the System76 ACPI driver to a platform one. After this change, the subordinate hwmon, input and LED class devices will be registered under the platform device used for driver binding instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3401648.aeNJFYEL58@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 89729c9c6c158259b8de14c57b5aac6a25dfac3d Author: Rafael J. Wysocki Date: Wed Mar 18 14:53:37 2026 +0100 platform/x86: system76: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/13970743.uLZWGnKmhe@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5539165cae8e133275f0eed4cfa131cda974a1a3 Author: Rafael J. Wysocki Date: Wed Mar 18 14:50:08 2026 +0100 platform/x86: system76: Drop redundant devm_led_classdev_unregister() Drop two redundant devm_led_classdev_unregister() calls from system76_remove(). No intentional functional impact. Suggested-by: Ilpo Järvinen Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5057164.GXAFRqVoOG@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit de6837243af00dc22b5117f45a35ec20adbf62c5 Author: Rafael J. Wysocki Date: Fri Mar 20 11:35:54 2026 +0100 platform/x86: panasonic-laptop: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Panasonic laptop ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. To maintain backwards compatibility with possibly existing user space, the sysfs attributes created by the driver under the ACPI device object used by it are not relocated. Accordingly, the driver will continue to use the driver_data pointer in struct acpi_device which needs to be cleared on driver removal. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/8664183.T7Z3S40VBb@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0381b6a65716dae778fb4b5ee4ee42aca62402e9 Author: Rafael J. Wysocki Date: Fri Mar 20 11:34:06 2026 +0100 platform/x86: panasonic-laptop: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/13979037.uLZWGnKmhe@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a347e11252c60bfce1bf15f2f86484cdb9bf6468 Author: Rafael J. Wysocki Date: Fri Mar 20 11:33:03 2026 +0100 platform/x86: panasonic-laptop: Remove redundant checks from 3 functions The device pointer cannot be NULL in acpi_pcc_hotkey_add() and acpi_pcc_hotkey_remove() because these functions are ACPI driver callbacks and NULL is never passed to any of them as an argument. Likewise, acpi_pcc_hotkey_resume() is a resume callback of a device driver and NULL is never passed to it as an argument, so the dev pointer in it cannot be NULL. Moreover, since acpi_pcc_hotkey_remove() and acpi_pcc_hotkey_resume() can only run after acpi_pcc_hotkey_add() has completed successfully, the acpi_driver_data() of the device object used by them cannot be NULL when they run. Drop all of the redundant NULL checks of the pointers mentioned above. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/1957824.tdWV9SEqCh@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8baeff2c1d33dad8572216c6ad3a7425852507d4 Author: Rafael J. Wysocki Date: Fri Mar 20 11:31:54 2026 +0100 platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup An ACPI notify handler is leaked if device_create_file() returns an error in acpi_pcc_hotkey_add(). Also, it is pointless to call pcc_unregister_optd_notifier() in acpi_pcc_hotkey_remove() if pcc->platform is NULL and it is better to arrange the cleanup code in that function in the same order as the rollback code in acpi_pcc_hotkey_add(). Address the above by placing the pcc_register_optd_notifier() call in acpi_pcc_hotkey_add() after the device_create_file() return value check and placing the pcc_unregister_optd_notifier() call in acpi_pcc_hotkey_remove() right before the device_remove_file() call. Fixes: d5a81d8e864b ("platform/x86: panasonic-laptop: Add support for optical driver power in Y and W series") Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2411055.ElGaqSPkdT@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e2b0cd5c265f01977ed4e7f04bd989cdb0b9eaed Author: Rafael J. Wysocki Date: Fri Mar 20 11:30:32 2026 +0100 platform/x86: panasonic-laptop: Make pcc_register_optd_notifier() void Convert pcc_register_optd_notifier() whose return value is never used to a void function. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5093613.31r3eYUQgx@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 19ca423f61b66ee3328b6a2f35fbb3ff2c8566f5 Author: Tommaso Merciai Date: Tue Feb 17 17:23:49 2026 +0100 arm64: dts: renesas: r9a09g047e57-smarc: Enable RSPI0 Enable RSPI0 on the RZ/G3E SMARC EVK, where it is accessible on the PMOD0 connector. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/b634c10e632fed07b5652c11de060deca27ead90.1771344527.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit d2c3353ddbebd07b27ded9813a665557cc0f96d7 Author: Tommaso Merciai Date: Tue Feb 17 17:23:48 2026 +0100 arm64: dts: renesas: r9a09g047: Add RSPI nodes Add nodes for the RSPI IPs found in the Renesas RZ/G3E SoC. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/c8df5202caf4e36ee5beafe78ad0940643edcbb6.1771344527.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 37d5b68ab57c5b4fb1c40e62c6b32376c6a2ca2c Author: Allen Ye Date: Wed Feb 18 16:30:27 2026 -0800 wifi: mt76: fix backoff fields and max_power calculation The maximum power value may exist in either the data or backoff field. Previously, backoff power limits were not considered in txpower reporting. This patch ensures mt76 also considers backoff values in the SKU table. Also, each RU entry (RU26, RU52, RU106, BW20, ...) in the DTS corresponds to 10 stream combinations (1T1ss, 2T1ss, 3T1ss, 4T1ss, 2T2ss, 3T2ss, 4T2ss, 3T3ss, 4T3ss, 4T4ss). For beamforming tables: - In connac2, beamforming entries for BW20~BW160, and OFDM do not include 1T1ss. - In connac3, beamforming entries for BW20~BW160, and RU include 1T1ss, but OFDM beamforming does not include 1T1ss. Non-beamforming and RU entries for both connac2 and connac3 include 1T1ss. Fixes: b05ab4be9fd7 ("wifi: mt76: mt7915: add bf backoff limit table support") Signed-off-by: Allen Ye Co-developed-by: Ryder Lee Signed-off-by: Ryder Lee Link: https://patch.msgid.link/8fa8ec500b3d4de7b1966c6887f1dfbe5c46a54c.1771205424.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau commit ee5bb35d2b83fadc6920aa2478326fb50ea653a9 Author: Madhur Kumar Date: Mon Dec 8 22:53:31 2025 +0530 wifi: mt76: mt7921: Replace deprecated PCI function pcim_iomap_table() and pcim_iomap_regions() have been deprecated. Replace them with pcim_iomap_region(). Signed-off-by: Madhur Kumar Link: https://patch.msgid.link/20251208172331.89705-1-madhurkumar004@gmail.com Signed-off-by: Felix Fietkau commit 0176417d10ce964cd195e64eff9e079cc0a52b69 Author: Chad Monroe Date: Mon Dec 8 14:14:50 2025 +0000 wifi: mt76: mt7996: increase txq memory limit to 32 MiB Prior to this change, both 2G and 6G radios would fall back to the mac80211 default of 4MB which is not enough for high data rates. Signed-off-by: Chad Monroe Link: https://patch.msgid.link/acfe2e25768b414518be2db22b1d3ba6f5db6fa1.1765203249.git.chad@monroe.io Signed-off-by: Felix Fietkau commit d2b860454ea2df8f336e9b859da7ffb27f43444d Author: Chad Monroe Date: Mon Dec 8 14:24:00 2025 +0000 wifi: mt76: mt7996: reset device after MCU message timeout Trigger a full reset after MCU message timeout. Signed-off-by: Chad Monroe Link: https://patch.msgid.link/6e05ed063f3763ad3457633c56b60a728a49a6f0.1765203753.git.chad@monroe.io Signed-off-by: Felix Fietkau commit 6939b97ddad3cf3dfbb3b5a0a12ef79cb886747e Author: Chad Monroe Date: Mon Dec 8 14:31:32 2025 +0000 wifi: mt76: fix deadlock in remain-on-channel mt76_remain_on_channel() and mt76_roc_complete() call mt76_set_channel() while already holding dev->mutex. Since mt76_set_channel() also acquires dev->mutex, this results in a deadlock. Use __mt76_set_channel() instead of mt76_set_channel(). Add cancel_delayed_work_sync() for mac_work before acquiring the mutex in mt76_remain_on_channel() to prevent a secondary deadlock with the mac_work workqueue. Fixes: a8f424c1287c ("wifi: mt76: add multi-radio remain_on_channel functions") Signed-off-by: Chad Monroe Link: https://patch.msgid.link/ace737e7b621af7c2adb33b0188011a5c1de2166.1765204256.git.chad@monroe.io Signed-off-by: Felix Fietkau commit d5059e52fd8bc624ec4255c9fa01a266513d126b Author: Sean Wang Date: Mon Jan 26 12:00:13 2026 -0600 wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync roc_abort_sync() can deadlock with roc_work(). roc_work() holds dev->mt76.mutex, while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block and no progress is possible. This deadlock can occur during station removal when mt76_sta_state() -> mt76_sta_remove() -> mt7921_mac_sta_remove() -> mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex. This avoids the mutex deadlock and preserves exactly-once work ownership. Fixes: 352d966126e6 ("wifi: mt76: mt7921: fix a potential association failure upon resuming") Co-developed-by: Quan Zhou Signed-off-by: Quan Zhou Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260126180013.8167-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit fdfa39f9f4fbae532b162da913a67b2410caf38f Author: Quan Zhou Date: Fri Jan 23 10:16:25 2026 +0800 wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work The mt7921_set_roc API may be executed concurrently with mt7921_roc_work, specifically between the following code paths: - The check and clear of MT76_STATE_ROC in mt7921_roc_work: if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state)) return; - The execution of ieee80211_iterate_active_interfaces. This race condition can interrupt the ROC abort flow, resulting in the ROC process failing to abort as expected. To address this defect, the modification of MT76_STATE_ROC is now protected by mt792x_mutex_acquire(phy->dev). This ensures that changes to the ROC state are properly synchronized, preventing race conditions and ensuring the ROC abort flow is not interrupted. Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") Cc: stable@vger.kernel.org Signed-off-by: Quan Zhou Reviewed-by: Sean Wang Link: https://patch.msgid.link/2568ece8b557e5dda79391414c834ef3233049b6.1769133724.git.quan.zhou@mediatek.com Signed-off-by: Felix Fietkau commit aae89dc4a1608da9060bada757f650ac94b7f184 Author: Leon Yen Date: Wed Jan 21 00:31:52 2026 +0800 wifi: mt76: mt7925: fix tx power setting failure after chip reset After the chip reset, the procedure to set the tx power will not be successful because the previous region setting is still remains. Clear the region setting during MAC initialization and allow it to be reset to finalize the TX power setting. Fixes: 3bc62aa4484d ("wifi: mt76: mt7925: add auto regdomain switch support") Signed-off-by: Leon Yen Link: https://patch.msgid.link/20260120163152.3694116-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau commit c41075ce8cf05ed8c0e7b7efef000dce548ffc42 Author: Zilin Guan Date: Fri Jan 16 14:49:19 2026 +0000 wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() mt76_connac_mcu_alloc_sta_req() allocates an skb which is expected to be freed eventually by mt76_mcu_skb_send_msg(). However, currently if an intermediate function fails before sending, the allocated skb is leaked. Specifically, mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail, leading to an immediate memory leak in the error path. Fix this by explicitly freeing the skb in these error paths. Commit 7c0f63fe37a5 ("wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error") made a similar change. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: d1369e515efe ("wifi: mt76: connac: introduce mt76_connac_mcu_sta_wed_update utility routine") Fixes: 6683d988089c ("mt76: connac: move mt76_connac_mcu_add_key in connac module") Fixes: 4f831d18d12d ("wifi: mt76: mt7915: enable WED RX support") Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20260116144919.1482558-1-zilin@seu.edu.cn Signed-off-by: Felix Fietkau commit dd08ca3f092f4185ece69ce2a835c23198b1628a Author: Sean Wang Date: Mon Dec 15 19:38:49 2025 -0600 wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync roc_abort_sync() can deadlock with roc_work(). roc_work() holds dev->mt76.mutex, while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block and no progress is possible. This deadlock can occur during station removal when mt76_sta_state() -> mt76_sta_remove() -> mt7925_mac_sta_remove_link() -> mt7925_mac_link_sta_remove() -> mt7925_roc_abort_sync() invokes cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex. This avoids the mutex deadlock and preserves exactly-once work ownership. Fixes: 45064d19fd3a ("wifi: mt76: mt7925: fix a potential association failure upon resuming") Co-developed-by: Quan Zhou Signed-off-by: Quan Zhou Signed-off-by: Sean Wang Link: https://patch.msgid.link/20251216013849.17976-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 8c7e19612b01567f641d3ffe21e47fa21c331171 Author: Michael Lo Date: Mon Jan 12 19:40:07 2026 +0800 wifi: mt76: mt7925: Skip scan process during suspend. We are experiencing command timeouts because an upper layer triggers an unexpected scan while the system/device is in suspend. The upper layer should not initiate scans until the NIC has fully resumed. We want to prevent scans during suspend and avoid timeouts without harming power management or user experience. Signed-off-by: Michael Lo Link: https://patch.msgid.link/20260112114007.2115873-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau commit 59a1864509d084a4b34117e693951c06b846b00a Author: Sean Wang Date: Mon Dec 15 20:20:17 2025 -0600 wifi: mt76: mt7925: drop puncturing handling from BSS change path IEEE80211_CHANCTX_CHANGE_PUNCTURING is a channel context change flag and should not be checked in the BSS change handler, where the changed mask represents enum ieee80211_bss_change. Remove the puncturing handling from the BSS path and rely on mt7925_change_chanctx() to update puncturing configuration. Fixes: cadebdad959b ("wifi: mt76: mt7925: add EHT preamble puncturing") Signed-off-by: Sean Wang Link: https://patch.msgid.link/20251216022017.23870-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit 53afca4329af885fe08703b93e71cb5589835f27 Author: Lorenzo Bianconi Date: Thu Jan 22 11:40:01 2026 +0100 wifi: mt76: Enable NPU support for MT7996 devices Enable NPU offloading for MT7990 chipset. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-17-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit c2efd5fe154686e52fff7321c97b2d21c569c36e Author: Lorenzo Bianconi Date: Thu Jan 22 11:40:00 2026 +0100 wifi: mt76: mt7996: Store DMA mapped buffer addresses in mt7996_npu_hw_init() In order to not always reallocate them during NPU reset, store the DMA mapped buffer addresses allocated by mt7996_npu_hw_init routine in mt7996 structure. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-16-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit 850856c4777c80348507da1543e58006ff0063d2 Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:59 2026 +0100 wifi: mt76: mt7996: Do not schedule RRO and TxFree queues during reset for NPU This is a preliminary patch to properly manage reset procedure when NPU offloading is enabled. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-15-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit 966c44ba73097a81fb47e9c6cac71e816e9f5084 Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:58 2026 +0100 wifi: mt76: Do not reset idx for NPU tx queues during reset Do not run reset_q callaback with reset_idx set to true for NPU Tx queues. This is a preliminary patch to properly manage reset procedure when NPU offloading is enabled. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-14-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit ae8ee98014bab9b6b1b782bb19cf47317ea0499a Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:57 2026 +0100 wifi: mt76: mt7996: Move RRO dma start in a dedicated routine This is a preliminary patch to properly enable NPU offloading for MT7996 chipset since NPU initialization must be completed before kicking rx queues. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-13-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit 93e2491470d34d2d45b240123da0267d6de68c71 Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:56 2026 +0100 wifi: mt76: mt7996: Add __mt7996_npu_hw_init routine Introduce __mt7996_npu_hw_init utility routine in order to run it holding mt76 mutex and move NPU hw re-initialization before restarting the NAPIs during device reset. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-12-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit cd7951f242a7e4114de8f41804d708f5b5079d53 Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:55 2026 +0100 wifi: mt76: mt7996: Integrate MT7990 dma configuration for NPU Add NPU integration in MT7996 dma codebase for MT7990 chipset. This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-11-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit 26c28522fa460435bd9a0dc4e05ae599f21ada6b Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:54 2026 +0100 wifi: mt76: mt7996: Integrate MT7990 init configuration for NPU Add NPU integration in MT7996 init codebase for MT7990 chipset. This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-10-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit aa6a0ded87d7dababcb2e9b23e8137131557b8fa Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:53 2026 +0100 wifi: mt76: mt7996: Integrate NPU in RRO session management Add NPU integration in RRO 3.0 session management. This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-9-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit 880f4e3e5a4c465fba0390ed3c2afa1d7eece550 Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:52 2026 +0100 wifi: mt76: mt7996: Add NPU support for MT7990 chipset Introduce support for MT7990 chipset in MT7996 npu configuration codebase. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-8-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit c93e2fbdc79b91e5c221446f970ab847db38309e Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:51 2026 +0100 wifi: mt76: mt7996: Rename mt7996_npu_rxd_init() in mt7992_npu_rxd_init() This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-7-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit a9ac8f837f12ce180da90e70277c36ecd04b01e2 Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:50 2026 +0100 wifi: mt76: mt7996: Add mt7992_npu_txrx_offload_init routine Introduce mt7992_npu_txrx_offload_init utility routine. This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-6-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit 00fa11ec4ab236a0e959093dc804285533846213 Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:49 2026 +0100 wifi: mt76: mt7996: Fix wdma_idx for MT7996 device if NPU is enabled This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-5-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit b849930f2ce77185b833d93ab4317a33ffc584c5 Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:48 2026 +0100 wifi: mt76: mt7996: Fix BAND2 tx queues initialization when NPU is enabled Fix BAND2 tx queues initialization for MT7990 chipset when NPU is enabled. This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-4-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit f801fec3f0850ac00073bc322c0e4ea446d938ae Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:47 2026 +0100 wifi: mt76: always enable RRO queues for non-MT7992 chipset MT7990 NPU binary requires to initialize NPU desc_base after configuring ring_size. This is a preliminary patch to enable NPU offload for MT7996 (Eagle) chipset. Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-3-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit 25e3203a2192f2b0d697b2410126bad87e62d4f0 Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:46 2026 +0100 wifi: mt76: npu: Add missing rx_token_size initialization Add missing rx_token_size initialization for NPU offloading. Fixes: 7fb554b1b623 ("wifi: mt76: Introduce the NPU generic layer") Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-2-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit 7aed20bd9fe427b192cce80a164429584b298bbe Author: Lorenzo Bianconi Date: Thu Jan 22 11:39:45 2026 +0100 wifi: mt76: mt7996: Fix NPU stop procedure Move mt7996_npu_hw_stop routine before disabling rx NAPIs in order to fix NPU stop procedure used during device L1 SER recovery. Add missing usleep_range in mt7996_npu_hw_stop(). Fixes: 377aa17d2aedc ("wifi: mt76: mt7996: Add NPU offload support to MT7996 driver") Tested-by: Kang Yang Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260122-mt76-npu-eagle-offload-v2-1-2374614c0de6@kernel.org Signed-off-by: Felix Fietkau commit 6b470f36616e3448d44b0ef4b1de2a3e3a31b5be Author: Lorenzo Bianconi Date: Mon Dec 8 19:54:08 2025 +0100 wifi: mt76: Fix memory leak destroying device All MT76 rx queues have an associated page_pool even if the queue is not associated to a NAPI (e.g. WED RRO queues with WED enabled). Destroy the page_pool running mt76_dma_cleanup routine during module unload. Moreover returns pages to the page pool if WED is not enabled for WED RRO queues. Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251208-mt76-fix-memory-leak-v1-1-cba813fc62b8@kernel.org Signed-off-by: Felix Fietkau commit 5373f8b19e568b5c217832b9bbef165bd2b2df14 Author: Leon Yen Date: Thu Oct 9 10:01:58 2025 +0800 wifi: mt76: mt7921: fix a potential clc buffer length underflow The buf_len is used to limit the iterations for retrieving the country power setting and may underflow under certain conditions due to changes in the power table in CLC. This underflow leads to an almost infinite loop or an invalid power setting resulting in driver initialization failure. Cc: stable@vger.kernel.org Fixes: fa6ad88e023d ("wifi: mt76: mt7921: fix country count limitation for CLC") Signed-off-by: Leon Yen Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20251009020158.1923429-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 4d0bf21e3e20619d51d06c0c36207aabab8b712c Author: Rory Little Date: Wed Sep 3 17:07:11 2025 -0700 wifi: mt76: mt7921: Place upper limit on station AID Any station configured with an AID over 20 causes a firmware crash. This situation occurred in our testing using an AP interface on 7922 hardware, with a modified hostapd, sourced from Mediatek's OpenWRT feeds. In stock hostapd, station AIDs begin counting at 1, and this configuration is prevented with an upper limit on associated stations. However, the modified hostapd began allocation at 65, which caused the firmware to crash. This fix does not allow these AIDs to work, but will prevent the firmware crash. This crash was only seen on IFTYPE_AP interfaces, and the fix does not appear to have an effect on IFTYPE_STATION behavior. Fixes: 5c14a5f944b9 ("mt76: mt7921: introduce mt7921e support") Signed-off-by: Rory Little Link: https://patch.msgid.link/20250904000711.3033860-1-rory@candelatech.com Signed-off-by: Felix Fietkau commit d8db56142e531f060c938fa0b5175ed6c8cabb11 Author: Alok Tiwari Date: Mon Oct 13 02:08:24 2025 -0700 wifi: mt76: mt7996: fix FCS error flag check in RX descriptor The mt7996 driver currently checks the MT_RXD3_NORMAL_FCS_ERR bit in rxd1 whereas other Connac3-based drivers(mt7925) correctly check this bit in rxd3. Since the MT_RXD3_NORMAL_FCS_ERR bit is defined in the fourth RX descriptor word (rxd3), update mt7996 to use the proper descriptor field. This change aligns mt7996 with mt7925 and the rest of the Connac3 family. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Alok Tiwari Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251013090826.753992-1-alok.a.tiwari@oracle.com Signed-off-by: Felix Fietkau commit 58b4bd18390ec3118d8577e19bdee0d01d40c31e Author: Nathan Chancellor Date: Fri Mar 20 14:29:33 2026 -0700 tracing: Adjust cmd_check_undefined to show unexpected undefined symbols When the check_undefined command in kernel/trace/Makefile fails, there is no output, making it hard to understand why the build failed. Capture the output of the $(NM) + grep command and print it when failing to make it clearer what the problem is. Fixes: a717943d8ecc ("tracing: Check for undefined symbols in simple_ring_buffer") Signed-off-by: Nathan Chancellor Reviewed-by: Vincent Donnefort Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260320-cmd_check_undefined-verbose-v1-1-54fc5b061f94@kernel.org Signed-off-by: Marc Zyngier commit 962eb04e67552be406c906c83099c1d736aae3b6 Author: Ming Yen Hsieh Date: Thu Sep 4 11:06:47 2025 +0800 wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi Check for a NULL `vif` before accessing `ieee80211_vif_is_mld(vif)` to avoid a potential kernel panic in scenarios where `vif` might not be initialized. Fixes: ebb1406813c6 ("wifi: mt76: mt7925: add link handling to txwi") Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250904030649.655436-3-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 83ae3a18ba957257b4c406273d2da2caeea2b439 Author: Ming Yen Hsieh Date: Thu Sep 4 11:06:48 2025 +0800 wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() Move the NULL check for 'sta' before dereferencing it to prevent a possible crash. Fixes: 44eb173bdd4f ("wifi: mt76: mt7925: add link handling in mt7925_txwi_free") Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250904030649.655436-4-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 34163942195410372fb138bea806c9b34e2f5257 Author: Zac Bowling Date: Tue Jan 20 12:10:32 2026 -0800 wifi: mt76: fix list corruption in mt76_wcid_cleanup mt76_wcid_cleanup() was not removing wcid entries from sta_poll_list before mt76_reset_device() reinitializes the master list. This leaves stale pointers in wcid->poll_list, causing list corruption when mt76_wcid_add_poll() later checks list_empty() and tries to add the entry back. The fix adds proper cleanup of poll_list in mt76_wcid_cleanup(), matching how tx_list is already handled. This is similar to what mt7996_mac_sta_deinit_link() already does correctly. Fixes list corruption warnings like: list_add corruption. prev->next should be next (ffffffff...) Signed-off-by: Zac Bowling Link: https://patch.msgid.link/20260120201043.38225-3-zac@zacbowling.com Signed-off-by: Felix Fietkau commit ccb186326bb6b7f20d77982f855568e7087ad0d7 Author: Ming Yen Hsieh Date: Mon Sep 8 15:25:26 2025 +0800 wifi: mt76: mt7925: fix incorrect length field in txpower command Set `tx_power_tlv->len` to `msg_len` instead of `sizeof(*tx_power_tlv)` to ensure the correct message length is sent to firmware. Cc: stable@vger.kernel.org Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250908072526.1833938-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 079db35fae4dd7d6daedfb144d50b517d0da10e2 Author: Ryder Lee Date: Wed Jan 21 09:41:58 2026 -0800 wifi: mt76: mt7996: add support for ERP CTS & HT protection This patch adds support for handling BSS_CHANGED_ERP_CTS_PROT and BSS_CHANGED_HT. With this change, when the Wi-Fi driver needs to adjust its behavior for compatibility or performance, especially concerning older 11g/n devices, by enabling or disabling CTS protection frames, often for hidden SSIDs or to manage legacy clients. It also introduces debugfs options to manually control protection mode, allowing users to select betweenno protection, RTS/CTS, and CTS-to-self. Reviewed-by: Money Wang Signed-off-by: Ryder Lee Link: https://patch.msgid.link/942ddb5777d5c201930d6609e9ba877a6ba6714a.1768879119.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau commit 8b2c26562b95c6397e132d21f2bd3d73aaee0c0a Author: Ryder Lee Date: Wed Jan 21 09:41:57 2026 -0800 wifi: mt76: mt7915: fix use_cts_prot support With this fix, when driver needs to adjust its behavior for compatibility, especially concerning older 11g/n devices, by enabling or disabling CTS protection frames, often for hidden SSIDs or to manage legacy clients. Fixes: 150b91419d3d ("wifi: mt76: mt7915: enable use_cts_prot support") Signed-off-by: Ryder Lee Link: https://patch.msgid.link/eb8db4d0bf1c89b7486e89facb788ae3e510dd8b.1768879119.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau commit 1974a67d9b65c29a0a9426e32e8cd8c056de48b7 Author: Ryder Lee Date: Wed Jan 21 09:41:56 2026 -0800 wifi: mt76: mt7615: fix use_cts_prot support Driver should not directly write WTBL to prevent overwritten issues. With this fix, when driver needs to adjust its behavior for compatibility, especially concerning older 11g/n devices, by enabling or disabling CTS protection frames, often for hidden SSIDs or to manage legacy clients. Fixes: e34235ccc5e3 ("wifi: mt76: mt7615: enable use_cts_prot support") Signed-off-by: Ryder Lee Link: https://patch.msgid.link/edb87088b0111b32fafc6c4179f54a5286dd37d8.1768879119.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau commit dcfbd5d3b82d3b5e94df3761c4d25086cab08c38 Author: Christian Hewitt Date: Sat Dec 27 11:22:19 2025 +0000 wifi: mt7601u: check multiple firmware paths The linux-firmware repo moved mt7601u.bin from its root folder to the mediatek sub-folder some time ago, but the driver still tries to load firmware from the old location. Users might have firmware in either location so update the driver to check both. Signed-off-by: Christian Hewitt Link: https://patch.msgid.link/20251227112219.2768439-1-christianshewitt@gmail.com Signed-off-by: Felix Fietkau commit bb2f07819d063a58756186cac6465341956ac0a4 Author: Leon Yen Date: Mon Dec 15 20:22:31 2025 +0800 wifi: mt76: mt792x: Fix a potential deadlock in high-load situations A deadlock may occur between two works, ps_work and mac_work, if their work functions run simultaneously as they attempt to cancel each other by calling cancel_delayed_work_sync(). mt792x_mac_work() -> ... -> cancel_delayed_work_sync(&pm->ps_work); mt792x_pm_power_save_work() -> cancel_delayed_work_sync(&mphy->mac_work); In high-load situations, they are queued but may not have chance to be executed until the CPUs are released. Once the CPUs are available, there is a high possibility that the ps_work function and mac_work function will be executed simultaneously, resulting in a possible deadlock. This patch replaces cancel_delayed_work_sync() with cancel_delayed_work() in ps_work to eliminate the deadlock and make the code easier to maintain. Signed-off-by: Leon Yen Tested-by: Chia-Lin Kao (AceLan) Link: https://patch.msgid.link/20251215122231.3180648-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau commit 1695f662329faa07c860c73453c097823852df28 Author: Leon Yen Date: Thu Dec 11 20:38:36 2025 +0800 wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control The selection of MLO mode should depend on the capabilities of the STA rather than those of the peer AP to avoid compatibility issues with certain APs, such as Xiaomi BE5000 WiFi7 router. Fixes: 69acd6d910b0c ("wifi: mt76: mt7925: add mt7925_change_vif_links") Signed-off-by: Leon Yen Link: https://patch.msgid.link/20251211123836.4169436-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau commit 53ffffeb9624ffab6d9a3b1da8635a23f1172b5e Author: Sean Wang Date: Mon Dec 15 18:59:30 2025 -0600 wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() Reset ampdu_state if ieee80211_start_tx_ba_session() fails in mt76_connac2_tx_check_aggr(), otherwise the driver may incorrectly assume aggregation is active and skip future BA setup attempts. Fixes: 163f4d22c118 ("mt76: mt7921: add MAC support") Signed-off-by: Sean Wang Link: https://patch.msgid.link/20251216005930.9412-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau commit c0747db7c10c2dfbdcff0e8e97021e3df1f1e362 Author: Lorenzo Bianconi Date: Sun Dec 14 10:55:30 2025 +0100 wifi: mt76: mt7996: Reset ampdu_state state in case of failure in mt7996_tx_check_aggr() Reset the ampdu_state configured state if ieee80211_start_tx_ba_session routine fails in mt7996_tx_check_aggr() Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251214-mt7996-aggr-check-fix-v1-1-33a8b62ec0fc@kernel.org Signed-off-by: Felix Fietkau commit 88973240dc7c976dd320b36a9e6d925c9be083ae Author: Lorenzo Bianconi Date: Fri Dec 5 11:24:39 2025 +0100 wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link() Clear WCID pointer removing the sta link in mt7996_mac_sta_deinit_link routine. Fixes: dd82a9e02c054 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-4-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau commit 5ef44c200618430b004233cbfc1b0929a13d5ac8 Author: Lorenzo Bianconi Date: Fri Dec 5 11:24:38 2025 +0100 wifi: mt76: mt7996: Switch to the secondary link if the default one is removed Switch to the secondary link if available in mt7996_mac_sta_remove_links routine if the primary one is removed. Moreover reset secondary link index for single link scenario. Fixes: 85cd5534a3f2e ("wifi: mt76: mt7996: use correct link_id when filling TXD and TXP") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-3-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau commit 751a2679b15e3a0fa8fc9175862f0ec40643db68 Author: Lorenzo Bianconi Date: Fri Dec 5 11:24:37 2025 +0100 wifi: mt76: mt7996: Reset mtxq->idx if primary link is removed in mt7996_vif_link_remove() Reset WCID index in mt76_txq struct if primary link is removed in mt7996_vif_link_remove routine. Fixes: a3316d2fc669f ("wifi: mt76: mt7996: set vif default link_id adding/removing vif links") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-2-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau commit 654abcbe4528f74428b69292fad5c4224414fa1b Author: Lorenzo Bianconi Date: Fri Dec 5 11:24:36 2025 +0100 wifi: mt76: mt7996: Set mtxq->wcid just for primary link Set WCID index in mt76_txq struct just for the primary link in mt7996_vif_link_add routine. Fixes: 69d54ce7491d0 ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-1-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau commit 0cd776fdccec526ee1f45c81d00da8a316b6e892 Author: Colin Ian King Date: Fri Nov 28 17:44:30 2025 +0000 wifi: mt76: mt7996: Fix spelling mistake "retriving" -> "retrieving" There are a handful of spelling mistakes in various warning messages. Fix them. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20251128174430.318838-1-colin.i.king@gmail.com Signed-off-by: Felix Fietkau commit 7900da40e315cd1971405ef95e561b0176e0dac2 Author: Leon Yen Date: Fri Sep 26 13:34:47 2025 +0800 wifi: mt76: mt7925: introduce CSA support in non-MLO mode Add CSA (Channel Switch Announcement) related implementation in collaboration with mac80211 to deal with dynamic channel switching. Signed-off-by: Leon Yen Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250926053447.4036650-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 524ef4b42b40bf1cf634663e746ace0af3fce45c Author: David Bauer Date: Sat Nov 29 03:39:02 2025 +0100 wifi: mt76: mt76x02: wake queues after reconfig The shared reset procedure of MT7610 and MT7612 stop all queues before starting the reset sequence. They however never restart these like other supported mt76 chips do in the reconfig_complete call. This leads to TX not continuing after the reset. Restart queues in the reconfig_complete callback to restore functionality after the reset. Signed-off-by: David Bauer Link: https://patch.msgid.link/20251129023904.288484-1-mail@david-bauer.net Signed-off-by: Felix Fietkau commit bb8e38fcdbf7290d7f0cd572d2d8fdb2b641b492 Author: Quan Zhou Date: Thu Nov 27 15:49:11 2025 +0800 wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Previously, the AMPDU state bit for a given TID was set before attempting to start a BA session, which could result in the AMPDU state being marked active even if ieee80211_start_tx_ba_session() failed. This patch changes the logic to only set the AMPDU state bit after successfully starting a BA session, ensuring proper synchronization between AMPDU state and BA session status. This fixes potential issues with aggregation state tracking and improves compatibility with mac80211 BA session management. Fixes: 44eb173bdd4f ("wifi: mt76: mt7925: add link handling in mt7925_txwi_free") Cc: stable@vger.kernel.org Signed-off-by: Quan Zhou Reviewed-by: Sean Wang Link: https://patch.msgid.link/d5960fbced0beaf33c30203f7f8fb91d0899c87b.1764228973.git.quan.zhou@mediatek.com Signed-off-by: Felix Fietkau commit 5ef0e8e2653b1ba325eb883ffb94073f19cb669a Author: Shayne Chen Date: Mon Dec 15 14:37:28 2025 +0800 wifi: mt76: mt7996: fix iface combination for different chipsets MT7992 and MT7990 support up to 19 interfaces per band and 32 in total. Fixes: 8df63a4bbe3d ("wifi: mt76: mt7996: adjust interface num and wtbl size for mt7992") Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20251215063728.3013365-7-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 7f3ec778593f24584dbcf25995f2b651133e956d Author: Shayne Chen Date: Mon Dec 15 14:37:27 2025 +0800 wifi: mt76: mt7996: add duplicated WTBL command This is a firmware mechanism to improve packet loss issues for mt7996 and mt7992 chipsets. Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20251215063728.3013365-6-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 956d2e65da93f59fb50bc149f2009565bec26f56 Author: StanleyYP Wang Date: Mon Dec 15 14:37:26 2025 +0800 wifi: mt76: mt7996: offload radar threshold initialization Since some radar specifications maintained by the driver are incorrect and are now also maintained by the firmware, offload the initialization procedure to the firmware. This fixes issues for radar detection rate testings. Signed-off-by: StanleyYP Wang Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20251215063728.3013365-5-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit fdce55c038702ac8f330de0697e907713a1e976b Author: StanleyYP Wang Date: Mon Dec 15 14:37:25 2025 +0800 wifi: mt76: mt7996: abort CCA when CSA is starting When CSA countdown is going to start, carry UNI_BSS_INFO_BCN_BCC tag to abort any CCA countdown. Signed-off-by: StanleyYP Wang Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20251215063728.3013365-4-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 7247037a016ed4bc8a50507d74d0bae98409ae3f Author: StanleyYP Wang Date: Mon Dec 15 14:37:24 2025 +0800 wifi: mt76: mt7996: set specific BSSINFO and STAREC commands after channel switch After channel switch, some tags of BSSINFO (rfch) and STAREC (bfer, rate_ctrl) commands should also be updated. Otherwise, a BSS might not be able to transmit with its peer using correct bandwidth. Co-developed-by: Shayne Chen Signed-off-by: Shayne Chen Signed-off-by: StanleyYP Wang Link: https://patch.msgid.link/20251215063728.3013365-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 45a09251d610f3b8a1fb02039146e42f1f4efe90 Author: StanleyYP Wang Date: Mon Dec 15 14:37:23 2025 +0800 wifi: mt76: mt7996: fix the behavior of radar detection RDD_DET_MODE is a firmware command intended for testing and does not pause TX after radar detection, so remove it from the normal flow; instead, use the MAC_ENABLE_CTRL firmware command to resume TX after the radar-triggered channel switch completes. Fixes: 1529e335f93d ("wifi: mt76: mt7996: rework radar HWRDD idx") Co-developed-by: Shayne Chen Signed-off-by: Shayne Chen Signed-off-by: StanleyYP Wang Link: https://patch.msgid.link/20251215063728.3013365-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 20743b0b64d91927d1a9346341f3ecdc527c8776 Author: Shayne Chen Date: Mon Dec 15 14:37:22 2025 +0800 wifi: mt76: mt7996: extend CSA and CCA support for MLO Use correct link_id to report CSA and CCA countdown events, and also modify mt7996_channel_switch_beacon() to set beacon with the correct link_id. Co-developed-by: Peter Chiu Signed-off-by: Peter Chiu Co-developed-by: StanleyYP Wang Signed-off-by: StanleyYP Wang Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20251215063728.3013365-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 0fdbe845534f4e0b7243b7a44562c4486ce25fb4 Author: Thorsten Blum Date: Sat Mar 21 22:05:47 2026 +0100 fanotify: replace deprecated strcpy in fanotify_info_copy_{name,name2} strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260321210544.519259-4-thorsten.blum@linux.dev Signed-off-by: Jan Kara commit e309dbd523b877f049496ecd6560fa3d9551e2d1 Author: Tzuyi Chang Date: Tue Mar 17 19:54:09 2026 +0800 pinctrl: realtek: add rtd1625 pinctrl driver Add support for Realtek RTD1625 SoC using the realtek common pinctrl driver. This patch introduces the RTK_PIN_CONFIG_V2 and RTK_PIN_CONFIG_I2C macros, which are required to describe the specific register layout and electrical features (such as slew rate and high VIL) of the RTD1625 pins. Signed-off-by: Tzuyi Chang Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit dcc9334435b0fd34adcca96cc397a30915c882d9 Author: Tzuyi Chang Date: Tue Mar 17 19:54:08 2026 +0800 pinctrl: realtek: add support for slew rate, input voltage and high VIL Add support for configuring slew rate, input voltage level and high VIL mode. This involves updating the pin configuration parsing logic to handle PIN_CONFIG_SLEW_RATE, PIN_CONFIG_INPUT_VOLTAGE_UV and the new custom property "realtek,high-vil-microvolt". Reviewed-by: Linus Walleij Signed-off-by: Tzuyi Chang Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit f6ea7004e926ddae54b261327a3db2e4b195c92c Author: Tzuyi Chang Date: Tue Mar 17 19:54:07 2026 +0800 dt-bindings: pinctrl: realtek: Add RTD1625 pinctrl binding Add device tree bindings for RTD1625. Reviewed-by: Conor Dooley Reviewed-by: Linus Walleij Signed-off-by: Tzuyi Chang Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit 56624479a98fe56b6e8b257b016c0bfd49f1b1cf Author: Yu-Chun Lin Date: Tue Mar 17 19:54:06 2026 +0800 dt-bindings: pinctrl: realtek: Improve 'realtek,duty-cycle' description The previous description was misleading because this hardware block is not a PWM generator. It does not generate a signal with a specific frequency and duty ratio. Instead, it provides a fixed nanosecond-level adjustment to the rising/ falling edges of an existing signal. The property name is kept as 'realtek,duty-cycle' rather than being renamed to strictly preserve Device Tree ABI backward compatibility. Acked-by: Conor Dooley Reviewed-by: Linus Walleij Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit 00a5d1e71c928edb1e7de211a82e87858105dd47 Author: Tzuyi Chang Date: Tue Mar 17 19:54:05 2026 +0800 pinctrl: pinconf-generic: Add properties 'input-threshold-voltage-microvolt' Add a new generic pin configuration parameter PIN_CONFIG_INPUT_VOLTAGE_UV. This parameter is used to specify the input voltage level of a pin in microvolts, which corresponds to the 'input-voltage-microvolt' property in Device Tree. Reviewed-by: Linus Walleij Signed-off-by: Tzuyi Chang Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit 7b9fe771dcbd40201fa5a97befa93f11af53204e Author: Tzuyi Chang Date: Tue Mar 17 19:54:04 2026 +0800 dt-bindings: pincfg-node: Add input-threshold-voltage-microvolt property Add a generic pin configuration property "input-threshold-voltage-microvolt" to support hardware designs where the input logic threshold is decoupled from the power supply voltage. This property allows the pinctrl driver to configure the correct internal reference voltage for pins that need to accept input signals at a different voltage level than their power supply. For example, a pin powered by 3.3V may need to accept 1.8V logic signals. This defines the reference for VIH (Input High Voltage) and VIL (Input Low Voltage) thresholds, enabling proper signal detection across different voltage domains. Signed-off-by: Tzuyi Chang Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Acked-by: Conor Dooley Signed-off-by: Linus Walleij commit 1f5451844786ed203605528dca9e5d84ed378160 Author: Yu-Chun Lin Date: Tue Mar 17 19:54:03 2026 +0800 pinctrl: realtek: Fix function signature for config argument The argument originates from pinconf_to_config_argument(), which returns a u32. Therefore, the arg parameter should be an unsigned int instead of enum pin_config_param. Fixes: e99ce78030db ("pinctrl: realtek: Add common pinctrl driver for Realtek DHC RTD SoCs") Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit 6872c84dc6f5d18e02ebc34b257f4152895e236c Merge: eb3b0d92c9c398 c369299895a591 Author: Greg Kroah-Hartman Date: Mon Mar 23 09:59:16 2026 +0100 Merge 7.0-rc5 into tty-next We need the tty/serial fixes in here as well. Signed-off-by: Greg Kroah-Hartman commit 4f53d8c6d23527d734fe3531d08e15cb170a0819 Author: Michał Winiarski Date: Tue Feb 17 16:41:18 2026 +0100 drm/xe/pf: Fix use-after-free in migration restore When an error is returned from xe_sriov_pf_migration_restore_produce(), the data pointer is not set to NULL, which can trigger use-after-free in subsequent .write() calls. Set the pointer to NULL upon error to fix the problem. Fixes: 1ed30397c0b92 ("drm/xe/pf: Add support for encap/decap of bitstream to/from packet") Reported-by: Sebastian Österlund Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7230 Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260217154118.176902-1-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit fb69d0076e687421188bc8103ab0e8e5825b1df1 Author: Imre Deak Date: Fri Mar 20 11:29:00 2026 +0200 drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic state Clearing the DP tunnel stream BW in the atomic state involves getting the tunnel group state, which can fail. Handle the error accordingly. This fixes at least one issue where drm_dp_tunnel_atomic_set_stream_bw() failed to get the tunnel group state returning -EDEADLK, which wasn't handled. This lead to the ctx->contended warn later in modeset_lock() while taking a WW mutex for another object in the same atomic state, and thus within the same already contended WW context. Moving intel_crtc_state_alloc() later would avoid freeing saved_state on the error path; this stable patch leaves that simplification for a follow-up. Cc: Uma Shankar Cc: Ville Syrjälä Cc: # v6.9+ Fixes: a4efae87ecb2 ("drm/i915/dp: Compute DP tunnel BW during encoder state computation") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7617 Reviewed-by: Michał Grzelak Reviewed-by: Uma Shankar Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260320092900.13210-1-imre.deak@intel.com commit ddb1444d3335129ae87d9796ab1debf41c0ee51b Author: Andreas Hindborg Date: Thu Feb 19 12:57:45 2026 +0100 hrtimer: add usage examples to documentation Add documentation examples showing various ways to use hrtimers: - Box-allocated timers with shared state in Arc. - Arc-allocated timers. - Stack-based timers for scoped usage. - Mutable stack-based timers with shared state. Tested-by: Daniel Almeida Reviewed-by: Daniel Almeida Reviewed-by: Alice Ryhl Link: https://msgid.link/20260219-hrtimer-examples-v6-19-rc1-v2-1-810cc06ca9f6@kernel.org Signed-off-by: Andreas Hindborg commit 67b598db7ef107d80091c4c957694b9a2feffa4c Author: FUJITA Tomonori Date: Mon Jun 30 22:10:11 2025 +0900 rust: time: make ClockSource unsafe trait Mark the ClockSource trait as unsafe and document its safety requirements. Specifically, implementers must guarantee that their `ktime_get()` implementation returns a value in the inclusive range [0, KTIME_MAX]. Update all existing implementations to use `unsafe impl` with corresponding safety comments. Note that there could be potential users of a customized clock source [1] so we don't seal the trait. Link: https://lore.kernel.org/rust-for-linux/Z9xb1r1x5tOzAIZT@boqun-archlinux/ [1] Suggested-by: Boqun Feng Signed-off-by: FUJITA Tomonori Reviewed-by: Alice Ryhl Link: https://msgid.link/20250630131011.405219-1-fujita.tomonori@gmail.com [ Change range expressions in docs. - Andreas ] Signed-off-by: Andreas Hindborg commit c51866f65b8ac37b8883a2e80ada13c8cd4d2f7b Author: Lyude Paul Date: Fri Nov 14 13:42:06 2025 -0500 rust/time: Add Delta::from_nanos() Since rvkms is going to need to create its own Delta instances, and we already have functions for creating Delta with every other unit of time. Signed-off-by: Lyude Paul Reviewed-by: Alice Ryhl Link: https://msgid.link/20251114184207.459335-1-lyude@redhat.com Signed-off-by: Andreas Hindborg commit c3e7cc8bc5ca08b2fae3d43c7c86f140daa873ef Author: Rosen Penev Date: Wed Mar 18 11:52:37 2026 -0700 thunderbolt: Use kzalloc_flex() for struct tb_path allocation Simplifies allocation of struct tb_path by using a flexible array member. Also added __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Reviewed-by: Kees Cook Signed-off-by: Mika Westerberg commit 25e90f486f5bc8f606f4263c9d86e2d2b1db4613 Author: Chen-Yu Tsai Date: Wed Mar 11 17:49:28 2026 +0800 drm/sun4i: Use backend/mixer as dedicated DMA device The sun4i DRM driver deals with DMA constraints in a peculiar way. Instead of using the actual DMA device in various helpers, it justs reconfigures the DMA constraints of the virtual display device using the DMA device's device tree node by calling of_dma_configure(). Turns out of_dma_configure() should only be called from bus code. Lately this also triggers a big warning through of_iommu_configure() and ultimately __iommu_probe_device(): late IOMMU probe at driver bind, something fishy here! Now that the GEM DMA helpers have proper support for allocating and mapping buffers with a dedicated DMA device, switch over to it as the proper solution. The mixer change was tested on a Pine H64 model B. The backend change was only compile tested. Though I don't expect any issues, help testing on an older device would be appreciated. Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20260311094929.3393338-5-wenst@chromium.org Signed-off-by: Chen-Yu Tsai commit e21b1a91430d5ff626a35f72951ed80268e26de6 Author: Chen-Yu Tsai Date: Wed Mar 11 17:49:27 2026 +0800 drm/mediatek: Set dedicated DMA device and drop custom GEM callbacks In commit 9b54a32c7c6a ("drm/mediatek: mtk_gem: Partial refactor and use drm_gem_dma_object") the MediaTek DRM driver was refactored to use drm_gem_dma_object, but custom callbacks were still needed to deal with using the first device of the pipeline as the DMA device, instead of the MMSYS device that the DRM driver binds to. Turns out there is already partial support for dedicated DMA devices in the DRM subsystem for PRIME imports. The preceding patches add support for dedicated DMA devices to the GEM DMA helpers. This allows us to just set the dedicated DMA device for the DRM device, and drop all the custom GEM callbacks. Also drop the .dma_dev field from the driver private data as it is no longer needed. There are slight differences in the mmap helper: the VM_DONTDUMP and VM_IO flags are no longer set. Both were lifted from drm_gem_mmap_obj(). VM_IO probably doesn't make sense since the buffer is allocated using dma_alloc_attrs(). Reviewed-by: Thomas Zimmermann Acked-by: Chun-Kuang Hu Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20260311094929.3393338-4-wenst@chromium.org Signed-off-by: Chen-Yu Tsai commit a9da24732aaa80d631bffc8a1390836d4b896690 Author: Chen-Yu Tsai Date: Wed Mar 11 17:49:26 2026 +0800 drm/gem-dma: Support dedicated DMA device for allocation and mapping Support for a dedicated DMA device for prime imports was added in commit 143ec8d3f939 ("drm/prime: Support dedicated DMA device for dma-buf imports"). This allowed the DRM driver to provide a dedicated DMA device when its own underlying device was not capable of DMA, for example when it is a USB device (the original target) or a virtual device. The latter case is common on embedded SoCs, on which the display pipeline is composed of various fixed function blocks, and the DRM device is simply a made-up device, an address space managing the routing between the blocks, or whichever block the implementor thought made sense at the time. The point is that the chosen device is often not the actual device doing the DMA. Various drivers have used workarounds or reimplemented the GEM DMA helpers to get the DMA addresses and IOMMUs to work correctly. Add support for the dedicated DMA device to the GEM DMA helpers. No existing driver currently uses the GEM DMA helpers and calls drm_dev_set_dma_dev() to set a dedicated DMA device, so no existing users should be affected. Reviewed-by: Thomas Zimmermann Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20260311094929.3393338-3-wenst@chromium.org Signed-off-by: Chen-Yu Tsai commit 864279920b2b2c1dd491eba0d0c64764c0c03d9f Author: Chen-Yu Tsai Date: Wed Mar 11 17:49:25 2026 +0800 drm/prime: Limit scatter list size with dedicated DMA device If a dedicated DMA device is specified for the DRM device, then the scatter list size limit should pertain to the DMA device. Use the dedicated DMA device, if given, to limit the scatter list size. This only applies to drivers that have called drm_dev_set_dma_dev() and are using drm_prime_pages_to_sg() either directly or through the SHMEM helpers. At the time of this writing, the former case only includes the Rockchip DRM driver, while the latter case includes the gud, udl, and the tiny appletbdrm and gm12u320 drivers. Reviewed-by: Thomas Zimmermann Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20260311094929.3393338-2-wenst@chromium.org Signed-off-by: Chen-Yu Tsai commit 74919e2797727596816a06e55c35352e0707a710 Merge: b3970e97490abf ade00a6c903f85 Author: Dave Airlie Date: Mon Mar 23 14:41:10 2026 +1000 Merge tag 'drm-misc-next-2026-03-20' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.1: UAPI Changes: math: - provide __KERNEL_DIV_ROUND_CLOSEST() in UAPI mode: - provide DRM_ARGB_GET*() macros for reading color components Cross-subsystem Changes: math: - implement DIV_ROUND_CLOSEST() with __KERNEL_DIV_ROUND_CLOSEST() Core Changes: atomic: - fix handling of colorop state in atomic updates - provide CRTC background color ttm: - improve tests and doumentation Driver Changes: amdxdna: - allow forcing DMA through IOMMU IOVA - improve debugging bridge: - Support Lontium LT8713SX DP MST bridge plus DT bindings imx: - support planes behind the primary plane - fix bus-format selection ivpu: - perform engine reset on TDR error panel: - novatek-nt36672a: Use mipi_dsi_*_multi() functions - panel-edp: Support BOE NV153WUM-N42, CMN N153JCA-ELK, CSW MNF307QS3-2 renesas: - rz-du: clean up rockchip: - support CRTC background color sun4i: - fix leak in init code - clean up tildc - clean up v3d: - improve handling of struct v3d_stats - improve error handling - clean up vkms: - support CRTC background color Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260320082604.GA17867@linux.fritz.box commit bfec8e88ff6022b056615ec71506703e7e54de82 Merge: 61bc8460815956 c369299895a591 Author: Alexei Starovoitov Date: Sun Mar 22 19:31:37 2026 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.0-rc5 Cross-merge BPF and other fixes after downstream PR. Minor conflicts in: tools/testing/selftests/bpf/progs/exceptions_fail.c tools/testing/selftests/bpf/progs/verifier_bounds.c Signed-off-by: Alexei Starovoitov commit 24d4c90286b9a36a2b72d1e0ceeae237d427f975 Author: Ming Lei Date: Wed Mar 18 09:41:12 2026 +0800 ublk: move cold paths out of __ublk_batch_dispatch() for icache efficiency Mark ublk_filter_unused_tags() as noinline since it is only called from the unlikely(needs_filter) branch. Extract the error-handling block from __ublk_batch_dispatch() into a new noinline ublk_batch_dispatch_fail() function to keep the hot path compact and icache-friendly. This also makes __ublk_batch_dispatch() more readable by separating the error recovery logic from the normal dispatch flow. Before: __ublk_batch_dispatch is ~1419 bytes After: __ublk_batch_dispatch is ~1090 bytes (-329 bytes, -23%) Signed-off-by: Ming Lei Link: https://patch.msgid.link/20260318014112.3125432-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit c50dcf533149e313a61d483769eb48682a1b0cdd Author: zhidao su Date: Sun Mar 22 15:35:33 2026 +0800 selftests/sched_ext: Add tests for SCX_ENQ_IMMED and scx_bpf_dsq_reenq() Add three selftests covering features introduced in v7.1: - dsq_reenq: Verify scx_bpf_dsq_reenq() on user DSQs triggers ops.enqueue() with SCX_ENQ_REENQ and SCX_TASK_REENQ_KFUNC in p->scx.flags. - enq_immed: Verify SCX_OPS_ALWAYS_ENQ_IMMED slow path where tasks dispatched to a busy CPU's local DSQ are re-enqueued through ops.enqueue() with SCX_TASK_REENQ_IMMED. - consume_immed: Verify SCX_ENQ_IMMED via the consume path using scx_bpf_dsq_move_to_local___v2() with explicit SCX_ENQ_IMMED. All three tests skip gracefully on kernels that predate the required features by checking availability via __COMPAT_has_ksym() / __COMPAT_read_enum() before loading. Signed-off-by: zhidao su Signed-off-by: Tejun Heo commit 76edc2761ab8bd27fe4c4b8b2fb71baefc4a31e8 Author: Tejun Heo Date: Sun Mar 22 10:33:08 2026 -1000 sched_ext: Use irq_work_queue_on() in schedule_deferred() schedule_deferred() uses irq_work_queue() which always queues on the calling CPU. The deferred work can run from any CPU correctly, and the _locked() path already processes remote rqs from the calling CPU. However, when falling through to the irq_work path, queuing on the target CPU is preferable as the work can run sooner via IPI delivery rather than waiting for the calling CPU to re-enable IRQs. Currently, only reenqueue operations use this path - either BPF-initiated reenqueue targeting a remote rq, or IMMED reenqueue when the target CPU is busy running userspace (not in balance or wakeup, so the _locked() fast paths aren't available). Use irq_work_queue_on() to target the owning CPU. This improves IMMED reenqueue latency when tasks are dispatched to remote local DSQs. Testing on a 24-CPU AMD Ryzen 3900X with scx_qmap -I -F 50 (ALWAYS_ENQ_IMMED, every 50th enqueue forced to prev_cpu's local DSQ) under heavy mixed load (2x CPU oversubscription, yield and context-switch pressure, SCHED_FIFO bursts, periodic fork storms, mixed nice levels, C-states disabled), measuring local DSQ residence time (insert to remove) over 5 x 120s runs (~1.2M tasks per set): >128us outliers: 71 -> 39 (-45%) >256us outliers: 59 -> 36 (-39%) Signed-off-by: Tejun Heo Reviewed-by: Emil Tsalapatis commit bf074eb6891be799174ff42e0051492681fdc045 Author: Nakamura Shuta Date: Mon Jan 19 15:29:25 2026 +0900 rust: str: improve safety comment for CString::try_from_fmt Improve the safety comment for the `inc_len()` call in `CString::try_from_fmt()` to clarify why `bytes_written()` is guaranteed not to exceed the buffer capacity. The current comment states that bytes written is bounded by size, but does not explain that this invariant is maintained because: 1. The `Formatter` is created with `size` as its capacity limit 2. The `?` operators on `write_fmt` and `write_str` ensure early return if writing exceeds this limit Suggested-by: Gary Guo Link: https://lore.kernel.org/rust-for-linux/20221114145329.0f47a3ab@GaryWorkstation/ Link: https://github.com/Rust-for-Linux/linux/issues/936 Signed-off-by: Nakamura Shuta Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260119062925.1647-1-nakamura.shuta@gmail.com [ Updated tags: it was a suggestion from Gary from the mailing list (the linked issue is mostly about adding a `debug_assert_eq!`). - Miguel ] Signed-off-by: Miguel Ojeda commit 14cf406e083c0541e40cd467ae8336ecceede09e Merge: 9aa64d2503c6f5 c369299895a591 Author: Danilo Krummrich Date: Sun Mar 22 23:13:06 2026 +0100 Merge tag 'v7.0-rc5' into driver-core-next We need the driver-core fixes in here as well to build on top of. Signed-off-by: Danilo Krummrich commit 99aa500409c43573a0399b2bd0dcf64e0062347c Author: Rito Rhymes Date: Sat Mar 21 08:55:32 2026 -0400 docs: use logo.svg as favicon Use the existing documentation logo as the HTML favicon. This makes generated documentation pages use a matching browser tab icon without introducing a separate favicon asset. Signed-off-by: Rito Rhymes Signed-off-by: Jonathan Corbet Message-ID: <20260321125532.9568-1-rito@ritovision.com> commit 0a1a27776ddf0072883cdb4a61b91155553fcb96 Merge: 781171bec0650c 01d6d7bf9672f1 Author: Jonathan Corbet Date: Sun Mar 22 15:25:08 2026 -0600 Merge branch 'mauro' into docs-mw This series comes after: https://lore.kernel.org/linux-doc/cover.1773770483.git.mchehab+huawei@kernel.org/ It basically contains patches I submitted before on a 40+ patch series, but were less relevant, plus a couple of other minor fixes: - patch 1 improves one of the CTokenizer unit test, fixing some potential issues on it; - patches 2 and 3 contain some improvement/fixes for Sphinx Python autodoc extension. They basically document c_lex.py; - The remaining patches: - create a new class for kernel-doc config; - fix some internal representations of KdocItem; - add unit tests for KernelDoc() parser class; - add support to output KdocItem in YAML, which is a machine-readable output for all documented kAPI. None of the patches should affect man or html output. commit 01d6d7bf9672f1aeabbffaa3fbfb8017223ff878 Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:14 2026 +0100 docs: kernel-doc: add support to store output on a YAML file Add a command line parameter and library support to optionally store: - KdocItem intermediate format after parsing; - man pages output; - rst output. inside a YAML file. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit b37b3cbbb1f1a99bc8b95d9f00fcf887c27f4770 Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:13 2026 +0100 docs: add a new file to write kernel-doc output to a YAML file Storing kernel-doc output is helpful to allow debugging problems on it and to preparate unit tests. Add a class to store such contents at the same format as defined at kdoc-test-schema.yaml. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <5d084ca1a91f6a620534a1135d1b8183d934319a.1773823995.git.mchehab+huawei@kernel.org> commit eea0d807dbd42b411ae0df21c6ca8d3560cb9fbf Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:12 2026 +0100 docs: test_kdoc_parser: add support for dynamic test creation Use the content of kdoc-test.yaml to generate unittests to verify that kernel-doc internal methods are parsing C code and generating output the expected way. Depending on what is written at the parser file at kdoc-test.yaml, up to 5 tests can be generated from a single test entry inside the YAML file: 1. from source to kdoc_item: test KernelDoc class; 2. from kdoc_item to man: test ManOutput class; 3. from kdoc_item to rst: test RestOutput class; 4. from source to man without checking expected KdocItem; 5. from source to rst without checking expected KdocItem. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <7ec2593c5b19de3e3b1d8de92675f6b751d3fa21.1773823995.git.mchehab+huawei@kernel.org> commit 8b69f5225aebbe37c767021bee1b95642ce530ca Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:11 2026 +0100 docs: add a simple kdoc-test.yaml together with a validation tool Create a simple kdoc-test.yaml to be used to create unit tests for kernel-doc parser and output classes. For now, all we want is a simple function mapped on a yaml test using the defined schema. To be sure that the schema is followed, add an unittest for the file, which will also validate that the schema is properly parsed. It should be noticed that the .TH definition for the man format contains a timestamp. We'll need to handle that when dealing with the actual implementation for the ManOutput class unit tests. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <74883976348c964f00161696d525c33ddd8c7641.1773823995.git.mchehab+huawei@kernel.org> commit f1cdbd824ca74e464a6159a0ae8af3ab1f123900 Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:10 2026 +0100 docs: add a schema to help creating unittests for kernel-doc Instead of hardcoding lots of tests inside a file, let's place them inside a yaml file. Add first a schema to handle it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit a5dea56ebd35a3027628b73db0968788e99c8412 Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:09 2026 +0100 docs: unittests: add a parser to test kernel-doc parser logic Validating that kernel-doc is parsing data properly is tricky. Add an unittest skeleton that alllows passing a source code and check if the corresponding values of export_table and entries returned by the parser are properly filled. It works by mocking a file input with the contents of a source string, an comparing if: - exports set matches; - expected KernelItem entries match. Create a new TestSelfValidate meant to check if the logic inside KdocParser.run_test() does its job of checking for differences inside KdocItem. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <8d91bfabd69de7aa44a0f5080ccb01aa41957e6d.1773823995.git.mchehab+huawei@kernel.org> commit e394855fcc897f73f23c364a3a596b54cc879e4c Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:08 2026 +0100 docs: kdoc_item: fix a typo on sections_start_lines Currently, there are 15 occurrences of section?_start_lines, with 10 using the plural way. This is an issue, as, while kdoc_output works with KdocItem, the term doesn't match its init value. The variable sections_start_lines stores multiple sections, so placing it in plural is its correct way. So, ensure that, on all parts of kdoc, this will be referred as sections_start_lines. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 99364ba7f8dca5c1c2d08fe37c5835b86be141f4 Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:07 2026 +0100 docs: kdoc_item: add support to generate a KdocItem from a dict When reading the contents on a KdocItem using YAML, the data will be imported into a dict. Add a method to create a new KdocItem from a dict to allow converting such input into a real KdocItem. While here, address an issue that, if the class is initialized with an internal parameter outside the 4 initial arguments, it would end being added inside other_stuff, which breaks initializing it from a dict. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 01c41b99c66ff26a102edbc4f9dff9c74692723e Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:06 2026 +0100 docs: kdoc_item: fix initial value for parameterdesc_start_lines Ensure that parameterdesc_start_lines is a dict at init time, as this is how it will be set later on at the parser. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <1b4ea24dd4cd82e6711e9be80168684427d74c30.1773823995.git.mchehab+huawei@kernel.org> commit 9ab2ca3dd127194a55bd9789c031e800fd19c254 Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:05 2026 +0100 docs: kdoc_files: move output symbols logic to kdoc_output When writing unittests for kdoc_output, it became clear that the logic with handles a series of KdocItem symbols from a single file belons to kdoc_output, and not to kdoc_files. Move the code to it. While here, also ensure that self.config will be placed together with set.out_style. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <4ebc26e37a0b544c50d50b8077760f147fa6a535.1773823995.git.mchehab+huawei@kernel.org> commit e0ebee442d56c11df023b7c2d32edc3b0765b2f3 Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:04 2026 +0100 docs: kdoc_files: use a class to group config parameters Instead of abusing argparse.Namespace, define a class to store configuration parameters and logger. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 8c0b7c0d3c0e640b3ebb7f1f648ea322e56c227a Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:03 2026 +0100 docs: kdoc: add c_lex to generated documentation Do some fixes at groups() description for it to be parsed by Sphinx and add it to the documentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <799178cf30dd4022fdb1d029ba998a458e037b52.1773823995.git.mchehab+huawei@kernel.org> commit b2d231f4a77800661b3fb812d997841a548c6526 Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:02 2026 +0100 docs: kdoc_re: better represent long regular expressions The Sphinx output from autodoc doesn't automatically break long lines, except on spaces. Change KernRe __repr__() to break the pattern on multiple strings, each one with a maximum limit of 60 characters. With that, documentation output for KernRe should now be displayable, even on long strings. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <60c264a9d277fed655b1a62df2195562c8596090.1773823995.git.mchehab+huawei@kernel.org> commit 14b7775ef7471fbb9380048aabb3e96faa1e9123 Author: Mauro Carvalho Chehab Date: Wed Mar 18 10:11:01 2026 +0100 unittests: test_tokenizer: better handle mismatch error The current logic is too sensitive to how c_lex name is placed. Also, it doesn't really check the log. Change it to check if the expected message will be reported after a call to C tokenizer with an invalid source. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <6e19578bc1ffa96e536dc31997ff658017f60173.1773823995.git.mchehab+huawei@kernel.org> commit 781171bec0650c00c642564afcb5cce57abda5bf Merge: 6108c809f4fd9d 7538df7a2d7d26 Author: Jonathan Corbet Date: Sun Mar 22 15:06:59 2026 -0600 Merge branch 'mauro' into docs-mw Mauro says: This patch series change how kdoc parser handles macro replacements. Instead of heavily relying on regular expressions that can sometimes be very complex, it uses a C lexical tokenizer. This ensures that BEGIN/END blocks on functions and structs are properly handled, even when nested. Checking before/after the patch series, for both man pages and rst only had: - whitespace differences; - struct_group macros now are shown as inner anonimous structs as it should be. Also, I didn't notice any relevant change on the documentation build time. With that regards, right now, every time a CMatch replacement rule takes in place, it does: for each transform: - tokenizes the source code; - handle CMatch; - convert tokens back to a string. A possible optimization would be to do, instead: - tokenizes source code; - for each transform handle CMatch; - convert tokens back to a string. For now, I opted not do do it, because: - too much changes on a single row; - docs build time is taking ~3:30 minutes, which is about the same time it ws taken before the changes; - there is a very dirty hack inside function_xforms: (KernRe(r"_noprof"), ""). This is meant to change function prototypes instead of function arguments. So, if ok for you, I would prefer to merge this one first. We can later optimize kdoc_parser to avoid multiple token <-> string conversions. - One important aspect of this series is that it introduces unittests for kernel-doc. I used it a lot during the development of this series, to ensure that the changes I was doing were producing the expected results. Tests are on two separate files that can be executed directly. Alternatively, there is a run.py script that runs all of them (and any other python script named tools/unittests/test_*.py"): $ tools/unittests/run.py test_cmatch: TestSearch: test_search_acquires_multiple: OK test_search_acquires_nested_paren: OK test_search_acquires_simple: OK test_search_must_hold: OK test_search_must_hold_shared: OK test_search_no_false_positive: OK test_search_no_function: OK test_search_no_macro_remains: OK TestSubMultipleMacros: test_acquires_multiple: OK test_acquires_nested_paren: OK test_acquires_simple: OK test_mixed_macros: OK test_must_hold: OK test_must_hold_shared: OK test_no_false_positive: OK test_no_function: OK test_no_macro_remains: OK TestSubSimple: test_rise_early_greedy: OK test_rise_multiple_greedy: OK test_strip_multiple_acquires: OK test_sub_count_parameter: OK test_sub_mixed_placeholders: OK test_sub_multiple_placeholders: OK test_sub_no_placeholder: OK test_sub_single_placeholder: OK test_sub_with_capture: OK test_sub_zero_placeholder: OK TestSubWithLocalXforms: test_functions_with_acquires_and_releases: OK test_raw_struct_group: OK test_raw_struct_group_tagged: OK test_struct_group: OK test_struct_group_attr: OK test_struct_group_tagged_with_private: OK test_struct_kcov: OK test_vars_stackdepot: OK test_tokenizer: TestPublicPrivate: test_balanced_inner_private: OK test_balanced_non_greddy_private: OK test_balanced_private: OK test_no private: OK test_unbalanced_inner_private: OK test_unbalanced_private: OK test_unbalanced_struct_group_tagged_with_private: OK test_unbalanced_two_struct_group_tagged_first_with_private: OK test_unbalanced_without_end_of_line: OK TestTokenizer: test_basic_tokens: OK test_depth_counters: OK test_mismatch_error: OK Ran 47 tests commit 7538df7a2d7d26428803cf8053476169a6d28659 Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:42 2026 +0100 docs: xforms_lists: use CMatch for all identifiers CMatch is lexically correct and replaces only identifiers, which is exactly where macro transformations happen. Use it to make the output safer and ensure that all arguments will be parsed the right way, even on complex cases. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <86d4a07ff0e054207747fabf38d6bb261b52b5fa.1773770483.git.mchehab+huawei@kernel.org> commit 79d881beb721d27f679f0dc1cba2d5fe2d7f6d8d Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:41 2026 +0100 docs: kdoc_parser: avoid tokenizing structs everytime Most of the rules inside CTransforms are of the type CMatch. Don't re-parse the source code every time. Doing this doesn't change the output, but makes kdoc almost as fast as before the tokenizer patches: # Before tokenizer patches $ time ./scripts/kernel-doc . -man >original 2>&1 real 0m42.933s user 0m36.523s sys 0m1.145s # After tokenizer patches $ time ./scripts/kernel-doc . -man >before 2>&1 real 1m29.853s user 1m23.974s sys 0m1.237s # After this patch $ time ./scripts/kernel-doc . -man >after 2>&1 real 0m48.579s user 0m45.938s sys 0m0.988s $ diff -s before after Files before and after are identical Manually checked the differences between original and after with: $ diff -U0 -prBw original after|grep -v Warning|grep -v "@@"|less They're due: - whitespace fixes; - struct_group are now better handled; - several badly-generated man pages from broken inline kernel-doc markups are now fixed. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <1cc2a4286ebf7d4b2d03fcaf42a1ba9fa09004b9.1773770483.git.mchehab+huawei@kernel.org> commit 12aa7753ff4c5fea405d139bcf67f49bda2c932e Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:40 2026 +0100 docs: kdoc: ensure that comments are dropped before calling split_struct_proto() Changeset 2b957decdb6c ("docs: kdoc: don't add broken comments inside prototypes") revealed a hidden bug at split_struct_proto(): some comments there may break its capability of properly identifying a struct. Fixing it is as simple as stripping comments before calling it. Fixes: 2b957decdb6c ("docs: kdoc: don't add broken comments inside prototypes") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 827b9458c9334733c598ff755bea84774ca97564 Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:39 2026 +0100 docs: kernel-doc.rst: document private: scope propagation This was an undefined behavior, but at least one place used private: inside a nested struct meant to not be propagated outside it. Kernel-doc now defines how this is propagated. So, document that. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 024e200e2a89d71dceff7d1bff8ae77b145726e0 Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:38 2026 +0100 docs: c_lex: setup a logger to report tokenizer issues Report file that has issues detected via CMatch and CTokenizer. This is done by setting up a logger that will be overriden by kdoc_parser, when used on it. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <903ad83ae176196a50444e66177a4f5bcdef5199.1773770483.git.mchehab+huawei@kernel.org> commit 2f07ddbd5793df4ec24f727322cc68065feb3568 Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:37 2026 +0100 docs: xforms_lists: better evaluate struct_group macros The previous approach were to unwind nested structs/unions. Now that we have a logic that can handle it well, use it to ensure that struct_group macros will properly reflect the actual struct. Note that the replacemend logic still simplifies the code a little bit, as the basic build block for struct group is: union { \ struct { MEMBERS } ATTRS; \ struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \ } ATTRS There: - ATTRS is meant to add extra macro attributes like __packed which we already discard, as they aren't relevant to document struct members; - TAG is used only when built with __cplusplus. So, instead, convert them into just: struct { MEMBERS }; Please notice that here, we're using the greedy version of the backrefs, as MEMBERS is actually MEMBERS... on all such macros. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <24bf2c036b08814d9b4aabc27542fd3b2ff54424.1773770483.git.mchehab+huawei@kernel.org> commit f63e6163c7e4f988b2ff35721ffc86b95425293f Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:36 2026 +0100 docs: xforms_lists: handle struct_group directly The previous logic was handling struct_group on two steps. Remove the previous approach, as CMatch can do it the right way on a single step. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit ae63a5b9203bcb3dce4819c07409b27734180eea Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:35 2026 +0100 docs: kdoc_re: get rid of NestedMatch class Now that everything was converted to CMatch, we can get rid of the previous NestedMatch implementation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 600079fdcf46fafe15b4ccd62804d66e05309cc6 Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:34 2026 +0100 docs: kdoc: replace NestedMatch with CMatch Our previous approach to solve nested structs were to use NestedMatch. It works well, but adding support to parse delimiters is very complex. Instead, use CMatch, which uses a C tokenizer, making the code more reliable and simpler. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <900bff66f8093402999f9fe055fbfa3fa33a8d8b.1773770483.git.mchehab+huawei@kernel.org> commit c22aa12c766f087d197fab7bda81554e4c1c7a0c Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:33 2026 +0100 unittests: test_cmatch: add tests for sub() Now that we have code for sub(), test it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 9aaeb817ef4f794d1dbb8736332a64b5dae9521c Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:32 2026 +0100 docs: c_lex: properly implement a sub() method for CMatch Implement a sub() method to do what it is expected, parsing backref arguments like \0, \1, \2, ... Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 50b87bb41e48127ec43a35f9302abb4c63ca6cc9 Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:31 2026 +0100 tools: unittests: add tests for CMatch The CMatch logic is complex enough to justify tests to ensure that it is doing its job. Add unittests to check the functionality provided by CMatch by replicating expected patterns. The CMatch class handles with complex macros. Add an unittest to check if its doing the right thing and detect eventual regressions as we improve its code. The initial version was generated using gpt-oss:latest LLM on my local GPU, as LLMs aren't bad transforming patterns into unittests. Yet, the curent version contains only the skeleton of what LLM produced, as I ended higly changing its content to be more representative and to have real case scenarios. The kdoc_xforms test suite contains 3 test groups. Two of them tests the basic functionality of CMatch to replace patterns. The last one (TestRealUsecases) contains real code snippets from the Kernel with some cleanups to better fit in 80 columns and uses the same transforms as kernel-doc, thus allowing to test the logic used inside kdoc_parser to transform functions, structs and variable patterns. Its output is like this: $ tools/unittests/kdoc_xforms.py Ran 25 tests in 0.003s OK test_cmatch: TestSearch: test_search_acquires_multiple: OK test_search_acquires_nested_paren: OK test_search_acquires_simple: OK test_search_must_hold: OK test_search_must_hold_shared: OK test_search_no_false_positive: OK test_search_no_function: OK test_search_no_macro_remains: OK Ran 8 tests Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <119712b5bc53b4c6dda6a81b4a783dcbfd1d970d.1773770483.git.mchehab+huawei@kernel.org> commit f1cf9f7cd66f1f90c4c3beb0885b6f7771e1b419 Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:30 2026 +0100 docs: kdoc: create a CMatch to match nested C blocks The NextMatch code is complex, and will become even more complex if we add there support for arguments. Now that we have a tokenizer, we can use a better solution, easier to be understood. Yet, to improve performance, it is better to make it use a previously tokenized code, changing its ABI. So, reimplement NextMatch using the CTokener class. Once it is done, we can drop NestedMatch. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit bd167a2122600ac787913275ad1eb5dd38698d9f Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:29 2026 +0100 unittests: add a runner to execute all unittests We'll soon have multiple unit tests, add a runner that will discover all of them and execute all tests. It was opted to discover only files that starts with "test", as this way unittest discover won't try adding libraries or other stuff that might not contain unittest classes. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <2d9dd14f03d3d6394346fdaceeb3167d54d1dd0c.1773770483.git.mchehab+huawei@kernel.org> commit 5f6fc8ed4933760c2bcddb86460fe45ada1b943c Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:28 2026 +0100 unittests: test_tokenizer: check if the tokenizer works Add extra tests to check if the tokenizer is working properly. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit fe79f85fc85691b64db1997a3b1a2df5d6d378ae Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:27 2026 +0100 unittests: test_private: modify it to use CTokenizer directly Change the logic to use the tokenizer directly. This allows adding more unit tests to check the validty of the tokenizer itself. Signed-off-by: Mauro Carvalho Chehab Message-ID: <2672257233ff73a9464c09b50924be51e25d4f59.1773074166.git.mchehab+huawei@kernel.org> Signed-off-by: Jonathan Corbet Message-ID: <66e6320a4d5ad9730c1c0ceea79b5021e90c66c6.1773770483.git.mchehab+huawei@kernel.org> commit cd77a9aa20ef53a03e5bb2630a5e7b16b910f198 Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:26 2026 +0100 docs: kdoc: use tokenizer to handle comments on structs Better handle comments inside structs. After those changes, all unittests now pass: test_private: TestPublicPrivate: test balanced_inner_private: OK test balanced_non_greddy_private: OK test balanced_private: OK test no private: OK test unbalanced_inner_private: OK test unbalanced_private: OK test unbalanced_struct_group_tagged_with_private: OK test unbalanced_two_struct_group_tagged_first_with_private: OK test unbalanced_without_end_of_line: OK Ran 9 tests This also solves a bug when handling STRUCT_GROUP() with a private comment on it: @@ -397134,7 +397134,7 @@ basic V4L2 device-level support. unsigned int max_len; unsigned int offset; struct page_pool_params_slow slow; - STRUCT_GROUP( struct net_device *netdev; + struct net_device *netdev; unsigned int queue_idx; unsigned int flags; }; Signed-off-by: Mauro Carvalho Chehab Message-ID: Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <054763260f7b5459ad0738ed906d7c358d640692.1773770483.git.mchehab+huawei@kernel.org> commit df50e848f67523195ee0b4c6d2c01823e36a15e7 Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:25 2026 +0100 docs: add a C tokenizer to be used by kernel-doc Handling C code purely using regular expressions doesn't work well. Add a C tokenizer to help doing it the right way. The tokenizer was written using as basis the Python re documentation tokenizer example from: https://docs.python.org/3/library/re.html#writing-a-tokenizer Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <39787bb8022e10c65df40c746077f7f66d07ffed.1773770483.git.mchehab+huawei@kernel.org> commit d5265f7af2d284d5421b763f268157b5fa72f806 Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:24 2026 +0100 docs: kdoc: properly handle empty enum arguments Depending on how the enum proto is written, a comma at the end may incorrectly make kernel-doc parse an arg like " ". Strip spaces before checking if arg is empty. Signed-off-by: Mauro Carvalho Chehab Message-ID: <4182bfb7e5f5b4bbaf05cee1bede691e56247eaf.1773074166.git.mchehab+huawei@kernel.org> Signed-off-by: Jonathan Corbet Message-ID: <640784283d52c5fc52ea597344ecd567e2fb6e22.1773770483.git.mchehab+huawei@kernel.org> commit b1e64e30fce86e61d3b09f9352b262622f3f0cda Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:23 2026 +0100 docs: kdoc: don't add broken comments inside prototypes Parsing a file like drivers/scsi/isci/host.h, which contains broken kernel-doc markups makes it create a prototype that contains unmatched end comments. That causes, for instance, struct sci_power_control to be shown this this prototype: struct sci_power_control { * it is not. */ bool timer_started; */ struct sci_timer timer; * requesters field. */ u8 phys_waiting; */ u8 phys_granted_power; * mapped into requesters via struct sci_phy.phy_index */ struct isci_phy *requesters[SCI_MAX_PHYS]; }; as comments won't start with "/*" anymore. Fix the logic to detect such cases, and keep adding the comments inside it. Signed-off-by: Mauro Carvalho Chehab Message-ID: <18e577dbbd538dcc22945ff139fe3638344e14f0.1773074166.git.mchehab+huawei@kernel.org> Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <12ac4a97e2bd5a19d6537122c10098690c38d2c7.1773770483.git.mchehab+huawei@kernel.org> commit c6c23449b3029757864c6895420296acbe096534 Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:22 2026 +0100 unittests: add a testbench to check public/private kdoc comments Add unit tests to check if the public/private and comments strip is working properly. Running it shows that, on several cases, public/private is not doing what it is expected: test_private: TestPublicPrivate: test balanced_inner_private: OK test balanced_non_greddy_private: OK test balanced_private: OK test no private: OK test unbalanced_inner_private: FAIL test unbalanced_private: FAIL test unbalanced_struct_group_tagged_with_private: FAIL test unbalanced_two_struct_group_tagged_first_with_private: FAIL test unbalanced_without_end_of_line: FAIL Ran 9 tests FAILED (failures=5) Signed-off-by: Mauro Carvalho Chehab Message-ID: <144f4952e0cb74fe9c9adc117e9a21ec8aa1cc10.1773074166.git.mchehab+huawei@kernel.org> Signed-off-by: Jonathan Corbet Message-ID: commit 023aabb6ccb298add344cab7c00c5f27b10319aa Author: Mauro Carvalho Chehab Date: Tue Mar 17 19:09:21 2026 +0100 docs: python: add helpers to run unit tests While python internal libraries have support for unit tests, its output is not nice. Add a helper module to improve its output. I wrote this module last year while testing some scripts I used internally. The initial skeleton was generated with the help of LLM tools, but it was higly modified to ensure that it will work as I would expect. Signed-off-by: Mauro Carvalho Chehab Message-ID: <37999041f616ddef41e84cf2686c0264d1a51dc9.1773074166.git.mchehab+huawei@kernel.org> Signed-off-by: Jonathan Corbet Message-ID: commit 6108c809f4fd9dbb1a138ba4326d645cc3113a8d Author: Haoyang LIU Date: Mon Mar 9 15:47:15 2026 +0800 tools/docs/checktransupdate.py: fix all issues reported by pylint This patch fixes all issues reported by pylint, including: 1. Format issue in logging. 2. Variable name style issue. Fixes: 63e96ce050e5 ("scripts: fix all issues reported by pylint") Signed-off-by: Haoyang LIU Signed-off-by: Jonathan Corbet Message-ID: <20260309074716.10739-1-tttturtleruss@gmail.com> commit cae0e1bbde87750ea6976e4ecbaa424de859d7ba Author: Daniel Tang Date: Mon Mar 9 21:05:21 2026 -0400 docs: path-lookup: fix unrenamed WALK_GET The symbol WALK_GET does not appears in the codebase as of 0031c06807cfa8aa. It was renamed as of 8f64fb1ccef33107. A previous documentation update, de9414adafe4, renamed one occurrence in path-lookup.rst, but forgot to change another occurrence later in the file. Fixes: de9414adafe4 ("docs: path-lookup: update WALK_GET, WALK_PUT desc") Signed-off-by: Daniel Tang Signed-off-by: Jonathan Corbet Message-ID: <13011949.O9o76ZdvQC@daniel-desktop3> commit 117376394061780680dd4bfd92ea30bf9deafedf Author: Julia Lawall Date: Tue Mar 10 13:14:31 2026 +0100 coccinelle: update Coccinelle URL The LIP6 URL no longer functions. Signed-off-by: Julia Lawall Signed-off-by: Jonathan Corbet Message-ID: <20260310121431.362091-1-Julia.Lawall@inria.fr> commit 9d437400745edec29eba221c41380a5ae0d925f5 Author: Thorsten Leemhuis Date: Tue Mar 17 13:33:08 2026 +0100 docs: reporting-issues: create a proper appendix explaining specialties Merge "Why some bugs remain unfixed and some reports are ignored" with the closing words while rewriting and extending the text. The result spends fewer words on explaining things that are normal in FLOSS -- while outlining where the kernel is different and how that makes bug reporting more complicated than in other FLOSS projects. Signed-off-by: Thorsten Leemhuis Signed-off-by: Jonathan Corbet Message-ID: <473b36fa9723c46b7167004752f097e6c26d7278.1773750701.git.linux@leemhuis.info> commit a9a1c262df0bbe43ea7a69fe0a97dc68fcc6ba66 Author: Thorsten Leemhuis Date: Tue Mar 17 13:33:07 2026 +0100 docs: verify-bugs-… and quickly-build-…: improve feedback section Mention sending patches in the section about feedback. This syncs them with a section a earlier patch added to reporting-issues.rst, which was based on these sections and improved during review. Signed-off-by: Thorsten Leemhuis Signed-off-by: Jonathan Corbet Message-ID: commit ceee0f73c3c6c45d4ffa4ebaf28a9094e0934779 Author: Thorsten Leemhuis Date: Tue Mar 17 13:33:06 2026 +0100 docs: reporting-issues: add conclusion to the step-by-step guide Text based on a section Documentation/admin-guide/verify-bugs-and-bisect-regressions.rst and slightly improved after review feedback. Signed-off-by: Thorsten Leemhuis Signed-off-by: Jonathan Corbet Message-ID: commit 83aa754da480ed665f99db5d6b73e7f1b9836976 Author: Thorsten Leemhuis Date: Tue Mar 17 13:33:05 2026 +0100 docs: reporting-issues: tweak the reference section intro Fine tuning to the intro of the reference section: * Call the step-by-step guide what it is. * Reorder the links to the guides on bug reporting to first mention the most modern one. * Many small changes to streamline the text and slightly shorten it. Signed-off-by: Thorsten Leemhuis Signed-off-by: Jonathan Corbet Message-ID: commit c423d3295a760da0f2943c5c14f9c3e8fae04390 Author: Thorsten Leemhuis Date: Tue Mar 17 13:33:04 2026 +0100 docs: reporting-issues: mention text is best viewed rendered Add a comment before the step-by-step guide explaining that the document is best viewed in the rendered form, as there the internal links will work that later patches will add. Signed-off-by: Thorsten Leemhuis Signed-off-by: Jonathan Corbet Message-ID: commit a0529bbe70d74e495b682933955e5938245ad84b Author: Daniel Castro Date: Tue Mar 17 11:01:34 2026 -0300 docs: pt_BR: translate process/1.Intro.rst Add Brazilian Portuguese translation of the development process introduction (Documentation/process/1.Intro.rst), covering the executive summary, importance of mainline code, and licensing. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Daniel Castro Signed-off-by: Jonathan Corbet Message-ID: <20260317140136.29256-1-arantescastro@gmail.com> commit 98b764fd72bd8a1fe357f0d65bb929ae11efc75b Author: Daniel Pereira Date: Thu Mar 19 08:54:12 2026 -0300 docs/pt_BR: translation of maintainer-soc-clean-dts.rst Translate Documentation/process/maintainer-soc-clean-dts.rst into Portuguese. Signed-off-by: Daniel Pereira Signed-off-by: Jonathan Corbet Message-ID: <20260319115416.495020-3-danielmaraboo@gmail.com> commit a39b136f67091533cb74829b0090db52089e6400 Author: Daniel Pereira Date: Thu Mar 19 08:54:11 2026 -0300 docs/pt_BR: translation of maintainer-soc.rst Translate Documentation/process/maintainer-soc.rst into Portuguese. This is part of the effort to localize the kernel documentation. Signed-off-by: Daniel Pereira Signed-off-by: Jonathan Corbet Message-ID: <20260319115416.495020-2-danielmaraboo@gmail.com> commit f03ffe53ab6ffc798ed8291090cebf19c6e5fa3b Author: Andrea Righi Date: Sun Mar 22 07:35:46 2026 +0100 tools/sched_ext: Add compat handling for sub-scheduler ops Extend SCX_OPS_OPEN() with compatibility handling for ops.sub_attach() and ops.sub_detach(), allowing scx C schedulers with sub-scheduler support to run on kernels both with and without its support. Cc: Cheng-Yang Chou Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Signed-off-by: Andrea Righi Reviewed-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 63f500c32a37d490ec623a3130e488cdb9bd6cf7 Author: Andrea Righi Date: Sun Mar 22 07:51:46 2026 +0100 sched_ext: Guard cpu_smt_mask() with CONFIG_SCHED_SMT Wrap cpu_smt_mask() usage with CONFIG_SCHED_SMT to avoid build failures on kernels built without SMT support. Fixes: 2197cecdb02c ("sched_ext: idle: Prioritize idle SMT sibling") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603221422.XIueJOE9-lkp@intel.com/ Signed-off-by: Andrea Righi Reviewed-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit e73b1d7210c02ff223e2786934d5a6e73eab1999 Author: Cheng-Yang Chou Date: Sun Mar 22 21:48:16 2026 +0800 sched_ext: Fix build errors and unused label warning in non-cgroup configs When building with SCHED_CLASS_EXT=y but CGROUPS=n, clang reports errors for undeclared cgroup_put() and cgroup_get() calls, and a warning for the unused err_stop_helper label. EXT_SUB_SCHED is def_bool y depending only on SCHED_CLASS_EXT, but it fundamentally requires cgroups (cgroup_path, cgroup_get, cgroup_put, cgroup_id, etc.). Add the missing CGROUPS dependency to EXT_SUB_SCHED in init/Kconfig. Guard cgroup_put() and cgroup_get() in the common paths with: #if defined(CONFIG_EXT_GROUP_SCHED) || defined(CONFIG_EXT_SUB_SCHED) Guard the err_stop_helper label with #ifdef CONFIG_EXT_SUB_SCHED since all gotos targeting it are inside that same ifdef block. Tested with both CGROUPS enabled and disabled. Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603210903.IrKhPd6k-lkp@intel.com/ Signed-off-by: Cheng-Yang Chou Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 713db70d6dc095d983be9a7576cb0e6d9eb7678c Merge: c2d466b9fe1913 6f507eb2bb5491 Author: Jens Axboe Date: Sun Mar 22 13:37:45 2026 -0600 Merge tag 'md-7.1-20260323' of git://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into for-7.1/block Pull MD changes from Yu Kuia: "Bug Fixes: - md: suppress spurious superblock update error message for dm-raid (Chen Cheng) - md/raid1: fix the comparing region of interval tree (Xiao Ni) - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) - md/raid5: skip 2-failure compute when other disk is R5_LOCKED (FengWei Shih) - md/md-llbitmap: raise barrier before state machine transition (Yu Kuai) - md/md-llbitmap: skip reading rdevs that are not in_sync (Yu Kuai) Improvements: - md/raid5: set chunk_sectors to enable full stripe I/O splitting (Yu Kuai) Cleanups: - md: remove unused mddev argument from export_rdev (Chen Cheng) - md/raid5: remove stale md_raid5_kick_device() declaration (Chen Cheng) - md/raid5: move handle_stripe() comment to correct location (Chen Cheng)" * tag 'md-7.1-20260323' of git://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: md: remove unused mddev argument from export_rdev md/raid5: move handle_stripe() comment to correct location md/raid5: remove stale md_raid5_kick_device() declaration md/raid1: fix the comparing region of interval tree md/raid5: skip 2-failure compute when other disk is R5_LOCKED md/md-llbitmap: raise barrier before state machine transition md/md-llbitmap: skip reading rdevs that are not in_sync md/raid5: set chunk_sectors to enable full stripe I/O splitting md/raid10: fix deadlock with check operation and nowait requests md: suppress spurious superblock update error message for dm-raid commit 26469110c750c8179560637dd813e5d65b8148d2 Author: Patrisious Haddad Date: Thu Mar 19 14:22:11 2026 +0200 net/mlx5: Add vhca_id_type bit to alias context Add vhca_id_type bit to alias context which allows indicating the vhca_id_type to be passed at vhca_id_to_be_accessed, which can be either HW or SW, note that SW_VHCA_ID must be used to allow alias to work properly after migration. Signed-off-by: Patrisious Haddad Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260319122211.27384-3-tariqt@nvidia.com Reviewed-by: Joe Damato Signed-off-by: Leon Romanovsky commit c0368933dd3d4a8210a07a0c95c471421fbf7523 Author: Parav Pandit Date: Thu Mar 19 14:22:10 2026 +0200 mlx5: Remove redundant iseg base iseg_base and base_addr both point to BAR0, making iseg_base redundant. Remove iseg_base and rely on base_addr instead, reducing the size of struct mlx5_core_dev. Signed-off-by: Parav Pandit Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260319122211.27384-2-tariqt@nvidia.com Reviewed-by: Joe Damato Signed-off-by: Leon Romanovsky commit 1b6f292cb94d95c9bc22e1efe592daf62c60bc2e Author: Prasanna Kumar T S M Date: Sun Mar 22 06:11:39 2026 -0700 EDAC/versalnet: Fix memory leak in remove and probe error paths The mcdi object allocated using kzalloc() in the setup_mcdi() is not freed in the remove path or in probe's error handling path leading to a memory leak. Fix it by freeing the allocated memory. Fixes: d5fe2fec6c40d ("EDAC: Add a driver for the AMD Versal NET DDR controller") Signed-off-by: Prasanna Kumar T S M Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260322131139.1684716-1-ptsm@linux.microsoft.com commit 6f507eb2bb5491327fe634dc23558d4ca5d710b8 Author: Chen Cheng Date: Wed Mar 4 19:14:17 2026 +0800 md: remove unused mddev argument from export_rdev The mddev argument in export_rdev() is never used. Remove it to simplify callers. Signed-off-by: Chen Cheng Reviewed-by: Paul Menzel Link: https://lore.kernel.org/linux-raid/20260304111417.20777-1-chencheng@fnnas.com/ Signed-off-by: Yu Kuai commit 81c041260a2b8b1533a2492071a0ab53074368a7 Author: Chen Cheng Date: Wed Mar 4 19:10:01 2026 +0800 md/raid5: move handle_stripe() comment to correct location Move the handle_stripe() documentation comment from above analyse_stripe() to directly above handle_stripe() where it belongs. Signed-off-by: Chen Cheng Reviewed-by: Yu Kuai Link: https://lore.kernel.org/linux-raid/20260304111001.15767-1-chencheng@fnnas.com/ Signed-off-by: Yu Kuai commit af5c99b8ea371b8137e2a62be50adabd964a68c6 Author: Chen Cheng Date: Wed Mar 4 19:09:18 2026 +0800 md/raid5: remove stale md_raid5_kick_device() declaration Remove the unused md_raid5_kick_device() declaration from raid5.h - no definition exists for this function. Signed-off-by: Chen Cheng Reviewed-by: Yu Kuai Link: https://lore.kernel.org/linux-raid/20260304110919.15071-1-chencheng@fnnas.com/ Signed-off-by: Yu Kuai commit de3544d2e5ea99064498de3c21ba490155864657 Author: Xiao Ni Date: Thu Mar 5 09:18:33 2026 +0800 md/raid1: fix the comparing region of interval tree Interval tree uses [start, end] as a region which stores in the tree. In raid1, it uses the wrong end value. For example: bio(A,B) is too big and needs to be split to bio1(A,C-1), bio2(C,B). The region of bio1 is [A,C] and the region of bio2 is [C,B]. So bio1 and bio2 overlap which is not right. Fix this problem by using right end value of the region. Fixes: d0d2d8ba0494 ("md/raid1: introduce wait_for_serialization") Signed-off-by: Xiao Ni Link: https://lore.kernel.org/linux-raid/20260305011839.5118-2-xni@redhat.com/ Signed-off-by: Yu Kuai commit e1c3bc324407e82a616228ff70027408b2e26f91 Author: Val Packett Date: Mon Feb 23 16:22:50 2026 +0000 drm/mediatek: ovl: Add specific entry for mt8167 While this configuration is otherwise identical to mt8173, according to Android kernel sources, this SoC does need smi_id_en. Signed-off-by: Val Packett Signed-off-by: Luca Leonardo Scorcia Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/5f880f1334aa93184afee3e36132ca42628821fb.1771863641.git.l.scorcia@gmail.com/ Signed-off-by: Chun-Kuang Hu commit 14b6aa1e6a2cbd3ef84bbabf2540784e6991b265 Author: Luca Leonardo Scorcia Date: Mon Feb 23 16:22:47 2026 +0000 dt-bindings: phy: mediatek, dsi-phy: Add support for mt8167 Add support for the MediaTek mt8167 SoC: the DSI PHY found in this chip is fully compatible with the one found in the mt2701 SoC. Signed-off-by: Luca Leonardo Scorcia Reviewed-by: AngeloGioacchino Del Regno Acked-by: Krzysztof Kozlowski Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/92530e0a31eca1feb822f5c5fd4ac894937dd6c7.1771863641.git.l.scorcia@gmail.com/ Signed-off-by: Chun-Kuang Hu commit 42c89f43107dd4931c3278035f7f1e02e6773c93 Author: Luca Leonardo Scorcia Date: Mon Feb 23 16:22:46 2026 +0000 dt-bindings: display: mediatek: Add compatibles for MediaTek mt8167 Add compatibles for various display-related blocks of MediaTek mt8167. Signed-off-by: Luca Leonardo Scorcia Reviewed-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/66eafae30f9fe00b469e79d385c1ddd24d209475.1771863641.git.l.scorcia@gmail.com/ Signed-off-by: Chun-Kuang Hu commit 86d5f60dea00a56ed3da9612028f930d78336adf Author: Luca Leonardo Scorcia Date: Thu Feb 12 19:22:47 2026 +0000 drm/mediatek: Remove all conflicting aperture devices during probe If a device has a framebuffer available it might be already used as display by simple-framebuffer or simpledrm when mediatek-drm is probed. This is actually helpful when porting to a new device as framebuffers are simple to setup in device trees and fbcon can be used to monitor the kernel boot process. When drm-mediatek loads a new fb device is initialized, however fbcon remains attached to the initial framebuffer which is no longer connected to the actual display - the early fb is never removed. We can gracefully transition from framebuffer handling to drm-managed display by calling aperture_remove_all_conflicting_devices before registering mediatek-drm. This takes care of unloading other fb devices/drivers and disconnects fbcon which then automatically reconnects to mediatekdrmfb as soon as it's available. The function is invoked just before drm_dev_register() to kick out the existing framebuffer as late as possible to reduce the time the screen is unresponsive. Signed-off-by: Luca Leonardo Scorcia Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20260212192605.263160-1-l.scorcia@gmail.com/ Signed-off-by: Chun-Kuang Hu commit af980a79bfed43c4a0be12cca786be46f1a0c5e8 Author: Oleksij Rempel Date: Tue Feb 10 14:51:10 2026 +0100 iio: dac: ds4424: add Rfs-based scale and per-variant limits Parse optional maxim,rfs-ohms values to derive the per-channel output current scale (mA per step) for the IIO current ABI. Behavior changes: - If maxim,rfs-ohms is present, IIO_CHAN_INFO_SCALE becomes available and reports mA/step derived from Rfs. - If maxim,rfs-ohms is missing, SCALE is not exposed to keep older DTs working without requiring updates. Signed-off-by: Oleksij Rempel Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit f789b8cc39f0dc46b1654aff84e420927bea4272 Author: Oleksij Rempel Date: Tue Feb 10 14:51:09 2026 +0100 dt-bindings: iio: dac: maxim,ds4424: add maxim,rfs-ohms property The Maxim DS4422/DS4424 and DS4402/DS4404 current DACs determine their full-scale output current via external resistors (Rfs) connected to the FSx pins. Without knowing these values, the full-scale range of the hardware is undefined. Add the 'maxim,rfs-ohms' property to describe these physical components. This property is required to provide a complete description of the hardware configuration. Signed-off-by: Oleksij Rempel Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit cfeae3ce3e5a5755aeada4930a84cf4cbac3ea10 Author: Oleksij Rempel Date: Tue Feb 10 14:51:08 2026 +0100 iio: dac: ds4424: convert to regmap Refactor the driver to use the regmap API. Replace the driver-specific mutex and manual shadow buffers with the standard regmap infrastructure for locking and caching. This ensures the cache is populated from hardware at probe, preventing state desynchronization (e.g. across suspend/resume). Define access tables to validate the different register maps of DS44x2 and DS44x4. Signed-off-by: Oleksij Rempel Reviewed-by: Sander Vanheule Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 8d68801a696ce101349db6896c10afb5f8d1c228 Author: Oleksij Rempel Date: Tue Feb 10 14:51:07 2026 +0100 iio: dac: ds4424: support per-variant output range limits The DS4402/DS4404 variants operate with a 5-bit resolution (31 steps), whereas the DS4422/DS4424 support 7-bit (127 steps). Previously, the driver enforced a hardcoded 7-bit mask (DS4424_DAC_MASK) for all variants. This allowed users to write values exceeding the 5-bit range to DS4402/DS4404 devices, resulting in silent truncation or undefined behavior. Add a `result_mask` field to the chip_info structure to define the valid data range for each variant. Use this mask to: 1. Correctly mask register values in read_raw(). 2. Return -EINVAL in write_raw() if the input value exceeds the variant's capabilities. Signed-off-by: Oleksij Rempel Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 1fa14dd130fae3feccdde112ed26f48042cf5d7b Author: David Jander Date: Tue Feb 10 14:51:06 2026 +0100 iio: dac: ds4424: add DS4402/DS4404 device IDs Add I2C/OF IDs for DS4402 and DS4404 and set the correct channel count. Follow-up changes add per-variant scaling based on external Rfs. Co-developed-by: Oleksij Rempel Signed-off-by: Oleksij Rempel Signed-off-by: David Jander Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit a7622a651d6ede223a25af432d6b29cb3c9337c9 Author: Oleksij Rempel Date: Tue Feb 10 14:51:05 2026 +0100 dt-bindings: iio: dac: maxim,ds4424: add ds4402/ds4404 Add compatible strings for Maxim DS4402 and DS4404 current DACs. These devices are 5-bit variants of the DS4422/DS4424 family. Signed-off-by: Oleksij Rempel Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit 5ff37a60b39804c6e505fc2069a3d892b5d787f5 Author: Oleksij Rempel Date: Tue Feb 10 14:51:04 2026 +0100 iio: dac: ds4424: use fsleep() instead of usleep_range() The DS4422/DS4424 and DS4402/DS4404 datasheets do not specify a minimum delay between power-up (POR) and the availability of the I2C interface. The driver previously used `usleep_range(1000, 1200)` to enforce a ~1ms delay. Replace this with `fsleep(1000)` to allow the kernel to select the most efficient sleep mechanism while retaining the existing conservative delay to ensure device readiness. Signed-off-by: Oleksij Rempel Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 76255024cadbe8c40462953f8193d2d78cd3b0ac Author: Gary Bisson Date: Tue Jan 20 12:36:59 2026 +0100 drm/mediatek: mtk_dsi: enable hs clock during pre-enable Some bridges, such as the TI SN65DSI83, require the HS clock to be running in order to lock its PLL during its own pre-enable function. Without this change, the bridge gives the following error: sn65dsi83 14-002c: failed to lock PLL, ret=-110 sn65dsi83 14-002c: Unexpected link status 0x01 sn65dsi83 14-002c: reset the pipe Move the necessary functions from enable to pre-enable. Signed-off-by: Gary Bisson Reviewed-by: CK Hu Tested-by: Chen-Yu Tsai # Chromebooks Tested-by: AngeloGioacchino Del Regno Reviewed-by: AngeloGioacchino Del Regno Link: https://patchwork.kernel.org/project/dri-devel/patch/20260120-mtkdsi-v1-1-b0f4094f3ac3@gmail.com/ Signed-off-by: Chun-Kuang Hu commit 37840446078b47e49ea97dd2a6f20cb5ecd44483 Author: Oleksij Rempel Date: Tue Feb 10 14:51:03 2026 +0100 iio: dac: ds4424: use device match data for chip info Refactor the driver to use device match data instead of checking ID enums in a switch statement. Define a `ds4424_chip_info` structure to hold variant-specific attributes (currently just the channel count) and attach it directly to the I2C and OF device ID tables. This simplifies the probe function and makes it easier to add support for new variants like DS4402/DS4404. Signed-off-by: Oleksij Rempel Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit d2d5a6cb288ad3d9fb327feb39f478dc40ec9f9c Author: Oleksij Rempel Date: Tue Feb 10 14:51:02 2026 +0100 iio: dac: ds4424: rename iio_info struct to avoid ambiguity Rename the static `ds4424_info` structure to `ds4424_iio_info`. The previous name was generic and could be confused with chip-specific data structures (like the upcoming `ds4424_chip_info`). The new name explicitly indicates that this structure holds the IIO framework callbacks. Signed-off-by: Oleksij Rempel Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 809b578b99c57cd5cbcfe5e1ef40ae0da6a383ee Author: Oleksij Rempel Date: Tue Feb 10 14:51:01 2026 +0100 iio: dac: ds4424: sort headers alphabetically Sort the header inclusions alphabetically. This improves readability and simplifies adding new includes in the future. Group subsystem-specific headers (linux/iio/*) separately at the end to clarify subsystem context. Signed-off-by: Oleksij Rempel Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit c071adeb72739306bf2960a8f703206979c65196 Author: Oleksij Rempel Date: Tue Feb 10 14:51:00 2026 +0100 iio: dac: ds4424: ratelimit read errors and use device context Replace pr_err() with dev_err_ratelimited() in the RAW read path to avoid log spam on repeated I2C failures and to include the device context. Use %pe to print errno names for faster debugging. Use the parent device context to identify the physical hardware causing the error. Signed-off-by: Oleksij Rempel Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit a718013647dcd5aca14c9a8856e1dab694e846ae Author: Oleksij Rempel Date: Tue Feb 10 14:50:59 2026 +0100 iio: dac: ds4424: refactor raw access to use bitwise operations Refactor the raw access logic to use standard GENMASK() and BIT() macros. Use abs() for magnitude calculation to simplify the logic and make the data flow clearer. Signed-off-by: Oleksij Rempel Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 9e4e86a604dfd06402933467578c4b79f5412b2c Merge: e8b83499b4cbc8 f338e77383789c Author: Jonathan Cameron Date: Sun Mar 22 12:20:42 2026 +0000 Merge tag 'v7.0-rc4' into togreg Linux 7.0-rc4 Required for the ds4422 series which is build upon; 5187e03b817c ("iio: dac: ds4424: reject -128 RAW value") commit 5c86ef2055900ebe5e5a195a7d67b14ff665b60e Author: Thomas Richard (TI) Date: Fri Mar 13 19:18:54 2026 +0100 arm64: dts: ti: k3-j721s2: Use ti,j7200-padconf compatible On the J721S2 platform, pinctrl contexts must be saved and restored during suspend-to-ram, just like on the J7200. So use ti,j7200-padconf compatible. Signed-off-by: Thomas Richard (TI) Link: https://patch.msgid.link/20260313-j721s2-s2r-pinctrl-v1-1-a6f80c641037@bootlin.com Signed-off-by: Vignesh Raghavendra commit 6e5df7cc5455dfcfac4764f00d121ee6a6796e2c Author: Dominik Haller Date: Fri Mar 20 14:23:46 2026 -0700 arm64: dts: ti: k3-am68-phyboard-izar: Add PEB-AV-15 overlay Add an overlay to use the PEB-AV-15 AV-Adapter. It's a small expansion board using a Lontium LT8912B DSI->HDMI bridge and a TLV320AIC3007 audio codec. Signed-off-by: Dominik Haller Link: https://patch.msgid.link/20260320212349.420951-6-d.haller@phytec.de Signed-off-by: Vignesh Raghavendra commit db0da07c37a2a79b19a07eef2f218dc830275e7d Author: Dominik Haller Date: Fri Mar 20 14:23:45 2026 -0700 arm64: dts: ti: k3-j721s2-main: Add DSI1 Add the second DSI instance and its corresponding phy to the main domain include file. Signed-off-by: Dominik Haller Reviewed-by: Beleswar Padhi Link: https://patch.msgid.link/20260320212349.420951-5-d.haller@phytec.de Signed-off-by: Vignesh Raghavendra commit 1bdfd6abc1ec5d60474a2f0b96955480b33e0644 Author: Dominik Haller Date: Fri Mar 20 14:23:44 2026 -0700 arm64: dts: ti: k3-am68-phyboard-izar: Add LVDS-Display Add an overlay to use a powertip,ph128800t006-zhc01 10.1" LVDS display. Signed-off-by: Dominik Haller Link: https://patch.msgid.link/20260320212349.420951-4-d.haller@phytec.de Signed-off-by: Vignesh Raghavendra commit 2295927906ce448a25ec7fc6f5da731b364d6b90 Author: Dominik Haller Date: Fri Mar 20 14:23:43 2026 -0700 arm64: dts: ti: k3-am68-phycore-som: Add DSI->LVDS bridge Add the TI SN65DSI83 MIPI-DSI->LVDS bridge that can be populated on the phyCORE-AM68x/TDA4x. Signed-off-by: Dominik Haller Link: https://patch.msgid.link/20260320212349.420951-3-d.haller@phytec.de Signed-off-by: Vignesh Raghavendra commit ae41091c65453b900a9a96294ee7ff007dc671e4 Author: Dominik Haller Date: Fri Mar 20 14:23:42 2026 -0700 arm64: dts: ti: k3-am68-phyboard-izar: Assign dss clocks Assign the dss clocks in the base dts so that display overlays can be used in any combination. Signed-off-by: Dominik Haller Link: https://patch.msgid.link/20260320212349.420951-2-d.haller@phytec.de Signed-off-by: Vignesh Raghavendra commit d5325810814ee995debfa0b6c4a22e0391598bef Author: Francesco Dolcini Date: Fri Mar 20 08:30:30 2026 +0100 arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Verdin AM62 board does not have external pullups on eMMC DAT1-DAT7 pins. Enable internal pullups on DAT1-DAT7 considering: - without a host-side pullup, these lines rely solely on the eMMC device's internal pullup (R_int, 10kohm-150kohm per JEDEC), which may exceed the recommended 50kohm max for 1.8V VCCQ - JEDEC JESD84-B51 Table 200 requires host-side pullups (R_DAT, 10kohm-100kohm) on all data lines to prevent bus floating Fixes: 316b80246b16 ("arm64: dts: ti: add verdin am62") Cc: stable@vger.kernel.org Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20260320073032.10427-1-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit e8b83499b4cbc8b989f7cd6aaa893b669326e93c Author: Randy Dunlap Date: Wed Mar 11 22:13:45 2026 -0700 iio: st_sensors: correct kernel-doc issues Use the proper kernel-doc format and struct member names to avoid kernel-doc warnings: Warning: include/linux/iio/common/st_sensors.h:184 struct member 'int1' not described in 'st_sensor_data_ready_irq' Warning: ../include/linux/iio/common/st_sensors.h:184 struct member 'int2' not described in 'st_sensor_data_ready_irq' Warning: ../include/linux/iio/common/st_sensors.h:184 struct member 'stat_drdy' not described in 'st_sensor_data_ready_irq' Warning: ../include/linux/iio/common/st_sensors.h:184 struct member 'ig1' not described in 'st_sensor_data_ready_irq' Warning: ../include/linux/iio/common/st_sensors.h:219 struct member 'num_ch' not described in 'st_sensor_settings' Warning: ../include/linux/iio/common/st_sensors.h:263 struct member 'num_data_channels' not described in 'st_sensor_data' Signed-off-by: Randy Dunlap Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 6285f0881ec68034399d13552f7243e69e6e37bf Author: Thomas Weißschuh Date: Thu Mar 19 17:20:17 2026 +0100 tools/nolibc: rename sys_foo() functions to _sys_foo() The sys_foo() naming scheme used by the syscall wrappers may collide with application symbols. Especially as 'sys_' is an obvious naming scheme an application may choose for its own custom systemcall wrappers. Avoid these conflicts by using an leading underscore which moves the names into the implementation's namespace. This naming scheme was chosen over a '__nolibc_' prefix, as these functions are not an implementation detail but a documented interface meant to be used by applications. While this may break some existing users, adapting them should be straightforward. Given that nolibc is most-likely vendored, no unexpected breakage should happen. No in-tree users are affected. These conflicts happen when compiling some of the kernel selftests with nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260319-nolibc-namespacing-v1-1-33c22eaddb5e@weissschuh.net commit c8f6a4bbad3b1a96572d1ac1d5c37bae109fa664 Author: Thomas Weißschuh Date: Wed Mar 18 17:12:43 2026 +0100 selftests/nolibc: enable -Wundef Users might use -Wundef, so also use it in the nolibc testsuite to ensure no warnings are triggered. The existing line with warning options is getting too long, so move all warnings to a dedicated line. Acked-by: Willy Tarreau Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260318-nolibc-wundef-v1-2-fcb7f9ac7298@weissschuh.net commit 3eb97c4cbd4d874e7e327ec512f6169934e12b8a Author: Thomas Weißschuh Date: Wed Mar 18 17:12:42 2026 +0100 tools/nolibc: avoid -Wundef warning for __STDC_VERSION__ With -std=c89 the macro __STDC_VERSION__ is not defined. While undefined identifiers in '#if' directives are assumed to be '0', with -Wundef a warning is emitted. Avoid the warning by explicitly falling back to '0' if __STDC_VERSION__ is not provided by the preprocessor. Fixes: 37219aa5b123 ("tools/nolibc: add __nolibc_static_assert()") Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260318-nolibc-wundef-v1-1-fcb7f9ac7298@weissschuh.net commit 9da0f529c089f00e6ab8b552d7407e612b7245a8 Author: Thomas Weißschuh Date: Wed Mar 18 16:50:17 2026 +0100 tools/nolibc: add err.h Add a few convenient helpers to print error and warning messages. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260318-nolibc-err-h-v4-2-08247a694bd9@weissschuh.net commit b74be922745989573eedee2a91d987711ef968bd Author: Thomas Weißschuh Date: Wed Mar 18 16:50:16 2026 +0100 tools/nolibc: add support for program_invocation_{,short_}name Add support for the GNU extensions 'program_invocation_name' and 'program_invocation_short_name'. These are useful to print error messages, which by convention include the program name. As these are global variables which take up memory even if not used, similar to 'errno', gate them behind NOLIBC_IGNORE_ERRNO. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260318-nolibc-err-h-v4-1-08247a694bd9@weissschuh.net commit 2219ec23b6cf4ba6e6e23f43601e859f9eaaa24d Author: Juergen Gross Date: Mon Jan 19 19:26:29 2026 +0100 block/floppy: Don't use REALLY_SLOW_IO for delays Instead of defining REALLY_SLOW_IO before including io.h, add the required additional calls of native_io_delay() to the related functions in arch/x86/include/asm/floppy.h. Drop REALLY_SLOW_IO now too as it has no users. [ bp: Merge the REALLY_SLOW_IO removal into this patch. ] Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20260119182632.596369-4-jgross@suse.com commit 9eece498565c3fd5f37efe58498779efd39f2269 Author: Juergen Gross Date: Mon Jan 19 19:26:28 2026 +0100 x86/paravirt: Replace io_delay() hook with a bool The io_delay() paravirt hook is in no way performance critical and all users setting it to a different function than native_io_delay() are using an empty function as replacement. Allow replacing the hook with a bool indicating whether native_io_delay() should be called. [ bp: Massage commit message. ] Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20260119182632.596369-3-jgross@suse.com commit 36c1eb9531e0c9bdcb3494142123f1c1e128367b Author: Juergen Gross Date: Mon Jan 19 19:26:27 2026 +0100 x86/irqflags: Preemptively move include paravirt.h directive where it belongs Commit 22cc5ca5de52 ("x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT") moved some paravirt hooks from the CONFIG_PARAVIRT_XXL umbrella to CONFIG_PARAVIRT, but missed to move the associated "#include " in irqflags.h from CONFIG_PARAVIRT_XXL to CONFIG_PARAVIRT. This hasn't resulted in build failures yet, as all use cases of irqflags.h had paravirt.h included via other header files, even without CONFIG_PARAVIRT_XXL being set. In order to allow changing those other header files, e.g. by no longer including paravirt.h, fix irqflags.h by moving inclusion of paravirt.h under the CONFIG_PARAVIRT umbrella. [ bp: Massage commit message. ] Fixes: 22cc5ca5de52 ("x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT") Closes: https://lore.kernel.org/oe-kbuild-all/202601152203.plJOoOEF-lkp@intel.com/ Reported-by: kernel test robot Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20260119182632.596369-2-jgross@suse.com commit f9bbd547cfb98b1c5e535aab9b0671a2ff22453a Author: Kit Dallege Date: Sun Mar 15 15:57:22 2026 +0100 crypto: add missing kernel-doc for anonymous union members Document the anonymous SKCIPHER_ALG_COMMON and COMP_ALG_COMMON struct members in skcipher_alg, scomp_alg, and acomp_alg, following the existing pattern used by HASH_ALG_COMMON in shash_alg. This fixes the following kernel-doc warnings: include/crypto/skcipher.h:166: struct member 'SKCIPHER_ALG_COMMON' not described in 'skcipher_alg' include/crypto/internal/scompress.h:39: struct member 'COMP_ALG_COMMON' not described in 'scomp_alg' include/crypto/internal/acompress.h:55: struct member 'COMP_ALG_COMMON' not described in 'acomp_alg' Signed-off-by: Kit Dallege Signed-off-by: Herbert Xu commit 7c622c4fa8b475df1977bfe3ac5d28d9da0c57fc Author: Eric Biggers Date: Sat Mar 14 14:37:20 2026 -0700 crypto: simd - Remove unused skcipher support Remove the skcipher algorithm support from crypto/simd.c. It is no longer used, and it is unlikely to gain any new user in the future, given the performance issues with this code. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit bab1adf3b87e4bfac92c4f5963c63db434d561c1 Author: Thorsten Blum Date: Sat Mar 14 20:36:29 2026 +0100 crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Unregister the hwrng to prevent new ->read() calls and flush the Atmel I2C workqueue before teardown to prevent a potential UAF if a queued callback runs while the device is being removed. Drop the early return to ensure sysfs entries are removed and ->hwrng.priv is freed, preventing a memory leak. Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit c8c4a2972f83c8b68ff03b43cecdb898939ff851 Author: Daniel Jordan Date: Fri Mar 13 11:24:33 2026 -0400 padata: Put CPU offline callback in ONLINE section to allow failure syzbot reported the following warning: DEAD callback error for CPU1 WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614 at commit 4ae12d8bd9a8 ("Merge tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux") which tglx traced to padata_cpu_dead() given it's the only sub-CPUHP_TEARDOWN_CPU callback that returns an error. Failure isn't allowed in hotplug states before CPUHP_TEARDOWN_CPU so move the CPU offline callback to the ONLINE section where failure is possible. Fixes: 894c9ef9780c ("padata: validate cpumask without removed CPU during offline") Reported-by: syzbot+123e1b70473ce213f3af@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69af0a05.050a0220.310d8.002f.GAE@google.com/ Debugged-by: Thomas Gleixner Signed-off-by: Daniel Jordan Signed-off-by: Herbert Xu commit 7fc31dd86415fc04c71b8fd4743ad63183e8565f Author: Sun Chaobo Date: Fri Mar 13 22:52:57 2026 +0800 crypto: Fix several spelling mistakes in comments Fix several typos in comments and messages. No functional change. Signed-off-by: Sun Chaobo Signed-off-by: Herbert Xu commit b44c7129f1e3cd0e6233c7cb2d88f917d92f213d Author: Zongyu Wu Date: Fri Mar 13 17:40:39 2026 +0800 crypto: hisilicon - add device load query functionality to debugfs The accelerator device supports usage statistics. This patch enables obtaining the accelerator's usage through the "dev_usage" file. The returned number expressed as a percentage as a percentage. Signed-off-by: Zongyu Wu Signed-off-by: Herbert Xu commit 3414c809777e37855063347f5fbd23ff03e1c9fb Author: Randy Dunlap Date: Wed Mar 11 22:13:23 2026 -0700 hwrng: core - avoid kernel-doc warnings Mark internal fields as "private:" so that kernel-doc comments are not needed for them, eliminating kernel-doc warnings: Warning: include/linux/hw_random.h:54 struct member 'list' not described in 'hwrng' Warning: include/linux/hw_random.h:54 struct member 'ref' not described in 'hwrng' Warning: include/linux/hw_random.h:54 struct member 'cleanup_work' not described in 'hwrng' Warning: include/linux/hw_random.h:54 struct member 'cleanup_done' not described in 'hwrng' Warning: include/linux/hw_random.h:54 struct member 'dying' not described in 'hwrng' Signed-off-by: Randy Dunlap Signed-off-by: Herbert Xu commit 344e6a4f7ff4756b9b3f75e0eb7eaec297e35540 Author: Thorsten Blum Date: Wed Mar 11 16:56:49 2026 +0100 crypto: nx - fix context leak in nx842_crypto_free_ctx Since the scomp conversion, nx842_crypto_alloc_ctx() allocates the context separately, but nx842_crypto_free_ctx() never releases it. Add the missing kfree(ctx) to nx842_crypto_free_ctx(), and reuse nx842_crypto_free_ctx() in the allocation error path. Fixes: 980b5705f4e7 ("crypto: nx - Migrate to scomp API") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum Reviewed-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c Author: Thorsten Blum Date: Wed Mar 11 16:56:47 2026 +0100 crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx The bounce buffers are allocated with __get_free_pages() using BOUNCE_BUFFER_ORDER (order 2 = 4 pages), but both the allocation error path and nx842_crypto_free_ctx() release the buffers with free_page(). Use free_pages() with the matching order instead. Fixes: ed70b479c2c0 ("crypto: nx - add hardware 842 crypto comp alg") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 57a13941c0bb06ae24e3b34672d7b6f2172b253f Author: Thorsten Blum Date: Wed Mar 11 12:39:28 2026 +0100 crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs Ensure the device supports XTS and GCM with 'has_xts' and 'has_gcm' before unregistering algorithms when XTS or authenc registration fails, which would trigger a WARN in crypto_unregister_alg(). Currently, with the capabilities defined in atmel_aes_get_cap(), this bug cannot happen because all devices that support XTS and authenc also support GCM, but the error handling should still be correct regardless of hardware capabilities. Fixes: d52db5188a87 ("crypto: atmel-aes - add support to the XTS mode") Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 464da0bf19fd0fdf4a6594ce2d3352bc5c3e676d Author: George Abraham P Date: Wed Mar 11 13:52:45 2026 +0530 crypto: qat - add wireless mode support for QAT GEN6 Add wireless mode support for QAT GEN6 devices. When the WCP_WAT fuse bit is clear, the device operates in wireless cipher mode (wcy_mode). In this mode all accelerator engines load the wireless firmware and service configuration via 'cfg_services' sysfs attribute is restricted to 'sym' only. The get_accel_cap() function is extended to report wireless-specific capabilities (ZUC, ZUC-256, 5G, extended algorithm chaining) gated by their respective slice-disable fuse bits. The set_ssm_wdtimer() function is updated to configure WCP (wireless cipher) and WAT (wireless authentication) watchdog timers. The adf_gen6_cfg_dev_init() function is updated to use adf_6xxx_is_wcy() to enforce sym-only service selection for WCY devices during initialization. Co-developed-by: Aviraj Cj Signed-off-by: Aviraj Cj Signed-off-by: George Abraham P Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 3fcfff4ed35f963380a68741bcd52742baff7f76 Author: Thorsten Blum Date: Wed Mar 11 03:07:35 2026 +0100 crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup atmel_aes_buff_init() allocates 4 pages using __get_free_pages() with ATMEL_AES_BUFFER_ORDER, but atmel_aes_buff_cleanup() frees only the first page using free_page(), leaking the remaining 3 pages. Use free_pages() with ATMEL_AES_BUFFER_ORDER to fix the memory leak. Fixes: bbe628ed897d ("crypto: atmel-aes - improve performances of data transfer") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 2aeec9af775fb53aa086419b953302c6f4ad4984 Author: Herbert Xu Date: Tue Mar 10 18:28:29 2026 +0900 crypto: tegra - Disable softirqs before finalizing request Softirqs must be disabled when calling the finalization fucntion on a request. Reported-by: Guangwu Zhang Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver") Signed-off-by: Herbert Xu commit 326118443ec3de85708a2678dcc2c14eea417228 Author: Thorsten Blum Date: Mon Mar 9 22:11:21 2026 +0100 crypto: artpec6 - use memcpy_and_pad to simplify prepare_hash Use memcpy_and_pad() instead of memcpy() followed by memset() to simplify artpec6_crypto_prepare_hash(). Also fix a duplicate word in a comment and remove a now-redundant one. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 52e4324935be917f8f3267354b3cc06bb8ffcec1 Author: FengWei Shih Date: Thu Mar 19 13:33:51 2026 +0800 md/raid5: skip 2-failure compute when other disk is R5_LOCKED When skip_copy is enabled on a doubly-degraded RAID6, a device that is being written to will be in R5_LOCKED state with R5_UPTODATE cleared. If a new read triggers fetch_block() while the write is still in flight, the 2-failure compute path may select this locked device as a compute target because it is not R5_UPTODATE. Because skip_copy makes the device page point directly to the bio page, reconstructing data into it might be risky. Also, since the compute marks the device R5_UPTODATE, it triggers WARN_ON in ops_run_io() which checks that R5_SkipCopy and R5_UPTODATE are not both set. This can be reproduced by running small-range concurrent read/write on a doubly-degraded RAID6 with skip_copy enabled, for example: mdadm -C /dev/md0 -l6 -n6 -R -f /dev/loop[0-3] missing missing echo 1 > /sys/block/md0/md/skip_copy fio --filename=/dev/md0 --rw=randrw --bs=4k --numjobs=8 \ --iodepth=32 --size=4M --runtime=30 --time_based --direct=1 Fix by checking R5_LOCKED before proceeding with the compute. The compute will be retried once the lock is cleared on IO completion. Signed-off-by: FengWei Shih Reviewed-by: Yu Kuai Link: https://lore.kernel.org/linux-raid/20260319053351.3676794-1-dannyshih@synology.com/ Signed-off-by: Yu Kuai commit 8ab1fc9104158045f68fde2d0ae16f5fbcf8bfbd Author: Andy Shevchenko Date: Fri Mar 20 23:06:44 2026 +0100 pwm: jz4740: Drop unused include This driver includes the legacy header but does not use any symbols from it. Drop the inclusion. Signed-off-by: Andy Shevchenko Acked-by: Paul Cercueil Link: https://patch.msgid.link/20260320220644.3237290-1-andriy.shevchenko@linux.intel.com Signed-off-by: Uwe Kleine-König commit 6849c6356bc314f40328d67f8a8fc8e207b28c29 Author: Antoniu Miclaus Date: Fri Mar 13 13:57:44 2026 +0200 iio: frequency: ad9523: use dev_err_probe Use dev_err_probe() instead of dev_err() in the probe path to ensure proper handling of deferred probing and to simplify error handling. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 9582a65eda4f566df9dc329e70f8be48260a9c9d Author: Antoniu Miclaus Date: Fri Mar 13 13:57:43 2026 +0200 iio: frequency: ad9523: add dev variable Introduce a local struct device variable in ad9523_probe() to simplify subsequent conversions and improve code readability. Split pdata declaration and assignment since the result is validated immediately after. No functional change. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 7428168fe1615423685fa61e4d38bd2e20f14ebd Author: Antoniu Miclaus Date: Fri Mar 13 13:57:42 2026 +0200 iio: frequency: admv4420: use dev_err_probe Use dev_err_probe() instead of dev_err() in the probe path to ensure proper handling of deferred probing and to simplify error handling. Also fix the format specifier for vco_freq_hz from %lld to %llu since it is u64 (unsigned), and add missing newline to the error message. Reviewed-by: Andy Shevchenko Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit e81f3889c2e29351d67d779b6731bbbc602b5d5f Author: Antoniu Miclaus Date: Fri Mar 13 13:57:41 2026 +0200 iio: frequency: admv4420: add dev variable Introduce a local struct device variable in admv4420_probe() to simplify subsequent conversions and improve code readability. No functional change. Reviewed-by: Andy Shevchenko Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit b37cce0bac85535d62ad0d1b235bd11a3c06ffdc Author: Giorgi Tchankvetadze Date: Sat Mar 14 15:12:53 2026 +0400 iio: adc: ad_sigma_delta: Format block comments Format the multi-line comment in ad_sd_set_comm() according to the kernel multi-line comment style. Suggested-by: Andy Shevchenko Signed-off-by: Giorgi Tchankvetadze Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 7806c060cceb2d6895efbb6cff2f2f17cf1ec5de Author: David Lechner Date: Sat Mar 14 16:12:24 2026 -0500 iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Use iio_push_to_buffers_with_ts_unaligned() to avoid unaligned access when writing the timestamp in the rx_buf. The previous implementation would have been fine on architectures that support 4-byte alignment of 64-bit integers but could cause issues on architectures that require 8-byte alignment. Fixes: 902c4b2446d4 ("iio: adc: New driver for TI ADS7950 chips") Signed-off-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit 61bc8460815956d57f3f7785e9adcdf8f1e62413 Merge: f4706504e2c825 ceebdeec6e8c6c Author: Alexei Starovoitov Date: Sat Mar 21 13:17:14 2026 -0700 Merge branch 'libbpf-add-bpf_program__clone-for-individual-program-loading' Mykyta Yatsenko says: ==================== libbpf: Add bpf_program__clone() for individual program loading This series adds bpf_program__clone() to libbpf and converts veristat to use it, replacing the costly per-program object re-opening pattern. veristat needs to load each BPF program in isolation to collect per-program verification statistics. Previously it achieved this by opening a fresh bpf_object for every program, disabling autoload on all but the target, and loading the whole object. For object files with many programs this meant repeating ELF parsing and BTF processing N times. Patch 1 introduces bpf_program__clone(), which loads a single program from a prepared object into the kernel and returns an fd owned by the caller. It populates load parameters from the prepared object and lets callers override any field via bpf_prog_load_opts. Fields written by the prog_prepare_load_fn callback (expected_attach_type, attach_btf_id, attach_btf_obj_fd) are seeded from prog/obj defaults before the callback, then overridden with caller opts after, so explicit values always win. Patch 2 converts veristat to prepare the object once and clone each program individually, eliminating redundant work. Patch 3 adds a selftest verifying that caller-provided attach_btf_id overrides are respected by bpf_program__clone(). Performance Tested on selftests: 918 objects, ~4270 programs: - Wall time: 36.88s -> 23.18s (37% faster) - User time: 20.80s -> 16.07s (23% faster) - Kernel time: 12.07s -> 6.06s (50% faster) Per-program loading also improves coverage: 83 programs that previously failed now succeed. Known regression: - Program-containing maps (PROG_ARRAY, DEVMAP, CPUMAP) track owner program type. Programs with incompatible attributes loaded against a shared map will be rejected. This is expected kernel behavior. Signed-off-by: Mykyta Yatsenko --- Changes in v5: - Fix overriding of the attach_btf_id, attach_btf_fd, etc: the override provided by the caller is applied after prog_prepare_load_fn(). - Added selftest to verify attach_btf_id override works as expected. - Link to v4: https://lore.kernel.org/all/20260316-veristat_prepare-v3-0-94e5691e0494@meta.com/ Changes in v4: - Replace OPTS_SET() with direct struct assignment for local bpf_prog_load_opts in bpf_program__clone() (libbpf.c) - Remove unnecessary pattr pointer indirection (libbpf.c) - Separate input and output fields in bpf_program__clone(): input fields (prog_flags, fd_array, etc.) are merged from caller opts before the callback; output fields (expected_attach_type, attach_btf_id, attach_btf_obj_fd) are initialized from prog/obj defaults for the callback, then overridden with caller opts after, so explicit caller values always win (libbpf.c) - Add selftest for attach_btf_id override - Link to v3: https://lore.kernel.org/r/20260206-veristat_prepare-a4a041873c53-v3@meta.com Changes in v3: - Clone fd_array_cnt in bpf_object__clone() - In veristat do not fail if bpf_object__prepare() fails, continue per-program processing to produce per program output - Link to v2: https://lore.kernel.org/r/20260220-veristat_prepare-v2-0-15bff49022a7@meta.com Changes in v2: - Removed map cloning entirely (libbpf.c) - Renamed bpf_prog_clone() -> bpf_program__clone() - Removed unnecessary obj NULL check (libbpf.c) - Fixed opts handling — no longer mutates caller's opts (libbpf.c) - Link to v1: https://lore.kernel.org/all/20260212-veristat_prepare-v1-0-c351023fb0db@meta.com/ --- ==================== Link: https://patch.msgid.link/20260317-veristat_prepare-v4-0-74193d4cc9d9@meta.com Signed-off-by: Alexei Starovoitov commit ceebdeec6e8c6c879260a7293ac66c08eb185d43 Author: Mykyta Yatsenko Date: Tue Mar 17 10:39:23 2026 -0700 selftests/bpf: Test bpf_program__clone() attach_btf_id override Add a test that verifies bpf_program__clone() respects caller-provided attach_btf_id in bpf_prog_load_opts. The BPF program has SEC("fentry/bpf_fentry_test1"). It is cloned twice from the same prepared object: first with no opts, verifying the callback resolves attach_btf_id from sec_name to bpf_fentry_test1; then with attach_btf_id overridden to bpf_fentry_test2, verifying the loaded program is actually attached to bpf_fentry_test2. Both results are checked via bpf_prog_get_info_by_fd(). Signed-off-by: Mykyta Yatsenko Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260317-veristat_prepare-v4-3-74193d4cc9d9@meta.com Signed-off-by: Alexei Starovoitov commit 3be706b937f3d4cf1b0236561eb23d064e833253 Author: Mykyta Yatsenko Date: Tue Mar 17 10:39:22 2026 -0700 selftests/bpf: Use bpf_program__clone() in veristat Replace veristat's per-program object re-opening with bpf_program__clone(). Previously, veristat opened a separate bpf_object for every program in a multi-program object file, iterated all programs to enable only the target one, and then loaded the entire object. Use bpf_object__prepare() once, then call bpf_program__clone() for each program individually. This lets veristat load programs one at a time from a single prepared object. The caller now owns the returned fd and closes it after collecting stats. Remove the special single-program fast path and the per-file early exit in handle_verif_mode() so all files are always processed. Split fixup_obj() into fixup_obj_maps() for object-wide map fixups that must run before bpf_object__prepare(), and fixup_obj() for per-program fixups (struct_ops masking, freplace type guessing) that run before each bpf_program__clone() call. Reviewed-by: Emil Tsalapatis Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260317-veristat_prepare-v4-2-74193d4cc9d9@meta.com Signed-off-by: Alexei Starovoitov commit 970bd2dced35632ce1c9e38943354d5389d80ca0 Author: Mykyta Yatsenko Date: Tue Mar 17 10:39:21 2026 -0700 libbpf: Introduce bpf_program__clone() Add bpf_program__clone() API that loads a single BPF program from a prepared BPF object into the kernel, returning a file descriptor owned by the caller. After bpf_object__prepare(), callers can use bpf_program__clone() to load individual programs with custom bpf_prog_load_opts, instead of loading all programs at once via bpf_object__load(). Non-zero fields in opts override the defaults derived from the program and object internals; passing NULL opts populates everything automatically. Signed-off-by: Mykyta Yatsenko Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260317-veristat_prepare-v4-1-74193d4cc9d9@meta.com Signed-off-by: Alexei Starovoitov commit f4706504e2c82523af7f12059940121c09d8d6bd Author: Tiezhu Yang Date: Tue Mar 10 14:45:07 2026 +0800 selftests/bpf: Add alignment flag for test_verifier 190 testcase There exists failure when executing the testcase "./test_verifier 190" if CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set on LoongArch. #190/p calls: two calls that return map_value with incorrect bool check FAIL ... misaligned access off (0x0; 0xffffffffffffffff)+0 size 8 ... Summary: 0 PASSED, 0 SKIPPED, 1 FAILED It means that the program has unaligned accesses, but the kernel sets CONFIG_ARCH_STRICT_ALIGN by default to enable -mstrict-align to prevent unaligned accesses, so add a flag F_NEEDS_EFFICIENT_UNALIGNED_ACCESS into the testcase to avoid the failure. This is somehow similar with the commit ce1f289f541e ("selftests/bpf: Add F_NEEDS_EFFICIENT_UNALIGNED_ACCESS to some tests"). Signed-off-by: Tiezhu Yang Reviewed-by: Emil Tsalapatis Acked-by: Paul Chaignon Link: https://lore.kernel.org/r/20260310064507.4228-3-yangtiezhu@loongson.cn Signed-off-by: Alexei Starovoitov commit 1ac30f58f0336287203109872f71a81d4bb271db Author: Sanjay Chitroda Date: Sun Mar 15 17:46:25 2026 +0530 iio: st_sensors: drop temporary kmalloc buffer and reuse buffer_data Replace the per-call kmalloc() scratch buffer with the existing buffer_data[] field present in struct st_sensor_data. The existing buffer is DMA-aligned and sufficiently sized for all channel widths, so using it avoids unnecessary dynamic memory allocation on each read. This simplifies the code, removes redundant allocation and cleanup. No functional change intended. Signed-off-by: Sanjay Chitroda Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit 21337b58f596155062cd02f38db3726c5b5c7ec6 Merge: 4b21ea5024830f a2542a91aafd5f Author: Alexei Starovoitov Date: Sat Mar 21 13:09:35 2026 -0700 Merge branch 'bpf-consolidate-sleepable-context-checks-in-verifier' Puranjay Mohan says: ==================== bpf: Consolidate sleepable context checks in verifier The BPF verifier has multiple call-checking functions that independently validate whether sleepable operations are permitted in the current context. Each function open-codes its own checks against active_rcu_locks, active_preempt_locks, active_irq_id, and in_sleepable, duplicating the logic already provided by in_sleepable_context(). This series consolidates these scattered checks into calls to in_sleepable_context() across check_helper_call(), check_kfunc_call(), and check_func_call(), reducing code duplication and making the error reporting consistent. No functional change. ==================== Link: https://patch.msgid.link/20260318174327.3151925-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit a2542a91aafd5fcf20cd804cd14c9de52cfc397e Author: Puranjay Mohan Date: Wed Mar 18 10:43:26 2026 -0700 bpf: Consolidate sleepable checks in check_func_call() The sleepable context check for global function calls in check_func_call() open-codes the same checks that in_sleepable_context() already performs. Replace the open-coded check with a call to in_sleepable_context() and use non_sleepable_context_description() for the error message, consistent with check_helper_call() and check_kfunc_call(). Note that in_sleepable_context() also checks active_locks, which overlaps with the existing active_locks check above it. However, the two checks serve different purposes: the active_locks check rejects all global function calls while holding a lock (not just sleepable ones), so it must remain as a separate guard. Update the expected error messages in the irq and preempt_lock selftests to match. Acked-by: Eduard Zingerman Signed-off-by: Puranjay Mohan Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260318174327.3151925-4-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit cd9840c413e3280d1c944e2e7e67380bc9a862d1 Author: Puranjay Mohan Date: Wed Mar 18 10:43:25 2026 -0700 bpf: Consolidate sleepable checks in check_kfunc_call() check_kfunc_call() has multiple scattered checks that reject sleepable kfuncs in various non-sleepable contexts (RCU, preempt-disabled, IRQ- disabled). These are the same conditions already checked by in_sleepable_context(), so replace them with a single consolidated check. This also simplifies the preempt lock tracking by flattening the nested if/else structure into a linear chain: preempt_disable increments, preempt_enable checks for underflow and decrements. The sleepable check is kept as a separate block since it is logically distinct from the lock accounting. No functional change since in_sleepable_context() checks all the same state (active_rcu_locks, active_preempt_locks, active_locks, active_irq_id, in_sleepable). Acked-by: Eduard Zingerman Acked-by: Mykyta Yatsenko Signed-off-by: Puranjay Mohan Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260318174327.3151925-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit a0d06cf102e4f088781b7df6f20ce8ef694e1deb Author: Puranjay Mohan Date: Wed Mar 18 10:43:24 2026 -0700 bpf: Consolidate sleepable checks in check_helper_call() check_helper_call() prints the error message for every env->cur_state->active* element when calling a sleepable helper. Consolidate all of them into a single print statement. The check for env->cur_state->active_locks was not part of the removed print statements and will not be triggered with the consolidated print as well because it is checked in do_check() before check_helper_call() is even reached. Acked-by: Mykyta Yatsenko Acked-by: Eduard Zingerman Signed-off-by: Puranjay Mohan Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260318174327.3151925-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 733bcf18eab0cbcea7b1a85c967dc100945fffc3 Author: Chuang Zhu Date: Mon Mar 16 02:23:04 2026 +0800 iio: adc: ina2xx: add INA236 support The calibration divisor is not directly specified in the datasheet, but can be calculated: I = Current_LSB * Current Current = ShuntVoltage * CAL / calibration_divisor CAL = 0.00512 / (Current_LSB * Rshunt) ShuntVoltage = Vshunt / ShuntVoltage_LSB => I = (0.00512 / (calibration_divisor*ShuntVoltage_LSB)) * (Vshunt / Rshunt) Ohm's law, I = Vshunt / Rshunt => 0.00512 / (calibration_divisor*ShuntVoltage_LSB) = 1 ShuntVoltage_LSB = 2.5 uV = 0.0000025 V => calibration_divisor = 2048 Signed-off-by: Chuang Zhu Signed-off-by: Jonathan Cameron commit 54dde4b1ed85a60ce1bcd10cc6783b9a33ea78e3 Author: David Lechner Date: Sun Mar 15 14:21:51 2026 -0500 iio: light: as73211: remove duplicate zero init of scan.chan[3] Remove setting scan.chan[3] to zero. Since commit 433b99e92294 ("iio: light: as73211: Ensure buffer holes are zeroed"), the entire scan struct is zeroed before being filled with data, so this is redundant. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 88d699da8ab6ead396809006c65d07b13b19907c Author: Shi Hao Date: Mon Mar 16 14:30:22 2026 +0530 iio: amplifiers: fix typo from Curren to Current Fix incorrect spelling from Curren to Current. Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit 1011a6bd86bc79dcadab04f3326868e62613484a Author: Shi Hao Date: Mon Mar 16 14:30:21 2026 +0530 iio: cdc: fix spelling mistakes in comments Fix spelling mistakes in comments. - becaue -> because - reenable -> re-enable - irq's -> IRQs Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit 1a18c847c89ce4b301a5870b0feafd931b076005 Author: Shi Hao Date: Mon Mar 16 14:30:20 2026 +0530 iio: chemical: rephrase comment and fix a typo Rephrase the comment and fix a spelling mistake. - insuffient -> insufficient Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit 96f46405219d9bf62d9fab76e055e3b6059b0bd5 Author: Shi Hao Date: Mon Mar 16 14:30:19 2026 +0530 iio: common: fix spelling mistakes in comments Fix spelling mistakes in comments. - exepects -> expects - fuction -> function - theoritical -> theoretical - appopriate -> appropriate - iio -> IIO Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit 5088fc744837eaba3f7a1c374cf9457a4ddbd87e Author: Shi Hao Date: Mon Mar 16 14:30:18 2026 +0530 iio: test: fix typo from neeeds to needs in comment Fix incorrect spelling from neeeds to needs. Signed-off-by: Shi Hao Reviewed-by: Matti Vaittinen Signed-off-by: Jonathan Cameron commit abf88d037b1bbdc76dec4248e09f7a3f71aae832 Author: Shi Hao Date: Mon Mar 16 14:30:17 2026 +0530 iio: temp: fix spelling mistakes in comments Fix spelling mistakes in comments. - catched -> caught - chanel -> channel Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit 6675af9c1a3251ff95ef1290f9317ba0e83ce99d Author: Thadeu Lima de Souza Cascardo Date: Thu Mar 19 18:22:42 2026 -0300 cgroup/dmem: remove region parameter from dmemcg_parse_limit dmemcg_parse_limit does not use the region parameter. Remove it. Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Tejun Heo commit 761451473febd7777034720b85ba2bbb2c73ec89 Author: Shi Hao Date: Mon Mar 16 14:30:16 2026 +0530 iio: resolver: fix typo from degredation to degradation Fix incorrect spelling from degredation to degradation and fixed up some missing spaces prior to */ Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit 22dd6499c1a67fd3fdb73a7b2e57bc90a464987c Author: Shi Hao Date: Mon Mar 16 14:30:15 2026 +0530 iio: proximity: fix typo from currenly to currently Fix incorrect spelling from currenly to currently. Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit 896b6508acdfa052dfdf91460ee1b2d565d23010 Author: Shi Hao Date: Mon Mar 16 14:30:14 2026 +0530 iio: pressure: fix spelling mistakes in comments Fix several spelling mistakes in comments. - opertion -> operations - transfered -> transferred - usng -> using - externaly -> externally Signed-off-by: Shi Hao Reviewed-by: Matti Vaittinen Signed-off-by: Jonathan Cameron commit 2354338cc8136fd4e77b92807cf5e0ad89c82e3d Author: Shi Hao Date: Mon Mar 16 14:30:13 2026 +0530 iio: magnetometer: fix various spelling mistakes Fix spelling mistakes in comments. - follwing -> following - atleast -> at least - occured -> occurred - measurment -> measurement - rougly -> roughly Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit d5036cd38aef10a59a08c10baf71a92efdd2d485 Author: Shi Hao Date: Mon Mar 16 14:30:12 2026 +0530 iio: imu: fix typo from adjustement to adjustment Fix incorrect spelling in a comment. - adjustement -> adjustment Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit a27bace4d5432bc5099a0f657119bebe60c5022a Author: Shi Hao Date: Mon Mar 16 14:30:11 2026 +0530 iio: adc: add an article and use digitize instead of digitalize Use digitize instead of digitalize, which is the correct technical term, and add an article for clarity. Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit 0dcaf3db244802283a268bb93b38a7683e476b2a Author: Shi Hao Date: Mon Mar 16 14:30:10 2026 +0530 iio: light: fix several incorrect spellings Fix spelling mistakes reported by codespell. - sesnor -> sensor - substraction -> subtraction - simulataneous -> simultaneous - proccessed -> processed - coefficents -> coefficients Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit db0da4b7f688a76951acc38870f71e673f8fcad0 Author: Shi Hao Date: Mon Mar 16 14:30:09 2026 +0530 iio: accel: fix typo celcius to Celsius Fix incorrect spelling in comments - celcius -> Celsius Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron commit 068014daad8d07bc11b24c223bc2d2c331b458bd Author: Ke Zhao Date: Wed Mar 18 16:53:49 2026 +0800 tools/sched_ext: Update stale scx_ops_error() comment in fcg_cgroup_move() The function scx_ops_error() was dropped, but the comment here is left pointing to the old name. Update to be consistent with current API. Signed-off-by: Ke Zhao Signed-off-by: Tejun Heo commit 818dbedd043e94f270403c795fe7856bfa61e013 Author: zhidao su Date: Thu Mar 19 13:30:26 2026 +0800 selftests/sched_ext: Return non-zero exit code on test failure runner.c always returned 0 regardless of test results. The kselftest framework (tools/testing/selftests/kselftest/runner.sh) invokes the runner binary and treats a non-zero exit code as a test failure; with the old code, failed sched_ext tests were silently hidden from the parent harness even though individual "not ok" TAP lines were emitted. Return 1 when at least one test failed, 0 when all tests passed or were skipped. Signed-off-by: zhidao su Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 7e226f036a71c032cd1eb985dd02bc8314e69adf Author: zhidao su Date: Thu Mar 19 13:30:25 2026 +0800 sched_ext: Documentation: Document events sysfs file and module parameters Two categories of sched_ext diagnostics are currently undocumented: 1. Per-scheduler events sysfs file Each active BPF scheduler exposes a set of diagnostic counters at /sys/kernel/sched_ext//events. These counters are defined (with detailed comments) in kernel/sched/ext_internal.h but have no corresponding documentation in sched-ext.rst. BPF scheduler developers must read kernel source to understand what each counter means. Add a description of the events file, an example of its output, and a brief explanation of every counter. 2. Module parameters kernel/sched/ext.c registers two parameters under the sched_ext. prefix (slice_bypass_us, bypass_lb_intv_us) via module_param_cb() with MODULE_PARM_DESC() strings, but sched-ext.rst makes no mention of them. Users who need to tune bypass-mode behavior have no in-tree documentation to consult. Add a "Module Parameters" section documenting both knobs: their default values, valid ranges (taken from the set_*() validators in ext.c), and the note from the source that they are primarily for debugging. No functional changes. Signed-off-by: zhidao su Signed-off-by: Tejun Heo commit 2197cecdb02c57b08340059452540fcf101fa30d Author: Andrea Righi Date: Fri Mar 20 18:28:31 2026 +0100 sched_ext: idle: Prioritize idle SMT sibling In the default built-in idle CPU selection policy, when @prev_cpu is busy and no fully idle core is available, try to place the task on its SMT sibling if that sibling is idle, before searching any other idle CPU in the same LLC. Migration to the sibling is cheap and keeps the task on the same core, preserving L1 cache and reducing wakeup latency. On large SMT systems this appears to consistently boost throughput by roughly 2-3% on CPU-bound workloads (running a number of tasks equal to the number of SMT cores). Cc: Cheng-Yang Chou Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 58b98c66e6b0e7bcd0799105dadad263a826d425 Author: Billy Tsai Date: Fri Mar 20 13:46:38 2026 +0800 iio: adc: aspeed: Reserve battery sensing channel for on-demand use For controllers with battery sensing capability (AST2600/AST2700), the last channel uses a different circuit design optimized for battery voltage measurement. This channel should not be enabled by default along with other channels to avoid potential interference and power efficiency issues. This ensures optimal power efficiency for normal ADC operations while maintaining full functionality when battery sensing is needed. Signed-off-by: Billy Tsai Signed-off-by: Jonathan Cameron commit 66ab53c286989634acaa2c4a5703c0f647cb9aa3 Author: Billy Tsai Date: Fri Mar 20 13:46:37 2026 +0800 iio: adc: aspeed: Replace mdelay() with fsleep() for ADC stabilization delay The ADC stabilization delays in compensation mode and battery sensing mode do not require atomic context. Using mdelay() here results in unnecessary busy waiting. Replace mdelay(1) with fsleep(1000) to allow the scheduler to run other tasks while waiting for the ADC to stabilize. Also fix a minor typo in the comment ("adc" -> "ADC"). Signed-off-by: Billy Tsai Signed-off-by: Jonathan Cameron commit 9ee1c3be164de16bab382197202ddef8ae020433 Author: Billy Tsai Date: Fri Mar 20 13:46:36 2026 +0800 iio: adc: Enable multiple consecutive channels based on model data Add helpers to generate channel masks and enable multiple ADC channels according to the device model's channel count. Signed-off-by: Billy Tsai Signed-off-by: Jonathan Cameron commit a28069be7d34597159840c4a0dfd3886787455db Author: Billy Tsai Date: Fri Mar 20 13:46:35 2026 +0800 iio: adc: Add battery channel definition for ADC Defines a constant for the battery sensing channel, typically the last channel of the ADC. Clarifies channel usage and improves code readability. Signed-off-by: Billy Tsai Signed-off-by: Jonathan Cameron commit e163b094917b122467b0498491c137c9e754e70f Author: David Marinovic Date: Fri Mar 20 16:09:48 2026 +0100 iio: dac: ltc2632: add support for LTC2654 DAC family Add support for the Linear Technology LTC2654 quad DAC family. The LTC2654 is a 4-channel, 16-/12-bit DAC with SPI interface, sharing the same 24-bit SPI protocol as the existing LTC2632/ LTC2634/LTC2636 devices supported by this driver. The 12-bit variants of LTC2654 reuse existing LTC2634 chip_info structs as they are register-compatible. Add support for the following variants: - LTC2654L-16: 16-bit, 2.5V internal reference - LTC2654L-12: 12-bit, 2.5V internal reference - LTC2654H-16: 16-bit, 4.096V internal reference - LTC2654H-12: 12-bit, 4.096V internal reference Signed-off-by: David Marinovic Signed-off-by: Jonathan Cameron commit 9e5e2c58da138409c3a5f2a4bc430beb16cdd878 Author: David Marinovic Date: Fri Mar 20 16:09:47 2026 +0100 dt-bindings: iio: dac: ltc2632: add LTC2654 compatible strings Add compatible strings for the LTC2654 quad-channel DAC family. The LTC2654 devices are 4-channel, 16-/12-bit DACs with an internal reference and SPI interface. They use the same 24-bit SPI command format as the LTC2632/2634/2636 family. The 16-bit variants (LTC2654-L16 and LTC2654-H16) require new compatible strings, as no existing compatibles support 16-bit resolution. The 12-bit variants (LTC2654-L12 and LTC2654-H12) are register- compatible with LTC2634-L12 and LTC2634-H12 respectively, and can use them as fallback compatibles. Signed-off-by: David Marinovic Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit 19045d89e4f4754349b1256650729ae08bde14ed Author: David Marinovic Date: Fri Mar 20 16:09:46 2026 +0100 iio: dac: ltc2632: drop enum and use individual chip_info objects Remove the ltc2632_chip_info_tbl[] array and related ltc2632_supported_device_ids enum used for looking up chip-specific information. Instead, use separate static const struct ltc2632_chip_info objects for each supported chip variant. Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: David Marinovic Signed-off-by: Jonathan Cameron commit c2d466b9fe1913f8dbe2701156c38719c94188f7 Author: Kees Cook Date: Fri Mar 20 17:48:44 2026 -0700 block: partitions: Replace pp_buf with struct seq_buf In preparation for removing the strlcat API[1], replace the char *pp_buf with a struct seq_buf, which tracks the current write position and remaining space internally. This allows for: - Direct use of seq_buf_printf() in place of snprintf()+strlcat() pairs, eliminating local tmp buffers throughout. - Adjacent strlcat() calls that build strings piece-by-piece (e.g., strlcat("["); strlcat(name); strlcat("]")) to be collapsed into single seq_buf_printf() calls. - Simpler call sites: seq_buf_puts() takes only the buffer and string, with no need to pass PAGE_SIZE at every call. The backing buffer allocation is unchanged (__get_free_page), and the output path uses seq_buf_str() to NUL-terminate before passing to printk(). Link: https://github.com/KSPP/linux/issues/370 [1] Cc: Andy Shevchenko Cc: Josh Law Signed-off-by: Kees Cook Reviewed-by: Josh Law Link: https://patch.msgid.link/20260321004840.work.670-kees@kernel.org Signed-off-by: Jens Axboe commit f761e0deb4d9ec9d485b9d353aba1a344bc57689 Author: Koichiro Den Date: Wed Feb 11 01:03:15 2026 +0900 PCI: dwc: rcar-gen4: Mark BAR0 and BAR2 as Resizable BARs in endpoint mode R-Car Gen4 (S4) endpoint controller implements the PCIe Resizable BAR capability for BAR0 and BAR2. Advertise them as BAR_RESIZABLE so that EPF requested BAR sizes are reflected to the host. Signed-off-by: Koichiro Den [commit log] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260210160315.2272930-1-den@valinux.co.jp commit cbf8db23fc58db8d516ebc7aa57c4563f36532b9 Author: Cosmin Tanislav Date: Wed Feb 4 20:00:32 2026 +0200 counter: sysfs: remove double return in counter_sysfs_attr_add() sysfs attribute creation for counter extensions has been consolidated into a single function, counter_sysfs_exts_add(). Inside counter_sysfs_attr_add(), although the code was changed to return the result of counter_sysfs_exts_add(), an unreachable return 0; statement was left at the end of the function. Remove it. Fixes: bb4bbbec664f ("counter: Consolidate Counter extension sysfs attribute creation") Signed-off-by: Cosmin Tanislav Link: https://lore.kernel.org/r/20260204180032.514328-1-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: William Breathitt Gray commit 8a75ac8f0a7274085aa71aacfaa21ed72bf8435b Author: Gabriel Rondon Date: Fri Mar 20 22:24:24 2026 +0000 staging: iio: ad9834: use sysfs_emit() and simplify show functions Replace sprintf() with sysfs_emit() in sysfs attribute show functions. sysfs_emit() is the preferred API for sysfs callbacks as it is aware of the PAGE_SIZE buffer limit. Also simplify the wavetype_available show functions by removing the intermediate string variable and returning directly from each branch. Signed-off-by: Gabriel Rondon Signed-off-by: Jonathan Cameron commit f6192780807d5c2fc08f506948b19c6072e1bfe8 Author: Gabriel Rondon Date: Fri Mar 20 22:24:23 2026 +0000 staging: iio: ad5933: use sysfs_emit() in show functions Replace sprintf() with sysfs_emit() in all sysfs attribute show functions. sysfs_emit() is the preferred API for sysfs callbacks as it is aware of the PAGE_SIZE buffer limit. Also remove the unnecessary (int) cast in ad5933_show_frequency() and use the correct format specifier %llu for the unsigned long long freqreg variable. Signed-off-by: Gabriel Rondon Signed-off-by: Jonathan Cameron commit 773a5dc613ed1c9b8b2a9d614d42ac994e99aeb6 Author: Erikas Bitovtas Date: Fri Mar 20 18:45:43 2026 +0200 iio: light: vcnl4000: add support for regulators Add supply, I2C and cathode voltage regulators to the sensor and enable them. This keeps the sensor powered on even after its only supply shared by another device shuts down. Reported-by: Raymond Hackley Reviewed-by: David Lechner Signed-off-by: Erikas Bitovtas Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 5ec96d77ca28c0560e8883a0709ab63667eac19f Author: Erikas Bitovtas Date: Fri Mar 20 18:45:42 2026 +0200 iio: light: vcnl4000: remove redundant check for proximity-near-level The data->near_level variable is already assigned 0 during devm_kzalloc(), therefore checking if the property is present and then assigning it 0 is redundant. Remove the check for device tree property and let it fail silently if it is missing or invalid. Reviewed-by: David Lechner Signed-off-by: Erikas Bitovtas Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit c4380f90752b8ad469e077658f378c9f454e429c Author: Erikas Bitovtas Date: Fri Mar 20 18:45:41 2026 +0200 iio: light: vcnl4000: use variables for I2C client and device instances After moving data->client and client->dev into variables of their own, replace all instances of data->client and client->dev being used in vcnl4200_init() and vcnl4000_probe() by the said variables to reduce clutter. Reviewed-by: David Lechner Signed-off-by: Erikas Bitovtas Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit b10aecd9d59ae084bea58472010f92023efa4283 Author: Erikas Bitovtas Date: Fri Mar 20 18:45:40 2026 +0200 iio: light: vcnl4000: remove error messages for trigger and irq The error code is available in the log after return. In our case, attaching a triggered buffer can only fail if we are out of memory, as no other buffer is being attached. Remove duplicate error messages to reduce noise in dmesg. Reviewed-by: David Lechner Signed-off-by: Erikas Bitovtas Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 177fa06d8e0b497fc9aec4ae2b233877ecd61bdb Author: Erikas Bitovtas Date: Fri Mar 20 18:45:39 2026 +0200 iio: light: vcnl4000: replace mutex_init() with devm_mutex_init() Replace mutex_init() used across the driver with its device-managed counterpart, so all assigned mutexes get destroyed. Reviewed-by: David Lechner Signed-off-by: Erikas Bitovtas Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 1c9cb53572ee67d19c43191fe02eb937173ee9a7 Author: Erikas Bitovtas Date: Fri Mar 20 18:45:38 2026 +0200 iio: light: vcnl4000: move power enablement from init to probe Given both vcnl4000_init() and vcnl4200_init() end with dev->chip_spec->set_power_state(), they can be called once from the probe to enable the sensors. Move the set_power_state function from init and call it after init function in probe. Reviewed-by: David Lechner Signed-off-by: Erikas Bitovtas Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 7e1d6b37c8b560d7ecf3c6f63a8d64a585b8ec62 Author: Erikas Bitovtas Date: Fri Mar 20 18:45:37 2026 +0200 iio: light: vcnl4000: sort includes by their name Sort include headers by file name for better readability. Reviewed-by: David Lechner Signed-off-by: Erikas Bitovtas Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit d674752564bfe294f7ac53a47b03846bc02c691f Author: Erikas Bitovtas Date: Fri Mar 20 18:45:36 2026 +0200 dt-bindings: iio: light: vcnl4000: add regulators These sensors can accept 2 supplies - one for the sensor and one for IR LED [1]. Add supply properties for the sensor - 2 for the sensors and one external, for their open drain interrupt line, to ensure the sensor is powered on before proceeding with setup. [1] https://www.vishay.com/docs/84274/vcnl4040.pdf Reviewed-by: David Lechner Signed-off-by: Erikas Bitovtas Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jonathan Cameron commit ab4a4043db1fcc4fd4c5745c5be8caf053502e29 Author: Ryder Lee Date: Mon Mar 2 17:46:48 2026 -0800 PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() As reported by the W=1 warning below, content of the 'name' variable might get truncated with the existing size of 10 bytes. Though it is not practically possible to exceed the 10 bytes size, increase it to 20 to silence the warning for a clean W=1 build: $ make W=1 drivers/pci/controller/pcie-mediatek.o CALL scripts/checksyscalls.sh DESCEND objtool INSTALL libsubcmd_headers CC drivers/pci/controller/pcie-mediatek.o drivers/pci/controller/pcie-mediatek.c: In function ‘mtk_pcie_parse_port’: drivers/pci/controller/pcie-mediatek.c:963:43: error: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size 6 [-Werror=format-truncation=] 963 | snprintf(name, sizeof(name), "port%d", slot); | ^~ drivers/pci/controller/pcie-mediatek.c:963:38: note: directive argument in the range [0, 2147483647] 963 | snprintf(name, sizeof(name), "port%d", slot); | ^~~~~~~~ drivers/pci/controller/pcie-mediatek.c:963:9: note: ‘snprintf’ output between 6 and 15 bytes into a destination of size 10 963 | snprintf(name, sizeof(name), "port%d", slot); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Ryder Lee [mani: commit log] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/b835e360b42c5e0994f9301a34dbdf140a8d3ef5.1772493898.git.ryder.lee@mediatek.com commit 0dc1147b4c9d4a77e8e4942b92ebf398aff1e91d Author: Antoniu Miclaus Date: Sat Mar 21 12:01:51 2026 +0200 iio: backend: use __free(fwnode_handle) for automatic cleanup Convert __devm_iio_backend_fwnode_get() to use the __free(fwnode_handle) cleanup attribute for the fwnode_back variable, removing the need for manual fwnode_handle_put() calls. Move the declaration closer to its first use, narrowing its scope. No functional change. Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit e7ecdcbc16f049edfa32be01b34ec8dc8e3c51ce Author: Antoniu Miclaus Date: Sat Mar 21 12:04:59 2026 +0200 iio: accel: adxl372: add support for ADXL371 Add support for the Analog Devices ADXL371, a +-200g 3-axis MEMS accelerometer sharing the same register map as the ADXL372 but with different ODR values (320/640/1280/2560/5120 Hz vs 400/800/1600/3200/ 6400 Hz), different bandwidth values, and different timer scale factors for activity/inactivity detection. Due to a silicon anomaly (er001) causing FIFO data misalignment on all current ADXL371 silicon, FIFO and triggered buffer support is disabled for the ADXL371 - only direct mode reads are supported. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 39df6dbfad4ecc7ad667995e738fbe9b3b76f850 Author: Antoniu Miclaus Date: Sat Mar 21 12:04:58 2026 +0200 iio: accel: adxl372: factor out buffer and trigger setup Extract the triggered buffer, trigger allocation, and IRQ request logic from adxl372_probe() into a dedicated adxl372_buffer_setup() helper. This reduces the probe function complexity and prepares for conditionally disabling buffer support on device variants with known FIFO issues. No functional change intended. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 2643500bd2145a1c430d60273f3a6e9d28821834 Author: Antoniu Miclaus Date: Sat Mar 21 12:04:57 2026 +0200 dt-bindings: iio: accel: adi,adxl372: add ADXL371 compatible Add the adi,adxl371 compatible string to the ADXL372 binding. The ADXL371 is a +-200g 3-axis MEMS accelerometer nearly identical to the ADXL372 in register layout, differing only in ODR/bandwidth values, timer scale factors, and a silicon anomaly affecting FIFO operation. Update the title and description to reflect both devices. Acked-by: Conor Dooley Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 23d742859a2dd20b1e96ab0828fa26227c47f328 Author: Antoniu Miclaus Date: Sat Mar 21 12:04:56 2026 +0200 iio: accel: adxl372: introduce chip_info structure Introduce a chip_info structure to parameterize device-specific properties such as ODR/bandwidth frequency tables, activity/inactivity timer scale factors, and the maximum ODR value. This refactors the driver to use chip_info lookups instead of hardcoded values, preparing the driver to support multiple device variants. The sampling_frequency and filter_low_pass_3db_frequency available attributes are switched from custom sysfs callbacks to read_avail() based handling via info_mask_shared_by_type_available. This enforces consistent formatting through the IIO framework and makes the values accessible to in-kernel consumers. The SPI/I2C probe functions are updated to pass a chip_info pointer instead of a device name string. No functional change intended. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 45ffabad4b53060d420c29b1a7c6a01bcc9da695 Merge: d9ef8c91c4bba8 d7787a77cf8b12 Author: Krzysztof Kozlowski Date: Sat Mar 21 11:57:53 2026 +0100 Merge tag 'v7.1-rockchip-dts64-1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New boards: RK3576-EVB2, OneThing Edge Cube New soc-peripherals: DisplayPort on RK3576 New overlays: TSx33 device-revisions, HD702E display/touchscreen on NanoPC-T4 And as always a number of per-board changes for added or enabled peripherals, added supplies, things moved to more fitting positions. * tag 'v7.1-rockchip-dts64-1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (28 commits) arm64: dts: rockchip: enable vicap dvp on wolfvision pf5 io expander arm64: dts: rockchip: Add analog audio switches to RK3576 EVB1 arm64: dts: rockchip: Enable GPU on rk3566-pinenote arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config arm64: dts: rockchip: add pinctrl for clk-generator GPIO on rk3588-tiger arm64: dts: rockchip: use gated-fixed-clock for pcie-refclk on rk3588-tiger arm64: dts: rockchip: use gated-fixed-clock for pcie-refclk on rk3588-jaguar arm64: dts: rockchip: Enable displayport for rk3576 evb2 arm64: dts: rockchip: Add battery and charger on rk3566-pinenote arm64: dts: rockchip: Fix sdmmc pwren pinctrl for rk3576-evb2 arm64: dts: rockchip: Describe HDMI supplies for nanopi4 boards arm64: dts: rockchip: Clean up NanoPi-R2S Plus gmac2io arm64: dts: rockchip: add pwm-fan for NanoPC-T6 arm64: dts: rockchip: Add rk3576 evb2 board dt-bindings: arm: rockchip: Add rk3576 evb2 board arm64: dts: rockchip: Add overlay for FriendlyElec HD702E arm64: dts: rockchip: Move RK3399 eDP pinctrl to boards arm64: dts: rockchip: add overlay for qnap-ts133 device revision arm64: dts: rockchip: add overlay for qnap-ts233 device revision arm64: dts: rockchip: add overlay for qnap-ts433 device revision ... Signed-off-by: Krzysztof Kozlowski commit d1895c15fc7d90a615bc8c455feb02acaf08ef1e Author: Thomas Weißschuh Date: Wed Mar 18 22:03:26 2026 +0100 x86/um: fix vDSO installation The generic vDSO installation logic used by 'make vdso_install' requires that $(vdso-install-y) is defined by the top-level architecture Makefile and that it contains a path relative to the root of the tree. For UML neither of these is satisfied. Move the definition of $(vdso-install-y) to a place which is included by the arch/um/Makefile and use the full relative path. Fixes: f1c2bb8b9964 ("um: implement a x86_64 vDSO") Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260318-um-vdso-install-v1-1-26a4ca5c4210@weissschuh.net Signed-off-by: Johannes Berg commit 92d5c5c04eaa61f01c5b99bea9d639f0bd008036 Author: Tiwei Bie Date: Sun Mar 8 14:04:06 2026 +0800 um: Remove CONFIG_FRAME_WARN from x86_64_defconfig The CONFIG_FRAME_WARN=1024 setting in x86_64_defconfig originates from arch/um/defconfig, which was split into i386_defconfig and x86_64_defconfig by commit e40f04d040c6 ("arch/um: make it work with defconfig and x86_64"). Currently, it's even smaller than the default on 32bit (i.e., 1280). It's no longer suitable for 64bit. Building with x86_64_defconfig triggers the following warning: lib/maple_tree.c: In function ‘mas_wr_bnode’: lib/maple_tree.c:3740:1: warning: the frame size of 1056 bytes is larger than 1024 bytes [-Wframe-larger-than=] 3740 | } | ^ Since we have a larger CONFIG_KERNEL_STACK_ORDER on 64bit (twice that of 32bit) by default, we could increase CONFIG_FRAME_WARN accordingly. Let's remove the CONFIG_FRAME_WARN=1024 setting from x86_64_defconfig and just use the default value (2048 for 64bit) defined in lib/Kconfig.debug, as we do for 32bit. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20260308060406.2772832-1-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg commit cd4126d48f7f61928c18498629ca19a0f846d0c4 Author: Tiwei Bie Date: Tue Mar 3 07:52:24 2026 +0800 um: Fix pte_read() and pte_exec() for kernel mappings The pte_read() and pte_exec() helpers are only used during the TLB sync to determine the read/exec permissions for mmap. However, for kernel mappings, they will always return 0. This leads to kern_map() having to unconditionally set the exec flag to 1 and the read flag unexpectedly always being 0. Remove the unnecessary check for the _PAGE_USER bit in these helpers to ensure that the kernel mapping permissions can be correctly determined. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20260302235224.1915380-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg commit 102331b66bcaf1f41f50b9c4cd5c36e46bafa9f3 Author: Tiwei Bie Date: Tue Mar 3 07:52:23 2026 +0800 um: Fix potential race condition in TLB sync During the TLB sync, we need to traverse and modify the page table, so we should hold the page table lock. Since full SMP support for threads within the same process is still missing, let's disable the split page table lock for simplicity. Fixes: 1e4ee5135d81 ("um: Add initial SMP support") Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20260302235224.1915380-2-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg commit 1ccc861dbbc1b4c6a896e95f815ef3310775c33f Author: Randy Dunlap Date: Thu Feb 26 14:11:12 2026 -0800 um: time-travel: clean up kernel-doc warnings Repair all kernel-doc warnings in um_timetravel.h: - add one enum description - mark "reserve" as private - use a leading '@' on current_time Warning: include/uapi/linux/um_timetravel.h:59 Enum value 'UM_TIMETRAVEL_SHARED_MAX_FDS' not described in enum 'um_timetravel_shared_mem_fds' Warning: include/uapi/linux/um_timetravel.h:245 union member 'reserve' not described in 'um_timetravel_schedshm_client' Warning: include/uapi/linux/um_timetravel.h:288 struct member 'current_time' not described in 'um_timetravel_schedshm' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260226221112.1042008-1-rdunlap@infradead.org Signed-off-by: Johannes Berg commit d46dfb369a4627d90efc2c2ffbe29e38e3e74286 Author: Marcel W. Wysocki Date: Sun Feb 15 22:28:03 2026 +0800 um: avoid struct sigcontext redefinition with musl mcontext.c includes both and . With musl libc, this causes a struct sigcontext redefinition error: pulls in musl's , which defines struct sigcontext directly. The kernel's then provides a second, conflicting definition of the same struct. With glibc this does not conflict because glibc's signal headers source their struct sigcontext from the kernel's own UAPI headers, so the include guard in makes the second inclusion a no-op. mcontext.c does not actually use struct sigcontext by name -- it only needs the FP-state types (_fpstate, _xstate, etc.) that are defined in independently of the sigcontext struct. Temporarily rename sigcontext to __kernel_sigcontext during the inclusion of so that the kernel's definition does not collide with musl's. The #undef restores normal name resolution immediately afterward. No functional change with glibc; fixes the build with musl. Signed-off-by: Marcel W. Wysocki Link: https://patch.msgid.link/20260215142803.1455757-2-maci.stgn@gmail.com Signed-off-by: Johannes Berg commit 4076f7329832074196e050def49d22265fce2021 Author: Marcel W. Wysocki Date: Sun Feb 15 22:28:02 2026 +0800 um: fix address-of CMSG_DATA() rvalue in stub The UML stub takes the address of CMSG_DATA(fd_msg): fd_map = (void *)&CMSG_DATA(fd_msg); CMSG_DATA() is specified by POSIX to return unsigned char *. Taking its address is semantically wrong -- the intent is to get a pointer to the control message data, which is exactly what CMSG_DATA() already returns. This happens to compile with glibc because glibc's primary CMSG_DATA definition accesses a flexible array member: #define CMSG_DATA(cmsg) ((cmsg)->__cmsg_data) An array lvalue can have its address taken, and &array yields the same address as array. However, glibc also has an alternative definition that uses pointer arithmetic (returning an rvalue), and musl's definition always uses pointer arithmetic: /* musl */ #define CMSG_DATA(cmsg) \ ((unsigned char *)(((struct cmsghdr *)(cmsg)) + 1)) Taking the address of an rvalue is a hard error in C, so the current code fails to compile with musl libc. Remove the erroneous & operator. The resulting code is correct regardless of the CMSG_DATA implementation -- it simply assigns the data pointer, which is what the subsequent code (fd_map[--num_fds]) expects. No functional change with glibc; fixes the build with musl. Signed-off-by: Marcel W. Wysocki Link: https://patch.msgid.link/20260215142803.1455757-1-maci.stgn@gmail.com Signed-off-by: Johannes Berg commit 39f4b29d9e7359d8a5a4d176f09623ad963d4d68 Author: Ville Syrjälä Date: Thu Mar 19 13:40:34 2026 +0200 drm/i915/wm: Include .min_ddb_alloc_uv in the wm dumps We include the Y/RGB .min_ddb_alloc in the wm state change dumps. Do the same for .min_ddb_alloc_uv, on the platforms where it is used. Also adjust the whitespace in the other debug prints to keep the values for each wm level lined up across all the lines. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260319114034.7093-10-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit e4ab44d8b28db868955d0da5dcadae5ef99a1dff Author: Ville Syrjälä Date: Thu Mar 19 13:40:33 2026 +0200 drm/i915/wm: Include ddb_y in skl_print_wm_changes() on pre-icl Pre-icl doesn't use a separate hardware plane for Y scanout, and instead it's all handled magically by the hardware. We do still need to allocate DDB space for the Y color plane though (PLANE_NV12_BUF_CFG). Include that information in the debugs so that we know where it ended up. On icl+ the equivalent information is dumped as the hardware Y plane's normal ddb allocation. v2: Use prink field width for ddb_name alignment Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260319114034.7093-9-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 27e58f7614533c0ba48d5919032283732f5342b1 Author: Ville Syrjälä Date: Thu Mar 19 13:40:32 2026 +0200 drm/i915/wm: Extract skl_print_plane_ddb_changes() We have skl_print_plane_wm_changes() but the DDB counterpart is just inline in the main loop. Extract it into a function. We'll have a second use for this soon. The "ddb" part is already parametrized in anticipation of the second user. v2: Use prink field width for ddb_name alignment Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260319114034.7093-8-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 2ef3bac16fb5e9eee4fb1d722578a79b751ea58a Author: Wesley Atwell Date: Mon Mar 9 00:26:24 2026 -0600 crypto: krb5enc - fix sleepable flag handling in encrypt dispatch krb5enc_encrypt_ahash_done() continues encryption from an ahash completion callback by calling krb5enc_dispatch_encrypt(). That helper takes a flags argument for this continuation path, but it ignored that argument and reused aead_request_flags(req) when setting up the skcipher subrequest callback. This can incorrectly preserve CRYPTO_TFM_REQ_MAY_SLEEP when the encrypt step is started from callback context. Preserve the original request flags but clear CRYPTO_TFM_REQ_MAY_SLEEP for the callback continuation path, and use the caller-supplied flags when setting up the skcipher subrequest. Fixes: d1775a177f7f ("crypto: Add 'krb5enc' hash and cipher AEAD algorithm") Assisted-by: Codex:GPT-5 Signed-off-by: Wesley Atwell Signed-off-by: Herbert Xu commit e0ce97f781c78b717b00493630a9e34caf04f79b Author: Wesley Atwell Date: Sun Mar 8 22:31:43 2026 -0600 crypto: simd - reject compat registrations without __ prefixes simd_register_skciphers_compat() and simd_register_aeads_compat() derive the wrapper algorithm names by stripping the __ prefix from the internal algorithm names. Currently they only WARN if cra_name or cra_driver_name lacks that prefix, but they still continue and unconditionally add 2 to both strings. That registers wrapper algorithms with incorrectly truncated names after a violated precondition. Reject such inputs with -EINVAL before registering anything, while keeping the warning so invalid internal API usage is still visible. Fixes: d14f0a1fc488 ("crypto: simd - allow registering multiple algorithms at once") Fixes: 1661131a0479 ("crypto: simd - support wrapping AEAD algorithms") Assisted-by: Codex:GPT-5 Signed-off-by: Wesley Atwell Signed-off-by: Herbert Xu commit e2a5a5b8876137df75506ca9272619813f958b44 Author: Ville Syrjälä Date: Thu Mar 19 13:40:31 2026 +0200 drm/i915/wm: s/skl_print_plane_changes()/skl_print_plane_wm_changes()/ Rename skl_print_plane_changes() to skl_print_plane_wm_changes() to better reflect what it does. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260319114034.7093-7-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit eb0ec2989e717a94f5e0bce9d73526a6fc598ec2 Author: Ville Syrjälä Date: Thu Mar 19 13:40:30 2026 +0200 drm/i915/wm: Nuke wm->uv_wm[] We currently keep around the full watermarks for the UV plane on pre-icl, even though the hardware doesn't need most of this information. The only thing we need to keep is the min_ddb_alloc for the UV plane. Move that into the main wm->wm[].min_ddb_alloc_uv alongside the other min_ddb_alloc (used for Y/RGB). This makes our state tracking match the hardware more closely, and avoids having to justify everwhere why uv_wm[] is being ignored. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260319114034.7093-6-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit bcc8da0436839562becbbc9e1f134559e86a8470 Author: Ville Syrjälä Date: Thu Mar 19 13:40:29 2026 +0200 drm/i915/wm: Extract skl_allocate_plane_ddb_nv12() Extract skl_allocate_plane_ddb_nv12() as the compute counterpart to skl_check_wm_level_nv12(). Mainly to hide some of the clutter from skl_crtc_allocate_plane_ddb(). Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260319114034.7093-5-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit cd4387fa57b4a2b276b40c61caa6e2e6ad217724 Author: Ville Syrjälä Date: Thu Mar 19 13:40:28 2026 +0200 drm/i915/wm: s/skl_check_nv12_wm_level()/skl_check_wm_level_nv12()/ Rename skl_check_nv12_wm_level() to skl_check_wm_level_nv12(). There will be a sort of DDB counterparts to skl_check_wm_level*(), and putting the "nv12" part to the end will allow consistent naming. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260319114034.7093-4-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit cdb41e341c6c174e9e778c02caa56eb08d256c65 Author: Ville Syrjälä Date: Thu Mar 19 13:40:27 2026 +0200 drm/i915/wm: Reorder the arguments to skl_allocate_plane_ddb() Group the ddb and data_rate together in the skl_allocate_plane_ddb() arguments. Upcoming changes will adjust the UV plane handling and keeing the ddb allocation and the data rate used to calculate it together will help with clarity. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260319114034.7093-3-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit c2d3e41f6e52269736cb9ecb17416e04f52b959a Author: Ville Syrjälä Date: Thu Mar 19 13:40:26 2026 +0200 drm/i915/wm: Nuke is_planar from skl+ wm structures We don't need is_planar in either the actual watermarks or the wm_params structure used during the wm computation. Get rid of both. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260319114034.7093-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit c5121204ad99196b6f80d12e5029e9a766cd8008 Author: Ville Syrjälä Date: Mon Mar 16 18:39:53 2026 +0200 drm/i915: Skip redundant NV12 plane unlinking plane_atomic_check() will already have unlinked the old NV12 planes by the time icl_check_nv12_planes() gets called. Drop the redundant second unlinking. Cc: Khaled Almahallawy Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260316163953.12905-4-ville.syrjala@linux.intel.com Reviewed-by: Uma Shankar commit 7b3a14322d1a8cbc6facdc857ac81960497e1c8b Author: Ville Syrjälä Date: Mon Mar 16 18:39:52 2026 +0200 drm/i915: Relocate unlink_nv12_plane() Move unlink_nv12_plane() ahead of its first caller to avoid the forward declaration. Cc: Khaled Almahallawy Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260316163953.12905-3-ville.syrjala@linux.intel.com Reviewed-by: Uma Shankar commit 017ecd04985573eeeb0745fa2c23896fb22ee0cc Author: Ville Syrjälä Date: Mon Mar 16 18:39:51 2026 +0200 drm/i915: Unlink NV12 planes earlier unlink_nv12_plane() will clobber parts of the plane state potentially already set up by plane_atomic_check(), so we must make sure not to call the two in the wrong order. The problem happens when a plane previously selected as a Y plane is now configured as a normal plane by user space. plane_atomic_check() will first compute the proper plane state based on the userspace request, and unlink_nv12_plane() later clears some of the state. This used to work on account of unlink_nv12_plane() skipping the state clearing based on the plane visibility. But I removed that check, thinking it was an impossible situation. Now when that situation happens unlink_nv12_plane() will just WARN and proceed to clobber the state. Rather than reverting to the old way of doing things, I think it's more clear if we unlink the NV12 planes before we even compute the new plane state. Cc: stable@vger.kernel.org Reported-by: Khaled Almahallawy Closes: https://lore.kernel.org/intel-gfx/20260212004852.1920270-1-khaled.almahallawy@intel.com/ Tested-by: Khaled Almahallawy Fixes: 6a01df2f1b2a ("drm/i915: Remove pointless visible check in unlink_nv12_plane()") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260316163953.12905-2-ville.syrjala@linux.intel.com Reviewed-by: Uma Shankar commit f6472b17933f9adb825e7c7da31f7b7b2edb1950 Merge: 763aacf86f1bae f338e77383789c Author: Ingo Molnar Date: Sat Mar 21 08:02:36 2026 +0100 Merge tag 'v7.0-rc4' into timers/core, to resolve conflict Resolve conflict between this change in the upstream kernel: 4c652a47722f ("rseq: Mark rseq_arm_slice_extension_timer() __always_inline") ... and this pending change in timers/core: 0e98eb14814e ("entry: Prepare for deferred hrtimer rearming") Signed-off-by: Ingo Molnar commit caf6144053b4e1c815aa56afb54745a176f999df Author: Andy Shevchenko Date: Fri Mar 20 15:36:46 2026 +0100 fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break Clang is not happy about set but unused variable: drivers/video/fbdev/matrox/g450_pll.c:412:18: error: variable 'mnp' set but not used 412 | unsigned int mnp; | ^ 1 error generated. Since the commit 7b987887f97b ("video: fbdev: matroxfb: remove dead code and set but not used variable") the 'mnp' became unused, but eliminating that code might have side-effects. The question here is what should we do with 'mnp'? The easiest way out is just mark it with __maybe_unused which will shut the compiler up and won't change any possible IO flow. So does this change. A dive into the history of the driver: The problem was revealed when the #if 0 guarded code along with unused pixel_vco variable was removed. That code was introduced in the original commit 213d22146d1f ("[PATCH] (1/3) matroxfb for 2.5.3"). And then guarded in the commit 705e41f82988 ("matroxfb DVI updates: Handle DVI output on G450/G550. Powerdown unused portions of G450/G550 DAC. Split G450/G550 DAC from older DAC1064 handling. Modify PLL setting when both CRTCs use same pixel clocks."). NOTE: The two commits mentioned above pre-date Git era and available in history.git repository for archaeological purposes. Even without that guard the modern compilers may see that the pixel_vco wasn't ever used and seems a leftover after some debug or review made 25 years ago. The g450_mnp2vco() doesn't have any IO and as Jason said doesn't seem to have any side effects either than some unneeded CPU processing during runtime. I agree that's unlikely that timeout (or heating up the CPU) has any effect on the HW (GPU/display) functionality. Fixes: 7b987887f97b ("video: fbdev: matroxfb: remove dead code and set but not used variable") Signed-off-by: Andy Shevchenko Reviewed-by: Jason Yan Signed-off-by: Helge Deller commit ea11284a2be6ce44d4c091d737a4440504cff33d Author: robgithub Date: Thu Mar 12 20:55:07 2026 +0000 fbdev: update help text for CONFIG_FB_NVIDIA The help text for CONFIG_FB_NVIDIA refers to obsolete hardware and incorrect default behaviour. This patch updates the description to reflect the current state of the driver and supported devices. Signed-off-by: robgithub Signed-off-by: Helge Deller commit d76856beb4a4a6c42244054cd780c00f2d33de4e Author: Max Zhen Date: Fri Mar 20 14:06:14 2026 -0700 accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval Refactor amdxdna GEM buffer object (BO) handling to simplify address management and unify BO type semantics. Introduce helper APIs to retrieve commonly used BO addresses: - User virtual address (UVA) - Kernel virtual address (KVA) - Device address (IOVA/PA) These helpers centralize address lookup logic and avoid duplicating BO-specific handling across submission and execution paths. This also improves readability and reduces the risk of inconsistent address handling in future changes. As part of the refactor: - Rename SHMEM BO type to SHARE to better reflect its usage. - Merge CMD BO handling into SHARE, removing special-case logic for command buffers. - Consolidate BO type handling paths to reduce code duplication and simplify maintenance. No functional change is intended. The refactor prepares the driver for future enhancements by providing a cleaner abstraction for BO address management. Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Max Zhen Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260320210615.1973016-1-lizhi.hou@amd.com commit a8f5c98517c7c89947024f79e5854e6b09766b79 Author: Huisong Li Date: Tue Mar 17 11:57:46 2026 +0800 soc: hisilicon: kunpeng_hccs: Remove unused input parameter The 'hdev' parameter of hccs_create_hccs_dir() is unused. Remove it to fix the compiler warning. Signed-off-by: Huisong Li Signed-off-by: Wei Xu commit 3caf4aa0d515080533373f4b75786d295f64e806 Author: Huisong Li Date: Tue Mar 17 11:57:45 2026 +0800 soc: hisilicon: kunpeng_hccs: Fix discard ‘const’ qualifier compiling warning The link_fsm_map has ‘const’ qualifier, but the 'str' pointer in link_fsm_map is discarded. So add 'const' for this pointer to fix the compiling warning. Signed-off-by: Huisong Li Signed-off-by: Wei Xu commit fb78a629b4f0eb399b413f6c093a3da177b3a4eb Merge: 53edd830957051 5754a1c9f9b6e2 Author: Jakub Kicinski Date: Fri Mar 20 20:13:16 2026 -0700 Merge branch 'netdevsim-support-ets-offload' Davide Caratti says: ==================== netdevsim: support ETS offload - patch 1 moves netdevsim tc offloads to a dedicated file - patch 2 enables ETS offload on netdevsim - patch 3 is a tdc test for ets offload on netdevsim ==================== Link: https://patch.msgid.link/cover.1773945414.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 5754a1c9f9b6e298791c4bb34263f37dfe93ee35 Author: Davide Caratti Date: Thu Mar 19 19:40:56 2026 +0100 tc-testing: add a test case for ETS offload While reviewing the fix for unintentional u32 overflows in ets offload code, Jamal said: [...] > otherwise a tdc test should cover it fine (when you get to the > netdevsim change perhaps) Extend tdc to allow setting hw-tc-offload via ethtool, and add a test case to reproduce the division by zero fixed in [1]. [1] https://lore.kernel.org/all/CAM0EoMm17wsYZmdFLshH3_-GrZtzd=i0xnoO2yiVB=-N4761mw@mail.gmail.com/ Suggested-by: Jamal Hadi Salim Reviewed-by: Jamal Hadi Salim Co-developed-by: Victor Nogueira Signed-off-by: Victor Nogueira Signed-off-by: Davide Caratti Link: https://patch.msgid.link/39129c374cbd00147b8c5afc04db59db62b50acc.1773945414.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit abdf5133bfa12c45d402f7b73d39bca772f3644a Author: Davide Caratti Date: Thu Mar 19 19:40:55 2026 +0100 netdevsim: support tc-ets offload Extend netdevsim to accept ndo_setup_tc(TC_SETUP_QDISC_ETS) calls, so that it's possible to run tdc on ETS offload code path. Reviewed-by: Jamal Hadi Salim Signed-off-by: Davide Caratti Link: https://patch.msgid.link/d04086cd0204d4aaf6524e972198faa1a4e5d657.1773945414.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 544921efd4e4b1f135c87335dd59114a302c574d Author: Davide Caratti Date: Thu Mar 19 19:40:54 2026 +0100 netdevsim: move TC offload code to a dedicated file This commit has no functional change. Reviewed-by: Jamal Hadi Salim Signed-off-by: Davide Caratti Link: https://patch.msgid.link/b7881fd53f8a5d8eff4eae8121576c3cd60c2ed7.1773945414.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 53edd8309570517137d58e3644976843b817179c Author: Alok Tiwari Date: Wed Mar 18 23:08:10 2026 -0700 net: netdevsim: correct typo in new_device_store error message Fix the format hint by replacing "unit" with "uint" in the pr_err() string. Signed-off-by: Alok Tiwari Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260319060812.495488-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 609e79253ace7f6eba5fdfe6ba8bd3bfd7b9e79b Author: Saeed Mahameed Date: Wed Mar 18 17:54:56 2026 -0700 net/mlx5e: Allow set_rx_mode on uplink representor set_rx_mode handler was skipped on uplink representor, since uplink relies on FDB to forward all traffic to it by default, which works perfectly on a single PF per physical port configuration, as explicit mac request isn't required, but In case of multi-host and DPU environments, uplink can only use own mac address, as set_rx_mode wasn't honored in uplink rep. Since MPFs (Multi PF switch) requires PFs to request explicit mac forwarding, this patch enables set_rx_mode on uplink representor to allow PF mac programming into MPFs table in switchdev mode, allowing use-cases such as arbitrary mac address forwarding via linux bridge. Signed-off-by: Saeed Mahameed Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260319005456.82745-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 2e69e55897dc1898175f42989dd575ca8c467363 Author: Maxime Chevallier Date: Thu Mar 19 19:17:04 2026 +0100 net: dsa: microchip: Don't embed struct phy_device to maintain the port state The KSZ9477 maintains the SGMII port's state for speed, duplex and link status to be able to fixup the accesses to its internal older version of the Designware XPCS. However, it does so by embedding a full instance of struct phy_device, only to use the 'speed', 'link' and 'duplex' fields. This is also only used for the SGMII port, it's otherwise unused for all other regular ports. Replace that with simple int/bool values. Signed-off-by: Maxime Chevallier Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260319181705.1576679-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit fa782d4df0b7fa5f3f9d2d7d74f422004487836c Merge: 82a5852595f5af beed9c0e9b53c9 Author: Jakub Kicinski Date: Fri Mar 20 19:12:48 2026 -0700 Merge branch 'net-phy-realtek-pair-order-and-polarity' Damien Dejean says: ==================== net: phy: realtek: pair order and polarity The RTL8224 PHY gives the manufacturer some flexbility with the pair order and polarity to ease the wiring on the PCB. Then the correct pair order and pair polarity must be provided to the PHY to function properly. This series adds the support to configure the pair order and the pair polarity to the Realtek PHY driver. ==================== Link: https://patch.msgid.link/20260318215502.106528-1-dam.dejean@gmail.com Signed-off-by: Jakub Kicinski commit beed9c0e9b53c98bc66d28d46fbe38c347e9aa74 Author: Damien Dejean Date: Wed Mar 18 22:55:01 2026 +0100 net: phy: realtek: add RTL8224 polarity support The RTL8224 has a register to configure the polarity of every pair of each port. It provides device designers more flexbility when wiring the chip. Unfortunately, the register is left in an unknown state after a reset. Thus on devices where the bootloader don't initialize it, the driver has to do it to detect and use a link. The MDI polarity swap can be set in the device tree using the property enet-phy-pair-polarity. The u32 value is a bitfield where bit[0..3] control the polarity of pairs A..D. Signed-off-by: Damien Dejean Link: https://patch.msgid.link/20260318215502.106528-5-dam.dejean@gmail.com Signed-off-by: Jakub Kicinski commit 58ffb5910f32e5b387d4af31ee21851c40eb31b5 Author: Damien Dejean Date: Wed Mar 18 22:55:00 2026 +0100 dt-bindings: net: ethernet-phy: add property enet-phy-pair-polarity Add the property enet-phy-pair-polarity to describe the polarity of the PHY pairs. To ease PCB designs some manufacturers allow to wire the pairs with a reverse polarity and provide a way to configure it. The property 'enet-phy-pair-polarity' sets the polarity of each pair. Bit 0 to 3 configure the polarity or pairs A to D, if set to 1 the polarity is reversed for this pair. Signed-off-by: Damien Dejean Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260318215502.106528-4-dam.dejean@gmail.com Signed-off-by: Jakub Kicinski commit 330296ea9e158758aa65631f5ec64aa74806b7e2 Author: Damien Dejean Date: Wed Mar 18 22:54:59 2026 +0100 net: phy: realtek: add RTL8224 pair order support The RTL8224 has a register to configure a pair swap (from ABCD order to DCBA) providing PCB designers more flexbility when wiring the chip. The swap parameter has to be set correctly for each of the 4 ports before the chip can detect a link. After a reset, this register is (unfortunately) left in a random state, thus it has to be initialized. On most of the devices the bootloader does it once for all and we can rely on the value set, on some other it is not and the kernel has to do it. The MDI pair swap can be set in the device tree using the property enet-phy-pair-order. The property is set to 0 to keep the default order (ABCD), or 1 to reverse the pairs (DCBA). Signed-off-by: Damien Dejean Link: https://patch.msgid.link/20260318215502.106528-3-dam.dejean@gmail.com Signed-off-by: Jakub Kicinski commit c1887257a81bf62f48178d3b9d31e23520d67b2c Author: Damien Dejean Date: Wed Mar 18 22:54:58 2026 +0100 dt-bindings: net: ethernet-phy: add property enet-phy-pair-order Add property enet-phy-pair-order to the device tree bindings to define the pair order of the PHY. To simplify PCB design some manufacturers allow to wire the pairs in a reverse order, and change the order in software. The property can be set to 0 to force the normal pair order (ABCD), or 1 to force the reverse pair order (DCBA). Signed-off-by: Damien Dejean Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260318215502.106528-2-dam.dejean@gmail.com Signed-off-by: Jakub Kicinski commit 82a5852595f5afb36aebddcc3ebc2654ee4d3879 Author: Maxime Chevallier Date: Thu Mar 19 19:05:54 2026 +0100 net: ethtool: re-order local includes Most local #include in the ethtool command handling is out of order, with either : #include "netlink.h" #include "common.h" or even : #include "netlink.h" #include "common.h" #include "bitset.h" One of the reasons is because bitset.h s lacking definitions for nlattr, netlink_ext_ack, ETH_GSTRING_LEN, and types such as u32, bool, etc. Make bitset.h standalone by including for ETH_GSTRING_LEN, and for nlattr, netlink_ext_ack and the rest. While at it, take a pass on ethnl sources to re-order the local includes : - put them after the global includes - add a newline between global and local includes - alpha-sort the local includes One notable exception is the cmis.h include, that needs definitions from module_fw.h. Keep them in this order for now. Signed-off-by: Maxime Chevallier Link: https://patch.msgid.link/20260319180555.1531386-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit e783e40fb689381caca31e03d28c39e10c82e722 Author: Thangaraj Samynathan Date: Wed Mar 18 12:02:28 2026 +0530 net: lan743x: fix SGMII detection on PCI1xxxx B0+ during warm reset A warm reset on boards using an EEPROM-only strap configuration (where no MAC address is set in the image) can cause the driver to incorrectly revert to RGMII mode. This occurs because the ENET_CONFIG_LOAD_STARTED bit may not persist or behave as expected. Update pci11x1x_strap_get_status() to use revision-specific validation: - For PCI11x1x A0: Continue using the legacy check (config load started or reset protection) to validate the SGMII strap. - For PCI11x1x B0 and later: Use the newly available STRAP_READ_USE_SGMII_EN_ bit in the upper strap register to validate the lower SGMII_EN bit. This ensures the SGMII interface is correctly identified even after a warm reboot. Signed-off-by: Thangaraj Samynathan Link: https://patch.msgid.link/20260318063228.17110-1-thangaraj.s@microchip.com Signed-off-by: Jakub Kicinski commit 64cf4b95de0741e25a5c1f3140de50149fa68937 Merge: 79cfb2d1f25a2d 0c3893d37892f3 Author: Jakub Kicinski Date: Fri Mar 20 18:34:50 2026 -0700 Merge branch 'selftests-vsock-support-nested-vm-runner-for-vmtest-sh' Bobby Eshleman says: ==================== selftests/vsock: support nested VM runner for vmtest.sh This series fixes a few issues trying to launch vmtest.sh in a nested VM environment and were discovered when trying to prepare the tests for netdev CI/CD. When taken together these patches make vmtest.sh work both on bare metal and in nested VMs, regardless of the outer VM's user, coincidental path overlaps, or filesystem settings. ==================== Link: https://patch.msgid.link/20260317-vsock-vmtest-nested-fixes-v2-0-0b3f53b80a0f@meta.com Signed-off-by: Jakub Kicinski commit 0c3893d37892f332b595906710bf53bbd9c7c572 Author: Bobby Eshleman Date: Tue Mar 17 15:09:36 2026 -0700 selftests/vsock: fix vsock_test path shadowing in nested VMs The /root mount introduced for nested VM support shadows any host paths under /root. This breaks systems where the outer VM runs as root and the vsock_test binary path is something like: /root/linux/tools/testing/selftests/vsock/vsock_test Fix this by copying vsock_test into the temporary home directory that gets mounted as /root in the guest, and using a relative path to invoke it. Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260317-vsock-vmtest-nested-fixes-v2-2-0b3f53b80a0f@meta.com Signed-off-by: Jakub Kicinski commit 865926e26e05be52ff311883619b9198298698df Author: Bobby Eshleman Date: Tue Mar 17 15:09:35 2026 -0700 selftests/vsock: fix vmtest.sh for read-only nested VM runners When running vmtest.sh inside a nested VM, there occurs a problem with stacking two sets of virtiofs/overlay layers (the first set from the outer VM and the second set from the inner VM). The virtme init scripts (sshd, udhcpd, etc...) fail to execute basic programs (e.g., /bin/cat) and load library dependencies (e.g., libpam) due to ESTALE. This only occurs when both layers (outer and inner) use virtiofs. Work around this by using 9p in the inner VM via --force-9p. Additionally, when the outer VM is read-only, the inner VM's attempt at populating SSH keys to the root filesystem fails: virtme-ng-init: mkdir: cannot create directory '/root/.cache': Read-only file system Work around this by creating a temporary home directory with generated SSH keys and passing it through to the guest as /root via --rwdir. Disable strict host key checking in vm_ssh() since the VM will be seen as a new host each run. The --rw arg had to be removed to prevent a vng complaint about overlay (in combination with the other parameters). The guest doesn't really need write access anyway, so this was probably overly permissive to begin with. Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260317-vsock-vmtest-nested-fixes-v2-1-0b3f53b80a0f@meta.com Signed-off-by: Jakub Kicinski commit 79cfb2d1f25a2de43d846d91143c8b66e99688e5 Author: Breno Leitao Date: Wed Mar 18 05:22:48 2026 -0700 bonding: remove bonding_priv.h bonding_priv.h only defined DRV_NAME and DRV_DESCRIPTION, but caused unnecessary recompilation: it included to define bond_version, which is used solely in bond_procfs.c. With CONFIG_LOCALVERSION_AUTO=y, utsrelease.h is regenerated on every git commit, so any git operation triggered recompilation of bond_main.c which also included bonding_priv.h. Remove the header entirely, as suggested by Jakub, given the macros on this file can be integrated into the C files directly. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260318-bond_uts-v2-1-033fe0d4e903@debian.org Signed-off-by: Jakub Kicinski commit eb2415854f3ba7d95c4f30d259f6f598ab604616 Author: Russell King (Oracle) Date: Wed Mar 18 08:27:44 2026 +0000 net: phylink: add debug for phy_config_inband() Add debug for the phy_config_inband() call so we can see which inband modes are being configured at the PHY. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1w2mFk-0000000DXW2-2PR9@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f44218cd5e6a3d98b137344b808ee154117ce765 Author: Lorenzo Bianconi Date: Tue Mar 17 17:40:47 2026 +0100 net: airoha: Reset PPE cpu port configuration in airoha_ppe_hw_init() Before this patch, the PPE cpu port configuration used for a specific GDM device was set just running ndo_init() callback during the device initialization. The selected PPE cpu port configuration depends on the QDMA block assigned to the GDM port. The QDMA block is selected according to the GDM port LAN/WAN configuration as specified in the commit '8737d7194d6d ("net: airoha: select QDMA block according LAN/WAN configuration"). However, the user selected PPE cpu port configuration can be different with respect to the one hardcoded in the NPU firmware binary. The hardcoded NPU PPE cpu port configuration is loaded initializing the PPE engine running the NPU ops ppe_init() callback in airoha_ppe_offload_setup routine (this is executed at runtime by the netfilter flowtable infrastructure during flow offloading). Reset the PPE cpu port configuration in airoha_ppe_hw_init routine in order to apply the user requested setup according to the device DTS. Please note this patch is fixing an issue not visible to the user (so we do not need to backport it) since airoha_eth driver currently supports just the internal phy available via the MT7530 DSA switch and there are no WAN interfaces officially supported since PCS/external phy is not merged mainline yet (it will be posted with following patches). Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260317-airoha-fix-ppe-def-cpu-v1-1-338533d8e234@kernel.org Signed-off-by: Jakub Kicinski commit 6b5f49176a08e01deb7b1435658152237bb44173 Author: Daniel Golle Date: Wed Mar 18 03:07:52 2026 +0000 net: dsa: mxl862xx: don't read out-of-bounds The write loop in mxl862xx_api_wrap() computes the word count as (size + 1) / 2, rounding up for odd-sized structs. On the last iteration of an odd-sized buffer it reads a full __le16 from data[i], accessing one byte past the end of the caller's struct. KASAN catches this as a stack-out-of-bounds read during probe (e.g. from mxl862xx_bridge_config_fwd() because of the odd length of sizeof(struct mxl862xx_bridge_config) == 49). The read-back loop already handles this case, it writes only a single byte when (i * 2 + 1) == size. The write loop lacked the same guard. In practice the over-read is harmless: the extra stack byte is sent to the firmware which ignores trailing data beyond the command's declared payload size. Apply the same odd-size last-byte handling to the write path: when the final word contains only one valid byte, send *(u8 *)&data[i] instead of le16_to_cpu(data[i]). This is endian-safe because data is __le16-encoded and the low byte is always at the lowest address regardless of host byte order. Signed-off-by: Daniel Golle Reviewed-by: Simon Horman Link: https://patch.msgid.link/83356ad9c9a4470dd49b6b3d661c2a8dd85cc6a1.1773803190.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 220bdfcb4b4788f57faa2c28454d8b2dd3bcab6c Author: Rosen Penev Date: Wed Mar 18 20:53:23 2026 -0700 ARM: dts: BCM5301X: EA9200: specify partitions Some are needed to be specified so that linksys,ns-firmware works properly. Signed-off-by: Rosen Penev Link: https://lore.kernel.org/r/20260319035324.269905-6-rosenp@gmail.com Signed-off-by: Florian Fainelli commit 6b0cb7b34ba68425abb6b3174cca4a7ee031da6d Author: Rosen Penev Date: Wed Mar 18 20:53:21 2026 -0700 ARM: dts: BCM5301X: EA9200: add LEDs Allows control and configuration of device LEDs. Signed-off-by: Rosen Penev Link: https://lore.kernel.org/r/20260319035324.269905-4-rosenp@gmail.com Signed-off-by: Florian Fainelli commit a4311aede88e8f1a5d606ce239aea9314813786f Author: Rosen Penev Date: Wed Mar 18 20:53:20 2026 -0700 ARM: dts: BCM5301X: EA9200: add USB GPIOs Allows at least halt to turn the USB ports off. Signed-off-by: Rosen Penev Link: https://lore.kernel.org/r/20260319035324.269905-3-rosenp@gmail.com Signed-off-by: Florian Fainelli commit 977707168d5444947f4f0ff21dffa5645a6d80bd Author: Rosen Penev Date: Wed Mar 18 20:53:19 2026 -0700 ARM: dts: BCM5301X: EA9200: add WiFi button Adds ability to configure the WiFi button. Signed-off-by: Rosen Penev Link: https://lore.kernel.org/r/20260319035324.269905-2-rosenp@gmail.com Signed-off-by: Florian Fainelli commit 5e3bfd609ffdaf231e33e5bcbf02165c06c3c283 Author: Rob Herring (Arm) Date: Fri Mar 20 10:48:06 2026 -0500 ARM: dts: broadcom: bcm2835-rpi: Move non simple-bus nodes to root level The 'gpu' and 'firmware' nodes are not MMIO devices, so they should not be under a 'simple-bus'. Additionally, the "raspberrypi,bcm2835-power" node is part of the firmware, so move it under the 'rpi-firmware' node. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260320154809.1246064-1-robh@kernel.org Signed-off-by: Florian Fainelli commit 2fd6ea687829bb1ca6e4dba6880877f01f6b9630 Author: Linus Walleij Date: Wed Feb 18 10:30:54 2026 +0100 ARM: dts: bcm63148: Add I2C block The BCM63148 has a brcmper I2C block. The peripheral range needs to be extended to accommodate it. The Boot LUT is at offset + 0x10000 so extend it to cover at least that too, 128 KB. INTERRUPT_ID_I2C is at (ISR_TABLE3_OFFSET + 19) = 96+19 = 115, convert back to SPI IRQ 115-32 = 83. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-7-5373ef82c50c@kernel.org Signed-off-by: Florian Fainelli commit c0a82d19e29e5b006b4a7b50c40b74a8b3604e2b Author: Linus Walleij Date: Wed Feb 18 10:30:53 2026 +0100 ARM: dts: bcm63138: Add I2C block The BCM63138 has a brcmper I2C block. The interrupt is at INTERRUPT_ID_I2C whic is (ISR_TABLE3_OFFSET + 19) = 96+115, convert back to SPI interrupt 115-32 = 83. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-6-5373ef82c50c@kernel.org Signed-off-by: Florian Fainelli commit f7819684123f02f4e1444748f69d98a71bcb6b9b Author: Linus Walleij Date: Wed Feb 18 10:30:52 2026 +0100 ARM: dts: bcm6878: Add I2C bus block The BCM6878 has an brcmper I2C block. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-5-5373ef82c50c@kernel.org Signed-off-by: Florian Fainelli commit 24cd3b7b07a392253d1873ad4483f881086302e9 Author: Linus Walleij Date: Wed Feb 18 10:30:51 2026 +0100 ARM: dts: bcm6855: Add I2C bus blocks The BCM6855 has two brcmper I2C blocks, the second one in the PERF1 area at 0xff85a800, this is covered by the current bus range. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-4-5373ef82c50c@kernel.org Signed-off-by: Florian Fainelli commit 682cc367f9366aebe7d23ae33d3a5a07d24d229b Author: Linus Walleij Date: Wed Feb 18 10:30:50 2026 +0100 ARM: dts: bcm6846: Add I2C bus block The BCM6846 has a brcmper I2C block. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-3-5373ef82c50c@kernel.org Signed-off-by: Florian Fainelli commit fc0c2f0cba01eb945dc68f57afe06fd4746a7aae Author: Linus Walleij Date: Wed Feb 18 10:30:49 2026 +0100 ARM: dts: bcm63138: Fix DMA IRQ INTERRUPT_ID_PL081 is (ISR_TABLE_3_OFFSET + 23) which is 96+3 = 119, convert back to SPI interrupt 119-32 = 87. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-2-5373ef82c50c@kernel.org Signed-off-by: Florian Fainelli commit e2de08086d72dcd7b4c26cda201cb98b518f62c4 Author: Linus Walleij Date: Wed Feb 18 10:30:48 2026 +0100 ARM: dts: bcm6878: Fix PL081 DMA block IRQ SPI_TABLE_OFFSET_2 is 96 in 6878. 96+30 = 126. Convert back dtsi SPI interrupt 126 - 32 = 94 Reviewed-by: William Zhang Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-1-5373ef82c50c@kernel.org Signed-off-by: Florian Fainelli commit 2560335ae52952702a6fb32f0f10be63d9b6c774 Author: Rosen Penev Date: Wed Feb 25 15:08:27 2026 -0800 ARM: dts: BCM5301X: AC5300: set WAN MAC from nvram The WAN MAC is offset by 1. Set in dts to avoid having to handle this in userspace. Signed-off-by: Rosen Penev Link: https://lore.kernel.org/r/20260225230827.21715-5-rosenp@gmail.com Signed-off-by: Florian Fainelli commit 00f8f89f39811edf510fdab041e90d68608861c5 Author: Rosen Penev Date: Wed Feb 25 15:08:26 2026 -0800 ARM: dts: BCM5301X: AC3100: set WAN MAC from nvram The WAN MAC is offset by 1. Set it to avoid having to do so in userspace. Signed-off-by: Rosen Penev Link: https://lore.kernel.org/r/20260225230827.21715-4-rosenp@gmail.com Signed-off-by: Florian Fainelli commit 649a62e1855b25c482670304ac473ed34b3621b4 Author: Rosen Penev Date: Wed Feb 25 15:08:25 2026 -0800 ARM: dts: BCM5301X: panamera: set WAN MAC from nvram The MAC address from the stock firmware is offset by 1. Define it properly to avoid having to override it in userspace. Signed-off-by: Rosen Penev Link: https://lore.kernel.org/r/20260225230827.21715-3-rosenp@gmail.com Signed-off-by: Florian Fainelli commit 93214f2574126ee55494b4390ced5cd3f0e42aa9 Author: Rosen Penev Date: Wed Feb 25 15:08:24 2026 -0800 ARM: dts: BCM5301X: EA9200: set WAN MAC from nvram The MAC address from the stock firmware is offset by 1. Define it properly to avoid having to override it in userspace. Signed-off-by: Rosen Penev Link: https://lore.kernel.org/r/20260225230827.21715-2-rosenp@gmail.com Signed-off-by: Florian Fainelli commit 58ea47a30b7dd2053545d5e7cae37b640b0dc442 Author: Biju Das Date: Wed Mar 4 07:17:28 2026 +0000 dt-bindings: i2c: renesas,riic: Document the R9A08G046 support Document the Renesas RZ/G3L (R9A08G046) RIIC IP. This is compatible with the version available on Renesas RZ/V2H (R9A09G057). Signed-off-by: Biju Das Reviewed-by: Wolfram Sang Signed-off-by: Wolfram Sang commit 5a2b3a854601a0c3e82d56ad2309e899027fc3b3 Author: Wenmeng Liu Date: Thu Mar 5 17:48:12 2026 +0800 dt-bindings: i2c: qcom-cci: Document sm6150 compatible Add the sm6150 CCI device string compatible. Reviewed-by: Vladimir Zapolskiy Acked-by: Andi Shyti Reviewed-by: Krzysztof Kozlowski Reviewed-by: Loic Poulain Signed-off-by: Wenmeng Liu Signed-off-by: Wolfram Sang commit 7a8d9fac8a9f44a5f030fec4c9c2ed2219885e3c Author: Johan Hovold Date: Fri Mar 6 10:41:14 2026 +0100 i2c: cp2615: rename disconnect callback Rename the driver disconnect function so that it reflects the callback name for consistency with the rest of the kernel (e.g. makes it easier to grep for). Signed-off-by: Johan Hovold Signed-off-by: Wolfram Sang commit a78295dff1894bfdba4398ca38a7262045f6195e Author: Luca Weiss Date: Fri Mar 20 09:09:49 2026 +0100 dt-bindings: i2c: qcom-cci: Document Milos compatible Add Milos compatible for the CAMSS CCI interfaces. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Signed-off-by: Wolfram Sang commit bb25b5635e90e33c8c1c4ef231d4d7351c06be49 Author: Arnd Bergmann Date: Fri Mar 6 17:33:09 2026 +0100 check-uapi: use dummy libc includes Based on Thomas Weißschuh's series to kernel headers to no longer require an installed libc when build testing the uapi headers, the same can now be done for the scripts/check-uapi.sh script. The only required change here is to add the usr/dummy-include include path. Link: https://lore.kernel.org/lkml/20260227-kbuild-uapi-libc-v1-0-c17de0d19776@weissschuh.net/ [1] Signed-off-by: Arnd Bergmann Reviewed-by: Thomas Weißschuh Acked-by: Nathan Chancellor Link: https://patch.msgid.link/20260306163309.2015837-4-arnd@kernel.org Signed-off-by: Nicolas Schier commit 9940ec38f12ed8ffe8edc1944f9bbdf9b9a4689e Author: Arnd Bergmann Date: Fri Mar 6 17:33:08 2026 +0100 check-uapi: honor ${CROSS_COMPILE} setting When ${CROSS_COMPILE} is set, but ${CC} is not set, the logic in check-uapi.sh is different from the top-level Makefile, which defaults to using the cross gcc. This leads to using the native gcc instead of the cross version, resulting in unexpected false-positive and false-negative output. Use the same logic here that we use in Kbuild for consistency. Signed-off-by: Arnd Bergmann Reviewed-by: Thomas Weißschuh Acked-by: Nathan Chancellor Link: https://patch.msgid.link/20260306163309.2015837-3-arnd@kernel.org Signed-off-by: Nicolas Schier commit a261f6dff3c1653c19c065c3b3650c625447b8a7 Author: Arnd Bergmann Date: Fri Mar 6 17:33:07 2026 +0100 check-uapi: link into shared objects While testing ABI changes across all architectures, I found that abidiff sometimes produces nonsensical output. Further debugging identified missing or broken libelf support for architecture specific relocations in ET_REL binaries as the source of the problem[1]. Change the script to no longer produce a relocatable object file but instead create a shared library for each header. This makes abidiff work for all of the architectures in upstream linux kernels. Link: https://sourceware.org/bugzilla/show_bug.cgi?id=33869 Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Thomas Weißschuh Acked-by: Nathan Chancellor Link: https://patch.msgid.link/20260306163309.2015837-2-arnd@kernel.org Signed-off-by: Nicolas Schier commit c82cfe15916d33e89c2d2efeeb624e8c9c2c4ca8 Author: Yi Lai Date: Fri Mar 20 09:09:29 2026 +0800 vfio: selftests: Support DMR and GNR-D DSA devices Currently, the VFIO DSA driver test only supports the SPR DSA device ID. Attempting to run the test on newer platforms like DMR or GNR-D results in a "No driver found" error, causing the test to be skipped. Refactor dsa_probe() to use a switch statement for checking device IDs. This improves maintainability and makes it easier to add new device IDs in the future. Add the following DSA device IDs to the supported list: PCI_DEVICE_ID_INTEL_DSA_DMR (0x1212) PCI_DEVICE_ID_INTEL_DSA_GNRD (0x11fb) Signed-off-by: Yi Lai Reviewed-by: David Matlack Link: https://lore.kernel.org/r/20260320010930.481380-1-yi1.lai@intel.com Signed-off-by: Alex Williamson commit 1347a742a1e1b080e2e8d200312ae45b8d6ac859 Author: Ted Logan Date: Thu Mar 19 15:58:47 2026 -0700 vfio: selftests: Build tests on aarch64 Fix vfio selftests on aarch64, allowing native builds on aarch64 hosts. Reported-by: Matt Evans Closes: https://lore.kernel.org/all/e51b4ff2-13c4-47d4-b781-3dcbd740d274@meta.com/ Fixes: a55d4bbbe644 ("vfio: selftests: only build tests on arm64 and x86_64") Signed-off-by: Ted Logan Reviewed-by: David Matlack Link: https://lore.kernel.org/r/20260319-vfio-selftests-aarch64-v2-1-bb2621c24dc4@fb.com Signed-off-by: Alex Williamson commit 2b27ea5b644d7da9bc84f4539e53d1b31c601566 Author: Alberto Garcia Date: Mon Mar 9 18:39:42 2026 +0100 PM: hibernate: return -ENODATA if the snapshot image is not loaded snapshot_image_loaded() is used in both the in-kernel and the userspace restore path to ensure that the snapshot image has been completely loaded. However the latter path returns -EPERM in such situations, which is meant for cases where the operation is neither write-only nor ready. This patch updates the check so the returned error code is -ENODATA in both cases. Suggested-by: Brian Geffon Signed-off-by: Alberto Garcia Acked-by: Brian Geffon Link: https://patch.msgid.link/8cfda38659c623f5392f3458cb32504ffd556a74.1773075892.git.berto@igalia.com Signed-off-by: Rafael J. Wysocki commit cb7415d8cbb750221b48e5beebe8f402719a20d9 Author: Nathan Chancellor Date: Mon Mar 16 14:54:22 2026 -0700 drm/xe: Fix format specifier for printing pointer differences GCC and clang warn (or error with CONFIG_WERROR=y / W=e) several times when targeting 32-bit platforms along the lines of drivers/gpu/drm/xe/xe_lrc.c: In function 'dump_mi_command': drivers/gpu/drm/xe/xe_lrc.c:1921:40: error: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'int' [-Werror=format=] 1921 | drm_printf(p, "LRC[%#5lx] = [%#010x] MI_NOOP (%d dwords)\n", | ~~~~^ | | | long unsigned int | %#5x 1922 | dw - num_noop - start, inst_header, num_noop); | ~~~~~~~~~~~~~~~~~~~~~ | | | int drivers/gpu/drm/xe/xe_lrc.c:1922:7: error: format specifies type 'unsigned long' but the argument has type '__ptrdiff_t' (aka 'int') [-Werror,-Wformat] 1921 | drm_printf(p, "LRC[%#5lx] = [%#010x] MI_NOOP (%d dwords)\n", | ~~~~~ | %#5tx 1922 | dw - num_noop - start, inst_header, num_noop); | ^~~~~~~~~~~~~~~~~~~~~ Use the '%tx' specifier for printing pointer differences, which clears up the warnings for 32-bit platforms while introducing no regressions for 64-bit platforms. Fixes: 65fcf19cb36b ("drm/xe: Include running dword offset in default_lrc dumps") Signed-off-by: Nathan Chancellor Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260316-drm-xe-fix-32-bit-wformat-ptrdiff-v1-1-0108b10b2b6b@kernel.org Signed-off-by: Matt Roper commit a7aa874b69460896349985833059a764e688f1d0 Author: Icenowy Zheng Date: Tue Mar 10 00:24:57 2026 +0800 riscv: dts: thead: th1520: add coefficients to the PVT node The manual of TH1520 contains a set of coefficients a little different to the driver default ones. Add them to the device tree node of PVT. Signed-off-by: Icenowy Zheng Signed-off-by: Icenowy Zheng Reviewed-by: Drew Fustini Signed-off-by: Drew Fustini commit 0acb1de2b4df426a62dba33bcd80f3939636f97b Author: Rob Herring (Arm) Date: Fri Mar 20 10:48:07 2026 -0500 arm64: dts: broadcom: bcm2712: Move non simple-bus nodes to root level The 'gpu' and 'firmware' nodes are not MMIO devices, so they should not be under a 'simple-bus', but at the root level. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260320154809.1246064-2-robh@kernel.org Signed-off-by: Florian Fainelli commit 5662ec000d97d7a84ad4e3f34768ef08c869d0e3 Author: Thomas Weißschuh Date: Wed Mar 11 23:00:50 2026 +0100 selftests/nolibc: validate NOLIBC_IGNORE_ERRNO compilation When NOLIBC_IGNORE_ERRNO is set, various bits of nolibc are disabled. Make sure that all the ifdeffery does not result in any compilation errors by compiling a dummy source file. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260311-nolibc-err-h-v1-2-735a9de7f15d@weissschuh.net commit e2900176327bb2fb1e8f831ba76b1b16264bc27a Author: Thomas Weißschuh Date: Wed Mar 11 23:00:49 2026 +0100 selftests/nolibc: add a variable for nolibc-test source files The list of the nolibc-test source files is repeated many times. Another source file is about to be added, adding to the mess. Introduce a common variable instead. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260311-nolibc-err-h-v1-1-735a9de7f15d@weissschuh.net commit e83b07dc8c05a55d02057b1484724a0b188f6f8d Author: Thomas Weißschuh Date: Tue Mar 17 09:40:36 2026 +0100 tools/nolibc: MIPS: fix clobbers of 'lo' and 'hi' registers on different ISAs All MIPS ISAs before r6 use the 'lo' and 'hi' special registers. These are clobbered by system calls and need to be marked as such to avoid miscompilations. Currently nolibc ties the clobbers to the ABI. But this is wrong and leads to ISA<->ABI combinations which are not handled correctly, leading to compiler errors or miscompilations. Handle all different combinations of ABI and ISA. Fixes: a6a2a8a42972 ("tools/nolibc: MIPS: add support for N64 and N32 ABIs") Fixes: 66b6f755ad45 ("rcutorture: Import a copy of nolibc") Suggested-by: Maciej W. Rozycki Link: https://lore.kernel.org/lkml/alpine.DEB.2.21.2603141744240.55200@angie.orcam.me.uk/ Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260317-nolibc-mips-clobber-v2-1-5b9a97761a9e@linutronix.de Signed-off-by: Thomas Weißschuh commit 9bc019e7ba1f797ad7e24ebb33f4fa0be011ce5b Author: David Laight Date: Sun Mar 8 11:37:42 2026 +0000 selftests/nolibc: Use printf variable field widths and precisions Now that printf supports '*' for field widths and precisions then can be used to simplify the test output. - aligning the "[OK]" strings. - reporting the expected sprintf() output when there is a mismatch. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-18-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit 248c7cf60c808f09044af1ce1d2c7c707696dc1e Author: David Laight Date: Sun Mar 8 11:37:41 2026 +0000 tools/nolibc/printf: Add support for octal output Octal output isn't often used, but adding it costs very little. Supporting "%#o" is mildly annoying, it has to add a leading '0' if there isn't one present. In simple cases this is the same as adding a sign of '0' - but that adds an extra '0' in a few places. So you need 3 tests, %o, # and no leading '0' (which can only be checked after the zero pad for precision). If all the test are deferred until after zero padding then too many values are 'live' across the call to _nolibc_u64toa_base() and get spilled to stack. Hence the check that ignores the 'sign' if it is the same as the first character of the output string. Add tests for octal output. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-17-david.laight.linux@gmail.com [Thomas: avoid a -Wsign-compare] Signed-off-by: Thomas Weißschuh commit d3d3f64f8e964f8af6ac72294e65caad5acc452e Author: David Laight Date: Sun Mar 8 11:37:40 2026 +0000 tools/nolibc/printf: Add support for zero padding and field precision Includes support for variable field widths (eg "%*.*d"). Zero padding is limited to 31 zero characters. This is wider than the largest numeric field so shouldn't be a problem. All the standard printf formats are now supported except octal and floating point. Add tests for new features Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-16-david.laight.linux@gmail.com [Thomas: fixup testcases for musl libc] Signed-off-by: Thomas Weißschuh commit b5f3f59cf4384a8c9e60fa4bb1a8f4ad71126a90 Author: David Laight Date: Sun Mar 8 11:37:39 2026 +0000 tools/nolibc/printf: Add support for left aligning fields Output the characters before or after the pad - writing the pad takes more code. Include additional/changed tests Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-15-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit 5eae5f1a01aff6f9773547265167d7a680c6fbc3 Author: David Laight Date: Sun Mar 8 11:37:38 2026 +0000 tools/nolibc/printf: Special case 0 and add support for %#x The output for %#x is almost the same as that for %p, both output in hexadecimal with a leading "0x". However for zero %#x should just output "0" (the same as decimal and ocal). For %p match glibc and output "(nil)" rather than "0x0" or "0". Add tests for "%#x", "% d", "%+d" and passing NULL to "%p". Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-14-david.laight.linux@gmail.com [Thomas: fix up testcases for musl libc] Signed-off-by: Thomas Weißschuh commit a30d20588fb8507540d267505a8876bc37bb3ec7 Author: David Laight Date: Sun Mar 8 11:37:37 2026 +0000 tools/nolibc/printf: Add support for conversion flags space and plus Flags ' ' and '+' are sign characters for positive numbers. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-13-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit 8df70ee45b1383114cdcaa9b2fe7449cdf5f46d5 Author: David Laight Date: Sun Mar 8 11:37:36 2026 +0000 tools/nolibc/printf: Prepend sign to converted number Instead of appending the converted number to the sign, convert first and then prepend the sign (or "0x"). Use the length returned by u64toh_r() instead of calling strlen(). Needed so that zero padding can be inserted between the sign and digits in an upcoming patch. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-12-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit b43be424343407661d5e7c79a3584a37b91a88bb Author: David Laight Date: Sun Mar 8 11:37:35 2026 +0000 tools/nolibc/printf: Handle "%s" with the numeric formats Avoids the extra va_arg() call with is non-trivial on a lot of modern ABI. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-11-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit 125632871929e9bf5b0bc907c8fef2d326e4623a Author: David Laight Date: Sun Mar 8 11:37:34 2026 +0000 tools/nolibc/printf: Add support for length modifiers tzqL and formats iX Length modifiers t (ptrdiff_t) and z (size_t) are aliases for l (long), q and L are 64bit the same as j (intmax). Format i is an alias for d and X similar to x but upper case. Supporting them is mostly just adding the relevant bit to the bit pattern used for matching characters. Although %X is detected the output will be lower case. Change/add tests to use conversions i and X, and length modifiers L and ll. Use the correct minimum value for "%Li". Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-10-david.laight.linux@gmail.com [Thomas: Fix up testcases for musl libc] Signed-off-by: Thomas Weißschuh commit 85f1152778f8cdc563ada12a3fc48c962b408d94 Author: David Laight Date: Sun Mar 8 11:37:33 2026 +0000 tools/nolibc/printf: Use bit-masks to hold requested flag, length and conversion chars Use flags bits (1u << (ch & 31)) for the flags, length modifiers, and conversion specifiers. This makes it easy to test for multiple values at once. Detect the conversion flags " #+-0" although they are currently all ignored. Unconditionally generate the signed values (for %d) to remove a second set of checks for the size. Separate out the formatting of single characters from numbers. Output the sign for negative values then negate and treat as unsigned. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-9-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit c5b9173ce9a110618edcb5bd92c8c724b6edf41f Author: David Laight Date: Sun Mar 8 11:37:32 2026 +0000 tools/nolibc/printf: Use goto and reduce indentation Upcoming changes will need to use goto to jump to the code that outputs characters. Use 'goto do_output' to output a known number of characters. Use 'goto do_strlen_output' to output a '\0' terminated string. Removes a level of indentation from the format processing code. The change is best reviewed using 'git diff -b' after applying it. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-8-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit b3d30efd052360c11abe1259a15dfcf2448b37be Author: David Laight Date: Sun Mar 8 11:37:31 2026 +0000 tools/nolibc/printf: Simplify __nolibc_printf() Move the check for the length modifiers into the format processing between the field width and conversion specifier. This lets the loop be simplified and a 'fast scan' for a format start used. If an error is detected (eg an invalid conversion specifier) then copy the invalid format to the output buffer. Reduces code size by about 10% on x86-64. Some versions of gcc bloat this version by generating a jump table. All goes away in the later patches. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-7-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit a2fa5a752ce67c11a9d6d6535165195073ce0c46 Author: David Laight Date: Sun Mar 8 11:37:30 2026 +0000 tools/nolibc/printf: Output pad characters in 16 byte chunks Simple to do and saves calls to the callback function. Change variables written, width and len to 'signed int' to get better code. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-6-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit c0a08eb87f60daec1c1549c067945abfee711f86 Author: David Laight Date: Sun Mar 8 11:37:29 2026 +0000 tools/nolibc: Rename the 'errnum' parameter to strerror() Change the parameter variable name from 'errno' to 'errnum'. Matches any documentation and avoids any issues that might happen if errno is actually a #define (which is not uncommon). Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-5-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit 2177dd375d087012907e389f787b21ac38bb1785 Author: David Laight Date: Sun Mar 8 11:37:28 2026 +0000 tools/nolibc: Implement strerror() in terms of strerror_r() strerror() can be the only part of a program that has a .data section. This requires 4k in the program file. Add a simple implementation of strerror_r() and use that in strerror() so that the "errno=" string is copied at run-time. Use __builtin_memcpy() because that optimises away the input string and just writes the required constants to the target buffer. Code size change largely depends on whether the inlining decision for strerror() changes. Change the tests to use the normal EXPECT_VFPRINTF() when testing %m. Skip the tests when !is_nolibc. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-4-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit ab7cd329a837711b88600e5d776836f16a0e8de8 Author: David Laight Date: Sun Mar 8 11:37:27 2026 +0000 selftests/nolibc: Rename w to written in expect_vfprintf() Single character variable names don't make code easy to read. Rename 'w' (used for the return value from snprintf()) 'written'. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-3-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit 6702425cd50ebb9a71d6b441df4b0df4f58d160a Author: David Laight Date: Sun Mar 8 11:37:26 2026 +0000 tools/nolibc: Add _NOLIBC_OPTIMIZER_HIDE_VAR() to compiler.h Needed to stop compiler 'optimisations' bloating code. Equivalent to the definition in include/linux/compiler.h Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260308113742.12649-2-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit cf3470882435c82742ab869d4e2d414de55e7e59 Author: David Laight Date: Mon Mar 2 10:17:59 2026 +0000 selftests/nolibc: Let EXPECT_VFPRINTF() tests be skipped Tests that check explicit nolibc behavior (eg "%m") or test places where the nolibc behaviour deviates from the libc need skipping when compiled to use the host libc. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260302101815.3043-8-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit 4ea2dedd502e2b4bfa8a47f2aaaaac4eab01e00d Author: David Laight Date: Mon Mar 2 10:17:58 2026 +0000 selftests/nolibc: Check that snprintf() doesn't write beyond the buffer end Fill buf[] with known data and check the vsnprintf() doesn't write beyond the specified buffer length. Would have picked up the bug in field padding. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260302101815.3043-7-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit f36e1ec61a6adb135d1b4021bc849c6acb96f50c Author: David Laight Date: Mon Mar 2 10:17:57 2026 +0000 selftests/nolibc: Use length of 'expected' string to check snprintf() output Instead of requiring the test cases specifying both the length and expected output, take the length from the expected output. Tests that expect the output be truncated are changed to specify the un-truncated output. Change the strncmp() to a memcmp() with an extra check that the output is actually terminated. Append a '+' to the printed output (after the final ") when the output is truncated. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260302101815.3043-6-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit 9aa8a4afd4e6407a4d4521c325855c4467a88b73 Author: David Laight Date: Mon Mar 2 10:17:56 2026 +0000 selftests/nolibc: check vsnprintf() output buffer before the length Check the string matches before checking the returned length. Only print the string once when it matches. Makes it a lot easier to diagnose any incorrect output. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260302101815.3043-5-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit b42f02da2bf99460a7b1c5c25008f2e4a65ea4e3 Author: David Laight Date: Mon Mar 2 10:17:55 2026 +0000 selftests/nolibc: Return correct value when printf test fails Correctly return 1 (the number of errors) when strcmp() fails rather than the return value from strncmp() which is the signed difference between the mismatching characters. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260302101815.3043-4-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit 4045e7b19bbf7338452cda11e64cfe7ae3361964 Author: David Laight Date: Mon Mar 2 10:17:54 2026 +0000 tools/nolibc/printf: Move snprintf length check to callback Move output truncation to the snprintf() callback. This simplifies the main code and fixes truncation of padded fields. Add a zero length callback to 'finalise' the buffer rather than doing it in snprintf() itself. Fixes: e90ce42e81381 ("tools/nolibc: implement width padding in printf()") Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260302101815.3043-3-david.laight.linux@gmail.com [Thomas: clean up Fixes trailer] Signed-off-by: Thomas Weißschuh commit f675ae28fcdf7db93a8c1a6964f062725b1e06a0 Author: David Laight Date: Mon Feb 23 10:17:24 2026 +0000 tools/nolibc/printf: Change variables 'c' to 'ch' and 'tmpbuf[]' to 'outbuf[]' Changing 'c' makes the code slightly easier to read because the variable stands out from the single character literals (especially 'c'). Change tmpbuf[] to outbuf[] because 'out' points into it. The following patches pretty much rewrite the function so the churn is limited. Signed-off-by: David Laight Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260223101735.2922-7-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit 35908c5a1703052d1fe63da42c8115252a38e141 Author: David Laight Date: Mon Feb 23 10:17:20 2026 +0000 tools/nolibc: Optimise and common up the number to ascii functions Implement u[64]to[ah]_r() using a common function that uses multiply by reciprocal to generate the least significant digit first and then reverses the string. On 32bit this is five multiplies (with 64bit product) for each output digit. I think the old utoa_r() always did 36 multiplies and a lot of subtracts - so this is likely faster even for 32bit values. Definitely better for 64bit values (especially small ones). Clearly shifts are faster for base 16, but reversing the output buffer makes a big difference. Sharing the code reduces the footprint (unless gcc decides to constant fold the functions). Definitely helps vfprintf() where the constants get loaded and a single call is done. Also makes it cheap to add octal support to vfprintf for completeness. Signed-off-by: David Laight Link: https://patch.msgid.link/20260223101735.2922-3-david.laight.linux@gmail.com Acked-by: Willy Tarreau [Thomas: skip int128 multiplication on SPARC and clang] Signed-off-by: Thomas Weißschuh commit 27532c645e61da541173d43fbe03d234f68232f9 Author: David Laight Date: Mon Feb 23 10:17:21 2026 +0000 selftests/nolibc: Fix build with host headers and libc Many systems don't have strlcpy() or strlcat() and readdir_r() is deprecated. This makes the tests fail to build with the host headers. Disable the 'directories' test and define strlcpy(), strlcat() and readdir_r() using #defines so that the code compiles. Fixes: 6fe8360b16acb ("selftests/nolibc: also test libc-test through regular selftest framework") Signed-off-by: David Laight Link: https://patch.msgid.link/20260223101735.2922-4-david.laight.linux@gmail.com Signed-off-by: Thomas Weißschuh commit 8ba600aa577f73cc551747fdf121afc7d04afcea Author: Thomas Weißschuh Date: Wed Mar 18 18:00:33 2026 +0100 selftests/nolibc: fix test_file_stream() on musl libc fwrite() modifying errno is non-standard. Only validate this behavior on those libc implementations which implement it. Fixes: a5f00be9b3b0 ("tools/nolibc: Add a simple test for writing to a FILE and reading it back") Signed-off-by: Thomas Weißschuh commit b3970e97490abfb040305f14327d75e7568f31c4 Merge: d93f8ea0e5ad41 daf9f9dd509113 Author: Dave Airlie Date: Sat Mar 21 02:21:54 2026 +1000 Merge tag 'amd-drm-next-7.1-2026-03-19' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-7.1-2026-03-19: amdgpu: - Fix gamma 2.2 colorop TFs - BO list fix - LTO fix - DC FP fix - DisplayID handling fix - DCN 2.01 fix - MMHUB boundary fixes - ISP fix - TLB fence fix - Hainan pm fix - UserQ fixes - MES 12.1 Updates - GC 12.1 updates - RAS fixes - DML updates - Cursor fixes - SWSMU cleanups - Misc cleanups - Clean up duplicate format modifiers - Devcoredump updates - Cleanup mmhub cid handling - Initial VCN 5.0.2 support - Initial JPEG 5.0.2 support - PSP 13.0.15 updates amdkfd: - Queue properties fix - GC 12.1 updates radeon: - Hainan pm fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260319173334.479766-1-alexander.deucher@amd.com commit 7974835aa9d54125a1b6a2948f927d745748bf46 Author: Dave Jiang Date: Thu Mar 19 08:25:41 2026 -0700 cxl: Add endpoint decoder flags clear when PCI reset happens When a PCI reset happens, the lock and enable flags of the CXL device should be cleared to avoid stale state flags after reset. Add flag clearing during cxl_reset_done() to clear the relevant endpoint decoder flags for all decoders of the endpoint device. Reported-by: Dan Williams Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319152541.2739343-1-dave.jiang@intel.com Signed-off-by: Dave Jiang commit 68b953730e94c0b3417573b7288d78995a48be4b Merge: 1f318b96cc84d7 2b46715fd9ec96 Author: Christian Brauner Date: Fri Mar 20 14:44:31 2026 +0100 Merge patch series "pid_namespace: make init creation more flexible" Pavel Tikhomirov says: The first patch properly annotates accesses to ->child_reaper with _ONCE macroses, to protect unlocked accesses from possible cpu/compiler optimization problems. The second patch makes sure that the init is always a first process in the pid namespace, previously this was only checked for set_tid case. The third patch allows to join pid namespace before pid namespace init is created, that allows to create pid namespace by one process and then create pid namespace init from another process after setns(). Please see the detailed description in the patch commit message. It depends on the second patch. The forth and the final patch is a comprehansive test, that tests both basic usecase of creating pid namespace and init separately, and a more specific usecase which shows how we can improve clone3(set_tid) usability after this change. This change is generally useful as it makes clone3(set_tid) more universal, and let's it work in all the cases evenly. Also it is highly useful to CRIU to handle nested containers. * patches from https://patch.msgid.link/20260318122157.280595-1-ptikhomirov@virtuozzo.com: MAINTAINERS: add a new entry for testing pidns init creation via setns selftests: Add tests for creating pidns init via setns pid_namespace: allow opening pid_for_children before init was created pid: check init is created first after idr alloc pid_namespace: avoid optimization of accesses to ->child_reaper Link: https://patch.msgid.link/20260318122157.280595-1-ptikhomirov@virtuozzo.com Signed-off-by: Christian Brauner commit 2b46715fd9ec966240324fd88c1e7eb504fcdf28 Author: Pavel Tikhomirov Date: Wed Mar 18 13:21:53 2026 +0100 MAINTAINERS: add a pid namespace entry Add a new entry for pid namespaces et al. Link: https://patch.msgid.link/20260318122157.280595-6-ptikhomirov@virtuozzo.com Signed-off-by: Pavel Tikhomirov Signed-off-by: Christian Brauner commit 7c5219e1a60686c04fe12536d96721d538635130 Author: Pavel Tikhomirov Date: Wed Mar 18 13:21:52 2026 +0100 selftests: Add tests for creating pidns init via setns First testcase "pidns_init_via_setns" checks that a process can become Pid 1 (init) in a new Pid namespace created via unshare() and joined via setns(). Second testcase "pidns_init_via_setns_set_tid" checks that during this process we can use clone3() + set_tid and set the pid in both the new and old pid namespaces (owned by different user namespaces). This test requires root to run to avoid complex setup for wrapper userns. Signed-off-by: Pavel Tikhomirov -- pidns_init_via_setns. Make pidns_init_via_setns_set_tid require root. Link: https://patch.msgid.link/20260318122157.280595-5-ptikhomirov@virtuozzo.com v6: Move wrapper userns creation for unprivileged case to the top of Signed-off-by: Christian Brauner commit a3bdc23ba8ead754583907419af6dbea32857ddb Author: Pavel Tikhomirov Date: Wed Mar 18 13:21:51 2026 +0100 pid_namespace: allow opening pid_for_children before init was created This effectively gives us an ability to create the pid namespace init as a child of the process (setns-ed to the pid namespace) different to the process which created the pid namespace itself. Original problem: There is a cool set_tid feature in clone3() syscall, it allows you to create process with desired pids on multiple pid namespace levels. Which is useful to restore processes in CRIU for nested pid namespace case. In nested container case we can potentially see this kind of pid/user namespace tree: Process ┌─────────┐ User NS0 ──▶ Pid NS0 ──▶ Pid p0 │ │ │ │ │ ▼ ▼ │ │ User NS1 ──▶ Pid NS1 ──▶ Pid p1 │ │ │ │ │ ... ... │ ... │ │ │ │ │ ▼ ▼ │ │ User NSn ──▶ Pid NSn ──▶ Pid pn │ └─────────┘ So to create the "Process" and set pids {p0, p1, ... pn} for it on all pid namespace levels we can use clone3() syscall set_tid feature, BUT the syscall does not allow you to set pid on pid namespace levels you don't have permission to. So basically you have to be in "User NS0" when creating the "Process" to actually be able to set pids on all levels. It is ok for almost any process, but with pid namespace init this does not work, as currently we can only create pid namespace init and the pid namespace itself simultaneously, so to make "Pid NSn" owned by "User NSn" we have to be in the "User NSn". We can't possibly be in "User NS0" and "User NSn" at the same time, hence the problem. Alternative solution: Yes, for the case of pid namespace init we can use old and gold /proc/sys/kernel/ns_last_pid interface on the levels lower than n. But it is much more complicated and introduces tons of extra code to do. It would be nice to make clone3() set_tid interface also aplicable to this corner case. Implementation: Now when anyone can setns to the pid namespace before the creation of init, and thus multiple processes can fork children to the pid namespace, it is important that we enforce the first process created is always pid namespace init. (Note that this was done by the previous preparational patch as a standalon useful change.) We only allow other processes after the init sets pid_namespace->child_reaper. Reviewed-by: Oleg Nesterov Acked-by: Andrei Vagin Signed-off-by: Pavel Tikhomirov -- v2: Use *_ONCE for ->child_reaper accesses atomicity, and avoid taking task_list lock for reading it. Rebase to master, and thus remove now excess pidns_ready variable. v3: Separate *_ONCE change and "init is first" checks into separate commits. v5: Add Andrei's review tag. ->child_reaper which can influence the pid namespace, so it looks like the pid namespace is fully setup at the point when init sets ->child_reaper to receive more processes. Thus tasklist lock looks excess in pidns_for_children_get()'s ->child_reaper check and it should be safe not to have it in the corresponding check in alloc_pid() (introduced earlier in this series). Link: https://patch.msgid.link/20260318122157.280595-4-ptikhomirov@virtuozzo.com Acked-by: Andrei Vagin Reviewed-by: Oleg Nesterov Note: I didn't find anything in copy_process() around setting the Signed-off-by: Christian Brauner commit 39c8806e2d887559237cd10f084c06f0223c6d45 Author: Pavel Tikhomirov Date: Wed Mar 18 13:21:50 2026 +0100 pid: check init is created first after idr alloc This moves the condition (tid != 1 && !tmp->child_reaper) to after idr alloc, so it not only covers that first process in pid namespace has pid 1 in case of clone3(set_tid) requesting wrong pid, but also if idr itself gives wrong pid for some reason. This could've been the case before this patch, when creating first process the alloc_pid()->pidfs_add_pid() code path fails, so that the idr->idr_next is non zero anymore and next process calling to alloc_pid(), will get 2 as a pid from idr_alloc_cyclic(). Though thanks to PIDNS_ADDING logic, free_pid() disables further pid allocation in this case and it does not lead to any real problem. Note: This is also a preparation for the next patch in the series, which will introduce an ability of creating init from the task different to the task which had created the pid namespace. Needed to make sure that init is always first, even in this new case. -- Suggested-by: Oleg Nesterov Signed-off-by: Oleg Nesterov Acked-by: Andrei Vagin Signed-off-by: Pavel Tikhomirov Link: https://patch.msgid.link/20260318122157.280595-3-ptikhomirov@virtuozzo.com v3: Split from main commit. Merge two checks of ->child_reaper into one. v4: Update commit message about PIDNS_ADDING. v5: Add Andrei's review tag. Signed-off-by: Christian Brauner commit d9c857aee2ebcdf5e9d81718b78b7966b8eee876 Author: Pavel Tikhomirov Date: Wed Mar 18 13:21:49 2026 +0100 pid_namespace: avoid optimization of accesses to ->child_reaper To avoid potential problems related to cpu/compiler optimizations around ->child_reaper, let's use WRITE_ONCE (additional to task_list lock) everywhere we write it and use READ_ONCE where we read it without explicit lock. Note: It also pairs with existing READ_ONCE with no lock in nsfs_fh_to_dentry(). Also let's add ASSERT_EXCLUSIVE_WRITER before write to identify to KCSAN that we don't expect any concurrent ->child_reaper modifications, and those must be detected. -- Suggested-by: Oleg Nesterov Acked-by: Oleg Nesterov Signed-off-by: Pavel Tikhomirov Link: https://patch.msgid.link/20260318122157.280595-2-ptikhomirov@virtuozzo.com v3: Split from main commit. Add ASSERT_EXCLUSIVE_WRITER. v5: Add one more READ_ONCE for access without lock in free_pid(). Signed-off-by: Christian Brauner commit be8058f31b4e237604e4ce7599593ab68dc69ae7 Author: Tomas Glozar Date: Tue Mar 10 17:07:25 2026 +0100 rtla: Fix segfault on multiple SIGINTs Detach stop_trace() from SIGINT/SIGALRM on tool clean-up to prevent it from crashing RTLA by accessing freed memory. This prevents a crash when multiple SIGINTs are received. Fixes: d6899e560366 ("rtla/timerlat_hist: Abort event processing on second signal") Fixes: 80967b354a76 ("rtla/timerlat_top: Abort event processing on second signal") Reviewed-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260310160725.144443-1-tglozar@redhat.com Signed-off-by: Tomas Glozar commit 3d6bb84f6bb3f4c05fc47fd02ce75ce3032a4ce1 Author: Yuto Ohnuki Date: Thu Feb 26 20:18:58 2026 +0000 fs: remove stale and duplicate forward declarations Remove the following unnecessary forward declarations from fs.h, which improves maintainability. - struct hd_geometry: became unused in fs.h when block_device_operations was moved to blkdev.h in commit 08f858512151 ("[PATCH] move block_device_operations to blkdev.h"). The forward declaration is now added to blkdev.h where it is actually used. - struct iovec: became unused when aio_read/aio_write were removed in commit 8436318205b9 ("->aio_read and ->aio_write removed") - struct iov_iter: duplicate forward declaration. This removes the redundant second declaration, added in commit 293bc9822fa9 ("new methods: ->read_iter() and ->write_iter()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512301303.s7YWTZHA-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202512302139.Wl0soAlz-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202512302105.pmzYfmcV-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202512302125.FNgHwu5z-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202512302108.nIV8r5ES-lkp@intel.com/ Signed-off-by: Yuto Ohnuki Link: https://patch.msgid.link/20260226201857.27310-2-ytohnuki@amazon.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 49e64d7136366a9657d581158d4a20399231530c Author: Askar Safin Date: Thu Mar 19 23:27:21 2026 +0000 init/initramfs.c: trivial fix: FSM -> Finite-state machine FSM means "finite-state machine", but I think this is not obvious to everyone. Signed-off-by: Askar Safin Link: https://patch.msgid.link/20260319232721.452950-1-safinaskar@gmail.com Signed-off-by: Christian Brauner commit 4bdb626957bfad8ab0292608b6f153135adebe7c Merge: a809ff6469c53d b84d27531744e0 Author: Mark Brown Date: Fri Mar 20 12:55:40 2026 +0000 ASoC: soc-component: add snd_soc_component_regmap_val_bytes() Kuninori Morimoto says: component has component->val_bytes which is set via snd_soc_component_setup_regmap(). But it can be calculated via component->regmap. No need to keep it as component->val_bytes. This patchset adds new snd_soc_component_regmap_val_bytes(), and remove component->val_bytes / snd_soc_component_setup_regmap(). Link: https://patch.msgid.link/87a4wdzyxf.wl-kuninori.morimoto.gx@renesas.com commit b84d27531744e046a72120882f513f42e361269d Author: Kuninori Morimoto Date: Thu Mar 12 00:15:55 2026 +0000 ASoC: soc-component: remove component->val_bytes component has component->val_bytes which is set via snd_soc_component_setup_regmap(). But it can be calculated via component->regmap. No need to keep it as component->val_bytes. No one is using component->val_bytes. Remove it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/874imlzyv8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7a478db6980f88969590d41b8b4f5a4b06a60881 Author: Kuninori Morimoto Date: Thu Mar 12 00:15:21 2026 +0000 ASoC: soc-ops: use snd_soc_component_regmap_val_bytes() component has component->val_bytes which is set via snd_soc_component_setup_regmap(). But it can be calculated via component->regmap. No need to keep it as component->val_bytes. Use snd_soc_component_regmap_val_bytes(). Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/875x71zyw5.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 72660d1ac9f1d4eb535e502b404c5cb4f15ada1a Author: Kuninori Morimoto Date: Thu Mar 12 00:15:13 2026 +0000 ASoC: tegra: use snd_soc_component_regmap_val_bytes() component has component->val_bytes which is set via snd_soc_component_setup_regmap(). But it can be calculated via component->regmap. No need to keep it as component->val_bytes. Use snd_soc_component_regmap_val_bytes(). Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/877brhzywd.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c2da4813882b8037198cd8e67182293e17b44573 Author: Kuninori Morimoto Date: Thu Mar 12 00:15:03 2026 +0000 ASoC: soc-component: add snd_soc_component_regmap_val_bytes() component has component->val_bytes which is set via snd_soc_component_setup_regmap(). But it can be calculated via component->regmap. No need to keep it as component->val_bytes. Add snd_soc_component_regmap_val_bytes() for it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/878qbxzywo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 763aacf86f1baefb134c70813aa8c72d1675d738 Author: Thomas Gleixner Date: Tue Mar 17 10:01:54 2026 +0100 clocksource: Rewrite watchdog code completely The clocksource watchdog code has over time reached the state of an impenetrable maze of duct tape and staples. The original design, which was made in the context of systems far smaller than today, is based on the assumption that the to be monitored clocksource (TSC) can be trivially compared against a known to be stable clocksource (HPET/ACPI-PM timer). Over the years it turned out that this approach has major flaws: - Long delays between watchdog invocations can result in wrap arounds of the reference clocksource - Scalability of the reference clocksource readout can degrade on large multi-socket systems due to interconnect congestion This was addressed with various heuristics which degraded the accuracy of the watchdog to the point that it fails to detect actual TSC problems on older hardware which exposes slow inter CPU drifts due to firmware manipulating the TSC to hide SMI time. To address this and bring back sanity to the watchdog, rewrite the code completely with a different approach: 1) Restrict the validation against a reference clocksource to the boot CPU, which is usually the CPU/Socket closest to the legacy block which contains the reference source (HPET/ACPI-PM timer). Validate that the reference readout is within a bound latency so that the actual comparison against the TSC stays within 500ppm as long as the clocks are stable. 2) Compare the TSCs of the other CPUs in a round robin fashion against the boot CPU in the same way the TSC synchronization on CPU hotplug works. This still can suffer from delayed reaction of the remote CPU to the SMP function call and the latency of the control variable cache line. But this latency is not affecting correctness. It only affects the accuracy. With low contention the readout latency is in the low nanoseconds range, which detects even slight skews between CPUs. Under high contention this becomes obviously less accurate, but still detects slow skews reliably as it solely relies on subsequent readouts being monotonically increasing. It just can take slightly longer to detect the issue. 3) Rewrite the watchdog test so it tests the various mechanisms one by one and validating the result against the expectation. Signed-off-by: Thomas Gleixner Tested-by: Borislav Petkov (AMD) Tested-by: Daniel J Blueman Reviewed-by: Jiri Wiesner Reviewed-by: Daniel J Blueman Link: https://patch.msgid.link/20260123231521.926490888@kernel.org Link: https://patch.msgid.link/87h5qeomm5.ffs@tglx commit d9794c0600f95b226b6672c5b364e44c80d660c5 Author: Kit Dallege Date: Sun Mar 15 18:10:01 2026 +0100 dma-mapping: fix false kernel-doc comment marker Change /** to /* for the DMA attributes list comment in dma-mapping.h. The comment is not a kernel-doc structured comment and should not use the kernel-doc opening marker. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Kit Dallege Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260315171001.66010-1-xaum.io@gmail.com commit ebf1bafd090790704ba54c032de299fccd90a9da Author: Krzysztof Kozlowski Date: Sun Mar 1 15:33:23 2026 +0100 LICENSES: Explicitly allow SPDX-FileCopyrightText Sources already have SPDX-FileCopyrightText (~40 instances) and more appear on the mailing list, so document that it is allowed. On the other hand SPDX defines several other tags like SPDX-FileType, so add checkpatch rule to narrow desired tags only to two of them - license and copyright. That way no new tags would sneak in to the kernel unnoticed. Cc: Laurent Pinchart Cc: Joe Perches Acked-by: Laurent Pinchart Signed-off-by: Krzysztof Kozlowski Signed-off-by: Greg Kroah-Hartman commit cf3a5a77d82cec9f48b4bcb615876d020566e43a Author: Geert Uytterhoeven Date: Wed Mar 18 15:01:47 2026 +0100 arm64: dts: renesas: rzt2h-rzn2h-evk: Fix GMAC pins sort order Restore alphabetical sort order of the pin control subnodes by exchanging the gmac1-pins and gmac2-pins nodes. While at it, fix the index in an incorrect "GMAC2" comment. Signed-off-by: Geert Uytterhoeven Reviewed-by: Lad Prabhakar Link: https://patch.msgid.link/4ce75f75a0569a4cc6f74dfda8b75f6f1a2495c1.1773842409.git.geert+renesas@glider.be commit 3a7e37edaa071faba1a69d400f091b14eb8bc21f Author: Lad Prabhakar Date: Thu Mar 12 16:04:07 2026 +0000 arm64: dts: renesas: r9a09g077m44-rzt2h-evk: Add PHY interrupt support Add interrupt support for the GMAC1 and GMAC2 PHYs on the RZ/T2H EVK board. The PHYs are connected to the ICU via IRQ3 and IRQ13 lines respectively. Define RZT2H_IRQxx macros in the SoC DTSI to map the ICU IRQ_NS lines to their absolute ICU interrupt space offsets. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260312160407.3387840-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 4926ff5231f4d5f7e0084e3a5c0bc7d2e34aecde Author: Lad Prabhakar Date: Thu Mar 12 16:04:06 2026 +0000 arm64: dts: renesas: r9a09g087m44-rzn2h-evk: Add PHY interrupt support Add interrupt support for the GMAC1 and GMAC2 PHYs on the RZ/N2H EVK board. The PHYs are connected to the ICU via IRQ14 and IRQ15 lines respectively. Define RZN2H_IRQxx macros in the SoC DTSI to map the ICU IRQ_NS lines to their absolute ICU interrupt space offsets. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260312160407.3387840-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c57fdc0aa24b30302766a9ac68337bd698d9881f Author: Wig Cheng Date: Sun Jan 25 00:36:11 2026 +0800 arm64: dts: renesas: r9a09g057h48-kakip: Add pixpaper display overlay Add device tree overlay to support the MayQueen PixPaper e-paper display on the Renesas RZ/V2H EVK (KAKIP board). The display is connected via SPI0 interface and uses GPIO pins for reset, busy, and DC control. The overlay configures: - RSPI0 pinmux for SPI communication (MOSI, MISO, CLK, CE0), - PixPaper display device with proper GPIO assignments, - SPI frequency set to 1MHz for stable operation. This enables support for the Open-EP Community pixpaper-213-c module on the RZ/V2H platform. Signed-off-by: Wig Cheng Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260124163611.3279104-1-onlywig@gmail.com Signed-off-by: Geert Uytterhoeven commit f01be0fa24b139a6f6676244a2f721244d7efc44 Author: Lad Prabhakar Date: Fri Jan 23 22:59:56 2026 +0000 arm64: dts: renesas: r9a09g087m44-rzn2h-evk: Clarify SD0 power jumper setup Document the required JP23 jumper positions for supplying SD0 when selecting between the onboard eMMC and the SD card slot. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260123225957.1007089-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a7b37f329e5fbeb0f40ef892fc33d1eebfadd7b8 Author: Lad Prabhakar Date: Fri Jan 23 22:59:55 2026 +0000 arm64: dts: renesas: r9a09g077m44-rzt2h-evk: Clarify SD0 power jumpers Clarify the board setup requirements for using SDHI0 on the RZ/T2H EVK by documenting the CN78 jumper positions needed to supply SD0 power for either the default eMMC configuration or the SD card slot configuration. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260123225957.1007089-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit d85cb4ff46c7b7f393b30666a41fff18962ba21a Author: John Madieu Date: Wed Mar 18 09:51:16 2026 +0100 clk: renesas: r9a09g047: Add PCIe clocks and reset Add necessary clocks and reset entries for the PCIe controller. Reviewed-by: Geert Uytterhoeven Signed-off-by: John Madieu Reviewed-by: Claudiu Beznea Tested-by: Claudiu Beznea Tested-by: Lad Prabhakar # RZ/V2N EVK Link: https://patch.msgid.link/20260318085119.44717-2-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c45d9bebf8b4ce4e50900723efa5b733e27684bd Author: Lad Prabhakar Date: Thu Mar 12 11:15:21 2026 +0000 clk: renesas: r9a09g057: Add PCIe clocks and reset Add clocks and reset entries for the PCIe controller. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260312111521.115392-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a7719b2d04c42b527741ecce68e29113e42a10bb Author: Lad Prabhakar Date: Thu Mar 12 11:15:20 2026 +0000 clk: renesas: r9a09g056: Add PCIe clocks and reset Add clocks and reset entries for the PCIe controller. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260312111521.115392-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 24a51f8bf869053de4927e0798d17dbcda9ea3cf Author: Tommaso Merciai Date: Tue Feb 17 17:23:45 2026 +0100 clk: renesas: r9a09g047: Add entries for the RSPIs Add clock and reset entries for the Renesas RZ/G3E RSPI IPs. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/ca59fdcc6c32b8f6659aa9218f1a42d2bcd258c3.1771344527.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 2c440f2fccf35d18f1b7eafc9015f0230c25395b Author: Nitin Gote Date: Tue Mar 17 13:30:59 2026 +0530 drm/xe: Extend Wa_14026781792 for xe3lpg Wa_14026781792 applies to all graphics versions from 30.00 through 35.10 (inclusive). Since there are no IPs between 30.05 and 35.10, consolidate the RTP rules into a single GRAPHICS_VERSION_RANGE(3000, 3510). v2: (Matt) - There are no IPs between 30.05 and 35.10 either, So, consolidate this into a single GRAPHICS_VERSION_RANGE(3000, 3510) - Also move it up to the top part of the table Signed-off-by: Nitin Gote Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260317080059.1275116-2-nitin.r.gote@intel.com Signed-off-by: Tejas Upadhyay commit d78c5bbf098fd93884a5dc05aec045f32cce7525 Merge: 46a9d97069cab3 e6d7eba23b666d Author: Niklas Cassel Date: Fri Mar 20 11:13:32 2026 +0100 Merge branch 'for-7.0-fixes' into for-7.1 commit 18fc0f1d7dbeada7810192fe739172c5abd2a902 Author: Varun Gupta Date: Tue Mar 17 09:34:47 2026 +0530 drm/xe/xe3p_lpg: Add Wa_16029437861 Wa_16029437861 requires disabling COAMA atomics by setting bit 22 (SQ_DISABLE_COAMA) of L3SQCREG2 (0xb104) for Xe3p_LPG graphics version 35.10 stepping A0..B0. This bit is already set by the existing Wa_14026144927 entry, so add the new WA ID to the same implementation. Signed-off-by: Varun Gupta Reviewed-by: Tejas Upadhyay Link: https://patch.msgid.link/20260317040447.1792687-1-varun.gupta@intel.com Signed-off-by: Tejas Upadhyay commit fbef867cf6614178bc6afd15ee15f85cddf19eab Author: Luca Ceresoli Date: Tue Mar 10 13:13:24 2026 +0100 drm/bridge: samsung-dsim: use drm_bridge_clear_and_put() to put the next bridge drm_bridge_clear_and_put() is simpler to write and it prevents any potential future use-after-free. Reviewed-by: Osama Abdelkader Acked-by: Marek Szyprowski Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260310-drm-bridge-atomic-vs-remove-clear_and_put-v2-2-51fe222f3cf0@bootlin.com Signed-off-by: Luca Ceresoli commit 8f3c83720555ffa96799896f2a0bb985a03a89f4 Author: Luca Ceresoli Date: Tue Mar 10 13:13:23 2026 +0100 drm/bridge: add drm_bridge_clear_and_put() Drivers having a struct drm_bridge pointer pointing to a bridge in many cases hold that reference until the owning device is removed. In those cases the reference to the bridge can be put in the .remove callback (possibly using devm actions) or in the .destroy func (possibly with the help of struct drm_bridge::next_bridge). At those moments the driver should not be operating anymore and won't dereference the bridge pointer after it is put. However there are cases when drivers need to stop holding a reference to a bridge even when their device is not being removed. This is the case for bridge hot-unplug, when a bridge is removed but the previous entity (bridge or encoder) is staying. In such case the "previous entity" needs to put it but cannot do it via devm or .destroy, because it is not being removed. The easy way to dispose of such pointer is: drm_bridge_put(my_priv->some_bridge); my_priv->some_bridge = NULL; However this is risky because there is a time window between the two lines where the reference is put, and thus the bridge could be deallocated, but the pointer is still assigned. If other functions of the same driver were invoked concurrently they might dereference my_priv->some_bridge during that window, resulting in use-after-free. A correct solution is to clear the pointer before putting the reference, but that needs a temporary variable: struct drm_bridge *temp = my_priv->some_bridge; my_priv->some_bridge = NULL; drm_bridge_put(temp); This solution is however annoying to write, so the incorrect version might still sneak in. Add a simple, easy to use function to put a bridge after setting its pointer to NULL in the correct way. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260310-drm-bridge-atomic-vs-remove-clear_and_put-v2-1-51fe222f3cf0@bootlin.com Signed-off-by: Luca Ceresoli commit 223af4a569d1f491e55d4de8ed40333c938622d0 Author: Rosen Penev Date: Thu Mar 19 18:05:17 2026 -0700 reset: sti: kzalloc + kcalloc to kzalloc Simplify allocation. Signed-off-by: Rosen Penev Reviewed-by: Patrice Chotard Signed-off-by: Philipp Zabel commit 5f1d250a8fc4a4975b692e30229ad93a20c3778a Author: Thomas Hellström Date: Tue Mar 17 15:18:56 2026 +0100 drm/ttm: Update the struct ttm_operation_ctx kerneldoc Update the kerneldoc with a more elaborate description of some members, including the gfp_retry_mayfail member. Use inline kerneldoc. Suggested-by: Simona Vetter Signed-off-by: Thomas Hellström Reviewed-by: Maarten Lankhorst Acked-by: Christian König Link: https://patch.msgid.link/20260317141856.237876-4-thomas.hellstrom@linux.intel.com commit c6135f67aa37a4a744869f726d706bda091e6dfa Author: Thomas Hellström Date: Tue Mar 17 15:18:55 2026 +0100 drm/ttm: Avoid invoking the OOM killer when reading back swapped content In situations where the system is very short on RAM, the shmem readback from swap-space may invoke the OOM killer. However, since this might be a recoverable situation where the caller is indicating this by setting struct ttm_operation_ctx::gfp_retry_mayfail to true, adjust the gfp value used by the allocation accordingly. Signed-off-by: Thomas Hellström Reviewed-by: Maarten Lankhorst Acked-by: Christian König Link: https://patch.msgid.link/20260317141856.237876-3-thomas.hellstrom@linux.intel.com commit 55fcf74cc2330580659426a57d1fa0125f7326b3 Author: Thomas Hellström Date: Tue Mar 17 15:18:54 2026 +0100 drm/ttm: Don't spam the log on buffer object backing store allocation failure If the struct ttm_operation_ctx::gfp_retry_mayfail is true, buffer object backing store allocation failures are expected to silently fail with an error code to the caller. But currently an elaborate warning is printed to the system log. Don't spam the log in this way. Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Reviewed-by: Simona Vetter Acked-by: Christian König Link: https://patch.msgid.link/20260317141856.237876-2-thomas.hellstrom@linux.intel.com commit 3590a52f0d0903e600dd01e2cf30820c404beca4 Author: Maxime Ripard Date: Tue Feb 24 17:10:29 2026 +0100 drm/atomic: Remove state argument to drm_atomic_private_obj_init Now that all drm_private_objs users have been converted to use atomic_create_state instead of the old ad-hoc initialization, we can remove the state parameter from drm_private_obj_init and the fallback code. Reviewed-by: Dmitry Baryshkov Reviewed-by: Tomi Valkeinen Reviewed-by: Liviu Dudau Reviewed-by: Maíra Canal Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260224-drm-private-obj-reset-v5-4-5a72f8ec9934@kernel.org Signed-off-by: Maxime Ripard commit 2d38301c2f29265a73499dd909b603e93fb5ca90 Author: Maxime Ripard Date: Tue Feb 24 17:10:28 2026 +0100 drm/tegra: Switch private_obj initialization to atomic_create_state The tegra driver relies on a drm_private_obj, that is initialized by allocating and initializing a state, and then passing it to drm_private_obj_init. Since we're gradually moving away from that pattern to the more established one relying on a atomic_create_state implementation, let's migrate this instance to the new pattern. Reviewed-by: Thomas Zimmermann Reviewed-by: Tomi Valkeinen Link: https://patch.msgid.link/20260224-drm-private-obj-reset-v5-3-5a72f8ec9934@kernel.org Signed-off-by: Maxime Ripard commit af95bb0092fa6b76608133f13f8e09c79082c91a Author: Maxime Ripard Date: Tue Feb 24 17:10:27 2026 +0100 drm/omapdrm: Switch private_obj initialization to atomic_create_state The omapdrm driver relies on a drm_private_obj, that is initialized by allocating and initializing a state, and then passing it to drm_private_obj_init. Since we're gradually moving away from that pattern to the more established one relying on a atomic_create_state implementation, let's migrate this instance to the new pattern. Reviewed-by: Thomas Zimmermann Reviewed-by: Tomi Valkeinen Link: https://patch.msgid.link/20260224-drm-private-obj-reset-v5-2-5a72f8ec9934@kernel.org Signed-off-by: Maxime Ripard commit 3c668e8c652a9d6d226b72f1e90b5a611b748f4a Author: Maxime Ripard Date: Tue Feb 24 17:10:26 2026 +0100 drm/amdgpu: Switch private_obj initialization to atomic_create_state The amdgpu driver relies on a drm_private_obj, that is initialized by allocating and initializing a state, and then passing it to drm_private_obj_init. Since we're gradually moving away from that pattern to the more established one relying on a atomic_create_state implementation, let's migrate this instance to the new pattern. Reviewed-by: Thomas Zimmermann Reviewed-by: Tomi Valkeinen Link: https://patch.msgid.link/20260224-drm-private-obj-reset-v5-1-5a72f8ec9934@kernel.org Signed-off-by: Maxime Ripard commit 711cca0f1cfef57018654b969da4041c2bab68d3 Author: Robert Marko Date: Mon Mar 2 12:20:14 2026 +0100 arm64: dts: microchip: add EV23X71A board Microchip EV23X71A is an LAN9696 based evaluation board. Signed-off-by: Robert Marko Reviewed-by: Claudiu Beznea Acked-by: Daniel Machon Tested-by: Daniel Machon Link: https://lore.kernel.org/r/20260302112153.464422-7-robert.marko@sartura.hr Signed-off-by: Claudiu Beznea commit 864d5e8436906fd2875cc2c5ada549d805457ca7 Author: Robert Marko Date: Mon Mar 2 12:20:13 2026 +0100 dt-bindings: arm: AT91: document EV23X71A board Microchip EV23X71A board is an LAN9696 based evaluation board. Signed-off-by: Robert Marko Acked-by: Conor Dooley Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20260302112153.464422-6-robert.marko@sartura.hr Signed-off-by: Claudiu Beznea commit 1effec9834710ec417861634c32208edcd2fcb2a Author: Robert Marko Date: Mon Mar 2 12:20:12 2026 +0100 arm64: dts: microchip: add LAN969x support Add support for Microchip LAN969x switch SoC series by adding the SoC DTSI. Signed-off-by: Robert Marko Reviewed-by: Claudiu Beznea Acked-by: Daniel Machon Link: https://lore.kernel.org/r/20260302112153.464422-5-robert.marko@sartura.hr Signed-off-by: Claudiu Beznea commit 229eeb0ad913c1bb2dd6027e5983d1e4c409abd0 Author: Robert Marko Date: Mon Mar 2 12:20:11 2026 +0100 arm64: dts: microchip: add LAN969x clock header file LAN969x uses hardware clock indexes, so document theses in a header to make them humanly readable. Signed-off-by: Robert Marko Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20260302112153.464422-4-robert.marko@sartura.hr Signed-off-by: Claudiu Beznea commit ade00a6c903f85031061b4e1a45e789b210f9055 Author: Karol Wachowski Date: Wed Mar 18 10:39:27 2026 +0100 accel/ivpu: Perform engine reset instead of device recovery on TDR Replace full device recovery on TDR timeout with per-context abort, allowing individual context handling instead of resetting the entire device. Extend ivpu_jsm_reset_engine() to return the list of contexts impacted by the engine reset and use that information to abort only the affected contexts. Only check for potentially faulty contexts when the engine reset was not triggered by an MMU fault or a job completion error status. This prevents misidentifying non-guilty contexts that happened to be running at the time of the fault. Trigger full device recovery if no contexts were marked by engine reset if triggered by job completion timeout, as there is no way to identify guilty one. Add engine reset counter to debugfs for engine resets bookkeeping for debugging/testing purposes. Reviewed-by: Lizhi Hou Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260318093927.4080303-1-karol.wachowski@linux.intel.com commit 8655a4e35cda5534f93303af393eac4e71704701 Author: Rosen Penev Date: Wed Mar 18 12:12:33 2026 -0700 cpufreq: tegra194: remove COMPILE_TEST The driver needs architecture specific headers to build. Problem gets exposed when TEGRA_BPMP gets COMPILE_TEST added to it. Signed-off-by: Rosen Penev Signed-off-by: Viresh Kumar commit 168e4b208ca8c2e04de20cc6cb7e2fb035dc1ec8 Author: Krzysztof Kozlowski Date: Thu Mar 5 22:45:49 2026 +0100 platform/chrome: cros_usbpd_logger: Simplify with devm Simplify the driver by using devm interfaces, which allow to drop probe() error paths and the remove() callback. Change is not equivalent in the workqueue itself: use non-legacy API which does not set (__WQ_LEGACY | WQ_MEM_RECLAIM). The workqueue is used to update logs, thus there is no point to run it for memory reclaim. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20260305-workqueue-devm-v2-10-66a38741c652@oss.qualcomm.com Signed-off-by: Tzung-Bi Shih commit c98f7d6ac39fed778a425c0ca18b002f6ee5a77a Merge: 27d58498f690ab 1dfc9d60a69ec1 Author: Tzung-Bi Shih Date: Fri Mar 20 02:52:03 2026 +0000 Merge remote-tracking branch 'wq/for-7.1-devm-alloc-wq' Merge branch adding support for device-managed workqueue allocation, which allows cleaning up a chrome-platform driver. Signed-off-by: Tzung-Bi Shih commit 1bf0ba46d9d2c784120fd9cb235c08add3a6e7be Author: Yannis Bolliger Date: Fri Oct 17 19:30:01 2025 +0000 extcon: usbc-tusb320: Make typec-power-opmode optional The driver returned an error in the probe function when a usb c connector is configured in the DT without a "typec-power-opmode" property. This property is used to initialize the CURRENT_MODE_ADVERTISE register of the TUSB320, which is unused when operating as a UFP. Requiring this property causes unnecessary configuration overhead and inconsistency with the USB connector DT bindings, which do not specify it as required. This change makes typec-power-opmode optional. When the property is not present, the driver will skip programming the CURRENT_MODE_ADVERTISE register and rely on the hardware default. Signed-off-by: Yannis Bolliger Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/aPKZJ6WTZlhSOyST@yaene-desktop/ commit 9c98fdec70ec15c46610464366d414df1d6a0bee Author: Xu Yang Date: Fri Sep 26 10:53:09 2025 +0800 extcon: ptn5150: Support USB role switch via connector fwnode Since the PTN5150 is a Type-C chip, it's common to describe related properties under the connector node. To align with this, the port node will be located under the connector node in the future. To support this layout, retrieve the USB role switch using the connector's fwnode. For compatibility with existing device trees, keep the usb_role_switch_get() function. Acked-by: Chanwoo Choi Reviewed-by: Frank Li Signed-off-by: Xu Yang Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20250926025309.24267-3-xu.yang_2@nxp.com/ commit 842546c56345eebc2396927df5b4e933d90de43a Author: Xu Yang Date: Fri Sep 26 10:53:08 2025 +0800 extcon: ptn5150: Add Type-C orientation switch support PTN5150 is able to detect CC polarity. The field[1:0] of CC status register (04H) will keep the result. 00: Cable Not Attached 01: CC1 is connected (normal orientation) 10: CC2 is connected (reversed orientation) 11: Reserved Add orientation switch support to correctly set orientation of multiplexer according to CC status. Acked-by: Chanwoo Choi Reviewed-by: Frank Li Signed-off-by: Xu Yang Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20250926025309.24267-2-xu.yang_2@nxp.com/ commit 086d7f1e063b3f7bbc6c54bbbabf1fa842be289f Author: Xu Yang Date: Fri Sep 26 10:53:07 2025 +0800 dt-bindings: extcon: ptn5150: Allow "connector" node to present PTN5150 is usually used with a Type-C connector, so allow a "connector" node to be defined under it. Acked-by: Chanwoo Choi Acked-by: Rob Herring (Arm) Signed-off-by: Xu Yang Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20250926025309.24267-1-xu.yang_2@nxp.com/ commit 8857f2495a2a37609ac925ab2fcd72104b190499 Author: Michael Wu Date: Fri Oct 24 10:49:46 2025 +0800 extcon: Fixed sysfs duplicate filename issue With current extcon_dev_unregister() timing, ida_free is before device_unregister(), that may cause current id re-alloc to another device in extcon_dev_register() context but sysfs filename path not removal completed yet. The right timing shows below: on extcon_dev_register: ida_alloc() -> device_register() on extcon_dev_unregister: device_unregister() -> ida_free() stack information when an error occurs: sysfs: cannot create duplicate filename '/class/extcon/extcon1' Call trace: sysfs_warn_dup+0x68/0x88 sysfs_do_create_link_sd+0x94/0xdc sysfs_create_link+0x30/0x48 device_add_class_symlinks+0xb4/0x12c device_add+0x1e0/0x48c device_register+0x20/0x34 extcon_dev_register+0x3b8/0x5c4 Fixes: 7bba9e81a6fb ("extcon: Use unique number for the extcon device ID") Acked-by: MyungJoo Ham Reviewed-by: Andy Shevchenko Signed-off-by: Michael Wu Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20251024024946.16618-1-michael@allwinnertech.com/ commit 6a4d20fecc650d0aeeb668cd1be6aa704220e227 Author: Marco Crivellari Date: Tue Nov 4 12:01:05 2025 +0100 extcon: int3496: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20251104110105.116858-1-marco.crivellari@suse.com/ commit 4652fefcda3c604c83d1ae28ede94544e2142f06 Author: Xu Yang Date: Sat Nov 15 10:59:05 2025 +0800 extcon: ptn5150: handle pending IRQ events during system resume When the system is suspended and ptn5150 wakeup interrupt is disabled, any changes on ptn5150 will only be record in interrupt status registers and won't fire an IRQ since its trigger type is falling edge. So the HW interrupt line will keep at low state and any further changes won't trigger IRQ anymore. To fix it, this will schedule a work to check whether any IRQ are pending and handle it accordingly. Fixes: 4ed754de2d66 ("extcon: Add support for ptn5150 extcon driver") Cc: stable@vger.kernel.org Reviewed-by: Krzysztof Kozlowski Acked-by: MyungJoo Ham Signed-off-by: Xu Yang Signed-off-by: Chanwoo Choi Link: https://lore.kernel.org/lkml/20251115025905.1395347-1-xu.yang_2@nxp.com/ commit 48b2de8505437805116a3dc51d5afa09308c6659 Author: Eric Biggers Date: Mon Mar 16 15:36:31 2026 -0700 scsi: lpfc: Use the crc32c() function lpfc_cgn_calc_crc32(data, size, crc) is really just an open-coded version of ~crc32c(bitrev32(crc), data, size). However, all callers pass crc == ~0, so it can be simplified even further to just ~crc32c(~0, data, size). Remove the crc argument and implement it that way. While we're at it, also use proper types in the function prototype. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260316223631.72361-1-ebiggers@kernel.org Signed-off-by: Martin K. Petersen commit 98eff361647ecba893aadce8808729672604a102 Author: vamshi gajjela Date: Wed Mar 11 00:33:08 2026 +0530 scsi: ufs: core: Handle MCQ IAG events Add support for handling aggregation-based interrupts when operating in MCQ mode. In legacy interrupt mode, an IE.IAGES is triggered when the counter or timer threshold is reached. To manage this, the handler now resets the aggregation counter and timer by writing to the MCQIACRy.CTR register. Since the register layout of MCQIACRy is identical to the existing UTRIACR register, this implementation reuses the previously defined bitfield masks to maintain consistency and reduce code duplication. Extend ufshcd_handle_mcq_cq_events() with a boolean iag parameter. If set, the handler resets the MCQ IAG counter and timer. Define MCQ_IAG_EVENT_STATUS (0x200000) and include it in UFSHCD_ENABLE_MCQ_INTRS to ensure the interrupt is unmasked during initialization. Signed-off-by: Vamshi Gajjela Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260310190308.2474956-1-vamshigajjela@google.com Signed-off-by: Martin K. Petersen commit d51f217957ca1fa3a151000e86a192231284595b Author: Alvin1 Chen Date: Thu Mar 19 13:09:38 2026 +0800 drm/panel-edp: Add BOE NV153WUM-N42, CMN N153JCA-ELK, CSW MNF307QS3-2 The raw EDIDs for each panel: BOE: NV153WUM-N42 00 ff ff ff ff ff ff 00 09 e5 b3 0d 00 00 00 00 11 23 01 04 a5 21 15 78 03 af e5 97 5e 58 92 28 1f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 9c 3e 80 c8 70 b0 3c 40 30 20 36 00 49 ce 10 00 00 1a 00 00 00 fd 00 28 3c 4c 4c 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 42 4f 45 20 43 51 0a 20 20 20 20 20 20 00 00 00 fc 00 4e 56 31 35 33 57 55 4d 2d 4e 34 32 0a 01 92 70 20 79 02 00 81 00 15 74 1a 00 00 03 01 28 3c 00 00 60 49 60 49 3c 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cb 90 CMN: N153JCA-ELK 00 ff ff ff ff ff ff 00 0d ae 6b 15 00 00 00 00 16 23 01 04 a5 21 15 78 03 08 82 93 59 53 8e 27 1e 4f 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 42 3c 80 a0 70 b0 24 40 30 20 a6 00 49 cd 10 00 00 1a 00 00 00 fd 00 28 3c 4a 4a 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 43 4d 4e 0a 20 20 20 20 20 20 20 20 20 00 00 00 fc 00 4e 31 35 33 4a 43 41 2d 45 4c 4b 0a 20 01 d5 70 20 79 02 00 25 01 09 94 5a 02 94 5a 02 28 3c 80 81 00 13 72 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ae 90 CSW: MNF307QS3-2 00 ff ff ff ff ff ff 00 0e 77 29 15 00 00 00 00 13 23 01 04 a5 21 15 78 03 9c 81 96 5d 5a 94 28 1e 51 56 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 1a 3f 80 04 71 b0 23 40 30 20 36 00 49 cd 10 00 00 18 00 00 00 fd 00 28 3c 4a 4a 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 43 4f 53 54 20 54 39 0a 20 20 20 20 20 00 00 00 fc 00 4d 4e 46 33 30 37 51 53 33 2d 32 0a 20 01 5c 70 20 79 02 00 81 00 15 74 1a 00 00 03 01 28 3c 00 00 60 46 60 46 3c 00 00 00 00 8d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 90 Signed-off-by: Alvin1 Chen Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260319050938.556235-1-alvin1.chen@lcfc.corp-partner.google.com commit ca7e99335aea7c5977683624ba319157a4603f96 Author: Rafael J. Wysocki Date: Wed Mar 18 14:43:55 2026 +0100 net: fjes: Drop fjes_acpi_driver and rework initialization The ACPI driver interface used by the Fujitsu Extended Socket (fjes) Network Device driver is redundant because its only role is to create a platform device the fjes platform driver can bind to, which can be done already at the module initialization time. Namely, acpi_find_extended_socket_device() looks for the requisite ACPI device object anyway and it may as well check its resources, and the platform device can be created when the ACPI object in question has been found (and it can be freed when the module is unloaded). Moreover, as a rule, it is better to avoid binding drivers directly to ACPI device objects [1]. Accordingly, drop fjes_acpi_driver, adjust the module initialization and exit code as per the above and set the fwnode for the fjes platform device to point to the corresponding ACPI device object as its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Simon Horman Link: https://patch.msgid.link/12857407.O9o76ZdvQC@rafael.j.wysocki Signed-off-by: Jakub Kicinski commit b56fae3328faeef3e3e7ff286253af3bffe9b584 Merge: b29580d58be6d4 6b4286e0550814 Author: Jakub Kicinski Date: Thu Mar 19 17:18:53 2026 -0700 Merge branch 'net-stmmac-descriptor-cleanups-part-2' Russell King says: ==================== net: stmmac: descriptor cleanups part 2 Part 2 of the stmmac descriptor cleanups. - rename "priv->mode" to be more descriptive, and do the same in function arguments. - simplify descriptor allocation/initialisation/freeing - use more descriptive local variable names in stmmac_xmit() - STMMAC_GET_ENTRY() doesn't get an entry, it moves to the next one. Describe this in the macro name. ==================== Link: https://patch.msgid.link/abruRQpjLyMkoUEP@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6b4286e0550814cdc4b897f881ec1fa8b0313227 Author: Russell King (Oracle) Date: Wed Mar 18 18:26:54 2026 +0000 net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() STMMAC_GET_ENTRY() doesn't describe what this macro is doing - it is incrementing the provided index for the circular array of descriptors. Replace "GET" with "NEXT" as this better describes the action here. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w2vba-0000000DbWo-1oL5@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b4df951549ddd44ebee4ef3cd7491ed57343fd25 Author: Russell King (Oracle) Date: Wed Mar 18 18:26:49 2026 +0000 net: stmmac: use more descriptive names in stmmac_xmit() Use "frag_size" rather than "len", correcting its type to be unsigned int. Rename "des" to "dma_addr" since that's what it is. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w2vbV-0000000DbWi-1O80@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e73b19baa3b1c8eb909d0990e32c8d596b52be53 Author: Russell King (Oracle) Date: Wed Mar 18 18:26:44 2026 +0000 net: stmmac: simplify DMA descriptor allocation/init/freeing Rather than having separate branches to handle the different types of descriptors, use the helper functions to calculate the total size of the DMA descriptors. Use this to allocate or free the descriptor array, and use a local variable to hold the address of the descriptor array, so we only need one dma_alloc_coherent() or dma_free_coherent() call in these paths. Also do the same for the receive ring initialisation. The transmit ring can't be converted as there is a case where stmmac_mode_init() is not called. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w2vbQ-0000000DbWc-0ty5@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 33be7846e4bebb44fb0c09ee92e99cdd111558fd Author: Russell King (Oracle) Date: Wed Mar 18 18:26:39 2026 +0000 net: stmmac: more mode -> descriptor_mode renames Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w2vbL-0000000DbWW-0PON@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1939749ce92dd47f55f1318522f4b8f6b46e13aa Author: Russell King (Oracle) Date: Wed Mar 18 18:26:33 2026 +0000 net: stmmac: rename "mode" to "descriptor_mode" priv->mode doesn't describe what it refers to, it is whether we operate the DMA descriptors as a ring or chain. It is also difficult to grep for as there are several "mode" struct members. Add "descriptor_" prefix. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w2vbF-0000000DbWQ-4674@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b29580d58be6d4d24d66c89d9bea96db342cff00 Author: Oskar Ray-Frayssinet Date: Wed Mar 18 22:11:53 2026 +0100 net: ntb_netdev: add SPDX tag and remove boilerplate license text Add SPDX-License-Identifier tag to reflect the dual GPL-2.0-only/BSD-3-Clause license, remove the redundant boilerplate license text and contact information, keeping only the driver description. Signed-off-by: Oskar Ray-Frayssinet Acked-by: Dave Jiang Link: https://patch.msgid.link/20260318211153.9460-1-rayfraytech@gmail.com Signed-off-by: Jakub Kicinski commit 031f090084839ff2454d05e342ec09a6f38f1797 Merge: edab1ca5ec6fff 7dae8ffb0987f8 Author: Jakub Kicinski Date: Thu Mar 19 16:57:30 2026 -0700 Merge branch 'selftests-drv-net-driver-tests-for-hw-gro' Jakub Kicinski says: ==================== selftests: drv-net: driver tests for HW GRO Add tests for HW GRO stats, packet ordering and depth. The ynltool and bnxt patches from v2 were applied separately. ==================== Link: https://patch.msgid.link/20260318033819.1469350-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7dae8ffb0987f802bf4fabad987e69913ffd82e8 Author: Jakub Kicinski Date: Tue Mar 17 20:38:19 2026 -0700 selftests: drv-net: gro: add a test for GRO depth Reuse the long sequence test to max out the GRO contexts. Repeat for a single queue, 8 queues, and default number of queues but flow steering to just one. The SW GRO's capacity should be around 64 per queue (8 buckets, up to 8 skbs in a chain). Link: https://patch.msgid.link/20260318033819.1469350-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ff1cb3ad2abce4d03eaf3e8d5f38a7a5dfd36e79 Author: Jakub Kicinski Date: Tue Mar 17 20:38:18 2026 -0700 selftests: drv-net: gro: add test for packet ordering Add a test to check if the NIC reorders packets if the hit GRO. Link: https://patch.msgid.link/20260318033819.1469350-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ba5d4128fca8d141cced21f7ed10d14582cd5c1c Author: Jakub Kicinski Date: Tue Mar 17 20:38:17 2026 -0700 selftests: drv-net: gro: test GRO stats Test accuracy of GRO stats. We want to cover two potentially tricky cases: - single segment GRO - packets which were eligible but didn't get GRO'd The first case is trivial, teach gro.c to send one packet, and check GRO stats didn't move. Second case requires gro.c to send a lot of flows expecting the NIC to run out of GRO flow capacity. To avoid system traffic noise we steer the packets to a dedicated queue and operate on qstat. Link: https://patch.msgid.link/20260318033819.1469350-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f26d43acf12f914e4562b6cf17f93af3d4a594a0 Author: Jakub Kicinski Date: Tue Mar 17 20:38:16 2026 -0700 selftests: drv-net: gro: use SO_TXTIME to schedule packets together Longer packet sequence tests are quite flaky when the test is run over a real network. Try to avoid at least the jitter on the sender side by scheduling all the packets to be sent at once using SO_TXTIME. Use hardcoded tx time of 5msec in the future. In my test increasing this time past 2msec makes no difference so 5msec is plenty of margin. Since we now expect more output buffering make sure to raise SNDBUF. Note that this is an opportunistic reliability improvement which will only work if the qdisc can schedule Tx time for us (fq). Fiddling with qdisc config was deemed too complex, so it's not part of the patch. Reviewed-by: Willem de Bruijn Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260318033819.1469350-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9b29afa1166088ca4e8223857508f2a19d88b58b Author: Jakub Kicinski Date: Tue Mar 17 20:38:15 2026 -0700 selftests: drv-net: give HW stats sync time extra 25% of margin There are transient failures for devices which update stats periodically, especially if it's the FW DMA'ing the stats rather than host periodic work querying the FW. Wait 25% longer than strictly necessary. For devices which don't report stats-block-usecs we retain 25 msec as the default wait time (0.025sec == 20,000usec * 1.25). Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260318033819.1469350-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8888bf4fb98057a93f3ac7392aa3913e1b318c86 Author: Jakub Kicinski Date: Tue Mar 17 20:38:14 2026 -0700 selftests: net: move gro to lib for HW vs SW reuse The gro.c packet sender is used for SW testing but bulk of incoming new tests will be HW-specific. So it's better to put them under drivers/net/hw/, to avoid tip-toeing around netdevsim. Move gro.c to lib so we can reuse it. Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260318033819.1469350-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 08e392059b7554e30435b477cd059117fcc165ec Author: Krzysztof Kozlowski Date: Mon Feb 16 09:58:26 2026 +0100 i2c: npcm7xx: Use NULL instead of 0 for pointer Pointers should use NULL instead of explicit '0', as pointed out by sparse: i2c-npcm7xx.c:1387:61: warning: Using plain integer as NULL pointer Signed-off-by: Krzysztof Kozlowski Reviewed-by: Paul Menzel Reviewed-by: Tali Perry Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260216085825.70568-2-krzysztof.kozlowski@oss.qualcomm.com commit e61af3ca893363838f263f3528476f6e1faed9aa Author: Rosen Penev Date: Wed Mar 18 12:10:37 2026 -0700 hsi: hsi_core: use kzalloc_flex Simplifies allocations by using a flexible array member in this struct. Add __counted_by to get extra runtime analysis. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260318191037.5661-1-rosenp@gmail.com Signed-off-by: Sebastian Reichel commit f15dbe8a94b6e3768b10e10bf8ab95b28682db80 Author: Nicholas Sielicki Date: Sat Mar 7 03:00:10 2026 -0600 docs: symbol-namespaces: mention sysfs attribute Reference the new /sys/module/*/import_ns sysfs attribute in docs as an alternative to modinfo for inspecting imported namespaces of loaded modules. Signed-off-by: Nicholas Sielicki Signed-off-by: Sami Tolvanen commit 3fe1dcbc2d20c5dbc581c0bb458e05365bfffcf7 Author: Nicholas Sielicki Date: Sat Mar 7 03:00:09 2026 -0600 module: expose imported namespaces via sysfs Add /sys/module/*/import_ns to expose imported namespaces for currently loaded modules. The file contains one namespace per line and only exists for modules that import at least one namespace. Previously, the only way for userspace to inspect the symbol namespaces a module imports is to locate the .ko on disk and invoke modinfo(8) to decompress/parse the metadata. The kernel validated namespaces at load time, but it was otherwise discarded. Exposing this data via sysfs provides a runtime mechanism to verify which namespaces are being used by modules. For example, this allows userspace to audit driver API access in Android GKI, which uses symbol namespaces to restrict vendor drivers from using specific kernel interfaces (e.g., direct filesystem access). Signed-off-by: Nicholas Sielicki [Sami: Updated the commit message to explain motivation.] Signed-off-by: Sami Tolvanen commit 584d752b8a1f0ee3a7d5a831e55623c10e7ca0ee Author: Sohil Mehta Date: Mon Mar 9 11:10:29 2026 -0700 x86/cpu: Remove LASS restriction on vsyscall emulation Vsyscall emulation has two modes of operation: XONLY and EMULATE. The default XONLY mode is now supported with a LASS-triggered #GP. OTOH, LASS is disabled if someone requests the deprecated EMULATE mode via the vsyscall=emulate command line option. So, remove the restriction on LASS when the overall vsyscall emulation support is compiled in. As a result, there is no need for setup_lass() anymore. LASS is enabled by default through a late_initcall(). Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: Dave Hansen Reviewed-by: H. Peter Anvin (Intel) Reviewed-by: Tested-by: Maciej Wieczor-Retman Link: https://patch.msgid.link/20260309181029.398498-6-sohil.mehta@intel.com commit b36d1f53d90c869d5f02fe0d8603f825013e746e Author: Sohil Mehta Date: Mon Mar 9 11:10:28 2026 -0700 x86/vsyscall: Disable LASS if vsyscall mode is set to EMULATE The EMULATE mode of vsyscall maps the vsyscall page with a high kernel address directly into user address space. Reading the vsyscall page in EMULATE mode would cause LASS to trigger a #GP. Fixing the LASS violation in EMULATE mode would require complex instruction decoding because the resulting #GP does include the necessary error information, and the vsyscall address is not readily available in the RIP. The EMULATE mode has been deprecated since 2022 and can only be enabled using the command line parameter vsyscall=emulate. See commit bf00745e7791 ("x86/vsyscall: Remove CONFIG_LEGACY_VSYSCALL_EMULATE") for details. At this point, no one is expected to be using this insecure mode. The rare usages that need it obviously do not care about security. Disable LASS when EMULATE mode is requested to avoid breaking legacy user software. Also, update the vsyscall documentation to reflect this. LASS will only be supported if vsyscall mode is set to XONLY (default) or NONE. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: Dave Hansen Reviewed-by: H. Peter Anvin (Intel) Tested-by: Maciej Wieczor-Retman Link: https://patch.msgid.link/20260309181029.398498-5-sohil.mehta@intel.com commit 8376b503b0f18d7425b42621798518e61e2ea601 Author: Sohil Mehta Date: Mon Mar 9 11:10:27 2026 -0700 x86/vsyscall: Restore vsyscall=xonly mode under LASS Background ========== The vsyscall page is located in the high/kernel part of the address space. Prior to LASS, a vsyscall page access from userspace would always generate a #PF. The kernel emulates the accesses in the #PF handler and returns the appropriate values to userspace. Vsyscall emulation has two modes of operation, specified by the vsyscall={xonly, emulate} kernel command line option. The vsyscall page behaves as execute-only in XONLY mode or read-execute in EMULATE mode. XONLY mode is the default and the only one expected to be commonly used. The EMULATE mode has been deprecated since 2022 and is considered insecure. With LASS, a vsyscall page access triggers a #GP instead of a #PF. Currently, LASS is only enabled when all vsyscall modes are disabled. LASS with XONLY mode ==================== Now add support for LASS specifically with XONLY vsyscall emulation. For XONLY mode, all that is needed is the faulting RIP, which is trivially available regardless of the type of fault. Reuse the #PF emulation code during the #GP when the fault address points to the vsyscall page. As multiple fault handlers will now be using the emulation code, add a sanity check to ensure that the fault truly happened in 64-bit user mode. LASS with EMULATE mode ====================== Supporting vsyscall=emulate with LASS is much harder because the #GP doesn't provide enough error information (such as PFEC and CR2 as in case of a #PF). So, complex instruction decoding would be required to emulate this mode in the #GP handler. This isn't worth the effort as remaining users of EMULATE mode can be reasonably assumed to be niche users, who are already trading off security for compatibility. LASS and vsyscall=emulate will be kept mutually exclusive for simplicity. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: H. Peter Anvin (Intel) Tested-by: Maciej Wieczor-Retman Link: https://patch.msgid.link/20260309181029.398498-4-sohil.mehta@intel.com commit 4e57fdd11083d5cd44febc4b6613777291ec936e Author: Sohil Mehta Date: Mon Mar 9 11:10:26 2026 -0700 x86/traps: Consolidate user fixups in the #GP handler Move the UMIP exception fixup under the common "if (user_mode(regs))" condition where the rest of user mode fixups reside. Also, move the UMIP feature check into its fixup function to keep the calling code consistent and clean. No functional change intended. Suggested-by: Dave Hansen Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: H. Peter Anvin (Intel) Acked-by: Dave Hansen Tested-by: Maciej Wieczor-Retman Link: https://patch.msgid.link/20260309181029.398498-3-sohil.mehta@intel.com commit 3ddd2e12c704f22c28efb714817c88ee4e25688a Author: Sohil Mehta Date: Mon Mar 9 11:10:25 2026 -0700 x86/vsyscall: Reorganize the page fault emulation code With LASS, vsyscall page accesses will cause a #GP instead of a #PF. Separate out the core vsyscall emulation code from the #PF specific handling in preparation for the upcoming #GP emulation. No functional change intended. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: H. Peter Anvin (Intel) Acked-by: Dave Hansen Tested-by: Maciej Wieczor-Retman Link: https://patch.msgid.link/20260309181029.398498-2-sohil.mehta@intel.com commit ca76fb67ebdd5e1a30a242d06dc096fddd670734 Author: Ian Rogers Date: Wed Mar 18 16:46:00 2026 -0700 perf evlist: Improve default event for s390 Frame pointer callchains are not supported on s390 and dwarf callchains are only supported on software events. Switch the default event from the hardware 'cycles' event to the software 'cpu-clock' or 'task-clock' on s390 if callchains are enabled. Move some of the target initialization earlier in builtin-top and builtin-record, so it is ready for use by evlist__new_default. If frame pointer callchains are requested on s390 show a warning. Modify the '-g' option of `perf top` and `perf record` to default to dwarf callchains on s390. Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit c006753c3aae432efda28d5aaea4b8fec0343da8 Author: Ian Rogers Date: Wed Mar 18 16:45:59 2026 -0700 perf callchain: Refactor callchain option parsing record_opts__parse_callchain is shared by builtin-record and builtin-trace, it is declared in callchain.h. Move the declaration to callchain.c for consistency with the header. In other cases make the option callback a small static stub that then calls into callchain.c. Make the no argument '-g' callchain option just a short-cut for '--call-graph fp' so that there is consistency in how the arguments are handled. This requires the const char* string to be strdup-ed in __parse_callchain_report_opt. For consistency also make parse_callchain_record use strdup and remove some unnecessary casts. Also, be more explicit about the '-g' behavior if there is a .perfconfig file setting. Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit 443556be8adc59126624eccd41f4150ec0e5a11a Author: Ian Rogers Date: Wed Mar 18 16:45:58 2026 -0700 perf evsel: Constify option arguments to config functions The options are used to configure the evsel but are not themselves configured. Make the arguments const to better capture this. Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit 8ebb69e549aa900cb51c0876c4f6ea03e5ece438 Author: Ian Rogers Date: Wed Mar 18 16:45:57 2026 -0700 perf target: Constify simple check functions Allow the target to be const in callers. Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit d84db579d75fd32ea6dd7814c8cf6b1c8b45ac05 Author: Ian Rogers Date: Wed Mar 18 16:45:56 2026 -0700 perf evsel: Improve falling back from cycles Switch to using evsel__match rather than comparing perf_event_attr values, this is robust on hybrid architectures. Ensure evsel->pmu matches the evsel->core.attr. Remove exclude bits that get set in other fallback attempts when switching the event. Log the event name with modifiers when switching the event on fallback. Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit a90407a5a89a29f3c4af89e55afe4d0489b8a81c Author: Zecheng Li Date: Mon Mar 9 13:55:24 2026 -0400 perf dwarf-aux: Collect all variable locations for insn tracking Previously, only the first DWARF location entry was collected for each variable. This was based on the assumption that instruction tracking could reconstruct the remaining state. However, variables may have different locations across different address ranges, and relying solely on instruction tracking can miss valid type information. Change __die_collect_vars_cb() to iterate over all location entries using dwarf_getlocations() in a loop. This ensures that variables with multiple location ranges are properly tracked, improving type coverage. Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim commit 4fb7eefe6c539840fa8854d67d00af35331b8843 Author: Zecheng Li Date: Mon Mar 9 13:55:23 2026 -0400 perf annotate-data: Use DWARF location ranges to preserve reg state When a function call occurs, caller-saved registers are typically invalidated since the callee may clobber them. However, DWARF debug info provides location ranges that indicate exactly where a variable is valid in a register. Track the DWARF location range end address in type_state_reg and use it to determine if a caller-saved register should be preserved across a call. If the current call address is within the DWARF-specified lifetime of the variable, keep the register state valid instead of invalidating it. This improves type annotation for code where the compiler knows a register value survives across calls (e.g., when the callee is known not to clobber certain registers or when the value is reloaded after the call at the same logical location). Changes: - Add `end` and `has_range` fields to die_var_type to capture DWARF location range information - Add `lifetime_active` and `lifetime_end` fields to type_state_reg - Check location lifetime before invalidating caller-saved registers Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim commit d35b0d5877109ecca106cc3835d4d23ac2cdc33c Author: Zecheng Li Date: Mon Mar 9 13:55:22 2026 -0400 perf annotate-data: Invalidate caller-saved regs for all calls Previously, the x86 call handler returned early without invalidating caller-saved registers when the call target symbol could not be resolved (func == NULL). This violated the ABI which requires caller-saved registers to be considered clobbered after any call instruction. Fix this by: 1. Always invalidating caller-saved registers for any call instruction (except __fentry__ which preserves registers) 2. Using dl->ops.target.name as fallback when func->name is unavailable, allowing return type lookup for more call targets This is a conservative change that may reduce type coverage for indirect calls (e.g., callq *(%rax)) where we cannot determine the return type but it ensures correctness. Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim commit 22b320777c5f496a36867f16f18870e67b123020 Author: Zecheng Li Date: Mon Mar 9 13:55:21 2026 -0400 perf annotate-data: Add invalidate_reg_state() helper for x86 Add a helper function to consistently invalidate register state instead of field assignments. This ensures kind, ok, and copied_from are all properly cleared when a register becomes invalid. The helper sets: - kind = TSR_KIND_INVALID - ok = false - copied_from = -1 Replace all invalidation patterns with calls to this helper. No functional change and this removes some incorrect annotations that were caused by incomplete invalidation (e.g. a obsolete copied_from from an invalidated register). Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim commit 1b8db0c963bf788392976bea87f0ef8d227c4930 Author: Zecheng Li Date: Mon Mar 9 13:55:20 2026 -0400 perf annotate-data: Handle global variable access with const register When a register holds a constant value (TSR_KIND_CONST) and is used with a negative offset, treat it as a potential global variable access instead of falling through to CFA (frame) handling. This fixes cases like array indexing with computed offsets: movzbl -0x7d72725a(%rax), %eax # array[%rax] Where %rax contains a computed index and the negative offset points to a global array. Previously this fell through to the CFA path which doesn't handle global variables, resulting in "no type information". The fix redirects such accesses to check_kernel which calls get_global_var_type() to resolve the type from the global variable cache. This is only done for kernel DSOs since the pattern relies on kernel-specific global variable resolution. We could also treat registers with integer types to the global variable path, but this requires more changes. Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim commit 752e662ae0619721ddde6f60a84fbe3c669fc539 Author: Zecheng Li Date: Mon Mar 9 13:55:19 2026 -0400 perf annotate-data: Collect global variables without name Previously, global_var__collect() required get_global_var_info() to succeed (i.e., the variable must have a symbol name) before caching a global variable. This prevented variables that exist in DWARF but lack symbol table coverage from being cached. Remove the symbol table requirement since DW_OP_addr already provides the variable's address directly from DWARF. The symbol table lookup is now optional to obtain the variable name when available. Also remove the var_offset != 0 check, which was intended to skip variables where the access address doesn't match the symbol start. The symbol table lookup is now optional and I found removing this check has no effect on the annotation results for both kernel and userspace programs. Test results show improved annotation coverage especially for userspace programs with RIP-relative addressing instructions. Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim commit 6ffc3d0d3db5fb6c88fcb69eb355e9cc839a860c Author: Zecheng Li Date: Mon Mar 9 13:55:18 2026 -0400 perf dwarf-aux: Handle array types in die_get_member_type When a struct member is an array type, die_get_member_type() would stop iterating since array types weren't handled in the loop. This caused accesses to array elements within structs to not resolve properly. Add array type handling by resolving the array to its element type and calculating the offset within an element using modulo arithmetic This improves type annotation coverage for struct members that are arrays. Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim commit 69953f9c65856fc9438fc2ad4b9fd8255a2e47da Author: Zecheng Li Date: Mon Mar 9 13:55:17 2026 -0400 perf annotate-data: Improve type comparison from different scopes When comparing types from different scopes, first compare their type offsets. A larger offset means the field belongs to an outer (enclosing) struct. This helps resolve cases where a pointer is found in an inner scope, but a struct containing that pointer exists in an outer scope. Previously, is_better_type would prefer the pointer type, but the struct type is actually more complete and should be chosen. Prefer types from outer scopes when is_better_type cannot determine a better type. This is a heuristic for the case `struct A { struct B; }` where A and B have the same size but I think in most cases A is in the outer scope and should be preferred. Signed-off-by: Zecheng Li Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim commit 8b8d8b8f17dfa817e4e94ce4e8f26d92f6f65504 Author: Zecheng Li Date: Mon Mar 9 13:55:16 2026 -0400 perf dwarf-aux: Skip check_variable for variable lookup Both die_find_variable_by_reg and die_find_variable_by_addr call match_var_offset which already performs sufficient checking and type matching. The additional check_variable call is redundant, and its need_pointer logic is only a heuristic. Since DWARF encodes accurate type information, which match_var_offset verifies, skipping check_variable improves both coverage and accuracy. Return the matched type from die_find_variable_by_reg and die_find_variable_by_addr via the existing `type` field in find_var_data, removing the need for check_variable in find_data_type_die. Signed-off-by: Zecheng Li Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim commit ace16303179efad4e1a2aebb27a661e5d1e7277d Author: Zecheng Li Date: Mon Mar 9 13:55:15 2026 -0400 perf dwarf-aux: Preserve typedefs in match_var_offset Preserve typedefs in match_var_offset to match the results by __die_get_real_type. Also move the (offset == 0) branch after the is_pointer check to ensure the correct type is used, fixing cases where an incorrect pointer type was chosen when the access offset was 0. Signed-off-by: Zecheng Li Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim commit 30b2e6fa58f3b9eff86fb851a8926bf814d82dcd Author: Zecheng Li Date: Mon Mar 9 13:55:14 2026 -0400 perf dwarf-aux: Add die_get_pointer_type to get pointer types When a variable type is wrapped in typedef/qualifiers, callers may need to first resolve it to the underlying DW_TAG_pointer_type or DW_TAG_array_type. A simple tag check is not enough and directly calling __die_get_real_type() can stop at the pointer type (e.g. typedef -> pointer) instead of the pointee type. Add die_get_pointer_type() helper that follows typedef/qualifier chains and returns the underlying pointer DIE. Use it in annotate-data.c so pointer checks and dereference work correctly for typedef'd pointers. Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim commit b593c26d081a4fbeabd34badb0a9e9a971a79cb4 Author: Senchuan Zhang Date: Fri Feb 27 19:18:08 2026 +0800 PCI: eswin: Add ESWIN PCIe Root Complex driver Add driver for the ESWIN PCIe Root Complex based on the DesignWare PCIe core, IP revision 5.96a. The PCIe Gen.3 Root Complex supports data rate of 8 GT/s and x4 lanes, with INTx and MSI interrupt capability. Signed-off-by: Yu Ning Signed-off-by: Yanghui Ou Signed-off-by: Senchuan Zhang [mani: renamed "EIC7700" to "ESWIN", added maintainers entry, removed async probe] Signed-off-by: Manivannan Sadhasivam [bhelgaas: add driver tag in subject] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260227111808.1996-1-zhangsenchuan@eswincomputing.com commit 249c48a55856245d5f6dcfd53e1e15fb5d0c467b Author: Senchuan Zhang Date: Fri Feb 27 19:17:32 2026 +0800 dt-bindings: PCI: eswin: Add ESWIN PCIe Root Complex Add Device Tree binding documentation for the ESWIN PCIe Root Complex. The Root Complex is based on Synopsys Designware PCIe IP. Signed-off-by: Yu Ning Signed-off-by: Yanghui Ou Signed-off-by: Senchuan Zhang [mani: Renamed 'EIC7700' to 'ESWIN'] Signed-off-by: Manivannan Sadhasivam [bhelgaas: add driver tag in subject] Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260227111732.1979-1-zhangsenchuan@eswincomputing.com commit edab1ca5ec6fffecbf340e26956ce73e502901d5 Merge: 9ac76f3d0bb294 a1d9d8e833781c Author: Jakub Kicinski Date: Thu Mar 12 12:53:34 2026 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-7.0-rc5). net/netfilter/nft_set_rbtree.c 598adea720b97 ("netfilter: revert nft_set_rbtree: validate open interval overlap") 3aea466a43998 ("netfilter: nft_set_rbtree: don't disable bh when acquiring tree lock") https://lore.kernel.org/abgaQBpeGstdN4oq@sirena.org.uk No adjacent changes. Signed-off-by: Jakub Kicinski commit 4b21ea5024830f5db6826542048541fab757085b Author: Amery Hung Date: Wed Mar 18 15:42:19 2026 -0700 bpf: Add warning to detect memory leak in bpf_selem_unlink_nofail() While very unlikely, local storage theoretically may leak memory of the size of "struct bpf_local_storage" when destroy() fails to grab local_storage->lock and initializes selem->local_storage before other racing map_free() see it. Warn the user to allow debugging the issue instead of leaking the memory silently. Note that test_maps in bpf selftests already stress tested bpf_selem_unlink_nofail() by creating 4096 sockets and then immediately destroying them in multiple threads. With 64 threads, 64 x 4096 socket local storages were created and destroyed during the test and no warning in the function were triggered. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Acked-by: Kumar Kartikeya Dwivedi Link: https://patch.msgid.link/20260318224219.615105-1-ameryhung@gmail.com commit 56f90177573e334532c0f039684e9c759830027a Author: Yishai Hadas Date: Tue Mar 17 18:17:53 2026 +0200 vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO When userspace opts into VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2, the driver may report the VFIO_PRECOPY_INFO_REINIT output flag in response to the VFIO_MIG_GET_PRECOPY_INFO ioctl, along with a new initial_bytes value. The presence of the VFIO_PRECOPY_INFO_REINIT flag indicates to the caller that new initial data is available in the migration stream. If the firmware reports a new initial-data chunk, any previously dirty bytes in memory are treated as initial bytes, since the caller must read both sets before reaching the end of the initial-data region. In this case, the driver issues a new SAVE command to fetch the data and prepare it for a subsequent read() from userspace. Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20260317161753.18964-7-yishaih@nvidia.com Signed-off-by: Alex Williamson commit bd0da611312b94f34b0e2b7342fdbd0431851347 Author: Yishai Hadas Date: Tue Mar 17 18:17:52 2026 +0200 vfio/mlx5: consider inflight SAVE during PRE_COPY Consider an inflight SAVE operation during the PRE_COPY phase, so the caller will wait when no data is currently available but is expected to arrive. This enables a follow-up patch to avoid returning -ENOMSG while a new *initial_bytes* chunk is still pending from an asynchronous SAVE command issued by the VFIO_MIG_GET_PRECOPY_INFO ioctl. Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20260317161753.18964-6-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 4bee09a5dbd14e3369926b14b4ee14e22ebfc1f6 Author: Yishai Hadas Date: Tue Mar 17 18:17:51 2026 +0200 net/mlx5: Add IFC bits for migration state Add the relevant IFC bits for querying an extra migration state from the device. Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20260317161753.18964-5-yishaih@nvidia.com Signed-off-by: Alex Williamson commit c995498636c704641c9e809c31b59445b48f7adc Author: Yishai Hadas Date: Tue Mar 17 18:17:50 2026 +0200 vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl Introduce a core helper function for VFIO_MIG_GET_PRECOPY_INFO and adapt all drivers to use it. It centralizes the common code and ensures that output flags are cleared on entry, in case user opts in to VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2. This preventing any unintended echoing of userspace data back to userspace. Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20260317161753.18964-4-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 50ff3f404617c5d15832fec3711978104c4c9efd Author: Yishai Hadas Date: Tue Mar 17 18:17:49 2026 +0200 vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 Currently, existing VFIO_MIG_GET_PRECOPY_INFO implementations don't assign info.flags before copy_to_user(). Because they copy the struct in from userspace first, this effectively echoes userspace-provided flags back as output, preventing the field from being used to report new reliable data from the drivers. Add support for a new device feature named VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2. On SET, enables the v2 pre_copy_info behaviour, where the vfio_precopy_info.flags is a valid output field. Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20260317161753.18964-3-yishaih@nvidia.com Signed-off-by: Alex Williamson commit d7140b5dde459048da52cfc0494228055f7e2fb8 Author: Yishai Hadas Date: Tue Mar 17 18:17:48 2026 +0200 vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase As currently defined, initial_bytes is monotonically decreasing and precedes dirty_bytes when reading from the saving file descriptor. The transition from initial_bytes to dirty_bytes is unidirectional and irreversible. The initial_bytes are considered as critical data that is highly recommended to be transferred to the target as part of PRE_COPY, without this data, the PRE_COPY phase would be ineffective. We come to solve the case when a new chunk of critical data is introduced during the PRE_COPY phase and the driver would like to report an entirely new value for the initial_bytes. For that, we extend the VFIO_MIG_GET_PRECOPY_INFO ioctl with an output flag named VFIO_PRECOPY_INFO_REINIT to allow drivers reporting a new initial_bytes value during the PRE_COPY phase. Currently, existing VFIO_MIG_GET_PRECOPY_INFO implementations don't assign info.flags before copy_to_user(), this effectively echoes userspace-provided flags back as output, preventing the field from being used to report new reliable data from the drivers. Reliable use of the new VFIO_PRECOPY_INFO_REINIT flag requires userspace to explicitly opt in by enabling the VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 device feature. When the caller opts in, the driver may report an entirely new value for initial_bytes. It may be larger, it may be smaller, it may include the previous unread initial_bytes, it may discard the previous unread initial_bytes, up to the driver logic and state. The presence of the VFIO_PRECOPY_INFO_REINIT output flag set by the driver indicates that new initial data is present on the stream. Once the caller sees this flag, the initial_bytes value should be re-evaluated relative to the readiness state for transition to STOP_COPY. Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20260317161753.18964-2-yishaih@nvidia.com Signed-off-by: Alex Williamson commit 4f42d716707654134789a0205a050b0d022be948 Author: Manish Honap Date: Tue Mar 17 10:44:02 2026 +0530 vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set() C does not permit an initialiser expression on a variable-length array (C99 Section 6.7.9 constraint: "The type of the entity to be initialized shall not be a variable length array type"). vfio_pci_irq_set() declared: u8 buf[sizeof(struct vfio_irq_set) + sizeof(int) * count] = {}; where `count` is a runtime function parameter, making `buf` a VLA. GCC rejects this with (tried with GCC-9.4.0): error: variable-sized object may not be initialized Fix by removing the `= {}` initialiser and inserting an explicit memset() immediately after the declaration. memset() on a VLA is perfectly legal and achieves the same zero-initialisation on all conforming C implementations. Fixes: 19faf6fd969c ("vfio: selftests: Add a helper library for VFIO selftests") Cc: stable@vger.kernel.org Reviewed-by: Dave Jiang Reviewed-by: David Matlack Signed-off-by: Manish Honap Link: https://lore.kernel.org/r/20260317051402.3725670-1-mhonap@nvidia.com Signed-off-by: Alex Williamson commit 02256acf1e81e42f6338a39020bf2de9807c33d7 Author: Joseph Salisbury Date: Mon Mar 16 14:56:17 2026 -0400 vfio: uapi: fix comment typo The file contains a spelling error in a source comment (succes). Typos in comments reduce readability and make text searches less reliable for developers and maintainers. Replace 'succes' with 'success' in the affected comment. This is a comment-only cleanup and does not change behavior. Signed-off-by: Joseph Salisbury Link: https://lore.kernel.org/r/20260316185617.166414-1-joseph.salisbury@oracle.com Signed-off-by: Alex Williamson commit 06ed87b3197e9b80dccac0b764fdffe44192e010 Author: Jori Koolstra Date: Sun Mar 8 22:49:39 2026 +0100 vfio: mdev: replace mtty_dev->vd_class with a const struct class The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Replace mtty_dev->vd_class with a const struct class and drop the class_create() call. Compile tested and found no errors/warns in dmesg after enabling CONFIG_VFIO and CONFIG_SAMPLE_VFIO_MDEV_MTTY. Link: https://lore.kernel.org/all/2023040244-duffel-pushpin-f738@gregkh/ Suggested-by: Greg Kroah-Hartman Signed-off-by: Jori Koolstra Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20260308214939.1215682-1-jkoolstra@xs4all.nl Signed-off-by: Alex Williamson commit 350de5b8a9befaa2a68861c51f671d4f5f751ca5 Author: Amery Hung Date: Wed Mar 18 19:57:16 2026 -0700 bpf: Do not allow deleting local storage in NMI Currently, local storage may deadlock when deferring freeing selem or local storage through kfree_rcu(), call_rcu() or call_rcu_tasks_trace() in NMI or reentrant. Since deleting selem in NMI is an unlikely use case, partially mitigate it by returning error when calling from bpf_xxx_storage_delete() helpers in NMI. Note that, it is still possible to deadlock through reentrant. A full mitigation requires returning error when irqs_disabled() is true, which, however is too heavy-handed for bpf_xxx_storage_delete(). The long-term solution requires _nolock versions of call_rcu. Another possible solution is to defer the free through irq_work [0], but it would grow the size of selem, which is non-ideal. The check is only needed in bpf_selem_unlink(), which is used by helpers and syscalls. bpf_selem_unlink_nofail() is fine as it is called during map and owner tear down that never run in NMI or reentrant. [0] https://lore.kernel.org/bpf/20260205190233.912-1-alexei.starovoitov@gmail.com/ Fixes: a10787e6d58c ("bpf: Enable task local storage for tracing programs") Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Acked-by: Kumar Kartikeya Dwivedi Link: https://patch.msgid.link/20260319025716.2361065-1-ameryhung@gmail.com commit ce29261ec6482de54320c03398eb30e9615aee40 Author: Sascha Bischoff Date: Thu Mar 19 16:00:21 2026 +0000 KVM: arm64: selftests: Add no-vgic-v5 selftest Now that GICv5 is supported, it is important to check that all of the GICv5 register state is hidden from a guest that doesn't create a vGICv5. Rename the no-vgic-v3 selftest to no-vgic, and extend it to check GICv5 system registers too. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-42-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 0a9f38bf612b195e04236d366ed9f769ce14cc27 Author: Sascha Bischoff Date: Thu Mar 19 16:00:06 2026 +0000 KVM: arm64: selftests: Introduce a minimal GICv5 PPI selftest This basic selftest creates a vgic_v5 device (if supported), and tests that one of the PPI interrupts works as expected with a basic single-vCPU guest. Upon starting, the guest enables interrupts. That means that it is initialising all PPIs to have reasonable priorities, but marking them as disabled. Then the priority mask in the ICC_PCR_EL1 is set, and interrupts are enable in ICC_CR0_EL1. At this stage the guest is able to receive interrupts. The architected SW_PPI (64) is enabled and KVM_IRQ_LINE ioctl is used to inject the state into the guest. The guest's interrupt handler has an explicit WFI in order to ensure that the guest skips WFI when there are pending and enabled PPI interrupts. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-41-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit d51c978b7d3e143381f871d28d8a0437d446b51b Author: Sascha Bischoff Date: Thu Mar 19 15:59:50 2026 +0000 KVM: arm64: gic-v5: Communicate userspace-driveable PPIs via a UAPI GICv5 systems will likely not support the full set of PPIs. The presence of any virtual PPI is tied to the presence of the physical PPI. Therefore, the available PPIs will be limited by the physical host. Userspace cannot drive any PPIs that are not implemented. Moreover, it is not desirable to expose all PPIs to the guest in the first place, even if they are supported in hardware. Some devices, such as the arch timer, are implemented in KVM, and hence those PPIs shouldn't be driven by userspace, either. Provided a new UAPI: KVM_DEV_ARM_VGIC_GRP_CTRL => KVM_DEV_ARM_VGIC_USERPSPACE_PPIs This allows userspace to query which PPIs it is able to drive via KVM_IRQ_LINE. Additionally, introduce a check in kvm_vm_ioctl_irq_line() to reject any PPIs not in the userspace mask. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-40-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit eb3c4d2c9a4d76b775a9dbd5ac056d1abf0083a1 Author: Sascha Bischoff Date: Thu Mar 19 15:59:35 2026 +0000 Documentation: KVM: Introduce documentation for VGICv5 Now that it is possible to create a VGICv5 device, provide initial documentation for it. At this stage, there is little to document. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-39-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 9b7aa05533f1bd170211fb6ee5812d9e736492ef Author: Sascha Bischoff Date: Thu Mar 19 15:59:19 2026 +0000 KVM: arm64: gic-v5: Probe for GICv5 device The basic GICv5 PPI support is now complete. Allow probing for a native GICv5 rather than just the legacy support. The implementation doesn't support protected VMs with GICv5 at this time. Therefore, if KVM has protected mode enabled the native GICv5 init is skipped, but legacy VMs are allowed if the hardware supports it. At this stage the GICv5 KVM implementation only supports PPIs, and doesn't interact with the host IRS at all. This means that there is no need to check how many concurrent VMs or vCPUs per VM are supported by the IRS - the PPI support only requires the CPUIF. The support is artificially limited to VGIC_V5_MAX_CPUS, i.e. 512, vCPUs per VM. With this change it becomes possible to run basic GICv5-based VMs, provided that they only use PPIs. Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Reviewed-by: Joey Gouly Link: https://patch.msgid.link/20260319154937.3619520-38-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit a8946fde86f860c3a94dca4ee71fe04a7a519da1 Author: Sascha Bischoff Date: Thu Mar 19 15:59:04 2026 +0000 KVM: arm64: gic-v5: Set ICH_VCTLR_EL2.En on boot This control enables virtual HPPI selection, i.e., selection and delivery of interrupts for a guest (assuming that the guest itself has opted to receive interrupts). This is set to enabled on boot as there is no reason for disabling it in normal operation as virtual interrupt signalling itself is still controlled via the HCR_EL2. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-37-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 37a25294682d28ef3bd131566602450a72c4d839 Author: Sascha Bischoff Date: Thu Mar 19 15:58:48 2026 +0000 KVM: arm64: gic-v5: Introduce kvm_arm_vgic_v5_ops and register them Only the KVM_DEV_ARM_VGIC_GRP_CTRL->KVM_DEV_ARM_VGIC_CTRL_INIT op is currently supported. All other ops are stubbed out. Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-36-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 61d4ad518312ecddef2331ea3d22902b4eac0e0a Author: Sascha Bischoff Date: Thu Mar 19 15:58:33 2026 +0000 KVM: arm64: gic-v5: Hide FEAT_GCIE from NV GICv5 guests Currently, NV guests are not supported with GICv5. Therefore, make sure that FEAT_GCIE is always hidden from such guests. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-35-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 5aefaf11f9af5d58257ad3d0c71c447a41963069 Author: Sascha Bischoff Date: Thu Mar 19 15:58:17 2026 +0000 KVM: arm64: gic: Hide GICv5 for protected guests We don't support running protected guest with GICv5 at the moment. Therefore, be sure that we don't expose it to the guest at all by actively hiding it when running a protected guest. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-34-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 7c31c06e2d2d75859d773ba940e56d1db2bd1fcd Author: Sascha Bischoff Date: Thu Mar 19 15:58:01 2026 +0000 KVM: arm64: gic-v5: Mandate architected PPI for PMU emulation on GICv5 Make it mandatory to use the architected PPI when running a GICv5 guest. Attempts to set anything other than the architected PPI (23) are rejected. Additionally, KVM_ARM_VCPU_PMU_V3_INIT is relaxed to no longer require KVM_ARM_VCPU_PMU_V3_IRQ to be called for GICv5-based guests. In this case, the architectued PPI is automatically used. Documentation is bumped accordingly. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Reviewed-by: Joey Gouly Link: https://patch.msgid.link/20260319154937.3619520-33-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 9491c63b6cd7bdae97cd29c7c6bf400adbd3578f Author: Sascha Bischoff Date: Thu Mar 19 15:57:45 2026 +0000 KVM: arm64: gic-v5: Enlighten arch timer for GICv5 Now that GICv5 has arrived, the arch timer requires some TLC to address some of the key differences introduced with GICv5. For PPIs on GICv5, the queue_irq_unlock irq_op is used as AP lists are not required at all for GICv5. The arch timer also introduces an irq_op - get_input_level. Extend the arch-timer-provided irq_ops to include the PPI op for vgic_v5 guests. When possible, DVI (Direct Virtual Interrupt) is set for PPIs when using a vgic_v5, which directly inject the pending state into the guest. This means that the host never sees the interrupt for the guest for these interrupts. This has three impacts. * First of all, the kvm_cpu_has_pending_timer check is updated to explicitly check if the timers are expected to fire. * Secondly, for mapped timers (which use DVI) they must be masked on the host prior to entering a GICv5 guest, and unmasked on the return path. This is handled in set_timer_irq_phys_masked. * Thirdly, it makes zero sense to attempt to inject state for a DVI'd interrupt. Track which timers are direct, and skip the call to kvm_vgic_inject_irq() for these. The final, but rather important, change is that the architected PPIs for the timers are made mandatory for a GICv5 guest. Attempts to set them to anything else are actively rejected. Once a vgic_v5 is initialised, the arch timer PPIs are also explicitly reinitialised to ensure the correct GICv5-compatible PPIs are used - this also adds in the GICv5 PPI type to the intid. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-32-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 91d940cd678d3c394c845cd64081113167d700d2 Author: Sascha Bischoff Date: Thu Mar 19 15:57:30 2026 +0000 irqchip/gic-v5: Introduce minimal irq_set_type() for PPIs GICv5 does not support configuring the handling mode or trigger mode of PPIs at runtime - these choices are made at implementation time, and most of the architected PPIs have an architected handling mode (as reported in the ICH_PPI_HMRn_EL1 registers). As chip->set_irq_type() is optional, this has not been implemented for GICv5 PPIs as it served no real purpose. However, although the set_irq_type() function is marked as optional, the lack of it breaks attempts to create a domain hierarchy on top of GICv5's PPI domain. This is due to __irq_set_trigger() calling chip->set_irq_type(), which returns -ENOSYS if the parent domain doesn't implement the set_irq_type() call. In order to make things work, this change introduces a set_irq_type() call for GICv5 PPIs. This performs a basic sanity check (that the hardware's handling mode (Level/Edge) matches what is being set as the type, and does nothing else. This is sufficient to get hierarchical domains working for GICv5 PPIs (such as the one KVM introduces for the arch timer). It has the side benefit (or drawback) that it will catch cases where the firmware description doesn't match what the hardware reports. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-31-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit a3ca7cf9b31715a63c4dd32f3b6209c3bd744988 Author: Sascha Bischoff Date: Thu Mar 19 15:57:14 2026 +0000 KVM: arm64: gic-v5: Initialise ID and priority bits when resetting vcpu Determine the number of priority bits and ID bits exposed to the guest as part of resetting the vcpu state. These values are presented to the guest by trapping and emulating reads from ICC_IDR0_EL1. GICv5 supports either 16- or 24-bits of ID space (for SPIs and LPIs). It is expected that 2^16 IDs is more than enough, and therefore this value is chosen irrespective of the hardware supporting more or not. The GICv5 architecture only supports 5 bits of priority in the CPU interface (but potentially fewer in the IRS). Therefore, this is the default value chosen for the number of priority bits in the CPU IF. Note: We replicate the way that GICv3 uses the num_id_bits and num_pri_bits variables. That is, num_id_bits stores the value of the hardware field verbatim (0 means 16-bits, 1 would mean 24-bits for GICv5), and num_pri_bits stores the actual number of priority bits; the field value + 1. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-30-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit f4d37c7c35769579c51aa5fe00161c690b89811d Author: Sascha Bischoff Date: Thu Mar 19 15:56:59 2026 +0000 KVM: arm64: gic-v5: Create and initialise vgic_v5 Update kvm_vgic_create to create a vgic_v5 device. When creating a vgic, FEAT_GCIE in the ID_AA64PFR2 is only exposed to vgic_v5-based guests, and is hidden otherwise. GIC in ~ID_AA64PFR0_EL1 is never exposed for a vgic_v5 guest. When initialising a vgic_v5, skip kvm_vgic_dist_init as GICv5 doesn't support one. The current vgic_v5 implementation only supports PPIs, so no SPIs are initialised either. The current vgic_v5 support doesn't extend to nested guests. Therefore, the init of vgic_v5 for a nested guest is failed in vgic_v5_init. As the current vgic_v5 doesn't require any resources to be mapped, vgic_v5_map_resources is simply used to check that the vgic has indeed been initialised. Again, this will change as more GICv5 support is merged in. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-29-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit b88d05a893cb7c8a48d03ff93d4aca95a6165377 Author: Sascha Bischoff Date: Thu Mar 19 15:56:43 2026 +0000 KVM: arm64: gic-v5: Support GICv5 interrupts with KVM_IRQ_LINE Interrupts under GICv5 look quite different to those from older Arm GICs. Specifically, the type is encoded in the top bits of the interrupt ID. Extend KVM_IRQ_LINE to cope with GICv5 PPIs and SPIs. The requires subtly changing the KVM_IRQ_LINE API for GICv5 guests. For older Arm GICs, PPIs had to be in the range of 16-31, and SPIs had to be 32-1019, but this no longer holds true for GICv5. Instead, for a GICv5 guest support PPIs in the range of 0-127, and SPIs in the range 0-65535. The documentation is updated accordingly. The SPI range doesn't cover the full SPI range that a GICv5 system can potentially cope with (GICv5 provides up to 24-bits of SPI ID space, and we only have 16 bits to work with in KVM_IRQ_LINE). However, 65k SPIs is more than would be reasonably expected on systems for years to come. In order to use vgic_is_v5(), the kvm/arm_vgic.h header is added to kvm/arm.c. Note: As the GICv5 KVM implementation currently doesn't support injecting SPIs attempts to do so will fail. This restriction will by lifted as the GICv5 KVM support evolves. Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-28-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 5a98d0e17e59210b400734f2359c4453aab3af21 Author: Sascha Bischoff Date: Thu Mar 19 15:56:28 2026 +0000 KVM: arm64: gic-v5: Implement direct injection of PPIs GICv5 is able to directly inject PPI pending state into a guest using a mechanism called DVI whereby the pending bit for a paticular PPI is driven directly by the physically-connected hardware. This mechanism itself doesn't allow for any ID translation, so the host interrupt is directly mapped into a guest with the same interrupt ID. When mapping a virtual interrupt to a physical interrupt via kvm_vgic_map_irq for a GICv5 guest, check if the interrupt itself is a PPI or not. If it is, and the host's interrupt ID matches that used for the guest DVI is enabled, and the interrupt itself is marked as directly_injected. When the interrupt is unmapped again, this process is reversed, and DVI is disabled for the interrupt again. Note: the expectation is that a directly injected PPI is disabled on the host while the guest state is loaded. The reason is that although DVI is enabled to drive the guest's pending state directly, the host pending state also remains driven. In order to avoid the same PPI firing on both the host and the guest, the host's interrupt must be disabled (masked). This is left up to the code that owns the device generating the PPI as this needs to be handled on a per-VM basis. One VM might use DVI, while another might not, in which case the physical PPI should be enabled for the latter. Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-27-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 4a5444d23979b69e466f8080477112c264f194f2 Author: Sascha Bischoff Date: Thu Mar 19 15:56:12 2026 +0000 KVM: arm64: Introduce set_direct_injection irq_op GICv5 adds support for directly injected PPIs. The mechanism for setting this up is GICv5 specific, so rather than adding GICv5-specific code to the common vgic code, we introduce a new irq_op. This new irq_op is intended to be used to enable or disable direct injection for interrupts that support it. As it is an irq_op, it has no effect unless explicitly populated in the irq_ops structure for a particular interrupt. The usage is demonstracted in the subsequent change. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-26-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit d1328c61511f6a2aeda48b8b9096e67d2443ec71 Author: Sascha Bischoff Date: Thu Mar 19 15:55:57 2026 +0000 KVM: arm64: gic-v5: Trap and mask guest ICC_PPI_ENABLERx_EL1 writes A guest should not be able to detect if a PPI that is not exposed to the guest is implemented or not. Avoid the guest enabling any PPIs that are not implemented as far as the guest is concerned by trapping and masking writes to the two ICC_PPI_ENABLERx_EL1 registers. When a guest writes these registers, the write is masked with the set of PPIs actually exposed to the guest, and the state is written back to KVM's shadow state. As there is now no way for the guest to change the PPI enable state without it being trapped, saving of the PPI Enable state is dropped from guest exit. Reads for the above registers are not masked. When the guest is running and reads from the above registers, it is presented with what KVM provides in the ICH_PPI_ENABLERx_EL2 registers, which is the masked version of what the guest last wrote. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-25-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 933e5288fa9714085e384a3d6ad6dcce8089a6b9 Author: Sascha Bischoff Date: Thu Mar 19 15:55:41 2026 +0000 KVM: arm64: gic-v5: Check for pending PPIs This change allows KVM to check for pending PPI interrupts. This has two main components: First of all, the effective priority mask is calculated. This is a combination of the priority mask in the VPEs ICC_PCR_EL1.PRIORITY and the currently running priority as determined from the VPE's ICH_APR_EL1. If an interrupt's priority is greater than or equal to the effective priority mask, it can be signalled. Otherwise, it cannot. Secondly, any Enabled and Pending PPIs must be checked against this compound priority mask. The reqires the PPI priorities to by synced back to the KVM shadow state on WFI entry - this is skipped in general operation as it isn't required and is rather expensive. If any Enabled and Pending PPIs are of sufficient priority to be signalled, then there are pending PPIs. Else, there are not. This ensures that a VPE is not woken when it cannot actually process the pending interrupts. As the PPI priorities are not synced back to the KVM shadow state on every guest exit, they must by synced prior to checking if there are pending interrupts for the guest. The sync itself happens in vgic_v5_put() if, and only if, the vcpu is entering WFI as this is the only case where it is not planned to run the vcpu thread again. If the vcpu enters WFI, the vcpu thread will be descheduled and won't be rescheduled again until it has a pending interrupt, which is checked from kvm_arch_vcpu_runnable(). Signed-off-by: Sascha Bischoff Reviewed-by: Joey Gouly Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-24-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit f20554ad3ccd42397f863f6c41b43b831cf9b328 Author: Sascha Bischoff Date: Thu Mar 19 15:55:26 2026 +0000 KVM: arm64: gic-v5: Clear TWI if single task running Handle GICv5 in kvm_vcpu_should_clear_twi(). Clear TWI if there is a single task running, and enable it otherwise. This is a sane default for GICv5 given the current level of support. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-23-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit da8d9636be7e0761f69c3dadf747c725732312ff Author: Sascha Bischoff Date: Thu Mar 19 15:55:10 2026 +0000 KVM: arm64: gic-v5: Init Private IRQs (PPIs) for GICv5 Initialise the private interrupts (PPIs, only) for GICv5. This means that a GICv5-style intid is generated (which encodes the PPI type in the top bits) instead of the 0-based index that is used for older GICs. Additionally, set all of the GICv5 PPIs to use Level for the handling mode, with the exception of the SW_PPI which uses Edge. This matches the architecturally-defined set in the GICv5 specification (the CTIIRQ handling mode is IMPDEF, so Level has been picked for that). Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-22-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 4d591252bacb2d004b7c7f5db439bfa23b552ee7 Author: Sascha Bischoff Date: Thu Mar 19 15:54:55 2026 +0000 KVM: arm64: gic-v5: Implement PPI interrupt injection This change introduces interrupt injection for PPIs for GICv5-based guests. The lifecycle of PPIs is largely managed by the hardware for a GICv5 system. The hypervisor injects pending state into the guest by using the ICH_PPI_PENDRx_EL2 registers. These are used by the hardware to pick a Highest Priority Pending Interrupt (HPPI) for the guest based on the enable state of each individual interrupt. The enable state and priority for each interrupt are provided by the guest itself (through writes to the PPI registers). When Direct Virtual Interrupt (DVI) is set for a particular PPI, the hypervisor is even able to skip the injection of the pending state altogether - it all happens in hardware. The result of the above is that no AP lists are required for GICv5, unlike for older GICs. Instead, for PPIs the ICH_PPI_* registers fulfil the same purpose for all 128 PPIs. Hence, as long as the ICH_PPI_* registers are populated prior to guest entry, and merged back into the KVM shadow state on exit, the PPI state is preserved, and interrupts can be injected. When injecting the state of a PPI the state is merged into the PPI-specific vgic_irq structure. The PPIs are made pending via the ICH_PPI_PENDRx_EL2 registers, the value of which is generated from the vgic_irq structures for each PPI exposed on guest entry. The queue_irq_unlock() irq_op is required to kick the vCPU to ensure that it seems the new state. The result is that no AP lists are used for private interrupts on GICv5. Prior to entering the guest, vgic_v5_flush_ppi_state() is called from kvm_vgic_flush_hwstate(). This generates the pending state to inject into the guest, and snapshots it (twice - an entry and an exit copy) in order to track any changes. These changes can come from a guest consuming an interrupt or from a guest making an Edge-triggered interrupt pending. When returning from running a guest, the guest's PPI state is merged back into KVM's vgic_irq state in vgic_v5_merge_ppi_state() from kvm_vgic_sync_hwstate(). The Enable and Active state is synced back for all PPIs, and the pending state is synced back for Edge PPIs (Level is driven directly by the devices generating said levels). The incoming pending state from the guest is merged with KVM's shadow state to avoid losing any incoming interrupts. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-21-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 4a9a32d3538a9d800067be113b0196271a478c6a Author: Sascha Bischoff Date: Thu Mar 19 15:54:39 2026 +0000 KVM: arm64: gic: Introduce queue_irq_unlock to irq_ops There are times when the default behaviour of vgic_queue_irq_unlock() is undesirable. This is because some GICs, such a GICv5 which is the main driver for this change, handle the majority of the interrupt lifecycle in hardware. In this case, there is no need for a per-VCPU AP list as the interrupt can be made pending directly. This is done either via the ICH_PPI_x_EL2 registers for PPIs, or with the VDPEND system instruction for SPIs and LPIs. The vgic_queue_irq_unlock() function is made overridable using a new function pointer in struct irq_ops. vgic_queue_irq_unlock() is overridden if the function pointer is non-null. This new irq_op is unused in this change - it is purely providing the infrastructure itself. The subsequent PPI injection changes provide a demonstration of the usage of the queue_irq_unlock irq_op. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-20-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 8f1fbe2fd279240d6999e3a975d0a51d816e080a Author: Sascha Bischoff Date: Thu Mar 19 15:54:23 2026 +0000 KVM: arm64: gic-v5: Finalize GICv5 PPIs and generate mask We only want to expose a subset of the PPIs to a guest. If a PPI does not have an owner, it is not being actively driven by a device. The SW_PPI is a special case, as it is likely for userspace to wish to inject that. Therefore, just prior to running the guest for the first time, we need to finalize the PPIs. A mask is generated which, when combined with trapping a guest's PPI accesses, allows for the guest's view of the PPI to be filtered. This mask is global to the VM as all VCPUs PPI configurations must match. In addition, the PPI HMR is calculated. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-19-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 9b8e3d4ca0e734dd13dc261c5f888b359f8f5983 Author: Sascha Bischoff Date: Thu Mar 19 15:54:08 2026 +0000 KVM: arm64: gic-v5: Implement GICv5 load/put and save/restore This change introduces GICv5 load/put. Additionally, it plumbs in save/restore for: * PPIs (ICH_PPI_x_EL2 regs) * ICH_VMCR_EL2 * ICH_APR_EL2 * ICC_ICSR_EL1 A GICv5-specific enable bit is added to struct vgic_vmcr as this differs from previous GICs. On GICv5-native systems, the VMCR only contains the enable bit (driven by the guest via ICC_CR0_EL1.EN) and the priority mask (PCR). A struct gicv5_vpe is also introduced. This currently only contains a single field - bool resident - which is used to track if a VPE is currently running or not, and is used to avoid a case of double load or double put on the WFI path for a vCPU. This struct will be extended as additional GICv5 support is merged, specifically for VPE doorbells. Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-18-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit af325e87af5da2f686d1ad547edc96f731418f2a Author: Sascha Bischoff Date: Thu Mar 19 15:53:52 2026 +0000 KVM: arm64: gic-v5: Add vgic-v5 save/restore hyp interface Introduce the following hyp functions to save/restore GICv5 state: * __vgic_v5_save_apr() * __vgic_v5_restore_vmcr_apr() * __vgic_v5_save_ppi_state() - no hypercall required * __vgic_v5_restore_ppi_state() - no hypercall required * __vgic_v5_save_state() - no hypercall required * __vgic_v5_restore_state() - no hypercall required Note that the functions tagged as not requiring hypercalls are always called directly from the same context. They are either called via the vgic_save_state()/vgic_restore_state() path when running with VHE, or via __hyp_vgic_save_state()/__hyp_vgic_restore_state() otherwise. This mimics how vgic_v3_save_state()/vgic_v3_restore_state() are implemented. Overall, the state of the following registers is saved/restored: * ICC_ICSR_EL1 * ICH_APR_EL2 * ICH_PPI_ACTIVERx_EL2 * ICH_PPI_DVIRx_EL2 * ICH_PPI_ENABLERx_EL2 * ICH_PPI_PENDRx_EL2 * ICH_PPI_PRIORITYRx_EL2 * ICH_VMCR_EL2 All of these are saved/restored to/from the KVM vgic_v5 CPUIF shadow state, with the exception of the PPI active, pending, and enable state. The pending state is saved and restored from kvm_host_data as any changes here need to be tracked and propagated back to the vgic_irq shadow structures (coming in a future commit). Therefore, an entry and an exit copy is required. The active and enable state is restored from the vgic_v5 CPUIF, but is saved to kvm_host_data. Again, this needs to by synced back into the shadow data structures. The ICSR must be save/restored as this register is shared between host and guest. Therefore, to avoid leaking host state to the guest, this must be saved and restored. Moreover, as this can by used by the host at any time, it must be save/restored eagerly. Note: the host state is not preserved as the host should only use this register when preemption is disabled. As with GICv3, the VMCR is eagerly saved as this is required when checking if interrupts can be injected or not, and therefore impacts things such as WFI. As part of restoring the ICH_VMCR_EL2 and ICH_APR_EL2, GICv3-compat mode is also disabled by setting the ICH_VCTLR_EL2.V3 bit to 0. The correspoinding GICv3-compat mode enable is part of the VMCR & APR restore for a GICv3 guest as it only takes effect when actually running a guest. Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-17-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit e238fb21bd52e1a798f7c7662d267703a249bdba Author: Andy Shevchenko Date: Tue Mar 17 11:36:13 2026 +0100 pinctrl: pinconf-generic: Convert ..._parse_dt_pinmux() to fwnode API Convert pinconf_generic_parse_dt_pinmux() to fwnode API. This makes code cleaner and potentially reusable for some other types of fwnodes, such as software nodes. Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 070543a85adce329672012a1fe35fa48c76e02d5 Author: Sascha Bischoff Date: Thu Mar 19 15:53:37 2026 +0000 KVM: arm64: gic-v5: Trap and emulate ICC_IDR0_EL1 accesses Unless accesses to the ICC_IDR0_EL1 are trapped by KVM, the guest reads the same state as the host. This isn't desirable as it limits the migratability of VMs and means that KVM can't hide hardware features such as FEAT_GCIE_LEGACY. Trap and emulate accesses to the register, and present KVM's chosen ID bits and Priority bits (which is 5, as GICv5 only supports 5 bits of priority in the CPU interface). FEAT_GCIE_LEGACY is never presented to the guest as it is only relevant for nested guests doing mixed GICv5 and GICv3 support. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-16-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 1fc7de3047e169e7ae32afadf87a134cd1c68319 Author: Andy Shevchenko Date: Tue Mar 17 11:36:12 2026 +0100 pinctrl: pinconf-generic: Validate fwnode instead of device node Currently we convert device node to fwnode in the pinconf_generic_parse_dt_config() and then validate the device node. This is confusing order. Instead, assign fwnode and validate it. Fixes: e002d162654b ("pinctrl: pinconf-generic: Use only fwnode API in parse_dt_cfg()") Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 607871ce633d3e0ca0eb375a04371f1130fc2c5a Author: Sascha Bischoff Date: Thu Mar 19 15:53:21 2026 +0000 KVM: arm64: gic-v5: Add emulation for ICC_IAFFIDR_EL1 accesses GICv5 doesn't provide an ICV_IAFFIDR_EL1 or ICH_IAFFIDR_EL2 for providing the IAFFID to the guest. A guest access to the ICC_IAFFIDR_EL1 must therefore be trapped and emulated to avoid the guest accessing the host's ICC_IAFFIDR_EL1. The virtual IAFFID is provided to the guest when it reads ICC_IAFFIDR_EL1 (which always traps back to the hypervisor). Writes are rightly ignored. KVM treats the GICv5 VPEID, the virtual IAFFID, and the vcpu_id as the same, and so the vcpu_id is returned. The trapping for the ICC_IAFFIDR_EL1 is always enabled when in a guest context. Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-15-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit c98324ea7849b6e5baa1774f71709b375a2c2f9e Author: Andy Shevchenko Date: Tue Mar 17 11:36:11 2026 +0100 pinctrl: pinconf-generic: Fully validate 'pinmux' property The pinconf_generic_parse_dt_pinmux() assumes that the 'pinmux' property is not empty when present. This might be not true. With that, the allocator will give a special value in return and not NULL which lead to the crash when trying to access that (invalid) memory. Fix that by fully validating 'pinmux' value, including its length. Fixes: 7112c05fff83 ("pinctrl: pinconf-generic: Add API for pinmux propertity in DTS file") Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 9d6d9514c08f462d162040b48526bda60def9de1 Author: Sascha Bischoff Date: Thu Mar 19 15:53:05 2026 +0000 KVM: arm64: gic-v5: Support GICv5 FGTs & FGUs Extend the existing FGT/FGU infrastructure to include the GICv5 trap registers (ICH_HFGRTR_EL2, ICH_HFGWTR_EL2, ICH_HFGITR_EL2). This involves mapping the trap registers and their bits to the corresponding feature that introduces them (FEAT_GCIE for all, in this case), and mapping each trap bit to the system register/instruction controlled by it. As of this change, none of the GICv5 instructions or register accesses are being trapped. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-14-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit a258a383b91774ac646517ec1003a442964d8946 Author: Sascha Bischoff Date: Thu Mar 19 15:52:50 2026 +0000 KVM: arm64: gic-v5: Sanitize ID_AA64PFR2_EL1.GCIE Add in a sanitization function for ID_AA64PFR2_EL1, preserving the already-present behaviour for the FPMR, MTEFAR, and MTESTOREONLY fields. Add sanitisation for the GCIE field, which is set to IMP if the host supports a GICv5 guest and NI, otherwise. Extend the sanitisation that takes place in kvm_vgic_create() to zero the ID_AA64PFR2.GCIE field when a non-GICv5 GIC is created. More importantly, move this sanitisation to a separate function, kvm_vgic_finalize_sysregs(), and call it from kvm_finalize_sys_regs(). We are required to finalize the GIC and GCIE fields a second time in kvm_finalize_sys_regs() due to how QEMU blindly reads out then verbatim restores the system register state. This avoids the issue where both the GCIE and GIC features are marked as present (an architecturally invalid combination), and hence guests fall over. See the comment in kvm_finalize_sys_regs() for more details. Overall, the following happens: * Before an irqchip is created, FEAT_GCIE is presented if the host supports GICv5-based guests. * Once an irqchip is created, all other supported irqchips are hidden from the guest; system register state reflects the guest's irqchip. * Userspace is allowed to set invalid irqchip feature combinations in the system registers, but... * ...invalid combinations are removed a second time prior to the first run of the guest, and things hopefully just work. All of this extra work is required to make sure that "legacy" GICv3 guests based on QEMU transparently work on compatible GICv5 hosts without modification. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-13-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit f656807150e3e1c6f76cab918e5adfad6d881d58 Author: Sascha Bischoff Date: Thu Mar 19 15:52:34 2026 +0000 KVM: arm64: gic-v5: Detect implemented PPIs on boot As part of booting the system and initialising KVM, create and populate a mask of the implemented PPIs. This mask allows future PPI operations (such as save/restore or state, or syncing back into the shadow state) to only consider PPIs that are actually implemented on the host. The set of implemented virtual PPIs matches the set of implemented physical PPIs for a GICv5 host. Therefore, this mask represents all PPIs that could ever by used by a GICv5-based guest on a specific host, albeit pre-filtered by what we support in KVM (see next paragraph). Only architected PPIs are currently supported in KVM with GICv5. Moreover, as KVM only supports a subset of all possible PPIS (Timers, PMU, GICv5 SW_PPI) the PPI mask only includes these PPIs, if present. The timers are always assumed to be present; if we have KVM we have EL2, which means that we have the EL1 & EL2 Timer PPIs. If we have a PMU (v3), then the PMUIRQ is present. The GICv5 SW_PPI is always assumed to be present. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-12-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit da92ff15ca4c5b0f75ec1cb3d2e275db2ff2c810 Author: Sascha Bischoff Date: Thu Mar 19 15:52:19 2026 +0000 KVM: arm64: gic-v5: Add Arm copyright header This header was mistakenly omitted during the creation of this file. Add it now. Better late than never. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-11-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit eb8bce08ecb12fa0e76af23432f1adb162248ca6 Author: Sascha Bischoff Date: Thu Mar 19 15:52:03 2026 +0000 KVM: arm64: gic: Introduce interrupt type helpers GICv5 has moved from using interrupt ranges for different interrupt types to using some of the upper bits of the interrupt ID to denote the interrupt type. This is not compatible with older GICs (which rely on ranges of interrupts to determine the type), and hence a set of helpers is introduced. These helpers take a struct kvm*, and use the vgic model to determine how to interpret the interrupt ID. Helpers are introduced for PPIs, SPIs, and LPIs. Additionally, a helper is introduced to determine if an interrupt is private - SGIs and PPIs for older GICs, and PPIs only for GICv5. Additionally, vgic_is_v5() is introduced (which unsurpisingly returns true when running a GICv5 guest), and the existing vgic_is_v3() check is moved from vgic.h to arm_vgic.h (to live alongside the vgic_is_v5() one), and has been converted into a macro. The helpers are plumbed into the core vgic code, as well as the Arch Timer and PMU code. There should be no functional changes as part of this change. Signed-off-by: Sascha Bischoff Reviewed-by: Joey Gouly Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-10-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit c547c51ff4d44c787330506737c5ce7808e536cc Author: Sascha Bischoff Date: Thu Mar 19 15:51:47 2026 +0000 KVM: arm64: gic-v5: Add ARM_VGIC_V5 device to KVM headers This is the base GICv5 device which is to be used with the KVM_CREATE_DEVICE ioctl to create a GICv5-based vgic. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-9-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 59991153f026766447bea14d85439555b6bf9164 Author: Sascha Bischoff Date: Thu Mar 19 15:51:32 2026 +0000 arm64/sysreg: Add GICR CDNMIA encoding The encoding for the GICR CDNMIA system instruction is thus far unused (and shall remain unused for the time being). However, in order to plumb the FGTs into KVM correctly, KVM needs to be made aware of the encoding of this system instruction. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-8-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 2808a8337078f2a65f1f1176880e1491a3e88fa8 Author: Sascha Bischoff Date: Thu Mar 19 15:51:16 2026 +0000 arm64/sysreg: Add remaining GICv5 ICC_ & ICH_ sysregs for KVM support Add the GICv5 system registers required to support native GICv5 guests with KVM. Many of the GICv5 sysregs have already been added as part of the host GICv5 driver, keeping this set relatively small. The registers added in this change complete the set by adding those required by KVM either directly (ICH_) or indirectly (FGTs for the ICC_ sysregs). The following system registers and their fields are added: ICC_APR_EL1 ICC_HPPIR_EL1 ICC_IAFFIDR_EL1 ICH_APR_EL2 ICH_CONTEXTR_EL2 ICH_PPI_ACTIVER_EL2 ICH_PPI_DVI_EL2 ICH_PPI_ENABLER_EL2 ICH_PPI_PENDR_EL2 ICH_PPI_PRIORITYR_EL2 Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260319154937.3619520-7-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 663594aafb438f8c4e51d4bf2dbf48b9f68aedb7 Author: Sascha Bischoff Date: Thu Mar 19 15:51:01 2026 +0000 KVM: arm64: vgic: Split out mapping IRQs and setting irq_ops Prior to this change, the act of mapping a virtual IRQ to a physical one also set the irq_ops. Unmapping then reset the irq_ops to NULL. So far, this has been fine and hasn't caused any major issues. Now, however, as GICv5 support is being added to KVM, it has become apparent that conflating mapping/unmapping IRQs and setting/clearing irq_ops can cause issues. The reason is that the upcoming GICv5 support introduces a set of default irq_ops for PPIs, and removing this when unmapping will cause things to break rather horribly. Split out the mapping/unmapping of IRQs from the setting/clearing of irq_ops. The arch timer code is updated to set the irq_ops following a successful map. The irq_ops are intentionally not removed again on an unmap as the only irq_op introduced by the arch timer only takes effect if the hw bit in struct vgic_irq is set. Therefore, it is safe to leave this in place, and it avoids additional complexity when GICv5 support is introduced. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-6-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 40927abf2fed04cd242b269720ce0192604e2027 Author: Yury Norov Date: Sat Mar 14 15:10:15 2026 -0400 thermal: intel: hfi: use cpumask_empty() in intel_hfi_offline() cpumask_empty() is more efficient as it may return earlier. Switch to using it. Signed-off-by: Yury Norov Link: https://patch.msgid.link/20260314191016.603067-1-ynorov@nvidia.com Signed-off-by: Rafael J. Wysocki commit fbe230a9a79b62be3c6ac55b24d53ce5dd9202d5 Author: Devang Vyas Date: Wed Mar 18 00:04:53 2026 +0530 EDAC/amd64: Add support for family 19h, models 40h-4fh Add support for Ryzen 6000 Zen3-based CPUs in the V3000 AMD Embedded SoC platform which uses ECC memory and would need RAS handling of hardware errors. Co-developed-by: Ramesh Garidapuri Signed-off-by: Ramesh Garidapuri Signed-off-by: Devang Vyas Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Yazen Ghannam Link: https://patch.msgid.link/20260317183453.3556588-1-devangnayanbhai.vyas@amd.com commit 6bc9effb4cbf9b6eba0f51aba1c8893dfd4c8100 Author: Eric Biggers Date: Wed Dec 3 21:55:12 2025 -0800 coco/guest: Remove unneeded selection of CRYPTO All that's needed here is CRYPTO_HASH_INFO. It used to be the case that CRYPTO_HASH_INFO was visible only when CRYPTO, but that was fixed by commit aacb37f597d0 ("lib/crypto: hash_info: Move hash_info.c into lib/crypto/"). Now CRYPTO_HASH_INFO can be selected directly. Acked-by: Dan Williams Link: https://lore.kernel.org/r/20251204055512.494013-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 645e64136b93e431a48f3b178fe7cf13737b10f6 Author: Eric Biggers Date: Wed Mar 18 09:42:33 2026 -0700 sample/tsm-mr: Use SHA-2 library APIs Given that tsm_mr_sample has a particular set of algorithms that it wants, just use the library APIs for those algorithms rather than crypto_shash. This is more straightforward and more efficient. This also fixes a bug where this module failed to build if it was enabled without CRYPTO_HASH happening to be set elsewhere in the kconfig. (With the concurrent change to make TSM_MEASUREMENTS stop selecting CRYPTO, this existing build error would have become easier to encounter, as well.) Also, even if it built, crypto_alloc_shash() could fail at runtime due to the needed algorithms not being available. The library functions simply use direct linking. So if it builds, which it will due to the kconfig options being selected, they are available. Fixes: f6953f1f9ec4 ("tsm-mr: Add tsm-mr sample code") Acked-by: Arnd Bergmann Acked-by: Dan Williams Link: https://lore.kernel.org/r/20260318164233.19800-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 7b6d3255e7f8c6df2d21504c47808e3ce84649ac Author: Yang Xiuwei Date: Tue Mar 17 15:22:26 2026 +0800 scsi: bsg: add io_uring passthrough handler Implement the SCSI-specific io_uring command handler for BSG using struct bsg_uring_cmd. The handler builds a SCSI request from the io_uring command, maps user buffers (including fixed buffers), and completes asynchronously via a request end_io callback and task_work. Completion returns a 32-bit status and packed residual/sense information via CQE res and res2, and supports IO_URING_F_NONBLOCK. Signed-off-by: Yang Xiuwei Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260317072226.2598233-4-yangxiuwei@kylinos.cn Signed-off-by: Jens Axboe commit a1e97ce80d9f41d0bb83951d758ff6fe49f3de60 Author: Yang Xiuwei Date: Tue Mar 17 15:22:25 2026 +0800 bsg: add io_uring command support to generic layer Add an io_uring command handler to the generic BSG layer. The new .uring_cmd file operation validates io_uring features and delegates handling to a per-queue bsg_uring_cmd_fn callback. Extend bsg_register_queue() so transport drivers can register both sg_io and io_uring command handlers. Signed-off-by: Yang Xiuwei Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260317072226.2598233-3-yangxiuwei@kylinos.cn Signed-off-by: Jens Axboe commit 7da9261bab0a82bdbc4aafd2ad4bc3529b7cb772 Author: Yang Xiuwei Date: Tue Mar 17 15:22:24 2026 +0800 bsg: add bsg_uring_cmd uapi structure Add the bsg_uring_cmd structure to the BSG UAPI header to support io_uring-based SCSI passthrough operations via IORING_OP_URING_CMD. Signed-off-by: Yang Xiuwei Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260317072226.2598233-2-yangxiuwei@kylinos.cn Signed-off-by: Jens Axboe commit c2db2288b8c3e2878cc37962375419cca8dfe3b6 Author: Eric Biggers Date: Sat Mar 14 10:50:49 2026 -0700 lib/crypto: arm64: Drop checks for CONFIG_KERNEL_MODE_NEON CONFIG_KERNEL_MODE_NEON is always enabled on arm64, and it always has been since its introduction in 2013. Given that and the fact that the usefulness of kernel-mode NEON has only been increasing over time, checking for this option in arm64-specific code is unnecessary. Remove these checks from lib/crypto/ to simplify the code and prevent any future bugs where e.g. code gets disabled due to a typo in this logic. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260314175049.26931-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit d76a943039a772fb2afd9c92bd25412d09bdf5c8 Author: Eric Biggers Date: Sat Mar 14 10:35:26 2026 -0700 lib/crypto: Remove unused file blockhash.h For a short time this file was used by the SHA-256 and Poly1305 library code, but they are no longer using it. Remove this unused file. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260314173526.17349-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6d80749becf8fc5ffa004194e578f79b558235ef Author: Eric Biggers Date: Mon Mar 16 21:06:26 2026 -0700 lib/crypto: tests: Drop the default to CRYPTO_SELFTESTS Defaulting the crypto KUnit tests to KUNIT_ALL_TESTS || CRYPTO_SELFTESTS instead of simply KUNIT_ALL_TESTS was originally intended to make it easy to enable all the crypto KUnit tests. This additional default is nonstandard for KUnit tests, though, and it can cause all the KUnit tests to be built-in unexpectedly if CRYPTO_SELFTESTS is set. It also constitutes a back-reference to crypto/ from lib/crypto/, which is something that we should be avoiding in order to get clean layering. Now that we provide a lib/crypto/.kunitconfig file that enables all crypto KUnit tests, let's consider that to be the supported way to enable all these tests, and drop the default of CRYPTO_SELFTESTS. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260317040626.5697-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 8d547482231fef30d0d6440629b73560ad3e937c Author: Eric Biggers Date: Fri Mar 13 20:59:27 2026 -0700 kunit: configs: Enable all crypto library tests in all_tests.config The new option CONFIG_CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT enables all the crypto library code that has KUnit tests, causing CONFIG_KUNIT_ALL_TESTS to enable all these tests. Add this option to all_tests.config so that kunit.py will run them when passed the --alltests option. Link: https://lore.kernel.org/r/20260314035927.51351-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit ed1767442d919f57aaf83d69c33853da2644d902 Author: Eric Biggers Date: Fri Mar 13 20:59:26 2026 -0700 lib/crypto: tests: Introduce CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT For kunit.py to run all the crypto library tests when passed the --alltests option, tools/testing/kunit/configs/all_tests.config needs to enable options that satisfy the test dependencies. This is the same as what lib/crypto/.kunitconfig already does. However, the strategy that lib/crypto/.kunitconfig currently uses to select all the hidden library options isn't going to scale up well when it needs to be repeated in two places. Instead let's go ahead and introduce an option CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT that depends on KUNIT and selects all the crypto library options that have corresponding KUnit tests. Update lib/crypto/.kunitconfig to use this option. Link: https://lore.kernel.org/r/20260314035927.51351-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 8c1c315104527cfb2b8209cb5c0572567857567a Merge: bf504b229cb8d5 36cb728754ea45 Author: Rafael J. Wysocki Date: Thu Mar 19 17:54:20 2026 +0100 Merge back ACPI processor driver updates for 7.1 commit f5b00975249bd30e3ab34b22b5f8a92675892044 Merge: f4c31b07b13683 a943787d20c97b Author: Rafael J. Wysocki Date: Thu Mar 19 17:51:13 2026 +0100 Merge back cpuidle material for 7.1 commit cbd8c958be54abdf2c0f9b9c3eac971428b9d4b1 Author: Sascha Bischoff Date: Thu Mar 19 15:50:28 2026 +0000 KVM: arm64: Return early from kvm_finalize_sys_regs() if guest has run If the guest has already run, we have no business finalizing the system register state - it is too late. Therefore, check early and bail if the VM has already run. This change also stops kvm_init_nv_sysregs() from being called once the RM has run once. Although this looks like a behavioural change, the function returns early once it has been called the first time. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-4-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 3a2857da94d4783c076b15035c578892f1817dce Author: Sascha Bischoff Date: Thu Mar 19 15:50:13 2026 +0000 KVM: arm64: vgic: Rework vgic_is_v3() and add vgic_host_has_gicvX() The GIC version checks used to determine host capabilities and guest configuration have become somewhat conflated (in part due to the addition of GICv5 support). vgic_is_v3() is a prime example, which prior to this change has been a combination of guest configuration and host cabability. Split out the host capability check from vgic_is_v3(), which now only checks if the vgic model itself is GICv3. Add two new functions: vgic_host_has_gicv3() and vgic_host_has_gicv5(). These explicitly check the host capabilities, i.e., can the host system run a GICvX guest or not. The vgic_is_v3() check in vcpu_set_ich_hcr() has been replaced with vgic_host_has_gicv3() as this only applies on GICv3-capable hardware, and isn't strictly only applicable for a GICv3 guest (it is actually vital for vGICv2 on GICv3 hosts). Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-3-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 90f0155f8754e75fa29fce02e40d690fb733852d Author: Sascha Bischoff Date: Thu Mar 19 15:49:57 2026 +0000 KVM: arm64: vgic-v3: Drop userspace write sanitization for ID_AA64PFR0.GIC on GICv5 Drop a check that blocked userspace writes to ID_AA64PFR0_EL1 for writes that set the GIC field to 0 (NI) on GICv5 hosts. There is no such check for GICv3 native systems, and having inconsistent behaviour both complicates the logic and risks breaking existing userspace software that expects to be able to write the register. This means that userspace is now able to create a GICv3 guest on GICv5 hosts, and disable the guest from seeing that it has a GICv3. This matches the already existing behaviour for GICv3-native VMs, allowing for fewer issues when migrating from GICv3 hosts to compatible GICv5 hosts. Additionally, this allows the trap and FGU infrastucture to kick in as these rely on the state of the feature bits that have been set. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260319154937.3619520-2-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit a56a658f2492ae70ca5e9db980b0af3aceb7b5b8 Merge: e7648ffecb7fcb 236ad358166cca Author: Rafael J. Wysocki Date: Thu Mar 19 17:13:44 2026 +0100 Merge back updates of core ACPI drivers for 7.1 commit d921f8d3b955ba09d321c612fc485b9e9ac438c0 Author: Thierry Reding Date: Thu Feb 26 16:09:33 2026 +0100 firmware: tegra: bpmp: Rename Tegra239 to Tegra238 This chip identifies as Tegra238, so update the BPMP ABI header to refer to it by the correct name. Reviewed-by: Jon Hunter Signed-off-by: Thierry Reding commit 9b0f1cd58fe9d2c95eae97f089040f1a5b02c097 Author: Eric Biggers Date: Sat Mar 14 13:12:25 2026 -0700 PM: hibernate: x86: Remove inclusion of crypto/hash.h hibernate_64.c does not do any cryptographic hashing, so the header crypto/hash.h is not needed at all. Signed-off-by: Eric Biggers [ rjw: Subject tweak ] Link: https://patch.msgid.link/20260314201225.38822-1-ebiggers@kernel.org Signed-off-by: Rafael J. Wysocki commit 4202fddd01c74fedc301ca2058623e28b8211dc1 Author: Nicolin Chen Date: Tue Mar 17 00:59:23 2026 -0700 iommu/arm-smmu-v3: Perform per-domain invalidations using arm_smmu_invs Replace the old invalidation functions with arm_smmu_domain_inv_range() in all the existing invalidation routines. And deprecate the old functions. The new arm_smmu_domain_inv_range() handles the CMDQ_MAX_TLBI_OPS as well, so drop it in the SVA function. Since arm_smmu_cmdq_batch_add_range() has only one caller now, and it must be given a valid size, add a WARN_ON_ONCE to catch any missed case. Also update the comments in arm_smmu_tlb_inv_context() to clarify things with the new invalidation functions. Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit 587bb3e56a2c37bbd58efff24e56fe7dae472199 Author: Nicolin Chen Date: Tue Mar 17 00:59:22 2026 -0700 iommu/arm-smmu-v3: Add arm_smmu_invs based arm_smmu_domain_inv_range() Each smmu_domain now has an arm_smmu_invs that specifies the invalidation steps to perform after any change the IOPTEs. This includes supports for basic ASID/VMID, the special case for nesting, and ATC invalidations. Introduce a new arm_smmu_domain_inv helper iterating smmu_domain->invs to convert the invalidation array to commands. Any invalidation request with no size specified means an entire flush over a range based one. Take advantage of the sorted array to compatible batch operations together to the same SMMU. For instance, ATC invaliations for multiple SIDs can be pushed as a batch. ATC invalidations must be completed before the driver disables ATS. Or the device is permitted to ignore any racing invalidation that would cause an SMMU timeout. The sequencing is done with a rwlock where holding the write side of the rwlock means that there are no outstanding ATC invalidations. If ATS is not used the rwlock is ignored, similar to the existing code. Co-developed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit b77429757e4501e00f62cd4328bcfe6a9dbbf65e Author: Nicolin Chen Date: Tue Mar 17 00:59:21 2026 -0700 iommu/arm-smmu-v3: Populate smmu_domain->invs when attaching masters Update the invs array with the invalidations required by each domain type during attachment operations. Only an SVA domain or a paging domain will have an invs array: a. SVA domain will add an INV_TYPE_S1_ASID per SMMU and an INV_TYPE_ATS per SID b. Non-nesting-parent paging domain with no ATS-enabled master will add a single INV_TYPE_S1_ASID or INV_TYPE_S2_VMID per SMMU c. Non-nesting-parent paging domain with ATS-enabled master(s) will do (b) and add an INV_TYPE_ATS per SID d. Nesting-parent paging domain will add an INV_TYPE_S2_VMID followed by an INV_TYPE_S2_VMID_S1_CLEAR per vSMMU. For an ATS-enabled master, it will add an INV_TYPE_ATS_FULL per SID Note that case #d prepares for a future implementation of VMID allocation which requires a followup series for S2 domain sharing. So when a nesting parent domain is attached through a vSMMU instance using a nested domain. VMID will be allocated per vSMMU instance v.s. currectly per S2 domain. The per-domain invalidation is not needed until the domain is attached to a master (when it starts to possibly use TLB). This will make it possible to attach the domain to multiple SMMUs and avoid unnecessary invalidation overhead during teardown if no STEs/CDs refer to the domain. It also means that when the last device is detached, the old domain must flush its ASID or VMID, since any new iommu_unmap() call would not trigger invalidations given an empty domain->invs array. Introduce some arm_smmu_invs helper functions for building scratch arrays, preparing and installing old/new domain's invalidation arrays. Co-developed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit e3a56b37bf7546ecde4332d70a5bd092b9fe061b Author: Nicolin Chen Date: Tue Mar 17 00:59:20 2026 -0700 iommu/arm-smmu-v3: Pre-allocate a per-master invalidation array When a master is attached from an old domain to a new domain, it needs to build an invalidation array to delete and add the array entries from/onto the invalidation arrays of those two domains, passed via the to_merge and to_unref arguments into arm_smmu_invs_merge/unref() respectively. Since the master->num_streams might differ across masters, a memory would have to be allocated when building an to_merge/to_unref array which might fail with -ENOMEM. On the other hand, an attachment to arm_smmu_blocked_domain must not fail so it's the best to avoid any memory allocation in that path. Pre-allocate a fixed size invalidation array for every master. This array will be used as a scratch to fill dynamically when building a to_merge or to_unref invs array. Sort fwspec->ids in an ascending order to fit to the arm_smmu_invs_merge() function. Co-developed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit 15a2a5645ad79df78965a7c49bdd4b6a63b2033a Author: Jason Gunthorpe Date: Tue Mar 17 00:59:19 2026 -0700 iommu/arm-smmu-v3: Introduce a per-domain arm_smmu_invs array Create a new data structure to hold an array of invalidations that need to be performed for the domain based on what masters are attached, to replace the single smmu pointer and linked list of masters in the current design. Each array entry holds one of the invalidation actions - S1_ASID, S2_VMID, ATS or their variant with information to feed invalidation commands to HW. It is structured so that multiple SMMUs can participate in the same array, removing one key limitation of the current system. To maximize performance, a sorted array is used as the data structure. It allows grouping SYNCs together to parallelize invalidations. For instance, it will group all the ATS entries after the ASID/VMID entry, so they will all be pushed to the PCI devices in parallel with one SYNC. To minimize the locking cost on the invalidation fast path (reader of the invalidation array), the array is managed with RCU. Provide a set of APIs to add/delete entries to/from an array, which cover cannot-fail attach cases, e.g. attaching to arm_smmu_blocked_domain. Also add kunit coverage for those APIs. Signed-off-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Co-developed-by: Nicolin Chen Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit c317452f5a224b4ac97d51162395bd6bddaf478c Author: Nicolin Chen Date: Tue Mar 17 00:59:18 2026 -0700 iommu/arm-smmu-v3: Add an inline arm_smmu_domain_free() There will be a bit more things to free than smmu_domain itself. So keep a simple inline function in the header to share aross files. Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Acked-by: Balbir Singh Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit 9b056856880a0a3de04e7b09521fe1f5df94e311 Author: Nicolin Chen Date: Tue Mar 17 00:59:17 2026 -0700 iommu/arm-smmu-v3: Explicitly set smmu_domain->stage for SVA Both the ARM_SMMU_DOMAIN_S1 case and the SVA case use ASID, requiring ASID based invalidation commands to flush the TLB. Define an ARM_SMMU_DOMAIN_SVA to make the SVA case clear to share the same path with the ARM_SMMU_DOMAIN_S1 case, which will be a part of the routine to build a new per-domain invalidation array. There is no function change. Suggested-by: Jason Gunthorpe Acked-by: Balbir Singh Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit 6fabce53f6b9c2419012a9103e1a46d40888cefa Author: Nicolin Chen Date: Tue Mar 17 00:59:16 2026 -0700 iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update When writing a new (previously invalid) valid IOPTE to a page table, then installing the page table into an STE hitlesslessly (e.g. in S2TTB field), there is a window before an STE invalidation, where the page-table may be accessed by SMMU but the new IOPTE is still siting in the CPU cache. This could occur when we allocate an iommu_domain and immediately install it hitlessly, while there would be no dma_wmb() for the page table memory prior to the earliest point of HW reading the STE. Fix it by adding a dma_wmb() prior to updating the STE. Fixes: 56e1a4cc2588 ("iommu/arm-smmu-v3: Add unit tests for arm_smmu_write_entry") Cc: stable@vger.kernel.org Reported-by: Will Deacon Closes: https://lore.kernel.org/linux-iommu/aXdlnLLFUBwjT0V5@willie-the-truck/ Suggested-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit 4a58ae85c3f9b142ffba023d0f976978ade57d1b Author: Lucas Zampieri Date: Sat Mar 14 01:05:30 2026 +0000 HID: input: Add support for multiple batteries per device Add support for HID devices that report multiple batteries, each identified by its report ID. The hid_device->battery pointer is replaced with a batteries list. Batteries are named using the pattern hid-{uniq}-battery-{report_id}. The hid_get_battery() helper returns the first battery in the list for backwards compatibility with single-battery drivers. Signed-off-by: Lucas Zampieri Signed-off-by: Benjamin Tissoires commit 7a3ac62473f2bd213557e41aaab7a8f144037dfd Author: Lucas Zampieri Date: Sat Mar 14 01:05:29 2026 +0000 HID: input: Introduce struct hid_battery and refactor battery code Introduce struct hid_battery to encapsulate individual battery state, preparing for future multi-battery support. The new structure contains all battery-related fields previously stored directly in hid_device (capacity, min, max, report_type, report_id, charge_status, etc.). The hid_device->battery pointer type changes from struct power_supply* to struct hid_battery*, and all battery functions are refactored accordingly. A hid_get_battery() helper is added for external drivers, with hid-apple.c and hid-magicmouse.c updated to use the new API. The hid-input-test.c KUnit tests are also updated for the new structure. No functional changes for single-battery devices. Signed-off-by: Lucas Zampieri Signed-off-by: Benjamin Tissoires commit 5a9df498581a2e12fd960ddeb1da41dd771d9000 Author: Lucas Zampieri Date: Sat Mar 14 01:05:28 2026 +0000 HID: input: Convert battery code to devm_* Convert the HID battery code to use devm_* managed resource APIs for the power_supply_desc allocation, battery name string, and power supply registration. The error path uses devm_kfree() to clean up allocated memory if devm_power_supply_register() fails, preventing memory waste on repeated setup attempts. The hidinput_cleanup_battery() function is removed as devm handles cleanup automatically. Signed-off-by: Lucas Zampieri Signed-off-by: Benjamin Tissoires commit 142068281f5138a9888d488e6911e8d9f7923c15 Author: Dmitry Torokhov Date: Sat Feb 28 21:05:11 2026 -0800 HID: input: use __free(kfree) to clean up temporary buffers The __free() cleanup automatically releases given resource when leaving the scope, so use it to make the code less cluttered with error handling. Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Kosina commit 889cdd9e1b375e2423e5d69c2dd96722d28777b8 Author: Abel Vesa Date: Mon Feb 23 10:46:39 2026 +0200 dt-bindings: arm-smmu: Add compatible for Eliza SoC Qualcomm Eliza SoC implements arm,mmu-500. Document its compatible. Signed-off-by: Abel Vesa Acked-by: Rob Herring (Arm) Signed-off-by: Will Deacon commit ac977b900907f621e117184e71766f297a2f702b Author: Colin Ian King Date: Sat Mar 14 17:02:25 2026 +0000 HID: mcp2221: Fix spelling mistake "Enfore" -> "Enforce" There is a spelling mistake in a module description. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Linus Walleij Signed-off-by: Benjamin Tissoires commit 9ac76f3d0bb2940db3a9684d596b9c8f301ef315 Merge: 96450df197bda7 dee55bc7cb8ad7 Author: Paolo Abeni Date: Thu Mar 19 15:30:19 2026 +0100 Merge tag 'wireless-next-2026-03-19' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Aside from various small improvements/cleanups, not much: - cfg80211/mac80211: S1G and UHR improvements - hwsim: incumbent signal report test support * tag 'wireless-next-2026-03-19' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (31 commits) qtnfmac: use alloc_netdev macro for single queue devices wifi: libertas: don't kill URBs in interrupt context wifi: libertas: use USB anchors for tracking in-flight URBs wifi: nl80211: use int for band coming from netlink wifi: rsi_91x_usb: do not pause rfkill polling when stopping mac80211 wifi: mac80211: fix STA link removal during link removal wifi: nl80211: reject S1G/60G with HT chantype wifi: ieee80211: fix definition of EHT-MCS 15 in MRU wifi: cfg80211: check non-S1G width with S1G chandef wifi: cfg80211: restrict cfg80211_chandef_create() to only HT-based bands wifi: mac80211: don't use cfg80211_chandef_create() for default chandef wifi: mac80211: Remove deleted sta links in ieee80211_ml_reconf_work() wifi: b43: use register definitions in nphy_op_software_rfkill wifi: cfg80211: split control freq check from chandef check wifi: mac80211: always use full chanctx compatible check wifi: mac80211: refactor chandef tracing macros wifi: mac80211: validate HE 6 GHz operation when EHT is used wifi: nl80211: split out UHR operation information wifi: mwifiex: drop redundant device reference wifi: rt2x00: drop redundant device reference ... ==================== Link: https://patch.msgid.link/20260319082439.79875-3-johannes@sipsolutions.net Signed-off-by: Paolo Abeni commit d16f57caa78776e6e8a88b96cb2597797b376138 Author: Sebastian Krzyszkowiak Date: Wed Jan 28 00:47:21 2026 +0100 clk: imx8mq: Correct the CSI PHY sels According to i.MX 8M Quad Reference Manual (Section 5.1.2 Table 5-1) MIPI_CSI1_PHY_REF_CLK_ROOT and MIPI_CSI2_PHY_REF_CLK_ROOT have SYSTEM_PLL2_DIV3 available as their second source, which corresponds to sys2_pll_333m rather than sys2_pll_125m. Fixes: b80522040cd3 ("clk: imx: Add clock driver for i.MX8MQ CCM") Signed-off-by: Sebastian Krzyszkowiak Reviewed-by: Peng Fan Link: https://patch.msgid.link/20260128-imx8mq-csi-clk-v1-1-ac028ed26e8c@puri.sm Signed-off-by: Abel Vesa commit d5dd8c523686153e29bc3e5ae0f854e13545535d Author: Lukasz Majewski Date: Thu Jan 29 10:54:42 2026 +0100 clk: vf610: Add support for the Ethernet switch clocks The vf610 device has built in the MoreThanIP L2 switch. For proper operation it is required to enable ESW and MAC table lookup clocks. The MAC table spans from 0x400E_C000 for 0x4000 and it is necessary to provide clocks for each AIPS1-"slot", which size is 0x1000 (hence four separate entries). Those can be enabled via clock gating CCM_CCGR10 register (0x4006_B068). Signed-off-by: Lukasz Majewski Reviewed-by: Peng Fan Link: https://patch.msgid.link/20260129095442.1646748-5-lukma@nabladev.com Signed-off-by: Abel Vesa commit 77f18a1f7dde3bc04c72f8623f9f4c218924301c Author: Lukasz Majewski Date: Thu Jan 29 10:54:41 2026 +0100 dt-bindings: clock: vf610: Add definitions for MTIP L2 switch This patch adds VF610_CLK_ESW and VF610_CLK_ESW_MAC_TAB{0123} macros definitions for L2 switch. Those definitions describe clocks for MoreThanIP switch IP block; the switch itself and the MAC address lookup table clocks. Signed-off-by: Lukasz Majewski Acked-by: Rob Herring (Arm) Reviewed-by: Peng Fan Link: https://patch.msgid.link/20260129095442.1646748-4-lukma@nabladev.com Signed-off-by: Abel Vesa commit 2f4788cca881d965188900843905c57aadd7855c Author: Lukasz Majewski Date: Thu Jan 29 10:54:40 2026 +0100 dt-bindings: clock: vf610: Drop VF610_CLK_END define The VF610_CLK_END should be dropped as it is not part of the ABI. Signed-off-by: Lukasz Majewski Acked-by: Rob Herring (Arm) Reviewed-by: Peng Fan Link: https://patch.msgid.link/20260129095442.1646748-3-lukma@nabladev.com Signed-off-by: Abel Vesa commit f5fd9ccf2d46ee7ef5b8ba645d3173116677cf7c Author: Lukasz Majewski Date: Thu Jan 29 10:54:39 2026 +0100 clk: vf610: Move VF610_CLK_END define to clk-vf610 driver The VF610_CLK_END was previously defined in vf610-clock.h to indicate the number of clocks. It is solely used in the clk driver to allocate proper size of the clk table. Moreover, when new clocks (like e.g. ones for MTIP L2 switch) are defined its value also changes, so it shall be locally adjusted. Signed-off-by: Lukasz Majewski Reviewed-by: Peng Fan Link: https://patch.msgid.link/20260129095442.1646748-2-lukma@nabladev.com Signed-off-by: Abel Vesa commit f2c2fc93b4a3efdfcf3805ab74741826d343ff2c Author: Stefan Eichenberger Date: Thu Feb 12 16:57:50 2026 +0800 clk: imx: imx8-acm: fix flags for acm clocks Currently, the flags for the ACM clocks are set to 0. This configuration causes the fsl-sai audio driver to fail when attempting to set the sysclk, returning an EINVAL error. The following error messages highlight the issue: fsl-sai 59090000.sai: ASoC: error at snd_soc_dai_set_sysclk on 59090000.sai: -22 imx-hdmi sound-hdmi: failed to set cpu sysclk: -22 By setting the flag CLK_SET_RATE_NO_REPARENT, we signal that the ACM driver does not support reparenting and instead relies on the clock tree as defined in the device tree. This change resolves the issue with the fsl-sai audio driver. CC: stable@vger.kernel.org Fixes: d3a0946d7ac9 ("clk: imx: imx8: add audio clock mux driver") Signed-off-by: Stefan Eichenberger Signed-off-by: Shengjiu Wang Reviewed-by: Peng Fan Link: https://patch.msgid.link/20260212085750.3253187-1-shengjiu.wang@nxp.com Signed-off-by: Abel Vesa commit 9faf207208951460f3f7eefbc112246c8d28ff1b Author: Felix Gu Date: Tue Feb 3 22:07:58 2026 +0800 clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() The function of_assigned_ldb_sels() calls of_parse_phandle_with_args() but never calls of_node_put() to release the reference, causing a memory leak. Fix this by adding proper cleanup calls on all exit paths. Fixes: 5d283b083800 ("clk: imx6: Fix procedure to switch the parent of LDB_DI_CLK") Signed-off-by: Felix Gu Reviewed-by: Frank Li Reviewed-by: Peng Fan Link: https://patch.msgid.link/20260203-clk-imx6q-v3-2-6cd2696bb371@gmail.com Signed-off-by: Abel Vesa commit 4b84d496c804b470124cd3a08e928df6801d8eae Author: Felix Gu Date: Tue Feb 3 22:07:57 2026 +0800 clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() The function pll6_bypassed() calls of_parse_phandle_with_args() but never calls of_node_put() to release the reference, causing a memory leak. Fix this by adding proper cleanup calls on all exit paths. Fixes: 3cc48976e9763 ("clk: imx6q: handle ENET PLL bypass") Signed-off-by: Felix Gu Reviewed-by: Frank Li Reviewed-by: Peng Fan Link: https://patch.msgid.link/20260203-clk-imx6q-v3-1-6cd2696bb371@gmail.com Signed-off-by: Abel Vesa commit a15840f7c3d7f7cac208df9c3a0dc651ebbfa80a Author: Alexander Stein Date: Fri Mar 13 08:07:32 2026 +0100 clk: imx: fracn-gppll: Add 477.4MHz support Add the 477.4MHz frequency support that can be used for display with pixelclk of 68.2 MHz. The divider of 7 is important for LVDS output on imx93. It is also usable for parallel output. Reviewed-by: Peng Fan Signed-off-by: Alexander Stein Link: https://patch.msgid.link/20260313070740.585043-3-alexander.stein@ew.tq-group.com Signed-off-by: Abel Vesa commit e2f8311a6aa5f809bb62de61888292e58087fd21 Author: Alexander Stein Date: Fri Mar 13 08:07:31 2026 +0100 clk: imx: fracn-gppll: Add 333.333333 MHz support Some parallel panels have a pixelclk of 33.30 MHz. Add support for 333.333333 MHz so a by 10 divider can be used to derive the exact pixelclk. Signed-off-by: Alexander Stein Reviewed-by: Abel Vesa Reviewed-by: Peng Fan Link: https://patch.msgid.link/20260313070740.585043-2-alexander.stein@ew.tq-group.com Signed-off-by: Abel Vesa commit 08841b06fa64d8edbd1a21ca6e613420c90cc4b8 Author: Seohyeon Maeng Date: Tue Mar 10 17:16:52 2026 +0900 udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in part_descs_loc[]. handle_partition_descriptor() deduplicates entries by partition number, but appended slots never record partnum. As a result duplicate Partition Descriptors are appended repeatedly and num_part_descs keeps growing. Once the table is full, the growth path still sizes the allocation from partnum even though inserts are indexed by num_part_descs. If partnum is already aligned to PART_DESC_ALLOC_STEP, ALIGN(partnum, step) can keep the old capacity and the next append writes past the end of the table. Store partnum in the appended slot and size growth from the next append count so deduplication and capacity tracking follow the same model. Fixes: ee4af50ca94f ("udf: Fix mounting of Win7 created UDF filesystems") Cc: stable@vger.kernel.org Signed-off-by: Seohyeon Maeng Link: https://patch.msgid.link/20260310081652.21220-1-bioloidgp@gmail.com Signed-off-by: Jan Kara commit 0cc24977224a6c7d470860265a4990109f0a32ee Author: Sumit Gupta Date: Wed Mar 18 15:20:05 2026 +0530 ACPI: CPPC: Check cpc_read() return values consistently Callers of cpc_read() ignore its return value, which can lead to using uninitialized or stale values when the read fails. Fix this by consistently checking cpc_read() return values in cppc_get_perf_caps(), cppc_get_perf_ctrs(), and cppc_get_perf(). Link: https://lore.kernel.org/lkml/48bdf87e-39f1-402f-a7dc-1a0e1e7a819d@nvidia.com/ Suggested-by: Rafael J. Wysocki Signed-off-by: Sumit Gupta Link: https://patch.msgid.link/20260318095005.2437960-1-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki commit d453086996957f1b87610315810235db7b03b3a6 Author: Rosen Penev Date: Sun Mar 15 16:10:00 2026 -0700 pinctrl: tegra: use flexible array member for array Simplifies allocation slightly by removing a kcalloc call and using struct_size. Signed-off-by: Rosen Penev [linusw@kernel.org: Add in count variable and use __counted_by()] Signed-off-by: Linus Walleij commit 47a9050e678c7929ada33c3f1f28ac4403423181 Author: Junhui Liu Date: Thu Mar 12 16:42:43 2026 +0800 gpio: spacemit-k1: Add set_config callback support Assign gpiochip_generic_config() to the set_config() callback to support pin configuration through the GPIO subsystem. This allows users to configure GPIO pin attributes like pull-up/down when specifying a GPIO line in the Device Tree. Signed-off-by: Junhui Liu Reviewed-by: Anand Moon Acked-by: Bartosz Golaszewski Reviewed-by: Yixun Lan Signed-off-by: Linus Walleij commit c3b0c06b73974d75c640a4ebc8678f8538654e5a Author: Junhui Liu Date: Thu Mar 12 16:42:42 2026 +0800 pinctrl: spacemit: return -ENOTSUPP for unsupported pin configurations Return -ENOTSUPP instead of -EINVAL when encountering unsupported pin configuration parameters. This is more logical and allows the GPIO subsystem to gracefully handle unsupported parameters via functions like gpio_set_config_with_argument_optional(), which specifically ignores -ENOTSUPP but treats others as failure. Signed-off-by: Junhui Liu Reviewed-by: Anand Moon Reviewed-by: Bartosz Golaszewski Reviewed-by: Yixun Lan Signed-off-by: Linus Walleij commit e65d430111a5ba83598b03a4aca4799eb295eef1 Author: Vlastimil Babka (SUSE) Date: Wed Mar 11 09:25:57 2026 +0100 slab: free remote objects to sheaves on memoryless nodes On memoryless nodes we can now allocate from cpu sheaves and refill them normally. But when a node is memoryless on a system without actual CONFIG_HAVE_MEMORYLESS_NODES support, freeing always uses the slowpath because all objects appear as remote. We could instead benefit from the freeing fastpath, because the allocations can't obtain local objects anyway if the node is memoryless. Thus adapt the locality check when freeing, and move them to an inline function can_free_to_pcs() for a single shared implementation. On configurations with CONFIG_HAVE_MEMORYLESS_NODES=y continue using numa_mem_id() so the percpu sheaves and barn on a memoryless node will contain mostly objects from the closest memory node (returned by numa_mem_id()). No change is thus intended for such configuration. On systems with CONFIG_HAVE_MEMORYLESS_NODES=n use numa_node_id() (the cpu's node) since numa_mem_id() just aliases it anyway. But if we are freeing on a memoryless node, allow the freeing to use percpu sheaves for objects from any node, since they are all remote anyway. This way we avoid the slowpath and get more performant freeing. The potential downside is that allocations will obtain objects with a larger average distance. If we kept bypassing the sheaves on freeing, a refill of sheaves from slabs would tend to get closer objects thanks to the ordering of the zonelist. Architectures that allow de-facto memoryless nodes without proper CONFIG_HAVE_MEMORYLESS_NODES support should perhaps consider adding such support. Link: https://patch.msgid.link/20260311-b4-slab-memoryless-barns-v1-3-70ab850be4ce@kernel.org Signed-off-by: Vlastimil Babka (SUSE) Reviewed-by: Harry Yoo Reviewed-by: Hao Li commit 7f693882f00963fd7808e333b86a87e0f9b9873b Author: Vlastimil Babka (SUSE) Date: Wed Mar 11 09:25:56 2026 +0100 slab: create barns for online memoryless nodes Ming Lei has reported [1] a performance regression due to replacing cpu (partial) slabs with sheaves. With slub stats enabled, a large amount of slowpath allocations were observed. The affected system has 8 online NUMA nodes but only 2 have memory. For sheaves to work effectively on given cpu, its NUMA node has to have struct node_barn allocated. Those are currently only allocated on nodes with memory (N_MEMORY) where kmem_cache_node also exist as the goal is to cache only node-local objects. But in order to have good performance on a memoryless node, we need its barn to exist and use sheaves to cache non-local objects (as no local objects can exist anyway). Therefore change the implementation to allocate barns on all online nodes, tracked in a new nodemask slab_barn_nodes. Also add a cpu hotplug callback as that's when a memoryless node can become online. Change both get_barn() and rcu_sheaf->node assignment to numa_node_id() so it's returned to the barn of the local cpu's (potentially memoryless) node, and not to the nearest node with memory anymore. On systems with CONFIG_HAVE_MEMORYLESS_NODES=y (which are not the main target of this change) barns did not exist on memoryless nodes, but get_barn() using numa_mem_id() meant a barn was returned from the nearest node with memory. This works, but the barn lock contention increases with every such memoryless node. With this change, barn will be allocated also on the memoryless node, reducing this contention in exchange for increased memory consumption. Reported-by: Ming Lei Link: https://lore.kernel.org/all/aZ0SbIqaIkwoW2mB@fedora/ [1] Link: https://patch.msgid.link/20260311-b4-slab-memoryless-barns-v1-2-70ab850be4ce@kernel.org Signed-off-by: Vlastimil Babka (SUSE) Reviewed-by: Harry Yoo Reviewed-by: Hao Li commit 5ba6bc27b1f99b35aa528409a8e223136c59e0af Author: Vlastimil Babka (SUSE) Date: Wed Mar 11 09:25:55 2026 +0100 slab: decouple pointer to barn from kmem_cache_node The pointer to barn currently exists in struct kmem_cache_node. That struct is instantiated for every NUMA node with memory, but we want to have a barn for every online node (including memoryless). Thus decouple the two structures. In struct kmem_cache we have an array for kmem_cache_node pointers that appears to be sized MAX_NUMNODES but the actual size calculation in kmem_cache_init() uses nr_node_ids. Therefore we can't just add another array of barn pointers. Instead change the array to newly introduced struct kmem_cache_per_node_ptrs holding both kmem_cache_node and barn pointer. Adjust barn accessor and allocation/initialization code accordingly. For now no functional change intended, barns are created 1:1 together with kmem_cache_nodes. Link: https://patch.msgid.link/20260311-b4-slab-memoryless-barns-v1-1-70ab850be4ce@kernel.org Signed-off-by: Vlastimil Babka (SUSE) Reviewed-by: Harry Yoo Reviewed-by: Hao Li commit 96450df197bda7de927b51372c13f1002d0e76e3 Author: Eric Woudstra Date: Tue Mar 17 12:03:47 2026 +0100 bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign In network setup as below: fastpath bypass .----------------------------------------. / \ | IP - forwarding | | / \ v | / wan ... | / | | | | | brlan.1 | | | +-------------------------------+ | | vlan 1 | | | | | | brlan (vlan-filtering) | | | +---------------+ | | | DSA-SWITCH | | | vlan 1 | | | | to | | | | untagged 1 vlan 1 | | +---------------+---------------+ . / \ ----->wlan1 lan0 . . . ^ ^ vlan 1 tagged packets untagged packets br_vlan_fill_forward_path_mode() sets DEV_PATH_BR_VLAN_UNTAG_HW when filling in from brlan.1 towards wlan1. But it should be set to DEV_PATH_BR_VLAN_UNTAG in this case. Using BR_VLFLAG_ADDED_BY_SWITCHDEV is not correct. The dsa switchdev adds it as a foreign port. The same problem for all foreignly added dsa vlans on the bridge. First add the vlan, trying only native devices. If this fails, we know this may be a vlan from a foreign device. Use BR_VLFLAG_TAGGING_BY_SWITCHDEV to make sure DEV_PATH_BR_VLAN_UNTAG_HW is set only when there if no foreign device involved. Acked-by: Nikolay Aleksandrov Signed-off-by: Eric Woudstra Link: https://patch.msgid.link/20260317110347.363875-1-ericwouds@gmail.com Signed-off-by: Paolo Abeni commit 0c45064487a10ee02b8bc528aa0664681c245243 Merge: 9f4960b94f1a04 d3244af9c4c2bb Author: Paolo Abeni Date: Thu Mar 19 12:50:42 2026 +0100 Merge tag 'ovpn-net-next-20260317' of https://github.com/OpenVPN/ovpn-net-next Antonio Quartulli says: ==================== Included features: * use bitops.h API when possible * send netlink notification in case of client float event * implement support for asymmetric peer IDs * consolidate memory allocations during crypto operations * add netlink notification check in selftests * add FW mark check in selftest * tag 'ovpn-net-next-20260317' of https://github.com/OpenVPN/ovpn-net-next: ovpn: consolidate crypto allocations in one chunk selftests: ovpn: add test for the FW mark feature selftests: ovpn: check asymmetric peer-id ovpn: add support for asymmetric peer IDs selftests: ovpn: add notification parsing and matching ovpn: notify userspace on client float event ovpn: pktid: use bitops.h API ovpn: use correct array size to parse nested attributes in ovpn_nl_key_swap_doit selftests: ovpn: allow compiling ovpn-cli.c with mbedtls3 ==================== Link: https://patch.msgid.link/20260317104023.192548-1-antonio@openvpn.net Signed-off-by: Paolo Abeni commit a464bace0482aa9a83e9aa7beefbaf44cd58e6cf Author: Ville Syrjälä Date: Fri Mar 13 13:07:40 2026 +0200 drm/i915: Order OP vs. timeout correctly in __wait_for() Put the barrier() before the OP so that anything we read out in OP and check in COND will actually be read out after the timeout has been evaluated. Currently the only place where we use OP is __intel_wait_for_register(), but the use there is precisely susceptible to this reordering, assuming the ktime_*() stuff itself doesn't act as a sufficient barrier: __intel_wait_for_register(...) { ... ret = __wait_for(reg_value = intel_uncore_read_notrace(...), (reg_value & mask) == value, ...); ... } Cc: stable@vger.kernel.org Fixes: 1c3c1dc66a96 ("drm/i915: Add compiler barrier to wait_for") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260313110740.24620-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 204f7c018d76c2488a90fc6681519b8eb6eebb1d Author: Wei-Lin Chang Date: Tue Mar 17 18:26:37 2026 +0000 KVM: arm64: ptdump: Make KVM ptdump code s2 mmu aware To reuse the ptdump code for shadow page table dumping later, let's pass s2 mmu as the private data, so we have the freedom to select which page table to print. Signed-off-by: Wei-Lin Chang Reviewed-by: Joey Gouly Link: https://patch.msgid.link/20260317182638.1592507-2-weilin.chang@arm.com Signed-off-by: Marc Zyngier commit fd93fc35cf4cd5936bbf7876e3bdc2a5933c8fd1 Author: Steffen Trumtrar Date: Tue Feb 17 16:35:16 2026 +0100 dt-bindings: leds: lp5860: add enable-gpio The VIO_EN pin on the lp5860 can either be connected to VIO power supply or GPIO. Add the enable-gpios pin to the binding documentation. Signed-off-by: Steffen Trumtrar Acked-by: Conor Dooley Link: https://patch.msgid.link/20260217-v6-19-topic-ti-lp5860-enable-gpio-v1-1-f5e8edeb5d74@pengutronix.de Signed-off-by: Lee Jones commit 9f4960b94f1a044f76da98a765d6cbd294c22c92 Author: Qingfang Deng Date: Tue Mar 17 13:41:40 2026 +0800 l2tp: ppp: use max L2TP header size for PPP channel hdrlen chan.hdrlen is read once at channel registration by ppp_register_net_channel(), and used to set the PPP net device's hard_header_len. It was set to PPPOL2TP_L2TP_HDR_SIZE_NOSEQ (6), which is 4 bytes too small if sequence numbers are later enabled via setsockopt(PPPOL2TP_SO_SENDSEQ), causing unnecessary skb reallocations on the TX path. The setsockopt handler attempted to change netdev's hard_header_len by updating chan.hdrlen, but the PPP layer never re-reads it after the registration, so the update had no effect. To avoid the unnecessary reallocations, set chan.hdrlen to PPPOL2TP_L2TP_HDR_SIZE_SEQ (10) unconditionally at registration and remove the ineffective update in the setsockopt callback. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260317054141.524879-1-dqfext@gmail.com Signed-off-by: Paolo Abeni commit c56af8fee9ec3124fa6c8cf3d2966070a7aed934 Author: Varun Gupta Date: Mon Mar 16 09:29:15 2026 +0530 drm/ttm: Fix spelling mistakes and comment style in ttm_resource.c Correct several spelling mistakes and textual inconsistencies in kdoc comments and inline comments. Suggested-by: Sanjay Yadav Signed-off-by: Varun Gupta Reviewed-by: Nitin Gote Link: https://patch.msgid.link/20260316035915.1403424-1-varun.gupta@intel.com Signed-off-by: Tejas Upadhyay commit 96a584db75bb21781562dc79f11932ce38a1205f Author: Simon Baatz Date: Mon Mar 16 19:51:10 2026 +0100 selftests/net: packetdrill: improve tcp_rcv_neg_window.pkt The test depends on accepting a packet that is larger than the advertised window and that does not trigger an immediate ACK. Previously, the test might still pass even if kernel behavior changed unexpectedly. Add assertions verifying that the large packet was accepted and no ACK was sent. Suggested-by: Eric Dumazet Signed-off-by: Simon Baatz Link: https://patch.msgid.link/20260316-improve_tcp_neg_usable_wnd_test-v1-1-f16d5e365107@gmail.com Signed-off-by: Paolo Abeni commit 9e63413827a8ea464249c0aa8046ac8fe7d9cc47 Merge: 7937ea733f79b3 d93f8ea0e5ad41 Author: Thomas Hellström Date: Thu Mar 19 10:01:55 2026 +0100 Merge drm/drm-next into drm-xe-next Bring in series "drm/{i915,xe}: sort out step enums between the drivers" that was merged through i915. Link: https://lore.kernel.org/all/cover.1772635152.git.jani.nikula@intel.com Signed-off-by: Thomas Hellström commit dee55bc7cb8ad70b8c8598df60f378b7aed2e41b Author: Roi L Date: Sat Mar 14 18:08:49 2026 +0200 qtnfmac: use alloc_netdev macro for single queue devices alloc_netdev is a macro for single queue devices, so there's no need to call alloc_netdev_mqs with a single tx/rx queue. Signed-off-by: Roi L Link: https://patch.msgid.link/SN6PR05MB58064E57FE979CE7B2BF7EF3DD42A@SN6PR05MB5806.namprd05.prod.outlook.com Signed-off-by: Johannes Berg commit 7c5c2b661bdb78c1472b8833265c9ed1ee880039 Author: Heitor Alves de Siqueira Date: Fri Mar 13 18:27:58 2026 -0300 wifi: libertas: don't kill URBs in interrupt context Serialization for the TX path was enforced by calling usb_kill_urb()/usb_kill_anchored_urbs(), to prevent transmission before a previous URB was completed. usb_tx_block() can be called from interrupt context (e.g. in the HCD giveback path), so we can't always use it to kill in-flight URBs. Prevent sleeping during interrupt context by checking the tx_submitted anchor for existing URBs. We now return -EBUSY, to indicate there's a pending request. Reported-by: syzbot+74afbb6355826ffc2239@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=74afbb6355826ffc2239 Fixes: d66676e6ca96 ("wifi: libertas: fix WARNING in usb_tx_block") Signed-off-by: Heitor Alves de Siqueira Link: https://patch.msgid.link/20260313-libertas-usb-anchors-v1-2-915afbe988d7@igalia.com Signed-off-by: Johannes Berg commit a57f35fc19add4dfe33703af575a2c19c2cef9c7 Author: Heitor Alves de Siqueira Date: Fri Mar 13 18:27:57 2026 -0300 wifi: libertas: use USB anchors for tracking in-flight URBs The libertas driver currently handles URB lifecycles manually, which makes it non-trivial to check if specific URBs are pending or not. Add anchors for TX/RX URBs, and use those to track in-flight requests. Signed-off-by: Heitor Alves de Siqueira Link: https://patch.msgid.link/20260313-libertas-usb-anchors-v1-1-915afbe988d7@igalia.com Signed-off-by: Johannes Berg commit f10ebd136dfef1d8fac0ac29587e7e898c980e3e Author: Johannes Berg Date: Mon Mar 16 12:30:50 2026 +0100 wifi: nl80211: use int for band coming from netlink This was pointed out before, but there are issues with just removing the <0 check since enum representation isn't fixed, nla_type() returns int but really can only return small non-negative values, etc. Now newer versions of sparse are also starting to warn on it. Just use int for the band var. Link: https://patch.msgid.link/20260316123050.8c2d9f3426a0.I86acfa785982993fbffd148cc59049991bd6158f@changeid Signed-off-by: Johannes Berg commit 777d8ba5aada960c666f810d5d820ab55ebb64c3 Author: Ville Nummela Date: Wed Mar 18 10:19:12 2026 +0200 wifi: rsi_91x_usb: do not pause rfkill polling when stopping mac80211 Removing rsi_91x USB adapter could cause rtnetlink to lock up. When rsi_mac80211_stop is called, wiphy_lock is locked. Call to wiphy_rfkill_stop_polling would wait until the work queue has finished, but because the work queue waits for wiphy_lock, that would never happen. Moving the call to rsi_disconnect avoids the lock up. Signed-off-by: Ville Nummela Link: https://patch.msgid.link/20260318081912.87744-1-ville.nummela@kempower.com Signed-off-by: Johannes Berg commit eb092b188fcf96ef2c770ff086ebfc2a15b061d3 Author: Johannes Berg Date: Wed Mar 18 18:06:22 2026 +0100 wifi: mac80211: fix STA link removal during link removal ieee80211_sta_free_link() only frees the link and doesn't unhash it, so it can't be used here. Instead this needs to use ieee80211_sta_remove_link(), which unhashes it. An argument against it was that it also calls the driver and that already happened, but calls to the driver removing a link that's already removed are suppressed, so that's not actually an issue. Use it to fix the hashtable. Reported-and-tested-by: Jouni Malinen Fixes: 84674b03d8bf ("wifi: mac80211: Remove deleted sta links in ieee80211_ml_reconf_work()") Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260318180622.9240067117e9.I45fb2b7f04d75e48d2f3e9c6650ef9f54a314f5b@changeid Signed-off-by: Johannes Berg commit 0e2c4117c3512cf6b8f54c2c3d37564bfa3ccd67 Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:38 2026 +0200 staging: media: tegra-video: add CSI support for Tegra20 and Tegra30 Add support for MIPI CSI device and calibration logic found in Tegra20 and Tegra30 SoC. To get CSI operational, an additional syncpoint was allocated to serve as the CSI frame counter. Both VIP and CSI use an existing syncpoint for VI frame start events. That said, the frame capture function was refactored to reflect the addition of the CSI syncpoint, and the CSI-specific configuration is guarded by the presence of a passed CSI channel structure pointer. The camera capture setup's configuration was reconsidered: the first two writes must be done before tegra_channel_set_stream for MIPI calibration to work properly; the third write was moved to VIP/CSI-specific functions since it must be source-specific; the function was placed after tegra_channel_set_stream so the initial sequence is preserved and expanded. CSI configuration sequences were added based on downstream 3.1 kernel sources and adjusted to the existing video-tegra framework. Although Tegra20 and Tegra30 have the same set of configurations, they differ by the number of clocks used by CSI. Dropped the software syncpoint counters in favor of reading syncpoints directly and passing the incremented value to the polling function. If the syncpoint increase fails, the PP is reset. This change should prevent possible race conditions. MIPI calibration logic was registered in CSI since Tegra20 and Tegra30 have no dedicated hardware block for these operations and use CSI. These calls are used for both CSI and DSI to work properly, which is why MIPI calibration cannot be contained within CSI. The pads passed to the calibration calls resemble CSI PORT_A (0), CSI PORT_B (1), DSI-A (3) and DSI-B (4). Tested-by: Luca Ceresoli # tegra20, parallel camera Co-developed-by: Jonas Schwöbel Signed-off-by: Jonas Schwöbel Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Hans Verkuil commit d974a67033f4c4bd8cf6864a6b30c5f997c6841e Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:37 2026 +0200 staging: media: tegra-video: tegra20: adjust luma buffer stride Luma buffer stride is calculated by multiplying height in pixels of image by bytes per line. Adjust that value accordingly. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Hans Verkuil commit 001beb030603f77c7bb46661483f3b9d85d8ce61 Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:36 2026 +0200 staging: media: tegra-video: tegra20: expand format support with RAW8/10 and YUV422/YUV420p 1X16 Add support for Bayer formats (RAW8 and RAW10) and YUV422/420p 1X16 versions of existing YUV422/YUV420p 2X8. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Hans Verkuil commit 071fa83ded5e0d369e3dd2af2afb70e09b39336c Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:35 2026 +0200 staging: media: tegra-video: tegra20: increase maximum VI clock frequency Increase maximum VI clock frequency to 450MHz to allow correct work with high resolution camera sensors. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Hans Verkuil commit d8f8373f1a319830e54791ee0e18aed1e0f2bd56 Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:34 2026 +0200 staging: media: tegra-video: tegra20: set VI HW revision According to TRM Tegra20, Tegra30 and Tegra114 have VI revision 1, Tegra124 has revision 2 and Tegra210 has revision 3. Set correct revision in tegra20_vi_soc like tegra210 does. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Signed-off-by: Hans Verkuil commit 8e3d2fbc961ccb3ae7bc8b6177a96ab8d20d7284 Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:33 2026 +0200 staging: media: tegra-video: tegra20: adjust format align calculations Expand supported formats structure with data_type and bit_width fields required for CSI support. Adjust tegra20_fmt_align by factoring out common bytesperline and sizeimage calculation logic shared by supported planar and non-planar formats and leaving planar-related correction under a switch. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Hans Verkuil commit 541f95b23c5662ec9a585c468d0abe4572cd8aa6 Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:32 2026 +0200 staging: media: tegra-video: tegra20: add support for second output of VI VI in Tegra20/Tegra30 has 2 VI outputs with different set of supported formats. Convert output registers to macros for simpler work with both outputs since apart formats their layout matches. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Hans Verkuil commit 9e539666209de05980a20720f6eae7332690003d Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:31 2026 +0200 staging: media: tegra-video: tegra20: set correct maximum width and height Maximum width and height for Tegra20 and Tegra30 is determined by respective register field, rounded down to factor of 2, which is 8191U rounded down to 8190U. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Hans Verkuil commit 3bcd5a240372cacf0587c549b25a43e246d53bdd Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:30 2026 +0200 staging: media: tegra-video: csi: move avdd-dsi-csi-supply from VI to CSI The avdd-dsi-csi-supply is CSI power supply not VI, hence move it to proper place. Signed-off-by: Svyatoslav Ryhel Tested-by: Luca Ceresoli # Tegra20 VIP Reviewed-by: Luca Ceresoli Reviewed-by: Mikko Perttunen Signed-off-by: Hans Verkuil commit 6017e97f50f8c9cbdd448b3569bc19152f57cd87 Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:29 2026 +0200 staging: media: tegra-video: vi: improve logic of source requesting By default tegra_channel_get_remote_csi_subdev returns next device in pipe assuming it is CSI but in case of Tegra20 and Tegra30 it can also be VIP or even HOST. Define tegra_channel_get_remote_csi_subdev within CSI and add check if returned device is actually CSI by comparing subdevice operations. Previous tegra_channel_get_remote_csi_subdev definition in VI rename to tegra_channel_get_remote_bridge_subdev and use it only in VI driver since core VI driver does not care about source and does not call any specific functions. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Signed-off-by: Hans Verkuil commit c888c4c834c9afc18879fde91ad405be21b7425d Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:28 2026 +0200 gpu: host1x: convert MIPI to use operation function pointers Convert existing MIPI code to use operation function pointers, a necessary step for supporting Tegra20/Tegra30 SoCs. All common MIPI configuration that is SoC-independent remains in mipi.c, while all SoC-specific code is moved to tegra114-mipi.c (The naming matches the first SoC generation with a dedicated calibration block). Shared structures and function calls are placed into tegra-mipi-cal.h. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Acked-by: Mikko Perttunen Signed-off-by: Hans Verkuil commit 6926495fa5204fa50f164c92bb63a303e0a829ff Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:27 2026 +0200 staging: media: tegra-video: csi: move CSI helpers to header Move CSI helpers into the header for easier access from SoC-specific video driver parts. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Signed-off-by: Hans Verkuil commit 4c9f5dc5210b0cbcf5582c8e1484659da376807f Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:26 2026 +0200 staging: media: tegra-video: vi: add flip controls only if no source controls are provided Because the current Tegra video driver is video-centric, it exposes all controls via /dev/video. If both the camera sensor and the VI provide hflip and vflip, the driver will fail because only one control is allowed. To address this, hflip and vflip should be added from the SoC only if the camera sensor doesn't provide those controls. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Signed-off-by: Hans Verkuil commit 8a50111951356d1975f63dcf3dd2f91edacfadf1 Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:25 2026 +0200 staging: media: tegra-video: vi: adjust get_selection operation check During __tegra_channel_try_format, the VI (Video Input) checks if the camera sensor driver provides a get_selection operation. If this operation is unavailable, the crop is set to 0. However, if the operation is available but returns an error, the VI currently fails. While this works for simple cameras with a single pad, it creates a corner case for sensors like the mt9m114. This sensor provides the same operation set for both IFP pads, but returns an error when get_selection is called on an unsupported pad (such as the source pad), causing the aforementioned behavior. To resolve this, if get_selection is implemented but returns an error, try_crop is now set to 0 — treating it as if the operation was not implemented — instead of returning a failure. Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Svyatoslav Ryhel Signed-off-by: Hans Verkuil commit 410ff94513353f737058bb0f5ffba8dae14f1a43 Author: Svyatoslav Ryhel Date: Tue Mar 3 10:42:24 2026 +0200 staging: media: tegra-video: expand VI and VIP support to Tegra30 Existing VI and VIP implementation for Tegra20 is fully compatible with Tegra30. Signed-off-by: Svyatoslav Ryhel Tested-by: Luca Ceresoli # Tegra20 VIP Reviewed-by: Luca Ceresoli Signed-off-by: Hans Verkuil commit eef6d4449e8a540fde792968a26d8aa514af8089 Author: Shin-Yi Lin Date: Thu Mar 12 13:57:24 2026 +0800 wifi: rtw89: usb: Rx aggregation for RTL8832CU/RTL8851BU USB RX Aggregation is a performance optimization technique used in USB network devices to increase throughput. Instead of sending every received network packet to the host computer individually, the device hardware groups multiple smaller packets into a single, large USB Bulk Transfer. * toAP/toNB use iperf3 respectively. With Cisco BE6000 - iperf3 tcp 10 pair (to another NB) [6G 160Mhz]: RTL8832CU-USB3.0 before after TX 941 941 RX 847 919 RTL8832CU-USB2.0 before after TX 293 286 RX 342 356 [5G 80Mhz]: RTL8832CU-USB3.0 before after TX 864 877 RX 864 902 RTL8832CU-USB2.0 before after TX 279 271 RX 327 349 RTL8851BU before after TX 115 114 RX 295 306 Signed-off-by: Shin-Yi Lin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260312055724.12177-1-pkshih@realtek.com commit 0f9bcf224f983e27f29fb0349c113b4817d5357c Author: Marek Vasut Date: Thu Mar 12 23:49:01 2026 +0100 dt-bindings: touchscreen: trivial-touch: Move allOf: after required: Majority of schemas place allOf: after required: . Documentation Documentation/devicetree/bindings/writing-schema.rst also hints at this ordering. Trivially update this schema. No functional change. Signed-off-by: Marek Vasut Acked-by: Conor Dooley Reviewed-by: Frank Li Link: https://patch.msgid.link/20260312224925.186077-1-marek.vasut+renesas@mailbox.org Signed-off-by: Dmitry Torokhov commit 35e688ec5010bd246cd3106b0c8a65df130a9a79 Author: Eduard Bostina Date: Mon Mar 16 20:10:37 2026 +0200 dt-bindings: input: touchscreen: Convert TS-4800 to DT schema Convert the TS-4800 touchscreen bindings to DT schema. Signed-off-by: Eduard Bostina Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260316181038.9771-1-egbostina@gmail.com Signed-off-by: Dmitry Torokhov commit 8ad2c6a36ac4328072377906a47ea0bff11e4032 Author: Shardul Bankar Date: Wed Mar 18 13:08:23 2026 +0530 hfsplus: validate b-tree node 0 bitmap at mount time Syzkaller reported an issue with corrupted HFS+ images where the b-tree allocation bitmap indicates that the header node (Node 0) is free. Node 0 must always be allocated as it contains the b-tree header record and the allocation bitmap itself. Violating this invariant leads to allocator corruption, which cascades into kernel panics or undefined behavior when the filesystem attempts to allocate blocks. Prevent trusting a corrupted allocator state by adding a validation check during hfs_btree_open(). Introduce the hfs_bmap_test_bit() helper (utilizing the newly added map-access API) to safely verify that the MSB of the first bitmap byte (representing Node 0) is marked as allocated. The helper returns a boolean, allowing the caller to safely catch both structural IO errors and illegally cleared bits in a single check. If corruption is detected, print a warning identifying the specific corrupted tree and force the filesystem to mount read-only (SB_RDONLY). This prevents kernel panics from corrupted images while enabling data recovery. As a minor cleanup to support the warning logs, replace the verbose CNID logic with cleaner macro definitions (using official structural names like "Extents Overflow File") and a dedicated string lookup helper. Reported-by: syzbot+1c8ff72d0cd8a50dfeaa@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=1c8ff72d0cd8a50dfeaa Link: https://lore.kernel.org/all/20260315172005.2066677-1-shardul.b@mpiricsoftware.com/ Signed-off-by: Shardul Bankar Reviewed-by: Viacheslav Dubeyko Tested-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260318073823.3933718-3-shardul.b@mpiricsoftware.com Signed-off-by: Viacheslav Dubeyko commit a8eed0ba6a4b2f1803ecdfa9f11a4818cf87c474 Author: Shardul Bankar Date: Wed Mar 18 13:08:22 2026 +0530 hfsplus: refactor b-tree map page access and add node-type validation In HFS+ b-trees, the node allocation bitmap is stored across multiple records. The first chunk resides in the b-tree Header Node at record index 2, while all subsequent chunks are stored in dedicated Map Nodes at record index 0. This structural quirk forces callers like hfs_bmap_alloc() and hfs_bmap_free() to duplicate boilerplate code to validate offsets, correct lengths, and map the underlying pages via kmap_local_page(). There is also currently no strict node-type validation before reading these records, leaving the allocator vulnerable if a corrupted image points a map linkage to an Index or Leaf node. Introduce a unified bit-level API to encapsulate the map record access: 1. A new `struct hfs_bmap_ctx` to cleanly pass state and safely handle page math across all architectures. 2. `hfs_bmap_get_map_page()`: Automatically validates node types (HFS_NODE_HEADER vs HFS_NODE_MAP), infers the correct record index, handles page-boundary math, and returns the unmapped `struct page *` directly to the caller to avoid asymmetric mappings. 3. `hfs_bmap_clear_bit()`: A clean wrapper that internally handles page mapping/unmapping for single-bit operations. Refactor hfs_bmap_alloc() and hfs_bmap_free() to utilize this new API. This deduplicates the allocator logic, hardens the map traversal against fuzzed images, and provides the exact abstractions needed for upcoming mount-time validation checks. Signed-off-by: Shardul Bankar Reviewed-by: Viacheslav Dubeyko Tested-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260318073823.3933718-2-shardul.b@mpiricsoftware.com Signed-off-by: Viacheslav Dubeyko commit 46fcbcaa72885e814fa0e4cc306f13af41d086e2 Author: Sibi Sankar Date: Fri Mar 13 17:38:11 2026 +0530 dt-bindings: remoteproc: qcom,sm8550-pas: Add Glymur CDSP Document compatible for Qualcomm Glymur CDSP PAS which is compatible with SM8550 SoC except for the one additional interrupt ("shutdown-ack"). Similar to the Qualcomm Kaanapali SoC, "global_sync_mem" is not managed by the kernel so it remains unlisted. Signed-off-by: Sibi Sankar Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260313120814.1312410-3-sibi.sankar@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 217fb074eb108075c26ddf96f3456c47e279fc15 Author: Sibi Sankar Date: Fri Mar 13 17:38:10 2026 +0530 dt-bindings: remoteproc: qcom,sm8550-pas: Add Glymur ADSP Document compatible for Qualcomm Glymur ADSP PAS which is compatible with SM8750, which can fallback to SM8550 except for the one additional interrupt ("shutdown-ack"). Signed-off-by: Sibi Sankar Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260313120814.1312410-2-sibi.sankar@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 56f809222ea762f38f58e01d09aa58f0f3c4b788 Author: Srinivas Kandagatla Date: Fri Mar 13 10:38:22 2026 +0000 arm64: defconfig: Enable configs for Arduino VENTUNO Q Enable ETHERNET PHY and Analog codec configs required for Arduino VENTUNO Q board. Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260313103824.2634519-8-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a7fb05cbb8f989fa5a81818be9680464cff9d717 Merge: 04cd075557e8f6 d01440e10a82ca Author: Jakub Kicinski Date: Wed Mar 18 20:01:14 2026 -0700 Merge branch 'add-ethtool-coalesce_rx_cqe_frames-nsecs-and-use-it-in-mana-driver' Haiyang Zhang says: ==================== add ethtool COALESCE_RX_CQE_FRAMES/NSECS and use it in MANA driver Add two parameters for drivers supporting Rx CQE Coalescing. ETHTOOL_A_COALESCE_RX_CQE_FRAMES: Maximum number of frames that can be coalesced into a CQE or writeback. ETHTOOL_A_COALESCE_RX_CQE_NSECS: Max time in nanoseconds after the first packet arrival in a coalesced CQE or writeback to be sent. Also implement it in MANA driver with the new parameter and counters. ==================== Link: https://patch.msgid.link/20260317191826.1346111-1-haiyangz@linux.microsoft.com Signed-off-by: Jakub Kicinski commit d01440e10a82cae2c4a28c76e46e6a8b94b27a84 Author: Haiyang Zhang Date: Tue Mar 17 12:18:07 2026 -0700 net: mana: Add ethtool counters for RX CQEs in coalesced type For RX CQEs with type CQE_RX_COALESCED_4, to measure the coalescing efficiency, add counters to count how many contains 2, 3, 4 packets respectively. Also, add a counter for the error case of first packet with length == 0. Reviewed-by: Long Li Signed-off-by: Haiyang Zhang Link: https://patch.msgid.link/20260317191826.1346111-4-haiyangz@linux.microsoft.com Signed-off-by: Jakub Kicinski commit c2fe3ff3d66d6f53ec5857c277fae5b3ff9881c1 Author: Haiyang Zhang Date: Tue Mar 17 12:18:06 2026 -0700 net: mana: Add support for RX CQE Coalescing Our NIC can have up to 4 RX packets on 1 CQE. To support this feature, check and process the type CQE_RX_COALESCED_4. The default setting is disabled, to avoid possible regression on latency. And, add ethtool handler to switch this feature. To turn it on, run: ethtool -C rx-cqe-frames 4 To turn it off: ethtool -C rx-cqe-frames 1 The rx-cqe-nsec is the time out value in nanoseconds after the first packet arrival in a coalesced CQE to be sent. It's read-only for this NIC. Reviewed-by: Long Li Signed-off-by: Haiyang Zhang Link: https://patch.msgid.link/20260317191826.1346111-3-haiyangz@linux.microsoft.com Signed-off-by: Jakub Kicinski commit dc3d720e12f602059490c1ab2bfee84a7465998f Author: Haiyang Zhang Date: Tue Mar 17 12:18:05 2026 -0700 net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS Add two parameters for drivers supporting Rx CQE coalescing / descriptor writeback. ETHTOOL_A_COALESCE_RX_CQE_FRAMES: Maximum number of frames that can be coalesced into a CQE or writeback. ETHTOOL_A_COALESCE_RX_CQE_NSECS: Max time in nanoseconds after the first packet arrival in a coalesced CQE or writeback to be sent. Signed-off-by: Haiyang Zhang Link: https://patch.msgid.link/20260317191826.1346111-2-haiyangz@linux.microsoft.com Signed-off-by: Jakub Kicinski commit ecaec77148428fd372a57eadbcca68845a8c68f7 Author: Pengyu Luo Date: Fri Mar 13 19:10:18 2026 +0800 clk: qcom: videocc-sm8350: use depend on instead of select Both sm8350 and sc8280xp use this, on sc8280xp, this would select gcc-sm8350, we don't neet it on sc8280xp. use depend on to fix it. Signed-off-by: Pengyu Luo Reviewed-by: Imran Shaik Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260313111018.130068-1-mitltlatltl@gmail.com Signed-off-by: Bjorn Andersson commit 678647c26e317d8d1de4d630ee9ffa7ecad637fe Author: Luca Weiss Date: Fri Jan 16 15:50:47 2026 +0100 soc: qcom: pd-mapper: Add Milos compatible Add support for the Qualcomm Milos SoC to the protection domain mapper. Milos shares the same protection domain configuration as SM8550, so reuse the existing SM8550 domain data. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260116-milos-fp6-bt-wifi-v1-1-27b4fbb77e9c@fairphone.com Signed-off-by: Bjorn Andersson commit a37cd9efe3d21b2d21c85b38001a367e2a50c2bf Author: Abel Vesa Date: Mon Mar 16 13:23:52 2026 +0200 arm64: defconfig: Enable Qualcomm Eliza basic resource providers Enable the interconnect, pinctrl and Global Clock Controller (GCC) providers as built-in, and the Top Control and Status Register (TCSR) clock provider as module, on the Qualcomm Eliza SoC. These are all necessary in order to be able to boot up Eliza-based MTP board with debug UART and rootfs on UFS storage. Signed-off-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260316-arm64-defconfig-enable-eliza-basic-providers-v1-1-7ae581670aa8@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 27c7ec7ad7dbc7baeede6ca7429f294bc33cae13 Author: John Crispin Date: Wed Mar 11 19:21:42 2026 +0100 clk: qcom: gcc-ipq6018: mark gcc_xo_clk_src as critical The XO clock source is always-on in hardware and cannot be gated. Without CLK_IS_CRITICAL, runtime PM of downstream consumers (such as the CMN PLL driver) cascades a disable up to gcc_xo_clk_src, causing a branch status timeout warning. The IPQ8074 GCC driver already marks this clock as CLK_IS_CRITICAL. Apply the same fix to IPQ6018. Signed-off-by: John Crispin Signed-off-by: Christian Marangi Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260311182147.30266-1-ansuelsmth@gmail.com Signed-off-by: Bjorn Andersson commit 04cd075557e8f68e709d69ede0a8daedee3813f9 Author: Saeed Mahameed Date: Tue Mar 17 12:45:48 2026 +0200 net/mlx5e: Remove unused field in mlx5e_flow_steering struct Not used in mlx5e, clean it up. Signed-off-by: Saeed Mahameed Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260317104548.15697-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 3883c2b5091016da2b23ba365f296310f1042321 Author: Bobby Eshleman Date: Mon Mar 16 17:56:15 2026 -0700 selftests/vsock: auto-detect kernel for guest VMs When running vmtest.sh inside a nested VM the running kernel may not be installed on the filesystem at the standard /boot/ or /usr/lib/modules/ paths. Previously, this would cause vng to fail with "does not exist" since it could not find the kernel image. Instead, this patch uses --dry-run to detect if the kernel is available. If not, then we fall back to the kernel in the kernel source tree. If that fails, then we die. This way runners, like NIPA, can use vng --run arch/x86/boot/bzImage to setup an outer VM, and vmtest.sh will still do the right thing setting up the inner VM. Due to job control issues in vng, a workaround is used to prevent 'make kselftest TARGETS=vsock' from hanging until test timeout. A PR has been placed upstream to solve the issue in vng: https://github.com/arighi/virtme-ng/pull/453 Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260316-vsock-vmtest-autodetect-kernel-v2-1-5eec7b4831f8@meta.com Signed-off-by: Jakub Kicinski commit b39ae8c2f3de2a2429caad9dd414db14f84bcc8e Author: Val Packett Date: Thu Mar 12 08:12:16 2026 -0300 clk: qcom: camcc-sc8180x: Refactor to use qcom_cc_driver_data Use a qcom_cc_driver_data struct instead of a long custom probe callback to align with modern qcom/gcc-*.c style. No functional change intended. Signed-off-by: Val Packett Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260312112321.370983-12-val@packett.cool Signed-off-by: Bjorn Andersson commit acf7a91d0b0e9e3ef374944021de62062125b7e4 Author: Val Packett Date: Thu Mar 12 08:12:13 2026 -0300 clk: qcom: dispcc-sm8250: Enable parents for pixel clocks Add CLK_OPS_PARENT_ENABLE to MDSS pixel clock sources to ensure parent clocks are enabled during clock operations, preventing potential stability issues during display configuration. Fixes: 80a18f4a8567 ("clk: qcom: Add display clock controller driver for SM8150 and SM8250") Signed-off-by: Val Packett Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260312112321.370983-9-val@packett.cool Signed-off-by: Bjorn Andersson commit 8c522da70f0c2e5148c4c13ccb1c64cca57a6fdb Author: Val Packett Date: Thu Mar 12 08:12:12 2026 -0300 clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk mdss_gdsc can get stuck on boot due to RCGs being left on from last boot. As a fix, commit 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") introduced a callback to ensure the RCG is off upon init. However, the fix depends on all shared RCGs being marked as such in code. For SM8150/SC8180X/SM8250 the MDSS vsync clock was using regular ops, unlike the same clock in the SC7180 code. This was causing display to frequently fail to initialize after rebooting on the Surface Pro X. Fix by using shared ops for this clock. Fixes: 80a18f4a8567 ("clk: qcom: Add display clock controller driver for SM8150 and SM8250") Signed-off-by: Val Packett Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260312112321.370983-8-val@packett.cool Signed-off-by: Bjorn Andersson commit f641773e10fa5e85154554b15f2aff30e050bdcb Author: Val Packett Date: Thu Mar 12 08:12:11 2026 -0300 clk: qcom: gcc-sc8180x: Refactor to use qcom_cc_driver_data Use a qcom_cc_driver_data struct instead of a long custom probe callback to align with modern qcom/gcc-*.c style. No functional change intended. Signed-off-by: Val Packett Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260312112321.370983-7-val@packett.cool Signed-off-by: Bjorn Andersson commit 733220662679da538c5c416b3367acc7cb212f29 Author: Val Packett Date: Thu Mar 12 08:12:10 2026 -0300 clk: qcom: gcc-sc8180x: Enable runtime PM support The GCC block on SC8180X is powered by the CX rail. We need to ensure that it's enabled to prevent unwanted power collapse. Enable runtime PM to keep the power flowing only when necessary. Signed-off-by: Val Packett Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260312112321.370983-6-val@packett.cool Signed-off-by: Bjorn Andersson commit ccb92c78b42edd26225b4d5920847dfee3e1b093 Author: Val Packett Date: Thu Mar 12 08:12:09 2026 -0300 clk: qcom: gcc-sc8180x: Use retention for PCIe power domains As the PCIe host controller driver does not yet support dealing with the loss of state during suspend, use retention for relevant GDSCs. This fixes the link not surviving upon resume: nvme 0002:01:00.0: Unable to change power state from D3cold to D0, device inaccessible nvme nvme0: controller is down; will reset: CSTS=0xffffffff, PCI_STATUS read failed (134) nvme 0002:01:00.0: Unable to change power state from D3cold to D0, device inaccessible nvme nvme0: Disabling device after reset failure: -19 Fixes: 4433594bbe5d ("clk: qcom: gcc: Add global clock controller driver for SC8180x") Reviewed-by: Dmitry Baryshkov Signed-off-by: Val Packett Reviewed-by: Konrad Dybcio Reviewed-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20260312112321.370983-5-val@packett.cool Signed-off-by: Bjorn Andersson commit 25bc96f26cd6c19dde13a0b9859183e531d6fbfc Author: Val Packett Date: Thu Mar 12 08:12:08 2026 -0300 clk: qcom: gcc-sc8180x: Use retention for USB power domains The USB subsystem does not expect to lose its state on suspend: xhci-hcd xhci-hcd.0.auto: xHC error in resume, USBSTS 0x401, Reinit usb usb1: root hub lost power or was reset (The reinitialization usually succeeds, but it does slow down resume.) To maintain state during suspend, the relevant GDSCs need to stay in retention mode, like they do on other similar SoCs. Change the mode to PWRSTS_RET_ON to fix. Fixes: 4433594bbe5d ("clk: qcom: gcc: Add global clock controller driver for SC8180x") Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Val Packett Link: https://lore.kernel.org/r/20260312112321.370983-4-val@packett.cool Signed-off-by: Bjorn Andersson commit 3565741eb985a8a7cc6656eb33496195468cb99e Author: Val Packett Date: Thu Mar 12 08:12:07 2026 -0300 clk: qcom: gcc-sc8180x: Add missing GDSCs There are 5 more GDSCs that we were ignoring and not putting to sleep, which are listed in downstream DTS. Add them. Fixes: 4433594bbe5d ("clk: qcom: gcc: Add global clock controller driver for SC8180x") Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Val Packett Link: https://lore.kernel.org/r/20260312112321.370983-3-val@packett.cool Signed-off-by: Bjorn Andersson commit 76404ffbf07f28a5ec04748e18fce3dac2e78ef6 Author: Val Packett Date: Thu Mar 12 08:12:06 2026 -0300 dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs There are 5 more GDSCs that we were ignoring and not putting to sleep, which are listed in downstream DTS. Add them. Signed-off-by: Val Packett Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260312112321.370983-2-val@packett.cool Signed-off-by: Bjorn Andersson commit 76eea68d5fe5c6474b4f2f63f785fd9f12789f5c Merge: d5516452a362aa 4dd2115f43594d Author: Jakub Kicinski Date: Wed Mar 18 19:08:49 2026 -0700 Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2026-03-17 The following pull-request contains common mlx5 updates * 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Expose MLX5_UMR_ALIGN definition {net/RDMA}/mlx5: Add LAG demux table API and vport demux rules net/mlx5: Add VHCA RX flow destination support for FW steering net/mlx5: LAG, replace mlx5_get_dev_index with LAG sequence number net/mlx5: E-switch, modify peer miss rule index to vhca_id net/mlx5: LAG, use xa_alloc to manage LAG device indices net/mlx5: LAG, replace pf array with xarray net/mlx5: Add silent mode set/query and VHCA RX IFC bits net/mlx5: Add IFC bits for shared headroom pool PBMC support net/mlx5: Expose TLP emulation capabilities net/mlx5: Add TLP emulation device capabilities ==================== Link: https://patch.msgid.link/20260317075844.12066-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d5516452a362aab2c136ab815967c4417c92d228 Author: Eric Biggers Date: Mon Mar 16 15:14:53 2026 -0700 qed: Reimplement qed_mcast_bin_from_mac() using library functions The calculation done by qed_calc_crc32c() is the standard least-significant-bit-first CRC-32C except it uses most-significant-bit-first order for the actual CRC variable. That is equivalent to bit-reflecting the input and output CRC. Replace it with equivalent calls to the corresponding library functions. Tested with a simple userspace program which tested that the old and new implementations of qed_mcast_bin_from_mac() produce the same outputs. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260316221453.66078-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 4455a30b043ac2e20369b400a2132aaf127735e3 Merge: 2839841f8e8fb1 96aca5efec8a73 Author: Jakub Kicinski Date: Wed Mar 18 19:05:16 2026 -0700 Merge branch 'net-mlx5-support-ptm-on-arm-architecture' Tariq Toukan says: ==================== net/mlx5: Support PTM on ARM architecture This series by Carolina refactors mlx5 crosststamp initialization and enables cross-timestamp support on ARM. ==================== Link: https://patch.msgid.link/20260316133607.8738-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 96aca5efec8a737057f31cd61586a4bb62af9829 Author: Carolina Jubran Date: Mon Mar 16 15:36:07 2026 +0200 net/mlx5: Support cross-timestamping on ARM architectures Extend cross-timestamp support for ARM systems that implement the ARM architected timer. Signed-off-by: Carolina Jubran Reviewed-by: Shahar Shitrit Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260316133607.8738-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit f87ca3b905e2226b31510de1f53b5df6dd0f80aa Author: Carolina Jubran Date: Mon Mar 16 15:36:06 2026 +0200 net/mlx5: Move crosststamp setup into helper function Move the crosststamp registration logic into a dedicated helper, mlx5_init_crosststamp(). This prepares the code for a follow-up patch around PTM handling. Signed-off-by: Carolina Jubran Reviewed-by: Shahar Shitrit Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260316133607.8738-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 48847fea51194edeff7f475f8decba9b2ea95800 Author: Luca Weiss Date: Fri Mar 13 17:00:40 2026 +0100 arm64: defconfig: Enable S5KJN1 camera sensor Enable the S5KJN1 driver which is used for the front camera on the Fairphone 5 smartphone. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260313-fp5-s5kjn1-v1-3-fa4f1c727318@fairphone.com Signed-off-by: Bjorn Andersson commit e3f45d32664edd2b25746e22add3a20c088edbec Author: Kathiravan Thirumoorthy Date: Wed Mar 18 14:09:46 2026 +0530 dt-bindings: firmware: qcom,scm: Document ipq5210 SCM Document the scm compatible for ipq5210 SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Kathiravan Thirumoorthy Link: https://lore.kernel.org/r/20260318-ipq5210_boot_to_shell-v2-4-a87e27c37070@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 844be6e24afdd16fa6a9d77b86a107b5c18a1c96 Author: Kathiravan Thirumoorthy Date: Wed Mar 18 14:09:44 2026 +0530 clk: qcom: add Global Clock controller (GCC) driver for IPQ5210 SoC Add support for the global clock controller found on IPQ5210 SoC. Signed-off-by: Kathiravan Thirumoorthy Link: https://lore.kernel.org/r/20260318-ipq5210_boot_to_shell-v2-2-a87e27c37070@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1279298702af5eb1ed2ebfd90815c3def0f7efaf Merge: 04088a68258c35 20a107bca2a16c Author: Bjorn Andersson Date: Wed Mar 18 20:53:02 2026 -0500 Merge branch '20260318-ipq5210_boot_to_shell-v2-1-a87e27c37070@oss.qualcomm.com' into clk-for-7.1 Merge the IPQ5210 Global clock controller binding through a topic branch, to allow the constants to also be merged into the DeviceTree branch. commit 20a107bca2a16c8aa20d62631d4fc45828607664 Author: Kathiravan Thirumoorthy Date: Wed Mar 18 14:09:43 2026 +0530 dt-bindings: clock: add Qualcomm IPQ5210 GCC Add binding for the Qualcomm IPQ5210 Global Clock Controller. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Kathiravan Thirumoorthy Link: https://lore.kernel.org/r/20260318-ipq5210_boot_to_shell-v2-1-a87e27c37070@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 04088a68258c3585767c9bae35d70812c69a5341 Author: Krzysztof Kozlowski Date: Wed Mar 18 12:08:44 2026 +0100 clk: qcom: eliza: Cleanup redundant header includes Remove unused header includes - drivers do not use any OF API. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260318-clk-qcom-headers-v1-5-d5c6a3b11b67@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 84b21053fe18af080c6486cea2d68a40ce08a294 Author: Krzysztof Kozlowski Date: Wed Mar 18 12:08:43 2026 +0100 clk: qcom: milos: Cleanup redundant header includes Remove unused header includes - drivers do not use any clk, OF or PTR_ERR API, but they need declaration of of_device_id table. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260318-clk-qcom-headers-v1-4-d5c6a3b11b67@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 82e7613f5d23e9698004453c9cb1d6955373a5b5 Author: Krzysztof Kozlowski Date: Wed Mar 18 12:08:42 2026 +0100 clk: qcom: sm8750: Cleanup redundant header includes Remove unused header includes - drivers do not use any OF or runtime PM API, but they need declaration of of_device_id table. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260318-clk-qcom-headers-v1-3-d5c6a3b11b67@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 320d45700c131740cb534f1fd2d7aae04d5f16a7 Author: Krzysztof Kozlowski Date: Wed Mar 18 12:08:41 2026 +0100 clk: qcom: glymur: Cleanup redundant header includes Remove unused header includes - drivers do not use any OF or runtime PM API. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260318-clk-qcom-headers-v1-2-d5c6a3b11b67@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7b70ccfd5df61504a28a8dd316e44fcd2c8970e3 Author: Krzysztof Kozlowski Date: Wed Mar 18 12:08:40 2026 +0100 clk: qcom: kaanapali: Cleanup redundant header includes Remove unused header includes - drivers do not use any OF or runtime PM API. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260318-clk-qcom-headers-v1-1-d5c6a3b11b67@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 47b8c61eab8f25b16b5aae90f3991abc6d56d712 Author: Abel Vesa Date: Wed Mar 18 19:25:06 2026 +0200 soc: qcom: socinfo: Add PM7550BA PMIC Add the PM7550BA to the pmic_models array. It is one of the PMICs used by the Eliza MTP platform. Reviewed-by: Konrad Dybcio Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260318-qcom-socinfo-add-pm8550ba-v2-1-2f9171af0465@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2839841f8e8fb18392c0a4a3e96bb597c9bccbfb Merge: ec03006a11c2dd 356d4fbcf3defa Author: Jakub Kicinski Date: Wed Mar 18 18:30:00 2026 -0700 Merge branch 'net-mdio-gpio-remove-unneeded-headers' Bartosz Golaszewski says: ==================== net: mdio-gpio: remove unneeded headers This removes linux/mdio-gpio.h and linux/platform_data/mdio-gpio.h as they are not needed due to the symbols either being used by the mdio-gpio module alone or not used at all. ==================== Link: https://patch.msgid.link/20260316-gpio-mdio-hdr-cleanup-v1-0-2df696f74728@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 356d4fbcf3defaff0f98d2b6b54f3b26f0ff189d Author: Bartosz Golaszewski Date: Mon Mar 16 11:04:04 2026 +0100 net: mdio-gpio: remove linux/platform_data/mdio-gpio.h Nobody defines struct mdio_gpio_platform_data. Remove platform data support from mdio-gpio and drop the header. Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260316-gpio-mdio-hdr-cleanup-v1-2-2df696f74728@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 9c6b4009da5991db6bf02a47a578885a04a5e3f6 Author: Bartosz Golaszewski Date: Mon Mar 16 11:04:03 2026 +0100 net: mdio-gpio: remove linux/mdio-gpio.h The three defines from the linux/mdio-gpio.h header are only used in the mdio-gpio module. There's no reason to have them in a public header. Move them into the driver and remove mdio-gpio.h. Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260316-gpio-mdio-hdr-cleanup-v1-1-2df696f74728@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit ec03006a11c2dd762af0cd491ec1b410839ba931 Merge: d347b28c492e74 91283bd5b008d5 Author: Jakub Kicinski Date: Wed Mar 18 18:27:14 2026 -0700 Merge branch 'remove-kconfig-sysmbol-mdio_bus' Heiner Kallweit says: ==================== remove Kconfig sysmbol MDIO_BUS MDIO-based regmap is the last user of config symbol MDIO_BUS. MDIO access needs a MII bus, which requires PHYLIB for the provider part. Therefore make REGMAP_MDIO depend on PHYLIB, what allows to remove config symbol MDIO_BUS. ==================== Link: https://patch.msgid.link/bc63cf87-3dba-4ab6-9c84-caa7357c3273@gmail.com Signed-off-by: Jakub Kicinski commit 91283bd5b008d5cd2b6a24f246ffb3e706b8c981 Author: Heiner Kallweit Date: Sun Mar 15 17:50:00 2026 +0100 net: phy: remove Kconfig symbol MDIO_BUS After usage of config symbol MDIO_BUS has been removed from REGMAP_MIO as last user, the symbol can be removed. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/9cdf83e9-470d-45da-8efe-ace0decf0204@gmail.com Signed-off-by: Jakub Kicinski commit e611a97032f0fa484d14656acf4a330448bf21a3 Author: Heiner Kallweit Date: Sun Mar 15 17:48:43 2026 +0100 regmap: mdio: make it depend on PHYLIB MDIO-based regmap is the last user of config symbol MDIO_BUS. MDIO access needs a MII bus, which requires PHYLIB for the provider part. Therefore make REGMAP_MDIO depend on PHYLIB, what allows to remove config symbol MDIO_BUS in a follow-up patch. Note: After c5a219395b4e ("regmap: Move selecting for REGMAP_MDIO and REGMAP_IRQ") switching to "depends on" should be fine, w/o risk of a circular dependency. Signed-off-by: Heiner Kallweit Acked-by: Mark Brown Link: https://patch.msgid.link/a21a3b3e-272e-4c61-986e-48a2cb3421d9@gmail.com Signed-off-by: Jakub Kicinski commit d347b28c492e746c0db9439265e55a50a912e034 Author: Nimrod Oren Date: Tue Mar 17 12:49:34 2026 +0200 net/mlx5e: Add hds-thresh query support via ethtool Add support for reporting HDS (Header-Data Split) threshold via ethtool. When applicable, mlx5 hardware splits packets of all sizes with no configurable threshold, so report both hds-thresh and hds-thresh-max as 0 (i.e. always split regardless of size). Signed-off-by: Nimrod Oren Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260317104934.16124-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 4a4fedb8a523e35d2ad80637bae85de3ee56646b Author: Sun Jian Date: Fri Mar 13 11:45:40 2026 +0800 selftests/bpf: Isolate fmod_ret hooks by pid modify_return's fmod_ret programs can override bpf_modify_return_test()'s return value, which conflicts with get_func_ip_test when selftests run in parallel. Store current tgid in BSS and make modify_return hooks act only for that tgid. For other tasks, fentry/fexit become no-ops and fmod_ret returns the original ret. Drop the serial-only restriction and remove the TODO comment. Tested: sudo ./test_progs -t modify_return sudo ./test_progs -t get_func_ip_test sudo ./test_progs -j$(nproc) -t modify_return sudo ./test_progs -j$(nproc) -t get_func_ip_test Signed-off-by: Sun Jian Link: https://lore.kernel.org/r/20260313034540.255805-1-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov commit 888329ba6c8baa7908e08561c6e89d3fc5680131 Author: Sun Jian Date: Thu Mar 5 16:43:05 2026 +0800 selftests/bpf: Avoid spurious failures perf_link perf_link creates a system-wide perf event pinned to CPU 0 (pid=-1, cpu=0) and also pins the test thread to CPU 0. Under concurrent selftests this can lead to cross-test interference and CPU 0 contention, making the test flaky. Create a per-task perf event instead (pid=0, cpu=-1) and drop CPU pinning from burn_cpu(). Use barrier() to prevent the burn loop from being optimized away. Drop the serial_ prefix so the test can run in parallel. Also remove the stale TODO comment. Tested: ./test_progs -t perf_link -vv ./test_progs -j$(nproc) -t perf_link -vv for i in $(seq 1 50); do ./test_progs -j$(nproc) -t perf_link; done Signed-off-by: Sun Jian Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260305084306.283983-1-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov commit c3f25894e3aeb69b34587dc56b9a1608174083b3 Merge: 17a55ddb195676 22214fb2fad04d Author: Jakub Kicinski Date: Wed Mar 18 17:01:19 2026 -0700 Merge branch 'dt-bindings-net-micrel-fix-ksz8041rnli-dtbs_check-warnings' Geert Uytterhoeven says: ==================== dt-bindings: net: micrel: Fix KSZ8041RNLI dtbs_check warnings "make dtbs_check" reports several warnings due to some KSZ8041RNLI PHY nodes having the "micrel,led-mode" property, while the DT bindings prohibit this. Apparently the DT bindings are incorrect, so this patch series fixes that, after a customary cleanup. ==================== Link: https://patch.msgid.link/cover.1773734298.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 22214fb2fad04d23c40598ec9be21ea638d75841 Author: Geert Uytterhoeven Date: Tue Mar 17 09:02:46 2026 +0100 dt-bindings: net: micrel: KSZ8041RNLI supports LED mode Micrel KSZ8041RNLI supports LED mode, just like KSZ8041. This fixes (a.o.) the following "make dtbs_check" warning: arch/arm/boot/dts/renesas/r8a7791-koelsch.dtb: ethernet-phy@1 (ethernet-phy-id0022.1537): False schema does not allow 1 from schema $id: http://devicetree.org/schemas/net/micrel.yaml Signed-off-by: Geert Uytterhoeven Reviewed-by: Stefan Eichenberger Acked-by: Conor Dooley Link: https://patch.msgid.link/efad6c7e024b3a9aa2882db65909ee5bbbcbdc45.1773734298.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 46906242fe6103c81af59c541be2ab2902d7a335 Author: Geert Uytterhoeven Date: Tue Mar 17 09:02:45 2026 +0100 dt-bindings: net: micrel: Sort lists Sort lists of PHY models and compatible values alphabetically. Signed-off-by: Geert Uytterhoeven Reviewed-by: Stefan Eichenberger Acked-by: Conor Dooley Link: https://patch.msgid.link/3877a8bca7e4c13119387870d10b0758274fa6a0.1773734298.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 6eb255d019b810614c5cbd99b9ef281b7b9361e3 Author: Josh Law Date: Wed Mar 18 15:59:19 2026 +0000 lib/bootconfig: change xbc_node_index() return type to uint16_t lib/bootconfig.c:136:21: warning: conversion from 'long int' to 'int' may change value [-Wconversion] lib/bootconfig.c:308:33: warning: conversion from 'int' to 'uint16_t' may change value [-Wconversion] lib/bootconfig.c:467:37: warning: conversion from 'int' to 'uint16_t' may change value [-Wconversion] lib/bootconfig.c:469:40: warning: conversion from 'int' to 'uint16_t' may change value [-Wconversion] lib/bootconfig.c:472:54: warning: conversion from 'int' to 'uint16_t' may change value [-Wconversion] lib/bootconfig.c:476:45: warning: conversion from 'int' to 'uint16_t' may change value [-Wconversion] xbc_node_index() returns the position of a node in the xbc_nodes array, which has at most XBC_NODE_MAX (8192) entries, well within uint16_t range. Every caller stores the result in a uint16_t field (node->parent, node->child, node->next, or the keys[] array in compose_key_after), so the int return type causes narrowing warnings at all six call sites. Change the return type to uint16_t and add an explicit cast on the pointer subtraction to match the storage width and eliminate the warnings. Link: https://lore.kernel.org/all/20260318155919.78168-14-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 05213e4b10b9bd2e121d3e73428404b4f920dd9a Author: Josh Law Date: Wed Mar 18 15:59:18 2026 +0000 lib/bootconfig: use size_t for key length tracking in xbc_verify_tree() lib/bootconfig.c:839:24: warning: conversion from 'size_t' to 'int' may change value [-Wconversion] lib/bootconfig.c:860:32: warning: conversion from 'size_t' to 'int' may change value [-Wconversion] lib/bootconfig.c:860:29: warning: conversion to 'size_t' from 'int' may change the sign of the result [-Wsign-conversion] The key length variables len and wlen accumulate strlen() results but were declared as int, causing truncation and sign-conversion warnings. Change both to size_t to match the strlen() return type and avoid mixed-sign arithmetic. Link: https://lore.kernel.org/all/20260318155919.78168-13-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 0f2199904188abd5477a6517a9ce525bdc2dc01d Author: Josh Law Date: Wed Mar 18 15:59:17 2026 +0000 lib/bootconfig: use signed type for offset in xbc_init_node() lib/bootconfig.c:415:32: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion] Pointer subtraction yields ptrdiff_t (signed), which was stored in unsigned long. The original unsigned type implicitly caught a negative offset (data < xbc_data) because the wrapped value would exceed XBC_DATA_MAX. Make this intent explicit by using a signed long and adding an offset < 0 check to the WARN_ON condition. Link: https://lore.kernel.org/all/20260318155919.78168-12-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 68f479de0e013d0c27432240f35bf2a3cc3260f6 Author: Josh Law Date: Wed Mar 18 15:59:16 2026 +0000 lib/bootconfig: use size_t for strlen result in xbc_node_match_prefix() lib/bootconfig.c:198:19: warning: conversion from 'size_t' to 'int' may change value [-Wconversion] lib/bootconfig.c:200:33: warning: conversion to '__kernel_size_t' from 'int' may change the sign of the result [-Wsign-conversion] strlen() returns size_t but the result was stored in an int. The value is then passed back to strncmp() which expects size_t, causing a second sign-conversion warning on the round-trip. Use size_t throughout to match the API types. Link: https://lore.kernel.org/all/20260318155919.78168-11-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 8f3e79397a980512c2329b3445ebe7258e2d3f01 Author: Josh Law Date: Wed Mar 18 15:59:15 2026 +0000 lib/bootconfig: fix signed comparison in xbc_node_get_data() lib/bootconfig.c:188:28: warning: comparison of integer expressions of different signedness: 'int' and 'size_t' [-Wsign-compare] The local variable 'offset' is declared as int, but xbc_data_size is size_t. Change the type to size_t to match and eliminate the warning. Link: https://lore.kernel.org/all/20260318155919.78168-10-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 909bb3a6c53faf86e96694ed09e7f32cad11ba2e Author: Josh Law Date: Wed Mar 18 15:59:14 2026 +0000 lib/bootconfig: validate child node index in xbc_verify_tree() xbc_verify_tree() validates that each node's next index is within bounds, but does not check the child index. Add the same bounds check for the child field. Without this check, a corrupt bootconfig that passes next-index validation could still trigger an out-of-bounds memory access via an invalid child index when xbc_node_get_child() is called during tree traversal at boot time. Link: https://lore.kernel.org/all/20260318155919.78168-9-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 2564fa0bb2dbee126cac03c9d916e6c6a7910f31 Author: Josh Law Date: Wed Mar 18 15:59:13 2026 +0000 lib/bootconfig: replace linux/kernel.h with specific includes linux/kernel.h is a legacy catch-all header. Replace it with the specific headers actually needed: linux/cache.h for SMP_CACHE_BYTES, linux/compiler.h for unlikely(), and linux/sprintf.h for snprintf(). Link: https://lore.kernel.org/all/20260318155919.78168-8-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 306c36a76da2d6d2b5e91db925d41a9a8d77dbfd Author: Josh Law Date: Wed Mar 18 15:59:12 2026 +0000 bootconfig: constify xbc_calc_checksum() data parameter xbc_calc_checksum() only reads the data buffer, so mark the parameter as const void * and the internal pointer as const unsigned char *. Link: https://lore.kernel.org/all/20260318155919.78168-7-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 73a9f74b86c6b88d1b6aec82adea56074ef2a9b9 Author: Josh Law Date: Wed Mar 18 15:59:11 2026 +0000 lib/bootconfig: drop redundant memset of xbc_nodes memblock_alloc() already returns zeroed memory, so the explicit memset in xbc_init() is redundant. Switch the userspace xbc_alloc_mem() from malloc() to calloc() so both paths return zeroed memory, and remove the separate memset call. Link: https://lore.kernel.org/all/20260318155919.78168-6-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit ae9bf4d3835fb1cd3f79ea74e96e6ab6cfe8f415 Author: Josh Law Date: Thu Mar 19 08:43:24 2026 +0900 lib/bootconfig: increment xbc_node_num after node init succeeds Move the xbc_node_num increment to after xbc_init_node() so a failed init does not leave a partially initialized node counted in the array. If xbc_init_node() fails on a data offset at the boundary of a maximum-size bootconfig, the pre-incremented count causes subsequent tree verification and traversal to consider the uninitialized node as valid, potentially leading to an out-of-bounds read or unpredictable boot behavior. Link: https://lore.kernel.org/all/20260318155919.78168-5-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 1c04fa80118cc20a943b9ec5b861a824fa90db1c Author: Josh Law Date: Thu Mar 19 08:43:24 2026 +0900 lib/bootconfig: fix off-by-one in xbc_verify_tree() next node check Valid node indices are 0 to xbc_node_num-1, so a next value equal to xbc_node_num is out of bounds. Use >= instead of > to catch this. A malformed or corrupt bootconfig could pass tree verification with an out-of-bounds next index. On subsequent tree traversal at boot time, xbc_node_get_next() would return a pointer past the allocated xbc_nodes array, causing an out-of-bounds read of kernel memory. Link: https://lore.kernel.org/all/20260318155919.78168-4-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit bf45f7c591939196d043e30bc5961ef30fcff52d Author: Josh Law Date: Thu Mar 19 08:43:23 2026 +0900 lib/bootconfig: narrow flag parameter type from uint32_t to uint16_t The flag parameter in the node creation helpers only ever carries XBC_KEY (0) or XBC_VALUE (0x8000), both of which fit in uint16_t. Using uint16_t matches the width of xbc_node.data where the flag is ultimately stored. Link: https://lore.kernel.org/all/20260318155919.78168-3-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 7eaf074e9109860bfc2f7b01958059e9f2d4a76e Author: Josh Law Date: Thu Mar 19 08:43:23 2026 +0900 lib/bootconfig: clean up comment typos and bracing Fixes kerneldoc typos ("initiized" and "uder") and adds a missing blank line. Also fixes inconsistent if/else bracing in __xbc_add_key() and elsewhere. Link: https://lore.kernel.org/all/20260318155919.78168-2-objecting@objecting.org/ Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 17a55ddb19567642aa404f5525be3cf4425c6c1a Author: Jakub Kicinski Date: Fri Mar 13 16:20:47 2026 -0700 tools: ynl: rework policy access to support recursion Donald points out that the current naive implementation using dicts breaks if policy is recursive (child nest uses policy idx already used by its parent). Lean more into the NlPolicy class. This lets us "render" the policy on demand, when user accesses it. If someone wants to do an infinite walk that's on them :) Show policy info as attributes of the class and use dict format to descend into sub-policies for extra neatness. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20260313232047.2068518-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 44a063c00fb13cf1f2e8a53a2ab10b232a44954b Author: Petr Pavlu Date: Fri Mar 13 14:48:04 2026 +0100 module: Remove extern keyword from param prototypes The external function declarations do not need the "extern" keyword. Remove it to align with the Linux kernel coding style and to silence the associated checkpatch warnings. Signed-off-by: Petr Pavlu Signed-off-by: Sami Tolvanen commit 65f535501e2a3378629b8650eca553920de5e5a2 Author: Petr Pavlu Date: Fri Mar 13 14:48:03 2026 +0100 module: Clean up parse_args() arguments * Use the preferred `unsigned int` over plain `unsigned` for the `num` parameter. * Synchronize the parameter names in moduleparam.h with the ones used by the implementation in params.c. Signed-off-by: Petr Pavlu Signed-off-by: Sami Tolvanen commit deffe1edba626d474fef38007c03646ca5876a0e Author: Petr Pavlu Date: Fri Mar 13 14:48:02 2026 +0100 module: Fix freeing of charp module parameters when CONFIG_SYSFS=n When setting a charp module parameter, the param_set_charp() function allocates memory to store a copy of the input value. Later, when the module is potentially unloaded, the destroy_params() function is called to free this allocated memory. However, destroy_params() is available only when CONFIG_SYSFS=y, otherwise only a dummy variant is present. In the unlikely case that the kernel is configured with CONFIG_MODULES=y and CONFIG_SYSFS=n, this results in a memory leak of charp values when a module is unloaded. Fix this issue by making destroy_params() always available when CONFIG_MODULES=y. Rename the function to module_destroy_params() to clarify that it is intended for use by the module loader. Fixes: e180a6b7759a ("param: fix charp parameters set via sysfs") Signed-off-by: Petr Pavlu Signed-off-by: Sami Tolvanen commit b47bcab6ee92d5ca6ba55c06b9a503e2663e942f Author: Mauricio Faria de Oliveira Date: Tue Mar 17 20:22:16 2026 -0300 rtc: add data_race() in rtc_dev_poll() The unlocked read of rtc->irq_data in rtc_dev_poll() can race with the write in rtc_handle_legacy_irq() and also, theoretically, with the write in rtc_dev_read(). These races should be safe (see inline comment), thus annotate the read with data_race() for KCSAN. Reported-by: syzbot+2d4127acca35ed7b31ad@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=2d4127acca35ed7b31ad Signed-off-by: Mauricio Faria de Oliveira Link: https://patch.msgid.link/20260317-irq_data-v1-1-a2741002be60@igalia.com Signed-off-by: Alexandre Belloni commit 16c1e8385b3bb65d412d7a60107f8894587c63fa Author: Yury Norov Date: Sat Mar 14 15:25:44 2026 -0400 cpufreq: optimize policy_is_shared() The switch to cpumask_nth() over cpumask_weight(), as it may return earlier - as soon as the function counts the required number of CPUs. Signed-off-by: Yury Norov Acked-by: Viresh Kumar Reviewed-by: Zhongqiu Han Link: https://patch.msgid.link/20260314192544.605914-1-ynorov@nvidia.com Signed-off-by: Rafael J. Wysocki commit 81fca7087466bd81fff7100d824b2c788edf7a97 Author: Ricardo B. Marlière Date: Wed Mar 18 16:00:43 2026 -0300 ktest: Store failure logs also in fatal paths STORE_FAILURES was only saved from fail(), so paths that reached dodie() could exit without preserving failure logs. That includes fatal hook paths such as: POST_BUILD_DIE = 1 and ordinary failures when: DIE_ON_FAILURE = 1 Call save_logs("fail", ...) from dodie() too so fatal failures keep the same STORE_FAILURES artifacts as non-fatal fail() paths. Cc: John Hawley Link: https://patch.msgid.link/20260318-ktest-fixes-v1-1-9dd94d46d84c@suse.com Signed-off-by: Ricardo B. Marlière Signed-off-by: Steven Rostedt commit c9bb03ac2c66bc5aa81b51ea0792477524c2763a Author: Thomas Weißschuh Date: Thu Mar 5 13:04:07 2026 +0100 kbuild: reduce output spam when building out of tree The execution of $(call cmd,makefile) will print 'GEN Makefile' on each build, even if the Makefile is not effectively changed. Use a filechk command instead, so a message is only printed on changes. The Makefile is now created even if the build is aborted due to an unclean working tree. That should not make a difference in practice. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Link: https://patch.msgid.link/20260305-kbuild-makefile-spam-v1-1-910f6cf218a1@linutronix.de Signed-off-by: Nicolas Schier commit 36cb728754ea4583f145ecacb6e4fb9a6d8e62d6 Author: Andy Shevchenko Date: Tue Mar 17 09:01:06 2026 +0100 ACPI: processor: idle: Replace strlcat() with better alternative strlcpy() and strlcat() are confusing APIs and the former one already gone from the kernel. In preparation to kill strlcat() replace it with the better alternative. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260317080218.1814693-1-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 616cd6047cbf736d93808f652086dd10a836005f Author: Chen Pei Date: Tue Mar 17 11:48:47 2026 +0800 perf symbol: Add RISCV case in get_plt_sizes According to RISC-V psABI specification, the PLT (Program Linkage Table) has the following layout: - The first PLT entry occupies two 16-byte entries (32 bytes total) - Subsequent PLT entries take up 16 bytes each This aligns with the binutils-gdb implementation which defines the same PLT sizes for RISC-V architecture. Update get_plt_sizes() to set plt_header_size=32 and plt_entry_size=16 for EM_RISCV, matching the architecture's standard ABI. Since AARCH64, LOONGARCH, and RISCV have the same PLT size definition, they are merged together. Link: https://github.com/riscv-non-isa/riscv-elf-psabi-doc Link: https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=bfd/elfnn-riscv.c Signed-off-by: Chen Pei Reviewed-by: Guo Ren Signed-off-by: Namhyung Kim commit 4138987f8a90574f4d5881afa5db4c5f78553811 Author: Chen Ni Date: Wed Mar 18 11:49:32 2026 +0800 perf tools: Remove duplicate include of stat.h Remove duplicate inclusion of stat.h in intel-tpebs.c to clean up redundant code. Signed-off-by: Chen Ni Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit ebbc5ce26eca294cf5f4e63399de63d086900442 Author: Chen Ni Date: Wed Mar 18 12:04:22 2026 +0800 perf tools: Remove duplicate include of debug.h Remove duplicate inclusion of debug.h in symbol.c to clean up redundant code. Signed-off-by: Chen Ni Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 35cd0098eeb9601844cb82c4402fa7e6576c8b01 Author: Mike Leach Date: Wed Mar 18 10:36:40 2026 +0000 perf: tools: cs-etm: Enhance raw Coresight trace debug display When compiling perf with CORESIGHT=1, an additional build option may be used: CSTRACE_RAW=1, which will cause the CoreSight formatted trace frames to be printed out during a perf --dump command. This is useful when investigating issues with trace generation, decode or possible data corruption. e.g. for ETMv4 trace source into a formatted ETR sink a dump - . ... CoreSight ETMV4I Trace data: size 0x28c150 bytes Idx:0; ID:14; I_ASYNC : Alignment Synchronisation. Idx:12; ID:14; I_TRACE_INFO : Trace Info.; INFO=0x0 { CC.0 }; Decoder Sync point TINFO Idx:17; ID:14; I_ADDR_L_64IS0 : Address, Long, 64 bit, IS0.; Addr=0x0000000000000000; becomes with CSTRACE_RAW=1: . ... CoreSight ETMV4I Trace data: size 0x28c150 bytes Frame Data; Index 0; ID_DATA[0x14]; 00 00 00 00 00 00 00 00 00 00 00 80 01 01 Idx:0; ID:14; I_ASYNC : Alignment Synchronisation. Frame Data; Index 16; ID_DATA[0x14]; 00 9d 00 00 00 00 00 00 00 00 04 85 57 08 f2 Idx:12; ID:14; I_TRACE_INFO : Trace Info.; INFO=0x0 { CC.0 }; Decoder Sync point TINFO Idx:17; ID:14; I_ADDR_L_64IS0 : Address, Long, 64 bit, IS0.; Addr=0x0000000000000000; CSTRACE_RAW=1 has no effect on ETE + TRBE trace as there is no trace formatting in the TRBE buffer. This patch enhances the output so that for each packet the individual bytes associated with the packet are printed. Thus for ETMv4 this now becomes: . ... CoreSight ETMV4I Trace data: size 0x28c150 bytes Frame Data; Index 0; ID_DATA[0x14]; 00 00 00 00 00 00 00 00 00 00 00 80 01 01 Idx:0; ID:14;[0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x80]; I_ASYNC : Alignment Synchronisation. Frame Data; Index 16; ID_DATA[0x14]; 00 9d 00 00 00 00 00 00 00 00 04 85 57 08 f2 Idx:12; ID:14; [0x01 0x01 0x00 ]; I_TRACE_INFO : Trace Info.; INFO=0x0 { CC.0 }; Decoder Sync point TINFO Idx:17; ID:14; [0x9d 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 ]; I_ADDR_L_64IS0 : Address, Long, 64 bit, IS0.; Addr=0x0000000000000000; ETE trace output changes from: Idx:0; ID:14; I_ASYNC : Alignment Synchronisation. Idx:12; ID:14; I_TRACE_INFO : Trace Info.; INFO=0x0 { CC.0, TSTATE.0 }; Decoder Sync point TINFO Idx:15; ID:14; I_ADDR_L_64IS0 : Address, Long, 64 bit, IS0.; Addr=0xFFFF80007CF7F56C; becoming: Idx:0; ID:14;[0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x80]; I_ASYNC : Alignment Synchronisation. Idx:12; ID:14; [0x01 0x01 0x00 ]; I_TRACE_INFO : Trace Info.; INFO=0x0 { CC.0, TSTATE.0 }; Decoder Sync point TINFO Idx:15; ID:14; [0x9d 0x5b 0x7a 0xf7 0x7c 0x00 0x80 0xff 0xff ]; I_ADDR_L_64IS0 : Address, Long, 64 bit, IS0.; Addr=0xFFFF80007CF7F56C; Tested-by: Leo Yan Signed-off-by: Mike Leach Acked-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 6c478e7b3eba3f387a2d6c749e3e3ee0f8ad1c53 Author: Mike Leach Date: Wed Mar 18 10:36:39 2026 +0000 perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace Building perf with CORESIGHT=1 and the optional CSTRACE_RAW=1 enables additional debug printing of raw trace data when using command:- perf report --dump. This raw trace prints the CoreSight formatted trace frames, which may be used to investigate suspected issues with trace quality / corruption / decode. These frames are not present in ETE + TRBE trace. This fix removes the unnecessary call to print these frames. This fix also rationalises implementation - original code had helper function that unnecessarily repeated initialisation calls that had already been made. Due to an addtional fault with the OpenCSD library, this call when ETE/TRBE are being decoded will cause a segfault in perf. This fix also prevents that problem for perf using older (<= 1.8.0 version) OpenCSD libraries. Fixes: 68ffe3902898 ("perf tools: Add decoder mechanic to support dumping trace data") Reported-by: Leo Yan Signed-off-by: Mike Leach Signed-off-by: Namhyung Kim commit 23e6e57a93bcabe86d5f0eab1df0c44706ab18f3 Author: Mikulas Patocka Date: Wed Mar 18 15:31:55 2026 +0100 dm: make "dmsetup remove_all" interruptible The command "dmsetup remove_all" may take a long time (a minute for removing 1000 devices), so make it interruptible with fatal signals. For better readability, the bool arguments were changed to flags. Signed-off-by: Mikulas Patocka Reviewed-by: Bart Van Assche commit f287826fd7e406caa56692ecc39742bdb312b2e8 Author: Yuanshen Cao Date: Thu Mar 5 03:34:07 2026 +0000 dt-bindings: power: Add Support for Allwinner A733 PCK600 Power Domain Controller The A733 PCK600, similar to A523 PCK600, is likely a customized version of ARM PCK-600 power controller. They share the same BSP drivers in the package provided by Radxa, with the only difference being the lack of resets. Therefore, document A733 compatible and make resets required only for the other models, as well as prepare the PD definitions for future device trees. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Yuanshen Cao Signed-off-by: Ulf Hansson commit 5b7ac8ca0eae522735d24f7c5c2296c8094328b1 Author: Tommaso Merciai Date: Tue Feb 17 17:23:47 2026 +0100 spi: dt-bindings: renesas,rzv2h-rspi: Document RZ/G3E SoC support Document the RSPI controller on the Renesas RZ/G3E SoC. The block is compatible with the RSPI implementation found on the RZ/V2H(P) family. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/f6b43f0dc64e13b1c9942c164dea30002d4c4466.1771344527.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Mark Brown commit c2edd7841f58cf228347b91256f0d9efcc1a1f50 Author: Tommaso Merciai Date: Tue Feb 17 17:23:46 2026 +0100 spi: dt-bindings: renesas,rzv2h-rspi: Document dmas property Document the dmas property to state it must be specified as TX/RX DMA specifier pairs. This clarifies the expected ordering and improves binding readability without changing behavior. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/ea6ed3b82c5a326732adfc0fcdb2922bfcad2591.1771344527.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Mark Brown commit bd3622e5b8e0650669332d9e10244a704560cbfe Author: Neil Armstrong Date: Fri Feb 20 16:04:43 2026 +0100 PCI/pwrctrl: generic: Add UPD720201/UPD720202 USB 3.0 xHCI Host Controller support Enable the generic pwrctrl driver to control power of PCIe UPD720201/UPD720202 USB 3.0 xHCI Host Controller. Signed-off-by: Neil Armstrong Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260220-topic-sm8650-ayaneo-pocket-s2-base-v5-4-1ad79caa1efa@linaro.org commit 0862e2b06cd88491e2e854a24219219b8aa6e0b5 Author: Neil Armstrong Date: Fri Feb 20 16:04:41 2026 +0100 PCI/pwrctrl: generic: Simplify dev_err_probe() usage dev_err_probe() returns the error code passed to it, so this: dev_err_probe(dev, ret, "Failed to get slot regulators\n"); return ret; is equivalent to this: return dev_err_probe(dev, ret, "Failed to get slot regulators\n"); Simplify by using the latter. Suggested-by: Bartosz Golaszewski Signed-off-by: Neil Armstrong Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260220-topic-sm8650-ayaneo-pocket-s2-base-v5-2-1ad79caa1efa@linaro.org commit ff124bbbca1d3a07fa1392ffdbbdeece71f68ece Author: Neil Armstrong Date: Wed Mar 18 12:10:10 2026 -0500 PCI/pwrctrl: generic: Rename pci-pwrctrl-slot as generic The driver is pretty generic and would fit for either PCI Slots or endpoints connected to PCI ports, so rename the driver and module as pci-pwrctrl-generic. Suggested-by: Manivannan Sadhasivam Signed-off-by: Neil Armstrong Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260220-topic-sm8650-ayaneo-pocket-s2-base-v5-3-1ad79caa1efa@linaro.org commit 95ad29eb1baec322f31ddb247e5bf36f156578cf Author: Qiuxu Zhuo Date: Wed Mar 18 10:31:18 2026 +0800 EDAC/i10nm: Add driver decoder for Granite Rapids server Current i10nm_edac only supports the firmware decoder (ACPI DSM methods) for Granite Rapids servers. Add the driver decoder, which directly extracts topology information from the IMC machine check bank IA32_MCi_MISC MSRs, to improve decoding performance for Granite Rapids. [Tony: Updated commit comment] Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Tested-by: Shawn Fan Link: https://patch.msgid.link/20260318023118.2704139-1-qiuxu.zhuo@intel.com commit df3eec203b940bad98a7c0b7ec0edaaaa8cd0247 Author: Cássio Gabriel Date: Wed Mar 18 11:08:46 2026 -0300 ALSA: usb-audio: validate full match when resolving quirk aliases get_alias_quirk() resolves a quirk for an aliased USB ID by scanning usb_audio_ids[], but it currently checks only the vendor/product pair. This is weak for quirk table entries that also depend on additional USB_DEVICE_ID match fields, such as device or interface class, subclass, protocol, interface number, or bcdDevice range. Keep the aliased vid:pid as the lookup key, then validate only the remaining match criteria of each candidate entry against the real device/interface descriptors by clearing USB_DEVICE_ID_MATCH_DEVICE from a temporary copy and passing it to usb_match_one_id(). Suggested-by: Takashi Iwai Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260318-alsa-usb-fix-quirk-alias-v3-1-bd3b17a32939@gmail.com Signed-off-by: Takashi Iwai commit 82e1c68ac206efe42854296c462aa83f541ea22c Author: Oskar Ray-Frayssinet Date: Sat Mar 14 13:23:25 2026 +0100 staging: rtl8723bs: add missing blank lines after declarations Add missing blank lines after variable declarations in several files throughout the rtl8723bs driver to comply with kernel coding style. Signed-off-by: Oskar Ray-Frayssinet Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260314122325.7877-1-rayfraytech@gmail.com Signed-off-by: Greg Kroah-Hartman commit 390c784709f266273d1dca24c5f93c42b05cb198 Author: Andrea Poldi Date: Tue Mar 17 16:59:40 2026 +0000 staging: rtl8723bs: fix line length warning Break a long function call across two lines in order to make code easier to read and also comply with the Linux coding style. Problem was found using checkpatch.pl tool. Signed-off-by: Andrea Poldi Link: https://patch.msgid.link/20260317165845.12594-1-andrea@riposetti.com Signed-off-by: Greg Kroah-Hartman commit efa140029a982c2194f26b3edad44aab4f542d75 Author: Giacomo Di Clerico Date: Tue Mar 17 11:07:23 2026 +0100 staging: rtl8723bs: simplify return checks in validate_recv_data_frame() Combine the return value checks for _FAIL and RTW_RX_HANDLED into a single logical OR statement and remove unnecessary braces. This improves code readability and resolves the following checkpatch.pl warning: "WARNING: braces {} are not necessary for any arm of this statement" Signed-off-by: Giacomo Di Clerico Link: https://patch.msgid.link/20260317100723.72476-1-giacomodiclerico@gmail.com Signed-off-by: Greg Kroah-Hartman commit f8252d54c4c1789b4c827216b3c338bc3197cfcf Author: Marcos Andrade Date: Mon Mar 16 19:19:24 2026 -0300 staging: rtl8723bs: Replace msleep() with fsleep() Replace msleep(10) with fsleep(10 * USEC_PER_MSEC) in _rtw_init_xmit_priv(). fsleep() is the new standard API for delays, as it automatically chooses the best sleep method based on the duration. Suggested-by: Ethan Tidmore Signed-off-by: Marcos Andrade Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260316221924.4904-3-marcosandrade95963@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9b17baf171c16706594a30fcac9e9b5be3ac6671 Author: Marcos Andrade Date: Mon Mar 16 19:19:23 2026 -0300 staging: rtl8723bs: Replace network magic numbers with EtherType macros Replace hardcoded magic numbers for network protocols (e.g., 0x0806 for ARP, 0x888e for EAPOL) with their standard EtherType macro equivalents (ETH_P_ARP, ETH_P_PAE) defined in . This change improves code readability and aligns the driver with standard Linux networking definitions. Signed-off-by: Marcos Andrade Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260316221924.4904-2-marcosandrade95963@gmail.com Signed-off-by: Greg Kroah-Hartman commit 97eef87a546e665f62c4c5500b2381a3c90c0ef1 Author: Bera Yüzlü Date: Mon Mar 9 21:45:56 2026 +0300 staging: rtl8723bs: change custom comparing function to strcmp() eqNByte() function is a redundant reimplementation of strcmp(). Remove eqNByte() and switch its usages to strcmp(). No functional change. Reviewed-by: Andy Shevchenko Signed-off-by: Bera Yüzlü Link: https://patch.msgid.link/20260309184556.846-2-b9788213@gmail.com Signed-off-by: Greg Kroah-Hartman commit 77da49db335dafd38754bc9a59a69a52e08557f3 Author: Marcos Andrade Date: Mon Mar 16 19:04:35 2026 -0300 staging: rtl8723bs: remove unused global efuse variables Remove several global efuse variables from rtw_efuse.c and their corresponding extern declarations in rtw_efuse.h. These variables (fakeEfuseBank, BTEfuseUsedBytes, etc.) are completely unused legacy code. The driver currently maintains the efuse state properly within the 'efuse_hal' structure, which is encapsulated inside 'hal_com_data'. The removal of this dead code cleans up the global namespace and resolves multiple checkpatch.pl warnings regarding CamelCase naming conventions. Verified by compilation that no functional code references these variables. Signed-off-by: Marcos Andrade Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260316220435.2249-1-marcosandrade95963@gmail.com Signed-off-by: Greg Kroah-Hartman commit 816e181560e230ea7d0bbb54db82200921e87547 Author: Nikolay Kulikov Date: Mon Mar 16 14:33:58 2026 +0300 staging: rtl8723bs: remove unusual 'NDIS_802_11_MAC_ADDRESS' type Remove the 'NDIS_802_11_MAC_ADDRESS' type and replace all variables of this type with an array of 'u8', which will make the code more understandable and get rid of unnecessary 'typedef'. Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260316113427.3696-1-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit c1dd45eed8a4eadca81d615f9d9aef9f7613fe8f Author: Joshua Gu Date: Mon Mar 16 02:04:51 2026 +0000 staging: rtl8723bs: remove unnecessary spaces in rtw_security.c Fix checkpatch.pl warnings about spaces after casts, along with other double spaces. Signed-off-by: Joshua Gu Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/abdlQzChJylv8evY@ubuntuarm64 Signed-off-by: Greg Kroah-Hartman commit f689f461fe3922f399845dbdccb44b43402a2c7d Author: Joshua Gu Date: Sun Mar 15 19:28:44 2026 +0000 staging: rtl8723bs: remove redundant blank line in rtw_btcoex.c Removed extra blank line, as reported by checkpatch.pl Signed-off-by: Joshua Gu Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/abcIbKgPQWkIB6vg@ubuntuarm64 Signed-off-by: Greg Kroah-Hartman commit 7da5c1136837951ac15536ededf0238757070699 Author: Nikolay Kulikov Date: Sun Mar 15 16:17:24 2026 +0300 staging: rtl8723bs: remove unnecessary 'ETH_ALEN' definition The ETH_ALEN macro is already declared in the Kernel headers, so there is no need to redefine it here. Signed-off-by: Nikolay Kulikov Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260315131734.25054-1-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit 91233340b401374baa804ecc081baaecef6ea71c Author: Giacomo Di Clerico Date: Sun Mar 15 11:58:53 2026 +0100 staging: greybus: loopback: remove unused argument from macro The gb_dev_loopback_ro_attr macro accepted a 'conn' argument which was never used in its expansion. Remove it from both the macro definition and its invocation. Signed-off-by: Giacomo Di Clerico Link: https://patch.msgid.link/20260315105853.34609-1-giacomodiclerico@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6e57c05a06b58ab72238661e770e1613fbb353c3 Author: Lukas Kraft Date: Thu Mar 12 18:38:59 2026 +0100 staging: rtl8723bs: fix blank line style in rtw_io.c Fix checkpatch style check for blank line placement after functions in rtw_io.c. Signed-off-by: Lukas Kraft Reviewed-by: Bera Yüzlü Link: https://patch.msgid.link/20260312173903.19822-1-rebootrequired42@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3f7004a175ecc18d36f25c1ede7f9804c4ea3b89 Author: Bera Yüzlü Date: Tue Mar 10 15:55:57 2026 +0300 staging: rtl8723bs: Remove space in the line start Remove a space in the line start to follow kernel coding style. Reported by checkpatch.pl. Signed-off-by: Bera Yüzlü Reviewed-by: Nikolay Kulikov Link: https://patch.msgid.link/20260310125556.874-2-b9788213@gmail.com Signed-off-by: Greg Kroah-Hartman commit a11fdb9f58cc4bd7793b259ee73f984799753ba7 Author: Luis Soza Rodriguez Date: Mon Mar 9 17:05:07 2026 -0600 staging: greybus: loopback: use sysfs_emit in sysfs show functions As per the kernel's documentation, sysfs_emit() is the preferred way to format strings for sysfs attributes. It handles buffer overruns safely. Replace sprintf calls with sysfs_emit across all loopback sysfs show macros. Signed-off-by: Luis Soza Rodriguez Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260309230507.4931-1-contact@sluisr.com Signed-off-by: Greg Kroah-Hartman commit e66cd5a8f2b48eb513867dcf0c3d25d8a405ec57 Author: Mark Adamenko Date: Mon Mar 9 18:45:14 2026 -0700 staging: octeon: remove BUG() call An unreachable default case calls BUG(). Remove the entire default case, as the three possible cases are already addressed. Signed-off-by: Mark Adamenko Link: https://patch.msgid.link/20260310014514.40293-1-marusik.adamenko@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7f9e3268fbc89eb82463394791d1b617f720a8d0 Author: Nikolay Kulikov Date: Mon Mar 9 23:12:21 2026 +0300 staging: rtl8723bs: replace rtw_linked_check() return type to bool Function rtw_linked_check() always return 'bool' value, but it's type 'int'. Replace 'int' with 'bool' to make it more accurate. Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260309201257.16984-5-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit c776297d23c04545eab06c7cc24821617bb7ade4 Author: Nikolay Kulikov Date: Mon Mar 9 23:12:20 2026 +0300 staging: rtl8723bs: replace rtw_is_desired_network() return type to bool Function rtw_is_desired_network() used only in rtw_mlme.c file and always return 'true' or 'false', so it's type can be replaced with 'static bool'. Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260309201257.16984-4-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit b816cabf466d4aef42ef53b2c60c10075ea80b87 Author: Nikolay Kulikov Date: Mon Mar 9 23:12:19 2026 +0300 staging: rtl8723bs: replace rtw_is_same_ibss() return type to bool Function rtw_is_same_ibss() returns a 'bool' value, but has an 'int type. Replace 'int' -> 'bool' types to make it more accrurate. Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260309201257.16984-3-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6c885251698312178781e37ba5d6613277fe3687 Author: Nikolay Kulikov Date: Mon Mar 9 23:12:18 2026 +0300 staging: rtl8723bs: replace rtw_if_up() return type to bool Function rtw_if_up() actually return 'bool' value, but it's type is 'signed int'. Replace 'signed int' with 'bool' to make it more accurate. Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260309201257.16984-2-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit b21cf01c29ea16cd016c5f0b96f49fd0e9e27591 Author: Dave Hansen Date: Thu Mar 5 13:22:15 2026 -0800 MAINTAINERS: Add references to tip tree handbook The tip tree handbook is a pretty handy reference for keeping the various tip maintainers happy. But there are no references to it in the MAINTAINERS file. Add a references to the handbook for a number of subsystems. I've added these for all of the obvious subsystems that list T:.../tip.git and are likely to follow the tip rules. This will be useful both for humans digging in the MAINTAINERS file and our new AI bot overlords. I'm cc'ing all the M:'s and L:'s listed for the subsystems but leaving off the R:'s because the cc list is already out of control. I'll commit this to *some* tip branch if there's general consensus that this is a good idea. [ dhansen: add objtool and futexes at peterz's urging ] Signed-off-by: Dave Hansen Acked-by: Boqun Feng Acked-by: Daniel Lezcano Acked-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260305212215.3188399-1-dave.hansen@linux.intel.com Signed-off-by: Dave Hansen commit 84db3719d27337b952fe382413d341fb95351130 Author: Xu Yang Date: Tue Mar 17 11:05:46 2026 +0800 usb: dwc3: imx: avoid calling imx suspend/resume callbacks twice If a runtime suspend is executed followed by a system suspend, the driver may invoke dwc3_imx_suspend() twice, which causes enable_irq() to be called twice as well. This leads to an unbalanced IRQ state and may trigger warnings or malfunction. Prevent this by checking the pm_suspended flag before running the imx suspend/resume path. Fixes: 76fc9452a6bf ("usb: dwc3: introduce flatten model driver of i.MX Soc") Signed-off-by: Xu Yang Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260317030546.1665206-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit d3d959404e6c72e09db8de8893a970edf0ac565d Author: Badhri Jagan Sridharan Date: Mon Mar 16 15:03:01 2026 +0000 tcpm: Implement sink support for PD SPR AVS negotiation Add support to enable TCPM to negotiate with USB PD Standard Power Range Adjustable Voltage Supply (SPR AVS) when acting as a power sink. * Added support to the tcpm power supply properties, allowing userspace to enable and control the dynamic limits (voltage and current) specific to the SPR AVS contract. * Implemented tcpm_pd_select_spr_avs_apdo() to select the appropriate APDO and validate the requested voltage/current against both the Source and Sink capabilities. * Implemented tcpm_pd_build_spr_avs_request() to construct the Request Data Object (RDO) for SPR AVS. * Added SNK_NEGOTIATE_SPR_AVS_CAPABILITIES state to the state machine to handle negotiation for SPR AVS. * Updated the SNK_TRANSITION_SINK state to implement the SPR AVS-specific VBUS transition rules, including reducing current draw to PD_I_SNK_STBY_MA for large voltage changes, as required by USB PD spec. Log stub captured when enabling AVS: $ echo 3 > /sys/class/power_supply/tcpm-source-psy-1-0025/online $ cat /d/usb/tcpm-1-0025/log [ 358.895775] request to set AVS online [ 358.895792] AMS POWER_NEGOTIATION start [ 358.895806] state change SNK_READY -> AMS_START [rev3 POWER_NEGOTIATION] [ 358.895850] state change AMS_START -> SNK_NEGOTIATE_SPR_AVS_CAPABILITIES [rev3 POWER_NEGOTIATION] [ 358.895866] SPR AVS src_pdo_index:4 snk_pdo_index:2 req_op_curr_ma roundup:2200 req_out_volt_mv roundup:9000 [ 358.895880] Requesting APDO SPR AVS 4: 9000 mV, 2200 mA [ 358.896405] set_auto_vbus_discharge_threshold mode:0 pps_active:n vbus:0 pps_apdo_min_volt:0 ret:0 [ 358.896422] PD TX, header: 0x1a82 [ 358.900158] PD TX complete, status: 0 [ 358.900205] pending state change SNK_NEGOTIATE_SPR_AVS_CAPABILITIES -> HARD_RESET_SEND @ 60 ms [rev3 POWER_NEGOTIATION] [ 358.904832] PD RX, header: 0x1a3 [1] [ 358.904854] state change SNK_NEGOTIATE_SPR_AVS_CAPABILITIES -> SNK_TRANSITION_SINK [rev3 POWER_NEGOTIATION] [ 358.904888] pending state change SNK_TRANSITION_SINK -> HARD_RESET_SEND @ 700 ms [rev3 POWER_NEGOTIATION] [ 359.021530] PD RX, header: 0x3a6 [1] [ 359.021546] Setting voltage/current limit 9000 mV 2200 mA [ 359.023035] set_auto_vbus_discharge_threshold mode:3 pps_active:n vbus:9000 pps_apdo_min_volt:0 ret:0 [ 359.023053] state change SNK_TRANSITION_SINK -> SNK_READY [rev3 POWER_NEGOTIATION] [ 359.023090] AMS POWER_NEGOTIATION finished $ cat /sys/class/power_supply/tcpm-source-psy-1-0025/online 3 Log stub captured when increasing voltage: $ echo 9100000 > /sys/class/power_supply/tcpm-source-psy-1-0025/voltage_now $ cat /d/usb/tcpm-1-0025/log [ 632.116714] AMS POWER_NEGOTIATION start [ 632.116728] state change SNK_READY -> AMS_START [rev3 POWER_NEGOTIATION] [ 632.116779] state change AMS_START -> SNK_NEGOTIATE_SPR_AVS_CAPABILITIES [rev3 POWER_NEGOTIATION] [ 632.116798] SPR AVS src_pdo_index:4 snk_pdo_index:2 req_op_curr_ma roundup:2200 req_out_volt_mv roundup:9100 [ 632.116811] Requesting APDO SPR AVS 4: 9100 mV, 2200 mA [ 632.117315] set_auto_vbus_discharge_threshold mode:0 pps_active:n vbus:0 pps_apdo_min_volt:0 ret:0 [ 632.117328] PD TX, header: 0x1c82 [ 632.121007] PD TX complete, status: 0 [ 632.121052] pending state change SNK_NEGOTIATE_SPR_AVS_CAPABILITIES -> HARD_RESET_SEND @ 60 ms [rev3 POWER_NEGOTIATION] [ 632.124572] PD RX, header: 0x5a3 [1] [ 632.124594] state change SNK_NEGOTIATE_SPR_AVS_CAPABILITIES -> SNK_TRANSITION_SINK [rev3 POWER_NEGOTIATION] [ 632.124623] pending state change SNK_TRANSITION_SINK -> HARD_RESET_SEND @ 700 ms [rev3 POWER_NEGOTIATION] [ 632.149256] PD RX, header: 0x7a6 [1] [ 632.149271] Setting voltage/current limit 9100 mV 2200 mA [ 632.150770] set_auto_vbus_discharge_threshold mode:3 pps_active:n vbus:9100 pps_apdo_min_volt:0 ret:0 [ 632.150787] state change SNK_TRANSITION_SINK -> SNK_READY [rev3 POWER_NEGOTIATION] [ 632.150823] AMS POWER_NEGOTIATION finished $ cat /sys/class/power_supply/tcpm-source-psy-1-0025/voltage_now 9100000 Signed-off-by: Badhri Jagan Sridharan Reviewed-by: Amit Sunil Dhamne Acked-by: Heikki Krogerus Link: https://patch.msgid.link/20260316150301.3892223-4-badhri@google.com Signed-off-by: Greg Kroah-Hartman commit a43dd4f6f91ed1a1d16595cb0c550b283e9b2298 Author: Badhri Jagan Sridharan Date: Mon Mar 16 15:03:00 2026 +0000 power: supply: Add PD SPR AVS support to USB type enum Add two new members to the power_supply_usb_type to represent the USB Power Delivery (PD) Standard Power Range (SPR) Adjustable Voltage Supply (AVS) charging types: POWER_SUPPLY_USB_TYPE_PD_SPR_AVS: For devices supporting only the PD SPR AVS type. POWER_SUPPLY_USB_TYPE_PD_PPS_SPR_AVS: For devices that support both PD Programmable Power Supply (PPS) and PD SPR AVS. Signed-off-by: Badhri Jagan Sridharan Link: https://patch.msgid.link/20260316150301.3892223-3-badhri@google.com Signed-off-by: Greg Kroah-Hartman commit 9270102a00aabbe4d1bbb6890d514b01f1c42989 Author: Badhri Jagan Sridharan Date: Mon Mar 16 15:02:59 2026 +0000 dt-bindings: connector: Add SPR AVS Sink APDO definitions USB Power Delivery 3.2 introduces a new power supply type SPR AVS. Add macro definitions for the USB Power Delivery (PD) Standard Power Range (SPR) Adjustable Voltage Supply (AVS) as a Sink Augmented Power Data Object (APDO) in the device tree bindings. Signed-off-by: Badhri Jagan Sridharan Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260316150301.3892223-2-badhri@google.com Signed-off-by: Greg Kroah-Hartman commit f8a5f6934f30b9ee334256347dd70a7ba0f8be7f Author: Aldo Conte Date: Wed Mar 11 17:33:20 2026 +0100 usb: typec: Document priority and mode_selection fields in struct typec_altmode The fields 'priority' and 'mode_selection' in struct typec_altmode are missing from the kernel-doc comment, which results in warnings when building the documentation with 'make htmldocs'. WARNING: ./include/linux/usb/typec_altmode.h:44 struct member 'priority' not described in 'typec_altmode' WARNING: ./include/linux/usb/typec_altmode.h:44 struct member 'mode_selection' not described in 'typec_altmode' Document both fields to keep the kernel-doc comment aligned with the structure definition. Signed-off-by: Aldo Conte Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260311163320.61534-1-aldocontelk@gmail.com Signed-off-by: Greg Kroah-Hartman commit fca8688a6798f6fee6b86ce0bc39d1cd0b1c8b8a Author: Alexander Stein Date: Tue Mar 17 13:19:52 2026 +0100 clk: imx: pll14xx: Use unsigned format specifier The debug outputs use %d for clock rates resulting in negative clock rate during rate calculation. Signed-off-by: Alexander Stein Reviewed-by: Peng Fan Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20260317121953.1100619-1-alexander.stein@ew.tq-group.com Signed-off-by: Abel Vesa commit 351eb14411f748341a9cb32e81f4973407a8350c Author: Krzysztof Kozlowski Date: Wed Mar 18 09:46:27 2026 +0100 usb: misc: onboard_dev: Remove duplicated static structures Static structure "ti_tusb8041_data" is exactly the same as "ti_tusb8020b_data" and "cypress_hx2vl_data" is the same as "microchip_usb424_data". Drop the duplicated structures to reduce driver size and memory usage without affecting functionality. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260318084626.34314-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 381133848a033c2086cf9cafb226f425bd0414ff Author: Mostafa Saleh Date: Fri Mar 13 15:55:34 2026 +0000 usb: typec: ps883x: Fix Oops at unbind When trying to unbind a device in order to bind to it vfio-platform as: echo bc0000.geniqup > /sys/bus/platform/devices/bc0000.geniqup/driver/unbind I get the following Oops: [ 436.478639] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 [ 436.487762] Mem abort info: [ 436.490716] ESR = 0x0000000096000004 [ 436.494595] EC = 0x25: DABT (current EL), IL = 32 bits [ 436.500071] SET = 0, FnV = 0 [ 436.503250] EA = 0, S1PTW = 0 [ 436.506505] FSC = 0x04: level 0 translation fault [ 436.511533] Data abort info: [ 436.514558] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 436.520215] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 436.525436] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 436.530918] user pgtable: 4k pages, 48-bit VAs, pgdp=00000008861a9000 [ 436.537554] [0000000000000020] pgd=0000000000000000, p4d=0000000000000000 [ 436.544548] Internal error: Oops: 0000000096000004 [#1] SMP [ 436.550374] Modules linked in: [ 436.553542] CPU: 2 UID: 0 PID: 671 Comm: bash Tainted: G W 7.0.0-rc3-g56fcdd0911a5-dirty #2 PREEMPT [ 436.564440] Tainted: [W]=WARN [ 436.567515] Hardware name: LENOVO 91B6CTO1WW/3796, BIOS O6NKT3BA 05/02/2025 [ 436.574675] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 436.581841] pc : ps883x_retimer_remove+0x14/0x94 [ 436.586605] lr : i2c_device_remove+0x28/0x84 [ 436.591017] sp : ffff8000847137c0 That's because the ps883x_retimer_remove() retrieves the driver data from i2c_get_clientdata() which was never set at probe. So, add i2c_set_clientdata() at the end of the probe. Signed-off-by: Mostafa Saleh Reviewed-by: Konrad Dybcio Fixes: 257a087c8b52 ("usb: typec: Add support for Parade PS8830 Type-C Retimer") Link: https://patch.msgid.link/20260313155534.1916773-1-smostafa@google.com Signed-off-by: Greg Kroah-Hartman commit b84cc80610a8ce036deb987f056ce3196ead7f1e Author: Xu Yang Date: Mon Mar 16 17:50:42 2026 +0800 usb: port: add delay after usb_hub_set_port_power() When a port is disabled, an attached device will be disconnected. This causes a port-status-change event, which will race with hub autosuspend (if the disabled port was the only connected port on its hub), causing an immediate resume and a second autosuspend. Both of these can be avoided by adding a short delay after the call to usb_hub_set_port_power(). Below log shows what is happening: $ echo 1 > usb1-port1/disable [ 37.958239] usb 1-1: USB disconnect, device number 2 [ 37.964101] usb 1-1: unregistering device [ 37.970070] hub 1-0:1.0: hub_suspend [ 37.971305] hub 1-0:1.0: state 7 ports 1 chg 0000 evt 0002 [ 37.974412] usb usb1: bus auto-suspend, wakeup 1 [ 37.988175] usb usb1: suspend raced with wakeup event <--- [ 37.993947] usb usb1: usb auto-resume [ 37.998401] hub 1-0:1.0: hub_resume [ 38.105688] usb usb1-port1: status 0000, change 0000, 12 Mb/s [ 38.112399] hub 1-0:1.0: state 7 ports 1 chg 0000 evt 0000 [ 38.118645] hub 1-0:1.0: hub_suspend [ 38.122963] usb usb1: bus auto-suspend, wakeup 1 [ 38.200368] usb usb1: usb wakeup-resume [ 38.204982] usb usb1: usb auto-resume [ 38.209376] hub 1-0:1.0: hub_resume [ 38.213676] usb usb1-port1: status 0101 change 0001 [ 38.321552] hub 1-0:1.0: state 7 ports 1 chg 0002 evt 0000 [ 38.327978] usb usb1-port1: status 0101, change 0000, 12 Mb/s [ 38.457429] usb 1-1: new high-speed USB device number 3 using ci_hdrc Then, port change bit will be fixed to the final state and usb_clear_port_feature() can correctly clear it after this period. This will also avoid usb runtime suspend routine to run because usb_autopm_put_interface() not run yet. Fixes: f061f43d7418 ("usb: hub: port: add sysfs entry to switch port power") Cc: stable@kernel.org Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260316095042.1559882-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 8020c41b39f514941d93f3322b598afdce487064 Author: Sean Rhodes Date: Sun Mar 15 22:34:33 2026 +0000 usb: core: allow ACPI-managed hard-wired ports to power off USB core only relaxes the default PM_QOS_FLAG_NO_POWER_OFF policy when an upstream hub reports switchable port power. That misses internal ports whose power is managed by platform firmware instead of the USB hub descriptor. Allow the port-poweroff policy to be exposed for hard-wired ports with an ACPI-managed power resource. The existing runtime PM path still requires the child usage count to drop and remote wakeup to be clear before it will power the port down. This lets internal devices such as CNVi Bluetooth use the existing USB ACPI runtime power path even when the root hub reports no USB-standard port power switching. Signed-off-by: Sean Rhodes Link: https://patch.msgid.link/20260315223433.23452-1-sean@starlabs.systems Signed-off-by: Greg Kroah-Hartman commit 1f50332c60c2f63118b6c8b41a61d0e43d707743 Author: Bence Csókás Date: Sun Mar 15 12:24:44 2026 +0100 USB: core: Use krealloc() in usb_cache_string() Instead of "shrinking" the allocation by kmalloc()ing a new, smaller buffer, utilize krealloc() to shrink the existing allocation. This saves a memcpy(), as well as eliminates the temporary `smallbuf` allocation, which guards against allocation failure under extreme memory pressure. Signed-off-by: Bence Csókás Link: https://patch.msgid.link/20260315-usb-krealloc-v2-1-32f83e090409@sch.bme.hu Signed-off-by: Greg Kroah-Hartman commit 0b9570c4ba5cbd2c0f9a282f649e4bcfce0d52af Author: Alexey Charkov Date: Wed Mar 11 19:20:23 2026 +0400 usb: misc: onboard_usb_dev: Add Corechips SL6341 USB 2.0/3.0 hub Add the ID entries and platform data for the Corechips SL6341 onboard USB 2.0/3.0 hub controller, which requires a reset pin and a power supply for proper operation. Signed-off-by: Alexey Charkov Link: https://patch.msgid.link/20260311-sl6341-v1-3-0a890056f054@flipper.net Signed-off-by: Greg Kroah-Hartman commit bfcb86e58f3a58d05b95970d81b94cb011982780 Author: Alexey Charkov Date: Wed Mar 11 19:20:22 2026 +0400 dt-bindings: usb: Add Corechips SL6341 USB2.0/3.0 hub controller Corechips SL6341 is a 4-port low-power USB 3.2 Gen 1x1 hub controller supporting SS, HS, FS and LS connections and integrating a 5V to 3.3V built-in LDO to enable its IO to be powered directly from the 5V USB VBUS. External 1v1 VDD supply is still required for its core power. Signed-off-by: Alexey Charkov Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260311-sl6341-v1-2-0a890056f054@flipper.net Signed-off-by: Greg Kroah-Hartman commit b0dd9345c3484f6d5963dee1cd4e0f3b5149947e Author: Alexey Charkov Date: Wed Mar 11 19:20:21 2026 +0400 dt-bindings: vendor-prefixes: Add Shenzhen Corechips Microelectronics Add Shenzhen Corechips Microelectronics Co., Ltd., which is a company producing chips for USB accessories Link: http://www.corechip-sz.com/enproducts.asp Signed-off-by: Alexey Charkov Acked-by: Conor Dooley Link: https://patch.msgid.link/20260311-sl6341-v1-1-0a890056f054@flipper.net Signed-off-by: Greg Kroah-Hartman commit f2e9bc030d848f3a3d7d1cec23dd0308152eb551 Author: Zhaoyang Yu <2426767509@qq.com> Date: Thu Mar 12 11:03:29 2026 +0000 USB: pxa27x_udc: check return value of clk_enable clk_enable() may fail according to the API contract. Previously, udc_enable() ignored its return value and returned void. Modify udc_enable() to return the error code. Additionally, update all of its callers (pxa_udc_pullup, pxa_udc_vbus_session, pxa27x_udc_start, pxa_udc_probe, and pxa_udc_resume) to check this return value and handle the failure properly with necessary cleanups or rollbacks. Signed-off-by: Zhaoyang Yu <2426767509@qq.com> Link: https://patch.msgid.link/tencent_46693FE6DB434ACFB7412B16F6078AC01A06@qq.com Signed-off-by: Greg Kroah-Hartman commit 0c8ee850572b6850a78ef4c83af2acd4909a4519 Author: Krishna Kurapati Date: Thu Mar 12 15:44:31 2026 +0530 usb: typec: ucsi: Add UCSI_USB4_IMPLIES_USB quirk for X1E80100 On X1E80100, when we connect a USB4 capable dock, the PARTNER_FLAGS indicate USB4_GEN3 being set whilst keeping the PARTNER_FLAGS_USB cleared. Due to this, during ucsi_partner_change call, the usb role is marked as ROLE_NONE and passed to DWC3 controller the same way. Fix this by adding UCSI_USB4_IMPLIES_USB quirk and check for it to decide and pass on proper ROLE information to DWC3 layer. Signed-off-by: Krishna Kurapati Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260312101431.2375709-1-krishna.kurapati@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 849fbecdf7e1d4b91a31e6aa72d15e8938bddc5c Author: Oliver Neukum Date: Thu Mar 12 10:53:20 2026 +0100 iowarrior: use normal memory in write path There is just no point in using coherent memory. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260312095328.1594015-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit bcbdfc7fadf8018552fd55e57114a77637395684 Author: Oliver Neukum Date: Thu Mar 12 10:45:28 2026 +0100 iowarrior: use interruptible lock in iowarrior_write() The function itself, if it has to wait to perform IO, use interruptible sleep. Hence the sleep needed to avoid the write code path racing with itself should also use interruptible sleep. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260312094619.1590556-2-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 56dd29088c9d9510c48a8ebad2465248fde36551 Author: Oliver Neukum Date: Thu Mar 12 10:45:27 2026 +0100 usb: iowarrior: remove inherent race with minor number The driver saves the minor number it gets upon registration in its descriptor for debugging purposes. However, there is inevitably a window between registration and saving the correct minor in a descriptor. During this window the debugging output will be wrong. As wrong debug output is worse than no debug output, just remove it. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260312094619.1590556-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 916aeaffad2526b9723387b6bd449ec76dcc8d44 Author: Oliver Neukum Date: Thu Mar 12 13:34:27 2026 +0100 USB: uas: give the error handler the correct name A UAS device can in principle contain multiple busses. A reset on the USB level will reset them all. We cannot reset a single bus. In practical terms this does not matter, as only one method of reset is implemented, but we should not lie. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260312123435.2015029-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 03cd4fd620bdfc33ea25f2f7504f0d49c7dd1f9e Author: Rosen Penev Date: Thu Mar 12 17:34:55 2026 -0700 usb: fhci: use kzalloc_flex for priv struct Convert kzalloc_obj(s) to kzalloc_flex to save an allocation. Add __counted_by to get extra runtime analysis. Move counting variable assignment immediately after allocation as required by __counted_by. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260313003456.124270-1-rosenp@gmail.com Signed-off-by: Greg Kroah-Hartman commit 341434a444024f70f1f7c2355bb1ae8dc5fb15fe Author: Rosen Penev Date: Wed Mar 11 16:20:43 2026 -0700 usb: renesas_usbhs: use kzalloc_flex Removes one allocation and one free by using a flexible array member. Also added __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260311232043.18025-1-rosenp@gmail.com Signed-off-by: Greg Kroah-Hartman commit a1678c4e57e0004a94363127309fcc8b388f11ba Author: Johan Hovold Date: Thu Mar 5 14:38:51 2026 +0100 USB: usbip: drop redundant device reference Driver core holds a reference to the USB device while it is bound to a driver and there is no need to take additional references unless the structure is needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305133851.2952-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0888c3371ad229ce76675754ce43ae04bb4945e1 Author: Johan Hovold Date: Thu Mar 5 14:38:50 2026 +0100 USB: apple-mfi-fastcharge: drop redundant device reference Driver core holds a reference to the USB device while it is bound to a driver and there is no need to take additional references unless the structure is needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Reviewed-by: Bastien Nocera Link: https://patch.msgid.link/20260305133851.2952-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit b7cce3e2cca9cd78418f3c3784474b778e7996fe Author: Mikulas Patocka Date: Mon Mar 16 15:04:15 2026 +0100 dm: don't report warning when doing deferred remove If dm_hash_remove_all was called from dm_deferred_remove, it would write a warning "remove_all left %d open device(s)" if there are some other devices active. The warning is bogus, so let's disable it in this case. Signed-off-by: Mikulas Patocka Reported-by: Zdenek Kabelac Cc: stable@vger.kernel.org Fixes: 2c140a246dc0 ("dm: allow remove to be deferred") commit 99a2312f69805f4ba92d98a757625e0300a747ab Author: Guillaume Gonnet Date: Tue Mar 17 22:32:28 2026 +0100 dm init: ensure device probing has finished in dm-mod.waitfor= The early_lookup_bdev() function returns successfully when the disk device is present but not necessarily its partitions. In this situation, dm_early_create() fails as the partition block device does not exist yet. In my case, this phenomenon occurs quite often because the device is an SD card with slow reading times, on which kernel takes time to enumerate available partitions. Fortunately, the underlying device is back to "probing" state while enumerating partitions. Waiting for all probing to end is enough to fix this issue. That's also the reason why this problem never occurs with rootwait= parameter: the while loop inside wait_for_root() explicitly waits for probing to be done and then the function calls async_synchronize_full(). These lines were omitted in 035641b, even though the commit says it's based on the rootwait logic... Anyway, calling wait_for_device_probe() after our while loop does the job (it both waits for probing and calls async_synchronize_full). Fixes: 035641b01e72 ("dm init: add dm-mod.waitfor to wait for asynchronously probed block devices") Signed-off-by: Guillaume Gonnet Signed-off-by: Mikulas Patocka commit 500e54d449f60e9692e2622ad2ba4f1e79590e87 Author: Rosen Penev Date: Fri Mar 13 14:41:37 2026 -0700 thunderbolt: dma_port: kmalloc_array + kzalloc to flex Use a single allocation with a flexible array member. Simplifies allocation and freeing. Signed-off-by: Rosen Penev Signed-off-by: Mika Westerberg commit a809ff6469c53d69db5f30251bcf206d618bcccb Author: Piyush Patle Date: Wed Mar 18 18:37:33 2026 +0530 ASoC: dt-bindings: adi,ssm2305: Convert to DT schema Convert the SSM2305 speaker amplifier binding from text format to DT schema to enable dtbs_check validation. Signed-off-by: Piyush Patle Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260318130733.52477-1-piyushpatle228@gmail.com Signed-off-by: Mark Brown commit a19457958c3018783881c4416f272cd594f13049 Author: Eliot Courtney Date: Wed Mar 18 13:07:13 2026 +0900 gpu: nova-core: gsp: add mutex locking to Cmdq Wrap `Cmdq`'s mutable state in a new struct `CmdqInner` and wrap that in a Mutex. This lets `Cmdq` methods take &self instead of &mut self, which lets required commands be sent e.g. while unloading the driver. The mutex is held over both send and receive in `send_command` to make sure that it doesn't get the reply of some other command that could have been sent just beforehand. Reviewed-by: Zhi Wang Tested-by: Zhi Wang Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260318-cmdq-locking-v5-5-18b37e3f9069@nvidia.com Signed-off-by: Alexandre Courbot commit 9b786c7f630924fc3a6179b515e9d0d222d91c95 Author: Eliot Courtney Date: Wed Mar 18 13:07:12 2026 +0900 gpu: nova-core: gsp: make `Cmdq` a pinned type Make `Cmdq` a pinned type. This is needed to use Mutex, which is needed to add locking to `Cmdq`. Reviewed-by: Zhi Wang Tested-by: Zhi Wang Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260318-cmdq-locking-v5-4-18b37e3f9069@nvidia.com Signed-off-by: Alexandre Courbot commit c3bd240f97491122e3c9e9922def7e59eecd6145 Author: Eliot Courtney Date: Wed Mar 18 13:07:11 2026 +0900 gpu: nova-core: gsp: add reply/no-reply info to `CommandToGsp` Add type infrastructure to know what reply is expected from each `CommandToGsp`. Uses a marker type `NoReply` which does not implement `MessageFromGsp` to mark commands which don't expect a response. Update `send_command` to wait for a reply and add `send_command_no_wait` which sends a command that has no reply, without blocking. This prepares for adding locking to the queue. Tested-by: Zhi Wang Reviewed-by: Gary Guo Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260318-cmdq-locking-v5-3-18b37e3f9069@nvidia.com Signed-off-by: Alexandre Courbot commit 67d9ef2bdd62c541a22da04875ccd0722ba1d3d4 Author: Eliot Courtney Date: Wed Mar 18 13:07:10 2026 +0900 gpu: nova-core: gsp: add `RECEIVE_TIMEOUT` constant for command queue Remove magic numbers and add a default timeout for callers to use. Tested-by: Zhi Wang Reviewed-by: Gary Guo Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260318-cmdq-locking-v5-2-18b37e3f9069@nvidia.com Signed-off-by: Alexandre Courbot commit 0a5dbeadf16f32945dce6631c169608f0e131e5a Author: Eliot Courtney Date: Wed Mar 18 13:07:09 2026 +0900 gpu: nova-core: gsp: fix stale doc comments on command queue methods Fix some inaccuracies / old doc comments. Reviewed-by: Zhi Wang Tested-by: Zhi Wang Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260318-cmdq-locking-v5-1-18b37e3f9069@nvidia.com Signed-off-by: Alexandre Courbot commit 87a1698cb80650e47b41ca78a78ce06870cba631 Author: Pankaj Patil Date: Wed Feb 25 17:37:24 2026 +0530 firmware: qcom: scm: Allow QSEECOM on Glymur CRD Add glymur-crd to QSEECOM allowlist for enabling access to efivars and uefi bootloader Signed-off-by: Pankaj Patil Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260225-qseecom_glymur-v1-1-0cafc709e2ef@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d98b978446d249df1a662b4fef4c0bbfa1d650b8 Author: Krzysztof Kozlowski Date: Mon Feb 16 10:15:28 2026 +0100 firmware: qcom: scom: Simplify mutex with guard Simplify error path unlocking mutex with the guard. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260216091525.107935-6-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4bfb0ec11e20b9354beabf1b9f3e70e926c407bd Author: Krzysztof Kozlowski Date: Mon Feb 16 10:15:27 2026 +0100 firmware: qcom: uefisecapp: Annotate acquiring locks for context tracking qcuefi_acquire() and qcuefi_release() end with mutex locked or unlocked respectively, so annotate them so the lock usage will be tracked by context tracking tools. Note that mutex is tracked since commit 370f0a345a70 ("locking/mutex: Support Clang's context analysis"). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260216091525.107935-5-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 055d79affa436d83a6e0d3ca6d054f11a7e3d4c1 Author: Krzysztof Kozlowski Date: Mon Feb 16 10:15:26 2026 +0100 firmware: qcom: uefisecapp: Simplify mutex with guard Simplify error path unlocking mutex with the guard. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260216091525.107935-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 408b79c097d054fac70d041bad117e1a14fb0213 Author: Manivannan Sadhasivam Date: Tue Feb 10 12:33:21 2026 +0530 arm64: dts: qcom: x1e80100: Add '#cooling-cells' for CPU nodes Enable passive cooling for CPUs in the X1E80100 SoC by adding the '#cooling-cells' property. This will allow the OS to mitigate the CPU power dissipation with the help of SCMI DVFS. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Tested-by: Gaurav Kohli Link: https://lore.kernel.org/r/20260210070321.17033-1-manivannan.sadhasivam@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 90b7cc18e9333879991f178c3f78bd1b93e2e8e7 Author: Krzysztof Kozlowski Date: Mon Feb 9 10:32:38 2026 +0100 arm64: dts: qcom: x1-crd: add USB DisplayPort audio Add support for playing audio over USB DisplayPort (the two left USB-C ports on the CRD device). Reviewed-by: Konrad Dybcio Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260209093237.33287-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1cde54c54b83b33b49b9fdf760a58a7e6689789c Author: Roger Shimizu Date: Sat Feb 7 02:45:28 2026 -0800 arm64: dts: qcom: qcs6490: Add Thundercomm AI Mini PC G1 IoT Thundercomm AI MiniPC G1 IoT is single board computer with AI capability based on Qualcomm QCS6490 platform. This device tree is confirmed to work as below: - GPU - HDMI output port - PCIe M.2 port (for external Wi-Fi or 5G connectivity) - UART / serial console port - UFS - USB Type-C port, with Display Port Signed-off-by: Roger Shimizu Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260207-next-20260130_rosh-v2-3-548bbe0c7742@debian.org Signed-off-by: Bjorn Andersson commit 5230355252d02f50491b3dbc34ba9cdab68fb82b Author: Roger Shimizu Date: Sat Feb 7 02:45:27 2026 -0800 arm64: dts: qcom: kodiak: Add missing usb-role-switch property Add missing usb-role-switch property to usb_1 node. Signed-off-by: Roger Shimizu Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260207-next-20260130_rosh-v2-2-548bbe0c7742@debian.org Signed-off-by: Bjorn Andersson commit bc7cc1c4a3916efb72bd0c8c10e31386fefa1029 Author: Roger Shimizu Date: Sat Feb 7 02:45:26 2026 -0800 dt-bindings: arm: qcom: Add Thundercomm AI Mini PC G1 IoT Document Thundercomm AI Mini PC G1 IoT. Signed-off-by: Roger Shimizu Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260207-next-20260130_rosh-v2-1-548bbe0c7742@debian.org Signed-off-by: Bjorn Andersson commit 453f8a15232faa55e84ae00c2bf1fed37262856e Author: Aaron Kling Date: Sat Feb 7 19:20:00 2026 -0600 arm64: dts: qcom: sm8550: Add ACD levels for GPU Update GPU node to include acd level values. Signed-off-by: Aaron Kling Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260207-sm8550-acd-v1-1-53d084c58c9a@gmail.com Signed-off-by: Bjorn Andersson commit ce26eb2967820eceb60c928bbae63dcd7c05fb68 Author: Xilin Wu Date: Sat Feb 7 20:12:11 2026 -0600 arm64: dts: qcom: pmk8550: Add PWM controller Add the PWM function to the pmk8550 dtsi, which is usually used to control PWM backlight on platforms using this PMIC. Signed-off-by: Xilin Wu Reviewed-by: Konrad Dybcio Signed-off-by: Aaron Kling Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260207-pmk8550-pwm-v1-1-f2b26ab98d8b@gmail.com Signed-off-by: Bjorn Andersson commit 7aedf0ebbf5701614a070620fc672fd66bc7899f Author: Bartosz Golaszewski Date: Fri Feb 6 14:45:06 2026 +0100 arm64: dts: qcom: remove msm8996-v3.0.dtsi This file is not used anywhere. Remove it. Signed-off-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Closes: https://lore.kernel.org/all/20251212203226.458694-3-robh@kernel.org/ Link: https://lore.kernel.org/r/20260206134506.72679-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f69b0d8d51ec020990ff9fd9b476f4be2a711a71 Author: Varadarajan Narayanan Date: Thu Feb 5 14:29:36 2026 +0530 arm64: dts: qcom: ipq9574: Enable eMMC variant RDP433/RDP418 can have NAND or eMMC based on a board level rework. Since the same GPIOS are used for both the interfaces, only one of them can be used. Add a new DTS file to enable eMMC. Signed-off-by: Varadarajan Narayanan Link: https://lore.kernel.org/r/20260205085936.3220108-5-varadarajan.narayanan@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 26c980a7d322439076e59205d9eb9f94d300418a Author: Varadarajan Narayanan Date: Thu Feb 5 14:29:35 2026 +0530 dt-bindings: arm: qcom: Add IPQ9574 AL02-c2 and AL02-c7 eMMC variant Document the IPQ9574 AL02-c2 and AL02-c7 eMMC variant. Signed-off-by: Varadarajan Narayanan Link: https://lore.kernel.org/r/20260205085936.3220108-4-varadarajan.narayanan@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit fc1fd9d52a88f1efabe9c2e34fa78245cfc6380b Author: Varadarajan Narayanan Date: Thu Feb 5 14:29:34 2026 +0530 arm64: dts: qcom: ipq9574-rdp433: Reorganize DTS to introduce eMMC support The RDP433 has NAND and eMMC variants. Presently, only NAND variant is supported. To enable support for eMMC variant, move the common nodes from ipq9574-rdp433.dts to ipq9574-rdp433-common.dtsi. ipq9574-rdp433-common.dtsi will be included in rdp433 NAND and eMMC DT files. Reviewed-by: Konrad Dybcio Signed-off-by: Varadarajan Narayanan Link: https://lore.kernel.org/r/20260205085936.3220108-3-varadarajan.narayanan@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 53f5d2d61a1c824e2b5117637248afe986abf2f2 Author: Varadarajan Narayanan Date: Thu Feb 5 14:29:33 2026 +0530 arm64: dts: qcom: ipq9574: Add details for eMMC RDP433 and RDP418 has NAND and eMMC variants. Presently, only NAND variant is supported. To enable support for eMMC variant, add the relevant GPIO and regulator information. Do not enable NAND or eMMC by default in ipq9574-rdp-common.dtsi. Enable it in board specific DTS as applicable. Reviewed-by: Konrad Dybcio Signed-off-by: Varadarajan Narayanan Link: https://lore.kernel.org/r/20260205085936.3220108-2-varadarajan.narayanan@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7aec47be7c2bbed4823325e888df3e91dde33253 Author: Odelu Kukatla Date: Tue Jan 27 14:31:16 2026 +0530 arm64: dts: qcom: qcs8300: Add clocks for QoS configuration Add clocks which need to be enabled for configuring QoS on qcs8300 SoC. Signed-off-by: Odelu Kukatla Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260127090116.1438780-4-odelu.kukatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7131f6d909a6546329b71f2bacfdc60cb3e6020e Author: Barnabás Czémán Date: Fri Jan 16 08:07:39 2026 +0100 arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight The backlight on this device is connected via 3 strings. Currently, the DT claims only two are present, which results in visible stripes on the display (since every third backlight string remains unconfigured). Fix the number of strings to avoid that. Fixes: 38d779c26395 ("arm64: dts: qcom: msm8953: Add device tree for Xiaomi Mi A2 Lite") Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260116-pmi8950-wled-v3-7-e6c93de84079@mainlining.org Signed-off-by: Bjorn Andersson commit 9bc4b18a425e8cf1bca190a136a11c3be516f513 Author: Barnabás Czémán Date: Fri Jan 16 08:07:38 2026 +0100 arm64: dts: qcom: msm8937-xiaomi-land: correct wled ovp value PMI8950 doesn't actually support setting an OVP threshold value of 29.6 V. The closest allowed value is 29.5 V. Set that instead. Fixes: 2144f6d57d8e ("arm64: dts: qcom: Add Xiaomi Redmi 3S") Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260116-pmi8950-wled-v3-6-e6c93de84079@mainlining.org Signed-off-by: Bjorn Andersson commit 9e87f0eaadccc3fecdf3c3c0334e05694804b5f5 Author: Barnabás Czémán Date: Fri Jan 16 08:07:37 2026 +0100 arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value PMI8950 doesn't actually support setting an OVP threshold value of 29.6 V. The closest allowed value is 29.5 V. Set that instead. Fixes: aa17e707e04a ("arm64: dts: qcom: msm8953: Add device tree for Xiaomi Redmi 5 Plus") Reviewed-by: Konrad Dybcio Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260116-pmi8950-wled-v3-5-e6c93de84079@mainlining.org Signed-off-by: Bjorn Andersson commit 00569c634222d58dbc145ce1667c889b0fad3cbc Author: Xilin Wu Date: Wed Jan 28 13:11:28 2026 -0600 arm64: dts: qcom: sm8550: Update EAS properties The original values provided by Qualcomm appear to be quite inaccurate. Specifically, some heavy gaming tasks could be improperly assigned to the A510 cores by the scheduler, resulting in a CPU bottleneck. This update to the EAS properties aims to enhance the user experience across various scenarios. The power numbers were obtained using a Type-C power meter, which was directly connected to the battery connector on the AYN Odin 2 motherboard, acting as a fake battery. It should be noted that the A715 cores seem less efficient than the A710 cores. Therefore, an average value has been assigned to them, considering that the A715 and A710 cores share a single cpufreq domain. Cortex-A510 cores: 441 kHz, 564 mV, 43 mW, 350 Cx 556 kHz, 580 mV, 59 mW, 346 Cx 672 kHz, 592 mV, 71 mW, 312 Cx 787 kHz, 604 mV, 83 mW, 290 Cx 902 kHz, 608 mV, 96 mW, 288 Cx 1017 kHz, 624 mV, 107 mW, 264 Cx 1113 kHz, 636 mV, 117 mW, 252 Cx 1228 kHz, 652 mV, 130 mW, 240 Cx 1344 kHz, 668 mV, 146 mW, 235 Cx 1459 kHz, 688 mV, 155 mW, 214 Cx 1555 kHz, 704 mV, 166 mW, 205 Cx 1670 kHz, 724 mV, 178 mW, 192 Cx 1785 kHz, 744 mV, 197 mW, 189 Cx 1900 kHz, 764 mV, 221 mW, 190 Cx 2016 kHz, 784 mV, 243 mW, 188 Cx Your dynamic-power-coefficient for cpu 1: 251 Cortex-A715 cores: 614 kHz, 572 mV, 97 mW, 470 Cx 729 kHz, 592 mV, 123 mW, 473 Cx 844 kHz, 608 mV, 152 mW, 486 Cx 940 kHz, 624 mV, 178 mW, 485 Cx 1056 kHz, 644 mV, 207 mW, 465 Cx 1171 kHz, 656 mV, 243 mW, 480 Cx 1286 kHz, 672 mV, 271 mW, 459 Cx 1401 kHz, 692 mV, 310 mW, 454 Cx 1536 kHz, 716 mV, 368 mW, 462 Cx 1651 kHz, 740 mV, 416 mW, 454 Cx 1785 kHz, 760 mV, 492 mW, 475 Cx 1920 kHz, 784 mV, 544 mW, 457 Cx 2054 kHz, 804 mV, 613 mW, 458 Cx 2188 kHz, 828 mV, 702 mW, 465 Cx 2323 kHz, 852 mV, 782 mW, 461 Cx 2457 kHz, 876 mV, 895 mW, 473 Cx 2592 kHz, 896 mV, 1020 mW, 490 Cx 2707 kHz, 920 mV, 1140 mW, 498 Cx 2803 kHz, 940 mV, 1215 mW, 490 Cx Your dynamic-power-coefficient for cpu 3: 472 Cortex-A710 cores: 614 kHz, 572 mV, 91 mW, 388 Cx 729 kHz, 592 mV, 116 mW, 424 Cx 844 kHz, 608 mV, 143 mW, 443 Cx 940 kHz, 624 mV, 165 mW, 434 Cx 1056 kHz, 644 mV, 195 mW, 430 Cx 1171 kHz, 656 mV, 218 mW, 414 Cx 1286 kHz, 672 mV, 250 mW, 415 Cx 1401 kHz, 692 mV, 286 mW, 412 Cx 1536 kHz, 716 mV, 331 mW, 407 Cx 1651 kHz, 740 mV, 374 mW, 401 Cx 1785 kHz, 760 mV, 439 mW, 417 Cx 1920 kHz, 784 mV, 495 mW, 411 Cx 2054 kHz, 804 mV, 557 mW, 412 Cx 2188 kHz, 828 mV, 632 mW, 415 Cx 2323 kHz, 852 mV, 721 mW, 422 Cx 2457 kHz, 876 mV, 813 mW, 427 Cx 2592 kHz, 896 mV, 912 mW, 435 Cx 2707 kHz, 920 mV, 1019 mW, 442 Cx 2803 kHz, 940 mV, 1087 mW, 436 Cx Your dynamic-power-coefficient for cpu 5: 421 Cortex-X3 core: 729 kHz, 568 mV, 252 mW, 1110 Cx 864 kHz, 580 mV, 312 mW, 1097 Cx 998 kHz, 592 mV, 379 mW, 1109 Cx 1132 kHz, 608 mV, 453 mW, 1099 Cx 1248 kHz, 624 mV, 517 mW, 1067 Cx 1363 kHz, 636 mV, 587 mW, 1067 Cx 1478 kHz, 648 mV, 657 mW, 1058 Cx 1593 kHz, 664 mV, 739 mW, 1049 Cx 1708 kHz, 680 mV, 813 mW, 1020 Cx 1843 kHz, 704 mV, 940 mW, 1021 Cx 1977 kHz, 724 mV, 1054 mW, 1007 Cx 2092 kHz, 740 mV, 1201 mW, 1045 Cx 2227 kHz, 768 mV, 1358 mW, 1029 Cx 2342 kHz, 788 mV, 1486 mW, 1016 Cx 2476 kHz, 812 mV, 1711 mW, 1046 Cx 2592 kHz, 836 mV, 1846 mW, 1014 Cx 2726 kHz, 856 mV, 2046 mW, 1020 Cx 2841 kHz, 880 mV, 2266 mW, 1027 Cx 2956 kHz, 908 mV, 2616 mW, 1074 Cx 3187 kHz, 956 mV, 3326 mW, 1147 Cx Your dynamic-power-coefficient for cpu 7: 1057 7-zip benchmark single-core MIPS: 2128 4416 4632 6686 Signed-off-by: Xilin Wu Signed-off-by: Aaron Kling Reviewed-by: Neil Armstrong Reviewed-by: Lukasz Luba Link: https://lore.kernel.org/r/20260128-sm8550-eas-v1-1-fb80615bed5c@gmail.com Signed-off-by: Bjorn Andersson commit 47c88db49f6ced5592331c38ef95978fe3497704 Author: Xin Liu Date: Mon Feb 2 22:32:44 2026 -0800 arm64: dts: qcom: hamoa: Add remoteproc IOMMUS in EL2 device trees All the existing variants Hamoa boards are using Gunyah hypervisor which means that, so far, Linux-based OS could only boot in EL1 on those devices. However, it is possible for us to boot Linux at EL2 on these devices [1]. When running under Gunyah, the remote processor firmware IOMMU streams are controlled by Gunyah. However, without Gunyah, the IOMMU is managed by the consumer of this DeviceTree. Therefore, describe the firmware streams for each remote processor. Add remoteproc IOMMUS to the EL2 device trees to generate the corresponding -el2.dtb files. [1] https://docs.qualcomm.com/bundle/publicresource/topics/80-70020-4/boot-developer-touchpoints.html#uefi Reviewed-by: Abel Vesa Signed-off-by: Xin Liu Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260203063244.1498699-1-xin.liu@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 6da22b031a3cf995d6488500a5edae07cae3df2d Author: Rafael J. Wysocki Date: Tue Mar 17 20:44:38 2026 +0100 platform/x86: fujitsu: Convert laptop driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the main part of the Fujitsu laptop driver from an ACPI driver to a platform one. After this change, the subordinate LED and input devices will be registered under the platform device used for driver binding instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Acked-by: Jonathan Woithe Link: https://patch.msgid.link/10818905.nUPlyArG6x@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d5c9212ccfaa7bd453bf4b198eb19937f5deb58b Author: Rafael J. Wysocki Date: Tue Mar 17 20:43:06 2026 +0100 platform/x86: fujitsu: Convert backlight driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the backlight part of the Fujitsu laptop driver from an ACPI driver to a platform one. After this change, the backlight and input subordinate devices will be registered under the platform device used for driver binding instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Acked-by: Jonathan Woithe Link: https://patch.msgid.link/3407755.44csPzL39Z@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 9b9271ac2a25f427dd38a3f486e8b4d7afe7e0ec Author: Rafael J. Wysocki Date: Tue Mar 17 20:42:09 2026 +0100 platform/x86: fujitsu: Register ACPI notify handlers directly To facilitate subsequent conversion of the driver to using struct platform_driver instead of struct acpi_driver, make it install its ACPI notify handlers directly instead of using struct acpi_driver .notify() callbacks. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Acked-by: Jonathan Woithe Link: https://patch.msgid.link/3035290.e9J7NaK4W3@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c256927c62475f222bd9fc913538dd484f88fed6 Author: Rafael J. Wysocki Date: Tue Mar 17 20:40:02 2026 +0100 platform/x86: fujitsu: Reorder code to avoid forward declarations Move the definitions of acpi_fujitsu_bl_notify() and acpi_fujitsu_laptop_notify() along with some helpers above the definitions of the functions that will refer to them after subsequent changes, to avoid having to add forward declarations of them. No intentional functional impact. Acked-by: Jonathan Woithe Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/1950259.tdWV9SEqCh@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit bd13b265d386afb15d9ee5feb4f2cb605a5770db Author: Rafael J. Wysocki Date: Tue Mar 17 20:39:07 2026 +0100 platform/x86: fujitsu-tablet: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the fujitsu-tablet ACPI driver to a platform one. After this change, the subordinate input device will be registered under the platform device used for driver binding instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Acked-by: Jonathan Woithe Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2403432.ElGaqSPkdT@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7937ea733f79b3f25e802a0c8360bf7423856f36 Author: Sanjay Yadav Date: Fri Mar 13 12:46:09 2026 +0530 drm/xe: Fix missing runtime PM reference in ccs_mode_store ccs_mode_store() calls xe_gt_reset() which internally invokes xe_pm_runtime_get_noresume(). That function requires the caller to already hold an outer runtime PM reference and warns if none is held: [46.891177] xe 0000:03:00.0: [drm] Missing outer runtime PM protection [46.891178] WARNING: drivers/gpu/drm/xe/xe_pm.c:885 at xe_pm_runtime_get_noresume+0x8b/0xc0 Fix this by protecting xe_gt_reset() with the scope-based guard(xe_pm_runtime)(xe), which is the preferred form when the reference lifetime matches a single scope. v2: - Use scope-based guard(xe_pm_runtime)(xe) (Shuicheng) - Update commit message accordingly Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7593 Fixes: 480b358e7d8e ("drm/xe: Do not wake device during a GT reset") Cc: # v6.19+ Cc: Thomas Hellström Cc: Matthew Brost Cc: Rodrigo Vivi Cc: Shuicheng Lin Suggested-by: Matthew Auld Signed-off-by: Sanjay Yadav Reviewed-by: Shuicheng Lin Reviewed-by: Matthew Auld Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260313071608.3459480-2-sanjay.kumar.yadav@intel.com commit 45c77d4bf8d4d15453d709b9b828e498898e0751 Author: Jouni Högander Date: Tue Mar 17 08:24:02 2026 +0200 drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk Add new quirk (QUIRK_DISABLE_PANEL_REPLAY) for disabling Panel Replay as quirk for problematic setups. Apply this newly added quirk on Dell XPS 14 DA14260 if specific panel model is installed. We are observing problems with Dell XPS 14 DA14260. This device has certain LGD panel model which seems to be problematic. We have seen other LGD panel model with same OUI is working fine. Due to this we can't apply the quirk only based on panel OUI. There are also cases where same device model has differing panel model. We don't want to disable Panel Replay on such devices. Best we can do is to apply the quirk based on both device model and panel model. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7521 Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://patch.msgid.link/20260317062402.1888624-1-jouni.hogander@intel.com commit b63c6b9b7f5ed02bb3abf7a39c18ea54d1a69f0f Author: Arnd Bergmann Date: Wed Mar 4 09:36:48 2026 +0100 drm/i915/fbdev: fix link failure without FBDEV emulation If CONFIG_DRM_FBDEV_EMULATION is disabled but CONFIG_FRAMEBUFFER_CONSOLE is turned on, the i915 driver now fails to link: ERROR: modpost: "intel_fbdev_fb_prefer_stolen" [drivers/gpu/drm/i915/i915.ko] undefined! Fix the contition to include a check for the symbol that controls compilation of intel_fbdev_fb.c. Fixes: 94c7d2861292 ("drm/i915/fbdev: Extract intel_fbdev_fb_prefer_stolen()") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260304083701.724908-1-arnd@kernel.org Signed-off-by: Jani Nikula commit 6017671da9d0a11056bf37b4b54903e57dbc9cd1 Author: Charles Keepax Date: Wed Mar 18 10:38:13 2026 +0000 ASoC: wm_adsp: Fix crash in kunit tests on arm64 Several of the wm_adsp kunit tests failed by only on arm64. This turns out to be passing things to release_firmware which were not allocated with request_firmware. This does actually drop some errors on other platforms but somehow doesn't cause the tests to fail, and kunit hides a lot of the output for passing tests. There is a comment in the code regarding this exact thing in wm_adsp_fw_find_test_case_exit(), but then it goes on and does it anyway. I suspect maybe there was a plan to override wm_adsp_release_firmware_files() that got forgotten, as the function appears to have hooks for kunit that aren't used. Anyway for now implement a simple fix of freeing the filenames locally. It is likely a more detailed fix will be implemented in the near future but this should get things moving again. Fixes: bf2d44d07de7 ("ASoC: wm_adsp: Add kunit test for firmware file search") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260318103813.249190-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit e5b3fe57dc5893c7ea5f478a1161b8643adf5dd9 Author: Samasth Norway Ananda Date: Mon Mar 16 16:19:20 2026 -0700 drm/i915/gmbus: fix a typo in comment message Fix a typo inside a comment message from ("generata" -> "generate") in function do_gmbus_xfer() before calling intel_de_write_fw() Signed-off-by: Samasth Norway Ananda Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260316231920.135438-3-samasth.norway.ananda@oracle.com Signed-off-by: Jani Nikula commit 4ab0f09ee73fc853d00466682635f67c531f909c Author: Samasth Norway Ananda Date: Mon Mar 16 16:19:19 2026 -0700 drm/i915/gmbus: fix spurious timeout on 512-byte burst reads When reading exactly 512 bytes with burst read enabled, the extra_byte_added path breaks out of the inner do-while without decrementing len. The outer while(len) then re-enters and gmbus_wait() times out since all data has been delivered. Decrement len before the break so the outer loop terminates correctly. Fixes: d5dc0f43f268 ("drm/i915/gmbus: Enable burst read") Signed-off-by: Samasth Norway Ananda Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260316231920.135438-2-samasth.norway.ananda@oracle.com Signed-off-by: Jani Nikula commit 2c0ff6151c7bc51b20e7b25be2073e6f01f750ef Merge: e5966096d0856d c1f955437440f9 Author: Carlos Maiolino Date: Wed Mar 18 11:04:17 2026 +0100 Merge branch 'xfs-7.1-merge' into for-next Signed-off-by: Carlos Maiolino commit bec7cbfa7d4f57797ac5a17f6a543a550eccbd47 Author: Cristian Ciocaltea Date: Tue Mar 3 21:24:20 2026 +0200 drm/rockchip: vop2: Support setting custom background color The Rockchip VOP2 display controller allows configuring the background color of each video output port. Since a previous patch introduced the BACKGROUND_COLOR CRTC property, which defaults to solid black, make use of it when programming the hardware. Note the maximum precision allowed by the display controller is 10bpc, while the alpha component is not supported, hence ignored. Tested-by: Diederik de Haas Reviewed-by: Andy Yan Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260303-rk3588-bgcolor-v8-4-fee377037ad1@collabora.com Signed-off-by: Daniel Stone commit 0b9eff726d5636a1638786d2f659b8897950533b Author: Cristian Ciocaltea Date: Tue Mar 3 21:24:19 2026 +0200 drm/vkms: Support setting custom background color Make use of the BACKGROUND_COLOR CRTC property when filling the background during blending. It already defaults to solid black. Since the internal representation of the pixel color in VKMS relies on 16 bits of precision, use the newly introduced DRM_ARGB64_GET{R|G|B}() helpers to access the individual components of the background color property, which is compliant with DRM_FORMAT_ARGB16161616. It's worth noting the alpha component is ignored, hence non-opaque background colors are not supported. Reviewed-by: Nícolas F. R. A. Prado Tested-by: Diederik de Haas Reviewed-by: Louis Chauvet Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260303-rk3588-bgcolor-v8-3-fee377037ad1@collabora.com Signed-off-by: Daniel Stone commit 4c684596cde44d03dfd9624c86e1de4db0dcf121 Author: Cristian Ciocaltea Date: Tue Mar 3 21:24:18 2026 +0200 drm: Add CRTC background color property Some display controllers can be hardware programmed to show non-black colors for pixels that are either not covered by any plane or are exposed through transparent regions of higher planes. This feature can help reduce memory bandwidth usage, e.g. in compositors managing a UI with a solid background color while using smaller planes to render the remaining content. To support this capability, introduce the BACKGROUND_COLOR standard DRM mode property, which can be attached to a CRTC through the drm_crtc_attach_background_color_property() helper function. Additionally, define a 64-bit ARGB format value to be built with the help of a couple of dedicated DRM_ARGB64_PREP*() helpers. Individual color components can be extracted with desired precision using the corresponding DRM_ARGB64_GET*() macros. Co-developed-by: Matt Roper Signed-off-by: Matt Roper Reviewed-by: Nícolas F. R. A. Prado Tested-by: Diederik de Haas Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260303-rk3588-bgcolor-v8-2-fee377037ad1@collabora.com Signed-off-by: Daniel Stone commit de9e2b3d88af36411301c049a1b049f3e4fe0757 Author: Cristian Ciocaltea Date: Tue Mar 3 21:24:17 2026 +0200 uapi: Provide DIV_ROUND_CLOSEST() Currently DIV_ROUND_CLOSEST() is only available for the kernel via include/linux/math.h. Expose it to userland as well by adding __KERNEL_DIV_ROUND_CLOSEST() as a common definition in uapi. Additionally, ensure it allows building ISO C applications by switching from the 'typeof' GNU extension to the ISO-friendly __typeof__. Reviewed-by: Nícolas F. R. A. Prado Tested-by: Diederik de Haas Acked-by: Andy Shevchenko Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260303-rk3588-bgcolor-v8-1-fee377037ad1@collabora.com Signed-off-by: Daniel Stone commit f8909447894aea7660c84c9d599ffd6b9a3772da Author: Thorsten Blum Date: Wed Mar 18 01:12:21 2026 +0100 autofs: replace manual symlink buffer allocation in autofs_dir_symlink The symlink name was previously duplicated using an explicit kmalloc() followed by strcpy(), which is deprecated [1]. Replace this open-coded string duplication with kstrdup(), which allocates and copies the symlink name with a single helper function. Remove the local variable 'size' and set 'i_size' directly using strlen(cp), which is equivalent to the previous value of 'size'. This simplifies the code, uses common string-handling helpers, and removes the deprecated use of strcpy(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Acked-by: Ian Kent Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260318001219.2354-3-thorsten.blum@linux.dev Signed-off-by: Christian Brauner commit b7560798466a07d9c3fb011698e92c335ab28baf Author: Devendra K Verma Date: Wed Mar 18 12:34:03 2026 +0530 dmaengine: dw-edma: Add non-LL mode AMD MDB IP supports Linked List (LL) mode as well as non-LL mode. The current code does not have the mechanisms to enable the DMA transactions using the non-LL mode. The following two cases are added with this patch: - For the AMD (Xilinx) only, when a valid physical base address of the device side DDR is not configured, then the IP can still be used in non-LL mode. For all the channels DMA transactions will be using the non-LL mode only. This, the default non-LL mode, is not applicable for Synopsys IP with the current code addition. - If the default mode is LL-mode, for both AMD (Xilinx) and Synosys, and if user wants to use non-LL mode then user can do so via configuring the peripheral_config param of dma_slave_config. Signed-off-by: Devendra K Verma Reviewed-by: Frank Li Link: https://patch.msgid.link/20260318070403.1634706-3-devendra.verma@amd.com Signed-off-by: Vinod Koul commit 14eb9a1d338fdc301a2297af86818ecf716b1539 Author: Devendra K Verma Date: Wed Mar 18 12:34:02 2026 +0530 dmaengine: dw-edma: Add AMD MDB Endpoint Support AMD MDB PCIe endpoint support. For AMD specific support added the following - AMD supported PCIe Device IDs and Vendor ID (Xilinx). - AMD MDB specific driver data - AMD MDB specific VSEC capability to retrieve the device DDR base address. Signed-off-by: Devendra K Verma Reviewed-by: Frank Li Link: https://patch.msgid.link/20260318070403.1634706-2-devendra.verma@amd.com Signed-off-by: Vinod Koul commit 132e47b783a8057a8eb14484f153b417de00c1cb Author: Colin Ian King Date: Tue Mar 17 20:49:38 2026 +0000 dt-bindings: dmaengine: Fix spelling mistake "Looongson" -> "Looogson" There is a spelling mistake in the title field. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Binbin Zhou Link: https://patch.msgid.link/20260317204938.120729-1-colin.i.king@gmail.com Signed-off-by: Vinod Koul commit 4a2759a3ae10bb2e6465cfb01c16d0620a1bc7ab Author: Colin Ian King Date: Tue Mar 17 20:46:31 2026 +0000 dmaengine: loongson: Fix spelling mistake "Looongson" -> "Looogson" There are a couple of spelling mistakes, one in a comment block and one in a module description. Fix them. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20260317204631.120332-1-colin.i.king@gmail.com Signed-off-by: Vinod Koul commit c1f955437440f92632e2efca4b591371bb3caefc Author: Damien Le Moal Date: Mon Mar 16 20:40:20 2026 +0900 xfs: avoid unnecessary calculations in xfs_zoned_need_gc() If zonegc_low_space is set to zero (which is the default), the second condition in xfs_zoned_need_gc() that triggers GC never evaluates to true because the calculated threshold will always be 0. So there is no need to calculate the threshold and to evaluate that condition. Return early when zonegc_low_space is zero. While at it, add comments to document the intent of each of the 3 tests used to determine the return value to control the execution of garbage collection. Signed-off-by: Damien Le Moal Reviewed-by: Hans Holmberg Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 68aa101bf2046aa8365333a3768cece07975ca5f Author: Damien Le Moal Date: Mon Mar 16 20:40:19 2026 +0900 xfs: display more zone related information in mountstats Modify xfs_zoned_show_stats() to add to the information displayed with /proc/self/mountstats the total number of zones (RT groups) and the number of open zones together with the maximum number of open zones. Signed-off-by: Damien Le Moal Reviewed-by: Hans Holmberg Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 6a82a691b08070ad03b237d7db89aa0bfef389e2 Author: Damien Le Moal Date: Mon Mar 16 20:40:18 2026 +0900 xfs: fix a comment typo in xfs_select_zone_nowait() Fix a typo in the comment describing the second call to xfs_select_open_zone_lru() in xfs_select_zone_nowait(). Signed-off-by: Damien Le Moal Reviewed-by: Hans Holmberg Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 770323d418ed5848cc21af172f77377b2cc0542d Author: Damien Le Moal Date: Mon Mar 16 20:40:17 2026 +0900 xfs: avoid unnecessary open zone check in xfs_select_zone_nowait() When xfs_select_zone_nowait() is called with pack_tight equal to true, the function xfs_select_open_zone_mru() is called if no open zone is returned by xfs_select_open_zone_lru(), that is, when oz is NULL. The open zone pointer return of xfs_select_zone_nowait() is then checked, but this check is outside of the "if (pack_tight)" that trigered the call to xfs_select_open_zone_mru(). In other word, this check is unnecessarily done even when pack_tight is false. Move the check for the return value of the call to xfs_select_open_zone_mru() inside the if that controls the call to this function, so that we do not uselessly test again the value of oz when pack_tight is false. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Hans Holmberg Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit e4ffa98a02f4d16eda9a5faec6792493b41dab35 Author: Bartosz Golaszewski Date: Thu Feb 26 15:36:15 2026 +0100 arm64: Kconfig: provide a top-level switch for Microchip platforms Microchip is the only platform that doesn't have a top-level switch for disabling all SoC families. Align it with other platforms and update the arm64 defconfig to keep the default config the same. Signed-off-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260226143615.65788-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Claudiu Beznea commit 1735858caa4bbb8b923860c0833d463b5d9c5f79 Author: Josh Poimboeuf Date: Wed Mar 18 09:38:38 2026 +0100 objtool/x86: Reorder ORC register numbering Reorder the ORC register values so their ordering matches the x86 instruction set register encodings. No functional change intended. Suggested-by: Peter Zijlstra Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) commit 96f3b16a9de552538b810f773645d43f3b661b50 Author: Josh Poimboeuf Date: Mon Mar 16 17:47:56 2026 -0700 objtool: Support Clang RAX DRAP sequence Recent Clang can use RAX as a temporary register for the DRAP stack alignment sequence. Add support for that. Fixes the following warning: vmlinux.o: error: objtool: vmw_host_printf+0xd: unknown CFA base reg 0 Closes: https://lore.kernel.org/cefefdd1-7b82-406d-8ff4-e4b167e45ee6@app.fastmail.com Reported-by: Arnd Bergmann Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/3f33dc720b83dc6d3a2b7094f75a5c90a0b1cbc5.1773708458.git.jpoimboe@kernel.org commit 01478f356ff794c7676803c7af04eaeaebfbb455 Author: Carlos Maiolino Date: Tue Mar 10 18:36:49 2026 +0100 xfs: opencode xfs_zone_record_blocks We only have a single caller, no need to keep it in its own function. Signed-off-by: Carlos Maiolino [hch: add zone_record_blocks trace back] Reviewed-by: Christoph Hellwig Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit fe7171d0d5dfbe189e41db99580ebacafc3c09ce Author: K Prateek Nayak Date: Thu Mar 12 04:44:34 2026 +0000 sched/fair: Simplify SIS_UTIL handling in select_idle_cpu() Use the "sd_llc" passed to select_idle_cpu() to obtain the "sd_llc_shared" instead of dereferencing the per-CPU variable. Since "sd->shared" is always reclaimed at the same time as "sd" via call_rcu() and update_top_cache_domain() always ensures a valid "sd->shared" assignment when "sd_llc" is present, "sd_llc->shared" can always be dereferenced without needing an additional check. While at it move the cpumask_and() operation after the SIS_UTIL bailout check to avoid unnecessarily computing the cpumask. Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Chen Yu Reviewed-by: Shrikanth Hegde Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Link: https://patch.msgid.link/20260312044434.1974-10-kprateek.nayak@amd.com commit f1320a8dd8ba6518ddb53ea4e3efcb49dc41d257 Author: K Prateek Nayak Date: Thu Mar 12 04:44:33 2026 +0000 sched/fair: Simplify the entry condition for update_idle_cpu_scan() Only the topmost SD_SHARE_LLC domain has the "sd->shared" assigned. Simply use "sd->shared" as an indicator for load balancing at the highest SD_SHARE_LLC domain in update_idle_cpu_scan() instead of relying on llc_size. Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Chen Yu Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Link: https://patch.msgid.link/20260312044434.1974-9-kprateek.nayak@amd.com commit fa6874dfeee06352ce7c4c271be6a25d84a38b54 Author: K Prateek Nayak Date: Thu Mar 12 04:44:32 2026 +0000 sched/fair: Remove superfluous rcu_read_lock() in the wakeup path select_task_rq_fair() is always called with p->pi_lock held and IRQs disabled which makes it equivalent of an RCU read-side. Since commit 71fedc41c23b ("sched/fair: Switch to rcu_dereference_all()") switched to using rcu_dereference_all() in the wakeup path, drop the explicit rcu_read_{lock,unlock}() in the fair task's wakeup path. Future plans to reuse select_task_rq_fair() / find_energy_efficient_cpu() in the fair class' balance callback will do so with IRQs disabled and will comply with the requirements of rcu_dereference_all() which makes this safe keeping in mind future development plans too. Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Link: https://patch.msgid.link/20260312044434.1974-8-kprateek.nayak@amd.com commit 8ca12326f592f7554acf2788ecb1c5c954dcf31c Author: Dietmar Eggemann Date: Mon Mar 16 00:36:22 2026 +0100 PM: EM: Switch to rcu_dereference_all() in wakeup path em_cpu_energy() is part of the EAS (Fair) task wakeup path. Now that rcu_read_{,un}lock() have been removed from find_energy_efficient_cpu() switch to rcu_dereference_all() and check for rcu_read_lock_any_held() in em_cpu_energy() as well. In EAS (Fair) task wakeup path is a preempt/IRQ disabled region, so rcu_read_{,un}lock() can be removed. Signed-off-by: Dietmar Eggemann Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Link: https://patch.msgid.link/5b1228b7-5949-4a45-9f62-e8ce936de694@arm.com commit f494bfb04615119f31dbd3222c9d39fea3817d40 Author: K Prateek Nayak Date: Thu Mar 12 04:44:31 2026 +0000 sched/core: Check for rcu_read_lock_any_held() in idle_get_state() Similar to commit 71fedc41c23b ("sched/fair: Switch to rcu_dereference_all()"), switch to checking for rcu_read_lock_any_held() in idle_get_state() to allow removing superfluous rcu_read_lock() regions in the fair task's wakeup path where the pi_lock is held and IRQs are disabled. Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Link: https://patch.msgid.link/20260312044434.1974-7-kprateek.nayak@amd.com commit 10febd397591d93f42adb743c2c664041e7f1bcb Author: K Prateek Nayak Date: Thu Mar 12 04:44:30 2026 +0000 sched/topology: Remove sched_domain_shared allocation with sd_data Now that "sd->shared" assignments are using the sched_domain_shared objects allocated with s_data, remove the sd_data based allocations. Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Valentin Schneider Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Link: https://patch.msgid.link/20260312044434.1974-6-kprateek.nayak@amd.com commit bb7a5e44fc6f3d5a252d95c48d057d5beccb8b35 Author: K Prateek Nayak Date: Thu Mar 12 04:44:29 2026 +0000 sched/topology: Switch to assigning "sd->shared" from s_data Use the "sched_domain_shared" object allocated in s_data for "sd->shared" assignments. Assign "sd->shared" for the topmost SD_SHARE_LLC domain before degeneration and rely on the degeneration path to correctly pass down the shared object to "sd_llc". sd_degenerate_parent() ensures degenerating domains must have the same sched_domain_span() which ensures 1:1 passing down of the shared object. If the topmost SD_SHARE_LLC domain degenerates, the shared object is freed from destroy_sched_domain() when the last reference is dropped. claim_allocations() NULLs out the objects that have been assigned as "sd->shared" and the unassigned ones are freed from the __sds_free() path. To keep all the claim_allocations() bits in one place, claim_allocations() has been extended to accept "s_data" and iterate the domains internally to free both "sched_domain_shared" and the per-topology-level data for the particular CPU in one place. Post cpu_attach_domain(), all reclaims of "sd->shared" are handled via call_rcu() on the sched_domain object via destroy_sched_domains_rcu(). Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Link: https://patch.msgid.link/20260312044434.1974-5-kprateek.nayak@amd.com commit 1cc8a33ca7e8d38f962b64ece2a42c411a67bc76 Author: K Prateek Nayak Date: Thu Mar 12 04:44:28 2026 +0000 sched/topology: Allocate per-CPU sched_domain_shared in s_data The "sched_domain_shared" object is allocated for every topology level in __sdt_alloc() and is freed post sched domain rebuild if they aren't assigned during sd_init(). "sd->shared" is only assigned for SD_SHARE_LLC domains and out of all the assigned objects, only "sd_llc_shared" is ever used by the scheduler. Since only "sd_llc_shared" is ever used, and since SD_SHARE_LLC domains never overlap, allocate only a single range of per-CPU "sched_domain_shared" object with s_data instead of doing it per topology level. The subsequent commit uses the degeneration path to correctly assign the "sd->shared" to the topmost SD_SHARE_LLC domain. No functional changes are expected at this point. Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Valentin Schneider Reviewed-by: Chen Yu Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Link: https://patch.msgid.link/20260312044434.1974-4-kprateek.nayak@amd.com commit 5a7b576b3ec1acc2694c5b58f80cd1d44a11b2c1 Author: K Prateek Nayak Date: Thu Mar 12 04:44:27 2026 +0000 sched/topology: Extract "imb_numa_nr" calculation into a separate helper Subsequent changes to assign "sd->shared" from "s_data" would necessitate finding the topmost SD_SHARE_LLC to assign shared object to. This is very similar to the "imb_numa_nr" computation loop except that "imb_numa_nr" cares about the first domain without the SD_SHARE_LLC flag (immediate parent of sd_llc) whereas the "sd->shared" assignment would require sd_llc itself. Extract the "imb_numa_nr" calculation into a helper adjust_numa_imbalance() and use the current loop in the build_sched_domains() to find the sd_llc. While at it, guard the call behind CONFIG_NUMA's status since "imb_numa_nr" only makes sense on NUMA enabled configs with SD_NUMA domains. No functional changes intended. Suggested-by: Valentin Schneider Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Link: https://patch.msgid.link/20260312044434.1974-3-kprateek.nayak@amd.com commit 8e8e23dea43e64ddafbd1246644c3219209be113 Author: K Prateek Nayak Date: Thu Mar 12 04:44:26 2026 +0000 sched/topology: Compute sd_weight considering cpuset partitions The "sd_weight" used for calculating the load balancing interval, and its limits, considers the span weight of the entire topology level without accounting for cpuset partitions. For example, consider a large system of 128CPUs divided into 8 * 16CPUs partition which is typical when deploying virtual machines: [ PKG Domain: 128CPUs ] [Partition0: 16CPUs][Partition1: 16CPUs] ... [Partition7: 16CPUs] Although each partition only contains 16CPUs, the load balancing interval is set to a minimum of 128 jiffies considering the span of the entire domain with 128CPUs which can lead to longer imbalances within the partition although balancing within is cheaper with 16CPUs. Compute the "sd_weight" after computing the "sd_span" considering the cpu_map covered by the partition, and set the load balancing interval, and its limits accordingly. For the above example, the balancing intervals for the partitions PKG domain changes as follows: before after balance_interval 128 16 min_interval 128 16 max_interval 256 32 Intervals are now proportional to the CPUs in the partitioned domain as was intended by the original formula. Fixes: cb83b629bae03 ("sched/numa: Rewrite the CONFIG_NUMA sched domain support") Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Shrikanth Hegde Reviewed-by: Chen Yu Reviewed-by: Valentin Schneider Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Link: https://patch.msgid.link/20260312044434.1974-2-kprateek.nayak@amd.com commit d7729643942325933508274f0392b749ca74f7cc Author: Marc Zyngier Date: Tue Mar 17 19:42:52 2026 +0000 tracing: Restore accidentally removed SPDX tag Restore the SPDX tag that was accidentally dropped. Fixes: 7e4b6c94300e3 ("tracing: add more symbols to whitelist") Reported-by: Nathan Chancellor Cc: Arnd Bergmann Cc: Vincent Donnefort Cc: Steven Rostedt Reviewed-by: Steven Rostedt (Google) Link: https://patch.msgid.link/20260317194252.1890568-1-maz@kernel.org Signed-off-by: Marc Zyngier commit b8303880b641fa12db4e752b19f1b5160f0fa965 Author: Rafael J. Wysocki Date: Sat Mar 14 12:54:58 2026 +0100 Input: atlas - convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the ACPI Atlas button driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3429591.aeNJFYEL58@rafael.j.wysocki Signed-off-by: Dmitry Torokhov commit 466e75d48038af252187855058a7a9312db9d2f8 Author: Umesh Nerlige Ramappa Date: Thu Mar 12 05:53:09 2026 -0700 drm/xe/lrc: Fix uninitialized new_ts when capturing context timestamp Getting engine specific CTX TIMESTAMP register can fail. In that case, if the context is active, new_ts is uninitialized. Fix that case by initializing new_ts to the last value that was sampled in SW - lrc->ctx_timestamp. Flagged by static analysis. v2: Fix new_ts initialization (Ashutosh) Fixes: bb63e7257e63 ("drm/xe: Avoid toggling schedule state to check LRC timestamp in TDR") Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Ashutosh Dixit Link: https://patch.msgid.link/20260312125308.3126607-2-umesh.nerlige.ramappa@intel.com commit 70729af783af1d66944918b33e5b345b500a5399 Merge: 1c0714c7458d3b 8cde3c87039b2a Author: Jakub Kicinski Date: Tue Mar 17 20:32:11 2026 -0700 Merge branch 'net-stmmac-clean-up-descriptor-handling-part-1' Russell King says: ==================== net: stmmac: clean up descriptor handling part 1 Part 1 of cleaning up the stmmac descriptor handling. Rearrange the struct stmmac_tx_info to pack better, and introduce helpers for duplicated code handing the transmit and receive descriptors. Remove unnecessary struct members that are only transitorily used. ==================== Link: https://patch.msgid.link/abUtGH9KB03PH5Ne@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 8cde3c87039b2a468d7e39ed6927403ce42fe55e Author: Russell King (Oracle) Date: Sat Mar 14 09:43:36 2026 +0000 net: stmmac: use queue rather than ->queue_index We use a lot of ->queue_index where we already have the queue / channel index (which are actually the same index), which has been used to get the queue struct. Since queue and queue_index are identical in priv->(tx|rx)_queue[queue]->queue_index there is no point using the queue_index where we already have queue. Use queue rather than queue_index. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LWy-0000000DGT8-2Hoc@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0da7809235d9cc34de71c9c5bf5028cc3034f806 Author: Russell King (Oracle) Date: Sat Mar 14 09:43:31 2026 +0000 net: stmmac: remove tx_tail_addr There is only one place where tx_q->tx_tail_addr is used - the new stmmac_set_queue_tx_tail_ptr(). Make this a local variable and remove it from struct stmmac_tx_queue. This commit does not change the semantics - the hardware relies upon the descriptor ring not crossing a 4GiB boundary as the high address bits are programmed into a separate register via stmmac_init_tx_chan(). Hence, truncating the DMA address to 32-bit is fine as the register it will be programmed into is 32-bit, and the high bits are handled elsewhere. Also change the type of desc_size to size_t, as this variable is initialised from sizeof(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LWt-0000000DGT2-1oeO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b2fd52d90b8a1daeb6d44583bada7baad82b3c98 Author: Russell King (Oracle) Date: Sat Mar 14 09:43:26 2026 +0000 net: stmmac: add helper to set transmit tail pointer Setting the queue transmit tail pointer follows a common pattern: calculate the DMA address, and then call stmmac_set_tx_tail_ptr(). The only difference between all the call sites is the index used. Factor this out into a static function. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LWo-0000000DGSw-1MCe@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 2c3525ad09e937e58ad6c78b9257af7d41bf3ab0 Author: Russell King (Oracle) Date: Sat Mar 14 09:43:21 2026 +0000 net: stmmac: add helper to get size of a transmit descriptor Add and use a helper to get the size of the hardware transmit descriptor. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LWj-0000000DGSp-0lhO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c493261de1c4c295c7dab8e59e58069a14d47e42 Author: Russell King (Oracle) Date: Sat Mar 14 09:43:16 2026 +0000 net: stmmac: add helper to get hardware transmit descriptor Provide a helper to get the hardware transmit descriptor that takes account of whether extended format and TBS are being used, returning the base struct dma_desc pointer. This avoids multiple instances where these tests are open coded. We need to update dwmac4_display_ring() to cope the passed head pointer always pointing at the struct dma_desc by using dma_desc_to_edesc() to convert it to struct dma_edesc. This is the only stmmac_display_ring() implementation that this affects. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LWe-0000000DGSj-0KtE@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 337191f37748ee9cf986c8154d32209241495d8b Author: Russell King (Oracle) Date: Sat Mar 14 09:43:10 2026 +0000 net: stmmac: simplify stmmac_set_queue_rx_buf_size() Clean up the new stmmac_set_queue_rx_buf_size() to simplify the code. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LWY-0000000DGSd-49H6@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a32734d25d870e4b6d3a9de87dd6e82b27c6d914 Author: Russell King (Oracle) Date: Sat Mar 14 09:43:05 2026 +0000 net: stmmac: add helper to set receive buffer size There are three sites that configure the hardware for the receive buffer size using the same logic to determine the buffer size. Add a helper so there is only one copy of this code. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LWT-0000000DGSX-3fxc@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0b3d090314372055e0c5544be1f781e988859198 Author: Russell King (Oracle) Date: Sat Mar 14 09:43:00 2026 +0000 net: stmmac: use consistent tests for receive buffer size Two out of the three sites that set the receive buffer size (via stmmac_set_dma_bfsize()) check for rx_q->xsk_pool && rx_q->buf_alloc_num. One uses just rx_q->xsk_pool. Discussing with Yoong Siang Song, the conclusion is that stmmac_dma_operation_mode() is missing the rx_q->buf_alloc_num check. Add this check. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LWO-0000000DGSR-3CaB@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit bea37bda7f75c552e0ddddec2d04c3c7c6222208 Author: Russell King (Oracle) Date: Sat Mar 14 09:42:55 2026 +0000 net: stmmac: remove rx_tail_addr There is only one place where rx_q->rx_tail_addr is used - the new stmmac_set_queue_rx_tail_ptr(). Make this a local variable and remove it from struct stmmac_rx_queue. This commit does not change the semantics - the hardware relies upon the descriptor ring not crossing a 4GiB boundary as the high address bits are programmed into a separate register via stmmac_init_rx_chan(). Hence, truncating the DMA address to 32-bit is fine as the register it will be programmed into is 32-bit, and the high bits are handled elsewhere. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LWJ-0000000DGSL-2jWd@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e9d0cafa9d60738ab396aa4b68d7e40c0855b4db Author: Russell King (Oracle) Date: Sat Mar 14 09:42:50 2026 +0000 net: stmmac: add helper to set receive tail pointer Setting the queue receive tail pointer follows a common pattern: calculate the DMA address, and then call stmmac_set_rx_tail_ptr(). The only difference between all the call sites is the index used. Factor this out into a static function, and add a comment about why it only uses the normal descriptor size. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LWE-0000000DGSF-2Hbs@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 4f6280c450ba699e3b700f1cbc4ff8dbc70f3c96 Author: Russell King (Oracle) Date: Sat Mar 14 09:42:45 2026 +0000 net: stmmac: add helper to get size of a receive descriptor Add and use a helper to get the size of the hardware receive descriptor. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LW9-0000000DGS9-1mzX@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ee1b6a94ba1246e505e2411080f23afb29e03425 Author: Russell King (Oracle) Date: Sat Mar 14 09:42:40 2026 +0000 net: stmmac: add helper to get hardware receive descriptor Provide a helper to get a hardware receive descriptor that takes account of whether extended format is being used, but returning the base struct dma_desc pointer. This avoids multiple instances where this is open coded. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LW4-0000000DGS3-1J49@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ee19df4d3bb7a207db813aaa0b2f26a1f1841a69 Author: Russell King (Oracle) Date: Sat Mar 14 09:42:35 2026 +0000 net: stmmac: clean up stmmac_clear_rx_descriptors() The two paths calling stmmac_init_rx_desc() are identical apart from the way the pointer to the descriptor is fetched. Split this out. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LVz-0000000DGRx-0v9B@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a4b1590ee0f09b20cc8551b0c81f38e4739e93f2 Author: Russell King (Oracle) Date: Sat Mar 14 09:42:30 2026 +0000 net: stmmac: helpers for filling tx_q->tx_skbuff_dma Add helpers to fill in the transmit queue metadata to ensure that all entries are initialised when preparing to transmit. This avoids clean up code running into surprises. For example, stmmac_clean_desc3() (which calls clean_desc3() in chain_mode.c or ring_mode.c) looks at the .last_segment, and in the latter case, .is_jumbo members. AI believes that there is a missing .buf_type assignment in stmmac_tso_xmit(), but this is a mis-analysis. AI believes that stmmac_tso_allocator() which would increment tx_q->cur_tx will be called within the loop when nfrags is zero, but it's failing to realise that none of the code within the for() loop will be executed. In any case, at the point where the loop exits, tx_q->tx_skbuff_dma[tx_q->cur_tx].buf_type has been correctly set via the call to stmmac_set_tx_skb_dma_entry() - either the one before the loop, or the one at the end of the loop block. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LVu-0000000DGRr-0Ni3@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 12b4b16c0c7ed6a4b98cfbec7c4ee69e94973334 Author: Russell King (Oracle) Date: Sat Mar 14 09:42:24 2026 +0000 net: stmmac: rearrange stmmac_tx_info members to pack better Rearrange the struct stmmac_tx_info members to pack better, essentially by sorting by type size: xsk_meta embeds only a pointer - 32 or 64 bit buf dma address, 32 or 64 bit len normally 32 bit buf_type dependent on arch map_as_page normally 8 bit last_segment normally 8 bit is_jumbo normally 8 bit Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w1LVo-0000000DGRl-44lt@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1c0714c7458d3bf436ae7061e22bb2349f153261 Merge: 6829f90906aaed 25e7553a502b92 Author: Jakub Kicinski Date: Tue Mar 17 20:18:43 2026 -0700 Merge branch 'riscv-spacemit-add-ethernet-support-for-k3' Inochi Amaoto says: ==================== riscv: spacemit: Add ethernet support for K3 Add initial support for ethernet controller of the Spacemit K3 SoC. This ethernet controller is almost a standard Synopsys DesignWare MAC (version 5.40a). This controller require a syscon device to configure some basic features, like interface type and internal delay. ==================== Link: https://patch.msgid.link/20260316010041.164360-1-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit 25e7553a502b92b08b67d40d1ac71e6cded3d5d1 Author: Inochi Amaoto Date: Mon Mar 16 09:00:40 2026 +0800 MAINTAINERS: add entry for SpacemiT DWMAC glue layer Add a MAINTAINERS entry for the SpacemiT DWMAC glue layer driver and its DT binding. Signed-off-by: Inochi Amaoto Link: https://patch.msgid.link/20260316010041.164360-5-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit 30f0ba420ed3fb9a16d55523ae3c1b43a6f00e22 Author: Inochi Amaoto Date: Mon Mar 16 09:00:39 2026 +0800 net: stmmac: Add glue layer for Spacemit K3 SoC The ethernet controller on Spacemit K3 SoC is Synopsys DesignWare MAC (version 5.40a), with the following special points: 1. The rate of the tx clock line is auto changed when the mac speed rate is changed, and no need for changing the input tx clock. 2. This controller require a extra syscon device to configure the interface type, enable wake up interrupt and delay configuration if needed. Add Spacemit dwmac driver support on the Spacemit K3 SoC. Signed-off-by: Inochi Amaoto Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260316010041.164360-4-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit d35aa97ea908a17809358a981bef6cd752f2e8a0 Author: Inochi Amaoto Date: Mon Mar 16 09:00:38 2026 +0800 net: stmmac: platform: Add snps,dwmac-5.40a IP compatible string Add compatible string for 5.40a version that can avoid to define some platform data in the glue layer. Signed-off-by: Inochi Amaoto Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260316010041.164360-3-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit bb30400a566c7a6a9355873344ec63e2c6310e2c Author: Inochi Amaoto Date: Mon Mar 16 09:00:37 2026 +0800 dt-bindings: net: Add support for Spacemit K3 dwmac The GMAC IP on Spacemit K3 is almost a standard Synopsys DesignWare MAC (version 5.40a) with some extra clock. Add necessary compatible string for this device. Signed-off-by: Inochi Amaoto Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260316010041.164360-2-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit 0fb03890d18205ec0909fc47049eceae8ba36457 Author: Suraj Kandpal Date: Mon Mar 16 08:48:51 2026 +0530 drm/i915/backlight: Check if VESA backlight is possible Check if BACKLIGHT_BRIGHTNESS_AUX_SET_CAPABLE bit is set then EDP_PWMGEN_BIT_COUNT_CAP_MIN and EDP_PWMGEN_BIT_COUNT_CAP_MAX follow the eDP 1.4b Section 10.3. Which states min should be >= 1 and max should be >= min. Some legacy panels do not follow this properly. They set the BACKLIGHT_BRIGHTNESS_AUX_SET_CAPABLE bit while not correctly populating the min and max fields leading to a 0 max value. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7514 Fixes: 40d2f5820951 ("drm/i915/backlight: Remove try_vesa_interface") Signed-off-by: Suraj Kandpal Reviewed-by: Pranay Samala Link: https://patch.msgid.link/20260316031850.81794-1-suraj.kandpal@intel.com commit 6829f90906aaed1e4781742b96822031d5c2bd85 Author: Rafael J. Wysocki Date: Sat Mar 14 12:43:33 2026 +0100 ptp: vmw: Convert to a platform driver In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the PTP VMware ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Simon Horman Link: https://patch.msgid.link/12883468.O9o76ZdvQC@rafael.j.wysocki Signed-off-by: Jakub Kicinski commit eb9744e2c5d06e7007f47dd5853f7c50be189176 Merge: bb8539e0e60916 acee049a6af2a7 Author: Jakub Kicinski Date: Tue Mar 17 19:05:14 2026 -0700 Merge branch 'dpll-zl3073x-refactor-state-management' Ivan Vecera says: ==================== dpll: zl3073x: refactor state management This series refactors the zl3073x DPLL driver to centralize hardware state management behind dedicated per-module state interfaces, replacing scattered direct register accesses in dpll.c with cached state and proper accessor functions. The driver already uses a fetch/get/set pattern for ref, out, and synth modules. This series extends and refines that pattern: First, struct_group() is applied to the existing ref, out, and synth structures to partition fields into cfg (mutable configuration), inv (invariants set at init), and stat (read-only status) groups. This enables group-level memcmp for short-circuit checks and bulk copies in state_set, and adds invariant validation guards. A ref_state_update() helper is extracted to encapsulate the per-reference monitor status register read, keeping direct register access behind the ref module interface. A new zl3073x_chan module is introduced following the same pattern, caching the DPLL channel mode_refsel register with inline getters and setters. The refsel_mode and forced_ref fields are removed from struct zl3073x_dpll in favor of the cached channel state. The chan module is then extended with cached mon_status and refsel_status registers, converting lock_status_get and selected_ref_get from direct HW reads to cached state lookups refreshed by the periodic worker. Reference priority registers are cached in the chan cfg group, removing the ad-hoc ref_prio_get/set functions and the redundant pin->selectable flag, which is now derived from the cached priority. The selected_ref_set function is inlined into input_pin_state_on_dpll_set, unifying all mode paths through a single chan_state_set commit point. Finally, selected_ref_get is dropped entirely since the refsel_status register provides the selected reference regardless of mode, and connected_ref_get is simplified to a direct refsel_state check. ==================== Link: https://patch.msgid.link/20260315174224.399074-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit acee049a6af2a7b4baabd28f16fb53628ea6e7a5 Author: Ivan Vecera Date: Sun Mar 15 18:42:24 2026 +0100 dpll: zl3073x: drop selected and simplify connected ref getter The HW reports the currently selected reference in the dpll_refsel_status register regardless of the DPLL mode. Use this to delete zl3073x_dpll_selected_ref_get() and have callers read the register directly via the cached channel state. Simplify zl3073x_dpll_connected_ref_get() to check refsel_state for LOCK directly and return the reference index, changing the return type from int to u8. The redundant ref_is_status_ok check is removed since the DPLL cannot be in LOCK state with a failed reference. In zl3073x_dpll_mode_set(), replace the selected_ref_get() call with zl3073x_chan_refsel_ref_get() to read the currently selected reference directly from the cached channel state. Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260315174224.399074-7-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit f6b075bc3ad545d1c91e181c3f8ea6193d01602f Author: Ivan Vecera Date: Sun Mar 15 18:42:23 2026 +0100 dpll: zl3073x: add reference priority to zl3073x_chan Cache the ZL_REG_DPLL_REF_PRIO registers in the zl3073x_chan cfg group. These mailbox-based registers store per-reference priority values (4 bits each, P/N packed) used for automatic reference selection. Add ref_prio[] array to struct zl3073x_chan and provide inline helpers zl3073x_chan_ref_prio_get(), zl3073x_chan_ref_prio_set(), and zl3073x_chan_ref_is_selectable() for nibble-level access and priority queries. Extend state_fetch and state_set with DPLL mailbox operations to read and write the priority registers. Replace the ad-hoc zl3073x_dpll_ref_prio_get/set functions in dpll.c with the cached state pattern, removing direct mailbox access from the DPLL layer. This also simplifies pin registration since reading priority from cached state cannot fail. Remove the pin->selectable flag from struct zl3073x_dpll_pin and derive the selectable state from the cached ref priority via zl3073x_chan_ref_is_selectable(), eliminating a redundant cache. Inline zl3073x_dpll_selected_ref_set() into zl3073x_dpll_input_pin_state_on_dpll_set(), unifying all manual and automatic mode paths to commit changes through a single zl3073x_chan_state_set() call at the end of the function. Move hardware limit constants from core.h to regs.h so that chan.h can reference ZL3073X_NUM_REFS for the ref_prio array size. Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260315174224.399074-6-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 41bab554d7e9840e17e4c8c7e93647161c6596bf Author: Ivan Vecera Date: Sun Mar 15 18:42:22 2026 +0100 dpll: zl3073x: add DPLL channel status fields to zl3073x_chan Add mon_status and refsel_status fields to struct zl3073x_chan in a stat group to cache the 'dpll_mon_status' and 'dpll_refsel_status' registers. Add zl3073x_chan_lock_state_get(), zl3073x_chan_is_ho_ready(), zl3073x_chan_refsel_state_get() and zl3073x_chan_refsel_ref_get() inline helpers for reading cached state, and zl3073x_chan_state_update() for refreshing both registers from hardware. Call it from zl3073x_chan_state_fetch() as well so that channel status is initialized at device startup. Call zl3073x_dev_chan_states_update() from the periodic work to keep the cached state up to date and convert zl3073x_dpll_lock_status_get() and zl3073x_dpll_selected_ref_get() to use the cached state via the new helpers instead of direct register reads. Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260315174224.399074-5-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 3032e95987fa0da656ce3a5eb454674e7cc60a12 Author: Ivan Vecera Date: Sun Mar 15 18:42:21 2026 +0100 dpll: zl3073x: introduce zl3073x_chan for DPLL channel state Extract DPLL channel state management into a dedicated zl3073x_chan module, following the pattern already established by zl3073x_ref, zl3073x_out and zl3073x_synth. The new struct zl3073x_chan caches the raw mode_refsel register value in a cfg group with inline getters and setters to extract and update the bitfields. Three standard state management functions are provided: - zl3073x_chan_state_fetch: read the mode_refsel register from HW - zl3073x_chan_state_get: return cached channel state - zl3073x_chan_state_set: write changed state to HW, skip if unchanged The channel state array chan[ZL3073X_MAX_CHANNELS] is added to struct zl3073x_dev. Channel state is fetched as part of zl3073x_dev_state_fetch, using the chip-specific channel count. The refsel_mode and forced_ref fields are removed from struct zl3073x_dpll and all direct register accesses in dpll.c are replaced with the new chan state operations. Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260315174224.399074-4-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 05ea2ab3b10075e8fcfcd5e283e486df7055de5e Author: Ivan Vecera Date: Sun Mar 15 18:42:20 2026 +0100 dpll: zl3073x: add zl3073x_ref_state_update helper Extract the per-reference monitor status HW read into a dedicated zl3073x_ref_state_update() helper in the ref module. Rename zl3073x_dev_ref_status_update() to zl3073x_dev_ref_states_update() and use the new helper in it. Call it from zl3073x_ref_state_fetch() as well so that mon_status is initialized at device startup. This keeps direct register access and struct field writes behind the ref module's interface, consistent with the state management pattern used for other ref operations. Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260315174224.399074-3-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit f327f5a8115e80d954598cf2d5c461873042b7f6 Author: Ivan Vecera Date: Sun Mar 15 18:42:19 2026 +0100 dpll: zl3073x: use struct_group to partition states Organize the zl3073x_out, zl3073x_ref, and zl3073x_synth structures using struct_group() to partition fields into semantic groups: * cfg: mutable configuration written to HW via state_set * inv: invariant fields set once during state_fetch * stat: read-only status This enables group-level operations in place of field-by-field copies: * state_set validates invariants haven't changed (WARN_ON + -EINVAL) * state_set short-circuits when cfg is unchanged * state_set copy entire groups in a single assignment instead of enumerating each field Add kernel doc for zl3073x_out_state_set and zl3073x_ref_state_set documenting the new invariant validation and short-circuit semantics. Remove forward declaration of zl3073x_synth_state_set(). Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260315174224.399074-2-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 77378dabb50f593c756d393d8eacb0b91b758863 Author: Maciej Fijalkowski Date: Mon Mar 16 15:05:57 2026 +0100 xsk: use __xsk_rcv_zc_safe for ZC multi-buffer Rx processing Commit f620af11c27b ("xsk: avoid double checking against rx queue being full") addressed a case in copy mode, when working with multi-buffer xdp_buff, where we were peeking onto XSK Rx queue twice, to find out if there is a space to produce descriptors. Adjust ZC path to follow the same principle. Signed-off-by: Maciej Fijalkowski Acked-by: Stanislav Fomichev Acked-by: Jakub Kicinski Reviewed-by: Jason Xing Link: https://lore.kernel.org/r/20260316140557.461288-1-maciej.fijalkowski@intel.com Signed-off-by: Alexei Starovoitov commit 643893647cac7317bafca4040dd0cfb815b510d4 Author: Qu Wenruo Date: Tue Mar 17 18:36:34 2026 +1030 block: reject zero length in bio_add_page() The function bio_add_page() returns the number of bytes added to the bio, and if that failed it should return 0. However there is a special quirk, if a caller is passing a page with length 0, that function will always return 0 but with different results: - The page is added to the bio If there is enough bvec slot or the folio can be merged with the last bvec. The return value 0 is just the length passed in, which is also 0. - The page is not added to the bio If the page is not mergeable with the last bvec, or there is no bvec slot available. The return value 0 means page is not added into the bio. Unfortunately the caller is not able to distinguish the above two cases, and will treat the 0 return value as page addition failure. In that case, this can lead to the double releasing of the last page: - By the bio cleanup Which normally goes through every page of the bio, including the last page which is added into the bio. - By the caller Which believes the page is not added into the bio, thus would manually release the page. I do not think anyone should call bio_add_folio()/bio_add_page() with zero length, but idiots like me can still show up. So add an extra WARN_ON_ONCE() check for zero length and rejects it early to avoid double freeing. Signed-off-by: Qu Wenruo Link: https://patch.msgid.link/bc2223c080f38d0b63f968f605c918181c840f40.1773734749.git.wqu@suse.com Signed-off-by: Jens Axboe commit 3141e0e536b43ab3555737cb2ee6ea1ed0aff69f Author: Thomas Weißschuh Date: Mon Mar 16 23:43:54 2026 +0100 blk-mq: make blk_mq_hw_ctx_sysfs_entry instances const The blk_mq_hw_ctx_sysfs_entry structures are never modified, mark them as const. Signed-off-by: Thomas Weißschuh Reviewed-by: John Garry Link: https://patch.msgid.link/20260316-b4-sysfs-const-attr-block-v1-4-a35d73b986b0@weissschuh.net Signed-off-by: Jens Axboe commit f00d826f1b8ee39a4e9283f2eb537f5b49e07829 Author: Thomas Weißschuh Date: Mon Mar 16 23:43:53 2026 +0100 blk-crypto: make blk_crypto_attr instances const The blk_crypto_attrs structures are never modified, mark them as const. Signed-off-by: Thomas Weißschuh Reviewed-by: John Garry > Link: https://patch.msgid.link/20260316-b4-sysfs-const-attr-block-v1-3-a35d73b986b0@weissschuh.net Signed-off-by: Jens Axboe commit 3c9122630953520e2a2b6c6a28751da23457e4ef Author: Thomas Weißschuh Date: Mon Mar 16 23:43:52 2026 +0100 block: ia-ranges: make blk_ia_range_sysfs_entry instances const The blk_ia_range_sysfs_entry structures are never modified, mark them as const. Signed-off-by: Thomas Weißschuh Reviewed-by: John Garry Link: https://patch.msgid.link/20260316-b4-sysfs-const-attr-block-v1-2-a35d73b986b0@weissschuh.net Signed-off-by: Jens Axboe commit 223983874d0366ac12d30eab3b633d699bdf763e Author: Thomas Weißschuh Date: Mon Mar 16 23:43:51 2026 +0100 block: make queue_sysfs_entry instances const The queue_sysfs_entry structures are never modified, mark them as const. Signed-off-by: Thomas Weißschuh Reviewed-by: John Garry Link: https://patch.msgid.link/20260316-b4-sysfs-const-attr-block-v1-1-a35d73b986b0@weissschuh.net Signed-off-by: Jens Axboe commit e80fd7a08940093aad5ea247a42046b57709a7bd Author: Christoph Hellwig Date: Mon Mar 16 17:11:31 2026 +0100 block: remove bvec_free bvec_free is only called by bio_free, so inline it there. Signed-off-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni -ck Reviewed-by: Johannes Thumshirn Reviewed-by: Martin K. Petersen Link: https://patch.msgid.link/20260316161144.1607877-4-hch@lst.de Signed-off-by: Jens Axboe commit b520c4eef83dd406591431f936de0908c3ed7fb9 Author: Christoph Hellwig Date: Mon Mar 16 17:11:30 2026 +0100 block: split bio_alloc_bioset more clearly into a fast and slowpath bio_alloc_bioset tries non-waiting slab allocations first for the bio and bvec array, but does so in a somewhat convoluted way. Restructure the function so that it first open codes these slab allocations, and then falls back to the mempools with the original gfp mask. Signed-off-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni -ck Reviewed-by: Martin K. Petersen Link: https://patch.msgid.link/20260316161144.1607877-3-hch@lst.de Signed-off-by: Jens Axboe commit fed406f3c1c2feb97adcbc557218713c5f7ec6a7 Author: Christoph Hellwig Date: Mon Mar 16 17:11:29 2026 +0100 block: mark bvec_{alloc,free} static Only used in bio.c these days. Signed-off-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni -ck Reviewed-by: Johannes Thumshirn Reviewed-by: Martin K. Petersen Link: https://patch.msgid.link/20260316161144.1607877-2-hch@lst.de Signed-off-by: Jens Axboe commit 9aa64d2503c6f5a803ff2990608312e5bdc6b0de Author: Danilo Krummrich Date: Fri Feb 13 23:07:15 2026 +0100 rust: devres: embed struct devres_node directly Currently, the Devres container uses devm_add_action() to register a devres callback. devm_add_action() allocates a struct action_devres, which on top of struct devres_node, just keeps a data pointer and release function pointer. This is an unnecessary indirection, given that analogous to struct devres, the Devres container can just embed a struct devres_node directly without an additional allocation. In contrast to struct devres, we don't need to force an alignment of ARCH_DMA_MINALIGN (as struct devres does to account for the worst case) since we have generics in Rust. I.e. the compiler already ensures correct alignment of the embedded T in Devres. Thus, get rid of devm_add_action() and instead embed a struct devres_node directly. Reviewed-by: Alice Ryhl Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260213220718.82835-6-dakr@kernel.org [ * Improve comment about core::any::type_name(), * add #[must_use] to devres_node_remove(), * use container_of!() in devres_node_free_node(). - Danilo ] Signed-off-by: Danilo Krummrich commit bb8539e0e60916ef3ed4a92eb2f3cfd8e34061ef Author: Qingfang Deng Date: Mon Mar 16 17:28:23 2026 +0800 ppp: require callers of ppp_dev_name() to hold RCU ppp_dev_name() holds the RCU read lock internally to protect pch->ppp. However, as it returns netdev->name to the caller, the caller should also hold either RCU or RTNL lock to prevent the netdev from being freed. The only two references of the function is in the L2TP driver, both of which already hold RCU. So remove the internal RCU lock and document that callers must hold RCU. Signed-off-by: Qingfang Deng Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260316092824.479149-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit 4afc71bba8b7d7841681e7647ae02f5079aaf28f Author: Joe Lawrence Date: Wed Mar 4 20:52:37 2026 -0500 module.lds,codetag: force 0 sh_addr for sections Commit 1ba9f8979426 ("vmlinux.lds: Unify TEXT_MAIN, DATA_MAIN, and related macros") added .text and made .data, .bss, and .rodata sections unconditional in the module linker script, but without an explicit address like the other sections in the same file. When linking modules with ld.bfd -r, sections defined without an address inherit the location counter, resulting in non-zero sh_addr values in the .ko. Relocatable objects are expected to have sh_addr=0 for these sections and these non-zero addresses confuse elfutils and have been reported to cause segmentation faults in SystemTap [1]. Add the 0 address specifier to all sections in module.lds, including the .codetag.* sections via MOD_SEPARATE_CODETAG_SECTIONS macro. Link: https://sourceware.org/bugzilla/show_bug.cgi?id=33958 Fixes: 1ba9f8979426 ("vmlinux.lds: Unify TEXT_MAIN, DATA_MAIN, and related macros") Signed-off-by: Joe Lawrence Reviewed-by: Petr Pavlu Acked-by: Josh Poimboeuf Signed-off-by: Sami Tolvanen commit e3f741f587a9826a82304bb5da021e0fe783795d Author: Kuniyuki Iwashima Date: Mon Mar 16 13:31:25 2026 +0000 fou: Remove IPPROTO_UDPLITE check in gue_err() and gue6_err(). UDP-Lite has been removed, and its error handler is no longer found in either inet_protos[IPPROTO_UDPLITE] or inet6_protos[IPPROTO_UDPLITE]. The recursion fixed by the protocol check in gue_err() and gue6_err() no longer occurs with UDP-Lite. Let's remove the checks. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260316133127.2646421-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 05c1fc56d37b2531b14afac9e76443ed98276923 Author: Daniel Golle Date: Sun Mar 15 15:19:44 2026 +0000 net: phy: mxl-gpy: add PHY-level statistics via ethtool Report PCS receive error counts for all supported GPY115x, GPY2xx and MxL862xx PHYs. Accumulate the vendor-specific PHY_ERRCNT read-clear counter (SEL=RXERR) in .update_stats() and expose it as both IEEE 802.3 SymbolErrorDuringCarrier and generic rx_errors via .get_phy_stats(). Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/0029a2fb29bfdcc26abff828d2e18400067b5c58.1773587924.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit ba424bc2c7bb3a9b81d1b6c773f1e2e7b8fffe66 Author: Danilo Krummrich Date: Fri Feb 13 23:07:14 2026 +0100 devres: rename and export set_node_dbginfo() Rename set_node_dbginfo() to devres_set_node_dbginfo() and export it through base.h, such that we can access is from the Rust devres code. Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260213220718.82835-5-dakr@kernel.org Signed-off-by: Danilo Krummrich commit b1081ef74d804ae1c512151c2610b79513a52cd6 Author: Danilo Krummrich Date: Fri Feb 13 23:07:13 2026 +0100 devres: add devres_node_remove() When the Rust Devres container type is dropped we need a way to remove the embedded struct devres_node from the device's node list. Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260213220718.82835-4-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 9738ca7df98f37b647c6a2f5ac5dfe49db03c948 Author: Danilo Krummrich Date: Fri Feb 13 23:07:12 2026 +0100 devres: export devres_node_init() and devres_node_add() Export devres_node_init() and devres_node_add() through base.h, such that we can access is from the Rust devres code. Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260213220718.82835-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 31b5733bcdef139719c990a86cd98bac07a5597c Author: Danilo Krummrich Date: Fri Feb 13 23:07:11 2026 +0100 devres: move struct devres_node into base.h Move struct devres_node into base.h, such that we can access it from the Rust devres code. Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260213220718.82835-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit c321a511e37c3aaa16226b3529c30b78f9e380c1 Author: Danilo Krummrich Date: Tue Feb 3 00:48:20 2026 +0100 devres: remove unnecessary unlocks in devres_release_group() There is no need to call spin_unlock_irqrestore() in every conditional block, as release_nodes() can safely be called with an empty list, in case we hit the "if else" or "else" case. We do not use a scoped_guard() here to not unnecessarily change the indentation level. Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260202235210.55176-8-dakr@kernel.org Signed-off-by: Danilo Krummrich commit e19f3fed3c4cd523dffa87f3c2d6837aff538543 Author: Danilo Krummrich Date: Tue Feb 3 00:48:19 2026 +0100 devres: use guard(spinlock_irqsave) where applicable Use guard(spinlock_irqsave)(&dev->devres_lock) where it improves the code. Some places still use manual spin_lock_irqsave() and spin_unlock() as changing it to use a scoped_guard() would result in unnecessary churn. Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260202235210.55176-7-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 55e329d0f7a0a92cf998cc6f20df6e46a4d6ab12 Author: Danilo Krummrich Date: Tue Feb 3 00:48:18 2026 +0100 devres: add free_node callback to struct devres_node Currently, there are three "subclasses" of struct devres_node, which are struct devres, struct devres_group, struct devres_action. release_nodes(), which only knows about the base struct devres_node, assumes that for all "subclasses" struct devres_node is the first member in the structure and calls kfree() on struct devres_node. While this technically works, we can still improve semantical correctness and type safety with a corresponding free_node() callback. Additionally, we will need this callback soon in the Rust Devres code, to allocate and free the required memory on the Rust side. Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260202235210.55176-6-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 2b5c6a14b5b4326916ef20b39eea3564ad786e9f Author: Danilo Krummrich Date: Tue Feb 3 00:48:17 2026 +0100 devres: don't require ARCH_DMA_MINALIGN for devres actions Currently, devres actions are allocated with devres_alloc(), which allocates a struct devres with a flexible array member for the actual data of the resource. The flexible array member is aligned to ARCH_DMA_MINALIGN, which is wasteful for devres actions that only need to store a struct action_devres. Introduce struct devres_action to handle devres actions separately from struct devres, analogous to what we do for struct devres_group. Speaking of which, without this patch struct devres_group is treated as struct devres in release_nodes(). While this is not an actual bug, as release callbacks for devres nodes in struct devres_group are empty functions anyways, it is a bit messy and can be confusing. (Note that besides devres actions, the Rust devres code will also make use of this. The Rust compiler can figure out the correct alignment of T in Devres itself, i.e. no need to force a minimum alignment.) Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260202235210.55176-5-dakr@kernel.org [ Add missing node->release check in devres_for_each_res() and find_dr(); use kzalloc_obj(). - Danilo ] Signed-off-by: Danilo Krummrich commit 7a60fe48af206d34571e446d685672f5730a6b90 Author: Eric Biggers Date: Wed Mar 11 22:39:33 2026 -0700 ima: remove buggy support for asynchronous hashes IMA computes hashes using the crypto_shash or crypto_ahash API. The latter is used only when ima.ahash_minsize is set on the command line, and its purpose is ostensibly to make the hash computation faster. However, going off the CPU to a crypto engine and back again is actually quite slow, especially compared with the acceleration that is built into modern CPUs and the kernel now enables by default for most algorithms. Typical performance results for SHA-256 on a modern platform can be found at https://lore.kernel.org/linux-crypto/20250615184638.GA1480@sol/ Partly for this reason, several other kernel subsystems have already dropped support for the crypto_ahash API. The other problem with crypto_ahash is that bugs are also common, not just in the underlying drivers, but also in the code using it, since it is very difficult to use correctly. Just from a quick review, here are some of the bugs I noticed in IMA's ahash code: - [Use after free] ima_alloc_atfm() isn't thread-safe and can trigger a use-after-free if multiple threads try to initialize the global ima_ahash_tfm at the same time. - [Deadlock] If only one buffer is allocated and there is an error reading from the file, then ahash_wait() is executed twice, causing a deadlock in wait_for_completion(). - [Crash or incorrect hash computed] calc_buffer_ahash_atfm() is sometimes passed stack buffers which can be vmalloc addresses, but it puts them in a scatterlist assuming they are linear addresses. This causes the hashing to be done on the wrong physical address. - [Truncation to 32-bit length] ima_alloc_pages() incorrectly assumes an loff_t value fits in an unsigned long. calc_buffer_ahash_atfm() incorrectly assumes that a loff_t value fits in an unsigned int. So, not exactly a great track record so far, even disregarding driver bugs which are an even larger problem. Fortunately, in practice it's unlikely that many users are actually setting the ima.ahash_minsize kernel command-line parameter which enables this code. However, given that this code is almost certainly no longer useful (if it ever was), let's just remove it instead of attempting to fix all these issues. Signed-off-by: Eric Biggers Acked-by: Dmitry Kasatkin Signed-off-by: Mimi Zohar commit b099ed598c64c8d275fc8877ec521b58712ab103 Author: Viacheslav Dubeyko Date: Tue Mar 17 15:14:00 2026 -0700 hfsplus: fix to update ctime after rename [BUG] $ sudo ./check generic/003 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 graphic 6.8.0-58-generic #60~22.04.1-Ubuntu MKFS_OPTIONS -- /dev/loop29 MOUNT_OPTIONS -- /dev/loop29 /mnt/scratch generic/003 - output mismatch --- tests/generic/003.out 2025-04-27 08:49:39.876945323 -0600 +++ /home/graphic/fs/xfstests-dev/results//generic/003.out.bad QA output created by 003 +ERROR: change time has not been updated after changing file1 Silence is golden ... Ran: generic/003 Failures: generic/003 Failed 1 of 1 tests [CAUSE] change time has not been updated after changing file1 [FIX] Update file ctime after rename in hfsplus_rename(). Signed-off-by: Yangtao Li Tested-by: Viacheslav Dubeyko Reviewed-by: Viacheslav Dubeyko Link: https://lore.kernel.org/linux-fsdevel/20250530081719.2430291-1-frank.li@vivo.com/ Signed-off-by: Viacheslav Dubeyko commit 4ff57c5e8dbba23b5457be12f9709d5c016da16e Author: Ashutosh Dixit Date: Thu Mar 12 22:36:30 2026 -0700 drm/xe/oa: Allow reading after disabling OA stream Some OA data might be present in the OA buffer when OA stream is disabled. Allow UMD's to retrieve this data, so that all data till the point when OA stream is disabled can be retrieved. v2: Update tail pointer after disable (Umesh) Fixes: efb315d0a013 ("drm/xe/oa/uapi: Read file_operation") Cc: stable@vger.kernel.org Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Link: https://patch.msgid.link/20260313053630.3176100-1-ashutosh.dixit@intel.com commit daf9f9dd509113d6f49ce7c00d92bc17db58f215 Author: Lijo Lazar Date: Tue Mar 17 16:38:00 2026 +0530 drm/amdgpu: Add client ids for gmcv9 mmhubs Initialize client ids for gmcv9 mmhubs Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 35362833df056fff0eaf9da132619243e013f1a3 Author: Lijo Lazar Date: Tue Mar 17 13:39:56 2026 +0530 drm/amdgpu: Add client ids for mmhub v2.x Initialize client ids for mmhub v2.x Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 642fb9e14c63aa00809ba38b5da090da1238558d Author: Lijo Lazar Date: Tue Mar 17 13:22:05 2026 +0530 drm/amdgpu: Add client ids for mmhub v3.x Initialize client ids for mmhub v3.x Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit f2eceeef689c859b17d19dd9077b7e902b09fdc9 Author: Lijo Lazar Date: Tue Mar 17 13:11:18 2026 +0530 drm/amdgpu: Add client ids for mmhub v4.x Initialize client ids for mmhub v4.x Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 3baa07dcfa51ff8d801d4566d6a7199834a73614 Author: Lijo Lazar Date: Tue Mar 17 13:03:53 2026 +0530 drm/amdgpu: Add client id helpers to mmhub Add data structure and helpers to get client id data of mmhub. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 6e9d61769b2b65e414fa9996da2b544a9eb45df5 Author: Harry Wentland Date: Tue Mar 17 13:04:51 2026 -0400 Revert "drm/amd/display: Add NV12/P010 formats to primary plane" With this change we're adding NV12 and P010 twice to reported formats on a primary plane, which causes us to hit an assert in Weston. This reverts commit 63fff551318f5e0814b94f709a6dfaec789dcd7a. Fixes: 63fff551318f ("drm/amd/display: Add NV12/P010 formats to primary plane") Signed-off-by: Harry Wentland Reviewed-by: Leo Li Signed-off-by: Alex Deucher commit 4fce3dfab54d60ebaff1c7a9020a730a0708b705 Author: Srinivasan Shanmugam Date: Thu Mar 12 18:53:59 2026 +0530 drm/amdgpu: Remove dead negative offset check in amdgpu_virt_init_critical_region() amdgpu_virt_init_critical_region() stores init_hdr_offset as u64. The subsequent check for init_hdr_offset < 0 is therefore always false. Drop the unreachable validation and rely on the existing check_add_overflow() and VRAM end bounds check for offset validation. This resolves the Smatch warning about comparing an unsigned value against zero. drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c:953 amdgpu_virt_init_critical_region() warn: unsigned 'init_hdr_offset' is never less than zero. Fixes: 07009df6494d ("drm/amdgpu: Introduce SRIOV critical regions v2 during VF init") Cc: Dan Carpenter Cc: Ellen Pan Cc: Lijo Lazar Cc: Alex Deucher Cc: Christian König Signed-off-by: Srinivasan Shanmugam Reviewed-by: Bokun Zhang Reviewed-by: Ellen Pan Signed-off-by: Alex Deucher commit a1c1c77d30cd497ad6dd6062f8a5c06b38a45132 Author: Srinivasan Shanmugam Date: Thu Mar 12 20:34:48 2026 +0530 drm/amdgpu: Move amdgpu_vm_is_bo_always_valid() before first use Smatch reports that 'bo' could be NULL in amdgpu_vm_bo_update(), even though amdgpu_vm_is_bo_always_valid() already checks for a NULL BO. Move amdgpu_vm_is_bo_always_valid() earlier in the file so the helper definition appears before its first use. This allows static analysis tools to see the NULL check performed by the helper and avoids the warning. Suggested-by: Tvrtko Ursulin Cc: Dan Carpenter Cc: Tvrtko Ursulin Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Tvrtko Ursulin Signed-off-by: Alex Deucher commit 9a62a097a7f8d223d722b9e9b557a792d30600ca Author: Srinivasan Shanmugam Date: Sun Mar 15 12:42:42 2026 +0530 drm/amdgpu: Drop redundant queue NULL check in hang detect worker amdgpu_userq_hang_detect_work() retrieves the queue pointer using container_of() from the embedded work item. Since the work structure is part of struct amdgpu_usermode_queue, the returned queue pointer cannot be NULL in normal execution. Remove the redundant !queue check and keep the validation for queue->userq_mgr. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c:159 amdgpu_userq_hang_detect_work() warn: can 'queue' even be NULL? Fixes: 290f46cf5726 ("drm/amdgpu: Implement user queue reset functionality") Cc: Jesse Zhang Cc: Dan Carpenter Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Acked-by: Jesse Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit a53676efc44a6265dee4cef44ef8b0c9079886ef Author: Mangesh Gadre Date: Sun Mar 1 15:19:13 2026 +0000 drm/amdgpu : Update psp 13_0_15 ip block support Included psp_13_0_15 ip block for RAS Signed-off-by: Mangesh Gadre Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit a1371d9f0e611ef40cd31b02565e2325701c1d82 Author: Christian König Date: Thu Jan 29 12:29:26 2026 +0100 drm/amdgpu: rework amdgpu_userq_wait_ioctl v4 Lockdep was complaining about a number of issues here. Especially lock inversion between syncobj, dma_resv and copying things into userspace. Rework the functionality. Split it up into multiple functions, consistenly use memdup_array_user(), fix the lock inversions and a few more bugs in error handling. v2: drop the dma_fence leak fix, turned out that was actually correct, just not well documented. Apply some more cleanup suggestion from Tvrtko. v3: rebase on already done cleanups v4: add missing dma_fence_put() in error path. Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit 2c192b06f1e6bd9f770138a55b26c4ea04246e2f Author: Christian König Date: Wed Jan 28 16:07:03 2026 +0100 drm/amdgpu: fix adding eviction fence We can't add the eviction fence without validating the BO. Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit 99f30a0607c6161309613b714e14470f5fc7ce41 Author: Christian König Date: Fri Jan 30 16:46:36 2026 +0100 drm/amdgpu: fix eviction fence and userq manager shutdown That is a really complicated dance and wasn't implemented fully correct. Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit 2cd7284ba54b22869c301fba7aff9ec96a12f8c0 Author: Christian König Date: Wed Jan 28 13:58:14 2026 +0100 drm/amdgpu: completely rework eviction fence handling v2 Well that was broken on multiple levels. First of all a lot of checks were placed at incorrect locations, especially if the resume worker should run or not. Then a bunch of code was just mid-layering because of incorrect assignment who should do what. And finally comments explaining what happens instead of why. Just re-write it from scratch, that should at least fix some of the hangs we are seeing. Use RCU for the eviction fence pointer in the manager, the spinlock usage was mostly incorrect as well. Then finally remove all the nonsense checks and actually add them in the correct locations. v2: some typo fixes and cleanups suggested by Sunil Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit 87327658c848f56eac166cb382b57b83bf06c5ac Author: Alex Deucher Date: Mon Sep 25 10:44:06 2023 -0400 drm/radeon: apply state adjust rules to some additional HAINAN vairants They need a similar workaround. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839 Signed-off-by: Alex Deucher commit 0de31d92a173d3d94f28051b0b80a6c98913aed4 Author: Alex Deucher Date: Mon Sep 25 10:44:07 2023 -0400 drm/amdgpu: apply state adjust rules to some additional HAINAN vairants They need a similar workaround. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839 Signed-off-by: Alex Deucher commit 69c5fbd2b93b5ced77c6e79afe83371bca84c788 Author: Alex Deucher Date: Mon Mar 16 11:04:46 2026 -0400 drm/amdgpu: rework how we handle TLB fences Add a new VM flag to indicate whether or not we need a TLB fence. Userqs (KFD or KGD) require a TLB fence. A TLB fence is not strictly required for kernel queues, but it shouldn't hurt. That said, enabling this unconditionally should be fine, but it seems to tickle some issues in KIQ/MES. Only enable them for KFD, or when KGD userq queues are enabled (currently via module parameter). Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4798 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4749 Fixes: f3854e04b708 ("drm/amdgpu: attach tlb fence to the PTs update") Cc: Christian König Cc: Prike Liang Reviewed-by: Prike Liang Signed-off-by: Alex Deucher commit 855e3e19f69c0133a98dfae3ec9d26089cd50e77 Author: Sonny Jiang Date: Wed Jan 21 17:56:36 2026 -0500 drm/amdgpu: Add JPEG_v5_0_2 IP block Add support for JPEG_5_0_2 v2: comment out RAS for now (Alex) v3: drop some bringup leftovers (Alex) Signed-off-by: Sonny Jiang Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 3663c6e4a367f04cecf96ece58db3a0fc700658b Author: Sonny Jiang Date: Fri Jan 23 11:08:35 2026 -0500 drm/amdgpu: Set VCN_5_0_2 DPG mode Set DPG flag for VCN_5_0_2 Signed-off-by: Sonny Jiang Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 2eb660e626d6a47e1798e7951bb6823530b3751a Author: Sonny Jiang Date: Thu Jan 22 13:23:48 2026 -0500 drm/amdgpu: Add VCN_5_0_2 codecs capabilities support Support VCN_5_0_2 codec query Signed-off-by: Sonny Jiang Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 8433398c789c02860343393397a456c4d883568b Author: Sonny Jiang Date: Wed Jan 21 10:02:11 2026 -0500 drm/amdgpu: Add VCN v5_0_2 Add support for VCN_5_0_2 v2: squash in RRMT enable bit fix from Sonny (Alex) v3: sqaush in doorbell enablement patch (Alex) v4: drop some bringup leftovers (Alex) Signed-off-by: Sonny Jiang Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 49b4b0c6af391f89353e57120272015cdc1cbff5 Author: Asad Kamal Date: Sat Jan 31 18:05:31 2026 +0800 drm/amd/pm: Add mutex lock for metrics table Add metrics table mutex lock in smu table context struct Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 076190257839c21c6d27d030d0e071d5ff5e89a3 Author: Asad Kamal Date: Sun Nov 30 19:45:28 2025 +0800 drm/amd/pm: Update pm attributes Update pm attributes show/hide for gc_v12_1_0 v2: Use multi-aid check (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 7e490a22d47acbcd854ac3af62abb1a9409a68b6 Author: Asad Kamal Date: Wed Jan 28 16:30:01 2026 +0800 drm/amd/pm: Add fru eeprom info support Add fru eeprom info support for smu_v15_0_8 Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 2b8101cc3b34d4d80d799360d2744829d5964479 Author: Srinivasan Shanmugam Date: Sun Mar 15 11:29:41 2026 +0530 drm/amd/ras: Fix NULL deref in ras_core_get_utc_second_timestamp() ras_core_get_utc_second_timestamp() retrieves the current UTC timestamp (in seconds since the Unix epoch) through a platform-specific RAS system callback and is used for timestamping RAS error events. The function checks ras_core in the conditional statement before calling the sys_fn callback. However, when the condition fails, the function prints an error message using ras_core->dev. If ras_core is NULL, this can lead to a potential NULL pointer dereference when accessing ras_core->dev. Add an early NULL check for ras_core at the beginning of the function and return 0 when the pointer is not valid. This prevents the dereference and makes the control flow clearer. Fixes: 13c91b5b4378 ("drm/amd/ras: Add rascore unified interface function") Cc: YiPeng Chai Cc: Dan Carpenter Cc: Tao Zhou Cc: Hawking Zhang Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher commit 79253d6fe1cc80938160be2625d270fe5a4252ee Author: Krzysztof Kozlowski Date: Tue Mar 17 14:33:26 2026 +0100 PCI: rpaphp: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Helgaas Reviewed-by: Jonathan Cameron Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20260317133322.266102-8-krzysztof.kozlowski@oss.qualcomm.com commit c4cac4a15c6e7a6f9517a2ddc9dc8d7d0d1aa11c Author: Krzysztof Kozlowski Date: Tue Mar 17 14:33:25 2026 +0100 PCI: pnv_php: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Helgaas Reviewed-by: Jonathan Cameron Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20260317133322.266102-7-krzysztof.kozlowski@oss.qualcomm.com commit d1a09195866890ed4b407bf17879d2f7fa72d9a7 Author: Dmitry Antipov Date: Tue Mar 17 17:11:35 2026 +0300 securityfs: use kstrdup_const() to manage symlink targets Since 'target' argument of 'securityfs_create_symlink()' is (for now at least) a compile-time constant, it may be reasonable to use 'kstrdup_const()' / 'kree_const()' to manage 'i_link' member of the corresponding inode in attempt to reuse .rodata instance rather than making a copy. Signed-off-by: Dmitry Antipov Signed-off-by: Paul Moore commit 25854131c04a5aa25a41cf527aab269aadb86699 Author: Lizhi Hou Date: Mon Mar 16 21:49:06 2026 -0700 accel/amdxdna: Support retrieving hardware context debug information The firmware implements the GET_APP_HEALTH command to collect debug information for a specific hardware context. When a command times out, the driver issues this command to collect the relevant debug information. User space tools can also retrieve this information through the hardware context query IOCTL. Reviewed-by: Mario Limonciello Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260317044906.1513133-1-lizhi.hou@amd.com commit f41b075492355c60d87ddd66371dcdb1ae9c484e Author: Jens Axboe Date: Tue Mar 17 14:28:44 2026 -0600 io_uring: avoid req->ctx reload in io_req_put_rsrc_nodes() Cache 'ctx' to avoid it needing to get potentially reloaded. Signed-off-by: Jens Axboe commit 3e97c2582f8450117dfa14cc672437afb31233a0 Author: Jens Axboe Date: Tue Mar 17 14:21:58 2026 -0600 io_uring/rw: use cached file rather than req->file In io_rw_init_file(), req->file is cached in file, yet the former is still being used when checking for O_DIRECT. As this is post setting the kiocb flags, the compiler has to reload req->file. Just use the locally cached file instead. Signed-off-by: Jens Axboe commit 0a6b9ae1f314c92141b851fcbc2f7b4d0cd2e340 Author: Jens Axboe Date: Tue Mar 17 14:18:04 2026 -0600 io_uring/net: use 'ctx' consistently There's already a local ctx variable, use it for the io_is_compat() check as well. Signed-off-by: Jens Axboe commit 74dbc0bab57b7e5b4adbc93ce9179e0f36079e4c Author: Jens Axboe Date: Tue Mar 17 14:10:19 2026 -0600 io_uring/poll: cache req->apoll_events Avoid a potential reload of ->apoll_events post vfs_poll() by caching it in a local variable. Signed-off-by: Jens Axboe commit 6fe9d3b942d2d18eee35ac9b0b3443d4caabefb6 Author: Danilo Krummrich Date: Tue Feb 3 00:48:16 2026 +0100 devres: add devres_node_init() Both alloc_dr() and devres_open_group() initialize devres_node.entry and set devres_node.release. Add a helper, devres_node_init(), for this pattern. Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260202235210.55176-4-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 4796dfd7e0e845de5e76b1748d3c022d350f1b57 Author: Danilo Krummrich Date: Tue Feb 3 00:48:15 2026 +0100 devres: add devres_node_add() Both devres_add() and devres_open_group() acquire the devres_lock and call add_dr(). Add a helper, devres_node_add(), for this pattern. Use guard(spinlock_irqsave) to avoid the explicit unlock call and local flag variables. Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260202235210.55176-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit f813ec9e84b4d0ca81ec1da94ab07bfb4a29266c Author: Danilo Krummrich Date: Tue Feb 3 00:48:14 2026 +0100 devres: fix missing node debug info in devm_krealloc() Fix missing call to set_node_dbginfo() for new devres nodes created by devm_krealloc(). Fixes: f82485722e5d ("devres: provide devm_krealloc()") Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260202235210.55176-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 49c21d9a5fcd83b717f2f543734ca15e36d0189e Author: Jens Axboe Date: Tue Mar 17 14:03:54 2026 -0600 io_uring/kbuf: use 'ctx' consistently There's already a local ctx variable, yet the ring lock and unlock helpers use req->ctx. use ctx consistently. Signed-off-by: Jens Axboe commit 702c1d56c7177a0481abd2814bab9495f1150967 Author: Vidya Sagar Date: Wed Feb 25 19:08:01 2026 +0530 PCI/CXL: Hide SBR from reset_methods if masked by CXL Per CXL r3.1, sec 8.1.5.2, the Secondary Bus Reset (SBR) bit in the Bridge Control register of a CXL port has no effect unless the "Unmask SBR" bit in the Port Control Extensions Register is set. After b1956e2d0713 ("PCI/CXL: Fail bus reset if upstream CXL Port has SBR masked"), Linux checks the "Unmask SBR" bit in pci_reset_bus_function(). But when probe==true, it previously returned 0, incorrectly indicating that SBR is a viable reset method for the device. As a result, "bus" is listed in the device's "reset_method" attribute even though the hardware is incapable of performing it. If a user writes "bus" to "reset_method" or triggers a reset that falls back to SBR, the operation fails with "write error: Inappropriate ioctl for device". If the link is operating in CXL mode (pcie_is_cxl()), return -ENOTTY immediately unless "Unmask SBR" is set, regardless of the probe argument. This ensures that "bus" is not advertised in "reset_methods" when the hardware prevents it, improving clarity for users and aligning the sysfs capability report with actual hardware behavior. Signed-off-by: Vidya Sagar [bhelgaas: commit log, use pcie_is_cxl()] Signed-off-by: Bjorn Helgaas Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260225133801.30231-1-vidyas@nvidia.com commit d19ab42867ae7c68be84ed957d95712b7934773f Merge: 76bce7ac516736 79cf41692aadc3 Author: Danilo Krummrich Date: Tue Mar 17 20:13:16 2026 +0100 Merge tag 'rust_io-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core into drm-rust-next Register abstraction and I/O infrastructure improvements Introduce the register!() macro to define type-safe I/O register accesses. Refactor the IoCapable trait into a functional trait, which simplifies I/O backends and removes the need for overloaded Io methods. This is a stable tag for other trees to merge. Signed-off-by: Danilo Krummrich commit de25dc008ea74bc6f33b8d6e773e51a920813fdc Merge: dc33ae50d32b50 79cf41692aadc3 Author: Danilo Krummrich Date: Tue Mar 17 20:11:03 2026 +0100 Merge tag 'rust_io-7.1-rc1' into driver-core-next Register abstraction and I/O infrastructure improvements Introduce the register!() macro to define type-safe I/O register accesses. Refactor the IoCapable trait into a functional trait, which simplifies I/O backends and removes the need for overloaded Io methods. This is a stable tag for other trees to merge. Signed-off-by: Danilo Krummrich commit 79cf41692aadc3d0ac9b1d8e2c2f620ce2103918 Author: Alexandre Courbot Date: Sat Mar 14 10:06:19 2026 +0900 sample: rust: pci: use `register!` macro Convert the direct IO accesses to properly defined registers. Tested-by: Zhi Wang Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20260314-register-v9-9-86805b2f7e9d@nvidia.com [ Fix up kernel import style. - Danilo ] Signed-off-by: Danilo Krummrich commit 9a52a8f5ed97d47c9641248874f4c6a78e136d97 Author: Alexandre Courbot Date: Sat Mar 14 10:06:18 2026 +0900 rust: io: introduce `write_reg` and `LocatedRegister` Some I/O types, like fixed address registers, carry their location alongside their values. For these types, the regular `Io::write` method can lead into repeating the location information twice: once to provide the location itself, another time to build the value. We are also considering supporting making all register values carry their full location information for convenience and safety. Add a new `Io::write_reg` method that takes a single argument implementing `LocatedRegister`, a trait that decomposes implementors into a `(location, value)` tuple. This allows write operations on fixed offset registers to be done while specifying their name only once. Suggested-by: Danilo Krummrich Link: https://lore.kernel.org/all/DH0XBLXZD81K.22SWIZ1ZAOW1@kernel.org/ Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20260314-register-v9-8-86805b2f7e9d@nvidia.com [ Replace FIFO with VERSION register in the examples. - Danilo ] Signed-off-by: Danilo Krummrich commit 20ba6a1dbcb957152f6d858015b3a3311dd6da49 Author: Alexandre Courbot Date: Sat Mar 14 10:06:17 2026 +0900 rust: io: add `register!` macro Add a macro for defining hardware register types with I/O accessors. Each register field is represented as a `Bounded` of the appropriate bit width, ensuring field values are never silently truncated. Fields can optionally be converted to/from custom types, either fallibly or infallibly. The address of registers can be direct, relative, or indexed, supporting most of the patterns in which registers are arranged. Suggested-by: Danilo Krummrich Link: https://lore.kernel.org/all/20250306222336.23482-6-dakr@kernel.org/ Co-developed-by: Gary Guo Signed-off-by: Gary Guo Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20260314-register-v9-7-86805b2f7e9d@nvidia.com [ * Improve wording and formatting of doc-comments, * Import build_assert!(), * Add missing inline annotations, * Call static_assert!() with absolute path, * Use expect instead of allow. - Danilo ] Signed-off-by: Danilo Krummrich commit 147b41ba23d63f43ed34e6940417a5506e323370 Author: Alexandre Courbot Date: Sat Mar 14 10:06:16 2026 +0900 rust: io: use generic read/write accessors for primitive accesses By providing the required `IoLoc` implementations on `usize`, we can leverage the generic accessors and reduce the number of unsafe blocks in the module. This also allows us to directly call the generic `read/write/update` methods with primitive types, so add examples illustrating this. Signed-off-by: Alexandre Courbot Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260314-register-v9-6-86805b2f7e9d@nvidia.com [ Slightly improve wording in doc-comment. - Danilo ] Signed-off-by: Danilo Krummrich commit 498823541be1e2d9f947b37a10cc98e681da9828 Author: Alexandre Courbot Date: Sat Mar 14 10:06:15 2026 +0900 rust: io: add IoLoc type and generic I/O accessors I/O accesses are defined by the following properties: - An I/O location, which consists of a start address, a width, and a type to interpret the read value as, - A value, which is returned for reads or provided for writes. Introduce the `IoLoc` trait, which allows implementing types to fully specify an I/O location. This allows I/O operations to be made generic through the new `read` and `write` methods. This design will allow us to factorize the I/O code working with primitives, and to introduce ways to perform I/O with a higher degree of control through register types. Co-developed-by: Gary Guo Signed-off-by: Gary Guo Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20260314-register-v9-5-86805b2f7e9d@nvidia.com [ Fix incorrect reference to io_addr_assert() in try_update(). - Danilo ] Signed-off-by: Danilo Krummrich commit 7836ec76ec5cd8d45759a6a360b1fda4829d2734 Author: Alexandre Courbot Date: Sat Mar 14 10:06:14 2026 +0900 rust: num: make Bounded::get const There is a need to access the inner value of a `Bounded` in const context, notably for bitfields and registers. Remove the invariant check of `Bounded::get`, which allows us to make it const. Reviewed-by: Gary Guo Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20260314-register-v9-4-86805b2f7e9d@nvidia.com Signed-off-by: Danilo Krummrich commit 164f8634bfd8eef7b90c429156c59706635cfb88 Author: Alexandre Courbot Date: Sat Mar 14 10:06:13 2026 +0900 rust: num: add `into_bool` method to `Bounded` Single-bit numbers are typically treated as booleans. There is an `Into` implementation for those, but invoking it from contexts that lack type expectations is not always convenient. Add an `into_bool` method as a simpler shortcut. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Reviewed-by: Daniel Almeida Reviewed-by: Yury Norov Tested-by: Dirk Behme Acked-by: Miguel Ojeda Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20260314-register-v9-3-86805b2f7e9d@nvidia.com Signed-off-by: Danilo Krummrich commit c59a2d14cd248c77457b821b15c72e6a6a268553 Author: Alexandre Courbot Date: Sat Mar 14 10:06:12 2026 +0900 rust: num: add `shr` and `shl` methods to `Bounded` Shifting a `Bounded` left or right changes the number of bits required to represent the value. Add methods that perform the shift and return a `Bounded` with the appropriately adjusted bit width. These methods are particularly useful for bitfield extraction. Suggested-by: Alice Ryhl Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Reviewed-by: Daniel Almeida Tested-by: Dirk Behme Acked-by: Miguel Ojeda Acked-by: Yury Norov Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20260314-register-v9-2-86805b2f7e9d@nvidia.com Signed-off-by: Danilo Krummrich commit 3cc319d5f433a4d560cc944ecfb1fe50b866cd66 Author: Alexandre Courbot Date: Sat Mar 14 10:06:11 2026 +0900 rust: enable the `generic_arg_infer` feature This feature is stable since 1.89, and used in subsequent patches. Reviewed-by: Gary Guo Tested-by: Dirk Behme Acked-by: Miguel Ojeda Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20260314-register-v9-1-86805b2f7e9d@nvidia.com [ Resolve merge conflict. - Danilo ] Signed-off-by: Danilo Krummrich commit 6291ee23da4224a7584ece2d292104e872b9b5fc Author: Alexandre Courbot Date: Fri Feb 6 15:00:20 2026 +0900 rust: io: remove overloaded Io methods of Mmio Since `Mmio` now has the relevant implementations of `IoCapable`, the default methods of `Io` can be used in place of the overloaded ones. Remove them as well as the macros generating them. Reviewed-by: Daniel Almeida Acked-by: Alice Ryhl Signed-off-by: Alexandre Courbot Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260206-io-v2-6-71dea20a06e6@nvidia.com Signed-off-by: Danilo Krummrich commit 50aad5510fbbf8dd8f5f63380e1a1e7ae73216c4 Author: Alexandre Courbot Date: Fri Feb 6 15:00:19 2026 +0900 rust: pci: io: remove overloaded Io methods of ConfigSpace Since `ConfigSpace` now has the relevant implementations of `IoCapable`, the default methods of `Io` can be used in place of the overloaded ones. Remove them as well as the macros generating them. Reviewed-by: Daniel Almeida Acked-by: Alice Ryhl Signed-off-by: Alexandre Courbot Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260206-io-v2-5-71dea20a06e6@nvidia.com Signed-off-by: Danilo Krummrich commit e385eb0d1c2c4d2dbc48d1bcbc44fd43cbb154a4 Author: Alexandre Courbot Date: Fri Feb 6 15:00:18 2026 +0900 rust: io: remove legacy relaxed accessors of Mmio The relaxed access functionality is now provided by the `RelaxedMmio` wrapper type, and we don't have any user of the legacy methods left. Remove them. Reviewed-by: Daniel Almeida Acked-by: Alice Ryhl Signed-off-by: Alexandre Courbot Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260206-io-v2-4-71dea20a06e6@nvidia.com Signed-off-by: Danilo Krummrich commit 1d1c5c73d7e8f166b6b55ae06a3c509561b854cd Author: Alexandre Courbot Date: Fri Feb 6 15:00:17 2026 +0900 rust: io: provide Mmio relaxed ops through a wrapper type Relaxed I/O accessors for `Mmio` are currently implemented as an extra set of methods that mirror the ones defined in `Io`, but with the `_relaxed` suffix. This makes these methods impossible to use with generic code, which is a highly plausible proposition now that we have the `Io` trait. Address this by adding a new `RelaxedMmio` wrapper type for `Mmio` that provides its own `IoCapable` implementations relying on the relaxed C accessors. This makes it possible to use relaxed operations on a `Mmio` simply by wrapping it, and to use `RelaxedMmio` in code generic against `Io`. Acked-by: Alice Ryhl Signed-off-by: Alexandre Courbot Reviewed-by: Daniel Almeida Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260206-io-v2-3-71dea20a06e6@nvidia.com [ Use kernel import style in examples. - Danilo ] Signed-off-by: Danilo Krummrich commit 19103d4f93673c804ef82dd797cd2b935d0bf70f Author: Alexandre Courbot Date: Fri Feb 6 15:00:16 2026 +0900 rust: io: mem: use non-relaxed I/O ops in examples The `_relaxed` I/O variant methods are about to be replaced by a wrapper type exposing this access pattern with the regular methods of the `Io` trait. Thus replace the examples to use the regular I/O methods. Since these are examples, we want them to use the most standard ops anyway, and the relaxed variants were but an addition that was MMIO-specific. Reviewed-by: Daniel Almeida Acked-by: Alice Ryhl Signed-off-by: Alexandre Courbot Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260206-io-v2-2-71dea20a06e6@nvidia.com Signed-off-by: Danilo Krummrich commit e2d599021c843d97ee38ba351cb0117eb984e038 Author: Alexandre Courbot Date: Fri Feb 6 15:00:15 2026 +0900 rust: io: turn IoCapable into a functional trait `IoCapable` is currently used as a marker trait to signal that the methods of the `Io` trait corresponding to `T` have been overridden by the implementor (the default implementations triggering a build-time error). This goes against the DRY principle and separates the signaling of the capability from its implementation, making it possible to forget a step while implementing a new `Io`. Another undesirable side-effect is that it makes the implementation of I/O backends boilerplate-y and convoluted: currently this is done using two levels of imbricated macros that generate unsafe code. Fix these issues by turning `IoCapable` into a functional trait that includes the raw implementation of the I/O access for `T` using unsafe methods that work with an arbitrary address. This allows us to turn the default methods of `Io` into regular methods that check the passed offset, turn it into an address, and call into the corresponding `IoCapable` functions, removing the need to overload them at all. `IoCapable` must still be implemented for all supported primitive types, which is still done more concisely using a macro, but this macro becomes much simpler and does not require calling into another one. Reviewed-by: Daniel Almeida Acked-by: Alice Ryhl Signed-off-by: Alexandre Courbot Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260206-io-v2-1-71dea20a06e6@nvidia.com Signed-off-by: Danilo Krummrich commit 4ebaf9d999327ce8e2ea5847ac96fe53fde3fe9a Author: James Calligeros Date: Sat Mar 14 10:27:11 2026 +1000 ASoC: codecs: cs42l84: set up PLL for more sample rates Previously, this driver only advertised support for 48 kHz and 96 kHz sample rates, as there was no PLL configuration data specified for any other sample rate/BCLK. The CS42L84 is an Apple-specific variant of CS42L42. The PLL configuration parameters for a variety of common BCLKs are available in the latter's datasheet. What happens if we just use those? As it turns out, they work just fine. Fill out more PLL config parameters in the PLL config lookup table, and advertise the corresponding sample rates to userspace. This enables 44.1, 88.2, 176.4 and 192 kHz output and input. Signed-off-by: James Calligeros Link: https://patch.msgid.link/20260314-cs42l84-rates-v2-1-ea8a5af52542@gmail.com Signed-off-by: Mark Brown commit c8d0beedf0da06652432354882b95c33a4cb7cfe Merge: 9d4189e68ebad4 58068932402c7f Author: Mark Brown Date: Tue Mar 17 18:07:38 2026 +0000 regulator: fp9931: Make vin-supply mandatory Robby Cai says: The FP9931 regulator requires a valid "vin" supply to operate correctly. Therefore, the driver should treat "vin" as a mandatory supply. This patchset updates the binding documentation to mark vin-supply as a required property, and modifies the driver accordingly. As suggested in the reviews from Andreas and Mark, v2 switches to using devm_regulator_get() since the supply is mandatory. commit 58068932402c7f5bf26489e01ae8e8bb89802d1e Author: Robby Cai Date: Fri Mar 13 21:31:02 2026 +0800 regulator: fp9931: Fix handling of mandatory "vin" supply The FP9931 requires a mandatory "vin" power supply to operate. Replace devm_regulator_get_optional() with devm_regulator_get() to enforce this mandatory dependency. Fixes: 12d821bd13d42 ("regulator: Add FP9931/JD9930 driver") Signed-off-by: Robby Cai Link: https://patch.msgid.link/20260313133102.2749890-3-robby.cai@nxp.com Signed-off-by: Mark Brown commit d342f5e355aaa4ff4fb5bd4a4aab70ed3a4f3c35 Author: Robby Cai Date: Fri Mar 13 21:31:01 2026 +0800 regulator: dt-bindings: fp9931: Make vin-supply property as required The FP9931 requires a vin power supply to operate, so mark vin-supply as a required property in the binding. Fixes: 80bbdefdfb417 ("dt-bindings: regulator: Add Fitipower FP9931/JD9930") Signed-off-by: Robby Cai Link: https://patch.msgid.link/20260313133102.2749890-2-robby.cai@nxp.com Signed-off-by: Mark Brown commit 48718378ab1f80da847930224360f8a1b690a538 Author: Tejun Heo Date: Tue Mar 17 07:51:08 2026 -1000 workqueue: Remove NULL wq WARN in __queue_delayed_work() Remove the WARN_ON_ONCE(!wq) which doesn't serve any useful purpose. Signed-off-by: Tejun Heo commit 8507277ef1326d6854a6445354cd43e93e2b95fa Author: Rafael J. Wysocki Date: Thu Mar 12 15:40:36 2026 +0100 platform/x86: wireless-hotkey: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the airplane mode button for AMD, HP and Xiaomi laptops driver from an ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/9607409.CDJkKcVGEf@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit cfc897f6d3f7e9e284d498cd9fc4c68488166f48 Author: Rafael J. Wysocki Date: Thu Mar 12 15:38:37 2026 +0100 platform/x86: wireless-hotkey: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3953848.kQq0lBPeGt@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 3471415c8186f952b805c441d905d7033c23304a Author: Rafael J. Wysocki Date: Thu Mar 12 15:34:25 2026 +0100 platform/x86: topstar-laptop: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Topstar Laptop ACPI Extras driver from an ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/10834824.nUPlyArG6x@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a15d1839c77884ad08b72fe2e18d8df7b32c5c0f Author: Rafael J. Wysocki Date: Thu Mar 12 15:32:36 2026 +0100 platform/x86: topstar-laptop: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3425557.44csPzL39Z@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f6689792ffc4bc226636a513f8b0ac7bd45c5091 Author: Cheng-Yang Chou Date: Tue Mar 17 23:13:11 2026 +0800 selftests/sched_ext: Show failed test names in summary When tests fail, the runner only printed the failure count, making it hard to tell which tests failed without scrolling through output. Track failed test names in an array and print them after the summary so failures are immediately visible at the end of the run. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 2e5e5b3738ddda91b9a7ee9399efa5245c992233 Author: zhidao su Date: Tue Mar 17 15:52:09 2026 +0800 sched_ext: Fix typos in comments Fix five typos across three files: - kernel/sched/ext.c: 'monotically' -> 'monotonically' (line 55) - kernel/sched/ext.c: 'used by to check' -> 'used to check' (line 56) - kernel/sched/ext.c: 'hardlockdup' -> 'hardlockup' (line 3881) - kernel/sched/ext_idle.c: 'don't perfectly overlaps' -> 'don't perfectly overlap' (line 371) - tools/sched_ext/scx_flatcg.bpf.c: 'shaer' -> 'share' (line 21) Signed-off-by: zhidao su Signed-off-by: Tejun Heo commit 138db7ee58c0c0911fc4f79ccd7c5846f7b9408b Author: Rafael J. Wysocki Date: Thu Mar 12 12:30:27 2026 +0100 platform/x86: sony-laptop: Convert PIC driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Programmable IO Control (pic) part of the Sony laptop driver from an ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2059875.yKVeVyVuyW@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 14004dd31caae2e49791d1ecc8f9ba87478df023 Author: Rafael J. Wysocki Date: Thu Mar 12 12:29:44 2026 +0100 platform/x86: sony-laptop: Convert NC driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Notebook Control (nc) part of the Sony laptop driver from an ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/886676729.0ifERbkFSE@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0f2ca62fdfbcada9568fbc7e27e94e4b3bffbf7a Author: Rafael J. Wysocki Date: Thu Mar 12 12:28:52 2026 +0100 platform/x86: sony-laptop: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2559802.jE0xQCEvom@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2d9cb20610f75ca48c1cac064aede90196787507 Author: Rafael J. Wysocki Date: Thu Mar 12 12:14:47 2026 +0100 platform/x86: lg-laptop: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the LG Gram ACPI features and hotkeys driver from an ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/1868365.VLH7GnMWUR@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c12fe0b2c12195e0d1c56e0f670a6bd792b0567e Author: Rafael J. Wysocki Date: Thu Mar 12 12:14:03 2026 +0100 platform/x86: lg-laptop: Drop debug-only ACPI notify handler To facilitate subsequent conversion of the driver to using struct platform_driver instead of struct acpi_driver, drop the debug-only notify handler method from the driver. No intentional functional impact beyond debug. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3346280.5fSG56mABF@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a469749640fbcd2f49ab05fb83cca3da07f35ee3 Author: Ethan Tidmore Date: Fri Mar 6 21:32:45 2026 -0600 drm/bridge: waveshare-dsi: Fix signedness bug The function drm_of_get_data_lanes_count_ep() returns negative error codes and dsi->lanes is an unsigned integer, so the check (dsi->lanes < 0) is always impossible. Make the return value of drm_of_get_data_lanes_count_ep() be assigned to ret, check for error, and then assign dsi->lanes to ret. Detected by Smatch: drivers/gpu/drm/bridge/waveshare-dsi.c:70 ws_bridge_attach_dsi() warn: unsigned 'dsi->lanes' is never less than zero. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603060341.hNj0pl9L-lkp@intel.com/ Fixes: fca11428425e9 ("drm/bridge: waveshare-dsi: Add support for 1..4 DSI data lanes") Signed-off-by: Ethan Tidmore Reviewed-by: Luca Ceresoli Reviewed-by: Marek Vasut Link: https://patch.msgid.link/20260307033245.71666-1-ethantidmore06@gmail.com Signed-off-by: Luca Ceresoli commit 22fa2ebc11a164e1ea529da6c356e3e01aef8ac8 Author: David E. Box Date: Thu Mar 12 18:51:45 2026 -0700 platform/x86/intel/vsec: Plumb ACPI PMT discovery tables through vsec Some platforms expose PMT discovery via ACPI instead of PCI BARs. Add a generic discovery source flag and carry ACPI discovery entries alongside the existing PCI resource path so PMT clients can consume either. Changes: - Add enum intel_vsec_disc_source { _PCI, _ACPI }. - Extend intel_vsec_platform_info and intel_vsec_device with source enum and ACPI discovery table pointer/ - When src==ACPI, skip BAR resource setup and copy the ACPI discovery entries into the aux device. No user-visible behavior change yet; this only wires ACPI data through vsec in preparation for ACPI-enumerated PMT clients. Signed-off-by: David E. Box Link: https://patch.msgid.link/20260313015202.3660072-7-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a6ce8bf3c993d8c2e8a6aeb2596429c101fe4462 Author: David E. Box Date: Thu Mar 12 18:51:44 2026 -0700 platform/x86/intel/vsec: Return real error codes from registration path Stop collapsing registration results into booleans. Make intel_vsec_walk_header() return int and propagate the first non-zero error from intel_vsec_register_device(). intel_vsec_register() now returns that error directly and 0 on success. This preserves success behavior while surfacing meaningful errors instead of hiding them behind a bool/-ENODEV, which makes debugging and probe ordering issues clearer. Reviewed-by: Ilpo Järvinen Signed-off-by: David E. Box Link: https://patch.msgid.link/20260313015202.3660072-6-david.e.box@linux.intel.com Signed-off-by: Ilpo Järvinen commit 353042d54d82f6c46449f0ee38c244b5a13c1fe4 Author: David E. Box Date: Thu Mar 12 18:51:43 2026 -0700 platform/x86/intel/vsec: Switch exported helpers from pci_dev to device Preparatory refactor for ACPI-enumerated PMT endpoints. Several exported PMT/VSEC interfaces and structs carried struct pci_dev * even though callers only need a generic struct device. Move those to struct device * so the same APIs work for PCI and ACPI parents. Acked-by: Rodrigo Vivi Signed-off-by: David E. Box Link: https://patch.msgid.link/20260313015202.3660072-5-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c62fd96a04e4a7b847448f97ecfe9f3fe706e7b3 Author: David E. Box Date: Thu Mar 12 18:51:42 2026 -0700 platform/x86/intel/vsec: Decouple add/link helpers from PCI This refactor prepares for adding ACPI-enumerated PMT endpoints. While intel_vsec is bound to PCI today, some helpers are used by code that will also register PMT endpoints from non-PCI (ACPI) paths. Clean up PCI-specific plumbing where it isn’t strictly required and rely on generic struct device where possible. Signed-off-by: David E. Box Reviewed-by: Ilpo Järvinen Reviewed-by: Michael J. Ruhl Link: https://patch.msgid.link/20260313015202.3660072-4-david.e.box@linux.intel.com Signed-off-by: Ilpo Järvinen commit 9577c74c96f88d807d1ba005adbf5952e7127e55 Author: David E. Box Date: Thu Mar 12 18:51:41 2026 -0700 platform/x86/intel/vsec: Make driver_data info const Treat PCI id->driver_data (intel_vsec_platform_info) as read-only by making vsec_priv->info a const pointer and updating all function signatures to accept const intel_vsec_platform_info *. This improves const-correctness and clarifies that the platform info data from the driver_data table is not meant to be modified at runtime. No functional changes intended. Signed-off-by: David E. Box Reviewed-by: Michael J. Ruhl Link: https://patch.msgid.link/20260313015202.3660072-3-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 904b333fc51cc045941df9656302449a0fc9978e Author: David E. Box Date: Thu Mar 12 18:51:40 2026 -0700 platform/x86/intel/vsec: Refactor base_addr handling The base_addr field in intel_vsec_platform_info was originally added to support devices that emulate PCI VSEC capabilities in MMIO. Previously, the code would check at registration time whether base_addr was set, falling back to the PCI BAR if not. Refactor this by making base_addr an explicit function parameter. This clarifies ownership of the value and removes conditional logic from intel_vsec_add_dev(). It also enables making intel_vsec_platform_info const in a later patch, since the function no longer needs to write to info->base_addr. No functional change intended. Signed-off-by: David E. Box Reviewed-by: Michael J. Ruhl Link: https://patch.msgid.link/20260313015202.3660072-2-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 27a39e135f5c1ceaf73e64648eccdb42b751d5c7 Author: Kory Maincent (TI) Date: Thu Mar 5 17:39:06 2026 +0100 drm/tilcdc: Fix type mismatch cpu_to_be32() returns a __be32 big-endian value, but the compound literals passed to tilcdc_panel_update_prop() were typed as u32. This causes a sparse type mismatch warning. Fix it by using __be32 as the compound literal type to match the return type of cpu_to_be32(). Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602200130.LjofC7YE-lkp@intel.com/ Fixes: 0ff223d991477 ("drm/tilcdc: Convert legacy panel binding via DT overlay at boot time") Signed-off-by: Kory Maincent (TI) Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260305163907.717719-1-kory.maincent@bootlin.com Signed-off-by: Luca Ceresoli commit 6e4d63e8993c681e1cec7d564b4e018e21e658d0 Author: Eric Biggers Date: Sat Mar 14 10:57:44 2026 -0700 lib/crc: arm64: Drop check for CONFIG_KERNEL_MODE_NEON CONFIG_KERNEL_MODE_NEON is always enabled on arm64, and it always has been since its introduction in 2013. Given that and the fact that the usefulness of kernel-mode NEON has only been increasing over time, checking for this option in arm64-specific code is unnecessary. Remove this check from lib/crc/ to simplify the code and prevent any future bugs where e.g. code gets disabled due to a typo in this logic. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260314175744.30620-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1d3864cf9cac2562d018f080982c231a64dc6cfd Author: Kory Maincent (TI) Date: Thu Mar 5 16:59:19 2026 +0100 drm/tilcdc: Remove tilcdc_panel driver reintroduced by a merge The tilcdc_panel driver was removed by commit 8f1e1ab9c794 ("drm/tilcdc: Remove tilcdc panel driver"), but was inadvertently reintroduced by the merge commit 8b85987d3cf5 ("Merge drm/drm-next into drm-misc-next"). The regression went unnoticed because standard git commands such as 'git show' do not expose the change. It was only spotted via 'git show --stat': git show --stat 8b85987d3cf5 | grep tilcdc drivers/gpu/drm/tilcdc/tilcdc_panel.c | 408 + git show 8b85987d3cf5 | grep tilcdc (no output) Remove tilcdc_panel.c again to restore the previously intended state. Fixes: 8b85987d3cf5 ("Merge drm/drm-next into drm-misc-next") Signed-off-by: Kory Maincent (TI) Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260305155921.659550-1-kory.maincent@bootlin.com Signed-off-by: Luca Ceresoli commit d61686cf10aa7203001d24d86369aa1af4d06319 Author: Eric Biggers Date: Mon Mar 16 13:56:59 2026 -0700 crypto: crc32c - Remove another outdated comment This code just calls crc32c(), which has a number of different implementations, not just the byte-at-a-time table-based one. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260316205659.17936-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 41919521c780699c4a506c394451079b3256cba9 Author: Eric Biggers Date: Sat Mar 14 10:31:30 2026 -0700 crypto: crc32c - Remove more outdated usage information Remove information from the crypto/crc32c.c file comment that is no longer applicable now that nearly all users of CRC-32C are simply using the crc32c() library function instead. This continues the cleanup from commit 0ef6eb10f2e0 ("crypto: Clean up help text for CRYPTO_CRC32C"). Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260314173130.16683-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 44ff3791d6295f7b51dd2711aad6a03dd79aef22 Author: Eric Biggers Date: Sat Mar 14 10:22:24 2026 -0700 kunit: configs: Enable all CRC tests in all_tests.config The new option CONFIG_CRC_ENABLE_ALL_FOR_KUNIT enables all the CRC code that has KUnit tests, causing CONFIG_KUNIT_ALL_TESTS to enable all these tests. Add this option to all_tests.config so that kunit.py will run them when passed the --alltests option. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260314172224.15152-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 3ccc8a922906703cd0efdf1bdd6186f18f7e23ec Author: Jani Nikula Date: Mon Mar 16 14:15:02 2026 +0200 drm/intel: add shared step.h and switch i915 to use it As the first step towards using shared definitions for step name enumerations, add shared include/drm/intel/step.h and switch i915 to use it. Reviewed-by: Luca Coelho Link: https://patch.msgid.link/e76412a316ddff44dc46633d80e9caa5df54ed6b.1773663208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 706d58da4c4b363b5dc3e690d97a05fdf47d2620 Author: Jani Nikula Date: Mon Mar 16 14:15:01 2026 +0200 drm/xe/compat: remove intel_step_name macro As there are no more compat users left for intel_step_name(), remove the macro and use the more direct include for the enumerations. Reviewed-by: Luca Coelho Link: https://patch.msgid.link/816e3f6dda0a112392e8f8ccff820a81aff63f32.1773663208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 58371a116845706ba2b90d3a1e0c9193794ebf06 Author: Jani Nikula Date: Mon Mar 16 14:15:00 2026 +0200 drm/i915/dmc: use step name from runtime info Now that the step name is in runtime info, switch to using it instead of intel_step_name(). The ** are only relevant for DMC, so make their use explicit. Reviewed-by: Luca Coelho Link: https://patch.msgid.link/395906e52e76bc726b9dac69a453583cc6e3f6c1.1773663208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 2ca0e7657f6f18838e396febaf8ca93a762e486a Author: Jani Nikula Date: Mon Mar 16 14:14:59 2026 +0200 drm/i915/display: add step name in display runtime info Initialize the stepping name in display runtime info. This avoids having to use intel_step_name(). For display device info print at boot, debugfs and snapshot this changes the unknown step name from ** to N/A, which is more user friendly anyway. Reviewed-by: Luca Coelho Link: https://patch.msgid.link/aab445dedb8235d9fdddfe2ee5bb624cdf453a18.1773663208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 902d174c6fd30d428337e90ed769a3aa81951983 Author: Jani Nikula Date: Mon Mar 16 14:14:58 2026 +0200 drm/i915/dmc: simplify stepping info initialization Having intel_get_stepping_info() return the pointer that was passed in isn't necessary. Just use a pointer to the local variable instead. The initialization to ** didn't make a difference, because it was always overridden. Reviewed-by: Luca Coelho Link: https://patch.msgid.link/c9affb82fd3e9fb464778013bb7c8fab06232bfd.1773663208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 9d4189e68ebad418eed964185d5563a71c67756d Author: Hugo Villeneuve Date: Tue Mar 17 11:22:11 2026 -0400 regulator: fixed: remove unused reboot.h include The include was added in commit ecb6f1f45614 ("regulator: fixed: add support for under-voltage IRQ") but it was never used. Signed-off-by: Hugo Villeneuve Link: https://patch.msgid.link/20260317152215.3473489-1-hugo@hugovil.com Signed-off-by: Mark Brown commit 21f2762acb5c082666495ebfee8d4a159f03bb07 Author: Tanmay Shah Date: Tue Mar 3 15:51:28 2026 -0800 remoteproc: xlnx: Release mailbox channels on shutdown Mailbox driver can't introduce shutdown callback, as it might endup closing mbox channels prematurely. By allowing the client driver to manage the shutdown process, it's ensured that mailbox channels are closed only when they are no longer needed. Signed-off-by: Tanmay Shah Link: https://lore.kernel.org/r/20260303235127.2317955-4-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier commit 88cf8a9ad32f85012eaf4bd1fe70ab39635ce89c Author: Krzysztof Kozlowski Date: Tue Mar 17 16:20:30 2026 +0100 mux: mmio: Zero the allocated memory Zero the allocated memory in probe() for fields and hardware states because: 1. The "hardware_states" array is not initialized in the probe, thus starting the device with uninitialized memory. This not a bug, because pointed memory will be assigned in suspend callback, however it is a discouraged coding practice. The "fields" array is initialized shortly further in the probe(). 2. Linux kernel convention for safer code encourages using zeroed allocations, as expressed in memory-allocation.rst document. Cc: Greg Kroah-Hartman Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260317152029.274829-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 98e7b5752898f74788098bef51f53205e365ab9d Author: Manuel Ebner Date: Wed Mar 11 17:54:41 2026 +0100 scripts: ver_linux: expand and fix list It is a pain in the ass to compare the software versions on the running system (scripts/ver_linux) with the minimal required versions. Sorting both lists the same way makes side-by-side comparisons a simple task. fix path to changes.rst make toolnames uniform with the toolnames in Changes.rst make version commands uniform with Changes.rst Add missing tools in ver_linux bash, bc, bindgen, btrfs-progs, Clang, gdb, GNU awk, GNU tar, GRUB, GRUB2, gtags, iptables, kmod, mcelog, mkimage, openssl, pahole, Python, Rust, Sphinx, squashfs-tools Signed-off-by: Manuel Ebner Message-ID: <20260311165440.183672-2-manuelebner@airmail.cc> Signed-off-by: Jonathan Corbet commit e8069c66d09309579e53567be8ddfa6ccb2f452a Author: Li Ming Date: Sat Mar 14 15:06:33 2026 +0800 cxl/pci: Check memdev driver binding status in cxl_reset_done() cxl_reset_done() accesses the endpoint of the corresponding CXL memdev without endpoint validity checking. By default, cxlmd->endpoint is initialized to -ENXIO, if cxl_reset_done() is triggered after the corresponding CXL memdev probing failed, this results in access to an invalid endpoint. CXL subsystem can always check CXL memdev driver binding status to confirm its endpoint validity. So adding the CXL memdev driver checking inside cxl_reset_done() to avoid accessing an invalid endpoint. Fixes: 934edcd436dc ("cxl: Add post-reset warning if reset results in loss of previously committed HDM decoders") Reviewed-by: Dan Williams Reviewed-by: Dave Jiang Signed-off-by: Li Ming Link: https://patch.msgid.link/20260314-fix_access_endpoint_without_drv_check-v2-4-4c09edf2e1db@zohomail.com Signed-off-by: Dave Jiang commit dc372e5f429ced834d81ff12a945397dc43585a8 Author: Li Ming Date: Sat Mar 14 15:06:32 2026 +0800 cxl/pci: Hold memdev lock in cxl_event_trace_record() cxl_event_config() invokes cxl_mem_get_event_record() to get remain event logs from CXL device during cxl_pci_probe(). If CXL memdev probing failed before that, it is possible to access an invalid endpoint. So adding a cxlmd->driver binding status checking inside cxl_dpa_to_region() to ensure the corresponding endpoint is valid. Besides, cxl_event_trace_record() needs to hold memdev lock to invoke cxl_dpa_to_region() to ensure the memdev probing completed. It is possible that cxl_event_trace_record() is invoked during the CXL memdev probing, especially user or cxl_acpi triggers CXL memdev re-probing. Suggested-by: Dan Williams Reviewed-by: Dan Williams Reviewed-by: Dave Jiang Signed-off-by: Li Ming Link: https://patch.msgid.link/20260314-fix_access_endpoint_without_drv_check-v2-3-4c09edf2e1db@zohomail.com Signed-off-by: Dave Jiang commit c991b7ef2fb658c186df56d16b3ebcd0afb555cc Author: Daniel Pereira Date: Thu Mar 12 09:24:24 2026 -0300 docs: pt_BR: add netdev and maintainer handbook translations Add the Brazilian Portuguese translation for the netdev subsystem process and update the maintainer handbook to include it. Signed-off-by: Daniel Pereira Signed-off-by: Jonathan Corbet Message-ID: <20260312122425.19577-1-danielmaraboo@gmail.com> commit 97b5266dac802feb34ae45936b73596a7e27d41b Author: Kuan-Wei Chiu Date: Thu Mar 12 17:53:41 2026 +0000 docs: interconnect: Document consumer APIs and drop outdated text The documentation currently states that consumer interfaces are not documented, which is no longer true. Remove the outdated claim and include the existing kernel-doc from drivers/interconnect/core.c (filtered for consumer APIs) and drivers/interconnect/bulk.c. Signed-off-by: Kuan-Wei Chiu Signed-off-by: Jonathan Corbet Message-ID: <20260312175341.2944154-3-visitorckw@gmail.com> commit 6f600f9972d56a5d67fcb8d49b33dda80adff457 Author: Kuan-Wei Chiu Date: Thu Mar 12 17:53:40 2026 +0000 docs: interconnect: Add provider APIs to documentation The "Interconnect providers" section currently only includes data structures from include/linux/interconnect-provider.h. Include drivers/interconnect/core.c to extract provider-specific API documentation. The :functions: directive is used to prevent mixing with consumer APIs. Signed-off-by: Kuan-Wei Chiu Signed-off-by: Jonathan Corbet Message-ID: <20260312175341.2944154-2-visitorckw@gmail.com> commit 15bdd0eaaf927c70f92e84280cb4268576f8e81a Author: Leo Li Date: Fri Mar 13 14:22:41 2026 -0400 drm/amdgpu/atomfirmware: Add LpDDR5x and new fields for info v2_3 [Why] Newer DCN bandwidth calculations require new definitions. [How] Add new fields cpu_id and vram_bit_width for atom_integrated_system_info_v2_3, and add a memtype for LpDDR5x. Reviewed-by: Alex Hung Signed-off-by: Leo Li Signed-off-by: Alex Deucher commit c51632d1ed7ac5aed2d40dbc0718d75342c12c6a Author: Pratap Nirujogi Date: Wed Mar 11 12:15:09 2026 -0400 drm/amdgpu: Fix ISP segfault issue in kernel v7.0 Add NULL pointer checks for dev->type before accessing dev->type->name in ISP genpd add/remove functions to prevent kernel crashes. This regression was introduced in v7.0 as the wakeup sources are registered using physical device instead of ACPI device. This led to adding wakeup source device as the first child of AMDGPU device without initializing dev-type variable, and resulted in segfault when accessed it in the amdgpu isp driver. Fixes: 057edc58aa59 ("ACPI: PM: Register wakeup sources under physical devices") Suggested-by: Bin Du Reviewed-by: Mario Limonciello Signed-off-by: Pratap Nirujogi Signed-off-by: Alex Deucher commit e14d468304832bcc4a082d95849bc0a41b18ddea Author: Alex Deucher Date: Mon Mar 16 15:51:08 2026 -0400 drm/amdgpu/gmc9.0: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Cc: Benjamin Cheng Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher commit dea5f235baf3786bfd4fd920b03c19285fdc3d9f Author: Alex Deucher Date: Wed Mar 4 17:26:17 2026 -0500 drm/amdgpu/mmhub4.2.0: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher commit 04f063d85090f5dd0c671010ce88ee49d9dcc8ed Author: Alex Deucher Date: Wed Mar 4 17:25:56 2026 -0500 drm/amdgpu/mmhub4.1.0: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher commit f14f27bbe2a3ed7af32d5f6eaf3f417139f45253 Author: Alex Deucher Date: Wed Mar 4 17:25:30 2026 -0500 drm/amdgpu/mmhub3.0: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher commit 1441f52c7f6ae6553664aa9e3e4562f6fc2fe8ea Author: Alex Deucher Date: Wed Mar 4 17:25:09 2026 -0500 drm/amdgpu/mmhub3.0.2: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher commit 5f76083183363c4528a4aaa593f5d38c28fe7d7b Author: Alex Deucher Date: Wed Mar 4 17:24:35 2026 -0500 drm/amdgpu/mmhub3.0.1: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher commit 89cd90375c19fb45138990b70e9f4ba4806f05c4 Author: Alex Deucher Date: Wed Mar 4 17:24:10 2026 -0500 drm/amdgpu/mmhub2.3: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher commit e064cef4b53552602bb6ac90399c18f662f3cacd Author: Alex Deucher Date: Wed Mar 4 17:22:43 2026 -0500 drm/amdgpu/mmhub2.0: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher commit e6020a55b8e364d15eac27f9c788e13114eec6b7 Author: Srinivasan Shanmugam Date: Thu Mar 12 19:29:54 2026 +0530 drm/amdgpu: Add default case in DVI mode validation amdgpu_connector_dvi_mode_valid() assigns max_digital_pixel_clock_khz based on connector_object_id using a switch statement that lacks a default case. In practice this code path should never be hit because the existing cases already cover all digital connector types that this function is used for. This is also legacy display code which is not used for new hardware. Add a default case returning MODE_BAD to make the switch exhaustive and silence the static analyzer smatch error. The new branch is effectively defensive and should never be reached during normal operation. Fixes: 585b2f685c56 ("drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)") Cc: Dan Carpenter Cc: Timur Kristóf Cc: Alex Deucher Cc: Christian König Signed-off-by: Srinivasan Shanmugam Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 6b606216e03fa2b53cc179d8383b683a140fe6e1 Author: Srinivasan Shanmugam Date: Wed Oct 22 18:16:51 2025 +0530 drm/amd/ras: Fix NULL deref in ras_core_ras_interrupt_detected() Fixes a NULL pointer dereference when ras_core is NULL and ras_core->dev is accessed in the error path. Fixes: 13c91b5b4378 ("drm/amd/ras: Add rascore unified interface function") Reported by: Dan Carpenter Cc: YiPeng Chai Cc: Tao Zhou Cc: Hawking Zhang Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit a782576e28ea35157f4cf97e723ea53c0ecbd6d5 Author: Srinivasan Shanmugam Date: Thu Mar 12 14:07:36 2026 +0530 drm/amdgpu: Drop unreachable return in amdgpu_reg_get_smn_base64() amdgpu_reg_get_smn_base64() returns from all control-flow paths inside the !adev->reg.smn.get_smn_base fallback path. For version == 1, the function returns the base address from amdgpu_reg_smn_v1_0_get_base(). For all other versions, the default switch branch emits a dev_err_once() and returns 0. The trailing return 0 after the switch is therefore unreachable and is reported by Smatch as dead code: drivers/gpu/drm/amd/amdgpu/amdgpu_reg_access.c:317 amdgpu_reg_get_smn_base64() warn: ignoring unreachable code Remove the redundant return statement. Fixes: 467ebfe65f6e ("drm/amdgpu: Add smn callbacks to register block") Cc: Dan Carpenter Cc: Lijo Lazar Cc: Hawking Zhang Cc: Alex Deucher Cc: Christian König Signed-off-by: Srinivasan Shanmugam Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 2cef848812a071991c20090cbe051a0a96c50a0c Author: Jesse.Zhang Date: Fri Mar 13 13:12:33 2026 +0800 drm/amdgpu: validate fence_count in wait_fences ioctl Add an early parameter check in amdgpu_cs_wait_fences_ioctl() to reject a zero fence_count with -EINVAL. dma_fence_wait_any_timeout() requires count > 0. When userspace passes fence_count == 0, the call propagates down to dma_fence core which does not expect a zero-length array and triggers a WARN_ON. Return -EINVAL immediately so the caller gets a clear error instead of hitting an unexpected warning in the DMA fence subsystem. No functional change for well-formed userspace callers. v2: - Reworked commit message to clarify the parameter validation rationale - Removed verbose crash log from commit description - Simplified inline code comment Reviewed-by: Vitaly Prosyak Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 4bbba79a7f1d0c7296bf8c935d65a9ff633f6917 Author: Pierre-Eric Pelloux-Prayer Date: Fri Feb 21 14:45:19 2025 +0100 drm/amdgpu: move devcoredump generation to a worker Update the way drm_coredump_printer is used based on its documentation and Xe's code: the main idea is to generate the final version in one go and then use memcpy to return the chunks requested by the caller of amdgpu_devcoredump_read. The generation is moved to a separate worker thread. This cuts the time to copy the dump from 40s to ~0s on my machine. --- v3: - removed adev->coredump_in_progress and instead use work as the synchronisation mechanism - use kvfree instead of kfree --- Signed-off-by: Pierre-Eric Pelloux-Prayer Acked-by: Alex Deucher Acked-by: Christian König Signed-off-by: Alex Deucher commit 9b4e099c221cd118b9dbe720586c1f1c71666d09 Author: Ricardo Ungerer Date: Mon Mar 16 22:02:17 2026 +0000 jobserver: Fix typo in docstring This commit fixes small typos in the docstring of jobserver.py. Signed-off-by: Ricardo Ungerer Signed-off-by: Jonathan Corbet Message-ID: <20260316220218.568022-1-ungerer.ricardo@gmail.com> commit 15e19d832bae7921f9c18fd274aa51ee3e75342b Author: Jesse.Zhang Date: Mon Mar 16 09:40:47 2026 +0800 drm/amd/amdgpu: Fix build errors due to declarations after labels In C90 (which the kernel uses with -std=gnu89), declarations must appear at the beginning of a block and cannot follow a label. The switch cases in amdgpu_discovery.c and gmc_v12_1.c contained variable declarations immediately after case labels, causing the compiler to error: drivers/gpu/drm/amd/amdgpu/gmc_v12_1.c:533:3: error: a label can only be part of a statement and a declaration is not a statement Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit f802f7b0bc0917023f4b5938246fd7abf23fa5e3 Author: Sunil Khatri Date: Thu Mar 12 13:55:32 2026 +0530 drm/amdgpu/userq: unlock cancel_delayed_work_sync for hang_detect_work cancel_delayed_work_sync for work hand_detect_work should not be locked since the amdgpu_userq_hang_detect_work also need the same mutex and when they run together it could be a deadlock. we do not need to hold the mutex for cancel_delayed_work_sync(&queue->hang_detect_work). With this in place if cancel and worker thread run at same time they will not deadlock. Due to any failures if there is a hand detect and reset that there a deadlock scenarios between cancel and running the main thread. [ 243.118276] task:kworker/9:0 state:D stack:0 pid:73 tgid:73 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 243.118283] Workqueue: events amdgpu_userq_hang_detect_work [amdgpu] [ 243.118636] Call Trace: [ 243.118639] [ 243.118644] __schedule+0x581/0x1810 [ 243.118649] ? srso_return_thunk+0x5/0x5f [ 243.118656] ? srso_return_thunk+0x5/0x5f [ 243.118659] ? wake_up_process+0x15/0x20 [ 243.118665] schedule+0x64/0xe0 [ 243.118668] schedule_preempt_disabled+0x15/0x30 [ 243.118671] __mutex_lock+0x346/0x950 [ 243.118677] __mutex_lock_slowpath+0x13/0x20 [ 243.118681] mutex_lock+0x2c/0x40 [ 243.118684] amdgpu_userq_hang_detect_work+0x63/0x90 [amdgpu] [ 243.118888] process_scheduled_works+0x1f0/0x450 [ 243.118894] worker_thread+0x27f/0x370 [ 243.118899] kthread+0x1ed/0x210 [ 243.118903] ? __pfx_worker_thread+0x10/0x10 [ 243.118906] ? srso_return_thunk+0x5/0x5f [ 243.118909] ? __pfx_kthread+0x10/0x10 [ 243.118913] ret_from_fork+0x10f/0x1b0 [ 243.118916] ? __pfx_kthread+0x10/0x10 [ 243.118920] ret_from_fork_asm+0x1a/0x30 Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 7a14a4e9b3fda05b907d0445a3be9e7c0e887f4e Author: Sunil Khatri Date: Fri Mar 13 12:41:22 2026 +0530 drm/amdgpu/userq: fix dma_fence refcount underflow in userq path An extra dma_fence_put() can drop the last reference to a fence while it is still attached to a dma_resv object. This frees the fence prematurely via dma_fence_release() while other users still hold the pointer. Later accesses through dma_resv iteration may then operate on the freed fence object, leading to refcount underflow warnings and potential hangs when walking reservation fences. Fix this by correcting the fence lifetime so the dma_resv object retains a valid reference until it is done with the fence.i [ 31.133803] refcount_t: underflow; use-after-free. [ 31.133805] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x58/0x90, CPU#18: kworker/u96:1/188 Signed-off-by: Sunil Khatri Reviewed-by: Tvrtko Ursulin Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 311f8fc05c8d1a0e65e9f91348e6d2be8cf58c60 Author: Hawking Zhang Date: Fri Mar 13 21:32:03 2026 +0800 drm/amdgpu: fallback to default discovery offset/size in sriov guest In SRIOV guest environment, if dynamic critical region is not enabled, fallback to default discovery offset and size to ensure proper initialization Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit d0eab64faf0c3b5a354a4ff1eff1b86808014559 Author: Praveen Kumar Singh Date: Tue Mar 17 11:10:32 2026 +0530 docs: memory-hotplug: fix typo 'fo' -> 'for' in NODE_ADDED_FIRST_MEMORY description The description of NODE_ADDED_FIRST_MEMORY notification contains a missing 'r' in the word 'for'. Fix the typo. Signed-off-by: Praveen Kumar Singh Signed-off-by: Jonathan Corbet Message-ID: commit e9405ce75e8e1c2a2281659bf395f8b18b94d786 Author: Sunil Khatri Date: Fri Mar 13 12:36:46 2026 +0530 drm/amdgpu/userq: Use kvfree instead of kfree in amdgpu_userq_signal_ioctl In function amdgpu_userq_signal_ioctl, drm_gem_objects_lookup allocates memory via kvmalloc and hence when that memory is freed the memory via kvfree. Fixes: 4ca06f6fb45d ("drm/amdgpu/userq: Use drm_gem_objects_lookup in amdgpu_userq_signal_ioctl") Signed-off-by: Sunil Khatri Reviewed-by: Tvrtko Ursulin Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 6b340cccf1340da310ae01d267b0586e08a538c9 Author: Tao Zhou Date: Wed Mar 11 18:52:59 2026 +0800 drm/amdgpu: update flip bit setting of RAS bad page The flip bit setting is different if umc number is half of original configuration. v2: block the flip bit setting for unsupported umc configuration. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 736ef29ed4573ce699949bd494cec328e6908527 Author: Yicong Hui Date: Fri Jan 9 16:25:14 2026 +0000 drm/amdgpu: Replace deprecated strcpy() in amdgpu_virt_write_vf2pf_data strcpy() is deprecated as it does not do any bounds checking (as specified in Documentation/process/deprecated.rst). There is a risk of buffer overflow in the case that the value for THIS_MODULE->version exceeds the 64 characters. This is unlikely, but replacing the deprecated function will pre-emptively remove this risk entirely. Replace both instances of strcpy() with the safer strscpy() function. Changes have been compile tested. Reviewed-by: Kees Cook Signed-off-by: Yicong Hui Signed-off-by: Alex Deucher commit 9c7be0efa6f0daa949a5f3e3fdf9ea090b0713cb Author: Andy Nguyen Date: Sun Mar 15 17:51:47 2026 +0100 drm/amd: fix dcn 2.01 check The ASICREV_IS_BEIGE_GOBY_P check always took precedence, because it includes all chip revisions upto NV_UNKNOWN. Fixes: 54b822b3eac3 ("drm/amd/display: Use dce_version instead of chip_id") Signed-off-by: Andy Nguyen Signed-off-by: Alex Deucher commit 91c7e6342e98c846b259c57273436fdea4c043f2 Author: Srinivasan Shanmugam Date: Sun Mar 15 18:30:26 2026 +0530 drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() parse_edid_displayid_vrr() searches the EDID extension blocks for a DisplayID extension before parsing the dynamic video timing range. The code previously checked whether edid_ext was NULL after the search loop. However, edid_ext is assigned during each iteration of the loop, so it will never be NULL once the loop has executed. If no DisplayID extension is found, edid_ext ends up pointing to the last extension block, and the NULL check does not correctly detect the failure case. Instead, check whether the loop completed without finding a matching DisplayID block by testing "i == edid->extensions". This ensures the function exits early when no DisplayID extension is present and avoids parsing an unrelated EDID extension block. Also simplify the EDID validation check using "!edid || !edid->extensions". Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:13079 parse_edid_displayid_vrr() warn: variable dereferenced before check 'edid_ext' (see line 13075) Fixes: a638b837d0e6 ("drm/amd/display: Fix refresh rate range for some panel") Cc: Roman Li Cc: Alex Hung Cc: Jerry Zuo Cc: Sun peng Li Cc: Tom Chung Cc: Dan Carpenter Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Tom Chung Signed-off-by: Alex Deucher commit 6736c8ff9d63e847a3b694aeaeb78d4e8ad42464 Author: Erik Kurzinger Date: Tue Feb 10 15:08:15 2026 -0500 drm/amd/display: remove duplicate format modifier amdgpu_dm_plane_get_plane_modifiers always adds DRM_FORMAT_MOD_LINEAR to the list of modifiers. However, with gfx12, amdgpu_dm_plane_add_gfx12_modifiers also adds that modifier to the list. So we end up with two copies. Most apps just ignore this but some (Weston) don't like it. As a fix, we change amdgpu_dm_plane_add_gfx12_modifiers to not add DRM_FORMAT_MOD_LINEAR to the list, matching the behavior of analogous functions for other chips. Signed-off-by: Erik Kurzinger Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit c955e99a060e4dc94228abe5cf63edd1e09754f2 Author: David Baum Date: Thu Mar 12 20:52:26 2026 -0500 drm/amdgpu: switch XGMI sysfs show helpers to sysfs_emit_at() The XGMI sysfs show helpers amdgpu_xgmi_show_num_hops() and amdgpu_xgmi_show_num_links() currently populate the output buffer with sprintf() and then call sysfs_emit(buf, "%s\n", buf) to append the final newline. Convert both helpers to use sysfs_emit_at() while tracking the current offset. This keeps buffer construction in the sysfs helpers, avoids feeding the output buffer back into the final formatted write, and matches the style already used by amdgpu_xgmi_show_connected_port_num(). Signed-off-by: David Baum Signed-off-by: Alex Deucher commit 2e43ca1a4f949e4beb763f8196695da02b17bd77 Merge: 9840bb66e7e5df 81359c146fba8d Author: Christian Brauner Date: Tue Mar 17 15:38:54 2026 +0100 Merge patch series "vfs: follow-on fixes for i_ino widening" Jeff Layton says: Just some patches to fix follow-on issues reported after the inode->i_ino widening series. * patches from https://patch.msgid.link/20260316-iino-u64-v3-0-d1076b8f7a20@kernel.org: nilfs2: fix 64-bit division operations in nilfs_bmap_find_target_in_group() EVM: add comment describing why ino field is still unsigned long Link: https://patch.msgid.link/20260316-iino-u64-v3-0-d1076b8f7a20@kernel.org Signed-off-by: Christian Brauner commit 81359c146fba8d6a59db7e938c316776f63b9ee5 Author: Jeff Layton Date: Mon Mar 16 15:02:23 2026 -0400 nilfs2: fix 64-bit division operations in nilfs_bmap_find_target_in_group() With the change to make inode->i_ino a u64, the build started failing on 32-bit ARM with: ERROR: modpost: "__aeabi_uldivmod" [fs/nilfs2/nilfs2.ko] undefined! Fix this by using udiv_u64() for the division. For finding the index into the group, switch to using a bitwise & operation since that's more efficient. With this change however, NILFS_BMAP_GROUP_DIV must be a power of two, so add a compile-time assertion for that. Fixes: 998a59d371c2 ("treewide: fix missed i_ino format specifier conversions") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603100602.KPxiClIO-lkp@intel.com/ Reviewed-by: Viacheslav Dubeyko Acked-by: Ryusuke Konishi Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260316-iino-u64-v3-2-d1076b8f7a20@kernel.org Signed-off-by: Christian Brauner commit bef5b11087ce87df47f621c02c1027557d886caf Author: Jeff Layton Date: Mon Mar 16 15:02:22 2026 -0400 EVM: add comment describing why ino field is still unsigned long Mimi pointed out that we didn't widen the inode number field in struct h_misc alongside the inode->i_ino widening. While we could make an equivalent change there, that would require EVM resigning on all 32-bit hosts. Instead, leave the field as an unsigned long. This should have no effect on 64-bit hosts, and allow things to continue working on 32-bit hosts in the cases where the i_ino fits in 32-bits. Add a comment explaining why it's being left as unsigned long. Reviewed-by: Mimi Zohar Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260316-iino-u64-v3-1-d1076b8f7a20@kernel.org Signed-off-by: Christian Brauner commit eb422f3bbdff4ef870b855b7252e60bb591ed85f Author: Nathan Chancellor Date: Thu Mar 12 14:46:48 2026 -0700 drm/amdgpu/discovery: Add braces to case statements in amdgpu_discovery_table_check() When building with a version of clang that supports the narrower '-fms-anonymous-structs' (as opposed to the wider '-fms-extensions') along with the associated kernel support (such as in next-20260312 [1]), there are warnings (or errors with CONFIG_WERROR=y / W=e) from the switch statement added by commit 47ab777c16c7 ("drm/amdgpu/discovery: use common function to check discovery table"). drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:560:3: error: label followed by a declaration is a C23 extension [-Werror,-Wc23-extensions] 560 | struct ip_discovery_header *ihdr = | ^ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:568:3: error: label followed by a declaration is a C23 extension [-Werror,-Wc23-extensions] 568 | struct gpu_info_header *ghdr = | ^ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:576:3: error: label followed by a declaration is a C23 extension [-Werror,-Wc23-extensions] 576 | struct harvest_info_header *hhdr = | ^ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:584:3: error: label followed by a declaration is a C23 extension [-Werror,-Wc23-extensions] 584 | struct vcn_info_header *vhdr = | ^ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:592:3: error: label followed by a declaration is a C23 extension [-Werror,-Wc23-extensions] 592 | struct mall_info_header *mhdr = | ^ If '-fms-extensions' were not present, this would be a hard error in older clang versions. Add braces to the case statements that declare variables to clear up the warnings. Fixes: 47ab777c16c7 ("drm/amdgpu/discovery: use common function to check discovery table") Link: https://git.kernel.org/next/linux-next/c/0d3fccf68d9873a3c824fb70be0dbb2c4642aa90 [1] Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit a0b2afa4c364499a43a58a007ba287e006b55521 Author: YiPeng Chai Date: Mon Dec 8 16:29:51 2025 +0800 drm/amd/ras: Pass ras poison consumption message to sriov host Pass ras poison consumption message to sriov host. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 04c612f6d7641dc563e8aac95649be6c888ba7db Author: h3288824963 <3288824963@qq.com> Date: Tue Mar 17 18:57:11 2026 +0800 Documentation: printk: Add section about avoiding lockups Add a section 'Avoiding lockups from excessive printk() use' to printk-basics.rst, explaining the risk of calling printk() in hot paths with legacy consoles and suggesting alternatives. The section covers: - Rate-limited and one-time printing variants - Log level filtering - printk_deferred() for legacy consoles - Porting to nbcon API (preferred solution) - Using tracepoints for permanent debugging This documentation is relevant only for legacy console drivers and !PREEMPT_RT kernels. Suggested-by: Petr Mladek Suggested-by: John Ogness Signed-off-by: h3288824963 <3288824963@qq.com> Reviewed-by: John Ogness Signed-off-by: Jonathan Corbet Message-ID: commit 087be0cd54f5e27a893222d9a4d4fc970bf31ccd Author: Sunil Khatri Date: Fri Mar 13 12:33:43 2026 +0530 drm/amdgpu/userq: Use kvfree instead of kfree in amdgpu_userq_wait_ioctl In function amdgpu_userq_wait_ioctl, drm_gem_objects_lookup allocates memory via kvmalloc and hence when that memory is freed the memory via kvfree. Fixes: 2de9353e193f ("drm/amdgpu/userq: Use drm_gem_objects_lookup in amdgpu_userq_wait_ioctl") Signed-off-by: Sunil Khatri Reviewed-by: Tvrtko Ursulin Signed-off-by: Alex Deucher commit 3d0b7f5da0bfd6b3725f21b893f068dc2959e57b Author: Asad Kamal Date: Thu Mar 12 15:40:13 2026 +0800 drm/amd/pm: Use common smu fw check function for smu15 Use common smu fw check function for smu15 and remove dedicated ones v2: Remove dedicated functions and directly use common one Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit fba3ad6f93723ca0c5c62a15ecd3b04a0d082d74 Author: Asad Kamal Date: Thu Mar 12 15:33:07 2026 +0800 drm/amd/pm: Use common smu fw check function for smu13 Use common smu fw check function for smu13 and remove deicated ones v2: Remove dedicated functions and directly use common one Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 927a16c216502ae78f1612ec538823e80a669680 Author: Taimur Hassan Date: Fri Mar 6 17:43:58 2026 -0500 drm/amd/display: Promote DC to 3.2.374 This version brings along the following updates: - Clamp dc_cursor_position x_hotspot to prevent integer overflow - Query DC for gfx handling when setting linear tiling - Add a buffer for boot time crc - Silence static analysis warnings - Plumb MRQ programming out of DML for dml2_1 - Add dcn_mrq_present Field - Fix number of opp - Add debugfs to disallow eDP Replay entry Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Chuanyu Tseng Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit a2aa7987de1169548c465f6cc1019d2112e0e8b5 Author: Benjamin Nwankwo Date: Fri Mar 6 12:49:44 2026 -0500 drm/amd/display: Clamp dc_cursor_position x_hotspot to prevent integer overflow why: Workaround for duplicate cursor. Cursor offsetting via x_hotspot attempts to write a 32 bit unsigned integer to the 8 bit field CURSOR_HOT_SPOT_X. This wraps cursor position back into focus if x_hotspot exceeds 8 bits, making duplicate cursors visible how: Clamp x_hotspot before writing to hardware Reviewed-by: Charlene Liu Reviewed-by: Nevenko Stupar Signed-off-by: Benjamin Nwankwo Signed-off-by: Chuanyu Tseng Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d227786ab1119669df4dc333a61510c52047cce4 Author: HyungJung Joo Date: Tue Mar 17 14:45:56 2026 +0900 fs/mbcache: cancel shrink work before destroying the cache mb_cache_destroy() calls shrinker_free() and then frees all cache entries and the cache itself, but it does not cancel the pending c_shrink_work work item first. If mb_cache_entry_create() schedules c_shrink_work via schedule_work() and the work item is still pending or running when mb_cache_destroy() runs, mb_cache_shrink_worker() will access the cache after its memory has been freed, causing a use-after-free. This is only reachable by a privileged user (root or CAP_SYS_ADMIN) who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem. Cancel the work item with cancel_work_sync() before calling shrinker_free(), ensuring the worker has finished and will not be rescheduled before the cache is torn down. Fixes: c2f3140fe2ec ("mbcache2: limit cache size") Signed-off-by: Hyungjung Joo Link: https://patch.msgid.link/20260317054556.1821600-1-jhj140711@gmail.com Signed-off-by: Christian Brauner commit 8333f22e44a972428a4e1b5c6a92e3e774e8ac99 Author: Nicholas Carbones Date: Wed Mar 11 14:36:05 2026 +0800 drm/amd/display: Query DC for gfx handling when setting linear tiling [Why] Post-driver cases always use linear tiling yet gfx handling for this case is improper, allowing for incorrect gfx structs to be populated and used. [How] Query DC for the apporpriate linear tiling mode and populate the DCN specific gfx version structs. Reviewed-by: Dillon Varone Signed-off-by: Nicholas Carbones Signed-off-by: Chuanyu Tseng Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit b034c5b0d831cf5d62b40d550349978d0a5a32f0 Author: Tom Chung Date: Wed Mar 4 17:48:00 2026 +0800 drm/amd/display: Add a buffer for boot time crc [Why] We need to reserve a memory buffer for boot time crc test during resume. [How] Create a buffer during boot up and send the buffer info to DMUB. Reviewed-by: Wayne Lin Signed-off-by: Tom Chung Signed-off-by: Chuanyu Tseng Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit cb0f6a16e23812289286ed2f581acf12c5b278b4 Author: Gaghik Khachatrian Date: Thu Feb 26 15:17:20 2026 -0500 drm/amd/display: Silence static analysis warning Silence static analysis warnings by ensuring swath size temporaries are initialized before use. No functional change intended. Reviewed-by: Dillon Varone Signed-off-by: Gaghik Khachatrian Signed-off-by: Chuanyu Tseng Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 0621c385fda1376e967f37ccd534c26c3e511d14 Author: HyungJung Joo Date: Tue Mar 17 14:48:27 2026 +0900 fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440). Later, omfs_make_empty() uses sbi->s_sys_blocksize - OMFS_DIR_START as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer. Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed. Fixes: a3ab7155ea21 ("omfs: add directory routines") Signed-off-by: Hyungjung Joo Link: https://patch.msgid.link/20260317054827.1822061-1-jhj140711@gmail.com Signed-off-by: Christian Brauner commit beb8e35e2b4b799dfedebbd48cd6ad2119cf200c Author: Nicholas Kazlauskas Date: Tue Mar 3 09:48:37 2026 -0500 drm/amd/display: Plumb MRQ programming out of DML for dml2_1 [Why] If the MRQ is present then these fields are also required to be plumbed out to the requestor for programming. [How] Pipe the fields out through rq_dlg_get_rq_reg. The implementation follows the previous generation in dml2_0 for DCN35 but adjusted for the new helpers and coding style of dml2_1. Reviewed-by: Dillon Varone Signed-off-by: Nicholas Kazlauskas Signed-off-by: Chuanyu Tseng Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit fabd89fc17fdfd1225afd69ca883fbd30226b4c9 Author: Austin Zheng Date: Thu Jan 29 17:31:19 2026 -0500 drm/amd/display: Add dcn_mrq_present Field [Why/How] Add MRQ flag so it can be passed from ip_caps to ip_params Reviewed-by: Dillon Varone Signed-off-by: Austin Zheng Signed-off-by: Chuanyu Tseng Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 2c5f15ee2c760514c5be0f02cf9c9f1ff68b9ac8 Author: Austin Zheng Date: Fri Jan 23 15:33:13 2026 -0500 drm/amd/display: Fix number of opp [Why/How] Patch number of opp based on IP caps Reviewed-by: Dillon Varone Signed-off-by: Austin Zheng Signed-off-by: Chuanyu Tseng Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f7168d1a8d356209f96c071e5fbff98201decaf9 Author: Ray Wu Date: Mon Mar 2 10:26:51 2026 +0800 drm/amd/display: Add debugfs to disallow eDP Replay entry [Why & How] Test applications need to read CRC from eDP sink side, but sink replay feature prevents proper CRC reading and causing timeout. Add disallow_edp_enter_replay debugfs interface to allow test apps to temporarily disable Replay for CRC operations. Reviewed-by: Tom Chung Signed-off-by: Ray Wu Signed-off-by: Chuanyu Tseng Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 5e6df46dffb32342c4be6deb6f897363f207bf05 Author: Ariful Islam Shoikot Date: Tue Mar 17 18:06:13 2026 +0600 Documentation/mm/hwpoison.rst: fix typos and grammar. Signed-off-by: Ariful Islam Shoikot Signed-off-by: Jonathan Corbet Message-ID: <20260317120614.51046-1-islamarifulshoikat@gmail.com> commit 5a6a33b56402167ef019fd2520728e8c25614f74 Author: Ai Chao Date: Tue Mar 10 17:44:29 2026 +0800 USB: serial: ti_usb_3410_5052: use strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao Signed-off-by: Johan Hovold commit 25bb1d54ba3983c064361033a8ec15474fece37e Author: Xi Ruoyao Date: Fri Mar 6 14:28:03 2026 +0800 drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} [Why] The dcn32_override_min_req_memclk function is in dcn32_fpu.c, which is compiled with CC_FLAGS_FPU into FP instructions. So when we call it we must use DC_FP_{START,END} to save and restore the FP context, and prepare the FP unit on architectures like LoongArch where the FP unit isn't always on. Reported-by: LiarOnce Fixes: ee7be8f3de1c ("drm/amd/display: Limit DCN32 8 channel or less parts to DPM1 for FPO") Signed-off-by: Xi Ruoyao Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit b7f1402f6ad24cc6b9a01fa09ebd1c6559d787d0 Author: Calvin Owens Date: Thu Mar 12 10:13:34 2026 -0700 drm/amd/display: Fix uninitialized variable use which breaks full LTO Commit e1b385726f7f ("drm/amd/display: Add additional checks for PSP footer size") introduced a use of an uninitialized stack variable in dm_dmub_sw_init() (region_params.bss_data_size). Interestingly, this seems to cause no issue on normal kernels. But when full LTO is enabled, it causes the compiler to "optimize" out huge swaths of amdgpu initialization code, and the driver is unusable: amdgpu 0000:03:00.0: [drm] Loading DMUB firmware via PSP: version=0x07002F00 amdgpu 0000:03:00.0: sw_init of IP block failed 5 amdgpu 0000:03:00.0: amdgpu_device_ip_init failed amdgpu 0000:03:00.0: Fatal error during GPU init It surprises me that neither gcc nor clang emit a warning about this: I only found it by bisecting the LTO breakage. Fix by using the bss_data_size field from fw_meta_info_params, as was presumably intended. Fixes: e1b385726f7f ("drm/amd/display: Add additional checks for PSP footer size") Signed-off-by: Calvin Owens Reviewed-by: Harry Wentland Reviewed-by: Nathan Chancellor Signed-off-by: Alex Deucher commit febc4b43661cd12dbc6255acb83b7fe60287459b Author: Asad Kamal Date: Thu Mar 12 15:26:16 2026 +0800 drm/amd/pm: Add common smu fw check function Add common smu firmware version check function Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 98dc529a27c57e184ab47453993ba9cfcfcec0ca Author: Christian König Date: Thu Jan 22 15:27:25 2026 +0100 drm/amdgpu: fix amdgpu_userq_evict Canceling the resume worker synchonized can deadlock because it can in turn wait for the eviction worker through the userq_mutex. Signed-off-by: Christian König Reviewed-by: Alex Deucher Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit 688b87d39e0aa8135105b40dc167d74b5ada5332 Author: Jesse.Zhang Date: Thu Mar 12 18:06:17 2026 +0800 drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Userspace can pass an arbitrary number of BO list entries via the bo_number field. Although the previous multiplication overflow check prevents out-of-bounds allocation, a large number of entries could still cause excessive memory allocation (up to potentially gigabytes) and unnecessarily long list processing times. Introduce a hard limit of 128k entries per BO list, which is more than sufficient for any realistic use case (e.g., a single list containing all buffers in a large scene). This prevents memory exhaustion attacks and ensures predictable performance. Return -EINVAL if the requested entry count exceeds the limit Reviewed-by: Christian König Suggested-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit df1f11fe142acb9312d2a9826161730f724276f7 Author: YiPeng Chai Date: Mon Dec 8 16:50:53 2025 +0800 drm/amdgpu: Add poison consumption handling for gfx v12_1 Add poison consumption handling for gfx v12_1. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit c32606c8c6f7f7e8d1807c7b39fab59963b16498 Author: YiPeng Chai Date: Mon Dec 8 16:23:10 2025 +0800 drm/amdgpu: Add umc ecc error handling for gmc v12_1 Add umc ecc error handling for gmc v12_1. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 22664436e61bd4694d914fbf774224b502c0ad99 Author: YiPeng Chai Date: Mon Dec 8 16:28:49 2025 +0800 drm/amd/ras: Add unified interface to handle ras interrupts Add unified interface to handle ras interrupts, some redundant interrupt function interfaces will be removed later. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 2886b439222d1134b4f1ac44268edfb8e5392ca5 Author: Hawking Zhang Date: Tue Feb 10 04:35:24 2026 +0800 drm/amdgpu: Place firmware bo in vram for A + A On A+A platforms, PSP requires the firmware bo to be located in VRAM Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit 38c900e0b425feee427c864b4da77903b4cbfd3a Author: Feifei Xu Date: Sat Jan 31 13:07:39 2026 +0800 drm/amdgpu/mmhub_v4_2_0: expand gart aperture to gart_end on A+A On A+A, sysvm aperture is used to access vram and gart. Gart is placed right after vram. Adjust gart aperture range in mmhub for A+A. Signed-off-by: Feifei Xu Signed-off-by: Jack Xiao Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit 25aa39a863932f43a4d52c54bbbd18ee626e39dc Author: Hawking Zhang Date: Wed Jan 28 19:18:28 2026 +0800 drm/amdgpu/gmc12: Init vram_size for A + A Calculate vram_size using the XGMI node segment size and node count for A+A configurations Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit 93d82ed35de622b90951434593a41abef7d98ae7 Author: Hawking Zhang Date: Tue Jan 27 16:07:19 2026 +0800 drm/amdgpu/gmc12: Update connected_to_cpu flag Query the host–GPU interface in gmc early init phase and set xgmi.connected_to_cpu accordingly Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit 63d3dc9dc46c189df6ed1e2a9e8c1ff8b1920f26 Author: Hawking Zhang Date: Wed Jan 21 00:12:36 2026 +0800 drm/amdgpu/gmc12: Fix VRAM base offset calculation Include segment size when calculating vram base offset Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Signed-off-by: Alex Deucher commit ae19135340f6556cf3790aedb4b589adc1e3676a Author: Hawking Zhang Date: Sat Jan 17 19:18:06 2026 +0800 drm/amdgpu/gmc12: Query host-gpu interface Query host-gpu interconnect type for gmc v12 devices Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit ec5d2d2d55b596f2ada28b545c9cef78036c74ec Author: Hawking Zhang Date: Sat Jan 17 20:34:44 2026 +0800 drm/amdgpu: Retire get_xgmi_info callback for gfxhub v12_1 gfxhub v12_1 is not always on. querying xgmi info from it may not work consistently Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit be3f235bb61b71fc5635c4459fee372252acd772 Author: Hawking Zhang Date: Sat Jan 17 20:33:06 2026 +0800 drm/amdgpu: Query xgmi info from mmhub if available Query xgmi info from mmhub if available Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 20fe5d020fe5a68d640828af7a42a1ee1a030db6 Author: Hawking Zhang Date: Sat Jan 17 20:25:36 2026 +0800 drm/amdgpu: Implement get_xgmi_info callback for mmhub_v4_2 Query memory region assignment and address via mmhub Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 5aff5c6831da26425255461c7a227d6e165fde02 Author: Hawking Zhang Date: Sat Jan 17 19:47:09 2026 +0800 drm/amdgpu/gmc12: Update gmc aperture base for A + A Query mmhub MC_VM_FB_OFFSET, XGMI_LFB_CNTL|SIZE registers to calculate gmc apeture base address for A + A configuration Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit c5f8454cd195267c6934f731d9d3be65395e53b9 Author: Hawking Zhang Date: Sat Jan 17 19:25:56 2026 +0800 drm/amdgpu/gmc12: Bypass FB resize on A + A platform Resizing fb bar is not needed/supported on A + A platform. Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 7c5ce459dd0f543112b6b37534b367420aee9aea Author: Hawking Zhang Date: Sat Jan 17 18:36:37 2026 +0800 drm/amdgpu: Update gfxhub system aperture settings for A + A Bypass the programming from SRIOV guest Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 23b4886a609a3bf8c2ba2857a8758f09e87d3759 Author: Hawking Zhang Date: Sat Jan 17 18:31:50 2026 +0800 drm/amdgpu: Correct mmhub system aperture settings for A + A Disable AGP and FB apeture on all available MMHUB instances when vmid0 page table is enabled Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 8392ca2d7ef3a8a8f16c24ec52a1315efae52f76 Author: Hawking Zhang Date: Sat Jan 17 17:18:10 2026 +0800 drm/amdgpu/gmc12: Set up pdb0 for vmid0 page table Alloc, Init and free pdb0 for vmid0 page table that is used for fb translation on A + A platform Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 5aca9e0e82c541740428746400d7dcc90f4e0820 Author: Hawking Zhang Date: Sat Jan 17 16:54:52 2026 +0800 drm/amdgpu: Init table depth and block_size for A + A Initialize page table depth and page table block size for 2-level gart table construction on A + A platform Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit e221c5f6aeca913d2bb53d2756788b0466f5ad65 Author: Hawking Zhang Date: Sat Jan 17 16:33:40 2026 +0800 drm/amdgpu: Place gart and vram in sysvm aper for A + A On A + A platform, sysvm aperture is used for both vram and gart access. In sysvm aperture, vram starts at 0, and gart starts right after vram. Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit cc692ae3e10ea9c84e280a01a325609af69455cf Author: Hawking Zhang Date: Sat Jan 17 16:01:20 2026 +0800 drm/amdgpu: Limit physical transcation mode to A + A only Only enable page table walker to snoop CPU cache on A + A platform Signed-off-by: Hawking Zhang Reviewed-by: Le Ma Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit 5abc46d134995715b69ed0a640a31ed43a1486bc Author: Harish Kasiviswanathan Date: Sat Feb 14 18:28:28 2026 -0500 drm/amdgpu: Support forcing MTYPE_RW Set default value of module parameter amdgpu_mtype_local to -1. This allows to force MTYPE_RW on ASICs where MTYPE_RW is not default. v2: Fix SDMA get_vm_pte_pde MTYPE Signed-off-by: Harish Kasiviswanathan Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit f6e9582a7f6a9764a2baf1615c14c98a371d4f6b Author: Harish Kasiviswanathan Date: Thu Jan 29 14:17:22 2026 -0500 drm/amdgpu: Update MTYPE for GFX12.1 Update MTYPE for GFX12.1 for AID A0 and A1 Signed-off-by: Harish Kasiviswanathan Reviewed-by: Philip.Yang Signed-off-by: Alex Deucher commit e04030139313a95fbce55d9f51828c69e83eba90 Author: Harish Kasiviswanathan Date: Wed Jan 28 10:54:10 2026 -0500 drm/amdkfd: Don't expect signal mailbox update GFX12.1 CP to improve performance has removed updating event_id into signal mailbox. In future, this optimization can be extended to older ASICs. Update driver code to handle this case. Signed-off-by: Harish Kasiviswanathan Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 90ddf27942580acd0cdd688fd1d190e6aaec2f53 Author: Likun Gao Date: Fri Jan 9 10:34:20 2026 +0800 drm/amdgpu: update cp packets for gfx v12_1 Clean up some unsupport CP packets for gfx v12_1. Update CP packets for gfx v12_1 with some new definition. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 426ffb7069ae40378e73f58ea0e6475c7ef29a1d Author: Likun Gao Date: Fri Jan 9 13:19:38 2026 +0800 drm/amdgpu: retire some unsupport cmd pkt bit for gfx v12_1 Retire some unsupport CP command bit set for gfx v12_1. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit f56e29b86389a67450aaac8b718576ca5451a8cb Author: Alex Sierra Date: Wed Dec 17 07:35:10 2025 -0600 drm/amdgpu: 57-bit enable for watch address on gfx_v12_1 Add 57-bit support for debugger set watch address API Signed-off-by: Alex Sierra Co-authored-by: Alexey Kondratiev Reviewed-by: Philip.Yang Signed-off-by: Alex Deucher commit f1d7a87634b3930d083eb955513abf765a8d1d6a Author: Jack Xiao Date: Fri Dec 5 16:45:41 2025 +0800 drm/amdgpu/mes12_1: fix the failure access to MID1 registers Correct the mid die id and mid1 register relative offset for mes fw to access to mid1 registers. Signed-off-by: Jack Xiao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 189208d3d503090d95a39e85433bd608a0d84511 Author: Philip Yang Date: Tue Dec 9 16:01:10 2025 -0500 drm/amdkfd: Update queue properties for metadata ring Metadata ring and queue ring is allocated as one buffer and map to GPU, so update queue peoperties should add the queue metadata size and ring size as buffer size to validate queue ring buffer. Fixes: c51bb53d5c68 ("drm/amdkfd: Add metadata ring buffer for compute") Signed-off-by: Philip Yang Reviewed-by: Alex Sierra Signed-off-by: Alex Deucher commit 29756a7535facdaed39d0b5572201068a7746812 Author: Sreekant Somasekharan Date: Thu Nov 6 19:15:11 2025 -0500 drm/amdgpu: Revert setting up Retry based Thrashing on GFX 12.1 Bug found with retry based thrashing mechanism. Revert to the old thrashing method. Signed-off-by: Sreekant Somasekharan Reviewed-by: Mukul Joshi Signed-off-by: Alex Deucher commit 370deb69ea618130c396ed4f33f035773c3d7420 Author: Michael Chen Date: Tue Jan 6 15:22:57 2026 +0800 drm/amdgpu: Fix RRMT for gfx v12_1 Correct NORMALIZE_XCC_REG_OFFSET to 0xFFFF because reg offset is in DW. Also set mode 3 temporarily for out of XCD access for MMHUB TLB flush. Will need to figure out how to differentiate between AID and MID access later. Signed-off-by: Michael Chen Reviewed-by: Alex Sierra Signed-off-by: Alex Deucher commit 44e5195fa3d4f14cfef6fcec0ccc32a08bac1d87 Author: Jack Xiao Date: Wed Jun 11 10:11:13 2025 +0800 drm/amdgpu/mes_v12_1: add mes self test Add mes self test to ensure that mes user queue work. V2: add pasid on amdgpu_vm_init. V3: Squash in fix non-SPX modes (Mukul) Signed-off-by: Jack Xiao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 3fd20c149e3ef75f472fdf15da35846dc0dabe54 Author: Sunil Khatri Date: Fri Mar 13 23:11:44 2026 +0530 Revert "drm/amdgpu: revert to old status lock handling v4" This reverts commit 7a9419ab42699fd3d4c857ef81ae097d8d8d5899. Reverting due to some of the probable issues caused by this change and CI is blocked. Signed-off-by: Sunil Khatri Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit d8f9f42effd767ffa7bbcd7e05fbd6b20737e468 Author: Alex Hung Date: Wed Mar 11 15:18:37 2026 -0600 drm/amd/display: Fix gamma 2.2 colorop TFs Use GAMMA22 for degamma/blend and GAMMA22_INV for shaper so curves match the color pipeline. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5016 Tested-by: Xaver Hugl Reviewed-by: Melissa Wen Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Alex Deucher commit 2727d44f5d5bc3f8e55a6a0ccf24d8105a5a400e Author: Kit Dallege Date: Sun Mar 15 18:09:31 2026 +0100 writeback: fix kernel-doc function name mismatch for wb_put_many() The kernel-doc comment says wb_put but the actual function is wb_put_many. Fix the name to match. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Kit Dallege Link: https://patch.msgid.link/20260315170931.65852-1-xaum.io@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 8737d7194d6d5947c3d7d8813895b44a25b84477 Author: Lorenzo Bianconi Date: Fri Mar 13 17:28:36 2026 +0100 net: airoha: select QDMA block according LAN/WAN configuration Before this patch even GDM ports were assigned to QDMA0 while odd GDM ports were using QDMA1, so, based on the DTS configuration, both QDMA0 and QDMA1 can theoretically receive traffic destinated to the host cpu from LAN or WAN GDM ports. Airoha folks reported the hw design assumes the LAN traffic destinated to the host cpu is be forwarded to QDMA0 while traffic received on WAN GDM port is managed by QDMA1. For this reason, select QDMA block according to the GDM port LAN or WAN configuration: - QDMA0 is used for GDM LAN devices - QDMA1 is used for GDM WAN device Assuming a device with three GDM ports, a typical configuration could be: - MT7530 DSA switch -> GDM1 (eth0) -> QDMA0 (LAN traffic) - External PHY -> GDM2 (eth1) -> QDMA1 (WAN traffic) - External PHY -> GDM3 (eth2) -> QDMA0 (LAN traffic) We can then bridge eth0 DSA port (lanX) with eth2 since they all tx/rx LAN traffic. Please note this patch introduces a change not visible to the user since airoha_eth driver currently supports just the internal phy available via the MT7530 DSA switch and there are no WAN interfaces officially supported since PCS/external phy is not merged mainline yet (it will be posted with following patches). Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260313-airoha-qdma-lan-wan-mode-v2-1-7d577db6e40c@kernel.org Signed-off-by: Paolo Abeni commit a93a51f42ac354425a252210183c4151d991f75d Author: LiPeng Huang Date: Thu Feb 5 09:48:52 2026 +0800 media: lirc: increase IR_MAX_DURATION to send extended code sequences sensor:increase IR_MAX_DURATION to 1000ms to fix long IR remote timeouts Certain infrared remotes (e.g., brand-specific smart home remotes, custom consumer electronics) send extended code sequences that exceed the default 500ms IR_MAX_DURATION threshold. This causes the kernel's raw IR driver to discard incomplete code, resulting in unrecognized commands. Increase IR_MAX_DURATION to 1000ms: - Aligns with common extended IR protocol specs (most long sequences use 700-900ms) - No impact on standard remotes (all mainstream IR codes are <500ms) - Validated on vivo X200 and vivo X300, resolves timeout issues without regressions Signed-off-by: LiPeng Huang Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 1f03894b2830e21f62659a803d76d06918deb3b3 Author: Johan Hovold Date: Thu Mar 5 11:39:17 2026 +0100 media: mceusb: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 88796a18f20f0a9d9ffccecb3be3d37dfa3391d6 Author: Johan Hovold Date: Thu Mar 5 11:39:16 2026 +0100 media: imon: drop redundant device references Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device references to reduce cargo culting, make it easier to spot drivers where extra references are needed, and reduce the risk of memory leaks when drivers fail to release them. Signed-off-by: Johan Hovold Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 50acaad3d202c064779db8dc3d010007347f59c7 Author: Oliver Neukum Date: Wed Feb 11 19:11:04 2026 +0100 media: rc: ttusbir: respect DMA coherency rules Buffers must not share a cache line with other data structures. Allocate separately. Fixes: 0938069fa0897 ("[media] rc: Add support for the TechnoTrend USB IR Receiver") Cc: stable@vger.kernel.org Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit eac69475b01fe1e861dfe3960b57fa95671c132e Author: Oliver Neukum Date: Wed Feb 11 19:11:51 2026 +0100 media: rc: igorplugusb: heed coherency rules In a control request, the USB request structure can be subject to DMA on some HCs. Hence it must obey the rules for DMA coherency. Allocate it separately. Fixes: b1c97193c6437 ("[media] rc: port IgorPlug-USB to rc-core") Cc: stable@vger.kernel.org Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff Author: Oliver Neukum Date: Wed Feb 11 19:09:44 2026 +0100 media: rc: xbox_remote: heed DMA restrictions The buffer for IO must not be part of the device structure because that violates the DMA coherency rules. Fixes: 02d32bdad3123 ("media: rc: add driver for Xbox DVD Movie Playback Kit") Cc: stable@vger.kernel.org Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 42844992664f03ef9f930e64f7370fa481e9c267 Author: Oliver Neukum Date: Wed Feb 11 19:06:21 2026 +0100 media: rc: streamzap: Error handling in probe If submitting the URB fails, the device will be unusable. Probe() must fail. Fixes: 7a569f524dd36 ("V4L/DVB: IR/streamzap: functional in-kernel decoding") Cc: stable@vger.kernel.org Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit dccc0c3ddf8f16071736f98a7d6dd46a2d43e037 Author: Sean Young Date: Sat Dec 20 10:33:26 2025 +0000 media: rc: fix race between unregister and urb/irq callbacks Some rc device drivers have a race condition between rc_unregister_device() and irq or urb callbacks. This is because rc_unregister_device() does two things, it marks the device as unregistered so no new commands can be issued and then it calls rc_free_device(). This means the driver has no chance to cancel any pending urb callbacks or interrupts after the device has been marked as unregistered. Those callbacks may access struct rc_dev or its members (e.g. struct ir_raw_event_ctrl), which have been freed by rc_free_device(). This change removes the implicit call to rc_free_device() from rc_unregister_device(). This means that device drivers can call rc_unregister_device() in their remove or disconnect function, then cancel all the urbs and interrupts before explicitly calling rc_free_device(). Note this is an alternative fix for an issue found by Haotian Zhang, see the Closes: tags. Reported-by: Haotian Zhang Closes: https://lore.kernel.org/linux-media/20251114101432.2566-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114101418.2548-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114101346.2530-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114090605.2413-1-vulab@iscas.ac.cn/ Reviewed-by: Patrice Chotard Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit fa5062e99b984448b7c8ca9aea47e7fc033b6e2f Author: Vishnu Sankar Date: Wed Mar 11 23:31:44 2026 +0900 Documentation: thinkpad-acpi - Document doubletap_enable attribute Document the doubletap_enable sysfs attribute for ThinkPad ACPI driver. Signed-off-by: Vishnu Sankar Link: https://patch.msgid.link/20260311143144.482145-4-vishnuocv@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6227cc32fa01ffbf5bef8dcc6759743a28a2ad57 Author: Vishnu Sankar Date: Wed Mar 11 23:31:43 2026 +0900 platform/x86: thinkpad_acpi: Add sysfs control for TrackPoint double-tap Add a sysfs attribute to enable or disable TrackPoint double-tap hotkey events at the kernel level. The TrackPoint firmware enables double-tap support automatically. This interface allows userspace to control whether double-tap events are forwarded to userspace. The attribute is available at: /sys/devices/platform/thinkpad_acpi/doubletap_enable 0 - Disable double-tap hotkey events 1 - Enable double-tap hotkey events (default) Filtering is implemented by suppressing ACPI hotkey delivery without injecting synthetic input events. Signed-off-by: Vishnu Sankar Suggested-by: Mark Pearson Link: https://patch.msgid.link/20260311143144.482145-3-vishnuocv@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 9a98ebe630cf13c1a6063afa676d1cecc44fb2c9 Author: Vishnu Sankar Date: Wed Mar 11 23:31:42 2026 +0900 input: trackpoint - Enable doubletap by default on capable devices Enable doubletap functionality by default on TrackPoint devices that support it. The feature is detected using firmware ID pattern matching (PNP: LEN03xxx) with a deny list of incompatible devices. This provides immediate doubletap functionality without requiring userspace configuration. The hardware is enabled during device detection, while event filtering continues to be handled by the thinkpad_acpi driver as before. Signed-off-by: Vishnu Sankar Suggested-by: Mark Pearson Acked-by: Dmitry Torokhov Link: https://patch.msgid.link/20260311143144.482145-2-vishnuocv@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a11661a58c06f7fdfef03a368ef20d05a4ea4ed0 Author: Shameer Kolothum Date: Tue Mar 17 11:16:03 2026 +0000 iommufd: Report ATS not supported status via IOMMU_GET_HW_INFO If the IOMMU driver reports that ATS is not supported for a device, set the IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED flag in the returned hardware capabilities. This uses a negative flag for UAPI compatibility. Existing userspace assumes ATS is supported if no flag is present. This also ensures that new userspace works correctly on both old and new kernels, where a zero value implies ATS support. When this flag is set, ATS cannot be used for the device. When it is clear, ATS may be enabled when an appropriate HWPT is attached. Reviewed-by: Samiullah Khawaja Reviewed-by: Jason Gunthorpe Signed-off-by: Shameer Kolothum Signed-off-by: Joerg Roedel commit a82efb8747d1b8a7c0a377dc79c2aac204eae788 Author: Shameer Kolothum Date: Tue Mar 17 11:16:02 2026 +0000 iommu: Add device ATS supported capability PCIe ATS may be disabled by platform firmware, root complex limitations, or kernel policy even when a device advertises the ATS capability in its PCI configuration space. Add a new IOMMU_CAP_PCI_ATS_SUPPORTED capability to allow IOMMU drivers to report the effective ATS decision for a device. When this capability is true for a device, ATS may be enabled for that device, but it does not imply that ATS is currently enabled. A subsequent patch will extend iommufd to expose the effective ATS status to userspace. Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Signed-off-by: Shameer Kolothum Signed-off-by: Joerg Roedel commit d6c65b0fd6218bd21ed0be7a8d3218e8f6dc91de Author: Jason Gunthorpe Date: Fri Feb 27 15:30:11 2026 -0400 iommupt: Avoid rewalking during map Currently the core code provides a simplified interface to drivers where it fragments a requested multi-page map into single page size steps after doing all the calculations to figure out what page size is appropriate. Each step rewalks the page tables from the start. Since iommupt has a single implementation of the mapping algorithm it can internally compute each step as it goes while retaining its current position in the walk. Add a new function pt_pgsz_count() which computes the same page size fragement of a large mapping operations. Compute the next fragment when all the leaf entries of the current fragement have been written, then continue walking from the current point. The function pointer is run through pt_iommu_ops instead of iommu_domain_ops to discourage using it outside iommupt. All drivers with their own page tables should continue to use the simplified map_pages() style interfaces. Reviewed-by: Samiullah Khawaja Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Reviewed-by: Lu Baolu Signed-off-by: Joerg Roedel commit 99fb8afa16add85ed016baee9735231bca0c32b4 Author: Jason Gunthorpe Date: Fri Feb 27 15:30:10 2026 -0400 iommupt: Directly call iommupt's unmap_range() The common algorithm in iommupt does not require the iommu_pgsize() calculations, it can directly unmap any arbitrary range. Add a new function pointer to directly call an iommupt unmap_range op and make __iommu_unmap() call it directly. Gives about a 5% gain on single page unmappings. The function pointer is run through pt_iommu_ops instead of iommu_domain_ops to discourage using it outside iommupt. All drivers with their own page tables should continue to use the simplified map/unmap_pages() style interfaces. Reviewed-by: Samiullah Khawaja Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Reviewed-by: Lu Baolu Signed-off-by: Joerg Roedel commit b2e5684558edf3e9bbe18d0e0043854994eab1be Author: Fangyu Yu Date: Fri Feb 27 19:26:40 2026 +0800 iommu/riscv: Stop polling when CQCSR reports an error The cmdq wait loop busy-polls the consumer index until it advances or the software timeout expires. If the IOMMU has already signaled a command queue failure in CQCSR, continuing to poll for progress is pointless. Make riscv_iommu_queue_wait() also terminate the poll when any of these CQCSR error bits are observed. This helps the caller return earlier in failure cases and avoids spinning until the full timeout interval when the hardware has already reported an error. On single-core systems in particular, the current busy-wait can delay servicing the command-timeout interrupt until the software timeout expires (90s by default). Fixes: 856c0cfe5c5f ("iommu/riscv: Command and fault queue support") Signed-off-by: Fangyu Yu Signed-off-by: Joerg Roedel commit 68e8619d221400f094490644dce9d3a4efffb6c5 Merge: fdd973148a117f f45797fe02df34 Author: Paolo Abeni Date: Tue Mar 17 13:32:35 2026 +0100 Merge branch 'initial-support-for-pic64-hpsc-hx-ethernet-endpoint' Charles Perry says: ==================== Initial support for PIC64-HPSC/HX Ethernet endpoint This series add basic support for Microchip "PIC64-HPSC" and "PIC64HX" Ethernet endpoint. Both SoCs contain 4 GEM IP with support for MII/RGMII/SGMII/USXGMII at rates of 10M to 10G. Only RGMII and SGMII at a rate of 1G is tested for now. Each GEM IP has 8 priority queues and the revision register reads 0x220c010e. One particularity of this instantiation of GEM is that the MDIO controller within the GEM IP is disconnected from any physical pin and the SoC rely on another standalone MDIO controller. The maximum jumbo frame size also seems to be different on PIC64-HPSC/HX (16383) than what most other platforms use (10240). I've found that I need to tweak a bit the MTU calculation for this, otherwise the RXBS field of the DMACFG register overflows. See patch 2 for more details. PIC64-HPSC/HX also supports other features guarded behind CAPS bit like MACB_CAPS_QBV but I've omitted those intentionally because I didn't test these. ==================== Link: https://patch.msgid.link/20260313140610.3681752-1-charles.perry@microchip.com Signed-off-by: Paolo Abeni commit f45797fe02df3459bb9cef6886fe0cfa3ed273bd Author: Charles Perry Date: Fri Mar 13 07:06:10 2026 -0700 net: macb: add support for Microchip pic64hpsc ethernet endpoint pic64hpsc doesn't have the USRIO register so MACB_CAPS_USRIO_DISABLED is used. pic64hpsc does support PTP and has the timestamping unit so MACB_CAPS_GEM_HAS_PTP is used. jumbo_max_len is set to 16383 (0x3FFF) as reported by the DCFG2 register bits 0..13. The JML register also has a default value of 0x3FFF. dma_burst_length is set to 16 because that's what most other platforms use and it worked for me so far. There is one other mode where bursts of up to 256 are allowed but this might impact negatively other masters on the NOC. The register default value is 4 (bursts up to 4). Signed-off-by: Charles Perry Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260313140610.3681752-4-charles.perry@microchip.com Signed-off-by: Paolo Abeni commit 363a99af19a7f5c7ddd7571e39f3ae6663397bb6 Author: Charles Perry Date: Fri Mar 13 07:06:09 2026 -0700 net: macb: add safeguards for jumbo frame larger than 10240 The RX buffers for GEM can have a maximum size of 16320 bytes (0xff in the RXBS field of the DMACFG register means 255*64 = 16320 bytes). The GEM IP has configurable maximum jumbo frame length that can go up to 16383. The actual value for this limit can be found in the "jumbo_max_length" field (bits 0..13) of the DCFG2 register. Currently, the macb driver doesn't use the DCFG2 register when determining the max MTU, instead an hardcoded value (jumbo_max_len in struct macb_config) is used for each platform. Right now the maximum value for jumbo_max_len is 10240 (0x2800). GEM uses one buffer per packet which means that one buffer must allow room for the max MTU plus L2 encapsulation and alignment. This is a limitation of the driver. This commit adds a limit to max_mtu and rx_buffer_size so that the RXBS field can never overflow when a large MTU is used. With this commit, it is now possible to add new platforms with a jumbo_max_len of 16383 so that the hardware properties of each IP can be properly captured in struct macb_config. Signed-off-by: Charles Perry Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260313140610.3681752-3-charles.perry@microchip.com Signed-off-by: Paolo Abeni commit 63e9d434ddc8b2f7b8b6a6d31611736981edc9ca Author: Charles Perry Date: Fri Mar 13 07:06:08 2026 -0700 dt-bindings: net: cdns,macb: add a compatible for Microchip pic64hpsc Add "microchip,pic64hpsc-gem" for "PIC64-HPSC" and "microchip,pic64hx-gem" for "PIC64HX", compatible with the former. The generic compatible "cdns,gem" works but offers limited features. Keep it as a fallback. The GEM IPs within pic64hpsc have their MDIO controllers unconnected from any physical pin. Add a check to prevent adding PHYs under the GEM node. Signed-off-by: Charles Perry Acked-by: Conor Dooley Link: https://patch.msgid.link/20260313140610.3681752-2-charles.perry@microchip.com Signed-off-by: Paolo Abeni commit fa8fb60d36375ca3166a60589a624f0d0bc9ddb5 Author: lynn Date: Sat Feb 14 08:09:19 2026 +0000 iommu/iova: Add NULL check in iova_magazine_free() When iova_domain_init_rcaches() fails to allocate an iova_magazine during the initialization of per-cpu rcaches, it jumps to out_err and calls free_iova_rcaches() for cleanup. In free_iova_rcaches(), the code iterates through all possible CPUs to free both cpu_rcache->loaded and cpu_rcache->prev. However, if the original allocation failed mid-way through the CPU loop, the pointers for the remaining CPUs remain NULL. Since kmem_cache_free() does not explicitly handle NULL pointers like kfree() does, passing these NULL pointers leads to a kernel paging request fault. Add a NULL check in iova_magazine_free() to safely handle partially initialized rcaches in error paths. Signed-off-by: lynn Signed-off-by: Joerg Roedel commit 1e0c8d6b695217cb0b16f13e31c7f08b453097b4 Author: Li RongQing Date: Tue Feb 10 22:58:39 2026 -0500 iommu/amd: Add NUMA node affinity for IOMMU log buffers Currently, PPR Log and GA logs for AMD IOMMU are allocated using iommu_alloc_pages_sz(), which does not account for NUMA affinity. This can lead to remote memory access latencies if the memory is allocated on a different node than the IOMMU hardware. Switch to iommu_alloc_pages_node_sz() to ensure that these data structures are allocated on the same NUMA node as the IOMMU device. If the node information is unavailable, it defaults to NUMA_NO_NODE. Signed-off-by: Li RongQing Reviewed-by: Vasant Hegde Reviewed-by: Ankit Soni Signed-off-by: Joerg Roedel commit 199036ae01321651fe0e4488f9e19a28af4c5f1d Author: Jason Gunthorpe Date: Fri Feb 27 11:27:02 2026 -0400 iommupt: Optimize the gather processing for DMA-FQ mode In PT_FEAT_FLUSH_RANGE mode the gather was accumulated but never flushed and then the accumulated range was discarded by the dma-iommu code in DMA-FQ mode. This is basically optimal. However for PT_FEAT_FLUSH_RANGE_NO_GAPS the page table would push flushes that are redundant with the flush all generated by the DMA-FQ mode. Disable all range accumulation in the gather, and iommu_pt triggered flushing when in iommu_iotlb_gather_queued() indicates it is in DMA-FQ mode. Reported-by: Robin Murphy Closes: https://lore.kernel.org/r/794b6121-b66b-4819-b291-9761ed21cd83@arm.com Signed-off-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Samiullah Khawaja Signed-off-by: Joerg Roedel commit 7cd0c655f02f08a5de851059ac8360e5d10fae62 Author: Jason Gunthorpe Date: Fri Feb 27 11:25:41 2026 -0400 iommu/riscv: Allow RISC_VIOMMU to COMPILE_TEST This driver used to use a lot of page table constants from the architecture code which prevented COMPILE_TEST on other architectures. Now that iommupt provides all of the constants internally there are only two small bumps preventing COMPILE_TEST. - Use the generic functions for the riscv specific phys_to_pfn() and pfn_to_phys() - Use CONFIG_MMIOWB to block off the mmiowb() barrier - Require 64 bit because of writeq use failing compilation on 32 bit Tested-by: Vincent Chen Acked-by: Paul Walmsley # arch/riscv Reviewed-by: Tomasz Jeznach Tested-by: Tomasz Jeznach Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit c70d20b25ca30d68b377b9363a2adca6eb2538e3 Author: Jason Gunthorpe Date: Fri Feb 27 11:25:40 2026 -0400 iommu/riscv: Add missing GENERIC_MSI_IRQ The commit below added MSI related calls to the driver that depends on GENERIC_MSI_IRQ. It is possible to build RISC-V without this selected. This is also necessary to make the driver COMPILE_TEST. Fixes: d5f88acdd6ff ("iommu/riscv: Add support for platform msi") Tested-by: Vincent Chen Tested-by: Tomasz Jeznach Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 69541898b71a8cb8a06706c67a2f756623598aa0 Author: Jason Gunthorpe Date: Fri Feb 27 11:25:39 2026 -0400 iommu/riscv: Enable SVNAPOT support for contiguous ptes This turns on a 64k page size. The "RISC-V IOMMU Architecture Specification" states: 6.4 IOMMU capabilities [..] IOMMU implementations must support the Svnapot standard extension for NAPOT Translation Contiguity. So just switch it on unconditionally. Cc: Xu Lu Tested-by: Vincent Chen Acked-by: Paul Walmsley # arch/riscv Reviewed-by: Tomasz Jeznach Tested-by: Tomasz Jeznach Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit e5ef32191a87da48a0f6cab2ca5f7d8b4a0fa054 Author: Jason Gunthorpe Date: Fri Feb 27 11:25:38 2026 -0400 iommu/riscv: Use the generic iommu page table This is a fairly straightforward conversion of the RISC-V iommu driver to use the generic iommu page table code. Invalidation stays as it is now with the driver pretending to implement simple range based invalidation even though the HW is more like ARM SMMUv3 than AMD where the HW implements a single-PTE based invalidation. Future work to extend the generic invalidate mechanism to support more ARM-like semantics would benefit this driver as well. Delete the existing page table code. Tested-by: Vincent Chen Acked-by: Paul Walmsley # arch/riscv Reviewed-by: Tomasz Jeznach Tested-by: Tomasz Jeznach Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit e93e4a6363b8f812cb89f2b2d97cbaf017a3d7f8 Author: Jason Gunthorpe Date: Fri Feb 27 11:25:37 2026 -0400 iommu/riscv: Disable SADE In terms of the iommu subystem the SADE/GADE feature "3.4. IOMMU updating of PTE accessed (A) and dirty (D) updates" is called dirty tracking. There is no reason to enable HW support for this, and the HW cost associated with it, unless dirty tracking is actually enabled through iommufd. It should be a dynamic feature linked to user request. Further, without implementing the read dirty ops the whole thing is pointless. Do not set DC.tc.SADE just because the HW has support for dirty tracking. Tested-by: Vincent Chen Acked-by: Paul Walmsley # arch/riscv Reviewed-by: Tomasz Jeznach Tested-by: Tomasz Jeznach Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit e71e00127110dedc6a9e746178282b4dac97ed96 Author: Jason Gunthorpe Date: Fri Feb 27 11:25:36 2026 -0400 iommupt: Add the RISC-V page table format The RISC-V format is a fairly simple 5 level page table not unlike the x86 one. It has optional support for a single contiguous page size of 64k (16 x 4k). The specification describes a 32-bit format, the general code can support it via a #define but the iommu side implementation has been left off until a user comes. Tested-by: Vincent Chen Acked-by: Paul Walmsley # arch/riscv Reviewed-by: Tomasz Jeznach Tested-by: Tomasz Jeznach Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 7217cee35aadbb07e12673bcf1dcf729e1b2f6c9 Author: Yaxing Guo Date: Fri Jan 30 14:54:20 2026 +0800 iommu/riscv: Skip IRQ count check when using MSI interrupts In RISC-V IOMMU platform devices that use MSI interrupts (indicated by the presence of 'msi-parent' in the device tree), there are no wired interrupt lines, so calling platform_get_irq_count() returns 0 or -ENXIO, causing the driver to fail during probe. However, MSI interrupts are allocated dynamically via the MSI subsystem and do not appear in the device tree 'interrupts' property. Therefore, the driver should not require a non-zero IRQ count when 'msi-parent' is present. This patch fixes the bug where probe fails when using MSI interrupts (which do not have an 'interrupts' property in the device tree).. Fixes: ("iommu/riscv: Add support for platform msi") Signed-off-by: Yaxing Guo Reviewed-by: Andrew Jones Signed-off-by: Joerg Roedel commit f5c262b544975e067ea265fc7403aefbbea8563e Author: Fangyu Yu Date: Thu Jan 22 22:32:24 2026 +0800 iommu/riscv: Add IOTINVAL after updating DDT/PDT entries Add riscv_iommu_iodir_iotinval() to perform required TLB and context cache invalidations after updating DDT or PDT entries, as mandated by the RISC-V IOMMU specification (Section 6.3.1 and 6.3.2). Fixes: 488ffbf18171 ("iommu/riscv: Paging domain support") Signed-off-by: Fangyu Yu Reviewed-by: Andrew Jones Signed-off-by: Joerg Roedel commit fdd973148a117f3244c9a0a6abf343da57f76ea7 Author: Fernando Fernandez Mancera Date: Fri Mar 13 13:48:27 2026 +0100 selftests: net: add ipv6 RA route to ECMP merge test As commit bbf4a17ad9ff ("ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF") pointed out, RA routes are not elegible for ECMP merging. Add a test scenario mixing RA and static routes with gateway to check that they are not getting merged. Signed-off-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260313124827.3945-1-fmancera@suse.de Signed-off-by: Paolo Abeni commit 1c0028e725f156ebabe68b0025f9c8e7a6170ffd Author: Binbin Zhou Date: Sat Mar 7 11:25:37 2026 +0800 dmaengine: loongson: New driver for the Loongson Multi-Channel DMA controller This DMA controller appears in Loongson-2K0300 and Loongson-2K3000. It is a chain multi-channel controller that enables data transfers from memory to memory, device to memory, and memory to device, as well as channel prioritization configurable through the channel configuration registers. In addition, there are slight differences between Loongson-2K0300 and Loongson-2K3000, such as channel register offsets and the number of channels. Reviewed-by: Frank Li Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://patch.msgid.link/73bc32ba6249f1eef94fec9b349bc9efa98278ea.1772853681.git.zhoubinbin@loongson.cn Signed-off-by: Vinod Koul commit 7a65e81e8e2e58b0db9f2dedda410ee2b6042859 Author: Binbin Zhou Date: Sat Mar 7 11:25:36 2026 +0800 dt-bindings: dmaengine: Add Loongson Multi-Channel DMA controller The Loongson-2K0300/Loongson-2K3000 have built-in multi-channel DMA controllers, which are similar except for some of the register offsets and number of channels. Obviously, this is quite different from the APB DMA controller used in the Loongson-2K0500/Loongson-2K1000, such as the latter being a single-channel DMA controller. To avoid cluttering a single dt-binding file, add a new yaml file. Reviewed-by: Rob Herring (Arm) Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://patch.msgid.link/135802de72b84f643d0b0624f3f79f13777147a1.1772853681.git.zhoubinbin@loongson.cn Signed-off-by: Vinod Koul commit 9de4303fc04977d15b257726a6519caca687c43a Author: Binbin Zhou Date: Sat Mar 7 11:25:35 2026 +0800 dmaengine: loongson: loongson2-apb: Simplify locking with guard() and scoped_guard() Use guard() and scoped_guard() infrastructure instead of explicitly acquiring and releasing spinlocks to simplify the code and ensure that all locks are released properly. Reviewed-by: Frank Li Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://patch.msgid.link/fb59bb25e5c4fcb84d9aa7b351285fa8d02ea8cb.1772853681.git.zhoubinbin@loongson.cn Signed-off-by: Vinod Koul commit bdf1621a6a67b6327e2a26a1d47bffcde3be3b26 Author: Binbin Zhou Date: Sat Mar 7 11:25:12 2026 +0800 dmaengine: loongson: loongson2-apb: Convert to devm_clk_get_enabled() Use the devm_clk_get_enabled() helper function to simplify the probe routine. Reviewed-by: Frank Li Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://patch.msgid.link/4f3aad22d14e730cc040ece8b0ced37853d52876.1772853681.git.zhoubinbin@loongson.cn Signed-off-by: Vinod Koul commit 7d348227f4961bbf21255281438ee3aebe12830f Author: Binbin Zhou Date: Sat Mar 7 11:25:11 2026 +0800 dmaengine: loongson: loongson2-apb: Convert to dmaenginem_async_device_register() Use the dmaenginem_async_device_register() helper function to simplify the probe routine. Reviewed-by: Frank Li Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://patch.msgid.link/c56e67ecde38e9a3bda5f88ea3fc20b97a5cba6c.1772853681.git.zhoubinbin@loongson.cn Signed-off-by: Vinod Koul commit ffee2dc04e7e06534aaa4fd51ef89645b809b6b8 Author: Binbin Zhou Date: Sat Mar 7 11:25:10 2026 +0800 dmaengine: loongson: New directory for Loongson DMA controllers drivers Gather the Loongson DMA controllers under drivers/dma/loongson/ Reviewed-by: Frank Li Signed-off-by: Binbin Zhou Reviewed-by: Keguang Zhang Reviewed-by: Huacai Chen Link: https://patch.msgid.link/0a0853a85630724741061f6fe08680610e49a06e.1772853681.git.zhoubinbin@loongson.cn Signed-off-by: Vinod Koul commit 5aeb6e039972312ecfdf7e54573e2729a5974df2 Author: Michael Margolin Date: Mon Mar 16 18:08:46 2026 +0000 RDMA/efa: Rename alloc_ucontext comp_mask to supported_caps Following discussion [1], rename the comp_mask field in efa_ibv_alloc_ucontext_cmd to supported_caps to reflect its actual usage as a capabilities handshake mechanism rather than a standard comp_mask. Rename related constants and align function and macro names. [1] https://lore.kernel.org/linux-rdma/20260312120858.GH1448102@nvidia.com/ Signed-off-by: Michael Margolin Link: https://patch.msgid.link/20260316180846.30273-1-mrgolin@amazon.com Signed-off-by: Leon Romanovsky commit 9bc3b976eb9db54721813d51f2e71553285e24ad Merge: 3e90f5103a8b19 50a9b75d77611f Author: Georgi Djakov Date: Tue Mar 17 12:57:00 2026 +0200 Merge branch 'icc-qcs615' into icc-next This series enables QoS configuration for QNOC type device which can be found on QCS615 platform. It enables QoS configuration for master ports with predefined priority and urgency forwarding. This helps in prioritizing the traffic originating from different interconnect masters at NOC (Network On Chip). The system may function normally without this feature. However, enabling QoS helps optimize latency and bandwidth across subsystems like CPU, GPU, and multimedia engines, which becomes important in high-throughput scenarios. This is a feature aimed at performance enhancement to improve system performance under concurrent workloads. * icc-qcs615 dt-bindings: interconnect: qcom,qcs615-rpmh: add clocks property to enable QoS interconnect: qcom: qcs615: enable QoS configuration Link: https://msgid.link/20260311103548.1823044-1-odelu.kukatla@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 2d5c2952b972be1cc87c215a2636d208b5e483d4 Author: Abin Joseph Date: Mon Mar 9 09:04:44 2026 +0530 dt-bindings: dma: xlnx,axi-dma: Convert to DT schema Convert the bindings document for Xilinx DMA. No changes to existing binding description. Signed-off-by: Abin Joseph Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260309033444.3472359-1-abin.joseph@amd.com Signed-off-by: Vinod Koul commit dece5b9185ba4c3941f5fffb432f7584138833aa Author: Biju Das Date: Fri Mar 6 14:58:17 2026 +0000 dt-bindings: dma: rz-dmac: Add conditional schema for RZ/G3L The RZ/G3L DMA controller is compatible with RZ/G2L, sharing the same IP. However, the conditional schema logic that enforces RZ/G2L-specific binding constraints was not extended to cover the RZ/G3L compatible string, leaving its bindings without proper validation. Add the RZ/G3L compatible string to the existing RZ/G2L conditional schema so that the same property constraints are applied to both SoCs. Signed-off-by: Biju Das Fixes: e45cf0c7d9b960f1 ("dt-bindings: dma: rz-dmac: Document RZ/G3L SoC") Reviewed-by: Geert Uytterhoeven Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260306145819.897047-1-biju.das.jz@bp.renesas.com Signed-off-by: Vinod Koul commit 50a9b75d77611faa62e9a71ac66c345930b3d3f6 Author: Odelu Kukatla Date: Wed Mar 11 16:05:47 2026 +0530 interconnect: qcom: qcs615: enable QoS configuration Enable QoS configuration for master ports with predefined priority and urgency forwarding. Signed-off-by: Odelu Kukatla Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://msgid.link/20260311103548.1823044-3-odelu.kukatla@oss.qualcomm.com Signed-off-by: Georgi Djakov commit e07f3b8c9e1cc6aa5b48d63cf8270409ffe76068 Author: Odelu Kukatla Date: Wed Mar 11 16:05:46 2026 +0530 dt-bindings: interconnect: qcom,qcs615-rpmh: add clocks property to enable QoS Aggre1-noc interconnect node on QCS615 has QoS registers located inside a block whose interface is clock-gated. Accessing these registers requires the corresponding clock(s) to be enabled. Update the bindings to include the 'clocks' property. Ensure that only aggre1-noc interconnect node uses this property by explicitly forbidding it for all other interconnect nodes. Signed-off-by: Odelu Kukatla Reviewed-by: Krzysztof Kozlowski Link: https://msgid.link/20260311103548.1823044-2-odelu.kukatla@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 44f991bd6e01bb6a3f78da98eafa6d2a72819a2f Author: Claudiu Beznea Date: Mon Mar 16 15:32:52 2026 +0200 dmaengine: sh: rz-dmac: Add device_{pause,resume}() callbacks The RZ/G2L SCIFA driver uses dmaengine_prep_slave_sg() to enqueue DMA transfers and implements a timeout mechanism on RX to handle cases where a DMA transfer does not complete. The timeout is implemented using an hrtimer. In the hrtimer callback, dmaengine_tx_status() is called (along with dmaengine_pause()) to retrieve the transfer residue and handle incomplete DMA transfers. Add support for device_{pause, resume}() callbacks. Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260316133252.240348-9-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit 21323b118c16d287355e6497e1098ce1ca348bd6 Author: Biju Das Date: Mon Mar 16 15:32:51 2026 +0200 dmaengine: sh: rz-dmac: Add device_tx_status() callback The RZ/G2L SCIFA driver uses dmaengine_prep_slave_sg() to enqueue DMA transfers and implements a timeout mechanism on RX to handle cases where a DMA transfer does not complete. The timeout is implemented using an hrtimer. In the hrtimer callback, dmaengine_tx_status() is called (along with dmaengine_pause()) to retrieve the transfer residue and handle incomplete DMA transfers. Add support for the device_tx_status() callback. Co-developed-by: Long Luu Signed-off-by: Long Luu Signed-off-by: Biju Das Co-developed-by: Claudiu Beznea Signed-off-by: Claudiu Beznea Reviewed-by: Frank Li Link: https://patch.msgid.link/20260316133252.240348-8-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit bfaa60be647842cece968769f208e57fa5dee594 Author: John Madieu Date: Mon Mar 16 15:32:50 2026 +0200 dmaengine: sh: rz-dmac: Use rz_lmdesc_setup() to invalidate descriptors rz_lmdesc_setup() invalidates DMA descriptors more comprehensively. It resets the base, head, and tail pointers of the descriptor list and clears the descriptor headers and their NXLA pointers. Use rz_lmdesc_setup() instead of open-coding parts of its logic. Signed-off-by: John Madieu Signed-off-by: Claudiu Beznea Reviewed-by: Frank Li Link: https://patch.msgid.link/20260316133252.240348-7-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit be25945d0ca3ac736c448b530c47e854c82a0343 Author: Claudiu Beznea Date: Mon Mar 16 15:32:49 2026 +0200 dmaengine: sh: rz-dmac: Drop unnecessary local_irq_save() call rz_dmac_enable_hw() calls local_irq_save()/local_irq_restore(), but this is not needed because the callers of rz_dmac_enable_hw() already protect the critical section using spin_lock_irqsave()/spin_lock_irqrestore(). Remove the local_irq_save()/local_irq_restore() calls. Reviewed-by: Frank Li Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260316133252.240348-6-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit 7badd294fc82629378b153327c57b8ba453688c7 Author: Claudiu Beznea Date: Mon Mar 16 15:32:48 2026 +0200 dmaengine: sh: rz-dmac: Drop goto instruction and label There is no need to jump to the done label, so return immediately. Reviewed-by: Frank Li Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260316133252.240348-5-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit be342fb7f2bb5f641419fef3109eaffd469b0d44 Author: Claudiu Beznea Date: Mon Mar 16 15:32:47 2026 +0200 dmaengine: sh: rz-dmac: Drop read of CHCTRL register The CHCTRL register has 11 bits that can be updated by software. The documentation for all these bits states the following: - A read operation results in 0 being read - Writing zero does not affect the operation All bits in the CHCTRL register accessible by software are set and clear bits. The documentation for the CLREND bit of CHCTRL states: Setting this bit to 1 can clear the END bit of the CHSTAT_n/nS register. Also, the DMA transfer end interrupt is cleared. An attempt to read this bit results in 0 being read. 1: Clears the END bit. 0: Does not affect the operation. Since writing zero to any bit in this register does not affect controller operation and reads always return zero, there is no need to perform read-modify-write accesses to set the CLREND bit. Drop the read of the CHCTRL register. Also, since setting the CLREND bit does not interact with other functionalities exposed through this register and only clears the END interrupt, there is no need to lock around this operation. Add a comment to document this. Reviewed-by: Biju Das Reviewed-by: Frank Li Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260316133252.240348-4-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit 6fa935cead15e020995a5577b265398e986b8a6b Merge: c03d8b5462bcb0 89a8567d84bde8 Author: Vinod Koul Date: Tue Mar 17 16:11:43 2026 +0530 Merge branch 'fixes' into next This brings in the rz-dmac fixes which are in fixes commit d3244af9c4c2bbce57465130c9cd509182207c2d Author: Ralf Lici Date: Fri Nov 14 11:40:29 2025 +0100 ovpn: consolidate crypto allocations in one chunk Currently ovpn uses three separate dynamically allocated structures to set up cryptographic operations for both encryption and decryption. This adds overhead to performance-critical paths and contribute to memory fragmentation. This commit consolidates those allocations into a single temporary blob, similar to what esp_alloc_tmp() does. The resulting performance gain is +7.7% and +4.3% for UDP when using AES and ChaChaPoly respectively, and +4.3% for TCP. Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli Reviewed-by: Sabrina Dubroca commit 7b80d8a33500bd8ae5081c053f0447b502581d79 Author: Ralf Lici Date: Wed Nov 19 11:56:52 2025 +0100 selftests: ovpn: add test for the FW mark feature Add a selftest to verify that the FW mark socket option is correctly supported and its value propagated by ovpn. The test adds and removes nftables DROP rules based on the mark value, and checks that the rule counter aligns with the number of lost ping packets. Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: horms@kernel.org Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit 367f4b163a8cff20d0cb06eb265a1bf1c6652bd9 Author: Ralf Lici Date: Wed Jul 23 14:35:34 2025 +0200 selftests: ovpn: check asymmetric peer-id Extend the base test to verify that the correct peer-id is set in data packet headers. This is done by capturing ping packets with tcpdump during the initial exchange and matching the first portion of the header against the expected sequence for every connection. Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: horms@kernel.org Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit 2e570a51408839b2079f3cb7e3944bf9b1184ee0 Author: Ralf Lici Date: Wed Jul 9 17:21:25 2025 +0200 ovpn: add support for asymmetric peer IDs In order to support the multipeer architecture, upon connection setup each side of a tunnel advertises a unique ID that the other side must include in packets sent to them. Therefore when transmitting a packet, a peer inserts the recipient's advertised ID for that specific tunnel into the peer ID field. When receiving a packet, a peer expects to find its own unique receive ID for that specific tunnel in the peer ID field. Add support for the TX peer ID and embed it into transmitting packets. If no TX peer ID is specified, fallback to using the same peer ID both for RX and TX in order to be compatible with the non-multipeer compliant peers. Cc: horms@kernel.org Cc: donald.hunter@gmail.com Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli Reviewed-by: Sabrina Dubroca commit 77de28cd7cf172e782319a144bf64e693794d78b Author: Ralf Lici Date: Fri Jun 13 17:55:39 2025 +0200 selftests: ovpn: add notification parsing and matching To verify that netlink notifications are correctly emitted and contain the expected fields, this commit uses the tools/net/ynl/pyynl/cli.py script to create multicast listeners. These listeners record the captured notifications to a JSON file, which is later compared to the expected output. Cc: linux-kselftest@vger.kernel.org Cc: shuah@kernel.org Cc: horms@kernel.org Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli commit c841b676da98638f5ed8d3f2f449ddd02d9921aa Author: Ralf Lici Date: Fri Nov 14 11:39:40 2025 +0100 ovpn: notify userspace on client float event Send a netlink notification when a client updates its remote UDP endpoint. The notification includes the new IP address, port, and scope ID (for IPv6). Cc: linux-kselftest@vger.kernel.org Cc: horms@kernel.org Cc: shuah@kernel.org Cc: donald.hunter@gmail.com Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli Reviewed-by: Sabrina Dubroca commit 4a6480599ce1aef2235152e16215cc68962e9416 Author: Qingfang Deng Date: Wed May 28 16:57:08 2025 +0800 ovpn: pktid: use bitops.h API Use bitops.h for replay window to simplify code. Signed-off-by: Qingfang Deng [antonio@openvpn.net: extended commit message] Signed-off-by: Antonio Quartulli Reviewed-by: Sabrina Dubroca commit 7e7ca01d912637316c0159a0a15a5fc14cd12aff Author: Sabrina Dubroca Date: Mon Jul 14 16:20:02 2025 +0200 ovpn: use correct array size to parse nested attributes in ovpn_nl_key_swap_doit In ovpn_nl_key_swap_doit, the attributes array used to parse the OVPN_A_KEYCONF uses OVPN_A_PEER_MAX instead of OVPN_A_KEYCONF_MAX. Note that this does not cause any bug, since currently OVPN_A_KEYCONF_MAX < OVPN_A_PEER_MAX. The wrong constant was introduced by commit 203e2bf55990 ("ovpn: implement key add/get/del/swap via netlink") Signed-off-by: Sabrina Dubroca Signed-off-by: Antonio Quartulli commit a8e136b496259e689942d295d06cc4e517418cc4 Author: Antonio Quartulli Date: Tue Nov 11 22:34:51 2025 +0100 selftests: ovpn: allow compiling ovpn-cli.c with mbedtls3 mbedtls 3 installs headers and calls the shared object differently than version 2, therefore we must now rely on pkgconfig to fill the right C/LDFLAGS. Moreover the mbedtls3 library expects any base64 file to have their content on one line. Since this change does no break older versions, let's change the sample key file format and make mbedtls3 happy. Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: horms@kernel.org Signed-off-by: Antonio Quartulli commit f2d1643ddc0f3d0b847a6877ec37f1fabacfbfed Author: Manivannan Sadhasivam Date: Mon Mar 2 11:20:21 2026 +0530 bus: mhi: ep: Test for non-zero return value where applicable Instead of testing for negative error code, just test for non-zero return for cases where there is no positive return value. This helps to maintain code uniformity. No functional change. Reported-by: Bjorn Helgaas Closes: https://lore.kernel.org/linux-pci/20260227191510.GA3904799@bhelgaas Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260302055021.8616-1-manivannan.sadhasivam@oss.qualcomm.com commit 37a23d6f11938cd59927e3307b9b301624df8e8f Author: Rosen Penev Date: Wed Mar 11 21:59:21 2026 -0700 bus: mhi: host: Use kzalloc_flex Change kzalloc + kzalloc to just kzalloc with a flexible array member. Add __counted_by for extra runtime analysis when requested. Move counting assignment immediately after allocation as required by __counted_by. Move mhi_buf definition as a complete definition as needed for flex arrays. It's not a pointer anymore. Signed-off-by: Rosen Penev [mani: squashed https://lore.kernel.org/mhi/20260317-mhi-invalid-free-mhi-buffers-v1-1-8418a3ad604f@oss.qualcomm.com] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260312045921.7663-1-rosenp@gmail.com commit febe8012458fd9057d3fb70f6b37ef67a07ff8a1 Author: Qingfang Deng Date: Thu Mar 12 17:37:31 2026 +0800 ppp: remove pch->chan NULL checks from tx path Now that ppp_disconnect_channel() is called before pch->chan is set to NULL, a channel from ppp->channels list on the transmit path is guaranteed to have non-NULL pch->chan. Remove the pch->chan NULL checks from ppp_push(), ppp_mp_explode(), and ppp_fill_forward_path(), where a channel is obtained from the list. Remove the corresponding WRITE/READ_ONCE annotations as they no longer race. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260312093732.277254-2-dqfext@gmail.com Signed-off-by: Paolo Abeni commit 6a196e83a1a7e50be93482d1cd4305641f1a9fb1 Author: Qingfang Deng Date: Thu Mar 12 17:37:30 2026 +0800 ppp: disconnect channel before nullifying pch->chan In ppp_unregister_channel(), pch->chan is set to NULL before calling ppp_disconnect_channel(), which removes the channel from ppp->channels list using list_del_rcu() + synchronize_net(). This creates an intermediate state where the channel is still connected (on the list) but already unregistered (pch->chan == NULL). Call ppp_disconnect_channel() before setting pch->chan to NULL. After the synchronize_net(), no new reader on the transmit path will hold a reference to the channel from the list. This eliminates the problematic state, and prepares for removing the pch->chan NULL checks from the transmit path in a subsequent patch. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260312093732.277254-1-dqfext@gmail.com Signed-off-by: Paolo Abeni commit 56c167a0c0fa24aa6eb14c4e81cc4bad1048d651 Author: Nam Cao Date: Mon Mar 16 08:28:50 2026 +0100 genirq/matrix, LoongArch: Delete IRQ_MATRIX_BITS leftovers Delete IRQ_MATRIX_BITS leftovers after commit 5b98d210ac1e ("genirq/matrix: Dynamic bitmap allocation") has made IRQ_MATRIX_BITS obsolete. Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260316072850.467995-1-namcao@linutronix.de commit b8f2d65fec19f3866905ac6ae3deb5c0c9faf162 Author: Charles Keepax Date: Fri Mar 13 15:54:28 2026 +0000 soundwire: intel_auxdevice: Add cs42l49 to wake_capable_list The Cirrus Logic cs42l49 codec can generate Jack events so add it to the wake-capable list. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260313155428.1934196-1-ckeepax@opensource.cirrus.com Signed-off-by: Vinod Koul commit a5dcbff7d50a89bf0376e7f2fb1ba3163a6dac0a Author: Bradford Love Date: Thu Mar 12 16:35:32 2026 -0500 media: em28xx: remove tuner type from Hauppauge DVB DualHD This reverts a patch which was perhaps inadvertently added. This was changed during the 5.15-rc4 merge. The faulty commit appears lost in the pull request somehow, I cannot find it to check the explanation. commit c52e7b855b33 ("Merge tag 'v5.15-rc4' into media_tree") There was nothing wrong with this device and no reason to moodify the board profile. The DVB capabilities are added via dvb_module_probe. Additionally, the device contains *zero* analog inputs, so I'm not sure why one was added. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 724e16b166534bd01d4f5bdf310310146bd4da56 Author: Bradford Love Date: Thu Mar 12 16:35:31 2026 -0500 media: em28xx: Add a variety of DualHD usb id Include possible vid:pid combination of DualHD models that are in the wild. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 5e521401d058b4b4bce9689e5897e286f1d4d8b0 Author: Bradford Love Date: Thu Mar 12 16:35:30 2026 -0500 media: au0828: Add new Hauppauge HVR1265 and ImpactVCB-e New HVR1265 and ImpactVCB-e devices are PCIe baords with USB controller and essentially embedded Hauppauge 950Q. HVR1265 - digital+analog TV, S-Video, and audio inputs ImpactVCB-e - Composite, S-Video, and audio inputs This also fixes AU8522_COMPOSITE_CH4, which was missing from video routing. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit ca3e8eaaa44e236413fd8d142231b5f03aefe55c Author: Bradford Love Date: Thu Mar 12 16:35:29 2026 -0500 media: saa7164: Fix REV2 firmware filename The wrong firmware file is listed, leading to non functional devices on REV2 models. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 57c3c67fce95ab0d449d3f6ae339621fcb61080e Author: Bradford Love Date: Thu Mar 12 16:35:28 2026 -0500 media: si2168: fw 4.0-11 loses warm state during sleep Ignoring version 4.0-11 firmware leads to non functional devices after sleep on all Hauppauge DVB devices containing the si2168 and firmware version 4.0-11. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 3c414622fe4bcedc48305bfe2170ae13119fc331 Author: Bradford Love Date: Thu Mar 12 16:35:27 2026 -0500 media: si2168: Fix i2c command timeout on embedded platforms On many embedded platforms i2c responses through USB are not returned as quickly, plus constantly banging on the i2c master receive essentially deadlocks the driver. Inserting a 3ms delay between i2c receive calls and extending the timeout fixes all tested platforms. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 69426c6c9bb1601a200dc5dd7ffcc5d542e545b1 Author: Bradford Love Date: Thu Mar 12 16:35:25 2026 -0500 media: cx231xx: Fix AGC levels for NTSC-M Windows uses the implemented command sequence to set AGC for NTSC-M. The previous Linux values work, mostly, but on some embedded platforms NTSC-M is very unstable. The Windows default values completely fix any signal stability issues and produce a clear image. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit bad32ae441e3969b34e032e2578a6b30858a5a96 Author: Bradford Love Date: Thu Mar 12 16:35:24 2026 -0500 media: xc5000: Add rf strength function Without a rf strength function implemented, analog lock cannot be detected by standardized command line tools. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 36200241f5a3dd28b95fdefb2885ca9fd52f6387 Author: Bradford Love Date: Thu Mar 12 16:35:23 2026 -0500 media: cx25840: Fix NTSC-J, PAL-N, and SECAM standards Formats did not correctly decode prior. Modifications are based off cx25840 datasheet. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 9cddeb883bacf82757bf3273c60a2d2e45bf7fe9 Author: Bradford Love Date: Thu Mar 12 16:35:22 2026 -0500 media: si2157: Analog format fixes Updates to support PAL-N and PAL-Nc Verifies PAL-I and PAL-DK standards are working Fixes and verifies SECAM-L now works Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil commit 24ae633ab3b8b0f632b94774a62a5f7e7b754299 Author: Faizel K B Date: Thu Mar 12 16:16:16 2026 -0700 media: vimc: streamer: Apply sensor frame rate in streamer thread Use the sensor's pre-calculated jiffies value to add appropriate delay between frames according to the configured timing value. The actual frame rate will vary depending on processing delays in other media pipeline components. Tested using yavta frame rate display with QCIF resolution: yavta --capture= Signed-off-by: Faizel K B Signed-off-by: Hans Verkuil commit ec1e620b245495121535bf5c046c6885c7e409cb Author: Faizel K B Date: Thu Mar 12 16:16:15 2026 -0700 media: vimc: sensor: Add pixel_rate,vblank and hblank configuration pixel_rate and hblank as read only parameter. vblank can be configured to match the desired frame rate. Default values are, pixel_rate - 160 MHz, hblank - 800. vblank defaults to an equivalent value of 30 fps for resolutions less than or equal to 1920x1080 and 10 fps for higher resolutions. For higher resolutions, modify pixel_rate in the driver code. fps = pixel_rate / ((width + hblank) * (height + vblank)) minimum vblank - 4, maximum vblank - 65535 The configured fps delay is pre-calculated into jiffies and stored in the sensor's hw structure for efficient access by the streamer thread. Signed-off-by: Faizel K B Signed-off-by: Hans Verkuil commit 12cdc242c3faaa66399a01fb40c151ee236e6bbf Author: Faizel K B Date: Thu Mar 12 16:16:14 2026 -0700 media: vimc: sensor: Move vimc_sensor_device to common header Move the vimc_sensor_device structure from vimc-sensor.c to vimc-common.h to make it accessible to the vimc-streamer component. Signed-off-by: Faizel K B Signed-off-by: Hans Verkuil commit 03fd5070c57acc99a21123a960f4820a6693e910 Author: Artem Lytkin Date: Sat Feb 7 22:05:44 2026 +0000 staging: media: av7110: replace BUG() with error return in gpioirq Replace BUG() with a return statement in the gpioirq tasklet handler. If saa7146_wait_for_debi_done() times out, crashing the kernel is disproportionate. The pr_err() already logs the failure, and returning early avoids accessing hardware in a potentially broken state. Signed-off-by: Artem Lytkin Signed-off-by: Hans Verkuil commit 8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c Author: Jeongjun Park Date: Sun Jan 11 00:17:53 2026 +0900 media: as102: fix to not free memory after the device is registered in as102_usb_probe() In as102_usb driver, the following race condition occurs: ``` CPU0 CPU1 as102_usb_probe() kzalloc(); // alloc as102_dev_t .... usb_register_dev(); fd = sys_open("/path/to/dev"); // open as102 fd .... usb_deregister_dev(); .... kfree(); // free as102_dev_t .... sys_close(fd); as102_release() // UAF!! as102_usb_release() kfree(); // DFB!! ``` When a USB character device registered with usb_register_dev() is later unregistered (via usb_deregister_dev() or disconnect), the device node is removed so new open() calls fail. However, file descriptors that are already open do not go away immediately: they remain valid until the last reference is dropped and the driver's .release() is invoked. In as102, as102_usb_probe() calls usb_register_dev() and then, on an error path, does usb_deregister_dev() and frees as102_dev_t right away. If userspace raced a successful open() before the deregistration, that open FD will later hit as102_release() --> as102_usb_release() and access or free as102_dev_t again, occur a race to use-after-free and double-free vuln. The fix is to never kfree(as102_dev_t) directly once usb_register_dev() has succeeded. After deregistration, defer freeing memory to .release(). In other words, let release() perform the last kfree when the final open FD is closed. Cc: Reported-by: syzbot+47321e8fd5a4c84088db@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=47321e8fd5a4c84088db Fixes: cd19f7d3e39b ("[media] as102: fix leaks at failure paths in as102_usb_probe()") Signed-off-by: Jeongjun Park Signed-off-by: Hans Verkuil commit 3b7da2b4d0fe014eff181ed37e3bf832eb8ed258 Author: Jeongjun Park Date: Sat Jan 10 23:58:29 2026 +0900 media: hackrf: fix to not free memory after the device is registered in hackrf_probe() In hackrf driver, the following race condition occurs: ``` CPU0 CPU1 hackrf_probe() kzalloc(); // alloc hackrf_dev .... v4l2_device_register(); .... fd = sys_open("/path/to/dev"); // open hackrf fd .... v4l2_device_unregister(); .... kfree(); // free hackrf_dev .... sys_ioctl(fd, ...); v4l2_ioctl(); video_is_registered() // UAF!! .... sys_close(fd); v4l2_release() // UAF!! hackrf_video_release() kfree(); // DFB!! ``` When a V4L2 or video device is unregistered, the device node is removed so new open() calls are blocked. However, file descriptors that are already open-and any in-flight I/O-do not terminate immediately; they remain valid until the last reference is dropped and the driver's release() is invoked. Therefore, freeing device memory on the error path after hackrf_probe() has registered dev it will lead to a race to use-after-free vuln, since those already-open handles haven't been released yet. And since release() free memory too, race to use-after-free and double-free vuln occur. To prevent this, if device is registered from probe(), it should be modified to free memory only through release() rather than calling kfree() directly. Cc: Reported-by: syzbot+6ffd76b5405c006a46b7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6ffd76b5405c006a46b7 Reported-by: syzbot+f1b20958f93d2d250727@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f1b20958f93d2d250727 Fixes: 8bc4a9ed8504 ("[media] hackrf: add support for transmitter") Signed-off-by: Jeongjun Park Signed-off-by: Hans Verkuil commit a2efb1b80f36320c67622245e661fd980aa0c344 Merge: 348baefbb635cb 639f1dcfde5540 Author: Paolo Abeni Date: Tue Mar 17 10:35:22 2026 +0100 Merge branch 'net-dsa-mv88e6xxx-add-partial-support-for-tcam-entries' Cedric Jehasse says: ==================== net: dsa: mv88e6xxx: Add partial support for TCAM entries This series adds partial Ternary Content Addressable Memory (TCAM) for the mv88e6390 and mv88e6393 family of switches. TCAM entries allow the switch to match the first 48 or 96 bytes of a frame and take actions on matched frames. This patch introduces a subset of the available TCAM functionality. Matching on ip addresses/protocol and trapping to the cpu. Eg. to trap traffic with destination ip 224.0.1.129 to the cpu: tc qdisc add dev p1 clsact tc filter add dev p1 ingress protocol ip flower skip_sw \ dst_ip 224.0.1.129 action trap Review of the mv88e6xxx changes have brought to light something in cls_flower: When adding a classifier with an ipv4 address both FLOW_DISSECTOR_KEY_IPV4_ADDRS and FLOW_DISSECTOR_KEY_IPV6_ADDRS bits are set in dissector->used_keys. A change was made to address this. Signed-off-by: Cedric Jehasse ==================== Link: https://patch.msgid.link/20260311-net-next-mv88e6xxx-tcam-v8-0-32dd5ba30002@luminex.be Signed-off-by: Paolo Abeni commit 639f1dcfde5540a8fafa8458d3e6be05207a68db Author: Cedric Jehasse Date: Wed Mar 11 11:46:19 2026 +0100 net: dsa: mv88e6xxx: Add partial support for TCAM entries This patch adds partial Ternary Content Addressable Memory (TCAM) for the mv88e6390 and mv88e6393 family of switches. TCAM entries allow the switch to match the first 48 or 96 bytes of a frame and take actions on matched frames. This patch introduces a subset of the available TCAM functionality. Matching on ip addresses/protocol and trapping to the cpu. Eg. to trap traffic with destination ip 224.0.1.129 to the cpu: tc qdisc add dev p1 clsact tc filter add dev p1 ingress protocol ip flower skip_sw \ dst_ip 224.0.1.129 action trap Signed-off-by: Cedric Jehasse Link: https://patch.msgid.link/20260311-net-next-mv88e6xxx-tcam-v8-2-32dd5ba30002@luminex.be Signed-off-by: Paolo Abeni commit b513dde96c0ac19874175360bde9ad13811a8120 Author: Cedric Jehasse Date: Wed Mar 11 11:46:18 2026 +0100 net/sched: cls_flower: remove unions from fl_flow_key When creating a flower classifier with an ipv4 address the flow_dissector has both FLOW_DISSECTOR_KEY_IPV4_ADDRS and FLOW_DISSECTOR_KEY_IPV6_ADDRS bits set in used_keys. This happens because ipv4/ipv6 fields are a union and FL_KEY_SET_IF_MASKED() will interpret either being set as both. Removing the unions fixes this behavior without needing special handling for union fields. Example of a command that caused FLOW_DISSECTOR_KEY_IPV4_ADDRS and FLOW_DISSECTOR_KEY_IPV6_ADDRS to be set: tc filter add dev p1 ingress protocol ip flower skip_sw \ dst_ip 224.0.1.129 action trap Signed-off-by: Cedric Jehasse Link: https://patch.msgid.link/20260311-net-next-mv88e6xxx-tcam-v8-1-32dd5ba30002@luminex.be Signed-off-by: Paolo Abeni commit b800359a4dfacae983cd01f8c3f1cbb6f4c9f816 Author: Rosen Penev Date: Mon Mar 16 17:35:17 2026 -0700 mtd: cmdlinepart: use a flexible array member This is already allocated properly. It's just using an extra pointer. Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal commit 1cabff0d18733f1f33bd6ab0505cbec430834469 Author: Jonathan Cavitt Date: Wed Feb 4 16:19:46 2026 +0000 drm/i915/gvt: Swap read and write checks The function intel_gvt_i2c_handle_aux_ch_write currently does not support the DP_AUX_I2C_WRITE operation. Notably, we check if op & 0x1 == DP_AUX_I2C_WRITE (one), and if it does not, assert that op & 0x1 == DP_AUX_I2C_READ (zero). This is unnecessary because if op & 0x1 != 1, then op & 0x1 == 0. But beyond that, it probably makes more sense to check for the condition that is implemented, rather than check for the condition that is not. Swap the conditions. We can also get rid of the unnecessary drm_WARN_ON while we're here. Suggested-by: Jani Nikula Signed-off-by: Jonathan Cavitt Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260204161945.8127-2-jonathan.cavitt@intel.com Signed-off-by: Jani Nikula commit 33978364a2f3fc2989751bdabcaea0ec7e8d1ae8 Author: Jonathan Cavitt Date: Fri Jan 23 15:21:22 2026 +0000 drm/i915/display: PORT_NONE is not valid Static analysis issue: In assert_port_valid, add a check to ensure port != PORT_NONE, as that is not a valid port. The check must be explicit to prevent a bad bit shift operation in the general case via short-circuiting. It's not likely this will ever come up in a real use case, but it's at least worth guarding against. It would probably also be pertinent to modify the behavior of the port_name function to correctly print PORT_NONE in this case, as currently the port would be reported as 'port @' by the debugger. But that should be done separately, and given port_name is mostly just a debug printing helper function anyways, fixing it is a low priority. v2: - Conditional check was backwards. Fix it. (Jani) Signed-off-by: Jonathan Cavitt Cc: Jani Nikula Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260123152121.7042-2-jonathan.cavitt@intel.com Signed-off-by: Jani Nikula commit 8510d054b7e086a71a9191ac3399231290dfd272 Author: Arnd Bergmann Date: Fri Mar 13 10:49:16 2026 +0100 KVM: arm64: avoid unused-variable warning The 'cpu' variable is only used inside of an #ifdef block and causes a warning if there is no user: arch/arm64/kvm/hyp_trace.c: In function 'kvm_hyp_trace_init': arch/arm64/kvm/hyp_trace.c:422:13: error: unused variable 'cpu' [-Werror=unused-variable] 422 | int cpu; | ^~~ Change the #ifdef to an equivalent IS_ENABLED() check to avoid the warning. Fixes: b22888917fa4 ("KVM: arm64: Sync boot clock with the nVHE/pKVM hyp") Signed-off-by: Arnd Bergmann Reviewed-by: Vincent Donnefort Link: https://patch.msgid.link/20260313094925.3749287-1-arnd@kernel.org Signed-off-by: Marc Zyngier commit 1211907ac0b5f35e5720620c50b7ca3c72d81f7e Author: Vincent Donnefort Date: Mon Mar 16 09:28:45 2026 +0000 tracing: Generate undef symbols allowlist for simple_ring_buffer Compiler and tooling-generated symbols are difficult to maintain across all supported architectures. Make the allowlist more robust by replacing the harcoded list with a mechanism that automatically detects these symbols. This mechanism generates a C function designed to trigger common compiler-inserted symbols. Signed-off-by: Vincent Donnefort Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Acked-by: Steven Rostedt (Google) Tested-by: Arnd Bergmann Link: https://patch.msgid.link/20260316092845.3367411-1-vdonnefort@google.com [maz: added __msan prefix to allowlist as pointed out by Arnd] Signed-off-by: Marc Zyngier commit d6f8e0e06dee066076a45eea4f9f85247f85477d Author: Faruque Ansari Date: Mon Mar 16 16:07:52 2026 +0530 cpufreq: Add QCS8300 to cpufreq-dt-platdev blocklist The Qualcomm QCS8300 platform uses the qcom-cpufreq-hw driver, so add it to the cpufreq-dt-platdev driver's blocklist. Signed-off-by: Faruque Ansari Reviewed-by: Mukesh Ojha Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Viresh Kumar commit d9ef8c91c4bba8160853a76ba0dc99919acef0ab Merge: f2f0587dcdecc2 0928a28daf0175 Author: Krzysztof Kozlowski Date: Tue Mar 17 09:27:44 2026 +0100 Merge tag 'renesas-dts-for-v7.1-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v7.1 - Add CPU frequency scaling and QSPI NOR FLASH support on the RZ/N1 SoC and the RZN1D-DB development board, - Add PCIe slot power control on the R-Car H3, M3-W(+), M3-N, and E3 SoCs, - Add USB3.0 PHY support on the R-Car E3 SoC and the Ebisu development board, - Add PCIe/USB3.0 clock generator support on the Salvator-X(S), ULCB King Fisher extension, and Ebisu development boards, - Add RTC support on the RZ/V2N SoC and its EVK board, - Add SPI DMA support on the RZ/T2H, RZ/N2H, RZ/V2H(P), and RZ/V2N SoCs, - Add support for the second SDHI channel on the Atmark Techno Armadillo-800-EVA board, - Miscellaneous fixes and improvements. * tag 'renesas-dts-for-v7.1-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (30 commits) ARM: dts: renesas: armadillo800eva: Add wakeup-source to st1232 ARM: dts: renesas: armadillo800eva: Enable SDHI1 ARM: dts: renesas: r9a06g032-rzn1d400-db: Use interrupts for Micrel PHYs ARM: dts: renesas: r9a06g032-rzn1d400-db: Do not use underscores in node names ARM: dts: renesas: r9a06g032-rzn1d400-db: Add QSPI node including NOR flash arm64: dts: renesas: r9a09g057: Add DMA support for RSPI channels arm64: dts: renesas: r9a09g056: Add DMA support for RSPI channels ARM: dts: renesas: r9a06g032: Describe the QSPI controller arm64: dts: renesas: r9a09g087: Wire up DMA support for SPI arm64: dts: renesas: r9a09g077: Wire up DMA support for SPI arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable RTC arm64: dts: renesas: r9a09g056: Add RTC node arm64: dts: renesas: ebisu: Describe PCIe/USB3.0 clock generator arm64: dts: renesas: ulcb: ulcb-kf: Describe PCIe/USB3.0 clock generator arm64: dts: renesas: salvator-common: Describe PCIe/USB3.0 clock generator arm64: dts: renesas: r8a77990: Add USB 3.0 PHY and USB3S0 clock nodes arm64: dts: renesas: r8a77990: Describe PCIe root port arm64: dts: renesas: r8a77965: Describe PCIe root ports arm64: dts: renesas: r8a77961: Describe PCIe root ports arm64: dts: renesas: r8a77960: Describe PCIe root ports ... Signed-off-by: Krzysztof Kozlowski commit 07791ff060dd3aa270cc03861f2599d81a77b97f Author: Ritesh Harjani (IBM) Date: Mon Mar 9 23:44:33 2026 +0530 powerpc: Print MMU_FTRS_POSSIBLE & MMU_FTRS_ALWAYS at startup Similar to CPU_FTRS_[POSSIBLE|ALWAYS], let's also print MMU_FTRS_[POSSIBLE|ALWAYS]. This has some useful data to capture during bootup. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/c37a9f314a723048d25aa5424f7ede8eec691d86.1773078178.git.ritesh.list@gmail.com commit 24eb6378408fc125eacc4ad498d120ecf7becc35 Author: Ritesh Harjani (IBM) Date: Mon Mar 9 23:44:32 2026 +0530 powerpc/64s: Make use of H_RPTI_TYPE_ALL macro Instead of opencoding, let's use the pre-defined macro (H_RPTI_TYPE_ALL) at the following places. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/d1d32404d5f0d3e93cd0faad2298b7bfed31288f.1773078178.git.ritesh.list@gmail.com commit f074059c7a4d4b93914eee404391dcdb0fd60aa6 Author: Ritesh Harjani (IBM) Date: Mon Mar 9 23:44:31 2026 +0530 powerpc/64s: Rename tlbie_lpid_va to tlbie_va_lpid In previous patch we renamed tlbie_va_lpid functions to tlbie_va_pid_lpid() since those were working with PIDs as well. This then allows us to rename tlbie_lpid_va to tlbie_va_lpid, which finally makes all the tlbie function naming consistent. No functional change in this patch. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/8fadd2beb2f883c65ba0d797c87d238098cd13c8.1773078178.git.ritesh.list@gmail.com commit 7bcfba20e946ec160fd72c3a0b4cf6e3e845d629 Author: Ritesh Harjani (IBM) Date: Mon Mar 9 23:44:30 2026 +0530 powerpc/64s: Rename tlbie_va_lpid to tlbie_va_pid_lpid It only make sense to rename these functions, so it's better reflect what they are supposed to do. For e.g. __tlbie_va_pid_lpid name better reflect that it is invalidating tlbie using VA, PID and LPID. No functional change in this patch. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/0a0b2cf23b9522f891f9a0f976bbdc5c8e6f6d8b.1773078178.git.ritesh.list@gmail.com commit 4894e2fb7b9a25cef843ee2c3b2ac49fd808647d Author: Ritesh Harjani (IBM) Date: Mon Mar 9 23:44:29 2026 +0530 powerpc/64s: Kill the unused argument of exit_lazy_flush_tlb In previous patch we removed the only caller of exit_lazy_flush_tlb() which was passing always_flush = false in it's second argument. With that gone, all the callers of exit_lazy_flush_tlb() are local to radix_pgtable.c and there is no need of an additional argument. This patch does the required cleanup. There should not be any functionality change in this patch. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/6f96ea53588034312ae84f74b1e2fa9c4ce7cfd5.1773078178.git.ritesh.list@gmail.com commit bf7c1497d2568ff803a0b0fc6728a1c06d11bf6e Author: Ritesh Harjani (IBM) Date: Mon Mar 9 23:44:28 2026 +0530 powerpc/64s: Move serialize_against_pte_lookup() to hash_pgtable.c Originally, commit fa4531f753f1 ("powerpc/mm: Don't send IPI to all cpus on THP updates") introduced serialize_against_pte_lookup() call for both Radix and Hash. However below commit fixed the race with Radix commit 70cbc3cc78a9 ("mm: gup: fix the fast GUP race against THP collapse") And therefore following commit removed the serialize_against_pte_lookup() call from radix_pgtable.c commit bedf03416913 ("powerpc/64s/radix: don't need to broadcast IPI for radix pmd collapse flush") Now since serialize_against_pte_lookup() only gets called from hash__pmdp_collapse_flush(), thus move the related functions to hash_pgtable.c Hence this patch: - moves serialize_against_pte_lookup() from radix_pgtable.c to hash_pgtable.c - removes the radix specific calls from do_serialize() - renames do_serialize() to do_nothing(). There should not be any functionality change in this patch. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/a73ebe800a9be257329507703779f822363f8b2f.1773078178.git.ritesh.list@gmail.com commit 4a342f3e6f6848c816a661d8d7b10c75430598cf Author: Ritesh Harjani (IBM) Date: Mon Mar 9 23:44:27 2026 +0530 powerpc/64s/tlbflush-radix: Remove unused radix__flush_tlb_pwc() Commit 52162ec784fa ("powerpc/mm/book3s64/radix: Use freed_tables instead of need_flush_all") removed radix__flush_tlb_pwc() definition, but missed to remove the extern declaration. This patch removes it. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/b79c8ce8f00aa3e96ab9b1c77bc004759c397d3f.1773078178.git.ritesh.list@gmail.com commit 68b1fa0ed5c84769e4e60d58f6a5af37e7273b51 Author: Ritesh Harjani (IBM) Date: Mon Mar 9 23:44:26 2026 +0530 powerpc/64s: Fix _HPAGE_CHG_MASK to include _PAGE_SPECIAL bit commit af38538801c6a ("mm/memory: factor out common code from vm_normal_page_*()"), added a VM_WARN_ON_ONCE for huge zero pfn. This can lead to the following call stack. ------------[ cut here ]------------ WARNING: mm/memory.c:735 at vm_normal_page_pmd+0xf0/0x140, CPU#19: hmm-tests/3366 NIP [c00000000078d0c0] vm_normal_page_pmd+0xf0/0x140 LR [c00000000078d060] vm_normal_page_pmd+0x90/0x140 Call Trace: [c00000016f56f850] [c00000000078d060] vm_normal_page_pmd+0x90/0x140 (unreliable) [c00000016f56f8a0] [c0000000008a9e30] change_huge_pmd+0x7c0/0x870 [c00000016f56f930] [c0000000007b2bc4] change_protection+0x17a4/0x1e10 [c00000016f56fba0] [c0000000007b3440] mprotect_fixup+0x210/0x4c0 [c00000016f56fc30] [c0000000007b3c3c] do_mprotect_pkey+0x54c/0x780 [c00000016f56fdb0] [c0000000007b3ed8] sys_mprotect+0x68/0x90 [c00000016f56fdf0] [c00000000003ae40] system_call_exception+0x190/0x500 [c00000016f56fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec This happens when we call mprotect -> change_huge_pmd() mprotect() change_pmd_range() pmd_modify(oldpmd, newprot) # this clears _PAGE_SPECIAL for zero huge pmd pmdv = pmd_val(pmd); pmdv &= _HPAGE_CHG_MASK; # -> gets cleared here return pmd_set_protbits(__pmd(pmdv), newprot); can_change_pmd_writable(vma, vmf->address, pmd) vm_normal_page_pmd(vma, addr, pmd) __vm_normal_page() VM_WARN_ON(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)); # this get hits as _PAGE_SPECIAL for zero huge pmd was cleared. It can be easily reproduced with the following testcase: p = mmap(NULL, 2 * hpage_pmd_size, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); madvise((void *)p, 2 * hpage_pmd_size, MADV_HUGEPAGE); aligned = (char*)(((unsigned long)p + hpage_pmd_size - 1) & ~(hpage_pmd_size - 1)); (void)(*(volatile char*)aligned); // read fault, installs huge zero PMD mprotect((void *)aligned, hpage_pmd_size, PROT_READ | PROT_WRITE); This patch adds _PAGE_SPECIAL to _HPAGE_CHG_MASK similar to _PAGE_CHG_MASK, as we don't want to clear this bit when calling pmd_modify() while changing protection bits. Signed-off-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/7416f5cdbcfeaad947860fcac488b483f1287172.1773078178.git.ritesh.list@gmail.com commit bbcbf045d6c778e82b47a35fc8728387708e9a3d Author: Ritesh Harjani (IBM) Date: Mon Mar 9 23:44:25 2026 +0530 powerpc/64s: Fix unmap race with PMD migration entries The following race is possible with migration swap entries or device-private THP entries. e.g. when move_pages is called on a PMD THP page, then there maybe an intermediate state, where PMD entry acts as a migration swap entry (pmd_present() is true). Then if an munmap happens at the same time, then this VM_BUG_ON() can happen in pmdp_huge_get_and_clear_full(). This patch fixes that. Thread A: move_pages() syscall add_folio_for_migration() mmap_read_lock(mm) folio_isolate_lru(folio) mmap_read_unlock(mm) do_move_pages_to_node() migrate_pages() try_to_migrate_one() spin_lock(ptl) set_pmd_migration_entry() pmdp_invalidate() # PMD: _PAGE_INVALID | _PAGE_PTE | pfn set_pmd_at() # PMD: migration swap entry (pmd_present=0) spin_unlock(ptl) [page copy phase] # <--- RACE WINDOW --> Thread B: munmap() mmap_write_downgrade(mm) unmap_vmas() -> zap_pmd_range() zap_huge_pmd() __pmd_trans_huge_lock() pmd_is_huge(): # !pmd_present && !pmd_none -> TRUE (swap entry) pmd_lock() -> # spin_lock(ptl), waits for Thread A to release ptl pmdp_huge_get_and_clear_full() VM_BUG_ON(!pmd_present(*pmdp)) # HITS! [ 287.738700][ T1867] ------------[ cut here ]------------ [ 287.743843][ T1867] kernel BUG at arch/powerpc/mm/book3s64/pgtable.c:187! cpu 0x0: Vector: 700 (Program Check) at [c00000044037f4f0] pc: c000000000094ca4: pmdp_huge_get_and_clear_full+0x6c/0x23c lr: c000000000645dec: zap_huge_pmd+0xb0/0x868 sp: c00000044037f790 msr: 800000000282b033 current = 0xc0000004032c1a00 paca = 0xc000000004fe0000 irqmask: 0x03 irq_happened: 0x09 pid = 1867, comm = a.out kernel BUG at :187! Linux version 6.19.0-12136-g14360d4f917c-dirty (powerpc64le-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #27 SMP PREEMPT Sun Feb 22 10:38:56 IST 2026 enter ? for help [link register ] c000000000645dec zap_huge_pmd+0xb0/0x868 [c00000044037f790] c00000044037f7d0 (unreliable) [c00000044037f7d0] c000000000645dcc zap_huge_pmd+0x90/0x868 [c00000044037f840] c0000000005724cc unmap_page_range+0x176c/0x1f40 [c00000044037fa00] c000000000572ea0 unmap_vmas+0xb0/0x1d8 [c00000044037fa90] c0000000005af254 unmap_region+0xb4/0x128 [c00000044037fb50] c0000000005af400 vms_complete_munmap_vmas+0x138/0x310 [c00000044037fbe0] c0000000005b0f1c do_vmi_align_munmap+0x1ec/0x238 [c00000044037fd30] c0000000005b3688 __vm_munmap+0x170/0x1f8 [c00000044037fdf0] c000000000587f74 sys_munmap+0x2c/0x40 [c00000044037fe10] c000000000032668 system_call_exception+0x128/0x350 [c00000044037fe50] c00000000000d05c system_call_vectored_common+0x15c/0x2ec ---- Exception: 3000 (System Call Vectored) at 0000000010064a2c SP (7fff9b1ee9c0) is in userspace 0:mon> zh commit a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages"), enabled migration for device-private PMD entries. Hence this is one other path where this warning could get trigger from. ------------[ cut here ]------------ WARNING: arch/powerpc/mm/book3s64/hash_pgtable.c:199 at hash__pmd_hugepage_update+0x48/0x284, CPU#3: hmm-tests/1905 Modules linked in: test_hmm CPU: 3 UID: 0 PID: 1905 Comm: hmm-tests Tainted: G B W L N 7.0.0-rc1-01438-g7e2f0ee7581c #21 PREEMPT Tainted: [B]=BAD_PAGE, [W]=WARN, [L]=SOFTLOCKUP, [N]=TEST Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) 0x801200 0xf000006 of:SLOF,git-ee03ae pSeries NIP [c000000000096b70] hash__pmd_hugepage_update+0x48/0x284 LR [c000000000096e7c] hash__pmdp_huge_get_and_clear+0xd0/0xd4 Call Trace: [c000000604707670] [c000000004e102b8] 0xc000000004e102b8 (unreliable) [c000000604707700] [c00000000064ec3c] set_pmd_migration_entry+0x414/0x498 [c000000604707760] [c00000000063e5a4] migrate_vma_collect_pmd+0x12e8/0x16c4 [c000000604707890] [c00000000059282c] walk_pgd_range+0x7fc/0xd2c [c000000604707990] [c000000000592e40] __walk_page_range+0xe4/0x2ac [c000000604707a10] [c000000000593534] walk_page_range_mm_unsafe+0x204/0x2a4 [c000000604707ab0] [c00000000063af10] migrate_vma_setup+0x1dc/0x2e8 [c000000604707b10] [c008000006a21838] dmirror_migrate_to_system.constprop.0+0x210/0x4b0 [test_hmm] [c000000604707c30] [c008000006a245b0] dmirror_fops_unlocked_ioctl+0x454/0xa5c [test_hmm] [c000000604707d20] [c0000000006aab84] sys_ioctl+0x4ec/0x1178 [c000000604707e10] [c0000000000326a8] system_call_exception+0x128/0x350 [c000000604707e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec ---- interrupt: 3000 at 0x7fffbe44f50c Fixes: 75358ea359e7c ("powerpc/mm/book3s64: Fix MADV_DONTNEED and parallel page fault race") Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages") Reported-by: Pavithra Prakash Signed-off-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/9437e5ef28d1e2f5cbdd7f8286350ce93c1d43c5.1773078178.git.ritesh.list@gmail.com commit fda4d71651f71c44b35829d13f3c8bf920032f77 Author: Ritesh Harjani (IBM) Date: Mon Mar 9 23:44:24 2026 +0530 powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy powerpc uses pt_frag_refcount as a reference counter for tracking it's pte and pmd page table fragments. For PTE table, in case of Hash with 64K pagesize, we have 16 fragments of 4K size in one 64K page. Patch series [1] "mm: free retracted page table by RCU" added pte_free_defer() to defer the freeing of PTE tables when retract_page_tables() is called for madvise MADV_COLLAPSE on shmem range. [1]: https://lore.kernel.org/all/7cd843a9-aa80-14f-5eb2-33427363c20@google.com/ pte_free_defer() sets the active flag on the corresponding fragment's folio & calls pte_fragment_free(), which reduces the pt_frag_refcount. When pt_frag_refcount reaches 0 (no active fragment using the folio), it checks if the folio active flag is set, if set, it calls call_rcu to free the folio, it the active flag is unset then it calls pte_free_now(). Now, this can lead to following problem in a corner case... [ 265.351553][ T183] BUG: Bad page state in process a.out pfn:20d62 [ 265.353555][ T183] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20d62 [ 265.355457][ T183] flags: 0x3ffff800000100(active|node=0|zone=0|lastcpupid=0x7ffff) [ 265.358719][ T183] raw: 003ffff800000100 0000000000000000 5deadbeef0000122 0000000000000000 [ 265.360177][ T183] raw: 0000000000000000 c0000000119caf58 00000000ffffffff 0000000000000000 [ 265.361438][ T183] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set [ 265.362572][ T183] Modules linked in: [ 265.364622][ T183] CPU: 0 UID: 0 PID: 183 Comm: a.out Not tainted 6.18.0-rc3-00141-g1ddeaaace7ff-dirty #53 VOLUNTARY [ 265.364785][ T183] Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) 0x801200 0xf000006 of:SLOF,git-ee03ae pSeries [ 265.364908][ T183] Call Trace: [ 265.364955][ T183] [c000000011e6f7c0] [c000000001cfaa18] dump_stack_lvl+0x130/0x148 (unreliable) [ 265.365202][ T183] [c000000011e6f7f0] [c000000000794758] bad_page+0xb4/0x1c8 [ 265.365384][ T183] [c000000011e6f890] [c00000000079c020] __free_frozen_pages+0x838/0xd08 [ 265.365554][ T183] [c000000011e6f980] [c0000000000a70ac] pte_frag_destroy+0x298/0x310 [ 265.365729][ T183] [c000000011e6fa30] [c0000000000aa764] arch_exit_mmap+0x34/0x218 [ 265.365912][ T183] [c000000011e6fa80] [c000000000751698] exit_mmap+0xb8/0x820 [ 265.366080][ T183] [c000000011e6fc30] [c0000000001b1258] __mmput+0x98/0x300 [ 265.366244][ T183] [c000000011e6fc80] [c0000000001c81f8] do_exit+0x470/0x1508 [ 265.366421][ T183] [c000000011e6fd70] [c0000000001c95e4] do_group_exit+0x88/0x148 [ 265.366602][ T183] [c000000011e6fdc0] [c0000000001c96ec] pid_child_should_wake+0x0/0x178 [ 265.366780][ T183] [c000000011e6fdf0] [c00000000003a270] system_call_exception+0x1b0/0x4e0 [ 265.366958][ T183] [c000000011e6fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec The bad page state error occurs when such a folio gets freed (with active flag set), from do_exit() path in parallel. ... this can happen when the pte fragment was allocated from this folio, but when all the fragments get freed, the pte_frag_refcount still had some unused fragments. Now, if this process exits, with such folio as it's cached pte_frag in mm->context, then during pte_frag_destroy(), we simply call pagetable_dtor() and pagetable_free(), meaning it doesn't clear the active flag. This, can lead to the above bug. Since we are anyway in do_exit() path, then if the refcount is 0, then I guess it should be ok to simply clear the folio active flag before calling pagetable_dtor() & pagetable_free(). Fixes: 32cc0b7c9d50 ("powerpc: add pte_free_defer() for pgtables sharing page") Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/ee13e7f99b8f258019da2b37655b998e73e5ef8b.1773078178.git.ritesh.list@gmail.com commit 785639b5bf2a87eaf0cda14baaa068b3728c7be2 Author: Cássio Gabriel Date: Mon Mar 16 10:39:38 2026 -0300 ALSA: timer: keep a list of open masters for slave lookup snd_timer_check_slave() still walks all registered timers and all open timer instances to find a matching master for a newly opened slave. Maintain a global list of open master instances that can accept slave links and use it for the slave lookup path instead. This keeps the existing matching semantics while avoiding the nested walk over snd_timer_list and each timer open_list_head. The reverse path in snd_timer_check_master() already scans only the pending slave list, so this makes both lookup paths closer in shape without changing the master/slave linking logic. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260316-alsa-timer-master-list-v1-1-fb95e547110a@gmail.com Signed-off-by: Takashi Iwai commit 0a7ec808abecaf0d5c3ecc0d1b87d58f29c85604 Author: Geert Uytterhoeven Date: Mon Mar 16 16:34:40 2026 +0100 firmware: arm_scmi: Support loop control in quirk code snippets Each SCMI firmware quirk contains a code snippet, which handles the quirk, and has full access to the surrounding context. When this context is (part of) a loop body, the code snippet may want to use loop control statements like "break" and "continue". Unfortunately the SCMI_QUIRK() macro implementation contains a dummy loop, taking precedence over any outer loops. Hence quirk code cannot use loop control statements, but has to resort to polluting the surrounding context with a label, and use goto. Fix this by replacing the "do { ... } while (0)" construct in the SCMI_QUIRK() implementation by "({ ... })". Signed-off-by: Geert Uytterhoeven Reviewed-by: Cristian Marussi Reviewed-by: Peng Fan Message-Id: <51de914cddef8fa86c2e7dd5397e5df759c45464.1773675224.git.geert+renesas@glider.be> Signed-off-by: Sudeep Holla commit 786244f70322e41c937e69f0f935bfd11a9611bf Merge: 8d16e3c6f84482 f338e77383789c Author: Ingo Molnar Date: Tue Mar 17 07:14:42 2026 +0100 Merge tag 'v7.0-rc4' into sched/core, to pick up scheduler fixes Signed-off-by: Ingo Molnar commit d93f8ea0e5ad41d661496d205fac3e2fbd9358c0 Merge: 02e778f12359fd 9876394f64a7c1 Author: Dave Airlie Date: Tue Mar 17 11:27:01 2026 +1000 Merge tag 'drm-intel-next-2026-03-16' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next [airlied: fixed conflict with xe tree] drm/i915 feature pull for v7.1: Features and functionality: - C10/C20/LT PHY PLL divider verification (Mika) - Use trans push mechanism to generate PSR frame change event on LNL+ (Jouni) - Account for DSC bubble overhead for horizontal slices (Ankit, Chaitanya) Refactoring and cleanups: - Refactor DP DSC slice config computation (Imre) - Use GVT versions of register helper macros for GVT MMIO table (Ankit) - C10/C20/LT PHY PLL computation refactoring (Mika) - VGA decode refactoring and related fixes/cleanups (Ville) - Move DSB buffer buffer implementation to display parent interface (Jani) - Move error interrupt capture to display irq snapshot (Jani) - Move pcode calls to display parent interface (Jani) - Reduce GVT dependency on display headers (Jani) - Compute config and mode valid refactoring for DSC (Ankit) - Stop using i915 core register headers in display (Uma) - Refactor DPT, move i915 parts to display parent interface (Jani) - Refactor gen2-4 overlay, move to display parent interface (Ville) - Refactor masked field register macro helpers, move to shared headers (Jani) - Convert a number of workaround checks to the new workaround framework (Luca) - Refactor and move frontbuffer calls to display parent interface (Jani) - Add VMA calls to display parent interface (Jani) - Refactor stolen memory allocation decisions (Vinod, Ville) - Clean up and unify workqueue usage (Marco Crivellari) - Preparation for UHBR DP tunnels (Imre) - Allow DSC passthrough modes during DP MST mode validation (Imre) - Move framebuffer bo interface to display parent interface (Jani) Fixes: - Plenty of DP SST HPD IRQ handling fixes (Imre) - DP AUX backlight and luminance control fixes (Suraj) - Respect VBT pipe joiner disable for eDP (Ankit) - Do not use CASF with joiner (Nemesa) - Clear C10/C20 PHY response read and error bit to avoid PHY hangs (Suraj) - Xe3p_LPD DMG clock gating, CDCLK, port sync workarounds (Suraj, Gustavo, Mitul) - Fix GVT error path (Michał) - Handle errors on DP DSC receiver cap reads (Suraj) - DSS clock gating workaround on MTL+ to avoid DSC corruption (Mika) - Skip state verification for LT PHY in TBT mode (Suraj) - Fix NULL pointer dereference on suspend when uc firmware not loaded (Rahul Bukte) - Fix an unlikely DMC state related NULL pointer dereference at probe (Imre) - Handle error returns from vga_get_uninterruptible() (Simon Richter) - Increase C10/C20/LT PHY timeouts to include SOC/OS turnaround (Arun) - Fix BIOS FB vs. stolen memory size check (Ville) - Fix LOBF to use computed guardband and set context latency (Ankit) - Handle modeset WW mutex lock failures due to contention properly (Imre) - Fix pipe BPP clamping due to HDR (Imre) - Fix stale state usage in DSC state computation (Imre) - Take HDCP 1.4 vs 2.x into account during link check (Suraj) - Fix forced link retrain handling in MST HPD IRQ handler (Imre) - Remove redundant warning on vcpi < 0 (Jonathan) Core changes: - iopoll: fix function parameter names in read_poll_timeout_atomic() (Randy Dunlap) Merges: - Backmerge drm-next for v7.0-rc1 (Jani) Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patch.msgid.link/b14bb0f297b1750816cf5f342bde608e435655fa@intel.com commit 348baefbb635cbb448e154f38c93657d4cf23936 Author: Charles Perry Date: Fri Mar 13 07:21:39 2026 -0700 net: macb: set default_an_inband to true for SGMII Most platforms using GEM in SGMII mode use in-band autonegotiation because it is on by default in GEM's 1G PCS and is always on since commit e276e5e40e92 ("net: macb: Disable PCS auto-negotiation for SGMII fixed-link mode"). Leave it on if possible using the "default_an_inband" flag of "struct phylink_config" so that platforms that lack in-band autonegotiation configurability at the PHY do not break with commit 1338cfef1ff1 ("net: macb: fix SGMII with inband aneg disabled") which will turn off in-band autoneg for non hot pluggable PHYs. Once the majority of the PHY drivers that support SGMII have the ->config_inband() callback, this commit could be reverted so that non hot pluggable PHY use outband negotiation with macb, like its the case for other MACs. Fixes: 1338cfef1ff1 ("net: macb: fix SGMII with inband aneg disabled") Reported-by: Conor Dooley Closes: https://lore.kernel.org/r/20260304-nebulizer-rounding-40fbc81a2ba1@spud Signed-off-by: Charles Perry Tested-by: Conor Dooley Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260313142140.4040647-1-charles.perry@microchip.com Signed-off-by: Jakub Kicinski commit dab177cbea3491354cc3c0b268602d8902501233 Author: Russell King (Oracle) Date: Fri Mar 13 11:51:58 2026 +0000 net: stmmac: move MSI data out of struct stmmac_priv Only three platforms supprt MSIs, which means having all the strings and interrupt arrays always allocated wastes space. None of this data is performance critical - this data is only used when requesting and releasing the MSI interrupts. Move the MSI data out of struct stmmac_priv into its own separately allocated structure, and move its initialisation to a separate function. This removes 768 bytes from struct stmmac_priv. Link: https://lore.kernel.org/r/aYtq4ypxXTvn_Is6@shell.armlinux.org.uk Reviewed-by: Florian Bezdeka Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1w113e-0000000DDwc-2oRv@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a91b5d44d5c5b4f46a087200c124c9899cc0ec48 Merge: cc6421acd97f2a 66ccb4f1d20551 Author: Jakub Kicinski Date: Mon Mar 16 20:07:05 2026 -0700 Merge branch 'support-multi-channel-irqs-in-stmmac-platform-drivers' Jan Petrous says: ==================== Support multi-channel IRQs in stmmac platform drivers The stmmac core supports two interrupt modes, controlled by the flag STMMAC_FLAG_MULTI_MSI_EN: - When the flag is set, the driver uses multi-channel IRQ mode (Multi-IRQ). - Otherwise, a single IRQ line is requested (aka MAC-IRQ): static int stmmac_request_irq(struct net_device *dev) { /* Request the IRQ lines */ if (priv->plat->flags & STMMAC_FLAG_MULTI_MSI_EN) ret = stmmac_request_irq_multi_msi(dev); else ret = stmmac_request_irq_single(dev); } At present, only PCI drivers (Intel and Loongson) make use of the Multi-IRQ mode. This concept can be extended to DT-based embedded glue drivers (dwmac-xxx.c). This series adds support for reading per-channel IRQs from the DT node and reuses the existing STMMAC_FLAG_MULTI_MSI_EN flag to enable multi-IRQ operation in platform drivers. The final decision if Multi-IRQ gets enabled remains on glue driver to allow implementing any reguirements/limitions the focused platform needs. NXP S32G2/S32G3/S32R SoCs integrate the DWMAC IP with multi-channel interrupt support. The dwmac-s32.c driver change is provided as an example of enabling multi-IRQ mode for non-PCI drivers. ==================== Link: https://patch.msgid.link/20260313-dwmac_multi_irq-v12-0-b5c9d0aa13d6@oss.nxp.com Signed-off-by: Jakub Kicinski commit 66ccb4f1d20551969e4aff9128f239c195b3e543 Author: Jan Petrous (OSS) Date: Fri Mar 13 08:13:35 2026 +0100 stmmac: s32: enable support for Multi-IRQ mode Based on previous changes in platform driver, the vendor glue driver can enable Multi-IRQ mode, if needed. To get enabled Multi-IRQ mode for dwmac-s32, the driver checks: 1) property of 'snps,mtl-xx-config' subnode defines 'snps,xx-queues-to-use' bigger then one, ie: ethernet@4033c000 { compatible = "nxp,s32g2-dwmac"; ... snps,mtl-rx-config = <&mtl_rx_setup>; ... mtl_rx_setup: rx-queues-config { snps,rx-queues-to-use = <2>; }; 2) queue based IRQs are set, ie: ethernet@4033c000 { compatible = "nxp,s32g2-dwmac"; ... interrupts = , /* CHN 0: tx, rx */ , , /* CHN 1: tx, rx */ , ; interrupt-names = "macirq", "tx-queue-0", "rx-queue-0", "tx-queue-1", "rx-queue-1"; If those prerequisites are met, the driver switches to Multi-IRQ mode, using per-queue IRQs for rx/tx data pathr: [ 1.387045] s32-dwmac 4033c000.ethernet: Multi-IRQ mode (per queue IRQs) selected Now the driver owns all queues IRQs: root@s32g399aevb3:~# grep eth /proc/interrupts 29: 0 0 0 0 0 0 0 0 GICv3 89 Level eth0:mac 30: 0 0 0 0 0 0 0 0 GICv3 91 Level eth0:rx-0 31: 0 0 0 0 0 0 0 0 GICv3 93 Level eth0:rx-1 32: 0 0 0 0 0 0 0 0 GICv3 95 Level eth0:rx-2 33: 0 0 0 0 0 0 0 0 GICv3 97 Level eth0:rx-3 34: 0 0 0 0 0 0 0 0 GICv3 99 Level eth0:rx-4 35: 0 0 0 0 0 0 0 0 GICv3 90 Level eth0:tx-0 36: 0 0 0 0 0 0 0 0 GICv3 92 Level eth0:tx-1 37: 0 0 0 0 0 0 0 0 GICv3 94 Level eth0:tx-2 38: 0 0 0 0 0 0 0 0 GICv3 96 Level eth0:tx-3 39: 0 0 0 0 0 0 0 0 GICv3 98 Level eth0:tx-4 Otherwise, if one of the prerequisite don't met, the driver continue with MAC IRQ mode: [ 1.387045] s32-dwmac 4033c000.ethernet: MAC IRQ mode selected And only MAC IRQ will be attached: root@s32g399aevb3:~# grep eth /proc/interrupts 29: 0 0 0 0 0 0 0 0 GICv3 89 Level eth0:mac What represents the original MAC IRQ mode and is fully backward compatible. Reviewed-by: Matthias Brugger Signed-off-by: Jan Petrous (OSS) Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260313-dwmac_multi_irq-v12-4-b5c9d0aa13d6@oss.nxp.com Signed-off-by: Jakub Kicinski commit cc7a3435dfadb7469082c6b09018fb2b9cbdeda1 Author: Jan Petrous (OSS) Date: Fri Mar 13 08:13:34 2026 +0100 dt-bindings: net: nxp,s32-dwmac: Declare per-queue interrupts The DWMAC IP on NXP S32G/R SoCs has connected queue-based IRQ lines, set them to allow using Multi-IRQ mode. Reviewed-by: Matthias Brugger Acked-by: Conor Dooley Signed-off-by: Jan Petrous (OSS) Link: https://patch.msgid.link/20260313-dwmac_multi_irq-v12-3-b5c9d0aa13d6@oss.nxp.com Signed-off-by: Jakub Kicinski commit a31bbe5ca2f8265f9c7dbc78f1787b88a1ad1775 Author: Jan Petrous (OSS) Date: Fri Mar 13 08:13:32 2026 +0100 net: stmmac: platform: read channels irq Read IRQ resources for all rx/tx channels, to allow Multi-IRQ mode for platform glue drivers. Reviewed-by: Matthias Brugger Signed-off-by: Jan Petrous (OSS) Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260313-dwmac_multi_irq-v12-1-b5c9d0aa13d6@oss.nxp.com Signed-off-by: Jakub Kicinski commit cc6421acd97f2a386516a16129d00254588bd9ad Author: Maciej Fijalkowski Date: Fri Mar 13 12:19:31 2026 +0100 xsk: remove repeated defines Seems we have been carrying around repeated defines for unaligned mode logic. Remove redundant ones. Signed-off-by: Maciej Fijalkowski Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260313111931.438911-1-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 854587e69ef3b7a14b4380d9b99e18693bb9a07b Author: Eric Dumazet Date: Fri Mar 13 12:03:46 2026 +0000 tcp: improve inet6_ehashfn() entropy Instead of only using the 32 low order bits of the local address, use all of them. Xor net_hash_mix(net) with the 32 high order bits of the local address so that we can use __jhash_mix() three times. If we were hashing 4 extra bytes, we would need one __jhash_final() which is a bit expensive. Using net_hash_mix() at the beginning allows better register allocation. We no longer use a cascade of two jhash and inet6_ehash_secret, this was dubious/weak. Add a comment explaining why @lport is not part of the jhash computation. $ scripts/bloat-o-meter -t vmlinux.0 vmlinux.1 add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-24 (-24) Function old new delta inet6_ehashfn 330 306 -24 Total: Before=24855958, After=24855934, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260313120346.3378811-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6a33a706265daa3a0d92fece0baf6f2c3915f1cd Author: Jakub Kicinski Date: Sun Mar 15 09:00:38 2026 -0700 selftests: net: py: give bpftrace more time to start After commit under Fixes debug runners in the CI hit the following: # subprocess.TimeoutExpired: Command '['bpftrace', '-f', 'json', '-q', '-e', 'kprobe:netpoll_poll_dev { @hits = count(); } interval:s:10 { exit(); }']' timed out after 15 seconds # # Exception| net.lib.py.ksft.KsftFailEx: bpftrace failed to run!?: {} in netpoll_basic.py >10% of the time. Let's give bpftool more time to start, it can take a while on a debug kernel. Fixes: 82562972b854 ("selftests: net: pass bpftrace timeout to cmd()") Reviewed-by: Breno Leitao Reviewed-by: Petr Machata Reviewed-by: Nimrod Oren Link: https://patch.msgid.link/20260315160038.3187730-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 45339c237c6a9ef916061521314acae0a414a6df Author: MD Danish Anwar Date: Wed Mar 11 13:59:23 2026 +0530 net: ti: icssg-prueth: Add HSR multicast FDB port membership management In HSR offload mode, multicast addresses can be added via HSR master (hsr0) or directly to slave ports (eth1/eth2). The FDB must track port membership: P0 (0x1) for HSR master, P1 (0x2) for slave port 1, and P2 (0x4) for slave port 2. When the same address is added from multiple paths, memberships must accumulate. Implement a hybrid approach using __dev_mc_sync() callbacks to track basic add/delete operations, checking netdev_hw_addr->synced to distinguish HSR-synced addresses from direct additions. Post-process to handle overlapping memberships by checking refcount: - refcount=2 with synced=1: HSR only (P0) - refcount>=3 with synced=1: HSR + direct (P0|P1/P2) - synced=0 with P0 set: HSR removed, clean up orphaned P0 On add operations, accumulate new membership with existing ports. On delete operations, remove only the specific port and clean up orphaned P0 bits if needed. Add error handling for icssg_fdb_lookup() which can return negative error codes (e.g., -ETIMEDOUT). On lookup failure in add/delete path, default to no existing membership. In the post-processing path, skip the address update to avoid corrupting FDB entries with garbage values. VLAN Interface Handling: Add support for multicast addresses added to VLAN interfaces on the HSR master (e.g., hsr0.7). These addresses require P0 (HSR master) bit to be set along with the port bits, since VLAN-tagged packets use separate FDB entries per VLAN ID. Without P0, the HSR master would not receive multicast packets on VLAN interfaces. Track whether the add/del operation came from a VLAN interface path and set P0 when in HSR offload mode with VLAN interfaces. Update orphaned P0 cleanup logic to preserve P0 for VLAN interfaces. Signed-off-by: MD Danish Anwar Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260311082923.2962937-1-danishanwar@ti.com Signed-off-by: Jakub Kicinski commit 24fbd3967f3fdaad5f93e0d35ae870ed25fb2c3a Author: Vishwanath Seshagiri Date: Tue Mar 10 11:31:04 2026 -0700 virtio_net: add page_pool support for buffer allocation Use page_pool for RX buffer allocation in mergeable and small buffer modes to enable page recycling and avoid repeated page allocator calls. skb_mark_for_recycle() enables page reuse in the network stack. Big packets mode is unchanged because it uses page->private for linked list chaining of multiple pages per buffer, which conflicts with page_pool's internal use of page->private. Implement conditional DMA premapping using virtqueue_dma_dev(): - When non-NULL (vhost, virtio-pci): use PP_FLAG_DMA_MAP with page_pool handling DMA mapping, submit via virtqueue_add_inbuf_premapped() - When NULL (VDUSE, direct physical): page_pool handles allocation only, submit via virtqueue_add_inbuf_ctx() This preserves the DMA premapping optimization from commit 31f3cd4e5756b ("virtio-net: rq submits premapped per-buffer") while adding page_pool support as a prerequisite for future zero-copy features (devmem TCP, io_uring ZCRX). Page pools are created in probe and destroyed in remove (not open/close), following existing driver behavior where RX buffers remain in virtqueues across interface state changes. Signed-off-by: Vishwanath Seshagiri Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260310183107.2822016-1-vishs@meta.com Signed-off-by: Jakub Kicinski commit 64584273dfb8a1e5fc7d78094ba22a93c204b44e Author: Alejandro Lucero Date: Sat Feb 28 17:36:03 2026 +0000 cxl/region: Factor out interleave granularity setup Region creation based on Type3 devices can be triggered from user space allowing memory combination through interleaving. In preparation for kernel driven region creation, that is Type2 drivers triggering region creation backed with its advertised CXL memory, factor out a common helper from the user-sysfs region setup for interleave granularity. Signed-off-by: Alejandro Lucero Reviewed-by: Gregory Price Reviewed-by: Dave Jiang Tested-by: Gregory Price Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260228173603.1125109-4-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang commit 29f0724c4592a5ab9076e1ff6e4e39f0de60cc9e Author: Alejandro Lucero Date: Sat Feb 28 17:36:02 2026 +0000 cxl/region: Factor out interleave ways setup Region creation based on Type3 devices can be triggered from user space allowing memory combination through interleaving. In preparation for kernel driven region creation, that is Type2 drivers triggering region creation backed with its advertised CXL memory, factor out a common helper from the user-sysfs region setup for interleave ways. Signed-off-by: Alejandro Lucero Reviewed-by: Dave Jiang Reviewed-by: Gregory Price Tested-by: Gregory Price Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260228173603.1125109-3-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang commit 09d065d256b1d5965fe6512cfd1c23ef44d2efc9 Author: Alejandro Lucero Date: Sat Feb 28 17:36:01 2026 +0000 cxl: Make region type based on endpoint type Current code is expecting Type3 or CXL_DECODER_HOSTONLYMEM devices only. Support for Type2 implies region type needs to be based on the endpoint type HDM-D[B] instead. Signed-off-by: Alejandro Lucero Reviewed-by: Zhi Wang Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Ben Cheatham Reviewed-by: Alison Schofield Reviewed-by: Davidlohr Bueso Reviewed-by: Gregory Price Tested-by: Gregory Price Reviewed-by: Davidlohr Bueso Link: https://patch.msgid.link/20260228173603.1125109-2-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang commit d537d953c47866bafc89feb66d8ef34baf17659a Author: Gregory Price Date: Fri Mar 6 16:47:41 2026 +0000 cxl/pci: Remove redundant cxl_pci_find_port() call Remove the redundant port lookup from cxl_rcrb_get_comp_regs() and use the dport parameter directly. The caller has already validated the port is non-NULL before invoking this function, and dport is given as a param. This is simpler than getting dport in the callee and return the pointer to the caller what would require more changes. Signed-off-by: Gregory Price Reviewed-by: Alejandro Lucero Reviewed-by: Jonathan Cameron Reviewed-by: Davidlohr Bueso Link: https://patch.msgid.link/20260306164741.3796372-5-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang commit 58f28930c7fb0e24cdf2972a9c3b7c91aeef4539 Author: Alejandro Lucero Date: Fri Mar 6 16:47:40 2026 +0000 cxl: Move pci generic code from cxl_pci to core/cxl_pci Inside cxl/core/pci.c there are helpers for CXL PCIe initialization meanwhile cxl/pci_drv.c implements the functionality for a Type3 device initialization. In preparation for type2 support, move helper functions from cxl/pci.c to cxl/core/pci.c in order to be exported and used by type2 drivers. [ dj: Clarified subject. ] Signed-off-by: Alejandro Lucero Reviewed-by: Dave Jiang Reviewed-by: Gregory Price Reviewed-by: Jonathan Cameron Signed-off-by: Gregory Price Link: https://patch.msgid.link/20260306164741.3796372-4-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang commit 005869886d1d370afb6c10cd40709d956960e9c2 Author: Alejandro Lucero Date: Fri Mar 6 16:47:39 2026 +0000 cxl: export internal structs for external Type2 drivers In preparation for type2 support, move structs and functions a type2 driver will need to access to into a new shared header file. Differentiate between public and private data to be preserved by type2 drivers. Signed-off-by: Alejandro Lucero Reviewed-by: Dave Jiang Tested-by: Alison Schofield Reviewed-by: Gregory Price Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260306164741.3796372-3-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang commit 9a775c07bb04384f7c03a35dd04818ed818c1f71 Author: Alejandro Lucero Date: Fri Mar 6 16:47:38 2026 +0000 cxl: support Type2 when initializing cxl_dev_state In preparation for type2 drivers add function and macro for differentiating CXL memory expanders (type 3) from CXL device accelerators (type 2) helping drivers built from public headers to embed struct cxl_dev_state inside a private struct. Update type3 driver for using this same initialization. Signed-off-by: Alejandro Lucero Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Reviewed-by: Gregory Price Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260306164741.3796372-2-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang commit a46aaa76ad21de033f188595173e8ae7afefddc0 Author: Viacheslav Dubeyko Date: Thu Mar 12 15:19:21 2026 -0700 hfsplus: fix generic/533 test-case failure The xfstests' test-case generic/533 fails to execute correctly: FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc4+ #8 SMP PREEMPT_DYNAMIC Thu May 1 16:43:22 PDT 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/533 _check_generic_filesystem: filesystem on /dev/loop50 is inconsistent (see xfstests-dev/results//generic/533.full for details) The key reason of the issue is returning -ENOENT error code from hfsplus_find_attr(), __hfsplus_delete_attr(), hfsplus_delete_attr_nolock(), hfsplus_delete_all_attrs(). The file exists but we don't have any xattr for this file. Finally, -ENODATA error code is expected by application logic. This patch reworks xattr logic of HFS+ by means exchanging the -ENOENT error code on -ENODATA error code if xattr has not been found for existing file or folder. sudo ./check generic/533 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #16 SMP PREEMPT_DYNAMIC Wed Mar 11 15:04:58 PDT 2026 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/533 33s ... 32s Ran: generic/533 Passed all 1 tests Closes: https://github.com/hfs-linux-kernel/hfs-linux-kernel/issues/184 cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260312221920.1422683-2-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 98f37634b12b17ad5c56db8fb63cf9d7dc55d74c Author: Pavel Begunkov Date: Thu Feb 26 12:48:41 2026 +0000 io_uring/bpf-ops: implement bpf ops registration Implement BPF struct ops registration. It's registered off the BPF path, and can be removed by BPF as well as io_uring. To protect it, introduce a global lock synchronising registration. ctx->uring_lock can be nested under it. ctx->bpf_ops is write protected by both locks and so it's safe to read it under either of them. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/1f46bffd76008de49cbafa2ad77d348810a4f69e.1772109579.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 890819248a8616558fe12e6c06c918ee1c3a2bc6 Author: Pavel Begunkov Date: Thu Feb 26 12:48:40 2026 +0000 io_uring/bpf-ops: add kfunc helpers Add two kfuncs that should cover most of the needs: 1. bpf_io_uring_submit_sqes(), which allows to submit io_uring requests. It mirrors the normal user space submission path and follows all related io_uring_enter(2) rules. i.e. SQEs are taken from the SQ according to head/tail values. In case of IORING_SETUP_SQ_REWIND, it'll submit first N entries. 2. bpf_io_uring_get_region() returns a pointer to the specified region, where io_uring regions are kernel-userspace shared chunks of memory. It takes the size as an argument, which should be a load time constant. There are 3 types of regions: - IOU_REGION_SQ returns the submission queue. - IOU_REGION_CQ stores the CQ, SQ/CQ headers and the sqarray. In other words, it gives same memory that would normally be mmap'ed with IORING_FEAT_SINGLE_MMAP enabled IORING_OFF_SQ_RING. - IOU_REGION_MEM represents the memory / parameter region. It can be used to store request indirect parameters and for kernel - user communication. It intentionally provides a thin but flexible API and expects BPF programs to implement CQ/SQ header parsing, CQ walking, etc. That mirrors how the normal user space works with rings and should help to minimise kernel / kfunc helpers changes while introducing new generic io_uring features. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/967bcc10e94c796eb273998621551b2a21848cde.1772109579.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit d0e437b76bd3c979ddaa6205f5e9ad3e0f95faef Author: Pavel Begunkov Date: Thu Feb 26 12:48:39 2026 +0000 io_uring/bpf-ops: implement loop_step with BPF struct_ops Introduce io_uring BPF struct ops implementing the loop_step callback, which will allow BPF to overwrite the default io_uring event loop logic. The callback takes an io_uring context, the main role of which is to be passed to io_uring kfuncs. The other argument is a struct iou_loop_params, which BPF can use to request CQ waiting and communicate other parameters. See the event loop description in the previous patch for more details. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/98db437651ce64e9cbeb611c60bf5887259db09f.1772109579.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 033af2b3eb19c5ed96825572105bca3611635ada Author: Pavel Begunkov Date: Thu Feb 26 12:48:38 2026 +0000 io_uring: introduce callback driven main loop The io_uring_enter() has a fixed order of execution: it submits requests, waits for completions, and returns to the user. Allow to optionally replace it with a custom loop driven by a callback called loop_step. The basic requirements to the callback is that it should be able to submit requests, wait for completions, parse them and repeat. Most of the communication including parameter passing can be implemented via shared memory. The callback should return IOU_LOOP_CONTINUE to continue execution or IOU_LOOP_STOP to return to the user space. Note that the kernel may decide to prematurely terminate it as well, e.g. in case the process was signalled or killed. The hook takes a structure with parameters. It can be used to ask the kernel to wait for CQEs by setting cq_wait_idx to the CQE index it wants to wait for. Spurious wake ups are possible and even likely, the callback is expected to handle it. There will be more parameters in the future like timeout. It can be used with kernel callbacks, for example, as a slow path deprecation mechanism overwiting SQEs and emulating the wanted behaviour, however it's more useful together with BPF programs implemented in following patches. Note that keeping it separately from the normal io_uring wait loop makes things much simpler and cleaner. It keeps it in one place instead of spreading a bunch of checks in different places including disabling the submission path. It holds the lock by default, which is a better fit for BPF synchronisation and the loop execution model. It nicely avoids existing quirks like forced wake ups on timeout request completion. And it should be easier to implement new features. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/a2d369aa1c9dd23ad7edac9220cffc563abcaed6.1772109579.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit f144dbac4b177cfd026e417ab98da518ff3372cb Author: Caleb Sander Mateos Date: Mon Mar 2 10:29:14 2026 -0700 nvme: remove nvme_dev_uring_cmd() IO_URING_F_IOPOLL check nvme_dev_uring_cmd() is part of struct file_operations nvme_dev_fops, which doesn't implement ->uring_cmd_iopoll(). So it won't be called with issue_flags that include IO_URING_F_IOPOLL. Drop the unnecessary IO_URING_F_IOPOLL check in nvme_dev_uring_cmd(). Signed-off-by: Caleb Sander Mateos Reviewed-by: Kanchan Joshi Reviewed-by: Anuj Gupta Link: https://patch.msgid.link/20260302172914.2488599-6-csander@purestorage.com Signed-off-by: Jens Axboe commit 23475637b0c47e5028817c9fd4dabe8f7409ca6c Author: Caleb Sander Mateos Date: Mon Mar 2 10:29:13 2026 -0700 io_uring/uring_cmd: allow non-iopoll cmds with IORING_SETUP_IOPOLL Currently, creating an io_uring with IORING_SETUP_IOPOLL requires all requests issued to it to support iopoll. This prevents, for example, using ublk zero-copy together with IORING_SETUP_IOPOLL, as ublk zero-copy buffer registrations are performed using a uring_cmd. There's no technical reason why these non-iopoll uring_cmds can't be supported. They will either complete synchronously or via an external mechanism that calls io_uring_cmd_done(), io_uring_cmd_post_mshot_cqe32(), or io_uring_mshot_cmd_post_cqe(), so they don't need to be polled. Allow uring_cmd requests to be issued to IORING_SETUP_IOPOLL io_urings even if their files don't implement ->uring_cmd_iopoll(). For these uring_cmd requests, skip initializing struct io_kiocb's iopoll fields, don't set REQ_F_IOPOLL, and don't set IO_URING_F_IOPOLL in issue_flags. Signed-off-by: Caleb Sander Mateos Reviewed-by: Kanchan Joshi Reviewed-by: Anuj Gupta Link: https://patch.msgid.link/20260302172914.2488599-5-csander@purestorage.com Signed-off-by: Jens Axboe commit 3a5e96d47f7ea37fb6adf37882eec1521f8ca75e Author: Caleb Sander Mateos Date: Mon Mar 2 10:29:12 2026 -0700 io_uring: count CQEs in io_iopoll_check() A subsequent commit will allow uring_cmds that don't use iopoll on IORING_SETUP_IOPOLL io_urings. As a result, CQEs can be posted without setting the iopoll_completed flag for a request in iopoll_list or going through task work. For example, a UBLK_U_IO_FETCH_IO_CMDS command could call io_uring_mshot_cmd_post_cqe() to directly post a CQE. The io_iopoll_check() loop currently only counts completions posted in io_do_iopoll() when determining whether the min_events threshold has been met. It also exits early if there are any existing CQEs before polling, or if any CQEs are posted while running task work. CQEs posted via io_uring_mshot_cmd_post_cqe() or other mechanisms won't be counted against min_events. Explicitly check the available CQEs in each io_iopoll_check() loop iteration to account for CQEs posted in any fashion. Signed-off-by: Caleb Sander Mateos Link: https://patch.msgid.link/20260302172914.2488599-4-csander@purestorage.com Signed-off-by: Jens Axboe commit 7995be40deb3ab8b5df7bdf0621f33aa546aefa7 Author: Caleb Sander Mateos Date: Mon Mar 2 10:29:11 2026 -0700 io_uring: remove iopoll_queue from struct io_issue_def The opcode iopoll_queue flag is now redundant with REQ_F_IOPOLL. Only io_{read,write}{,_fixed}() and io_uring_cmd() set the REQ_F_IOPOLL flag, and the opcodes with these ->issue() implementations are precisely the ones that set iopoll_queue. So don't bother checking the iopoll_queue flag in io_issue_sqe(). Remove the unused flag from struct io_issue_def. Signed-off-by: Caleb Sander Mateos Reviewed-by: Kanchan Joshi Reviewed-by: Anuj Gupta Link: https://patch.msgid.link/20260302172914.2488599-3-csander@purestorage.com Signed-off-by: Jens Axboe commit 9165dc4fa969b64c2d4396ee4e1546a719978dd1 Author: Caleb Sander Mateos Date: Mon Mar 2 10:29:10 2026 -0700 io_uring: add REQ_F_IOPOLL A subsequent commit will allow uring_cmds to files that don't implement ->uring_cmd_iopoll() to be issued to IORING_SETUP_IOPOLL io_urings. This means the ctx's IORING_SETUP_IOPOLL flag isn't sufficient to determine whether a given request needs to be iopolled. Introduce a request flag REQ_F_IOPOLL set in ->issue() if a request needs to be iopolled to completion. Set the flag in io_rw_init_file() and io_uring_cmd() for requests issued to IORING_SETUP_IOPOLL ctxs. Use the request flag instead of IORING_SETUP_IOPOLL in places dealing with a specific request. A future possibility would be to add an option to enable/disable iopoll in the io_uring SQE instead of determining it from IORING_SETUP_IOPOLL. Signed-off-by: Caleb Sander Mateos Reviewed-by: Kanchan Joshi Reviewed-by: Anuj Gupta Link: https://patch.msgid.link/20260302172914.2488599-2-csander@purestorage.com Signed-off-by: Jens Axboe commit 8c557449199e8267bc969ae7e1d70b343b6a646d Author: Jens Axboe Date: Sat Mar 14 08:46:17 2026 -0600 io_uring: mark known and harmless racy ctx->int_flags uses There are a few of these, where flags are read outside of the uring_lock, yet it's harmless to race on them. Signed-off-by: Jens Axboe commit f1a424e21c15993db0f9594cda17ef5d516ab3e9 Author: Jens Axboe Date: Sat Mar 14 08:41:04 2026 -0600 io_uring: switch struct io_ring_ctx internal bitfields to flags Bitfields cannot be set and checked atomically, and this makes it more clear that these are indeed in shared storage and must be checked and set in a sane fashion. This is in preparation for annotating a few of the known racy, but harmless, flags checking. No intended functional changes in this patch. Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit 2364959abecb052d7b798ae51d0626edec8b9288 Author: Ihor Solodrai Date: Mon Mar 16 09:39:16 2026 -0700 libbpf: Start v1.8 development cycle libbpf 1.7.0 has been released [1]. Update libbpf.map and libbpf_verson.h to start v1.8 development cycle. [1] https://github.com/libbpf/libbpf/releases/tag/v1.7.0 Signed-off-by: Ihor Solodrai Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260316163916.2822081-1-ihor.solodrai@linux.dev commit 7e2f40ef0a75f5fac3fbe8ab192c15ca6523e0f4 Author: Ihor Solodrai Date: Thu Mar 12 16:48:20 2026 -0700 selftests/bpf: Bump path and command buffer sizes in bpftool_helpers.c The path length of 64 is way too low in some envirnoments, which leads to subtle failures due to truncation [1]. Replace BPFTOOL_PATH_MAX_LEN with PATH_MAX, and set BPFTOOL_FULL_CMD_MAX_LEN to double of PATH_MAX. [1] https://github.com/libbpf/libbpf/actions/runs/22980753016/job/66719800527 Signed-off-by: Ihor Solodrai Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260312234820.439720-1-ihor.solodrai@linux.dev commit c73a24436698ade1b6a0742e8bcfa04c9ef8fad9 Author: Mykyta Yatsenko Date: Thu Mar 12 17:03:27 2026 -0700 bpftool: Allow explicitly skip llvm, libbfd and libcrypto dependencies Introduce SKIP_LLVM, SKIP_LIBBFD, and SKIP_CRYPTO build flags that let users build bpftool without these optional dependencies. SKIP_LLVM=1 skips LLVM even when detected. SKIP_LIBBFD=1 prevents the libbfd JIT disassembly fallback when LLVM is absent. Together, they produce a bpftool with no disassembly support. SKIP_CRYPTO=1 excludes sign.c and removes the -lcrypto link dependency. Inline stubs in main.h return errors with a clear message if signing functions are called at runtime. Use BPFTOOL_WITHOUT_CRYPTO (not HAVE_LIBCRYPTO_SUPPORT) as the C define, following the BPFTOOL_WITHOUT_SKELETONS naming convention for bpftool-internal build config, leaving HAVE_LIBCRYPTO_SUPPORT free for proper feature detection in the future. All three flags are propagated through the selftests Makefile to bpftool sub-builds. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260312-b4-bpftool_build-v2-1-4c9d57133644@meta.com commit a1ed752bc7cb77b740cee671567d9508ae74becd Author: Sizhe Liu Date: Wed Mar 11 14:52:11 2026 -0500 PCI/DPC: Hold pci_dev reference during error recovery The AER and EDR error handling paths hold a reference on the pci_dev during recovery. Hold a reference during the DPC recovery path as well. Signed-off-by: Sizhe Liu [bhelgaas: split to separate patch] Signed-off-by: Bjorn Helgaas https://patch.msgid.link/20260214081130.1878424-1-liusizhe5@huawei.com commit 18d4a06e10051681de074a9250e54afc1f3ee312 Author: Gregor Herburger Date: Thu Feb 26 09:55:59 2026 +0100 arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt On the -d revision of bcm2712 the uart interrupt is on 120. Update it accordingly. Signed-off-by: Gregor Herburger Link: https://lore.kernel.org/r/20260226-raspi-dts-updates-v1-6-60832d20ff04@linutronix.de Signed-off-by: Florian Fainelli commit aeb078cebc40d421f61a8f07b0e7919aeb44d751 Author: Gregor Herburger Date: Thu Feb 26 09:55:58 2026 +0100 arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon On the -d revision of the bcm2712 the pinctrl differs from the c0 revision. The driver already supports both and distinguishes the two with the compatible string. Update the compatible string and reg length to reflect the different pinctrl. Signed-off-by: Gregor Herburger Link: https://lore.kernel.org/r/20260226-raspi-dts-updates-v1-5-60832d20ff04@linutronix.de Signed-off-by: Florian Fainelli commit 783922597a48e1bb8dfea5e196eb080d88e5967a Author: Gregor Herburger Date: Thu Feb 26 09:55:57 2026 +0100 arm64: dts: broadcom: bcm2712-rpi-5-b: add pinctrl properties for csi i2cs Configure the i2c pins for the csi interfaces as i2c. Signed-off-by: Gregor Herburger Link: https://lore.kernel.org/r/20260226-raspi-dts-updates-v1-4-60832d20ff04@linutronix.de Signed-off-by: Florian Fainelli commit f9b7d552273fd32ec5fd307f48ce40ae6d7ea0c7 Author: Gregor Herburger Date: Thu Feb 26 09:55:56 2026 +0100 arm64: dts: broadcom: bcm2712: add camera backend node pispbe The bcm2712 found in the Raspberry Pi 5 has a PiSP Image Signal Processor back end image processor. Add the relevant node to the devicetree. Signed-off-by: Gregor Herburger Link: https://lore.kernel.org/r/20260226-raspi-dts-updates-v1-3-60832d20ff04@linutronix.de Signed-off-by: Florian Fainelli commit cdf38d5997a5cb4ef874602936dfb74a6810f52c Author: Gregor Herburger Date: Thu Feb 26 09:55:55 2026 +0100 arm64: dts: broadcom: rp1: add csi nodes The RaspberryPi 5 has 2 PiSP Camera front end controller on the RP1 chipset. Add the relevant nodes to the devicetree. Signed-off-by: Gregor Herburger Link: https://lore.kernel.org/r/20260226-raspi-dts-updates-v1-2-60832d20ff04@linutronix.de Signed-off-by: Florian Fainelli commit 531f5a97394b2dc2606e3d2ee960b783602d7f2e Author: Gregor Herburger Date: Thu Feb 26 09:55:54 2026 +0100 arm64: dts: broadcom: rp1: add i2c controller The RaspberryPi 5 has 7 designware-i2c I2C controller on the RP1 chipset. Add the relevant nodes to the devicetree. Signed-off-by: Gregor Herburger Link: https://lore.kernel.org/r/20260226-raspi-dts-updates-v1-1-60832d20ff04@linutronix.de Signed-off-by: Florian Fainelli commit 893faf67438cb7642d8c2da7650a436716155416 Author: Rosen Penev Date: Sun Mar 1 16:07:36 2026 -0800 ARM: dts: BCM5301X: add root pcie bridges They are always required and instead of duplicating a definition in each dts file, place it in dtsi with labels and work based on that. Also changed each bridge@ to pcie@ to get extra dtc static analysis. Fixed bridge numbers as a result. Signed-off-by: Rosen Penev Link: https://lore.kernel.org/r/20260302000736.592422-1-rosenp@gmail.com Signed-off-by: Florian Fainelli commit 4dd2115f43594da5271a1aa34fde6719b4259047 Author: Tariq Toukan Date: Mon Mar 9 11:34:35 2026 +0200 net/mlx5: Expose MLX5_UMR_ALIGN definition Expose HW constant value in a shared header, to be used by core/EN drivers. Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260309093435.1850724-10-tariqt@nvidia.com Reviewed-by: Dragos Tatulea Signed-off-by: Leon Romanovsky commit d6c9b4de8109a3b4ca9c6c6b7c5fbc42cfeff9ae Author: Shay Drory Date: Mon Mar 9 11:34:34 2026 +0200 {net/RDMA}/mlx5: Add LAG demux table API and vport demux rules Downstream patches will introduce SW-only LAG (e.g. shared_fdb without HW LAG). In this mode the firmware cannot create the LAG demux table, but vport demuxing is still required. Move LAG demux flow-table ownership to the LAG layer and introduce APIs to init/cleanup the demux table and add/delete per-vport rules. Adjust the RDMA driver to use the new APIs. In this mode, the LAG layer will create a flow group that matches vport metadata. Vports that are not native to the LAG master eswitch add the demux rule during IB representor load and remove it on unload. The demux rule forward traffic from said vports to their native eswitch manager via a new dest type - MLX5_FLOW_DESTINATION_TYPE_VHCA_RX. Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260309093435.1850724-9-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 0bc9059fab6365feaf95cc9a796a3d381915a70f Author: Shay Drory Date: Mon Mar 9 11:34:33 2026 +0200 net/mlx5: Add VHCA RX flow destination support for FW steering Introduce MLX5_FLOW_DESTINATION_TYPE_VHCA_RX as a new flow steering destination type. Wire the new destination through flow steering command setup by mapping it to MLX5_IFC_FLOW_DESTINATION_TYPE_VHCA_RX and passing the vhca id, extend forward-destination validation to accept it, and teach the flow steering tracepoint formatter to print rx_vhca_id. Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260309093435.1850724-8-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 971b28accc09436fe6a6d5afd667dcbfb3ed7e03 Author: Shay Drory Date: Mon Mar 9 11:34:32 2026 +0200 net/mlx5: LAG, replace mlx5_get_dev_index with LAG sequence number Introduce mlx5_lag_get_dev_seq() which returns a device's sequence number within the LAG: master is always 0, remaining devices numbered sequentially. This provides a stable index for peer flow tracking and vport ordering without depending on native_port_num. Replace mlx5_get_dev_index() usage in en_tc.c (peer flow array indexing) and ib_rep.c (vport index ordering) with the new API. Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260309093435.1850724-7-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit da0349d0ffc7b831a589b1fcec59d9d94aa10e55 Author: Shay Drory Date: Mon Mar 9 11:34:31 2026 +0200 net/mlx5: E-switch, modify peer miss rule index to vhca_id Replace the fixed-size array peer_miss_rules[MLX5_MAX_PORTS], indexed by physical function index, with an xarray indexed by vhca_id. This decouples peer_miss_rules from mlx5_get_dev_index(), removing the dependency on a PF-derived index and the arbitrary MLX5_MAX_PORTS bounds check. Using vhca_id as the key simplifies insertion/removal logic and scales better across multi-peer topologies. Initialize and destroy the xarray alongside the existing esw->paired xarray in mlx5_esw_offloads_devcom_init/cleanup respectively. Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260309093435.1850724-6-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 2b204cdb12068c7087f44a6a6d0af6f71fd72237 Author: Shay Drory Date: Mon Mar 9 11:34:30 2026 +0200 net/mlx5: LAG, use xa_alloc to manage LAG device indices Replace the use of mlx5_get_dev_index() for xarray indexing with xa_alloc() to dynamically allocate indices. This decouples the LAG xarray index from the physical device index. Update mlx5_ldev_add_netdev/remove_mdev to find entries by dev pointer and replace mlx5_lag_get_dev_index_by_seq(ldev, MLX5_LAG_P1) calls with mlx5_lag_get_master_idx() where appropriate. No functional changes intended Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260309093435.1850724-5-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 91e9f3e7b626579b0393151545b80e50e2bffdca Author: Shay Drory Date: Mon Mar 9 11:34:29 2026 +0200 net/mlx5: LAG, replace pf array with xarray Replace the fixed-size array with a dynamic xarray. This commit changes: - Adds mlx5_lag_pf() helper for consistent xarray access - Converts all direct pf[] accesses to use the new helper/macro - Dynamically allocates lag_func entries via xa_store/xa_load No functional changes intended. This prepares the LAG infrastructure for future flexibility in device indexing. Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260309093435.1850724-4-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 691dffc7255e740bc3df1c68b50b36786aadeb3a Author: Shay Drory Date: Mon Mar 9 11:34:28 2026 +0200 net/mlx5: Add silent mode set/query and VHCA RX IFC bits Update the mlx5 IFC headers with newly defined capability and command-layout bits: - Add silent_mode_query and rename silent_mode to silent_mode_set cap fields. - Add forward_vhca_rx and MLX5_IFC_FLOW_DESTINATION_TYPE_VHCA_RX. - Expose silent mode fields in the L2 table query command structures. Update the SD support check to use the new capability name (silent_mode_set) to match the updated IFC definition. Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260309093435.1850724-3-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit f8e761655997cc0ee434fb5f35570d2e93d3a707 Author: Alexei Lazar Date: Mon Mar 9 11:34:27 2026 +0200 net/mlx5: Add IFC bits for shared headroom pool PBMC support Add hardware interface definitions for shared headroom pool (SHP) in port buffer management: - shp_pbmc_pbsr_support: capability bit in PCAM enhanced features indicating device support for shared headroom pool in PBMC/PBSR. - shared_headroom_pool: buffer entry in PBMC register (pbmc_reg_bits) for the shared headroom pool configuration, reusing the bufferx layout; reduce trailing reserved region accordingly. Signed-off-by: Alexei Lazar Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260309093435.1850724-2-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 531397a80360661b61fb69ab41c7359c1f7d35c1 Author: Kim Phillips Date: Tue Feb 3 16:24:05 2026 -0600 x86/sev: Rename SNP_FEATURES_PRESENT to SNP_FEATURES_IMPL Rename SNP_FEATURES_PRESENT to SNP_FEATURES_IMPL to denote its counterpart relationship with SNP_FEATURES_IMPL_REQ. [ bp: Drop stable@, massage commit message. ] Suggested-by: Borislav Petkov (AMD) Suggested-by: Tom Lendacky Signed-off-by: Kim Phillips Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260203222405.4065706-4-kim.phillips@amd.com commit f699e0aa7a1382f52fb6f3e8e26754e7aaad6db6 Author: Miquel Raynal Date: Wed Feb 4 10:15:30 2026 +0100 ARM: dts: BCM5301X: Drop extra NAND controller compatible Fix the dtbs_check warning introduced when the brcm,brcmnand fallback compatible got removed for iProc machines. Fixes: 4db35366d6dc ("dt-bindings: mtd: brcm,brcmnand: Drop "brcm,brcmnand" compatible for iProc") Signed-off-by: Miquel Raynal Acked-by: Rob Herring (Arm) Acked-by: William Zhang Link: https://lore.kernel.org/r/20260204091530.624230-1-miquel.raynal@bootlin.com Signed-off-by: Florian Fainelli commit 76701239797698b620f2b7ec713fe08ef50ee664 Author: Rafał Miłecki Date: Thu Jan 8 23:40:26 2026 +0100 ARM: dts: BCM5301X: Describe PCIe controllers fully Tested successfully on BCM47094 SoC using Linux's pcie-iproc-platform driver. This fixes: arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dtb: pcie@12000: 'device_type' is a required property from schema $id: http://devicetree.org/schemas/pci/pci-bus.yaml# arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dtb: pcie@12000: 'ranges' is a required property from schema $id: http://devicetree.org/schemas/pci/pci-bus.yaml# arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dtb: pcie@13000: 'device_type' is a required property from schema $id: http://devicetree.org/schemas/pci/pci-bus.yaml# arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dtb: pcie@13000: 'ranges' is a required property from schema $id: http://devicetree.org/schemas/pci/pci-bus.yaml# arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dtb: pcie@14000: 'device_type' is a required property from schema $id: http://devicetree.org/schemas/pci/pci-bus.yaml# arch/arm/boot/dts/broadcom/bcm4708-asus-rt-ac56u.dtb: pcie@14000: 'ranges' is a required property from schema $id: http://devicetree.org/schemas/pci/pci-bus.yaml# Signed-off-by: Rafał Miłecki Link: https://lore.kernel.org/r/20260108224026.3550-1-zajec5@gmail.com Signed-off-by: Florian Fainelli commit 80ebada3dbcc811f3f64fc65e49d87857fe9272b Author: Maíra Canal Date: Wed Jan 14 09:04:58 2026 -0300 arm64: dts: broadcom: bcm2712: Add V3D device node Commits 0ad5bc1ce463 ("drm/v3d: fix up register addresses for V3D 7.x") and 6fd9487147c4 ("drm/v3d: add brcm,2712-v3d as a compatible V3D device") added driver support for V3D on BCM2712, but the corresponding device tree node is still missing. Add the V3D device tree node to the BCM2712 DTS. Signed-off-by: Maíra Canal Reviewed-by: Stefan Wahren Link: https://lore.kernel.org/r/20260114120610.82531-1-mcanal@igalia.com Signed-off-by: Florian Fainelli commit 8ed8b02396172b137ca8c78c3cb999ddf4fb0bbf Author: Lizhi Hou Date: Mon Mar 16 10:56:42 2026 -0700 accel/amdxdna: Add debug prints for command submission Add debug prints to help diagnose issues with incoming command submissions. Reviewed-by: Mario Limonciello Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260316175642.1451749-1-lizhi.hou@amd.com commit 51a0b7c4ede5c775e9d362e5f465ca993e076823 Author: Joe Lawrence Date: Tue Mar 10 16:37:51 2026 -0400 livepatch/klp-build: report patch validation fuzz Capture the output of the patch command to detect when a patch applies with fuzz or line offsets. If such "fuzz" is detected during the validation phase, warn the user and display the details. This helps identify input patches that may need refreshing against the target source tree. Ensure that internal patch operations (such as those in refresh_patch or during the final build phase) can still run quietly. Signed-off-by: Joe Lawrence Acked-by: Song Liu Link: https://patch.msgid.link/20260310203751.1479229-13-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit 1fbc9b855f08f89ccf933324a5cbd8c53ee94d87 Author: Joe Lawrence Date: Tue Mar 10 16:37:50 2026 -0400 livepatch/klp-build: add terminal color output Improve the readability of klp-build output by implementing a basic color scheme. When the standard output and error are connected to a terminal, highlight status messages in bold and warning/error prefixes in yellow/red. Acked-by: Song Liu Signed-off-by: Joe Lawrence Link: https://patch.msgid.link/20260310203751.1479229-12-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit b41d8b7d1752f2f85fc1a87f5e4f4dda45adad15 Author: Joe Lawrence Date: Tue Mar 10 16:37:49 2026 -0400 livepatch/klp-build: provide friendlier error messages Provide more context for common klp-build failure modes. Clarify which user-provided patch is unsupported or failed to apply, and explicitly identify which kernel build (original or patched) failed. Acked-by: Song Liu Signed-off-by: Joe Lawrence Link: https://patch.msgid.link/20260310203751.1479229-11-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit e506ad210d6d7aeaff4bca777428c8c8f9850150 Author: Joe Lawrence Date: Tue Mar 10 16:37:47 2026 -0400 livepatch/klp-build: improve short-circuit validation Update SHORT_CIRCUIT behavior to better handle patch validation and argument processing in later klp-build steps. Perform patch validation for both step 1 (building original kernel) and step 2 (building patched kernel) to ensure patches are verified before any compilation occurs. Additionally, allow the user to omit input patches when skipping past step 2. Acked-by: Song Liu Signed-off-by: Joe Lawrence Link: https://patch.msgid.link/20260310203751.1479229-9-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit b4a53519393521c68ec65f43bfebd64f178e6220 Author: Joe Lawrence Date: Tue Mar 10 16:37:46 2026 -0400 livepatch/klp-build: fix shellcheck complaints Fix or suppress the following shellcheck warnings: In klp-build line 57: command grep "$@" || true ^--^ SC2317 (info): Command appears to be unreachable. Check usage (or ignore if invoked indirectly). Fix the following warning: In klp-build line 565: local file_dir="$(dirname "$file")" ^------^ SC2034 (warning): file_dir appears unused. Verify use (or export if used externally). Acked-by: Song Liu Signed-off-by: Joe Lawrence Link: https://patch.msgid.link/20260310203751.1479229-8-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit 0573bcc4ffca498a6c644b0e1ccbe1a6d9b96a5c Author: Joe Lawrence Date: Tue Mar 10 16:37:45 2026 -0400 livepatch/klp-build: add Makefile with check target Add a standalone Makefile with a 'check' target that runs static code analysis (shellcheck) on the klp-build script(s). This is intended strictly as a development aid. Acked-by: Song Liu Signed-off-by: Joe Lawrence Link: https://patch.msgid.link/20260310203751.1479229-7-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit e4dbf70615e52255de3ff943ac08e0bbd080dcd6 Author: Joe Lawrence Date: Tue Mar 10 16:37:44 2026 -0400 livepatch/klp-build: add grep-override function Provide a custom grep() function to catch direct usage of the command. Bare grep calls are generally incompatible with pipefail and errexit behavior (where a failed match causes the script to exit). Developers can still call grep via command grep if that behavior is explicitly desired. Acked-by: Song Liu Signed-off-by: Joe Lawrence Link: https://patch.msgid.link/20260310203751.1479229-6-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit d36a7343f4bac518b6ef05e2ccc47acd3a2cdab9 Author: Joe Lawrence Date: Tue Mar 10 16:37:43 2026 -0400 livepatch/klp-build: switch to GNU patch and recountdiff The klp-build script is currently very strict with input patches, requiring them to apply cleanly via `git apply --recount`. This prevents the use of patches with minor contextual fuzz relative to the target kernel sources. To allow users to reuse a patch across similar kernel streams, switch to using GNU patch and patchutils for intermediate patch manipulation. Update the logic for applying, reverting, and regenerating patches: - Use 'patch -p1' for better handling of context fuzz. - Use 'recountdiff' to update line counts after FIX_PATCH_LINES. - Drop git_refresh() and related git-specific logic. Signed-off-by: Joe Lawrence Acked-by: Song Liu Link: https://patch.msgid.link/20260310203751.1479229-5-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit 757bd10ff0f015d83481d39a266eb752dbbfce33 Author: Joe Lawrence Date: Tue Mar 10 16:37:42 2026 -0400 livepatch/klp-build: support patches that add/remove files The klp-build script prepares a clean patch by populating two temporary directories ('a' and 'b') with source files and diffing the result. However, this process fails when a patch introduces a new source file, as the script attempts to copy files that do not yet exist in the original source tree. Likewise, it fails when a patch removes a source file and the script attempts to copy a file that no longer exists. Refactor the file-gathering logic to distinguish between original input files and patched output files: - Split get_patch_files() into get_patch_input_files() and get_patch_output_files() to identify which files exist before and after patch application. - Filter out "/dev/null" from both to handle file creation/deletion. - Update refresh_patch() to only copy existing input files to the 'a' directory and the resulting output files to the 'b' directory. Acked-by: Song Liu Signed-off-by: Joe Lawrence Link: https://patch.msgid.link/20260310203751.1479229-4-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit 5efa9a54c6a5f22080f33012c41a94112e955b53 Author: Jori Koolstra Date: Fri Mar 6 20:06:28 2026 +0100 vfio: replace vfio->class with a const struct class The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Replace vfio->class with a const struct class and drop the class_create() call. Compile tested and found no errors/warns in dmesg after enabling VFIO_GROUP. Link: https://lore.kernel.org/all/2023040244-duffel-pushpin-f738@gregkh/ Suggested-by: Greg Kroah-Hartman Signed-off-by: Jori Koolstra Link: https://lore.kernel.org/r/20260306190628.259203-1-jkoolstra@xs4all.nl Signed-off-by: Alex Williamson commit b7cbc6b8646eec120a652bbfc867e9cc50a14d5f Merge: f8d51e903a6c97 b6a6cd3f6b5b0d Author: Mark Brown Date: Mon Mar 16 18:45:30 2026 +0000 ASoC: Handle edge case on SDCA jack control naming Charles Keepax says: Normally the SDCA jack detection controls will be named after the GE widget that represents the grouping of everything in the topology controlled by the jack selection. However, in the case that the jack selection only controls a single widget the control will be named after the SU widget that implements that. It is rather confusing to have the jack detection controls change naming scheme between devices. Add a new widget type, similar to mixer widgets, to force use of the control name rather than falling back to the widget names. commit b6a6cd3f6b5b0de65b398383ba12e72eb7322c82 Author: Charles Keepax Date: Tue Mar 3 15:53:08 2026 +0000 ASoC: SDCA: Use named control mux for GE/SU controls Most of the time a GE Entity will control many SU Entities and thus the generated control will use the control name, since the control is shared. However, in rare cases the GE Entity will only control a single SU Entity. In this case the control is only linked to a single SU widget and will thus inherit the name from that. This leads to the naming for the Selected Mode control to be unpredictable. Update to use the new named control muxes to always force the use of the control name. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260303155308.138989-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit e29d097ead33d0172f028b5b23f10812fe8e8335 Author: Charles Keepax Date: Tue Mar 3 15:53:07 2026 +0000 ASoC: dapm: Add a named controls variant of a mux widget There is already a version of the mixer widget that forces use of the specified control name, rather than factoring in the widget name. Add the same feature for mux widgets. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260303155308.138989-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit f8d51e903a6c97d8d298f14d9f8b4fff808670e3 Author: Cédric Bellegarde Date: Wed Mar 4 15:10:06 2026 +0100 ASoC: codecs: wcd-clsh: Always update buck/flyback on transitions on transitions The WCD934x audio outputs (earpiece, headphone, speaker) share two power supply converters, a buck and a flyback, managed by reference counters (buck_users, flyback_users) in the Class-H controller. The early return in wcd_clsh_ctrl_set_state() when nstate == ctrl->state prevented _wcd_clsh_ctrl_set_state() from being called when switching between outputs sharing the same state value. As a result, the buck and flyback reference counters were never decremented on disable, leaving the converters active and their counters out of sync with the actual hardware state. This caused audible distortion on the earpiece output and spurious MBHC over-current protection interrupts on HPHL/HPHR during output switching. Remove the early return so that CLSH_REQ_ENABLE and CLSH_REQ_DISABLE are always dispatched, keeping the buck and flyback reference counters consistent on every state transition. Signed-off-by: Cédric Bellegarde Link: https://patch.msgid.link/20260304141006.280894-1-cedric.bellegarde@adishatz.org Signed-off-by: Mark Brown commit 29a80e6c3a38f0c533b5a17ae6862886d6322510 Merge: 8abf84f76a546c 3f174274d22493 Author: Mark Brown Date: Mon Mar 16 18:36:09 2026 +0000 spi: controller registration fixes Johan Hovold says: This series fixes a few issues related to controller registration found through inspection. commit 3f174274d2249342df00d43fdef25511c3d3565a Author: Johan Hovold Date: Thu Mar 12 16:18:17 2026 +0100 spi: fix misleading controller deregistration kernel-doc The controller reference count is not decremented on deregistration if the controller has been allocated using devm_spi_alloc_host/target(). Amend the kernel-doc for devm_spi_register_controller() and spi_unregister_controller() so that it reflects this (more recent) behaviour. Fixes: 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation") Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260312151817.32100-6-johan@kernel.org Signed-off-by: Mark Brown commit edc463d72d697ff22da8ba96c0fcb25f3586d9a2 Author: Johan Hovold Date: Thu Mar 12 16:18:16 2026 +0100 spi: fix misleading controller registration kernel-doc The controller reference count is not decremented on registration failures (and has not been for a very long time) contrary to what the outdated kernel-doc says. Drop the entire sentence about return values which are now documented in the Return section. Fixes: b885244eb262 ("[PATCH] spi: add spi_driver to SPI framework") Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260312151817.32100-5-johan@kernel.org Signed-off-by: Mark Brown commit d5b4cb41b9a244e5571f9a589e77cc38ac5ebcc3 Author: Johan Hovold Date: Thu Mar 12 16:18:15 2026 +0100 spi: drop unused devres statistics allocation Drop the now unused device managed per-cpu statistics allocation. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260312151817.32100-4-johan@kernel.org Signed-off-by: Mark Brown commit 6c8e1a9eee0fec802b542dadf768c30c2a183b3c Merge: 202e42e4aa8901 01d5d2f7d93de7 Author: Alexei Starovoitov Date: Mon Mar 16 11:26:42 2026 -0700 Merge branch 'bpf-relax-8-frame-limitation-for-global-subprogs' Emil Tsalapatis says: ==================== bpf: Relax 8 frame limitation for global subprogs The BPF verifier currently limits the maximum runtime call stack to 8 frames. Larger BPF programs like sched-ext schedulers routinely fail verification because they exceed this limit, even as they use very little actual stack space for each frame. Relax the verifier to permit call stacks > 8 frames deep when the call stacks include global subprogs. The old 8 stack frame limit now only applies to call stacks composed entirely of static function calls. This works because global functions are each verified in isolation, so the verifier does not need to cross-reference verification state across the function call boundary, which has been the reason for limiting the call stack size in the first place. This patch does not change the verification time limit of 8 stack frames. Static functions that are inlined for verification purposes still only go 8 frames deep to avoid changing the verifier's internal data structures used for verification. These data structures only support holding information on up to 8 stack frames. This patch also does not adjust the actual maximum stack size of 512. CHANGELOG ========= v5 -> v6 (https://lore.kernel.org/bpf/20260311182831.91219-1-emil@etsalapatis.com/) - Make bpf_subprog_call_depth_info internal to verifier.c (Alexei) v4 -> v5 (https://lore.kernel.org/bpf/20260309204430.201219-1-emil@etsalapatis.com/) - Move depth tracking state to verifier (Eduard) and free it after verification (Alexei) - Fix selftest patch title and formatting errors (Yonghong) v3 -> v4 (https://lore.kernel.org/bpf/20260303043106.406099-1-emil@etsalapatis.com/) - Factor out temp call depth tracking info into its own struct (Eduard) - Bring depth calculation loop in line with the other instances (Mykyta) - Add comment on why selftest call stack is 16 bytes/frame (Eduard) - Rename "cidx" to "caller" for clarity (Mykyta, Eduard) v2 -> v3 (https://lore.kernel.org/bpf/20260210213606.475415-1-emil@etsalapatis.com/) - Change logic to remove arbitrary limit on call depth (Eduard) - Add additional selftests (Eduard) v1 -> v2 (https://lore.kernel.org/bpf/20260202233716.835638-1-emil@etsalapatis.com) - Adjust patch to only increase the runtime stack depth, leaving the verification-time stack depth unchanged (Alexei) Signed-off-by: Emil Tsalapatis ==================== Link: https://patch.msgid.link/20260316161225.128011-1-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 01d5d2f7d93de7270f0bf3bcba36f6f4d3d0bf9d Author: Emil Tsalapatis Date: Mon Mar 16 12:12:25 2026 -0400 selftests/bpf: Add deep call stack selftests Add tests that demonstrate the verifier support for deep call stacks while still enforcing maximum stack size limits. Acked-by: Eduard Zingerman Signed-off-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260316161225.128011-3-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit ad95d3c758d8752c41781b73fa060ab3215b1584 Author: Emil Tsalapatis Date: Mon Mar 16 12:12:24 2026 -0400 bpf: Only enforce 8 frame call stack limit for all-static stacks The BPF verifier currently enforces a call stack depth of 8 frames, regardless of the actual stack space consumption of those frames. The limit is necessary for static call stacks, because the bookkeeping data structures used by the verifier when stepping into static functions during verification only support 8 stack frames. However, this limitation only matters for static stack frames: Global subprogs are verified by themselves and do not require limiting the call depth. Relax this limitation to only apply to static stack frames. Verification now only fails when there is a sequence of 8 calls to non-global subprogs. Calling into a global subprog resets the counter. This allows deeper call stacks, provided all frames still fit in the stack. The change does not increase the maximum size of the call stack, only the maximum number of frames we can place in it. Also change the progs/test_global_func3.c selftest to use static functions, since with the new patch it would otherwise unexpectedly pass verification. Acked-by: Mykyta Yatsenko Acked-by: Eduard Zingerman Signed-off-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260316161225.128011-2-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 804dce6c73fdfa44184ee4e8b09abad7f5da408f Author: Joseph Salisbury Date: Mon Mar 16 14:05:45 2026 -0400 ASoC: fsl_easrc: fix comment typo The file contains a spelling error in a source comment (funciton). Typos in comments reduce readability and make text searches less reliable for developers and maintainers. Replace 'funciton' with 'function' in the affected comment. This is a comment-only cleanup and does not change behavior. Fixes: 955ac624058f ("ASoC: fsl_easrc: Add EASRC ASoC CPU DAI drivers") Cc: stable@vger.kernel.org Signed-off-by: Joseph Salisbury Link: https://patch.msgid.link/20260316180545.144032-1-joseph.salisbury@oracle.com Signed-off-by: Mark Brown commit 6afaa3a69ff9c9b3ebfd600228d84159a3ed5ace Merge: 0861893cff9662 ac5f5cfc98b528 Author: Mark Brown Date: Mon Mar 16 18:14:41 2026 +0000 ASoC: soc_sdw_utils: remove snd_soc_sdca codec name index Bard Liao says: The index could change if any endpoint is not present. Remove the index and let the machine driver get the right codec name from the registered components. commit ac5f5cfc98b5285c9278a74733a306e77816b822 Author: Bard Liao Date: Mon Mar 16 09:03:08 2026 +0800 ASoC: soc_sdw_utils: remove codec name index of snd_soc_sdca codecs The index could change if any endpoint is not present. Remove the index and let the machine driver get the right codec name from the registered components. Signed-off-by: Bard Liao Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260316010308.285622-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 1029df4de882bdfb4698bee6ac2b0c3d98d0e52d Author: Bard Liao Date: Mon Mar 16 09:03:07 2026 +0800 ASoC: soc_sdw_utils: remove cs42l45 SmartMic codec name index Currently the index is 0. In theory, it will not change even if any other endpoint is not present. But to be consistent and avoid surprise, remove the index and let the machine driver match the codec name partially. Signed-off-by: Bard Liao Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260316010308.285622-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit bb2a3912549d3b5cef5ed27200402fe8f6fb0694 Author: Hans Verkuil Date: Mon Mar 16 14:43:03 2026 +0100 media: cx231xx: add USB ID 2040:8360 for Hauppauge WinTV-HVR-935 The Hauppauge WinTV-HVR-935 HD stick is supported as 2040:b151 (CX231XX_BOARD_HAUPPAUGE_935C). Some units report USB id 2040:8360 with product string "HVR-935 Audio" and are not bound by cx231xx, so no DVB adapter is created. Please consider adding 2040:8360 to the cx231xx_id_table with the same driver_info as 0xb151 so these devices work without out-of-tree patches. How the ID was obtained (Debian, kernel 6.1.0-40-amd64): $ lsusb -d 2040:8360 Bus 001 Device 006: ID 2040:8360 Hauppauge HVR-935 Audio $ lsusb -t | grep -A3 "Port 3" |__ Port 3: Dev 6, If 2, Class=Audio, Driver=snd-usb-audio, 480M |__ Port 3: Dev 6, If 0, Class=Vendor Specific Class, Driver=, 480M |__ Port 3: Dev 6, If 1, Class=Audio, Driver=snd-usb-audio, 480M Interface 0 (Vendor Specific) has no driver; the stock cx231xx module has no 2040:8360 in its alias table. Reported-by: Lucian Onicescu Closes: https://lore.kernel.org/linux-media/CALbYB1O79OnqKMF--HWVx-nuKtYKJbE+Ux=yK_45HDb4oujQyA@mail.gmail.com/ Suggested-by: Lucian Onicescu Signed-off-by: Hans Verkuil commit d51c60a498e83c9a79884c8e420f97e3885c9583 Author: Wang Jun <1742789905@qq.com> Date: Mon Mar 16 20:24:01 2026 +0800 media: saa7164: add ioremap return checks and cleanups Add checks for ioremap return values in saa7164_dev_setup(). If ioremap for BAR0 or BAR2 fails, release the already allocated PCI memory regions, remove the device from the global list, decrement the device count, and return -ENODEV. This prevents potential null pointer dereferences and ensures proper cleanup on memory mapping failures. Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") Cc: stable@vger.kernel.org Signed-off-by: Wang Jun <1742789905@qq.com> Signed-off-by: Hans Verkuil commit 2008fb257323cdb0870d070f1c599bc3fed4be9b Author: Cheng-Yang Chou Date: Tue Mar 17 01:49:27 2026 +0800 sched_ext: Fix slab-out-of-bounds in scx_alloc_and_add_sched() ancestors[] is a flexible array member that needs level + 1 slots to hold all ancestors including self (indices 0..level), but kzalloc_flex() only allocates `level` slots: sch = kzalloc_flex(*sch, ancestors, level); ... sch->ancestors[level] = sch; /* one past the end */ For the root scheduler (level = 0), zero slots are allocated and ancestors[0] is written immediately past the end of the object. KASAN reports: BUG: KASAN: slab-out-of-bounds in scx_alloc_and_add_sched+0x1c17/0x1d10 Write of size 8 at addr ffff888066b56538 by task scx_enable_help/667 The buggy address is located 0 bytes to the right of allocated 1336-byte region [ffff888066b56000, ffff888066b56538) Fix by passing level + 1 to kzalloc_flex(). Tested with vng + scx_lavd, KASAN no longer triggers. Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit e5564e39207517c1b0e0ac4dc20a1e858484ca88 Merge: f338e77383789c bb729bf1d6fdf5 Author: Dave Jiang Date: Mon Mar 16 10:18:12 2026 -0700 Merge tag 'device_lock_cond_guard-7.1-rc1' into for-7.1/cxl-consolidate-endpoint DEFINE_GUARD_COND() for device_lock_interruptible() Introduce conditional guard version of device_lock() for scenarios that require conditional device lock holding. This is a stable tag for other trees to merge. commit 1e1cd49ded597a7cc89f774ab3f42e22ff24fd57 Author: Kai Huang Date: Mon Mar 9 11:23:13 2026 +1300 ACPI: NUMA: Only parse CFMWS at boot when CXL_ACPI is on On CXL platforms, the Static Resource Affinity Table (SRAT) may not cover memory affinity information for all the CXL memory regions. Since each CXL memory region is enumerated via a CXL Fixed Memory Window Structure (CFMWS), during early boot the kernel parses the CFMWS tables to find all CXL memory regions and sets a NUMA node for each of them. This memory affinity information of CXL memory regions is later used by the CXL ACPI driver. The CFMWS table doesn't provide the memory affinity information either. Currently the kernel assigns a 'faked' NUMA node for each CXL memory region, starting from the next node of the highest node that is enumerated via the SRAT. This can potentially increase the maximum NUMA node ID of the platform ('nr_node_ids') a lot. E.g., on a GNR platform with 4 NUMA nodes and 18 CFMWS tables, this bumps the 'nr_node_ids' to 22. Increasing the 'nr_node_ids' has side effects. For instance, it is widely used by the kernel for "highest possible NUMA node" based memory allocations. It also impacts userspace ABIs, e.g., some NUMA memory related system calls such as 'get_mempolicy' which requires 'maxnode' not being smaller than the 'nr_node_ids'. Currently parsing CFMWS tables and assigning faked NUMA node at boot is done unconditionally. However, if the CXL ACPI driver is not enabled, there will be no user of such memory affinity information of CXL memory regions. Change to only parsing the CFMWS tables at boot when CXL_ACPI is enabled in Kconfig to avoid the unnecessary cost of bumping up 'nr_node_ids'. E.g., on the aforementioned GNR platform, the "Slab" in /proc/meminfo is reduced with this change (when CXL_ACPI is off): w/ this change w/o Slab 900488 kB 923660 kB Signed-off-by: Kai Huang Reviewed-by: Jonathan Cameron Reviewed-by: Gregory Price Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260308222313.14014-1-kai.huang@intel.com Signed-off-by: Dave Jiang commit 032322b44c02f5e8a127d1dca6798f91cc72eb1d Author: Cen Zhang Date: Mon Mar 16 16:50:47 2026 +0800 ALSA: pcm: oss: use proper stream lock for runtime->state access __snd_pcm_set_state() writes runtime->state under the PCM stream lock. However, the OSS I/O functions snd_pcm_oss_write3(), snd_pcm_oss_read3(), snd_pcm_oss_writev3() and snd_pcm_oss_readv3() read runtime->state without holding the stream lock, only holding oss.params_lock (a different mutex that does not synchronize with the stream lock). Since __snd_pcm_set_state() is called from IRQ context (e.g., snd_pcm_period_elapsed -> snd_pcm_update_state -> __snd_pcm_xrun -> snd_pcm_stop -> snd_pcm_post_stop) while the OSS read/write paths run in process context, these are concurrent accesses that constitute a data race. Rather than using READ_ONCE()/WRITE_ONCE() barriers, introduce a snd_pcm_get_state() helper that reads runtime->state under the stream lock, matching the locking discipline used elsewhere in the PCM layer. Also export snd_pcm_set_state() for completeness. Use snd_pcm_get_state() in all four OSS I/O functions, caching the result in a local variable where the same snapshot is used for multiple comparisons to avoid taking the lock repeatedly. Signed-off-by: Cen Zhang Link: https://patch.msgid.link/20260316085047.2876451-1-zzzccc427@gmail.com Signed-off-by: Takashi Iwai commit 1b12096b4bc5177d685ae098fdb90260ffd5db6b Author: Brian Nguyen Date: Thu Mar 5 17:15:50 2026 +0000 drm/xe: Skip adding PRL entry to NULL VMA NULL VMAs have no corresponding PTE, so skip adding a PRL entry to avoid an unnecessary PRL abort during unbind. Signed-off-by: Brian Nguyen Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260305171546.67691-8-brian3.nguyen@intel.com Signed-off-by: Matt Roper commit d88fa967dc4335196d9ec2e07b2269bb53feec0d Author: Brian Nguyen Date: Thu Mar 5 17:15:49 2026 +0000 drm/xe: Move page reclaim done_handler to own func Originally, page reclamation is handled by the same fence as tlb invalidation and uses its seqno, so there was no reason to separate out the handlers. However in hindsight, for readability, and possible future changes, it seems more beneficial to move this all out to its own function. Signed-off-by: Brian Nguyen Reviewed-by: Matthew Brost Reviewed-by: Shuicheng Lin Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20260305171546.67691-7-brian3.nguyen@intel.com Signed-off-by: Matt Roper commit 1d123587525db86cc8f0d2beb35d9e33ca3ade83 Author: Brian Nguyen Date: Thu Mar 5 17:15:48 2026 +0000 drm/xe: Skip over non leaf pte for PRL generation The check using xe_child->base.children was insufficient in determining if a pte was a leaf node. So explicitly skip over every non-leaf pt and conditionally abort if there is a scenario where a non-leaf pt is interleaved between leaf pt, which results in the page walker skipping over some leaf pt. Note that the behavior being targeted for abort is PD[0] = 2M PTE PD[1] = PT -> 512 4K PTEs PD[2] = 2M PTE results in abort, page walker won't descend PD[1]. With new abort, ensuring valid PRL before handling a second abort. v2: - Revert to previous assert. - Revised non-leaf handling for interleaf child pt and leaf pte. - Update comments to specifications. (Stuart) - Remove unnecessary XE_PTE_PS64. (Matthew B) v3: - Modify secondary abort to only check non-leaf PTEs. (Matthew B) Fixes: b912138df299 ("drm/xe: Create page reclaim list on unbind") Signed-off-by: Brian Nguyen Reviewed-by: Matthew Brost Cc: Stuart Summers Link: https://patch.msgid.link/20260305171546.67691-6-brian3.nguyen@intel.com Signed-off-by: Matt Roper commit e882626c1747653f1f01ea9d12e278e613b11d0f Author: Cosmin Tanislav Date: Wed Mar 11 17:39:57 2026 +0200 mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions In order to parse sub-partitions, add_mtd_partitions() calls parse_mtd_partitions() for all previously found partitions. Each partition will end up being passed to parse_fixed_partitions(), and its of_node will be treated as the ofpart_node. Commit 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()") added of_node_put() calls for ofpart_node on all exit paths. In the case where the partition passed to parse_fixed_partitions() has a parent, it is treated as a dedicated partitions node, and of_node_put() is wrongly called for it, even if of_node_get() was not called explicitly. On repeated bind / unbinds of the MTD, the extra of_node_put() ends up decrementing the refcount down to 0, which should never happen, resulting in the following error: OF: ERROR: of_node_release() detected bad of_node_put() on /soc/spi@80007000/flash@0/partitions/partition@0 Call of_node_get() to balance the call to of_node_put() done for dedicated partitions nodes. Fixes: 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()") Signed-off-by: Cosmin Tanislav Tested-by: Tommaso Merciai Signed-off-by: Miquel Raynal commit 0c87dea1aab86116211cb37387c404c9e9231c39 Author: Cosmin Tanislav Date: Wed Mar 11 17:39:56 2026 +0200 mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path ofpart_none can only be reached after the for_each_child_of_node() loop finishes. for_each_child_of_node() correctly calls of_node_put() for all device nodes it iterates over as long as we don't break or jump out of the loop. Calling of_node_put() inside the ofpart_none path will wrongly decrement the ref count of the last node in the for_each_child_of_node() loop. Move the call to of_node_put() under the ofpart_fail label to fix this. Fixes: ebd5a74db74e ("mtd: ofpart: Check availability of reg property instead of name property") Signed-off-by: Cosmin Tanislav Tested-by: Tommaso Merciai Signed-off-by: Miquel Raynal commit 54f955ba09367eb9abad6c4afd3bb81c2b7e0b54 Author: Andy Shevchenko Date: Fri Mar 13 12:34:09 2026 +0100 mtd: physmap: Drop leftovers of removed code for Baikal SoC The previous clean up killed the driver along with dropping some calls but missed one place to drop. Do it here. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603121229.PPSg4X8q-lkp@intel.com/ Reported-by: Mark Brown Closes: https://lore.kernel.org/r/abK8KXC70RC2K_fW@sirena.org.uk Fixes: 16d68d10f5b93 "(mtd: physmap: physmap-bt1-rom: Remove not-going-to-be-supported code for Baikal SoC)" Signed-off-by: Andy Shevchenko Signed-off-by: Miquel Raynal commit 202e42e4aa890172366354b233c42c73107a3f59 Author: Ilya Leoshkevich Date: Fri Mar 13 18:46:25 2026 +0100 s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend signed return values. s390 BPF JIT currently implements only sign extension. Fix this omission and implement zero extension too. Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()") Reported-by: Hari Bathini Closes: https://lore.kernel.org/bpf/20260312080113.843408-1-hbathini@linux.ibm.com/ Signed-off-by: Ilya Leoshkevich Tested-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260313174807.581826-1-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 65fcf19cb36bf43c893c3444d5bd120006cb843d Author: Matt Roper Date: Wed Mar 11 16:04:58 2026 -0700 drm/xe: Include running dword offset in default_lrc dumps Printing a running dword offset in the default_lrc_* debugfs entries makes it easier for developers to find the right offsets to use in regs/xe_lrc_layout.h and/or compare the default LRC contents against the bspec-documented LRC layout. Reviewed-by: Dnyaneshwar Bhadane Link: https://patch.msgid.link/20260311-default_lrc_offsets-v1-1-58d8ed3aa081@intel.com Signed-off-by: Matt Roper commit 7bbb578fc43e7dcb8690cfc98844bd67bc311e8a Author: Jeff Johnson Date: Tue Mar 10 08:16:13 2026 -0700 wifi: ath12k: Remove unused DFS Unit Test definitions The following are unused, so remove them: struct wmi_dfs_unit_test_arg macro DFS_PHYERR_UNIT_TEST_CMD Compile tested only. Reviewed-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260310-ath12k-unit-test-cleanup-v1-2-03e3df56f903@oss.qualcomm.com Signed-off-by: Jeff Johnson commit e570593b568f74b8d8367d094400d71bc398118f Author: Jeff Johnson Date: Tue Mar 10 08:16:12 2026 -0700 wifi: ath12k: Clean up the WMI Unit Test command interface Currently, ath12k_wmi_send_unit_test_cmd() provides the interface to send a Unit Test command to firmware. The payload for the command is passed in two separate parameters, struct wmi_unit_test_cmd ut_cmd and u32 *test_args. This interface is strange in that it passes the ut_cmd structure by value instead of by reference. But even worse, this presents an interface that is not endian clean since the ut_cmd structure is defined in little endian format while the test_args array is defined to be in cpu endian format. Furthermore, the implementation of this function passes the test_args directly to the firmware, without performing cpu_to_le32() conversion, and hence this functionality will not work correctly on big endian platforms. In order to fix these issues, introduce a new wmi_unit_test_arg structure which defines all of the parameters needed by the Unit Test command in a single structure using cpu endian. Update ath12k_wmi_send_unit_test_cmd() to take a pointer to this structure and perform all cpu_to_le32() conversions needed while forming the firmware command. Update the only existing Unit Test function, ath12k_wmi_simulate_radar(), to properly fill and pass this new structure to ath12k_wmi_send_unit_test_cmd(). Compile tested only. Reviewed-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260310-ath12k-unit-test-cleanup-v1-1-03e3df56f903@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 8ea21435fe36fb853706f4935d78bc11beb63fb4 Author: Abdun Nihaal Date: Thu Mar 12 18:02:56 2026 +0530 media: pci: zoran: fix potential memory leak in zoran_probe() The memory allocated for codec in videocodec_attach() is not freed in one of the error paths, due to an incorrect goto label. Fix the label to free it on error. Fixes: 8f7cc5c0b0eb ("media: staging: media: zoran: introduce zoran_i2c_init") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal Signed-off-by: Hans Verkuil commit a66485a934c7187ae8e36517d40615fa2e961cff Author: Abhishek Kumar Date: Tue Mar 10 22:14:37 2026 +0530 media: em28xx: fix use-after-free in em28xx_v4l2_open() em28xx_v4l2_open() reads dev->v4l2 without holding dev->lock, creating a race with em28xx_v4l2_init()'s error path and em28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct and set dev->v4l2 to NULL under dev->lock. This race leads to two issues: - use-after-free in v4l2_fh_init() when accessing vdev->ctrl_handler, since the video_device is embedded in the freed em28xx_v4l2 struct. - NULL pointer dereference in em28xx_resolution_set() when accessing v4l2->norm, since dev->v4l2 has been set to NULL. Fix this by moving the mutex_lock() before the dev->v4l2 read and adding a NULL check for dev->v4l2 under the lock. Reported-by: syzbot+c025d34b8eaa54c571b8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c025d34b8eaa54c571b8 Fixes: 8139a4d583ab ("[media] em28xx: move v4l2 user counting fields from struct em28xx to struct v4l2") Cc: stable@vger.kernel.org Signed-off-by: Abhishek Kumar Signed-off-by: Hans Verkuil commit 323f52e02be68889c8630c4a0415ef5b78f9dc63 Author: Vicki Pfau Date: Mon Mar 9 21:50:34 2026 -0700 media: pulse8-cec: Handle partial deinit In the event that the cec dev node is held open while the adapter is disconnected the serio device will be cleaned up but the cec device won't be. As the serio device is freed but the ping_eeprom_work is not canceled, the next ping will still attempt to send, leading to a kernel oops. This patch both cancels the ping_eeprom_work in the serio cleanup as well as checking to make sure the serio is still present before attempting to write to it. Note that while the added serio = NULL line looks similar to one that was removed in commit 024e01dead12c ("media: pulse8-cec: fix duplicate free at disconnect or probe error"), it notably happens before calling cec_unregister_adapter, and as such shouldn't lead to the user-after-free that removing it fixed. Signed-off-by: Vicki Pfau Signed-off-by: Hans Verkuil commit 68380ec2161ee61ce4f23001dfb536bbaa8f4979 Author: Johan Hovold Date: Thu Mar 5 14:00:25 2026 +0100 media: cx231xx: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil commit dbc6798b80481a20f9aff671bc4d529eae63c9e8 Author: Johan Hovold Date: Thu Mar 5 11:39:19 2026 +0100 media: usbtv: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil commit 64f47fca95c307c569adb7fec48ffc2891e3b209 Author: Johan Hovold Date: Thu Mar 5 11:39:18 2026 +0100 media: go7007-loader: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil commit f8e1fc918a9fe67103bcda01d20d745f264d00a7 Author: Ruslan Valiyev Date: Tue Mar 3 11:27:54 2026 +0000 media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections syzbot reported a general protection fault in vidtv_psi_desc_assign [1]. vidtv_psi_pmt_stream_init() can return NULL on memory allocation failure, but vidtv_channel_pmt_match_sections() does not check for this. When tail is NULL, the subsequent call to vidtv_psi_desc_assign(&tail->descriptor, desc) dereferences a NULL pointer offset, causing a general protection fault. Add a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean up the already-allocated stream chain and return. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629 Call Trace: vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline] vidtv_channel_si_init+0x1445/0x1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479 vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline] vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239 Fixes: f90cf6079bf67 ("media: vidtv: add a bridge driver") Cc: stable@vger.kernel.org Reported-by: syzbot+1f5bcc7c919ec578777a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1f5bcc7c919ec578777a Signed-off-by: Ruslan Valiyev Signed-off-by: Hans Verkuil commit a0e5a598fe9a4612b852406b51153b881592aede Author: Ruslan Valiyev Date: Sun Mar 1 21:07:35 2026 +0000 media: vidtv: fix nfeeds state corruption on start_streaming failure syzbot reported a memory leak in vidtv_psi_service_desc_init [1]. When vidtv_start_streaming() fails inside vidtv_start_feed(), the nfeeds counter is left incremented even though no feed was actually started. This corrupts the driver state: subsequent start_feed calls see nfeeds > 1 and skip starting the mux, while stop_feed calls eventually try to stop a non-existent stream. This state corruption can also lead to memory leaks, since the mux and channel resources may be partially allocated during a failed start_streaming but never cleaned up, as the stop path finds dvb->streaming == false and returns early. Fix by decrementing nfeeds back when start_streaming fails, keeping the counter in sync with the actual number of active feeds. [1] BUG: memory leak unreferenced object 0xffff888145b50820 (size 32): comm "syz.0.17", pid 6068, jiffies 4294944486 backtrace (crc 90a0c7d4): vidtv_psi_service_desc_init+0x74/0x1b0 drivers/media/test-drivers/vidtv/vidtv_psi.c:288 vidtv_channel_s302m_init+0xb1/0x2a0 drivers/media/test-drivers/vidtv/vidtv_channel.c:83 vidtv_channels_init+0x1b/0x40 drivers/media/test-drivers/vidtv/vidtv_channel.c:524 vidtv_mux_init+0x516/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:518 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline] vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239 Fixes: f90cf6079bf67 ("media: vidtv: add a bridge driver") Cc: stable@vger.kernel.org Reported-by: syzbot+639ebc6ec75e96674741@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=639ebc6ec75e96674741 Signed-off-by: Ruslan Valiyev Signed-off-by: Hans Verkuil commit c42c596a85e53560e6c4db5c74854d3b259c23e0 Author: Bartosz Golaszewski Date: Mon Feb 23 09:59:30 2026 +0100 media: saa7134: rename i2c_dbg() to saa7134_i2c_dbg() Ahead of introducing I2C-adapter-specific printk() helpers, preemptively avoid a conflict with the upcoming i2c_dbg() and rename the local macro in the saa7134 driver to saa7134_i2c_dbg(). Suggested-by: Wolfram Sang Reviewed-by: Wolfram Sang Signed-off-by: Bartosz Golaszewski Acked-by: Hans Verkuil Signed-off-by: Hans Verkuil commit 5f8e73bde67e931468bc2a1860d78d72f0c6ba41 Author: Abd-Alrhman Masalkhi Date: Sat Feb 21 13:56:18 2026 +0100 media: vidtv: fix pass-by-value structs causing MSAN warnings vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() take their argument structs by value, causing MSAN to report uninit-value warnings. While only vidtv_ts_null_write_into() has triggered a report so far, both functions share the same issue. Fix by passing both structs by const pointer instead, avoiding the stack copy of the struct along with its MSAN shadow and origin metadata. The functions do not modify the structs, which is enforced by the const qualifier. Fixes: f90cf6079bf67 ("media: vidtv: add a bridge driver") Cc: stable@vger.kernel.org Reported-by: syzbot+96f901260a0b2d29cd1a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=96f901260a0b2d29cd1a Tested-by: syzbot+96f901260a0b2d29cd1a@syzkaller.appspotmail.com Suggested-by: Yihan Ding Signed-off-by: Abd-Alrhman Masalkhi Signed-off-by: Hans Verkuil commit dde3c37af95cd6fa301c4906f33d627bc9dd874c Author: Sergey Shtylyov Date: Fri Feb 6 17:22:26 2026 +0300 media: dib8000: avoid division by 0 in dib8000_set_dds() In dib8000_set_dds(), 1 << 26 (67108864) divided by e.g. 1 apparently can't fit into 16-bit variable unit_khz_dds_val, being truncated to 0; this will cause division by 0 while calling dprintk() with debugging enabled (via the module parameter). Use s32 instead of s16 to declare the variable, getting rid of the cast to u16 in the *else* branch as well... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Fixes: 173a64cb3fcf ("[media] dib8000: enhancement") Cc: stable@vger.kernel.org Signed-off-by: Sergey Shtylyov Signed-off-by: Hans Verkuil commit dad98c5b2a05ef744af4c884c97066a3c8cdad61 Author: Arnd Bergmann Date: Mon Mar 16 15:42:51 2026 +0100 jfs: avoid -Wtautological-constant-out-of-range-compare warning again The comparison of an __s8 value against DTPAGEMAXSLOT is still trivially true, causing a harmless (default disabled) warning with clang: fs/jfs/jfs_dtree.c:4419:25: error: result of comparison of constant 128 with expression of type 's8' (aka 'signed char') is always false [-Werror,-Wtautological-constant-out-of-range-compare] 4419 | p->header.freelist >= DTPAGEMAXSLOT)) { | ~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~ I previously worked around two of these in commit 7833570dae83 ("jfs: avoid -Wtautological-constant-out-of-range-compare warning"), but now a new one has come up, so address the same way by dropping the redundant range check. Fixes: 119e448bb50a ("jfs: add dtpage integrity check to prevent index/pointer overflows") Signed-off-by: Arnd Bergmann Signed-off-by: Dave Kleikamp commit d75c6c7d8e9855e4dfa28d17c4ab9ad4f29a40a9 Author: Luke Wang Date: Wed Mar 11 17:50:09 2026 +0800 mmc: sdhci-pltfm: remove duplicate DTS property parsing The "keep-power-in-suspend", "wakeup-source" and "enable-sdio-wakeup" properties are already parsed in mmc_of_parse(). All sdhci drivers that call sdhci_get_property() also call mmc_of_parse(). The only exception is sdhci-of-hlwd, which does not call mmc_of_parse(), but its devicetree does not use these properties anyway. Signed-off-by: Luke Wang Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 5cfc804ba9d30322288cdb7ffc42d8c851dc6439 Author: Luke Wang Date: Wed Mar 11 17:50:08 2026 +0800 mmc: sdhci-esdhc-imx: remove duplicate HS400 bus width validation mmc_validate_host_caps() already validates that HS400/HS400ES requires 8-bit bus width. Remove the duplicate validation. Signed-off-by: Luke Wang Acked-by: Adrian Hunter Reviewed-by: Haibo Chen Signed-off-by: Ulf Hansson commit 60ed2f96c9842cd4e85e3229fdc6bec2a0fa9cfa Author: Luke Wang Date: Wed Mar 11 17:50:07 2026 +0800 mmc: sdhci-esdhc-imx: add 1-bit bus width support Add sdhci_get_property() call to parse common SDHCI DT properties, including "bus-width = <1>" which sets SDHCI_QUIRK_FORCE_1_BIT_DATA quirk for 1-bit data bus width configuration. Remove the duplicate "no-1-8-v" property parsing since sdhci_get_property() already handles it. Signed-off-by: Luke Wang Acked-by: Adrian Hunter Reviewed-by: Haibo Chen Signed-off-by: Ulf Hansson commit 45319865ae6341bd500faad3c8d7889d7c8a051a Merge: 941717214d0be9 5e3486e64094c2 Author: Ulf Hansson Date: Mon Mar 16 16:13:02 2026 +0100 mmc: Merge branch fixes into next Merge the mmc fixes for v7.0-rc[n] into the next branch, to allow them to get tested together with the mmc changes that are targeted for the next release. Signed-off-by: Ulf Hansson commit 941717214d0be9f0be5fb0b46a38e429b72f8719 Author: Kathiravan Thirumoorthy Date: Wed Mar 11 15:15:48 2026 +0530 dt-bindings: mmc: sdhci-msm: add IPQ5210 compatible The IPQ5210 supports eMMC with an SDHCI controller. Add the appropriate compatible to the documentation. Signed-off-by: Kathiravan Thirumoorthy Acked-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit ca43d891b6da359260c94b74fe29799f381eb782 Author: Shawn Lin Date: Tue Mar 10 09:35:53 2026 +0800 mmc: core: Remove checking MMC_CAP_4_BIT_DATA from mmc_host_can_uhs() The bus width support for UHS mode is now validated in mmc_validate_host_caps(). Therefore, we can safely remove the explicit MMC_CAP_4_BIT_DATA check from mmc_host_can_uhs(). As part of this cleanup, simplify the condition by using the consolidated MMC_CAP_UHS flag. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit e98f926e5a2d8023a74ec2ba7a973b5d76610f4e Author: Luke Wang Date: Tue Mar 10 09:35:52 2026 +0800 mmc: core: Validate UHS/DDR/HS200 timing selection for 1-bit bus width UHS/DDR/HS200 modes require at least 4-bit bus support. Host controllers that lack relevant capability registers rely on paring properties provided by firmware, which may incorrectly set these modes. Now that mmc_validate_host_caps() has been introduced to validate such configuration violations, let's also add checks for UHS/DDR/HS200 modes. This fixes an issue where, if the HS200/HS400 property is set while only a 1-bit bus width is used, mmc_select_hs200() returns 0 without actually performing the mode switch. Consequently, mmc_select_timing() proceeds without falling back to mmc_select_hs(), leaving the eMMC device operating in legacy mode (26 MHz) instead of switching to High Speed mode (52 MHz). Signed-off-by: Luke Wang [Shawn: reword the commit msg and rework the code] Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit cc1060a18e0464a7b03c06fb64889935d27acee0 Author: Shawn Lin Date: Mon Mar 9 11:29:03 2026 +0800 mmc: dw_mmc-rockchip: Add phase map support Multiple boards require different phase settings, rendering the default phase policy unscalable. Therefore, we introduce phase map to address this limitation. To preserve backward compatibility, the default_sample_phase and original drv phase for different modes are retained, with phase map values taking precedence when available. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 8750929d971386c530ca1e131e50a56187fa5f73 Author: Shawn Lin Date: Mon Mar 9 11:29:02 2026 +0800 mmc: dw_mmc-hi3798mv200: Using phase map from dw_mmc core dw_mmc core helps parse phase map now, so reuse it. No functional changes intended. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 0d944576c99ebaacadb07ceb7e34bfbcc67a32d6 Author: Shawn Lin Date: Mon Mar 9 11:29:01 2026 +0800 mmc: dw_mmc: Add parsing mmc_clk_phase_map support The dw_mmc library already assists in invoking mmc_of_parse() to provide unified parsing for variant drivers. We can also call mmc_of_parse_clk_phase() to help variant drivers achieve unified parsing. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 27a5e78a23dd36e487678aee92364fc9ef6d6871 Author: Raag Jadav Date: Fri Mar 13 13:34:38 2026 +0530 drm/xe/i2c: Assert/Deassert I2C IRQ I2C IRQ is triggered using virtual wire. Assert/Deassert it in IRQ handler to allow subsequent interrupt generation. Signed-off-by: Raag Jadav Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260313080438.4166251-1-raag.jadav@intel.com Signed-off-by: Matt Roper commit 1ef3e1c278eb7bda1cc09a508c3fe65d2e567c77 Author: Andy Shevchenko Date: Mon Mar 2 19:43:31 2026 +0100 regmap: Synchronize cache for the page selector If the selector register is represented in each page, its value according to the debugfs is stale because it gets synchronized only after the real page switch happens. Hence the regmap cache initialisation from the HW inherits outdated data in the selector register. Synchronize cache for the page selector just in time. Before (offset followed by hexdump, the first byte is selector): // Real registers 18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00 ... // Virtual (per port) 40: 05 ff 00 00 e0 e0 00 00 00 00 00 1f 50: 00 ff 00 00 e0 e0 00 00 00 00 00 1f 60: 01 ff 00 00 ff ff 00 00 00 00 00 00 70: 02 ff 00 00 cf f3 00 00 00 00 00 0c 80: 03 ff 00 00 00 00 00 00 00 00 00 ff 90: 04 ff 00 00 ff 0f 00 00 f0 00 00 00 After: // Real registers 18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00 ... // Virtual (per port) 40: 00 ff 00 00 e0 e0 00 00 00 00 00 1f 50: 01 ff 00 00 e0 e0 00 00 00 00 00 1f 60: 02 ff 00 00 ff ff 00 00 00 00 00 00 70: 03 ff 00 00 cf f3 00 00 00 00 00 0c 80: 04 ff 00 00 00 00 00 00 00 00 00 ff 90: 05 ff 00 00 ff 0f 00 00 f0 00 00 00 Fixes: 6863ca622759 ("regmap: Add support for register indirect addressing.") Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260302184753.2693803-1-andriy.shevchenko@linux.intel.com Tested-by: Marek Szyprowski Signed-off-by: Mark Brown commit 0861893cff96624523adc0968587fa64e9a9f76d Merge: cb15d8e6cbe8d0 175f733325ac2c Author: Mark Brown Date: Mon Mar 16 13:38:10 2026 +0000 ASoC: soc-component: re-add pcm_new()/pcm_free() Kuninori Morimoto says: Because old pcm_new()/pcm_free() didn't care about parameter component, to avoid name collisions, we have added pcm_construct()/pcm_destruct() by commit c64bfc9066007 ("ASoC: soc-core: add new pcm_construct/pcm_destruct") Because all driver switch to new pcm_construct()/pcm_destruct(), old pcm_new()/pcm_free() were remoted by commit e9067bb502787 ("ASoC: soc-component: remove snd_pcm_ops from component driver") But naming of pcm_construct()/pcm_destruct() are not goot. re-add pcm_new()/pcm_free(), and switch to use it, again. Because it has no functional significance, 1 patch is for 1 vender. commit 175f733325ac2ce875cafd051980be2d2c06dec9 Author: Kuninori Morimoto Date: Mon Mar 16 02:27:57 2026 +0000 ASoC: soc-component: remove pcm_construct()/pcm_destruct() All driver have switched to use pcm_new()/pcm_free(), let's remove pcm_construct()/pcm_destruct(). Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/875x6wjyoa.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 667fb65f5164e190b3c30c76be113cceb7260bf6 Author: Kuninori Morimoto Date: Mon Mar 16 02:27:50 2026 +0000 ASoC: xtensa: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/877brcjyoh.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7649b2f1f8b207716e42e4446b88de3691cfe9aa Author: Kuninori Morimoto Date: Mon Mar 16 02:27:44 2026 +0000 ASoC: xilinx: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/878qbsjyon.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 88e277ef789a67a3ee5fb3de8757609a08e85404 Author: Kuninori Morimoto Date: Mon Mar 16 02:27:38 2026 +0000 ASoC: uniphier: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87a4w8jyot.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 1f7fc5f1f084af6fcb4c42ab8bcc9d46ef5d1f36 Author: Kuninori Morimoto Date: Mon Mar 16 02:27:33 2026 +0000 ASoC: tegra: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87bjgojyoy.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4e2f7ecb5db3223c9dcdb8d433038b89163123aa Author: Kuninori Morimoto Date: Mon Mar 16 02:27:27 2026 +0000 ASoC: stm: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87cy14jyp4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 90a2dbecc20fc20f365d3e080cbcf251a8a33873 Author: Kuninori Morimoto Date: Mon Mar 16 02:27:22 2026 +0000 ASoC: sprd: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87eclkjyp9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e56decec6baea73a5871229889a08b64783fa0d9 Author: Kuninori Morimoto Date: Mon Mar 16 02:27:16 2026 +0000 ASoC: sof: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87fr60jypf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7d803acf6181e2ec98b0c48710c800b3167f00e0 Author: Kuninori Morimoto Date: Mon Mar 16 02:27:11 2026 +0000 ASoC: soc-generic-dmaengine-pcm: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87h5qgjypk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7ef8b7a10c4b20dd84db7d3a066d90949eb65882 Author: Kuninori Morimoto Date: Mon Mar 16 02:27:05 2026 +0000 ASoC: samsung: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ikawjypq.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2840266185be2c4c350c930b7f48da962ee16ede Author: Kuninori Morimoto Date: Mon Mar 16 02:26:59 2026 +0000 ASoC: renesas: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87jyvcjypw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit df202b5e6d3e9a56a9b9c21666105ec869fa8093 Author: Kuninori Morimoto Date: Mon Mar 16 02:26:54 2026 +0000 ASoC: qcom: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ldfsjyq1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0828e050415f73f7904521629449ed313a617da8 Author: Kuninori Morimoto Date: Mon Mar 16 02:26:47 2026 +0000 ASoC: pxa: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ms08jyq8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6f3658d6ee738bc7e8289e73f9f65aed5399dc27 Author: Kuninori Morimoto Date: Mon Mar 16 02:26:40 2026 +0000 ASoC: mediatek: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87o6kojyqf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7fce3691e13140c26c50f91f205a6388de34355a Author: Kuninori Morimoto Date: Mon Mar 16 02:26:33 2026 +0000 ASoC: loongson: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87pl54jyqm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 31447bd2149eda1032f7bb050045008ed241f166 Author: Kuninori Morimoto Date: Mon Mar 16 02:26:26 2026 +0000 ASoC: kirkwood: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87qzpkjyqt.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6f2b7bd598824a4f4bccb052daa91c44e7001010 Author: Kuninori Morimoto Date: Mon Mar 16 02:26:19 2026 +0000 ASoC: intel: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87sea0jyr1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 71a5590610063a3bff8acffa2677a00f42828343 Author: Kuninori Morimoto Date: Mon Mar 16 02:26:11 2026 +0000 ASoC: google: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87tsugjyr8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2905b2266ac6a6bb99c9dcdb122fcf2b89b829dc Author: Kuninori Morimoto Date: Mon Mar 16 02:26:04 2026 +0000 ASoC: generic: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87v7ewjyrf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit fe8112d6d2a62eac923a6fdde274b848021e94b6 Author: Kuninori Morimoto Date: Mon Mar 16 02:25:56 2026 +0000 ASoC: fsl: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87wlzcjyrn.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c42b65583773251ebd5a71ee38f8a74f3e5dbb13 Author: Kuninori Morimoto Date: Mon Mar 16 02:25:47 2026 +0000 ASoC: dwc: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87y0jsjyrw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a1f956d8519964c92a66d73ad86149ed3f0d514c Author: Kuninori Morimoto Date: Mon Mar 16 02:25:40 2026 +0000 ASoC: codecs: rt5xxx-spi: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87zf48jys3.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2a97dfda9e53ab57f1ec1e8062ce55b29e8ae02b Author: Kuninori Morimoto Date: Mon Mar 16 02:25:33 2026 +0000 ASoC: codecs: cros_ec_codec: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/871phkldcq.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 3859e15cc9d88c0e7b6f9a2cefdc4cbf3d6298e5 Author: Kuninori Morimoto Date: Mon Mar 16 02:25:26 2026 +0000 ASoC: bcm: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/873420ldcy.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8ec624ef881ce0099053363ebc8eecb4652cbdd3 Author: Kuninori Morimoto Date: Mon Mar 16 02:25:18 2026 +0000 ASoC: au1x: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/874imgldd6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 83cce46863b06feb83ead3742fb3d1501673c37e Author: Kuninori Morimoto Date: Mon Mar 16 02:25:10 2026 +0000 ASoC: atmel: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/875x6wldde.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d28e193504903cb0735ff595a689ef25d2134a9a Author: Kuninori Morimoto Date: Mon Mar 16 02:25:01 2026 +0000 ASoC: apple: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcmdestruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops from component driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/877brclddm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit fe33a69681e343999e18893f97bb6cd99b883992 Author: Kuninori Morimoto Date: Mon Mar 16 02:24:51 2026 +0000 ASoC: amd: name back to pcm_new()/pcm_free() We have been used pcm_new()/pcm_free(), but switched to pcm_construct()/pcm_destruct() to use extra parameters [1]. pcm_new()/free() had been removed [2], but each drivers are still using such function naming. Let's name back to pcm_new()/pcm_free() again. [1] commit c64bfc906600 ("ASoC: soc-core: add new pcm_construct/pcm_destruct") [2] commit e9067bb50278 ("ASoC: soc-component: remove snd_pcm_ops fromcomponent driver") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/878qbslddx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 68130eef1e0d3c1770952e738f7f8d9f340bd42d Author: Kuninori Morimoto Date: Mon Mar 16 02:24:43 2026 +0000 ASoC: soc-component: re-add pcm_new()/pcm_free() Because old pcm_new()/pcm_free() didn't care about parameter component, to avoid name collisions, we have added pcm_construct()/pcm_destruct() by commit c64bfc9066007 ("ASoC: soc-core: add new pcm_construct/pcm_destruct") Because all driver switch to new pcm_construct()/pcm_destruct(), old pcm_new()/pcm_free() were remoted by commit e9067bb502787 ("ASoC: soc-component: remove snd_pcm_ops from component driver") But naming of pcm_construct()/pcm_destruct() are not goot. re-add pcm_new()/pcm_free(), and switch to use it, again. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87a4w8lde4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 69d73421b76e3d952076be2e17cea42de90d126a Author: Vlastimil Babka (SUSE) Date: Wed Mar 11 19:22:33 2026 +0100 slab: remove alloc_full_sheaf() The function allocates and then refills and empty sheaf. It's only called from __pcs_replace_empty_main(), which can also in some cases refill an empty sheaf. We can therefore consolidate this code. Remove alloc_full_sheaf() and refactor __pcs_replace_empty_main() so it will call alloc_empty_sheaf() when necessary, and then use the pre-existing refill_sheaf(). The result should be simpler to follow and less duplicated code. Also adjust the comment about returning sheaves to barn, the part about where the empty sheaf we'd be returning comes from is incorrect. No functional change intended. Reviewed-by: Qing Wang Reviewed-by: Harry Yoo Reviewed-by: Hao Li Link: https://patch.msgid.link/20260311-b4-slab-remove-alloc_full_sheaf-v1-1-c4c5bb587ae5@kernel.org Signed-off-by: Vlastimil Babka (SUSE) commit cb15d8e6cbe8d085ac585016deb2e1e0107b99e5 Author: Linus Walleij Date: Sat Mar 14 23:56:49 2026 +0100 ASoC: codec: arizona: Convert to use GPIO descriptors This converts the Arizona driver to use GPIO descriptors exclusively, deletes the legacy code path an updates the in-tree user of legacy GPIO. The GPIO lines for mic detect polarity and headphone ID detection are made exclusively descriptor-oriented. The headphone ID detection could actually only be used by the legacy GPIO code, but I converted it to use a descriptor if someone would actually need it so we don't just drop useful code. The compatible "wlf,hpdet-id-gpio" is not in the device tree bindings and only intended to be used by software nodes if any. If someone insists I can try to add a binding for it, but I doubt there is any real user so it seems pointless. Signed-off-by: Linus Walleij Reviewed-by: Charles Keepax Reviewed-by: Bartosz Golaszewski Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260314-asoc-arizona-v1-1-ecc9a165307c@kernel.org Signed-off-by: Mark Brown commit dc3b90751d6ffa8865e09a81645a539b9de6d642 Author: Yonghong Song Date: Fri Mar 6 21:02:50 2026 -0800 kbuild: Reduce the number of compiler-generated suffixes for clang thin-lto build The current clang thin-lto build often produces lots of symbols with suffix. The following is a partial list of such function call symbols: ... ethnl_module_fw_flash_ntf.llvm.7631589765585346066 __nf_conntrack_alloc.llvm.6438426151906658917 tcp_can_early_drop.llvm.11937612064648250727 tcp_print_conntrack.llvm.11937612064648250727 ... In my particular build with current bpf-next, the number of '*.llvm.' function calls is 1212. As the side effect of cross-file inlining, some static variables may be promoted with '*.llvm.' as well. In my same setup, the number of variables with such suffixes is 9. Such symbols make kernel live patching difficult since - a minor code change will change the hash and then the '*.llvm.' symbol becomes another one with a different hash. Sometimes, maybe the suffix is gone. - a previous source-level symbol may become a one with suffix after live patching code. In [1], Song Liu suggested to reduce the number of '*.llvm.' functions to make live patch easier. In respond of this, I implemented this in llvm ([2]). The same thin-lto build with [2] only has two symbols with suffix: m_stop.llvm.14460341347352036579 m_next.llvm.14460341347352036579 This should make live patch much easier. To support suffix symbol reduction, two lld flags are necessary to enable this feature in kernel: - Flag '--lto-whole-program-visibility' is needed as it ensures that all non-assembly files are available in the same thin-lto lld, which is true for kernel. - Flag '-mllvm -always-rename-promoted-locals=false' is needed to enable suffix reduction. Currently in llvm [1], only process mode is supported. There is another distributed mode (across different processes or even different machines) which is not supported yet ([2]). The kernel uses process mode so it should work. The assembly files may have some global functions/data which may potentially conflict with thin-lto global symbols after the above two flags. But such assembly global symbols are limited and tend to be uniquely named for its context. Hence the conflict with globals in non-assembly codes is rare. If indeed the conflict happens, we can rename either of them to avoid conflicts. Nathan Chancellor suggested the following under thin-lto: KBUILD_LDFLAGS += $(call ld-option,--lto-whole-program-visibility -mllvm -always-rename-promoted-locals=false) The '-mllvm -always-rename-promoted-locals=false' flag is only available for llvm23. So for llvm22 or earlier, the above KBUILD_LDFLAGS will ignore those two flags. For llvm23 and later, two flags will be added to KBUILD_LDFLAGS. [1] https://lpc.events/event/19/contributions/2212 [2] https://github.com/llvm/llvm-project/pull/178587 Signed-off-by: Yonghong Song Acked-by: Song Liu Acked-by: Josh Poimboeuf Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor # build Link: https://patch.msgid.link/20260307050250.3767489-1-yonghong.song@linux.dev Signed-off-by: Nicolas Schier commit b06e988c4c52ce8750616ea9b23c8bd3b611b931 Author: Bart Van Assche Date: Fri Mar 13 10:15:09 2026 -0700 locking: Add lock context annotations in the spinlock implementation Make the spinlock implementation compatible with lock context analysis (CONTEXT_ANALYSIS := 1) by adding lock context annotations to the _raw_##op##_...() macros. Signed-off-by: Bart Van Assche Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260313171510.230998-4-bvanassche@acm.org commit c4d3b8c77d85082d32250c505beb1d9e46ee47ee Author: Bart Van Assche Date: Fri Mar 13 10:15:08 2026 -0700 locking: Add lock context support in do_raw_{read,write}_trylock() Convert do_raw_{read,write}_trylock() from macros into inline functions and annotate these inline functions with __cond_acquires_shared() or __cond_acquires() as appropriate. This change is necessary to build kernel drivers or subsystems that use rwlock synchronization objects with lock context analysis enabled. The return type 'int' matches the return type for CONFIG_DEBUG_SPINLOCK=y. Signed-off-by: Bart Van Assche Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260313171510.230998-3-bvanassche@acm.org commit 756a0e011cfca0b45a48464aa25b05d9a9c2fb0b Author: Bart Van Assche Date: Fri Mar 13 10:15:07 2026 -0700 locking: Fix rwlock support in Architecture support for rwlocks must be available whether or not CONFIG_DEBUG_SPINLOCK has been defined. Move the definitions of the arch_{read,write}_{lock,trylock,unlock}() macros such that these become visbile if CONFIG_DEBUG_SPINLOCK=n. This patch prepares for converting do_raw_{read,write}_trylock() into inline functions. Without this patch that conversion triggers a build failure for UP architectures, e.g. arm-ep93xx. I used the following kernel configuration to build the kernel for that architecture: CONFIG_ARCH_MULTIPLATFORM=y CONFIG_ARCH_MULTI_V7=n CONFIG_ATAGS=y CONFIG_MMU=y CONFIG_ARCH_MULTI_V4T=y CONFIG_CPU_LITTLE_ENDIAN=y CONFIG_ARCH_EP93XX=y Fixes: fb1c8f93d869 ("[PATCH] spinlock consolidation") Signed-off-by: Bart Van Assche Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260313171510.230998-2-bvanassche@acm.org commit 891626973b2faf468565a253ca55373e0b9675de Author: Mikhail Gavrilov Date: Fri Mar 13 22:10:02 2026 +0500 lockdep: Raise default stack trace limits when KASAN is enabled KASAN-enabled kernels with LOCKDEP and PREEMPT_FULL hit "BUG: MAX_STACK_TRACE_ENTRIES too low!" within 9-23 hours of normal desktop use. The root cause is a feedback loop between KASAN slab tracking and lockdep: every KASAN-tracked slab allocation saves a stack trace via stack_trace_save() -> arch_stack_walk(). The unwinder calls is_bpf_text_address(), which under PREEMPT_FULL can trigger RCU deferred quiescent-state processing -> swake_up_one() -> lock_acquire() -> lockdep validate_chain() -> save_trace(). This means KASAN's own stack captures indirectly generate new lockdep dependency chains, consuming the buffer from both directions. /proc/lockdep_stats at the moment of overflow confirms that stack-trace entries is the sole exhausted resource: stack-trace entries: 524288 [max: 524288] <- 100% full number of stack traces: 22080 <- unique after dedup dependency chains: 164665 [max: 524288] <- only 31% used direct dependencies: 45270 [max: 65536] <- 69% lock-classes: 2811 [max: 8192] <- 34% 22080 genuinely unique traces averaging ~24 frames each fill the buffer in under a day. The hash-based deduplication (12593b7467f9) is working correctly -- the traces are simply all different due to the deep and varied call stacks from GPU + filesystem + Wine/Proton + KASAN instrumentation. Raise the LOCKDEP_STACK_TRACE_BITS default from 19 to 21 when KASAN is enabled (2M entries, +12MB). This is negligible compared to KASAN's own shadow memory overhead (~12.5% of total RAM). Scale LOCKDEP_STACK_TRACE_HASH_BITS accordingly to maintain dedup efficiency. Signed-off-by: Mikhail Gavrilov Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260313171118.1702954-2-mikhail.v.gavrilov@gmail.com commit 2deccd5c862a0337a691bcfaa87919b4216e6103 Author: Peter Zijlstra Date: Mon Mar 9 17:40:42 2026 +0100 cleanup: Optimize guards Andrew reported that a guard() conversion of zone_lock increased the code size unnecessarily. It turns out the unconditional __GUARD_IS_ERR() is to blame. As explored earlier [1], __GUARD_IS_ERR(), similar to IS_ERR_OR_NULL(), generates somewhat sub-optimal code. However, looking at things again, it is possible to avoid doing the __GUARD_IS_ERR() unconditionally. Revert the normal destructors to a simple NULL test and only add the IS_ERR bit to COND guards. This cures the reported overhead; as compiled by GCC-16: page_alloc.o: pre: Total: Before=45299, After=45371, chg +0.16% post: Total: Before=45299, After=45026, chg -0.60% [1] https://lkml.kernel.org/r/20250513085001.GC25891@noisy.programming.kicks-ass.net Reported-by: Andrew Morton Signed-off-by: Peter Zijlstra (Intel) Tested-by: Dan Williams Link: https://patch.msgid.link/20260309164516.GE606826@noisy.programming.kicks-ass.net commit acb38872d4cbec5b6825345d9d757e21d2d9d953 Author: Thomas Weißschuh Date: Fri Mar 13 09:22:19 2026 +0100 jump_label: remove workaround for old compilers in initializations The extra braces for the initialization of the anonymous union members were added in commit cd8d860dcce9 ("jump_label: Fix anonymous union initialization") to compensate for limitations in gcc < 4.6. Versions of gcc this old are not supported anymore, so drop the workaround. Signed-off-by: Thomas Weißschuh Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260313-jump_label-cleanup-v2-2-35d3c0bde549@linutronix.de commit 428c56525bf5dbc3bd5e30014df1f5213f8bd7c8 Author: Thomas Weißschuh Date: Fri Mar 13 09:22:18 2026 +0100 jump_label: use ATOMIC_INIT() for initialization of .enabled Currently ATOMIC_INIT() is not used because in the past that macro was provided by linux/atomic.h which is not usable from linux/jump_label.h. However since commit 7ca8cf5347f7 ("locking/atomic: Move ATOMIC_INIT into linux/types.h") the macro only requires linux/types.h. Remove the now unnecessary workaround and the associated assertions. Signed-off-by: Thomas Weißschuh Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260313-jump_label-cleanup-v2-1-35d3c0bde549@linutronix.de commit 16df04446e34a1e7dba57f657af6ad5f51199763 Author: Peter Zijlstra Date: Wed Jan 14 12:08:28 2026 +0100 futex: Convert to compiler context analysis Convert the sparse annotations over to the new compiler context analysis stuff. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260121111213.950376128@infradead.org commit 68bcd8b6e0b10d902f7fc8bf3f08f335f5d1640e Author: Andrei Vagin Date: Sat Mar 14 18:26:07 2026 +0000 locking/rwsem: Fix logic error in rwsem_del_waiter() Commit 1ea4b473504b ("locking/rwsem: Remove the list_head from struct rw_semaphore") introduced a logic error in rwsem_del_waiter(). The root cause of this issue is an inconsistency in the return values of __rwsem_del_waiter() and rwsem_del_waiter(). Specifically, __rwsem_del_waiter() returns true when the wait list becomes empty, whereas rwsem_del_waiter() is supposed to return true if the wait list is NOT empty. This caused a null pointer dereference in rwsem_mark_wake() because it was being called when sem->first_waiter was NULL. Fixes: 1ea4b473504b ("locking/rwsem: Remove the list_head from struct rw_semaphore") Reported-by: syzbot+3d2ff92c67127d337463@syzkaller.appspotmail.com Signed-off-by: Andrei Vagin Signed-off-by: Peter Zijlstra (Intel) Tested-by: syzbot+3d2ff92c67127d337463@syzkaller.appspotmail.com Link: https://patch.msgid.link/20260314182607.3343346-1-avagin@google.com commit c5f59626f1ab0292699c1744f05d1918f4665db3 Merge: 739690915ce1f0 773b24bcedc16a Author: Peter Zijlstra Date: Mon Mar 16 13:16:47 2026 +0100 Merge branch 'arm64/for-next/read-once' Need the arm64 READ_ONCE() rework, otherwise clang context analysis can't see through it. Signed-off-by: Peter Zijlstra commit 77f58db7391e227f8ff6ef5d83966347d759daed Author: Hyunchul Lee Date: Fri Mar 13 09:47:01 2026 +0900 ntfs: fix ignoring unreachable code warnings Detected by Smatch. inode.c:1796 load_attribute_list_mount() warn: ignoring unreachable code. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 068a35fd7293c20ba35cc3f19ce981c038cc9328 Author: Hyunchul Lee Date: Fri Mar 13 09:25:21 2026 +0900 ntfs: fix inconsistent indenting warnings Detected by Smatch. ndex.c:2041 ntfs_index_walk_up() warn: inconsistent indenting mft.c:2462 ntfs_mft_record_alloc() warn: inconsistent indenting Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 4e59f8a1a82beaa49d7796648fc4dc538eff6485 Author: Hyunchul Lee Date: Fri Mar 13 08:59:07 2026 +0900 ntfs: fix variable dereferenced before check warnings Detected by Smatch. lcnalloc.c:736 ntfs_cluster_alloc() error: we previously assumed 'rl' could be null (see line 719) inode.c:3275 ntfs_inode_close() warn: variable dereferenced before check 'tmp_nis' (see line 3255) attrib.c:4952 ntfs_attr_remove() warn: variable dereferenced before check 'ni' (see line 4951) dir.c:1035 ntfs_readdir() error: we previously assumed 'private' could be null (see line 850) Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 7cf4b3c768fda4076af25d5c4bb4a6267e32d42d Author: Hyunchul Lee Date: Wed Mar 11 11:13:51 2026 +0900 ntfs: prefer IS_ERR_OR_NULL() over manual NULL check Use IS_ERR_OR_NULL() instead of manual NULL and IS_ERR() checks. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit e6a95c5a8066b4d6a74651f89612f13ed1a03fe6 Author: Hyunchul Lee Date: Mon Mar 9 16:40:09 2026 +0900 ntfs: harden ntfs_listxattr against EA entries Validate every EA entry only if the buffer length is required to prevent large memory allocation. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit c451d34ae14201c2bb40652bf74072a79ff82f7d Author: Hyunchul Lee Date: Mon Mar 9 16:06:46 2026 +0900 ntfs: harden ntfs_ea_lookup against malformed EA entries Validate p_ea->ea_name_length tightly, and the used entry size for every EA. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 10993e525b1ee81cbe02a8ca7d0005712f6b3d82 Author: Hyunchul Lee Date: Mon Mar 9 16:06:06 2026 +0900 ntfs: check $EA query-length in ntfs_ea_get if ea_info_qlen exceeds all_ea_size, OOB can happen. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit a5325419e9fb086f79334723a54481336dc9d561 Author: Hyunchul Lee Date: Mon Mar 9 13:06:51 2026 +0900 ntfs: validate WSL EA payload sizes Enforce the exact-size reads for $LXUID, $LXGID, $LXMOD, $LXDEV. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit a73258681279bceb4e9210d86204bae14d3ea795 Author: Hyunchul Lee Date: Thu Mar 12 08:36:24 2026 +0900 ntfs: fix WSL ea restore condition Use NTFS_VOL_GID(not NTFS_VOL_UID) for restoring the gid, and call ntfs_ea_get_wsl_inode() only when $EA_INFORMATION exists. Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 8c229b4aa00262c13787982e998c61c0783285e0 Author: Jouni Högander Date: Thu Mar 12 10:37:10 2026 +0200 drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state PSR entry_setup_frames is currently computed directly into struct intel_dp:intel_psr:entry_setup_frames. This causes a problem if mode change gets rejected after PSR compute config: Psr_entry_setup_frames computed for this rejected state is in intel_dp:intel_psr:entry_setup_frame. Fix this by computing it into intel_crtc_state and copy the value into intel_dp:intel_psr:entry_setup_frames on PSR enable. Fixes: 2b981d57e480 ("drm/i915/display: Support PSR entry VSC packet to be transmitted one frame earlier") Cc: Mika Kahola Cc: # v6.8+ Signed-off-by: Jouni Högander Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312083710.1593781-3-jouni.hogander@intel.com commit 65852b56bfa929f99e28c96fd98b02058959da7f Author: Jouni Högander Date: Thu Mar 12 10:37:09 2026 +0200 drm/i915/psr: Disable PSR on update_m_n and update_lrr PSR/PR parameters might change based on update_m_n or update_lrr. Disable on update_m_n and update_lrr to ensure proper parameters are taken into use on next PSR enable in intel_psr_post_plane_update. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15771 Fixes: 2bc98c6f97af ("drm/i915/alpm: Compute ALPM parameters into crtc_state->alpm_state") Cc: # v6.19+ Signed-off-by: Jouni Högander Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312083710.1593781-2-jouni.hogander@intel.com commit f48753aa3a109051e63e050e796f7d4cc6f22d3c Author: Atharv Dubey Date: Sat Mar 14 02:02:22 2026 +0530 media: cx25821-alsa: replace BUG_ON() with WARN_ON() media: cx25821-alsa: replace BUG_ON() with WARN_ON() Avoid crashing the kernel for a recoverable condition by replacing BUG_ON() with WARN_ON(). Signed-off-by: Atharv Dubey Signed-off-by: Hans Verkuil commit c03222d061fc5d150d696e7c3a91e58a620c7e65 Author: Zhaoyang Yu <2426767509@qq.com> Date: Sun Mar 1 16:18:54 2026 +0000 media: fimc: check return value of clk_enable in runtime_resume In fimc_runtime_resume(), the return value of clk_enable(fimc->clock[CLK_GATE]) was not checked. If enabling the clock fails, subsequent register accesses (fimc_hw_reset() and capture/m2m resume) may trigger a bus error or undefined behavior. Fix this by checking the return value. If clk_enable() fails, return the error immediately, preventing unsafe hardware access. Signed-off-by: Zhaoyang Yu <2426767509@qq.com> Signed-off-by: Hans Verkuil commit f3e969a5b54304cab6891a58d9dd8b29072bde4c Author: Felix Gu Date: Sun Mar 1 21:39:25 2026 +0800 media: ti: vpe: Add missing v4l2_device_unregister in vip_remove() The v4l2_device is registered during probe but was not being unregistered during remove. Add the missing v4l2_device_unregister() call to properly clean up resources. Fixes: fc2873aa4a21 ("media: ti: vpe: Add the VIP driver") Cc: stable@vger.kernel.org Signed-off-by: Felix Gu Reviewed-by: Yemike Abhilash Chandra Signed-off-by: Hans Verkuil commit 7254b31a13aaa0c2c0f9ffbc335b718656117ff4 Author: Janne Grunau Date: Sun Feb 15 18:42:59 2026 +0100 media: videobuf2: Set vma_flags in vb2_dma_sg_mmap vb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not see a reason why vb2_dma_sg should behave differently. This avoids hitting `WARN_ON(!(vma->vm_flags & VM_DONTEXPAND));` in drm_gem_mmap_obj() during mmap() of an imported dma-buf from the out of tree Apple ISP camera capture driver which uses vb2_dma_sg_memops. gst-launch-1.0 v4l2src ! gtk4paintablesink [ 38.201528] ------------[ cut here ]------------ [ 38.202135] WARNING: CPU: 7 PID: 2362 at drivers/gpu/drm/drm_gem.c:1144 drm_gem_mmap_obj+0x1f8/0x210 [ 38.203278] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device uinput nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr bnep nls_ascii i2c_dev loop fuse dm_multipath nfnetlink brcmfmac_wcc hid_magicmouse hci_bcm4377 brcmfmac brcmutil bluetooth ecdh_generic cfg80211 ecc btrfs xor xor_neon rfkill hid_apple raid6_pq joydev aop_als apple_nvmem_spmi industrialio snd_soc_aop apple_z2 snd_soc_cs42l84 tps6598x snd_soc_tas2764 macsmc_reboot spi_nor macsmc_hwmon rtc_macsmc gpio_macsmc macsmc_power regmap_spmi macsmc_input dockchannel_hid panel_summit appledrm nvme_apple dwc3 snd_soc_macaudio drm_client_lib nvme_core phy_apple_atc hwmon apple_sart apple_dockchannel macsmc apple_rtkit_helper spmi_apple_controller aop apple_wdt mfd_core nvmem_apple_efuses pinctrl_apple_gpio apple_isp apple_dcp videobuf2_dma_sg mux_core spi_apple [ 38.203300] videobuf2_memops i2c_pasemi_platform snd_soc_apple_mca videobuf2_v4l2 videodev clk_apple_nco videobuf2_common snd_pcm_dmaengine adpdrm asahi apple_admac adpdrm_mipi drm_dma_helper pwm_apple i2c_pasemi_core drm_display_helper mc cec apple_dart ofpart apple_soc_cpufreq leds_pwm phram [ 38.217677] CPU: 7 UID: 1000 PID: 2362 Comm: gst-launch-1.0 Tainted: G W 6.17.6+ #asahi-dev PREEMPT(full) [ 38.219040] Tainted: [W]=WARN [ 38.219398] Hardware name: Apple MacBook Pro (13-inch, M2, 2022) (DT) [ 38.220213] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 38.221088] pc : drm_gem_mmap_obj+0x1f8/0x210 [ 38.221643] lr : drm_gem_mmap_obj+0x78/0x210 [ 38.222178] sp : ffffc0008dc678e0 [ 38.222579] x29: ffffc0008dc678e0 x28: 0000000000042a97 x27: ffff8000b701b480 [ 38.223465] x26: 00000000000000fb x25: ffffc0008dc67d20 x24: ffffc0008dc67968 [ 38.224402] x23: ffff8000e3ca5600 x22: ffff8000265b7800 x21: ffff80003000c0c0 [ 38.225279] x20: 0000000000000000 x19: ffff8000b68c5200 x18: ffffc0008dc67968 [ 38.226151] x17: 0000000000000000 x16: 0000000000000000 x15: ffffc000810a30a8 [ 38.227042] x14: 00007fff637effff x13: 00005555de91ffff x12: 00007fff63293fff [ 38.227942] x11: 0000000000000000 x10: ffff8000184ecf08 x9 : ffffc0007a1900c8 [ 38.228824] x8 : ffffc0008dc67968 x7 : 0000000000000012 x6 : ffffc0015cf1c000 [ 38.229703] x5 : ffffc0008dc676a0 x4 : ffffc00081a27dc0 x3 : 0000000000000038 [ 38.230607] x2 : 0000000000000003 x1 : 0000000000000003 x0 : 00000000100000fb [ 38.231488] Call trace: [ 38.231806] drm_gem_mmap_obj+0x1f8/0x210 (P) [ 38.232342] drm_gem_mmap+0x140/0x260 [ 38.232813] __mmap_region+0x488/0x9a0 [ 38.233277] mmap_region+0xd0/0x148 [ 38.233703] do_mmap+0x350/0x5c0 [ 38.234148] vm_mmap_pgoff+0x14c/0x200 [ 38.234612] ksys_mmap_pgoff+0x150/0x208 [ 38.235107] __arm64_sys_mmap+0x34/0x50 [ 38.235611] invoke_syscall+0x50/0x120 [ 38.236075] el0_svc_common.constprop.0+0x48/0xf0 [ 38.236680] do_el0_svc+0x24/0x38 [ 38.237113] el0_svc+0x38/0x168 [ 38.237507] el0t_64_sync_handler+0xa0/0xe8 [ 38.238034] el0t_64_sync+0x198/0x1a0 [ 38.238491] ---[ end trace 0000000000000000 ]--- There were discussions in [1] at the end of 2023 that mmap() on imported dma-bufs should not be supported but as of v6.17 drm_gem_shmem_mmap() in drm_gem_shmem_helper.c still supports it. This might affect all gpu or accel drivers using drm_gem_shmem_mmap() or the wrapper drm_gem_shmem_object_mmap(). [1] https://lore.kernel.org/dri-devel/bc7f7844-0aa3-4802-b203-69d58e8be2fa@linux.intel.com/ Cc: stable@vger.kernel.org Fixes: 5ba3f757f059 ("[media] v4l: videobuf2: add DMA scatter/gather allocator") Signed-off-by: Janne Grunau Acked-by: Marek Szyprowski Signed-off-by: Hans Verkuil commit dd3eff5db48e9d75b27468166ad3ca8c4d657ffa Author: Hans Verkuil Date: Thu Feb 12 10:57:58 2026 +0100 .mailmap: Add back old email alias The old hans.verkuil@cisco.com email, long since dead, still pops up once in a while when using get_maintainer.pl. Add it back to .mailmap so it is mapped to a working email. Signed-off-by: Hans Verkuil commit b6f892ff82bde42d09e84617f6c1e9c6a9d42910 Author: Andriy Utkin Date: Mon Feb 9 15:01:06 2026 +0000 MAINTAINERS: drop myself from solo6x10, tw5864 Years passed since I stopped being involved in development of these drivers. Don't possess hardware samples, too. Signed-off-by: Andriy Utkin Signed-off-by: Hans Verkuil commit ca511311479d7985da50900488d802412887ef28 Author: Gaston Gonzalez Date: Fri Jan 30 17:45:43 2026 -0300 media: bcm2835-unicam: remove reference to dropped driver in Kconfig The bcm2835-camera driver was dropped in commit <90204a38a760>. Remove the paragraph in Kconfig making reference to it. Signed-off-by: Gaston Gonzalez Signed-off-by: Hans Verkuil commit b8db6cf0c2e27dab6f4bc66b2cbf2cdedc07d35f Author: Gaston Gonzalez Date: Fri Jan 30 17:45:41 2026 -0300 media: bcm2835-unicam: remove obsolete comment The bcm2835-camera driver was dropped in commit <90204a38a760>, but it is still mentioned as a current driver in a comment section. Remove the comment making reference to it. Signed-off-by: Gaston Gonzalez Signed-off-by: Hans Verkuil commit 6cc2b8d987477c5dce5eee4d78b226c981386fbb Author: Martin Tůma Date: Tue Jan 27 13:43:08 2026 +0100 media:admin-guide:mgb4: Add zDML color mapping info Document the zDML (Audi Digital Matrix Light) color mapping option for the inputs and the new outputs color mapping property. Signed-off-by: Martin Tůma Signed-off-by: Hans Verkuil commit b4318729a0df38a07be2348d8b91db40dc9f1cf3 Author: Martin Tůma Date: Tue Jan 27 13:43:07 2026 +0100 media:pci:mgb4: Add zDML color mapping support Add zDML (a special signal mapping as used in Audi Digital Matrix Lights) color mapping support. In addition to extending the already existing color mapping property of the inputs, the same property is added for the outputs that must be configured in the same way as the inputs. Signed-off-by: Martin Tůma Signed-off-by: Hans Verkuil commit 0924f7ed0c17c9aee75c269d8ed825b8fbfb3fa3 Author: Martin Tůma Date: Fri Jan 23 13:14:58 2026 +0100 media:pci:mgb4: Fixed negative hwmon temperatures processing The "magic" temperature formula must be computed using a signed integer for negative temperatures to work properly. Signed-off-by: Martin Tůma Signed-off-by: Hans Verkuil commit d8944192615e3f0bb00a64dfe2e93edbb6e0a5f9 Author: Nauman Sabir Date: Fri Jan 16 00:01:15 2026 +0100 media: docs: Fix typo 'hardwares' to 'hardware' Fix incorrect plural form of the uncountable noun 'hardware' in the legacy DVB audio documentation. Signed-off-by: Nauman Sabir Signed-off-by: Hans Verkuil commit 251475d98e36d8067d955cacc1aa08fbf89d13d2 Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:56 2026 +0100 media: samsung: exynos4-is: Simplify with scoped for each OF child loop Use scoped for_each_compatible_node_scoped() loop when iterating over device nodes to make code a bit simpler. Reviewed-by: Jonathan Cameron Signed-off-by: Krzysztof Kozlowski Signed-off-by: Hans Verkuil commit 01537c973d3aecd8f2e065e0449ef3e09495c917 Author: Andy Shevchenko Date: Fri Nov 7 21:02:59 2025 +0100 media: vidtv: Rename PI definition to PI_SAMPLES The definition of PI in the driver is not the actual value in radians, but rather degrees. Since we are going to have a value in radians defined in a global header, rename this definition to avoid potential collisions. No functional changes. Acked-by: Hans Verkuil Signed-off-by: Andy Shevchenko Signed-off-by: Hans Verkuil commit ec6c3e3f0e61a9da2e7e4619248d18479b28b8a5 Author: Martin Hecht Date: Tue Sep 9 13:32:16 2025 +0200 media: i2c: alvium-csi2 Change from my company email address to gmail.com. Signed-off-by: Martin Hecht Signed-off-by: Hans Verkuil commit 108bd79a12c4ae90486962d887a2176be0ab65c9 Author: Martin Hecht Date: Tue Sep 9 13:32:15 2025 +0200 dt-bindings: media: i2c: alliedvision,alvium-csi2 Change from my company email address to gmail.com. Signed-off-by: Martin Hecht Acked-by: Krzysztof Kozlowski Signed-off-by: Hans Verkuil commit ad4729225d93f71f50710ed1757f619845b0082e Author: Arnd Bergmann Date: Fri Jun 20 13:14:23 2025 +0200 media: mxl5005s: reduce stack usage in MXL5005_ControlInit This function initializes two large structures with arrays. On at least parisc, the specific code sequence here leads to a badly misoptimized output from the compiler along with a warning about the resulting excessive stack usage from many spilled variables: drivers/media/tuners/mxl5005s.c: In function 'MXL5005_ControlInit.isra': drivers/media/tuners/mxl5005s.c:1660:1: warning: the frame size of 1400 bytes is larger than 1024 bytes [-Wframe-larger-than=] Splitting this one function into two functions avoids this because there are few temporaries that can be spilled to the stack in each of the smaller structures, so this avoids the warning and also improves readability. Signed-off-by: Arnd Bergmann Signed-off-by: Hans Verkuil commit de6c925db978004703944585e9dd57d58aba0fac Merge: 322a81d35ecdf9 f338e77383789c Author: Greg Kroah-Hartman Date: Mon Mar 16 11:50:48 2026 +0100 Merge 7.0-rc4 into usb-next We need the USB fixes in this branch as well to build on top of Signed-off-by: Greg Kroah-Hartman commit 678f946b40586a276421b2b4b6201665d6709119 Author: Johan Hovold Date: Thu Mar 5 11:27:45 2026 +0100 gpib: ni_usb: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305102745.12032-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit d35da40ec364ff9e763e7fd3198ca14cf39d39bf Author: Johan Hovold Date: Thu Mar 5 11:27:44 2026 +0100 gpib: agilent_82357a: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305102745.12032-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 04576813544d141b50e7e80e2f447b88235c61d7 Author: Jori Koolstra Date: Tue Mar 3 20:21:20 2026 +0100 gpib: common: change gpib_class to a const struct The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Change gpib_class to be a const struct class and drop the class_create() call. Link: https://lore.kernel.org/all/2023040244-duffel-pushpin-f738@gregkh/ Suggested-by: Greg Kroah-Hartman Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20260303192124.3855792-1-jkoolstra@xs4all.nl Signed-off-by: Greg Kroah-Hartman commit 42df3a519ab6d355e2c43f1e30eb5414b60aeea5 Author: Ethan Nelson-Moore Date: Fri Jan 30 17:41:40 2026 -0800 gpib: remove unnecessary module_init/exit functions Two GPIB drivers have unnecessary empty module_init and module_exit functions. Remove them. Note that if a module_init function exists, a module_exit function must also exist; otherwise, the module cannot be unloaded. Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260131014152.35875-1-enelsonmoore@gmail.com Signed-off-by: Greg Kroah-Hartman commit f3f5d52d6bcdf190891601a11910cdd596963c1e Merge: ad6bb64332bb42 f338e77383789c Author: Greg Kroah-Hartman Date: Mon Mar 16 11:47:14 2026 +0100 Merge 7.0-rc4 into staging-next We need the staging driver fixes in here to build on top of Signed-off-by: Greg Kroah-Hartman commit bf3e24a9bff52303f5058c83cc6c7d7b2ef4958f Author: Johan Hovold Date: Thu Mar 5 16:17:29 2026 +0100 gpib: lpvo_usb: rename driver symbol prefix The LPVO driver apparently includes a more or less verbatim copy of the USB skeleton driver. Replace the "skel_" symbol prefix with "lpvo_" and rename the "usb_skel" struct "lpvo" to avoid symbol name clashes and make this a bit more palatable. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305151729.10501-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3812943e01fdeabd80118b01c1484f6bd4d324d9 Merge: 34268365a9e942 f338e77383789c Author: Greg Kroah-Hartman Date: Mon Mar 16 11:41:58 2026 +0100 Merge 7.0-rc4 into char-misc-next We need the char/misc/iio fixes in this branch as well to build on top of. Signed-off-by: Greg Kroah-Hartman commit 9ba4ef6847ba53dea92efce47c9e044fbf6d6dcf Author: Chen Ni Date: Thu Mar 12 11:18:20 2026 +0800 pinctrl: realtek: Fix error check for devm_platform_ioremap_resource() Replace NULL check with IS_ERR() for devm_platform_ioremap_resource() return value. Use dev_err_probe() for error handling to maintain consistency with the rest of the probe function. Fixes: b7f698b22b8b ("pinctrl: realtek: Switch to use devm functions") Signed-off-by: Chen Ni Signed-off-by: Linus Walleij commit abf3502033cfc2797126f054eb081857f8e7e939 Author: Lad Prabhakar Date: Mon Mar 9 16:59:46 2026 +0000 soc: renesas: r9a09g056-sys: Mark rzv2n_sys_init_data as __initconst Annotate rzv2n_sys_init_data with __initconst as it is only used during initialization. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260309165946.3003731-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 71e94c79606c5e6ca0c3ae41b6a9ce8b13c721b4 Author: Lad Prabhakar Date: Mon Mar 9 16:59:45 2026 +0000 soc: renesas: r9a09g047-sys: Mark rzg3e_sys_init_data as __initconst Annotate rzg3e_sys_init_data with __initconst as it is only used during initialization. Signed-off-by: Lad Prabhakar Reviewed-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260309165946.3003731-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a01c4cd7e2f7812bb5c87a73d0fb9cb501e7cabd Author: Lad Prabhakar Date: Mon Mar 9 16:59:44 2026 +0000 soc: renesas: r9a09g057-sys: Mark rzv2h_sys_init_data as __initconst Annotate rzv2h_sys_init_data with __initconst as it is only used during initialization. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260309165946.3003731-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit d784bbad7fcbfad42e0d12c8dae2eb9c17b327b4 Author: Geert Uytterhoeven Date: Wed Mar 11 16:14:14 2026 +0100 ARM: shmobile: rcar-gen2: Use of_phandle_args_equal() helper Use the existing of_phandle_args_equal() helper instead of open-coding the same operation. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/d8338ff1fd795912b466ccf55b49dcd6885b6925.1773241833.git.geert+renesas@glider.be commit 618a9db0158b1c51fd33822cf804f5a09f829837 Author: Tejun Heo Date: Sun Mar 15 19:43:28 2026 -1000 sched_ext: Use kobject_put() for kobject_init_and_add() failure in scx_alloc_and_add_sched() kobject_init_and_add() failure requires kobject_put() for proper cleanup, but the error paths were using kfree(sch) possibly leaking the kobject name. The kset_create_and_add() failure was already using kobject_put() correctly. Switch the kobject_init_and_add() error paths to use kobject_put(). As the release path puts the cgroup ref, make scx_alloc_and_add_sched() always consume @cgrp via a new err_put_cgrp label at the bottom of the error chain and update scx_sub_enable_workfn() accordingly. Fixes: 17108735b47d ("sched_ext: Use dynamic allocation for scx_sched") Reported-by: David Carlier Link: https://lore.kernel.org/r/20260314134457.46216-1-devnexen@gmail.com Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 0c66b0da006415880444ec821e3cb66a89273865 Author: Tejun Heo Date: Sun Mar 15 19:43:27 2026 -1000 sched_ext: Fix cgroup double-put on sub-sched abort path The abort path in scx_sub_enable_workfn() fell through to out_put_cgrp, double-putting the cgroup ref already owned by sch->cgrp. It also skipped kthread_flush_work() needed to flush the disable path. Relocate the abort block above err_unlock_and_disable so it falls through to err_disable. Fixes: 337ec00b1d9c ("sched_ext: Implement cgroup sub-sched enabling and disabling") Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit fc334ad4a1d110754b3ec3abd0805d1ae1cfcc4b Author: Srinivas Kandagatla Date: Wed Mar 11 12:42:28 2026 +0000 dt-bindings: pinctrl: qcom,sm8650-lpass-lpi-pinctrl: Add Glymur pinctrl Document compatible for Qualcomm Glymur SoC LPASS TLMM pin controller, fully compatible with previous SM8650 generation (same amount of pins and functions). Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit a6e53d05ab849779d55ca985566a1da7f22435b9 Author: Rosen Penev Date: Thu Mar 12 17:12:09 2026 -0700 gpio: cs5535: use dynamically allocated priv struct Static allocation is deprecated. Remove the FIXME as gpiochip_add_data allows using gpiod_get_data. No need for container_of. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260313001209.117823-1-rosenp@gmail.com Signed-off-by: Bartosz Golaszewski commit 3518fd4c780d4fa4c0e2cedd95c0f8bc5d8b457f Author: Tzung-Bi Shih Date: Fri Mar 13 05:41:12 2026 +0000 Revert "gpio: Access `gpio_bus_type` in gpiochip_setup_dev()" This reverts commit cc11f4ef666fbca02c8a2f11d0184d57e6b75579. Commit cc11f4ef666f ("gpio: Access `gpio_bus_type` in gpiochip_setup_dev()") moved the bus type assignment from gpiochip_add_data_with_key() to gpiochip_setup_dev(). This change introduced a bug where dev_printk() and friends might access the bus name after gpiochip_add_data_with_key() but before gpiochip_setup_dev() has run. In this window, the bus type is not yet initialized, leading to empty bus names in logs. Move the bus type assignment back to gpiochip_add_data_with_key() to ensure the bus name is available before any potential users like dev_printk(). Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/all/CAMuHMdU0Xb=Moca5LUex+VxyHQa2-uYJgYf4hzHiSEjDCQQT=Q@mail.gmail.com/ Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260313054112.1248074-1-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit 7673e4c7f7f99bfc9f30294ac8ab769dbb386866 Author: Linus Walleij Date: Sat Mar 14 00:07:50 2026 +0100 Do not enable the v1 uAPI by default It's been five years since we introduced the v2 uAPI and the major consumer libgpiod is at v2.2.3. Let's discourage the old ABI. Signed-off-by: Linus Walleij Reviewed-by: Kent Gibson Link: https://patch.msgid.link/20260314-no-y-uapi1-default-v2-1-578f09c91b8f@kernel.org Signed-off-by: Bartosz Golaszewski commit a25f48fd920b557e6ad02f692f690520c82f5914 Author: Alban Bedel Date: Wed Mar 11 15:31:20 2026 +0100 gpio: kempld: Implement the interrupt controller Add a GPIO IRQ chip implementation for the kempld GPIO controller. Of note is only how the parent IRQ is obtained. The IRQ for the GPIO controller can be configured in the BIOS, along with the IRQ for the I2C controller. These IRQ are returned by ACPI but this information is only usable if both IRQ are configured. When only one is configured, only one is returned making it impossible to know which one it is. Luckily the BIOS will set the configured IRQ in the PLD registers, so it can be read from there instead, and that also work on platforms without ACPI. The vendor driver allowed to override the IRQ using a module parameters, so there are boards in field which used this parameter instead of properly configuring the BIOS. This implementation provides this as well for compatibility. Signed-off-by: Alban Bedel Link: https://patch.msgid.link/20260311143120.2179347-5-alban.bedel@lht.dlh.de Signed-off-by: Bartosz Golaszewski commit 2443c2e1223bda4dcef5563d0154df6a72969922 Author: Alban Bedel Date: Wed Mar 11 15:31:19 2026 +0100 gpio: kempld: Add support for get/set multiple As the bus accesses are quiet slow with this device, supporting the get/set multiple API can help with performences. The implementation tries to keep the number of bus access to a minimum by checking the mask to only read or write the needed bytes. Signed-off-by: Alban Bedel Link: https://patch.msgid.link/20260311143120.2179347-4-alban.bedel@lht.dlh.de Signed-off-by: Bartosz Golaszewski commit 84cb463d2f6597c7951da6fb795f12119af8130d Author: Alban Bedel Date: Wed Mar 11 15:31:18 2026 +0100 gpio: kempld: Add support for PLD version >= 2.8 Starting with version 2.8 there is a dedicated register to configure the output level. Read the PLD version in the probe and select the correct register to use for the set operations. Signed-off-by: Alban Bedel Link: https://patch.msgid.link/20260311143120.2179347-3-alban.bedel@lht.dlh.de Signed-off-by: Bartosz Golaszewski commit 4071437cd2aac6b9d48f160d46cfb35ecbb11136 Author: Alban Bedel Date: Wed Mar 11 15:31:17 2026 +0100 gpio: kempld: Simplify the bit level register accesses The hardware uses 8 bit registers but supports configurations with up to 16 GPIO, so all GPIO registers come in pairs. Most accesses to single bits is done using the kempld_gpio_bitop() and kempld_gpio_get_bit() functions, which take a register index and bit offset as parameter. These functions apply a modulo on the bit offset but leave the register index as is, so callers have to use an additional macro to fix the register index before the call. Simplify things by also handling the register index offsetting in the bitop functions. Signed-off-by: Alban Bedel Link: https://patch.msgid.link/20260311143120.2179347-2-alban.bedel@lht.dlh.de Signed-off-by: Bartosz Golaszewski commit 9876394f64a7c166964e003585806473ad6f532b Author: Jani Nikula Date: Wed Mar 11 16:18:18 2026 +0200 drm/{i915,xe}: move framebuffer bo to parent interface Add .framebuffer_init, .framebuffer_fini and .framebuffer_lookup to the bo parent interface. While they're about framebuffers, they're specifically about framebuffer objects, so the bo interface is a good enough fit, and there's no need to add another interface struct. Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/848d32a44bf844cba3d66e44ba9f20bea4a8352d.1773238670.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a65c06a94886c446f906a3ef96f2458e1b8e3425 Author: Jani Nikula Date: Wed Mar 11 16:18:17 2026 +0200 drm/i915/fb: make intel_fb_bo.c less dependent on display intel_fb_bo.c is i915 core specific code, and should use struct drm_i915_private instead of struct intel_display. Switch one DISPLAY_VER() to GRAPHICS_VER(). The check is for < 4, where they're effectively the same thing. Reviewed-by: Suraj Kandpal@intel.com> Link: https://patch.msgid.link/13087bd24bd5af5265ca6af67f086b93e26e311f.1773238670.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 37a6ed2c284b594470e5512df3528abb50b9815e Author: Jani Nikula Date: Wed Mar 11 16:18:16 2026 +0200 drm/{i915, xe}/bo: move display bo calls to parent interface Continue i915 and xe separation from display by moving the bo calls to the display parent interface. Instead of adding all these functions to intel_parent.[ch], reuse the now vacated intel_bo.[ch], and avoid mass renames to calls of these functions. This is similar to intel_display_rpm.[ch]. Make many of the hooks optional to avoid having to implement dummy functions in xe. Indeed now we can remove many of the existing dummy functions. Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/7899eef2ccf0cd603df69099df065226a0df917b.1773238670.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 49464bb6977aa87e3edda2f5d011fbaafc5e1cf3 Author: Jani Nikula Date: Wed Mar 11 16:18:15 2026 +0200 drm/xe: rename intel_bo.c to xe_display_bo.c Follow the xe_ prefixed file naming in xe. With xe_bo.[ch] already being a thing in xe core, use xe_display_bo.c. Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/2f73eda5117462407f12113ce096496282ee3fcc.1773238670.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit e3ef2c21176e7031b5846418e3dd1b5b94512ce5 Author: Jani Nikula Date: Wed Mar 11 16:18:14 2026 +0200 drm/i915: move i915 specific bo implementation to i915 The bo interface implementation is different for both i915 and xe. Move the i915 specific implementation from display to i915 core. Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/e159166d623899996a51a577365ca7ab9b1a0974.1773238670.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 803e822b0089211367d8d368a163b1dea077159d Author: Linus Walleij Date: Wed Mar 11 10:42:14 2026 +0100 gpiolib: Update gpiochip_find_base_unlocked() kerneldoc This function albeit static was lacking a kerneldoc, and the function returns a dangerous number for internal use so make that clear in the kerneldoc. Reported-by: Matthijs Kooijman Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260311-gpio-discourage-dynamic-v1-1-c8b68fc84203@kernel.org Signed-off-by: Bartosz Golaszewski commit 8a3613898ff3b7eb9eed252f41aebcc1d7af4a31 Author: Richard Lyu Date: Wed Mar 11 16:59:26 2026 +0800 gpio: max732x: use guard(mutex) to simplify locking Convert the max732x driver to use the RAII-based guard(mutex) macro from . This change replaces manual mutex_lock() and mutex_unlock() calls, allowing the chip lock to be managed automatically based on function scope. Refactor max732x_gpio_set_mask() and max732x_irq_update_mask() to improve code readability. This allows for direct returns and removes the redundant 'out' label in the set_mask function, resulting in cleaner and more maintainable code. While at it: order includes alphabetically and add missing ones. Signed-off-by: Richard Lyu Link: https://patch.msgid.link/20260311085924.191288-1-richard.lyu@suse.com [Bartosz: tweak commit message, add err.h and device.h to includes] Signed-off-by: Bartosz Golaszewski commit 696e9ba9a3da3d919d08a1abf05c9288311858f1 Author: Bartosz Golaszewski Date: Mon Mar 9 13:42:42 2026 +0100 gpio: sim: allow to define the active-low setting of a simulated hog Add a new configfs attribute to the hog group allowing to configure the active-low lookup flag for hogged lines. This will allow us to extend tests to also cover the line config of hogs set up using software nodes. Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-6-4e61f3dbf06a@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit dea046e7f46f2357124a465e058c92cac3e351c5 Author: Bartosz Golaszewski Date: Mon Mar 9 13:42:41 2026 +0100 gpio: remove machine hogs With no more users, remove legacy machine hog API from the kernel. Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-5-4e61f3dbf06a@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit e627fc9fad93d59765dd16adac1b2a9bf68d7523 Author: Bartosz Golaszewski Date: Mon Mar 9 13:42:40 2026 +0100 ARM: omap1: ams-delta: convert GPIO hogs to using firmware nodes Setup a software node hierarchy for the latch2 GPIO controller defining the required hog and stop using legacy machine hog API. Acked-by: Kevin Hilman Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-4-4e61f3dbf06a@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 5cfbd0eb784f19436b5d5a9a7e0dca862619739a Author: Bartosz Golaszewski Date: Mon Mar 9 13:42:39 2026 +0100 gpio: sim: use fwnode-based GPIO hogs Convert gpio-sim to using software nodes for setting up simulated hogs instead of legacy machine hogs. Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-3-4e61f3dbf06a@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit d1d564ec4992945db853303dc2978256bce8c0b4 Author: Bartosz Golaszewski Date: Mon Mar 9 13:42:38 2026 +0100 gpio: move hogs into GPIO core Refactor line hogging code by moving the parts duplicated in gpiolib-acpi-core.c and gpiolib-of.c into gpiolib.c, leaving just the OF-specific bits in the latter. This makes fwnode the primary API for setting up hogs and allows to use software nodes in addition to ACPI and OF nodes. Reviewed-by: Mika Westerberg Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-2-4e61f3dbf06a@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit bbee90e750262bfb406d66dc65c46d616d2b6673 Author: Bartosz Golaszewski Date: Mon Mar 9 13:42:37 2026 +0100 gpio: of: clear OF_POPULATED on hog nodes in remove path The previously set OF_POPULATED flag should be cleared on the hog nodes when removing the chip. Cc: stable@vger.kernel.org Fixes: 63636d956c455 ("gpio: of: Add DT overlay support for GPIO hogs") Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-1-4e61f3dbf06a@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 02e778f12359fde41830c42c70a737a1c1b0ce58 Merge: 3f071d00fc9478 7a9419ab42699f Author: Dave Airlie Date: Mon Mar 16 16:50:47 2026 +1000 Merge tag 'amd-drm-next-7.1-2026-03-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-7.1-2026-03-12: amdgpu: - SMU13 fix - SMU14 fix - Fixes for bring up hw testing - Kerneldoc fix - GC12 idle power fix for compute workloads - DCCG fixes - UserQ fixes - Move test for fbdev object to a generic helper - GC 12.1 updates - Use struct drm_edid in non-DC code - Include IP discovery data in devcoredump - SMU 13.x updates - Misc cleanups - DML 2.1 fixes - Enable NV12/P010 support on primary planes - Enable color encoding and color range on overlay planes - DC underflow fixes - HWSS fast path fixes - Replay fixes - DCN 4.2 updates - Support newer IP discovery tables - LSDMA 7.1 support - IH 7.1 fixes - SoC v1 updates - GC12.1 updates - PSP 15 updates - XGMI fixes - GPUVM locking fix amdkfd: - Fix missing BO unreserve in an error path radeon: - Move test for fbdev object to a generic helper From: Alex Deucher Link: https://patch.msgid.link/20260312184425.3875669-1-alexander.deucher@amd.com Signed-off-by: Dave Airlie commit a1488456f70655f7a95f846c8fbadbe61daf292c Author: Zong-Zhe Yang Date: Tue Mar 10 16:01:46 2026 +0800 wifi: rtw89: debug: simulate Wi-Fi 7 SER L0/L1 without PS mode Current triggers of Wi-Fi 7 SER (system error recovery) L0/L1 simulation don't yet guarantee working with PS mode. So, leave PS mode first before triggering them for now. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-14-pkshih@realtek.com commit 45ba9226b1081fe3292c1087de9db6d592c38de8 Author: Po-Hao Huang Date: Tue Mar 10 16:01:45 2026 +0800 wifi: rtw89: Recalculate station aggregates when AMSDU length changes for MLO links Currently, AMSDU length is updated per-link for MLO but not propagated to the station aggregates, causing suboptimal TX throughput. This change ensures station aggregates are recalculated when any link's AMSDU length changes. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-13-pkshih@realtek.com commit bda294ed0ed05ada2a832b19a55dd4a6fa72b1a1 Author: Po-Hao Huang Date: Tue Mar 10 16:01:44 2026 +0800 wifi: rtw89: Drop malformed AMPDU frames with abnormal PN Fix connection issue caused by AMPDU frames with abnormal PN patterns (out-of-order packets with correct MPDU sequence numbers but paired with abnormal PN values, which is next PN of previous in-order packet). This is causing packet drops, low throughput and disconnections. It is observed in fields with some specific AP firmwares. Do this workaround for better interoperability since some APs could never receive a proper FW update. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-12-pkshih@realtek.com commit 829b89c2b08ff376eb4c5edc66363ea09ba99138 Author: Zong-Zhe Yang Date: Tue Mar 10 16:01:43 2026 +0800 wifi: rtw89: replace RF mutex with wiphy lock assertion Now, stack has introduced wiphy lock. And, the normal paths calling RF read/write should be under wiphy lock. So, replace RF mutex with wiphy lock assertion. Besides, in dbgfs paths, add the corresponding lock option. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-11-pkshih@realtek.com commit 72dbc78594a19b78467d7a5ea67a0b557e505667 Author: Chin-Yen Lee Date: Tue Mar 10 16:01:42 2026 +0800 wifi: rtw89: wow: add retry for ensuring packet are processed Before entering WoWLAN mode, the driver must ensure that all received packets have been processed to prevent packet loss. Consequently, a retry mechanism has been implemented to guarantee completion. Signed-off-by: Chin-Yen Lee Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-10-pkshih@realtek.com commit cf3cd3687d8a9ff2940d97dc649c53c62458d3e9 Author: Zong-Zhe Yang Date: Tue Mar 10 16:01:41 2026 +0800 wifi: rtw89: chan: recalc MLO DBCC mode based on current entity mode Since MLD vif can do MLSR switch, it may not always run on HW band 0. But when preparing MCC for MLD + P2P, P2P vif needs to use HW band 0 to handle connection, i.e. uses of HW bands may be different by vif. The current major role/vif can be indicated through entity mode. So, based on it, recalculate MLO DBCC mode to change use of HW band. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-9-pkshih@realtek.com commit 2fed8de4eb98764e559189eb3bac9d3f2954cb95 Author: Zong-Zhe Yang Date: Tue Mar 10 16:01:40 2026 +0800 wifi: rtw89: chan: simplify link handling related to ROC The original channel is swapped out for the target channel during ROC. And, all vifs/links accessing the original channel will be marked with off-channel. So, it doesn't seem necessary for chan.c to determine which link instance it is. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-8-pkshih@realtek.com commit 4516621686cb3c628c2094f38e622a94958b335e Author: Zong-Zhe Yang Date: Tue Mar 10 16:01:39 2026 +0800 wifi: rtw89: tweak settings of TX power and channel for Wi-Fi 7 The support_mlo flag depends on FW features, so it's determined at runtime. Since Wi-Fi 7 chip now needs to initialize second HW band, if support_mlo is not allowed, second HW band might act without settings of TX power and channel. So, set that for Wi-Fi 7 chip. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-7-pkshih@realtek.com commit be28b2c4eed490c95c2ca2ebacbf7795912b3ec6 Author: Zong-Zhe Yang Date: Tue Mar 10 16:01:38 2026 +0800 wifi: rtw89: move disabling dynamic mechanism functions to core Some dynamic mechanism (DM) may need to be disabled during some normal processes rather than debugging. For example, should not do MLSR switch during SCAN/ROC or even MCC. So, move the disabling DM functions to core for impending uses. No logic changes. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-6-pkshih@realtek.com commit 84f5e0eaf84ec55edfc053e858d58af074e3fcb4 Author: Ping-Ke Shih Date: Tue Mar 10 16:01:37 2026 +0800 wifi: rtw89: phy: limit AMPDU number for RA try rate When RA (Rate Adaptive) does try higher rate, a TRY bit is flagged, and hardware will reference registers configured by this patch as maximum number of AMPDU. To prevent aggregate too many MPDU over peer's capability causing loss in peer side, set the minimum values across all stations and TID since there is single one register per hardware band. Consider MLD case, a BA session can run across two hardware bands, so set the same value as well. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-5-pkshih@realtek.com commit 9a38ef92aaa2d3c02ae1f6f1cacc3d3a8cf19db6 Author: Ping-Ke Shih Date: Tue Mar 10 16:01:36 2026 +0800 wifi: rtw89: mac: remove A-die off setting for RTL8852C and RTL8922A Fix timing issue of A-die off followed by XTAL off. Otherwise, device might get lost potentially. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-4-pkshih@realtek.com commit 177520960c012cf223002279c6454726ea6fa73e Author: Ping-Ke Shih Date: Tue Mar 10 16:01:35 2026 +0800 wifi: rtw89: pci: update SER parameters for suspend/resume In suspend mode, SER timer unit is different from normal mode. Set proper value to prevent expected SER happened during suspend. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260310080146.31113-3-pkshih@realtek.com commit e1b6b5af5d1725c9474baf3846f717a738f7e000 Author: Jaime Saguillo Revilla Date: Sun Mar 8 11:18:50 2026 +0000 wifi: rtlwifi: rtl8192d: fix typo in H2C wait counter names Rename local variables in rtl92d_fill_h2c_cmd() from wait_writeh2c_limmit/wait_h2c_limmit to wait_writeh2c_limit/wait_h2c_limit. No functional change. Signed-off-by: Jaime Saguillo Revilla Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260308111850.20420-1-jaime.saguillo@gmail.com commit fc25b384fc0bb983fe383e8392b6c2f4aafec77d Author: Johan Hovold Date: Mon Mar 9 09:33:36 2026 +0100 wifi: rtlwifi: usb: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260309083336.16397-1-johan@kernel.org commit c2a21f35cea43c3287a4f314b7aab22ea7234122 Author: Johan Hovold Date: Fri Mar 6 10:32:06 2026 +0100 wifi: rtw89: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260306093206.21081-1-johan@kernel.org commit bbb15e71156cd9f5e1869eee7207a06ea8e96c39 Author: Johan Hovold Date: Fri Mar 6 09:51:44 2026 +0100 wifi: rtw88: fix device leak on probe failure Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. This driver takes a reference to the USB device during probe but does not to release it on all probe errors (e.g. when descriptor parsing fails). Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks. Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support") Reported-by: Greg Kroah-Hartman Link: https://lore.kernel.org/netdev/2026022319-turbofan-darkened-206d@gregkh/ Cc: stable@vger.kernel.org # 6.2 Cc: Sascha Hauer Signed-off-by: Johan Hovold Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260306085144.12064-19-johan@kernel.org commit 711b8add39294393a086b5c0e51f0c8d79a89f4d Author: Johan Hovold Date: Fri Mar 6 09:51:43 2026 +0100 wifi: rtl8xxxu: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260306085144.12064-18-johan@kernel.org commit 68e7d359a5eeea75197626c800d082955032e30a Author: Johan Hovold Date: Fri Mar 6 09:51:42 2026 +0100 wifi: rtl818x: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260306085144.12064-17-johan@kernel.org commit f8a2fc809bfeb49130709b31a4d357a049f28547 Author: Yi Cong Date: Fri Mar 6 15:16:27 2026 +0800 wifi: rtl8xxxu: fix potential use of uninitialized value The local variables 'mcs' and 'nss' in rtl8xxxu_update_ra_report() are passed to rtl8xxxu_desc_to_mcsrate() as output parameters. If the helper function encounters an unhandled rate index, it may return without setting these values, leading to the use of uninitialized stack data. Remove the helper rtl8xxxu_desc_to_mcsrate() and inline the logic into rtl8xxxu_update_ra_report(). This fixes the use of uninitialized 'mcs' and 'nss' variables for legacy rates. The new implementation explicitly handles: - Legacy rates: Set bitrate only. - HT rates (MCS0-15): Set MCS flags, index, and NSS (1 or 2) directly. - Invalid rates: Return early. Fixes: 7de16123d9e2 ("wifi: rtl8xxxu: Introduce rtl8xxxu_update_ra_report") Cc: stable@vger.kernel.org Suggested-by: Ping-Ke Shih Signed-off-by: Yi Cong Link: https://lore.kernel.org/all/96e31963da0c42dcb52ce44f818963d7@realtek.com/ Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260306071627.56501-1-cong.yi@linux.dev commit 2a585b2efb48a86cd32a953ba84cf1557a655b40 Author: J. Neuschäfer Date: Tue Mar 3 18:49:25 2026 +0100 wifi: rtl8xxxu: Mark RTL8188ETV (0bda:0179) as tested This WiFi chip appears in the "TCU Fernsehfee 3.0" set-top box. I have tested that it works in WPA2-PSK-CCMP client mode. Cc: Jes.Sorensen@gmail.com Signed-off-by: J. Neuschäfer Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260303-rtl8xxx-tested-v1-1-291a38a6ff2f@posteo.net commit 6955d6bca0531ffbbaeecac844b7bae84345b3fb Author: Chaitanya Kumar Borah Date: Tue Mar 10 17:02:38 2026 +0530 drm/atomic: Add affected colorops with affected planes When drm_atomic_add_affected_planes() adds a plane to the atomic state, the associated colorops are not guaranteed to be included. This can leave colorop state out of the transaction when planes are pulled in implicitly (eg. during modeset or internal commits). Also add affected colorops when adding affected planes to keep plane and color pipeline state consistent within the atomic transaction. v2: Add affected colorops only when a pipeline is enabled Fixes: 2afc3184f3b3 ("drm/plane: Add COLOR PIPELINE property") Cc: #v6.19+ Reviewed-by: Uma Shankar #v1 Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Harry Wentland Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260310113238.3495981-3-chaitanya.kumar.borah@intel.com commit 0d9710aeb6959ae244f255986187562fa50504b9 Author: Chaitanya Kumar Borah Date: Tue Mar 10 17:02:37 2026 +0530 drm/colorop: Preserve bypass value in duplicate_state() __drm_atomic_helper_colorop_duplicate_state() unconditionally sets state->bypass = true after copying the existing state. This override causes the new atomic state to no longer reflect the currently committed hardware state. Since the bypass property directly controls whether the colorop is active in hardware, resetting it to true can inadvertently disable an active colorop during a subsequent commit, particularly for internal driver commits where userspace does not touch the property. Drop the unconditional assignment and preserve the duplicated bypass value. Fixes: 8c5ea1745f4c ("drm/colorop: Add BYPASS property") Cc: #v6.19+ Reviewed-by: Uma Shankar Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Harry Wentland Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260310113238.3495981-2-chaitanya.kumar.borah@intel.com commit 5044a0b0307a3377dabbb0a2a653a30e388d16cc Author: Sibi Sankar Date: Fri Mar 13 16:04:39 2026 +0530 arm64: dts: qcom: glymur: Fix deprecated cpu compatibles The generic Qualcomm Oryon CPU compatible used by the Glymur SoC is deprecated and incorrect since it uses a single compatible to describe two different core variants. It is now replaced with two different core-specific compatibles based on MIDR part and variant number. CPUS 0-5: MIDR_EL1[PART_NUM] - 0x2 MIDR_EL1[VARIANT] - 0x2 CPUS 6-17: MIDR_EL1[PART_NUM] - 0x2 MIDR_EL1[VARIANT] - 0x1 Fixes: 41b6e8db400c ("arm64: dts: qcom: Introduce Glymur base dtsi") Signed-off-by: Sibi Sankar Reviewed-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260313103439.1255247-3-sibi.sankar@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 96e71f817b02caedbbaeffc916010ba68802612f Author: Sibi Sankar Date: Fri Mar 13 16:04:38 2026 +0530 dt-bindings: arm: cpus: Extend Qualcomm Oryon compatibles The generic Qualcomm Oryon CPU compatible documented in the binding doesn't account for differences between core types and has been deprecated. Introduce core-specific compatibles, by appending the compatible with MIDR part and variant numbers as listed below. qcom,oryon-MIDR_EL1[PART_NUM]-MIDR_EL1[VARIANT] Signed-off-by: Sibi Sankar Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260313103439.1255247-2-sibi.sankar@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5a679430cf1def009b5c5cb821cad46be450c149 Author: Kathiravan Thirumoorthy Date: Fri Mar 13 21:32:57 2026 +0530 soc: qcom: socinfo: add SoC ID for IPQ5210 family SoCs based on IPQ5210 is shipped under two different naming schemes namely IPQ52xx and QCF2xxx/QCF3xxx. In the later variants Passive Optical Network (PON) interface acts as the backhaul where as in the former it is ethernet backhaul. Add the SoC IDs for the same. Signed-off-by: Kathiravan Thirumoorthy Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260313-b4-ipq5210_soc_ids-v1-2-97faae3fef95@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 508e58ac65eec4e272f89e39d9b64588f7fe21cc Author: Kathiravan Thirumoorthy Date: Fri Mar 13 21:32:56 2026 +0530 dt-bindings: arm: qcom,ids: add SOC IDs for IPQ5210 family SoCs based on IPQ5210 is shipped under two different naming schemes namely IPQ52xx and QCF2xxx/QCF3xxx. In the later variants Passive Optical Network (PON) interface acts as the backhaul where as in the former it is ethernet backhaul. Document the same. Signed-off-by: Kathiravan Thirumoorthy Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260313-b4-ipq5210_soc_ids-v1-1-97faae3fef95@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3f071d00fc9478344f3231f585a5e39ceb6c63e6 Merge: 38cb89a6c924c3 42d3b66d4cdbac Author: Dave Airlie Date: Mon Mar 16 12:21:06 2026 +1000 Merge tag 'drm-xe-next-2026-03-12' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - add VM_BIND DECOMPRESS support and on-demand decompression (Nitin) - Allow per queue programming of COMMON_SLICE_CHICKEN3 bit13 (Lionel) Cross-subsystem Changes: - Introduce the DRM RAS infrastructure over generic netlink (Riana, Rodrigo) Core Changes: - Two-pass MMU interval notifiers (Thomas) Driver Changes: - Merge drm/drm-next into drm-xe-next (Brost) - Fix overflow in guc_ct_snapshot_capture (Mika, Fixes) - Extract gt_pta_entry (Gustavo) - Extra enabling patches for NVL-P (Gustavo) - Add Wa_14026578760 (Varun) - Add type-specific GT loop iterator (Roper) - Refactor xe_migrate_prepare_vm (Raag) - Don't disable GuCRC in suspend path (Vinay, Fixes) - Add missing kernel docs in xe_exec_queue.c (Niranjana) - Change TEST_VRAM to work with 32-bit resource_size_t (Wajdeczko) - Fix memory leak in xe_vm_madvise_ioctl (Varun, Fixes) - Skip access counter queue init for unsupported platforms (Himal) Signed-off-by: Dave Airlie From: Matthew Brost Link: https://patch.msgid.link/abLUVfSHu8EHRF9q@lstrano-desk.jf.intel.com commit 95b6c029e56e4d75e2957ce7ac795da29415865b Author: Daniel Lezcano Date: Tue Mar 10 00:03:33 2026 +0100 remoteproc: sysmon: Use the unified QMI service ID instead of defining it locally Instead of defining a local macro with a custom name for the QMI service identifier, use the one provided in qmi.h and remove the locally defined macro. Signed-off-by: Daniel Lezcano Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260309230346.3584252-5-daniel.lezcano@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1d1c40d67480a755a0da0f0273db3fa905060079 Merge: 38dd6ccfdfbbe8 e4ee7621d73216 Author: Bjorn Andersson Date: Sun Mar 15 21:03:24 2026 -0500 Merge branch '20260309230346.3584252-2-daniel.lezcano@oss.qualcomm.com' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into rproc-next Merge the addition of centralized QMI constants from immutable branch, to allow using them in the upcoming sysmon patch. commit 8baf6b3b7695849581a91bdaf66af2be68ef32ed Author: Daniel Lezcano Date: Tue Mar 10 00:03:37 2026 +0100 samples: qmi: Use the unified QMI service ID instead of defining it locally Instead of defining a local macro with a custom name for the QMI service identifier, use the one provided in qmi.h and remove the locally defined macro. Signed-off-by: Daniel Lezcano Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260309230346.3584252-9-daniel.lezcano@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 24f80cbe0b8f4c6b27d03c7a7ad707d76c1c4885 Author: Daniel Lezcano Date: Tue Mar 10 00:03:35 2026 +0100 soc: qcom: pdr: Use the unified QMI service ID instead of defining it locally Instead of defining a local macro with a custom name for the QMI service identifier, use the one provided in qmi.h and remove the locally defined macro. Signed-off-by: Daniel Lezcano Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260309230346.3584252-7-daniel.lezcano@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 6fc1aa70bc1bb67f22c68c990e0540d82db492bf Merge: eda32f68ce7a3d e4ee7621d73216 Author: Bjorn Andersson Date: Sun Mar 15 20:53:35 2026 -0500 Merge branch '20260309230346.3584252-2-daniel.lezcano@oss.qualcomm.com' into drivers-for-7.1 Merge the relocated constants through a topic branch, to allow this change being shared with other trees. commit e4ee7621d732162ea2ec714ae76dac2f70519417 Author: Daniel Lezcano Date: Tue Mar 10 00:03:30 2026 +0100 soc: qcom: qmi: Enumerate the service IDs of QMI The QMI framework proposes a set of services which are defined by an integer identifier. The different QMI client lookup for the services via this identifier. Moreover, the function qmi_add_lookup() and qmi_add_server() must match the service ID but the code in different places set the same value but with a different macro name. These macros are spreaded across the different subsystems implementing the protocols associated with a service. It would make more sense to define them in the QMI header for the sake of consistency and clarity. This change use an unified naming for the services and enumerate the ones implemented in the Linux kernel. More services can come later and put the service ID in this same header. Signed-off-by: Daniel Lezcano Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260309230346.3584252-2-daniel.lezcano@oss.qualcomm.com [bjorn: Lower case hex constants] Signed-off-by: Bjorn Andersson commit bdce3a69c578090dd5e3c77bcdaaca10c3a41e34 Author: Shawn Lin Date: Fri Mar 13 10:21:07 2026 +0800 scsi: ufs: rockchip,rk3576-ufshc: dt-bindings: Add new mphy reset item Add the mphy reset property to the devicetree bindings for the Rockchip RK3576 UFS host controller. The mphy reset signal is used to reset the physical adapter. Resetting other components while leaving the mphy unreset may occasionally prevent the UFS controller from successfully linking up with the device. This addresses an intermittent hardware bug where the UFS link fails to establish under specific timing conditions with certain chips. While difficult to reproduce initially, this issue was consistently observed in downstream testing and requires explicit mphy reset control for full stability. Although this change increases the maxItems for resets and adds a new entry (which technically alters the binding ABI), it does not break compatibility for existing Linux systems. The driver uses devm_reset_control_array_get_exclusive() to manage resets, allowing it to function correctly with both older Device Trees (without the mphy entry) and newer ones. Fixes: d90e92023771 ("scsi: ufs: dt-bindings: Document Rockchip UFS host controller") Signed-off-by: Shawn Lin Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/1773368467-109650-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Martin K. Petersen commit 134b898ccb68f705dff100f097886e6fe53a9566 Author: Abel Vesa Date: Wed Mar 11 15:04:04 2026 +0200 scsi: ufs: qcom: dt-bindings: Document the Eliza UFS controller Document the UFS Controller on the Eliza Platform. The IP block version here is 6.0.0, exactly the same as on SM8650. While MCQ reg range is also available on the already documented platforms, enforce only starting with Eliza. Signed-off-by: Abel Vesa Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260311-eliza-bindings-ufs-v3-1-498b26864182@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit eda32f68ce7a3d16071870c7af0803fdfae40401 Author: Unnathi Chalicheemala Date: Thu Mar 5 19:12:06 2026 -0800 soc: qcom: llcc: Use guards for mutex handling Replacing manual lock/unlock pairs with guard() removes the need to think about unlocking entirely and keeps the function trivially structured. Signed-off-by: Unnathi Chalicheemala Signed-off-by: Francisco Munoz Ruiz Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260305-external_llcc_changes1set-v1-2-6347e52e648e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 45c2a55d13c698ba6a281315676934c44225b034 Author: Unnathi Chalicheemala Date: Thu Mar 5 19:12:05 2026 -0800 soc: qcom: llcc: Add per-slice counter and common llcc slice descriptor Fix incorrect slice activation/deactivation accounting by replacing the bitmap-based activation tracking with per-slice atomic reference counters. This resolves mismatches that occur when multiple client drivers vote for the same slice or when llcc_slice_getd() is called multiple times. As part of this fix, simplify slice descriptor handling by eliminating dynamic allocation. llcc_slice_getd() now returns a pointer to a preallocated descriptor, removing the need for repeated allocation/free cycles and ensuring consistent reference tracking across all users. Signed-off-by: Unnathi Chalicheemala Signed-off-by: Francisco Munoz Ruiz Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260305-external_llcc_changes1set-v1-1-6347e52e648e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3fa036c08938d37c4bc79d125974bb87b4122ac4 Author: Aelin Reidel Date: Mon Mar 2 14:10:15 2026 +0100 soc: qcom: socinfo: Add SoC IDs for SM7450 and SM7450P SM7450 and SM7450P are two SoCs in the 'fillmore' family. Signed-off-by: Aelin Reidel Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260302-fillmore-socids-v2-2-e6c5ad167ec4@mainlining.org Signed-off-by: Bjorn Andersson commit 583157bee545e5c2da6ae094bcac7f68dbc5d265 Author: Aelin Reidel Date: Mon Mar 2 14:10:14 2026 +0100 dt-bindings: arm: qcom,ids: Add SoC IDs for SM7450 and SM7450P SM7450 and SM7450P are two SoCs of the 'fillmore' family. Signed-off-by: Aelin Reidel Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260302-fillmore-socids-v2-1-e6c5ad167ec4@mainlining.org Signed-off-by: Bjorn Andersson commit cdf0e445ee21119187f5551e68ff4e466f8aa950 Author: Vladimir Zapolskiy Date: Tue Feb 24 13:02:13 2026 +0200 soc: qcom: pd-mapper: Simplify code using of_root to get root device tree node A few lines of code are removed by using the global non-NULL of_root pointer to access the root device tree node instead of its recalculation. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260224110213.3929063-1-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit 11080cc4af8f0ee4b88d0e51384765bb78f05bf5 Author: Richard Acayan Date: Mon Feb 9 21:19:56 2026 -0500 soc: qcom: llcc: Add configuration data for SDM670 Add system cache table and configs for the SDM670 SoC. Signed-off-by: Richard Acayan Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260210021957.13357-3-mailingradian@gmail.com Signed-off-by: Bjorn Andersson commit 12cf1b5de820bc302f92221d87ae13ec1c760c84 Author: Richard Acayan Date: Mon Feb 9 21:19:55 2026 -0500 dt-bindings: cache: qcom,llcc: Add SDM670 compatible Document the Last Level Cache Controller on SDM670. Signed-off-by: Richard Acayan Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260210021957.13357-2-mailingradian@gmail.com Signed-off-by: Bjorn Andersson commit 42c4cf5d482813067789dd5ea2e33f3b7805e7e1 Author: Chris Lew Date: Tue Jan 27 16:08:46 2026 +0530 soc: qcom: smp2p: Add support for smp2p v2 smp2p v2 adds support for allowing remote processors to write outbound smp2p items without completing the feature negotiation. This is required for processors that start before linux to write out signals like error and clock ready and unblock their bootup. If a remote processor only supports v1, smp2p can version down by mirroring the peer version during the negotiation stage. When using smp2p version 2, the remote does not wait for the ssr ack before setting the items. To accommodate this, set the last_value of all the entries to 0 when SSR is detected. This forces smp2p to detect the new values written by the remote. Because the SSR ack is skipped, the down transition of bits is missed in smp2p version 2. Signed-off-by: Chris Lew Signed-off-by: Deepak Kumar Singh Link: https://lore.kernel.org/r/20260127-smp2pv2-v3-2-4060b859b1e2@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8a9a7b9d14c21d060301a8dd4a676ccb4ade5870 Author: Chris Lew Date: Tue Jan 27 16:08:45 2026 +0530 soc: qcom: smp2p: Add irqchip state support A remoteproc booted during earlier boot stages such as UEFI or the bootloader, may need to be attached to without restarting the remoteproc hardware. To do this the remoteproc will need to check the ready and handover states in smp2p without an interrupt notification. Create qcom_smp2p_start_in() to initialize the shadow state without notifying clients because these early events happened in the past. Add support for the .irq_get_irqchip_state callback so remoteproc can read the current state of the fatal, ready and handover bits. Signed-off-by: Chris Lew Signed-off-by: Deepak Kumar Singh Link: https://lore.kernel.org/r/20260127-smp2pv2-v3-1-4060b859b1e2@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8abf84f76a546c320c788cd7a8c5e3abea9b2b38 Author: Felix Gu Date: Sun Mar 8 14:59:50 2026 +0800 spi: amlogic-spisg: Use IS_ERR() instead of IS_ERR_OR_NULL() devm_clk_get_enabled() and devm_clk_hw_get_clk() return error pointers on failure and never return NULL. So IS_ERR_OR_NULL() is unnecessary, replace them with IS_ERR(). Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260308-spisg-1-v1-1-4e209faf228d@gmail.com Signed-off-by: Mark Brown commit fc1fbafc18a0352f1f23cdff3533fbd0276dd58e Author: Teguh Sobirin Date: Wed Mar 11 12:41:20 2026 -0500 ASoC: codecs: aw88166: Support device specific firmware This driver currently loads firmware from a hardcoded path. Support loading device specific firmware when provided by the boot firmware. Signed-off-by: Teguh Sobirin Co-developed-by: Aaron Kling Signed-off-by: Aaron Kling Link: https://patch.msgid.link/20260311-aw88166-fw-v2-1-8ef30dae3657@gmail.com Signed-off-by: Mark Brown commit 706d2dc0269e695979943f27b03389007e034db7 Merge: 3e9cda2f4a33c6 af176d0787d219 Author: Mark Brown Date: Mon Mar 16 01:13:07 2026 +0000 ASoC: basic support for configuring bus keepers James Calligeros says: This series introduces some infrastructure to allow platform drivers to specify what a DAI should be doing when it is not active on the bus. The primary use case for this is configuring bus keepers which may be integrated into various codecs. The instigating use case for this functionality is an interesting bus topology on Apple Silicon laptops with multiple codecs. Most Apple Silicon laptops have six codecs split into groups of three, driving a pair of dual opposed woofers and a tweeter for L/R stereo sound. These codecs report the voltage and current across their connected voice coils back to the SoC via the SDOUT pin, represented as PCM data sent via configurable TDM slots. This data is used in conjunction with the connected speaker's Thiele/Small Parameters to ensure that the speaker is not being driven to levels that would permanently damage them. This is integrated into CoreAudio on macOS. speakersafetyd[1] handles this for Linux. All of the codec SDOUT pins are attached to a single receiver port on the SoC's I2S peripheral, however are split across two physical data lines (one each for the left and right codec groups). The receiver has an OR gate in front of it, which is used to sum the two lines. If at any point a codec is trying to transmit data, and the "opposite" line ends up floating high, the transmitting codec's data will be corrupted. We need to guarantee that the idle line stays idle. In the downstream Asahi Linux kernel[2], we set up one codec in each group to zero-fill or pull down its line while a codec on the opposite line is actively transmitting. This is done entirely in the codec driver, however this approach is over-fit for this one use case. This sort of functionality may also be of use for other hardware, so following previous mailing list discussions[3], I have tried to expose the functionality in a more configurable and generic way. I have integrated this approach into our downstream platform driver and select Devicetrees as an example of how this mechanism is intended to be used[4]. [1] https://github.com/AsahiLinux/speakersafetyd [2] https://github.com/AsahiLinux/linux/tree/bits/070-audio [3] https://lore.kernel.org/asahi/20250227-apple-codec-changes-v3-17-cbb130030acf@gmail.com/ [4] https://github.com/chadmed/tree/tdm-revised2 Link: https://patch.msgid.link/20260301-tdm-idle-slots-v3-0-c6ac5351489a@gmail.com commit af176d0787d219d9e07272988079ebb9be8efe6a Author: James Calligeros Date: Sun Mar 1 18:05:26 2026 +1000 ASoC: tas2770: expose SDOUT bus keeper via set_tdm_idle TAS2770 includes a bus keeper which can be used to control the behaviour of the SDOUT pin during specified TDM slots. The chip can either pull the pin to ground, actively transmit zeroes, or keep the pin floating (default/uninitialised behaviour). Expose the bus keeper via the set_tdm_idle DAI op so that it can be configured by consumers. Signed-off-by: James Calligeros Link: https://patch.msgid.link/20260301-tdm-idle-slots-v3-7-c6ac5351489a@gmail.com Signed-off-by: Mark Brown commit 45573ee1f2badd1886eb6f4a736e60e3f76effe6 Author: James Calligeros Date: Sun Mar 1 18:05:25 2026 +1000 ASoC: tas2764: expose SDOUT bus keeper via set_tdm_idle operation TAS2764, and the Apple-exclusive variant SN012776, include bus keepers on the SDOUT pin that can be configured to alter the behaviour of the SDOUT pin during specified TDM slots. The chip can either leave the bus floating (default/uninitialised behaviour) or fill the specified slots with zeroes. Expose the SDOUT bus keeper and allow it to be configured using the set_tdm_idle DAI op. The mask must be cropped to only cover slots valid for the configured BCLK ratio, so introduce a set_bclk_ratio op that properly configures this. Signed-off-by: James Calligeros Link: https://patch.msgid.link/20260301-tdm-idle-slots-v3-6-c6ac5351489a@gmail.com Signed-off-by: Mark Brown commit b758d3574e88537f9089bd757a51b35cf9675179 Author: James Calligeros Date: Sun Mar 1 18:05:24 2026 +1000 ASoC: soc-dai: add common operation to set TDM idle mode Some audio devices, like certain Texas Instruments codecs, integrate configurable bus keepers that dictate the codec's behaviour during idle TDM slots. Now that we have definitions for various idle modes, add a snd_soc_dai_set_tdm_idle() operation to control this in a standardised way. This is useful on Apple Silicon laptops, where a single I2S bus is comprised of two physical lines which are ORed just before the receiving port. When a codec on one line is transmitting, we must guarantee that the other line is low. We can achieve this by configuring one codec on each line to use its bus keeper to fill its line with zeroes during the active slots of the other line. Signed-off-by: James Calligeros Link: https://patch.msgid.link/20260301-tdm-idle-slots-v3-5-c6ac5351489a@gmail.com Signed-off-by: Mark Brown commit 7d8632f1ef6c8ed0b53771c16f130f18d636931e Author: James Calligeros Date: Sun Mar 1 18:05:23 2026 +1000 ASoC: soc-dai: define possible idle TDM slot modes Some audio devices, such as certain Texas Instruments codecs, include configurable bus keepers. We currently don't have a standardised way to configure such hardware, and instead rely on the hardware initialising setting itself up into a sane state. There are situations where this is insufficient, however, and some platforms require more concrete guarantees as to the state of the bus, and being able to explicitly configure bus keepers enables this. For example, some Apple Silicon machines have an odd bus topology where the SDOUT pins of all codecs are split across two data lines, which are summed via an OR gate in front of the receiving port on the SoC's I2S peripheral. Each line must transmit 0 while a codec on the other line is actively transmitting data, or the SoC will receive garbage data. To do this, one codec on each line must be configured to transmit zeroes during the other line's active TDM slots. Thus, we define seven possible bus-keeping modes that a device can be in: NONE (UB/as initialised), OFF (explicitly disabled), ZERO (actively transmit a 0), PULLDOWN, HIZ (floating), PULLUP, and DRIVE_HIGH. These will be consumed by CODEC/CPU drivers via a common DAI op, enabling the explicit configuration of bus keepers where required. Signed-off-by: James Calligeros Link: https://patch.msgid.link/20260301-tdm-idle-slots-v3-4-c6ac5351489a@gmail.com Signed-off-by: Mark Brown commit 938c1ed56ab888b0715a8c7070dbb4e276c2d3fe Author: James Calligeros Date: Sun Mar 1 18:05:22 2026 +1000 ASoC: dt-bindings: add TDM slot idle mode properties Add properties to describe TDM slot idle behaviour. These properties can be used to describe how a DAI is supposed to behave when not active. For example, Apple Silicon laptops split a single I2S bus between two physical lines which are combined at an OR gate in front of the receiving port. One codec on each line is expected to transmit zeroes during the active TDM slots of the opposite line, or we will have corrupted data at the receiver. Signed-off-by: James Calligeros Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260301-tdm-idle-slots-v3-3-c6ac5351489a@gmail.com Signed-off-by: Mark Brown commit cc74890fb484a73420e46fc7be7bff8d02a82699 Author: James Calligeros Date: Sun Mar 1 18:05:21 2026 +1000 ASoC: dt-bindings: update tdm-slot.txt references to tdm-slot.yaml Ensure that all references to tdm-slot.txt have been updated to tdm-slot.yaml, and are schema-compliant. Signed-off-by: James Calligeros Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260301-tdm-idle-slots-v3-2-c6ac5351489a@gmail.com Signed-off-by: Mark Brown commit 5273cb8197d8eea1ab83ae3227a8c2db94177195 Author: James Calligeros Date: Sun Mar 1 18:05:20 2026 +1000 ASoC: dt-bindings: convert tdm-slot to YAML This schema was still in plaintext form. Convert to YAML format. Signed-off-by: James Calligeros Link: https://patch.msgid.link/20260301-tdm-idle-slots-v3-1-c6ac5351489a@gmail.com Signed-off-by: Mark Brown commit 3e9cda2f4a33c6becc99f8a78946cbd02983852f Merge: 5e2f19ce90d560 c43988dfe25ba3 Author: Mark Brown Date: Mon Mar 16 01:11:23 2026 +0000 ASoC: amd: Move to GPIO descriptors Linus Walleij says: After a quick look and test-compile I can determine that all of these drivers include for no reason whatsoever, so fixing it is low hanging fruit. Link: https://patch.msgid.link/20260314-asoc-amd-v1-0-31afed06e022@kernel.org commit c43988dfe25ba358b1df72201327ca719e8a369d Author: Linus Walleij Date: Sat Mar 14 21:06:24 2026 +0100 ASoC: amd: acp3x-rt5682-max9836: Drop unused include This driver includes the legacy header but does not use any symbols from it. Drop the inclusion. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260314-asoc-amd-v1-5-31afed06e022@kernel.org Signed-off-by: Mark Brown commit 70f0a90e718d6163543a3f7eb4f7cb582f85ae47 Author: Linus Walleij Date: Sat Mar 14 21:06:23 2026 +0100 ASoC: amd: acp3x-es83x: Drop unused include This driver includes the legacy header but does not use any symbols from it. Drop the inclusion. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260314-asoc-amd-v1-4-31afed06e022@kernel.org Signed-off-by: Mark Brown commit d63b722361b8dff3d8bbc0f5f324367420f19f0b Author: Linus Walleij Date: Sat Mar 14 21:06:22 2026 +0100 ASoC: amd: acp-rt5645: Drop unused include This driver includes the legacy header but does not use any symbols from it. Drop the inclusion. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260314-asoc-amd-v1-3-31afed06e022@kernel.org Signed-off-by: Mark Brown commit 0a80eff3f53ce6fb0c75187b34a0c145c4c7167d Author: Linus Walleij Date: Sat Mar 14 21:06:21 2026 +0100 ASoC: amd: acp-es8336: Drop unused include This driver includes the legacy header but does not use any symbols from it. Drop the inclusion. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260314-asoc-amd-v1-2-31afed06e022@kernel.org Signed-off-by: Mark Brown commit 6d841b46ec05e31d21827821ce748ff168cbd4ee Author: Linus Walleij Date: Sat Mar 14 21:06:20 2026 +0100 ASoC: amd: acp-da7291-max98357a: Drop unused include This driver includes the legacy header but does not use any symbols from it. Drop the inclusion. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260314-asoc-amd-v1-1-31afed06e022@kernel.org Signed-off-by: Mark Brown commit 5e2f19ce90d5601f4250b510ed2f41160e5692e9 Author: Charles Keepax Date: Fri Mar 13 16:08:58 2026 +0000 ASoC: sdw_utils: Add codec_info for cs42l49 The cs42l49 is an audio codec with integrated MIPI SoundWire interface (Version 1.2.1 compliant) with SDCA v1.0 support, I2C, and I2S/TDM interfaces designed for portable applications. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260313160858.2022849-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 7699b12a32b99437dc270cc7ee603b608860679f Author: Charles Keepax Date: Fri Mar 13 16:08:57 2026 +0000 ASoC: SDCA: Add support for the Cirrus Logic cs42l49 The cs42l49 is an audio codec with integrated MIPI SoundWire interface (Version 1.2.1 compliant) with SDCA v1.0 support, I2C, and I2S/TDM interfaces designed for portable applications. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260313160858.2022849-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 38cb89a6c924c35d7d17ed13ccd3952c82b4e0d1 Merge: d9a4a2021d4a5c 06249b4e691a75 Author: Dave Airlie Date: Mon Mar 16 09:10:13 2026 +1000 Merge tag 'drm-intel-gt-next-2026-03-12' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Driver Changes: Fixes/improvements/new stuff: - Fix potential overflow of shmem scatterlist length (Janusz Krzysztofik) Miscellaneous: - Keep mock file open during unfaultable migrate with fill [selftests] (Krzysztof Karas) - Test for imported buffers with drm_gem_is_imported() (Thomas Zimmermann) - Fix corrupted copyright symbols in selftest files [guc] (Konstantin Khorenko) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patch.msgid.link/abKBHNFsBQCv2h3e@linux commit 76bce7ac51673640a4a46236ea723cf5543268d7 Merge: a544873ce0575b f338e77383789c Author: Danilo Krummrich Date: Sun Mar 15 21:55:47 2026 +0100 Merge tag 'v7.0-rc4' into drm-rust-next We need the latest fixes from drm-rust-fixes in drm-rust-next as well to build on top of. Signed-off-by: Danilo Krummrich commit 79e25710e7227228902d672417b552dd1d7e5d3b Author: Shankari Anand Date: Sat Jan 3 01:57:14 2026 +0530 rust: types: remove temporary re-exports of ARef and AlwaysRefCounted Remove the temporary re-exports of `ARef` and `AlwaysRefCounted` from `types.rs` now that all in-tree users have been updated to import them directly from `sync::aref`. These re-exports were originally added to avoid breaking the kernel build during the transition period while call sites were incrementally migrated. With all users updated, they are no longer needed. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Link: https://patch.msgid.link/20260102202714.184223-5-shankari.ak0208@gmail.com Signed-off-by: Miguel Ojeda commit ebbed9d02ece592c3e693db72197afad8de70af8 Author: Shankari Anand Date: Sat Jan 3 01:57:13 2026 +0530 rust: usb: Update AlwaysRefCounted imports to use sync::aref Update call sites in `usb.rs` to import `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Link: https://patch.msgid.link/20260102202714.184223-4-shankari.ak0208@gmail.com [ Rebase. - Miguel ] Signed-off-by: Miguel Ojeda commit dfce283387274446ef5755de7c59baad1da0b93e Author: Shankari Anand Date: Sat Jan 3 01:57:12 2026 +0530 rust: i2c: Update ARef and AlwaysRefCounted imports to use sync::aref Update call sites in `i2c.rs` to import `ARef` and `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Acked-by: Igor Korotin Link: https://patch.msgid.link/20260102202714.184223-3-shankari.ak0208@gmail.com [ Move `ARef` import into the `kernel` `use` tree above. - Miguel ] Signed-off-by: Miguel Ojeda commit 1353b8f32c49235d5c66bad3e197025c26d1684e Author: Tamir Duberstein Date: Mon Mar 9 13:01:57 2026 -0400 rust: str: update `c_str!` documentation Now that all literals are C-Strings, update the documentation to explain that use of this macro should be limited to non-literal strings. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Signed-off-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260309-cstr-rename-macro-v2-1-25f7de75944e@kernel.org [ Apply sentence case to comment. Reword title. - Miguel ] Signed-off-by: Miguel Ojeda commit ef4ca3d4bf09716cff9ba00eb0351deadc8417ab Author: Yu Kuai Date: Mon Feb 23 10:40:35 2026 +0800 md/md-llbitmap: raise barrier before state machine transition Move the barrier raise operation before calling llbitmap_state_machine() in both llbitmap_start_write() and llbitmap_start_discard(). This ensures the barrier is in place before any state transitions occur, preventing potential race conditions where the state machine could complete before the barrier is properly raised. Cc: stable@vger.kernel.org Fixes: 5ab829f1971d ("md/md-llbitmap: introduce new lockless bitmap") Link: https://lore.kernel.org/linux-raid/20260223024038.3084853-3-yukuai@fnnas.com Signed-off-by: Yu Kuai commit 7701e68b5072faa03a8f30b4081dc16df9092381 Author: Yu Kuai Date: Mon Feb 23 10:40:34 2026 +0800 md/md-llbitmap: skip reading rdevs that are not in_sync When reading bitmap pages from member disks, the code iterates through all rdevs and attempts to read from the first available one. However, it only checks for raid_disk assignment and Faulty flag, missing the In_sync flag check. This can cause bitmap data to be read from spare disks that are still being rebuilt and don't have valid bitmap information yet. Reading stale or uninitialized bitmap data from such disks can lead to incorrect dirty bit tracking, potentially causing data corruption during recovery or normal operation. Add the In_sync flag check to ensure bitmap pages are only read from fully synchronized member disks that have valid bitmap data. Cc: stable@vger.kernel.org Fixes: 5ab829f1971d ("md/md-llbitmap: introduce new lockless bitmap") Link: https://lore.kernel.org/linux-raid/20260223024038.3084853-2-yukuai@fnnas.com Signed-off-by: Yu Kuai commit d51e1668fad6d7d34feea5735264929aabb95975 Author: Yu Kuai Date: Mon Feb 23 11:58:34 2026 +0800 md/raid5: set chunk_sectors to enable full stripe I/O splitting Set chunk_sectors to the full stripe width (io_opt) so that the block layer splits I/O at full stripe boundaries. This ensures that large writes are aligned to full stripes, avoiding the read-modify-write overhead that occurs with partial stripe writes in RAID-5/6. When chunk_sectors is set, the block layer's bio splitting logic in get_max_io_size() uses blk_boundary_sectors_left() to limit I/O size to the boundary. This naturally aligns split bios to full stripe boundaries, enabling more efficient full stripe writes. Test results with 24-disk RAID5 (chunk_size=64k): dd if=/dev/zero of=/dev/md0 bs=10M oflag=direct Before: 461 MB/s After: 520 MB/s (+12.8%) Link: https://lore.kernel.org/linux-raid/20260223035834.3132498-1-yukuai@fnnas.com Suggested-by: Christoph Hellwig Reviewed-by: Paul Menzel Reviewed-by: Christoph Hellwig Signed-off-by: Yu Kuai commit 7d96f3120a7fb7210d21b520c5b6f495da6ba436 Author: Josh Hunt Date: Mon Mar 2 19:56:19 2026 -0500 md/raid10: fix deadlock with check operation and nowait requests When an array check is running it will raise the barrier at which point normal requests will become blocked and increment the nr_pending value to signal there is work pending inside of wait_barrier(). NOWAIT requests do not block and so will return immediately with an error, and additionally do not increment nr_pending in wait_barrier(). Upstream change commit 43806c3d5b9b ("raid10: cleanup memleak at raid10_make_request") added a call to raid_end_bio_io() to fix a memory leak when NOWAIT requests hit this condition. raid_end_bio_io() eventually calls allow_barrier() and it will unconditionally do an atomic_dec_and_test(&conf->nr_pending) even though the corresponding increment on nr_pending didn't happen in the NOWAIT case. This can be easily seen by starting a check operation while an application is doing nowait IO on the same array. This results in a deadlocked state due to nr_pending value underflowing and so the md resync thread gets stuck waiting for nr_pending to == 0. Output of r10conf state of the array when we hit this condition: crash> struct r10conf barrier = 1, nr_pending = { counter = -41 }, nr_waiting = 15, nr_queued = 0, Example of md_sync thread stuck waiting on raise_barrier() and other requests stuck in wait_barrier(): md1_resync [<0>] raise_barrier+0xce/0x1c0 [<0>] raid10_sync_request+0x1ca/0x1ed0 [<0>] md_do_sync+0x779/0x1110 [<0>] md_thread+0x90/0x160 [<0>] kthread+0xbe/0xf0 [<0>] ret_from_fork+0x34/0x50 [<0>] ret_from_fork_asm+0x1a/0x30 kworker/u1040:2+flush-253:4 [<0>] wait_barrier+0x1de/0x220 [<0>] regular_request_wait+0x30/0x180 [<0>] raid10_make_request+0x261/0x1000 [<0>] md_handle_request+0x13b/0x230 [<0>] __submit_bio+0x107/0x1f0 [<0>] submit_bio_noacct_nocheck+0x16f/0x390 [<0>] ext4_io_submit+0x24/0x40 [<0>] ext4_do_writepages+0x254/0xc80 [<0>] ext4_writepages+0x84/0x120 [<0>] do_writepages+0x7a/0x260 [<0>] __writeback_single_inode+0x3d/0x300 [<0>] writeback_sb_inodes+0x1dd/0x470 [<0>] __writeback_inodes_wb+0x4c/0xe0 [<0>] wb_writeback+0x18b/0x2d0 [<0>] wb_workfn+0x2a1/0x400 [<0>] process_one_work+0x149/0x330 [<0>] worker_thread+0x2d2/0x410 [<0>] kthread+0xbe/0xf0 [<0>] ret_from_fork+0x34/0x50 [<0>] ret_from_fork_asm+0x1a/0x30 Fixes: 43806c3d5b9b ("raid10: cleanup memleak at raid10_make_request") Cc: stable@vger.kernel.org Signed-off-by: Josh Hunt Link: https://lore.kernel.org/linux-raid/20260303005619.1352958-1-johunt@akamai.com Signed-off-by: Yu Kuai commit eff0d74c6c8fd358bc9474c05002e51fa5aa56ad Author: Chen Cheng Date: Tue Feb 10 21:38:47 2026 +0800 md: suppress spurious superblock update error message for dm-raid dm-raid has external metadata management (mddev->external = 1) and no persistent superblock (mddev->persistent = 0). For these arrays, there's no superblock to update, so the error message is spurious. The error appears as: md_update_sb: can't update sb for read-only array md0 Fixes: 8c9e376b9d1a ("md: warn about updating super block failure") Reported-by: Tj Closes: https://lore.kernel.org/all/20260128082430.96788-1-tj.iam.tj@proton.me/ Signed-off-by: Chen Cheng Reviewed-by: Paul Menzel Link: https://lore.kernel.org/linux-raid/20260210133847.269986-1-chencheng@fnnas.com Signed-off-by: Yu Kuai commit e022f0c72c7f67fe79de03e71d839418073490a5 Author: Niklas Cassel Date: Thu Mar 12 14:02:38 2026 +0100 selftests: pci_endpoint: Skip reserved BARs Running a test against a reserved BAR will result in the pci-epf-test driver returning -ENOBUFS. Make sure that the pci_endpoint_test selftest will return skip instead of failure or success for reserved BARs. Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Tested-by: Manikanta Maddireddy Tested-by: Koichiro Den Reviewed-by: Manikanta Maddireddy Reviewed-by: Frank Li Link: https://patch.msgid.link/20260312130229.2282001-22-cassel@kernel.org commit c3f33af67e6458f4e49d016429d7aeef3c8b8399 Author: Niklas Cassel Date: Thu Mar 12 14:02:37 2026 +0100 misc: pci_endpoint_test: Give reserved BARs a distinct error code Give reserved BARs a distinct error code, such that the pci_endpoint_test selftest will be able to skip test cases that are run against reserved BARs. Signed-off-by: Niklas Cassel [mani: Used __fls(CAP_BAR0_RESERVED) instead of PCI_ENDPOINT_CAP_BAR0_RESERVED_BIT] Signed-off-by: Manivannan Sadhasivam Tested-by: Manikanta Maddireddy Tested-by: Koichiro Den Reviewed-by: Frank Li Link: https://patch.msgid.link/20260312130229.2282001-21-cassel@kernel.org commit 50a1fd6e5ee3fd93e1a5a49fb9c76ca44ac13b8b Author: Niklas Cassel Date: Thu Mar 12 14:02:36 2026 +0100 PCI: endpoint: pci-epf-test: Advertise reserved BARs Advertise reserved BARs as reserved in the Capabilities register, such that the host side driver will be able to skip reserved BARs. Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Tested-by: Koichiro Den Tested-by: Manikanta Maddireddy Reviewed-by: Manikanta Maddireddy Reviewed-by: Frank Li Link: https://patch.msgid.link/20260312130229.2282001-20-cassel@kernel.org commit 0f08179c8c29bc5ab23906d2ab5409d98a4ca110 Author: Niklas Cassel Date: Thu Mar 12 14:02:35 2026 +0100 PCI: dwc: Disable BARs in common code instead of in each glue driver The current EPC core design relies on an EPC driver disabling all BARs by default. An EPF driver will then enable the BARs that it wants to enabled. This design is there because there is no epc->ops->disable_bar(). (There is a epc->ops->clear_bar(), but that is only to disable a BAR that has been enabled using epc->ops->set_bar() first.) By default, an EPF driver will not be able to get/enable BARs that are marked as BAR_RESERVED or BAR_DISABLED (see pci_epc_get_next_free_bar()). Since the current EPC code design requires an EPC driver to disable all BARs by default, move this to DWC common code from each glue driver. BAR_RESERVED BARs are not disabled by default because these BARs are hardware backed, and should only be disabled explicitly by an EPF driver if absolutely necessary for the EPF driver to function correctly. (This is similar to how e.g. NVMe may have vendor specific BARs outside of the mandatory BAR0 which contains the NVMe registers.) Note that there is currently no EPC operation to disable a BAR that has not first been programmed using pci_epc_set_bar(). If an EPF driver ever wants to disable a BAR marked as BAR_RESERVED, a disable_bar() operation would have to be added first. No functional changes intended. Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Tested-by: Manikanta Maddireddy Tested-by: Koichiro Den Reviewed-by: Manikanta Maddireddy Reviewed-by: Frank Li Link: https://patch.msgid.link/20260312130229.2282001-19-cassel@kernel.org commit 5a95fecbdd4216d0451c9e7e332ffd0b6e239f0e Author: Niklas Cassel Date: Thu Mar 12 14:02:34 2026 +0100 PCI: dwc: Replace certain BAR_RESERVED with BAR_DISABLED in glue drivers Most DWC based EPC glue drivers that have BARs marked as BAR_RESERVED in epc_features also call dw_pcie_ep_reset_bar() for these reserved BARs in ep->ops->init(). (The only exception is pci-keystone.c.) An EPF driver will be able to get/enable BARs that have been disabled/reset using dw_pcie_ep_reset_bar(), except if the BAR is marked as BAR_RESERVED (see pci_epc_get_next_free_bar()). Thus, all EPC drivers that have BARs marked as BAR_RESERVED in epc_features and call dw_pcie_ep_reset_bar(), should really have these BARs marked as BAR_DISABLED. If dw_pcie_ep_reset_bar() is not called by the glue driver, the BARs are kept as BAR_RESERVED. No EPC drivers outside drivers/pci/controllers/dwc mark their BARs as BAR_RESERVED, so there is nothing to do in non-DWC based EPC drivers. Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Tested-by: Manikanta Maddireddy Tested-by: Koichiro Den Reviewed-by: Frank Li Link: https://patch.msgid.link/20260312130229.2282001-18-cassel@kernel.org commit 33642e9e36dc084e4fc9245a266c9843bc8303b9 Author: Niklas Cassel Date: Thu Mar 12 14:02:33 2026 +0100 PCI: endpoint: Introduce pci_epc_bar_type BAR_DISABLED Add a pci_epc_bar_type BAR_DISABLED to more clearly differentiate from BAR_RESERVED. This BAR type will only be used to describe a BAR that the EPC driver should disable, and will thus never be available to an EPF driver. (Unlike BAR_RESERVED, which will never be disabled by default by an EPC driver.) Co-developed-by: Manikanta Maddireddy Signed-off-by: Manikanta Maddireddy Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Tested-by: Koichiro Den Tested-by: Manikanta Maddireddy Reviewed-by: Frank Li Reviewed-by: Manikanta Maddireddy Link: https://patch.msgid.link/20260312130229.2282001-17-cassel@kernel.org commit 489d3abb4117bdf4af8296c69f09493e21b70c28 Author: Koichiro Den Date: Thu Mar 12 14:02:32 2026 +0100 PCI: dw-rockchip: Describe RK3588 BAR4 DMA ctrl window On RK3588 PCIe3_4L in EP mode, the integrated DMA controller registers are permanently mapped to BAR4 and must not be repurposed by EPF drivers. When the remote peer needs to access these registers, it must use the fixed BAR4 window instead of creating another inbound mapping in a different BAR. Mixing the fixed window with an additional mapping can lead to incorrect behavior. Advertise the DMA controller MMIO window as a reserved BAR subregion so EPF drivers can reuse it safely. Signed-off-by: Koichiro Den Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Tested-by: Koichiro Den Reviewed-by: Manikanta Maddireddy Reviewed-by: Frank Li Link: https://patch.msgid.link/20260312130229.2282001-16-cassel@kernel.org commit f51644eb40a73677fcd0c92d8174eddde5d0be0e Author: Koichiro Den Date: Thu Mar 12 14:02:31 2026 +0100 PCI: endpoint: Describe reserved subregions within BARs Some endpoint controllers expose platform-owned, fixed register windows within a BAR that EPF drivers must not reprogram (e.g. a BAR marked BAR_RESERVED). Even in that case, EPF drivers may need to reference a well-defined subset of that BAR, e.g. to reuse an integrated DMA controller MMIO window as a doorbell target. Introduce struct pci_epc_bar_rsvd_region and extend struct pci_epc_bar_desc so EPC drivers can advertise such fixed subregions in a controller-agnostic way. No functional change for existing users. Signed-off-by: Koichiro Den Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Tested-by: Manikanta Maddireddy Tested-by: Koichiro Den Reviewed-by: Frank Li Link: https://patch.msgid.link/20260312130229.2282001-15-cassel@kernel.org commit 27ce1d8ecb9b9ae025b9e9e199845624bc950998 Author: Manikanta Maddireddy Date: Thu Mar 12 14:02:30 2026 +0100 PCI: endpoint: Allow only_64bit on BAR_RESERVED Remove the documentation that forbids setting only_64bit on a BAR of type BAR_RESERVED. When a reserved BAR is 64-bit by default, setting only_64bit is the most accurate description. If we later add support to disable a reserved BAR (e.g. disable_bar() for BARs that were never set via set_bar()), the implementation will need to clear the adjacent BAR (upper 32 bits) as well; having only_64bit set documents that requirement. Signed-off-by: Manikanta Maddireddy Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260312130229.2282001-14-cassel@kernel.org commit 0834d6f4abd0ca35b5706d267a6e4b78303a95de Author: Niklas Cassel Date: Thu Mar 12 14:02:29 2026 +0100 PCI: endpoint: Do not mark the BAR succeeding a 64-bit BAR as BAR_RESERVED A BAR that can only be configured as a 64-bit BAR by an EPC driver is marked as such using the "only_64bit" flag. Currently, the documentation says that an EPC driver should explicitly mark the BAR succeeding an "only_64bit" BAR as BAR_RESERVED. However, a 64-bit BAR will always take up two BARs. It is thus redundant to mark both BARs. pci_epc_get_next_free_bar() already skips the BAR succeeding a "only_64bit" BAR, regardless if the succeeding BAR is marked as BAR_RESERVED or not. Thus, drop the BAR_RESERVED for a BAR succeeding a "only_64bit" BAR. No functional changes. Suggested-by: Manivannan Sadhasivam Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260312130229.2282001-13-cassel@kernel.org commit 8197ec49a2062185f6bd432a19969ce0b3752e94 Author: John Madieu Date: Fri Mar 6 15:34:19 2026 +0100 PCI: rzg3s-host: Add support for RZ/G3E PCIe controller Add support for the PCIe controller found in RZ/G3E SoCs to the existing RZ/G3S PCIe host controller driver. The RZ/G3E PCIe controller is similar to the RZ/G3S, with the following key differences: - Supports PCIe Gen3 (8.0 GT/s) link speeds alongside Gen2 (5.0 GT/s) - Uses a different reset control mechanism via AXI registers instead of the Linux reset framework - Requires specific SYSC configuration for link state control and Root Complex mode selection Signed-off-by: John Madieu [mani: added a readl_relaxed() before fsleep() to flush previous write] Signed-off-by: Manivannan Sadhasivam Tested-by: Lad Prabhakar # RZ/V2N EVK Tested-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260306143423.19562-13-john.madieu.xa@bp.renesas.com commit 5e9a5af5c9a2797a5e41e8ee565ce8108588f956 Author: John Madieu Date: Fri Mar 6 15:34:18 2026 +0100 PCI: rzg3s-host: Add PCIe Gen3 (8.0 GT/s) link speed support Extend the link speed configuration to support Gen3 (8.0 GT/s) in addition to Gen2 (5.0 GT/s). This is required for RZ/G3E PCIe host support, which is Gen3 capable. Instead of relying on DT max-link-speed for configuration, read the hardware capabilities from the PCI_EXP_LNKCAP register to determine the maximum supported speed. The DT max-link-speed property is now only used as an optional limit when explicitly specified, which aligns with PCIe subsystem expectations. Signed-off-by: John Madieu Signed-off-by: Manivannan Sadhasivam Tested-by: Lad Prabhakar # RZ/V2N EVK Tested-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260306143423.19562-12-john.madieu.xa@bp.renesas.com commit 1e75d2e9a0e018b53f06dcc2e9345ac10f1aa174 Author: John Madieu Date: Fri Mar 6 15:34:17 2026 +0100 PCI: rzg3s-host: Explicitly set class code for RZ/G3E compatibility Program the class code register explicitly during PCIe configuration initialization. RZ/G3E requires this register to be set, while RZ/G3S has these values as hardware defaults. This configuration is harmless for RZ/G3S where these match the hardware defaults, and necessary for RZ/G3E to properly identify the device as a PCI bridge. Signed-off-by: John Madieu Signed-off-by: Manivannan Sadhasivam Tested-by: Lad Prabhakar # RZ/V2N EVK Tested-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260306143423.19562-11-john.madieu.xa@bp.renesas.com commit 5f2c4de717786150f8d6cdbdbffb986cd3c59edb Author: John Madieu Date: Fri Mar 6 15:34:16 2026 +0100 PCI: rzg3s-host: Add SoC-specific configuration and initialization callbacks Add optional cfg_pre_init, cfg_post_init, and cfg_deinit callbacks to handle SoC-specific configuration methods. While RZ/G3S uses the Linux reset framework with dedicated reset lines, other SoC variants like RZ/G3E control configuration resets through PCIe AXI registers. As Linux reset bulk API gracefully handles optional NULL reset lines (num_cfg_resets = 0 for RZ/G3E), the driver continues to use the standard reset framework when reset lines are available, while custom callbacks are only invoked when provided. This provides a balanced pattern where: - RZ/G3S: Uses callbacks that fall back to the reset framework - RZ/G3E: Sets num_cfg_resets=0, provides cfg_pre_init/cfg_post_init/cfg_deinit Signed-off-by: John Madieu Signed-off-by: Manivannan Sadhasivam Tested-by: Lad Prabhakar # RZ/V2N EVK Tested-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260306143423.19562-10-john.madieu.xa@bp.renesas.com commit 4ec4ccdaace40397638c305c0a36b423d2142a93 Author: John Madieu Date: Fri Mar 6 15:34:15 2026 +0100 PCI: rzg3s-host: Make configuration reset lines optional Some SoC variants such as RZ/G3E handle configuration reset control through PCIe AXI registers instead of dedicated reset lines. Make cfg_resets optional by using devm_reset_control_bulk_get_optional_exclusive() to allow SoCs to use alternative or complementary reset control mechanisms. Signed-off-by: John Madieu Signed-off-by: Manivannan Sadhasivam Tested-by: Lad Prabhakar # RZ/V2N EVK Tested-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260306143423.19562-9-john.madieu.xa@bp.renesas.com commit 346dd3422ed9ff56f033726a50fad2da5677eb12 Author: John Madieu Date: Fri Mar 6 15:34:14 2026 +0100 PCI: rzg3s-host: Make SYSC register offsets SoC-specific In preparation for adding RZ/G3E support, move the RST_RSM_B register offset and mask into a SoC-specific data structure. Compared with RZ/G3S, the RZ/G3E SYSC controls different functionalities for the PCIe controller. Make SYSC operations conditional on the presence of register offset information, allowing the driver to handle SoCs that don't use the RST_RSM_B signal. Signed-off-by: John Madieu Signed-off-by: Manivannan Sadhasivam Tested-by: Lad Prabhakar # RZ/V2N EVK Tested-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260306143423.19562-8-john.madieu.xa@bp.renesas.com commit fabce18494e5a4f388c70a40fa8351c911790d8d Author: John Madieu Date: Fri Mar 6 15:34:13 2026 +0100 dt-bindings: PCI: renesas,r9a08g045s33-pcie: Document RZ/G3E SoC Extend the existing device tree bindings for Renesas RZ/G3S PCIe controller to include support for the RZ/G3E (renesas,r9a09g047e57-pcie) PCIe controller. The RZ/G3E PCIe controller is similar to RZ/G3S but has some key differences: - Uses a different device ID - Supports PCIe Gen3 (8.0 GT/s) link speeds - Uses a different clock naming (clkpmu vs clkl1pm) - Has a different set of interrupts, interrupt ordering, and reset signals Add device tree bindings for renesas,r9a09g047e57-pcie compatible IPs. Signed-off-by: John Madieu Signed-off-by: Manivannan Sadhasivam Tested-by: Lad Prabhakar # RZ/V2N EVK Tested-by: Claudiu Beznea Reviewed-by: Rob Herring (Arm) Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260306143423.19562-7-john.madieu.xa@bp.renesas.com commit bb1b0f47f6822864c1689f46348efa42c5d4074c Author: John Madieu Date: Fri Mar 6 15:34:12 2026 +0100 dt-bindings: PCI: renesas,r9a08g045s33-pcie: Fix naming properties Fix a typo in interrupt-names: "ser_cor" should be "serr_cor" (System Error Correctable). Also convert interrupt-names, clock-names, and reset-names properties from "description" to "const" to enable proper validation with dtbs_check. Fixes: e7534e790557 ("dt-bindings: PCI: Add Renesas RZ/G3S PCIe controller binding") Signed-off-by: John Madieu Signed-off-by: Manivannan Sadhasivam Tested-by: Lad Prabhakar # RZ/V2N EVK Tested-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Acked-by: Conor Dooley Link: https://patch.msgid.link/20260306143423.19562-6-john.madieu.xa@bp.renesas.com commit d17a200a747b01e05bb0fc14d62fbb5ad6653869 Author: John Madieu Date: Fri Mar 6 15:34:10 2026 +0100 PCI: rzg3s-host: Rework inbound window algorithm for supporting RZ/G3E SoC The existing inbound window configuration algorithm has two issues that prevent proper operation on RZ/G3E: 1. Over-mapping: Using roundup_pow_of_two() on the remaining region size can result in windows that extend beyond the intended memory region. 2. Alignment violation: Addresses are only aligned to 4K regardless of the actual window size. According to the RZ/G3S HW manual (Rev.1.10, section 34.6.6.7) and RZ/G3E HW manual (Rev.1.15, section 6.6.7.6), bit carry must not occur when adding AXI Window Base and AXI Window Mask registers. This effectively requires the base address to be aligned to the window size. RZ/G3E strictly enforces these constraints and requires precise window boundaries with properly aligned addresses. Rework the algorithm to properly handle arbitrary region sizes and alignment constraints by splitting non-power-of-2 regions into multiple windows. The new approach iteratively selects the largest power-of-2 size that: - Fits within the remaining region (__fls of remaining size) - Does not exceed the natural alignment of the CPU address (__ffs) - Does not exceed the natural alignment of the PCI address (__ffs) This ensures windows never over-map beyond the intended region and satisfies the hardware requirement that base address + mask must not cause bit carry, while maintaining the 4K * 2^N byte window size constraint. The reworked algorithm is required for RZ/G3E support and remains fully compatible with RZ/G3S. Signed-off-by: John Madieu Signed-off-by: Manivannan Sadhasivam Tested-by: Lad Prabhakar # RZ/V2N EVK Tested-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260306143423.19562-4-john.madieu.xa@bp.renesas.com commit 34735f63748daa2ea27544259c3042b4948376bf Author: John Madieu Date: Fri Mar 6 15:34:09 2026 +0100 PCI: rzg3s-host: Reorder reset assertion during suspend Reorder the reset assertion sequence during suspend from power_resets -> cfg_resets to cfg_resets -> power_resets. This change ensures the suspend sequence follows the reverse order of the probe/init sequence, where power_resets are deasserted first followed by cfg_resets. Additionally, this ordering is required for RZ/G3E support where cfg resets are controlled through PCIe AXI registers (offset 0x310h). According to the RZ/G3E hardware manual (Rev.1.15, section 6.6.6.1.1 "Changing the Initial Values of the Registers"), AXI register access requires ARESETn to be de-asserted and the clock to be supplied. Since ARESETn is part of power_resets, cfg_resets must be asserted before power_resets, otherwise the AXI registers become inaccessible. Fixes: 7ef502fb35b2 ("PCI: Add Renesas RZ/G3S host controller driver") Signed-off-by: John Madieu Signed-off-by: Manivannan Sadhasivam Tested-by: Lad Prabhakar # RZ/V2N EVK Tested-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260306143423.19562-3-john.madieu.xa@bp.renesas.com commit d284389d4576e7c8040dc4cbb66876e539c6d064 Author: John Madieu Date: Fri Mar 6 15:34:08 2026 +0100 PCI: rzg3s-host: Fix reset handling in probe error path Fix incorrect reset_control_bulk_deassert() call in the probe error path. When unwinding from a failed pci_host_probe(), the configuration resets should be asserted to restore the hardware to its initial state, not deasserted again. Fixes: 7ef502fb35b2 ("PCI: Add Renesas RZ/G3S host controller driver") Signed-off-by: John Madieu Signed-off-by: Manivannan Sadhasivam Tested-by: Lad Prabhakar # RZ/V2N EVK Tested-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260306143423.19562-2-john.madieu.xa@bp.renesas.com commit 8c7440c686091a109802a720db25224dcc21485a Author: Giorgi Tchankvetadze Date: Tue Mar 10 18:38:10 2026 +0400 iio: adc: mt6359-auxadc: Fix comma spacing Fix incorrect whitespace around comma on line 325 to comply with kernel coding style. This silences checkpatch errors "ERROR: space prohibited before that ','" and "ERROR: space required after that ','". No functional change. Signed-off-by: Giorgi Tchankvetadze Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit f96bc0fa92be8dc0ec97bbe5bec6d5df26f9585b Author: Cheng-Yang Chou Date: Sun Mar 15 16:24:41 2026 +0800 sched_ext: Update selftests to drop ops.cpu_acquire/release() ops.cpu_acquire/release() are deprecated by commit a3f5d4822253 ("sched_ext: Allow scx_bpf_reenqueue_local() to be called from anywhere") in favor of handling CPU preemption via the sched_switch tracepoint. In the maximal selftest, replace the cpu_acquire/release stubs with a minimal sched_switch TP program. Attach all non-struct_ops programs (including the new TP) via maximal__attach() after disabling auto-attach for the maximal_ops struct_ops map, which is managed manually in run(). Apply the same fix to reload_loop, which also uses the maximal skeleton. Signed-off-by: Cheng-Yang Chou Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 6712c4fefca0422851b71d1a58a32ea03f69310f Author: Cheng-Yang Chou Date: Sun Mar 15 16:24:40 2026 +0800 sched_ext: Update demo schedulers and selftests to use scx_bpf_task_set_dsq_vtime() Direct writes to p->scx.dsq_vtime are deprecated in favor of scx_bpf_task_set_dsq_vtime(). Update scx_simple, scx_flatcg, and select_cpu_vtime selftest to use the new kfunc with scale_by_task_weight_inverse(). Signed-off-by: Cheng-Yang Chou Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit c708d3fad4217f23421b8496e231b0c5cee617a0 Author: Thorsten Blum Date: Mon Mar 9 00:22:32 2026 +0100 crypto: atmel - use list_first_entry_or_null to simplify find_dev Use list_first_entry_or_null() to simplify atmel_sha_find_dev() and remove the now-unused local variable 'struct atmel_sha_dev *tmp'. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit c8a9a647532f5c2a04180352693215e24e9dba03 Author: Thorsten Blum Date: Sat Mar 7 16:31:10 2026 +0100 crypto: atmel-tdes - fix DMA sync direction Before DMA output is consumed by the CPU, ->dma_addr_out must be synced with dma_sync_single_for_cpu() instead of dma_sync_single_for_device(). Using the wrong direction can return stale cache data on non-coherent platforms. Fixes: 13802005d8f2 ("crypto: atmel - add Atmel DES/TDES driver") Fixes: 1f858040c2f7 ("crypto: atmel-tdes - add support for latest release of the IP (0x700)") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 5377032914b29b4643adece0ff1dfc67e36700f4 Author: Aleksander Jan Bajkowski Date: Fri Mar 6 23:17:40 2026 +0100 crypto: inside-secure/eip93 - register hash before authenc algorithms Register hash before hmac and authenc algorithms. This will ensure selftests pass at startup. Previously, selftests failed on the crypto_alloc_ahash() function since the associated algorithm was not yet registered. Fixes following error: ... [ 18.375811] alg: self-tests for authenc(hmac(sha1),cbc(aes)) using authenc(hmac(sha1-eip93),cbc(aes-eip93)) failed (rc=-2) [ 18.382140] alg: self-tests for authenc(hmac(sha224),rfc3686(ctr(aes))) using authenc(hmac(sha224-eip93),rfc3686(ctr(aes-eip93))) failed (rc=-2) [ 18.395029] alg: aead: authenc(hmac(sha256-eip93),cbc(des-eip93)) setkey failed on test vector 0; expected_error=0, actual_error=-2, flags=0x1 [ 18.409734] alg: aead: authenc(hmac(md5-eip93),cbc(des3_ede-eip93)) setkey failed on test vector 0; expected_error=0, actual_error=-2, flags=0x1 ... Fixes: 9739f5f93b78 ("crypto: eip93 - Add Inside Secure SafeXcel EIP-93 crypto engine support") Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit f4abb1af1bedafada8d7f814b85a7cf83d58f0b7 Author: Eric Biggers Date: Thu Mar 5 20:19:15 2026 -0800 MAINTAINERS: remove outdated entry for crypto/rng.c Lore shows no emails from Neil on linux-crypto since 2020. Without the listed person being active, this MAINTAINERS entry provides no value, and actually is a bit confusing because while it is called the "CRYPTOGRAPHIC RANDOM NUMBER GENERATOR", it is not the CRNG that is normally used (drivers/char/random.c) which has a separate entry. Remove this entry, so crypto/rng.c will just be covered by "CRYPTO API". Cc: Neil Horman Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 82fc2b17fa5b9b12d34770afcc8e3c4288735429 Author: Aleksander Jan Bajkowski Date: Thu Mar 5 21:08:24 2026 +0100 crypto: testmgr - Add test vectors for authenc(hmac(sha512),rfc3686(ctr(aes))) Test vectors were generated starting from existing RFC3686(CTR(AES)) test vectors and adding HMAC(SHA512) computed with software implementation. Then, the results were double-checked on Mediatek MT7986 (safexcel). Platform pass self-tests. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit 2f0814271715f974ae1fc6247c9918906c83e24b Author: Aleksander Jan Bajkowski Date: Thu Mar 5 21:08:23 2026 +0100 crypto: testmgr - Add test vectors for authenc(hmac(sha384),rfc3686(ctr(aes))) Test vectors were generated starting from existing RFC3686(CTR(AES)) test vectors and adding HMAC(SHA384) computed with software implementation. Then, the results were double-checked on Mediatek MT7986 (safexcel). Platform pass self-tests. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit 5ac6b904c70ff163fd2f9e152056300ce5ed6c26 Author: Aleksander Jan Bajkowski Date: Thu Mar 5 21:08:22 2026 +0100 crypto: testmgr - Add test vectors for authenc(hmac(sha256),rfc3686(ctr(aes))) Test vectors were generated starting from existing RFC3686(CTR(AES)) test vectors and adding HMAC(SHA256) computed with software implementation. Then, the results were double-checked on Mediatek MT7986 (safexcel). Platform pass self-tests. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit d46c27c01f132082095342b5abf4e83e250b70b8 Author: Aleksander Jan Bajkowski Date: Thu Mar 5 21:08:21 2026 +0100 crypto: testmgr - Add test vectors for authenc(hmac(sha224),rfc3686(ctr(aes))) Test vectors were generated starting from existing RFC3686(CTR(AES)) test vectors and adding HMAC(SHA224) computed with software implementation. Then, the results were double-checked on Mediatek MT7986 (safexcel). Platform pass self-tests. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit b45b4314d3e55be70b597baa1f0ab9283e68003b Author: Aleksander Jan Bajkowski Date: Thu Mar 5 21:08:20 2026 +0100 crypto: testmgr - Add test vectors for authenc(hmac(sha1),rfc3686(ctr(aes))) Test vectors were generated starting from existing RFC3686(CTR(AES)) test vectors and adding HMAC(SHA1) computed with software implementation. Then, the results were double-checked on Mediatek MT7986 (safexcel). Platform pass self-tests. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit 68095ad9de9361844235c1e4e3bd5632f6b21929 Author: Dave Hansen Date: Thu Mar 5 09:21:33 2026 -0800 MAINTAINERS: Remove bouncing maintaner for IAA driver This maintainer's email is now bouncing. Remove them. Cc: Kristen Accardi Cc: Vinicius Costa Gomes Cc: Herbert Xu Cc: "David S. Miller" Cc: linux-crypto@vger.kernel.org Signed-off-by: Dave Hansen Signed-off-by: Herbert Xu commit e7dcb722bb75bb3f3992f580a8728a794732fd7a Author: Suman Kumar Chakraborty Date: Thu Mar 5 08:58:59 2026 +0000 crypto: qat - fix firmware loading failure for GEN6 devices QAT GEN6 hardware requires a minimum 3 us delay during the acceleration engine reset sequence to ensure the hardware fully settles. Without this delay, the firmware load may fail intermittently. Add a delay after placing the AE into reset and before clearing the reset, matching the hardware requirements and ensuring stable firmware loading. Earlier generations remain unaffected. Fixes: 17fd7514ae68 ("crypto: qat - add qat_6xxx driver") Signed-off-by: Suman Kumar Chakraborty Cc: stable@vger.kernel.org Reviewed-by: Giovanni Cabiddu Reviewed-by: Andy Shevchenko Signed-off-by: Herbert Xu commit 4963b39e3a3feed07fbf4d5cc2b5df8498888285 Author: Suman Kumar Chakraborty Date: Thu Mar 5 08:58:58 2026 +0000 crypto: qat - fix indentation of macros in qat_hal.c The macros in qat_hal.c were using a mixture of tabs and spaces. Update all macro indentation to use tabs consistently, matching the predominant style. This does not introduce any functional change. Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit f06b4ee3351dee90d422305d164a7aa353c5fdd1 Author: Thorsten Blum Date: Wed Mar 4 09:24:02 2026 +0100 crypto: atmel-sha204a - Drop redundant I2C_FUNC_I2C check atmel_i2c_probe() already verifies I2C_FUNC_I2C - remove the redundant check in atmel_sha204a_probe(). Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 1e84df6ccfcb342262b02dfdb723eaad50a0b6c9 Author: Aleksander Jan Bajkowski Date: Tue Mar 3 19:53:49 2026 +0100 dt-bindings: crypto: inside-secure,safexcel: add compatible for MT7981 The MT7981 as well as the MT7986 have a built-in EIP-97 crypto accelerator. This commit adds a compatible string for MT7981. Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit d9a4a2021d4a5ced93b7d9a6d1b13298c631dbdd Merge: 58351f46de26bc f08ceb71c5a561 Author: Dave Airlie Date: Sun Mar 15 07:53:05 2026 +1000 Merge tag 'drm-misc-next-2026-03-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.1: UAPI Changes: amdxdna: - Add sensors ioctls Cross-subsystem Changes: dma-buf: - clean pages with helpers Documenatation: - devicetree: Add lxd vendor prefix Core Changes: buddy: - improve aligned allocations gem-shmem: - Track page accessed/dirty status across mmap/vmap ttm: - fix fence signalling Driver Changes: amdxdna: - provide NPU power estimate - support sensor for column utilization bridge: - anx7625: Fix USB Type-C handling - cdns-mhdp8546-core: Handle HDCP state in bridge atomic_check ivpu: - fixes loongson: - replace custom code with drm_gem_ttm_dumb_map_offset() mxsfb: - lcdif: report probing errors with dev_err_probe() panel: - ilitek-ili9882t: Allow GPIO calls to sleep - jadard: Support TAIGUAN XTI05101-01A - lxd: Support LXD M9189A plus DT bindings - mantix: Fix pixel clock; Clean up - motorola: Support Motorola Atrix 4G and Droid X2 plus DT bindings - novatek: Support Novatek/Tianma NT37700F plus DT bindings - renesas: Clean up - simple: Support EDT ET057023UDBA plus DT bindings; Support Powertip PH800480T032-ZHC19 plus DT bindings; Support Waveshare 13.3" - clean up DT bindings of various drivers panthor: - fix fence handling vc4: - check return value of platform_get_irq_byname() Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260312075629.GA21234@linux.fritz.box commit 5446b8691eb8278f10deca92048fad84ffd1e4d5 Merge: 4686679a14d269 97daf00745f7f9 Author: Jakub Kicinski Date: Sat Mar 14 13:33:04 2026 -0700 Merge branch 'dpaa2-fix-config-relation-with-fsl_dpaa2_switch' Cai Xinchen says: ==================== dpaa2: fix config relation with FSL_DPAA2_SWITCH When compile FSL_DPAA2_SWITCH, it needs to set CONFIG_FSL_DPAA2_ETH=y, otherwise it cannot be compiled. And as Ioana Ciornei sugggested, FSL_DPAA2_SWITCH included dpaa2-mac.o in the driver, but it does not select PCS_LYNX, PHYLINK and FSL_XGMAC_MDIO. And FSL_DPAA2_SWITCH depends on FSL_MC_BUS && FSL_MC_DPIO becuase it uses fsl_mc_driver APIs. ==================== Link: https://patch.msgid.link/20260312065907.476663-1-caixinchen1@huawei.com Signed-off-by: Jakub Kicinski commit 97daf00745f7f9f261b0e91418de6e79d7826c36 Author: Cai Xinchen Date: Thu Mar 12 06:59:07 2026 +0000 dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n CONFIG_FSL_DPAA2_ETH and CONFIG_FSL_DPAA2_SWITCH are not associated, but the compilation of FSL_DPAA2_SWITCH depends on the compilation of the dpaa2 folder. The files controlled by CONFIG_FSL_DPAA2_SWITCH in the dpaa2 folder are not controlled by CONFIG_FSL_DPAA2_ETH, except for the files controlled by CONFIG_FSL_DPAA2_SWITCH. Therefore, removing the restriction will not affect the compilation of the files in the directory. Fixes: f48298d3fbfaa ("staging: dpaa2-switch: move the driver out of staging") Suggested-by: Ioana Ciornei Signed-off-by: Cai Xinchen Link: https://patch.msgid.link/20260312065907.476663-3-caixinchen1@huawei.com Signed-off-by: Jakub Kicinski commit 12589892f41c4c645c80ef9f036f7451a6045624 Author: Cai Xinchen Date: Thu Mar 12 06:59:06 2026 +0000 dpaa2: add independent dependencies for FSL_DPAA2_SWITCH Since the commit 84cba72956fd ("dpaa2-switch: integrate the MAC endpoint support") included dpaa2-mac.o in the driver, but it didn't select PCS_LYNX, PHYLINK and FSL_XGMAC_MDIO. it will lead to link error, such as undefined reference to `phylink_ethtool_ksettings_set' undefined reference to `lynx_pcs_create_fwnode' And the same reason as the commit d2624e70a2f53 ("dpaa2-eth: select XGMAC_MDIO for MDIO bus support"), enable the FSL_XGMAC_MDIO Kconfig option in order to have MDIO access to internal and external PHYs. Because dpaa2-switch uses fsl_mc_driver APIs, add depends on FSL_MC_BUS && FSL_MC_DPIO as FSL_DPAA2_SWITCH do. FSL_XGMAC_MDIO and FSL_MC_BUS depend on OF, thus the dependence of FSL_MC_BUS can satisfy FSL_XGMAC_MDIO's OF requirement. Fixes: 84cba72956fd ("dpaa2-switch: integrate the MAC endpoint support") Suggested-by: Ioana Ciornei Signed-off-by: Cai Xinchen Link: https://patch.msgid.link/20260312065907.476663-2-caixinchen1@huawei.com Signed-off-by: Jakub Kicinski commit 4686679a14d269d4f02533228e82de56f432bae5 Author: Eric Dumazet Date: Fri Mar 13 11:54:29 2026 +0000 selftests/net: packetdrill: add tcp_disorder_fin_in_FIN_WAIT.pkt Commit 795a7dfbc3d9 ("net: tcp: accept old ack during closing") was fixing an old bug, add a test to make sure we won't break this case in future kernels. Signed-off-by: Eric Dumazet Cc: Menglong Dong Link: https://patch.msgid.link/20260313115429.3365751-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 411ad060587591a2c8a6005b8e2f42d8a1dae2da Merge: 9d9d7b4b153bc4 2a8c8a03f306e2 Author: Jakub Kicinski Date: Sat Mar 14 13:08:57 2026 -0700 Merge branch 'devlink-introduce-shared-devlink-instance-for-pfs-on-same-chip' Jiri Pirko says: ==================== devlink: introduce shared devlink instance for PFs on same chip Multiple PFs on a network adapter often reside on the same physical chip, running a single firmware. Some resources and configurations are inherently shared among these PFs - PTP clocks, VF group rates, firmware parameters, and others. Today there is no good object in the devlink model to attach these chip-wide configuration knobs to. Drivers resort to workarounds like pinning shared state to PF0 or maintaining ad-hoc internal structures (e.g., ice_adapter) that are invisible to userspace. This problem was discussed extensively starting with Przemek Kitszel's "whole device devlink instance" RFC for the ice driver [1]. Several approaches for representing the parent instance were considered: using a partial PCI BDF as the dev_name (breaks when PFs have different BDFs in VMs), creating a per-driver bus, using auxiliary devices, or using faux devices. All of these required a backing struct device for the parent devlink instance, which does not naturally exist - there is no PCI device that represents the chip as a whole. This patchset takes a different approach: allow devlink instances to exist without any backing struct device. The instance is identified purely by its internal index, exposed over devlin netlink. This avoids fabricating fake devices and keeps the devlink handle semantics clean. The first ten patches prepare the devlink core for device-less instances by decoupling the handle from the parent device. The last three introduce the shared devlink infrastructure and its first user in the mlx5 driver. Example output showing the shared instance and nesting: pci/0000:08:00.0: index 0 nested_devlink: auxiliary/mlx5_core.eth.0 devlink_index/1: index 1 nested_devlink: pci/0000:08:00.0 pci/0000:08:00.1 auxiliary/mlx5_core.eth.0: index 2 pci/0000:08:00.1: index 3 nested_devlink: auxiliary/mlx5_core.eth.1 auxiliary/mlx5_core.eth.1: index 4 [1] https://lore.kernel.org/netdev/20250219164410.35665-1-przemyslaw.kitszel@intel.com/ --- Decoupled from "devlink and mlx5: Support cross-function rate scheduling" patchset to maintain 15-patches limit. See individual patches for changelog. ==================== Link: https://patch.msgid.link/20260312100407.551173-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 2a8c8a03f306e21a0ea74c93d4332119557f4575 Author: Jiri Pirko Date: Thu Mar 12 11:04:07 2026 +0100 net/mlx5: Add a shared devlink instance for PFs on same chip Use the previously introduced shared devlink infrastructure to create a shared devlink instance for mlx5 PFs that reside on the same physical chip. The shared instance is identified by the chip's serial number extracted from PCI VPD (V3 keyword, with fallback to serial number for older devices). Each PF that probes calls mlx5_shd_init() which extracts the chip serial number and uses devlink_shd_get() to get or create the shared instance. When a PF is removed, mlx5_shd_uninit() calls devlink_shd_put() to release the reference. The shared instance is automatically destroyed when the last PF is removed. Make the PF devlink instances nested in this shared devlink instance, allowing userspace to identify which PFs belong to the same physical chip. Example: pci/0000:08:00.0: index 0 nested_devlink: auxiliary/mlx5_core.eth.0 devlink_index/1: index 1 nested_devlink: pci/0000:08:00.0 pci/0000:08:00.1 auxiliary/mlx5_core.eth.0: index 2 pci/0000:08:00.1: index 3 nested_devlink: auxiliary/mlx5_core.eth.1 auxiliary/mlx5_core.eth.1: index 4 Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-14-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 63fff8c0f7025a838f1afab5fc8e6ad989e4823e Author: Jiri Pirko Date: Thu Mar 12 11:04:06 2026 +0100 documentation: networking: add shared devlink documentation Document shared devlink instances for multiple PFs on the same chip. Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-13-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 1850e76b38049548ecb03c62bb10d40b94eecaac Author: Jiri Pirko Date: Thu Mar 12 11:04:05 2026 +0100 devlink: introduce shared devlink instance for PFs on same chip Multiple PFs may reside on the same physical chip, running a single firmware. Some of the resources and configurations may be shared among these PFs. Currently, there is no good object to pin the configuration knobs on. Introduce a shared devlink instance, instantiated upon probe of the first PF and removed during remove of the last PF. The shared devlink instance is not backed by any device device, as there is no PCI device related to it. The implementation uses reference counting to manage the lifecycle: each PF that probes calls devlink_shd_get() to get or create the shared instance, and calls devlink_shd_put() when it removes. The shared instance is automatically destroyed when the last PF removes. Example: pci/0000:08:00.0: index 0 nested_devlink: auxiliary/mlx5_core.eth.0 devlink_index/1: index 1 nested_devlink: pci/0000:08:00.0 pci/0000:08:00.1 auxiliary/mlx5_core.eth.0: index 2 pci/0000:08:00.1: index 3 nested_devlink: auxiliary/mlx5_core.eth.1 auxiliary/mlx5_core.eth.1: index 4 Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-12-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit a4c6d53e5fd61829f707b7a723dd2937ed67c803 Author: Jiri Pirko Date: Thu Mar 12 11:04:04 2026 +0100 devlink: allow devlink instance allocation without a backing device Allow devlink_alloc_ns() to be called with dev=NULL to support device-less devlink instances. When dev is NULL, the instance is identified over netlink using "devlink_index" as bus_name and the decimal index value as dev_name. Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-11-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 104733e1303efcec97c9a581adabbc03c6679006 Author: Jiri Pirko Date: Thu Mar 12 11:04:03 2026 +0100 devlink: add devl_warn() helper and use it in port warnings Introduce devl_warn() macro that uses dev_warn() when a backing device is available and falls back to pr_warn() otherwise. Convert all dev_warn() calls in port.c to use it, preparing for devlink instances without a backing device. Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-10-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 20b0f383aae7d26990a769d52b4d5c0e570e659c Author: Jiri Pirko Date: Thu Mar 12 11:04:02 2026 +0100 devlink: add devlink_dev_driver_name() helper and use it in trace events In preparation to dev-less devlinks, add devlink_dev_driver_name() that returns the driver name stored in devlink struct, and use it in all trace events. Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-9-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit eb32a6310a7bcc6b26087a1a93981d3593aa17ea Author: Jiri Pirko Date: Thu Mar 12 11:04:01 2026 +0100 devlink: introduce __devlink_alloc() with dev driver pointer Introduce __devlink_alloc() as an internal devlink allocator that accepts a struct device_driver pointer and stores it in the devlink instance. This allows internal devlink code (e.g. shared instances) to associate a driver with a devlink instance without need to pass dev pointer. Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-8-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 089aeb4f2218ee0d7b53930e9f04a061240ce0f0 Author: Jiri Pirko Date: Thu Mar 12 11:04:00 2026 +0100 devlink: support index-based notification filtering Extend the notification filter descriptor with devlink_index so that userspace can filter notifications by devlink instance index in addition to bus_name/dev_name. Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-7-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 725d5fdb7b9c01d9e7079682acf998703762475b Author: Jiri Pirko Date: Thu Mar 12 11:03:59 2026 +0100 devlink: support index-based lookup via bus_name/dev_name handle Devlink instances without a backing device use bus_name "devlink_index" and dev_name set to the decimal index string. When user space sends this handle, detect the pattern and perform a direct xarray lookup by index instead of iterating all instances. Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-6-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit d85a8af57da871964c60eb5b9ab121a6c31e3bd3 Author: Jiri Pirko Date: Thu Mar 12 11:03:58 2026 +0100 devlink: allow to use devlink index as a command handle Currently devlink instances are addressed bus_name/dev_name tuple. Allow the newly introduced DEVLINK_ATTR_INDEX to be used as an alternative handle for all devlink commands. When DEVLINK_ATTR_INDEX is present in the request, use it for a direct xarray lookup instead of iterating over all instances comparing bus_name/dev_name strings. Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-5-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit e2e3666fd3609bfc03c42bd8544be8cbd080d24d Author: Jiri Pirko Date: Thu Mar 12 11:03:57 2026 +0100 devlink: avoid extra iterations when found devlink is not registered Since the one found is not registered, very unlikely another one with the same bus_name/dev_name is going to be found. Stop right away and prepare common "found" path for the follow-up patch. Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-4-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 0f5531879afbf904f19a15b39f687a9ec47a82cc Author: Jiri Pirko Date: Thu Mar 12 11:03:56 2026 +0100 devlink: add helpers to get bus_name/dev_name Introduce devlink_bus_name() and devlink_dev_name() helpers and convert all direct accesses to devlink->dev->bus->name and dev_name(devlink->dev) to use them. This prepares for dev-less devlink instances where these helpers will be extended to handle the missing device. Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-3-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 68deca0f0f4bba8c5278340c7c142500171d5f9b Author: Jiri Pirko Date: Thu Mar 12 11:03:55 2026 +0100 devlink: expose devlink instance index over netlink Each devlink instance has an internally assigned index used for xarray storage. Expose it as a new DEVLINK_ATTR_INDEX uint attribute alongside the existing bus_name and dev_name handle. Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260312100407.551173-2-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 9d9d7b4b153bc44e5d3226f1d0b445fb70320da9 Merge: a99f06e579a39b c4399af5e55658 Author: Jakub Kicinski Date: Sat Mar 14 12:23:04 2026 -0700 Merge branch 'net-phy-further-decouple-provider-from-consumer-part' Heiner Kallweit says: ==================== net: phy: further decouple provider from consumer part This series aims at further decoupling the provider and consumer part in phylib. ==================== Link: https://patch.msgid.link/9d5724bc-e525-4f8f-b3f8-b16dd5a1164e@gmail.com Signed-off-by: Jakub Kicinski commit c4399af5e55658e832779b256d8458323011f983 Author: Heiner Kallweit Date: Mon Mar 9 18:06:00 2026 +0100 net: phy: move remaining provider code to mdio_bus_provider.c This moves definition of mdio_bus class and bus_type to the provider side, what allows to make them private to libphy. As a prerequisite MDIO statistics handling is moved to the provider side as well. Note: This patch causes a checkpatch error "Macros with complex values should be enclosed in parentheses" for MDIO_BUS_STATS_ADDR_ATTR_GROUP. I consider this a false positive here, in addition the patch just moves existing code. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/47b85676-b349-4aa0-a5ef-cd37769a4c69@gmail.com Signed-off-by: Jakub Kicinski commit 25b23d82831870b8581abe6a24970ffd95675bc7 Author: Heiner Kallweit Date: Mon Mar 9 18:04:46 2026 +0100 net: phy: move registering mdio_bus_class and mdio_bus_type to libphy The MDIO consumer side shouldn't register class and bus_type. Therefore move this to libphy. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/b15b378a-fda2-44b9-9d63-bf82919b71b2@gmail.com Signed-off-by: Jakub Kicinski commit b69ceb387aca23126421ed676a312576cc3e0aee Author: Heiner Kallweit Date: Mon Mar 9 18:04:08 2026 +0100 net: phy: move (of_)mdio_find_bus to mdio_bus_provider.c Functionality outside libphy shouldn't access mdio_bus_class directly. So move both functions to the provider side. This is a step towards making mdio_bus_class private to libphy. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/b6161c64-68ac-4524-82ec-5b7d81b86dbc@gmail.com Signed-off-by: Jakub Kicinski commit 6df1459605cedd2112ebf660c77f42bb87d5c306 Author: Heiner Kallweit Date: Mon Mar 9 18:03:31 2026 +0100 net: phy: make mdio_device.c part of libphy This patch - makes mdio_device.c part of libphy - makes mdio_device_(un)register_reset() static - moves mdiobus_(un)register_device() from mdio_bus.c to mdio_device.c, stops exporting both functions and makes them private to phylib This further decouples the MDIO consumer functionality from libphy. Note: This makes MDIO driver registration part of phylib, therefore adjust Kconfig dependencies where needed. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/c6dbf9b3-3ca0-434b-ad3a-71fe602ab809@gmail.com Signed-off-by: Jakub Kicinski commit 2d7bebc9dd79177f098187b0ddb0c357d4496c1c Author: Heiner Kallweit Date: Mon Mar 9 18:02:38 2026 +0100 net: phy: move mdio_device reset handling functions in the code In preparation of a follow-up patch this moves reset-related functions in the code. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/8ea1a929-33b8-49ee-afe6-355f5a7d2bd1@gmail.com Signed-off-by: Jakub Kicinski commit a99f06e579a39be6113d37e84658a20b71c52e5f Author: Oliver Neukum Date: Thu Mar 12 09:45:32 2026 +0100 net: usb: cdc-ether: unify error handling in probe usbnet_generic_cdc_bind() is duplicating the error handling multiple times. That is bad. Unify it with jumps. V2: Update error logging with every cause a unique message Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260312084612.1469853-1-oneukum@suse.com Signed-off-by: Jakub Kicinski commit 44b02a14d993d91ae36409a54941ac5a5ad20b44 Author: AlanSong-oc Date: Fri Mar 13 16:01:50 2026 +0800 lib/crypto: x86/sha256: PHE Extensions optimized SHA256 transform function Zhaoxin CPUs have implemented the SHA(Secure Hash Algorithm) as its CPU instructions by PHE(Padlock Hash Engine) Extensions, including XSHA1, XSHA256, XSHA384 and XSHA512 instructions. The instruction specification is available at the following link. (https://gitee.com/openzhaoxin/zhaoxin_specifications/blob/20260227/ZX_Padlock_Reference.pdf) With the help of implementation of SHA in hardware instead of software, can develop applications with higher performance, more security and more flexibility. This patch includes the XSHA256 instruction optimized implementation of SHA-256 transform function. The table below shows the benchmark results before and after applying this patch by using CRYPTO_LIB_BENCHMARK on Zhaoxin KX-7000 platform, highlighting the achieved speedups. +---------+--------------------------+ | | SHA256 | +---------+--------+-----------------+ | Len | Before | After | +---------+--------+-----------------+ | 1* | 2 | 7 (3.50x) | | 16 | 35 | 119 (3.40x) | | 64 | 74 | 280 (3.78x) | | 127 | 99 | 387 (3.91x) | | 128 | 103 | 427 (4.15x) | | 200 | 123 | 537 (4.37x) | | 256 | 128 | 582 (4.55x) | | 511 | 144 | 679 (4.72x) | | 512 | 146 | 714 (4.89x) | | 1024 | 157 | 796 (5.07x) | | 3173 | 167 | 883 (5.28x) | | 4096 | 166 | 876 (5.28x) | | 16384 | 169 | 899 (5.32x) | +---------+--------+-----------------+ *: The length of each data block to be processed by one complete SHA sequence. **: The throughput of processing data blocks, unit is Mb/s. After applying this patch, the SHA256 KUnit test suite passes on Zhaoxin platforms. Detailed test logs are shown below. [ 7.767257] # Subtest: sha256 [ 7.770542] # module: sha256_kunit [ 7.770544] 1..15 [ 7.777383] ok 1 test_hash_test_vectors [ 7.788563] ok 2 test_hash_all_lens_up_to_4096 [ 7.806090] ok 3 test_hash_incremental_updates [ 7.813553] ok 4 test_hash_buffer_overruns [ 7.822384] ok 5 test_hash_overlaps [ 7.829388] ok 6 test_hash_alignment_consistency [ 7.833843] ok 7 test_hash_ctx_zeroization [ 7.915191] ok 8 test_hash_interrupt_context_1 [ 8.362312] ok 9 test_hash_interrupt_context_2 [ 8.401607] ok 10 test_hmac [ 8.415458] ok 11 test_sha256_finup_2x [ 8.419397] ok 12 test_sha256_finup_2x_defaultctx [ 8.424107] ok 13 test_sha256_finup_2x_hugelen [ 8.451289] # benchmark_hash: len=1: 7 MB/s [ 8.465372] # benchmark_hash: len=16: 119 MB/s [ 8.481760] # benchmark_hash: len=64: 280 MB/s [ 8.499344] # benchmark_hash: len=127: 387 MB/s [ 8.515800] # benchmark_hash: len=128: 427 MB/s [ 8.531970] # benchmark_hash: len=200: 537 MB/s [ 8.548241] # benchmark_hash: len=256: 582 MB/s [ 8.564838] # benchmark_hash: len=511: 679 MB/s [ 8.580872] # benchmark_hash: len=512: 714 MB/s [ 8.596858] # benchmark_hash: len=1024: 796 MB/s [ 8.612567] # benchmark_hash: len=3173: 883 MB/s [ 8.628546] # benchmark_hash: len=4096: 876 MB/s [ 8.644482] # benchmark_hash: len=16384: 899 MB/s [ 8.649773] ok 14 benchmark_hash [ 8.655505] ok 15 benchmark_sha256_finup_2x # SKIP not relevant [ 8.659065] # sha256: pass:14 fail:0 skip:1 total:15 [ 8.665276] # Totals: pass:14 fail:0 skip:1 total:15 [ 8.670195] ok 7 sha256 Signed-off-by: AlanSong-oc Link: https://lore.kernel.org/r/20260313080150.9393-3-AlanSong-oc@zhaoxin.com Signed-off-by: Eric Biggers commit b87249aab4c0cbc8d9e4e745dcd1cb45ca29b8bd Author: Heiner Kallweit Date: Wed Mar 11 21:54:46 2026 +0100 net: mdio: remove selecting FIXED_PHY for FWNODE_MDIO Fwnode MDIO has never used the fixed PHY code, therefore don't select symbol FIXED_PHY. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/880ca62b-a5d3-4865-bbce-2d2210928239@gmail.com Signed-off-by: Jakub Kicinski commit 74cd4e0e5399480e3fab2cd6a6cbdb17f673c335 Author: Yifan Wu Date: Thu Mar 5 09:36:38 2026 +0800 selftests/arm64: Implement cmpbr_sigill() to hwcap test The function executes a CBEQ instruction which is valid if the CPU supports the CMPBR extension. The CBEQ branches to skip the following UDF instruction, and no SIGILL is generated. Otherwise, it will generate a SIGILL. Signed-off-by: Yifan Wu Reviewed-by: Mark Brown Signed-off-by: Catalin Marinas commit fa8fca88714c3a4a74f972ed37328e2f0bbef9fa Author: Fernando Fernandez Mancera Date: Thu Mar 12 15:26:37 2026 +0100 ipv4: validate IPV4_DEVCONF attributes properly As the IPV4_DEVCONF netlink attributes are not being validated, it is possible to use netlink to set read-only values like mc_forwarding. In addition, valid ranges are not being validated neither but that is less relevant as they aren't in sysctl. To avoid similar situations in the future, define a NLA policy for IPV4_DEVCONF attributes which are nested in IFLA_INET_CONF. Signed-off-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260312142637.5704-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit f807b5b9b89eb9220d034115c272c312251cbcac Author: Russell King (Oracle) Date: Thu Mar 12 12:13:52 2026 +0000 net: stmmac: avoid passing pci_dev The pci_dev is only used to provide the ethtool bus_info using pci_name(priv->plat->pdev). This is the same as dev_name(priv->device). Thus, rather than passing the pci_dev, make use of what we already have. To avoid unexpectedly exposing the device name through ethtool where it wasn't provided before, add a flag priv->plat->provide_bus_info to enable this, which only dwmac-intel needs to set. Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Link: https://patch.msgid.link/E1w0evI-0000000CzY7-1fyo@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9c99a784d9117a192ebf779d4f72ebec435ada97 Author: Icenowy Zheng Date: Thu Jan 29 10:39:21 2026 +0800 riscv: dts: thead: lichee-pi-4a: enable HDMI Lichee Pi 4A board features a HDMI Type-A connector connected to the HDMI TX controller of TH1520 SoC. Add a device tree node describing the connector, connect it to the HDMI controller, and enable everything on this display pipeline. Signed-off-by: Icenowy Zheng Signed-off-by: Icenowy Zheng Tested-by: Han Gao Tested-by: Michal Wilczynski Reviewed-by: Luca Ceresoli Reviewed-by: Drew Fustini Signed-off-by: Drew Fustini commit 5634f777a6a94db316f9b26c00525320c3b582c2 Author: Icenowy Zheng Date: Thu Jan 29 10:39:20 2026 +0800 riscv: dts: thead: add DPU and HDMI device tree nodes T-Head TH1520 SoC contains a Verisilicon DC8200 display controller (called DPU in manual) and a Synopsys DesignWare HDMI TX controller. Add device tree nodes to them. Signed-off-by: Icenowy Zheng Signed-off-by: Icenowy Zheng Tested-by: Han Gao Tested-by: Michal Wilczynski Reviewed-by: Drew Fustini Reviewed-by: Luca Ceresoli Signed-off-by: Drew Fustini commit f4ce4922df8d1c3417f4bc21314ac7d5e4c92ab7 Author: Wei Fang Date: Fri Mar 13 19:24:54 2026 +0800 net: enetc: remove stray semicolon Remove stray semicolon from ntmp_table_name(). Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260313112454.427191-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit be6e9dee0e978ddf7b4b6b8b8dba37413ae1a393 Author: Anshuman Khandual Date: Mon Mar 2 06:44:37 2026 +0000 arm64/mm: Directly use TTBRx_EL1_CnP Replace all TTBR_CNP_BIT macro instances with TTBRx_EL1_CNP_BIT which is a standard field from tools sysreg format. Drop the now redundant custom macro TTBR_CNP_BIT. No functional change. Cc: Will Deacon Cc: Marc Zyngier Cc: Oliver Upton Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Cc: kvmarm@lists.linux.dev Signed-off-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit d989010bbecad295cc66737a30b05319f5e7507b Author: Anshuman Khandual Date: Mon Mar 2 06:44:36 2026 +0000 arm64/mm: Directly use TTBRx_EL1_ASID_MASK Replace all TTBR_ASID_MASK macro instances with TTBRx_EL1_ASID_MASK which is a standard field mask from tools sysreg format. Drop the now redundant custom macro TTBR_ASID_MASK. No functional change. Cc: Will Deacon Cc: Marc Zyngier Cc: Oliver Upton Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Cc: kvmarm@lists.linux.dev Signed-off-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit 2615924e45a79dacc5eb27afea45a364a6b6d8bc Author: Anshuman Khandual Date: Wed Feb 25 06:40:28 2026 +0000 arm64/mm: Describe TTBR1_BADDR_4852_OFFSET TTBR1_BADDR_4852_OFFSET is a constant offset which gets added into kernel page table physical address for TTBR1_EL1 when kernel is build for 52 bit VA but found to be running on 48 bit VA capable system. Although there is no explanation on how the macro is computed. Describe TTBR1_BADDR_4852_OFFSET computation in detail via deriving from all required parameters involved thus improving clarity and readability. Cc: Will Deacon Cc: Mark Rutland Cc: Ryan Roberts Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit 425abcea830c647ed9e11f669e05200a67e905e8 Author: Colin Ian King Date: Thu Mar 12 23:59:22 2026 +0000 hinic3: Fix spelling mistake "capbility" -> "capability" There is a spelling mistake in a dev_dbg message. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260312235922.3442120-1-colin.i.king@gmail.com Signed-off-by: Jakub Kicinski commit bfeb2c029e7b6839928f5167b5c44ba41836d402 Merge: b58e3a2d014567 045f977dd4ebdd Author: Jakub Kicinski Date: Sat Mar 14 08:38:08 2026 -0700 Merge branch 'net-add-skb_drop_reason_recursion_limit' Eric Dumazet says: ==================== net: add SKB_DROP_REASON_RECURSION_LIMIT Add a new drop reason : SKB_DROP_REASON_RECURSION_LIMIT Used for packets dropped in a too deep virtual device chain, from tunnels and __dev_queue_xmit() __dev_queue_xmit() can also return SKB_DROP_REASON_DEV_READY ==================== Link: https://patch.msgid.link/20260312201824.203093-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 045f977dd4ebdd3ad8e96cf684917adfc5805adb Author: Eric Dumazet Date: Thu Mar 12 20:18:24 2026 +0000 net: plumb drop reasons to __dev_queue_xmit() Add drop reasons to __dev_queue_xmit(): - SKB_DROP_REASON_DEV_READY : device is not UP. - SKB_DROP_REASON_RECURSION_LIMIT : recursion limit on virtual device is hit. Also add an unlikely() for the SKB_DROP_REASON_DEV_READY case, and reduce indentation level. Signed-off-by: Eric Dumazet Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260312201824.203093-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit d15d3de94a4766fb43d7fe7a72ed0479fb268131 Author: Eric Dumazet Date: Thu Mar 12 20:18:23 2026 +0000 net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT ip[6]tunnel_xmit() can drop packets if a too deep recursion level is detected. Add SKB_DROP_REASON_RECURSION_LIMIT drop reason. We will use this reason later in __dev_queue_xmit(). Signed-off-by: Eric Dumazet Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260312201824.203093-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit b58e3a2d014567a9092eb026fe677ff4bed5af38 Merge: 9089c5f3c444ad 3eb371eddad0a4 Author: Jakub Kicinski Date: Sat Mar 14 08:02:52 2026 -0700 Merge branch 'tcp-rfc-7323-compliant-window-retraction-handling' Simon Baatz says: ==================== tcp: RFC 7323-compliant window retraction handling this series implements the receiver-side requirements for TCP window retraction as specified in RFC 7323 and adds packetdrill tests to cover the new behavior. Please see the first patch for background and implementation details. Since MPTCP adjusts the TCP receive window on subflows, the relevant MPTCP code paths are updated accordingly. ==================== Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-0-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski commit 3eb371eddad0a47183dd4434de9c9190d0f721c5 Author: Simon Baatz Date: Mon Mar 9 09:02:31 2026 +0100 selftests/net: packetdrill: add tcp_rcv_neg_window.pkt The test ensures we correctly apply the maximum advertised window limit when rcv_nxt advances past rcv_mwnd_seq, so that the "usable window" is properly clamped to zero rather than becoming negative. Signed-off-by: Simon Baatz Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-6-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski commit ba58b3e70b86cd64fe8bb9c52f1111667a448908 Author: Simon Baatz Date: Mon Mar 9 09:02:30 2026 +0100 selftests/net: packetdrill: add tcp_rcv_wnd_shrink_allowed.pkt This test verifies the sequence number checks using the maximum advertised window sequence number when net.ipv4.tcp_shrink_window is enabled. Signed-off-by: Simon Baatz Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-5-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski commit ec1adf8ecf9568a0581464b9a86603c9a4287ce6 Author: Simon Baatz Date: Mon Mar 9 09:02:29 2026 +0100 selftests/net: packetdrill: add tcp_rcv_wnd_shrink_nomem.pkt This test verifies - the sequence number checks using the maximum advertised window sequence number and - the logic for handling received data in tcp_data_queue() for the cases: 1. The window is reduced to zero because of memory 2. The window grows again but still does not reach the originally advertised window Signed-off-by: Simon Baatz Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-4-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski commit e2b9c52a2b00ca754def5597cbc07ad401457974 Author: Simon Baatz Date: Mon Mar 9 09:02:28 2026 +0100 tcp: increase LINUX_MIB_BEYOND_WINDOW for SKB_DROP_REASON_TCP_OVERWINDOW Since commit 9ca48d616ed7 ("tcp: do not accept packets beyond window"), the path leading to SKB_DROP_REASON_TCP_OVERWINDOW in tcp_data_queue() is probably dead. However, it can be reached now when tcp_max_receive_window() is larger than tcp_receive_window(). In that case, increment LINUX_MIB_BEYOND_WINDOW as done in tcp_sequence(). Signed-off-by: Simon Baatz Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-3-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski commit 81714374a29cbaca7e23d9229296515027e355cb Author: Simon Baatz Date: Mon Mar 9 09:02:27 2026 +0100 mptcp: keep rcv_mwnd_seq in sync with subflow rcv_wnd MPTCP shares a receive window across subflows and applies it at the subflow level by adjusting each subflow's rcv_wnd when needed. With the new TCP tracking of the maximum advertised window sequence, rcv_mwnd_seq must stay consistent with these subflow-level rcv_wnd adjustments. Signed-off-by: Simon Baatz Reviewed-by: Eric Dumazet Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-2-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski commit 0e24d17bd9668f9dad78ede6a0e8f13dab176682 Author: Simon Baatz Date: Mon Mar 9 09:02:26 2026 +0100 tcp: implement RFC 7323 window retraction receiver requirements By default, the Linux TCP implementation does not shrink the advertised window (RFC 7323 calls this "window retraction") with the following exceptions: - When an incoming segment cannot be added due to the receive buffer running out of memory. Since commit 8c670bdfa58e ("tcp: correct handling of extreme memory squeeze") a zero window will be advertised in this case. It turns out that reaching the required memory pressure is easy when window scaling is in use. In the simplest case, sending a sufficient number of segments smaller than the scale factor to a receiver that does not read data is enough. - Commit b650d953cd39 ("tcp: enforce receive buffer memory limits by allowing the tcp window to shrink") addressed the "eating memory" problem by introducing a sysctl knob that allows shrinking the window before running out of memory. However, RFC 7323 does not only state that shrinking the window is necessary in some cases, it also formulates requirements for TCP implementations when doing so (Section 2.4). This commit addresses the receiver-side requirements: After retracting the window, the peer may have a snd_nxt that lies within a previously advertised window but is now beyond the retracted window. This means that all incoming segments (including pure ACKs) will be rejected until the application happens to read enough data to let the peer's snd_nxt be in window again (which may be never). To comply with RFC 7323, the receiver MUST honor any segment that would have been in window for any ACK sent by the receiver and, when window scaling is in effect, SHOULD track the maximum window sequence number it has advertised. This patch tracks that maximum window sequence number rcv_mwnd_seq throughout the connection and uses it in tcp_sequence() when deciding whether a segment is acceptable. rcv_mwnd_seq is updated together with rcv_wup and rcv_wnd in tcp_select_window(). If we count tcp_sequence() as fast path, it is read in the fast path. Therefore, rcv_mwnd_seq is put into rcv_wnd's cacheline group. The logic for handling received data in tcp_data_queue() is already sufficient and does not need to be updated. Signed-off-by: Simon Baatz Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260309-tcp_rfc7323_retract_wnd_rfc-v3-1-4c7f96b1ec69@gmail.com Signed-off-by: Jakub Kicinski commit 0e46cb553f35517f9ac946de0f1a2cfab7c156b6 Merge: cb9487333652b2 c2c185be5c85d3 Author: Jens Axboe Date: Sat Mar 14 08:57:15 2026 -0600 Merge branch 'io_uring-7.0' into for-7.1/io_uring Merge upstream io_uring fixes to avoid conflicts in later patches. * io_uring-7.0: io_uring/kbuf: check if target buffer list is still legacy on recycle io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops io_uring/eventfd: use ctx->rings_rcu for flags checking io_uring: ensure ctx->rings is stable for task work flags manipulation io_uring/bpf_filter: use bpf_prog_run_pin_on_cpu() to prevent migration io_uring/register: fix comment about task_no_new_privs commit aa5903b47d4bc0e7d1fb76941731cbda32ef9cbc Author: Thomas Weißschuh Date: Sat Mar 14 13:15:38 2026 +0100 xtensa: uapi: Reuse asm-generic ucontext.h Drop the custom non-uapi definition which is the same as the generic uapi one. Signed-off-by: Thomas Weißschuh Message-ID: <20260314-uapi-ucontext-xtensa-v1-1-08dceca7e6a2@weissschuh.net> [Max: Move new generic-y line to the arch/xtensa/include/uapi/asm/Kbuild] Signed-off-by: Max Filippov commit 5d540162059598c3f79e12f96064825cc91f0f9c Author: Caleb Sander Mateos Date: Fri Mar 13 07:47:01 2026 -0700 ublk: report BLK_SPLIT_INTERVAL_CAPABLE The ublk driver doesn't access request integrity buffers directly, it only copies them to/from the ublk server in ublk_copy_user_integrity(). ublk_copy_user_integrity() uses bio_for_each_integrity_vec() to walk all the integrity segments. ublk devices are therefore capable of handling requests with integrity intervals split across segments. Set BLK_SPLIT_INTERVAL_CAPABLE in the struct blk_integrity flags for ublk devices to opt out of the integrity-interval dma_alignment limit. Reviewed-by: Ming Lei Reviewed-by: Keith Busch Reviewed-by: Martin K. Petersen Signed-off-by: Caleb Sander Mateos Signed-off-by: Keith Busch Link: https://patch.msgid.link/20260313144701.1221652-3-kbusch@meta.com Signed-off-by: Jens Axboe commit 203247c5cb972af5d46bdb7d41ef40078048810b Author: Keith Busch Date: Fri Mar 13 07:47:00 2026 -0700 blk-integrity: support arbitrary buffer alignment A bio segment may have partial interval block data with the rest continuing into the next segments because direct-io data payloads only need to align in memory to the device's DMA limits. At the same time, the protection information may also be split in multiple segments. The most likely way that may happen is if two requests merge, or if we're directly using the io_uring user metadata. The generate/verify, however, only ever accessed the first bip_vec. Further, it may be possible to unalign the protection fields from the user space buffer, or if there are odd additional opaque bytes in front or in back of the protection information metadata region. Change up the iteration to allow spanning multiple segments. This patch is mostly a re-write of the protection information handling to allow any arbitrary alignments, so it's probably easier to review the end result rather than the diff. Many controllers are not able to handle interval data composed of multiple segments when PI is used, so this patch introduces a new integrity limit that a low level driver can set to notify that it is capable, default to false. The nvme driver is the first one to enable it in this patch. Everyone else will force DMA alignment to the logical block size as before to ensure interval data is always aligned within a single segment. Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch Link: https://patch.msgid.link/20260313144701.1221652-2-kbusch@meta.com Signed-off-by: Jens Axboe commit dc33ae50d32b509af5ae61030912fa20c79ef112 Merge: 16de94a1b09086 bb729bf1d6fdf5 Author: Danilo Krummrich Date: Sat Mar 14 14:21:23 2026 +0100 Merge tag 'device_lock_cond_guard-7.1-rc1' into driver-core-testing DEFINE_GUARD_COND() for device_lock_interruptible() Introduce conditional guard version of device_lock() for scenarios that require conditional device lock holding. This is a stable tag for other trees to merge. Signed-off-by: Danilo Krummrich commit ff0843ceb1fb11a6b73e0e77b932ef7967aecd4b Author: David Lechner Date: Sat Mar 7 15:54:37 2026 -0600 iio: adc: ti-ads7950: remove chip_info[] Remove the chip_info[] array and related enum used for looking up chip- specific information. Instead, use individual structs directly in the module device tables. Also update to use spi_get_device_match_data() in case the devicetree table is ever used instead of the SPI device ID table. Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron commit c48012d519fe72fb82786d53930b2b907bf7c10c Author: Giorgi Tchankvetadze Date: Sat Mar 7 17:02:14 2026 +0400 iio: adc: palmas_gpadc: Replace leading space indentation with tabs Fix lines starting with spaces instead of tabs to comply with the kernel coding style. No functional change. Signed-off-by: Giorgi Tchankvetadze Signed-off-by: Jonathan Cameron commit 594ca8ced1b380309f3a23e2a77d8846ec5fd025 Author: Rajveer Chaudhari Date: Sat Mar 7 17:19:12 2026 +0530 iio: accel: adxl372: convert to guard(mutex) Replace manual mutex_lock/mutex_unlock pair with guard(mutex) in adxl372_write_threshold_value(). This ensures the mutex is released on all return paths and allows returning directly without a goto label. Signed-off-by: Rajveer Chaudhari Signed-off-by: Jonathan Cameron commit c4e73728626e9930ecbb14b9cb2418d36feeefe4 Author: Rajveer Chaudhari Date: Sat Mar 7 17:19:11 2026 +0530 iio: accel: adxl313: convert to guard(mutex) Replace manual mutex_lock/mutex_unlock pair with guard(mutex) in adxl313_read_axis(). This ensures the mutex is released on all return paths and allows returning directly without a goto label. Signed-off-by: Rajveer Chaudhari Signed-off-by: Jonathan Cameron commit 9a2e1233d38c460ad07f36901931f3674a32d1ed Author: Nuno Sá Date: Tue Mar 3 11:50:44 2026 +0000 iio: buffer: hw-consumer: remove redundant scan_mask flexible array The scan_mask flexible array member in hw_consumer_buffer duplicates the scan_mask pointer already present in struct iio_buffer. Remove it and allocate the bitmap directly with bitmap_zalloc(), assigning it to buf->buffer.scan_mask. This simplifies the code and there's no need for the flex array allocation. Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit d6f2eac6440329d8c1d981b907b9ecd325ee3d2f Author: Rosen Penev Date: Tue Mar 3 20:17:16 2026 -0800 iio: adc: meson: no devm for nvmem_cell_get There is no reason to extend the lifetime of this post removal of the driver when it's only needed in one spot. Moved tsc_regmap assignment to avoid two nvmem_cell_put calls. Signed-off-by: Rosen Penev Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 8d8613036491f1057b1eeca4e4b2c41d8d465a63 Author: Rosen Penev Date: Tue Mar 3 20:18:43 2026 -0800 iio: adc: at91-sama5d2_adc: no devm for nvmem_cell_get There is absolutely no reason to pospone cleanup of this post driver removal. Just do it immediately. Signed-off-by: Rosen Penev Reviewed-by: Nuno Sá Reviewed-by: Eugen Hristev Signed-off-by: Jonathan Cameron commit d4243cb08a272b6cc0f7c8293f9c7e128b51795c Author: Rafael J. Wysocki Date: Wed Mar 4 19:33:14 2026 +0100 iio: light: acpi-als: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the ACPI ambient light sensor driver to a platform one. After this change, the subordinate IIO device will be registered under the platform device used for driver binding instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 1653e0897f1526acfb6d041d4920ebc6a3c3b028 Author: Rafael J. Wysocki Date: Wed Mar 4 19:32:26 2026 +0100 iio: light: acpi-als: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit aac0a51b16700b403a55b67ba495de021db78763 Author: Antoniu Miclaus Date: Thu Mar 5 11:14:48 2026 +0200 iio: frequency: admv1013: fix NULL pointer dereference on str When device_property_read_string() fails, str is left uninitialized but the code falls through to strcmp(str, ...), dereferencing a garbage pointer. Replace manual read/strcmp with device_property_match_property_string() and consolidate the SE mode enums into a single sequential enum, mapping to hardware register values via a switch consistent with other bitfields in the driver. Several cleanup patches have been applied to this driver recently so this will need a manual backport. Fixes: da35a7b526d9 ("iio: frequency: admv1013: add support for ADMV1013") Reviewed-by: Nuno Sá Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit af2f069b78950910ec7932a21544faad5ad8b13f Author: Giorgi Tchankvetadze Date: Sat Mar 7 11:15:56 2026 +0400 iio: adc: max1363: Reformat enum and array initializers Reformat the device enum so each entry is on its own line and add a trailing comma to the final enumerator. Also reformat the nearby monitor speeds array for consistency. No functional change. Signed-off-by: Giorgi Tchankvetadze Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 2dc1b0dd4bbfa2a27e5432300d1c18eb51c7efed Author: Thorsten Blum Date: Wed Mar 11 17:42:14 2026 +0100 thermal: sysfs: Use str_enabled_disabled() helper in mode_show() Replace hard-coded strings with the str_enabled_disabled() helper. This unifies the output and helps the linker with deduplication, which may result in a smaller binary. Signed-off-by: Thorsten Blum [ rjw: Subject and changelog tweaks ] Link: https://patch.msgid.link/20260311164212.405981-3-thorsten.blum@linux.dev Signed-off-by: Rafael J. Wysocki commit 16de94a1b090864637c12bc6207e18d82d1972a1 Author: T.J. Mercier Date: Fri Mar 13 10:51:53 2026 -0700 kernfs: Add missing documentation for kernfs_put_active's drop_supers argument The drop_supers argument was added to kernfs_put_active to control whether the kernfs_supers_rwsem is temporarily dropped along with the kernfs_rwsem, but no documentation was added for it. Fixes: eea5d2bb34ba ("kernfs: Send IN_DELETE_SELF and IN_IGNORED") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603130112.2FcCzv1g-lkp@intel.com/ Signed-off-by: T.J. Mercier Link: https://patch.msgid.link/20260313175153.235681-1-tjmercier@google.com Signed-off-by: Greg Kroah-Hartman commit c9da2648790306176171ab4ac2e4db95d79f3923 Merge: f699a3c258dd2d 3ac4e6b92fc200 Author: Krzysztof Kozlowski Date: Sat Mar 14 12:10:17 2026 +0100 Merge tag 'renesas-dt-bindings-for-v7.1-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas DT binding updates for v7.1 - Document RZ/G3L SoC variants, the RZ/G3L SYSC block, and RZ/G3L SMARC SoM and Carrier-II EVK boards. * tag 'renesas-dt-bindings-for-v7.1-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: dt-bindings: soc: renesas: renesas,rzg2l-sysc: Document RZ/G3L SoC dt-bindings: soc: renesas: Document RZ/G3L SoC variants, SMARC SoM and Carrier-II EVK Signed-off-by: Krzysztof Kozlowski commit f699a3c258dd2d2b502230b2419026d8bb802959 Merge: 6de23f81a5e08b b1de9823fdc67a Author: Krzysztof Kozlowski Date: Sat Mar 14 12:05:56 2026 +0100 Merge tag 'renesas-drivers-for-v7.1-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v7.1 - Initial support for the Renesas RZ/G3L (R9A08G046) SoC. * tag 'renesas-drivers-for-v7.1-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: rz-sysc: Add SoC identification for RZ/G3L SoC Signed-off-by: Krzysztof Kozlowski commit bb57e36b0a30d9fa479ef65370b01493981cb033 Merge: 6de23f81a5e08b 8c6cccefb33e20 Author: Krzysztof Kozlowski Date: Sat Mar 14 12:05:03 2026 +0100 Merge tag 'renesas-arm-defconfig-for-v7.1-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/defconfig Renesas ARM defconfig updates for v7.1 - Refresh the ARM SH-Mobile defconfig for v7.0-rc1. * tag 'renesas-arm-defconfig-for-v7.1-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: ARM: shmobile: defconfig: Refresh for v7.0-rc1 Signed-off-by: Krzysztof Kozlowski commit 9124e0e8f3fa39b32feb5cb756de10a265e9d8f0 Author: Manaf Meethalavalappu Pallikunhi Date: Fri Mar 13 16:04:17 2026 +0530 dt-bindings: thermal: qcom-tsens: Document the SM8750 Temperature Sensor Document the Temperature Sensor (TSENS) on the SM8750 SoC. Signed-off-by: Manaf Meethalavalappu Pallikunhi Signed-off-by: Gaurav Kohli Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260313-sm8750_tsens-v1-1-250fcc3794a2@oss.qualcomm.com Signed-off-by: Daniel Lezcano commit c959218c6533cf7e373cb5ccddb93f582ee5d47b Author: Cheng-Yang Chou Date: Sat Mar 14 12:20:51 2026 +0800 sched_ext/selftests: Fix incorrect include guard comments Fix two mismatched closing comments in header include guards: - util.h: closing comment says __SCX_TEST_H__ but the guard is __SCX_TEST_UTIL_H__ - exit_test.h: closing comment has a spurious '#' character before the guard name Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit e36bc38ebfac95ecd088d4bc0ceb3ffcef2ebdfa Author: Cheng-Yang Chou Date: Sat Mar 14 09:39:34 2026 +0800 sched_ext: Fix uninitialized ret in scx_alloc_and_add_sched() Under CONFIG_EXT_SUB_SCHED, the kzalloc() and kstrdup() failure paths jump to err_stop_helper without first setting ret. The function then returns ERR_PTR(ret) with ret uninitialized, which can produce ERR_PTR(0) (NULL), causing the caller's IS_ERR() check to pass and leading to a NULL pointer dereference. Set ret = -ENOMEM before each goto to fix the error path. Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 12b49dd15e4bf4e906759ac445797ba2213e52dd Author: Andrea Righi Date: Sat Mar 14 07:51:04 2026 +0100 selftests/sched_ext: Update scx_bpf_dsq_move_to_local() in kselftests After commit 860683763ebf ("sched_ext: Add enq_flags to scx_bpf_dsq_move_to_local()") some of the kselftests are failing to build: exit.bpf.c:44:34: error: too few arguments provided to function-like macro invocation 44 | scx_bpf_dsq_move_to_local(DSQ_ID); Update the kselftests adding the new argument to scx_bpf_dsq_move_to_local(). Fixes: 860683763ebf ("sched_ext: Add enq_flags to scx_bpf_dsq_move_to_local()") Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 79ac1c945ab885369a840da014ebc6fcde8e2ae2 Author: Chen-Yu Tsai Date: Tue Mar 10 00:56:33 2026 +0800 drm/sun4i: layers: Use drm_fb_dma_get_gem_addr() to get display memory Commit 4636ce93d5b2 ("drm/fb-cma-helper: Add drm_fb_cma_get_gem_addr()") adds a new helper, which covers fetching a drm_framebuffer's GEM object and calculating the buffer address for a given plane. This patch uses this helper to replace our own open coded version of the same function. Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20260309165635.1138413-1-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 127367ad2e0f4870de60c6d719ae82ecf68d674c Author: Ethan Tidmore Date: Thu Feb 26 10:38:36 2026 -0600 drm/sun4i: Fix resource leaks Three clocks are not being released in devm_regmap_init_mmio() error path. Add proper goto and set ret to the error code. Fixes: 8270249fbeaf0 ("drm/sun4i: backend: Create regmap after access is possible") Signed-off-by: Ethan Tidmore Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20260226163836.10335-1-ethantidmore06@gmail.com Signed-off-by: Chen-Yu Tsai commit b912e48bee355b6b1faf86efc4a23191324ffecb Author: Jun Yan Date: Wed Mar 4 15:34:30 2026 +0800 arm64: dts: allwinner: h6: Add TaiqiCat (TQC) A01 support TaiqiCat (TQC) A01 is a set-top box powered by an Allwinner H6 SoC, equipped with an AXP305 PMIC, 1GB LPDDR3 RAM, 8GB eMMC, an AP6212 WiFi/BT combo module, one 100M Ethernet port, one USB 3.0 Type-A port, one USB 2.0 Type-A port, one Micro USB port, HDMI, SPDIF, Micro-SD, and infrared input. It was released by Ultrapower(UQSoft) as a blockchain-based terminal and is now discontinued and no longer supported. https://web.archive.org/web/20190409213228/https://tq.ultrapower.com.cn/product.html Hardware schematics are not available at this time; however, the dts from the vendor firmware is provided for reference [1]. Based on the PCB silkscreen marking "AZW-KT02 2.0", the ODM/OEM can be confirmed as AZW, and the overall hardware circuit design is highly similar to the Beelink GS1. Tested, works: - debug UART - status LED - USB 3.0 Type-A port - USB 2.0 Type-A port - Micro USB port (Host) - MicroSD - eMMC - WiFi/Bluetooth - HDMI video output Does not work: - Ethernet (requires AC200 MFD/EPHY driver) - HDMI audio Untested: - SPDIF - IR receiver [1] https://archive.org/download/tqc-a01-stock-fw/tqc-a01-stock-fw.dts Signed-off-by: Jun Yan Reviewed-by: Andre Przywara Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20260304073430.438835-4-jerrysteve1101@gmail.com Signed-off-by: Chen-Yu Tsai commit f3208874f32c09dfc9ee330204f9fccf26e15b57 Author: Jun Yan Date: Wed Mar 4 15:34:29 2026 +0800 dt-bindings: arm: sunxi: Add TaiqiCat (TQC) A01 TaiqiCat (TQC) A01 is a set-top box powered by an Allwinner H6 SoC, equipped with an AXP305 PMIC, 1GB LPDDR3 RAM, 8GB eMMC, an AP6212 WiFi/BT combo module, one 100M Ethernet port, one USB 3.0 Type-A port, one USB 2.0 Type-A port, one Micro USB port, HDMI, SPDIF, Micro-SD, and infrared input. It is a blockchain-based terminal product launched by UQSoft (Beijing UQSoft Interactive Technology Co., Ltd.), a wholly-owned subsidiary of Ultrapower. Its dedicated product homepage[1] was once hosted on Ultrapower’s official website[2]. It should be noted that UQSoft's official website[3] is no longer operational, and the company appears to have been discontinued. [1] https://web.archive.org/web/20190409213228/https://tq.ultrapower.com.cn/product.html [2] https://www.ultrapower.com.cn [3] http://www.uqsoft.com Signed-off-by: Jun Yan Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260304073430.438835-3-jerrysteve1101@gmail.com Signed-off-by: Chen-Yu Tsai commit b4137a75e1e611f37fcdc74c1d41696c7971e0b8 Author: Jun Yan Date: Wed Mar 4 15:34:28 2026 +0800 dt-bindings: vendor-prefixes: Add Beijing Ultrapower Software Co., Ltd. Beijing Ultrapower Software Co., Ltd. is a company focusing on global mobile games, ICT services, cloud computing, and artificial intelligence solutions. TaiqiCat A01 is a blockchain-based terminal product launched by UQSoft (Beijing UQSoft Interactive Technology Co., Ltd.), a wholly-owned subsidiary of Ultrapower. Its dedicated product homepage[1] was once hosted on Ultrapower’s official website[2]. It should be noted that UQSoft's official website[3] is no longer operational, and the company appears to have been discontinued. [1] https://web.archive.org/web/20190409213228/https://tq.ultrapower.com.cn/product.html [2] https://www.ultrapower.com.cn [3] http://www.uqsoft.com Signed-off-by: Jun Yan Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260304073430.438835-2-jerrysteve1101@gmail.com Signed-off-by: Chen-Yu Tsai commit 03170b8f84354f1649a757e57c2130e1de237f5d Author: Saeed Mirzamohammadi Date: Mon Mar 2 16:06:40 2026 -0800 crypto: tcrypt - stop ahash speed tests when setkey fails The async hash speed path ignores the return code from crypto_ahash_setkey(). If the caller picks an unsupported key length, the transform keeps whatever key state it already has and the speed test still runs, producing misleading numbers, hence bail out of the loop when setkey fails. Signed-off-by: Saeed Mirzamohammadi Signed-off-by: Herbert Xu commit 32e76e3757e89f370bf2ac8dba8aeb133071834e Author: Saeed Mirzamohammadi Date: Mon Mar 2 15:59:14 2026 -0800 crypto: tcrypt - clamp num_mb to avoid divide-by-zero Passing num_mb=0 to the multibuffer speed tests leaves test_mb_aead_cycles() and test_mb_acipher_cycles() dividing by (8 * num_mb). With sec=0 (the default), the module prints "1 operation in ..." and hits a divide-by-zero fault. Force num_mb to at least 1 during module init and warn the caller so the warm-up loop and the final report stay well-defined. To reproduce: sudo modprobe tcrypt mode=600 num_mb=0 Signed-off-by: Saeed Mirzamohammadi Signed-off-by: Herbert Xu commit 3ac949881396361b6462a717f6cbbd97f368af02 Author: Tycho Andersen (AMD) Date: Mon Mar 2 08:02:24 2026 -0700 include/psp-sev.h: fix structure member in comment The member is 'data', not 'opaque'. Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Tom Lendacky Signed-off-by: Herbert Xu commit 35a89319f60a48fb8cd07617f8e2c4649edbe361 Author: Tycho Andersen (AMD) Date: Mon Mar 2 08:02:23 2026 -0700 crypto: ccp - simplify sev_update_firmware() sev_do_cmd() has its own command buffer (sev->cmd_buf) with the correct alignment, perms, etc. that it copies the command into, so prepending it to the firmware data is unnecessary. Switch sev_update_firmware() to using a stack allocated command in light of this copy, and drop all of the resulting pointer math. Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Tom Lendacky Signed-off-by: Herbert Xu commit d23cf35880114a1ad24efc262577e494ebfa0c23 Author: Thorsten Blum Date: Mon Mar 2 12:34:53 2026 +0100 crypto: qce - Remove return variable and unused assignments In qce_aead_done(), the return variable 'ret' is no longer used - remove it. And qce_aead_prepare_dst_buf() jumps directly to 'dst_tbl_free:' on error and returns 'sg' - drop the useless 'ret' assignments. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 25ab621f7de76fbcd6bfeb8915f8882785323674 Author: Robert Marko Date: Mon Mar 2 12:20:10 2026 +0100 dt-bindings: rng: atmel,at91-trng: add microchip,lan9691-trng Document Microchip LAN969X TRNG compatible. Signed-off-by: Robert Marko Acked-by: Conor Dooley Reviewed-by: Claudiu Beznea Signed-off-by: Herbert Xu commit bb41fcef5c7932e61ce87f573497ab0472cfe496 Merge: 2af3aa702c05ec 0a753d8cd61e31 Author: Alexei Starovoitov Date: Fri Mar 13 19:09:35 2026 -0700 Merge branch 'optimize-bounds-refinement-by-reordering-deductions' Paul Chaignon says: ==================== Optimize bounds refinement by reordering deductions This patchset optimizes the bounds refinement (reg_bounds_sync) by reordering deductions in __reg_deduce_bounds. This reordering allows us to improve precision slightly while losing one call to __reg_deduce_bounds. The first patch from Eduard refactors the __reg_deduce_bounds subfunctions, the second patch implements the reordering, and the last one adds a selftest. Changes in v3: - Added first commit from Eduard that significantly helps with readability of second commit. - Reshuffled a bit more the functions in the second commit to improve precision (Eduard). - Rebased. Changes in v2: - Updated description to mention potential precision improvement and to clarify the sequence of refinements (Shung-Hsi). - Added the second patch. - Rebased. ==================== Link: https://patch.msgid.link/cover.1773401138.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 0a753d8cd61e31cc438a4fc414cc01655d3f3b72 Author: Paul Chaignon Date: Fri Mar 13 12:43:07 2026 +0100 selftests/bpf: Test case for refinement improvement using 64b bounds This new selftest demonstrates the improvement of bounds refinement from the previous patch. It is inspired from a set of reg_bounds_sync inputs generated using CBMC [1] by Shung-Hsi: reg.smin_value=0x8000000000000002 reg.smax_value=2 reg.umin_value=2 reg.umax_value=19 reg.s32_min_value=2 reg.s32_max_value=3 reg.u32_min_value=2 reg.u32_max_value=3 reg_bounds_sync returns R=[2; 3] without the previous patch, and R=2 with it. __reg64_deduce_bounds is able to derive that u64=2, but before the previous patch, those bounds are overwritten in __reg_deduce_mixed_bounds using the 32bits bounds. To arrive to these reg_bounds_sync inputs, we bound the 32bits value first to [2; 3]. We can then upper-bound s64 without impacting u64. At that point, the refinement to u64=2 doesn't happen because the ranges still overlap in two points: 0 umin=2 umax=0xff..ff00..03 U64_MAX | [xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx] | |----------------------------|------------------------------| |xx] [xxxxxxxxxxxxxxxxxxxxxxxxxxxx| 0 smax=2 smin=0x800..02 -1 With an upper-bound check at value 19, we can reach the above inputs for reg_bounds_sync. At that point, the refinement to u64=2 happens and because it isn't overwritten by __reg_deduce_mixed_bounds anymore, reg_bounds_sync returns with reg=2. The test validates this result by including an illegal instruction in the (dead) branch reg != 2. Link: https://github.com/shunghsiyu/reg_bounds_sync-review/ [1] Co-developed-by: Shung-Hsi Yu Signed-off-by: Shung-Hsi Yu Signed-off-by: Paul Chaignon Tested-by: Eduard Zingerman Link: https://lore.kernel.org/r/622dc51c581cd4d652fff362188b2a5f73c1fe99.1773401138.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 9e5fcb003aec9cb3034cbf34a319682586f41788 Author: Paul Chaignon Date: Fri Mar 13 12:40:49 2026 +0100 bpf: Avoid one round of bounds deduction In commit 5dbb19b16ac49 ("bpf: Add third round of bounds deduction"), I added a new round of bounds deduction because two rounds were not enough to converge to a fixed point. This commit slightly refactor the bounds deduction logic such that two rounds are enough. In [1], Eduard noticed that after we improved the refinement logic, a third call to the bounds deduction (__reg_deduce_bounds) was needed to converge to a fixed point. More specifically, we needed this third call to improve the s64 range using the s32 range. We added the third call and postponed a more detailed analysis of the refinement logic. I've been looking into this more recently. The register refinement consists of the following calls. __update_reg_bounds(); 3 x __reg_deduce_bounds() { deduce_bounds_32_from_64(); deduce_bounds_32_from_32(); deduce_bounds_64_from_64(); deduce_bounds_64_from_32(); }; __reg_bound_offset(); __update_reg_bounds(); From this, we can observe that we first improve the 32bit ranges from the 64bit ranges in deduce_bounds_32_from_64, then improve the 64bit ranges on their own in deduce_bounds_64_from_64. Intuitively, if we were to improve the 64bit ranges on their own *before* we use them to improve the 32bit ranges, we may reach a fixed point earlier. In a similar manner, using CBMC, Eduard found that it's best to improve the 32bit ranges on their own *after* we've improve them using the 64bit ranges. That is, running deduce_bounds_32_from_32 after deduce_bounds_32_from_64. These changes allow us to lose one call to __reg_deduce_bounds. Without this reordering, the test "verifier_bounds/bounds deduction cross sign boundary, negative overlap" fails when removing one call to __reg_deduce_bounds. In some cases, this change can even improve precision a little bit, as illustrated in the new selftest in the next patch. As expected, this change didn't have any impact on the number of instructions processed when running it through the Cilium complexity test suite [2]. Link: https://lore.kernel.org/bpf/aIKtSK9LjQXB8FLY@mail.gmail.com/ [1] Link: https://pchaigno.github.io/test-verifier-complexity.html [2] Acked-by: Shung-Hsi Yu Co-developed-by: Eduard Zingerman Signed-off-by: Eduard Zingerman Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/1b00d2749ec4c774c3ada84e265ac7fda72cfe56.1773401138.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 879cace976671eea235d283bf5109a4e09d73a14 Author: Eduard Zingerman Date: Fri Mar 13 12:40:06 2026 +0100 bpf: better naming for __reg_deduce_bounds() parts This renaming will also help reshuffle the different parts in the subsequent patch. Signed-off-by: Eduard Zingerman Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/a988ecf2c57e265b97917136b14b421038534e8c.1773401138.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 9089c5f3c444ad6e9eb172e9375615ed0b0bc31c Author: Sagi Maimon Date: Thu Mar 12 10:20:03 2026 +0200 ptp: ocp: Add support for Xilinx-based Adva TimeCard variant Add support for the Adva TimeCard model built on a Xilinx-based design. This patch enables detection and integration of the new hardware within the existing OCP timecard framework. The Xilinx variant relies on the shared driver infrastructure, requiring only small, targeted additions to accommodate its specific characteristics. Signed-off-by: Sagi Maimon Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260312082009.249622-1-maimon.sagi@gmail.com Signed-off-by: Jakub Kicinski commit d6e0f04bf22d9b25b530c5e04f82664eac942719 Merge: 8f921f61005450 14ce9a47c5b749 Author: Jakub Kicinski Date: Fri Mar 13 18:57:48 2026 -0700 Merge branch 'udp-retire-udp-lite' Kuniyuki Iwashima says: ==================== udp: Retire UDP-Lite. In 2023, syzbot found a null-ptr-deref bug triggered when UDP-Lite attempted to charge an skb after the total memory usage for UDP-Lite _and_ UDP exceeded a system-wide threshold, net.ipv4.udp_mem[1]. Since this threshold is shared with UDP, the bug would have been easy to trigger if any real-world applications were using UDP-Lite; however, only syzbot ever stumbled upon it. The bug had persisted since 2016, suggesting that UDP-Lite had remained unused for 7 years at that point. The bug was fixed in commit ad42a35bdfc6 ("udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated()."), and we added another commit be28c14ac8bb ("udplite: Print deprecation notice.") to announce the deprecation plan. Since then, no one has complained, so it is time to officially retire UDP-Lite. This series first removes IPv6 and IPv4 UDP-Lite sockets, then gradually cleans up the remaining dead/unnecessary code within the UDP stack. By removing a bunch of conditionals for UDP-Lite from the fast path, udp_rr with 20,000 flows sees a 10% increase in pps (13.3 Mpps -> 14.7 Mpps) on an AMD EPYC 7B12 (Zen 2) 64-Core Processor platform. [ With FDO, the baseline is much higher and the delta was ~3%, 20.1 Mpps -> 20.7 Mpps ] Before: $ nstat > /dev/null; sleep 1; nstat | grep Udp Udp6InDatagrams 14013408 0.0 Udp6OutDatagrams 14013128 0.0 After: $ nstat > /dev/null; sleep 1; nstat | grep Udp Udp6InDatagrams 15491971 0.0 Udp6OutDatagrams 15491671 0.0 $ ./scripts/bloat-o-meter vmlinux.before vmlinux.after add/remove: 13/75 grow/shrink: 11/75 up/down: 13777/-18401 (-4624) Function old new delta udp4_gro_receive 872 866 -6 udp6_gro_receive 910 903 -7 udp_rcv 32 1727 +1695 udpv6_rcv 32 1450 +1418 __udp4_lib_rcv 2045 - -2045 __udp6_lib_rcv 2084 - -2084 udp_unicast_rcv_skb 160 149 -11 udp6_unicast_rcv_skb 196 181 -15 __udp4_lib_mcast_deliver 925 846 -79 __udp6_lib_mcast_deliver 922 810 -112 __udp4_lib_lookup 973 969 -4 __udp6_lib_lookup 940 929 -11 __udp4_lib_lookup_skb 106 100 -6 __udp6_lib_lookup_skb 71 66 -5 udp4_lib_lookup_skb 132 127 -5 udp6_lib_lookup_skb 87 81 -6 udp_queue_rcv_skb 326 356 +30 udpv6_queue_rcv_skb 331 361 +30 udp_queue_rcv_one_skb 1233 914 -319 udpv6_queue_rcv_one_skb 1250 930 -320 __udp_enqueue_schedule_skb 1067 995 -72 udp_rcv_segment 520 480 -40 udp_post_segment_fix_csum 120 - -120 udp_lib_checksum_complete 200 84 -116 udp_err 27 1103 +1076 udpv6_err 36 1417 +1381 __udp4_lib_err 1112 - -1112 __udp6_lib_err 1448 - -1448 udp_recvmsg 1149 994 -155 udpv6_recvmsg 1349 1294 -55 udp_sendmsg 2730 2648 -82 udp_send_skb 909 681 -228 udpv6_sendmsg 3022 2861 -161 udp_v6_send_skb 1214 952 -262 ... Total: Before=18446744073748075501, After=18446744073748070877, chg -0.00% ==================== Link: https://patch.msgid.link/20260311052020.1213705-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 14ce9a47c5b7497193cb4fdf9980b847482bd289 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:20:02 2026 +0000 udp: Don't pass proto to __udp4_lib_rcv() and __udp6_lib_rcv(). UDP and UDP-Lite shared __udp4_lib_rcv() and __udp6_lib_rcv() by passing IPPROTO_UDP or IPPROTO_UDPLITE. Now, @proto is always IPPROTO_UDP. Let's not pass it and rename the functions accordingly. With this series removing a bunch of conditionals for UDP-Lite from the fast path, udp_rr with 20,000 flows sees a 10% increase in pps (13.3 Mpps -> 14.7 Mpps) on an AMD EPYC 7B12 (Zen 2) 64-Core Processor platform. [ With FDO, the baseline is much higher and the delta was ~3%, 20.1 Mpps -> 20.7 Mpps ] Before: $ nstat > /dev/null; sleep 1; nstat | grep Udp Udp6InDatagrams 14013408 0.0 Udp6OutDatagrams 14013128 0.0 After: $ nstat > /dev/null; sleep 1; nstat | grep Udp Udp6InDatagrams 15491971 0.0 Udp6OutDatagrams 15491671 0.0 $ ./scripts/bloat-o-meter vmlinux.before vmlinux.after add/remove: 13/75 grow/shrink: 11/75 up/down: 13777/-18401 (-4624) Function old new delta udp4_gro_receive 872 866 -6 udp6_gro_receive 910 903 -7 udp_rcv 32 1727 +1695 udpv6_rcv 32 1450 +1418 __udp4_lib_rcv 2045 - -2045 __udp6_lib_rcv 2084 - -2084 udp_unicast_rcv_skb 160 149 -11 udp6_unicast_rcv_skb 196 181 -15 __udp4_lib_mcast_deliver 925 846 -79 __udp6_lib_mcast_deliver 922 810 -112 __udp4_lib_lookup 973 969 -4 __udp6_lib_lookup 940 929 -11 __udp4_lib_lookup_skb 106 100 -6 __udp6_lib_lookup_skb 71 66 -5 udp4_lib_lookup_skb 132 127 -5 udp6_lib_lookup_skb 87 81 -6 udp_queue_rcv_skb 326 356 +30 udpv6_queue_rcv_skb 331 361 +30 udp_queue_rcv_one_skb 1233 914 -319 udpv6_queue_rcv_one_skb 1250 930 -320 __udp_enqueue_schedule_skb 1067 995 -72 udp_rcv_segment 520 480 -40 udp_post_segment_fix_csum 120 - -120 udp_lib_checksum_complete 200 84 -116 udp_err 27 1103 +1076 udpv6_err 36 1417 +1381 __udp4_lib_err 1112 - -1112 __udp6_lib_err 1448 - -1448 udp_recvmsg 1149 994 -155 udpv6_recvmsg 1349 1294 -55 udp_sendmsg 2730 2648 -82 udp_send_skb 909 681 -228 udpv6_sendmsg 3022 2861 -161 udp_v6_send_skb 1214 952 -262 ... Total: Before=18446744073748075501, After=18446744073748070877, chg -0.00% Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-16-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 68aeb21ef0e183ff3675fb82e22573e959505f95 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:20:01 2026 +0000 udp: Don't pass udptable to IPv4 socket lookup functions. Since UDP and UDP-Lite had dedicated socket hash tables for each, we have had to pass the pointer down to many socket lookup functions. UDP-Lite gone, and we do not need to do that. Let's fetch net->ipv4.udp_table only where needed in IPv4 stack: __udp4_lib_lookup(), __udp4_lib_mcast_deliver(), and udp_diag_dump(). Some functions are renamed as the wrapper functions are no longer needed. __udp4_lib_err() -> udp_err() __udp_diag_destroy() -> udp_diag_destroy() udp_dump_one() -> udp_diag_dump_one() udp_dump() -> udp_diag_dump() Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-15-kuniyu@google.com Signed-off-by: Jakub Kicinski commit deffb85478a4076226f0213c7b9f7b7cf5dfe9f8 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:20:00 2026 +0000 udp: Don't pass udptable to IPv6 socket lookup functions. Since UDP and UDP-Lite had dedicated socket hash tables for each, we have had to pass the pointer down to many socket lookup functions. UDP-Lite gone, and we do not need to do that. Let's fetch net->ipv4.udp_table only where needed in IPv6 stack: __udp6_lib_lookup() and __udp6_lib_mcast_deliver(). __udp6_lib_err() is renamed to udpv6_err() as its wrapper is no longer needed. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-14-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 5a88b2810f267893e4b34f3044a9e11f952f03d9 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:59 2026 +0000 udp: Remove dead check in __udp[46]_lib_lookup() for BPF. BPF socket lookup for SO_REUSEPORT does not support UDP-Lite. In __udp4_lib_lookup() and __udp6_lib_lookup(), it checks if the passed udptable pointer is the same as net->ipv4.udp_table, which is only true for UDP. Now, the condition is always true. Let's remove the check. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-13-kuniyu@google.com Signed-off-by: Jakub Kicinski commit c570bd25d88a02c249be23850315435ec69808f5 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:58 2026 +0000 udp: Remove udp_table in struct udp_seq_afinfo. Since UDP and UDP-Lite had dedicated socket hash tables for each, we have had to fetch them from different pointers for procfs or bpf iterator. UDP always has its global or per-netns table in net->ipv4.udp_table and struct udp_seq_afinfo.udp_table is NULL. OTOH, UDP-Lite had only one global table in the pointer. We no longer use the field. Let's remove it and udp_get_table_seq(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-12-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 5c2738588621a4a53e3a1e87860abcaf9190194a Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:57 2026 +0000 udp: Remove struct proto.h.udp_table. Since UDP and UDP-Lite had dedicated socket hash tables for each, we have had to fetch them from different pointers. UDP always has its global or per-netns table in net->ipv4.udp_table and struct proto.h.udp_table is NULL. OTOH, UDP-Lite had only one global table in the pointer. We no longer use the field. Let's remove it and udp_get_table_prot(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-11-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 74f0cca1100b6d1f1ea28178435aff8078d06603 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:56 2026 +0000 udp: Remove UDPLITE_SEND_CSCOV and UDPLITE_RECV_CSCOV. UDP-Lite supports variable-length checksum and has two socket options, UDPLITE_SEND_CSCOV and UDPLITE_RECV_CSCOV, to control the checksum coverage. Let's remove the support. setsockopt(UDPLITE_SEND_CSCOV / UDPLITE_RECV_CSCOV) was only available for UDP-Lite and returned -ENOPROTOOPT for UDP. Now, the options are handled in ip_setsockopt() and ipv6_setsockopt(), which still return the same error. getsockopt(UDPLITE_SEND_CSCOV / UDPLITE_RECV_CSCOV) was available for UDP and always returned 0, meaning full checksum, but now -ENOPROTOOPT is returned. Given that getsockopt() is meaningless for UDP and even the options are not defined under include/uapi/, this should not be a problem. $ man 7 udplite ... BUGS Where glibc support is missing, the following definitions are needed: #define IPPROTO_UDPLITE 136 #define UDPLITE_SEND_CSCOV 10 #define UDPLITE_RECV_CSCOV 11 Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-10-kuniyu@google.com Signed-off-by: Jakub Kicinski commit b2a1d719be4f8e9d970038ecd4db983f6e42d377 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:55 2026 +0000 udp: Remove partial csum code in TX. UDP TX paths also have some code for UDP-Lite partial checksum: * udplite_csum() in udp_send_skb() and udp_v6_send_skb() * udplite_getfrag() in udp_sendmsg() and udpv6_sendmsg() Let's remove such code. Now, we can use IPPROTO_UDP directly instead of sk->sk_protocol or fl6->flowi6_proto for csum_tcpudp_magic() and csum_ipv6_magic(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-9-kuniyu@google.com Signed-off-by: Jakub Kicinski commit c2539d4f2df7a9889b71bad97b97ddfd9e47add1 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:54 2026 +0000 udp: Remove partial csum code in RX. UDP-Lite supports the partial checksum and the coverage is stored in the position of the length field of struct udphdr. In RX paths, udp4_csum_init() / udp6_csum_init() save the value in UDP_SKB_CB(skb)->cscov and set UDP_SKB_CB(skb)->partial_cov to 1 if the coverage is not full. The subsequent processing diverges depending on the value, but such paths are now dead. Also, these functions have some code guarded for UDP: * udp_unicast_rcv_skb / udp6_unicast_rcv_skb * __udp4_lib_rcv() and __udp6_lib_rcv(). Let's remove the partial csum code and the unnecessary guard for UDP-Lite in RX. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-8-kuniyu@google.com Signed-off-by: Jakub Kicinski commit b972cb5d397e0e9575d953a6c6b983c708de0326 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:53 2026 +0000 smack: Remove IPPROTO_UDPLITE support in security_sock_rcv_skb(). smack_socket_sock_rcv_skb() is registered as socket_sock_rcv_skb, which is called as security_sock_rcv_skb() in sk_filter_trim_cap(). Now that UDP-Lite is gone, let's remove the IPPROTO_UDPLITE support in smack_socket_sock_rcv_skb(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Acked-by: Casey Schaufler Link: https://patch.msgid.link/20260311052020.1213705-7-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 7accba6fd1ab60fb4f3a5c15c52d6fbb3af7f3a3 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:52 2026 +0000 udp: Remove UDP-Lite SNMP stats. Since UDP and UDP-Lite shared most of the code, we have had to check the protocol every time we increment SNMP stats. Now that the UDP-Lite paths are dead, let's remove UDP-Lite SNMP stats. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-6-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 56520b398e5e6ee129c6279d8649ca959765a0a0 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:51 2026 +0000 ipv4: Retire UDP-Lite. We have deprecated IPv6 UDP-Lite sockets. Let's drop support for IPv4 UDP-Lite sockets as well. Most of the changes are similar to the IPv6 patch: removing udplite.c and udp_impl.h, marking most functions in udp_impl.h as static, moving the prototype for udp_recvmsg() to udp.h, and adding INDIRECT_CALLABLE_SCOPE for it. In addition, the INET_DIAG support for UDP-Lite is dropped. We will remove the remaining dead code in the following patches. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 92586f02f8a52e0f02464445aa3d9697abe054fb Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:50 2026 +0000 ipv6: Remove UDP-Lite support for IPV6_ADDRFORM. We cannot create IPv6 UDP-Lite sockets anymore. Let's remove dead code in IPV6_ADDRFORM. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 62554a51c5844feebe0466d8b31980e110b481de Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:49 2026 +0000 ipv6: Retire UDP-Lite. As announced in commit be28c14ac8bb ("udplite: Print deprecation notice."), it's time to deprecate UDP-Lite. As a first step, let's drop support for IPv6 UDP-Lite sockets. We will remove the remaining dead code gradually. Along with the removal of udplite.c, most of the functions exposed via udp_impl.h are made static. The prototypes of udpv6_sendmsg() and udpv6_recvmsg() are moved to udp.h, but only udpv6_recvmsg() has INDIRECT_CALLABLE_DECLARE() because udpv6_sendmsg() is exported for rxrpc since commit ed472b0c8783 ("rxrpc: Call udp_sendmsg() directly"). Also, udpv6_recvmsg() needs INDIRECT_CALLABLE_SCOPE for CONFIG_MITIGATION_RETPOLINE=n. Note that udplite.h is included temporarily for udplite_csum(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 86a41d957ba058932d58c2d7729451afe8625ce9 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:19:48 2026 +0000 udp: Make udp[46]_seq_show() static. Since commit a3d2599b2446 ("ipv{4,6}/udp{,lite}: simplify proc registration"), udp4_seq_show() and udp6_seq_show() are not used in net/ipv4/udplite.c and net/ipv6/udplite.c. Instead, udp_seq_ops and udp6_seq_ops are exposed to UDP-Lite. Let's make udp4_seq_show() and udp6_seq_show() static. udp_seq_ops and udp6_seq_ops are moved to udp_impl.h so that we can make them static when the header is removed. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260311052020.1213705-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 4037c6adc1f99843b9076e7ced85db0f233e9eeb Author: Vishnu Saini Date: Tue Mar 3 22:13:36 2026 +0530 drm/bridge: add support for lontium lt8713sx bridge driver The lt8713sx is a Type-C/DP1.4 to DP1.4/HDMI2.0 converter, with three configurable DP1.4/HDMI2.0/DP++ output interfaces and audio output interface. Driver is required for firmware upgrade and enabling the bridge chip. Co-developed-by: Prahlad Valluru Signed-off-by: Prahlad Valluru Signed-off-by: Vishnu Saini Reviewed-by: Dmitry Baryshkov Cc: Simon Zhu Link: https://patch.msgid.link/20260303-lt8713sx-bridge-driver-v5-2-6cc2a855aafa@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 130daea1cb6217fb9b9ad51453e0a06e8111b3b2 Author: Vishnu Saini Date: Tue Mar 3 22:13:35 2026 +0530 dt-bindings: bridge: lt8713sx: Add bindings Add bindings for lt8713sx. Co-developed-by: Prahlad Valluru Signed-off-by: Prahlad Valluru Signed-off-by: Vishnu Saini Reviewed-by: Krzysztof Kozlowski Cc: Simon Zhu Link: https://patch.msgid.link/20260303-lt8713sx-bridge-driver-v5-1-6cc2a855aafa@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 192cb1f5cb1694c45b7cac14519d7bad65ba22f6 Author: Francois Dugast Date: Thu Mar 12 20:20:14 2026 +0100 drm/pagemap: Enable THP support for GPU memory migration This enables support for Transparent Huge Pages (THP) for device pages by using MIGRATE_VMA_SELECT_COMPOUND during migration. It removes the need to split folios and loop multiple times over all pages to perform required operations at page level. Instead, we rely on newly introduced support for higher orders in drm_pagemap and folio-level API. In Xe, this drastically improves performance when using SVM. The GT stats below collected after a 2MB page fault show overall servicing is more than 7 times faster, and thanks to reduced CPU overhead the time spent on the actual copy goes from 23% without THP to 80% with THP: Without THP: svm_2M_pagefault_us: 966 svm_2M_migrate_us: 942 svm_2M_device_copy_us: 223 svm_2M_get_pages_us: 9 svm_2M_bind_us: 10 With THP: svm_2M_pagefault_us: 132 svm_2M_migrate_us: 128 svm_2M_device_copy_us: 106 svm_2M_get_pages_us: 1 svm_2M_bind_us: 2 v2: - Fix one occurrence of drm_pagemap_get_devmem_page() (Matthew Brost) v3: - Remove migrate_device_split_page() and folio_split_lock, instead rely on free_zone_device_folio() to split folios before freeing (Matthew Brost) - Assert folio order is HPAGE_PMD_ORDER (Matthew Brost) - Always use folio_set_zone_device_data() in split (Matthew Brost) v4: - Warn on compound device page, s/continue/goto next/ (Matthew Brost) v5: - Revert warn on compound device page - s/zone_device_page_init()/zone_device_folio_init() (Matthew Brost) Cc: Matthew Brost Cc: Thomas Hellström Cc: Michal Mrozek Cc: Andrew Morton Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Cc: Zi Yan Cc: Alistair Popple Cc: Balbir Singh Cc: linux-mm@kvack.org Reviewed-by: Matthew Brost Signed-off-by: Francois Dugast Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260312192126.2024853-5-francois.dugast@intel.com commit 139ab31aea8a9436460568d556b432bb7e9311f7 Author: Matthew Brost Date: Thu Mar 12 20:20:13 2026 +0100 drm/pagemap: Correct cpages calculation for migrate_vma_setup cpages returned from migrate_vma_setup represents the total number of individual pages found, not the number of 4K pages. The math in drm_pagemap_migrate_to_devmem for npages is based on the number of 4K pages, so cpages != npages can fail even if the entire memory range is found in migrate_vma_setup (e.g., when a single 2M page is found). Add drm_pagemap_cpages, which converts cpages to the number of 4K pages found. Cc: Andrew Morton Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Cc: Zi Yan Cc: Alistair Popple Cc: Balbir Singh Cc: linux-mm@kvack.org Reviewed-by: Francois Dugast Signed-off-by: Francois Dugast Reviewed-by: Balbir Singh Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260312192126.2024853-4-francois.dugast@intel.com commit 2e03c0c5c59a086df534e15ddde03cb33bc475c4 Author: Francois Dugast Date: Thu Mar 12 20:20:12 2026 +0100 drm/pagemap: Add helper to access zone_device_data This new helper helps ensure all accesses to zone_device_data use the correct API whether the page is part of a folio or not. v2: - Move to drm_pagemap.h, stick to folio_zone_device_data (Matthew Brost) - Return struct drm_pagemap_zdd * (Matthew Brost) v3: - Add stub for !CONFIG_ZONE_DEVICE (CI) Cc: Andrew Morton Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Cc: Zi Yan Cc: Alistair Popple Cc: Balbir Singh Cc: linux-mm@kvack.org Suggested-by: Matthew Brost Reviewed-by: Matthew Brost Signed-off-by: Francois Dugast Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260312192126.2024853-3-francois.dugast@intel.com commit 440ec190c2fc06c368096df4862213f3f795db37 Author: Francois Dugast Date: Thu Mar 12 20:20:11 2026 +0100 drm/pagemap: Unlock and put folios when possible If the page is part of a folio, unlock and put the whole folio at once instead of individual pages one after the other. This will reduce the amount of operations once device THP are in use. Cc: Andrew Morton Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Cc: Zi Yan Cc: Alistair Popple Cc: Balbir Singh Cc: linux-mm@kvack.org Suggested-by: Matthew Brost Reviewed-by: Matthew Brost Signed-off-by: Francois Dugast Reviewed-by: Balbir Singh Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260312192126.2024853-2-francois.dugast@intel.com commit 4f3a998a173b4325c2efd90bdadc6ccd3ad9a431 Author: Matthew Brost Date: Tue Mar 10 18:50:39 2026 -0400 drm/xe: Open-code GGTT MMIO access protection GGTT MMIO access is currently protected by hotplug (drm_dev_enter), which works correctly when the driver loads successfully and is later unbound or unloaded. However, if driver load fails, this protection is insufficient because drm_dev_unplug() is never called. Additionally, devm release functions cannot guarantee that all BOs with GGTT mappings are destroyed before the GGTT MMIO region is removed, as some BOs may be freed asynchronously by worker threads. To address this, introduce an open-coded flag, protected by the GGTT lock, that guards GGTT MMIO access. The flag is cleared during the dev_fini_ggtt devm release function to ensure MMIO access is disabled once teardown begins. Cc: stable@vger.kernel.org Fixes: 919bb54e989c ("drm/xe: Fix missing runtime outer protection for ggtt_remove_node") Reviewed-by: Zhanjun Dong Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-8-zhanjun.dong@intel.com commit 9a9d960dce05b45b2a7dacd2c98d602480812a13 Author: Zhanjun Dong Date: Tue Mar 10 18:50:38 2026 -0400 drm/xe/uc: Drop xe_guc_sanitize in favor of managed cleanup If the firmware fails to load in GT resets the device is wedged also initiating a GuC state cleanup. Signed-off-by: Zhanjun Dong Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-7-zhanjun.dong@intel.com commit dace8cb0032f57ea67c87b3b92ad73c89dd2db44 Author: Zhanjun Dong Date: Tue Mar 10 18:50:37 2026 -0400 drm/xe/guc: Ensure CT state transitions via STOP before DISABLED The GuC CT state transition requires moving to the STOP state before entering the DISABLED state. Update the driver teardown sequence to make the proper state machine transitions. Fixes: ee4b32220a6b ("drm/xe/guc: Add devm release action to safely tear down CT") Cc: stable@vger.kernel.org Signed-off-by: Zhanjun Dong Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-6-zhanjun.dong@intel.com commit a7f607610da721f77db358b09be8091e60bd8e89 Author: Zhanjun Dong Date: Tue Mar 10 18:50:36 2026 -0400 drm/xe: Use XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET enum instead of magic number Replace the magic number 2 with the proper enum value XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET for better code readability and maintainability. Signed-off-by: Zhanjun Dong Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-5-zhanjun.dong@intel.com commit e25ba41c8227c5393c16e4aab398076014bd345f Author: Matthew Brost Date: Tue Mar 10 18:50:35 2026 -0400 drm/xe: Trigger queue cleanup if not in wedged mode 2 The intent of wedging a device is to allow queues to continue running only in wedged mode 2. In other modes, queues should initiate cleanup and signal all remaining fences. Fix xe_guc_submit_wedge to correctly clean up queues when wedge mode != 2. Fixes: 7dbe8af13c18 ("drm/xe: Wedge the entire device") Cc: stable@vger.kernel.org Reviewed-by: Zhanjun Dong Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-4-zhanjun.dong@intel.com commit a6ab444a111a59924bd9d0c1e0613a75a0a40b89 Author: Matthew Brost Date: Tue Mar 10 18:50:34 2026 -0400 drm/xe: Forcefully tear down exec queues in GuC submit fini In GuC submit fini, forcefully tear down any exec queues by disabling CTs, stopping the scheduler (which cleans up lost G2H), killing all remaining queues, and resuming scheduling to allow any remaining cleanup actions to complete and signal any remaining fences. Split guc_submit_fini into device related and software only part. Using device-managed and drm-managed action guarantees the correct ordering of cleanup. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Reviewed-by: Zhanjun Dong Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-3-zhanjun.dong@intel.com commit 78f3bf00be4f15daead02ba32d4737129419c902 Author: Matthew Brost Date: Tue Mar 10 18:50:33 2026 -0400 drm/xe: Always kill exec queues in xe_guc_submit_pause_abort xe_guc_submit_pause_abort is intended to be called after something disastrous occurs (e.g., VF migration fails, device wedging, or driver unload) and should immediately trigger the teardown of remaining submission state. With that, kill any remaining queues in this function. Fixes: 7c4b7e34c83b ("drm/xe/vf: Abort VF post migration recovery on failure") Cc: stable@vger.kernel.org Signed-off-by: Zhanjun Dong Reviewed-by: Stuart Summers Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-2-zhanjun.dong@intel.com commit 661f8a193d48d123aedcbd401ace137333d02523 Author: Barry Song Date: Sun Mar 1 06:13:37 2026 +0800 dma-mapping: Support batch mode for dma_direct_{map,unmap}_sg Extending these APIs with a flush argument: dma_direct_unmap_phys(), dma_direct_map_phys(), and dma_direct_sync_single_for_cpu(). For single-buffer cases, flush=true would be used, while for SG cases flush=false would be used, followed by a single flush after all cache operations are issued in dma_direct_{map,unmap}_sg(). This ultimately benefits dma_map_sg() and dma_unmap_sg(). Cc: Catalin Marinas Cc: Will Deacon Cc: Marek Szyprowski Cc: Robin Murphy Cc: Ada Couprie Diaz Cc: Ard Biesheuvel Cc: Marc Zyngier Cc: Anshuman Khandual Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Tangquan Zheng Reviewed-by: Leon Romanovsky Tested-by: Xueyuan Chen Signed-off-by: Barry Song Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260228221337.59951-1-21cnbao@gmail.com commit d7eafe655b741dfc241d5b920f6d2cea45b568d9 Author: Barry Song Date: Sun Mar 1 06:13:16 2026 +0800 dma-mapping: Separate DMA sync issuing and completion waiting Currently, arch_sync_dma_for_cpu and arch_sync_dma_for_device always wait for the completion of each DMA buffer. That is, issuing the DMA sync and waiting for completion is done in a single API call. For scatter-gather lists with multiple entries, this means issuing and waiting is repeated for each entry, which can hurt performance. Architectures like ARM64 may be able to issue all DMA sync operations for all entries first and then wait for completion together. To address this, arch_sync_dma_for_* now batches DMA operations and performs a flush afterward. On ARM64, the flush is implemented with a dsb instruction in arch_sync_dma_flush(). On other architectures, arch_sync_dma_flush() is currently a nop. Cc: Leon Romanovsky Cc: Catalin Marinas Cc: Will Deacon Cc: Marek Szyprowski Cc: Robin Murphy Cc: Ada Couprie Diaz Cc: Ard Biesheuvel Cc: Marc Zyngier Cc: Anshuman Khandual Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Joerg Roedel Cc: Stefano Stabellini Cc: Oleksandr Tyshchenko Cc: Tangquan Zheng Reviewed-by: Juergen Gross # drivers/xen/swiotlb-xen.c Tested-by: Xueyuan Chen Signed-off-by: Barry Song Reviewed-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260228221316.59934-1-21cnbao@gmail.com commit cf875c4b6863fd64054e1c3550c349eac09c4f35 Author: Barry Song Date: Sun Mar 1 06:12:58 2026 +0800 arm64: Provide dcache_inval_poc_nosync helper dcache_inval_poc_nosync does not wait for the data cache invalidation to complete. Later, we defer the synchronization so we can wait for all SG entries together. Cc: Leon Romanovsky Cc: Catalin Marinas Cc: Will Deacon Cc: Marek Szyprowski Cc: Robin Murphy Cc: Ada Couprie Diaz Cc: Ard Biesheuvel Cc: Marc Zyngier Cc: Anshuman Khandual Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Tangquan Zheng Tested-by: Xueyuan Chen Signed-off-by: Barry Song Reviewed-by: Catalin Marinas Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260228221258.59918-1-21cnbao@gmail.com commit 1c3a7f9e6bac8993946d384ee4c2f79910e93cd8 Author: Barry Song Date: Sun Mar 1 06:12:39 2026 +0800 arm64: Provide dcache_clean_poc_nosync helper dcache_clean_poc_nosync does not wait for the data cache clean to complete. Later, we wait for completion of all scatter-gather entries together. Cc: Leon Romanovsky Cc: Catalin Marinas Cc: Will Deacon Cc: Marek Szyprowski Cc: Robin Murphy Cc: Ada Couprie Diaz Cc: Ard Biesheuvel Cc: Marc Zyngier Cc: Anshuman Khandual Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Tangquan Zheng Tested-by: Xueyuan Chen Signed-off-by: Barry Song Reviewed-by: Catalin Marinas Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260228221239.59903-1-21cnbao@gmail.com commit 2c92eff008a253a5ec0af7e9fa9c5a41e238ea50 Author: Barry Song Date: Sun Mar 1 06:12:16 2026 +0800 arm64: Provide dcache_by_myline_op_nosync helper dcache_by_myline_op ensures completion of the data cache operations for a region, while dcache_by_myline_op_nosync only issues them without waiting. This enables deferred synchronization so completion for multiple regions can be handled together later. Cc: Leon Romanovsky Cc: Catalin Marinas Cc: Will Deacon Cc: Marek Szyprowski Cc: Robin Murphy Cc: Ada Couprie Diaz Cc: Ard Biesheuvel Cc: Marc Zyngier Cc: Anshuman Khandual Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Tangquan Zheng Tested-by: Xueyuan Chen Signed-off-by: Barry Song Reviewed-by: Catalin Marinas Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260228221216.59886-1-21cnbao@gmail.com commit 520a1347faf46c2c00c3499de05fdecc6d254c2e Author: Yosry Ahmed Date: Fri Mar 6 21:08:56 2026 +0000 KVM: nSVM: Simplify error handling of nested_svm_copy_vmcb12_to_cache() nested_svm_vmrun() currently stores the return value of nested_svm_copy_vmcb12_to_cache() in a local variable 'err', separate from the generally used 'ret' variable. This is done to have a single call to kvm_skip_emulated_instruction(), such that we can store the return value of kvm_skip_emulated_instruction() in 'ret', and then re-check the return value of nested_svm_copy_vmcb12_to_cache() in 'err'. The code is unnecessarily confusing. Instead, call kvm_skip_emulated_instruction() in the failure path of nested_svm_copy_vmcb12_to_cache() if the return value is not -EFAULT, and drop 'err'. Suggested-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260306210900.1933788-3-yosry@kernel.org Signed-off-by: Sean Christopherson commit f42f3076dd9d2cd1bde6abc44e45478fad8a1a54 Author: Rosen Penev Date: Fri Mar 13 14:56:37 2026 -0700 EDAC/sb: Use kzalloc_flex() Simplifies allocations by using a flexible array member in this struct. Add __counted_by to get extra runtime analysis. Move counting variable assignment immediately after allocation as required by __counted_by. Signed-off-by: Rosen Penev Signed-off-by: Tony Luck Reviewed-by: Qiuxu Zhuo Link: https://patch.msgid.link/20260313215637.6371-1-rosenp@gmail.com commit 7cbea96f6660786158ed7dc81fe40273d860355b Author: Rosen Penev Date: Fri Mar 13 14:59:00 2026 -0700 EDAC/i7core: Use kzalloc_flex() Simplifies allocations by using a flexible array member in this struct. Add __counted_by to get extra runtime analysis. Move counting variable assignment to right after allocation as required by __counted_by. Signed-off-by: Rosen Penev Signed-off-by: Tony Luck Reviewed-by: Qiuxu Zhuo Link: https://patch.msgid.link/20260313215900.6724-1-rosenp@gmail.com commit 3ee3d8a44976ac7e39584637ee4c840d70ab2ad1 Author: Geert Uytterhoeven Date: Mon Mar 2 17:29:10 2026 +0100 soc: qcom: pd-mapper: Convert to of_machine_get_match() Use the of_machine_get_match() helper instead of open-coding the same operation. Signed-off-by: Geert Uytterhoeven Reviewed-by: Konrad Dybcio Acked-by: Viresh Kumar Link: https://patch.msgid.link/0d23a449e62ac85f04ff07bc2758efbaa709c9d1.1772468323.git.geert+renesas@glider.be Signed-off-by: Rob Herring (Arm) commit 951318c4651a646f4835ae33abe7c4cb232e7c6e Author: Geert Uytterhoeven Date: Mon Mar 2 17:29:09 2026 +0100 cpufreq: ti-cpufreq: Convert to of_machine_get_match() Use the of_machine_get_match() helper instead of open-coding the same operation. Signed-off-by: Geert Uytterhoeven Acked-by: Viresh Kumar Link: https://patch.msgid.link/bba0631aea78b6db7d453a9f9e98ea16b7e2c269.1772468323.git.geert+renesas@glider.be Signed-off-by: Rob Herring (Arm) commit 8cd94ead5184c5bdde74dc0afc316c6f3c41fdd7 Author: Geert Uytterhoeven Date: Mon Mar 2 17:29:08 2026 +0100 cpufreq: qcom-nvmem: Convert to of_machine_get_match() Use the of_machine_get_match() helper instead of open-coding the same operation. Signed-off-by: Geert Uytterhoeven Acked-by: Viresh Kumar Link: https://patch.msgid.link/886a603a7a1de6c8cb14ee0783ee0bceea4d914a.1772468323.git.geert+renesas@glider.be Signed-off-by: Rob Herring (Arm) commit 1838e0924e508eb30e140ad8f037863ee53be3c6 Author: Geert Uytterhoeven Date: Mon Mar 2 17:29:07 2026 +0100 cpufreq: airoha: Convert to of_machine_get_match() Use the of_machine_get_match() helper instead of open-coding the same operation. Signed-off-by: Geert Uytterhoeven Acked-by: Viresh Kumar Link: https://patch.msgid.link/cc76137755d93af982bf255095adafc7d523692c.1772468323.git.geert+renesas@glider.be Signed-off-by: Rob Herring (Arm) commit 57814f2e0cd7960fc8bbe097c05fdf2c3f8c67e4 Author: Geert Uytterhoeven Date: Mon Mar 2 17:29:06 2026 +0100 of: Convert to of_machine_get_match() Use the of_machine_get_match() helper instead of open-coding the same operation. Signed-off-by: Geert Uytterhoeven Acked-by: Viresh Kumar Link: https://patch.msgid.link/83ed49314b94dab7781e1d74236af72dd5c349c6.1772468323.git.geert+renesas@glider.be Signed-off-by: Rob Herring (Arm) commit 82b6c1b542ea0530318c6f2a880d884eb4dce49f Author: Geert Uytterhoeven Date: Mon Mar 2 17:29:05 2026 +0100 of: Add of_machine_get_match() helper Currently, there are two helpers to match the root compatible value against an of_device_id array: - of_machine_device_match() returns true if a match is found, - of_machine_get_match_data() returns the match data if a match is found. However, there is no helper that returns the actual of_device_id structure corresponding to the match, leading to code duplication in various drivers. Fix this by reworking of_machine_device_match() to return the actual match structure, and renaming it to of_machine_get_match(). Retain the old of_machine_device_match() functionality using a cheap static inline wrapper around the new of_machine_get_match() helper. Signed-off-by: Geert Uytterhoeven Acked-by: Viresh Kumar Link: https://patch.msgid.link/14e1c03d443b1a5f210609ec3a1ebbaeab8fb3d9.1772468323.git.geert+renesas@glider.be Signed-off-by: Rob Herring (Arm) commit bb551508e78c886e6d3bcca6c744d3bc3fd8ad59 Author: Ian Rogers Date: Sat Feb 7 00:24:28 2026 -0800 perf record: Remove unused cpu-set-sched.h Header file declares unused macros, so remove. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 5cd621dead2b1fe71afa723f73904242a1bd01a8 Author: Ian Rogers Date: Sat Feb 7 00:24:27 2026 -0800 perf bpf_map: Remove unused code bpf_map__fprintf is unused so delete it, the header file declaring it and the now unused static helper functions. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 2907fd820b8f1e4563ecd624989fd5a4db479c2f Author: Ian Rogers Date: Sat Feb 7 00:24:26 2026 -0800 perf tool: Constify the command and option arrays Reduce scope and capture immutability. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 8e6f3103c079d44b51177449cd93af4c18733194 Author: Ian Rogers Date: Sat Feb 7 00:24:25 2026 -0800 perf dump-insn: Remove dump-insn.c dump_insn and arch_is_uncond_branch are declared in intel-pt-insn-decoder.c which is unconditionally part of all perf builds. Don't declare weak versions of these symbols that will be unused. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit ed09766cd0bff29a537c6262a2dfca3643c2f6e6 Author: Ian Rogers Date: Sat Feb 7 00:24:24 2026 -0800 perf symbol: Reduce scope of elf__needs_adjust_symbols Function is only used by symsrc__init in symbol-elf.c, make static to reduce scope. Switch to not passing the argument by value but as a pointer. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit c969a9d7bbf46f983c4a48566b3b2f7340b02296 Author: Ian Rogers Date: Thu Mar 12 15:31:31 2026 -0700 perf branch: Avoid incrementing NULL If the entry is NULL the value is meaningless so early return NULL to avoid an increment of NULL. This was happening in calls from has_stitched_lbr when running the "perf record LBR tests". The return value isn't used in that case, so returning NULL as no effect. Fixes: 42bbabed09ce ("perf tools: Add hw_idx in struct branch_stack") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 7315728ab5388bf4956835b20497332b1d45fe98 Author: Maíra Canal Date: Fri Mar 6 08:30:38 2026 -0300 drm/v3d: Remove dedicated fence_lock Commit adefb2ccea1e ("drm/v3d: create a dedicated lock for dma fence") split `fence_lock` from `queue_lock` because v3d_job_update_stats() was taking `queue_lock` to protect `job->file_priv` during stats collection in the IRQ handler. Using the same lock for both DMA fence signaling and stats protection in a IRQ context caused issues on PREEMPT_RT. Since then, the stats infrastructure has been reworked: v3d_stats is now refcounted and jobs hold their own references to stats objects, so v3d_job_update_stats() no longer takes `queue_lock` at all. With the original reason for the split gone, merge `fence_lock` back into `queue_lock` to simplify the locking scheme. Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-6-49864fe00692@igalia.com Signed-off-by: Maíra Canal commit 2f0e110735a4e59e71e44d04b4f70e58f06c61c9 Author: Tvrtko Ursulin Date: Fri Mar 6 08:30:37 2026 -0300 drm/v3d: Attach per-fd reset counters to v3d_stats To remove the file_priv NULL-ing dance needed to check if the file descriptor is open, move the per-fd reset counter into v3d_stats, which is heap-allocated and refcounted, outliving the fd as long as jobs reference it. This change allows the removal of the last `queue_lock` usage to protect `job->file_priv` and avoids possible NULL ptr dereference issues due to lifetime mismatches. Also, to simplify locking, replace both the global and per-fd locked reset counters with atomics. Signed-off-by: Tvrtko Ursulin Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-5-49864fe00692@igalia.com Co-developed-by: Maíra Canal Signed-off-by: Maíra Canal commit 745cc3f92a4b43606119b81d1f8bb1d1f5116049 Author: Tvrtko Ursulin Date: Fri Mar 6 08:30:36 2026 -0300 drm/v3d: Hold v3d_stats references in each job Have each job hold its own references to the per-fd and global stats objects. This eliminates the need for `queue_lock` protection in the stats update path, since the job's stats pointers are guaranteed to remain valid for the job's entire lifetime regardless of file descriptor closure. Signed-off-by: Tvrtko Ursulin Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-4-49864fe00692@igalia.com Co-developed-by: Maíra Canal Signed-off-by: Maíra Canal commit 266d4ba30d6a70c2574a302d49d54a1e4f595035 Author: Tvrtko Ursulin Date: Fri Mar 6 08:30:35 2026 -0300 drm/v3d: Refcount v3d_stats Convert `v3d_stats` from embedded structs to heap-allocated, refcounted objects. This decouples the stats lifetime from the containing structures (this is, `v3d_queue_state` and `v3d_file_priv`), allowing jobs to safely hold their own references to stats objects even after the file descriptor is closed. Signed-off-by: Tvrtko Ursulin Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-3-49864fe00692@igalia.com Co-developed-by: Maíra Canal Signed-off-by: Maíra Canal commit 0b2a4569cd9fe56683be1aab9864032a8d267caa Author: Tvrtko Ursulin Date: Fri Mar 6 08:30:34 2026 -0300 drm/v3d: Use raw seqcount helpers instead of fighting with lockdep The `v3d_stats` sequence counter uses regular seqcount helpers, which carry lockdep annotations that expect a consistent IRQ context between all writers. However, lockdep is unable to detect that v3d's readers are never in IRQ or softirq context, and that for CPU job queues, even the write side never is. This led to false positive that were previously worked around by conditionally disabling local IRQs under IS_ENABLED(CONFIG_LOCKDEP). Switch to the raw seqcount helpers which skip lockdep tracking entirely. This is safe because jobs are fully serialized per queue: the next job can only be queued after the previous one has been signaled, so there is no scope for the start and update paths to race on the same seqcount. Signed-off-by: Tvrtko Ursulin Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-2-49864fe00692@igalia.com Co-developed-by: Maíra Canal Signed-off-by: Maíra Canal commit 8cf1bec37b27846ad3169744c9f1a89a06dcb3fa Author: Maíra Canal Date: Fri Mar 6 08:30:33 2026 -0300 drm/v3d: Handle error from drm_sched_entity_init() drm_sched_entity_init() can fail but its return value is currently being ignored in v3d_open(). Check the return value and properly unwind on failure by destroying any already-initialized scheduler entities. Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-1-49864fe00692@igalia.com Signed-off-by: Maíra Canal commit d7787a77cf8b129304f590233032556dec10dfc6 Author: Michael Riesch Date: Fri Mar 13 16:53:29 2026 +0100 arm64: dts: rockchip: enable vicap dvp on wolfvision pf5 io expander The Digital Video Port (DVP, the 16-bit variant) of the RK3568 VICAP is broken out to the PF5 mainboard expansion header. Enable it in the device tree overlay for the WolfVision PF5 IO Expander board. Signed-off-by: Michael Riesch Reviewed-by: Gerald Loacker Tested-by: Gerald Loacker Reviewed-by: Bryan O'Donoghue Signed-off-by: Michael Riesch Link: https://patch.msgid.link/20260313-wv-io-expander-vicap-v1-1-11001fb3b744@collabora.com Signed-off-by: Heiko Stuebner commit 0b4a043a54144aef3e5a2597c29c6adb5e6c47dc Author: Sean Christopherson Date: Tue Mar 10 15:04:14 2026 -0700 KVM: SVM: Add a helper to get LBR field pointer to dedup MSR accesses Add a helper to get a pointer to the corresponding VMCB field given an LBR MSR index, and use it to dedup the handling in svm_{g,s}et_msr(). No functional change intended. Suggested-by: Yosry Ahmed Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20260310220414.2569208-1-seanjc@google.com [sean: use KVM_BUG_ON() instead of BUILD_BUG(), clang ain't smart enough] Signed-off-by: Sean Christopherson commit 235b333e2878d791cee09e1e72f44611a9400114 Author: Harry Wentland Date: Thu Mar 12 16:41:45 2026 -0400 drm/colorop: Fix blob property reference tracking in state lifecycle The colorop state blob property handling had memory leaks during state duplication, destruction, and reset operations. The implementation failed to follow the established pattern from drm_crtc's handling of DEGAMMA/GAMMA blob properties. Issues fixed: - drm_colorop_atomic_destroy_state() was freeing state memory without releasing the blob reference, causing a leak - drm_colorop_reset() was directly freeing old state with kfree() instead of properly destroying it, leaking blob references - drm_colorop_cleanup() had duplicate blob cleanup code Changes: - Add __drm_atomic_helper_colorop_destroy_state() helper to properly release blob references before freeing state memory - Update drm_colorop_atomic_destroy_state() to call the helper - Fix drm_colorop_reset() to use drm_colorop_atomic_destroy_state() for proper cleanup of old state - Simplify drm_colorop_cleanup() to use the common destruction path This matches the well-tested pattern used by drm_crtc since 2016 and ensures proper reference counting throughout the state lifecycle. Co-developed by Claude Sonnet 4.5. Fixes: cfc27680ee20 ("drm/colorop: Introduce new drm_colorop mode object") Cc: Simon Ser Cc: Alex Hung Cc: Harry Wentland Cc: Daniel Stone Cc: Melissa Wen Cc: Sebastian Wick Cc: Uma Shankar Cc: Ville Syrjälä Cc: Maarten Lankhorst Cc: Jani Nikula Cc: Louis Chauvet Cc: Chaitanya Kumar Borah Cc: #v6.19+ Signed-off-by: Harry Wentland Reviewed-by: Alex Hung Link: https://patch.msgid.link/20260312204145.829714-1-harry.wentland@amd.com commit 238eba8c210d02ec2908d9c9143db4edcea3bfa1 Author: Tejun Heo Date: Fri Mar 13 09:43:23 2026 -1000 sched_ext: Use schedule_deferred_locked() in schedule_dsq_reenq() schedule_dsq_reenq() always uses schedule_deferred() which falls back to irq_work. However, callers like schedule_reenq_local() already hold the target rq lock, and scx_bpf_dsq_reenq() may hold it via the ops callback. Add a locked_rq parameter so schedule_dsq_reenq() can use schedule_deferred_locked() when the target rq is already held. The locked variant can use cheaper paths (balance callbacks, wakeup hooks) instead of always bouncing through irq_work. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 3229ac4a5ef5a838e82a784226432c92d3db90a8 Author: Tejun Heo Date: Fri Mar 13 09:43:23 2026 -1000 sched_ext: Add SCX_OPS_ALWAYS_ENQ_IMMED ops flag SCX_ENQ_IMMED makes enqueue to local DSQs succeed only if the task can start running immediately. Otherwise, the task is re-enqueued through ops.enqueue(). This provides tighter control but requires specifying the flag on every insertion. Add SCX_OPS_ALWAYS_ENQ_IMMED ops flag. When set, SCX_ENQ_IMMED is automatically applied to all local DSQ enqueues including through scx_bpf_dsq_move_to_local(). scx_qmap is updated with -I option to test the feature and -F option for IMMED stress testing which forces every Nth enqueue to a busy local DSQ. v2: - Cover scx_bpf_dsq_move_to_local() path (now has enq_flags via ___v2). - scx_qmap: Remove sched_switch and cpu_release handlers (superseded by kernel-side wakeup_preempt_scx()). Add -F for IMMED stress testing. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 860683763ebf4662cb72a312279334e02718308f Author: Tejun Heo Date: Fri Mar 13 09:43:23 2026 -1000 sched_ext: Add enq_flags to scx_bpf_dsq_move_to_local() scx_bpf_dsq_move_to_local() moves a task from a non-local DSQ to the current CPU's local DSQ. This is an indirect way of dispatching to a local DSQ and should support enq_flags like direct dispatches do - e.g. SCX_ENQ_HEAD for head-of-queue insertion and SCX_ENQ_IMMED for immediate execution guarantees. Add scx_bpf_dsq_move_to_local___v2() with an enq_flags parameter. The original becomes a v1 compat wrapper passing 0. The compat macro is updated to a three-level chain: v2 (7.1+) -> v1 (current) -> scx_bpf_consume (pre-rename). All in-tree BPF schedulers are updated to pass 0. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit da32a2986e5fb3c70562ad610918834696e87322 Author: Tejun Heo Date: Fri Mar 13 09:43:23 2026 -1000 sched_ext: Plumb enq_flags through the consume path Add enq_flags parameter to consume_dispatch_q() and consume_remote_task(), passing it through to move_{local,remote}_task_to_local_dsq(). All callers pass 0. No functional change. This prepares for SCX_ENQ_IMMED support on the consume path. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 98d709cba3193f0bec54da4cd76ef499ea2f1ef7 Author: Tejun Heo Date: Fri Mar 13 09:43:22 2026 -1000 sched_ext: Implement SCX_ENQ_IMMED Add SCX_ENQ_IMMED enqueue flag for local DSQ insertions. Once a task is dispatched with IMMED, it either gets on the CPU immediately and stays on it, or gets reenqueued back to the BPF scheduler. It will never linger on a local DSQ behind other tasks or on a CPU taken by a higher-priority class. rq_is_open() uses rq->next_class to determine whether the rq is available, and wakeup_preempt_scx() triggers reenqueue when a higher-priority class task arrives. These capture all higher class preemptions. Combined with reenqueue points in the dispatch path, all cases where an IMMED task would not execute immediately are covered. SCX_TASK_IMMED persists in p->scx.flags until the next fresh enqueue, so the guarantee survives SAVE/RESTORE cycles. If preempted while running, put_prev_task_scx() reenqueues through ops.enqueue() with SCX_TASK_REENQ_PREEMPTED instead of silently placing the task back on the local DSQ. This enables tighter scheduling latency control by preventing tasks from piling up on local DSQs. It also enables opportunistic CPU sharing across sub-schedulers - without this, a sub-scheduler can stuff the local DSQ of a shared CPU, making it difficult for others to use. v2: - Rewrite is_curr_done() as rq_is_open() using rq->next_class and implement wakeup_preempt_scx() to achieve complete coverage of all cases where IMMED tasks could get stranded. - Track IMMED persistently in p->scx.flags and reenqueue preempted-while-running tasks through ops.enqueue(). - Bound deferred reenq cycles (SCX_REENQ_LOCAL_MAX_REPEAT). - Misc renames, documentation. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit b5b38761b45a6c7d91760d212fda8b46df8c5362 Author: Tejun Heo Date: Fri Mar 13 09:43:22 2026 -1000 sched_ext: Add scx_vet_enq_flags() and plumb dsq_id into preamble Add scx_vet_enq_flags() stub and call it from scx_dsq_insert_preamble() and scx_dsq_move(). Pass dsq_id into preamble so the vetting function can validate flag and DSQ combinations. No functional change. This prepares for SCX_ENQ_IMMED which will populate the vetting function. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit f1c1dd9cc1b610e44d16210f5b9bd5e697c7cf74 Author: Tejun Heo Date: Fri Mar 13 09:43:22 2026 -1000 sched_ext: Split task_should_reenq() into local and user variants Split task_should_reenq() into local_task_should_reenq() and user_task_should_reenq(). The local variant takes reenq_flags by pointer. No functional change. This prepares for SCX_ENQ_IMMED which will add IMMED-specific logic to the local variant. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 752a0d1d483e9479f5c59519256fd190139d0b39 Author: Ryan Roberts Date: Mon Mar 2 13:56:00 2026 +0000 arm64: mm: Provide level hint for flush_tlb_page() Previously tlb invalidations issued by __flush_tlb_page() did not contain a level hint. From the core API documentation, this function is clearly only ever intended to target level 3 (PTE) tlb entries: | 4) ``void flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)`` | | This time we need to remove the PAGE_SIZE sized translation | from the TLB. However, the arm64 documentation is more relaxed allowing any last level: | this operation only invalidates a single, last-level page-table | entry and therefore does not affect any walk-caches It turns out that the function was actually being used to invalidate a level 2 mapping via flush_tlb_fix_spurious_fault_pmd(). The bug was benign because the level hint was not set so the HW would still invalidate the PMD mapping, and also because the TLBF_NONOTIFY flag was set, the bounds of the mapping were never used for anything else. Now that we have the new and improved range-invalidation API, it is trival to fix flush_tlb_fix_spurious_fault_pmd() to explicitly flush the whole range (locally, without notification and last level only). So let's do that, and then update __flush_tlb_page() to hint level 3. Reviewed-by: Linu Cherian Signed-off-by: Ryan Roberts [catalin.marinas@arm.com: use "level 3" in the __flush_tlb_page() description] [catalin.marinas@arm.com: tweak the commit message to include the core API text] Signed-off-by: Catalin Marinas commit c85ec5c5753a46b5c2aea1292536487be9470ffe Author: Daniele Ceraolo Spurio Date: Mon Mar 2 16:17:33 2026 -0800 drm/xe/guc: Fail immediately on GuC load error By using the same variable for both the return of poll_timeout_us and the return of the polled function guc_wait_ucode, the return value of the latter is overwritten and lost after exiting the polling loop. Since guc_wait_ucode returns -1 on GuC load failure, we lose that information and always continue as if the GuC had been loaded correctly. This is fixed by simply using 2 separate variables. Fixes: a4916b4da448 ("drm/xe/guc: Refactor GuC load to use poll_timeout_us()") Signed-off-by: Daniele Ceraolo Spurio Reviewed-by: Matthew Brost Signed-off-by: Vinay Belgaumkar Link: https://patch.msgid.link/20260303001732.2540493-2-daniele.ceraolospurio@intel.com commit 9117e20a36d005abb68e0e3f4ca0080eeacb71ca Author: Josua Mayer Date: Thu Feb 26 18:36:33 2026 +0200 arm64: dts: imx8mp-sr-som: build dtbs with symbols for overlay support Build all dtbs based on SolidRun i.MX8MP SoM with symbols (adding -@ to dtc flags) to allow applying of device-tree overlays e.g. by the bootloader. The SoM has a basler camera connector that can be configured for a particular camera by device-tree overlay. By extension all boards based on this SoM have this connector and should support device-tree overlays. Reviewed-by: Frank Li Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 1d1d14d4253e6f373c247e67f3716768910be81e Author: Josua Mayer Date: Thu Feb 26 18:36:32 2026 +0200 arm64: dts: imx8mp-hummingboard-pulse: fix mini-hdmi dsi port reference imx8mp.dtsi includes a default port@1 node with an empty placeholder endpoint intended for linking to a dsi bridge or panel. HummingBoard Pulse mini-hdmi dtsi described a new endpoint node with a different label attached. This duplicate label causes confusion and is suspected to also cause errors during dsi_attach. Remove the duplicate node and link to the one defined in soc dtsi. Further remove the unnecessary attach-bridge property. Fixes: 2a222aa2bee9 ("arm64: dts: add description for solidrun imx8mp hummingboard variants") Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit 70ecea46d36b3b0ddcbe71f9cde8d0df00c11f87 Author: Josua Mayer Date: Thu Feb 26 18:36:31 2026 +0200 arm64: dts: imx8mp-hummingboard-pulse/cubox-m: fix vmmc gpio polarity Fix the polarity in vmmc regulator node for the gpio from active-high to active-low. This is a cosmetic change as regulator default to active-low unless property enable-active-high was also specified - ignoring the flag on gpio handle. Fixes: a009c0c66ecb ("arm64: dts: add description for solidrun imx8mp som and cubox-m") Fixes: 2a222aa2bee9 ("arm64: dts: add description for solidrun imx8mp hummingboard variants") Reviewed-by: Frank Li Signed-off-by: Josua Mayer Signed-off-by: Frank Li commit f1a26bc43c87813183220f1f7a067c3e39dde2d8 Author: Alexander Stein Date: Thu Feb 26 16:38:51 2026 +0100 arm64: dts: imx8qm-ss-hsio: Wire up DMA IRQ for PCIe IRQ mapping is already present. Add the missing DMA interrupt. This is similar to commit 0b4c46f9ad79c ("arm64: dts: imx8qm-ss-hsio: Wire up DMA IRQ for PCIe") Signed-off-by: Alexander Stein Signed-off-by: Frank Li commit 3147e56028a4e7afff47ffd77e99178e7fe113f0 Author: Wig Cheng Date: Thu Feb 26 22:48:19 2026 +0800 arm64: dts: freescale: add pixpaper display overlay for i.MX93 FRDM Add device tree overlay to support the MayQueen PixPaper e-paper display on the NXP i.MX93 FRDM board. The display is connected via LPSPI3 interface and uses GPIO pins for reset, busy and DC control. The overlay configures: - LPSPI3 pinmux for SPI communication (MOSI, MISO, CLK, CE0) - PixPaper display device with proper GPIO assignments - SPI frequency set to 1MHz for stable operation Enable Open-EP Community pixpaper-213-c support on NXP i.MX93. Signed-off-by: Wig Cheng Signed-off-by: Frank Li commit 6fb408d59b74dbb9a69a0f075c177eaed0c884f8 Author: Alexander Stein Date: Thu Feb 26 14:02:21 2026 +0100 arm64: dts: tqma8mpql-mba8mp-ras314: Configure multiple queues on eqos The MBa8MP-RAS314 mainboard has an integrated PHY connected to the EQOS ethernet controller which can support up to five queues. Configure these queues in the same manor as done on the imx8mp-evk. Setting DMA to threas mode is necessary to prevent FIFO overflows, see commit 0bc3e333a0c82 ("arm64: dts: imx8mp-evk: configure multiple queues on eqos") Signed-off-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Frank Li commit 713527940c8c4afcdf142e900f71d391bfe7d6a9 Author: Alexander Stein Date: Thu Feb 26 14:02:20 2026 +0100 arm64: dts: tqma8mpql-mba8mpxl: Configure multiple queues on eqos The MBa8MPxL mainboard has an integrated PHY connected to the EQOS ethernet controller which can support up to five queues. Configure these queues in the same manor as done on the imx8mp-evk. Setting DMA to threas mode is necessary to prevent FIFO overflows, see commit 0bc3e333a0c82 ("arm64: dts: imx8mp-evk: configure multiple queues on eqos") Signed-off-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Frank Li commit 93190b6eab824454223e355477d7ef621d1d8dae Author: Frieder Schrempf Date: Fri Feb 20 11:36:19 2026 +0100 arm64: dts: imx8mp-kontron: Use GPIO/IRQ defines in DL devicetree To make the code more readable, use the macros for the GPIO and IRQ settings. Signed-off-by: Frieder Schrempf Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Signed-off-by: Frank Li commit d2ce84eecf081056b1d18d7524de52f849281ba7 Author: Frieder Schrempf Date: Fri Feb 20 11:36:17 2026 +0100 arm64: dts: imx8mp-kontron: Drop vmmc-supply to fix SD card on SMARC eval carrier The SMARC evaluation carrier provides an SD card power switch that complies with the OSM standard definition. The OSM base devicetree already describes this correctly. Stop overriding the vmmc-supply in the board devicetree and rely on the definition from the OSM base DTS instead to fix the power supply configuration for the SD card. Fixes: 6fe1ced5ccab7 ("arm64: dts: Add support for Kontron i.MX8MP SMARC module and eval carrier") Signed-off-by: Frieder Schrempf Signed-off-by: Frank Li commit 058c53476dde9937877e93d964a283bbb5e1e4c7 Author: Frieder Schrempf Date: Fri Feb 20 11:36:16 2026 +0100 arm64: dts: imx8mp-kontron: Fix touch reset configuration on DL devices The reset signal needs a pullup, but there is no hardware pullup. As a workaround, enable the internal pullup to fix the touchscreen. As this deviates from the default generic GPIO settings in the OSM devicetree, add a new node for the touch pinctrl and redefine the generic gpio1 pinctrl. Fixes: 946ab10e3f40f ("arm64: dts: Add support for Kontron OSM-S i.MX8MP SoM and BL carrier board") Signed-off-by: Frieder Schrempf Reviewed-by: Frank Li Signed-off-by: Frank Li commit 1abaae9b38a85c9dabff67a22d8c99f7254c423a Author: Breno Leitao Date: Thu Mar 12 09:12:02 2026 -0700 workqueue: fix parse_affn_scope() prefix matching bug parse_affn_scope() uses strncasecmp() with the length of the candidate name, which means it only checks if the input *starts with* a known scope name. Given that the upcoming diff will create "cache_shard" affinity scope, writing "cache_shard" to a workqueue's affinity_scope sysfs attribute always matches "cache" first, making it impossible to select "cache_shard" via sysfs, so, this fix enable it to distinguish "cache" and "cache_shard" Fix by replacing the hand-rolled prefix matching loop with sysfs_match_string(), which uses sysfs_streq() for exact matching (modulo trailing newlines). Also add the missing const qualifier to the wq_affn_names[] array declaration. Note that sysfs_streq() is case-sensitive, unlike the previous strncasecmp() approach. This is intentional and consistent with how other sysfs attributes handle string matching in the kernel. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 15397e3c3850d447b7167614cbb24a98192c3693 Author: Ryan Roberts Date: Mon Mar 2 13:55:59 2026 +0000 arm64: mm: Wrap flush_tlb_page() around __do_flush_tlb_range() Flushing a page from the tlb is just a special case of flushing a range. So let's rework flush_tlb_page() so that it simply wraps __do_flush_tlb_range(). While at it, let's also update the API to take the same flags that we use when flushing a range. This allows us to delete all the ugly "_nosync", "_local" and "_nonotify" variants. Thanks to constant folding, all of the complex looping and tlbi-by-range options get eliminated so that the generated code for flush_tlb_page() looks very similar to the previous version. Reviewed-by: Linu Cherian Signed-off-by: Ryan Roberts Reviewed-by: Jonathan Cameron Signed-off-by: Catalin Marinas commit 0477fc56960d91ac98412534188741a09e5d8a18 Author: Ryan Roberts Date: Mon Mar 2 13:55:58 2026 +0000 arm64: mm: More flags for __flush_tlb_range() Refactor function variants with "_nosync", "_local" and "_nonotify" into a single __always_inline implementation that takes flags and rely on constant folding to select the parts that are actually needed at any given callsite, based on the provided flags. Flags all live in the tlbf_t (TLB flags) type; TLBF_NONE (0) continues to provide the strongest semantics (i.e. evict from walk cache, broadcast, synchronise and notify). Each flag reduces the strength in some way; TLBF_NONOTIFY, TLBF_NOSYNC and TLBF_NOBROADCAST are added to complement the existing TLBF_NOWALKCACHE. There are no users that require TLBF_NOBROADCAST without TLBF_NOWALKCACHE so implement that as BUILD_BUG() to avoid needing to introduce dead code for vae1 invalidations. The result is a clearer, simpler, more powerful API. Signed-off-by: Ryan Roberts Reviewed-by: Jonathan Cameron Signed-off-by: Catalin Marinas commit 11f6dd8dd2838703fe3d149118b8c785150cc92f Author: Ryan Roberts Date: Mon Mar 2 13:55:57 2026 +0000 arm64: mm: Refactor __flush_tlb_range() to take flags We have function variants with "_nosync", "_local", "_nonotify" as well as the "last_level" parameter. Let's generalize and simplify by using a flags parameter to encode all these variants. As a first step, convert the "last_level" boolean parameter to a flags parameter and create the first flag, TLBF_NOWALKCACHE. When present, walk cache entries are not evicted, which is the same as the old last_level=true. Reviewed-by: Linu Cherian Reviewed-by: Jonathan Cameron Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit 64212d689306df27fb12363df2aab030cf767a4a Author: Ryan Roberts Date: Mon Mar 2 13:55:56 2026 +0000 arm64: mm: Refactor flush_tlb_page() to use __tlbi_level_asid() Now that we have __tlbi_level_asid(), let's refactor the *flush_tlb_page*() variants to use it rather than open coding. The emitted tlbi(s) is/are intended to be exactly the same as before; no TTL hint is provided. Although the spec for flush_tlb_page() allows for setting the TTL hint to 3, it turns out that flush_tlb_fix_spurious_fault_pmd() depends on local_flush_tlb_page_nonotify() to invalidate the level 2 entry. This will be fixed separately. Reviewed-by: Linu Cherian Reviewed-by: Jonathan Cameron Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit c753d667d9596866e0b9608f52c91b5a540786cb Author: Will Deacon Date: Mon Mar 2 13:55:55 2026 +0000 arm64: mm: Simplify __flush_tlb_range_limit_excess() __flush_tlb_range_limit_excess() is unnecessarily complicated: - It takes a 'start', 'end' and 'pages' argument, whereas it only needs 'pages' (which the caller has computed from the other two arguments!). - It erroneously compares 'pages' with MAX_TLBI_RANGE_PAGES when the system doesn't support range-based invalidation but the range to be invalidated would result in fewer than MAX_DVM_OPS invalidations. Simplify the function so that it no longer takes the 'start' and 'end' arguments and only considers the MAX_TLBI_RANGE_PAGES threshold on systems that implement range-based invalidation. Signed-off-by: Will Deacon Reviewed-by: Jonathan Cameron Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit 057bbd8e06102100023b980dfdd26f8a595785cd Author: Will Deacon Date: Mon Mar 2 13:55:54 2026 +0000 arm64: mm: Simplify __TLBI_RANGE_NUM() macro Since commit e2768b798a19 ("arm64/mm: Modify range-based tlbi to decrement scale"), we don't need to clamp the 'pages' argument to fit the range for the specified 'scale' as we know that the upper bits will have been processed in a prior iteration. Drop the clamping and simplify the __TLBI_RANGE_NUM() macro. Signed-off-by: Will Deacon Reviewed-by: Ryan Roberts Reviewed-by: Dev Jain Reviewed-by: Jonathan Cameron Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit 5e63b73f3deb1e0f7e2234f7f6743e323b60daf8 Author: Ryan Roberts Date: Mon Mar 2 13:55:53 2026 +0000 arm64: mm: Re-implement the __flush_tlb_range_op macro in C The __flush_tlb_range_op() macro is horrible and has been a previous source of bugs thanks to multiple expansions of its arguments (see commit f7edb07ad7c6 ("Fix mmu notifiers for range-based invalidates")). Rewrite the thing in C. Suggested-by: Linus Torvalds Co-developed-by: Will Deacon Signed-off-by: Will Deacon Reviewed-by: Jonathan Cameron Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit d4b048ca145fd31a2c6f77ae4db49e51bdec58ac Author: Will Deacon Date: Mon Mar 2 13:55:52 2026 +0000 arm64: mm: Inline __TLBI_VADDR_RANGE() into __tlbi_range() The __TLBI_VADDR_RANGE() macro is only used in one place and isn't something that's generally useful outside of the low-level range invalidation gubbins. Inline __TLBI_VADDR_RANGE() into the __tlbi_range() function so that the macro can be removed entirely. Signed-off-by: Will Deacon Reviewed-by: Linu Cherian Reviewed-by: Jonathan Cameron Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit a3710035604fdeace5c0945d98955a1624e4648d Author: Will Deacon Date: Mon Mar 2 13:55:51 2026 +0000 arm64: mm: Push __TLBI_VADDR() into __tlbi_level() The __TLBI_VADDR() macro takes an ASID and an address and converts them into a single argument formatted correctly for a TLB invalidation instruction. Rather than have callers worry about this (especially in the case where the ASID is zero), push the macro down into __tlbi_level() via a new __tlbi_level_asid() helper. Signed-off-by: Will Deacon Reviewed-by: Linu Cherian Reviewed-by: Jonathan Cameron Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit edc55b7abb2547aac5521202b029dc4dd2054771 Author: Ryan Roberts Date: Mon Mar 2 13:55:50 2026 +0000 arm64: mm: Implicitly invalidate user ASID based on TLBI operation When kpti is enabled, separate ASIDs are used for userspace and kernelspace, requiring ASID-qualified TLB invalidation by virtual address to invalidate both of them. Push the logic for invalidating the two ASIDs down into the low-level tlbi-op-specific functions and remove the burden from the caller to handle the kpti-specific behaviour. Co-developed-by: Will Deacon Signed-off-by: Will Deacon Reviewed-by: Jonathan Cameron Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit d2bf3226952c64d1c2ce4995cce60b3fb8ae5f33 Author: Ryan Roberts Date: Mon Mar 2 13:55:49 2026 +0000 arm64: mm: Introduce a C wrapper for by-range TLB invalidation As part of efforts to reduce our reliance on complex preprocessor macros for TLB invalidation routines, introduce a new C wrapper for by-range TLB invalidation which can be used instead of the __tlbi() macro and can additionally be called from C code. Each specific tlbi range op is implemented as a C function and the appropriate function pointer is passed to __tlbi_range(). Since everything is declared inline and is statically resolvable, the compiler will convert the indirect function call to a direct inline execution. Suggested-by: Linus Torvalds Reviewed-by: Jonathan Cameron Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit 5b3fb8a6b429c33ee669d08b1a883d881e9614a1 Author: Ryan Roberts Date: Mon Mar 2 13:55:48 2026 +0000 arm64: mm: Re-implement the __tlbi_level macro as a C function As part of efforts to reduce our reliance on complex preprocessor macros for TLB invalidation routines, convert the __tlbi_level macro to a C function for by-level TLB invalidation. Each specific tlbi level op is implemented as a C function and the appropriate function pointer is passed to __tlbi_level(). Since everything is declared inline and is statically resolvable, the compiler will convert the indirect function call to a direct inline execution. Suggested-by: Linus Torvalds Reviewed-by: Jonathan Cameron Signed-off-by: Ryan Roberts Signed-off-by: Catalin Marinas commit 3ce8f5860ff478d23af87bd459e76e466b483af3 Author: Will Deacon Date: Fri Mar 13 12:32:19 2026 +0000 arm64: scs: Remove redundant save/restore of SCS SP on entry to/from EL0 When returning to userspace, the SCS is empty and so the SCS SP just points to the base address of the SCS page. Rather than saving and restoring this address in the current task, we can simply restore the SCS SP to point at the base of the stack on entry to EL1 from EL0. Cc: Ard Biesheuvel Cc: Mark Rutland Signed-off-by: Will Deacon Acked-by: Mark Rutland Acked-by: Ard Biesheuvel Reviewed-by: Sami Tolvanen Signed-off-by: Catalin Marinas commit 1d02346fec8d13b05e54296ddc6ae29b7e1067df Author: David Carlier Date: Fri Mar 13 05:17:55 2026 +0000 selftests/sched_ext: Add missing error check for exit__load() exit__load(skel) was called without checking its return value. Every other test in the suite wraps the load call with SCX_FAIL_IF(). Add the missing check to be consistent with the rest of the test suite. Fixes: a5db7817af78 ("sched_ext: Add selftests") Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit 09c091fddb0b93297ea659ab48ee64f54ebeeaa2 Author: Thorsten Blum Date: Thu Mar 12 17:40:42 2026 +0100 iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} mock_viommu_init() allocates two pages using __get_free_pages(..., 1), but its error path and mock_viommu_destroy() only release the first page using free_page(), leaking the second page. Use free_pages() with the matching order instead to avoid any page leaks. Fixes: 80478a2b450e ("iommufd/selftest: Add coverage for the new mmap interface") Link: https://patch.msgid.link/r/20260312164040.457293-3-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Nicolin Chen Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe commit 04e43ec9f002ed1041b41a6df4c645ef3148da9f Author: Borislav Petkov Date: Thu Feb 26 15:50:33 2026 +0100 x86/split_lock: Restructure the unwieldy switch-case in sld_state_show() Split the handling in two parts: 1. handle the sld_state option first 2. handle X86_FEATURE flag-based printing afterwards This splits the function nicely into two, separate logical things which are easier to parse and understand. Also, zap the printing in the disabled case. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Xiaoyao Li Link: https://patch.msgid.link/20260226145033.GAaaBduQ0rWXydOkAm@fat_crate.local commit 236ad358166cca167e6ed33639bb7948e7a2f6fd Author: Rafael J. Wysocki Date: Fri Mar 13 14:03:46 2026 +0100 ACPI: AC: Define ACPI_AC_CLASS in one place The ACPI_AC_CLASS symbol is defined in several places in the same way which is rather unfortunate. Instead, define it in one common header file (acpi_bus.h) so that it is accessible to all of its users. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/6163384.MhkbZ0Pkbq@rafael.j.wysocki commit e18947038bf4f39d47cdba511f85a9af668d56e1 Author: Rafael J. Wysocki Date: Fri Mar 13 14:00:41 2026 +0100 ACPI: driver: Do not set acpi_device_class() unnecessarily Several core ACPI device drivers set acpi_device_class() for the given struct acpi_device to whatever they like, but that value is never used unless the driver itself uses it and, sadly, they neglect to clear it on remove. Since the only one of them still using acpi_device_class() after previous changes is the button driver, update the others to stop setting it in vain. Also drop the related device class sybmols that become redundant. Since the ACPI button driver continues to use acpi_device_class(), make it clear the struct field represented by acpi_device_class() in its remove callback. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3706295.iIbC2pHGDl@rafael.j.wysocki commit 76866c912ac8639965861c648fa234ab61c0e72d Author: Rafael J. Wysocki Date: Fri Mar 13 13:59:58 2026 +0100 ACPI: driver: Avoid using pnp.device_class for netlink handling Update several core ACPI device drivers that use acpi_bus_generate_netlink_event() for generating netlink messages to pass a string literal as its first argument instead of a pointer to pnp.device_class in a given struct acpi_device, which will allow them to avoid initializing the pnp.device_class field in the future. The ACPI button driver that uses different acpi_device_class() values for different button types will still pass it to acpi_bus_generate_netlink_event(), but update it to use the acpi_device_class() macro instead of open coding the pointer access path. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/7944022.EvYhyI6sBW@rafael.j.wysocki commit 69652f32c9ac71e2b0c8ed407e13ad905e00e947 Author: Rafael J. Wysocki Date: Fri Mar 13 13:59:17 2026 +0100 ACPI: event: Redefine acpi_notifier_call_chain() Notice that acpi_notifier_call_chain() only uses its device argument to retrieve the pnp.device_class and pnp.bus_id values from there, so it can be redefined to take pointers to those two strings as parameters istead of a struct acpi_device pointer. That allows all of its callers to pass a string literal as its first argument, so they won't need to initialize pnp.device_class in struct acpi_device objects operated by them any more, and its signature becomes more similar to acpi_bus_generate_netlink_event() then. Update the code as per the above. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2056097.PYKUYFuaPT@rafael.j.wysocki commit 97892d5f0690f588bbcf755efe922c72cd248639 Author: Rafael J. Wysocki Date: Fri Mar 13 13:58:30 2026 +0100 ACPI: driver: Do not set acpi_device_name() unnecessarily ACPI drivers usually set acpi_device_name() for the given struct acpi_device to whatever they like, but that value is never used unless the driver itself uses it and, quite unfortunately, drivers neglect to clear it on remove. Some drivers use it for printing messages or initializing the names of subordinate devices, but it is better to use string literals for that, especially if the given one is used just once. To eliminate unnecessary overhead related to acpi_device_name() handling, rework multiple core ACPI device drivers to stop setting acpi_device_name() for struct acpi_device objects manipulated by them and use a string literal instead of it where applicable. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/10840483.nUPlyArG6x@rafael.j.wysocki commit 6a8e793ca8db1546d05071ba0807cbf8c4f44a8b Author: Rafael J. Wysocki Date: Fri Mar 13 13:57:43 2026 +0100 ACPI: video: Consolidate pnp.bus_id workarounds handling Reduce code duplication related to pnp.bus_id workarounds by combining the two existing cases. Also move the definition of static variable "instance" into acpi_video_bus_probe() because it is only used there. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3430879.44csPzL39Z@rafael.j.wysocki commit 9dc11faca2456384c8f8c5d83b7fc80dafeb9745 Author: Rafael J. Wysocki Date: Fri Mar 13 13:56:19 2026 +0100 ACPI: video: Rework checking for duplicate video bus devices The current way of checking for duplicate video bus devices in acpi_video_bus_probe() is based on walking the ACPI namespace which is not necessary after recent driver conversions. It is also susceptible to race conditions (for example, if two video bus devices are probed at the same time) and ordering issues. Instead of doing it the old way, inspect the children of the parent of the device being probed, excluding the latter and the children that are not auxiliary devices. For each of the remaining children, check if any of the entries in the video_bus_head list is equal to its driver data which can only happen if the given child has been processed by acpi_video_bus_probe() successfully and so it is a duplicate of the one being probed. Moreover, to prevent acpi_video_bus_probe() from processing two devices concurrently, which might defeat the above check, use a new internal mutex in it. Also, print the FW_BUG message only if allow_duplicates is unset which allows the entire duplicates check to be skipped in that case (doing it just to print the message about the case that is going to be ignored anyway is kind of pointless). Signed-off-by: Rafael J. Wysocki Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/3058492.e9J7NaK4W3@rafael.j.wysocki commit 97e6fabee5dcb2d86d4ff45f20606b8a73181f74 Author: Rafael J. Wysocki Date: Fri Mar 13 13:53:03 2026 +0100 driver core: auxiliary bus: Introduce dev_is_auxiliary() Introduce dev_is_auxiliary() in analogy with dev_is_platform() to facilitate subsequent changes. Signed-off-by: Rafael J. Wysocki Reviewed-by: Danilo Krummrich Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/5079467.GXAFRqVoOG@rafael.j.wysocki commit bc4cb68a02f1a445aa65d8054bd69ba4ba3f5767 Author: Chintan Patel Date: Wed Mar 4 20:49:21 2026 -0800 drm/panel: novatek-nt36672a: Convert to mipi_dsi_*_multi() helpers Convert the driver to use the non-deprecated mipi_dsi_*_multi() helpers and mipi_dsi_msleep(). Switch DCS command sequences to the multi context API and accumulate errors via struct mipi_dsi_multi_context. Replace open-coded error handling with the multi helpers and convert nt36672a_send_cmds() and power sequencing accordingly. This patch is intended to functionally be a no-op, though there is one slight change. Previously a failure in regulator_bulk_disable() would have caused nt36672a_panel_unprepare() to return an error. Now it won't. No other errors in nt36672a_panel_unprepare() were propagated, so this makes things consistent. Signed-off-by: Chintan Patel Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260305044921.10942-1-chintanlike@gmail.com commit edb7efa767da8bb82d724b85178be251ec4e060e Author: Elad Nachman Date: Thu Jan 22 18:59:21 2026 +0200 dt-bindings: arm64: add Marvell 7k COMe boards Add dt bindings for: Armada 7020 COM Express CPU module Falcon DB-98CX85x0 COM Express type 7 Carrier board Falcon DB-98CX85x0 COM Express type 7 Carrier board with an Armada 7020 COM Express CPU module Signed-off-by: Elad Nachman Acked-by: Rob Herring (Arm) Signed-off-by: Gregory CLEMENT commit 7caedbb5ade345df0eec0bf01035c780919a9f56 Author: Nathan Chancellor Date: Mon Mar 9 13:37:02 2026 -0700 integrity: Eliminate weak definition of arch_get_secureboot() security/integrity/secure_boot.c contains a single __weak function, which breaks recordmcount when building with clang: $ make -skj"$(nproc)" ARCH=powerpc LLVM=1 ppc64_defconfig security/integrity/secure_boot.o Cannot find symbol for section 2: .text. security/integrity/secure_boot.o: failed Introduce a Kconfig symbol, CONFIG_HAVE_ARCH_GET_SECUREBOOT, to indicate that an architecture provides a definition of arch_get_secureboot(). Provide a static inline stub when this symbol is not defined to achieve the same effect as the __weak function, allowing secure_boot.c to be removed altogether. Move the s390 definition of arch_get_secureboot() out of the CONFIG_KEXEC_FILE block to ensure it is always available, as it does not actually depend on KEXEC_FILE. Reported-by: Arnd Bergmann Fixes: 31a6a07eefeb ("integrity: Make arch_ima_get_secureboot integrity-wide") Signed-off-by: Nathan Chancellor Acked-by: Arnd Bergmann Signed-off-by: Mimi Zohar commit ecbcceea4767dc11881986cb41a9962cac6f6c39 Author: Michael Tretter Date: Thu Feb 19 12:32:58 2026 +0100 drm/imx: ipuv3-plane: support underlay plane The IPUv3 overlay plane may be placed over or under the primary plane. Set the zpos of the primary to an immutable position of 1 to have the possibility to place the other plane underneath it. Set the zpos of other planes (the overlay plane) to a mutable value between 0 (the lowest possible value of a zpos) and directly above the primary plane with the latter being the default. Signed-off-by: Michael Tretter Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel Link: https://patch.msgid.link/20260219-drm-imx-underlay-plane-v2-2-26ef829c5483@pengutronix.de commit a872e90e3668f9f8d0bc9c2fae3c328835b98bf0 Author: Michael Tretter Date: Thu Feb 19 12:32:57 2026 +0100 drm/imx: ipuv3-plane: decouple zpos from plane type The overlay plane may be placed over or under the primary plane. Using zpos to determine, if the plane is the primary or overlay plane is not valid anymore. Use the plane type for determining the name of the plane in the error message. Reviewed-by: Philipp Zabel Signed-off-by: Michael Tretter Signed-off-by: Philipp Zabel Link: https://patch.msgid.link/20260219-drm-imx-underlay-plane-v2-1-26ef829c5483@pengutronix.de commit 02df94d98ff837074788ce921edf67707dbad404 Author: Martin Kepplinger-Novakovic Date: Wed Jan 21 11:26:07 2026 +0100 drm/imx: parallel-display: add DRM_DISPLAY_HELPER for DRM_IMX_PARALLEL_DISPLAY When I build for an old imx53 platform I see the same as the test robot saw before: arm-buildroot-linux-gnueabihf-ld: drivers/gpu/drm/imx/ipuv3/parallel-display.o: in function `imx_pd_bind': parallel-display.c:(.text+0xb8): undefined reference to `drm_bridge_connector_init' Selecting DRM_DISPLAY_HELPER for DRM_IMX_PARALLEL_DISPLAY fixes the build. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512241721.jZgcwRfr-lkp@intel.com/ Signed-off-by: Martin Kepplinger-Novakovic Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel Link: https://patch.msgid.link/20260121102607.4087362-1-martin.kepplinger-novakovic@ginzinger.com commit cdf26e1462c220629bb79d487263b66f8b679eab Author: Marek Vasut Date: Sat Jan 10 18:14:10 2026 +0100 drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property Prefer bus format set via legacy "interface-pix-fmt" DT property over panel bus format. This is necessary to retain support for DTs which configure the IPUv3 parallel output as 24bit DPI, but connect 18bit DPI panels to it with hardware swizzling. This used to work up to Linux 6.12, but stopped working in 6.13, reinstate the behavior to support old DTs. Cc: stable@vger.kernel.org Fixes: 5f6e56d3319d ("drm/imx: parallel-display: switch to drm_panel_bridge") Signed-off-by: Marek Vasut Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel Link: https://patch.msgid.link/20260110171510.692666-1-marex@nabladev.com commit 1b7c834dedf9933447c424bfa01348f9dc3db4d1 Author: Alexander Stein Date: Wed Mar 4 15:44:22 2026 +0100 MAINTAINERS: Add i.MX team to all arm NXP platforms i.MX team maintains layerscape as well, so add the whole arch/arm/boot/dts/nxp directory as requested in [1]. [1] https://lore.kernel.org/all/Z+Vs+pHZs2fMP%2Fp3@lizhi-Precision-Tower-5810/ Signed-off-by: Alexander Stein Reviewed-by: Frank Li Acked-by: Daniel Baluta Signed-off-by: Frank Li commit 2af3aa702c05ecd05850db9d9e110be9ffa3cf47 Author: Hari Bathini Date: Thu Mar 12 13:31:13 2026 +0530 selftests/bpf: Improve test coverage for kfunc call On powerpc, immediate load instructions are sign extended. In case of unsigned types, arguments should be explicitly zero-extended by the caller. For kfunc call, this needs to be handled in the JIT code. In bpf_kfunc_call_test4(), that tests for sign-extension of signed argument types in kfunc calls, add some additional failure checks. And add bpf_kfunc_call_test5() to test zero-extension of unsigned argument types in kfunc calls. Signed-off-by: Hari Bathini Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20260312080113.843408-1-hbathini@linux.ibm.com Signed-off-by: Alexei Starovoitov commit c1bf657164413426cb4d7d1231f8a6b949f08188 Author: Frank Li Date: Wed Feb 11 16:41:04 2026 -0500 dt-bindings: input: touchscreen: convert fsl-mx25-tcq.txt to yaml Convert fsl-mx25-tcq.txt to yaml. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260211-yaml_mfd-v1-1-05cb48bc6f09@nxp.com Signed-off-by: Rob Herring (Arm) commit d3947aac97c3e57ee2f85fd1bef8e7674e609c45 Author: Johannes Berg Date: Fri Mar 13 13:01:06 2026 +0100 wifi: nl80211: reject S1G/60G with HT chantype This configuration doesn't make sense, neither S1G nor 60G have 20 or 40 MHz channel width. Reject it to not run into the new cfg80211_chandef_create() warning. Fixes: 92d77e06e73c ("wifi: cfg80211: restrict cfg80211_chandef_create() to only HT-based bands") Signed-off-by: Johannes Berg commit cb0caadb64ca0894c4a24e1a34841f260d462f90 Author: Shayne Chen Date: Fri Mar 13 14:21:49 2026 +0800 wifi: ieee80211: fix definition of EHT-MCS 15 in MRU According to the definition in IEEE Std 802.11be-2024, Table 9-417r, each bit indicates support for the transmission and reception of EHT-MCS 15 in: - B0: 52+26-tone and 106+26-tone MRUs. - B1: a 484+242-tone MRU if 80 MHz is supported. - B2: a 996+484-tone MRU and a 996+484+242-tone MRU if 160 MHz is supported. - B3: a 3×996-tone MRU if 320 MHz is supported. Fixes: 6239da18d2f9 ("wifi: mac80211: adjust EHT capa when lowering bandwidth") Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20260313062150.3165433-1-shayne.chen@mediatek.com Signed-off-by: Johannes Berg commit bf017304fce10933f18fafe140bf749fb9672058 Author: Bartosz Golaszewski Date: Wed Mar 4 10:02:26 2026 +0100 regulator: drop unneeded dependencies on OF_GPIO OF_GPIO is selected automatically on all OF systems. Any symbols it controls also provide stubs so there's really no reason to select it explicitly. Acked-by: Mark Brown Link: https://patch.msgid.link/20260304-gpio-of-kconfig-v1-5-d597916e79e7@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit dd1cdfb20e44e295512080dea508771b6a1f1c0a Author: Bartosz Golaszewski Date: Wed Mar 4 10:02:24 2026 +0100 powerpc: drop unneeded dependency on OF_GPIO OF_GPIO is automatically enabled on all OF systems. There's no need to select it explicitly. Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260304-gpio-of-kconfig-v1-3-d597916e79e7@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit d2cd20f7c2a4e4bf4fca844c01e925b112c5a2c5 Author: Bartosz Golaszewski Date: Wed Mar 4 10:02:23 2026 +0100 arc: axs10x: drop unneeded dependency on OF_GPIO OF_GPIO is automatically enabled on all OF systems. There's no need to select it explicitly. Acked-by: Vineet Gupta Link: https://patch.msgid.link/20260304-gpio-of-kconfig-v1-2-d597916e79e7@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 6b3f2475a036f58c7e20742b696d723f8e39ad22 Merge: 6e5cbf46c27ae4 6ab3532b4c98f4 Author: Rafael J. Wysocki Date: Fri Mar 13 14:16:59 2026 +0100 Merge branch 'acpi-video' into acpi-driver Merge a recent ACPI video bus driver fix to satisfy dependencies. commit 95acbb074694ead2a2f09888e673a485ed00ea22 Author: Imre Deak Date: Wed Mar 11 17:31:52 2026 +0200 drm/i915/dp: Simplify forcing a link retraining Since both the DP SST and MST HPD IRQ handlers call intel_dp_handle_link_service_irq() with LINK_STATUS_CHANGED set in irq_mask if intel_dp->link.force_retrain is set, checking for the former flag is sufficient to determine if the link status needs to be checked (which includes retraining the link if this is forced); remove checking for the latter flag. Since LINK_STATUS_CHANGED is currently set unconditionally for DP SST, extend the related comment to note that it must be set if intel_dp->link.force_retrain is set (in case setting LINK_STATUS_CHANGED becomes conditional on DPCD_REV). Reviewed-by: Suraj Kandpal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260311153152.133744-2-imre.deak@intel.com commit e41e992cb6534cac3a21a02d005c714f7f923653 Author: Imre Deak Date: Wed Mar 11 17:31:51 2026 +0200 drm/i915/dp_mst: Fix forced link retrain handling in MST HPD IRQ handler Handling of a forced link retraining debugfs request via the DP MST HPD IRQ handler is incorrectly skipped, if the IRQ handler doesn't see any HPD IRQs raised by the sink. Fix this by ensuring that the request is always handled (in the Fixes: commit below by directly calling intel_dp_check_link_state(), later by the same call moved to intel_dp_handle_link_service_irq()). Cc: Luca Coelho Fixes: db4855d90363 ("drm/i915/dp_mst: Reuse intel_dp_check_link_state() in the HPD IRQ handler") Reviewed-by: Suraj Kandpal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260311153152.133744-1-imre.deak@intel.com commit 28a7f755d7c9a4b9c41c12620fb4885f39b554ad Author: Yixun Lan Date: Wed Mar 4 07:36:45 2026 +0000 riscv: dts: spacemit: k3: add full resource to UART Previously the UART rely on external bootloader to initialize clock, pinctrl and reset, to solve this, explicitly adding those resource in Device Tree, so UART driver will handle them properly. Link: https://lore.kernel.org/r/20260304-01-dts-uart-full-v1-4-50a0aa53a245@kernel.org Signed-off-by: Yixun Lan commit 20b77926864203e10b85af5276b17c2812d92ec1 Author: Yixun Lan Date: Wed Mar 4 07:36:44 2026 +0000 riscv: dts: spacemit: k3: add GPIO support Add GPIO node in the Device Tree, so devices are able to request GPIO resource properly. Link: https://lore.kernel.org/r/20260304-01-dts-uart-full-v1-3-50a0aa53a245@kernel.org Signed-off-by: Yixun Lan commit d8944577496b5b99061d3b2020704fc86ab1f9e6 Author: Yixun Lan Date: Wed Mar 4 07:36:43 2026 +0000 riscv: dts: spacemit: k3: add pinctrl support Populate pinctrl node in Device Tree for SpacemiT K3 SoC, So devices can request pinctrl resource properly. Link: https://lore.kernel.org/r/20260304-01-dts-uart-full-v1-2-50a0aa53a245@kernel.org Signed-off-by: Yixun Lan commit 67072c8cd48c1fbb95cea39239eba5526395fcf5 Author: Yixun Lan Date: Wed Mar 4 07:36:42 2026 +0000 riscv: dts: spacemit: k3: add clock tree Add clock support to SpacemiT K3 SoC, the clock tree consist of several blocks which are APBC, APMU, DCIU, MPUM. Link: https://lore.kernel.org/r/20260304-01-dts-uart-full-v1-1-50a0aa53a245@kernel.org Signed-off-by: Yixun Lan commit 606a6b8bca570aa4f838ddd410345a2937bd98eb Author: Yixun Lan Date: Wed Mar 4 07:19:39 2026 +0000 dt-bindings: serial: 8250: spacemit: fix clock property for K3 SoC The UART of SpacemiT K3 SoC has same clock property as K1 generation which request two clock sources, fix the binding otherwise will get DT check warnings. Acked-by: Greg Kroah-Hartman Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260304-01-uart-clock-names-v1-1-338483f04a8b@kernel.org Signed-off-by: Yixun Lan commit 94645aa41bf9ecb87c2ce78b1c3405bfb6074a37 Author: Shiji Yang Date: Wed Jan 28 20:42:56 2026 +0800 mtd: spi-nor: swp: check SR_TB flag when getting tb_mask When the chip does not support top/bottom block protect, the tb_mask must be set to 0, otherwise SR1 bit5 will be unexpectedly modified. Signed-off-by: Shiji Yang Fixes: 3dd8012a8eeb ("mtd: spi-nor: add TB (Top/Bottom) protect support") Reviewed-by: Michael Walle Reviewed-by: Miquel Raynal Signed-off-by: Pratyush Yadav (Google) commit 6d660fba6a32a34ad7d746d7f65317831daaf033 Author: Haibo Chen Date: Tue Dec 23 11:01:02 2025 +0800 mtd: spi-nor: micron-st: add SNOR_CMD_PP_8_8_8_DTR sfdp fixup for mt35xu512aba Find two batches mt35xu512aba has different SFDP but with same jedec ID. The batch which use the new version of SFDP contain all the necessary information to support OCT DTR mode. The batch with old version do not contain the OCT DTR command information, but in fact it did support OCT DTR mode. Current mt35xu512aba_post_sfdp_fixup() add some setting including SNOR_CMD_READ_8_8_8_DTR, but still lack SNOR_CMD_PP_8_8_8_DTR. Meet issue on the batch mt35xu512aba with old SFDP version. Because no SNOR_CMD_PP_8_8_8_DTR, micron_st_nor_octal_dtr_en() will not be called, then use SNOR_CMD_READ_8_8_8_DTR will meet issue. Fixes: 44dd635cd632 ("mtd: spi-nor: micron-st: use SFDP of mt35xu512aba") Reviewed-by: Pratyush Yadav Signed-off-by: Haibo Chen Reviewed-by: Michael Walle [pratyush@kernel.org: touch up the comment a bit] Signed-off-by: Pratyush Yadav (Google) commit 07bee454fbf45fa36fdd505d97840b5412fde2e8 Author: Uwe Kleine-König Date: Mon Mar 9 21:19:55 2026 +0100 MAINTAINERS: Add #linux-pwm irc channel to pwm entry The channel exists since quite a while, it's very low volume, so chances are good that I see you starting a conversation. Link: https://patch.msgid.link/20260309201954.1938136-2-ukleinek@kernel.org Signed-off-by: Uwe Kleine-König commit 3620d67b48493c6252bbc873dc88dde81641d56b Author: Jonas Gorski Date: Thu Dec 18 10:54:30 2025 +0100 mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation After commit 5273cc6df984 ("mtd: spi-nor: core: Call spi_nor_post_sfdp_fixups() only when SFDP is defined") spi_nor_post_sfdp_fixups() isn't called anymore if no SFDP is detected. Update the documentation accordingly. Fixes: 5273cc6df984 ("mtd: spi-nor: core: Call spi_nor_post_sfdp_fixups() only when SFDP is defined") Signed-off-by: Jonas Gorski Reviewed-by: Pratyush Yadav Signed-off-by: Pratyush Yadav (Google) commit a90863095f84f6d17c49716e4e2212d28a6b25b5 Author: Suzuki K Poulose Date: Fri Mar 13 10:21:33 2026 +0000 MAINTAINERS: coresight: Add Leo Yan as Reviewer Leo has been an active contributor and reviewer for CoreSight subsystem for years. Add him as a Reviewer for CORESIGHT. Cc: Leo Yan Acked-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260313102133.2298330-1-suzuki.poulose@arm.com commit 756564a536ecd8c9d33edd89f0647a91a0b03587 Author: Haibo Chen Date: Mon Dec 8 17:14:14 2025 +0800 mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations When check read operation, need to setting the op.dummy.nbytes based on current read operation rather than the nor->read_proto. Fixes: 0e30f47232ab ("mtd: spi-nor: add support for DTR protocol") Signed-off-by: Haibo Chen Reviewed-by: Pratyush Yadav Signed-off-by: Pratyush Yadav (Google) commit 5827fe59745dc717e878177f104f0c1a96cfcb7f Author: Rosen Penev Date: Wed Mar 4 14:53:29 2026 -0800 rtc: armada38x: zalloc + calloc to single allocation Use a flexible array member to simplify allocation. Signed-off-by: Rosen Penev Reviewed-by: Gregory CLEMENT Link: https://patch.msgid.link/20260304225329.24510-1-rosenp@gmail.com Signed-off-by: Alexandre Belloni commit 5ff89ef425d17a43b1a48173482f8bfe2ce4fcd1 Author: Piyush Patle Date: Sat Feb 28 00:21:15 2026 +0530 dt-bindings: rtc: isl12026: convert to YAML schema Convert the ISL12026 RTC binding from text format to YAML schema. Remove the legacy text binding. The new schema enables dtbs_check validation. Signed-off-by: Piyush Patle Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260227185115.174997-1-piyushpatle228@gmail.com Signed-off-by: Alexandre Belloni commit 0928a28daf017504e14920f4131bb99e3bc39dba Author: bui duc phuc Date: Mon Mar 9 07:03:19 2026 +0700 ARM: dts: renesas: armadillo800eva: Add wakeup-source to st1232 Add the wakeup-source property to the ST1232 touchscreen node in the device tree so that the touchscreen interrupt can wake the system from suspend when the panel is touched. Signed-off-by: bui duc phuc Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260309000319.74880-3-phucduc.bui@gmail.com Signed-off-by: Geert Uytterhoeven commit 057c0944e09ff3392d2add958c3d2bd5b6586f1d Author: bui duc phuc Date: Tue Feb 24 14:45:32 2026 +0700 ARM: dts: renesas: armadillo800eva: Enable SDHI1 The Armadillo-800EVA board provides an SD card slot and an AWL13 SDIO interface connected to the SDHI1 controller. Routing between these two interfaces is controlled by a mechanical DIP switch and a set of multiplexers. To support this, add: - A fixed 3.3V regulator for SDHI1 power, controlled by PORT16 (G2), - SDHI1 pinmux groups for data, control, and card detection, - A gpio-hog for PORT6 (J5) to control the SDHI1/AWLAN multiplexer. PORT176 (N21) is already configured as output-high in this DTS (via lcd0-mux-hog), routing the SDSLOT2_ENABLE signal to PORT6. Since the hardware includes an external 10k pull-up resistor (R94) on this line, PORT6 is configured as an input to allow the physical DIP switch to determine the routing without SoC interference. Both configurations have been verified: - SD card (CON8): detected as mmcblk1, high-speed SDHC, - SDIO (CON14): detected as mmc1, high-speed SDIO. Signed-off-by: bui duc phuc Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260224074532.60046-1-phucduc.bui@gmail.com Signed-off-by: Geert Uytterhoeven commit b52db5af2c50cad0690b455a53ad2b886c8a25a5 Author: Xianwei Zhao Date: Thu Mar 12 03:10:28 2026 +0000 dt-bindings: pwm: amlogic: Document A4 A5 and T7 PWM Document amlogic,a4-pwm amlogic,a5-pwm and amlogic,t7-pwm compatible, which falls back to the meson-s4-pwm group. Signed-off-by: Xianwei Zhao Acked-by: Conor Dooley Link: https://patch.msgid.link/20260312-pwm_binding-v1-1-515cb65add98@amlogic.com Signed-off-by: Uwe Kleine-König commit 10663044bee592ba049a2aa37f4431fbdf93b739 Author: Frieder Schrempf Date: Mon Mar 9 09:57:42 2026 +0100 dt-bindings: rtc: microcrystal,rv3028: Allow to specify vdd-supply In case the VDD supply voltage regulator of the RTC needs to be specified explicitly, allow to set vdd-supply. Signed-off-by: Frieder Schrempf Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260309085749.25747-2-frieder@fris.de Signed-off-by: Alexandre Belloni commit 10f874dc92b3f3bf96470d997bdf157b289c9d4c Author: Heiner Kallweit Date: Sun Mar 1 13:31:56 2026 +0100 driver core: make struct class groups members constant arrays Constify the groups arrays, allowing to assign constant arrays. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/7ff56b07-09ca-4948-b98f-5bd37ceef21e@gmail.com Signed-off-by: Greg Kroah-Hartman commit ece5283706aff6791a37894bafbb0c134a94c0f3 Author: Heiner Kallweit Date: Sun Mar 1 13:31:02 2026 +0100 driver: core: constify groups array argument in device_add_groups and device_remove_groups Now that sysfs_create_groups() and sysfs_remove_groups() allow to pass constant groups arrays, we can constify the groups array argument also here. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/8ea2d6d1-0adb-4d7f-92bc-751e93ce08d6@gmail.com Signed-off-by: Greg Kroah-Hartman commit fe2511adb1fc1814df06ca11e0d8a92f792e4029 Author: Heiner Kallweit Date: Sun Mar 1 13:30:17 2026 +0100 sysfs: constify group arrays in function arguments Constify the groups array argument where applicable. This allows to pass constant arrays as arguments. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/17035265-8882-4101-b7a7-16b3eb94f8b5@gmail.com Signed-off-by: Greg Kroah-Hartman commit 15949f153059275d70a5448a17e429af51e3560c Author: Bartosz Golaszewski Date: Mon Feb 23 14:37:24 2026 +0100 soc: sunxi: mbus: don't access of_root directly Don't access of_root directly as it reduces the build test coverage for this driver with COMPILE_TEST=y and OF=n. Use existing helper functions to retrieve the relevant information. Suggested-by: Rob Herring Acked-by: Jernej Skrabec Signed-off-by: Bartosz Golaszewski Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223-soc-of-root-v2-9-b45da45903c8@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 3962c24f2d14e8a7f8a23f56b7ce320523947342 Author: Viorel Suman (OSS) Date: Wed Mar 11 14:33:09 2026 +0200 pwm: imx-tpm: Count the number of enabled channels in probe On a soft reset TPM PWM IP may preserve its internal state from previous runtime, therefore on a subsequent OS boot and driver probe "enable_count" value and TPM PWM IP internal channels "enabled" states may get unaligned. In consequence on a suspend/resume cycle the call "if (--tpm->enable_count == 0)" may lead to "enable_count" overflow the system being blocked from entering suspend due to: if (tpm->enable_count > 0) return -EBUSY; Fix the problem by counting the enabled channels in probe function. Signed-off-by: Viorel Suman (OSS) Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support") Link: https://patch.msgid.link/20260311123309.348904-1-viorel.suman@oss.nxp.com Cc: stable@vger.kernel.org Signed-off-by: Uwe Kleine-König commit d3908631838329746d093dc24a1d4935c36c753c Author: Francesco Dolcini Date: Fri Mar 6 16:31:17 2026 +0100 arm64: defconfig: Enable configurations for Toradex Aquila AM69 Enable the configurations needed for Aquila AM69 SoM and compatible carrier boards. - CONFIG_SENSORS_AMC6821, needed for the fan controller on the clover and dev carrier board (as module). - CONFIG_POWER_RESET_GPIO and CONFIG_POWER_RESET_GPIO_RESTART needed for poweroff and restart functionalities (as built-in, it's not possible to set them as 'm'). Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20260306153130.102972-1-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit b632eb8cd72268f5fbc982442e5210dda41b0340 Author: Michael Walle Date: Mon Mar 2 13:24:47 2026 +0100 arm64: defconfig: remove SENSORS_SA67MCU Remove the SENSORS_SA67MCU from the defconfig because the driver was removed. Signed-off-by: Michael Walle Link: https://patch.msgid.link/20260302122540.1377444-3-mwalle@kernel.org Signed-off-by: Vignesh Raghavendra commit 6ee0792d83d5c690205c350825a4c30746c0e0a2 Author: Siddharth Vadapalli Date: Mon Mar 9 10:25:32 2026 +0530 arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 The pin for GPMC0_CLK.GPIO0_31 at address 0x000F407C is N22 and not M19. Hence, fix the pin name in the comment to avoid confusion. Fixes: 8f023012eb4a ("arm64: dts: ti: k3-am62a: Enable UHS mode support for SD cards") Cc: stable@vger.kernel.org Signed-off-by: Siddharth Vadapalli Reviewed-by: Andrew Davis Reviewed-by: Bryan Brattlof Link: https://patch.msgid.link/20260309045539.2070793-1-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit e416e7fa417b2d2604c1526a2f9cc38da7ced166 Author: Randy Dunlap Date: Tue Mar 10 22:29:53 2026 -0700 tee: clean up tee_core.h kernel-doc Use the correct struct member name and function parameter name in kernel-doc comments. Move a macro that was between a struct's documentation and its declaration. These eliminate the following kernel-doc warnings: Warning: include/linux/tee_core.h:73 struct member 'c_no_users' not described in 'tee_device' Warning: include/linux/tee_core.h:132 #define TEE_DESC_PRIVILEGED 0x1; error: Cannot parse struct or union! Warning: include/linux/tee_core.h:257 function parameter 'connection_data' not described in 'tee_session_calc_client_uuid' Warning: include/linux/tee_core.h:320 function parameter 'teedev' not described in 'tee_get_drvdata' Signed-off-by: Randy Dunlap Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit cbfea84f820962c3c5394ff06e7e9344c96bf761 Author: Richard Fitzgerald Date: Tue Mar 10 11:31:33 2026 +0000 soundwire: cadence: Clear message complete before signaling waiting thread Clear the CDNS_MCP_INT_RX_WL interrupt before signaling completion. This is to prevent the potential race where: - The main thread is scheduled immediately the completion is signaled, and starts a new message - The RX_WL IRQ for this new message happens before sdw_cdns_irq() has been re-scheduled. - When sdw_cdns_irq() is re-scheduled it clears the new RX_WL interrupt. MAIN THREAD | IRQ THREAD | _cdns_xfer_msg() | { | write data to FIFO | wait_for_completion_timeout() | | <---- RX_WL IRQ | sdw_cdns_irq() | { | signal completion <== RESCHEDULE <== Handle message completion | } | | Start new message | _cdns_xfer_msg() | { | write data to FIFO | wait_for_completion_timeout() | | <---- RX_WL IRQ ==> RESCHEDULE ==> | // New RX_WL IRQ is cleared before | // it has been handled. | clear CDNS_MCP_INTSTAT | return IRQ_HANDLED; | } Before this change, this error message was sometimes seen on kernels that have large amounts of debugging enabled: SCP Msg trf timed out This error indicates that the completion has not been signalled after 500ms. Signed-off-by: Richard Fitzgerald Fixes: 956baa1992f9 ("soundwire: cdns: Add sdw_master_ops and IO transfer support") Reported-by: Norman Bintang Closes: https://issuetracker.google.com/issues/477099834 Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260310113133.1707288-1-rf@opensource.cirrus.com Signed-off-by: Vinod Koul commit ba683f774299d89d17cde03bb1bdb13f3513cd20 Author: Geert Uytterhoeven Date: Thu Mar 5 11:13:14 2026 +0100 drm: renesas: rz-du: mipi_dsi: Convert to FIELD_MODIFY() Use the FIELD_MODIFY() helper instead of open-coding the same operation. Signed-off-by: Geert Uytterhoeven Reviewed-by: Biju Das Link: https://patch.msgid.link/da7709d50894d422442401e6e3ff4c4715a33fa5.1772705564.git.geert+renesas@glider.be Signed-off-by: Biju Das commit 341a2c99c87ce6f62c6f4423fa641a39f0966bff Author: Nitin Gote Date: Thu Mar 12 21:32:45 2026 +0530 drm/xe/uapi: Fix kernel-doc for DRM_XE_VM_BIND_FLAG_DECOMPRESS There is kernel-doc warning for DRM_XE_VM_BIND_FLAG_DECOMPRESS: ./include/uapi/drm/xe_drm.h:1060: WARNING: Block quote ends without a blank line; unexpected unindent. Fix the warning by adding the missing '%' prefix to DRM_XE_VM_BIND_FLAG_DECOMPRESS in the kernel-doc list entry for struct drm_xe_vm_bind_op. Fixes: 2270bd7124f4 ("drm/xe: add VM_BIND DECOMPRESS uapi flag") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603121515.gEMrFlTL-lkp@intel.com/ Cc: Matthew Auld Signed-off-by: Nitin Gote Reviewed-by: Matthew Auld Link: https://patch.msgid.link/20260312160244.809849-2-nitin.r.gote@intel.com Signed-off-by: Tejas Upadhyay commit 7218d8e9d8485b08933d832615ca19760a8999cd Author: Lachlan Hodges Date: Thu Mar 12 15:58:04 2026 +1100 wifi: cfg80211: check non-S1G width with S1G chandef It is not valid to have an S1G chandef with a non-S1G width. Enforce this during chandef validation. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20260312045804.362974-4-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 92d77e06e73ca987b030cfed322e8421db1d6f41 Author: Lachlan Hodges Date: Thu Mar 12 15:58:03 2026 +1100 wifi: cfg80211: restrict cfg80211_chandef_create() to only HT-based bands cfg80211_chandef_create() should only be used by bands that are HT-based and the chantype argument makes sense. Insert a WARN such that it isn't used on 60GHz and S1GHz bands and to catch any potential existing uses by those bands. Suggested-by: Johannes Berg Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20260312045804.362974-3-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit a6d4291eae0409e63525d3b26f44feae6f6f4659 Author: Lachlan Hodges Date: Thu Mar 12 15:58:02 2026 +1100 wifi: mac80211: don't use cfg80211_chandef_create() for default chandef cfg80211_chandef_create() is called universally to create the default chandef during hw registration, however it only really makes sense to be used for 2GHz, 5GHz, and 6GHz (and by extension the 'LC' band) as it relies on the channel type which is only relevant to those specific bands. To reduce some confusion, create a generic helper for creating the default chandef that makes sense for all supported bands. Suggested-by: Johannes Berg Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20260312045804.362974-2-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 84674b03d8bf3a850f023a98136c27909f0a2b61 Author: Lorenzo Bianconi Date: Mon Mar 9 09:28:28 2026 +0100 wifi: mac80211: Remove deleted sta links in ieee80211_ml_reconf_work() Delete stale station links announced in the reconfiguration IE transmitted by the AP in the beacon frames. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260309-mac80211-reconf-remove-sta-link-v2-1-1582aac720c6@kernel.org Signed-off-by: Johannes Berg commit 8bca522588e0aace011bf411bb0354e0ca17f144 Author: Joshua Peisach Date: Sat Mar 7 12:01:35 2026 -0500 wifi: b43: use register definitions in nphy_op_software_rfkill Replaces uses of hardcoded register addresses with proper definitions, for readability. Signed-off-by: Joshua Peisach Acked-by: Michael Büsch Link: https://patch.msgid.link/20260307170135.167460-1-jpeisach@ubuntu.com Signed-off-by: Johannes Berg commit fd2905157d692b9dee39d27bccb7b255e57ba3f4 Author: Johannes Berg Date: Tue Mar 3 15:26:19 2026 +0100 wifi: cfg80211: split control freq check from chandef check In order to introduce NPCA later, split the control frequency check out of cfg80211_chandef_valid(). Link: https://patch.msgid.link/20260303152641.11b31e4878a7.I534669506008e12ffcd6c115161777e528fdc838@changeid Signed-off-by: Johannes Berg commit f932856649b07529d9dbd0f2f7fb7fcc5b929858 Author: Johannes Berg Date: Tue Mar 3 15:26:18 2026 +0100 wifi: mac80211: always use full chanctx compatible check For NPCA, we need to treat the channel request differently for AP and other interfaces (APs can share NPCA, under the assumption that userspace will set them up with the same BSS color.) This is difficult if we have to check against a chanreq made up from the chanctx, but this isn't a code path that needs to be highly optimised, so just always use the (originally) recheck functionality to check against all users of the chanctx. Link: https://patch.msgid.link/20260303152641.1a3ff6ead82b.I486f1a94b9a32e0b045815cbbb22679c8cef56e4@changeid Signed-off-by: Johannes Berg commit ba9d121f85771cce38012d1bee59d7399250e4a5 Author: Johannes Berg Date: Tue Mar 3 15:26:17 2026 +0100 wifi: mac80211: refactor chandef tracing macros We don't need to duplicate the macros, just make a generic one that gets the name prefix to be used, and use that to create the others. While at it, add the puncturing bitmap to the trace and simplify the ternary expressions. Reviewed-by: Miriam Rachel Korenblit Link: https://patch.msgid.link/20260303152641.ca32d70055f8.I8138a31ceb75715d928d807554288baccc33cd8c@changeid Signed-off-by: Johannes Berg commit f2514ff78855c45fe93c82bdb45f7609dd70c637 Author: Johannes Berg Date: Tue Mar 3 15:08:33 2026 +0100 wifi: mac80211: validate HE 6 GHz operation when EHT is used When in strict mode, validate that the HE 6 GHz operation is valid even when EHT operation is used instead. This checks that APs are advertising correct information for HE clients, without testing with such clients. Reviewed-by: Ilan Peer Reviewed-by: Miriam Rachel Korenblit Link: https://patch.msgid.link/20260303150832.74b934163b99.If4d1db3f39c37900cf0d0f4669cd5f8b677daaa0@changeid Signed-off-by: Johannes Berg commit e4b993f2bca78357b430170574f8de7bc7874088 Author: Johannes Berg Date: Tue Mar 3 22:17:09 2026 +0100 wifi: nl80211: split out UHR operation information The beacon doesn't contain the full UHR operation, a number of fields (such as NPCA) are only partially there. Add a new attribute to contain the full information, so it's available to the driver/mac80211. Link: https://patch.msgid.link/20260303221710.866bacf82639.Iafdf37fb0f4304bdcdb824977d61e17b38c47685@changeid Signed-off-by: Johannes Berg commit 5f6da19359a8c289d4d327c4043905d04726fbc4 Author: Suraj Kandpal Date: Wed Feb 25 12:20:45 2026 +0530 drm/i915/hdcp: Take force_hdcp14 into account during check_link During intel_hdcp_check_link phase we need to take into account if we are currently forcing HDCP 1.4 or not. This is because we check for HDCP 2.x Link first and only if HDCP 2.x is not being used check for HDCP 1.4. With force_hdcp14 in picture we should not be going into intel_hdcp2_check_link because of which we may end up trying to disable HDCP2.x even if HDCP 1.4 was enabled causing a lot of issues while IGT tests this. Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260225065045.3040787-1-suraj.kandpal@intel.com commit 8f921f61005450589c0bc1a941a5ddde21d9aed9 Author: Kexin Sun Date: Wed Mar 11 21:35:19 2026 +0800 netlink: update outdated comment The function netlink_clear_multicast_users() was removed as unused in commit 2173f8d953e7 ("netlink: cleanup tap related functions"). Update the comment in netlink_change_ngroups() to remove the stale reference, replacing it with a general description of the behavior while preserving the warning. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260311133519.688-1-kexinsun@smail.nju.edu.cn Signed-off-by: Jakub Kicinski commit 886d56099d947443936298a8f98533768c5ad44b Author: Kexin Sun Date: Wed Mar 11 21:30:11 2026 +0800 qlcnic: update outdated comment The function pci_unmap_page() was a compatibility wrapper around dma_unmap_page(), and was removed by commit 7968778914e5 ("PCI: Remove the deprecated pci-dma-compat.h API"). Update the comment accordingly. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260311133012.519-1-kexinsun@smail.nju.edu.cn Signed-off-by: Jakub Kicinski commit 08dc30de1a402fe88fd80592cf6c72c4c2ebbcbc Author: Eric Dumazet Date: Wed Mar 11 19:13:40 2026 +0000 net: add skb_defer_disable_key static key Add a static key to bypass skb_attempt_defer_free() steps if net.core.skb_defer_max is set to zero. Main benefit is the atomic_long_inc_return() avoidance. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260311191340.1996888-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 15abbe7c82661209c1dc67c21903c07e2fff5aae Author: Nimrod Oren Date: Mon Mar 9 10:13:01 2026 +0200 net: page_pool: scale alloc cache with PAGE_SIZE The current page_pool alloc-cache size and refill values were chosen to match the NAPI budget and to leave headroom for XDP_DROP recycling. These fixed values do not scale well with large pages, as they significantly increase a given page_pool's memory footprint. Scale these values to better balance memory footprint across page sizes, while keeping behavior on 4KB-page systems unchanged. Reviewed-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Nimrod Oren Link: https://patch.msgid.link/20260309081301.103152-1-noren@nvidia.com Signed-off-by: Jakub Kicinski commit 06fc88a6973fa6203c7c0cd3f5cef9d3405928ca Merge: 6e263aadbaf231 c1f9a89b0c9012 Author: Jakub Kicinski Date: Thu Mar 12 18:02:15 2026 -0700 Merge branch 'genetlink-apply-reject-policy-for-split-ops-on-the-dispatch-path' Jakub Kicinski says: ==================== genetlink: apply reject policy for split ops on the dispatch path Looks like I somehow missed adding default reject policies to commands in families using split Netlink ops. I realized this randomly trying to dump page pools for a specific device and always getting all of them back. The per-device dump is simply not implemented so the request should have been rejected. Patch 2 is the real change, the rest is just accompaniment. ==================== Link: https://patch.msgid.link/20260311032839.417748-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c1f9a89b0c901266028e66cd8e6bdf54c8c3042e Author: Jakub Kicinski Date: Tue Mar 10 20:28:39 2026 -0700 selftests: net: add test for Netlink policy dumps Add validation for the nlctrl family, accessing family info and dumping policies. TAP version 13 1..4 ok 1 nl_nlctrl.getfamily_do ok 2 nl_nlctrl.getfamily_dump ok 3 nl_nlctrl.getpolicy_dump ok 4 nl_nlctrl.getpolicy_by_op # Totals: pass:4 fail:0 xfail:0 xpass:0 skip:0 error:0 Link: https://patch.msgid.link/20260311032839.417748-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e911be835432b1e0fd70d1cc35127de189141f96 Author: Jakub Kicinski Date: Tue Mar 10 20:28:38 2026 -0700 selftests: net: make sure that Netlink rejects unknown attrs in dump Add a test case for rejecting attrs if policy is not set. dev_get dump has no input policy (accepts no attrs). Link: https://patch.msgid.link/20260311032839.417748-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e3a5b7f8ef2abe7b119c1806ee214d648289faf6 Author: Jakub Kicinski Date: Tue Mar 10 20:28:37 2026 -0700 genetlink: apply reject policy for split ops on the dispatch path Commit 4fa86555d1cd ("genetlink: piggy back on resv_op to default to a reject policy") added genl_policy_reject_all to ensure that ops without an explicit policy reject all attributes rather than silently accepting them. This change was applied to net. When split ops were later introduced in net-next in commit b8fd60c36a44 ("genetlink: allow families to use split ops directly"), genl_op_fill_in_reject_policy_split() was added and called from genl_op_from_split() (used for policy dumping and registration). However, genl_get_cmd_split(), which is called for incoming messages, copies split_ops entries as-is without applying the reject policy. This means that split ops without policy accept all inputs. This looks like an omission / mistake made when splitting the changes between net and net-next. Let's try to re-introduce the checking. Not considering this a fix given the regression potential. If anyone reports issues we should probably fill in fake policies for specific ops rather than reverting this. Link: https://patch.msgid.link/20260311032839.417748-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b93ec16310b4bfc14af12321257dd7237ef4cce9 Author: Jakub Kicinski Date: Tue Mar 10 20:28:36 2026 -0700 genetlink: use maxattr of 0 for the reject policy Commit 4fa86555d1cd ("genetlink: piggy back on resv_op to default to a reject policy") added genl_policy_reject_all to ensure that ops without an explicit policy reject all attributes rather than silently accepting them. The reject policy had maxattr of 1. Passing info->attrs of size 2 may surprise families. Devlink, for instance, assumes that if info->attrs is set it's safe to access DEVLINK_ATTR_BUS_NAME (1) and DEVLINK_ATTR_DEV_NAME (2). Before plugging reject policies into split ops we need to make sure the genetlink code will not populate info->attrs if family had no explicit policy for the op. While even shared code paths within the families can figure out that given op has no policy fairly easily themselves, passing attrs with fixed size of 2 feels fairly useless and error prone. This change has no user-visible impact, reject attrs are not reported to the user space via getpolicy. We do have to remove the safety check in netlink_policy_dump_get_policy_idx() but it seems to have been there to catch likely faulty input, the code can handle maxattr = 0 just fine. Link: https://patch.msgid.link/20260311032839.417748-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6e263aadbaf231bbb73e1fed048b3e3591f06264 Author: Russell King (Oracle) Date: Wed Mar 11 01:07:00 2026 +0000 net: phy: vitesse: add inband caps and configuration Add support for VSC8662 reporting its inband capabilities, and also hook to configure the PHY's inband mode. This fixes a regression in the macb driver caused by commit 1338cfef1ff1 ("net: macb: fix SGMII with inband aneg disabled") Cc: stable+noautosel@kernel.org # neither this nor commit under fixes should be backported Reported-by: Conor Dooley Link: https://lore.kernel.org/r/20260304-nebulizer-rounding-40fbc81a2ba1@spud Signed-off-by: Russell King (Oracle) Tested-by: Conor Dooley Tested-by: Geert Uytterhoeven Fixes: 1338cfef1ff1b958 ("net: macb: fix SGMII with inband aneg disabled") Link: https://patch.msgid.link/E1w082O-0000000ChNc-1wDz@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7c52f407f28d2e3746a931f88869b0169a09ed6a Author: Hangbin Liu Date: Wed Mar 11 11:22:29 2026 +0800 ynl: ethtool: remove duplicated unspec entry There is a duplicated unspec entry. Remove it. No user impact expected, found by inspection. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20260311-b4-drop_dup_unspec-v1-1-e0dfa47b5981@gmail.com Signed-off-by: Jakub Kicinski commit 00699d944836576d2789eb0cf02d989b975375d7 Author: ShravyaPanchagiri Date: Tue Mar 10 22:04:50 2026 -0500 docs: octeontx2: fix typo in documentation Fix spelling mistake "Crate" to "Create" in the documentation. Signed-off-by: ShravyaPanchagiri Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260311030450.8461-1-shravy112@gmail.com Signed-off-by: Jakub Kicinski commit 158ecce9c32abf860d8d76ddc206fb34c2530ac8 Author: Andrew Goodbody Date: Thu Mar 12 14:16:57 2026 +0000 ARM: dts: omap: dm816x: Correct pinctrl register The declaration in the pinmux device for the pinctrl registers is not correct. These registers are actually 32 bits wide, not 16. Also the mask for functional bits is also wrong. Functional bits are 0-4, not 0-3. So the mask needs to changed to 0x1f. This information is taken from the TMS320DM816x DaVinci Digital Media Processors Technical Reference Manual. SPRUGX8C March 2015 Signed-off-by: Andrew Goodbody Reviewed-by: Christopher Obbard Tested-by: Christopher Obbard Link: https://patch.msgid.link/20260312-dm816x_dt-v1-1-ed3370b20799@linaro.org [khilman: fix minor typo: s/delcaration/declaration/] Signed-off-by: Kevin Hilman commit cf4812898b58228d9705a9426e8351360b25c5a4 Author: Rosen Penev Date: Tue Mar 10 17:41:59 2026 -0700 regulator: da9063: kzalloc + kcalloc to kzalloc Reduce main allocation to a single kzalloc call by using a flexible array member. Allows using __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260311004159.32374-1-rosenp@gmail.com Signed-off-by: Mark Brown commit 7bbf70131f937ee5871e22d159ed2fc66795722f Merge: 92ae0c1efc6c7b 07c4e7a6f6b1d1 Author: Vasily Gorbik Date: Fri Mar 13 00:13:51 2026 +0100 Merge branch 'page-table-check-support' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux into features Add s390 support for CONFIG_PAGE_TABLE_CHECK. * 'page-table-check-support' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: Enable page table check for debug_defconfig s390/pgtable: Add s390 support for page table check s390/pgtable: Use set_pmd_bit() to invalidate PMD entry mm/page_table_check: Pass mm_struct to pxx_user_accessible_page() Signed-off-by: Vasily Gorbik commit 07c4e7a6f6b1d1ac871ae93c203b20144b709ec5 Author: Alexander Gordeev Date: Fri Mar 6 17:16:33 2026 +0100 s390: Enable page table check for debug_defconfig Reviewed-by: Gerald Schaefer Signed-off-by: Alexander Gordeev Link: https://lore.kernel.org/r/975007c27f8563e46d66a1fbb4b14ae6a4147edd.1772812343.git.agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik commit 7b4dde5e40ad68d68a6b3bdc9621cb4cdce54e43 Author: Tobias Huschle Date: Fri Mar 6 17:16:32 2026 +0100 s390/pgtable: Add s390 support for page table check Add page table check hooks into routines that modify user page tables. Unlike other architectures s390 does not have means to distinguish between kernel and user page table entries. Rely on the fact the page table check infrastructure itself operates on non-init_mm memory spaces only. Use the provided mm_struct to verify that the memory space is not init_mm (aka not the kernel memory space) indeed. That check is supposed to be succeeded already (on some code paths even twice). If the passed memory space by contrast is init_mm that would be an unexpected semantical change in generic code, so do VM_BUG_ON() in such case. Unset _SEGMENT_ENTRY_READ bit to indicate that pmdp_invalidate() was applied against a huge PMD and is going to be updated by set_pmd_at() shortly. The hook pmd_user_accessible_page() should skip such entries until that, otherwise the page table accounting falls apart and BUG_ON() gets hit as result. The invalidated huge PMD entry should not be confused with a PROT_NONE entry as reported by pmd_protnone(), though the entry characteristics exactly match: _SEGMENT_ENTRY_LARGE is set while _SEGMENT_ENTRY_READ is unset. Since pmd_protnone() implementation depends on NUMA_BALANCING configuration option, it should not be used in pmd_user_accessible_page() check, which is expected to be CONFIG_NUMA_BALANCING-agnostic. Nevertheless, an invalidated huge PMD is technically still pmd_protnone() entry and it should not break other code paths once _SEGMENT_ENTRY_READ is unset. As of now, all pmd_protnone() checks are done under page table locks or exercise GUP-fast and HMM code paths, which are expected to be safe against concurrent page table updates. Alternative approach would be using the last remaining unused PMD entry bit 0x800 to indicate that pmdp_invalidate() was called on a PMD. That would allow avoiding collisions with pmd_protnone() handling code paths, but saving the bit is more preferable way to go. Reviewed-by: Gerald Schaefer Signed-off-by: Tobias Huschle Co-developed-by: Alexander Gordeev Signed-off-by: Alexander Gordeev Link: https://lore.kernel.org/r/4db8a681205bd555298d62441cdcfca43317a35a.1772812343.git.agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik commit 2f34c2e609540c6bf806261e2f9a9d8f77b388ef Author: Alexander Gordeev Date: Fri Mar 6 17:16:31 2026 +0100 s390/pgtable: Use set_pmd_bit() to invalidate PMD entry Commit 3a5a8d343e1c ("mm: fix race between __split_huge_pmd_locked() and GUP-fast") failed to follow the convention and used direct PMD entry modification instead of set_pmd_bit(). Reviewed-by: Gerald Schaefer Signed-off-by: Alexander Gordeev Link: https://lore.kernel.org/r/a9248694a38cc898d3f0628f59b8abb57d56a416.1772812343.git.agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik commit cf8771ca4cdbd78232338652b98a7c5c9e0a6184 Author: Tobias Huschle Date: Fri Mar 6 17:16:30 2026 +0100 mm/page_table_check: Pass mm_struct to pxx_user_accessible_page() Unlike other architectures, s390 does not have means to distinguish kernel vs user page table entries - neither an entry itself, nor the address could be used for that. It is only the mm_struct that indicates whether an entry in question is mapped to a user space. So pass mm_struct to pxx_user_accessible_page() callbacks. [agordeev@linux.ibm.com: rephrased commit message, removed braces] Acked-by: Madhavan Srinivasan Reviewed-by: Gerald Schaefer Reviewed-by: Andrew Morton Reviewed-by: Ritesh Harjani (IBM) #powerpc Signed-off-by: Tobias Huschle Signed-off-by: Alexander Gordeev Link: https://lore.kernel.org/r/ca77f3489453c2fe01b25e50e53b778929e0dfc5.1772812343.git.agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik commit 0026bb20d12531ca2925b60bf081cc8be910ccf9 Author: Richard Cheng Date: Thu Mar 12 19:54:41 2026 +0800 PCI: Use pr_warn_once() for ACS parameter parse failure When the ACS command line parameter cannot be parsed, the kernel skips applying the requested ACS override. This indicates an invalid boot parameter and should not be logged at informational level. Use pr_warn_once() so the message is surfaced as a warning while still avoiding repeated log spam during device enumeration. Signed-off-by: Richard Cheng Signed-off-by: Bjorn Helgaas Acked-by: Tushar Dave Link: https://patch.msgid.link/20260312115441.8168-1-icheng@nvidia.com commit e89b5724aaf362cc84ecacaf56eb09a88e57441e Author: Viacheslav Dubeyko Date: Mon Mar 9 14:49:48 2026 -0700 hfsplus: set ctime after setxattr and removexattr The generic/728 test-case complains that: (1) Expected ctime needs to be changed after setxattr; (2) Expected ctime needs to be changed after removexattr. This patch adds calling inode_set_ctime_current() in __hfsplus_setxattr() and hfsplus_removexattr(). sudo ./check generic/728 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #6 SMP PREEMPT_DYNAMIC Mon Mar 9 14:29:30 PDT 2026 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/728 35s ... 44s Ran: generic/728 Passed all 1 tests cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260309214947.1114618-2-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit bb729bf1d6fdf5c2087c1651165c74cef0da1742 Author: Li Ming Date: Tue Mar 10 23:57:53 2026 +0800 driver core: Add conditional guard support for device_lock() Introduce conditional guard version of device_lock() for scenarios that require conditional device lock holding. Suggested-by: Dan Williams Reviewed-by: Dan Williams Acked-by: Greg Kroah-Hartman Signed-off-by: Li Ming Link: https://patch.msgid.link/20260310-fix_access_endpoint_without_drv_check-v1-1-94fe919a0b87@zohomail.com Signed-off-by: Danilo Krummrich commit 29ca18505d58fedf2388c303156107c4ed97197b Author: Rosen Penev Date: Tue Mar 10 12:46:46 2026 -0700 net: xgbe: use device_get_mac_addr device_get_mac_addr is basically device_property_read_u8_array with an is_valid_ether_addr call. Allows just checking for ret. Remove XGBE_MAC_ADDR_PROPERTY. device_get_mac_addr supports more properties than just "mac-address". Signed-off-by: Rosen Penev Reviewed-by: Sai Krishna Link: https://patch.msgid.link/20260310194647.3794-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski commit 9f49e185ee31d5d5fc8ea1a23aaaba5a4374a949 Author: Matt Roper Date: Thu Mar 12 09:29:23 2026 -0700 drm/xe/wa: Drop redundant entries for Wa_16021867713 & Wa_14019449301 The Xe2_HPM-specific RTP table entries for Wa_16021867713 and Wa_14019449301 were removed by commit 941f538b0af8 ("drm/xe: Consolidate workaround entries for Wa_16021867713") and commit aa0f0a678370 ("drm/xe: Consolidate workaround entries for Wa_14019449301") in favor of alternate entries earlier in the table that cover a wider range of IP versions. However these Xe2_HPM-specific entries were accidentally resurrected during a backmerge, which causes the Xe driver to complain on probe about two entries trying to program the same registers+bits: <3> [48.491155] xe 0000:03:00.0: [drm] *ERROR* Tile0: GT1: discarding save-restore reg 1c3f1c (clear: 00000008, set: 00000008, masked: no, mcr: no): ret=-22 <3> [48.491211] xe 0000:03:00.0: [drm] *ERROR* Tile0: GT1: discarding save-restore reg 1d3f1c (clear: 00000008, set: 00000008, masked: no, mcr: no): ret=-22 <3> [48.491225] xe 0000:03:00.0: [drm] *ERROR* Tile0: GT1: discarding save-restore reg 1c3f08 (clear: 00000020, set: 00000020, masked: no, mcr: no): ret=-22 <3> [48.491238] xe 0000:03:00.0: [drm] *ERROR* Tile0: GT1: discarding save-restore reg 1d3f08 (clear: 00000020, set: 00000020, masked: no, mcr: no): ret=-22 Re-drop the redundant Xe2_HPM-specific entries to eliminate the dmesg errors. Fixes: 58351f46de26 ("Merge v7.0-rc3 into drm-next") Cc: Simona Vetter Cc: Rodrigo Vivi Cc: Matthew Brost Cc: Thomas Hellström Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7608 Reviewed-by: Simona Vetter Link: https://patch.msgid.link/20260312-wa_merge_fix-v1-1-2ec6607f1e0c@intel.com Signed-off-by: Matt Roper commit f862f2919669ea6ceffb1d901d5e66c6625ad743 Merge: 393815f5765110 591230c6f26830 Author: Rafael J. Wysocki Date: Thu Mar 12 21:16:46 2026 +0100 Merge back ACPI OS services layer (OSL) material for 7.1 commit a943787d20c97b103e45d65e16fc73ac0d2ff545 Merge: d557640e4ce589 d51de21b4c3a34 Author: Rafael J. Wysocki Date: Thu Mar 12 21:15:20 2026 +0100 Merge back cpuidle material for 7.1 commit 72374257ede14897ee3d5a709c2498f7b6a1764b Merge: 8e7adcf81564a3 2c7e63d702f6c4 Author: Jakub Kicinski Date: Thu Mar 12 12:53:34 2026 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-7.0-rc4). drivers/net/ethernet/mellanox/mlx5/core/en_rx.c db25c42c2e1f9 ("net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ") dff1c3164a692 ("net/mlx5e: SHAMPO, Always calculate page size") https://lore.kernel.org/aa7ORohmf67EKihj@sirena.org.uk drivers/net/ethernet/ti/am65-cpsw-nuss.c 840c9d13cb1ca ("net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support") a23c657e332f2 ("net: ethernet: ti: am65-cpsw: Use also port number to identify timestamps") https://lore.kernel.org/abK3EkIXuVgMyGI7@sirena.org.uk No adjacent changes. Signed-off-by: Jakub Kicinski commit ece3e8980907818c72dc9faa7bbaf40488ef1824 Author: Lizhi Hou Date: Mon Jan 26 11:30:01 2026 -0800 accel/amdxdna: Allow forcing IOVA-based DMA via module parameter The amdxdna driver normally performs DMA using userspace virtual address plus PASID. For debugging and validation purposes, add a module parameter, force_iova, to force DMA to go through IOMMU IOVA mapping. When force_iova=1 is set, the driver will allocate and map DMA buffers using IOVA. Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260126193001.1400545-1-lizhi.hou@amd.com commit 9d28af133ef2de00239dc8a8b7878aa4f1b3ecb1 Author: Alexey Charkov Date: Wed Mar 11 20:25:02 2026 +0400 arm64: dts: rockchip: Add analog audio switches to RK3576 EVB1 These allow selective muting/unmuting of inputs and outputs, as well as setting mutually-exclusive rules in ALSA UCM. Signed-off-by: Alexey Charkov Link: https://patch.msgid.link/20260311-evb1-audio-switches-v1-1-0e0199e56c80@flipper.net Signed-off-by: Heiko Stuebner commit beb2b0a26c3a1021421e8db40154c3b6687b6621 Author: Dmitry Torokhov Date: Wed Mar 11 22:50:57 2026 -0700 Input: psmouse - remove dedicated kpsmoused workqueue The only user of psmouse_queue_work() and therefore kpsmoused workqueue is psmouse-base itself, when it tries to schedule the resync work. Since resyncing is not going to race with itself we no longer need the dedicated ordered workqueue. Remove it and switch to using regular (non-delayed) work structure scheduled on the default workqueue. Signed-off-by: Dmitry Torokhov commit d4904a3d7159b342d45de8495046d33d1c18998e Author: Dmitry Torokhov Date: Wed Mar 11 22:39:58 2026 -0700 Input: alps - use standard workqueue when registering supplemental device Registering supplemental bare PS/2 device does not need to be ordered relative to attempt to resynchronization done in psmouse core. Switch to the default workqueue and use normal (non-delayed) work. Signed-off-by: Dmitry Torokhov commit 3873f16d4936690ddd7b35231fa5c712a3c63a54 Author: Duoming Zhou Date: Wed Dec 17 11:00:18 2025 +0800 Input: psmouse - replace flush_workqueue() with disable_delayed_work_sync() The original code uses flush_workqueue() in psmouse_disconnect() to ensure the completion of both resync_work and dev3_register_work. Given that alps_disconnect() already uses disable_delayed_work_sync() to cancel dev3_register_work, replacing flush_workqueue() with disable_delayed_work_sync(&psmouse->resync_work) is more robust and efficient. Signed-off-by: Duoming Zhou Link: https://patch.msgid.link/6e40a46e5d9e6e3237702958b8f641263c28d2e4.1765939397.git.duoming@zju.edu.cn Signed-off-by: Dmitry Torokhov commit e732b2ac0a18b64369c0def65b6214f6748d0d73 Author: Dmitry Torokhov Date: Tue Mar 10 17:43:29 2026 -0700 Input: hgpk - remove protocol support The protocol flavor for ALPS touchpads found in OLPC laptops has been broken since 2015 commit c378b5119eb0 ("Input: psmouse - factor out common protocol probing code") that forgot to add hgpk_init() to HGPK entry in psmouse_protocols array. Since nobody complained for 10 years let's remove it. Acked-by: Andres Salomon Link: https://patch.msgid.link/abC5U_JigA9TrGYu@google.com Signed-off-by: Dmitry Torokhov commit de0bfdc7137d5132b71dd1fe7aa3ca3df4d68241 Author: Nikunj A Dadhania Date: Tue Feb 10 05:35:11 2026 +0000 KVM: x86: Advertise AVX512 Bit Matrix Multiply (BMM) to userspace Advertise AVX512 Bit Matrix Multiply (BMM) and Bit Reversal instructions to userspace via CPUID leaf 0x80000021_EAX[23]. This feature enables bit matrix multiply operations and bit reversal. Like most AVX instructions, there are no intercept controls for individual instructions, and no extra work is needed in KVM to enable correct execution of the instructions in the guest. The instructions and CPUID feature are first described in: AMD64 Bit Matrix Multiply and Bit Reversal Instructions Publication #69192 Revision: 1.00 Issue Date: January 2026 While at it, reorder PREFETCHI in KVM's initialization sequence to match the CPUID bit position order for better organization. Signed-off-by: Nikunj A Dadhania Link: https://patch.msgid.link/20260210053511.1612505-1-nikunj@amd.com [sean: massage changelog] Signed-off-by: Sean Christopherson commit 55be358e17af4aa218f173cd6eb17a0dc423cd70 Author: Sean Christopherson Date: Mon Mar 2 13:26:19 2026 -0800 KVM: x86: Immediately fail the build when possible if required #define is missing Guard usage of the must-be-defined macros in KVM's multi-include headers with the existing #ifdefs that attempt to alert the developer to a missing macro, and spit out an explicit #error message if a macro is missing, as referencing the missing macro completely defeats the purpose of the #ifdef (the compiler spews a ton of error messages and buries the targeted error message). Suggested-by: Alexey Dobriyan Reviewed-by: Yuan Yao Link: https://patch.msgid.link/20260302212619.710873-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 0421ccdfad0d92713a812a5aeb7d07b0ea7213c8 Merge: 6d4b67a2a76a4f 1f318b96cc84d7 Author: Dmitry Torokhov Date: Thu Mar 12 10:44:42 2026 -0700 Merge tag 'v7.0-rc3' into next Sync up with the mainline to brig up the latest changes, specifically changes to ALPS driver. commit b3ae3ceb556945724d0c046ddb4ea0cf492a0ce6 Author: Lai Jiangshan Date: Fri Jan 23 17:03:03 2026 +0800 KVM: x86/mmu: KVM: x86/mmu: Skip unsync when large pages are allowed Use the large-page metadata to avoid pointless attempts to search SP. If the target GFN falls within a range where a large page is allowed, then there cannot be a shadow page for that GFN; a shadow page in the range would itself disallow using a large page. In that case, there is nothing to unsync and mmu_try_to_unsync_pages() can return immediately. This is always true for TDP MMU without nested TDP, and holds for a significant fraction of cases with shadow paging even all SPs are 4K. For shadow paging, this optimization theoretically avoids work for about 1/e ~= 37% of GFNs, assuming one guest page table per 2M of memory and that each GPT falls randomly into the 2M memory buckets. In a simple test setup, it skipped unsync in a much higher percentage of cases, mainly because the guest buddy allocator clusters GPTs into fewer buckets. Signed-off-by: Lai Jiangshan Link: https://patch.msgid.link/20260123090304.32286-2-jiangshanlai@gmail.com [sean: check for hugepage after write-tracking, update comment] Signed-off-by: Sean Christopherson commit 0d65a9d93d870ef3d13642f88d0e6d562790c96d Author: Svyatoslav Ryhel Date: Thu Mar 12 10:52:58 2026 +0200 rtc: max77686: convert to i2c_new_ancillary_device Convert RTC I2C device creation from devm_i2c_new_dummy_device() to i2c_new_ancillary_device() to enable the use of a device tree-specified RTC address instead of a hardcoded value. If the device tree does not provide an address, use hardcoded values as a fallback. This addresses an issue with the MAX77663 PMIC, which can have the RTC at different I2C positions (either 0x48, like the MAX77714, or 0x68, like the MAX77620). The MAX77620 value is used as the default. The I2C position of the MAX77663 is factory-set and cannot be detected from the chip itself. Signed-off-by: Svyatoslav Ryhel Link: https://patch.msgid.link/20260312085258.11431-6-clamor95@gmail.com Signed-off-by: Alexandre Belloni commit e80c626ae06ed9c502ebda4a7e0b390af9ccf6b0 Author: Felix Gu Date: Thu Mar 12 22:30:31 2026 +0800 regulator: pf1550: Remove redundant regmap assignment The config.regmap is already correctly initialized using dev_get_regmap() on the parent device. Remove the redundant second assignment that was overwriting it with pf1550->regmap. Signed-off-by: Felix Gu Reviewed-by: Frank Li Link: https://patch.msgid.link/20260312-1550-v1-1-5a84b886ccfe@gmail.com Signed-off-by: Mark Brown commit 00d572d4cd7d23f9a7a498d2d824b68ba3ea5b88 Author: Anel Orazgaliyeva Date: Fri Mar 6 08:59:52 2026 +0100 KVM: X86: Fix array_index_nospec protection in __pv_send_ipi The __pv_send_ipi() function iterates over up to BITS_PER_LONG vCPUs starting from the APIC ID specified in its 'min' argument, which is provided by the guest. Commit c87bd4dd43a6 used array_index_nospec() to clamp the value of 'min' but then the for_each_set_bit() loop dereferences higher indices without further protection. Theoretically, a guest can trigger speculative access to up to BITS_PER_LONG elements off the end of the phys_map[] array. (In practice it would probably need aggressive loop unrolling by the compiler to go more than one element off the end, and even that seems unlikely, but the theoretical possibility exists.) Move the array_index_nospec() inside the loop to protect the [map + i] index which is actually being used each time. Fixes: c87bd4dd43a6 ("KVM: x86: use array_index_nospec with indices that come from guest") Fixes: bdf7ffc89922 ("KVM: LAPIC: Fix pv ipis out-of-bounds access") Fixes: 4180bf1b655a ("KVM: X86: Implement "send IPI" hypercall") Signed-off-by: Anel Orazgaliyeva Signed-off-by: David Woodhouse Reviewed-by: Jim Mattson Link: https://patch.msgid.link/9d50fc3ca9e8e58f551d015f95d51a3c29ce6ccc.camel@infradead.org Signed-off-by: Sean Christopherson commit 26c9bfc0fac240540581cfbe58031b412f98aaf8 Author: xuanqingshi <1356292400@qq.com> Date: Fri Mar 6 17:12:32 2026 +0800 KVM: x86: Add LAPIC guard in kvm_apic_write_nodecode() kvm_apic_write_nodecode() dereferences vcpu->arch.apic without first checking whether the in-kernel LAPIC has been initialized. If it has not (e.g. the vCPU was created without an in-kernel LAPIC), the dereference results in a NULL pointer access. While APIC-write VM-Exits are not expected to occur on a vCPU without an in-kernel LAPIC, kvm_apic_write_nodecode() should be robust against such a scenario as a defense-in-depth measure, e.g. to guard against KVM bugs or CPU errata that could generate a spurious APIC-write VM-Exit. Use KVM_BUG_ON() with lapic_in_kernel() instead of a simple WARN_ON_ONCE(), as suggested by Sean Christopherson, so that KVM kills the VM outright rather than letting it continue in a broken state. Found by a VMCS-targeted fuzzer based on syzkaller. Signed-off-by: xuanqingshi <1356292400@qq.com> Link: https://patch.msgid.link/tencent_7A9F1B4D75468C0CF5DE1B6902038C948B07@qq.com Signed-off-by: Sean Christopherson commit 577da677aa7cbc13040e4951170d39ec7663ad8a Author: Xin Li Date: Fri Mar 6 15:12:53 2026 -0800 KVM: VMX: Remove unnecessary parentheses Drop redundant parentheses; the & operator has higher precedence than the return statement's implicit evaluation, making the grouping redundant. Signed-off-by: Xin Li Link: https://patch.msgid.link/20260306231253.2177246-1-xin@zytor.com Signed-off-by: Sean Christopherson commit d216449f253c7039c3e6a0276279c117a5198ce0 Author: Yosry Ahmed Date: Sat Mar 7 01:16:18 2026 +0000 KVM: x86: Use kvm_cpu_cap_has() for EFER bits enablement checks Instead of checking that the hardware supports underlying features for EFER bits, check if KVM supports them. It is practically the same, but this removes a subtle dependency on kvm_set_cpu_caps() enabling the relevant CPUID features. No functional change intended. Suggested-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260307011619.2324234-3-yosry@kernel.org Signed-off-by: Sean Christopherson commit 3b27c82ba2f3dcf8075e3df74dbf7294d2955d1a Author: Yosry Ahmed Date: Sat Mar 7 01:16:17 2026 +0000 KVM: x86: Move some EFER bits enablement to common code Move EFER bits enablement that only depend on CPU support to common code, as there is no reason to do it in vendor code. Leave EFER.SVME and EFER.LMSLE enablement in SVM code as they depend on vendor module parameters. Having the enablement in common code ensures that if a vendor starts supporting an existing feature, KVM doesn't end up advertising to userspace but not allowing the EFER bit to be set. No functional change intended. Suggested-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260307011619.2324234-2-yosry@kernel.org Signed-off-by: Sean Christopherson commit 9e5dd49de5d82401e92098c03e0a0e978ddd515a Author: Arnd Bergmann Date: Thu Mar 12 13:35:44 2026 +0100 KVM: arm64: tracing: add ftrace dependency Selecting CONFIG_TRACE_REMOTE causes a build time warning when FTRACE is disabled: WARNING: unmet direct dependencies detected for TRACE_REMOTE Depends on [n]: FTRACE [=n] Selected by [y]: - NVHE_EL2_TRACING [=y] && VIRTUALIZATION [=y] && KVM [=y] && NVHE_EL2_DEBUG [=y] && TRACING [=y] Add this as another dependency to ensure a clean build. Fixes: 3aed038aac8d ("KVM: arm64: Add trace remote for the nVHE/pKVM hyp") Signed-off-by: Arnd Bergmann Reviewed-by: Vincent Donnefort Link: https://patch.msgid.link/20260312123601.625063-3-arnd@kernel.org Signed-off-by: Marc Zyngier commit 7e4b6c94300e355a72670c5b896ccc26ac312c63 Author: Arnd Bergmann Date: Thu Mar 12 13:35:43 2026 +0100 tracing: add more symbols to whitelist Randconfig builds show a number of cryptic build errors from hitting undefined symbols in simple_ring_buffer.o: make[7]: *** [/home/arnd/arm-soc/kernel/trace/Makefile:147: kernel/trace/simple_ring_buffer.o.checked] Error 1 These happen with CONFIG_TRACE_BRANCH_PROFILING, CONFIG_KASAN_HW_TAGS, CONFIG_STACKPROTECTOR, CONFIG_DEBUG_IRQFLAGS and indirectly from WARN_ON(). Add exceptions for each one that I have hit so far on arm64, x86_64 and arm randconfig builds. Other architectures likely hit additional ones, so it would be nice to produce a little more verbose output that include the name of the missing symbols directly. Fixes: a717943d8ecc ("tracing: Check for undefined symbols in simple_ring_buffer") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260312123601.625063-2-arnd@kernel.org Signed-off-by: Marc Zyngier commit 01898f5ed659796bb3eba4bc3ac5177317942e24 Author: Bartosz Golaszewski Date: Mon Feb 23 14:37:22 2026 +0100 soc: imx9: don't access of_root directly Don't access of_root directly as it reduces the build test coverage for this driver with COMPILE_TEST=y and OF=n. Use existing helper functions to retrieve the relevant information. Suggested-by: Rob Herring Reviewed-by: Peng Fan Signed-off-by: Bartosz Golaszewski Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223-soc-of-root-v2-7-b45da45903c8@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 2524b293a59e586afd06358d0b191ab57208a920 Author: Bartosz Golaszewski Date: Mon Feb 23 14:37:21 2026 +0100 soc: imx8m: don't access of_root directly Don't access of_root directly as it reduces the build test coverage for this driver with COMPILE_TEST=y and OF=n. Use existing helper functions to retrieve the relevant information. Suggested-by: Rob Herring Signed-off-by: Bartosz Golaszewski Reviewed-by: Peng Fan Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223-soc-of-root-v2-6-b45da45903c8@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit db0622ef4e65601489522c7bfe87409f4e60835c Author: Bartosz Golaszewski Date: Mon Feb 23 14:37:20 2026 +0100 soc: fsl: guts: don't access of_root directly Don't access of_root directly as it reduces the build test coverage for this driver with COMPILE_TEST=y and OF=n. Use existing helper functions to retrieve the relevant information. Suggested-by: Rob Herring Reviewed-by: Christophe Leroy (CS GROUP) Acked-by: Christophe Leroy (CS GROUP) Signed-off-by: Bartosz Golaszewski Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223-soc-of-root-v2-5-b45da45903c8@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 030706e954c10749da8c75464c6b02cb30cb00aa Author: Bartosz Golaszewski Date: Mon Feb 23 14:37:19 2026 +0100 base: soc: rename and export soc_device_get_machine() Some SoC drivers reimplement the functionality of soc_device_get_machine(). Make this function accessible through the sys_soc.h header and rename it to a more descriptive name. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Bartosz Golaszewski Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223-soc-of-root-v2-4-b45da45903c8@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit e06c3b137907ad93daab6ca7e63aa9b68b2486ea Author: Bartosz Golaszewski Date: Mon Feb 23 14:37:18 2026 +0100 base: soc: order includes alphabetically For easier readability and maintenance, order the included headers alphabetically. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Bartosz Golaszewski Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223-soc-of-root-v2-3-b45da45903c8@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit c86d3b7b847cc9b32a17117cfd71679e4315fd9f Author: Bartosz Golaszewski Date: Mon Feb 23 14:37:17 2026 +0100 of: provide of_machine_read_model() Provide a helper function allowing users to read the model string of the machine, hiding the access to the root node. Signed-off-by: Bartosz Golaszewski Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223-soc-of-root-v2-2-b45da45903c8@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 59621105ffca7a33955f56bc7dee0923992f5832 Author: Bartosz Golaszewski Date: Mon Feb 23 14:37:16 2026 +0100 of: provide of_machine_read_compatible() Provide a helper function allowing users to read the compatible string of the machine, hiding the access to the root node. Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Bartosz Golaszewski Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223-soc-of-root-v2-1-b45da45903c8@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 5f2f83047126f1cb2986d142d2e76e1fa3cef3f0 Author: Vincent Donnefort Date: Thu Mar 12 11:35:35 2026 +0000 tracing: Update undefined symbols allow list for simple_ring_buffer Undefined symbols are not allowed for simple_ring_buffer.c. But some compiler emitted symbols are missing in the allowlist. Update it. Reported-by: Nathan Chancellor Signed-off-by: Vincent Donnefort Fixes: a717943d8ecc ("tracing: Check for undefined symbols in simple_ring_buffer") Closes: https://lore.kernel.org/all/20260311221816.GA316631@ax162/ Acked-by: Steven Rostedt (Google) Link: https://patch.msgid.link/20260312113535.2213350-1-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 021915c7885fb1c83810930d527fa513877138d6 Author: Debbie Horsfall Date: Wed Mar 11 17:39:48 2026 +0000 arm64: dts: zena: Move SRAM into SoC and memory node out of SoC Move the SRAM node into the SoC node. Move the memory node out of the include to make it customizable for each platform variant. Signed-off-by: Debbie Horsfall Message-Id: <20260311173948.3478931-1-debbie.horsfall@arm.com> Reviewed-by: Andre Przywara Signed-off-by: Sudeep Holla commit 15cfc8984defc17e5e4de1f58db7b993240fcbda Author: Geert Uytterhoeven Date: Fri Mar 6 11:26:20 2026 +0100 dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range According to the "Arm Generic Interrupt Controller (GIC) Architecture Specification, v3 and v4", revision H.b[1], there can be only 64 Extended PPI interrupts. [1] https://developer.arm.com/documentation/ihi0069/hb/ Fixes: 4b049063e0bcbfd3 ("dt-bindings: interrupt-controller: arm,gic-v3: Describe EPPI range support") Signed-off-by: Geert Uytterhoeven Brain-farted-by: Marc Zyngier Acked-by: Marc Zyngier Link: https://patch.msgid.link/3e49a63c6b2b6ee48e3737adee87781f9c136c5f.1772792753.git.geert+renesas@glider.be Signed-off-by: Rob Herring (Arm) commit 2de27980e1d46e5dac586b1785edee7849a6e705 Author: T.J. Mercier Date: Wed Feb 25 14:34:04 2026 -0800 selftests: memcg: Add tests for IN_DELETE_SELF and IN_IGNORED Add two new tests that verify inotify events are sent when memcg files or directories are removed with rmdir. Signed-off-by: T.J. Mercier Acked-by: Tejun Heo Acked-by: Amir Goldstein Tested-by: syzbot@syzkaller.appspotmail.com Link: https://patch.msgid.link/20260225223404.783173-4-tjmercier@google.com Signed-off-by: Greg Kroah-Hartman commit eea5d2bb34ba11dccd9c53f392dc50cf060150a9 Author: T.J. Mercier Date: Wed Feb 25 14:34:03 2026 -0800 kernfs: Send IN_DELETE_SELF and IN_IGNORED Currently some kernfs files (e.g. cgroup.events, memory.events) support inotify watches for IN_MODIFY, but unlike with regular filesystems, they do not receive IN_DELETE_SELF or IN_IGNORED events when they are removed. This means inotify watches persist after file deletion until the process exits and the inotify file descriptor is cleaned up, or until inotify_rm_watch is called manually. This creates a problem for processes monitoring cgroups. For example, a service monitoring memory.events for memory.high breaches needs to know when a cgroup is removed to clean up its state. Where it's known that a cgroup is removed when all processes die, without IN_DELETE_SELF the service must resort to inefficient workarounds such as: 1) Periodically scanning procfs to detect process death (wastes CPU and is susceptible to PID reuse). 2) Holding a pidfd for every monitored cgroup (can exhaust file descriptors). This patch enables IN_DELETE_SELF and IN_IGNORED events for kernfs files and directories by clearing inode i_nlink values during removal. This allows VFS to make the necessary fsnotify calls so that userspace receives the inotify events. As a result, applications can rely on a single existing watch on a file of interest (e.g. memory.events) to receive notifications for both modifications and the eventual removal of the file, as well as automatic watch descriptor cleanup, simplifying userspace logic and improving efficiency. There is gap in this implementation for certain file removals due their unique nature in kernfs. Directory removals that trigger file removals occur through vfs_rmdir, which shrinks the dcache and emits fsnotify events after the rmdir operation; there is no issue here. However kernfs writes to particular files (e.g. cgroup.subtree_control) can also cause file removal, but vfs_write does not attempt to emit fsnotify events after the write operation, even if i_nlink counts are 0. As a usecase for monitoring this category of file removals is not known, they are left without having IN_DELETE or IN_DELETE_SELF events generated. Fanotify recursive monitoring also does not work for kernfs nodes that do not have inodes attached, as they are created on-demand in kernfs. Suggested-by: Jan Kara Signed-off-by: T.J. Mercier Tested-by: syzbot@syzkaller.appspotmail.com Acked-by: Tejun Heo Link: https://patch.msgid.link/20260225223404.783173-3-tjmercier@google.com Signed-off-by: Greg Kroah-Hartman commit 507d8ce13f5b91d5b4dca7bd4b4e4249e8021cca Author: T.J. Mercier Date: Wed Feb 25 14:34:02 2026 -0800 kernfs: Don't set_nlink for directories being removed If a directory is already in the process of removal its i_nlink count becomes irrelevant because its contents are also about to be removed and any pending filesystem operations on it or its contents will soon start to fail. So we can avoid setting it for directories already flagged for removal. This avoids a race in the next patch, which adds clearing of the i_nlink count for kernfs nodes being removed to support inotify delete events. Use protection from the kernfs_iattr_rwsem to avoid adding more contention to the kernfs_rwsem for calls to kernfs_refresh_inode. Signed-off-by: T.J. Mercier Tested-by: syzbot@syzkaller.appspotmail.com Link: https://patch.msgid.link/20260225223404.783173-2-tjmercier@google.com Signed-off-by: Greg Kroah-Hartman commit f917dc56060a10f401dd8ca46a1c5df237b35d84 Author: Dan Williams Date: Mon Mar 2 16:01:50 2026 -0800 device core: Fix kernel-doc warnings in base.h In preparation for adding new fields to 'struct device_private' fix up existing kernel-doc warnings in this header file of the form: Warning: drivers/base/base.h:59 struct member 'subsys' not described in 'subsys_private' Warning: drivers/base/base.h:59 struct member 'devices_kset' not described in 'subsys_private' Warning: drivers/base/base.h:59 struct member 'interfaces' not described in 'subsys_private' Warning: drivers/base/base.h:59 struct member 'mutex' not described in 'subsys_private' ...which are simple replacements of " - " with ": ". Add new descriptions for these previously undescribed fields: Warning: drivers/base/base.h:58 struct member 'drivers_autoprobe' not described in 'subsys_private' Warning: drivers/base/base.h:117 struct member 'deferred_probe_reason' not described in 'device_private' Signed-off-by: Dan Williams Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260303000207.1836586-3-dan.j.williams@intel.com Signed-off-by: Greg Kroah-Hartman commit cbf39bfd4bf938494dcc5f699e6bfa04e1916873 Author: Conor Dooley Date: Tue Mar 3 16:36:33 2026 +0000 dt-bindings: rtc: mpfs-rtc: permit resets The RTC on mpfs and pic64gx has a reset pin, but until now this has been undocumented because platform firmware takes the RTC out of reset on first-party boards (or those using modified versions of the vendor firmware), but not all boards may take this approach. Permit providing a reset in devicetree for Linux, or other devicetree-consuming software, to use. Signed-off-by: Conor Dooley Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260303-flounder-slate-dd69766990ce@spud Signed-off-by: Alexandre Belloni commit eb3b0d92c9c39890592cca6647601fe5c631efea Author: Xin Zhao Date: Fri Feb 13 16:50:39 2026 +0800 tty: tty_port: add workqueue to flip TTY buffer On the embedded platform, certain critical data, such as IMU data, is transmitted through UART. The tty_flip_buffer_push() interface in the TTY layer uses system_dfl_wq to handle the flipping of the TTY buffer. Although the unbound workqueue can create new threads on demand and wake up the kworker thread on an idle CPU, it may be preempted by real-time tasks or other high-prio tasks. flush_to_ldisc() needs to wake up the relevant data handle thread. When executing __wake_up_common_lock(), it calls spin_lock_irqsave(), which does not disable preemption but disables migration in RT-Linux. This prevents the kworker thread from being migrated to other cores by CPU's balancing logic, resulting in long delays. The call trace is as follows: __wake_up_common_lock __wake_up ep_poll_callback __wake_up_common __wake_up_common_lock __wake_up n_tty_receive_buf_common n_tty_receive_buf2 tty_ldisc_receive_buf tty_port_default_receive_buf flush_to_ldisc In our system, the processing interval for each frame of IMU data transmitted via UART can experience significant jitter due to this issue. Instead of the expected 10 to 15 ms frame processing interval, we see spikes up to 30 to 35 ms. Moreover, in just one or two hours, there can be 2 to 3 occurrences of such high jitter, which is quite frequent. This jitter exceeds the software's tolerable limit of 20 ms. Introduce flip_wq in tty_port which can be set by tty_port_link_wq() or as default linked to default workqueue allocated when tty_register_driver(). The default workqueue is allocated with flag WQ_SYSFS, so that cpumask and nice can be set dynamically. The execution timing of tty_port_link_wq() is not clearly restricted. The newly added function tty_port_link_driver_wq() checks whether the flip_wq of the tty_port has already been assigned when linking the default tty_driver's workqueue to the port. After the user has set a custom workqueue for a certain tty_port using tty_port_link_wq(), the system will only use this custom workqueue, even if tty_driver does not have %TTY_DRIVER_NO_WORKQUEUE flag. When tty_port register device, flip_wq link operation is done by tty_port_link_driver_wq(), but for in-memory devices the link operation cannot cover all the cases. Although tty_port_install() is dedicated for in-memory devices lik PTY to link port allocated on demand, the logic of tty_port_install() is so simple that people may not call it, vc_cons[0].d->port is one such case. We check the buf.flip_wq when flip TTY buffer, if buf.flip_wq of TTY port is NULL, use system_dfl_wq as a backup. To avoid naming conflict of the default tty_driver's workqueue, using '"%s-%s", driver->name, driver->driver_name' as the workqueue name. In cases where driver_name is not specified and therefore is NULL, the workqueue is not created. Drivers that do not define driver_name are potentially in-memory devices like vty, which generally do not require special workqueue settings. Even with the combination of name and driver_name, the workqueue names can still be duplicated, as many tty serial drivers use "ttyS" as dev_name and "serial" as driver_name. I modified the conflicting driver_name of these drivers by appending a suffix of _xx based on the corresponding .c file. If this modification is not made, it could not only lead to duplicate workqueue names but also result in duplicate entries for the /proc/tty/driver/ nodes. Introduce %TTY_DRIVER_NO_WORKQUEUE flag meaning not to create the default single tty_driver workqueue. Two reasons why need to introduce the %TTY_DRIVER_NO_WORKQUEUE flag: 1. If the WQ_SYSFS parameter is enabled, workqueue_sysfs_register() will fail when trying to create a workqueue with the same name. The pty is an example of this; if both CONFIG_LEGACY_PTYS and CONFIG_UNIX98_PTYS are enabled, the call to tty_register_driver() in unix98_pty_init() will fail. 2. Different TTY ports may be used for different tasks, which may require separate core binding control via workqueues. In this case, the workqueue created by default in the TTY driver is unnecessary. Enabling this flag prevents the creation of this redundant workqueue. After applying this patch, we can set the related UART TTY flip buffer workqueue by sysfs. We set the cpumask to CPU cores associated with the IMU tasks, and set the nice to -20. Testing has shown significant improvement in the previously described issue, with almost no stuttering occurring anymore. Tested-by: Tommaso Merciai Tested-by: Marek Szyprowski Signed-off-by: Xin Zhao Link: https://patch.msgid.link/20260213085039.3274704-1-jackzxcui1989@163.com Signed-off-by: Greg Kroah-Hartman commit fa4268cfe899b684d628e9419705a236c2ae589a Author: Ronan Pigott Date: Mon Mar 2 18:02:22 2026 -0700 vt: support ITU-T T.416 color subparameters The colon ("bit combination 03/10") is a valid character in parameter substrings. ECMA-48 says: Each parameter sub-string consists of one or more bit combinations from 03/00 to 03/10; the bit combinations from 03/00 to 03/09 represent the digits ZERO to NINE; bit combination 03/10 may be used as a separator in a parameter sub-string, for example, to separate the fractional part of a decimal number from the integer part of that number. To my knowledge, the only codes where 03/10 is actually used as a separator are the CSI-m SGR sequences. The colon separated format is superior as an embedded string for software that doesn't wish to link ncurses terminal database, because terminals that do not support the requested SGR sequence can safely skip the sub-parameters rather than misinterpret them as another sequence. Hence, some software have started using this "modern" format [1]. We should support the colon separated format as well. [1] https://github.com/systemd/systemd/commit/6eabe9f2ff48c1b6924724d5afe64e7b661ccdbf Signed-off-by: Ronan Pigott Link: https://patch.msgid.link/20260303010701.631022-1-ronan@rjp.ie Signed-off-by: Greg Kroah-Hartman commit 0b1837c04d2335ec50b9a55b0282dcde7bc12439 Author: Anup Kulkarni Date: Tue Mar 10 16:11:55 2026 +0530 serial: qcom-geni: Fix RTS behavior with flow control When userspace enables flow control (CRTSCTS), the driver deasserts RTS even when the receive buffer has space. This prevents the peer device from transmitting, causing communication to stall. The root cause is that the driver unconditionally uses manual RTS control regardless of flow control mode. When CRTSCTS is set, the hardware should automatically manage RTS based on buffer status, but the driver overrides this by setting manual control. Fix this by introducing port->manual_flow flag. In set_termios(), disable manual flow when CRTSCTS is set. In set_mctrl(), only assert SE_UART_MANUAL_RFR when manual_flow is active. Verified by enabling and disabling hardware flow control with stty. Signed-off-by: Anup Kulkarni Link: https://patch.msgid.link/20260310104155.339010-1-anup.kulkarni@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 74e0c9f0528bcd597cb1299a027d7be27d1c27d9 Author: Robin Gong Date: Thu Mar 12 17:45:26 2026 +0800 tty: serial: imx: keep dma request disabled before dma transfer setup Since sdma hardware configure postpone to transfer phase, have to disable dma request before dma transfer setup because there is a hardware limitation on sdma event enable(ENBLn) as below. Refer SDMA 2.6.28 Channel Enable RAM (SDMAARMx_CHNENBLn) section: "It is thus essential for the Arm platform to program them before any DMA request is triggered to the SDMA, otherwise an unpredictable combination of channels may be started." Signed-off-by: Robin Gong Signed-off-by: Sherry Sun Link: https://patch.msgid.link/20260312094526.297348-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit 072ce4812b2f8c178d035c5837e17420ec4a3167 Author: Michael Walle Date: Wed Feb 25 09:17:23 2026 +0100 tty: serial: 8250: Add SystemBase Multi I/O cards Add support for the SystemBase Multi I/O serial cards, which are "compatible" with a standard 16550A controllers, except that they need to have their interrupts enabled in a proprietary way. Tested with a Delock "Serial PCI Express x1 Card 8x Serial RS-232". Signed-off-by: Michael Walle Link: https://patch.msgid.link/20260225081739.946723-1-mwalle@kernel.org Signed-off-by: Greg Kroah-Hartman commit 37b4cab642f285176ed392e2f5a467a531424f90 Author: Brian Masney Date: Sun Feb 22 18:29:08 2026 -0500 serial: pic32_uart: allow driver to be compiled on all architectures with COMPILE_TEST This driver currently only supports builds against a PIC32 target, or with COMPILE_TEST on MIPS. Now that commit 24cad1a22848 ("serial: pic32_uart: update include to use pic32.h from platform_data") is merged, it's possible to compile this driver on other architectures. To avoid future breakage of this driver in the future, let's update the Kconfig so that it can be built with COMPILE_TEST enabled on all architectures. Signed-off-by: Brian Masney Link: https://patch.msgid.link/20260222-serial-pic32-v1-1-8fdbc0d0d334@redhat.com Signed-off-by: Greg Kroah-Hartman commit dcb822503bfc77fe93e8ca15c82077ee590dd7b9 Author: Francesco Lavra Date: Tue Mar 3 12:14:38 2026 +0100 serial: tegra: remove Kconfig dependency on APB DMA controller This driver runs also on SoCs without a Tegra20 APB DMA controller (e.g. Tegra234). Remove the Kconfig dependency on TEGRA20_APB_DMA, and remove reference to the APB DMA controller from the Kconfig help text. Signed-off-by: Francesco Lavra Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260303111438.2691799-1-flavra@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 579ab531225e25f50848109a0e7238dc86803088 Author: Xianwei Zhao Date: Tue Mar 3 10:05:24 2026 +0000 dt-bindings: serial: amlogic,meson-uart: Add compatible string for A9 Amlogic A9 SoCs uses the same UART controller as S4 SoCs. There is no need for an extra compatible line in the driver, but add A9 compatible line for documentation. Reviewed-by: Martin Blumenstingl Acked-by: Krzysztof Kozlowski Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20260303-serial-binding-v1-1-c3df2a8f6fa3@amlogic.com Signed-off-by: Greg Kroah-Hartman commit 0e5cb010e37d24a03d3e3a3565900cba4df8a7f0 Author: Robert Marko Date: Mon Mar 2 12:20:09 2026 +0100 dt-bindings: serial: atmel,at91-usart: add microchip,lan9691-usart Document Microchip LAN969x USART compatible. Signed-off-by: Robert Marko Acked-by: Conor Dooley Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260302112153.464422-2-robert.marko@sartura.hr Signed-off-by: Greg Kroah-Hartman commit 2c8c3487b25b2e599528299224a54941e0b835ed Author: Zhaoyang Yu <2426767509@qq.com> Date: Sun Mar 1 16:22:56 2026 +0000 serial: auart: check clk_enable() return in console write Add a check for clk_enable() in auart_console_write(). If clk_enable() fails, return immediately to avoid accessing hardware registers while the clock is not enabled. Signed-off-by: Zhaoyang Yu <2426767509@qq.com> Reviewed-by: Frank Li Link: https://patch.msgid.link/tencent_AB29FADF1FAD67D818283B6BB4FDF66F2F08@qq.com Signed-off-by: Greg Kroah-Hartman commit 42d3b66d4cdbacfc9d120d2301b8de89cc29a914 Merge: 635e3eba1ebcd5 58351f46de26bc Author: Matthew Brost Date: Thu Mar 12 07:17:56 2026 -0700 Merge drm/drm-next into drm-xe-next Backmerging to bring in 7.00-rc3. Important ahead GPU SVM merging THP support. Signed-off-by: Matthew Brost commit fbae853a00b472d905175a6844b74d0eb3526d4b Author: Andrew Davis Date: Thu Mar 5 13:35:45 2026 -0600 rtc: rx8025: Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has a couple other benefits: * It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove those or move the i2c_device_id table down to its more natural spot with the other module info. * It also checks for device match data, which allows for OF and ACPI based probing. That means we do not have to manually check those first and can remove those checks. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260305193545.796294-7-afd@ti.com Signed-off-by: Alexandre Belloni commit c79e6131b17eb574ce2d065995a81c933616f880 Author: Andrew Davis Date: Thu Mar 5 13:35:44 2026 -0600 rtc: rv8803: Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has a couple other benefits: * It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove those or move the i2c_device_id table down to its more natural spot with the other module info. * It also checks for device match data, which allows for OF and ACPI based probing. That means we do not have to manually check those first and can remove those checks. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260305193545.796294-6-afd@ti.com Signed-off-by: Alexandre Belloni commit 022bfe69575d2d3ba39172b05c1162fd41c7f2b5 Author: Andrew Davis Date: Thu Mar 5 13:35:43 2026 -0600 rtc: rs5c372: Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has a couple other benefits: * It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove those or move the i2c_device_id table down to its more natural spot with the other module info. * It also checks for device match data, which allows for OF and ACPI based probing. That means we do not have to manually check those first and can remove those checks. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260305193545.796294-5-afd@ti.com Signed-off-by: Alexandre Belloni commit c85ac0b4d7c52b30aca9c4a7914279dd072d105f Author: Andrew Davis Date: Thu Mar 5 13:35:42 2026 -0600 rtc: pcf2127: Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has a couple other benefits: * It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove those or move the i2c_device_id table down to its more natural spot with the other module info. * It also checks for device match data, which allows for OF and ACPI based probing. That means we do not have to manually check those first and can remove those checks. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260305193545.796294-4-afd@ti.com Signed-off-by: Alexandre Belloni commit aade5f4bf9e236fe3fee127e0acbbabc93609ad6 Author: Andrew Davis Date: Thu Mar 5 13:35:41 2026 -0600 rtc: m41t80: Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has a couple other benefits: * It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove those or move the i2c_device_id table down to its more natural spot with the other module info. * It also checks for device match data, which allows for OF and ACPI based probing. That means we do not have to manually check those first and can remove those checks. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260305193545.796294-3-afd@ti.com Signed-off-by: Alexandre Belloni commit 652dc1328110d8635447e21f7f6a10fd0593ef35 Author: Andrew Davis Date: Thu Mar 5 13:35:40 2026 -0600 rtc: abx80x: Remove use of i2c_match_id() The function i2c_match_id() is used to fetch the matching ID from the i2c_device_id table. This is often used to then retrieve the matching driver_data. This can be done in one step with the helper i2c_get_match_data(). This helper has a couple other benefits: * It doesn't need the i2c_device_id passed in so we do not need to have that forward declared, allowing us to remove those or move the i2c_device_id table down to its more natural spot with the other module info. * It also checks for device match data, which allows for OF and ACPI based probing. That means we do not have to manually check those first and can remove those checks. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260305193545.796294-2-afd@ti.com Signed-off-by: Alexandre Belloni commit 635e3eba1ebcd5b92856e975e1d3859b487dc88b Author: Mika Kuoppala Date: Wed Mar 4 23:17:28 2026 +0200 drm/xe: Fix overflow in guc_ct_snapshot_capture snapshot->ctb is u32*, so pointer arithmetic on it scales the byte offset from xe_bo_size() by 4, overshooting the intended start of the g2h portion and writing past the allocated buffer. Fix this by using void * to get the arithmetic right and prevent future mishaps. v2: s/u8/void for memcpy and iosys_map consistency (Matt) Fixes: af3de6cf06f9 ("drm/xe: Split H2G and G2H into separate buffer objects") Cc: Matthew Brost Cc: Thomas Hellström Cc: Rodrigo Vivi Cc: intel-xe@lists.freedesktop.org Signed-off-by: Mika Kuoppala Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260304211728.249104-1-mika.kuoppala@linux.intel.com commit c1d2deb6492fbd900392f4ebd47572ca4903d0fe Author: Nicolas Pitre Date: Mon Feb 2 23:52:48 2026 -0500 vt: add fallback to plain map for modifier-aware key types When a key is pressed with modifiers (Shift, Ctrl, Alt, etc.) and the modifier-specific keymap has no binding (K_HOLE) or doesn't exist, fall back to the plain keymap if the plain entry is a modifier-aware type (KT_CUR or KT_CSI). This allows arrow keys and CSI navigation keys to automatically handle all modifier combinations with just a single plain map entry. The key handlers (k_cur and k_csi) read the modifier state at runtime and encode it into the output sequence. For example, with just: keycode 103 = Up keycode 104 = Csi_Home All these combinations now work automatically: Up -> ESC [ A Shift+Up -> ESC [ 1 ; 2 A Ctrl+Up -> ESC [ 1 ; 5 A Home -> ESC [ 1 ~ Shift+Home -> ESC [ 1 ; 2 ~ Ctrl+Home -> ESC [ 1 ; 5 ~ Previously, each modifier combination required an explicit keymap entry, which was tedious and consumed keymap slots. Explicit modifier bindings still take precedence - the fallback only triggers when the modifier-specific entry is empty. Signed-off-by: Nicolas Pitre Link: https://patch.msgid.link/20260203045457.1049793-4-nico@fluxnic.net Signed-off-by: Greg Kroah-Hartman commit 5cba06c71c713a5beb4aafab7973287d8a248ddb Author: Nicolas Pitre Date: Mon Feb 2 23:52:47 2026 -0500 vt: add KT_CSI keysym type for modifier-aware CSI sequences Add a new keysym type KT_CSI that generates CSI tilde sequences with automatic modifier encoding. The keysym value encodes the CSI parameter number, producing sequences like ESC [ ~ or ESC [ ; ~ when Shift, Alt, or Ctrl modifiers are held. This allows navigation keys (Home, End, Insert, Delete, PgUp, PgDn) and function keys to generate modifier-aware escape sequences without consuming string table entries for each modifier combination. Define key symbols for navigation keys (K_CSI_HOME, K_CSI_END, etc.) and function keys (K_CSI_F1 through K_CSI_F20) using standard xterm CSI parameter values. The modifier encoding follows the xterm convention: mod = 1 + (shift ? 1 : 0) + (alt ? 2 : 0) + (ctrl ? 4 : 0) Allowed CSI parameter values range from 0 to 99. Note: The Linux console historically uses a non-standard double-bracket format for F1-F5 (ESC [ [ A through ESC [ [ E) rather than the xterm tilde format (ESC [ 11 ~ through ESC [ 15 ~). The K_CSI_F1 through K_CSI_F5 definitions use the xterm format. Converting F1-F5 to KT_CSI would require updating the "linux" terminfo entry to match. Navigation keys and F6-F20 already use the tilde format and are fully compatible. Signed-off-by: Nicolas Pitre Link: https://patch.msgid.link/20260203045457.1049793-3-nico@fluxnic.net Signed-off-by: Greg Kroah-Hartman commit 4af70f151671da6acd7a1d7bae1469c576673d2d Author: Nicolas Pitre Date: Mon Feb 2 23:52:46 2026 -0500 vt: add modifier support to cursor keys Generate xterm-style CSI sequences with modifier parameters for arrow keys when Shift, Alt, or Ctrl are held. For example, Shift+Up produces ESC [ 1 ; 2 A instead of plain ESC [ A. The modifier encoding follows the standard xterm convention: mod = 1 + (shift ? 1 : 0) + (alt ? 2 : 0) + (ctrl ? 4 : 0) When no modifiers are pressed, the original behavior is preserved. Explicit keymap bindings for modified cursor keys (e.g., "shift keycode 103 = Find") take precedence over this automatic modifier encoding. Signed-off-by: Nicolas Pitre Link: https://patch.msgid.link/20260203045457.1049793-2-nico@fluxnic.net Signed-off-by: Greg Kroah-Hartman commit 24728b93fafe0949b5353e1a7b3a94175fe26d6e Author: Randy Dunlap Date: Tue Mar 10 22:23:47 2026 -0700 serdev: serdev.h: clean up kernel-doc comments Correct kernel-doc comment format and add a missing to avoid kernel-doc warnings: Warning: include/linux/serdev.h:49 struct member 'write_comp' not described in 'serdev_device' Warning: include/linux/serdev.h:49 struct member 'write_lock' not described in 'serdev_device' Warning: include/linux/serdev.h:68 struct member 'shutdown' not described in 'serdev_device_driver' Warning: include/linux/serdev.h:134 function parameter 'serdev' not described in 'serdev_device_put' Warning: include/linux/serdev.h:162 function parameter 'ctrl' not described in 'serdev_controller_put' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260311052347.305612-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit 2dccde6f5f2ff2726236fd69a1be813629c5512f Author: Julian Braha Date: Mon Mar 9 12:23:21 2026 +0000 serial: remove drivers for espressif esp32 These drivers were added about 3 years ago, and depend on the XTENSA_PLATFORM_ESP32 config option which has never existed, so no device can actually use them. They can only be compiled with COMPILE_TEST. In a previous conversation [1], Greg suggested removing the drivers, and Max, the original submitter of the drivers, agreed due to a lack of foreseeable development. Link: https://lore.kernel.org/all/20260308131412.1102749-1-julianbraha@gmail.com/ [1] Signed-off-by: Julian Braha Link: https://patch.msgid.link/20260309122321.1528622-1-julianbraha@gmail.com Signed-off-by: Greg Kroah-Hartman commit d925538446d3f80e03a91a9ef7da34104a75df4d Author: Kartik Rajput Date: Wed Feb 25 12:29:14 2026 +0530 serial: amba-pl011: Respect DMA controller's copy_align requirement Some DMA controllers require transfer lengths to be aligned to a specific boundary. For example, the Tegra GPC DMA requires 4-byte (word) aligned transfers and will reject unaligned lengths. Align the TX DMA buffer length down to the DMA controller's copy_align boundary before submitting the transfer. Any remaining unaligned bytes will be transmitted via PIO on subsequent calls, which is the existing fallback behavior when DMA is not used. Signed-off-by: Kartik Rajput Link: https://patch.msgid.link/20260225065915.341522-5-kkartik@nvidia.com Signed-off-by: Greg Kroah-Hartman commit a2abd18e316ee2442631f0a60896b49dd8e9a80c Author: Kartik Rajput Date: Wed Feb 25 12:29:13 2026 +0530 serial: amba-pl011: Add Tegra264 UART support Add support for the NVIDIA Tegra264 UART controller, which is derived from the AMBA PL011 design. On Tegra264, the fractional baud rate divisor (FBRD) register is broken. Using IBRD alone may not achieve the required baud rate tolerance. Enable the skip_ibrd_fbrd and set_uartclk_rate flags for the NVIDIA variant. Signed-off-by: Kartik Rajput Link: https://patch.msgid.link/20260225065915.341522-4-kkartik@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 87df45b4a83f13952958e9916af1b2dd56d4cfc7 Author: Kartik Rajput Date: Wed Feb 25 12:29:12 2026 +0530 serial: amba-pl011: Introduce set_uartclk_rate vendor flag The NVIDIA Tegra264 UART relies on configuring the UART clock rate directly to program the desired baud rate. Introduce the set_uartclk_rate vendor flag. When set, the driver uses clk_set_rate() to program the UART clock to the desired baud rate and clk_round_rate() to determine the maximum supported baud rate. Signed-off-by: Kartik Rajput Link: https://patch.msgid.link/20260225065915.341522-3-kkartik@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 42157639ddc797053e0f16e6fe0f6b64034fe559 Author: Kartik Rajput Date: Wed Feb 25 12:29:11 2026 +0530 serial: amba-pl011: Introduce skip_ibrd_fbrd vendor flag The NVIDIA Tegra264 UART has a broken fractional baud rate divisor register. Using IBRD and FBRD may cause the baud rate to fall outside the required tolerance. Introduce the skip_ibrd_fbrd vendor flag to skip IBRD/FBRD programming. When set, the baud rate is derived directly from the UART clock rate using a fixed divisor. Signed-off-by: Kartik Rajput Link: https://patch.msgid.link/20260225065915.341522-2-kkartik@nvidia.com Signed-off-by: Greg Kroah-Hartman commit cc8de922bb8e3f4349e355de72bf2b3ef840c430 Author: Peter Maydell Date: Tue Feb 10 12:50:59 2026 +0000 serial: amba-pl011: Enable UART in earlycon setup Currently the PL011 driver only enables the UART (by setting UARTEN in REG_CR) in pl011_startup(), so if it is used for earlycon it is relying on the bootrom/firmware having left the UART enabled. There's no particular reason not to actively enable the UART before using it for earlycon, and the earlycon handling for e.g. the 8250 UART sets up the UART in its setup function, so follow that in the PL011. This allows use of earlycon with a UART that the firmware hasn't already been using for its own output, but the main motivation is that QEMU will otherwise log a message complaining that the guest is trying to write to a UART it never enabled. Signed-off-by: Peter Maydell Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260210125100.223138-1-peter.maydell@linaro.org Signed-off-by: Greg Kroah-Hartman commit cd5e64c0bca25be6d1b779858a2d10aebc4976a3 Author: Fabio Estevam Date: Mon Mar 9 21:06:06 2026 -0300 dt-bindings: serial: snps-dw-apb-uart: Add RV1103B compatible The RV1103B UART is compatible with the existing DesignWare APB UART binding. Add the rockchip,rv1103b-uart compatible string. Signed-off-by: Fabio Estevam Acked-by: Krzysztof Kozlowski Reviewed-by: Heiko Stuebner Link: https://patch.msgid.link/20260310000606.415206-1-festevam@gmail.com Signed-off-by: Greg Kroah-Hartman commit c670267ff50d5f9beb486f0203cdede580a99ae3 Author: Qingfang Deng Date: Fri Feb 6 14:20:03 2026 +0800 tty: constify tty_ldisc_ops tty_ldisc_ops is not modified once registered, so make it const. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260206062004.1273890-1-dqfext@gmail.com Signed-off-by: Greg Kroah-Hartman commit f2a880e802ad12d1e38039d1334fb1475d0f5241 Author: Randy Dunlap Date: Thu Jan 29 23:29:37 2026 -0800 tty: hvc_iucv: fix off-by-one in number of supported devices MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8. This is the number of entries in: static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES]; Sometimes hvc_iucv_table[] is limited by: (a) if (num > hvc_iucv_devices) // for error detection or (b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places (so these 2 don't agree; second one appears to be correct to me.) hvc_iucv_devices can be 0..8. This is a counter. (c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES) If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8]. Oops. Fixes: 44a01d5ba8a4 ("[S390] s390/hvc_console: z/VM IUCV hypervisor console support") Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260130072939.1535869-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit 7885af04df6e4efd72910200c1bfc079d61202e4 Author: Andy Shevchenko Date: Wed Jan 28 15:27:26 2026 +0100 serial: 8250_port: Drop duplicate NULL check serial8250_release_dma() is NULL-aware, no need to check this in the caller. While at it, make sure DMA won't be used again, by NULLifying the pointer. Signed-off-by: Andy Shevchenko Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20260128142726.128175-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 43c2b86ff633c34831c8430925ba73d7c20da1ad Author: Alyssa Milburn Date: Wed Jan 28 11:28:54 2026 +0000 tty: serial: samsung_tty: avoid dev_dbg deadlock commit a05025d0ce72 ("tty: serial: samsung_tty: use standard debugging macros") changed the debug prints to dev_dbg, which can result in deadlocks: s3c24xx_serial_set_termios can be called with the port lock, and then calls dev_dbg, which needs the console mutex. At the same time, s3c24xx_serial_console_write can be called with the console lock (e.g., inside console_unlock), and needs the port lock. To avoid this, move one dev_dbg call and just delete the other. Signed-off-by: Alyssa Milburn Link: https://patch.msgid.link/aXny9km6N1v9eoXU@zall.org Signed-off-by: Greg Kroah-Hartman commit 9bd35baa37226a76888516edfbe290709d3ffac2 Author: Oliver Neukum Date: Tue Mar 3 09:43:38 2026 +0100 HID: pl: eliminate private debug macro Use proper dynamic debugging. Signed-off-by: Oliver Neukum Signed-off-by: Jiri Kosina commit 200e6c6e94fa786e36e4fe33eebf16b822181b99 Author: Linus Walleij Date: Wed Feb 18 14:44:38 2026 +0100 HID: mcp2221: Add module parameter to enfoce GPIO mode Add a module parameter to MCP2221 to enfor GPIO mode on the general purpose pins GP0 thru GP3. If I plug a device of this type into my machine, it will use the GP0, GP1, GP2 and GP3 pins for IIO voltage readings by default if CONFIG_IIO is set. However there may be cases where IIO is available but we want to use the GP0 thru GP3 lines for GPIO anyway. Example use: insmode hid-mcp2221.ko gpio_mode_enforce=1 Result in dmesg: mcp2221 0003:04D8:00DD.0005: GPIO 0 not in gpio mode mcp2221 0003:04D8:00DD.0005: GPIO 1 not in gpio mode mcp2221 0003:04D8:00DD.0005: GPIO 2 not in gpio mode mcp2221 0003:04D8:00DD.0005: GPIO 3 not in gpio mode mcp2221 0003:04D8:00DD.0005: Set GPIO mode for gpio pin 0! mcp2221 0003:04D8:00DD.0005: Set GPIO mode for gpio pin 1! mcp2221 0003:04D8:00DD.0005: Set GPIO mode for gpio pin 2! mcp2221 0003:04D8:00DD.0005: Set GPIO mode for gpio pin 3! After this the gpiolib tools such as gpioset can be used to alter the GPIO line values successfully. Signed-off-by: Linus Walleij Signed-off-by: Jiri Kosina commit 43dcce3f2a6209898f31d1ef99e0a4a1335ebb67 Merge: 4e9f7592b6f5fe bb5c17bc863d1a Author: Christian Brauner Date: Mon Mar 2 10:53:15 2026 +0100 Merge patch series "move_mount: expand MOVE_MOUNT_BENEATH" Christian Brauner says: I'm too tired now to keep refining this but I think it's in good enough shape for review. Allow MOVE_MOUNT_BENEATH to target the caller's rootfs, allowing to switch out the rootfs without pivot_root(2). The traditional approach to switching the rootfs involves pivot_root(2) or a chroot_fs_refs()-based mechanism that atomically updates fs->root for all tasks sharing the same fs_struct. This has consequences for fork(), unshare(CLONE_FS), and setns(). This series instead decomposes root-switching into individually atomic, locally-scoped steps: fd_tree = open_tree(-EBADF, "/newroot", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC); fchdir(fd_tree); move_mount(fd_tree, "", AT_FDCWD, "/", MOVE_MOUNT_BENEATH | MOVE_MOUNT_F_EMPTY_PATH); chroot("."); umount2(".", MNT_DETACH); Since each step only modifies the caller's own state, the fork/unshare/setns races are eliminated by design. A key step to making this possible is to remove the locked mount restriction. Originally MOVE_MOUNT_BENEATH doesn't support mounting beneath a mount that is locked. The locked mount protects the underlying mount from being revealed. This is a core mechanism of unshare(CLONE_NEWUSER | CLONE_NEWNS). The mounts in the new mount namespace become locked. That effectively makes the new mount table useless as the caller cannot ever get rid of any of the mounts no matter how useless they are. We can lift this restriction though. We simply transfer the locked property from the top mount to the mount beneath. This works because what we care about is to protect the underlying mount aka the parent. The mount mounted between the parent and the top mount takes over the job of protecting the parent mount from the top mount mount. This leaves us free to remove the locked property from the top mount which can consequently be unmounted: unshare(CLONE_NEWUSER | CLONE_NEWNS) and we inherit a clone of procfs on /proc then currently we cannot unmount it as: umount -l /proc will fail with EINVAL because the procfs mount is locked. After this series we can now do: mount --beneath -t tmpfs tmpfs /proc umount -l /proc after which a tmpfs mount has been placed beneath the procfs mount. The tmpfs mount has become locked and the procfs mount has become unlocked. This means you can safely modify an inherited mount table after unprivileged namespace creation. Afterwards we simply make it possible to move a mount beneath the rootfs allowing to upgrade the rootfs. Removing the locked restriction makes this very useful for containers created with unshare(CLONE_NEWUSER | CLONE_NEWNS) to reshuffle an inherited mount table safely and MOVE_MOUNT_BENEATH makes it possible to switch out the rootfs instead of using the costly pivot_root(2). * patches from https://patch.msgid.link/20260224-work-mount-beneath-rootfs-v1-0-8c58bf08488f@kernel.org: selftests/filesystems: add MOVE_MOUNT_BENEATH rootfs tests move_mount: allow MOVE_MOUNT_BENEATH on the rootfs move_mount: transfer MNT_LOCKED Link: https://patch.msgid.link/20260224-work-mount-beneath-rootfs-v1-0-8c58bf08488f@kernel.org Signed-off-by: Christian Brauner commit bb5c17bc863d1ac9ee0d51d300d5399d632fe69f Author: Christian Brauner Date: Tue Feb 24 01:40:28 2026 +0100 selftests/filesystems: add MOVE_MOUNT_BENEATH rootfs tests Add tests for mounting beneath the rootfs using MOVE_MOUNT_BENEATH: - beneath_rootfs_success: mount beneath /, fchdir, chroot, umount2 MNT_DETACH -- verify root changed - beneath_rootfs_old_root_stacked: after mount-beneath, verify old root parent is clone via statmount - beneath_rootfs_in_chroot_fail: chroot into subdir of same mount, mount-beneath fails (dentry != mnt_root) - beneath_rootfs_in_chroot_success: chroot into separate tmpfs mount, mount-beneath succeeds - beneath_rootfs_locked_transfer: in user+mount ns: mount-beneath rootfs succeeds, MNT_LOCKED transfers, old root unmountable - beneath_rootfs_locked_containment: in user+mount ns: after full root-switch workflow, new root is MNT_LOCKED (containment preserved) - beneath_non_rootfs_locked_transfer: mounts created before unshare(CLONE_NEWUSER | CLONE_NEWNS) become locked; mount-beneath transfers MNT_LOCKED, displaced mount can be unmounted - beneath_non_rootfs_locked_containment: same setup, verify new mount is MNT_LOCKED (containment preserved) Link: https://patch.msgid.link/20260224-work-mount-beneath-rootfs-v1-3-8c58bf08488f@kernel.org Signed-off-by: Christian Brauner commit ccfac16e0be52b674ac04fb5ba88c643f76ae0e1 Author: Christian Brauner Date: Tue Feb 24 01:40:27 2026 +0100 move_mount: allow MOVE_MOUNT_BENEATH on the rootfs Allow MOVE_MOUNT_BENEATH to target the caller's rootfs. When the target of a mount-beneath operation is the caller's root mount, verify that: (1) The caller is located at the root of the mount, as enforced by path_mounted() in do_lock_mount(). (2) Propagation from the parent mount would not overmount the target, to avoid propagating beneath the rootfs of other mount namespaces. The root-switching is decomposed into individually atomic, locally-scoped steps: mount-beneath inserts the new root under the old one, chroot(".") switches the caller's root, and umount2(".", MNT_DETACH) removes the old root. Since each step only modifies the caller's own state, this avoids cross-namespace vulnerabilities and inherent fork/unshare/setns races that a chroot_fs_refs()-based approach would have. Userspace can use the following workflow to switch roots: fd_tree = open_tree(-EBADF, "/newroot", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC); fchdir(fd_tree); move_mount(fd_tree, "", AT_FDCWD, "/", MOVE_MOUNT_BENEATH | MOVE_MOUNT_F_EMPTY_PATH); chroot("."); umount2(".", MNT_DETACH); Link: https://patch.msgid.link/20260224-work-mount-beneath-rootfs-v1-2-8c58bf08488f@kernel.org Signed-off-by: Christian Brauner commit c62a4766937edec2962d52e583276b459b739f2d Author: Christian Brauner Date: Tue Feb 24 01:40:26 2026 +0100 move_mount: transfer MNT_LOCKED When performing a mount-beneath operation the target mount can often be locked: unshare(CLONE_NEWUSER | CLONE_NEWNS); mount --beneath -t tmpfs tmpfs /proc will fail because the procfs mount on /proc became locked when the mount namespace was created from the parent mount namespace. Same logic for: unshare(CLONE_NEWUSER | CLONE_NEWNS); mount --beneath -t tmpfs tmpfs / MNT_LOCKED is raised to prevent an unprivileged mount namespace from revealing whatever is under a given mount. To replace the rootfs we need to handle that case though. We can simply transfer the locked mount property from the top mount to the mount beneath. The new mount we mounted beneath the top mount takes over the job of the top mount in protecting the parent mount from being revealed. This leaves us free to allow the top mount to be unmounted. This also works during mount propagation and also works for the non-MOVE_MOUNT_BENEATH case: (1) move_mount(MOVE_MOUNT_BENEATH): @source_mnt->overmount always NULL (2) move_mount(): @source_mnt->overmount maybe !NULL For (1) can_move_mount_beneath() rejects overmounted @source_mnt (We could allow this but whatever it's not really a use-case and it's fugly to move an overmounted mount stack around. What are you even doing? So let's keep that restriction. For (2) we can have @source_mnt overmounted (Someone overmounted us while we locked the target mount.). Both are fine. @source_mnt will be mounted on whatever @q was mounted on and @q will be mounted on the top of the @source_mnt mount stack. Even in such cases we can unlock @q and lock @source_mnt if @q was locked. This effectively makes mount propagation useful in cases where a mount namespace has a locked mount somewhere and we propagate a new mount beneath it but the mount namespace could never get at it because the old top mount remains locked. Again, we just let the newly propagated mount take over the protection and unlock the top mount. Link: https://patch.msgid.link/20260224-work-mount-beneath-rootfs-v1-1-8c58bf08488f@kernel.org Signed-off-by: Christian Brauner commit 4e9f7592b6f5fe4929b2d755785788acba123db5 Merge: 0209e31659d690 5b8ffd63fbd94f Author: Christian Brauner Date: Wed Mar 11 23:01:17 2026 +0100 Merge patch series "namespace: allow creating empty mount namespaces" Christian Brauner says: Currently, creating a new mount namespace always copies the entire mount tree from the caller's namespace. For containers and sandboxes that intend to build their mount table from scratch this is wasteful: they inherit a potentially large mount tree only to immediately tear it down. This series adds support for creating a mount namespace that contains only a clone of the root mount, with none of the child mounts. Two new flags are introduced: - CLONE_EMPTY_MNTNS (0x400000000) for clone3(), using the 64-bit flag space. - UNSHARE_EMPTY_MNTNS (0x00100000) for unshare(), reusing the CLONE_PARENT_SETTID bit which has no meaning for unshare. Both flags imply CLONE_NEWNS. The resulting namespace contains a single nullfs root mount with an immutable empty directory. The intended workflow is to then mount a real filesystem (e.g., tmpfs) over the root and build the mount table from there. * patches from https://patch.msgid.link/20260306-work-empty-mntns-consolidated-v1-0-6eb30529bbb0@kernel.org: selftests/filesystems: add clone3 tests for empty mount namespaces selftests/filesystems: add tests for empty mount namespaces namespace: allow creating empty mount namespaces Link: https://patch.msgid.link/20260306-work-empty-mntns-consolidated-v1-0-6eb30529bbb0@kernel.org Signed-off-by: Christian Brauner commit 5b8ffd63fbd94fe71f1baf50a55e31be54a97ca9 Author: Christian Brauner Date: Fri Mar 6 17:28:39 2026 +0100 selftests/filesystems: add clone3 tests for empty mount namespaces Add a test suite for the CLONE_EMPTY_MNTNS flag exercising the empty mount namespace functionality through the clone3() syscall. The clone3() code path is distinct from the unshare() path already tested in empty_mntns_test.c. With clone3(), CLONE_EMPTY_MNTNS (0x400000000ULL) is a 64-bit flag that implies CLONE_NEWNS. The implication happens in kernel_clone() before copy_process(), unlike unshare() where it goes through UNSHARE_EMPTY_MNTNS to CLONE_EMPTY_MNTNS conversion in unshare_nsproxy_namespaces(). The tests cover: - basic functionality: clone3 child gets empty mount namespace with exactly one mount, root and cwd point to the same mount - CLONE_NEWNS implication: CLONE_EMPTY_MNTNS works without explicit CLONE_NEWNS, also works with redundant CLONE_NEWNS - flag interactions: combines correctly with CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_PIDFD - mutual exclusion: CLONE_EMPTY_MNTNS | CLONE_FS returns EINVAL because the implied CLONE_NEWNS conflicts with CLONE_FS - error paths: EPERM without capabilities, unknown 64-bit flags rejected - parent isolation: parent mount namespace is unchanged after clone - many parent mounts: child still gets exactly one mount - mount properties: root mount is nullfs, is its own parent, is the only listmount entry - overmount workflow: child can mount tmpfs over nullfs root to build a writable filesystem from scratch - repeated clone3: each child gets a distinct mount namespace - setns: parent can join child's empty mount namespace via setns() - regression: plain CLONE_NEWNS via clone3 still copies the full mount tree Link: https://patch.msgid.link/20260306-work-empty-mntns-consolidated-v1-3-6eb30529bbb0@kernel.org Signed-off-by: Christian Brauner commit 32f54f2bbccfdeff81d930d18ccf3161a1c203b9 Author: Christian Brauner Date: Fri Mar 6 17:28:38 2026 +0100 selftests/filesystems: add tests for empty mount namespaces Add a test suite for the UNSHARE_EMPTY_MNTNS and CLONE_EMPTY_MNTNS flags exercising the empty mount namespace functionality through the kselftest harness. The tests cover: - basic functionality: unshare succeeds, exactly one mount exists in the new namespace, root and cwd point to the same mount - flag interactions: UNSHARE_EMPTY_MNTNS works standalone without explicit CLONE_NEWNS, combines correctly with CLONE_NEWUSER and other namespace flags (CLONE_NEWUTS, CLONE_NEWIPC) - edge cases: EPERM without capabilities, works from a user namespace, many source mounts still result in one mount, cwd on a different mount gets reset to root - error paths: invalid flags return EINVAL - regression: plain CLONE_NEWNS still copies the full mount tree, other namespace unshares are unaffected - mount properties: the root mount has the expected statmount properties, is its own parent, and is the only entry returned by listmount - repeated unshare: consecutive UNSHARE_EMPTY_MNTNS calls each produce a new namespace with a distinct mount ID - overmount workflow: verifies the intended usage pattern of creating an empty mount namespace with a nullfs root and then mounting tmpfs over it to build a writable filesystem from scratch Link: https://patch.msgid.link/20260306-work-empty-mntns-consolidated-v1-2-6eb30529bbb0@kernel.org Signed-off-by: Christian Brauner commit 9d4e752a24f740b31ca827bfab07010e4e7f34b0 Author: Christian Brauner Date: Fri Mar 6 17:28:37 2026 +0100 namespace: allow creating empty mount namespaces Add support for creating a mount namespace that contains only a copy of the root mount from the caller's mount namespace, with none of the child mounts. This is useful for containers and sandboxes that want to start with a minimal mount table and populate it from scratch rather than inheriting and then tearing down the full mount tree. Two new flags are introduced: - CLONE_EMPTY_MNTNS for clone3(), using the 64-bit flag space. - UNSHARE_EMPTY_MNTNS for unshare(), reusing the CLONE_PARENT_SETTID bit which has no meaning for unshare. Both flags imply CLONE_NEWNS. For the unshare path, UNSHARE_EMPTY_MNTNS is converted to CLONE_EMPTY_MNTNS in unshare_nsproxy_namespaces() before it reaches copy_mnt_ns(), so the mount namespace code only needs to handle a single flag. In copy_mnt_ns(), when CLONE_EMPTY_MNTNS is set, clone_mnt() is used instead of copy_tree() to clone only the root mount. The caller's root and working directory are both reset to the root dentry of the new mount. The cleanup variables are changed from vfsmount pointers with __free(mntput) to struct path with __free(path_put) because the empty mount namespace path needs to release both mount and dentry references when replacing the caller's root and pwd. In the normal (non-empty) path only the mount component is set, and dput(NULL) is a no-op so path_put remains correct there as well. Link: https://patch.msgid.link/20260306-work-empty-mntns-consolidated-v1-1-6eb30529bbb0@kernel.org Signed-off-by: Christian Brauner commit 0209e31659d6908c6d0788c8a495b43d0a1f6f6c Merge: 1f318b96cc84d7 3ac7ea91f3d044 Author: Christian Brauner Date: Fri Jan 23 16:58:20 2026 +0100 Merge patch series "fsmount: add FSMOUNT_NAMESPACE" Christian Brauner says: Add FSMOUNT_NAMESPACE flag to fsmount() that creates a new mount namespace with the newly created filesystem attached to a copy of the real rootfs. This returns a namespace file descriptor instead of an O_PATH mount fd, similar to how OPEN_TREE_NAMESPACE works for open_tree(). This allows creating a new filesystem and immediately placing it in a new mount namespace in a single operation, which is useful for container runtimes and other namespace-based isolation mechanisms. This accompanies OPEN_TREE_NAMESPACE and avoids a needless detour via OPEN_TREE_NAMESPACE to get the same effect. Will be especially useful when you mount an actual filesystem to be used as the container rootfs. * patches from https://patch.msgid.link/20260122-work-fsmount-namespace-v1-0-5ef0a886e646@kernel.org: selftests/open_tree_ns: fix compilation selftests: add FSMOUNT_NAMESPACE tests selftests/statmount: add statmount_alloc() helper tools: update mount.h header mount: add FSMOUNT_NAMESPACE mount: simplify __do_loopback() mount: start iterating from start of rbtree Link: https://patch.msgid.link/20260122-work-fsmount-namespace-v1-0-5ef0a886e646@kernel.org Signed-off-by: Christian Brauner commit 3ac7ea91f3d0442caf6b079e1ddc80e06b079ff9 Author: Christian Brauner Date: Thu Jan 22 11:48:51 2026 +0100 selftests: add FSMOUNT_NAMESPACE tests Add selftests for FSMOUNT_NAMESPACE which creates a new mount namespace with the newly created filesystem mounted onto a copy of the real rootfs. Link: https://patch.msgid.link/20260122-work-fsmount-namespace-v1-6-5ef0a886e646@kernel.org Signed-off-by: Christian Brauner commit be1ca3ee8f97067fee87fda73ea5959d5ab75bbf Author: Christian Brauner Date: Thu Jan 22 11:48:50 2026 +0100 selftests/statmount: add statmount_alloc() helper Add a helper to allocate a statmount buffer and call statmount(). This helper will be shared by multiple test suites that need to query mount information via statmount(). Link: https://patch.msgid.link/20260122-work-fsmount-namespace-v1-5-5ef0a886e646@kernel.org Signed-off-by: Christian Brauner commit fc1a05de0058bc1dbbc202f6f6cdb25ee0bae16d Author: Christian Brauner Date: Thu Jan 22 11:48:49 2026 +0100 tools: update mount.h header Update the mount.h header so we can rely on it in the selftests. Link: https://patch.msgid.link/20260122-work-fsmount-namespace-v1-4-5ef0a886e646@kernel.org Signed-off-by: Christian Brauner commit 5e8969bd192712419aae511dd5ba26855c2c78db Author: Christian Brauner Date: Thu Jan 22 11:48:48 2026 +0100 mount: add FSMOUNT_NAMESPACE Add FSMOUNT_NAMESPACE flag to fsmount() that creates a new mount namespace with the newly created filesystem attached to a copy of the real rootfs. This returns a namespace file descriptor instead of an O_PATH mount fd, similar to how OPEN_TREE_NAMESPACE works for open_tree(). This allows creating a new filesystem and immediately placing it in a new mount namespace in a single operation, which is useful for container runtimes and other namespace-based isolation mechanisms. The rootfs mount is created before copying the real rootfs for the new namespace meaning that the mount namespace id for the mount of the root of the namespace is bigger than the child mounted on top of it. We've never explicitly given the guarantee for such ordering and I doubt anyone relies on it. Accepting that lets us avoid copying the mount again and also avoids having to massage may_copy_tree() to grant an exception for fsmount->mnt->mnt_ns being NULL. Link: https://patch.msgid.link/20260122-work-fsmount-namespace-v1-3-5ef0a886e646@kernel.org Signed-off-by: Christian Brauner commit ad4a3599e58d5ac0caa3f576c48a4b62f38d400d Author: Christian Brauner Date: Thu Jan 22 11:48:47 2026 +0100 mount: simplify __do_loopback() Remove the OPEN_TREE_NAMESPACE flag checking from __do_loopback() and instead have callers pass CL_COPY_MNT_NS_FILE directly in copy_flags. Link: https://patch.msgid.link/20260122-work-fsmount-namespace-v1-2-5ef0a886e646@kernel.org Signed-off-by: Christian Brauner commit 0c0b046392b5b6e2402bf75215ab0c3a242d7af5 Author: Christian Brauner Date: Thu Jan 22 11:48:46 2026 +0100 mount: start iterating from start of rbtree If the root of the namespace has an id that's greater than the child we'd not find it. Handle that case. Link: https://patch.msgid.link/20260122-work-fsmount-namespace-v1-1-5ef0a886e646@kernel.org Signed-off-by: Christian Brauner commit 820ed0c1a13c5fafb36232538d793f99a0986ef3 Author: Akari Tsuyukusa Date: Thu Mar 12 13:15:30 2026 +0900 arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count The gpio-ranges in the MT7986A pinctrl node were incorrectly defined, therefore, pin 100 cannot be used. Correct the range count to match the driver. Fixes: c3a064a32ed9 ("arm64: dts: mediatek: add pinctrl support for mt7986a") Signed-off-by: Akari Tsuyukusa Signed-off-by: AngeloGioacchino Del Regno commit b62a927f4a46a7f58d88ba3d5fb6e88e1a4b4603 Author: Akari Tsuyukusa Date: Thu Mar 12 13:15:29 2026 +0900 arm64: dts: mediatek: mt7981b: Fix gpio-ranges pin count The gpio-ranges in the MT7981B pinctrl node were incorrectly defined, therefore, pin 56 cannot be used. Correct the range count to match the driver. Fixes: 62b24c7fdf0a ("arm64: dts: mediatek: mt7981: add pinctrl") Signed-off-by: Akari Tsuyukusa Signed-off-by: AngeloGioacchino Del Regno commit c4c4823c8a5baa10b8100b01f49d7c3f4a871689 Author: Akari Tsuyukusa Date: Thu Mar 12 13:15:28 2026 +0900 arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count The gpio-ranges in the MT6795 pinctrl node were incorrectly defined, therefore, GPIO196 cannot be used. Correct the range count to match the driver. Fixes: b888886a4536 ("arm64: dts: mediatek: mt6795: Add pinctrl controller node") Signed-off-by: Akari Tsuyukusa Signed-off-by: AngeloGioacchino Del Regno commit 8e7adcf81564a3fe886a6270eea7558f063e5538 Author: MD Danish Anwar Date: Tue Mar 10 18:50:35 2026 +0530 net: ti: icssg: Fix wrong macro used in RX classifier configuration The RX_CLASS_OR_REG macro is being used with RX_CLASS_OR_EN parameter when writing to the AND enable register. This should use RX_CLASS_AND_EN instead to properly configure the classifier AND enable register. Fix this by using the correct RX_CLASS_AND_EN macro parameter for RX_CLASS_OR_REG when configuring the PTP duplicate and HSR tag classifiers. Fixes: f56438a74d88 ("net: ti: icssg: Add HSR/PRP protocol frame filtering") Signed-off-by: MD Danish Anwar Link: https://patch.msgid.link/20260310132035.1299787-1-danishanwar@ti.com Signed-off-by: Paolo Abeni commit 6f459eda8b60382efa0da2ca025c26a2018adc87 Author: Eric Dumazet Date: Tue Mar 10 12:44:51 2026 +0000 tcp: add tcp_release_cb_cond() helper Majority of tcp_release_cb() calls do nothing at all. Provide tcp_release_cb_cond() helper so that release_sock() can avoid these calls. Also hint the compiler that __release_sock() and wake_up() are rarely called. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-77 (-77) Function old new delta release_sock 258 181 -77 Total: Before=25235790, After=25235713, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260310124451.2280968-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 0d3fccf68d9873a3c824fb70be0dbb2c4642aa90 Author: Nathan Chancellor Date: Mon Feb 23 12:10:29 2026 -0700 kbuild: Use '-fms-anonymous-structs' if it is available Clang recently added '-fms-anonymous-structs' [1] to specifically enable the Microsoft tagged anonymous structure / union extension, for which the kernel added '-fms-extensions' in commit c4781dc3d1cf ("Kbuild: enable -fms-extensions"). Switch to this more narrow option if it is available, which would have helped avoid the issue addressed by commit a6773e6932cb ("jfs: Rename _inline to avoid conflict with clang's '-fms-extensions'"). GCC has talked about adding a similar flag [2] as well but potentially naming it differently. Move the selection of the flag to Kconfig to make it easier to use cc-option (as CC_FLAGS_DIALECT may be used in arch Makefiles, which may be too early for cc-option in Kbuild) and customize based on compiler flag names. Link: https://github.com/llvm/llvm-project/commit/c391efe6fb67329d8e2fd231692cc6b0ea902956 [1] Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=123623 [2] Signed-off-by: Nathan Chancellor Reviewed-by: Nicolas Schier Reviewed-by: Kees Cook Acked-by: Ard Biesheuvel Acked-by: Helge Deller # parisc Link: https://patch.msgid.link/20260223-fms-anonymous-structs-v1-2-8ee406d3c36c@kernel.org Signed-off-by: Nicolas Schier commit ec4c28276c140a9338700041112f64f8d7ccc3e9 Author: Nathan Chancellor Date: Mon Feb 23 12:10:28 2026 -0700 kbuild: Consolidate C dialect options Introduce CC_FLAGS_DIALECT to make it easier to update the various places in the tree that rely on the GNU C standard and Microsoft extensions flags atomically. All remaining uses of '-std=gnu11' and '-fms-extensions' are in the tools directory (which has its own build system) and other standalone Makefiles. This will allow the kernel to use a narrower option to enable the Microsoft anonymous tagged structure extension in a simpler manner. Place the CC_FLAGS_DIALECT block after the configuration include (so that a future change can move the selection of the flag to Kconfig) but before the arch/$(SRCARCH)/Makefile include (so that CC_FLAGS_DIALECT is available for use in those Makefiles). Signed-off-by: Nathan Chancellor Reviewed-by: Nicolas Schier Acked-by: Ard Biesheuvel Acked-by: Helge Deller # parisc Link: https://patch.msgid.link/20260223-fms-anonymous-structs-v1-1-8ee406d3c36c@kernel.org Signed-off-by: Nicolas Schier commit febb5c81fa8df999e24877f6226f8cba9f06ce6a Author: Thomas Weißschuh Date: Fri Feb 27 07:38:07 2026 +0100 kbuild: uapi: remove now unneeded guard headers The test compilation does not allow usage of the toolchain headers anymore, so these dummy headers are not needed anymore. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260227-kbuild-uapi-libc-v1-9-c17de0d19776@weissschuh.net Signed-off-by: Nicolas Schier commit 510c7a57362d4620f66cf8a083363b8e20bd9778 Author: Thomas Weißschuh Date: Fri Feb 27 07:38:06 2026 +0100 kbuild: uapi: simplify libc dependency logic The only left user of the condition inverts it. Invert the condition completely and simplify its user. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260227-kbuild-uapi-libc-v1-8-c17de0d19776@weissschuh.net Signed-off-by: Nicolas Schier commit 579f103fb9c570e54c81866627efb1ea1e00a26b Author: Thomas Weißschuh Date: Fri Feb 27 07:38:05 2026 +0100 kbuild: uapi: use custom stub headers instead of libc ones Now that custom stub headers are provided for all libc headers used from the UAPI headers, the dependency on the toolchain libc can be dropped. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260227-kbuild-uapi-libc-v1-7-c17de0d19776@weissschuh.net Signed-off-by: Nicolas Schier commit aad94ba683adc6ff7ff4e29ae48184b42782dd97 Author: Thomas Weißschuh Date: Fri Feb 27 07:38:04 2026 +0100 kbuild: uapi: provide stub includes for some libc headers Some UAPI headers incorrectly use libc headers. To compile-test these UAPI headers, their respective libc dependencies need to be present. Not all kernel toolchains provide these headers, reducing test coverage. Introduce some stub headers which provide just enough symbols to test all UAPI headers. Most headers are empty anyways, as their symbols are only used in macros which are not actually evaluated. As these headers are only ever used with newer kernel toolchains, they can defer to compiler builtins in many cases. As more UAPI headers are cleaned up to not require these stubs anymore, they can be removed again. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260227-kbuild-uapi-libc-v1-6-c17de0d19776@weissschuh.net Signed-off-by: Nicolas Schier commit 0ef1b7a66b604593c62a6375e4b6afa0a5f2e04a Author: Thomas Weißschuh Date: Fri Feb 27 07:38:03 2026 +0100 kbuild: uapi: only use dummy-include for headers which use libc The headers which do not rely on libc are using built using -nostdinc. For them the dummy headers are pointless. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260227-kbuild-uapi-libc-v1-5-c17de0d19776@weissschuh.net Signed-off-by: Nicolas Schier commit 60a16beedf37db82edf39346fdc9e3916ab41994 Author: Thomas Weißschuh Date: Fri Feb 27 07:38:02 2026 +0100 kbuild: uapi: completely exclude linux/bpf_perf_event.h on nios2 This header is actually not buildable on nios. As nobody built nios2 with CONFIG_CC_CAN_LINK=y so far, this produced no errors. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260227-kbuild-uapi-libc-v1-4-c17de0d19776@weissschuh.net Signed-off-by: Nicolas Schier commit 45bd8643c1a2e5e17e3436c4d8de2a67e16e64d6 Author: Thomas Weißschuh Date: Fri Feb 27 07:38:01 2026 +0100 kbuild: uapi: deduplicate linux/bpf_perf_event.h exclusions This header is excluded for multiple architectures. Use a single exclusion for all of them. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260227-kbuild-uapi-libc-v1-3-c17de0d19776@weissschuh.net Signed-off-by: Nicolas Schier commit a8c9d3cc23b6564aa8898a9ba20b2abc7fc42eca Author: Thomas Weißschuh Date: Fri Feb 27 07:38:00 2026 +0100 kbuild: uapi: test linux/bpf_perf_event.h on powerpc This header works now, so test it. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260227-kbuild-uapi-libc-v1-2-c17de0d19776@weissschuh.net Signed-off-by: Nicolas Schier commit 47bca1cbf692b89defbf4db27495813f82d5e3ff Author: Thomas Weißschuh Date: Fri Feb 27 07:37:59 2026 +0100 hexagon: uapi: Fix structure alignment attribute __aligned() is a kernel macro, which is not available in UAPI headers. Use the compiler-provided alignment attribute directly. Signed-off-by: Thomas Weißschuh Acked-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Link: https://patch.msgid.link/20260227-kbuild-uapi-libc-v1-1-c17de0d19776@weissschuh.net Signed-off-by: Nicolas Schier commit 00da2edc646c851114c78affdc3e34a089136d8a Merge: 0670bc81f50966 8fc5c7895185d1 Author: Mark Brown Date: Thu Mar 12 11:29:05 2026 +0000 ASoC: wm_adsp: Some improvements to firmware file Merge series from Richard Fitzgerald : This series makes some improvements to the code that searches for firmware files. Patch 1 is a trivial patch to remove an unused function argument, before adding any new code that uses this API. Patches 2..4 add KUnit testing to prove that the subsequent changes don't break anything. The remaining patches remove duplicated code and clean up some of the implementation. commit 0670bc81f50966bf1b30df5744eea4fdeea2ba6f Merge: 46b87c37ca4f54 7b3f8db159f710 Author: Mark Brown Date: Thu Mar 12 11:29:01 2026 +0000 ASoC: fsl: add bitcount and timestamp controls Merge series from Shengjiu Wang : The SAI and XCVR have the timestamp counters and bit counters, which can be used by software to track the progress of the transmitter and receiver. They can also be used to calculate the relative frequency of the bit clock against the bus interface clock. commit 869d5b4b2a8012f6ef6058a1055cac6922c2cb55 Author: Pei Xiao Date: Thu Mar 12 10:47:55 2026 +0800 spi: atcspi200: fix mutex initialization order The atcspi_exec_mem_op() function may call mutex_lock() on the driver's mutex before it is properly initialized if a SPI memory operation is initiated immediately after devm_spi_register_controller() is called. The mutex initialization currently occurs after the controller registration, which leaves a window where the mutex could be used uninitialized. Move the mutex initialization to the beginning of the probe function, before any registration or resource allocation. Fixes: 34e3815ea459 ("spi: atcspi200: Add ATCSPI200 SPI controller driver") Signed-off-by: Pei Xiao Link: https://patch.msgid.link/15a71241affc25108a97d40d9d3dd1bc3d2d69ed.1773282905.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit 4320f1f111c587b8c6c9abc06f43e25bc10b670c Author: Wojciech Slenska Date: Tue Mar 10 12:22:30 2026 +0100 dt-bindings: net: qcom,ipa: document qcm2290 compatible Document that ipa on qcm2290 uses version 4.2, the same as sc7180. Acked-by: Krzysztof Kozlowski Signed-off-by: Wojciech Slenska Link: https://patch.msgid.link/20260310112309.79261-2-wojciech.slenska@gmail.com Signed-off-by: Paolo Abeni commit 1432f9d4e8aa2d7585b678bdd0b740597af00d6e Author: Thomas Gleixner Date: Sat Jan 24 00:17:57 2026 +0100 clocksource: Don't use non-continuous clocksources as watchdog Using a non-continuous aka untrusted clocksource as a watchdog for another untrusted clocksource is equivalent to putting the fox in charge of the henhouse. That's especially true with the jiffies clocksource which depends on interrupt delivery based on a periodic timer. Neither the frequency of that timer is trustworthy nor the kernel's ability to react on it in a timely manner and rearm it if it is not self rearming. Just don't bother to deal with this. It's not worth the trouble and only relevant to museum piece hardware. Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260123231521.858743259@kernel.org commit 79ccb0693a99e1b91eba95c6bd32a3e02be156ae Author: Thomas Gleixner Date: Sat Jan 24 00:17:55 2026 +0100 x86/tsc: Handle CLOCK_SOURCE_VALID_FOR_HRES correctly Unconditionally setting the CLOCK_SOURCE_VALID_FOR_HRES for the real TSC clocksource is wrong as there is no guarantee that the early TSC was validated for high resolution mode. Set the flag only when the early TSC was validated as otherwise the clocksource selection might enable high resolution mode with a TSC of unknown quality and possibly no way to back out once it is discovered to be unsuitable. Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260123231521.790598171@kernel.org commit ced7072a3ad65698f0ad378c8f8566379fe50723 Author: Thomas Gleixner Date: Sat Jan 24 00:17:52 2026 +0100 MIPS: Don't select CLOCKSOURCE_WATCHDOG MIPS selects CLOCKSOURCE_WATCHDOG, but none of the clocksources actually sets the MUST_VERIFY flag. So compiling the watchdog in is a pointless exercise. Remove the selects. Signed-off-by: Thomas Gleixner Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260123231521.723433371@kernel.org commit 2a14f7c5ee790d9e49ec7df8efa7eb9446028d7e Author: Thomas Gleixner Date: Sat Jan 24 00:17:48 2026 +0100 parisc: Remove unused clocksource flags PARISC does not enable the clocksource watchdog, so the VERIFY flags are pointless as they are not evaluated. Remove them from the clocksource. Signed-off-by: Thomas Gleixner Signed-off-by: Thomas Gleixner Acked-by: Helge Deller Link: https://patch.msgid.link/20260123231521.655892451@kernel.org commit 88c316ff7694ddf55d5a0fe42602ae83bee560aa Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:21 2026 +0100 hrtimer: Add a helper to retrieve a hrtimer from its timerqueue node The container_of() call is open-coded multiple times. Add a helper macro. Use container_of_const() to preserve constness. Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-12-095357392669@linutronix.de commit f27fc117cf8fba56e0619694e685f9bca9b9cb82 Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:20 2026 +0100 hrtimer: Remove trailing comma after HRTIMER_MAX_CLOCK_BASES HRTIMER_MAX_CLOCK_BASES is required to stay the last value of the enum. Drop the trailing comma so no new members are added after it by mistake. Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-11-095357392669@linutronix.de commit f12ef5cb4e035e15f0c324c41ff402441578ffda Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:19 2026 +0100 hrtimer: Mark index and clockid of clock base as const These fields are initialized once and are never supposed to change. Mark them as const to make this explicit. Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-10-095357392669@linutronix.de commit bd803783dfa7ddd5e1d44a6abfeee26fdc3a2db7 Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:18 2026 +0100 hrtimer: Drop unnecessary pointer indirection in hrtimer_expire_entry event This pointer indirection is a remnant from when ktime_t was a struct, today it is pointless. Drop the pointer indirection. Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-9-095357392669@linutronix.de commit b94c076dd949426d09e5d415304acb3f951d9069 Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:17 2026 +0100 hrtimer: Drop spurious space in 'enum hrtimer_base_type' This spurious space makes grepping for the enum definition annoying. Remove it. Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-8-095357392669@linutronix.de commit 194675f16d7307a0109b54cf350ef9f81617f006 Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:16 2026 +0100 hrtimer: Don't zero-initialize ret in hrtimer_nanosleep() The value will be assigned to before any usage. No other function in hrtimer.c does such a zero-initialization. Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-7-095357392669@linutronix.de commit 8ef2807042d0886a85bbcb0aba1a2a277680dc4a Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:15 2026 +0100 hrtimer: Remove hrtimer_get_expires_ns() There are no users left. Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-6-095357392669@linutronix.de commit 112c685f02114d02efe0a14535abcb86fe9e464e Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:14 2026 +0100 timekeeping: Mark offsets array as const Neither the array nor the offsets it is pointing to are meant to be changed through the array. Mark both the array and the values it points to as const. Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-5-095357392669@linutronix.de commit ba546d3d895c5190a4c16d92e1ecff7c0b4ee9b3 Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:13 2026 +0100 timekeeping/auxclock: Consistently use raw timekeeper for tk_setup_internals() In aux_clock_enable() the clocksource from tkr_raw is used to call tk_setup_internals(). Do the same in tk_aux_update_clocksource(). While the clocksources will be the same in any case, this is less confusing. Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-4-095357392669@linutronix.de commit bb2705b4e03605532b429525cc8d1e9a2afe3e00 Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:12 2026 +0100 timer_list: Print offset as signed integer The offset of a hrtimer base may be negative. Print those values correctly. Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-3-095357392669@linutronix.de commit 754e38d2d1aeeadddac5220f34e07cf263502a46 Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:11 2026 +0100 tracing: Use explicit array size instead of sentinel elements in symbol printing The sentinel value added by the wrapper macros __print_symbolic() et al prevents the callers from adding their own trailing comma. This makes constructing symbol list dynamically based on kconfig values tedious. Drop the sentinel elements, so callers can either specify the trailing comma or not, just like in regular array initializers. Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-2-095357392669@linutronix.de commit 5aa9383813aca45b914d4a7481ca417ef13114df Author: Thomas Weißschuh (Schneider Electric) Date: Wed Mar 11 11:15:10 2026 +0100 scripts/gdb: timerlist: Adapt to move of tk_core tk_core is a macro today which cannot be resolved by gdb. Use the correct symbol expression to reference tk_core. Fixes: 22c62b9a84b8 ("timekeeping: Introduce auxiliary timekeepers") Signed-off-by: Thomas Weißschuh (Schneider Electric) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311-hrtimer-cleanups-v1-1-095357392669@linutronix.de commit 52e4d5da6db788c3abc5bbb0e044e761b3540a30 Merge: 0de607dc4fd80e 00608d02ddf04b Author: Paolo Abeni Date: Thu Mar 12 12:13:50 2026 +0100 Merge branch 'net-hinic3-pf-initialization' Fan Gong says: ==================== net: hinic3: PF initialization This is [2/3] part of hinic3 Ethernet driver second submission. With this patch hinic3 becomes a complete Ethernet driver with pf and vf. Add cmdq detailed-response interfaces. Add dump interfaces for cmdq, aeq, ceq and mailbox. Add msg_send_lock for message sending concurrency. Add PF device support and chip_present_flag to check cards. Add rx vlan offload support. Add PF FLR wait and timeout handling. Add 5 ethtool ops for information of driver and link. v1: https://lore.kernel.org/netdev/cover.1771916043.git.zhuyikai1@h-partners.com/ v2: https://lore.kernel.org/netdev/cover.1772697509.git.zhuyikai1@h-partners.com/ ==================== Link: https://patch.msgid.link/cover.1773062356.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 00608d02ddf04b49c14801f4b0581b1b937bc766 Author: Fan Gong Date: Tue Mar 10 09:04:57 2026 +0800 hinic3: Add ethtool basic ops Implement following ethtool callback function: .get_link_ksettings .get_drvinfo .get_msglevel .set_msglevel .get_link These callbacks allow users to utilize ethtool for detailed network configuration and monitoring. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/b56d490c2a06cae9541a0297d76b11d869f37161.1773062356.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 330adcedd0035414b138635fd6b5f61f00cf419f Author: Fan Gong Date: Tue Mar 10 09:04:56 2026 +0800 hinic3: Add PF/VF capability parsing and parameter validation Add the ability to parse PF and VF capabilities and validate related parameters(SQ & RQ). Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/ac4733f2c0409bb778b4624ed1632dcb2ded6632.1773062356.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 33cf53672b6f386585998366c40369834f882ddb Author: Fan Gong Date: Tue Mar 10 09:04:55 2026 +0800 hinic3: Add PF FLR wait and timeout handling Add a mechanism for PF to wait for the completion of FLR, ensuring hardware state consistency after an FLR event. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/7a1b21426fd4274831733aca962eb209b806f4bd.1773062356.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 3d36efc28078ef314445b8445b174f63bdf9579f Author: Fan Gong Date: Tue Mar 10 09:04:54 2026 +0800 hinic3: Add PF device support and function type validation Add PF device ID to support for PF devices in driver and enhance function type validation to ensure proper handling of both PF and VF. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/895cf7ac341c475e383aa8726039dc8ea3b96ffb.1773062356.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 2a76f900d17dcb9e8322770ac9bcae34517805b3 Author: Fan Gong Date: Tue Mar 10 09:04:53 2026 +0800 hinic3: Add msg_send_lock for message sending concurrecy As send_mbox_msg is invoked by 3 functions: hinic3_send_mbox_to_mgmt, hinic3_response_mbox_to_mgmt and hinic3_send_mbox_to_mgmt_no_ack, only hinic3_response_mbox_to_mgmt does not has mutex and the other two has mbox->mbox_send_lock because their send actions are mutually exclusive. As hinic3_response_mbox_to_mgmt does not conflict with them in send actions but in mailbox resources, add the new mutex(msg_send_lock) in send_mbox_msg to ensure message concurrency. Besdies, in mbox_send_seg change FIELD_PREP to FIELD_GET in MBOX_STATUS_FINISHED and MBOX_STATUS_SUCCESS to be more reasonable. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/d83f7f6eb4b5e94642a558fab75d61292c347e48.1773062356.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 0f746fc5bc77cb7421ce3f6611bd770db8c4cba8 Author: Fan Gong Date: Tue Mar 10 09:04:52 2026 +0800 hinic3: Add RX VLAN offload support Add vlan offload processing in RX process. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/22cf02a014c2beb7b5f92ab5e6de38c4dd928125.1773062356.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit d69ee992fbf60dc691fed97bafcd2905c7e48832 Author: Fan Gong Date: Tue Mar 10 09:04:51 2026 +0800 hinic3: Add chip_present_flag checks to prevent errors when card is absent chip_present_flag is added for driver to prevent errors when card does not exist. It has been added to multiple critical functions, including command queue, mailbox and network device operations, ensuring that the existence of the network card is verified before performing operations. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/3954f22df125f5e843aaa62953d7506eb66922ac.1773062356.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 678c5b3b6b22f2b9851058e1624156b982891ae8 Author: Fan Gong Date: Tue Mar 10 09:04:50 2026 +0800 hinic3: Add Command Queue/Async Event Queue/Complete Event Queue/Mailbox dump interfaces Add dump interfaces for CMDQ, AEQ, CEQ and mailbox to enhance debugging capabilities. Dump the WQE header for CMDQ. Dump the detailed queue information for AEQ and CEQ. Dump the related register status for mailbox. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/1644c5021e2059594e878812339ea025ed677f71.1773062356.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 15b5be9389bef46884d9f970b643fedeea19105c Author: Fan Gong Date: Tue Mar 10 09:04:49 2026 +0800 hinic3: Add command queue detailed-response interfaces Add new detailed response interfaces for the hinic3 command queue (CMDQ), enhancing its functionality to handle commands requiring input and output buffer pairs. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/cc3cff8458aeb27b07749dc9dcee43c11c45a4c1.1773062356.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit b2eaf45e12fafffbdfc20dbe7cb160a4d2c8f9be Author: Wolfram Sang Date: Wed Mar 11 20:59:58 2026 +0100 ARM: dts: renesas: r9a06g032-rzn1d400-db: Use interrupts for Micrel PHYs Make use of the interrupts wired to the Micrel PHYs via the GPIO IRQ mux. Signed-off-by: Wolfram Sang Reviewed-by: Herve Codina Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260311200307.16034-2-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven commit 9fdad4267cef855dff8f45a04419bd61bb3438c4 Author: Geert Uytterhoeven Date: Wed Mar 11 15:58:07 2026 +0100 ARM: dts: renesas: r9a06g032-rzn1d400-db: Do not use underscores in node names Node names should not contain underscores; replace them by hyphens. Signed-off-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Reviewed-by: Herve Codina Link: https://patch.msgid.link/1c1fc11f1f183a8e72f168bf6eb35a40e01ecacb.1773240961.git.geert+renesas@glider.be commit 68532ef010e202cdc0a5a734b6d828ddcbc6a7e9 Author: Wolfram Sang Date: Thu Mar 5 22:54:04 2026 +0100 ARM: dts: renesas: r9a06g032-rzn1d400-db: Add QSPI node including NOR flash Enable the QSPI controller to access the connected SPI NOR flash. The NOR datasheet may suggest faster tuning parameters but those did not work on my board. Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260305220023.28257-2-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven commit 6c9940cbf7f3e7f9dc8f0ba3de74640ca9e66feb Author: Lad Prabhakar Date: Tue Mar 3 23:33:14 2026 +0000 arm64: dts: renesas: r9a09g057: Add DMA support for RSPI channels Enable DMA support for RSPI channels. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260303233314.2928711-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit ce2c7ca2c2acd252c495da0d924f48b70f2f4198 Author: Lad Prabhakar Date: Tue Mar 3 23:33:13 2026 +0000 arm64: dts: renesas: r9a09g056: Add DMA support for RSPI channels Enable DMA support for RSPI channels. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260303233314.2928711-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 5be0b48a3b23d961891db72a85092fe185106177 Author: Miquel Raynal (Schneider Electric) Date: Thu Feb 5 19:09:51 2026 +0100 ARM: dts: renesas: r9a06g032: Describe the QSPI controller Add a node describing the QSPI controller. There are 2 clocks feeding this controller: - one for the reference clock - one that feeds both the ahb and the apb interfaces As the binding expect either the ref clock, or all three (ref, ahb and apb) clocks, it makes sense to provide the same clock twice. Reviewed-by: Geert Uytterhoeven Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Link: https://patch.msgid.link/20260205-schneider-6-19-rc1-qspi-v5-4-843632b3c674@bootlin.com Signed-off-by: Geert Uytterhoeven commit d11ac9043435cf1ddf1abc59fa774eb6c0ca4e51 Author: Thadeu Lima de Souza Cascardo Date: Mon Mar 9 15:47:04 2026 -0300 drm/ttm/tests: add a test to exercise ttm_bo_swapout Currently, ttm_bo_swapout is not exercised by the TTM KUnit tests. It used to be exercised until commit 76689eb52667 ("drm/ttm: remove ttm_bo_validate_swapout test"), but that test was removed as it was unreliable due to requiring to allocate half of the system memory. Calling ttm_bo_swapout directly with a single allocated BO, however, does not suffer from that problem, and was able to detect a UAF introduced by commit c06da4b3573a ("drm/ttm: Tidy usage of local variables a little bit"), when built with KASAN. When applying a fix to that UAF, the test passed without any issues. Cc: Tvrtko Ursulin Cc: Christian König Reviewed-by: Tvrtko Ursulin Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260309-ttm_bo_swapout_test-v2-1-219f64046cfe@igalia.com commit acee19f998234c4aec88c5fab364780312ba17e9 Author: Thadeu Lima de Souza Cascardo Date: Mon Mar 9 15:49:52 2026 -0300 drm/ttm: document that ttm_bo_swapout deals with pages Both the target parameter and return value of ttm_bo_swapout deal with pages, not bytes. Reported-by: Tvrtko Ursulin Signed-off-by: Thadeu Lima de Souza Cascardo Acked-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260309-ttm_bo_swapout_doc-v1-1-eeb08176a00b@igalia.com commit b191aa32be2c960ca2391b40e862c389230cadef Author: Dapeng Mi Date: Sat Feb 28 13:33:19 2026 +0800 perf/x86/intel: Only check GP counters for PEBS constraints validation It's good enough to only check GP counters for PEBS constraints validation since constraints overlap can only happen on GP counters. Besides opportunistically refine the code style and use pr_warn() to replace pr_info() as the message itself is a warning message. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260228053320.140406-1-dapeng1.mi@linux.intel.com commit 0de607dc4fd80ede3b2a35e8a72f99c7a0bbc321 Author: Alexander Graf Date: Wed Mar 4 23:00:27 2026 +0000 vsock: add G2H fallback for CIDs not owned by H2G transport When no H2G transport is loaded, vsock currently routes all CIDs to the G2H transport (commit 65b422d9b61b ("vsock: forward all packets to the host when no H2G is registered"). Extend that existing behavior: when an H2G transport is loaded but does not claim a given CID, the connection falls back to G2H in the same way. This matters in environments like Nitro Enclaves, where an instance may run nested VMs via vhost-vsock (H2G) while also needing to reach sibling enclaves at higher CIDs through virtio-vsock-pci (G2H). With the old code, any CID > 2 was unconditionally routed to H2G when vhost was loaded, making those enclaves unreachable without setting VMADDR_FLAG_TO_HOST explicitly on every connect. Requiring every application to set VMADDR_FLAG_TO_HOST creates friction: tools like socat, iperf, and others would all need to learn about it. The flag was introduced 6 years ago and I am still not aware of any tool that supports it. Even if there was support, it would be cumbersome to use. The most natural experience is a single CID address space where H2G only wins for CIDs it actually owns, and everything else falls through to G2H, extending the behavior that already exists when H2G is absent. To give user space at least a hint that the kernel applied this logic, automatically set the VMADDR_FLAG_TO_HOST on the remote address so it can determine the path taken via getpeername(). Add a per-network namespace sysctl net.vsock.g2h_fallback (default 1). At 0 it forces strict routing: H2G always wins for CID > VMADDR_CID_HOST, or ENODEV if H2G is not loaded. Signed-off-by: Alexander Graf Tested-by: syzbot@syzkaller.appspotmail.com Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20260304230027.59857-1-graf@amazon.com Signed-off-by: Paolo Abeni commit 2b484419700a0f563c695312374eb8cd5264b82c Author: Nitin Gote Date: Wed Mar 4 18:08:02 2026 +0530 drm/xe: implement VM_BIND decompression in vm_bind_ioctl Implement handling of VM_BIND(..., DECOMPRESS) in xe_vm_bind_ioctl. Key changes: - Parse and record per-op intent (op->map.request_decompress) when the DECOMPRESS flag is present. - Use xe_pat_index_get_comp_en() helper to check if a PAT index has compression enabled via the XE2_COMP_EN bit. - Validate DECOMPRESS preconditions in the ioctl path: - Only valid for MAP ops. - The provided pat_index must select the device's "no-compression" PAT. - Only meaningful on devices with flat CCS and the required XE2+ otherwise return -EOPNOTSUPP. - Use XE_IOCTL_DBG for uAPI sanity checks. - Implement xe_bo_decompress(): For VRAM BOs run xe_bo_move_notify(), reserve one fence slot, schedule xe_migrate_resolve(), and attach the returned fence with DMA_RESV_USAGE_KERNEL. Non-VRAM cases are silent no-ops. - Wire scheduling into vma_lock_and_validate() so VM_BIND will schedule decompression when request_decompress is set. - Handle fault-mode VMs by performing decompression synchronously during the bind process, ensuring that the resolve is completed before the bind finishes. This schedules an in-place GPU resolve (xe_migrate_resolve) for decompression. Compute PR: https://github.com/intel/compute-runtime/pull/898 IGT PR: https://patchwork.freedesktop.org/series/157553/ v7: Rebase on latest drm-tip and add compute and igt pr info v6: (Matt Auld) - Rebase as xe_pat_index_get_comp_en() is added in separate patch - Drop vm param from xe_bo_decompress(), instead of it extract tile from bo - Reject decompression on igpu instead of silent skipping to avoid any failure on Xe2+igpu as xe_device_has_flat_ccs() can sometimes be false on igpu due some setting in the BIOS to turn off compression on igpu. - Nits v5: (Matt) - Correct the condition check of xe_pat_index_get_comp_en v4: (Matt) - Introduce xe_pat_index_get_comp_en(), which checks XE2_COMP_EN for the pat_index - .interruptible should be true, everything else false v3: (Matt) - s/xe_bo_schedule_decompress/xe_bo_decompress - skip the decrompress step if the BO isn't in VRAM - start/size not required in xe_bo_schedule_decompress - Use xe_bo_move_notify instead of xe_vm_invalidate_vma with respect to invalidation. - Nits v2: - Move decompression work out of vm_bind ioctl. (Matt) - Put that work in a small helper at the BO/migrate layer invoke it from vma_lock_and_validate which already runs under drm_exec. - Move lightweight checks to vm_bind_ioctl_check_args (Matthew Auld) Cc: Matthew Brost Cc: Matthew Auld Reviewed-by: Matthew Auld Acked-by: Michal Mrozek Signed-off-by: Nitin Gote Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260304123758.3050386-8-nitin.r.gote@intel.com commit be97fd06458d66a53aefb6d9429db0df734c81c0 Author: Nitin Gote Date: Wed Mar 4 18:08:01 2026 +0530 drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support Introduce an internal __xe_migrate_copy(..., is_vram_resolve) path and expose a small wrapper xe_migrate_resolve() that calls it with is_vram_resolve=true. For resolve/decompression operations we must ensure the copy code uses the compression PAT index when appropriate; this change centralizes that behavior and allows callers to schedule a resolve (decompress) operation via the migrate API. v3: Fix kernel-doc warnings v2: (Matt) - Simplify xe_migrate_resolve(), use single BO/resource; remove copy_only_ccs argument as it's always false. Cc: Matthew Brost Cc: Matthew Auld Reviewed-by: Matthew Brost Signed-off-by: Nitin Gote Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260304123758.3050386-7-nitin.r.gote@intel.com commit 2270bd7124f4d25497d58c293cd40ea014ddaf01 Author: Nitin Gote Date: Wed Mar 4 18:08:00 2026 +0530 drm/xe: add VM_BIND DECOMPRESS uapi flag Add a new VM_BIND flag, DRM_XE_VM_BIND_FLAG_DECOMPRESS, that lets userspace express intent for the driver to perform on-device in-place decompression for the GPU mapping created by a MAP bind operation. This flag is used by subsequent driver changes to trigger scheduling of GPU work that resolves compressed VRAM pages into an uncompressed PAT VM mapping. Behavior and semantics: - Valid only for DRM_XE_VM_BIND_OP_MAP. IOCTLs using this flag on other ops are rejected (-EINVAL). - The bind's pat_index must select the device "no-compression" PAT entry; otherwise the ioctl is rejected (-EINVAL). - Only meaningful for VRAM-backed BOs on devices that support Flat CCS and the required hardware generation (driver will return -EOPNOTSUPP if not). - On success the driver schedules a migrate/resolve and installs the returned dma_fence into the BO's kernel reservation (DMA_RESV_USAGE_KERNEL). Compute PR: https://github.com/intel/compute-runtime/pull/898 v3: Rebase on latest drm-tip and add compute pr info v2: Add kernel doc (Matt) Cc: Matthew Brost Cc: Matthew Auld Cc: Mrozek, Michal Reviewed-by: Matthew Brost Signed-off-by: Nitin Gote Acked-by: Michal Mrozek Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260304123758.3050386-6-nitin.r.gote@intel.com commit 3bdc20b005c20ce1bf9b098d1ee2caa1d994141e Author: Carlos Maiolino Date: Tue Mar 10 18:36:48 2026 +0100 xfs: factor out xfs_zone_inc_written Move the written blocks increment and full zone check into a new helper. Also add an assert to ensure rmap lock is held here. Signed-off-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 02a5d8993b09fe9a6754e57d0e25399baffe9a06 Author: Carlos Maiolino Date: Tue Mar 10 18:36:47 2026 +0100 xfs: factor out xfs_dio_write_zoned_end_io Stop sharing direct IO end_io between regular and zoned devices by factoring out zoned dio end_io to its own function. Signed-off-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit db8367f63b301bbdff6eb00c2e09fad4f2ae75e9 Author: Carlos Maiolino Date: Tue Mar 10 18:36:46 2026 +0100 xfs: factor out isize updates from xfs_dio_write_end_io This is the only code needed for zoned inodes, so factor it out so we can move zoned inodes ioend to its own callback. Signed-off-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit f08ceb71c5a5615577e7c841e1e00a89f495ab51 Merge: f66d6cc6891e41 58351f46de26bc Author: Maxime Ripard Date: Thu Mar 12 08:25:41 2026 +0100 Merge drm/drm-next into drm-misc-next Biju Das needs a patch for rz-du merged in 7.0-rc3 Signed-off-by: Maxime Ripard commit 8d16e3c6f844823812f872df5ef1d3d2ed11b956 Author: Zhan Xusheng Date: Mon Mar 9 10:42:47 2026 +0800 sched/fair: Fix comma operator misuse in NUMA fault accounting Replace the comma operator with separate statements when assigning NUMA fault statistics. This improves readability and follows kernel coding style. Signed-off-by: Zhan Xusheng Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260309024247.10908-1-zhanxusheng@xiaomi.com commit 49b76317592ecbaefd0969d51d02019966cc994b Author: Randy Dunlap Date: Sun Mar 1 16:52:37 2026 -0800 sched/wait: correct kernel-doc descriptions Use the correct function name and function parameter name to avoid these kernel-doc warnings: Warning: include/linux/wait_bit.h:424 expecting prototype for wait_var_event_killable(). Prototype was for wait_var_event_interruptible() instead Warning: include/linux/wait_bit.h:508 function parameter 'lock' not described in 'wait_var_event_mutex' Signed-off-by: Randy Dunlap Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260302005237.3473095-1-rdunlap@infradead.org commit 103a7b97c63905ab4d1463bf040e27f668e6a340 Author: Cássio Gabriel Date: Wed Mar 11 17:00:10 2026 -0300 ALSA: usb-audio: map UAC3 front wide channels in convert_chmap_v3() convert_chmap_v3() translates UAC3 channel relationship values into ALSA channel-map positions. UAC3_CH_FRONT_WIDE_LEFT and UAC3_CH_FRONT_WIDE_RIGHT currently fall back to SNDRV_CHMAP_UNKNOWN, although ALSA already provides matching channel-map positions via SNDRV_CHMAP_FLW and SNDRV_CHMAP_FRW. Map these two UAC3 positions to their ALSA equivalents and update the comment to clarify that unsupported UAC3 channel relationships remain reported as SNDRV_CHMAP_UNKNOWN. No functional change for other channel relationships. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260311200010.103710-1-cassiogabrielcontato@gmail.com Signed-off-by: Takashi Iwai commit 17edc4e820bf8b4c7737c1de86c267e6974d543a Author: Christophe Leroy (CS GROUP) Date: Tue Mar 10 12:33:36 2026 +0100 net: Convert move_addr_to_user() to scoped user access move_addr_to_user() is a critical functions that was converted to masked user access by commit 1fb0e471611d ("net: remove one stac/clac pair from move_addr_to_user()") Convert it to scoped user access to simplify the code. Signed-off-by: Christophe Leroy (CS GROUP) Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/36d7f2e7f504d620c1b88526b25ebc89e3cb61d9.1773142315.git.chleroy@kernel.org Signed-off-by: Jakub Kicinski commit dc9902bbd480aae510b885b67cd30cd04cfce3a8 Author: Wesley Atwell Date: Mon Mar 9 19:26:04 2026 -0600 tcp: use WRITE_ONCE() for tsoffset in tcp_v6_connect() Commit dd23c9f1e8d5 ("tcp: annotate data-races around tp->tsoffset") updated do_tcp_getsockopt() to read tp->tsoffset with READ_ONCE() for TCP_TIMESTAMP because another CPU may change it concurrently. tcp_v6_connect() still stores tp->tsoffset with a plain write. That store runs under lock_sock() via inet_stream_connect(), but the socket lock does not serialize a concurrent getsockopt(TCP_TIMESTAMP) from another task sharing the socket. Use WRITE_ONCE() for the tcp_v6_connect() store so the connect-time writer matches the lockless TCP_TIMESTAMP reader. This also makes the IPv6 path consistent with tcp_v4_connect(). Signed-off-by: Wesley Atwell Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260310012604.145661-1-atwellwea@gmail.com Signed-off-by: Jakub Kicinski commit 87aa0f539df0c190be7b565c1f32f9f90bf3869f Merge: bd4d6b955df233 f0bd1931666371 Author: Jakub Kicinski Date: Wed Mar 11 19:11:43 2026 -0700 Merge branch 'selftests-net-fix-cmd-process-timeout-handling' Gal Pressman says: ==================== selftests: net: fix cmd.process() timeout handling Pass the timeout argument correctly in cmd.process(). As Jakub noted, fixing the timeout broke the bpftrace() command in netpoll_basic.py, so fix it first. ==================== Link: https://patch.msgid.link/20260310115803.2521050-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit f0bd19316663710de157e85afd62058312aa97e1 Author: Gal Pressman Date: Tue Mar 10 13:58:03 2026 +0200 selftests: net: fix timeout passed as positional argument to communicate() The cited commit refactored the hardcoded timeout=5 into a parameter, but dropped the keyword from the communicate() call. Since Popen.communicate()'s first positional argument is 'input' (not 'timeout'), the timeout value is silently treated as stdin input and the call never enforces a timeout. Pass timeout as a keyword argument to restore the intended behavior. Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20260310115803.2521050-3-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 82562972b85469e23fb787f78c1dea6ad6b16af4 Author: Gal Pressman Date: Tue Mar 10 13:58:02 2026 +0200 selftests: net: pass bpftrace timeout to cmd() The bpftrace() helper configures an interval based exit timer but does not propagate the timeout to the cmd object, which defaults to 5 seconds. Since the default BPFTRACE_TIMEOUT is 10 seconds, cmd.process() always raises a TimeoutExpired exception before bpftrace has a chance to exit gracefully. Pass timeout+5 to cmd() to allow bpftrace to complete gracefully. Note: this issue is masked by a bug in the way cmd() passes timeout, this is fixed in the next commit. Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20260310115803.2521050-2-gal@nvidia.com Signed-off-by: Jakub Kicinski commit bd4d6b955df2333511d7800a5cf9c672d3a9cad5 Merge: 7e27d6202e90bc 0ae998c4efd69f Author: Jakub Kicinski Date: Wed Mar 11 19:00:37 2026 -0700 Merge branch 'net-macb-clean-up-several-member-settings-of-macb_config-instances' Kevin Hao says: ==================== net: macb: Clean up several member settings of macb_config instances While debugging an issue in the macb driver, I noticed that many macb_config instances have very similar member settings. This makes it difficult to identify the actual differences between these instances. This patch series aims to clean up some of these settings and clarify the specific configurations of each macb_config instance. No functional changes are introduced. ==================== Link: https://patch.msgid.link/20260310-macb-cleanup-v1-0-928c1a91a7dc@gmail.com Signed-off-by: Jakub Kicinski commit 0ae998c4efd69fd5e331db7844b8cfaf07d47aea Author: Kevin Hao Date: Tue Mar 10 18:12:09 2026 +0800 net: macb: Clean up the .usrio settings in macb_config instances All instances of macb_config currently have the .usrio set, but most of them use &macb_default_usrio. In fact, there is no need to duplicate this across all macb_config instances. Remove the .usrio setting from instances that use &macb_default_usrio, and ensure that the default is selected at runtime when no other value is explicitly set. Signed-off-by: Kevin Hao Link: https://patch.msgid.link/20260310-macb-cleanup-v1-3-928c1a91a7dc@gmail.com Signed-off-by: Jakub Kicinski commit 9179711ee2f70f3ba1d56d5c2e9fce04fb754198 Author: Kevin Hao Date: Tue Mar 10 18:12:08 2026 +0800 net: macb: Clean up the .init settings in macb_config instances All instances of macb_config currently have the .init field set, but most of them use macb_init(). In fact, there is no need to duplicate this across all macb_config instances. Introduce a new macb_init() function that executes the specific .init if it is set; otherwise, it runs a default initialization function. Signed-off-by: Kevin Hao Link: https://patch.msgid.link/20260310-macb-cleanup-v1-2-928c1a91a7dc@gmail.com Signed-off-by: Jakub Kicinski commit f97977944d1587fc01736da8b138d7bb9c526d02 Author: Kevin Hao Date: Tue Mar 10 18:12:07 2026 +0800 net: macb: Clean up the .clk_init setting in the macb_config instances All instances of macb_config currently have .clk_init set, but most of them use macb_clk_init(). In fact, there is no need to duplicate this across all macb_config instances. Introduce a new macb_clk_init() function that executes the specific .clk_init if it is set; otherwise, it runs the default clock initialization function. Signed-off-by: Kevin Hao Link: https://patch.msgid.link/20260310-macb-cleanup-v1-1-928c1a91a7dc@gmail.com Signed-off-by: Jakub Kicinski commit 7e27d6202e90bc1c2ff16cd3118cb5456214ee42 Author: Daniel Golle Date: Tue Mar 10 18:10:32 2026 +0000 selftests: net: local_termination: test link-local protocols Add tests to local_termination.sh to verify that link-local frames arrive. On some switches the DSA driver uses bridges to connect the user ports to their CPU ports. More "intelligent" switches typically don't forward link-local frames, but may trap them to an internal microcontroller. The driver may have to change trapping rules, so link-local frames end up on the DSA CPU ports instead of being silently dropped or trapped to the internal microcontroller of the switch. Add two tests which help to validate this has been done correctly: - Link-local STP BPDU should arrive at the Linux netdev when the bridge has STP disabled (BR_NO_STP), in which case the bridge forwards them rather than consuming them in the control plane - Link-local LLDP should arrive at standalone ports (and the test should be skipped on bridged ports similar to how it is done for the IEEE1588v2/PTP tests) Signed-off-by: Daniel Golle Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean Link: https://patch.msgid.link/1a67081b2ede1e6d2d32f7dd54ae9688f3566152.1773166131.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 410593fec752f15c97062d2ded5e3a9dd654dcb2 Author: Eric Dumazet Date: Tue Mar 10 07:38:55 2026 +0000 tcp: add sysctl_tcp_shrink_window to netns_ipv4_sysctl.rst Add missing entry for sysctl_tcp_shrink_window. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260310073855.564927-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 34c0378b156f02f5fd8149f24a7aa75b255e8cda Author: Soichiro Ueda Date: Tue Mar 10 16:28:31 2026 +0900 selftests: af_unix: validate SO_PEEK_OFF advancement and reset Extend the so_peek_off selftest to ensure the socket peek offset is handled correctly after both MSG_PEEK and actual data consumption. Verify that the peek offset advances by the same amount as the number of bytes read when performing a read with MSG_PEEK. After exercising SO_PEEK_OFF via MSG_PEEK, drain the receive queue with a non-peek recv() and verify that it can receive all the content in the buffer and SO_PEEK_OFF returns back to 0. The verification after actual data consumption was suggested by Miao Wang when the original so_peek_off selftest was introduced. Link: https://lore.kernel.org/all/7B657CC7-B5CA-46D2-8A4B-8AB5FB83C6DA@gmail.com/ Suggested-by: Miao Wang Reviewed-by: Willem de Bruijn Reviewed-by: Kuniyuki Iwashima Signed-off-by: Soichiro Ueda Link: https://patch.msgid.link/20260310072832.127848-1-the.latticeheart@gmail.com Signed-off-by: Jakub Kicinski commit d8e899855459b841754a8d938ae6eba4b50e464b Author: Andy Shevchenko Date: Fri Feb 27 08:26:26 2026 +0100 dt-bindings: bus: Remove unused bindings As stated in [1] the Baikal platforms are not supported and the respective driver code has just been removed. Remove unused bindings. Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1] Signed-off-by: Andy Shevchenko Reviewed-by: Randy Dunlap Link: https://patch.msgid.link/20260227072726.1142944-3-andriy.shevchenko@linux.intel.com Signed-off-by: Rob Herring (Arm) commit eda024766c84d08833d18a3903537161e744e2b3 Author: Andy Shevchenko Date: Fri Feb 27 08:26:25 2026 +0100 bus: Remove not-going-to-be-supported code for Baikal SoC As noticed in the discussion [1] the Baikal SoC and platforms are not going to be finalized, hence remove stale code. Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1] Signed-off-by: Andy Shevchenko Reviewed-by: Randy Dunlap Link: https://patch.msgid.link/20260227072726.1142944-2-andriy.shevchenko@linux.intel.com Signed-off-by: Rob Herring (Arm) commit a2900f5aa4e7724a2bf56ddb1a4f816d4fcc0598 Merge: 6de23f81a5e08b ec26879e6d8998 Author: Christian Brauner Date: Wed Mar 11 23:24:31 2026 +0100 Merge patch series "pidfd: add CLONE_AUTOREAP, CLONE_NNP, and CLONE_PIDFD_AUTOKILL" Christian Brauner says: Add three new clone3() flags for pidfd-based process lifecycle management. === CLONE_AUTOREAP === CLONE_AUTOREAP makes a child process auto-reap on exit without ever becoming a zombie. This is a per-process property in contrast to the existing auto-reap mechanism via SA_NOCLDWAIT or SIG_IGN for SIGCHLD which applies to all children of a given parent. Currently the only way to automatically reap children is to set SA_NOCLDWAIT or SIG_IGN on SIGCHLD. This is a parent-scoped property affecting all children which makes it unsuitable for libraries or applications that need selective auto-reaping of specific children while still being able to wait() on others. CLONE_AUTOREAP stores an autoreap flag in the child's signal_struct. When the child exits do_notify_parent() checks this flag and causes exit_notify() to transition the task directly to EXIT_DEAD. Since the flag lives on the child it survives reparenting: if the original parent exits and the child is reparented to a subreaper or init the child still auto-reaps when it eventually exits. This is cleaner than forcing the subreaper to get SIGCHLD and then reaping it. If the parent doesn't care the subreaper won't care. If there's a subreaper that would care it would be easy enough to add a prctl() that either just turns back on SIGCHLD and turns off auto-reaping or a prctl() that just notifies the subreaper whenever a child is reparented to it. CLONE_AUTOREAP can be combined with CLONE_PIDFD to allow the parent to monitor the child's exit via poll() and retrieve exit status via PIDFD_GET_INFO. Without CLONE_PIDFD it provides a fire-and-forget pattern. No exit signal is delivered so exit_signal must be zero. CLONE_THREAD and CLONE_PARENT are rejected: CLONE_THREAD because autoreap is a process-level property, and CLONE_PARENT because an autoreap child reparented via CLONE_PARENT could become an invisible zombie under a parent that never calls wait(). The flag is not inherited by the autoreap process's own children. Each child that should be autoreaped must be explicitly created with CLONE_AUTOREAP. === CLONE_NNP === CLONE_NNP sets no_new_privs on the child at clone time. Unlike prctl(PR_SET_NO_NEW_PRIVS) which a process sets on itself, CLONE_NNP allows the parent to impose no_new_privs on the child at creation without affecting the parent's own privileges. CLONE_THREAD is rejected because threads share credentials. CLONE_NNP is useful on its own for any spawn-and-sandbox pattern but was specifically introduced to enable unprivileged usage of CLONE_PIDFD_AUTOKILL. === CLONE_PIDFD_AUTOKILL === This flag ties a child's lifetime to the pidfd returned from clone3(). When the last reference to the struct file created by clone3() is closed the kernel sends SIGKILL to the child. A pidfd obtained via pidfd_open() for the same process does not keep the child alive and does not trigger autokill - only the specific struct file from clone3() has this property. This is useful for container runtimes, service managers, and sandboxed subprocess execution - any scenario where the child must die if the parent crashes or abandons the pidfd or just wants a throwaway helper process. CLONE_PIDFD_AUTOKILL requires both CLONE_PIDFD and CLONE_AUTOREAP. It requires CLONE_PIDFD because the whole point is tying the child's lifetime to the pidfd. It requires CLONE_AUTOREAP because a killed child with no one to reap it would become a zombie - the primary use case is the parent crashing or abandoning the pidfd so no one is around to call waitpid(). CLONE_THREAD is rejected because autokill targets a process not a thread. If CLONE_NNP is specified together with CLONE_PIDFD_AUTOKILL an unprivileged user may spawn a process that is autokilled. The child cannot escalate privileges via setuid/setgid exec after being spawned. If CLONE_PIDFD_AUTOKILL is specified without CLONE_NNP the caller must have have CAP_SYS_ADMIN in its user namespace. * patches from https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-0-d148b984a989@kernel.org: selftests/pidfd: add CLONE_PIDFD_AUTOKILL tests selftests/pidfd: add CLONE_NNP tests selftests/pidfd: add CLONE_AUTOREAP tests pidfd: add CLONE_PIDFD_AUTOKILL clone: add CLONE_NNP clone: add CLONE_AUTOREAP Link: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-0-d148b984a989@kernel.org Signed-off-by: Christian Brauner commit ec26879e6d89983b31fdb27d149854f42ee8d689 Author: Christian Brauner Date: Thu Feb 26 14:51:04 2026 +0100 selftests/pidfd: add CLONE_PIDFD_AUTOKILL tests Add tests for CLONE_PIDFD_AUTOKILL: - autokill_basic: Verify closing the clone3 pidfd kills the child. - autokill_requires_pidfd: Verify AUTOKILL without CLONE_PIDFD fails. - autokill_requires_autoreap: Verify AUTOKILL without CLONE_AUTOREAP fails. - autokill_rejects_thread: Verify AUTOKILL with CLONE_THREAD fails. - autokill_pidfd_open_no_effect: Verify only the clone3 pidfd triggers autokill, not pidfd_open(). - autokill_requires_cap_sys_admin: Verify AUTOKILL without CLONE_NNP fails with -EPERM for an unprivileged caller. - autokill_without_nnp_with_cap: Verify AUTOKILL without CLONE_NNP succeeds with CAP_SYS_ADMIN. Link: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-6-d148b984a989@kernel.org Signed-off-by: Christian Brauner commit 2a4d85aa1c0a894d962a15dc75e8489f1e91f5f6 Author: Christian Brauner Date: Thu Feb 26 14:51:03 2026 +0100 selftests/pidfd: add CLONE_NNP tests Add tests for the new CLONE_NNP flag: - nnp_sets_no_new_privs: Verify a child created with CLONE_NNP has no_new_privs set while the parent does not. - nnp_rejects_thread: Verify CLONE_NNP | CLONE_THREAD is rejected with -EINVAL since threads share credentials. - autoreap_no_new_privs_unset: Verify a plain CLONE_AUTOREAP child does not get no_new_privs. Link: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-5-d148b984a989@kernel.org Signed-off-by: Christian Brauner commit 76d46ad2c52a4d7631274a35777ac4601103e2aa Author: Christian Brauner Date: Thu Feb 26 14:51:02 2026 +0100 selftests/pidfd: add CLONE_AUTOREAP tests Add tests for the new CLONE_AUTOREAP clone3() flag: - autoreap_without_pidfd: CLONE_AUTOREAP without CLONE_PIDFD works (fire-and-forget) - autoreap_rejects_exit_signal: CLONE_AUTOREAP with non-zero exit_signal fails - autoreap_rejects_parent: CLONE_AUTOREAP with CLONE_PARENT fails - autoreap_rejects_thread: CLONE_AUTOREAP with CLONE_THREAD fails - autoreap_basic: child exits, pidfd poll works, PIDFD_GET_INFO returns correct exit code, waitpid() returns -ECHILD - autoreap_signaled: child killed by signal, exit info correct via pidfd - autoreap_reparent: autoreap grandchild reparented to subreaper still auto-reaps - autoreap_multithreaded: autoreap process with sub-threads auto-reaps after last thread exits - autoreap_no_inherit: grandchild forked without CLONE_AUTOREAP becomes a regular zombie Link: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-4-d148b984a989@kernel.org Signed-off-by: Christian Brauner commit 4ef420b3450026b56807e5d53001f80eb495403c Author: Shakeel Butt Date: Tue Mar 10 18:01:01 2026 -0700 cgroup: replace global cgroup_file_kn_lock with per-cgroup_file lock Replace the global cgroup_file_kn_lock with a per-cgroup_file spinlock to eliminate cross-cgroup contention as it is not really protecting data shared between different cgroups. The lock is initialized in cgroup_add_file() alongside timer_setup(). No lock acquisition is needed during initialization since the cgroup directory is being populated under cgroup_mutex and no concurrent accessors exist at that point. Reported-by: Jakub Kicinski Signed-off-by: Shakeel Butt Signed-off-by: Tejun Heo commit 4616120fca7f6d48b4c640e3975352e451e9c2ce Author: Shakeel Butt Date: Tue Mar 10 18:01:00 2026 -0700 cgroup: add lockless fast-path checks to cgroup_file_notify() Add lockless checks before acquiring cgroup_file_kn_lock: 1. READ_ONCE(cfile->kn) NULL check to skip torn-down files. 2. READ_ONCE(cfile->notified_at) rate-limit check to skip when within the notification interval. If within the interval, arm the deferred timer via timer_reduce() and confirm it is pending before returning -- if the timer fired in between, fall through to the lock path so the notification is not lost. Both checks have safe error directions -- a stale read can only cause unnecessary lock acquisition, never a missed notification. The critical section is simplified to just taking a kernfs_get() reference and updating notified_at. Annotate cfile->kn and cfile->notified_at write sites with WRITE_ONCE() to pair with the lockless readers. Reported-by: Jakub Kicinski Signed-off-by: Shakeel Butt Signed-off-by: Tejun Heo commit 05070cd654f38346d051b8c411faff196fa58880 Author: Shakeel Butt Date: Tue Mar 10 18:00:59 2026 -0700 cgroup: reduce cgroup_file_kn_lock hold time in cgroup_file_notify() cgroup_file_notify() calls kernfs_notify() while holding the global cgroup_file_kn_lock. kernfs_notify() does non-trivial work including wake_up_interruptible() and acquisition of a second global spinlock (kernfs_notify_lock), inflating the hold time. Take a kernfs_get() reference under the lock and call kernfs_notify() after dropping it, following the pattern from cgroup_file_show(). Reported-by: Jakub Kicinski Signed-off-by: Shakeel Butt Signed-off-by: Tejun Heo commit c8134b5f13ae959de2b3c8cc278e2602b0857345 Author: Christian Brauner Date: Thu Feb 26 14:51:01 2026 +0100 pidfd: add CLONE_PIDFD_AUTOKILL Add a new clone3() flag CLONE_PIDFD_AUTOKILL that ties a child's lifetime to the pidfd returned from clone3(). When the last reference to the struct file created by clone3() is closed the kernel sends SIGKILL to the child. A pidfd obtained via pidfd_open() for the same process does not keep the child alive and does not trigger autokill - only the specific struct file from clone3() has this property. This is useful for container runtimes, service managers, and sandboxed subprocess execution - any scenario where the child must die if the parent crashes or abandons the pidfd. CLONE_PIDFD_AUTOKILL requires both CLONE_PIDFD (the whole point is tying lifetime to the pidfd file) and CLONE_AUTOREAP (a killed child with no one to reap it would become a zombie). CLONE_THREAD is rejected because autokill targets a process not a thread. The clone3 pidfd is identified by the PIDFD_AUTOKILL file flag set on the struct file at clone3() time. The pidfs .release handler checks this flag and sends SIGKILL via do_send_sig_info(SIGKILL, SEND_SIG_PRIV, ...) only when it is set. Files from pidfd_open() or open_by_handle_at() are distinct struct files that do not carry this flag. dup()/fork() share the same struct file so they extend the child's lifetime until the last reference drops. CLONE_PIDFD_AUTOKILL uses a privilege model based on CLONE_NNP: without CLONE_NNP the child could escalate privileges via setuid/setgid exec after being spawned, so the caller must have CAP_SYS_ADMIN in its user namespace. With CLONE_NNP the child can never gain new privileges so unprivileged usage is allowed. This is a deliberate departure from the pdeath_signal model which is reset during secureexec and commit_creds() rendering it useless for container runtimes that need to deprivilege themselves. Link: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-3-d148b984a989@kernel.org Reviewed-by: Oleg Nesterov Signed-off-by: Christian Brauner commit 24baca56fafc33d4fb77cd9858a48c734183cb22 Author: Christian Brauner Date: Thu Feb 26 14:51:00 2026 +0100 clone: add CLONE_NNP Add a new clone3() flag CLONE_NNP that sets no_new_privs on the child process at clone time. This is analogous to prctl(PR_SET_NO_NEW_PRIVS) but applied at process creation rather than requiring a separate step after the child starts running. CLONE_NNP is rejected with CLONE_THREAD. It's conceptually a lot simpler if the whole thread-group is forced into NNP and not have single threads running around with NNP. Link: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-2-d148b984a989@kernel.org Reviewed-by: Oleg Nesterov Signed-off-by: Christian Brauner commit 12ae2c81b21cfaa193db2faf035d495807edc3a7 Author: Christian Brauner Date: Thu Feb 26 14:50:59 2026 +0100 clone: add CLONE_AUTOREAP Add a new clone3() flag CLONE_AUTOREAP that makes a child process auto-reap on exit without ever becoming a zombie. This is a per-process property in contrast to the existing auto-reap mechanism via SA_NOCLDWAIT or SIG_IGN for SIGCHLD which applies to all children of a given parent. Currently the only way to automatically reap children is to set SA_NOCLDWAIT or SIG_IGN on SIGCHLD. This is a parent-scoped property affecting all children which makes it unsuitable for libraries or applications that need selective auto-reaping of specific children while still being able to wait() on others. CLONE_AUTOREAP stores an autoreap flag in the child's signal_struct. When the child exits do_notify_parent() checks this flag and causes exit_notify() to transition the task directly to EXIT_DEAD. Since the flag lives on the child it survives reparenting: if the original parent exits and the child is reparented to a subreaper or init the child still auto-reaps when it eventually exits. CLONE_AUTOREAP can be combined with CLONE_PIDFD to allow the parent to monitor the child's exit via poll() and retrieve exit status via PIDFD_GET_INFO. Without CLONE_PIDFD it provides a fire-and-forget pattern where the parent simply doesn't care about the child's exit status. No exit signal is delivered so exit_signal must be zero. CLONE_AUTOREAP is rejected in combination with CLONE_PARENT. If a CLONE_AUTOREAP child were to clone(CLONE_PARENT) the new grandchild would inherit exit_signal == 0 from the autoreap parent's group leader but without signal->autoreap. This grandchild would become a zombie that never sends a signal and is never autoreaped - confusing and arguably broken behavior. The flag is not inherited by the autoreap process's own children. Each child that should be autoreaped must be explicitly created with CLONE_AUTOREAP. Link: https://github.com/uapi-group/kernel-features/issues/45 Link: https://patch.msgid.link/20260226-work-pidfs-autoreap-v5-1-d148b984a989@kernel.org Reviewed-by: Oleg Nesterov Signed-off-by: Christian Brauner commit 4782a916f0af8e1eccb58eceb0662587bd92cae9 Author: Thomas Weißschuh Date: Mon Feb 23 22:16:34 2026 +0100 EDAC/mpc85xx: Constify device sysfs attributes Now that the EDAC core allows the registration of read-only attributes, make use of that in the mpc85xx driver. Signed-off-by: Thomas Weißschuh Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260223-sysfs-const-edac-v1-7-3ff0b87249e7@weissschuh.net commit 2f1260c89347e45d2ebd05d930a71c6263f4a3b7 Author: Thomas Weißschuh Date: Mon Feb 23 22:16:33 2026 +0100 EDAC/device: Allow addition of const sysfs attributes The generic EDAC sysfs code does not need to modify these structs. Allow the drivers to add read-only ones. Signed-off-by: Thomas Weißschuh Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260223-sysfs-const-edac-v1-6-3ff0b87249e7@weissschuh.net commit 5d05360d748d477acfe1f0d05593c12beb507387 Author: Coiby Xu Date: Tue Sep 30 10:26:57 2025 +0800 ima: Add code comments to explain IMA iint cache atomic_flags Explain these atomic flags to improve code readability. For example, the flag IMA_DIGSIG is to indicate we mustn't update a file's security.ima on close because the file already has IMA signature. The code comments for the first three flags come from commit 0d73a55208e9 ("ima: re-introduce own integrity cache lock") with a minor tweak. Signed-off-by: Coiby Xu [zohar@linux.ibm.com: remove duplicate "integrity violation", unnecessary commas] Signed-off-by: Mimi Zohar commit d2b7cdcd1d337cd915eee84453cdeeff0f205445 Author: Thomas Weißschuh Date: Mon Feb 23 22:16:32 2026 +0100 EDAC/pci_sysfs: Constify instance sysfs attributes These structures are never modified, mark them read-only. Signed-off-by: Thomas Weißschuh Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260223-sysfs-const-edac-v1-5-3ff0b87249e7@weissschuh.net commit e72e70870a0b4955ca74e2a715f9bda4c08b252c Author: Thomas Weißschuh Date: Mon Feb 23 22:16:31 2026 +0100 EDAC/device: Constify info sysfs attributes These structures are never modified, mark them read-only. Signed-off-by: Thomas Weißschuh Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260223-sysfs-const-edac-v1-4-3ff0b87249e7@weissschuh.net commit 495e77a575a1f3637cfc0cff53d889316dd00594 Author: Thomas Weißschuh Date: Mon Feb 23 22:16:30 2026 +0100 EDAC/device: Drop unnecessary and dangerous casts of attributes These casts assume that the struct attribute is at the beginning of struct edac_dev_sysfs_block_attribute. This is can silently break if the field is moved, either manually or through struct randomization. Use proper member syntax to get the field address and drop the casts. Signed-off-by: Thomas Weißschuh Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260223-sysfs-const-edac-v1-3-3ff0b87249e7@weissschuh.net commit bd377af0970164a4d12479bf36049619201be2f0 Author: Cheng-Yang Chou Date: Wed Mar 11 19:34:07 2026 +0800 sched_ext: Fix incomplete help text usage strings Several demo schedulers and the selftest runner had usage strings that omitted options which are actually supported: - scx_central: add missing [-v] - scx_pair: add missing [-v] - scx_qmap: add missing [-S] and [-H] - scx_userland: add missing [-v] - scx_sdt: remove [-f] which no longer exists - runner.c: add missing [-s], [-l], [-q]; drop [-h] which none of the other sched_ext tools list in their usage lines Suggested-by: Tejun Heo Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit bb4d28e377cf04fbee8a01322059fa14808cdfe9 Author: Val Packett Date: Tue Mar 3 00:41:25 2026 -0300 arm64: dts: qcom: sm6125: Add missing MDSS core reset To make sure the display subsystem starts in a predictable state, we need to reset it. Otherwise, unpredictable issues can happen, e.g. on the xiaomi-laurel-sprout smartphone DSI would not work on boot. Wire up the reset to fix. Fixes: 0865d23a0226 ("arm64: dts: qcom: sm6125: Add display hardware nodes") Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Tested-by: Yedaya Katsman Signed-off-by: Val Packett Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260303034847.13870-7-val@packett.cool Signed-off-by: Bjorn Andersson commit 1cc317d4188ba2d72c298b5271fb4a2fa1d84c29 Author: Val Packett Date: Tue Mar 3 00:41:24 2026 -0300 arm64: dts: qcom: sm6115: Add missing MDSS core reset To make sure the display subsystem starts in a predictable state, we need to reset it. Otherwise, unpredictable issues can happen, e.g. on the motorola-guamp smartphone DSI would not transmit anything. Wire up the reset to fix. Fixes: 705e50427d81 ("arm64: dts: qcom: sm6115: Add mdss/dpu node") Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Val Packett Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260303034847.13870-6-val@packett.cool Signed-off-by: Bjorn Andersson commit 3c0101cdf24568c3ad5d9f2d2eb98c1b4a5a76c9 Merge: a5c21b9bd5f531 0221b14be8aae9 Author: Bjorn Andersson Date: Wed Mar 11 15:45:53 2026 -0500 Merge branch '20260303034847.13870-2-val@packett.cool' into arm64-for-7.1 Merge the MDSS reset constants for SM6115 and SM6125 from topic branch to get access to the constants. commit a09a80b44b155e932601292b467d8445a556fd91 Author: Val Packett Date: Tue Mar 3 00:41:23 2026 -0300 clk: qcom: dispcc-sm6125: Add missing MDSS resets The MDSS resets were left undescribed. Add them to allow resetting the display subsystem, which is necessary to avoid issues caused by state left over from the bootloader on various platforms. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Val Packett Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260303034847.13870-5-val@packett.cool Signed-off-by: Bjorn Andersson commit 67d41a9237311fe771c5a580fae7f4d15b46c724 Author: Val Packett Date: Tue Mar 3 00:41:22 2026 -0300 clk: qcom: dispcc-sm6115: Add missing MDSS resets The MDSS resets were left undescribed. Add them to allow resetting the display subsystem, which is necessary to avoid issues caused by state left over from the bootloader on various platforms. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Val Packett Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260303034847.13870-4-val@packett.cool Signed-off-by: Bjorn Andersson commit 8081dbb031ef733d200f9a6b2f34dae9543caac0 Merge: c69a586344758f 0221b14be8aae9 Author: Bjorn Andersson Date: Wed Mar 11 15:44:31 2026 -0500 Merge branch '20260303034847.13870-2-val@packett.cool' into clk-for-7.1 Merge the definition of MDSS resets for SM6115 and SM6125 to allow them to be made available in the DeviceTree branch. commit 0221b14be8aae98d687efab066133a114bea02d8 Author: Val Packett Date: Tue Mar 3 00:41:21 2026 -0300 dt-bindings: clock: qcom,dispcc-sm6125: Define MDSS resets Add the missing defines for MDSS resets, which are necessary to reset the display subsystem in order to avoid issues caused by state left over from the bootloader. While here, align comment style with other SoCs. Acked-by: Krzysztof Kozlowski Signed-off-by: Val Packett Link: https://lore.kernel.org/r/20260303034847.13870-3-val@packett.cool Signed-off-by: Bjorn Andersson commit a5c7b4fc8405846c613e7a01805a77d2e0cb75bd Author: Val Packett Date: Tue Mar 3 00:41:20 2026 -0300 dt-bindings: clock: qcom,sm6115-dispcc: Define MDSS resets Add the missing defines for MDSS resets, which are necessary to reset the display subsystem in order to avoid issues caused by state left over from the bootloader. While here, align comment style with other SoCs. Acked-by: Krzysztof Kozlowski Signed-off-by: Val Packett Link: https://lore.kernel.org/r/20260303034847.13870-2-val@packett.cool Signed-off-by: Bjorn Andersson commit c69a586344758f0d9cf0526d2a4b14fb56941b10 Author: Abel Vesa Date: Wed Mar 11 16:46:36 2026 +0200 clk: qcom: Add TCSR clock driver for Eliza Add the TCSR clock controller that provides the refclks on Eliza platform for PCIe, USB and UFS subsystems. Co-developed-by: Taniya Das Signed-off-by: Taniya Das Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260311-eliza-clocks-v6-6-453c4cf657a2@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3d356ab4a1ec2d9b208f0d0020c79855097b1fc7 Author: Taniya Das Date: Wed Mar 11 16:46:35 2026 +0200 clk: qcom: Add support for Global clock controller on Eliza Add support for Global clock controller for Eliza Qualcomm SoC. Signed-off-by: Taniya Das Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260311-eliza-clocks-v6-5-453c4cf657a2@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 76cbaa6557b1e685a268f08f892a35004bd4fdd2 Author: Taniya Das Date: Wed Mar 11 16:46:34 2026 +0200 clk: qcom: rpmh: Add support for Eliza rpmh clocks Add the RPMH clocks present in Eliza SoC. Signed-off-by: Taniya Das Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260311-eliza-clocks-v6-4-453c4cf657a2@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b671f2f351566679ad4289843c12b7a6127502cd Merge: 2851b6c6a42e22 b8a86146da5f33 Author: Bjorn Andersson Date: Wed Mar 11 15:31:22 2026 -0500 Merge branch '20260311-eliza-clocks-v6-1-453c4cf657a2@oss.qualcomm.com' into clk-for-7.1 Merge DeviceTree bindings for Eliza global, rpmh, and tcsr clock controllers through a topic branch, in case we need them in the DeviceTree branch as well. commit b8a86146da5f33a261ed69eb0eb85f23c9a57747 Author: Taniya Das Date: Wed Mar 11 16:46:33 2026 +0200 dt-bindings: clock: qcom-rpmhcc: Add RPMHCC for Eliza Update the documentation for RPMH clock controller for Eliza SoC. Signed-off-by: Taniya Das Acked-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260311-eliza-clocks-v6-3-453c4cf657a2@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b7518e0d1c0f4da4c0cc7940eed4679a5ff69a2e Author: Taniya Das Date: Wed Mar 11 16:46:32 2026 +0200 dt-bindings: clock: qcom: Document the Eliza TCSR Clock Controller Add bindings documentation for TCSR Clock Controller for Eliza SoC. Signed-off-by: Taniya Das Acked-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260311-eliza-clocks-v6-2-453c4cf657a2@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8e3a93e7a1a3a788109ba005edf6223d389ab04f Author: Taniya Das Date: Wed Mar 11 16:46:31 2026 +0200 dt-bindings: clock: qcom: document the Eliza Global Clock Controller Add bindings documentation for the Global Clock Controller on Qualcomm Eliza SoC. Reuse the Milos bindings schema since the controller resources are exactly the same, even though the controllers are incompatible between them. Signed-off-by: Taniya Das Reviewed-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20260311-eliza-clocks-v6-1-453c4cf657a2@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1e4a70e0f64f8362653e81ad6a32c508b555dd23 Merge: bc47b2e8239149 92f7ee408c23fc Author: Thomas Gleixner Date: Wed Mar 11 21:14:32 2026 +0100 Merge branch 'sched/hrtick' into timers/core Pick up the hrtick related hrtimer changes so other unrelated changes can be queued on top. commit 92f7ee408c23fcc074e4952fb6ffacdf3eb86b56 Author: Peter Zijlstra Date: Tue Mar 10 20:02:21 2026 +0100 hrtimer: Less agressive interrupt 'hang' handling When the hrtimer_interrupt needs to restart more than 3 times and still has expired timers, the interrupt is considered hung. To give the system a little time to recover, the hardware timer is programmed a little into the future. Prior to commit 288924384856 ("hrtimer: Re-arrange hrtimer_interrupt()"), this was relative to the amount of time spend serving the interrupt with a max of 100 msec. However, in order to simplify, and because this condition 'should' not happen, the timeout was unconditionally set to 100 msec. 'Obviously' there is a benchmark that hits this hard, by programming a ton of very short timers :-/ Since reprogramming is decoupled from the interrupt handling, the actual execution time is lost, however the code does track max_hang_time. Using that, rather than the 100 ms max restores performance. stress-ng --timeout 60 --times --verify --metrics --no-rand-seed --timermix 64 bogo ops/s 288924384856^1: 23715979.93 288924384856: 11550049.77 patched: 23361116.78 Additionally, Thomas noted that cpu_base->hang_detected should not be cleared until the next interrupt, such that __hrtimer_reprogram() won't undo the extra delay. Fixes: 288924384856 ("hrtimer: Re-arrange hrtimer_interrupt()") Reported-by: kernel test robot Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311121500.GF652779@noisy.programming.kicks-ass.net Closes: https://lore.kernel.org/oe-lkp/202603102229.74b9dee4-lkp@intel.com commit c43c3b8fb39a3cc96f0cea9ca30e3e39ec696490 Author: Thomas Weißschuh Date: Mon Feb 23 22:16:29 2026 +0100 EDAC/device: Drop unused macro to_edacdev_attr() This macro is unused, drop it. Signed-off-by: Thomas Weißschuh Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260223-sysfs-const-edac-v1-2-3ff0b87249e7@weissschuh.net commit 04beb11c5772efc943a033f87770d41086de90ca Author: Thomas Weißschuh Date: Mon Feb 23 22:16:28 2026 +0100 EDAC/altera: Drop unused field eccmgr_sysfs_attr This field is unused, drop it. Signed-off-by: Thomas Weißschuh Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260223-sysfs-const-edac-v1-1-3ff0b87249e7@weissschuh.net commit 6be4ca0ab3a2363a850787079f2342d41d377487 Author: Dean Luick Date: Mon Mar 9 16:44:59 2026 -0400 RDMA/rdmavt: Add driver mmap callback Add a reserved range and a driver callback to allow the driver to have custom mmaps. Generated mmap offsets are cookies and are not related to the size of the mmap. Advance the mmap offset by the minimum, PAGE_SIZE, rather than the size of the mmap. Signed-off-by: Dean Luick Signed-off-by: Dennis Dalessandro Link: https://patch.msgid.link/177308909972.1279894.15543003811821875042.stgit@awdrv-04.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit 0fed679e0862b3abd706041be3cc7620318fbee8 Author: Dean Luick Date: Mon Mar 9 16:44:54 2026 -0400 RDMA/rdmavt: Correct multi-port QP iteration When finding special QPs, the iterator makes an incorrect port index calculation. Fix the calculation. Signed-off-by: Dean Luick Signed-off-by: Dennis Dalessandro Link: https://patch.msgid.link/177308909468.1279894.5073405674644246445.stgit@awdrv-04.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit 679eb25de4ee537f209c6d81f7808ad65b03bbbc Author: Dean Luick Date: Wed Mar 11 13:28:03 2026 -0400 RDMA/rdmavt: Add ucontext alloc/dealloc passthrough Add a private data pointer to the ucontext structure and add per-client pass-throughs. Signed-off-by: Dean Luick Signed-off-by: Dennis Dalessandro Link: https://patch.msgid.link/177325008318.52243.7367786996925601681.stgit@awdrv-04.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit 786ee8ddf47a2333aa5ffd16f68a3c0e9c7d1fbf Author: Dean Luick Date: Mon Mar 9 16:44:44 2026 -0400 RDMA/OPA: Update OPA link speed list Update the list of available link speeds. Fix comments. Signed-off-by: Dean Luick Signed-off-by: Dennis Dalessandro Link: https://patch.msgid.link/177308908456.1279894.16723781060261360236.stgit@awdrv-04.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit 46b87c37ca4f54a630d988cb24a1aa9a2e5ba1dc Author: Krzysztof Kozlowski Date: Wed Mar 11 16:35:49 2026 +0100 ASoC: dt-bindings: ti,tas2770: Switch to undeprecated reset-gpios GPIOs with "gpio" suffix were long time ago deprecated, thus "reset-gpios" should be used. Linux kernel supports both, thus this only documents desired choice of ABI. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260311153548.94265-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown commit 56e2ef8f5f9161d08d45656d373da83d4a789be1 Author: Ben Dooks Date: Mon Mar 9 17:10:12 2026 +0000 efi: libstub: fix type of fdt 32 and 64bit variables In update_fdt_memmap() an update_fdt() the fdt values should be of the fd32_t and fdt64_t types. Make the relevant changes to remove the following sparse warnings: drivers/firmware/efi/libstub/fdt.c:97:19: warning: incorrect type in assignment (different base types) drivers/firmware/efi/libstub/fdt.c:97:19: expected unsigned long long [usertype] fdt_val64 drivers/firmware/efi/libstub/fdt.c:97:19: got restricted __be64 [usertype] drivers/firmware/efi/libstub/fdt.c:157:19: warning: incorrect type in assignment (different base types) drivers/firmware/efi/libstub/fdt.c:157:19: expected unsigned long long [usertype] fdt_val64 drivers/firmware/efi/libstub/fdt.c:157:19: got restricted __be64 [usertype] drivers/firmware/efi/libstub/fdt.c:163:19: warning: incorrect type in assignment (different base types) drivers/firmware/efi/libstub/fdt.c:163:19: expected unsigned int [usertype] fdt_val32 drivers/firmware/efi/libstub/fdt.c:163:19: got restricted __be32 [usertype] drivers/firmware/efi/libstub/fdt.c:169:19: warning: incorrect type in assignment (different base types) drivers/firmware/efi/libstub/fdt.c:169:19: expected unsigned int [addressable] [usertype] fdt_val32 drivers/firmware/efi/libstub/fdt.c:169:19: got restricted __be32 [usertype] drivers/firmware/efi/libstub/fdt.c:175:19: warning: incorrect type in assignment (different base types) drivers/firmware/efi/libstub/fdt.c:175:19: expected unsigned int [addressable] [usertype] fdt_val32 drivers/firmware/efi/libstub/fdt.c:175:19: got restricted __be32 [usertype] Signed-off-by: Ben Dooks Signed-off-by: Ard Biesheuvel commit 77dd8adabbc8ff845177b460de48b9d2cd579966 Author: Ard Biesheuvel Date: Mon Mar 9 13:52:22 2026 +0100 efi: Drop unused efi_range_is_wc() function efi_range_is_wc() has no callers, so remove it. Reviewed-by: Ilias Apalodimas Signed-off-by: Ard Biesheuvel commit f66d6cc6891e41be96380261943837b1909107b3 Author: Mario Limonciello (AMD) Date: Wed Mar 11 10:18:42 2026 -0700 accel/amdxdna: Support sensors for column utilization The AMD PMF driver provides realtime column utilization (npu_busy) metrics for the NPU. Extend the DRM_IOCTL_AMDXDNA_GET_INFO sensor query to expose these metrics to userspace. Add AMDXDNA_SENSOR_TYPE_COLUMN_UTILIZATION to the sensor type enum and update aie2_get_sensors() to return both the total power and up to 8 column utilization sensors if the user buffer permits. Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Lizhi Hou [lizhi: support legacy tool which uses small buffer. checkpatch cleanup] Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260311171842.473453-1-lizhi.hou@amd.com commit f3bffef037fb4aedd6c0b7d066ad4cdcda75409a Author: Lizhi Hou Date: Sat Feb 28 00:10:57 2026 -0600 accel/amdxdna: Add IOCTL to retrieve realtime NPU power estimate The AMD PMF driver provides an interface to obtain realtime power estimates for the NPU. Expose this information to userspace through a new DRM_IOCTL_AMDXDNA_GET_INFO parameter, allowing applications to query the current NPU power level. Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Shyam Sundar S K (Update comment to indicate power and utilization) Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260228061109.361239-2-superm1@kernel.org commit efa3382a5a39ee9aee98bcf13e66fe91413aef0c Author: Mario Limonciello (AMD) Date: Sat Feb 28 18:50:08 2026 -0600 accel/amdxdna: Import AMD_PMF namespace The amdxdna driver uses amd_pmf_get_npu_data() which is exported in the AMD_PMF namespace. Import the AMD_PMF namespace. Reviewed-by: Lizhi Hou Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260301005028.367618-1-superm1@kernel.org commit 4d613fb1ea0516e1f69d3a4ebfbf2572d5da5368 Author: Huisong Li Date: Wed Mar 11 14:50:38 2026 +0800 ACPI: processor: idle: Remove redundant static variable and rename cstate check function The function acpi_processor_cstate_first_run_checks() is currently called only once during initialization in acpi_processor_register_idle_driver(). Since its execution is already limited by the caller's lifecycle, the internal static 'first_run' variable is redundant and can be safely removed. Additionally, the current function name is no longer descriptive of its behavior, so rename the function to acpi_processor_update_max_cstate() to better reflect its actual purpose. Signed-off-by: Huisong Li Link: https://patch.msgid.link/20260311065038.4151558-4-lihuisong@huawei.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 1f23194c8b8208bf3a43beb6c97d4c843197b6f6 Author: Huisong Li Date: Wed Mar 11 14:50:37 2026 +0800 ACPI: processor: idle: Move max_cstate update out of the loop The acpi_processor_cstate_first_run_checks() function, which updates max_cstate on certain platforms, only needs to be executed once. Move this call outside of the loop to avoid redundant executions. Signed-off-by: Huisong Li Link: https://patch.msgid.link/20260311065038.4151558-3-lihuisong@huawei.com Signed-off-by: Rafael J. Wysocki commit db19103ea847ed139da59a2fb71773081c12cd40 Author: Huisong Li Date: Wed Mar 11 14:50:36 2026 +0800 ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init The function acpi_processor_cstate_first_run_checks() is responsible for updating max_cstate and performing initial hardware validation. Currently, this function is invoked within acpi_processor_power_init(). However, the initialization flow already ensures this is called during acpi_processor_register_idle_driver(). Therefore, the call in acpi_processor_power_init() is redundant and effectively performs no work, so remove it. Signed-off-by: Huisong Li Link: https://patch.msgid.link/20260311065038.4151558-2-lihuisong@huawei.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit d7bd8cf0b348d3edae7bee33e74a32b21668b181 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Tue Mar 10 17:40:39 2026 +0000 ima_fs: Correctly create securityfs files for unsupported hash algos ima_tpm_chip->allocated_banks[i].crypto_id is initialized to HASH_ALGO__LAST if the TPM algorithm is not supported. However there are places relying on the algorithm to be valid because it is accessed by hash_algo_name[]. On 6.12.40 I observe the following read out-of-bounds in hash_algo_name: ================================================================== BUG: KASAN: global-out-of-bounds in create_securityfs_measurement_lists+0x396/0x440 Read of size 8 at addr ffffffff83e18138 by task swapper/0/1 CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.40 #3 Call Trace: dump_stack_lvl+0x61/0x90 print_report+0xc4/0x580 ? kasan_addr_to_slab+0x26/0x80 ? create_securityfs_measurement_lists+0x396/0x440 kasan_report+0xc2/0x100 ? create_securityfs_measurement_lists+0x396/0x440 create_securityfs_measurement_lists+0x396/0x440 ima_fs_init+0xa3/0x300 ima_init+0x7d/0xd0 init_ima+0x28/0x100 do_one_initcall+0xa6/0x3e0 kernel_init_freeable+0x455/0x740 kernel_init+0x24/0x1d0 ret_from_fork+0x38/0x80 ret_from_fork_asm+0x11/0x20 The buggy address belongs to the variable: hash_algo_name+0xb8/0x420 Memory state around the buggy address: ffffffff83e18000: 00 01 f9 f9 f9 f9 f9 f9 00 01 f9 f9 f9 f9 f9 f9 ffffffff83e18080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffff83e18100: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 05 f9 f9 ^ ffffffff83e18180: f9 f9 f9 f9 00 00 00 00 00 00 00 04 f9 f9 f9 f9 ffffffff83e18200: 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9 ================================================================== Seems like the TPM chip supports sha3_256, which isn't yet in tpm_algorithms: tpm tpm0: TPM with unsupported bank algorithm 0x0027 That's TPM_ALG_SHA3_256 == 0x0027 from "Trusted Platform Module 2.0 Library Part 2: Structures", page 51 [1]. See also the related U-Boot algorithms update [2]. Thus solve the problem by creating a file name with "_tpm_alg_" postfix if the crypto algorithm isn't initialized. This is how it looks on the test machine (patch ported to v6.12 release): # ls -1 /sys/kernel/security/ima/ ascii_runtime_measurements ascii_runtime_measurements_tpm_alg_27 ascii_runtime_measurements_sha1 ascii_runtime_measurements_sha256 binary_runtime_measurements binary_runtime_measurements_tpm_alg_27 binary_runtime_measurements_sha1 binary_runtime_measurements_sha256 policy runtime_measurements_count violations [1]: https://trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-2.0-Library-Part-2-Version-184_pub.pdf [2]: https://lists.denx.de/pipermail/u-boot/2024-July/558835.html Fixes: 9fa8e7625008 ("ima: add crypto agility support for template-hash algorithm") Signed-off-by: Dmitry Safonov Cc: Enrico Bravi Cc: Silvia Sisinni Cc: Roberto Sassu Cc: Mimi Zohar Reviewed-by: Roberto Sassu Tested-by: Roberto Sassu Link: https://github.com/linux-integrity/linux/issues/14 Signed-off-by: Mimi Zohar commit 07d40fb889109cb69e1e607a652dc060c98f2fc1 Author: Gustavo Sousa Date: Tue Mar 3 17:46:17 2026 -0300 drm/xe/pat: Extract gt_pta_entry() Avoid code duplication by extracting the logic for selection of the correct PAT_PTA entry for a GT into function gt_pta_entry() and using that function whenever necessary. Reviewed-by: Dnyaneshwar Bhadane Link: https://patch.msgid.link/20260303-pat-gt_pta_entry-v1-1-0dee8e1e7bd9@intel.com Signed-off-by: Gustavo Sousa commit 7a9419ab42699fd3d4c857ef81ae097d8d8d5899 Author: Christian König Date: Tue Jan 20 13:09:52 2026 +0100 drm/amdgpu: revert to old status lock handling v4 It turned out that protecting the status of each bo_va with a spinlock was just hiding problems instead of solving them. Revert the whole approach, add a separate stats_lock and lockdep assertions that the correct reservation lock is held all over the place. This not only allows for better checks if a state transition is properly protected by a lock, but also switching back to using list macros to iterate over the state of lists protected by the dma_resv lock of the root PD. v2: re-add missing check v3: split into two patches v4: re-apply by fixing holding the VM lock at the right places. Signed-off-by: Christian König Reviewed-by: Alex Deucher Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit fae5984296b981c8cc3acca35b701c1f332a6cd8 Author: Mario Limonciello Date: Tue Mar 10 11:58:22 2026 -0500 drm/amd: Set num IP blocks to 0 if discovery fails If discovery has failed for any reason (such as no support for a block) then there is no need to unwind all the IP blocks in fini. In this condition there can actually be failures during the unwind too. Reset num_ip_blocks to zero during failure path and skip the unnecessary cleanup path. Suggested-by: Lijo Lazar Reviewed-by: Lijo Lazar Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit da16822ce5c32b5aca848eaea521936d4410d48c Author: Lijo Lazar Date: Mon Mar 9 15:17:00 2026 +0530 drm/amd/pm: Fix xgmi max speed reporting Fix XGMI max bitrate/width reporting on SMUv13.0.12 SOCs. The data format got changed when moved to static table from dynamic metrics table. Fixes: 1bec2f270766 ("drm/amd/pm: Fetch SMUv13.0.12 xgmi max speed/width") Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 418b4e397570f1b0ffb6d5c8aa0872bc33071d49 Author: Le Ma Date: Mon Mar 2 15:43:20 2026 +0800 drm/amdgpu: fix array out of bounds accesses for mes sw_fini The mes.fw[] is per-pipe resource shared accross xcc inst. And enlarge hung_queue array to max inst_pipes. Signed-off-by: Le Ma Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit cbbf33396c5b4b54e28e9865a28090eca7a13173 Author: Likun Gao Date: Fri Feb 27 15:16:09 2026 +0800 drm/amdgpu: fix sysfs ip base addr with 64bit Correct the base addr value shown on sysfs with ignore reg_base_64, since the base_addr value have been over write when discovery_init. Signed-off-by: Likun Gao Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit d3f8a9eba034d4c223d516a5f31a011b428a7c21 Author: Likun Gao Date: Sat Feb 14 04:22:56 2026 +0800 drm/amdgpu: disable rlc fw info print Disable to print RLC v2_5 related firmware information by default. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 57f765a7ef090c31a60b3e9b75236bb652c41dba Author: Likun Gao Date: Thu Feb 26 13:11:27 2026 +0800 drm/amdgpu: change sdma doorbell size for soc v1 Change SDMA doorbel size to 14 per SDMA engine. Signed-off-by: Likun Gao Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit c52b6c3709258760bd0950a75e02195811203da1 Author: Likun Gao Date: Fri Feb 6 09:09:47 2026 +0800 drm/amdgpu: correct SDMA instance number for soc v1_0 Calculate sdma instance number according to xcc_mask and num_inst_per_xcc, and correct adev->sdma.sdma_mask according to totally sdma instance number. Signed-off-by: Likun Gao Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 1394a4926f4bcff0dc6ac6deea5beeb2844297f0 Author: Hawking Zhang Date: Wed Jan 28 18:53:40 2026 +0800 drm/amdgpu: fix shift-out-of-bounds when updating umc active mask UMC node_inst_num can exceed 32, causing (1 << node_inst_num) to shift a 32-bit int out of bounds Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit 68af620c9a370863e973fa27f94b635a90b8a045 Author: Le Ma Date: Fri Dec 12 18:43:47 2025 +0800 drm/amdgpu: bypass IMU ucode loading for MP0 15.0.8 For MP0 15.0.8, IMU ucode is part of IFWI and ASP would load it by default. Signed-off-by: Le Ma Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 3ebe58535898cb0a842390ecde79b5bc63a5b777 Author: Le Ma Date: Tue Dec 2 19:46:36 2025 +0800 drm/amdgpu: update GFX CGCG/LS flags for gfx 12.1 Update GFX CGCG flags and fix num_xcc assignment Signed-off-by: Le Ma Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit d49f8adcbcaaeef1c4081d93fd9c35b018ab0652 Author: Asad Kamal Date: Tue Dec 2 10:54:59 2025 +0800 drm/amd/amdgpu: Disable reset on init for soc_v1_0 Return false from soc_v1_0_reset_on_init as psp is loaded with ifwi and sol register will be non zero on first load itself Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit eb737fb303dd73ceb0f646fc2e696595e576056f Author: Asad Kamal Date: Tue Nov 25 01:42:42 2025 +0800 drm/amdgpu: Add default reset method for soc_v1_0 Add mode2 as default reset method for soc_v1_0 v2: Remove unnecessary overrides while selecting reset method (Lijo) v4: Add dev_warn_once (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 6952ee37fad0fbccc98266ac61fce33ecd9d7338 Author: Alex Deucher Date: Tue Nov 18 17:41:02 2025 -0500 drm/amdgpu: use common defines for GMC 12.1 HUB faults Use proper definitions rather than a number. Signed-off-by: Alex Deucher commit 41c61e60f82d55e9a3a3f3f04d192d732230a91c Author: Hawking Zhang Date: Tue Dec 2 21:36:19 2025 +0800 drm/amdgpu: Handle IH v7_1 reg offset differences IH v7_1 changes the offsets of some registers relative to IH v7_0. Introduce IH v7_1-specific register access Signed-off-by: Hawking Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 50808826a64b4957b7088c789e539dd0a75a1560 Author: Likun Gao Date: Fri Jul 26 09:33:17 2024 +0800 drm/amdgpu: fix DF NULL pointer issue for soc24 If DF function not initialized, NULL pointer issue will happen on soc24. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 0cdd5a0d68b452bf2e34c018b39ad454b979bd65 Author: Likun Gao Date: Wed Jan 21 15:03:25 2026 +0800 drm/amdgpu: add support for lsdma v7_1 Add support for LSDMA v7_1_0. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 6d215051d272f749f5a31475d11ec1c9968bcca5 Author: Likun Gao Date: Wed Jan 21 14:56:54 2026 +0800 drm/amdgpu: Add lsdma v7_1_0 ip headers Add header files for lsdma v7_1_0 register offsets and shift masks Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit c81761f2334f479ac865ab631e5166c15227adde Author: Hawking Zhang Date: Mon Feb 2 03:32:52 2026 +0800 drm/amdgpu: Use memcpy to update IPD table for sriov guest On some hardware configuration, sriov guests cannot access mm_index and mm_data. Update the IPD table via memcpy in these cases Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit 01bdc7e219c4e10166a2eb4642e9e55af33b8ff5 Author: Hawking Zhang Date: Tue Feb 10 04:08:54 2026 +0800 drm/amdgpu: New interface to get IP discovery binary v3 Implement a driver path to read the IP discovery binary offset and size from DRIVER_SCRATCH registers BIOS signals usage by setting a feature flag that instructs the driver to use this method. Otherwise, fallback to legacy approach. v2: Simplify discovery offset/size retrieval in get_tmr_info v3: Update get_tmr_info to cover discovery offset and size retrieval for both bare-metal and sriov Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit 47ab777c16c71ba033325593cd833bded65f5943 Author: Likun Gao Date: Thu Mar 5 14:34:56 2026 -0500 drm/amdgpu/discovery: use common function to check discovery table Use an common function to check the validation of discovery table. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit d0c647a6aae2ce577372594a176c82733e1ed267 Author: Likun Gao Date: Fri Nov 7 11:59:05 2025 +0800 drm/amdgpu/discovery: support new discovery binary header Support for new IP discovery binary header version 2. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit c24afed7de9ecce341825d8ab55a43a254348b33 Author: Philip Yang Date: Tue Dec 9 15:13:23 2025 -0500 drm/amdkfd: Unreserve bo if queue update failed Error handling path should unreserve bo then return failed. Fixes: 305cd109b761 ("drm/amdkfd: Validate user queue update") Signed-off-by: Philip Yang Reviewed-by: Alex Sierra Signed-off-by: Alex Deucher commit 78aad33088dd7fc3e222d387a272b2e50dec3fb9 Author: Taimur Hassan Date: Fri Feb 27 17:40:05 2026 -0500 drm/amd/display: Promote DC to 3.2.373 This version brings along the following updates: - [FW Promotion] Release 0.1.50.0 - Sync DCN42 with DC 3.2.373 - Add DML support for dcn42 - Enable dcn42 DC clk_mgr - Clean up unused code - Add back missing memory type in array - Fix compile warnings in dml2_0 - Check for S0i3 to be done before DCCG init on DCN21 - Add documentation and cleanup DMUB HW lock manager - Add new types to replay config - Fix HWSS v3 fast path determination - Add missing DCCG register entries for DCN20-DCN316 - Add ESD detection for replay recovery - Update underflow detection - Add COLOR_ENCODING/COLOR_RANGE to overlay planes - Add NV12/P010 formats to primary plane - Set chroma taps to 1 if luma taps are 1 - Add min clock init for DML21 mode programming - Return early from vesa replay enable function - Clean up NULL pointer warnings in dml2 Acked-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 9e9fbebde4a42268a39e4d9355fd038313f5da64 Author: Taimur Hassan Date: Fri Feb 27 16:35:12 2026 -0500 drm/amd/display: [FW Promotion] Release 0.1.50.0 [WHAT] Introduce DMUB BOOT_TIME_CRC_INIT command. Acked-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit e56e3cff2a1bb29545ddbec562e76c0419363a40 Author: Roman Li Date: Thu Mar 5 12:56:09 2026 -0500 drm/amd/display: Sync dcn42 with DC 3.2.373 This patch provides a bulk merge to align driver support for DCN42 with Display Core version 3.2.373. It includes upgrade for: - clk_mgr - dml2/dml21 - optc - hubp - mpc - optc - hwseq Acked-by: Aurabindo Pillai Signed-off-by: Roman Li Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 6e5b72ac22ecedf29d300a6e253296f3a661f7fb Author: Roman Li Date: Tue Mar 3 12:00:55 2026 -0500 drm/amd/display: Add DML support for dcn42 DML support for DCN 4.2 Acked-by: Aurabindo Pillai Signed-off-by: Roman Li Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 5b880e37a89feda5185cd1875b9d1d213dc731d1 Author: Roman Li Date: Fri Feb 20 16:48:14 2026 -0500 drm/amd/display: Enable dcn42 DC clk_mgr Add support for DCN 4.2 clock manager. Acked-by: Aurabindo Pillai Signed-off-by: Roman Li Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8c993dad415191e76169ca4b42eb00a8f8f7865a Author: Clay King Date: Fri Feb 27 12:34:34 2026 -0500 drm/amd/display: Clean up unused code [WHAT] Silence warning by cleaning up unused code. Reviewed-by: Dillon Varone Signed-off-by: Clay King Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 41a5b6239fe8d437927d03f56816c7f167ac30dc Author: Tom Chung Date: Thu Feb 26 16:16:19 2026 +0800 drm/amd/display: Add back missing memory type in array [WHY & HOW] Add back some missing memory type in window_memory_type. It should be aligned with enum dmub_window_id. Reviewed-by: Aurabindo Pillai Signed-off-by: Tom Chung Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit a28076422b0b1dc640471e4905d9c3a360b10a08 Author: Gaghik Khachatrian Date: Thu Feb 26 11:06:17 2026 -0500 drm/amd/display: Fix compile warnings in dml2_0 Fix static analysis warnings by ensuring swath size temporaries are initialized before use. No functional change intended. Reviewed-by: Dillon Varone Signed-off-by: Gaghik Khachatrian Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c61eda434336cf2c033aa35efdc9a08b31d2fdfa Author: Ivan Lipski Date: Wed Feb 25 21:48:36 2026 -0500 drm/amd/display: Check for S0i3 to be done before DCCG init on DCN21 [WHY] On DCN21, dccg2_init() is called in dcn10_init_hw() before bios_golden_init(). During S0i3 resume, BIOS sets MICROSECOND_TIME_BASE_DIV to 0x00120464 as a marker. dccg2_init() overwrites this to 0x00120264, causing dcn21_s0i3_golden_init_wa() to misdetect the state and skip golden init. Eventually during the resume sequence, a flip timeout occurs. [HOW] Skip DCCG on dccg2_is_s0i3_golden_init_wa_done() on DCN21. Fixes: 4c595e75110e ("drm/amd/display: Migrate DCCG registers access from hwseq to dccg component.") Reviewed-by: Aurabindo Pillai Signed-off-by: Ivan Lipski Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit ca0f39a369c5f927c3d004e63a5a778b08a9df94 Author: Varun R Mallya Date: Fri Mar 6 03:51:32 2026 +0530 selftests/bpf: Fix const qualifier warning in fexit_bpf2bpf.c Building selftests with clang 23.0.0 (6fae863eba8a72cdd82f37e7111a46a70be525e0) triggers the following error: tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c:117:12: error: assigning to 'char *' from 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers] The variable `tgt_name` is declared as `char *`, but it stores the result of strstr(prog_name[i], "/"). Since `prog_name[i]` is a `const char *`, the returned pointer should also be treated as const-qualified. Update `tgt_name` to `const char *` to match the type of the underlying string and silence the compiler warning. Signed-off-by: Varun R Mallya Signed-off-by: Andrii Nakryiko Acked-by: Menglong Dong Link: https://lore.kernel.org/bpf/20260305222132.470700-1-varunrmallya@gmail.com commit ce6a2badf58170bcf73489cd73981bb5775c1e22 Author: Vincent Donnefort Date: Wed Mar 11 16:49:56 2026 +0000 KVM: arm64: Fix out-of-tree build for nVHE/pKVM tracing simple_ring_buffer.c is located in the source tree and isn't duplicated to objtree. Fix its include path. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260311164956.1424119-1-vdonnefort@google.com Signed-off-by: Marc Zyngier commit c02e0ab8aeeca716948d06a88993c470e4fbe426 Author: Sun Jian Date: Mon Mar 9 18:44:48 2026 +0800 selftests/bpf: Skip livepatch test when prerequisites are missing livepatch_trampoline relies on livepatch sysfs and livepatch-sample.ko. When CONFIG_LIVEPATCH is disabled or the samples module isn't built, the test fails with ENOENT and causes false failures in minimal CI configs. Skip the test when livepatch sysfs or the sample module is unavailable. Also avoid writing to livepatch sysfs when it's not present. Signed-off-by: Sun Jian Acked-by: Jiri Olsa Link: https://lore.kernel.org/r/20260309104448.817401-1-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov commit aa181c7d642cf10c31d53f73754795b6e5d88785 Author: Sun Jian Date: Fri Mar 6 16:33:30 2026 +0800 selftests/bpf: drop serial restriction Patch 1/2 added PID filtering to the probe_user BPF program to avoid cross-test interference from the global connect() hooks. With the interference removed, drop the serial_ prefix and remove the stale TODO comment so the test can run in parallel. Tested: ./test_progs -t probe_user -v ./test_progs -j$(nproc) -t probe_user Signed-off-by: Sun Jian Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260306083330.518627-2-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov commit 70ce840d5f5bc7ae8a467c34a8fc15c1162ffee7 Author: Sun Jian Date: Fri Mar 6 16:33:29 2026 +0800 selftests/bpf: filter by pid to avoid cross-test interference The test installs a kprobe on __sys_connect and checks that bpf_probe_write_user() can modify the syscall argument. However, any concurrent thread in any other test that calls connect() will also trigger the kprobe and have its sockaddr silently overwritten, causing flaky failures in unrelated tests. Constrain the hook to the current test process by filtering on a PID stored as a global variable in .bss. Initialize the .bss value from user space before bpf_object__load() using bpf_map__set_initial_value(), and validate the bss map value size to catch layout mismatches. No new map is introduced and the test keeps the existing non-skeleton flow. Signed-off-by: Sun Jian Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260306083330.518627-1-sun.jian.kdev@gmail.com Signed-off-by: Alexei Starovoitov commit 900b7cc73ce9e6a1539d43f5c060c953f7eaf83b Author: Viktor Malik Date: Fri Mar 6 11:16:28 2026 +0100 selftests/bpf: Speed up module_attach test The module_attach test contains subtests which check that unloading a module while there are BPF programs attached to its functions is not possible because the module is still referenced. The problem is that the test calls the generic unload_module() helper function which is used for module cleanup after test_progs terminate and tries to wait until all module references are released. This unnecessarily slows down the module_attach subtests since each unsuccessful call to unload_module() takes about 1 second. Introduce try_unload_module() which takes the number of retries as a parameter. Make unload_module() call it with the currently used amount of 10000 retries but call it with just 1 retry from module_attach tests as it is always expected to fail. This speeds up the module_attach() test significantly. Before: # time ./test_progs -t module_attach [...] Summary: 1/14 PASSED, 0 SKIPPED, 0 FAILED real 0m5.011s user 0m0.293s sys 0m0.108s After: # time ./test_progs -t module_attach [...] Summary: 1/14 PASSED, 0 SKIPPED, 0 FAILED real 0m0.350s user 0m0.197s sys 0m0.063s Signed-off-by: Viktor Malik Reviewed-by: Alan Maguire Tested-by: Alan Maguire Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260306101628.3822284-1-vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit 48863104d2e1ea70a68cbd8d87c0d75270f3c6e5 Author: Richard Fitzgerald Date: Wed Mar 11 14:21:53 2026 +0000 ASoC: cs35l56: Support clock stop mode 1 if enabled in ACPI Report the ability to support SoundWire clock-stop mode 1 if this is enabled in ACPI. Mode 1 allows the device to lose state, so it can reduce power consumption in clock-stop. Also add the necessary handling to wait for re-enumeration on resume. This does not use sdw_slave_read_prop(), because that also fills in other properties from ACPI that were not previously set by the driver and this has been observed to break some systems. Instead, the "mipi-sdw-clock-stop-mode1-supported" property is checked directly. When a SoundWire peripheral has been put into clock-stop mode 1 it must be re-enumerated after the clock is restarted. A new flag sdw_in_clock_stop_1 is set to true in cs35l56_sdw_clk_stop() if the SoundWire core notifies that it is entering clock-stop 1. cs35l56_sdw_handle_unattach() will wait for re-enumeration if sdw_in_clock_stop_1 is true. sdw_in_clock_stop_1 will be reset to false when an ATTACH notification is received in cs35l56_sdw_update_status(). Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260311142153.2201761-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 679330e4a7af1d102d035b13b2b9d41bc1dfbbf7 Author: João Paredes Date: Mon Mar 2 02:55:39 2026 +0000 JFS: always load filesystem UUID during mount The filesystem UUID was only being loaded into super_block sb when an external journal device was in use. When mounting without an external journal, the UUID remained unset, which prevented the computation of a filesystem ID (fsid), which could be confirmed via `stat -f -c "%i"` and thus user space could not use fanotify correctly. A missing filesystem ID causes fanotify to return ENODEV when marking the filesystem for events like FAN_CREATE, FAN_DELETE, FAN_MOVED_TO, and FAN_MOVED_FROM. As a result, applications relying on fanotify could not monitor these events on JFS filesystems without an external journal. Moved the UUID initialization so it is always performed during mount, ensuring the superblock UUID is consistently available. Signed-off-by: João Paredes Signed-off-by: Dave Kleikamp commit ca5848ae87d24886a7886f5a22278bd4045c15f8 Author: Helen Koike Date: Fri Feb 27 15:11:50 2026 -0300 jfs: hold LOG_LOCK on umount to avoid null-ptr-deref write_special_inodes() function iterate through the log->sb_list and access the sbi fields, which can be set to NULL concurrently by umount. Fix concurrency issue by holding LOG_LOCK and checking for NULL. Reported-by: syzbot+e14b1036481911ae4d77@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e14b1036481911ae4d77 Signed-off-by: Helen Koike Signed-off-by: Dave Kleikamp commit b15e4310633f90072d66cc9b6692acbf6b4d7d00 Author: Edward Adam Davis Date: Tue Dec 16 21:57:51 2025 +0800 jfs: Set the lbmDone flag at the end of lbmIODone In lbmRead(), the I/O event waited for by wait_event() finishes before it goes to sleep, and the lbmIODone() prematurely sets the flag to lbmDONE, thus ending the wait. This causes wait_event() to return before lbmREAD is cleared (because lbmDONE was set first), the premature return of wait_event() leads to the release of lbuf before lbmIODone() returns, thus triggering the use-after-free vulnerability reported in [1]. Moving the operation of setting the lbmDONE flag to after clearing lbmREAD in lbmIODone() avoids the use-after-free vulnerability reported in [1]. [1] BUG: KASAN: slab-use-after-free in rt_spin_lock+0x88/0x3e0 kernel/locking/spinlock_rt.c:56 Call Trace: blk_update_request+0x57e/0xe60 block/blk-mq.c:1007 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1169 blk_complete_reqs block/blk-mq.c:1244 [inline] blk_done_softirq+0x10a/0x160 block/blk-mq.c:1249 Allocated by task 6101: lbmLogInit fs/jfs/jfs_logmgr.c:1821 [inline] lmLogInit+0x3d0/0x19e0 fs/jfs/jfs_logmgr.c:1269 open_inline_log fs/jfs/jfs_logmgr.c:1175 [inline] lmLogOpen+0x4e1/0xfa0 fs/jfs/jfs_logmgr.c:1069 jfs_mount_rw+0xe9/0x670 fs/jfs/jfs_mount.c:257 jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532 Freed by task 6101: kfree+0x1bd/0x900 mm/slub.c:6876 lbmLogShutdown fs/jfs/jfs_logmgr.c:1864 [inline] lmLogInit+0x1137/0x19e0 fs/jfs/jfs_logmgr.c:1415 open_inline_log fs/jfs/jfs_logmgr.c:1175 [inline] lmLogOpen+0x4e1/0xfa0 fs/jfs/jfs_logmgr.c:1069 jfs_mount_rw+0xe9/0x670 fs/jfs/jfs_mount.c:257 jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532 Reported-by: syzbot+1d38eedcb25a3b5686a7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1d38eedcb25a3b5686a7 Signed-off-by: Edward Adam Davis Signed-off-by: Dave Kleikamp commit 3c778ec882084626ac915d6c6ec88aff87b82221 Author: Yun Zhou Date: Sun Nov 9 15:58:18 2025 +0800 jfs: fix corrupted list in dbUpdatePMap This patch resolves the "list_add corruption. next is NULL" Oops reported by syzkaller in dbUpdatePMap(). The root cause is uninitialized synclist nodes in struct metapage and struct TxBlock, plus improper list node removal using list_del() (which leaves nodes in an invalid state). This fixes the following Oops reported by syzkaller. list_add corruption. next is NULL. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:28! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 122 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:__list_add_valid_or_report+0xc3/0x130 lib/list_debug.c:27 Code: 4c 89 f2 48 89 d9 e8 0c 88 a4 fc 90 0f 0b 48 c7 c7 20 de 3d 8b e8 fd 87 a4 fc 90 0f 0b 48 c7 c7 c0 de 3d 8b e8 ee 87 a4 fc 90 <0f> 0b 48 89 df e8 13 c3 7d fd 42 80 7c 2d 00 00 74 08 4c 89 e7 e8 RSP: 0018:ffffc9000395fa20 EFLAGS: 00010246 RAX: 0000000000000022 RBX: 0000000000000000 RCX: 270c5dfadb559700 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00000000000f0000 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff5200072bee9 R12: 0000000000000000 R13: dffffc0000000000 R14: 0000000000000004 R15: 1ffff92000632266 FS: 0000000000000000(0000) GS:ffff888126ef9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056341fdb86c0 CR3: 0000000040a18000 CR4: 00000000003526f0 Call Trace: __list_add_valid include/linux/list.h:96 [inline] __list_add include/linux/list.h:158 [inline] list_add include/linux/list.h:177 [inline] dbUpdatePMap+0x7e4/0xeb0 fs/jfs/jfs_dmap.c:577 txAllocPMap+0x57d/0x6b0 fs/jfs/jfs_txnmgr.c:2426 txUpdateMap+0x81e/0x9c0 fs/jfs/jfs_txnmgr.c:2364 txLazyCommit fs/jfs/jfs_txnmgr.c:2665 [inline] jfs_lazycommit+0x3f1/0xa10 fs/jfs/jfs_txnmgr.c:2734 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Modules linked in: ---[ end trace 0000000000000000 ]--- Reported-by: syzbot+4d0a0feb49c5138cac46@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4d0a0feb49c5138cac46 Tested-by: syzbot+4d0a0feb49c5138cac46@syzkaller.appspotmail.com Signed-off-by: Yun Zhou Signed-off-by: Dave Kleikamp commit cce219b203c4b9cb445e910c7090d1f58af847c5 Author: Yun Zhou Date: Fri Nov 28 23:51:50 2025 +0800 jfs: add dmapctl integrity check to prevent invalid operations Add check_dmapctl() to validate dmapctl structure integrity, focusing on preventing invalid operations caused by on-disk corruption. Key checks: - nleafs bounded by [0, LPERCTL] (maximum leaf nodes per dmapctl). - l2nleafs bounded by [0, L2LPERCTL] and consistent with nleafs (nleafs must be 2^l2nleafs). - leafidx must be exactly CTLLEAFIND (expected leaf index position). - height bounded by [0, L2LPERCTL >> 1] (valid tree height range). - budmin validity: NOFREE only if nleafs=0; otherwise >= BUDMIN. - Leaf nodes fit within stree array (leafidx + nleafs <= CTLTREESIZE). - Leaf node values are either non-negative or NOFREE. Invoked in dbAllocAG(), dbFindCtl(), dbAdjCtl() and dbExtendFS() when accessing dmapctl pages, catching corruption early before dmap operations trigger invalid memory access or logic errors. This fixes the following UBSAN warning. [58245.668090][T14017] ------------[ cut here ]------------ [58245.668103][T14017] UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:2641:11 [58245.668119][T14017] shift exponent 110 is too large for 32-bit type 'int' [58245.668137][T14017] CPU: 0 UID: 0 PID: 14017 Comm: 4c1966e88c28fa9 Tainted: G E 6.18.0-rc4-00253-g21ce5d4ba045-dirty #124 PREEMPT_{RT,(full)} [58245.668174][T14017] Tainted: [E]=UNSIGNED_MODULE [58245.668176][T14017] Hardware name: QEMU Ubuntu 25.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [58245.668184][T14017] Call Trace: [58245.668200][T14017] [58245.668208][T14017] dump_stack_lvl+0x189/0x250 [58245.668288][T14017] ? __pfx_dump_stack_lvl+0x10/0x10 [58245.668301][T14017] ? __pfx__printk+0x10/0x10 [58245.668315][T14017] ? lock_metapage+0x303/0x400 [jfs] [58245.668406][T14017] ubsan_epilogue+0xa/0x40 [58245.668422][T14017] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [58245.668462][T14017] dbSplit+0x1f8/0x200 [jfs] [58245.668543][T14017] dbAdjCtl+0x34c/0xa20 [jfs] [58245.668628][T14017] dbAllocNear+0x2ee/0x3d0 [jfs] [58245.668710][T14017] dbAlloc+0x933/0xba0 [jfs] [58245.668797][T14017] ea_write+0x374/0xdd0 [jfs] [58245.668888][T14017] ? __pfx_ea_write+0x10/0x10 [jfs] [58245.668966][T14017] ? __jfs_setxattr+0x76e/0x1120 [jfs] [58245.669046][T14017] __jfs_setxattr+0xa01/0x1120 [jfs] [58245.669135][T14017] ? __pfx___jfs_setxattr+0x10/0x10 [jfs] [58245.669216][T14017] ? mutex_lock_nested+0x154/0x1d0 [58245.669252][T14017] ? __jfs_xattr_set+0xb9/0x170 [jfs] [58245.669333][T14017] __jfs_xattr_set+0xda/0x170 [jfs] [58245.669430][T14017] ? __pfx___jfs_xattr_set+0x10/0x10 [jfs] [58245.669509][T14017] ? xattr_full_name+0x6f/0x90 [58245.669546][T14017] ? jfs_xattr_set+0x33/0x60 [jfs] [58245.669636][T14017] ? __pfx_jfs_xattr_set+0x10/0x10 [jfs] [58245.669726][T14017] __vfs_setxattr+0x43c/0x480 [58245.669743][T14017] __vfs_setxattr_noperm+0x12d/0x660 [58245.669756][T14017] vfs_setxattr+0x16b/0x2f0 [58245.669768][T14017] ? __pfx_vfs_setxattr+0x10/0x10 [58245.669782][T14017] filename_setxattr+0x274/0x600 [58245.669795][T14017] ? __pfx_filename_setxattr+0x10/0x10 [58245.669806][T14017] ? getname_flags+0x1e5/0x540 [58245.669829][T14017] path_setxattrat+0x364/0x3a0 [58245.669840][T14017] ? __pfx_path_setxattrat+0x10/0x10 [58245.669859][T14017] ? __se_sys_chdir+0x1b9/0x280 [58245.669876][T14017] __x64_sys_lsetxattr+0xbf/0xe0 [58245.669888][T14017] do_syscall_64+0xfa/0xfa0 [58245.669901][T14017] ? lockdep_hardirqs_on+0x9c/0x150 [58245.669913][T14017] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [58245.669927][T14017] ? exc_page_fault+0xab/0x100 [58245.669937][T14017] entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: syzbot+4c1966e88c28fa96e053@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4c1966e88c28fa96e053 Signed-off-by: Yun Zhou Signed-off-by: Dave Kleikamp commit 119e448bb50a5b2626e248c01f439095766e248b Author: Yun Zhou Date: Thu Nov 20 23:44:00 2025 +0800 jfs: add dtpage integrity check to prevent index/pointer overflows Add check_dtpage() to validate dtpage_t integrity, focusing on preventing index/pointer overflows from on-disk corruption. Key checks: - maxslot must be exactly DTPAGEMAXSLOT (128) as defined for dtpage slot array. - freecnt bounded by [0, DTPAGEMAXSLOT-1] (slot[0] reserved for header). - freelist validity: -1 when freecnt=0; 1~DTPAGEMAXSLOT-1 when non-zero, with linked list checks (no duplicates, proper termination via next=-1). - stblindex bounds: must be within range that avoids overlapping with stbl itself (stblindex < DTPAGEMAXSLOT - stblsize). - nextindex bounded by stbl size (stblsize << L2DTSLOTSIZE). stbl entries validity: within 1~DTPAGEMAXSLOT-1, no duplicates(excluding invalid entries marked as -1). Invoked when loading dtpage (in BT_GETPAGE macro context) to catch corruption early before directory operations trigger out-of-bounds access. Signed-off-by: Yun Zhou Signed-off-by: Dave Kleikamp commit c83abc766aeb153e69cb46363bf7c9de0c9f3268 Author: Yun Zhou Date: Thu Nov 20 23:43:50 2025 +0800 jfs: add dtroot integrity check to prevent index out-of-bounds Add check_dtroot() to validate dtroot_t integrity, focusing on preventing index/pointer overflows from on-disk corruption. Key checks: - freecnt bounded by [0, DTROOTMAXSLOT-1] (slot[0] reserved for header). - freelist validity: -1 when freecnt=0; 1~DTROOTMAXSLOT-1 when non-zero, with linked list checks (no duplicates, proper termination via next=-1). - stbl bounds: nextindex within stbl array size; entries within 0~8, no duplicates (excluding idx=0). Invoked in copy_from_dinode() when loading directory inodes, catching corruption early before directory operations trigger out-of-bounds access. This fixes the following UBSAN warning. [ 101.832754][ T5960] ------------[ cut here ]------------ [ 101.832762][ T5960] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:3713:8 [ 101.832792][ T5960] index -1 is out of range for type 'struct dtslot[128]' [ 101.832807][ T5960] CPU: 2 UID: 0 PID: 5960 Comm: 5f7f0caf9979e9d Tainted: G E 6.18.0-rc4-00250-g2603eb907f03 #119 PREEMPT_{RT,(full [ 101.832817][ T5960] Tainted: [E]=UNSIGNED_MODULE [ 101.832819][ T5960] Hardware name: QEMU Ubuntu 25.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.832823][ T5960] Call Trace: [ 101.832833][ T5960] [ 101.832838][ T5960] dump_stack_lvl+0x189/0x250 [ 101.832909][ T5960] ? __pfx_dump_stack_lvl+0x10/0x10 [ 101.832925][ T5960] ? __pfx__printk+0x10/0x10 [ 101.832934][ T5960] ? rt_mutex_slowunlock+0x493/0x8a0 [ 101.832959][ T5960] ubsan_epilogue+0xa/0x40 [ 101.832966][ T5960] __ubsan_handle_out_of_bounds+0xe9/0xf0 [ 101.833007][ T5960] dtInsertEntry+0x936/0x1430 [jfs] [ 101.833094][ T5960] dtSplitPage+0x2c8b/0x3ed0 [jfs] [ 101.833177][ T5960] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 101.833193][ T5960] dtInsert+0x109b/0x6000 [jfs] [ 101.833283][ T5960] ? rt_mutex_slowunlock+0x493/0x8a0 [ 101.833296][ T5960] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 101.833307][ T5960] ? rt_spin_unlock+0x161/0x200 [ 101.833315][ T5960] ? __pfx_dtInsert+0x10/0x10 [jfs] [ 101.833391][ T5960] ? txLock+0xaf9/0x1cb0 [jfs] [ 101.833477][ T5960] ? dtInitRoot+0x22a/0x670 [jfs] [ 101.833556][ T5960] jfs_mkdir+0x6ec/0xa70 [jfs] [ 101.833636][ T5960] ? __pfx_jfs_mkdir+0x10/0x10 [jfs] [ 101.833721][ T5960] ? generic_permission+0x2e5/0x690 [ 101.833760][ T5960] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 101.833776][ T5960] vfs_mkdir+0x306/0x510 [ 101.833786][ T5960] do_mkdirat+0x247/0x590 [ 101.833795][ T5960] ? __pfx_do_mkdirat+0x10/0x10 [ 101.833804][ T5960] ? getname_flags+0x1e5/0x540 [ 101.833815][ T5960] __x64_sys_mkdir+0x6c/0x80 [ 101.833823][ T5960] do_syscall_64+0xfa/0xfa0 [ 101.833832][ T5960] ? lockdep_hardirqs_on+0x9c/0x150 [ 101.833840][ T5960] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.833847][ T5960] ? exc_page_fault+0xab/0x100 [ 101.833856][ T5960] entry_SYSCALL_64_after_hwframe+0x77/0x7f Signed-off-by: Yun Zhou Signed-off-by: Dave Kleikamp commit ee78d466db8a001d137d6f9c97010b343aee456b Author: Frank Li Date: Tue Mar 10 15:07:39 2026 -0400 mtd: rawnand: ifc: set chip->of_node to nand@0 child node if present The nand-controller.yaml binding requires a child node (e.g. nand@0) under the NAND controller. However, the driver currently assigns the controller's of_node directly to the NAND chip. Search for the first child node with the "nand" prefix and assign it to chip->of_node. This filters out properties such as "partition" that may be placed under the controller node in some older DTS files. Fall back to using the controller's of_node if no suitable child node is found to maintain backward compatibility. This issue went unnoticed because the default behavior works for most NAND chips. Signed-off-by: Frank Li Signed-off-by: Miquel Raynal commit f7bd1948a5461df9e1027d5bd9a511e754146689 Author: Frank Li Date: Tue Mar 10 15:07:38 2026 -0400 mtd: rawnand: mxc: set chip->of_node to nand@0 child node if present The nand-controller.yaml binding requires a child node (e.g. nand@0) under the NAND controller. However, the driver currently assigns the controller's of_node directly to the NAND chip. Search for the first child node with the "nand" prefix and assign it to chip->of_node. This filters out properties such as "partition" that may be placed under the controller node in some older DTS files. Fall back to using the controller's of_node if no suitable child node is found to maintain backward compatibility. This issue went unnoticed because the default behavior works for most NAND chips. Signed-off-by: Frank Li Signed-off-by: Miquel Raynal commit 3a6e21ea57c8118d3095f073aeaf9362dc2c3865 Author: Frank Li Date: Tue Mar 10 15:07:37 2026 -0400 mtd: rawnand: gpmi: set chip->of_node to nand@0 child node if present The nand-controller.yaml binding requires a child node (e.g. nand@0) under the NAND controller. However, the driver currently assigns the controller's of_node directly to the NAND chip. Search for the first child node with the "nand" prefix and assign it to chip->of_node. This filters out properties such as "partition" that may be placed under the controller node in some older DTS files. Fall back to using the controller's of_node if no suitable child node is found to maintain backward compatibility. This issue went unnoticed because the default behavior works for most NAND chips. Signed-off-by: Frank Li Signed-off-by: Miquel Raynal commit 520886a1a6ca16862a0437b4a8fae133a895a9b8 Author: Richard Lyu Date: Wed Mar 11 00:30:43 2026 +0800 mtd: nand: Use scoped_guard for mutex in nand_resume Refactor nand_resume() to use scoped_guard() instead of explicit mutex_lock/unlock. This improves code safety by ensuring the mutex is always released through the RAII-based cleanup infrastructure. The behavior is functionally equivalent. The mutex is released at the end of the scoped block, after which wake_up_all() is called to preserve the original locking semantics. Signed-off-by: Richard Lyu Signed-off-by: Miquel Raynal commit 605d69163de602433ace8aab32cf4e893df36deb Author: Ajay Kumar Nandam Date: Wed Jan 21 15:56:06 2026 +0530 arm64: defconfig: Enable Qualcomm WCD937x headphone codec as module Enable the Qualcomm WCD937x headphone audio codec as a loadable module, as it is now required on the QCM6490 IDP platform. Signed-off-by: Ajay Kumar Nandam Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260121102606.1753970-1-ajay.nandam@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit dccccbb739510a63cc62eb3cc1261392cc6045f7 Author: Harshal Dev Date: Wed Jan 14 13:49:14 2026 +0530 arm64: defconfig: Enable QCOMTEE module for QTEE-enabled Qualcomm SoCs All Qualcomm SoCs starting from SM8650 provide access to the Qualcomm Trusted Execution Environment (QTEE) through the SMCInvoke interface, implemented by the QCOMTEE driver. QTEE runs in the Secure World domain on ARM64 CPUs and exposes secure services to Linux running in the Normal World domain. This change enables the QCOMTEE driver as a module to support communication with QTEE. QCOMTEE has been tested on a Qualcomm RB3Gen2 board by loading and executing a Trusted Application via tests hosted at github.com/qualcomm/minkipc. Signed-off-by: Harshal Dev Reviewed-by: Kuldeep Singh Tested-by: Kuldeep Singh Reviewed-by: Sumit Garg Reviewed-by: Amirreza Zarrabi Link: https://lore.kernel.org/r/20260114-qcom_qcomtee_defconfig-v4-1-ec676311171f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ca19808bc6fac7e29420d8508df569b346b3e339 Author: James Kim Date: Mon Mar 9 15:05:12 2026 +0900 mtd: docg3: fix use-after-free in docg3_release() In docg3_release(), the docg3 pointer is obtained from cascade->floors[0]->priv before the loop that calls doc_release_device() on each floor. doc_release_device() frees the docg3 struct via kfree(docg3) at line 1881. After the loop, docg3->cascade->bch dereferences the already-freed pointer. Fix this by accessing cascade->bch directly, which is equivalent since docg3->cascade points back to the same cascade struct, and is already available as a local variable. This also removes the now-unused docg3 local variable. Fixes: c8ae3f744ddc ("lib/bch: Rework a little bit the exported function names") Cc: stable@vger.kernel.org Signed-off-by: James Kim Signed-off-by: Miquel Raynal commit e19eaffc5213fdd6179e849d3032929fae0d8c2c Author: Rosen Penev Date: Thu Mar 5 14:44:10 2026 -0800 mtd: concat: replace alloc + calloc with 1 alloc A flex array can be used to reduce the allocation to 1. And actually mtdconcat was using the pointer + 1 trick to point to the overallocated area. Better alternatives exist. Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal commit c685e6e8d88d544e8c4429b06c3e6795cbba32dd Author: Rosen Penev Date: Thu Mar 5 14:44:09 2026 -0800 mtd: virt_concat: use single allocation for node Simpler to reason about and avoids having to free nodes separately. Also add __counted_by attribute for extra runtime analysis. Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal commit 87d8f1285470b3c8367880993113ea604d365e33 Author: Luca Ceresoli Date: Mon Mar 9 22:17:48 2026 +0100 mtd: virt_concat: fix kdoc text The function name in the kdoc comment is different from the name of the function being documented, fix it. Fixes: 43db6366fc2d ("mtd: Add driver for concatenating devices") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603041232.fNDHNtUa-lkp@intel.com/ Signed-off-by: Luca Ceresoli Signed-off-by: Miquel Raynal commit b7c0982184b0661f5b1b805f3a56f1bd3757b63e Author: Chen Ni Date: Fri Feb 27 09:43:36 2026 +0800 mtd: physmap_of_gemini: Fix disabled pinctrl state check The condition for checking the disabled pinctrl state incorrectly checks gf->enabled_state instead of gf->disabled_state. This causes misleading error messages and could lead to incorrect behavior when only one of the pinctrl states is defined. Fix the condition to properly check gf->disabled_state. Fixes: 9d3b5086f6d4 ("mtd: physmap_of_gemini: Handle pin control") Signed-off-by: Chen Ni Reviewed-by: Linus Walleij Signed-off-by: Miquel Raynal commit 16d68d10f5b934db7ee02a1e28cbc539905c64b8 Author: Andy Shevchenko Date: Wed Feb 25 17:23:34 2026 +0100 mtd: physmap: physmap-bt1-rom: Remove not-going-to-be-supported code for Baikal SoC As noticed in the discussion [1] the Baikal SoC and platforms are not going to be finalized, hence remove stale code. Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1] Reviewed-by: Randy Dunlap Signed-off-by: Andy Shevchenko Signed-off-by: Miquel Raynal commit b8469dd5b37fd25886c2018a04b71eb76fe8975d Author: Nicholas Kazlauskas Date: Tue Feb 24 10:36:29 2026 -0500 drm/amd/display: Add documentation and cleanup DMUB HW lock manager To document how the helpers should be used before a subsequent change adds new locations that these helpers will be used. Reviewed-by: Ovidiu (Ovi) Bunea Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit eff9280110bbea0b39586301a80a517cf5d79ce8 Author: ChunTao Tso Date: Fri Feb 6 15:41:54 2026 +0800 drm/amd/display: Add new types to replay config [WHAT] Add FRAME_SKIPPING_ERROR_STATUS to dpcd_replay_configuration. Add received_frame_skipping_error_hpd to replay_config. Add REPLAY_GENERAL_CMD_SET_COASTING_VTOTAL_WITHOUT_FRAME_UPDATE to dmub_cmd_replay_general_subtype. Reviewed-by: Aric Cyr Signed-off-by: ChunTao Tso Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d3e79f333d90f6d3d268c3b073cf3afc0b019036 Author: Nicholas Kazlauskas Date: Tue Feb 24 16:49:46 2026 -0500 drm/amd/display: Fix HWSS v3 fast path determination [WHY] We're checking surface and stream updates after they've been applied to their respective states within `update_planes_and_stream_state`. Medium updates under the HWSS V3 fast path that are not supported or tested are getting implicitly if they don't trigger a DML validation and getting updated in place on the dc->current_state context. [HOW] Fix this issue by moving up the fast path determination check prior to `update_planes_and_stream_state`. This is how the V2 path works and how the V3 path used to work prior to the refactors in this area. Reviewed-by: Dillon Varone Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit e6e2b956fc814de766d3480be7018297c41d3ce0 Author: Ivan Lipski Date: Tue Feb 24 16:28:00 2026 -0500 drm/amd/display: Add missing DCCG register entries for DCN20-DCN316 Commit 4c595e75110e ("drm/amd/display: Migrate DCCG registers access from hwseq to dccg component.") moved register writes from hwseq to dccg2_*() functions but did not add the registers to the DCCG register list macros. The struct fields default to 0, so REG_WRITE() targets MMIO offset 0, causing a GPU hang on resume (seen on DCN21/DCN30 during IGT kms_cursor_crc@cursor-suspend). Add - MICROSECOND_TIME_BASE_DIV - MILLISECOND_TIME_BASE_DIV - DCCG_GATE_DISABLE_CNTL - DCCG_GATE_DISABLE_CNTL2 - DC_MEM_GLOBAL_PWR_REQ_CNTL to macros in dcn20_dccg.h, dcn301_dccg.h, dcn31_dccg.h, and dcn314_dccg.h. Fixes: 4c595e75110e ("drm/amd/display: Migrate DCCG registers access from hwseq to dccg component.") Reported-by: Rafael Passos Reviewed-by: Aurabindo Pillai Signed-off-by: Ivan Lipski Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 61436301dfc1d845f2b90a5f07d5c1d7cf89e900 Author: Weiguang Li Date: Mon Dec 8 14:13:20 2025 +0800 drm/amd/display: Add ESD detection for replay recovery [HOW] Add Replay recovery flow so that when HPD occurs and ESD is detected, Replay can restore the system back to normal. Reviewed-by: Wenjing Liu Reviewed-by: Robin Chen Reviewed-by: Aric Cyr Signed-off-by: Weiguang Li Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit a879009f9a08b5756ca178223f003f18def07b22 Author: Charlene Liu Date: Mon Feb 23 14:28:14 2026 -0500 drm/amd/display: Update underflow detection [WHY] Add underflow detection for later ASICs. Reviewed-by: Leo Chen Signed-off-by: Charlene Liu Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f3d349484856e874ad00eeda9754a2ca8b7be5c7 Author: Harry Wentland Date: Thu Jan 15 14:12:46 2026 -0500 drm/amd/display: Add COLOR_ENCODING/COLOR_RANGE to overlay planes Extend COLOR_ENCODING and COLOR_RANGE property creation to overlay planes in addition to primary planes. This allows overlay planes to use YUV formats with proper color space configuration when the hardware supports NV12/P010 formats. These properties control the YUV-to-RGB conversion matrix selection (BT.601/BT.709/BT.2020) and range handling (limited/full range). Assisted-by: Claude: claude-sonnet-4.5 Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 63fff551318f5e0814b94f709a6dfaec789dcd7a Author: Harry Wentland Date: Thu Jan 15 14:12:05 2026 -0500 drm/amd/display: Add NV12/P010 formats to primary plane Add NV12, NV21, and P010 YUV formats to the primary plane's supported format list, enabling YUV content to be scanned out directly from the primary plane. Assisted-by: Claude: claude-sonnet-4.5 Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit eb51c5a103f63b6e9c3f9cebf7b1e2e1056d3119 Author: Harry Wentland Date: Fri Jan 16 09:39:05 2026 -0500 drm/amd/display: Set chroma taps to 1 if luma taps are 1 When luma is unscaled we also want chroma to be pixel-perfect. When luma taps are > 1 the result will be a blurred luma plane, even when the image isn't scaled. This makes IGT tests for CSC colorop pass. Assisted-by: Claude: claude-sonnet-4.5 Reviewed-by: Alex Hung Signed-off-by: Harry Wentland Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 23dee18f6503d67b195f1513e404c78653ed0d40 Author: Ovidiu Bunea Date: Tue Feb 10 15:26:18 2026 -0500 drm/amd/display: Add min clock init for DML21 mode programming [WHY & HOW] 0 stream cases do not go through any DML validation which leaves DCN clocks in unoptimized states. If requesting DML validation or programming with 0 streams, program DCN clocks to lowest DPM state. Reviewed-by: Dillon Varone Signed-off-by: Ovidiu Bunea Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit aef320b01c4306957cac7be5468868806a27985c Author: Peichen Huang Date: Fri Feb 6 15:10:25 2026 +0800 drm/amd/display: Return early from vesa replay enable function [WHY & HOW] If the enable state is already as expect then just return. Reviewed-by: Robin Chen Reviewed-by: Wenjing Liu Signed-off-by: Peichen Huang Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 6cafbc182855b8f456e04110b9111847446cd0ea Author: Gaghik Khachatrian Date: Mon Feb 23 14:56:15 2026 -0500 drm/amd/display: Clean up NULL pointer warnings in dml2 This commit addresses multiple warnings by adding defensive checks for NULL pointers before dereferencing them. The changes ensure that pointers such as are validated, preventing potential undefined behavior. Reviewed-by: Dillon Varone Signed-off-by: Gaghik Khachatrian Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 322a81d35ecdf9997c3bbf676e3547d75f38935a Author: Rodrigo Gobbi Date: Tue Feb 24 22:23:20 2026 -0300 dt-bindings: usb: maxim,max3421: convert to DT schema Convert legacy maxim,max3421.txt to proper format. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rodrigo Gobbi Link: https://patch.msgid.link/20260225014751.9121-1-rodrigo.gobbi.7@gmail.com Signed-off-by: Greg Kroah-Hartman commit b558a9cc107287bd49bd9256e5d965afa80acfd6 Author: Amit Sunil Dhamne Date: Mon Feb 23 20:05:38 2026 +0000 usb: typec: tcpm: add support for Sink Cap Extended msg response Add support for responding to Sink Cap Extended msg request. To achieve this, include parsing support for DT properties related to Sink Cap Extended. The request for Sink Cap Ext is a control message while the response is an extended message (chunked). As the Sink Caps Extended Data Block size (24 Byte) is less than MaxExtendedMsgChunkLen (26 Byte), a single chunk is sufficient to complete this AMS. Supporting sink cap extended messages while responding to a Get_Sink_Caps_Extended request when port is in Sink role is required in order to be compliant with at least USB PD Rev3.1 Ver1.8. Signed-off-by: Amit Sunil Dhamne Reviewed-by: Badhri Jagan Sridharan Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260223-skedb-v2-2-60675765bc7e@google.com Signed-off-by: Greg Kroah-Hartman commit ef22555fbee7c284a6ab55238fcbe4eea9dbb2a4 Author: Amit Sunil Dhamne Date: Mon Feb 23 20:05:37 2026 +0000 dt-bindings: connector: Add sink properties to comply with PD 3.1 spec Add additional properties for ports supporting sink mode. The properties define certain hardware and electrical properties such as sink load step, sink load characteristics, sink compliance and charging adapter Power Delivery Profile (PDP) for the connector. These properties need to be defined for a Type-C port in compliance with the PD 3.1 spec. Signed-off-by: Amit Sunil Dhamne Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223-skedb-v2-1-60675765bc7e@google.com Signed-off-by: Greg Kroah-Hartman commit d6a093c3bf0e4e073b87022ac34b261979325228 Author: Thomas Weißschuh Date: Mon Feb 23 22:20:33 2026 +0100 usb: endpoint: drop custom sysfs attribute structure Nowadays the USB endpoints use device attributes, so the custom structure is unused. Drop it. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260223-sysfs-const-usb-v1-1-54c4434d83c8@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit ec53fe37a56044a1a8e7751d05b13385fb30741f Author: Yuanshen Cao Date: Fri Feb 20 06:22:41 2026 +0000 usb: typec: tcpm: Add vid and chip info for Etek ET7304 Move VID field to chip info to accommodate different VIDs. Add chip info for Etek Micro ET7304. ET7304 is functionally identical to the Richtek RT1715, with the only difference being the VID. Signed-off-by: Yuanshen Cao Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260220-et7304-v3-2-ede2d9634957@gmail.com Signed-off-by: Greg Kroah-Hartman commit cd763789d31adac7f38131c5b2892d7a5562a1ee Author: Yuanshen Cao Date: Fri Feb 20 06:22:40 2026 +0000 dt-bindings: usb: document the Etek ET7304 USB Type-C Port Controller Document the ETEK Micro ET7304 USB Type-C Port Controller with USB-PD. Signed-off-by: Yuanshen Cao Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260220-et7304-v3-1-ede2d9634957@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8f196a359e1b4f80d360c57ed32bec15d5dd8e0e Author: Ai Chao Date: Tue Mar 10 17:44:34 2026 +0800 usbip: vhci_sysfs: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao Link: https://patch.msgid.link/20260310094434.3639602-7-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit 9b4051a47da5050ba349b630494cf5ee3d5aa1e1 Author: Ai Chao Date: Tue Mar 10 17:44:33 2026 +0800 usb: gadget: udc: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao Link: https://patch.msgid.link/20260310094434.3639602-6-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit 2131540de4adc8eb7960ebea9915694ec0ce430d Author: Ai Chao Date: Tue Mar 10 17:44:32 2026 +0800 usb: typec: tcpm: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao Link: https://patch.msgid.link/20260310094434.3639602-5-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit 224fb8661f66a58530564a2cdce42b219adde4cb Author: Ai Chao Date: Tue Mar 10 17:44:31 2026 +0800 usb: gadget: functionfs: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao Link: https://patch.msgid.link/20260310094434.3639602-4-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit 786bf7ef564e97f195a2fca379fa7866a4c3ea08 Author: Ai Chao Date: Tue Mar 10 17:44:30 2026 +0800 usb: musb: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao Link: https://patch.msgid.link/20260310094434.3639602-3-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit c384f7ad44f940c2d054bbe4c06840e2073af788 Author: Ai Chao Date: Tue Mar 10 17:44:29 2026 +0800 USB: serial: ti_usb_3410_5052: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Ai Chao Link: https://patch.msgid.link/20260310094434.3639602-2-aichao@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit b145c3f29d62f71cc9d2d714e2d4ae4c8d3f863d Author: Sebastian Reichel Date: Mon Feb 23 19:27:39 2026 +0100 usb: typec: mux: avoid duplicated mux switches Some devices use combo PHYs (i.e. USB3 + DisplayPort), which also handle the lane muxing. These PHYs are referenced twice from the USB-C connector (USB super-speed lines and SBU/AUX lines) resulting in the mux being configured twice. Avoid this by dropping duplicates. Signed-off-by: Sebastian Reichel Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260223-typec-mux-duplication-fix-v2-2-0402fefc222e@collabora.com Signed-off-by: Greg Kroah-Hartman commit a53b4f9c51a90a556bca129d632b81f49b1a4061 Author: Sebastian Reichel Date: Mon Feb 23 19:27:38 2026 +0100 usb: typec: mux: avoid duplicated orientation switches Some devices use combo PHYs (i.e. USB3 + DisplayPort), which also handle the orientation mux. These PHYs are referenced twice from the USB-C connector (USB super-speed lines and SBU/AUX lines) resulting in the switch being configured twice. Avoid this by dropping duplicates. Signed-off-by: Sebastian Reichel Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260223-typec-mux-duplication-fix-v2-1-0402fefc222e@collabora.com Signed-off-by: Greg Kroah-Hartman commit f2529d08fcb429ea01bb87c326342f41483f8b2f Author: Ethan Tidmore Date: Wed Feb 18 15:46:21 2026 -0600 usb: typec: Fix error pointer dereference The variable tps->partner is checked for an error pointer and then if it is, it sends an error message but does not return and then immediately dereferenced a few lines below: tps->partner = typec_register_partner(tps->port, &desc); if (IS_ERR(tps->partner)) dev_warn(tps->dev, "%s: failed to register partnet\n", __func__); if (desc.identity) { typec_partner_set_identity(tps->partner); cd321x->cur_partner_identity = st.partner_identity; } Add early return and fix spelling mistake in error message. Detected by Smatch: drivers/usb/typec/tipd/core.c:827 cd321x_update_work() error: 'tps->partner' dereferencing possible ERR_PTR() Fixes: 82432bbfb9e83 ("usb: typec: tipd: Handle mode transitions for CD321x") Signed-off-by: Ethan Tidmore Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260218214621.38154-1-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0313023f19054f2d267382e04d0c00988640e9f0 Author: Krzysztof Kozlowski Date: Mon Feb 16 12:04:04 2026 +0100 USB: typec: tcpci: Make tcpci_pm_ops variable static File-scope 'tcpci_pm_ops' is not used outside of this unit, so make it static to silence sparse warning: tcpm/tcpci.c:1002:1: warning: symbol 'tcpci_pm_ops' was not declared. Should it be static? Signed-off-by: Krzysztof Kozlowski Reviewed-by: Heikki Krogerus Reviewed-by: Badhri Jagan Sridharan Link: https://patch.msgid.link/20260216110403.159945-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 78bf06db167b1cddc7f46c2d30c11cca8e32b5d8 Author: Loic Poulain Date: Tue Feb 17 11:34:03 2026 +0100 usb: typec: ucsi: Invoke ucsi_run_command tracepoint The ucsi_run_command trace event is exposed in tracefs, but it never produces any output because the UCSI core never invokes the associated tracepoint. As a result, enabling the event under events/ucsi/ yields no traces, preventing users from inspecting UCSI command sequencing. Wire the tracepoint into the UCSI command path so that commands are properly reported. Example: 50.692342: ucsi_run_command: GET_CONNECTOR_STATUS -> OK (err=0) 50.692345: ucsi_connector_change: port0 status: change=4800, ... 51.750298: ucsi_run_command: GET_CABLE_PROPERTY -> FAIL (err=-5) 51.773360: ucsi_run_command: GET_CONNECTOR_STATUS -> OK (err=0) Signed-off-by: Loic Poulain Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260217103403.1956-1-loic.poulain@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 3dbaacf6ab68f81e3375fe769a2ecdbd3ce386fd Author: Ming Lei Date: Wed Mar 11 11:28:37 2026 +0800 blk-cgroup: wait for blkcg cleanup before initializing new disk When a queue is shared across disk rebind (e.g., SCSI unbind/bind), the previous disk's blkcg state is cleaned up asynchronously via disk_release() -> blkcg_exit_disk(). If the new disk's blkcg_init_disk() runs before that cleanup finishes, we may overwrite q->root_blkg while the old one is still alive, and radix_tree_insert() in blkg_create() fails with -EEXIST because the old blkg entries still occupy the same queue id slot in blkcg->blkg_tree. This causes the sd probe to fail with -ENOMEM. Fix it by waiting in blkcg_init_disk() for root_blkg to become NULL, which indicates the previous disk's blkcg cleanup has completed. Fixes: 1059699f87eb ("block: move blkcg initialization/destroy into disk allocation/release handler") Cc: Yi Zhang Signed-off-by: Ming Lei Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260311032837.2368714-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 99261ccdc0f346b1f21ae3718b2b3c0dd69c04b4 Author: Wander Lairson Costa Date: Mon Mar 9 16:46:31 2026 -0300 rtla/utils: Fix loop condition in PID validation The procfs_is_workload_pid() function iterates through a directory entry name to validate if it represents a process ID. The loop condition checks if the pointer t_name is non-NULL, but since incrementing a pointer never makes it NULL, this condition is always true within the loop's context. Although the inner isdigit() check catches the NUL terminator and breaks out of the loop, the condition is semantically misleading and not idiomatic for C string processing. Correct the loop condition from checking the pointer (t_name) to checking the character it points to (*t_name). This ensures the loop terminates when the NUL terminator is reached, aligning with standard C string iteration practices. While the original code functioned correctly due to the existing character validation, this change improves code clarity and maintainability. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-19-wander@redhat.com Signed-off-by: Tomas Glozar commit 5b6dc659ad792c72b3ff1be8039ae2945e030928 Author: Wander Lairson Costa Date: Mon Mar 9 16:46:30 2026 -0300 rtla/utils: Fix resource leak in set_comm_sched_attr() The set_comm_sched_attr() function opens the /proc directory via opendir() but fails to call closedir() on its successful exit path. If the function iterates through all processes without error, it returns 0 directly, leaking the DIR stream pointer. Fix this by refactoring the function to use a single exit path. A retval variable is introduced to track the success or failure status. All exit points now jump to a unified out label that calls closedir() before the function returns, ensuring the resource is always freed. Fixes: dada03db9bb19 ("rtla: Remove procps-ng dependency") Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-18-wander@redhat.com Signed-off-by: Tomas Glozar commit 47dd74f68c0c068fdd29cdf9fe1860a19209bc1f Author: Wander Lairson Costa Date: Mon Mar 9 16:46:29 2026 -0300 rtla/trace: Fix I/O handling in save_trace_to_file() The read/write loop in save_trace_to_file() does not correctly handle errors from the read() and write() system calls. If either call is interrupted by a signal, it returns -1 with errno set to EINTR, but the code treats this as a fatal error and aborts the save operation. Additionally, write() may perform a partial write, returning fewer bytes than requested, which the code does not handle. Fix the I/O loop by introducing proper error handling. The return value of read() is now stored in a ssize_t variable and checked for errors, with EINTR causing a retry. For write(), an inner loop ensures all bytes are written, handling both EINTR and partial writes. Error messages now include strerror() output for better debugging. This follows the same pattern established in the previous commit that fixed trace_event_save_hist(), ensuring consistent and robust I/O handling throughout the trace saving code. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-17-wander@redhat.com Signed-off-by: Tomas Glozar commit 4bf4ef5292b9253d8607c61a875d9f6b14129976 Author: Wander Lairson Costa Date: Mon Mar 9 16:46:28 2026 -0300 rtla/trace: Fix write loop in trace_event_save_hist() The write loop in trace_event_save_hist() does not correctly handle errors from the write() system call. If write() returns -1, this value is added to the loop index, leading to an incorrect memory access on the next iteration and potentially an infinite loop. The loop also fails to handle EINTR. Fix the write loop by introducing proper error handling. The return value of write() is now stored in a ssize_t variable and checked for errors. The loop retries the call if interrupted by a signal and breaks on any other error after logging it with strerror(). Additionally, change the index variable type from int to size_t to match the type used for buffer sizes and by strlen(), improving type safety. Fixes: 761916fd02c2 ("rtla/trace: Save event histogram output to a file") Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-16-wander@redhat.com Signed-off-by: Tomas Glozar commit 48fbcd4db34b5ea9135801ffe4585a22681c0815 Author: Wander Lairson Costa Date: Mon Mar 9 16:46:27 2026 -0300 rtla/timerlat: Simplify RTLA_NO_BPF environment variable check The code that checks the RTLA_NO_BPF environment variable calls getenv() twice and uses strncmp() with a length of 2 to compare against the single-character string "1". This is inefficient and the comparison length is unnecessarily long. Store the result of getenv() in a local variable to avoid the redundant call, and replace strncmp() with strncmp_static() for the exact match comparison. This follows the same pattern established in recent commits that improved string comparison consistency throughout the rtla codebase. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-15-wander@redhat.com Signed-off-by: Tomas Glozar commit ea5ea8359cd68037d8a093df67d55b750818ab8f Author: Wander Lairson Costa Date: Mon Mar 9 16:46:26 2026 -0300 rtla: Use str_has_prefix() for option prefix check The argument parsing code in timerlat_main() and osnoise_main() uses strncmp() with a length of 1 to check if the first argument starts with a dash, indicating an option flag was passed. Replace this pattern with str_has_prefix() for consistency with the rest of the codebase. While character comparison would be slightly more efficient, using str_has_prefix() provides better readability and maintains a uniform coding style throughout the rtla tool. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-14-wander@redhat.com Signed-off-by: Tomas Glozar commit b3910a739235f89f616345dda1f8303d9ccb99fb Author: Wander Lairson Costa Date: Mon Mar 9 16:46:25 2026 -0300 rtla: Enforce exact match for time unit suffixes The parse_ns_duration() function currently uses prefix matching for detecting time units. This approach is problematic as it silently accepts malformed strings such as "100nsx" or "100us_invalid" by ignoring the trailing characters, leading to potential configuration errors. Introduce a match_time_unit() helper that checks the suffix matches exactly and is followed by either end-of-string or a ':' delimiter. The ':' is needed because parse_ns_duration() is also called from get_long_ns_after_colon() when parsing SCHED_DEADLINE priority specifications in the format "d:runtime:period" (e.g., "d:10ms:100ms"). A plain strcmp() would reject valid deadline strings because the suffix "ms" is followed by ":100ms", not end-of-string. Similarly, strncmp_static() would fail because ARRAY_SIZE() includes the NUL terminator, making it equivalent to strcmp() for this comparison. The match_time_unit() helper solves both problems: it rejects malformed input like "100msx" while correctly handling the colon-delimited deadline format. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-13-wander@redhat.com Signed-off-by: Tomas Glozar commit 265905df83a4c1e78c1a912e1699d7c81d9540e6 Author: Wander Lairson Costa Date: Mon Mar 9 16:46:24 2026 -0300 rtla: Use str_has_prefix() for prefix checks The code currently uses strncmp() combined with strlen() to check if a string starts with a specific prefix. This pattern is verbose and prone to errors if the length does not match the prefix string. Replace this pattern with the str_has_prefix() helper function in both trace.c and utils.c. This improves code readability and safety by handling the prefix length calculation automatically. In addition, remove the unused retval variable from trace_event_save_hist() in trace.c to clean up the function and silence potential compiler warnings. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-12-wander@redhat.com Signed-off-by: Tomas Glozar commit 0f4bc9d67a643a6ea8b82faf724e44648b2c322d Author: Wander Lairson Costa Date: Mon Mar 9 16:46:23 2026 -0300 rtla: Add str_has_prefix() helper function Add a str_has_prefix() helper function that tests whether a string starts with a given prefix. This function provides a cleaner interface for prefix matching compared to using strncmp() with strlen() directly. The function returns a boolean value indicating whether the string starts with the specified prefix. This helper will be used in subsequent changes to simplify prefix matching code throughout rtla. Also add the missing string.h include which is needed for the strlen() and strncmp() functions used by str_has_prefix() and the existing strncmp_static() macro. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-11-wander@redhat.com Signed-off-by: Tomas Glozar commit d847188bb92b14518a04d7542e44928a22060847 Author: Wander Lairson Costa Date: Mon Mar 9 16:46:22 2026 -0300 rtla: Handle pthread_create() failure properly Add proper error handling when pthread_create() fails to create the timerlat user-space dispatcher thread. Previously, the code only logged an error message but continued execution, which could lead to undefined behavior when the tool later expects the thread to be running. When pthread_create() returns an error, the function now jumps to the out_trace error path to properly clean up resources and exit. This ensures consistent error handling and prevents the tool from running in an invalid state without the required user-space thread. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-10-wander@redhat.com Signed-off-by: Tomas Glozar commit d6515424e80583928ec1c55e9dd4e906bc90d9be Author: Wander Lairson Costa Date: Mon Mar 9 16:46:21 2026 -0300 rtla/timerlat: Add bounds check for softirq vector Add bounds checking when accessing the softirq_name array using the vector value from kernel trace data. The vector field from the osnoise:softirq_noise event is used directly as an array index without validation, which could cause an out-of-bounds read if the kernel provides an unexpected vector value. The softirq_name array contains 10 elements corresponding to the standard Linux softirq vectors. While the kernel should only provide valid vector values in the range 0-9, defensive programming requires validating untrusted input before using it as an array index. If an out-of-range vector is encountered, display the word UNKNOWN instead of attempting to read beyond the array bounds. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-9-wander@redhat.com Signed-off-by: Tomas Glozar commit 99df63d20dabda8d7ae01bcca7cdb1e92110a555 Author: Abel Vesa Date: Mon Mar 9 12:56:51 2026 +0200 dt-bindings: usb: qcom,dwc3: Allow high-speed interrupt on Glymur, Hamoa and Milos Some of the controllers found of these platforms can be tied up to a single high-speed PHY, basically rendering them as USB 2.0 controllers. So in this case, the interrupt to the Synopsys DesignWare Core is coming from the high-speed PHY, so allow the interrupt to reflect that. Acked-by: Rob Herring (Arm) Signed-off-by: Abel Vesa Tested-by: Pankaj Patil Link: https://patch.msgid.link/20260309-dts-qcom-glymur-add-usb-support-v4-1-6bdc41f58d18@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 79a860ad214d034d1a5be8dc83811bd97e9aafb4 Author: Zeeshan Ahmad Date: Fri Mar 6 14:06:43 2026 +0500 usb: dwc3: gadget: use explicit 0 for success in __dwc3_gadget_kick_transfer() Smatch warns that __dwc3_gadget_kick_transfer() might be missing an error code when returning 'ret' at line 1691. While 'ret' is guaranteed to be 0 at this point, returning an explicit 0 improves readability by removing a level of indirection and clarifies the intent that this is a successful "no-op" path. This change also silences the Smatch warning. Suggested-by: Dan Carpenter Signed-off-by: Zeeshan Ahmad Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260306090643.47383-1-zeeshanahmad022019@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7afa83a7a8bf3f1d6984c29fe77a2fb44d9f049d Author: Zeeshan Ahmad Date: Wed Feb 25 11:51:57 2026 +0500 usb: dwc3: qcom: simplify error check in dwc3_qcom_find_num_ports() The platform_get_irq_byname_optional() function returns a non-zero IRQ number on success and a negative error code on failure. It never returns zero. The current implementation in the modern dwc3-qcom driver checks for a return value less than or equal to zero. Since zero is not a valid return value, simplify the check to only look for negative error codes. This aligns the logic with the standard return contract of the platform IRQ APIs. Signed-off-by: Zeeshan Ahmad Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260225065157.8952-1-zeeshanahmad022019@gmail.com Signed-off-by: Greg Kroah-Hartman commit bed0053a6303d908266aaaabf4fa96e2d02a4abc Author: Thomas Weißschuh Date: Fri Feb 27 07:46:01 2026 +0100 selftests: vDSO: vdso_test_correctness: Add a test for time() Extend the test to also cover the time() function. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-6-d84830fa8beb@linutronix.de commit a8b22a158a47e459d4d353600b1405391bbfb567 Author: Thomas Weißschuh Date: Fri Feb 27 07:46:00 2026 +0100 selftests: vDSO: vdso_test_correctness: Use facilities from parse_vdso.c The soname from the vDSO is not a public API. Furthermore it requires libc to implement dlsym() and friends. Use the facilities from parse_vdso.c instead which uses the official vDSO ABI to find it, aligned with the other vDSO selftests. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-5-d84830fa8beb@linutronix.de commit 38bc16aa47dc89dc3753ee5359c7a7c15f7bf602 Author: Thomas Weißschuh Date: Fri Feb 27 07:45:59 2026 +0100 selftests: vDSO: vdso_test_correctness: Handle different tv_usec types On SPARC the field tv_usec of 'struct timespec' is not a 'long int', but only a regular int. In this case the format string is incorrect and will trigger compiler warnings. Avoid the warnings by casting to 'long long', similar to how it is done for the tv_sec and what the other similar selftests are doing. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-4-d84830fa8beb@linutronix.de commit ad2af7768fac884ede727d2a085bd78b8e13fdef Author: Thomas Weißschuh Date: Fri Feb 27 07:45:58 2026 +0100 selftests: vDSO: vdso_test_correctness: Drop SYS_getcpu fallbacks These fallbacks are only valid on x86 and unused in the first place. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-3-d84830fa8beb@linutronix.de commit 50692c25ee2e8f9093ec3409ee43b342d9d07775 Author: Thomas Weißschuh Date: Fri Feb 27 07:45:57 2026 +0100 selftests: vDSO: vdso_test_gettimeofday: Remove nolibc checks nolibc now provides these headers, making the check unnecessary. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-2-d84830fa8beb@linutronix.de commit 5abfa0c4da3bdcc53597127be7cd4054812b0383 Author: Thomas Weißschuh Date: Fri Feb 27 07:45:56 2026 +0100 Revert "selftests: vDSO: parse_vdso: Use UAPI headers instead of libc headers" This reverts commit c9fbaa879508 ("selftests: vDSO: parse_vdso: Use UAPI headers instead of libc headers") The kernel headers were used to make parse_vdso.c compatible with nolibc. Unfortunately linux/elf.h is incompatible with glibc's sys/auxv.h. When using glibc it is therefore not possible build parse_vdso.c as part of the same compilation unit as its caller as sys/auxv.h is needed for getauxval(). In the meantime nolibc gained its own elf.h, providing compatibility with the documented libc interfaces. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-selftest-cleanups-v2-1-d84830fa8beb@linutronix.de commit 260b98f75b618aa209998557dbd1d13dbc64bc89 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:41 2026 +0100 random: vDSO: Remove ifdeffery Recent cleanups of the vDSO headers allow the unconditional inclusion of vdso/datapage.h and the declarations it provides. This also means that the declaration of vdso_k_rng_data is always visible and its usage does not need to be guarded by ifdefs anymore. Instead use IS_ENABLED(). Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Jason A. Donenfeld Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-15-35d60acf7410@linutronix.de commit fc880ff14acd49202c83b569316bd19c6a037a91 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:40 2026 +0100 random: vDSO: Trim vDSO includes These includes are not used, remove them. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Jason A. Donenfeld Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-14-35d60acf7410@linutronix.de commit f5e386fe5f1c26b24fb9ffc616f8e857f43cf88d Author: Thomas Weißschuh Date: Fri Feb 27 07:44:39 2026 +0100 vdso/datapage: Trim down unnecessary includes vdso/datapage.h includes a lot of headers which are not strictly necessary. Some of those headers include architecture-specific vDSO headers which prevent the usage of vdso/datapage.h in kernel code on architectures without an vDSO. This would be useful however to write generic code using IS_ENABLED(), for example in drivers/char/random.c. Remove the unnecessary includes. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-13-35d60acf7410@linutronix.de commit 750d8cc84901757d9e5fe96207f5aa6b3e2acf92 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:38 2026 +0100 vdso/datapage: Remove inclusion of gettimeofday.h vdso/datapage.h is useful without pulling in the architecture-specific gettimeofday() helpers. Move the include to the only users which needs it. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-12-35d60acf7410@linutronix.de commit 8bd49acb4e81d2859f66a30e8edfd984f91c6c9c Author: Thomas Weißschuh Date: Fri Feb 27 07:44:37 2026 +0100 vdso/helpers: Explicitly include vdso/processor.h The usage of cpu_relax() requires vdso/processor.h. Currently this header is included transitively, but that transitive inclusion is about to go away. Explicitly include the header. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-11-35d60acf7410@linutronix.de commit 9b91cafe8084d83c14d0303fc5897c4ff43122c0 Author: Johan Hovold Date: Thu Mar 5 12:15:11 2026 +0100 USB: usbsevseg: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305111511.18386-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 58221c728d087ece9671d4d9f6fd0a321531d2de Author: Johan Hovold Date: Thu Mar 5 12:15:10 2026 +0100 USB: trancevibrator: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305111511.18386-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9970f8388642410354d6e4e783c655a50fba8ca6 Author: Johan Hovold Date: Thu Mar 5 12:15:09 2026 +0100 USB: ljca: drop redundant interface reference Driver core holds a reference to the USB interface while it is bound to a driver and there is no need to take another reference unless the interface is needed after disconnect. Drop the redundant interface reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Acked-by: Sakari Ailus Link: https://patch.msgid.link/20260305111511.18386-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit bb49af3c56a60af57abdd5e6c753da87d30306fe Author: Johan Hovold Date: Thu Mar 5 12:15:08 2026 +0100 USB: cytherm: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305111511.18386-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 70cd7459ea42ac4ee059ee9522e23f6028dfd1bd Author: Johan Hovold Date: Thu Mar 5 12:15:07 2026 +0100 USB: cypress_cy7c63: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305111511.18386-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3222f3ed0b12056d66d2b00c751dafa5ba614822 Author: Oliver Neukum Date: Thu Mar 5 11:28:35 2026 +0100 usb: image: microtek: use dev_warn and dev_err Do not use useless private macros Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260305102905.2392512-5-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit ef0c4a4f04cbd4126311e2056d553c8c953d112d Author: Oliver Neukum Date: Thu Mar 5 11:28:34 2026 +0100 usb: image: microtek: remove unused macro No users left. Remove it. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260305102905.2392512-4-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit ca1f98576e4b363da96c32f7130af0bb29d85912 Author: Oliver Neukum Date: Thu Mar 5 11:28:33 2026 +0100 usb: image: microtek: remove outdated comment The comment is no longer true Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260305102905.2392512-3-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 9197136fe4b0ac637ee40c84be45baa6c2a9ed22 Author: Oliver Neukum Date: Thu Mar 5 11:28:32 2026 +0100 usb: image: microtek: remove function trace macro This functionality has been obsoleted by ftrace Remove it Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260305102905.2392512-2-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 04e82f27d4c53542bdfb0d0d65985b339e32f884 Author: Oliver Neukum Date: Thu Mar 5 11:28:31 2026 +0100 usb: image: microtek: cleanup ep handling We now have macros for endpoint numbers, types and directions. Use them. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260305102905.2392512-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit fa305f884c84e889d40806a1b09aeab0081ff12c Author: Xu Yang Date: Wed Mar 4 19:39:16 2026 +0800 usb: dwc3: fix a typo 'HishSpeed' It should be 'HighSpeed' instead of 'HishSpeed'. Signed-off-by: Xu Yang Reviewed-by: Daniel Baluta Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260304113916.856841-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 7cc9508563f0b9ab2b54d1f1167040bd81373bf6 Author: Xu Yang Date: Wed Mar 4 19:39:15 2026 +0800 usb: dwc3: fix a kernel-doc issue Add '*' to needs_full_reinit comment line to fix a kernel-doc issue. Signed-off-by: Xu Yang Acked-by: Thinh Nguyen Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20260304113916.856841-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 9fc2232e285bbd3d71c251376255d7fb2ae34f73 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:36 2026 +0100 vdso/gettimeofday: Add explicit includes Various used symbols are only visible through transitive includes. These transitive includes are about to go away. Explicitly include the necessary headers. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-10-35d60acf7410@linutronix.de commit 32bd966050486d3fed6980aa3de3e60b9e383589 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:35 2026 +0100 random: vDSO: Add explicit includes Various used symbols are only visible through transitive includes. These transitive includes are about to go away. Explicitly include the necessary headers. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Acked-by: Jason A. Donenfeld Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-9-35d60acf7410@linutronix.de commit 5dca096e865fbf37febb4dde26d9a52288da6db3 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:34 2026 +0100 MIPS: vdso: Explicitly include asm/vdso/vdso.h The usage of __VDSO_PAGES requires asm/vdso/vdso.h. Currently this header is included transitively, but that transitive inclusion is about to go away. Explicitly include the header. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-8-35d60acf7410@linutronix.de commit a9d7e1ea5897477d704bd03eaa93d19634e90523 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:33 2026 +0100 MIPS: vdso: Add include guard to asm/vdso/vdso.h An upcomming patch will lead to the header file being included multiple times from the same source file. Add an include guard so this is possible. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-7-35d60acf7410@linutronix.de commit 55434071cdcf50f6c2da9a9ecafb32465fb3bf13 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:32 2026 +0100 LoongArch: vDSO: Explicitly include asm/vdso/vdso.h The usage of 'struct old_timespec32' requires asm/vdso/vdso.h. Currently this header is included transitively, but that transitive inclusion is about to go away. Explicitly include the header. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-6-35d60acf7410@linutronix.de commit 9c89d8bd64b8c03ad3d5b6fd52550b8773a12669 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:31 2026 +0100 powerpc/vdso: Explicitly include asm/cputable.h and asm/feature-fixups.h The usage of ASM_FTR_IFCLR(CPU_TR_ARCH_31) requires asm/cputable.h and asm/feature-fixups.h. Currently these headers are included transitively, but that transitive inclusion is about to go away. Explicitly include the headers. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Christophe Leroy Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-5-35d60acf7410@linutronix.de commit 3852dd5abc306a64060266a20b64d46a3037b735 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:30 2026 +0100 powerpc/vdso/gettimeofday: Explicitly include vdso/time32.h The usage of 'struct old_timespec32' requires vdso/time32.h. Currently this header is included transitively, but that transitive inclusion is about to go away. Explicitly include the header. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Christophe Leroy Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-4-35d60acf7410@linutronix.de commit 89e6796fa530a90059c63b7c02e54a426d278c9b Author: Thomas Weißschuh Date: Fri Feb 27 07:44:29 2026 +0100 ARM: vdso: gettimeofday: Add explicit includes The reference to VDSO_CLOCKMODE_NONE requires vdso/clocksource.h and 'struct old_timespec32' requires vdso/time32.h. Currently these headers are included transitively, but those transitive inclusions are about to go away. Explicitly include the headers. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-3-35d60acf7410@linutronix.de commit 2b8cf39d7e0b4964d27f499e74aed7e5e06dafd4 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:28 2026 +0100 arm64: vDSO: compat_gettimeofday: Add explicit includes The reference to VDSO_CLOCKMODE_ARCHTIMER requires vdso/clocksource.h and 'struct old_timespec32' requires vdso/time32.h. Currently these headers are included transitively, but those transitive inclusions are about to go away. Explicitly include the headers. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Acked-by: Catalin Marinas Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-2-35d60acf7410@linutronix.de commit b18ec8b5e0ceb311d860c6521a00056a60cbd5b1 Author: Thomas Weißschuh Date: Fri Feb 27 07:44:27 2026 +0100 arm64: vDSO: gettimeofday: Explicitly include vdso/clocksource.h The reference to VDSO_CLOCKMODE_NONE requires vdso/clocksource.h. Currently this header is included transitively, but that transitive inclusion is about to go away. Explicitly include the header. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Acked-by: Catalin Marinas Link: https://patch.msgid.link/20260227-vdso-header-cleanups-v2-1-35d60acf7410@linutronix.de commit 0c02d6df15d4bf7376a965b66d92ad31b0e458fd Author: Thomas Weißschuh Date: Fri Feb 27 07:43:23 2026 +0100 vdso/gettimeofday: Move the unlikely() into vdso_read_retry() All callers of vdso_read_retry() test its return value with unlikely(). Move the unlikely into the helper to make the code easier to read. This is equivalent to the retry function of non-vDSO seqlocks. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-cleanups-v1-4-c848b4bc4850@linutronix.de commit a657bebd7f02d0ec1ddb08c1d8c572fe1e187f9c Author: Thomas Weißschuh Date: Fri Feb 27 07:43:22 2026 +0100 vdso/gettimeofday: Add a helper to test if a clock is namespaced Currently this logic is duplicate multiple times. Add a helper for it to make the code more readable. [ bp: Add a missing clocksource.h include, see https://lore.kernel.org/r/20260311113435-f72f81d8-33a6-4a0f-bd80-4997aad068cc@linutronix.de ] Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260227-vdso-cleanups-v1-3-c848b4bc4850@linutronix.de commit 5d79c525405dcf9611c1f019b0aa05d72f0186ae Author: Sebastian Reichel Date: Tue Mar 10 18:17:34 2026 +0100 usb: typec: fusb302: add DRM DP HPD bridge support Add support to use fusb302 based USB-C connectors with the DP altmode helper code on devicetree based platforms. To get this working there must be a DRM bridge chain from the DisplayPort controller to the USB-C connector. E.g. on Rockchip RK3576: root@rk3576 # cat /sys/kernel/debug/dri/0/encoder-0/bridges bridge[0]: dw_dp_bridge_funcs refcount: 7 type: [10] DP OF: /soc/dp@27e40000:rockchip,rk3576-dp ops: [0x47] detect edid hpd bridge[1]: drm_aux_bridge_funcs refcount: 4 type: [0] Unknown OF: /soc/phy@2b010000:rockchip,rk3576-usbdp-phy ops: [0x0] bridge[2]: drm_aux_hpd_bridge_funcs refcount: 5 type: [10] DP OF: /soc/i2c@2ac50000/typec-portc@22/connector:usb-c-connector ops: [0x4] hpd Signed-off-by: Sebastian Reichel Acked-by: Heikki Krogerus Link: https://patch.msgid.link/20260310-fusb302-drm-dp-hpd-bridge-v1-1-ffd41ef9afe3@collabora.com Signed-off-by: Greg Kroah-Hartman commit afcba2ced16676c7771d4c2e2ccdb62a8bb33d43 Author: Pengyu Luo Date: Thu Mar 5 22:40:36 2026 +0800 usb: ucsi: huawei_gaokun: make gaokun_ucsi_ops static The gaokun_ucsi_ops structure is only used within its translation unit and is not referenced from any other file. Add the 'static' qualifier to avoid unnecessary symbol export. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603050203.KD4RWA00-lkp@intel.com Signed-off-by: Pengyu Luo Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260305144054.27848-1-mitltlatltl@gmail.com Signed-off-by: Greg Kroah-Hartman commit 26cf0917142897f052e2966e265917e4593340d5 Author: Rosen Penev Date: Thu Mar 5 19:16:39 2026 -0800 usb: typec: tcpm: kzalloc + kcalloc to kzalloc_flex Simplifies allocation and allows using __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Reviewed-by: Gustavo A. R. Silva Link: https://patch.msgid.link/20260306031639.46942-1-rosenp@gmail.com Signed-off-by: Greg Kroah-Hartman commit a28de63356575612954d4e5d5f48a2488f50e16d Author: Ingo Rohloff Date: Thu Mar 5 13:14:52 2026 +0100 usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation. The Microchip USB3340x ULPI PHY requires a delay when switching to the high-speed transmitter. See: http://ww1.microchip.com/downloads/en/DeviceDoc/80000645A.pdf Module 2 "Device Enumeration Failure with Link IP Systems" For details on the behavior and fix, refer to the AMD (formerly Xilinx) forum post: "USB stuck in full speed mode with USB3340 ULPI PHY, ZynqMP." This patch uses the USB PHY Vendor-ID and Product-ID to detect the USB3340 PHY and then applies the necessary fix if this PHY is found. Signed-off-by: Ingo Rohloff Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260305121452.54082-2-ingo.rohloff@lauterbach.com Signed-off-by: Greg Kroah-Hartman commit d740dcd1fa7b9cd86f10f1badc173b952fdc375f Author: Oliver Neukum Date: Wed Mar 4 17:07:30 2026 +0100 usb: uss720: unify error handling in probe There is a lot of code duplication. Unify it. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260304160734.1742200-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit fc12cd6bce1da3f1048f00ce6b6080cce47144b0 Author: Alexey Charkov Date: Tue Feb 17 14:12:00 2026 +0400 usb: misc: onboard_usb_dev: Add support for requesting VBUS for Type-A ports Add a regulator-only entry matching OF-described USB Type-A connectors. This allows platforms to explicitly model VBUS supply regulators for these ports instead of calling them PHY supplies or making the respective regulators always-on in their device trees. Type-A ports won't typically need a dedicated driver, as there is nothing to configure apart from the power supply, so there is no controller driver to traverse the OF graph and request the VBUS regulator, unlike for Type-C ports. Thus make it an onboard USB device, which it kind of really is. Signed-off-by: Alexey Charkov Link: https://patch.msgid.link/20260217-typea-vbus-v1-1-657b4e55a4c2@flipper.net Signed-off-by: Greg Kroah-Hartman commit 282b8eec8a4eab9a3ff3addf6dad2ce699594fe8 Author: Oliver Neukum Date: Tue Feb 10 13:22:08 2026 +0100 net: cdc-ncm: cleanup device descriptor Flags are boolean values, hence they should be typed as bool, not as u8. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260210122208.29244-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit bb24a1c09d7f848fb5a453b0ffc95a29b888907d Author: Gabor Juhos Date: Sat Feb 21 10:02:37 2026 +0100 usb: ehci-orion: remove optional PHY handling code remnants Since the USB core code handles the generic USB PHYs automatically, the optional PHY handling code has been removed from the 'ehci-orion' driver entirely by commit e04585184dcf ("usb: ehci-orion: avoid double PHY initialization"). However, the devm_phy_optional_get() call has been kept so the driver still gets the PHY even though it is not used for anything in the driver. Drop the remaining code, and also remove the 'phy' member of the 'orion_ehci_hcd' structure to simplify the code. Acked-by: Alan Stern Signed-off-by: Gabor Juhos Reviewed-by: Miquel Raynal Link: https://patch.msgid.link/20260221-ehci-orion-drop-phy-handling-v2-1-5e26aa73790b@gmail.com Signed-off-by: Greg Kroah-Hartman commit dc3cf736a5cb63dea1158c267e168ca410d02fa4 Author: Conor Dooley Date: Tue Mar 3 16:37:39 2026 +0000 dt-bindings: usb: mpfs-musb: permit resets The musb IP on mpfs and pic64gx has a reset pin, but until now this has been undocumented because platform firmware takes the block out of reset on first-party boards (or those using modified versions of the vendor firmware), but not all boards may take this approach. Permit providing a reset in devicetree for Linux, or other devicetree-consuming software, to use. Signed-off-by: Conor Dooley Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260303-backspace-unhearing-c6cc8cbddbba@spud Signed-off-by: Greg Kroah-Hartman commit d0ef3c4a9fa3b4694a187f277527664919c2ecb4 Author: Diogo Ivo Date: Tue Jan 27 15:11:48 2026 +0000 usb: xhci: tegra: Remove redundant mutex when setting phy mode As the PHY subsystem already synchronizes concurrent accesses to a PHY instance with a core-internal mutex remove the driver specific mutex synchronization. Signed-off-by: Diogo Ivo Link: https://patch.msgid.link/20260127-diogo-tegra_phy-v2-2-787b9eed3ed5@tecnico.ulisboa.pt Signed-off-by: Greg Kroah-Hartman commit 45955006cc29bfb7fd436b8e7e2197d9bdc30af9 Author: Anjelique Melendez Date: Mon Feb 9 12:49:14 2026 -0800 usb: typec: ucsi: ucsi_glink: Add support for Glymur and Kaanapali Add Glymur and Kaanapali compatible strings which both need UCSI_DELAY_DEVICE_PDOS quirk. Signed-off-by: Anjelique Melendez Reviewed-by: Dmitry Baryshkov Reviewed-by: Heikki Krogerus Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260209204915.1983997-5-anjelique.melendez@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit ee11e0c45954d1d91f4d92c92d2e394e0032b2d4 Author: Alexander Stein Date: Thu Feb 26 16:38:50 2026 +0100 dt-bindings: usb: cdns,usb3: support USB devices in DT Reference usb-xhci.yaml in host mode in order to support on-board USB hubs. Signed-off-by: Alexander Stein Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260226153859.665901-2-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman commit 94ef278e7439c875b83ddbeddb92d1580d566a0c Merge: 4ba5c63778e5cc 8a99ccb032d670 Author: Mark Brown Date: Wed Mar 11 13:34:14 2026 +0000 Merge patch series "ASoC: Intel: catpt: Overhaul volume and mute control operations" Cezary Rojewski says: ASoC: Intel: catpt: Overhaul volume and mute control operations Short summary first, longer description later: - fix the return code for kctl->put() - currently the driver returns '0' even if changes were done - lower power consumption for kctl operations by waking the DSP only when some streaming is done. No streaming? Cache the values and inform the AudioDSP firmware later. - drop the existing code duplication between individual and master volume controls The very first patch addresses synchronization problem that exists when an individual control and its paired stream are manipulated by a user simultaneously. As the refactor integrates the fix in its new code, most of it gets shuffled but in case of a "refactor problem" I've decided to have it separated and leading the series. This way the problem is fixed even if refactor, for whatever reason, would be reverted. -- More of in-depth explanation for the refactor, taken from commit 2: The catpt-driver's volume and mute control operations always return '0' regardless if a change occurred or not. To conform to ALSA's interface, value '1' shall be returned when a change occurred. The second major point is power consumption. Existing control operations always wake the DSP even if no streams are running. In such case waking the DSP just for the sake of updating the volume (or mute) settings on the firmware side is a waste of power. The provided implementation caches the values and updates the settings only when streams are being opened for streaming or are already running. As changing existing code is non-trivial, provide new operations instead. The put() operation, which interests us the most, takes the following shape: // two values provided to put(): // @pin_id - which stream given control relates to // @value_to_apply - the value from user if (control->existing_val == value_to_apply) return 0; runtime_stream = get_running_stream(pin_id); if (runtime_stream != NULL) { ret = send_ipc(); if (ret) return ret; } control->existing_val = value_to_apply; return 1; Adheres to ALSA's expectation and avoids sending IPCs if there is no change to be made. commit 8a99ccb032d670eae2b1ea89174e06a60d2d3fc2 Author: Cezary Rojewski Date: Mon Mar 9 10:16:05 2026 +0100 ASoC: Intel: catpt: Migrate to the new control operations Switch to the new implementation and remove all unused code. The change effectively causes the control put() operations to return '1' if a change occurred, '0' if no change was made or error otherwise. The second effect of the update is reducing the power consumption. With the new control-operations in place, the controls no longer wake the DSP just for the sake of updating volume (or mute) settings on the firmware side. The values are cached and actual update occurs only when streams are being opened for streaming or are already running. Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20260309091605.896307-6-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 150badf73e9a10cf646d07353b41117ea90f67ae Author: Cezary Rojewski Date: Mon Mar 9 10:16:04 2026 +0100 ASoC: Intel: catpt: Do not wake DSP just for volume setup With the new control-operations in place, the controls no longer wake the DSP just for the sake of updating volume (or mute) settings on the firmware side. The values are cached and actual update occurs only when streams are being opened for streaming or are already running. In those cases the DSP must already be woken up and we avoid unnecessary power consumption. Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20260309091605.896307-5-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 2464febd81e4c98f78466462da938ed2f8c37e17 Author: Cezary Rojewski Date: Mon Mar 9 10:16:03 2026 +0100 ASoC: Intel: catpt: Simplify procedure of applying user settings Existing catpt_dai_apply_usettings() applies all the individual control settings but why-what is covered behind if-statements. Refactor the operation into: catpt_apply_controls() |__ catpt_apply_volume() |__ catpt_apply_mute() to make it easy to understand why and what is going on. The update also enlists snd_ctl_find_id_mixer() for the query purpose, removing code duplication. Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20260309091605.896307-4-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit d16b942aa7fa6135a44d156246d98e50b5a0aad3 Author: Cezary Rojewski Date: Mon Mar 9 10:16:02 2026 +0100 ASoC: Intel: catpt: New volume and mute control operations The catpt-driver's volume and mute control operations always return '0' regardless if a change occurred or not. To conform to ALSA's interface, value '1' shall be returned when a change occurred. The second major point is power consumption. Existing control operations always wake the DSP even if no streams are running. In such case waking the DSP just for the sake of updating the volume (or mute) settings on the firmware side is a waste of power. The provided implementation caches the values and updates the settings only when streams are being opened for streaming or are already running. As changing existing code is non-trivial, provide new operations instead. The put() operation, which interests us the most, takes the following shape: // two values provided to put(): // pin_id - which stream given control relates to // value_to_apply - the value from user if (control->existing_val == value_to_apply) return 0; runtime_stream = get_running_stream(pin_id); if (runtime_stream != NULL) { ret = send_ipc(); if (ret) return ret; } control->existing_val = value_to_apply; return 1; Adheres to ALSA's expectation and avoids sending IPCs if there is no change to be made. Two helpers which are part of the patch, catpt_stream_hw_id() and catpt_stream_volume_regs(), help differentiate between individual streams and the general MIXER stream. Translates to one pair of get()/put() instead of two pairs as done currently. PIN_ID_INVALID is returned if given stream is not currently running - the constant is part of the firmware's API but remained unused by the driver. Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20260309091605.896307-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit b0b49c77bddac75db79f7c2c6ec0b07d61864f2f Author: Cezary Rojewski Date: Mon Mar 9 10:16:01 2026 +0100 ASoC: Intel: catpt: Synchronize stream access Streams may have individual controls assigned to them e.g.: volume control in case of offload streams. If such a stream is running and simultaneously its controls are being manipulated, both processes are touching the exact same descriptors - access to these must be synchronized. Replace spinlock with mutex as IPCs are non-atomic operations and add proper locking for all ->stream_list users. Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20260309091605.896307-2-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 2344b93af8eb5da5d496b4e0529d35f0f559eaf0 Author: Imre Deak Date: Mon Mar 9 18:48:03 2026 +0200 drm/i915/dmc: Fix an unlikely NULL pointer deference at probe intel_dmc_update_dc6_allowed_count() oopses when DMC hasn't been initialized, and dmc is thus NULL. That would be the case when the call path is intel_power_domains_init_hw() -> {skl,bxt,icl}_display_core_init() -> gen9_set_dc_state() -> intel_dmc_update_dc6_allowed_count(), as intel_power_domains_init_hw() is called *before* intel_dmc_init(). However, gen9_set_dc_state() calls intel_dmc_update_dc6_allowed_count() conditionally, depending on the current and target DC states. At probe, the target is disabled, but if DC6 is enabled, the function is called, and an oops follows. Apparently it's quite unlikely that DC6 is enabled at probe, as we haven't seen this failure mode before. It is also strange to have DC6 enabled at boot, since that would require the DMC firmware (loaded by BIOS); the BIOS loading the DMC firmware and the driver stopping / reprogramming the firmware is a poorly specified sequence and as such unlikely an intentional BIOS behaviour. It's more likely that BIOS is leaving an unintentionally enabled DC6 HW state behind (without actually loading the required DMC firmware for this). The tracking of the DC6 allowed counter only works if starting / stopping the counter depends on the _SW_ DC6 state vs. the current _HW_ DC6 state (since stopping the counter requires the DC5 counter captured when the counter was started). Thus, using the HW DC6 state is incorrect and it also leads to the above oops. Fix both issues by using the SW DC6 state for the tracking. This is v2 of the fix originally sent by Jani, updated based on the first Link: discussion below. Link: https://lore.kernel.org/all/3626411dc9e556452c432d0919821b76d9991217@intel.com Link: https://lore.kernel.org/all/20260228130946.50919-2-ltao@redhat.com Fixes: 88c1f9a4d36d ("drm/i915/dmc: Create debugfs entry for dc6 counter") Cc: Mohammed Thasleem Cc: Jani Nikula Cc: Tao Liu Cc: # v6.16+ Tested-by: Tao Liu Reviewed-by: Jani Nikula Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260309164803.1918158-1-imre.deak@intel.com commit 91910a4047e4d3c85e140604c9b75097bb8f0329 Author: Conor Dooley Date: Tue Mar 10 17:58:27 2026 +0000 dt-bindings: pinctrl: pincfg-node: permit bias-high-impedance with other bias properties It is possible that devices tristate buffers may set the buffer to the high-Z state in addition to setting pull-up or pull-down on a pin. Remove this particular restriction to prevent warning on zynqmp systems where this configuration seems to be valid. Reported-by: Rob Herring (Arm) Fixes: a901e8705f89f ("dt-bindings: pinctrl: pincfg-node: add restrictions on conflicting properties") Signed-off-by: Conor Dooley Signed-off-by: Linus Walleij commit b90d398138ab3088d168cacb2c3d5248feaa1ef7 Author: Yazen Ghannam Date: Sat Mar 7 11:33:16 2026 -0500 x86/mce, EDAC/mce_amd: Add new SMCA bank types Recognize new SMCA bank types and include their short names for sysfs and long names for decoding. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260307163316.345923-4-yazen.ghannam@amd.com commit b595a009726b706fdadedace90c54831e19188e2 Author: Yazen Ghannam Date: Sat Mar 7 11:33:15 2026 -0500 x86/mce, EDAC/mce_amd: Update CS bank type naming Recent documentation updated the "CS" bank type name from "Coherent Slave" to "Coherent Station". Apply this change in the kernel also. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260307163316.345923-3-yazen.ghannam@amd.com commit bee9f4178b4a3fec70414c82ddc4bceff182f2ba Author: Yazen Ghannam Date: Sat Mar 7 11:33:14 2026 -0500 x86/mce, EDAC/mce_amd: Reorder SMCA bank type enums Originally, the SMCA bank type enums were ordered based on processor documentation. However, the ordering became inconsistent after new bank types were added over time. Sort the bank type enums alphanumerically in most places. Sort the "enum to HWID/McaType" mapping by HWID/McaType. Drop redundant code comments. No functional changes. [ bp: Sort them alphanumerically. ] Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260307163316.345923-2-yazen.ghannam@amd.com commit 97545e37234fdbe457f5104a09f55033550b3d84 Author: Pei Xiao Date: Wed Mar 11 09:55:13 2026 +0800 spi: atcspi200: Use helper function devm_clk_get_enabled() Since commit 7ef9651e9792 ("clk: Provide new devm_clk helpers for prepared and enabled clocks"), devm_clk_get() and clk_prepare_enable() can now be replaced by devm_clk_get_enabled(). Moreover, it is no longer necessary to unprepare and disable the clocks explicitly. Signed-off-by: Pei Xiao Link: https://patch.msgid.link/e53aefc63e28caf32bcd553f3d0a8f2a5a25cd8d.1773193726.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit ed1021fbf98ea88732d56583884c77297ef75aab Author: Karol Wachowski Date: Tue Mar 10 13:07:35 2026 +0100 accel/ivpu: Apply minor code style cleanups to align with kernel style Replace direct import_attach test with drm_gem_is_imported() in ivpu_bo_bind(). Replace kzalloc(sizeof(*bo), GFP_KERNEL) with kzalloc_obj() in ivpu_gem_create_object(). Remove unnecessary cast to bool in ivpu_dbg_bo(). No functional changes. Reviewed-by: Maciej Falkowski Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260310120736.3341679-1-karol.wachowski@linux.intel.com commit d51de21b4c3a34a2cc592319df63864e14b18b29 Author: Artem Bityutskiy Date: Mon Mar 9 10:38:18 2026 +0200 intel_idle: Add Panther Lake C-states table Panther Lake supports the following requestable C-states: C1, C1E, C6S, C10. The parameters of these C-states should be consistent across all systems based on Panther Lake, so add a custom C-states table for it that will override C-state parameters supplied by platform firmware that may vary from one platform to another and may not represent the most optimum choice. Signed-off-by: Artem Bityutskiy [ rjw: Changelog expansion ] Link: https://patch.msgid.link/20260309083818.79588-1-dedekind1@gmail.com Signed-off-by: Rafael J. Wysocki commit be473f0591f183990a998edee02161b319047eaa Author: Pengjie Zhang Date: Wed Mar 11 15:13:34 2026 +0800 ACPI: CPPC: Fix uninitialized ref variable in cppc_get_perf_caps() Commit 8505bfb4e4ec ("ACPI: CPPC: Move reference performance to capabilities") introduced a logical error when retrieving the reference performance. On platforms lacking the reference performance register, the fallback logic leaves the local 'ref' variable uninitialized (0). This causes the subsequent sanity check to incorrectly return -EFAULT, breaking amd_pstate initialization. Fix this by assigning 'ref = nom' in the fallback path. Fixes: 8505bfb4e4ec ("ACPI: CPPC: Move reference performance to capabilities") Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/all/20260310003026.GA2639793@ax162/ Tested-by: Nathan Chancellor Signed-off-by: Pengjie Zhang [ rjw: Subject tweak ] Link: https://patch.msgid.link/20260311071334.1494960-1-zhangpengjie2@huawei.com Signed-off-by: Rafael J. Wysocki commit 58351f46de26bcc4403f9972f7aed430d15cbd03 Merge: 5f0a63f81a027b 1f318b96cc84d7 Author: Simona Vetter Date: Wed Mar 11 11:09:21 2026 +0100 Merge v7.0-rc3 into drm-next Requested by Maxime Ripard for drm-misc-next because renesas people need fb797a70108f ("drm: renesas: rz-du: mipi_dsi: Set DSI divider"). Signed-off-by: Simona Vetter commit aa2132799817fb052d95a87f0c23cc6af38541c0 Author: Yassine Oudjana Date: Wed Mar 4 22:33:56 2026 +0530 power: supply: add support for S2MU005 battery fuel gauge device Samsung's S2MU005 PMIC, which contains battery charger functionality also includes a battery fuel gauge device, which is separate from the PMIC itself, and typically connected to an I2C bus. Add a generic driver to support said device. Signed-off-by: Yassine Oudjana Co-developed-by: Kaustabh Chakraborty Signed-off-by: Kaustabh Chakraborty Link: https://patch.msgid.link/20260304-s2mu005-fuelgauge-v3-2-e4dc4e47cde8@disroot.org [Moved mutex init before power-supply registration] Signed-off-by: Sebastian Reichel commit d74b4fcc8093f9dc84172adf15f93b858d3daaac Author: Kaustabh Chakraborty Date: Wed Mar 4 22:33:55 2026 +0530 dt-bindings: power: supply: document Samsung S2MU005 battery fuel gauge Samsung S2MU005 is a PMIC device which has LED controllers, an MUIC and a battery charger. The battery charger is paired with an independent device connected via I2C which can be used to access various metrics of the battery. Document the device as a schema. Reviewed-by: Rob Herring (Arm) Acked-by: Conor Dooley Signed-off-by: Kaustabh Chakraborty Link: https://patch.msgid.link/20260304-s2mu005-fuelgauge-v3-1-e4dc4e47cde8@disroot.org Signed-off-by: Sebastian Reichel commit 382db565d7a2cc732ea78edd147b0ed76f00080c Author: Jani Nikula Date: Mon Mar 2 20:17:39 2026 +0200 drm/i915/frontbuffer: reduce fb for frontbuffer abbreviation usage Using fb for frontbuffer is a bit misleading, as framebuffer is the more common fb. Reduce fb usage in frontbuffer function naming. Reviewed-by: Jouni Högander Link: https://patch.msgid.link/f7f04d63771891d1c3b1aa280485437bc4a70f20.1772475391.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit fa5f1836f95785548cceccc6865e0a65a9fbda0b Author: Jani Nikula Date: Mon Mar 2 20:17:38 2026 +0200 drm/i915/frontbuffer: call parent interface directly Do away with the redundant intel_frontbuffer_get(), intel_frontbuffer_put(), and intel_frontbuffer_ref() functions, and call the parent interface functions directly. Reviewed-by: Jouni Högander Link: https://patch.msgid.link/7451574d6840fe9a4af16d2d6b81ffb7739b5b76.1772475391.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 2cca25160d159e6351e3273b088db0b4f359ef6a Author: Jani Nikula Date: Mon Mar 2 20:17:37 2026 +0200 drm/{i915, xe}/frontbuffer: move frontbuffer handling to parent interface Move the get/put/ref/flush_for_display calls to the display parent interface. For i915, move the hooks next to the other i915 core frontbuffer code in i915_gem_object_frontbuffer.c. For xe, add new file xe_frontbuffer.c for the same. Note: The intel_frontbuffer_flush() calls from i915_gem_object_frontbuffer.c will partially route back to i915 core via the parent interface. This is less than stellar. Reviewed-by: Jouni Högander Link: https://patch.msgid.link/f69b967ed82bbcfd60ffa77ba197b26a1399f09f.1772475391.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 6a3e5eb3c51dbd01ca46c2c40a67bea1dd845cdb Author: Jani Nikula Date: Mon Mar 2 20:17:36 2026 +0200 drm/intel: fix @dpt kernel-doc for parent interface Fix the copy-paste fail. Reviewed-by: Jouni Högander Link: https://patch.msgid.link/0209e128312520ca1c6a0c39f9dfb0184125322a.1772475391.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit df88ba8904ce23483889e3397814e91366e729b0 Author: Jani Nikula Date: Mon Mar 2 20:17:35 2026 +0200 drm/i915/overlay: convert from struct intel_frontbuffer to i915_frontbuffer The intel_frontbuffer_get() and intel_frontbuffer_put() calls are routed through intel_frontbuffer.c to i915_gem_object_frontbuffer.c. We might as well call the functions directly, instead of going through display code. This would only get worse with get/put being moved to the parent interface. To make this easier, convert overlay code from struct intel_frontbuffer to struct i915_frontbuffer, and add a i915_gem_object_frontbuffer_track() wrapper for clarity. Reviewed-by: Jouni Högander Link: https://patch.msgid.link/829b304a6451e80fbce554bdc7788077245e803a.1772475391.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit e18eec6c299a194f3efaedc61f05d881697f07a8 Author: Jani Nikula Date: Mon Mar 2 20:17:34 2026 +0200 drm/i915/gem: unify i915 gem object frontbuffer function names Many of the i915 gem object frontbuffer function names follow the file name as prefix. Follow suit with the remaining functions, renaming them i915_gem_object_frontbuffer_*(). Reviewed-by: Jouni Högander Link: https://patch.msgid.link/3415b59497f2c3a79586600d259eeaf58be73498.1772475391.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 8828edabb9318817a55c91f1f2a5d65a26559f86 Author: Jani Nikula Date: Mon Mar 2 20:17:33 2026 +0200 drm/i915/gem: relocate __i915_gem_object_{flush, invalidate}_frontbuffer() Move __i915_gem_object_{flush,invalidate}_frontbuffer() to i915_gem_object_frontbuffer.c. All the other i915 gem object frontbuffer functions are there already, and the relevant declarations are in i915_gem_object_frontbuffer.h too. Reviewed-by: Jouni Högander Link: https://patch.msgid.link/d779ef44b4b43feda9df63f1225a947a9cd23ba8.1772475391.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit b7fff045a9f8d15d78ae3206ab393f55bf9c383d Author: Philipp Hahn Date: Tue Mar 10 12:49:07 2026 +0100 pinctrl: Prefer IS_ERR_OR_NULL over manual NULL check Prefer using IS_ERR_OR_NULL() over using IS_ERR() and a manual NULL check. Change generated with coccinelle. To: Linus Walleij Cc: linux-gpio@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Philipp Hahn Signed-off-by: Linus Walleij commit ed78b7b2c5ae679960469c0f679539c427e051ab Author: Thomas Weißschuh Date: Fri Feb 27 07:43:21 2026 +0100 vdso/gettimeofday: Add a helper to read the sequence lock of a time namespace aware clock Currently there are three different open-coded variants of a time namespace aware variant of vdso_read_begin(). They make the code hard to read and introduce an inconsistency, as only the first copy uses unlikely(). Split the code into a shared helper function. Move that next to the definition of the regular vdso_read_begin(), so that any future changes can be kept in sync easily. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260227-vdso-cleanups-v1-2-c848b4bc4850@linutronix.de commit 08cd5e1de815842089ca3938c3ad7ac511097d70 Author: Thomas Weißschuh Date: Fri Feb 27 07:43:20 2026 +0100 vdso/gettimeofday: Drop a few usages of __maybe_unused These functions are used from the very same file, so this annotation is unnecessary. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260227-vdso-cleanups-v1-1-c848b4bc4850@linutronix.de commit c453b9abb4f422461c1493ef74d63af0961a2d30 Author: Arnd Bergmann Date: Wed Mar 4 08:49:11 2026 +0100 clocksource: Remove ARCH_CLOCKSOURCE_DATA After sparc64, there are no remaining users of ARCH_CLOCKSOURCE_DATA and it can just be removed. Signed-off-by: Arnd Bergmann Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Acked-by: John Stultz Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-14-d8eb3b0e1410@linutronix.de [Thomas: drop sparc64 bits from the patch] commit 1628f6a742702071e9d67c47185562e3ab6e6755 Author: Thomas Weißschuh Date: Wed Mar 4 08:49:10 2026 +0100 sparc64: vdso: Implement clock_gettime64() To be y2038-safe, 32-bit userspace needs to explicitly call the 64-bit safe time APIs. Implement clock_gettime64() in the 32-bit vDSO. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Acked-by: Andreas Larsson Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-13-d8eb3b0e1410@linutronix.de commit 168d23e5762b8bad9c7a14b130179dc561c0b13a Author: Thomas Weißschuh Date: Wed Mar 4 08:49:09 2026 +0100 sparc64: vdso2c: Remove symbol handling There are no handled symbols left. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Acked-by: Andreas Larsson Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-12-d8eb3b0e1410@linutronix.de commit fb57f3e7d5dc2c9ea195c5a7774412b6ffaf276d Author: Thomas Weißschuh Date: Wed Mar 4 08:49:08 2026 +0100 sparc64: vdso2c: Drop sym_vvar_start handling After the adoption of the generic vDSO library this symbol does not exist. The alignment invariant is now guaranteed by the generic code. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Acked-by: Andreas Larsson Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-11-d8eb3b0e1410@linutronix.de commit 7c5fc16c7a5699e7706d7847e58a75560251946e Author: Thomas Weißschuh Date: Wed Mar 4 08:49:07 2026 +0100 sparc64: vdso: Switch to the generic vDSO library The generic vDSO provides a lot common functionality shared between different architectures. SPARC is the last architecture not using it, preventing some necessary code cleanup. Make use of the generic infrastructure. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Acked-by: Andreas Larsson Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-10-d8eb3b0e1410@linutronix.de commit e13e3059dcc27b0b79603925e68200a148b2ef4e Author: Thomas Weißschuh Date: Wed Mar 4 08:49:06 2026 +0100 sparc64: vdso: Introduce vdso/processor.h The generic vDSO library expects a vdso/processor.h with an definition of cpu_relax(). Split out cpu_relax() into this dedicated header. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Acked-by: Andreas Larsson Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-9-d8eb3b0e1410@linutronix.de commit d60c682bce3dce963d6cf8208ed60d586004ce49 Author: Thomas Weißschuh Date: Wed Mar 4 08:49:05 2026 +0100 sparc64: vdso: Move syscall fallbacks into header The generic vDSO libraries expected the syscall fallbacks in asm/vdso/gettimeofday.h. To prepare the adoption of the generic library, move the existing functions there. While at it, rename them so they match what the generic library expects. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Acked-by: Andreas Larsson Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-8-d8eb3b0e1410@linutronix.de commit 10fdbd9517e833de31911c29c5ff2494d62a5551 Author: Thomas Weißschuh Date: Wed Mar 4 08:49:04 2026 +0100 sparc64: vdso: Move hardware counter read into header The generic vDSO libraries expected the architecture glue around hardware counter reading in asm/vdso/gettimeofday.h. To prepare the adoption of the generic library, move the existing functions there. While at it, perform some trivial alignment with the generic vDSO library: * Drop 'notrace', as the functions are __always_inline anyways * Use the same parameter types * Use the same function names Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Acked-by: Andreas Larsson Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-7-d8eb3b0e1410@linutronix.de commit 7b4ee085e760cf77993ceca2b7d6a76ab0870d2c Author: Thomas Weißschuh Date: Wed Mar 4 08:49:03 2026 +0100 sparc64: vdso: Replace code patching with runtime conditional The patching logic is unnecessarily complicated and stands in the way of the adoption of the generic vDSO framework. Replace it by a simple runtime switch, similar to other architectures. Suggested-by: Thomas Gleixner Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Acked-by: Andreas Larsson Link: https://lore.kernel.org/lkml/87ecu9tfhw.ffs@tglx/ Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-6-d8eb3b0e1410@linutronix.de commit 9fc4fe6e142ae574a494ae4018b3992b7d5b7d58 Author: Thomas Weißschuh Date: Wed Mar 4 08:49:02 2026 +0100 sparc64: vdso: Remove obsolete "fake section table" reservation When the vDSO logic was copied from x86 to SPARC some unused remnants of the fake section handling were copied, too. In x86 the original fake section handling had already been removed incompletely in commit da861e18eccc ("x86, vdso: Get rid of the fake section mechanism"). On x86 the reservation was only cleaned up in commit 24b7c77bbb24 ("x86/vdso: Remove obsolete "fake section table" reservation"). Remove the reservation for SPARC, too. Fixes: 9a08862a5d2e ("vDSO for sparc") Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Acked-by: Andreas Larsson Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-5-d8eb3b0e1410@linutronix.de commit acc4f131d5d57c2aa89db914aeb6f7bb0ab4eb4a Author: Thomas Weißschuh Date: Wed Mar 4 08:49:01 2026 +0100 sparc64: vdso: Link with -z noexecstack The vDSO stack does not need to be executable. Prevent the linker from creating executable. For more background see commit ffcf9c5700e4 ("x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments"). Also prevent the following warning from the linker: sparc64-linux-ld: warning: arch/sparc/vdso/vdso-note.o: missing .note.GNU-stack section implies executable stack sparc64-linux-ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker Fixes: 9a08862a5d2e ("vDSO for sparc") Suggested-by: Arnd Bergmann Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Acked-by: Andreas Larsson Link: https://lore.kernel.org/lkml/20250707144726.4008707-1-arnd@kernel.org/ Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-4-d8eb3b0e1410@linutronix.de commit 05988dba11791ccbb458254484826b32f17f4ad2 Author: Thomas Weißschuh Date: Wed Mar 4 08:49:00 2026 +0100 vdso/datastore: Allocate data pages dynamically Allocating the data pages as part of the kernel image does not work on SPARC. The MMU will raise a fault when userspace tries to access them. Allocate the data pages through the page allocator instead. Unused pages in the vDSO VMA are still allocated to keep the virtual addresses aligned. Switch the mapping from PFNs to 'struct page' as that is required for dynamically allocated pages. This also aligns the allocation of the datapages with the code pages and is a prerequisite for mlockall() support. VM_MIXEDMAP is necessary for the call to vmf_insert_page() in the timens prefault path to work. The data pages need to be order-0, non-compound pages so that the mapping to userspace and the different orderings work. These pages are also used by the timekeeping, random pool and architecture initialization code. Some of these are running before the page allocator is available. To keep these subsytems working without changes, introduce early, statically data storage which will then replaced by the real one as soon as that is available. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-3-d8eb3b0e1410@linutronix.de commit c0c9439ba30738104cdf1a50f82c7c189729f3a6 Author: Thomas Weißschuh Date: Wed Mar 4 08:48:59 2026 +0100 vdso/datastore: Drop inclusion of linux/mmap_lock.h This header is unnecessary and together with some upcoming changes would introduce compiler warnings. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Reviewed-by: Christophe Leroy (CS GROUP) Link: https://lore.kernel.org/lkml/20250916-mm-rcuwait-v1-1-39a3beea6ec3@linutronix.de/ Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-2-d8eb3b0e1410@linutronix.de commit dc432ab7130bb39f5a351281a02d4bc61e85a14a Author: Thomas Weißschuh Date: Wed Mar 4 08:48:58 2026 +0100 vdso/datastore: Reduce scope of some variables in vvar_fault() These variables are only used inside a single branch. Move their declarations there. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Tested-by: Andreas Larsson Reviewed-by: Andreas Larsson Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260304-vdso-sparc64-generic-2-v6-1-d8eb3b0e1410@linutronix.de commit 62357a5888ea6ef81f718eee20ad962a1101fb96 Author: Thomas Weißschuh Date: Mon Mar 2 08:58:41 2026 +0100 asm-generic/bitsperlong.h: Add sanity checks for __BITS_PER_LONG The value of __BITS_PER_LONG from architecture-specific logic should always match the generic one if that is available. It should also match the actual C type 'long'. Mismatches can happen for example when building the compat vDSO. Either during the compilation, see commit 9a6d3ff10f7f ("arm64: uapi: Provide correct __BITS_PER_LONG for the compat vDSO"), or when running sparse when mismatched CHECKFLAGS are inherited from the kernel build. Add some consistency checks which detect such issues early and clearly. The kernel-internal BITS_PER_LONG is not checked as it is derived from CONFIG_64BIT and therefore breaks for the compat vDSO. See the similar, deactivated check above. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260302-vdso-compat-checkflags-v2-5-78e55baa58ba@linutronix.de commit 9b444349a2e96745fc172e161539594ee1f0239e Author: Thomas Weißschuh Date: Mon Mar 2 08:58:40 2026 +0100 powerpc/audit: Directly include unistd_32.h from compat_audit.c This source file undefines '__powerpc64__' to get the 32-bit system call numbers from asm/unistd.h. However this symbol is also evaluated by other headers, among them is asm/bitsperlong.h. The undefinition leads to an inconsistency between __BITS_PER_LONG and the C type 'long'. An upcoming consistency check will be tripped by this. Directly include asm/unistd_32.h to get access to the 32-bit system call numbers instead. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Reviewed-by: Arnd Bergmann Link: https://patch.msgid.link/20260302-vdso-compat-checkflags-v2-4-78e55baa58ba@linutronix.de commit 08b5dcb6139975f3fd754c27f4943720c3c43ae2 Author: Thomas Weißschuh Date: Mon Mar 2 08:58:39 2026 +0100 s390: Add -m64 to KBUILD_CPPFLAGS Some non-code files, like linkescripts, are preprocessed with the C preprocessor and make use of regular kernel headers. As -m64 is not passed to those preprocessor invocations this leads to an inconsistency between __BITS_PER_LONG and the C type 'long'. An upcoming consistency check will be tripped by this. Make sure -m64 is also defined for those preprocessing steps. As KBUILD_CPPFLAGS is inherited by both KBUILD_AFLAGS and KBUILD_CFLAGS, drop -m64 from these variables. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Reviewed-by: Arnd Bergmann Link: https://patch.msgid.link/20260302-vdso-compat-checkflags-v2-3-78e55baa58ba@linutronix.de commit 273aaa8ef8e347c08865effcd8917e20f049e612 Author: Thomas Weißschuh Date: Mon Mar 2 08:58:38 2026 +0100 sparc64: vdso: Use 32-bit CHECKFLAGS for compat vDSO When building the compat vDSO the CHECKFLAGS from the 64-bit kernel are used. These are combined with the 32-bit CFLAGS. This confuses sparse, producing false-positive warnings or potentially missing real issues. Manually override the CHECKFLAGS for the compat vDSO with the correct 32-bit configuration. Reported-by: kernel test robot Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260302-vdso-compat-checkflags-v2-2-78e55baa58ba@linutronix.de Closes: https://lore.kernel.org/lkml/202511030021.9v1mIgts-lkp@intel.com/ commit 56f85f67b3e20b105fa23bf97bfc8b6d5cdbbef0 Author: Thomas Weißschuh Date: Mon Mar 2 08:58:37 2026 +0100 x86/vdso: Use 32-bit CHECKFLAGS for compat vDSO When building the compat vDSO the CHECKFLAGS from the 64-bit kernel are used. These are combined with the 32-bit CFLAGS. This confuses sparse, producing false-positive warnings or potentially missing real issues. Manually override the CHECKFLAGS for the compat vDSO with the correct 32-bit configuration. Reported-by: Sun Jian Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260302-vdso-compat-checkflags-v2-1-78e55baa58ba@linutronix.de Closes: https://lore.kernel.org/lkml/20260114084529.1676356-1-sun.jian.kdev@gmail.com/ Closes: https://lore.kernel.org/lkml/20260117215542.342638347@kernel.org/ Closes: https://lore.kernel.org/r/202602111941.PIhubgrb-lkp@intel.com/ commit a5ccec8fd10efa50a3fd4444915a2abff31f2535 Author: Randy Dunlap Date: Fri Feb 27 23:17:11 2026 -0800 vdso/datapage: Correct struct member kernel-doc Remove the "[]" array indicators from the struct member descriptions to avoid kernel-doc warnings. Warning: include/vdso/datapage.h:107 struct member 'basetime' not described in 'vdso_clock' Warning: include/vdso/datapage.h:107 struct member 'offset' not described in 'vdso_clock' Signed-off-by: Randy Dunlap Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260228071711.2663851-1-rdunlap@infradead.org commit 252b0e790d22dfef8c4d0c39a5bfc04e40b615ad Author: Linus Walleij Date: Tue Mar 10 09:53:12 2026 +0100 dma-buf: heaps: Clear CMA highages using helper Currently the CMA allocator clears highmem pages using kmap()->clear_page()->kunmap(), but there is a helper static inline in that does the same for us so use clear_highpage() instead of open coding this. Suggested-by: T.J. Mercier Reviewed-by: T.J. Mercier Reviewed-by: Christian König Reviewed-by: Maxime Ripard Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260310-cma-heap-clear-pages-v2-2-ecbbed3d7e6d@kernel.org commit e669d2f601919aedc6cadca673109684aa499326 Author: Linus Walleij Date: Tue Mar 10 09:53:11 2026 +0100 dma-buf: heaps: Clear CMA pages with clear_pages() As of commit 62a9f5a85b98 "mm: introduce clear_pages() and clear_user_pages()" we can clear a range of pages with a potentially assembly-optimized call. Instead of using a memset, use this helper to clear the whole range of pages from the CMA allocation. Reviewed-by: T.J. Mercier Reviewed-by: Maxime Ripard Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260310-cma-heap-clear-pages-v2-1-ecbbed3d7e6d@kernel.org commit 1f0cf05155175849e2f747d26ef1d59e97e280db Author: Janne Grunau Date: Mon Feb 23 21:42:47 2026 +0100 irqchip/apple-aic: Add support for "apple,t8122-aic3" Introduce support for the new AICv3 hardware block in t8122 and t603x SoCs. AICv3 is similar to AICv2 but has an increased IRQ config offset. These MMIO offsets are coded as properties of the "aic,3" node in Apple's device tree. The actual offsets are the same for all SoCs starting from M3 through at least M5. So do not bother to follow suit but use AICv3 specific defines in the driver. The compatible string is SoC specific so future SoCs with AICv3 and different offsets would just use their own compatible string as base and add their new offsets. Signed-off-by: Janne Grunau Signed-off-by: Thomas Gleixner Reviewed-by: Sven Peter Link: https://patch.msgid.link/20260223-irq-apple-aic3-v3-2-2b7328076b8d@jannau.net commit 0db190e68b2388e367cd101f5d08048ed9b3c61b Author: Janne Grunau Date: Mon Feb 23 21:42:46 2026 +0100 dt-bindings: interrupt-controller: apple,aic2: Add AICv3 AIC version 3 as found on the Apple M3 (t8122) is very similar to AICv2 in its base functionality. It can use the same device tree bindings as AICv2 so add it to the AICv2 bindings. This interrupt controller is used on all Apple SoCs starting with M3 up to at least M5. The only apparent difference is the increased IRQ config offset. Apple's device tree codes this new offset as property of the "aic" node but the value stayed constant for all SoCs with "aic,3". Since the SoC specific compatible "apple,t8122-aic3" will be only used in the driver this offset can remain a driver implementation detail. Signed-off-by: Janne Grunau Signed-off-by: Thomas Gleixner Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223-irq-apple-aic3-v3-1-2b7328076b8d@jannau.net commit 5e72917802dd65ad1ff57f2158a9d221b4fddf0b Author: Ciprian Marian Costea Date: Wed Mar 11 09:11:52 2026 +0100 irqchip/imx-irqsteer: Add NXP S32N79 support Add support for the interrupt steering controller found in NXP S32N79 series automotive SoCs. The S32N79 IRQ_STEER variant differs from the i.MX version by not implementing the CHANCTRL register. To handle this hardware difference, introduce a device type data structure with quirks field. The IRQSTEER_QUIRK_NO_CHANCTRL quirk skips CHANCTRL register access for S32N79 variants. The interrupt routing functionality and register layout are otherwise identical between the two variants. Co-developed-by: Larisa Grigore Signed-off-by: Larisa Grigore Signed-off-by: Ciprian Marian Costea Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260311081154.381881-4-ciprianmarian.costea@oss.nxp.com commit 39d5ca62a3dab7d162d49eb60b14cdd46138590f Author: Vincent Donnefort Date: Mon Mar 9 16:25:16 2026 +0000 tracing: selftests: Add hypervisor trace remote tests Run the trace remote selftests with the trace remote 'hypervisor', This trace remote is most likely created when the arm64 KVM nVHE/pKVM hypervisor is in use. Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-31-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 5bbbed42f71f771a70e974e3726d283690ecd589 Author: Vincent Donnefort Date: Mon Mar 9 16:25:15 2026 +0000 KVM: arm64: Add selftest event support to nVHE/pKVM hyp Add a selftest event that can be triggered from a `write_event` tracefs file. This intends to be used by trace remote selftests. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-30-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 696dfec22b8e4ac57cc90558af2b6be2b37f4b95 Author: Vincent Donnefort Date: Mon Mar 9 16:25:14 2026 +0000 KVM: arm64: Add hyp_enter/hyp_exit events to nVHE/pKVM hyp The hyp_enter and hyp_exit events are logged by the hypervisor any time it is entered and exited. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-29-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 0a90fbc8a1709f682e0196c2632027cdedae5e94 Author: Vincent Donnefort Date: Mon Mar 9 16:25:13 2026 +0000 KVM: arm64: Add event support to the nVHE/pKVM hyp and trace remote Allow the creation of hypervisor and trace remote events with a single macro HYP_EVENT(). That macro expands in the kernel side to add all the required declarations (based on REMOTE_EVENT()) as well as in the hypervisor side to create the trace_() function. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-28-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 2194d317e07d169efc113344c531621ce31afe64 Author: Vincent Donnefort Date: Mon Mar 9 16:25:12 2026 +0000 KVM: arm64: Add trace reset to the nVHE/pKVM hyp Make the hypervisor reset either the whole tracing buffer or a specific ring-buffer, on remotes/hypervisor/trace or per_cpu//trace write access. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-27-vdonnefort@google.com Signed-off-by: Marc Zyngier commit b22888917fa411d100339ef9d418b4eb86aba962 Author: Vincent Donnefort Date: Mon Mar 9 16:25:11 2026 +0000 KVM: arm64: Sync boot clock with the nVHE/pKVM hyp Configure the hypervisor tracing clock with the kernel boot clock. For tracing purposes, the boot clock is interesting: it doesn't stop on suspend. However, it is corrected on a regular basis, which implies the need to re-evaluate it every once in a while. Cc: John Stultz Cc: Thomas Gleixner Cc: Stephen Boyd Cc: Christopher S. Hall Cc: Richard Cochran Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-26-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 3aed038aac8d897016a2b6e1935f16c7640918d4 Author: Vincent Donnefort Date: Mon Mar 9 16:25:10 2026 +0000 KVM: arm64: Add trace remote for the nVHE/pKVM hyp In both protected and nVHE mode, the hypervisor is capable of writing events into tracefs compatible ring-buffers. Create a trace remote so the kernel can read those buffers. This currently doesn't provide any event support which will come later. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-25-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 680a04c333fa29bf92007efe11431be005e8c4bb Author: Vincent Donnefort Date: Mon Mar 9 16:25:09 2026 +0000 KVM: arm64: Add tracing capability for the nVHE/pKVM hyp There is currently no way to inspect or log what's happening at EL2 when the nVHE or pKVM hypervisor is used. With the growing set of features for pKVM, the need for tooling is more pressing. And tracefs, by its reliability, versatility and support for user-space is fit for purpose. Add support to write into a tracefs compatible ring-buffer. There's no way the hypervisor could log events directly into the host tracefs ring-buffers. So instead let's use our own, where the hypervisor is the writer and the host the reader. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-24-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 4cdf8dec8c115d9531f80519db69846c32c580a5 Author: Vincent Donnefort Date: Mon Mar 9 16:25:08 2026 +0000 KVM: arm64: Support unaligned fixmap in the pKVM hyp Return the fixmap VA with the page offset, instead of the page base address. This allows to use hyp_fixmap_map() seamlessly regardless of the address alignment. While at it, do the same for hyp_fixblock_map(). Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-23-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 8bbeb4d1698fb0945107c69019c15207bbe605c9 Author: Vincent Donnefort Date: Mon Mar 9 16:25:07 2026 +0000 KVM: arm64: Initialise hyp_nr_cpus for nVHE hyp Knowing the number of CPUs is necessary for determining the boundaries of per-cpu variables, which will be used for upcoming hypervisor tracing. hyp_nr_cpus which stores this value, is only initialised for the pKVM hypervisor. Make it accessible for the nVHE hypervisor as well. With the kernel now responsible for initialising hyp_nr_cpus, the nr_cpus parameter is no longer needed in __pkvm_init. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-22-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 405df5b55748d93d44666fd6005c60981094a077 Author: Vincent Donnefort Date: Mon Mar 9 16:25:06 2026 +0000 KVM: arm64: Add clock support to nVHE/pKVM hyp In preparation for supporting tracing from the nVHE hyp, add support to generate timestamps with a clock fed by the CNTCVT counter. The clock can be kept in sync with the kernel's by updating the slope values. This will be done later. As current we do only create a trace clock, make the whole support dependent on the upcoming CONFIG_NVHE_EL2_TRACING. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-21-vdonnefort@google.com Signed-off-by: Marc Zyngier commit 9019e82c7e46c03c37e8b108473d02b543222d9f Author: Vincent Donnefort Date: Mon Mar 9 16:25:05 2026 +0000 KVM: arm64: Add PKVM_DISABLE_STAGE2_ON_PANIC On NVHE_EL2_DEBUG, when using pKVM, the host stage-2 is relaxed to grant the kernel access to the stacktrace, hypervisor bug table and text to symbolize addresses. This is unsafe for production. In preparation for adding more debug options to NVHE_EL2_DEBUG, decouple the stage-2 relaxation into a separate option. While at it, rename PROTECTED_NVHE_STACKTRACE into PKVM_STACKTRACE, following the same naming scheme as PKVM_DISABLE_STAGE2_ON_PANIC. Reviewed-by: Kalesh Singh Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20260309162516.2623589-20-vdonnefort@google.com Signed-off-by: Marc Zyngier commit dfda8e9a282d3affbd64df3483e1bb8a5e0b015d Author: Boris Brezillon Date: Mon Mar 9 13:43:18 2026 +0100 drm/panthor: Fix the "done_fence is initialized" detection logic After commit 541c8f2468b9 ("dma-buf: detach fence ops on signal v3"), dma_fence::ops == NULL can't be used to check if the fence is initialized. Use dma_fence_was_initialized() instead. v2: - Use dma_fence_was_initialized() instead of open-coding it Cc: Nicolas Frattaroli Cc: Tvrtko Ursulin Cc: Philipp Stanner Cc: Christian König Reported-by: Steven Price Reported-by: Nicolas Frattaroli Fixes: 541c8f2468b9 ("dma-buf: detach fence ops on signal v3") Signed-off-by: Boris Brezillon Reviewed-by: Christian König Tested-by: Nicolas Frattaroli Reviewed-by: Steven Price Reviewed-by: Liviu Dudau Signed-off-by: Steven Price Link: https://patch.msgid.link/20260309124318.222902-1-boris.brezillon@collabora.com commit b4784adfe3aab3e74b5f7556834d87e416b666d0 Author: Rosen Penev Date: Mon Mar 9 16:28:04 2026 -0700 gpio: tegra186: allocate irqs with the main struct Remove an extra kcalloc call by using a flexible array member. Add __counted_by for extra runtime analysis. Assign counting variable immediately after allocation as required by __counted_by. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260309232804.331882-1-rosenp@gmail.com Signed-off-by: Bartosz Golaszewski commit 223d9a310c7bd785f08320de8d2b66a5af6a25e6 Author: Rosen Penev Date: Mon Mar 9 15:52:04 2026 -0700 gpio: htc-egpio: allocate irq with the main struct Use a flexible array member to combinwe allocations. Add __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260309225204.44789-1-rosenp@gmail.com Signed-off-by: Bartosz Golaszewski commit 0258fe8721f541bbd3949cac2f4971b98e1fe4ed Author: Rosen Penev Date: Tue Mar 10 17:34:31 2026 -0700 gpio: bcm-kona: reduce the number of memory allocations Simplify allocation by using a flexible array member. Use __counted_by for extra runtime analysis. Shuffle some code as __counted_by requires the counting variable to be set right after allocation. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260311003431.31881-1-rosenp@gmail.com Signed-off-by: Bartosz Golaszewski commit 81e1035e1b9a1fc7c457337eb7869ef640fa374d Author: Amin GATTOUT Date: Sun Mar 8 11:15:57 2026 +0100 drm/loongson: use drm_gem_ttm_dumb_map_offset() Replace the open-coded lsdc_dumb_map_offset() with the generic drm_gem_ttm_dumb_map_offset() helper, which is functionally identical. This removes unnecessary boilerplate and aligns with the DRM convention for TTM-based drivers. Signed-off-by: Amin GATTOUT Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260308-master-v1-1-af32d71c8a1d@gmail.com commit 648fa9ca27e75e08a37047fb65ec179d349d1b1d Author: Thomas Zimmermann Date: Fri Feb 27 12:42:11 2026 +0100 drm/gem-shmem: Track folio accessed/dirty status in vmap On successful vmap, set the page_mark_accessed_on_put and _dirty_on_put flags in the gem-shmem object. Signals that the contained pages require LRU and dirty tracking when they are being released back to SHMEM. Clear these flags on put, so that the buffer remains quiet until the next call to vmap. There's no means of handling dirty status in vmap as there's no write-only mapping available. Both flags, _accessed_on_put and _dirty_on_put, have always been part of the gem-shmem object, but never used much. So most drivers did not track the page status correctly. Only the v3d and imagination drivers make limited use of _dirty_on_put. In the case of imagination, move the flag setting from init to cleanup. This ensures writeback of modified pages but does not interfere with the internal vmap/vunmap calls. V3d already implements this behaviour. Signed-off-by: Thomas Zimmermann Reviewed-by: Boris Brezillon # gem-shmem Acked-by: Frank Binns # imagination Tested-by: Frank Binns # imagination Link: https://patch.msgid.link/20260227114509.165572-7-tzimmermann@suse.de commit 28e3918179aa75cfd4490b3b0281496ed91d829a Author: Thomas Zimmermann Date: Fri Feb 27 12:42:10 2026 +0100 drm/gem-shmem: Track folio accessed/dirty status in mmap Invoke folio_mark_accessed() in mmap page faults to add the folio to the memory manager's LRU list. Userspace invokes mmap to get the memory for software rendering. Compositors do the same when creating the final on-screen image, so keeping the pages in LRU makes sense. Avoids paging out graphics buffers when under memory pressure. In pfn_mkwrite, further invoke the folio_mark_dirty() to add the folio for writeback should the underlying file be paged out from system memory. This rarely happens in practice, yet it would corrupt the buffer content. This has little effect on a system's hardware-accelerated rendering, which only mmaps for an initial setup of textures, meshes, shaders, etc. v4: - test for VM_FAULT_NOPAGE before marking folio as accessed (Boris) - test page-array bounds in mkwrite handler (Boris) v3: - rewrite for VM_PFNMAP v2: - adapt to changes in drm_gem_shmem_try_mmap_pmd() Signed-off-by: Thomas Zimmermann Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20260227114509.165572-6-tzimmermann@suse.de commit 06f3662cb3ba95aa895c1036910555a81c8bcd95 Author: Thomas Zimmermann Date: Fri Feb 27 12:42:09 2026 +0100 drm/gem-shmem: Refactor drm_gem_shmem_try_map_pmd() The current mmap page-fault handler requires some changes before it can track folio access. Call to folio_test_pmd_mappable() into the mmap page-fault handler before calling drm_gem_shmem_try_map_pmd(). The folio will become useful for tracking the access status. Also rename drm_gem_shmem_try_map_pmd() to _try_insert_pfn_pmd() and only pass the page fault and page-frame number. The new name and parameters make it similar to vmf_insert_pfn_pmd(). No functional changes. If PMD mapping fails or is not supported, insert a regular PFN as before. Signed-off-by: Thomas Zimmermann Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20260227114509.165572-5-tzimmermann@suse.de commit 5cf8de6cd1620baf64f188706ea34f0a7fbc1ed0 Author: Thomas Zimmermann Date: Fri Feb 27 12:42:08 2026 +0100 drm/gem-shmem: Return vm_fault_t from drm_gem_shmem_try_map_pmd() Return the exact VM_FAULT_ mask from drm_gem_shmem_try_map_pmd(). Gives the caller better insight into the result. Return 0 if nothing was done. If the caller sees VM_FAULT_NOPAGE, drm_gem_shmem_try_map_pmd() added a PMD entry to the page table. As before, return early from the page-fault handler in that case. Signed-off-by: Thomas Zimmermann Suggested-by: Matthew Wilcox Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20260227114509.165572-4-tzimmermann@suse.de commit cd40c12a9e8c3551a61e84ed3ad53ff43e12ca3b Author: Thomas Zimmermann Date: Fri Feb 27 12:42:07 2026 +0100 drm/gem-shmem: Test for existence of page in mmap fault handler Not having a page pointer in the mmap fault handler is an error. Test for this situation and return VM_FAULT_SIGBUS if so. Also replace several lookups of the page with a local variable. Signed-off-by: Thomas Zimmermann Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20260227114509.165572-3-tzimmermann@suse.de commit 6b1697f23cb75eecc0056cea0a4fdcdb06a3ed4e Author: Thomas Zimmermann Date: Fri Feb 27 12:42:06 2026 +0100 drm/gem-shmem: Use obj directly where appropriate in fault handler Replace shmem->base with obj in several places. It is the same value, but the latter is easier to read. Signed-off-by: Thomas Zimmermann Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20260227114509.165572-2-tzimmermann@suse.de commit f7093ebf612f45544600f06681d6fb7be7d0649a Author: Thomas Hellström Date: Thu Mar 5 10:39:09 2026 +0100 drm/xe/userptr: Defer Waiting for TLB invalidation to the second pass if possible Now that the two-pass notifier flow uses xe_vma_userptr_do_inval() for the fence-wait + TLB-invalidate work, extend it to support a further deferred TLB wait: - xe_vma_userptr_do_inval(): when the embedded finish handle is free, submit the TLB invalidation asynchronously (xe_vm_invalidate_vma_submit) and return &userptr->finish so the mmu_notifier core schedules a third pass. When the handle is occupied by a concurrent invalidation, fall back to the synchronous xe_vm_invalidate_vma() path. - xe_vma_userptr_complete_tlb_inval(): new helper called from invalidate_finish when tlb_inval_submitted is set. Waits for the previously submitted batch and unmaps the gpusvm pages. xe_vma_userptr_invalidate_finish() dispatches between the two helpers via tlb_inval_submitted, making the three possible flows explicit: pass1 (fences pending) -> invalidate_finish -> do_inval (sync TLB) pass1 (fences done) -> do_inval -> invalidate_finish -> complete_tlb_inval (deferred TLB) pass1 (finish occupied) -> do_inval (sync TLB, inline) In multi-GPU scenarios this allows TLB flushes to be submitted on all GPUs in one pass before any of them are waited on. Also adds xe_vm_invalidate_vma_submit() which submits the TLB range invalidation without blocking, populating a xe_tlb_inval_batch that the caller waits on separately. v3: - Add locking asserts and notifier state asserts (Matt Brost) - Update the locking documentation of the notifier state members (Matt Brost) - Remove unrelated code formatting changes (Matt Brost) Assisted-by: GitHub Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260305093909.43623-5-thomas.hellstrom@linux.intel.com commit 400ee0f4f1f06b2c447ba87868b6da613445c31a Author: Thomas Hellström Date: Thu Mar 5 10:39:08 2026 +0100 drm/xe: Split TLB invalidation into submit and wait steps xe_vm_range_tilemask_tlb_inval() submits TLB invalidation requests to all GTs in a tile mask and then immediately waits for them to complete before returning. This is fine for the existing callers, but a subsequent patch will need to defer the wait in order to overlap TLB invalidations across multiple VMAs. Introduce xe_tlb_inval_range_tilemask_submit() and xe_tlb_inval_batch_wait() in xe_tlb_inval.c as the submit and wait halves respectively. The batch of fences is carried in the new xe_tlb_inval_batch structure. Remove xe_vm_range_tilemask_tlb_inval() and convert all three call sites to the new API. v3: - Don't wait on TLB invalidation batches if the corresponding batch submit returns an error. (Matt Brost) - s/_batch/batch/ (Matt Brost) Assisted-by: GitHub Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260305093909.43623-4-thomas.hellstrom@linux.intel.com commit 18c4e536959e983b74c6a21968f2513a6ca2acf0 Author: Thomas Hellström Date: Thu Mar 5 10:39:07 2026 +0100 drm/xe/userptr: Convert invalidation to two-pass MMU notifier In multi-GPU scenarios, asynchronous GPU job latency is a bottleneck if each notifier waits for its own GPU before returning. The two-pass mmu_interval_notifier infrastructure allows deferring the wait to a second pass, so all GPUs can be signalled in the first pass before any of them are waited on. Convert the userptr invalidation to use the two-pass model: Use invalidate_start as the first pass to mark the VMA for repin and enable software signalling on the VM reservation fences to start any gpu work needed for signaling. Fall back to completing the work synchronously if all fences are already signalled, or if a concurrent invalidation is already using the embedded finish structure. Use invalidate_finish as the second pass to wait for the reservation fences to complete, invalidate the GPU TLB in fault mode, and unmap the gpusvm pages. Embed a struct mmu_interval_notifier_finish in struct xe_userptr to avoid dynamic allocation in the notifier callback. Use a finish_inuse flag to prevent two concurrent invalidations from using it simultaneously; fall back to the synchronous path for the second caller. v3: - Add locking asserts in notifier components (Matt Brost) - Clean up newlines (Matt Brost) - Update the userptr notifier state member locking documentation (Matt Brost) Assisted-by: GitHub Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260305093909.43623-3-thomas.hellstrom@linux.intel.com commit 7aba71dbc41641e43a79fb9f6fac91719094b4fb Author: Thomas Hellström Date: Thu Mar 5 10:39:06 2026 +0100 mm/mmu_notifier: Allow two-pass struct mmu_interval_notifiers GPU use-cases for mmu_interval_notifiers with hmm often involve starting a gpu operation and then waiting for it to complete. These operations are typically context preemption or TLB flushing. With single-pass notifiers per GPU this doesn't scale in multi-gpu scenarios. In those scenarios we'd want to first start preemption- or TLB flushing on all GPUs and as a second pass wait for them to complete. One can do this on per-driver basis multiplexing per-driver notifiers but that would mean sharing the notifier "user" lock across all GPUs and that doesn't scale well either, so adding support for multi-pass in the core appears to be the right choice. Implement two-pass capability in the mmu_interval_notifier. Use a linked list for the final passes to minimize the impact for use-cases that don't need the multi-pass functionality by avoiding a second interval tree walk, and to be able to easily pass data between the two passes. v1: - Restrict to two passes (Jason Gunthorpe) - Improve on documentation (Jason Gunthorpe) - Improve on function naming (Alistair Popple) v2: - Include the invalidate_finish() callback in the struct mmu_interval_notifier_ops. - Update documentation (GitHub Copilot:claude-sonnet-4.6) - Use lockless list for list management. v3: - Update kerneldoc for the struct mmu_interval_notifier_finish::list member (Matthew Brost) - Add a WARN_ON_ONCE() checking for NULL invalidate_finish() op if if invalidate_start() is non-NULL. (Matthew Brost) v4: - Addressed documentation review comments by David Hildenbrand. Cc: Matthew Brost Cc: Christian König Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Cc: Jason Gunthorpe Cc: Andrew Morton Cc: Simona Vetter Cc: Dave Airlie Cc: Alistair Popple Cc: Cc: Cc: Assisted-by: GitHub Copilot:claude-sonnet-4.6 # Documentation only. Signed-off-by: Thomas Hellström Acked-by: David Hildenbrand (Arm) Reviewed-by: Maarten Lankhorst Link: https://patch.msgid.link/20260305093909.43623-2-thomas.hellstrom@linux.intel.com commit c753c18754acf71d0355f2495483df0defe574c8 Author: Lukas Bulwahn Date: Wed Mar 11 05:33:14 2026 +0100 MAINTAINERS: adjust file entry in GPU BUDDY ALLOCATOR The commit 4a9671a03f2b ("gpu: Move DRM buddy allocator one level up (part one)") and commit ba110db8e1bc ("gpu: Move DRM buddy allocator one level up (part two)") split the majority of the file drivers/gpu/drm/drm_buddy.c into drivers/gpu/buddy.c, with some pieces remaining in the original location drivers/gpu/drm/drm_buddy.c. The commits also adjust the file entries in the GPU BUDDY ALLOCATOR section, but as part of that, change the file entry to the non-existing file drivers/gpu/drm_buddy.c instead of keeping the reference to the existing file drivers/gpu/drm/drm_buddy.c. Make the file entry in GPU BUDDY ALLOCATOR refer to the intended existing file. While at it, order the file entries in this section alphabetically. Signed-off-by: Lukas Bulwahn Reviewed-by: Arunpravin Paneer Selvam Reviewed-by: Joel Fernandes Link: https://patch.msgid.link/20260311043314.265627-1-lukas.bulwahn@redhat.com Signed-off-by: Maxime Ripard commit 62d11b80ea5d118ba4a1b24e55ca13d77a4cf161 Author: Bartosz Golaszewski Date: Tue Mar 10 16:15:15 2026 +0100 reset: don't overwrite fwnode_reset_n_cells Fix a logic bug in reset_controller_register() where we set fwnode_reset_n_cells to 1 if fwnode is set and fwnode_xlate is not but we do it after assigning of_fwnode_handle(of_node) to fwnode. Modify the logic to: assign fwnode from of_node if applicable, if fwnode is still not set, try to get it from the device and only then check of_xlate and fwnode_xlate and either assign fwnode_reset_n_cells from OF or default to fwnode_reset_simple_xlate and fwnode_reset_n_cells = 1. Fixes: ba8dbbb14b7e ("reset: convert the core API to using firmware nodes") Reported-by: Mark Brown Closes: https://lore.kernel.org/all/0b72286b-33dd-4bc9-8c0e-161c2f4baed8@sirena.org.uk/ Signed-off-by: Bartosz Golaszewski Tested-by: Mark Brown Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit c7e05ab38adc44d0cae4888016829359dcbba7b2 Author: Arnd Bergmann Date: Fri Mar 6 16:07:34 2026 +0100 power: reset: reboot-mode: fix -Wformat-security warning The device_create() function expects a format string to construct a device name, so passing a variable here introduces a possible vulnerability in case the string can contain '%' characters: drivers/power/reset/reboot-mode.c:148:22: error: format string is not a string literal (potentially insecure) [-Werror,-Wformat-security] drivers/power/reset/reboot-mode.c:148:22: note: treat the string as an argument to avoid this 148 | (void *)priv, reboot->dev->driver->name); Use an trivial "%s" format instead and pass the name as the string to be included here. Fixes: cfaf0a90789a ("power: reset: reboot-mode: Expose sysfs for registered reboot_modes") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260306150738.497978-1-arnd@kernel.org Signed-off-by: Sebastian Reichel commit ad2f6258dd1d484f328d5cdcc1bc760419636cb2 Author: Ian Rogers Date: Fri Mar 6 16:22:22 2026 -0800 perf disasm: Fix potential use-after-free on fileloc The fileloc is a copy of a pointer to a string but in places like symbol_disassemble__llvm this string appears to be freed setting up potential use-after-frees: llvm.c: ``` dl = disasm_line__new(args); if (dl == NULL) goto err; annotation_line__add(&dl->al, ¬es->src->source); free(args->fileloc); ``` disasm.c: ``` static void annotation_line__init(struct annotation_line *al, struct annotate_args *args, int nr) { al->offset = args->offset; al->line = strdup(args->line); al->line_nr = args->line_nr; al->fileloc = args->fileloc; al->data_nr = nr; } struct disasm_line *disasm_line__new(struct annotate_args *args) { struct disasm_line *dl = NULL; struct annotation *notes = symbol__annotation(args->ms->sym); int nr = notes->src->nr_events; dl = zalloc(disasm_line_size(nr)); if (!dl) return NULL; annotation_line__init(&dl->al, args, nr); ``` Fix this by making the fileloc a copy of the underlying string in its init/exit. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit f182573e06abb635f320b0fd0e60972c4c2467c5 Author: Changbin Du Date: Mon Mar 9 17:44:12 2026 +0000 perf tools: Add layout support for --symfs option Add support for parsing an optional layout parameter in the --symfs command line option. The format is: --symfs Where layout can be: - 'hierarchy': matches full path (default) - 'flat': only matches base name When debugging symbol files from a copy of the filesystem (e.g., from a container or remote machine), the debug files are often stored in a flat directory structure with only filenames, not the full original paths. In this case, using 'flat' layout allows perf to find debug symbols by matching only the filename rather than the full path. For example, given a binary path like: /build/output/lib/foo.so With 'perf report --symfs /debug/files,flat', perf will look for: /debug/files/foo.so Instead of: /debug/files/build/output/lib/foo.so This is particularly useful when: - Extracting debug files from containers with different directory layouts - Working with build systems that flatten directory structures Signed-off-by: Changbin Du Signed-off-by: Namhyung Kim commit 2cfc7cac68e19c4acb236b8db6065bbaff5deee8 Author: Krzysztof Kozlowski Date: Thu Mar 5 22:45:45 2026 +0100 power: supply: ipaq_micro: Simplify with devm Simplify the driver by using devm interfaces, which allow to drop probe() error paths and the remove() callback. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260305-workqueue-devm-v2-6-66a38741c652@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit f23afa01040a41882a048e4957a7acac1426da6f Author: Krzysztof Kozlowski Date: Thu Mar 5 22:45:44 2026 +0100 power: supply: mt6370: Simplify with devm_alloc_ordered_workqueue() Simplify the driver probe function by using devm_alloc_ordered_workqueue() which handles the cleanup already. Change is not equivalent in the workqueue itself: use non-legacy API which does not set (__WQ_LEGACY | WQ_MEM_RECLAIM). The workqueue is used to update power supply data (power_supply_changed()) status, thus there is no point to run it for memory reclaim. Note that dev_name() is not directly used in second argument to prevent possible unlikely parsing any "%" character in device name as format. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260305-workqueue-devm-v2-5-66a38741c652@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit 1e668baadefb16e81269dbfebf3ffc2672e3a3bb Author: Krzysztof Kozlowski Date: Thu Mar 5 22:45:43 2026 +0100 power: supply: max77705: Free allocated workqueue and fix removal order Use devm interface for allocating workqueue to fix two bugs at the same time: 1. Driver leaks the memory on remove(), because the workqueue is not destroyed. 2. Driver allocates workqueue and then registers interrupt handlers with devm interface. This means that probe error paths will not use a reversed order, but first destroy the workqueue and then, via devm release handlers, free the interrupt. The interrupt handler schedules work on this exact workqueue, thus if interrupt is hit in this short time window - after destroying workqueue, but before devm() frees the interrupt - the schedulled work will lead to use of freed memory. Change is not equivalent in the workqueue itself: use non-legacy API which does not set (__WQ_LEGACY | WQ_MEM_RECLAIM). The workqueue is used to update power supply (power_supply_changed()) status, thus there is no point to run it for memory reclaim. Note that dev_name() is not directly used in second argument to prevent possible unlikely parsing any "%" character in device name as format. Fixes: 11741b8e382d ("power: supply: max77705: Fix workqueue error handling in probe") Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260305-workqueue-devm-v2-4-66a38741c652@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit 2064c64ceb1996ee02a6bbb1de05fd6e8028e3e4 Author: Krzysztof Kozlowski Date: Thu Mar 5 22:45:42 2026 +0100 power: supply: max77705: Drop duplicated IRQ error message Core already prints error message on devm_request_threaded_irq() failure, so no need to do that second time. Suggested-by: Andy Shevchenko Signed-off-by: Krzysztof Kozlowski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260305-workqueue-devm-v2-3-66a38741c652@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit db254b0b232358ab1aeadebe8d147c99a3569559 Author: Krzysztof Kozlowski Date: Thu Mar 5 22:45:41 2026 +0100 power: supply: cw2015: Free allocated workqueue Use devm interface so allocated workqueue will be freed during device removal and error paths, thus fixing a memory leak. Change is not equivalent in the workqueue itself: use non-legacy API which does not set (__WQ_LEGACY | WQ_MEM_RECLAIM). The workqueue is used to read updated data from the battery, thus there is no point to run it for memory reclaim. Cc: stable@vger.kernel.org Fixes: b4c7715c10c1 ("power: supply: add CellWise cw2015 fuel gauge driver") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260305-workqueue-devm-v2-2-66a38741c652@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit 9bd4059660d06d34fde37d8d33d2a50a0b563431 Merge: c2bfe2edf741b6 1dfc9d60a69ec1 Author: Sebastian Reichel Date: Wed Mar 11 06:54:30 2026 +0100 Merge branch 'for-7.1-devm-alloc-wq' Merge branch adding support for device-managed workqueue allocation, which allows cleaning up a couple of power-supply drivers. Signed-off-by: Sebastian Reichel commit 482aac8b56ca21d06c588517970579474d56736e Merge: 1a6ca6497a40f5 315bab9411f3bd Author: Jakub Kicinski Date: Tue Mar 10 19:54:43 2026 -0700 Merge branch 'net-stmmac-start-to-shrink-memory-usage' Russell King says: ==================== net: stmmac: start to shrink memory usage Start shrinking stmmac's memory usage by avoiding using "int" for members that are only used for 0/1 (boolean) values, or values that can't be larger than 255. In addition, as struct stmmac_dma_cfg is approximately a cache line, shrinks below a cache line as a result of this patch set, and is required, there is no point separately allocating this from struct plat_stmmacenet_data. Embed it into the end of this struct and set the existing pointer to avoid large wide-spread changes. Lastly, add documentation for struct stmmac_dma_cfg, and document the stmmac clocks as best we can given the driver history. ==================== Link: https://patch.msgid.link/aa6VEsmBK-S9eNYU@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 315bab9411f3bd3465a47a64a3e44323bfab60be Author: Russell King (Oracle) Date: Mon Mar 9 09:39:49 2026 +0000 net: stmmac: add documentation for clocks Add documentation covering stmmac_clk, pclk, clk_ptp_ref and clk_tx_i in the hope that this will help understand what each of these clocks are for. There is confusion around stmmac_clk and pclk which can't be easily resolved today as the Imagination Technologies Pistachio board that pclk was introduced for has no public documentation and is likely now obsolete. So the origins of pclk are lost to the winds of time. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1vzX5Z-0000000CVsb-1XTm@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9fe167ab790b10c9eb9ef82f46a03c83f9953b61 Author: Russell King (Oracle) Date: Mon Mar 9 09:39:44 2026 +0000 net: stmmac: add documentation for stmmac_dma_cfg members Add documentation of each of the struct stmmac_dma_cfg members. dche remains undocumented as I don't have documentation that covers this. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1vzX5U-0000000CVsQ-162V@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 758ed85aadd0668c66cb359c63f384992b10938c Author: Russell King (Oracle) Date: Mon Mar 9 09:39:39 2026 +0000 net: stmmac: use u8 for host_dma_width and similar struct members We aren't going to see >= 256-bit address busses soon, so reduce host_dma_width and associated other struct members that initialise this from u32 to u8. Signed-off-by: Russell King (Oracle) Acked-by: Mohd Ayaan Anwar # qcom-ethqos Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1vzX5P-0000000CVsK-0iwX@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 94808793fed71ee47741df0923d353024b6904ff Author: Russell King (Oracle) Date: Mon Mar 9 09:39:34 2026 +0000 net: stmmac: use u8 for ?x_queues_to_use and number_?x_queues The maximum number of queues is a compile time constant of only eight. This makes using a 32-bit quantity wastefulf. Instead, use u8 for these and their associated variables. When reading the DT properties, saturdate at U8_MAX. Provided the core provides DMA capabilities to describe the number of queues, this will be capped by stmmac_hw_init() with a warning. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1vzX5K-0000000CVsE-0J0Y@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3357642e65e9454c3da64b62c0ed987ee4010008 Author: Russell King (Oracle) Date: Mon Mar 9 09:39:28 2026 +0000 net: stmmac: reorder structs to reduce memory consumption Reorder some of the stmmac structures to allow them to pack better, thereby using less memory. On aarch64, sizeof(struct stmmac_priv) was 880, and with this change becomes 816, saving 64 bytes, which is an 8% saving. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1vzX5E-0000000CVs8-40w4@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c3d08424e025aaac8fb54134f76e611ef919cd08 Author: Russell King (Oracle) Date: Mon Mar 9 09:39:23 2026 +0000 net: stmmac: convert plat_stmmacenet_data booleans to type bool Convert members of struct plat_stmmacenet_data that are booleans to type 'bool' and ensure their initialisers are true/false. Move the has_xxx for the GMAC cores together, and move the COE members to the end of the list of bool to avoid unused holes in the struct. Signed-off-by: Russell King (Oracle) Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1vzX59-0000000CVs2-3MHc@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7a6387dec8cee5a237dc5092269e97028f5a983b Author: Russell King (Oracle) Date: Mon Mar 9 09:39:18 2026 +0000 net: stmmac: provide plat_dat->dma_cfg in stmmac_plat_dat_alloc() plat_dat->dma_cfg is unconditionally required for the operation of the driver, so it would make sense to allocate it along with the plat_dat. On Arm64, sizeof(*plat_dat) has recently shrunk from 880 to 816 bytes and sizeof(*plat_dat->dma_cfg) has shrunk from 32 to 20 bytes. Given that dma_cfg is required, and it is now less than a cache line, It doesn't make sense to allocate this separateny, so place it at the end of struct plat_stmmacenet_data, and set plat_dat->dma_cfg to point at that to avoid mass changes. Signed-off-by: Russell King (Oracle) Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1vzX54-0000000CVrw-2jfu@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1a6ca6497a40f5c7795575a35f0da7d013b79bdd Author: Johan Hovold Date: Mon Mar 9 09:26:41 2026 +0100 net: mdio: mvusb: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260309082641.15574-1-johan@kernel.org Signed-off-by: Jakub Kicinski commit 07f56c8f54118cdbe33d566d9d4cc537c87d9202 Merge: 34bd3c6b0bd383 7644e76956baa9 Author: Jakub Kicinski Date: Tue Mar 10 19:51:26 2026 -0700 Merge branch 'amd-xgbe-improve-power-management-for-s0i3' Raju Rangoju says: ==================== amd-xgbe: Improve power management for S0i3 Improve the amd-xgbe power management handling to allow AMD platforms to reach the deepest suspend state (S0i3) when modern standby is used. The first patch cleans up the xgbe_powerdown() and xgbe_powerup() helpers by removing an unused caller distinction and aligning the ordering of operations with xgbe_stop(). The second patch adds proper PCI power management operations, following the standard PCI PM model, so that the device can be cleanly put into D3 and resumed back to D0. Without this, the amd_pmc driver reports: "Last suspend didn't reach deepest state" when the amd-xgbe driver is enabled. These changes have been tested on AMD platforms using S0i3 modern standby. ==================== Link: https://patch.msgid.link/20260308092851.1510214-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 7644e76956baa9a6bc3d208dfd92928f9ecd6a93 Author: Raju Rangoju Date: Sun Mar 8 14:58:51 2026 +0530 amd-xgbe: add PCI power management for S0i3 support The current suspend/resume implementation does not correctly handle PCI device power state transitions, which prevents AMD platforms from reaching the deepest suspend state (S0i3) when the amd-xgbe driver is enabled. In particular, the amd_pmc driver reports: "Last suspend didn't reach deepest state" when this device is present. Implement proper PCI power management operations following the standard PCI PM model so that the device can be cleanly powered down and resumed. Suspend path: - Power down the network interface - Put the PHY into low-power mode - Disable bus mastering to prevent DMA activity - Save PCI configuration space - Disable the PCI device - Disable wake from D3 (S0i3 does not require Wake-on-LAN) - Set the device to D3hot Resume path: - Restore the PCI power state to D0 - Restore PCI configuration space - Enable the PCI device - Re-enable bus mastering - Re-enable device interrupts - Clear the PHY low-power mode - Power up the network interface This allows systems using amd-xgbe to reach the deepest suspend state when entering modern standby (S0i3). Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260308092851.1510214-3-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit fe81629217e09ed8772e63a4c9cb0d864d849174 Author: Raju Rangoju Date: Sun Mar 8 14:58:50 2026 +0530 amd-xgbe: Simplify powerdown/powerup paths The caller parameter in xgbe_powerdown() and xgbe_powerup() was intended to differentiate between driver and ioctl contexts, but the only remaining usage is from the driver suspend/resume path. Simplify this by: - Removing the unused XGMAC_DRIVER_CONTEXT and XGMAC_IOCTL_CONTEXT macros - Dropping the now-unused caller parameter - Reordering operations in xgbe_powerdown() to disable NAPI before stopping TX/RX, matching the order used in xgbe_stop() This makes the powerdown/powerup paths easier to follow and keeps the ordering consistent with the rest of the driver. Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260308092851.1510214-2-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 34bd3c6b0bd383a76d987c8c45c4f309b681b255 Author: Jiayuan Chen Date: Mon Mar 9 20:39:16 2026 +0800 net: sched: cls_u32: Avoid memcpy() false-positive warning in u32_init_knode() Syzbot reported a warning in u32_init_knode() [1]. Similar to commit 7cba18332e36 ("net: sched: cls_u32: Avoid memcpy() false-positive warning") which addressed the same issue in u32_change(), use unsafe_memcpy() in u32_init_knode() to work around the compiler's inability to see into composite flexible array structs. This silences the false-positive reported by syzbot: memcpy: detected field-spanning write (size 32) of single field "&new->sel" at net/sched/cls_u32.c:855 (size 16) Since the memory is correctly allocated with kzalloc_flex() using s->nkeys, this is purely a false positive and does not need a Fixes tag. [1] https://syzkaller.appspot.com/bug?extid=d5ace703ed883df56e42 Reported-by: syzbot+d5ace703ed883df56e42@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69a811b9.a70a0220.b118c.0019.GAE@google.com/T/ Reviewed-by: Simon Horman Acked-by: Gustavo A. R. Silva Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260309123917.402183-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 9278b888920ee8f3cea06622f04da681536b6601 Author: Yoshihiro Shimoda Date: Sat Mar 7 10:55:32 2026 +0100 net: ethernet: ravb: Disable interrupts when closing device Disable E-MAC interrupts when closing the device. Signed-off-by: Yoshihiro Shimoda [Niklas: Rebase from BSP and reword commit message] Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20260307095532.2118495-1-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 1f9cab56e79eb88acec4d350c192d327244887c3 Author: Eric Joyner Date: Fri Mar 6 13:56:34 2026 -0800 ionic: Report additional media types from firmware The device firmware supports reporting more media types than what was there in the past, so map these new media types to existing ethtool bits, which appears to be what other drivers do for media types that match speeds but not physical spec. And while here, make a very small cleanup in ionic_get_link_ksettings() to remove some unnecessary code duplication. Reviewed-by: Brett Creeley Signed-off-by: Eric Joyner Link: https://patch.msgid.link/20260306215634.64550-1-eric.joyner@amd.com Signed-off-by: Jakub Kicinski commit 7bb1970494faa6396fe4d622c4fe7edb1a9e217f Merge: 73a864352570fd d6df5e9b2a565b Author: Jakub Kicinski Date: Tue Mar 10 19:33:07 2026 -0700 Merge branch 'tools-ynl-policy-query-support' Jakub Kicinski says: ==================== tools: ynl: policy query support Improve the Netlink policy support in YNL. This series grew out of improvements to policy checking, when writing selftests I realized that instead of doing all the policy parsing in the test we're better off making it part of YNL itself. Patch 1 adds pad handling, apparently we never hit pad with commonly used families. nlctrl policy dumps use pad more frequently. Patch 2 is a trivial refactor. Patch 3 pays off some technical debt in terms of documentation. The YnlFamily class is growing in size and it's quite hard to find its members. So document it a little bit. Patch 4 is the main dish, the implementation of get_policy(op) in YnlFamily. Patch 5 plugs the new functionality into the CLI. ==================== Link: https://patch.msgid.link/20260310005337.3594225-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d6df5e9b2a565be08330e46a8a615aac9ed8711b Author: Jakub Kicinski Date: Mon Mar 9 17:53:37 2026 -0700 tools: ynl: cli: add --policy support Add --policy flag which can be combined with --do or --dump to query the kernel's netlink policy for an operation instead of executing it. Examples: $ ynl --family netdev --do dev-get --policy {'ifindex': {'max-value': 4294967295, 'min-value': 1, 'type': 'u32'}} $ ynl --family ethtool --do channels-get --policy --output-json {"header": {"type": "nested", "policy": {"dev-index": ...}}} $ ynl --family netdev --dump dev-get --policy {} Link: https://patch.msgid.link/20260310005337.3594225-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 77a6401a8722be20ea8db98ac900c93ccc7068ff Author: Jakub Kicinski Date: Mon Mar 9 17:53:36 2026 -0700 tools: ynl: add Python API for easier access to policies The format of Netlink policy dump is a bit curious with messages in the same dump carrying both attrs and mapping info. Plus each message carries a single piece of the puzzle the caller must then reassemble. I need to do this reassembly for a test, but I think it's generally useful. So let's add proper support to YnlFamily to return more user-friendly representation. See the various docs in the patch for more details. Link: https://patch.msgid.link/20260310005337.3594225-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8bbcfce5db97abc6ca2066b540e88702f461128b Author: Jakub Kicinski Date: Mon Mar 9 17:53:35 2026 -0700 tools: ynl: add short doc to class YnlFamily The class is quite long. It's getting hard to find the user-facing methods. Add a short doc at the class level explaining the main API. Link: https://patch.msgid.link/20260310005337.3594225-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c26fda6212b88af1e667474728dd241ebf6ba1d1 Author: Jakub Kicinski Date: Mon Mar 9 17:53:34 2026 -0700 tools: ynl: move policy decoding out of NlMsg We'll soon need to decode policies from dump so move _decode_policy() out of class NlMsg. Link: https://patch.msgid.link/20260310005337.3594225-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7b1309c33927d126d1cc47ddaf33bf2ae86f000c Author: Jakub Kicinski Date: Mon Mar 9 17:53:33 2026 -0700 tools: ynl: handle pad type during decode Apparently Python code only handled the 'pad' type in structs until now. Add it to attr decoding. nlctrl policy dumps need it. Link: https://patch.msgid.link/20260310005337.3594225-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 91d045058c68ab0ae133cd0bd8ed25a32c3dee97 Author: Dmitry Baryshkov Date: Wed Feb 11 11:17:27 2026 +0200 drm: bridge: anx7625: correctly detect if PD can be disabled During initial checks the ANX7625 bridge can be powered on before setting up the Type-C port. At this point, when anx7625_ocm_loading_check() checks if it can disable PD or not, it will notice that typec_port is not set and disable PD, breaking orientation and HPD handling. Unify the check between anx7625_ocm_loading_check() anx7625_i2c_probe() and anx7625_typec_register() and check for the presence of the "connector" node. Fixes: 8ad0f7d2e6fd ("drm: bridge: anx7625: implement message sending") Reviewed-by: Neil Armstrong Reviewed-by: Xin Ji Tested-by: Loic Poulain Link: https://patch.msgid.link/20260211-anx7625-fix-pd-v1-1-1dd31451b06f@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 8e3d8b33859bb8229d1f0b88752cbecb4932790a Author: Loic Poulain Date: Sun Feb 15 03:30:02 2026 +0200 drm: bridge: anx7625: don't crash if Type-C port is not used The typec_set_*() functions do not tolerate being passed the NULL typec_port instance. However, if CONFIG_TYPEC is enabled, but anx7625 DT node doesn't have the usb-c connector fwnode, then typec_port remains NULL, crashing the kernel. Prevent calling typec_set_foo() functions by checking that ctx->typec_port is not NULL in anx7625_typec_set_status(). Call trace: typec_set_orientation+0x18/0x68 (P) anx7625_typec_set_status+0x108/0x13c anx7625_work_func+0x124/0x438 process_one_work+0x214/0x648 worker_thread+0x1b4/0x358 kthread+0x14c/0x214 ret_from_fork+0x10/0x20 Code: 910003fd a90153f3 aa0003f3 2a0103f4 (f9431400) Fixes: f81455b2d332 ("drm: bridge: anx7625: implement minimal Type-C support") Reported-by: Salendarsingh Gaud Signed-off-by: Loic Poulain [db: dropped chunk anx7625_typec_unregister(), wrote commit message] Cc: Amit Kucheria Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260215-anx-fix-no-typec-v1-1-75172a5ca88b@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 10e9ff46fe07bdfa8c11434d4b943f89d8ba74f6 Author: Arnd Bergmann Date: Wed Mar 4 09:35:52 2026 +0100 drm: bridge: anx7625: enforce CONFIG_USB_ROLE_SWITCH dependency When CONFIG_TYPEC is enabled, but USB_ROLE_SWITCH=m, the anx7625 driver fails to link as built-in: aarch64-linux-ld: drivers/gpu/drm/bridge/analogix/anx7625.o: in function `anx7625_i2c_remove': anx7625.c:(.text+0x6ec): undefined reference to `usb_role_switch_put' aarch64-linux-ld: drivers/gpu/drm/bridge/analogix/anx7625.o: in function `anx7625_typec_set_status': anx7625.c:(.text+0x3080): undefined reference to `usb_role_switch_set_role' aarch64-linux-ld: drivers/gpu/drm/bridge/analogix/anx7625.o: in function `anx7625_i2c_probe': anx7625.c:(.text+0x5368): undefined reference to `fwnode_usb_role_switch_get' The problem is that both dependencies are optional in the sense of allowing the anx7625 driver to call the exported interfaces to be used from a loadable module, but cannot work for built-in drivers. It would be possible to handle all nine combinations of the CONFIG_TYPEC and CONFIG_USB_ROLE_SWITCH tristate options, but that does add a lot of complexity that seems unnecessary when in reality any user of this driver would have both enabled anyway. Turn both dependencies into hard 'depends on' here to only allow configurations where it's possible to actually use them, and remove the misguided IS_REACHABLE() check that did nothing here. Fixes: f81455b2d332 ("drm: bridge: anx7625: implement minimal Type-C support") Signed-off-by: Arnd Bergmann Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260304083604.724519-1-arnd@kernel.org Signed-off-by: Dmitry Baryshkov commit 73a864352570fd30d942652f05bfe9340d7a2055 Author: Rosen Penev Date: Fri Mar 6 19:17:09 2026 -0800 net: mvneta: support EPROBE_DEFER when reading MAC address If nvmem loads after the ethernet driver, mac address assignments will not take effect. of_get_ethdev_address returns EPROBE_DEFER in such a case so we need to handle that to avoid eth_hw_addr_random. Add extra goto section to just free stats as they are allocated right above. Signed-off-by: Rosen Penev Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260307031709.640141-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski commit 690043b95c1804cccce8ae6a6677a6b5de33ca77 Author: Dimitri Daskalakis Date: Mon Mar 9 13:42:15 2026 -0700 selftests: drv-net: rss: Add retries to test_rss_key_indir to reduce flakes The test generates 16 flows, and verifies that traffic is distributed across two queues via the NICs RSS indirection table. The likelihood of the flows skewing to a single queue is high, so we retry sending traffic up to 3 times. Alternatively, we could increase the number of generated flows. But debug kernels may struggle to ramp this many flows. During manual testing, the test passed for 10,000 consecutive runs. Signed-off-by: Dimitri Daskalakis Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20260309204215.2110486-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit 7da62262ec96a4b345d207b6bcd2ddf5231b7f7d Author: Fernando Fernandez Mancera Date: Mon Mar 9 03:39:45 2026 +0100 inet: add ip_local_port_step_width sysctl to improve port usage distribution With the current port selection algorithm, ports after a reserved port range or long time used port are used more often than others [1]. This causes an uneven port usage distribution. This combines with cloud environments blocking connections between the application server and the database server if there was a previous connection with the same source port, leading to connectivity problems between applications on cloud environments. The real issue here is that these firewalls cannot cope with standards-compliant port reuse. This is a workaround for such situations and an improvement on the distribution of ports selected. The proposed solution is to implement a variant of RFC 6056 Algorithm 5. The step size is selected randomly on every connect() call ensuring it is a coprime with respect to the size of the range of ports we want to scan. This way, we can ensure that all ports within the range are scanned before returning an error. To enable this algorithm, the user must configure the new sysctl option "net.ipv4.ip_local_port_step_width". In addition, on graphs generated we can observe that the distribution of source ports is more even with the proposed approach. [2] [1] https://0xffsoftware.com/port_graph_current_alg.html [2] https://0xffsoftware.com/port_graph_random_step_alg.html Reviewed-by: Eric Dumazet Signed-off-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260309023946.5473-2-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 2bf2d65f76697820dbc4227d13866293576dd90a Author: Junrui Luo Date: Wed Mar 4 23:42:58 2026 +0800 scsi: target: core: Fix integer overflow in UNMAP bounds check sbc_execute_unmap() checks LBA + range does not exceed the device capacity, but does not guard against LBA + range wrapping around on 64-bit overflow. Add an overflow check matching the pattern already used for WRITE_SAME in the same file. Fixes: 86d7182985d2 ("target: Add sbc_execute_unmap() helper") Reported-by: Yuhao Jiang Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB7881593C61AD52C69FBDB0BDAF7CA@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Martin K. Petersen commit ae95cbaedb754633b9c0d35712a024b16a70962e Merge: b8a0e5eb6a126a 87fdf57ded3d3e Author: Jakub Kicinski Date: Tue Mar 10 18:54:25 2026 -0700 Merge branch 'selftests-rds-ksft-cleanups' Allison Henderson says: ==================== selftests: rds: ksft cleanups This set addresses a few rds selftests clean ups and bugs encountered when running in the ksft framework. The first patch is a clean up patch that addresses pylint warnings, but otherwise no functional changes. The next patch moves the test time out to a ksft settings file so that the time out is set appropriately. And lastly we fix a tcpdump segfault caused by deprecated a os.fork() call. ==================== Link: https://patch.msgid.link/20260308055835.1338257-1-achender@kernel.org Signed-off-by: Jakub Kicinski commit 87fdf57ded3d3e83b90cffb160fce8e2a914142a Author: Allison Henderson Date: Sat Mar 7 22:58:35 2026 -0700 selftests: rds: Fix tcpdump segfault in rds selftests net/rds/test.py sees a segfault in tcpdump when executed through the ksft runner. [ 21.903713] tcpdump[1469]: segfault at 0 ip 000072100e99126d sp 00007ffccf740fd0 error 4 [ 21.903721] in libc.so.6[16a26d,7798b149a000+188000] [ 21.905074] in libc.so.6[16a26d,72100e84f000+188000] likely on CPU 5 (core 5, socket 0) [ 21.905084] Code: 00 0f 85 a0 00 00 00 48 83 c4 38 89 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 1f 44 00 00 48 8b 05 91 8b 09 00 8b 4d ac 64 89 08 <41> 0f b6 07 83 e8 2b a8 fd 0f 84 54 ff ff ff 49 8b 36 4c 89 ff e8 [ 21.906760] likely on CPU 9 (core 9, socket 0) [ 21.913469] Code: 00 0f 85 a0 00 00 00 48 83 c4 38 89 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 1f 44 00 00 48 8b 05 91 8b 09 00 8b 4d ac 64 89 08 <41> 0f b6 07 83 e8 2b a8 fd 0f 84 54 ff ff ff 49 8b 36 4c 89 ff e8 The os.fork() call creates extra complexity because it forks the entire process including the python interpreter. ip() then calls cmd() which creates a subprocess.Popen. We can avoid the extra layering by simply calling subprocess.Popen directly. Track the process handles directly and terminate them at cleanup rather than relying on killall. Further tcpdump's -Z flag attempts to change savefile ownership, which is not supported by the 9p protocol. Fix this by writing pcap captures to "/tmp" during the test and move them to the log directory after tcpdump exits. Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260308055835.1338257-4-achender@kernel.org Signed-off-by: Jakub Kicinski commit b873b4e16042fac1244499dab5a72373d25ce051 Author: Allison Henderson Date: Sat Mar 7 22:58:34 2026 -0700 selftests: rds: Add ksft timeout rds/run.sh sets a timer of 400s when calling test.py. However when tests are run through ksft, a default 45s timer is applied. Fix this by adding a ksft timeout in tools/testing/selftests/net/rds/settings Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260308055835.1338257-3-achender@kernel.org Signed-off-by: Jakub Kicinski commit 5a0c5702bd0016ce761dfa2ce84c009a3a32d863 Author: Allison Henderson Date: Sat Mar 7 22:58:33 2026 -0700 selftests: rds: Fix pylint warnings Tidy up all exiting pylint errors in test.py. No functional changes are introduced in this patch Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260308055835.1338257-2-achender@kernel.org Signed-off-by: Jakub Kicinski commit 20ca5460e5f95163b85dda555625a27d1c120ebf Author: Ed Tsai Date: Tue Mar 10 08:52:30 2026 +0800 scsi: ufs: host: mediatek: Add VCC on delay for stability Introduce a delay after enabling UFS5 VCC for MT6995 to ensure voltage stability before refclk activation. Signed-off-by: Ed Tsai Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260310005230.4001904-6-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen commit 6ab94d0194ddca662da69cf42b98dcf74690ed92 Author: Ed Tsai Date: Tue Mar 10 08:52:28 2026 +0800 scsi: ufs: core: Add quirks for VCC ramp-up delay On some platforms, the VCC regulator has a slow ramp-up time. Add a delay after enabling VCC to ensure voltage has fully stabilized before we enable the clocks. Reviewed-by: Bart Van Assche Signed-off-by: Ed Tsai Link: https://patch.msgid.link/20260310005230.4001904-4-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen commit 096cd6b7adf21791827a045d464242d93a6fd54e Author: Adrian Hunter Date: Mon Mar 9 10:58:15 2026 +0200 scsi: ufs: ufs-pci: Add support for Intel Nova Lake Add PCI ID to support Intel Nova Lake, same as Intel Meteor Lake (MTL). Signed-off-by: Adrian Hunter Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260309085815.55216-1-adrian.hunter@intel.com Signed-off-by: Martin K. Petersen commit 3e70441fb508c8f3ad475f0d20e016913be60e87 Author: Mike Christie Date: Sat Mar 7 16:06:30 2026 -0600 scsi: target: core: Fix complete_type use There were two copy and paste type of errors where I swapped 'complete' with 'submit' names. Use the correct variables and definitions. This problem was found by Dmitry Bogdanov and this patch builds on top of his patch to fix a second instance that was found. Fixes: 06933066d88a ("scsi: target: Add support for completing commands from backend context") Signed-off-by: Dmitry Bogdanov [mnc: Fixed second instance] Signed-off-by: Mike Christie Link: https://patch.msgid.link/20260307220630.131008-1-michael.christie@oracle.com Signed-off-by: Martin K. Petersen commit b8a0e5eb6a126a641ab8768e825756a66848ca29 Author: Jakub Kicinski Date: Sat Mar 7 09:59:16 2026 -0800 tools: ynl: cli: order set->list conversion in JSON output NIPA tries to make sure that HW tests don't modify system state. It dumps some well known configs before and after the test and compares the outputs. Make sure that YNL json output is stable. Converting sets to lists with a naive list(o) results in a random order. Link: https://patch.msgid.link/20260307175916.1652518-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 16767c72a40f524fbd0441386f2c3b6f5ff283b0 Merge: 05e059510edf7b aa5ec9d03b9c44 Author: Jakub Kicinski Date: Tue Mar 10 17:53:10 2026 -0700 Merge branch 'smc-sysctl-formatting-and-missing-entries' Kyoji Ogasawara says: ==================== smc-sysctl formatting and missing entries update SMC sysctl documentation in two small steps. - patch 1 fixes indentation in the smcr_buf_type section - patch 2 documents missing sysctl parameters limit_smc_hs and hs_ctrl, including values/defaults and hs_ctrl usage notes ==================== Link: https://patch.msgid.link/20260309124541.22723-1-sawara04.o@gmail.com Signed-off-by: Jakub Kicinski commit aa5ec9d03b9c4459e528ecd75d84f6ef98fb2f5a Author: Kyoji Ogasawara Date: Mon Mar 9 21:45:40 2026 +0900 net/smc: Add documentation for limit_smc_hs and hs_ctrl Document missing SMC sysctl parameters limit_smc_hs and hs_ctrl Signed-off-by: Kyoji Ogasawara Reviewed-by: D. Wythe Link: https://patch.msgid.link/20260309124541.22723-3-sawara04.o@gmail.com Signed-off-by: Jakub Kicinski commit 4a51ac9056c17e8216b245cd16152eefbd21abfb Author: Kyoji Ogasawara Date: Mon Mar 9 21:45:39 2026 +0900 net/smc: fix indentation in smcr_buf_type section smcr_buf_type section used inconsistent indentation compared with the rest of this document. Signed-off-by: Kyoji Ogasawara Reviewed-by: D. Wythe Link: https://patch.msgid.link/20260309124541.22723-2-sawara04.o@gmail.com Signed-off-by: Jakub Kicinski commit e95e85b8914be1c951a1ead34b1353592719e26e Author: Alan Maguire Date: Tue Mar 10 11:13:29 2026 +0000 selftests/bpf: Handle !CONFIG_SMC in bpf_smc.c Currently BPF selftests will fail to compile if CONFIG_SMC is not set. Use BPF CO-RE to work around the case where CONFIG_SMC is not set; use ___local variants of relevant structures and utilize bpf_core_field_exists() for net->smc. The test continues to pass where CONFIG_SMC=y CONFIG_SMC_HS_CTRL_BPF=y but these changes allow the selftests to build in the absence of CONFIG_SMC=y. Also ensure that we get a pure skip rather than a skip+fail by removing the SMC is unsupported part from the ASSERT_FALSE() in get_smc_nl_family(); doing this means we get a skip without a fail when CONFIG_SMC is not set: $ sudo ./test_progs -t bpf_smc Summary: 1/0 PASSED, 1 SKIPPED, 0 FAILED Fixes: beb3c67297d9 ("bpf/selftests: Add selftest for bpf_smc_hs_ctrl") Reported-by: Colm Harrington Signed-off-by: Alan Maguire Signed-off-by: Martin KaFai Lau Tested-by: Kumar Kartikeya Dwivedi Link: https://patch.msgid.link/20260310111330.601765-1-alan.maguire@oracle.com commit 6d4b67a2a76a4ff2393fe88119ae4332821b82b4 Author: bui duc phuc Date: Mon Mar 9 14:14:13 2026 +0700 Input: mpr121 - drop redundant wakeup handling The driver currently calls device_init_wakeup() and manually toggles IRQ wake in suspend and resume paths. This is unnecessary since the I2C core already handles wakeup configuration when the device is described in Device Tree with the "wakeup-source" property. Signed-off-by: bui duc phuc Link: https://patch.msgid.link/20260309071413.92709-1-phucduc.bui@gmail.com Signed-off-by: Dmitry Torokhov commit f6390408a846aacc2171c17d88b062e202d84e86 Author: Omer El Idrissi Date: Wed Jan 28 17:58:46 2026 +0100 staging: media: ipu3: fix function argument alignment Fix alignment of function arguments to match kernel coding style as reported by checkpatch.pl Signed-off-by: Omer El Idrissi Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 9da49bd9d4224035cff39b40d7395310abb10201 Author: Haoxiang Li Date: Mon Jan 26 09:44:12 2026 +0800 media: omap3isp: drop the use count of v4l2 pipeline In isp_video_open(), drop the use count of v4l2 pipeline if vb2_queue_init() fails. Fixes: 8fd390b89cc8 ("media: Split v4l2_pipeline_pm_use into v4l2_pipeline_pm_{get, put}") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 942435a62d67035394340cfcbaa534145d638bf0 Author: Geert Uytterhoeven Date: Tue Jan 27 20:10:09 2026 +0100 media: synopsys: VIDEO_DW_MIPI_CSI2RX should depend on ARCH_ROCKCHIP The Synopsys DesignWare MIPI CSI-2 Receiver is currently only supported on Rockchip RK3568 SoCs. Hence add a dependency on ARCH_ROCKCHIP, to prevent asking the user about this driver when configuring a kernel without Rockchip platform support. The dependency can be relaxed later, when adding support for appropriate SoCs from other vendors (if any). Fixes: 355a110040665e43 ("media: synopsys: add driver for the designware mipi csi-2 receiver") Signed-off-by: Geert Uytterhoeven Acked-by: Michael Riesch Reviewed-by: Frank Li Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit c3109ecc3bb76aab9ef65f2e795a97a764a0b4a3 Author: Ziyi Guo Date: Fri Jan 30 02:31:54 2026 +0000 media: i2c: imx258: add missing mutex protection for format code access imx258_open(), imx258_enum_mbus_code(), and imx258_enum_frame_size() call imx258_get_format_code() without holding imx258->mutex. However, imx258_get_format_code() has lockdep_assert_held(&imx258->mutex) indicating that callers must hold this lock. All other callers of imx258_get_format_code() properly acquire the mutex: - imx258_set_pad_format() acquires mutex at imx258.c:918 - imx258_get_pad_format() acquires mutex at imx258.c:896 The mutex is needed to protect access to imx258->vflip->val and imx258->hflip->val which are used to calculate the bayer format code. Add mutex_lock()/mutex_unlock() around the imx258_get_format_code() calls in the affected functions to fix the missing lock protection. Signed-off-by: Ziyi Guo Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 46c2891cf12c767de031a248cbb1f96d203bd3f6 Author: Chen Ni Date: Fri Jan 30 12:18:15 2026 +0800 media: i2c: ar0521: Check return value of devm_gpiod_get_optional() in ar0521_probe() The devm_gpiod_get_optional() function may return an error pointer (ERR_PTR) in case of a genuine failure during GPIO acquisition, not just NULL which indicates the legitimate absence of an optional GPIO. Add an IS_ERR() check after the function call to catch such errors and propagate them to the probe function, ensuring the driver fails to load safely rather than proceeding with an invalid pointer. Signed-off-by: Chen Ni Acked-by: Krzysztof Hałasa Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit dab65dfbf9c8beb325577c35450c9d363f423f44 Author: Chen Ni Date: Fri Jan 30 12:20:43 2026 +0800 media: i2c: vgxy61: Check return value of devm_gpiod_get_optional() in vgxy61_probe() The devm_gpiod_get_optional() function may return an error pointer (ERR_PTR) in case of a genuine failure during GPIO acquisition, not just NULL which indicates the legitimate absence of an optional GPIO. Add an IS_ERR() check after the function call to catch such errors and propagate them to the probe function, ensuring the driver fails to load safely rather than proceeding with an invalid pointer. Signed-off-by: Chen Ni Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit c8e0585dce5df525308f0fba40b618df03aaf7fc Author: Chen Ni Date: Mon Feb 2 10:43:12 2026 +0800 media: i2c: mt9p031: Check return value of devm_gpiod_get_optional() in mt9p031_probe() The devm_gpiod_get_optional() function may return an error pointer (ERR_PTR) in case of a genuine failure during GPIO acquisition, not just NULL which indicates the legitimate absence of an optional GPIO. Add an IS_ERR() check after the function call to catch such errors and propagate them to the probe function, ensuring the driver fails to load safely rather than proceeding with an invalid pointer. Signed-off-by: Chen Ni Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 943b1f27a3eead21b22e2531a5432ea5910b60eb Author: Chen Ni Date: Wed Feb 4 10:48:59 2026 +0800 media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() The devm_gpiod_get_optional() function may return an error pointer (ERR_PTR) in case of a genuine failure during GPIO acquisition, not just NULL which indicates the legitimate absence of an optional GPIO. Add an IS_ERR() check after the function call to catch such errors and propagate them to the probe function, ensuring the driver fails to load safely rather than proceeding with an invalid pointer. Fixes: 1283b3b8f82b ("media: i2c: Add driver for Sony IMX219 sensor") Cc: stable@vger.kernel.org Signed-off-by: Chen Ni Reviewed-by: Dave Stevenson Reviewed-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit c64122124c482df1bf606d34d30895359f501cf5 Author: Ethan Nelson-Moore Date: Fri Jan 30 18:00:47 2026 -0800 media: remove unnecessary module_init/exit functions Three media drivers have unnecessary module_init and module_exit functions that are empty or just print a message. Remove them. Note that if a module_init function exists, a module_exit function must also exist; otherwise, the module cannot be unloaded. Signed-off-by: Ethan Nelson-Moore Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c Author: Sakari Ailus Date: Thu Feb 26 15:10:54 2026 +0200 staging: media: atomisp: Disallow all private IOCTLs Disallow all private IOCTLs. These aren't quite as safe as one could assume of IOCTL handlers; disable them for now. Instead of removing the code, return in the beginning of the function if cmd is non-zero in order to keep static checkers happy. Reported-by: Soufiane Dani Closes: https://lore.kernel.org/linux-staging/20260210-atomisp-fix-v1-1-024429cbff31@tutanota.com/ Cc: stable@vger.kernel.org Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Fixes: ad85094b293e ("Revert "media: staging: atomisp: Remove driver"") Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit d6576b85d3fe75238e67d3e311222e7f69730b09 Author: Leif Skunberg Date: Tue Feb 10 10:45:45 2026 +0100 media: ipu-bridge: Add OV5675 sensor config Add the Omnivision OV5675 (ACPI HID OVTI5675) to the ipu_supported_sensors[] table with a link frequency of 450 MHz. This sensor is found in the Lenovo ThinkPad X1 Fold 16 Gen 1 behind an Intel Vision Sensing Controller (IVSC). Without this entry the IPU bridge does not create the software-node fwnode graph for the sensor, preventing the camera from being enumerated. Signed-off-by: Leif Skunberg Reviewed-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit cd9f95628e375634a93fc0f4f980abc62f59cce1 Author: Richard Acayan Date: Mon Feb 16 19:27:34 2026 -0500 media: i2c: imx355: Support devicetree and power management A device tree compatible makes it possible for this driver to be used on Open Firmware devices. Initialization of power-managed resources such as the reset GPIO and voltage regulators can be specified in the device tree and handled by the driver. Add support for this so the Pixel 3a can use the driver. Reviewed-by: Bryan O'Donoghue Reviewed-by: Vladimir Zapolskiy Signed-off-by: Richard Acayan Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit cdf81b4e47b1b37b55de6067d2feaeab972e746b Author: Richard Acayan Date: Mon Feb 16 19:27:33 2026 -0500 dt-bindings: media: i2c: Add Sony IMX355 The IMX355 camera sensor is a camera sensor that can be found as the front camera in some smartphones, such as the Pixel 3, Pixel 3 XL, Pixel 3a, and Pixel 3a XL. It already has a driver, but needs support for device tree. Document the IMX355 to support defining it in device tree. Reviewed-by: Vladimir Zapolskiy Reviewed-by: Krzysztof Kozlowski Signed-off-by: Richard Acayan Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 9cea4f8e56dbbddb6128a21666c8ccf7d9269995 Author: Richard Acayan Date: Mon Feb 16 19:27:32 2026 -0500 dt-bindings: media: qcom,sdm670-camss: Remove clock-lanes requirement The clock-lanes property has no effect on the hardware configuration, as of commit 336136e197e2 ("media: dt-bindings: media: camss: Remove clock-lane property"). Since boards with new camss support can omit the property, remove it from the required lists. Signed-off-by: Richard Acayan Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 4369a7d34d649d71be4984e7484178f3287932bc Author: Vladimir Zapolskiy Date: Thu Feb 26 15:37:39 2026 +0200 media: i2c: og01a1b: Add support of 8-bit media bus format Omnivision OG01A1B monochrome image sensor supports 8-bit and 10-bit output formats, add support of 8-bit Y8 format to the driver. Signed-off-by: Vladimir Zapolskiy [Sakari Ailus: Fix error handling for enable_streams callback.] Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 4ab1e06143290f9ffcddeab72abede3a677def1f Author: Vladimir Zapolskiy Date: Thu Feb 26 15:37:38 2026 +0200 media: i2c: og01a1b: Use generic v4l2_subdev_get_fmt() to get format The generic v4l2_subdev_get_fmt() helper function can be utilized to get the setup device format instead of the custom one. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit d935219d19daf1d43d116e14c253a17bb23cd480 Author: Vladimir Zapolskiy Date: Thu Feb 26 15:37:37 2026 +0200 media: i2c: og01a1b: Replace .open with .init_state internal ops Instead of wiping the camera sensor subdevice initial state on every open() syscall it would be better to set the initial state just once. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit a62d99ed89888d3446cab5b7bc1a8cea001190b8 Author: Vladimir Zapolskiy Date: Thu Feb 26 15:37:36 2026 +0200 media: i2c: og01a1b: Change I2C interface controls to V4L2 CCI Switch the sensor driver to utilize V4L2 CCI helper interfaces instead of driver specific wrappers over I2C read/write functions. The conversion change is intended to be non-function, Group Access register macros were removed as unused ones. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 3a594bb454ba1ecb005f753007fa1bb5c5e68bae Author: Vladimir Zapolskiy Date: Thu Feb 26 15:37:35 2026 +0200 media: i2c: og01a1b: Switch from .s_stream to .enable_streams/.disable_streams The change allows to simplify the driver code, in particular the explicit locking scheme for stream on/off or format update serialization can be dropped in favour to the one provided by the V4L2 core internals. Signed-off-by: Vladimir Zapolskiy [Sakari Ailus: Fix error handling for enable_streams callback.] Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 535b7f106991c7d8f0e5b8e1769bfb8b1ce9d3d6 Author: Vladimir Zapolskiy Date: Thu Feb 26 15:37:34 2026 +0200 media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe It's necessary to finalize the camera sensor subdevice initialization on driver probe and clean V4L2 subdevice data up on error paths and driver removal. The change fixes a previously reported by v4l2-compliance issue of the failed VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT test: fail: v4l2-test-controls.cpp(1104): subscribe event for control 'User Controls' failed Fixes: 472377febf84 ("media: Add a driver for the og01a1b camera sensor") Signed-off-by: Vladimir Zapolskiy Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 9206359b2c396ff594adf39bc7daaadab0fcb367 Author: Jai Luthra Date: Sat Feb 14 18:35:22 2026 +0530 media: i2c: imx283: Fix hang when going from large to small resolution When switching between modes (e.g. full resolution to binned), standby_cancel() previously cleared XMSTA (starting master mode data output) before the new mode's MDSEL, crop, and timing registers were programmed in start_streaming(). This caused the sensor to briefly output MIPI data using the previous mode's configuration. On receivers like imx-mipi-csis, this leads to FIFO overflow errors when switching from a higher to a lower resolution, as the receiver is configured for the new smaller frame size but receives stale full-resolution data. Fix this by moving the XMSTA and SYNCDRV register writes from standby_cancel() to the end of start_streaming(), after all mode, crop, and timing registers have been configured. Also explicitly stop master mode (XMSTA=1) when stopping the stream, matching the pattern used by other Sony sensor drivers (imx290, imx415). Use named macros IMX283_XMSTA_START/STOP instead of raw 0/BIT(0) for readability. Cc: stable@vger.kernel.org Fixes: ccb4eb4496fa ("media: i2c: Add imx283 camera sensor driver") Signed-off-by: Jai Luthra Tested-by: Kieran Bingham Reviewed-by: Kieran Bingham Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit bce1349dbf6348ddee47308e2ed08878356de317 Author: Jai Luthra Date: Sat Feb 14 18:35:21 2026 +0530 media: i2c: imx283: Enter full standby when stopping streaming Use IMX283_STANDBY (bit 0) instead of IMX283_STBLOGIC (bit 1) when stopping streaming. STBLOGIC only puts the sensor logic into standby but leaves the MIPI interface (along with other components) in an indeterminate state. This (presumably) causes the CSI receiver (e.g. Raspberry Pi's CFE) to miss the LP-11 to HS transition when streaming restarts, resulting in a hang of 10+ seconds. The issue is most visible when immediately restarting a full-resolution stream after stopping a 3x3 binned one, so that runtime suspend hasn't yet been triggered. Writing IMX283_STANDBY puts the entire sensor into standby. The imx283_standby_cancel() sequence already handles the full wakeup from this suspended state. Cc: stable@vger.kernel.org Link: https://github.com/raspberrypi/linux/issues/7153 Link: https://github.com/will127534/OneInchEye/issues/12 Fixes: ccb4eb4496fa ("media: i2c: Add imx283 camera sensor driver") Signed-off-by: Jai Luthra Tested-by: Kieran Bingham Reviewed-by: Kieran Bingham Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 10c85e00f356894f1fe77055d338c941fe463720 Author: Dmitry Torokhov Date: Wed Feb 18 12:53:48 2026 -0800 media: i2c: max9286: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by max9286_gpiochip_get() is normalized to the [0, 1] range. Signed-off-by: Dmitry Torokhov Reviewed-by: Linus Walleij Reviewed-by: Kieran Bingham Reviewed-by: Bartosz Golaszewski Reviewed-by: Ricardo Ribalda Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 2c10400e4a233200046d023ab2377bc56fd48dea Author: Hans de Goede Date: Wed Feb 25 21:30:54 2026 +0100 media: ipu-bridge: Add upside-down sensor DMI quirk for Dell XPS 13 9340 and XPS 14 9440 The Dell XPS 13 9340 and XPS 14 9440 have an upside-down mounted OV02C10 sensor, just like the XPS 13 9350 and XPS 16 9640 models. Extend the existing DMI matches for handling these laptops with DMI matches for these 2 models Reported-by: Heimir Thor Sverrisson # XPS 14 9440 Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2440581 # XPS 13 9340 Fixes: d5ebe3f7d13d ("media: ov02c10: Fix default vertical flip") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit f11ae9c04f8368a3b5a0280ef595198dace1c983 Author: Xiaolei Wang Date: Wed Feb 25 16:56:21 2026 +0800 media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl Three control cases (AUTOGAIN, EXPOSURE_AUTO, ANALOGUE_GAIN) directly return without calling pm_runtime_put(), causing runtime PM reference count leaks. Change these cases from 'return' to 'ret = ... break' pattern to ensure pm_runtime_put() is always called before function exit. Fixes: 4f66f36388d5 ("media: i2c: ov5647: Convert to CCI register access helpers") Cc: stable@vger.kernel.org Signed-off-by: Xiaolei Wang Reviewed-by: Tarang Raval Reviewed-by: Jacopo Mondi Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 8dd088b8b106f7b119664f965b691785998edcfb Author: Ethan Tidmore Date: Fri Mar 6 21:03:55 2026 -0600 media: intel/ipu6: fix error pointer dereference In a error path isp->psys is confirmed to be an error pointer not NULL so this condition is true and the error pointer is dereferenced. So isp-psys should be set to NULL before going to out_ipu6_bus_del_devices. Detected by Smatch: drivers/media/pci/intel/ipu6/ipu6.c:690 ipu6_pci_probe() error: 'isp->psys' dereferencing possible ERR_PTR() Fixes: 25fedc021985a ("media: intel/ipu6: add Intel IPU6 PCI device driver") Cc: stable@vger.kernel.org Signed-off-by: Ethan Tidmore [Sakari Ailus: Fix commit message.] Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit b7ef8bbb9fbd43d33ecb92e23aa7c5a55dab5513 Author: Alexander Shiyan Date: Thu Mar 5 16:16:37 2026 +0300 media: ccs-pll: Fix pre-PLL divider calculation for EXT_IP_PLL_DIVIDER flag When the CCS_PLL_FLAG_EXT_IP_PLL_DIVIDER flag is set, odd pre-PLL divider values are allowed. However, in the operational timing branch the calculation of the minimum pre-PLL divider incorrectly uses clk_div_even_up, forcing the minimum value to be even, even if the flag is set. This prevents selecting a valid odd divider like 3, which may be required for certain sensor configurations. Fix this by removing the forced even rounding from the minimum pre-PLL divider calculation. The loop later uses the flag to determine the step, so odd values will be considered when the flag is set. Signed-off-by: Alexander Shiyan Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 2fb0481fe0d7891420c1a3df2e4f9a70b1f77dbd Author: Mark Brown Date: Mon Mar 2 16:32:18 2026 +0000 media: synopsys: hdmirx: support use with sleeping GPIOs The recent change in commit 20cf2aed89ac ("gpio: rockchip: mark the GPIO controller as sleeping") to mark the rockchip GPIO driver as sleeping has started triggering the warning at drivers/gpio/gpiolib.c:3523 indicating that a sleepable GPIO was called via the non-sleeping APIs on the Rock 5B: <4>[ 14.699308] Call trace: <4>[ 14.699545] gpiod_get_value+0x90/0x98 (P) <4>[ 14.699928] tx_5v_power_present+0x44/0xd0 [synopsys_hdmirx] <4>[ 14.700446] hdmirx_delayed_work_hotplug+0x34/0x128 [synopsys_hdmirx] <4>[ 14.701031] process_one_work+0x14c/0x28c <4>[ 14.701405] worker_thread+0x184/0x300 <4>[ 14.701756] kthread+0x11c/0x128 <4>[ 14.702065] ret_from_fork+0x10/0x20 Currently the active use of the GPIO is all done from process context so can be simply converted to use gpiod_get_value_cansleep(). There is one use of the GPIO from hard interrupt context but this is only done so the status can be displayed in a debug print so can simply be deleted without any functional effect. Reviewed-by: Heiko Stuebner Acked-by: Dmitry Osipenko Signed-off-by: Mark Brown Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 8e3c751259dc2d1325838eff26f41032523c7b57 Author: Dang Huynh Date: Thu Jan 29 14:24:02 2026 +0700 media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads The pads missed checks for connected devices which may a null dereference when the stream is enabled. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 pc : rkcif_interface_enable_streams+0x48/0xf0 lr : rkcif_interface_enable_streams+0x44/0xf0 Call trace: rkcif_interface_enable_streams+0x48/0xf0 v4l2_subdev_enable_streams+0x26c/0x3f0 rkcif_stream_start_streaming+0x140/0x278 vb2_start_streaming+0x74/0x188 vb2_core_streamon+0xe0/0x1d8 vb2_ioctl_streamon+0x60/0xa8 v4l_streamon+0x2c/0x40 __video_do_ioctl+0x34c/0x400 video_usercopy+0x2d0/0x800 video_ioctl2+0x20/0x60 v4l2_ioctl+0x48/0x78 Fixes: 501802e2ad51 ("media: rockchip: rkcif: add abstraction for dma blocks") Fixes: 85411d17bee9 ("media: rockchip: rkcif: add abstraction for interface and crop blocks") Cc: stable@vger.kernel.org Signed-off-by: Dang Huynh Reviewed-by: Michael Riesch Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 48c8292d4445088d8b3c9d639c7982744a94d819 Author: Michael Riesch Date: Fri Feb 20 09:15:08 2026 +0100 media: rockchip: rkcif: comply with minimum number of buffers requirement Each stream requires CIF_REQ_BUFS_MIN=1 buffers to enable streaming. However, it failed with only one buffer provided. Comply with the minimum number of buffers requirement and accept exactly one buffer. Fixes: 501802e2ad51 ("media: rockchip: rkcif: add abstraction for dma blocks") Cc: stable@kernel.org Tested-by: Paul Elder Tested-by: Chen-Yu Tsai Signed-off-by: Michael Riesch Reviewed-by: Isaac Scott Reviewed-by: Paul Elder Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit e4056b84af0fc18c84b4e5741df04ecd8ca17973 Author: Dan Carpenter Date: Fri Feb 20 09:15:07 2026 +0100 media: rockchip: rkcif: fix off by one bugs Change these comparisons from > vs >= to avoid accessing one element beyond the end of the arrays. While at it, use ARRAY_SIZE instead of the _MAX enum values. Fixes: 1f2353f5a1af ("media: rockchip: rkcif: add support for rk3568 vicap mipi capture") Cc: stable@kernel.org Signed-off-by: Dan Carpenter Reviewed-by: Michael Riesch Reviewed-by: Paul Elder Reviewed-by: Laurent Pinchart Tested-by: Chen-Yu Tsai [fix cosmetic issues] Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 937ffb7a427649a6bd7d1bd778cbcb70700e3062 Author: Xiaolei Wang Date: Thu Mar 5 12:33:50 2026 +0800 media: i2c: ov9282: switch to {enable,disable}_streams Switch from s_stream to enable_streams and disable_streams callbacks. Signed-off-by: Xiaolei Wang Reviewed-by: Tarang Raval Reviewed-by: Dave Stevenson Tested-by: Dave Stevenson Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 0c69a963a300f7a6882e3eb9dcb08ee0be27da85 Author: Xiaolei Wang Date: Thu Mar 5 12:33:49 2026 +0800 media: i2c: ov9282: Switch to using the sub-device state lock Switch to using the sub-device state lock and properly call v4l2_subdev_init_finalize() / v4l2_subdev_cleanup() on probe() / remove(). Signed-off-by: Xiaolei Wang Reviewed-by: Tarang Raval Reviewed-by: Dave Stevenson Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 273f52f3cbec3adc50fbb73e6a1a3c9d5f968773 Author: Xiaolei Wang Date: Thu Mar 5 12:33:48 2026 +0800 media: i2c: ov9282: Convert to CCI register access helpers Use the new common CCI register access helpers to replace the private register access helpers in the ov9282 driver. This simplifies the driver by reducing the amount of code. Signed-off-by: Xiaolei Wang Reviewed-by: Tarang Raval Reviewed-by: Dave Stevenson [Sakari Ailus: Declare ret_hold earlier to make old GCC happy.] Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 87ebce19aa03fd51aa9e7ab054e8705b7bb990b0 Author: Alain Volmat Date: Tue Jan 6 12:34:38 2026 +0100 media: stm32: dcmi: addition of DMA-MDMA chaining support Add possibility to rely on an additional MDMA channel and chain the DMA and MDMA channels allowing to achieve faster capture. Indeed, on the MP15 platform, the MDMA engine has an higher bandwidth to the DDR than the DMA engine. Relying on that it is possible to capture frames from the DCMI IP into the DDR by using two channels as follow: DCMI -> (DMA) -> SRAM -> (MDMA) -> DDR The DMA is able by himself to trigger a MDMA request hence, once properly configured, the DCMI IP can simply trigger the DMA in order to have the data pushed up to the DDR (via the SRAM and a MDMA channel). This behavior is detailed in the document Documentation/arch/arm/stm32/stm32-dma-mdma-chaining.rst Signed-off-by: Alain Volmat Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 57611a49e50c742d19c8e5f043e698cce8dbf0ba Author: Alain Volmat Date: Tue Jan 6 12:34:37 2026 +0100 dt-bindings: media: st: dcmi: add DMA-MDMA chaining properties Add properties update and new sram property necessary in order to enable the DMA-MDMA chaining. Signed-off-by: Alain Volmat Reviewed-by: Rob Herring (Arm) Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit fd239fef09d1ecc981fd50cf1ea3c476a002f944 Author: Alain Volmat Date: Tue Jan 6 12:34:36 2026 +0100 media: stm32: dcmi: continuous mode capture in JPEG Overall cleanup done allows to now have the JPEG handling done in the same way as other formats in continuous mode, allowing to achieve a faster framerate in all resolutions. Signed-off-by: Alain Volmat Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 04e047447a05de495ac2a9cb96adf35bf1c0e0f8 Author: Alain Volmat Date: Tue Jan 6 12:34:35 2026 +0100 media: stm32: dcmi: use dmaengine_terminate_async in irq context Whenever receiving an OVERRUN event or an end of frame, the driver stops currently ongoing DMA transfer since the DCMI stops sending data to dma. Not doing this would lead to having DMA & DCMI no more synchronized in term of expected data to be copied. Since this is done in irq handler context, it is not possible to make any call that would lead to scheduling hence dmaengine_terminate_sync are not possible. Since the dcmi driver is NOT using dma callbacks, it is possible thus to call instead dmaengine_terminate_async (aka without synchronize) and call again right after a new dmaengine_submit to setup again a new transfer. And since this is now a dmaengine_submit_async, there is no need to release the spinlock around calls to the dmaengine_submit_async. Signed-off-by: Alain Volmat Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit c1cde65747158e90e3e4633d571450d929b4a4fe Author: Alain Volmat Date: Tue Jan 6 12:34:34 2026 +0100 media: stm32: dcmi: perform all dma handling within irq_thread Move all the type of frame handling within the dcmi_irq_thread handler and do not rely on dma_callback as previously. This simplifies the code by having only a single path for both compressed and uncompressed data while also making the system more reactive since irq_handler have more chances to be called faster than the dma completion callback. Indeed, in case of the dma completion callback, this run as a tasklet created by the dma framework upon getting an interrupt from the dma and run at a lower priority level than other irq handlers. Signed-off-by: Alain Volmat Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit c0216d072f119e89dd24735a068808427ab643b5 Author: Alain Volmat Date: Tue Jan 6 12:34:33 2026 +0100 media: stm32: dcmi: rework spin_lock calls Rework of the spin_lock calls in preparation of the rework of the data handling of the driver. Keep it straight forward with basically spin_lock protection around everything except dmaengine calls that might sleep (ex: synchronize / terminate) Signed-off-by: Alain Volmat Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 4847286b87ccda7bdec8245f35c07203ce9eb0ed Author: Alain Volmat Date: Tue Jan 6 12:34:32 2026 +0100 media: stm32: dcmi: stop the dma transfer on overrun Ensure to stop the dma transfer whenever receiving a overrun to avoid having a buffer partially filled with a frame and partially with the next frame. Signed-off-by: Alain Volmat Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 9b6f6208f40dee7e021a97f863cdcdd55c59327c Author: Alain Volmat Date: Tue Jan 6 12:34:31 2026 +0100 media: stm32: dcmi: only create dma descriptor once at buf_prepare Perform the dmaengine prep_slave_sg call within buf_prepare and mark the descriptor as reusable in order to avoid having to redo this at every start of the dma. This also allow to remove the mutex used by the driver to protect dma descriptors related piece of codes. Signed-off-by: Alain Volmat Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit bc901885fae0a0273288666609d143e960b6ad3a Author: Alain Volmat Date: Tue Jan 6 12:34:30 2026 +0100 media: stm32: dcmi: perform dmaengine_slave_config at probe Perform the dma channel configuration at probe time right after the channel allocation since this is fixed for the whole lifetime of the driver. Signed-off-by: Alain Volmat Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 9ab2bd7760a9edc23dfef71bb94092359ce94024 Author: Alain Volmat Date: Tue Jan 6 12:34:29 2026 +0100 media: stm32: dcmi: Switch from __maybe_unused to pm_ptr() Letting the compiler remove these functions when the kernel is built without CONFIG_PM_SLEEP support is simpler and less heavier for builds than the use of __maybe_unused attributes. Signed-off-by: Alain Volmat Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 0001c706ee98738613cc8f6dcd139766230a9e01 Author: Svyatoslav Ryhel Date: Thu Mar 5 12:21:22 2026 +0200 media: i2c: mt9m114: add support for Aptina MI1040 Slightly different version of MT9M114 camera module is used in a several devices like ASUS Nexus 7 (2012) or ASUS Transformer Prime TF201 and is called Aptina MI1040. The only difference found so far is lacking ability to poll STATE register during power on sequence, which causes driver to fail with time out error. Add state_standby_polling flag to diverge models and address quirk found in MI1040. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 0731914021a3401538b04d345149ff601ebc9d5a Author: Svyatoslav Ryhel Date: Thu Mar 5 12:21:21 2026 +0200 dt-bindings: media: mt9m114: document MI1040 sensor The Aptina MI1040 is a slightly different version of the MT9M114 camera module. It is used in several devices, such as the ASUS Nexus 7 (2012) and the ASUS Transformer Prime TF201. The compatible "onnn,mt9m114" is placed first in the enum, as it is considered the default compatible value. Signed-off-by: Svyatoslav Ryhel Acked-by: Conor Dooley Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 76cd9527b70bd6c12fbe08743e13b397e860640b Author: Krzysztof Kozlowski Date: Sun Mar 1 14:44:04 2026 +0100 media: samsung: exynos4-is: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit d6113cdd221964ebcfd479f56b1b7e9c4e28e7d4 Author: Tomi Valkeinen Date: Mon Mar 24 10:04:46 2025 +0200 media: i2c: ds90ub913: Use v4l2_subdev_get_frame_desc_passthrough Use the new v4l2_subdev_get_frame_desc_passthrough helper for .get_frame_desc. Signed-off-by: Tomi Valkeinen Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 3ff6b67e0a6dcbfa541bf97b80dfc73bf82fa96e Author: Tomi Valkeinen Date: Mon Mar 24 10:04:45 2025 +0200 media: i2c: ds90ub953: Use v4l2_subdev_get_frame_desc_passthrough Use the new v4l2_subdev_get_frame_desc_passthrough helper for .get_frame_desc. Signed-off-by: Tomi Valkeinen Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit a564839e630c11b089470d2e010b0019b7cf61bc Author: Tomi Valkeinen Date: Mon Mar 24 10:04:44 2025 +0200 media: subdev: Add v4l2_subdev_get_frame_desc_passthrough helper Add a helper for v4l2_subdev_pad_ops.v4l2_get_frame_desc operation. The helper can be used when the subdevice directly passes through the streams. Signed-off-by: Tomi Valkeinen Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 291d75952cf7e6801fe02c62ad694d50dc64e56b Author: Tomi Valkeinen Date: Thu Jan 15 12:07:01 2026 +0200 media: rcar-csi2: Optimize rcsi2_calc_mbps() With modern drivers supporting link-freq, we don't need to do any calculations based on the bpp and number of lanes when figuring out the link frequency. However, the code currently always runs code to get the bpp and number of lanes. Optimize the rcsi2_calc_mbps() so that we only do that when needed, i.e. when querying the link-freq is not supported by the upstream subdevice. Signed-off-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Reviewed-by: Niklas Söderlund Tested-by: Niklas Söderlund Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 21bcc9355cae73637e42865ee2c61d48d209a91d Author: Tomi Valkeinen Date: Thu Jan 15 12:07:00 2026 +0200 media: rcar-csi2: Simplify rcsi2_calc_mbps() Instead of taking the bpp and the number of lanes as parameters to rcsi2_calc_mbps(), change the function to get those parameters inside the function. This centralizes the code a bit and makes it easier to add streams support. Also, in the future when the legacy (non-link-freq) code is removed, there will be no need to change rcsi2_calc_mbps() parameters. Signed-off-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Reviewed-by: Niklas Söderlund Tested-by: Niklas Söderlund Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 0ffd7f4c4c3b4ab55b34d6f27b15e65ba75c10ea Author: Tomi Valkeinen Date: Thu Jan 15 12:06:59 2026 +0200 media: rcar-csi2: Move rcsi2_calc_mbps() Move the function so that it can call rcsi2_get_active_lanes() in the following patch. No functional change intended. Signed-off-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Reviewed-by: Niklas Söderlund Tested-by: Niklas Söderlund Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 6de424728b56a85465216f003660286fa91c9087 Author: Tomi Valkeinen Date: Thu Jan 15 12:06:58 2026 +0200 media: rcar-csi2: Improve FLD_FLD_EN macros Instead of having four macros for FLD_FLD_EN for different channels, have just one FLD_FLD_EN(ch). Signed-off-by: Tomi Valkeinen Reviewed-by: Niklas Söderlund Tested-by: Niklas Söderlund Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit be87abcc20f90fffbc140ea918c8861da753ce97 Author: Tomi Valkeinen Date: Thu Jan 15 12:06:57 2026 +0200 media: rcar-isp: Improve ISPPROCMODE_DT_PROC_MODE_VC Instead of having four macros for ISPPROCMODE_DT_PROC_MODE_VC[0123](pm), have just one ISPPROCMODE_DT_PROC_MODE_VCn(vc, pm). Signed-off-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Reviewed-by: Niklas Söderlund Tested-by: Niklas Söderlund Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 0707307f039813eed83e9e8d6cd70c02a6e86158 Author: Yemike Abhilash Chandra Date: Tue Feb 24 17:09:24 2026 +0530 media: i2c: ds90ub960: Add support for DS90UB954-Q1 DS90UB954-Q1 is an FPDLink-III deserializer that is mostly register compatible with DS90UB960-Q1. The main difference is that it supports half of the RX and TX ports, i.e. 2x FPDLink RX ports and 1x CSI TX port. A couple of differences are between the status registers and the strobe setting registers. Hence accommodate these differences in the UB960 driver so that we can reuse a large part of the existing code. Link: https://www.ti.com/lit/gpn/ds90ub954-q1 Reviewed-by: Jai Luthra Reviewed-by: Tomi Valkeinen Signed-off-by: Yemike Abhilash Chandra Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 1c067005b06f809ae48bf9acf6588f74f1ca7ce7 Author: Yemike Abhilash Chandra Date: Tue Feb 24 17:09:23 2026 +0530 media: dt-bindings: ti,ds90ub960: Add support for DS90UB954-Q1 DS90UB954-Q1 is an FPDLink-III deserializer that is mostly register compatible with DS90UB960-Q1. The main difference is that it supports half of the RX and TX ports, i.e. 2x FPDLink RX ports and 1x CSI TX port. Therefore, add support for DS90UB954 within the existing bindings. Link: https://www.ti.com/lit/gpn/ds90ub954-q1 Reviewed-by: Rob Herring (Arm) Reviewed-by: Tomi Valkeinen Signed-off-by: Yemike Abhilash Chandra Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 8bc79ab270fba606bb96c52356176d1e0957f8ba Author: Yemike Abhilash Chandra Date: Tue Feb 24 17:09:22 2026 +0530 media: i2c: ds90ub960: Use enums for chip type and chip family Replace chip-specific boolean flags with chip_type and chip_family enums. This simplifies the process of adding support for newer devices and also improves code readability. Reviewed-by: Tomi Valkeinen Reviewed-by: Jai Luthra Signed-off-by: Yemike Abhilash Chandra Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 76c101e2e06393656731e35b9744b12f3b180999 Author: Yemike Abhilash Chandra Date: Tue Feb 24 17:09:21 2026 +0530 media: dt-bindings: ti,ds90ub960: Refactor port definitions The current bindings duplicate the port definitions for each FPD-Link RX and CSI-2 TX ports. This results in a large amount of repeated schema blocks and makes it harder to extend the bindings for new devices. Refactor the bindings by introducing shared deftinitions for FPD-Link input ports and CSI-2 output ports. No functional change intended. Reviewed-by: Rob Herring (Arm) Reviewed-by: Tomi Valkeinen Signed-off-by: Yemike Abhilash Chandra Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 644673fc8fb04c10d5e085e15cda4ebd2cad3b8e Author: Jai Luthra Date: Tue Mar 3 14:54:07 2026 +0530 media: dt-bindings: Drop starfive,jh7110-camss from staging The starfive-camss driver is no longer being worked upon for destaging, and will be dropped in a subsequent commit, so drop the DT bindings. Link: https://lore.kernel.org/all/ZQ0PR01MB13024A92926C415C187D2C18F29F2@ZQ0PR01MB1302.CHNPR01.prod.partner.outlook.cn/ Acked-by: Changhuang Liang Reviewed-by: Krzysztof Kozlowski Reviewed-by: Laurent Pinchart Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 70eaeee95f7b4813737b9e529b4b33b3e9928336 Author: Jai Luthra Date: Tue Mar 3 14:54:06 2026 +0530 media: staging: Drop starfive-camss from staging The starfive-camss driver is no longer being worked upon for destaging, as confirmed by the maintainer, so drop it. Link: https://lore.kernel.org/all/ZQ0PR01MB13024A92926C415C187D2C18F29F2@ZQ0PR01MB1302.CHNPR01.prod.partner.outlook.cn/ Acked-by: Changhuang Liang Reviewed-by: Laurent Pinchart Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 64ad2497e626c48689cca6507352c4ab11cc154d Author: Wenmeng Liu Date: Fri Jan 23 17:19:56 2026 +0800 media: i2c: imx412: Extend the power-on waiting time The Arducam IMX577 module requires a longer reset time than the 1000µs configured in the current driver. Increase the wait time after power-on to ensure proper initialization. Signed-off-by: Wenmeng Liu Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 8467c5ff5acae28513bc1e0af535e06b41b04344 Author: Wenmeng Liu Date: Fri Jan 23 17:19:55 2026 +0800 media: i2c: imx412: Assert reset GPIO during probe Assert the reset GPIO before first power up. This avoids a mismatch where the first power up (when the reset GPIO defaults deasserted) differs from subsequent cycles. Signed-off-by: Wenmeng Liu Fixes: 9214e86c0cc1 ("media: i2c: Add imx412 camera sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 37e89761380b5e65dccf3f0e5fa494f2514a08a2 Author: bui duc phuc Date: Mon Mar 9 07:03:18 2026 +0700 dt-bindings: input: touchscreen: sitronix,st1232: Add wakeup-source Document the 'wakeup-source' property for Sitronix ST1232 touchscreen controllers to allow the device to wake the system from suspend. Acked-by: Krzysztof Kozlowski Signed-off-by: bui duc phuc Link: https://patch.msgid.link/20260309000319.74880-2-phucduc.bui@gmail.com Signed-off-by: Dmitry Torokhov commit b3d161f22ba9b2dc16bb82aa2b8515d98c99624f Author: Gary Guo Date: Tue Feb 3 13:06:27 2026 +0000 rust: disallow use of `CStr::as_ptr` and `CStr::from_ptr` As kernel always use unsigned char and not the platform ABI's default, an user should always use `as_char_ptr` provided via `CStrExt` instead. Therefore configure `disallow-methods` feature of clippy to catch incorrect usage. Similarly, the dual `from_ptr` is also disallowed. [ As an example, without the previous commit, we would get a warning like: warning: use of a disallowed method `core::ffi::CStr::as_ptr` --> rust/kernel/task.rs:422:54 | 422 | unsafe { crate::bindings::__might_sleep(file.as_ptr().cast(), loc.line() as i32) } | ^^^^^^ help: kernel's `char` is always unsigned, use `as_char_ptr` instead: `kernel::prelude::CStrExt::as_char_ptr` | = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.94.0/index.html#disallowed_methods = note: `-W clippy::disallowed-methods` implied by `-W clippy::all` = help: to override `-W clippy::all` add `#[allow(clippy::disallowed_methods)]` - Miguel ] Signed-off-by: Gary Guo Reviewed-by: Tamir Duberstein Link: https://patch.msgid.link/20260203130745.868762-2-gary@kernel.org Signed-off-by: Miguel Ojeda commit 1a933719e70787f462d6126230a403c15f95598e Author: Gary Guo Date: Tue Feb 3 13:06:26 2026 +0000 rust: task: use `as_char_ptr` instead of `as_ptr().cast()` `as_char_ptr` would provide the correct (unsigned char) type without needing to convert to an intermediate type and cast the pointer. The `as_ptr()` function is going to be disallowed by clippy warning, so fix this usage. This is used only if CONFIG_DEBUG_ATOMIC_SLEEP=y. Instead of conditionally importing `CStrExt`, import it via prelude instead, and remove other imports that are already available via the prelude. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601221157.89t3Sqbl-lkp@intel.com/ Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260203130745.868762-1-gary@kernel.org Signed-off-by: Miguel Ojeda commit 68bed0d6bfae422b7297c62736fee0134b3b0c24 Author: Gustavo Sousa Date: Mon Mar 9 21:42:12 2026 -0300 drm/xe: Translate C-state "reset value" into RC6 There are higher level sleep states that will cause RC6 state readout to come back with an "in-reset" value. That is the case with NVL-P. As those states are only possible if the GT is already in C6, let's just translate the "reset value" into C6 when doing the readout. Bspec: 67651 Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-7-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa commit 44b512754d168b9ed7b8bc128565150203c9ac38 Author: Gustavo Sousa Date: Mon Mar 9 21:42:11 2026 -0300 drm/xe/xe3p: Drop Wa_16028780921 Wa_16028780921 involves writing to a register that is locked by firmware prior to driver loading and doesn't have any effect if implemented by the KMD. Since the implementation of the workaround actually belongs the firmware, just drop the ineffective implementation by the KMD. Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-6-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa commit 0919b266456d81e71277c5963d4e806e85b65232 Author: Gustavo Sousa Date: Mon Mar 9 21:42:10 2026 -0300 drm/xe/nvlp: Implement Wa_14026539277 Implement the KMD part of Wa_14026539277, which applies to NVL-P A0. The KMD implementation is just one component of the workaround, which also depends on Pcode to implement its part in order to be complete. v2: - Add FUNC(xe_rtp_match_not_sriov_vf) to skip applying the workaround to SRIOV VFs. (Matt) v3: - Make Wa_14026539277 a device workaround instead of a GT workaround. (Matt) v4: - Drop FUNC(xe_rtp_match_not_sriov_vf) and use a direct check with IS_SRIOV_VF() in the workaround implementation. (Matt) Reviewed-by: Matt Roper # v3 Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-5-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa commit 557c05034ffaa0614d2ed57fff435b6630b92e70 Author: Gustavo Sousa Date: Mon Mar 9 21:42:09 2026 -0300 drm/xe/rtp: Add support for matching platform-level stepping Add support for matching platform-level stepping, which will be used for an upcoming NVL-P workaround. As support for reading platform-level stepping information is added only as needed in the driver, add a warning when the rule finds a STEP_NONE value, which is an indication that the driver is missing such a support. Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-4-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa commit 19da26bce08a5686515b877099af78169148a3b3 Author: Gustavo Sousa Date: Mon Mar 9 21:42:08 2026 -0300 drm/xe/nvlp: Read platform-level stepping info There will be a NVL-P workaround for which we will need to know the platform-level stepping information in order to decide whether to apply it or not. While NVL-P has a nice mapping between the PCI revid and our symbolic stepping enumeration, not all platforms are like that: (i) Some platforms will have a single PCI revid used for a set platform level steppings (ii) and some might even require specific mappings. To make things simpler, let's include stepping information in the device info only on demand, for those platforms where it is needed for workaround checks. v2: - Call xe_step_platform_get() very early, to allow device workarounds to use it in early stages of device initialization. (Matt) Bspec: 74201 Reviewed-by: Matt Roper # v1 Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-3-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa commit ce517adff59c50a54a33ae90e2947eff9698dc86 Author: Gustavo Sousa Date: Mon Mar 9 21:42:07 2026 -0300 drm/xe: Drop unused IS_PLATFORM_STEP() and IS_SUBPLATFORM_STEP() The macros IS_PLATFORM_STEP() and IS_SUBPLATFORM_STEP() are unused since commit 87c299fa3a97 ("drm/xe/guc: Port Wa_14014475959 to xe_wa and fix it") and commit 63bbd800ff01 ("drm/xe/guc: Port Wa_22012727170/Wa_22012727685 to xe_wa"), respectively, and we can drop them now. Furthermore, in upcoming changes we will add logic to read platform-level step information from PCI RevID and keeping those macros around would potentially cause confusion. v2: - Cite commits that made the macros unused. (Matt) Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-2-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa commit 7e9de44e2c0f7d4cae734af59593054b127c8f69 Author: Gustavo Sousa Date: Mon Mar 9 21:42:06 2026 -0300 drm/xe: Modify stepping info directly in xe_step_*_get() In an upcoming change, we will add a member to struct xe_step_info to represent the platform-level stepping. As such, we should stop assigning the value returned by functions xe_step_pre_gmdid_get() and xe_step_gmdid_get() directly to xe->info.step. Since there are no other users for those functions, let's simply update them to modify xe->info.step directly. Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-1-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa commit eaeff8411fcafc33da66a78b10566749d353ca2f Author: Marek Marczykowski-Górecki Date: Mon Mar 9 13:17:23 2026 +0100 efi: Enable BGRT loading under Xen The BGRT table can be parsed if EFI_PARAVIRT is enabled, even if EFI_MEMMAP is not. Xen will take care of preserving the image even if EfiBootServicesData memory is reclaimed already, or invalidate the table if it didn't preserve it - in both cases accesing the table itself under virt is safe. Also allow the ESRT to be in reclaimable memory, as that is where future Xen versions will put it. This is similar approach as was taken for ESRT table in 01de145dc7fb "efi: Actually enable the ESRT under Xen". Signed-off-by: Marek Marczykowski-Górecki Signed-off-by: Ard Biesheuvel commit 80e80a703e18aa7d55fe26e4504c58a6f6c4ff07 Author: Marek Marczykowski-Górecki Date: Mon Mar 9 13:17:22 2026 +0100 efi: make efi_mem_type() and efi_mem_attributes() work on Xen PV Xen doesn't give direct access to the EFI memory map, but provides a hypercall interface for it. efi_mem_desc_lookup() was already adjusted in aca1d27ac38a "efi: xen: Implement memory descriptor lookup based on hypercall" to (optionally) use it. Now make efi_mem_type() and efi_mem_attributes() use common efi_mem_desc_lookup() too. This also reduces code duplication a bit. efi_mem_type() retains separate check for -ENOTSUPP error case (even though no caller seems to rely on this currently). Signed-off-by: Marek Marczykowski-Górecki [ardb: Drop erroneous 'const' qualifier] Signed-off-by: Ard Biesheuvel commit 7be3644795573055d2d3ae707e2c418c985d3a38 Author: Chen-Yu Tsai Date: Mon Mar 2 23:35:58 2026 +0800 arm64: dts: allwinner: sun55i-t527: avaota-a1: Add SPI NAND The Avaota A1 board has a SPI NAND chip connected to spi0 on the PJ pins with support for QSPI. Enable spi0 and add a device node for the SPI NAND chip. Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20260302153559.3199783-4-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit b1bbf38922de947144a48dafa0f0e4ac8e24444a Author: Chen-Yu Tsai Date: Mon Mar 2 23:35:57 2026 +0800 arm64: dts: allwinner: sun55i-a523: Add pinmux for spi0 on PJ pins The Avaota A1 board uses spi0 on the PJ pins to connect a SPI NAND chip. Add the full set of pins. Even though this board doesn't use CS1, other boards may do so in the future. Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20260302153559.3199783-3-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit d1008a8e29b09ea57c77ddf82d688f8c2ea6cbe8 Author: Felix Gu Date: Sat Mar 7 15:24:45 2026 +0800 spi: tegra210-quad: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend() already internally updates the last_busy timestamp before scheduling the autosuspend, making explicit pm_runtime_mark_last_busy() calls immediately before it redundant. Fixes: 7c12f6ead467 ("spi: tegra210-quad: Add runtime autosuspend support") Signed-off-by: Felix Gu Signed-off-by: Mark Brown Link: https://patch.msgid.link/20260307-quad-v1-1-f103515db501@gmail.com commit ec6c2e15a42fc8fb63baadee0e8a3257e37fa90c Author: Felix Gu Date: Sat Mar 7 15:47:15 2026 +0800 spi: axiado: Remove redundant pm_runtime_mark_last_busy() call The pm_runtime_mark_last_busy() call is redundant in the probe function as pm_runtime_put_autosuspend() already calls pm_runtime_mark_last_busy() internally to update the last access time of the device before queuing autosuspend. Fixes: e75a6b00ad79 ("spi: axiado: Add driver for Axiado SPI DB controller") Signed-off-by: Felix Gu Signed-off-by: Mark Brown Link: https://patch.msgid.link/20260307-axiado-1-v1-1-e90aa1b6dd9b@gmail.com commit 4ba5c63778e5cca15b1408f012d00b441f808f3d Author: Pengpeng Hou Date: Tue Mar 10 08:23:48 2026 +0000 ASoC: da7219: scope AAD suspend and resume helpers to CONFIG_PM In current linux.git, da7219_aad_suspend() and da7219_aad_resume() are defined and declared unconditionally. However, their only in-tree callers are the component PM callbacks in da7219.c, which are already guarded by #ifdef CONFIG_PM. This inconsistency leads to unnecessary code inclusion and potential compiler warnings when CONFIG_PM is disabled. Match the helper declarations and definitions to the callers' scope and provide no-op !CONFIG_PM stubs in the header. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260310082348.743716-1-pengpeng.hou@isrc.iscas.ac.cn Signed-off-by: Mark Brown commit 360160f75592bdc85edba8fe78fb20d90924c7e8 Author: Ricardo Robaina Date: Mon Mar 9 10:05:33 2026 -0300 audit: handle unknown status requests in audit_receive_msg() Currently, audit_receive_msg() ignores unknown status bits in AUDIT_SET requests, incorrectly returning success to newer user space tools querying unsupported features. This breaks forward compatibility. Fix this by defining AUDIT_STATUS_ALL and returning -EINVAL if any unrecognized bits are set (s.mask & ~AUDIT_STATUS_ALL). This ensures invalid requests are safely rejected, allowing user space to reliably test for and gracefully handle feature detection on older kernels. Suggested-by: Steve Grubb Signed-off-by: Ricardo Robaina [PM: subject line tweak] Signed-off-by: Paul Moore commit 0c55d4817aff454cfaded4f161ab13f2049758a9 Merge: 437350df8640bf da99028c21137a Author: Alexei Starovoitov Date: Tue Mar 10 11:53:23 2026 -0700 Merge branch 'fix-test_cgroup_iter_memcg-issues-found-during-back-porting' Hui Zhu says: ==================== Fix test_cgroup_iter_memcg issues found during back-porting While back-porting "mm: bpf kfuncs to access memcg data", I encountered issues with test_cgroup_iter_memcg, specifically in test_kmem. The test_cgroup_iter_memcg test would falsely pass when bpf_mem_cgroup_page_state() failed due to incompatible enum values across kernel versions. Additionally, test_kmem would fail on systems with cgroup.memory=nokmem enabled. These patches are my fixes for the problems I encountered. Changelog: v5: According to the comments of Emil Tsalapatis and JP Kobryn, dropped "selftests/bpf: Check bpf_mem_cgroup_page_state return value". v4: Fixed wrong git commit log in "bpf: Use bpf_core_enum_value for stats in cgroup_iter_memcg". v3: According to the comments of JP Kobryn, remove kmem subtest from cgroup_iter_memcg and fix assertion string in test_pgfault. v2: According to the comments of JP Kobryn, added bpf_core_enum_value() usage in the BPF program to handle cross-kernel enum value differences at load-time instead of compile-time. Dropped the mm/memcontrol.c patch. Modified test_kmem handling: instead of skipping when nokmem is set, verify that kmem value is zero as expected. According to the comments of bot, fixed assertion message: changed "bpf_mem_cgroup_page_state" to "bpf_mem_cgroup_vm_events" for PGFAULT check. ==================== Link: https://patch.msgid.link/cover.1772505399.git.zhuhui@kylinos.cn Signed-off-by: Alexei Starovoitov commit da99028c21137ac13925836d3819c2977694d173 Author: Hui Zhu Date: Tue Mar 3 13:53:09 2026 +0800 selftests/bpf: Use bpf_core_enum_value for stats in cgroup_iter_memcg Replace hardcoded enum values with bpf_core_enum_value() calls in cgroup_iter_memcg test to improve portability across different kernel versions. The change adds runtime enum value resolution for: - node_stat_item: NR_ANON_MAPPED, NR_SHMEM, NR_FILE_PAGES, NR_FILE_MAPPED - vm_event_item: PGFAULT This ensures the BPF program can adapt to enum value changes between kernel versions. Reviewed-by: Emil Tsalapatis Reviewed-by: JP Kobryn Signed-off-by: Hui Zhu Link: https://lore.kernel.org/r/ca6eb1a1a4fd7a17ffe995acf52c9a4ceb7bac13.1772505399.git.zhuhui@kylinos.cn Signed-off-by: Alexei Starovoitov commit a8fce027e17b0a99a8f9732f271ed505aa7a2940 Author: Hui Zhu Date: Tue Mar 3 13:53:08 2026 +0800 selftests/bpf: Remove kmem subtest from cgroup_iter_memcg When cgroup.memory=nokmem is set in the kernel command line, kmem accounting is disabled. This causes the test_kmem subtest in cgroup_iter_memcg to fail because it expects non-zero kmem values. Remove the kmem subtest altogether since the remaining subtests (shmem, file, pgfault) already provide sufficient coverage for the cgroup iter memcg functionality. Reviewed-by: JP Kobryn Signed-off-by: Hui Zhu Link: https://lore.kernel.org/r/35fa32a019361ec26265c8a789ee31e448d4dbda.1772505399.git.zhuhui@kylinos.cn Signed-off-by: Alexei Starovoitov commit 437350df8640bf0535b74a3d8bade6f707940027 Merge: bd2e02e3c92153 6a1c9a442f634e Author: Alexei Starovoitov Date: Tue Mar 10 11:51:18 2026 -0700 Merge branch 'bpf-support-for-non_null-ptr-detection-with-jeq-jne-with-register-operand' Cupertino Miranda says: ==================== bpf: support for non_null ptr detection with JEQ/JNE with register operand Changes from v1: - Corrected typos in commit messages. - Fixed indentation. - Replaced text by simpler version suggested by Eduard. Changes from v2: - Small fixes after AI patch checker complaints. Changes from v3: - Removed log file. No idea how that got added. ==================== Link: https://patch.msgid.link/20260304195018.181396-1-cupertino.miranda@oracle.com Signed-off-by: Alexei Starovoitov commit 6a1c9a442f634e7b95c5ad0927870335b1ce299e Author: Cupertino Miranda Date: Wed Mar 4 19:50:18 2026 +0000 selftests/bpf: tests to non_null ptr detection using register operand in JEQ/JNE This patch adds two tests to check non_null ptr detection when using JEQ and JNE have a register in second operand, and its value is known to be 0. Signed-off-by: Cupertino Miranda Cc: David Faust Cc: Jose Marchesi Cc: Elena Zannoni Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260304195018.181396-4-cupertino.miranda@oracle.com Signed-off-by: Alexei Starovoitov commit 2f4cb53eed448c1aeb6f4b40cf9c810716d8218c Author: Cupertino Miranda Date: Wed Mar 4 19:50:17 2026 +0000 bpf: detect non null pointer with register operand in JEQ/JNE. This patch adds support to validate a pointer as not null when its value is compared to a register whose value the verifier knows to be null. Initial pattern only verifies against an immediate operand. Signed-off-by: Cupertino Miranda Cc: David Faust Cc: Jose Marchesi Cc: Elena Zannoni Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260304195018.181396-3-cupertino.miranda@oracle.com Signed-off-by: Alexei Starovoitov commit 56521f58770422ac2c90daf85b48876fc63683d8 Author: Rosen Penev Date: Mon Mar 9 14:50:17 2026 -0700 IB/hfi1: kzalloc to kzalloc_flex Combine kzalloc and kcalloc with a flexible array member. Avoids having to free separately. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260309215017.4753-1-rosenp@gmail.com Signed-off-by: Leon Romanovsky commit bcf92fbca6055b7b717c3706e4e5f92a4e63ef45 Author: Shashank Balaji Date: Fri Mar 6 14:46:29 2026 +0900 x86/64/defconfig: Add CONFIG_IRQ_REMAP x2apic is enabled in the defconfig, and interrupt remapping is an architectural dependency of x2apic as per the Intel SDM: Routing of device interrupts to local APIC units operating in x2APIC mode requires use of the interrupt-remapping architecture specified in the Intel® Virtualization Technology for Directed I/O (Revision 1.3 and/or later versions). Enable CONFIG_IRQ_REMAP in defconfig so that a defconfig kernel on bare metal actually uses x2apic. Co-developed-by: Rahul Bukte Signed-off-by: Rahul Bukte Signed-off-by: Shashank Balaji Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Sohil Mehta Acked-by: Thomas Gleixner Link: https://patch.msgid.link/20260306-x2apic-fix-v2-2-bee99c12efa3@sony.com commit f183963891b4b0126f19aa0993ed931f3f3f9520 Author: Alex Mastro Date: Tue Mar 3 11:46:24 2026 -0800 vfio: selftests: fix crash in vfio_dma_mapping_mmio_test Remove the __iommu_unmap() call on a region that was never mapped. When __iommu_map() fails (expected for MMIO vaddrs in non-VFIO modes), the region is not added to the dma_regions list, leaving its list_head zero-initialized. If the unmap ioctl returns success, __iommu_unmap() calls list_del_init() on this zeroed node and crashes. This fixes the iommufd_compat_type1 and iommufd_compat_type1v2 test variants. Fixes: 080723f4d4c3 ("vfio: selftests: Add vfio_dma_mapping_mmio_test") Signed-off-by: Alex Mastro Reviewed-by: David Matlack Reviewed-by: Yuan Yao Link: https://lore.kernel.org/r/20260303-fix-mmio-test-v1-1-78b4a9e46a4e@fb.com Signed-off-by: Alex Williamson commit d3da7f00e21c2ff274b991167c69e96501746f28 Author: Chen Ni Date: Tue Mar 10 16:56:25 2026 +0800 fbdev: omapfb: Add missing error check for clk_get() The hwa742_init() function did not check the return value of clk_get(). This could lead to dereferencing an error pointer in subsequent clock operations, potentially causing a kernel crash. Fix this by adding a missing error check and ensuring proper clock resource cleanup on failure and driver removal. Signed-off-by: Chen Ni Signed-off-by: Helge Deller commit 86ff690f45cc034ab32246630b3c7d7a46d1ae6b Author: Besar Wicaksono Date: Thu Feb 12 23:34:07 2026 +0000 perf vendor events arm64: Add Tegra410 Olympus PMU events Add JSON files for NVIDIA Tegra410 Olympus core PMU events. Also updated the common-and-microarch.json. Signed-off-by: Besar Wicaksono Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit 5a8103a6fb0ae9cf99c0271b17474468d6bae2b2 Author: Geert Uytterhoeven Date: Wed Mar 4 18:21:57 2026 +0100 genirq: Document interaction between and DT binding defines Document that the DT binding definitions in shadow the first six IRQ_TYPE_* definitions in . The values must be the same anyway, so this is harmless (as long as the latter is included first when both are included), but it is good to document this explicitly. Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/fbcc65dcee6c5437fab5ef18d21766bb4effb7cb.1772644406.git.geert+renesas@glider.be commit d50590de0c646332713aa00a8be0012e089028e8 Author: Philipp Hahn Date: Tue Mar 10 12:49:05 2026 +0100 irqchip: Use IS_ERR_OR_NULL() instead of NULL and IS_ERR() checks Prefer using IS_ERR_OR_NULL() over using IS_ERR() and a open coded NULL pointer check. Change generated with coccinelle. To: Marc Zyngier To: Thomas Gleixner To: Andrew Lunn To: Gregory Clement To: Sebastian Hesselbarth Signed-off-by: Philipp Hahn Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260310-b4-is_err_or_null-v1-39-bd63b656022d@avm.de commit 7585a27644f338b3e764ceeda4be10e7047331a7 Author: Lad Prabhakar Date: Wed Mar 4 11:33:17 2026 +0000 irqchip/renesas-rzv2h: Handle ICU error IRQ and add SWPE trigger Handle the RZ/V2H ICU error interrupt to help diagnose latched bus, ECC RAM, and CA55/IP error conditions. Support error injection via ICU_SWPE to allow testing the pseudo error error interrupts. Account for SoC differences in ECC RAM error register coverage so the handler only iterates over valid ECC status/clear banks, and route the RZ/V2N compatible to a probe path with the correct ECC range while keeping the existing RZ/V2H and RZ/G3E handling. [ tglx: Convert to hwirq_within() and upgrade to pr_warn() for those errors ] Signed-off-by: Lad Prabhakar Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260304113317.129339-8-prabhakar.mahadev-lad.rj@bp.renesas.com commit 61adc4813d67990f6f9c20ab8c4a57fb3d969322 Author: Lad Prabhakar Date: Wed Mar 4 11:33:16 2026 +0000 irqchip/renesas-rzv2h: Add CA55 software interrupt support The RZ/V2H ICU exposes four software-triggerable interrupts targeting the CA55 cores (int-ca55-0 to int-ca55-3). Add support for these interrupts to enable IRQ injection via the generic IRQ injection framework. Add a dedicated rzv2h_icu_swint_chip irq_chip for the CA55 region and implement rzv2h_icu_irq_set_irqchip_state() to handle software interrupt injection. [ tglx: Convert to hwirq_within() ] Signed-off-by: Lad Prabhakar Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260304113317.129339-7-prabhakar.mahadev-lad.rj@bp.renesas.com commit f3ebae6dc025d0e45e9240ed85f9909a5a91e03c Author: Lad Prabhakar Date: Wed Mar 4 11:33:15 2026 +0000 irqchip/renesas-rzv2h: Replace single irq_chip with per-region irq_chip instances Replace the single rzv2h_icu_chip and its dispatcher callbacks with dedicated irq_chip instances for each interrupt region: NMI, IRQ, and TINT. Move the irqd_is_level_type() check ahead of the scoped_guard in rzv2h_icu_tint_eoi() and rzv2h_icu_irq_eoi() to avoid acquiring the spinlock unnecessarily for level-type interrupts. Drop the ICU_TINT_START guard from rzv2h_tint_irq_endisable() since it is now only reachable via the TINT chip path. [ tglx: Convert to hwirq_within() ] Signed-off-by: Lad Prabhakar Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260304113317.129339-6-prabhakar.mahadev-lad.rj@bp.renesas.com commit 9dc4335758c983045ab38871e2411fa1ae7e438d Author: Lad Prabhakar Date: Wed Mar 4 11:33:14 2026 +0000 irqchip/renesas-rzv2h: Clarify IRQ range definitions and tighten TINT validation Introduce ICU_IRQ_LAST and ICU_TINT_LAST macros to make range boundaries explicit and reduce the chance of off-by-one errors. Extract the TINT information up front in rzv2h_icu_alloc() and validate the resulting hardware IRQ against the full TINT range [ICU_TINT_START, ICU_TINT_LAST]. [ tglx: Convert the hard to parse inverse conditions to use a simple helper macro hwirq_within() which is easy to read, less error prone and avoids a lot of typing ] Signed-off-by: Lad Prabhakar Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260304113317.129339-5-prabhakar.mahadev-lad.rj@bp.renesas.com commit c34368b0404b8fd610b4f589481a1339bab76e0f Author: Lad Prabhakar Date: Wed Mar 4 11:33:13 2026 +0000 irqchip/renesas-rzv2h: Switch to using dev_err_probe() Make use of dev_err_probe() to simplify rzv2h_icu_probe_common(). Keep dev_err() for -ENOMEM paths, as dev_err_probe() does not print for allocation failures, ensuring they remain visible in logs. Signed-off-by: Lad Prabhakar Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260304113317.129339-4-prabhakar.mahadev-lad.rj@bp.renesas.com commit bbe78cb1399b4ba6b6d14943fb9dadefe9c17b5b Author: Lad Prabhakar Date: Wed Mar 4 11:33:12 2026 +0000 irqchip/renesas-rzv2h: Use local device pointer in ICU probe Use a local struct device pointer in rzv2h_icu_probe_common() to avoid repeated dereferencing of pdev->dev. Signed-off-by: Lad Prabhakar Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260304113317.129339-3-prabhakar.mahadev-lad.rj@bp.renesas.com commit 9fcd9ffe94da4a34a451e4cc0e3e007b4ed7f114 Author: Lad Prabhakar Date: Wed Mar 4 11:33:11 2026 +0000 irqchip/renesas-rzv2h: Use local node pointer Avoid dereferencing pdev->dev.of_node again in rzv2h_icu_probe_common(). Reuse the already available local node pointer when mapping the ICU register space. Signed-off-by: Lad Prabhakar Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260304113317.129339-2-prabhakar.mahadev-lad.rj@bp.renesas.com commit 6712fcde003f780d6241d755a0fa41ff4739b9a4 Author: Jisheng Zhang Date: Fri Feb 20 17:12:28 2026 +0800 arm64: remove ARCH_INLINE_* Since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes"), arm64 only has two preemption models: full and lazy. Both implies PREEMPTION, so !PREEMPTION is always false for arm64, it's time to remove ARCH_INLINE_*. Signed-off-by: Jisheng Zhang Signed-off-by: Catalin Marinas commit fd7df93013c5118812e63a52635dc6c3a805a1de Author: Thorsten Blum Date: Tue Mar 10 11:29:20 2026 +0100 ALSA: aoa: Skip devices with no codecs in i2sbus_resume() In i2sbus_resume(), skip devices with an empty codec list, which avoids using an uninitialized 'sysclock_factor' in the 32-bit format path in i2sbus_pcm_prepare(). In i2sbus_pcm_prepare(), replace two list_for_each_entry() loops with a single list_first_entry() now that the codec list is guaranteed to be non-empty by all callers. Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260310102921.210109-3-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 6b4576b09714def33890e04ef49621bca3614bbf Author: Tejun Heo Date: Tue Mar 10 07:12:21 2026 -1000 sched_ext: Reject sub-sched attachment to a disabled parent scx_claim_exit() propagates exits to descendants under scx_sched_lock. A sub-sched being attached concurrently could be missed if it links after the propagation. Check the parent's exit_kind in scx_link_sched() under scx_sched_lock to interlock against scx_claim_exit() - either the parent sees the child in its iteration or the child sees the parent's non-NONE exit_kind and fails attachment. Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 6b36c4c2935c54d6a103389fad2a2a9d25591501 Author: Tejun Heo Date: Tue Mar 10 07:12:21 2026 -1000 sched_ext: Fix scx_sched_lock / rq lock ordering There are two sites that nest rq lock inside scx_sched_lock: - scx_bypass() takes scx_sched_lock then rq lock per CPU to propagate per-cpu bypass flags and re-enqueue tasks. - sysrq_handle_sched_ext_dump() takes scx_sched_lock to iterate all scheds, scx_dump_state() then takes rq lock per CPU for dump. And scx_claim_exit() takes scx_sched_lock to propagate exits to descendants. It can be reached from scx_tick(), BPF kfuncs, and many other paths with rq lock already held, creating the reverse ordering: rq lock -> scx_sched_lock vs. scx_sched_lock -> rq lock Fix by flipping scx_bypass() to take rq lock first, and dropping scx_sched_lock from sysrq_handle_sched_ext_dump() as scx_sched_all is already RCU-traversable and scx_dump_lock now prevents dumping a dead sched. This makes the consistent ordering rq lock -> scx_sched_lock. Reported-by: Cheng-Yang Chou Link: https://lore.kernel.org/r/20260309163025.2240221-1-yphbchou0911@gmail.com Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit f4a6c506d11823e7123bc6573fbd8e432245acf4 Author: Tejun Heo Date: Tue Mar 10 07:12:21 2026 -1000 sched_ext: Always bounce scx_disable() through irq_work scx_disable() directly called kthread_queue_work() which can acquire worker->lock, pi_lock and rq->__lock. This made scx_disable() unsafe to call while holding locks that conflict with this chain - in particular, scx_claim_exit() calls scx_disable() for each descendant while holding scx_sched_lock, which nests inside rq->__lock in scx_bypass(). The error path (scx_vexit()) was already bouncing through irq_work to avoid this issue. Generalize the pattern to all scx_disable() calls by always going through irq_work. irq_work_queue() is lockless and safe to call from any context, and the actual kthread_queue_work() call happens in the irq_work handler outside any locks. Rename error_irq_work to disable_irq_work to reflect the broader usage. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit b5bc043505fed4198158037938ead78557eb79ab Author: Tejun Heo Date: Tue Mar 10 07:12:21 2026 -1000 sched_ext: Add scx_dump_lock and dump_disabled Add a dedicated scx_dump_lock and per-sched dump_disabled flag so that debug dumping can be safely disabled during sched teardown without relying on scx_sched_lock. This is a prep for the next patch which decouples the sysrq dump path from scx_sched_lock to resolve a lock ordering issue. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 7e92cf4354e9803cc7b8ed01f38371e0e89d2a0a Author: Tejun Heo Date: Tue Mar 10 07:12:21 2026 -1000 sched_ext: Fix sub_detach op check to test the parent's ops sub_detach is the parent's op called to notify the parent that a child is detaching. Test parent->ops.sub_detach instead of sch->ops.sub_detach. Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit b39bf7f0fae98c03e5ba6061e2251eeb36ec0b39 Merge: c116737e972ea7 1dfc9d60a69ec1 Author: Tejun Heo Date: Tue Mar 10 07:03:57 2026 -1000 Merge branch 'for-7.1-devm-alloc-wq' into for-7.1 commit 1dfc9d60a69ec148e1cb709256617d86e5f0e8f8 Author: Krzysztof Kozlowski Date: Thu Mar 5 22:45:40 2026 +0100 workqueue: devres: Add device-managed allocate workqueue Add a Resource-managed version of alloc_workqueue() to fix common problem of drivers mixing devm() calls with destroy_workqueue. Such naive and discouraged driver approach leads to difficult to debug bugs when the driver: 1. Allocates workqueue in standard way and destroys it in driver remove() callback, 2. Sets work struct with devm_work_autocancel(), 3. Registers interrupt handler with devm_request_threaded_irq(). Which leads to following unbind/removal path: 1. destroy_workqueue() via driver remove(), Any interrupt coming now would still execute the interrupt handler, which queues work on destroyed workqueue. 2. devm_irq_release(), 3. devm_work_drop() -> cancel_work_sync() on destroyed workqueue. devm_alloc_workqueue() has two benefits: 1. Solves above problem of mix-and-match devres and non-devres code in driver, 2. Simplify any sane drivers which were correctly using alloc_workqueue() + devm_add_action_or_reset(). Signed-off-by: Krzysztof Kozlowski Acked-by: Tejun Heo Reviewed-by: Andy Shevchenko Signed-off-by: Tejun Heo commit c89046d57d534348b41ca28f5c1c5443743dbe04 Author: Denis Benato Date: Sat Feb 28 20:10:10 2026 +0100 HID: asus: do not try to initialize the backlight if the enpoint doesn't support it Avoid possibly printing a warning about the inability to initialize the backlight if the hid endpoint doesn't support it. Also fix and move an incorrect check in asus_kbd_register_leds(): that same check is now used as a precondition to call that function. Fixes: 0919db9f3583 ("HID: asus: always fully initialize devices") Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina commit 7253091766ded0fd81fe8d8be9b8b835495b06e8 Author: Denis Benato Date: Sat Feb 28 20:10:09 2026 +0100 HID: asus: do not abort probe when not necessary In order to avoid dereferencing a NULL pointer asus_probe is aborted early and control of some asus devices is transferred over hid-generic after erroring out even when such NULL dereference cannot happen: only early abort when the NULL dereference can happen. Also make the code shorter and more adherent to coding standards removing square brackets enclosing single-line if-else statements. Fixes: d3af6ca9a8c3 ("HID: asus: fix UAF via HID_CLAIMED_INPUT validation") Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina commit 43b3d1a95a587d32f3d441033d0aa108515a8c27 Author: Denis Benato Date: Sat Feb 28 20:10:08 2026 +0100 HID: asus: simplify and improve asus_kbd_set_report() Make the function shorter and easier to read using __free, and also fix a misaligned comment closing tag. The __free macro from cleanup.h is already used in the driver, but its include is missing: add it. Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina commit 51d33b42b8ae23da92819d28439fdd5636c45186 Author: Denis Benato Date: Sat Feb 28 20:10:07 2026 +0100 HID: asus: make asus_resume adhere to linux kernel coding standards Linux kernel coding standars requires functions opening brackets to be in a newline: move the opening bracket of asus_resume in its own line. Fixes: 546edbd26cff ("HID: hid-asus: reset the backlight brightness level on resume") Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina commit a593671545475dd78c7ba939155efb6c272b161e Author: Denis Benato Date: Sat Feb 28 20:10:04 2026 +0100 HID: asus: fix code style of comments and brackets In asus_raw_event there is code that would violate checkpatch script such as unaligned closing comments and superfluous graph parenthesis: fix these stylistic issues. Also remove an empty comment spanning two lines. This commit does not change runtime behavior. Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina commit 98059335382dc5870207d6a0c1c9e7a004d627ad Author: Philipp Hahn Date: Tue Mar 10 12:48:42 2026 +0100 sched: Prefer IS_ERR_OR_NULL over manual NULL check Prefer using IS_ERR_OR_NULL() over using IS_ERR() and a manual NULL check. Change generated with coccinelle. Signed-off-by: Philipp Hahn Signed-off-by: Tejun Heo commit dd800099c26d9cb16d688c23aa469dc677b0b735 Author: Colin Ian King Date: Tue Mar 10 07:29:37 2026 +0000 HID: hid-lenovo-go-s: Fix spelling mistake "configuratiion" -> "configuration" There is a spelling mistake in a dev_err_probe message. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Derek J. Clark Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit 54549af86f2d6fd6e547d208dadfdf904101f7ae Author: Chen Ni Date: Tue Mar 10 07:29:36 2026 +0000 HID: hid-lenovo-go: Remove unneeded semicolon Remove unnecessary semicolons after switch statements and function bodies. Most issues were reported by Coccinelle/coccicheck using the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Additional instances found during manual code review were also fixed. Signed-off-by: Chen Ni Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit c04744049febb39a21185c356507eda112e97385 Author: Chen Ni Date: Tue Mar 10 07:29:35 2026 +0000 HID: hid-lenovo-go-s: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Reviewed-by: Derek J. Clark Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit 168c918391391e9fbfe60501da59b61df23a9565 Author: Derek J. Clark Date: Tue Mar 10 07:29:34 2026 +0000 HID: Add documentation for Lenovo Legion Go drivers Adds ABI documentation for the hid-lenovo-go-s and hid-lenovo-go drivers. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit 34a05773e81505a35cacc0548797c64777f91f9c Author: Derek J. Clark Date: Tue Mar 10 07:29:33 2026 +0000 HID: hid-lenovo-go-s: Add IMU and Touchpad RO Attributes Adds attributes for reporting the touchpad manufacturer, version, and IMU manufacturer. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit be6d7dbb368ba840d7f7624d90e93d0acb2a1e94 Author: Derek J. Clark Date: Tue Mar 10 07:29:32 2026 +0000 HID: hid-lenovo-go-s: Add RGB LED control interface Adds an LED multicolor class device and attribute group for controlling the RGB of the Left and right joystick rings. In addition to the standard led_cdev attributes, additional attributes that allow for the control of the effect (monocolor, breathe, rainbow, and chroma), speed of the effect change, an enable toggle, and profile. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit e10f5499384d33d4a818f4309b46b974ac1a155e Author: Derek J. Clark Date: Tue Mar 10 07:29:31 2026 +0000 HID: hid-lenovo-go-s: Add Touchpad Mode Attributes Adds attributes for managing the touchpad operating modes. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit c78d07c37c65361f34a51efd99aab2ea59722559 Author: Derek J. Clark Date: Tue Mar 10 07:29:30 2026 +0000 HID: hid-lenovo-go-s: Add Feature Status Attributes Adds features status attributes for the gamepad, MCU, touchpad/mouse, and IMU devices. Reviewed-by: Mark Pearson Co-developed-by: Ethan Tidmore Signed-off-by: Ethan Tidmore Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit 5153f1aa6cd529874f4d82c9133dc5f06b10d262 Author: Derek J. Clark Date: Tue Mar 10 07:29:29 2026 +0000 HID: hid-lenovo-go-s: Add MCU ID Attribute Adds command to probe for the MCU ID of the Lenovo Legion Go S Controller and assign it to a device attribute. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit a23f3497bf208c59adac1bc8fd1d8eae240b3001 Author: Derek J. Clark Date: Tue Mar 10 07:29:28 2026 +0000 HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver Adds initial framework for a new HID driver, hid-lenovo-go-s, along with a uevent to report the firmware version for the MCU. This driver primarily provides access to the configurable settings of the Lenovo Legion Go S controller. It will attach if the controller is in xinput or dinput mode. Non-configuration raw reports are forwarded to ensure the other endpoints continue to function as normal. Reviewed-by: Mark Pearson Co-developed-by: Mario Limonciello Signed-off-by: Mario Limonciello Co-developed-by: Ethan Tidmore Signed-off-by: Ethan Tidmore Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit 6ca9029c823b7853e980585e757343e0e84227cd Author: Mario Limonciello Date: Tue Mar 10 07:29:27 2026 +0000 HID: Include firmware version in the uevent Userspace software fwupd probes some HID devices when the daemon starts up to determine the current firmware version in order to be able to offer updated firmware if the manufacturer has made it available. In order to do this fwupd will detach the existing kernel driver if one is present, send a HID command and then reattach the kernel driver. This can be problematic if the user is using the HID device at the time that fwupd probes the hardware and can cause a few frames of input to be dropped. In some cases HID drivers already have a command to look up the firmware version, and so if that is exported to userspace fwupd can discover it and avoid needing to detach the kernel driver until it's time to update the device. Introduce a new member in the struct hid_device for the version and export a new uevent variable HID_FIRMWARE_VERSION that will display the version that HID drivers obtained. Reviewed-by: Derek J. Clark Reviewed-by: Mark Pearson Cc: Richard Hughes Signed-off-by: Mario Limonciello Signed-off-by: Jiri Kosina commit 51e4270c9d0454b8c384a656ee9e37f0f54b58ac Author: Derek J. Clark Date: Tue Mar 10 07:29:26 2026 +0000 HID: hid-lenovo-go: Add OS Mode Toggle Adds OS Mode toggle, who's primary function is to change the built-in functional chords to use the right handle legion button instead of the left handle legion button as the mode shift key. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit 995887a10da1f6e23a52fe656b30ba6cf1a56316 Author: Derek J. Clark Date: Tue Mar 10 07:29:25 2026 +0000 HID: hid-lenovo-go: Add Calibration Settings Adds calibration enable and last calibration status indicators for the triggers, joysticks, and handle gyros. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit 325262fa1d2e919e417fdb207bdb8d2baafcb047 Author: Derek J. Clark Date: Tue Mar 10 07:29:24 2026 +0000 HID: hid-lenovo-go: Add RGB LED control interface Adds an LED multicolor class device and attribute group for controlling the RGB of the Left and right handles. In addition to the standard led_cdev attributes, additional attributes that allow for the control of the effect (monocolor, breathe, rainbow, and chroma), speed of the effect change, an enable toggle, and profile. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit f0bedee60607597682d3125f3c0530d76568857b Author: Derek J. Clark Date: Tue Mar 10 07:29:23 2026 +0000 HID: hid-lenovo-go: Add FPS Mode DPI settings Adds attribute that enables selection of the DPI of the optical sensor when the right handle toggle is set to FPS mode. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit 96b20c1fe9031be04a36d58af70e4c297a928a3a Author: Derek J. Clark Date: Tue Mar 10 07:29:22 2026 +0000 HID: hid-lenovo-go: Add Rumble and Haptic Settings Adds attributes that control the handles rumble mode and intensity, as well as touchpad haptic feedback settings. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit 82cd9bc866e1823cabd3af962e467e51724506eb Author: Derek J. Clark Date: Tue Mar 10 07:29:21 2026 +0000 HID: hid-lenovo-go: Add Feature Status Attributes Adds various feature status indicators and toggles to hid-lenovo-go, including the FPS mode switch setting, touchpad enable toggle, handle automatic sleep timer, etc. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit d69ccfcbc9551988190895bc125a8bf709aa5931 Author: Derek J. Clark Date: Tue Mar 10 07:29:20 2026 +0000 HID: hid-lenovo-go: Add Lenovo Legion Go Series HID Driver Adds initial framework for a new HID driver, hid-lenovo-go, along with attributes that report the firmware and hardware version for each component of the HID device, of which there are 4 parts: The MCU, the transmission dongle, the left "handle" controller half, and the right "handle" controller half. Each of these devices are provided an attribute group to contain its device specific attributes. Additionally, the touchpad device attributes are logically separated from the other components in another attribute group. This driver primarily provides access to the configurable settings of the Lenovo Legion Go and Lenovo Legion Go 2 controllers running the latest firmware. As previously noted, the Legion Go controllers recently had a firmware update[1] which switched from the original "SepentiaUSB" protocol to a brand new protocol for the Go 2, primarily to ensure backwards and forwards compatibility between the Go and Go 2 devices. As part of that update the PIDs for the controllers were changed, so there is no risk of this driver attaching to controller firmware that it doesn't support. -- v6: - Make attributes static. - Use NULL instead of 0 in mcu_propery_out when there is no data. v5: - Make version attributes static, retrieve them using delayed work during probe. - Fix endianness of version strings and print as hex. v3: - Add hid-lenovo.c and Mark Pearson to LENOVO HID DRIVERS entry in MAINTAINERS Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Signed-off-by: Jiri Kosina commit 1b891f4c852817b3afd231712ab7e171932e1eb1 Author: Derek J. Clark Date: Tue Mar 10 07:29:19 2026 +0000 include: device.h: Add named device attributes Adds DEVICE_ATTR_[RW|RO|WO]_NAMED macros for adding attributes that reuse the same sysfs name in a driver under separate subdirectories. When dealing with some devices it can be useful to be able to reuse the same name for similar attributes under a different subdirectory. For example, a single logical HID endpoint may provide a configuration interface for multiple physical devices. In such a case it is useful to provide symmetrical attribute names under different subdirectories on the configuration device. The Lenovo Legion Go is one such device, providing configuration to a detachable left controller, detachable right controller, the wireless transmission dongle, and the MCU. It is therefore beneficial to treat each of these as individual devices in the driver, providing a subdirectory for each physical device in the sysfs. As some attributes are reused by each physical device, it provides a much cleaner interface if the same driver can reuse the same attribute name in sysfs while uniquely distinguishing the store/show functions in the driver, rather than repeat string portions. Example new WO attrs: ATTRS{left_handle/reset}=="(not readable)" ATTRS{right_handle/reset}=="(not readable)" ATTRS{tx_dongle/reset}=="(not readable)" vs old WO attrs in a subdir: ATTRS{left_handle/left_handle_reset}=="(not readable)" ATTRS{right_handle/right_handle_reset}=="(not readable)" ATTRS{tx_dongle/tx_dongle_reset}=="(not readable)" or old WO attrs with no subdir: ATTRS{left_handle_reset}=="(not readable)" ATTRS{right_handle_reset}=="(not readable)" ATTRS{tx_dongle_reset}=="(not readable)" While the third option is usable, it doesn't logically break up the physical devices and creates a device directory with over 80 attributes once all attrs are defined. Reviewed-by: Mark Pearson Signed-off-by: Derek J. Clark Acked-by: Greg Kroah-Hartman Signed-off-by: Jiri Kosina commit f044788088ef55e9855b17b7984ffe522c40c093 Author: Wang Jun <1742789905@qq.com> Date: Tue Mar 10 09:14:20 2026 +0800 fbdev: viafb: check ioremap return value in viafb_lcd_get_mobile_state The function viafb_lcd_get_mobile_state() calls ioremap() without checking the return value. If ioremap() fails (returns NULL), the subsequent readw() will cause a NULL pointer dereference. Signed-off-by: Wang Jun <1742789905@qq.com> Signed-off-by: Helge Deller commit 90f771a9745476a5e2b95b5efe225a943c090bb9 Author: Krzysztof Kozlowski Date: Thu Mar 5 10:09:25 2026 +0100 arm64: dts: exynos8895: Move I2C address/size-cells to DTSI Convention followed in all other DTSI files is to define I2C controller address/size-cells in the DTSI thus reducing code needed in each DTS. It's also logical, since I2C is a bus and needs definition of addressing children, even if the bus is enabled without the nodes. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260305-dts-exynos-i2c-v1-2-2c8d3df3b9ca@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit 41dadc6f78150b7bf0308269fba7ba8a1a516392 Author: Krzysztof Kozlowski Date: Thu Mar 5 10:09:24 2026 +0100 arm64: dts: exynos7870: Move I2C address/size-cells to DTSI Convention followed in all other DTSI files is to define I2C controller address/size-cells in the DTSI thus reducing code needed in each DTS. It's also logical, since I2C is a bus and needs definition of addressing children, even if the bus is enabled without the nodes. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260305-dts-exynos-i2c-v1-1-2c8d3df3b9ca@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit 44ee52a030a6dd2f6e0ecb3632ecf8b263114619 Author: Krzysztof Kozlowski Date: Thu Mar 5 10:09:28 2026 +0100 ARM: dts: exyons4412: Drop duplicated I2C address/size-cells The DTSI already has address/size-cells for each I2C controller, thus the board does not have to define them again. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260305-dts-exynos-i2c-v1-5-2c8d3df3b9ca@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit 7c40913bc532f3645c522a89886070a08b1ad23b Author: Krzysztof Kozlowski Date: Thu Mar 5 10:09:27 2026 +0100 ARM: dts: exynos4210-smdkv310: Drop duplicated I2C address/size-cells The DTSI already has address/size-cells for each I2C controller, thus the board does not have to define them again. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260305-dts-exynos-i2c-v1-4-2c8d3df3b9ca@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit cb243c21bbe14739406b5be680c850cdf20c9739 Author: Krzysztof Kozlowski Date: Thu Mar 5 10:09:26 2026 +0100 ARM: dts: exynos3250: Drop duplicated I2C address/size-cells The DTSI already has address/size-cells for each I2C controller, thus the board does not have to define them again. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260305-dts-exynos-i2c-v1-3-2c8d3df3b9ca@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit 9095f233c0258e9a05e958c7d822eb38681e7a5a Author: feng.zhou Date: Mon Feb 2 17:41:40 2026 +0800 printk: Fix _DESCS_COUNT type for 64-bit systems The _DESCS_COUNT macro currently uses 1U (32-bit unsigned) instead of 1UL (unsigned long), which breaks the intended overflow testing design on 64-bit systems. Problem Analysis: ---------------- The printk_ringbuffer uses a deliberate design choice to initialize descriptor IDs near the maximum 62-bit value to trigger overflow early in the system's lifetime. This is documented in printk_ringbuffer.h: "initial values are chosen that map to the correct initial array indexes, but will result in overflows soon." The DESC0_ID macro calculates: DESC0_ID(ct_bits) = DESC_ID(-(_DESCS_COUNT(ct_bits) + 1)) On 64-bit systems with typical configuration (descbits=16): - Current buggy behavior: DESC0_ID = 0xfffeffff - Expected behavior: DESC0_ID = 0x3ffffffffffeffff The buggy version only uses 32 bits, which means: 1. The initial ID is nowhere near 2^62 2. It would take ~140 trillion wraps to trigger 62-bit overflow 3. The overflow handling code is never tested in practice Root Cause: ---------- The issue is in this line: #define _DESCS_COUNT(ct_bits) (1U << (ct_bits)) When _DESCS_COUNT(16) is calculated: 1U << 16 = 0x10000 (32-bit value) -(0x10000 + 1) = -0x10001 = 0xFFFEFFFF (32-bit two's complement) On 64-bit systems, this 32-bit value doesn't get extended to create the intended 62-bit ID near the maximum value. Impact: ------ While index calculations still work correctly in the short term, this bug has several implications: 1. Violates the design intention documented in the code 2. Overflow handling code paths remain untested 3. ABA detection code doesn't get exercised under overflow conditions 4. In extreme long-term running scenarios (though unlikely), could potentially cause issues when ID actually reaches 2^62 Verification: ------------ Tested on ARM64 system with CONFIG_LOG_BUF_SHIFT=20 (descbits=15): - Before fix: DESC0_ID(16) = 0xfffeffff - After fix: DESC0_ID(16) = 0x3fffffffffff7fff The fix aligns _DESCS_COUNT with _DATA_SIZE, which already correctly uses 1UL: #define _DATA_SIZE(sz_bits) (1UL << (sz_bits)) Signed-off-by: feng.zhou Reviewed-by: Petr Mladek Tested-by: Petr Mladek Link: https://patch.msgid.link/20260202094140.9518-1-realsummitzhou@gmail.com Signed-off-by: Petr Mladek commit 27401c9b143278eb9fa7d46f97ab063d65e5afd5 Author: Aaradhana Sahu Date: Fri Mar 6 08:52:52 2026 +0530 wifi: ath12k: Use .mbn firmware for AHB devices Currently ath12k AHB devices request firmware in .mdt/.bxx split format. AHB firmware is transitioning from the split format to a single .mbn file. Update ath12k to request q6_fw.mbn and iu_fw.mbn instead of q6_fw.mdt iu_fw.mdt respectively. Note: There is no impact to current devices since ath12k AHB support is not yet complete and no AHB firmware files are currently present in linux-firmware. Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.7-00587-QCAHKSWPL_SILICONZ-1 Signed-off-by: Aaradhana Sahu Link: https://patch.msgid.link/20260306032252.2237722-1-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit fcc3555fce3c35333891e904c3592375d5e63cf4 Author: Johan Hovold Date: Fri Mar 6 09:51:31 2026 +0100 wifi: ath10k: rename disconnect callback Rename the disconnect callback so that it reflects the callback name for consistency with the rest of the kernel (e.g. makes it easier to grep for). Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260306085144.12064-6-johan@kernel.org Signed-off-by: Jeff Johnson commit c880c0794076f04b0058dd5cbc1f94c33d7bff44 Author: Johan Hovold Date: Fri Mar 6 09:51:30 2026 +0100 wifi: ath10k: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260306085144.12064-5-johan@kernel.org Signed-off-by: Jeff Johnson commit 2ddbec82e1650d57ea0f63d284b5da01d2f21293 Author: Johan Hovold Date: Fri Mar 6 09:51:29 2026 +0100 wifi: ath9k: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260306085144.12064-4-johan@kernel.org Signed-off-by: Jeff Johnson commit 0bc013d68a5d1943728d110d759c6587c2b81913 Author: Johan Hovold Date: Fri Mar 6 09:51:28 2026 +0100 wifi: ath6kl: rename disconnect callback Rename the disconnect callback so that it reflects the callback name for consistency with the rest of the kernel (e.g. makes it easier to grep for). Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260306085144.12064-3-johan@kernel.org Signed-off-by: Jeff Johnson commit 86581adf05f526f53b90ebcbbc2fd4d9f9fd4c96 Author: Johan Hovold Date: Fri Mar 6 09:51:27 2026 +0100 wifi: ath6kl: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260306085144.12064-2-johan@kernel.org Signed-off-by: Jeff Johnson commit 38dd6ccfdfbbe865569a52fe1ba9fa1478f672e6 Author: Ben Levinsky Date: Tue Mar 3 15:51:27 2026 -0800 remoteproc: xlnx: Only access buffer information if IPI is buffered In the receive callback check if message is NULL to prevent possibility of crash by NULL pointer dereferencing. Signed-off-by: Ben Levinsky Signed-off-by: Tanmay Shah Fixes: 5dfb28c257b7 ("remoteproc: xilinx: Add mailbox channels for rpmsg") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260303235127.2317955-3-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier commit d20c27dc8141c90a27927b1343ec2131f864fbb3 Author: Tanmay Shah Date: Tue Mar 3 15:51:26 2026 -0800 remoteproc: xlnx: Avoid mailbox setup Mailbox properties are optional in the remoteproc xlnx bindings. If mailbox properties are not found in device-tree it's not fatal error in the driver. Driver will print warning messages and continue with normal operation. However, these warning messages can be interpreted as error. Check "mboxes" and "mbox-names" properties in the driver and setup mailbox only if they are available in the device-tree. This will avoid any unwanted warning/error messages. Signed-off-by: Tanmay Shah Link: https://lore.kernel.org/r/20260303235127.2317955-2-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier commit cda15ff39df82ef6842affeb8cf57d0090708227 Author: Simon Richter Date: Sat Mar 7 00:13:16 2026 +0900 drm/i915: handle failure from vga_get_uninterruptible() The vga_get_uninterruptible() function can return an error if it fails to set up VGA decoding for the requested device. If VGA decoding is unavailable, we don't need to be careful to leave the VGA emulation in a usable state, as vgacon will also be unable to get access later on, so just skip over the VGA accesses and the vga_put() call matching the failed vga_get_uninterruptible(). Signed-off-by: Simon Richter Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1824 Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260306151347.758836-1-Simon.Richter@hogyros.de commit 9be71d462c33b1a00acfa4ab8f0f5332ed592817 Author: Richard Fitzgerald Date: Tue Mar 10 13:03:43 2026 +0000 firmware: cs_dsp: Simplify suppressing log messages during KUnit testing Rework the way that kernel log messages are rate-limited or suppressed while running the cs_dsp KUnit tests. Under normal conditions cs_dsp doesn't produce an unreasonable number of log messages, and state changes are relatively infrequent. But the KUnit tests run through a very large number of test cases, especially error cases, and this produces an unusually large amount of log output from cs_dsp. The original fix for this in commit 10db9f6899dd ("firmware: cs_dsp: rate-limit log messages in KUnit builds") was effective but not pretty. It involved different definitions of the log macros for KUnit and not-KUnit builds, and exported variables for the KUnit tests to disable log messages. I would have preferred to turn the log macros into real functions that can contain a KUNIT_STATIC_STUB_REDIRECT(), but the dev_xxx() macros don't have a version that take va_args, so they can't be wrapped by a function. This patch enables the use of a KUNIT_STATIC_STUB_REDIRECT() instead of exported variables, and avoids the need for different definitions of the debug macros in KUnit and not-KUnit builds. - A new function cs_dsp_can_emit_message() returns true if the messages can be emitted to the kernel log. In a normal not-KUnit build this function collapses to simply returning true. In KUnit builds it will rate-limit output, and this uses a single static rate limiter so it limits the overall rate across all cs_dsp log messages. The KUnit test can redirect it to change the suppression behavior. - The cs_dsp debug message macros are changed to only call the dev_xxx() if cs_dsp_can_emit_message() returns true. These are still macros so there is no problem wrapping the dev_xxx(). For a normal not-KUnit build cs_dsp_can_emit_message() always returns true so these macros simplify down to being identical to calling dev_xxx() directly. - The KUnit tests that cause a lot of cs_dsp messages now redirect cs_dsp_can_emit_message() to a local function. This returns false to suppress cs_dsp messages, unless DEBUG is defined for that test. I have checked that for a x86_64 production (non-KUnit) build the disassembled cs_dsp.o is identical to what was generated from the original code. So the complier is correctly simplifying the cs_dsp_can_emit_message() and macros down to only the call to dev_xxx(). Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260310130343.1791951-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 207fd1f4d84b7f073eaab556623bf4ad3a161f3f Author: Ben Dooks Date: Tue Mar 10 12:51:06 2026 +0000 ASoC: SOF: sof-audio: pcm_id is __le32 The pcm_id value is __le32 so convert it before passing to the dev_dbg function to be printed. Also fixup some other uses of __le32 data and a couple of places where %u should have been used instead of %d Picked up by sparse prototype for variadic and printf function checking. Fixes a large number of sparse warnings, such as: sound/soc/sof/pcm.c:84:25: warning: incorrect type in argument 4 (different base types) sound/soc/sof/pcm.c:84:25: expected unsigned int sound/soc/sof/pcm.c:84:25: got restricted __le32 [usertype] pcm_id Signed-off-by: Ben Dooks Acked-by: Peter Ujfalusi Link: https://patch.msgid.link/20260310125106.178944-1-ben.dooks@codethink.co.uk Signed-off-by: Mark Brown commit 8fc5c7895185d1119ae76b509892a1d14e0bd483 Author: Richard Fitzgerald Date: Tue Mar 10 14:18:17 2026 +0000 ASoC: wm_adsp: Combine some similar code in firmware file search In wm_adsp_request_firmware_files() squash the if (system_name && suffix) and the following if (system_name) blocks together. This removes some duplicated code. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260310141817.1871794-11-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 7bca3ca55ef53ca66fdf6e663290d0596a8f520d Author: Richard Fitzgerald Date: Tue Mar 10 14:18:16 2026 +0000 ASoC: wm_adsp: Use a struct to pass around firmware struct and filename Bundle the pointers to struct firmware and its filename into a new struct wm_adsp_fw_files. This simplifies passing these pointers around. Changes are also needed to the test cases in wm_adsp_fw_find_test.c that use this API. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260310141817.1871794-10-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit d8a4c96082e6f5c7aaf6f3e101effe7ff0ea4d6e Author: Richard Fitzgerald Date: Tue Mar 10 14:18:15 2026 +0000 ASoC: wm_adsp: Add KUnit test cases for '/' in firmware filenames Add test cases that '/' in the system name or ALSA prefix are converted to '-' in the firmware filename. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260310141817.1871794-9-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 66170cc7ed59fb7e1e192e53f1d690bd04e8c720 Author: Richard Fitzgerald Date: Tue Mar 10 14:18:14 2026 +0000 ASoC: wm_adsp: Convert '/' to '-' when normalizing firmware filenames Don't preserve '/' in firmware filename fields - convert it to '-' like other punctuation characters. The code originally normalized the entire string, including the directory prefix. To prevent breaking the directory it had to preserve '/' characters in the name, but this meant that the system name and ALSA prefix must not contain those characters. It's trivial to skip the directory name prefix and start the normalization after it, and that means the normalization does not need to make a special case for '/'. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260310141817.1871794-8-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit f8f0c68c75214e326c0d4cbcab8ecab882201f48 Author: Richard Fitzgerald Date: Tue Mar 10 14:18:13 2026 +0000 ASoC: wm_adsp: Use consistent error checks in wm_adsp_request_firmware_files() Use a consistent pattern of error checking in wm_adsp_request_firmware_files(). - The integer return value of wm_adsp_request_firmware_file() reports unrecoverable errors, for example -ENOMEM. - A NULL struct firmware pointer is a valid result. This not an error, not all DSPs require both files, some may not require any files. Previously wm_adsp_request_firmware_files() was using a mix of checking the return value and checking the struct firmware pointer to determine whether a file was found. It wasn't checking for unrecoverable errors. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260310141817.1871794-7-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 2c7c27025374abbdeda201ad103ddf27e8079aec Author: Richard Fitzgerald Date: Tue Mar 10 14:18:12 2026 +0000 ASoC: wm_adsp: Remove duplicated code to find firmware file The 3rd search case in wm_adsp_request_firmware_files() does exactly the same bin file searches as the case immediately above it. Merge the conditional from the 3rd case into the second case so the duplicated code can be removed. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260310141817.1871794-6-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit bf2d44d07de726b0393439cb4d4defc5cf89a4fc Author: Richard Fitzgerald Date: Tue Mar 10 14:18:11 2026 +0000 ASoC: wm_adsp: Add kunit test for firmware file search Add KUnit testing of the wm_adsp code that searches for firmware files. Also make the SND_SOC_WM_ADSP Kconfig symbol visible if KUNIT is enabled so that wm_adsp can be manually included for KUnit testing. The firmware filename is composed of several fields, some of which are optional, and there is a search algorithm to fallback from specific to generic versions of firmware for a device. This KUnit test verifies that wm_adsp is searching for the correct sequence of filenames. The are two ways of testing this, and both are used in this KUnit test. 1. Trap the calls to firmware_request_nowarn() and test that the sequence of filenames request is correct. This is the most thorough test because it proves that exactly the expected filenames are requested, in the correct order. But it doesn't fully cover regression testing. If a change to the search algorithm changes the expected sequence of requested files, the test must also be changed to expect that new sequence. If the expectation is wrong, the tests can pass (because the search order is as expected) while picking a different file in some cases from what it did before the change. 2. Test which file is picked from a simulated directory of files. This is better for regression testing because it is independent of the search algorithm. It does not need to change if the search algorithm changes. It is not testing exactly which files the algorithm searches for, only which file it eventually picks from a given set of available files. In other words, the regression test is: does it still pick the same file from the same directory of files? But it is impractical for thorough testing. It doesn't prove that exactly the correct files were searched for, unless it was to test with every possible combination of file names and directory content that could ever exist. Clearly this is impossible to implement, since the number of combations of possible valid filenames in a directory and number of files in a directory is astronomically large. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260310141817.1871794-5-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit b4e6b01191afb9516570437a7aff61019134fd59 Author: Richard Fitzgerald Date: Tue Mar 10 14:18:10 2026 +0000 ASoC: wm_adsp: Export function for KUnit test to get firmware filenames Export a function that KUnit tests can use to get the firmware filenames from the wm_adsp_fw[] array. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260310141817.1871794-4-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 70057cfe492d600c2b83598e8b8b64780b2ca147 Author: Richard Fitzgerald Date: Tue Mar 10 14:18:09 2026 +0000 ASoC: wm_adsp: Add KUnit redirection stubs for firmware file search Make some of the firmware file search functions redirectable for KUnit testing. - The call to firmware_request_nowarn() is factored out into a wrapper function so that it can be redirected. - wm_adsp_request_firmware_files() and wm_adsp_release_firmware_files() are made visible and exported if KUNIT is enabled. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260310141817.1871794-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 1eadb7791ee5699ca58920ef705ce0934c814ece Author: Richard Fitzgerald Date: Tue Mar 10 14:18:08 2026 +0000 ASoC: wm_adsp: Remove unused argument to wm_adsp_release_firmware_files() The dsp argument to wm_adsp_release_firmware_files() isn't used so remove it. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260310141817.1871794-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 7b3f8db159f710d432c4edc024fcefa9e62e8b4b Author: Shengjiu Wang Date: Tue Mar 10 18:42:35 2026 +0800 ASoC: fsl_xcvr: add bitcount and timestamp controls The transmitter and receiver implement separate timestamp counters and bit counters. The bit counter increments at the end of each bit in a frame whenever the transmitter or receiver is enabled. The bit counter can be reset by software. The timestamp counter increments on the bus interface clock whenever it is enabled. The current value of the timestamp counter is latched whenever the bit counter increments. Reading the bit counter register will cause the latched timestamp value to be saved in the bit counter timestamp register. The timestamp counter can be reset by software, this also resets the latched timestamp value and the bit counter timestamp register. The timestamp counter and bit counter can be used by software to track the progress of the transmitter and receiver. It can also be used to calculate the relative frequency of the bit clock against the bus interface clock. As there are three regmap handlers defined in this driver, explicitly call the snd_soc_component_init_regmap() to init regmap handler for the component. Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260310104235.1234569-4-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 8e27987a208029c39da7a787bd9f1217d42011a5 Author: Shengjiu Wang Date: Tue Mar 10 18:42:34 2026 +0800 ASoC: fsl_sai: add bitcount and timestamp controls The transmitter and receiver implement separate timestamp counters and bit counters. The bit counter increments at the end of each bit in a frame whenever the transmitter or receiver is enabled. The bit counter can be reset by software. The timestamp counter increments on the bus interface clock whenever it is enabled. The current value of the timestamp counter is latched whenever the bit counter increments. Reading the bit counter register will cause the latched timestamp value to be saved in the bit counter timestamp register. The timestamp counter can be reset by software, this also resets the latched timestamp value and the bit counter timestamp register. The timestamp counter and bit counter can be used by software to track the progress of the transmitter and receiver. It can also be used to calculate the relative frequency of the bit clock against the bus interface clock. These bitcount and timestamp registers are volatile, and supported when the module has timestamp features. Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260310104235.1234569-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 819cf1dc01ce66b6906d403a6925c4bd754a7a1d Author: Shengjiu Wang Date: Tue Mar 10 18:42:33 2026 +0800 ASoC: fsl_utils: Add snd_kcontrol functions for specific cases There are some registers which are volatile, at pm runtime suspend state, the regmap cache only is enabled, regmap will return -EBUSY when trying to access these registers. static int _regmap_read(struct regmap *map, unsigned int reg, unsigned int *val) { int ret; void *context = _regmap_map_get_context(map); if (!map->cache_bypass) { ret = regcache_read(map, reg, val); if (ret == 0) return 0; } if (map->cache_only) return -EBUSY; if (!regmap_readable(map, reg)) return -EIO; When exporting these registers by amixer interface to user space, there will be -EBUSY errors in mixer-test when the cpu dai is in idle. In order to avoid such error, needs to define FSL own functions to take a pm runtime reference before calling snd_soc_get_xr_sx(), snd_soc_get_enum_double(), snd_soc_get_volsw(), and so on. Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260310104235.1234569-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 0e07b16371b6eef9b5a4a1fd3e7942938811072e Author: Lionel Landwerlin Date: Fri Mar 6 09:55:03 2026 +0200 drm/xe: Allow per queue programming of COMMON_SLICE_CHICKEN3 bit13 Similar to i915's commit cebc13de7e704b1355bea208a9f9cdb042c74588 ("drm/i915: Whitelist COMMON_SLICE_CHICKEN3 for UMD access"), except that instead of putting the register on the allowlist for UMD to program, the KMD is doing the programming at context initialization based on a queue creation flag. This is a recommended tuning setting for both gen12 and Xe_HP platforms. If a render queue is created with DRM_XE_EXEC_QUEUE_SET_STATE_CACHE_PERF_FIX, COMMON_SLICE_CHICKEN3 will be programmed at initialization to enable the render color cache to key with BTP+BTI (binding table pool + binding table entry) instead of just BTI (binding table entry). This enables the UMD to avoid emitting render-target-cache-flush + stall-at-pixel-scoreboard every time a binding table entry pointing to a render target is changed. v2: Use xe_lrc_write_ring() v3: Update xe_query.c to report availability v4: Rename defines to add DISABLE_ v5: update commit message v6: rebase Mesa MR: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/39982 Bspec: 73993, 73994, 72161, 31870, 68331 Acked-by: Rodrigo Vivi Reviewed-by: José Roberto de Souza Signed-off-by: Lionel Landwerlin Signed-off-by: José Roberto de Souza Link: https://patch.msgid.link/20260306075504.1288676-1-lionel.g.landwerlin@intel.com commit e68f95a51d1a8c1594b536c4d495cbea38d47561 Author: Philipp Hahn Date: Tue Mar 10 12:49:17 2026 +0100 leds: Prefer IS_ERR_OR_NULL over manual NULL check Prefer using IS_ERR_OR_NULL() over using IS_ERR() and a manual NULL check. Change generated with coccinelle. Signed-off-by: Philipp Hahn Link: https://patch.msgid.link/20260310-b4-is_err_or_null-v1-51-bd63b656022d@avm.de Signed-off-by: Lee Jones commit 66b0baaabd35d302698d0a2c98671bf4e1b87f92 Author: Krzysztof Kozlowski Date: Fri Mar 6 13:02:57 2026 +0100 dt-bindings: display: panel: Align style of additionalProperties For code readability the bindings are expected to follow order shown in example-schema.yaml - put the additionalProperties/unevaluatedProperties entry at the end, after listing all required properties and possible "allOf:if:then:" conditions. Meaning of this style is to close the schema, after listing what it contains, with final "nothing more is allowed". Move the code around adjusting it to coding style. No functional impact. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260306-dt-bindings-display-panel-clean-v1-4-3086eda1efaf@oss.qualcomm.com commit 72cfe73347fac6252ab77d8dcd405f0a5b1a5a24 Author: Krzysztof Kozlowski Date: Fri Mar 6 13:02:56 2026 +0100 dt-bindings: display: panel: Drop redundant properties The purpose of common schemas, like panel-common.yaml, is to list applicable properties. It can list common ABI, e.g. "label" property, and pure hardware related properties like power supply or GPIOs. In the second case it means that all panels have these supplies or GPIOs. This is the only meaning when hardware property is allowed in common schema, because bindings are precise and we do not define common schemas for "possible" hardware configurations. Following this, all panel bindings which reference common schema and use "unevaluatedProperties: false" do not need to list these common parts. Simplify such bindings to also reduce copy-paste code and review time for new contributions. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260306-dt-bindings-display-panel-clean-v1-3-3086eda1efaf@oss.qualcomm.com commit 32003681e575a9a02cb6814e99157dfab0b9f70d Author: Krzysztof Kozlowski Date: Fri Mar 6 13:02:55 2026 +0100 dt-bindings: display: innolux,p097pfg: Document ports This MIPI-DSI LCD panel must be connected to something. According to scarce web data it supports two channels and it is already used like this in DTS. Reported by dtbs_check: rockchip/rk3399-gru-scarlet-inx.dtb: panel@0 (innolux,p097pfg): 'ports' does not match any of the regexes: '^pinctrl-[0-9]+$' Signed-off-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260306-dt-bindings-display-panel-clean-v1-2-3086eda1efaf@oss.qualcomm.com commit 1f5a1ebddc170197348d203b11a05799966dbef6 Author: Krzysztof Kozlowski Date: Fri Mar 6 13:02:54 2026 +0100 dt-bindings: display: samsung,s6d7aa0: Document port This MIPI-DSI LCD panel must be connected to something, thus add missing port property, already used in DTS. Reported by dtbs_check: qcom/msm8916-samsung-gt58.dtb: panel@0 (samsung,lsl080al03): 'port' does not match any of the regexes: '^pinctrl-[0-9]+$' Signed-off-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260306-dt-bindings-display-panel-clean-v1-1-3086eda1efaf@oss.qualcomm.com commit a187482243cac177d04ce9b5571acc76ab800e9b Author: Svyatoslav Ryhel Date: Mon Feb 23 08:46:30 2026 +0200 gpu/drm: panel: add support for DSI panel used in Motorola Atrix 4G and Droid X2 Add support for the DSI LCD panel module found in Motorola Atrix 4G or Droid X2 smartphones. Exact panel vendor and model are unknown hence panel uses generic compatible based on board where it is used. The panel has a 540x960 resolution with 24 bit RGB per pixel. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260223064630.12720-3-clamor95@gmail.com commit 6b263e50c036ab5a366142fb050e287d50d404b6 Author: Svyatoslav Ryhel Date: Mon Feb 23 08:46:29 2026 +0200 dt-bindings: display: panel: document Atrix 4G and Droid X2 DSI panel Atrix 4G and Droid X2 are based on a board called by Motorola "Mot" and use the same 540x960 DSI video mode panel. Exact panel vendor and model are unknown hence generic compatible based on board name "Mot" is used. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260223064630.12720-2-clamor95@gmail.com commit 2db443036fe9daf170e5919face475307d486641 Author: Richard Acayan Date: Mon Mar 9 20:26:04 2026 -0400 drm/panel: Add Novatek/Tianma NT37700F panel Some Pixel 3a XL devices have a Tianma panel. Add support for it, with the aid of linux-mdss-dsi-panel-driver-generator. Link: https://github.com/msm8916-mainline/linux-mdss-dsi-panel-driver-generator Signed-off-by: Richard Acayan Tested-by: Yifei Zhan Reviewed-by: Dmitry Baryshkov Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260310002606.16413-4-mailingradian@gmail.com commit e0102c94ec12640a6b66037adc6e9ae5c9c0dc27 Author: Richard Acayan Date: Mon Mar 9 20:26:03 2026 -0400 dt-bindings: panel-simple-dsi: add nt37700f compatible Add the compatible for the NT37700F panel found on the Pixel 3a XL. Signed-off-by: Richard Acayan Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260310002606.16413-3-mailingradian@gmail.com commit 8bcf6264b73f5cfa24e734c0027a69f207e26445 Author: Richard Acayan Date: Mon Mar 9 20:26:02 2026 -0400 dt-bindings: arm: qcom: document google,bonito-tianma board The Pixel 3a XL is code-named by Google as "bonito". The google,bonito-tianma compatible represents a variant of the Pixel 3a XL board with a Tianma/Novatek NT37700F panel. Document the google,bonito board compatible and the google,bonito-tianma variant in the bindings. Signed-off-by: Richard Acayan Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260310002606.16413-2-mailingradian@gmail.com commit 4063a4d39f97b02cb7bbdb47f0b0050b7821e187 Author: Luca Leonardo Scorcia Date: Mon Mar 9 18:03:36 2026 +0000 dt-bindings: display: panel: Document the rotation property The Jadard jd9365da-h3 driver already allows DRM to get the panel orientation via the device tree rotation property (described in panel-common.yaml), but it's currently not documented. Describe it in the driver documentation to fix a dtbs_check error in Xiaomi Mi Smart Clock x04g, where the panel is landscape-oriented. Signed-off-by: Luca Leonardo Scorcia Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260309180353.8220-1-l.scorcia@gmail.com commit 46be11b678e0a9a5deaf132cb21afd1259e32d6e Author: Marek Vasut Date: Sat Jan 17 01:49:48 2026 +0100 drm/panel: simple: Add Waveshare 13.3" panel support Add WaveShare 13.3inch 1920x1080 DSI Capacitive Touch Display support. While the panel is described as DPI panel, it is part of a larger unit in non-removable metal casing, so the actual internal configuration is not known. The panel is attached to "waveshare,dsi2dpi" bridge via DT. It is likely that internally, this panel is an LVDS panel, connected to ICN6211 DSI-to-DPI bridge and then another unknown DPI-to-LVDS bridge. Current device link is at https://www.waveshare.com/13.3inch-dsi-lcd.htm Signed-off-by: Marek Vasut Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260117005028.126361-1-marek.vasut+renesas@mailbox.org commit b26c17c924ff9ecae6312e1947cc6c1b561b40a7 Author: John Keeping Date: Tue Mar 3 15:21:24 2026 +0000 drm/panel: ilitek-ili9882t: use gpiod_set_value_cansleep() All of these GPIO calls are in process context where they can sleep. Use the appropriate function call to allow use of this driver with GPIO controllers that might sleep. Signed-off-by: John Keeping Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260303152124.187791-1-jkeeping@inmusicbrands.com commit 5c19c4ed5ae45553380afa6de7cd17d4e5bef827 Author: Langyan Ye Date: Sat Feb 14 16:54:09 2026 +0800 drm/panel: panel-jadard-jd9365da-h3: support for taiguan-xti05101-01a MIPI-DSI panel The taiguan-xti05101-01a is a 10.1" TFT panel. The MIPI controller on this panel is the same as the other panels here, so add this panel to this driver. Signed-off-by: Langyan Ye Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260214085409.3489057-4-yelangyan@huaqin.corp-partner.google.com commit 75a703c6810fa566e5a64dc0c3e45d2d891307e2 Author: Langyan Ye Date: Sat Feb 14 16:54:08 2026 +0800 dt-bindings: display: panel: Add compatible for TAIGUAN XTI05101-01A Add a new compatible for the panel TAIGUAN XTI05101-01A. This panel uses JD9365DA-H3 IC, so add the compatible to the jd9365da-h3 binding files. Signed-off-by: Langyan Ye Acked-by: Rob Herring (Arm) Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260214085409.3489057-3-yelangyan@huaqin.corp-partner.google.com commit 65fb1ca580461a4fb4529a22b0d6f50c13e4c3cc Author: Langyan Ye Date: Sat Feb 14 16:54:07 2026 +0800 dt-bindings: vendor: add taiguanck Add the "taiguanck" vendor prefix for Shenzhen Top Group Technology Co., Ltd. The prefix is derived from the vendor's website domain: www.taiguanck.com/en/, which uses "taiguanck" as the primary identifier of the company. Signed-off-by: Langyan Ye Acked-by: Conor Dooley Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260214085409.3489057-2-yelangyan@huaqin.corp-partner.google.com commit 1f772de164e6417e58c7b53fdad7f3c04d7f49ab Author: Rouven Czerwinski Date: Wed Feb 18 10:12:06 2026 +0100 drm/panel: add LXD M9189A panel driver The LXD M9189A panel is based on the EK79007AD3 DSI display controller. It currently supports only 4 lane operation. Signed-off-by: Rouven Czerwinski Signed-off-by: Michael Tretter Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260218-drm-panel-ek79007ad3-v4-3-8ec448bf3ede@pengutronix.de commit 59986dad1bd075de129334c4a4cf4ee9b29fb221 Author: Rouven Czerwinski Date: Wed Feb 18 10:12:05 2026 +0100 dt-bindings: display: panel: add LXD M9189A The LXD M9189A is a 1024x600 MIPI-DSI panel. Signed-off-by: Rouven Czerwinski Signed-off-by: Michael Tretter Reviewed-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260218-drm-panel-ek79007ad3-v4-2-8ec448bf3ede@pengutronix.de commit 312e23275b5bfa61e6cad9f6648d048257273742 Author: Rouven Czerwinski Date: Wed Feb 18 10:12:04 2026 +0100 dt-bindings: vendor-prefixes: Add lxd Add vendor prefix for LXD Research & Display, LLC. Link: https://www.lxdinc.com/ Signed-off-by: Rouven Czerwinski Acked-by: Krzysztof Kozlowski Signed-off-by: Michael Tretter Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260218-drm-panel-ek79007ad3-v4-1-8ec448bf3ede@pengutronix.de commit fd77ff14801570f546a777c52fbe22ac8c3ea0fb Author: Sebastian Krzyszkowiak Date: Wed Feb 18 20:47:23 2026 +0100 drm/panel: mantix: Set the pixel clocks for 60 Hz These are 60 Hz panels, but the currently set pixel clocks result in modes with refresh rates of 63 Hz and ~63.41 Hz. Adjust the clocks to target 60 Hz. Signed-off-by: Sebastian Krzyszkowiak Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260218-mantix-pixel-clock-v1-1-c22c034ba5c1@puri.sm commit 4a3a4cb8198a5853e940cc6620c7b7c4e215a899 Author: Florijan Plohl Date: Tue Feb 17 13:37:59 2026 +0100 drm/panel: simple: Add Powertip PH800480T032-ZHC19 panel Add support for the Powertip PH800480T032-ZHC19 7" (800x480) parallel LCD-TFT panel. Signed-off-by: Florijan Plohl Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260217123759.169317-2-florijan.plohl@norik.com commit eb2ed3de6ae9006a81e964ecd0ca86919b13f37d Author: Florijan Plohl Date: Tue Feb 17 13:37:58 2026 +0100 dt-bindings: display: simple: Add Powertip PH800480T032-ZHC19 panel Add Powertip PH800480T032-ZHC19 7" LCD-TFT RGB panel compatible string. Signed-off-by: Florijan Plohl Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260217123759.169317-1-florijan.plohl@norik.com commit 8e9661f4127ffe17768f9c24a16d9a281315d571 Author: Sebastian Krzyszkowiak Date: Mon Feb 16 18:50:18 2026 +0100 drm/panel: mantix: Drop the shutdown callback It's the responsibility of the DRM modeset driver to unprepare and disable the panel. Doing so here leads to regulator underflows. Signed-off-by: Sebastian Krzyszkowiak Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260216-mantix-shutdown-v1-1-d2e93a8ccc4c@puri.sm commit 3efe01ff79041fe64a6f6637191b69abf310fd0d Author: Svyatoslav Ryhel Date: Sun Feb 15 10:51:39 2026 +0200 drm/panel: r61307/r69328: convert to devm_mipi_dsi_attach Switch to device managed version of mipi_dsi_attach. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260215085140.20499-6-clamor95@gmail.com Link: https://patch.msgid.link/20251204060627.4727-2-clamor95@gmail.com Link: https://patch.msgid.link/20251204060627.4727-3-clamor95@gmail.com Link: https://patch.msgid.link/20251204060627.4727-5-clamor95@gmail.com Link: https://patch.msgid.link/20251204060627.4727-6-clamor95@gmail.com Link: https://patch.msgid.link/20251204060627.4727-7-clamor95@gmail.com Link: https://patch.msgid.link/20251204060627.4727-8-clamor95@gmail.com commit a4ad5575ce195d2a49a302e823cd42aa5c4133d5 Author: Svyatoslav Ryhel Date: Sun Feb 15 10:51:38 2026 +0200 drm/panel: r61307/r69328: return accumulated errors Return accumulated errors from dsi function calls. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260215085140.20499-5-clamor95@gmail.com commit 1f8ba5e3508d17fef2602cb2826426afe593de78 Author: Svyatoslav Ryhel Date: Sun Feb 15 10:51:37 2026 +0200 drm/panel: r61307/r69328: remove redundant checks This is now done by the DRM framework itself. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260215085140.20499-4-clamor95@gmail.com commit 839ed86975721a428f4798c52cf167349164b2fb Author: Svyatoslav Ryhel Date: Sun Feb 15 10:51:36 2026 +0200 drm/panel: r61307/r69328: convert to drm_connector_helper_get_modes_fixed Switch to use of drm_connector_helper_get_modes_fixed helper for get_modes operation. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260215085140.20499-3-clamor95@gmail.com commit c1a4c55d75c0471710f444f56527f5bce9739c7e Author: Svyatoslav Ryhel Date: Sun Feb 15 10:51:35 2026 +0200 drm/panel: r61307: align with schema property Rename renesas,inversion to renesas,column-inversion according to schema. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260215085140.20499-2-clamor95@gmail.com commit 43c3d68e64898f61e3b76c56b20af227fa49ca3f Author: Marco Felsch Date: Mon Jan 19 14:44:43 2026 +0100 drm/panel: simple: add EDT ET057023UDBA panel Add support for the EDT ET057023UDBA 5.7" 24-bit 640x480 DPI panel. Reviewed-by: Neil Armstrong Signed-off-by: Marco Felsch Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260119-v6-18-topic-panel-simple-et057023udba-v2-2-3c73f0c9d87a@pengutronix.de commit c58724f415a21222b43f9e9385216252be4cedc7 Author: Marco Felsch Date: Mon Jan 19 14:44:42 2026 +0100 dt-bindings: display: simple: add EDT ET057023UDBA panel Add EDT ET057023UDBA 5.7" 24-bit 640x480 DPI panel. Signed-off-by: Marco Felsch Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260119-v6-18-topic-panel-simple-et057023udba-v2-1-3c73f0c9d87a@pengutronix.de commit cc68a8a3f89c18bdbce33a449c31e6467a3cbcfa Author: Chen-Yu Tsai Date: Mon Mar 2 23:27:22 2026 +0800 arm64: dts: allwinner: sun55i-t527: avaota-a1: Enable LEDs The Avaota A1 board features 4 RGB LEDs in a string connected to the SoC's LED controller. Enable the LED controller and add device nodes for them. The timings were copied from the downstream vendor DTS. The design does not specify what these LEDs are for, nor are there any markings on the board for them, so just use them as indicators. Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20260302152724.3197587-4-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 24cd5a81771d8213abb7494245a7f320a6e75e52 Author: Chen-Yu Tsai Date: Mon Mar 2 23:27:21 2026 +0800 arm64: dts: allwinner: sun55i-a523: Add LED controller The A523 SoC family features an LED controller that is identical to the one found on previous SoCs. Add a device node for it, and one of the possible pinmux settings. This setting is used on the Avaota A1. Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20260302152724.3197587-3-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 7cb259eacc08df8e5d1b17e6a75a19518e5de7ca Author: Chen-Yu Tsai Date: Mon Mar 2 23:27:20 2026 +0800 dt-bindings: leds: sun50i-a100: Add compatible for Allwinner A523 SoC The Allwinner A523 SoC family features an identical LED controller as found on the A100. Add a SoC-specific compatible for it, with fallback to the A100 one. Acked-by: Krzysztof Kozlowski Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20260302152724.3197587-2-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit daa6c79858e9ca75c548452bf71db8a9e61bde42 Author: Chaitanya Kulkarni Date: Wed Feb 25 19:12:43 2026 -0800 block: clear BIO_QOS flags in blk_steal_bios() When a bio goes through the rq_qos infrastructure on a path's request queue, it gets BIO_QOS_THROTTLED or BIO_QOS_MERGED flags set. These flags indicate that rq_qos_done_bio() should be called on completion to update rq_qos accounting. During path failover in nvme_failover_req(), the bio's bi_bdev is redirected from the failed path's disk to the multipath head's disk via bio_set_dev(). However, the BIO_QOS flags are not cleared. When the bio eventually completes (either successfully via a new path or with an error via bio_io_error()), rq_qos_done_bio() checks for these flags and calls __rq_qos_done_bio(q->rq_qos, bio) where q is obtained from the bio's current bi_bdev - which is now the multipath head's queue, not the original path's queue. The multipath head's queue does not have rq_qos enabled (q->rq_qos is NULL), but the code assumes that if BIO_QOS_* flags are set, q->rq_qos must be valid. This breaks when a bio is moved between queues during NVMe multipath failover, leading to a NULL pointer dereference. Execution Context timeline :- * =====> dd process context [USER] dd process [SYSCALL] write() - dd process context submit_bio() nvme_ns_head_submit_bio() - path selection blk_mq_submit_bio() #### QOS FLAGS SET HERE [USER] dd waits or returns ==== I/O in flight on NVMe hardware ===== ===== End of submission path ==== ------------------------------------------------------ * dd ====> Interrupt context; [IRQ] NVMe completion interrupt nvme_irq() nvme_complete_rq() nvme_failover_req() ### BIO MOVED TO HEAD spin_lock_irqsave (atomic section) bio_set_dev() changes bi_bdev ### BUG: QOS flags NOT cleared kblockd_schedule_work() * Interrupt context =====> kblockd workqueue [WQ] kblockd workqueue - kworker process nvme_requeue_work() submit_bio_noacct() nvme_ns_head_submit_bio() nvme_find_path() returns NULL bio_io_error() bio_endio() rq_qos_done_bio() ### CRASH ### KERNEL PANIC / OOPS Crash from blktests nvme/058 (rapid namespace remapping): [ 1339.636033] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 1339.641025] nvme nvme4: rescanning namespaces. [ 1339.642064] #PF: supervisor read access in kernel mode [ 1339.642067] #PF: error_code(0x0000) - not-present page [ 1339.642070] PGD 0 P4D 0 [ 1339.642073] Oops: Oops: 0000 [#1] SMP NOPTI [ 1339.642078] CPU: 35 UID: 0 PID: 4579 Comm: kworker/35:2H Tainted: G O N 6.17.0-rc3nvme+ #5 PREEMPT(voluntary) [ 1339.642084] Tainted: [O]=OOT_MODULE, [N]=TEST [ 1339.673446] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 1339.682359] Workqueue: kblockd nvme_requeue_work [nvme_core] [ 1339.686613] RIP: 0010:__rq_qos_done_bio+0xd/0x40 [ 1339.690161] Code: 75 dd 5b 5d 41 5c c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 f5 53 48 89 fb <48> 8b 03 48 8b 40 30 48 85 c0 74 0b 48 89 ee 48 89 df ff d0 0f 1f [ 1339.703691] RSP: 0018:ffffc900066f3c90 EFLAGS: 00010202 [ 1339.706844] RAX: ffff888148b9ef00 RBX: 0000000000000000 RCX: 0000000000000000 [ 1339.711136] RDX: 00000000000001c0 RSI: ffff8882aaab8a80 RDI: 0000000000000000 [ 1339.715691] RBP: ffff8882aaab8a80 R08: 0000000000000000 R09: 0000000000000000 [ 1339.720472] R10: 0000000000000000 R11: fefefefefefefeff R12: ffff8882aa3b6010 [ 1339.724650] R13: 0000000000000000 R14: ffff8882338bcef0 R15: ffff8882aa3b6020 [ 1339.729029] FS: 0000000000000000(0000) GS:ffff88985c0cf000(0000) knlGS:0000000000000000 [ 1339.734525] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1339.738563] CR2: 0000000000000000 CR3: 0000000111045000 CR4: 0000000000350ef0 [ 1339.742750] DR0: ffffffff845ccbec DR1: ffffffff845ccbed DR2: ffffffff845ccbee [ 1339.745630] DR3: ffffffff845ccbef DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 1339.748488] Call Trace: [ 1339.749512] [ 1339.750449] bio_endio+0x71/0x2e0 [ 1339.751833] nvme_ns_head_submit_bio+0x290/0x320 [nvme_core] [ 1339.754073] __submit_bio+0x222/0x5e0 [ 1339.755623] ? rcu_is_watching+0xd/0x40 [ 1339.757201] ? submit_bio_noacct_nocheck+0x131/0x370 [ 1339.759210] submit_bio_noacct_nocheck+0x131/0x370 [ 1339.761189] ? submit_bio_noacct+0x20/0x620 [ 1339.762849] nvme_requeue_work+0x4b/0x60 [nvme_core] [ 1339.764828] process_one_work+0x20e/0x630 [ 1339.766528] worker_thread+0x184/0x330 [ 1339.768129] ? __pfx_worker_thread+0x10/0x10 [ 1339.769942] kthread+0x10a/0x250 [ 1339.771263] ? __pfx_kthread+0x10/0x10 [ 1339.772776] ? __pfx_kthread+0x10/0x10 [ 1339.774381] ret_from_fork+0x273/0x2e0 [ 1339.775948] ? __pfx_kthread+0x10/0x10 [ 1339.777504] ret_from_fork_asm+0x1a/0x30 [ 1339.779163] Fix this by clearing both BIO_QOS_THROTTLED and BIO_QOS_MERGED flags when bios are redirected to the multipath head in nvme_failover_req(). This is consistent with the existing code that clears REQ_POLLED and REQ_NOWAIT flags when the bio changes queues. Signed-off-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260226031243.87200-3-kch@nvidia.com Signed-off-by: Jens Axboe commit b2c45ced591e6cf947560d2d290a51855926b774 Author: Chaitanya Kulkarni Date: Wed Feb 25 19:12:42 2026 -0800 block: move bio queue-transition flag fixups into blk_steal_bios() blk_steal_bios() transfers bios from a request to a bio_list when the request is requeued to a different queue. The NVMe multipath failover path (nvme_failover_req) currently open-codes clearing of REQ_POLLED, bi_cookie, and REQ_NOWAIT on each bio before calling blk_steal_bios(). Move these fixups into blk_steal_bios() itself so that any caller automatically gets correct flag state when bios cross queue boundaries. Simplify nvme_failover_req() accordingly. Signed-off-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260226031243.87200-2-kch@nvidia.com Signed-off-by: Jens Axboe commit efaf86be62d34b13b8e2293805d3c96299a92960 Author: Varun Gupta Date: Mon Mar 9 12:09:23 2026 +0530 drm/xe: Add Wa_14026578760 Add GT workaround Wa_14026578760 for graphics versions 35.10, 35.11 and media version 35.03. Signed-off-by: Varun Gupta Reviewed-by: Tejas Upadhyay Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260309063923.4031933-1-varun.gupta@intel.com Signed-off-by: Tejas Upadhyay commit 05e059510edf7b6101ff85db2a2e2d1b6f31ee6d Merge: 89fe91c65992a3 8e5218199da489 Author: Paolo Abeni Date: Tue Mar 10 13:53:54 2026 +0100 Merge branch 'eth-fbnic-add-fbnic-self-tests' Mike Marciniszyn says: ==================== eth fbnic: Add fbnic self tests From: "Mike Marciniszyn (Meta)" This series adds self tests to test the registers, the msix interrupts, the tlv, and the firmware mailbox. This series assumes that the [PATCH net-next 0/2] Add debugfs hooks [1] is present. When the self tests are run the with ethtool -t: ethtool -t eth0 The test result is PASS The test extra info: Register test (offline) 0 MSI-X Interrupt test (offline) 0 FW mailbox test (on/offline) 0 ==================== Link: https://patch.msgid.link/20260307105847.1438-1-mike.marciniszyn@gmail.com Signed-off-by: Paolo Abeni commit 8e5218199da48913960a0ce7e22193020dc23891 Author: Mike Marciniszyn (Meta) Date: Sat Mar 7 05:58:47 2026 -0500 eth fbnic: Add mailbox self test The mailbox self test ensures the interface to and from the firmware is healthy by sending a test message and fielding the response from the firmware. This patch uses the new completion API [1][2] that allocates a completion structure, binds the completion to the TEST message, and uses a new FW parsing routine that wraps the completion processing around the TLV parser. Link: https://patch.msgid.link/20250516164804.741348-1-lee@trager.us [1] Link: https://patch.msgid.link/20260115003353.4150771-6-mohsin.bashr@gmail.com [2] Signed-off-by: Mike Marciniszyn (Meta) Link: https://patch.msgid.link/20260307105847.1438-6-mike.marciniszyn@gmail.com Signed-off-by: Paolo Abeni commit d522b1b004800728de5466451e4d7032a4f53de6 Author: Mike Marciniszyn (Meta) Date: Sat Mar 7 05:58:46 2026 -0500 eth fbnic: TLV support for use by MBX self test The TLV (Type-Value-Length) self uses a known set of data to create a TLV message. These routines support the MBX self test by creating the test messages and parsing the response message coming back from the firmware. Signed-off-by: Mike Marciniszyn (Meta) Link: https://patch.msgid.link/20260307105847.1438-5-mike.marciniszyn@gmail.com Signed-off-by: Paolo Abeni commit 99fc8d3d00c94e32c1a8b60783a0d24421053446 Author: Mike Marciniszyn (Meta) Date: Sat Mar 7 05:58:45 2026 -0500 eth fbnic: Add msix self test This function is meant to test the global interrupt registers and the PCIe IP MSI-X functionality. It essentially goes through and tests various combinations of the set, clear, and mask bits in order to verify the behavior is as we expect it to be from the driver. Signed-off-by: Mike Marciniszyn (Meta) Link: https://patch.msgid.link/20260307105847.1438-4-mike.marciniszyn@gmail.com Signed-off-by: Paolo Abeni commit b43498b7e9be0ef76440980642b2bf20dc213e19 Author: Mike Marciniszyn (Meta) Date: Sat Mar 7 05:58:44 2026 -0500 eth fbnic: Add register self test The register test will be used to verify hardware is behaving as expected. The test itself will have us writing to registers that should have no side effects due to us resetting after the test has been completed. While the test is being run the interface should be offline. This patch counts on the first patch of this series to export netif_open() and also ensures that the half close calls netif_close() to avoid deadlock. Signed-off-by: Mike Marciniszyn (Meta) Link: https://patch.msgid.link/20260307105847.1438-3-mike.marciniszyn@gmail.com Signed-off-by: Paolo Abeni commit 3fdd33697c2be9184668c89ba4f24a5ecbc8ec51 Author: Mike Marciniszyn (Meta) Date: Sat Mar 7 05:58:43 2026 -0500 net: export netif_open for self_test usage dev_open() already is exported, but drivers which use the netdev instance lock need to use netif_open() instead. netif_close() is also already exported [1] so this completes the pairing. This export is required for the following fbnic self tests to avoid calling ndo_stop() and ndo_open() in favor of the more appropriate netif_open() and netif_close() that notifies any listeners that the interface went down to test and is now coming back up. Link: https://patch.msgid.link/20250309215851.2003708-1-sdf@fomichev.me [1] Signed-off-by: Mike Marciniszyn (Meta) Link: https://patch.msgid.link/20260307105847.1438-2-mike.marciniszyn@gmail.com Signed-off-by: Paolo Abeni commit 89fe91c65992a37863241e35aec151210efc53ce Author: Erni Sri Satya Vennela Date: Fri Mar 6 13:12:06 2026 -0800 net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response As a part of MANA hardening for CVM, add validation for the doorbell ID (db_id) received from hardware in the GDMA_REGISTER_DEVICE response to prevent out-of-bounds memory access when calculating the doorbell page address. In mana_gd_ring_doorbell(), the doorbell page address is calculated as: addr = db_page_base + db_page_size * db_index = (bar0_va + db_page_off) + db_page_size * db_index A hardware could return values that cause this address to fall outside the BAR0 MMIO region. In Confidential VM environments, hardware responses cannot be fully trusted. Add the following validations: - Store the BAR0 size (bar0_size) in gdma_context during probe. - Validate the doorbell page offset (db_page_off) read from device registers does not exceed bar0_size during initialization, converting mana_gd_init_registers() to return an error code. - Validate db_id from GDMA_REGISTER_DEVICE response against the maximum number of doorbell pages that fit within BAR0. Signed-off-by: Erni Sri Satya Vennela Link: https://patch.msgid.link/20260306211212.543376-1-ernis@linux.microsoft.com Signed-off-by: Paolo Abeni commit 46097d011f77f5758fb47b7059b4f1f2e7403940 Author: Lorenzo Bianconi Date: Fri Mar 6 16:09:47 2026 +0100 net: airoha: Move GDM forward port configuration in ndo_open/ndo_stop callbacks This change allows to set GDM forward port configuration to FE_PSE_PORT_DROP stopping the network device. Hw design requires to stop packet forwarding putting the interface down. Moreover, PPE firmware requires to use PPE1 for GDM3 or GDM4. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260306-airoha-gdm-forward-ndo-open-stop-v1-1-7b7a20dd9ef0@kernel.org Signed-off-by: Paolo Abeni commit 49c002275a8cabe2fcb3a99b39a1b7fae2351215 Merge: 296bd7dd81bf43 a8075ada4a341c Author: Mark Brown Date: Tue Mar 10 12:09:17 2026 +0000 ASoC: ti: davinci-mcasp: McASP code cleanup and clk Merge series from Sen Wang : Just two minor patches that aim to tidy up the code a little bit, as well as fix the aux_div selection in davinci_mcasp_calc_clk_div() for mid-range dividers (33 <= div <= 4096). Sen Wang (2): ASoC: ti: davinci-mcasp: extract mcasp_is_auxclk_enabled() helper ASoC: ti: davinci-mcasp: improve aux_div selection for mid-range dividers sound/soc/ti/davinci-mcasp.c | 45 +++++++++++++++++++++++++----------- 1 file changed, 31 insertions(+), 14 deletions(-) -- 2.43.0 commit 1b50f42049d8270986a952e621415278e0945ce4 Author: Dennis Dalessandro Date: Mon Mar 9 16:45:29 2026 -0400 RDMA/hfi1: Remove opa_vnic OPA Vnic has been abandoned and left to rot. Time to excise. Signed-off-by: Dennis Dalessandro Link: https://patch.msgid.link/177308912950.1280237.15051663328388849915.stgit@awdrv-04.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit ca0395d9ef294a4340104107177de23e04de2344 Author: Luca Weiss Date: Fri Mar 6 15:22:16 2026 +0100 pinctrl: qcom: Add Milos LPASS LPI TLMM Add a driver for the pin controller in the Low Power Audio SubSystem (LPASS) on the Milos SoC. Signed-off-by: Luca Weiss Signed-off-by: Linus Walleij commit 3bf14aec6d6f1ad694d8e196289ed7e02ba3cb66 Author: Luca Weiss Date: Fri Mar 6 15:22:15 2026 +0100 dt-bindings: pinctrl: qcom: Add Milos LPASS LPI pinctrl Add bindings for pin controller in Milos Low Power Audio SubSystem (LPASS). Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit a544873ce0575b2fd8285a1364d3e09929d9a3ba Author: John Hubbard Date: Mon Mar 9 19:10:56 2026 -0700 gpu: nova-core: apply the one "use" item per line policy to commands.rs As per [1], we need one "use" item per line, in order to reduce merge conflicts. Furthermore, we need a trailing ", //" in order to tell rustfmt(1) to leave it alone. This does that for commands.rs, which is the only file in nova-core that has any remaining instances of the old style. [1] https://docs.kernel.org/rust/coding-guidelines.html#imports Reviewed-by: Gary Guo Signed-off-by: John Hubbard Link: https://patch.msgid.link/20260310021125.117855-7-jhubbard@nvidia.com Signed-off-by: Alexandre Courbot commit a247f8a107b5ddbf21084599ad8d8190d1357de8 Author: John Hubbard Date: Mon Mar 9 19:10:52 2026 -0700 gpu: nova-core: add FbRange.len() and use it in boot.rs A tiny simplification: now that FbLayout uses its own specific FbRange type, add an FbRange.len() method, and use that to (very slightly) simplify the calculation of Frts::frts_size initialization. Suggested-by: Alexandre Courbot Reviewed-by: Gary Guo Signed-off-by: John Hubbard Link: https://patch.msgid.link/20260310021125.117855-3-jhubbard@nvidia.com Signed-off-by: Alexandre Courbot commit ba6e088ac6df02dfca2b90c54f8bb3559aab162c Author: John Hubbard Date: Mon Mar 9 19:10:51 2026 -0700 gpu: nova-core: print FB sizes, along with ranges For convenience of the reader: now you can directly see the sizes of each range. It is surprising just how much this helps. Sample output (using an Ampere GA104): NovaCore 0000:e1:00.0: FbLayout { fb: 0x0..0x3ff800000 (16376 MiB), vga_workspace: 0x3ff700000..0x3ff800000 (1 MiB), frts: 0x3ff600000..0x3ff700000 (1 MiB), boot: 0x3ff5fa000..0x3ff600000 (24 KiB), elf: 0x3fb960000..0x3ff5f9000 (60 MiB), wpr2_heap: 0x3f3900000..0x3fb900000 (128 MiB), wpr2: 0x3f3800000..0x3ff700000 (191 MiB), heap: 0x3f3700000..0x3f3800000 (1 MiB), vf_partition_count: 0x0, } Cc: Timur Tabi Reviewed-by: Gary Guo Signed-off-by: John Hubbard Link: https://patch.msgid.link/20260310021125.117855-2-jhubbard@nvidia.com Signed-off-by: Alexandre Courbot commit 94ff50f41472391f7a5b98fd9801dfc361db8957 Author: Thorsten Blum Date: Tue Mar 10 11:25:25 2026 +0100 thermal/drivers/sprd: Use min instead of clamp in sprd_thm_temp_to_rawdata Clamping 'val' to itself is unnecessary and the expression can be simplified by using min() instead. Casting SPRD_THM_RAW_DATA_HIGH to u32 is also redundant and can be removed. Reviewed-by: Baolin Wang Reviewed-by: Lukasz Luba Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260310102523.201722-3-thorsten.blum@linux.dev Signed-off-by: Daniel Lezcano commit 5ad32c3607cf241a1a2680cabd64cbcd757227aa Author: Andy Shevchenko Date: Fri Feb 27 17:43:35 2026 +0100 pinctrl: cy8c95x0: Avoid returning positive values to user space When probe fails due to unclear interrupt status register, it returns a positive number instead of the proper error code. Fix this accordingly. Fixes: e6cbbe42944d ("pinctrl: Add Cypress cy8c95x0 support") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202602271847.vVWkqLBD-lkp@intel.com/ Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit f4040a7c3ddf38710f5f9aeb19220da9b614a4b0 Author: Alice Ryhl Date: Mon Jan 5 12:42:22 2026 +0000 rust: jump_label: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Acked-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260105-define-rust-helper-v2-9-51da5f454a67@google.com Signed-off-by: Miguel Ojeda commit 15536a3b3ceb57f8cecedaf82f2afc9edd6e36e0 Author: Alice Ryhl Date: Mon Jan 5 12:42:17 2026 +0000 rust: clk: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Acked-by: Stephen Boyd Link: https://patch.msgid.link/20260105-define-rust-helper-v2-4-51da5f454a67@google.com Signed-off-by: Miguel Ojeda commit 2afa8b9f5ff8749b8e4e6c42c3df033e5bf51e3a Author: Rosen Penev Date: Sun Mar 8 13:14:19 2026 -0700 RDMA/ocrdma: kzalloc_objs to kzalloc_flex Simplify allocation by eliminating one. No longer need to kfree pages separately. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260308201419.5260-1-rosenp@gmail.com Signed-off-by: Leon Romanovsky commit a53a67b1fe94e4a4a3b05edb6bf52e74676e8de2 Author: Richard Acayan Date: Mon Mar 9 20:20:36 2026 -0400 dt-bindings: thermal: lmh: Add SDM670 compatible Document the SDM670 LMh. Signed-off-by: Richard Acayan Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260310002037.1863-3-mailingradian@gmail.com Signed-off-by: Daniel Lezcano commit 015c4506c356e3bf23b31fd68b913a53f32d4924 Author: Richard Acayan Date: Mon Mar 9 20:20:35 2026 -0400 dt-bindings: thermal: tsens: add SDM670 compatible Add the compatible for the thermal sensors on the SDM670. Signed-off-by: Richard Acayan Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260310002037.1863-2-mailingradian@gmail.com Signed-off-by: Daniel Lezcano commit c9c61275fd270c09e1dfe82794f90ad10604fd5d Author: Shiva Tripathi Date: Mon Mar 9 15:46:50 2026 +0530 arm64: dts: ti: k3-am62l-main: Add RNG node Add EIP76 Random Number Generator (RNG) node for AM62L SoC. Unlike other k3 platforms, AM62L RNG is integrated outside crypto subsystem at address 0x3b100000, requiring an additional entry in cbass_main memory map. Mark the RNG node with status "reserved" as it is intended for use by OP-TEE for secure random number generation. If required, this hardware can also be used through Linux kernel by enabling this node. Signed-off-by: Shiva Tripathi Link: https://patch.msgid.link/20260309101650.1652240-1-s-tripathi1@ti.com Signed-off-by: Vignesh Raghavendra commit 41a7b57152ffbf3ab8ab1110f831b1f53c2f9b88 Author: Michael Walle Date: Mon Mar 2 13:24:49 2026 +0100 dt-bindings: arm: ti: Drop Kontron SMARC-sAM67 module I was just informed that this product is discontinued (without being ever released to the market). Pull the plug and let's not waste any more maintainers time and revert commit 22e1d0d8cda7 ("dt-bindings: arm: ti: Add Kontron SMARC-sAM67 module"). Acked-by: Conor Dooley Signed-off-by: Michael Walle Link: https://patch.msgid.link/20260302122540.1377444-5-mwalle@kernel.org Signed-off-by: Vignesh Raghavendra commit 8b0260457b0bced7e782f000c1d4c10668bf7cb2 Author: Michael Walle Date: Mon Mar 2 13:24:48 2026 +0100 dt-bindings: mfd: sl28cpld: Drop sa67mcu compatible I was just informed that this product is discontinued (without being ever released to the market). Pull the plug and let's not waste any more maintainers time and revert commit a598ae45f48d ("dt-bindings: mfd: sl28cpld: Add sa67mcu compatible"). Acked-by: Conor Dooley Signed-off-by: Michael Walle Link: https://patch.msgid.link/20260302122540.1377444-4-mwalle@kernel.org Signed-off-by: Vignesh Raghavendra commit 852d2c0cc231806b9a3e9cd9e965c08342a27d66 Author: Michael Walle Date: Mon Mar 2 13:24:46 2026 +0100 arm64: dts: ti: remove the Kontron SMARC-sAM67 I was just informed that this product is discontinued (without being ever released to the market). Pull the plug and let's not waste any more maintainers time. Signed-off-by: Michael Walle Link: https://patch.msgid.link/20260302122540.1377444-2-mwalle@kernel.org Signed-off-by: Vignesh Raghavendra commit 0625c6af7f91d4739a2508bc9fa5f1a48fd98a8a Author: Anurag Dutta Date: Thu Feb 26 14:47:30 2026 +0530 arm64: dts: ti: k3-j721s2-common-proc-board: Add QSPI flash partition details J721S2 EVM has MT25QU512AB 64 MiB Quad SPI NOR flash connected to OSPI1. Add the partition information as per bootloader. Signed-off-by: Anurag Dutta Reviewed-by: Udit Kumar Link: https://patch.msgid.link/20260226091730.2735587-1-a-dutta@ti.com Signed-off-by: Vignesh Raghavendra commit 6195b626bbb76415409d0eb4f5f9547cc2765ee0 Author: Siddharth Vadapalli Date: Mon Feb 23 16:24:15 2026 +0530 arm64: dts: ti: k3-j721e-common-proc-board: add ti,min-output-impedance The default impedance for the MAC I/O lines from the DP83867 Ethernet PHY is 50 Ohm. Based on the board PCB traces, this impedance is relatively higher than expected, resulting in CRC errors for packets being transmitted and received. Hence, add the "ti,min-output-impedance" device-tree property to set the impedance to its lowest possible value of 35 Ohm as described in the DP83867 Datasheet [0]. [0]: https://www.ti.com/lit/ds/symlink/dp83867e.pdf Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20260223105448.1110428-5-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit bd24b82e1f98994519b48b2f491334a764710caf Author: Siddharth Vadapalli Date: Mon Feb 23 16:24:14 2026 +0530 arm64: dts: ti: k3-j7200-common-proc-board: add ti,min-output-impedance The default impedance for the MAC I/O lines from the DP83867 Ethernet PHY is 50 Ohm. Based on the board PCB traces, this impedance is relatively higher than expected, resulting in CRC errors for packets being transmitted and received. Hence, add the "ti,min-output-impedance" device-tree property to set the impedance to its lowest possible value of 35 Ohm as described in the DP83867 Datasheet [0]. [0]: https://www.ti.com/lit/ds/symlink/dp83867e.pdf Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20260223105448.1110428-4-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit 48c2db8733ea3c03e4081268a6b1031ec5e5a186 Author: Siddharth Vadapalli Date: Mon Feb 23 16:24:13 2026 +0530 arm64: dts: ti: k3-am654-base-board: add ti,min-output-impedance The default impedance for the MAC I/O lines from the DP83867 Ethernet PHY is 50 Ohm. Based on the board PCB traces, this impedance is relatively higher than expected, resulting in CRC errors for packets being transmitted and received. Hence, add the "ti,min-output-impedance" device-tree property to set the impedance to its lowest possible value of 35 Ohm as described in the DP83867 Datasheet [0]. [0]: https://www.ti.com/lit/ds/symlink/dp83867e.pdf Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20260223105448.1110428-3-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit 2870e4deda9cd7e63ab140ad1df7904d4708f851 Author: Siddharth Vadapalli Date: Mon Feb 23 16:24:12 2026 +0530 arm64: dts: ti: k3-am642-{evm,sk}: add ti,min-output-impedance The default impedance for the MAC I/O lines from the DP83867 Ethernet PHY is 50 Ohm. Based on the board PCB traces, this impedance is relatively higher than expected, resulting in CRC errors for packets being transmitted and received. Hence, add the "ti,min-output-impedance" device-tree property to set the impedance to its lowest possible value of 35 Ohm as described in the DP83867 Datasheet [0]. [0]: https://www.ti.com/lit/ds/symlink/dp83867e.pdf Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20260223105448.1110428-2-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit 3865126f0e5b497e2a94eaaba56464ac4ce8faef Author: Kendall Willis Date: Thu Feb 19 13:43:19 2026 -0600 arm64: boot: dts: ti: k3-am62l3-evm: enable wkup_uart0_target node Change the status of the wkup_uart0_target node to enabled. The node sets the UART SYSS register to allow wakeup from WKUP UART in DeepSleep low power mode. Reviewed-by: Dhruva Gole Signed-off-by: Kendall Willis Link: https://patch.msgid.link/20260219-v6-19-wkup-uart-wakeup-v4-4-eda09dce5623@ti.com Signed-off-by: Vignesh Raghavendra commit 54217686642ac0007d4e0c8032c0250dd9b29f91 Author: Kendall Willis Date: Thu Feb 19 13:43:18 2026 -0600 arm64: boot: dts: ti: k3-am62l3-evm: define wkup_uart0 pins Add the pin definition for the wkup_uart0 node. Signed-off-by: Kendall Willis Link: https://patch.msgid.link/20260219-v6-19-wkup-uart-wakeup-v4-3-eda09dce5623@ti.com Signed-off-by: Vignesh Raghavendra commit f177b48ac038ddf131d05099ce6b05eae946db08 Author: Kendall Willis Date: Thu Feb 19 13:43:17 2026 -0600 arm64: boot: dts: ti: k3-am62l-wakeup: create label for wkup_uart0 target-module Add label to the target-module node so that it can easily be referenced. The node specifically configures the SYSCONFIG related registers for WKUP UART. Reviewed-by: Dhruva Gole Signed-off-by: Kendall Willis Link: https://patch.msgid.link/20260219-v6-19-wkup-uart-wakeup-v4-2-eda09dce5623@ti.com Signed-off-by: Vignesh Raghavendra commit e5452968a4b04f93bf9b778ccfd00f79e4d4f529 Author: Kendall Willis Date: Thu Feb 19 13:43:16 2026 -0600 arm64: dts: ti: k3-am62l: include WKUP_UART0 in wakeup peripheral window WKUP_UART0 is apart of the wakeup peripherals and has a range from 0x002B300000 to 0x002B3001FF. Expand the wakeup peripheral window to include WKUP_UART0. Fixes: 5f016758b0ab ("arm64: dts: ti: k3-am62l: add initial infrastructure") Reviewed-by: Dhruva Gole Signed-off-by: Kendall Willis Link: https://patch.msgid.link/20260219-v6-19-wkup-uart-wakeup-v4-1-eda09dce5623@ti.com Signed-off-by: Vignesh Raghavendra commit d170388d5c80d3812811b02fe0ce13a5f90796d0 Author: Kendall Willis Date: Thu Feb 12 14:07:16 2026 -0600 arm64: dts: ti: k3-am62d2-evm: Set wakeup-source system-states The CANUART pins of mcu_mcan0, mcu_mcan1, mcu_uart0 and wkup_uart0 are powered during Partial-IO and I/O Only + DDR and are capable of waking up the system in these states. Specify the states in which these units can do a wakeup on this board. Note that the UARTs are not capable of wakeup in Partial-IO because of of a UART mux on the board not being powered during Partial-IO. Add pincontrol definitions for mcu_mcan0 and mcu_mcan1 for wakeup from Partial-IO. Add these as wakeup pinctrl entries for both devices. Signed-off-by: Kendall Willis Reviewed-by: Dhruva Gole Link: https://patch.msgid.link/20260212-am62d-can-wkup-dts-v1-1-d2de17e1f303@ti.com Signed-off-by: Vignesh Raghavendra commit 2af52683ecd85ae33dcd52eaddef6d592da5492a Author: Wadim Egorov Date: Fri Feb 13 06:38:06 2026 +0100 arm64: dts: ti: k3-am62-phycore-som: Add 128MiB of global CMA Reserve 128MiB of global CMA which is also marked as re-usable so that OS can also use the same if peripheral drivers are not using the same. Based on the use case described in commit c43dd2fe5316 ("arm64: dts: ti: k3-am62x-sk-common: Reserve 128MiB of global CMA"). Signed-off-by: Wadim Egorov Link: https://patch.msgid.link/20260213053806.219495-1-w.egorov@phytec.de Signed-off-by: Vignesh Raghavendra commit 86314111f654310a69c9775e35e263c036031675 Author: Chukun Pan Date: Mon Mar 9 11:00:00 2026 +0800 riscv: dts: spacemit: Add 'linux,pci-domain' to PCIe nodes for K1 The SpacemiT K1 SoC has 3 PCIe EP controller nodes. Add the 'linux,pci-domain' property to assign a PCI domain number to each of the controllers instead of assigning it randomly. This creates a stable sysfs path, allowing userspace scripts to reliably target specific PCIe devices (such as PCIe NICs). Signed-off-by: Chukun Pan Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260309030000.1157040-1-amadeus@jmu.edu.cn Signed-off-by: Yixun Lan commit f79720e25b793691dcc46e1f1cd64d01578075c2 Author: Wander Lairson Costa Date: Mon Mar 9 16:46:19 2026 -0300 rtla: Simplify code by caching string lengths Simplify trace_event_save_hist() and set_comm_cgroup() by computing string lengths once and storing them in local variables, rather than calling strlen() multiple times on the same unchanged strings. This makes the code clearer by eliminating redundant function calls and improving readability. In trace_event_save_hist(), the write loop previously called strlen() on the hist buffer twice per iteration for both the size calculation and loop condition. Store the length in hist_len before entering the loop. In set_comm_cgroup(), strlen() was called on cgroup_path up to three times in succession. Store the result in cg_path_len to use in both the offset calculation and size parameter for subsequent append operations. This simplification makes the code easier to read and maintain without changing program behavior. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-7-wander@redhat.com Signed-off-by: Tomas Glozar commit a29430c2bc86b00e62f74299b866216390c7e418 Author: Wander Lairson Costa Date: Mon Mar 9 16:46:18 2026 -0300 rtla: Replace magic number with MAX_PATH The trace functions use a buffer to manipulate strings that will be written to tracefs files. These buffers are defined with a magic number of 1024, which is a common source of vulnerabilities. Replace the magic number 1024 with the MAX_PATH macro to make the code safer and more readable. While at it, replace other instances of the magic number with ARRAY_SIZE() when the buffer is locally defined. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-6-wander@redhat.com Signed-off-by: Tomas Glozar commit a50c53884db83189947f213d4c7f8385c522d141 Author: Wander Lairson Costa Date: Mon Mar 9 16:46:17 2026 -0300 rtla: Introduce common_threshold_handler() helper Several functions duplicate the logic for handling threshold actions. When a threshold is reached, these functions stop the trace, perform configured actions, and restart the trace if --on-threshold continue is set. Create common_threshold_handler() to centralize this shared logic and avoid code duplication. The function executes the configured threshold actions and restarts the necessary trace instances when appropriate. Also add should_continue_tracing() helper to encapsulate the check for whether tracing should continue after a threshold event, improving code readability at call sites. In timerlat_top_bpf_main_loop(), use common_params directly instead of casting through timerlat_params when only common fields are needed. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-5-wander@redhat.com Signed-off-by: Tomas Glozar commit 989e5b8f0c5302cfb233fa2db49f8877b5f1352d Author: Wander Lairson Costa Date: Mon Mar 9 16:46:16 2026 -0300 rtla/actions: Simplify argument parsing The actions_parse() function uses open-coded logic to extract arguments from a string. This includes manual length checks and strncmp() calls, which can be verbose and error-prone. To simplify and improve the robustness of argument parsing, introduce a new extract_arg() helper macro. This macro extracts the value from a "key=value" pair, making the code more concise and readable. Also, introduce STRING_LENGTH() and strncmp_static() macros to perform compile-time calculations of string lengths and safer string comparisons. Refactor actions_parse() to use these new helpers, resulting in cleaner and more maintainable code. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-4-wander@redhat.com Signed-off-by: Tomas Glozar commit b8f7f49a23897fc772373da513a1cb6d51e5958e Author: Wander Lairson Costa Date: Mon Mar 9 16:46:15 2026 -0300 rtla: Use strdup() to simplify code The actions_add_trace_output() and actions_add_shell() functions were using calloc() followed by strcpy() to allocate and copy a string. This can be simplified by using strdup(), which allocates memory and copies the string in a single step. Replace the calloc() and strcpy() calls with strdup(), making the code more concise and readable. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-3-wander@redhat.com Signed-off-by: Tomas Glozar commit 009a8e681fb003f38dd57a640e11ed826740b5c1 Author: Wander Lairson Costa Date: Mon Mar 9 16:46:14 2026 -0300 rtla: Exit on memory allocation failures during initialization Most memory allocations in rtla happen during early initialization before any resources are acquired that would require cleanup. In these cases, propagating allocation errors just adds complexity without any benefit. There's nothing to clean up, and the program must exit anyway. This patch introduces fatal allocation wrappers (calloc_fatal, reallocarray_fatal, strdup_fatal) that call fatal() on allocation failure. These wrappers simplify the code by eliminating unnecessary error propagation paths. The patch converts early allocations to use these wrappers in actions_init() and related action functions, osnoise_context_alloc() and osnoise_init_tool(), trace_instance_init() and trace event functions, and parameter structure allocations in main functions. This simplifies the code while maintaining the same behavior: immediate exit on allocation failure during initialization. Allocations that require cleanup, such as those in histogram allocation functions with goto cleanup paths, are left unchanged and continue to return errors. Signed-off-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260309195040.1019085-2-wander@redhat.com Signed-off-by: Tomas Glozar commit 1b63f91d1c9013629fb2005ace48b7aeead32330 Merge: 969ebebc30fff0 6bbb4d96f797d4 Author: Christian Brauner Date: Mon Mar 9 15:28:27 2026 +0100 Merge patch series "support file system generated / verified integrity information v4" Christoph Hellwig says: This series adds support to generate and verify integrity information (aka T10 PI) in the file system, instead of the automatic below the covers support that is currently used. There two reasons for this: a) to increase the protection enveloped. Right now this is just a minor step from the bottom of the block layer to the file system, but it is required to support io_uring integrity data passthrough in the file system similar to the currently existing support for block devices, which will follow next. It also allows the file system to directly see the integrity error and act upon in, e.g. when using RAID either integrated (as in btrfs) or by supporting reading redundant copies through the block layer. b) to make the PI processing more efficient. This is primarily a concern for reads, where the block layer auto PI has to schedule a work item for each bio, and the file system them has to do it again for bounce buffering. Additionally the current iomap post-I/O workqueue handling is a lot more efficient by supporting merging and avoiding workqueue scheduling storms. The implementation is based on refactoring the existing block layer PI code to be reusable for this use case, and then adding relatively small wrappers for the file system use case. These are then used in iomap to implement the semantics, and wired up in XFS with a small amount of glue code. Compared to the baseline (iomap-bounce branch), this does not change performance for writes, but increases read performance up to 15% for 4k I/O, with the benefit decreasing with larger I/O sizes as even the baseline maxes out the device quickly on my older enterprise SSD. Anuj Gupta also measured a large decrease in QD1 latency on an Intel Optane device for small I/O sizes, but also an increase for very large ones. Note that the upcoming XFS fsverity support also depends on some infrastructure in this series. * patches from https://patch.msgid.link/20260223132021.292832-1-hch@lst.de: xfs: support T10 protection information iomap: support T10 protection information iomap: support ioends for buffered reads iomap: add a bioset pointer to iomap_read_folio_ops ntfs3: remove copy and pasted iomap code iomap: allow file systems to hook into buffered read bio submission iomap: only call into ->submit_read when there is a read_ctx iomap: pass the iomap_iter to ->submit_read iomap: refactor iomap_bio_read_folio_range Link: https://patch.msgid.link/20260223132021.292832-1-hch@lst.de Signed-off-by: Christian Brauner commit 6bbb4d96f797d42d4baef1691a27a62275727146 Author: Christoph Hellwig Date: Mon Feb 23 05:20:16 2026 -0800 xfs: support T10 protection information Add support for generating / verifying protection information in the file system. This is largely done by simply setting the IOMAP_F_INTEGRITY flag and letting iomap do all of the work. XFS just has to ensure that the data read completions for integrity data are run from user context. For zoned writeback, XFS also has to generate the integrity data itself as the zoned writeback path is not using the generic writeback_submit implementation. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260223132021.292832-17-hch@lst.de Tested-by: Anuj Gupta Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner commit 0b10a370529cbd7b918c1eef43d409e43d9e0b78 Author: Christoph Hellwig Date: Mon Feb 23 05:20:15 2026 -0800 iomap: support T10 protection information Add support for generating / verifying protection information in iomap. This is done by hooking into the bio submission and then using the generic PI helpers. Compared to just using the block layer auto PI this extends the protection envelope and also prepares for eventually passing through PI from userspace at least for direct I/O. To generate or verify PI, the file system needs to set the IOMAP_F_INTEGRITY flag on the iomap for the request, and ensure the ioends are used for all integrity I/O. Additionally the file system must defer read I/O completions to user context so that the guard tag validation isn't run from interrupt context. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260223132021.292832-16-hch@lst.de Tested-by: Anuj Gupta Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner commit e8f9cf03c9dc94b475ae8f172ecd700806846a6d Author: Christoph Hellwig Date: Mon Feb 23 05:20:14 2026 -0800 iomap: support ioends for buffered reads Support using the ioend structure to defer I/O completion for buffered reads by calling into the buffered read I/O completion handler from iomap_finish_ioend. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260223132021.292832-15-hch@lst.de Tested-by: Anuj Gupta Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner commit 57287771fa8d77841149bf847b629f29acbad35b Author: Christoph Hellwig Date: Mon Feb 23 05:20:13 2026 -0800 iomap: add a bioset pointer to iomap_read_folio_ops Optionally allocate the bio from the bioset provided in iomap_read_folio_ops. If no bioset is provided, fs_bio_set is still used, which is the standard bioset for file systems. Based on a patch from Goldwyn Rodrigues . Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260223132021.292832-14-hch@lst.de Tested-by: Anuj Gupta Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner commit 6810365c0d1b31e53777d993e61d7fdd3f5f4af5 Author: Christoph Hellwig Date: Mon Feb 23 05:20:12 2026 -0800 ntfs3: remove copy and pasted iomap code ntfs3 copied the iomap code without attribution or talking to the maintainers, to hook into the bio completion for (unexplained) zeroing. Fix this by just overriding the bio completion handler in the submit handler. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260223132021.292832-13-hch@lst.de Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner commit 5f4fe046cb3c84eed719f7becbe822000e1a589e Author: Christoph Hellwig Date: Mon Feb 23 05:20:11 2026 -0800 iomap: allow file systems to hook into buffered read bio submission File systems such as btrfs have additional operations with bios such as verifying data checksums. Allow file systems to hook into submission of the bio to allow for this processing by replacing the direct submit_bio call in iomap_read_alloc_bio with a call into ->submit_read and exporting iomap_read_alloc_bio. Also add a new field to struct iomap_read_folio_ctx to track the file logic offset of the current read context. Based on a patch from Goldwyn Rodrigues . Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260223132021.292832-12-hch@lst.de Tested-by: Anuj Gupta Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner commit 19fb5f9780753bf99065f13e29cf5761eb5380db Author: Christoph Hellwig Date: Mon Feb 23 05:20:10 2026 -0800 iomap: only call into ->submit_read when there is a read_ctx Move the NULL check into the callers to simplify the callees. Fuse was missing this before, but has a constant read_ctx that is never NULL or changed, so no change here either. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260223132021.292832-11-hch@lst.de Tested-by: Anuj Gupta Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner commit 4d25c7d68896b4002c4ab5cd646775392bb7fbb4 Author: Christoph Hellwig Date: Mon Feb 23 05:20:09 2026 -0800 iomap: pass the iomap_iter to ->submit_read This provides additional context for file systems. Rename the fuse instance to match the method name while we're at it. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260223132021.292832-10-hch@lst.de Tested-by: Anuj Gupta Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner commit 2580a0095fdc6c1cc632802c5f8ac226e7738d88 Author: Christoph Hellwig Date: Mon Feb 23 05:20:08 2026 -0800 iomap: refactor iomap_bio_read_folio_range Split out the logic to allocate a new bio and only keep the fast path that adds more data to an existing bio in iomap_bio_read_folio_range. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260223132021.292832-9-hch@lst.de Tested-by: Anuj Gupta Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner commit 9f6cfc93dde974bff44db11224bf45e68ac1752b Author: Tzuyi Chang Date: Fri Mar 6 15:52:36 2026 +0800 pinctrl: realtek: Support system suspend and resume Add system suspend and resume capabilities to the common Realtek pinctrl library. This enables saving and restoring pin configurations during the noirq phase for SoCs that define register ranges. Signed-off-by: Tzuyi Chang Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit aeeac6d3a1f51c8b0ac44ab262c568e905211879 Author: Yu-Chun Lin Date: Fri Mar 6 15:52:35 2026 +0800 pinctrl: realtek: Fix grammar in error messages Correct the grammar in dev_err() messages. Change "Not support ..." to " unsupported..." to improve readability and comply with standard English usage. Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit 5e783510b5c09bc8a9d83a34488ed924769085f2 Author: Yu-Chun Lin Date: Fri Mar 6 15:52:34 2026 +0800 pinctrl: realtek: Simplify error handling with dev_err_probe() Convert the error handling code in probe() to use dev_err_probe() to enhance semantic meaning. Reviewed-by: Bartosz Golaszewski Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit b7f698b22b8be5e25839d2dcfc6a6889c9ef196b Author: Yu-Chun Lin Date: Fri Mar 6 15:52:33 2026 +0800 pinctrl: realtek: Switch to use devm functions Simplify the probe() function by switching to devm-managed versions of ioremap and pinctrl registration. Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit 6a6b238c66dc69cd784baf03b170c50f7e5f24d9 Author: Tzuyi Chang Date: Fri Mar 6 15:52:32 2026 +0800 pinctrl: realtek: Fix return value and silence log for unsupported configs Treating unsupported configurations as errors causes upper layers (like the GPIO subsystem) to interpret optional features as hard failures, aborting operations or printing unnecessary error logs. For example, during gpiod_get(), the GPIO framework attempts to set PIN_CONFIG_PERSIST_STATE. Since this driver does not support it, false error reports are generated in dmesg. Fix this by returning -ENOTSUPP and demoting the log level to dev_dbg. Reviewed-by: Bartosz Golaszewski Signed-off-by: Tzuyi Chang Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit a248904e3030926ddba1d7cd32db742a368242bc Author: Yu-Chun Lin Date: Fri Mar 6 15:52:31 2026 +0800 pinctrl: realtek: Cleanup license string Prefer "GPL" over "GPL v2" - see commit bf7fbeeae6db ("module: Cure the MODULE_LICENSE "GPL" vs. "GPL v2" bogosity") Reviewed-by: Bartosz Golaszewski Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit e70ffd8fb18d1831320b344406f387b4f37e827e Author: Otto Pflüger Date: Sun Feb 22 14:16:46 2026 +0100 dt-bindings: leds: sc2731: Add compatible for SC2730 The LED controller found in the SC2730 PMIC is compatible with the one found in the SC2731 PMIC. Signed-off-by: Otto Pflüger Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260222-sc27xx-mfd-cells-v1-2-69526fe74c77@abscue.de Signed-off-by: Lee Jones commit 15c9c907bf4c6025aa78404dbf072cf634d6756d Author: Andrew Davis Date: Thu Mar 5 14:37:06 2026 -0600 leds: lp8860: Do not always program EEPROM on probe The EEPROM has limited writes and the contents might have factory set values that should not be changed. The values currently written by this driver are just one example of values, but might not be correct for many use-cases. Do not overwrite the EEPROM with these example values every probe. At some point it would be better to populate the content of the EEPROM based on a configuration provided by the user and check that the values in EEPROM are not already the same to avoid unneeded write cycles. That configuration would depend on how the device is used on the board to which it is attached, for that Device Tree might be the right way. Until a method can be devised, gate the EEPROM writing behind a module param. Reported-by: David Owens Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260305203706.841384-5-afd@ti.com Signed-off-by: Lee Jones commit ca4b5ff8ab68663afb1316d41f9a2deb9f1dca2e Author: Andrew Davis Date: Thu Mar 5 14:37:05 2026 -0600 leds: lp8860: Remove unused read of STATUS register This register is read but the contents are never checked, remove the read until we add status checking. While here add an error message should the preceding fault check fail. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260305203706.841384-4-afd@ti.com Signed-off-by: Lee Jones commit 67a4a344f74cc8d3de9e0bc672143fbd1bcd1b6b Author: Andrew Davis Date: Thu Mar 5 14:37:04 2026 -0600 leds: lp8860: Hold lock for all of EEPROM programming The lock is taken while unlocking the EEPROM but then released, it should instead be held for the whole EEPROM programming process. To do this merge in the lp8860_unlock_eeprom() function to the only call site in the lp8860_init() function. This way we hold the lock for all steps. While here, rename this function to lp8860_program_eeprom() to better represent what it really does. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260305203706.841384-3-afd@ti.com Signed-off-by: Lee Jones commit 665e064221498b08387f1fb5e12cee4d6e7f8d8a Author: Andrew Davis Date: Thu Mar 5 14:37:03 2026 -0600 leds: lp8860: Return directly from lp8860_init No need to use goto to jump to a label that also just returns, return directly in the if statements. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260305203706.841384-2-afd@ti.com Signed-off-by: Lee Jones commit 24f2baec82279d86a52e7d5d330c9afd65899b30 Author: Randy Dunlap Date: Thu Mar 5 22:34:11 2026 -0800 pinctrl: s32: correct kernel-doc bad line warning Insert a "*" in the kernel-doc line to resolve a warning: Warning: drivers/pinctrl/nxp/pinctrl-s32.h:18 bad line: this group. Signed-off-by: Randy Dunlap Acked-by: Dong Aisheng Signed-off-by: Linus Walleij commit 4df6b6b3fbbc4056880efa4fe0a4686af91297ff Author: Andrew Davis Date: Thu Mar 5 14:37:02 2026 -0600 leds: lp8860: Use a single regmap table Instead of a regmap table each for the normal registers and the EEPROM registers, make one table and use an access table to prevent read/write to/from the registers between the two ranges. Slightly simplifies the code. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260305203706.841384-1-afd@ti.com Signed-off-by: Lee Jones commit 7186d0330c3f3e86de577687a82f4ebd96dcb5ac Author: Chen Ni Date: Thu Feb 26 11:30:48 2026 +0800 leds: lgm-sso: Remove duplicate assignments for priv->mmap Remove duplicate assignment of priv->mmap in intel_sso_led_probe(). Fixes: fba8a6f2263b ("leds: lgm-sso: Fix clock handling") Signed-off-by: Chen Ni Link: https://patch.msgid.link/20260226033048.3715915-1-nichen@iscas.ac.cn Signed-off-by: Lee Jones commit d45963a93c1495e9f1338fde91d0ebba8fd22474 Author: Greg Kroah-Hartman Date: Thu Feb 19 15:34:35 2026 +0100 leds: qcom-lpg: Check for array overflow when selecting the high resolution When selecting the high resolution values from the array, FIELD_GET() is used to pull from a 3 bit register, yet the array being indexed has only 5 values in it. Odds are the hardware is sane, but just to be safe, properly check before just overflowing and reading random data and then setting up chip values based on that. Cc: stable Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026021934-nearby-playroom-036b@gregkh Signed-off-by: Lee Jones commit 437536cae0e1b6109a5aed5172c06b4ed76a2aaf Author: Krzysztof Kozlowski Date: Mon Feb 16 12:04:42 2026 +0100 leds: ktd2692: Make ktd2692_timing variable static File-scope 'ktd2692_timing' is not used outside of this unit, so make it static to silence sparse warning: leds-ktd2692.c:62:33: warning: symbol 'ktd2692_timing' was not declared. Should it be static? Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260216110441.160155-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Lee Jones commit 0600cf91c0c3b749f2f6ef4c43f62c8c09d1eb82 Author: Neel Bullywon Date: Sat Feb 7 13:18:25 2026 -0500 leds: lp5569: Use sysfs_emit instead of sprintf() Replace sprintf() with sysfs_emit(), which is the modern standard for formatting sysfs output. This change aligng with the kernel's best practices and ensures usage of the most up to date API. Signed-off-by: Neel Bullywon Link: https://patch.msgid.link/20260207181825.13481-1-neelb2403@gmail.com Signed-off-by: Lee Jones commit b5227947e68e7515ba449b870338909ed32ac8d2 Author: Michael Tretter Date: Fri Feb 6 15:21:23 2026 +0100 leds: multicolor: Change intensity_value to unsigned int Using min to compare the intensity_value with led_dev->max_brightness causes a signedness error: drivers/leds/led-class-multicolor.c: In function 'multi_intensity_store': ././include/linux/compiler_types.h:630:45: error: call to '__compiletime_assert_195' declared with attribute error: min(intensity_value[i], led_cdev->max_brightness) signedness error Change the type of intensity_value to unsigned int to fix the signedness error. intensity_value is used to set mcled_cdev->subled_info[i].intensity, which is unsigned int, too. Fixes: 129f82752bce ("leds: multicolor: Limit intensity to max_brightness of LED") Signed-off-by: Michael Tretter Link: https://patch.msgid.link/20260206-leds-multicolor-fix-signedness-error-v1-1-48a00ed33c07@pengutronix.de Signed-off-by: Lee Jones commit e002d162654b74fad60a0f85e8fdb1a6c8a903f5 Author: Andy Shevchenko Date: Thu Mar 5 10:50:14 2026 +0100 pinctrl: pinconf-generic: Use only fwnode API in parse_dt_cfg() The parse_dt_cfg() uses OF and fwnode APIs. Fix this inconsistency by fully switching it to use fwnode API and rename the function accordingly. While at it, add missing linux/property.h inclusion. Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 35b9b024db9d762952c45bf3bb7007c5aaaddcb6 Author: Geert Uytterhoeven Date: Thu Mar 5 10:05:12 2026 +0100 pinctrl: imx: PINCTRL_IMX_SCMI should depend on ARCH_MXC i.MX95 SCMI firmware is only present on NXP i.MX94 and i.MX95 SoCs. Hence add a dependency on ARCH_MXC, to prevent asking the user about this driver when configuring a kernel without NXP i.MX SoC family support. While at it, relax the dependencies on ARM_SCMI_PROTOCOL and OF when compile-testing. Signed-off-by: Geert Uytterhoeven Reviewed-by: Peng Fan Signed-off-by: Linus Walleij commit e785c990adccabb9cc3286166b2377fae05c2533 Author: Bartosz Golaszewski Date: Wed Mar 4 10:02:28 2026 +0100 pinctrl: Kconfig: drop unneeded dependencies on OF_GPIO OF_GPIO is selected automatically on all OF systems. Any symbols it controls also provide stubs so there's really no reason to select it explicitly. Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 8f0aecf2957e7dba78603544368846133bf6d22e Author: Rustam Adilov Date: Thu Mar 5 21:11:06 2026 +0500 gpio: realtek-otto: add rtl9607 support The RTL9607C SoC has support for 3 GPIO banks with 32 GPIOs each and the port order is reversed just like in RTL930x. Signed-off-by: Rustam Adilov Reviewed-by: Sander Vanheule Link: https://patch.msgid.link/20260305161106.15999-3-adilov@disroot.org Signed-off-by: Bartosz Golaszewski commit 49944d6ab7eb951f2aefee69341c623e13434863 Author: Rustam Adilov Date: Thu Mar 5 21:11:05 2026 +0500 dt-bindings: gpio: realtek-otto: add rtl9607 compatible Add the "realtek,rtl9607-gpio" compatible for GPIO nodes on the RTL9607C SoC series. Signed-off-by: Rustam Adilov Reviewed-by: Linus Walleij Reviewed-by: Sander Vanheule Link: https://patch.msgid.link/20260305161106.15999-2-adilov@disroot.org Signed-off-by: Bartosz Golaszewski commit 2737dcb3c467824cd55921fba3fbd1375fc01695 Author: Philipp Zabel Date: Tue Mar 10 10:00:05 2026 +0100 reset: core: Fix indentation Correct an accidental whitespace change. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603100730.J3pi4xqi-lkp@intel.com/ Fixes: 9035073d0ef1 ("reset: convert reset core to using firmware nodes") Signed-off-by: Philipp Zabel commit ea3566a3fa235cd0325b2bedf91ceec65073004b Author: Woody Suwalski Date: Tue Mar 10 17:50:57 2026 +0900 ntfs: add missing newlines to pr_err() messages There is an inconsistent use of pr_err() statements in the current code. Many error messages are missing the \n termination, what results in the messages being printed with a delay, only after a next printk() line is printed. It prevents relying on printk() to monitor the driver errors. This patch is modifying only text messages, no functional change. Signed-off-by: Woody Suwalski Signed-off-by: Namjae Jeon commit d7bf74c94f11dedde59a16d9c94e6c1aec32e1f5 Author: Hyunchul Lee Date: Tue Mar 10 08:48:29 2026 +0900 ntfs: fix pointer/integer casting warnings Use uintptr_t for both conversion paths to fix the warnings. Reported-by: kernel test robot Reported-by: Randy Dunlap Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 82c68c62bd8d64785c42292449688fed4d2c284c Author: Samuel Holland Date: Thu Mar 5 13:05:40 2026 +0100 arm64: dts: rockchip: Enable GPU on rk3566-pinenote The GPU is most useful when used together with the EBC on the PineNote, which is not yet described. But there's no reason not to define the GPU already as the hardware is present and could be used without the EBC. Signed-off-by: Samuel Holland Signed-off-by: Diederik de Haas Link: https://patch.msgid.link/20260305120620.173600-1-diederik@cknow-tech.com Signed-off-by: Heiko Stuebner commit 969ebebc30fff0b9756130e3b4f6f3036e7c53ab Merge: 1f318b96cc84d7 a9aa6045abde87 Author: Christian Brauner Date: Tue Mar 10 09:37:48 2026 +0100 Merge branch 'for-7.1/block-integrity' Bring in the shared branch with the block layer. * 'for-7.1/block-integrity' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block: pass a maxlen argument to bio_iov_iter_bounce block: add fs_bio_integrity helpers block: make max_integrity_io_size public block: prepare generation / verification helpers for fs usage block: add a bdev_has_integrity_csum helper block: factor out a bio_integrity_setup_default helper block: factor out a bio_integrity_action helper Signed-off-by: Christian Brauner commit edf04f1af05d714c7aba0cf008ded1245365fcd7 Author: wangdicheng Date: Tue Mar 10 10:36:49 2026 +0800 ALSA: hda/senary: Fix beep error handling and optimize EAPD switching This patch addresses a potential state inconsistency bug and optimizes runtime performance: 1. Fix error handling in set_beep_amp(): Previously, beep_nid was assigned before adding kcontrols. If kcontrol creation failed, the function returned error but left beep_nid set, causing inconsistent driver state. Moved the assignment to the end of the function. 2. Optimize senary_auto_turn_eapd(): Removed the redundant snd_hda_query_pin_caps() check inside the loop. The target pins are sourced from spec->eapds, which is strictly filtered during the initial parse phase. Checking capabilities again during every mute/unmute hook is unnecessary overhead. Signed-off-by: wangdicheng Link: https://patch.msgid.link/20260310023649.155858-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit 41b1a6760959017c4fa1dbc7c3cc318406ab1455 Author: Shawn Lin Date: Fri Mar 6 20:20:41 2026 +0800 clk: rockchip: rk3568: Add PCIe pipe clock gates The PCIe pipe clocks are currently left as orphan clocks and remain enabled indefinitely, which is suboptimal. Add the missing clock gates so the PCIe driver can explicitly manage them when not in use. In order not to break compatibility with old DTB, mark them as CLK_IGNORE_UNUSED. Signed-off-by: Shawn Lin Link: https://patch.msgid.link/1772799641-32164-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Heiko Stuebner commit 0499a3826c2f8c768cc5948154ab317052947697 Author: Eliot Courtney Date: Fri Mar 6 16:22:06 2026 +0900 gpu: nova-core: gsp: add tests for continuation records Add tests for continuation record splitting. They cover boundary conditions at the split points to make sure the right number of continuation records are made. They also check that the data concatenated is correct. Tested-by: Zhi Wang Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260306-cmdq-continuation-v6-9-cc7b629200ee@nvidia.com Signed-off-by: Alexandre Courbot commit e8f4f9ae86a4636c16cf90208c5794e92090bd6b Author: Eliot Courtney Date: Fri Mar 6 16:22:05 2026 +0900 gpu: nova-core: gsp: support large RPCs via continuation record Splits large RPCs if necessary and sends the remaining parts using continuation records. RPCs that do not need continuation records continue to write directly into the command buffer. Ones that do write into a staging buffer first, so there is one copy. Continuation record for receive is not necessary to support at the moment because those replies do not need to be read and are currently drained by retrying `receive_msg` on `ERANGE`. Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260306-cmdq-continuation-v6-8-cc7b629200ee@nvidia.com Signed-off-by: Alexandre Courbot commit adcb40c5fcf085b16327ab1eef11ec157c9f603b Author: Eliot Courtney Date: Fri Mar 6 16:22:04 2026 +0900 gpu: nova-core: gsp: add `size` helper to `CommandToGsp` Add a default method to `CommandToGsp` which computes the size of a command. Tested-by: Zhi Wang Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260306-cmdq-continuation-v6-7-cc7b629200ee@nvidia.com Signed-off-by: Alexandre Courbot commit dcf1fdafe04095947f08db5a45d1994aa1d948fa Author: Eliot Courtney Date: Fri Mar 6 16:22:03 2026 +0900 gpu: nova-core: gsp: unconditionally call variable payload handling Unconditionally call the variable length payload code, which is a no-op if there is no such payload but could defensively catch some coding errors by e.g. checking that the allocated size is completely filled. Tested-by: Zhi Wang Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260306-cmdq-continuation-v6-6-cc7b629200ee@nvidia.com Signed-off-by: Alexandre Courbot commit 1a0d4bc62b5d36a8ae4dca4413c2703b5fdd93f4 Author: Eliot Courtney Date: Fri Mar 6 16:22:02 2026 +0900 gpu: nova-core: gsp: clarify invariant on command queue Clarify why using only the first returned slice from allocate_command for the message headers is okay. Tested-by: Zhi Wang Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260306-cmdq-continuation-v6-5-cc7b629200ee@nvidia.com Signed-off-by: Alexandre Courbot commit 41584c71342e6046fc5af0bd7823e6c0c53ffb0c Author: Eliot Courtney Date: Fri Mar 6 16:22:01 2026 +0900 gpu: nova-core: gsp: add checking oversized commands The limit is 16 pages for a single command sent to the GSP. Return an error if `allocate_command` is called with a too large size. Tested-by: Zhi Wang Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260306-cmdq-continuation-v6-4-cc7b629200ee@nvidia.com Signed-off-by: Alexandre Courbot commit 59f237a0d17fb95f60de15386a6ab968af4bd4d4 Author: Eliot Courtney Date: Fri Mar 6 16:22:00 2026 +0900 rust: add EMSGSIZE error code Add the EMSGSIZE error code, which indicates that a message is too long. Tested-by: Zhi Wang Acked-by: Miguel Ojeda Reviewed-by: Gary Guo Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260306-cmdq-continuation-v6-3-cc7b629200ee@nvidia.com Signed-off-by: Alexandre Courbot commit b4281ffb80d341c2c7cf0343784ec77dbd7f9189 Author: Eliot Courtney Date: Fri Mar 6 16:21:59 2026 +0900 gpu: nova-core: gsp: add mechanism to wait for space on command queue Add a timeout to `allocate_command` which waits for space on the GSP command queue. It uses a similar timeout to nouveau. This lets `send_command` wait for space to free up in the command queue. This is required to support continuation records which can fill up the queue. Tested-by: Zhi Wang Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260306-cmdq-continuation-v6-2-cc7b629200ee@nvidia.com Signed-off-by: Alexandre Courbot commit 9a3e455927f3d7f06f445897626360220cf6a27b Author: Eliot Courtney Date: Fri Mar 6 16:21:58 2026 +0900 gpu: nova-core: gsp: sort `MsgFunction` variants alphabetically There is no particular order required here and keeping them alphabetical will help preventing future mistakes. Tested-by: Zhi Wang Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260306-cmdq-continuation-v6-1-cc7b629200ee@nvidia.com Signed-off-by: Alexandre Courbot commit db5e64651a1b3ddf33a25ccfc1d28da1c427780b Author: Viresh Kumar Date: Tue Mar 10 11:43:27 2026 +0530 cpufreq: Add MAINTAINERS entry for CPPC driver Add a MAINTAINERS entry for the CPPC driver, with a list of reviewers from multiple organizations. Also sort the list alphabetically while doing so. Signed-off-by: Viresh Kumar commit 23c8ebc952849b3ba47d04d0ec95daf5cc136061 Author: Anirudh Srinivasan Date: Fri Mar 6 11:12:19 2026 -0600 clk: tenstorrent: Add Atlantis clock controller driver Add driver for clock controller in Tenstorrent Atlantis SoC. This version of the driver covers clocks from RCPU subsystem. 5 types of clocks generated by this controller: PLLs (PLLs with bypass functionality and an additional Gate clk at output), Shared Gates (Multiple Gate clks that share an enable bit), standard Muxes, Dividers and Gates. All clocks are implemented using custom clk ops and use the regmap interface associated with the syscon. All clocks are derived from a 24 Mhz oscillator. The reset controller is also setup as an auxiliary device of the clock controller. Signed-off-by: Anirudh Srinivasan Reviewed-by: Brian Masney Reviewed-by: Drew Fustini Signed-off-by: Drew Fustini commit 89b23af16276a6d4d06064d72e3fd548de090375 Author: Anirudh Srinivasan Date: Fri Mar 6 11:12:18 2026 -0600 reset: tenstorrent: Add reset controller for Atlantis Adds Atlantis Reset Controller driver, which shares the same regmap as prcm ( clock controller). This version of the reset controller driver covers resets from the RCPU prcm. Reviewed-by: Philipp Zabel Acked-by: Philipp Zabel Signed-off-by: Anirudh Srinivasan Reviewed-by: Drew Fustini Signed-off-by: Drew Fustini commit 1227a8f6c34e297b5fada96aa140129eced771dc Author: Anirudh Srinivasan Date: Fri Mar 6 11:12:17 2026 -0600 dt-bindings: clk: tenstorrent: Add tenstorrent,atlantis-prcm-rcpu Document bindings for Tenstorrent Atlantis PRCM that manages clocks and resets. This block is instantiated multiple times in the SoC. This commit documents the clocks from the RCPU PRCM block. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Anirudh Srinivasan Reviewed-by: Drew Fustini Signed-off-by: Drew Fustini commit 52ede1bce557c66309f41ac29dd190be23ca9129 Merge: c127d4087930cc 687e7863f02742 Author: Jakub Kicinski Date: Mon Mar 9 19:45:31 2026 -0700 Merge branch 'net-stmmac-further-ptp-cleanups' Russell King says: ==================== net: stmmac: further ptp cleanups The first uses a local variable when setting n_ext_ts which is a minor simplification of the code. The second removes the now unnecessary "available" flag for the PPS outputs. ==================== Link: https://patch.msgid.link/aawDiK7DjcSXSs1X@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 687e7863f027426175791f8a23a59b7c4c816fe9 Author: Russell King (Oracle) Date: Sat Mar 7 10:53:20 2026 +0000 net: stmmac: ptp: remove redundant priv->pps[].available priv->pps[].available is set in stmmac_ptp_register() for all PPS outputs reported by hardware up to STMMAC_PPS_MAX. Since we now set priv->ptp_clock_ops.n_per_out to the number of PPS outputs that both the hardware and driver can support to prevent array overflow in stmmac_enable(), this makes priv->pps[].available redundant. Remove this struct member. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vypHc-0000000CSbl-1X6v@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b560d4434f98b5a8f7d04e5ec1a515a21aa8d914 Author: Russell King (Oracle) Date: Sat Mar 7 10:53:15 2026 +0000 net: stmmac: ptp: rearrange n_ext_ts initialisation Use local variables for n_ext_ts rather than referencing the DMA capability several times. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vypHX-0000000CSbc-123K@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c127d4087930cc4706b99c9431e35ba00776a634 Author: Russell King (Oracle) Date: Sat Mar 7 10:55:08 2026 +0000 net: stmmac: remove stmmac_dwmac4_get_mac_addr() stmmac_dwmac4_get_mac_addr() is identical to stmmac_get_mac_addr(). Remove stmmac_dwmac4_get_mac_addr() to avoid this code duplication. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vypJM-0000000CSiJ-48yO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 56acc7f51974c824142dd0a529b1ce05ec5fa75a Author: Victor Nogueira Date: Sat Mar 7 19:07:24 2026 -0300 selftests/tc-testing: Adapt test's output to HFSC's iproute2 printing changes To make the printing of HFSC's defcls consistent with HTB's, iproute2 is now printing defcls prepended with "0x". This commit adapts test a4c3 to this change. Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20260307220724.2501212-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit d6d4ff335db2d9242937ca474d292010acd35c38 Author: Eric Dumazet Date: Sun Mar 8 12:35:49 2026 +0000 tcp: inline tcp_chrono_start() tcp_chrono_start() is small enough, and used in TCP sendmsg() fast path (from tcp_skb_entail()). Note clang is already inlining it from functions in tcp_output.c. Inlining it improves performance and reduces bloat : $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/2 grow/shrink: 1/0 up/down: 1/-84 (-83) Function old new delta tcp_skb_entail 280 281 +1 __pfx_tcp_chrono_start 16 - -16 tcp_chrono_start 68 - -68 Total: Before=25192434, After=25192351, chg -0.00% Note that tcp_chrono_stop() is too big. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20260308123549.2924460-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4b78c9cbd8f1fbb9517aee48b372646f4cf05442 Author: Eric Dumazet Date: Sun Mar 8 12:23:02 2026 +0000 tcp: move tp->chrono_type next tp->chrono_stat[] chrono_type is currently in tcp_sock_read_txrx group, which is supposed to hold read-mostly fields. But chrono_type is mostly written in tx path, it should be moved to tcp_sock_write_tx group, close to other chrono fields (chrono_stat[], chrono_start). Note this adds holes, but data locality is far more important. Use a full u8 for the time being, compiler can generate more efficient code. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20260308122302.2895067-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit f2db7b80b03f268ff65fe825a7c761a8f551aa48 Author: Eric Dumazet Date: Sat Mar 7 13:36:01 2026 +0000 net/sched: refine indirect call mitigation in tc_wrapper.h Some modern cpus disable X86_FEATURE_RETPOLINE feature, even if a direct call can still be beneficial. Even when IBRS is present, an indirect call is more expensive than a direct one: Direct Calls: Compilers can perform powerful optimizations like inlining, where the function body is directly inserted at the call site, eliminating call overhead entirely. Indirect Calls: Inlining is much harder, if not impossible, because the compiler doesn't know the target function at compile time. Techniques like Indirect Call Promotion can help by using profile-guided optimization to turn frequently taken indirect calls into conditional direct calls, but they still add complexity and potential overhead compared to a truly direct call. In this patch, I split tc_skip_wrapper in two different static keys, one for tc_act() (tc_skip_wrapper_act) and one for tc_classify() (tc_skip_wrapper_cls). Then I enable the tc_skip_wrapper_cls only if the count of builtin classifiers is above one. I enable tc_skip_wrapper_act only it the count of builtin actions is above one. In our production kernels, we only have CONFIG_NET_CLS_BPF=y and CONFIG_NET_ACT_BPF=y. Other are modules or are not compiled. Tested on AMD Turin cpus, cls_bpf_classify() cost went from 1% down to 0.18 %, and FDO will be able to inline it in tcf_classify() for further gains. Signed-off-by: Eric Dumazet Acked-by: Jamal Hadi Salim Reviewed-by: Pedro Tammela Reviewed-by: Victor Nogueira Link: https://patch.msgid.link/20260307133601.3863071-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit e8eb33d650cd5e60b008f9d958262e489de6e7a9 Author: Eric Dumazet Date: Sat Mar 7 09:22:14 2026 +0000 tcp: move sysctl_tcp_shrink_window to netns_ipv4_read_txrx group Commit 18fd64d25422 ("netns-ipv4: reorganize netns_ipv4 fast path variables") missed that __tcp_select_window() is reading net->ipv4.sysctl_tcp_shrink_window. Move this field to netns_ipv4_read_txrx group, as __tcp_select_window() is used both in tx and rx paths. Saves a potential cache line miss. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260307092214.2433548-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit bf3471e6e6c02137dc0d26caa783ac1849f9aab8 Author: Lorenzo Bianconi Date: Fri Mar 6 09:07:27 2026 +0100 net: airoha: Make flow control source port mapping dependent on nbq parameter Flow control source port mapping for USB serdes needs to be configured according to the GDM port nbq parameter. This is a preliminary patch since nbq parameter is specific for the given port serdes and needs to be read from the DTS (in the current codebase is assigned statically). Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260306-airoha-fix-loopback-for-usb-serdes-v2-1-319de9c96826@kernel.org Signed-off-by: Jakub Kicinski commit 014c607f86abc903d7bf46e13373d89392e371fe Author: Ankit Garg Date: Fri Mar 6 22:48:16 2026 +0000 gve: add support for UDP GSO for DQO format Enable support for UDP GSO when using DQO format. Advertise the feature flag during device initialization and enable offload by default. Signed-off-by: Ankit Garg Reviewed-by: Willem de Bruijn Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20260306224816.3391551-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit dc9c9193c7c19a0163552da3a73a1706b7faea12 Author: Alok Tiwari Date: Fri Mar 6 10:08:19 2026 -0800 selftests: fib_tests: fix link-local retrieval in fib6_nexthop() fib6_nexthop() retrieves the link-local address for two interfaces used in the test. However, both lldummy and llv1 are obtained from dummy0. llv1 is expected to be retrieved from veth1, which is the interface used later in the test. The subsequent check and error message also expect the address to be retrieved from veth1. Fix this by retrieving llv1 from veth1. Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20260306180830.2329477-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 51aaf65bbd21e81a0a4d6827fad76ec8873a7703 Merge: abb0eb0b033a0a b6420bd5aa0c37 Author: Jakub Kicinski Date: Mon Mar 9 19:11:21 2026 -0700 Merge tag 'ib-gpio-remove-of-gpio-h-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into mbox Bartosz Golaszewski says: ==================== Immutable branch between GPIO and net Convert remaining users of of_gpio.h to using GPIO descriptors and remove the header. * tag 'ib-gpio-remove-of-gpio-h-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: remove of_get_named_gpio() and nfc: nfcmrvl: convert to gpio descriptors nfc: s3fwrn5: convert to gpio descriptors ==================== Link: https://patch.msgid.link/20260309093153.10446-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit abb0eb0b033a0a8980eb9215e02626e4801ead3f Author: Qingfang Deng Date: Fri Mar 6 17:36:49 2026 +0800 ppp: simplify input error handling Currently, ppp_input_error() indicates an error by allocating a 0-length skb and calling ppp_do_recv(). It takes an error code argument, which is stored in skb->cb, but not used by ppp_receive_frame(). Simplify the error handling by removing the unused parameter and the unnecessary skb allocation. Instead, call ppp_receive_error() directly from ppp_input_error() under the recv lock, and the length check in ppp_receive_frame() can be removed. Signed-off-by: Qingfang Deng Signed-off-by: Jakub Kicinski commit 58e4d35ae7b9325ab622bbcc34312b17af425c8f Author: Eric Dumazet Date: Fri Mar 6 13:31:54 2026 +0000 net/sched: use rtnl_kfree_skbs() in pfifo_fast_reset() rtnl_kfree_skbs() reduces RTNL and qdisc spinlock hold time. skbs are freed later after RTNL has been released. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260306133154.678730-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a23c657e332f2feb5eb9c4a3e8371386aa7392a6 Author: Sebastian Andrzej Siewior Date: Fri Mar 6 15:44:39 2026 +0100 net: ethernet: ti: am65-cpsw: Use also port number to identify timestamps The driver uses packet-type (RX/TX) PTP-message type and PTP-sequence number to identify a matching timestamp packet for a skb. If the same PTP packet arrives on both ports (as in a PRP environment) then it is not obvious which event belongs to which skb. The event contains also the port number on which it was received. Instead of masking it out, use it for matching. Tested-by: Chintan Vankar Reviewed-by: Martin Kaistra Signed-off-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20260306144439.cVwaaopR@linutronix.de Signed-off-by: Jakub Kicinski commit 47e8dbb6e763e5ccfed2ab4aa55cbb163382aec1 Author: Eric Dumazet Date: Sat Mar 7 16:34:30 2026 +0000 net/sched: do not reset queues in graft operations Following typical script is extremely disruptive, because each graft operation calls dev_deactivate() which resets all the queues of the device. QPARAM="limit 100000 flow_limit 1000 buckets 4096" TXQS=64 for ETH in eth1 do tc qd del dev $ETH root 2>/dev/null tc qd add dev $ETH root handle 1: mq for i in `seq 1 $TXQS` do slot=$( printf %x $(( i )) ) tc qd add dev $ETH parent 1:$slot fq $QPARAM done done One can add "ip link set dev $ETH down/up" to reduce the disruption time: QPARAM="limit 100000 flow_limit 1000 buckets 4096" TXQS=64 for ETH in eth1 do ip link set dev $ETH down tc qd del dev $ETH root 2>/dev/null tc qd add dev $ETH root handle 1: mq for i in `seq 1 $TXQS` do slot=$( printf %x $(( i )) ) tc qd add dev $ETH parent 1:$slot fq $QPARAM done ip link set dev $ETH up done Or we can add a @reset_needed flag to dev_deactivate() and dev_deactivate_many(). This flag is set to true at device dismantle or linkwatch_do_dev(), and to false for graft operations. In the future, we might only stop one queue instead of the whole device, ie call dev_deactivate_queue() instead of dev_deactivate(). I think the problem (quadratic behavior) was added in commit 2fb541c862c9 ("net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc") but this does not look serious enough to deserve risky backports. Signed-off-by: Eric Dumazet Cc: Yunsheng Lin Reviewed-by: Jamal Hadi Salim Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Victor Nogueira Link: https://patch.msgid.link/20260307163430.470644-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 82f36517a13e6339ddd9737d8a310949e057e596 Author: Eric Dumazet Date: Fri Mar 6 15:43:22 2026 +0000 tcp: avoid dst->ops->check() call in tcp_v{4,6}_do_rcv() If incoming skb dst matches the socket cached one, there is no need to call again dst->ops->check(). Network layer already validated the skb dst for us, usually from tcp_v{4,6}_early_demux(). Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260306154322.1086539-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6927430735802bd8bc5dbe352edbd94a04459567 Author: Rosen Penev Date: Thu Mar 5 18:54:49 2026 -0800 net: rocker: kzalloc + kcalloc to kzalloc_flex Combining the allocations simplifies things, especially the free path. Remove ofdpa_group_tbl_entry_free as a result. kfree is shorter. Add __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev Acked-by: Gustavo A. R. Silva Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20260306025449.12333-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski commit 50636e5ff8861c35ebb190521ba540074ab583ad Author: Eric Dumazet Date: Fri Mar 6 13:11:30 2026 +0000 tcp: move tcp_v4_early_demux() to net/ipv4/ip_input.c tcp_v4_early_demux() has a single caller : ip_rcv_finish_core(). Move it to net/ipv4/ip_input.c and mark it static, for possible compiler/linker optimizations. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260306131130.654991-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8ca8eb05767395cd2fd0db12e052ca0bc5d1597c Author: Keita Morisaki Date: Sat Mar 7 14:16:19 2026 +0900 tcp: remove unused hash_size from struct tcp_out_options hash_size is declared but never read. The MD5 path always uses a fixed size of 16, and the TCP-AO path uses tcp_ao_maclen(). This closes a 7-byte hole and reduces the struct size from 96 to 88 bytes. Suggested-by: Jakub Sitnicki Signed-off-by: Keita Morisaki Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260307051619.51685-1-kmta1236@gmail.com Signed-off-by: Jakub Kicinski commit d31b23723ca0e3e340a1a68558a0f958569dd4a8 Author: Alexander Stein Date: Wed Mar 4 15:04:25 2026 +0100 drm: lcdif: Use dev_err_probe() Use dev_err_probe() to add a reason for deferred probe. This can especially happen on lcdif3 which uses hdmi_tx_phy for 'pix' clock Reviewed-by: Liu Ying Reviewed-by: Marco Felsch Reviewed-by: Frank Li Signed-off-by: Alexander Stein Signed-off-by: Liu Ying Link: https://lore.kernel.org/r/20260304140426.1499446-1-alexander.stein@ew.tq-group.com commit 2ed4b46b4fc77749cb0f8dd31a01441b82c8dbaa Author: Tim Bird Date: Wed Mar 4 17:47:22 2026 -0700 net: Add SPDX ids to some source files Add SPDX-License-Identifier lines to several source files under the network sub-directory. Work on files in the core, dns_resolver, ipv4, ipv6 and netfilter sub-dirs. Remove boilerplate and license reference text to avoid ambiguity. Rusty Russell has expressed that his contributions were intended to be GPL-2.0-or-later. Signed-off-by: Tim Bird Link: https://patch.msgid.link/20260305004724.87469-1-tim.bird@sony.com Signed-off-by: Jakub Kicinski commit 86020d7db03abd337d89b02586ce0fb0d65667e0 Merge: 0bcac7b1126255 aa234faa5a4d0f Author: Jakub Kicinski Date: Mon Mar 9 17:02:30 2026 -0700 Merge branch 'tools-ynl-convert-samples-into-selftests' Jakub Kicinski says: ==================== tools: ynl: convert samples into selftests The "samples" were always poor man's tests, used to manually confirm that C YNL works as expected. Since a proper tests/ directory now exists move the samples and use the kselftest harness to turn them into selftests outputting KTAP. ==================== Link: https://patch.msgid.link/20260307033630.1396085-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit aa234faa5a4d0f213697c4b9012c75b80b9d2c20 Author: Jakub Kicinski Date: Fri Mar 6 19:36:30 2026 -0800 tools: ynl: convert rt-route sample to selftest Convert rt-route.c to use kselftest_harness.h with FIXTURE/TEST_F. This is the last test to convert so clean up the Makefile. Validate that the connected routes for 192.168.1.0/24 and 2001:db8::/64 appear in the dump. Output: TAP version 13 1..1 # Starting 1 tests from 1 test cases. # RUN rt_route.dump ... # oif: nsim0 dst: 192.168.1.0/24 # oif: lo dst: ::1/128 # oif: nsim0 dst: 2001:db8::1/128 # oif: nsim0 dst: 2001:db8::/64 # oif: nsim0 dst: fe80::/64 # oif: nsim0 dst: ff00::/8 # OK rt_route.dump ok 1 rt_route.dump # PASSED: 1 / 1 tests passed. # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 Reviewed-by: Donald Hunter Tested-by: Donald Hunter Link: https://patch.msgid.link/20260307033630.1396085-11-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e7a39b8f5fcf076b88925d0e24bdba69d988cf9e Author: Jakub Kicinski Date: Fri Mar 6 19:36:29 2026 -0800 tools: ynl: convert rt-addr sample to selftest Convert rt-addr.c to use kselftest_harness.h with FIXTURE/TEST_F. Validate that the addresses configured by the wrapper (192.168.1.1 and 2001:db8::1) appear in the dump. Output: TAP version 13 1..1 # Starting 1 tests from 1 test cases. # RUN rt_addr.dump ... # lo: 127.0.0.1 # nsim0: 192.168.1.1 # lo: ::1 # nsim0: 2001:db8::1 # nsim0: fe80::7c66:c9ff:fe5f:bf01 # OK rt_addr.dump ok 1 rt_addr.dump # PASSED: 1 / 1 tests passed. # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 Reviewed-by: Donald Hunter Tested-by: Donald Hunter Link: https://patch.msgid.link/20260307033630.1396085-10-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1419fbf5a8179f6d5cc1e2487c01d51c97bcade0 Author: Jakub Kicinski Date: Fri Mar 6 19:36:28 2026 -0800 tools: ynl: convert ethtool sample to selftest Convert ethtool.c to use kselftest_harness.h with FIXTURE/TEST_F. Move ethtool from BINS to TEST_GEN_FILES and add ethtool.sh wrapper which sets up a netdevsim device before running the test binary. Output: TAP version 13 1..2 # Starting 2 tests from 1 test cases. # RUN ethtool.channels ... # nsim0: combined 1 # OK ethtool.channels ok 1 ethtool.channels # RUN ethtool.rings ... # nsim0: rx 512 tx 512 # OK ethtool.rings ok 2 ethtool.rings # PASSED: 2 / 2 tests passed. # Totals: pass:2 fail:0 xfail:0 xpass:0 skip:0 error:0 Reviewed-by: Donald Hunter Tested-by: Donald Hunter Link: https://patch.msgid.link/20260307033630.1396085-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit db20b374e7f74d2336c8d9f8a6e4806985328980 Author: Jakub Kicinski Date: Fri Mar 6 19:36:27 2026 -0800 tools: ynl: convert devlink sample to selftest Convert devlink.c to use kselftest_harness.h with FIXTURE/TEST_F. Move devlink from BINS to TEST_GEN_FILES in the Makefile since it's invoked via the devlink.sh wrapper which sets up netdevsim. Output: TAP version 13 1..2 # Starting 2 tests from 1 test cases. # RUN devlink.dump ... # netdevsim/netdevsim1337 # OK devlink.dump ok 1 devlink.dump # RUN devlink.info ... # netdevsim/netdevsim1337: # driver: netdevsim # running fw: # fw.mgmt: 10.20.30 # OK devlink.info ok 2 devlink.info # PASSED: 2 / 2 tests passed. # Totals: pass:2 fail:0 xfail:0 xpass:0 skip:0 error:0 Reviewed-by: Donald Hunter Tested-by: Donald Hunter Link: https://patch.msgid.link/20260307033630.1396085-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7a95e52562936e54c77f3fb2177016d68f1f203f Author: Jakub Kicinski Date: Fri Mar 6 19:36:26 2026 -0800 tools: ynl: add netdevsim wrapper library for YNL tests Some tests need netdevsim setup which is painful to do from C. Add ynl_nsim_lib.sh, a shared library providing nsim_setup and nsim_cleanup functions for tests that need a netdevsim device. Reviewed-by: Donald Hunter Tested-by: Donald Hunter Link: https://patch.msgid.link/20260307033630.1396085-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6cf8fb4722c35270df8e087c0c589da0577377a6 Author: Jakub Kicinski Date: Fri Mar 6 19:36:25 2026 -0800 tools: ynl: convert tc and tc-filter-add samples to selftest Convert tc.c and tc-filter-add.c to produce KTAP output with kselftest_harness. Merge the two tests together. They both test TC one is testing qdisc and the other classifiers but they can easily live in a single selftest. Make the test spawn a new netns, and run the operations on lo to avoid onerous setup and cleanup. TAP version 13 1..2 # Starting 2 tests from 1 test cases. # RUN tc.qdisc ... # lo: fq_codel limit: 10240p target: 5ms new_flow_cnt: 0 # OK tc.qdisc ok 1 tc.qdisc # RUN tc.flower ... # flower pref 1 proto: 0x8100 # flower: # vlan_id: 100 # vlan_prio: 5 # num_of_vlans: 3 # action order: 1 vlan push id 200 protocol 0x8100 priority 0 # action order: 2 vlan push id 300 protocol 0x8100 priority 0 # OK tc.flower ok 2 tc.flower # PASSED: 2 / 2 tests passed. # Totals: pass:2 fail:0 xfail:0 xpass:0 skip:0 error:0 Reviewed-by: Donald Hunter Tested-by: Donald Hunter Link: https://patch.msgid.link/20260307033630.1396085-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5c3206786c2d2c42540ad075d73fc895a9eb7f39 Author: Jakub Kicinski Date: Fri Mar 6 19:36:24 2026 -0800 tools: ynl: convert rt-link sample to selftest Convert rt-link.c to use kselftest_harness.h with FIXTURE/TEST_F. Move rt-link from BINS to TEST_GEN_PROGS. Output: TAP version 13 1..3 # Starting 3 tests from 1 test cases. # RUN rt_link.dump ... # 1: lo: mtu 65536 # 2: sit0: mtu 1480 kind sit # OK rt_link.dump ok 1 rt_link.dump # RUN rt_link.netkit ... # 4: nk1: mtu 1500 kind netkit primary 1 policy blackhole # OK rt_link.netkit ok 2 rt_link.netkit # RUN rt_link.netkit_err_msg ... # OK rt_link.netkit_err_msg ok 3 rt_link.netkit_err_msg # PASSED: 3 / 3 tests passed. # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 Reviewed-by: Donald Hunter Tested-by: Donald Hunter Link: https://patch.msgid.link/20260307033630.1396085-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7e3effbc76278bfe3c452074c301233c8e69101f Author: Jakub Kicinski Date: Fri Mar 6 19:36:23 2026 -0800 tools: ynl: convert ovs sample to selftest Convert ovs.c to produce KTAP output with kselftest_harness. The single "crud" test creates a new OVS datapath, fetches it back by name, then dumps all datapaths verifying the new one appears. IIRC I added this test because ovs is a genetlink family but has a family-specific fixed header. TAP version 13 1..1 # Starting 1 tests from 1 test cases. # RUN ovs.crud ... # get: # ynl-test(3): pid:0 cache:256 # dump: # ynl-test(3): pid:0 cache:256 # OK ovs.crud ok 1 ovs.crud # PASSED: 1 / 1 tests passed. # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 Reviewed-by: Donald Hunter Tested-by: Donald Hunter Link: https://patch.msgid.link/20260307033630.1396085-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 285804d63f35b333b216f90255104264c590514b Author: Jakub Kicinski Date: Fri Mar 6 19:36:22 2026 -0800 tools: ynl: convert netdev sample to selftest Convert netdev.c to produce KTAP output with 3 tests: - dev_dump: dump all netdev devices, skip if empty - dev_get: query first device from dump by ifindex - ntf_check: subscribe to "mgmt", create a veth via rt-link, verify netdev notification is received, then delete the veth Remove stdin/scanf-based UI. Add rt-link dependency for the veth notification test. TAP version 13 1..3 # Starting 3 tests from 1 test cases. # RUN netdev.dump ... # lo[1] xdp-features (0): xdp-rx-metadata-features (0): xsk-fea... # sit0[2] xdp-features (0): xdp-rx-metadata-features (0): xsk-fea... # OK netdev.dump ok 1 netdev.dump # RUN netdev.get ... # lo[1] xdp-features (0): xdp-rx-metadata-features (0): xsk-fea... # OK netdev.get ok 2 netdev.get # RUN netdev.ntf_check ... # veth0[7] xdp-features (0): xdp-rx-metadata-features (7): timesta... # OK netdev.ntf_check ok 3 netdev.ntf_check # PASSED: 3 / 3 tests passed. # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 Reviewed-by: Donald Hunter Tested-by: Donald Hunter Link: https://patch.msgid.link/20260307033630.1396085-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e0aa0c61758f517ded2befa084ebcad93809b421 Author: Jakub Kicinski Date: Fri Mar 6 19:36:21 2026 -0800 tools: ynl: move samples to tests The "samples" were always poor man's tests (used to manually confirm that C YNL works). Move all C sample programs from tools/net/ynl/samples/ to tools/net/ynl/tests/, "merge" the Makefiles. The subsequent changes will convert each sample into a proper KTAP selftests. Since these are now tests rather than samples - default to enabling asan. After all we're testing user space code here. Sort the gitignore while at it, the page-pool entry was a leftover so delete it. Reviewed-by: Donald Hunter Tested-by: Donald Hunter Link: https://patch.msgid.link/20260307033630.1396085-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b3414148bbc1f9cd56217e58a558c6ac4fd1b4a6 Author: Thorsten Blum Date: Sat Mar 7 11:24:21 2026 +0100 thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp The raw temperature data was never clamped to SPRD_THM_RAW_DATA_LOW or SPRD_THM_RAW_DATA_HIGH because the return value of clamp() was not used. Fix this by assigning the clamped value to 'rawdata'. Casting SPRD_THM_RAW_DATA_LOW and SPRD_THM_RAW_DATA_HIGH to u32 is also redundant and can be removed. Fixes: 554fdbaf19b1 ("thermal: sprd: Add Spreadtrum thermal driver support") Signed-off-by: Thorsten Blum Signed-off-by: Daniel Lezcano Reviewed-by: Baolin Wang Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260307102422.306055-2-thorsten.blum@linux.dev commit 83c0f9a5d679a6f8d84fc49b2f62ea434ccab4b6 Author: Thorsten Blum Date: Sat Mar 7 11:24:20 2026 +0100 thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata The temperature was never clamped to SPRD_THM_TEMP_LOW or SPRD_THM_TEMP_HIGH because the return value of clamp() was not used. Fix this by assigning the clamped value to 'temp'. Casting SPRD_THM_TEMP_LOW and SPRD_THM_TEMP_HIGH to int is also redundant and can be removed. Fixes: 554fdbaf19b1 ("thermal: sprd: Add Spreadtrum thermal driver support") Signed-off-by: Thorsten Blum Signed-off-by: Daniel Lezcano Reviewed-by: Baolin Wang Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260307102422.306055-1-thorsten.blum@linux.dev commit a3618f3ca6a6dc5cb185d70626c28836b86e8256 Author: Alexander Stein Date: Fri Mar 6 14:30:16 2026 +0100 thermal/drivers/imx91: Add hwmon support Expose thermal readings as a HWMON device, so that it could be accessed using lm-sensors. Signed-off-by: Alexander Stein Link: https://patch.msgid.link/20260306133017.3189979-1-alexander.stein@ew.tq-group.com Signed-off-by: Daniel Lezcano commit d161cbd68531eeb4f7cf339d75ee2c761fd8a1aa Author: Alexander Stein Date: Thu Mar 5 17:35:07 2026 +0100 thermal/of: Add OF node address to output message Temperature sensors are supposed to have the DT node name temperature-sensors. Having multiple ones the node name alone isn't very helpful. Add the node address to make them more distinguishable. Signed-off-by: Alexander Stein Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/20260305163508.2643106-1-alexander.stein@ew.tq-group.com Signed-off-by: Daniel Lezcano commit a5c21b9bd5f531e50141b0484faabb707b92f1e2 Author: Dmitry Baryshkov Date: Wed Mar 4 05:29:47 2026 +0200 arm64: dts: qcom: correct RBR opp entry DisplayPort Reduced Bit Rate uses link rate of 1.62 Gbps, the main link clock should be 162 MHz. Having the incorrect frequency (160 MHz) in the OPP table will result in selecting wrong link frequency. Correct the entry in the OPP table. Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260304-msm-fix-rbr-v1-1-b9eba986eaef@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8eb46e0a7a1074342b3aab75a48783cd488f56e1 Author: Swati Agarwal Date: Tue Mar 3 13:51:57 2026 +0530 arm64: dts: qcom: monaco-evk: Enable the secondary USB controller Enable the secondary USB controller connected to micro usb port in OTG mode on Monaco EVK platform. Signed-off-by: Swati Agarwal Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260303082157.523847-4-swati.agarwal@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d2b1f221088d3ba1c365ea9af1e7ebe20c34a3a5 Author: Swati Agarwal Date: Tue Mar 3 13:51:56 2026 +0530 arm64: dts: qcom: monaco: Add role-switch support and HS endpoint for secondary USB controller Enable usb-role-switch for the secondary HS USB controller on Monaco. Additionally, add a port node with an HS endpoint so the controller can be linked through the DT graph to the corresponding connector. Signed-off-by: Swati Agarwal Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260303082157.523847-3-swati.agarwal@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d99862e7103986b98ed0b79e3527af0e7bc516ef Author: Swati Agarwal Date: Tue Mar 3 13:51:55 2026 +0530 arm64: dts: qcom: monaco-evk: Enable GPIO expander interrupt for Monaco EVK Enable PCA9538 expander as interrupt controller on Monaco EVK and configure the corresponding TLMM pins via pinctrl to operate as GPIO inputs with internal pull-ups. Signed-off-by: Swati Agarwal Link: https://lore.kernel.org/r/20260303082157.523847-2-swati.agarwal@oss.qualcomm.com [bjorn: Reordered nodes under &tlmm] Signed-off-by: Bjorn Andersson commit 7ffe83b6178e1668cf17ab4d9394dc2873c3aa17 Author: David Heidelberg Date: Wed Jan 14 11:08:45 2026 +0100 arm64: dts: qcom: sdm845: Introduce camera master clock pinctrl Put clock pins configuration for camera master clock into the dtsi. Reviewed-by: Vladimir Zapolskiy Reviewed-by: Konrad Dybcio Signed-off-by: David Heidelberg Link: https://lore.kernel.org/r/20260114-sdm845-mclk-v3-1-c9351deaf4f2@ixit.cz Signed-off-by: Bjorn Andersson commit af2385d532c3457e08e8431f27d5771d7a686ef5 Author: Janaki Ramaiah Thota Date: Tue Feb 3 12:48:07 2026 +0530 arm64: dts: qcom: qcm6490-idp: add and enable BT node Add the PMU node for WCN6750 present on the qcm6490-idp board and assign its power outputs to the Bluetooth module. In WCN6750 module sw_ctrl and wifi-enable pins are handled in the wifi controller firmware. Therefore, it is not required to have those pins' entries in the PMU node. Signed-off-by: Janaki Ramaiah Thota Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260203071807.764036-1-janaki.thota@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7a7d24a14a009691a1af6bfe45b210521635db5b Author: Le Qi Date: Fri Jan 30 14:12:31 2026 +0800 soc: qcom: pd-mapper: Add QCS615 power domain mappings Add the QCS615 domain table to the in-kernel pd-mapper so that audio subsystems no longer rely on the userspace pd-mapper daemon. This enables proper initialization of ADSP and CDSP domains directly from the kernel. Reviewed-by: Dmitry Baryshkov Signed-off-by: Le Qi Link: https://lore.kernel.org/r/20260130061231.310113-1-le.qi@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 296bd7dd81bf43d127852eb59972b4391e1622e1 Merge: ed0313223ce651 0a208adefecb28 Author: Mark Brown Date: Mon Mar 9 22:37:16 2026 +0000 Add support for CS42L43B codec to CS42L43 driver Merge series from Maciej Strozek : Introducing CS42L43B, a variant of the CS42L43 codec with changes to PDM (DMIC) inputs, RAM/ROM memory and extra channels to two SoundWire ports and ISRCs, and can be supported by the existing CS42L43 driver with some modifications. commit 0111d600f0f456d09eb0ff6ac217fa5f30ae79ab Author: Jeremy Linton Date: Sun Mar 8 23:59:30 2026 -0500 PCI: of: Reduce severity of missing of_root error message Arm64 kernels are frequently built dual ACPI/DT, and then boot in ACPI mode. In this case, there won't be an of_root, except for rare DT described PCIe boards. As a result, users in the common case see this high priority worrying message, despite the machine working as expected. Reduce this message to pr_debug() to avoid unnecessary noise. Signed-off-by: Jeremy Linton Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260309045930.21531-1-jeremy.linton@arm.com commit c2dd39323d497cad721097491aef59514d6cc9c1 Author: Loic Poulain Date: Fri Jan 16 22:43:54 2026 +0100 arm64: dts: qcom: monaco-evk: Enable SDHC1 for eMMC Monaco EVK has onboard eMMC, that can be used either as primary boot storage or as secondary storage when booting from UFS. Signed-off-by: Loic Poulain Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260116214354.256878-3-loic.poulain@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 978400b7a68f19d09ef3767b69447f855bd5ea43 Author: Loic Poulain Date: Fri Jan 16 22:43:53 2026 +0100 arm64: dts: qcom: monaco: Complete SDHC definition Add the missing SDHC properties required to enable HS200, HS400, and HS400 Enhanced Strobe modes, as supported by this controller. Select the proper default pinctrls. Signed-off-by: Loic Poulain Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260116214354.256878-2-loic.poulain@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d44e0ab9722c19a14bd281952a08700d9318d4fc Author: Jie Gan Date: Wed Jan 28 09:25:34 2026 +0800 arm64: dts: qcom: talos: add ETR device Add the TMC ETR device to store collected trace data in DDR memory. Reviewed-by: Konrad Dybcio Signed-off-by: Jie Gan Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260128-enable-etr-on-talos-v2-1-ba77063d6b62@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7adefbf4dff31e016c0edc653b85823afff541fe Author: Charan Pedumuru Date: Fri Jan 23 15:39:02 2026 +0000 arm: dts: ti: omap: align node patterns with established convention Update OMAP DTS node patterns to match established conventions. Signed-off-by: Charan Pedumuru Link: https://patch.msgid.link/20260123-ti-phy-v4-1-b557e2c46e6f@gmail.com Signed-off-by: Kevin Hilman commit 57c554332c8654c2fc2b62459f6eecaff6afca85 Author: Matt Roper Date: Thu Mar 5 14:59:28 2026 -0800 drm/xe: Utilize for_each_gt_with_type() for type-specific GT loops Convert existing loops with Coccinelle via the following semantic patch: @@ identifier GT, XE, ID; iterator name for_each_gt, for_each_gt_with_type; @@ - for_each_gt(GT, XE, ID) { + for_each_gt_with_type(GT, XE, ID, BIT(XE_GT_TYPE_MAIN)) { - if (xe_gt_is_media_type(GT)) - continue; ... } @@ identifier GT, XE, ID; iterator name for_each_gt, for_each_gt_with_type; @@ - for_each_gt(GT, XE, ID) { + for_each_gt_with_type(GT, XE, ID, BIT(XE_GT_TYPE_MEDIA)) { - if (xe_gt_is_main_type(GT)) - continue; ... } @@ identifier GT, XE, ID; iterator name for_each_gt, for_each_gt_with_type; @@ - for_each_gt(GT, XE, ID) { + for_each_gt_with_type(GT, XE, ID, BIT(XE_GT_TYPE_MAIN)) { - if (!xe_gt_is_main_type(GT)) - continue; ... } @@ identifier GT, XE, ID; iterator name for_each_gt, for_each_gt_with_type; @@ - for_each_gt(GT, XE, ID) { + for_each_gt_with_type(GT, XE, ID, BIT(XE_GT_TYPE_MEDIA)) { - if (xe_gt_is_media_type(GT)) - continue; ... } No functional change expected. Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260305-gt-type-loops-v1-2-aa42e9fc3f06@intel.com Signed-off-by: Matt Roper commit 9f3e77cf204ebb5755e092136c880a6c2d942568 Author: Matt Roper Date: Thu Mar 5 14:59:27 2026 -0800 drm/xe: Add for_each_gt_with_type() iterator There are a couple places in the driver today that have GT loops that only need to operate on a specific type of GT. E.g., for_each_gt(...) { if (xe_gt_is_media_type(gt)) continue; ... } Some upcoming development is expected to utilize this pattern a bit more widely, so add a dedicated iterator that allows looping over specific GT type(s). Note that this iterator uses a mask for the "type" parameter rather than a direct value match. That's probably a bit overkill for now given that there are only two possible types of GTs, but if additional types of GTs ever show up in the future, this approach will fit more naturally and allow cases where we might want to loop over a subset of the possible types, or specifically mask off one single type. Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260305-gt-type-loops-v1-1-aa42e9fc3f06@intel.com Signed-off-by: Matt Roper commit cca149429956745293ea94865ff8be6f77cc003d Author: Tom Lendacky Date: Mon Mar 9 12:00:45 2026 -0600 x86/virt/sev: Keep the RMP table bookkeeping area mapped In preparation for delayed SNP initialization and disablement on shutdown, the RMP will need to be cleared each time SNP is disabled. Maintain the mapping to the RMP bookkeeping area to avoid mapping and unmapping it each time and any possible errors that may arise from that. Signed-off-by: Tom Lendacky Signed-off-by: Tycho Andersen (AMD) Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260309180053.2389118-4-tycho@kernel.org commit 99cf1fb58e68291d408b4c4484181cf88f081857 Author: Tycho Andersen (AMD) Date: Mon Mar 9 12:00:44 2026 -0600 x86/virt/sev: Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN WBINVD is required before SNP_INIT(_EX), but not before setting MSR_AMD64_SYSCFG_SNP_EN, since the ccp driver already does its own WBINVD before SNP_INIT (and this one would be too early for that anyway...). Signed-off-by: Tycho Andersen (AMD) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://patch.msgid.link/20260309180053.2389118-3-tycho@kernel.org commit 959d3f7565352fab844ae73a722631c5f615427f Author: Tycho Andersen (AMD) Date: Mon Mar 9 12:00:43 2026 -0600 x86/virt/sev: Drop support for SNP hotplug During an SNP_INIT(_EX), the SEV firmware checks that all CPUs have the SNP syscfg bit set, and fails if they do not. As such, it does not make sense to have offline CPUs: the firmware will fail initialization because of the offlined ones that the kernel did not initialize. Further, there is a bug: during SNP_INIT(_EX) the firmware requires the MFDM syscfg bit to be set in addition to having SNP enabled, which the previous hotplug code did not do. Since k8_check_syscfg_dram_mod_en() enforces this be cleared, hotplug wouldn't work. Signed-off-by: Tycho Andersen (AMD) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://patch.msgid.link/20260309180053.2389118-2-tycho@kernel.org commit 7b193af58b7f65715dc19e235e03e447a454b377 Author: Ilpo Järvinen Date: Wed Mar 4 14:21:38 2026 +0200 PCI: Consolidate pci_bus/slot_lock/unlock/trylock() pci_bus/slot_lock/unlock/trylock() largely duplicate the bus iteration loop with variation only due to slot filter handling. The only differences in the loops is where the struct bus is found (directly in the argument vs in slot->bus) and whether slot filter is applied. Those differences are simple to handle using function parameters. Consolidate the bus iteration loop to one place by creating __pci_bus_{lock,unlock,trylock}() and call them from the non-underscore locking functions. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260304122139.1479-1-ilpo.jarvinen@linux.intel.com commit 8238cb69c01fe4dbb4e3be277fff3ed680ac0108 Author: Keith Busch Date: Tue Feb 17 08:08:36 2026 -0800 PCI: Make reset_subordinate hotplug safe Use the slot reset method when resetting the bridge if the bus contains hot plug slots. This fixes spurious hot plug events that are triggered by the secondary bus reset that bypasses the slot's detection disabling. Resetting a bridge's subordinate bus can be done like this: # echo 1 > /sys/bus/pci/devices/0000:50:01.0/reset_subordinate Prior to this patch, an example kernel message may show something like: pcieport 0000:50:01.0: pciehp: Slot(40): Link Down With this change, the pciehp driver ignores the link event during the reset, so may show this message instead: pcieport 0000:50:01.0: pciehp: Slot(40): Link Down/Up ignored Signed-off-by: Keith Busch Signed-off-by: Bjorn Helgaas Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260217160836.2709885-4-kbusch@meta.com commit 102c8b26b54e363f85c4c86099ca049a0a76bb58 Author: Keith Busch Date: Tue Feb 17 08:08:35 2026 -0800 PCI: Allow all bus devices to use the same slot A PCIe hotplug slot applies to the entire secondary bus. Thus, pciehp only allocates a single hotplug_slot for the bridge to that bus. The existing PCI slot, though, would only match to functions on device 0, meaning any devices beyond that, e.g., ARI functions, are not matched to any slot even though they share it. A slot reset will break all the missing devices because the handling skips them. For example, ARI devices with more than 8 functions fail because their state is not properly handled, nor is the attached driver notified of the reset. In the best case, the device will appear unresponsive to the driver, resulting in unexpected errors. A worse possibility may panic the kernel if in-flight transactions trigger hardware reported errors like this real observation: vfio-pci 0000:01:00.0: resetting vfio-pci 0000:01:00.0: reset done {1}[Hardware Error]: Error 1, type: fatal {1}[Hardware Error]: section_type: PCIe error {1}[Hardware Error]: port_type: 0, PCIe end point {1}[Hardware Error]: version: 0.2 {1}[Hardware Error]: command: 0x0140, status: 0x0010 {1}[Hardware Error]: device_id: 0000:01:01.0 {1}[Hardware Error]: slot: 0 {1}[Hardware Error]: secondary_bus: 0x00 {1}[Hardware Error]: vendor_id: 0x1d9b, device_id: 0x0207 {1}[Hardware Error]: class_code: 020000 {1}[Hardware Error]: bridge: secondary_status: 0x0000, control: 0x0000 {1}[Hardware Error]: aer_cor_status: 0x00008000, aer_cor_mask: 0x00002000 {1}[Hardware Error]: aer_uncor_status: 0x00010000, aer_uncor_mask: 0x00100000 {1}[Hardware Error]: aer_uncor_severity: 0x006f6030 {1}[Hardware Error]: TLP Header: 0a412800 00192080 60000004 00000004 GHES: Fatal hardware error but panic disabled Kernel panic - not syncing: GHES: Fatal hardware error Allow a slot to be created to claim all devices on a bus, not just a matching device. This is done by introducing a sentinel value, named PCI_SLOT_ALL_DEVICES, which then has the PCI slot match to any device on the bus. This fixes slot resets for pciehp. Since 0xff already has special meaning, the chosen value for this new feature is 0xfe. This will not clash with any actual slot number since they are limited to 5 bits. Signed-off-by: Keith Busch Signed-off-by: Bjorn Helgaas Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260217160836.2709885-3-kbusch@meta.com commit 4377a22d84f726f0a650927edf75cdc0698baf06 Author: Christoph Hellwig Date: Mon Mar 2 06:18:19 2026 -0800 ext4: use a byte granularity cursor in ext4_mpage_readpages Replace the next_block variable that is in units of file system blocks and incorrectly uses the sector_t type with a byte offset, as that is what both users want. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-15-hch@lst.de Signed-off-by: Eric Biggers commit 5ca1a1f017ea0f0e0bcb6ec52064735f2ac1c393 Author: Christoph Hellwig Date: Mon Mar 2 06:18:18 2026 -0800 fscrypt: pass a real sector_t to fscrypt_zeroout_range While the pblk argument to fscrypt_zeroout_range is declared as a sector_t, it actually is interpreted as a logical block size unit, which is highly unusual. Switch to passing the 512 byte units that sector_t is defined for. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-14-hch@lst.de Signed-off-by: Eric Biggers commit fb87ab4ad3d0df2397648e5ce2384de26463c183 Author: Christoph Hellwig Date: Mon Mar 2 06:18:17 2026 -0800 fscrypt: pass a byte length to fscrypt_zeroout_range Range lengths are usually expressed as bytes in the VFS, switch fscrypt_zeroout_range to this convention. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-13-hch@lst.de Signed-off-by: Eric Biggers commit cd7db2e7dfeef99c901156f58ab4a38256b0c3f1 Author: Christoph Hellwig Date: Mon Mar 2 06:18:16 2026 -0800 fscrypt: pass a byte offset to fscrypt_zeroout_range Logical offsets into an inode are usually expressed as bytes in the VFS. Switch fscrypt_zeroout_range to that convention. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-12-hch@lst.de Signed-off-by: Eric Biggers commit 90950ee5630b68b2b321c78af29e0b3f36080594 Author: Christoph Hellwig Date: Mon Mar 2 06:18:15 2026 -0800 fscrypt: pass a byte length to fscrypt_zeroout_range_inline_crypt Range lengths are usually expressed as bytes in the VFS, switch fscrypt_zeroout_range_inline_crypt to this convention. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-11-hch@lst.de Signed-off-by: Eric Biggers commit 090c5c1597491e66097ccd21612e3ab9dcfcb231 Author: Christoph Hellwig Date: Mon Mar 2 06:18:14 2026 -0800 fscrypt: pass a byte offset to fscrypt_zeroout_range_inline_crypt Logical offsets into an inode are usually expressed as bytes in the VFS. Switch fscrypt_zeroout_range_inline_crypt to that convention. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-10-hch@lst.de Signed-off-by: Eric Biggers commit 3c7eaa775d8e008135646bd4b7aa7db7c5e40a0e Author: Christoph Hellwig Date: Mon Mar 2 06:18:13 2026 -0800 fscrypt: pass a byte offset to fscrypt_set_bio_crypt_ctx Logical offsets into an inode are usually expressed as bytes in the VFS. Switch fscrypt_set_bio_crypt_ctx to that convention. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-9-hch@lst.de Signed-off-by: Eric Biggers commit 22be86a23c5956254b752e4e98f0ef2799565a41 Author: Christoph Hellwig Date: Mon Mar 2 06:18:12 2026 -0800 fscrypt: pass a byte offset to fscrypt_mergeable_bio Logical offsets into an inode are usually expressed as bytes in the VFS. Switch fscrypt_mergeable_bio to that convention. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-8-hch@lst.de Signed-off-by: Eric Biggers commit 60b4fcb49efe7f07aaa92c8d7933ac37b3be85b2 Author: Christoph Hellwig Date: Mon Mar 2 06:18:11 2026 -0800 fscrypt: pass a byte offset to fscrypt_generate_dun Logical offsets into an inode are usually expressed as bytes in the VFS. Switch fscrypt_generate_dun to that convention and remove the ci_data_units_per_block_bits member in struct fscrypt_inode_info that was only used to cache the DUN shift based on the logical block size granularity. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-7-hch@lst.de Signed-off-by: Eric Biggers commit a18b1ab81654b06e7ff402e5d0b85249e9504bcb Author: Christoph Hellwig Date: Mon Mar 2 06:18:10 2026 -0800 fscrypt: move fscrypt_set_bio_crypt_ctx_bh to buffer.c fscrypt_set_bio_crypt_ctx_bh is only used by submit_bh_wbc now. Move it there and merge bh_get_inode_and_lblk_num into it. Note that this does not add ifdefs for fscrypt as the compiler will optimize away the dead code if it is not built in. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-6-hch@lst.de Signed-off-by: Eric Biggers commit 588e7c048d7d2bfcbe7776ee0888ee248adf01d1 Author: Christoph Hellwig Date: Mon Mar 2 06:18:09 2026 -0800 ext4, fscrypt: merge fscrypt_mergeable_bio_bh into io_submit_need_new_bio ext4 already has the inode and folio and can't have a NULL folio->mapping in this path. Open code fscrypt_mergeable_bio_bh in io_submit_need_new_bio based on these simplifying assumptions. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-5-hch@lst.de Signed-off-by: Eric Biggers commit 5f18a9d2f75a3a5c055c2d777a29b3aa322b04da Author: Christoph Hellwig Date: Mon Mar 2 06:18:08 2026 -0800 ext4: factor out a io_submit_need_new_bio helper Factor out a helper to prepare for making this logic a bit more complex in the next commit. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-4-hch@lst.de Signed-off-by: Eric Biggers commit d3fc0edc8825f39c86dcc4a8b8544f6e25680a51 Author: Christoph Hellwig Date: Mon Mar 2 06:18:07 2026 -0800 ext4: open code fscrypt_set_bio_crypt_ctx_bh io_submit_init_bio already has or can easily get at most information needed to set the crypto context. Open code fscrypt_set_bio_crypt_ctx_bh based on that. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-3-hch@lst.de Signed-off-by: Eric Biggers commit 7737b1b448738be650ddc51fe64b8aae42d433c1 Author: Christoph Hellwig Date: Mon Mar 2 06:18:06 2026 -0800 ext4: initialize the write hint in io_submit_init_bio Make io_submit_init_bio complete by also initializing the write hint. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260302141922.370070-2-hch@lst.de Signed-off-by: Eric Biggers commit 89d10b7803a6ab7276850e54b766487666667153 Merge: ecd92cfec53498 a9aa6045abde87 Author: Jens Axboe Date: Mon Mar 9 14:30:14 2026 -0600 Merge branch 'for-7.1/block-integrity' into for-7.1/block Merge in integrity changes which are also landing in the VFS tree as dependencies for fs related changes. * for-7.1/block-integrity: block: pass a maxlen argument to bio_iov_iter_bounce block: add fs_bio_integrity helpers block: make max_integrity_io_size public block: prepare generation / verification helpers for fs usage block: add a bdev_has_integrity_csum helper block: factor out a bio_integrity_setup_default helper block: factor out a bio_integrity_action helper commit ecd92cfec5349876d6a80f8188ea98c5920094b6 Author: Damien Le Moal Date: Thu Feb 26 16:54:48 2026 +0900 block: remove bdev_nonrot() bdev_nonrot() is simply the negative return value of bdev_rot(). So replace all call sites of bdev_nonrot() with calls to bdev_rot() and remove bdev_nonrot(). Signed-off-by: Damien Le Moal Reviewed-by: Martin K. Petersen Reviewed-by: Paul Menzel Signed-off-by: Jens Axboe commit d0e5fc70620266f975cfa5137795a8c1697ba362 Author: John Garry Date: Fri Feb 27 10:44:38 2026 +0000 block: Correct comments on bio_alloc_clone() and bio_init_clone() Correct the comments that the cloned bio must be freed before the memory pointed to by @bio_src->bi_io_vecs (is freed). Christoph Hellwig contributed most the of the update wording. Signed-off-by: John Garry Reviewed-by: Damien Le Moal Signed-off-by: Jens Axboe commit b0e497db68ae5b0af8e9a0bd1a761607757d5dfe Author: Damien Le Moal Date: Fri Feb 27 22:19:51 2026 +0900 Documentation: ABI: stable: document the zoned_qd1_writes attribute Update the documentation file Documentation/ABI/stable/sysfs-block to describe the zoned_qd1_writes sysfs queue attribute file. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 3d9782f62fb7c2c9ec3020c579425d634559d600 Author: Damien Le Moal Date: Fri Feb 27 22:19:50 2026 +0900 block: default to QD=1 writes for blk-mq rotational zoned devices For blk-mq rotational zoned block devices (e.g. SMR HDDs), default to having zone write plugging limit write operations to a maximum queue depth of 1 for all zones. This significantly reduce write seek overhead and improves SMR HDD write throughput. For remotely connected disks with a very high network latency this features might not be useful. However, remotely connected zoned devices are rare at the moment, and we cannot know the round trip latency to pick a good default for network attached devices. System administrators can however disable this feature in that case. For BIO based (non blk-mq) rotational zoned block devices, the device driver (e.g. a DM target driver) can directly set an appropriate default. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 1365b6904fd050bf22ab9f3df375a396de5837a1 Author: Damien Le Moal Date: Fri Feb 27 22:19:49 2026 +0900 block: allow submitting all zone writes from a single context In order to maintain sequential write patterns per zone with zoned block devices, zone write plugging issues only a single write BIO per zone at any time. This works well but has the side effect that when large sequential write streams are issued by the user and these streams cross zone boundaries, the device ends up receiving a discontiguous set of write commands for different zones. The same also happens when a user writes simultaneously at high queue depth multiple zones: the device does not see all sequential writes per zone and receives discontiguous writes to different zones. While this does not affect the performance of solid state zoned block devices, when using an SMR HDD, this pattern change from sequential writes to discontiguous writes to different zones significantly increases head seek which results in degraded write throughput. In order to reduce this seek overhead for rotational media devices, introduce a per disk zone write plugs kernel thread to issue all write BIOs to zones. This single zone write issuing context is enabled for any zoned block device that has a request queue flagged with the new QUEUE_ZONED_QD1_WRITES flag. The flag QUEUE_ZONED_QD1_WRITES is visible as the sysfs queue attribute zoned_qd1_writes for zoned devices. For regular block devices, this attribute is not visible. For zoned block devices, a user can override the default value set to force the global write maximum queue depth of 1 for a zoned block device, or clear this attribute to fallback to the default behavior of zone write plugging which limits writes to QD=1 per sequential zone. Writing to a zoned block device flagged with QUEUE_ZONED_QD1_WRITES is implemented using a list of zone write plugs that have a non-empty BIO list. Listed zone write plugs are processed by the disk zone write plugs worker kthread in FIFO order, and all BIOs of a zone write plug are all processed before switching to the next listed zone write plug. A newly submitted BIO for a non-FULL zone write plug that is not yet listed causes the addition of the zone write plug at the end of the disk list of zone write plugs. Since the write BIOs queued in a zone write plug BIO list are necessarilly sequential, for rotational media, using the single zone write plugs kthread to issue all BIOs maintains a sequential write pattern and thus reduces seek overhead and improves write throughput. This processing essentially result in always writing to HDDs at QD=1, which is not an issue for HDDs operating with write caching enabled. Performance with write cache disabled is also not degraded thanks to the efficient write handling of modern SMR HDDs. A disk list of zone write plugs is defined using the new struct gendisk zone_wplugs_list, and accesses to this list is protected using the zone_wplugs_list_lock spinlock. The per disk kthread (zone_wplugs_worker) code is implemented by the function disk_zone_wplugs_worker(). A reference on listed zone write plugs is always held until all BIOs of the zone write plug are processed by the worker kthread. BIO issuing at QD=1 is driven using a completion structure (zone_wplugs_worker_bio_done) and calls to blk_io_wait(). With this change, performance when sequentially writing the zones of a 30 TB SMR SATA HDD connected to an AHCI adapter changes as follows (1MiB direct I/Os, results in MB/s unit): +--------------------+ | Write BW (MB/s) | +------------------+----------+---------+ | Sequential write | Baseline | Patched | | Queue Depth | 6.19-rc8 | | +------------------+----------+---------+ | 1 | 244 | 245 | | 2 | 244 | 245 | | 4 | 245 | 245 | | 8 | 242 | 245 | | 16 | 222 | 246 | | 32 | 211 | 245 | | 64 | 193 | 244 | | 128 | 112 | 246 | +------------------+----------+---------+ With the current code (baseline), as the sequential write stream crosses a zone boundary, higher queue depth creates a gap between the last IO to the previous zone and the first IOs to the following zones, causing head seeks and degrading performance. Using the disk zone write plugs worker thread, this pattern disappears and the maximum throughput of the drive is maintained, leading to over 100% improvements in throughput for high queue depth write. Using 16 fio jobs all writing to randomly chosen zones at QD=32 with 1 MiB direct IOs, write throughput also increases significantly. +--------------------+ | Write BW (MB/s) | +------------------+----------+---------+ | Random write | Baseline | Patched | | Number of zones | 6.19-rc7 | | +------------------+----------+---------+ | 1 | 191 | 192 | | 2 | 101 | 128 | | 4 | 115 | 123 | | 8 | 90 | 120 | | 16 | 64 | 115 | | 32 | 58 | 105 | | 64 | 56 | 101 | | 128 | 55 | 99 | +------------------+----------+---------+ Tests using XFS shows that buffered write speed with 8 jobs writing files increases by 12% to 35% depending on the workload. +--------------------+ | Write BW (MB/s) | +------------------+----------+---------+ | Workload | Baseline | Patched | | | 6.19-rc7 | | +------------------+----------+---------+ | 256MiB file size | 212 | 238 | +------------------+----------+---------+ | 4MiB .. 128 MiB | 213 | 243 | | random file size | | | +------------------+----------+---------+ | 2MiB .. 8 MiB | 179 | 242 | | random file size | | | +------------------+----------+---------+ Performance gains are even more significant when using an HBA that limits the maximum size of commands to a small value, e.g. HBAs controlled with the mpi3mr driver limit commands to a maximum of 1 MiB. In such case, the write throughput gains are over 40%. +--------------------+ | Write BW (MB/s) | +------------------+----------+---------+ | Workload | Baseline | Patched | | | 6.19-rc7 | | +------------------+----------+---------+ | 256MiB file size | 175 | 245 | +------------------+----------+---------+ | 4MiB .. 128 MiB | 174 | 244 | | random file size | | | +------------------+----------+---------+ | 2MiB .. 8 MiB | 171 | 243 | | random file size | | | +------------------+----------+---------+ Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit b7cbc30e93e3a64ea058230f6d0c764d6d80276f Author: Damien Le Moal Date: Fri Feb 27 22:19:48 2026 +0900 block: rename struct gendisk zone_wplugs_lock field Rename struct gendisk zone_wplugs_lock field to zone_wplugs_hash_lock to clearly indicates that this is the spinlock used for manipulating the hash table of zone write plugs. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe commit c30e8c4bb0e088068a7aae2d98882ec1cfa57d4c Author: Damien Le Moal Date: Fri Feb 27 22:19:47 2026 +0900 block: remove disk_zone_is_full() The helper function disk_zone_is_full() is only used in disk_zone_wplug_is_full(). So remove it and open code it directly in this single caller. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe commit 1084e41deeada93eebfd83572cf29029c24e5443 Author: Damien Le Moal Date: Fri Feb 27 22:19:46 2026 +0900 block: rename and simplify disk_get_and_lock_zone_wplug() disk_get_and_lock_zone_wplug() always returns a zone write plug with the plug lock held. This is unnecessary since this function does not look at the fields of existing plugs, and new plugs need to be locked only after their insertion in the disk hash table, when they are being used. Remove the zone write plug locking from disk_get_and_lock_zone_wplug() and rename this function disk_get_or_alloc_zone_wplug(). blk_zone_wplug_handle_write() is modified to add locking of the zone write plug after calling disk_get_or_alloc_zone_wplug() and before starting to use the plug. This change also simplifies blk_revalidate_seq_zone() as unlocking the plug becomes unnecessary. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 0a8b8af896e0ef83e188e1fe20f98f2bbb1c2459 Author: Damien Le Moal Date: Fri Feb 27 22:19:45 2026 +0900 block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() The function disk_zone_wplug_schedule_bio_work() always takes a reference on the zone write plug of the BIO work being scheduled. This ensures that the zone write plug cannot be freed while the BIO work is being scheduled but has not run yet. However, this unconditional reference taking is fragile since the reference taken is released by the BIO work blk_zone_wplug_bio_work() function, which implies that there always must be a 1:1 relation between the work being scheduled and the work running. Make sure to drop the reference taken when scheduling the BIO work if the work is already scheduled, that is, when queue_work() returns false. Fixes: 9e78c38ab30b ("block: Hold a reference on zone write plugs to schedule submission") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit b7d4ffb510373cc6ecf16022dd0e510a023034fb Author: Damien Le Moal Date: Fri Feb 27 22:19:44 2026 +0900 block: fix zone write plug removal Commit 7b295187287e ("block: Do not remove zone write plugs still in use") modified disk_should_remove_zone_wplug() to add a check on the reference count of a zone write plug to prevent removing zone write plugs from a disk hash table when the plugs are still being referenced by BIOs or requests in-flight. However, this check does not take into account that a BIO completion may happen right after its submission by a zone write plug BIO work, and before the zone write plug BIO work releases the zone write plug reference count. This situation leads to disk_should_remove_zone_wplug() returning false as in this case the zone write plug reference count is at least equal to 3. If the BIO that completes in such manner transitioned the zone to the FULL condition, the zone write plug for the FULL zone will remain in the disk hash table. Furthermore, relying on a particular value of a zone write plug reference count to set the BLK_ZONE_WPLUG_UNHASHED flag is fragile as reading the atomic reference count and doing a comparison with some value is not overall atomic at all. Address these issues by reworking the reference counting of zone write plugs so that removing plugs from a disk hash table can be done directly from disk_put_zone_wplug() when the last reference on a plug is dropped. To do so, replace the function disk_remove_zone_wplug() with disk_mark_zone_wplug_dead(). This new function sets the zone write plug flag BLK_ZONE_WPLUG_DEAD (which replaces BLK_ZONE_WPLUG_UNHASHED) and drops the initial reference on the zone write plug taken when the plug was added to the disk hash table. This function is called either for zones that are empty or full, or directly in the case of a forced plug removal (e.g. when the disk hash table is being destroyed on disk removal). With this change, disk_should_remove_zone_wplug() is also removed. disk_put_zone_wplug() is modified to call the function disk_free_zone_wplug() to remove a zone write plug from a disk hash table and free the plug structure (with a call_rcu()), when the last reference on a zone write plug is dropped. disk_free_zone_wplug() always checks that the BLK_ZONE_WPLUG_DEAD flag is set. In order to avoid having multiple zone write plugs for the same zone in the disk hash table, disk_get_and_lock_zone_wplug() checked for the BLK_ZONE_WPLUG_UNHASHED flag. This check is removed and a check for the new BLK_ZONE_WPLUG_DEAD flag is added to blk_zone_wplug_handle_write(). With this change, we continue preventing adding multiple zone write plugs for the same zone and at the same time re-inforce checks on the user behavior by failing new incoming write BIOs targeting a zone that is marked as dead. This case can happen only if the user erroneously issues write BIOs to zones that are full, or to zones that are currently being reset or finished. Fixes: 7b295187287e ("block: Do not remove zone write plugs still in use") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 0ee8ab5d4dc51704be1157470f3df8090629f9fc Author: Bill Wendling Date: Wed Feb 25 20:51:05 2026 +0000 block: annotate struct request_queue with __counted_by_ptr The queue_hw_ctx field in struct request_queue is an array of pointers to struct blk_mq_hw_ctx. The number of elements in this array is tracked by the nr_hw_queues field. The array is allocated in __blk_mq_realloc_hw_ctxs() using kcalloc_node() with set->nr_hw_queues elements. q->nr_hw_queues is subsequently updated to set->nr_hw_queues. When growing the array, the new array is assigned to queue_hw_ctx before nr_hw_queues is updated. This is safe because nr_hw_queues (the old smaller count) is used for bounds checking, which is within the new larger allocation. When shrinking the array, nr_hw_queues is updated to the smaller value, while queue_hw_ctx retains the larger allocation. This is also safe as the count is within the allocation bounds. Annotating queue_hw_ctx with __counted_by_ptr(nr_hw_queues) allows the compiler (with kSAN) to verify that accesses to queue_hw_ctx are within the valid range defined by nr_hw_queues. This patch was generated by CodeMender and reviewed by Bill Wendling. Tested by running blktests. Reviewed-by: Daniel Wagner Signed-off-by: Bill Wendling [axboe: massage commit message] Signed-off-by: Jens Axboe commit 0cc9293bccb234552b81c3ebc074f5839f019e01 Author: Ondrej Kozina Date: Fri Feb 6 15:18:03 2026 +0100 sed-opal: add IOC_OPAL_GET_SUM_STATUS ioctl. This adds a function for retrieving the set of Locking objects enabled for Single User Mode (SUM) and the value of the RangeStartRangeLengthPolicy parameter. It retrieves data from the LockingInfo table, specifically the columns SingleUserModeRanges and RangeStartLengthPolicy, which were added according to the TCG Opal Feature Set: Single User Mode, as described in chapters 4.4.3.1 and 4.4.3.2. Signed-off-by: Ondrej Kozina Reviewed-and-tested-by: Milan Broz Signed-off-by: Jens Axboe commit 661025cdbc976eadbdfb4c8fcf6d4ead5c67e645 Author: Ondrej Kozina Date: Fri Feb 6 15:18:02 2026 +0100 sed-opal: increase column attribute type size to 64 bits. Change the column parameter in response_get_column() from u8 to u64 to support the full range of column identifiers. Signed-off-by: Ondrej Kozina Reviewed-and-tested-by: Milan Broz Signed-off-by: Jens Axboe commit a441a9d22433fea561de131e27fff41715c2d186 Author: Ondrej Kozina Date: Fri Feb 6 15:18:01 2026 +0100 sed-opal: add IOC_OPAL_ENABLE_DISABLE_LR. This ioctl is used to set up RLE (read lock enabled) and WLE (write lock enabled) parameters of the Locking object. In Single User Mode (SUM), if the RangeStartRangeLengthPolicy parameter is set in the 'Reactivate' method, only Admin authority maintains the locking range length and start (offset) attributes of Locking objects set up for SUM. All other attributes from struct opal_user_lr_setup (RLE - read locking enabled, WLE - write locking enabled) shall remain in possession of the User authority associated with the Locking object set for SUM. With the IOC_OPAL_ENABLE_DISABLE_LR ioctl, the opal_user_lr_setup members 'range_start' and 'range_length' of the ioctl argument are ignored. Signed-off-by: Ondrej Kozina Reviewed-and-tested-by: Milan Broz Signed-off-by: Jens Axboe commit 8e3d34a7ce7386b01947dd649bd24775544e4d3e Author: Ondrej Kozina Date: Fri Feb 6 15:18:00 2026 +0100 sed-opal: add IOC_OPAL_LR_SET_START_LEN ioctl. This ioctl is used to set up locking range start (offset) and locking range length attributes only. In Single User Mode (SUM), if the RangeStartRangeLengthPolicy parameter is set in the 'Reactivate' method, only Admin authority maintains the locking range length and start (offset) attributes of Locking objects set up for SUM. All other attributes from struct opal_user_lr_setup (RLE - read locking enabled, WLE - write locking enabled) shall remain in possession of the User authority associated with the Locking object set for SUM. Therefore, we need a separate function for setting up locking range start and locking range length because it may require two different authorities (and sessions) if the RangeStartRangeLengthPolicy attribute is set. With the IOC_OPAL_LR_SET_START_LEN ioctl, the opal_user_lr_setup members 'RLE' and 'WLE' of the ioctl argument are ignored. Signed-off-by: Ondrej Kozina Reviewed-and-tested-by: Milan Broz Signed-off-by: Jens Axboe commit 8ff71e6b961beea2ab25850b285287a3350bce92 Author: Ondrej Kozina Date: Fri Feb 6 15:17:59 2026 +0100 sed-opal: refactor (split) IOC_OPAL_LR_SETUP internals. IOC_OPAL_LR_SETUP is used to set up a locking range entirely under a single authority (usually Admin1), but for Single User Mode (SUM), the permissions for attributes (RangeStart, RangeLength) and (ReadLockEnable, WriteLockEnable, ReadLocked, WriteLocked) may be split between two different authorities. Typically, it is Admin1 for the former and the User associated with the LockingRange in SUM for the latter. This commit only splits the internals in preparation for the introduction of separate ioctls for setting RangeStart, RangeLength and the rest using new ioctl calls. Signed-off-by: Ondrej Kozina Reviewed-and-tested-by: Milan Broz Signed-off-by: Jens Axboe commit aca086ff27c3f67e81617e4b063d1126544a4f19 Author: Ondrej Kozina Date: Fri Feb 6 15:17:58 2026 +0100 sed-opal: add IOC_OPAL_REACTIVATE_LSP. This adds the 'Reactivate' method as described in the "TCG Storage Opal SSC Feature Set: Single User Mode" document (ch. 3.1.1.1). The method enables switching an already active SED OPAL2 device, with appropriate firmware support for Single User Mode (SUM), to or from SUM. Signed-off-by: Ondrej Kozina Reviewed-and-tested-by: Milan Broz Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit c6c9dc91cb5fd30d2e11e7f2ae570e614b013ee1 Author: Ondrej Kozina Date: Fri Feb 6 15:17:57 2026 +0100 sed-opal: add Admin1PIN parameter. As desribed in ch. 3.1.1.1.1.3 of TCG Storage Opal SSC Feature Set: Single User Mode document. To be used later in Reactivate method implementation. Signed-off-by: Ondrej Kozina Reviewed-and-tested-by: Milan Broz Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit a184058fb4d3cfcce1a2b4e021451dcc2e88d9c6 Author: Ondrej Kozina Date: Fri Feb 6 15:17:56 2026 +0100 sed-opal: add RangeStartRangeLengthPolicy parameter. As desribed in ch. 3.1.1.1.1.2 of TCG Storage Opal SSC Feature Set: Single User Mode document. To be used later in Reactivate method implementation and in function for retrieving SUM device status. Signed-off-by: Ondrej Kozina Reviewed-and-tested-by: Milan Broz Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit b26f29b6692f362a343f7cce2e716a16a8fee488 Author: Ondrej Kozina Date: Fri Feb 6 15:17:55 2026 +0100 sed-opal: add UID of Locking Table. As described in ch. 6.3, Table 240 in TCG Storage Architecture Core Specification document. It's also referenced in TCG Storage Opal SSC Feature Set: Single User Mode document, ch. 3.1.1.1 Reactivate method. It will be used later in Reactivate method implemetation for sed-opal interface. Signed-off-by: Ondrej Kozina Reviewed-and-tested-by: Milan Broz Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit c13cee2fc7f137dd25ed50c63eddcc578624f204 Author: Eric Biggers Date: Thu Mar 5 19:35:57 2026 -0800 lib/crc: tests: Add a .kunitconfig file Add a .kunitconfig file to the lib/crc/ directory so that the CRC library tests can be run more easily using kunit.py. Example with UML: tools/testing/kunit/kunit.py run --kunitconfig=lib/crc Example with QEMU: tools/testing/kunit/kunit.py run --kunitconfig=lib/crc --arch=arm64 --make_options LLVM=1 Link: https://lore.kernel.org/r/20260306033557.250499-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit cdf22aeaad8430905c3aa3b3d0f2686c65395c22 Author: Eric Biggers Date: Thu Mar 5 19:35:56 2026 -0800 lib/crc: tests: Add CRC_ENABLE_ALL_FOR_KUNIT Now that crc_kunit uses the standard "depends on" pattern, enabling the full set of CRC tests is a bit difficult, mainly due to CRC7 being rarely used. Add a kconfig option to make it easier. It is visible only when KUNIT, so hopefully the extra prompt won't be too annoying. Link: https://lore.kernel.org/r/20260306033557.250499-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 85c9f3a2b805eb96d899da7bcc38a16459aa3c16 Author: Eric Biggers Date: Thu Mar 5 19:35:55 2026 -0800 lib/crc: tests: Make crc_kunit test only the enabled CRC variants Like commit 4478e8eeb871 ("lib/crypto: tests: Depend on library options rather than selecting them") did with the crypto library tests, make crc_kunit depend on the code it tests rather than selecting it. This follows the standard convention for KUnit and fixes an issue where enabling KUNIT_ALL_TESTS enabled non-test code. crc_kunit does differ from the crypto library tests in that it consolidates the tests for multiple CRC variants, with 5 kconfig options, into one KUnit suite. Since depending on *all* of these kconfig options would greatly restrict the ability to enable crc_kunit, instead just depend on *any* of these options. Update crc_kunit accordingly to test only the reachable code. Alternatively we could split crc_kunit into 5 test suites. But keeping it as one is simpler for now. Fixes: e47d9b1a76ed ("lib/crc_kunit.c: add KUnit test suite for CRC library functions") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260306033557.250499-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 84226677e04154000d13bb2792c4837b691ccb34 Author: Keith Busch Date: Tue Feb 17 08:08:34 2026 -0800 PCI: Rename __pci_bus_reset() and __pci_slot_reset() Make the code a little easier to navigate with more descriptive function names. The two renamed functions here "try" to do to a reset, so make that clear in the name to distinguish them from other similarly named functions: __pci_reset_bus() -> pci_try_reset_bus() __pci_reset_slot() -> pci_try_reset_slot() Signed-off-by: Keith Busch Signed-off-by: Bjorn Helgaas Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260217160836.2709885-2-kbusch@meta.com commit ce260754bb435aea18e6a1a1ce3759249013f5a4 Author: David Howells Date: Wed Feb 25 17:00:05 2026 -0800 crypto: jitterentropy - Use SHA-3 library Make the jitterentropy RNG use the SHA-3 library API instead of crypto_shash. This ends up being quite a bit simpler, as various dynamic allocations and error checks become unnecessary. Signed-off-by: David Howells Co-developed-by: Eric Biggers Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260226010005.43528-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 5e07ce466356d9833757b2d6c0380b6ee7b11a77 Author: Eric Biggers Date: Wed Feb 18 13:35:01 2026 -0800 wifi: mac80211: Use AES-CMAC library in aes_s2v() Now that AES-CMAC has a library API, convert aes_s2v() to use it instead of a "cmac(aes)" crypto_shash. The result is faster and simpler code. It's also more reliable, since with the library the only step that can fail is preparing the key. In contrast, crypto_shash_digest(), crypto_shash_init(), crypto_shash_update(), and crypto_shash_final() could all fail and return an errno value. aes_s2v() ignored these errors, which was a bug. So that bug is fixed as well. As part of this, change the prototype of aes_s2v() to take the raw key directly instead of a prepared key. Its only two callers prepare a key for each call, so it might as well be done directly in aes_s2v(). Since this removes the last dependency on the "cmac(aes)" crypto_shash from mac80211, also remove the 'select CRYPTO_CMAC'. Acked-by: Johannes Berg Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260218213501.136844-16-ebiggers@kernel.org Signed-off-by: Eric Biggers commit c9de7246d5422bbea5374a402e761cf7725a263e Author: Eric Biggers Date: Wed Feb 18 13:35:00 2026 -0800 wifi: mac80211: Use AES-CMAC library in ieee80211_aes_cmac() Now that AES-CMAC has a library API, convert the mac80211 AES-CMAC packet authentication code to use it instead of a "cmac(aes)" crypto_shash. This has multiple benefits, such as: - It's faster. The AES-CMAC code is now called directly, without unnecessary overhead such as indirect calls. - MAC calculation can no longer fail. - The AES-CMAC key struct is now a fixed size, allowing it to be embedded directly into 'struct ieee80211_key' rather than using a separate allocation. Note that although this increases the size of the 'u.cmac' field of 'struct ieee80211_key', it doesn't cause it to exceed the size of the largest variant of the union 'u'. Therefore, the size of 'struct ieee80211_key' itself is unchanged. Acked-by: Johannes Berg Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260218213501.136844-15-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2505f9157ebf2bbdb7b1c0ff1cb7274e651ab028 Author: Eric Biggers Date: Wed Feb 18 13:34:53 2026 -0800 lib/crypto: aes: Add FIPS self-test for CMAC Add a FIPS cryptographic algorithm self-test for AES-CMAC to fulfill the self-test requirement when this code is built into a FIPS 140 cryptographic module. This provides parity with the traditional crypto API, which uses crypto/testmgr.c to meet the FIPS self-test requirement. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260218213501.136844-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a348fd1f6eee5b8f5bf159c9d95d35cc54d17699 Author: Eric Biggers Date: Wed Feb 18 13:34:52 2026 -0800 lib/crypto: tests: Add KUnit tests for CBC-based MACs Add a KUnit test suite for the AES-CMAC, AES-XCBC-MAC, and AES-CBC-MAC library functions. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260218213501.136844-7-ebiggers@kernel.org Link: https://lore.kernel.org/r/20260306001917.24105-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 58286738b159ca93d41438a6ddcc2ea5333191b4 Author: Eric Biggers Date: Wed Feb 18 13:34:51 2026 -0800 lib/crypto: arm64/aes: Migrate optimized CBC-based MACs into library Instead of exposing the arm64-optimized CMAC, XCBC-MAC, and CBC-MAC code via arm64-specific crypto_shash algorithms, instead just implement the aes_cbcmac_blocks_arch() library function. This is much simpler, it makes the corresponding library functions be arm64-optimized, and it fixes the longstanding issue where this optimized code was disabled by default. The corresponding algorithms still remain available through crypto_shash, but individual architectures no longer need to handle it. Note that to be compatible with the library using 'size_t' lengths, the type of the return value and 'blocks' parameter to the assembly functions had to be changed to 'size_t', and the assembly code had to be updated accordingly to use the corresponding 64-bit registers. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260218213501.136844-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 4b908403209252e59ecad4c068bf967fa3f07525 Author: Eric Biggers Date: Wed Feb 18 13:34:50 2026 -0800 lib/crypto: arm64/aes: Move assembly code for AES modes into libaes To migrate the support for CBC-based MACs into libaes, the corresponding arm64 assembly code needs to be moved there. However, the arm64 AES assembly code groups many AES modes together; individual modes aren't easily separable. (This isn't unique to arm64; other architectures organize their AES modes similarly.) Since the other AES modes will be migrated into the library eventually too, just move the full assembly files for the AES modes into the library. (This is similar to what I already did for PowerPC and SPARC.) Specifically: move the assembly files aes-ce.S, aes-modes.S, and aes-neon.S and their build rules; declare the assembly functions in ; and export the assembly functions from libaes. Note that the exports and public declarations of the assembly functions are temporary. They exist only to keep arch/arm64/crypto/ working until the AES modes are fully moved into the library. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260218213501.136844-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit f8f08d7cc43237e91e3aedf7b67d015d24c38fcc Author: Eric Biggers Date: Wed Feb 18 13:34:49 2026 -0800 crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Since the 'enc_after' argument to neon_aes_mac_update() and ce_aes_mac_update() has type 'int', it needs to be accessed using the corresponding 32-bit register, not the 64-bit register. The upper half of the corresponding 64-bit register may contain garbage. Fixes: 4860620da7e5 ("crypto: arm64/aes - add NEON/Crypto Extensions CBCMAC/CMAC/XCBC driver") Cc: stable@vger.kernel.org Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260218213501.136844-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 7137cbf2b5c9feb6302d6da116eab2047c5f05d2 Author: Eric Biggers Date: Wed Feb 18 13:34:48 2026 -0800 crypto: aes - Add cmac, xcbc, and cbcmac algorithms using library Update the "aes" module to implement "cmac(aes)", "xcbc(aes)", and "cbcmac(aes)" algorithms using the corresponding library functions, and register these with the crypto_shash API. Each algorithm is included only if the corresponding existing kconfig option is enabled. This allows the architecture-optimized implementations of these algorithms to continue to be accessible via the crypto_shash API once they are migrated into the library. For "xcbc(aes)", I also fixed the bug where AES key lengths other than 128 bits were allowed, so that this bug didn't have to be implemented in the library. The AES-XCBC-MAC specification (RFC 3566) is clear that key lengths other than 128 bits MUST NOT be supported. AES-XCBC-MAC derives a 128-bit subkey internally, so the nonstandard support for longer AES keys didn't really work: AES-128 was still used internally. In the unlikely event that someone is actually relying on the broken and nonstandard support for longer AES-XCBC-MAC keys, we can fairly easily reintroduce it. But it seems unnecessary: the only user of "xcbc(aes)" seems to be IPsec, which uses 128-bit keys with it. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260218213501.136844-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 309a7e514da7d53e05b5d053594f6aabb0d382b5 Author: Eric Biggers Date: Wed Feb 18 13:34:47 2026 -0800 lib/crypto: aes: Add support for CBC-based MACs Add support for CBC-based MACs to the AES library, specifically AES-CMAC, AES-XCBC-MAC, and AES-CBC-MAC. Of these three algorithms, AES-CMAC is the most modern and the most commonly used. Use cases for the AES-CMAC library include the kernel's SMB client and server, and the bluetooth and mac80211 drivers. Support for AES-XCBC-MAC and AES-CBC-MAC is included so that there will be no performance regression in the "xcbc(aes)" and "ccm(aes)" support in the traditional crypto API once the arm64-optimized code is migrated into the library. AES-XCBC-MAC is given its own key preparation function but is otherwise identical to AES-CMAC and just reuses the AES-CMAC structs and functions. The implementation automatically uses the optimized AES key expansion and single block en/decryption functions. It also allows architectures to provide an optimized implementation of aes_cbcmac_blocks(), which allows the existing arm64-optimized code for these modes to be used. Just put the code for these modes directly in the libaes module rather than in a separate module. This is simpler, it makes it easier to share code between AES modes, and it increases the amount of inlining that is possible. (Indeed, for these reasons, most of the architecture-optimized AES code already provides multiple modes per module. x86 for example has only a single aesni-intel module. So to a large extent, this design choice just reflects the status quo.) However, since there are a lot of AES modes, there's still some value in omitting modes that are not needed at all in a given kernel. Therefore, make these modes an optional feature of libaes, controlled by CONFIG_CRYPTO_LIB_AES_CBC_MACS. This seems like a good middle ground. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260218213501.136844-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 981b080a79724738882b0af1c5bb7ade30d94f24 Author: Felix Gu Date: Wed Mar 4 20:47:21 2026 +0800 spi: fsl-qspi: Use reinit_completion() for repeated operations The driver currently calls init_completion() during every spi_mem_op. Tchnically it may work, but it's not the recommended pattern. According to the kernel documentation: Calling init_completion() on the same completion object twice is most likely a bug as it re-initializes the queue to an empty queue and enqueued tasks could get "lost" - use reinit_completion() in that case, but be aware of other races. So moves the initial initialization to probe function and uses reinit_completion() for subsequent operations. Fixes: 84d043185dbe ("spi: Add a driver for the Freescale/NXP QuadSPI controller") Signed-off-by: Felix Gu Reviewed-by: Haibo Chen Link: https://patch.msgid.link/20260304-spi-nxp-v2-3-cd7d7726a27e@gmail.com Signed-off-by: Mark Brown commit 68c8c93fdb0de7e528dc3dfb1d17eb0f652259b8 Author: Felix Gu Date: Wed Mar 4 20:47:20 2026 +0800 spi: nxp-fspi: Use reinit_completion() for repeated operations The driver currently calls init_completion() during every spi_mem_op. Tchnically it may work, but it's not the recommended pattern. According to the kernel documentation: Calling init_completion() on the same completion object twice is most likely a bug as it re-initializes the queue to an empty queue and enqueued tasks could get "lost" - use reinit_completion() in that case, but be aware of other races. So moves the initial initialization to probe function and uses reinit_completion() for subsequent operations. Fixes: a5356aef6a90 ("spi: spi-mem: Add driver for NXP FlexSPI controller") Signed-off-by: Felix Gu Reviewed-by: Haibo Chen Link: https://patch.msgid.link/20260304-spi-nxp-v2-2-cd7d7726a27e@gmail.com Signed-off-by: Mark Brown commit 40f9bc646db5aa89fb85f2cda1e55a2bf9d6a30c Author: Felix Gu Date: Wed Mar 4 20:47:19 2026 +0800 spi: nxp-xspi: Use reinit_completion() for repeated operations The driver currently calls init_completion() during every spi_mem_op. Tchnically it may work, but it's not the recommended pattern. According to the kernel documentation: Calling init_completion() on the same completion object twice is most likely a bug as it re-initializes the queue to an empty queue and enqueued tasks could get "lost" - use reinit_completion() in that case, but be aware of other races. So moves the initial initialization to probe function and uses reinit_completion() for subsequent operations. Fixes: 29c8c00d9f9d ("spi: add driver for NXP XSPI controller") Reviewed-by: Haibo Chen Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260304-spi-nxp-v2-1-cd7d7726a27e@gmail.com Signed-off-by: Mark Brown commit b8840942644cd76438a192ff493c60ec2169f7ef Author: Tejun Heo Date: Mon Mar 9 10:06:02 2026 -1000 sched_ext: Replace system_unbound_wq with system_dfl_wq in scx_kobj_release() c2a57380df9d ("sched: Replace use of system_unbound_wq with system_dfl_wq") converted system_unbound_wq usages in ext.c but missed the queue_rcu_work() call in scx_kobj_release() which was added later by the dynamic scx_sched allocation conversion. Apply the same conversion. Signed-off-by: Tejun Heo Cc: Marco Crivellari commit 0e7cd9cef61fde36ebfb653fe9e7a9722185cb57 Merge: bec10581e92289 54a66e431eeacf Author: Tejun Heo Date: Mon Mar 9 09:59:36 2026 -1000 Merge branch 'sched/core' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into for-7.1 Pull sched/core to resolve conflicts between: c2a57380df9dd ("sched: Replace use of system_unbound_wq with system_dfl_wq") from the tip tree and commit: cde94c032b32b ("sched_ext: Make watchdog sub-sched aware") The latter moves around code modiefied by the former. Apply the changes in the new locations. Signed-off-by: Tejun Heo commit ed0313223ce6514dbd39c049e25f702980d7e3cc Author: Josh Poimboeuf Date: Mon Mar 9 09:03:06 2026 -0700 ASoC: codecs: wcd9335: Remove potential undefined behavior in wcd9335_slimbus_irq() If 'port_id' is negative, the shift counts in wcd9335_slimbus_irq() also become negative, resulting in undefined behavior due to shift out of bounds. That appears to be not possible, but with UBSAN enabled, Clang's range analysis isn't always able to determine that and generates undefined behavior. As a result the code generation isn't optimal, and undefined behavior should be avoided regardless. Improve code generation and remove the undefined behavior by converting the signed variables to unsigned. Fixes the following warning: sound/soc/codecs/wcd9335.o: warning: objtool: wcd9335_slimbus_irq() falls through to next function __cfi_wcd9335_set_channel_map() This is very similar to a previous fix to wcd934x with commit 060aed9c0093 ("objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler()"). Cc: Srinivas Kandagatla Cc: Liam Girdwood Cc: Mark Brown Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/a426d669-58bb-4be1-9eaa-6f3d83109e2d@app.fastmail.com Signed-off-by: Josh Poimboeuf Link: https://patch.msgid.link/08dbb63519ef31a5457e07673b7b256fecb5989b.1773071992.git.jpoimboe@kernel.org Signed-off-by: Mark Brown commit 87e49eb0918154f64f736d5271e9e3fe566f82b1 Author: Richard Fitzgerald Date: Mon Mar 9 14:53:10 2026 +0000 ASoC: wm_adsp: Make wm_adsp_fw_text[] const Add the extra const to wm_adsp_fw_text[] to make the array data const. This array should have been const data but was missing the second const that is needed when declaring a const array of const pointers. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260309145310.1199583-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit bec10581e92289bdc3eed17e90200900ddb00594 Author: Zhao Mengmeng Date: Mon Mar 9 10:28:46 2026 +0800 sched_ext: remove SCX_OPS_HAS_CGROUP_WEIGHT While running scx_flatcg, dmesg prints "SCX_OPS_HAS_CGROUP_WEIGHT is deprecated and a noop", in code, SCX_OPS_HAS_CGROUP_WEIGHT has been marked as DEPRECATED, and will be removed on 6.18. Now it's time to do it. Signed-off-by: Zhao Mengmeng Signed-off-by: Tejun Heo commit 6e5cbf46c27ae46f13c7ac830e618c6e0b1ed07c Author: Rafael J. Wysocki Date: Thu Mar 5 21:11:22 2026 +0100 ACPI: PAD: Rearrange notify handler installation and removal Use acpi_dev_install_notify_handler() and acpi_dev_remove_notify_handler() for installing and removing the ACPI notify handler, respectively, which allows acpi_pad_notify() and acpi_pad_remove() to be simplified quite a bit. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2011993.taCxCBeP46@rafael.j.wysocki commit 6a0c7d388b6a19899ab0db60325699980706fb11 Author: Rafael J. Wysocki Date: Thu Mar 5 21:10:38 2026 +0100 ACPI: AC: Get rid of unnecessary declarations Drop unnecessary forward declarations of 4 functions and move the SIMPLE_DEV_PM_OPS() definition after the definition of the resume callback function. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3757869.R56niFO833@rafael.j.wysocki commit 638a95168fd53a911201681cd5e55c7965b20733 Author: Jingkai Tan Date: Thu Mar 5 21:38:31 2026 +0000 ACPI: processor: idle: Add missing bounds check in flatten_lpi_states() The inner loop in flatten_lpi_states() that combines composite LPI states can increment flat_state_cnt multiple times within the loop. The condition that guards this (checks bounds against ACPI_PROCESSOR _MAX_POWER) occurs at the top of the outer loop. flat_state_cnt might exceed ACPI_PROCESSOR_MAX_POWER if it is incremented multiple times within the inner loop between outer loop iterations. Add a bounds check after the increment inside the inner loop so that it breaks out when flat_state_cnt reaches ACPI_PROCESSOR_MAX_POWER. The existing check in the outer loop will then handle the warning. Signed-off-by: Jingkai Tan Reviewed-by: Sudeep Holla Link: https://patch.msgid.link/20260305213831.53985-1-contact@jingk.ai Signed-off-by: Rafael J. Wysocki commit bfb18fd193e2413f02ad934e46887f415f0ce4ec Author: Jayesh Choudhary Date: Tue Dec 9 17:33:32 2025 +0530 drm/bridge: cadence: cdns-mhdp8546-core: Reduce log level for DPCD read/write Reduce the log level for cdns_mhdp_dpcd_read and cdns_mhdp_dpcd_write errors in cdns_mhdp_transfer function as in case of failure, there is flooding of these prints along with other indicators like EDID failure logs which are fairly intuitive in themselves rendering these error logs useless. Also, the caller functions for the cdns_mhdp_transfer in drm_dp_helper.c (which calls it 32 times), has debug log level in case transfer fails. So having a superseding log level in cdns_mhdp_transfer seems bad. Reviewed-by: Tomi Valkeinen Signed-off-by: Jayesh Choudhary Signed-off-by: Harikrishna Shenoy Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20251209120332.3559893-7-h-shenoy@ti.com Signed-off-by: Luca Ceresoli commit 0d9e84d304575029815681e06f755075c64ee85d Author: Jayesh Choudhary Date: Tue Dec 9 17:33:31 2025 +0530 cadence: cdns-mhdp8546*: Change drm_connector from structure to pointer Now that we have dropped the legacy code which became redundant with introduction of DRM_BRIDGE_ATTACH_NO_CONNECTOR usecase in driver,we can cleanly switch to drm_connector pointer instead of structure. Rename the connector_ptr member variable to connector for clarity and consistency. The driver was using both connector and connector_ptr members, but connector_ptr was the only one actually used throughout the code. This change removes the unused connector struct member and renames connector_ptr to connector for better readability. This is purely a code cleanup change with no functional impact. All references to connector_ptr are updated to use the renamed connector variable throughout the driver. Reviewed-by: Dmitry Baryshkov Signed-off-by: Jayesh Choudhary Signed-off-by: Harikrishna Shenoy Reviewed-by: Luca Ceresoli Reviewed-by: Tomi Valkeinen Link: https://patch.msgid.link/20251209120332.3559893-6-h-shenoy@ti.com Signed-off-by: Luca Ceresoli commit 35cf2554520c8ec59f12e08ded72ed11895fffc6 Author: Jayesh Choudhary Date: Tue Dec 9 17:33:30 2025 +0530 drm/bridge: cadence: cdns-mhdp8546-core: Remove legacy support for connector initialisation in bridge Now that this bridge supports DRM_BRIDGE_ATTACH_NO_CONNECTOR, and only TI K3 platforms consume this driver and tidss (their display controller) has DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set,we can remove the legacy code for the non-DRM_BRIDGE_ATTACH_NO_CONNECTOR case. Reviewed-by: Dmitry Baryshkov Signed-off-by: Jayesh Choudhary Signed-off-by: Harikrishna Shenoy Reviewed-by: Luca Ceresoli Reviewed-by: Tomi Valkeinen Link: https://patch.msgid.link/20251209120332.3559893-5-h-shenoy@ti.com Signed-off-by: Luca Ceresoli commit 4a8edd658489ec2a3d7e20482fa9e8d366153d8d Author: Harikrishna Shenoy Date: Tue Dec 9 17:33:29 2025 +0530 drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check Now that we have DRM_BRIDGE_ATTACH_NO_CONNECTOR framework, handle the HDCP state change in bridge atomic check as well to enable correct functioning for HDCP in both DRM_BRIDGE_ATTACH_NO_CONNECTOR and !DRM_BRIDGE_ATTACH_NO_CONNECTOR case. Without this patch, when using DRM_BRIDGE_ATTACH_NO_CONNECTOR flag, HDCP state changes would not be properly handled during atomic commits, potentially leading to HDCP authentication failures or incorrect protection status for content requiring HDCP encryption. Fixes: 6a3608eae6d33 ("drm: bridge: cdns-mhdp8546: Enable HDCP") Signed-off-by: Harikrishna Shenoy Reviewed-by: Luca Ceresoli Reviewed-by: Tomi Valkeinen Link: https://patch.msgid.link/20251209120332.3559893-4-h-shenoy@ti.com Signed-off-by: Luca Ceresoli commit 6dbff34016052b099558b76632e4983e2df13fed Author: Jayesh Choudhary Date: Tue Dec 9 17:33:28 2025 +0530 drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs Add cdns_mhdp_bridge_mode_valid() to check if specific mode is valid for this bridge or not. In the legacy usecase with !DRM_BRIDGE_ATTACH_NO_CONNECTOR we were using the hook from drm_connector_helper_funcs but with DRM_BRIDGE_ATTACH_NO_CONNECTOR we need to have mode_valid() in drm_bridge_funcs. Without this patch, when using DRM_BRIDGE_ATTACH_NO_CONNECTOR flag, the cdns_mhdp_bandwidth_ok() function would not be called during mode validation, potentially allowing modes that exceed the bridge's bandwidth capabilities to be incorrectly marked as valid. Fixes: c932ced6b585 ("drm/tidss: Update encoder/bridge chain connect model") Reviewed-by: Tomi Valkeinen Signed-off-by: Jayesh Choudhary Signed-off-by: Harikrishna Shenoy Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20251209120332.3559893-3-h-shenoy@ti.com Signed-off-by: Luca Ceresoli commit 43d6508ddbf9fb974fbc359a033154f78c9d4c8b Author: Jayesh Choudhary Date: Tue Dec 9 17:33:27 2025 +0530 drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() In case if we get errors in cdns_mhdp_link_up() or cdns_mhdp_reg_read() in atomic_enable, we will go to cdns_mhdp_modeset_retry_fn() and will hit NULL pointer while trying to access the mutex. We need the connector to be set before that. Unlike in legacy cases with flag !DRM_BRIDGE_ATTACH_NO_CONNECTOR, we do not have connector initialised in bridge_attach(), so add the mhdp->connector_ptr in device structure to handle both cases with DRM_BRIDGE_ATTACH_NO_CONNECTOR and !DRM_BRIDGE_ATTACH_NO_CONNECTOR, set it in atomic_enable() earlier to avoid possible NULL pointer dereference in recovery paths like modeset_retry_fn() with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set. Fixes: c932ced6b585 ("drm/tidss: Update encoder/bridge chain connect model") Signed-off-by: Jayesh Choudhary Signed-off-by: Harikrishna Shenoy Reviewed-by: Luca Ceresoli Reviewed-by: Tomi Valkeinen Link: https://patch.msgid.link/20251209120332.3559893-2-h-shenoy@ti.com Signed-off-by: Luca Ceresoli commit 878004e2852bc22ce0687c5597d6fe3909fb59f3 Author: Randy Dunlap Date: Fri Mar 6 14:10:32 2026 -0800 iopoll: fix function parameter names in read_poll_timeout_atomic() Correct the function parameter names to avoid kernel-doc warnings and to emphasize this function is atomic (non-sleeping). Warning: include/linux/iopoll.h:169 function parameter 'sleep_us' not described in 'read_poll_timeout_atomic' Warning: ../include/linux/iopoll.h:169 function parameter 'sleep_before_read' not described in 'read_poll_timeout_atomic' Fixes: 9df8043a546d ("iopoll: Generalize read_poll_timeout() into poll_timeout_us()") Signed-off-by: Randy Dunlap Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260306221033.2357305-1-rdunlap@infradead.org Signed-off-by: Jani Nikula commit 5c8d16ac49405c5b77c955684849528f7d4d6b81 Author: Tamir Duberstein Date: Tue Jan 27 08:55:51 2026 -0500 scripts: generate_rust_analyzer.py: reduce cfg plumbing Pass `pin_init{,_internal}-cfgs` from rust/Makefile to scripts/generate_rust_analyzer.py. Remove hardcoded `cfg`s in scripts/generate_rust_analyzer.py for `pin-init{,-internal}` now that these are passed from `rust/Makefile`. Centralize `cfg` lookup in scripts/generate_rust_analyzer.py in `append_crate` to avoid having to do so for each crate. Reviewed-by: Jesung Yang Acked-by: Benno Lossin Acked-by: Miguel Ojeda Link: https://patch.msgid.link/20260127-rust-analyzer-pin-init-duplication-v3-2-118c48c35e88@kernel.org Signed-off-by: Tamir Duberstein commit dc6b431f18cfb1e8cc7da45c16ccf371bcd636d5 Author: Eliot Courtney Date: Tue Jan 20 17:52:50 2026 +0900 scripts: generate_rust_analyzer.py: rename cfg to generated_cfg This variable is for the cfg from generated files. It's also easy to confuse with the `cfg` parameter in append_crate(), so rename it. [ Changed title to include script extension. - Tamir ] Signed-off-by: Eliot Courtney Reviewed-by: Tamir Duberstein Link: https://patch.msgid.link/20260120-ra-fix-v1-1-829e4e92818c@nvidia.com Signed-off-by: Tamir Duberstein commit 9b4744d8eda2824041064a5639ccbb079850914d Author: Tamir Duberstein Date: Tue Jan 27 11:35:43 2026 -0500 scripts: generate_rust_analyzer.py: avoid FD leak Use `pathlib.Path.read_text()` to avoid leaking file descriptors. Fixes: 8c4555ccc55c ("scripts: add `generate_rust_analyzer.py`") Cc: stable@vger.kernel.org Reviewed-by: Daniel Almeida Reviewed-by: Fiona Behrens Reviewed-by: Trevor Gross Link: https://patch.msgid.link/20260127-rust-analyzer-fd-leak-v2-1-1bb55b9b6822@kernel.org Signed-off-by: Tamir Duberstein commit 36c619f6bd793493294becb10a02fea370b67a91 Author: Tamir Duberstein Date: Thu Jan 22 11:53:28 2026 -0500 scripts: generate_rust_analyzer.py: define scripts Add IDE support for host-side scripts written in Rust. This support has been missing since these scripts were initially added in commit 9a8ff24ce584 ("scripts: add `generate_rust_target.rs`"), thus add it. Change the existing instance of extension stripping to `pathlib.Path.stem` to maintain code consistency. Fixes: 9a8ff24ce584 ("scripts: add `generate_rust_target.rs`") Cc: stable@vger.kernel.org Reviewed-by: Daniel Almeida Reviewed-by: Fiona Behrens Reviewed-by: Trevor Gross Link: https://patch.msgid.link/20260122-rust-analyzer-scripts-v1-1-ff6ba278170e@kernel.org Signed-off-by: Tamir Duberstein commit 75c0fb25b56dc3ef122b1ac2dbb7bc9b31937408 Author: Tamir Duberstein Date: Thu Jan 22 12:30:48 2026 -0500 scripts: generate_rust_analyzer.py: identify crates explicitly Use the return of `append_crate` to declare dependency on that crate. This removes the need to build an index of crates and allows multiple crates with the same display_name be defined, which allows e.g. host crates to be defined separately from target crates. Reviewed-by: Fiona Behrens Reviewed-by: Daniel Almeida Tested-by: Daniel Almeida Reviewed-by: Trevor Gross Reviewed-by: Jesung Yang Tested-by: Jesung Yang Link: https://patch.msgid.link/20260122-rust-analyzer-types-v1-4-29cc2e91dcd5@kernel.org Signed-off-by: Tamir Duberstein commit 94a3b2d9877eee2f8b5b41a51d99b7860efbd34d Author: Tamir Duberstein Date: Thu Jan 22 12:30:47 2026 -0500 scripts: generate_rust_analyzer.py: add type hints Python type hints allow static analysis tools like mypy to detect type errors during development, improving the developer experience. Python type hints have been present in the kernel since 2019 at the latest; see commit 6ebf5866f2e8 ("kunit: tool: add Python wrappers for running KUnit tests"). Add a subclass of `argparse.Namespace` to get type checking on the CLI arguments. Run `mypy --strict scripts/generate_rust_analyzer.py --python-version 3.9` to verify. Note that `mypy` no longer supports python < 3.9. Tested-by: Daniel Almeida Reviewed-by: Daniel Almeida Reviewed-by: Trevor Gross Reviewed-by: Jesung Yang Tested-by: Jesung Yang Link: https://patch.msgid.link/20260122-rust-analyzer-types-v1-3-29cc2e91dcd5@kernel.org Signed-off-by: Tamir Duberstein commit 4079cf049cb265c15c3c7349d85943462ba054d5 Author: Tamir Duberstein Date: Thu Jan 22 12:30:46 2026 -0500 scripts: generate_rust_analyzer.py: drop `"is_proc_macro": false` Add a dedicated `append_proc_macro_crate` function to reduce overloading in `append_crate`. This has the effect of removing `"is_proc_macro": false` from the output; this field is interpreted as false if absent[1] so this doesn't change the behavior of rust-analyzer. Use the `/` operator on `pathlib.Path` rather than directly crafting a string. This is consistent with all other path manipulation in this script. Link: https://github.com/rust-lang/rust-analyzer/blob/8d01570b5e812a49daa1f08404269f6ea5dd73a1/crates/project-model/src/project_json.rs#L372-L373 [1] Tested-by: Daniel Almeida Reviewed-by: Daniel Almeida Reviewed-by: Trevor Gross Reviewed-by: Jesung Yang Tested-by: Jesung Yang Link: https://patch.msgid.link/20260122-rust-analyzer-types-v1-2-29cc2e91dcd5@kernel.org Signed-off-by: Tamir Duberstein commit e33d58ee0c081c4468d0ea4f03fcb93c6cb5e21a Author: Tamir Duberstein Date: Thu Jan 22 12:30:45 2026 -0500 scripts: generate_rust_analyzer.py: extract `{build,register}_crate` Extract helpers from `append_crate` to avoid the need to peek into `crates[-1]`. This improves readability. Change default parameters to `None` with true defaults applied in `build_crate` to avoid repeating the defaults in wrapper functions such as `append_crate`. Suggested-by: Trevor Gross Reviewed-by: Daniel Almeida Tested-by: Daniel Almeida Reviewed-by: Fiona Behrens Reviewed-by: Trevor Gross Reviewed-by: Jesung Yang Tested-by: Jesung Yang Link: https://patch.msgid.link/20260122-rust-analyzer-types-v1-1-29cc2e91dcd5@kernel.org Signed-off-by: Tamir Duberstein commit b6b592275aeff184aa82fcf6abccd833fb71b393 Author: Deepanshu Kartikey Date: Sat Mar 7 06:33:02 2026 +0530 hfsplus: fix uninit-value by validating catalog record size Syzbot reported a KMSAN uninit-value issue in hfsplus_strcasecmp(). The root cause is that hfs_brec_read() doesn't validate that the on-disk record size matches the expected size for the record type being read. When mounting a corrupted filesystem, hfs_brec_read() may read less data than expected. For example, when reading a catalog thread record, the debug output showed: HFSPLUS_BREC_READ: rec_len=520, fd->entrylength=26 HFSPLUS_BREC_READ: WARNING - entrylength (26) < rec_len (520) - PARTIAL READ! hfs_brec_read() only validates that entrylength is not greater than the buffer size, but doesn't check if it's less than expected. It successfully reads 26 bytes into a 520-byte structure and returns success, leaving 494 bytes uninitialized. This uninitialized data in tmp.thread.nodeName then gets copied by hfsplus_cat_build_key_uni() and used by hfsplus_strcasecmp(), triggering the KMSAN warning when the uninitialized bytes are used as array indices in case_fold(). Fix by introducing hfsplus_brec_read_cat() wrapper that: 1. Calls hfs_brec_read() to read the data 2. Validates the record size based on the type field: - Fixed size for folder and file records - Variable size for thread records (depends on string length) 3. Returns -EIO if size doesn't match expected For thread records, check against HFSPLUS_MIN_THREAD_SZ before reading nodeName.length to avoid reading uninitialized data at call sites that don't zero-initialize the entry structure. Also initialize the tmp variable in hfsplus_find_cat() as defensive programming to ensure no uninitialized data even if validation is bypassed. Reported-by: syzbot+d80abb5b890d39261e72@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d80abb5b890d39261e72 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: syzbot+d80abb5b890d39261e72@syzkaller.appspotmail.com Reviewed-by: Viacheslav Dubeyko Tested-by: Viacheslav Dubeyko Suggested-by: Charalampos Mitrodimas Link: https://lore.kernel.org/all/20260120051114.1281285-1-kartikey406@gmail.com/ [v1] Link: https://lore.kernel.org/all/20260121063109.1830263-1-kartikey406@gmail.com/ [v2] Link: https://lore.kernel.org/all/20260212014233.2422046-1-kartikey406@gmail.com/ [v3] Link: https://lore.kernel.org/all/20260214002100.436125-1-kartikey406@gmail.com/T/ [v4] Link: https://lore.kernel.org/all/20260221061626.15853-1-kartikey406@gmail.com/T/ [v5] Signed-off-by: Deepanshu Kartikey Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20260307010302.41547-1-kartikey406@gmail.com Signed-off-by: Viacheslav Dubeyko commit 826f32e8ff437b4b88ba0b5c7978699710572ceb Author: Alexander Stein Date: Thu Feb 26 16:38:52 2026 +0100 dt-bindings: arm: fsl: add bindings for TQMa8x TQMa8x is a SOM family using NXP i.MX8QM CPU family MBa8x is an evaluation mainboard for this SOM. Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Reviewed-by: Rob Herring (Arm) Signed-off-by: Frank Li commit ad6bb64332bb4297110950769ad5af52791e33a2 Author: Gustavo Arantes Date: Sun Mar 8 15:41:20 2026 -0300 staging: rtl8723bs: remove unnecessary braces in rtw_mlme.c Remove braces that are not necessary for single statement blocks, as reported by checkpatch. Signed-off-by: Gustavo Arantes Link: https://patch.msgid.link/20260308184120.519401-1-dev.gustavoa@gmail.com Signed-off-by: Greg Kroah-Hartman commit e4125d46e1f1ac5a81ef9a0e1be0689b6ccd4dd6 Author: Esther Zilberberg Date: Mon Mar 9 09:55:43 2026 +0000 staging: rtl8723bs: rename supportRateNum to support_rate_num Rename supportRateNum to support_rate_num to fix warning reported by checkpatch.pl. Signed-off-by: Esther Zilberberg Link: https://patch.msgid.link/20260309095543.14495-1-esty5664@gmail.com Signed-off-by: Greg Kroah-Hartman commit b114ef1efc49a40fc50ad1caf8a7d1647cf88c86 Author: Mustafa Karamanli Date: Mon Mar 9 05:58:36 2026 +0000 staging: most: fix typos in driver_usage.txt Fix spelling mistakes in driver_usage.txt documentation: - 'can by used' should be 'can be used' - 'config itmes' should be 'config items' - 'isochrnous' should be 'isochronous' - 'packts_per_xact' should be 'packets_per_xact' Signed-off-by: Mustafa Karamanli Link: https://patch.msgid.link/20260309055836.3741-1-mbarancemkaramanli@gmail.com Signed-off-by: Greg Kroah-Hartman commit 78285e5830e6cc24bc987da9007e3e039a125cf0 Author: Gopi Krishna Menon Date: Sun Mar 8 08:46:38 2026 +0530 staging: rtl8723bs: remove unnecessary braces Checkpatch reports the following warning in odm_DIG.c WARNING: braces {} are not necessary for single statement blocks Remove unnecessary braces from single line conditional statements in odm_DIG.c to fix checkpatch warning. Suggested-by: Bera Yüzlü Signed-off-by: Gopi Krishna Menon Link: https://patch.msgid.link/20260308031704.4907-1-krishnagopi487@gmail.com Signed-off-by: Greg Kroah-Hartman commit 36561a326ce0f3494f59bc1c0a7d516b1d43f068 Author: Mark Adamenko Date: Thu Mar 5 18:19:26 2026 -0800 staging: most: dim2: replace ROUND_UP_TO macro with round_up() The ROUND_UP_TO macro reuses argument 'd', which can cause unintended side effects. Remove it and replace the macro call with the existing round_up() function. Signed-off-by: Mark Adamenko Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260306021926.7475-1-marusik.adamenko@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0bfb8f916ae0a2a9dae42206519aa927655546a3 Author: Nikolay Kulikov Date: Wed Mar 4 21:34:23 2026 +0300 staging: rtl8723bs: remove unnecessary return value from func Function init_hw_mlme_ext() always returns '_SUCCESS', regardless of the result of it's work. Remove this unnecessary return and change function type to 'void' to simplify the code. Additionally, fix the line length exceeding 100 columns. Signed-off-by: Nikolay Kulikov Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260304183438.25228-1-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit ba6d4760e2686c319b27c704fb2acba814b03c6e Author: Zeynep Dicle Date: Wed Mar 4 20:19:41 2026 +0300 staging: rtl8723bs: remove unnecessary braces Remove unnecessary braces to obey Linux coding style and also fix the following checkpatch issue: WARNING: braces {} are not necessary for any arm of this statement Signed-off-by: Zeynep Dicle Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260304171941.594-1-zeynep.dicle.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit eb069110bd335cbd9e349463497bdd14cdd134e6 Author: Tomasz Unger Date: Wed Mar 4 09:41:41 2026 +0100 staging: rtl8723bs: Fix spelling mistake in comment Fix typo 'termindate' -> 'terminate' in a comment. Found with codespell. No other occurrences in this file. Signed-off-by: Tomasz Unger Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260304-rtl8723bs-fix-spelling-v1-1-e2bcc89d5311@yahoo.pl Signed-off-by: Greg Kroah-Hartman commit 7004af17eda439bc1364c3f06f3e22167b4f42d9 Author: Giorgi Tchankvetadze Date: Tue Mar 3 16:43:07 2026 +0400 staging: rtl8723bs: remove unnecessary parentheses in rtw_pwrctrl.c Remove unnecessary parentheses around address-of expressions (e.g. &(adapter->mlmepriv)) to address checkpatch warnings. No functional changes. Signed-off-by: Giorgi Tchankvetadze Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260303124306.260483-2-giorgitchankvetadze1997@gmail.com Signed-off-by: Greg Kroah-Hartman commit e43627a7bf80747c68688e8e06518791f01c8147 Author: Alexandru Hossu Date: Thu Mar 5 11:23:18 2026 +0100 staging: rtl8723bs: use kmemdup() in rtw_cfg80211_set_wpa_ie Replace open-coded kzalloc()+memcpy() with kmemdup() to simplify the code. Signed-off-by: Alexandru Hossu Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260305102318.43034-1-hossu.alexandru@gmail.com Signed-off-by: Greg Kroah-Hartman commit 436aa95b3cff392a4c9ff2ae8a02ee513b0130d3 Author: Adam Azuddin Date: Wed Mar 4 17:39:05 2026 +0800 staging: fbtft: Update RA8875 Kconfig help description The current description is too brief. Update the description to include the manufacturer (RAiO) and the supported resolution (up to 800x480 pixels) to help users identify the correct driver. Signed-off-by: Adam Azuddin Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/aaf9uQOBzCwQuff4@marchy Signed-off-by: Greg Kroah-Hartman commit 5a7334704cf77eb496e54cb007a976f717ddf4c7 Author: Jose A. Perez de Azpillaga Date: Tue Mar 3 18:38:30 2026 +0100 staging: rtl8723bs: fix indentation, line length and declarations Fix indentation to match opening parentheses, wrap lines exceeding 100 columns, and add a missing blank line after variable declarations. Signed-off-by: Jose A. Perez de Azpillaga Reviewd-by: Ethan Tidmore Link: https://patch.msgid.link/20260303173844.47975-5-azpijr@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2d649e3a35f5693633f7598f80c8f61cee26b746 Author: Jose A. Perez de Azpillaga Date: Tue Mar 3 18:38:29 2026 +0100 staging: rtl8723bs: curly brace consistency Fix unbalanced braces and improve readability. Signed-off-by: Jose A. Perez de Azpillaga Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260303173844.47975-4-azpijr@gmail.com Signed-off-by: Greg Kroah-Hartman commit e532e9dcd792b4aa6869727ef099681cf2a5dd76 Author: Jose A. Perez de Azpillaga Date: Tue Mar 3 18:38:28 2026 +0100 staging: rtl8723bs: format operators and logical continuations Fix spaces around different operators. Move logical continuations to the end of the previous line. Signed-off-by: Jose A. Perez de Azpillaga Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260303173844.47975-3-azpijr@gmail.com Signed-off-by: Greg Kroah-Hartman commit f3b6c0c9f0af31c05363c8a8127f81a76be270d4 Author: Jose A. Perez de Azpillaga Date: Tue Mar 3 18:38:27 2026 +0100 staging: rtl8723bs: remove redundant blank lines Remove multiple blank lines and unnecessary blank lines before closing braces. Signed-off-by: Jose A. Perez de Azpillaga Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260303173844.47975-2-azpijr@gmail.com Signed-off-by: Greg Kroah-Hartman commit e65ea7fb205e1f9e3f7908569da1868e7a3fc2a6 Author: Jose A. Perez de Azpillaga Date: Mon Mar 2 22:51:54 2026 +0100 staging: rtl8723bs: fix bitwise OR operator spacing Fix spaces between bitwise OR operations rtw_action_frame_parse() for better readability. Signed-off-by: Jose A. Perez de Azpillaga Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260302215208.67045-1-azpijr@gmail.com Signed-off-by: Greg Kroah-Hartman commit c116737e972ea74f4468a1bd0703d623a3c0ee4a Author: Marco Crivellari Date: Mon Mar 9 14:15:28 2026 +0100 workqueue: Add system_dfl_long_wq for long unbound works Currently there are users of queue_delayed_work() who specify system_long_wq, the per-cpu workqueue. This workqueue should be used for long per-cpu works, but queue_delayed_work() queue the work using: queue_delayed_work_on(WORK_CPU_UNBOUND, ...); This would end up calling __queue_delayed_work() that does: if (housekeeping_enabled(HK_TYPE_TIMER)) { // [....] } else { if (likely(cpu == WORK_CPU_UNBOUND)) add_timer_global(timer); else add_timer_on(timer, cpu); } So when cpu == WORK_CPU_UNBOUND the timer is global and is not using a specific CPU. Later, when __queue_work() is called: if (req_cpu == WORK_CPU_UNBOUND) { if (wq->flags & WQ_UNBOUND) cpu = wq_select_unbound_cpu(raw_smp_processor_id()); else cpu = raw_smp_processor_id(); } Because the wq is not unbound, it takes the CPU where the timer fired and enqueue the work on that CPU. The consequence of all of this is that the work can run anywhere, depending on where the timer fired. Introduce system_dfl_long_wq in order to change, in a future step, users that are still calling: queue_delayed_work(system_long_wq, ...); with the new system_dfl_long_wq instead, so that the work may benefit from scheduler task placement. Signed-off-by: Marco Crivellari Signed-off-by: Tejun Heo commit 73f175a46330c57ab5797287233cbf83a36b6a99 Merge: 0d3ab0e4bbfd68 ab9150972f21c4 Author: Jonathan Corbet Date: Mon Mar 9 10:38:27 2026 -0600 Merge branch 'mauro' into docs-mw Mauro says: The first patches on this series are focused mostly on .TH (troff header) line, but, as a side effect, it also change the name of man pages generated from DOC kernel-doc annotations. At the previous state, those were overriden due to lots of duplicated names. The rationale for most of such changes is that modern troff/man page specs say that .TH has up to 5 arguments,, as defined at [1]: .TH topic section [footer-middle] [footer-inside] [header-middle] [1] https://man7.org/linux/man-pages/man7/groff_man_style.7.html Right now, Kernel uses 6 arguments, probably due to some legacy man page definitions. After double checking, modern man pages use this format: .TH "{name}" {section} "{date}" "{modulename}" "{manual}" Right now, man pages generation are messing up on how it encodes each position at .TH, depending on the type of object it emits. After this series, the definition is more consistent and file output is better named. It also fixes two issues at sphinx-build-wrapper related to how it generate files names from the .TH header. The last 4 patches on this series are new: they fix lots of issues related to groff format: there, new lines continue the test from previous pagragraph. This cause issues mainly on: - tables; - code blocks; - lists With the changes, the output now looks a lot better. Please notice that the code there is not meant to fully implement rst -> troff/groff conversion. Instead, it is meant to make the output reasonable. A more complete approach would be to use docutils or Sphinx libraries, but that would likely require to also write a troff output plugin, as the "man" builder is very limited. Also, this could be problematic, as kernel-doc classes can be called from Sphinx. I don't think we need that much complexity, as what we mainly need is to avoid bad line grouping when generating man pages. This series should not affect HTML documentation. It only affect man page generation and ManFormat output class. commit ab9150972f21c41d4487e5d4b21cea0ecfe0bb94 Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:51 2026 +0100 docs: kdoc_output: better handle lists On several functions, the return values are inside a bullet list. Also, on some places, there are numbered lists as well. Use a troff markup to format them, to avoid placing everything on a single line. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 908ae13b1864c05bcde8cfc7127ec147d28f9414 Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:50 2026 +0100 docs: kdoc_output: add support to handle code blocks It is common to have code blocks inside kernel-doc markups. By default, troff will group all lines altogether, producing a very weird output. If a code block is detected by disabling filling inside code blocks, re-enabling it afterwards. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 4ec130cff633361c2217d2ba116ae32772087087 Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:49 2026 +0100 docs: kdoc_output: add a logic to handle tables inside kernel-doc markups specially when DOC is used, it is not uncommon to have tables inside a kernel-doc markup. Add support for simple tables and complex grid tables when output in groff format. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <442ad76442c325044eb9f34a155d5f484341fb35.1772810752.git.mchehab+huawei@kernel.org> commit cde7c96f88a0fe9ed53e8bb57147b19a725cf097 Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:48 2026 +0100 docs: kdoc_output: Change the logic to handle man highlight The code inside ManFormat code to output man pages is too simple: it produces very bad results when the content has tables or code blocks. Change the way lines are parsed there to allow adding extra logic to handle some special cases. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <6ae2301a40b3fcb4381dd9dda8c75d14f9616b46.1772810752.git.mchehab+huawei@kernel.org> commit e4dadcf510da846f32aaaad5d5988890cbf6033d Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:47 2026 +0100 docs: kdoc_output: pick a better default for modulename Instead of placing the same data for modulename for all generated man pages, use the directory from the filename used to produce kernel docs as basis. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <8a5d91c93c0b9b34c2f60e389f4464742804d0d6.1772810752.git.mchehab+huawei@kernel.org> commit 26b4fdefc0f96b1e2e25e0482de1476d037ad325 Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:46 2026 +0100 docs: kdoc_output: describe the class init parameters As this class is part of the ABI used by both Sphinx kerneldoc extension and docs/tools/kernel-doc, better describe what parmeters are used to initialize ManOutput class. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <7c57f26150aae11fced259f30898a980b96efb68.1772810752.git.mchehab+huawei@kernel.org> commit 4160533d058cfa667159e8d6a46fe42c738a4a84 Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:45 2026 +0100 docs: kdoc_output: fix naming for DOC markups Right now, DOC markups aren't being handled properly, as it was using the same name for all output. Fix it by filling the title argument on a different way. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <11d809e5c4bec23240d3ace3f342dbb2a9263446.1772810752.git.mchehab+huawei@kernel.org> commit 1a63342a2774c734b73841fdfa41cf4d8d58cd94 Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:44 2026 +0100 docs: kdoc_output: don't use a different modulename for functions It doesn't make much sense to have a different modulename just for functions, but not for structs/enums/... Use the same header everywere. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <978259bdf3e8d310c646ecf76ce56d054f6d5738.1772810752.git.mchehab+huawei@kernel.org> commit 31938f120fa261b983fed3315239fe1c5fc4e6e7 Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:43 2026 +0100 docs: kdoc_output: use a single manual for everything There's no reason why functions will be on a different manual. Unify its name, calling it as "Kernel API Manual". Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <000e1174a551e97ad4710ad4f3750b22017bedd5.1772810752.git.mchehab+huawei@kernel.org> commit 43874045faa72b876da361fed4b3c9aeee09ebdb Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:42 2026 +0100 docs: kdoc_output: remove extra attribute on man .TH headers According with modern documents, groff .TH supports up to 5 arguments, but the logic passes 6. Drop the lastest one ("LINUX"). Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit c1873e77434db2c592cfd21dd7d2e34a5c18304f Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:41 2026 +0100 docs: kdoc_output: use a method to emit the .TH header All man emit functions need to add a .TH header. Move the code to a common function, as we'll be addressing some issues at the common code. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <2e55fcfe8724fde08a78635a1a3f8b449a6adf82.1772810752.git.mchehab+huawei@kernel.org> commit 0e4c8adad4cacf699672d28e19143dc0b9d145fd Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:40 2026 +0100 docs: sphinx-build-wrapper: don't allow "/" on file names When handling "DOC:" sections, slash characters may be there. Prevent using it at the file names, as this is used for directory separator. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 5828d3564729e61306456fae02e9d0dc9f2e772d Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:45:39 2026 +0100 docs: sphinx-build-wrapper: better handle troff .TH markups Using a regular expression to match .TH is problematic, as it doesn't handle well quotation marks. Use shlex instead. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <9436806316d33aaf68625c00ce068463d3917660.1772810752.git.mchehab+huawei@kernel.org> commit a717943d8ecc0e533c581bf04473b50f6f17f2cb Author: Vincent Donnefort Date: Mon Mar 9 16:25:04 2026 +0000 tracing: Check for undefined symbols in simple_ring_buffer The simple_ring_buffer implementation must remain simple enough to be used by the pKVM hypervisor. Prevent the object build if unresolved symbols are found. Link: https://patch.msgid.link/20260309162516.2623589-19-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 635923081c792c830fb87e680d6dd5f348926b3f Author: Vincent Donnefort Date: Mon Mar 9 16:25:03 2026 +0000 tracing: load/unload page callbacks for simple_ring_buffer Add load/unload callback used for each admitted page in the ring-buffer. This will be later useful for the pKVM hypervisor which uses a different VA space and need to dynamically map/unmap the ring-buffer pages. Link: https://patch.msgid.link/20260309162516.2623589-18-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit c88d510584abdb6f3d3517de3a3d48d9febc85ed Author: Vincent Donnefort Date: Mon Mar 9 16:25:02 2026 +0000 Documentation: tracing: Add tracing remotes Add documentation about the newly introduced tracing remotes framework. Link: https://patch.msgid.link/20260309162516.2623589-17-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 0a1b03251db15eef1709f2db9846ac6918813227 Author: Vincent Donnefort Date: Mon Mar 9 16:25:01 2026 +0000 tracing: selftests: Add trace remote tests Exercise the tracefs interface for trace remote with a set of tests to check: * loading/unloading (unloading.tc) * reset (reset.tc) * size changes (buffer_size.tc) * consuming read (trace_pipe.tc) * non-consuming read (trace.tc) Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Link: https://patch.msgid.link/20260309162516.2623589-16-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit ea908a2b79c84279f06d6c4fa19bf45f113a34d0 Author: Vincent Donnefort Date: Mon Mar 9 16:25:00 2026 +0000 tracing: Add a trace remote module for testing Add a module to help testing the tracefs support for trace remotes. This module: * Use simple_ring_buffer to write into a ring-buffer. * Declare a single "selftest" event that can be triggered from user-space. * Register a "test" trace remote. This is intended to be used by trace remote selftests. Link: https://patch.msgid.link/20260309162516.2623589-15-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 34e5b958bdad0f9cf16306368bbc2dc5b2a50143 Author: Vincent Donnefort Date: Mon Mar 9 16:24:59 2026 +0000 tracing: Introduce simple_ring_buffer Add a simple implementation of the kernel ring-buffer. This intends to be used later by ring-buffer remotes such as the pKVM hypervisor, hence the need for a cut down version (write only) without any dependency. Link: https://patch.msgid.link/20260309162516.2623589-14-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 93ae1b76fff9e745f870a2f2cd32f472328c4a8f Author: Vincent Donnefort Date: Mon Mar 9 16:24:58 2026 +0000 ring-buffer: Export buffer_data_page and macros In preparation for allowing the writing of ring-buffer compliant pages outside of ring_buffer.c, move buffer_data_page and timestamps encoding macros into the publicly available ring_buffer_types.h. Link: https://patch.msgid.link/20260309162516.2623589-13-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 5f3efd1dcebc35d44cce39630ae00980a45d9247 Author: Vincent Donnefort Date: Mon Mar 9 16:24:57 2026 +0000 tracing: Add helpers to create trace remote events Declaring remote events can be cumbersome let's add a set of macros to simplify developers life. The declaration of a remote event is very similar to kernel's events: REMOTE_EVENT(name, id, RE_STRUCT( re_field(u64 foo) ), RE_PRINTK("foo=%llu", __entry->foo) ) Link: https://patch.msgid.link/20260309162516.2623589-12-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 775cb093bc50649e83ad00ce5347d6fbd4aa8387 Author: Vincent Donnefort Date: Mon Mar 9 16:24:56 2026 +0000 tracing: Add events/ root files to trace remotes Just like for the kernel events directory, add 'enable', 'header_page' and 'header_event' at the root of the trace remote events/ directory. Link: https://patch.msgid.link/20260309162516.2623589-11-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 072529158e604cc964feb78dcf094c6975828146 Author: Vincent Donnefort Date: Mon Mar 9 16:24:55 2026 +0000 tracing: Add events to trace remotes An event is predefined point in the writer code that allows to log data. Following the same scheme as kernel events, add remote events, described to user-space within the events/ tracefs directory found in the corresponding trace remote. Remote events are expected to be described during the trace remote registration. Add also a .enable_event callback for trace_remote to toggle the event logging, if supported. Link: https://patch.msgid.link/20260309162516.2623589-10-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit bf2ba0f8ca1af14aaaa765cbb93caf564d383aad Author: Vincent Donnefort Date: Mon Mar 9 16:24:54 2026 +0000 tracing: Add init callback to trace remotes Add a .init call back so the trace remote callers can add entries to the tracefs directory. Link: https://patch.msgid.link/20260309162516.2623589-9-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 330b0cceb30634864d1e9c661eb5524c52d70c07 Author: Vincent Donnefort Date: Mon Mar 9 16:24:53 2026 +0000 tracing: Add non-consuming read to trace remotes Allow reading the trace file for trace remotes. This performs a non-consuming read of the trace buffer. Link: https://patch.msgid.link/20260309162516.2623589-8-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 9af4ab0e11e336e2671d303ffcc6578e3546d9fc Author: Vincent Donnefort Date: Mon Mar 9 16:24:52 2026 +0000 tracing: Add reset to trace remotes Allow to reset the trace remote buffer by writing to the Tracefs "trace" file. This is similar to the regular Tracefs interface. Link: https://patch.msgid.link/20260309162516.2623589-7-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 96e43537af5461b26f50904c6055046ba65d742f Author: Vincent Donnefort Date: Mon Mar 9 16:24:51 2026 +0000 tracing: Introduce trace remotes A trace remote relies on ring-buffer remotes to read and control compatible tracing buffers, written by entity such as firmware or hypervisor. Add a Tracefs directory remotes/ that contains all instances of trace remotes. Each instance follows the same hierarchy as any other to ease the support by existing user-space tools. This currently does not provide any event support, which will come later. Link: https://patch.msgid.link/20260309162516.2623589-6-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit fbd1743ecba11ea163920279bc16263d79bb0929 Author: Vincent Donnefort Date: Mon Mar 9 16:24:50 2026 +0000 ring-buffer: Add non-consuming read for ring-buffer remotes Hopefully, the remote will only swap pages on the kernel instruction (via the swap_reader_page() callback). This means we know at what point the ring-buffer geometry has changed. It is therefore possible to rearrange the kernel view of that ring-buffer to allow non-consuming read. Link: https://patch.msgid.link/20260309162516.2623589-5-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 2e67fabd8b77c4f482df9b211bca1b495c6c2c24 Author: Vincent Donnefort Date: Mon Mar 9 16:24:49 2026 +0000 ring-buffer: Introduce ring-buffer remotes Add ring-buffer remotes to support entities outside of the kernel (such as firmware or a hypervisor) that writes events into a ring-buffer using the tracefs format Require a description of the ring-buffer pages (struct trace_buffer_desc) and callbacks (swap_reader_page and reset) to set up the ring-buffer on the kernel side. Expect the remote entity to maintain and update the meta-page. Link: https://patch.msgid.link/20260309162516.2623589-4-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit e682207bf7ae3f81885f612ada1ac44d027158d4 Author: Vincent Donnefort Date: Mon Mar 9 16:24:48 2026 +0000 ring-buffer: Store bpage pointers into subbuf_ids The subbuf_ids field allows to point to a specific page from the ring-buffer based on its ID. As a preparation or the upcoming ring-buffer remote support, point this array to the buffer_page instead of the buffer_data_page. Link: https://patch.msgid.link/20260309162516.2623589-3-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit 7d776a36277ff2685ffc3dc7eff32002d0333ac9 Author: Vincent Donnefort Date: Mon Mar 9 16:24:47 2026 +0000 ring-buffer: Add page statistics to the meta-page Add two fields pages_touched and pages_lost to the ring-buffer meta-page. Those fields are useful to get the number of used pages in the ring-buffer. Link: https://patch.msgid.link/20260309162516.2623589-2-vdonnefort@google.com Reviewed-by: Steven Rostedt (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt (Google) commit c8e175a73b0da6cc715adf4099634cfed317536d Author: Albab Hasan Date: Sat Feb 28 21:38:09 2026 +0600 staging: vme_user: remove unimplemented #if 0 code blocks Remove dead code in #if 0 blocks from struct vme_master and struct vme_slave. these were never implemented or compiled in. checkpatch.pl reports: WARNING: Consider removing the code enclosed by this #if 0 and its #endif No functional changes. Signed-off-by: Albab Hasan Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260228153809.15398-1-albabhasan276@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3c7fe1b403d4118ae0f6ffc937caf25aca7b871c Author: Nikolay Kulikov Date: Sat Feb 28 16:09:06 2026 +0300 staging: rtl8723bs: remove unused 'ratelen' parameter from rtw_check_network_type() The rtw_check_network_type() function takes a 'ratelen' parameter, but does not use it in any way. Also remove the local variable in rtw_ap.c created just to pass a value to this unused parameter. Signed-off-by: Nikolay Kulikov Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260228130917.4123-1-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit bd2e02e3c9215305dfa344c050d5822f19929cf7 Merge: 099bded7525d98 fcec7c66d68165 Author: Alexei Starovoitov Date: Mon Mar 9 09:28:43 2026 -0700 Merge branch 'always-allow-sleepable-and-fmod_ret-programs-on-syscalls' Viktor Malik says: ==================== Always allow sleepable and fmod_ret programs on syscalls Both sleepable and fmod_ret programs are only allowed on selected functions. For convenience, the error injection list was originally used. When error injection is disabled, that list is empty and sleepable tracing programs, as well as fmod_ret programs, are effectively unavailable. This patch series addresses the issue by at least enabling sleepable and fmod_ret programs on syscalls, if error injection is disabled. More details on why syscalls are used can be found in [1]. [1] https://lore.kernel.org/bpf/CAADnVQK6qP8izg+k9yV0vdcT-+=axtFQ2fKw7D-2Ei-V6WS5Dw@mail.gmail.com/ Changes in v3: - Handle LoongArch (Leon) - Add Kumar's and Leon's acks Changes in v2: - Check "sys_" prefix instead of "sys" for powerpc syscalls (AI review) - Add link to the original discussion (Kumar) - Add explanation why arch syscall prefixes are hard-coded (Leon) ==================== Link: https://patch.msgid.link/cover.1773055375.git.vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit fcec7c66d68165b69b3cef6af913a435a25e36a1 Author: Viktor Malik Date: Mon Mar 9 12:23:58 2026 +0100 selftests/bpf: Move sleepable refcounted_kptr tests to syscalls Now that sleepable programs are always enabled on syscalls, let refcounted_kptr tests use syscalls rather than bpf_testmod_test_read, which is not sleepable with error injection disabled. The tests just check that the verifier can handle usage of RCU locks in sleepable programs and never actually attach. So, the attachment target doesn't matter (as long as it is sleepable) and with syscalls, the tests pass on kernels with disabled error injection. Signed-off-by: Viktor Malik Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/8b6626eae384559855f7a0e846a16e83f25f06f6.1773055375.git.vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit 20c2e102a2f30e7e47cba9816ab226de296e8e57 Author: Viktor Malik Date: Mon Mar 9 12:23:57 2026 +0100 bpf: Always allow fmod_ret programs on syscalls fmod_ret BPF programs can only be attached to selected functions. For convenience, the error injection list was originally used (along with functions prefixed with "security_"), which contains syscalls and several other functions. When error injection is disabled (CONFIG_FUNCTION_ERROR_INJECTION=n), that list is empty and fmod_ret programs are effectively unavailable for most of the functions. In such a case, at least enable fmod_ret programs on syscalls. Signed-off-by: Viktor Malik Acked-by: Kumar Kartikeya Dwivedi Acked-by: Leon Hwang Link: https://lore.kernel.org/r/472310f9a5f4944ad03214e4d943a4830fd8eb76.1773055375.git.vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit 16d9c5660692d6f0e6aba367274de2b6dfd4343c Author: Viktor Malik Date: Mon Mar 9 12:23:56 2026 +0100 bpf: Always allow sleepable programs on syscalls Sleepable BPF programs can only be attached to selected functions. For convenience, the error injection list was originally used, which contains syscalls and several other functions. When error injection is disabled (CONFIG_FUNCTION_ERROR_INJECTION=n), that list is empty and sleepable tracing programs are effectively unavailable. In such a case, at least enable sleepable programs on syscalls. For discussion why syscalls were chosen, see [1]. To detect that a function is a syscall handler, we check for arch-specific prefixes for the most common architectures. Unfortunately, the prefixes are hard-coded in arch syscall code so we need to hard-code them, too. [1] https://lore.kernel.org/bpf/CAADnVQK6qP8izg+k9yV0vdcT-+=axtFQ2fKw7D-2Ei-V6WS5Dw@mail.gmail.com/ Signed-off-by: Viktor Malik Acked-by: Kumar Kartikeya Dwivedi Acked-by: Leon Hwang Link: https://lore.kernel.org/r/2704a8512746655037e3c02b471b31bd0d76c8db.1773055375.git.vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit ebfef080cd965962d455dabe452fec50913e4759 Author: Mariyam Shahid Date: Fri Feb 27 12:19:41 2026 +0500 staging: rtl8723bs: Fix logical continuation placement Move logical operators to the end of the previous line to fix checkpatch warnings. Signed-off-by: Mariyam Shahid Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260227071942.6328-1-mariyam.shahid135@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0d3ab0e4bbfd688bfaef66b6365a71c70a0f0450 Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:25:15 2026 +0100 docs: kdoc_files: document KernelFiles() ABI The KernelFiles is the main entry point to run kernel-doc, being used by both tools/docs/kernel-doc and Documentation/sphinx/kerneldoc.py. It is also used on QEMU, which also uses the kernel-doc libraries from tools/lib/python/kdoc. Properly describe its ABI contract. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <13eb44c341232564eaf2a9c9de4782369fef57e1.1772810574.git.mchehab+huawei@kernel.org> commit 861dcdb6ad6f339a5958764352e626e2af7df4c1 Author: Mauro Carvalho Chehab Date: Fri Mar 6 16:25:14 2026 +0100 docs: kdoc_files: allows the caller to use a different xforms class While the main goal for kernel-doc is to be used inside the Linux Kernel, other open source projects could benefit for it. That's currently the case of QEMU, which has a fork, mainly due to two reasons: - they need an extra C function transform rule; - they handle the html output a little bit different. Add an extra optional argument to make easier for the code to be shared, as, with that, QEMU can just create a new derivated class that will contain its specific rulesets, and just copy the remaining kernel-doc files as-is. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <6b274ddbdcd9d438c6848e00e410a2f65ef80ec2.1772810574.git.mchehab+huawei@kernel.org> commit 6af9b391351261b38b592800010d4bdca2197f8e Merge: 0a0d3b8dd06b9d 2fcfe5951eb2e8 Author: Tejun Heo Date: Mon Mar 9 06:19:12 2026 -1000 Merge branch 'for-7.0-fixes' into for-7.1 commit b8e7e03370b924f2c91895296dfb79c8692d21d4 Author: Tommaso Cucinotta Date: Wed Mar 4 11:28:16 2026 +0100 sched/deadline: document new sched_getattr() feature for retrieving current parameters for DEADLINE tasks Document in Documentation/sched/sched-deadline.rst the new capability of sched_getattr() to retrieve, for DEADLINE tasks, the runtime left and absolute deadline (setting the flags syscall parameter to 1), in addition to the static parameters (obtained with flags=0). Signed-off-by: Tommaso Cucinotta Acked-by: Juri Lelli Signed-off-by: Jonathan Corbet Message-ID: <20260304102843.1373905-2-tommaso.cucinotta@santannapisa.it> commit 17eb360d7df58708f0c16b48e6b29bc614d6ffc7 Author: David Hildenbrand (Arm) Date: Fri Mar 6 09:19:16 2026 +0100 docs: filesystems: clarify KernelPageSize vs. MMUPageSize in smaps There was recently some confusion around THPs and the interaction with KernelPageSize / MMUPageSize. Historically, these entries always correspond to the smallest size we could encounter, not any current usage of transparent huge pages or larger sizes used by the MMU. Ever since we added THP support many, many years ago, these entries would keep reporting the smallest (fallback) granularity in a VMA. For this reason, they default to PAGE_SIZE for all VMAs except for VMAs where we have the guarantee that the system and the MMU will always use larger page sizes. hugetlb, for example, exposes a custom vm_ops->pagesize callback to handle that. Similarly, dax/device exposes a custom vm_ops->pagesize callback and provides similar guarantees. Let's clarify the historical meaning of KernelPageSize / MMUPageSize, and point at "AnonHugePages", "ShmemPmdMapped" and "FilePmdMapped" regarding PMD entries. While at it, document "FilePmdMapped", clarify what the "AnonHugePages" and "ShmemPmdMapped" entries really mean, and make it clear that there are no other entries for other THP/folio sizes or mappings. Also drop the duplicate "KernelPageSize" and "MMUPageSize" entries in the example. Link: https://lore.kernel.org/all/20260225232708.87833-1-ak@linux.intel.com/ Reviewed-by: Zi Yan Reviewed-by: Lance Yang Acked-by: Vlastimil Babka (SUSE) Cc: Andrew Morton Cc: Lorenzo Stoakes Cc: Zi Yan Cc: Baolin Wang Cc: Liam R. Howlett Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lance Yang Cc: Jonathan Corbet Cc: Shuah Khan Cc: Usama Arif Cc: Andi Kleen Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Signed-off-by: Jonathan Corbet Message-ID: <20260306081916.38872-1-david@kernel.org> commit 73f29b02e78e2d45c97024d8c05a798b4b235383 Author: Ariful Islam Shoikot Date: Sat Mar 7 17:40:06 2026 +0600 Documentation/mm: Fix typo in NUMA paragraph Fixed a typo in Documentation/mm/numa.rst: -changed 'allocated' to 'allocate' in the paragraph about memoryless nodes. Signed-off-by: Ariful Islam Shoikot Signed-off-by: Jonathan Corbet Message-ID: <20260307114006.33183-1-islamarifulshoikat@gmail.com> commit cb794619c2d29b882f6eec3b6ad4a1ca5afab312 Author: Peng Fan Date: Mon Mar 2 23:07:41 2026 +0800 dt-bindings: fsl: imx7ulp-smc1: Add #clock-cells property The SMC1 block on i.MX7ULP is already used as a clock provider in imx7ulp.dtsi, but the corresponding dt-binding schema does not define the required '#clock-cells' property. This results in CHECK_DTBS schema validation errors. Functionally, SMC1 controls the CPU run mode configuration: - 00b: Normal Run (RUN) - 10b: Very-Low-Power Run (VLPR) - 11b: High-Speed Run (HSRUN) These run modes determine the effective CPU operating point, and their programming is tied to the OPP table. Add the missing `#clock-cells` definition so the dt-binding schema is consistent with the DTS and validates correctly. Fixes: 8ba41d6bd9893 ("dt-bindings: fsl: Convert i.MX7ULP PM to json-schema") Reviewed-by: Krzysztof Kozlowski Signed-off-by: Peng Fan Signed-off-by: Frank Li commit 4fe1e1dcca07a8dfd9534bbb9bd40e5ea9f594cb Author: LIU Haoyang Date: Sun Mar 8 18:08:50 2026 +0800 docs/dev-tools: fix a broken URL in dev-tools/coccinelle.rst The original supplemental documentation for coccicheck is https://bottest.wiki.kernel.org/coccicheck, which redirects to a not found page, thus change it to https://bottest.wiki.kernel.org/coccicheck.html, which adds a suffix to original URL to make it direct to the right page. Signed-off-by: LIU Haoyang Reviewed-by: Dongliang Mu Signed-off-by: Jonathan Corbet Message-ID: <20260308100851.341-1-tttturtleruss@gmail.com> commit fcbf51dd164e52cac4df10bd0c7a08b6e08dd0f4 Author: Haoyang LIU Date: Sun Mar 8 19:13:13 2026 +0800 tools/docs/checktransupdate.py: add support for scanning directory Origin script can only accept a file as parameter, this commit enables it to scan a directory. Usage example: ./scripts/checktransupdate.py Documentation/translations/zh_CN/dev-tools And it will output something like: """ [1772967203.351603] Documentation/translations/zh_CN/dev-tools/kmemleak.rst [1772967205.074201] commit 7591c127f3b1 ("kmemleak: iommu/iova: fix transient kmemleak false positive") [1772967205.074337] 1 commits needs resolving in total [1772967205.301705] Documentation/translations/zh_CN/dev-tools/index.rst [1772967206.912395] commit a592a36e4937 ("Documentation: use a source-read extension for the index link boilerplate") [1772967206.921424] commit 6eac13c87680 ("Documentation: dev-tools: add container.rst page") [1772967206.930220] commit 8f32441d7a53 ("Documentation: Add documentation for Compiler-Based Context Analysis") [1772967206.939002] commit 1e9ddbb2cd34 ("docs: Pull LKMM documentation into dev-tools book") [1772967206.948636] commit d5af79c05e93 ("Documentation: move dev-tools debugging files to process/debugging/") [1772967206.957562] commit d5dc95836147 ("kbuild: Add Propeller configuration for kernel build") [1772967206.966255] commit 315ad8780a12 ("kbuild: Add AutoFDO support for Clang build") [1772967206.966410] 7 commits needs resolving in total """ Signed-off-by: Haoyang LIU [jc: tweaked coding style] Signed-off-by: Jonathan Corbet Message-ID: <20260308111314.27333-1-tttturtleruss@gmail.com> commit d3bc73362751c4399b5ca78fe8360dbe9c7cd0c5 Author: Bera Yüzlü Date: Thu Feb 26 16:02:53 2026 +0300 staging: rtl8723bs: refactor halbtc8723b1ant_CoexTableWithType() to remove duplication Replace the verbose switch-case block with a constant 2D array lookup. This makes the function much more concise and easier to read without changing the underlying behavior. Signed-off-by: Bera Yüzlü Link: https://patch.msgid.link/20260226130253.2145-1-b9788213@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7d7501b66a244398c72fcf02cb57bb704cb5f2fa Author: Andy Shevchenko Date: Thu Feb 26 09:08:45 2026 +0100 fbtft: Update REAMDE to slow down the stream of undesired cleanups Lately the enormous amount of some untested cleanups started coming to a mailing list. This adds an unneeded and undesired burden on the reviewers and maintainers. Try to stop that by clearly state what we accept and on what conditions in the README file. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260226080845.4081732-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit cd002b58ecbf44054238223941b8f7e5c2f5233a Author: Oskar Ray-Frayssinet Date: Wed Mar 4 20:32:06 2026 +0100 staging: greybus: remove redundant 'int' from unsigned long long Replace 'unsigned long long int' with 'unsigned long long' as the 'int' suffix is unnecessary and not preferred by kernel coding style. Signed-off-by: Oskar Ray-Frayssinet Link: https://patch.msgid.link/20260304193206.4992-1-rayfraytech@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1fc63bfed102f536b5322ac46cdd198a5c47ebb6 Author: Jose A. Perez de Azpillaga Date: Fri Feb 27 09:46:12 2026 +0100 staging: rtl8723bs: replace msleep() with fsleep() in rtw_cmd.c Replace msleep() with fsleep() in rtw_cmd.c to improve delay precision and follow modern kernel practices. Specifically, this fixes a checkpatch warning for the 10ms delay in _rtw_free_evt_priv() and updates the 100ms polling loops in rtw_chk_hi_queue_hdl() and rtw_free_cmd_priv() for consistency. Signed-off-by: Jose A. Perez de Azpillaga Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260227084623.209913-1-azpijr@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7b6f321f6967f9d224b7c1f19f5efa98a0e2099b Author: Ruslan Valiyev Date: Thu Feb 26 07:48:58 2026 +0000 staging: greybus: arche: use sysfs_emit() instead of sprintf() Replace sprintf() with sysfs_emit() in state_show() sysfs attribute callbacks in arche-platform.c and arche-apb-ctrl.c. Checkpatch complains about code using sprintf(). This code here is obviously safe as-is, but it would be more appropriate to use sysfs_emit(). Signed-off-by: Ruslan Valiyev Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260226074858.67635-1-linuxoid@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1f659f1cdf85601a19b64b5245b12f015606f189 Author: Shubham Chakraborty Date: Thu Feb 26 12:22:39 2026 +0530 staging: greybus: arche-platform: Use sysfs_emit instead of sprintf Refactor sprintf to sysfs_emit in the show function of the arche platform driver. This follows the standard kernel practice of using sysfs_emit for sysfs attributes, ensuring consistent output formatting and newline handling. Signed-off-by: Shubham Chakraborty Link: https://patch.msgid.link/20260226065239.11698-1-chakrabortyshubham66@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1722b500d22ce3fa327d510c255725eb213a9011 Author: Ryan Cheevers Date: Mon Mar 9 01:00:15 2026 -0500 docs: fix typo in housekeeping Signed-off-by: Ryan Cheevers Signed-off-by: Jonathan Corbet Message-ID: <20260309060015.2349939-1-cheeversr0@gmail.com> commit fc6aa072bdbd26dfc94269fa87ca40ab4f867236 Author: Dave Hansen Date: Thu Mar 5 09:24:15 2026 -0800 MAINTAINERS: Remove bouncing Keem Bay maintainer This maintainer's email no longer works. Remove it from MAINTAINERS. There is still one listed maintainer for the "INTEL KEEM BAY DRM DRIVER". Signed-off-by: Dave Hansen Acked-by: Anitha Chrisanthus Cc: Anitha Chrisanthus Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Simona Vetter Cc: dri-devel@lists.freedesktop.org Link: https://patch.msgid.link/20260305172415.3116438-1-dave.hansen@linux.intel.com Signed-off-by: Maxime Ripard commit 9652a49a17bf6d5978259318bc8c7bb91f3fb6c9 Author: Ciprian Marian Costea Date: Mon Mar 9 15:34:08 2026 +0100 mmc: sdhci-esdhc-imx: add NXP S32N79 support Add support for the uSDHC controller found in NXP S32N79 automotive SoCs, which reuse the existing sdhci-esdhc-imx driver with slice difference. Compared with s32g2/s32g3, needn't set ESDHC_FLAG_SKIP_CD_WAKE flag because s32n79 does not have this limitation. Co-developed-by: Larisa Grigore Signed-off-by: Larisa Grigore Signed-off-by: Ciprian Marian Costea Reviewed-by: Haibo Chen Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 0f961114e4aca744597390d78fbe462a846ac332 Author: Ciprian Marian Costea Date: Mon Mar 9 15:34:06 2026 +0100 dt-bindings: mmc: fsl-imx-esdhc: add S32N79 support Add compatible string "nxp,s32n79-usdhc" for the uSDHC controller found in NXP S32N79 series automotive SoCs. Co-developed-by: Larisa Grigore Signed-off-by: Larisa Grigore Signed-off-by: Ciprian Marian Costea Acked-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit 229517449879b3ca8ca5588593cbea6a67ba0ad2 Author: Ricardo B. Marlière Date: Sat Mar 7 19:08:04 2026 -0300 ktest: Add a --dry-run mode When working on a ktest configuration, it is often useful to inspect the final option values after includes, defaults, per-test overrides, and variable expansion have been applied, without actually starting a test run. Add a --dry-run option that reads the configuration, prints the test preamble using resolved option values, and exits before opening LOG_FILE or executing any test logic. This is useful for debugging ktest configurations and for scripts that need to validate the final resolved settings without triggering side effects. Cc: John Hawley Cc: Andrea Righi Cc: Marcos Paulo de Souza Cc: Matthieu Baerts Cc: Fernando Fernandez Mancera Cc: Pedro Falcato Link: https://patch.msgid.link/20260307-ktest-fixes-v1-9-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière Signed-off-by: Steven Rostedt commit bc6e165a452da909cef0efbc286e6695624db372 Author: Ricardo B. Marlière Date: Sat Mar 7 19:08:03 2026 -0300 ktest: Run POST_KTEST hooks on failure and cancellation PRE_KTEST can be useful for setting up the environment and POST_KTEST to tear it down, however POST_KTEST only runs on the normal end-of-run path. It is skipped when ktest exits through dodie() or cancel_test(). Final cleanup hooks are skipped. Factor the final hook execution into run_post_ktest(), call it from the normal exit path and from the early exit paths, and guard it so the hook runs at most once. Cc: John Hawley Cc: Andrea Righi Cc: Marcos Paulo de Souza Cc: Matthieu Baerts Cc: Fernando Fernandez Mancera Cc: Pedro Falcato Link: https://patch.msgid.link/20260307-ktest-fixes-v1-8-565d412f4925@suse.com Fixes: 921ed4c7208e ("ktest: Add PRE/POST_KTEST and TEST options") Signed-off-by: Ricardo B. Marlière Signed-off-by: Steven Rostedt commit 870819434c8dfcc3158033b66e7851b81bb17e21 Author: Daniel Hodges Date: Sat Jan 31 18:40:15 2026 -0800 ima: check return value of crypto_shash_final() in boot aggregate The return value of crypto_shash_final() is not checked in ima_calc_boot_aggregate_tfm(). If the hash finalization fails, the function returns success and a corrupted boot aggregate digest could be used for IMA measurements. Capture the return value and propagate any error to the caller. Fixes: 76bb28f6126f ("ima: use new crypto_shash API instead of old crypto_hash") Signed-off-by: Daniel Hodges Reviewed-by: Roberto Sassu Signed-off-by: Mimi Zohar commit db65872b38dc9f18a62669d6ae1e4ec7868a85a9 Author: Thomas Zimmermann Date: Mon Mar 9 15:14:55 2026 +0100 lib/fonts: Remove internal symbols and macros from public header file Define access macros for font_data_t in fonts.c. Define struct font_data and declare most of the font symbols in the internal header font.h, where they can only be seen by the font code. Also move font indices into internal font.h. They appear to be unused though. There is m86k assembly code that operates on the idx field, so leave them in place for now. List all built-in fonts in a separate section in the public header file. v2: - do not add config guards around font symbols (Helge) - keep declaration of built-in fonts in public header Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit c37bd7c8d36f760c064de2639423866dc0270997 Author: Thomas Zimmermann Date: Mon Mar 9 15:14:54 2026 +0100 lib/fonts: Store font data for user space with font_data_export() Add font_data_export() and update consoles to use it. The helper font_data_export() is based on code in fbcon_get_font(). It extends the size of a single glyph to match the requested vpitch, which us usually 32 bytes for fonts from user space. Internal fonts have a pitch according to the glyph's height. The implementation of font_data_export() differs in several ways from the original code. The original implementation distinguished between different pitches of the font data. This is not necessary as the pitch is a parameter in the copying. There was also special handling for a font pitch of 3 bytes, which got expanded to 4 bytes (with trailing bits on each scanline). The logic originated from long before git history exists even in the historical tree. So it is not clear why this was implemented. It is not what user space expects. The setfont utitlity loads font with 3-bytes pitches and expects to read such fonts with a 3-byte pitch. For any font width, the font pitch is always the width extended to the next multiple of 8. See [1] for the user-space font-reading code. With the changes to handling the font pitches, font_data_export() replaces the original code's various special cases with a single copying logic. v3: - fix typos (Helge) Signed-off-by: Thomas Zimmermann Link: https://github.com/legionus/kbd/blob/v2.9.0/src/libkfont/kdfontop.c#L73 # [1] Signed-off-by: Helge Deller commit 514d0de7cf403144d3e6c5b9fabb1ce4c15974ca Author: Thomas Zimmermann Date: Mon Mar 9 15:14:53 2026 +0100 lib/fonts: Create font_data_t from struct console_font with font_data_import() Add font_data_import() and update consoles to use it. The implementation of font_data_import() is based on code from fbcon, which supports overflow checks and crc32 checksums. Fbcon uses the crc32 checksum. Newport_con now implements the same overflow checks as fbcon. As before, this console does not support checksums, which are optional. Newport_con can now also handle input font data with a vertical pitch other than 32 bytes. (The vertical pitch is the offset between two glyphs in the font data.) As an internal change, remove the const qualifier from the data field if struct font_data. This allows font_data_import() to write the data without type casting. For all users of the font data via font_data_t, the stored data is still read only. v3: - fix typos Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 1e3c49aa03fbfeea595ca0c9a4ebaf1e9cc078af Author: Thomas Zimmermann Date: Mon Mar 9 15:14:52 2026 +0100 lib/fonts: Compare font data for equality with font_data_is_equal() Add font_data_is_equal() and update consoles to use it. Font data is equal if it has the same size and contains the same values on all bytes. Only fbcon uses a crc32 checksum. If set in both operands the checksums have to be equal. The new helper also guarantees to not compare internal fonts against fonts from user space. Internal fonts cannot be ref-counted, so making them equal to user-space fonts with the same byte sequence results in undefined behavior. The test only compares data buffers. Their interpretation is up each console. Therefore remove a width test in fbcon_set_font(). v3: - rebase onto font_data_{get,put}() Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 1de371b1f1b02dc82da598f9707089229699a604 Author: Thomas Zimmermann Date: Mon Mar 9 15:14:51 2026 +0100 lib/fonts: Manage font-data lifetime with font_data_get/_put() Add font_data_get() and font_data_put(). Update consoles to use them over REFCOUNT() and plain kfree(). Newly allocated font data starts with a reference count of 1. Loading the font puts the previously loaded font. If the reference count reaches zero, font_data_put() frees the font data. The kernel stores a refcount of zero for internal font data. Invoking font_data_get() and font_data_put() tests this internally and returns success without further operation. From the caller's perspective, getting and putting works the same for all font data. Fbcon used the userfont flag distinguish between internal fonts and fonts loaded by user space. Only the latter where refcounted. With the new helper's automatic handling of internal font data, remove the userfont flag from fbcon. Newport_con uses a default font, FONT_DATA, until user space loads custom font data. Remove all special cases for FONT_DATA, as the get and put calls' read-only handling also covers this case. v3: - fix module linker error wrt font symbols (Nathan, Arnd) - fix typos Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit e2e000a0b22036a72474088d3399097ff47ace02 Author: Thomas Zimmermann Date: Mon Mar 9 15:14:50 2026 +0100 lib/fonts: Read font size with font_data_size() Add font_data_size() and update consoles to use it. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 04bd5abc8cbebc1bd7e02471a8e3af51b8aad029 Author: Thomas Zimmermann Date: Mon Mar 9 15:14:49 2026 +0100 lib/fonts: Store font data as font_data_t; update consoles Store font data as pointer to font_data_t instead of unsigned char. Update consoles. Pointers to font data refer to the raw data. There is a hidden header before the data that contains additional state. Document the existing layout and semantics of font_data_t. The data field in struct vc_font can be used by any console. Therefore it still points to plain data without the additional header. Fbcon sets its value from struct fbcon_display.fontdata. Hence, update the size test in fbcon_resize() to use struct fbcon_display.fontdata instead of struct vc_font.data. v3: - fix typos (Helge) v2: - 'Font lookup' -> 'Font description' in Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 773ac24c44614ad1d5a96258534160c4a0d48d72 Author: Thomas Zimmermann Date: Mon Mar 9 15:14:48 2026 +0100 lib/fonts: Remove FNTCHARCNT() The character count in the font data is unused. The internal fonts also do not set it. Remove FNTCHARCNT(). Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit e7564d80636e37990ef2f2ab085e22ac94c7a1a9 Author: Thomas Zimmermann Date: Mon Mar 9 15:14:47 2026 +0100 lib/fonts: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit e370d84b79ad28ecf9a9e1dad967aa64dbfbd8d8 Author: Thomas Zimmermann Date: Mon Mar 9 15:14:46 2026 +0100 vt: Calculate font-buffer size with vc_font_size() In fbcon, fbcon_resize() computes the size of the font buffer from the values stored in vc_font. Move these calculations to the dedicated helpers vc_font_pitch() and vc_font_size(). Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 61912c607fa9955dcf3fc018b227baa98a6776dc Author: Thomas Zimmermann Date: Mon Mar 9 15:14:45 2026 +0100 vt: Store font in struct vc_font Replace struct console_font with struct vc_font for the type of the vc_font field of struct vc_data. Struct console_font is UAPI, which prevents further changes. Hence a new data type is required. Struct console_font has a documented vertical pitch of 32 bytes. This is not the case after the font data has been loaded into the kernel. Changing the type of vc_font addresses this inconsistency. The font data is now declared as constant, as it might come from the kernel's read-only section. There's some fallout throughout the console code where non-const variables refer to it. Fix them. A later update will declare the font data to a dedicated data type. v3: - fix typos Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 982f8b002aadef2b5169147b3a60a9eb62f908df Author: Thomas Zimmermann Date: Mon Mar 9 15:14:44 2026 +0100 vt: Remove trailing whitespaces Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit b9e0180b2e6a48532eb80e5cd8793157196586cf Author: Thomas Zimmermann Date: Mon Mar 9 15:14:43 2026 +0100 fbdev: Declare src parameter of fb_pad_ helpers as constant Fbdev's padding helpers do not modify the source buffer. Declare the parameter as 'const'. Fbcon's font-rendering code calls these helpers with the font data. Declaring src as const will allow for making the font data constant as well. While at it, also remove the extern qualifier from the function declarations in the header file. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 82c43bae4778c5b80df02e3df03dfcc21de3bb76 Author: Jori Koolstra Date: Sun Mar 8 15:08:49 2026 +0100 drivers: rpmsg: class_destroy() is deprecated The class_destroy() function documents that: Note, the pointer to be destroyed must have been created with a call to class_create(). However, class_create() is deprecated. rpmsg already uses class_register() but the class_destroy() calls should also be replaced with class_unregister(). Link: https://lore.kernel.org/all/2023040244-duffel-pushpin-f738@gregkh/ Signed-off-by: Jori Koolstra Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20260308140850.1138376-1-jkoolstra@xs4all.nl Signed-off-by: Mathieu Poirier commit 972816d21bb1c4eb2e5095aee34eb4b109f4c2e3 Author: Ricardo B. Marlière Date: Sat Mar 7 19:08:02 2026 -0300 ktest: Add PRE_KTEST_DIE for PRE_KTEST failures PRE_KTEST runs before the first test, but its return status is currently ignored. A failing setup hook can leave the rest of the run executing in a partially initialized environment. Add PRE_KTEST_DIE so PRE_KTEST can fail the run in the same way PRE_BUILD_DIE and PRE_TEST_DIE already can. Keep the default behavior unchanged when the new option is not set. Cc: John Hawley Cc: Andrea Righi Cc: Marcos Paulo de Souza Cc: Matthieu Baerts Cc: Fernando Fernandez Mancera Cc: Pedro Falcato Link: https://patch.msgid.link/20260307-ktest-fixes-v1-7-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière Signed-off-by: Steven Rostedt commit eae247f65dece5018c83d25d165ddecd45f93dfb Author: Ricardo B. Marlière Date: Sat Mar 7 19:08:01 2026 -0300 ktest: Stop dropping console output during power-cycle reboot The POWER_CYCLE fallback added to reboot() flushes monitor output at the wrong time. In the untimed reboot path, flushing immediately after start_monitor() can consume the first output from the new boot before monitor() begins reading it. In the timed path, flushing after POWER_CYCLE can eat the "Linux version" banner or REBOOT_SUCCESS_LINE from the new kernel. That makes ktest miss the boot it is waiting for and can trigger an unnecessary second power cycle. Start the monitor before POWER_CYCLE so the reference counting stays balanced, but only flush when reboot() was asked to wait for a timed reboot. Perform that flush before issuing POWER_CYCLE so it drains stale output from the old kernel instead of consuming the next boot. Cc: John Hawley Cc: Andrea Righi Cc: Marcos Paulo de Souza Cc: Matthieu Baerts Cc: Fernando Fernandez Mancera Cc: Pedro Falcato Link: https://patch.msgid.link/20260307-ktest-fixes-v1-6-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière Signed-off-by: Steven Rostedt commit fcfc25725a19e7e41f788380df82cab42226de5a Author: Ricardo B. Marlière Date: Sat Mar 7 19:08:00 2026 -0300 ktest: Run commands through list-form shell open run_command() currently uses string-form open(): open(CMD, "$command 2>&1 |") That delegates parsing to the shell but also mixes the stderr redirection into the command string. Switch to list-form open() with an explicit sh -c wrapper so shell syntax errors are captured in the same output stream as command output. Otherwise, important errors can not be retrieved from the ktest LOG_FILE. Cc: John Hawley Cc: Andrea Righi Cc: Marcos Paulo de Souza Cc: Matthieu Baerts Cc: Fernando Fernandez Mancera Cc: Pedro Falcato Link: https://patch.msgid.link/20260307-ktest-fixes-v1-5-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière Signed-off-by: Steven Rostedt commit a2de57a3c8192dcd67cccaff6c341b93748d799b Author: Ricardo B. Marlière Date: Sat Mar 7 19:07:59 2026 -0300 ktest: Honor empty per-test option overrides A per-test override can clear an inherited default option by assigning an empty value, but __set_test_option() still used option_defined() to decide whether a per-test key existed. That turned an empty per-test assignment back into "fall back to the default", so tests still could not clear inherited settings. For example: DEFAULTS (...) LOG_FILE = /tmp/ktest-empty-override.log CLEAR_LOG = 1 ADD_CONFIG = /tmp/.config TEST_START TEST_TYPE = build BUILD_TYPE = nobuild ADD_CONFIG = This would run the test with ADD_CONFIG[1] = /tmp/.config Fix by checking whether the per-test key exists before falling back. If it does exist but is empty, treat it as unset for that test and stop the fallback chain there. Cc: John Hawley Cc: Andrea Righi Cc: Marcos Paulo de Souza Cc: Matthieu Baerts Cc: Fernando Fernandez Mancera Cc: Pedro Falcato Link: https://patch.msgid.link/20260307-ktest-fixes-v1-4-565d412f4925@suse.com Fixes: 22c37a9ac49d ("ktest: Allow tests to undefine default options") Signed-off-by: Ricardo B. Marlière Signed-off-by: Steven Rostedt commit a2706c6c4ab5f74366740576b4d06b17392f0086 Author: Ricardo B. Marlière Date: Sat Mar 7 19:07:58 2026 -0300 ktest: Treat undefined self-reference as empty Config variables are expanded when they are assigned. A first-time append such as: VAR := ${VAR} foo leaves the literal ${VAR} in the stored value because VAR has not been defined yet. Later expansions then carry the self-reference forward instead of behaving like an empty prefix. Drop an unescaped self-reference when the variable has no current value, and trim the outer whitespace left behind. Keep escaped \${VAR} references unchanged so literal text still works. Cc: John Hawley Cc: Andrea Righi Cc: Marcos Paulo de Souza Cc: Matthieu Baerts Cc: Fernando Fernandez Mancera Cc: Pedro Falcato Link: https://patch.msgid.link/20260307-ktest-fixes-v1-3-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière Signed-off-by: Steven Rostedt commit eb30942e4ed7365116c2eb9b2a25995520744620 Author: Ricardo B. Marlière Date: Sat Mar 7 19:07:57 2026 -0300 ktest: Resolve LOG_FILE in test option context LOG_FILE is expanded immediately after the config file is parsed with eval_option(..., -1). That uses the default context, not the same option resolution path used for tests. If LOG_FILE depends on options that are finalized per test, it can be resolved from stale values before the first test starts. Resolve LOG_FILE through set_test_option("LOG_FILE", 1) instead so it uses the same expansion rules as the rest of the test options. Cc: John Hawley Cc: Andrea Righi Cc: Marcos Paulo de Souza Cc: Matthieu Baerts Cc: Fernando Fernandez Mancera Cc: Pedro Falcato Link: https://patch.msgid.link/20260307-ktest-fixes-v1-2-565d412f4925@suse.com Signed-off-by: Ricardo B. Marlière Signed-off-by: Steven Rostedt commit 057854f8a595160656fe77ed7bf0d2403724b915 Author: Ricardo B. Marlière Date: Sat Mar 7 19:07:56 2026 -0300 ktest: Avoid undef warning when WARNINGS_FILE is unset check_buildlog() probes $warnings_file with -f even when WARNINGS_FILE is not configured. Perl warns about the uninitialized value and adds noise to the test log, which can hide the output we actually care about. Check that WARNINGS_FILE is defined before testing whether the file exists. Cc: John Hawley Cc: Andrea Righi Cc: Marcos Paulo de Souza Cc: Matthieu Baerts Cc: Fernando Fernandez Mancera Cc: Pedro Falcato Link: https://patch.msgid.link/20260307-ktest-fixes-v1-1-565d412f4925@suse.com Fixes: 4283b169abfb ("ktest: Add make_warnings_file and process full warnings") Signed-off-by: Ricardo B. Marlière Signed-off-by: Steven Rostedt commit 664b6b3ca5766ce487b80601f356a58d92b483b7 Author: Andrew Davis Date: Mon Mar 2 14:17:34 2026 -0600 remoteproc: keystone: Request IRQs in probe() IRQs can be registered in probe and only need to be enabled/disabled during remoteproc start/stop. This lets us catch IRQ issues early and simplify remoteproc start/stop. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260302201734.320747-1-afd@ti.com Signed-off-by: Mathieu Poirier commit 9b0ee949f7940786b0292329c2ae1f5dd63e69ba Author: Thorsten Blum Date: Thu Mar 5 15:09:13 2026 +0100 platform/x86: dell-wmi-sysman: Use sysfs_emit{_at} in show functions Replace sprintf() with sysfs_emit() and sysfs_emit_at() in sysfs show functions. sysfs_emit() and sysfs_emit_at() are preferred for formatting sysfs output because they provide safer bounds checking. In reset_bios_show(), use sysfs_emit_at() to avoid manual buffer size accounting. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260305140912.258090-2-thorsten.blum@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4f6d6fb3a6c53241c6059947d54b9f68fa0719e1 Author: Eric Biggers Date: Thu Feb 5 20:59:41 2026 -0800 dm-verity-fec: improve comments for fec_read_bufs() Update the comments in and above fec_read_bufs() to more clearly describe what it does. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit d0829329de71634129420ff53557bb0ade6a9145 Author: Eric Biggers Date: Thu Feb 5 20:59:40 2026 -0800 dm-verity-fec: log target_block instead of index_in_region The log message for a FEC error or correction includes the data device name and index_in_region as the context. Although the result of FEC (for a particular dm-verity instance) is expected to be the same for a given index_in_region, index_in_region does not uniquely identify the actual target block that is being corrected. Since that value (target_block) is likely more useful, log it instead. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 71dab3b90f177462a23af81658c9cea327016137 Author: Eric Biggers Date: Thu Feb 5 20:59:39 2026 -0800 dm-verity-fec: make fec_decode_bufs() just return 0 or error fec_decode_bufs() returns the number of errors corrected or a negative errno value. However, the caller just checks for an errno value and doesn't do anything with the number of errors corrected. Simplify the code by just returning 0 instead of the number of errors corrected. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit b39b3c812eaf7956cc6f9ba570b75b5d52c8da62 Author: Eric Biggers Date: Thu Feb 5 20:59:38 2026 -0800 dm-verity-fec: pass down index_in_region instead of rsb Replace 'rsb', which is a byte index, with 'index_in_region' which is a block index. The block index is slightly easier to compute, it matches what fec_read_bufs() wants, and it avoids the mismatch between the name and the units of the variable. ('rsb' stood for "Reed-Solomon block", but its units were bytes, not blocks.) fec_decode_bufs() does want it as a byte index when computing parity_block, but that's easily handled locally. As long as the parameters to the log messages are being adjusted, also eliminate the unnecessary casts to 'unsigned long long'. %llu is the correct way to print a u64 in the Linux kernel, as documented in printk-formats.rst. There's no PRIu64 macro like there is in userspace. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit ca21ed4089200ff32ef0a17f58b6153499121cef Author: Eric Biggers Date: Thu Feb 5 20:59:37 2026 -0800 dm-verity-fec: compute target region directly Instead of determining the target block's region by checking which block of the k blocks being iterated over in fec_read_bufs() is equal to the target block, instead just directly use the quotient of the division of target_block by region_blocks. This is the same value, just derived in a more straightforward way. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit ca0da6cc096870e9e138f4c2bb78bd2560e29590 Author: Eric Biggers Date: Thu Feb 5 20:59:36 2026 -0800 dm-verity-fec: move computation of offset and rsb down a level verity_fec_decode() computes (offset, rsb) from the target block index and calls fec_decode_rsb() with these parameters. Move this computation into fec_decode_rsb(), and rename fec_decode_rsb() to fec_decode(). This ends up being simpler and enables further refactoring, specifically making use of the quotient from the division more easily. The function renaming also eliminates a reference to the ambiguous term "rsb". This change does mean the same div64_u64_rem() can now be executed twice per block, since verity_fec_decode() calls fec_decode() up to twice per block. However, this cost is negligible compared to the rest of FEC. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 3ad2b952a3ea26c05ed6fdd6484051604b1dee66 Author: Eric Biggers Date: Thu Feb 5 20:59:35 2026 -0800 dm-verity-fec: rename block_offset to out_pos The current position in the output block buffer is called 'pos' in fec_decode_rsb(), and 'block_offset' in fec_read_bufs() and fec_decode_bufs(). These names aren't very clear, especially 'block_offset' which is easily confused with the offset of a message or parity block or the position in the current parity block. Rename it to 'out_pos'. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 96dfabe7382bb984a702b689b69b784d2a29ca0b Author: Eric Biggers Date: Thu Feb 5 20:59:34 2026 -0800 dm-verity-fec: simplify deinterleaving Since fec_read_bufs() deinterleaves the bytes from 'bbuf' sequentially starting from 'block_offset', it can just do simple increments instead of the more complex fec_buffer_rs_index() computation. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 5ef22361fa98a44409f11a10cb7d08b5cbf6d57c Author: Eric Biggers Date: Thu Feb 5 20:59:33 2026 -0800 dm-verity-fec: simplify computation of ileaved fec_read_bufs() just iterates over a sequence of message blocks with step size region_blocks. At each step, 'ileaved' is just the offset (in bytes) to one of these blocks. Compute it in the straightforward way, eliminating fec_interleave(). In more detail, previously the code computed 'ileaved = (n / k) + (n % k) * (region_blocks * block_size)' where n = rsb * k + i and 0 <= i < k. Substituting 'n' gives: ileaved = ((rsb * k + i) / k) + ((rsb * k + i) % k) * region_blocks * block_size = rsb + (i * region_blocks * block_size) The result is more efficient and easier to understand. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 8ef45923fdcb7ec44e3a965bcbf41723e20814e4 Author: Eric Biggers Date: Thu Feb 5 20:59:32 2026 -0800 dm-verity-fec: simplify computation of rsb To compute 'rsb', verity_fec_decode() divides 'offset' by 'v->fec->region_blocks << v->data_dev_block_bits', then subtracts the quotient times that divisor. That's simply the long way to do a modulo operation, i.e. a - b * floor(a / b) instead of just a % b. Use div64_u64_rem() to get the remainder more concisely. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 41208f3707e97976f3b1b7c36c4c094e05e5cf1d Author: Eric Biggers Date: Thu Feb 5 20:59:31 2026 -0800 dm-verity-fec: rename rounds to region_blocks It's hard to reconcile the value stored in dm_verity_fec::rounds with its name and documentation. Most likely "rounds" is being used as an alias for what is more commonly called the interleaving degree or "number of ways". But the interleaving is done at the byte level, whereas the units of "rounds" are blocks. So it's not really that. In practice, the reason the code needs this value is that it expresses the number of blocks in each "region" of the message data, where each region contains the bytes from a particular index in the RS codewords. Rename it to region_blocks to make the code a bit more understandable. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit e75d55461871bbf5debe33f528f267e23c84a370 Author: Eric Biggers Date: Thu Feb 5 20:59:30 2026 -0800 dm-verity-fec: replace io_size with block_size dm-verity's FEC implementation assumes that data_block_size == hash_block_size, and it accesses the FEC device in units of the same size. Many places in the code want that size and compute it on-demand as '1 << v->data_dev_block_bits'. However, it's actually already available in v->fec->io_size. Rename that field to block_size, initialize it a bit earlier, and use it in the appropriate places. Note that while these sizes could in principle be different, that case is not supported. So there's no need to complicate the code for it. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 9b6098ad5b19261fd319b2637a28c69693585908 Author: Eric Biggers Date: Thu Feb 5 20:59:29 2026 -0800 dm-verity-fec: rename "RS block" to "RS codeword" The literature refers to the unit of a Reed-Solomon (RS) code as either a "block" or a "codeword". dm-verity's source code uses "RS block". Unfortunately, that's really confusing because "block" already means something else in dm-verity. Especially problematic is the fact that dm-verity sometimes uses "RS block" to mean an RS codeword and sometimes to mean some dm-verity block that's related to the RS decoding process, for example one of the blocks that shares its RS codewords with the target block. Let's use "RS codeword" instead, or "RS message" when referring to just the message part of the codeword. Update some comments, function names, macro names, and variable names accordingly. No functional change. There are still some remaining comments where "RS block" refers to a dm-verity block. Later commits will handle these cases. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit f34ebde14c7c23fa9844cc5c03209048510fd686 Author: Eric Biggers Date: Thu Feb 5 20:59:28 2026 -0800 dm-verity-fec: use standard names for Reed-Solomon parameters "RS(n, k)" is by far the most common and standard notation for describing Reed-Solomon codes. Each RS codeword consists of 'n' symbols, divided into 'k' message symbols and 'n - k' parity symbols. 'n - k' is also the number of roots of the generator polynomial. dm-verity uses "RS(M, N)" instead. I haven't been able to find any other source that uses this convention. This quirk makes the code harder to understand than necessary, especially due to dm-verity's 'N' meaning something different from the standard 'n'. Therefore, update dm-verity-fec.c and dm-verity-fec.h to use the standard parameter names. No functional changes. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 82fbd6a3e29a329d439690cd7ccc4162c9cd8db6 Author: Eric Biggers Date: Thu Feb 5 20:59:27 2026 -0800 dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS Every time DM_VERITY_FEC_{MAX,MIN}_RSN are used, they are subtracted from DM_VERITY_FEC_RSM to get the bounds on the number of roots. Therefore, replace these with {MIN,MAX}_ROOTS constants which are more directly useful. (Note the inversion, where MAX_RSN maps to MIN_ROOTS and MIN_RSN maps to MAX_ROOTS.) No functional change. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 05777b2800b060585d601705a8d1bb5afadc2f11 Author: Eric Biggers Date: Thu Feb 5 20:59:26 2026 -0800 dm-verity-fec: improve documentation for Forward Error Correction Update verity.rst to add a dedicated section about FEC and improve the documentation for the FEC-related parameters. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit a9fbb31af763344072dbd7afcdff79438c70d480 Author: Eric Biggers Date: Thu Feb 5 20:59:25 2026 -0800 dm-verity: rename dm_verity::hash_blocks to dm_verity::hash_end Rename hash_blocks to hash_end to reflect what it actually is. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 430a05cb926f6bdf53e81460a2c3a553257f3f61 Author: Eric Biggers Date: Thu Feb 5 20:59:24 2026 -0800 dm-verity-fec: fix reading parity bytes split across blocks (take 3) fec_decode_bufs() assumes that the parity bytes of the first RS codeword it decodes are never split across parity blocks. This assumption is false. Consider v->fec->block_size == 4096 && v->fec->roots == 17 && fio->nbufs == 1, for example. In that case, each call to fec_decode_bufs() consumes v->fec->roots * (fio->nbufs << DM_VERITY_FEC_BUF_RS_BITS) = 272 parity bytes. Considering that the parity data for each message block starts on a block boundary, the byte alignment in the parity data will iterate through 272*i mod 4096 until the 3 parity blocks have been consumed. On the 16th call (i=15), the alignment will be 4080 bytes into the first block. Only 16 bytes remain in that block, but 17 parity bytes will be needed. The code reads out-of-bounds from the parity block buffer. Fortunately this doesn't normally happen, since it can occur only for certain non-default values of fec_roots *and* when the maximum number of buffers couldn't be allocated due to low memory. For example with block_size=4096 only the following cases are affected: fec_roots=17: nbufs in [1, 3, 5, 15] fec_roots=19: nbufs in [1, 229] fec_roots=21: nbufs in [1, 3, 5, 13, 15, 39, 65, 195] fec_roots=23: nbufs in [1, 89] Regardless, fix it by refactoring how the parity blocks are read. Fixes: 6df90c02bae4 ("dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit a7fca324d7d90f7b139d4d32747c83a629fdb446 Author: Eric Biggers Date: Thu Feb 5 20:59:23 2026 -0800 dm-verity-fec: fix the size of dm_verity_fec_io::erasures At most 25 entries in dm_verity_fec_io::erasures are used: the maximum number of FEC roots plus one. Therefore, set the array size accordingly. This reduces the size of dm_verity_fec_io by 912 bytes. Note: a later commit introduces a constant DM_VERITY_FEC_MAX_ROOTS, which allows the size to be more clearly expressed as DM_VERITY_FEC_MAX_ROOTS + 1. This commit just fixes the size first. Fixes: a739ff3f543a ("dm verity: add support for forward error correction") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 48640c88a8ddd482b6456fcbc084b08dd2bac083 Author: Eric Biggers Date: Thu Feb 5 20:59:22 2026 -0800 dm-verity-fec: fix corrected block count stat dm_verity_fec::corrected seems to have been intended to count the number of corrected blocks. However, it actually counted the number of calls to fec_decode_bufs() that corrected at least one error. That's not the same thing. For example, in low-memory situations correcting a single block can require many calls to fec_decode_bufs(). Fix it to count corrected blocks instead. Fixes: ae97648e14f7 ("dm verity fec: Expose corrected block count via status") Cc: Shubhankar Mishra Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 4355142245f7e55336dcc005ec03592df4d546f8 Author: Eric Biggers Date: Thu Feb 5 20:59:21 2026 -0800 dm-verity-fec: correctly reject too-small hash devices Fix verity_fec_ctr() to reject too-small hash devices by correctly taking hash_start into account. Note that this is necessary because dm-verity doesn't call dm_bufio_set_sector_offset() on the hash device's bufio client (v->bufio). Thus, dm_bufio_get_device_size(v->bufio) returns a size relative to 0 rather than hash_start. An alternative fix would be to call dm_bufio_set_sector_offset() on v->bufio, but then all the code that reads from the hash device would have to be adjusted accordingly. Fixes: a739ff3f543a ("dm verity: add support for forward error correction") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 2b14e0bb63cc671120e7791658f5c494fc66d072 Author: Eric Biggers Date: Thu Feb 5 20:59:20 2026 -0800 dm-verity-fec: correctly reject too-small FEC devices Fix verity_fec_ctr() to reject too-small FEC devices by correctly computing the number of parity blocks as 'f->rounds * f->roots'. Previously it incorrectly used 'div64_u64(f->rounds * f->roots, v->fec->roots << SECTOR_SHIFT)' which is a much smaller value. Note that the units of 'rounds' are blocks, not bytes. This matches the units of the value returned by dm_bufio_get_device_size(), which are also blocks. A later commit will give 'rounds' a clearer name. Fixes: a739ff3f543a ("dm verity: add support for forward error correction") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit d913a5a12b4036e4219b02777d0a9c70e37a6620 Author: Rafael J. Wysocki Date: Wed Mar 4 19:55:28 2026 +0100 platform/surface: surfacepro3_button: Convert to a platform driver In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Surface Pro 3 button ACPI driver to a platform one. After this change, the subordinate input device and wakeup source class device will be registered under the platform device used for driver binding instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3207406.CbtlEUcBR6@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 639d8c601c7a9aab44803245a22f6e3c365b08be Author: Rafael J. Wysocki Date: Wed Mar 4 19:54:47 2026 +0100 platform/surface: surfacepro3_button: Register ACPI notify handler To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/1881356.TLkxdtWsSY@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1410a228ab2d36fe2b383415a632ae12048d4f3a Author: Rafael J. Wysocki Date: Wed Mar 4 19:54:08 2026 +0100 platform/surface: surfacepro3_button: Drop wakeup source on remove The wakeup source added by device_init_wakeup() in surface_button_add() needs to be dropped during driver removal, so update the driver to do that. Fixes: 19351f340765 ("platform/x86: surfacepro3: Support for wakeup from suspend-to-idle") Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/4368848.1IzOArtZ34@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c20e36b7631d83e7535877f08af8b0af72c44b1a Author: Junrui Luo Date: Thu Mar 5 20:05:48 2026 +0800 dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit). When a device-mapper target has a sufficiently large ti->len with a small region_size, the division result can exceed UINT_MAX. The truncated value is then used to calculate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be allocated far smaller than needed for the actual number of regions. Subsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use region indices derived from the full untruncated region space, causing out-of-bounds writes to kernel heap memory allocated by vmalloc. This can be reproduced by creating a mirror target whose region_count overflows 32 bits: dmsetup create bigzero --table '0 8589934594 zero' dmsetup create mymirror --table '0 8589934594 mirror \ core 2 2 nosync 2 /dev/mapper/bigzero 0 \ /dev/mapper/bigzero 0' The status output confirms the truncation (sync_count=1 instead of 4294967297, because 0x100000001 was truncated to 1): $ dmsetup status mymirror 0 8589934594 mirror 2 254:1 254:1 1/4294967297 ... This leads to a kernel crash in core_in_sync: BUG: scheduling while atomic: (udev-worker)/9150/0x00000000 RIP: 0010:core_in_sync+0x14/0x30 [dm_log] CR2: 0000000000000008 Fixing recursive fault but reboot is needed! Fix by widening the local region_count to sector_t and adding an explicit overflow check before the value is assigned to lc->region_count. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Yuhao Jiang Signed-off-by: Junrui Luo Signed-off-by: Mikulas Patocka commit 044ca491d4086dc5bf233e9fcb71db52df32f633 Author: Ming-Hung Tsai Date: Wed Mar 4 19:56:28 2026 +0800 dm cache metadata: fix memory leak on metadata abort retry When failing to acquire the root_lock in dm_cache_metadata_abort because the block_manager is read-only, the temporary block_manager created outside the root_lock is not properly released, causing a memory leak. Reproduce steps: This can be reproduced by reloading a new table while the metadata is read-only. While the second call to dm_cache_metadata_abort is caused by lack of support for table preload in dm-cache, mentioned in commit 9b1cc9f251af ("dm cache: share cache-metadata object across inactive and active DM tables"), it exposes the memory leak in dm_cache_metadata_abort when the function is called multiple times. Specifically, dm-cache fails to sync the new cache object's mode during preresume, creating the reproducer condition. This issue could also occur through concurrent metadata_operation_failed calls due to races in cache mode updates, but the table preload scenario below provides a reliable reproducer. 1. Create a cache device with some faulty trailing metadata blocks dmsetup create cmeta < unreferenced object 0xffff8880080c2010 (size 16): comm "dmsetup", pid 132, jiffies 4294982580 hex dump (first 16 bytes): 00 38 b9 07 80 88 ff ff 6a 6b 6b 6b 6b 6b 6b a5 ... backtrace (crc 3118f31c): kmemleak_alloc+0x28/0x40 __kmalloc_cache_noprof+0x3d9/0x510 dm_block_manager_create+0x51/0x140 dm_cache_metadata_abort+0x85/0x320 metadata_operation_failed+0x103/0x1e0 cache_preresume+0xacd/0xe70 dm_table_resume_targets+0xd3/0x320 __dm_resume+0x1b/0xf0 dm_resume+0x127/0x170 Fixes: 352b837a5541 ("dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort") Signed-off-by: Ming-Hung Tsai Signed-off-by: Mikulas Patocka commit a9aa6045abde87b94168c3ba034b953417e27272 Author: Christoph Hellwig Date: Mon Feb 23 05:20:07 2026 -0800 block: pass a maxlen argument to bio_iov_iter_bounce Allow the file system to limit the size processed in a single bounce operation. This is needed when generating integrity data so that the size of a single integrity segment can't overflow. Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Reviewed-by: Martin K. Petersen Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit 0bde8a12b5540572a7fd6d2867bee6de15e4f289 Author: Christoph Hellwig Date: Mon Feb 23 05:20:06 2026 -0800 block: add fs_bio_integrity helpers Add a set of helpers for file system initiated integrity information. These include mempool backed allocations and verifying based on a passed in sector and size which is often available from file system completion routines. Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Reviewed-by: Martin K. Petersen Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit 8c56ef10150ed7650cf4105539242c94c156148c Author: Christoph Hellwig Date: Mon Feb 23 05:20:05 2026 -0800 block: make max_integrity_io_size public File systems that generate integrity will need this, so move it out of the block private or blk-mq specific headers. Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Reviewed-by: Martin K. Petersen Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit 3f00626832a9f85fc5a04b25898157a6d43cb236 Author: Christoph Hellwig Date: Mon Feb 23 05:20:04 2026 -0800 block: prepare generation / verification helpers for fs usage Return the status from verify instead of directly stashing it in the bio, and rename the helpers to use the usual bio_ prefix for things operating on a bio. Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Reviewed-by: Martin K. Petersen Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit 7afe93946dff63aa57c6db81f5eb43ac8233364e Author: Christoph Hellwig Date: Mon Feb 23 05:20:03 2026 -0800 block: add a bdev_has_integrity_csum helper Factor out a helper to see if the block device has an integrity checksum from bdev_stable_writes so that it can be reused for other checks. Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Reviewed-by: Martin K. Petersen Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit a936655697cd8d1bab2fd5189e2c33dd6356a266 Author: Christoph Hellwig Date: Mon Feb 23 05:20:02 2026 -0800 block: factor out a bio_integrity_setup_default helper Add a helper to set the seed and check flag based on useful defaults from the profile. Note that this includes a small behavior change, as we now only set the seed if any action is set, which is fine as nothing will look at it otherwise. Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Reviewed-by: Martin K. Petersen Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit 7ea25eaad5ae3a6c837a3df9bdb822194f002565 Author: Christoph Hellwig Date: Mon Feb 23 05:20:01 2026 -0800 block: factor out a bio_integrity_action helper Split the logic to see if a bio needs integrity metadata from bio_integrity_prep into a reusable helper than can be called from file system code. Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Reviewed-by: Martin K. Petersen Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit 8a44bd3ffdb269c028236d9165ce06a46c091373 Author: Rafael J. Wysocki Date: Sat Feb 28 16:28:19 2026 +0100 platform/x86: intel/smartconnect: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Intel Smart Connect disabling ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/24282289.6Emhk5qWAg@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 163a68a31f743c5a820f348322b9162bc89c720a Author: Rafael J. Wysocki Date: Sat Feb 28 16:27:33 2026 +0100 platform/x86: intel/rst: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Intel Rapid Start Technology (rst) ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3599223.QJadu78ljV@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 97af961568c8682c44506c9ad4b26c8a5455ec1d Author: Richard Fitzgerald Date: Mon Mar 9 12:45:43 2026 +0000 ASoC: cs35l56: Put OTP register defines in correct address order Move the defines for the OTP registers to keep the register defines in order of increasing address. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260309124543.1135247-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit eae0946b2485109a9f24f46853497f5b1983ab79 Author: Christophe Leroy (CS GROUP) Date: Mon Mar 9 12:46:49 2026 +0100 ASoC: codecs: peb2466: Change the +/- 6dB switch to a volume In addition to the digital volume adjustment, infineon peb2466 codec has an analog adjustment which can be set to either 0dB or +/-6dB. At the time being it is defined as a switch and appears in 'alsamixer' like a 'mute'. This adjustment isn't a mute, change it to a 'volume' with an associated dB range. With this change, this adjustment now appears in 'alsamixer' as a standard volume slider which can have two positions. Signed-off-by: Christophe Leroy (CS GROUP) Acked-by: Herve Codina Link: https://patch.msgid.link/418fe76d1c9efc8182ab57b6b426a8c723e025fe.1773056714.git.chleroy@kernel.org Signed-off-by: Mark Brown commit 66f71ec3539e0e724f5099e6d4bbc81db4d9954a Author: Richard Fitzgerald Date: Mon Mar 9 11:56:51 2026 +0000 ASoC: cs35l56-test: Remove pointless duplicate loop counters In cs35l56_test_parse_xu_onchip_spkid() the first two loops used local i to index an array and num_gpios/num_pulls to count how many entries it had seen. But both i and num_* started at 0 and incremented on each loop so were identical. Remove i from these loops. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260309115651.1090368-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 079b59fd2d79e4f492cba7013c5f60787d573fc8 Author: Rafael J. Wysocki Date: Sat Feb 28 16:22:54 2026 +0100 platform/x86: eeepc-laptop: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the EEEPC laptop ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Denis Benato Link: https://patch.msgid.link/3329436.5fSG56mABF@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5eea33b4d301e279abe49cdbd28f8be24e8932a1 Author: Rafael J. Wysocki Date: Sat Feb 28 16:22:08 2026 +0100 platform/x86: eeepc-laptop: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Denis Benato Link: https://patch.msgid.link/3681264.iIbC2pHGDl@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 46ab50745309c3f230f6ae4328f280607ef2c69b Author: Thorsten Blum Date: Thu Mar 5 13:25:49 2026 +0100 mmc: tifm_sd: Use min3() to simplify tifm_sd_transfer_data() Use min3() to simplify tifm_sd_transfer_data(). Signed-off-by: Thorsten Blum Signed-off-by: Ulf Hansson commit 6c9b6c635148e3dc39ab1411fa5d9762596831ac Author: Thorsten Blum Date: Thu Mar 5 13:25:48 2026 +0100 mmc: sdio: Use min3() to simplify sdio_set_block_size() Use min3() to simplify sdio_set_block_size(). Signed-off-by: Thorsten Blum Signed-off-by: Ulf Hansson commit cb9487333652b2cfb4f10ef596fc5b675241cae9 Author: Pavel Begunkov Date: Mon Feb 16 11:48:52 2026 +0000 io_uring/zctx: separate notification user_data People previously asked for the notification CQE to have a different user_data value from the main request completion. It's useful to separate buffer and request handling logic and avoid separately refcounting the request. Let the user pass the notification user_data in sqe->addr3. If zero, it'll inherit sqe->user_data as before. It doesn't change the rules for when the user can expect a notification CQE, and it should still check the IORING_CQE_F_MORE flag. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit dce00c83035b880deebf7b2f0a204f740cb90d64 Author: Pavel Begunkov Date: Tue Mar 3 12:32:19 2026 +0000 io_uring/net: allow vectorised regbuf send zc Enable IORING_SEND_VECTORIZED with registered buffers for IORING_OP_SEND_ZC. Set IORING_SEND_VECTORIZED for all msg send requests to differentiate if the vectorised version is expected. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d8345a21902af5d754f2c2aadf877de989e3cac3 Author: Pavel Begunkov Date: Mon Mar 2 13:10:37 2026 +0000 io_uring/timeout: immediate timeout arg One the things the user has always keep in mind is that any user pointers they put into an SQE is not going to be read by the kernel until submission happens, and the user has to ensure the pointee stays alive until then. For example, snippet below will lead to UAF of the on stack variable ts. Instead of passing the timeout value as a pointer allow to store it immediately in the SQE. The user has to set a new flag called IORING_TIMEOUT_IMMEDIATE_ARG, in which case sqe->addr for timeout or sqe->addr2 for timeout update requests will be interpreted as a time value in nanosecods. void prep_timeout(struct io_uring_sqe *sqe) { struct __kernel_timespec ts = {...}; prep_timeout(sqe, &ts); } void submit() { sqe = get_sqe(); prep_timeout(sqe); io_uring_submit(); } Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 0e78aa188cbddc6311ff24938b1c8d3850b35708 Author: Pavel Begunkov Date: Mon Mar 2 13:10:36 2026 +0000 io_uring/timeout: migrate reqs from ts64 to ktime It'll be more convenient for next patches to keep ktime in requests instead of timespec64. Convert everything to ktime right after user argument parsing at request prep time. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 6e3f5943a49b1593921fd340ff1dffba851c2afd Author: Pavel Begunkov Date: Mon Mar 2 13:10:35 2026 +0000 io_uring/timeout: add helper for parsing user time There is some duplication for timespec checks that can be deduplicated with a new function, and it'll be extended in next patches. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 484ae637a3e3d909718de7c07afd3bb34b6b8504 Author: Pavel Begunkov Date: Mon Mar 2 13:10:34 2026 +0000 io_uring/timeout: check unused sqe fields Zero check unused SQE fields addr3 and pad2 for timeout and timeout update requests. They're not needed now, but could be used sometime in the future. Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d9d2455e77d0f36a22b9dbaba8b6354dd1378101 Author: Pavel Begunkov Date: Sun Feb 15 23:31:20 2026 +0000 io_uring/zcrx: move zcrx uapi into separate header Split out zcrx uapi into a separate file. It'll be easier to manage it this way, and that reduces the size of a not so small io_uring.h. Since there are users that expect that zcrx definitions come with io_uring.h, it includes the new file. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit dc156e0f1aae69659885422364438ff8eb022e09 Author: Pavel Begunkov Date: Sun Feb 15 23:29:39 2026 +0000 io_uring/zcrx: declare some constants for query Add constants for zcrx features and supported registration flags that can be reused by the query code. I was going to add another registration flag, and this patch helps to avoid duplication and keeps changes specific to zcrx files. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 403fec55bf938bde4f8361b1afa135c853ca5ef9 Author: Pavel Begunkov Date: Mon Feb 16 11:45:55 2026 +0000 io_uring/zctx: unify zerocopy issue variants io_send_zc and io_sendmsg_zc started different but now the only real difference between them is how registered buffers are imported and which net helper we use. Avoid duplication and combine them into a single function. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 2f9965f5d5de022e2040231712f36d4e93d8a3df Author: Pavel Begunkov Date: Mon Feb 16 11:45:54 2026 +0000 io_uring/zctx: move vec regbuf import into io_send_zc_import Unify send and sendmsg zerocopy paths for importing registered buffers and make io_send_zc_import() responsible for that. It's a preparation patch making the next change simpler. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit c279fcd95ae136c9dccccc8b7f5069f651449e58 Author: Pavel Begunkov Date: Mon Feb 16 11:45:53 2026 +0000 io_uring/zctx: rename flags var for more clarity The name "flags" is too overloaded, so rename the variable in io_sendmsg_zc() into msg_flags to stress that it contains MSG_*. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit bdb489adca295a14750c7343ddb035830fc033b1 Author: Asbjørn Sloth Tønnesen Date: Mon Feb 16 16:03:53 2026 +0000 io_uring/cmd_net: split ioctl code out of io_uring_cmd_sock() io_uring_cmd_sock() originally supported two ioctl-based cmd_op operations. Over time, additional operations were added with tail calls to their helpers. This approach resulted in the new operations sharing an ioctl check with the original operations. io_uring_cmd_sock() now supports 6 operations, so let's move the implementation of the original two into their own helper, reducing io_uring_cmd_sock() to a simple dispatcher. Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jens Axboe commit 4cbdda11fd016689edd5f200726190701bfc7f2a Author: Geert Uytterhoeven Date: Thu Mar 5 10:08:24 2026 +0100 mmc: renesas_sdhi_sys_dmac: Convert to DEFINE_RUNTIME_DEV_PM_OPS() Convert the Renesas SDHI SD/SDIO controller driver using SYS-DMAC from an open-coded dev_pm_ops structure to DEFINE_RUNTIME_DEV_PM_OPS() and pm_ptr(). This simplifies the code, and reduces kernel size in case CONFIG_PM is disabled. Signed-off-by: Geert Uytterhoeven Signed-off-by: Ulf Hansson commit bdc1eb80b9b9793e28f625a790b0ae0387bb5b17 Author: Binbin Zhou Date: Tue Mar 3 19:27:40 2026 +0800 mmc: loongson2: Add Loongson-2K0300 SD/SDIO/eMMC controller driver This patch describes the two MMC controllers of the Loongson-2K0300 SoC, one providing an eMMC interface and the other exporting an SD/SDIO interface. Its hardware design is similar to that of the Loongson-2K2000, but it suffers from hardware defects such as missing CMD48 interrupts. Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Signed-off-by: Ulf Hansson commit 1d1519bc582c4700c37b6ba7bb5cde237060159b Author: Binbin Zhou Date: Tue Mar 3 19:27:39 2026 +0800 mmc: loongson2: Gathering all SoCs private data together More Loongson SoCs will be added, gathering all SoC private data (`loongson2_mmc_pdata`) together to make the code clearer. No functional change intended. Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Signed-off-by: Ulf Hansson commit f1ccb2b0955293766c5f50002299202bf49a4142 Author: Binbin Zhou Date: Tue Mar 3 19:27:38 2026 +0800 dt-bindings: mmc: loongson,ls2k0500-mmc: Add compatible for Loongson-2K0300 Add "loongson,ls2k0300-mmc" dedicated compatible to represent the eMMC/SD/SDIO controller interface of the Loongson-2K0300 chip. Its hardware design is similar to that of the Loongson-2K2000, but it suffers from hardware defects such as missing CMD48 interrupts. Signed-off-by: Binbin Zhou Acked-by: Conor Dooley Reviewed-by: Huacai Chen Signed-off-by: Ulf Hansson commit b30a462720ad15613ede9e365938d401ed464095 Author: Rafael J. Wysocki Date: Sat Feb 28 16:18:52 2026 +0100 platform/x86: acer-wireless: Convert ACPI driver to a platform one In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Acer wireless ACPI driver to a platform one. After this change, the subordinate input device will be registered under the platform device used for driver binding instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2032103.PYKUYFuaPT@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6fdc70794cc15b450e3fd750ca048318764a343e Author: Rafael J. Wysocki Date: Sat Feb 28 16:18:01 2026 +0100 platform/x86: acer-wireless: Register ACPI notify handler directly To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/10810967.nUPlyArG6x@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 670f524faedccb1749beeb445c833ecae8c7409b Author: Felix Gu Date: Mon Mar 2 21:47:12 2026 +0800 mmc: sdhci-of-bst: Fix memory leak in sdhci_bst_alloc_bounce_buffer() In sdhci_bst_alloc_bounce_buffer(), if dma_alloc_coherent() fails, the function immediately returns -ENOMEM without releasing the reserved memory, which results in a memory leak. Add the missing of_reserved_mem_device_release() call before returning -ENOMEM to properly clean up the reserved memory. Fixes: 695824f45629 ("mmc: sdhci: add Black Sesame Technologies BST C1200 controller driver") Signed-off-by: Felix Gu Signed-off-by: Ulf Hansson commit 824254f3c2518fb24e5d7aad1d9651f87f24ff2c Merge: 6eba866b0ab61a 3c080bb2639d7b Author: Ulf Hansson Date: Mon Mar 9 13:45:42 2026 +0100 mmc: Merge the immutable mux branch into next The mux branch contains updates to the mux core along with some corresponding changes for a couple of consumer drivers, including an mmc driver. Let's merge it into the next branch to get it tested and queued for the next release. Signed-off-by: Ulf Hansson commit 3c080bb2639d7b17bf83ca561f60252774a77b37 Author: Josua Mayer Date: Thu Feb 26 15:21:17 2026 +0200 mmc: host: renesas_sdhi_core: support selecting an optional mux Some hardware designs route data or control signals through a mux to support multiple devices on a single sdhi controller. In particular SolidRun RZ/G2L/G2LC/V2L System on Module use a mux for switching between soldered eMMC and an optional microSD on a carrier board, e.g. for development or provisioning. SD/SDIO/eMMC are not well suited for runtime switching between different cards, however boot-time selection is possible and useful - in particular considering dt overlays. Add support for an optional SD/SDIO/eMMC mux defined in dt, and select it during probe. Similar functionality already exists in other places, e.g. i2c-omap. Signed-off-by: Josua Mayer Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Signed-off-by: Ulf Hansson commit ce5c7c17e70640fc5635fd2252d0bdf4664d452b Author: Josua Mayer Date: Thu Feb 26 15:21:16 2026 +0200 mux: add visible config symbol to enable multiplexer subsystem The multiplexer subsystem was initially designed to be completely hidden, relying on consumers to "select MULTIPLEXER" explicitly. Drivers implementing multiplexers depend on this hidden symbol. This prevents users from manually enabling both the mux core and any of the multiplexer drivers. All multiplexer drivers in drivers/mux/ can operate standalone without a consumer. This is particularly useful in a device-tree, where a default state can be set through the idle-state property. Over time, several drivers have added "select MULTIPLEXER" dependencies, some of which require a mux and some consider it optional. v7.0-rc1 shows 15 such occurrences in Kconfig files, in a variety of subsystems. The natural step forward to allow enabling mux core and drivers would be adding a prompt and help text to the existing symbol. This violates the general Kbuild advice to avoid selecting visible symbols for all existing consumers of the mux core. Add the new config symbol MUX_CORE with a prompt and help text as a wrapper for users to enable manually. This avoids existing consumers automatically selecting a visible symbol. Change the MULTIPLEXER symbol from tristate to bool. This avoids complex dependencies if users were to attempt a configuration where the mux is a module but one of its consumers is built-in, as well as difficulties keeping the state of visible and invisible symbols in sync. Further convert the "menu ... depends on ..." structure to "if ... menu ... endmenu endif". These are functionally equivalent, but the new structure is more efficient and can support future source statements within the conditional block. Signed-off-by: Josua Mayer Signed-off-by: Ulf Hansson commit bc0d3adf2f47439e8b7ffd228154d71b8acb50e6 Author: Josua Mayer Date: Thu Feb 26 15:21:15 2026 +0200 dt-bindings: mmc: renesas,sdhi: Add mux-states property Add mux controller support for data or control lines that are muxed between a host and multiple cards. There are several devices supporting a choice of eMMC or SD on a single board by both dip switch and gpio, e.g. Renesas RZ/G2L SMARC SoM and SolidRun RZ/G2L SoM. In-tree dts for the Renesas boards currently rely on preprocessor macros and gpio hogs to describe the respective cards. By adding mux-states property to sdhi controller description, boards can correctly describe the mux that already exists in hardware - and drivers can coordinate between mux selection and probing for cards. Acked-by: Rob Herring (Arm) Reviewed-by: Wolfram Sang Signed-off-by: Josua Mayer Signed-off-by: Ulf Hansson commit 43c00f2bcff7c6e235f0c1b1eb18a6db0aa23815 Author: Josua Mayer Date: Thu Feb 26 15:21:14 2026 +0200 i2c: omap: switch to new generic helper for getting selected mux-state Multiplexer subsystem has added generic helper functions for getting an already selected mux-state object. Replace existing logic in probe with the equivalent helper function. There is a functional difference in that the mux is now automatically deselected on release, replacing the explicit mux_state_deselect call. This change is only compile-tested. Reviewed-by: Geert Uytterhoeven Reviewed-by: Andreas Kemnade Reviewed-by: Wolfram Sang Signed-off-by: Josua Mayer Signed-off-by: Ulf Hansson commit 602236a78291c0ead8667be2c7a9199d2c290479 Author: Josua Mayer Date: Thu Feb 26 15:21:13 2026 +0200 phy: renesas: rcar-gen3-usb2: drop helper getting optional mux-state Multiplexer subsystem has now added helpers for getting managed optional mux-state. Switch to the new devm_mux_state_get_optional_selected helper. This change is only compile-tested. Signed-off-by: Josua Mayer Acked-by: Vinod Koul Reviewed-by: Wolfram Sang Signed-off-by: Ulf Hansson commit d76e0c54ed8405469375177ddc7e4b863b59d0ae Author: Josua Mayer Date: Thu Feb 26 15:21:12 2026 +0200 phy: can-transceiver: drop temporary helper getting optional mux-state Multiplexer subsystem has now added helpers for getting managed optional mux-state. Switch to the new devm_mux_state_get_optional helper. This change is only compile-tested. Acked-by: Vinod Koul Reviewed-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Signed-off-by: Josua Mayer Signed-off-by: Ulf Hansson commit 993bcaf32c494014f56357f6cdd87fdfaa4e4d11 Author: Josua Mayer Date: Thu Feb 26 15:21:11 2026 +0200 mux: Add helper functions for getting optional and selected mux-state In-tree phy-can-transceiver and phy_rcar_gen3_usb2 have already implemented local versions of devm_mux_state_get_optional. The omap-i2c driver gets and selects an optional mux in its probe function without using any helper. Add new helper functions covering both aforementioned use-cases: - mux_control_get_optional: Get a mux-control if specified in dt, return NULL otherwise. - devm_mux_state_get_optional: Get a mux-state if specified in dt, return NULL otherwise. - devm_mux_state_get_selected: Get and select a mux-state specified in dt, return error otherwise. - devm_mux_state_get_optional_selected: Get and select a mux-state if specified in dt, return error or NULL. Existing mux_get helper function is changed to take an extra argument indicating whether the mux is optional. In this case no error is printed, and NULL returned in case of ENOENT. Calling code is adapted to handle NULL return case, and to pass optional argument as required. To support automatic deselect for _selected helper, a new structure is created storing an exit pointer similar to clock core which is called on release. To facilitate code sharing between optional/mandatory/selected helpers, a new internal helper function is added to handle quiet (optional) and verbose (mandatory) errors, as well as storing the correct callback for devm release: __devm_mux_state_get Due to this structure devm_mux_state_get_*_selected can no longer print a useful error message when select fails. Instead callers should print errors where needed. Commit e153fdea9db04 ("phy: can-transceiver: Re-instate "mux-states" property presence check") noted that "mux_get() always prints an error message in case of an error, including when the property is not present, confusing the user." The first error message covers the case that a mux name is not matched in dt. The second error message is based on of_parse_phandle_with_args return value. In optional case no error is printed and NULL is returned. This ensures that the new helper functions will not confuse the user either. With the addition of optional helper functions it became clear that drivers should compile and link even if CONFIG_MULTIPLEXER was not enabled. Add stubs for all symbols exported by mux core. Acked-by: Wolfram Sang Signed-off-by: Josua Mayer Signed-off-by: Ulf Hansson commit 80f3df6e254d860cc7a41d5f2ae37fe717644098 Author: Josua Mayer Date: Thu Feb 26 15:21:10 2026 +0200 phy: renesas: rcar-gen3-usb2: rename local mux helper to avoid conflict Rename the temporary devm_mux_state_get_optional function to avoid conflict with upcoming implementation in multiplexer subsystem. Signed-off-by: Josua Mayer Reviewed-by: Wolfram Sang Acked-by: Vinod Koul Signed-off-by: Ulf Hansson commit b6376ccdcb4bf7163fc4cbe5f83e265bc1660d4f Author: Josua Mayer Date: Thu Feb 26 15:21:09 2026 +0200 phy: can-transceiver: rename temporary helper function to avoid conflict Rename the temporary devm_mux_state_get_optional function to avoid conflict with upcoming implementation in multiplexer subsystem. Signed-off-by: Josua Mayer Acked-by: Vinod Koul Reviewed-by: Wolfram Sang Signed-off-by: Ulf Hansson commit 02fe86e5fc22faee9b29e761d9fdd17fdfe583e6 Author: Thomas Zimmermann Date: Tue Feb 24 09:25:57 2026 +0100 fbdev: defio: Move pageref array to struct fb_deferred_io_state The pageref array stores all pageref structures for a device's defio helpers. Move it into struct fb_deferred_io_state to not expose it to drivers. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 648bfb62da4e7a970f6b153bb8cdab1703877fcd Author: Thomas Zimmermann Date: Tue Feb 24 09:25:56 2026 +0100 fbdev: defio: Move variable state into struct fb_deferred_io_state Move variable fields from struct fb_deferred_io into struct fb_deferred_io_state. These fields are internal to the defio code and should not be exposed to drivers. At some later point, struct fb_defered_io might become const in all defio code. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit d460a54fd321997a3a4703816cfb8fb4a520af29 Author: Thomas Zimmermann Date: Tue Feb 24 09:25:55 2026 +0100 fbdev: defio: Keep module reference from VMAs Acquire a module reference on each mmap and VMA open; hold it until the kernel closes the VMA. Protects against unloading the module while user space still has a mapping of the graphics memory. The VMA page-fault handling would then call into undefined code. This situation can happen if the underlying device has been unplugged and the driver has been unloaded. It would then be possible to trigger the bug by unloading the fbdev core module. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 9ded47ad003f09a94b6a710b5c47f4aa5ceb7429 Author: Thomas Zimmermann Date: Tue Feb 24 09:25:54 2026 +0100 fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Hold state of deferred I/O in struct fb_deferred_io_state. Allocate an instance as part of initializing deferred I/O and remove it only after the final mapping has been closed. If the fb_info and the contained deferred I/O meanwhile goes away, clear struct fb_deferred_io_state.info to invalidate the mapping. Any access will then result in a SIGBUS signal. Fixes a long-standing problem, where a device hot-unplug happens while user space still has an active mapping of the graphics memory. The hot- unplug frees the instance of struct fb_info. Accessing the memory will operate on undefined state. Signed-off-by: Thomas Zimmermann Fixes: 60b59beafba8 ("fbdev: mm: Deferred IO support") Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v2.6.22+ Signed-off-by: Helge Deller commit 24d11b25a1da6e4d55c9b8c9508f2e38b44ac741 Author: Thorsten Blum Date: Thu Mar 5 11:39:15 2026 +0100 fbdev: macfb: Replace deprecated strcpy with strscpy strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy(). No functional changes. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum Signed-off-by: Helge Deller commit d95beb0a373ae8b0b213a1f564c735e8ecfa54e2 Author: Daniel Palmer Date: Fri Feb 27 21:25:00 2026 +0900 fbdev: tdfxfb: Make the VGA register initialisation a bit more obvious For a while I was trying to get this working on m68k, for some reason the card doesn't display anything if it's own video BIOS didn't run.. Anyhow, I spent a long time looking up what each of these offsets were to work out what the code is configuring and eventually replaced them with the human readable defines in video/vga.h. Functionally there is no change but maybe it makes it a bit easier to look at for the next person that finds themselves in here. Tested on a real voodoo 3 on x86_64. Signed-off-by: Daniel Palmer Signed-off-by: Helge Deller commit f630c79accf67ad3e0f74fdc7c705f5401bf8658 Author: Amin GATTOUT Date: Wed Mar 4 18:10:42 2026 +0100 fbdev: wmt_ge_rops: use devm_platform_ioremap_resource() Replace the open-coded platform_get_resource() + ioremap() pair with devm_platform_ioremap_resource(), which requests the memory region and maps it in a single call, with automatic cleanup on device removal. Also reset regbase to NULL in remove() so that the single-instance guard in probe() works correctly if the device is re-probed. Signed-off-by: Amin GATTOUT Signed-off-by: Helge Deller commit 8d10dd8907e1c0e619d5e785365875bb758d43ce Author: Amin GATTOUT Date: Tue Mar 3 13:22:24 2026 +0100 fbdev: goldfishfb: use devm_platform_ioremap_resource() Replace the open-coded platform_get_resource() + ioremap() pair with devm_platform_ioremap_resource(), which requests the memory region and maps it in a single call, with automatic cleanup on device removal. Signed-off-by: Amin GATTOUT Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller commit c4791ce96b88a444b04c7089ae2827a3b3ae1877 Author: Frederic Popp Date: Sun Mar 8 16:22:16 2026 +0100 ALSA: usb-audio: add Studio 1824 support Adapt the already implemented support for the Studio 1824c audio interface to the predecessor Studio 1824. Basically just a change adding the different hardware ID in the relevant places. Tested as much as possible. All implemented functionality seemingly works. Signed-off-by: Frederic Popp Link: https://patch.msgid.link/20260308153334.50433-2-frederic.l.popp@t-online.de Signed-off-by: Takashi Iwai commit 09472cecf83bc818ba26d3a17b8d7383ad72a1a1 Author: Johan Hovold Date: Thu Mar 5 13:54:03 2026 +0100 i2c: tiny-usb: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Signed-off-by: Wolfram Sang commit 32dbfb4dbc2a546a6514f1f56152170683778ab4 Author: Johan Hovold Date: Thu Mar 5 13:52:21 2026 +0100 i2c: diolan-u2c: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Signed-off-by: Wolfram Sang commit 7bc4c8f3469284a499febb73dbca7183ff53c98c Author: Johan Hovold Date: Thu Mar 5 11:29:55 2026 +0100 i2c: robotfuzz-osif: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Signed-off-by: Wolfram Sang commit c03d8b5462bcb0022f9477d09eb37dae66c3a769 Author: Cosmin Tanislav Date: Mon Jan 5 13:44:45 2026 +0200 dmaengine: sh: rz_dmac: add RZ/{T2H,N2H} support The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs use a completely different ICU unit compared to RZ/V2H, which requires a separate implementation. Add support for them. RZ/N2H will use RZ/T2H as a fallback. Signed-off-by: Cosmin Tanislav Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260105114445.878262-5-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Vinod Koul commit 40dd470a95c0674515ca606757ffe174bd7d3f90 Author: Cosmin Tanislav Date: Mon Jan 5 13:44:44 2026 +0200 dt-bindings: dma: renesas,rz-dmac: document RZ/{T2H,N2H} The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have three DMAC instances. Compared to the previously supported RZ/V2H, these SoCs are missing the error interrupt line and the reset lines, and they use a different ICU IP. Document them, and use RZ/T2H as a fallback for RZ/N2H as the DMACs are entirely compatible. Signed-off-by: Cosmin Tanislav Reviewed-by: Rob Herring (Arm) Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260105114445.878262-4-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Vinod Koul commit bbb8b402d798f9f211376cee3d649d64dfc17880 Author: Cosmin Tanislav Date: Mon Jan 5 13:44:43 2026 +0200 dmaengine: sh: rz_dmac: make register_dma_req() chip-specific The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs use a completely different ICU unit compared to RZ/V2H, which requires a separate implementation. To prepare for adding support for these SoCs, add a chip-specific structure and put a pointer to the rzv2h_icu_register_dma_req() function in the .register_dma_req field of the chip-specific structure to allow for other implementations. Do the same for the default request value, RZV2H_ICU_DMAC_REQ_NO_DEFAULT, and place it into .dma_req_no_default. While at it, factor out the logic that calls .register_dma_req() or rz_dmac_set_dmars_register() into a separate function to remove some code duplication. Signed-off-by: Cosmin Tanislav Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260105114445.878262-3-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Vinod Koul commit b34f3fcae72a0afdd1a966fd68309b461bf678e6 Author: Cosmin Tanislav Date: Mon Jan 5 13:44:42 2026 +0200 dmaengine: sh: rz_dmac: make error interrupt optional The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs do not have an error interrupt for the DMACs, and the current driver implementation does not make much use of it. To prepare for adding support for these SoCs, do not error out if the error interrupt is missing. Signed-off-by: Cosmin Tanislav Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260105114445.878262-2-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Vinod Koul commit 2438deea9ff82940ebfce67e232d558199ab8a6e Author: Frank Li Date: Wed Feb 25 16:41:49 2026 -0500 dmaengine: fsl-qdma: Use dev_err_probe() to simplify code Use dev_err_probe() to simplify code. No functional change. Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-13-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit 804e18f7da6d29cff7ed4e004bcc05658f51d737 Author: Frank Li Date: Wed Feb 25 16:41:48 2026 -0500 dmaengine: fsl-edma: Use dev_err_probe() to simplify code Use dev_err_probe() to simplify code. No functional change. Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-12-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit 4035726a6b724ff0f04b4f1429c7b1a935fc2e76 Author: Frank Li Date: Wed Feb 25 16:41:47 2026 -0500 dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() Use managed API dmaenginem_async_device_register() and devm_of_dma_controller_register() to simple code. Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-11-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit 917edfa57783352cd491cd5759a04d7b60de1714 Author: Frank Li Date: Wed Feb 25 16:41:46 2026 -0500 dmaengine: imx-sdma: Use dev_err_probe() to simplify code Use dev_err_probe() to simplify code. No functional change. Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-10-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit 8982cb214a7f29db7d28058a3b4697f436af34d2 Author: Frank Li Date: Wed Feb 25 16:41:45 2026 -0500 dmaengine: imx-sdma: Use managed API to simplify code Use managed API devm_kzalloc(), dmaenginem_async_device_register() and devm_of_dma_controller_register() to simple code. No functional change. Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-9-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit 5daee52d7cc87415367fa0051a80998cccbab920 Author: Frank Li Date: Wed Feb 25 16:41:44 2026 -0500 dmaengine: imx-sdma: Use devm_clk_get_prepared() to simplify code Use devm_clk_get_prepared() to simplify code. No functional change. Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-8-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit 67adf1f6643d75e33509900a2cb35db3a31f0410 Author: Jindong Yue Date: Wed Feb 25 16:41:43 2026 -0500 dmaengine: mxs-dma: Turn MXS_DMA as tristate Use tristate for mxs-dma to support module building. Signed-off-by: Jindong Yue Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-7-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit e1b712c9352cf74285973462ced8d60ed7a9183c Author: Jindong Yue Date: Wed Feb 25 16:41:42 2026 -0500 dmaengine: mxs-dma: Add module license and description Module license string is required for loading it as a module. Signed-off-by: Jindong Yue Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-6-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit d11544c674b64beb9948724ba27187238c52b079 Author: Frank Li Date: Wed Feb 25 16:41:41 2026 -0500 dmaengine: mxs-dma: Use managed API devm_of_dma_controller_register() Use managed API devm_of_dma_controller_register() to prepare support module remove. Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-5-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit 4a5b0a728d665b3b7b08fb5bf6b2f69c995e30ec Author: Frank Li Date: Wed Feb 25 16:41:40 2026 -0500 dmaengine: mxs-dma: Use dev_err_probe() to simplify code Use dev_err_probe() simplify code. No functional change. Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-4-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit 96857a90982c2a461520fadc55dda3b8051e8d96 Author: Frank Li Date: Wed Feb 25 16:41:39 2026 -0500 dmaengine: mxs-dma: Use local dev variable in probe() Introduce a local dev variable in probe() to avoid repeated use of &pdev->dev throughout the function. No functional change. Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-3-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit ab2bf6d4c0a0152907b18d25c1b118ea5ea779df Author: Frank Li Date: Wed Feb 25 16:41:38 2026 -0500 dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() Propagate the return value of of_dma_controller_register() in probe() instead of ignoring it. Fixes: a580b8c5429a6 ("dmaengine: mxs-dma: add dma support for i.MX23/28") Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-2-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit 3a005126c9d7f30093627a6f329656c358e16b3a Author: Frank Li Date: Wed Feb 25 16:41:37 2026 -0500 dmaengine: of_dma: Add devm_of_dma_controller_register() Add a managed API, devm_of_dma_controller_register(), to simplify DMA engine controller registration by automatically handling resource cleanup. Signed-off-by: Frank Li Link: https://patch.msgid.link/20260225-mxsdma-module-v3-1-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul commit 9900002f7afad64ee4124762ec8464fc5e4e4c97 Merge: d1880d5f5899c5 1f318b96cc84d7 Author: Danilo Krummrich Date: Mon Mar 9 12:06:36 2026 +0100 Merge tag 'v7.0-rc3' into driver-core-next We need the driver-core fixes in here as well to build on top of. Signed-off-by: Danilo Krummrich commit 7cd3ca90d92110cb6a57fcc286c193cf7fd048d2 Author: Gary Yang Date: Mon Mar 2 14:44:06 2026 +0800 reset: add Sky1 soc reset support Add support for the resets on Cix's Sky1 SoC. There are two reset controllers on Cix Sky1 Soc. One is located in S0 domain, and the other is located in S5 domain. Signed-off-by: Gary Yang Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit c76350e7add86344beae4cd69fffdf63284a4bf5 Author: Gary Yang Date: Mon Mar 2 14:44:05 2026 +0800 dt-bindings: soc: cix: document the syscon on Sky1 SoC There are two system control on Cix sky1 Soc. One is located in S0 domain, and the other is located in S5 domain. The system control contains resets, usb typeC and more. At this point, only the reset controller is embedded as usb typeC uses it by phandle. Signed-off-by: Gary Yang Reviewed-by: Krzysztof Kozlowski Signed-off-by: Philipp Zabel commit 340db7c4d9dfa86cce3cb8f68e68115cadae8d51 Author: Luca Coelho Date: Thu Mar 5 11:59:19 2026 +0200 drm/i915/display: convert W/As in skl_watermark.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-17-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit de2a558e76a5877d5a1765d5b00e59610e855c9e Author: Luca Coelho Date: Thu Mar 5 11:59:18 2026 +0200 drm/i915/display: convert W/As in skl_universal_plane.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-16-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit bbcf7efbd1b6dc53af08ef022e95c7e372d65f0b Author: Luca Coelho Date: Thu Mar 5 11:59:17 2026 +0200 drm/i915/display: convert W/As in intel_psr.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-15-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit b13bd24cae6156d5b53fd67cef45621bbbab83c5 Author: Luca Coelho Date: Thu Mar 5 11:59:16 2026 +0200 drm/i915/display: convert W/As in intel_pmdemand.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-14-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit 2cefa9a955641b9860050b95bdb2212bcffeaffe Author: Luca Coelho Date: Thu Mar 5 11:59:15 2026 +0200 drm/i915/display: convert W/As in intel_modeset_setup.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-13-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit 700f1c1b3be7897cd3d265a2f3f2ebe200fb2700 Author: Luca Coelho Date: Thu Mar 5 11:59:14 2026 +0200 drm/i915/display: convert W/As in intel_flipq.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-12-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit 305a60de9b16f310e8e50d1405108609f6e6ec2b Author: Luca Coelho Date: Thu Mar 5 11:59:13 2026 +0200 drm/i915/display: convert W/As in intel_fbc.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-11-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit cd09d058c0bda43f311928946600f7b51fc79686 Author: Luca Coelho Date: Thu Mar 5 11:59:12 2026 +0200 drm/i915/display: convert W/As in intel_dp_mst.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-10-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit e0263465c5fff944d47efb9f129f06fee1ff2457 Author: Luca Coelho Date: Thu Mar 5 11:59:11 2026 +0200 drm/i915/display: convert W/As in intel_display_device.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-9-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit 7850730c1d6273f5bbae1f5dd5117d5af33a641c Author: Luca Coelho Date: Thu Mar 5 11:59:10 2026 +0200 drm/i915/display: convert W/As in intel_display.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-8-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit cc81de748dfb29eb693dac2b5227e568eab44ec2 Author: Luca Coelho Date: Thu Mar 5 11:59:09 2026 +0200 drm/i915/display: convert W/As in intel_ddi.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-7-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit 7bad5d5c18ffc2a3e889504f8b48050a43177c84 Author: Luca Coelho Date: Thu Mar 5 11:59:08 2026 +0200 drm/i915/display: convert W/As in intel_cursor.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-6-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit 267f668a9ef295d5e6f2067eeedc60424e7f31e9 Author: Luca Coelho Date: Thu Mar 5 11:59:07 2026 +0200 drm/i915/display: convert W/As in intel_cdclk.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-5-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit cf7db663ba0b54e28a9795b70c0aebded8232df4 Author: Luca Coelho Date: Thu Mar 5 11:59:06 2026 +0200 drm/i915/display: convert W/As in intel_display_power.c to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-4-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit 57288a60ef387934fc4842ccaa8ad9a6176ed24c Author: Luca Coelho Date: Thu Mar 5 11:59:05 2026 +0200 drm/i915/display: convert audio workaround to new framework Convert the low-hanging fruits of workaround checks to the workaround framework. Instead of having display structure checks for the workarounds all over, concentrate the checks in intel_display_wa.c. Acked-by: Jani Nikula Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-3-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit ae4d74dad8531b742714d1973055b348349f5188 Author: Luca Coelho Date: Thu Mar 5 11:59:04 2026 +0200 drm/i915/display: remove enum macro magic in intel_display_wa() There's not much use in passing a number to the macro and let it convert that into the enum and a string. It just hides the symbols. Remove the number to enum conversion magic in intel_display_wa(). This has the side-effect of changing the print in the drm_WARN() that is issued when the number is not implemented, but that is moot anyway and can be changed later to something cleaner if needed. Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260305100100.332956-2-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit 0a208adefecb287d22321054470d4619cb303839 Author: Maciej Strozek Date: Fri Mar 6 15:28:11 2026 +0000 ASoC: cs42l43: Add support for the B variant Introducing CS42L43B codec, a variant of CS42L43 which can be driven by the same driver. Changes in CS42L43 driver specific for CS42L43B: - Decimator 1 and 2 are dedicated to ADC, can't be selected for PDM - Decimators 3 and 4 are connected to PDM1 - Added Decimator 5 and 6 for PDM2 - Supports SoundWire Clock Gearing - Updated ROM requiring no patching - Reduced RAM space - Each ISRC has 4 decimators now Signed-off-by: Maciej Strozek Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260306152829.3130530-5-mstrozek@opensource.cirrus.com Signed-off-by: Mark Brown commit a6fe20d67dc7d512f9b5dc11c5777fb1e1ff70ce Author: Maciej Strozek Date: Fri Mar 6 15:28:10 2026 +0000 mfd: cs42l43: Add support for the B variant Introducing CS42L43B codec, a variant of CS42L43 which can be driven by the same driver. Changes in CS42L43 driver specific for CS42L43B: - Decimator 1 and 2 are dedicated to ADC, can't be selected for PDM - Decimators 3 and 4 are connected to PDM1 - Added Decimator 5 and 6 for PDM2 - Supports SoundWire Clock Gearing - Updated ROM requiring no patching - Reduced RAM space - Each ISRC has 4 decimators now Signed-off-by: Maciej Strozek Acked-by: Lee Jones Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260306152829.3130530-4-mstrozek@opensource.cirrus.com Signed-off-by: Mark Brown commit 301db523173236829974c7add540baa470ac8761 Author: Maciej Strozek Date: Fri Mar 6 15:28:09 2026 +0000 ASoC: dt-bindings: cirrus,cs42l43: Add CS42L43B variant CS42L43B variant adds dedicated PDM interface, SoundWire Clock Gearing support and more decimators to ISRCs. Acked-by: Krzysztof Kozlowski Signed-off-by: Maciej Strozek Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260306152829.3130530-3-mstrozek@opensource.cirrus.com Signed-off-by: Mark Brown commit 3e314fde2304b328929c471a70906bc5968f9dcf Author: Maciej Strozek Date: Fri Mar 6 15:28:08 2026 +0000 ASoC: sdw_utils: Add CS42L43B codec info Add codec_info for a new variant of CS42L43. It can resue existing info but needs a new part_id. Signed-off-by: Maciej Strozek Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260306152829.3130530-2-mstrozek@opensource.cirrus.com Tested-by: Charles Keepax Signed-off-by: Mark Brown commit 9840bb66e7e5dffd72b03201318f154a10b06b4a Author: Jeff Layton Date: Sat Mar 7 14:54:31 2026 -0500 vfs: remove externs from fs.h on functions modified by i_ino widening Christoph says, in response to one of the patches in the i_ino widening series, which changes the prototype of several functions in fs.h: "Can you please drop all these pointless externs while you're at it?" Remove extern keyword from functions touched by that patch (and a few that happened to be nearby). Also add missing argument names to declarations that lacked them. Suggested-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260307-iino-u64-v2-1-a1a1696e0653@kernel.org Signed-off-by: Christian Brauner commit 153308a2f966adc7d1e72cad5557d621708a3a18 Author: Karol Wachowski Date: Mon Mar 9 10:27:55 2026 +0100 accel/ivpu: Test for imported buffers with drm_gem_is_imported() Instead of testing import_attach for imported GEM buffers, invoke drm_gem_is_imported() to do the test. The test itself does not change. Suggested-by: Thomas Zimmermann Reviewed-by: Thomas Zimmermann Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260309092755.3165130-1-karol.wachowski@linux.intel.com commit e0c8104074f48868976832e334ffa86eb87176b2 Merge: c452588f3cb6b5 b6420bd5aa0c37 Author: Bartosz Golaszewski Date: Mon Mar 9 10:32:41 2026 +0100 Merge tag 'ib-gpio-remove-of-gpio-h-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux.git into gpio/for-next Immutable branch between GPIO and net Convert remaining users of of_gpio.h to using GPIO descriptors and remove the header. commit b6420bd5aa0c374331bad6c0fa2eb5f0f87cf5a0 Author: Jialu Xu Date: Sat Mar 7 11:06:26 2026 +0800 gpio: remove of_get_named_gpio() and All in-tree consumers have been converted to the descriptor-based API. Remove the deprecated of_get_named_gpio() helper, delete the header, and drop the corresponding entry from MAINTAINERS. Also remove the completed TODO item for this cleanup. Signed-off-by: Jialu Xu Reviewed-by: Linus Walleij Link: https://patch.msgid.link/02ABDA1F9E3FAF1F+20260307030623.3495092-6-xujialu@vimux.org Signed-off-by: Bartosz Golaszewski commit 253350dbf3e7fbd136905c98bd9f800fddb4fead Author: Jialu Xu Date: Sat Mar 7 11:06:24 2026 +0800 nfc: nfcmrvl: convert to gpio descriptors Replace the legacy of_get_named_gpio() / gpio_request_one() / gpio_set_value() API with the descriptor-based devm_gpiod_get_optional() / gpiod_set_value() API from , removing the dependency on . The "reset-n-io" property rename quirk already exists in gpiolib-of.c (added in commit 9c2cc7171e08), so no additional quirk is needed. Signed-off-by: Jialu Xu Reviewed-by: Linus Walleij Link: https://patch.msgid.link/DD684946FD7EE161+20260307030623.3495092-4-xujialu@vimux.org Signed-off-by: Bartosz Golaszewski commit b544927d75574330b0a8a33c113556b67df56f39 Author: Jialu Xu Date: Sat Mar 7 11:06:22 2026 +0800 nfc: s3fwrn5: convert to gpio descriptors Replace the legacy of_get_named_gpio() / gpio_request_one() / gpio_set_value() API with the descriptor-based devm_gpiod_get() / gpiod_set_value() API from , removing the dependency on . This removes the s3fwrn5_i2c_parse_dt() and s3fwrn82_uart_parse_dt() functions since devm_gpiod_get() handles both DT lookup and resource management. The gpio_en and gpio_fw_wake fields in struct phy_common are changed from int to struct gpio_desc *. Add rename quirks in gpiolib-of.c for the deprecated "s3fwrn5,en-gpios" and "s3fwrn5,fw-gpios" properties to maintain backward compatibility with old device trees. Signed-off-by: Jialu Xu Reviewed-by: Linus Walleij Link: https://patch.msgid.link/94FF47746A92BD6B+20260307030623.3495092-2-xujialu@vimux.org Signed-off-by: Bartosz Golaszewski commit faaad5006e5835c3b9228906232fc6b17b01512b Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:58 2026 +0100 reset: gpio: make the driver fwnode-agnostic With reset core now being able to work with firmware nodes, we can make reset-gpio node-agnostic and drop any OF dependencies. Reviewed-by: Philipp Zabel Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit 9035073d0ef1de813c6335239250248bfe0a64aa Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:57 2026 +0100 reset: convert reset core to using firmware nodes With everything else now in place, we can convert the remaining parts of the reset subsystem to becoming fwnode-agnostic - meaning it will work with all kinds of firmware nodes, not only devicetree. To that end: extend struct reset_controller_dev with fields taking information relevant for using firmware nodes (which mirrors what we already do for OF-nodes) and limit using of_ APIs only to where it's absolutely necessary (mostly around the of_xlate callback). For backward compatibility of existing drivers we still support OF-nodes but firmware nodes become the preferred method. Signed-off-by: Bartosz Golaszewski Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit ba8dbbb14b7e6734afbb5ba37d0679831aa3d590 Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:56 2026 +0100 reset: convert the core API to using firmware nodes In order to simplify the commit converting the internals of reset core to using firmware nodes, first convert the user-facing API. Modify the signature of the core consumer functions but leave the specialized wrappers as is to avoid modifying users for now. No functional change intended. Reviewed-by: Philipp Zabel Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit 9d52054a4fc3d6f95f4aa81d5355505c98a3e4ee Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:55 2026 +0100 reset: convert of_reset_control_get_count() to using firmware nodes Start the conversion of reset core to using firmware nodes by reworking of_reset_control_get_count(). Unfortunately there is no fwnode-based alternative to of_count_phandle_with_args() so we have to hand-code it. Reviewed-by: Philipp Zabel Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit 8c91302a29bc1b710c7a164d4b81b5bb432f4eb5 Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:54 2026 +0100 reset: protect struct reset_control with its own mutex Currently we use a single, global mutex - misleadingly names reset_list_mutex - to protect the global list of reset devices, per-controller list of reset control handles and also internal fields of struct reset_control. Locking can be made a lot more fine-grained if we use a separate mutex for serializing operations on the list AND accessing the reset control handle. Signed-off-by: Bartosz Golaszewski Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 44a0acb2caca3bfd0ca459fbf0b19be75f1819c0 Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:53 2026 +0100 reset: protect struct reset_controller_dev with its own mutex Currently we use a single, global mutex - misleadingly names reset_list_mutex - to protect the global list of reset devices, per-controller list of reset control handles and also internal fields of struct reset_control. Locking can be made a lot more fine-grained if we use a separate mutex for serializing operations on the list AND accessing the reset controller device. Signed-off-by: Bartosz Golaszewski Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 78ebbff6d1a05ffc2062d90231b4720618a57147 Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:52 2026 +0100 reset: handle removing supplier before consumers Except for the reset-gpio, all reset drivers use device tree - and as such - benefit from the device links set up by driver core. This means, that no reset supplier will be unbound before all its consumers have been. For this reason, nobody bothered making the reset core resiliant to the object life-time issues that are plagueing the kernel. In this case: reset control handles referencing the reset provider device with no serialization or NULL-pointer checking. We now want to make the reset core fwnode-agnostic but before we do, we must make sure it can survive unbinding of suppliers with consumers still holding reset control handles. To that end: use SRCU to protect the rcdev pointer inside struct reset_control. We protect all sections using the pointer with SRCU read-only critical sections and synchronize SRCU after every modification of the pointer. This is in line with what the GPIO subsystem does and what the proposed revocable API tries to generalize. When and if the latter makes its way into the kernel, reset core could potentially also be generalized to use it. Signed-off-by: Bartosz Golaszewski Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 1f10008aff7190e300e93ed33a0eb2d236c0b87d Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:51 2026 +0100 reset: use lock guards in reset core Simplify the locking code in reset core by using lock guard from linux/cleanup.h. Reviewed-by: Philipp Zabel Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit 6703784ab9a8039bd3f476db2643414c45690c68 Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:50 2026 +0100 reset: fold ida_alloc() into reset_create_gpio_aux_device() We don't need to know the IDA value outside of the function that creates the auxiliary reset-gpio device. Simplify error handling by folding it into reset_create_gpio_aux_device(). Signed-off-by: Bartosz Golaszewski Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 20adbf3b8f5c5787da29f8cdd7cfc4fa87854bd5 Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:49 2026 +0100 reset: warn on reset-gpio release While we implement an empty .release() callback for reset-gpio (driver core requires it), this function will never actually be called as nobody ever removes the device and the last reference is not dropped anywhere. This is by design - once created, the reset-gpio device stays in memory. Make the .release() callback emit a warning, should it ever be called due to a programming bug. Reviewed-by: Philipp Zabel Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit 1acd4663840849d3371ab8734b55cd184a2a5c5b Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:48 2026 +0100 reset: gpio: remove unneeded auxiliary_set_drvdata() There's no user of the driver data so don't needlessly assign it. Reviewed-by: Philipp Zabel Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit ad9d28e68f4f9d15b9bde15e1ab79a4f85eff60e Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:47 2026 +0100 reset: gpio: simplify fallback device matching The of_args field of struct reset_controller_dev was introduced to allow the reset-gpio driver to pass the phandle arguments back to reset core. The thing is: it doesn't even have to do it. The core sets the platform data of the auxiliary device *AND* has access to it later on during the lookup. This means the field is unneeded and all can happen entirely in reset core. Remove the field from the public header and don't set it in reset-gpio.c. Retrieve the platform data in reset core when needed instead. Reviewed-by: Philipp Zabel Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit a9b95ce36de4422761dc2a2afc01e1781801800c Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:46 2026 +0100 reset: gpio: add a devlink between reset-gpio and its consumer The device that requests the reset control managed by the reset-gpio device is effectively its consumer but the devlink is only established between it and the GPIO controller exposing the reset pin. Add a devlink between the consumer of the reset control and its supplier. This will allow us to simplify the GPIOLIB code managing shared GPIOs when handling the corner case of reset-gpio and gpiolib-shared interacting. While at it and since we need to store the address of the auxiliary device: don't allocate memory for the device separately but fold it into struct reset_gpio_lookup instead. Reviewed-by: Philipp Zabel Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit fe3da77f2f946e84d13e5183ae0fa223b968766b Author: Bartosz Golaszewski Date: Fri Mar 6 18:22:45 2026 +0100 reset: gpio: remove unneeded OF-node put priv->rc.of_node is never set in reset core. Even if it were: tasking the reset-gpio driver with controlling the reference count of an OF node set up in reset core is a weird inversion of responsability. But it's also wrong in that the underlying device never actually gets removed so the node should not be put at all and especially not at driver detach. Remove the devres action. Reviewed-by: Philipp Zabel Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit c452588f3cb6b5c2bb6448fc347465aa2174cd7a Author: Krzysztof Kozlowski Date: Thu Feb 12 12:09:06 2026 +0100 dt-bindings: gpio: gpio-delay: Use Alexander's email Group/anonymous mailboxes are not accepted for bindings maintainers, so switch from such linux @TQ mailbox to Alexander's email. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Alexander Stein Link: https://patch.msgid.link/20260212110905.52842-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 5645f805927c9bd4443e6143e487ef3ffea34aaf Author: Linus Walleij Date: Fri Mar 6 14:22:00 2026 +0100 gpio: Document line value semantics It is not clearly documented that the GPIO driver API expect the driver to get/set the physical level of the GPIO line and the consumer API will get/set the logic level. Document this in relevant places. Reported-by: David Jander Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260306-gpio-doc-levels-v1-1-19928739e400@kernel.org Signed-off-by: Bartosz Golaszewski commit 3671411e9073cb06d726dbf10835d158e18f0796 Author: Johan Hovold Date: Thu Mar 5 13:49:45 2026 +0100 gpio: mpsse: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260305124945.10781-1-johan@kernel.org Signed-off-by: Bartosz Golaszewski commit dd8a93dafe6ef50b49d2a7b44862264d74a7aafa Author: Deborah Brouwer Date: Mon Mar 2 12:23:31 2026 -0800 drm/tyr: Use DRM device type alias across driver Currently Tyr defines a convenience type alias for its DRM device type, `TyrDrmDevice` but it does not use the alias outside of `tyr/driver.rs`. Replace `drm::Device` with the alias `TyrDrmDevice` across the driver. This change will ease future upstream Tyr development by reducing the diffs when multiple series are touching these files. No functional changes are intended. Signed-off-by: Deborah Brouwer Reviewed-by: Boris Brezillon Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260302202331.176140-1-deborah.brouwer@collabora.com Signed-off-by: Alice Ryhl commit 81e62e7bf8b9309bf0febdf00940818f98bc23d8 Author: Andrzej Kacprowski Date: Thu Mar 5 15:22:26 2026 +0100 accel/ivpu: Remove boot params address setting via MMIO register The NPU 60XX uses the default boot params location specified in the firmware image header, consistent with earlier generations. Remove the unnecessary MMIO register write, freeing the AON register for future use. Fixes: 44e4c88951fa ("accel/ivpu: Implement warm boot flow for NPU6 and unify boot handling") Signed-off-by: Andrzej Kacprowski Reviewed-by: Karol Wachowski Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260305142226.194995-1-andrzej.kacprowski@linux.intel.com commit 9c62536a958ffef246b6f7c01125ebac962158f8 Merge: 6de23f81a5e08b 4d94ce88c77e74 Author: Christian Brauner Date: Fri Mar 6 10:24:19 2026 +0100 Merge patch series "Further centralising of directory locking for name ops." NeilBrown says: I am working towards changing the locking rules for name-operations: locking the name rather than the whole directory. The current part of this process is centralising all the locking so that it can be changed in one place. Recently "start_creating", "start_removing", "start_renaming" and related interaces were added which combine the locking and the lookup. At that time many callers were changed to use the new interfaces. However there are still an assortment of places out side of fs/namei.c where the directory is locked explictly, whether with inode_lock() or lock_rename() or similar. These were missed in the first pass for an assortment of uninteresting reasons. This series addresses the remaining places where explicit locking is used, and changes them to use the new interfaces, or otherwise removes the explicit locking. The biggest changes are in overlayfs. The other changes are quite simple, though maybe the cachefiles changes is the least simple of those. I'm running the --overlay tests in xfstests and nothing has popped yet. I'll continue with this and run some NFS tests too. * patches from https://patch.msgid.link/20260224222542.3458677-1-neilb@ownmail.net: VFS: unexport lock_rename(), lock_rename_child(), unlock_rename() ovl: remove ovl_lock_rename_workdir() ovl: use is_subdir() for testing if one thing is a subdir of another ovl: change ovl_create_real() to get a new lock when re-opening created file. ovl: pass name buffer to ovl_start_creating_temp() cachefiles: change cachefiles_bury_object to use start_renaming_dentry() ovl: Simplify ovl_lookup_real_one() VFS: make lookup_one_qstr_excl() static. nfsd: switch purge_old() to use start_removing_noperm() selinux: Use simple_start_creating() / simple_done_creating() Apparmor: Use simple_start_creating() / simple_done_creating() libfs: change simple_done_creating() to use end_creating() VFS: move the start_dirop() kerndoc comment to before start_dirop() fs/proc: Don't lock root inode when creating "self" and "thread-self" VFS: note error returns in documentation for various lookup functions Link: https://patch.msgid.link/20260224222542.3458677-1-neilb@ownmail.net Signed-off-by: Christian Brauner commit 4d94ce88c77e74830a5b9d02ecb8286039ffa494 Author: NeilBrown Date: Wed Feb 25 09:17:00 2026 +1100 VFS: unexport lock_rename(), lock_rename_child(), unlock_rename() These three function are now only used in namei.c, so they don't need to be exported. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-16-neilb@ownmail.net Signed-off-by: Christian Brauner commit 54d7ea7324e65023ec931ddb470019db066c165d Author: NeilBrown Date: Wed Feb 25 09:16:59 2026 +1100 ovl: remove ovl_lock_rename_workdir() This function is unused since Commit 833d2b3a072f ("Add start_renaming_two_dentries()") Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-15-neilb@ownmail.net Signed-off-by: Christian Brauner commit 56c8fd738ed86667daa13c8a28fd1074f8a22cb7 Author: NeilBrown Date: Wed Feb 25 09:16:58 2026 +1100 ovl: use is_subdir() for testing if one thing is a subdir of another Rather than using lock_rename(), use the more obvious is_subdir() for ensuring that neither upper nor workdir contain the other. Also be explicit in the comment that the two directories cannot be the same. As this is a point-it-time sanity check and does not provide any on-going guarantees, the removal of locking does not introduce any interesting races. Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-14-neilb@ownmail.net Signed-off-by: Christian Brauner commit 8348278650bca7a51c274bdf898aa9a73ce4b67f Author: NeilBrown Date: Wed Feb 25 09:16:57 2026 +1100 ovl: change ovl_create_real() to get a new lock when re-opening created file. When ovl_create_real() is used to create a file on the upper filesystem it needs to return the resulting dentry - positive and hashed. It is usually the case the that dentry passed to the create function (e.g. vfs_create()) will be suitable but this is not guaranteed. The filesystem may unhash that dentry forcing a repeat lookup next time the name is wanted. So ovl_create_real() must be (and is) aware of this and prepared to perform that lookup to get a hash positive dentry. This is currently done under that same directory lock that provided exclusion for the create. Proposed changes to locking will make this not possible - as the name, rather than the directory, will be locked. The new APIs provided for lookup and locking do not and cannot support this pattern. The lock isn't needed. ovl_create_real() can drop the lock and then get a new lock for the lookup - then check that the lookup returned the correct inode. In a well-behaved configuration where the upper filesystem is not being modified by a third party, this will always work reliably, and if there are separate modification it will fail cleanly. So change ovl_create_real() to drop the lock and call ovl_start_creating_upper() to find the correct dentry. Note that start_creating doesn't fail if the name already exists. The lookup previously used the name from newdentry which was guaranteed to be stable because the parent directory was locked. As we now drop the lock we lose that guarantee. As newdentry is unhashed it is unlikely for the name to change, but safest not to depend on that. So the expected name is now passed in to ovl_create_real() and that is used. This removes the only remaining use of ovl_lookup_upper, so it is removed. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-13-neilb@ownmail.net Signed-off-by: Christian Brauner commit 85bb1420a850099fd44e8ba212d4e56575b45322 Author: NeilBrown Date: Wed Feb 25 09:16:56 2026 +1100 ovl: pass name buffer to ovl_start_creating_temp() Now ovl_start_creating_temp() is passed a buffer in which to store the temp name. This will be useful in a future patch were ovl_create_real() will need access to that name. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-12-neilb@ownmail.net Signed-off-by: Christian Brauner commit deef04993541a809260cbc40664908761c92fe5d Author: NeilBrown Date: Wed Feb 25 09:16:55 2026 +1100 cachefiles: change cachefiles_bury_object to use start_renaming_dentry() Rather then using lock_rename() and lookup_one() etc we can use the new start_renaming_dentry(). This is part of centralising dir locking and lookup so that locking rules can be changed. Some error check are removed as not necessary. Checks for rep being a non-dir or IS_DEADDIR and the check that ->graveyard is still a directory only provide slightly more informative errors and have been dropped. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-11-neilb@ownmail.net Signed-off-by: Christian Brauner commit bdca18a60ed7a332777c655d43bc99d0152b41c2 Author: Sanjay Yadav Date: Mon Mar 2 20:39:46 2026 +0530 gpu/tests/gpu_buddy: Add gpu_test_buddy_alloc_range for exact-range allocation Add a new kunit test gpu_test_buddy_alloc_range() that exercises the __gpu_buddy_alloc_range() exact-range allocation path, triggered when start + size == end with flags=0. The test covers: - Basic exact-range allocation of the full mm - Exact-range allocation of equal sub-ranges (quarters) - Minimum chunk-size exact ranges at start, middle, and end offsets - Non power-of-two mm size with multiple roots, including cross-root exact-range allocation - Randomized exact-range allocations of N contiguous page-aligned slices in random order - Negative: partially allocated range must reject overlapping exact alloc - Negative: checkerboard allocation pattern rejects exact range over partially occupied pairs - Negative: misaligned start, unaligned size, and out-of-bounds end - Free and re-allocate the same exact range across multiple iterations - Various power-of-two exact ranges at natural alignment Cc: Christian König Cc: Arunpravin Paneer Selvam Suggested-by: Matthew Auld Signed-off-by: Sanjay Yadav Reviewed-by: Matthew Auld Signed-off-by: Arunpravin Paneer Selvam Link: https://patch.msgid.link/20260302150947.47535-2-sanjay.kumar.yadav@intel.com commit c2948247cd1a6f3e476df46a1bd903c79f3228dd Author: Coby McKinney Date: Mon Feb 2 12:52:11 2026 -0800 platform/x86: thinkpad_acpi: use seq_puts() instead of seq_printf() checkpatch.pl reported warnings where seq_printf() was used for simple strings with no format specifiers. Replace these instances with seq_puts() to avoid the overhead of runtime string parsing and to conform to kernel coding standards. Signed-off-by: Coby McKinney Reviewed-by: Mark Pearson Link: https://patch.msgid.link/20260202205214.18898-1-coby@bytemap.space Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 88442ba208dd5d3405de3f5000cf5b2c86876ae3 Author: Arun R Murthy Date: Wed Mar 4 12:51:57 2026 +0530 drm/i915/dp: Read ALPM caps after DPCD init For eDP read the ALPM DPCD caps after DPCD initalization and just before the PSR init. v2: Move intel_alpm_init to intel_edp_init_dpcd (Jouni) v3: Add Fixes with commit-id (Jouni) v4: Separated the alpm dpcd read caps from alpm_init and moved to intel_edp_init_dpcd. v5: Read alpm_caps always for eDP irrespective of the eDP version (Jouni) v6: replace drm_dp_dpcd_readb with drm_dp_dpcd_read_byte (Jouni) Fixes: 15438b325987 ("drm/i915/alpm: Add compute config for lobf") Signed-off-by: Arun R Murthy Reviewed-by: Animesh Manna Reviewed-by: Jouni Högander Signed-off-by: Animesh Manna Link: https://patch.msgid.link/20260304072157.1123283-1-arun.r.murthy@intel.com commit 458c9519ab21ea473020c53a50d7d5b1720ded30 Author: Costa Shulyupin Date: Fri Mar 6 21:49:52 2026 +0200 tools/rtla: Remove unneeded nr_cpus from for_each_monitored_cpu nr_cpus does not change at runtime, so passing it through the macro argument is unnecessary. Remove the argument and use the global nr_cpus instead. Signed-off-by: Costa Shulyupin Link: https://lore.kernel.org/r/20260306194953.2511960-5-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit caf3fc0fdd63b4b163ee4eac1ca822772108c0f8 Author: Costa Shulyupin Date: Fri Mar 6 21:49:51 2026 +0200 tools/rtla: Remove unneeded nr_cpus members nr_cpus does not change at runtime, so keeping it in struct members is unnecessary. Use the global nr_cpus instead of struct members. Signed-off-by: Costa Shulyupin Link: https://lore.kernel.org/r/20260306194953.2511960-4-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit ea06305ff9920115e07b6947568cbfba4736e10c Author: Costa Shulyupin Date: Fri Mar 6 21:49:50 2026 +0200 tools/rtla: Remove unneeded nr_cpus arguments nr_cpus does not change at runtime, so passing it through function arguments is unnecessary. Use the global nr_cpus instead of propagating it via parameters. Signed-off-by: Costa Shulyupin Link: https://lore.kernel.org/r/20260306194953.2511960-3-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 115b06a008756ec777249dc9f432dc1a6c681396 Author: Costa Shulyupin Date: Fri Mar 6 21:49:49 2026 +0200 tools/rtla: Consolidate nr_cpus usage across all tools sysconf(_SC_NPROCESSORS_CONF) (via get_nprocs_conf) reflects cpu_possible_mask, which is fixed at boot time, so querying it repeatedly is unnecessary. Replace multiple calls to sysconf(_SC_NPROCESSORS_CONF) with a single global nr_cpus variable initialized once at startup. `#pragma once` in timerlat_u.h is needed for pre-C23 compilers to avoid redefinition errors. Signed-off-by: Costa Shulyupin Link: https://lore.kernel.org/r/20260306194953.2511960-2-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 65ca1121f7be4cc0391f6d80fa87eac6f7d847a5 Author: Vinod Koul Date: Fri Feb 27 07:59:05 2026 +0530 dmaengine: xilinx: Update kernel-doc comments Two members of struct xdma_desc_block are not descibed leading to warnings, document them. Warning: drivers/dma/xilinx/xdma.c:75 struct member 'last_interrupt' not described in 'xdma_chan' Warning: drivers/dma/xilinx/xdma.c:75 struct member 'stop_requested' not described in 'xdma_chan' Link: https://patch.msgid.link/20260227022905.233721-1-vkoul@kernel.org Signed-off-by: Vinod Koul commit 7b84a00dd3528d980f1f35fd2c5015f72dc3f62a Author: Randy Dunlap Date: Sat Feb 28 17:12:03 2026 -0800 dmaengine: qcom: qcom-gpi-dma.h: fix all kernel-doc warnings Add missing enum descriptions and spell one struct member correctly to avoid kernel-doc warnings: Warning: include/linux/dma/qcom-gpi-dma.h:15 Enum value 'SPI_TX' not described in enum 'spi_transfer_cmd' Warning: include/linux/dma/qcom-gpi-dma.h:15 Enum value 'SPI_RX' not described in enum 'spi_transfer_cmd' Warning: include/linux/dma/qcom-gpi-dma.h:15 Enum value 'SPI_DUPLEX' not described in enum 'spi_transfer_cmd' Warning: include/linux/dma/qcom-gpi-dma.h:80 struct member 'multi_msg' not described in 'gpi_i2c_config' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260301011203.3062658-1-rdunlap@infradead.org Signed-off-by: Vinod Koul commit 70fbea9f1a44d80a4c573c225f119022d6e21360 Author: Randy Dunlap Date: Sat Feb 28 17:12:13 2026 -0800 dmaengine: ti-cppi5: fix all kernel-doc warnings Add missing struct member, function parameter, and enum value descriptions. Add missing function Returns: sections. Use correct function name in kernel-doc to avoid mismatched prototypes. These repair all kernel-doc warnings in ti-cppi5.h: Warning: include/linux/dma/ti-cppi5.h:27 struct member 'pkt_info1' not described in 'cppi5_desc_hdr_t' Warning: include/linux/dma/ti-cppi5.h:27 struct member 'pkt_info2' not described in 'cppi5_desc_hdr_t' Warning: include/linux/dma/ti-cppi5.h:50 struct member 'epib' not described in 'cppi5_host_desc_t' Warning: include/linux/dma/ti-cppi5.h:142 struct member 'epib' not described in 'cppi5_monolithic_desc_t' Warning: include/linux/dma/ti-cppi5.h:413 function parameter 'pkt_len' not described in 'cppi5_hdesc_set_pktlen' Warning: include/linux/dma/ti-cppi5.h:436 function parameter 'ps_flags' not described in 'cppi5_hdesc_set_psflags' Warning: include/linux/dma/ti-cppi5.h:509 function parameter 'hbuf_desc' not described in 'cppi5_hdesc_link_hbdesc' Warning: include/linux/dma/ti-cppi5.h:839 struct member 'dicnt3' not described in 'cppi5_tr_type15_t' Warning: include/linux/dma/ti-cppi5.h:970 function parameter 'desc_hdr' not described in 'cppi5_trdesc_init' Warning: include/linux/dma/ti-cppi5.h:184 No description found for return value of 'cppi5_desc_is_tdcm' Warning: include/linux/dma/ti-cppi5.h:198 No description found for return value of 'cppi5_desc_get_type' Warning: include/linux/dma/ti-cppi5.h:210 No description found for return value of 'cppi5_desc_get_errflags' Warning: include/linux/dma/ti-cppi5.h:448 expecting prototype for cppi5_hdesc_get_errflags(). Prototype was for cppi5_hdesc_get_pkttype() instead Warning: include/linux/dma/ti-cppi5.h:460 expecting prototype for cppi5_hdesc_get_errflags(). Prototype was for cppi5_hdesc_set_pkttype() instead Warning: include/linux/dma/ti-cppi5.h:1053 expecting prototype for cppi5_tr_cflag_set(). Prototype was for cppi5_tr_csf_set() instead Warning: include/linux/dma/ti-cppi5.h:651 Enum value 'CPPI5_TR_TYPE_MAX' not described in enum 'cppi5_tr_types' Warning: include/linux/dma/ti-cppi5.h:676 Enum value 'CPPI5_TR_EVENT_SIZE_MAX' not described in enum 'cppi5_tr_event_size' Warning: include/linux/dma/ti-cppi5.h:693 Enum value 'CPPI5_TR_TRIGGER_MAX' not described in enum 'cppi5_tr_trigger' Warning: include/linux/dma/ti-cppi5.h:714 Enum value 'CPPI5_TR_TRIGGER_TYPE_MAX' not described in enum 'cppi5_tr_trigger_type' Warning: include/linux/dma/ti-cppi5.h:890 Enum value 'CPPI5_TR_RESPONSE_STATUS_MAX' not described in enum 'cppi5_tr_resp_status_type' Warning: include/linux/dma/ti-cppi5.h:906 Enum value 'CPPI5_TR_RESPONSE_STATUS_SUBMISSION_MAX' not described in enum 'cppi5_tr_resp_status_submission' Warning: include/linux/dma/ti-cppi5.h:934 Enum value 'CPPI5_TR_RESPONSE_STATUS_UNSUPPORTED_MAX' not described in enum 'cppi5_tr_resp_status_unsupported' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260301011213.3063688-1-rdunlap@infradead.org Signed-off-by: Vinod Koul commit fe8a56f098fb87dd489666d6e9d6498be73a92e6 Author: Krzysztof Kozlowski Date: Sun Mar 1 15:21:59 2026 +0100 dmaengine: xilinx: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260301142158.90319-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Vinod Koul commit 3af11daeaeaa6f62494c7cb07265928162b440ab Author: Kelvin Cao Date: Mon Mar 2 14:04:19 2026 -0700 dmaengine: switchtec-dma: Implement descriptor submission On prep, a spin lock is taken and the next entry in the circular buffer is filled. On submit, the spin lock just needs to be released as the requests are already pending. When switchtec_dma_issue_pending() is called, the sq_tail register is written to indicate there are new jobs for the dma engine to start on. Pause and resume operations are implemented by writing to a control register. Signed-off-by: Kelvin Cao Co-developed-by: George Ge Signed-off-by: George Ge Reviewed-by: Christoph Hellwig Signed-off-by: Logan Gunthorpe Link: https://patch.msgid.link/20260302210419.3656-4-logang@deltatee.com Signed-off-by: Vinod Koul commit 30eba9df76adf1294e88214dbf9cea402fa7af37 Author: Kelvin Cao Date: Mon Mar 2 14:04:18 2026 -0700 dmaengine: switchtec-dma: Implement hardware initialization and cleanup Initialize the hardware and create the dma channel queues. Signed-off-by: Kelvin Cao Co-developed-by: George Ge Signed-off-by: George Ge Reviewed-by: Christoph Hellwig Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe Link: https://patch.msgid.link/20260302210419.3656-3-logang@deltatee.com Signed-off-by: Vinod Koul commit d9587042b50f69d35a6e05c1b7fc9092e26625a6 Author: Kelvin Cao Date: Mon Mar 2 14:04:17 2026 -0700 dmaengine: switchtec-dma: Introduce Switchtec DMA engine skeleton Some Switchtec Switches can expose DMA engines via extra PCI functions on the upstream ports. At most one such function can be supported on each upstream port. Each function can have one or more DMA channels. This patch is just the core PCI driver skeleton and dma engine registration. Signed-off-by: Kelvin Cao Co-developed-by: George Ge Signed-off-by: George Ge Reviewed-by: Christoph Hellwig Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe Link: https://patch.msgid.link/20260302210419.3656-2-logang@deltatee.com Signed-off-by: Vinod Koul commit f1d201e7e4e7646e55ce4946f0adec4b035ffb4b Author: Nuno Sá Date: Tue Mar 3 10:25:04 2026 +0000 dmaengine: dma-axi-dmac: Gracefully terminate HW cyclic transfers Add support for gracefully terminating hardware cyclic DMA transfers when a new transfer is queued and is flagged with DMA_PREP_LOAD_EOT. Without this, cyclic transfers would continue indefinitely until we brute force it with .device_terminate_all(). When a new descriptor is queued while a cyclic transfer is active, mark the cyclic transfer for termination. For hardware with scatter-gather support, modify the last segment flags to trigger end-of-transfer. For non-SG hardware, clear the CYCLIC flag to allow natural completion. Older IP core versions (pre-4.6.a) can prefetch data when clearing the CYCLIC flag, causing corruption in the next transfer. Work around this by disabling and re-enabling the core to flush prefetched data. The cyclic_eot flag tracks transfers marked for termination, preventing new transfers from starting until the cyclic one completes. Non-EOT transfers submitted after cyclic transfers are discarded with a warning. Also note that for hardware cyclic transfers not using SG, we need to make sure that chan->next_desc is also set to NULL (so we can look at possible EOT transfers) and we also need to move the queue check to after axi_dmac_get_next_desc() because with hardware based cyclic transfers we might get the queue marked as full and hence we would not be able to check for cyclic termination. Signed-off-by: Nuno Sá Link: https://patch.msgid.link/20260303-axi-dac-cyclic-support-v2-5-0db27b4be95a@analog.com Signed-off-by: Vinod Koul commit ca3bf200dea50fada92ec371e9e294b18a589676 Author: Nuno Sá Date: Tue Mar 3 10:25:03 2026 +0000 dmaengine: dma-axi-dmac: Gracefully terminate SW cyclic transfers As of now, to terminate a cyclic transfer, one pretty much needs to use brute force and terminate all transfers with .device_terminate_all(). With this change, when a cyclic transfer terminates (and generates an EOT interrupt), look at any new pending transfer with the DMA_PREP_LOAD_EOT flag set. If there is one, the current cyclic transfer is terminated and the next one is enqueued. If the flag is not set, that transfer is ignored. Signed-off-by: Nuno Sá Link: https://patch.msgid.link/20260303-axi-dac-cyclic-support-v2-4-0db27b4be95a@analog.com Signed-off-by: Vinod Koul commit c60990ba1fb2a6c1ff2789e610aa130f3047a2ff Author: Nuno Sá Date: Tue Mar 3 10:25:02 2026 +0000 dmaengine: dma-axi-dmac: Add helper for getting next desc Add a new helper for getting the next valid struct axi_dmac_desc. This will be extended in follow up patches to support to gracefully terminate cyclic transfers. Reviewed-by: Frank Li Signed-off-by: Nuno Sá Link: https://patch.msgid.link/20260303-axi-dac-cyclic-support-v2-3-0db27b4be95a@analog.com Signed-off-by: Vinod Koul commit ac85913ab71e0de9827b7f8f7fccb9f20943c02f Author: Nuno Sá Date: Tue Mar 3 10:25:01 2026 +0000 dmaengine: dma-axi-dmac: Add cyclic transfers in .device_prep_peripheral_dma_vec() Add support for cyclic transfers by checking the DMA_PREP_REPEAT flag. If the flag is set, close the loop and clear the flag for the last segment (the same done for .device_prep_dma_cyclic(). Reviewed-by: Frank Li Signed-off-by: Nuno Sá Link: https://patch.msgid.link/20260303-axi-dac-cyclic-support-v2-2-0db27b4be95a@analog.com Signed-off-by: Vinod Koul commit 5f88899ec7531e1680b1003f32584d7da5922902 Author: Nuno Sá Date: Tue Mar 3 10:25:00 2026 +0000 dmaengine: Document cyclic transfer for dmaengine_prep_peripheral_dma_vec() Document that the DMA_PREP_REPEAT flag can be used with the dmaengine_prep_peripheral_dma_vec() to mark a transfer as cyclic similar to dmaengine_prep_dma_cyclic(). Reviewed-by: Frank Li Signed-off-by: Nuno Sá Link: https://patch.msgid.link/20260303-axi-dac-cyclic-support-v2-1-0db27b4be95a@analog.com Signed-off-by: Vinod Koul commit 28c829977f4072b23f2fd8d341c2795eec0d5bcb Author: Thomas Weißschuh Date: Wed Mar 4 22:44:40 2026 +0100 dmaengine: ioatdma: make sysfs attributes const The ioat_sysfs_entry structures are never modified, mark them as read-only. Signed-off-by: Thomas Weißschuh Acked-by: Dave Jiang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260304-sysfs-const-ioat-v2-4-b9b82651219b@weissschuh.net Signed-off-by: Vinod Koul commit 81ca3ad09ba7296daa798b4950097af1591b2809 Author: Thomas Weißschuh Date: Wed Mar 4 22:44:39 2026 +0100 dmaengine: ioatdma: make ioat_ktype const ioat_ktype is never modified, so make it const. Signed-off-by: Thomas Weißschuh Acked-by: Dave Jiang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260304-sysfs-const-ioat-v2-3-b9b82651219b@weissschuh.net Signed-off-by: Vinod Koul commit bc94ca718f85f1caa40bea31ea63b52278d9d0cb Author: Thomas Weißschuh Date: Wed Mar 4 22:44:38 2026 +0100 dmaengine: ioatdma: move sysfs entry definition out of header Move struct ioat_sysfs_entry into sysfs.c because it is only used in it. Signed-off-by: Thomas Weißschuh Reviewed-by: Frank Li Acked-by: Dave Jiang Link: https://patch.msgid.link/20260304-sysfs-const-ioat-v2-2-b9b82651219b@weissschuh.net Signed-off-by: Vinod Koul commit 0124b354a4dbea1f924adb2355db21d29bd2a5fd Author: Thomas Weißschuh Date: Wed Mar 4 22:44:37 2026 +0100 dmaengine: ioatdma: make some sysfs structures static These structures are only used in sysfs.c, where are defined. Make them static and remove them from the header. Signed-off-by: Thomas Weißschuh Reviewed-by: Frank Li Acked-by: Dave Jiang Link: https://patch.msgid.link/20260304-sysfs-const-ioat-v2-1-b9b82651219b@weissschuh.net Signed-off-by: Vinod Koul commit f5bd7da05a5988506dedcb3e67aecb3a13a4cdf0 Author: Arunpravin Paneer Selvam Date: Fri Mar 6 11:31:55 2026 +0530 drm/buddy: Add KUnit test for offset-aligned allocations Add KUnit test to validate offset-aligned allocations in the DRM buddy allocator. Validate offset-aligned allocation: The test covers allocations with sizes smaller than the alignment constraint and verifies correct size preservation, offset alignment, and behavior across multiple allocation sizes. It also exercises fragmentation by freeing alternating blocks and confirms that allocation fails once all aligned offsets are consumed. Stress subtree_max_alignment propagation: Exercise subtree_max_alignment tracking by allocating blocks with descending alignment constraints and freeing them in reverse order. This verifies that free-tree augmentation correctly propagates the maximum offset alignment present in each subtree at every stage. v2: - Move the patch to gpu/tests/gpu_buddy_test.c file. v3: - Fixed build warnings reported by kernel test robot v4:(Matthew) - Use IS_ALIGNED() instead of manual alignment checks - Simplify order iteration loop for readability - Remove extra newline Signed-off-by: Arunpravin Paneer Selvam Reviewed-by: Matthew Auld Link: https://patch.msgid.link/20260306060155.2114-2-Arunpravin.PaneerSelvam@amd.com commit 493740d790cce709d285cd1022d16d05439b7d5b Author: Arunpravin Paneer Selvam Date: Fri Mar 6 11:31:54 2026 +0530 drm/buddy: Improve offset-aligned allocation handling Large alignment requests previously forced the buddy allocator to search by alignment order, which often caused higher-order free blocks to be split even when a suitably aligned smaller region already existed within them. This led to excessive fragmentation, especially for workloads requesting small sizes with large alignment constraints. This change prioritizes the requested allocation size during the search and uses an augmented RB-tree field (subtree_max_alignment) to efficiently locate free blocks that satisfy both size and offset-alignment requirements. As a result, the allocator can directly select an aligned sub-region without splitting larger blocks unnecessarily. A practical example is the VKCTS test dEQP-VK.memory.allocation.basic.size_8KiB.reverse.count_4000, which repeatedly allocates 8 KiB buffers with a 256 KiB alignment. Previously, such allocations caused large blocks to be split aggressively, despite smaller aligned regions being sufficient. With this change, those aligned regions are reused directly, significantly reducing fragmentation. This improvement is visible in the amdgpu VRAM buddy allocator state (/sys/kernel/debug/dri/1/amdgpu_vram_mm). After the change, higher-order blocks are preserved and the number of low-order fragments is substantially reduced. Before: order- 5 free: 1936 MiB, blocks: 15490 order- 4 free: 967 MiB, blocks: 15486 order- 3 free: 483 MiB, blocks: 15485 order- 2 free: 241 MiB, blocks: 15486 order- 1 free: 241 MiB, blocks: 30948 After: order- 5 free: 493 MiB, blocks: 3941 order- 4 free: 246 MiB, blocks: 3943 order- 3 free: 123 MiB, blocks: 4101 order- 2 free: 61 MiB, blocks: 4101 order- 1 free: 61 MiB, blocks: 8018 By avoiding unnecessary splits, this change improves allocator efficiency and helps maintain larger contiguous free regions under heavy offset-aligned allocation workloads. v2:(Matthew) - Update augmented information along the path to the inserted node. v3: - Move the patch to gpu/buddy.c file. v4:(Matthew) - Use the helper instead of calling _ffs directly - Remove gpu_buddy_block_order(block) >= order check and drop order - Drop !node check as all callers handle this already - Return larger than any other possible alignment for __ffs64(0) - Replace __ffs with __ffs64 v5:(Matthew) - Drop subtree_max_alignment initialization at gpu_block_alloc() Signed-off-by: Arunpravin Paneer Selvam Suggested-by: Christian König Reviewed-by: Matthew Auld Link: https://patch.msgid.link/20260306060155.2114-1-Arunpravin.PaneerSelvam@amd.com commit b2c9f1d5a7eb50bcdda607afef1378e552bbb490 Author: Bard Liao Date: Mon Jan 26 13:40:45 2026 +0800 soundwire: Intel: test bus.bpt_stream before assigning it We only allow up to 1 bpt stream running on a SoundWire bus. bus.bpt_stream will be assigned when it is opened and will be set to NULL when it is closed. We do check bus->bpt_stream_refcount if the stream type is SDW_STREAM_BPT in sdw_master_rt_alloc(), but at that moment the bpt stream is allocated and set to bus.bpt_stream. It will lead to the original bus.bpt_stream be changed to the new and not used bpt stream. And it will be released and set to NULL when sdw_slave_bpt_stream_add() return error as it supposed to. Then the original stream will try to use the NULL bus.bpt_stream. Fixes: 4c1ce9f37d8a ("soundwire: intel_ace2x: add BPT send_async/wait callbacks") Reported-by: Simon Trimmer Signed-off-by: Bard Liao Reviewed-by: Simon Trimmer Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20260126054045.2504103-1-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit 2c96956fe764f8224f9ec93b2a9160a578949a7a Author: Cole Leavitt Date: Wed Feb 18 11:02:10 2026 -0700 soundwire: bus: demote UNATTACHED state warnings to dev_dbg() The dev_warn() messages in sdw_handle_slave_status() for UNATTACHED transitions were added in commit d1b328557058 ("soundwire: bus: add dev_warn() messages to track UNATTACHED devices") to debug attachment failures with dynamic debug enabled. These warnings fire during normal operation -- for example when a codec driver triggers a hardware reset after firmware download, causing the device to momentarily go UNATTACHED before re-attaching -- producing misleading noise on every boot. Demote the messages to dev_dbg() so they remain available via dynamic debug for diagnosing real attachment failures without alarming users during expected initialization sequences. Fixes: d1b328557058 ("soundwire: bus: add dev_warn() messages to track UNATTACHED devices") Signed-off-by: Cole Leavitt Reviewed-by: Richard Fitzgerald Link: https://patch.msgid.link/20260218180210.9263-1-cole@unwrap.rs Signed-off-by: Vinod Koul commit fee12f3c20dd5902dbd95eb41f80d3fba89336d7 Author: Richard Fitzgerald Date: Fri Feb 27 11:16:48 2026 +0000 soundwire: stream: Poll for DP prepare to avoid interrupt deadlock Replace the wait_for_completion_timeout() in sdw_prep_deprep_slave_ports() with a read_poll_timeout(). The original intent of the wait_for_completion_timeout() was to wait for the port prepare interrupt. But at this time the code is holding the bus_lock, which prevents the interrupt handler from running. Because of this, the port_prep completion will not be signaled and the wait_for_completion_timeout() will always timeout. Rewriting the code to avoid taking the bus_lock carries risks, and needs careful consideration of the consequences. It is safer and simpler to replace the completion with a simple register poll. As the code is holding the bus_lock, it is already blocking other activity so consuming control channel bandwidth for polling isn't really a concern. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260227111648.175548-1-rf@opensource.cirrus.com Signed-off-by: Vinod Koul commit 27ab4f1e4909a674dfd03058fb9802cae2343a36 Author: Vijendar Mukunda Date: Thu Feb 26 12:25:54 2026 +0530 soundwire: amd: refactor bandwidth calculation logic For current platforms(ACP6.3/ACP7.0/ACP7.1/ACP7.2), AMD SoundWire manager doesn't have banked registers for data port programming on Manager's side. Need to use fixed block offsets, hstart & hstop for manager ports. Earlier amd manager driver has support for 12 MHz as a bus clock frequency where frame rate is 48000 and number of bits is 500, frame shape as 50 x 10 with fixed block offset mapping based on port number. Got a new requirement to support 6 MHz as a bus clock frequency. For 6 MHz bus clock frequency amd manager driver needs to support two different frame shapes i.e number of bits as 250 with frame rate as 48000 and frame shape as 125 x 2 and for the second combination number of bits as 500 where frame rate is 24000 and frame shape is 50 x 10. Few SoundWire peripherals doesn't support 125 x 2 as a frame shape for 6 MHz bus clock frequency. They have explicit requirement for the frame shape. In this scenario, amd manager driver needs to use 50 x 10 as a frame shape where frame rate is 24000. Based on the platform and SoundWire topology for 6Mhz support frame shape will be decided which is part of SoundWire manager DisCo tables. For current platforms, amd manager driver supports only two bus clock frequencies(12 MHz & 6 MHz). Refactor bandwidth logic to support different bus clock frequencies. Signed-off-by: Vijendar Mukunda Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260226065638.1251771-3-Vijendar.Mukunda@amd.com Signed-off-by: Vinod Koul commit 2a267a8410841ba1c71daa41d1fb2cc21ff23e6b Author: Vijendar Mukunda Date: Thu Feb 26 12:25:53 2026 +0530 soundwire: amd: add clock init control function Add generic SoundWire clock initialization sequence to support different SoundWire bus clock frequencies for ACP6.3/7.0/7.1/7.2 platforms and remove hard coding initializations for 12Mhz bus clock frequency. Signed-off-by: Vijendar Mukunda Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260226065638.1251771-2-Vijendar.Mukunda@amd.com Signed-off-by: Vinod Koul commit edb5ca3262e2255cf938a5948709d3472d4871ad Author: Manivannan Sadhasivam Date: Thu Feb 26 19:09:51 2026 +0530 PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq() If the dw_pcie_resume_noirq() API fails, it just returns the errno without doing cleanup in the error path, leading to resource leak. So perform cleanup in the error path. Fixes: 4774faf854f5 ("PCI: dwc: Implement generic suspend/resume functionality") Reported-by: Senchuan Zhang Closes: https://lore.kernel.org/linux-pci/78296255.3869.19c8eb694d6.Coremail.zhangsenchuan@eswincomputing.com Signed-off-by: Manivannan Sadhasivam Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260226133951.296743-1-mani@kernel.org commit 94cbea0f636b55602a9a10583670976680ecea67 Author: Aksh Garg Date: Tue Feb 24 14:08:17 2026 +0530 PCI: dwc: ep: Mirror the max link width and speed fields to all functions PCIe r7.0, section 7.5.3.6 states that for multi-function devices, the Max Link Width and Max Link Speed fields in the Link Capabilities Register must report the same values for all functions. Currently, dw_pcie_setup() programs these fields only for Function 0 via dw_pcie_link_set_max_speed() and dw_pcie_link_set_max_link_width(). For multi-function endpoint configurations, Function 1 and beyond retain their default values, violating the PCIe specification. Fix this by reading the Max Link Width and Max Link Speed fields from Link Capabilities Register of Function 0 after dw_pcie_setup() completes, then mirroring these values to all other functions. Fixes: 24ede430fa49 ("PCI: designware-ep: Add multiple PFs support for DWC") Fixes: 89db0793c9f2 ("PCI: dwc: Add missing PCI_EXP_LNKCAP_MLW handling") Signed-off-by: Aksh Garg [mani: renamed ref_lnkcap to func0_lnkcap] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260224083817.916782-3-a-garg7@ti.com commit 271d0b1f058ae9815e75233d04b23e3558c3e4f4 Author: Aksh Garg Date: Tue Feb 24 14:08:16 2026 +0530 PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix() In dw_pcie_ep_set_msix(), while updating the MSI-X Table Size value for individual functions, Message Control register is read from the passed function number register space using dw_pcie_ep_readw_dbi(), but always written back to the Function 0's register space using dw_pcie_writew_dbi(). This causes incorrect MSI-X configuration for the rest of the functions, other than Function 0. Fix this by using dw_pcie_ep_writew_dbi() to write to the correct function's register space, matching the read operation. Fixes: 70fa02ca1446 ("PCI: dwc: Add dw_pcie_ep_{read,write}_dbi[2] helpers") Signed-off-by: Aksh Garg [mani: commit log] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260224083817.916782-2-a-garg7@ti.com commit 17d7c97f73c7a0bd90bd22cd7441269a6f8a1d72 Author: Alexandre Courbot Date: Fri Mar 6 13:52:46 2026 +0900 gpu: nova-core: firmware: fix and explain v2 header offsets computations There are no offsets in `FalconUCodeDescV2` to give the non-secure and secure IMEM sections start offsets relative to the beginning of the firmware object. The start offsets for both sections were set to `0`, but that is obviously incorrect since two different sections cannot start at the same offset. Since these offsets were not used by the bootloader, this doesn't prevent proper function but is incorrect nonetheless. Fix this by computing the start of the secure IMEM section relatively to the start of the firmware object and setting it properly. Also add and improve comments to explain how the values are obtained. Fixes: dbfb5aa41f16 ("gpu: nova-core: add FalconUCodeDescV2 support") Reviewed-by: Eliot Courtney Link: https://patch.msgid.link/20260306-turing_prep-v11-9-8f0042c5d026@nvidia.com Signed-off-by: Alexandre Courbot commit 3140af2fab505a4cd47d516284529bf1585628be Author: Jouni Högander Date: Wed Mar 4 13:30:11 2026 +0200 drm/i915/psr: Write DSC parameters on Selective Update in ET mode There are slice row per frame and pic height parameters in DSC that needs to be configured on every Selective Update in Early Transport mode. Use helper provided by DSC code to configure these on Selective Update when in Early Transport mode. Also fill crtc_state->psr2_su_area with full frame area on full frame update for DSC calculation. v2: move psr2_su_area under skip_sel_fetch_set_loop label Bspec: 68927, 71709 Fixes: 467e4e061c44 ("drm/i915/psr: Enable psr2 early transport as possible") Cc: # v6.9+ Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260304113011.626542-5-jouni.hogander@intel.com commit c8698d61aeb3f70fe33761ee9d3d0e131b5bc2eb Author: Jouni Högander Date: Wed Mar 4 13:30:10 2026 +0200 drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters There are slice row per frame and pic height configuration in DSC Selective Update Parameter Set 1 register. Add helper for configuring these. v2: - Add WARN_ON_ONCE if vdsc instances per pipe > 2 - instead of checking vdsc instances per pipe being > 1 check == 2 Bspec: 71709 Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260304113011.626542-4-jouni.hogander@intel.com commit 24f96d903daf3dcf8fafe84d3d22b80ef47ba493 Author: Jouni Högander Date: Wed Mar 4 13:30:09 2026 +0200 drm/i915/dsc: Add Selective Update register definitions Add definitions for DSC_SU_PARAMETER_SET_0_DSC0 and DSC_SU_PARAMETER_SET_0_DSC1 registers. These are for Selective Update Early Transport configuration. Bspec: 71709 Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260304113011.626542-3-jouni.hogander@intel.com commit 681e12440d8b110350a5709101169f319e10ccbb Author: Jouni Högander Date: Wed Mar 4 13:30:08 2026 +0200 drm/i915/psr: Repeat Selective Update area alignment Currently we are aligning Selective Update area to cover cursor fully if needed only once. It may happen that cursor is in Selective Update area after pipe alignment and after that covering cursor plane only partially. Fix this by looping alignment as long as alignment isn't needed anymore. v2: - do not unecessarily loop if cursor was already fully covered - rename aligned as su_area_changed Fixes: 1bff93b8bc27 ("drm/i915/psr: Extend SU area to cover cursor fully if needed") Cc: # v6.9+ Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260304113011.626542-2-jouni.hogander@intel.com commit 6ef5141114a95746731a65bc384ff4b1c071a3f2 Author: Alexandre Courbot Date: Fri Mar 6 13:52:45 2026 +0900 gpu: nova-core: firmware: add comments to justify v3 header values There is no member in `FalconUCodeDescV3` to describe the start offsets of the IMEM and DMEM section in the firmware object. Add comments to justify how they are computed. Reviewed-by: Eliot Courtney Link: https://patch.msgid.link/20260306-turing_prep-v11-8-8f0042c5d026@nvidia.com Signed-off-by: Alexandre Courbot commit 8cfb2e517113543e0de9e8df5754d5e09cb3627e Author: Franz Schnyder Date: Mon Feb 2 09:36:01 2026 +0100 arm64: dts: ti: k3-am69-aquila-clover: Fix DP regulator enable GPIO Correct the DP regulator enable GPIO to index 21. The 3.3V DP regulator was not being enabled by the assigned GPIO, as it is routed to GPIO index 21 and not 37, which was causing instability with displays connected over DP or via an active DP-to-HDMI adapter. Fixes: 9f748a6177e1 ("arm64: dts: ti: am69-aquila: Add Clover") Cc: stable@vger.kernel.org Signed-off-by: Franz Schnyder Reviewed-by: Francesco Dolcini Link: https://patch.msgid.link/20260202083604.325060-3-fra.schnyder@gmail.com Signed-off-by: Vignesh Raghavendra commit 222191225e69711089ecade3b98d79757d51e907 Author: Franz Schnyder Date: Mon Feb 2 09:36:00 2026 +0100 arm64: dts: ti: k3-am69-aquila-dev: Fix DP regulator enable GPIO Correct the DP regulator enable GPIO to index 21. The 3.3V DP regulator was not being enabled by the assigned GPIO, as it is routed to GPIO index 21 and not 37, which was causing instability with displays connected over DP or via an active DP-to-HDMI adapter. Fixes: 39ac6623b1d8 ("arm64: dts: ti: Add Aquila AM69 Support") Cc: stable@vger.kernel.org Signed-off-by: Franz Schnyder Reviewed-by: Francesco Dolcini Link: https://patch.msgid.link/20260202083604.325060-2-fra.schnyder@gmail.com Signed-off-by: Vignesh Raghavendra commit b349c778a8f49cc85a585ab9bbe35d9d84c6383f Author: Dhruva Gole Date: Thu Jan 22 21:13:57 2026 +0530 arm64: dts: ti: k3-am62l: support cpufreq scaling Enable CPUFreq support for AM62L SoC by adding the relevant OPP efuse table syscon for speed grade detection. Add the operating-points-v2 table with CPU frequency steps from 200MHz to 1.25GHz. Specify the CPU clocks to reference the SCMI clock controller for frequency scaling. Signed-off-by: Dhruva Gole Reviewed-by: Kendall Willis Link: https://patch.msgid.link/20260122-am62l-cpufreq-v5-1-65c50af71681@ti.com Signed-off-by: Vignesh Raghavendra commit 57df858a46f0a4cc104716e0ec88864e5c386ca4 Author: Jassi Brar Date: Mon Feb 9 17:36:19 2026 -0600 mailbox: add API to query available TX queue slots Clients sometimes need to know whether the mailbox TX queue has room before posting a new message. Rather than exposing internal queue state through a struct field, provide a proper accessor function that returns the number of available slots for a given channel. This lets clients choose to back off when the queue is full instead of hitting the -ENOBUFS error path and the misleading "Try increasing MBOX_TX_QUEUE_LEN" warning. Tested-by: Tanmay Shah Signed-off-by: Jassi Brar commit 50b3e0c7c82f32e6ac3ead30f0e0ba96d36a4ff6 Author: Timur Tabi Date: Fri Mar 6 13:52:49 2026 +0900 gpu: nova-core: use the Generic Bootloader to boot FWSEC on Turing On Turing and GA100, a new firmware image called the Generic Bootloader (gen_bootloader) must be used to load FWSEC into Falcon memory. The driver loads the generic bootloader into Falcon IMEM, passes a descriptor that points to FWSEC using DMEM, and then boots the generic bootloader. The bootloader will then load FWSEC into IMEM and boot it. Signed-off-by: Timur Tabi Co-developed-by: Alexandre Courbot Signed-off-by: Alexandre Courbot Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260306-turing_prep-v11-12-8f0042c5d026@nvidia.com commit e92241683a2a28ec224f2b99fcac56f2c46750ab Author: Alexandre Courbot Date: Fri Mar 6 13:52:48 2026 +0900 gpu: nova-core: add gen_bootloader firmware to ModInfoBuilder Turing GPUs need an additional firmware file (the FWSEC generic bootloader) in order to initialize. Add it to `ModInfoBuilder`. Reviewed-by: Eliot Courtney Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260306-turing_prep-v11-11-8f0042c5d026@nvidia.com Signed-off-by: Alexandre Courbot commit 349b6dbca0acd8a6a27969f712227c36d681b1d0 Author: Alexandre Courbot Date: Fri Mar 6 13:52:47 2026 +0900 gpu: nova-core: make Chipset::arch() const We will use this method from const context. Also take `self` by value since it is the size of a primitive type and implements `Copy`. Reviewed-by: Eliot Courtney Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260306-turing_prep-v11-10-8f0042c5d026@nvidia.com Signed-off-by: Alexandre Courbot commit 192125e0909e106ae37c2447ec43ee2653909d17 Author: Alexandre Courbot Date: Fri Mar 6 13:52:44 2026 +0900 gpu: nova-core: falcon: remove unwarranted safety check in dma_load This safety check was an assumption based on the firmwares we work with - it is not based on an actual hardware limitation. Thus, remove it. Reviewed-by: Eliot Courtney Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260306-turing_prep-v11-7-8f0042c5d026@nvidia.com Signed-off-by: Alexandre Courbot commit c1d2f7471ba7a21eb3c68b8405365f7e1eac5c9d Author: Timur Tabi Date: Fri Mar 6 13:52:43 2026 +0900 gpu: nova-core: add PIO support for loading firmware images Turing and GA100 use programmed I/O (PIO) instead of DMA to upload firmware images into Falcon memory. Signed-off-by: Timur Tabi Co-developed-by: Alexandre Courbot Signed-off-by: Alexandre Courbot Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260306-turing_prep-v11-6-8f0042c5d026@nvidia.com commit 9725005e2b4bac2f490bef2165eab18fc36b5b67 Author: Alexandre Courbot Date: Fri Mar 6 13:52:42 2026 +0900 gpu: nova-core: move brom_params and boot_addr to FalconFirmware These methods are relevant no matter the loading method used, thus move them to the common `FalconFirmware` trait. Reviewed-by: Eliot Courtney Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260306-turing_prep-v11-5-8f0042c5d026@nvidia.com Signed-off-by: Alexandre Courbot commit 99d451cb8e76bd299b036003f067959816975b9c Author: Alexandre Courbot Date: Fri Mar 6 13:52:41 2026 +0900 gpu: nova-core: falcon: remove FalconFirmware's dependency on FalconDmaLoadable Not all firmware is necessarily loaded by DMA. Remove the requirement for `FalconFirmware` to implement `FalconDmaLoadable`, and adapt `Falcon`'s methods constraints accordingly. Reviewed-by: Eliot Courtney Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260306-turing_prep-v11-4-8f0042c5d026@nvidia.com Signed-off-by: Alexandre Courbot commit 8a623869b8269dbf52d52711cd7b9355044b6b53 Author: Alexandre Courbot Date: Fri Mar 6 13:52:40 2026 +0900 gpu: nova-core: falcon: rename load parameters to reflect DMA dependency The current `FalconLoadParams` and `FalconLoadTarget` types are fit for DMA loading, but not so much for PIO loading which will require its own types. Start by renaming them to something that indicates that they are indeed DMA-related. Reviewed-by: Eliot Courtney Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260306-turing_prep-v11-3-8f0042c5d026@nvidia.com [acourbot@nvidia.com: fixup order of import items.] Signed-off-by: Alexandre Courbot commit 3b97ec9fdef49932505cf4f99cd7074a04806240 Author: Alexandre Courbot Date: Fri Mar 6 13:52:39 2026 +0900 gpu: nova-core: falcon: add constant for memory block alignment Falcon memory blocks are 256 bytes in size. This is a hard constant on all models. This value was hardcoded, so turn it into a documented constant. It will also become useful with the PIO loading code. Reviewed-by: Eliot Courtney Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260306-turing_prep-v11-2-8f0042c5d026@nvidia.com Signed-off-by: Alexandre Courbot commit bc9de9e1af2f05461460e1b215a6d209ee62d65a Author: Alexandre Courbot Date: Fri Mar 6 13:52:38 2026 +0900 gpu: nova-core: create falcon firmware DMA objects lazily When DMA was the only loading option for falcon firmwares, we decided to store them in DMA objects as soon as they were loaded from disk and patch them in-place to avoid having to do an extra copy. This decision complicates the PIO loading patch considerably, and actually does not even stand on its own when put into perspective with the fact that it requires 8 unsafe statements in the code that wouldn't exist if we stored the firmware into a `KVVec` and copied it into a DMA object at the last minute. The cost of the copy is, as can be expected, imperceptible at runtime. Thus, switch to a lazy DMA object creation model and simplify our code a bit. This will also have the nice side-effect of being more fit for PIO loading. Reviewed-by: Eliot Courtney Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260306-turing_prep-v11-1-8f0042c5d026@nvidia.com [acourbot@nvidia.com: add TODO item to switch back to a coherent allocation when it becomes convenient to do so.] Signed-off-by: Alexandre Courbot commit 099bded7525d9803f62bc5a1ed60e2c9ec4851e0 Merge: 6dd780f9738161 1f318b96cc84d7 Author: Alexei Starovoitov Date: Sun Mar 8 17:46:38 2026 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.0-rc3 Cross-merge BPF and other fixes after downstream PR. No conflicts. Signed-off-by: Alexei Starovoitov commit a8075ada4a341ce58ebf8bef0188cefe6c2f6487 Author: Sen Wang Date: Thu Mar 5 13:58:25 2026 -0600 ASoC: ti: davinci-mcasp: improve aux_div selection for mid-range dividers When the ideal total divider (sysclk/bclk) is between 33 and 4096 and AUXCLK is enabled, the driver computes aux_div as ceil(div/32) and then recomputes bclk_div from the truncated sysclk. This two-step integer division loses precision due to truncation and can sometimes produce PPM errors large enough for ALSA's hw_rule_format to reject otherwise valid sample formats. For example, on AM62D-EVM (auxclk-fs-ratio=2177, tdm-slots=2, fck=96 MHz), playing S16_LE at 44100 Hz gives BCLK = 1,411,200 Hz and an ideal total divider of 68. The old code picks aux_div = ceil(68/32) = 3, then bclk_div = (96005700/3) / 1411200 = 22, for a total of 3 x 22 = 66 -- two steps from ideal. The resulting error exceeds the PPM threshold and causes S16_LE, S24_LE to be rejected. Therefore when the total divider fits in the AHCLKXDIV register alone (<=4096), use it directly as aux_div with bclk_div=1, and compare floor and ceil to pick the closer match, to ensure the best ideal total dividers. Dividers at or below 32 never enter this path, and dividers above 4096 still fall through to the existing DIV_ROUND_UP path, so previously working configurations remains unaffected. Signed-off-by: Sen Wang Link: https://patch.msgid.link/20260305195825.9998-3-sen@ti.com Signed-off-by: Mark Brown commit 5bebbfd64b879d1a7220233767be3274e7d442b8 Author: Sen Wang Date: Thu Mar 5 13:58:24 2026 -0600 ASoC: ti: davinci-mcasp: extract mcasp_is_auxclk_enabled() helper Move the AUXCLK-enabled check out of davinci_mcasp_calc_clk_div() into a reusable helper. No functional change. Signed-off-by: Sen Wang Link: https://patch.msgid.link/20260305195825.9998-2-sen@ti.com Signed-off-by: Mark Brown commit 5f0a63f81a027becb06a71406e0941c5d12e074d Merge: 057ad0ef4da61a d2e20c8951e4bb Author: Dave Airlie Date: Mon Mar 9 06:06:57 2026 +1000 Merge tag 'drm-misc-next-2026-03-05' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.1: Cross-subsystem Changes: dma-buf: - Prepare for compile-time concurrency analysis Core Changes: buddy: - Improve assert testing sched: - Fix race condition in drm_sched_fini() - Mark slow tests Driver Changes: bridge: - waveshare-dsi: Fix register and attach; Support 1..4 DSI lanes plus DT bindings gma500: - Use DRM client buffer for fbdev framebuffer gud: - Test for imported buffers with helper imagination: - Fix power domain handling ivpu: - Update boot API to v3.29.4 - Limit per-user number of doorbells and contexts nouveau: - Test for imported buffers with helper panel: - panel-edp: Fix timings for BOE NV140WUM-N64 panfrost: - Test for imported buffers with helper panthor: - Test for imported buffers with helper vc4: - Test for imported buffers with helper Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260305081140.GA171266@linux.fritz.box commit 057ad0ef4da61a8ba654c691e3fc3933d92b7d5f Merge: 17b95278ae6adb c5d8df53b620eb Author: Dave Airlie Date: Mon Mar 9 06:04:15 2026 +1000 Merge tag 'amd-drm-next-7.1-2026-03-04' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-7.1-2026-03-04: amdgpu: - FAMS2 updates - Refactor DC I2C - Rework ttm handling to allow for multiple engines - UserQ updates - Ring reset improvements - DC DCE 6.x cleanups - DC support for NUTMEG and TRAVIS DP bridges - Enable DC by default on CIK APUs - Add DCN 4.2 support - IPS fixes - Overlay fixes for DCN4 - SDMA Limit updates - Misc fixes - RAS updates - Register access callback rework - GC 12.1 updates amdkfd: - Misc cleanups UAPI: - UserQ fence IOCTL parameter size fixes. The change is backwards compatible on LE, but not BE. UserQs are still not considered stable and are disabled by default. From: Alex Deucher Link: https://patch.msgid.link/20260304213233.1938311-1-alexander.deucher@amd.com Signed-off-by: Dave Airlie commit ceea7868b594ccf376562af40b9463d9f2fb7dd0 Author: Uros Bizjak Date: Sun Mar 8 18:12:35 2026 +0100 x86/local: Remove trailing semicolon from _ASM_XADD in local_add_return() Remove the trailing semicolon from the inline assembly statement in local_add_return(). The _ASM_XADD macro already expands to a complete instruction, making the extra semicolon unnecessary. More importantly, the stray semicolon causes GCC to treat the inline asm as containing multiple instructions, which can skew its internal instruction count estimation and affect optimization heuristics. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260308171250.7278-1-ubizjak@gmail.com commit c52f2944492590c59599b0663f05611320efe441 Author: Charan Pedumuru Date: Sat Mar 7 09:16:18 2026 +0000 arm: dts: microchip: remove unused #address-cells/#size-cells from sam9x60 udc node The UDC node does not define any child nodes, so the "#address-cells" and "#size-cells" properties are unnecessary. Remove these unused properties to simplify the devicetree node and keep it consistent with DT conventions. Signed-off-by: Charan Pedumuru Link: https://lore.kernel.org/r/20260307-atmel-usb-v3-1-3dc48fe772be@gmail.com Reviewed-by: Claudiu Beznea [claudiu.beznea: s/at91/microchip in commit title] Signed-off-by: Claudiu Beznea commit 09bb95d63adeaab7b07127cfce4ecbeff9ab6488 Author: Peng Fan Date: Sat Feb 28 11:37:33 2026 +0800 firmware: arm_scmi: Use round_up() for base protocol list size calculation Replace the open-coded size rounding logic with the kernel's round_up() helper to improve readability and align with common kernel practices. The original expression: (1 + (loop_num_ret - 1) / sizeof(u32)) * sizeof(u32) is equivalent to rounding up loop_num_ret to the nearest multiple of sizeof(u32), which is exactly what round_up() does. No functional change. Signed-off-by: Peng Fan Reviewed-by: Cristian Marussi Message-Id: <20260228-scmi-check-v1-1-4935b58bb2db@nxp.com> Signed-off-by: Sudeep Holla commit d8283ac2c8fbf2b459672064ebff718fbefae226 Author: Marek Vasut Date: Sat Jan 17 02:02:29 2026 +0100 firmware: arm_scmi: Implement arm,no-completion-irq property Implement new property arm,no-completion-irq, which sets all SCMI operation into poll mode. This is meant to work around uncooperative SCP implementations, which do not generate completion interrupts. This applies to mbox/shmem based implementations. With this property set, such implementations which do not generate interrupts can be interacted with, until they are fixed to generate interrupts properly. Signed-off-by: Marek Vasut Reviewed-by: Cristian Marussi Message-Id: <20260117010241.186685-2-marek.vasut+renesas@mailbox.org> Signed-off-by: Sudeep Holla commit 0c5453bf8437e558d3b3bc5a8e8c45d31126c254 Author: Marek Vasut Date: Sat Jan 17 02:02:28 2026 +0100 dt-bindings: firmware: arm,scmi: Document arm,no-completion-irq property Document new property arm,no-completion-irq . This optional property is intended for hardware that does not generate completion interrupts and can be used to unconditionally enable forced polling mode of operation. With this property set, such implementations which do not generate interrupts can be interacted with, until they are fixed to generate interrupts properly. Note that, because the original base protocol exchange also requires some sort of completion mechanism, it is not possible to query SCMI itself for this property and it must be described in DT. While this does look a bit like policy, the SCMI provider is part of the hardware, hence DT. Reviewed-by: Rob Herring (Arm) Signed-off-by: Marek Vasut Reviewed-by: Cristian Marussi Message-Id: <20260117010241.186685-1-marek.vasut+renesas@mailbox.org> Signed-off-by: Sudeep Holla commit 4707bf5f6c86443bcfa9fcf5826effe46ebd6f21 Author: Jacob Moroni Date: Thu Mar 5 17:08:26 2026 +0000 RDMA/irdma: Add support for revocable pinned dmabuf import Use the new API to support importing pinned dmabufs from exporters that require revocation, such as VFIO. The revoke semantic is achieved by issuing a HW invalidation command but not freeing the key. This prevents further accesses to the region (they will result in an invalid key AE), but also keeps the key reserved until the region is actually deregistered (i.e., ibv_dereg_mr) so that a new MR registration cannot acquire the same key. Tested with lockdep+kasan and a memfd backed dmabuf. The rereg_mr path is explicitly blocked in libibverbs for dmabuf MRs (more specifically, any MR not of type IBV_MR_TYPE_MR), so the rereg_mr path for dmabufs was tested with a modified libibverbs. Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20260305170826.3803155-6-jmoroni@google.com Signed-off-by: Leon Romanovsky commit 3a0b171302eea1732a168e26db3b8461f51cc1f9 Author: Jacob Moroni Date: Thu Mar 5 17:08:25 2026 +0000 RDMA/umem: Add helpers for umem dmabuf revoke lock Added helpers to acquire and release the umem dmabuf revoke lock. The intent is to avoid the need for drivers to peek into the ib_umem_dmabuf internals to get the dma_resv_lock and bring us one step closer to abstracting ib_umem_dmabuf away from drivers in general. Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20260305170826.3803155-5-jmoroni@google.com Signed-off-by: Leon Romanovsky commit ff85a2ebacbdaec9f28c4660c991295ace93cd1c Author: Jacob Moroni Date: Thu Mar 5 17:08:24 2026 +0000 RDMA/umem: Add pinned revocable dmabuf import interface Added an interface for importing a pinned but revocable dmabuf. This interface can be used by drivers that are capable of revocation so that they can import dmabufs from exporters that may require it, such as VFIO. This interface implements a two step process, where drivers will first call ib_umem_dmabuf_get_pinned_revocable_and_lock() which will pin and map the dmabuf (and provide a functional move_notify/invalidate_mappings callback), but will return with the lock still held so that the driver can then populate the callback via ib_umem_dmabuf_set_revoke_locked() without races from concurrent revocations. This scheme also allows for easier integration with drivers that may not have actually allocated their internal MR objects at the time of the get_pinned_revocable* call. Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20260305170826.3803155-4-jmoroni@google.com Signed-off-by: Leon Romanovsky commit 797291a66ce346c96114b72222fc290d402da005 Author: Jacob Moroni Date: Thu Mar 5 17:08:23 2026 +0000 RDMA/umem: Move umem dmabuf revoke logic into helper function This same logic will eventually be reused from within the invalidate_mappings callback which already has the dma_resv_lock held, so break it out into a separate function so it can be reused. Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20260305170826.3803155-3-jmoroni@google.com Signed-off-by: Leon Romanovsky commit 553dfa8cbd0c6d36adae042d9738ddf8f8765ac7 Author: Jacob Moroni Date: Thu Mar 5 17:08:22 2026 +0000 RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper Move the inner logic of ib_umem_dmabuf_get_pinned_with_dma_device() to a new static function that returns with the lock held upon success. The intent is to allow reuse for the future get_pinned_revocable_and_lock function. Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20260305170826.3803155-2-jmoroni@google.com Signed-off-by: Leon Romanovsky commit a74d7197ebe5b1b8028911d47e78c119d9aaf193 Author: Roberto Sassu Date: Fri Feb 27 13:06:45 2026 +0100 ima: Define and use a digest_size field in the ima_algo_desc structure Add the digest_size field to the ima_algo_desc structure to determine the digest size from the correct source. If the hash algorithm is among allocated PCR banks, take the value from the TPM bank info (equal to the value from the crypto subsystem if the TPM algorithm is supported by it; otherwise, not exceding the size of the digest buffer in the tpm_digest structure, used by IMA). If the hash algorithm is SHA1, use the predefined value. Lastly, if the hash algorithm is the default one but not among the PCR banks, take the digest size from the crypto subsystem (the default hash algorithm is checked when parsing the ima_hash= command line option). Finally, use the new information to correctly show the template digest in ima_measurements_show() and ima_ascii_measurements_show(). Link: https://github.com/linux-integrity/linux/issues/14 Signed-off-by: Roberto Sassu Signed-off-by: Mimi Zohar commit 1984dc2c2ff490701d884e568f0e7dab6ec0dbff Author: Thomas Weißschuh Date: Thu Feb 26 08:20:13 2026 +0100 powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG When CONFIG_MODULE_SIG is disabled set_module_sig_enforced() is defined as an empty stub, so the check is unnecessary. Signed-off-by: Thomas Weißschuh Reviewed-by: Mimi Zohar Reviewed-by: Aaron Tomlin Reviewed-by: Nicolas Schier Signed-off-by: Mimi Zohar commit 658d5c72fc5d14fb52419ecf090ec332f46cf262 Author: Thomas Weißschuh Date: Thu Feb 26 08:20:12 2026 +0100 ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG When configuration settings are disabled the guarded functions are defined as empty stubs, so the check is unnecessary. Signed-off-by: Thomas Weißschuh Reviewed-by: Mimi Zohar Reviewed-by: Aaron Tomlin Reviewed-by: Nicolas Schier [zohar@linux.ibm.com: fixed merge conflict with commit 63e8a44395a4] Signed-off-by: Mimi Zohar commit 01baa39cf55fbbd0078f28a215157ecd185a5176 Author: Mimi Zohar Date: Mon Feb 2 11:23:47 2026 -0500 ima: fallback to using i_version to detect file change Commit db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version") replaced detecting file change based on i_version with STATX_CHANGE_COOKIE. On filesystems without STATX_CHANGE_COOKIE enabled, revert back to detecting file change based on i_version. On filesystems which do not support either, assume the file changed. Reported-by: Frederick Lawler Fixes: db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version") Cc: stable@vger.kernel.org Reviewed-by: Frederick Lawler Tested-by: Frederick Lawler Signed-off-by: Mimi Zohar commit 1dc469f669fe4802dc26aa5a10bcfa32f39b681b Author: Marco Crivellari Date: Thu Mar 5 16:41:17 2026 +0100 RDMA/rtrs: add WQ_PERCPU to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20260305154117.326472-1-marco.crivellari@suse.com Signed-off-by: Leon Romanovsky commit a06165a705eefff4b524ad72c50c9ad82bdf4fae Author: Sriharsha Basavapatna Date: Mon Mar 2 16:30:36 2026 +0530 RDMA/bnxt_re: Support application specific CQs This patch supports application allocated memory for CQs. The application allocates and manages the CQs directly. To support this, the driver exports a new comp_mask to indicate direct control of the CQ. When this comp_mask bit is set in the ureq, the driver maps this application allocated CQ memory into hardware. As the application manages this memory, the CQ depth ('cqe') passed by it must be used as is and the driver shouldn't update it. For CQs, ib_core supports pinning dmabuf based application memory, specified through provider attributes. This umem is mananged by the ib_core and is available in ib_cq. Register 'create_cq_user' devop to process this umem. The driver also supports the legacy interface that allocates umem internally. Link: https://patch.msgid.link/r/20260302110036.36387-7-sriharsha.basavapatna@broadcom.com Signed-off-by: Sriharsha Basavapatna Reviewed-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit cec5157b6c73e3e43ce868b7726dfece8891c1f8 Author: Sriharsha Basavapatna Date: Mon Mar 2 16:30:35 2026 +0530 RDMA/bnxt_re: Separate kernel and user CQ creation paths This patch refactors kernel and user CQ creation logic into two separate code paths. This will be used to support dmabuf based user CQ memory in the next patch. There is no functional change in this patch. Link: https://patch.msgid.link/r/20260302110036.36387-6-sriharsha.basavapatna@broadcom.com Signed-off-by: Sriharsha Basavapatna Reviewed-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 3d4a42360c338203b26eeaba7762a4e6a9ebce01 Author: Sriharsha Basavapatna Date: Mon Mar 2 16:30:34 2026 +0530 RDMA/bnxt_re: Refactor bnxt_re_create_cq() Some applications may allocate dmabuf based memory for CQs. To support this, update the existing code to use SZ_4K to specify supported HW page size for CQs, as we support only 4K pages for now. Call ib_umem_find_best_pgsz() to ensure umem supports this requested page size. A helper function includes these changes. Link: https://patch.msgid.link/r/20260302110036.36387-5-sriharsha.basavapatna@broadcom.com Signed-off-by: Sriharsha Basavapatna Reviewed-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 1234a9d8aebbf24a46ef5d323bf9074bc911423e Author: Kalesh AP Date: Mon Mar 2 16:30:33 2026 +0530 RDMA/bnxt_re: Support doorbell extensions Some applications may need multiple doorbells to support parallel processing of threads that each operate on a group of resources. The following uapi methods have been implemented in this patch. - BNXT_RE_METHOD_DBR_ALLOC: This will allow the appliation to create extra doorbell regions and use the associated doorbell page index in CREATE_QP and use the associated DB address while ringing the doorbell. - BNXT_RE_METHOD_DBR_FREE: Free the allocated doorbell region. - BNXT_RE_METHOD_GET_DEFAULT_DBR: Return the default doorbell page index and doorbell page address associated with the ucontext. Link: https://patch.msgid.link/r/20260302110036.36387-4-sriharsha.basavapatna@broadcom.com Co-developed-by: Sriharsha Basavapatna Signed-off-by: Sriharsha Basavapatna Signed-off-by: Kalesh AP Reviewed-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 13f9a813eee5836e92b83fd41dc09ef8c4aee92d Author: Kalesh AP Date: Mon Mar 2 16:30:32 2026 +0530 RDMA/bnxt_re: Refactor bnxt_qplib_create_qp() function Inside bnxt_qplib_create_qp(), driver currently is doing a lot of things like allocating HWQ memory for SQ/RQ/ORRQ/IRRQ, initializing few of qplib_qp fields etc. Refactored the code such that all memory allocation for HWQs have been moved to bnxt_re_init_qp_attr() function and inside bnxt_qplib_create_qp() function just initialize the request structure and issue the HWRM command to firmware. Introduced couple of new functions bnxt_re_setup_qp_hwqs() and bnxt_re_setup_qp_swqs() moved the hwq and swq memory allocation logic there. Link: https://patch.msgid.link/r/20260302110036.36387-3-sriharsha.basavapatna@broadcom.com Signed-off-by: Kalesh AP Reviewed-by: Selvin Xavier Signed-off-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe commit eee6268421a2ccc6d47d8e175a1f4bfcd78a83ca Author: Kalesh AP Date: Mon Mar 2 16:30:31 2026 +0530 RDMA/bnxt_re: Move the UAPI methods to a dedicated file This is in preparation for upcoming patches in the series. Driver has to support additional UAPIs for some applications. Moving current UAPI implementation to a new file, uapi.c. Link: https://patch.msgid.link/r/20260302110036.36387-2-sriharsha.basavapatna@broadcom.com Signed-off-by: Kalesh AP Reviewed-by: Selvin Xavier Signed-off-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe commit 613713f251c89d089a0da7241573149b9ae8b8ab Author: Jason Gunthorpe Date: Tue Mar 3 15:50:10 2026 -0400 RDMA: Add IB_UVERBS_CORE_SUPPORT_ROBUST_UDATA This flag can be set by drivers once they have finished auditing and implementing the full udata support on every udata operation. My intention going forward is that driver authors proposing new udata uAPI for their drivers must first do the work and set this flag. If this flag is not set the userspace should not try to use udata based uAPI newer than this commit, though on a case by case basis it may be OK based on what checks historical kernels performed on the specific call. Since bnxt_re is audited now, it is the first driver to set the flag. Link: https://patch.msgid.link/r/13-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Signed-off-by: Jason Gunthorpe commit bed686d8dcd4fbcaa18cf67468caaf8772acfc7a Author: Jason Gunthorpe Date: Tue Mar 3 15:50:09 2026 -0400 RDMA/bnxt_re: Use ib_respond_empty_udata() Like ib_is_udata_in_empty() for the request side ib_respond_empty_udata() is called on the response side if there no response struct. Link: https://patch.msgid.link/r/12-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Signed-off-by: Jason Gunthorpe commit bc30311e492ecf908bc57d9cdcc3e891d64d8b6c Author: Jason Gunthorpe Date: Tue Mar 3 15:50:08 2026 -0400 RDMA/bnxt_re: Use ib_respond_udata() All the calls to ib_copy_to_udata() can use this helper safely. Link: https://patch.msgid.link/r/11-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe commit 0cee3acab27a45e9b46f4f8a4edf6e7ab4ade1ef Author: Jason Gunthorpe Date: Tue Mar 3 15:50:07 2026 -0400 RDMA/bnxt_re: Add missing comp_mask validation Two existing req driver data structures have comp_mask but nothing checks them for valid contents. Add the missing checks. Link: https://patch.msgid.link/r/10-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe commit 3f6b103c4bf25eace0e85fe8c0d3a7cd30b210a7 Author: Jason Gunthorpe Date: Tue Mar 3 15:50:06 2026 -0400 RDMA/bnxt_re: Add compatibility checks to the uapi path for no data If drivers ever want to go from an empty drvdata to something with them they need to have called ib_is_udata_in_empty(). Add the missing calls to all the system calls that don't have req structures. Link: https://patch.msgid.link/r/9-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe commit b33d860a13b4f779a740b0c529d457f96d4688a8 Author: Jason Gunthorpe Date: Tue Mar 3 15:50:05 2026 -0400 RDMA/bnxt_re: Add compatibility checks to the uapi path Check that the driver data is properly sized and properly zeroed by calling ib_copy_validate_udata_in(). Use git history to find the commit introducing each req struct and use that to select the end member. Link: https://patch.msgid.link/r/8-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe commit 5ebe8832ef900a889bfb72794086ebcde5fd40b7 Author: Jason Gunthorpe Date: Tue Mar 3 15:50:04 2026 -0400 RDMA: Provide documentation about the uABI compatibility rules Write down how all of this is supposed to work using the new helpers. Link: https://patch.msgid.link/r/7-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe commit 4c379ba04c110ba55182535140fda3a7f285d597 Author: Jason Gunthorpe Date: Tue Mar 3 15:50:03 2026 -0400 RDMA: Add ib_is_udata_in_empty() If the driver doesn't yet support any request driver data it should check that it is all zeroed. This is a common pattern, add a helper around _ib_copy_validate_udata_in() to do this. Link: https://patch.msgid.link/r/6-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe commit 14badc323ed7153c24a0a9c3175e594aaf1366c9 Author: Jason Gunthorpe Date: Tue Mar 3 15:50:02 2026 -0400 RDMA: Add ib_respond_udata() Wrap the common copy_to_user() pattern used in drivers and enhance it to zero pad as well. Include debug logging on failures. Link: https://patch.msgid.link/r/5-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe commit dbf6491bb98d2821f0a23f4e8efd215cb2e5ff21 Author: Jason Gunthorpe Date: Tue Mar 3 15:50:01 2026 -0400 RDMA: Add ib_copy_validate_udata_in_cm() For structures with comp_mask also absorb the check of comp_mask valid bits into the helper. This is slightly tricky because ~ might not fully extend to 64 bits, the helper inserts an explicit type to ensure that ~ covers all bits. Link: https://patch.msgid.link/r/4-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe commit 1de9287ece44022bd694e669153fb7644804e10d Author: Jason Gunthorpe Date: Tue Mar 3 15:50:00 2026 -0400 RDMA: Add ib_copy_validate_udata_in() Add a new function to consolidate the required compatibility pattern for driver data of checking against a minimum size, and checking for unknown trailing bytes to be zero into a function. This new function uses the faster copy_struct_from_user() instead of trying to directly check for zero. Incorporate the common ibdev_dbg() logging directly into the error paths of the helper. Link: https://patch.msgid.link/r/3-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe commit b51caeb24aad565ef26689fb667c60daa60094aa Author: Jason Gunthorpe Date: Tue Mar 3 15:49:59 2026 -0400 RDMA/core: Add rdma_udata_to_dev() Get an ib_device out of a udata so it can be used for debug prints. Link: https://patch.msgid.link/r/2-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Signed-off-by: Jason Gunthorpe commit 38a6e5579d0d9b9ecc742bad4260a6e90d128e07 Author: Jason Gunthorpe Date: Tue Mar 3 15:49:58 2026 -0400 RDMA: Use copy_struct_from_user() instead of open coding This entire function is just open coding copy_struct_from_user(), call it directly, it is faster anyhow. Link: https://patch.msgid.link/r/1-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Signed-off-by: Jason Gunthorpe commit 739690915ce1f017223ef4e6f3cc966ccfa3c861 Author: Peter Zijlstra Date: Fri Mar 6 10:43:56 2026 +0100 locking/rwsem: Add context analysis Add compiler context analysis annotations. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260306101417.GT1282955@noisy.programming.kicks-ass.net commit 90bb681dcdf7e69c90b56a18f06c0389a0810b92 Author: Peter Zijlstra Date: Tue Jan 20 18:17:50 2026 +0100 locking/rtmutex: Add context analysis Add compiler context analysis annotations. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260121111213.851599178@infradead.org commit 5c4326231cde36fd5e90c41e403df9fac6238f4b Author: Peter Zijlstra Date: Tue Jan 20 10:06:08 2026 +0100 locking/mutex: Add context analysis Add compiler context analysis annotations. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260121111213.745353747@infradead.org commit 07574b8ebaac7927e2355b4f343b03b50e04494c Author: Peter Zijlstra Date: Tue Jan 20 13:40:30 2026 +0100 compiler-context-analysys: Add __cond_releases() Useful for things like unlock fastpaths, which on success release the lock. Suggested-by: Marco Elver Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Marco Elver Link: https://patch.msgid.link/20260121111213.634625032@infradead.org commit 25500ba7e77ce9d3d9b5a1929d41a2ee2e23f6fe Author: Matthew Wilcox (Oracle) Date: Thu Mar 5 19:55:43 2026 +0000 locking/mutex: Remove the list_head from struct mutex Instead of embedding a list_head in struct mutex, store a pointer to the first waiter. The list of waiters remains a doubly linked list so we can efficiently add to the tail of the list, remove from the front (or middle) of the list. Some of the list manipulation becomes more complicated, but it's a reasonable tradeoff on the slow paths to shrink data structures which embed a mutex like struct file. Some of the debug checks have to be deleted because there's no equivalent to checking them in the new scheme (eg an empty waiter->list now means that it is the only waiter, not that the waiter is no longer on the list). Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260305195545.3707590-4-willy@infradead.org commit b9bdd4b6840454ef87f61b6506c9635c57a81650 Author: Matthew Wilcox (Oracle) Date: Thu Mar 5 19:55:42 2026 +0000 locking/semaphore: Remove the list_head from struct semaphore Instead of embedding a list_head in struct semaphore, store a pointer to the first waiter. The list of waiters remains a doubly linked list so we can efficiently add to the tail of the list and remove from the front (or middle) of the list. Some of the list manipulation becomes more complicated, but it's a reasonable tradeoff on the slow paths to shrink data structures which embed a semaphore. Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260305195545.3707590-3-willy@infradead.org commit 1ea4b473504b6dc6a0d21c298519aff2d52433c9 Author: Matthew Wilcox (Oracle) Date: Thu Mar 5 19:55:41 2026 +0000 locking/rwsem: Remove the list_head from struct rw_semaphore Instead of embedding a list_head in struct rw_semaphore, store a pointer to the first waiter. The list of waiters remains a doubly linked list so we can efficiently add to the tail of the list, remove from the front (or middle) of the list. Some of the list manipulation becomes more complicated, but it's a reasonable tradeoff on the slow paths to shrink some core data structures like struct inode. Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260305195545.3707590-2-willy@infradead.org commit b91d5d4bcf1266257a9e0199e1b4ad7fa8771baa Author: Andreas Hindborg Date: Tue Mar 3 12:17:01 2026 -0800 rust: atomic: Update a safety comment in impl of `fetch_add()` The safety comment used in the implementation of `fetch_add()` could be read as just saying something it is true without justifying it. Update the safety comment to include justification. Suggested-by: Miguel Ojeda Signed-off-by: Andreas Hindborg Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260220-atomic-sub-v3-3-e63cbed1d2aa@kernel.org Link: https://patch.msgid.link/20260303201701.12204-14-boqun@kernel.org commit 0b864375d93d1509821def9c4b15f845d314a5d2 Author: Andreas Hindborg Date: Tue Mar 3 12:17:00 2026 -0800 rust: sync: atomic: Update documentation for `fetch_add()` The documentation for `fetch_add()` does not indicate that the original value is returned by `fetch_add()`. Update the documentation so this is clear. Signed-off-by: Andreas Hindborg Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260220-atomic-sub-v3-2-e63cbed1d2aa@kernel.org Link: https://patch.msgid.link/20260303201701.12204-13-boqun@kernel.org commit c49cf341090b53d2afa4dc7c8007ddeefbb3b37f Author: Andreas Hindborg Date: Tue Mar 3 12:16:59 2026 -0800 rust: sync: atomic: Add fetch_sub() Add `Atomic::fetch_sub()` with implementation and documentation in line with existing `Atomic::fetch_add()` implementation. Signed-off-by: Andreas Hindborg Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260220-atomic-sub-v3-1-e63cbed1d2aa@kernel.org Link: https://patch.msgid.link/20260303201701.12204-12-boqun@kernel.org commit e2f9c86f33abb89d3e52436018f58e5fb951cc04 Author: Boqun Feng Date: Tue Mar 3 12:16:58 2026 -0800 rust: sync: atomic: Add atomic operation helpers over raw pointers In order to synchronize with C or external memory, atomic operations over raw pointers are need. Although there is already an `Atomic::from_ptr()` to provide a `&Atomic`, it's more convenient to have helpers that directly perform atomic operations on raw pointers. Hence a few are added, which are basically an `Atomic::from_ptr().op()` wrapper. Note: for naming, since `atomic_xchg()` and `atomic_cmpxchg()` have a conflict naming to 32bit C atomic xchg/cmpxchg, hence the helpers are just named as `xchg()` and `cmpxchg()`. For `atomic_load()` and `atomic_store()`, their 32bit C counterparts are `atomic_read()` and `atomic_set()`, so keep the `atomic_` prefix. [boqun: Fix typo spotted by Alice and fix broken sentence spotted by Gary] Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260120115207.55318-3-boqun.feng@gmail.com Link: https://patch.msgid.link/20260303201701.12204-11-boqun@kernel.org commit 282866207020b15c2afc4d43b1ca0c5d96c9032d Author: FUJITA Tomonori Date: Tue Mar 3 12:16:57 2026 -0800 rust: list: Use AtomicFlag in AtomicTracker Make AtomicTracker use AtomicFlag instead of Atomic to avoid slow byte-sized RMWs on architectures that don't support them. Signed-off-by: FUJITA Tomonori Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260129122622.3896144-3-tomo@aliasing.net Link: https://patch.msgid.link/20260303201701.12204-10-boqun@kernel.org commit ec6fc66ac39b1a6c0b06a828eff8d21928e56b60 Author: FUJITA Tomonori Date: Tue Mar 3 12:16:56 2026 -0800 rust: sync: atomic: Add performance-optimal Flag type for atomic booleans Add AtomicFlag type for boolean flags. Document when AtomicFlag is generally preferable to Atomic: in particular, when RMW operations such as xchg()/cmpxchg() may be used and minimizing memory usage is not the top priority. On some architectures without byte-sized RMW instructions, Atomic can be slower for RMW operations. Signed-off-by: FUJITA Tomonori Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260129122622.3896144-2-tomo@aliasing.net Link: https://patch.msgid.link/20260303201701.12204-9-boqun@kernel.org commit ac8f06ade38a49f7725cc219fc6e90d1d4708d2b Author: Boqun Feng Date: Tue Mar 3 12:16:55 2026 -0800 rust: sync: atomic: Add Atomic<*{mut,const} T> support Atomic pointer support is an important piece of synchronization algorithm, e.g. RCU, hence provide the support for that. Note that instead of relying on atomic_long or the implementation of `Atomic`, a new set of helpers (atomic_ptr_*) is introduced for atomic pointer specifically, this is because ptr2int casting would lose the provenance of a pointer and even though in theory there are a few tricks the provenance can be restored, it'll still be a simpler implementation if C could provide atomic pointers directly. The side effects of this approach are: we don't have the arithmetic and logical operations for pointers yet and the current implementation only works on ARCH_SUPPORTS_ATOMIC_RMW architectures, but these are implementation issues and can be added later. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Gary Guo Reviewed-by: FUJITA Tomonori Link: https://patch.msgid.link/20260120140503.62804-3-boqun.feng@gmail.com Link: https://patch.msgid.link/20260303201701.12204-8-boqun@kernel.org commit 553c02fb588d4310193eba80f75b43b20befd1d2 Author: Boqun Feng Date: Tue Mar 3 12:16:54 2026 -0800 rust: sync: atomic: Clarify the need of CONFIG_ARCH_SUPPORTS_ATOMIC_RMW Currently, since all the architectures that support Rust all have CONFIG_ARCH_SUPPORTS_ATOMIC_RMW selected, the helpers of atomic load/store on i8 and i16 relies on CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y. It's generally fine since most of architectures support that. The plan for CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=n architectures is adding their (probably lock-based) atomic load/store for i8 and i16 as their atomic_{read,set}() and atomic64_{read,set}() counterpart when they plans to support Rust. Hence use a statis_assert!() to check this and remind the future us the need of the helpers. This is more clear than the #[cfg] on impl blocks of i8 and i16. Suggested-by: Dirk Behme Suggested-by: Benno Lossin Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260120140503.62804-2-boqun.feng@gmail.com Link: https://patch.msgid.link/20260303201701.12204-7-boqun@kernel.org commit a92236bf239cc01fd40d9cbe98fc8b9924c42a82 Author: Boqun Feng Date: Tue Mar 3 12:16:53 2026 -0800 rust: helpers: Generify the definitions of rust_helper_*_cmpxchg* To support atomic pointers, more cmpxchg helpers will be introduced, hence define macros to generate these helpers to ease the introduction of the future helpers. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260117122243.24404-4-boqun.feng@gmail.com Link: https://patch.msgid.link/20260303201701.12204-6-boqun@kernel.org commit f92d22b00e3f75fad2efd965b20d49b4e763b792 Author: Boqun Feng Date: Tue Mar 3 12:16:52 2026 -0800 rust: helpers: Generify the definitions of rust_helper_*_xchg* To support atomic pointers, more xchg helpers will be introduced, hence define macros to generate these helpers to ease the introduction of the future helpers. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260117122243.24404-3-boqun.feng@gmail.com Link: https://patch.msgid.link/20260303201701.12204-5-boqun@kernel.org commit ecc8e9fbaac35c8e5cced26f740f846506c4737b Author: Boqun Feng Date: Tue Mar 3 12:16:51 2026 -0800 rust: helpers: Generify the definitions of rust_helper_*_{read,set}* To support atomic pointers, more {read,set} helpers will be introduced, hence define macros to generate these helpers to ease the introduction of the future helpers. Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260117122243.24404-2-boqun.feng@gmail.com Link: https://patch.msgid.link/20260303201701.12204-4-boqun@kernel.org commit bebf7bdc62537b9ef4700c6402f1c2aa206a9b50 Author: FUJITA Tomonori Date: Tue Mar 3 12:16:50 2026 -0800 rust: sync: atomic: Add example for Atomic::get_mut() Add an example for Atomic::get_mut(). No functional change. Signed-off-by: FUJITA Tomonori Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260128123313.3850604-1-tomo@aliasing.net Link: https://patch.msgid.link/20260303201701.12204-3-boqun@kernel.org commit 4a5dc632e0b603ec1cbbf87b78de86b4b6359cff Author: Boqun Feng Date: Tue Mar 3 12:16:49 2026 -0800 rust: sync: atomic: Remove bound `T: Sync` for `Atomic::from_ptr()` Originally, `Atomic::from_ptr()` requires `T` being a `Sync` because I thought having the ability to do `from_ptr()` meant multiplle `&Atomic`s shared by different threads, which was identical (or similar) to multiple `&T`s shared by different threads. Hence `T` was required to be `Sync`. However this is not true, since `&Atomic` is not the same at `&T`. Moreover, having this bound makes `Atomic::<*mut T>::from_ptr()` impossible, which is definitely not intended. Therefore remove the `T: Sync` bound. [boqun: Fix title typo spotted by Alice & Gary] Fixes: 29c32c405e53 ("rust: sync: atomic: Add generic atomics") Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260120115207.55318-2-boqun.feng@gmail.com Link: https://patch.msgid.link/20260303201701.12204-2-boqun@kernel.org commit 0da9ca4c08e709144a1bd2f765c14205960ac64d Author: Randy Dunlap Date: Tue Mar 3 16:50:03 2026 -0800 futex: add missing function parameter comments Correct or add the missing function parameter kernel-doc comments to avoid warnings: Warning: include/asm-generic/futex.h:38 function parameter 'op' not described in 'futex_atomic_op_inuser_local' Warning: include/asm-generic/futex.h:38 function parameter 'oparg' not described in 'futex_atomic_op_inuser_local' Warning: include/asm-generic/futex.h:38 function parameter 'oval' not described in 'futex_atomic_op_inuser_local' Signed-off-by: Randy Dunlap Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260304005008.409858-1-rdunlap@infradead.org commit 0a0d3b8dd06b9df0bdc31427090a85e90ac0406b Author: Tejun Heo Date: Sat Mar 7 16:45:19 2026 -1000 tools/sched_ext/include: Regenerate enum_defs.autogen.h Regenerate enum_defs.autogen.h from the current vmlinux.h to pick up new SCX enums added in the for-7.1 cycle. Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit 93ac9b150e2fba3a5e94e0b20d954a12e4b0907f Author: Tejun Heo Date: Sat Mar 7 16:45:18 2026 -1000 tools/sched_ext/include: Add libbpf version guard for assoc_struct_ops Extract the inline bpf_program__assoc_struct_ops() call in SCX_OPS_LOAD() into a __scx_ops_assoc_prog() helper and wrap it with a libbpf >= 1.7 version guard. bpf_program__assoc_struct_ops() was added in libbpf 1.7; the guard provides a no-op fallback for older versions. Add the include needed by the helper, and fix "assumming" typo in a nearby comment. Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit c9c8546cdee64d3f1a54fe09cc2b8c1a8ea80c6d Author: Tejun Heo Date: Sat Mar 7 16:45:17 2026 -1000 tools/sched_ext/include: Add __COMPAT_HAS_scx_bpf_select_cpu_and macro scx_bpf_select_cpu_and() is now an inline wrapper so bpf_ksym_exists(scx_bpf_select_cpu_and) no longer works. Add __COMPAT_HAS_scx_bpf_select_cpu_and macro that checks for either the struct args type (new) or the compat ksym (old) to test availability. Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit 3691d380d5ca8c847c716327aad73a07307ec9c4 Author: Tejun Heo Date: Sat Mar 7 16:45:16 2026 -1000 tools/sched_ext/include: Add missing helpers to common.bpf.h Sync several helpers from the scx repo: - bpf_cgroup_acquire() ksym declaration - __sink() macro for hiding values from verifier precision tracking - ctzll() count-trailing-zeros implementation - get_prandom_u64() helper - scx_clock_task/pelt/virt/irq() clock helpers with get_current_rq() Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit 9c6437f7c2e848aea2469df3396f8365d06adbb0 Author: Tejun Heo Date: Sat Mar 7 16:45:15 2026 -1000 tools/sched_ext/include: Sync bpf_arena_common.bpf.h with scx repo Sync the following changes from the scx repo: - Guard __arena define with #ifndef to avoid redefinition when the attribute is already defined by another header. - Add bpf_arena_reserve_pages() and bpf_arena_mapping_nr_pages() ksym declarations. - Rename TEST to SCX_BPF_UNITTEST to avoid collision with generic TEST macros in other projects. Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit c90af06c80a33a28f0bdba3ba136439afad4dd38 Author: Tejun Heo Date: Sat Mar 7 16:45:14 2026 -1000 tools/sched_ext/include: Remove dead sdt_task_defs.h guard from common.h The __has_include guard for sdt_task_defs.h is vestigial — the only remaining content is the bpf_arena_common.h include which is available unconditionally. Remove the dead guard. Signed-off-by: Tejun Heo Acked-by: Andrea Righi commit 80a54b807d6c0b98e43522f102da61c953cfd502 Author: Tejun Heo Date: Sat Mar 7 21:42:12 2026 -1000 Revert "sched_ext: Use READ_ONCE() for the read side of dsq->nr update" This reverts commit 9adfcef334bf9c6ef68eaecfca5f45d18614efe0. dsq->nr is protected by dsq->lock and reading while holding the lock doesn't constitute a racy read. Signed-off-by: Tejun Heo Cc: zhidao su commit 25e1a46cc3b7dccb1e2c86ddb15a1c8b92b564f0 Author: Breno Leitao Date: Sat Mar 7 09:47:21 2026 -0800 tools/workqueue/wq_dump.py: add NODE prefix to all node columns Previously only the first node column showed "NODE 0" while subsequent columns showed just the bare node number, making it unclear what the numbers refer to. Add the "NODE" prefix to all node columns and remove the now-unnecessary first/else branching. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 15e1fab91b3d69773735447cbc151a8a96c4f4a0 Author: Breno Leitao Date: Sat Mar 7 09:47:20 2026 -0800 tools/workqueue/wq_dump.py: fix column alignment in node_nr/max_active section On larger machines with many CPUs, max_active values such as 2048 exceed the hardcoded minimum field width of 3 characters, causing the header and data columns to misalign. Widen the format specifiers to accommodate 4-digit values and right-align each nr/max as a single string to keep the output compact. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 18a1efe0156efd583a85e34d9869f92b02473705 Author: Breno Leitao Date: Sat Mar 7 09:47:19 2026 -0800 tools/workqueue/wq_dump.py: remove backslash separator from node_nr/max_active header Remove the backslash separator between the workqueue name and the data columns in the "Unbound workqueue -> node_nr/max_active" header for cleaner output. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 28c4ef2b2e57cb13bf784251e4abbf942d37b4ce Author: Cheng-Yang Chou Date: Sun Mar 8 01:26:28 2026 +0800 sched_ext: Fix scx_bpf_reenqueue_local() silently reenqueuing nothing ffa7ae0724e4 ("sched_ext: Add reenq_flags plumbing to scx_bpf_dsq_reenq()") introduced task_should_reenq() as a filter inside reenq_local(), requiring SCX_REENQ_ANY to be set in order to match any task. scx_bpf_dsq_reenq() handles this correctly by converting a bare reenq_flags=0 to SCX_REENQ_ANY, but scx_bpf_reenqueue_local() was not updated and continued to call reenq_local() with 0, causing it to silently reenqueue zero tasks. Fix by passing SCX_REENQ_ANY directly. Fixes: ffa7ae0724e4 ("sched_ext: Add reenq_flags plumbing to scx_bpf_dsq_reenq()") Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 82169065ffb07577075a5088b313d78673ded331 Author: Ketan Patil Date: Thu Feb 26 16:31:15 2026 +0000 memory: tegra: Add MC error logging support for Tegra264 In Tegra264, different components from memory subsystems like Memory Controller Fabric (MCF), HUB, HUB Common (HUBC), Side Band Shim (SBS) and channels have different interrupt lines for receiving memory controller error interrupts. Add support for logging memory controller errors reported by these memory subsystems on Tegra264 by: - Renaming tegra_mc_error_names array to tegra20_mc_error_names because it has a different bit index for error names compared to Tegra264. - Defining the intmask registers and mask values supported for Tegra264. - Registering interrupt handlers for interrupts associated with these different MC components which read the interrupt status registers to determine the type of violation that occurred. Signed-off-by: Ketan Patil Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20260226163115.1152181-7-ketanp@nvidia.com Signed-off-by: Krzysztof Kozlowski commit 9f2614510960f0761144d14e1b4c4d82e0c098e9 Author: Ketan Patil Date: Thu Feb 26 16:31:14 2026 +0000 memory: tegra: Prepare for supporting multiple intmask registers Add a new structure for the intmask register e.g. MC_INTMASK_0 and it's mask value. Add an array of these new structures to prepare for supporting multiple intmask registers. This is done in preparation for adding support for Tegra264 which supports multiple intmask registers. Signed-off-by: Ketan Patil Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20260226163115.1152181-6-ketanp@nvidia.com [krzk: Fix checkpatch warning] Signed-off-by: Krzysztof Kozlowski commit 2e4cfaa78eb98d2623367818c859225c6b6bf701 Author: Ketan Patil Date: Thu Feb 26 16:31:13 2026 +0000 memory: tegra: Group SoC specific fields Introduce new SoC specific fields in tegra_mc_soc struct for high address mask and error status type mask because Tegra264 has different values for these than the existing devices. Error status registers e.g. MC_ERR_STATUS_0 has few bits which indicate the type of the error. In order to obtain such type of error from error status register, we use error status type mask. Similarly, these error status registers have bits which indicate the higher address bits of the address responsible for mc error. In order to obtain such higher address, we use high address mask. Make this change to prepare for adding MC interrupt support for Tegra264. Signed-off-by: Ketan Patil Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20260226163115.1152181-5-ketanp@nvidia.com [krzk: Fix checkpatch warning] Signed-off-by: Krzysztof Kozlowski commit 4d865a2374037d2d0842f88822fd753f0918b370 Author: Ketan Patil Date: Thu Feb 26 16:31:12 2026 +0000 memory: tegra: Add support for multiple IRQs Add support to handle multiple MC interrupts lines, as supported by Tegra264. Turn the single IRQ handler callback into a counted array to allow specifying a separate handler for each interrupt. Move IRQ handlers into tegra_mc_soc struct, so as to specify SoC specific values. Signed-off-by: Ketan Patil Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20260226163115.1152181-4-ketanp@nvidia.com Signed-off-by: Krzysztof Kozlowski commit 95b714bd8c39d65b241aa1c346625b9c942af403 Author: Ketan Patil Date: Thu Feb 26 16:31:11 2026 +0000 memory: tegra: Group register and fields The current register definitions are not in sorted order. Sort these registers according to their address. Put bit fields and masks of the corresponding registers below the register definitions to clearly identify which fields belongs to which registers. Signed-off-by: Ketan Patil Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20260226163115.1152181-3-ketanp@nvidia.com Signed-off-by: Krzysztof Kozlowski commit b8a177f18df1b439aac708da2d8bd9fcd68bb1eb Author: Ketan Patil Date: Thu Feb 26 16:31:10 2026 +0000 memory: tegra: Group error handling related registers Group MC error related registers into a struct as they could have SoC specific values. Tegra264 has different register offsets than the existing devices and so in order to add support for Tegra264 we need to first make this change. Signed-off-by: Ketan Patil Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20260226163115.1152181-2-ketanp@nvidia.com Signed-off-by: Krzysztof Kozlowski commit 0e124af675ebabddacfeb0958abd443265dddf13 Author: Nilesh Javali Date: Thu Mar 5 15:03:37 2026 +0530 scsi: qla2xxx: Add support to report MPI FW state MPI firmware state was returned as 0. Get MPI FW state to proceed with flash image validation. A new sysfs node 'mpi_fw_state' is added to report MPI firmware state: /sys/class/scsi_host/hostXX/mpi_fw_state Fixes: d74181ca110e ("scsi: qla2xxx: Add bsg interface to support firmware img validation") Signed-off-by: Nilesh Javali Link: https://patch.msgid.link/20260305093337.2007205-1-njavali@marvell.com Signed-off-by: Martin K. Petersen commit 3d7bd20e026687db513887e4d066121cb0a49852 Author: André Draszik Date: Mon Mar 2 12:35:22 2026 +0000 arm64: dts: exynos: gs101-pixel-common: add Maxim MAX77759 fuel gauge On Pixel 6 (and Pro), a MAX77759 companion PMIC for USB Type-C applications is used, which contains four functional blocks (at distinct I2C addresses): * top (including GPIO & NVMEM) * charger * fuel gauge * TCPCi This change adds the fuel gauge. Reviewed-by: Peter Griffin Tested-by: Peter Griffin Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-dts-v2-1-12f1109a6fee@linaro.org Signed-off-by: Krzysztof Kozlowski commit c420f7c4ac7e808bf8554af43691bc9133bb89e9 Author: Yihang Li Date: Thu Mar 5 14:47:00 2026 +0800 scsi: hisi_sas: Fix the risk of overflow in bitwise logical operations Fix a few constants defined via macros that had overflow risks. Signed-off-by: Yihang Li Link: https://patch.msgid.link/20260305064700.116033-3-liyihang9@huawei.com Signed-off-by: Martin K. Petersen commit 87a629fd5e37677ce04b102df25057d889f71be4 Author: Yihang Li Date: Thu Mar 5 14:46:59 2026 +0800 scsi: hisi_sas: Correct printing format issues There are some print format errors, fix them. Signed-off-by: Yihang Li Link: https://patch.msgid.link/20260305064700.116033-2-liyihang9@huawei.com Signed-off-by: Martin K. Petersen commit 6475cfb81fc4f6175b6d15d1c205a5168dc10b46 Author: Peter Wang Date: Fri Mar 6 13:43:02 2026 +0800 scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command Only return IRQ_WAKE_THREAD when MCQ and ESI are not enabled and no UIC command is active. The default UIC command timeout is 500ms, Using threaded IRQs during an active UIC command increases the risk of timeout due to possible preemption by other system IRQs. Signed-off-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260306054419.3816557-1-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit b5e21a29fe9459aef1e6b20b9315e8f3690f8f31 Author: Can Guo Date: Thu Mar 5 03:08:56 2026 -0800 scsi: ufs: core: Add support to notify userspace of UniPro QoS events The UniPro stack manages to repair many potential Link problems without the need to notify the Application Layer. Repair mechanisms of the stack include L2 re-transmission and successful handling of PA_INIT.req. Nevertheless, any successful repair sequence requires Link bandwidth that is no longer vailable for the Application. Therefore, it may be useful for an Application to understand how often such repair attempts are made. The DME implements Quality of Service monitoring using a simple counting scheme, counting error events and comparing them against the number of correctly received or transmitted bytes. When the error counter exceeds a programmed threshold before the byte counter overflows, a DME_QoS.ind is issued to the Application and both counters are reset. When the byte counter overflows before the error counter has reached the programmed threshold, both counters are reset without triggering a DME_QoS.ind. The DME provides Link quality monitoring for the following purposes: 1. Detection of re-occurring repaired fatal error conditions on the Link (PA_INIT loop). This kind of detection is useful if capabilities exchanged between local and peer permit a potential operation at a higher M-PHY Gear, but the physical interconnect between local and peer Device does not, or, after Line quality degradation, no longer satisfies channel characteristics. 2. Detection of degraded inbound or outbound Link quality, to allow an Application to issue an ADAPT sequence for a Link running in HS-G4 or higher HS Gears. This kind of detection is used to monitor a slowly degrading Link quality, e.g., one being affected by temperature and voltage variations, against the expected M-PHY bit error rate. Userspace can configure and enable UniPro QoS via UniPro QoS Attributes (via UFS BSG) and get notified by dme_qos_notification without polling UniPro QoS Status attribute. The dme_qos_notification attribute is a bitfield with the following bit assignments: Bit Description === ====================================== 0 DME QoS Monitor has been reset by host 1 QoS from TX is detected 2 QoS from RX is detected 3 QoS from PA_INIT is detected Signed-off-by: Can Guo Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260305110856.959211-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 7a3aff163c77159d262217382ec0e9c06c847b46 Author: Chaohai Chen Date: Thu Mar 5 10:51:24 2026 +0800 scsi: core: Drop using the host_lock to protect async_scan race condition Previously, host_lock was used to prevent bit-set conflicts in async_scan, but this approach introduced naked reads in some code paths. Convert async_scan from a bitfield to a bool type to eliminate bit-level conflicts entirely. Use __guarded_by(&scan_mutex) to indicate that the async_scan variable is protected by scan_mutex. Signed-off-by: Chaohai Chen Reviewed-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/20260305025125.3649517-1-wdhh6@aliyun.com Signed-off-by: Martin K. Petersen commit ce897abc21b2d5e74981ff2b848f3a08a580d50a Author: Tejun Heo Date: Sat Mar 7 05:29:50 2026 -1000 sched_ext: Add SCX_TASK_REENQ_REASON flags SCX_ENQ_REENQ indicates that a task is being re-enqueued but doesn't tell the BPF scheduler why. Add SCX_TASK_REENQ_REASON flags using bits 12-13 of p->scx.flags to communicate the reason during ops.enqueue(): - NONE: Not being reenqueued - KFUNC: Reenqueued by scx_bpf_dsq_reenq() and friends More reasons will be added. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 7203d77d6e04f83f7b78838eed099d9cac31700b Author: Tejun Heo Date: Sat Mar 7 05:29:50 2026 -1000 sched_ext: Simplify task state handling Task states (NONE, INIT, READY, ENABLED) were defined in a separate enum with unshifted values and then shifted when stored in scx_entity.flags. Simplify by defining them as pre-shifted values directly in scx_ent_flags and removing the separate scx_task_state enum. This removes the need for shifting when reading/writing state values. scx_get_task_state() now returns the masked flags value directly. scx_set_task_state() accepts the pre-shifted state value. scx_dump_task() shifts down for display to maintain readable output. No functional changes. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit a90449b126824b796e9aeefc2b009e57f38af168 Author: Tejun Heo Date: Sat Mar 7 05:29:50 2026 -1000 sched_ext: Optimize schedule_dsq_reenq() with lockless fast path schedule_dsq_reenq() always acquires deferred_reenq_lock to queue a reenqueue request. Add a lockless fast-path to skip lock acquisition when the request is already pending with the required flags set. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 84b1a0ea0b7c23dec240783a592e480780efe459 Author: Tejun Heo Date: Sat Mar 7 05:29:50 2026 -1000 sched_ext: Implement scx_bpf_dsq_reenq() for user DSQs scx_bpf_dsq_reenq() currently only supports local DSQs. Extend it to support user-defined DSQs by adding a deferred re-enqueue mechanism similar to the local DSQ handling. Add per-cpu deferred_reenq_user_node/flags to scx_dsq_pcpu and deferred_reenq_users list to scx_rq. When scx_bpf_dsq_reenq() is called on a user DSQ, the DSQ's per-cpu node is added to the current rq's deferred list. process_deferred_reenq_users() then iterates the DSQ using the cursor helpers and re-enqueues each task. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 35250720d6ed1e83e0d1e12b7e8bf7b8316d7d58 Author: Tejun Heo Date: Sat Mar 7 05:29:50 2026 -1000 sched_ext: Factor out nldsq_cursor_next_task() and nldsq_cursor_lost_task() Factor out cursor-based DSQ iteration from bpf_iter_scx_dsq_next() into nldsq_cursor_next_task() and the task-lost check from scx_dsq_move() into nldsq_cursor_lost_task() to prepare for reuse. As ->priv is only used to record dsq->seq for cursors, update INIT_DSQ_LIST_CURSOR() to take the DSQ pointer and set ->priv from dsq->seq so that users don't have to read it manually. Move scx_dsq_iter_flags enum earlier so nldsq_cursor_next_task() can use SCX_DSQ_ITER_REV. bypass_lb_cpu() now sets cursor.priv to dsq->seq but doesn't use it. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 30b0515342db48ac9ffd9999648de0f7ca1d6a87 Author: Tejun Heo Date: Sat Mar 7 05:29:50 2026 -1000 sched_ext: Add per-CPU data to DSQs Add per-CPU data structure to dispatch queues. Each DSQ now has a percpu scx_dsq_pcpu which contains a back-pointer to the DSQ. This will be used by future changes to implement per-CPU reenqueue tracking for user DSQs. init_dsq() now allocates the percpu data and can fail, so it returns an error code. All callers are updated to handle failures. exit_dsq() is added to free the percpu data and is called from all DSQ cleanup paths. In scx_bpf_create_dsq(), init_dsq() is called before rcu_read_lock() since alloc_percpu() requires GFP_KERNEL context, and dsq->sched is set afterwards. v2: Fix err_free_pcpu to only exit_dsq() initialized bypass DSQs (Andrea Righi). Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit ffa7ae0724e4ee548c87a56dc7a7a0ab7ee0c1d6 Author: Tejun Heo Date: Sat Mar 7 05:29:49 2026 -1000 sched_ext: Add reenq_flags plumbing to scx_bpf_dsq_reenq() Add infrastructure to pass flags through the deferred reenqueue path. reenq_local() now takes a reenq_flags parameter, and scx_sched_pcpu gains a deferred_reenq_local_flags field to accumulate flags from multiple scx_bpf_dsq_reenq() calls before processing. No flags are defined yet. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 9c34c5074d1bc22072fc7f9c86b0028f7e273b2c Author: Tejun Heo Date: Sat Mar 7 05:29:49 2026 -1000 sched_ext: Introduce scx_bpf_dsq_reenq() for remote local DSQ reenqueue scx_bpf_reenqueue_local() can only trigger re-enqueue of the current CPU's local DSQ. Introduce scx_bpf_dsq_reenq() which takes a DSQ ID and can target any local DSQ including remote CPUs via SCX_DSQ_LOCAL_ON | cpu. This will be expanded to support user DSQs by future changes. scx_bpf_reenqueue_local() is reimplemented as a simple wrapper around scx_bpf_dsq_reenq(SCX_DSQ_LOCAL, 0) and may be deprecated in the future. Update compat.bpf.h with a compatibility shim and scx_qmap to test the new functionality. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 0c4df54ad8cd52cc165fe2c51fec87e311372699 Author: Tejun Heo Date: Sat Mar 7 05:29:49 2026 -1000 sched_ext: Wrap deferred_reenq_local_node into a struct Wrap the deferred_reenq_local_node list_head into struct scx_deferred_reenq_local. More fields will be added and this allows using a shorthand pointer to access them. No functional change. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 8c1b9453fde6ed3490508974d8134355e8c3c476 Author: Tejun Heo Date: Sat Mar 7 05:29:49 2026 -1000 sched_ext: Convert deferred_reenq_locals from llist to regular list The deferred reenqueue local mechanism uses an llist (lockless list) for collecting schedulers that need their local DSQs re-enqueued. Convert to a regular list protected by a raw_spinlock. The llist was used for its lockless properties, but the upcoming changes to support remote reenqueue require more complex list operations that are difficult to implement correctly with lockless data structures. A spinlock- protected regular list provides the necessary flexibility. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit ea4593e97a1c0b4b84125dd570b8694bda45c3e0 Author: Tejun Heo Date: Sat Mar 7 05:29:49 2026 -1000 sched_ext: Relocate run_deferred() and its callees Previously, both process_ddsp_deferred_locals() and reenq_local() required forward declarations. Reorganize so that only run_deferred() needs to be declared. Both callees are grouped right before run_deferred() for better locality. This reduces forward declaration clutter and will ease adding more to the run_deferred() path. No functional changes. v2: Also relocate process_ddsp_deferred_locals() next to run_deferred() (Daniel Jordan). Signed-off-by: Tejun Heo Reviewed-by: Emil Tsalapatis Reviewed-by: Daniel Jordan Reviewed-by: Andrea Righi commit 053d27fba582b6c33531aa4d4f7d4e7ee73f193a Author: Tejun Heo Date: Sat Mar 7 05:29:49 2026 -1000 sched_ext: Change find_global_dsq() to take CPU number instead of task Change find_global_dsq() to take a CPU number directly instead of a task pointer. This prepares for callers where the CPU is available but the task is not. No functional changes. v2: Rename tcpu to cpu in find_global_dsq() (Emil Tsalapatis). Signed-off-by: Tejun Heo Reviewed-by: Emil Tsalapatis Reviewed-by: Daniel Jordan Reviewed-by: Andrea Righi commit 363cd075e97058f70404ed34955864b99530cbdb Author: Tejun Heo Date: Sat Mar 7 05:29:49 2026 -1000 sched_ext: Factor out pnode allocation and deallocation into helpers Extract pnode allocation and deallocation logic into alloc_pnode() and free_pnode() helpers. This simplifies scx_alloc_and_add_sched() and prepares for adding more per-node initialization and cleanup in subsequent patches. No functional changes. Signed-off-by: Tejun Heo Reviewed-by: Emil Tsalapatis Reviewed-by: Daniel Jordan Reviewed-by: Andrea Righi commit d4ae868c6b7d6aaa29c86c4f72f68d2252709178 Author: Tejun Heo Date: Sat Mar 7 05:29:49 2026 -1000 sched_ext: Wrap global DSQs in per-node structure Global DSQs are currently stored as an array of scx_dispatch_q pointers, one per NUMA node. To allow adding more per-node data structures, wrap the global DSQ in scx_sched_pnode and replace global_dsqs with pnode array. NUMA-aware allocation is maintained. No functional changes. Signed-off-by: Tejun Heo Reviewed-by: Emil Tsalapatis Reviewed-by: Daniel Jordan Reviewed-by: Andrea Righi commit 26b9c7c70027f011a5f39cef9c3cf44539310a6d Author: Tejun Heo Date: Sat Mar 7 05:29:49 2026 -1000 sched_ext: Relocate scx_bpf_task_cgroup() and its BTF_ID to the end of kfunc section Move scx_bpf_task_cgroup() kfunc definition and its BTF_ID entry to the end of the kfunc section before __bpf_kfunc_end_defs() for cleaner code organization. No functional changes. Signed-off-by: Tejun Heo Reviewed-by: Emil Tsalapatis Reviewed-by: Daniel Jordan Reviewed-by: Andrea Righi commit 03f5304aad0f90907475437be8052e7e70376319 Author: Andrea Righi Date: Sat Mar 7 10:56:31 2026 +0100 sched_ext: Pass full dequeue flags to ops.quiescent() ops.quiescent() is invoked with the same deq_flags as ops.dequeue(), so the BPF scheduler is able to distinguish sleep vs property changes in both callbacks. However, dequeue_task_scx() receives deq_flags as an int from the sched_class interface, so SCX flags above bit 32 (%SCX_DEQ_SCHED_CHANGE) are truncated. ops_dequeue() reconstructs the full u64 for ops.dequeue(), but ops.quiescent() is still called with the original int and can never see %SCX_DEQ_SCHED_CHANGE. Fix this by constructing the full u64 deq_flags in dequeue_task_scx() (renaming the int parameter to core_deq_flags) and passing the complete flags to both ops_dequeue() and ops.quiescent(). Fixes: ebf1ccff79c4 ("sched_ext: Fix ops.dequeue() semantics") Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit f68971bcec23c53979531aab0904afec9b8d0b4a Merge: 4f8b122848dbc3 57ccf5ccdc5695 Author: Tejun Heo Date: Sat Mar 7 04:57:53 2026 -1000 Merge branch 'for-7.0-fixes' into for-7.1 Pull in 57ccf5ccdc56 ("sched_ext: Fix enqueue_task_scx() truncation of upper enqueue flags") which conflicts with ebf1ccff79c4 ("sched_ext: Fix ops.dequeue() semantics"). Signed-off-by: Tejun Heo # Conflicts: # kernel/sched/ext.c commit 09fbb775f1d01945119c4a0be4afacf30cc86796 Author: Uros Bizjak Date: Tue Dec 16 11:51:20 2025 +0100 x86/asm: Use inout "+" asm onstraint modifiers in __iowrite32_copy() Use inout "+" asm constraint modifiers to simplify asm operands. No functional changes intended. Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Reviewed-by: H. Peter Anvin (Intel) Link: https://patch.msgid.link/20251216105134.248196-1-ubizjak@gmail.com commit f3ae0049ff8a3d2cbd8c05857705744435629d0c Author: Akhila YS Date: Fri Feb 27 15:14:35 2026 +0000 dt-bindings: arm: atmel,at91rm9200-sdramc: convert to DT schema Convert RAMC SDRAM/DDR controller binding to YAML format. Signed-off-by: Akhila YS Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20260227-arm-microchip-v4-5-7e2ae1c5b5d6@gmail.com Signed-off-by: Claudiu Beznea commit ae18e2543c4a07317a03c7cf042d8a0596cd5bd0 Author: Akhila YS Date: Fri Feb 27 15:14:34 2026 +0000 dt-bindings: arm: atmel,at91rm9200-st: convert to DT schema Convert System Timer binding to YAML format. Changes during conversion: - Add "#address-cells" and "#size-cells" to the properties and required as watchdog is defined as a child node to the timer parent node. - Define watchdog as a pattern property along with unit address in examples. Acked-by: Conor Dooley Signed-off-by: Akhila YS Link: https://lore.kernel.org/r/20260227-arm-microchip-v4-4-7e2ae1c5b5d6@gmail.com Signed-off-by: Claudiu Beznea commit 67f386b2c623aa07b73a3f6882472d439c5b3ceb Author: Akhila YS Date: Fri Feb 27 15:14:33 2026 +0000 dt-bindings: arm: microchip,sam9x60-pit64b : convert to DT schema Convert Atmel Periodic interval timer of 64bit (PIT64b) binding to YAML format. Changes during conversion: - Add missing compatible "microchip,sama7g5-pit64b" along with a fallback compatible "microchip,sam9x60-pit64b". Acked-by: Conor Dooley Signed-off-by: Akhila YS Link: https://lore.kernel.org/r/20260227-arm-microchip-v4-3-7e2ae1c5b5d6@gmail.com [claudiu.beznea: alphanumerically sort the enum entries] Signed-off-by: Claudiu Beznea commit 5f3acf8c03d666377fbe68a8562d89b2e737875d Author: Akhila YS Date: Fri Feb 27 15:14:32 2026 +0000 dt-bindings: arm: atmel,at91sam9260-pit: convert to DT schema Convert Atmel Periodic interval timer (PIT) binding to YAML format. Acked-by: Conor Dooley Signed-off-by: Akhila YS Link: https://lore.kernel.org/r/20260227-arm-microchip-v4-2-7e2ae1c5b5d6@gmail.com Signed-off-by: Claudiu Beznea commit 0b7b7d1abec33d568086165916510c0415fcabcf Author: Akhila YS Date: Fri Feb 27 15:14:31 2026 +0000 dt-bindings: arm: microchip,sama7g5-chipid : convert to DT schema Convert Atmel system registers binding to YAML format. Acked-by: Conor Dooley Signed-off-by: Akhila YS Link: https://lore.kernel.org/r/20260227-arm-microchip-v4-1-7e2ae1c5b5d6@gmail.com [claudiu.beznea: alphanumerically sort the enum entries] Signed-off-by: Claudiu Beznea commit 76755a576a7676ea75dcf2c1b06907876dea6622 Author: Thorsten Blum Date: Fri Feb 27 12:53:56 2026 +0100 crypto: qat - Drop redundant local variables Return sysfs_emit() directly and drop 'ret' in cap_rem_show(). In cap_rem_store(), use 'ret' when calling set_param_u() instead of assigning it to 'val' first, and remove 'val'. Signed-off-by: Thorsten Blum Acked-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 8456e55162aa38d65d3dcccf9a0eb3e33c01d1f0 Author: Alexander Dahl Date: Thu Feb 26 16:56:27 2026 +0100 crypto: docs/userspace-if - Fix outdated links According to archive.org the site threw HTTP errors 404 since early 2024. The last snapshot in the archive having actual content was from late 2023. The page behind the new URL has more or less the same content as the archived page from 2023, so it probably was just moved without setting up a redirect. Signed-off-by: Alexander Dahl Signed-off-by: Herbert Xu commit 35645ca63caa158e4df3853ada22630d861c821d Author: T Pratham Date: Thu Feb 26 18:24:39 2026 +0530 crypto: ti - Add support for AES-CTR in DTHEv2 driver Add support for CTR mode of operation for AES algorithm in the AES Engine of the DTHEv2 hardware cryptographic engine. Signed-off-by: T Pratham Signed-off-by: Herbert Xu commit 73117ea6470dca787f70f33c001f9faf437a1c0b Author: Chuyi Zhou Date: Thu Feb 26 16:07:03 2026 +0800 padata: Remove cpu online check from cpu add and removal During the CPU offline process, the dying CPU is cleared from the cpu_online_mask in takedown_cpu(). After this step, various CPUHP_*_DEAD callbacks are executed to perform cleanup jobs for the dead CPU, so this cpu online check in padata_cpu_dead() is unnecessary. Similarly, when executing padata_cpu_online() during the CPUHP_AP_ONLINE_DYN phase, the CPU has already been set in the cpu_online_mask, the action even occurs earlier than the CPUHP_AP_ONLINE_IDLE stage. Remove this unnecessary cpu online check in __padata_add_cpu() and __padata_remove_cpu(). Signed-off-by: Chuyi Zhou Acked-by: Daniel Jordan Signed-off-by: Herbert Xu commit d2ad1cf29a98adafaf85ddd5ccad6e40c14bcff9 Author: Randy Dunlap Date: Tue Feb 24 17:45:28 2026 -0800 crypto: ecc - correct kernel-doc format Fix all kernel-doc warnings in ecc.h: - use correct kernel-doc format - add some Returns: sections - fix spelling and parameter names Fixes these warnings: Warning: include/crypto/internal/ecc.h:82 function parameter 'nbytes' not described in 'ecc_digits_from_bytes' Warning: include/crypto/internal/ecc.h:82 function parameter 'out' not described in 'ecc_digits_from_bytes' Warning: include/crypto/internal/ecc.h:95 No description found for return value of 'ecc_is_key_valid' Warning: include/crypto/internal/ecc.h:110 No description found for return value of 'ecc_gen_privkey' Warning: include/crypto/internal/ecc.h:124 No description found for return value of 'ecc_make_pub_key' Warning: include/crypto/internal/ecc.h:143 No description found for return value of 'crypto_ecdh_shared_secret' Warning: include/crypto/internal/ecc.h:182 No description found for return value of 'vli_is_zero' Warning: include/crypto/internal/ecc.h:194 No description found for return value of 'vli_cmp' Warning: include/crypto/internal/ecc.h:209 function parameter 'right' not described in 'vli_sub' Warning: include/crypto/internal/ecc.h:271 expecting prototype for ecc_aloc_point(). Prototype was for ecc_alloc_point() instead Warning: include/crypto/internal/ecc.h:287 function parameter 'point' not described in 'ecc_point_is_zero' Signed-off-by: Randy Dunlap Signed-off-by: Herbert Xu commit 8fe0cdfd9cb073d4090e2f20f16dd4b44de7526e Author: Randy Dunlap Date: Tue Feb 24 17:45:18 2026 -0800 crypto: des - fix all kernel-doc warnings Use correct function parameter names and add Returns: sections to eliminate all kernel-doc warnings in des.h: Warning: include/crypto/des.h:41 function parameter 'keylen' not described in 'des_expand_key' Warning: include/crypto/des.h:41 No description found for return value of 'des_expand_key' Warning: include/crypto/des.h:54 function parameter 'keylen' not described in 'des3_ede_expand_key' Warning: include/crypto/des.h:54 No description found for return value of 'des3_ede_expand_key' Signed-off-by: Randy Dunlap Signed-off-by: Herbert Xu commit 2f5b5ce1e4b89c76a2b177ee689101a274d1a3c6 Author: Randy Dunlap Date: Tue Feb 24 17:45:00 2026 -0800 crypto: acomp - repair kernel-doc warnings Correct kernel-doc: - add the @extra function parameter - add "_extra" to the mismatched function name - spell the "cmpl" parameter correctly to avoid these warnings: Warning: include/crypto/acompress.h:251 function parameter 'extra' not described in 'acomp_request_alloc_extra' Warning: include/crypto/acompress.h:251 expecting prototype for acomp_request_alloc(). Prototype was for acomp_request_alloc_extra() instead Warning: include/crypto/acompress.h:327 function parameter 'cmpl' not described in 'acomp_request_set_callback' Signed-off-by: Randy Dunlap Signed-off-by: Herbert Xu commit c9429bf56405a326845a8a35357b5bdf1dc4558c Author: Mykyta Yatsenko Date: Tue Feb 24 19:29:54 2026 +0000 rhashtable: consolidate hash computation in rht_key_get_hash() The else-if and else branches in rht_key_get_hash() both compute a hash using either params.hashfn or jhash, differing only in the source of key_len (params.key_len vs ht->p.key_len). Merge the two branches into one by using the ternary `params.key_len ?: ht->p.key_len` to select the key length, removing the duplicated logic. This also improves the performance of the else branch which previously always used jhash and never fell through to jhash2. This branch is going to be used by BPF resizable hashmap, which wraps rhashtable: https://lore.kernel.org/bpf/20260205-rhash-v1-0-30dd6d63c462@meta.com/ Signed-off-by: Mykyta Yatsenko Signed-off-by: Herbert Xu commit 68e96c97369e63414c2e02d1dcb92680ac60cd2f Author: Thorsten Blum Date: Mon Feb 23 17:57:37 2026 +0100 crypto: atmel-i2c - Replace hard-coded bus clock rate with constant Replace 1000000L with I2C_MAX_FAST_MODE_PLUS_FREQ. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 3193dd7e848b90cecca3b3f2ed4a04e6fca87bcb Author: Thorsten Blum Date: Mon Feb 23 16:57:55 2026 +0100 crypto: qce - Replace snprintf("%s") with strscpy Replace snprintf("%s", ...) with the faster and more direct strscpy(). Signed-off-by: Thorsten Blum Reviewed-by: Konrad Dybcio Signed-off-by: Herbert Xu commit 39e2a75fffc78537504f25fac66530178ffb3ecd Author: Daniele Alessandrelli Date: Mon Feb 23 15:06:22 2026 +0000 MAINTAINERS: Remove Daniele Alessandrelli as Keem Bay maintainer I'm leaving Intel soon. Remove myself as maintainer of Keem Bay architecture and related crypto drivers. The INTEL KEEM BAY OCS AES/SM4 CRYPTO DRIVER has no replacement maintainer available, so mark it as Orphan. Signed-off-by: Daniele Alessandrelli Signed-off-by: Herbert Xu commit 618195a7ac3dfb88ef7ff701439cabcba2096f31 Author: Abel Vesa Date: Mon Feb 23 10:44:02 2026 +0200 dt-bindings: crypto: qcom,inline-crypto-engine: Document the Eliza ICE Document the Inline Crypto Engine (ICE) on the Eliza platform. Signed-off-by: Abel Vesa Reviewed-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit 1eccfd0e65f727258d50eddcbc9ede809475da92 Author: Thorsten Blum Date: Mon Feb 23 08:56:12 2026 +0100 crypto: vmx - Remove disabled build directive CONFIG_CRYPTO_DEV_VMX has been moved to arch/powerpc - delete the disabled build directive. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 095d50008d55d13f8fcf1bbeb7c6eba51779bc85 Author: Thorsten Blum Date: Fri Feb 20 15:03:13 2026 +0100 crypto: atmel-ecc - Release client on allocation failure Call atmel_ecc_i2c_client_free() to release the I2C client reserved by atmel_ecc_i2c_client_alloc() when crypto_alloc_kpp() fails. Otherwise ->tfm_count will be out of sync. Fixes: 11105693fa05 ("crypto: atmel-ecc - introduce Microchip / Atmel ECC driver") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit de4e66b763d1e81188cb2803ec109466582fc9d1 Author: Thorsten Blum Date: Fri Feb 20 14:31:36 2026 +0100 crypto: atmel-sha204a - Fix uninitialized data access on OTP read error Return early if atmel_i2c_send_receive() fails to avoid checking potentially uninitialized data in 'cmd.data'. Cc: stable@vger.kernel.org Fixes: e05ce444e9e5 ("crypto: atmel-sha204a - add reading from otp zone") Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 0bcac7b11262557c990da1ac564d45777eb6b005 Author: Aleksei Oladko Date: Fri Mar 6 00:01:23 2026 +0000 selftests: net: make ovs-dpctl.py fail when pyroute2 is unsupported The pmtu.sh kselftest configures OVS using ovs-dpctl.py and falls back to ovs-vsctl only when ovs-dpctl.py fails. However, ovs-dpctl.py exits with a success status when the installed pyroute2 package version is lower than 0.6, even though the OVS datapath is not configured. As a result, pmtu.sh assumes that the setup was successful and continues running the test, which later fails due to the missing OVS configuration. Fix the exit code handling in ovs-dpctl.py so that pmtu.sh can detect that the setup did not complete successfully and fall back to ovs-vsctl. Signed-off-by: Aleksei Oladko Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20260306000127.519064-3-aleksey.oladko@virtuozzo.com Signed-off-by: Jakub Kicinski commit f4ac0cc88e9949d41bbdd101caa3117afe983ec9 Author: Johan Hovold Date: Thu Mar 5 11:50:06 2026 +0100 net: usb: lan78xx: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305105006.16415-1-johan@kernel.org Signed-off-by: Jakub Kicinski commit f67ab9d8106ef8c265310cb4249387c9f7e9ec9b Merge: 70eba59f92076d 24d9e73c7e000a Author: Jakub Kicinski Date: Fri Mar 6 19:15:24 2026 -0800 Merge branch 'net-ntb_netdev-add-multi-queue-support' Koichiro Den says: ==================== net: ntb_netdev: Add Multi-queue support ntb_netdev currently hard-codes a single NTB transport queue pair, which means the datapath effectively runs as a single-queue netdev regardless of available CPUs / parallel flows. The longer-term motivation here is throughput scale-out: allow ntb_netdev to grow beyond the single-QP bottleneck and make it possible to spread TX/RX work across multiple queue pairs as link speeds and core counts keep increasing. Multi-queue also unlocks the standard networking knobs on top of it. In particular, once the device exposes multiple TX queues, qdisc/tc can steer flows/traffic classes into different queues (via skb->queue_mapping), enabling per-flow/per-class scheduling and QoS in a familiar way. Usage ===== 1. Ensure the NTB device you want to use has multiple Memory Windows. 2. modprobe ntb_transport on both sides, if it's not built-in. 3. modprobe ntb_netdev on both sides, if it's not built-in. 4. Use ethtool -L to configure the desired number of queues. The default number of real (combined) queues is 1. e.g. ethtool -L eth0 combined 2 # to increase ethtool -L eth0 combined 1 # to reduce back to 1 Note: * If the NTB device has only a single Memory Window, ethtool -L eth0 combined N (N > 1) fails with: "netlink error: No space left on device". * ethtool -L can be executed while the net_device is up. Compatibility ============= The default remains a single queue, so behavior is unchanged unless the user explicitly increases the number of queues. Kernel base =========== ntb-next (latest as of 2026-03-06): commit 7b3302c687ca ("ntb_hw_amd: Fix incorrect debug message in link disable path") Testing / Results ================= Environment / command line: - 2x R-Car S4 Spider boards "Kernel base" (see above) + this series TCP: [RC] $ sudo iperf3 -s [EP] $ sudo iperf3 -Z -c ${SERVER_IP} -l 65480 -w 512M -P 4 UDP: [RC] $ sudo iperf3 -s [EP] $ sudo iperf3 -ub0 -c ${SERVER_IP} -l 65480 -w 512M -P 4 Without this series: TCP / UDP : 589 Mbps / 580 Mbps With this series (default single queue): TCP / UDP : 583 Mbps / 583 Mbps With this series + `ethtool -L eth0 combined 2`: TCP / UDP : 576 Mbps / 584 Mbps With this series + `ethtool -L eth0 combined 2` + [1], where flows are properly distributed across queues: TCP / UDP : 1.13 Gbps / 1.16 Gbps (re-measured with v3) The 575~590 Mbps variation is run-to-run variance i.e. no measurable regression or improvement is observed with a single queue. The key point is scaling from ~600 Mbps to ~1.20 Gbps once flows are distributed across multiple queues. Note: On R-Car S4 Spider, only BAR2 is usable for ntb_transport MW. For testing, BAR2 was expanded from 1 MiB to 2 MiB and split into two Memory Windows. A follow-up series is planned to add split BAR support for vNTB. On platforms where multiple BARs can be used for the datapath, this series should allow >=2 queues without additional changes. [1] [PATCH v2 00/10] NTB: epf: Enable per-doorbell bit handling while keeping legacy offset https://lore.kernel.org/linux-pci/20260227084955.3184017-1-den@valinux.co.jp/ (subject was accidentally incorrect in the original posting) ==================== Link: https://patch.msgid.link/20260305155639.1885517-1-den@valinux.co.jp Signed-off-by: Jakub Kicinski commit 24d9e73c7e000af7c1f1a1f669bdaa9bd7e88ea5 Author: Koichiro Den Date: Fri Mar 6 00:56:39 2026 +0900 net: ntb_netdev: Support ethtool channels for multi-queue Support dynamic queue pair addition/removal via ethtool channels. Use the combined channel count to control the number of netdev TX/RX queues, each corresponding to a ntb_transport queue pair. When the number of queues is reduced, tear down and free the removed ntb_transport queue pairs (not just deactivate them) so other ntb_transport clients can reuse the freed resources. When the number of queues is increased, create additional queue pairs up to NTB_NETDEV_MAX_QUEUES (=64). The effective limit is determined by the underlying ntb_transport implementation and NTB hardware resources (the number of MWs), so set_channels may return -ENOSPC if no more QPs can be allocated. Keep the default at one queue pair to preserve the previous behavior. Signed-off-by: Koichiro Den Link: https://patch.msgid.link/20260305155639.1885517-5-den@valinux.co.jp Signed-off-by: Jakub Kicinski commit b83bf617dc849f11e7b2f907540017b5aa42d167 Author: Koichiro Den Date: Fri Mar 6 00:56:38 2026 +0900 net: ntb_netdev: Factor out multi-queue helpers Implementing .set_channels will otherwise duplicate the same multi-queue operations at multiple call sites. Factor out the following helpers: - ntb_netdev_update_carrier(): carrier is switched on when at least one QP link is up - ntb_netdev_queue_rx_drain(): drain and free all queued RX packets for one QP - ntb_netdev_queue_rx_fill(): prefill RX ring for one QP No functional change. Signed-off-by: Koichiro Den Link: https://patch.msgid.link/20260305155639.1885517-4-den@valinux.co.jp Signed-off-by: Jakub Kicinski commit 304132b7a5e6de84737ed4735c124d3d515f8c7a Author: Koichiro Den Date: Fri Mar 6 00:56:37 2026 +0900 net: ntb_netdev: Gate subqueue stop/wake by transport link When ntb_netdev is extended to multiple ntb_transport queue pairs, the netdev carrier can be up as long as at least one QP link is up. In that setup, a given QP may be link-down while the carrier remains on. Make the link event handler start/stop the corresponding netdev TX subqueue and drive carrier state based on whether any QP link is up. Also guard subqueue wake/start points in the TX completion and timer paths so a subqueue is not restarted while its QP link is down. Stop all queues in ndo_open() and let the link event handler wake each subqueue once ntb_transport link negotiation succeeds. Signed-off-by: Koichiro Den Link: https://patch.msgid.link/20260305155639.1885517-3-den@valinux.co.jp Signed-off-by: Jakub Kicinski commit ee970634c7773f248a0a27d8a645500371ae5249 Author: Koichiro Den Date: Fri Mar 6 00:56:36 2026 +0900 net: ntb_netdev: Introduce per-queue context Prepare ntb_netdev for multi-queue operation by moving queue-pair state out of struct ntb_netdev. Introduce struct ntb_netdev_queue to carry the ntb_transport_qp pointer, the per-QP TX timer and queue id. Pass this object as the callback context and convert the RX/TX handlers and link event path accordingly. The probe path allocates a fixed upper bound for netdev queues while instantiating only a single ntb_transport queue pair, preserving the previous behavior. Also store client_dev for future queue pair creation/removal via the ntb_transport API. Signed-off-by: Koichiro Den Link: https://patch.msgid.link/20260305155639.1885517-2-den@valinux.co.jp Signed-off-by: Jakub Kicinski commit 70eba59f92076d84264762d63d30532685943017 Author: Vivian Wang Date: Thu Mar 5 15:00:29 2026 +0800 net: spacemit: Remove unused buff_addr fields These were never used. Just remove them. No functional change intended. Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20260305-k1-ethernet-cleanup-buff_addr-v1-1-e978ef119231@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 00e3228702de819690ed86d210fd233a4a1341a3 Merge: e3f8800aa24369 1a2d4bfa04919c Author: Jakub Kicinski Date: Fri Mar 6 18:57:46 2026 -0800 Merge branch 'nfc-drop-redundant-usb-device-references' Johan Hovold says: ==================== nfc: drop redundant USB device references Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop redundant device references to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release them. ==================== Link: https://patch.msgid.link/20260305111019.18030-1-johan@kernel.org Signed-off-by: Jakub Kicinski commit 1a2d4bfa04919c2e1676b756ccc21dd8e22d3838 Author: Johan Hovold Date: Thu Mar 5 12:10:19 2026 +0100 nfc: port100: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305111019.18030-3-johan@kernel.org Signed-off-by: Jakub Kicinski commit 6c7f710325228a54a364ae433acd8779c2fc2bcf Author: Johan Hovold Date: Thu Mar 5 12:10:18 2026 +0100 nfc: pn533: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305111019.18030-2-johan@kernel.org Signed-off-by: Jakub Kicinski commit e3f8800aa24369d0766b1005b2b2834b6e262083 Author: Bui Quang Minh Date: Wed Mar 4 22:43:17 2026 +0700 virtio-net: xsk: Support wakeup on RX side When XDP_USE_NEED_WAKEUP is used and the fill ring is empty so no buffer is allocated on RX side, allow RX NAPI to be descheduled. This avoids wasting CPU cycles on polling. Users will be notified and they need to make a wakeup call after refilling the ring. Reviewed-by: Jason Xing Signed-off-by: Bui Quang Minh Link: https://patch.msgid.link/20260304154317.7506-1-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski commit 21c0dc7cdd0723e34103d960a22f4130303eec21 Author: Aleksei Oladko Date: Thu Mar 5 21:10:00 2026 +0000 selftests: net: forwarding: fix IPv6 address leak in cleanup Several forwarding tests (e.g., gre_multipath.sh) initialize both IPv4 and IPv6 addresses using simple_if_init, but only clean up IPv4 in simple_if_fini. This leaves stale IPv6 addresses on the interfaces, which causes subsequent tests to fail when they encounter unexpected address configuration. The issue can be reproduced by running tests in sequence: # run_kselftest.sh -t net/forwarding:ipip_hier_gre.sh # run_kselftest.sh -t net/forwarding:min_max_mtu.sh TAP version 13 1..1 # timeout set to 0 # selftests: net/forwarding: min_max_mtu.sh # TEST: ping [ OK ] # TEST: ping6 [ OK ] # TEST: Test maximum MTU configuration [ OK ] # TEST: Test traffic, packet size is maximum MTU [FAIL] # Ping6, packet size: 65487 succeeded, but should have failed # TEST: Test minimum MTU configuration [ OK ] # TEST: Test traffic, packet size is minimum MTU [ OK ] not ok 1 selftests: net/forwarding: min_max_mtu.sh # exit=1 Fix this by removing the unused IPv6 argument from simple_if_init in tests that don't use IPv6 (gre_multipath.sh, ipip_lib.sh), and by adding the missing IPv6 argument to simple_if_fini in tests that use IPv6 (gre_multipath_nh.sh, gre_multipath_nh_res.sh). Signed-off-by: Aleksei Oladko Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260305211000.515301-1-aleksey.oladko@virtuozzo.com Signed-off-by: Jakub Kicinski commit ad4c9559603e1897e3a978c966b04424be68f4dc Author: Jiayuan Chen Date: Wed Mar 4 14:42:52 2026 +0800 net: annotate data races around sk->sk_prot inet_sendmsg() and inet_recvmsg() access sk->sk_prot without lock_sock() or any other synchronization. sock_replace_proto() (used by sockmap), TLS and MPTCP can change sk->sk_prot under us, so these functions need READ_ONCE() to avoid load tearing. Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260304064253.16955-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 260d27b3aec9f30d68f9f3cacc674655897eb745 Author: Heiner Kallweit Date: Wed Mar 4 21:17:28 2026 +0100 net: phy: remove phy_attach 378e6523ebb1 ("net: bcmgenet: remove unused platform code") removed the last user of phy_attach(). So remove this function. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/8812176a-e319-4e9f-815d-99ea339df8b2@gmail.com Signed-off-by: Jakub Kicinski commit c698f5cc940de5871ea3c65c94f5fd7fbc6844e3 Author: Eric Dumazet Date: Thu Mar 5 11:48:29 2026 +0000 inet_diag: report delayed ack timer information inet_sk_diag_fill() populates r->idiag_timer with the following precedence order: 1 - Retransmit timer. 4 - Probe0 timer. 2 - Keepalive timer. This patch adds a new value, last in the list, if other timers are not active. 5 - Delayed ACK timer. A corresponding iproute2 patch will follow to replace "unknown" with "delack": ESTAB 10 0 [2002:a05:6830:1f86::]:12875 [2002:a05:6830:1f85::]:50438 timer:(unknown,003ms,0) ino:152178 sk:3004 cgroup:unreachable:189 <-> skmem:(r1344,rb12780520,t0,tb262144,f2752,w0,o250,bl0,d0) ts usec_ts ... Also add the following enum in uapi/linux/inet_diag.h as suggested by David Ahern. enum { IDIAG_TIMER_OFF, IDIAG_TIMER_ON, IDIAG_TIMER_KEEPALIVE, IDIAG_TIMER_TIMEWAIT, IDIAG_TIMER_PROBE0, IDIAG_TIMER_DELACK, }; Neal Cardwell suggested to test for ICSK_ACK_TIMER: inet_csk_clear_xmit_timer() does not call sk_stop_timer() because INET_CSK_CLEAR_TIMERS is unset. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Neal Cardwell Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260305114829.2163276-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit db29970799e499b88fea048d8a3ad81bd95672c9 Merge: 507ccb668f2db1 e4fd855c52ec5a Author: Jakub Kicinski Date: Fri Mar 6 15:39:12 2026 -0800 Merge branch 'net-stmmac-mdio-related-cleanups' Russell King says: ==================== net: stmmac: mdio related cleanups The first four patches clean up the MDC clock divisor selection code, turning the three different ways we choose a divisor into tabular form, rather than doing the selection purely in code. Convert MDIO to use field_prep() which allows a non-constant mask to be used when preparing fields. Then use u32 and the associated typed GENMASK for MDIO register field definitions. Finally, an extra couple of patches that use appropriate types in struct mdio_bus_data. ==================== Link: https://patch.msgid.link/aald--qJquWGIvmO@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e4fd855c52ec5af34d920206190be29919fadca3 Author: Russell King (Oracle) Date: Thu Mar 5 10:43:02 2026 +0000 net: stmmac: make pcs_mask and phy_mask u32 The PCS and PHY masks are passed to the mdio bus layer as phy_mask to prevent bus addresses between 0 and 31 inclusive being scanned, and this is declared as u32. Also declare these as u32 in stmmac for type consistency. Since this is a u32, use BIT_U32() rather than BIT() to generate values for these fields. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/E1vy6AY-0000000BtxJ-3smT@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3cd963fa915c494a6d0da0287bd10cb6f2204f9e Author: Russell King (Oracle) Date: Thu Mar 5 10:42:57 2026 +0000 net: stmmac: mdio_bus_data->default_an_inband is boolean default_an_inband is declared as an unsigned int, but is set to true/ false and is assigned to phylink_config's member of the same name which is a bool. Declare this also as a bool for consistency. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/E1vy6AT-0000000BtxD-2qm7@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a64d927aecf17827a02976fef8ba7b7b04a4b26f Author: Russell King (Oracle) Date: Thu Mar 5 10:42:52 2026 +0000 net: stmmac: use GENMASK_U32() for mdio bitfields Rather than using hex numbers, use GENMASK() for mdio bitfields. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/E1vy6AO-0000000Btx7-2NDV@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit df388b4d3913fe2bb1356355ffadb126f70f82d1 Author: Russell King (Oracle) Date: Thu Mar 5 10:42:47 2026 +0000 net: stmmac: use u32 for MDIO register field masks MDIO registers are 32-bit, so use u32 to describe the masks for these registers. Convert the GENMASK() initialisers to GENMASK_U32() for type compatibility. Signed-off-by: Russell King (Oracle) Tested-by: Maxime Chevallier Link: https://patch.msgid.link/E1vy6AJ-0000000Btx1-1teC@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 58bd0039002ba58019138608de4f2a3041ae0026 Author: Russell King (Oracle) Date: Thu Mar 5 10:42:42 2026 +0000 net: stmmac: mdio: convert field prep to use field_prep() Convert the MDIO field preparation to use field_prep(), which removes the need to store separate mask and shifts. Also convert the clk_csr value using __ffs() to do the shift as we need to detect overflows for this. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/E1vy6AE-0000000Btwv-1LM4@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 506f78f43c58094009b2d62ed0f8070bb4635954 Author: Russell King (Oracle) Date: Thu Mar 5 10:42:37 2026 +0000 net: stmmac: mdio: simplify MDC clock divisor lookup As each lookup now iterates over each table in the same way, simplfy the code to select the table, and then walk that table. Signed-off-by: Russell King (Oracle) Tested-by: Maxime Chevallier Link: https://patch.msgid.link/E1vy6A9-0000000Btwp-0lxY@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b6687ef976036d3a3e672384f47de5742b2574c7 Author: Russell King (Oracle) Date: Thu Mar 5 10:42:32 2026 +0000 net: stmmac: mdio: use same test for MDC clock divisor lookups Use the same frequency test for all clk_csr value lookups (clock rate > table rate). This has the side effect that the standard rate table results in the divider being used for the maximum frequency for the divider rather than the next higher divider. This still allows MDC to meet the IEE 802.3 specification, but at a rate closer to 2.5MHz for these frequencies. Signed-off-by: Russell King (Oracle) Tested-by: Maxime Chevallier Link: https://patch.msgid.link/E1vy6A4-0000000Btwj-0ATB@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 4c7e0e081889be876e2d9ee23332c75b6207d5eb Author: Russell King (Oracle) Date: Thu Mar 5 10:42:26 2026 +0000 net: stmmac: mdio: convert MDC clock divisor selection to tables Convert the MDC clock divisor selection to tabular format. Note that there is a change for 300MHz, but this is not a problem, as the MDC clock remains within the useable ranges, which are: STMMAC_CSR_500_800M /324 1.54 - 2.47MHz STMMAC_CSR_300_500M /204 1.47 - 2.45MHz STMMAC_CSR_250_300M /124 2.02 - 2.42MHz STMMAC_CSR_150_250M /102 1.47 - 2.45MHz STMMAC_CSR_100_150M /62 1.61 - 2.42MHz STMMAC_CSR_60_100M /42 1.43 - 2.38MHz STMMAC_CSR_35_60M /26 1.35 - 2.31MHz STMMAC_CSR_20_35M /16 1.25 - 2.19MHz Thus, with the change of divisor for exactly 300MHz, MDC temporarily changes from 2.42MHz to 1.47MHz for the sake of consistency. The databook does not specify whether the frequency limits for the CSR divider are inclusive or exclusive. Signed-off-by: Russell King (Oracle) Tested-by: Maxime Chevallier Link: https://patch.msgid.link/E1vy69y-0000000Btwd-3oq7@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 507ccb668f2db1377defdc54068eab3398bd5974 Author: Dragos Tatulea Date: Thu Mar 5 10:04:45 2026 +0200 selftests: drv-net: iou-zcrx: wait for memory cleanup of probe run The large chunks test does a probe run of iou-zcrx before it runs the actual test. After the probe run finishes, the context will still exist until the deferred io_uring teardown. When running iou-zcrx the second time, io_uring_register_ifq() can return -EEXIST due to the existence of the old context. The fix is simple: wait for the context teardown using the new mp_clear_wait() utility before running the second instance of iou-zcrx. Signed-off-by: Dragos Tatulea Link: https://patch.msgid.link/20260305080446.897628-2-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski commit e8a6e92285ba41f7870b8ac9a272b184b8301982 Author: Raag Jadav Date: Tue Mar 3 15:49:13 2026 +0530 drm/xe/migrate: Refactor xe_migrate_prepare_vm() Currently xe_migrate_prepare_vm() does three things. 1. Allocates pt_bo for migrate context. 2. Initializes pt_bo with actual pte details. 3. Initializes sa_manager for migrate context. Split these implementations in their own functions for better maintainability. Signed-off-by: Raag Jadav Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260303101913.3576481-1-raag.jadav@intel.com Signed-off-by: Matt Roper commit eb2e7f20c1473f9153088d564471dc0226530824 Author: Sunil Khatri Date: Fri Mar 6 16:45:14 2026 +0530 drm/amdgpu: push userq debugfs function in amdgpu_debugfs files Debugfs files for amdgpu are better to be handled in the dedicated amdgpu_debugfs.c/.h files. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit a07930e4db4ceecb22f5ae63c97ed09c020844f8 Author: Sunil Khatri Date: Fri Mar 6 12:24:29 2026 +0530 drm/amdgpu/userq: declutter the code with goto Clean up the amdgpu_userq_create function clean up in failure condition using goto method. This avoid replication of cleanup for every failure condition. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 28cacaace5cde8318b7da967b3955a73cc6de91a Author: Sunil Khatri Date: Wed Mar 4 00:38:06 2026 +0530 drm/amdgpu/userq: defer queue publication until create completes The userq create path publishes queues to global xarrays such as userq_doorbell_xa and userq_xa before creation was fully complete. Later on if create queue fails, teardown could free an already visible queue, opening a UAF race with concurrent queue walkers. Also calling amdgpu_userq_put in such cases complicates the cleanup. Solution is to defer queue publication until create succeeds and no partially initialized queue is exposed. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 421c0f19043337a553e802b2dfe4b56d538ef4d6 Author: David Francis Date: Fri Jan 16 10:21:15 2026 -0500 drm/amdgpu: Check for multiplication overflow in checkpoint stack size get_checkpoint_info() in kfd_mqd_manager_v9.c finds 32-bit value ctl_stack_size by multiplying two 32-bit values. This can overflow to a lower value, which could result in copying outside the bounds of a buffer in checkpoint_mqd() in the same file. Put in a check for the overflow, and fail with -EINVAL if detected. v2: use check_mul_overflow() Signed-off-by: David Francis Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 8c78845bf9b18d336e5b5d00c966176a3c3f9581 Author: Sunil Khatri Date: Fri Mar 6 12:53:30 2026 +0530 drm/amdkfd: fix the warning for potential insecure string Below is the warning thrown by the clang compiler: linux/drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c:588:9: warning: format string is not a string literal (potentially insecure) [-Wformat-security] stats_dir_filename); ^~~~~~~~~~~~~~~~~~ linux/drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c:588:9: note: treat the string as an argument to avoid this stats_dir_filename); ^ "%s", linux/drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c:635:18: warning: format string is not a string literal (potentially insecure) [-Wformat-security] p->kobj, counters_dir_filename); ^~~~~~~~~~~~~~~~~~~~~ linux/drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c:635:18: note: treat the string as an argument to avoid this p->kobj, counters_dir_filename); ^ "%s", Signed-off-by: Sunil Khatri CC: Philip Yang CC: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 210fa907a64496af6341c3455cb267d2b68dfb12 Author: Sunil Khatri Date: Fri Mar 6 16:48:02 2026 +0530 drm/amdgpu: fix warning for potentially insecure string linux/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:2358:24: warning: format string is not a string literal (potentially insecure) [-Wformat-security] sprintf(ring->name, amdgpu_sw_ring_name(i)); ^~~~~~~~~~~~~~~~~~~~~~ linux/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:2358:24: note: treat the string as an argument to avoid this sprintf(ring->name, amdgpu_sw_ring_name(i)); Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 79b7209c9c61584e8584f8bfe8d259e202fe7107 Author: Asad Kamal Date: Tue Mar 3 15:11:00 2026 +0800 drm/amd/pm: Enable aid/xcd/hbm temperature reporting Enable aid/xcd/hbm temperature reporting for smu_v13_0_12 via gpu metrics Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 281108ad1e2d75216e29d8c9877a7bb32839659d Author: Asad Kamal Date: Mon Mar 2 18:26:55 2026 +0800 drm/amd/pm: Add aid/xcd/hbm temperatures Add aid, xcd & hbm temperatures to gpu metrics for smu_v13_0_12 v2: Use correct umc control per stack (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit e81eff80aad6c04ff1d7c1bf6412de17e717bd76 Author: Pierre-Eric Pelloux-Prayer Date: Tue Dec 2 14:27:24 2025 +0100 drm/amdgpu: include ip discovery data in devcoredump This is the best way to describe the GPU to a tool loading the devcoredump. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 4e22a5fe6ea6e0b057e7f246df4ac3ff8bfbc46a Author: Yang Wang Date: Wed Mar 4 18:45:45 2026 -0500 drm/amdgpu: fix gpu idle power consumption issue for gfx v12 Older versions of the MES firmware may cause abnormal GPU power consumption. When performing inference tasks on the GPU (e.g., with Ollama using ROCm), the GPU may show abnormal power consumption in idle state and incorrect GPU load information. This issue has been fixed in firmware version 0x8b and newer. Closes: https://github.com/ROCm/ROCm/issues/5706 Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit ec5708d6e547f7efe2f009073bfa98dbc4c5c2ac Author: Cristian Ciocaltea Date: Thu Mar 5 13:16:36 2026 +0200 drm/amdgpu: Fix kernel-doc comments for some LUT properties The following members of struct amdgpu_mode_info do not have valid references in the related kernel-doc sections: - plane_shaper_lut_property - plane_shaper_lut_size_property, - plane_lut3d_size_property Correct all affected comment blocks. Fixes: f545d82479b4 ("drm/amd/display: add plane shaper LUT and TF driver-specific properties") Fixes: 671994e3bf33 ("drm/amd/display: add plane 3D LUT driver-specific properties") Reviewed-by: Melissa Wen Signed-off-by: Cristian Ciocaltea Signed-off-by: Alex Deucher commit 71036457ad85a5b08e5101738c4803a45b4e1555 Author: Joshua Peisach Date: Tue Mar 3 16:18:23 2026 -0500 drm/amdgpu/amdgpu_connectors: remove amdgpu_connector_free_edid Now that we are using struct drm_edid, we can just call drm_edid_free directly. Remove the function and update calls to drm_edid_free. Signed-off-by: Joshua Peisach Signed-off-by: Alex Deucher commit 9f0e7b5177a452be7a3740128eaa9c23e6660ab9 Author: Joshua Peisach Date: Tue Mar 3 16:18:22 2026 -0500 drm/amdgpu/amdgpu_connectors: use struct drm_edid instead of struct edid Some amdgpu code is still using deprecated edid functions. Switch to the newer functions and update the amdgpu_connector struct's edid type to the drm_edid type. At the same time, use the raw EDID when we need to for speaker allocations and for determining if the input is digital. Signed-off-by: Joshua Peisach Signed-off-by: Alex Deucher commit 829f21e90d1982c1b5674828f4e0b9424f345921 Author: Alex Deucher Date: Wed Jan 28 14:50:31 2026 -0500 drm/amdgpu/gfx12.1: add support for disable_kq Plumb in support for disabling kernel queues and make it the default. For testing, kernel queues can be re-enabled by setting amdgpu.user_queue=0 v2: integrate feedback from Lijo Acked-by: Lijo Lazar Signed-off-by: Alex Deucher commit f5a05f8414fc10f307eb965f303580c7778f8dd2 Author: Mario Limonciello Date: Thu Mar 5 09:06:11 2026 -0600 drm/amd: Fix a few more NULL pointer dereference in device cleanup I found a few more paths that cleanup fails due to a NULL version pointer on unsupported hardware. Add NULL checks as applicable. Fixes: 39fc2bc4da00 ("drm/amdgpu: Protect GPU register accesses in powergated state in some paths") Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 0b78bb6e6534d3b3bdd849e899fdd17b7f609d04 Author: Alex Deucher Date: Wed Mar 4 10:06:04 2026 -0500 drm/amdgpu: gfx 12.1 cleanups Remove some remnants from when the code was forked from gfx 12.0. Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 7ba5286aad4e670b64053d64c04dfdf575594692 Author: Thomas Zimmermann Date: Wed Mar 4 13:58:39 2026 +0100 drm/radeon: Test for fbdev GEM object with generic helper Replace radeon's test for the fbdev GEM object with a call to the generic helper. Reviewed-by: Alex Deucher Signed-off-by: Thomas Zimmermann Signed-off-by: Alex Deucher commit 1837c76b780a4201e3d9f718e17c09b536df700f Author: Thomas Zimmermann Date: Wed Mar 4 13:58:38 2026 +0100 drm/amdgpu: Move test for fbdev GEM object into generic helper Provide a generic helper that tests if fbdev emulation is backed by a specific GEM object. Not all drivers use client buffers (yet), hence also test against the first GEM object in the fbdev framebuffer. Convert amdgpu. The helper will also be useful for radeon. Reviewed-by: Alex Deucher Signed-off-by: Thomas Zimmermann Signed-off-by: Alex Deucher commit 1b5cf07d80bb16d1593579ccdb23f08ea4262c14 Author: Yang Wang Date: Tue Mar 3 21:14:10 2026 -0500 drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14 add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14.0.2/14.0.3 Fixes: 9710b84e2a6a ("drm/amd/pm: add overdrive support on smu v14.0.2/3") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5018 Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit a978ed3d6454e4aa1a2ac74051ffd77b7d263e44 Author: Sunil Khatri Date: Tue Mar 3 22:30:04 2026 +0530 drm/amdgpu/userq: remove queue from doorbell xa during clean up If function amdgpu_userq_map_helper fails we do need to clean up and remove the queue from the userq_doorbell_xa. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit f0e46fd06c3f7590b0f06aea3c877f441c2cbccc Author: Sunil Khatri Date: Tue Mar 3 22:25:57 2026 +0530 drm/amdgpu/userq: remove queue from doorbell xarray In case of failure in xa_alloc, remove the queue during clean up from the userq_doorbell_xa. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit b7ac77468cda92eecae560b05f62f997a12fe2f2 Author: Mario Limonciello Date: Wed Mar 4 14:07:40 2026 -0600 drm/amd: Fix NULL pointer dereference in device cleanup When GPU initialization fails due to an unsupported HW block IP blocks may have a NULL version pointer. During cleanup in amdgpu_device_fini_hw, the code calls amdgpu_device_set_pg_state and amdgpu_device_set_cg_state which iterate over all IP blocks and access adev->ip_blocks[i].version without NULL checks, leading to a kernel NULL pointer dereference. Add NULL checks for adev->ip_blocks[i].version in both amdgpu_device_set_cg_state and amdgpu_device_set_pg_state to prevent dereferencing NULL pointers during GPU teardown when initialization has failed. Fixes: 39fc2bc4da00 ("drm/amdgpu: Protect GPU register accesses in powergated state in some paths") Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 576a10797b607ee9e4068218daf367b481564120 Author: Yang Wang Date: Tue Mar 3 21:10:11 2026 -0500 drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v13 add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v13.0.0/13.0.7 Fixes: cfffd980bf21 ("drm/amd/pm: add zero RPM OD setting support for SMU13") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5018 Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 1a9940317c1b46b7641af6b4b14c9d2509ac88b2 Author: Heiner Kallweit Date: Thu Mar 5 18:42:04 2026 +0100 Revert "net: phy: improve mdiobus_stats_acct" This reverts commit 1afccc5a201ec7c9023370958bae1312369b64da. As reported by Marek the change causes a warning on non-PREEMPT_RT 32 bit systems. Reported-by: Marek Szyprowski Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/c3a1aba9-3fae-4c4b-bcb1-fb620fb7a309@gmail.com Signed-off-by: Jakub Kicinski commit 8e235bc43326f47adfd77d926c7d6ad39077569a Author: Jakub Kicinski Date: Wed Mar 4 07:16:46 2026 -0800 docs: netdev: refine netdevsim testing guidance The library to create tests for both NIC HW and netdevsim has existed for almost a year. netdevsim-only tests we get increasingly feel like a waste, we should try to write tests that work both on netdevsim and real HW. Refine the guidance accordingly. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260304151647.2770466-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 13f0dd7ed1e1ebc8561efe23a3ab11b26fafc1aa Merge: e5e09233e8a917 37d24994a7a0ad Author: Jakub Kicinski Date: Fri Mar 6 13:11:21 2026 -0800 Merge branch 'selftests-net-add-netkit-container-env-and-test' David Wei says: ==================== selftests/net: add netkit container env and test Add a new Python selftest env NetDrvContEnv that sets up a pair of netkit netdevs, with one inside of a netns, and a bpf prog that forwards skbs from NETIF to the netkit inside the netns. NETIF = "eth0" LOCAL_V6 = "2001:db8:1::1" REMOTE_V6 = "2001:db8:1::2" LOCAL_PREFIX_V6 = "2001:db8:2::0/64" +-----------------------------+ +------------------------------+ dst | INIT NS | | TEST NS | 2001: | +---------------+ | | | db8:2::2| | NETIF | | bpf | | +---|>| 2001:db8:1::1 | |redirect| +-------------------------+ | | | | |-----------|--------|>| Netkit | | | | +---------------+ | _peer | | nk_guest | | | | +-------------+ Netkit pair | | | fe80::2/64 | | | | | Netkit |.............|........|>| 2001:db8:2::2/64 | | | | | nk_host | | | +-------------------------+ | | | | fe80::1/64 | | | | | | +-------------+ | | route: | | | | | default | | | route: | | via fe80::1 dev nk_guest | | | 2001:db8:2::2/128 | +------------------------------+ | | via fe80::2 dev nk_host | | +-----------------------------+ | | +---------------+ | | REMOTE | +---| 2001:db8:1::2 | +---------------+ I will use this series for queue leasing selftests. Include a basic ping test in this series as demonstration. ==================== Link: https://patch.msgid.link/20260305181803.2912736-1-dw@davidwei.uk Signed-off-by: Jakub Kicinski commit 37d24994a7a0ad777c80e2b90c3a4a528753d70d Author: David Wei Date: Thu Mar 5 10:18:03 2026 -0800 selftests/net: Add netkit container ping test Add a basic ping test using NetDrvContEnv that sets up a netkit pair, with one end in a netns. Use LOCAL_PREFIX_V6 and nk_forward BPF program to ping from a remote host to the netkit in netns. Signed-off-by: David Wei Signed-off-by: Daniel Borkmann Link: https://patch.msgid.link/20260305181803.2912736-5-dw@davidwei.uk Signed-off-by: Jakub Kicinski commit 3f74d5bb807ee500cb68f167df7dc4e4252a42ec Author: David Wei Date: Thu Mar 5 10:18:02 2026 -0800 selftests/net: Add env for container based tests Add an env NetDrvContEnv for container based selftests. This automates the setup of a netns, netkit pair with one inside the netns, and a BPF program that forwards skbs from the NETIF host inside the container. Currently only netkit is used, but other virtual netdevs e.g. veth can be used too. Expect netkit container datapath selftests to have a publicly routable IP prefix to assign to netkit in a container, such that packets will land on eth0. The BPF skb forward program will then forward such packets from the host netns to the container netns. Signed-off-by: David Wei Signed-off-by: Daniel Borkmann Link: https://patch.msgid.link/20260305181803.2912736-4-dw@davidwei.uk Signed-off-by: Jakub Kicinski commit 68ab8ba927758d77439785661f1f8b2a47318c5a Author: David Wei Date: Thu Mar 5 10:18:01 2026 -0800 selftests/net: Export Netlink class via lib.py Making rtnl newlink calls requires constants defined in Netlink class in pyynl. Export it. Signed-off-by: David Wei Link: https://patch.msgid.link/20260305181803.2912736-3-dw@davidwei.uk Signed-off-by: Jakub Kicinski commit 01748996f649d3de1c6ce08c829662d56bfd281b Author: David Wei Date: Thu Mar 5 10:18:00 2026 -0800 selftests/net: Add bpf skb forwarding program Add nk_forward.bpf.c, a BPF program that forwards skbs matching some IPv6 prefix received on eth0 ifindex to a specified netkit ifindex. This will be needed by netkit container tests. Signed-off-by: David Wei Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260305181803.2912736-2-dw@davidwei.uk Signed-off-by: Jakub Kicinski commit 8e0ab5b9adb7fec3149441621df1cf15325b7215 Author: Gustavo A. R. Silva Date: Tue Feb 24 13:46:17 2026 +0900 wifi: ath6kl: wmi: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Remove unused structures bss_bias_info and bss_bias, and member bss in struct roam_ctrl_cmd. After these changes, the size of struct roam_ctrl_cmd, along with its member's offsets remain the same, hence the memory layout doesn't change: Before changes: struct roam_ctrl_cmd { union { u8 bssid[6]; /* 0 6 */ u8 roam_mode; /* 0 1 */ struct bss_bias_info bss; /* 0 1 */ struct low_rssi_scan_params params; /* 0 8 */ } info; /* 0 8 */ u8 roam_ctrl; /* 8 1 */ /* size: 9, cachelines: 1, members: 2 */ /* last cacheline: 9 bytes */ } __attribute__((__packed__)); After changes: struct roam_ctrl_cmd { union { u8 bssid[6]; /* 0 6 */ u8 roam_mode; /* 0 1 */ struct low_rssi_scan_params params; /* 0 8 */ } info; /* 0 8 */ u8 roam_ctrl; /* 8 1 */ /* size: 9, cachelines: 1, members: 2 */ /* last cacheline: 9 bytes */ } __attribute__((__packed__)); With these changes fix the following warning: drivers/net/wireless/ath/ath6kl/wmi.h:1658:20: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Link: https://patch.msgid.link/aZ0tGZnmtGckKJzY@kspp Signed-off-by: Jeff Johnson commit 616217a989e09c55398db8555e5ef0c64504cb66 Author: P Praneesh Date: Mon Feb 9 11:19:24 2026 +0530 wifi: ath12k: Fix legacy rate mapping for monitor mode capture The current implementation incorrectly reports legacy CCK and OFDM rates in monitor mode radiotap headers. The rate field displays wrong values, for example showing 11 Mbps when the actual rate is 1 Mbps. This occurs because the HAL layer uses a unified enum for both CCK and OFDM rates without distinguishing between long/short preamble variants and proper rate mapping to hardware rate indices. The root cause is threefold: 1. The hal_rx_legacy_rate enum conflates CCK and OFDM rates into a single enumeration, making it impossible to differentiate between 802.11b CCK rates (with long/short preamble variants) and 802.11a/g OFDM rates. 2. The L-SIG-B parsing function maps hardware rate values to the wrong enum values. For CCK rates, it incorrectly combines long and short preamble cases (e.g., cases 2 and 5 both map to 2 Mbps), losing preamble information critical for proper rate identification. 3. The mac layer's rate-to-index conversion function does not properly handle the precedence between long preamble, short preamble, and OFDM rates when matching hardware rate values. Split the hal_rx_legacy_rate enum into two separate enumerations: hal_rx_legacy_rate for CCK rates with explicit long preamble (LP) and short preamble (SP) variants, and hal_rx_legacy_rates_ofdm for OFDM rates. This separation allows proper identification of rate types and preamble modes. Introduce a new mapping ath12k_wifi7_hal_mon_map_legacy_rate_to_hw_rate() that converts HAL CCK rate enums to hardware rate indices defined in ath12k_hw_rate_cck. This ensures the rate field in ppdu_info contains the correct hardware rate index that matches the mac layer's expectations. Update the L-SIG-B parsing to map each hardware rate value (1-7) to its corresponding CCK rate enum with proper preamble designation: - Cases 1-4: Long preamble (1, 2, 5.5, 11 Mbps) - Cases 5-7: Short preamble (2, 5.5, 11 Mbps) Update the L-SIG-A parsing to use the new OFDM-specific enum values, maintaining the existing rate mapping for 802.11a/g OFDM rates. Refactor the mac layer's ath12k_mac_hw_rate_to_idx() function to implement proper matching precedence: 1. First match OFDM rates using the IEEE80211_RATE_MANDATORY_A flag 2. Then match CCK short preamble rates 3. Finally match CCK long preamble rates as fallback Add helper macros ATH12K_MAC_RATE_A_M and ATH12K_MAC_RATE_B to improve readability of the rate table initialization and ensure the mandatory flag is set for OFDM rates. This fix ensures monitor mode captures display accurate rate information in the radiotap header, correctly distinguishing between 1 Mbps and 11 Mbps, and properly identifying preamble types for CCK rates. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01181-QCAHKSWPL_SILICONZ-1 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: P Praneesh Signed-off-by: Thiraviyam Mariyappan Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260209054924.2713072-1-thiraviyam.mariyappan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit aecb569d7fb689e3e5b0005ca7bd0a2ef28915e8 Author: Manish Dharanenthiran Date: Thu Feb 26 09:49:11 2026 +0530 wifi: ath12k: Fix the assignment of logical link index Per-link logical index is assigned from the global counter, ahsta->num_peer. This logical index is sent to firmware during peer association. If there is a failure in creating a link station, ath12k_mac_free_unassign_link_sta() clears the link, but does not decrement the logical link index. This will result in a higher logical link index for the next link station created. Also, if there is a leak in logical link index as we assign the incremented num_peer, then the index can exceed the maximum valid value of 15. As an example, let's say we have a 2 GHz + 5 GHz + 6 GHz MLO setup. So the logical link indices that they have are 0, 1 and 2, respectively. If the 5 GHz link is removed, logical link index 1 becomes available, and num_peer is not reduced to 2 and still remains at 3. If a new 5 GHz link is added later, it gets the index 3, instead of reusing link index 1. Also, num_peer is increased to 4, though only 3 links are present. To resolve these, create a bitmap, free_logical_link_idx, that tracks the available logical link indices. When a link station is created, select the first free logical index and when a link station is removed, mark its logical link index as available by setting the bit. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01181-QCAHKSWPL_SILICONZ-1 Signed-off-by: Manish Dharanenthiran Signed-off-by: Roopni Devanathan Reviewed-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260226041911.2434999-1-roopni.devanathan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 1635ecc61a24597f893d057d004051a535c1c643 Author: Sarika Sharma Date: Thu Feb 26 10:49:47 2026 +0530 wifi: ath12k: account TX stats only when ACK/BA status is present The fields tx_retry_failed, tx_retry_count, and tx_duration are currently updated outside the HTT_PPDU_STATS_TAG_USR_COMPLTN_ACK_BA_STATUS flag check. In certain scenarios, firmware delivers multiple PPDU statistics for the same PPDU, first without BA/ACK information, and later with BA/ACK status once it becomes available. As the same PPDU is processed again, these counters are updated a second time, resulting in duplicate TX statistics. To address this, move the accounting of tx_retry_failed and tx_retry_count under the ACK/BA status flag check, and similarly gate tx_duration on the same path. This ensures that each PPDU contributes to these counters exactly once, avoids double counting, and provides consistent reporting in userspace tools such as station dump. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 Fixes: a0b963e1da5b ("wifi: ath12k: fetch tx_retry and tx_failed from htt_ppdu_stats_user_cmpltn_common_tlv") Signed-off-by: Sarika Sharma Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260226051947.1379716-1-sarika.sharma@oss.qualcomm.com Signed-off-by: Jeff Johnson commit b458597544c20c31cef9d907696e8b9652b0894e Author: Vinay Belgaumkar Date: Tue Mar 3 10:14:16 2026 -0800 drm/xe: Don't disable GuCRC in suspend path GuCRC should not be disabled in xe_guc_stop_prepare() as C6 is a prerequisite for s0ix and s2idle. This is a regression caused by the patch below. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7510 Fixes: 40a684f91d26 ("drm/xe: Decouple GuC RC code from xe_guc_pc") Cc: Riana Tauro Signed-off-by: Vinay Belgaumkar Reviewed-by: Riana Tauro Link: https://patch.msgid.link/20260303181416.3880937-1-vinay.belgaumkar@intel.com commit 022eec206a32c985f096ccc79894dad50dcf04f6 Author: Thorsten Blum Date: Mon Feb 23 22:03:51 2026 +0100 cpufreq: governor: Use sysfs_emit() in sysfs show functions Replace sprintf() with sysfs_emit() in sysfs show functions. sysfs_emit() is preferred for formatting sysfs output because it provides safer bounds checking. No functional changes. Signed-off-by: Thorsten Blum Acked-by: Viresh Kumar [ rjw: Subject tweak ] Link: https://patch.msgid.link/20260223210351.344388-2-thorsten.blum@linux.dev Signed-off-by: Rafael J. Wysocki commit 6acae3c8332f3125e331f2d896bef994d4460376 Author: Fabio M. De Francesco Date: Thu Feb 19 19:15:55 2026 +0100 cpufreq: intel_pstate: Allow repeated intel_pstate disable Repeated intel_pstate disables currently return an error, adding unnecessary complexity to userspace scripts which must first read the current state and conditionally write 'off'. Make repeated intel_pstate disables a no-op. Signed-off-by: Fabio M. De Francesco Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260219181600.16388-1-fabio.m.de.francesco@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 4f8b122848dbc353a193de0fa707bc40b5f067ff Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Add basic building blocks for nested sub-scheduler dispatching This is an early-stage partial implementation that demonstrates the core building blocks for nested sub-scheduler dispatching. While significant work remains in the enqueue path and other areas, this patch establishes the fundamental mechanisms needed for hierarchical scheduler operation. The key building blocks introduced include: - Private stack support for ops.dispatch() to prevent stack overflow when walking down nested schedulers during dispatch operations - scx_bpf_sub_dispatch() kfunc that allows parent schedulers to trigger dispatch operations on their direct child schedulers - Proper parent-child relationship validation to ensure dispatch requests are only made to legitimate child schedulers - Updated scx_dispatch_sched() to handle both nested and non-nested invocations with appropriate kf_mask handling The qmap scheduler is updated to demonstrate the functionality by calling scx_bpf_sub_dispatch() on registered child schedulers when it has no tasks in its own queues. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 25037af712eb04eb92a89440852029a50eea8d82 Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Add rhashtable lookup for sub-schedulers Add rhashtable-based lookup for sub-schedulers indexed by cgroup_id to enable efficient scheduler discovery in preparation for multiple scheduler support. The hash table allows quick lookup of the appropriate scheduler instance when processing tasks from different cgroups. This extends scx_link_sched() to register sub-schedulers in the hash table and scx_unlink_sched() to remove them. A new scx_find_sub_sched() function provides the lookup interface. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 54be8de4236a52b301825cb51c6d5fdecb2fd6b8 Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Factor out scx_link_sched() and scx_unlink_sched() Factor out scx_link_sched() and scx_unlink_sched() functions to reduce code duplication in the scheduler enable/disable paths. No functional change. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 0d8c551dd5de1c157600da05a01e3147115dfbb4 Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Make scx_bpf_reenqueue_local() sub-sched aware scx_bpf_reenqueue_local() currently re-enqueues all tasks on the local DSQ regardless of which sub-scheduler owns them. With multiple sub-schedulers, each should only re-enqueue tasks it owns or are owned by its descendants. Replace the per-rq boolean flag with a lock-free linked list to track per-scheduler reenqueue requests. Filter tasks in reenq_local() using hierarchical ownership checks and block deferrals during bypass to prevent use on dead schedulers. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 7f5fcd47dd62ba7e150468ca05d30bfd26feb306 Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Add scx_sched back pointer to scx_sched_pcpu Add a back pointer from scx_sched_pcpu to scx_sched. This will be used by the next patch to make scx_bpf_reenqueue_local() sub-sched aware. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 337ec00b1d9c676f637651c2cefddb8612b867ee Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Implement cgroup sub-sched enabling and disabling The preceding changes implemented the framework to support cgroup sub-scheds and updated scheduling paths and kfuncs so that they have minimal but working support for sub-scheds. However, actual sub-sched enabling/disabling hasn't been implemented yet and all tasks stayed on scx_root. Implement cgroup sub-sched enabling and disabling to actually activate sub-scheds: - Both enable and disable operations bypass only the tasks in the subtree of the child being enabled or disabled to limit disruptions. - When enabling, all candidate tasks are first initialized for the child sched. Once that succeeds, the tasks are exited for the parent and then switched over to the child. This adds a bit of complication but guarantees that child scheduler failures are always contained. - Disabling works the same way in the other direction. However, when the parent may fail to initialize a task, disabling is propagated up to the parent. While this means that a parent sched fail due to a child sched event, the failure can only originate from the parent itself (its ops.init_task()). The only effect a malfunctioning child can have on the parent is attempting to move the tasks back to the parent. After this change, although not all the necessary mechanisms are in place yet, sub-scheds can take control of their tasks and schedule them. v2: Fix missing scx_cgroup_unlock()/percpu_up_write() in abort path (Cheng-Yang Chou). Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 9276b7ccb2202f1c2324e4346d12fd6df166c747 Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Support dumping multiple schedulers and add scheduler identification Extend scx_dump_state() to support multiple schedulers and improve task identification in dumps. The function now takes a specific scheduler to dump and can optionally filter tasks by scheduler. scx_dump_task() now displays which scheduler each task belongs to, using "*" to mark tasks owned by the scheduler being dumped. Sub-schedulers are identified with their level and cgroup ID. The SysRq-D handler now iterates through all active schedulers under scx_sched_lock and dumps each one separately. For SysRq-D dumps, only tasks owned by each scheduler are dumped to avoid redundancy since all schedulers are being dumped. Error-triggered dumps continue to dump all tasks since only that specific scheduler is being dumped. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit eff782fddb5cb03c247fdb68b148abfd30cda1fe Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Convert scx_dump_state() spinlock to raw spinlock The scx_dump_state() function uses a regular spinlock to serialize access. In a subsequent patch, this function will be called while holding scx_sched_lock, which is a raw spinlock, creating a lock nesting violation. Convert the dump_lock to a raw spinlock and use the guard macro for cleaner lock management. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit cde94c032b32be773ef05db9847be6f02fb123f0 Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Make watchdog sub-sched aware Currently, the watchdog checks all tasks as if they are all on scx_root. Move scx_watchdog_timeout inside scx_sched and make check_rq_for_timeouts() use the timeout from the scx_sched associated with each task. refresh_watchdog() is added, which determines the timer interval as half of the shortest watchdog timeouts of all scheds and arms or disarms it as necessary. Every scx_sched instance has equivalent or better detection latency while sharing the same timer. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 34ecfb355104c29734c124b35ffd598a49e62156 Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Move scx_dsp_ctx and scx_dsp_max_batch into scx_sched scx_dsp_ctx and scx_dsp_max_batch are global variables used in the dispatch path. In prepration for multiple scheduler support, move the former into scx_sched_pcpu and the latter into scx_sched. No user-visible behavior changes intended. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 0203e0c3f64c6e5b1cb8c28a6661e246feb8043c Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Dispatch from all scx_sched instances The cgroup sub-sched support involves invasive changes to many areas of sched_ext. The overall scaffolding is now in place and the next step is implementing sub-sched enable/disable. To enable partial testing and verification, update balance_one() to dispatch from all scx_sched instances until it finds a task to run. This should keep scheduling working when sub-scheds are enabled with tasks on them. This will be replaced by BPF-driven hierarchical operation. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 025b1bd419653f181c8b9c748aa07802177ff828 Author: Tejun Heo Date: Fri Mar 6 07:58:04 2026 -1000 sched_ext: Implement hierarchical bypass mode When a sub-scheduler enters bypass mode, its tasks must be scheduled by an ancestor to guarantee forward progress. Tasks from bypassing descendants are queued in the bypass DSQs of the nearest non-bypassing ancestor, or the root scheduler if all ancestors are bypassing. This requires coordination between bypassing schedulers and their hosts. Add bypass_enq_target_dsq() to find the correct bypass DSQ by walking up the hierarchy until reaching a non-bypassing ancestor. When a sub-scheduler starts bypassing, all its runnable tasks are re-enqueued after scx_bypassing() is set, ensuring proper migration to ancestor bypass DSQs. Update scx_dispatch_sched() to handle hosting bypassed descendants. When a scheduler is not bypassing but has bypassing descendants, it must schedule both its own tasks and bypassed descendant tasks. A simple policy is implemented where every Nth dispatch attempt (SCX_BYPASS_HOST_NTH=2) consumes from the bypass DSQ. A fallback consumption is also added at the end of dispatch to ensure bypassed tasks make progress even when normal scheduling is idle. Update enable_bypass_dsp() and disable_bypass_dsp() to increment bypass_dsp_enable_depth on both the bypassing scheduler and its parent host, ensuring both can detect that bypass dispatch is active through bypass_dsp_enabled(). Add SCX_EV_SUB_BYPASS_DISPATCH event counter to track scheduling of bypassed descendant tasks. v2: Fix comment typos (Andrea). Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit aa2a0a19686c90106ade6a7e848ffbb62d55d733 Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Separate bypass dispatch enabling from bypass depth tracking The bypass_depth field tracks nesting of bypass operations but is also used to determine whether the bypass dispatch path should be active. With hierarchical scheduling, child schedulers may need to activate their parent's bypass dispatch path without affecting the parent's bypass_depth, requiring separation of these concerns. Add bypass_dsp_enable_depth and bypass_dsp_claim to independently control bypass dispatch path activation. The new enable_bypass_dsp() and disable_bypass_dsp() functions manage this state with proper claim semantics to prevent races. The bypass dispatch path now only activates when bypass_dsp_enabled() returns true, which checks the new enable_depth counter. The disable operation is carefully ordered after all tasks are moved out of bypass DSQs to ensure they are drained before the dispatch path is disabled. During scheduler teardown, disable_bypass_dsp() is called explicitly to ensure cleanup even if bypass mode was never entered normally. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit d94d09a23340b343ffc6ad935f4a7fa90516684a Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: When calling ops.dispatch() @prev must be on the same scx_sched The @prev parameter passed into ops.dispatch() is expected to be on the same sched. Passing in @prev which isn't on the sched can spuriously trigger failures that can kill the scheduler. Pass in @prev iff it's on the same sched. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 39d0b2c43776fc84a27b2fc37cebe89e442aafd8 Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Factor out scx_dispatch_sched() In preparation of multiple scheduler support, factor out scx_dispatch_sched() from balance_one(). The function boundary makes remembering $prev_on_scx and $prev_on_rq less useful. Open code $prev_on_scx in balance_one() and $prev_on_rq in both balance_one() and scx_dispatch_sched(). No functional changes. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit c7f0e467a27a9ee98a324f12b25abf53280d71d0 Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Prepare bypass mode for hierarchical operation Bypass mode is used to simplify enable and disable paths and guarantee forward progress when something goes wrong. When enabled, all tasks skip BPF scheduling and fall back to simple in-kernel FIFO scheduling. While this global behavior can be used as-is when dealing with sub-scheds, that would allow any sub-sched instance to affect the whole system in a significantly disruptive manner. Make bypass state hierarchical by propagating it to descendants and updating per-cpu flags accordingly. This allows an scx_sched to bypass if itself or any of its ancestors are in bypass mode. However, this doesn't make the actual bypass enqueue and dispatch paths hierarchical yet. That will be done in later patches. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 5c8d98a1b4de444709f7d2b7cee3d0ea00c581a2 Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Move bypass state into scx_sched In preparation of multiple scheduler support, make bypass state per-scx_sched. Move scx_bypass_depth, bypass_timestamp and bypass_lb_timer from globals into scx_sched. Move SCX_RQ_BYPASSING from rq to scx_sched_pcpu as SCX_SCHED_PCPU_BYPASSING. scx_bypass() now takes @sch and scx_rq_bypassing(rq) is replaced with scx_bypassing(sch, cpu). All callers updated. scx_bypassed_for_enable existed to balance the global scx_bypass_depth when enable failed. Now that bypass_depth is per-scheduler, the counter is destroyed along with the scheduler on enable failure. Remove scx_bypassed_for_enable. As all tasks currently use the root scheduler, there's no observable behavior change. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit ff06f727a9412b3c9f2f13f1441a5a0d2a31366b Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Move bypass_dsq into scx_sched_pcpu To support bypass mode for sub-schedulers, move bypass_dsq from struct scx_rq to struct scx_sched_pcpu. Add bypass_dsq() helper. Move bypass_dsq initialization from init_sched_ext_class() to scx_alloc_and_attach_sched(). bypass_lb_cpu() now takes a CPU number instead of rq pointer. All callers updated. No behavior change as all tasks use the root scheduler. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit c1743da43cf52caa412413af06eb56a547086c7a Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Move aborting flag to per-scheduler field The abort state was tracked in the global scx_aborting flag which was used to break out of potential live-lock scenarios when an error occurs. With hierarchical scheduling, each scheduler instance must track its own abort state independently so that an aborting scheduler doesn't interfere with others. Move the aborting flag into struct scx_sched and update all access sites. The early initialization check in scx_root_enable() that warned about residual aborting state is no longer needed as each scheduler instance now starts with a clean state. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit e1cccf365ef4b8927d002e424e95fd4e04e2d966 Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Move default slice to per-scheduler field The default time slice was stored in the global scx_slice_dfl variable which was dynamically modified when entering and exiting bypass mode. With hierarchical scheduling, each scheduler instance needs its own default slice configuration so that bypass operations on one scheduler don't affect others. Move slice_dfl into struct scx_sched and update all access sites. The bypass logic now modifies the root scheduler's slice_dfl. At task initialization in init_scx_entity(), use the SCX_SLICE_DFL constant directly since the task may not yet be associated with a specific scheduler. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 41346d68d0aa79a86374c57164c92ce136b6b723 Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Make scx_prio_less() handle multiple schedulers Call ops.core_sched_before() iff both tasks belong to the same scx_sched. Otherwise, use timestamp based ordering. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 073d4f0667b064ed05c19e44d840b0d4cd49a251 Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Refactor task init/exit helpers - Add the @sch parameter to scx_init_task() and drop @tg as it can be obtained from @p. Separate out __scx_init_task() which does everything except for the task state transition. - Add the @sch parameter to scx_enable_task(). Separate out __scx_enable_task() which does everything except for the task state transition. - Add the @sch parameter to scx_disable_task(). - Rename scx_exit_task() to scx_disable_and_exit_task() and separate out __scx_disable_and_exit_task() which does everything except for the task state transition. While some task state transitions are relocated, no meaningful behavior changes are expected. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit bb4d9fd551588165dc918aa2f2108b939e3367db Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: scx_dsq_move() should validate the task belongs to the right scheduler scx_bpf_dsq_move[_vtime]() calls scx_dsq_move() to move task from a DSQ to another. However, @p doesn't necessarily have to come form the containing iteration and can thus be a task which belongs to another scx_sched. Verify that @p is on the same scx_sched as the DSQ being iterated. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 245d09c594ea40dbd4b8f989f2422dbc8e65a61c Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Enforce scheduler ownership when updating slice and dsq_vtime scx_bpf_task_set_slice() and scx_bpf_task_set_dsq_vtime() now verify that the calling scheduler has authority over the task before allowing updates. This prevents schedulers from modifying tasks that don't belong to them in hierarchical scheduling configurations. Direct writes to p->scx.slice and p->scx.dsq_vtime are deprecated and now trigger warnings. They will be disallowed in a future release. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit a5fa0708cbfda4d3c2c6a447de7c4b0b23595527 Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Enforce scheduling authority in dispatch and select_cpu operations Add checks to enforce scheduling authority boundaries when multiple schedulers are present: 1. In scx_dsq_insert_preamble() and the dispatch retry path, ignore attempts to insert tasks that the scheduler doesn't own, counting them via SCX_EV_INSERT_NOT_OWNED. As BPF schedulers are allowed to ignore dequeues, such attempts can occur legitimately during sub-scheduler enabling when tasks move between schedulers. The counter helps distinguish normal cases from scheduler bugs. 2. For scx_bpf_dsq_insert_vtime() and scx_bpf_select_cpu_and(), error out when sub-schedulers are attached. These functions lack the aux__prog parameter needed to identify the calling scheduler, so they cannot be used safely with multiple schedulers. BPF programs should use the arg-wrapped versions (__scx_bpf_dsq_insert_vtime() and __scx_bpf_select_cpu_and()) instead. These checks ensure that with multiple concurrent schedulers, scheduler identity can be properly determined and unauthorized task operations are prevented or tracked. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 105dcd005be2ac1d5541921db8feb1d0f98d59d5 Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Introduce scx_prog_sched() In preparation for multiple scheduler support, introduce scx_prog_sched() accessor which returns the scx_sched instance associated with a BPF program. The association is determined via the special KF_IMPLICIT_ARGS kfunc parameter, which provides access to bpf_prog_aux. This aux can be used to retrieve the struct_ops (sched_ext_ops) that the program is associated with, and from there, the corresponding scx_sched instance. For compatibility, when ops.sub_attach is not implemented (older schedulers without sub-scheduler support), unassociated programs fall back to scx_root. A warning is logged once per scheduler for such programs. As scx_root is still the only scheduler, this shouldn't introduce user-visible behavior changes. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 88234b075c3fc23d57406e1867523b6aba783ebf Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Introduce scx_task_sched[_rcu]() In preparation of multiple scheduler support, add p->scx.sched which points to the scx_sched instance that the task is scheduled by, which is currently always scx_root. Add scx_task_sched[_rcu]() accessors which return the associated scx_sched of the specified task and replace the raw scx_root dereferences with it where applicable. scx_task_on_sched() is also added to test whether a given task is on the specified sched. As scx_root is still the only scheduler, this shouldn't introduce user-visible behavior changes. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit ebeca1f930eac8f11f815d58eb38fa5d07e7c16e Author: Tejun Heo Date: Fri Mar 6 07:58:03 2026 -1000 sched_ext: Introduce cgroup sub-sched support A system often runs multiple workloads especially in multi-tenant server environments where a system is split into partitions servicing separate more-or-less independent workloads each requiring an application-specific scheduler. To support such and other use cases, sched_ext is in the process of growing multiple scheduler support. When partitioning a system in terms of CPUs for such use cases, an oft-taken approach is hard partitioning the system using cpuset. While it would be possible to tie sched_ext multiple scheduler support to cpuset partitions, such an approach would have fundamental limitations stemming from the lack of dynamism and flexibility. Users often don't care which specific CPUs are assigned to which workload and want to take advantage of optimizations which are enabled by running workloads on a larger machine - e.g. opportunistic over-commit, improving latency critical workload characteristics while maintaining bandwidth fairness, employing control mechanisms based on different criteria than on-CPU time for e.g. flexible memory bandwidth isolation, packing similar parts from different workloads on same L3s to improve cache efficiency, and so on. As this sort of dynamic behaviors are impossible or difficult to implement with hard partitioning, sched_ext is implementing cgroup sub-sched support where schedulers can be attached to the cgroup hierarchy and a parent scheduler is responsible for controlling the CPUs that each child can use at any given moment. This makes CPU distribution dynamically controlled by BPF allowing high flexibility. This patch adds the skeletal sched_ext cgroup sub-sched support: - sched_ext_ops.sub_cgroup_id and .sub_attach/detach() are added. Non-zero sub_cgroup_id indicates that the scheduler is to be attached to the identified cgroup. A sub-sched is attached to the cgroup iff the nearest ancestor scheduler implements .sub_attach() and grants the attachment. Max nesting depth is limited by SCX_SUB_MAX_DEPTH. - When a scheduler exits, all its descendant schedulers are exited together. Also, cgroup.scx_sched added which points to the effective scheduler instance for the cgroup. This is updated on scheduler init/exit and inherited on cgroup online. When a cgroup is offlined, the attached scheduler is automatically exited. - Sub-sched support is gated on CONFIG_EXT_SUB_SCHED which is automatically enabled if both SCX and cgroups are enabled. Sub-sched support is not tied to the CPU controller but rather the cgroup hierarchy itself. This is intentional as the support for cpu.weight and cpu.max based resource control is orthogonal to sub-sched support. Note that CONFIG_CGROUPS around cgroup subtree iteration support for scx_task_iter is replaced with CONFIG_EXT_SUB_SCHED for consistency. - This allows loading sub-scheds and most framework operations such as propagating disable down the hierarchy work. However, sub-scheds are not operational yet and all tasks stay with the root sched. This will serve as the basis for building up full sub-sched support. - DSQs point to the scx_sched they belong to. - scx_qmap is updated to allow attachment of sub-scheds and also serving as sub-scheds. - scx_is_descendant() is added but not yet used in this patch. It is used by later changes in the series and placed here as this is where the function belongs. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit dbd542a8fac7bcfba91e353f2a522e1bf2fbee27 Author: Tejun Heo Date: Fri Mar 6 07:58:02 2026 -1000 sched_ext: Reorganize enable/disable path for multi-scheduler support In preparation for multiple scheduler support, reorganize the enable and disable paths to make scheduler instances explicit. Extract scx_root_disable() from scx_disable_workfn(). Rename scx_enable_workfn() to scx_root_enable_workfn(). Change scx_disable() to take @sch parameter and only queue disable_work if scx_claim_exit() succeeds for consistency. Move exit_kind validation into scx_claim_exit(). The sysrq handler now prints a message when no scheduler is loaded. These changes don't materially affect user-visible behavior. v2: Keep scx_enable() name as-is and only rename the workfn to scx_root_enable_workfn(). Change scx_enable() return type to s32. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 0454a604b98a9bf301e82860cd216ec4ac563668 Author: Tejun Heo Date: Fri Mar 6 07:58:02 2026 -1000 sched_ext: Update p->scx.disallow warning in scx_init_task() - Always trigger the warning if p->scx.disallow is set for fork inits. There is no reason to set it during forks. - Flip the positions of if/else arms to ease adding error conditions. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit 19d0e98c20f079352f7c9098338520e09086e5ab Author: Tejun Heo Date: Fri Mar 6 07:58:02 2026 -1000 sched/core: Swap the order between sched_post_fork() and cgroup_post_fork() The planned sched_ext cgroup sub-scheduler support needs the newly forked task to be associated with its cgroup in its post_fork() hook. There is no existing ordering requirement between the two now. Swap them and note the new ordering requirement. Signed-off-by: Tejun Heo Acked-by: Peter Zijlstra (Intel) Reviewed-by: Andrea Righi Cc: Ingo Molnar commit e3715e397720c9f6068aff4f7babccd3cb6ef618 Author: Tejun Heo Date: Fri Mar 6 07:58:02 2026 -1000 sched_ext: Add @kargs to scx_fork() Make sched_cgroup_fork() pass @kargs to scx_fork(). This will be used to determine @p's cgroup for cgroup sub-sched support. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi Cc: Peter Zijlstra commit b0e4c2f8a0f0a60d10c427db4080181060014cac Author: Tejun Heo Date: Fri Mar 6 07:58:02 2026 -1000 sched_ext: Implement cgroup subtree iteration for scx_task_iter For the planned cgroup sub-scheduler support, enable/disable operations are going to be subtree specific and iterating all tasks in the system for those operations can be unnecessarily expensive and disruptive. cgroup already has mechanisms to perform subtree task iterations. Implement cgroup subtree iteration for scx_task_iter: - Add optional @cgrp to scx_task_iter_start() which enables cgroup subtree iteration. - Make scx_task_iter use css_next_descendant_pre() and css_task_iter to iterate all tasks in the cgroup subtree. - Update all existing callers to pass NULL to maintain current behavior. The two iteration mechanisms are independent and duplicate. It's likely that scx_tasks can be removed in favor of always using cgroup iteration if CONFIG_SCHED_CLASS_EXT depends on CONFIG_CGROUPS. Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi commit a0b0f6c7d7f29f1ade9ec59699d02e3b153ee8e4 Merge: 32e940f2bd3b16 5b30afc20b3fea Author: Tejun Heo Date: Fri Mar 6 07:48:08 2026 -1000 Merge branch 'for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup into for-7.1 To receive 5b30afc20b3f ("cgroup: Expose some cgroup helpers") which will be used by sub-sched support. Signed-off-by: Tejun Heo commit 32e940f2bd3b16551f23ea44be47f6f5d1746d64 Merge: 477174ac35c510 1dde5025876570 Author: Tejun Heo Date: Fri Mar 6 07:46:32 2026 -1000 Merge branch 'for-7.0-fixes' into for-7.1 To prepare for hierarchical scheduling patchset which will cause multiple conflicts otherwise. Signed-off-by: Tejun Heo commit d1165ef7e9d2bc86a7efeac386435de104c0ba2f Author: Andrew Davis Date: Mon Mar 2 14:27:28 2026 -0600 remoteproc: pru: Remove empty remove callback The .remove() callback only prints out a debug message, remove this otherwise unneeded callback. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260302202728.322073-2-afd@ti.com Signed-off-by: Mathieu Poirier commit 8f5dea46d06e306354203bf594129a199943dfc2 Author: Andrew Davis Date: Mon Mar 2 14:27:27 2026 -0600 remoteproc: pru: Use rproc_of_parse_firmware() to get firmware name There is a helper function to get the firmware name, make use of that. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260302202728.322073-1-afd@ti.com Signed-off-by: Mathieu Poirier commit 5ddd020b8bd0fb2fdcdc1f8c40513c656a690f80 Author: Thorsten Blum Date: Mon Feb 23 08:32:45 2026 +0100 thermal: core: Replace sprintf() in thermal_bind_cdev_to_trip() Replace unbounded sprintf() with the safer snprintf(). While the current code works correctly, snprintf() is safer and follows secure coding best practices. No functional changes. Signed-off-by: Thorsten Blum Reviewed-by: Lukasz Luba [ rjw: Subject tweaks ] Link: https://patch.msgid.link/20260223073245.321298-2-thorsten.blum@linux.dev Signed-off-by: Rafael J. Wysocki commit 4b57e97be22fb8332d05ee1d0fe3c0dd43c828bf Author: Song Liu Date: Thu Mar 5 15:15:31 2026 -0800 objtool/klp: Correlate locals to globals Allow correlating original locals to patched globals, and vice versa. This is needed when: 1. User adds/removes "static" for a function. 2. CONFIG_LTO_CLANG_THIN promotes local functions and objects to global and add .llvm. suffix. Signed-off-by: Song Liu Link: https://patch.msgid.link/20260305231531.3847295-8-song@kernel.org Signed-off-by: Josh Poimboeuf commit cdea5cadb0ca403b1929f8d29929c0eda0f715d6 Author: Song Liu Date: Thu Mar 5 15:15:30 2026 -0800 objtool/klp: Match symbols based on demangled_name for global variables correlate_symbols() will always try to match full name first. If there is no match, try match only demangled_name. In very rare cases, it is possible to have multiple foo.llvm. in the same kernel. Whenever there is ambiguity like this, fail the klp diff. Signed-off-by: Song Liu Link: https://patch.msgid.link/20260305231531.3847295-7-song@kernel.org Signed-off-by: Josh Poimboeuf commit 020b71dcafeeececb78d9ee9e5a2e68e8e05e922 Author: Song Liu Date: Thu Mar 5 15:15:29 2026 -0800 objtool/klp: Remove .llvm suffix in demangle_name() Remove .llvm suffix, so that we can correlate foo.llvm. and foo.llvm.. Signed-off-by: Song Liu Link: https://patch.msgid.link/20260305231531.3847295-6-song@kernel.org Signed-off-by: Josh Poimboeuf commit 8206277746d5c6ae300e7e062a0d9238ed59cc7f Author: Song Liu Date: Thu Mar 5 15:15:28 2026 -0800 objtool/klp: Also demangle global objects With CONFIG_LTO_CLANG_THIN, it is possible to have global __UNIQUE_ID, such as: FUNC GLOBAL HIDDEN 19745 __UNIQUE_ID_quirk_amd_nb_node_458 Also demangle global objects. Signed-off-by: Song Liu Link: https://patch.msgid.link/20260305231531.3847295-5-song@kernel.org Signed-off-by: Josh Poimboeuf commit 0b8fc6adc3d9bdf161fc8ad0a1de191dba293b39 Author: Song Liu Date: Thu Mar 5 15:15:27 2026 -0800 objtool/klp: Use sym->demangled_name for symbol_name hash For klp-build with LTO, it is necessary to correlate demangled symbols, e.g., correlate foo.llvm. and foo.llvm.. However, these two symbols do not have the same str_hash(name). To be able to correlate the two symbols, calculate hash based on demanged_name, so that these two symbols have the same hash. No functional changes intended. Signed-off-by: Song Liu Link: https://patch.msgid.link/20260305231531.3847295-4-song@kernel.org Signed-off-by: Josh Poimboeuf commit a3f28d2072452edb377eaad01375445dbace6771 Author: Song Liu Date: Thu Mar 5 15:15:26 2026 -0800 objtool/klp: Remove trailing '_' in demangle_name() With CONFIG_LTO_CLANG_THIN, it is possible to have nested __UNIQUE_ID_, such as: __UNIQUE_ID_addressable___UNIQUE_ID_pci_invalid_bar_694_695 To remove both trailing numbers, also remove trailing '_'. Also add comments to demangle_name(). Signed-off-by: Song Liu Link: https://patch.msgid.link/20260305231531.3847295-3-song@kernel.org Signed-off-by: Josh Poimboeuf commit a1cbaff2ea23645f0a94fdfa721aef202aebdf86 Author: Song Liu Date: Thu Mar 5 15:15:25 2026 -0800 objtool/klp: Remove redundant strcmp() in correlate_symbols() find_global_symbol_by_name() already compares names of the two symbols, so there is no need to compare them again. Signed-off-by: Song Liu Link: https://patch.msgid.link/20260305231531.3847295-2-song@kernel.org Signed-off-by: Josh Poimboeuf commit c19c854b307424c745dd6de73eea8db099c79408 Author: Wentong Tian Date: Thu Jan 22 22:44:04 2026 +0800 objtool: Use section/symbol type helpers Commit 25eac74b6bdb ("objtool: Add section/symbol type helpers") introduced several helper macros to improve code readability. Update the remaining open-coded checks in check.c, disas.c, elf.c, and klp-diff.c to use these new helpers. Signed-off-by: Wentong Tian Link: https://patch.msgid.link/20260122144404.40602-1-tianwentong2000@gmail.com Signed-off-by: Josh Poimboeuf commit 41c3f9fa52020c47a9f1143f8428b2798bbd3aa9 Author: Andrew Davis Date: Mon Mar 2 13:56:16 2026 -0600 remoteproc: da8xx: Reorder resource fetching in probe() Currently several resource are fetched before we allocate our instance data struct. The is unlike most other drivers that fill in the instance data with resources as they are fetched. Move these down which is more natural and also removes the need for several temporarily locals. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260302195616.312378-3-afd@ti.com Signed-off-by: Mathieu Poirier commit 7d9e37f30cd5f3db650ee19a733252b22b5ce0a4 Author: Andrew Davis Date: Mon Mar 2 13:56:15 2026 -0600 remoteproc: da8xx: Remove unused local struct data The member irq is never used and ack_fxn is unneeded as it is already a part of another member irq_data. Drop those and their struct docs. While touching the struct docs add one for dsp_reset which was previously missing. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260302195616.312378-2-afd@ti.com Signed-off-by: Mathieu Poirier commit 3bd256e8cd2abec45811d8bcb6f7240f0b122c6a Author: Andrew Davis Date: Mon Mar 2 13:56:14 2026 -0600 remoteproc: da8xx: Use dev_err_probe() Simplify the probe() code by using dev_err_probe(). Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20260302195616.312378-1-afd@ti.com Signed-off-by: Mathieu Poirier commit 797cc011ae02bda26f93d25a4442d7a1a77d84df Author: Chen Ni Date: Tue Feb 3 10:16:25 2026 +0800 backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() The devm_gpiod_get_optional() function may return an ERR_PTR in case of genuine GPIO acquisition errors, not just NULL which indicates the legitimate absence of an optional GPIO. Add an IS_ERR() check after the call in sky81452_bl_parse_dt(). On error, return the error code to ensure proper failure handling rather than proceeding with invalid pointers. Fixes: e1915eec54a6 ("backlight: sky81452: Convert to GPIO descriptors") Signed-off-by: Chen Ni Reviewed-by: Linus Walleij Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/20260203021625.578678-1-nichen@iscas.ac.cn Signed-off-by: Lee Jones commit 920e5001f4beb38685d5b8cac061cb1d2760eeab Author: Marcos Paulo de Souza Date: Fri Feb 20 11:12:33 2026 -0300 selftests: livepatch: test-ftrace: livepatch a traced function This is basically the inverse case of commit 474eecc882ae ("selftests: livepatch: test if ftrace can trace a livepatched function") but ensuring that livepatch would work on a traced function. Signed-off-by: Marcos Paulo de Souza Reviewed-by: Petr Mladek Tested-by: Petr Mladek Acked-by: Miroslav Benes Acked-by: Joe Lawrence Link: https://patch.msgid.link/20260220-lp-test-trace-v1-1-4b6703cd01a6@suse.com [pmladek: Fixed a typo found by Joe.] Signed-off-by: Petr Mladek commit 998a59d371c2365e7e6c72125f254487d50cbbd5 Author: Christian Brauner Date: Fri Mar 6 10:00:15 2026 +0100 treewide: fix missed i_ino format specifier conversions Fix three format strings that were missed in the treewide i_ino unsigned long to u64 conversion: - fs/binfmt_elf_fdpic.c: %lu -> %llu - fs/ext2/xattr.c: %ld -> %llu (debug macro, also fixes signedness) - fs/isofs/inode.c: %ld -> %llu (debug block, also fixes signedness) Signed-off-by: Christian Brauner commit 309a4f8ffd1d428e426cd7b80f9f8956490dd233 Author: Christian Brauner Date: Fri Mar 6 10:00:10 2026 +0100 ext4: fix signed format specifier in ext4_load_inode trace event The ext4_load_inode trace event uses %lld (signed) to print the ino field which is u64 (unsigned). Use %llu instead. Signed-off-by: Christian Brauner commit 2cd400974c10c2e1169683c1bffbf477bb220160 Merge: 6de23f81a5e08b 0b2600f81cefcd Author: Christian Brauner Date: Fri Mar 6 09:26:59 2026 +0100 Merge patch series "vfs: change inode->i_ino from unsigned long to u64" Jeff Layton says: Christian said [1] to "just do it" when I proposed this, so here we are! For historical reasons, the inode->i_ino field is an unsigned long, which means that it's 32 bits on 32 bit architectures. This has caused a number of filesystems to implement hacks to hash a 64-bit identifier into a 32-bit field, and deprives us of a universal identifier field for an inode. This patchset changes the inode->i_ino field from an unsigned long to a u64. This shouldn't make any material difference on 64-bit hosts, but 32-bit hosts will see struct inode grow by at least 4 bytes. This could have effects on slabcache sizes and field alignment. The bulk of the changes are to format strings and tracepoints, since the kernel itself doesn't care that much about the i_ino field. The first patch changes some vfs function arguments, so check that one out carefully. With this change, we may be able to shrink some inode structures. For instance, struct nfs_inode has a fileid field that holds the 64-bit inode number. With this set of changes, that field could be eliminated. I'd rather leave that sort of cleanups for later just to keep this simple. [1]: https://lore.kernel.org/linux-fsdevel/20260219-portrait-winkt-959070cee42f@brauner/ * patches from https://patch.msgid.link/20260304-iino-u64-v3-0-2257ad83d372@kernel.org: treewide: change inode->i_ino from unsigned long to u64 nilfs2: widen trace event i_ino fields to u64 f2fs: widen trace event i_ino fields to u64 ext4: widen trace event i_ino fields to u64 zonefs: widen trace event i_ino fields to u64 hugetlbfs: widen trace event i_ino fields to u64 ext2: widen trace event i_ino fields to u64 cachefiles: widen trace event i_ino fields to u64 vfs: widen trace event i_ino fields to u64 net: change sock.sk_ino and sock_i_ino() to u64 audit: widen ino fields to u64 vfs: widen inode hash/lookup functions to u64 Link: https://patch.msgid.link/20260304-iino-u64-v3-0-2257ad83d372@kernel.org Signed-off-by: Christian Brauner commit 0b2600f81cefcdfcda58d50df7be8fd48ada8ce2 Author: Jeff Layton Date: Wed Mar 4 10:32:42 2026 -0500 treewide: change inode->i_ino from unsigned long to u64 On 32-bit architectures, unsigned long is only 32 bits wide, which causes 64-bit inode numbers to be silently truncated. Several filesystems (NFS, XFS, BTRFS, etc.) can generate inode numbers that exceed 32 bits, and this truncation can lead to inode number collisions and other subtle bugs on 32-bit systems. Change the type of inode->i_ino from unsigned long to u64 to ensure that inode numbers are always represented as 64-bit values regardless of architecture. Update all format specifiers treewide from %lu/%lx to %llu/%llx to match the new type, along with corresponding local variable types. This is the bulk treewide conversion. Earlier patches in this series handled trace events separately to allow trace field reordering for better struct packing on 32-bit. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-12-2257ad83d372@kernel.org Acked-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Jan Kara Reviewed-by: Chuck Lever Signed-off-by: Christian Brauner commit d84c70c6eab10e56d22c394e3a250c1c6fde8d6e Author: Jeff Layton Date: Wed Mar 4 10:32:41 2026 -0500 nilfs2: widen trace event i_ino fields to u64 In trace events, change __field(unsigned long, ...) to __field(u64, ...) and update TP_PROTO parameters and TP_printk format strings to match the widened field type. Reviewed-by: Viacheslav Dubeyko Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-11-2257ad83d372@kernel.org Signed-off-by: Christian Brauner commit a232ef7831048448c3a7a93a80b1521ec9106b6a Author: Jeff Layton Date: Wed Mar 4 10:32:40 2026 -0500 f2fs: widen trace event i_ino fields to u64 In trace events, change __field(ino_t, ...) to __field(u64, ...) and update TP_printk format strings to %llu/%llx to match the widened field type. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-10-2257ad83d372@kernel.org Signed-off-by: Christian Brauner commit d352871478616ac63d0edf90e78194ec0a19b988 Author: Jeff Layton Date: Wed Mar 4 10:32:39 2026 -0500 ext4: widen trace event i_ino fields to u64 In trace events, change __field(ino_t, ...) to __field(u64, ...) and update TP_printk format strings to %llu/%llx to match the widened field type. Reviewed-by: Jan Kara Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-9-2257ad83d372@kernel.org Signed-off-by: Christian Brauner commit e4290764d10fd750fd3aad454e7c92d6f63d8df4 Author: Jeff Layton Date: Wed Mar 4 10:32:38 2026 -0500 zonefs: widen trace event i_ino fields to u64 Update zonefs trace event definitions to use u64 instead of ino_t/unsigned long for inode number fields. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-8-2257ad83d372@kernel.org Acked-by: Damien Le Moal Signed-off-by: Christian Brauner commit aeb11603158aea8c2f34e17c445883fce8ef4e86 Author: Jeff Layton Date: Wed Mar 4 10:32:37 2026 -0500 hugetlbfs: widen trace event i_ino fields to u64 Update hugetlbfs trace event definitions to use u64 instead of ino_t/unsigned long for inode number fields. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-7-2257ad83d372@kernel.org Signed-off-by: Christian Brauner commit d19eea7c1758e23bdc9cc8c0163308786e946c52 Author: Jeff Layton Date: Wed Mar 4 10:32:36 2026 -0500 ext2: widen trace event i_ino fields to u64 Update ext2 trace event definitions to use u64 instead of ino_t/unsigned long for inode number fields. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-6-2257ad83d372@kernel.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 7e35c9d7039504399f0dd573568d2b3a13a3e406 Author: Jeff Layton Date: Wed Mar 4 10:32:35 2026 -0500 cachefiles: widen trace event i_ino fields to u64 Update cachefiles trace event definitions to use u64 instead of ino_t/unsigned long for inode number fields. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-5-2257ad83d372@kernel.org Signed-off-by: Christian Brauner commit 5a3d5928b1a4196affc5f504fdf95f67f169bc57 Author: Jeff Layton Date: Wed Mar 4 10:32:34 2026 -0500 vfs: widen trace event i_ino fields to u64 Update VFS-layer trace event definitions to use u64 instead of ino_t/unsigned long for inode number fields. Update TP_printk format strings to use %llu/%llx to match the widened field type. Remove now-unnecessary (unsigned long) casts since __entry->ino is already u64. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-4-2257ad83d372@kernel.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 0fe27e5985925de8f0243f91658af7a6fea05725 Author: Jeff Layton Date: Wed Mar 4 10:32:33 2026 -0500 net: change sock.sk_ino and sock_i_ino() to u64 inode->i_ino is being converted to a u64. sock.sk_ino (which caches the inode number) must also be widened to avoid truncation on 32-bit architectures where unsigned long is only 32 bits. Change sk_ino from unsigned long to u64, and update the return type of sock_i_ino() to match. Fix all format strings that print the result of sock_i_ino() (%lu -> %llu), and widen the intermediate variables and function parameters in the diag modules that were using int to hold the inode number. Note that the UAPI socket diag structures (inet_diag_msg.idiag_inode, unix_diag_msg.udiag_ino, etc.) are all __u32 and cannot be changed without breaking the ABI. The assignments to those fields will silently truncate, which is the existing behavior. Acked-by: Marc Kleine-Budde # for net/can Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-3-2257ad83d372@kernel.org Signed-off-by: Christian Brauner commit 125dfa218134df7cc112667e92984de9d8cd0bf6 Author: Jeff Layton Date: Wed Mar 4 10:32:32 2026 -0500 audit: widen ino fields to u64 inode->i_ino is being widened from unsigned long to u64. The audit subsystem uses unsigned long ino in struct fields, function parameters, and local variables that store inode numbers from arbitrary filesystems. On 32-bit platforms this truncates inode numbers that exceed 32 bits, which will cause incorrect audit log entries and broken watch/mark comparisons. Widen all audit ino fields, parameters, and locals to u64, and update the inode format string from %lu to %llu to match. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-2-2257ad83d372@kernel.org Acked-by: Paul Moore Signed-off-by: Christian Brauner commit 96fefcabf340fcf8b3208dcd8685961955a66040 Author: Jeff Layton Date: Wed Mar 4 10:32:31 2026 -0500 vfs: widen inode hash/lookup functions to u64 Change the inode hash/lookup VFS API functions to accept u64 parameters instead of unsigned long for inode numbers and hash values. This is preparation for widening i_ino itself to u64, which will allow filesystems to store full 64-bit inode numbers on 32-bit architectures. Since unsigned long implicitly widens to u64 on all architectures, this change is backward-compatible with all existing callers. Reviewed-by: Jan Kara Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260304-iino-u64-v3-1-2257ad83d372@kernel.org Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit e7d82353986c7267fbd03d7385829cc763807b55 Author: Namjae Jeon Date: Thu Mar 5 10:46:42 2026 +0900 ntfs: use ->mft_no instead of ->i_ino in prints This improves log accuracy for NTFS debugging and removes unnecessary reliance on the VFS i_ino field ahead of the core VFS type change. Signed-off-by: Namjae Jeon commit d9038d99fb5c623f43bcd8b726bfbbe8562648c2 Author: Namjae Jeon Date: Thu Mar 5 10:40:54 2026 +0900 ntfs: change mft_no type to u64 Changes the type of ntfs_inode::mft_no from unsigned long to u64 to safely handle the full 48-bit range without truncation risk, especially in preparation for broader VFS inode number type (i_ino:u64) and to improve consistency with ntfs driver practices. Signed-off-by: Namjae Jeon commit 8c6cccefb33e20224ef35497e3f55ee360942f14 Author: Geert Uytterhoeven Date: Mon Mar 2 12:04:28 2026 +0100 ARM: shmobile: defconfig: Refresh for v7.0-rc1 Refresh the defconfig for Renesas ARM systems: - Move various DRM config symbols (moved in commit 22ba3bb3ff2a8e5a ("drm/Kconfig: sort driver Kconfig source list")), - Drop CONFIG_NFS_V4_1=y (removed in commit 7537db24806fdc3d ("NFS: Merge CONFIG_NFS_V4_1 with CONFIG_NFS_V4")). Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/d5faca8fe1db69d584f3097c269be7813ceffd33.1772449420.git.geert+renesas@glider.be commit b1de9823fdc67a8e9cd0dcf1f6f0e9780d425d4e Author: Biju Das Date: Tue Feb 3 10:30:12 2026 +0000 soc: renesas: rz-sysc: Add SoC identification for RZ/G3L SoC Add SoC identification for the RZ/G3L SoC using the System Controller (SYSC) block. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260203103031.247435-5-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 3e90f5103a8b19c69ba98d841d4b6a924266b165 Merge: 086502e93524e7 bc888ba1d493d5 Author: Georgi Djakov Date: Fri Mar 6 14:39:37 2026 +0200 Merge branch 'icc-qcs8300' into icc-next This series enables QoS configuration for QNOC type device which can be found on QCS8300 platform. It enables QoS configuration for master ports with predefined priority and urgency forwarding. This helps in prioritizing the traffic originating from different interconnect masters at NOC (Network On Chip). The system may function normally without this feature. However, enabling QoS helps optimize latency and bandwidth across subsystems like CPU, GPU, and multimedia engines, which becomes important in high-throughput scenarios. This is a feature aimed at performance enhancement to improve system performance under concurrent workloads. * icc-qcs8300 dt-bindings: interconnect: qcom,qcs8300-rpmh: add clocks property to enable QoS interconnect: qcom: qcs8300: enable QoS configuration Link: https://msgid.link/20260127090116.1438780-1-odelu.kukatla@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 3ac4e6b92fc200e047d13aae06224b2a72539b9e Author: Biju Das Date: Tue Feb 3 10:30:11 2026 +0000 dt-bindings: soc: renesas: renesas,rzg2l-sysc: Document RZ/G3L SoC Document RZ/G3L (R9A08G046) SYSC bindings. The SYSC block found on the RZ/G3L SoC is similar to the one found on RZ/G3S. Acked-by: Conor Dooley Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260203103031.247435-4-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 56c828dff9ff5e787e74d901e8b530a36b8941da Author: Biju Das Date: Tue Feb 3 10:30:10 2026 +0000 dt-bindings: soc: renesas: Document RZ/G3L SoC variants, SMARC SoM and Carrier-II EVK Document Renesas RZ/G3L (R9A08G046) SoC variants and the Renesas RZ/G3L SMARC Carrier-II EVK board which is based on the Renesas RZ/G3L SMARC SoM. The RZ/G3L SMARC Carrier-II EVK consists of an RZ/G3L SoM module and a SMARC Carrier-II carrier board. The SoM module sits on top of the carrier board. Reviewed-by: Fabrizio Castro Signed-off-by: Biju Das Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260203103031.247435-3-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 086502e93524e797fe431c8f091faea523eca08c Merge: b6adc224b7ac7f dfff14a4a44d8b Author: Georgi Djakov Date: Fri Mar 6 14:38:48 2026 +0200 Merge branch 'icc-mahua' into icc-next Mahua is a derivative of the Glymur SoC and shares a significant portion of its interconnect topology with Glymur. As such, this series extends the existing Glymur interconnect driver to support Mahua, reusing common definitions where possible and adding SoC-specific configurations where necessary. * icc-mahua dt-bindings: interconnect: document the RPMh Network-On-Chip interconnect in Mahua SoC interconnect: qcom: glymur: Add Mahua SoC support Link: https://msgid.link/20260209-mahua_icc-v3-0-c65f3dfd72c8@oss.qualcomm.com Signed-off-by: Georgi Djakov commit b6adc224b7ac7f31d53b379951cba1be7009a564 Merge: 26078bbdad9704 a39efc80ff507d Author: Georgi Djakov Date: Fri Mar 6 14:37:35 2026 +0200 Merge branch 'icc-eliza' into icc-next Add interconnect support for the Qualcomm Eliza SoC. * icc-eliza dt-bindings: interconnect: document the RPMh Network-On-Chip interconnect in Eliza SoC interconnect: qcom: Add Eliza interconnect provider driver dt-bindings: interconnect: OSM L3: Add Eliza EPSS L3 compatible Signed-off-by: Georgi Djakov commit c8d5972a25408b1daf73653ccd5207fdfc80c964 Author: Ovidiu Panait Date: Sun Jan 25 19:27:02 2026 +0000 clk: renesas: r9a09g056: Add clock and reset entries for RTC Add module clock and reset entries for the RTC module on the Renesas RZ/V2N (R9A09G056) SoC. Signed-off-by: Ovidiu Panait Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260125192706.27099-3-ovidiu.panait.rb@renesas.com Signed-off-by: Geert Uytterhoeven commit 1b4f047dc4010d51821694cc4ed73b52b3040a5c Author: Fabrizio Castro Date: Tue Feb 3 12:42:47 2026 +0000 clk: renesas: r9a09g057: Remove entries for WDT{0,2,3} The HW user manual for the Renesas RZ/V2H(P) SoC specifies that only the WDT1 IP is supposed to be used by Linux, while the WDT{0,2,3} IPs are supposed to be used by the CM33 and CR8 cores. Remove the clock and reset entries for WDT{0,2,3} to prevent interfering with the CM33 and CR8 cores. This change is harmless as only WDT1 is used by Linux, there are no users for the WDT{0,2,3} cores. Fixes: 3aeccbe08171 ("clk: renesas: r9a09g057: Add clock and reset entries for GTM/RIIC/SDHI/WDT") Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260203124247.7320-4-fabrizio.castro.jz@renesas.com Signed-off-by: Geert Uytterhoeven commit 8300438dc424f367875acce54c7e91fa819e5ab1 Author: Odelu Kukatla Date: Tue Feb 24 13:43:06 2026 +0200 dt-bindings: interconnect: document the RPMh Network-On-Chip interconnect in Eliza SoC Document the RPMh Network-On-Chip Interconnect of the Eliza platform. Signed-off-by: Odelu Kukatla Reviewed-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Link: https://msgid.link/20260224-eliza-interconnect-v4-1-ad75855d5018@oss.qualcomm.com Signed-off-by: Georgi Djakov commit a39efc80ff507d91cdaa4d2d143143300330f599 Author: Odelu Kukatla Date: Tue Feb 24 13:43:07 2026 +0200 interconnect: qcom: Add Eliza interconnect provider driver Add driver for the Qualcomm interconnect buses found in Eliza based platforms. The topology consists of several NoCs that are controlled by a remote processor that collects the aggregated bandwidth for each master-slave pairs. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Odelu Kukatla Signed-off-by: Abel Vesa Link: https://msgid.link/20260224-eliza-interconnect-v4-2-ad75855d5018@oss.qualcomm.com Signed-off-by: Georgi Djakov commit ae66be593643cb853e861fe3a47281a4485e8cd4 Author: Abel Vesa Date: Mon Mar 2 13:14:03 2026 +0200 dt-bindings: interconnect: OSM L3: Add Eliza EPSS L3 compatible Eliza, similarly to SM8650, uses EPSS hardware for L3 scaling. Document it. Signed-off-by: Abel Vesa Reviewed-by: Krzysztof Kozlowski Link: https://msgid.link/20260302-eliza-bindings-interconnect-epss-l3-v2-1-05b1848b98cc@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 26078bbdad9704ba1567d6c79a8191f6184229bf Author: Krzysztof Kozlowski Date: Tue Feb 17 14:00:37 2026 +0100 interconnect: qcom: De-acronymize SoC names Glymur and Kaanapali are codenames of Qualcomm SoCs, not acronyms. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://msgid.link/20260217130035.281752-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 7245b2ad0aee119f8edbb41b3f486af92e4f8baf Author: Krzysztof Kozlowski Date: Tue Feb 17 14:00:36 2026 +0100 dt-bindings: interconnect: qcom,glymur-rpmh: De-acronymize SoC name Glymur is a codename of Qualcomm SoC, not an acronym. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Reviewed-by: Taniya Das Link: https://msgid.link/20260217130035.281752-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Georgi Djakov commit fee48405a027516e0cde9c2b04a2714f035f7157 Author: Aaron Kling Date: Thu Feb 19 22:07:39 2026 -0600 dt-bindings: interconnect: OSM L3: Document sm8550 OSM L3 compatible Document the OSM L3 found in the Qualcomm SM8550 platform. Acked-by: Krzysztof Kozlowski Signed-off-by: Aaron Kling Link: https://msgid.link/20260219-sm8550-ddr-bw-scaling-v3-1-75c19152e921@gmail.com Signed-off-by: Georgi Djakov commit 24090c9b8a376d03da29e444be0a8831f248b21e Author: Cosmin Tanislav Date: Wed Jan 28 23:51:32 2026 +0200 arm64: dts: renesas: r9a09g087: Wire up DMA support for SPI RZ/N2H (R9A09G087) has three DMA controllers that can be used by peripherals like SPI to offload data transfers from the CPU. Wire up the DMA channels for the SPI peripherals. Signed-off-by: Cosmin Tanislav Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260128215132.1353381-4-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Geert Uytterhoeven commit c5fb3c5465e999dcdede4b238a843d056a6f7479 Author: Cosmin Tanislav Date: Wed Jan 28 23:51:31 2026 +0200 arm64: dts: renesas: r9a09g077: Wire up DMA support for SPI RZ/T2H (R9A09G077) has three DMA controllers that can be used by peripherals like SPI to offload data transfers from the CPU. Wire up the DMA channels for the SPI peripherals. Signed-off-by: Cosmin Tanislav Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260128215132.1353381-3-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Geert Uytterhoeven commit b901f2f03ed72ccef7a46619550546e2471d581f Author: Ovidiu Panait Date: Sun Jan 25 19:27:05 2026 +0000 arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable RTC Enable RTC. Signed-off-by: Ovidiu Panait Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260125192706.27099-6-ovidiu.panait.rb@renesas.com Signed-off-by: Geert Uytterhoeven commit eb90ae0b39a15c380e640efc0c927b012d8b28fb Author: Ovidiu Panait Date: Sun Jan 25 19:27:04 2026 +0000 arm64: dts: renesas: r9a09g056: Add RTC node Add RTC node to Renesas RZ/V2N ("R9A09G056") SoC DTSI. Signed-off-by: Ovidiu Panait Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260125192706.27099-5-ovidiu.panait.rb@renesas.com Signed-off-by: Geert Uytterhoeven commit 64e962bc366438c09e9b98940e0c9274c95a8af5 Author: Marek Vasut Date: Sun Jan 18 14:49:57 2026 +0100 arm64: dts: renesas: ebisu: Describe PCIe/USB3.0 clock generator Describe the 9FGV0841 PCIe and USB3.0 clock generator present on Ebisu board. The clock generator supplies 100 MHz differential clock for both PCIe slot and BT/WLAN expansion port, as well as for the USB 3.0 PHY. This configuration is valid for SW49 in OFF position, which means the PCIe signals are routed to the PCIe slot and U11 9FGV0841 PCIe clock generator output 3 supplies clock to the PCIe slot. In case the SW49 is set to ON position, which means the PCIe signals are routed to the EX BT/WLAN expansion port, and U11 9FGV0841 PCIe clock generator output 4 supplies clock to the port and &pciec0_rp clocks should be changed to "clocks = <&pcie_usb_clk 4>;". Once the BT/WLAN port is tested, this can be implemented using a DTO. Until then, assume SW49 is set to OFF position. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260118135038.8033-10-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit c3632693cee78b4806496a661f33a0c84f9775e0 Author: Marek Vasut Date: Sun Jan 18 14:49:56 2026 +0100 arm64: dts: renesas: ulcb: ulcb-kf: Describe PCIe/USB3.0 clock generator Describe the 9FGV0841 PCIe and USB3.0 clock generator present on ULCB boards. The clock generator supplies 100 MHz differential clock for both PCIe ports, the USB 3.0 PHY and SATA. SATA is not yet described in the ULCB DT, therefore the connection to this clock generator is not described here either. The H3 ULCB schematic does describe connection from output DIF7 to USB3S1_CLK_*, but these signals do not exist on the SoC, therefore this connection is also not described. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260118135038.8033-9-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 39ef5f2dac6697c88bbc6588ca9388659a3cbed6 Author: Marek Vasut Date: Sun Jan 18 14:49:55 2026 +0100 arm64: dts: renesas: salvator-common: Describe PCIe/USB3.0 clock generator Describe the 9FGV0841 PCIe and USB3.0 clock generator present on both Salvator-X and Salvator-XS boards. The clock generator supplies 100 MHz differential clock for both PCIe ports, as well as for the USB 3.0 PHY. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260118135038.8033-8-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit c6ffd326277aa87138ee6ed4fc4e6f8af1106179 Author: Marek Vasut Date: Sun Jan 18 14:49:54 2026 +0100 arm64: dts: renesas: r8a77990: Add USB 3.0 PHY and USB3S0 clock nodes Add USB 3.0 PHY and PHY clock node for R-Car E3. The PHY node is different in that it does not have control registers and extal clock, which are not routed to the SoC pads on R-Car E3, therefore describe the PHY as usb-nop-xceiv simple PHY. Add USB3S0 clock pad fixed-clock node, the frequency has to be overridden at board level. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260118135038.8033-7-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 1ec13760f46831108833221e2812f15d03ac71e5 Author: Marek Vasut Date: Sun Jan 18 14:49:53 2026 +0100 arm64: dts: renesas: r8a77990: Describe PCIe root port Add node which describes the root port in the PCIe controller DT node. This can be used together with the pwrctrl driver to control clock and power supply to a PCIe slot. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260118135038.8033-6-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 12424624c8484f79e02fdc8a437fd401bc21ed41 Author: Marek Vasut Date: Sun Jan 18 14:49:52 2026 +0100 arm64: dts: renesas: r8a77965: Describe PCIe root ports Add nodes which describe the root ports in the PCIe controller DT nodes. This can be used together with the pwrctrl driver to control clock and power supply to a PCIe slot. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260118135038.8033-5-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 457fad44b471b474ac6983b30f33e840b9362179 Author: Marek Vasut Date: Sun Jan 18 14:49:51 2026 +0100 arm64: dts: renesas: r8a77961: Describe PCIe root ports Add nodes which describe the root ports in the PCIe controller DT nodes. This can be used together with the pwrctrl driver to control clock and power supply to a PCIe slot. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260118135038.8033-4-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit dc21c26490c692419e1aa4d68f668f3e47c51a6a Author: Marek Vasut Date: Sun Jan 18 14:49:50 2026 +0100 arm64: dts: renesas: r8a77960: Describe PCIe root ports Add nodes which describe the root ports in the PCIe controller DT nodes. This can be used together with the pwrctrl driver to control clock and power supply to a PCIe slot. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260118135038.8033-3-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 11f251f3df14cf27847e4bdd46b4df86214b313f Author: Marek Vasut Date: Sun Jan 18 14:49:49 2026 +0100 arm64: dts: renesas: r8a77951: Describe PCIe root ports Add nodes which describe the root ports in the PCIe controller DT nodes. This can be used together with the pwrctrl driver to control clock and power supply to a PCIe slot. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260118135038.8033-2-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit b686ccad06a8c3b041e89e19e52d7b1ba5dd93f7 Author: Herve Codina (Schneider Electric) Date: Thu Jan 15 17:49:05 2026 +0100 ARM: dts: renesas: r9a06g032: Add support for CPU frequency scaling In RZ/N1 SoCs, CPUs are allowed to work at 125, 250 or 500 MHz when the 'ref' clock frequency value is set to 500 MHz which is the default 'ref' clock frequency value. Add support for CPU frequency scaling defining those 3 frequencies in the opp-table with the assumption that the 'ref' clock is set to its default value. Signed-off-by: Herve Codina (Schneider Electric) Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260115164905.1203453-1-herve.codina@bootlin.com Signed-off-by: Geert Uytterhoeven commit bd462aa2027ff3dc80741045b03260fdcd273b12 Author: Marek Vasut Date: Tue Jan 13 00:45:56 2026 +0100 arm64: dts: renesas: sparrow-hawk: Mark OTP and HSCIF0 pins as bootph-all The U-Boot SPL is responsible for initializing the hardware and it does also initialize HSCIF0 and its pinmux, mark the HSCIF0 pinmux as needed in all bootloader stages. The SPL also uses OTP to determine the exact V4H SoC variant during DRAM initialization, to determine which is the maximum allowed DRAM rate, mark OTP as required in all bootloader stages as well. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260112234642.225993-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit bc888ba1d493d5c352365cc24de64f093343a7b1 Author: Odelu Kukatla Date: Tue Jan 27 14:31:15 2026 +0530 interconnect: qcom: qcs8300: enable QoS configuration Enable QoS configuration for master ports with predefined priority and urgency forwarding. Signed-off-by: Odelu Kukatla Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://msgid.link/20260127090116.1438780-3-odelu.kukatla@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 28a70e793977a606395550b3c0547c14b6441e98 Author: Odelu Kukatla Date: Tue Jan 27 14:31:14 2026 +0530 dt-bindings: interconnect: qcom,qcs8300-rpmh: add clocks property to enable QoS Some QCS8300 interconnect nodes have QoS registers located inside a block whose interface is clock-gated. For those nodes, driver must enable the corresponding clock(s) before accessing the registers. Add the 'clocks' property so the driver can obtain and enable the required clock(s). Only interconnects that have clock‑gated QoS register interface use this property; it is not applicable to all interconnect nodes. Signed-off-by: Odelu Kukatla Reviewed-by: Krzysztof Kozlowski Link: https://msgid.link/20260127090116.1438780-2-odelu.kukatla@oss.qualcomm.com Signed-off-by: Georgi Djakov commit dfff14a4a44d8bbf33bdd08535b30981e76230f1 Author: Raviteja Laggyshetty Date: Mon Feb 9 09:44:29 2026 +0000 interconnect: qcom: glymur: Add Mahua SoC support Mahua is a derivative of the Glymur SoC. Extend the Glymur driver to support Mahua by: 1. Adding new node definitions for interconnects that differ from Glymur (Config NoC, High-Speed Coherent NoC, PCIe West ANOC/Slave NoC). 2. Reusing existing Glymur definitions for identical NoCs. 3. Overriding the channel and buswidth, with Mahua specific values for the differing NoCs Co-developed-by: Odelu Kukatla Signed-off-by: Odelu Kukatla Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Raviteja Laggyshetty Link: https://msgid.link/20260209-mahua_icc-v3-2-c65f3dfd72c8@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 43cb0a21a47577938735919a6effe9805414d40a Author: Raviteja Laggyshetty Date: Mon Feb 9 09:44:28 2026 +0000 dt-bindings: interconnect: document the RPMh Network-On-Chip interconnect in Mahua SoC Document the RPMh Network-on-Chip (NoC) interconnect for the Qualcomm Mahua platform. Mahua is a derivative of the Glymur SoC. Many interconnect nodes are identical and continue to use Glymur fallback compatibles. Mahua introduces SoC-specific configurations and topologies for several NoC blocks, including CNOC, HSCNOC, PCIe West ANoC/Slave NoCs. This updates the existing Glymur yaml schema to include Mahua-specific compatible strings, using two-cell "fallback" compatibles wherever the hardware is identical with Glymur. Co-developed-by: Odelu Kukatla Signed-off-by: Odelu Kukatla Acked-by: Konrad Dybcio Signed-off-by: Raviteja Laggyshetty Reviewed-by: Krzysztof Kozlowski Link: https://msgid.link/20260209-mahua_icc-v3-1-c65f3dfd72c8@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 06249b4e691a75694c014a61708c007fb5755f60 Author: Janusz Krzysztofik Date: Tue Feb 24 10:49:06 2026 +0100 drm/i915: Fix potential overflow of shmem scatterlist length When a scatterlists table of a GEM shmem object of size 4 GB or more is populated with pages allocated from a folio, unsigned int .length attribute of a scatterlist may get overflowed if total byte length of pages allocated to that single scatterlist happens to reach or cross the 4GB limit. As a consequence, users of the object may suffer from hitting unexpected, premature end of the object's backing pages. [278.780187] ------------[ cut here ]------------ [278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915] ... [278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S U 6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary) [278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER [278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024 [278.780659] RIP: 0010:remap_sg+0x199/0x1d0 [i915] ... [278.780786] Call Trace: [278.780787] [278.780788] ? __apply_to_page_range+0x3e6/0x910 [278.780795] ? __pfx_remap_sg+0x10/0x10 [i915] [278.780906] apply_to_page_range+0x14/0x30 [278.780908] remap_io_sg+0x14d/0x260 [i915] [278.781013] vm_fault_cpu+0xd2/0x330 [i915] [278.781137] __do_fault+0x3a/0x1b0 [278.781140] do_fault+0x322/0x640 [278.781143] __handle_mm_fault+0x938/0xfd0 [278.781150] handle_mm_fault+0x12c/0x300 [278.781152] ? lock_mm_and_find_vma+0x4b/0x760 [278.781155] do_user_addr_fault+0x2d6/0x8e0 [278.781160] exc_page_fault+0x96/0x2c0 [278.781165] asm_exc_page_fault+0x27/0x30 ... That issue was apprehended by the author of a change that introduced it, and potential risk even annotated with a comment, but then never addressed. When adding folio pages to a scatterlist table, take care of byte length of any single scatterlist not exceeding max_segment. Fixes: 0b62af28f249b ("i915: convert shmem_sg_free_table() to use a folio_batch") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14809 Cc: Matthew Wilcox (Oracle) Cc: Andrew Morton Cc: stable@vger.kernel.org # v6.5+ Signed-off-by: Janusz Krzysztofik Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260224094944.2447913-2-janusz.krzysztofik@linux.intel.com commit 2a99ecca1fdfc3838dda2f7b85bd3216fbf51867 Author: Konstantin Khorenko Date: Mon Feb 9 12:27:09 2026 +0100 drm/i915/guc: Fix corrupted copyright symbols in selftest files Replace broken UTF-8 sequences (Unicode replacement characters) with proper "©" text in copyright headers. Signed-off-by: Konstantin Khorenko Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260209112709.2551603-1-khorenko@virtuozzo.com commit f791145abcb83faa6ba580f2b7a6cefef37b9cf3 Author: Dave Hansen Date: Thu Mar 5 09:18:37 2026 -0800 MAINTAINERS: Remove bouncing maintainer, Mika takes over DMA test driver This maintainer's email is now bouncing. Since Mika maintains the core Thunderbolt/USB4 driver he can take over this one too. Signed-off-by: Dave Hansen [mw: Put me as maintainer instead of orphaning it] Signed-off-by: Mika Westerberg commit 73cee0aad1ee2479fde2c9b753a1b66acb7d1b9a Author: Yen-Hsiang Hsu Date: Tue Jan 13 22:18:30 2026 +0800 perf/x86/amd/ibs: Fix comment typo in ibs_op_data The comment for tag_to_ret_ctr in ibs_op_data says "15-31" but it should be "16-31". Fix the misleading comment. No functional changes. Signed-off-by: Yen-Hsiang Hsu Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260113141830.3204114-1-rrrrr4413@gmail.com commit 9d93e13bf5c4d7800a6168a145984adda9bf3c0e Author: Andrew Davis Date: Wed Aug 13 16:41:38 2025 -0500 reset: sunplus: Use devm_register_sys_off_handler() Function register_restart_handler() is deprecated. Using this new API removes our need to keep and manage a struct notifier_block and to later unregister the handler. Signed-off-by: Andrew Davis Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 71c021cd8875ad96c01fa9263b8a4868d2635a0d Author: Andrew Davis Date: Wed Aug 13 16:41:37 2025 -0500 reset: npcm: Use devm_register_sys_off_handler() Function register_restart_handler() is deprecated. Using this new API removes our need to keep and manage a struct notifier_block and to later unregister the handler. Signed-off-by: Andrew Davis Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 42d03696a05de8a79383d9ed29ca286846133c40 Author: Andrew Davis Date: Wed Aug 13 16:41:36 2025 -0500 reset: ma35d1: Use devm_register_sys_off_handler() Function register_restart_handler() is deprecated. Using this new API removes our need to keep and manage a struct notifier_block and to later unregister the handler. Signed-off-by: Andrew Davis Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 09f166128aeae20706611d009e3c3d39e285e368 Author: Andrew Davis Date: Wed Aug 13 16:41:35 2025 -0500 reset: lpc18xx: Use devm_register_sys_off_handler() Function register_restart_handler() is deprecated. Using this new API removes our need to keep and manage a struct notifier_block and to later unregister the handler. Signed-off-by: Andrew Davis Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 8bfef0c2438978d4e246f239b3e5dcd0ab9df07d Author: Andrew Davis Date: Wed Aug 13 16:41:34 2025 -0500 reset: intel: Use devm_register_restart_handler() Function register_restart_handler() is deprecated. Using this new API removes our need to keep and manage a struct notifier_block and to later unregister the handler. Signed-off-by: Andrew Davis Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 59ad2fb0be75d984e78c9e9ceb6c371f656ac74d Author: Andrew Davis Date: Wed Aug 13 16:41:33 2025 -0500 reset: ath79: Use devm_register_restart_handler() Function register_restart_handler() is deprecated. Using this new API removes our need to keep and manage a struct notifier_block and to later unregister the handler. Signed-off-by: Andrew Davis Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 97492c019da4b62df83255e968b23b81c0315530 Author: Johan Hovold Date: Fri Mar 6 09:51:35 2026 +0100 wifi: mwifiex: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Acked-by: Francesco Dolcini Link: https://patch.msgid.link/20260306085144.12064-10-johan@kernel.org Signed-off-by: Johannes Berg commit 6f29eda7b77a9d44382bbeb99fe8a4c93b11aabb Author: Johan Hovold Date: Fri Mar 6 09:51:41 2026 +0100 wifi: rt2x00: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Acked-by: Stanislaw Gruszka Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260306085144.12064-16-johan@kernel.org Signed-off-by: Johannes Berg commit b1af0de313bde1539c2501ef6849791010950387 Author: Johan Hovold Date: Fri Mar 6 09:51:34 2026 +0100 wifi: libertas_tf: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260306085144.12064-9-johan@kernel.org Signed-off-by: Johannes Berg commit 75e375816392e8b84feafc97e2c72513f8bd11d4 Author: Johan Hovold Date: Fri Mar 6 09:51:33 2026 +0100 wifi: libertas: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260306085144.12064-8-johan@kernel.org Signed-off-by: Johannes Berg commit c882b7a603eff6d4a368678dd53beb7413a8414a Author: Johan Hovold Date: Fri Mar 6 09:51:32 2026 +0100 wifi: at76c50x: drop redundant device reference Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Drop the redundant device reference to reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of memory leaks when drivers fail to release it. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260306085144.12064-7-johan@kernel.org Signed-off-by: Johannes Berg commit 4e0417a00971cd621e568396c18109f96be2a01d Author: Aditya Kumar Singh Date: Fri Mar 6 11:39:27 2026 +0530 wifi: mac80211_hwsim: add incumbent signal interference detection support Add a debugfs 'simulate_incumbent_signal_interference' with custom file_operations and a .write that accepts " ". The handler selects the 6 GHz chanctx whose primary 20 MHz center matches and reports the event via cfg80211_incumbent_signal_notify(). The bitmap marks affected 20 MHz segments within the current chandef (lowest bit = lowest segment) Signed-off-by: Aditya Kumar Singh Signed-off-by: Amith A Link: https://patch.msgid.link/20260306060927.504567-2-amith.a@oss.qualcomm.com Signed-off-by: Johannes Berg commit 35de87bf598ca48d5cd5cc7f328ce00df2b5fb59 Author: Tim Bird Date: Thu Mar 5 15:04:21 2026 -0700 wifi: Add SPDX ids to some files in the wireless subsystem Add SPDX-License-Identifier lines to some files where they are missing in the net/wireless directory. Remove licensing text from individual files headers (where present) to canonicalize the library references. Use (mostly) either GPL-2.0 or ISC, depending on the license wording (or not) in the files. radiotap.c does not mention which BSD variant it intends for the license. My selection of 'OR BSD-2-Clause' for radiotap.c was based on research into this code's history and its licensing elsewhere. In OpenBSD, radiotap code (which likely either derived from this code, or this code was derived from) has the BSD-2-Clause license. Very similar code in the radiotap library user space tool, by the same authors Andy Green and Johannes Berg, has an ISC license. Also the ISC license is used by Johannes for other contributions in the Linux wireless system. Since the radiotap.c license text here mentions BSD, but not a specific version, I chose the closest BSD variant to ISC, which is BSD-2-Clause. Signed-off-by: Tim Bird Link: https://patch.msgid.link/20260305220422.24161-1-tim.bird@sony.com [modify subject since it's not all radiotap] Signed-off-by: Johannes Berg commit 98acd4c1d9f7dc9c426e840c16e81b57315ff84b Author: Ria Thomas Date: Thu Mar 5 14:43:04 2026 +0530 wifi: mac80211: add support for NDP ADDBA/DELBA for S1G S1G defines use of NDP Block Ack (BA) for aggregation, requiring negotiation of NDP ADDBA/DELBA action frames. If the S1G recipient supports HT-immediate block ack, the sender must send an NDP ADDBA Request indicating it expects only NDP BlockAck frames for the agreement. Introduce support for NDP ADDBA and DELBA exchange in mac80211. The implementation negotiates the BA mechanism during setup based on station capabilities and driver support (IEEE80211_HW_SUPPORTS_NDP_BLOCKACK). If negotiation fails due to mismatched expectations, a rejection with status code WLAN_STATUS_REJECTED_NDP_BLOCK_ACK_SUGGESTED is returned as per IEEE 802.11-2024. Trace sample: IEEE 802.11 Wireless Management Fixed parameters Category code: Block Ack (3) Action code: NDP ADDBA Request (0x80) Dialog token: 0x01 Block Ack Parameters: 0x1003, A-MSDUs, Block Ack Policy .... .... .... ...1 = A-MSDUs: Permitted in QoS Data MPDUs .... .... .... ..1. = Block Ack Policy: Immediate Block Ack .... .... ..00 00.. = Traffic Identifier: 0x0 0001 0000 00.. .... = Number of Buffers (1 Buffer = 2304 Bytes): 64 Block Ack Timeout: 0x0000 Block Ack Starting Sequence Control (SSC): 0x0010 .... .... .... 0000 = Fragment: 0 0000 0000 0001 .... = Starting Sequence Number: 1 IEEE 802.11 Wireless Management Fixed parameters Category code: Block Ack (3) Action code: NDP ADDBA Response (0x81) Dialog token: 0x02 Status code: BlockAck negotiation refused because, due to buffer constraints and other unspecified reasons, the recipient prefers to generate only NDP BlockAck frames (0x006d) Block Ack Parameters: 0x1002, Block Ack Policy .... .... .... ...0 = A-MSDUs: Not Permitted .... .... .... ..1. = Block Ack Policy: Immediate Block Ack .... .... ..00 00.. = Traffic Identifier: 0x0 0001 0000 00.. .... = Number of Buffers (1 Buffer = 2304 Bytes): 64 Block Ack Timeout: 0x0000 Signed-off-by: Ria Thomas Link: https://patch.msgid.link/20260305091304.310990-1-ria.thomas@morsemicro.com Signed-off-by: Johannes Berg commit 9aa84d5c6c99480c523aeb7a6ce93b6635f3e290 Author: Johannes Berg Date: Wed Mar 4 14:41:48 2026 +0100 wifi: ieee80211: fix UHR operation DBE vs. P-EDCA order Draft P802.11bn_D1.3 switched the order here to align with the order of the fields. Adjust the code accordingly. Link: https://patch.msgid.link/20260304144148.ce45942294e1.I22ab3f16e6376a19c3953cf81dd67105ea8e529d@changeid Signed-off-by: Johannes Berg commit a140826caa2c14aa5a9a6990e514c5edbdb7eafd Author: Johannes Berg Date: Tue Mar 3 15:16:15 2026 +0100 wifi: nl80211: fix UHR capability validation The ieee80211_uhr_capa_size_ok() function returns a boolean, but we need an error code here. Fix that. Fixes: 072e6f7f416f ("wifi: cfg80211: add initial UHR support") Cc: # no drivers with UHR yet Link: https://patch.msgid.link/20260303151614.e87ea9995be5.Ie164040a51855a3e548f05f0d0291d7d7993c7ee@changeid Signed-off-by: Johannes Berg commit 9f39e2cc2b01225c1af7f18ff112047c13240d06 Author: Johannes Berg Date: Tue Mar 3 15:09:21 2026 +0100 wifi: mac80211: remove AID bit stripping for print Since the top bits have already been masked off according to whether or not it's S1G, there's no need to mask again for printing. Remove the superfluous code. Link: https://patch.msgid.link/20260303150921.d04ad4dfdc48.I78da2953982e85aab386867dc9db83471bf35475@changeid Signed-off-by: Johannes Berg commit 2f211be112e6453b3b3a1b752fd6f446e5297704 Author: Johannes Berg Date: Tue Mar 3 15:06:14 2026 +0100 wifi: mac80211: remove stale TODO item We've addressed multi-link operation, nothing appears to still need to get moved around. Link: https://patch.msgid.link/20260303150614.5f4b91c2490e.Ic49b55bd211129e05b1d035ad468d033cf24c0e9@changeid Signed-off-by: Johannes Berg commit bb3fa3f8a4166e6fbc769e208a1932242800f8e5 Author: Alain Volmat Date: Tue Jan 6 12:34:40 2026 +0100 ARM: dts: stm32: enable DCMI DMA-MDMA chaining on stm32mp157c-ev1.dts Enable the DMA-MDMA chaining for the dcmi (camera capture) in order to be able to achieve higher resolution. Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20260106-stm32-dcmi-dma-chaining-v2-12-70688bccd80a@foss.st.com Signed-off-by: Alexandre Torgue commit eea9018b64c94a87304a4a2632841140e8c05083 Author: Alain Volmat Date: Tue Jan 6 12:34:39 2026 +0100 ARM: dts: stm32: add sram node within stm32mp151.dtsi Introduce the sram node in order to be used by drivers requiring SRAM memory space. Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20260106-stm32-dcmi-dma-chaining-v2-11-70688bccd80a@foss.st.com Signed-off-by: Alexandre Torgue commit 1dd44972896d20d7c26b550f31b54f1155f4d131 Author: Christophe Parant Date: Fri Mar 6 10:13:07 2026 +0100 ARM: dts: stm32: phyboard-sargas and phycore: Add optional interfaces - stm32mp15xx-phycore-som: add NAND device on FMC interface to support the SoM version equipped with NAND flash instead of eMMC. - stm32mp15xx-phyboard-sargas: define pinctrl for PWM5, LTDC and DCMI interfaces used on phyBOARD-Sargas. Those interfaces are not enabled by default as PHYTEC displays and PHYTEC cameras are enabled and configured throught device tree overlays. PWM5 is used for LCD backlight command. Signed-off-by: Christophe Parant Signed-off-by: Alexandre Torgue commit c586a772639dee64f9bb0deb8612c4d67d32cdb0 Author: Christophe Parant Date: Fri Mar 6 10:05:00 2026 +0100 ARM: dts: stm32: phyboard-sargas and phycore: Fix coding style issues - Remove "stm32-pinfunc.h" include as it is already include in "stm32mp15-pinctrl.dtsi" file. - reserved-memory: reorder the memory sections (lower to higher addresses). - Move vendor properties (go last). - Remove useless compatible values: - QSPI flash: remove the winbond compatible. jedec is enought as the NOR flahses are detectable. - EEPROM: "atmel,24c32" is enought. - Use uppercase for regulator-name properties. - In pmic node: use the names from the PHYTEC SoM schematics. - stmpe811 touch: fix dts schema to comply with st,stmpe.yaml. - Fix one "multiple blank lines" detected by checkpatch. Signed-off-by: Christophe Parant Signed-off-by: Alexandre Torgue commit e4c9cc73887eab58368499dcab3c6b7dc04a3102 Author: Christophe Parant Date: Wed Dec 10 11:16:09 2025 +0100 ARM: dts: stm32: phycore-stm32mp15: Disable optional SoM peripherals Following peripherals are optional on phyCORE-STM32MP15x following PHYTEC standard SoM variants: external RTC, EEPROM, SPI NOR. Also NAND (fmc) can be populated instead of eMMC (sdmmc2). So disable those peripherals on SoM dtsi file and enable them on board dts file. Additionally, enable by default the "DTS" SoC IP on common SoM dtsi file as it is not an optional IP in STM32MP15x SoC. Signed-off-by: Christophe Parant Link: https://lore.kernel.org/r/20251210101611.27008-10-c.parant@phytec.fr Signed-off-by: Alexandre Torgue commit d07f9c56d09fc686231cece73a1793427aaa4775 Author: Christophe Parant Date: Wed Dec 10 11:16:08 2025 +0100 ARM: dts: stm32: phyboard-sargas: Move aliases from dts to dtsi aliases are common to every phyboard-sargas version. So move it to the common phyboard dtsi file. Signed-off-by: Christophe Parant Link: https://lore.kernel.org/r/20251210101611.27008-9-c.parant@phytec.fr Signed-off-by: Alexandre Torgue commit b95ce919a73166f6ea86d0e6714776349e7b03da Author: Christophe Parant Date: Wed Dec 10 11:16:07 2025 +0100 ARM: dts: stm32: phycore-stm32mp15: Add dummy memory-node "memory" node is not necessary as the bootloader is taking care of passing the correct DDR size. However keep a dummy memory node with the minimum DDR size (512MB) with comment explaining that. Signed-off-by: Christophe Parant Link: https://lore.kernel.org/r/20251210101611.27008-8-c.parant@phytec.fr Signed-off-by: Alexandre Torgue commit 399206250d7ad135256cdb45faefd53255642c3d Author: Christophe Parant Date: Wed Dec 10 11:16:06 2025 +0100 ARM: dts: stm32: phycore-stm32mp15: qspi: Fix memory map and pinctrl - Add missing chip select pin group in pinctrl. - Overwrite the memory map to the Flash device size (16MB) is necessary to avoid waste of virtual memory that will not be used. Without this modification, qspi probe fails because of ioremap error. Signed-off-by: Christophe Parant Link: https://lore.kernel.org/r/20251210101611.27008-7-c.parant@phytec.fr Signed-off-by: Alexandre Torgue commit 35c59caef69ea1e03da4eb825144119177a58d2a Author: Christophe Parant Date: Wed Dec 10 11:16:05 2025 +0100 ARM: dts: stm32: phyboard-sargas: Fix uart4 and sai2 pinctrl - UART4: "uart4_pins_a" pinmux option does not apply here, as PB9 should be used for UART4_TX instead of PG11 (PG11 is LCD_B3 on Sargas). Use "uart4_pins_f" instead. Also remove "pinctrl-3" which is useless (identical to "pinctrl-1"). - SAI2 A: "sai2a_pins_b" pinmux option does not apply here, as only PI6 is used for SAI2 A ("SAI2_SD_A"). Other pins of this group (PI7 and PD13) are not used for audio. Use "sai2a_sleep_pins_d" instead. Signed-off-by: Christophe Parant Link: https://lore.kernel.org/r/20251210101611.27008-6-c.parant@phytec.fr Signed-off-by: Alexandre Torgue commit 9a711cfa6e2f37ec6301923bf8137a3796584fbd Author: Christophe Parant Date: Wed Dec 10 11:16:04 2025 +0100 ARM: dts: stm32: Add new pinmux groups for phyboard-sargas and phycore Add add alternate pinmux for following interfaces used on phyBOARD-Sargas: - UART4 - LTDC - DCMI - TIM5 - SAI2 Fix "ethernet0_rgmii_pins_d" pinmux used on phyCORE-STM32MP15x: ETH_RGMII_GTX_CLK pin was missing. Signed-off-by: Christophe Parant Link: https://lore.kernel.org/r/20251210101611.27008-5-c.parant@phytec.fr Signed-off-by: Alexandre Torgue commit 372c9dc0b2dd7f930743bbe0fa0210cc6ee65fc9 Author: Christophe Parant Date: Wed Dec 10 11:16:03 2025 +0100 dt-bindings: arm: stm32: Modify STM32MP15x Phytec board items types As Phytec manages different SoM configurations with different STM32MP15 SoC versions, modify the phyBOARD and SoM compatible items to "enum" instead of "const". The description concerns PHYTEC SoM equipped with STM32MP157 ("st,stm32mp157" is "const"). Also add comments in front of the enum items to be able to identify the compatible string with the phyBOARD/phyCORE names. Signed-off-by: Christophe Parant Link: https://lore.kernel.org/r/20251210101611.27008-4-c.parant@phytec.fr Signed-off-by: Alexandre Torgue commit a620efc8ab18938ea37e557f419c8b9e9bd26e1b Author: Christophe Parant Date: Wed Dec 10 11:16:02 2025 +0100 ARM: dts: stm32: phyboard-sargas: Introduce SoM device tree Add stm32mp15xx-phycore-som.dtsi device tree file to split hardware features between the phyBOARD (baseboard) and the phyCORE (SoM). Signed-off-by: Christophe Parant Link: https://lore.kernel.org/r/20251210101611.27008-3-c.parant@phytec.fr Signed-off-by: Alexandre Torgue commit 0c212fb9f58f36c0a7a080fa8d86fecd0016f50e Author: Christophe Parant Date: Wed Dec 10 11:16:01 2025 +0100 ARM: dts: stm32: phycore-stm32mp15: Rename device tree files Rename "stm32mp157c-phycore-*" device tree for the following reasons: - The name of the dts should match to the phyBOARD name and not the name of the SoM ("phycore-stm32mp1-3" was initialy coming from the name of the yocto machine from meta-phytec). - PHYTEC manages different SoM configurations with different STM32MP15x SoC versions, so common dtsi files starting with "stm32mp15xx-*" should be used (as it is done for ST boards for example). - Add "-rdk" as suffix (for "Rapid Development Kit") to match our others phytec boards dts names (imx6, imx6ul,..). - "model" property is updated to introduce the name "phyBOARD-Sargas". Signed-off-by: Christophe Parant Link: https://lore.kernel.org/r/20251210101611.27008-2-c.parant@phytec.fr Signed-off-by: Alexandre Torgue commit 08e6183ed2568e733e05e7e1c9de737d91c21155 Author: Johannes Berg Date: Thu Feb 26 18:36:07 2026 +0100 wifi: move action code from per-type frame structs The action code actually serves to identify the type of action frame, so it really isn't part of the per-type structure. Pull it out and have it in the general action frame format. In theory, whether or not the action code is present in this way is up to each category, but all categories that are defined right now all have that value. While at it, and since this change requires changing all users, remove the 'u' and make it an anonymous union in this case, so that all code using this changes. Change IEEE80211_MIN_ACTION_SIZE to take an argument which says how much of the frame is needed, e.g. category, action_code or the specific frame type that's defined in the union. Again this also ensures that all code is updated. In some cases, fix bugs where the SKB length was checked after having accessed beyond the checked length, in particular in FTM code, e.g. ieee80211_is_ftm(). Link: https://patch.msgid.link/20260226183607.67e71846b59e.I9a24328e3ffcaae179466a935f1c3345029f9961@changeid Signed-off-by: Johannes Berg commit 2c3a9eb1b4f711c00c4358c16a036a2390d9e57c Author: NeilBrown Date: Wed Feb 25 09:16:54 2026 +1100 ovl: Simplify ovl_lookup_real_one() The primary purpose of this patch is to remove the locking from ovl_lookup_real_one() as part of centralising all locking of directories for name operations. The locking here isn't needed. By performing consistency tests after the lookup we can be sure that the result of the lookup was valid at least for a moment, which is all the original code promised. lookup_noperm_unlocked() is used for the lookup and it will take the lock if needed only where it is needed. Also: - don't take a reference to real->d_parent. The parent is only use for a pointer comparison, and no reference is needed for that. - Several "if" statements have a "goto" followed by "else" - the else isn't needed: the following statement can directly follow the "if" as a new statement - Use a consistent pattern of setting "err" before performing a test and possibly going to "fail". - remove the "out" label (now that we don't need to dput(parent) or unlock) and simply return from fail:. Reviewed-by: Jeff Layton Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-10-neilb@ownmail.net Signed-off-by: Christian Brauner commit 336faf5d9115ca6982b82cf122e68738ea8c4173 Author: NeilBrown Date: Wed Feb 25 09:16:53 2026 +1100 VFS: make lookup_one_qstr_excl() static. lookup_one_qstr_excl() is no longer used outside of namei.c, so make it static. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-9-neilb@ownmail.net Signed-off-by: Christian Brauner commit 6cb3411962c884c628ec198c654bab79a5500ccc Author: NeilBrown Date: Wed Feb 25 09:16:52 2026 +1100 nfsd: switch purge_old() to use start_removing_noperm() Rather than explicit locking, use the start_removing_noperm() and end_removing() wrappers. This was not done with other start_removing changes due to conflicting in-flight patches. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-8-neilb@ownmail.net Signed-off-by: Christian Brauner commit c4573e18e286c5741f52b12de2b1fe791b614f9a Author: NeilBrown Date: Wed Feb 25 09:16:51 2026 +1100 selinux: Use simple_start_creating() / simple_done_creating() Instead of explicitly locking the parent and performing a lookup in selinux, use simple_start_creating(), and then use simple_done_creating() to unlock. This extends the region that the directory is locked for, and also performs a lookup. The lock extension is of no real consequence. The lookup uses simple_lookup() and so always succeeds. Thus when d_make_persistent() is called the dentry will already be hashed. d_make_persistent() handles this case. Reviewed-by: Jeff Layton Acked-by: Paul Moore Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-7-neilb@ownmail.net Signed-off-by: Christian Brauner commit 5c6c7ae93236ee46be8e9ac396af2de5d222986c Author: NeilBrown Date: Wed Feb 25 09:16:50 2026 +1100 Apparmor: Use simple_start_creating() / simple_done_creating() Instead of explicitly locking the parent and performing a look up in apparmor, use simple_start_creating(), and then simple_done_creating() to unlock and drop the dentry. This removes the need to check for an existing entry (as simple_start_creating() acts like an exclusive create and can return -EEXIST), simplifies error paths, and keeps dir locking code centralised. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-6-neilb@ownmail.net Signed-off-by: Christian Brauner commit 1948172bddabef7f9ca46d3e965e71eb93a0dcc5 Author: NeilBrown Date: Wed Feb 25 09:16:49 2026 +1100 libfs: change simple_done_creating() to use end_creating() simple_done_creating() and end_creating() are identical. So change the former to use the latter. This further centralises unlocking of directories. Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-5-neilb@ownmail.net Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit 4eb94abd6bc8989d7478b9fdbff4dab5abc11ef7 Author: NeilBrown Date: Wed Feb 25 09:16:48 2026 +1100 VFS: move the start_dirop() kerndoc comment to before start_dirop() This kerneldoc comment was always meant for start_dirop(), not for __start_dirop() which is a static function and doesn't need documentation. It was in the wrong place and was then incorrectly renamed (instead of moved) and useless "documentation" was added for "@state" was provided. This patch reverts the name, removes the mention of @state, and moves the comment to where it belongs. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-4-neilb@ownmail.net Signed-off-by: Christian Brauner commit 9ab68389843a434d7d49e2a986ebf6d01d81ae42 Author: NeilBrown Date: Wed Feb 25 09:16:47 2026 +1100 fs/proc: Don't lock root inode when creating "self" and "thread-self" proc_setup_self() and proc_setup_thread_self() are only called from proc_fill_super() which is before the filesystem is "live". So there is no need to lock the root directory when adding "self" and "thread-self". This is clear from simple_fill_super() which provides similar functionality for other filesystems and does not lock anything. The locking is not harmful, except that it may be confusing to a reader. As part of an effort to centralise all locking for directories for name-based operations (prior to changing some locking rules), it is simplest to remove the locking here. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-3-neilb@ownmail.net Signed-off-by: Christian Brauner commit c025a53314127b8cd236201bed765be0df5cf1eb Author: NeilBrown Date: Wed Feb 25 09:16:46 2026 +1100 VFS: note error returns in documentation for various lookup functions Darrick recently noted that try_lookup_noperm() is documented as "Look up a dentry by name in the dcache, returning NULL if it does not currently exist." but it can in fact return an error. So update the documentation for that and related functions. Link: https://lore.kernel.org/all/20260218234917.GA6490@frogsfrogsfrogs/ Cc: Darrick J. Wong Signed-off-by: NeilBrown Link: https://patch.msgid.link/20260224222542.3458677-2-neilb@ownmail.net Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit 67549df87fff2a3dc7639439e4aff128b814f109 Author: Louis-Alexis Eyraud Date: Tue Mar 3 12:58:05 2026 +0100 dt-bindings: arm: mediatek: audsys: fix formatting issues Fix indentation and drop duplicate newline to resolve the following 'make dt_binding_check' warnings: ``` ./Documentation/devicetree/bindings/arm/mediatek/mediatek,audsys.yaml:52:2: [warning] wrong indentation: expected 2 but found 1 (indentation) ./Documentation/devicetree/bindings/arm/mediatek/mediatek,audsys.yaml:84:1: [warning] too many blank lines (2 > 1) (empty-lines) ``` Fixes: a8e3d66ff5c0 ("dt-bindings: arm: mediatek: audsys: Support mt8192-audsys variant") Signed-off-by: Louis-Alexis Eyraud Acked-by: Conor Dooley Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit f227b246307e0cf3091e13e7fbae3974aaf38eb9 Author: Qiang Yu Date: Tue Mar 3 01:02:14 2026 -0800 bus: mhi: host: pci_generic: Add pm_runtime_forbid() in remove callback Add pm_runtime_forbid() to balance the pm_runtime_allow() call made during Mission Mode transition. Without this, the device remains in runtime PM allowed state even after driver removal. Fixes: 855a70c12021 ("bus: mhi: Add MHI PCI support for WWAN modems") Signed-off-by: Qiang Yu [mani: moved pm_runtime_forbid() to the start of remove()] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260303-b4-async_power_on-v2-2-d3db81eb457d@oss.qualcomm.com commit cfdb41adf1c2822ad1b1791d4d11093edb5582b6 Author: Qiang Yu Date: Tue Mar 3 01:02:13 2026 -0800 bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays Some modem devices can take significant time (up to 20 secs for sdx75) to enter mission mode during initialization. Currently, mhi_sync_power_up() waits for this entire process to complete, blocking other driver probes and delaying system boot. Switch to mhi_async_power_up() so probe can return immediately while MHI initialization continues in the background. This eliminates lengthy boot delays and allows other drivers to probe in parallel, improving overall system boot performance. Fixes: 5571519009d0 ("bus: mhi: host: pci_generic: Add SDX75 based modem support") Signed-off-by: Qiang Yu Signed-off-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260303-b4-async_power_on-v2-1-d3db81eb457d@oss.qualcomm.com commit 54b022f162a7f9b7c4f2b3902e4873d74f8d0875 Author: Daniele Palmas Date: Thu Mar 5 10:44:04 2026 +0100 bus: mhi: host: pci_generic: Add NMEA channels to FN920C04 and FN990A Add NMEA channels to Telit FN920C04 and FN990A configuration. Signed-off-by: Daniele Palmas Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260305094404.1956028-1-dnlplm@gmail.com commit 8bd1254c92c92382114ff9b3b727d5cb81167df7 Author: Vivek Pernamitta Date: Thu Feb 12 16:30:23 2026 +0530 bus: mhi: host: pci_generic: Enable IP_SW and IP_ETH channels for Qcom QDU100 device Enable IP_SW1 (ch:48/49), IP_ETH0 (ch:50,51) and IP_ETH1 (ch:52, 53) channels over MHI for M-plane, NETCONF and S-plane interface for Qualcomm 5G DU X100 Accelerator Card (QDU100). M-plane: Used to implement DU M-Plane software for non-real-time O-RAN management between O-DU and O-RU using NETCONF/YANG and O-RAN WG4 M-Plane YANG models. It provides capability exchange, configuration management, performance monitoring, and fault management per O-RAN.WG4.TS.MP.0-R004-v18.00 spec. Netconf: Used for configuration operations such as fetching, modifying, and deleting network device configurations. This interface is also used for IETF Netconf communication, with a Netconf server on the ORU to interact with a Netconf client running on the host. S-plane: To support frequency and time synchronization between O-DUs and O-RUs using Synchronous Ethernet and IEEE 1588. Assume PTP transport over L2 Ethernet (ITU-T G.8275.1) for full timing support and to allow PTP over UDP/IP (ITU-T G.8275.2) with reduced reliability, as per ORAN spec O-RAN.WG4.CUS.0-R003-v12.00. Signed-off-by: Vivek Pernamitta [mani: commit log] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260212-eth_vdev_next-20260211-v8-2-0974b3a8d61b@qti.qualcomm.com commit 54a66e431eeacf23e1dc47cb3507f2d0c068aaf0 Author: Xie Yuanbin Date: Tue Feb 17 00:49:49 2026 +0800 sched/headers: Inline raw_spin_rq_unlock() raw_spin_rq_unlock() is short, and is called in some hot code paths such as finish_lock_switch(). Inline raw_spin_rq_unlock() to micro-optimize performance a bit. Signed-off-by: Xie Yuanbin Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20260216164950.147617-3-qq570070308@gmail.com commit 4b9ef32c57a68eb98c45835c2beaa77f8e51c5c4 Author: Xie Yuanbin Date: Tue Feb 17 00:49:48 2026 +0800 x86/mm/tlb: Make enter_lazy_tlb() always inline on x86 enter_lazy_tlb() on x86 is short enough, and is called in context switching, which is the hot code path. Make enter_lazy_tlb() always inline on x86 to optimize performance. Suggested-by: Dave Hansen Signed-off-by: Xie Yuanbin Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20260216164950.147617-2-qq570070308@gmail.com commit 12f8069115d5ff9d292c6b00c74e1984b01b6fc1 Merge: 2e7af192697ef2 5ee8dbf54602dc Author: Ingo Molnar Date: Fri Mar 6 06:21:02 2026 +0100 Merge branch 'linus' into sched/core, to resolve conflicts Conflicts: kernel/sched/ext.c Signed-off-by: Ingo Molnar commit eef9f648fb0e92618041f019d4bdcf7ae17cb743 Author: Ingo Molnar Date: Mon Mar 2 11:26:12 2026 +0000 sched/hrtick: Mark hrtick_clear() as always used This recent commit: 96d1610e0b20b ("sched: Optimize hrtimer handling") introduced a new build warning when !CONFIG_HOTPLUG_CPU while SCHED_HRTIMERS=y [ == HIGH_RES_TIMERS=y ]: /tip.testing/kernel/sched/core.c:882:13: warning: ‘hrtick_clear’ defined but not used [-Wunused-function] Mark this helper function as always-used, instead of complicating the code with another obscure #ifdef. Fixes: 96d1610e0b20b ("sched: Optimize hrtimer handling") Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Thomas Gleixner Link: https://patch.msgid.link/177245077226.1647592.1821545206171336606.tip-bot2@tip-bot2 commit 27d58498f690ab39140678df918155a597b3a17a Author: Rafael J. Wysocki Date: Thu Mar 5 20:46:19 2026 +0100 platform/chrome: wilco_ec: event: Convert to a platform driver In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the ChromeOS Wilco Embedded Controller event ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/9600287.CDJkKcVGEf@rafael.j.wysocki Signed-off-by: Tzung-Bi Shih commit 25a06b7a3224161cf4b27049bea93cac21136460 Author: Rafael J. Wysocki Date: Thu Mar 5 20:43:59 2026 +0100 platform/chrome: wilco_ec: event: Register ACPI notify handler To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/7931926.EvYhyI6sBW@rafael.j.wysocki Signed-off-by: Tzung-Bi Shih commit a2676ead257f6cf12e458efc786a68d6ab7c1224 Author: Rafael J. Wysocki Date: Thu Mar 5 20:42:25 2026 +0100 platform/chrome: chromeos_tbmc: Convert to a platform driver In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the ChromeOS tablet mode change (TBMC) ACPI driver to a platform one. After this change, the subordinate input device and wakeup source class device will be registered under the platform device used for driver binding instead of its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/10827297.nUPlyArG6x@rafael.j.wysocki Signed-off-by: Tzung-Bi Shih commit de1260139dbd7610a2f25343c962569b8fe23f8f Author: Rafael J. Wysocki Date: Thu Mar 5 20:39:05 2026 +0100 platform/chrome: chromeos_tbmc: Register ACPI notify handler To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/3413961.aeNJFYEL58@rafael.j.wysocki Signed-off-by: Tzung-Bi Shih commit 5d441a4bc93642ed6f41da87327a39946b4e1455 Author: Rafael J. Wysocki Date: Thu Mar 5 20:47:03 2026 +0100 platform/chrome: chromeos_tbmc: Drop wakeup source on remove The wakeup source added by device_init_wakeup() in chromeos_tbmc_add() needs to be dropped during driver removal, so add a .remove() callback to the driver for this purpose. Fixes: 0144c00ed86b ("platform/chrome: chromeos_tbmc: Report wake events") Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/6151957.MhkbZ0Pkbq@rafael.j.wysocki Signed-off-by: Tzung-Bi Shih commit d3c2872ae323ea45cc32ea0247f26c2189a481cb Author: Rafael J. Wysocki Date: Thu Mar 5 20:37:54 2026 +0100 platform/chrome: Convert ChromeOS privacy-screen driver to platform In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the ChromeOS privacy-screen ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/1963835.tdWV9SEqCh@rafael.j.wysocki Signed-off-by: Tzung-Bi Shih commit 5b30afc20b3fea29b9beb83c6415c4ff06f774aa Author: Tejun Heo Date: Wed Mar 4 11:26:47 2026 -1000 cgroup: Expose some cgroup helpers Expose the following through cgroup.h: - cgroup_on_dfl() - cgroup_is_dead() - cgroup_for_each_live_child() - cgroup_for_each_live_descendant_pre() - cgroup_for_each_live_descendant_post() Until now, these didn't need to be exposed because controllers only cared about the css hierarchy. The planned sched_ext hierarchical scheduler support will be based on the default cgroup hierarchy, which is in line with the existing BPF cgroup support, and thus needs these exposed. Signed-off-by: Tejun Heo commit f3e334fb7f82cd63734faeb395419ab713b4bb5c Author: Ricardo Robaina Date: Tue Mar 3 10:35:28 2026 -0300 audit: fix coding style issues Fix various coding style issues across the audit subsystem flagged by checkpatch.pl script to adhere to kernel coding standards. Specific changes include: - kernel/auditfilter.c: Move the open brace '{' to the previous line for the audit_ops array declaration. - lib/audit.c: Add a required space before the open parenthesis '('. - include/uapi/linux/audit.h: Enclose the complex macro value for AUDIT_UID_UNSET in parentheses. Signed-off-by: Ricardo Robaina Signed-off-by: Paul Moore commit e5e09233e8a9179b260460fdb28df5c24bcfbed6 Author: Antonio Quartulli Date: Wed Mar 4 15:10:09 2026 +0100 tools: ynl: add uns-admin-perm to genetlink GENL_UNS_ADMIN_PERM may be required by protocols using the `genetlink` family, however, this flag is currently only allowed in `genetlink-legacy`. Add it to the list of possible values in genetlink.yaml too. Cc: Simon Horman Cc: Donald Hunter Link: https://github.com/OpenVPN/ovpn-net-next/issues/33 Suggested-by: Ralf Lici Signed-off-by: Antonio Quartulli Link: https://patch.msgid.link/20260304141020.23270-1-antonio@openvpn.net Signed-off-by: Jakub Kicinski commit 7600fb3b41dd6ab65ed61169df1b6099044edf97 Author: Lorenzo Bianconi Date: Wed Mar 4 11:56:47 2026 +0100 net: airoha: Rely __field_prep for non-constant masks Rely on __field_prep macros for non-constant masks preparing the values for register updates instead of open-coding. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260304-airoha-__field_prep-v1-1-b185facc4e2f@kernel.org Signed-off-by: Jakub Kicinski commit 8844de1037dd5fd39f4843cd58bdac763f6edaca Merge: d4d8c6e6fd2a1c 48575b6e16d123 Author: Jakub Kicinski Date: Thu Mar 5 18:56:53 2026 -0800 Merge branch 'net-cadence-macb-add-ieee-802-3az-eee-support' Nicolai Buchwitz says: ==================== net: cadence: macb: add IEEE 802.3az EEE support Add Energy Efficient Ethernet (IEEE 802.3az) support to the Cadence GEM (macb) driver using phylink's managed EEE framework. The GEM MAC has hardware LPI registers but no built-in idle timer, so the driver implements software-managed TX LPI using a delayed_work timer while delegating EEE negotiation and ethtool state to phylink. The series is structured as follows: 1. LPI statistics: Expose the four hardware EEE counters (RX/TX LPI transitions and time) through ethtool -S, accumulated in software since they are clear-on-read. Adds register offset definitions GEM_RXLPI/RXLPITIME/TXLPI/TXLPITIME (0x270-0x27c). 2. TX LPI engine: Introduces GEM_TXLPIEN (NCR bit 19) and MACB_CAPS_EEE alongside the implementation that uses them. phylink mac_enable_tx_lpi / mac_disable_tx_lpi callbacks with a delayed_work-based idle timer. LPI entry is deferred 1 second after link-up per IEEE 802.3az. Wake before transmit with a conservative 50us PHY wake delay (IEEE 802.3az Tw_sys_tx). 3. ethtool EEE ops: get_eee/set_eee delegating to phylink for PHY negotiation and timer management. 4. RP1 enablement: Set MACB_CAPS_EEE for the Raspberry Pi 5's RP1 southbridge (Cadence GEM_GXL rev 0x00070109 + BCM54213PE PHY). 5. EyeQ5 enablement: Set MACB_CAPS_EEE for the Mobileye EyeQ5 GEM instance, verified with a hardware loopback by Théo Lebrun. Tested on Raspberry Pi 5 (1000BASE-T, BCM54213PE PHY, 250ms LPI timer): iperf3 throughput (no regression): TCP TX: 937.8 Mbit/s (EEE on) vs 937.0 Mbit/s (EEE off) TCP RX: 936.5 Mbit/s both Latency (ping RTT, small expected increase from LPI wake): 1s interval: 0.273 ms (EEE on) vs 0.181 ms (EEE off) 10ms interval: 0.206 ms (EEE on) vs 0.168 ms (EEE off) flood ping: 0.200 ms (EEE on) vs 0.156 ms (EEE off) LPI counters (ethtool -S, 1s-interval ping, EEE on): tx_lpi_transitions: 112 tx_lpi_time: 15574651 Zero packet loss across all tests. Also verified with ethtool --show-eee / --set-eee and cable unplug/replug cycling. ==================== Link: https://patch.msgid.link/20260304105432.631186-1-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit 48575b6e16d12365d6a69de13d061d9df2b775ec Author: Nicolai Buchwitz Date: Wed Mar 4 11:54:32 2026 +0100 net: cadence: macb: enable EEE for Mobileye EyeQ5 Set MACB_CAPS_EEE for the Mobileye EyeQ5 GEM instance. EEE has been verified on EyeQ5 hardware using a loopback setup with ethtool --show-eee confirming EEE active on both ends at 100baseT/Full and 1000baseT/Full. Tested-by: Théo Lebrun Signed-off-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260304105432.631186-6-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit 92ba3307431a1756a3c8094787527a38ce19623d Author: Nicolai Buchwitz Date: Wed Mar 4 11:54:31 2026 +0100 net: cadence: macb: enable EEE for Raspberry Pi RP1 Set MACB_CAPS_EEE for the Raspberry Pi 5 RP1 southbridge (Cadence GEM_GXL rev 0x00070109 paired with BCM54213PE PHY). EEE has been verified on RP1 hardware: the LPI counter registers at 0x270-0x27c return valid data, the TXLPIEN bit in NCR (bit 19) controls LPI transmission correctly, and ethtool --show-eee reports the negotiated state after link-up. Other GEM variants that share the same LPI register layout (SAMA5D2, SAME70, PIC32CZ) can be enabled by adding MACB_CAPS_EEE to their respective config entries once tested. Reviewed-by: Claudiu Beznea Reviewed-by: Théo Lebrun Signed-off-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260304105432.631186-5-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit 61332b78761cb1638e2bf29273050cf009fbbc0e Author: Nicolai Buchwitz Date: Wed Mar 4 11:54:30 2026 +0100 net: cadence: macb: add ethtool EEE support Implement get_eee and set_eee ethtool ops for GEM as simple passthroughs to phylink_ethtool_get_eee() and phylink_ethtool_set_eee(). No MACB_CAPS_EEE guard is needed: phylink returns -EOPNOTSUPP from both ops when mac_supports_eee is false, which is the case when lpi_capabilities and lpi_interfaces are not populated. Those fields are only set when MACB_CAPS_EEE is present (previous patch), so phylink already handles the unsupported case correctly. Reviewed-by: Claudiu Beznea Reviewed-by: Théo Lebrun Signed-off-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260304105432.631186-4-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit 0cc425f18f59f992c61c1802331d25ce689ff5d1 Author: Nicolai Buchwitz Date: Wed Mar 4 11:54:29 2026 +0100 net: cadence: macb: implement EEE TX LPI support The GEM MAC has hardware LPI registers (NCR bit 19: TXLPIEN) but no built-in idle timer, so asserting TXLPIEN blocks all TX immediately with no automatic wake. A software idle timer is required, as noted in Microchip documentation (section 40.6.19): "It is best to use firmware to control LPI." Implement phylink managed EEE using the mac_enable_tx_lpi and mac_disable_tx_lpi callbacks: - macb_tx_lpi_set(): sets or clears TXLPIEN; requires bp->lock to be held by the caller (asserted with lockdep_assert_held). Returns bool indicating whether the register actually changed, avoiding redundant writes and unnecessary udelay on the xmit fast path. - macb_tx_lpi_work_fn(): delayed_work handler that enters LPI if all TX queues are idle and EEE is still active. Takes bp->lock with irqsave before calling macb_tx_lpi_set(). - macb_tx_lpi_schedule(): arms the work timer using the LPI timer value provided by phylink (default 250 ms). Called from macb_tx_complete() after each TX drain so the idle countdown restarts whenever the ring goes quiet. - macb_tx_lpi_wake(): called from macb_start_xmit() under bp->lock, immediately before TSTART. Returns early if eee_active is false to avoid a register read on the common path when EEE is disabled. Clears TXLPIEN and applies a 50 us udelay for PHY wake (IEEE 802.3az Tw_sys_tx is 16.5 us for 1000BASE-T / 30 us for 100BASE-TX; GEM has no hardware enforcement). Only delays when TXLPIEN was actually set. The delay is placed after tx_head is advanced so the work_fn's queue-idle check sees a non-empty ring and cannot race back into LPI before the frame is transmitted. - mac_enable_tx_lpi: stores the timer and sets eee_active under bp->lock, then defers the first LPI entry by 1 second per IEEE 802.3az section 22.7a. - mac_disable_tx_lpi: cancels the work (sync, without the lock to avoid deadlock with the work_fn), then takes bp->lock to clear eee_active and deassert TXLPIEN. Populate phylink_config lpi_interfaces (MII, GMII, RGMII variants) and lpi_capabilities (MAC_100FD | MAC_1000FD) so phylink can negotiate EEE with the PHY and call the callbacks appropriately. Set lpi_timer_default to 250000 us and eee_enabled_default to true. Reviewed-by: Claudiu Beznea Reviewed-by: Théo Lebrun Signed-off-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260304105432.631186-3-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit 237577e603cedc8910fc61c774b47eb1fc18eef9 Author: Nicolai Buchwitz Date: Wed Mar 4 11:54:28 2026 +0100 net: cadence: macb: add EEE LPI statistics counters The GEM MAC provides four read-only, clear-on-read LPI statistics registers at offsets 0x270-0x27c: GEM_RXLPI (0x270): RX LPI transition count (16-bit) GEM_RXLPITIME (0x274): cumulative RX LPI time (24-bit) GEM_TXLPI (0x278): TX LPI transition count (16-bit) GEM_TXLPITIME (0x27c): cumulative TX LPI time (24-bit) Add register offset definitions, extend struct gem_stats with corresponding u64 software accumulators, and register the four counters in gem_statistics[] so they appear in ethtool -S output. Because the hardware counters clear on read, the existing macb_update_stats() path accumulates them into the u64 fields on every stats poll, preventing loss between userspace reads. These registers are present on SAMA5D2, SAME70, PIC32CZ, and RP1 variants of the Cadence GEM IP and have been confirmed on RP1 via devmem reads. Reviewed-by: Claudiu Beznea Reviewed-by: Théo Lebrun Signed-off-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260304105432.631186-2-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit d4d8c6e6fd2a1c5144339884ca5f66e654ad54a5 Author: Kuniyuki Iwashima Date: Tue Mar 3 23:54:16 2026 +0000 tcp: Initialise ehash secrets during connect() and listen(). inet_ehashfn() and inet6_ehashfn() initialise random secrets on the first call by net_get_random_once(). While the init part is patched out using static keys, with CONFIG_STACKPROTECTOR_STRONG=y, this causes a compiler to generate a stack canary due to an automatic variable, unsigned long ___flags, in the DO_ONCE() macro being passed to __do_once_start(). With FDO, this is visible in __inet_lookup_established() and __inet6_lookup_established() too. Let's initialise the secrets by get_random_sleepable_once() in the slow paths: inet_hash() for listen(), and inet_hash_connect() and inet6_hash_connect() for connect(). Note that IPv6 listener will initialise both IPv4 & IPv6 secrets in inet_hash() for IPv4-mapped IPv6 address. With the patch, the stack size is reduced by 16 bytes (___flags + a stack canary) and NOPs for the static key go away. Before: __inet6_lookup_established() ... push %rbx sub $0x38,%rsp # stack is 56 bytes mov %edx,%ebx # sport mov %gs:0x299419f(%rip),%rax # load stack canary mov %rax,0x30(%rsp) and store it onto stack mov 0x440(%rdi),%r15 # net->ipv4.tcp_death_row.hashinfo nop 32: mov %r8d,%ebp # hnum shl $0x10,%ebp # hnum << 16 nop 3d: mov 0x70(%rsp),%r14d # sdif or %ebx,%ebp # INET_COMBINED_PORTS(sport, hnum) mov 0x11a8382(%rip),%eax # inet6_ehashfn() ... After: __inet6_lookup_established() ... push %rbx sub $0x28,%rsp # stack is 40 bytes mov 0x60(%rsp),%ebp # sdif mov %r8d,%r14d # hnum shl $0x10,%r14d # hnum << 16 or %edx,%r14d # INET_COMBINED_PORTS(sport, hnum) mov 0x440(%rdi),%rax # net->ipv4.tcp_death_row.hashinfo mov 0x1194f09(%rip),%r10d # inet6_ehashfn() ... Suggested-by: Eric Dumazet Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260303235424.3877267-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit edad504ce16c941d7c6f804c39fd7e3fef0a492d Merge: 2a13309fa840fa 568b370f128ce3 Author: Jakub Kicinski Date: Thu Mar 5 18:49:10 2026 -0800 Merge branch 'doc-netlink-expand-nftables-specification' Remy D. Farley says: ==================== doc/netlink: Expand nftables specification Getting out some changes I've accumulated while making nftables work with Rust netlink-bindings. Hopefully, this will be useful upstream. ==================== Link: https://patch.msgid.link/20260303195638.381642-1-one-d-wide@protonmail.com Signed-off-by: Jakub Kicinski commit 568b370f128ce328cf3750eda5a84080043f97d6 Author: Remy D. Farley Date: Tue Mar 3 20:00:12 2026 +0000 doc/netlink: nftables: Fill out operation attributes Filled out operation attributes: - newtable - gettable - deltable - destroytable - newchain - getchain - delchain - destroychain - newrule - getrule - getrule-reset - delrule - destroyrule - newset - getset - delset - destroyset - newsetelem - getsetelem - getsetelem-reset - delsetelem - destroysetelem - getgen - newobj - getobj - delobj - destroyobj - newflowtable - getflowtable - delflowtable - destroyflowtable Signed-off-by: Remy D. Farley Link: https://patch.msgid.link/20260303195638.381642-6-one-d-wide@protonmail.com Signed-off-by: Jakub Kicinski commit 27c7ee6d26ddd1a769bdcfb22862ef443da461e8 Author: Remy D. Farley Date: Tue Mar 3 19:59:19 2026 +0000 doc/netlink: nftables: Add sub-messages New sub-messsages: - log - match - numgen - range Reviewed-by: Donald Hunter Signed-off-by: Remy D. Farley Link: https://patch.msgid.link/20260303195638.381642-5-one-d-wide@protonmail.com Signed-off-by: Jakub Kicinski commit 482da27d5274dfe5f2828d150981b966b8f9f3b1 Author: Remy D. Farley Date: Tue Mar 3 19:58:52 2026 +0000 doc/netlink: nftables: Update attribute sets New attribute sets: - log-attrs - numgen-attrs - range-attrs - compat-target-attrs - compat-match-attrs - compat-attrs Added missing attributes: - table-attrs (pad, owner) - set-attrs (type, count) Added missing checks: - range-attrs - expr-bitwise-attrs - compat-target-attrs - compat-match-attrs - compat-attrs Annotated doc comment or associated enum: - batch-attrs - verdict-attrs - expr-payload-attrs Fixed byte order: - nft-counter-attrs - expr-counter-attrs - rule-compat-attrs Reviewed-by: Donald Hunter Signed-off-by: Remy D. Farley Link: https://patch.msgid.link/20260303195638.381642-4-one-d-wide@protonmail.com Signed-off-by: Jakub Kicinski commit a3a54ba4ef2b2f788c45caf02255efd457fbadd0 Author: Remy D. Farley Date: Tue Mar 3 19:58:13 2026 +0000 doc/netlink: nftables: Add definitions New enums/flags: - payload-base - range-ops - registers - numgen-types - log-level - log-flags Added missing enumerations: - bitwise-ops Annotated doc comment or associated enum: - bitwise-ops Reviewed-by: Donald Hunter Signed-off-by: Remy D. Farley Link: https://patch.msgid.link/20260303195638.381642-3-one-d-wide@protonmail.com Signed-off-by: Jakub Kicinski commit bf5a54bc0e3d8962474fcd611f1266eba036232f Author: Remy D. Farley Date: Tue Mar 3 19:57:41 2026 +0000 doc/netlink: netlink-raw: Add max check Add definitions for max check and len-or-limit type, the same as in other specifications. Suggested-by: Donald Hunter Reviewed-by: Donald Hunter Signed-off-by: Remy D. Farley Link: https://patch.msgid.link/20260303195638.381642-2-one-d-wide@protonmail.com Signed-off-by: Jakub Kicinski commit 2a13309fa840fa7d651e6df0e174023003829461 Merge: 46cb1fcdb75b2d 038a8e8eb90d4d Author: Jakub Kicinski Date: Thu Mar 5 18:43:08 2026 -0800 Merge branch 'net-stmmac-qcom-ethqos-further-serdes-reorganisation' Russell King says: ==================== net: stmmac: qcom-ethqos: further serdes reorganisation This is part 2 of the qcom-ethqos series, part 1 and patch 2 of part 2 has now been merged. This part of the series focuses on the generic PHY driver, but these changes have dependencies on the ethernet driver, hence why it will need to go via net-next. Furthermore, subsequent changes depend on these patches. The underlying ideas here are: - get rid of the driver using phy_set_speed() with SPEED_1000 and SPEED_2500 which makes no sense for an ethernet SerDes due to the PCS 8B10B data encoding, which inflates the data rate at the SerDes compared to the MAC. This is replaced with phy_set_mode_ext(). - allow phy_power_on() / phy_set_mode*() to be called in any order. Mohd has tested this series, although not in the resulting merge order. ==================== Link: https://patch.msgid.link/aacD3osfaZkLsGxm@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 038a8e8eb90d4dd06ce6bda825970c71af09f4b0 Author: Russell King (Oracle) Date: Tue Mar 3 15:54:06 2026 +0000 net: stmmac: qcom-ethqos: remove phy_set_mode_ext() after phy_power_on() The call to phy_set_mode_ext() after phy_power_on() was a work-around for the qcom-sgmii-eth SerDes driver that only re-enabled its clocks on phy_power_on() but did not configure the PHY. Now that the SerDes driver fully configures the SerDes at phy_power_on(), there is no need to call phy_set_mode_ext() immediately afterwards. This also means we no longer need to record the previous operating mode of the driver - this is up to the SerDes driver. In any case, the only thing that we care about is the SerDes provides the necessary clocks to the stmmac core to allow it to reset at this point. The actual mode is irrelevant at this point as the correct mode will be configured in ethqos_mac_finish_serdes() just before the network device is brought online. Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Reviewed-by: Vladimir Oltean Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vxS4U-0000000BQXy-1Q1v@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ebe8b48b88ad012cf6067226e184e9173b7ea9d6 Author: Russell King (Oracle) Date: Tue Mar 3 15:54:01 2026 +0000 phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*() Allow any order of the .power_on() and .set_mode*() methods as per the recent discussion. This means phy_power_on() with this SerDes will now restore the previous setup without requiring a subsequent phy_set_mode*() call. Tested-by: Mohd Ayaan Anwar Acked-by: Vinod Koul Reviewed-by: Vladimir Oltean Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vxS4P-0000000BQXs-0vGB@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f82210ce8cb8015a06af48a2732ce17a2e903f71 Author: Russell King (Oracle) Date: Tue Mar 3 15:53:56 2026 +0000 phy: qcom-sgmii-eth: remove qcom_dwmac_sgmii_phy_interface() Now that qcom_dwmac_sgmii_phy_interface() only serves to validate the passed interface mode, combine it with qcom_dwmac_sgmii_phy_validate(), and use qcom_dwmac_sgmii_phy_validate() to validate the mode in qcom_dwmac_sgmii_phy_set_mode(). Tested-by: Mohd Ayaan Anwar Acked-by: Vinod Koul Reviewed-by: Vladimir Oltean Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vxS4K-0000000BQXm-0OJL@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d2b20acdaed80a41fe191e326083fd71007f3456 Author: Russell King (Oracle) Date: Tue Mar 3 15:53:50 2026 +0000 phy: qcom-sgmii-eth: use PHY interface mode for SerDes settings As established in the previous commit, using SPEED_1000 and SPEED_2500 does not make sense for a SerDes due to the PCS encoding that is used over the SerDes link, which inflates the data rate at the SerDes. Thus, the use of these constants in a SerDes driver is incorrect. Since qcom-sgmii-eth no longer implements phy_set_speed(), but instead uses the PHY interface mode passed via the .set_mode() method, convert the driver to use the PHY interface mode internally to decide whether to configure the SerDes for 1.25Gbps or 3.125Gbps mode. Tested-by: Mohd Ayaan Anwar Acked-by: Vinod Koul Reviewed-by: Vladimir Oltean Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vxS4E-0000000BQXg-46dJ@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b7721597547de9e5cfaf0fc3f2720891f207ec77 Author: Russell King (Oracle) Date: Tue Mar 3 15:53:45 2026 +0000 phy: qcom-sgmii-eth: remove .set_speed() implementation Now that the qcom-ethqos driver has migrated to use phy_set_mode_ext() rather than phy_set_speed() to configure the SerDes, the support for phy_set_speed() is now obsolete. Remove support for this method. Using the MAC speed for the SerDes is never correct due to the PCS encoding. For SGMII and 2500BASE-X, the PCS uses 8B10B encoding, and so: MAC rate * PCS output bits / PCS input bits = SerDes rate 1000M * 10 / 8 = 1250M 2500M * 10 / 8 = 3125M Tested-by: Mohd Ayaan Anwar Acked-by: Vinod Koul Reviewed-by: Vladimir Oltean Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vxS49-0000000BQXa-3Zcg@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 4999e0a2ab3464eb9e9aef141298123630d689e8 Author: Russell King (Oracle) Date: Tue Mar 3 15:53:40 2026 +0000 net: stmmac: qcom-ethqos: convert to use phy_set_mode_ext() qcom-sgmii-eth now accepts the phy_set_mode*() calls to configure the SerDes, taking a PHY interface mode rather than a speed. This allows the elimination of the interface mode to speed conversion in ethqos_mac_finish_serdes(). Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Reviewed-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1vxS44-0000000BQXU-38lG@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit fc8ca5da896e22d29837f40032c08c486dcda76a Author: Russell King (Oracle) Date: Tue Mar 3 15:53:35 2026 +0000 net: stmmac: qcom-ethqos: move ethqos_set_serdes_speed() Combine ethqos_set_serdes_speed() with ethqos_mac_finish_serdes() to simplify the code. Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vxS3z-0000000BQXO-2WpU@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 46cb1fcdb75b2dab2f3ed62caad04fe939549943 Author: Eric Dumazet Date: Wed Mar 4 02:27:06 2026 +0000 tcp: move tcp_v6_early_demux() to net/ipv6/ip6_input.c tcp_v6_early_demux() has a single caller : ip6_rcv_finish_core(). Move it to net/ipv6/ip6_input.c and mark it static, for possible compiler/linker optimizations. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260304022706.1062459-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 54f5a89da9e083322a0af171126020d509593414 Author: Alok Tiwari Date: Wed Mar 4 11:57:36 2026 -0800 net: mdio: xgene: Fix misleading err message in xgene mdio read xgene_xfi_mdio_read() prints "write failed" when the MDIO management interface remains busy and the read times out. Update the message to "read failed" to match the operation. Signed-off-by: Alok Tiwari Reviewed-by: Andrew Lunn Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260304195755.2468204-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 58a4c3e8006504bf18e0ddd2dcba6f414bed7680 Author: Alok Tiwari Date: Wed Mar 4 11:39:48 2026 -0800 octeontx2-af: make PF_FUNC comparison consistent in NIX XOFF handling nix_smq_flush_enadis_xoff() compares PF_FUNC values with the FUNC bits masked off, but one operand applied the mask before extracting PF_FUNC via TXSCH_MAP_FUNC(). Apply RVU_PFVF_FUNC_MASK after TXSCH_MAP_FUNC() for the TL2 scheduler queue operand, matching the existing handling of the other operand and making the comparison consistent and clearer. No functional change intended. Signed-off-by: Alok Tiwari Reviewed-by: Subbaraya Sundeep Link: https://patch.msgid.link/20260304193950.2467391-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit cfcceb7a39fc10a6f896af8229bf81d96acb22cc Author: Keita Morisaki Date: Wed Mar 4 20:15:17 2026 +0900 tcp: shrink per-packet memset in __tcp_transmit_skb() Use struct_group() to group the three fields in tcp_out_options that are read unconditionally by tcp_options_write() and bpf_skops_write_hdr_opt() (mss, bpf_opt_len, num_sack_blocks), then replace the full-struct memset with a targeted memset of only that group. struct tcp_out_options is 40 bytes without MPTCP and 96 bytes with CONFIG_MPTCP=y (typical distro config). Every remaining field is either assigned before first use by tcp_established_options()/tcp_syn_options(), or gated behind its OPTION_* flag in tcp_options_write(). This memset runs on every transmitted TCP packet, so shrinking it from 96 (or 40) bytes to 4 bytes reduces per-packet overhead on the hot path. Assembly comparison (x86-64, GCC 13, CONFIG_MPTCP=y): Before: rep stos zeroing 96 bytes (5 instructions, 12 8-byte stores) After: movl $0x0 zeroing 4 bytes (1 instruction, 1 store) Also add opts->options = 0 at the top of tcp_syn_options(), which already used |= without a prior clear. tcp_established_options() already clears opts->options at its top. Reviewed-by: Jakub Sitnicki Signed-off-by: Keita Morisaki Acked-by: Matthieu Baerts (NGI0) Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260304111517.2088694-1-kmta1236@gmail.com Signed-off-by: Jakub Kicinski commit 752941e3faf6be26c6b5a118e37bdbaea2b97171 Author: Kryštof Černý Date: Wed Mar 4 13:03:10 2026 +0100 net: phy: realtek: Add support for PHY LEDs on RTL8211F-VD Realtek RTL8211F-VD has the same LED configuration and registers as RTL8211F. Use the existing LED related functions for this chip, so it is possible to also use the netdev trigger. Tested on ROCK Pi E. Signed-off-by: Kryštof Černý Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260304-rtl8211fvd-add-leds-v2-1-d50bd8a50f08@gmail.com Signed-off-by: Jakub Kicinski commit adcf290f9de2fc4768e5ba07c700e91faf9c86bf Author: Andreas Kemnade Date: Fri Feb 20 19:43:36 2026 +0100 arm: multi_v7_defconfig: Enable more OMAP 3/4 related configs Enable drivers commonly used for these boards. - CONFIG_*TWL*: PMIC mostly used on these devices so enable all functions. Especially charging is required to avoid having battery drained. - missing SoC functions (watchdog, thermal, sound) - TI WiLink chipset support to provide WLAN for - GTA04A5, Pandaboards, OpenPandora, Moverio BT200 - HCILL to provide Bluetooth on boards with TI WiLink combo chips - TCA6507 LEDs: some are used as GPIO os GTA04A4 to provide Power. Signed-off-by: Andreas Kemnade Acked-by: Aaro Koskinen Link: https://patch.msgid.link/20260220184336.616623-1-andreas@kemnade.info Signed-off-by: Kevin Hilman commit de70eef32e10883fe74f6df635c616785b24b867 Author: Randy Dunlap Date: Wed Feb 25 21:13:09 2026 -0800 ARM: omap: fix all kernel-doc warnings Use the correct struct member names to avoid kernel-doc warnings: Warning: include/linux/platform_data/voltage-omap.h:27 struct member 'volt_nominal' not described in 'omap_volt_data' Warning: include/linux/platform_data/voltage-omap.h:27 struct member 'vp_errgain' not described in 'omap_volt_data' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260226051309.556228-1-rdunlap@infradead.org Signed-off-by: Kevin Hilman commit 5156a8d92cebb531c320c7cec7e527e40232b922 Author: Thorsten Blum Date: Tue Feb 24 15:45:51 2026 +0100 ARM: omap2: Replace scnprintf with strscpy in omap3_cpuinfo Replace scnprintf("%s", ...) with the faster and more direct strscpy(). Signed-off-by: Thorsten Blum Reviewed-by: Andreas Kemnade Link: https://patch.msgid.link/20260224144552.585272-1-thorsten.blum@linux.dev Signed-off-by: Kevin Hilman commit 0616bdf083dbb4c4cbe27615c4c371689291d0ea Author: Kory Maincent (TI) Date: Mon Feb 16 17:55:53 2026 +0100 ARM: multi_v7_defconfig: omap2plus_defconfig: Enable ITE IT66121 driver Enable the ITE IT66121 HDMI bridge driver to support HDMI output on the BeagleBone Green with the Seeed Studio HDMI cape. Enable CONFIG_DRM_TILCDC as a module on multi_v7_defconfig to provide display support for TI AM335x-based SoCs in this kernel configuration. Signed-off-by: Kory Maincent (TI) Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260216-feature_bbge-v2-2-22805cfdbf62@bootlin.com Signed-off-by: Kevin Hilman commit 01aab7e1c9d450a5bc7f09e6132b8dbbacf87586 Author: Riana Tauro Date: Wed Mar 4 13:14:12 2026 +0530 drm/xe/xe_hw_error: Add support for PVC SoC errors Report the SoC nonfatal/fatal hardware error and update the counters. $ sudo ynl --family drm_ras --do get-error-counter \ --json '{"node-id":0, "error-id":2}' {'error-id': 2, 'error-name': 'soc-internal', 'error-value': 0} Co-developed-by: Himal Prasad Ghimiray Signed-off-by: Himal Prasad Ghimiray Signed-off-by: Riana Tauro Reviewed-by: Raag Jadav Link: https://patch.msgid.link/20260304074412.464435-12-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit 9b2c89ddd961c188ddd8252a1b01d62ab50f6b95 Author: Riana Tauro Date: Wed Mar 4 13:14:11 2026 +0530 drm/xe/xe_hw_error: Add support for Core-Compute errors PVC supports GT error reporting via vector registers along with error status register. Add support to report these errors and update respective counters. Incase of Subslice error reported by vector register, process the error status register for applicable bits. The counter is embedded in the xe drm ras structure and is exposed to the userspace using the drm_ras generic netlink interface. $ sudo ynl --family drm_ras --do get-error-counter \ --json '{"node-id":0, "error-id":1}' {'error-id': 1, 'error-name': 'core-compute', 'error-value': 0} Co-developed-by: Himal Prasad Ghimiray Signed-off-by: Himal Prasad Ghimiray Signed-off-by: Riana Tauro Reviewed-by: Raag Jadav Link: https://patch.msgid.link/20260304074412.464435-11-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit 63f687362fbabe13006713208bf4131d897b821e Author: Riana Tauro Date: Wed Mar 4 13:14:10 2026 +0530 drm/xe/xe_hw_error: Integrate DRM RAS with hardware error handling Initialize DRM RAS in hw error init. Map the UAPI error severities with the hardware error severities and refactor file. Signed-off-by: Riana Tauro Reviewed-by: Raag Jadav Link: https://patch.msgid.link/20260304074412.464435-10-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit b40db12b542f503b5ec689d18d473299d49eeb60 Author: Riana Tauro Date: Wed Mar 4 13:14:09 2026 +0530 drm/xe/xe_drm_ras: Add support for XE DRM RAS Allocate correctable, uncorrectable nodes for every xe device. Each node contains error component, counters and respective query counter functions. Add basic functionality to create and register drm nodes. Below operations can be performed using Generic netlink DRM RAS interface: 1) List Nodes: $ sudo ynl --family drm_ras --dump list-nodes [{'device-name': '0000:03:00.0', 'node-id': 0, 'node-name': 'correctable-errors', 'node-type': 'error-counter'}, {'device-name': '0000:03:00.0', 'node-id': 1, 'node-name': 'uncorrectable-errors', 'node-type': 'error-counter'}] 2) Get Error counters: $ sudo ynl --family drm_ras --dump get-error-counter --json '{"node-id":0}' [{'error-id': 1, 'error-name': 'core-compute', 'error-value': 0}, {'error-id': 2, 'error-name': 'soc-internal', 'error-value': 0}] 3) Get specific Error counter: $ sudo ynl --family drm_ras --do get-error-counter --json '{"node-id":0, "error-id":1}' {'error-id': 1, 'error-name': 'core-compute', 'error-value': 0} Signed-off-by: Riana Tauro Reviewed-by: Raag Jadav Link: https://patch.msgid.link/20260304074412.464435-9-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit c36218dc49f5e9ef9e3074670fdae7ac3a7e794f Author: Rodrigo Vivi Date: Wed Mar 4 13:14:08 2026 +0530 drm/ras: Introduce the DRM RAS infrastructure over generic netlink Introduces the DRM RAS infrastructure over generic netlink. The new interface allows drivers to expose RAS nodes and their associated error counters to userspace in a structured and extensible way. Each drm_ras node can register its own set of error counters, which are then discoverable and queryable through netlink operations. This lays the groundwork for reporting and managing hardware error states in a unified manner across different DRM drivers. Currently it only supports error-counter nodes. But it can be extended later. The registration is also not tied to any drm node, so it can be used by accel devices as well. It uses the new and mandatory YAML description format stored in Documentation/netlink/specs/. This forces a single generic netlink family namespace for the entire drm: "drm-ras". But multiple-endpoints are supported within the single family. Any modification to this API needs to be applied to Documentation/netlink/specs/drm_ras.yaml before regenerating the code: $ tools/net/ynl/pyynl/ynl_gen_c.py --spec \ Documentation/netlink/specs/drm_ras.yaml --mode uapi --header \ -o include/uapi/drm/drm_ras.h $ tools/net/ynl/pyynl/ynl_gen_c.py --spec \ Documentation/netlink/specs/drm_ras.yaml --mode kernel \ --header -o drivers/gpu/drm/drm_ras_nl.h $ tools/net/ynl/pyynl/ynl_gen_c.py --spec \ Documentation/netlink/specs/drm_ras.yaml \ --mode kernel --source -o drivers/gpu/drm/drm_ras_nl.c Cc: Zack McKevitt Cc: Lijo Lazar Cc: Hawking Zhang Cc: Jakub Kicinski Cc: David S. Miller Cc: Paolo Abeni Cc: Eric Dumazet Cc: netdev@vger.kernel.org Co-developed-by: Aravind Iddamsetty Signed-off-by: Aravind Iddamsetty Signed-off-by: Riana Tauro Reviewed-by: Zack McKevitt Acked-by: Jakub Kicinski Acked-by: Maarten Lankhorst Link: https://patch.msgid.link/20260304074412.464435-8-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi commit 18161bb01ede109fed41c66efa2624a4c27377f7 Author: Kory Maincent (TI) Date: Mon Feb 16 17:55:52 2026 +0100 ARM: dts: ti: Enable overlays for am335x BeagleBoard devicetrees Allow overlays to be applied to am335x BeagleBoard boards. This adds around ~40% to the total size of the DTB files on average. Signed-off-by: Kory Maincent (TI) Link: https://patch.msgid.link/20260216-feature_bbge-v2-1-22805cfdbf62@bootlin.com Signed-off-by: Kevin Hilman commit 16dcd2c7535ed09e97fc075cad97814f0e8968ed Author: Mithil Bavishi Date: Tue Mar 3 15:30:17 2026 -0500 ARM: dts: ti: omap: samsung-espresso10: Add initial support for Galaxy Tab 2 10.1 Create a device tree for the 10 inch variants (P5100, P5110, P5113) Signed-off-by: Mithil Bavishi Reviewed-by: Andreas Kemnade Link: https://patch.msgid.link/20260303203017.511-9-bavishimithil@gmail.com Signed-off-by: Kevin Hilman commit f1bf8f53355411d5afbf0421b59c7218d68e081e Author: Mithil Bavishi Date: Tue Mar 3 15:30:16 2026 -0500 ARM: dts: ti: omap: samsung-espresso7: Add initial support for Galaxy Tab 2 7.0 Create a device tree for the 7 inch variants (P3100, P3110, P3113) Signed-off-by: Mithil Bavishi Reviewed-by: Andreas Kemnade Link: https://patch.msgid.link/20260303203017.511-8-bavishimithil@gmail.com Signed-off-by: Kevin Hilman commit 9b2ee6dd895625155ad90c2430e85e9a8885c2c6 Author: Mithil Bavishi Date: Tue Mar 3 15:30:15 2026 -0500 dt-bindings: omap: Add Samsung Galaxy Tab 2 7.0 and 10.1 Add samsung-espresso7 codename for the 7 inch variant Add samsung-espresso10 codename for the 10 inch variant Signed-off-by: Mithil Bavishi Acked-by: Krzysztof Kozlowski Reviewed-by: Andreas Kemnade Link: https://patch.msgid.link/20260303203017.511-7-bavishimithil@gmail.com Signed-off-by: Kevin Hilman commit f768d54723d13a10e7c7556aeb6087e8938f2951 Author: Mithil Bavishi Date: Tue Mar 3 15:30:14 2026 -0500 ARM: dts: ti: omap: espresso-common: Add common device tree for Samsung Galaxy Tab 2 series Create common device tree for Samsung Espresso series devices Create a shared device tree for all variants first. Device-specific trees will be added later based on screen size. Signed-off-by: Mithil Bavishi Reviewed-by: Andreas Kemnade Link: https://patch.msgid.link/20260303203017.511-6-bavishimithil@gmail.com Signed-off-by: Kevin Hilman commit bd861514cafab553b7b4dcc3b436a8036c90150f Author: Mithil Bavishi Date: Tue Mar 3 15:30:13 2026 -0500 dt-bindings: display: panel-lvds: Add compatibles for Samsung LTN070NL01 and LTN101AL03 panels The LTN070NL01 is a 7.0 inch 1024x600, 24 bit, VESA Compatible, TFT display panel The LTN101AL03 is a 10.1 inch 800x1280, 24 bit, VESA Compatible, TFT display panel Signed-off-by: Mithil Bavishi Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260303203017.511-5-bavishimithil@gmail.com Signed-off-by: Kevin Hilman commit 3e375496c6d0f8c506afebc7de6bbfc392a6de00 Author: Mithil Bavishi Date: Tue Mar 3 15:30:12 2026 -0500 dt-bindings: display: bridge: lvds-codec: add doestek,dtc34lm85am Add compatible strings for the Doestek DTC34LM85AM Flat Panel Display Transmitter Signed-off-by: Mithil Bavishi Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260303203017.511-4-bavishimithil@gmail.com Signed-off-by: Kevin Hilman commit e17a1b049128274386ebcc9bc88e2fe4fb81a4db Author: Mithil Bavishi Date: Tue Mar 3 15:30:11 2026 -0500 dt-bindings: vendor-prefixes: Add Doestek Add vendor prefix for Doestek Co., Ltd. Link: http://www.doestek.co.kr/ Signed-off-by: Mithil Bavishi Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260303203017.511-3-bavishimithil@gmail.com Signed-off-by: Kevin Hilman commit 3b142fdcae780cb67ab4cab61cf71647e9566411 Author: Mithil Bavishi Date: Tue Mar 3 15:30:10 2026 -0500 ARM: dts: twl6032: Add DTS file for TWL6032 PMIC Add a dedicated DTS file for the TWL6032 PMIC (Phoenix Lite). Already has driver support with TWL6030 (Phoenix) since both of them are so similar, some nodes can be reused from TWL6030 as well This can be included in the board files like twl6030 Example: ... &i2c1 { twl: twl@48 { reg = <0x48>; interrupts = ; interrupt-controller; interrupt-parent = <&gic>; }; }; /include/ "twl6032.dtsi" ... Used in devices like samsung-espresso, amazon-jem, epson-embt2ws etc Signed-off-by: Mithil Bavishi Reviewed-by: Andreas Kemnade Link: https://patch.msgid.link/20260303203017.511-2-bavishimithil@gmail.com Signed-off-by: Kevin Hilman commit 389a820af0dfd5021f224b5b70016b680e6ba4fe Author: Abel Vesa Date: Mon Feb 23 10:39:47 2026 +0200 dt-bindings: qcom,pdc: document the Eliza Power Domain Controller Document the Power Domain Controller on the Qualcomm Eliza SoC. Signed-off-by: Abel Vesa Link: https://patch.msgid.link/20260223-eliza-pdc-v1-1-fcb17464fee2@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit e597a809a2b97e927060ba182f58eb3e6101bc70 Author: Greg Kroah-Hartman Date: Mon Feb 23 16:53:39 2026 +0100 drm/vc4: platform_get_irq_byname() returns an int platform_get_irq_byname() will return a negative value if an error happens, so it should be checked and not just passed directly into devm_request_threaded_irq() hoping all will be ok. Cc: Maxime Ripard Cc: Dave Stevenson Cc: Maíra Canal Cc: Raspberry Pi Kernel Maintenance Cc: Maarten Lankhorst Cc: Thomas Zimmermann Cc: David Airlie Cc: Simona Vetter Cc: stable Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026022339-cornflake-t-shirt-2471@gregkh Signed-off-by: Maíra Canal commit 6dd780f973816133f189efec04118c1e6b1b443d Merge: 748f9c6811b973 a28441dd29617b Author: Andrii Nakryiko Date: Thu Mar 5 15:14:25 2026 -0800 Merge branch 'optimize-kprobe-session-attachment-for-exact-function-names' Andrey Grodzovsky says: ==================== Optimize kprobe.session attachment for exact function names When libbpf attaches kprobe.session programs with exact function names (the common case: SEC("kprobe.session/vfs_read")), the current code path has two independent performance bottlenecks: 1. Userspace (libbpf): attach_kprobe_session() always parses /proc/kallsyms to resolve function names, even when the name is exact (no wildcards). This takes ~150ms per function. 2. Kernel (ftrace): ftrace_lookup_symbols() does a full O(N) linear scan over ~200K kernel symbols via kallsyms_on_each_symbol(), decompressing every symbol name, even when resolving a single symbol (cnt == 1). This series optimizes libbpf side: libbpf detects exact function names (no wildcards) in bpf_program__attach_kprobe_multi_opts() and bypasses kallsyms parsing, passing the symbol directly to the kernel via syms[] array. ESRCH is normalized to ENOENT for API consistency. Selftests validates exact-name attachment via kprobe_multi_session.c and error consistency between wildcard and exact paths in test_attach_api_fails. Changes since v3 [3]: - Skip fast path when unique_match is set (Jiri Olsa, CI bot) Changes since v2 [2]: - Use if/else-if instead of goto (Jiri Olsa) - Use syms = &pattern directly (Jiri Olsa) - Drop unneeded pattern = NULL (Jiri Olsa) - Revert cosmetic rename in attach_kprobe_session (Jiri Olsa) - Remove "module symbols" from ftrace comment (CI bot) Changes since v1 [1]: - Move optimization into attach_kprobe_multi_opts (Jiri Olsa) - Use ftrace_location as boolean check only (Jiri Olsa) - Remove verbose perf rationale from comment (Steven Rostedt) - Consolidate tests into existing subtests (Jiri Olsa) - Delete standalone _syms.c and _errors.c files [1] https://lore.kernel.org/bpf/20260223215113.924599-1-andrey.grodzovsky@crowdstrike.com/ [2] https://lore.kernel.org/bpf/20260226173342.3565919-1-andrey.grodzovsky@crowdstrike.com/ [3] https://lore.kernel.org/bpf/20260227204052.725813-1-andrey.grodzovsky@crowdstrike.com/ ==================== Link: https://patch.msgid.link/20260302200837.317907-1-andrey.grodzovsky@crowdstrike.com Signed-off-by: Andrii Nakryiko commit a28441dd29617b330d7284dc00b610be196b783f Author: Andrey Grodzovsky Date: Mon Mar 2 15:08:37 2026 -0500 selftests/bpf: Add tests for kprobe.session optimization Extend existing kprobe_multi_test subtests to validate the kprobe.session exact function name optimization: In kprobe_multi_session.c, add test_kprobe_syms which attaches a kprobe.session program to an exact function name (bpf_fentry_test1) exercising the fast syms[] path that bypasses kallsyms parsing. It calls session_check() so bpf_fentry_test1 is hit by both the wildcard and exact probes, and test_session_skel_api validates kprobe_session_result[0] == 4 (entry + return from each probe). In test_attach_api_fails, add fail_7 and fail_8 verifying error code consistency between the wildcard pattern path (slow, parses kallsyms) and the exact function name path (fast, uses syms[] array). Both paths must return -ENOENT for non-existent functions. Signed-off-by: Andrey Grodzovsky Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260302200837.317907-4-andrey.grodzovsky@crowdstrike.com commit 6afc431db1b4c21fec96cf6bea29489f4dce17c5 Author: Andrey Grodzovsky Date: Mon Mar 2 15:08:35 2026 -0500 libbpf: Optimize kprobe.session attachment for exact function names Detect exact function names (no wildcards) in bpf_program__attach_kprobe_multi_opts() and bypass kallsyms parsing, passing the symbol directly to the kernel via syms[] array. This benefits all callers, not just kprobe.session. When the pattern contains no '*' or '?' characters, set syms to point directly at the pattern string and cnt to 1, skipping the expensive /proc/kallsyms or available_filter_functions parsing (~150ms per function). Error code normalization: the fast path returns ESRCH from kernel's ftrace_lookup_symbols(), while the slow path returns ENOENT from userspace kallsyms parsing. Convert ESRCH to ENOENT in the bpf_link_create error path to maintain API consistency - both paths now return identical error codes for "symbol not found". Signed-off-by: Andrey Grodzovsky Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260302200837.317907-2-andrey.grodzovsky@crowdstrike.com commit 748f9c6811b973a518436136fb86e6284a8854c1 Merge: 8a2a3aaf90cf67 7f20d371fd879f Author: Andrii Nakryiko Date: Thu Mar 5 15:07:40 2026 -0800 Merge branch 'selftests-bpf-fix-bpf_cookie-failures' Sun Jian says: ==================== selftests/bpf: fix bpf_cookie failures Fix bpf_cookie failures due to missing bpf_testmod and flaky perf_event triggering. Tested: ./test_progs -t bpf_cookie/perf_event -vv (30 runs): 0 failures ./test_progs -t bpf_cookie -vv ==================== Link: https://patch.msgid.link/20260228074555.122950-1-sun.jian.kdev@gmail.com Signed-off-by: Andrii Nakryiko commit 7f20d371fd879f5bb9be739c86c9bac13ea920c8 Author: Sun Jian Date: Sat Feb 28 15:45:55 2026 +0800 selftests/bpf: bpf_cookie: Make perf_event subtest trigger reliably The perf_event subtest relies on SW_CPU_CLOCK sampling to trigger the BPF program, but the current CPU burn loop can be too short on slower systems and may fail to generate any overflow sample. This leaves pe_res unchanged and makes the test flaky. Make burn_cpu() take a loop count and use a longer burn only for the perf_event subtest. Also scope perf_event_open() to the current task to avoid wasting samples on unrelated activity. Signed-off-by: Sun Jian Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20260228074555.122950-3-sun.jian.kdev@gmail.com commit 74d3305e620b3c71b414198f9cf9b1609148d277 Author: Sun Jian Date: Sat Feb 28 15:45:54 2026 +0800 selftests/bpf: bpf_cookie: Skip kprobe_multi tests without bpf_testmod The kprobe_multi subtests rely on bpf_testmod fentry ksyms. When bpf_testmod isn't available, libbpf fails to resolve bpf_testmod_fentry_test* and skeleton load fails with -ESRCH, causing false failures. Skip these subtests when env.has_testmod is false. Signed-off-by: Sun Jian Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20260228074555.122950-2-sun.jian.kdev@gmail.com commit 8a2a3aaf90cf671caaca88fe57362c8b169ef392 Merge: 4faa1893807cfc fefeeec6123587 Author: Andrii Nakryiko Date: Thu Mar 5 14:53:37 2026 -0800 Merge branch 'libbpf-bpftool-support-merging-split-btfs' Josef Bacik says: ==================== libbpf/bpftool: support merging split BTFs v1: https://lore.kernel.org/bpf/cover.1771605821.git.josef@toxicpanda.com/ v2: https://lore.kernel.org/bpf/cover.1771616227.git.josef@toxicpanda.com/ v3: https://lore.kernel.org/bpf/cover.1771622266.git.josef@toxicpanda.com/ v4: https://lore.kernel.org/bpf/cover.1771625484.git.josef@toxicpanda.com/ v5: https://lore.kernel.org/bpf/cover.1771950922.git.josef@toxicpanda.com/ v1->v2: - Added a btf__dedup() call to btf__add_btf() to ensure that we don't have duplicate types in the merged BTF. v2->v3: - AI review got confused about the UAF comment, so the comment was expanded to clarify the UAF potential. - Fixed potential clobbering of errno in the error path. v3->v4: - Fixed a potential silent corruption pointed out by the AI review bot. v4->v5: - Addressed Andrii's comments for 1/3. - Addressed Alan and Quentin's comments for 2/3. - Addressed Alan's comments for 3/3. - Added my Signed-off-by for the third patch. - Made sure to validate everything still worked. v5->v6: - Fixed the missed is_prefix comment. - Fixed the removed warning about skipping vmlinux. --- Original email --- Hello, I'm extending systing to do introspection on vfio devices, which requires having the structs I need from the kernel available in userspace. Normally these are loadable modules, but in the case of vfio there's multiple structs across multiple modules. Normally you'd do the following to generate your vmlinux.h with a module bpftool btf dump file /sys/kernel/btf/ format c \ --base /sys/kernel/btf/vmlinux > vmlinux.h but if you need multiple modules you have to hack together multiple dumps and merge them together. This patch series adds support for merging multiple BTF sources together, so you can do bpftool btf dump file /sys/kernel/btf/ \ file /sys/kernel/btf/ format c \ --base /sys/kernel/btf/vmlinux > vmlinux.h I tested this with my usecase and it works. Thanks, Josef ==================== Link: https://patch.msgid.link/cover.1772657690.git.josef@toxicpanda.com Signed-off-by: Andrii Nakryiko commit fefeeec6123587c6b08884865042988d40405bd2 Author: Josef Bacik Date: Wed Mar 4 15:56:52 2026 -0500 selftests/bpf: Add test for btf__add_btf() with split BTF sources Add a test that verifies btf__add_btf() correctly handles merging multiple split BTF objects that share the same base BTF. The test creates two sibling split BTFs on a common base, merges them into a combined split BTF, and validates that base type references are preserved while split type references are properly remapped. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Josef Bacik Signed-off-by: Andrii Nakryiko Reviewed-by: Alan Maguire Link: https://lore.kernel.org/bpf/64a8c947bff1ae89efa9ba8c099466477762490f.1772657690.git.josef@toxicpanda.com commit d8d5c0151148b0194e8bbba66eb56d4d9cab94cd Author: Josef Bacik Date: Wed Mar 4 15:56:51 2026 -0500 bpftool: Support merging multiple module BTFs in btf dump Add support for specifying multiple file sources in 'bpftool btf dump' to generate a single C header containing types from vmlinux plus multiple kernel modules: bpftool btf dump file /sys/kernel/btf/mod1 file /sys/kernel/btf/mod2 format c This is useful for BPF programs that need to access types defined in kernel modules. Previously this required a separate bpftool invocation for each module, producing separate headers that could not be combined due to overlapping vmlinux type definitions. The implementation collects all file paths, then for the multi-file case creates an empty split BTF on the vmlinux base and iteratively merges each module's types into it via btf__add_btf(). The single-file code path is preserved exactly to avoid any regression risk. Auto-detection of vmlinux as the base BTF from sysfs paths works as before. If vmlinux itself appears in the file list it is skipped with a warning since its types are already provided by the base. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Josef Bacik Signed-off-by: Andrii Nakryiko Reviewed-by: Alan Maguire Link: https://lore.kernel.org/bpf/b19c2760ffe48cec546dd3810d237f8cad20d606.1772657690.git.josef@toxicpanda.com commit be872ccf370915b858ab693aa0707a2eff4bb1fd Author: Josef Bacik Date: Wed Mar 4 15:56:50 2026 -0500 libbpf: Support appending split BTF in btf__add_btf() btf__add_btf() currently rejects split BTF sources with -ENOTSUP. This prevents merging types from multiple kernel module BTFs that are all split against the same vmlinux base. Extend btf__add_btf() to handle split BTF sources by: - Replacing the blanket -ENOTSUP with a validation that src and dst share the same base BTF pointer when both are split, returning -EOPNOTSUPP on mismatch. - Computing src_start_id from the source's base to distinguish base type ID references (which must remain unchanged) from split type IDs (which must be remapped to new positions in the destination). - Using src_btf->nr_types instead of btf__type_cnt()-1 for the type count, which is correct for both split and non-split sources. - Skipping base string offsets (< start_str_off) during the string rewrite loop, mirroring the type ID skip pattern. Since src and dst share the same base BTF, base string offsets are already valid and need no remapping. For non-split sources the behavior is identical: src_start_id is 1, the type_id < 1 guard is never true (VOID is already skipped), and the remapping formula reduces to the original. start_str_off is 0 so no string offsets are skipped. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Josef Bacik Signed-off-by: Andrii Nakryiko Reviewed-by: Alan Maguire Link: https://lore.kernel.org/bpf/c00216ed48cf7897078d9645679059d5ebf42738.1772657690.git.josef@toxicpanda.com commit a2614f29ee37841638a2ca852da7f83aac6756dc Merge: 2adac914c72b6c ef0b4783afc211 Author: Mark Brown Date: Thu Mar 5 21:55:12 2026 +0000 ASoC: cs35l56: More KUnit tests for speaker ID Merge series from Richard Fitzgerald : The first 3 patches in this series add some more KUnit testing for fetching speaker ID and combining it with the system name to create part of the qualifier for a firmware filename. Patch #4 enables GPIOLIB in KUnit 'alltests' builds. This can be taken separately from the first 3 patches. The GPIO tests will skip if GPIOLIB is not enabled, but obviously it would be ideal for 'kunit.py --alltests' runs to include these new test cases. commit 0f409eaea53e49932cf92a761de66345c9a4b4be Author: Kuppuswamy Sathyanarayanan Date: Fri Jan 16 15:03:15 2026 -0800 virt: tdx-guest: Return error for GetQuote failures Currently, the GetQuote request handler returns explicit errors for hypercall-level failures and timeouts, but it ignores some VMM failures (e.g., GET_QUOTE_SERVICE_UNAVAILABLE), for which it returns success with a zero-length Quote. This makes error handling in userspace more complex. The VMM reports failures via the status field in the shared GPA header, which is inaccessible to userspace because only the Quote payload is exposed to userspace. Parse the status field in the kernel and return an error for Quote failures. This preserves existing ABI behavior as userspace already treats a zero-length Quote as a failure. Refer to GHCI specification [1], section "TDG.VP.VMCALL ", Table 3-10 and Table 3-11 for details on the GPA header and GetQuote status codes. Closes: https://lore.kernel.org/linux-coco/6bdf569c-684a-4459-af7c-4430691804eb@linux.intel.com/T/#u Closes: https://github.com/confidential-containers/guest-components/issues/823 Fixes: f4738f56d1dc ("virt: tdx-guest: Add Quote generation support using TSM_REPORTS") Reported-by: Xiaoyao Li Signed-off-by: Kuppuswamy Sathyanarayanan Signed-off-by: Dave Hansen Reviewed-by: Kirill A. Shutemov Reviewed-by: Xiaoyao Li Reviewed-by: Dan Williams Acked-by: Kai Huang Tested-by: Mikko Ylinen Link: https://cdrdv2.intel.com/v1/dl/getContent/858626 # [1] Link: https://patch.msgid.link/20260116230315.4023504-1-sathyanarayanan.kuppuswamy@linux.intel.com commit b1ef855c62601ed4de2c4b0ff75a075877e3dac8 Author: Krzysztof Kozlowski Date: Thu Mar 5 21:13:50 2026 +0100 regmap: Simplify devres handling The resource-managed devm_regmap_init() can be a bit simpler by using devm_add_action_or_reset() instead of devres_alloc(). This allows to drop the less-obvious pointer to pointer (struct regmap **ptr) and make devm_regmap_release() interface simpler. Code is functionally equivalent with minor difference: devres_alloc() will happen now after successful resource init (__regmap_init()). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260305201349.32734-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown commit 7989c39341348e3507282d88a564cb20d83a0829 Author: Dave Hansen Date: Wed Mar 4 10:10:24 2026 -0800 x86/microcode: Add platform mask to Intel microcode "old" list Intel sometimes has CPUs with identical family/model/stepping but which need different microcode. These CPUs are differentiated with the platform ID. The Intel "microcode-20250512" release was used to generate the existing contents of intel-ucode-defs.h. Use that same release and add the platform mask to the definitions. This makes the list a few entries longer because some CPUs previously that shared a definition now need two or more. for example for the ancient Pentium III there are two CPUs that differ only in their platform and have two different microcode versions (note: .driver_data is the microcode version): { ..., .model = 0x05, .steppings = 0x0001, .platform_mask = 0x01, .driver_data = 0x40 }, { ..., .model = 0x05, .steppings = 0x0001, .platform_mask = 0x08, .driver_data = 0x45 }, Another example is the state-of-the-art Granite Rapids: { ..., .model = 0xad, .steppings = 0x0002, .platform_mask = 0x20, .driver_data = 0xa0000d1 }, { ..., .model = 0xad, .steppings = 0x0002, .platform_mask = 0x95, .driver_data = 0x10003a2 }, As you can see, this differentiation with platform ID has been necessary for a long time and is still relevant today. Without the platform matching, the old microcode table is incomplete. For instance, it might lead someone with a Pentium III, platform 0x0, and microcode 0x40 to think that they should have microcode 0x45, which is really only for platform 0x4 (.platform_mask==0x08). In practice, this meant that folks with fully updated microcode were seeing "Vulnerable" in the "old_microcode" file. 1. https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files Closes: https://lore.kernel.org/all/38660F8F-499E-48CD-B58B-4822228A5941@nutanix.com/ Fixes: 4e2c719782a8 ("x86/cpu: Help users notice when running old Intel microcode") Reported-by: Jon Kohler Signed-off-by: Dave Hansen Reviewed-by: Sohil Mehta Tested-by: Zhao Liu Link: https://lore.kernel.org/all/3ECBB974-C6F0-47A7-94B6-3646347F1CC2@nutanix.com/ Link: https://patch.msgid.link/20260304181024.76E3F038@davehans-spike.ostc.intel.com commit fab0c75d500fd23de6ea1b30e44635418a6dae65 Author: Dave Hansen Date: Wed Mar 4 10:10:22 2026 -0800 x86/cpu: Add platform ID to CPU matching structure The existing x86_match_cpu() infrastructure can be used to match a bunch of attributes of a CPU: vendor, family, model, steppings and CPU features. But, there's one more attribute that's missing and unable to be matched against: the platform ID, enumerated on Intel CPUs in MSR_IA32_PLATFORM_ID. It is a little more obscure and is only queried during microcode loading. This is because Intel sometimes has CPUs with identical family/model/stepping but which need different microcode. These CPUs are differentiated with the platform ID. Add a field in 'struct x86_cpu_id' for the platform ID. Similar to the stepping field, make the new field a mask of platform IDs. Some examples: 0x01: matches only platform ID 0x0 0x02: matches only platform ID 0x1 0x03: matches platform IDs 0x0 or 0x1 0x80: matches only platform ID 0x7 0xff: matches all 8 possible platform IDs Since the mask is only a byte wide, it nestles in next to another u8 and does not even increase the size of 'struct x86_cpu_id'. Reserve the all 0's value as the wildcard (X86_PLATFORM_ANY). This avoids forcing changes to existing 'struct x86_cpu_id' users. They can just continue to fill the field with 0's and their matching will work exactly as before. Note: If someone is ever looking for space in 'struct x86_cpu_id', this new field could probably get stuck over in ->driver_data for the one user that there is. Signed-off-by: Dave Hansen Reviewed-by: Sohil Mehta Link: https://patch.msgid.link/20260304181022.058DF07C@davehans-spike.ostc.intel.com commit d8630b67ca1edeea728dbb309b09d239e9db6bdf Author: Dave Hansen Date: Wed Mar 4 10:10:20 2026 -0800 x86/cpu: Add platform ID to CPU info structure The end goal here is to be able to do x86_match_cpu() and match on a specific platform ID. While it would be possible to stash this ID off somewhere or read it dynamically, that approaches would not be consistent with the other fields which can be matched. Read the platform ID and store it in cpuinfo_x86. There are lots of sites to set this new field. Place it near the place c->microcode is established since the platform ID is so closely intertwined with microcode updates. Note: This should not grow the size of 'struct cpuinfo_x86' in practice since the u8 fits next to another u8 in the structure. Signed-off-by: Dave Hansen Reviewed-by: Sohil Mehta Reviewed-by: Pawan Gupta Link: https://patch.msgid.link/20260304181020.8D518228@davehans-spike.ostc.intel.com commit 238be4ba87605da69de2131e8736be7a0d299e00 Author: Dave Hansen Date: Wed Mar 4 10:10:18 2026 -0800 x86/microcode: Refactor platform ID enumeration into a helper Today, the only code that cares about the platform ID is the microcode update code itself. To facilitate storing the platform ID in a more generic place and using it outside of the microcode update itself, put the enumeration into a helper function. Mirror intel_get_microcode_revision()'s naming and location. But, moving away from intel_collect_cpu_info() means that the model and family information in CPUID is not readily available. Just call CPUID again. Note that the microcode header is a mask of supported platform IDs. Only stick the ID part in the helper. Leave the 1<=PII, say <=PII. The PII is the real oddball here being the only CPU with Linux microcode updates but no platform ID. It's worth calling it out by name. This does subtly change the sig->pf for the PII though from 0x0 to 0x1. Make up for that by ignoring sig->pf when the microcode update platform mask is 0x0. [ dhansen: reflow comment for bpetkov ] Signed-off-by: Dave Hansen Reviewed-by: Sohil Mehta Reviewed-by: Pawan Gupta Link: https://patch.msgid.link/20260304181018.EB6404F8@davehans-spike.ostc.intel.com commit 0b1324cdd8de9f54f9daf689a4ae59783c333510 Merge: ab99e116729372 abacaf559950ee Author: Jakub Kicinski Date: Thu Feb 26 10:20:47 2026 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-7.0-rc3). No conflicts. Adjacent changes: net/netfilter/nft_set_rbtree.c fb7fb4016300 ("netfilter: nf_tables: clone set on flush only") 3aea466a4399 ("netfilter: nft_set_rbtree: don't disable bh when acquiring tree lock") Signed-off-by: Jakub Kicinski commit 92ae0c1efc6c7b9c3299a6c954bca2a928cb9f60 Author: Vasily Gorbik Date: Wed Feb 25 10:30:28 2026 +0100 s390/boot: Respect kaslr_enabled() for identity randomization CONFIG_RANDOMIZE_IDENTITY_BASE only enables support for randomizing the identity mapping base. The randomization (identity base != 0) itself should happen only when KASLR is enabled at runtime. Guard the __identity_base update with kaslr_enabled() so nokaslr (and other KASLR-disabled cases) keep the non-randomized identity mapping at 0. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 20216c126bd946248d28d875c4a82cd1a79ba794 Author: Vasily Gorbik Date: Wed Feb 25 10:30:25 2026 +0100 s390/Kconfig: Make modules sanity test a module-only option The modules sanity test must be built as a module to actually exercise module loading. Require KUNIT && m to prevent built-in builds and avoid misuse, so it is either 'n' or 'm'. Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit b4d3c33a3486c518298a7326ac3a3134ca7ee64c Author: Vasily Gorbik Date: Wed Jan 28 15:40:57 2026 +0100 s390/setup: Drop stale ident_map_size declaration ident_map_size is no longer a standalone variable and the declaration in asm/setup.h conflicts with its current definition in asm/page.h introduced with commit 236f324b7473 ("s390/mm: Create virtual memory layout structure"). Remove the stale declaration. Signed-off-by: Vasily Gorbik commit 9558a2cbec2eb034ae7d570ff56ad74f9a918177 Author: Rong Zhang Date: Fri Mar 6 01:46:39 2026 +0800 ALSA: usb-audio: Refine string-descriptor-based quirk matching Remove snd_usb_get_string() and use the manufacturer and product strings stored in struct usb_device directly to match quirk table entries. Their NULLity can be checked to determine if the device has no these strings. This simplifies the code a lot. Meanwhile, allow quirk table entries to match "no string" explicitly, and add appropriate comments to show the expected usages of DEVICE_STRING_FLG() and VENDOR_STRING_FLG(). These changes are tiny and doesn't form another separate patch, so that back-and-forth changes can be avoided. Suggested-by: Terry Junge Link: https://lore.kernel.org/r/b59da54a-9c80-4212-a337-c5ea98da52d1@cosmicgizmosystems.com Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20260305174711.1106324-1-i@rong.moe Signed-off-by: Takashi Iwai commit aa3d0c93a333182e887426366a4f3e5f06ee0d83 Author: Ben Dooks Date: Thu Mar 5 18:46:23 2026 +0000 regulator: max20411: show failure on register It is easy to use %pe to print a error-pointer so add this to the dev_err() if the devm_regulator_register() fails. Signed-off-by: Ben Dooks Link: https://patch.msgid.link/20260305184623.2603269-1-ben.dooks@codethink.co.uk Signed-off-by: Mark Brown commit 8505bfb4e4eca28ef1b20d3369435ec2d6a125c6 Author: Pengjie Zhang Date: Fri Feb 13 18:09:35 2026 +0800 ACPI: CPPC: Move reference performance to capabilities Currently, the `Reference Performance` register is read every time the CPU frequency is sampled in `cppc_get_perf_ctrs()`. This function is on the hot path of the cppc_cpufreq driver. Reference Performance indicates the performance level that corresponds to the Reference Counter incrementing and is not expected to change dynamically during runtime (unlike the Delivered and Reference counters). Reading this register in the hot path incurs unnecessary overhead, particularly on platforms where CPC registers are located in the PCC (Platform Communication Channel) subspace. This patch moves `reference_perf` from the dynamic feedback counters structure (`cppc_perf_fb_ctrs`) to the static capabilities structure (`cppc_perf_caps`). Signed-off-by: Pengjie Zhang [ rjw: Changelog adjustment ] Link: https://patch.msgid.link/20260213100935.19111-1-zhangpengjie2@huawei.com Signed-off-by: Rafael J. Wysocki commit c15d0056fb74d6a2efd7bb1d382305fbd8a93cd2 Author: Marco Crivellari Date: Tue Nov 4 11:00:32 2025 +0100 drm/i915: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues: commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Krzysztof Karas Link: https://patch.msgid.link/20251104100032.61525-4-marco.crivellari@suse.com Signed-off-by: Rodrigo Vivi commit 4fb289d352e316d79fbf0e5b513e3ad17c947ff7 Author: Marco Crivellari Date: Tue Nov 4 11:00:31 2025 +0100 drm/i915: replace use of system_wq with system_percpu_wq in the documentation Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") The old wq (system_wq) will be kept for a few release cycles. This change only update the documentation of drm/i915. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Krzysztof Karas Link: https://patch.msgid.link/20251104100032.61525-3-marco.crivellari@suse.com Signed-off-by: Rodrigo Vivi commit 36ed3648a2f352059284e3ba7903156b7e581187 Author: Marco Crivellari Date: Tue Nov 4 11:00:30 2025 +0100 drm/i915: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Krzysztof Karas Link: https://patch.msgid.link/20251104100032.61525-2-marco.crivellari@suse.com Signed-off-by: Rodrigo Vivi commit 5b1f4b5c72cc40e676293b8609cacef7e1545beb Author: Chen Ni Date: Fri Feb 27 17:21:10 2026 +0800 remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init() The devm_ioremap_resource_wc() function never returns NULL, it returns error pointers. Update the error checking to match. Fixes: 67a7bc7f0358 ("remoteproc: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Chen Ni Reviewed-by: Peng Fan Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260227092110.4044313-1-nichen@iscas.ac.cn Signed-off-by: Mathieu Poirier commit 665eebebb029690a5b2f92e481020877cc6c8d36 Author: Chen Ni Date: Fri Feb 27 17:15:46 2026 +0800 remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init() The devm_ioremap_resource_wc() function never returns NULL, it returns error pointers. Update the error checking to match. Fixes: 67a7bc7f0358 ("remoteproc: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Chen Ni Reviewed-by: Peng Fan Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260227091546.4044246-1-nichen@iscas.ac.cn Signed-off-by: Mathieu Poirier commit 390045a24591ac4071ed6fff80b317f685fbdd6f Author: Jingyi Wang Date: Wed Jan 14 22:42:56 2026 -0800 dt-bindings: remoteproc: qcom,sm8550-pas: Add Kaanapali CDSP Add remote processor PAS loader for Kaanapali CDSP processor, compatible with earlier SM8550 with minor difference: one more sixth "shutdown-ack" interrupt. It is not compatible with SM8650 because one memory region "global_sync_mem" is not managed by kernel on Kaanapali so it is removed in the remoteproc cdsp node. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260114-knp-remoteproc-v4-2-fcf0b04d01af@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0af8802175d2dcff98210cfd32e056dfc6c40267 Author: Jingyi Wang Date: Wed Jan 14 22:42:55 2026 -0800 dt-bindings: remoteproc: qcom,sm8550-pas: Add Kaanapali ADSP Document compatible for Qualcomm Kaanapali SoC ADSP PAS which looks fully compatible with SM8750, which can fallback to SM8550 except for one more interrupt ("shutdown-ack"). Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20260114-knp-remoteproc-v4-1-fcf0b04d01af@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a48c6676912fb808d2af1b8344d8656815a3e108 Author: Chen Ni Date: Mon Feb 9 13:14:07 2026 +0800 remoteproc: imx_rproc: Check return value of regmap_attach_dev() in imx_rproc_mmio_detect_mode() Add error checking for regmap_attach_dev() call in imx_rproc_mmio_detect_mode() function to ensure proper error propagation. Return the value of regmap_attach_dev() if it fails to prevent proceeding with an incomplete regmap setup. Suggested-by: Peng Fan Signed-off-by: Chen Ni Fixes: e14168bf3493 ("remoteproc: imx_rproc: Simplify IMX_RPROC_MMIO switch case") Link: https://lore.kernel.org/r/20260209051407.1467660-1-nichen@iscas.ac.cn Signed-off-by: Mathieu Poirier commit 122d16da1313f1746a4cdd31a620bbb141be7060 Author: Marco Crivellari Date: Wed Dec 24 17:13:01 2025 +0100 ipmi: Replace use of system_wq with system_percpu_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Message-ID: <20251224161301.135382-1-marco.crivellari@suse.com> Signed-off-by: Corey Minyard commit 53007d526e17d29f0e5b81c07eb594a93bc4d29c Author: Thomas Gleixner Date: Wed Mar 4 19:49:29 2026 +0100 clocksource: Update clocksource::freq_khz on registration Borislav reported a division by zero in the timekeeping code and random hangs with the new coupled clocksource/clockevent functionality. It turned out that the TSC clocksource is not always updating the freq_khz field of the clocksource on registration. The coupled mode conversion calculation requires the frequency and as it's not initialized the resulting factor is zero or a random value. As a consequence this causes a division by zero or random boot hangs. Instead of chasing down all clocksources which fail to update that member, fill it in at registration time where the caller has to supply the frequency anyway. Except for special clocksources like jiffies which never can have coupled mode. To make this more robust put a check into the registration function to validate that the caller supplied a frequency if the coupled mode feature bit is set. If not, emit a warning and clear the feature bit. Fixes: cd38bdb8e696 ("timekeeping: Provide infrastructure for coupled clockevents") Reported-by: Borislav Petkov Reported-by: Nathan Chancellor Signed-off-by: Thomas Gleixner Tested-by: Borislav Petkov Tested-by: Nathan Chancellor Link: https://patch.msgid.link/87cy1jsa4m.ffs@tglx Closes: https://lore.kernel.org/20260303213027.GA2168957@ax162 commit 9d5e25b361b7228b422fd32bd1c327fd7fb919b4 Author: Thomas Gleixner Date: Tue Mar 3 22:56:27 2026 +0100 timekeeping: Initialize the coupled clocksource conversion completely Nathan reported a boot failure after the coupled clocksource/event support was enabled for the TSC deadline timer. It turns out that on the affected test systems the TSC frequency is not refined against HPET, so it is registered with the same frequency as the TSC-early clocksource. As a consequence the update function which checks for a change of the shift/mult pair of the clocksource fails to compute the conversion limit, which is zero initialized. This check is there to avoid pointless computations on every timekeeping update cycle (tick). So the actual clockevent conversion function limits the delta expiry to zero, which means the timer is always programmed to expire in the past. This obviously results in a spectacular timer interrupt storm, which goes unnoticed because the per CPU interrupts on x86 are not exposed to the runaway detection mechanism and the NMI watchdog is not yet functional. So the machine simply stops booting. That did not show up in testing. All test machines refine the TSC frequency so TSC has a differrent shift/mult pair than TSC-early and the conversion limit is properly initialized. Cure that by setting the conversion limit right at the point where the new clocksource is installed. Fixes: cd38bdb8e696 ("timekeeping: Provide infrastructure for coupled clockevents") Reported-by: Nathan Chancellor Signed-off-by: Thomas Gleixner Tested-by: Nathan Chancellor Acked-by: John Stultz Link: https://patch.msgid.link/87bjh4zies.ffs@tglx Closes: https://lore.kernel.org/20260303012905.GA978396@ax162 commit 0ec959cf4b5a609d7f27bf84064ef5372e30ab80 Author: Coiby Xu Date: Tue Sep 30 10:26:56 2025 +0800 evm: fix security.evm for a file with IMA signature When both IMA and EVM fix modes are enabled, accessing a file with IMA signature but missing EVM HMAC won't cause security.evm to be fixed. Add a function evm_fix_hmac which will be explicitly called to fix EVM HMAC for this case. Suggested-by: Mimi Zohar Signed-off-by: Coiby Xu Signed-off-by: Mimi Zohar commit a2e507afd9a25e333b7a58082f5db8c4de2bd12d Author: Coiby Xu Date: Fri Feb 13 09:28:48 2026 +0800 s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT Commit b5ca117365d9 ("ima: prevent kexec_load syscall based on runtime secureboot flag") and commit 268a78404973 ("s390/kexec_file: Disable kexec_load when IPLed secure") disabled the kexec_load syscall based on the secureboot mode. Commit 9e2b4be377f0 ("ima: add a new CONFIG for loading arch-specific policies") needed to detect the secure boot mode, not to load an IMA architecture specific policy. Since there is the new CONFIG_INTEGRITY_SECURE_BOOT, drop CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT for s390. Signed-off-by: Coiby Xu Tested-by: Alexander Egorenkov [Vasily Gorbik: Fix missing arch_get_secureboot() prototype warning] link: https://lore.kernel.org/linux-integrity/c00-01.ttbfdx5@ub.hpns/ Signed-off-by: Mimi Zohar commit cf75c8632034da568146f4005db746d4a3998292 Author: Coiby Xu Date: Fri Feb 13 09:28:47 2026 +0800 evm: Don't enable fix mode when secure boot is enabled Similar to IMA fix mode, forbid EVM fix mode when secure boot is enabled. Reported-and-suggested-by: Mimi Zohar Suggested-by: Roberto Sassu Signed-off-by: Coiby Xu Signed-off-by: Mimi Zohar commit 31a6a07eefeb4c84bd6730fbe9e95fd9221712cf Author: Coiby Xu Date: Fri Feb 13 09:28:46 2026 +0800 integrity: Make arch_ima_get_secureboot integrity-wide EVM and other LSMs need the ability to query the secure boot status of the system, without directly calling the IMA arch_ima_get_secureboot function. Refactor the secure boot status check into a general function named arch_get_secureboot. Reported-and-suggested-by: Mimi Zohar Suggested-by: Roberto Sassu Signed-off-by: Coiby Xu Acked-by: Ard Biesheuvel Signed-off-by: Mimi Zohar commit ab99e1167293726f016360a5dbbbc10386fd7d66 Merge: bc531c2cc1d179 cc663d3fed062f Author: Paolo Abeni Date: Thu Mar 5 16:26:54 2026 +0100 Merge branch 'net-ethtool-track-tx-pause-storm' Mohsin Bashir says: ==================== net: ethtool: Track TX pause storm With TX pause enabled, if a device cannot deliver received frames to the stack (e.g., during a system hang), it may generate excessive pause frames causing a pause storm. This series updates the uAPI to track TX pause storm events as part of the pause stats (p1), proposes using the existing pfc-prevention-tout knob to configure the storm watchdog (p2), adds pause storm protection support for fbnic (p3), and leverages p1 to provide observability into these events for the fbnic (p4) and mlx5 (p5) drivers. v3: https://lore.kernel.org/netdev/20260223174914.74461-1-mohsin.bashr@gmail.com/ V2: https://lore.kernel.org/20260207010525.3808842-1-mohsin.bashr@gmail.com/ V1: https://lore.kernel.org/20260122192158.428882-1-mohsin.bashr@gmail.com/ ==================== Link: https://patch.msgid.link/20260302230149.1580195-1-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit cc663d3fed062fb41b59df953a2cb9df5f56f943 Author: Mohsin Bashir Date: Mon Mar 2 15:01:49 2026 -0800 eth: mlx5: Move pause storm errors to pause stats Report device_stall_critical_watermark_cnt as tx_pause_storm_events in the ethtool_pause_stats struct. This counter tracks pause storm error events which indicate the NIC has been sending pause frames for an extended period due to a stall. The ethtool_pause_stats struct reports these stalls as a single value, whereas the device supports tracking them per priority. Aggregate the counter across all priority classes to capture stalls on all priorities. Note that the stats are fetched from the device for each priority via mlx5_core_access_reg(). Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260302230149.1580195-6-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 8d282b680c729203d04d4eee396f3216f29b35aa Author: Mohsin Bashir Date: Mon Mar 2 15:01:48 2026 -0800 eth: fbnic: Fetch TX pause storm stats With pause storm protection in place, track the occurrence of pause storm events. Since there is a one-to-one mapping between pause storm interrupts and events, use the interrupt count to track this metric. ./ethtool -I -a eth0 Pause parameters for eth0: Autonegotiate: off RX: off TX: on Statistics: tx_pause_frames: 759657 rx_pause_frames: 0 tx_pause_storm_events: 219 Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260302230149.1580195-5-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 9b7c8728f53a5652a5184651c7b78ed1587542a4 Author: Mohsin Bashir Date: Mon Mar 2 15:01:47 2026 -0800 eth: fbnic: Add protection against pause storm Add protection against TX pause storms. A pause storm occurs when a device fails to send received packets up to the stack. When a pause storm is detected (pause state persists beyond the configured timeout), the device stops sending the pause frames and begins dropping packets instead of back-pressuring. The timeout is configurable via ethtool tunable (pfc-prevention-tout) with a maximum value of 10485ms, and the default value of 500ms. Once the device transitions to the storm-detected state, the service task periodically attempts recovery, returning the device to normal operation to handle any subsequent pause storm episodes. Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260302230149.1580195-4-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 817de93c348a3086ecca6e03ff459138832157cc Author: Mohsin Bashir Date: Mon Mar 2 15:01:46 2026 -0800 net: ethtool: Update doc for tunable ETHTOOL_PFC_PREVENTION_TOUT enables the configuration of timeout value for PFC storm prevention. This can also be used to configure storm detection timeout for global pause settings. In fact some existing drivers are already using it for the said purpose. Highlight that the knob can formally be used to configure timeout value for pause storm prevention mechanism. The update to the ethtool man page will follow afterwards. Link: https://lore.kernel.org/aa5f189a-ac62-4633-97b5-ebf939e9c535@nvidia.com Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260302230149.1580195-3-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit cc39325f927850473d3a84b029ae6f9b508e9bd1 Author: Mohsin Bashir Date: Mon Mar 2 15:01:45 2026 -0800 net: ethtool: Track pause storm events With TX pause enabled, if a device is unable to pass packets up to the stack (e.g., CPU is hanged), the device can cause pause storm. Given that devices can have native support to protect the neighbor from such flooding, such events need some tracking. This support is to track TX pause storm events for better observability. Reviewed-by: Oleksij Rempel Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260302230149.1580195-2-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit e7662bced2e98ffa2c572126677deb9cf55d43b3 Author: Andy Shevchenko Date: Thu Mar 5 09:53:02 2026 +0100 regcache: Move HW readback after cache initialisation Make sure that cache is initialised before calling any IO using regmap, this makes sure that we won't access NULL or invalid pointers in the cache which hasn't been initialised. As a side effect it also makes the ordering of cleaning up the resources in regcache_exit() to be the same (and correct) as in the error path of regcache_init(). This is not a problem right now as they do not have dependencies, but it makes code robust against potential changes in the future. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260305085449.3184020-4-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 0cb7ae981894ff1fd0283813a17253250a747cf5 Author: Andy Shevchenko Date: Thu Mar 5 09:53:01 2026 +0100 regcache: Allocate and free reg_defaults on the same level Currently reg_defaults buffer may be allocated on two different levels when the user provided them and we duplicate it in regcache_init() or when user wants us to read back from HW in regcache_hw_init(). This inconsistency makes code harder to follow and maintain. Allocate and free reg_defaults on the same level in regcache_init() to improve the readability and maintenance efforts. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260305085449.3184020-3-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 8e2d279724944f788edc633e4888107eae666a37 Author: Andy Shevchenko Date: Thu Mar 5 09:53:00 2026 +0100 regcache: Move count check and cache_bypass assignment to the caller Make regcache_count_cacheable_registers() just a counting routine without any side effects by moving count check and cache_bypass assignment to the caller. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260305085449.3184020-2-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit ef0b4783afc211a4b120e72b5a57f3d0340a9981 Author: Richard Fitzgerald Date: Wed Mar 4 16:24:01 2026 +0000 ASoC: cs35l56: KUnit tests for reading speaker ID from host GPIOs Add test cases for the spk-id-gpios property used to read an integer speaker ID value from a set of GPIO inputs. There is a single parameterized test function, cs35l56_shared_test_get_speaker_id_from_host_gpio() that does the following: - Create a mock GPIO driver to simulate real GPIO inputs. - Create an array of struct software_node_ref_args to provide the content of the spk-id-gpios property. Each entry is a reference to a GPIO on the mock GPIO driver. The GPIO indexes are taken from test case parameterization. - Create a software node containing the spk-id-gpios property and set this as the node of the pseudo codec driver device. - Call cs35l56_get_speaker_id() and assert that the returned value matches the expected value defined in the test case parameterization. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260304162402.1714759-4-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 72e1c4704844766c46725d6b043ba04559054d02 Author: Richard Fitzgerald Date: Wed Mar 4 16:24:00 2026 +0000 ASoC: cs35l56: Some KUnit testing of cs35l56_get_speaker_id() Add some KUnit tests for cs35l56_get_speaker_id(). These only test the simpler cases of reading the speaker ID from cs_amp_get_vendor_spkid() or the "cirrus,speaker-id" property. The untested case is reading it from GPIOs, which would require a dummy implementation of a GPIO driver. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260304162402.1714759-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit bae6668c526018af45b70e7825b61e6edb528f41 Author: Richard Fitzgerald Date: Wed Mar 4 16:23:59 2026 +0000 ASoC: cs35l56: KUnit tests for setting dsp.system_name Add KUnit tests for setting the dsp.system_name string. There are two sources of the string: 1. PCI SSID from struct snd_soc_card. 2. "cirrus,firmware-uid" property. Either of these can then be qualified by a speaker ID integer. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260304162402.1714759-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit ae715818c5d7e486fe97806a734205cea63921e2 Author: Martin Schiller Date: Wed Feb 25 08:46:09 2026 +0100 x86/reboot: Execute the kernel restart handler upon machine restart SoC devices like the Intel / MaxLinear Lightning Mountain must be reset by the Reset Control Unit (RCU) instead of using "normal" x86 mechanisms like ACPI, BIOS, KBD, etc. Therefore, the RCU driver (reset-intel-gw) registers a restart handler which triggers the global reset signal. Unfortunately, this is of no use as long as the restart chain is not processed during reboot on x86 systems. That's why do_kernel_restart() must be called when a reboot is performed. This has long been common practice for other architectures. [ bp: Massage commit message. ] Signed-off-by: Martin Schiller Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260225-x86_do_kernel_restart-v2-1-81396cf3d44c@dev.tdt.de commit b364a0d23cae157691cde2c0137998d66b45b703 Author: Takashi Iwai Date: Thu Mar 5 14:04:25 2026 +0100 ALSA: usb-audio: Use strings in struct usb_dev for manufacturer & co The USB core already prepares the strings for manufacturer, product and serial number, and we don't have to extract the string at each time. Replace the manual usb_string() calls with the corresponding pointers in struct usb_dev as a code cleanup. Link: https://patch.msgid.link/20260305130426.975604-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit f82fabe18c75a7703e4bd81a9eabc9aa2303e1fb Author: Kuppuswamy Sathyanarayanan Date: Thu Feb 12 15:30:42 2026 -0800 thermal: intel: int340x: processor: Move RAPL defaults to MMIO driver Previously, the MMIO and MSR RAPL interfaces shared the same set of RAPL defaults provided by common code. However, unlike the MSR interface, the MMIO RAPL interface does not require CPU-specific variations in its default handling. Keeping the RAPL defaults in the RAPL common driver therefore provides no additional benefit. Move the MMIO defaults into the MMIO interface driver. This change includes the following updates: * Introduce a MMIO-local rapl_defaults instance with the appropriate default callbacks. * Assign the MMIO-specific rapl_defaults to priv->defaults during MMIO driver initialization. No functional changes are expected. Co-developed-by: Zhang Rui Signed-off-by: Zhang Rui Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260212233044.329790-11-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 22e729c5e5e0c5a35ae9fbc691bb7635dae3378b Author: Kuppuswamy Sathyanarayanan Date: Thu Feb 12 15:30:41 2026 -0800 powercap: intel_rapl: Move TPMI default settings into TPMI interface driver TPMI-specific RAPL defaults differ from those used by MSR and MMIO interfaces. Keeping them in RAPL common driver introduces unnecessary complexity. Move the TPMI defaults into the TPMI interface driver. This change includes the following updates: 1. Add a TPMI-local struct rapl_defaults instance and assign it to priv->defaults during TPMI probe. 2. Move rapl_check_unit_tpmi() and related unit-field definitions from the common driver into the TPMI driver. 3. In rapl_check_unit_tpmi(), replace the generic get_rid() usage with direct access to the TPMI package ID, since the function is now interface-specific. No functional changes are intended. Co-developed-by: Zhang Rui Signed-off-by: Zhang Rui Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260212233044.329790-10-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit d7ca7d1488cc916dbf0a6a594abbda81d4eaeee9 Author: Kuppuswamy Sathyanarayanan Date: Thu Feb 12 15:30:40 2026 -0800 powercap: intel_rapl: Allow interface drivers to configure rapl_defaults RAPL default settings vary across different RAPL interfaces (MSR, TPMI, MMIO). Currently, these defaults are stored in the common RAPL driver, which requires interface-specific handling logic and makes the common layer unnecessarily complex. There is no strong reason for the common code to own these defaults, since they are inherently interface-specific. To prepare for moving default configuration into the individual interface drivers, 1. Move struct rapl_defaults into a shared header so that interface drivers can directly populate their own default settings. 2. Change the @defaults field in struct rapl_if_priv from void * to const struct rapl_defaults * to improve type safety and readability and update the common driver to use the typed defaults structure. 3. Update all internal getter functions and local pointers to use const struct rapl_defaults * to maintain const-correctness. 4. Rename and export the common helper functions (check_unit, set_floor_freq, compute_time_window) so interface drivers may reuse or override them as appropriate. No functional changes. This is a preparatory refactoring to allow interface drivers to supply their own RAPL default settings. Co-developed-by: Zhang Rui Signed-off-by: Zhang Rui Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260212233044.329790-9-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 90503f9ffee927c3abdc94a4862d13ae71ea9442 Author: Kuppuswamy Sathyanarayanan Date: Thu Feb 12 15:30:39 2026 -0800 powercap: intel_rapl: Use unit conversion macros from units.h Replace hardcoded numeric constants with standard unit conversion macros from linux/units.h for better code clarity and self-documentation. Add MICROJOULE_PER_JOULE and NANOJOULE_PER_JOULE to units.h to support energy unit conversions, following the existing pattern for power units. No functional changes. Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260212233044.329790-8-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 71bb2c50e0248217dd3999621b06bd69c31e6e90 Author: Kuppuswamy Sathyanarayanan Date: Thu Feb 12 15:30:38 2026 -0800 powercap: intel_rapl: Use GENMASK() and BIT() macros Replace hardcoded bitmasks and bit shift operations with standard GENMASK(), GENMASK_ULL(), BIT(), and BIT_ULL() macros for better readability and to follow kernel coding conventions. No functional changes. Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260212233044.329790-7-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 923860a899a5e343fa0313c9f2f32d67c254f1ac Author: Kuppuswamy Sathyanarayanan Date: Thu Feb 12 15:30:37 2026 -0800 powercap: intel_rapl: Use shifts for power-of-2 operations Replace division by (1 << value) with shift operations for clarity and consistency. Add ULL suffix to avoid undefined behavior from shifting signed integers. No functional changes intended. Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260212233044.329790-6-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 637bf7404e046ab72f7019a13bbaa9a0368d2d1d Author: Kuppuswamy Sathyanarayanan Date: Thu Feb 12 15:30:36 2026 -0800 powercap: intel_rapl: Simplify rapl_compute_time_window_atom() Restructure to use early return for to_raw case, eliminating redundant assignments and clarifying conversion paths. No functional changes. Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260212233044.329790-5-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit c64e89ba9fa3d603142a4c5746cf148dc569574e Author: Kuppuswamy Sathyanarayanan Date: Thu Feb 12 15:30:35 2026 -0800 powercap: intel_rapl: Remove unused TIME_WINDOW macros Remove TIME_WINDOW_MIN_MSEC and TIME_WINDOW_MAX_MSEC as they are not used anywhere in the code. Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260212233044.329790-4-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 4fee5b749c92db83a60032206708ed5f68098e05 Author: Kuppuswamy Sathyanarayanan Date: Thu Feb 12 15:30:34 2026 -0800 powercap: intel_rapl: Cleanup coding style Improve code readability and consistency by: - Aligning macro definitions vertically - Reformatting primitive info arrays with consistent indentation - Aligning CPU ID table entries - Reorganizing macro definitions for better logical grouping - Using consistent hex formatting (0x00 instead of 0) - Capitalizing hex digits consistently (0xDF instead of 0xdf) - Removing unnecessary parentheses around numeric constants No functional changes. Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260212233044.329790-3-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 13060743a441700f6498942d2d0fea4fef0e9d65 Author: Kuppuswamy Sathyanarayanan Date: Thu Feb 12 15:30:33 2026 -0800 powercap: intel_rapl: Add a symbol namespace for intel_rapl exports Cleanup of the intel_rapl common driver requires introducing additional exported helper and lifecycle functions. Before adding new exports, create a dedicated symbol namespace for intel_rapl and update the relevant interface drivers to explicitly import it. This makes the intended usage of these symbols explicit, avoids polluting the global namespace, and prepares the codebase for the ongoing RAPL refactoring. No functional changes are intended. Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260212233044.329790-2-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit bc531c2cc1d179156e8e4bdede92842dc3b63cc2 Merge: a90e3029f20d8a 3c398063ef01b0 Author: Paolo Abeni Date: Thu Mar 5 15:49:52 2026 +0100 Merge branch 'gve-optimize-and-enable-hw-gro-for-dqo' Ankit Garg says: ==================== gve: optimize and enable HW GRO for DQO The DQO device has always performed HW GRO, not LRO. This series updates the feature bit and modifies the RX path to enhance support. It sets gso_segs correctly so the software stack can continue coalescing, and pulls network headers into the skb linear space to avoid multiple small memory copies when header-split is disabled. We also enable HW GRO by default on supported devices. ==================== Link: https://patch.msgid.link/20260303195549.2679070-1-joshwash@google.com Signed-off-by: Paolo Abeni commit 3c398063ef01b02d7efd31662154fe70fd28ace6 Author: Ankit Garg Date: Tue Mar 3 11:55:49 2026 -0800 gve: Enable hw-gro by default if device supported Change the driver's default behavior to enable hw-gro whenever supported for device. Performance observations: - We observed ~10% improvement in RX single stream throughput across various MTU sizes. - No change in TCP_RR/TCP_CRR latencies Signed-off-by: Ankit Garg Reviewed-by: Willem de Bruijn Reviewed-by: Harshitha Ramamurthy Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20260303195549.2679070-5-joshwash@google.com Signed-off-by: Paolo Abeni commit 0c7025fd24db5b2f8cbd2e1f0050c033b923fd48 Author: Ankit Garg Date: Tue Mar 3 11:55:48 2026 -0800 gve: pull network headers into skb linear part Currently, in DQO mode with hw-gro enabled, entire received packet is placed into skb fragments when header-split is disabled. This leaves the skb linear part empty, forcing the networking stack to do multiple small memory copies to access eth, IP and TCP headers. This patch adds a single memcpy to put all headers into linear portion before packet reaches the SW GRO stack; thus eliminating multiple smaller memcpy calls. Additionally, the criteria for calling napi_gro_frags() was updated. Since skb->head is now populated, we instead check if the SKB is the cached NAPI scratchpad to ensure we continue using the zero-allocation path. Signed-off-by: Ankit Garg Reviewed-by: Eric Dumazet Reviewed-by: Harshitha Ramamurthy Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20260303195549.2679070-4-joshwash@google.com Signed-off-by: Paolo Abeni commit ea4c1176871fd70a06eadcbd7c828f6cb9a1b0cd Author: Ankit Garg Date: Tue Mar 3 11:55:47 2026 -0800 gve: fix SW coalescing when hw-GRO is used Leaving gso_segs unpopulated on hardware GRO packet prevents further coalescing by software stack because the kernel's GRO logic marks the SKB for flush because the expected length of all segments doesn't match actual payload length. Setting gso_segs correctly results in significantly more segments being coalesced as measured by the result of dev_gro_receive(). gso_segs are derived from payload length. When header-split is enabled, payload is in the non-linear portion of skb. And when header-split is disabled, we have to parse the headers to determine payload length. Signed-off-by: Ankit Garg Reviewed-by: Eric Dumazet Reviewed-by: Jordan Rhee Reviewed-by: Harshitha Ramamurthy Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20260303195549.2679070-3-joshwash@google.com Signed-off-by: Paolo Abeni commit e637c244b954426b84340cbc551ca0e2a32058ce Author: Ankit Garg Date: Tue Mar 3 11:55:46 2026 -0800 gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO The device behind DQO format has always coalesced packets per stricter hardware GRO spec even though it was being advertised as LRO. Update advertised capability to match device behavior. Signed-off-by: Ankit Garg Reviewed-by: Willem de Bruijn Reviewed-by: Harshitha Ramamurthy Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20260303195549.2679070-2-joshwash@google.com Signed-off-by: Paolo Abeni commit 54de61a3f6894556364e2164602c7eaa943581be Author: Pengjie Zhang Date: Thu Jan 29 20:18:13 2026 +0800 cpufreq: Add debug print for current frequency in __cpufreq_driver_target() Include policy->cur in the debug message to explicitly show the frequency transition (from current to target). Signed-off-by: Pengjie Zhang Acked-by: Viresh Kumar Link: https://patch.msgid.link/20260129121813.3874516-1-zhangpengjie2@huawei.com Signed-off-by: Rafael J. Wysocki commit 6d3e2ce6f10107c2e5870e9dce7c2e1d03a6be72 Author: Srinivas Pandruvada Date: Mon Feb 23 11:04:20 2026 -0800 thermal: intel: int340x: Read DDR data rate for Nova Lake Add support for reading DDR data rate from PCI config offset. The register details are: CFG Offset : 0xE0 Bits : 11:2 DDR Data rate is in 33.33 MTPS units. Signed-off-by: Srinivas Pandruvada [ rjw: Rearrange code to avoid using goto and make declarations consistent ] Link: https://patch.msgid.link/20260223190420.874853-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 106a2662e655363db0dd73d9a91e1ec9afe9f4b1 Author: Rafael J. Wysocki Date: Mon Feb 23 16:40:18 2026 +0100 cpuidle: governors: teo: Rearrange stopped tick handling This change is based on the observation that it is not in fact necessary to select a deep idle state every time the scheduler tick has been stopped before the idle state selection takes place. Namely, if the time till the closest timer (that is not the tick) is short enough, a shallow idle state can be selected because the timer will kick the CPU out of that state, so the damage from a possible overly optimistic selection will be limited. Update the teo governor in accordance with the above in analogy with the previous analogous menu governor update. Among other things, this will cause the teo governor to call tick_nohz_get_sleep_length() every time when the tick has been stopped already and only change the original idle state selection if the time till the closest timer is beyond SAFE_TIMER_RANGE_NS which is way more straightforward than the current code flow. Of course, this effectively throws away some of the recent teo governor changes made recently, but the resulting simplification is worth it in my view. Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/1865078.VLH7GnMWUR@rafael.j.wysocki commit e57c2bf2e89df3b176ab579abfd3ed54fd27034c Author: Rafael J. Wysocki Date: Mon Feb 23 16:38:55 2026 +0100 cpuidle: governors: menu: Refine stopped tick handling This change is based on the observation that it is not in fact necessary to select a deep idle state every time the scheduler tick has been stopped before the idle state selection takes place. Namely, if the time till the closest timer (that is not the tick) is short enough, a shallow idle state can be selected because the timer will kick the CPU out of that state, so the damage from a possible overly optimistic selection will be limited. Update the menu governor in accordance with the above and use twice the tick period length as the "safe timer range" for allowing the original predicted_ns value to be used even if the tick has been stopped. Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/3341782.5fSG56mABF@rafael.j.wysocki commit 4c434585ce6d485ee12ed6becb1524f933454aba Author: Chen-Yu Tsai Date: Mon Mar 2 13:31:07 2026 +0800 arm64: dts: mediatek: mt8195-cherry-dojo: Describe M.2 M-key NVMe slot The Dojo device has a M.2 M-key slot for an included NVMe on some models. Add a proper device tree description based on the new M.2 M-key binding. Power for the slot is controlled by the embedded controller. As far as the main SoC is concerned, it is always on. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Manivannan Sadhasivam Signed-off-by: Chen-Yu Tsai Signed-off-by: AngeloGioacchino Del Regno commit 0c5d91b3d0eeed3925dd43f834afcc19a11aa9fd Author: Chen-Yu Tsai Date: Mon Mar 2 13:31:06 2026 +0800 arm64: dts: mediatek: mt8195-cherry: add WiFi PCIe and BT USB power supplies The MT8195 Cherry design features an M.2 E-key slot wired up with PCIe and USB for a WiFi+BT adapter. Previously the power was just enabled all the time with a default pinctrl setting that set the GPIO pin high. With the PCIe slot description DT binding in place, the power supplies can at least be added and tied to the PCIe and USB hosts. Once the M.2 E-key binding is merged, this description can be further converted to an M.2 E-key. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Manivannan Sadhasivam Signed-off-by: Chen-Yu Tsai Signed-off-by: AngeloGioacchino Del Regno commit a90e3029f20d8a8c2c1337436a313d29acde5b93 Author: Javen Xu Date: Tue Mar 3 17:46:11 2026 +0800 r8169: add support for RTL8125cp This patch adds support for chip RTL8125cp. Its XID is 0x708. We apply different configuration and firmware for RTL8125cp. Signed-off-by: Javen Xu Link: https://patch.msgid.link/20260303094611.450-1-javen_xu@realsil.com.cn [pabeni@redhat.com: changelog cleanup] Signed-off-by: Paolo Abeni commit 70836c8d0fe046400de8cdcf0613b2f1f6bddde3 Author: Qingfang Deng Date: Tue Mar 3 17:32:19 2026 +0800 ppp: don't store tx skb in the fastpath Currently, ppp->xmit_pending is used in ppp_send_frame() to pass a skb to ppp_push(), and holds the skb when a PPP channel cannot immediately transmit it. This state is redundant because the transmit queue (ppp->file.xq) can already handle the backlog. Furthermore, during normal operation, an skb is queued in file.xq only to be immediately dequeued, causing unnecessary overhead. Refactor the transmit path to avoid stashing the skb when possible: - Remove ppp->xmit_pending. - Rename ppp_send_frame() to ppp_prepare_tx_skb(), and don't call ppp_push() in it. It returns 1 if the skb is consumed (dropped/handled) or 0 if it can be passed to ppp_push(). - Update ppp_push() to accept the skb. It returns 1 if the skb is consumed, or 0 if the channel is busy. - Optimize __ppp_xmit_process(): - Fastpath: If the queue is empty, attempt to send the skb directly via ppp_push(). If busy, queue it. - Slowpath: If the queue is not empty, process the backlog in file.xq. Split dequeuing loop into a separate function ppp_xmit_flush() so ppp_channel_push() uses that directly instead of passing a NULL skb to __ppp_xmit_process(). This simplifies the states and reduces locking in the fastpath. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260303093219.234403-1-dqfext@gmail.com Signed-off-by: Paolo Abeni commit d1d75eaf01abceb3d5cb50253375b5f254b6be54 Author: Chi Zhiling Date: Tue Mar 3 11:14:09 2026 +0800 exfat: fix error handling for FAT table operations Fix three error handling issues in FAT table operations: 1. Fix exfat_update_bh() to properly return errors from sync_dirty_buffer 2. Fix exfat_end_bh() to properly return errors from exfat_update_bh() and exfat_mirror_bh() 3. Fix ignored return values from exfat_chain_cont_cluster() in inode.c and namei.c These fixes ensure that FAT table write errors are properly propagated to the caller instead of being silently ignored. Signed-off-by: Chi Zhiling Signed-off-by: Namjae Jeon commit 636bd62299aea24684086d126ea88b23a6466f8e Author: Chi Zhiling Date: Tue Mar 3 11:14:08 2026 +0800 exfat: optimize exfat_chain_cont_cluster with cached buffer heads When converting files from NO_FAT_CHAIN to FAT_CHAIN format, profiling reveals significant time spent in mark_buffer_dirty() and exfat_mirror_bh() operations. This overhead occurs because each FAT entry modification triggers a full block dirty marking and mirroring operation. For consecutive clusters that reside in the same block, optimize by caching the buffer head and performing dirty marking only once at the end of the block's modifications. Performance improvements for converting a 30GB file: | Cluster Size | Before Patch | After Patch | Speedup | |--------------|--------------|-------------|---------| | 512 bytes | 4.243s | 1.866s | 2.27x | | 4KB | 0.863s | 0.236s | 3.66x | | 32KB | 0.069s | 0.034s | 2.03x | | 256KB | 0.012s | 0.006s | 2.00x | Signed-off-by: Chi Zhiling Signed-off-by: Namjae Jeon commit 63193eb4452d3bf5b2b71042c536cb51c7d786cb Author: Chi Zhiling Date: Tue Mar 3 11:14:07 2026 +0800 exfat: drop redundant sec parameter from exfat_mirror_bh The sector offset can be obtained from bh->b_blocknr, so drop the redundant sec parameter from exfat_mirror_bh(). Also clean up the function to use exfat_update_bh() helper. No functional changes. Signed-off-by: Chi Zhiling Signed-off-by: Namjae Jeon commit 7094b09ea713d537f801a48853681c1b4205df2e Author: Chi Zhiling Date: Tue Mar 3 11:14:06 2026 +0800 exfat: use readahead helper in exfat_get_dentry Replace the custom exfat_dir_readahead() function with the unified exfat_blk_readahead() helper in exfat_get_dentry(). This removes the duplicate readahead implementation and uses the common interface, also reducing code complexity. Signed-off-by: Chi Zhiling Signed-off-by: Namjae Jeon commit a299900144da9276a66d3d8c5112605b273bacd6 Author: Chi Zhiling Date: Tue Mar 3 11:14:05 2026 +0800 exfat: use readahead helper in exfat_allocate_bitmap Use the newly added exfat_blk_readahead() helper in exfat_allocate_bitmap() to simplify the code. This eliminates the duplicate inline readahead logic and uses the unified readahead interface. Signed-off-by: Chi Zhiling Signed-off-by: Namjae Jeon commit 6ed88c9491d7693c87dd8bfb850c56770310828b Author: Chi Zhiling Date: Tue Mar 3 11:14:04 2026 +0800 exfat: add block readahead in exfat_chain_cont_cluster When a file cannot allocate contiguous clusters, exfat converts the file from NO_FAT_CHAIN to FAT_CHAIN format. For large files, this conversion process can take a significant amount of time. Add simple readahead to read all the FAT blocks in advance, as these blocks are consecutive, significantly improving the conversion performance. Test in an empty exfat filesystem: dd if=/dev/zero of=/mnt/file bs=1M count=30k dd if=/dev/zero of=/mnt/file2 bs=1M count=1 time cat /mnt/file2 >> /mnt/file | cluster size | before patch | after patch | | ------------ | ------------ | ----------- | | 512 | 47.667s | 4.316s | | 4k | 6.436s | 0.541s | | 32k | 0.758s | 0.071s | | 256k | 0.117s | 0.011s | Signed-off-by: Chi Zhiling Signed-off-by: Namjae Jeon commit 2413283fac5b2975f5ead6a1dcac7d5c6f7366d8 Author: Krzysztof Kozlowski Date: Thu Feb 26 21:35:27 2026 +0100 memory: tegra-mc: Use %pe format Make code printing pointer error value a bit simpler and fix coccinelle suggestion: tegra/mc.c:975:4-11: WARNING: Consider using %pe to print PTR_ERR() Signed-off-by: Krzysztof Kozlowski Acked-by: Thierry Reding Link: https://patch.msgid.link/20260226-memory-simplify-v1-4-ccb94f378628@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit f7bd985ad907ed85999f4bac4870abe35dcd2745 Author: Krzysztof Kozlowski Date: Thu Feb 26 21:35:26 2026 +0100 memory: tegra-mc: Simplify printing PTR_ERR with dev_err_probe Use dev_err_probe() to simplify the code and fix Coccinelle warning: tegra/mc.c:513:52-59: WARNING: Consider using %pe to print PTR_ERR() Signed-off-by: Krzysztof Kozlowski Acked-by: Thierry Reding Link: https://patch.msgid.link/20260226-memory-simplify-v1-3-ccb94f378628@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit 2ac5ba4c50be535497dc01089e4113185e4ccad1 Author: Krzysztof Kozlowski Date: Thu Feb 26 21:35:25 2026 +0100 memory: tegra-mc: Drop tegra_mc_setup_latency_allowance() return value tegra_mc_setup_latency_allowance() only succeeds, thus its return value can be dropped making code a bit simpler. Signed-off-by: Krzysztof Kozlowski Acked-by: Thierry Reding Link: https://patch.msgid.link/20260226-memory-simplify-v1-2-ccb94f378628@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit 8a39b1d4b358f8ccae29166e239f4dd2594b2e7c Author: Krzysztof Kozlowski Date: Thu Feb 26 21:35:24 2026 +0100 memory: renesas-rpc-if: Simplify printing PTR_ERR with dev_err_probe Use dev_err_probe() to simplify the code and fix Coccinelle warning: renesas-rpc-if.c:1010:3-10: WARNING: Consider using %pe to print PTR_ERR() Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260226-memory-simplify-v1-1-ccb94f378628@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit 0172f8d80220d2255cae00eb5131a864047433f7 Author: Erni Sri Satya Vennela Date: Mon Mar 2 09:41:52 2026 -0800 net: mana: Add MAC address to vPort logs and clarify error messages Add MAC address to vPort configuration success message and update error message to be more specific about HWC message errors in mana_send_request. Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260302174204.234837-1-ernis@linux.microsoft.com Signed-off-by: Paolo Abeni commit 75b864f08773a6a69f8c467dc2516e5e06414fa7 Author: Maher Sanalla Date: Wed Feb 25 16:19:35 2026 +0200 RDMA/mlx5: Add support for TLP VAR allocation Extend the VAR allocation UAPI to accept an optional flags attribute, allowing userspace to request TLP VAR allocation via the MLX5_IB_UAPI_VAR_ALLOC_FLAG_TLP flag. When the TLP flag "MLX5_IB_UAPI_VAR_ALLOC_FLAG_TLP" is specified, the driver selects the TLP VAR region for allocation instead of the regular VirtIO VAR region. Signed-off-by: Maher Sanalla Signed-off-by: Leon Romanovsky commit d3552a1f1e2074effc9d1822911b562a9996e224 Author: Maher Sanalla Date: Wed Feb 25 16:19:34 2026 +0200 RDMA/mlx5: Add TLP VAR region support and infrastructure Add support for TLP (Transaction Layer Packet) VAR regions used by software-defined device emulation. TLP VAR provides dedicated response gateways for sending TLP responses back to the host in TLP emulation scenarios. Signed-off-by: Maher Sanalla Signed-off-by: Leon Romanovsky commit ea6641828d43f6b07feb38f04f10cf0438b34d03 Author: Maher Sanalla Date: Wed Feb 25 16:19:33 2026 +0200 RDMA/mlx5: Refactor VAR table to use region abstraction Extract mlx5_var_region struct from mlx5_var_table to enable supporting multiple VAR regions in VAR table, which will be used in the upcoming patches (Virtio emulation VAR and TLP emulation VAR). Signed-off-by: Maher Sanalla Signed-off-by: Leon Romanovsky commit f63f1d74e952d85ada5af95a52ca61c7dc72d5e4 Merge: f30bc6f9b9cc49 385a06f74ff7a0 Author: Leon Romanovsky Date: Thu Mar 5 05:41:16 2026 -0500 Add support for TLP emulation This series adds support for Transaction Layer Packet (TLP) emulation response gateway regions, enabling userspace device emulation software to write TLP responses directly to lower layers without kernel driver involvement. Currently, the mlx5 driver exposes VirtIO emulation access regions via the MLX5_IB_METHOD_VAR_OBJ_ALLOC ioctl. This series extends that ioctl to also support allocating TLP response gateway channels for PCI device emulation use cases. Signed-off-by: Leon Romanovsky commit f30bc6f9b9cc492634a333be9c6aa9755ca1bf17 Author: Cheng Xu Date: Thu Mar 5 14:29:26 2026 +0800 RDMA/erdma: Remove numa_node from struct erdma_devattr Using dev_to_node() to get the pci device's numa information instead of caching it in struct erdma_devattr. Signed-off-by: Cheng Xu Link: https://patch.msgid.link/20260305062929.58881-1-chengyou@linux.alibaba.com Signed-off-by: Leon Romanovsky commit 9d2994f97ddf324ec1cb48333f62d3fbde6602da Author: Leon Romanovsky Date: Thu Feb 26 15:44:12 2026 +0200 RDMA/core: Delete not-implemented get_vector_affinity No drivers implement .get_vector_affinity(), and no callers invoke ib_get_vector_affinity(), so remove it. Link: https://patch.msgid.link/20260226-get_vector_affinity-v1-1-910a899c4e5d@nvidia.com Reviewed-by: Kalesh AP Signed-off-by: Leon Romanovsky commit dbd0472fd7a5bdd0b86c21c36f8afa713baa7653 Author: Michael Guralnik Date: Thu Feb 26 15:52:16 2026 +0200 RDMA/nldev: Expose kernel-internal FRMR pools in netlink Allow netlink users, through the usage of driver-details netlink attribute, to get information about internal FRMR pools that use the kernel_vendor_key FRMR key member. Signed-off-by: Michael Guralnik Reviewed-by: Patrisious Haddad Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260226-frmr_pools-v4-11-95360b54f15e@nvidia.com Signed-off-by: Leon Romanovsky commit da73d7634f61a1d5dbedc237f392c04ae487ca46 Author: Michael Guralnik Date: Thu Feb 26 15:52:15 2026 +0200 RDMA/nldev: Add command to set pinned FRMR handles Allow users to set through netlink, for a specific FRMR pool, the amount of handles that are not aged, and fill the pool to this amount. This allows users to warm-up the FRMR pools to an expected amount of handles with specific attributes that fits their expected usage. Signed-off-by: Michael Guralnik Reviewed-by: Patrisious Haddad Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260226-frmr_pools-v4-10-95360b54f15e@nvidia.com Signed-off-by: Leon Romanovsky commit 385a06f74ff7a03e3fb0b15fb87cfeb052d75073 Author: Maher Sanalla Date: Wed Feb 25 16:19:32 2026 +0200 net/mlx5: Expose TLP emulation capabilities Expose and query TLP device emulation caps on driver load. Signed-off-by: Maher Sanalla Signed-off-by: Leon Romanovsky commit 01b7768578a68abe597cfb36ebe0fc47c9305f88 Author: Maher Sanalla Date: Wed Feb 25 16:19:31 2026 +0200 net/mlx5: Add TLP emulation device capabilities Introduce the hardware structures and definitions needed for the driver support of TLP emulation in mlx5_ifc. Signed-off-by: Maher Sanalla Signed-off-by: Leon Romanovsky commit 6d32a196beb41525f055f720e98f97fb441f0ee0 Merge: d8103bfe41eeb8 f20c73b0460d15 Author: Paolo Abeni Date: Thu Mar 5 11:32:49 2026 +0100 Merge tag 'nf-next-26-03-04' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== netfilter: updates for net-next The following patchset contains Netfilter updates for *net-next*, including changes to IPv6 stack and updates to IPVS from Julian Anastasov. 1) ipv6: export fib6_lookup for nft_fib_ipv6 module 2) factor out ipv6_anycast_destination logic so its usable without dst_entry. These are dependencies for patch 3. 3) switch nft_fib_ipv6 module to no longer need temporary dst_entry object allocations by using fib6_lookup() + RCU. This gets us ~13% higher packet rate in my tests. Patches 4 to 8, from Eric Dumazet, zap sk_callback_lock usage in netfilter. Patch 9 removes another sk_callback_lock instance. Remaining patches, from Julian Anastasov, improve IPVS, Quoting Julian: * Add infrastructure for resizable hash tables based on hlist_bl. * Change the 256-bucket service hash table to be resizable. * Change the global connection table to be per-net and resizable. * Make connection hashing more secure for setups with multiple services. netfilter pull request nf-next-26-03-04 * tag 'nf-next-26-03-04' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: ipvs: use more keys for connection hashing ipvs: switch to per-net connection table ipvs: use resizable hash table for services ipvs: add resizable hash tables rculist_bl: add hlist_bl_for_each_entry_continue_rcu netfilter: nfnetlink_queue: remove locking in nfqnl_get_sk_secctx netfilter: nfnetlink_queue: no longer acquire sk_callback_lock netfilter: nfnetlink_log: no longer acquire sk_callback_lock netfilter: nft_meta: no longer acquire sk_callback_lock in nft_meta_get_eval_skugid() netfilter: xt_owner: no longer acquire sk_callback_lock in mt_owner() netfilter: nf_log_syslog: no longer acquire sk_callback_lock in nf_log_dump_sk_uid_gid() netfilter: nft_fib_ipv6: switch to fib6_lookup ipv6: make ipv6_anycast_destination logic usable without dst_entry ipv6: export fib6_lookup for nft_fib_ipv6 ==================== Link: https://patch.msgid.link/20260304114921.31042-1-fw@strlen.de Signed-off-by: Paolo Abeni commit d8103bfe41eeb8b6842672502a0025b7278931a8 Merge: ad3dfa80be7657 ea274bf8529a70 Author: Paolo Abeni Date: Thu Mar 5 11:18:18 2026 +0100 Merge branch 'amd-xgbe-add-support-for-p100a-platform' Raju Rangoju says: ==================== amd-xgbe: add support for P100a platform This patch series adds support for the AMD P100a platform featuring the ethernet controller PCI device ID 0x1122. The P100a platform uses different register access patterns and speed encoding compared to previous generation hardware (Yellow Carp,etc.) Key differences include: 1. Different XPCS window offset calculation due to changed memory mapping 2. 2.5G speed uses XGMII mode (ss=0x06) instead of GMII (ss=0x02) 3. Extended port speed bits (6-bit instead of 5-bit) for 5G support The series is organized as follows: Patch 1: Defines macros for MAC version numbers and speed select values to replace hardcoded magic numbers Patch 2: Adds the core P100a platform support with PCI ID, register configuration, and version-specific behavior Tested on AMD P100a platform verifying: - 10G/2.5G/1G/100M link establishment - PHY initialization and auto-negotiation - No register access errors ==================== Link: https://patch.msgid.link/20260302044409.1388430-1-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit ea274bf8529a70c987c7314b31176fc15f030dae Author: Raju Rangoju Date: Mon Mar 2 10:16:34 2026 +0530 amd-xgbe: add support for P100a platform Add hardware support for the AMD P100a platform featuring the ethernet controller PCI device ID 0x1122. Platform-specific changes include: 1. PCI device ID and register configuration: - Add XGBE_P100a_PCI_DEVICE_ID (0x1122) for recognition - Configure platform-specific XPCS window registers - Disable CDR workaround and RRC for this platform 2. XPCS window offset calculation fix: The P100a platform uses a different memory mapping scheme for XPCS register access. The offset calculation differs between platforms: - Older platforms (YC): offset = base + (addr & mask) The address is masked first, then added to the window base. - P100a: offset = (base + addr) & mask The full address is added to base first, then masked. This is critical because using the wrong calculation causes register reads/writes to access incorrect addresses, leading to incorrect behaviour. 3. 2.5G speed mode handling: P100a uses XGMII mode (ss=0x06) for 2.5G instead of GMII mode (ss=0x02) used by older platforms. The MAC version check determines which mode to use. 4. Port speed bits extended: Extend XP_PROP_0_PORT_SPEEDS from 5 bits to 6 bits to support the additional 5G speed capability. 5. Rx adaptation disabled: Rx adaptation is disabled for P100a (MAC version 0x33) as this feature requires further development for this platform. 6. Rate change command for 2.5G: Use XGBE_MB_SUBCMD_2_5G_KX subcommand for 2.5G mode on P100a instead of XGBE_MB_SUBCMD_NONE used on older platforms. Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260302044634.1388661-2-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 718e1f6dd06e8055ee9ca297a3f2219168bda19f Author: Raju Rangoju Date: Mon Mar 2 10:16:33 2026 +0530 amd-xgbe: define macros for MAC versions and speed select values Define symbolic constants for MAC hardware version numbers and speed select register values to improve code readability and maintainability. This replaces magic numbers like 0x30, 0x33, 0x07, 0x06, etc. with descriptive macro names that indicate their purpose: MAC versions: - XGBE_MAC_VER_30: Baseline version supporting Rx adaptation - XGBE_MAC_VER_33: P100a platform version Speed select values for MAC_TCR_SS register: - XGBE_MAC_SS_10G: 10Gbps XGMII mode - XGBE_MAC_SS_2_5G_GMII: 2.5Gbps GMII mode (older platforms) - XGBE_MAC_SS_2_5G_XGMII: 2.5Gbps XGMII mode (P100a) - XGBE_MAC_SS_1G: 1Gbps mode - XGBE_MAC_SS_100M: 100Mbps mode - XGBE_MAC_SS_10M: 10Mbps mode No functional changes. Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260302044634.1388661-1-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit a7da7fb57f2a787412da1a62292a17fa00fbfbdf Merge: f505e978d1a044 11439c4635edd6 Author: Mauro Carvalho Chehab Date: Thu Mar 5 10:55:47 2026 +0100 Merge tag 'v7.0-rc2' into __tmp-hverkuil-media-tags_br_v7_1a Linux 7.0-rc2 * tag 'v7.0-rc2': (372 commits) Linux 7.0-rc2 firewire: ohci: initialize page array to use alloc_pages_bulk() correctly KVM: always define KVM_CAP_SYNC_MMU KVM: remove CONFIG_KVM_GENERIC_MMU_NOTIFIER selftests/bpf: Avoid simplification of crafted bounds test selftests/bpf: Test refinement of single-value tnum bpf: Improve bounds when tnum has a single possible value bpf: Introduce tnum_step to step through tnum's members bpf: Fix race in devmap on PREEMPT_RT bpf: Fix race in cpumap on PREEMPT_RT selftests/bpf: Add tests for special fields races bpf: Retire rcu_trace_implies_rcu_gp() from local storage bpf: Delay freeing fields in local storage bpf: Lose const-ness of map in map_check_btf() bpf: Register dtor for freeing special fields PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value smb: client: Use snprintf in cifs_set_cifscreds mm/slab: initialize slab->stride early to avoid memory ordering issues smb: client: Don't log plaintext credentials in cifs_set_cifscreds smb: client: fix broken multichannel with krb5+signing ... commit 5eed3d6aa58c7f1ded6ba31fb2ae013ae55e7006 Author: Namjae Jeon Date: Thu Mar 5 17:37:02 2026 +0900 ntfs: select FS_IOMAP in Kconfig Add 'select FS_IOMAP' to the NTFS_FS Kconfig option so that CONFIG_NTFS_FS automatically enables CONFIG_FS_IOMAP when built. Signed-off-by: Namjae Jeon commit 040457cfeaea667d6a9d959d04405c94fa9ac7a4 Author: Woody Suwalski Date: Thu Mar 5 17:35:48 2026 +0900 ntfs: add MODULE_ALIAS_FS Add missing MODUE_ALIAS record to the ntfs driver to allow automatic loading of the module. Signed-off-by: Woody Suwalski Signed-off-by: Namjae Jeon commit a3a20c5f4e10f43e137ee32842639637c853c3a6 Author: Andras Sebok Date: Wed Mar 4 22:56:54 2026 +0530 arm64: dts: exynos: add initial support for Samsung Galaxy J5 Add initial devicetree support for Samsung Galaxy J5 (2017) using Exynos7870 SoC. Signed-off-by: Andras Sebok Signed-off-by: Kaustabh Chakraborty Link: https://patch.msgid.link/20260304-exynos7870-j5y17lte-v1-2-eb25902c84c8@disroot.org [krzk: Rephrase commit msg] Signed-off-by: Krzysztof Kozlowski commit 135b55014109de2e6c8b9c5d52e5cfd7b765315e Author: Kaustabh Chakraborty Date: Wed Mar 4 22:56:53 2026 +0530 dt-bindings: arm: samsung: add compatible for samsung-j5y17lte Document board compatible for samsung-j5y17lte (exynos7870) Signed-off-by: Kaustabh Chakraborty Link: https://patch.msgid.link/20260304-exynos7870-j5y17lte-v1-1-eb25902c84c8@disroot.org Signed-off-by: Krzysztof Kozlowski commit 21613f67ede11e495281b4a6dde72cd7db3ada4e Author: Sebastian Brzezinka Date: Tue Mar 3 13:26:42 2026 +0100 drm/ttm: fix NULL deref in ttm_bo_flush_all_fences() after fence ops detach Since commit 541c8f2468b9 ("dma-buf: detach fence ops on signal v3"), fence->ops may be set to NULL via RCU when a fence signals and has no release/wait ops. ttm_bo_flush_all_fences() was not updated to handle this and directly dereferences fence->ops->signaled, leading to a NULL pointer dereference crash: ``` BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:ttm_bo_release+0x1bc/0x330 [ttm] ``` Since dma_fence_enable_sw_signaling() already handles the signaled case internally (it checks DMA_FENCE_FLAG_SIGNALED_BIT before doing anything), the ops->signaled pre-check is redundant. Simply remove it and call dma_fence_enable_sw_signaling() unconditionally for each fence. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15759 Fixes: 541c8f2468b9 ("dma-buf: detach fence ops on signal v3") Cc: Christian König Signed-off-by: Sebastian Brzezinka Reviewed-by: Christian König Reviewed-by: Andi Shyti Signed-off-by: Christian König Link: https://lore.kernel.org/r/1c2f34351b6fb70ab576aeac07987542a4d480b2.1772540459.git.sebastian.brzezinka@intel.com commit d2e20c8951e4bb5f4a828aed39813599980353b6 Author: Thomas Zimmermann Date: Fri Feb 27 14:31:03 2026 +0100 drm/gud: Test for imported buffers with drm_gem_is_imported() Instead of testing import_attach for imported GEM buffers, invoke drm_gem_is_imported() to do the test. The test itself does not change. Signed-off-by: Thomas Zimmermann Cc: Ruben Wauters Acked-by: Ruben Wauters Link: https://patch.msgid.link/20260227133113.235940-4-tzimmermann@suse.de commit 0b74f7d72399d4c4422ed3d68ef28b3612f71e74 Author: Alok Tiwari Date: Thu Feb 26 19:06:53 2026 -0800 PCI: endpoint: Propagate error from pci_epf_create() pci_epf_make() overwrites the actual error returned by pci_epf_create() with -EINVAL, which hides the real failure reason. Use PTR_ERR(epf) instead and print the error code. Signed-off-by: Alok Tiwari Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260227030701.40533-1-alok.a.tiwari@oracle.com commit df5d8fb6fe55754bc2956e501a9e6acaca5af7d9 Author: Randolph Lin Date: Wed Feb 25 16:55:03 2026 +0800 PCI: qilai: Add Andes QiLai SoC PCIe host driver support Add driver support for DesignWare based PCIe controller in Andes QiLai SoC. The driver only supports the Root Complex mode. Signed-off-by: Randolph Lin [mani: squashed the MAINTAINERS change] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260225085504.3757601-4-randolph@andestech.com commit 6bf2305ea846868dc1ff9004eb3f61a6590d8431 Author: Randolph Lin Date: Wed Feb 25 16:55:01 2026 +0800 dt-bindings: PCI: Add Andes QiLai PCIe support Add the Andes QiLai PCIe node, which includes 3 Root Complexes. Only one example is required in the DTS bindings YAML file. Signed-off-by: Randolph Lin Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260225085504.3757601-2-randolph@andestech.com commit 88ce49abc2185da3d08da9f71290d46a393d3876 Author: Alok Tiwari Date: Tue Feb 24 10:39:19 2026 -0800 PCI: endpoint: Fix typo in pci_epf_add_vepf() kernel-doc The function description in kernel-doc refers to pci_epf_add_epf(), but the correct function name is pci_epf_add_vepf(). Update it to match the implementation. Signed-off-by: Alok Tiwari [mani: commit log] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260224183927.1369124-1-alok.a.tiwari@oracle.com commit ad3dfa80be765757f612da04318248f6d20e4f71 Author: Jori Koolstra Date: Tue Mar 3 17:31:04 2026 +0100 dibs: change dibs_class to a const struct The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Change dibs_class to be a const struct class and drop the class_create() call. Link: https://lore.kernel.org/all/2023040244-duffel-pushpin-f738@gregkh/ Suggested-by: Greg Kroah-Hartman Signed-off-by: Jori Koolstra Reviewed-by: Greg Kroah-Hartman Reviewed-by: Alexandra Winter Link: https://patch.msgid.link/20260303163104.3749311-1-jkoolstra@xs4all.nl Signed-off-by: Jakub Kicinski commit d37f53822c4c96b3fbcd487b0da4f2232c5863e6 Author: Jakub Kicinski Date: Tue Mar 3 13:36:25 2026 -0800 selftests: drv-net: update the README I have added some instructions for driver authors on the NIPA wiki: https://github.com/linux-netdev/nipa/wiki/Guidance-for-test-authors last year. Given the increasingly common use of LLMs let's add those in tree as well. Hopefully this will decrease the number of review comments we have to give to AI-assisted noobs. While at it sync the overall instructions with what's on the GitHub as well. Link: https://patch.msgid.link/20260303213626.2320308-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f85db97bc5d4d2048016cc0cfb5a8d80cab24e9a Author: Dimitri Daskalakis Date: Tue Mar 3 12:22:58 2026 -0800 selftests: drv-net: rss: Fix error calculation in test_hitless_key_update This test verifies there are no errors when a devices RSS key is updated while traffic is flowing. The current check is a no-op since the last sample was subtracted from itself. Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20260303202258.1595661-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit d824c64a937d18dd8c31add6a651eb7666029b1c Merge: c66e0f453d1afa 246c5495c69fae Author: Jakub Kicinski Date: Wed Mar 4 18:37:21 2026 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-03-02 (ice, i40e, ixgbe) For ice: Simon Horman adds const modifier to read only member of a struct. For i40e: Yury Norov removes an unneeded check of bitmap_weight(). Andy Shevchenko adds a missing include. For ixgbe: Aleksandr changes declaration of a bitmap to utilize DECLARE_BITMAP() macro. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ixgbe: refactor: use DECLARE_BITMAP for ring state field i40e: Add missing wordpart.h header i40e: drop useless bitmap_weight() call in i40e_set_rxfh_fields() ice: Make name member of struct ice_cgu_pin_desc const ==================== Link: https://patch.msgid.link/20260304000800.3536872-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 54e417f2b82b730b31ea66be76f513a779da328c Author: Tommaso Merciai Date: Thu Jan 29 17:48:48 2026 +0100 dt-bindings: mux: Remove nodename pattern constraints The nodename pattern in created an unnecessary restriction that forced all mux nodes to be named with the 'mux-controller' prefix. This prevented valid use cases where mux functionality is part of other hardware blocks that should use more specific naming conventions. Remove the $nodename pattern constraints from both the 'select' keyword and the properties section of the mux-controller schema. Reviewed-by: Conor Dooley Signed-off-by: Tommaso Merciai Link: https://patch.msgid.link/dbe73c0777eca61cf14442f4082caae62b61805a.1769703480.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Rob Herring (Arm) commit b1718b0367ba31e8db273e3896ebd1707bcbe59e Author: Peter Collingbourne Date: Tue Mar 3 15:00:54 2026 -0800 perf annotate: Specify llvm features="+all" for aarch64 This is consistent with what llvm-objdump does (see [1]) and allows the LLVM disassembler to disassemble instructions not in the base instruction set. [1] https://reviews.llvm.org/D127741 Link: https://linux-review.googlesource.com/id/I52e4fef18d2e12b45f875231fa9d3efff2538fd4 Signed-off-by: Peter Collingbourne Reviewed-by: Ian Rogers Acked-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit c66e0f453d1afa82534383c58d503238a43fa76c Author: Eric Dumazet Date: Wed Mar 4 01:27:47 2026 +0000 net: use ktime_t in struct scm_timestamping_internal Instead of using struct timespec64 in scm_timestamping_internal, use ktime_t, saving 24 bytes in kernel stack. This makes tcp_update_recv_tstamps() small enough to be inlined. The ktime_t -> timespec64 conversions happen after socket lock has been released in tcp_recvmsg(), and only if the application requested them. $ scripts/bloat-o-meter -t vmlinux.0 vmlinux add/remove: 0/2 grow/shrink: 5/4 up/down: 146/-277 (-131) Function old new delta tcp_zerocopy_receive 2383 2425 +42 mptcp_recvmsg 1565 1607 +42 tcp_recvmsg_locked 3797 3823 +26 put_cmsg_scm_timestamping64 131 149 +18 put_cmsg_scm_timestamping 131 149 +18 __pfx_tcp_update_recv_tstamps 16 - -16 do_tcp_getsockopt 4024 4006 -18 tcp_recv_timestamp 474 430 -44 tcp_zc_handle_leftover 417 371 -46 __sock_recv_timestamp 1087 1031 -56 tcp_update_recv_tstamps 97 - -97 Total: Before=25223788, After=25223657, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Reviewed-by: Jason Xing Link: https://patch.msgid.link/20260304012747.881644-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 39ae83b0f557969c461d93c608545443a2f5c307 Author: Randy Dunlap Date: Tue Mar 3 17:24:37 2026 -0800 net: openvswitch: clean up some kernel-doc warnings Fix some kernel-doc warnings in openvswitch.h: Mark enum placeholders that are not used as "private" so that kernel-doc comments are not needed for them. Correct names for 2 enum values: Warning: include/uapi/linux/openvswitch.h:300 Excess enum value '@OVS_VPORT_UPCALL_SUCCESS' description in 'ovs_vport_upcall_attr' Warning: include/uapi/linux/openvswitch.h:300 Excess enum value '@OVS_VPORT_UPCALL_FAIL' description in 'ovs_vport_upcall_attr' Convert one comment from "/**" kernel-doc to a plain C "/*" comment: Warning: include/uapi/linux/openvswitch.h:638 This comment starts with '/**', but isn't a kernel-doc comment. * Omit attributes for notifications. Add more kernel-doc: - add kernel-doc for kernel-only enums; - add missing kernel-doc for enum ovs_datapath_attr; - add missing kernel-doc for enum ovs_flow_attr; - add missing kernel-doc for enum ovs_sample_attr; - add kernel-doc for enum ovs_check_pkt_len_attr; - add kernel-doc for enum ovs_action_attr; - add kernel-doc for enum ovs_action_push_eth; - add kernel-doc for enum ovs_vport_attr; Signed-off-by: Randy Dunlap Acked-by: Ilya Maximets Link: https://patch.msgid.link/20260304012437.469151-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 1d88db16156e02989087eb6287662827c10ada13 Author: Eric Dumazet Date: Tue Mar 3 19:12:43 2026 +0000 tcp: move tcp_do_parse_auth_options() to net/ipv4/tcp.c tcp_do_parse_auth_options() fast path user is tcp_inbound_hash(). Move tcp_do_parse_auth_options() right before tcp_inbound_hash() so that it can be (auto)inlined by the compiler. As a bonus, stack canary is removed from tcp_inbound_hash(). Also use EXPORT_IPV6_MOD(tcp_do_parse_auth_options). $ scripts/bloat-o-meter -t vmlinux.0 vmlinux add/remove: 0/0 grow/shrink: 1/0 up/down: 131/0 (131) Function old new delta tcp_inbound_hash 565 696 +131 Total: Before=25223788, After=25223919, chg +0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260303191243.557245-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4faa1893807cfc9363b19624f8666e07e7e42f59 Merge: 05c9b2eda8a9e3 e8ae16d65ac629 Author: Martin KaFai Lau Date: Wed Mar 4 12:46:47 2026 -0800 Merge branch 'fix-the-null-pointer-dereference-issue-in-bpf_lwt_xmit_push_encap' Feng Yang says: ==================== Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap Changes in v10: - Patch simplification. Thanks, Martin KaFai Lau. - Link to v9: https://lore.kernel.org/all/20260303074423.172680-1-yangfeng59949@163.com/ Changes in v9: - Use dst_hold() and skb_dst_set(). Skip !skb_dst check. Move all changes into the IS_ENABLED(CONFIG_IPV6). Use #if IS_ENABLED(CONFIG_IPV6); otherwise, a compilation error will occur when ipv6 is not enabled. Thanks, Martin KaFai Lau. - Link to v8: https://lore.kernel.org/all/20260227082133.96951-1-yangfeng59949@163.com/ Changes in v8: - set ret to an error code before goto out. - Link to v7: https://lore.kernel.org/all/20260226095156.117996-1-yangfeng59949@163.com/ Changes in v7: - Use ip6_null_entry to avoid. Thanks, Martin KaFai Lau. Changes in v6: - Modify the bpf_lwt_xmit_push_encap function and add selftests for it. Thanks, Martin KaFai Lau. - Link to v5: https://lore.kernel.org/all/20260210090657.86977-1-yangfeng59949@163.com/ Changes in v5: - Refer to the bpf_lwt_xmit_reroute function to configure the dst parameter. - Link to v4: https://lore.kernel.org/all/20260209015111.28144-1-yangfeng59949@163.com/ Changes in v4: - add rcu lock - Link to v3: https://lore.kernel.org/all/20260206055113.63476-1-yangfeng59949@163.com/ Changes in v3: - use dst_init - Link to v2: https://lore.kernel.org/all/20260205092227.126665-1-yangfeng59949@163.com/ Changes in v2: - Link to v1: https://lore.kernel.org/all/20260127084520.13890-1-luyun_611@163.com/ ==================== Link: https://patch.msgid.link/20260304094429.168521-1-yangfeng59949@163.com Signed-off-by: Martin KaFai Lau commit db739ff277b4ba8713224a334d7e388d04473725 Merge: c26b8c4e291c55 a435163d3100b0 Author: Jakub Kicinski Date: Wed Mar 4 16:54:12 2026 -0800 Merge branch 'rfs-use-high-order-allocations-for-hash-tables' Eric Dumazet says: ==================== rfs: use high-order allocations for hash tables This series adds rps_tag_ptr which encodes both a pointer and a size of a power-of-two hash table in a single long word. RFS hash tables (global and per rx-queue) are converted to rps_tag_ptr. This removes a cache line miss, and allows high-order allocations. The global hash table can benefit from huge pages. ==================== Link: https://patch.msgid.link/20260302181432.1836150-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a435163d3100b044d620990772a5ce1684ff02ca Author: Eric Dumazet Date: Mon Mar 2 18:14:32 2026 +0000 net-sysfs: use rps_tag_ptr and remove metadata from rps_dev_flow_table Instead of storing the @log at the beginning of rps_dev_flow_table use 5 low order bits of the rps_tag_ptr to store the log of the size. This removes a potential cache line miss (for light traffic). This allows us to switch to one high-order allocation instead of vmalloc() when CONFIG_RFS_ACCEL is not set. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260302181432.1836150-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit b2cc61857e3cf7e103089dd54c0548d54a6ae381 Author: Eric Dumazet Date: Mon Mar 2 18:14:31 2026 +0000 net-sysfs: remove rcu field from 'struct rps_dev_flow_table' Remove rps_dev_flow_table_release() in favor of kvfree_rcu_mightsleep(). In the following pach, we will remove "u8 @log" field and 'struct rps_dev_flow_table' size will be a power-of-two. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260302181432.1836150-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit 68b6394a220b782586e30d0efb94633ccaef9c8d Author: Eric Dumazet Date: Mon Mar 2 18:14:30 2026 +0000 net-sysfs: get rid of rps_dev_flow_lock Use unrcu_pointer() and xchg() in store_rps_dev_flow_table_cnt() instead of a dedicated spinlock. Make a similar change in rx_queue_release(), so that both functions use a similar construct and synchronization. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260302181432.1836150-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit dd378109d20ff6789091fa3558607c1d242d80ad Author: Eric Dumazet Date: Mon Mar 2 18:14:29 2026 +0000 net-sysfs: use rps_tag_ptr and remove metadata from rps_sock_flow_table Instead of storing the @mask at the beginning of rps_sock_flow_table, use 5 low order bits of the rps_tag_ptr to store the log of the size. This removes a potential cache line miss to fetch @mask. More importantly, we can switch to vmalloc_huge() without wasting memory. Tested with: numactl --interleave=all bash -c "echo 4194304 >/proc/sys/net/core/rps_sock_flow_entries" Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260302181432.1836150-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9cde131cdd888873363b5d9dfd8d4d4c1fae6986 Author: Eric Dumazet Date: Mon Mar 2 18:14:28 2026 +0000 net-sysfs: add rps_sock_flow_table_mask() helper In preparation of the following patch, abstract access to the @mask field in 'struct rps_sock_flow_table'. Also cleanup rps_sock_flow_sysctl() a bit : - Rename orig_sock_table to o_sock_table. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260302181432.1836150-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 61753849b8bc6420cc5834fb3de331ce1134060d Author: Eric Dumazet Date: Mon Mar 2 18:14:27 2026 +0000 net-sysfs: remove rcu field from 'struct rps_sock_flow_table' Removing rcu_head (and @mask in a following patch) will allow a power-of-two allocation and thus high-order allocation for better performance. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260302181432.1836150-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 42a101775bc515a77ac0c39de6cef42aa7abb3a7 Author: Eric Dumazet Date: Mon Mar 2 18:14:26 2026 +0000 net: add rps_tag_ptr type and helpers Add a new rps_tag_ptr type to encode a pointer and a size to a power-of-two table. Three helpers are added converting an rps_tag_ptr to: 1) A log of the size. 2) A mask : (size - 1). 3) A pointer to the array. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260302181432.1836150-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit c26b8c4e291c55c7b2138d7bcb27348ca3a5ae59 Author: Eric Dumazet Date: Mon Mar 2 16:39:33 2026 +0000 net: fix off-by-one in udp_flow_src_port() / psp_write_headers() udp_flow_src_port() and psp_write_headers() use ip_local_port_range. ip_local_port_range is inclusive : all ports between min and max can be used. Before this patch, if ip_local_port_range was set to 40000-40001 40001 would not be used as a source port. Use reciprocal_scale() to help code readability. Not tagged for stable trees, as this change could break user expectations. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260302163933.1754393-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit e8ae16d65ac629bcdebf685b9ad9b008648b08b0 Author: Feng Yang Date: Wed Mar 4 17:44:29 2026 +0800 selftests/bpf: Add selftests for the invocation of bpf_lwt_xmit_push_encap Calling bpf_lwt_xmit_push_encap will not cause a crash when dst is missing. Signed-off-by: Feng Yang Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260304094429.168521-3-yangfeng59949@163.com commit 972787479ee73006fddb5e59ab5c8e733810ff42 Author: Feng Yang Date: Wed Mar 4 17:44:28 2026 +0800 bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap The bpf_lwt_xmit_push_encap helper needs to access skb_dst(skb)->dev to calculate the needed headroom: err = skb_cow_head(skb, len + LL_RESERVED_SPACE(skb_dst(skb)->dev)); But skb->_skb_refdst may not be initialized when the skb is set up by bpf_prog_test_run_skb function. Executing bpf_lwt_push_ip_encap function in this scenario will trigger null pointer dereference, causing a kernel crash as Yinhao reported: [ 105.186365] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 105.186382] #PF: supervisor read access in kernel mode [ 105.186388] #PF: error_code(0x0000) - not-present page [ 105.186393] PGD 121d3d067 P4D 121d3d067 PUD 106c83067 PMD 0 [ 105.186404] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 105.186412] CPU: 3 PID: 3250 Comm: poc Kdump: loaded Not tainted 6.19.0-rc5 #1 [ 105.186423] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.186427] RIP: 0010:bpf_lwt_push_ip_encap+0x1eb/0x520 [ 105.186443] Code: 0f 84 de 01 00 00 0f b7 4a 04 66 85 c9 0f 85 47 01 00 00 31 c0 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8b 73 58 48 83 e6 fe <48> 8b 36 0f b7 be ec 00 00 00 0f b7 b6 e6 00 00 00 01 fe 83 e6 f0 [ 105.186449] RSP: 0018:ffffbb0e0387bc50 EFLAGS: 00010246 [ 105.186455] RAX: 000000000000004e RBX: ffff94c74e036500 RCX: ffff94c74874da00 [ 105.186460] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff94c74e036500 [ 105.186463] RBP: 0000000000000001 R08: 0000000000000002 R09: 0000000000000000 [ 105.186467] R10: ffffbb0e0387bd50 R11: 0000000000000000 R12: ffffbb0e0387bc98 [ 105.186471] R13: 0000000000000014 R14: 0000000000000000 R15: 0000000000000002 [ 105.186484] FS: 00007f166aa4d680(0000) GS:ffff94c8b7780000(0000) knlGS:0000000000000000 [ 105.186490] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.186494] CR2: 0000000000000000 CR3: 000000015eade001 CR4: 0000000000770ee0 [ 105.186499] PKRU: 55555554 [ 105.186502] Call Trace: [ 105.186507] [ 105.186513] bpf_lwt_xmit_push_encap+0x2b/0x40 [ 105.186522] bpf_prog_a75eaad51e517912+0x41/0x49 [ 105.186536] ? kvm_clock_get_cycles+0x18/0x30 [ 105.186547] ? ktime_get+0x3c/0xa0 [ 105.186554] bpf_test_run+0x195/0x320 [ 105.186563] ? bpf_test_run+0x10f/0x320 [ 105.186579] bpf_prog_test_run_skb+0x2f5/0x4f0 [ 105.186590] __sys_bpf+0x69c/0xa40 [ 105.186603] __x64_sys_bpf+0x1e/0x30 [ 105.186611] do_syscall_64+0x59/0x110 [ 105.186620] entry_SYSCALL_64_after_hwframe+0x76/0xe0 [ 105.186649] RIP: 0033:0x7f166a97455d Temporarily add the setting of skb->_skb_refdst before bpf_test_run to resolve the issue. Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap") Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Closes: https://groups.google.com/g/hust-os-kernel-patches/c/8-a0kPpBW2s Signed-off-by: Yun Lu Signed-off-by: Feng Yang Signed-off-by: Martin KaFai Lau Tested-by: syzbot@syzkaller.appspotmail.com Link: https://patch.msgid.link/20260304094429.168521-2-yangfeng59949@163.com commit 98d95000bb1207f86a0e5876755ac2308ac86d2d Merge: aefa52a28a36cf 32d6fd5832ad87 Author: Jakub Kicinski Date: Wed Mar 4 16:41:57 2026 -0800 Merge branch 'tools-ynl-tests-adjust-makefile-to-mimic-ksft' Jakub Kicinski says: ==================== tools: ynl: tests: adjust Makefile to mimic ksft Make a few minor adjustments to tools/net/ynl/tests/Makefile to align its behavior more with how real kselftests behave. This series allows running the YNL tests in NIPA with little extra integration effort. If anyone already integrated these tests into their CI minor adjustments to the integration may be needed (due to patch 2). ==================== Link: https://patch.msgid.link/20260303163504.2084981-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 32d6fd5832ad8773fa19192a3e6695cac5cd4379 Author: Jakub Kicinski Date: Tue Mar 3 08:35:04 2026 -0800 tools: ynl: produce kselftest-list.txt from tests Executors will need kselftest-list.txt so create it when tests are installed. Acked-by: Matthieu Baerts (NGI0) Reviewed-by: Hangbin Liu Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20260303163504.2084981-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2bfc36f5ea163b9ea620c99cac9582245e3681ef Author: Jakub Kicinski Date: Tue Mar 3 08:35:03 2026 -0800 tools: ynl: support INSTALL_PATH in the tests Makefile We have modelled the YNL tests after ksft to be able to reuse the NIPA wrappers. Make sure YNL honors INSTALL_PATH not just DESTDIR, ksft uses INSTALL_PATH. Acked-by: Matthieu Baerts (NGI0) Reviewed-by: Hangbin Liu Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20260303163504.2084981-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3e90e00da96b6eddc91b5fffb19089d35af48695 Author: Jakub Kicinski Date: Tue Mar 3 08:35:02 2026 -0800 tools: ynl: don't install tests in /usr/bin/ Until commit 790792ebc960 ("tools: ynl: don't install tests") YNL selftests were installed with all the other YNL outputs. That's no longer the case, as tests are not really production artifacts. Let's not install them in /usr/bin at all, and mirror kselftest format more closely: For: make -C tools/net/ynl/tests/ install DESTDIR=tmp tmp/usr/share/kselftest ├── ktap_helpers.sh └── ynl ├── test_ynl_cli.sh └── test_ynl_ethtool.sh Acked-by: Matthieu Baerts (NGI0) Reviewed-by: Hangbin Liu Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20260303163504.2084981-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d86670b837fbe1994e8b1ce9d1f56f1272038ad1 Author: Jakub Kicinski Date: Tue Mar 3 08:35:01 2026 -0800 tools: ynl: rename TESTS variable to TEST_PROGS Use the standard kselftest variable naming for tests in the Makefile. NIPA depends on being able to selectively target tests by setting those variables on the CLI. Acked-by: Matthieu Baerts (NGI0) Reviewed-by: Hangbin Liu Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20260303163504.2084981-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit aefa52a28a36cf4c9063c095a8191c951e07eb4e Author: Daniel Golle Date: Tue Mar 3 03:17:43 2026 +0000 net: dsa: mxl862xx: rename MDIO op arguments The use of the 'port' argument name for functions implementing the MDIO bus operations is misleading as the port address isn't equal to the PHY address. Rename the MDIO operation argument name to match the prototypes of mdiobus_write, mdiobus_read, mdiobus_c45_read and mdiobus_c45_write. Suggested-by: Vladimir Oltean Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/e1f4cb3bcffc7df9af0f2c9b673b14c7e1201c9a.1772507674.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 8838bb185ef3c801ea4641a95bdace6210cd4b4e Author: Daniel Golle Date: Tue Mar 3 03:16:23 2026 +0000 dt-bindings: net: dsa: maxlinear,mxl862xx: remove port label The ports in the example device tree should not have a 'label' property. Labels for all user ports have been removed from an earlier submission, but this was overlooked in the case of the CPU port. Remove 'cpu' port label from the example. Suggested-by: Vladimir Oltean Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Acked-by: Conor Dooley Link: https://patch.msgid.link/61579de297eb636ec5f1e6c97d453e26abb0625d.1772507210.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 3900e56eb184abcc8a16ab52af24ea255589acc2 Author: Yosry Ahmed Date: Mon Feb 9 19:51:42 2026 +0000 KVM: selftests: Add a test for L2 clearing EFER.SVME without intercept Add a test that verifies KVM's newly introduced behavior of synthesizing a triple fault in L1 if L2 clears EFER.SVME without an L1 interception (which is architecturally undefined). Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260209195142.2554532-3-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit cdc69269b18a19cb76eaf7bf4fa47fe270dcaf11 Author: Yosry Ahmed Date: Mon Feb 9 19:51:41 2026 +0000 KVM: SVM: Triple fault L1 on unintercepted EFER.SVME clear by L2 KVM tracks when EFER.SVME is set and cleared to initialize and tear down nested state. However, it doesn't differentiate if EFER.SVME is getting toggled in L1 or L2+. If L2 clears EFER.SVME, and L1 does not intercept the EFER write, KVM exits guest mode and tears down nested state while L2 is running, executing L1 without injecting a proper #VMEXIT. According to the APM: The effect of turning off EFER.SVME while a guest is running is undefined; therefore, the VMM should always prevent guests from writing EFER. Since the behavior is architecturally undefined, KVM gets to choose what to do. Inject a triple fault into L1 as a more graceful option that running L1 with corrupted state. Co-developed-by: Sean Christopherson Signed-off-by: Yosry Ahmed base-commit: 95deaec3557dced322e2540bfa426e60e5373d46 Link: https://patch.msgid.link/20260209195142.2554532-2-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 66b207f175f1cd52b083c4d90d03cc1c15b8ae6a Author: Jim Mattson Date: Mon Feb 23 16:54:39 2026 -0800 KVM: x86: SVM: Remove vmcb_is_dirty() After commit dd26d1b5d6ed ("KVM: nSVM: Cache all used fields from VMCB12"), vmcb_is_dirty() has no callers. Remove the function. Signed-off-by: Jim Mattson Link: https://patch.msgid.link/20260224005500.1471972-2-jmattson@google.com Signed-off-by: Sean Christopherson commit 5e4c6da0bb925bc91a6020511e85bd9574f8474a Author: Yosry Ahmed Date: Tue Mar 3 00:34:20 2026 +0000 KVM: selftest: Add a selftest for VMRUN/#VMEXIT with unmappable vmcb12 Add a test that verifies that KVM correctly injects a #GP for nested VMRUN and a shutdown for nested #VMEXIT, if the GPA of vmcb12 cannot be mapped. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-27-yosry@kernel.org Signed-off-by: Sean Christopherson commit b6dc21d896a02b5fd305f505a4ec4dad50ecd8fb Author: Yosry Ahmed Date: Tue Mar 3 00:34:19 2026 +0000 KVM: nSVM: Only copy SVM_MISC_ENABLE_NP from VMCB01's misc_ctl The 'misc_ctl' field in VMCB02 is taken as-is from VMCB01. However, the only bit that needs to copied is SVM_MISC_ENABLE_NP, as all other known bits in misc_ctl are related to SEV guests, and KVM doesn't support nested virtualization for SEV guests. Only copy SVM_MISC_ENABLE_NP to harden against future bugs if/when other bits are set for L1 but should not be set for L2. Opportunistically add a comment explaining why SVM_MISC_ENABLE_NP is taken from VMCB01 and not VMCB02. Suggested-by: Jim Mattson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-26-yosry@kernel.org Signed-off-by: Sean Christopherson commit c8123e82725648b1b13103ce3d8066ce13ab81b7 Author: Yosry Ahmed Date: Tue Mar 3 00:34:18 2026 +0000 KVM: nSVM: Sanitize INT/EVENTINJ fields when copying from vmcb12 Make sure all fields used from vmcb12 in creating the vmcb02 are sanitized, such that no unhandled or reserved bits end up in the vmcb02. The following control fields are read from vmcb12 and have bits that are either reserved or not handled/advertised by KVM: tlb_ctl, int_ctl, int_state, int_vector, event_inj, misc_ctl, and misc_ctl2. The following fields do not require any extra sanitizing: - tlb_ctl: already being sanitized. - int_ctl: bits from vmcb12 are copied bit-by-bit as needed. - misc_ctl: only used in consistency checks (particularly NP_ENABLE). - misc_ctl2: bits from vmcb12 are copied bit-by-bit as needed. For the remaining fields (int_vector, int_state, and event_inj), make sure only defined bits are copied from L1's vmcb12 into KVM'cache by defining appropriate masks where needed. Suggested-by: Jim Mattson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-25-yosry@kernel.org Signed-off-by: Sean Christopherson commit 30a1d2fa819039e06bc6242669f6fd45df039a41 Author: Yosry Ahmed Date: Tue Mar 3 00:34:17 2026 +0000 KVM: nSVM: Sanitize TLB_CONTROL field when copying from vmcb12 The APM defines possible values for TLB_CONTROL as 0, 1, 3, and 7 -- all of which are always allowed for KVM guests as KVM always supports X86_FEATURE_FLUSHBYASID. Only copy bits 0 to 2 from vmcb12's TLB_CONTROL, such that no unhandled or reserved bits end up in vmcb02. Note that TLB_CONTROL in vmcb12 is currently ignored by KVM, as it nukes the TLB on nested transitions anyway (see nested_svm_transition_tlb_flush()). However, such sanitization will be needed once the TODOs there are addressed, and it's minimal churn to add it now. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-24-yosry@kernel.org Signed-off-by: Sean Christopherson commit a2b858051cf03d4f0abca014cddd424675be5316 Author: Yosry Ahmed Date: Tue Mar 3 00:34:16 2026 +0000 KVM: nSVM: Use PAGE_MASK to drop lower bits of bitmap GPAs from vmcb12 Use PAGE_MASK to drop the lower bits from IOPM_BASE_PA and MSRPM_BASE_PA while copying them instead of dropping the bits afterward with a hardcoded mask. No functional change intended. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-23-yosry@kernel.org Signed-off-by: Sean Christopherson commit b709087e9e544259d1d075ced91cc4ab769a8ae2 Author: Yosry Ahmed Date: Tue Mar 3 00:34:15 2026 +0000 KVM: nSVM: Restrict mapping vmcb12 on nested VMRUN All accesses to the vmcb12 in the guest memory on nested VMRUN are limited to nested_svm_vmrun() copying vmcb12 fields and writing them on failed consistency checks. However, vmcb12 remains mapped throughout nested_svm_vmrun(). Mapping and unmapping around usages is possible, but it becomes easy-ish to introduce bugs where 'vmcb12' is used after being unmapped. Move reading the vmcb12, copying to cache, and consistency checks from nested_svm_vmrun() into a new helper, nested_svm_copy_vmcb12_to_cache() to limit the scope of the mapping. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-22-yosry@kernel.org Signed-off-by: Sean Christopherson commit 84dc9fd0354d3d0e02faf2f7b3f4d1228c2571ea Author: Yosry Ahmed Date: Tue Mar 3 00:34:14 2026 +0000 KVM: nSVM: Cache all used fields from VMCB12 Currently, most fields used from VMCB12 are cached in svm->nested.{ctl/save}. This is mainly to avoid TOC-TOU bugs. However, for the save area, only the fields used in the consistency checks (i.e. nested_vmcb_check_save()) were being cached. Other fields are read directly from guest memory in nested_vmcb02_prepare_save(). While probably benign, this still makes it possible for TOC-TOU bugs to happen. For example, RAX, RSP, and RIP are read twice, once to store in VMCB02, and once to store in vcpu->arch.regs. It is possible for the guest to modify the value between both reads, potentially causing nasty bugs. Harden against such bugs by caching everything in svm->nested.save. Cache all the needed fields, and keep all accesses to the VMCB12 strictly in nested_svm_vmrun() for caching and early error injection. Following changes will further limit the access to the VMCB12 in the nested VMRUN path. Introduce vmcb12_is_dirty() to use with the cached control fields instead of vmcb_is_dirty(), similar to vmcb12_is_intercept(). Opportunistically order the copies in __nested_copy_vmcb_save_to_cache() by the order in which the fields are defined in struct vmcb_save_area. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-21-yosry@kernel.org Signed-off-by: Sean Christopherson commit 7e6eab9be2200f83ab03ab2b921ea7ca47a6c3b4 Author: Yosry Ahmed Date: Tue Mar 3 00:34:13 2026 +0000 KVM: SVM: Rename vmcb->virt_ext to vmcb->misc_ctl2 'virt' is confusing in the VMCB because it is relative and ambiguous. The 'virt_ext' field includes bits for LBR virtualization and VMSAVE/VMLOAD virtualization, so it's just another miscellaneous control field. Name it as such. While at it, move the definitions of the bits below those for 'misc_ctl' and rename them for consistency. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-20-yosry@kernel.org Signed-off-by: Sean Christopherson commit 1aea80dd42cf46d11af5ff7874a4f4dae77efd6a Author: Sean Christopherson Date: Tue Mar 3 08:58:06 2026 -0800 KVM: SVM: Rename vmcb->nested_ctl to vmcb->misc_ctl The 'nested_ctl' field is misnamed. Although the first bit is for nested paging, the other defined bits are for SEV/SEV-ES. Other bits in the same field according to the APM (but not defined by KVM) include "Guest Mode Execution Trap", "Enable INVLPGB/TLBSYNC", and other control bits unrelated to 'nested'. There is nothing common among these bits, so just name the field misc_ctl. Also rename the flags accordingly. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-19-yosry@kernel.org Signed-off-by: Sean Christopherson commit 56bfbe68f78ece2ea9b15f31ec8f7543d8942e3b Author: Sean Christopherson Date: Wed Feb 18 15:09:58 2026 -0800 KVM: nSVM: Capture svm->nested.ctl as vmcb12_ctrl when preparing vmcb02 Grab svm->nested.ctl as vmcb12_ctrl when preparing the vmcb02 controls to make it more obvious that much of the data is coming from vmcb12 (or rather, a snapshot of vmcb12 at the time of L1's VMRUN). Opportunistically reorder the variable definitions to create a pretty reverse fir tree. No functional change intended. Cc: Yosry Ahmed Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20260218230958.2877682-9-seanjc@google.com Signed-off-by: Sean Christopherson commit af75470944f4c978956001cd6034f67469957c1b Author: Sean Christopherson Date: Wed Feb 18 15:09:57 2026 -0800 KVM: nSVM: Move vmcb_ctrl_area_cached.bus_lock_rip to svm_nested_state Move "bus_lock_rip" from "vmcb_ctrl_area_cached" to "svm_nested_state" as "last_bus_lock_rip" to more accurately reflect what it tracks, and because it is NOT a cached vmcb12 control field. The misplaced field isn't all that apparent in the current code base, as KVM uses "svm->nested.ctl" broadly, but the bad placement becomes glaringly obvious if "svm->nested.ctl" is captured as a local "vmcb12_ctrl" variable. No functional change intended. Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20260218230958.2877682-8-seanjc@google.com Signed-off-by: Sean Christopherson commit ef09eebc5736add3415b6efb009fdb7c47a504c7 Author: Yosry Ahmed Date: Wed Feb 18 15:09:56 2026 -0800 KVM: nSVM: Use vmcb12_is_intercept() in nested_sync_control_from_vmcb02() Use vmcb12_is_intercept() instead of open-coding the intercept check. No functional change intended. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260218230958.2877682-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 586160b750914d5bd636f395a2ba9248c6f346e5 Author: Sean Christopherson Date: Wed Feb 18 15:09:55 2026 -0800 KVM: nSVM: Use intuitive local variables in nested_vmcb02_recalc_intercepts() Now that nested_vmcb02_recalc_intercepts() is explicitly scoped to deal with *only* recalculating vmcb02 intercepts, rename its local variables to use more intuivite names. The current "c", "h", and "g" local variables, for the current VMCB, vmcb01, and (cached) vmcb12 respectively, are short and sweet, but don't do much to help unfamiliar readers understand what the code is doing. Use vmcb12_ctrl/vmcb01/vmcb02/vmcb12_ctrl in lieu of c/h/g to make it clear the function is updating intercepts in vmcb02 based on the intercepts in vmcb01 and (cached) vmcb12. Opportunistically change the existing WARN_ON to a WARN_ON_ONCE so that a KVM bug doesn't unintentionally DoS the host. No functional change intended. Signed-off-by: Yosry Ahmed [sean: use WARN_ON_ONCE, keep local vmcb12 cache as vmcb12_ctrl] Link: https://patch.msgid.link/20260218230958.2877682-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 4a80c4bc1f10645fe3fc51d4c116f69096340683 Author: Sean Christopherson Date: Wed Feb 18 15:09:54 2026 -0800 KVM: nSVM: Directly (re)calc vmcb02 intercepts from nested_vmcb02_prepare_control() Now that nested_vmcb02_recalc_intercepts() provides guardrails against it being incorrectly called without vmcb02 active, invoke it directly from nested_vmcb02_recalc_intercepts() instead of bouncing through svm_mark_intercepts_dirty(), which unnecessarily marks vmcb01 as dirty. Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20260218230958.2877682-5-seanjc@google.com Signed-off-by: Sean Christopherson commit a367b6e10372b46fa10debd889e89aa65ca65aee Author: Yosry Ahmed Date: Wed Feb 18 15:09:53 2026 -0800 KVM: nSVM: WARN and abort vmcb02 intercepts recalc if vmcb02 isn't active WARN and bail early from nested_vmcb02_recalc_intercepts() if vmcb02 isn't the active/current VMCB, as recalculating intercepts for vmcb01 using logic intended for merging vmcb12 and vmcb01 intercepts can yield unexpected and unwanted results. In addition to hardening against general bugs, this will provide additional safeguards "if" nested_vmcb02_recalc_intercepts() is invoked directly from nested_vmcb02_prepare_control(). Signed-off-by: Yosry Ahmed [sean: split to separate patch, bail early on "failure"] Link: https://patch.msgid.link/20260218230958.2877682-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 0b97f929831a70e7ad6d9dbd30ae1f65dd43526d Author: Sean Christopherson Date: Wed Feb 18 15:09:52 2026 -0800 KVM: SVM: Separate recalc_intercepts() into nested vs. non-nested parts Extract the non-nested aspects of recalc_intercepts() into a separate helper, svm_mark_intercepts_dirty(), to make it clear that the call isn't *just* recalculating (vmcb02's) intercepts, and to not bury non-nested code in nested.c. As suggested by Yosry, opportunistically prepend "nested_vmbc02_" to recalc_intercepts() so that it's obvious the function specifically deals with recomputing intercepts for L2. No functional change intended. Cc: Yosry Ahmed Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20260218230958.2877682-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 460c7eb2e7594319abcb2066c737cb8b5eb78213 Author: Kevin Cheng Date: Tue Mar 3 16:30:10 2026 -0800 KVM: SVM: Recalc instructions intercepts when EFER.SVME is toggled The AMD APM states that VMRUN, VMLOAD, VMSAVE, CLGI, VMMCALL, and INVLPGA instructions should generate a #UD when EFER.SVME is cleared. Currently, when VMLOAD, VMSAVE, or CLGI are executed in L1 with EFER.SVME cleared, no #UD is generated in certain cases. This is because the intercepts for these instructions are cleared based on whether or not vls or vgif is enabled. The #UD fails to be generated when the intercepts are absent. Fix the missing #UD generation by ensuring that all relevant instructions have intercepts set when SVME.EFER is disabled. VMMCALL is special because KVM's ABI is that VMCALL/VMMCALL are always supported for L1 and never fault. Signed-off-by: Kevin Cheng [sean: isolate Intel CPU "compatibility" in EFER.SVME=1 path] Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20260304003010.1108257-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 69f779f79e0d1ff321a89ab56cdcab34613104c0 Author: Kevin Cheng Date: Tue Mar 3 16:30:09 2026 -0800 KVM: SVM: Move STGI and CLGI intercept handling Move STGI/CLGI intercept handling to svm_recalc_instruction_intercepts() in preparation for making the function EFER.SVME-aware. This will allow configuring STGI/CLGI intercepts along with other intercepts for other SVM instructions when EFER.SVME is toggled (KVM needs to intercept SVM instructions when EFER.SVME=0 to inject #UD). When clearing the STGI intercept in particular, request KVM_REQ_EVENT if there is at least one a pending GIF-controlled event. This avoids breaking NMI/SMI window tracking, as enable_{nmi,smi}_window() sets INTERCEPT_STGI to detect when NMIs become unblocked. KVM_REQ_EVENT forces kvm_check_and_inject_events() to re-evaluate pending events and re-enable the intercept if needed. Extract the pending GIF event check into a helper function svm_has_pending_gif_event() to deduplicate the logic between svm_recalc_instruction_intercepts() and svm_set_gif(). Signed-off-by: Kevin Cheng [sean: keep vgif handling out of the "Intel CPU model" path] Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20260304003010.1108257-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 33d3617a52f9930d22b2af59f813c2fbdefa6dd5 Author: Sean Christopherson Date: Tue Mar 3 16:22:23 2026 -0800 KVM: nSVM: Always intercept VMMCALL when L2 is active Always intercept VMMCALL now that KVM properly synthesizes a #UD as appropriate, i.e. when L1 doesn't want to intercept VMMCALL, to avoid putting L2 into an infinite #UD loop if KVM_X86_QUIRK_FIX_HYPERCALL_INSN is enabled. By letting L2 execute VMMCALL natively and thus #UD, for all intents and purposes KVM morphs the VMMCALL intercept into a #UD intercept (KVM always intercepts #UD). When the hypercall quirk is enabled, KVM "emulates" VMMCALL in response to the #UD by trying to fixup the opcode to the "right" vendor, then restarts the guest, without skipping the VMMCALL. As a result, the guest sees an endless stream of #UDs since it's already executing the correct vendor hypercall instruction, i.e. the emulator doesn't anticipate that the #UD could be due to lack of interception, as opposed to a truly undefined opcode. Fixes: 0d945bd93511 ("KVM: SVM: Don't allow nested guest to VMMCALL into host") Cc: stable@vger.kernel.org Reviewed-by: Yosry Ahmed Reviewed-by: Vitaly Kuznetsov Link: https://patch.msgid.link/20260304002223.1105129-3-seanjc@google.com Signed-off-by: Sean Christopherson commit c36991c6f8d2ab56ee67aff04e3c357f45cfc76c Author: Kevin Cheng Date: Tue Mar 3 16:22:22 2026 -0800 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is something other than one of the supported Hyper-V hypercalls. When all of the above conditions are met, KVM will intercept VMMCALL but never forward it to L1, i.e. will let L2 make hypercalls as if it were L1. The TLFS says a whole lot of nothing about this scenario, so go with the architectural behavior, which says that VMMCALL #UDs if it's not intercepted. Opportunistically do a 2-for-1 stub trade by stub-ifying the new API instead of the helpers it uses. The last remaining "single" stub will soon be dropped as well. Suggested-by: Sean Christopherson Fixes: 3f4a812edf5c ("KVM: nSVM: hyper-v: Enable L2 TLB flush") Cc: Vitaly Kuznetsov Cc: stable@vger.kernel.org Signed-off-by: Kevin Cheng Link: https://patch.msgid.link/20260228033328.2285047-5-chengkev@google.com [sean: rewrite changelog and comment, tag for stable, remove defunct stubs] Reviewed-by: Yosry Ahmed Reviewed-by: Vitaly Kuznetsov Link: https://patch.msgid.link/20260304002223.1105129-2-seanjc@google.com Signed-off-by: Sean Christopherson commit d5bde6113aed8315a2bfe708730b721be9c2f48b Author: Sean Christopherson Date: Wed Feb 18 15:09:51 2026 -0800 KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts When reacting to an intercept update, explicitly mark vmcb01's intercepts dirty, as KVM always initially operates on vmcb01, and nested_svm_vmexit() isn't guaranteed to mark VMCB_INTERCEPTS as dirty. I.e. if L2 is active, KVM will modify the intercepts for L1, but might not mark them as dirty before the next VMRUN of L1. Fixes: 116a0a23676e ("KVM: SVM: Add clean-bit for intercetps, tsc-offset and pause filter count") Cc: stable@vger.kernel.org Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20260218230958.2877682-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 7e79f71bca5cf536f92effc7227bd044c2722c11 Author: Yosry Ahmed Date: Tue Mar 3 00:34:11 2026 +0000 KVM: nSVM: Add missing consistency check for EVENTINJ According to the APM Volume #2, 15.20 (24593—Rev. 3.42—March 2024): VMRUN exits with VMEXIT_INVALID error code if either: • Reserved values of TYPE have been specified, or • TYPE = 3 (exception) has been specified with a vector that does not correspond to an exception (this includes vector 2, which is an NMI, not an exception). Add the missing consistency checks to KVM. For the second point, inject VMEXIT_INVALID if the vector is anything but the vectors defined by the APM for exceptions. Reserved vectors are also considered invalid, which matches the HW behavior. Vector 9 (i.e. #CSO) is considered invalid because it is reserved on modern CPUs, and according to LLMs no CPUs exist supporting SVM and producing #CSOs. Defined exceptions could be different between virtual CPUs as new CPUs define new vectors. In a best effort to dynamically define the valid vectors, make all currently defined vectors as valid except those obviously tied to a CPU feature: SHSTK -> #CP and SEV-ES -> #VC. As new vectors are defined, they can similarly be tied to corresponding CPU features. Invalid vectors on specific (e.g. old) CPUs that are missed by KVM should be rejected by HW anyway. Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") CC: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-18-yosry@kernel.org Signed-off-by: Sean Christopherson commit 96bd3e76a171a8e21a6387e54e4c420a81968492 Author: Yosry Ahmed Date: Tue Mar 3 00:34:10 2026 +0000 KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS According to the APM Volume #2, 15.5, Canonicalization and Consistency Checks (24593—Rev. 3.42—March 2024), the following condition (among others) results in a #VMEXIT with VMEXIT_INVALID (aka SVM_EXIT_ERR): EFER.LME, CR0.PG, CR4.PAE, CS.L, and CS.D are all non-zero. In the list of consistency checks done when EFER.LME and CR0.PG are set, add a check that CS.L and CS.D are not both set, after the existing check that CR4.PAE is set. This is functionally a nop because the nested VMRUN results in SVM_EXIT_ERR in HW, which is forwarded to L1, but KVM makes all consistency checks before a VMRUN is actually attempted. Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-17-yosry@kernel.org Signed-off-by: Sean Christopherson commit b71138fcc362c67ebe66747bb22cb4e6b4d6a651 Author: Yosry Ahmed Date: Tue Mar 3 00:34:09 2026 +0000 KVM: nSVM: Add missing consistency check for nCR3 validity From the APM Volume #2, 15.25.4 (24593—Rev. 3.42—March 2024): When VMRUN is executed with nested paging enabled (NP_ENABLE = 1), the following conditions are considered illegal state combinations, in addition to those mentioned in “Canonicalization and Consistency Checks”: • Any MBZ bit of nCR3 is set. • Any G_PAT.PA field has an unsupported type encoding or any reserved field in G_PAT has a nonzero value. Add the consistency check for nCR3 being a legal GPA with no MBZ bits set. Note, the G_PAT.PA check is being handled separately[*]. Link: https://lore.kernel.org/kvm/20260205214326.1029278-3-jmattson@google.com [*] Fixes: 4b16184c1cca ("KVM: SVM: Initialize Nested Nested MMU context on VMRUN") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-16-yosry@kernel.org [sean: capture everything in CC(), massage changelog formatting] Signed-off-by: Sean Christopherson commit e0b6f031d64c086edd563e7af9c0c0a2261dd2a4 Author: Yosry Ahmed Date: Tue Mar 3 00:34:08 2026 +0000 KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE KVM currenty fails a nested VMRUN and injects VMEXIT_INVALID (aka SVM_EXIT_ERR) if L1 sets NP_ENABLE and the host does not support NPTs. On first glance, it seems like the check should actually be for guest_cpu_cap_has(X86_FEATURE_NPT) instead, as it is possible for the host to support NPTs but the guest CPUID to not advertise it. However, the consistency check is not architectural to begin with. The APM does not mention VMEXIT_INVALID if NP_ENABLE is set on a processor that does not have X86_FEATURE_NPT. Hence, NP_ENABLE should be ignored if X86_FEATURE_NPT is not available for L1, so sanitize it when copying from the VMCB12 to KVM's cache. Apart from the consistency check, NP_ENABLE in VMCB12 is currently ignored because the bit is actually copied from VMCB01 to VMCB02, not from VMCB12. Fixes: 4b16184c1cca ("KVM: SVM: Initialize Nested Nested MMU context on VMRUN") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-15-yosry@kernel.org Signed-off-by: Sean Christopherson commit b786e34cde42922dace620e6f56f0858edae2311 Author: Yosry Ahmed Date: Tue Mar 3 00:34:07 2026 +0000 KVM: nSVM: Drop nested_vmcb_check_{save/control}() wrappers The wrappers provide little value and make it harder to see what KVM is checking in the normal flow. Drop them. Opportunistically fixup comments referring to the functions, adding '()' to make it clear it's a reference to a function. No functional change intended. Co-developed-by: Sean Christopherson Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-14-yosry@kernel.org Signed-off-by: Sean Christopherson commit 8998e1d012f3f45d0456f16706682cef04c3c436 Author: Yosry Ahmed Date: Tue Mar 3 00:34:06 2026 +0000 KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT KVM clears tracking of L1->L2 injected NMIs (i.e. nmi_l1_to_l2) and soft IRQs (i.e. soft_int_injected) on a synthesized #VMEXIT(INVALID) due to failed VMRUN. However, they are not explicitly cleared in other synthesized #VMEXITs. soft_int_injected is always cleared after the first VMRUN of L2 when completing interrupts, as any re-injection is then tracked by KVM (instead of purely in vmcb02). nmi_l1_to_l2 is not cleared after the first VMRUN if NMI injection failed, as KVM still needs to keep track that the NMI originated from L1 to avoid blocking NMIs for L1. It is only cleared when the NMI injection succeeds. KVM could synthesize a #VMEXIT to L1 before successfully injecting the NMI into L2 (e.g. due to a #NPF on L2's NMI handler in L1's NPTs). In this case, nmi_l1_to_l2 will remain true, and KVM may not correctly mask NMIs and intercept IRET when injecting an NMI into L1. Clear both nmi_l1_to_l2 and soft_int_injected in nested_svm_vmexit(), i.e. for all #VMEXITs except those that occur due to failed consistency checks, as those happen before nmi_l1_to_l2 or soft_int_injected are set. Fixes: 159fc6fa3b7d ("KVM: nSVM: Transparently handle L1 -> L2 NMI re-injection") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-13-yosry@kernel.org Signed-off-by: Sean Christopherson commit 69b721a86d0dcb026f6db7d111dcde7550442d2e Author: Yosry Ahmed Date: Tue Mar 3 00:34:05 2026 +0000 KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT According to the APM, from the reference of the VMRUN instruction: Upon #VMEXIT, the processor performs the following actions in order to return to the host execution context: ... clear EVENTINJ field in VMCB KVM already syncs EVENTINJ fields from vmcb02 to cached vmcb12 on every L2->L0 #VMEXIT. Since these fields are zeroed by the CPU on #VMEXIT, they will mostly be zeroed in vmcb12 on nested #VMEXIT by nested_svm_vmexit(). However, this is not the case when: 1. Consistency checks fail, as nested_svm_vmexit() is not called. 2. Entering guest mode fails before L2 runs (e.g. due to failed load of CR3). (2) was broken by commit 2d8a42be0e2b ("KVM: nSVM: synchronize VMCB controls updated by the processor on every vmexit"), as prior to that nested_svm_vmexit() always zeroed EVENTINJ fields. Explicitly clear the fields in all nested #VMEXIT code paths. Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") Fixes: 2d8a42be0e2b ("KVM: nSVM: synchronize VMCB controls updated by the processor on every vmexit") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-12-yosry@kernel.org [sean: massage changelog formatting] Signed-off-by: Sean Christopherson commit f85a6ce06e4a0d49652f57967a649ab09e06287c Author: Yosry Ahmed Date: Tue Mar 3 00:34:04 2026 +0000 KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) According to the APM, GIF is set to 0 on any #VMEXIT, including an #VMEXIT(INVALID) due to failed consistency checks. Clear GIF on consistency check failures. Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-11-yosry@kernel.org Signed-off-by: Sean Christopherson commit 5d291ef0585ed880ed4dd71ea1a5965e0a65fb53 Author: Yosry Ahmed Date: Tue Mar 3 00:34:03 2026 +0000 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit() returns an error code that is ignored by most callers, and continues to run L1 with corrupted state. A sane recovery is not possible in this case, and HW behavior is to cause a shutdown. Inject a triple fault instead, and do not return early from nested_svm_vmexit(). Continue cleaning up the vCPU state (e.g. clear pending exceptions), to handle the failure as gracefully as possible. From the APM: Upon #VMEXIT, the processor performs the following actions in order to return to the host execution context: ... if (illegal host state loaded, or exception while loading host state) shutdown else execute first host instruction following the VMRUN Remove the return value of nested_svm_vmexit(), which is mostly unchecked anyway. Fixes: d82aaef9c88a ("KVM: nSVM: use nested_svm_load_cr3() on guest->host switch") CC: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-10-yosry@kernel.org Signed-off-by: Sean Christopherson commit 1b30e7551767cb95b3e49bb169c72bbd76b56e05 Author: Yosry Ahmed Date: Tue Mar 3 00:34:02 2026 +0000 KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT KVM currently injects a #GP and hopes for the best if mapping VMCB12 fails on nested #VMEXIT, and only if the failure mode is -EINVAL. Mapping the VMCB12 could also fail if creating host mappings fails. After the #GP is injected, nested_svm_vmexit() bails early, without cleaning up (e.g. KVM_REQ_GET_NESTED_STATE_PAGES is set, is_guest_mode() is true, etc). Instead of optionally injecting a #GP, triple fault the guest if mapping VMCB12 fails since KVM cannot make a sane recovery. The APM states that a #VMEXIT will triple fault if host state is illegal or an exception occurs while loading host state, so the behavior is not entirely made up. Do not return early from nested_svm_vmexit(), continue cleaning up the vCPU state (e.g. switch back to vmcb01), to handle the failure as gracefully as possible. Fixes: cf74a78b229d ("KVM: SVM: Add VMEXIT handler and intercepts") CC: stable@vger.kernel.org Co-developed-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-9-yosry@kernel.org Signed-off-by: Sean Christopherson commit dcf3648ab71437b504abbfdc4e74622a0f1a56e3 Author: Yosry Ahmed Date: Tue Mar 3 00:34:01 2026 +0000 KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper Move mapping vmcb12 and updating it out of nested_svm_vmexit() into a helper, no functional change intended. CC: stable@vger.kernel.org Co-developed-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-8-yosry@kernel.org Signed-off-by: Sean Christopherson commit 290c8d82023ab0e1d2782d37136541e017174d7c Author: Yosry Ahmed Date: Tue Mar 3 00:34:00 2026 +0000 KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper Refactor the vCPU cap and vmcb12 flag checks into a helper. The unlikely() annotation is dropped, it's unlikely (huh) to make a difference and the CPU will probably predict it better on its own. CC: stable@vger.kernel.org Co-developed-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-7-yosry@kernel.org Signed-off-by: Sean Christopherson commit 01ddcdc55e097ca38c28ae656711b8e6d1df71f8 Author: Yosry Ahmed Date: Tue Mar 3 00:33:59 2026 +0000 KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN nested_svm_vmrun() currently only injects a #GP if kvm_vcpu_map() fails with -EINVAL. But it could also fail with -EFAULT if creating a host mapping failed. Inject a #GP in all cases, no reason to treat failure modes differently. Fixes: 8c5fbf1a7231 ("KVM/nSVM: Use the new mapping API for mapping guest memory") CC: stable@vger.kernel.org Co-developed-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-6-yosry@kernel.org Signed-off-by: Sean Christopherson commit ac17892e51525ccea892b7e3171e2d1e9bb6fa61 Author: Yosry Ahmed Date: Tue Mar 3 00:33:58 2026 +0000 KVM: selftests: Add a test for LBR save/restore (ft. nested) Add a selftest exercising save/restore with usage of LBRs in both L1 and L2, and making sure all LBRs remain intact. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-5-yosry@kernel.org Signed-off-by: Sean Christopherson commit 3700f0788da6acf73b2df56690f4b201aa4aefd2 Author: Yosry Ahmed Date: Tue Mar 3 00:33:57 2026 +0000 KVM: SVM: Add missing save/restore handling of LBR MSRs MSR_IA32_DEBUGCTLMSR and LBR MSRs are currently not enumerated by KVM_GET_MSR_INDEX_LIST, and LBR MSRs cannot be set with KVM_SET_MSRS. So save/restore is completely broken. Fix it by adding the MSRs to msrs_to_save_base, and allowing writes to LBR MSRs from userspace only (as they are read-only MSRs) if LBR virtualization is enabled. Additionally, to correctly restore L1's LBRs while L2 is running, make sure the LBRs are copied from the captured VMCB01 save area in svm_copy_vmrun_state(). Note, for VMX, this also fixes a flaw where MSR_IA32_DEBUGCTLMSR isn't reported as an MSR to save/restore. Note #2, over-reporting MSR_IA32_LASTxxx on Intel is ok, as KVM already handles unsupported reads and writes thanks to commit b5e2fec0ebc3 ("KVM: Ignore DEBUGCTL MSRs with no effect") (kvm_do_msr_access() will morph the unsupported userspace write into a nop). Fixes: 24e09cbf480a ("KVM: SVM: enable LBR virtualization") Cc: stable@vger.kernel.org Reported-by: Jim Mattson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-4-yosry@kernel.org [sean: guard with lbrv checks, massage changelog] Signed-off-by: Sean Christopherson commit 361dbe8173c460a2bf8aee23920f6c2dbdcabb94 Author: Yosry Ahmed Date: Tue Mar 3 00:33:56 2026 +0000 KVM: SVM: Switch svm_copy_lbrs() to a macro In preparation for using svm_copy_lbrs() with 'struct vmcb_save_area' without a containing 'struct vmcb', and later even 'struct vmcb_save_area_cached', make it a macro. Macros are generally not preferred compared to functions, mainly due to type-safety. However, in this case it seems like having a simple macro copying a few fields is better than copy-pasting the same 5 lines of code in different places. Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-3-yosry@kernel.org Signed-off-by: Sean Christopherson commit b53ab5167a81537777ac780bbd93d32613aa3bda Author: Yosry Ahmed Date: Tue Mar 3 00:33:55 2026 +0000 KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 svm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB. However, nested_svm_vmexit() uses it to copy LBRs to vmcb12, and clearing clean bits in vmcb12 is not architecturally defined. Move vmcb_mark_dirty() to callers and drop it for vmcb12. This also facilitates incoming refactoring that does not pass the entire VMCB to svm_copy_lbrs(). Fixes: d20c796ca370 ("KVM: x86: nSVM: implement nested LBR virtualization") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260303003421.2185681-2-yosry@kernel.org Signed-off-by: Sean Christopherson commit d99df02ff427f461102230f9c5b90a6c64ee8e23 Author: Kevin Cheng Date: Sat Feb 28 03:33:26 2026 +0000 KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 INVLPGA should cause a #UD when EFER.SVME is not set. Add a check to properly inject #UD when EFER.SVME=0. Fixes: ff092385e828 ("KVM: SVM: Implement INVLPGA") Cc: stable@vger.kernel.org Signed-off-by: Kevin Cheng Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20260228033328.2285047-3-chengkev@google.com [sean: tag for stable@] Signed-off-by: Sean Christopherson commit c64bc6ed1764c1b7e3c0017019f743196074092f Author: Sean Christopherson Date: Wed Mar 4 16:06:56 2026 -0800 KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run In the save+restore path, when restoring nested state, the values of RIP and CS base passed into nested_vmcb02_prepare_control() are mostly incorrect. They are both pulled from the vmcb02. For CS base, the value is only correct if system regs are restored before nested state. The value of RIP is whatever the vCPU had in vmcb02 before restoring nested state (zero on a freshly created vCPU). Instead, take a similar approach to NextRIP, and delay initializing the RIP tracking fields until shortly before the vCPU is run, to make sure the most up-to-date values of RIP and CS base are used regardless of KVM_SET_SREGS, KVM_SET_REGS, and KVM_SET_NESTED_STATE's relative ordering. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") CC: stable@vger.kernel.org Suggested-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260225005950.3739782-8-yosry@kernel.org [sean: deal with the svm_cancel_injection() madness] Signed-off-by: Sean Christopherson commit a0592461f39c00b28f552fe842a063a00043eaa8 Author: Yosry Ahmed Date: Wed Feb 25 00:59:48 2026 +0000 KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances L2's RIP before running it. KVM uses L2's current RIP as the NextRIP in vmcb02 to emulate a CPU without NRIPS. However, in svm_set_nested_state(), the value used for L2's current RIP comes from vmcb02, which is just whatever the vCPU had in vmcb02 before restoring nested state (zero on a freshly created vCPU). Passing the cached RIP value instead (i.e. kvm_rip_read()) would only fix the issue if registers are restored before nested state. Instead, split the logic of setting NextRIP in vmcb02. Handle the 'normal' case of initializing vmcb02's NextRIP using NextRIP from vmcb12 (or KVM_GET_NESTED_STATE's payload) in nested_vmcb02_prepare_control(). Delay the special case of stuffing L2's current RIP into vmcb02's NextRIP until shortly before the vCPU is run, to make sure the most up-to-date value of RIP is used regardless of KVM_SET_REGS and KVM_SET_NESTED_STATE's relative ordering. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") CC: stable@vger.kernel.org Suggested-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260225005950.3739782-7-yosry@kernel.org [sean: use new helper, svm_fixup_nested_rips()] Signed-off-by: Sean Christopherson commit dbbda7dd6835d1ac7ee7ea095be306ad9c90f7b4 Merge: 4ad96a7c9e2ceb 44d93cf1abb6a8 Author: Jakub Kicinski Date: Wed Mar 4 15:30:04 2026 -0800 Merge tag 'wireless-next-2026-03-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Notable features this time: - cfg80211/mac80211 - finished assoc frame encryption/EPPKE/802.1X-over-auth (also hwsim) - radar detection improvements - 6 GHz incumbent signal detection APIs - multi-link support for FILS, probe response templates and client probling - ath12k: - monitor mode support on IPQ5332 - basic hwmon temperature reporting * tag 'wireless-next-2026-03-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (38 commits) wifi: UHR: define DPS/DBE/P-EDCA elements and fix size parsing wifi: mac80211_hwsim: change hwsim_class to a const struct wifi: mac80211: give the AP more time for EPPKE as well wifi: ath12k: Remove the unused argument from the Rx data path wifi: ath12k: Enable monitor mode support on IPQ5332 wifi: ath12k: Set up MLO after SSR wifi: ath11k: Silence remoteproc probe deferral prints wifi: cfg80211: support key installation on non-netdev wdevs wifi: cfg80211: make cluster id an array wifi: mac80211: update outdated comment wifi: mac80211: Advertise IEEE 802.1X authentication support wifi: mac80211: Add support for IEEE 802.1X authentication protocol in non-AP STA mode wifi: cfg80211: add support for IEEE 802.1X Authentication Protocol wifi: mac80211: Advertise EPPKE support based on driver capabilities wifi: mac80211_hwsim: Advertise support for (Re)Association frame encryption wifi: mac80211: Fix AAD/Nonce computation for management frames with MLO wifi: rt2x00: use generic nvmem_cell_get wifi: mac80211: fetch unsolicited probe response template by link ID wifi: mac80211: fetch FILS discovery template by link ID wifi: nl80211: don't allow DFS channels for NAN ... ==================== Link: https://patch.msgid.link/20260304113707.175181-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit ee8422d00b7cfa028823ebf1f28bf9dea428cac3 Author: Viacheslav Dubeyko Date: Fri Feb 20 14:01:53 2026 -0800 hfsplus: fix potential Allocation File corruption after fsync The generic/348 test-case has revealed the issue of HFS+ volume corruption after simulated power failure: FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc4+ #8 SMP PREEMPT_DYNAMIC Thu May 1 16:43:22 PDT 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/348 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent (see xfstests-dev/results//generic/348.full for details) The fsck tool complains about Allocation File (block bitmap) corruption as a result of such event. The generic/348 creates a symlink, fsync its parent directory, power fail and mount again the filesystem. Currently, HFS+ logic has several flags HFSPLUS_I_CAT_DIRTY, HFSPLUS_I_EXT_DIRTY, HFSPLUS_I_ATTR_DIRTY, HFSPLUS_I_ALLOC_DIRTY. If inode operation modified the Catalog File, Extents Overflow File, Attributes File, or Allocation File, then inode is marked as dirty and one of the mentioned flags has been set. When hfsplus_file_fsync() has been called, then this set of flags is checked and dirty b-tree or/and block bitmap is flushed. However, block bitmap can be modified during file's content allocation. It means that if we call hfsplus_file_fsync() for directory, then we never flush the modified Allocation File in such case because such inode cannot receive HFSPLUS_I_ALLOC_DIRTY flag. Moreover, this inode-centric model is not good at all because Catalog File, Extents Overflow File, Attributes File, and Allocation File represent the whole state of file system metadata. This inode-centric policy is the main reason of the issue. This patch saves the whole approach of using HFSPLUS_I_CAT_DIRTY, HFSPLUS_I_EXT_DIRTY, HFSPLUS_I_ATTR_DIRTY, and HFSPLUS_I_ALLOC_DIRTY flags. But Catalog File, Extents Overflow File, Attributes File, and Allocation File have associated inodes. And namely these inodes become the mechanism of checking the dirty state of metadata. The hfsplus_file_fsync() method checks the dirtiness of file system metadata by testing HFSPLUS_I_CAT_DIRTY, HFSPLUS_I_EXT_DIRTY, HFSPLUS_I_ATTR_DIRTY, and HFSPLUS_I_ALLOC_DIRTY flags of Catalog File's, Extents Overflow File's, Attributes File's, or Allocation File's inodes. As a result, even if we call hfsplus_file_fsync() for parent folder, then dirty Allocation File will be flushed anyway. Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20260220220152.152721-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 9830209b4ae8c8eecae7e6af271cebf1e1285142 Author: Ackerley Tng Date: Fri Feb 20 23:54:36 2026 +0000 KVM: selftests: Test MADV_COLLAPSE on guest_memfd guest_memfd only supports PAGE_SIZE pages, and khugepaged or MADV_COLLAPSE collapsing pages may result in private memory regions being mapped into host page tables. Add test to verify that MADV_COLLAPSE fails on guest_memfd folios, and any subsequent usage of guest_memfd memory faults in PAGE_SIZE folios. Running this test should not result in any memory failure logs or kernel WARNings. This selftest was added as a result of a syzbot-reported issue where khugepaged operating on guest_memfd memory with MADV_HUGEPAGE caused the collapse of folios, which then subsequently resulted in a WARNing. Link: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44 Suggested-by: David Hildenbrand Signed-off-by: Ackerley Tng Link: https://patch.msgid.link/8048d04f150326d1e2231318aa9f1b3fce3e2e2c.1771630983.git.ackerleytng@google.com Signed-off-by: Sean Christopherson commit 58f5d8eebd5c6b0c9377391d6b7bf9d321e014cc Author: Ackerley Tng Date: Fri Feb 20 23:54:35 2026 +0000 KVM: selftests: Wrap madvise() to assert success Extend kvm_syscalls.h to wrap madvise() to assert success. This will be used in the next patch. Signed-off-by: Ackerley Tng Reviewed-by: David Hildenbrand (Arm) Link: https://patch.msgid.link/455483ca29a3a3042efee0cf3bbd0e2548cbeb1c.1771630983.git.ackerleytng@google.com Signed-off-by: Sean Christopherson commit a3e3203d04e6d25bbd2ee678d82b833af53461a8 Author: Mukesh Ojha Date: Tue Jan 27 17:13:49 2026 +0530 arm64: dts: qcom: monaco: Add EL2 overlay All the Monaco IOT variants boards are using Gunyah hypervisor which means that, so far, Linux-based OS could only boot in EL1 on those devices. However, it is possible for us to boot Linux at EL2 on these devices [1]. When running under Gunyah, the remote processor firmware IOMMU streams are controlled by Gunyah. However, without Gunyah, the IOMMU is managed by the consumer of this DeviceTree. Therefore, describe the firmware streams for each remote processor. Add a EL2-specific DT overlay and apply it to Monaco IOT variant devices to create -el2.dtb for each of them alongside "normal" dtb. [1] https://docs.qualcomm.com/bundle/publicresource/topics/80-70020-4/boot-developer-touchpoints.html#uefi Signed-off-by: Mukesh Ojha Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260127-talos-el2-overlay-v2-2-b6a2266532c4@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b3e0db9d8ec0fbb7367313d888b1bc3cc32cdffc Author: Mukesh Ojha Date: Tue Jan 27 17:13:48 2026 +0530 arm64: dts: qcom: lemans: disable zap-shader for EL2 configuration We don't need to use zap shader in EL2 as Linux can zap the gpu on it's own. Lets disable zap-shader for Lemans EL2 configuration. Signed-off-by: Mukesh Ojha Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260127-talos-el2-overlay-v2-1-b6a2266532c4@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 49ad4ca38c38b7d317cccf0e7f9f18e77b67b20d Author: Xin Liu Date: Mon Jan 26 22:24:25 2026 -0800 arm64: dts: qcom: hamoa: Add EL2 overlay for hamoa-evk Add support for building an EL2 combined DTB for the hamoa-evk in the Qualcomm DTS Makefile. The new hamoa-iot-evk-el2.dtb is generated by combining the base hamoa-iot-evk.dtb with the x1-el2.dtbo overlay, enabling EL2-specific configurations required by the platform. Signed-off-by: Xin Liu Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260127062425.1084673-1-xin.liu@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c653607929bb4e0d8b80573bdb523adab5b975c2 Author: Konrad Dybcio Date: Mon Jan 26 10:45:03 2026 +0100 arm64: dts: qcom: talos: Add missing clock-names to GCC The binding for this clock controller requires that clock-names are present. They're not really used by the kernel driver, but they're marked as required, so someone might have assumed it's done on purpose (where in reality we try to stay away from that since index-based references are faster, take up less space and are already widely used) and referenced it in drivers for another OS. Hence, do the least painful thing and add the missing entries. Fixes: 8e266654a2fe ("arm64: dts: qcom: add QCS615 platform") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Taniya Das Link: https://lore.kernel.org/r/20260126-topic-talos_dt_warn-v1-1-c452afc647ad@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 65991dedc8c10d634df7ea697f9b424b263e7d72 Author: Gabor Juhos Date: Fri Jan 23 19:16:05 2026 +0100 arm64: dts: qcom: ipq9574: remove MP5496 regulator references from SoC dtsi The 'cpu-supply' properties in the IPQ9574 SoC dtsi are referencing to a regulator provided by an MP5496 PMIC via the RPM firmware which's node is defined externally in the common RDP dtsi file. Since the PMIC is not part of the SoC it should not be referenced from the SoC specific dtsi, so remove the properties from there and define those in the common RDP dtsi instead. While at it, also change the prefix of the label from 'ipq9574' to 'mp5496' to keep it consistent with the labels of the l{2,5} regulators provided by the same PMIC. No functional changes. According to dtx_diff there are no differences between the ipq9574*.dtb files built with and without the change. Signed-off-by: Gabor Juhos Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260123-ipq9574-mp5496-cleanup-v1-1-9fa86f72b873@gmail.com Signed-off-by: Bjorn Andersson commit 30e8b6d42e8988eaaf0c2efd8c3797cb3884faea Author: Krishna Chaitanya Chundru Date: Fri Jan 23 17:42:27 2026 +0530 arm64: dts: qcom: kodiak: Fix PCIe1 PHY ref clock voting GCC_PCIE_CLKREF_EN controls a repeater that provides the reference clock only to the PCIe0 PHY. PCIe1 PHY receives its refclk directly from the CXO source. If the PCIe1 driver in HLOS votes for or against GCC_PCIE_CLKREF_EN, it will inadvertently modify the refclk to PCIe0 as well. Since PCIe0 is managed by WPSS while PCIe1 is managed in HLOS, there is no mechanism to coordinate these votes. As a result, HLOS may disable this repeater during suspend and cut off the PCIe0 PHY refclk while PCIe0 is still active. Replace the unused GCC_PCIE_CLKREF_EN clock entry with RPMH_CXO_CLK to reflect the actual hardware wiring and prevent unintended changes to PCIe0 clocking. Fixes: 92e0ee9f83b3 ("arm64: dts: qcom: sc7280: Add PCIe and PHY related nodes") Cc: stable@vger.kernel.org Signed-off-by: Krishna Chaitanya Chundru Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260123-fix_pcie1_phy_clk-v1-1-38f82ea01792@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit de8eed3597598f68387626e1bceaa9df12af0bc4 Author: Val Packett Date: Tue Jan 20 20:30:12 2026 -0300 arm64: dts: qcom: Add support for ECS LIVA QC710 Add a device tree for the ECS LIVA QC710 (Snapdragon 7c) mini PC/devkit. Working: - Wi-Fi (wcn3990 hw1.0) - Bluetooth - USB Type-A (USB3 and USB2) - Ethernet (over USB2) - HDMI Display - eMMC - SDHC (microSD slot) Not included: - HDMI Audio - EC (IT8987) Signed-off-by: Val Packett Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260120234029.419825-10-val@packett.cool [bjorn: Reordered apps_rsc and tlmm nodes] Signed-off-by: Bjorn Andersson commit 34a49e8508b5d00816d25fe3758b474471e7e051 Author: Val Packett Date: Tue Jan 20 20:30:13 2026 -0300 firmware: qcom: scm: Allow QSEECOM on ECS LIVA QC710 Allow this machine to access efivars through qseecom/uefisecapp. Reviewed-by: Dmitry Baryshkov Signed-off-by: Val Packett Link: https://lore.kernel.org/r/20260120234029.419825-11-val@packett.cool Signed-off-by: Bjorn Andersson commit 7adaecd3f8ed3e682bac5ec34dbc4b06f613c86f Author: Val Packett Date: Tue Jan 20 20:30:08 2026 -0300 dt-bindings: arm: qcom: Add ECS LIVA QC710 Document the SC7180 (Snapdragon 7c) based ECS LIVA QC710 mini PC/devkit. Signed-off-by: Val Packett Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260120234029.419825-6-val@packett.cool Signed-off-by: Bjorn Andersson commit c056679db5ddaa576fb9f347d8e3f0fc1a6f4e20 Author: Gianluca Boiano Date: Tue Jan 20 20:36:34 2026 +0100 arm64: dts: qcom: sdm630: add SPI7 interface Add spi7 interface to SDM630 device tree. Signed-off-by: Gianluca Boiano Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260120193634.1089688-1-morf3089@gmail.com Signed-off-by: Bjorn Andersson commit 2ad034b05154bb61d1296896ce11129e97e838f0 Author: Krzysztof Kozlowski Date: Tue Jan 20 17:47:08 2026 +0100 soc: qcom: socinfo: Add SoC ID for CQ7790 Recognize the CQ7790S and CQ7790M SoCs (Eliza SoC IoT variants). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260120164706.501119-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c3d1892569afad7cdd5fbe94b4698e3b87fbde9f Author: Krzysztof Kozlowski Date: Tue Jan 20 17:47:07 2026 +0100 dt-bindings: arm: qcom,ids: Add SoC ID for CQ7790 Document the IDs used by Eliza SoC IoT variant: CQ7790S (without modem) and CQ7790M, present for example on MTP7790 IoT and evalkit boards. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260120164706.501119-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0924a6fba19c8f4bbbe2e228a4fb5ae4bdb6d8ab Author: Yijie Yang Date: Mon Feb 2 15:35:46 2026 +0800 firmware: qcom: scm: Allow QSEECOM on PURWA-IOT-EVK Add the Purwa-IoT-EVK board to the list to enable access to EFI variables. Guarantee that subsystems relying on SCM services can access secure-world features. This change improves reliability and prevents missing functionality or boot-time issues by making service availability explicit. Reviewed-by: Dmitry Baryshkov Signed-off-by: Yijie Yang Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260202073555.1345260-2-yijie.yang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9ed20e877239e5ca30892542dcaee1e5f9b0c413 Author: Yijie Yang Date: Mon Feb 2 15:35:48 2026 +0800 arm64: dts: qcom: Add base PURWA-IOT-EVK board The PURWA-IOT-EVK is an evaluation platform for IoT products, composed of the Purwa IoT SoM and a carrier board. Together, they form a complete embedded system capable of booting to UART. PURWA-IOT-EVK uses the PS8833 as a retimer for USB0, unlike HAMOA-IOT-EVK. Meanwhile, USB0 bypasses the SBU selector FSUSB42. Make the following peripherals on the carrier board enabled: - UART - On-board regulators - USB Type-C mux - Pinctrl - Embedded USB (EUSB) repeaters - NVMe - pmic-glink - USB DisplayPorts - Bluetooth - WLAN - Audio - PCIe ports for PCIe3 through PCIe6a - TPM Signed-off-by: Yijie Yang Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260202073555.1345260-4-yijie.yang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 64a0277c98769ae716b804cce7b961187ea55c60 Author: Yijie Yang Date: Mon Feb 2 15:35:47 2026 +0800 arm64: dts: qcom: Add PURWA-IOT-SOM platform The PURWA-IOT-SOM is a compact computing module that integrates a System on Chip (SoC) — specifically the x1p42100 — along with essential components optimized for IoT applications. It is designed to be mounted on carrier boards, enabling the development of complete embedded systems. Purwa uses a slightly different Iris HW revision (8.1.2 on Hamoa, 8.1.11 on Purwa). Support will be added later. Make the following peripherals on the SOM enabled: - Regulators on the SOM - Reserved memory regions - PCIe3, PCIe4, PCIe5, PCIe6a - USB0 through USB6 and their PHYs - ADSP, CDSP - Graphic Reviewed-by: Konrad Dybcio Signed-off-by: Yijie Yang Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20260202073555.1345260-3-yijie.yang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 06a4db5d8d0e306f83709e7a274dc7bb6b5e1374 Author: Yijie Yang Date: Mon Feb 2 15:35:45 2026 +0800 dt-bindings: arm: qcom: Document PURWA-IOT-EVK board Document the device tree bindings for the PURWA-IOT-EVK board, which uses the Qualcomm X1P42100 SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Yijie Yang Link: https://lore.kernel.org/r/20260202073555.1345260-1-yijie.yang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ebcf2240a2494faf202ce5ec80ef159a38b1e542 Author: Hongyang Zhao Date: Sat Feb 7 15:32:56 2026 +0800 arm64: dts: qcom: qcs6490-rubikpi3: Use lt9611 DSI Port B The LT9611 HDMI bridge on RubikPi3 has DSI physically connected to Port B. Update the devicetree to use port@1 which corresponds to Port B input on the LT9611. Fixes: f055a39f6874 ("arm64: dts: qcom: Add qcs6490-rubikpi3 board dts") Reviewed-by: Konrad Dybcio Signed-off-by: Hongyang Zhao Reviewed-by: Roger Shimizu Tested-by: Roger Shimizu Link: https://lore.kernel.org/r/20260207-rubikpi-next-20260116-v3-3-23b9aa189a3a@thundersoft.com Signed-off-by: Bjorn Andersson commit d304777ee4988b4faac62a7fb731f79f64c17a8d Author: Krishna Kurapati Date: Wed Jan 28 11:57:20 2026 +0530 arm64: dts: qcom: talos: Mark usb controllers are wakeup capable devices USB controllers on talos are wakeup capable. Hence add wakeup-source property to both controller nodes. Signed-off-by: Krishna Kurapati Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260128062720.437712-3-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c1e77b13457d20f14c70e623f7c0a6a3cefc1d67 Author: Krishna Kurapati Date: Wed Jan 28 11:57:19 2026 +0530 arm64: dts: qcom: talos: Flatten usb controller nodes Flatten usb controller nodes and update to using latest bindings and flattened driver approach. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krishna Kurapati Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260128062720.437712-2-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7bb7c90e0ac18565a45c02072356bf3dffb81bcb Author: Barnabás Czémán Date: Mon Jan 26 17:34:57 2026 +0100 arm64: dts: qcom: Add Redmi Note 8T Redmi Note 8T (willow) is very similar to Redmi Note 8 (ginkgo) the only difference is willow have NFC. Make a common base from ginkgo devicetree for both device. Reviewed-by: Dmitry Baryshkov Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260126-xiaomi-willow-v3-7-aad7b106c311@mainlining.org Signed-off-by: Bjorn Andersson commit 32ace20ca1b65fcc2680b94cc8f00a80758eb76d Author: Barnabás Czémán Date: Mon Jan 26 17:34:56 2026 +0100 dt-bindings: arm: qcom: Add Xiaomi Redmi Note 8T Document the Xiaomi Redmi Note 8 (willow). Acked-by: Rob Herring (Arm) Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260126-xiaomi-willow-v3-6-aad7b106c311@mainlining.org Signed-off-by: Bjorn Andersson commit e8669e010991154bedadd1cd67700544e0362e99 Author: Barnabás Czémán Date: Mon Jan 26 17:34:55 2026 +0100 arm64: dts: qcom: sm6125-xiaomi-ginkgo: Fix reserved gpio ranges The device was crashing on boot because the reserved gpio ranges was wrongly defined. Correct the ranges for avoid pinctrl crashing. Fixes: 9b1a6c925c88 ("arm64: dts: qcom: sm6125: Initial support for xiaomi-ginkgo") Tested-by: Biswapriyo Nath Reviewed-by: Konrad Dybcio Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260126-xiaomi-willow-v3-5-aad7b106c311@mainlining.org Signed-off-by: Bjorn Andersson commit 79664600fd3ed3972ad9321e13d1f80267730447 Author: Barnabás Czémán Date: Mon Jan 26 17:34:54 2026 +0100 arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove extcon GPIO pin 102 is related to DisplayPort what is not supported by this device and it is also disabled at downstream, remove the unnecessary extcon-usb node. Fixes: 9b1a6c925c88 ("arm64: dts: qcom: sm6125: Initial support for xiaomi-ginkgo") Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260126-xiaomi-willow-v3-4-aad7b106c311@mainlining.org Signed-off-by: Bjorn Andersson commit f3d3a5924812eae3aedb431632c8a3b4c3f6bae1 Author: Barnabás Czémán Date: Mon Jan 26 17:34:53 2026 +0100 arm64: dts: qcom: sm6125-xiaomi-ginkgo: Set memory-region for framebuffer Use memory-region property for framebuffer instead of reg. Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260126-xiaomi-willow-v3-3-aad7b106c311@mainlining.org Signed-off-by: Bjorn Andersson commit 242801cc24e865cb525ef7d826ce6ebeffcad606 Author: Barnabás Czémán Date: Mon Jan 26 17:34:52 2026 +0100 arm64: dts: qcom: sm6125-xiaomi-ginkgo: Correct reserved memory ranges The device was crashing on high memory load because the reserved memory ranges was wrongly defined. Correct the ranges for avoid the crashes. Change the ramoops memory range to match with the values from the recovery to be able to get the results from the device. Fixes: 9b1a6c925c88 ("arm64: dts: qcom: sm6125: Initial support for xiaomi-ginkgo") Reviewed-by: Konrad Dybcio Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260126-xiaomi-willow-v3-2-aad7b106c311@mainlining.org Signed-off-by: Bjorn Andersson commit 535e5741bc9acef5ea2561aa300f28370599e7e2 Author: Barnabás Czémán Date: Mon Jan 26 17:34:51 2026 +0100 arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove board-id Remove board-id it is not necessary for the bootloader. Fixes: 9b1a6c925c88 ("arm64: dts: qcom: sm6125: Initial support for xiaomi-ginkgo") Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260126-xiaomi-willow-v3-1-aad7b106c311@mainlining.org Signed-off-by: Bjorn Andersson commit 1701d886a193e2ce856e9c26ffe8db548aaa7694 Author: Rob Herring (Arm) Date: Fri Dec 12 14:32:08 2025 -0600 ARM: dts: qcom: Drop unused .dtsi These .dtsi files are not included anywhere in the tree and can't be tested. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20251212203226.458694-2-robh@kernel.org Signed-off-by: Bjorn Andersson commit 724b4a12116fdb60130b89778611482bf8de0a6a Author: Niranjana Vishwanathapura Date: Tue Mar 3 14:30:41 2026 -0800 drm/xe: Add missing kernel docs in xe_exec_queue.c Add kernel doc to all exported functions that do not have a kernel doc in xe_exec_queue.c. v2: mention multi-lrc in comment (Matt Brost) Assisted-by: Claude 4.5 Sonnet Signed-off-by: Niranjana Vishwanathapura Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260303223040.140504-2-niranjana.vishwanathapura@intel.com Link: https://patch.msgid.link/20260303223040.140504-2-niranjana.vishwanathapura@intel.com commit 8d397582f6b5e9fbcf09781c7c934b4910e94a50 Author: Yosry Ahmed Date: Wed Feb 25 00:59:47 2026 +0000 KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before running it. KVM uses the current RIP as the NextRIP in vmcb02 to emulate a CPU without NRIPS. However, after L2 runs the first time, NextRIP will be updated by the CPU and/or KVM, and the current RIP is no longer the correct value to use in vmcb02. Hence, after save/restore, use the current RIP if and only if a nested run is pending, otherwise use NextRIP. Give soft_int_next_rip the same treatment, as it's the same logic, just for a narrower use case. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") CC: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260225005950.3739782-6-yosry@kernel.org [sean: give soft_int_next_rip the same treatment] Signed-off-by: Sean Christopherson commit e751303e0ad2e998f421d104193f6904df3516d1 Author: Vishal Moola (Oracle) Date: Tue Mar 3 11:48:27 2026 -0800 x86/mm/pat: Convert split_large_page() to use ptdescs Use the ptdesc APIs for all page table allocation and free sites to allow their separate allocation from struct page in the future. Update split_large_page() to allocate a ptdesc instead of allocating a page for use as a page table. Signed-off-by: Vishal Moola (Oracle) Signed-off-by: Dave Hansen Acked-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260303194828.1406905-5-vishal.moola@gmail.com commit b2203a9bf53237368a7c7fc976c9616b5562af8e Author: Vishal Moola (Oracle) Date: Tue Mar 3 11:48:26 2026 -0800 x86/mm/pat: Convert populate_pgd() to use page table apis Use the ptdesc APIs for all page table allocation and free sites to allow their separate allocation from struct page in the future. Convert the remaining get_zeroed_page() calls to the generic page table APIs, as they already use ptdescs. Pass through init_mm since these are kernel page tables, as both functions require it to identify kernel page tables. Because the generic implementations do not use the second argument, pass a placeholder to avoid reimplementing them or risking breakage on other architectures. It is not obvious whether these pages are freed. Regardless, convert the remaining free paths as needed, noting that the only other possible free paths have already been converted and that a frozen page table test kernel has not reported any issues. Signed-off-by: Vishal Moola (Oracle) Signed-off-by: Dave Hansen Acked-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260303194828.1406905-4-vishal.moola@gmail.com commit 6ba1917a4c5c59415c8fc3f83019d92e3f81c87c Author: Vishal Moola (Oracle) Date: Tue Mar 3 11:48:25 2026 -0800 x86/mm/pat: Convert pmd code to use page table apis Use the ptdesc APIs for all page table allocation and free sites to allow their separate allocation from struct page in the future. Convert the PMD allocation and free sites to use the generic page table APIs, as they already use ptdescs. Pass through init_mm since these are kernel page tables, as pmd_alloc_one() requires it to identify kernel page tables. Because the generic implementation does not use the second argument, pass a placeholder to avoid reimplementing it or risking breakage on other architectures. Signed-off-by: Vishal Moola (Oracle) Signed-off-by: Dave Hansen Acked-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260303194828.1406905-3-vishal.moola@gmail.com commit c22ca4a96300c8ed01fe2282d2dd9e9a75032379 Author: Vishal Moola (Oracle) Date: Tue Mar 3 11:48:24 2026 -0800 x86/mm/pat: Convert pte code to use page table apis Use the ptdesc APIs for all page table allocation and free sites to allow their separate allocation from struct page in the future. Convert the PTE allocation and free sites to use the generic page table APIs, as they already use ptdescs. Pass through init_mm since these are kernel page tables; otherwise, pte_alloc_one_kernel() becomes a no-op. Signed-off-by: Vishal Moola (Oracle) Signed-off-by: Dave Hansen Acked-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260303194828.1406905-2-vishal.moola@gmail.com commit 6eba866b0ab61ae282f64980b06c7c613897201a Merge: 5f7ac24ba23218 2b76e0cc7803e5 Author: Ulf Hansson Date: Wed Mar 4 17:55:41 2026 +0100 mmc: Merge branch fixes into next Merge the mmc fixes for v7.0-rc[n] into the next branch, to allow them to get tested together with the mmc changes that are targeted for the next release. Signed-off-by: Ulf Hansson commit f630de1f8d70d7e29e12bc25dc63f9c5f771dc59 Author: Sean Christopherson Date: Fri Feb 13 17:27:02 2026 -0800 KVM: TDX: Fold tdx_bringup() into tdx_hardware_setup() Now that TDX doesn't need to manually enable virtualization through _KVM_ APIs during setup, fold tdx_bringup() into tdx_hardware_setup() where the code belongs, e.g. so that KVM doesn't leave the S-EPT kvm_x86_ops wired up when TDX is disabled. The weird ordering (and naming) was necessary to allow KVM TDX to use kvm_enable_virtualization(), which in turn had a hard dependency on kvm_x86_ops.enable_virtualization_cpu and thus kvm_x86_vendor_init(). Tested-by: Chao Gao Reviewed-by: Dan Williams Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-17-seanjc@google.com Signed-off-by: Sean Christopherson commit d30372d0b7e637475c79a785d055f4eb8c863656 Author: Sean Christopherson Date: Fri Feb 13 17:27:01 2026 -0800 KVM: Bury kvm_{en,dis}able_virtualization() in kvm_main.c once more Now that TDX handles doing VMXON without KVM's involvement, bury the top-level APIs to enable and disable virtualization back in kvm_main.c. No functional change intended. Reviewed-by: Dan Williams Reviewed-by: Chao Gao Tested-by: Chao Gao Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-16-seanjc@google.com Signed-off-by: Sean Christopherson commit afe31de159bf218d6e92db6a4495f715f0a4e38c Author: Sean Christopherson Date: Fri Feb 13 17:27:00 2026 -0800 x86/virt/tdx: Use ida_is_empty() to detect if any TDs may be running Drop nr_configured_hkid and instead use ida_is_empty() to detect if any HKIDs have been allocated/configured. Suggested-by: Dan Williams Reviewed-by: Dan Williams Reviewed-by: Chao Gao Tested-by: Chao Gao Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-15-seanjc@google.com Signed-off-by: Sean Christopherson commit eac90a5ba0aa40f6d81def241bd78d2a5cc5e08b Author: Chao Gao Date: Fri Feb 13 17:26:59 2026 -0800 x86/virt/tdx: KVM: Consolidate TDX CPU hotplug handling The core kernel registers a CPU hotplug callback to do VMX and TDX init and deinit while KVM registers a separate CPU offline callback to block offlining the last online CPU in a socket. Splitting TDX-related CPU hotplug handling across two components is odd and adds unnecessary complexity. Consolidate TDX-related CPU hotplug handling by integrating KVM's tdx_offline_cpu() to the one in the core kernel. Also move nr_configured_hkid to the core kernel because tdx_offline_cpu() references it. Since HKID allocation and free are handled in the core kernel, it's more natural to track used HKIDs there. Reviewed-by: Dan Williams Signed-off-by: Chao Gao Tested-by: Chao Gao Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-14-seanjc@google.com Signed-off-by: Sean Christopherson commit 9900400e20c0289bf0c82231169c33b43e38c6e8 Author: Sean Christopherson Date: Fri Feb 13 17:26:58 2026 -0800 x86/virt/tdx: Tag a pile of functions as __init, and globals as __ro_after_init Now that TDX-Module initialization is done during subsys init, tag all related functions as __init, and relevant data as __ro_after_init. Reviewed-by: Dan Williams Reviewed-by: Chao Gao Tested-by: Chao Gao Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-13-seanjc@google.com Signed-off-by: Sean Christopherson commit 165e77353831a85caa0444d16f29bd6b111dd2c5 Author: Sean Christopherson Date: Fri Feb 13 17:26:57 2026 -0800 KVM: x86/tdx: Do VMXON and TDX-Module initialization during subsys init Now that VMXON can be done without bouncing through KVM, do TDX-Module initialization during subsys init (specifically before module_init() so that it runs before KVM when both are built-in). Aside from the obvious benefits of separating core TDX code from KVM, this will allow tagging a pile of TDX functions and globals as being __init and __ro_after_init. Reviewed-by: Dan Williams Reviewed-by: Chao Gao Acked-by: Dave Hansen Tested-by: Chao Gao Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 0efe5dc16169b0c7d47cbb495225065c67712fbc Author: Sean Christopherson Date: Fri Feb 13 17:26:56 2026 -0800 x86/virt/tdx: Drop the outdated requirement that TDX be enabled in IRQ context Remove TDX's outdated requirement that per-CPU enabling be done via IPI function call, which was a stale artifact leftover from early versions of the TDX enablement series. The requirement that IRQs be disabled should have been dropped as part of the revamped series that relied on a the KVM rework to enable VMX at module load. In other words, the kernel's "requirement" was never a requirement at all, but instead a reflection of how KVM enabled VMX (via IPI callback) when the TDX subsystem code was merged. Note, accessing per-CPU information is safe even without disabling IRQs, as tdx_online_cpu() is invoked via a cpuhp callback, i.e. from a per-CPU thread. Link: https://lore.kernel.org/all/ZyJOiPQnBz31qLZ7@google.com Tested-by: Chao Gao Reviewed-by: Dan Williams Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-11-seanjc@google.com Signed-off-by: Sean Christopherson commit 8528a7f9c91d917ad2b3b6a71f1cb7e00b1fb1bf Author: Sean Christopherson Date: Fri Feb 13 17:26:55 2026 -0800 x86/virt: Add refcounting of VMX/SVM usage to support multiple in-kernel users Implement a per-CPU refcounting scheme so that "users" of hardware virtualization, e.g. KVM and the future TDX code, can co-exist without pulling the rug out from under each other. E.g. if KVM were to disable VMX on module unload or when the last KVM VM was destroyed, SEAMCALLs from the TDX subsystem would #UD and panic the kernel. Disable preemption in the get/put APIs to ensure virtualization is fully enabled/disabled before returning to the caller. E.g. if the task were preempted after a 0=>1 transition, the new task would see a 1=>2 and thus return without enabling virtualization. Explicitly disable preemption instead of requiring the caller to do so, because the need to disable preemption is an artifact of the implementation. E.g. from KVM's perspective there is no _need_ to disable preemption as KVM guarantees the pCPU on which it is running is stable (but preemption is enabled). Opportunistically abstract away SVM vs. VMX in the public APIs by using X86_FEATURE_{SVM,VMX} to communicate what technology the caller wants to enable and use. Cc: Xu Yilun Reviewed-by: Chao Gao Tested-by: Chao Gao Reviewed-by: Dan Williams Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-10-seanjc@google.com Signed-off-by: Sean Christopherson commit 428afac5a8ea9c55bb8408e02dc92b8f85bf5f30 Author: Sean Christopherson Date: Fri Feb 13 17:26:54 2026 -0800 KVM: x86: Move bulk of emergency virtualizaton logic to virt subsystem Move the majority of the code related to disabling hardware virtualization in emergency from KVM into the virt subsystem so that virt can take full ownership of the state of SVM/VMX. This will allow refcounting usage of SVM/VMX so that KVM and the TDX subsystem can enable VMX without stomping on each other. To route the emergency callback to the "right" vendor code, add to avoid mixing vendor and generic code, implement a x86_virt_ops structure to track the emergency callback, along with the SVM vs. VMX (vs. "none") feature that is active. To avoid having to choose between SVM and VMX, simply refuse to enable either if both are somehow supported. No known CPU supports both SVM and VMX, and it's comically unlikely such a CPU will ever exist. Leave KVM's clearing of loaded VMCSes and MSR_VM_HSAVE_PA in KVM, via a callback explicitly scoped to KVM. Loading VMCSes and saving/restoring host state are firmly tied to running VMs, and thus are (a) KVM's responsibility and (b) operations that are still exclusively reserved for KVM (as far as in-tree code is concerned). I.e. the contract being established is that non-KVM subsystems can utilize virtualization, but for all intents and purposes cannot act as full-blown hypervisors. Reviewed-by: Chao Gao Tested-by: Chao Gao Reviewed-by: Dan Williams Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 32d76cdfa1222c88262da5b12e0b2bba444c96fa Author: Sean Christopherson Date: Fri Feb 13 17:26:53 2026 -0800 KVM: SVM: Move core EFER.SVME enablement to kernel Move the innermost EFER.SVME logic out of KVM and into to core x86 to land the SVM support alongside VMX support. This will allow providing a more unified API from the kernel to KVM, and will allow moving the bulk of the emergency disabling insanity out of KVM without having a weird split between kernel and KVM for SVM vs. VMX. No functional change intended. Tested-by: Chao Gao Reviewed-by: Dan Williams Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 920da4f75519a3fa3fe2fc25458445b561653610 Author: Sean Christopherson Date: Fri Feb 13 17:26:52 2026 -0800 KVM: VMX: Move core VMXON enablement to kernel Move the innermost VMXON+VMXOFF logic out of KVM and into to core x86 so that TDX can (eventually) force VMXON without having to rely on KVM being loaded, e.g. to do SEAMCALLs during initialization. Opportunistically update the comment regarding emergency disabling via NMI to clarify that virt_rebooting will be set by _another_ emergency callback, i.e. that virt_rebooting doesn't need to be set before VMCLEAR, only before _this_ invocation does VMXOFF. Acked-by: Dave Hansen Tested-by: Chao Gao Reviewed-by: Dan Williams Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 95e4adb24ff6e876f6d2b960cf922d3c969d4dc4 Author: Sean Christopherson Date: Fri Feb 13 17:26:51 2026 -0800 x86/virt: Force-clear X86_FEATURE_VMX if configuring root VMCS fails If allocating and configuring a root VMCS fails, clear X86_FEATURE_VMX in all CPUs so that KVM doesn't need to manually check root_vmcs. As added bonuses, clearing VMX will reflect that VMX is unusable in /proc/cpuinfo, and will avoid a futile auto-probe of kvm-intel.ko. WARN if allocating a root VMCS page fails, e.g. to help users figure out why VMX is broken in the unlikely scenario something goes sideways during boot (and because the allocation should succeed unless there's a kernel bug). Tweak KVM's error message to suggest checking kernel logs if VMX is unsupported (in addition to checking BIOS). Tested-by: Chao Gao Reviewed-by: Dan Williams Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 405b7c27934eaabbcc52ccfbaeb22ef966b6b5f0 Author: Sean Christopherson Date: Fri Feb 13 17:26:50 2026 -0800 KVM: VMX: Unconditionally allocate root VMCSes during boot CPU bringup Allocate the root VMCS (misleading called "vmxarea" and "kvm_area" in KVM) for each possible CPU during early boot CPU bringup, before early TDX initialization, so that TDX can eventually do VMXON on-demand (to make SEAMCALLs) without needing to load kvm-intel.ko. Allocate the pages early on, e.g. instead of trying to do so on-demand, to avoid having to juggle allocation failures at runtime. Opportunistically rename the per-CPU pointers to better reflect the role of the VMCS. Use Intel's "root VMCS" terminology, e.g. from various VMCS patents[1][2] and older SDMs, not the more opaque "VMXON region" used in recent versions of the SDM. While it's possible the VMCS passed to VMXON no longer serves as _the_ root VMCS on modern CPUs, it is still in effect a "root mode VMCS", as described in the patents. Link: https://patentimages.storage.googleapis.com/c7/e4/32/d7a7def5580667/WO2013101191A1.pdf [1] Link: https://patentimages.storage.googleapis.com/13/f6/8d/1361fab8c33373/US20080163205A1.pdf [2] Tested-by: Chao Gao Reviewed-by: Dan Williams Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-5-seanjc@google.com Signed-off-by: Sean Christopherson commit a1450a8156c65d9fe6111627094c26359d2e2274 Author: Sean Christopherson Date: Fri Feb 13 17:26:49 2026 -0800 KVM: x86: Move "kvm_rebooting" to kernel as "virt_rebooting" Move "kvm_rebooting" to the kernel, exported for KVM, as one of many steps towards extracting the innermost VMXON and EFER.SVME management logic out of KVM and into to core x86. For lack of a better name, call the new file "hw.c", to yield "virt hardware" when combined with its parent directory. No functional change intended. Tested-by: Chao Gao Reviewed-by: Dan Williams Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 3c75e6a5da3c0dfcd34e5f9df5390804179f2aeb Author: Sean Christopherson Date: Fri Feb 13 17:26:48 2026 -0800 KVM: VMX: Move architectural "vmcs" and "vmcs_hdr" structures to public vmx.h Move "struct vmcs" and "struct vmcs_hdr" to asm/vmx.h in anticipation of moving VMXON/VMXOFF to the core kernel (VMXON requires a "root" VMCS with the appropriate revision ID in its header). No functional change intended. Tested-by: Chao Gao Reviewed-by: Dan Williams Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 4059172b2a78a71d15d8fcd8d3fd8ea1ba65d25b Author: Sean Christopherson Date: Fri Feb 13 17:26:47 2026 -0800 KVM: x86: Move kvm_rebooting to x86 Move kvm_rebooting, which is only read by x86, to KVM x86 so that it can be moved again to core x86 code. Add a "shutdown" arch hook to facilate setting the flag in KVM x86, along with a pile of comments to provide more context around what KVM x86 is doing and why. Reviewed-by: Chao Gao Acked-by: Dave Hansen Tested-by: Chao Gao Reviewed-by: Dan Williams Tested-by: Sagi Shahar Link: https://patch.msgid.link/20260214012702.2368778-2-seanjc@google.com Signed-off-by: Sean Christopherson commit c5d8df53b620eb094855a2bd88be89c4bdf7a031 Author: Srinivasan Shanmugam Date: Sat Feb 28 21:56:40 2026 +0530 drm/amdgpu: Fix mutex handling in amdgpu_benchmark_do_move() v3 amdgpu_benchmark_do_move() can exit the loop early if amdgpu_copy_buffer() or dma_fence_wait() fails. In the error path, the function jumps to the exit label without releasing adev->mman.default_entity.lock, which leaves the mutex held and results in a lock imbalance. This can block subsequent users of default_entity and potentially cause deadlocks. Move the mutex_unlock() to the common exit path so the lock is released on both success and error returns. This fixes: drivers/gpu/drm/amd/amdgpu/amdgpu_benchmark.c:57 amdgpu_benchmark_do_move() warn: inconsistent returns '&adev->mman.default_entity.lock'. v2: - Drop unrelated initialization of 'r' - Keep the change focused on the mutex imbalance fix (Pierre). v3: - Removed empty line Fixes: 30f2daedf4d8 ("drm/amdgpu: add missing lock in amdgpu_benchmark_do_move") Reported-by: Dan Carpenter Cc: Pierre-Eric Pelloux-Prayer Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Alex Deucher commit 8e8f6bda8a84f41c4002bca44ac89a5b3f8c7df2 Author: Asad Kamal Date: Mon Mar 2 13:35:30 2026 +0800 drm/amd/pm: Avoid overflow when sorting pp_feature list pp_features sorting uses int8_t sort_feature[] to store driver feature enum indices. On newer ASICs the enum index can exceed 127, causing signed overflow and silently dropping entries from the output. Switch the array to int16_t so all enum indices are preserved. Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit b2e997e6cfefdc24241656ef2352ab1176823735 Author: Lijo Lazar Date: Wed Feb 25 17:53:31 2026 +0530 drm/amd/pm: Add pm firmware info to dmesg log Add PMFW info to dmesg log for SMUv13 SOCs. It's helpful as diagnostic data for some driver load issues. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 9b822e26eea3899003aa8a89d5e2c4408e066e20 Author: sguttula Date: Wed Feb 25 13:57:01 2026 +0530 drm/amdgpu/psp: Use Indirect access address for GFX to PSP mailbox The reason the RAP is not granting access to 0x58200 is that a dedicated RSMU slot would have to be spent for this address range, and MPASP is close to running out of RSMU slots. This will help to fix PSP TOC load failure during secureboot. GFX Driver Need to use indirect access for SMN address regs. Signed-off-by: sguttula Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit a95dfb0c78fa7d0d17c0131738097c53b4074d6c Author: Tvrtko Ursulin Date: Wed Jan 7 12:43:50 2026 +0000 drm/amdgpu: Remove redundant missing hw ip handling Now that it is guaranteed there can be no entity if there is no hw ip block we can remove the open coded protection during CS parsing. Signed-off-by: Tvrtko Ursulin References: 55414ad5c983 ("drm/amdgpu: error out on entity with no run queue") Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 3ccdad15ae81a65875e4fe961f4e9c80b6d15829 Author: Tvrtko Ursulin Date: Wed Jan 7 12:43:49 2026 +0000 drm/amdgpu: Reject impossible entities early Currently there are two different behaviour modes when userspace tries to operate on not present HW IP blocks. On a machine without UVD, VCE and VPE blocks, this can be observed for example like this: $ sudo ./amd_fuzzing --r cs-wait-fuzzing ... amd_cs_wait_fuzzing DRM_IOCTL_AMDGPU_CTX r 0 amd_cs_wait_fuzzing AMDGPU_WAIT_CS AMD_IP_GFX r 0 amd_cs_wait_fuzzing AMDGPU_WAIT_CS AMD_IP_COMPUTE r 0 amd_cs_wait_fuzzing AMDGPU_WAIT_CS AMD_IP_DMA r 0 amd_cs_wait_fuzzing AMDGPU_WAIT_CS AMD_IP_UVD r -1 amd_cs_wait_fuzzing AMDGPU_WAIT_CS AMD_IP_VCE r 0 amd_cs_wait_fuzzing AMDGPU_WAIT_CS AMD_IP_UVD_ENC r -1 amd_cs_wait_fuzzing AMDGPU_WAIT_CS AMD_IP_VCN_DEC r 0 amd_cs_wait_fuzzing AMDGPU_WAIT_CS AMD_IP_VCN_ENC r 0 amd_cs_wait_fuzzing AMDGPU_WAIT_CS AMD_IP_VCN_JPEG r 0 amd_cs_wait_fuzzing AMDGPU_WAIT_CS AMD_IP_VPE r 0 We can see that UVD returns an errno (-EINVAL) from the CS_WAIT ioctl, while VCE and VPE return unexpected successes. The difference stems from the fact the UVD is a load balancing engine which retains the context, so with a workaround implemented in amdgpu_ctx_init_entity(), but which does not account for the fact hardware block may not be present. This causes a single NULL scheduler to be passed to drm_sched_entity_init(), which immediately rejects this with -EINVAL. The not present VCE and VPE cases on the other hand pass zero schedulers to drm_sched_entity_init(), which is explicitly allowed and results in unusable entities. As the UVD case however shows, call paths can handle the errors, so we can consolidate this into a single path which will always return -EINVAL if the HW IP block is not present. We do this by rejecting it early and not calling drm_sched_entity_init() when there is no backing hardware. This also removes the need for the drm_sched_entity_init() to handle the zero schedulers and NULL scheduler cases, which means that we can follow up by removing the special casing from the DRM scheduler. Signed-off-by: Tvrtko Ursulin References: f34e8bb7d6c6 ("drm/sched: fix null-ptr-deref in init entity") Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 4952189b284d4d847f92636bb42dd747747129c0 Author: Sunil Khatri Date: Mon Mar 2 18:50:46 2026 +0530 drm/amdgpu/userq: refcount userqueues to avoid any race conditions To avoid race condition and avoid UAF cases, implement kref based queues and protect the below operations using xa lock a. Getting a queue from xarray b. Increment/Decrement it's refcount Every time some one want to access a queue, always get via amdgpu_userq_get to make sure we have locks in place and get the object if active. A userqueue is destroyed on the last refcount is dropped which typically would be via IOCTL or during fini. v2: Add the missing drop in one the condition in the signal ioclt [Alex] v3: remove the queue from the xarray first in the free queue ioctl path [Christian] - Pass queue to the amdgpu_userq_put directly. - make amdgpu_userq_put xa_lock free since we are doing put for each get only and final put is done via destroy and we remove the queue from xa with lock. - use userq_put in fini too so cleanup is done fully. v4: Use xa_erase directly rather than doing load and erase in free ioctl. Also remove some of the error logs which could be exploited by the user to flood the logs [Christian] Signed-off-by: Sunil Khatri Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit c7c573275ec20db05be769288a3e3bb2250ec618 Author: Alysa Liu Date: Thu Feb 5 11:21:45 2026 -0500 drm/amdgpu: Fix use-after-free race in VM acquire Replace non-atomic vm->process_info assignment with cmpxchg() to prevent race when parent/child processes sharing a drm_file both try to acquire the same VM after fork(). Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alysa Liu Signed-off-by: Alex Deucher commit 8de9edb35976fa56565dc8fbb5d1310e8e10187c Author: Yang Wang Date: Wed Feb 25 22:51:06 2026 -0500 drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x v1: The metrics->EnergyAccumulator field has been deprecated on newer pmfw. v2: add smu 13.0.0/13.0.7/13.0.10 support. Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit a4f87a1c303862e273187d417110e829bddac414 Author: Gangliang Xie Date: Tue Dec 16 14:31:23 2025 +0800 drm/amd/ras: adapt sync info func for pmfw eeprom adapt sync info func for pmfw eeprom Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit e82f9aac39885c220168e0ac11ff866e1aebbca1 Author: Gangliang Xie Date: Mon Dec 15 15:54:35 2025 +0800 drm/amd/ras: add check func for pmfw eeprom add check func for pmfw eeprom Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit b2d13a41da94008fdd3786b396a6375c12454522 Author: Philip Yang Date: Thu Feb 26 15:15:51 2026 -0500 drm/amdgpu: GFX12.1 scratch memory limit up to 57-bit The scratch aperture or gmc private aperture in flat memory contains 57 bits of data on gfx v12.1.0 compared to the 32 bits from previous. Add new helper kfd_init_apertures_v12 for gfx version >= v12.1.0 which supports 57-bit VA space. v2: - update pdd->scratch_limit (Yu, Lang) - update fixes tag (Felix Kuehling) - add helper kfd_init_apertures_v12 Fixes: db1882b3ff0c ("drm/amdkfd: Update LDS, Scratch base for 57bit address") Signed-off-by: Philip Yang Reviewed-by: Lang Yu Acked-by: Felix Kuehling Signed-off-by: Alex Deucher commit 89b814a34a954c5aa678d1f39726d0c108489c72 Author: Gangliang Xie Date: Mon Dec 15 15:48:44 2025 +0800 drm/amd/ras: add initialization func for pmfw eeprom add initialization func for pmfw eeprom Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 72289903a231e421b8c0f50d8213ac2ad28ab8a4 Author: Gangliang Xie Date: Mon Dec 15 15:18:35 2025 +0800 drm/amd/ras: adapt page retirement process for pmfw eeprom read bad page data from pmfw eeprom when retirement is triggered, use timestamp read from eeprom Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 42c46be2ec30df732cea4d4682e8f70795f21cee Author: Gangliang Xie Date: Mon Dec 15 14:19:34 2025 +0800 drm/amd/ras: add read func for pmfw eeprom add read func for pmfw eeprom, and adapt address converting for bad pages loaded from pmfw eeprom v2: change label 'Out' to 'out' Signed-off-by: Tao Zhou Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 3972f41bc107cc10fa82c54ec420b7a947ba7912 Author: Tao Zhou Date: Mon Dec 15 13:53:59 2025 +0800 drm/amd/ras: make MCA IPID parse global add a new IPID parse interface for umc, so we can implement it for each ASIC, and so we can call it in other blocks Signed-off-by: Tao Zhou Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit b18475fba3d0990b9679ba0ea872e7c4ac5017e2 Author: Gangliang Xie Date: Mon Dec 15 13:22:55 2025 +0800 drm/amd/ras: add append func for pmfw eeprom add append func for pmfw eeprom Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 50428065575872563c8004fcacb8db3048ada77f Author: Gangliang Xie Date: Mon Dec 15 13:01:04 2025 +0800 drm/amd/ras: add check safety watermark func for pmfw eeprom add check safety watermark func for pmfw eeprom Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 5f7ac24ba232180caf77e9ddd6ccad61b9948706 Author: Huan He Date: Thu Feb 26 17:26:14 2026 +0800 dt-bindings: mmc: dwcmshc-sdhci: Fix resets array validation The binding defines tuple-style reset-names items for some compatibles, which implicitly enforces a fixed array length via JSON Schema. Defining global maxItems for resets and reset-names causes these constraints to be intersected via allOf, resulting in an effective minItems equal to the global maxItems. This leads to dtbs_check failures reporting reset arrays as too short, even when the DTS provides the correct number of entries. Fixes: 30009a21f257 ("dt-bindings: mmc: sdhci-of-dwcmshc: Add Eswin EIC7700") Co-developed-by: Pritesh Patel Signed-off-by: Pritesh Patel Signed-off-by: Huan He Acked-by: Conor Dooley Signed-off-by: Ulf Hansson commit 2851b6c6a42e22c243aa4cd606a49e2b9acfb6d6 Author: Konrad Dybcio Date: Wed Mar 4 14:48:31 2026 +0100 clk: qcom: dispcc[01]-sa8775p: Fix DSI byte clock rate setting The clock tree for byte_clk_src is as follows: ┌──────byte0_clk_src─────┐ │ │ byte0_clk byte0_div_clk_src │ byte0_intf_clk If both of its direct children have CLK_SET_RATE_PARENT with different requests, byte0_clk_src (and its parent) will be reconfigured. In this case, byte0_intf should strictly follow the rate of byte0_clk (with some adjustments based on PHY mode). Remove CLK_SET_RATE_PARENT from byte0_div_clk_src to avoid this issue. Fixes: e700bfd2f976 ("clk: qcom: Add support for Display clock Controllers on SA8775P") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260304-topic-dsi_byte_fixup-v1-5-b79b29f83176@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7bc48fcdf9e77bf68ef04af015d50df2a9acac00 Author: Konrad Dybcio Date: Wed Mar 4 14:48:30 2026 +0100 clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting The clock tree for byte_clk_src is as follows: ┌──────byte0_clk_src─────┐ │ │ byte0_clk byte0_div_clk_src │ byte0_intf_clk If both of its direct children have CLK_SET_RATE_PARENT with different requests, byte0_clk_src (and its parent) will be reconfigured. In this case, byte0_intf should strictly follow the rate of byte0_clk (with some adjustments based on PHY mode). Remove CLK_SET_RATE_PARENT from byte0_div_clk_src to avoid this issue. Fixes: 76f05f1ec766 ("clk: qcom: Add DISPCC driver support for SM4450") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260304-topic-dsi_byte_fixup-v1-4-b79b29f83176@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit dd5b76257b4048151006620c9895e2f5f0d997eb Author: Konrad Dybcio Date: Wed Mar 4 14:48:29 2026 +0100 clk: qcom: dispcc-milos: Fix DSI byte clock rate setting The clock tree for byte_clk_src is as follows: ┌──────byte0_clk_src─────┐ │ │ byte0_clk byte0_div_clk_src │ byte0_intf_clk If both of its direct children have CLK_SET_RATE_PARENT with different requests, byte0_clk_src (and its parent) will be reconfigured. In this case, byte0_intf should strictly follow the rate of byte0_clk (with some adjustments based on PHY mode). Remove CLK_SET_RATE_PARENT from byte0_div_clk_src to avoid this issue. Fixes: f40b5217dce1 ("clk: qcom: Add Display Clock controller (DISPCC) driver for Milos") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260304-topic-dsi_byte_fixup-v1-3-b79b29f83176@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e892f4e3f3d558ce5d7595dca7cce2bd170a19fa Author: Konrad Dybcio Date: Wed Mar 4 14:48:28 2026 +0100 clk: qcom: dispcc-kaanapali: Fix DSI byte clock rate setting The clock tree for byte_clk_src is as follows: ┌──────byte0_clk_src─────┐ │ │ byte0_clk byte0_div_clk_src │ byte0_intf_clk If both of its direct children have CLK_SET_RATE_PARENT with different requests, byte0_clk_src (and its parent) will be reconfigured. In this case, byte0_intf should strictly follow the rate of byte0_clk (with some adjustments based on PHY mode). Remove CLK_SET_RATE_PARENT from byte0_div_clk_src to avoid this issue. Fixes: 6c6750b7061c ("clk: qcom: dispcc: Add support for display clock controller Kaanapali") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260304-topic-dsi_byte_fixup-v1-2-b79b29f83176@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 98ea9eda030587601db56425efcd32263d853591 Author: Konrad Dybcio Date: Wed Mar 4 14:48:27 2026 +0100 clk: qcom: dispcc-glymur: Fix DSI byte clock rate setting The clock tree for byte_clk_src is as follows: ┌──────byte0_clk_src─────┐ │ │ byte0_clk byte0_div_clk_src │ byte0_intf_clk If both of its direct children have CLK_SET_RATE_PARENT with different requests, byte0_clk_src (and its parent) will be reconfigured. In this case, byte0_intf should strictly follow the rate of byte0_clk (with some adjustments based on PHY mode). Remove CLK_SET_RATE_PARENT from byte0_div_clk_src to avoid this issue. Fixes: b4d15211c408 ("clk: qcom: dispcc-glymur: Add support for Display Clock Controller") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260304-topic-dsi_byte_fixup-v1-1-b79b29f83176@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0b151a6307205eb867250985a910a88787cbf12e Author: White Lewis Date: Tue Mar 3 19:55:50 2026 +0800 clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers The four byte_div_clk_src dividers (disp{0,1}_cc_mdss_byte{0,1}_div_clk_src) had CLK_SET_RATE_PARENT set. When the DSI driver calls clk_set_rate() on byte_intf_clk, the rate-change propagates through the divider up to the parent PLL (byte_clk_src), halving the byte clock rate. A simiar issue had been also encountered on SM8750. b8501febdc51 ("clk: qcom: dispcc-sm8750: Drop incorrect CLK_SET_RATE_PARENT on byte intf parent"). Likewise, remove CLK_SET_RATE_PARENT from all four byte divider clocks so that clk_set_rate() on the divider adjusts only the divider ratio, leaving the parent PLL untouched. Fixes: 4a66e76fdb6d ("clk: qcom: Add SC8280XP display clock controller") Signed-off-by: White Lewis [pengyu: reword] Signed-off-by: Pengyu Luo Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260303115550.9279-1-mitltlatltl@gmail.com Signed-off-by: Bjorn Andersson commit 1e31a3e867ca3d3bb345f9524670256cc8b62c25 Author: Ricky Wu Date: Fri Jan 30 11:05:01 2026 +0800 mmc: rtsx_pci_sdmmc: simplify voltage switch handling after card_busy() Now that the Realtek PCIe SDMMC host implements the card_busy() callback, the MMC core performs the required DAT[3:0] validation during the signal voltage switch sequence. As a result, the driver-side voltage stabilization helpers sd_wait_voltage_stable_1() and sd_wait_voltage_stable_2() become redundant. These helpers duplicate DAT line checks that are now handled centrally by the MMC core via card_busy(). Remove the two stabilization helpers and simplify sdmmc_switch_voltage() accordingly, keeping only the minimal clock control needed around the voltage switch. No functional changes and intended. Signed-off-by: Ricky Wu Signed-off-by: Ulf Hansson commit e4be7e96d076b014abb77fc7fe72c92e8788f3df Author: Tomas Glozar Date: Mon Jan 19 12:52:22 2026 +0100 Documentation/rtla: Document --stack-format option Add documentation for --stack-format option of rtla-timerlat into its common options. Reviewed-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260119115222.744150-2-tglozar@redhat.com Signed-off-by: Tomas Glozar commit ef59e454156eb068ba3f2d9e14b397fd7953f65a Author: Tomas Glozar Date: Mon Jan 19 12:52:21 2026 +0100 rtla/timerlat: Add --stack-format option In the current implementation, the auto-analysis code for printing the stack captured in the tracefs buffer of the aa instance stops at the first encountered address that cannot be resolved into a function symbol. This is not always the desired behavior on all platforms; sometimes, there might be resolvable entries after unresolvable ones, and sometimes, the user might want to inspect the raw pointers for the unresolvable entries. Add a new option, --stack-format, with three values: - truncate: stop at first unresolvable entry. This is the current behavior, and is kept as the default. - skip: skip unresolvable entries, but do not stop on them. - full: print all entries, including unresolvable ones. To make this work, the "size" field of the stack entry is now also read and used as the maximum number of entries to print, capped at 64, since that is the fixed length of the "caller" field. Link: https://lore.kernel.org/r/20260119115222.744150-1-tglozar@redhat.com Signed-off-by: Tomas Glozar commit 3a4080e5e426352a78f944db0ff29e029d89193b Author: Costa Shulyupin Date: Mon Jan 19 12:58:57 2026 +0200 tools/rtla: Add unit tests for utils.c Add unit tests for utility functions in src/utils.c using the Check testing framework. The tests verify parse_cpu_set(), strtoi(), and parse_prio() functions. Unit tests are built conditionally when libcheck is available. Run tests with 'make unit-test'. The test framework uses the Check library which provides process isolation for each test, preventing failures in one test from affecting others. Signed-off-by: Costa Shulyupin Link: https://lore.kernel.org/r/20260119105857.797498-3-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 153e211fc74a096cbd3570ca7388ab4cbeadc6c5 Author: Costa Shulyupin Date: Mon Jan 19 12:58:56 2026 +0200 tools/build: Add feature test for libcheck Enable support for unit tests in rtla. Note that the pkg-config file for libcheck is named check.pc. Signed-off-by: Costa Shulyupin Link: https://lore.kernel.org/r/20260119105857.797498-2-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 93f3a267c3dd4d811b224bb9e179a10d81456a74 Author: Ville Syrjälä Date: Tue Mar 3 11:54:14 2026 +0200 drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL Apparently ICL may hang with an MCE if we write TRANS_VRR_VMAX/FLIPLINE before enabling TRANS_DDI_FUNC_CTL. Personally I was only able to reproduce a hang (on an Dell XPS 7390 2-in-1) with an external display connected via a dock using a dodgy type-C cable that made the link training fail. After the failed link training the machine would hang. TGL seemed immune to the problem for whatever reason. BSpec does tell us to configure VRR after enabling TRANS_DDI_FUNC_CTL as well. The DMC firmware also does the VRR restore in two stages: - first stage seems to be unconditional and includes TRANS_VRR_CTL and a few other VRR registers, among other things - second stage is conditional on the DDI being enabled, and includes TRANS_DDI_FUNC_CTL and TRANS_VRR_VMAX/VMIN/FLIPLINE, among other things So let's reorder the steps to match to avoid the hang, and toss in an extra WARN to make sure we don't screw this up later. BSpec: 22243 Cc: stable@vger.kernel.org Cc: Ankit Nautiyal Reported-by: Benjamin Tissoires Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15777 Tested-by: Benjamin Tissoires Fixes: dda7dcd9da73 ("drm/i915/vrr: Use fixed timings for platforms that support VRR") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260303095414.4331-1-ville.syrjala@linux.intel.com Reviewed-by: Ankit Nautiyal commit 27b9bcad2bf77e12c08e36d8d72bd6ce0db46041 Author: wangdicheng Date: Wed Mar 4 15:02:19 2026 +0800 ALSA: hda/senary: Add hardware init verbs and fixup framework Port the essential hardware initialization logic from the vendor driver and introduce the standard HDA fixup framework to handle different machine configurations. Key changes: 1. Add hardware init verbs: - Implement `senary_init_verb` to send the vendor-specific initialization sequence required by the SN6186 chip. - Override pin capabilities for Node 0x19 to ensure proper headset microphone support. 2. Introduce fixup framework: - Define a default pin configuration table (`senary_pincfg_default`) to provide a fallback for devices with invalid BIOS configurations. - Establish a quirk table structure for future machine-specific fixes. - Since the standard quirk matching relies on Subsystem IDs, we manually apply the default fixup if `snd_hda_pick_fixup` does not find a specific match. This ensures the chip is correctly initialized during probe and resume, and provides a scalable mechanism for supporting specific hardware quirks. Signed-off-by: wangdicheng Link: https://patch.msgid.link/20260304070219.450083-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit dfd4b0d46e774d7fbd23a438ead45de08bde783e Author: Rong Zhang Date: Wed Mar 4 03:48:03 2026 +0800 ALSA: usb-audio: Apply linear volume quirk on MV-SILICON devices MV-SILICON is a SoC manufacturer producing multifunctional audio SoCs. Many devices built on top of their SDK share a common quirk that the Playback and Capture mixers use linear volume with val = 0/4096/1. The SDK seems to always report "MV-SILICON" for manufacturer string. Hence, match it so that we don't need to define quirk table entries separately for each devices. The "val = 0/4096/1" pattern is also checked against before applying the quirk, in order that the quirk won't accidentally break unseen variants. Quirky device samples: usb 7-1: New USB device found, idVendor=1235, idProduct=0003, bcdDevice= 1.00 usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 7-1: Product: G1 usb 7-1: Manufacturer: MV-SILICON usb 7-1: SerialNumber: 20190808 usb 7-1: New USB device found, idVendor=1235, idProduct=0003, bcdDevice= 1.00 usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 7-1: Product: mvsilicon B1 usb audio usb 7-1: Manufacturer: MV-SILICON usb 7-1: SerialNumber: 20190808 usb 5-1.4: New USB device found, idVendor=8888, idProduct=1719, bcdDevice= 1.00 usb 5-1.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 5-1.4: Product: HF310 USB Audio usb 5-1.4: Manufacturer: MV-SILICON usb 5-1.4: SerialNumber: 20190808 usb 7-1: New USB device found, idVendor=2717, idProduct=5086, bcdDevice= 1.00 usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 7-1: Product: Redmi 电脑音箱 usb 7-1: Manufacturer: MV-SILICON usb 7-1: SerialNumber: 20190808 usb 2-1.2: New USB device found, idVendor=3142, idProduct=a601, bcdDevice= 1.00 usb 2-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 2-1.2: Product: fifine Microphone usb 2-1.2: Manufacturer: MV-SILICON usb 2-1.2: SerialNumber: 20190808 * https://forum.ubuntu-it.org/viewtopic.php?t=659345 Signed-off-by: Rong Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260303194805.266158-9-i@rong.moe commit f510f3bacc2f0f862bb4b878e80e5519cec3419e Author: Rong Zhang Date: Wed Mar 4 03:48:02 2026 +0800 ALSA: usb-audio: Add linear volume quirk for Hotone Audio Pulze Mini Hotone Audio Pulze Mini is a modeling amplifier with UAC interface. Its Playback and Capture mixers use linear volume with val = 0/100/1. Add a quirk table entry matching VID/PID=0x84ef/0x0082 and applying linear volume quirk flags, so that it can work properly. Quirky device sample: usb 7-1: New USB device found, idVendor=84ef, idProduct=0082, bcdDevice= 1.03 usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 7-1: Product: Pulze Mini usb 7-1: Manufacturer: Hotone Audio usb 7-1: SerialNumber: 20240807 Signed-off-by: Rong Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260303194805.266158-8-i@rong.moe commit 3787a6a10e707fca1a61d364a7c256c59823ed59 Author: Rong Zhang Date: Wed Mar 4 03:48:01 2026 +0800 ALSA: usb-audio: Add QUIRK_FLAG_MIXER_{PLAYBACK,CAPTURE}_LINEAR_VOL Some quirky devices tune their volume by linearly tuning the voltage level (linear volume). In other words, such devices has a linear TLV mapping of DECLARE_TLV_DB_LINEAR(scale, TLV_DB_GAIN_MUTE, 0). Add quirk flags MIXER_PLAYBACK_LINEAR_VOL and MIXER_CAPTURE_LINEAR_VOL to represent this case respectively for playback and capture mixers. No functional change intended. Signed-off-by: Rong Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260303194805.266158-7-i@rong.moe commit b13031ca112a922352e585ab7220c0a99979f328 Author: Rong Zhang Date: Wed Mar 4 03:48:00 2026 +0800 ALSA: usb-audio: Deconflict VID between Focusrite Novation & MV-SILICON MV-SILICON is a SoC manufacturer producing multifunctional audio SoCs. Many budget-oriented OEM devices are built on top of them. However, some of them are just too budget-constrained that their manufacturers didn't even have a USB VID and simply picked a random VID. Some OEMs unfortunately picked the VID of Focusrite Novation (0x1235), resulting in VID conflicts as we had defined a VENDOR_FLG() for the latter. Add a VENDOR_STRING_FLG() for MV-SILICON to stop the matching procedure for these quirky devices, so that quirk flags for Focusrite Novation won't be accidentally applied on them. Quirky device samples: usb 7-1: New USB device found, idVendor=1235, idProduct=0003, bcdDevice= 1.00 usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 7-1: Product: G1 usb 7-1: Manufacturer: MV-SILICON usb 7-1: SerialNumber: 20190808 usb 7-1: New USB device found, idVendor=1235, idProduct=0003, bcdDevice= 1.00 usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 7-1: Product: mvsilicon B1 usb audio usb 7-1: Manufacturer: MV-SILICON usb 7-1: SerialNumber: 20190808 usb 1-1.2: New USB device found, idVendor=1235, idProduct=0002, bcdDevice= 1.00 usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=... usb 1-1.2: Product: V8 usb 1-1.2: Manufacturer: MV-SILICON usb 1-1.2: SerialNumber: ... * https://github.com/linuxhw/Dmesg/blob/main/Desktop/Others/Intel/Intel%20X79/96ED1CC44499/LINUXMINT-19.3/5.0.0-32-GENERIC/X86_64/5BE1E4C74C#L1122 usb 2-1.6: New USB device found, idVendor=1235, idProduct=0002, bcdDevice= 1.00 usb 2-1.6: New USB device strings: Mfr=1, Product=2, SerialNumber=... usb 2-1.6: Product: V9 usb 2-1.6: Manufacturer: MV-SILICON usb 2-1.6: SerialNumber: ... * https://github.com/linuxhw/Dmesg/blob/main/Desktop/Hewlett-Packard/ProLiant/ProLiant%20ML110%20G6/79B1D707316A/KUBUNTU-21.04/5.11.0-33-GENERIC/X86_64/A43F59C4AB#L1009 Signed-off-by: Rong Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260303194805.266158-6-i@rong.moe commit 30f68d090c0ee55a7c9b422e65d43b9ff68434c8 Author: Rong Zhang Date: Wed Mar 4 03:47:59 2026 +0800 ALSA: usb-audio: Support string-descriptor-based quirk table entry Some quirky devices do not have a unique VID/PID. Matching them using DEVICE_FLG() or VENDOR_FLG() may result in conflicts. Add two new macros DEVICE_STRING_FLG() and VENDOR_STRING_FLG() to match USB string descriptors (manufacturer and/or product) in addition to VID and/or PID, so that we can deconflict these devices safely. No functional change intended. Signed-off-by: Rong Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260303194805.266158-5-i@rong.moe commit 52dc4b190a31d5a5f43aadc51f5297048bfb6d52 Author: Rong Zhang Date: Wed Mar 4 03:47:58 2026 +0800 ALSA: usb-audio: Improve volume range checks Currently the volume range check is only meant to discover quirky microphone on webcam devices and facing these issues: - The check is only meaningful for dB volume, but it doesn't check if the TLV callback is the corresponding one - A common quirky pattern "val = 0/100/1" doesn't trigger any warning - Some modern devices trigger the check, but they are legit - The warning message doesn't apply to some quirky messages with linear volume - The term "range" in the warning message is confusing. At readers' first glance it should be (max - min), but it turns out to be ((max - min) / res) Solve these issues by improving the checking logic to: - Ignore mixers with non-dB TLV - Warn on unlikely small volume ranges (max - min < 256) - Add some heuristics to determine if the volume range is unlikely big - Rephrase the warning message to mention linear volume - Rephrase the warning message in correct wording Signed-off-by: Rong Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260303194805.266158-4-i@rong.moe commit 1060dbbbb2f260e4755dbd8d2f53f5a1894397d8 Author: Rong Zhang Date: Wed Mar 4 03:47:57 2026 +0800 ALSA: usb-audio: Add helper function for volume range checks When a potentially insane volume range is found, the volume control parameters will be printed in WARN level instead of DEBUG level. Currently, it's done by emitting a open-coded usb_audio_warn() in the corresponding check. The following changes are about to add more checks against volumen ranges. As the first step, extract the current check logic into a helper function to improve readability. No functional change intended. Signed-off-by: Rong Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260303194805.266158-3-i@rong.moe commit 41d78cb724f4b40b7548af420ccfe524b14023bb Author: Rong Zhang Date: Wed Mar 4 03:47:56 2026 +0800 Revert "ALSA: usb: Increase volume range that triggers a warning" UAC uses 2 bytes to store volume values, so the maximum volume range is 0xFFFF (65535, val = -32768/32767/1). The reverted commit bumpped the range of triggering the warning to > 65535, effectively making the range check a no-op. It didn't fix anything but covered any potential problems and deviated from the original intention of the range check. This reverts commit 6b971191fcfc9e3c2c0143eea22534f1f48dbb62. Fixes: 6b971191fcfc ("ALSA: usb: Increase volume range that triggers a warning") Cc: stable@vger.kernel.org Signed-off-by: Rong Zhang Acked-by: Arun Raghavan Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260303194805.266158-2-i@rong.moe commit 0cdccaae8c28a396ed6ac6c4bb6099cfca77d3ce Merge: a69f6770209142 7ae0d8f1abbbba Author: Takashi Iwai Date: Wed Mar 4 12:05:13 2026 +0100 Merge branch 'for-linus' into for-next Pull 7.0 devel branch for developing further HD- and USB-audio fixes. Signed-off-by: Takashi Iwai commit 35ff3cc8e5e7222fa9d046ca1481a959cd757682 Author: Abel Vesa Date: Mon Mar 2 15:29:31 2026 +0200 dt-bindings: power: qcom,rpmpd: document the Eliza RPMh Power Domains Document the RPMh Power Domains on the Eliza Platform. It is not compatible with any of the previous platforms, so dedicated compatible string is needed. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Signed-off-by: Ulf Hansson commit 051fff352954e3ef50b561ff66ca91a68e499013 Author: Jani Nikula Date: Wed Feb 25 19:57:10 2026 +0200 drm/i915/gt: prefer _PICK_EVEN() over _PICK() There's no need to use _PICK() here. Use the simpler one instead. Reviewed-by: Michał Grzelak Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/f94272fb9e93afa51d9fdb006888b8ebe38580df.1772042022.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 3c35731b7296a9c2e621387587a3e4cebb3bce8b Author: Jani Nikula Date: Wed Feb 25 19:57:09 2026 +0200 drm/intel: add pick.h for the various "picker" helpers Add a shared header that's used by i915, xe, and i915 display. This allows us to drop the compat-i915-headers/i915_reg_defs.h include from xe_reg_defs.h. All the register macro helpers were subtly pulled in from i915 to all of xe through this. Reviewed-by: Michał Grzelak Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/fcd70f3317755bf98a6e7ae88974aa8ba06efd1e.1772042022.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 242ab49aca7fa754c31d66f1c846396832dbece3 Author: Jani Nikula Date: Wed Feb 25 19:57:08 2026 +0200 drm/intel: add reg_bits.h for the various register content helpers Add a shared header that's used by i915, xe, and i915 display. Reviewed-by: Michał Grzelak Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/e641fe6dcecef92367471f3e0d150f9f47ae4edc.1772042022.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 64c9a6bed7329bccadcc71bc74529cac70d9a29a Author: Jani Nikula Date: Wed Feb 25 19:57:07 2026 +0200 drm/xe/oa: prefer REG_MASKED_FIELD_ENABLE() and REG_MASKED_FIELD_DISABLE() Using REG_MASKED_FIELD_ENABLE() and REG_MASKED_FIELD_DISABLE() is more obvious to the reader than having the ternary expression inside REG_MASKED_FIELD(). Reviewed-by: Michał Grzelak Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/a9b0151d82b1622daa0625fc8ea2c41d233e4318.1772042022.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 31bad44c76ff25a110d0f3cb8df808f617e36a80 Author: Jani Nikula Date: Wed Feb 25 19:57:06 2026 +0200 drm/i915/perf: prefer REG_MASKED_FIELD_ENABLE() and REG_MASKED_FIELD_DISABLE() Using REG_MASKED_FIELD_ENABLE() and REG_MASKED_FIELD_DISABLE() is more obvious to the reader than having the ternary expression inside REG_MASKED_FIELD(). Reviewed-by: Michał Grzelak Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/93caec439ad10ef8b163162c52407abf36df69f5.1772042022.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit dd249a166fd16f5b2c5fc1b66461be7f7a23e651 Author: Jani Nikula Date: Wed Feb 25 19:57:05 2026 +0200 drm/{i915, xe}/reg: rename masked field helpers REG_MASKED_FIELD*() The underscore prefixed masked field helper names aren't great. Rename them REG_MASKED_FIELD(), REG_MASKED_FIELD_ENABLE(), and REG_MASKED_FIELD_DISABLE(). This is more in line with the existing REG_FIELD_PREP() etc. helpers, and using "field" instead of "bit" is more accurate for the functionality. This is done with: sed -i 's/_MASKED_FIELD/REG_MASKED_FIELD/g' $(git grep -wl _MASKED_FIELD) sed -i 's/_MASKED_BIT_ENABLE/REG_MASKED_FIELD_ENABLE/g' $(git grep -wl _MASKED_BIT_ENABLE) sed -i 's/_MASKED_BIT_DISABLE/REG_MASKED_FIELD_DISABLE/g' $(git grep -wl _MASKED_BIT_DISABLE) with some manual indentation fixes on top. Reviewed-by: Michał Grzelak Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/49dc20448a12f3e03f5f8347540d167a281b8987.1772042022.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit fa3fe9d9e190055b0dddba981b4ac7d4230677b1 Author: Jani Nikula Date: Wed Feb 25 19:57:04 2026 +0200 drm/i915/lrc: switch to _MASKED_BIT_ENABLE() and _MASKED_BIT_DISABLE() Since it's now possible to use _MASKED_BIT_ENABLE() and _MASKED_BIT_DISABLE() in the array initializer, switch to them. This allows us to remove __MASKED_FIELD() macro. Reviewed-by: Michał Grzelak Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/733568f8a6155b6e2da1dcdce9d21d6aab881449.1772042022.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit b6d558af2d6362f9fed704302071bc765f395e0d Author: Jani Nikula Date: Wed Feb 25 19:57:03 2026 +0200 drm/i915/reg: make masked field helpers constexpr Make it possible to use _MASKED_FIELD(), _MASKED_BIT_ENABLE() and _MASKED_BIT_DISABLE() in contexts that require integer constant expressions. This increases their usefulness at the small cost of making the warnings from build time checks less helpful. Reviewed-by: Michał Grzelak Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/788f538cc71dec0db25e0c768e8945bef6f9701c.1772042022.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 44d93cf1abb6a85d65c3b4b027c82d44263de6a5 Author: Karthikeyan Kathirvel Date: Wed Mar 4 14:23:42 2026 +0530 wifi: UHR: define DPS/DBE/P-EDCA elements and fix size parsing Add UHR Operation and Capability definitions and parsing helpers: - Define ieee80211_uhr_dps_info, ieee80211_uhr_dbe_info, ieee80211_uhr_p_edca_info with masks. - Update ieee80211_uhr_oper_size_ok() to account for optional DPS/DBE/P-EDCA blocks. - Move NPCA pointer position after DPS Operation Parameter if it is present in ieee80211_uhr_oper_size_ok(). - Move NPCA pointer position after DPS info if it is present in ieee80211_uhr_npca_info(). Signed-off-by: Karthikeyan Kathirvel Link: https://patch.msgid.link/20260304085343.1093993-2-karthikeyan.kathirvel@oss.qualcomm.com Signed-off-by: Johannes Berg commit f20c73b0460d15301cf1bddf0f85d060a38a75df Author: Julian Anastasov Date: Tue Mar 3 23:04:08 2026 +0200 ipvs: use more keys for connection hashing Simon Kirby reported long time ago that IPVS connection hashing based only on the client address/port (caddr, cport) as hash keys is not suitable for setups that accept traffic on multiple virtual IPs and ports. It can happen for multiple VIP:VPORT services, for single or many fwmark service(s) that match multiple virtual IPs and ports or even for passive FTP with peristence in DR/TUN mode where we expect traffic on multiple ports for the virtual IP. Fix it by adding virtual addresses and ports to the hash function. This causes the traffic from NAT real servers to clients to use second hashing for the in->out direction. As result: - the IN direction from client will use hash node hn0 where the source/dest addresses and ports used by client will be used as hash keys - the OUT direction from NAT real servers will use hash node hn1 for the traffic from real server to client - the persistence templates are hashed only with parameters based on the IN direction, so they now will also use the virtual address, port and fwmark from the service. OLD: - all methods: c_list node: proto, caddr:cport - persistence templates: c_list node: proto, caddr_net:0 - persistence engine templates: c_list node: per-PE, PE-SIP uses jhash NEW: - all methods: hn0 node (dir 0): proto, caddr:cport -> vaddr:vport - MASQ method: hn1 node (dir 1): proto, daddr:dport -> caddr:cport - persistence templates: hn0 node (dir 0): proto, caddr_net:0 -> vaddr:vport_or_0 proto, caddr_net:0 -> fwmark:0 - persistence engine templates: hn0 node (dir 0): as before Also reorder the ip_vs_conn fields, so that hash nodes are on same read-mostly cache line while write-mostly fields are on separate cache line. Reported-by: Simon Kirby Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit 2fa7cc9c70254d42a82bf82827d8d20cafe975d2 Author: Julian Anastasov Date: Tue Mar 3 23:04:07 2026 +0200 ipvs: switch to per-net connection table Use per-net resizable hash table for connections. The global table is slow to walk when using many namespaces. The table can be resized in the range of [256 - ip_vs_conn_tab_size]. Table is attached only while services are present. Resizing is done by delayed work based on load (the number of connections). Add a hash_key field into the connection to store the table ID in the highest bit and the entry's hash value in the lowest bits. The lowest part of the hash value is used as bucket ID, the remaining part is used to filter the entries in the bucket before matching the keys and as result, helps the lookup operation to access only one cache line. By knowing the table ID and bucket ID for entry, we can unlink it without calculating the hash value and doing lookup by keys. We need only to validate the saved hash_key under lock. For better security switch from jhash to siphash for the default connection hashing but the persistence engines may use their own function. Keeping the hash table loaded with entries below the size (12%) allows to avoid collision for 96+% of the conns. ip_vs_conn_fill_cport() now will rehash the connection with proper locking because unhash+hash is not safe for RCU readers. To invalidate the templates setting just dport to 0xffff is enough, no need to rehash them. As result, ip_vs_conn_unhash() is now unused and removed. Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit 840aac3d900d09ec8fb8efe41bd7d09f9eb15538 Author: Julian Anastasov Date: Tue Mar 3 23:04:06 2026 +0200 ipvs: use resizable hash table for services Make the hash table for services resizable in the bit range of 4-20. Table is attached only while services are present. Resizing is done by delayed work based on load (the number of hashed services). Table grows when load increases 2+ times (above 12.5% with lfactor=-3) and shrinks 8+ times when load decreases 16+ times (below 0.78%). Switch to jhash hashing to reduce the collisions for multiple services. Add a hash_key field into the service to store the table ID in the highest bit and the entry's hash value in the lowest bits. The lowest part of the hash value is used as bucket ID, the remaining part is used to filter the entries in the bucket before matching the keys and as result, helps the lookup operation to access only one cache line. By knowing the table ID and bucket ID for entry, we can unlink it without calculating the hash value and doing lookup by keys. We need only to validate the saved hash_key under lock. Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit b655388111cf7e43f70e49db64bdaa42bcb8a038 Author: Julian Anastasov Date: Tue Mar 3 23:04:05 2026 +0200 ipvs: add resizable hash tables Add infrastructure for resizable hash tables based on hlist_bl which we will use in followup patches. The tables allow RCU lookups during resizing, bucket modifications are protected with per-bucket bit lock and additional custom locking, the tables are resized when load reaches thresholds determined based on load factor parameter. Compared to other implementations we rely on: * fast entry removal by using node unlinking without pre-lookup * entry rehashing when hash key changes * entries can contain multiple hash nodes * custom locking depending on different contexts * adjustable load factor to customize the grow/shrink process Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit 1ac252ad036cdb18f5fb7f76bb6061adfed9cedf Author: Julian Anastasov Date: Tue Mar 3 23:04:04 2026 +0200 rculist_bl: add hlist_bl_for_each_entry_continue_rcu Change the old hlist_bl_first_rcu to hlist_bl_first_rcu_dereference to indicate that it is a RCU dereference. Add hlist_bl_next_rcu and hlist_bl_first_rcu to use RCU pointers and use them to fix sparse warnings. Add hlist_bl_for_each_entry_continue_rcu. Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit 34a6a003d4e493133c4dc81c055324646bb7ebef Author: Florian Westphal Date: Thu Feb 26 11:12:21 2026 +0100 netfilter: nfnetlink_queue: remove locking in nfqnl_get_sk_secctx We don't need the cb lock here. Also, if skb was NULL we'd have crashed already. Signed-off-by: Florian Westphal commit 013e2f91d0a4cac7396ac121ecdbc7bb71ca5cef Author: Eric Dumazet Date: Thu Feb 26 09:40:36 2026 +0000 netfilter: nfnetlink_queue: no longer acquire sk_callback_lock After commit 983512f3a87f ("net: Drop the lock in skb_may_tx_timestamp()") from Sebastian Andrzej Siewior, apply the same logic in nfqnl_put_sk_uidgid() to avoid touching sk->sk_callback_lock. Signed-off-by: Eric Dumazet Signed-off-by: Florian Westphal commit b297aaefc648be6bd6f3028f0b6161707c7bf632 Author: Eric Dumazet Date: Thu Feb 26 08:58:16 2026 +0000 netfilter: nfnetlink_log: no longer acquire sk_callback_lock After commit 983512f3a87f ("net: Drop the lock in skb_may_tx_timestamp()") from Sebastian Andrzej Siewior, apply the same logic in __build_packet_message() to avoid touching sk->sk_callback_lock. Signed-off-by: Eric Dumazet Signed-off-by: Florian Westphal commit afc2125de7414be3a31f5c09724c0375a57f5eae Author: Eric Dumazet Date: Thu Feb 26 08:29:22 2026 +0000 netfilter: nft_meta: no longer acquire sk_callback_lock in nft_meta_get_eval_skugid() After commit 983512f3a87f ("net: Drop the lock in skb_may_tx_timestamp()") from Sebastian Andrzej Siewior, apply the same logic in nft_meta_get_eval_skugid() to avoid touching sk->sk_callback_lock. Signed-off-by: Eric Dumazet Signed-off-by: Florian Westphal commit cdec942ac2006d74b2219c5f950402e5bd1f6c7b Author: Eric Dumazet Date: Wed Feb 25 13:23:19 2026 +0000 netfilter: xt_owner: no longer acquire sk_callback_lock in mt_owner() After commit 983512f3a87f ("net: Drop the lock in skb_may_tx_timestamp()") from Sebastian Andrzej Siewior, apply the same logic in mt_owner() to avoid touching sk_callback_lock. Signed-off-by: Eric Dumazet Signed-off-by: Florian Westphal commit 5663ac3e548163183c4354e75f728f7b34ffe040 Author: Eric Dumazet Date: Wed Feb 25 13:20:19 2026 +0000 netfilter: nf_log_syslog: no longer acquire sk_callback_lock in nf_log_dump_sk_uid_gid() After commit 983512f3a87f ("net: Drop the lock in skb_may_tx_timestamp()") from Sebastian Andrzej Siewior, apply the same logic in nf_log_dump_sk_uid_gid() to avoid touching sk_callback_lock. Signed-off-by: Eric Dumazet Signed-off-by: Florian Westphal commit 1c32b24c234ba88a969e6bd9c385e66212a4af15 Author: Florian Westphal Date: Sat Nov 22 19:24:49 2025 +0100 netfilter: nft_fib_ipv6: switch to fib6_lookup Existing code works but it requires a temporary dst object that is released again right away. Switch to fib6_lookup + RT6_LOOKUP_F_DST_NOREF: no need for temporary dst objects and refcount overhead anymore. Provides ~13% improvement in match performance. Signed-off-by: Florian Westphal commit 831fb31b76aea1453229dfd7cbd1946ffe1c03b5 Author: Florian Westphal Date: Tue Feb 24 21:09:31 2026 +0100 ipv6: make ipv6_anycast_destination logic usable without dst_entry nft_fib_ipv6 uses ipv6_anycast_destination(), but upcoming patch removes the dst_entry usage in favor of fib6_result. Move the 'plen > 127' logic to a new helper and call it from the existing one. Signed-off-by: Florian Westphal commit 7a135bf9903fe599aec1825ebc2c5b026fe1e38c Author: Florian Westphal Date: Mon Dec 1 19:47:13 2025 +0100 ipv6: export fib6_lookup for nft_fib_ipv6 Upcoming patch will call fib6_lookup from nft_fib_ipv6. The EXPORT_SYMBOL is added twice because there are two implementations of the function, one is a small stub for MULTIPLE_TABLES=n, only one is compiled into the kernel depending on .config settings. Alternative to EXPORT_SYMBOL is to use an indirect call via the ipv6_stub->fib6_lookup() indirection, but thats more expensive than the direct call. Also, nft_fib_ipv6 cannot be builtin if ipv6 is a module. Signed-off-by: Florian Westphal commit 08d7d4cf2570428c695d63c018d3be897caf5be7 Author: Jori Koolstra Date: Tue Mar 3 17:59:37 2026 +0100 wifi: mac80211_hwsim: change hwsim_class to a const struct The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Change hwsim_class to be a const struct class and drop the class_create() call. Suggested-by: Greg Kroah-Hartman Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20260303165938.3773998-1-jkoolstra@xs4all.nl Signed-off-by: Johannes Berg commit c64760e0bce2b89b3839eb60bf7b2e91a2ed0fff Merge: 5d048bbed1bb2b cf7cbf97c630c3 Author: Johannes Berg Date: Wed Mar 4 11:40:17 2026 +0100 Merge tag 'ath-next-20260303' of https://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.1 (PR #1) For ath12k: Add basic hwmon temperature reporting. Enable monitor mode on IPQ5332. Also a few small cleanups and bug fixes across ath drivers. ================== Signed-off-by: Johannes Berg commit f462fdf3d6a405ada5cf51241d56a47ead152968 Author: Arnd Bergmann Date: Wed Mar 4 09:38:32 2026 +0100 ntfs: reduce stack usage in ntfs_write_mft_block() The use of two large arrays in this function makes the stack frame exceed the warning limit in some configurations, especially with KASAN enabled. When CONFIG_PAGE_SIZE is set to 65536, each of the arrays contains 128 pointers, so the combined size is 2KB: fs/ntfs/mft.c: In function 'ntfs_write_mft_block.isra': fs/ntfs/mft.c:2891:1: error: the frame size of 2640 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] Use dynamic allocation of these arrays to avoid getting into dangerously high stack usage. Unfortunately, allocating memory in the writepages() code path can be problematic in case of low memory situations, so it would be better to rework the code more widely to avoid the allocation entirely. Fixes: 115380f9a2f9 ("ntfs: update mft operations") Signed-off-by: Arnd Bergmann Signed-off-by: Namjae Jeon commit bf1797960c20f3d4dc4e8b6f560ca39692abac56 Author: David Timber Date: Sat Feb 28 17:44:14 2026 +0900 exfat: add fallocate FALLOC_FL_ALLOCATE_RANGE support Currently, the Linux (ex)FAT drivers do not employ any cluster allocation strategy to keep fragmentation at bay. As a result, when multiple processes are competing for new clusters to expand files in exfat filesystem on Linux simultaneously, the files end up heavily fragmented. HDDs are most impacted, but this could also have some negative impact on various forms of flash memory depending on the type of underlying technology. For instance, modern digital cameras produce multiple media files for a single video stream. If the application does not take the fragmentation issue into account or the system is under memory pressure, the kernel end up allocating clusters in said files in a interleaved manner. Demo script: for (( i = 0; i < 4; i += 1 )); do dd if=/dev/urandom iflag=fullblock bs=1M count=64 of=frag-$i & done for (( i = 0; i < 4; i += 1 )); do wait done filefrag frag-* Result - Linux kernel native exfat, async mount: 780 extents found 740 extents found 809 extents found 712 extents found Result - Linux kernel native exfat, sync mount: 1852 extents found 1836 extents found 1846 extents found 1881 extents found Result - Windows XP: 3 extents found 3 extents found 3 extents found 2 extents found Windows kernel, on the other hand, regardless of the underlying storage interface or the medium, seems to space out clusters for each file. Similar strategy has to be employed by Linux fat filesystems for efficient utilisation of storage backend. In the meantime, userspace applications like rsync may use fallocate to combat this issue. This patch may introduce a regression-like behaviour to some niche filesystem-agnostic applications that use fallocate and proceed to non-sequentially write to the file. Examples: - libtorrent's use of posix_fallocate() and the first fragment from a peer is near the end of the file - "Download accelerators" that do partial content requests(HTTP 206) in multiple threads writing to the same file The delay incurred in such use cases is documented in WinAPI. Patches that add the ioctl equivalents to the WinAPI function SetFileValidData() and `fsutil file queryvaliddata ...` will follow. Signed-off-by: David Timber Signed-off-by: Namjae Jeon commit 3dce5bb82c97fc2ac28d80d496120a6525ce3fb7 Author: Philipp Hahn Date: Tue Mar 3 11:59:14 2026 +0100 exfat: Fix bitwise operation having different size cpos has type loff_t (long long), while s_blocksize has type u32. The inversion wil happen on u32, the coercion to s64 happens afterwards and will do 0-left-paddding, resulting in the upper bits getting masked out. Cast s_blocksize to loff_t before negating it. Found by static code analysis using Klocwork. Signed-off-by: Philipp Hahn Signed-off-by: Namjae Jeon commit 81440a740d385a992b0652fbd4a5c71edd6f27d2 Author: Philipp Hahn Date: Tue Mar 3 11:59:15 2026 +0100 exfat: Drop dead assignment of num_clusters num_clusters is not used anywhere afterwards. Remove assignment. Found by static code analysis using Klocwork. Signed-off-by: Philipp Hahn Signed-off-by: Namjae Jeon commit a54302ccfd38afba7b297566f0d414b961ca97bf Author: Qinxin Xia Date: Wed Feb 25 17:38:00 2026 +0800 tools/dma: Add dma_map_sg support Support for dma_map_sg, add option '-m' to distinguish mode. i) Users can set option '-m' to select mode: DMA_MAP_BENCH_SINGLE_MODE=0, DMA_MAP_BENCH_SG_MODE:=1 (The mode is also show in the test result). ii) Users can set option '-g' to set sg_nents (total count of entries in scatterlist) the maximum number is 1024. Each of sg buf size is PAGE_SIZE. e.g [root@localhost]# ./dma_map_benchmark -m 1 -g 8 -t 8 -s 30 -d 2 dma mapping mode: DMA_MAP_BENCH_SG_MODE dma mapping benchmark: threads:8 seconds:30 node:-1 dir:FROM_DEVICE granule/sg_nents: 8 average map latency(us):1.4 standard deviation:0.3 average unmap latency(us):1.3 standard deviation:0.3 [root@localhost]# ./dma_map_benchmark -m 0 -g 8 -t 8 -s 30 -d 2 dma mapping mode: DMA_MAP_BENCH_SINGLE_MODE dma mapping benchmark: threads:8 seconds:30 node:-1 dir:FROM_DEVICE granule/sg_nents: 8 average map latency(us):1.0 standard deviation:0.3 average unmap latency(us):1.3 standard deviation:0.5 Reviewed-by: Barry Song Signed-off-by: Qinxin Xia Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260225093800.3625054-4-xiaqinxin@huawei.com commit a8d14dd6e621f47344d0eda72f7ce9203bdef4f1 Author: Qinxin Xia Date: Wed Feb 25 17:37:59 2026 +0800 dma-mapping: benchmark: add support for dma_map_sg Support for dma scatter-gather mapping and is intended for testing mapping performance. It achieves by introducing the dma_sg_map_param structure and related functions, which enable the implementation of scatter-gather mapping preparation, mapping, and unmapping operations. Additionally, the dma_map_benchmark_ops array is updated to include operations for scatter-gather mapping. This commit aims to provide a wider range of mapping performance test to cater to different scenarios. Reviewed-by: Barry Song Signed-off-by: Qinxin Xia Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260225093800.3625054-3-xiaqinxin@huawei.com commit 9cc60ec453fe5d58d4faa70829814769a8af24d4 Author: Qinxin Xia Date: Wed Feb 25 17:37:58 2026 +0800 dma-mapping: benchmark: modify the framework to adapt to more map modes This patch adjusts the DMA map benchmark framework to make the DMA map benchmark framework more flexible and adaptable to other mapping modes in the future. By abstracting the framework into five interfaces: prepare, unprepare, initialize_data, do_map, and do_unmap. The new map schema can be introduced more easily without major modifications to the existing code structure. Reviewed-by: Barry Song Signed-off-by: Qinxin Xia Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260225093800.3625054-2-xiaqinxin@huawei.com commit 144d47f9053634a9587c4ce217c8d7672934f38d Author: Matt Coster Date: Fri Feb 27 14:12:49 2026 +0000 drm/imagination: Ensure struct pvr_device->power is initialized When pvr_power_domains_init() handles <=1 power domains, the content of struct pvr_device->power was previously left uninitialized. Fixes: e19cc5ab347e3 ("drm/imagination: Use dev_pm_domain_attach_list()") Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20260227-single-domain-power-fixes-v1-3-d37ba0825f7c@imgtec.com Signed-off-by: Matt Coster commit 218ea788a69308008c233381605a4b18cc140a5e Author: Matt Coster Date: Fri Feb 27 14:12:48 2026 +0000 drm/imagination: Detach pm domains if linking fails There's a missing call to dev_pm_domain_detach_list() in the error path of pvr_power_domains_init(); if creating the second stage of device links fails then the struct dev_pm_domain_list will be left dangling. Fixes: e19cc5ab347e3 ("drm/imagination: Use dev_pm_domain_attach_list()") Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20260227-single-domain-power-fixes-v1-2-d37ba0825f7c@imgtec.com Signed-off-by: Matt Coster commit 713ec926d8256d5989043ec95620b88a79924aa3 Author: Matt Coster Date: Fri Feb 27 14:12:47 2026 +0000 drm/imagination: Check for NULL struct dev_pm_domain_list While dev_pm_domain_detach_list() itself contains the necessary NULL check, the access to struct dev_pm_domain_list->num_pds does not and thus faults on devices with <=1 power domains (where the struct dev_pm_domain_list machinery is skipped for simplicity). This can be reproduced on AM625, which produces the following log[1]: [ 10.820056] powervr fd00000.gpu: Direct firmware load for powervr/rogue_33.15.11.3_v1.fw failed with error -2 [ 10.831903] powervr fd00000.gpu: [drm] *ERROR* failed to load firmware powervr/rogue_33.15.11.3_v1.fw (err=-2) ... [ 10.844023] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 ... [ 11.090162] Call trace: [ 11.092600] pvr_power_domains_fini+0x18/0xa0 [powervr] (P) [ 11.098218] pvr_probe+0x100/0x14c [powervr] [ 11.102505] platform_probe+0x5c/0xa4 Fixes: e19cc5ab347e3 ("drm/imagination: Use dev_pm_domain_attach_list()") Reported-by: Mark Brown Closes: https://lore.kernel.org/r/c353fdef-9ccd-4a11-a527-ab4a792d8e70@sirena.org.uk/ [1] Tested-by: Mark Brown Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20260227-single-domain-power-fixes-v1-1-d37ba0825f7c@imgtec.com Signed-off-by: Matt Coster commit f5c8f824a495e849492f09a43bd965a8f4d86cb2 Author: Jouni Högander Date: Wed Feb 25 09:42:21 2026 +0200 drm/i915/psr: Fix for Panel Replay X granularity DPCD register handling DP specification is saying value 0xff 0xff in PANEL REPLAY SELECTIVE UPDATE X GRANULARITY CAPABILITY registers (0xb2 and 0xb3) means full-line granularity. Take this into account when handling Panel Replay X granularity informed by the panel. Fixes: 1cc854647450 ("drm/i915/psr: Use SU granularity information available in intel_connector") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7284 Tested-by: Mark Pearson Signed-off-by: Jouni Högander Reviewed-by: Uma Shankar Link: https://patch.msgid.link/20260225074221.1744330-2-jouni.hogander@intel.com commit b93311673263bb98a200ab1cb6304f969bdada5c Author: Jouni Högander Date: Wed Feb 25 09:42:20 2026 +0200 drm/dp: Add definition for Panel Replay full-line granularity DP specification is saying value 0xff 0xff in PANEL REPLAY SELECTIVE UPDATE X GRANULARITY CAPABILITY registers (0xb2 and 0xb3) means full-line granularity. Add definition for this. Cc: dri-devel@lists.freedesktop.org Signed-off-by: Jouni Högander Reviewed-by: Uma Shankar Acked-by: Maarten Lankhorst Link: https://patch.msgid.link/20260225074221.1744330-1-jouni.hogander@intel.com commit e98266e823a1fa06fe6499df61aeaac2fd6f7a49 Author: Edward Adam Davis Date: Mon Feb 23 16:01:13 2026 +0800 fs/ntfs3: prevent uninitialized lcn caused by zero len syzbot reported a uninit-value in ntfs_iomap_begin [1]. Since runs was not touched yet, run_lookup_entry() immediately fails and returns false, which makes the value of "*len" 0. Simultaneously, the new value and err value are also 0, causing the logic in attr_data_get_block_locked() to jump directly to ok, ultimately resulting in *lcn being triggered before it is set [1]. In ntfs_iomap_begin(), the check for a 0 value in clen is moved forward to before updating lcn to avoid this [1]. [1] BUG: KMSAN: uninit-value in ntfs_iomap_begin+0x8c0/0x1460 fs/ntfs3/inode.c:825 ntfs_iomap_begin+0x8c0/0x1460 fs/ntfs3/inode.c:825 iomap_iter+0x9b7/0x1540 fs/iomap/iter.c:110 Local variable lcn created at: ntfs_iomap_begin+0x15d/0x1460 fs/ntfs3/inode.c:786 Fixes: 10d7c95af043 ("fs/ntfs3: add delayed-allocation (delalloc) support") Reported-by: syzbot+7be88937363ac7ab7bb0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7be88937363ac7ab7bb0 Tested-by: syzbot+7be88937363ac7ab7bb0@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Signed-off-by: Konstantin Komarov commit 48d9b57b169fb39d7362034a32706453d107ed6e Author: Konstantin Komarov Date: Mon Mar 2 14:03:05 2026 +0100 fs/ntfs3: add a subset of W=1 warnings for stricter checks Enable a subset of W=1-style compiler warnings for the ntfs3 tree so we catch small bugs early (unused symbols, missing declarations/prototypes, possible uninitialized/mis-sized uses, etc). Signed-off-by: Konstantin Komarov commit c6ce65cb17aa9321687d1b8a842487f839e1a548 Author: Wilfred Mallawa Date: Sun Mar 1 10:34:35 2026 +1000 xfs: add write pointer to xfs_rtgroup_geometry There is currently no XFS ioctl that allows userspace to retrieve the write pointer for a specific realtime group block for zoned XFS. On zoned block devices, userspace can obtain this information via zone reports from the underlying device. However, for zoned XFS operating on regular block devices, no equivalent mechanism exists. Access to the realtime group write pointer is useful to userspace development and analysis tools such as Zonar [1]. So extend the existing struct xfs_rtgroup_geometry to add a new rg_writepointer field. This field is valid if XFS_RTGROUP_GEOM_WRITEPOINTER flag is set. The rg_writepointer field specifies the location of the current writepointer as a block offset into the respective rtgroup. [1] https://lwn.net/Articles/1059364/ Signed-off-by: Wilfred Mallawa Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit b678676b7a0ab65ad5b4278505d6bcf706e53230 Author: Conor Dooley Date: Tue Mar 3 16:33:12 2026 +0000 dt-bindings: gpio: mpfs-gpio: permit resets Both CoreGPIO and the hardened versions of it on mpfs and pic64gx have a reset pin. For the former, usually this is wired to a common fabric reset not managed by software and for the latter two the platform firmware takes them out of reset on first-party boards (or those using modified versions of the vendor firmware), but not all boards may take this approach. Permit providing a reset in devicetree for Linux, or other devicetree-consuming software, to use. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260303-irate-hungry-b54cda817e42@spud Signed-off-by: Bartosz Golaszewski commit 8c6e843f1c26a0b12720cab02f785c46450b6adc Author: Rouven Czerwinski Date: Mon Jan 26 11:11:24 2026 +0100 optee: simplify OP-TEE context match Simplify the TEE implementor ID match by returning the boolean expression directly instead of going through an if/else. Signed-off-by: Rouven Czerwinski Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit d799984233a50abd2667a7d17a9a710a3f10ebe2 Author: Koichiro Den Date: Thu Feb 26 17:41:40 2026 +0900 PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup Disable the delayed work before clearing BAR mappings and doorbells to avoid running the handler after resources have been torn down. Unable to handle kernel paging request at virtual address ffff800083f46004 [...] Internal error: Oops: 0000000096000007 [#1] SMP [...] Call trace: epf_ntb_cmd_handler+0x54/0x200 [pci_epf_vntb] (P) process_one_work+0x154/0x3b0 worker_thread+0x2c8/0x400 kthread+0x148/0x210 ret_from_fork+0x10/0x20 Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260226084142.2226875-4-den@valinux.co.jp commit 3446beddba450c8d6f9aca2f028712ac527fead3 Author: Koichiro Den Date: Thu Feb 26 17:41:39 2026 +0900 PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown epf_ntb_epc_destroy() duplicates the teardown that the caller is supposed to do later. This leads to an oops when .allow_link fails or when .drop_link is performed. Remove the helper. Also drop pci_epc_put(). EPC device refcounting is tied to configfs EPC group lifetime, and pci_epc_put() in the .drop_link path is sufficient. Fixes: 8b821cf76150 ("PCI: endpoint: Add EP function driver to provide NTB functionality") Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260226084142.2226875-3-den@valinux.co.jp commit 0da63230d3ec1ec5fcc443a2314233e95bfece54 Author: Koichiro Den Date: Thu Feb 26 17:41:38 2026 +0900 PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown epf_ntb_epc_destroy() duplicates the teardown that the caller is supposed to perform later. This leads to an oops when .allow_link fails or when .drop_link is performed. The following is an example oops of the former case: Unable to handle kernel paging request at virtual address dead000000000108 [...] [dead000000000108] address between user and kernel address ranges Internal error: Oops: 0000000096000044 [#1] SMP [...] Call trace: pci_epc_remove_epf+0x78/0xe0 (P) pci_primary_epc_epf_link+0x88/0xa8 configfs_symlink+0x1f4/0x5a0 vfs_symlink+0x134/0x1d8 do_symlinkat+0x88/0x138 __arm64_sys_symlinkat+0x74/0xe0 [...] Remove the helper, and drop pci_epc_put(). EPC device refcounting is tied to the configfs EPC group lifetime, and pci_epc_put() in the .drop_link path is sufficient. Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260226084142.2226875-2-den@valinux.co.jp commit 6910944bf0b92fea63d5a7aeed69e4b9c14fd01b Author: Ian Rogers Date: Mon Mar 2 15:58:21 2026 -0800 perf test type profiling: Remote typedef on struct The typedef creates an issue where the struct or the typedef may appear in the output and cause the "perf data type profiling tests" to fail. Let's remove the typedef to keep the test passing. Fixes: 335047109d7d ("perf tests: Test annotate with data type profiling and C") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 4ad96a7c9e2cebbbdc68369438a736a133539f1d Author: Kibaek Yoo Date: Sat Feb 28 16:16:13 2026 +0900 selftests: net: add macvlan multicast test for shared source MAC Add a selftest that verifies multicast delivery to a macvlan bridge port when the source MAC of the incoming frame matches the macvlan's own MAC address. This scenario occurs with protocols like VRRP where multiple hosts share the same virtual MAC address. Without the corresponding kernel change, macvlan bridge mode does not handle this case and the multicast frame is not delivered. Signed-off-by: Kibaek Yoo Link: https://patch.msgid.link/20260228071613.4360-2-psykibaek@gmail.com Signed-off-by: Jakub Kicinski commit b52363f706e53101d9f8c5ba5e3854d6be8f122c Author: Kibaek Yoo Date: Sat Feb 28 16:16:12 2026 +0900 net: macvlan: support multicast rx for bridge ports with shared source MAC Macvlan bridge mode currently does not handle the case where an external source shares its MAC address with a local macvlan interface. When such a frame arrives, macvlan_hash_lookup() matches the source MAC to the local macvlan, and macvlan_multicast_rx() assumes bridge ports already received the frame during local transmission. Since the frame actually originated externally, bridge ports never saw it. This situation arises with protocols like VRRP, where multiple hosts use the same virtual MAC address. Support this by passing NULL as the source device and including MACVLAN_MODE_BRIDGE in the mode mask for the else branch of macvlan_multicast_rx(). This ensures all VEPA and bridge mode macvlan interfaces receive incoming multicast regardless of source MAC matching. The trade-off is that looped-back locally-originated multicasts may be delivered to bridge ports a second time, but multicast consumers already handle duplicate frames. Signed-off-by: Kibaek Yoo Link: https://patch.msgid.link/20260228071613.4360-1-psykibaek@gmail.com Signed-off-by: Jakub Kicinski commit d6ca199568c53ece99aeeae1022d04f2fd8cde7f Author: Zeeshan Ahmad Date: Mon Mar 2 11:43:17 2026 +0500 net: core: failover: enforce mandatory ops and clean up redundant checks The failover framework requires 'ops' to be functional. Currently, failover_register() allows an instance to be registered with NULL ops, which leads to inconsistent NULL checks and potential NULL pointer dereferences in the slave registration paths. Harden the entry point by requiring non-NULL ops in failover_register(). This ensures the 'fops' pointer is guaranteed to be valid for any successfully registered failover instance. Consequently, remove the now redundant NULL checks for 'fops' throughout the module to simplify the logic. Signed-off-by: Zeeshan Ahmad Link: https://patch.msgid.link/20260302064317.9964-1-zeeshanahmad022019@gmail.com Signed-off-by: Jakub Kicinski commit dfa77c0dd4ab267d3f1160617c95eab80181a76f Author: Breno Leitao Date: Mon Mar 2 06:40:39 2026 -0800 selftests: netconsole: print diagnostic on busywait timeout in netcons_basic The script uses set -euo pipefail, so when busywait times out waiting for the netconsole message to arrive, it returns 1 and the script exits immediately without printing any error message. As reported by Jakub, this makes failures hard to diagnose since the test reports exit=1 with no explanation. Handle the busywait failure explicitly so that a FAIL message is printed before exiting. This is how it looks like now: Running with target mode: basic (ipv6) [ 167.452561] netconsole selftest: netcons_QdMay FAIL: Timed out waiting (20000 ms) for netconsole message in /tmp/netcons_QdMay The remaining silent failures under set -e can only happen during the setup phase (netdevsim creation, interface configuration, configfs writes). So, it is not expected to have any silent failure once the test starts. Note that this issue might be less frequent now, since commit a68a9bd086c28 ("selftests: netconsole: Increase port listening timeout") increased the timeout that _might_ have been the root cause of these random failures in NIPA. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260302-netconsole_test_verbose-v1-1-b1be5d30cd7d@debian.org Signed-off-by: Jakub Kicinski commit 1085c258d88493f920789e1215b31f32031942ac Merge: acd338ba2f3a33 6f82cb4ecdb4f2 Author: Jakub Kicinski Date: Tue Mar 3 17:22:17 2026 -0800 Merge branch 'grab-ipa-imem-slice-through-dt' Konrad Dybcio says: ==================== Grab IPA IMEM slice through DT This adds the necessary driver change to migrate over from hardcoded-per-IPA-version-but-varying-per-implementation numbers, while unfortunately keeping them in there for backwards compatibility. The DT changes will be submitted in a separate series, this one is OK to merge independently. ==================== Link: https://patch.msgid.link/20260302-topic-ipa_imem-v6-0-c0ebbf3eae9f@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 6f82cb4ecdb4f23b81d7f71e31d17a55857c8d74 Author: Konrad Dybcio Date: Mon Mar 2 16:58:45 2026 +0100 net: ipa: Grab IMEM slice base/size from DTS This is a detail that differ per chip, and not per IPA version (and there are cases of the same IPA versions being implemented across very very very different SoCs). This region isn't actually used by the driver, but we most definitely want to iommu-map it, so that IPA can poke at the data within. Reviewed-by: Alex Elder Acked-by: Dmitry Baryshkov Reviewed-by: Simon Horman Signed-off-by: Konrad Dybcio Link: https://patch.msgid.link/20260302-topic-ipa_imem-v6-3-c0ebbf3eae9f@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit f5a598abfdd9dc73a9537b9628d4f26a3069c707 Author: Konrad Dybcio Date: Mon Mar 2 16:58:44 2026 +0100 dt-bindings: net: qcom,ipa: Add sram property for describing IMEM slice The IPA driver currently grabs a slice of IMEM through hardcoded addresses. Not only is that ugly and against the principles of DT, but it also creates a situation where two distinct platforms implementing the same version of IPA would need to be hardcoded together and matched at runtime. Instead, do the sane thing and accept a handle to said region directly. Don't make it required on purpose, as it's not there on ancient implementations (currently unsupported) and we're not yet done with filling the data across al DTs. Reviewed-by: Alex Elder Reviewed-by: Krzysztof Kozlowski Signed-off-by: Konrad Dybcio Link: https://patch.msgid.link/20260302-topic-ipa_imem-v6-2-c0ebbf3eae9f@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit ca4c7771a059fb2665fecc7d5954672d09475089 Author: Konrad Dybcio Date: Mon Mar 2 16:58:43 2026 +0100 dt-bindings: sram: qcom,imem: Allow modem-tables subnode The IP Accelerator hardware/firmware owns a sizeable region within the IMEM, named 'modem-tables', containing various packet processing configuration data. It's not actually accessed by the OS, although we have to IOMMU-map it with the IPA device, so that presumably the firmware can act upon it. Allow it as a subnode of IMEM. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Alex Elder Signed-off-by: Konrad Dybcio Link: https://patch.msgid.link/20260302-topic-ipa_imem-v6-1-c0ebbf3eae9f@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit acd338ba2f3a33d68aa05f406407fbdf6adccfee Author: Sean Chang Date: Mon Mar 2 22:29:31 2026 +0800 net: macb: use ethtool_sprintf to fill ethtool stats strings The RISC-V toolchain triggers a stringop-truncation warning when using snprintf() with a fixed ETH_GSTRING_LEN (32 bytes) buffer. Convert the driver to use the modern ethtool_sprintf() API from linux/ethtool.h. This removes the need for manual snprintf() and memcpy() calls, handles the 32-byte padding automatically, and simplifies the logic by removing manual pointer arithmetic. Suggested-by: Andrew Lunn Reviewed-by: Andrew Lunn Reviewed-by: Andy Shevchenko Signed-off-by: Sean Chang Link: https://patch.msgid.link/20260302142931.49108-1-seanwascoding@gmail.com Signed-off-by: Jakub Kicinski commit 39feb171f361f887dad8504dc5822b852871ac21 Author: Kohei Enju Date: Fri Feb 20 11:09:17 2026 +0000 net: core: allow netdev_upper_get_next_dev_rcu from bh context Since XDP programs are called from a NAPI poll context, the RCU reference liveness is ensured by local_bh_disable(). Commit aeea1b86f936 ("bpf, devmap: Exclude XDP broadcast to master device") started to call netdev_upper_get_next_dev_rcu() from this context, but missed adding rcu_read_lock_bh_held() as a condition to the RCU checks. While both bh_disabled and rcu_read_lock() provide RCU protection, lockdep complains since the check condition is insufficient [1]. Add rcu_read_lock_bh_held() as condition to help lockdep to understand the dereference is safe, in the same way as commit 694cea395fde ("bpf: Allow RCU-protected lookups to happen from bh context"). [1] WARNING: net/core/dev.c:8099 at netdev_upper_get_next_dev_rcu+0x96/0xd0, CPU#0: swapper/0/0 ... RIP: 0010:netdev_upper_get_next_dev_rcu+0x96/0xd0 ... dev_map_enqueue_multi+0x411/0x970 xdp_do_redirect+0xdf2/0x1030 __igc_xdp_run_prog+0x6a0/0xc80 igc_poll+0x34b0/0x70b0 __napi_poll.constprop.0+0x98/0x490 net_rx_action+0x8f2/0xfa0 handle_softirqs+0x1c7/0x710 __irq_exit_rcu+0xb1/0xf0 irq_exit_rcu+0x9/0x20 common_interrupt+0x7f/0x90 Signed-off-by: Kohei Enju Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20260220110922.94781-1-kohei@enjuk.jp Signed-off-by: Jakub Kicinski commit 8ce185c7e00dbddfdea026acd5dcf7b122af3db0 Author: Tomasz Unger Date: Mon Mar 2 11:09:08 2026 +0100 NFC: s3fwrn5: Replace strcpy() with strscpy() Replace strcpy() with strscpy() which limits the copy to the size of the destination buffer. Since fw_info->fw_name is an array with a fixed, declared size, the two-argument variant of strscpy() is used - the compiler deduces the buffer size automatically. This is a defensive cleanup replacing the deprecated strcpy() with the preferred strscpy(). Signed-off-by: Tomasz Unger Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260302100908.26399-1-tomasz.unger@yahoo.pl Signed-off-by: Jakub Kicinski commit c49a9eb650d5b6c9a19901e9055ad4e0a0d2386e Author: Tomasz Unger Date: Sun Mar 1 15:43:45 2026 +0100 NFC: nfcmrvl: Replace strcpy() with strscpy() Replace strcpy() with strscpy() which limits the copy to the size of the destination buffer. Since fw_dnld->name is an array, the two-argument variant of strscpy() is used - the compiler deduces the buffer size automatically. This is a defensive cleanup replacing the deprecated strcpy() with the preferred strscpy(). Signed-off-by: Tomasz Unger Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260301144345.218628-1-tomasz.unger@yahoo.pl Signed-off-by: Jakub Kicinski commit 66e807f96f4e895283ac27ebd0e2513d7c8da557 Author: Tomasz Unger Date: Sun Mar 1 14:56:33 2026 +0100 NFC: nxp-nci: Replace strcpy() with strscpy() Replace strcpy() with strscpy() which limits the copy to the size of the destination buffer. Since fw_info->name is an array, the two-argument variant of strscpy() is used - the compiler deduces the buffer size automatically. This is a defensive cleanup replacing the deprecated strcpy() with the preferred strscpy(). Signed-off-by: Tomasz Unger Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260301135633.214497-1-tomasz.unger@yahoo.pl Signed-off-by: Jakub Kicinski commit e63f5918adb8efa7d9609585318db773ac7cd241 Author: Tomasz Unger Date: Sun Mar 1 13:12:54 2026 +0100 NFC: pn544: i2c: Replace strcpy() with strscpy() Replace strcpy() with strscpy() which limits the copy to the size of the destination buffer. Since phy->firmware_name is an array, the two-argument variant of strscpy() is used - the compiler deduces the buffer size automatically. This is a defensive cleanup. As pointed out by Jakub Kicinski , firmware_name is already bounded to NFC_FIRMWARE_NAME_MAXSIZE via nla_strscpy() in net/nfc/netlink.c before reaching this driver, so no actual buffer overflow is possible. Signed-off-by: Tomasz Unger Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260301121254.174354-1-tomasz.unger@yahoo.pl Signed-off-by: Jakub Kicinski commit 895306e3c881ae8a3227a31bf4e64865ad6a534f Author: Ian Rogers Date: Tue Mar 3 10:52:16 2026 -0800 perf pmu: Replace starts_with with strstarts linux/string.h provides strstarts that matches the starts_with function. For style and consistency reasons remove the starts_with functions and use strstarts. Signed-off-by: Ian Rogers Reviewed-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 3256e41f02623edc4b90a77b70191f83dcdea6cc Author: Xiaoyao Li Date: Tue Mar 3 11:03:35 2026 +0800 KVM/TDX: Rename KVM_SUPPORTED_TD_ATTRS to KVM_SUPPORTED_TDX_TD_ATTRS Rename KVM_SUPPORTED_TD_ATTRS to KVM_SUPPORTED_TDX_TD_ATTRS to include "TDX" in the name, making it clear that it pertains to TDX. Suggested-by: Sean Christopherson Signed-off-by: Xiaoyao Li Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: Kiryl Shutsemau Acked-by: Sean Christopherson Link: https://patch.msgid.link/20260303030335.766779-5-xiaoyao.li@intel.com commit 28bcd8d83fca2c16b2d596b0dce5c4dbca4f9b50 Author: Xiaoyao Li Date: Tue Mar 3 11:03:34 2026 +0800 x86/tdx: Rename TDX_ATTR_* to TDX_TD_ATTR_* The macros TDX_ATTR_* and DEF_TDX_ATTR_* are related to TD attributes, which are TD-scope attributes. Naming them as TDX_ATTR_* can be somewhat confusing and might mislead people into thinking they are TDX global things. Rename TDX_ATTR_* to TDX_TD_ATTR_* to explicitly clarify they are TD-scope things. Suggested-by: Rick Edgecombe Signed-off-by: Xiaoyao Li Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Kiryl Shutsemau Acked-by: Sean Christopherson Link: https://patch.msgid.link/20260303030335.766779-4-xiaoyao.li@intel.com commit 87686987193e8465a7ecbd7a3012efe20f1f293d Author: Xiaoyao Li Date: Tue Mar 3 11:03:33 2026 +0800 KVM/TDX: Remove redundant definitions of TDX_TD_ATTR_* There are definitions of TD attributes bits inside asm/shared/tdx.h as TDX_ATTR_*. Remove KVM's definitions and use the ones in asm/shared/tdx.h Signed-off-by: Xiaoyao Li Signed-off-by: Dave Hansen Reviewed-by: Kirill A. Shutemov Reviewed-by: Kai Huang Reviewed-by: Rick Edgecombe Acked-by: Sean Christopherson Link: https://patch.msgid.link/20260303030335.766779-3-xiaoyao.li@intel.com commit 3aecb2e7b948400354399b26f3f1653bd2c1bae0 Author: Xiaoyao Li Date: Tue Mar 3 11:03:32 2026 +0800 x86/tdx: Fix the typo in TDX_ATTR_MIGRTABLE The TD scoped TDCS attributes are defined by bit positions. In the guest side of the TDX code, the 'tdx_attributes' string array holds pretty print names for these attributes, which are generated via macros and defines. Today these pretty print names are only used to print the attribute names to dmesg. Unfortunately there is a typo in the define for the migratable bit. Change the defines TDX_ATTR_MIGRTABLE* to TDX_ATTR_MIGRATABLE*. Update the sole user, the tdx_attributes array, to use the fixed name. Since these defines control the string printed to dmesg, the change is user visible. But the risk of breakage is almost zero since it is not exposed in any interface expected to be consumed programmatically. Fixes: 564ea84c8c14 ("x86/tdx: Dump attributes and TD_CTLS on boot") Signed-off-by: Xiaoyao Li Signed-off-by: Dave Hansen Reviewed-by: Kirill A. Shutemov Reviewed-by: Kai Huang Acked-by: Sean Christopherson Link: https://patch.msgid.link/20260303030335.766779-2-xiaoyao.li@intel.com commit 48f7a50c027dd2abb9e7b8a6ecc8e531d87f2c21 Author: Thomas Weißschuh Date: Tue Feb 17 14:11:11 2026 +0100 stop_machine: Fix the documentation for a NULL cpus argument A recent refactoring of the kernel-docs for stop machine changed the description of the cpus parameter from "NULL = any online cpu" to "NULL = run on each online CPU". However the callback is only executed on a single CPU, not all of them. The old wording was a bit ambiguous and could have been read both ways. Reword the documentation to be correct again and hopefully also clearer. Fixes: fc6f89dc7078 ("stop_machine: Improve kernel-doc function-header comments") Signed-off-by: Thomas Weißschuh Signed-off-by: Paul E. McKenney Reviewed-by: Sebastian Andrzej Siewior commit c2bfe2edf741b6ae03acda7ab795974cf53d342c Author: Andrew Davis Date: Tue Mar 3 11:59:59 2026 -0600 power: reset: keystone: Use register_sys_off_handler(SYS_OFF_MODE_RESTART) Function register_restart_handler() is deprecated. Using this new API removes our need to keep and manage a struct notifier_block. Signed-off-by: Andrew Davis Link: https://patch.msgid.link/20260303175959.75647-1-afd@ti.com Signed-off-by: Sebastian Reichel commit e6d91eed847778dbc9a6a595d5fb3015ab305483 Author: Krzysztof Kozlowski Date: Fri Feb 20 18:49:42 2026 +0100 power: supply: twl4030_madc: Drop unused header includes Driver does not use any code from workqueue.h and param.h. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260220174938.672883-8-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit 4f73a52df7d282784f4f040efc9e124b477ca504 Author: Krzysztof Kozlowski Date: Fri Feb 20 18:49:41 2026 +0100 power: supply: bq24190: Avoid rescheduling after cancelling work Driver initializes delayed work and then registers interrupt handler with devm interface. This means that device removal will not use a reversed order, but first cancel pending work items and then, via devm release handlers, free the interrupt. The interrupt handler does not directly use/schedule work items on the workqueue, however it updates the status of the battery charger which might lead to calling power_supply_changed() and trigger chain of calls leading to scheduling the work items. If this happens during short time window after cancel_delayed_work_sync() in remove() callback, the work would be rescheduled. Avoid this by using devm interface to initialize and cancel work item, thus having exactly reverse order during remove() in respect to rest of the probe/cleanup paths. This is also more logical and readable code. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260220174938.672883-7-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit 727fe2e90ec6365771b3cd49dc0e263bc602d7c1 Author: Krzysztof Kozlowski Date: Fri Feb 20 18:49:40 2026 +0100 power: supply: axp288_charger: Simplify returns of dev_err_probe() One of benefits of dev_err_probe() is that it returns the error value greatly simplifying the error paths (e.g. three lines -> one line). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Hans de Goede Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260220174938.672883-6-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit 658342fd75b582cbb06544d513171c3d645faead Author: Krzysztof Kozlowski Date: Fri Feb 20 18:49:39 2026 +0100 power: supply: axp288_charger: Do not cancel work before initializing it Driver registered devm handler to cancel_work_sync() before even the work was initialized, thus leading to possible warning from kernel/workqueue.c on (!work->func) check, if the error path was hit before the initialization happened. Use devm_work_autocancel() on each work item independently, which handles the initialization and handler to cancel work. Fixes: 165c2357744e ("power: supply: axp288_charger: Properly stop work on probe-error / remove") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Reviewed-by: Hans de Goede Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260220174938.672883-5-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit f0c8407c83a596dcb5aeaa940b1f8ed43631ae46 Author: Svyatoslav Ryhel Date: Fri Jan 30 15:40:21 2026 +0200 power: supply: cpcap-battery: pass static battery cell data from device tree Add an option to populate battery cell properties from the device tree if the driver cannot access the battery's NVMEM. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Tony Lindgren Link: https://patch.msgid.link/20260130134021.353688-3-clamor95@gmail.com Signed-off-by: Sebastian Reichel commit 95a1fa0b0034d11a05b6b858bd6418e2b1ccab0a Author: Svyatoslav Ryhel Date: Fri Jan 30 15:40:20 2026 +0200 dt-bindings: power: supply: cpcap-battery: document monitored-battery property Document monitored-battery used to describe static battery cell properties. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260130134021.353688-2-clamor95@gmail.com Signed-off-by: Sebastian Reichel commit 16a7c32e586ed9c7e1bbaac7c441afcf474a67bb Author: Anjelique Melendez Date: Mon Feb 9 12:49:15 2026 -0800 power: supply: qcom_battmgr: Add support for Glymur and Kaanapali Glymur is a compute platform which has the same power supply properties as X1E80100 and Kaanapali is a mobile platform which has the same power supply properties as SM8550. Add support for the Glymur and Kaanapali compatible strings. Signed-off-by: Anjelique Melendez Reviewed-by: Bjorn Andersson Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260209204915.1983997-6-anjelique.melendez@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit 0ebf821cf6c75de2d95d3db277617ec685498e7c Author: Hector Martin Date: Tue Feb 17 21:47:25 2026 +1100 power: supply: Add macsmc-power driver for Apple Silicon This driver provides battery and AC status monitoring for Apple Silicon Macs via the SMC (System Management Controller). It supports reporting capacity, voltage, current, and charging status, and modifying the charging behaviour across multiple generations of SMC firmware. Signed-off-by: Hector Martin Co-developed-by: Joey Gouly Signed-off-by: Joey Gouly Co-developed-by: Janne Grunau Signed-off-by: Janne Grunau Reviewed-by: Neal Gompa Reviewed-by: Sven Peter Co-developed-by: Michael Reeves Signed-off-by: Michael Reeves Link: https://patch.msgid.link/20260217-b4-macsmc-power-v7-1-4a4d63664362@gmail.com Signed-off-by: Sebastian Reichel commit 5c2ffc0b215a884dbc961d4737f636067348b8bd Author: Dmitry Torokhov Date: Wed Feb 18 12:59:49 2026 -0800 power: supply: sbs-manager: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by sbsm_gpio_get_value() is normalized to the [0, 1] range. Signed-off-by: Dmitry Torokhov Reviewed-by: Linus Walleij Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/aZYoL2MnTYU5FuQh@google.com Signed-off-by: Sebastian Reichel commit 68e6343fbf54ef7dd6f3f94e93afa42a9fe0eaf7 Author: Jaime Saguillo Revilla Date: Thu Feb 19 21:23:53 2026 +0000 power: supply: cpcap-battery: fix typo in config name Rename cpcap_battery_unkown_data to cpcap_battery_unknown_data to correct a spelling mistake in the identifier. No functional change. Signed-off-by: Jaime Saguillo Revilla Link: https://patch.msgid.link/20260219212353.49416-1-jaime.saguillo@gmail.com Signed-off-by: Sebastian Reichel commit cfaf0a90789ac74391ac7583c86cdaaada78cdbb Author: Shivendra Pratap Date: Tue Feb 24 12:12:27 2026 +0530 power: reset: reboot-mode: Expose sysfs for registered reboot_modes Currently, there is no standardized mechanism for userspace to discover supported reboot modes on a platform. This limits userspace scripts, to rely on hardcoded assumptions about the available reboot-modes. Create a class 'reboot-mode' and a device under it. Use the name of the registering driver as device name. Expose a sysfs interface under this device to show available reboot mode arguments. This results in the creation of: /sys/class/reboot-mode//reboot_modes This read-only sysfs file will exposes the supported reboot mode arguments provided by the registering driver, enabling userspace to query the list of arguments. Reviewed-by: Bartosz Golaszewski Signed-off-by: Shivendra Pratap Link: https://patch.msgid.link/20260224-next-15nov_expose_sysfs-v24-2-4ee5b49d5a06@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit d3da03025e6de538ca5af346c43526a2d5494582 Author: Shivendra Pratap Date: Tue Feb 24 12:12:26 2026 +0530 Documentation: ABI: Add sysfs-class-reboot-mode-reboot_modes Add ABI documentation for /sys/class/reboot-mode/*/reboot_modes, a read-only sysfs attribute exposing the list of supported reboot-mode arguments. This file is created by reboot-mode framework and provides a user-readable interface to query available reboot-mode arguments. Reviewed-by: Bartosz Golaszewski Reviewed-by: Sebastian Reichel Signed-off-by: Shivendra Pratap Link: https://patch.msgid.link/20260224-next-15nov_expose_sysfs-v24-1-4ee5b49d5a06@oss.qualcomm.com Signed-off-by: Sebastian Reichel commit c10b68e331c51aed8a615af701946dd85b2aca1c Author: André Draszik Date: Mon Mar 2 13:32:10 2026 +0000 power: supply: max17042: report time to full (max17055 & max77759) Report the remaining time to full as calculated by the firmware for devices that implement this. Similar to time to empty, the reported value is only meaningful when charging, i.e. if it is != U16_MAX. Reviewed-by: Peter Griffin Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-v3-11-3c5f01dbda23@linaro.org Signed-off-by: Sebastian Reichel commit 83a86e27c34d06ec2dc117fb293e80f78402df49 Author: André Draszik Date: Mon Mar 2 13:32:09 2026 +0000 power: supply: max17042: consider task period (max77759) Several (register) values reported by the fuel gauge depend on its internal task period and it needs to be taken into account when calculating results. All relevant example formulas in the data sheet assume the default task period (of 5760) and final results need to be adjusted based on the task period in effect. Update the code as and where necessary. Reviewed-by: Peter Griffin Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-v3-10-3c5f01dbda23@linaro.org Signed-off-by: Sebastian Reichel commit 2864fb6aa947703d290b52b1b030b0b74d0a6128 Author: André Draszik Date: Mon Mar 2 13:32:08 2026 +0000 power: supply: max17042: initial support for Maxim MAX77759 The Maxim MAX77759 is a companion PMIC intended for use in mobile phones and tablets. It is used on Google Pixel 6 and 6 Pro (oriole and raven). Amongst others, it contains a fuel gauge that is similar to the ones supported by this driver. The fuel gauge can measure battery charge and discharge current, battery voltage, battery temperature, and the Type C connector's temperature. The MAX77759 incorporates the Maxim ModelGauge m5 algorithm. It, as well as previous generations like m3 on max17047/max17050, requires the host to save/restore some register values across power cycles to maintain full accuracy. Extending the driver for such support is out of scope in this initial commit. Reviewed-by: Peter Griffin Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-v3-9-3c5f01dbda23@linaro.org Signed-off-by: Sebastian Reichel commit 2288d5eaca2249b1b8a80af063808cfc42e2a834 Author: André Draszik Date: Mon Mar 2 13:32:07 2026 +0000 power: supply: max17042: support standard shunt-resistor-micro-ohms DT property shunt-resistor-micro-ohms is a standard property used to describe the value of a shunt resistor required when measuring currents. Standard properties should be used instead of vendor-specific ones of similar intention when possible. Try to read it from DT, and fall back to the vendor-specific property maxim,rsns-microohm if unsuccessful for compatibility with existing DTs. Reviewed-by: Peter Griffin Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-v3-8-3c5f01dbda23@linaro.org Signed-off-by: Sebastian Reichel commit 0c5a6dc85d739c41f5240fd149f42f26f0665aab Author: André Draszik Date: Mon Mar 2 13:32:06 2026 +0000 power: supply: max17042: time to empty is meaningless when charging When charging, the fuel gauge reports U16_MAX as time to empty. Ignoring this special case (as this driver currently does), causes the remaining time to be reported as ~102hours, which is incorrect. Update the code to not return anything in this case. Reviewed-by: Peter Griffin Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-v3-7-3c5f01dbda23@linaro.org Signed-off-by: Sebastian Reichel commit 9a44949da669708f19d29141e65b3ac774d08f5a Author: André Draszik Date: Mon Mar 2 13:32:05 2026 +0000 power: supply: max17042: avoid overflow when determining health If vmax has the default value of INT_MAX (e.g. because not specified in DT), battery health is reported as over-voltage. This is because adding any value to vmax (the vmax tolerance in this case) causes it to wrap around, making it negative and smaller than the measured battery voltage. Avoid that by using size_add(). Fixes: edd4ab055931 ("power: max17042_battery: add HEALTH and TEMP_* properties support") Cc: stable@vger.kernel.org Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-v3-6-3c5f01dbda23@linaro.org Signed-off-by: Sebastian Reichel commit 699f0f71ac98cf79fecdcab0a604b25f11c580b6 Author: André Draszik Date: Mon Mar 2 13:32:04 2026 +0000 power: supply: max17042: use dev_err_probe() where appropriate dev_err_probe() exists to simplify code, harmonise error messages, and set the deferred probe reason if relevant - there's no reason not to use it here. While at it, return the actual error from devm_regmap_init_i2c() rather than overwriting with -EINVAL, when relevant. Reviewed-by: Peter Griffin Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-v3-5-3c5f01dbda23@linaro.org Signed-off-by: Sebastian Reichel commit e370b67c2ceb3e3c4577da0a882b1ede87ef485e Author: André Draszik Date: Mon Mar 2 13:32:03 2026 +0000 power: supply: max17042: fix a comment typo (then -> than) Fix this trivial typo where than should be used instead of then. Reviewed-by: Peter Griffin Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-v3-4-3c5f01dbda23@linaro.org Signed-off-by: Sebastian Reichel commit a060c6fe82d6ee41cb592fc4760e814b64a92f81 Author: André Draszik Date: Mon Mar 2 13:32:02 2026 +0000 dt-bindings: power: supply: max17042: drop formatting specifier | | denotes a literal (preformatted) block and is not necessary here. Drop them from this file. Acked-by: Conor Dooley Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-v3-3-3c5f01dbda23@linaro.org Signed-off-by: Sebastian Reichel commit f76deab4e9035bb054b38f067c374ca7ee1e1faf Author: André Draszik Date: Mon Mar 2 13:32:01 2026 +0000 dt-bindings: power: supply: max17042: support shunt-resistor-micro-ohms This binding supports the vendor-specific property maxim,rsns-microohm to describe the value of a shunt resistor required when measuring currents. shunt-resistor-micro-ohms is a standard property with the same meaning. Standard properties should be used instead of vendor- specific ones of similar intention when possible. Allow this standard property here, while also deprecating the existing vendor-specific property maxim,rsns-microohm. Reviewed-by: Peter Griffin Acked-by: Conor Dooley Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-v3-2-3c5f01dbda23@linaro.org Signed-off-by: Sebastian Reichel commit 4a53e15414c3ed9c73f9a725c774d68749d1f437 Author: André Draszik Date: Mon Mar 2 13:32:00 2026 +0000 dt-bindings: power: supply: max17042: add support for max77759 The Maxim MAX77759 is a companion PMIC intended for use in mobile phones and tablets. It is used on Google Pixel 6 and 6 Pro (oriole and raven). Amongst others, it contains a fuel gauge that is similar to the ones supported by this binding. The fuel gauge can measure battery charge and discharge current, battery voltage, battery temperature, and the Type C connector's temperature. Reviewed-by: Peter Griffin Acked-by: Conor Dooley Signed-off-by: André Draszik Link: https://patch.msgid.link/20260302-max77759-fg-v3-1-3c5f01dbda23@linaro.org Signed-off-by: Sebastian Reichel commit 1ff6d25d691d1b10c977b61219206c3400a81606 Author: Antoniu Miclaus Date: Mon Feb 2 14:07:12 2026 +0200 iio: light: ltr501: return proper error code from ltr501_get_gain_index() Return -EINVAL instead of -1 when no matching gain value is found in the gain table. Update the callers to propagate this error directly rather than overwriting it with -EINVAL. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Reviewed-by: Waqar Hameed Signed-off-by: Jonathan Cameron commit 18a1ae3e7350e1798ea9f492959d5000ae5d9bc4 Author: Svyatoslav Ryhel Date: Fri Feb 6 19:28:39 2026 +0200 iio: adc: cpcap-adc: add support for Mot ADC Add support for ADC found in Motorola Mot board, used as a base for Atrix 4G and Droid X2 smartphones. Signed-off-by: Svyatoslav Ryhel Signed-off-by: Jonathan Cameron commit dd31b649ef002302331cbff137d8045885e49a11 Author: Svyatoslav Ryhel Date: Fri Feb 6 19:28:38 2026 +0200 dt-bindings: iio: adc: cpcap-adc: document Mot ADC Add compatible for ADC used in Mot board. Separate compatible is required since ADC in the Mot board uses a unique set of configurations. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Signed-off-by: Jonathan Cameron commit 2ac8cd2bab30509cfada82546eee96f0aca38c20 Author: Antoniu Miclaus Date: Mon Feb 2 13:26:03 2026 +0200 iio: light: gp2ap020a00f: remove unused debug_reg_addr Remove unused debug_reg_addr field from gp2ap020a00f_data struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 9c21a850f0c7a4bb9a50487b918a858014835b65 Author: Antoniu Miclaus Date: Mon Feb 2 13:26:02 2026 +0200 iio: light: apds9306: remove unused nlux_per_count Remove unused nlux_per_count field from apds9306_data struct. The field is declared but never accessed in the driver. Acked-by: Subhajit Ghosh Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit c1f9dea72c9e0ee764a8d823696da32abcb00900 Author: Antoniu Miclaus Date: Mon Feb 2 13:26:01 2026 +0200 iio: imu: bmi323: remove unused drdy_trigger_enabled Remove unused drdy_trigger_enabled field from bmi323_data struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 5c9ba5d863add3423e7b7ccdf44c7fd646171dd1 Author: Antoniu Miclaus Date: Mon Feb 2 13:26:00 2026 +0200 iio: humidity: hdc2010: remove unused interrupt_config Remove unused interrupt_config field from hdc2010_data struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 18c1d078efee67c0d65f1725bb07f5d3be7c8025 Author: Antoniu Miclaus Date: Mon Feb 2 13:25:59 2026 +0200 iio: dac: ti-dac5571: remove unused id field Remove unused id field from dac5571_data struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 3890d6a324960816df9e8cebd742b11ee7591186 Author: Antoniu Miclaus Date: Mon Feb 2 13:25:58 2026 +0200 iio: dac: adi-axi-dac: remove unused int_tone field Remove unused int_tone field from axi_dac_state struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 0555e56f4c4b4b78191de7abf0ff6f8ab133a7c1 Author: Antoniu Miclaus Date: Mon Feb 2 13:25:57 2026 +0200 iio: adc: ti-ads1015: remove unused enabled field Remove unused enabled field from ads1015_channel_data struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 726c1035ba1e6a09d75367d900525c77d654db27 Author: Antoniu Miclaus Date: Mon Feb 2 13:25:56 2026 +0200 iio: adc: nau7802: remove unused min_conversions field Remove unused min_conversions field from nau7802_state struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit d41114a74e7312991ed05fe051d2c6fd04685b96 Author: Antoniu Miclaus Date: Mon Feb 2 13:25:55 2026 +0200 iio: adc: max1363: remove unused requestedmask field Remove unused requestedmask field from max1363_state struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 8c0af74e250734ab91276f2cc53058a0b394758a Author: Antoniu Miclaus Date: Mon Feb 2 13:25:54 2026 +0200 iio: adc: ad9467: remove unused output_mode field Remove unused output_mode field from ad9467_state struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Reviewed-by: Tomas Melin Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 1062f21ce1052eacee2714b9078e237470bcb973 Author: Antoniu Miclaus Date: Mon Feb 2 13:25:53 2026 +0200 iio: adc: ad7793: remove unused int_vref_mv field Remove unused int_vref_mv field from ad7793_state struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 1a993d5686ffe6f9b6addea22301ece733897765 Author: Antoniu Miclaus Date: Mon Feb 2 13:25:52 2026 +0200 iio: adc: ad7768-1: remove unused mclk_div field Remove unused mclk_div field from ad7768_state struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit c1de86dab615b1b379ed856434c4fe9e71d32318 Author: Antoniu Miclaus Date: Mon Feb 2 13:25:51 2026 +0200 iio: adc: ad4080: remove unused dec_rate field Remove unused dec_rate field from ad4080_state struct. The driver reads/writes decimation rate directly from hardware registers via ad4080_get_dec_rate() and ad4080_set_dec_rate() functions. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 04bb8d0e5d1c8d5a9079b35b4e6f0868f734698b Author: Cosmin Tanislav Date: Wed Feb 4 20:02:02 2026 +0200 iio: ABI: fix current_trigger description Triggers exist under /sys/bus/iio/devices/, not under /sys/class/iio. /sys/class/iio does not even exist. Use the current path. Signed-off-by: Cosmin Tanislav Signed-off-by: Jonathan Cameron commit 8b012728ed9fb0f05d05c464a7faa04800e087bf Author: Harshit Mogalapalli Date: Thu Feb 5 05:12:13 2026 -0800 iio: sca3000: manage device registration with devm helper Convert the iio registration to use devm_* helpers so the probe no longer needs a separate cleanup path and remove callback can also drop the unregister. After this there is no need for having a remove callback, so remote it. No functional change intended. Suggested-by: Andy Shevchenko Reviewed-by: David Lechner Reviewed-by: Andy Shevchenko Signed-off-by: Harshit Mogalapalli Signed-off-by: Jonathan Cameron commit 71d0d6a6cae028e0713c1373bf14751764f0f3aa Author: Harshit Mogalapalli Date: Thu Feb 5 05:12:12 2026 -0800 iio: sca3000: stop interrupts via devm_add_action_or_reset() Used devm_add_action_or_reset() for shutting down the interrupts. Make sca3000_stop_all_interrupts() return void now that it always hooks into devm cleanup. No functional change intended. Suggested-by: David Lechner Suggested-by: Andy Shevchenko Signed-off-by: Harshit Mogalapalli Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 31ac64108d0e2484dc7fdeaf990cc88a42894639 Author: Harshit Mogalapalli Date: Thu Feb 5 05:12:11 2026 -0800 iio: sca3000: use guard(mutex) to simplify return paths Switch sca3000_stop_all_interrupts() to use guard(mutex) to simplify the error paths without needing a goto. Suggested-by: Jonathan Cameron Signed-off-by: Harshit Mogalapalli Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 8358169ebb04a4e60c5730682ea5e8706bca485a Author: Harshit Mogalapalli Date: Thu Feb 5 05:12:10 2026 -0800 iio: sca3000: make stop_all_interrupts() return void sca3000_stop_all_interrupts() is called only from the driver remove path and its return value is discarded, so convert the helper to return void. No functional change. Signed-off-by: Harshit Mogalapalli Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit aa598c22157a18d19ef6071dd1dd9d2376a9c743 Author: Harshit Mogalapalli Date: Thu Feb 5 05:12:09 2026 -0800 iio: sca3000: Move sca3000_stop_all_interrupts() above sca3000_probe() Move sca3000_stop_all_interrupts() above sca3000_probe() without altering its logic so the next set of patches are easier to review. No functional change. Suggested-by: Andy Shevchenko Signed-off-by: Harshit Mogalapalli Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 4390d4161a286646a0e180e8a6cb9fd58c511f68 Author: Harshit Mogalapalli Date: Thu Feb 5 05:12:08 2026 -0800 iio: sca3000: switch IRQ handling to devm helpers Convert the threaded IRQ registration to devm_request_threaded_irq() so that the probe and remove paths can drop manual freeing of irqs. No functionality change. Suggested-by: Andy Shevchenko Reviewed-by: David Lechner Reviewed-by: Andy Shevchenko Signed-off-by: Harshit Mogalapalli Signed-off-by: Jonathan Cameron commit 042d1244786ce713da25ea26cce71e7e90be7580 Author: Harshit Mogalapalli Date: Thu Feb 5 05:12:07 2026 -0800 iio: sca3000: reuse device pointer for devm helpers Cache struct device *dev and feed it to the devm helpers to simplify the probe function. No functional changes. Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Harshit Mogalapalli Signed-off-by: Jonathan Cameron commit 7affc01b317819eb426f6c0aa2fd98be73080b75 Author: Andy Shevchenko Date: Sun Nov 9 20:24:36 2025 +0100 iio: imu: inv_icm42600: Convert to uXX and sXX integer types The driver has a some use of intXX_t and uintXX_t types which is not the pattern we use in the IIO subsystem. Switch the driver to use kernel internal types for that. No functional changes. Signed-off-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 6662283ac71552a3a5f66d747110186c9b997cf6 Author: Menderes Sabaz Date: Thu Jan 29 19:46:10 2026 +0300 iio: dac: ad5360: converting to guard(mutex) Converting mutex_lock and mutex_unlock to guard(mutex) Signed-off-by: Menderes Sabaz Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit 1bceffda64eeb7d24c4bfea9f0514b8775afb709 Author: SAJJA EASWAR SAI Date: Fri Jan 30 02:34:31 2026 +0530 iio: light: apds9306: remove redundant explicit pointer cast C allows implicit conversion from void * to struct apds9306_data *, so the explicit cast on 'ptr' is unnecessary. Removing it improves readability. Signed-off-by: SAJJA EASWAR SAI Acked-by: Subhajit Ghosh Signed-off-by: Jonathan Cameron commit f4e466aac34013904d81acfacf1f2453068578a2 Author: Antoniu Miclaus Date: Thu Jan 29 20:14:52 2026 +0200 iio: pressure: hsc030pa: Improve i2c_transfer return value handling The i2c_transfer() function returns the number of messages successfully transferred. The function sends 1 message but checks for ret == 2, which can never be true. In practice this has no impact since the caller checks ret < 0, and the erroneous return value of 1 is not treated as an error. Improve the return value handling to properly distinguish between I2C errors and unexpected transfer counts. Signed-off-by: Antoniu Miclaus Tested-by: Petre Rodan Signed-off-by: Jonathan Cameron commit f7c0ea2e782f5cf46f8c78859368106476e5f946 Author: Antoniu Miclaus Date: Fri Jan 30 14:23:08 2026 +0200 MAINTAINERS: add entry for ADL8113 driver Add MAINTAINERS entry for the ADL8113 driver. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit d43795cb35b4b7c8db50c67a3459e3964829aca9 Author: Antoniu Miclaus Date: Fri Jan 30 15:50:05 2026 +0200 iio: frequency: admv4420: return proper error code from admv4420_calc_parameters() Return -EINVAL instead of -1 when no valid PLL parameters solution is found. Using standard kernel error codes ensures consistency and proper error propagation through the call chain. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 43e41846ac7ebee529c3684b5726d71224f4fbdd Author: Yosry Ahmed Date: Mon Mar 2 15:42:49 2026 +0000 KVM: x86: Drop redundant call to kvm_deliver_exception_payload() In kvm_check_and_inject_events(), kvm_deliver_exception_payload() is called for pending #DB exceptions. However, shortly after, the per-vendor inject_exception callbacks are made. Both vmx_inject_exception() and svm_inject_exception() unconditionally call kvm_deliver_exception_payload(), so the call in kvm_check_and_inject_events() is redundant. Note that the extra call for pending #DB exceptions is harmless, as kvm_deliver_exception_payload() clears exception.has_payload after the first call. The call in kvm_check_and_inject_events() was added in commit f10c729ff965 ("kvm: vmx: Defer setting of DR6 until #DB delivery"). At that point, the call was likely needed because svm_queue_exception() checked whether an exception for L2 is intercepted by L1 before calling kvm_deliver_exception_payload(), as SVM did not have a check_nested_events callback. Since DR6 is updated before the #DB intercept in SVM (unlike VMX), it was necessary to deliver the DR6 payload before calling svm_queue_exception(). After that, commit 7c86663b68ba ("KVM: nSVM: inject exceptions via svm_check_nested_events") added a check_nested_events callback for SVM, which checked for L1 intercepts for L2's exceptions, and delivered the the payload appropriately before the intercept. At that point, svm_queue_exception() started calling kvm_deliver_exception_payload() unconditionally, and the call to kvm_deliver_exception_payload() from its caller became redundant. No functional change intended. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260302154249.784529-1-yosry@kernel.org Signed-off-by: Sean Christopherson commit a56444d5e7387effbc61d6b98fe5d68897017fc9 Author: Sean Christopherson Date: Thu Nov 13 15:14:20 2025 -0800 KVM: SVM: Skip OSVW MSR reads if current CPU doesn't support the feature Skip the OSVW RDMSRs if the current CPU doesn't enumerate support for the MSRs. In practice, checking only the boot CPU's capabilities is sufficient, as the RDMSRs should fault when unsupported, but there's no downside to being more precise, and checking only the boot CPU _looks_ wrong given the rather odd semantics of the MSRs. E.g. if a CPU doesn't support OVSW, then KVM must assume all errata are present. Link: https://patch.msgid.link/20251113231420.1695919-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 3b7a320e491c87c6d25928f6798c2efeef2be0e8 Author: Sean Christopherson Date: Thu Nov 13 15:14:19 2025 -0800 KVM: SVM: Skip OSVW variable updates if current CPU's errata are a subset Elide the OSVW variable updates if the current CPU's set of errata are a subset of the errata tracked in the global values, i.e. if no update is needed. There's no danger of under-reporting errata due to bailing early as KVM is purely reducing the set of "known fixed" errata. I.e. a racing update on a different CPU with _more_ errata doesn't change anything if the current CPU has the same or fewer errata relative to the status quo. If another CPU is writing osvw_len, then "len" is guaranteed to be larger than the new osvw_len and so the osvw_len update would be skipped anyways. If another CPU is setting new bits in osvw_status, then "status" is guaranteed to be a subset of the new osvw_status and the bitwise-OR would be an effective nop anyways. Link: https://patch.msgid.link/20251113231420.1695919-5-seanjc@google.com Signed-off-by: Sean Christopherson commit c65106af8393fe45524b256d7836317a8b3f2c09 Author: Sean Christopherson Date: Thu Nov 13 15:14:18 2025 -0800 KVM: SVM: Extract OS-visible workarounds setup to helper function Move the initialization of the global OSVW variables to a helper function so that svm_enable_virtualization_cpu() isn't polluted with a pile of what is effectively legacy code. No functional change intended. Link: https://patch.msgid.link/20251113231420.1695919-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 089af84641b574990da97d4674706a0303abca34 Author: Sean Christopherson Date: Thu Nov 13 15:14:17 2025 -0800 KVM: SVM: Skip OSVW MSR reads if KVM is treating all errata as present Don't bother reading the OSVW MSRs if osvw_len is already zero, i.e. if KVM is already treating all errata as present, in which case the positive path of the if-statement is one giant nop. Opportunistically update the comment to more thoroughly explain how the MSRs work and why the code does what it does. Link: https://patch.msgid.link/20251113231420.1695919-3-seanjc@google.com Signed-off-by: Sean Christopherson commit f35043d0f973504e5f199be6287159dc5b373deb Author: Sean Christopherson Date: Thu Nov 13 15:14:16 2025 -0800 KVM: SVM: Serialize updates to global OS-Visible Workarounds variables Guard writes to the global osvw_status and osvw_len variables with a spinlock to ensure enabling virtualization on multiple CPUs in parallel doesn't effectively drop any writes due to writing back stale data. Don't bother taking the lock when the boot CPU doesn't support the feature, as that check is constant for all CPUs, i.e. racing writes will always write the same value (zero). Note, the bug was inadvertently "fixed" by commit 9a798b1337af ("KVM: Register cpuhp and syscore callbacks when enabling hardware"), which effectively serialized calls to enable virtualization due to how the cpuhp framework "brings up" CPU. But KVM shouldn't rely on the mechanics of cphup to provide serialization. Link: https://patch.msgid.link/20251113231420.1695919-2-seanjc@google.com Signed-off-by: Sean Christopherson commit ecb80629321306547f7ad13b0ca5ef9cf8cdbb77 Author: Sean Christopherson Date: Wed Feb 18 13:08:20 2026 -0800 KVM: x86/mmu: Don't zero-allocate page table used for splitting a hugepage When splitting hugepages in the TDP MMU, don't zero the new page table on allocation since tdp_mmu_split_huge_page() is guaranteed to write every entry and thus every byte. Unless someone peeks at the memory between allocating the page table and writing the child SPTEs, no functional change intended. Cc: Rick Edgecombe Cc: Kai Huang Reviewed-by: Kai Huang Reviewed-by: Rick Edgecombe Link: https://patch.msgid.link/20260218210820.2828896-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 89355b05356d055fc5a7bc0fdffd44cb4a53f477 Author: Andrew Davis Date: Mon Mar 2 13:35:43 2026 -0600 xtensa: xtfpga: Use register_sys_off_handler(SYS_OFF_MODE_RESTART) Function register_restart_handler() is deprecated. Using this new API removes our need to keep and manage a struct notifier_block. Signed-off-by: Andrew Davis Message-ID: <20260302193543.275197-3-afd@ti.com> Signed-off-by: Max Filippov commit 7a3595dfffb84f7ff3d8e2800b271d02d2933d04 Author: Andrew Davis Date: Mon Mar 2 13:35:42 2026 -0600 xtensa: xt2000: Use register_sys_off_handler(SYS_OFF_MODE_RESTART) Function register_restart_handler() is deprecated. Using this new API removes our need to keep and manage a struct notifier_block. Signed-off-by: Andrew Davis Message-ID: <20260302193543.275197-2-afd@ti.com> Signed-off-by: Max Filippov commit a413a26a0ee935fa59cbfb3ba289e345baf6ce79 Author: Andrew Davis Date: Mon Mar 2 13:35:41 2026 -0600 xtensa: ISS: Use register_sys_off_handler(SYS_OFF_MODE_RESTART) Function register_restart_handler() is deprecated. Using this new API removes our need to keep and manage a struct notifier_block. Signed-off-by: Andrew Davis Message-ID: <20260302193543.275197-1-afd@ti.com> Signed-off-by: Max Filippov commit d1880d5f5899c572337ceb3d7e067052b22597e1 Author: Alice Ryhl Date: Thu Feb 19 09:12:29 2026 +0000 rust: irq: move 'static bounds to traits The 'static bound is required by all irq handlers, so it is simpler to specify it on the trait declaration instead of repeating it every time the trait is used as a where clause. Note that we already list Sync on the trait bound for the same reason. Signed-off-by: Alice Ryhl Reviewed-by: Gary Guo Reviewed-by: Benno Lossin Link: https://patch.msgid.link/20260219-irq-static-on-trait-v1-1-6ede6b743ea3@google.com Signed-off-by: Danilo Krummrich commit 2adac914c72b6cb5aba2612f49050c82aecd498e Author: Richard Fitzgerald Date: Tue Mar 3 13:14:40 2026 +0000 ASoC: cs35l56-test: Add test cases without onchip pulls defined Add parameters to cs35l56_test_onchip_spkid_cases[] for the ACPI defining onchip GPIOs but not defining any pull settings. Pull settings are optional because the pull should normally be provided by an external resistor. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260303131440.574690-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit d20e945e9fe631381dc426eaeaddeed0eb47935a Author: Thorsten Leemhuis Date: Mon Feb 23 09:20:47 2026 +0100 docs: handling-regressions: add, trim, and sort quotes from Linus Add additional quotes from Linus while trimming the existing ones and sorting them all into categories. That makes it easier for new developers and maintainers to look up how Linus expects certain situations wrt regressions to be handled. The earlier sections in the document already explain this, but those parts are often questioned -- or not considered authoritative at all and plainly ignored. Having it straight from the horse's mouth helps get everyone on the same page, even if that makes the document quite a bit longer (the raw line count of this section doubles, but the number of characters increases by nearly 50%). In return, this covers a lot more aspects and, due to the sub-headings, is easier to navigate. In contrast to the more neutral description in the early sections of the document, this also provides a better insight into how serious Linus is about the "no regressions" rule and how he wants it to be interpreted in practice; this makes it easier for new developers and maintainers to understand things and prevent run-ins with higher-level maintainers. Signed-off-by: Thorsten Leemhuis Signed-off-by: Jonathan Corbet Message-ID: commit 2b8060418dffaa4fcd9173dd5830a763a4b32e99 Author: Matteo Martelli Date: Mon Feb 23 14:05:31 2026 +0100 sched_deadline, docs: fix cpuset example for cgroupv2 Documenation/scheduler/sched-deadline.rst provides two examples for how to setup cgroup and cpuset for deadline tasks: one for cgroup v1 and one cgroup v2. The code block in the latter is not properly html rendered as the :: marker is missing. Add the :: marker before the code block for the cgroup v2 example to fix html rendering. Also make the example description more explicit for better clarity. Fixes: 0116765035eb ("sched_deadline, docs: add affinity setting with cgroup2 cpuset controller") Signed-off-by: Matteo Martelli Signed-off-by: Jonathan Corbet Message-ID: <20260223-docs-sched-deadline-fix-example-v1-1-8d0bedc2bc6f@codethink.co.uk> commit e0bb430d3edc0b63e1482c2b7d4bbd38854ff8a7 Merge: 6801cc493603b2 85c2a51357f720 Author: Jonathan Corbet Date: Tue Mar 3 10:54:28 2026 -0700 Merge branch 'mauro' into docs-mw The changes here basically addresses several issues discoverd by Randy and by me and makes NestedMatch more similar to KernRe. It also moves the transforms ruleset to a separate file, to make easier to maintain kernel-doc code. commit 68400c1aaf02636a97c45ba198110b66feb270a9 Author: Sohil Mehta Date: Tue Jan 20 15:47:30 2026 -0800 x86/cpu: Remove LASS restriction on EFI The initial LASS enabling has been deferred to much later during boot, and EFI runtime services now run with LASS temporarily disabled. This removes LASS from the path of all EFI services. Remove the LASS restriction on EFI config, as the two can now coexist. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Tested-by: Tony Luck Tested-by: Maciej Wieczor-Retman Link: https://patch.msgid.link/20260120234730.2215498-4-sohil.mehta@intel.com commit 0021e71cfb96d7816e2027a76b813da6003c3a0c Author: Sohil Mehta Date: Tue Jan 20 15:47:29 2026 -0800 x86/efi: Disable LASS while executing runtime services Ideally, EFI runtime services should switch to kernel virtual addresses after SetVirtualAddressMap(). However, firmware implementations are known to be buggy in this regard and continue to access physical addresses. The kernel maintains a 1:1 mapping of all runtime services code and data regions to avoid breaking such firmware. LASS enforcement relies on bit 63 of the virtual address, which would block such accesses to the lower half. Unfortunately, not doing anything could lead to #GP faults when users update to a kernel with LASS enabled. One option is to use a STAC/CLAC pair to temporarily disable LASS data enforcement. However, there is no guarantee that the stray accesses would only touch data and not perform instruction fetches. Also, relying on the AC bit would depend on the runtime calls preserving RFLAGS, which is highly unlikely in practice. Instead, use the big hammer and switch off the entire LASS mechanism temporarily by clearing CR4.LASS. Runtime services are called in the context of efi_mm, which has explicitly unmapped any memory EFI isn't allowed to touch (including userspace). So, do this right after switching to efi_mm to avoid any security impact. Some runtime services can be invoked during boot when LASS isn't active. Use a global variable (similar to efi_mm) to save and restore the correct CR4.LASS state. The runtime calls are serialized with the efi_runtime_lock, so no concurrency issues are expected. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Tested-by: Tony Luck Tested-by: Maciej Wieczor-Retman Link: https://patch.msgid.link/20260120234730.2215498-3-sohil.mehta@intel.com commit b3226af5ad7bbfcba79d26f547fe6582baf20ce9 Author: Sohil Mehta Date: Tue Jan 20 15:47:28 2026 -0800 x86/cpu: Defer LASS enabling until userspace comes up LASS blocks any kernel access to the lower half of the virtual address space. Unfortunately, some EFI accesses happen during boot with bit 63 cleared, which causes a #GP fault when LASS is enabled. Notably, the SetVirtualAddressMap() call can only happen in EFI physical mode. Also, EFI_BOOT_SERVICES_CODE/_DATA could be accessed even after ExitBootServices(). The boot services memory is truly freed during efi_free_boot_services() after SVAM has completed. To prevent EFI from tripping LASS, at a minimum, LASS enabling must be deferred until EFI has completely finished entering virtual mode (including freeing boot services memory). Moving setup_lass() to arch_cpu_finalize_init() would do the trick, but that would make the implementation very fragile. Something else might come in the future that would need the LASS enabling to be moved again. In general, security features such as LASS provide limited value before userspace is up. They aren't necessary during early boot while only trusted ring0 code is executing. Introduce a generic late initcall to defer activating some CPU features until userspace is enabled. For now, only move the LASS CR4 programming to this initcall. As APs are already up by the time late initcalls run, some extra steps are needed to enable LASS on all CPUs. Use a CPU hotplug callback instead of on_each_cpu() or smp_call_function(). This ensures that LASS is enabled on every CPU that is currently online as well as any future CPUs that come online later. Note, even though hotplug callbacks run with preemption enabled, cr4_set_bits() would disable interrupts while updating CR4. Keep the existing logic in place to clear the LASS feature bits early. setup_clear_cpu_cap() must be called before boot_cpu_data is finalized and alternatives are patched. Eventually, the entire setup_lass() logic can go away once the restrictions based on vsyscall emulation and EFI are removed. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Tested-by: Tony Luck Tested-by: Maciej Wieczor-Retman Link: https://patch.msgid.link/20260120234730.2215498-2-sohil.mehta@intel.com commit 85c2a51357f720fabfb6fa8d2551d87a94e797cb Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:41:01 2026 +0100 docs: kdoc_parser: move nested match transforms to xforms_lists.py As NestedMatch now has a sub method and a declaration close to what KernRe does, we can move the rules to xforms_lists and simplify kdoc_parser a little bit. No functional changes. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <762ce2a58ff024c1b0b6f6a6e05020d1415b8308.1772469446.git.mchehab+huawei@kernel.org> commit fc44c0a0b2a72f2e9331063a311a548634ae18af Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:41:00 2026 +0100 docs: kdoc_re: make NestedMatch use KernRe Instead of using re_compile, let's create the class with the regex and use KernRe to keep it cached. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: commit 34503b5fd10d8c7f1b1f4fecb6aae826fcf79424 Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:59 2026 +0100 docs: kdoc_re: Change NestedMath args replacement to \0 Future patches will allow parsing each argument instead of the hole set. Prepare for it by changing the replace all args from \1 to \0. No functional changes. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <46e383118be9d9e432e3814fe819ebb12261d7b4.1772469446.git.mchehab+huawei@kernel.org> commit 962bdc440df58008e0319d6cbe08c4ca1193c112 Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:58 2026 +0100 docs: kdoc_re: don't recompile NestedMatch regex every time Store delimiters and its regex-compiled version as const vars. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <0cf2b72d4785aa8b727188b56688ff442d1c65ce.1772469446.git.mchehab+huawei@kernel.org> commit 134468b0e2043efec4bd25dc6bcef238358a8111 Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:57 2026 +0100 docs: kdoc_re: handle strings and escape chars on NextMatch The logic inside NestedMatch currently doesn't consider that function arguments may have chars and strings, which may eventually contain delimiters. Add logic to handle strings and escape characters on them. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: commit 4ff59bdd93f0e80b5014977502d082c778f96304 Author: Randy Dunlap Date: Mon Mar 2 17:40:56 2026 +0100 docs: xforms_lists: ignore context analysis and lock attributes Drop context analysis and lock (tracking) attributes to avoid kernel-doc warnings. There are now lots of warnings like these: Documentation/core-api/kref:328: ../include/linux/kref.h:72: WARNING: Invalid C declaration: Expected end of definition. [error at 96] int kref_put_mutex (struct kref *kref, void (*release)(struct kref *kref), struct mutex *mutex) __cond_acquires(true# mutex) ------------------------------------------------------------------------------------------------^ Documentation/core-api/kref:328: ../include/linux/kref.h:94: WARNING: Invalid C declaration: Expected end of definition. [error at 92] int kref_put_lock (struct kref *kref, void (*release)(struct kref *kref), spinlock_t *lock) __cond_acquires(true# lock) --------------------------------------------------------------------------------------------^ The regex is suggested by Mauro; mine was too greedy. Thanks. Updated context analysis and lock macros list provided by PeterZ. Thanks. [mchehab: modified to be applied after xforms_lists split] Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20260107161548.45530e1c@canb.auug.org.au/ Signed-off-by: Randy Dunlap Reviewed-by: Mauro Carvalho Chehab Reviewed-by: Aleksandr Loktionov Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <3c7fdfc364a8920f92530b47bdbf4bb29a40371f.1772469446.git.mchehab+huawei@kernel.org> commit d842057c4a205084fb3036122c7426963f04e826 Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:55 2026 +0100 docs: kdoc_parser: move transform lists to a separate file Over the time, most of the changes at kernel-doc are related to maintaining a list of transforms to convert macros into pure C code. Place such transforms on a separate module, to cleanup the parser module. There is an advantage on that: QEMU also uses our own kernel-doc, but the xforms list there is different. By placing it on a separate module, we can minimize the differences and make it easier to keep QEMU in sync with Kernel upstream. No functional changes. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: commit 95a9429cc6d31371575793ab7beb94bf3e7a2f92 Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:54 2026 +0100 docs: kdoc_re: better show KernRe() at documentation the __repr__() function is used by autodoc to document macro initialization. Add a better representation for them. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <80d27732368c14125c1b76048a70d8b4aee527ef.1772469446.git.mchehab+huawei@kernel.org> commit 97d4e70bc2c6f75911a9a5e1a75f2de13fde9b6b Author: Randy Dunlap Date: Mon Mar 2 17:40:53 2026 +0100 docs: kdoc_parser: handle struct member macro VIRTIO_DECLARE_FEATURES(name) Parse the macro VIRTIO_DECLARE_FEATURES(name) and expand it to its definition. These prevents one build warning: WARNING: include/linux/virtio.h:188 struct member 'VIRTIO_DECLARE_FEATURES(features' not described in 'virtio_device' Signed-off-by: Randy Dunlap Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <6f62e1f1210e74906fa50f4e937f66f54813661b.1772469446.git.mchehab+huawei@kernel.org> commit 9bff5121fe22fdd0bb5bd6f744e136ec20bf7b95 Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:52 2026 +0100 docs: kdoc_parser: add support for LIST_HEAD Convert LIST_HEAD into struct list_head when handling its prototype. Signed-off-by: Mauro Carvalho Chehab Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <8bdfa6ba6002b0a73a83660f0ce7b40e30124552.1772469446.git.mchehab+huawei@kernel.org> commit 6d9c2e9575b8630e17571a77eef8ade84a2a6344 Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:51 2026 +0100 docs: kdoc_parser: fix parser to support multi-word types The regular expression currently expects a single word for the type, but it may be something like "struct foo". Add support for it. Signed-off-by: Mauro Carvalho Chehab Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <544c73a9e670b6fef1828bf4f2ba0de7d29d8675.1772469446.git.mchehab+huawei@kernel.org> commit b7dc635459ad5b00f2d482406dbdca3291622ce2 Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:50 2026 +0100 docs: kdoc_parser: don't exclude defaults from prototype If we do that, the defaults won't be parsed. Signed-off-by: Mauro Carvalho Chehab Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: commit 9bbf22b87d866fa1e6a1f9f6376d2ef458b6dcc7 Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:49 2026 +0100 docs: kdoc_parser: fix the default_value logic for variables The indentation is wrong for the second regex, which causes problems on variables with defaults. Signed-off-by: Mauro Carvalho Chehab Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <681f18338abd6ae33cb9c15d72bb31a1cba75a9a.1772469446.git.mchehab+huawei@kernel.org> commit 4fd349f03dc51bc2f9cd2ea9f6309b0bc2b848ca Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:48 2026 +0100 docs: kdoc_parser: fix variable regexes to work with size_t The regular expressions meant to pick variable types are too naive: they forgot that the type word may contain underlines. It also means that we need to change the regex which detects var attributes to handle "const". Co-developed-by: Randy Dunlap Signed-off-by: Mauro Carvalho Chehab Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <8230715239929cf9d475ab81ca1df7de65d82d06.1772469446.git.mchehab+huawei@kernel.org> commit cca1bbdd72f72a3cf86d90fd6f326fd709ae931f Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:47 2026 +0100 docs: kdoc_parser: don't mangle with function defines Mangling with #defines is not nice, as we may end removing the macro names, preventing several macros from being properly documented. Also, on defines, we have something like: #define foo(a1, a2, a3, ...) \ /* some real implementation */ The prototype part (first line on this example) won't contain any macros, so no need to apply any regexes on it. With that, move the apply_transforms() logic to ensure that it will be called only on functions. Signed-off-by: Mauro Carvalho Chehab Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <8f9854c8ca1c794b6a3fe418f7adbc32aa68b432.1772469446.git.mchehab+huawei@kernel.org> commit 77e6e17e9fc4cb4e59ad97de5453bb6f963a5fd4 Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:46 2026 +0100 docs: kdoc_parser: move var transformers to the beginning Just like functions and structs had their transform variables placed at the beginning, move variable transforms to there as well. No functional changes. Signed-off-by: Mauro Carvalho Chehab Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <491b290252a308f381f88353a3bbe9e2bd1f6a62.1772469446.git.mchehab+huawei@kernel.org> commit 8eb49357ffa229c9b65a002f655c1280dc09769a Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:45 2026 +0100 docs: kdoc_re: don't go past the end of a line The logic which checks if the line ends with ";" is currently broken: it may try to read past the buffer. Fix it by checking before trying to access line[pos]. Signed-off-by: Mauro Carvalho Chehab Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: commit 2b144a30a407d29b7e6d24549f5316175115e788 Author: Mauro Carvalho Chehab Date: Mon Mar 2 17:40:44 2026 +0100 docs: kdoc_re: add support for groups() Add an equivalent to re groups() method. This is useful on debug messages. Signed-off-by: Mauro Carvalho Chehab Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Aleksandr Loktionov Signed-off-by: Jonathan Corbet Message-ID: <20d1a9c77200e28cc2ff1d6122635c43f8ba6a71.1772469446.git.mchehab+huawei@kernel.org> commit 96f06d055ca03d1dfb5830fd07ff6eadbd66264c Author: Conor Dooley Date: Tue Mar 3 16:41:52 2026 +0000 spi: dt-bindings: mpfs-spi: remove clock-names This binding documented clock-names, but never bothered to document what the name should be, rendering the property useless to software. It's not a required property, so it can just be removed without harming any software that conjured up it's own name for the clock, as they could not rely on it being there to begin with. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260303-spoils-snowbird-99f6e3a2dae3@spud Signed-off-by: Mark Brown commit f5d09914d473059e4e851c6a3bfa9f0e848c63e4 Author: Conor Dooley Date: Tue Mar 3 16:41:50 2026 +0000 spi: dt-bindings: mpfs-spi: permit resets CoreSPI, CoreQSPI and the hardened versions of them on mpfs and pic64gx have a reset pin. For the first two, usually this is wired to a common fabric reset not managed by software and for the latter two the platform firmware takes them out of reset on first-party boards (or those using modified versions of the vendor firmware), but not all boards may take this approach. Permit providing a reset in devicetree for Linux, or other devicetree-consuming software, to use. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260303-deceiver-rack-82f2b89eac40@spud Signed-off-by: Mark Brown commit 6801cc493603b273698de501702ccc8751fb6689 Author: Shubham Chakraborty Date: Tue Feb 24 02:07:24 2026 +0530 docs: sysctl: add documentation for crypto and debug Add documentation for the /proc/sys/crypto and /proc/sys/debug directories in the admin-guide. This includes tunables for FIPS mode (fips_enabled, fips_name, fips_version), exception-trace, and kprobes-optimization. The documentation is based on source code analysis and addresses stylistic feedback to keep it direct and concise. Tested-by: Randy Dunlap Signed-off-by: Shubham Chakraborty Signed-off-by: Jonathan Corbet Message-ID: <20260223203724.20874-1-chakrabortyshubham66@gmail.com> commit e7753827b9ba1827bf802e3268aea7716cddd6e6 Author: Akiyoshi Kurita Date: Thu Feb 26 00:47:06 2026 +0900 docs: ja_JP: process: translate first half of 'Describe your changes' Translate the first half of the "Describe your changes" section in Documentation/translations/ja_JP/process/submitting-patches.rst. Replace "説明する" with "記述する" to match the distinction used in ja_JP/process/howto.rst, and adjust line wrapping to ~74 columns. Avoid cross-references for now by adding TODO notes to convert them to file-local references when the destinations are translated. Signed-off-by: Akiyoshi Kurita Acked-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Message-ID: <20260225154706.5457-1-weibu@redadmin.org> commit 8350d14725a459fba899d5642b7ced786424d33c Author: Ariful Islam Shoikot Date: Thu Feb 26 18:01:29 2026 +0600 Documentation: process: backporting: fix missing subject Add the missing "it" in the sentence: "even though it could have been changed by other patches." This is a grammatical error in the Error handling section. Signed-off-by: Ariful Islam Shoikot Signed-off-by: Jonathan Corbet Message-ID: <20260226120129.18610-1-islamarifulshoikat@gmail.com> commit 05c9b2eda8a9e3a216e43879fc812981a4890704 Author: Viktor Malik Date: Wed Feb 25 13:09:04 2026 +0100 selftests/bpf: Split module_attach into subtests The test verifies attachment to various hooks in a kernel module, however, everything is flattened into a single test. This makes it impossible to run or skip test cases selectively. Isolate each BPF program into a separate subtest. This is done by disabling auto-loading of programs and loading and testing each program separately. At the same time, modernize the test to use ASSERT* instead of CHECK and replace `return` by `goto cleanup` where necessary. Signed-off-by: Viktor Malik Link: https://lore.kernel.org/r/20260225120904.1529112-1-vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit aa029f7a51d74401ebd05388ed573ad18b2830a8 Author: Ville Syrjälä Date: Tue Mar 3 12:14:17 2026 +0200 drm/i915/overlay: Fix oops on unload Apparently I failed to test the unload case properly and thus didn't notice that the i915_overlay_is_active() needs i915->overlay after fetch_and_zero() already cleared it. Stop using fetch_and_zero() and only clear the pointer at the end to avoid the oops. Fixes: 38d9a352c45e ("drm/i915/overlay: Extract i915_overlay_is_active()") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260303101417.14409-1-ville.syrjala@linux.intel.com Reviewed-by: Michał Grzelak commit 63b5305ad84d72ff60a7cfcdd70fd97dd45e0b7a Author: Pierre-Henry Moussay Date: Mon Nov 17 14:21:22 2025 +0000 soc: microchip: mpfs-sys-controller: add support for pic64gx pic64gx is not compatible with mpfs because due to the lack of FPGA functionality some features are disabled. Notably, anything to do with FPGA fabric contents is not supported. Signed-off-by: Pierre-Henry Moussay Signed-off-by: Conor Dooley commit ecc09da7ba34b249022897b2c0cafcbd8e2280ac Author: Pierre-Henry Moussay Date: Mon Nov 17 14:21:21 2025 +0000 dt-bindings: soc: microchip: mpfs-sys-controller: Add pic64gx compatibility pic64gx is not compatible with mpfs because due to the lack of FPGA functionality some features are disabled. Notably, anything to do with FPGA fabric contents is not supported. Signed-off-by: Pierre-Henry Moussay Acked-by: Rob Herring (Arm) Signed-off-by: Conor Dooley commit 7a58baed883a08d5cffa906d325be70942c13f03 Author: Conor Dooley Date: Mon Nov 17 14:21:20 2025 +0000 dt-bindings: soc: microchip: add compatible for the mss-top-sysreg on pic64gx pic64gx has an identical sysreg syscon to mpfs, add it using a fallback. Acked-by: Rob Herring (Arm) Signed-off-by: Conor Dooley commit c8975709eae716666b864316503e3acb88ffe06e Author: Daniel Pereira Date: Thu Feb 26 19:58:48 2026 -0300 docs: pt_BR: Add translation for maintainer-handbooks Translate the maintainer-handbooks.rst into Portuguese (Brazil) and update the main index to include it. This document provides a starting point for subsystem-specific development processes. Signed-off-by: Daniel Pereira Signed-off-by: Jonathan Corbet Message-ID: <20260226225849.268373-1-danielmaraboo@gmail.com> commit 4d2956e0094d9a7b04395185bc81467fa0ae1ccc Author: Thorsten Blum Date: Mon Mar 2 14:51:42 2026 +0100 Documentation/maintainer-tip: Fix grammar s/a empty newline/an empty newline/ Signed-off-by: Thorsten Blum Signed-off-by: Jonathan Corbet Message-ID: <20260302135141.3213-2-thorsten.blum@linux.dev> commit 246c5495c69fae1ec96531d79106c946ea904312 Author: Aleksandr Loktionov Date: Thu Jan 22 09:50:39 2026 +0100 ixgbe: refactor: use DECLARE_BITMAP for ring state field Convert the ring state field from 'unsigned long' to a proper bitmap using DECLARE_BITMAP macro, aligning with the implementation pattern already used in the i40e driver. This change: - Adds __IXGBE_RING_STATE_NBITS as the bitmap size sentinel to enum ixgbe_ring_state_t (consistent with i40e's __I40E_RING_STATE_NBITS) - Changes 'unsigned long state' to 'DECLARE_BITMAP(state, __IXGBE_RING_STATE_NBITS)' in struct ixgbe_ring - Removes the address-of operator (&) when passing ring->state to bit manipulation functions, as bitmap arrays naturally decay to pointers The change maintains functional equivalence while using the more appropriate kernel bitmap API, consistent with other Intel Ethernet drivers. Signed-off-by: Aleksandr Loktionov Reviewed-by: Marcin Szycik Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit b09621cc0dfd7d2ae8557ee9d0d7ca6dc75145e5 Author: Andy Shevchenko Date: Mon Mar 2 10:18:31 2026 +0100 i40e: Add missing wordpart.h header When cleaning up another header I have met this build error: drivers/net/ethernet/intel/i40e/i40e_hmc.h:105:22: error: implicit declaration of function 'upper_32_bits' [-Wimplicit-function-declaration] 105 | val1 = (u32)(upper_32_bits(pa)); \ This is due to missing header, add it to fix the possible issue. Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Signed-off-by: Andy Shevchenko Signed-off-by: Tony Nguyen commit 1f3d49734820fdc30655b9ee4e51aede2bf86d45 Author: Yury Norov (NVIDIA) Date: Wed Dec 17 20:57:57 2025 -0500 i40e: drop useless bitmap_weight() call in i40e_set_rxfh_fields() bitmap_weight() is O(N) and useless here, because the following for_each_set_bit() returns immediately in case of empty flow_pctypes. Signed-off-by: Yury Norov (NVIDIA) Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit dc0cdb7ff3b1e1ff2faf594640724c2771a8b2c6 Author: Simon Horman Date: Tue Jan 27 16:16:55 2026 +0000 ice: Make name member of struct ice_cgu_pin_desc const The name member of struct ice_cgu_pin_desc never modified. Make it const. Found by inspection. Compile tested only. Signed-off-by: Simon Horman Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 44dd647b668984fb52b7fb73952cb1668b76ebed Merge: 7242b0951d2cab 422f1efabd1389 Author: Alexei Starovoitov Date: Tue Mar 3 08:47:23 2026 -0800 Merge branch 'bpf-allow-void-return-type-for-global-subprogs' Emil Tsalapatis says: ==================== bpf: Allow void return type for global subprogs Global subprogs are currently not allowed to return void. Adjust verifier logic to allow global functions with a void return type. Exception callbacks are excluded from this change, and still require a scalar return type. Adding additional logic for void globals significantly complicates check_return_code(), mainly because of how the new feature interacts with bpf_throw(). To avoid complicating the code, refactor the return value range validation logic into two separate functions, one for program exits through BPF_EXIT and one for program exits through bpf_throw(). The changes are non-functional. Also adjust existing selftests that were ensuring that global subprogs with void return types fail to verify. These tests should now load successfully. Patches 1-3 refactor check_return_code into two separate functions, one for BPF_EXIT and one for bpf_throw(). No functional changes. Patches 4-5 enable void globals in the verifier and add additional selftests. v5 -> v6 (https://lore.kernel.org/bpf/20260227154616.6846-1-emil@etsalapatis.com/) Patch 1: - Removed unused variables (kernel test robot) - Add break; on empty default to suppress warning (kernel test robot) - Added explanation on why change in switch statement for BPF_PROG_TYPE_TRACING in check_return_code is a no-op Patches 2/3: - Added From: tags to Eduard's patches and changed my Reviewed-by to Signed-off-by to properly denote patch route (submitting-patches.rst) - Renamed check_subprogram_return_code for into check_global_subprog_return_code (Eduard) Patch 4: - Remove unnecessary subprog_is_global() check in check_return_code (Eduard) - Fix indentation on patch 4 (AI) Patch 5: - Fix unused data in selftests (Eduard) v4 -> v5 (https://lore.kernel.org/bpf/20260225033356.518313-1-emil@etsalapatis.com/) - Split value validation logic from throw/nonthrow to main prog/subprog (Eduard) - Turn return_retval_range() to bool and incorporate return_32bit in retval (Eduard) - Adjust if-else chain in return_retval_range for cgroup programs into switch statement to bring it in line with the other program types v3 -> v4 (https://lore.kernel.org/bpf/20260223215046.1706110-1-emil@etsalapatis.com/) - Factor out bpf_throw() return value validation logic into its own function (Eduard) - Validate the range of bpf_throw() return values from void globals (Eduard) - Move new selftest to verifier_global_subprogs.c (Eduard) - Remove unnecessary verifier_bug_if() statements (Eduard) - Add new test to ensure void globals can call bpf_throw v2 -> v3 (https://lore.kernel.org/bpf/20260210183257.217285-1-emil@etsalapatis.com/) - Allow freplace for global programs that return void and add selftests (Kumar) v1 -> v2 (https://lore.kernel.org/bpf/20260127231414.359283-1-emil@etsalapatis.com/) - Only mark R0 as valid for non-void global functions (AI) - Rename subprog_is_void to subprog_returns_void (Kumar) - Add test that R0 is invalid after calling a void global (Alexei) - Add check to ensure exception callbacks do not return void and associated selftest Cc: Kumar Kartikeya Dwivedi ==================== Link: https://patch.msgid.link/20260228184759.108145-1-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 422f1efabd1389020be1c768c66aa6df40f528e7 Author: Emil Tsalapatis Date: Sat Feb 28 13:47:59 2026 -0500 selftests: bpf: Add tests for void global subprogs Add additional testing for void global functions. The tests ensure that calls to void global functions properly keep R0 invalid. Also make sure that exception callbacks still require a return value. Acked-by: Eduard Zingerman Signed-off-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260228184759.108145-6-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 8446ded1e1a0db86eac8210669301f56649ecd22 Author: Emil Tsalapatis Date: Sat Feb 28 13:47:58 2026 -0500 bpf: Allow void global functions in the verifier Global subprogs are currently not allowed to return void. Adjust verifier logic to allow global functions with a void return type. Acked-by: Eduard Zingerman Signed-off-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260228184759.108145-5-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 69ca55e63101001997c960abdce35869102577c2 Author: Eduard Zingerman Date: Sat Feb 28 13:47:57 2026 -0500 bpf: extract check_global_subprog_return_code() for clarity From: Eduard Zingerman Both main progs and subprogs use the same function in the verifier, check_return_code, to verify the type and value range of the register being returned. However, subprogs only need a subset of the logic in check_return_code. this also goes the way - check_return_code explicitly checks whether it is handling a subprogram in multiple places, complicating the logic. Separate the handling of the two into separate functions. Signed-off-by: Eduard Zingerman Signed-off-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260228184759.108145-4-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 63ec29623943bd55fa026017a93b2d739fcdbb32 Author: Eduard Zingerman Date: Sat Feb 28 13:47:56 2026 -0500 bpf: Extract program_returns_void() for clarity From: Eduard Zingerman The check_return_code function has explicit checks on whether a program type can return void. Factor this logic out to reuse it later for both main progs and subprogs. Signed-off-by: Eduard Zingerman Signed-off-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260228184759.108145-3-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 83419c8fdbbc1dacd12fa614c5a3561e498aac5f Author: Emil Tsalapatis Date: Sat Feb 28 13:47:55 2026 -0500 bpf: Factor out program return value calculation Factor the return value range calculation logic in check_return_code out of the function in preparation for separating the return value validation logic for BPF_EXIT and bpf_throw(). No functional changes. The change made in return_retval_code's handling of PROG_TRACING program types (not error'ing on the default case) is a no-op because the match on the program attach type is exhaustive. Acked-by: Eduard Zingerman Signed-off-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260228184759.108145-2-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 7242b0951d2cab0f5908ec768ebd3f3ca4f0884c Author: Alexis Lothoré (eBPF Foundation) Date: Fri Feb 27 09:08:47 2026 +0100 selftests/bpf: drop test_bpftool.sh The test_bpftool.sh script runs a python unittest script checking bpftool json output on different commands. As part of the ongoing effort to get rid of any standalone test, this script should either be converted to test_progs or removed. As validating bpftool json output does not bring much value to the test base (and because it would need test_progs to bring in a json parser), remove the standalone test script. Signed-off-by: Alexis Lothoré (eBPF Foundation) Acked-by: Quentin Monnet Link: https://lore.kernel.org/r/20260227-bpftool_feature-v1-1-a25860fd52fb@bootlin.com Signed-off-by: Alexei Starovoitov commit b0000448094892c9131e485b64be2d5ef62ab73b Merge: b1d6bd5462f1e1 f6312e71759ddb Author: Alexei Starovoitov Date: Tue Mar 3 08:45:16 2026 -0800 Merge branch 'allow-fixed-offsets-for-ptr_to_ctx' Kumar Kartikeya Dwivedi says: ==================== Allow fixed offsets for PTR_TO_CTX Enable pointer modification with constant offsets accumulated in the register for PTR_TO_CTX for programs where it won't be rewritten. See patches for details. ==================== Link: https://patch.msgid.link/20260227005725.1247305-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit f6312e71759ddb10b20fbdb9ee01b9546cabd4e3 Author: Kumar Kartikeya Dwivedi Date: Thu Feb 26 16:57:25 2026 -0800 selftests/bpf: Add tests for ctx fixed offset support Add tests to ensure PTR_TO_CTX supports fixed offsets for program types that don't rewrite accesses to it. Ensure that variable offsets and negative offsets are still rejected. An extra test also checks writing into ctx with modified offset for syscall progs. Other program types do not support writes (notably, writable tracepoints offer a pointer for a writable buffer through ctx, but don't allow writing to the ctx itself). Before the fix made in the previous commit, these tests do not succeed, except the ones testing for failures regardless of the change. Signed-off-by: Kumar Kartikeya Dwivedi Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260227005725.1247305-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit de6c7d99f898d82106e3c3b84cd03453201a565c Author: Kumar Kartikeya Dwivedi Date: Thu Feb 26 16:57:24 2026 -0800 bpf: Relax fixed offset check for PTR_TO_CTX The limitation on fixed offsets stems from the fact that certain program types rewrite the accesses to the context structure and translate them to accesses to the real underlying type. Technically, in the past, we could have stashed the register offset in insn_aux and made rewrites work, but we've never needed it in the past since the offset for such context structures easily fit in the s16 signed instruction offset. Regardless, the consequence is that for program types where the program type's verifier ops doesn't supply a convert_ctx_access callback, we unnecessarily reject accesses with a modified ctx pointer (i.e., one whose offset has been shifted) in check_ptr_off_reg. Make an exception for such program types (like syscall, tracepoint, raw_tp, etc.). Pass in fixed_off_ok as true to __check_ptr_off_reg for such cases, and accumulate the register offset into insn->off passed to check_ctx_access. In particular, the accumulation is critical since we need to correctly track the max_ctx_offset which is used for bounds checking the buffer for syscall programs at runtime. Reported-by: Tejun Heo Reported-by: Dan Schatzberg Signed-off-by: Kumar Kartikeya Dwivedi Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260227005725.1247305-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 5a6baf204610589f8a5b5a1cd69d1fe661d9d3cd Author: Luis Henriques Date: Mon Feb 16 14:48:30 2026 +0000 fuse: fix uninit-value in fuse_dentry_revalidate() fuse_dentry_revalidate() may be called with a dentry that didn't had ->d_time initialised. The issue was found with KMSAN, where lookup_open() calls __d_alloc(), followed by d_revalidate(), as shown below: ===================================================== BUG: KMSAN: uninit-value in fuse_dentry_revalidate+0x150/0x13d0 fs/fuse/dir.c:394 fuse_dentry_revalidate+0x150/0x13d0 fs/fuse/dir.c:394 d_revalidate fs/namei.c:1030 [inline] lookup_open fs/namei.c:4405 [inline] open_last_lookups fs/namei.c:4583 [inline] path_openat+0x1614/0x64c0 fs/namei.c:4827 do_file_open+0x2aa/0x680 fs/namei.c:4859 [...] Uninit was created at: slab_post_alloc_hook mm/slub.c:4466 [inline] slab_alloc_node mm/slub.c:4788 [inline] kmem_cache_alloc_lru_noprof+0x382/0x1280 mm/slub.c:4807 __d_alloc+0x55/0xa00 fs/dcache.c:1740 d_alloc_parallel+0x99/0x2740 fs/dcache.c:2604 lookup_open fs/namei.c:4398 [inline] open_last_lookups fs/namei.c:4583 [inline] path_openat+0x135f/0x64c0 fs/namei.c:4827 do_file_open+0x2aa/0x680 fs/namei.c:4859 [...] ===================================================== Reported-by: syzbot+fdebb2dc960aa56c600a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69917e0d.050a0220.340abe.02e2.GAE@google.com Fixes: 2396356a945b ("fuse: add more control over cache invalidation behaviour") Signed-off-by: Luis Henriques Signed-off-by: Miklos Szeredi commit 8d306cbffc2ee0f3251c81d574aa3451ef21cd5a Author: Joanne Koong Date: Tue Jan 20 14:44:49 2026 -0800 fuse: use offset_in_page() for page offset calculations Replace open-coded (x & ~PAGE_MASK) with offset_in_page(). Reviewed-by: Darrick J. Wong Reviewed-by: Horst Birthelmer Signed-off-by: Joanne Koong Reviewed-by: Jingbo Xu Signed-off-by: Miklos Szeredi commit dcfd95cb5076c9ef421c19b9b22b3e01f03ce68e Author: Joanne Koong Date: Tue Jan 20 14:44:48 2026 -0800 fuse: use DIV_ROUND_UP() for page count calculations Use DIV_ROUND_UP() instead of manually computing round-up division calculations. Reviewed-by: Darrick J. Wong Reviewed-by: Horst Birthelmer Signed-off-by: Joanne Koong Signed-off-by: Miklos Szeredi commit 25307ca50b815c14a21f82fc5b10e8a621af32ad Author: Joanne Koong Date: Tue Jan 20 14:44:47 2026 -0800 fuse: simplify logic in fuse_notify_store() and fuse_retrieve() Simplify the folio parsing logic in fuse_notify_store() and fuse_retrieve(). In particular, calculate the index by tracking pos, which allows us to remove calculating nr_pages, and use "pos" in place of outarg's offset field. Suggested-by: Jingbo Xu Signed-off-by: Joanne Koong Reviewed-by: Jingbo Xu Reviewed-by: Darrick J. Wong Signed-off-by: Miklos Szeredi commit b1d6bd5462f1e16adb805ce293bd11e9d7c47e6c Author: Puranjay Mohan Date: Wed Feb 25 05:43:38 2026 -0800 bpf, arm64: Use ORR-based MOV for general-purpose registers The A64_MOV macro unconditionally uses ADD Rd, Rn, #0 to implement register moves. While functionally correct, this is not the canonical encoding when both operands are general-purpose registers. On AArch64, MOV has two aliases depending on the operand registers: - MOV , → ADD , , #0 - MOV , → ORR , XZR, The ADD form is required when the stack pointer is involved (as ORR does not accept SP), while the ORR form is the preferred encoding for general-purpose registers. The ORR encoding is also measurably faster on modern microarchitectures. A microbenchmark [1] comparing dependent chains of MOV (ORR) vs ADD #0 on an ARM Neoverse-V2 (72-core, 3.4 GHz) shows: === mov (ORR Xd, XZR, Xn) === run1 cycles/op=0.749859456 run2 cycles/op=0.749991250 run3 cycles/op=0.749601847 avg cycles/op=0.749817518 === add0 (ADD Xd, Xn, #0) === run1 cycles/op=1.004777689 run2 cycles/op=1.004558266 run3 cycles/op=1.004806559 avg cycles/op=1.004714171 The ORR form completes in ~0.75 cycles/op vs ~1.00 cycles/op for ADD #0, a ~25% improvement. This is likely because the CPU's register renaming hardware can eliminate ORR-based moves, while ADD #0 must go through the ALU pipeline. Update A64_MOV to select the appropriate encoding at JIT time: use ADD when either register is A64_SP, and ORR (via aarch64_insn_gen_move_reg()) otherwise. Update verifier_private_stack selftests to expect "mov x7, x0" instead of "add x7, x0, #0x0" in the JITed instruction checks, matching the new ORR-based encoding. [1] https://github.com/puranjaymohan/scripts/blob/main/arm64/bench/run_mov_vs_add0.sh Signed-off-by: Puranjay Mohan Acked-by: Xu Kuohai Link: https://lore.kernel.org/r/20260225134339.2723288-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 7239ae5331ae077c2621740a5db89e65611182cd Author: Thomas Weißschuh Date: Thu Feb 26 22:23:58 2026 +0100 tools/build: Reject unexpected values for LLVM= Since commit 502678b88cb3 ("kbuild: Reject unexpected values for LLVM=") the regular kbuild rejects unexpected values of LLVM=1 instead of silently treating them as LLVM=1. Align the tools build to kbuild. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260226-kbuild-llvm-followup-v1-2-201cc2a492d9@weissschuh.net Signed-off-by: Nicolas Schier commit 8830b2e5907325bd80543bf6001f80819f5cbfc5 Author: Thomas Weißschuh Date: Thu Feb 26 22:23:57 2026 +0100 Documentation/llvm: drop note about LLVM=0 Since commit 502678b88cb3 ("kbuild: Reject unexpected values for LLVM=") LLVM=0 generates an error instead of silently behaving unexpectedly. Drop the now unnecessary note. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20260226-kbuild-llvm-followup-v1-1-201cc2a492d9@weissschuh.net Signed-off-by: Nicolas Schier commit b0cc2e069fae3fba74381609ebc523ceca85cd9a Merge: 39948c2d42b509 0c4fc6bd61054a Author: Alexei Starovoitov Date: Tue Mar 3 08:39:22 2026 -0800 Merge branch 'libbpf-make-optimized-uprobes-backward-compatible' Jiri Olsa says: ==================== libbpf: Make optimized uprobes backward compatible hi, we can currently optimize uprobes on top of nop5 instructions, so application can define USDT_NOP to nop5 and use USDT macro to define optimized usdt probes. This works fine on new kernels, but could have performance penalty on older kernels, that do not have the support to optimize and to emulate nop5 instruction. This patchset adds support to workaround the performance penalty on older kernels that do not support uprobe optimization, please see detailed description in patch 2. v1: https://lore.kernel.org/bpf/20251117083551.517393-1-jolsa@kernel.org/ v2: https://lore.kernel.org/bpf/20260210133649.524292-1-jolsa@kernel.org/ v3: https://lore.kernel.org/bpf/20260211084858.750950-1-jolsa@kernel.org/T/#t v4: https://lore.kernel.org/bpf/20260220104220.634154-1-jolsa@kernel.org/ v5 changes: - keep nop_combo on stack and levae buf uninitialized in has_nop_combo function [David] v4 changes: - rebased on latest bpf-next/master - use pread for nop combo read [Andrii] - renamed usdt triger benchmark names [Andrii] - added more ip address checks to tests [Andrii] v3 changes: - fix __x86_64 define and other typos [CI] - add missing '?' to usdt trigger program [CI] v2 changes: - after more investigation we realized there are some versions of bpftrace and stap that does not work with solution suggested in version 1, so we decided to switch to following solution: - change USDT macro [1] emits nop,nop5 instructions combo by default - libbpf detects nop,nop5 instructions combo for USDT probe, if there is and if uprobe syscall is detected libbpf installs usdt probe on top of nop5 instruction to get it optimized - added usdt trigger benchmarks [Andrii] - several small fixes on uprobe syscall detection, tests and other places [Andrii] - true usdt.h source [1] updated [Andrii] - compile usdt_* objects unconditionally [Andrii] thanks, jirka [1] https://github.com/libbpf/usdt --- ==================== Link: https://patch.msgid.link/20260224103915.1369690-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 0c4fc6bd61054a9378bce149b3758f9b6e8fb5ab Author: Jiri Olsa Date: Tue Feb 24 11:39:15 2026 +0100 selftests/bpf: Add usdt trigger bench Adding usdt trigger bench for usdt: trig-usdt-nop - usdt on top of nop1 instruction trig-usdt-nop5 - usdt on top of nop1/nop5 combo Adding it to benchs/run_bench_uprobes.sh script. Example run on x86_64 kernel with uprobe syscall: # ./benchs/run_bench_uprobes.sh usermode-count : 152.507 ± 0.098M/s syscall-count : 14.309 ± 0.093M/s uprobe-nop : 3.190 ± 0.012M/s uprobe-push : 3.057 ± 0.004M/s uprobe-ret : 1.095 ± 0.009M/s uprobe-nop5 : 7.305 ± 0.034M/s uretprobe-nop : 2.175 ± 0.005M/s uretprobe-push : 2.109 ± 0.003M/s uretprobe-ret : 0.945 ± 0.002M/s uretprobe-nop5 : 3.530 ± 0.006M/s usdt-nop : 3.235 ± 0.008M/s <-- added usdt-nop5 : 7.511 ± 0.045M/s <-- added Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260224103915.1369690-6-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 304841967c5574fec9307a2c1cdfa8abf30a29fc Author: Jiri Olsa Date: Tue Feb 24 11:39:14 2026 +0100 selftests/bpf: Add test for checking correct nop of optimized usdt Adding test that attaches bpf program on usdt probe in 2 scenarios; - attach program on top of usdt_1, which is single nop instruction, so the probe stays on nop instruction and is not optimized. - attach program on top of usdt_2 which is probe defined on top of nop,nop5 combo, so the probe is placed on top of nop5 and is optimized. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260224103915.1369690-5-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 0c178e9debc8f0a305149f5ccace6796f6931a1d Author: Jiri Olsa Date: Tue Feb 24 11:39:13 2026 +0100 selftests/bpf: Emit nop,nop5 instructions combo for x86_64 arch Syncing latest usdt.h change [1]. Now that we have nop5 optimization support in kernel, let's emit nop,nop5 for usdt probe. We leave it up to the library to use desirable nop instruction. [1] https://github.com/libbpf/usdt/commit/c9865d158984fb2b73e3cbbdcdfb4f583ad36a73 Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260224103915.1369690-4-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 41a5c7df4466887a937c91368fa015a2b08cb537 Author: Jiri Olsa Date: Tue Feb 24 11:39:12 2026 +0100 libbpf: Add support to detect nop,nop5 instructions combo for usdt probe Adding support to detect nop,nop5 instructions combo for usdt probe by checking on probe's following nop5 instruction. When the nop,nop5 combo is detected together with uprobe syscall, we can place the probe on top of nop5 and get it optimized. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260224103915.1369690-3-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 05738da0efa1ea7b71244b1eb2e0797f79091f27 Author: Jiri Olsa Date: Tue Feb 24 11:39:11 2026 +0100 libbpf: Add uprobe syscall feature detection Adding uprobe syscall feature detection that will be used in following changes. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260224103915.1369690-2-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 39948c2d42b5093b49f1ad6c3b75df455331ac99 Author: Anand Kumar Shaw Date: Wed Feb 18 09:59:24 2026 +0530 bpf: Add missing XDP_ABORTED handling in cpumap cpu_map_bpf_prog_run_xdp() handles XDP_PASS, XDP_REDIRECT, and XDP_DROP but is missing an XDP_ABORTED case. Without it, XDP_ABORTED falls into the default case which logs a misleading "invalid XDP action" warning instead of tracing the abort via trace_xdp_exception(). Add the missing XDP_ABORTED case with trace_xdp_exception(), matching the handling already present in the skb path (cpu_map_bpf_prog_run_skb), devmap (dev_map_bpf_prog_run), and the generic XDP path (do_xdp_generic). Also pass xdpf->dev_rx instead of NULL to bpf_warn_invalid_xdp_action() in the default case, so the warning includes the actual device name. This aligns with the generic XDP path in net/core/dev.c which already passes the real device. Signed-off-by: Anand Kumar Shaw Link: https://lore.kernel.org/r/20260218042924.42931-1-anandkrshawheritage@gmail.com Signed-off-by: Alexei Starovoitov commit 2ca7f635c7a324690bb5af38f6aa727c69c11dec Merge: 74fef05ef11846 c1eee8d1e84fd1 Author: Alexei Starovoitov Date: Tue Mar 3 08:36:26 2026 -0800 Merge branch 'bpf-fsession-support-for-s390' Menglong Dong says: ==================== bpf: fsession support for s390 Implement bpf fsession for the s390 architecture. Changes v2 -> v1: * keep LGHI as it was in the 1st patch * fix up the comment style * remove the unnecessary checking of fentry->nr_links and fexit->nr_links in the 2nd patch * v1: https://lore.kernel.org/bpf/20260223084022.653186-1-dongml2@chinatelecom.cn/ ==================== Link: https://patch.msgid.link/20260224092208.1395085-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit c1eee8d1e84fd199571b09a0b66d3da6a1d160a9 Author: Menglong Dong Date: Tue Feb 24 17:22:08 2026 +0800 selftests/bpf: factor out get_func_* tests for fsession The fsession is already supported by x86_64, arm64, riscv and s390, so we don't need to disable it in the compile time according to the architecture. Factor out the testings for it. Therefore, the testing can be disabled for the architecture that doesn't support it manually. Signed-off-by: Menglong Dong Acked-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20260224092208.1395085-4-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 63d2b7d101267767f2a87921539b2cbbf9cc48b0 Author: Menglong Dong Date: Tue Feb 24 17:22:07 2026 +0800 bpf,s390: add fsession support for trampolines Implement BPF_TRACE_FSESSION support for s390. The logic here is similar to what we did in x86_64. In order to simply the logic, we factor out the function invoke_bpf() for fentry and fexit. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260224092208.1395085-3-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 339193c44e75d302bae11e93cbb76980912df660 Author: Menglong Dong Date: Tue Feb 24 17:22:06 2026 +0800 bpf,s390: introduce emit_store_stack_imm64() for trampoline Introduce a helper to store 64-bit immediate on the trampoline stack with a help of a register. Signed-off-by: Menglong Dong Acked-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20260224092208.1395085-2-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 74fef05ef11846515f4386d451b176ccb9e062b5 Merge: 309d8808eef93d 0f87614c4dbdd1 Author: Alexei Starovoitov Date: Tue Mar 3 08:35:07 2026 -0800 Merge branch 'bpf-s390-implement-get_preempt_count' Ilya Leoshkevich says: ==================== bpf/s390: Implement get_preempt_count() This series adds get_preempt_count() BPF implementation for s390. On s390 preempt_count lives in lowcore: a per-cpu data structure mapped at virtual address 0 or 0x70000 depending on the kernel command line. Patch 1 adds a kfunc to obtain lowcore address. Patch 2 is the implementation that delegates to it. ==================== Link: https://patch.msgid.link/20260217160813.100855-1-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 0f87614c4dbdd14bbcc23c69b09be58177ce7b9b Author: Ilya Leoshkevich Date: Tue Feb 17 17:05:09 2026 +0100 bpf/s390: Implement get_preempt_count() exe_ctx test fails on s390, because get_preempt_count() is not implemented and its fallback path always returns 0. Implement it using the new bpf_get_lowcore() kfunc. Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20260217160813.100855-3-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 6fe54677bcc2e7a42f5fcaa3c66600232ba54d44 Author: Ilya Leoshkevich Date: Tue Feb 17 17:05:08 2026 +0100 s390: Introduce bpf_get_lowcore() kfunc Implementing BPF version of preempt_count() requires accessing lowcore from BPF. Since lowcore can be relocated, open-coding (struct lowcore *)0 does not work, so add a kfunc. Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20260217160813.100855-2-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 7dc457ace829e2e3efb1503afe992b5f217387c0 Author: Imre Deak Date: Wed Feb 25 18:46:18 2026 +0200 drm/i915/dp: Ack only the handled link service IRQs Ack only those SST link service IRQs that will be handled, similarly to device service IRQs. While at it add asserts that only the known/acked link service IRQs are handled both in the MST and SST case. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-21-imre.deak@intel.com commit 683853b166f051eba43088092d4d1d85cd8ac3cd Author: Imre Deak Date: Wed Feb 25 18:46:17 2026 +0200 drm/i915/dp: Ack only the handled device service IRQs Only those IRQs should be acked that are handled, however for SST all IRQs triggered by the sink are acked. This can be a problem for flags that are reserved/reading zero at a given moment, but become used for some purpose - with a side-effect if set - in a future DPCD revision. Fix the above by acking only those device service IRQs that will be handled. While at it add asserts that only the known/acked device service IRQs are handled both in the MST and SST case. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-20-imre.deak@intel.com commit 0f3675d6472218fdde3e6682ab1ad59618a63e83 Author: Imre Deak Date: Wed Feb 25 18:46:16 2026 +0200 drm/i915/dp_mst: Reuse intel_dp_handle_link_service_irq() Use intel_dp_handle_link_service_irq() while handling an MST HPD IRQ, instead of open-coding this. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-19-imre.deak@intel.com commit 9b9e4f0940789b75f9fc31f73d0e91812edba250 Author: Imre Deak Date: Wed Feb 25 18:46:15 2026 +0200 drm/i915/dp: Check SST link status while handling link service IRQs Move checking the link status for SST to intel_dp_handle_link_service_irq(). This is the logical place for the check which should only happen in response to a LINK_STATUS_CHANGE sink IRQ. This IRQ is only supported by DPCD revision >= 1.2, so for sinks with an older DPCD revision the link status is checked in response to any HPD IRQ. For newer DPCD revisions however the link status check can be made conditional on LINK_STATUS_CHANGE. For now keep the current behavior of always forcing a link status check regardless of LINK_STATUS_CHANGE being set or not. This also prepares for a follow-up change sharing the link service IRQ handler for SST and MST (on MST the link status check only happening in response to a LINK_STATUS_CHANGE IRQ). Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-18-imre.deak@intel.com commit d036488a24d3d7feb5b6f56a1b6b76854f54847c Author: Imre Deak Date: Wed Feb 25 18:46:14 2026 +0200 drm/i915/dp: Print debug message for a sink connected off request So far the CONNECTED_OFF_ENTRY_REQUESTED request was accepted only implicitly, by acking all the IRQs raised by the sink. Make this explicit by printing a debug message. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-17-imre.deak@intel.com commit a4e50c53ccd81d91e435e1889f1b8291fac3580a Author: Imre Deak Date: Wed Feb 25 18:46:13 2026 +0200 drm/i915/dp: Read/ack sink count and sink IRQs for SST as it's done for MST Read and ack the sink count, sink device and link service IRQs for SST the same way this is done for MST, the read/ack happening in separate steps via an ESI (Event Status Indicator) vector. The above way is more efficient, since on newer (DPCD_REV >= 1.2) sinks the DP_SINK_COUNT_ESI..DP_LINK_SERVICE_IRQ_VECTOR_ESI0 registers can be read out in one AUX transaction - and the 3 last one written in one transaction. Also this allows sharing more of the SST and MST IRQ handling code (done as a follow-up). For now keep the current behavior of always reading the legacy DP_SINK_COUNT, DP_DEVICE_SERVICE_IRQ_VECTOR registers and not reading the DP_DEVICE_SERVICE_IRQ_VECTOR_ESI1 register. v2: Document the ESI vector get/ack helper fnuctions' return value. (Jani, Luca) Cc: Jani Nikula Cc: Luca Coelho Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-16-imre.deak@intel.com commit 7b05655171c217d61a95838cac19deb702b166b4 Author: Imre Deak Date: Wed Feb 25 18:46:12 2026 +0200 drm/i915/dp: Return early if getting/ackink link service IRQs fails If getting/acking the link service IRQs fail, the short HPD handler should bail out, falling back to a full connector detection as in case of any AUX access failures during the HPD handling. Do this by separating the getting/acking and handling steps of the IRQs. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-15-imre.deak@intel.com commit 8a21e77c6bfa0a2c6a4e8961fd668906409d0684 Author: Imre Deak Date: Wed Feb 25 18:46:11 2026 +0200 drm/i915/dp: Return early if getting/acking device service IRQs fails If getting/acking the device service IRQs fail, the short HPD handler should bail out, falling back to a full connector detection as in case of any AUX access failures during the HPD handling. Do this by separating the getting/acking and handling steps of the IRQs. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-14-imre.deak@intel.com commit 81e4161dd8f6d3de61392041441df2214d81cc6f Author: Imre Deak Date: Wed Feb 25 18:46:10 2026 +0200 drm/i915/dp: Reprobe connector if getting/acking link service IRQs fails An AUX access failure during HPD IRQ handling should be handled by falling back to a full connector detection, ensure that if the failure happens while reading/acking a link service IRQ. While at it add code comment documenting the return value of intel_dp_check_link_service_irq(). v2: Docuement intel_dp_check_link_service_irq()'s return value. (Jani) Cc: Jani Nikula Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-13-imre.deak@intel.com commit 288b3c518fa3e00d715c9295624dff6184735139 Author: Imre Deak Date: Wed Feb 25 18:46:09 2026 +0200 drm/i915/dp: Reprobe connector if getting/acking device IRQs fails An AUX access failure during HPD IRQ handling should be handled by falling back to a full connector detection, ensure that if the failure happens while reading/acking a device service IRQ. v2: Document intel_dp_check_device_service_irq()'s return value. (Jani, Luca) Cc: Jani Nikula Cc: Luca Coelho Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-12-imre.deak@intel.com commit fbb003f8f722a0c7c8f409973d59dfcc8a54578c Author: Imre Deak Date: Wed Feb 25 18:46:08 2026 +0200 drm/i915/dp: Fix the link service IRQ DPCD_REV check The DP_LINK_SERVICE_IRQ_VECTOR_ESI0 DPCD register is supported only since DPCD REV 1.2, so fix the revision check accordingly. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-11-imre.deak@intel.com commit e0f252bb36dea780971af4736622d2c7be60d122 Author: Imre Deak Date: Wed Feb 25 18:46:07 2026 +0200 drm/i915/dp: Fix the device service IRQ DPCD_REV check The DP_DEVICE_SERVICE_IRQ_VECTOR DPCD register is supported since DPCD REV 1.0, so read it out always. Flags added only by later DPCD revisions are defined as reserved/must-be-zero by earlier DP Standard versions. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-10-imre.deak@intel.com commit 21bd63282215c515e914da4d15c137af737e115b Author: Imre Deak Date: Wed Feb 25 18:46:06 2026 +0200 drm/i915/dp: Remove the device service IRQ handling from connector detect The device service IRQ handling was added to the connector detect function by commit 09b1eb130e43 ("drm/i915: Move Displayport test request and sink IRQ logic to intel_dp_detect()") since some Automated Test Request IRQs couldn't be handled in the short HPD IRQ handler context. This has been fixed meanwhile by deferring the handling of all test request events from the IRQ handler to the hotplug handler (intel_dp_short_pulse() -> intel_dp_test_short_pulse() -> reprobe) and by handling all hotplug events (both for short and long HPD pulses) in the test application. Handling device IRQs during connector detection is not standard compliant (the IRQs should be handled when an HPD IRQ is raised) and it happens in a racy way with the same device IRQ handling happening from the HPD IRQ handler (since the detect and HPD IRQ handler can run in parallel). Based on the above, remove the redundant call from the detect function. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-9-imre.deak@intel.com commit 6997aa23db7ea1c1c062da0e9bf984465872b8d4 Author: Imre Deak Date: Wed Feb 25 18:46:05 2026 +0200 drm/i915/dp: Don't clobber the encoder state in the HPD IRQ handler The intel_dp_get_dpcd() function called from an HPD IRQ handler reads out the DPRX capabilities from the sink and updates these in the intel_dp encoder state. Since the IRQ handler can run in parallel with the encoder/connector detection (intel_dp_detect()) which also calls intel_dp_get_dpcd(), the encoder state can get corrupted, since the two updates happen in a racy way. Fix the above by checking only for any change in the sink count value in the HPD IRQ handler, without updating the encoder state. Note that any state change in the sink requiring an update of the encoder state is handled via the sink's SINK_COUNT change, RX_CAPS_CHANGED, DOWNSTREAM_PORT_STATUS_CHANGED signaling, which all should result in a full connector detection. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-8-imre.deak@intel.com commit a6d89d46d32688943ed3a67d109a4a57d8fdb68d Author: Imre Deak Date: Wed Feb 25 18:46:04 2026 +0200 drm/i915/dp: Handle the DOWNSTREAM_PORT_STATUS_CHANGED event Handle the DOWNSTREAM_PORT_STATUS_CHANGED event a branch device can use to indicate the state change of a DFP connector on the branch device. The event is signaled in the DP_LANE_ALIGN_STATUS_UPDATED DPCD register setting a clear-on-read flag and triggering an HPD IRQ. Accordingly keep a cached version of the flag, updating it whenever DP_LANE_ALIGN_STATUS_UPDATED is read. Schedule a full connector detection from the HPD IRQ handler if the cached flag is set and clear the cached flag at the start of detection. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-7-imre.deak@intel.com commit e55791f5b78d1e2ecba107564e2c7370b8272974 Author: Imre Deak Date: Wed Feb 25 18:46:03 2026 +0200 drm/i915/dp: Handle the RX_CAP_CHANGED HPD IRQ Handle the RX_CAP_CHANGED IRQ, which a sink can use to indicate a DPRX capability change without disconnecting and reconnecting itself (i.e. through a short vs. long HPD pulse). Handle the IRQ by doing a full connector detection. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-6-imre.deak@intel.com commit 90b86782d4993da94089671723c993551cc1fb3e Author: Imre Deak Date: Wed Feb 25 18:46:02 2026 +0200 drm/i915/dp: Handle a tunneling IRQ after acking it HPD IRQs in general should be handled after acking them. The 1. Read IRQ register (read DP_DEVICE_SERVICE_IRQ_VECTOR, DP_LINK_SERVICE_IRQ_VECTOR_ESI0) 2. Handle IRQ 3. Ack IRQ (write DP_DEVICE_SERVICE_IRQ_VECTOR, DP_LINK_SERVICE_IRQ_VECTOR_ESI0) sequence would miss a new interrupt triggered after 2. and before 3., since the flag set in the IRQ register for this interrupt would be cleared in step 3. Fix the above by handling the IRQ after acking it. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-5-imre.deak@intel.com commit db4855d90363d76cc4d6f8bf6aadadc07b7d7c3c Author: Imre Deak Date: Wed Feb 25 18:46:01 2026 +0200 drm/i915/dp_mst: Reuse intel_dp_check_link_state() in the HPD IRQ handler Use intel_dp_check_link_state() in the MST HPD IRQ handler instead of open-coding it. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-4-imre.deak@intel.com commit 1ed0420217fa18fc44a8cba285d10645073ce1a0 Author: Imre Deak Date: Wed Feb 25 18:46:00 2026 +0200 drm/i915/dp_mst: Verify the link status always the same way The MST link status should be always verified from the same DPCD registers after link training. Atm, both the legacy (0x202 - 0x205) and the ESI (0x200C - 0x200F) link status registers are used. Use always the latter ESI version of link status registers. v2: Propagate error from intel_dp_read_link_status(). (Jani, Luca) Cc: Jani Nikula Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-3-imre.deak@intel.com commit c51348f02b19aa292b4e92b465af45503e0210b4 Author: Imre Deak Date: Wed Feb 25 18:45:59 2026 +0200 drm/i915/dp_mst: Reprobe connector if the IRQ ESI read failed An AUX access failure during HPD IRQ handling should be handled by falling back to a full connector detection, do so. Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260225164618.1261368-2-imre.deak@intel.com commit 4f18a79b3585a28c9f73f859fe83f12d0eccc736 Author: Michal Wajdeczko Date: Fri Feb 27 17:00:10 2026 +0100 drm/xe/tests: Change TEST_VRAM to work with 32-bit resource_size_t We've picked the value of TEST_VRAM to match real VRAM size as found on the machines used by the CI, but that didn't work well on kernels that have 32-bit resource_size_t. Use smaller value instead. Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/intel-xe/20260227011639.GA1683727@ax162/ Fixes: cbe29da6f7c0 ("drm/xe/tests: Add KUnit tests for new VRAM fair provisioning") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20260227160010.12425-1-michal.wajdeczko@intel.com commit ac55e8ffc405893fafc5665d97b4c29c285885c1 Author: Jani Nikula Date: Fri Feb 27 19:17:14 2026 +0200 drm/xe/display: clean up xe_initial_plane.c includes Remove excess includes, group and sort include directives. Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/637eab7df00a540df6b7ca1ca345302864b6342f.1772212579.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit cb0f3a171f197325f0831d7d9b0c5388dae0608f Author: Jani Nikula Date: Fri Feb 27 19:17:13 2026 +0200 drm/xe/compat: remove i915_vma.h from compat Move compat i915_vma.h to xe_display_vma.h, and remove all extra cruft. Drop the i915_ggtt_offset() wrapper in favour of using xe_ggtt_node_addr() directly. The usefulness of the I915_TILING_X and I915_TILING_Y undef/define is unclear, since uapi/drm/i915_drm.h is included in other paths as well. The naming of struct i915_vma is a bit unfortunate in xe, but (at least for now) a necessity for maintaining type safety on the opaque type. Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/ecd5d75981b4b21c3da3b1831faceccfe385d898.1772212579.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit dc5f903b3ab6675721c8aa943d5cd0cb5ca2f5c8 Author: Jani Nikula Date: Fri Feb 27 19:17:12 2026 +0200 drm/i915: add VMA to parent interface It's unclear what the direction of the VMA abstraction in the parent interface should be, but convert i915_vma_fence_id() to parent interface for starters. This paves the way for making struct i915_vma opaque towards display. Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/036f4b2d20cc1b0a7ab814beb5bb914c53b6eb53.1772212579.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 2402cc1f85984cff4f3a3b8b95b04fdac7908693 Author: Jani Nikula Date: Fri Feb 27 19:17:11 2026 +0200 drm/i915/fbdev: stop debug logging i915_ggtt_offset() The debug logging in fbdev is the only user of i915_ggtt_offset() in display code. Just stop doing it to drop a dependency on i915_vma.h. Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/c3b84cb572c7ee94389e702aba4dcacb26c41673.1772212579.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit fca11428425e92bf21d4a7f5865708c5e64430e4 Author: Marek Vasut Date: Thu Jan 15 03:39:43 2026 +0100 drm/bridge: waveshare-dsi: Add support for 1..4 DSI data lanes Parse the data lane count out of DT. Limit the supported data lanes to 1..4 which is the maximum available DSI pairs on the connector of any known panels which may use this bridge. Internally, this bridge is an ChipOne ICN6211 which loads its register configuration from a dedicated storage and its I2C does not seem to be accessible. The ICN6211 also supports up to 4 DSI lanes, so this is a hard limit. To avoid any breakage on old DTs where the parsing of data lanes from DT may fail, fall back to the original hard-coded value of 2 lanes and warn user. The lane configuration is preconfigured in the bridge for each of the WaveShare panels. The 13.3" DSI panel works with 4-lane configuration, others seem to use 2-lane configuration. This is a hardware property, so the actual count should come from DT. Reviewed-by: Joseph Guo Signed-off-by: Marek Vasut Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260115024004.660986-2-marek.vasut+renesas@mailbox.org Signed-off-by: Luca Ceresoli commit 2befa6407d5c8b543be32c2276d396db395d9d02 Author: Marek Vasut Date: Thu Jan 15 03:39:42 2026 +0100 dt-bindings: display: bridge: waveshare,dsi2dpi: Document 1..4 DSI lane support Describe 1..4 DSI lanes as supported. Internally, this bridge is an ChipOne ICN6211 which loads its register configuration from a dedicated storage and its I2C does not seem to be accessible. The ICN6211 supports up to 4 DSI lanes, so this is a hard limit for this bridge. The lane configuration is preconfigured in the bridge for each of the WaveShare panels. Signed-off-by: Marek Vasut Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260115024004.660986-1-marek.vasut+renesas@mailbox.org Signed-off-by: Luca Ceresoli commit 9891b52ba12e9d5fed5901b6b5f6e0cdcd424390 Author: Andy Shevchenko Date: Tue Mar 3 10:26:24 2026 +0100 regcache: Factor out regcache_hw_exit() helper Factor out regcache_hw_exit() helper to make error and exit paths clearer. This helps to avoid missing changes in case the code gets shuffled in the future. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260303092820.2818138-2-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit f48e7a246a567e3764112e2463274c479d95cd96 Author: Kuninori Morimoto Date: Tue Mar 3 02:20:33 2026 +0000 ASoC: soc-core: Use guard()/scoped_guard() for mutex lock Replace the manual mutex lock/unlock pairs with guard()/scoped_guard(). Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/875x7dac26.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 29bd06faf727a4b76663e4be0f7d770e2d2a7965 Author: Varun Gupta Date: Mon Feb 23 23:21:45 2026 +0530 drm/xe: Fix memory leak in xe_vm_madvise_ioctl When check_bo_args_are_sane() validation fails, jump to the new free_vmas cleanup label to properly free the allocated resources. This ensures proper cleanup in this error path. Fixes: 293032eec4ba ("drm/xe/bo: Update atomic_access attribute on madvise") Cc: stable@vger.kernel.org # v6.18+ Reviewed-by: Shuicheng Lin Signed-off-by: Varun Gupta Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260223175145.1532801-1-varun.gupta@intel.com Signed-off-by: Tejas Upadhyay commit 51ac0f4b6d5f4965153d8c39644ecfb228480396 Author: Frank Li Date: Wed Jan 21 13:04:15 2026 -0500 dt-bindings: clock: imx6q[ul]-clock: add optional clock enet[1]_ref_pad Add optional clock source enet_ref_pad for imx6q, enet1_ref_pad for imx6ul, which input from ENET ref pad. Acked-by: Conor Dooley Signed-off-by: Frank Li Reviewed-by: Peng Fan Link: https://patch.msgid.link/20260121-ccm_dts-v3-1-820ce9b5fa38@nxp.com Signed-off-by: Abel Vesa commit ed0abfe93fd135dac223e87a3c945017b1fa8bfc Merge: e07bd1f7161fd0 1afccc5a201ec7 Author: Paolo Abeni Date: Tue Mar 3 13:23:46 2026 +0100 Merge branch 'net-phy-improve-stats-handling-in-mdio_bus-c' Heiner Kallweit says: ==================== net: phy: improve stats handling in mdio_bus.c Improve stats handling in mdio_bus.c. ==================== Link: https://patch.msgid.link/799114be-1456-442b-b479-142e7ee9d254@gmail.com Signed-off-by: Paolo Abeni commit 1afccc5a201ec7c9023370958bae1312369b64da Author: Heiner Kallweit Date: Fri Feb 27 23:11:02 2026 +0100 net: phy: improve mdiobus_stats_acct - Remove duplicated preempt disable. Disabling preemption has been added to functions like u64_stats_update_begin() in the meantime. - Simplify branch structure Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/2ceeb542-986a-404e-ad0f-62e0a938ce7c@gmail.com Signed-off-by: Paolo Abeni commit 7f97ca5f9858629f618d7f3b5a16c0d6e48e4353 Author: Heiner Kallweit Date: Fri Feb 27 23:10:17 2026 +0100 net: phy: inline helper mdio_bus_get_global_stat mdio_bus_get_global_stat() has only one user. Inline it to simplify the code. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/7876625a-bd6f-42b4-8eb3-420f39d2f59a@gmail.com Signed-off-by: Paolo Abeni commit 8e0bdf30be75e7af8dc8349205b100c7a9889ff2 Author: Heiner Kallweit Date: Fri Feb 27 23:09:35 2026 +0100 net: mdio: use macro __ATTRIBUTE_GROUPS Use macro __ATTRIBUTE_GROUPS() to simplify the code. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/260fb184-c662-415c-b288-e1423097f2b9@gmail.com Signed-off-by: Paolo Abeni commit a4c08b701559c5a3039f3bdf0b5286ca02877985 Author: Heiner Kallweit Date: Fri Feb 27 23:08:58 2026 +0100 net: mdio: constify attributes and attribute arrays Constify attributes and attribute arrays, using new member attrs_const of struct attribute_group. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/c20f17bb-3489-42b5-b8fe-457245ac6cb3@gmail.com Signed-off-by: Paolo Abeni commit c599649d05a072a6ff7c4012e57cbabab7a2d57e Author: Heiner Kallweit Date: Fri Feb 27 23:07:56 2026 +0100 net: phy: avoid extra casting in mdio_bus_get_stat Using void * instead of char * allows to remove one cast. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/054bbf60-d8ac-45ce-8b80-9c396469b7f9@gmail.com Signed-off-by: Paolo Abeni commit 8068acaff1250d836a97ebef4659548b435858f2 Author: Heiner Kallweit Date: Fri Feb 27 23:07:16 2026 +0100 net: phy: consider that mdio_bus_device_stat_field_show doesn't use member address mdio_bus_device_stat_field_show() doesn't use the address member, so we don't have to initialize it. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/03a812a7-6871-4cc0-b5bf-ee80c6d6b5fd@gmail.com Signed-off-by: Paolo Abeni commit 807d8addc3ec6e3b89523dc65096594e9e549c1a Author: Heiner Kallweit Date: Fri Feb 27 23:06:28 2026 +0100 net: mdio: use macro __ATTR to simplify the code Use macro __ATTR to simplify the code. Note that __ATTR can't be used in MDIO_BUS_STATS_ADDR_ATTR_DECL because the included stringification would conflict with how argument file is passed. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/4877a4dc-247c-4453-b281-20a8d969b15b@gmail.com Signed-off-by: Paolo Abeni commit 5c494f404a3fa5181f038b8c328a3e0dc4cc2e18 Author: Heiner Kallweit Date: Fri Feb 27 23:05:18 2026 +0100 net: mdio: extend struct mdio_bus_stat_attr instead of using dev_ext_attribute Currently the var member of struct dev_ext_attribute is used in a very ugly way. Extend struct mdio_bus_stat_attr instead, what allows to simplify the code and also slightly reduces memory footprint. Note: Member addr is renamed to avoid a conflict in macro MDIO_BUS_STATS_ADDR_ATTR_DECL. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/ce9f85d2-4f72-4b15-b868-210a8ced662d@gmail.com Signed-off-by: Paolo Abeni commit 07eb8b54166b208ca23382d650b5262a26a4492b Author: Himal Prasad Ghimiray Date: Wed Feb 25 22:17:48 2026 +0530 drm/xe/guc: Skip access counter queue init for unsupported platforms Add a has_access_counter feature flag to the graphics IP descriptor and skip writing parameters for the access counter queue in guc_um_init_params(), leaving queue_params[2] zero-initialized to signal unavailability to the GuC. The queue_params[] array layout is fixed by firmware ABI, so we maintain the structure with queues 0 and 1 (page fault request/response) always configured, and queue 2 conditionally skipped based on the has_access_counter flag. Bspec: 59323 Cc: Stuart Summers Cc: Matt Roper Suggested-by: Daniele Ceraolo Spurio Signed-off-by: Himal Prasad Ghimiray Signed-off-by: Varun Gupta Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260225164748.2302380-1-varun.gupta@intel.com Signed-off-by: Tejas Upadhyay commit e07bd1f7161fd0918e644d97e11608854c3bf14b Author: Heiner Kallweit Date: Fri Feb 27 21:52:16 2026 +0100 net: ti: davinci_emac: stop using bus type mdio_bus_type This driver is the only user of mdio_bus_type outside phylib. Using mdio_bus_type isn't strictly needed here, so use an alternative approach. This will allow to make mdio_bus_type private to phylib in a follow-up series. Compile-tested only. Note: Devices supported by this driver are OF-only, therefore the string comparison in match_first_device() isn't needed any longer. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/cc8e83aa-48c3-4497-b6ad-760a7f9e25dc@gmail.com Signed-off-by: Paolo Abeni commit 86a14330bf0598ce89177cebcc19e2cf810abf44 Author: Karol Wachowski Date: Mon Mar 2 21:22:07 2026 +0100 accel/ivpu: Limit number of maximum contexts and doorbells per user Implement per-user resource limits to prevent resource exhaustion. Root users can allocate all available contexts (128) and doorbells (255), while non-root users are limited to half of the available resources (64 contexts and 127 doorbells respectively). This prevents scenarios where a single user could monopolize NPU resources and starve other users on multi-user systems. Change doorbell ID and command queue ID allocation errors to debug messages as those are user triggered. Signed-off-by: Karol Wachowski Reviewed-by: Lizhi Hou Signed-off-by: Maciej Falkowski Link: https://patch.msgid.link/20260302202207.469442-1-maciej.falkowski@linux.intel.com commit f56438a74d8809fa0c28811cd782a74477994fdd Author: MD Danish Anwar Date: Fri Feb 27 23:12:54 2026 +0530 net: ti: icssg: Add HSR/PRP protocol frame filtering Add support for HSR and PRP protocol frame filtering in the ICSSG classifier by configuring filter table 3 (FT3) to detect PTP frames (EtherType 0x88F7) in HSR/PRP tagged packets. Also add rx_class_or_base to miig_rt_offsets structure to support RX_CLASS_OR register access, and fix typos in FT1_N_REG and FT3_N_REG macros (slize -> slice). Signed-off-by: MD Danish Anwar Link: https://patch.msgid.link/20260227174254.3821443-1-danishanwar@ti.com Signed-off-by: Paolo Abeni commit c006396f59aae01fccc758a0243402f5c0a9a54d Merge: 2b12ffb6695539 3a97e02b3e91e4 Author: Paolo Abeni Date: Tue Mar 3 12:15:32 2026 +0100 Merge branch 'dpll-zl3073x-consolidate-chip-info-and-add-temperature-reporting' Ivan Vecera says: ==================== dpll: zl3073x: consolidate chip info and add temperature reporting This series refactors the ZL3073x chip variant handling and adds die temperature reporting for chips that support it. Patch 1 replaces the five per-variant chip_info structures and their exported symbols with a single consolidated lookup table. The chip variant is now detected at runtime from the chip ID register rather than being selected at compile time via bus driver match data. This simplifies the I2C/SPI drivers and makes adding new variants a single-line table addition. A flags field replaces the hardcoded chip_id switch in zl3073x_dev_is_ref_phase_comp_32bit(). Patch 2 uses the new flags infrastructure to add die temperature reporting for chip variants that provide a temperature status register. The temp_get callback is conditionally set during device registration based on the ZL3073X_FLAG_DIE_TEMP chip flag. ==================== Link: https://patch.msgid.link/20260227105300.710272-1-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 3a97e02b3e91e4d40095ad9bb6e466d8d7c1a1bc Author: Ivan Vecera Date: Fri Feb 27 11:53:00 2026 +0100 dpll: zl3073x: add die temperature reporting for supported chips Some zl3073x chip variants (0x1Exx, 0x2Exx and 0x3FC4) provide a die temperature status register with 0.1 C resolution. Add a ZL3073X_FLAG_DIE_TEMP chip flag to identify these variants and implement zl3073x_dpll_temp_get() as the dpll_device_ops.temp_get callback. The register value is converted from 0.1 C units to millidegrees as expected by the DPLL subsystem. To support per-instance ops selection, copy the base dpll_device_ops into struct zl3073x_dpll and conditionally set .temp_get during device registration based on the chip flag. Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260227105300.710272-3-ivecera@redhat.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit 4845f2fff730f0cdf8f7fe6401c8b871891cf1cb Author: Ivan Vecera Date: Fri Feb 27 11:52:59 2026 +0100 dpll: zl3073x: detect DPLL channel count from chip ID at runtime Replace the five per-variant zl3073x_chip_info structures and their exported symbol definitions with a single consolidated chip ID lookup table. The chip variant is now detected at runtime by reading the chip ID register from hardware and looking it up in the table, rather than being selected at compile time via the bus driver match data. Repurpose struct zl3073x_chip_info to hold a single chip ID, its channel count, and a flags field. Introduce enum zl3073x_flags with ZL3073X_FLAG_REF_PHASE_COMP_32 to replace the chip_id switch statement in zl3073x_dev_is_ref_phase_comp_32bit(). Store a pointer to the detected chip_info entry in struct zl3073x_dev for runtime access. This simplifies the bus drivers by removing per-variant .data and .driver_data references from the I2C/SPI match tables, and makes adding support for new chip variants a single-line table addition. Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260227105300.710272-2-ivecera@redhat.com Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit 5d048bbed1bb2bbef612dad0bb9c177c434e63a4 Author: Johannes Berg Date: Wed Jan 28 14:24:12 2026 +0100 wifi: mac80211: give the AP more time for EPPKE as well EPPKE authentication can use SAE (via PASN), so give the AP more time to respond to EPPKE case just like for SAE. Link: https://patch.msgid.link/20260128132414.881741-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg commit 9c5ef7a30d9044f8706bd02bfdc4eff7266f3e25 Author: Leo Yan Date: Thu Feb 26 09:23:56 2026 +0000 coresight: cti: Properly handle negative offsets in cti_reg32_{show|store}() Return an error when the offset is negative. Signed-off-by: Leo Yan Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-8-b30fada3cfec@arm.com commit d5e57babdffb961ca8b51910d00c2c0ddb03c54a Author: Leo Yan Date: Thu Feb 26 09:23:55 2026 +0000 coresight: cti: Remove hw_enabled flag The enable_req_count field already tracks whether the CTI device is enabled. A non-zero value indicates that the device is active, the hw_enabled flag is redundant if so. Remove hw_enabled and update cti_is_active() to check enable_req_count. Replace open-coded enable_req_count checks with cti_is_active(). Reviewed-by: Mike Leach Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-7-b30fada3cfec@arm.com commit daedb30fd6ac68a100912407aba3a4fdba8a4080 Author: Leo Yan Date: Thu Feb 26 09:23:54 2026 +0000 coresight: cti: Remove hw_powered flag Since the CPU PM code has been removed from the CTI driver and the device is enabled via runtime PM, pm_runtime_active() can be used to check whether the device is powered. As a result, the hw_powered flag is redundant, remove it. Reviewed-by: Mike Leach Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-6-b30fada3cfec@arm.com commit b727e7bba3ff2b4da3e71628c85f2c2dd9ef471a Author: Leo Yan Date: Thu Feb 26 09:23:53 2026 +0000 coresight: cti: Rename cti_active() to cti_is_active() Rename cti_active() to cti_is_active() to clarify that it checks whether the CTI device is active. Reviewed-by: Mike Leach Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-5-b30fada3cfec@arm.com commit 59213b4be5c109414f8240f6389b3fc3a7f48b4d Author: Leo Yan Date: Thu Feb 26 09:23:52 2026 +0000 coresight: cti: Remove CPU power management code According Arm ARM, the CTI ASICCTL register: "It is IMPLEMENTATION DEFINED whether ASICCTL is implemented in the Core power domain or in the Debug power domain." This is the only CTI register that may reside in the core power domain. However, it has been confirmed that Arm designed CTIs place ASICCTL in the debug power domain. Furthermore, ASICCTL is implemented only when CTIDEVID.EXTMUXNUM is non-zero, which is a rare case for CPU CTIs. For these reasons, it is safe to conclude that all CTI registers are not located in the CPU power domain. Therefore, the CTI driver does not need CPU power management. This commit removes the CPU power management from CTI driver. Reviewed-by: Mike Leach Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-4-b30fada3cfec@arm.com commit b4d9ef475ec71e13e1ec395e9b9e6b165506a564 Author: Leo Yan Date: Thu Feb 26 09:23:51 2026 +0000 coresight: cti: Access ASICCTL only when implemented According to the Arm ARM (DDI 0487 L.b), ASICCTL is implemented only when CTIDEVID.EXTMUXNUM is non-zero. Based on CTIDEVID.EXTMUXNUM, add a flag 'asicctl_impl' to indicate whether the register is implemented, and access ASICCTL conditionally based on the flag. Allow the sysfs node to be visible only when the register is implemented. Reviewed-by: Mike Leach Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-3-b30fada3cfec@arm.com commit 6582fe69ac4b1b575e023f5110427c15fbf5ad36 Author: Leo Yan Date: Thu Feb 26 09:23:50 2026 +0000 coresight: cti: Fix register reads Introduce cti_read_single_reg() as an interface for reading registers with unlocking the CS lock. Consolidate register read in sysfs interfaces using this new helper. Fixes: b5213376c240 ("coresight: cti: Add sysfs access to program function registers") Fixes: 1a556ca6cc24 ("coresight: cti: Add sysfs coresight mgmt register access") Reviewed-by: Mike Leach Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-2-b30fada3cfec@arm.com commit ef7d4aaf686785b8b0f70c9fe373fb5455d3e5b5 Author: Leo Yan Date: Thu Feb 26 09:23:49 2026 +0000 coresight: cti: Make spinlock usage consistent The spinlock is acquired sometimes with IRQs disabled and sometimes without. This leads to inconsistent semantics: the lock can be either HARDIRQ-safe or HARDIRQ-unsafe, which may trigger lockdep complaints. Make spinlock usage consistent by acquiring it with disabling IRQs. It is possible for sysfs knobs to acquire the spinlock for accessing a CTI device, while at the same time a perf session sends an IPI to enable the same CTI device. In this case, the spinlock must be IRQ-safe, which is why all lock acquisitions are changed to disable IRQs. Use guard() and scoped_guard() for spinlock to tidy up the code. Fixes: 984f37efa385 ("coresight: cti: Write regsiters directly in cti_enable_hw()") Tested-by: James Clark Reviewed-by: Mike Leach Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260226-arm_coresight_cti_refactor_v1-v2-1-b30fada3cfec@arm.com commit 2b12ffb669553972f5cd017c69a2b81593b09106 Author: Dipayaan Roy Date: Fri Feb 27 00:15:02 2026 -0800 net: mana: Trigger VF reset/recovery on health check failure due to HWC timeout The GF stats periodic query is used as mechanism to monitor HWC health check. If this HWC command times out, it is a strong indication that the device/SoC is in a faulty state and requires recovery. Today, when a timeout is detected, the driver marks hwc_timeout_occurred, clears cached stats, and stops rescheduling the periodic work. However, the device itself is left in the same failing state. Extend the timeout handling path to trigger the existing MANA VF recovery service by queueing a GDMA_EQE_HWC_RESET_REQUEST work item. This is expected to initiate the appropriate recovery flow by suspende resume first and if it fails then trigger a bus rescan. This change is intentionally limited to HWC command timeouts and does not trigger recovery for errors reported by the SoC as a normal command response. Signed-off-by: Dipayaan Roy Reviewed-by: Haiyang Zhang Reviewed-by: Simon Horman Link: https://patch.msgid.link/aaFShvKnwR5FY8dH@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Paolo Abeni commit 6716101ae42949e98ad4b9e71eeba08c055be410 Merge: ad595a8aeeabfb 17b95278ae6adb Author: Thomas Zimmermann Date: Tue Mar 3 10:40:37 2026 +0100 Merge drm/drm-next into drm-misc-next Backmerge fixes from v7.0-rc2 into drm-misc-next. Signed-off-by: Thomas Zimmermann commit cbbf2df81dd9ed1623bf290a799d4e6b77fedd29 Author: Imre Deak Date: Mon Mar 2 12:28:38 2026 +0200 drm/i915/dp: Fix DSC state computation When computing the encoder/CRTC state multiple times, such as during iteration over the possible pipe joiner configurations, it must be ensured that all state is explicitly initialized each time. At the moment, this is not guaranteed for the DSC/FEC state within the encoder/CRTC state. In one iteration trying a pipe joiner configuration, the DSC state may get initialized without computing the full CRTC/encoder state due to the given joiner configuration being impossible. When the same CRTC/encoder state is recomputed in a subsequent iteration, the previously set non-zero - now stale - DSC/FEC state may still be present, which is unexpected if a non-DSC configuration is being computed. This can lead to a DSC state mismatch error if multiple joiner configurations are evaluated and the working configuration ultimately turns out to be a non-DSC one. Follow the existing pattern and compute the full (DSC/FEC) state on all code paths (including now the non-DSC path as well) to fix the issue. Fixes: 1f1e3e5c65f6 ("drm/i915/dp: Rework pipe joiner logic in compute_config") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7512 Cc: Ankit Nautiyal Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260302102838.1522499-1-imre.deak@intel.com commit 65161470f95bb579a72673bf303ecf0800b9054b Author: Joanne Koong Date: Tue Jan 20 14:44:46 2026 -0800 fuse: validate outarg offset and size in notify store/retrieve Add validation checking for outarg offset and outarg size values passed in by the server. MAX_LFS_FILESIZE is the maximum file size supported. The fuse_notify_store_out and fuse_notify_retrieve_out structs take in a uint64_t offset. Add logic to ensure: * outarg.offset is less than MAX_LFS_FILESIZE * outarg.offset + outarg.size cannot exceed MAX_LFS_FILESIZE * potential uint64_t overflow is fixed when adding outarg.offset and outarg.size. Signed-off-by: Joanne Koong Signed-off-by: Miklos Szeredi commit 59ba47b6be9cd0146ef9a55c6e32e337e11e7625 Author: Bernd Schubert Date: Sun Jan 11 12:48:07 2026 +0100 fuse: Check for large folio with SPLICE_F_MOVE xfstest generic/074 and generic/075 complain result in kernel warning messages / page dumps. This is easily reproducible (on 6.19) with CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ALWAYS=y CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ALWAYS=y This just adds a test for large folios fuse_try_move_folio with the same page copy fallback, but to avoid the warnings from fuse_check_folio(). Cc: stable@vger.kernel.org Signed-off-by: Bernd Schubert Signed-off-by: Horst Birthelmer Signed-off-by: Miklos Szeredi commit 129a45f9755a89f573c6a513a6b9e3d234ce89b0 Author: Darrick J. Wong Date: Mon Feb 23 15:06:50 2026 -0800 fuse: quiet down complaints in fuse_conn_limit_write gcc 15 complains about an uninitialized variable val that is passed by reference into fuse_conn_limit_write: control.c: In function ‘fuse_conn_congestion_threshold_write’: include/asm-generic/rwonce.h:55:37: warning: ‘val’ may be used uninitialized [-Wmaybe-uninitialized] 55 | *(volatile typeof(x) *)&(x) = (val); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~ include/asm-generic/rwonce.h:61:9: note: in expansion of macro ‘__WRITE_ONCE’ 61 | __WRITE_ONCE(x, val); \ | ^~~~~~~~~~~~ control.c:178:9: note: in expansion of macro ‘WRITE_ONCE’ 178 | WRITE_ONCE(fc->congestion_threshold, val); | ^~~~~~~~~~ control.c:166:18: note: ‘val’ was declared here 166 | unsigned val; | ^~~ Unfortunately there's enough macro spew involved in kstrtoul_from_user that I think gcc gives up on its analysis and sprays the above warning. AFAICT it's not actually a bug, but we could just zero-initialize the variable to enable using -Wmaybe-uninitialized to find real problems. Previously we would use some weird uninitialized_var annotation to quiet down the warnings, so clearly this code has been like this for quite some time. Cc: stable@vger.kernel.org # v5.9 Fixes: 3f649ab728cda8 ("treewide: Remove uninitialized_var() usage") Signed-off-by: Darrick J. Wong Signed-off-by: Miklos Szeredi commit f595dda929e1b914f605de7cc3ff6a6888e3d66b Author: Luis Henriques Date: Wed Feb 25 11:24:35 2026 +0000 fuse: drop unnecessary argument from fuse_lookup_init() Remove the fuse_conn argument from function fuse_lookup_init() as it isn't used since commit 21f621741a77 ("fuse: fix LOOKUP vs INIT compat handling"). Signed-off-by: Luis Henriques Signed-off-by: Miklos Szeredi commit 5223e0470e7bb7910038fe3d31171490e00fbbb9 Author: Jingbo Xu Date: Thu Jan 15 10:36:07 2026 +0800 fuse: fix premature writetrhough request for large folio When large folio is enabled and the initial folio offset exceeds PAGE_SIZE, e.g. the position resides in the second page of a large folio, after the folio copying the offset (in the page) won't be updated to 0 even though the expected range is successfully copied until the end of the folio. In this case fuse_fill_write_pages() exits prematurelly before the request has reached the max_write/max_pages limit. Fix this by eliminating page offset entirely and use folio offset instead. Fixes: d60a6015e1a2 ("fuse: support large folios for writethrough writes") Reviewed-by: Horst Birthelmer Reviewed-by: Joanne Koong Signed-off-by: Jingbo Xu Signed-off-by: Miklos Szeredi commit ad595a8aeeabfbfcc0026b9892a8155bc0763416 Author: Thomas Zimmermann Date: Fri Feb 27 14:31:11 2026 +0100 drm/vc4: Test for imported buffers with drm_gem_is_imported() Instead of testing import_attach for imported GEM buffers, invoke drm_gem_is_imported() to do the test. The test itself does not change. Signed-off-by: Thomas Zimmermann Cc: Maxime Ripard Cc: Dave Stevenson Cc: "Maíra Canal" Cc: Raspberry Pi Kernel Maintenance Reviewed-by: Maíra Canal Link: https://patch.msgid.link/20260227133113.235940-12-tzimmermann@suse.de commit c70708c53ddbda691169f03f8dcbcc4f117518bf Author: Thomas Zimmermann Date: Fri Feb 6 14:21:58 2026 +0100 drm/gma500: Create framebuffers with drm_gem_fb_create() Replace gma500's internal framebuffer creation with DRM's standard helper drm_gem_fb_create(). The result is equivalent. Only keep the existing tests for color depth and pitch alignment. v2: - rebase on upstream changes Signed-off-by: Thomas Zimmermann Acked-by: Patrik Jakobsson Link: https://patch.msgid.link/20260206133458.226467-6-tzimmermann@suse.de commit 581a5bfe758353d95d9829146c0b673843e36e25 Author: Thomas Zimmermann Date: Fri Feb 6 14:21:57 2026 +0100 drm/gma500: fbdev: Use a DRM client buffer Replace the internal DRM framebuffer with a DRM client buffer. The client buffer allocates the DRM framebuffer on a file and also uses GEM object handles via the regular ADDFB2 interfaces. This unifies framebuffer allocation for clients in user space and gma500's internal fbdev emulation. Also simplify the clean-up side of the fbdev emulation. Later patches will allow for streamlining gma500's framebuffer code and DRM's fbdev emulation in general. Signed-off-by: Thomas Zimmermann Acked-by: Patrik Jakobsson Link: https://patch.msgid.link/20260206133458.226467-5-tzimmermann@suse.de commit aaea2359a6ba7442a4cacb66d915d66b618fe9b6 Author: Thomas Zimmermann Date: Fri Feb 6 14:21:56 2026 +0100 drm/gma500: fbdev: Calculate buffer geometry with format helpers Replace the geometry and size calculation in gma500's fbdev emulation with DRM format helpers. This consists of 4CC lookup from the fbdev parameters, format loockup, pitch calculation and size calculation. Then allocate the GEM buffer object for the framebuffer memory from the calculated size. As before, fallback to 16-bit colors if the stolen memory is insufficient for 32-bit colors. But look at the result from psb_gem_create() instead of guessing before the allocation. The new method is more reliable when others allocate from stolen video memory (e.g., cursors). Set up mode_cmd with the calculated values just before allocating the framebuffer. This code will later be replaced with a DRM client buffer. Signed-off-by: Thomas Zimmermann Acked-by: Patrik Jakobsson Link: https://patch.msgid.link/20260206133458.226467-4-tzimmermann@suse.de commit bbc1d2105481d47d2441ba061529c490ccb7f27f Author: Thomas Zimmermann Date: Fri Feb 6 14:21:55 2026 +0100 drm/gma500: fbdev: Set framebuffer size to GEM object size Framebuffer emulation sets the size of the available memory to the value that has been requested. As the allocated GEM buffer object acts as full framebuffer memory, set the size to the value of the actually allocated buffer. Signed-off-by: Thomas Zimmermann Acked-by: Patrik Jakobsson Link: https://patch.msgid.link/20260206133458.226467-3-tzimmermann@suse.de commit e0afbfe321d5131c56005f56fbf5d548340da749 Author: Thomas Zimmermann Date: Fri Feb 6 14:21:54 2026 +0100 drm/client: Export drm_client_buffer_create() The helper drm_client_buffer_create() will be required by various drivers for fbdev emulation. Signed-off-by: Thomas Zimmermann Acked-by: Patrik Jakobsson Link: https://patch.msgid.link/20260206133458.226467-2-tzimmermann@suse.de commit b8eb97ead862de7a321dd55a901542a372f8f1cd Author: Marek Vasut Date: Fri Feb 6 13:57:53 2026 +0100 drm/bridge: waveshare-dsi: Register and attach our DSI device at probe In order to avoid any probe ordering issue, the best practice is to move the secondary MIPI-DSI device registration and attachment to the MIPI-DSI host at probe time. Besides solving the probe ordering problems, this makes the bridge work with R-Car DU. The R-Car DU will attempt to locate the DSI host bridge in its own rcar_du_probe()->rcar_du_modeset_init()->rcar_du_encoder_init() by calling of_drm_find_bridge() which calls of_drm_find_and_get_bridge() and iterates over bridge_list to locate the DSI host bridge. However, unless the WS driver calls mipi_dsi_attach() in probe(), the DSI host bridge .attach callback rcar_mipi_dsi_host_attach() is not called and the DSI host bridge is not added into bridge_list. Therefore the of_drm_find_and_get_bridge() called from du_probe() will never find the DSI host bridge and probe will indefinitelly fail with -EPROBE_DEFER. The circular dependency here is, that if rcar_du_encoder_init() would manage to find the DSI host bridge, it would call the WS driver .attach callback ws_bridge_bridge_attach(), but this is too late and can never happen. This change avoids the circular dependency. Reviewed-by: Luca Ceresoli Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260206125801.78705-1-marek.vasut+renesas@mailbox.org Signed-off-by: Luca Ceresoli commit abdcd4c3586dee8c190ac932cb544036b0c937b9 Author: Sanjay Yadav Date: Fri Feb 27 18:30:38 2026 +0530 gpu/buddy: Introduce gpu_buddy_assert() for kunit-aware assertions Introduce gpu_buddy_assert(), a small helper that wraps WARN_ON() and, when CONFIG_KUNIT is enabled, also calls kunit_fail_current_test() so that any active KUnit test is marked as failed. In non-KUnit builds the macro reduces to WARN_ON(), preserving existing behaviour. Stringify the asserted condition in the failure message to make it easy to identify which assertion fired. Leave the WARN_ON() in gpu_buddy_block_trim() unchanged, as it returns -EINVAL and the caller already observes the failure via the return code. Cc: Christian König Cc: Arunpravin Paneer Selvam Suggested-by: Matthew Auld Signed-off-by: Sanjay Yadav Reviewed-by: Arunpravin Paneer Selvam Signed-off-by: Arunpravin Paneer Selvam Link: https://patch.msgid.link/20260227130037.53615-2-sanjay.kumar.yadav@intel.com commit 01086b97dcc92799bd03cd243ed6061fd21db7a6 Author: Bart Van Assche Date: Fri Feb 27 08:55:01 2026 -0800 dma-buf: Suppress a thread-safety complaint Handle all possible dma_resv_lock() return values. This patch prepares for enabling compile-time thread-safety analysis. This will cause the compiler to check whether all dma_resv_lock() return values are handled. Signed-off-by: Bart Van Assche Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260227165501.2062829-1-bvanassche@acm.org commit bf64b1bae2a555043c8360836c6e708339ac078f Author: Matthijs Kooijman Date: Mon Mar 2 21:17:17 2026 +0100 gpio: rockchip: Call pinctrl for gpio config Pinctrl is responsible for bias settings and possibly other pin config, so call gpiochip_generic_config to apply such config values. This might also include settings that pinctrl does not support, but then it can return ENOTSUPP as appropriate. Signed-off-by: Matthijs Kooijman Signed-off-by: Linus Walleij commit 8f72335002db29fb593f8c2c25761feb3b947eb3 Author: Felix Gu Date: Tue Mar 3 02:13:17 2026 +0800 pinctrl: microchip-mssio: Fix missing return in probe In mpfs_pinctrl_probe(), when pctrl->regmap fails, it just print out an error message without return, which could lead serious errors. Fixes: 488d704ed7b7 ("pinctrl: add polarfire soc mssio pinctrl driver") Signed-off-by: Felix Gu Reviewed-by: Conor Dooley Signed-off-by: Linus Walleij commit 33d4feff673bb32d3c94a6f25e7ca0be966ef410 Author: Michal Piekos Date: Sun Mar 1 17:46:31 2026 +0100 pinctrl: core: use dev_err_probe() when applying state When applying a pinctrl state, -EPROBE_DEFER may be returned if dependencies are not ready and the consumer will retry probing. This is normal probe ordering behaviour and not a real error. However, pinctrl core currently logs: "Error applying setting, reverse things back" even when the return value is -EPROBE_DEFER, resulting in noisy boot-time error messages. Replace dev_err() with dev_err_probe() to handle -EPROBE_DEFER consistently and suppress error logging for deferred probes. No functional change intended. Signed-off-by: Michal Piekos Signed-off-by: Linus Walleij commit 2d14bf98e6b445afbb799b170448f628f6d4ab69 Author: Thierry Reding Date: Thu Feb 26 16:12:12 2026 +0100 cpufreq: tegra194: Rename Tegra239 to Tegra238 This chip identifies as Tegra238, so update the device tree compatible string and data structures associated with it to use the correct name. Signed-off-by: Thierry Reding Signed-off-by: Viresh Kumar commit a3e93d8733490a72abb4e27e01d88f5bdc741271 Author: Thierry Reding Date: Thu Feb 26 16:12:11 2026 +0100 dt-bindings: arm: nvidia: Document the Tegra238 CCPLEX cluster Tegra238 is derived from Tegra234 and uses a similar CCPLEX cluster, with slight variations but the same programming model. Add a compatible string to specify this particular implementation. Signed-off-by: Thierry Reding Acked-by: Conor Dooley Signed-off-by: Viresh Kumar commit a42622e30f89fee66c1d55594348fe4df1e21669 Author: Abel Vesa Date: Mon Feb 23 10:50:18 2026 +0200 dt-bindings: cpufreq: qcom-hw: document Eliza cpufreq hardware Document the cpufreq hardware on the Eliza SoC. Signed-off-by: Abel Vesa Signed-off-by: Viresh Kumar commit 7dbfba0ba0b99661266c93cd9025d47197241511 Author: Suraj Kandpal Date: Mon Mar 2 09:36:12 2026 +0530 drm/i915/backlight: Provide clear description on how backlight level is controlled Currently it takes us multiple log prints to arrive at the conclusion on how we are actually controlling backlight level. Make the logging concise. Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://patch.msgid.link/20260302040613.3324049-8-suraj.kandpal@intel.com commit ef8ed2ddd1cd1457befb4e94f996fd5ee82ff7e4 Author: Suraj Kandpal Date: Mon Mar 2 09:36:11 2026 +0530 drm/i915/backlight: Update debug log during backlight setup With luminance_set which represents PANEL_LUMINANCE_OVERRIDE, we have another variable to decide if we use PWM or DPCD. Make drm_dbg_kms log represent that. Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://patch.msgid.link/20260302040613.3324049-7-suraj.kandpal@intel.com commit c7677f4e7523be347551192c8cda9a0cfb7d4843 Author: Suraj Kandpal Date: Mon Mar 2 09:36:10 2026 +0530 drm/i915/backlight: Short circuit intel_dp_aux_supports_hdr_backlight intel_dp_aux_supports_hdr_backlight() prints debug message for intel HDR backlight version. This is fine when dealing with eDP 1.4b and lower. When we are talking about eDP 1.5 it causes confusion in logs since we need to use VESA AUX backlight functions but this print causes confusion as to which path code take. Short circuit this function with a eDP version check. Make sure this is only called if eDP <= 1.4b Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://patch.msgid.link/20260302040613.3324049-6-suraj.kandpal@intel.com commit e2b83593f6bced361cf3a45e6f290b5124527e74 Author: Suraj Kandpal Date: Mon Mar 2 09:36:09 2026 +0530 drm/i915/backlight: Check luminance_set when disabling PWM via AUX VESA backlight When deciding what if PWM funcs need to be disabled take into account luminance_set too. We do this since it is also used to decide if we are enabling PWM backlight funcs or not. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15671 Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://patch.msgid.link/20260302040613.3324049-5-suraj.kandpal@intel.com commit 79e870c86d30c6e2e1e3b68723158a8b1f0079eb Author: Suraj Kandpal Date: Mon Mar 2 09:36:08 2026 +0530 drm/i915/backlight: Take luminance_set into account for VESA backlight When deciding what functions to enable to help control backlight we used to only check aux_enable. Now with PANEL_LUMINANCE_OVERRIDE in picture we need to take care that we do not enable PWM function if luminance_set is set. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15671 Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://patch.msgid.link/20260302040613.3324049-4-suraj.kandpal@intel.com commit c15a236644b1c495e22985f9ddb323de006cfafc Author: Suraj Kandpal Date: Mon Mar 2 09:36:07 2026 +0530 drm/i915/backlight: Use intel_panel variable instead of intel_connector Use the intel_panel variable since it has already been declared and looks cleaner. Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://patch.msgid.link/20260302040613.3324049-3-suraj.kandpal@intel.com commit 039cd522dc70151da13329a5e3ae19b1736f468a Author: Duoming Zhou Date: Mon Feb 23 12:55:22 2026 +0800 wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware. But it is never killed in rtl_pci_deinit(). When the rtlwifi card probe fails or is being detached, the ieee80211_hw is deallocated. However, irq_prepare_bcn_tasklet may still be running or pending, leading to use-after-free when the freed ieee80211_hw is accessed in _rtl_pci_prepare_bcn_tasklet(). Similar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to ensure that irq_prepare_bcn_tasklet is properly terminated before the ieee80211_hw is released. The issue was identified through static analysis. Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") Signed-off-by: Duoming Zhou Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260223045522.48377-1-duoming@zju.edu.cn commit c69855ada28656fdd7e197b6e24cd40a04fe14d3 Author: Randy Dunlap Date: Sat Feb 28 14:08:45 2026 -0800 atm: atmdev: add function parameter names and description kernel-doc reports function parameters not described for parameters that are not named. Add parameter names for these functions and then describe the function parameters in kernel-doc format. Fixes these warnings: Warning: include/linux/atmdev.h:316 function parameter '' not described in 'register_atm_ioctl' Warning: include/linux/atmdev.h:321 function parameter '' not described in 'deregister_atm_ioctl' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260228220845.2978547-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit eb101d2abdcccb514ca4fccd3b278dd8267374f6 Author: Fedor Pchelkin Date: Fri Feb 20 12:47:30 2026 +0300 wifi: rtw88: check for PCI upstream bridge existence pci_upstream_bridge() returns NULL if the device is on a root bus. If 8821CE is installed in the system with such a PCI topology, the probing routine will crash. This has probably been unnoticed as 8821CE is mostly supplied in laptops where there is a PCI-to-PCI bridge located upstream from the device. However the card might be installed on a system with different configuration. Check if the bridge does exist for the specific workaround to be applied. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool. Fixes: 24f5e38a13b5 ("rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260220094730.49791-1-pchelkin@ispras.ru commit 425e080a1c34859395efcc377efead05dc6fae3b Author: Kuniyuki Iwashima Date: Sun Mar 1 06:37:55 2026 +0000 dccp Remove inet_hashinfo2_init_mod(). Commit c92c81df93df ("net: dccp: fix kernel crash on module load") added inet_hashinfo2_init_mod() for DCCP. Commit 22d6c9eebf2e ("net: Unexport shared functions for DCCP.") removed EXPORT_SYMBOL_GPL() it but forgot to remove the function itself. Let's remove inet_hashinfo2_init_mod(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260301063756.1581685-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit cd994652225f8758cb1e5c9dd879320dcf7ce4e5 Merge: a0e8c9a5060fbd bddafc06ca5ee1 Author: Jakub Kicinski Date: Mon Mar 2 18:49:43 2026 -0800 Merge branch 'ipmr-no-rtnl-for-rtnl_family_ipmr-rtnetlink' Kuniyuki Iwashima says: ==================== ipmr: No RTNL for RTNL_FAMILY_IPMR rtnetlink. This series removes RTNL from ipmr rtnetlink handlers. After this series, there are a few RTNL left in net/ipv4/ipmr.c and such users will be converted to per-netns RTNL in another series. Patch 1 adds a selftest to exercise most? of the RTNL paths in net/ipv4/ipmr.c Patch 2 - 6 converts RTM_GETLINK / RTM_GETROUTE handlers to RCU. Patch 7 - 9 converts ->exit_batch() to ->exit_rtnl() to save one RTNL in cleanup_net(). Patch 10 - 11 removes unnecessary RTNL during setup_net() failure. Patch 12 is a random cleanup. Patch 13 - 15 drops RTNL for RTM_NEWROUTE and RTM_DELROUTE. ==================== Link: https://patch.msgid.link/20260228221800.1082070-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit bddafc06ca5ee1be4d10061f7954c6d6be5dc1d8 Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:33 2026 +0000 ipmr: Don't hold RTNL for ipmr_rtm_route(). ipmr_mfc_add() and ipmr_mfc_delete() are already protected by a dedicated mutex. rtm_to_ipmr_mfcc() calls __ipmr_get_table(), __dev_get_by_index(), amd ipmr_find_vif(). Once __dev_get_by_index() is converted to dev_get_by_index_rcu(), we can move the other two functions under that same RCU section and drop RTNL for ipmr_rtm_route(). Let's do that conversion and drop ASSERT_RTNL() in mr_call_mfc_notifiers(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-16-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 3c1e53e55418d4ca4040e281501643a96e227974 Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:32 2026 +0000 ipmr: Add dedicated mutex for mrt->{mfc_hash,mfc_cache_list}. We will no longer hold RTNL for ipmr_rtm_route() to modify the MFC hash table. Only __dev_get_by_index() in rtm_to_ipmr_mfcc() is the RTNL dependant, otherwise, we just need protection for mrt->mfc_hash and mrt->mfc_cache_list. Let's add a new mutex for ipmr_mfc_add(), ipmr_mfc_delete(), and mroute_clean_tables() (setsockopt(MRT_FLUSH or MRT_DONE)). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-15-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 4480d5fa1f6ebe7dfc546e14371d63c8b915a82d Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:31 2026 +0000 ipmr/ip6mr: Convert net->ipv[46].ipmr_seq to atomic_t. We will no longer hold RTNL for ipmr_mfc_add() and ipmr_mfc_delete(). MFC entry can be loosely connected with VIF by its index for mrt->vif_table[] (stored in mfc_parent), but the two tables are not synchronised. i.e. Even if VIF 1 is removed, MFC for VIF 1 is not automatically removed. The only field that the MFC/VIF interfaces share is net->ipv[46].ipmr_seq, which is protected by RTNL. Adding a new mutex for both just to protect a single field is overkill. Let's convert the field to atomic_t. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-14-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 1c36d186a0c81f3b55b2722736163233b05f8756 Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:30 2026 +0000 ipmr: Define net->ipv4.{ipmr_notifier_ops,ipmr_seq} under CONFIG_IP_MROUTE. net->ipv4.ipmr_notifier_ops and net->ipv4.ipmr_seq are used only in net/ipv4/ipmr.c. Let's move these definitions under CONFIG_IP_MROUTE. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-13-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 478c2add78b13e36d781d6891d5861e6e1eecef4 Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:29 2026 +0000 ipmr: Call fib_rules_unregister() without RTNL. fib_rules_unregister() removes ops from net->rules_ops under spinlock, calls ops->delete() for each rule, and frees the ops. ipmr_rules_ops_template does not have ->delete(), and any operation does not require RTNL there. Let's move fib_rules_unregister() from ipmr_rules_exit_rtnl() to ipmr_net_exit(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-12-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 4a11adcd9eefb841d4595267bbd4df304a98ded6 Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:28 2026 +0000 ipmr: Remove RTNL in ipmr_rules_init() and ipmr_net_init(). When ipmr_free_table() is called from ipmr_rules_init() or ipmr_net_init(), the netns is not yet published. Thus, no device should have been registered, and mroute_clean_tables() will not call vif_delete(), so unregister_netdevice_many() is unnecessary. unregister_netdevice_many() does nothing if the list is empty, but it requires RTNL due to the unconditional ASSERT_RTNL() at the entry of unregister_netdevice_many_notify(). Let's remove unnecessary RTNL and ASSERT_RTNL() and instead add WARN_ON_ONCE() in ipmr_free_table(). Note that we use a local list for the new WARN_ON_ONCE() because dev_kill_list passed from ipmr_rules_exit_rtnl() may have some devices when other ops->init() fails after ipmr durnig setup_net(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-11-kuniyu@google.com Signed-off-by: Jakub Kicinski commit b22b01867406bcafbf61b61dccdf5b0afbd89fdc Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:27 2026 +0000 ipmr: Convert ipmr_net_exit_batch() to ->exit_rtnl(). ipmr_net_ops uses ->exit_batch() to acquire RTNL only once for dying network namespaces. ipmr does not depend on the ordering of ->exit_rtnl() and ->exit_batch() of other pernet_operations (unlike fib_net_ops). Once ipmr_free_table() is called and all devices are queued for destruction in ->exit_rtnl(), later during NETDEV_UNREGISTER, ipmr_device_event() will not see anything in vif table and just do nothing. Let's convert ipmr_net_exit_batch() to ->exit_rtnl(). Note that fib_rules_unregister() does not need RTNL and we will remove RTNL and unregister_netdevice_many() in ipmr_net_init(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-10-kuniyu@google.com Signed-off-by: Jakub Kicinski commit b7fdc3cfb60a4dd80bb71c818fe433d8b3449cf3 Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:26 2026 +0000 ipmr: Move unregister_netdevice_many() out of ipmr_free_table(). This is a prep commit to convert ipmr_net_exit_batch() to ->exit_rtnl(). Let's move unregister_netdevice_many() in ipmr_free_table() to its callers. Now ipmr_rules_exit() can do batching all tables per netns. Note that later we will remove RTNL and unregister_netdevice_many() in ipmr_rules_init(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-9-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 3810f9529dc7f784b5b958b2a018bb6996cf9077 Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:25 2026 +0000 ipmr: Move unregister_netdevice_many() out of mroute_clean_tables(). This is a prep commit to convert ipmr_net_exit_batch() to ->exit_rtnl(). Let's move unregister_netdevice_many() in mroute_clean_tables() to its callers. As a bonus, mrtsock_destruct() can do batching for all tables. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-8-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 2c698bab294aa273dacd8d6b72db1d79ef994385 Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:24 2026 +0000 ipmr: Convert ipmr_rtm_dumproute() to RCU. ipmr_rtm_dumproute() calls mr_table_dump() or mr_rtm_dumproute(), and mr_rtm_dumproute() finally calls mr_table_dump(). mr_table_dump() calls the passed function, _ipmr_fill_mroute(). _ipmr_fill_mroute() is a wrapper of ipmr_fill_mroute() to cast struct mr_mfc * to struct mfc_cache *. ipmr_fill_mroute() can be already called safely under RCU. Let's convert ipmr_rtm_dumproute() to RCU. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-7-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 295a17b3eae97910c2664e7905a903b483c4089c Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:23 2026 +0000 ipmr: Convert ipmr_rtm_getroute() to RCU. ipmr_rtm_getroute() calls __ipmr_get_table(), ipmr_cache_find(), and ipmr_fill_mroute(). The table is not removed until netns dismantle, and net->ipv4.mr_tables is managed with RCU list API, so __ipmr_get_table() is safe under RCU. struct mfc_cache is freed by mr_cache_put() after RCU grace period, so we can use ipmr_cache_find() under RCU. rcu_read_lock() around it was just to avoid lockdep splat for rhl_for_each_entry_rcu(). ipmr_fill_mroute() calls mr_fill_mroute(), which properly uses RCU. Let's drop RTNL for ipmr_rtm_getroute() and use RCU instead. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-6-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 2bd6c9d600d66497f5293dbb8ec61a5e80f13e64 Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:22 2026 +0000 ipmr: Use MAXVIFS in mroute_msgsize(). mroute_msgsize() calculates skb size needed for ipmr_fill_mroute(). The size differs based on mrt->maxvif. We will drop RTNL for ipmr_rtm_getroute() and mrt->maxvif may change under RCU. To avoid -EMSGSIZE, let's calculate the size with the maximum value of mrt->maxvif, MAXVIFS. struct rtnexthop is 8 bytes and MAXVIFS is 32, so the maximum delta is 256 bytes, which is small enough. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 402a8111d7becb4220a94f5684edfbd5d4668ddb Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:21 2026 +0000 ipmr: Convert ipmr_rtm_dumplink() to RCU. net->ipv4.mr_tables is updated under RTNL and can be read safely under RCU. Once created, the multicast route tables are not removed until netns dismantle. ipmr_rtm_dumplink() does not need RTNL protection for ipmr_for_each_table() and ipmr_fill_table() if RCU is held. Even if mrt->maxvif changes concurrently, ipmr_fill_vif() returns true to continue dumping the next table. Let's convert it to RCU. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 261950e0390b70f1f17947423a36b8d9baae80f2 Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:20 2026 +0000 ipmr: Annotate access to mrt->mroute_do_{pim,assert,wrvifwhole}. These fields in struct mr_table are updated in ip_mroute_setsockopt() under RTNL: * mroute_do_pim * mroute_do_assert * mroute_do_wrvifwhole However, ip_mroute_getsockopt() does not hold RTNL and read the first two fields locklessly, and ip_mr_forward() reads all the three under RCU. pim_rcv_v1() also reads mroute_do_pim locklessly. Let's use WRITE_ONCE() and READ_ONCE() for them. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 05068eaa67b29963c1249c3032658968f64993e6 Author: Kuniyuki Iwashima Date: Sat Feb 28 22:17:19 2026 +0000 selftest: net: Add basic functionality tests for ipmr. The new test exercise paths, where RTNL is needed, to catch lockdep splat: setsockopt MRT_INIT / MRT_DONE MRT_ADD_VIF / MRT_DEL_VIF MRT_ADD_MFC / MRT_DEL_MFC / MRT_ADD_MFC_PROXY / MRT_DEL_MFC_PROXY MRT_TABLE MRT_FLUSH rtnetlink RTM_NEWROUTE RTM_DELROUTE NETDEV_UNREGISTER I will extend this to cover IPv6 setsockopt() later. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228221800.1082070-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit a0e8c9a5060fbdb72fca767164467a3cf2b8fc30 Author: Eric Dumazet Date: Sat Feb 28 17:57:15 2026 +0000 mpls: remove test against ipv6_stub ipv6_stub is never NULL, let's remove this test. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260228175715.1195536-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit c34604572ec53229f1651f8cab8ef8e9d51b0a02 Merge: d03c9ae654dd2f 1e540c4d8f3266 Author: Jakub Kicinski Date: Mon Mar 2 18:46:24 2026 -0800 Merge branch 'net-sparx5-clean-up-probe-remove-init-and-deinit-paths' Daniel Machon says: ==================== net: sparx5: clean up probe/remove init and deinit paths This series refactors the sparx5 init and deinit code out of sparx5_start() and into probe(), adding proper per-subsystem cleanup labels and deinit functions. Currently, the sparx5 driver initializes most subsystems inside sparx5_start(), which is called from probe(). This includes registering netdevs, starting worker threads for stats and MAC table polling, requesting PTP IRQs, and initializing VCAP. The function has grown to handle many unrelated subsystems, and has no granular error handling — it either succeeds entirely or returns an error, leaving cleanup to a single catch-all label in probe(). The remove() path has a similar problem: teardown is not structured as the reverse of initialization, and several subsystems lack proper deinit functions. For example, the stats workqueue has no corresponding cleanup, and the mact workqueue is destroyed without first cancelling its delayed work. Refactor this by moving each init function out of sparx5_start() and into probe(), with a corresponding goto-based cleanup label. Add deinit functions for subsystems that allocate resources, to properly cancel work and destroy workqueues. Ensure that cleanup order in both error paths and remove() follows the reverse of initialization order. sparx5_start() is eliminated entirely — its hardware register setup is renamed to sparx5_forwarding_init() and its FDMA/XTR setup is extracted to sparx5_frame_io_init(). Before this series, most init functions live inside sparx5_start() with no individual cleanup: probe(): sparx5_start(): <- no granular error handling sparx5_mact_init() sparx_stats_init() <- starts worker, no cleanup mact_queue setup <- no cancel on teardown sparx5_register_netdevs() sparx5_register_notifier_blocks() sparx5_vcap_init() sparx5_ptp_init() probe() error path: cleanup_ports: sparx5_cleanup_ports() destroy_workqueue(mact_queue) After this series, probe() initializes subsystems in order with matching cleanup labels, and remove() tears down in reverse: probe(): sparx5_pgid_init() sparx5_vlan_init() sparx5_board_init() sparx5_forwarding_init() sparx5_calendar_init() -> cleanup_ports sparx5_qos_init() -> cleanup_ports sparx5_vcap_init() -> cleanup_ports sparx5_mact_init() -> cleanup_vcap sparx5_stats_init() -> cleanup_mact sparx5_frame_io_init() -> cleanup_stats sparx5_ptp_init() -> cleanup_frame_io sparx5_register_netdevs() -> cleanup_ptp sparx5_register_notifier_blocks() -> cleanup_netdevs remove(): sparx5_unregister_notifier_blocks() sparx5_unregister_netdevs() sparx5_ptp_deinit() sparx5_frame_io_deinit() sparx5_stats_deinit() sparx5_mact_deinit() sparx5_vcap_deinit() sparx5_destroy_netdevs() ==================== Link: https://patch.msgid.link/20260227-sparx5-init-deinit-v2-0-10ba54ccf005@microchip.com Signed-off-by: Jakub Kicinski commit 1e540c4d8f3266fac261a5e9aaa423d2c2c1c5e5 Author: Daniel Machon Date: Fri Feb 27 15:56:47 2026 +0100 net: sparx5: replace sparx5_start() with sparx5_forwarding_init() With all subsystem initializations moved out, sparx5_start() only sets up forwarding (UPSIDs, CPU ports, masks, PGIDs, FCS, watermarks). Rename it to sparx5_forwarding_init() and make it void since it cannot fail. This removes sparx5_start() entirely. Signed-off-by: Daniel Machon Link: https://patch.msgid.link/20260227-sparx5-init-deinit-v2-9-10ba54ccf005@microchip.com Signed-off-by: Jakub Kicinski commit 8b1e4a6747b8f1bfb835967f57435ebf5e928e37 Author: Daniel Machon Date: Fri Feb 27 15:56:46 2026 +0100 net: sparx5: move FDMA/XTR initialization out of sparx5_start() Move the Frame DMA and register-based extraction initialization out of sparx5_start() and into a new sparx5_frame_io_init() function, called from probe(). Also, add sparx5_frame_io_deinit() for the cleanup path. Signed-off-by: Daniel Machon Link: https://patch.msgid.link/20260227-sparx5-init-deinit-v2-8-10ba54ccf005@microchip.com Signed-off-by: Jakub Kicinski commit 0432c60112b4fe3ebaf5c2c6bd859b9666233a03 Author: Daniel Machon Date: Fri Feb 27 15:56:45 2026 +0100 net: sparx5: move PTP IRQ handling out of sparx5_start() Move the PTP IRQ request into sparx5_ptp_init() so all PTP setup is done in one place. Also move the sparx5_ptp_init() call to right before sparx5_register_netdevs() and add a cleanup_ptp label. Update remove() to disable the PTP IRQ and reorder ptp_deinit accordingly. Signed-off-by: Daniel Machon Link: https://patch.msgid.link/20260227-sparx5-init-deinit-v2-7-10ba54ccf005@microchip.com Signed-off-by: Jakub Kicinski commit cdc374359fe8c99d4519ac331324a344ff89d44d Author: Daniel Machon Date: Fri Feb 27 15:56:44 2026 +0100 net: sparx5: move remaining init functions from start() to probe() Move sparx5_pgid_init(), sparx5_vlan_init(), and sparx5_board_init() from sparx5_start() to probe(). These functions do not require cleanup. Signed-off-by: Daniel Machon Link: https://patch.msgid.link/20260227-sparx5-init-deinit-v2-6-10ba54ccf005@microchip.com Signed-off-by: Jakub Kicinski commit 274182ff34fdd85f712c2b6e624e1c85c6696685 Author: Daniel Machon Date: Fri Feb 27 15:56:43 2026 +0100 net: sparx5: move calendar initialization to probe Move the calendar initialization from sparx5_start() to probe() by creating a new sparx5_calendar_init() wrapper function that calls both sparx5_config_auto_calendar() and sparx5_config_dsm_calendar(). Calendar initialization does not require cleanup. Also, make the individual calendar config functions static since they are now only called from within sparx5_calendar.c. Signed-off-by: Daniel Machon Link: https://patch.msgid.link/20260227-sparx5-init-deinit-v2-5-10ba54ccf005@microchip.com Signed-off-by: Jakub Kicinski commit e180067a03cad7043d951b0040f0169a267f0293 Author: Daniel Machon Date: Fri Feb 27 15:56:42 2026 +0100 net: sparx5: move stats initialization and add deinit function The sparx5_stats_init() function starts a worker thread which needs to be cleaned up. Move the initialization code to probe() and add a deinit() function for proper teardown. Also, rename sparx_stats_init() to sparx5_stats_init() to match the driver naming convention. Signed-off-by: Daniel Machon Link: https://patch.msgid.link/20260227-sparx5-init-deinit-v2-4-10ba54ccf005@microchip.com Signed-off-by: Jakub Kicinski commit 13cb1b68842b010275974454d4c5dffaf427197f Author: Daniel Machon Date: Fri Feb 27 15:56:41 2026 +0100 net: sparx5: move MAC table initialization and add deinit function Consolidate all MAC table initialization from sparx5_start() into sparx5_mact_init(), move it to probe(), and add a deinit function for proper teardown. Also, make sparx5_mact_pull_work() static since it is only used within sparx5_mactable.c. Signed-off-by: Daniel Machon Link: https://patch.msgid.link/20260227-sparx5-init-deinit-v2-3-10ba54ccf005@microchip.com Signed-off-by: Jakub Kicinski commit 3a95973e7c79bbef04171240ecf8c42e28b4ea46 Author: Daniel Machon Date: Fri Feb 27 15:56:40 2026 +0100 net: sparx5: move VCAP initialization to probe Move the VCAP initialization code from sparx5_start() to probe(). Add proper error handling with a cleanup_vcap label and sparx5_vcap_deinit() call. Also, rename sparx5_vcap_destroy() to sparx5_vcap_deinit() to stay consistent with the naming. Signed-off-by: Daniel Machon Link: https://patch.msgid.link/20260227-sparx5-init-deinit-v2-2-10ba54ccf005@microchip.com Signed-off-by: Jakub Kicinski commit b8909aad5b8de0e2d7e27c0246119eb07f0caa3b Author: Daniel Machon Date: Fri Feb 27 15:56:39 2026 +0100 net: sparx5: move netdev and notifier block registration to probe Move netdev registration and notifier block registration from sparx5_start() to probe(). This allows proper cleanup via goto-based error labels in probe(). Also, remove the sparx5_cleanup_ports() helper as its functionality is now split between sparx5_unregister_netdevs() and sparx5_destroy_netdevs() called at appropriate points. Signed-off-by: Daniel Machon Link: https://patch.msgid.link/20260227-sparx5-init-deinit-v2-1-10ba54ccf005@microchip.com Signed-off-by: Jakub Kicinski commit 3d90c421341ba6705f991ddaa350b585afefe078 Author: Zong-Zhe Yang Date: Fri Feb 13 14:15:52 2026 +0800 wifi: rtw89: ser: post-recover DMAC state to prevent LPS If entering LPS during SER (system error recovery), IMR might fail to be re-enabled after SER. Then, the next SER would not be noticed well. After FW v0.35.100.0, Wi-Fi 7 chipsets adjust the order in which SER recovers DMAC state to prevent LPS from being in the middle of SER. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-13-pkshih@realtek.com commit 0cae26a78b14fe1292b0f50f28ebabe6801f3885 Author: Zong-Zhe Yang Date: Fri Feb 13 14:15:51 2026 +0800 wifi: rtw89: ser: Wi-Fi 7 reset HALT C2H after reading it When a SER (system error recovery) interrupt happens, driver reads HALT C2H register to get the error status via MAC. For Wi-Fi 7 chipset, driver needs to reset HALT C2H register after reading it to make FW aware that. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-12-pkshih@realtek.com commit a72de4d4599e8e31d43485f108bed477da139171 Author: Zong-Zhe Yang Date: Fri Feb 13 14:15:50 2026 +0800 wifi: rtw89: debug: add SER SW counters to count simulation Some chipsets, e.g. Wi-Fi 7, will not record SER (system error recovery), which are triggered by simulations, in the HW counters. Their HW counters only record the SER happen in field. However for verification, it's still needed to check if simulations are triggered. So, add SW counters to count any causes that SER happen. But, SW can only count L1 and L2. SW does not involve L0 SER, so SW cannot count it. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-11-pkshih@realtek.com commit dcd2326db84399adbb0a6768d04a09f3078394c5 Author: Ping-Ke Shih Date: Fri Feb 13 14:15:49 2026 +0800 wifi: rtw89: rfk: add hardware version to rtw89_fw_h2c_rf_pre_ntfy_mcc for new WiFi 7 firmware The RF calibration in firmware needs proper hardware version to select corresponding logic, so add the field to H2C command accordingly. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-10-pkshih@realtek.com commit 79b3702bbc02bc6e65e89195d761caae51fa20c8 Author: Kuan-Chung Chen Date: Fri Feb 13 14:15:48 2026 +0800 wifi: rtw89: add H2C command to protect TX/RX for unused PHY For BE chips, the unused PHY should pause transmissions and receptions. This ensures that no unexpected packets are routed to an inactive PHY, which could otherwise trigger SER L0 and lead to TX hang. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-9-pkshih@realtek.com commit 6b4fe140874b9e8a1765fda9e9b11b55b79de64e Author: Zong-Zhe Yang Date: Fri Feb 13 14:15:47 2026 +0800 wifi: rtw89: 8851b: update supported firmware format to 1 More data will be included in Firmware file and loaded via FW elements. Increase RTL8851B FW format to 1 to prevent old driver from failing to recognize FW with FW elements. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-8-pkshih@realtek.com commit d03c9ae654dd2f18f99f0efd873b209cba723007 Merge: df548e627b8ce5 07a8531d44272a Author: Jakub Kicinski Date: Mon Mar 2 18:35:46 2026 -0800 Merge branch 'net-stmmac-further-cleanups' Russell King says: ==================== net: stmmac: further cleanups Yet another bunch of patches cleaning up the stmmac driver. We start off by cleaning up the formatting for stmmac_mac_finish(). Then remove a plat_dat->port_node which is redundant, followed by several descriptor methods that aren't called. We then remove useless dwmac4 interrupt definitions, and realise that v4.10 definitions are the same as v4.0, so get rid of those as well. We also remove the write-only priv->hw->xlgmac member. Next, we change priv->extend_desc and priv->chain_mode to be a boolean and document what each of these are doing. Also do the same for dma_cfg->fixed_burst and dma_cfg->mixed_burst. Then, move the initialisation of dma_cfg->atds into stmmac_hw_init() as this is where we have all the dependencies for this known, and simplify its initialisation. Also comment what this is doing. Finally, move the check that priv->plat->dma_cfg is present and the programmable burst limit is set into the driver probe rather than checking it each time we are just about to reset the dwmac core. It is unnecessary to keep checking this. This makes a platform glue driver fail early when it hasn't setup everything that's required rather than when attempting to bring the netdev up for the first time. ==================== Link: https://patch.msgid.link/aaFpZvuIzOLaNM0m@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 07a8531d44272a1b9fd646f5fc09fc397e5b8a65 Author: Russell King (Oracle) Date: Fri Feb 27 09:54:15 2026 +0000 net: stmmac: move DMA configuration validation to driver probe Move the DMA configuration validation from stmmac_init_dma_engine() to the start of the driver probe function. The platform glue is expected to supply the DMA configuration, and a non-zero programmable burst length (bpl). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuY3-0000000Avnq-1Spv@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 93cde989bd280b5930ed4852f832d87feb001533 Author: Russell King (Oracle) Date: Fri Feb 27 09:54:10 2026 +0000 net: stmmac: simplify atds initialisation atds is boolean, and there is only one place that its value is changed. Simplify this to a boolean assignment. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuXy-0000000Avnk-10Q8@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0835bc72510ffbd2dba1827bd17ac08e31dc2485 Author: Russell King (Oracle) Date: Fri Feb 27 09:54:05 2026 +0000 net: stmmac: move initialisation of dma_cfg->atds Move the initialisation of priv->plat->dma_cfg->atds, which indicates that 8 32-bit word descriptors are being used for pre-v4.0 cores, after the call to stmmac_hwif_init(), which will initialise priv->extend_desc and priv->mode (the descriptor mode.) We don't need to re-evaluate this in stmmac_init_dma_engine() - as the state that it depends on only changes in stmmac_hwif_init() which is only called in the probe path. Also, once set, no code clears this flag. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuXt-0000000Avnc-0UYC@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1558705afbb293549fdedd539682bc5240e1964b Author: Russell King (Oracle) Date: Fri Feb 27 09:53:59 2026 +0000 net: stmmac: make dma_cfg mixed/fixed burst boolean struct stmmac_dma_cfg mixed_burst/fixed_burst members are both boolean in nature - of_property_read_bool() are used to read these from DT, and they are only tested for non-zero values. Use bool to avoid unnecessary padding in this structure. Update dwmac-intel to initialise these using true rather than '1', and remove the '0' initialisers as the struct is already zero initialised on allocation. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuXn-0000000AvnX-4A1u@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a2a3832ad76d357aadabd2e730cbe4b26725fc8a Author: Russell King (Oracle) Date: Fri Feb 27 09:53:54 2026 +0000 net: stmmac: make chain_mode a boolean priv->chain_mode is only tested for non-zero, so it can be a boolean. Change its type to boolean, and add a comment describing this member. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuXi-0000000AvnR-3btC@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ecb037f58da7db2eae199a5f40f4684005d8e57f Author: Russell King (Oracle) Date: Fri Feb 27 09:53:49 2026 +0000 net: stmmac: make extend_desc boolean extend_desc is a boolean, so make it so, and use "true" to assign it. Add a comment to describe what this member does. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuXd-0000000AvnL-36K3@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 70bafb53b305801f21562c145d717e62dcf589e4 Author: Russell King (Oracle) Date: Fri Feb 27 09:53:44 2026 +0000 net: stmmac: remove mac->xlgmac mac->xlgmac is only ever written to by the dwxlgmac2_quirk() function. Remove mac->xlgmac, and the quirk function that then becomes redundant. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuXY-0000000AvnF-2ccv@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0e7cb34d0f6cc3ef56f2b0f6f637f501106ab8c5 Author: Russell King (Oracle) Date: Fri Feb 27 09:53:39 2026 +0000 net: stmmac: remove dwmac410_(enable|disable)_dma_irq As a result of the previous cleanup, it is now obvious that there are no differences between the dwmac4 and dwmac410 versions of the DMA interrupt enable/disable functions. Moreover, dwmac410_disable_dma_irq() is completely unused; instead, dwmac4_disable_dma_irq() is used to disable the interrupts for v4.10a cores while dwmac410_enable_dma_irq() was being used to enable these same same interrupts. Remove the unnecessary v4.10a functions. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuXT-0000000Avn9-29US@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d1925291231e00f31f9711b40fcab3e139a2ca73 Author: Russell King (Oracle) Date: Fri Feb 27 09:53:34 2026 +0000 net: stmmac: remove dwmac4 DMA_CHAN_INTR_DEFAULT_[TR]X* Remove the DMA_CHAN_INTR_DEFAULT_[TR]X* definitions, which are aliases of their respective DMA_CHAN_INTR_ENA_[TR]IE definitions. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuXO-0000000Avn3-1hhD@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 19f2d59c3c3af5092ccea8086b8e840980057b9c Author: Russell King (Oracle) Date: Fri Feb 27 09:53:29 2026 +0000 net: stmmac: remove .get_tx_len() No code calls stmmac_get_tx_len(). Remove this macro, its associated function pointer, and all implementations. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuXJ-0000000Avmx-1B8Y@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1fe444bdc58399118ef1e85e4160ece227278c89 Author: Russell King (Oracle) Date: Fri Feb 27 09:53:24 2026 +0000 net: stmmac: remove .get_tx_ls() No code calls stmmac_get_tx_ls(). Remove this macro, its associated function pointer, and all implementations. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuXE-0000000Avmr-0eB0@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d48ba98bbc8245a367ce6d30ed4de6323623ebdf Author: Russell King (Oracle) Date: Fri Feb 27 09:53:19 2026 +0000 net: stmmac: remove .get_tx_owner() No code calls stmmac_get_tx_owner(). Remove the macro, its associated function pointer, and all implementations. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuX9-0000000Avml-08Lo@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 44a2ec96d374806ee74454ea915615536a76b152 Author: Russell King (Oracle) Date: Fri Feb 27 09:53:13 2026 +0000 net: stmmac: remove plat_dat->port_node There are repeated instances of: fwnode = priv->plat->port_node; if (!fwnode) fwnode = dev_fwnode(priv->device); However, the only place that ->port_node is set is stmmac_probe_config_dt(): struct device_node *np = pdev->dev.of_node; ... /* PHYLINK automatically parses the phy-handle property */ plat->port_node = of_fwnode_handle(np); which is equivalent to dev_fwnode(&pdev->dev) and, as priv->device will be &pdev->dev, is also equivalent to dev_fwnode(priv->device). Thus, plat_dat->port_node doesn't provide any extra benefit over using dev_fwnode(priv->device) directly. There is one case where port_node is used directly, which can be found in stmmac_pcs_setup(). This may cause a change of behaviour as PCI drivers do not populate plat_dat->port_node, but dev_fwnode(priv->device) may be valid. PCI-based stmmac should be tested. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuX3-0000000Avme-3oej@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 940ec40dd299bba05bc022cf8e951de8a0f8b124 Author: Russell King (Oracle) Date: Fri Feb 27 09:53:08 2026 +0000 net: stmmac: clean up formatting in stmmac_mac_finish() Wrap the arguments for priv->plat->mac_finish() to avoid an overly long line. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvuWy-0000000AvmY-3GWN@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b60796c07a79178db32b63e5b75996551145fa5d Author: Zong-Zhe Yang Date: Fri Feb 13 14:15:46 2026 +0800 wifi: rtw89: 8852a: update supported firmware format to 1 More data will be included in Firmware file and loaded via FW elements. Unlike other chips, for RF radio, RTL8852A uses rtw89_phy_config_rf_reg instead of v1, so update loading handling of corresponding FW element. And then, increase RTL8852A FW format to 1 to prevent old driver from misusing the data in FW elements. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-7-pkshih@realtek.com commit 5cfda90c638423aeab3f1e99f7606d6c6a2cf018 Author: Zong-Zhe Yang Date: Fri Feb 13 14:15:45 2026 +0800 wifi: rtw89: 8852a: move DIG tables to rtw8852a.c Now, most of PHY parameter tables in driver can be loaded via FW elements. Plan to generate the corresponding FW elements for 8852A PHY tables. Then, after FW elements work for a enough time, rtw8852a_table.c can be cleaned up. However, DIG (dynamic initial gain) tables are legacy for 8852A only, so FW element doesn't support. Their sizes are not very big, so move them to rtw8852a.c and keep rtw8852a_table.c for PHY tables which are supported by FW elements. No logic is changed. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-6-pkshih@realtek.com commit 1d67f1f8e9a0d99ed1731601ea6bdf3c42570be9 Author: Ping-Ke Shih Date: Fri Feb 13 14:15:44 2026 +0800 wifi: rtw89: 8852b: update supported firmware format to 2 After firmware version 0.29.29.15, more data are included in firmware file. Increase format to 2 to prevent old driver failed to load the new firmware. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-5-pkshih@realtek.com commit 888226bd560a577be7f169a5f4a0b9e74f4cf039 Author: Zong-Zhe Yang Date: Fri Feb 13 14:15:43 2026 +0800 wifi: rtw89: add general way to generate module firmware string Module firmware string depends on max format of the firmware. When max format is 0, the module firmware string will be like XYZ.bin. However, when max format N > 0, the module firmware string will become XYZ-N.bin. Originally, when one chip updated its max firmware format from 0 to 1, the module firmware string also needed to be changed. However, did not need to do for other cases, e.g. from 1 to 2. It's a bit inconvenient to always remember that from 0 to 1 is a special case. So, add a general macro to generate the corresponding module firmware string based on max firmware format. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-4-pkshih@realtek.com commit fdb626b79477d40c858faf7dad7628704f7b7c3c Author: Ping-Ke Shih Date: Fri Feb 13 14:15:42 2026 +0800 wifi: rtw89: fw: recognize firmware type B by AID Select a firmware suit including normal and WoWLAN firmware by chip AID from multiple firmware, because coming RTL8922D has variant hardware with different chip AID. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-3-pkshih@realtek.com commit abaa59fb24cad1bfb4aeb3b2a152b5b4eb90a2d3 Author: Ping-Ke Shih Date: Fri Feb 13 14:15:41 2026 +0800 wifi: rtw89: fw: add fw_def struct to put firmware name and format version The RTL8922DE has a RTL8922DE-VS variant which uses different firmware name and format version, and the rule to select firmware type will be needed to extend. Prepare for coming patches. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213061552.29997-2-pkshih@realtek.com commit df548e627b8ce5d354b1b19060dfb52a32f27d83 Merge: 8341c989ac77d7 c7b228418e8b34 Author: Jakub Kicinski Date: Mon Mar 2 18:21:19 2026 -0800 Merge branch 'selftests-drv-net-iou-zcrx-improve-stability-and-make-the-large-chunk-test-work' Jakub Kicinski says: ==================== selftests: drv-net: iou-zcrx: improve stability and make the large chunk test work The iou-zcrx test hasn't been passing in NIPA, I assumed it's because we're missing iouring changes, but it's still failing after the merge window. Turns out there was a bug in the implementation which was fixed separately via the iouring tree. With that out of the way the tests are passing but flaky. Patch 1 deals with the flakiness. While looking at this I also noticed that the large chunk test isn't running at all. So fix and enable it (patches 2 and 3). ==================== Link: https://patch.msgid.link/20260227171305.2848240-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c7b228418e8b34282d266ffeef59996434a73b32 Author: Jakub Kicinski Date: Fri Feb 27 09:13:05 2026 -0800 selftests: drv-net: iou-zcrx: allocate hugepages for large chunks test The large chunks test needs 2MB hugepages for its mmap allocation, but the test system may not have any pre-allocated. Ensure at least 64 hugepages are available before running the test, and restore the original value on cleanup. While at it strip the stdout, it has a trailing new line. Before: ok 5 iou-zcrx.test_zcrx_large_chunks # SKIP Can't allocate huge pages Link: https://patch.msgid.link/20260227171305.2848240-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 67792dde27a66fa6dc262d5e2ee8260096a9deb3 Author: Jakub Kicinski Date: Fri Feb 27 09:13:04 2026 -0800 selftests: drv-net: iou-zcrx: rework large chunks test to use common setup Commit a32bb32d0193 ("selftests: iou-zcrx: test large chunk sizes") and commit de7c600e2d5b ("selftests/net: parametrise iou-zcrx.py with ksft_variants") landed at similar time. The large chunks test was actually not included in the list of tests, so it never run. We haven't noticed that it uses the old-style helpers (_get_combined_channels, _get_current_settings, _set_flow_rule) that were removed by the other commit. Rework test_zcrx_large_chunks to reuse the single() setup function and add it to the ksft_run cases list so it actually gets executed. Link: https://patch.msgid.link/20260227171305.2848240-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 27c4ab943882c8ca7d3c56241cd969da6b5e6727 Author: Jakub Kicinski Date: Fri Feb 27 09:13:03 2026 -0800 selftests: drv-net: iou-zcrx: wait for memory provider cleanup io_uring defers zcrx context teardown to the iou_exit workqueue. # ps aux | grep iou ... 07:58 0:00 [kworker/u19:0-iou_exit] ... 07:58 0:00 [kworker/u18:2-iou_exit] When the test's receiver process exits, bkg() returns but the memory provider may still be attached to the rx queue. The subsequent defer() that restores tcp-data-split then fails: # Exception while handling defer / cleanup (callback 3 of 3)! # Defer Exception| net.ynl.pyynl.lib.ynl.NlError: Netlink error: can't disable tcp-data-split while device has memory provider enabled: Invalid argument not ok 1 iou-zcrx.test_zcrx.single Add a helper that polls netdev queue-get until no rx queue reports the io-uring memory provider attribute. Register it as a defer() just before tcp-data-split is restored as a "barrier". Reviewed-by: Dragos Tatulea Link: https://patch.msgid.link/20260227171305.2848240-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c95323ea9dfba8ab2bafbaee9da96c53f893873f Author: Ching-Te Ku Date: Fri Feb 13 13:34:45 2026 +0800 wifi: rtw88: coex: Solve LE-HID lag & update coex version to 26020420 When Wi-Fi enters power save, the register value can not be read correctly. If mechanism take the wrong information to make decision, it will run with wrong parameters. It leads Bluetooth low-energy HID lag. Add logic to isolate the wrong register state. BTCOEX Version: 26020420-2020 Desired_BT_Coex_Ver: 0x20 Desired_WL_FW_Ver: 9.9.X Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260213053445.19384-1-pkshih@realtek.com commit 8341c989ac77d712c7d6e2bce29e8a4bcb2eeae4 Author: Eric Dumazet Date: Fri Feb 27 15:11:20 2026 +0000 net: remove addr_len argument of recvmsg() handlers Use msg->msg_namelen as a place holder instead of a temporary variable, notably in inet[6]_recvmsg(). This removes stack canaries and allows tail-calls. $ scripts/bloat-o-meter -t vmlinux.old vmlinux add/remove: 0/0 grow/shrink: 2/19 up/down: 26/-532 (-506) Function old new delta rawv6_recvmsg 744 767 +23 vsock_dgram_recvmsg 55 58 +3 vsock_connectible_recvmsg 50 47 -3 unix_stream_recvmsg 161 158 -3 unix_seqpacket_recvmsg 62 59 -3 unix_dgram_recvmsg 42 39 -3 tcp_recvmsg 546 543 -3 mptcp_recvmsg 1568 1565 -3 ping_recvmsg 806 800 -6 tcp_bpf_recvmsg_parser 983 974 -9 ip_recv_error 588 576 -12 ipv6_recv_rxpmtu 442 428 -14 udp_recvmsg 1243 1224 -19 ipv6_recv_error 1046 1024 -22 udpv6_recvmsg 1487 1461 -26 raw_recvmsg 465 437 -28 udp_bpf_recvmsg 1027 984 -43 sock_common_recvmsg 103 27 -76 inet_recvmsg 257 175 -82 inet6_recvmsg 257 175 -82 tcp_bpf_recvmsg 663 568 -95 Total: Before=25143834, After=25143328, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260227151120.1346573-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2d85152020d576010a5396d10c864a66b4ce8cf3 Author: Bitterblue Smith Date: Fri Feb 6 20:01:34 2026 +0200 wifi: rtw89: Turbo mode for RTL8851BU/RTL8852BU RTL8851BU and RTL8852BU currently have much lower TX speed than expected, ~100 and ~300 Mbps, respectively. This is because part of the chip's memory is allocated for some unknown firmware features instead of the TX buffers. The vendor drivers have a module parameter called "rtw_quota_turbo_en", which can be used to choose between full TX speed or the unknown firmware features. It is on by default. Change the relevant chip parameters to implement the turbo mode. Do it only for USB because PCI is already fast even without the turbo mode. It's unclear if SDIO will need it or not. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/88cce107-ff52-496f-bb77-b930e4182b67@gmail.com commit d05073adda0f047e9b2115a2932bcb2797eab238 Author: Ian Rogers Date: Mon Mar 2 15:45:15 2026 -0800 perf trace: Avoid an ERR_PTR in syscall_stats hashmap__new may return an ERR_PTR and previously this would be assigned to syscall_stats meaning all use of syscall_stats needs to test for NULL (uninitialized) or an ERR_PTR. Given the only reason hashmap__new can fail is ENOMEM, just use NULL to indicate the allocation failure and avoid the code having to test for NULL and IS_ERR. Fixes: 96f202eab813 (perf trace: Fix IS_ERR() vs NULL check bug) Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 06ec44c2aa2ef15fd56f9808b6cf7495e1fbd8ec Author: Leo Yan Date: Sun Mar 1 17:43:25 2026 +0000 perf kvm stat: Fix relative paths for including headers Add an extra "../" to the relative paths so that the uAPI headers provided by tools can be found correctly. Fixes: a724a8fce5e2 ("perf kvm stat: Fix build error") Reported-by: Namhyung Kim Suggested-by: Ian Rogers Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 17b95278ae6adb9ea5b801fcd2ae5d182448e99d Merge: 21f6bcdf2be72e 6bc6fec71ac45f Author: Dave Airlie Date: Tue Mar 3 09:55:32 2026 +1000 Merge tag 'drm-xe-next-2026-03-02' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - restrict multi-lrc to VCS/VECS engines (Xin Wang) - Introduce a flag to disallow vm overcommit in fault mode (Thomas) - update used tracking kernel-doc (Auld, Fixes) - Some bind queue fixes (Auld, Fixes) Cross-subsystem Changes: - Split drm_suballoc_new() into SA alloc and init helpers (Satya, Fixes) - pass pagemap_addr by reference (Arnd, Fixes) - Revert "drm/pagemap: Disable device-to-device migration" (Thomas) - Fix unbalanced unlock in drm_gpusvm_scan_mm (Maciej, Fixes) - Small GPUSVM fixes (Brost, Fixes) - Fix xe SVM configs (Thomas, Fixes) Core Changes: - Fix a hmm_range_fault() livelock / starvation problem (Thomas, Fixes) Driver Changes: - Fix leak on xa_store failure (Shuicheng, Fixes) - Correct implementation of Wa_16025250150 (Roper, Fixes) - Refactor context init into xe_lrc_ctx_init (Raag) - Fix GSC proxy cleanup on early initialization failure (Zhanjun) - Fix exec queue creation during post-migration recovery (Tomasz, Fixes) - Apply windower hardware filtering setting on Xe3 and Xe3p (Roper) - Free ctx_restore_mid_bb in release (Shuicheng, Fixes) - Drop stale MCR steering TODO comment (Roper) - dGPU memory optimizations (Brost) - Do not preempt fence signaling CS instructions (Brost, Fixes) - Revert "drm/xe/compat: Remove unused i915_reg.h from compat header" (Uma) - Don't expose display modparam if no display support (Wajdeczko) - Some VRAM flag improvements (Wajdeczko) - Misc fix for xe_guc_ct.c (Shuicheng, Fixes) - Remove unused i915_reg.h from compat header (Uma) - Workaround cleanup & simplification (Roper) - Add prefetch pagefault support for Xe3p (Varun) - Fix fs_reclaim deadlock caused by CCS save/restore (Satya, Fixes) - Cleanup partially initialized sync on parse failure (Shuicheng, Fixes) - Allow to change VFs VRAM quota using sysfs (Michal) - Increase GuC log sizes in debug builds (Tomasz) - Wa_18041344222 changes (Harish) - Add Wa_14026781792 (Niton) - Add debugfs facility to catch RTP mistakes (Roper) - Convert GT stats to per-cpu counters (Brost) - Prevent unintended VRAM channel creation (Karthik) - Privatize struct xe_ggtt (Maarten) - remove unnecessary struct dram_info forward declaration (Jani) - pagefault refactors (Brost) - Apply Wa_14024997852 (Arvind) - Redirect faults to dummy page for wedged device (Raag, Fixes) - Force EXEC_QUEUE_FLAG_KERNEL for kernel internal VMs (Piotr) - Stop applying Wa_16018737384 from Xe3 onward (Roper) - Add new XeCore fuse registers to VF runtime regs (Roper) - Update xe_device_declare_wedged() error log (Raag) - Make xe_modparam.force_vram_bar_size signed (Shuicheng, Fixes) - Avoid reading media version when media GT is disabled (Piotr, Fixes) - Fix handling of Wa_14019988906 & Wa_14019877138 (Roper, Fixes) - Basic enabling patches for Xe3p_LPG and NVL-P (Gustavo, Roper, Shekhar) - Avoid double-adjust in 64-bit reads (Shuicheng, Fixes) - Allow VF to initialize MCR tables (Wajdeczko) - Add Wa_14025883347 for GuC DMA failure on reset (Anirban) - Add bounds check on pat_index to prevent OOB kernel read in madvise (Jia, Fixes) - Fix the address range assert in ggtt_get_pte helper (Winiarski) - XeCore fuse register changes (Roper) - Add more info to powergate_info debugfs (Vinay) - Separate out GuC RC code (Vinay) - Fix g2g_test_array indexing (Pallavi) - Mutual exclusivity between CCS-mode and PF (Nareshkumar, Fixes) - Some more _types.h cleanups (Wajdeczko) - Fix sysfs initialization (Wajdeczko, Fixes) - Drop unnecessary goto in xe_device_create (Roper) - Disable D3Cold for BMG only on specific platforms (Karthik, Fixes) - Add sriov.admin_only_pf attribute (Wajdeczko) - replace old wq(s), add WQ_PERCPU to alloc_workqueue (Marco) - Make MMIO communication more robust (Wajdeczko) - Fix warning of kerneldoc (Shuicheng, Fixes) - Fix topology query pointer advance (Shuicheng, Fixes) - use entry_dump callbacks for xe2+ PAT dumps (Xin Wang) - Fix kernel-doc warning in GuC scheduler ABI header (Chaitanya, Fixes) - Fix CFI violation in debugfs access (Daniele, Fixes) - Apply WA_16028005424 to Media (Balasubramani) - Fix typo in function kernel-doc (Wajdeczko) - Protect priority against concurrent access (Niranjana) - Fix nvm aux resource cleanup (Shuicheng, Fixes) - Fix is_bound() pci_dev lifetime (Shuicheng, Fixes) - Use CLASS() for forcewake in xe_gt_enable_comp_1wcoh (Shuicheng) - Reset VF GuC state on fini (Wajdeczko) - Move _THIS_IP_ usage from xe_vm_create() to dedicated function (Nathan Chancellor, Fixes) - Unregister drm device on probe error (Shuicheng, Fixes) - Disable DCC on PTL (Vinay, Fixes) - Fix Wa_18022495364 (Tvrtko, Fixes) - Skip address copy for sync-only execs (Shuicheng, Fixes) - derive mem copy capability from graphics version (Nitin, Fixes) - Use DRM_BUDDY_CONTIGUOUS_ALLOCATION for contiguous allocations (Sanjay) - Context based TLB invalidations (Brost) - Enable multi_queue on xe3p_xpc (Brost, Niranjana) - Remove check for gt in xe_query (Nakshtra) - Reduce LRC timestamp stuck message on VFs to notice (Brost, Fixes) Signed-off-by: Dave Airlie From: Matthew Brost Link: https://patch.msgid.link/aaYR5G2MHjOEMXPW@lstrano-desk.jf.intel.com commit 7147ec874ea08c322d779d8eba28946e294ed1f3 Author: Jacob Pan Date: Fri Feb 13 10:36:36 2026 -0800 iommufd: vfio compatibility extension check for noiommu mode VFIO_CHECK_EXTENSION should return false for TYPE1_IOMMU variants when in NO-IOMMU mode and IOMMUFD compat container is set. This change makes the behavior match VFIO_CONTAINER in noiommu mode. It also prevents userspace from incorrectly attempting to use TYPE1 IOMMU operations in a no-iommu context. Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility") Link: https://patch.msgid.link/r/20260213183636.3340-1-jacob.pan@linux.microsoft.com Signed-off-by: Jacob Pan Signed-off-by: Jason Gunthorpe commit 46a93917bf776c35dfdfe7601f8972dacd9259ee Author: Christophe JAILLET Date: Thu Feb 26 22:05:21 2026 +0100 iommufd: Constify struct dma_buf_attach_ops 'struct dma_buf_attach_ops' is not modified in this driver. Constifying this structure moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 81096 13899 192 95187 173d3 drivers/iommu/iommufd/pages.o After: ===== text data bss dec hex filename 81160 13835 192 95187 173d3 drivers/iommu/iommufd/pages.o Link: https://patch.msgid.link/r/67e9126bbffa1d5c05124773a8dd4a3493be77ac.1772139886.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Signed-off-by: Jason Gunthorpe commit 1450ab08108ccd825c8f9362475fadfc187942fc Author: Gal Pressman Date: Wed Feb 25 16:50:50 2026 +0200 KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter The nx_huge_pages parameter is stored as an int (initialized to -1 to indicate auto mode), but get_nx_huge_pages() calls param_get_bool() which expects a bool pointer. This causes UBSAN to report "load of value 255 is not a valid value for type '_Bool'" when the parameter is read via sysfs during a narrow time window. The issue occurs during module load: the module parameter is registered and its sysfs file becomes readable before the kvm_mmu_x86_module_init() function runs: 1. Module load begins, static variable initialized to -1 2. mod_sysfs_setup() creates /sys/module/kvm/parameters/nx_huge_pages 3. (Parameter readable, value = -1) 4. do_init_module() runs kvm_x86_init() 5. kvm_mmu_x86_module_init() resolves -1 to bool If userspace (e.g., sos report) reads the parameter during step 3, param_get_bool() dereferences the int as a bool, triggering the UBSAN warning. Fix that by properly reading and converting the -1 value into an 'auto' string. Fixes: b8e8c8303ff2 ("kvm: mmu: ITLB_MULTIHIT mitigation") Reviewed-by: Dragos Tatulea Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20260225145050.2350278-3-gal@nvidia.com Signed-off-by: Sean Christopherson commit 2b1a59f7ef96c3f29f0ada1a63f4699c35687e33 Author: Gal Pressman Date: Wed Feb 25 16:50:49 2026 +0200 KVM: SVM: Fix UBSAN warning when reading avic parameter The avic parameter is stored as an int to support the special value -1 (AVIC_AUTO_MODE), but the cited commit changed it from bool to int while keeping param_get_bool() as the getter function. This causes UBSAN to report "load of value 255 is not a valid value for type '_Bool'" when the parameter is read via sysfs. The issue happens in two scenarios: 1. During module load: There's a time window between when module parameters are registered, and when avic_hardware_setup() runs to resolve the value, where the value is -1. 2. On non-AMD systems: On non-AMD hardware, the kvm_is_svm_supported() check returns early. The avic_hardware_setup() function never runs, so avic remains -1. Fix that by implementing a getter function that properly reads and converts the -1 value into a string. Triggered by sos report: UBSAN: invalid-load in kernel/params.c:323:33 load of value 255 is not a valid value for type '_Bool' CPU: 0 UID: 0 PID: 4667 Comm: sos Not tainted 6.19.0-rc5net_mlx5_1e86836 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x69/0xa0 ubsan_epilogue+0x5/0x2b __ubsan_handle_load_invalid_value.cold+0x47/0x4c ? lock_acquire+0x219/0x2c0 param_get_bool.cold+0xf/0x14 param_attr_show+0x51/0x80 module_attr_show+0x19/0x30 sysfs_kf_seq_show+0xac/0xf0 seq_read_iter+0x100/0x410 copy_splice_read+0x1b4/0x360 splice_direct_to_actor+0xbd/0x270 ? wait_for_space+0xb0/0xb0 do_splice_direct+0x72/0xb0 ? propagate_umount+0x870/0x870 do_sendfile+0x3a3/0x470 __x64_sys_sendfile64+0x5e/0xe0 do_syscall_64+0x70/0x8c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: ca2967de5a5b ("KVM: SVM: Enable AVIC by default for Zen4+ if x2AVIC is support") Reviewed-by: Dragos Tatulea Signed-off-by: Gal Pressman Reviewed-by: Naveen N Rao (AMD) Link: https://patch.msgid.link/20260225145050.2350278-2-gal@nvidia.com Signed-off-by: Sean Christopherson commit e2138c4a5be1e50d75281136bdc3e709cb07ec5e Author: Sean Christopherson Date: Tue Feb 24 17:20:49 2026 -0800 KVM: x86: Add helpers to prepare kvm_run for userspace MMIO exit Add helpers to fill kvm_run for userspace MMIO exits to deduplicate a variety of code, and to allow for a cleaner return path in emulator_read_write(). Opportunistically add a KVM_BUG_ON() to ensure the caller is limiting the length of a single MMIO access to 8 bytes (the largest size userspace is prepared to handled, as the ABI was baked before things like MOVDQ came along). No functional change intended. Cc: Rick Edgecombe Cc: Binbin Wu Cc: Xiaoyao Li Cc: Tom Lendacky Cc: Michael Roth Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-15-seanjc@google.com Signed-off-by: Sean Christopherson commit 4f09e62afcd6c7a2c3428a3453ced7e56475dc70 Author: Sean Christopherson Date: Tue Feb 24 17:20:48 2026 -0800 KVM: x86: Don't panic the kernel if completing userspace I/O / MMIO goes sideways Kill the VM instead of the host kernel if KVM botches I/O and/or MMIO handling. There is zero danger to the host or guest, i.e. panicking the host isn't remotely justified. Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-14-seanjc@google.com Signed-off-by: Sean Christopherson commit 216729846603d5be668a84d75c88ae097c27ae61 Author: Sean Christopherson Date: Tue Feb 24 17:20:47 2026 -0800 KVM: x86: Rename .read_write_emulate() to .read_write_guest() Rename the ops and helpers to read/write guest memory to clarify that they do exactly that, i.e. aren't generic emulation flows and don't do anything related to emulated MMIO. Opportunistically add comments to explain the flow, e.g. it's not exactly obvious that KVM deliberately treats "failed" accesses to guest memory as emulated MMIO. No functional change intended. Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-13-seanjc@google.com Signed-off-by: Sean Christopherson commit 929613b3cd1a97bc6e17100c0cab5668cd4eff90 Author: Sean Christopherson Date: Tue Feb 24 17:20:46 2026 -0800 KVM: x86: Fold emulator_write_phys() into write_emulate() Fold emulator_write_phys() into write_emulate() to drop a superfluous wrapper, and to provide more symmetry between the read and write paths. No functional change intended. Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 3517193ef9c260e4a2677fd4e7dc09efd0f628bb Author: Sean Christopherson Date: Tue Feb 24 17:20:45 2026 -0800 KVM: x86: Bury emulator read/write ops in emulator_{read,write}_emulated() Now that SEV-ES invokes vcpu_mmio_{read,write}() directly, bury the read vs. write emulator ops in the dedicated emulator callbacks so that they are colocated with their usage, and to make it harder for non-emulator code to use hooks that are intended for the emulator. Opportunistically rename the structures to get rid of the long-standing "emultor" typo. No functional change intended. Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-11-seanjc@google.com Signed-off-by: Sean Christopherson commit 326e810eaaa53ae38c21855da064bfed26a44045 Author: Sean Christopherson Date: Tue Feb 24 17:20:44 2026 -0800 KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API Dedup kvm_sev_es_mmio_{read,write}() into a single API, as the "cost" of plumbing in a boolean is largely negligible since KVM pulls out a boolean for ops->write anyways, and consolidating the APIs will allow for additional cleanups. No functional change intended. Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-10-seanjc@google.com Signed-off-by: Sean Christopherson commit 33e09e2f9735fef7255aa96d1fe00782777bc44b Author: Sean Christopherson Date: Tue Feb 24 17:20:43 2026 -0800 KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() Dedup the SEV-ES emulated MMIO code by using the read vs. write emulator ops to handle the few differences between reads and writes. Opportunistically tweak the comment about fragments to call out that KVM should verify that userspace can actually handle MMIO requests that cross page boundaries. Unlike emulated MMIO, the request is made in the GPA space, not the GVA space, i.e. emulation across page boundaries can work generically, at least in theory. No functional change intended. Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 144089f5c3944cf6383d53ab5d941b74924a0989 Author: Sean Christopherson Date: Tue Feb 24 17:20:42 2026 -0800 KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free Add a sanity check to ensure KVM doesn't use an on-stack variable when handling an MMIO request for an SEV-ES guest. The source/destination for SEV-ES MMIO should _always_ be the #VMGEXIT scratch area. Opportunistically update the comment in the completion side of things to clarify that frag->data doesn't need to be copied anywhere, and the VMEGEXIT is trap-like (the current comment doesn't clarify *how* RIP is advanced). Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 72f36f99072c3b79451af38274d59ac30cc064c6 Author: Sean Christopherson Date: Tue Feb 24 17:20:41 2026 -0800 KVM: x86: Move MMIO write tracing into vcpu_mmio_write() Move the invocation of MMIO write tracepoint into vcpu_mmio_write() and drop its largely-useless wrapper to cull pointless code and to make the code symmetrical with respect to vcpu_mmio_read(). No functional change intended. Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-7-seanjc@google.com Signed-off-by: Sean Christopherson commit cbbf8228c0716d8f96f354f378efd1cbadb428e0 Author: Sean Christopherson Date: Tue Feb 24 17:20:40 2026 -0800 KVM: x86: Open code read vs. write userspace MMIO exits in emulator_read_write() Open code the differences in read vs. write userspace MMIO exits instead of burying three lines of code behind indirect callbacks, as splitting the logic makes it extremely hard to track that KVM's handling of reads vs. write is _significantly_ different. Add a comment to explain why the semantics are different, and how on earth an MMIO write ends up triggering an exit to userspace. No functional change intended. Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 523b6269f700373eba65ad8a0bfaac284a12c167 Author: Sean Christopherson Date: Tue Feb 24 17:20:39 2026 -0800 KVM: x86: Use local MMIO fragment variable to clean up emulator_read_write() Grab the MMIO fragment used by emulator_read_write() to initiate an exit to userspace in a local variable to make the code easier to read. No functional change intended. Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 4f11fded5381eb32ca2e0f1e280c6eb97eff92c8 Author: Sean Christopherson Date: Tue Feb 24 17:20:38 2026 -0800 KVM: x86: Trace unsatisfied MMIO reads on a per-page basis Invoke the "unsatisfied MMIO reads" when KVM first detects that a particular access "chunk" requires an exit to userspace instead of tracing the entire access at the time KVM initiates the exit to userspace. I.e. precisely trace the first and/or second fragments of a page split instead of tracing the entire access, as the GPA could be wrong on a page split case. Leave the completion tracepoint alone, at least for now, as fixing the completion path would incur significantly complexity to track exactly which fragment(s) of the overall access actually triggered MMIO, but add a comment that the tracing for completed reads in is technically wrong. Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 4046823e78b0c9abd25d23bffd7f1c773532dbfd Author: Sean Christopherson Date: Tue Feb 24 17:20:37 2026 -0800 KVM: x86: Open code handling of completed MMIO reads in emulator_read_write() Open code the handling of completed MMIO reads instead of using an ops hook, as burying the logic behind a (likely RETPOLINE'd) indirect call, and with an unintuitive name, makes relatively straightforward code hard to comprehend. Opportunistically add comments to explain the dependencies between the emulator's mem_read cache and the MMIO read completion logic, as it's very easy to overlook the cache's role in getting the read data into the correct destination. No functional change intended. Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 0b16e69d17d8c35c5c9d5918bf596c75a44655d3 Author: Sean Christopherson Date: Tue Feb 24 17:20:36 2026 -0800 KVM: x86: Use scratch field in MMIO fragment to hold small write values When exiting to userspace to service an emulated MMIO write, copy the to-be-written value to a scratch field in the MMIO fragment if the size of the data payload is 8 bytes or less, i.e. can fit in a single chunk, instead of pointing the fragment directly at the source value. This fixes a class of use-after-free bugs that occur when the emulator initiates a write using an on-stack, local variable as the source, the write splits a page boundary, *and* both pages are MMIO pages. Because KVM's ABI only allows for physically contiguous MMIO requests, accesses that split MMIO pages are separated into two fragments, and are sent to userspace one at a time. When KVM attempts to complete userspace MMIO in response to KVM_RUN after the first fragment, KVM will detect the second fragment and generate a second userspace exit, and reference the on-stack variable. The issue is most visible if the second KVM_RUN is performed by a separate task, in which case the stack of the initiating task can show up as truly freed data. ================================================================== BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420 Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984 CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack+0xbe/0xfd print_address_description.constprop.0+0x19/0x170 __kasan_report.cold+0x6c/0x84 kasan_report+0x3a/0x50 check_memory_region+0xfd/0x1f0 memcpy+0x20/0x60 complete_emulated_mmio+0x305/0x420 kvm_arch_vcpu_ioctl_run+0x63f/0x6d0 kvm_vcpu_ioctl+0x413/0xb20 __se_sys_ioctl+0x111/0x160 do_syscall_64+0x30/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1 RIP: 0033:0x42477d Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720 The buggy address belongs to the page: page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37 flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== The bug can also be reproduced with a targeted KVM-Unit-Test by hacking KVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by overwrite the data value with garbage. Limit the use of the scratch fields to 8-byte or smaller accesses, and to just writes, as larger accesses and reads are not affected thanks to implementation details in the emulator, but add a sanity check to ensure those details don't change in the future. Specifically, KVM never uses on-stack variables for accesses larger that 8 bytes, e.g. uses an operand in the emulator context, and *all* reads are buffered through the mem_read cache. Note! Using the scratch field for reads is not only unnecessary, it's also extremely difficult to handle correctly. As above, KVM buffers all reads through the mem_read cache, and heavily relies on that behavior when re-emulating the instruction after a userspace MMIO read exit. If a read splits a page, the first page is NOT an MMIO page, and the second page IS an MMIO page, then the MMIO fragment needs to point at _just_ the second chunk of the destination, i.e. its position in the mem_read cache. Taking the "obvious" approach of copying the fragment value into the destination when re-emulating the instruction would clobber the first chunk of the destination, i.e. would clobber the data that was read from guest memory. Fixes: f78146b0f923 ("KVM: Fix page-crossing MMIO") Suggested-by: Yashu Zhang Reported-by: Yashu Zhang Closes: https://lore.kernel.org/all/369eaaa2b3c1425c85e8477066391bc7@huawei.com Cc: stable@vger.kernel.org Tested-by: Tom Lendacky Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20260225012049.920665-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 690dc03859e7907bc995f389618c748619559477 Author: Jim Mattson Date: Tue Feb 10 15:45:42 2026 -0800 KVM: x86: Ignore cpuid faulting in SMM The Intel Virtualization Technology FlexMigration Application Note says, "When CPUID faulting is enabled, all executions of the CPUID instruction outside system-management mode (SMM) cause a general-protection exception (#GP(0)) if the current privilege level (CPL) is greater than 0." Always allow the execution of CPUID in SMM. Fixes: db2336a80489 ("KVM: x86: virtualize cpuid faulting") Signed-off-by: Jim Mattson Link: https://patch.msgid.link/20260210234613.1383279-1-jmattson@google.com Signed-off-by: Sean Christopherson commit e5cdd34b5f74c4a0c72fe43092192f347d999e77 Author: Yosry Ahmed Date: Wed Feb 25 00:59:46 2026 +0000 KVM: selftests: Extend state_test to check next_rip Similar to vGIF, extend state_test to make sure that next_rip is saved correctly in nested state. GUEST_SYNC() in L2 causes IO emulation by KVM, which advances the RIP to the value of next_rip. Hence, if next_rip is saved correctly, its value should match the saved RIP value. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260225005950.3739782-5-yosry@kernel.org Signed-off-by: Sean Christopherson commit 2303ca26fbb005a45aaf5a547465f978df906cb7 Author: Yosry Ahmed Date: Wed Feb 25 00:59:45 2026 +0000 KVM: selftests: Extend state_test to check vGIF V_GIF_MASK is one of the fields written by the CPU after VMRUN, and sync'd by KVM from vmcb02 to cached vmcb12 after running L2. Part of the reason is to make sure V_GIF_MASK is saved/restored correctly, as the cached vmcb12 is the payload of nested state. Verify that V_GIF_MASK is saved/restored correctly in state_test by enabling vGIF in vmcb12, toggling GIF in L2 at different GUEST_SYNC() points, and verifying that V_GIF_MASK is correctly propagated to the nested state. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260225005950.3739782-4-yosry@kernel.org Signed-off-by: Sean Christopherson commit 03bee264f8ebfd39e0254c98e112d033a7aa9055 Author: Yosry Ahmed Date: Wed Feb 25 00:59:44 2026 +0000 KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 After VMRUN in guest mode, nested_sync_control_from_vmcb02() syncs fields written by the CPU from vmcb02 to the cached vmcb12. This is because the cached vmcb12 is used as the authoritative copy of some of the controls, and is the payload when saving/restoring nested state. int_state is also written by the CPU, specifically bit 0 (i.e. SVM_INTERRUPT_SHADOW_MASK) for nested VMs, but it is not sync'd to cached vmcb12. This does not cause a problem if KVM_SET_NESTED_STATE preceeds KVM_SET_VCPU_EVENTS in the restore path, as an interrupt shadow would be correctly restored to vmcb02 (KVM_SET_VCPU_EVENTS overwrites what KVM_SET_NESTED_STATE restored in int_state). However, if KVM_SET_VCPU_EVENTS preceeds KVM_SET_NESTED_STATE, an interrupt shadow would be restored into vmcb01 instead of vmcb02. This would mostly be benign for L1 (delays an interrupt), but not for L2. For L2, the vCPU could hang (e.g. if a wakeup interrupt is delivered before a HLT that should have been in an interrupt shadow). Sync int_state to the cached vmcb12 in nested_sync_control_from_vmcb02() to avoid this problem. With that, KVM_SET_NESTED_STATE restores the correct interrupt shadow state, and if KVM_SET_VCPU_EVENTS follows it would overwrite it with the same value. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") CC: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260225005950.3739782-3-yosry@kernel.org Signed-off-by: Sean Christopherson commit 778d8c1b2a6ffe622ddcd3bb35b620e6e41f4da0 Author: Yosry Ahmed Date: Wed Feb 25 00:59:43 2026 +0000 KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 After VMRUN in guest mode, nested_sync_control_from_vmcb02() syncs fields written by the CPU from vmcb02 to the cached vmcb12. This is because the cached vmcb12 is used as the authoritative copy of some of the controls, and is the payload when saving/restoring nested state. NextRIP is also written by the CPU (in some cases) after VMRUN, but is not sync'd to the cached vmcb12. As a result, it is corrupted after save/restore (replaced by the original value written by L1 on nested VMRUN). This could cause problems for both KVM (e.g. when injecting a soft IRQ) or L1 (e.g. when using NextRIP to advance RIP after emulating an instruction). Fix this by sync'ing NextRIP to the cache after VMRUN of L2, but only after completing interrupts (not in nested_sync_control_from_vmcb02()), as KVM may update NextRIP (e.g. when re-injecting a soft IRQ). Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") CC: stable@vger.kernel.org Co-developed-by: Sean Christopherson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260225005950.3739782-2-yosry@kernel.org Signed-off-by: Sean Christopherson commit 24f7d36b824b65cf1a2db3db478059187b2a37b0 Author: Yosry Ahmed Date: Tue Feb 24 22:50:17 2026 +0000 KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode On nested VMRUN, KVM ensures AVIC is inhibited by requesting KVM_REQ_APICV_UPDATE, triggering a check of inhibit reasons, finding APICV_INHIBIT_REASON_NESTED, and disabling AVIC. However, when KVM_SET_NESTED_STATE is performed on a vCPU not in guest mode with AVIC enabled, KVM_REQ_APICV_UPDATE is not requested, and AVIC is not inhibited. Request KVM_REQ_APICV_UPDATE in the KVM_SET_NESTED_STATE path if AVIC is active, similar to the nested VMRUN path. Fixes: f44509f849fe ("KVM: x86: SVM: allow AVIC to co-exist with a nested guest running") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260224225017.3303870-1-yosry@kernel.org Signed-off-by: Sean Christopherson commit f5ada26d6cca4c5d9a20eda55f44e772018b36af Merge: 01857fc712f646 4ff5801f45b494 Author: Jakub Kicinski Date: Mon Mar 2 15:46:10 2026 -0800 Merge tag 'phy-qcom-sgmii-eth-add-set_mode-and-validate-methods' net: stmmac: qcom-ethqos: further serdes reorganisation [part] First PHY patch of Russell's series. Vladimir will need this to avoid a conflict with his work. Link: https://patch.msgid.link/aaDSJAc-x2-klvHJ@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 4ff5801f45b494ad8251a16ec06c9f303ed3b9a0 Author: Russell King (Oracle) Date: Thu Feb 26 23:09:27 2026 +0000 phy: qcom-sgmii-eth: add .set_mode() and .validate() methods qcom-sgmii-eth is an Ethernet SerDes supporting only Ethernet mode using SGMII, 1000BASE-X and 2500BASE-X. Add an implementation of the .set_mode() method, which can be used instead of or as well as the .set_speed() method. The Ethernet interface modes mentioned above all have a fixed data rate, so setting the mode is sufficient to fully specify the operating parameters. Add an implementation of the .validate() method, which will be necessary to allow discovery of the SerDes capabilities for platform independent SerDes support in the stmmac network driver. Reviewed-by: Vladimir Oltean Reviewed-by: Bartosz Golaszewski Acked-by: Vinod Koul Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvkU3-0000000AuP2-0hu3@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e907b4e72488f1df878e7e8acf88d23e49cb3ca7 Author: Yosry Ahmed Date: Fri Feb 27 01:13:06 2026 +0000 KVM: x86: Check for injected exceptions before queuing a debug exception On KVM_SET_GUEST_DEBUG, if a #DB or #BP is injected with KVM_GUESTDBG_INJECT_DB or KVM_GUESTDBG_INJECT_BP, KVM fails with -EBUSY if there is an existing pending exception. This was introduced in commit 4f926bf29186 ("KVM: x86: Polish exception injection via KVM_SET_GUEST_DEBUG") to avoid a warning in kvm_queue_exception(), presumably to avoid overriding a pending exception. This added another (arguably nice) property, if there's a pending exception, KVM_SET_GUEST_DEBUG cannot cause a #DF or triple fault. However, if an exception is injected, KVM_SET_GUEST_DEBUG will cause a #DF or triple fault in the guest, as kvm_multiple_exception() combines them. Check for both pending and injected exceptions for KVM_GUESTDBG_INJECT_DB and KVM_GUESTDBG_INJECT_BP, to avoid accidentally injecting a #DB or triple fault. Signed-off-by: Yosry Ahmed base-commit: a68a4bbc5b9ce5b722473399f05cb05217abaee8 Signed-off-by: Sean Christopherson commit a4f23717b1d6fa7b438c63537edadf1b5b181b38 Merge: d3b693a13b39bc 11439c4635edd6 Author: Mark Brown Date: Mon Mar 2 23:16:01 2026 +0000 spi: Merge up v7.0-rc2 This gets us a fix for KUnit which allows us to test it. commit c26137d3a3a8168b49679e30cf3c08177bb2dbe7 Merge: 9ab637ac5d3826 11439c4635edd6 Author: Mark Brown Date: Mon Mar 2 23:15:13 2026 +0000 regmap: Merge up v7.0-rc2 This gets us a fix for KUnit execution which allows us to run the testsuite again. commit 4d4becffe425fd8a4ab6bea5a8cb6d23428bd657 Merge: 4add09ab359c8c e84141846decb7 Author: Mark Brown Date: Mon Mar 2 23:11:58 2026 +0000 regulator: pf9453: Fix IRQ trigger and allow Merge series from Franz Schnyder : The IRQ_B pin is an open-drain output. The datasheet specifies, that the IRQ_B pin is pulled low when any unmasked interrupt bit status is changed, and it is released high once the application processor reads the INT1 register. As it specifies a level-low behavior, it should not force a falling-edge interrupt. Remove the IRQF_TRIGGER_FALLING to not force the falling-edge interrupt and instead rely on the flag from the device tree. Set the IRQF_SHARED to be able to share the interrupt line with other devices. If the interrupt has not been triggered by the PMIC, return IRQ_NONE. commit 806140e9a33218f22188fe5019c7874aa78d81f8 Author: Lizhi Hou Date: Thu Feb 26 10:25:45 2026 -0800 PCI: Avoid FLR for AMD NPU device The AMD NPU device (PCI Device IDs 0x1502 and 0x17f0) advertises FLR support. However, triggering an FLR causes the device to hang. Signed-off-by: Lizhi Hou Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260226182545.3057330-1-lizhi.hou@amd.com commit fa78a514d632ed2428b7c573108d9658c00d536e Author: Sean Christopherson Date: Fri Jan 23 14:45:14 2026 -0800 KVM: Isolate apicv_update_lock and apicv_nr_irq_window_req in a cacheline Force apicv_update_lock and apicv_nr_irq_window_req to reside in their own cacheline to avoid generating significant contention due to false sharing when KVM is contantly creating IRQ windows. E.g. apicv_inhibit_reasons is read on every VM-Enter; disabled_exits is read on page faults, on PAUSE exits, if a vCPU is scheduled out, etc.; kvmclock_offset is read every time a vCPU needs to refresh kvmclock, and so on and so forth. Isolating the write-mostly fields from all other (read-mostly) fields improves performance by 7-8% when running netperf TCP_RR between two guests on the same physical host when using an in-kernel PIT in re-inject mode. Reported-by: Naveen N Rao (AMD) Closes: https://lore.kernel.org/all/yrxhngndj37edud6tj5y3vunaf7nirwor4n63yf4275wdocnd3@c77ujgialc6r Tested-by: Naveen N Rao (AMD) Link: https://patch.msgid.link/20260123224514.2509129-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 5617dddcfa30129562d7028ec766797d8c345f36 Author: Sean Christopherson Date: Fri Jan 23 14:45:13 2026 -0800 KVM: SVM: Optimize IRQ window inhibit handling IRQ windows represent times during which an IRQ can be injected into a vCPU, and thus represent times when a vCPU is running with RFLAGS.IF=1 and GIF enabled (TPR/PPR don't matter since KVM controls interrupt injection and it only injects one interrupt at a time). On SVM, when emulating the local APIC (i.e., AVIC disabled), KVM detects IRQ windows by injecting a dummy virtual interrupt through VMCB.V_IRQ and intercepting virtual interrupts (INTERCEPT_VINTR). This intercept triggers as soon as the guest enables interrupts and is about to take the dummy interrupt, at which point the actual interrupt can be injected through VMCB.EVENTINJ. When AVIC is enabled, VMCB.V_IRQ is ignored by the hardware and so detecting IRQ windows requires AVIC to be inhibited. However, this is only necessary for ExtINTs since all other interrupts can be injected either by directly setting IRR in the APIC backing page and letting the AVIC hardware inject the interrupt into the guest, or via VMCB.V_NMI for NMIs. If AVIC is enabled but inhibited for some other reason, KVM has to request for IRQ window inhibits every time it has to inject an interrupt into the guest. This is because APICv inhibits are dynamic in nature, so KVM has to be sure that AVIC is inhibited for purposes of discovering an IRQ window even if the other inhibit is cleared in the meantime. This is particularly problematic with APICV_INHIBIT_REASON_PIT_REINJ which stays set throughout the life of the guest and results in KVM rapidly toggling IRQ window inhibit resulting in contention on apicv_update_lock. Address this by setting and clearing APICV_INHIBIT_REASON_PIT_REINJ lazily: if some other inhibit reason is already set, just increment the IRQ window request count and do not update apicv_inhibit_reasons immediately. If any other inhibit reason is set/cleared in the meantime, re-evaluate APICV_INHIBIT_REASON_PIT_REINJ by checking the IRQ window request count and update apicv_inhibit_reasons appropriately. Otherwise, just the IRQ window request count is incremented/decremented each time an IRQ window is requested. This reduces much of the contention on the apicv_update_lock semaphore and does away with much of the performance degradation. Co-developed-by: Paolo Bonzini Signed-off-by: Paolo Bonzini Co-developed-by: Naveen N Rao (AMD) Signed-off-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://patch.msgid.link/20260123224514.2509129-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 6563ddadd169cc6f509a75b3ff8354309dcb9080 Author: Sean Christopherson Date: Fri Jan 23 14:45:12 2026 -0800 KVM: SVM: Fix IRQ window inhibit handling across multiple vCPUs IRQ window inhibits can be requested by multiple vCPUs at the same time for injecting interrupts meant for different vCPUs. However, AVIC inhibition is VM-wide and hence it is possible for the inhibition to be cleared prematurely by the first vCPU that obtains the IRQ window even though a second vCPU is still waiting for its IRQ window. This is likely not a functional issue since the other vCPU will again see that interrupts are pending to be injected (due to KVM_REQ_EVENT), and will again request for an IRQ window inhibition. However, this can result in AVIC being rapidly toggled resulting in high contention on apicv_update_lock and degrading performance of the guest. Address this by maintaining a VM-wide count of the number of vCPUs that have requested for an IRQ window. Set/clear the inhibit reason when the count transitions between 0 and 1. This ensures that the inhibit reason is not cleared as long as there are some vCPUs still waiting for an IRQ window. Co-developed-by: Paolo Bonzini Signed-off-by: Paolo Bonzini Co-developed-by: Naveen N Rao (AMD) Signed-off-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://patch.msgid.link/20260123224514.2509129-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 7b402ec851cb66e73ee35913c7d802bba820086b Author: Sean Christopherson Date: Fri Jan 23 14:45:11 2026 -0800 KVM: SVM: Fix clearing IRQ window inhibit with nested guests Clearing IRQ window inhibit today relies on interrupt window interception, but that is not always reachable when nested guests are involved. If L1 is intercepting IRQs, then interrupt_window_interception() will never be reached while L2 is active, because the only reason KVM would set the V_IRQ intercept in vmcb02 would be on behalf of L1, i.e. because of vmcb12. svm_clear_vintr() always operates on (at least) vmcb01, and VMRUN unconditionally sets GIF=1, which means that enter_svm_guest_mode() will always do svm_clear_vintr() via svm_set_gif(svm, true). I.e. KVM will keep the VM-wide inhibit set until control transfers back to L1 *and* an interrupt window is triggered. If L1 is not intercepting IRQs, KVM may immediately inject L1's ExtINT into L2 if IRQs are enabled in L2 without taking an interrupt window interception. Address this by clearing the IRQ window inhibit when KVM actually injects an interrupt and there are no further injectable interrupts. That way, if L1 isn't intercepting IRQs, KVM will drop the inhibit as soon as an interrupt is injected into L2. And if L1 is intercepting IRQs, KVM will keep the inhibit until the IRQ is injected into L2. So, AVIC won't be left inhibited. Note, somewhat blindly invoking kvm_clear_apicv_inhibit() is both wrong and suboptimal. If the IRQWIN inhibit isn't set, then the vCPU will unnecessarily take apicv_update_lock for write. And if a _different_ vCPU has an injectable IRQ, clearing IRQWIN may block that vCPU's ability to inject its IRQ. Defer fixing both issues to a future commit, as fixing one problem without also fixing the other would also leave KVM in a temporarily bad state, as would fixing both issues without fixing _this_ bug. I.e. it's not feasible to fix each bug independently without there being some remaining flaw in KVM. Co-developed-by: Naveen N Rao (AMD) Signed-off-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://patch.msgid.link/20260123224514.2509129-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 6dad5447c7bfca26b5d72604b5378dca6dc58bbc Author: Ackerley Tng Date: Thu Jan 29 09:26:46 2026 -0800 KVM: guest_memfd: Don't set FGP_ACCESSED when getting folios guest_memfd folios don't care about accessed flags since the memory is unevictable and there is no storage to write back to, hence, cleanup the allocation path by not setting FGP_ACCESSED. Signed-off-by: Ackerley Tng [sean: split to separate patch] Acked-by: Vlastimil Babka Acked-by: David Hildenbrand (arm) Link: https://patch.msgid.link/20260129172646.2361462-1-ackerleytng@google.com Signed-off-by: Sean Christopherson commit 52de184badc48d2bb5f2087b19da9d2cddfb0464 Author: Li RongQing Date: Mon Feb 2 04:50:04 2026 -0500 KVM: SVM: Mark module parameters as __ro_after_init for security and performance SVM module parameters such as avic, sev_enabled, npt_enabled, and pause_filter_thresh are configured exclusively during initialization (via kernel command line) and remain constant throughout runtime. Additionally, sev_supported_vmsa_features and svm_gp_erratum_intercept, while not exposed as module parameters, share the same initialization pattern and runtime constancy. Mark these variables with '__ro_after_init' to: - Harden against accidental or malicious runtime modification - Enable compiler and CPU optimizations (improved caching, branch prediction) - Align with kernel security best practices for init-only configuration The exception is 'iopm_base', which retains '__read_mostly' as it requires updates during module unloading. Suggested-by: Sean Christopherson Signed-off-by: Li RongQing Link: https://patch.msgid.link/20260202095004.1765-1-lirongqing@baidu.com Signed-off-by: Sean Christopherson commit 5a6b189317501169b0510f2f1256cfc0c6ca81c7 Author: Li RongQing Date: Mon Feb 2 04:50:04 2026 -0500 KVM: SVM: Mark module parameters as __ro_after_init for security and performance SVM module parameters such as avic, sev_enabled, npt_enabled, and pause_filter_thresh are configured exclusively during initialization (via kernel command line) and remain constant throughout runtime. Additionally, sev_supported_vmsa_features and svm_gp_erratum_intercept, while not exposed as module parameters, share the same initialization pattern and runtime constancy. Mark these variables with '__ro_after_init' to: - Harden against accidental or malicious runtime modification - Enable compiler and CPU optimizations (improved caching, branch prediction) - Align with kernel security best practices for init-only configuration The exception is 'iopm_base', which retains '__read_mostly' as it requires updates during module unloading. Suggested-by: Sean Christopherson Signed-off-by: Li RongQing Link: https://patch.msgid.link/20260202095004.1765-1-lirongqing@baidu.com Signed-off-by: Sean Christopherson commit e63fb1379f4b9300a44739964e69549bebbcdca4 Author: Yosry Ahmed Date: Tue Feb 10 01:08:06 2026 +0000 KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state When restoring a vCPU in guest mode, any state restored before KVM_SET_NESTED_STATE (e.g. KVM_SET_SREGS) will mark the corresponding dirty bits in vmcb01, as it is the active VMCB before switching to vmcb02 in svm_set_nested_state(). Hence, mark all fields in vmcb02 dirty in svm_set_nested_state() to capture any previously restored fields. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") CC: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260210010806.3204289-1-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 192f777b3af084d2073037b13ed0c2457e563d39 Author: Uros Bizjak Date: Wed Feb 11 11:28:50 2026 +0100 KVM: VMX: Use ASM_INPUT_RM in __vmcs_writel Use the ASM_INPUT_RM macro for VMCS write operation in vmx_ops.h to work around clang problems with "rm" asm constraint. clang seems to always chose the memory input, while it is almost always the worst choice. Signed-off-by: Uros Bizjak Cc: Sean Christopherson Cc: Paolo Bonzini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Acked-by: Nathan Chancellor Link: https://patch.msgid.link/20260211102928.100944-2-ubizjak@gmail.com Signed-off-by: Sean Christopherson commit 6dad59124e1536a38e0f177d45418ebe1e0eea1f Author: Uros Bizjak Date: Wed Feb 11 11:28:49 2026 +0100 KVM: VMX: Drop obsolete branch hint prefixes from inline asm Remove explicit branch hint prefixes (.byte 0x2e / 0x3e) from VMX inline assembly sequences. These prefixes (CS/DS segment overrides used as branch hints on very old x86 CPUs) have been ignored by modern processors for a long time. Keeping them provides no measurable benefit and only enlarges the generated code. No functional change intended. Signed-off-by: Uros Bizjak Cc: Sean Christopherson Cc: Paolo Bonzini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Link: https://patch.msgid.link/20260211102928.100944-1-ubizjak@gmail.com Signed-off-by: Sean Christopherson commit 46ee9d718b9b67a8be067a39e21da6634107ed0e Author: Li RongQing Date: Tue Feb 10 01:21:43 2026 -0500 KVM: Mark halt poll and other module parameters with appropriate memory attributes Add '__read_mostly' to the halt polling parameters (halt_poll_ns, halt_poll_ns_grow, halt_poll_ns_grow_start, halt_poll_ns_shrink) since they are frequently read in hot paths (e.g., vCPU halt handling) but only occasionally updated via sysfs. This improves cache locality on SMP systems. Conversely, mark 'allow_unsafe_mappings' and 'enable_virt_at_load' with '__ro_after_init', as they are set only during module initialization via kernel command line or early sysfs writes and remain constant thereafter. This enhances security by preventing runtime modification and enables compiler optimizations. Signed-off-by: Li RongQing Link: https://patch.msgid.link/20260210062143.1739-1-lirongqing@baidu.com Signed-off-by: Sean Christopherson commit c522ac04ba9d7ec6003633aa1501c7392cdf8b2d Author: Carlos López Date: Thu Feb 12 15:05:56 2026 +0100 KVM: x86/pmu: annotate struct kvm_x86_pmu_event_filter with __counted_by() struct kvm_x86_pmu_event_filter has a flexible array member, so annotate it with the field that describes the amount of entries in such array. Opportunistically replace the open-coded array size calculation with flex_array_size() when copying the array portion of the struct from userspace. Signed-off-by: Carlos López Link: https://patch.msgid.link/20260212140556.3883030-2-clopez@suse.de Signed-off-by: Sean Christopherson commit e1df128dc00beaa53b0be4e751b7f2f0192dc146 Author: Uros Bizjak Date: Thu Feb 12 22:24:04 2026 +0100 KVM: x86: Zero-initialize temporary fxregs_state buffers in FXSAVE emulation Explicitly zero-initialize stack-allocated struct fxregs_state variables in em_fxsave() and fxregs_fixup() to ensure all padding and unused fields are cleared before use. Both functions declare temporary fxregs_state buffers that may be partially written by fxsave. Although the emulator copies only the architecturally defined portion of the state to userspace, any padding or otherwise untouched bytes in the structure can remain uninitialized. This can lead to the use of uninitialized stack data and may trigger KMSAN reports. In the worst case, it could result in leaking stack contents if such bytes are ever exposed. No functional change intended. Suggested-by: Sean Christopherson Signed-off-by: Uros Bizjak Cc: Sean Christopherson Cc: Paolo Bonzini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Link: https://patch.msgid.link/20260212212457.24483-1-ubizjak@gmail.com Signed-off-by: Sean Christopherson commit 6bc6fec71ac45f52db609af4e62bdb96b9f5fadb Author: Shuicheng Lin Date: Wed Feb 4 17:28:11 2026 +0000 drm/xe/reg_sr: Fix leak on xa_store failure Free the newly allocated entry when xa_store() fails to avoid a memory leak on the error path. v2: use goto fail_free. (Bala) Fixes: e5283bd4dfec ("drm/xe/reg_sr: Remove register pool") Cc: Balasubramani Vivekanandan Cc: Matt Roper Signed-off-by: Shuicheng Lin Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260204172810.1486719-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper commit a251f9ed77f01f16adaaa1b3d2f568fc1b5acbfd Author: Andrej Picej Date: Tue Jan 13 20:06:08 2026 +0100 arm64: dts: imx93-phyboard-segin: Add peb-av-02 overlay Add overlay for Audio-Video module PEB-AV-02. Add support for panel display, capacitive touchscreen and backlight. The pwm-backlight uses the GPIO based PWM implementation for now. Switch to the FlexIO PWM support once available. Signed-off-by: Andrej Picej [rework commit message, use local regulator, remove compatible] Signed-off-by: Primoz Fiser Signed-off-by: Christian Hemp [m.felsch@pengutronix.de: cleanup downstream commit] Tested-by: Primoz Fiser Signed-off-by: Marco Felsch Signed-off-by: Frank Li commit 56435b70f778995c696d53624ba93a429aa38432 Author: Rakuram Eswaran Date: Wed Dec 24 00:10:03 2025 +0530 PCI: amd-mdb: Correct IRQ number in INTx error message The INTx devm_request_irq() failure path logs an incorrect IRQ number. The printed 'irq' variable refers to a previous MDB interrupt mapping and does not correspond to the INTx IRQ being requested. Fix the error message to report pcie->intx_irq, which is the IRQ associated with the failing request. Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202512230112.AaiGqMWM-lkp@intel.com/ Reported-by: Dan Carpenter Signed-off-by: Rakuram Eswaran Signed-off-by: Manivannan Sadhasivam [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Sai Krishna Musham Link: https://patch.msgid.link/20251223184003.32950-1-rakuram.e96@gmail.com commit fe3c03b84ae69f34992a5e72cbb8384b9ebad738 Author: Randy Dunlap Date: Sun Mar 1 16:51:54 2026 -0800 cred: fix kernel-doc warnings in cred.h Use the correct function parameter names, function names, or kernel-doc format, and add function return comment sections to avoid kernel-doc warnings: Warning: include/linux/cred.h:43 function parameter 'gi' not described in 'get_group_info' Warning: include/linux/cred.h:43 No description found for return value of 'get_group_info' Warning: include/linux/cred.h:213 No description found for return value of 'get_cred_many' Warning: include/linux/cred.h:260 function parameter '_cred' not described in 'put_cred_many' Warning: include/linux/cred.h:260 expecting prototype for put_cred(). Prototype was for put_cred_many() instead Signed-off-by: Randy Dunlap [PM: subject tweak] Signed-off-by: Paul Moore commit db217d08afc21cbe13f282948a74c528d8740d3b Author: Gangliang Xie Date: Mon Dec 15 12:34:41 2025 +0800 drm/amd/ras: Add table reset func for pmfw eeprom add table reset func for pmfw eeprom, add smu eeprom control structure Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 0e5eaa8d8d612969ef7485b68e98940c737efac3 Author: Colin Ian King Date: Sat Feb 28 09:59:38 2026 +0000 drm/amd/display: remove extra ; from statement, remove extra tabs There is a statement that has a ;; at the end, remove the extraneous ; and remove extra tabs in the code block. Signed-off-by: Colin Ian King Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 36a0245666882cf10ddc0576b78a33692263e417 Author: Lijo Lazar Date: Tue Dec 9 19:43:21 2025 +0530 drm/amdgpu: Use get_smn_base in aqua_vanjaram Use get_smn_base interface to get IP die instance's base offset in aqua_vanjaram. encode_ext_smn_addressing is not used. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 467ebfe65f6e70da92266b156c6fbf6e9e0e022f Author: Lijo Lazar Date: Tue Dec 9 18:01:25 2025 +0530 drm/amdgpu: Add smn callbacks to register block Add smn block to register access and callback interface definition to get smn base. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit b2d55124712b3551842bab228f27db3df8068b30 Author: Lijo Lazar Date: Tue Dec 9 11:32:42 2025 +0530 drm/amdgpu: Move pcie lock to register block Move pcie register access lock to register access block. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 4a6ab03731c0cb7fd9c98930ad79eb784a5c72d1 Author: Lijo Lazar Date: Tue Dec 9 11:28:45 2025 +0530 drm/amdgpu: Add pcie64 extended to register block Add extended pcie 64-bit access method to register access block. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 74b9c49e6d8ba2586081aecd86af96c510092103 Author: Lijo Lazar Date: Tue Dec 9 11:11:41 2025 +0530 drm/amdgpu: Add pcie64 indirect to register block Move 64-bit pcie indirect read/writes to register access block. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 5312d68a6bdbf3546cc3fbea0fb5d283b28aabbe Author: Lijo Lazar Date: Tue Dec 9 10:09:37 2025 +0530 drm/amdgpu: Add pcie ext access to register block Move pcie extended access (64-bit address) to register access block. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit e84d7e717bf94bd977e20e5ca52d0b2ae4e19802 Author: Lijo Lazar Date: Tue Dec 9 09:47:13 2025 +0530 drm/amdgpu: Add pcie indirect to register block Move pcie indirect access to register access block. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 5d82f451b0ab2d7137d9ffdd0d15675b756ab29d Author: Lijo Lazar Date: Tue Dec 9 09:35:18 2025 +0530 drm/amdgpu: Add pciep method to register block Move pcie port method to register access block. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 72cc2e3011549d7b71e1d641c925ab6e9ff495d8 Author: Lijo Lazar Date: Mon Dec 8 19:11:57 2025 +0530 drm/amdgpu: Add audio method to register block Move audio endpoint callbacks to register access block. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit b1a516a5df1eb3294e807b09db907e823731cb51 Author: Lijo Lazar Date: Mon Dec 8 19:04:47 2025 +0530 drm/amdgpu: Add se cac method to register block Move se cac access callbacks to register access block. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit d2de787f2d8097e5c583a7307b798cf5ec31cb55 Author: Lijo Lazar Date: Mon Dec 8 18:57:47 2025 +0530 drm/amdgpu: Add gc cac method to register block Move gc cac access callbacks to register access block. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 4780a26a96f88631d56f7bd0eee4e2c6721a279b Author: Lijo Lazar Date: Mon Dec 8 18:52:42 2025 +0530 drm/amdgpu: Add didt method to register block Move didt callbacks to register access block. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 750cbc4fbd4909476e0ffccb19e6333dd68d7380 Author: Srinivasan Shanmugam Date: Sun Mar 1 18:19:50 2026 +0530 drm/amdgpu: Drop redundant syncobj handle limit checks in userq ioctls Clang warns that comparing a __u16 value against 65536 is always false. num_syncobj_handles is defined as __u16 in both the userq signal and wait ioctl argument structs, so it can never exceed 65535. The checks against AMDGPU_USERQ_MAX_HANDLES are therefore redundant and trigger -Wtautological-constant-out-of-range-compare. Fixes: Clang -Wtautological-constant-out-of-range-compare in userq signal/wait ioctls Fixes: d8e760b7996d ("drm/amdgpu: update type for num_syncobj_handles in drm_amdgpu_userq_signal") Fixes: c561d2320492 ("drm/amdgpu: update type for num_syncobj_handles in drm_amdgpu_userq_wait") Cc: Alex Deucher Cc: Christian König Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 0d21084c02864fc95df18c5cdd3bab6efafdd406 Author: Gangliang Xie Date: Fri Dec 12 16:15:56 2025 +0800 drm/amd/ras: add wrapper funcs for pmfw eeprom add wrapper funcs for pmfw eeprom interface to make them easier to be called Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 12f4d4482af9271534db8ecaeca1f1a5a4ef3259 Author: Gangliang Xie Date: Fri Dec 12 16:04:30 2025 +0800 drm/amd/ras: add uniras smu feature flag init func add flag to indicate if pmfw eeprom is supported or not, and initialize it v2: change copyright from 2025 to 2026 Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 689b03a0a28b43bab3016f57b933fbacfb3dcd45 Author: Gangliang Xie Date: Fri Dec 12 14:16:17 2025 +0800 drm/amd/ras: add pmfw eeprom smu interfaces add smu interfaces and its data structures for pmfw eeprom in uniras v2: add 'const' to smu messages array, and specify index for each member when initializing. Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 45c692a177a9251c284f96478eab949625b2efa3 Author: Gangliang Xie Date: Fri Dec 12 15:42:49 2025 +0800 drm/amd/pm: add feature query interface for uniras add amdgpu_smu_ras_feature_is_enabled to query one feature is supported or not v2: change default return value from -EOPNOTSUPP to 0 Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit fd58392dc57d66155f33b240a3c59b909a1a947e Author: Gangliang Xie Date: Thu Dec 11 18:14:46 2025 +0800 drm/amd/pm: add pmfw eeprom messages into uniras interface add pmfw eeprom related messages into smu_v13_0_6_ras_send_msg v2: add sriov check before sending smu commands Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 366201e790f10ddc081ef787e2e345553b87459d Author: Lijo Lazar Date: Mon Dec 8 18:38:52 2025 +0530 drm/amdgpu: Add uvd indirect to register block Add uvd indirect method to register access block and replace the existing calls from adev. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit f4eb08f8b216c334752246fe24e1304477d78968 Author: Lijo Lazar Date: Mon Dec 8 18:26:09 2025 +0530 drm/amdgpu: Add smc method to register block Define register access block which consolidates different register access methods. Add smc method to register access block. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 3d77ca68eb0b48f88cc891d1b98f109b68e2ffcf Author: Tao Zhou Date: Sat Feb 21 20:11:03 2026 +0800 drm/amdgpu: clear related counter after RAS eeprom reset Make eeprom data and its counter consistent. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 2e36bc6abd40b6bb5768aae54d7832619d660d88 Author: Tao Zhou Date: Sat Feb 21 10:48:14 2026 +0800 drm/amdgpu: compatible with specific RAS old eeprom format Handle RAS eeprom record when UMC_CHANNEL_IDX_V2 is set. v2: get UMC_CHANNEL_IDX_V2 flag before the clear of it. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit c561d2320492e0dbe50a37437a525a2e91c471bd Author: Sunil Khatri Date: Thu Feb 26 21:18:51 2026 +0530 drm/amdgpu: update type for num_syncobj_handles in drm_amdgpu_userq_wait update the type for num_syncobj_handles from __u32 to _u16 with required padding. This breaks the UAPI for big-endian platforms but this is deliberate and harmless since userqueues is still a beta feature. It is enabled via module parameter and need the right fw support to work. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit d8e760b7996df37b6c1f25ca8a4a5645f144f63c Author: Sunil Khatri Date: Thu Feb 26 21:14:27 2026 +0530 drm/amdgpu: update type for num_syncobj_handles in drm_amdgpu_userq_signal update the type for num_syncobj_handles from __u64 to _u16 with required padding. This breaks the UAPI for big-endian platforms but this is deliberate and harmless since userqueues is still a beta feature. It is enabled via module parameter and need the right fw support to work. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 2d60e9898a1d4f66f7ec1954e1f086490ce6560b Author: Sunil Khatri Date: Thu Feb 26 13:05:55 2026 +0530 drm/amdgpu/userq: change queue id type to u32 from int queue id always remain a positive value and should be of type unsigned. With this we also dont need to typecast the id to other types specially in xarray functions. Signed-off-by: Sunil Khatri Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 549b7a6d841f5848dee92e906f20adff0bf18d07 Author: Taimur Hassan Date: Fri Feb 20 17:53:34 2026 -0500 drm/amd/display: Promote DC to 3.2.372 This version brings along the following updates: - Prevent integer overflow when mhz to khz - Remove always-false branches - Remove redundant initializers - Silence unused variable warning - Initialize replay_state to PR_STATE_INVALID - Fallback to boot snapshot for dispclk - Skip cursor cache reset if hubp powergating is disabled Reviewed-by: Leo Li Signed-off-by: Taimur Hassan Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit a6053fefcd3e3522274344dd5da8d49eafea25ca Author: Ricardo Robaina Date: Thu Feb 26 15:13:38 2026 -0300 audit: remove redundant initialization of static variables to 0 Static variables are automatically initialized to 0 by the compiler. Remove the redundant explicit assignments in kernel/audit.c to clean up the code, align with standard kernel coding style, and fix the following checkpatch.pl errors: ./scripts/checkpatch.pl kernel/audit.c | grep -A2 ERROR: ERROR: do not initialise statics to 0 + static unsigned long last_check = 0; -- ERROR: do not initialise statics to 0 + static int messages = 0; -- ERROR: do not initialise statics to 0 + static unsigned long last_msg = 0; Signed-off-by: Ricardo Robaina Signed-off-by: Paul Moore commit 7783a8bf065461c1eecaae5ab4421dd4d895f72b Author: YiPeng Chai Date: Thu Feb 26 17:56:26 2026 +0800 drm/amdgpu: Fix static assertion failure issue Since the PAGE_SIZE is 8KB on sparc64, the size of structure amdsriov_ras_telemetry will exceed 64KB, so use absolute value to fix the buffer size. Fixes the issue: drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h:522:2: error: static assertion failed due to requirement 'sizeof(struct amdsriov_ras_telemetry) <= 64 << 10': amdsriov_ras_telemetry must be 64 KB | sizeof(struct amdsriov_ras_telemetry) <= AMD_SRIOV_MSG_RAS_TELEMETRY_SIZE_KB_V1 << 10, drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h:522:40: note: expression evaluates to '115616 <= 65536' | sizeof(struct amdsriov_ras_telemetry) <= AMD_SRIOV_MSG_RAS_TELEMETRY_SIZE_KB_V1 << 10, Fixes: cb48a6b2b61d ("drm/amd/ras: use dedicated memory as vf ras command buffer") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602261700.rVOLIw4l-lkp@intel.com/ Signed-off-by: YiPeng Chai Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 11de9539fedf7f56f55246714b231da52aabbe72 Author: Alex Hung Date: Wed Feb 18 10:38:33 2026 -0700 drm/amd/display: Prevent integer overflow when mhz to khz [WHAT] Cast to long long before multiplication to prevent overflow when converting mhz to khz by multiplying by 1000. This is reported as INTEGER_OVERFLOW errors by Coverity. Reviewed-by: Roman Li Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d9bc24d263fdb420f61a8a8b8bbb1a68f5a0f803 Author: Alex Hung Date: Wed Feb 18 09:50:15 2026 -0700 drm/amd/display: Remove always-false branches [WHAT] program_prealpha_dealpha and hpo_frl_stream_enc_acquired are always false and all branches depending on them will never be taken. This is reported as DEADCODE errors by Coverity. Reviewed-by: Roman Li Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 83b75278eb56ebc4cb73caf67572144293b739a9 Author: Alex Hung Date: Wed Feb 18 09:30:32 2026 -0700 drm/amd/display: Remove redundant initializers [WHAT] Remove unnecessary default value assignments for variables that are unconditionally assigned before use. Linux kernel code style prefers no assignments during initialization when variables are assigned unconditionally as they can obscures the actual data flow. In addition, compilers will be able to catch them if variables are used without being updated later in all conditions. This is reported as UNUSED_VALUE errors by Coverity. Reviewed-by: Roman Li Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit b91cfeb6f2ddf720a06506a1d1e5d9e76d3bd129 Author: Clay King Date: Fri Feb 20 11:25:47 2026 -0500 drm/amd/display: Silence unused variable warning [WHY & HOW] Remove unused dpp_pipe_count variable. Reviewed-by: Austin Zheng Signed-off-by: Clay King Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit aef8c3253e9d2f476765b76c3d0c6031b2a5b042 Author: Ivan Lipski Date: Wed Feb 18 16:19:15 2026 -0500 drm/amd/display: Initialize replay_state to PR_STATE_INVALID [WHY & HOW] Initialize the replay_state variable to PR_STATE_INVALID instead of PR_STATE_0 before retrieving the actual replay state. Reviewed-by: Wenjing Liu Signed-off-by: Ivan Lipski Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 2ab77600d1e55a042c02437326d3c7563e853c6c Author: Dillon Varone Date: Wed Feb 18 14:34:28 2026 -0500 drm/amd/display: Fallback to boot snapshot for dispclk [WHY & HOW] If the dentist is unavailable, fallback to reading CLKIP via the boot snapshot to get the current dispclk. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Dillon Varone Signed-off-by: Alex Hung Cc: Mario Limonciello Cc: Alex Deucher Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 5ea175ae5606a7f9761597e37f529ed9817c1863 Author: Yujie Liu Date: Thu Feb 26 11:00:37 2026 +0800 drm/amd/pm: fix kernel-doc warning for smu_msg_v1_send_msg() Warning: drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu_cmn.c:415 expecting prototype for smu_msg_proto_v1_send_msg(). Prototype was for smu_msg_v1_send_msg() instead Fixes: 4f379370a49c ("drm/amd/pm: Add smu message control block") Signed-off-by: Yujie Liu Signed-off-by: Alex Deucher commit 74c2689eea7d18169095854edf7e7b0cf77b039d Author: Yujie Liu Date: Thu Feb 26 11:00:38 2026 +0800 drm/amd/ras: fix kernel-doc warning for ras_eeprom_append() Warning: drivers/gpu/drm/amd/amdgpu/../ras/rascore/ras_eeprom.c:845 function parameter 'ras_core' not described in 'ras_eeprom_append' Warning: drivers/gpu/drm/amd/amdgpu/../ras/rascore/ras_eeprom.c:845 expecting prototype for ras_core_eeprom_append(). Prototype was for ras_eeprom_append() instead Fixes: 5c3be5defc92 ("drm/amd/ras: Add eeprom ras functions") Signed-off-by: Yujie Liu Signed-off-by: Alex Deucher commit 4bf5569dbb7cbae885f07571dbc9d068fff1bf24 Author: Yujie Liu Date: Thu Feb 26 11:00:35 2026 +0800 drm/amdgpu: fix kernel-doc warning for amdgpu_ttm_alloc_mmio_remap_bo() Warning: drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c:1923 expecting prototype for amdgpu_ttm_mmio_remap_bo_init(). Prototype was for amdgpu_ttm_alloc_mmio_remap_bo() instead Fixes: 96e97a562d06 ("drm/amdgpu: Drop MMIO_REMAP domain bit and keep it Internal") Signed-off-by: Yujie Liu Signed-off-by: Alex Deucher commit 9f3d543a9f7371622aff389e69010ac6bac69ef8 Author: Kees Cook Date: Wed Feb 25 09:47:03 2026 -0800 drm/amd/ras: Fix type size of remainder argument Forcing an int to be dereferenced at uint64_t for div64_u64_rem() runs the risk of endian confusion and stack overflowing writes. Seen while preparing to enable -Warray-bounds globally: In file included from ../arch/x86/include/asm/processor.h:35, from ../include/linux/sched.h:13, from ../include/linux/ratelimit.h:6, from ../include/linux/dev_printk.h:16, from ../drivers/gpu/drm/amd/amdgpu/../ras/ras_mgr/ras_sys.h:29, from ../drivers/gpu/drm/amd/amdgpu/../ras/rascore/ras.h:27, from ../drivers/gpu/drm/amd/amdgpu/../ras/rascore/ras_core.c:24: In function 'div64_u64_rem', inlined from 'ras_core_convert_timestamp_to_time' at ../drivers/gpu/drm/amd/amdgpu/../ras/rascore/ras_core.c:72:9: ../include/linux/math64.h:56:20: error: array subscript 'u64 {aka long long unsigned int}[0]' is partly outside array bounds of 'int[1]' [-Werror=array-bounds=] 56 | *remainder = dividend % divisor; | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~ ../drivers/gpu/drm/amd/amdgpu/../ras/rascore/ras_core.c: In function 'ras_core_convert_timestamp_to_time': ../drivers/gpu/drm/amd/amdgpu/../ras/rascore/ras_core.c:70:19: note: object 'remaining_seconds' of size 4 70 | int days, remaining_seconds; | ^~~~~~~~~~~~~~~~~ Use a 64-bit type for the remainder calculation, but leave remaining_seconds as 32-bit to avoid 64-bit division later. The value of remainder will always be less than seconds_per_day, so there's no truncation risk. Fixes: ace232eff50e ("drm/amdgpu: Add ras module files into amdgpu") Signed-off-by: Kees Cook Signed-off-by: Alex Deucher commit 57052d293eff5fcb6b8f5653370fe7df26ca62ec Author: Lijo Lazar Date: Mon Dec 8 15:41:07 2025 +0530 drm/amdgpu: Move register access functions Move register access methods from amdgpu_device.c to a dedicated file. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit a503c266d70d3363ba6bffb883cd6ecdb092670c Author: sguttula Date: Sat Feb 21 10:47:59 2026 +0530 drm/amdgpu: Enable DPG support for VCN5 This will set DPG flags for enabling power gating on GFX11_5_4 Signed-off-by: sguttula Reviewed-by: Pratik Vishwakarma Signed-off-by: Alex Deucher commit 196a6aa727f1f15eb54dda5e60a41543ea9397ee Author: Alex Hung Date: Fri Feb 27 12:30:38 2026 -0700 drm/amd/display: Enable DEGAMMA and reject COLOR_PIPELINE+DEGAMMA_LUT [WHAT] Create DEGAMMA properties even if color pipeline is enabled, and enforce the mutual exclusion in atomic check by rejecting any commit that attempts to enable both COLOR_PIPELINE on the plane and DEGAMMA_LUT on the CRTC simultaneously. Fixes: 18a4127e9315 ("drm/amd/display: Disable CRTC degamma when color pipeline is enabled") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4963 Reviewed-by: Melissa Wen Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Alex Deucher commit 43175f6164d32cb96362d16e357689f74298145c Author: Alex Hung Date: Fri Feb 27 12:26:04 2026 -0700 drm/amd/display: Use mpc.preblend flag to indicate 3D LUT [WHAT] New ASIC's 3D LUT is indicated by mpc.preblend. Fixes: 0de2b1afea8d ("drm/amd/display: add 3D LUT colorop") Reviewed-by: Melissa Wen Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Alex Deucher commit f6c2996709ca864a8226f54377b4b07da002b807 Author: Ricardo Robaina Date: Thu Feb 26 14:15:46 2026 -0300 audit: fix whitespace alignment in include/uapi/linux/audit.h Fixed minor indentation inconsistencies in the audit macros to align with standard kernel coding style using 8-character hard tabs. Signed-off-by: Ricardo Robaina [PM: fixed a space before tab issue in the patch] Signed-off-by: Paul Moore commit 9396cc1e282a280bcba2e932e03994e0aada4cd8 Author: Sean Christopherson Date: Thu Feb 12 18:38:41 2026 +0800 KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs When determining whether or not a WRMSR with reserved bits will #GP or succeed due to the WRMSR not existing per the guest virtual CPU model, expect failure if and only if _all_ features associated with the MSR are unsupported. Checking only the primary feature results in false failures when running on AMD and Hygon CPUs with only one of RDPID or RDTSCP, as AMD/Hygon CPUs ignore MSR_TSC_AUX[63:32], i.e. don't treat the bits as reserved, and so #GP only if the MSR is unsupported. Fixes: 9c38ddb3df94 ("KVM: selftests: Add an MSR test to exercise guest/host and read/write") Reported-by: Zhiquan Li Closes: https://lore.kernel.org/all/20260209041305.64906-6-zhiquan_li@163.com Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260212103841.171459-5-zhiquan_li@163.com Signed-off-by: Sean Christopherson commit 6b8b11ba47159f33d766b274001529da9d5b0913 Author: Zhiquan Li Date: Thu Feb 12 18:38:40 2026 +0800 KVM: selftests: Allow the PMU event filter test for Hygon At present, the PMU event filter test for AMD architecture is applicable for Hygon architecture as well. Since all known Hygon processors can re-use the test cases, so it isn't necessary to create a new wrapper. Signed-off-by: Zhiquan Li Link: https://patch.msgid.link/20260212103841.171459-4-zhiquan_li@163.com Signed-off-by: Sean Christopherson commit 53b2869231d3211ed638295e8873215d0ad10507 Author: Zhiquan Li Date: Thu Feb 12 18:38:39 2026 +0800 KVM: selftests: Add a flag to identify AMD compatible test cases Most of KVM x86 selftests for AMD are compatible with Hygon architecture (but not all), add a flag "host_cpu_is_amd_compatible" to figure out these cases. Following test failures on Hygon platform can be fixed: * Fix hypercall test: Hygon architecture also uses VMMCALL as guest hypercall instruction. * Following test failures due to access reserved memory address regions: - access_tracking_perf_test - demand_paging_test - dirty_log_perf_test - dirty_log_test - kvm_page_table_test - memslot_modification_stress_test - pre_fault_memory_test - x86/dirty_log_page_splitting_test Hygon CSV also makes the "physical address space width reduction", the reduced physical address bits are reported by bits 11:6 of CPUID[0x8000001f].EBX as well, so the existed logic is totally applicable for Hygon processors. Mapping memory into these regions and accessing to them results in a #PF. Signed-off-by: Zhiquan Li Link: https://patch.msgid.link/20260212103841.171459-3-zhiquan_li@163.com Signed-off-by: Sean Christopherson commit 0c96c47d4345084f543f2fe60ab031507b9a1b2f Author: Zhiquan Li Date: Thu Feb 12 18:38:38 2026 +0800 KVM: selftests: Add CPU vendor detection for Hygon Currently some KVM selftests are failed on Hygon CPUs due to missing vendor detection and edge-case handling specific to Hygon's architecture. Add CPU vendor detection for Hygon and add a global variable "host_cpu_is_hygon" as the basic facility for the following fixes. Signed-off-by: Zhiquan Li Link: https://patch.msgid.link/20260212103841.171459-2-zhiquan_li@163.com Signed-off-by: Sean Christopherson commit 7031ee94438469732754cfdb23ae097adfe9336e Author: Neel Bullywon Date: Sat Feb 28 12:23:20 2026 -0500 iio: magnetometer: bmc150_magn: use automated cleanup for mutex Use guard() and scoped_guard() to replace manual mutex lock/unlock calls. This simplifies error handling and ensures RAII-style cleanup. guard() is used in read_raw, write_raw, trig_reen, and trigger_set_state. Case blocks using guard() in read_raw and write_raw are wrapped in braces at the case label level to ensure clear scope for the cleanup guards. A bmc150_magn_set_power_mode_locked() helper is added to deduplicate the lock-call-unlock pattern used by remove, runtime_suspend, suspend, and resume. The trigger_handler function is left unchanged as mixing guard() with goto error paths can be fragile. Signed-off-by: Neel Bullywon Acked-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit cf7cbf97c630c3414302945617b8ac405e2b0dd7 Author: Karthikeyan Periyasamy Date: Fri Feb 27 09:51:28 2026 +0530 wifi: ath12k: Remove the unused argument from the Rx data path Currently, the Rx path uses new infrastructure to extract the required HAL parameters. Consequently, the HAL Rx descriptor argument is no longer needed in the following helper functions. Remove the unused argument from the following helper functions. ath12k_dp_rx_h_undecap() ath12k_dp_rx_check_nwifi_hdr_len_valid() ath12k_wifi7_dp_rx_h_mpdu() Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 Signed-off-by: Karthikeyan Periyasamy Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260227042128.3494167-1-karthikeyan.periyasamy@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 80a1147469b07a384f6f83a26b31bcd63d6684c0 Author: Aaradhana Sahu Date: Fri Feb 27 09:03:32 2026 +0530 wifi: ath12k: Enable monitor mode support on IPQ5332 Currently, rxdma1_enable and supports_monitor are set to false in IPQ5332 hardware parameters, which skips monitor ring configuration and removes NL80211_IFTYPE_MONITOR from the supported interface modes. Set rxdma1_enable and supports_monitor to true so that monitor rings are configured and monitor mode is enabled on IPQ5332. Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.7-00587-QCAHKSWPL_SILICONZ-1 Signed-off-by: Aaradhana Sahu Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260227033332.687805-1-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit f33a8e41826831fc8ceb5f62833488cd9388ed59 Author: Ramya Gnanasekar Date: Fri Feb 27 09:41:27 2026 +0530 wifi: ath12k: Set up MLO after SSR During recovery of an MLO setup from a core reset, ATH12K_GROUP_FLAG_REGISTERED is set because ath12k_mac_unregister is not called during core reset. So, when an MLO setup is recovering from a core reset, ath12k_core_mlo_setup() is skipped. Hence, the firmware will not have information about partner links. This makes MLO association fail after recovery. To resolve this, call ath12k_core_mlo_setup() during recovery, to set up MLO. Also, if MLO setup fails during recovery, call ath12k_mac_unregister() and ath12k_mac_destroy() to unregister mac and then tear down the mac structures. Also, initiate MLO teardown in the hardware group stop sequence to align with the hardware group start sequence. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01181-QCAHKSWPL_SILICONZ-1 Signed-off-by: Ramya Gnanasekar Signed-off-by: Roopni Devanathan Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260227041127.3265879-1-roopni.devanathan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 6508c9752451a7e5e44a325e8563897a67f5344b Author: Bjorn Andersson Date: Thu Feb 12 08:52:52 2026 -0600 wifi: ath11k: Silence remoteproc probe deferral prints Upon failing to resolve the remoteproc phandle one ath11k_dbg() and one ath11k_err() is used to tell the user about the (presumably) temporary failure. Reduce the log spam by removing the duplicate print and switching to dev_err_probe(), in line with how ath12k handles this error. Signed-off-by: Bjorn Andersson Reviewed-by: Baochen Qiang Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260212-ath11k-silence-probe-deferr-v1-1-b8a49bb3c332@oss.qualcomm.com Signed-off-by: Jeff Johnson commit cd04646c0f3eefdde87538f6ff932420cedc9ba0 Author: Bruno Martins Date: Sun Mar 1 21:28:26 2026 +0000 staging: iio: ad7816: Replace sprintf() with sysfs_emit() As stated in Documentation/filesystems/sysfs.rst: 'New implementations of show() methods should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space.' Replace sprintf with sysfs_emit in the following sysfs show functions: - ad7816_show_mode() - ad7816_show_available_modes() - ad7816_show_channel() - ad7816_show_value() - ad7816_show_oti() Signed-off-by: Bruno Martins Signed-off-by: Jonathan Cameron commit d139209ef88e48af1f6731cd45440421c757b6b5 Author: Matt Roper Date: Fri Feb 27 08:43:41 2026 -0800 drm/xe/xe2_hpg: Correct implementation of Wa_16025250150 Wa_16025250150 asks us to set five register fields of the register to 0x1 each. However we were just OR'ing this into the existing register value (which has a default of 0x4 for each nibble-sized field) resulting in final field values of 0x5 instead of the desired 0x1. Correct the RTP programming (use FIELD_SET instead of SET) to ensure each field is assigned to exactly the value we want. Cc: Aradhya Bhatia Cc: Tejas Upadhyay Cc: stable@vger.kernel.org # v6.16+ Fixes: 7654d51f1fd8 ("drm/xe/xe2hpg: Add Wa_16025250150") Reviewed-by: Ngai-Mint Kwan Link: https://patch.msgid.link/20260227164341.3600098-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 5c3cf14b82f723ecaef7495fffcfe947e1c4d11e Author: Giorgi Tchankvetadze Date: Mon Mar 2 09:50:36 2026 +0400 iio: adc: ade9000: remove unused ADE9000_ST_ERROR macro The ADE9000_ST_ERROR macro references ADE9000_ST1_ERROR0 through ADE9000_ST1_ERROR3, but the actual defined symbols use the BIT suffix. Since this macro is currently unused in the driver, remove it entirely rather than fixing the names. It can be reintroduced in a future patch when it is actually needed. The individual error bit definitions (bits 28-31 of the STATUS1 register at 0x403) are retained as they follow the convention of defining all register fields. Reference: ADE9000 datasheet (Rev. B, Page 61), STATUS1 register (0x403), bits 28-31 define ERROR0 through ERROR3 status flags. Suggested-by: Andy Shevchenko Signed-off-by: Giorgi Tchankvetadze Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 89340099c6a45884d5bf3995e466359ddb31a6f7 Author: Raag Jadav Date: Mon Mar 2 13:57:57 2026 +0530 drm/xe/lrc: Refactor context init into xe_lrc_ctx_init() Currently xe_lrc_init() does two things. 1. Allocates LRC bo based on exec queue parameters. 2. Initializes LRC bo with actual context details. Introduce xe_lrc_ctx_init() and split these two implementations for better maintainability. Signed-off-by: Raag Jadav Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260302082757.3516577-1-raag.jadav@intel.com commit dad46509b63b64f0a56f12caec0f60c8503e26a5 Author: Felix Gu Date: Tue Mar 3 01:07:29 2026 +0800 iio: adc: ti-ads1119: Drop redundant error message devm_request_threaded_irq already prints an error message when failure, so the error message is redundant, drop it. Suggested-by: Andy Shevchenko Signed-off-by: Felix Gu Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 081a4a78b6e64e2bac5a18bc6a548bc80cd8ae44 Author: Maud Spierings Date: Mon Feb 16 14:07:12 2026 +0100 arm64: dts: freescale: Add the GOcontroll Moduline Mini The Moduline Mini is a part of the wider GOcontroll Moduline ecosystem. These are embedded controllers that focus on modularity with their swappable IO modules. Features: - up to 4 Moduline IO modules - 2 CAN busses - 1 Ethernet - 4 RGB leds - 1 3D accelerometer - optional Wi-Fi/Bluetooth - optional 4G/GPS Signed-off-by: Maud Spierings Signed-off-by: Frank Li commit 3ed539cb892f2d398543f78a0c94dbe1391bd245 Author: Maud Spierings Date: Mon Feb 16 14:07:11 2026 +0100 arm64: dts: freescale: Add the GOcontroll Moduline IV The Moduline IV is a part of the wider GOcontroll Moduline ecosystem. These are embedded controllers that focus on modularity with their swappable IO modules. Features: - up to 8 Moduline IO modules - 4 CAN busses - 1 LIN bus - 1 Ethernet - 4 RGB leds - optional Wi-Fi/Bluetooth - optional 4G/GPS Signed-off-by: Maud Spierings Signed-off-by: Frank Li commit ce6765b80f8fcf5d5702a091546c72ccc5d2be6a Author: Maud Spierings Date: Mon Feb 16 14:07:10 2026 +0100 arm64: dts: freescale: add Ka-Ro Electronics tx8m-1610 COM The Ka-Ro Electronics tx8m-1610 is a COM based on the imx8mm SOC. It has 1 GB of ram and 4 GB of eMMC storage on board. Add it to enable boards based on this module Reviewed-by: Frank Li Signed-off-by: Maud Spierings Signed-off-by: Frank Li commit f9084ded66bb4d3801d57e7f355f872081158776 Author: Maud Spierings Date: Mon Feb 16 14:07:09 2026 +0100 arm64: dts: imx8mm: Add pinctrl config definitions Currently to configure each IOMUXC_SW_PAD_CTL_PAD the raw value of this register is written in the dts, these values are not obvious. Add defines which describe the fields of this register which can be or-ed together to produce readable settings. Reviewed-by: Frank Li Signed-off-by: Maud Spierings Signed-off-by: Frank Li commit 9a7dded511a789ff4abb9b6db5db001d7cef06da Author: Yanan Yang Date: Tue Feb 10 19:47:55 2026 +0900 arm64: dts: freescale: add NXP FRDM-IMX91S board support Add DeviceTree support for the NXP FRDM-IMX91S development board based on the i.MX91 SoC. FRDM-IMX91S is a cost-optimized variant of FRDM-IMX91 and differs in memory, storage, Ethernet, and PMIC configuration: - 512MB LPDDR4 (FRDM-IMX91 uses 1GB) - 256MB FlexSPI-NAND (FRDM-IMX91 uses 8GB eMMC) - Single GbE port (FRDM-IMX91 has dual GbE) - PMIC PF9453 (FRDM-IMX91 uses PCA9451A) This DT enables: - ADC1 - UART1 and UART5 - I2C bus and children nodes - USB and related nodes - uSDHC1 and uSDHC2 - FlexSPI NAND flash - Watchdog3 - Ethernet (eqos) - FlexCAN - MQS Link: https://www.nxp.com/design/design-center/development-boards-and-designs/FRDM-IMX91S (FRDM-IMX91S board page) Link: https://www.nxp.com/design/design-center/development-boards-and-designs/FRDM-IMX91 (FRDM-IMX91 board page) Co-developed-by: Lei Xu Signed-off-by: Lei Xu Co-developed-by: Xiaofeng Wei Signed-off-by: Xiaofeng Wei Signed-off-by: Yanan Yang Tested-by: Daniel Baluta Signed-off-by: Frank Li commit 9c94cb52c80fce841fda417dc6168d6c9f3dbc60 Author: Sherry Sun Date: Thu Feb 5 18:06:47 2026 +0800 arm64: dts: imx91-11x11-evk: Add usdhc3 for SDIO WiFi support Add usdhc3 to support M.2 SDIO WiFi on i.MX91 11x11 EVK board. Signed-off-by: Sherry Sun Signed-off-by: Frank Li commit feea0340ad290aac84f76b9886336419168b72a4 Author: Sherry Sun Date: Thu Feb 5 15:34:54 2026 +0800 arm64: dts: imx8mp-evk: Add usdhc1 for SDIO WiFi support Add usdhc1 to support M.2 SDIO WiFi on i.MX8MP EVK board. Signed-off-by: Sherry Sun Reviewed-by: Frank Li Signed-off-by: Frank Li commit d2ea675e86bab6563bbc0841e6c74eef54e83be7 Author: Michael Guralnik Date: Thu Feb 26 15:52:14 2026 +0200 RDMA/core: Add netlink command to modify FRMR aging Allow users to set FRMR pools aging timer through netlink. This functionality will allow user to control how long handles reside in the kernel before being destroyed, thus being able to tune the tradeoff between memory and HW object consumption and memory registration optimization. Since FRMR pools is highly beneficial for application restart scenarios, this command allows users to modify the aging timer to their application restart time, making sure the FRMR handles deregistered on application teardown are kept for long enough in the pools for reuse in the application startup. Signed-off-by: Michael Guralnik Reviewed-by: Patrisious Haddad Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260226-frmr_pools-v4-9-95360b54f15e@nvidia.com Signed-off-by: Leon Romanovsky commit 50c035976af3d361cff27dd54b1736debd42c19a Author: Michael Guralnik Date: Thu Feb 26 15:52:13 2026 +0200 RDMA/nldev: Add command to get FRMR pools Add support for a new command in netlink to dump to user the state of the FRMR pools on the devices. Expose each pool with its key and the usage statistics for it. Signed-off-by: Michael Guralnik Reviewed-by: Patrisious Haddad Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260226-frmr_pools-v4-8-95360b54f15e@nvidia.com Signed-off-by: Leon Romanovsky commit ba51cf9fcf511df8c7026feda4b7d65999d3517c Author: Michael Guralnik Date: Thu Feb 26 15:52:12 2026 +0200 net/mlx5: Drop MR cache related code Following mlx5_ib move to using FRMR pools, drop all unused code of MR cache. Signed-off-by: Michael Guralnik Reviewed-by: Yishai Hadas Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260226-frmr_pools-v4-7-95360b54f15e@nvidia.com Signed-off-by: Leon Romanovsky commit 36680ef7bceb0a98a94a3896399551e0a058b9db Author: Michael Guralnik Date: Thu Feb 26 15:52:11 2026 +0200 RDMA/mlx5: Switch from MR cache to FRMR pools Use the new generic FRMR pools mechanism to optimize the performance of memory registrations. The move to the new generic FRMR pools will allow users configuring MR cache through debugfs of MR cache to use the netlink API for FRMR pools which will be added later in this series. Thus being able to have more flexibility configuring the kernel and also being able to configure on machines where debugfs is not available. Mlx5_ib will save the mkey index as the handle in FRMR pools, same as the MR cache implementation. Upon each memory registration mlx5_ib will try to pull a handle from FRMR pools and upon each deregistration it will push the handle back to it's appropriate pool. Use the vendor key field in umr pool key to save the access mode of the mkey. Use the option for kernel-only FRMR pool to manage the mkeys used for registration with DMAH as the translation between UAPI of DMAH and the mkey property of st_index is non-trivial and changing dynamically. Since the value for no PH is 0xff and not zero, switch between them in the frmr_key to have a zero'ed kernel_vendor_key when not using DMAH. Remove the limitation we had with MR cache for mkeys up to 2^20 dma blocks and support mkeys up to HW limitations according to caps. Remove all MR cache related code. Signed-off-by: Michael Guralnik Reviewed-by: Yishai Hadas Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260226-frmr_pools-v4-6-95360b54f15e@nvidia.com Signed-off-by: Leon Romanovsky commit 020d189d16a62ed56115cce7e255459cf0eeb4e6 Author: Michael Guralnik Date: Thu Feb 26 15:52:10 2026 +0200 RDMA/core: Add pinned handles to FRMR pools Add a configuration of pinned handles on a specific FRMR pool. The configured amount of pinned handles will not be aged and will stay available for users to claim. Upon setting the amount of pinned handles to an FRMR pool, we will make sure we have at least the pinned amount of handles associated with the pool and create more, if necessary. The count for pinned handles take into account handles that are used by user MRs and handles in the queue. Introduce a new FRMR operation of build_key that allows drivers to manipulate FRMR keys supplied by the user, allowing failing for unsupported properties and masking of properties that are modifiable. Signed-off-by: Michael Guralnik Reviewed-by: Yishai Hadas Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260226-frmr_pools-v4-5-95360b54f15e@nvidia.com Signed-off-by: Leon Romanovsky commit 304725adecd7b1e08c5cd810d761e9c218839b12 Author: Michael Guralnik Date: Thu Feb 26 15:52:09 2026 +0200 RDMA/core: Add FRMR pools statistics Count for each pool the number of FRMR handles popped and held by user MRs. Also keep track of the max value of this counter. Next patches will expose the statistics through netlink. Signed-off-by: Michael Guralnik Reviewed-by: Yishai Hadas Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260226-frmr_pools-v4-4-95360b54f15e@nvidia.com Signed-off-by: Leon Romanovsky commit 84cb1dd06fc47c5a7bb797a83bf3a776dcd28afd Author: Michael Guralnik Date: Thu Feb 26 15:52:08 2026 +0200 RDMA/core: Add aging to FRMR pools Add aging mechanism to handles of FRMR pools. Keep the handles stored in FRMR pools for at least 1 minute for application to reuse, destroy all handles which were not reused. Add a new queue to each pool to accomplish that. Upon aging trigger, destroy all FRMR handles from the new 'inactive' queue and move all handles from the 'active' pool to the 'inactive' pool. This ensures all destroyed handles were not reused for at least one aging time period and were not held longer than 2 aging time periods. Handles from the inactive queue will be popped only if the active queue is empty. Signed-off-by: Michael Guralnik Reviewed-by: Yishai Hadas Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260226-frmr_pools-v4-3-95360b54f15e@nvidia.com Signed-off-by: Leon Romanovsky commit ce5df0b891edfa19620cd7e28bd69246c77ae78c Author: Michael Guralnik Date: Thu Feb 26 15:52:07 2026 +0200 IB/core: Introduce FRMR pools Add a generic Fast Registration Memory Region pools mechanism to allow drivers to optimize memory registration performance. Drivers that have the ability to reuse MRs or their underlying HW objects can take advantage of the mechanism to keep a 'handle' for those objects and use them upon user request. We assume that to achieve this goal a driver and its HW should implement a modify operation for the MRs that is able to at least clear and set the MRs and in more advanced implementations also support changing a subset of the MRs properties. The mechanism is built using an RB-tree consisting of pools, each pool represents a set of MR properties that are shared by all of the MRs residing in the pool and are unmodifiable by the vendor driver or HW. The exposed API from ib_core to the driver has 4 operations: Init and cleanup - handles data structs and locks for the pools. Push and pop - store and retrieve 'handle' for a memory registration or deregistrations request. The FRMR pools mechanism implements the logic to search the RB-tree for a pool with matching properties and create a new one when needed and requires the driver to implement creation and destruction of a 'handle' when pool is empty or a handle is requested or is being destroyed. Later patch will introduce Netlink API to interact with the FRMR pools mechanism to allow users to both configure and track its usage. A vendor wishing to configure FRMR pool without exposing it or without exposing internal MR properties to users, should use the kernel_vendor_key field in the pools key. This can be useful in a few cases, e.g, when the FRMR handle has a vendor-specific un-modifiable property that the user registering the memory might not be aware of. Signed-off-by: Michael Guralnik Reviewed-by: Yishai Hadas Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260226-frmr_pools-v4-2-95360b54f15e@nvidia.com Signed-off-by: Leon Romanovsky commit bc0ad1a17c2ce49b1a89a5b04ee0eed345fac558 Author: Chiara Meiohas Date: Thu Feb 26 15:52:06 2026 +0200 RDMA/mlx5: Move device async_ctx initialization Move the async_ctx initialization from mlx5_mkey_cache_init() to mlx5_ib_stage_init_init() since the async_ctx is used by both the MR cache and DEVX. Also add the corresponding cleanup in mlx5_ib_stage_init_cleanup() to properly release the async_ctx resources. Signed-off-by: Chiara Meiohas Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260226-frmr_pools-v4-1-95360b54f15e@nvidia.com Signed-off-by: Leon Romanovsky commit 2b37c401b265c07b46408b5cb36a4b757c9b5060 Author: Zhanjun Dong Date: Fri Feb 20 17:53:08 2026 -0500 drm/xe/gsc: Fix GSC proxy cleanup on early initialization failure xe_gsc_proxy_remove undoes what is done in both xe_gsc_proxy_init and xe_gsc_proxy_start; however, if we fail between those 2 calls, it is possible that the HW forcewake access hasn't been initialized yet and so we hit errors when the cleanup code tries to write GSC register. To avoid that, split the cleanup in 2 functions so that the HW cleanup is only called if the HW setup was completed successfully. Since the HW cleanup (interrupt disabling) is now removed from xe_gsc_proxy_remove, the cleanup on error paths in xe_gsc_proxy_start must be updated to disable interrupts before returning. Fixes: ff6cd29b690b ("drm/xe: Cleanup unwind of gt initialization") Signed-off-by: Zhanjun Dong Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260220225308.101469-1-zhanjun.dong@intel.com commit d0ad1b05bbe6f8da159a4dfb6692b3b7ce30ccc8 Author: Sean Christopherson Date: Tue Feb 17 16:54:38 2026 -0800 KVM: x86: Defer non-architectural deliver of exception payload to userspace read When attempting to play nice with userspace that hasn't enabled KVM_CAP_EXCEPTION_PAYLOAD, defer KVM's non-architectural delivery of the payload until userspace actually reads relevant vCPU state, and more importantly, force delivery of the payload in *all* paths where userspace saves relevant vCPU state, not just KVM_GET_VCPU_EVENTS. Ignoring userspace save/restore for the moment, delivering the payload before the exception is injected is wrong regardless of whether L1 or L2 is running. To make matters even more confusing, the flaw *currently* being papered over by the !is_guest_mode() check isn't even the same bug that commit da998b46d244 ("kvm: x86: Defer setting of CR2 until #PF delivery") was trying to avoid. At the time of commit da998b46d244, KVM didn't correctly handle exception intercepts, as KVM would wait until VM-Entry into L2 was imminent to check if the queued exception should morph to a nested VM-Exit. I.e. KVM would deliver the payload to L2 and then synthesize a VM-Exit into L1. But the payload was only the most blatant issue, e.g. waiting to check exception intercepts would also lead to KVM incorrectly escalating a should-be-intercepted #PF into a #DF. That underlying bug was eventually fixed by commit 7709aba8f716 ("KVM: x86: Morph pending exceptions to pending VM-Exits at queue time"), but in the interim, commit a06230b62b89 ("KVM: x86: Deliver exception payload on KVM_GET_VCPU_EVENTS") came along and subtly added another dependency on the !is_guest_mode() check. While not recorded in the changelog, the motivation for deferring the !exception_payload_enabled delivery was to fix a flaw where a synthesized MTF (Monitor Trap Flag) VM-Exit would drop a pending #DB and clobber DR6. On a VM-Exit, VMX CPUs save pending #DB information into the VMCS, which is emulated by KVM in nested_vmx_update_pending_dbg() by grabbing the payload from the queue/pending exception. I.e. prematurely delivering the payload would cause the pending #DB to not be recorded in the VMCS, and of course, clobber L2's DR6 as seen by L1. Jumping back to save+restore, the quirked behavior of forcing delivery of the payload only works if userspace does KVM_GET_VCPU_EVENTS *before* CR2 or DR6 is saved, i.e. before KVM_GET_SREGS{,2} and KVM_GET_DEBUGREGS. E.g. if userspace does KVM_GET_SREGS before KVM_GET_VCPU_EVENTS, then the CR2 saved by userspace won't contain the payload for the exception save by KVM_GET_VCPU_EVENTS. Deliberately deliver the payload in the store_regs() path, as it's the least awful option even though userspace may not be doing save+restore. Because if userspace _is_ doing save restore, it could elide KVM_GET_SREGS knowing that SREGS were already saved when the vCPU exited. Link: https://lore.kernel.org/all/20200207103608.110305-1-oupton@google.com Cc: Yosry Ahmed Cc: stable@vger.kernel.org Reviewed-by: Yosry Ahmed Tested-by: Yosry Ahmed Link: https://patch.msgid.link/20260218005438.2619063-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 5c247d08bc81bbad4c662dcf5654137a2f8483ec Author: Yosry Ahmed Date: Tue Feb 3 20:10:10 2026 +0000 KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT KVM currently uses the value of CR2 from vmcb02 to update vmcb12 on nested #VMEXIT. This value is incorrect in some cases, causing L1 to run L2 with a corrupted CR2. This could lead to segfaults or data corruption if L2 is in the middle of handling a #PF and reads a corrupted CR2. Use the correct value in vcpu->arch.cr2 instead. The value in vcpu->arch.cr2 is sync'd to vmcb02 shortly before a VMRUN of L2, and sync'd back to vcpu->arch.cr2 shortly after. The value are only out-of-sync in two cases: after save+restore, and after a #PF is injected into L2. In either case, if a #VMEXIT to L1 is synthesized before L2 runs, using the value in vmcb02 would be incorrect. After save+restore, the value of CR2 is restored by KVM_SET_SREGS into vcpu->arch.cr2. It is not reflect in vmcb02 until a VMRUN of L2. Before that, it holds whatever was in vmcb02 before restore, which would be zero on a new vCPU that never ran nested. If a #VMEXIT to L1 is synthesized before L2 ever runs, using vcpu->arch.cr2 to update vmcb12 is the right thing to do. The #PF injection case is more nuanced. Although the APM is a bit unclear about when CR2 is written during a #PF, the SDM is more clear: Processors update CR2 whenever a page fault is detected. If a second page fault occurs while an earlier page fault is being delivered, the faulting linear address of the second fault will overwrite the contents of CR2 (replacing the previous address). These updates to CR2 occur even if the page fault results in a double fault or occurs during the delivery of a double fault. KVM injecting the exception surely counts as the #PF being "detected". More importantly, when an exception is injected into L2 at the time of a synthesized #VMEXIT, KVM updates exit_int_info in vmcb12 accordingly, such that an L1 hypervisor can re-inject the exception. If CR2 is not written at that point, the L1 hypervisor have no way of correctly re-injecting the #PF. Hence, if a #VMEXIT to L1 is synthesized after the #PF is injected into L2 but before it actually runs, using vcpu->arch.cr2 to update vmcb12 is also the right thing to do. Note that KVM does _not_ update vcpu->arch.cr2 when a #PF is pending for L2, only when it is injected. The distinction is important, because only injected (but not intercepted) exceptions are propagated to L1 through exit_int_info. It would be incorrect to update CR2 in vmcb12 for a pending #PF, as L1 would perceive an updated CR2 value with no #PF. Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20260203201010.1871056-1-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 4c788c6f921b22f9b6c3f316c4a071c05683e7de Author: Junrui Luo Date: Sun Mar 1 21:10:58 2026 +0800 dm mirror: fix integer overflow in create_dirty_log() The argument count calculation in create_dirty_log() performs `*args_used = 2 + param_count` before validating against argc. When a user provides a param_count close to UINT_MAX via the device mapper table string, this unsigned addition wraps around to a small value, causing the subsequent `argc < *args_used` check to be bypassed. The overflowed param_count is then passed as argc to dm_dirty_log_create(), where it can cause out-of-bounds reads on the argv array. Fix by comparing param_count against argc - 2 before performing the addition, following the same pattern used by parse_features() in the same file. Since argc >= 2 is already guaranteed, the subtraction is safe. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Yuhao Jiang Signed-off-by: Junrui Luo Reviewed-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka commit 2f7ae8ab6aa73daaf080d5332110357c29df9c36 Author: Conor Dooley Date: Tue Feb 24 09:35:25 2026 +0000 clk: microchip: mpfs-ccc: fix out of bounds access during output registration UBSAN reported an out of bounds access during registration of the last two outputs. This out of bounds access occurs because space is only allocated in the hws array for two PLLs and the four output dividers that each has, but the defined IDs contain two DLLS and their two outputs each, which are not supported by the driver. The ID order is PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs by two while adding them to the array to avoid the problem. Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support") CC: stable@vger.kernel.org Reviewed-by: Brian Masney Signed-off-by: Conor Dooley commit e84141846decb77d2826e553318a608b256804e5 Author: Franz Schnyder Date: Mon Mar 2 17:53:56 2026 +0100 regulator: pf9453: Allow shared IRQ The PF9453 datasheet specifies the IRQ_B pin as an open drain output with level-low behavior. This makes it capable to share the interrupt line. To allow shared interrupts, the driver must handle the case if the interrupt has been triggered by another device. Set IRQF_SHARED to be able to share the interrupt line. If the interrupt has not been triggered by the PMIC, return IRQ_NONE. Signed-off-by: Franz Schnyder Link: https://patch.msgid.link/20260302165357.1797803-3-fra.schnyder@gmail.com Signed-off-by: Mark Brown commit ebe69512733ad5e50c110df903722b0f5b54cb69 Author: Maud Spierings Date: Mon Feb 16 14:07:08 2026 +0100 dt-bindings: arm: fsl: Add GOcontroll Moduline IV/Mini Document the compatible strings for the Moduline IV and Mini. Also add a compatible for the Ka-Ro Electronics TX8M-1610 SoM that they are based on. Acked-by: Conor Dooley Signed-off-by: Maud Spierings Signed-off-by: Frank Li commit 15da5bc9f3adab7242867db0251fe451ac3ddb72 Author: Deborah Brouwer Date: Mon Feb 23 16:23:14 2026 -0800 drm/tyr: Clarify driver/device type names Currently the `TyrDriver` struct implements both `platform::Driver` and `drm::Driver`. For clarity, split up these two roles: - Introduce `TyrPlatformDriverData` to implement `platform::Driver`, and - Introduce `TyrDrmDriver` to implement `drm::Driver`. Also rename other variables to reflect their roles in the DRM context: - Rename `TyrDevice` to `TyrDrmDevice` - Rename `TyrData` to `TyrDrmDeviceData` - Rename `File` to `TyrDrmFileData` - Rename `DrmFile` to `TyrDrmFile` No functional changes are intended. Co-developed-by: Boris Brezillon Signed-off-by: Boris Brezillon Signed-off-by: Deborah Brouwer Link: https://patch.msgid.link/20260224002314.344675-1-deborah.brouwer@collabora.com Signed-off-by: Alice Ryhl commit 48d8ef9209f488f4661d4daa0700d149b8cad54d Author: Yanan Yang Date: Tue Feb 10 19:47:54 2026 +0900 dt-bindings: arm: fsl: Add FRDM-IMX91S board Add DT compatible string for NXP FRDM-IMX91S board The FRDM-IMX91S is a low-cost, compact development board based on the i.MX91 applications processor. It is a cost-optimized variant of the FRDM-IMX91 board, with notable hardware differences requiring a separate DTS: - 512MB LPDDR4 (FRDM-IMX91 uses 1GB) - 256MB FlexSPI-NAND (FRDM-IMX91 uses 8GB eMMC) - Single GbE port (FRDM-IMX91 has dual GbE) - PMIC PF9453 (FRDM-IMX91 uses PCA9451A) Acked-by: Krzysztof Kozlowski Reviewed-by: Daniel Baluta Signed-off-by: Yanan Yang Signed-off-by: Frank Li commit 1b0b124a9c41bf384f609003a97ba35a25fae130 Author: Thomas Weißschuh Date: Mon Feb 23 21:59:07 2026 +0100 platform/x86: dell-wmi-sysman: Use standard kobj_sysfs_ops wmi_sysman_kobj_sysfs_ops are identical to the standard kobj_sysfs_ops. Drop the unnecessary custom copy. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260223-sysfs-const-dell-wmi-sysman-v1-1-8a690884044e@weissschuh.net Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0e59b31dbd3bfca96567e3d22518f4b6a7051a40 Author: Dmitry Torokhov Date: Fri Feb 13 14:40:32 2026 -0800 platform/x86: pcengines-apuv2: attach software node to the gpiochip GPIO subsystem is switching the way it locates GPIO chip instances for GPIO references in software nodes from matching on node names to identity matching, which necessitates assigning firmware nodes (software nodes) to GPIO chips. Attach apu2_gpiochip_node to the platform device representing the GPIO controller. Signed-off-by: Dmitry Torokhov Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/aY-oAVI0TubcaD2K@google.com Signed-off-by: Ilpo Järvinen commit 9a4af5a00a8bff84d8d499e43d3424173835173c Author: Thorsten Blum Date: Mon Mar 2 14:53:40 2026 +0100 x86/mtrr: Use kstrtoul() in parse_mtrr_spare_reg() Replace the deprecated simple_strtoul()¹ with kstrtoul() for parsing the early boot parameter mtrr_spare_reg_nr. simple_strtoul() silently sets nr_mtrr_spare_reg to 0 for invalid input instead of rejecting it and keeping the default value. Return kstrtoul()'s retval directly to propagate parsing failures instead of treating them as success. Also return -EINVAL when '=' is missing from the boot parameter and 'arg' is NULL. ¹ https://www.kernel.org/doc/html/latest/process/deprecated.html#simple-strtol-simple-strtoll-simple-strtoul-simple-strtoull [ bp: Massage commit message. ] Signed-off-by: Thorsten Blum Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260302135341.3473-2-thorsten.blum@linux.dev commit af08f9628bb6a2eb7bf42463eee1a41de848abb4 Author: Stefano Radaelli Date: Thu Feb 5 11:01:23 2026 +0100 dt-bindings: arm: fsl: add Variscite DART-MX91 Boards Add DT compatible strings for Variscite DART-MX91 SoM and Variscite development carrier Board. Acked-by: Conor Dooley Signed-off-by: Stefano Radaelli Reviewed-by: Daniel Baluta Signed-off-by: Frank Li commit d1e7eab6033f9885a02c4b4e8f09e34d8e9d21ab Author: Sherry Sun Date: Thu Feb 5 15:34:53 2026 +0800 arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) The current pin configuration for MX8MP_IOMUXC_SD1_DATA4__GPIO2_IO06 sets the weak pull-up but does not enable the pull select field. Bit 8 in the IOMUX register must be set in order for the weak pull-up to actually take effect. Update the pinctrl setting from 0x40 to 0x140 to enable both the pull select and the weak pull-up, ensuring the line behaves as expected. Fixes: d50650500064 ("arm64: dts: imx8mp-evk: Add PCIe support") Signed-off-by: Sherry Sun Reviewed-by: Frank Li Signed-off-by: Frank Li commit 51c0c3d880acc45a9b57d505195d93541b38b3f5 Author: Sherry Sun Date: Wed Feb 4 10:23:06 2026 +0800 arm64: dts: imx943-evk: add usdhc3 for SDIO WiFi support Add usdhc3 to support M.2 SDIO WiFi on i.MX943 EVK board. Signed-off-by: Sherry Sun Reviewed-by: Frank Li Signed-off-by: Frank Li commit db139186beac761c1172a7b20687fb2078c6a70c Author: Ken Raeburn Date: Thu Feb 26 20:12:08 2026 -0500 dm vdo: add __counted_by attribute to a number of structures This attribute allows the compiler to refine compile-time diagnostics and run-time sanitizer features with information about the size of the flexible arrays. Signed-off-by: Ken Raeburn Signed-off-by: Mikulas Patocka commit 9bb388b1a95751c4a4a99a4dab1b21136a4eeb96 Author: Ken Raeburn Date: Thu Feb 26 20:12:07 2026 -0500 dm vdo: remove redundant TYPE argument from vdo_allocate macro We can infer the type needed from the supplied pointer argument. A couple invocation sites needed fixing to supply the proper type of pointer. Use overflow.h's size_mul, and we can remove the __vdo_do_allocation wrapper which did the same overflow check. Signed-off-by: Ken Raeburn Signed-off-by: Mikulas Patocka commit 6af58aa3b028e364c0a8f8b6be48fca17e571de3 Author: Ken Raeburn Date: Thu Feb 26 20:12:06 2026 -0500 dm vdo: update vdo_allocate_extended to take a field name, no types All of VDO's "extended" allocations use a flexible array field at the end of the allocated structure. We can infer the struct type from the supplied pointer. Replacing the array field type with the field name lets us use struct_size from overflow.h to compute the size instead of the local __vdo_do_allocation version. One allocation of bio structures doesn't conform to this pattern, since the removal of bi_inline_vecs; directly compute the total size for that case. Signed-off-by: Ken Raeburn Signed-off-by: Mikulas Patocka commit 5282ac80183bd25e44c4f5f52a7f46e9a54289eb Author: Eric Biggers Date: Wed Feb 25 17:39:15 2026 -0800 dm-ima: use SHA-256 library Make dm_ima_measure_on_table_load() use the SHA-256 library API instead of crypto_shash to calculate the SHA-256 hash value that it needs. This is simpler and more efficient. It also ensures that SHA-256 is actually available and doesn't fail due to the unreliable loading by name. While doing this, also use kasprintf() to simplify building the string version of the digest. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 88d1b3336e797d8036710298590ff9e0e0d21488 Author: Haibo Chen Date: Wed Feb 25 14:47:26 2026 +0800 arm64: dts: imx952-evk: add MT35XU01G spi nor flash Add spi nor flash MT35XU01G support, it support OCT DTR mode at 200MHz. Signed-off-by: Haibo Chen Signed-off-by: Frank Li commit 973ec14af07f774c892e8e07f1e1340a1fc50031 Author: Haibo Chen Date: Wed Feb 25 14:47:25 2026 +0800 arm64: dts: imx952: Add xspi node Add xspi node for i.MX952 Signed-off-by: Haibo Chen Signed-off-by: Frank Li commit 51d81e14fe6788dc6463064c7517480f2acd2724 Author: Benjamin Marzinski Date: Thu Feb 12 13:05:41 2026 -0500 dm-mpath: don't stop probing paths at presuspend Commit 5c977f102315 ("dm-mpath: Don't grab work_mutex while probing paths"), added code to make multipath quit probing paths early, if it was trying to suspend. This isn't necessary. It was just an optimization to try to keep path probing from delaying a suspend. However it causes problems with the intended user of this code, qemu. The path probing code was added because failed ioctls to multipath devices don't cause paths to fail in cases where a regular IO failure would. If an ioctl to a path failed because the path was down, and the multipath device had passed presuspend, the M_MPATH_PROBE_PATHS ioctl would exit early, without probing the path. The caller would then retry the original ioctl, hoping to use a different path. But if there was only one path in the pathgroup, it would pick the same non-working path again, even if there were working paths in other pathgroups. ioctls to a suspended dm device will return -EAGAIN, notifying the caller that the device is suspended, but ioctls to a device that is just preparing to suspend won't (and in general, shouldn't). This means that the caller (qemu in this case) would get into a tight loop where it would issue an ioctl that failed, skip probing the paths because the device had already passed presuspend, and start over issuing the ioctl again. This would continue until the multipath device finally fully suspended, or the caller gave up and failed the ioctl. multipath's path probing code could return -EAGAIN in this case, and the caller could delay a bit before retrying, but the whole purpose of skipping the probe after presuspend was to speed things up, and that would just slow them down. Instead, remove the is_suspending flag, and check dm_suspended() instead to decide whether to exit the probing code early. This means that when the probing code exits early, future ioctls will also be delayed, because the device is fully suspended. Fixes: 5c977f102315 ("dm-mpath: Don't grab work_mutex while probing paths") Signed-off-by: Benjamin Marzinski Reviewed-by: Martin Wilck Reviewed-by: Hanna Czenczek Signed-off-by: Mikulas Patocka commit 7b2f88cc9dd4c2b9f3d6f5377b45ed9c90fd2fe9 Author: Benjamin Tissoires Date: Mon Mar 2 15:51:10 2026 +0100 HID: asus: drop unused variables Looks like those variables are leftovers from debugging. Reported-by: Mark Brown Closes: https://lore.kernel.org/linux-next/aaWXFVxygHFpKNxv@sirena.org.uk/ Signed-off-by: Benjamin Tissoires commit a373b3d5289e50ab26d4cf776bf5891436ff3658 Author: Ming-Hung Tsai Date: Mon Feb 9 15:54:11 2026 +0800 dm cache: prevent entering passthrough mode after unclean shutdown dm-cache assumes all cache blocks are dirty when it recovers from an unclean shutdown. Given that the passthrough mode doesn't handle dirty blocks, we should not load a cache in passthrough mode if it was not cleanly shut down; or we'll risk data loss while updating an actually dirty block. Also bump the target version to 2.4.0 to mark completion of passthrough mode fixes. Reproduce steps: 1. Create a writeback cache with zero migration_threshold to produce dirty blocks. dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writeback smq \ 2 migration_threshold 0" 2. Write the first cache block dirty fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \ --direct=1 --size=64k 3. Ensure the number of dirty blocks is 1. This status query triggers metadata commit without flushing the dirty bitset, setting up the unclean shutdown state. dmsetup status cache | awk '{print $14}' 4. Force reboot, leaving the cache uncleanly shutdown. echo b > /proc/sysrq-trigger 5. Activate the above cache components, and verify the first data block remains dirty. dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/mapper/cdata of=/tmp/cb0.bin bs=64k count=1 dd if=/dev/mapper/corig of=/tmp/ob0.bin bs=64k count=1 md5sum /tmp/cb0.bin /tmp/ob0.bin # expected to be different 6. Try bringing up the cache in passthrough mode. It succeeds, while the first cache block was loaded dirty due to unclean shutdown, violates the passthrough mode's constraints. dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup status cache | awk '{print $14}' 7. (Optional) Demonstrate the integrity issue: invalidating the dirty block in passthrough mode doesn't write back the dirty data, causing data loss. fio --filename=/dev/mapper/cache --name=invalidate --rw=write --bs=4k \ --direct=1 --size=4k # overwrite the first 4k to trigger invalidation dmsetup remove cache dd if=/dev/mapper/corig of=/tmp/ob0new.bin bs=64k count=1 cb0sum=$(dd if=/tmp/cb0.bin bs=4k count=15 skip=1 | md5sum | \ awk '{print $1}') ob0newsum=$(dd if=/tmp/ob0new.bin bs=4k count=15 skip=1 | md5sum | \ awk '{print $1}') echo "$cb0sum, $ob0newsum" # remaining 60k should differ (data loss) Signed-off-by: Ming-Hung Tsai Signed-off-by: Mikulas Patocka commit 322586745bd1a0e5f3559fd1635fdeb4dbd1d6b8 Author: Ming-Hung Tsai Date: Mon Feb 9 15:54:10 2026 +0800 dm cache: fix dirty mapping checking in passthrough mode switching As mentioned in commit 9b1cc9f251af ("dm cache: share cache-metadata object across inactive and active DM tables"), dm-cache assumed table reload occurs after suspension, while LVM's table preload breaks this assumption. The dirty mapping check for passthrough mode was designed around this assumption and is performed during table creation, causing the check to fail with preload while metadata updates are ongoing. This risks loading dirty mappings into passthrough mode, resulting in data loss. Reproduce steps: 1. Create a writeback cache with zero migration_threshold to produce dirty mappings dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writeback smq \ 2 migration_threshold 0" 2. Preload a table in passthrough mode dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" 3. Write to the first cache block to make it dirty fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \ --direct=1 --size=64k 4. Resume the inactive table. Now it's possible to load the dirty block into passthrough mode. dmsetup resume cache Fix by moving the checks to the preresume phase to support table preloading. Also remove the unused function dm_cache_metadata_all_clean. Fixes: 2ee57d587357 ("dm cache: add passthrough mode") Signed-off-by: Ming-Hung Tsai Signed-off-by: Mikulas Patocka commit e4f66341779d0cf4c83c74793753a84094286d9e Author: Ming-Hung Tsai Date: Mon Feb 9 15:54:09 2026 +0800 dm cache: fix concurrent write failure in passthrough mode When bio prison cell lock acquisition fails due to concurrent writes to the same block in passthrough mode, dm-cache incorrectly returns an I/O error instead of properly handling the concurrency. This can occur in both process and workqueue contexts when invalidate_lock() is called for exclusive access to a data block. Fix this by deferring the write bios to ensure proper block device behavior. Reproduce steps: 1. Create a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Promote the first data block into cache fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \ --direct=1 --size=64k 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the first cached block concurrently. Sometimes one of the processes will receive I/O errors. fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \ --randrepeat=0 --direct=1 --numjobs=2 --size 64k fio-3.41 fio: io_u error on file /dev/mapper/cache: Input/output error: write offset=4096, buflen=4096 fio: pid=106, err=5/file:io_u.c:2008, func=io_u error, error=Input/output error test: (groupid=0, jobs=1): err= 0: pid=105 test: (groupid=0, jobs=1): err= 5 (file:io_u.c:2008, func=io_u error, error=Input/output error): pid=106 Fixes: b29d4986d0da ("dm cache: significant rework to leverage dm-bio-prison-v2") Signed-off-by: Ming-Hung Tsai Signed-off-by: Mikulas Patocka commit 2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45 Author: Ming-Hung Tsai Date: Mon Feb 9 15:54:08 2026 +0800 dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called simultaneously from multiple workers, thus it should be protected by a lock. Otherwise, we might end up with data races on the allocated blocks counter, or even use-after-free issues with internal data structures when doing concurrent writes. Note that the existing FIXME in smq_invalidate_mapping() doesn't affect passthrough mode since migration tasks don't exist there, but would need attention if supporting fast device shrinking via suspend/resume without target reloading. Reproduce steps: 1. Create a cache device consisting of 1024 cache entries dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Populate the cache, and record the number of cached blocks fio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k \ --size=64m --direct=1 nr_cached=$(dmsetup status cache | awk '{split($7, a, "/"); print a[1]}') 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the passthrough cache. By setting multiple jobs with I/O size equal to the cache block size, cache blocks are invalidated concurrently from different workers. fio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k \ --direct=1 --numjobs=2 --randrepeat=0 --size=64m 5. Check if demoted matches cached block count. These numbers should match but may differ due to the data race. nr_demoted=$(dmsetup status cache | awk '{print $12}') echo "$nr_cached, $nr_demoted" Fixes: b29d4986d0da ("dm cache: significant rework to leverage dm-bio-prison-v2") Signed-off-by: Ming-Hung Tsai Signed-off-by: Mikulas Patocka commit 4ca8b8bd952df7c3ccdc68af9bd3419d0839a04b Author: Ming-Hung Tsai Date: Mon Feb 9 15:54:07 2026 +0800 dm cache: fix write hang in passthrough mode The invalidate_remove() function has incomplete logic for handling write hit bios after cache invalidation. It sets up the remapping for the overwrite_bio but then drops it immediately without submission, causing write operations to hang. Fix by adding a new invalidate_committed() continuation that submits the remapped writes to the cache origin after metadata commit completes, while using the overwrite_endio hook to ensure proper completion sequencing. This maintains existing coherency. Also improve error handling in invalidate_complete() to preserve the original error status instead of using bio_io_error() unconditionally. Fixes: b29d4986d0da ("dm cache: significant rework to leverage dm-bio-prison-v2") Signed-off-by: Ming-Hung Tsai Signed-off-by: Mikulas Patocka commit 0c5eef0aad508231d8e43ff8392692925e131b68 Author: Ming-Hung Tsai Date: Mon Feb 9 15:54:06 2026 +0800 dm cache: fix write path cache coherency in passthrough mode In passthrough mode, dm-cache defers write bio submission until cache invalidation completes to maintain existing coherency, requiring the target map function to return DM_MAPIO_SUBMITTED. The current map_bio() returns DM_MAPIO_REMAPPED, violating the required ordering constraint. Reproduce steps: 1. Create a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Promote the first data block into the cache fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \ --direct=1 --size=64k 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the first data block, and check io ordering using ftrace echo 1 > /sys/kernel/debug/tracing/events/block/block_bio_queue/enable echo 1 > /sys/kernel/debug/tracing/events/block/block_bio_complete/enable echo 1 > /sys/kernel/debug/tracing/events/block/block_rq_complete/enable fio --filename=/dev/mapper/cache --name=test --rw=write --bs=64k \ --direct=1 --size 64k 5. ftrace logs show that write operations to the cache origin (252:2) and metadata operations (252:0) are unsynchronized: the origin write occurs before metadata commit. fio-146 [000] ..... 420.139562: block_bio_queue: 252,3 WS 0 + 128 [fio] fio-146 [000] ..... 420.149395: block_bio_queue: 252,2 WS 0 + 128 [fio] fio-146 [000] ..... 420.149763: block_bio_queue: 8,32 WS 262144 + 128 [fio] fio-146 [000] dNh1. 420.151446: block_rq_complete: 8,32 WS () 262144 + 128 be,0,4 [0] fio-146 [000] dNh1. 420.152731: block_bio_complete: 252,2 WS 0 + 128 [0] fio-146 [000] dNh1. 420.154229: block_bio_complete: 252,3 WS 0 + 128 [0] kworker/0:0-9 [000] ..... 420.160530: block_bio_queue: 252,0 W 408 + 8 [kworker/0:0] kworker/0:0-9 [000] ..... 420.161641: block_bio_queue: 8,32 W 408 + 8 [kworker/0:0] kworker/0:0-9 [000] ..... 420.162533: block_bio_queue: 252,0 W 416 + 8 [kworker/0:0] kworker/0:0-9 [000] ..... 420.162821: block_bio_queue: 8,32 W 416 + 8 [kworker/0:0] Fixes: b29d4986d0da ("dm cache: significant rework to leverage dm-bio-prison-v2") Signed-off-by: Ming-Hung Tsai Signed-off-by: Mikulas Patocka commit 7d1f98d668ee34c1d15bdc0420fdd062f24a27c0 Author: Ming-Hung Tsai Date: Mon Feb 9 15:54:05 2026 +0800 dm cache: fix null-deref with concurrent writes in passthrough mode In passthrough mode, when dm-cache starts to invalidate a cache entry and bio prison cell lock fails due to concurrent write to the same cached block, mg->cell remains NULL. The error path in invalidate_complete() attempts to unlock and free the cell unconditionally, causing a NULL pointer dereference: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 134 Comm: fio Not tainted 6.19.0-rc7 #3 PREEMPT RIP: 0010:dm_cell_unlock_v2+0x3f/0x210 Call Trace: invalidate_complete+0xef/0x430 map_bio+0x130f/0x1a10 cache_map+0x320/0x6b0 __map_bio+0x458/0x510 dm_submit_bio+0x40e/0x16d0 __submit_bio+0x419/0x870 Reproduce steps: 1. Create a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 131072 linear /dev/sdc 8192" dmsetup create corig --table "0 262144 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. Promote the first data block into cache fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \ --direct=1 --size=64k 3. Reload the cache into passthrough mode dmsetup suspend cache dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0" dmsetup resume cache 4. Write to the first cached block concurrently fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \ --randrepeat=0 --direct=1 --numjobs=2 --size 64k Fix by checking if mg->cell is valid before attempting to unlock it. Fixes: b29d4986d0da ("dm cache: significant rework to leverage dm-bio-prison-v2") Signed-off-by: Ming-Hung Tsai Signed-off-by: Mikulas Patocka commit 98226a594f313442fcba38cefc1df0b6c1691c7e Author: Gabor Juhos Date: Fri Feb 20 11:20:11 2026 +0100 arm64: dts: marvell: armada-37xx: drop redundant status property Remove the 'status' property from the 'armada-3700-rwtm' node. Device nodes are enabled by default, so specifying the status as "okay" is superfluous. Signed-off-by: Gabor Juhos Signed-off-by: Gregory CLEMENT commit b6453dd68e7329b2954ed9a3552095919889a4a9 Author: Gabor Juhos Date: Fri Feb 20 11:03:49 2026 +0100 arm64: dts: marvell: armada-37xx: align 'phy-names' of EHCI node with DT schema According to the 'generic-ehci.yaml' schema, the name of the first phy in an EHCI node must be "usb", however the 'usb@5e000' node in the 'armada-37xx.dtsi' uses "usb2-utmi-host-phy" instead. This causes dtbs_check warnings like the following ones: arch/arm64/boot/dts/marvell/armada-3720-atlas-v5.dtb: usb@5e000 (marvell,armada-3700-ehci): phy-names:0: 'usb' was expected from schema $id: http://devicetree.org/schemas/usb/generic-ehci.yaml arch/arm64/boot/dts/marvell/armada-3720-db.dtb: usb@5e000 (marvell,armada-3700-ehci): phy-names:0: 'usb' was expected from schema $id: http://devicetree.org/schemas/usb/generic-ehci.yaml arch/arm64/boot/dts/marvell/armada-3720-eDPU.dtb: usb@5e000 (marvell,armada-3700-ehci): phy-names:0: 'usb' was expected from schema $id: http://devicetree.org/schemas/usb/generic-ehci.yaml ... Use "usb" as a name for the phy to avoid the warnings. No functional change, the USB interface works after the change: [ 1.472393] orion-ehci d005e000.usb: EHCI Host Controller [ 1.477847] orion-ehci d005e000.usb: new USB bus registered, assigned bus number 1 [ 1.487127] orion-ehci d005e000.usb: irq 40, io mem 0xd005e000 [ 1.505759] orion-ehci d005e000.usb: USB 2.0 started, EHCI 1.00 [ 1.512493] hub 1-0:1.0: USB hub found [ 1.516434] hub 1-0:1.0: 1 port detected ... [ 4.175746] usb 1-1: new high-speed USB device number 2 using orion-ehci [ 4.347643] usb-storage 1-1:1.0: USB Mass Storage device detected [ 4.359972] scsi host0: usb-storage 1-1:1.0 [ 5.367100] scsi 0:0:0:0: Direct-Access ADATA USB Flash Drive 1.00 PQ: 0 ANSI: 6 [ 5.387091] sd 0:0:0:0: [sda] 30869504 512-byte logical blocks: (15.8 GB/14.7 GiB) [ 5.398420] sd 0:0:0:0: [sda] Write Protect is off [ 5.408108] sd 0:0:0:0: [sda] Write cache: disabled, read cache: disabled, doesn't support DPO or FUA [ 5.477359] sda: sda1 [ 5.480037] sd 0:0:0:0: [sda] Attached SCSI removable disk Signed-off-by: Gabor Juhos Signed-off-by: Gregory CLEMENT commit 283822a64d6bd9aca55b5e2718bc63e9815b443d Author: Elad Nachman Date: Thu Jan 22 18:59:21 2026 +0200 dt-bindings: arm64: add Marvell 7k COMe boards Add dt bindings for: Armada 7020 COM Express CPU module Falcon DB-98CX85x0 COM Express type 7 Carrier board Falcon DB-98CX85x0 COM Express type 7 Carrier board with an Armada 7020 COM Express CPU module Signed-off-by: Elad Nachman Acked-by: Rob Herring (Arm) Signed-off-by: Gregory CLEMENT commit b3929b2cc2a6003b8e301e6540c651e60d24dcb4 Author: Matthew Sakai Date: Wed Feb 11 10:05:55 2026 -0500 dm vdo slab-depot: validate old zone count on load Verify the old zone count has a valid value before using it to compute slab summary entry offsets. Signed-off-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit 9e809bb1defe9be7fed2e21552c6b03b2694394d Author: Matthew Sakai Date: Wed Feb 11 10:05:54 2026 -0500 dm vdo indexer: validate saved zone count Verify that the loaded zone count is in the valid range before using it as a loop iterator. Signed-off-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit 85c4b28fe8b6173d6bf129d99bc42913102e9a4b Author: Gabor Juhos Date: Sat Feb 21 16:37:59 2026 +0100 arm64: dts: marvell: armada-3720: drop 'marvell,xenon-emmc' properties The 'marvell,xenon-emmc' property used in some device trees of Armada 3720 based boards is not documented. Due to this dtbs_check throws warnings: .../armada-3720-atlas-v5.dtb: mmc@d8000 (marvell,armada-3700-sdhci): Unevaluated properties are not allowed ('marvell,xenon-emmc' was unexpected) .../armada-3720-espressobin-emmc.dtb: mmc@d8000 (marvell,armada-3700-sdhci): Unevaluated properties are not allowed ('marvell,xenon-emmc' was unexpected) Apart from the warnings, 'git grep' says that the property is used in device trees only: $ git grep -n 'marvell,xenon-emmc' arch/arm64/boot/dts/marvell/armada-3720-atlas-v5.dts:85: marvell,xenon-emmc; arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi:81: marvell,xenon-emmc; Although handling of the property was there in an early version of the 'sdhci-xenon' driver during the initial submission [1], but that part has been removed in later versions. Drop the property from the affected device trees due to the reasons mentioned above. No functional changes intended, compile tested only. Link: https://lore.kernel.org/r/0390e7a05b6163deabb545f93729ea615eeaaee2.1477911954.git-series.gregory.clement@free-electrons.com # [1] Signed-off-by: Gabor Juhos Reviewed-by: Andrew Lunn Signed-off-by: Gregory CLEMENT commit 29d8a380643521422a9907f3e982e142fe22d19e Author: Lukas Bulwahn Date: Tue Feb 3 09:38:42 2026 +0100 MAINTAINERS: drop file entry in Marvell Kirkwood and Armada SOC support Commit fcaf733ca526 ("MAINTAINERS: Add Falcon DB") adds a new file entry referring to non-existing files arch/arm/boot/dts/marvell/db-falcon*. Checking with 'find . -name db-falcon*' and the files actually added with the commit b3370479a5f7 ("arm64: dts: a7k: add COM Express boards"), which was part of the same patch series, the files intended to refer to are actually arch/arm64/boot/dts/marvell/db-falcon-carrier-a7k.dts and arch/arm64/boot/dts/marvell/db-falcon-carrier.dtsi. Note though that there is already a file entry for arch/arm64/boot/dts/marvell/ in the ARM/Marvell Kirkwood and Armada SOC support section. So, the added files were already covered by the existing MAINTAINERS file and no further file entry is required at all. Drop the unneeded file entry, essentially reverting the commit fcaf733ca526 ("MAINTAINERS: Add Falcon DB"). Signed-off-by: Lukas Bulwahn Signed-off-by: Gregory CLEMENT commit 38f09c97340cd23f976242e6cb1e7aa4c8ed28d0 Author: Robert Marko Date: Tue Jan 27 13:32:15 2026 +0100 arm64: dts: marvell: uDPU: add ethernet aliases On eDPU plus, which is an updated revision of eDPU which uses an external MV88E6361 switch we are relying on U-Boot to detect the board, and then enable and disable the required nodes for that revision. However, it seems that I missed adding the required aliases for ethernet controllers, and this worked as in OpenWrt we had added those locally. Cc: stable@vger.kernel.org Fixes: 660b8b2f3944 ("arm64: dts: marvell: eDPU: add support for version with external switch") Signed-off-by: Robert Marko Signed-off-by: Gregory CLEMENT commit e171a891c2e5bae484eaed45c1c82f85f356c288 Author: Rob Herring (Arm) Date: Tue Jan 27 19:55:20 2026 -0600 arm/arm64: dts: marvell: Drop unused .dtsi These .dtsi files are not included anywhere in the tree and can't be tested. Signed-off-by: Rob Herring (Arm) Acked-by: Elad Nachman Signed-off-by: Gregory CLEMENT commit e4cbff2debc02e71f2ce75e19377df5aef7f7ae5 Author: Elad Nachman Date: Mon Jan 26 13:36:27 2026 +0200 arm64: dts: a7k: use phy handle Documentation/devicetree/bindings/net/ethernet-controller.yaml phy: : #/properties/phy-handle deprecated: true New dts files should not be using deprecated properties. What should be used is: phy-handle: : /schemas/types.yaml#/definitions/phandle description: Specifies a reference to a node representing a PHY device. Suggested-by: Andrew Lunn Signed-off-by: Elad Nachman Reviewed-by: Andrew Lunn Signed-off-by: Gregory CLEMENT commit 9ab637ac5d3826606947f4e861107da958eda324 Author: Andy Shevchenko Date: Mon Mar 2 10:56:57 2026 +0100 regcache: Amend printf() specifiers when printing registers In one case the 0x is provided in the formatting string, while the rest use # for that. In a couple of more cases a decimal signed value specifier is used. Amend them to use %#x when register is printed. Note, for the case, when it's related to the read/write, use %x to be in align with the similar messages in regmap core. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260302095847.2310066-4-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 8e29bc88e11928926fd97fc9acd58b8afa38de9d Author: Andy Shevchenko Date: Mon Mar 2 10:56:56 2026 +0100 regcache: Define iterator inside for-loop and align their types Some of the iterators may be defined inside the respective for-loop reducing the scope and potential risk of their misuse. While at it, align their types based on the type of the upper or lower limits. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260302095847.2310066-3-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 6dc41d8d3b9692b6336196ae1a330bcd3fad92ee Merge: 727d1a1c4eb272 06dba254de95b1 Author: Mark Brown Date: Mon Mar 2 14:22:26 2026 +0000 ASoC: tegra: Add support for WM8962 and CPCAP Merge series from Svyatoslav Ryhel : Add support for WM8962 and CPCAP codecs found in various Tegra devices. commit 5e5ea39ff55297fc9d6338f26346c2a7738a78ea Author: Andy Shevchenko Date: Fri Feb 20 15:21:12 2026 +0100 PCI: dwc: Remove not-going-to-be-supported code for Baikal SoC As noticed in the discussion [1] the Baikal SoC and platforms are not going to be finalized, hence remove stale code. Signed-off-by: Andy Shevchenko Signed-off-by: Manivannan Sadhasivam Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1] Link: https://patch.msgid.link/20260220142600.2397070-1-andriy.shevchenko@linux.intel.com commit 4a1cec7450b7159a0ee57403f44460ac4d618b4f Author: Costa Shulyupin Date: Thu Jan 8 11:49:55 2026 +0200 tools/rtla: Generate optstring from long options getopt_long() processes short and long options independently. RTLA, like the majority of applications, uses both short and long variants for each logical option. Since the val member of struct option holds the letter of the short variant, the string of short options can be reconstructed from the array of long options. Add getopt_auto() to generate optstring from an array of long options, eliminating the need to maintain separate short option strings. Signed-off-by: Costa Shulyupin Reviewed-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20260108095011.2115719-1-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 387a926ee166814611acecb960207fe2f3c4fd3e Author: Amirreza Zarrabi Date: Mon Feb 16 14:24:06 2026 -0800 tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate while the supplicant is still processing its request. If the client exits first it removes the request from its queue and kfree()s it, while the request ID remains in supp->idr. A subsequent lookup on the supplicant path then dereferences freed memory, leading to a use-after-free. Serialise access to the request with supp->mutex: * Hold supp->mutex in optee_supp_recv() and optee_supp_send() while looking up and touching the request. * Let optee_supp_thrd_req() notice that the client has terminated and signal optee_supp_send() accordingly. With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race. Fixes: 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") Signed-off-by: Amirreza Zarrabi Tested-by: Ox Yeh Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 727d1a1c4eb272164a84d4400dddcdf26ecf502a Merge: a8fd392f6e3ad3 17c6bf433742e0 Author: Mark Brown Date: Mon Mar 2 13:35:21 2026 +0000 Support wm_adsp hibernation for runtime suspend Merge series from Stefan Binding : When the CS35L41 and CS35L45 drivers suspend, they are put into hibernation, and the regmap goes into cache_only, but the firmware is still running, and wm_adsp is not stopped. If userspace attempts to read a firmware control, it will perform a regmap_raw_read() and this will produce an error in the kernel log. To prevent these spurious errors, add an apis into cs_dsp and wm_adsp to allow wm_adsp to hibernate. In this hibernation mode, reads or writes to the dsp controls would be rejected with -EPERM rather than -EBUSY, and no error will be printed to the kernel log. commit a8fd392f6e3ad33b87dfdb6d438f05c5bc29d2e6 Merge: ca5355db6330cc 1696fad8b259a2 Author: Mark Brown Date: Mon Mar 2 13:35:13 2026 +0000 ASoC: sti: regmap_field usage improvements Merge series from Sander Vanheule : uni_player_parse_dt_audio_glue() allocates two regmap_field objects on the device's regmap. However, error codes from these allocations are not propagated correctly and the resources will leak on device removal. These issues were found while looking for users of regmap_field_alloc(), to assess the impact of adding a cleanup helper for regmap_field. It appears this driver is the only (remaining) in-tree user of this allocator. Since the resources are long-lived, it may as well switch to devm_regmap_field_alloc(). As I don't have access to this hardware, these patches were only compile tested on a UM build. commit ca5355db6330ccd1a02bb382b793d0a2027c7fd3 Merge: da37bfe76b5b4c 34b4fc44e4f904 Author: Mark Brown Date: Mon Mar 2 13:35:04 2026 +0000 ASoC: partial match the sdca codec name Merge series from Bard Liao : Currently, we set a predefined codec component name in a DAI link. But the codec name may contain an index which is not fixed. This series suggest using partial match the codec name to fix the issue. commit 85cd4fbf5669cf394c8627d91c7b50b9aca8f4af Author: Ethan Nelson-Moore Date: Fri Jan 30 18:01:17 2026 -0800 platform: x86: remove unnecessary module_init/exit() functions Two x86 platform drivers have unnecessary module_init() and module_exit() functions that are empty or just print a message. Remove them. Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260131020118.46171-1-enelsonmoore@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 62a9fc50e8d947601ea3484e732b1a65a0a54b96 Author: Shubhrajyoti Datta Date: Tue Nov 4 15:09:20 2025 +0530 EDAC/versalnet: Refactor memory controller initialization and cleanup Simplify the initialization and cleanup flow for Versal Net DDRMC controllers in the EDAC driver by carving out the single controller init into a separate function which allows for a much better and more readable error handling and unwinding. [ bp: - do the kzalloc allocations first - "publish" the structures only after they've been initialized properly so that you don't need to unwind unnecessarily when it fails later - remove_versalnet() is now trivial ] Signed-off-by: Shubhrajyoti Datta Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251104093932.3838876-1-shubhrajyoti.datta@amd.com commit f45d4356feeba1c8dac3414b688f59292ddfc9f9 Author: Heiko Stuebner Date: Tue Feb 10 09:03:02 2026 +0100 arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config The hardware PU/PD config of the pin after reset is to pull-up and on Jaguar this will also keep the device in reset until the driver actually enables the pin. So restore this boot pull-up config of the pin on Jaguar instead of setting it to pull-none. Suggested-by: Quentin Schulz Fixes: 0ec7e1096332 ("arm64: dts: rockchip: add PCIe3 support on rk3588-jaguar") Signed-off-by: Heiko Stuebner Reviewed-by: Shawn Lin Reviewed-by: Quentin Schulz Link: https://patch.msgid.link/20260210080303.680403-5-heiko@sntech.de Signed-off-by: Heiko Stuebner commit 603921cf88952c456bff8f22e48a822a077341b8 Author: Heiko Stuebner Date: Tue Feb 10 09:03:01 2026 +0100 arm64: dts: rockchip: add pinctrl for clk-generator GPIO on rk3588-tiger While specific driver in the Linux-Kernel handles GPIOs gracefully without matching pinctrl entries, this might not be true for other operating systems. So having pinctrl entries makes the hardware-description more complete. The somewhat similar rk3588-jaguar board has a pinctrl entry already, so also add one for rk3588-tiger. Reviewed-by: Quentin Schulz Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260210080303.680403-4-heiko@sntech.de Signed-off-by: Heiko Stuebner commit cfe2d65332eff95ac7308478897760888f957aeb Author: Heiko Stuebner Date: Tue Feb 10 09:03:00 2026 +0100 arm64: dts: rockchip: use gated-fixed-clock for pcie-refclk on rk3588-tiger Using a combination of fixed clock and gpio-gate clock works but does not describe the actual hardware. Use the gated-fixed-clock binding to describe this in a nicer way. Signed-off-by: Heiko Stuebner Reviewed-by: Shawn Lin Reviewed-by: Quentin Schulz Link: https://patch.msgid.link/20260210080303.680403-3-heiko@sntech.de Signed-off-by: Heiko Stuebner commit f5e52701725c5c5c54d6511ca633a7566d1661a8 Author: Heiko Stuebner Date: Tue Feb 10 09:02:59 2026 +0100 arm64: dts: rockchip: use gated-fixed-clock for pcie-refclk on rk3588-jaguar Using a combination of fixed clock and gpio-gate clock works but does not describe the actual hardware. Use the gated-fixed-clock binding to describe this in a nicer way. Signed-off-by: Heiko Stuebner Reviewed-by: Shawn Lin Reviewed-by: Quentin Schulz Link: https://patch.msgid.link/20260210080303.680403-2-heiko@sntech.de Signed-off-by: Heiko Stuebner commit 35dad33703e8b40090e964257eafdd66e53f38eb Author: Chaoyi Chen Date: Tue Feb 24 16:38:18 2026 +0800 arm64: dts: rockchip: Enable displayport for rk3576 evb2 The rk3576 evb2 has a full size displayport connector. Enable it. Signed-off-by: Chaoyi Chen Link: https://patch.msgid.link/20260224083818.109-1-kernel@airkyi.com Signed-off-by: Heiko Stuebner commit 1d608a269e24285eb399e08f0b47c2020b8c719a Author: Samuel Holland Date: Tue Feb 24 18:04:51 2026 +0100 arm64: dts: rockchip: Add battery and charger on rk3566-pinenote The PineNote has a single cell 4000mAh battery which can be charged via the rk817 PMIC. Signed-off-by: Samuel Holland Co-developed-by: Maximilian Weigand Signed-off-by: Maximilian Weigand Signed-off-by: Diederik de Haas Link: https://patch.msgid.link/20260224170531.516392-1-diederik@cknow-tech.com Signed-off-by: Heiko Stuebner commit 0dd7a23da214279cfb77b0eb03c38614867524d7 Author: Thomas Zimmermann Date: Fri Feb 27 14:31:07 2026 +0100 drm/panthor: Test for imported buffers with drm_gem_is_imported() Instead of testing import_attach for imported GEM buffers, invoke drm_gem_is_imported() to do the test. The test itself does not change. Signed-off-by: Thomas Zimmermann Cc: Boris Brezillon Cc: Steven Price Cc: Liviu Dudau Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Reviewed-by: Liviu Dudau Signed-off-by: Steven Price Link: https://patch.msgid.link/20260227133113.235940-8-tzimmermann@suse.de commit 6618c0fd0cb7dbe6cd99f8c3d7f4673f73ea2019 Author: Thomas Zimmermann Date: Fri Feb 27 14:31:06 2026 +0100 drm/panfrost: Test for imported buffers with drm_gem_is_imported() Instead of testing import_attach for imported GEM buffers, invoke drm_gem_is_imported() to do the test. The test itself does not change. Signed-off-by: Thomas Zimmermann Cc: Boris Brezillon Cc: Rob Herring Cc: Steven Price Cc: "Adrián Larumbe" Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Signed-off-by: Steven Price Link: https://patch.msgid.link/20260227133113.235940-7-tzimmermann@suse.de commit 75d627e5571a5ef313f6f553b7749b124c923c3d Author: Fabio Estevam Date: Mon Feb 9 23:26:19 2026 -0300 dt-bindings: clock: rockchip: Add RV1103B CRU support Add support for the Rockchip RV1103B Clock and Reset Unit (CRU). The RV1103B CRU is compatible with the existing RV1126B binding. Add the compatible string to the schema and introduce the corresponding clock ID definitions. Signed-off-by: Fabio Estevam Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260210022620.172570-1-festevam@gmail.com Signed-off-by: Heiko Stuebner commit 3e65e426d4575a66a82928eb41b6d83f36e5ce9c Author: Fabio Estevam Date: Mon Feb 9 23:26:20 2026 -0300 clk: rockchip: Add clock controller for the RV1103B Add the clock and reset tree definitions for the RV1103B SoC. Based on the 5.10 Rockchip vendor kernel driver. Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20260210022620.172570-2-festevam@gmail.com Signed-off-by: Heiko Stuebner commit ec1fb4e55df47ed043ab2ccc6787e39b9d67e49b Author: Yixun Lan Date: Thu Feb 26 09:35:00 2026 +0000 riscv: dts: spacemit: adapt regulator node name to preferred form The preferred node name for fixed-regulators has changed to pattern [1]: '^regulator(-[0-9]+v[0-9]+|-[0-9a-z-]+)?$' Adjust all SpacemiT DT regulator node names to fix this. Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20240426215147.3138211-1-robh@kernel.org [1] Link: https://lore.kernel.org/r/20260226-02-k1-regulator-names-v1-1-e87695d50159@kernel.org Signed-off-by: Yixun Lan commit 7d939032bd7e203e1c907a8c35e3672eeee08246 Author: Chaoyi Chen Date: Thu Feb 26 18:20:52 2026 +0800 arm64: dts: rockchip: Fix sdmmc pwren pinctrl for rk3576-evb2 In rk3576.dtsi, sdmmc0_pwren is configured as part of the sdmmc pinctrl. However, on the rk3576 evb2 board, sdmmc0_pwren is used as the regulator for vmmc-supply. Therefore, we need to reassign the sdmmc pinctrl and remove sdmmc0_pwren to avoid conflicts. Cc: Shawn Lin Fixes: 86a82f7a7eed ("arm64: dts: rockchip: Add rk3576 evb2 board") Signed-off-by: Chaoyi Chen Link: https://patch.msgid.link/20260226102052.63-1-kernel@airkyi.com Signed-off-by: Heiko Stuebner commit 164148d0a16351ad3027cf3a3bb96d197633aecb Author: Debbie Horsfall Date: Thu Feb 12 11:16:52 2026 +0000 arm64: dts: zena: Add support for Zena CSS Introduce the Zena CSS Fixed Virtual Platform (FVP) dts. This is currently the only Zena CSS variant, however the common definitions are included in a common dtsi for extensibility. Signed-off-by: Debbie Horsfall Message-Id: <20260212-zena-css-v2-2-d33ea23cb9c2@arm.com> Reviewed-by: Andre Przywara Signed-off-by: Sudeep Holla commit 96a43d3325e370de6fd72b814d083b2777cb4595 Author: Debbie Horsfall Date: Thu Feb 12 11:16:51 2026 +0000 dt-bindings: arm: Add Zena CSS compatibility Add compatibility to Arm Zena CSS Fixed Virtual Platform [1]. [1] https://www.arm.com/products/automotive/compute-subsystems/zena Reviewed-by: Rob Herring (Arm) Signed-off-by: Debbie Horsfall Message-Id: <20260212-zena-css-v2-1-d33ea23cb9c2@arm.com> Signed-off-by: Sudeep Holla commit d1fed2d600905e7f007d8c88c936b768d45c09d6 Author: Russell King (Oracle) Date: Fri Dec 5 16:26:04 2025 +0000 ARM: provide individual is_translation_fault() and is_permission_fault() Provide individual LPAE and non-LPAE definitions for both these functions, rather than having ifdefs inside the function body. This places the functions closer to their associated definitions. Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Russell King (Oracle) commit a542de4451093f310d20e3d65d62ab4f4d38241f Author: Russell King (Oracle) Date: Fri Dec 5 15:36:09 2025 +0000 ARM: move FSR fault status definitions before fsr_fs() The FSR's fault status bits depend on whether LPAE is enabled. Rather than always exposing both LPAE and non-LPAE to all code, move them inside the ifdef blocks dependent on LPAE to restrict their visibility. No code other than fsr_fs() makes use of these. Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Russell King (Oracle) commit 5548e8a4663d9decc8215c53e4a41c704f183cbb Author: Russell King (Oracle) Date: Fri Dec 5 15:34:42 2025 +0000 ARM: use BIT() and GENMASK() for fault status register fields Modernise the fault status field definitions by using BIT() and GENMASK(). Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Russell King (Oracle) commit 9c46fcaf2efa78e814e102c5828cf5c825a133ec Author: Russell King (Oracle) Date: Fri Dec 5 15:25:24 2025 +0000 ARM: move is_permission_fault() and is_translation_fault() to fault.h is_permission_fault() and is_translation_fault() are both conditional on the FSR encodings, which are dependent on LPAE. We define the constants in fault.h. Move these inline functions to fault.h to be near the FSR definitions. Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Russell King (Oracle) commit 1b9a5bc8513d081c1bfe2c096b6dc502a4660f47 Author: Dmitry Torokhov Date: Fri Feb 13 18:52:45 2026 -0800 driver core: platform: fix various formatting issues Make checkpatch happy. This helps when checkpatch is set up as an automatic linter. Signed-off-by: Dmitry Torokhov Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260214025246.2095239-4-dmitry.torokhov@gmail.com Signed-off-by: Danilo Krummrich commit 0fc434bc2c45fceb9356f2138911db0f454b8ca6 Author: Dmitry Torokhov Date: Fri Feb 13 18:52:44 2026 -0800 driver core: platform: allow attaching software nodes when creating devices Extend platform_device_info structure with an optional pointer to a software node to be used as a secondary firmware node for the device being created. If software node has not been registered yet it will be automatically registered. This reduces boilerplate needed when switching legacy board code to static device properties/GPIO references. Signed-off-by: Dmitry Torokhov Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260214025246.2095239-3-dmitry.torokhov@gmail.com Signed-off-by: Danilo Krummrich commit 94798081732abfb5748471d5c3cced6ff187fa36 Author: Dmitry Torokhov Date: Fri Feb 13 18:52:43 2026 -0800 driver core: platform: add kerneldoc to struct platform_device_info Add kernel documentation for struct platform_device_info and its individual members. While at it remove an extra indent level from the structure definition. Signed-off-by: Dmitry Torokhov Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260214025246.2095239-2-dmitry.torokhov@gmail.com Signed-off-by: Danilo Krummrich commit 78900204851708bbe761c3acf641ad60f15c922f Author: Russell King (Oracle) Date: Fri Dec 5 12:39:42 2025 +0000 ARM: move vmalloc() lazy-page table population Split the vmalloc() lazy-page table population from do_translation_fault() into a new vmalloc_fault() function. Signed-off-by: Russell King (Oracle) commit 59e4f3b45b96a24fc9b7a89e5f8a2168b30f95af Author: Russell King (Oracle) Date: Fri Dec 5 12:17:00 2025 +0000 ARM: ensure interrupts are enabled in __do_user_fault() __do_user_fault() may be called from fault handling paths where the interrupts are enabled or disabled. E.g. do_page_fault() calls this with interrupts enabled, whereas do_sect_fault()->do_bad_area() will call this with interrupts disabled. Since this is a userspace fault, we know that interrupts were enabled in the parent context, so call local_irq_enable() here to give a consistent interrupt state. This is necessary for force_sig_info() when PREEMPT_RT is enabled. Reported-by: Yadi.hu Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Russell King (Oracle) commit e4e6f0c5a4dc238684acef079e792c81d37e3226 Author: Frank Wunderlich Date: Mon Dec 15 08:46:08 2025 +0100 arm64: dts: mediatek: mt7988a-bpi-r4pro: fix model string Fix incorrect model string in Devicetree for BPI-R4-Pro. Fixes: f397471a6a8c ("arm64: dts: mediatek: mt7988: Add devicetree for BananaPi R4 Pro") Signed-off-by: Frank Wunderlich Signed-off-by: AngeloGioacchino Del Regno commit 94ff7c59cdfde3a16ab830531acbcb3091b292eb Author: Leon Romanovsky Date: Thu Feb 26 15:07:50 2026 +0200 RDMA: Complete k[z|m|c]alloc-to-k[z|m]alloc_obj conversion Commits bf4afc53b77a ("Convert 'alloc_obj' family to use the new default GFP_KERNEL argument") and 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") updated various k[z|m|c]alloc calls to their k[z|m]alloc_obj counterparts. This commit finalizes that transition within the RDMA subsystem. Link: https://patch.msgid.link/20260226-complete-alloc-conversion-v1-1-ebf1df1c2518@nvidia.com Signed-off-by: Leon Romanovsky commit 7c6084d7fa4e61dd7824c34529277a814c7b3836 Author: Avraham Stern Date: Wed Jan 7 15:20:02 2026 +0200 wifi: cfg80211: support key installation on non-netdev wdevs Currently key installation is only supported for netdev. For NAN, support most key operations (except setting default data key) on wdevs instead of netdevs, and adjust all the APIs and tracing to match. Since nothing currently sets NL80211_EXT_FEATURE_SECURE_NAN, this doesn't change anything (P2P Device already isn't allowed.) Signed-off-by: Avraham Stern Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260107150057.69a0cfad95fa.I00efdf3b2c11efab82ef6ece9f393382bcf33ba8@changeid Signed-off-by: Johannes Berg commit cc2f5e2aeb6c69556837e45756b3ddded98b3898 Author: Randy Dunlap Date: Sat Feb 28 17:48:02 2026 -0800 pinctrl: pinconf-generic: fix an enum name description Correct an enum name in a kernel-doc comment to avoid kernel-doc warnings: Warning: include/linux/pinctrl/pinconf-generic.h:161 Enum value 'PIN_CONFIG_SKEW_DELAY_OUTPUT_PS' not described in enum 'pin_config_param' Warning: include/linux/pinctrl/pinconf-generic.h:161 Excess enum value '@PIN_CONFIG_SKEW_DELAY_OUPUT_PS' description in 'pin_config_param' Signed-off-by: Randy Dunlap Signed-off-by: Linus Walleij commit f08061d267d2061f64d514c1ecbe441a063a6fad Author: Ethan Tidmore Date: Fri Feb 27 15:56:24 2026 -0600 pinctrl: pinctrl-pic32: Use devres version of gpiochip_add_data() Convert gpiochip_add_data() to devm_gpiochip_add_data() to use devres style cleanup across entire driver. Suggested-by: Linus Walleij Signed-off-by: Ethan Tidmore Signed-off-by: Linus Walleij commit fe5560688f3ba98364c7de7b4f8dc240ffd1ff75 Author: Ethan Tidmore Date: Fri Feb 27 15:56:23 2026 -0600 pinctrl: pinctrl-pic32: Fix resource leak Fix three possible resource leaks by using the devres version of clk_prepare_enable(). Also, update error message accordingly. Detected by Smatch: drivers/pinctrl/pinctrl-pic32.c:2211 pic32_pinctrl_probe() warn: 'pctl->clk' from clk_prepare_enable() not released on lines: 2208. drivers/pinctrl/pinctrl-pic32.c:2274 pic32_gpio_probe() warn: 'bank->clk' from clk_prepare_enable() not released on lines: 2264,2272. Fixes: 2ba384e6c3810 ("pinctrl: pinctrl-pic32: Add PIC32 pin control driver") Signed-off-by: Ethan Tidmore Signed-off-by: Linus Walleij commit a92b75100826b1ea27e6b8a678e53970ad4736d7 Author: Gabor Juhos Date: Fri Feb 27 15:15:54 2026 +0100 dt-bindings: pinctrl: marvell,armada3710-xb-pinctrl: add missing items keyword Even though the type of the 'groups' property of a pinmux node is specified as string-array in pinmux-node.yaml, but trying to use multiple strings causes dtbs_check warnings. For example, checking the following dts ... $ cat arch/arm64/boot/dts/marvell/armada-3720-test.dts /dts-v1/; #include "armada-372x.dtsi" &pinctrl_nb { pwm-gpio-pins { groups = "pwm0", "pwm1", "pwm2", "pwm3"; function = "gpio"; }; }; ... results in this warning: arch/arm64/boot/dts/marvell/armada-3720-test.dtb: pinctrl@13800 (marvell,armada3710-nb-pinctrl): pwm-gpio-pins:groups: ['pwm0', 'pwm1', 'pwm2', 'pwm3'] is too long from schema $id: http://devicetree.org/schemas/pinctrl/marvell,armada3710-xb-pinctrl.yaml Add the missing 'items' keyword to the schema to allow using multiple strings without such warnings. Also adjust the indentation of the next statements accordingly. Signed-off-by: Gabor Juhos Acked-by: Conor Dooley Fixes: c1c9641a04e83 ("dt-bindings: pinctrl: Convert marvell,armada-3710-(sb|nb)-pinctrl to DT schema") Reviewed-by: Miquel Raynal Signed-off-by: Linus Walleij commit f7df26875b9a07d756a5f4cac26dac95bf1d9de1 Author: Mark Brown Date: Fri Feb 27 15:20:35 2026 +0000 selftests/filesystems: Assume that TIOCGPTPEER is defined The devpts_pts selftest has an ifdef in case an architecture does not define TIOCGPTPEER, but the handling for this is broken since we need errno to be set to EINVAL in order to skip the test as we should. Given that this ioctl() has been defined since v4.15 we may as well just assume it's there rather than write handling code which will probably never get used. Signed-off-by: Mark Brown Link: https://patch.msgid.link/20260227-selftests-filesystems-devpts-tiocgptpeer-v3-1-07db4d85d5aa@kernel.org Signed-off-by: Christian Brauner commit 98779186aa0b3367489a87c6d8bc0911f577444e Merge: 6de23f81a5e08b 0f1f4e4e1503e6 Author: Christian Brauner Date: Mon Feb 23 13:06:04 2026 +0100 Merge patch series "xattr: rework simple xattrs and support user.* xattrs on sockets" Christian Brauner says: This reworks the simple_xattr infrastructure and adds support for user.* extended attributes on sockets. The simple_xattr subsystem currently uses an rbtree protected by a reader-writer spinlock. This series replaces the rbtree with an rhashtable giving O(1) average-case lookup with RCU-based lockless reads. This sped up concurrent access patterns on tmpfs quite a bit and it's an overall easy enough conversion to do and gets rid or rwlock_t. The conversion is done incrementally: a new rhashtable path is added alongside the existing rbtree, consumers are migrated one at a time (shmem, kernfs, pidfs), and then the rbtree code is removed. All three consumers switch from embedded structs to pointer-based lazy allocation so the rhashtable overhead is only paid for inodes that actually use xattrs. With this infrastructure in place the series adds support for user.* xattrs on sockets. Path-based AF_UNIX sockets inherit xattr support from the underlying filesystem (e.g. tmpfs) but sockets in sockfs - that is everything created via socket() including abstract namespace AF_UNIX sockets - had no xattr support at all. The xattr_permission() checks are reworked to allow user.* xattrs on S_IFSOCK inodes. Sockfs sockets get per-inode limits of 128 xattrs and 128KB total value size matching the limits already in use for kernfs. The practical motivation comes from several directions. systemd and GNOME are expanding their use of Varlink as an IPC mechanism. For D-Bus there are tools like dbus-monitor that can observe IPC traffic across the system but this only works because D-Bus has a central broker. For Varlink there is no broker and there is currently no way to identify which sockets speak Varlink. With user.* xattrs on sockets a service can label its socket with the IPC protocol it speaks (e.g., user.varlink=1) and an eBPF program can then selectively capture traffic on those sockets. Enumerating bound sockets via netlink combined with these xattr labels gives a way to discover all Varlink IPC entrypoints for debugging and introspection. Similarly, systemd-journald wants to use xattrs on the /dev/log socket for protocol negotiation to indicate whether RFC 5424 structured syslog is supported or whether only the legacy RFC 3164 format should be used. In containers these labels are particularly useful as high-privilege or more complicated solutions for socket identification aren't available. The series comes with comprehensive selftests covering path-based AF_UNIX sockets, sockfs socket operations, per-inode limit enforcement, and xattr operations across multiple address families (AF_INET, AF_INET6, AF_NETLINK, AF_PACKET). * patches from https://patch.msgid.link/20260216-work-xattr-socket-v1-0-c2efa4f74cb7@kernel.org: selftests/xattr: test xattrs on various socket families selftests/xattr: sockfs socket xattr tests selftests/xattr: path-based AF_UNIX socket xattr tests xattr: support extended attributes on sockets xattr,net: support limited amount of extended attributes on sockfs sockets xattr: move user limits for xattrs to generic infra xattr: switch xattr_permission() to switch statement xattr: add xattr_permission_error() xattr: remove rbtree-based simple_xattr infrastructure pidfs: adapt to rhashtable-based simple_xattrs kernfs: adapt to rhashtable-based simple_xattrs with lazy allocation shmem: adapt to rhashtable-based simple_xattrs with lazy allocation xattr: add rhashtable-based simple_xattr infrastructure xattr: add rcu_head and rhash_head to struct simple_xattr Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-0-c2efa4f74cb7@kernel.org Signed-off-by: Christian Brauner commit 0f1f4e4e1503e605f2189bfa10290d7b8920187c Author: Christian Brauner Date: Mon Feb 16 14:32:10 2026 +0100 selftests/xattr: test xattrs on various socket families Test user.* xattr operations on sockets from different address families: AF_INET, AF_INET6, AF_NETLINK, and AF_PACKET. All socket types use sockfs for their inodes, so user.* xattrs should work regardless of address family. Each fixture creates a socket (no bind needed) and verifies the full fsetxattr/fgetxattr/flistxattr/fremovexattr cycle. AF_INET6 skips if not supported; AF_PACKET skips if CAP_NET_RAW is unavailable. Also tests abstract namespace AF_UNIX sockets, which live in sockfs (not on a filesystem) and should support user.* xattrs. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-14-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 0e75aea0b52dc8918fed4db40b035b2ef2cded40 Author: Christian Brauner Date: Mon Feb 16 14:32:09 2026 +0100 selftests/xattr: sockfs socket xattr tests Test user.* extended attribute operations on sockfs sockets. Sockets created via socket() have their inodes in sockfs, which now supports user.* xattrs with per-inode limits. Tests fsetxattr/fgetxattr/flistxattr/fremovexattr operations including set/get, listing (verifies system.sockprotoname presence), remove, update, XATTR_CREATE/XATTR_REPLACE flags, empty values, size queries, and buffer-too-small errors. Also tests per-inode limit enforcement: maximum 128 xattrs, maximum 128KB total value size, limit recovery after removal, and independent limits across different sockets. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-13-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 7e28fef5d4db3a5e61cfcd4b09313933d16c0430 Author: Christian Brauner Date: Mon Feb 16 14:32:08 2026 +0100 selftests/xattr: path-based AF_UNIX socket xattr tests Test user.* extended attribute operations on path-based Unix domain sockets (SOCK_STREAM, SOCK_DGRAM, SOCK_SEQPACKET). Path-based sockets are bound to a filesystem path and their inodes live on the underlying filesystem (e.g. tmpfs). Covers set/get/list/remove, persistence, XATTR_CREATE/XATTR_REPLACE flags, empty values, size queries, buffer-too-small errors, O_PATH fd operations, and trusted.* xattr handling. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-12-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit dc0876b9846d3d48bb8528332106d1b051578a02 Author: Christian Brauner Date: Mon Feb 16 14:32:07 2026 +0100 xattr: support extended attributes on sockets Allow user.* extended attributes on sockets by adding S_IFSOCK to the xattr_permission() switch statement. Previously user.* xattrs were only permitted on regular files and directories. Symlinks and special files including sockets were rejected with -EPERM. Path-based AF_UNIX sockets have their inodes on the underlying filesystem (e.g. tmpfs) which already supports user.* xattrs through simple_xattrs. So for these the permission check was the only thing missing. For sockets in sockfs - everything created via socket() including abstract namespace AF_UNIX sockets - the preceding patch added simple_xattr storage with per-inode limits. With the permission check lifted here these sockets can now store user.* xattrs as well. This enables services to associate metadata with their sockets. For example, a service using Varlink for IPC can label its socket with user.varlink=1 allowing eBPF programs to selectively capture traffic and tools to discover IPC entrypoints by enumerating bound sockets via netlink. Similarly, protocol negotiation can be performed through xattrs such as indicating RFC 5424 structured syslog support on /dev/log. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-11-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit b6d6ab1b6dd2ead98f8915e47895ea4014ac3cb2 Author: Christian Brauner Date: Mon Feb 16 14:32:06 2026 +0100 xattr,net: support limited amount of extended attributes on sockfs sockets Now that we've generalized the infrastructure for user.* xattrs make it possible to set up to 128 user.* extended attributes on a sockfs inode or up to 128kib. kernfs (cgroupfs) has the same limits and it has proven to be quite sufficient for nearly all use-cases. This will allow containers to label sockets and will e.g., be used by systemd and Gnome to find various sockets in containers where high-privilege or more complicated solutions aren't available. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-10-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 4fbe9e78bb415dd632ff63a9f620af0be58ef820 Author: Christian Brauner Date: Mon Feb 16 14:32:05 2026 +0100 xattr: move user limits for xattrs to generic infra Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-9-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 8adddcb01e8f1009c0e4d4438d950d1bb794df46 Author: Christian Brauner Date: Mon Feb 16 14:32:04 2026 +0100 xattr: switch xattr_permission() to switch statement Simplify the codeflow by using a switch statement that switches on S_IFMT. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-8-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 3ec90ae54dadbff30fd041796d04eac7f0474887 Author: Christian Brauner Date: Mon Feb 16 14:32:03 2026 +0100 xattr: add xattr_permission_error() Stop repeating the ?: in multiple places and use a simple helper for this. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-7-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 25ab7b6f34c74ea555b4489b57f7219612991433 Author: Christian Brauner Date: Mon Feb 16 14:32:02 2026 +0100 xattr: remove rbtree-based simple_xattr infrastructure Now that all consumers (shmem, kernfs, pidfs) have been converted to use the rhashtable-based simple_xattrs with pointer-based lazy allocation, remove the legacy rbtree code path. The rhashtable implementation provides O(1) average-case lookup with RCU-based lockless reads, replacing the O(log n) rbtree with reader-writer spinlock contention. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-6-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 50704c391fbf11cf52faa27d46c3bb59da33a191 Author: Christian Brauner Date: Mon Feb 16 14:32:01 2026 +0100 pidfs: adapt to rhashtable-based simple_xattrs Adapt pidfs to use the rhashtable-based xattr path by switching from a dedicated slab cache to simple_xattrs_alloc(). Previously pidfs used a custom kmem_cache (pidfs_xattr_cachep) that allocated a struct containing an embedded simple_xattrs plus simple_xattrs_init(). Replace this with simple_xattrs_alloc() which combines kzalloc + rhashtable_init, and drop the dedicated slab cache entirely. Use simple_xattr_free_rcu() for replaced xattr entries to allow concurrent RCU readers to finish. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-5-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 5bd97f5c5f241a5610c4412d1b93995a26241f81 Author: Christian Brauner Date: Mon Feb 16 14:32:00 2026 +0100 kernfs: adapt to rhashtable-based simple_xattrs with lazy allocation Adapt kernfs to use the rhashtable-based xattr path and switch from an embedded struct to pointer-based lazy allocation. Change kernfs_iattrs.xattrs from embedded 'struct simple_xattrs' to a pointer 'struct simple_xattrs *', initialized to NULL (zeroed by kmem_cache_zalloc). Since kernfs_iattrs is already lazily allocated itself, this adds a second level of lazy allocation specifically for the xattr store. The xattr store is allocated on first setxattr. Read paths check for NULL and return -ENODATA or empty list. Replaced xattr entries are freed via simple_xattr_free_rcu() to allow concurrent RCU readers to finish. The cleanup paths in kernfs_free_rcu() and __kernfs_new_node() error handling conditionally free the xattr store only when allocated. As Jan noted in [1]: > This is a slight change in the lifetime rules because previously kernfs > xattrs could be safely accessed only under RCU but after this change you > have to hold inode reference *and* RCU to safely access them. I don't think > anybody would be accessing xattrs without holding inode reference so this > should be safe [...]. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-4-c2efa4f74cb7@kernel.org Link: https://lore.kernel.org/3cnmtqmakpbb2uwhenrj7kdqu3uefykiykjllgfbtpkiwhaa4s@sghkevv7jned [1] Acked-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 94d865739249c0b68b0046ea22e55b93fdf420c6 Author: Miri Korenblit Date: Mon Mar 2 09:11:46 2026 +0200 wifi: cfg80211: make cluster id an array cfg80211_nan_conf::cluster_id is currently a pointer, but there is no real reason to not have it an array. It makes things easier as there is no need to check the pointer validity each time. If a cluster ID wasn't provided by user space it will be randomized. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260302091108.2b12e4ccf5bb.Ib16bf5cca55463d4c89e18099cf1dfe4de95d405@changeid Signed-off-by: Johannes Berg commit 26e5e1be2e640a562618c1aa03ed15b62bfbf2d6 Author: Dinh Nguyen Date: Fri Jan 16 22:36:26 2026 -0600 fpga: bridge: Use sysfs_emit() instead of sprintf() According to Documentation/filesystems/sysfs.rst, show() functions should use sysfs_emit() when formatting the value to be returned to user space. This keeps consistent usage of sysfs_emit() across the same file. Signed-off-by: Dinh Nguyen [ Yilun: clarify the necessity of the change in changelog ] Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260117043626.2188219-1-dinguyen@kernel.org Signed-off-by: Xu Yilun commit b8a57b979a7c2069081ed0bf88a727b17d85ac96 Author: Kexin Sun Date: Sat Feb 28 14:19:44 2026 +0800 wifi: mac80211: update outdated comment The function ieee80211_start_scan() was refactored and replaced by __ieee80211_start_scan() in commit f3b85252f081 ("mac80211: fix scan races and rework scanning"). Update the comment in ieee80211_tx_h_check_assoc() accordingly. Additionally, remove the broken gmane.org link in the comment. Suggested-by: Lachlan Hodges Suggested-by: Johannes Berg Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun Link: https://patch.msgid.link/20260228061944.887-1-kexinsun@smail.nju.edu.cn Signed-off-by: Johannes Berg commit e91d8e8c735cba92737f2a2fb73eb70fe4221048 Author: Benoît Monin Date: Thu Feb 26 14:33:50 2026 +0100 pinctrl: eyeq5: Add Mobileye EyeQ6Lplus OLB Add the match data for the pinctrl found in the EyeQ6Lplus OLB. The pin control is identical in function to the one present in the EyeQ5 but has a single bank of 32 pins. Signed-off-by: Benoît Monin Signed-off-by: Linus Walleij commit 27a2ef20c0ae458d3dd6a19070dad662d0769001 Author: Benoît Monin Date: Thu Feb 26 14:33:49 2026 +0100 pinctrl: eyeq5: Use match data Instead of using the pin descriptions, pin functions and register offsets of the EyeQ5 directly, access those via a pointer to a newly introduced struct eq5p_match_data. This structure contains, in addition to the pin descriptions and pin functions, an array of pin banks. Each bank holds the number of pins and the register offsets. All functions accessing a pin now use a pointer to a bank structure and an offset inside that bank. The conversion from a pin number to a bank and an offset is done in the new function eq5p_pin_to_bank_offset(), which replace eq5p_pin_to_bank() and eq5p_pin_to_offset(). All the data related to the EyeQ5 is declared with the eq5p_eyeq5_ prefix to distinguish it from the common code. During the probe, we use the parent OF node to get the match data. We cannot directly use an OF node since pinctrl-eyeq5 is an auxiliary device of clk-eyeq. Signed-off-by: Benoît Monin Signed-off-by: Linus Walleij commit 061c39a17136376f368a6082d4948301641f7db1 Author: Elsanti Date: Sat Feb 28 18:23:44 2026 -0400 drivers/hwtracing/coresight: remove unneeded variable in tmc_crashdata_release() The variable 'ret' is initialized to 0, never modified, and returned directly. Remove it and return 0 explicitly. Signed-off-by: Elsanti Reviewed-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260228222344.288639-1-santiagojoseleal27@gmail.com commit fdfe3e72a228b74da21939c47ebd6f5ad4969d5f Author: Tzung-Bi Shih Date: Sat Feb 28 21:14:30 2026 +0800 gpio: Fix lockdep warnings in gpiolib_{cdev,sysfs}_register() A lockdep warning is reported in gpiolib-cdev driver: WARNING: drivers/gpio/gpiolib-cdev.c:2735 at gpiolib_cdev_register+0x114/0x140, CPU#1: swapper/0/1 Modules linked in: CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-rc1-next-20260227-00065-g6af4b9cfeded #12259 PREEMPT Hardware name: Samsung Exynos (Flattened Device Tree) Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x68/0x88 dump_stack_lvl from __warn+0x94/0x210 __warn from warn_slowpath_fmt+0x1b0/0x1bc warn_slowpath_fmt from gpiolib_cdev_register+0x114/0x140 gpiolib_cdev_register from gpiochip_setup_dev+0x4c/0xd0 gpiochip_setup_dev from gpiochip_add_data_with_key+0x960/0xad4 gpiochip_add_data_with_key from devm_gpiochip_add_data_with_key+0x20/0x5c This is because the SRCU wasn't held in gpiolib_cdev_register() when the caller is from gpiochip_add_data_with_key() instead of gpiochip_setup_devs(). gpiochip_sysfs_register() shares the similar concern. Given that both gpiolib_cdev_register() and gpiochip_sysfs_register() are only called from gpiolib but no external users. Remove the lockdep checks to fix the warnings. Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/506ce9b3-d492-4fce-9d02-330e411911e2@samsung.com/ Fixes: cf674f1a0c98 ("gpio: Ensure struct gpio_chip for gpiochip_setup_dev()") Signed-off-by: Tzung-Bi Shih Tested-by: Marek Szyprowski Link: https://patch.msgid.link/20260228131430.102388-1-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit bed80a08ff5e357ea722db10e2b552acf1ff7482 Author: Kavita Kavita Date: Fri Feb 27 00:25:53 2026 +0530 wifi: mac80211: Advertise IEEE 802.1X authentication support Advertise support for IEEE 802.1X authentication protocol directly from mac80211, without depending on driver indication of (Re)Association frame encryption capability. As specified in "IEEE P802.11bi/D4.0, clauses 12.16.5 and 12.16.8.2", IEEE 802.1X authentication can operate with or without (Re)Association frame encryption support. Therefore, mac80211 can safely advertise 802.1X support independently of driver capabilities. Signed-off-by: Kavita Kavita Link: https://patch.msgid.link/20260226185553.1516290-6-kavita.kavita@oss.qualcomm.com Signed-off-by: Johannes Berg commit 9347878b1513beee1a26bb249f5dc8326d450f75 Author: Kavita Kavita Date: Fri Feb 27 00:25:52 2026 +0530 wifi: mac80211: Add support for IEEE 802.1X authentication protocol in non-AP STA mode Add support for the IEEE 802.1X authentication protocol in non-AP STA mode, as specified in "IEEE P802.11bi/D4.0, 12.16.5". IEEE 802.1X authentication involves multiple Authentication frame exchanges, with the non-AP STA and AP alternating transaction sequence numbers. The number of Authentication frame exchanges depends on the EAP method in use. For IEEE 802.1X authentication, process only Authentication frames with the expected transaction sequence number. For IEEE 802.1X Authentication, Table 9-71 specifies that the Encapsulation Length field as specified in Clause 9.4.1.82 shall be present in all IEEE 802.1X Authentication frames. Drop the frame in the mac80211 if the Encapsulation Length field is missing. After receiving the final Authentication frame with status code WLAN_STATUS_8021X_AUTH_SUCCESS from the AP, mac80211 marks the state as authenticated, as it indicates the EAP handshake has completed successfully over the Authentication frames as specified in Clause 12.16.5. In the PMKSA caching case, only two Authentication frames are exchanged if the AP identifies a valid PMKSA, then as specified in Clause 12.16.8.3, the AP shall set the Status Code to WLAN_STATUS_SUCCESS in the final Authentication frame and must not include an encapsulated EAPOL PDU. This frame will be the final Authentication frame from the AP when PMKSA caching is enabled, and mac80211 marks the state as authenticated. In case of authentication success or failure, forward the Authentication frame to userspace(e.g. wpa_supplicant), and let userspace validate the Authentication frame from the AP as per the specification. Signed-off-by: Kavita Kavita Link: https://patch.msgid.link/20260226185553.1516290-5-kavita.kavita@oss.qualcomm.com Signed-off-by: Johannes Berg commit bd77375097357b46af00db1316ceab5e82ccbc8b Author: Kavita Kavita Date: Fri Feb 27 00:25:51 2026 +0530 wifi: cfg80211: add support for IEEE 802.1X Authentication Protocol Add an extended feature flag NL80211_EXT_FEATURE_IEEE8021X_AUTH to allow a driver to indicate support for the IEEE 802.1X authentication protocol in non-AP STA mode, as defined in "IEEE P802.11bi/D4.0, 12.16.5". In case of SME in userspace, the Authentication frame body is prepared in userspace while the driver finalizes the Authentication frame once it receives the required fields and elements. The driver indicates support for IEEE 802.1X authentication using the extended feature flag so that userspace can initiate IEEE 802.1X authentication. When the feature flag is set, process IEEE 802.1X Authentication frames from userspace in non-AP STA mode. If the flag is not set, reject IEEE 802.1X Authentication frames. Define a new authentication type NL80211_AUTHTYPE_IEEE8021X for IEEE 802.1X authentication. Signed-off-by: Kavita Kavita Link: https://patch.msgid.link/20260226185553.1516290-4-kavita.kavita@oss.qualcomm.com Signed-off-by: Johannes Berg commit 0e88342dbd0ee8088ca2d2ae8af319d3c2b627a8 Author: Kavita Kavita Date: Fri Feb 27 00:25:50 2026 +0530 wifi: mac80211: Advertise EPPKE support based on driver capabilities Advertise support for Enhanced Privacy Protection Key Exchange (EPPKE) authentication protocol in mac80211 when the driver supports (Re)Association frame encryption. Since EPPKE mandates (Re)Association frame encryption. Signed-off-by: Kavita Kavita Link: https://patch.msgid.link/20260226185553.1516290-3-kavita.kavita@oss.qualcomm.com Signed-off-by: Johannes Berg commit ae61f43df1a99734ef55d9b2fe54c1feda9bac98 Author: Kavita Kavita Date: Fri Feb 27 00:25:49 2026 +0530 wifi: mac80211_hwsim: Advertise support for (Re)Association frame encryption Advertise support for (Re)Association frame encryption in mac80211_hwsim for testing scenarios. Signed-off-by: Kavita Kavita Link: https://patch.msgid.link/20260226185553.1516290-2-kavita.kavita@oss.qualcomm.com Signed-off-by: Johannes Berg commit a536be923191e2662369ee87e5d7beb50946c71c Author: Sai Pratyusha Magam Date: Thu Feb 26 09:59:59 2026 +0530 wifi: mac80211: Fix AAD/Nonce computation for management frames with MLO Per IEEE Std 802.11be-2024, 12.5.2.3.3, if the MPDU is an individually addressed Data frame between an AP MLD and a non-AP MLD associated with the AP MLD, then A1/A2/A3 will be MLD MAC addresses. Otherwise, Al/A2/A3 will be over-the-air link MAC addresses. Currently, during AAD and Nonce computation for software based encryption/decryption cases, mac80211 directly uses the addresses it receives in the skb frame header. However, after the first authentication, management frame addresses for non-AP MLD stations are translated to MLD addresses from over the air link addresses in software. This means that the skb header could contain translated MLD addresses, which when used as is, can lead to incorrect AAD/Nonce computation. In the following manner, ensure that the right set of addresses are used: In the receive path, stash the pre-translated link addresses in ieee80211_rx_data and use them for the AAD/Nonce computations when required. In the transmit path, offload the encryption for a CCMP/GCMP key to the hwsim driver that can then ensure that encryption and hence the AAD/Nonce computations are performed on the frame containing the right set of addresses, i.e, MLD addresses if unicast data frame and link addresses otherwise. To do so, register the set key handler in hwsim driver so mac80211 is aware that it is the driver that would take care of encrypting the frame. Offload encryption for a CCMP/GCMP key, while keeping the encryption for WEP/TKIP and MMIE generation for a AES_CMAC or a AES_GMAC key still at the SW crypto in mac layer Co-developed-by: Rohan Dutta Signed-off-by: Rohan Dutta Signed-off-by: Sai Pratyusha Magam Link: https://patch.msgid.link/20260226042959.3766157-1-sai.magam@oss.qualcomm.com [only store and apply link_addrs for unicast non-data rather storing always and applying for !unicast_data] Signed-off-by: Johannes Berg commit 5249fcc0efef8c1cf179485773f104d39b636c82 Author: Rosen Penev Date: Mon Feb 23 13:40:04 2026 -0800 wifi: rt2x00: use generic nvmem_cell_get The library doesn't necessarily depend on OF. This codepath is used by both soc (OF only) and pci (no such requirement). After this, the only of specific function is of_get_mac_address, which is needed for nvmem. Signed-off-by: Rosen Penev Acked-by: Stanislaw Gruszka Link: https://patch.msgid.link/20260223214004.19960-1-rosenp@gmail.com Signed-off-by: Johannes Berg commit e098c26b3524b6a8087dfc8f664d7cc76d30ecc2 Author: Sriram R Date: Fri Feb 20 01:12:42 2026 +0530 wifi: mac80211: fetch unsolicited probe response template by link ID Currently, the unsolicited probe response template is always fetched from the default link of a virtual interface in both Multi-Link Operation (MLO) and non-MLO cases. However, in the MLO case there is a need to fetch the unsolicited probe response template from a specific link instead of the default link. Hence, add support for fetching the unsolicited probe response template based on the link ID from the corresponding link data. Signed-off-by: Sriram R Co-developed-by: Raj Kumar Bhagat Signed-off-by: Raj Kumar Bhagat Link: https://patch.msgid.link/20260220-fils-prob-by-link-v1-2-a2746a853f75@oss.qualcomm.com Signed-off-by: Johannes Berg commit 0495b64132154dd04ed5d443bb35afd3769a13a6 Author: Sriram R Date: Fri Feb 20 01:12:41 2026 +0530 wifi: mac80211: fetch FILS discovery template by link ID Currently, the FILS discovery template is always fetched from the default link of a virtual interface in both Multi-Link Operation (MLO) and non-MLO cases. However, in the MLO case there is a need to fetch the FILS discovery template from a specific link instead of the default link. Hence, add support for fetching the FILS discovery template based on the link ID from the corresponding link data. Signed-off-by: Sriram R Co-developed-by: Raj Kumar Bhagat Signed-off-by: Raj Kumar Bhagat Link: https://patch.msgid.link/20260220-fils-prob-by-link-v1-1-a2746a853f75@oss.qualcomm.com Signed-off-by: Johannes Berg commit a34951ef56b0fc2ce2feff32a1ac71dbd8e3b998 Author: Miri Korenblit Date: Thu Feb 19 11:47:15 2026 +0200 wifi: nl80211: don't allow DFS channels for NAN NAN cannot use DFS channels. Mark DFS channels as unusable if the chandef is to be used for NAN. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260108102921.c2a5a0a14b9f.Idca29fb8a235df980e63b733a298fd1f2bdf2f48@changeid Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219094725.3846371-3-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit 9e2f7f4a2c0ac937ab9dbadc9dc5db9f72d83616 Author: Miri Korenblit Date: Thu Feb 19 11:47:14 2026 +0200 wifi: cfg80211: refactor wiphy_suspend The sequence of operations that needs to be done in wiphy_suspend is identical for the case where there is no wowlan configured, and for the case that it is but the driver refused to do wowlan (by returning 1 from rdev_suspend). The current code duplicates this set of operations for each one of the cases. In particular, next patch will change the locking of cfg80211_leave_all to not hold the wiphy lock, which will be easier to do if it is not called twice. Change the code to handle first the case that wowlan is configured, and then handle both cases (driver refused to do wowlan and no wowlan configured) in one place. Note that this changes the behaviour to set suspended=true also when we were not registered yet, but that makes sense anyway, as wiphy works can be queued also before registration. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260108102921.00336669ac32.Id76f272662e1315cd93a628808cc2d1625036b00@changeid Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219094725.3846371-2-miriam.rachel.korenblit@intel.com Signed-off-by: Johannes Berg commit 033fe322f5852d5144a85978e880e01b1787fd0d Author: Miri Korenblit Date: Thu Feb 19 11:47:13 2026 +0200 wifi: nl80211/cfg80211: support stations of non-netdev interfaces Currently, a station can only be added to a netdev interface, mainly because there was no need for a station of a non-netdev interface. But for NAN, we will have stations that belong to the NL80211_IFTYPE_NAN interface. Prepare for adding/changing/deleting a station that belongs to a non-netdev interface. This doesn't actually allow such stations - this will be done in a different patch. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219114327.65c9cc96f814.Ic02066b88bb8ad6b21e15cbea8d720280008c83b@changeid Signed-off-by: Johannes Berg commit 137b61fdfc989a66db1831ac05edee613323552f Author: Miri Korenblit Date: Thu Feb 19 11:47:12 2026 +0200 wifi: cfg80211: remove unneeded call to cfg80211_leave In cfg80211_destroy_ifaces, we first close all netdev wdevs, which will trigger a NETDEV_GOING_DOWN event that will call cfg80211_leave, and for non-netdev wdevs, we call cfg80211_remove_virtual_intf which calles cfg80211_unregister_wdev, which handles the "leaving" for those interfaces (i.e. stop_nan and stop_p2p_device) Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219114327.c43709c9d3af.I3179a28f237ea3b8ec368af720fbf77455a7763f@changeid Signed-off-by: Johannes Berg commit 49a1e65c6d706703a8fcd54a5c5ca1f11f7e319b Author: Miri Korenblit Date: Thu Feb 19 11:47:11 2026 +0200 wifi: nl80211: refactor nl80211_parse_chandef In order to be able to use this function also for nested attributes, change this function to receive a pointer to extack and to the attributes array, instead of receiving the info and extracting them out of it. While at it, use NL_SET_ERR_MSG_ATTR with the frequency of the chandef. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260219114327.2b994566a63b.I6c2b6f4c7e2e09f4c47285ca4ac8a37b20700e19@changeid Signed-off-by: Johannes Berg commit abf37167e78f87c131a1de22ba1bd1cdc81a131f Author: Gustavo A. R. Silva Date: Mon Feb 16 18:25:14 2026 +0900 wifi: iwlegacy: Avoid multiple -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declarations (which in a couple of cases happen to be in a union, so the entire unions are moved) to the end of the corresponding structures, struct il_frame, and struct il3945_frame. Notice that `struct il_tx_beacon_cmd`, `struct il4965_tx_resp`, and `struct il3945_tx_beacon_cmd` are flexible structures, this is structures that contain a flexible-array member. The case for struct il4965_beacon_notif is different. Since this structure is defined by hardware, we create the new `struct il4965_tx_resp_hdr` type. We then use this newly created type to replace the object type causing trouble in struct il4965_beacon_notif, namely `struct il4965_tx_resp`. Also, once -fms-extensions is enabled, we can use transparent struct members in struct il4965_tx_resp. Notice that the newly created type does not contain the flex-array member `agg_status`, which is the object causing the -Wfamnae warnings. This object is currently in a union along with `__le32 status`, so anything using struct il4965_beacon_notif needs to have its own view of `status`. To preserve the memory layout, we therefore add member `__le32 beacon_tx_status` to struct il4965_beacon_notif. After these changes, the size of struct il4965_beacon_notif along with its member's offsets remain the same, hence the memory layout doesn't change: Before changes: struct il4965_beacon_notif { struct il4965_tx_resp beacon_notify_hdr; /* 0 24 */ __le32 low_tsf; /* 24 4 */ __le32 high_tsf; /* 28 4 */ __le32 ibss_mgr_status; /* 32 4 */ /* size: 36, cachelines: 1, members: 4 */ /* last cacheline: 36 bytes */ }; After changes: struct il4965_beacon_notif { struct il4965_tx_resp_hdr beacon_notify_hdr; /* 0 20 */ __le32 beacon_tx_status; /* 20 4 */ __le32 low_tsf; /* 24 4 */ __le32 high_tsf; /* 28 4 */ __le32 ibss_mgr_status; /* 32 4 */ /* size: 36, cachelines: 1, members: 5 */ /* last cacheline: 36 bytes */ }; Lastly, adjust the rest of the code, accordingly. With these changes fix the following warnings: 11 drivers/net/wireless/intel/iwlegacy/common.h:526:11: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] 11 drivers/net/wireless/intel/iwlegacy/commands.h:2667:31: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] 4 drivers/net/wireless/intel/iwlegacy/3945.h:131:11: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Acked-by: Stanislaw Gruszka Link: https://patch.msgid.link/aZLienEatf9KC6Rx@kspp Signed-off-by: Johannes Berg commit 6a584e336cefb230e2d981a464f4d85562eb750c Author: Hari Chandrakanthan Date: Mon Feb 16 08:50:26 2026 +0530 wifi: cfg80211: add support to handle incumbent signal detected event from mac80211/driver When any incumbent signal is detected by an AP/mesh interface operating in 6 GHz band, FCC mandates the AP/mesh to vacate the channels affected by it [1]. Add a new API cfg80211_incumbent_signal_notify() that can be used by mac80211 or drivers to notify the higher layers about the signal interference event with the interference bitmap in which each bit denotes the affected 20 MHz in the operating channel. Add support for the new nl80211 event and nl80211 attribute as well to notify userspace on the details about the interference event. Userspace is expected to process it and take further action - vacate the channel, or reduce the bandwidth. [1] - https://apps.fcc.gov/kdb/GetAttachment.html?id=nXQiRC%2B4mfiA54Zha%2BrW4Q%3D%3D&desc=987594%20D02%20U-NII%206%20GHz%20EMC%20Measurement%20v03&tracking_number=277034 Signed-off-by: Hari Chandrakanthan Signed-off-by: Amith A Link: https://patch.msgid.link/20260216032027.2310956-2-amith.a@oss.qualcomm.com Signed-off-by: Johannes Berg commit f3f52e6f20ac875ebbef6bd3a235a06d9c4d3fa0 Author: Suraj P Kizhakkethil Date: Fri Feb 13 15:31:26 2026 +0530 wifi: mac80211: Set link ID for NULL packets sent to probe stations Currently, for AP MLD, the link ID is not provided when a NULL packet is triggered to probe a station. For non-MLO stations connected to an AP MLD, use the station's default link to send the NULL packets and set addr2 and addr3 to the link address. For MLO stations, set the link ID to unspecified to let the driver select the appropriate link. Co-developed-by: Sriram R Signed-off-by: Sriram R Co-developed-by: Rameshkumar Sundaram Signed-off-by: Rameshkumar Sundaram Signed-off-by: Suraj P Kizhakkethil Link: https://patch.msgid.link/20260213100126.1414398-3-suraj.kizhakkethil@oss.qualcomm.com [init link_id in each branch instead of default to zero] Signed-off-by: Johannes Berg commit 73e7df69edb6f1271ea0fa876794761e6c73e76a Author: Suraj P Kizhakkethil Date: Fri Feb 13 15:31:25 2026 +0530 wifi: mac80211: set band information only for non-MLD when probing stations using NULL frame Currently, when sending a NULL frame to probe a station, the band information is derived from the chanctx_conf in the mac80211 vif's bss_conf. However, for AP MLD, chanctx_conf is not assigned to the vif's bss_conf; instead it is assigned on a per-link basis. As a result, for AP MLD, sending a NULL packet to probe will trigger a warning. WARNING: net/mac80211/cfg.c:4635 at ieee80211_probe_client+0x1a8/0x1d8 [mac80211], CPU#2: hostapd/244 Call trace: ieee80211_probe_client+0x1a8/0x1d8 [mac80211] (P) nl80211_probe_client+0xac/0x170 [cfg80211] genl_family_rcv_msg_doit+0xc8/0x134 genl_rcv_msg+0x200/0x280 netlink_rcv_skb+0x38/0xf0 genl_rcv+0x34/0x48 netlink_unicast+0x314/0x3a0 netlink_sendmsg+0x150/0x390 ____sys_sendmsg+0x1f4/0x21c ___sys_sendmsg+0x98/0xc0 __sys_sendmsg+0x74/0xcc __arm64_sys_sendmsg+0x20/0x34 invoke_syscall.constprop.0+0x4c/0xd0 do_el0_svc+0x3c/0xd0 el0_svc+0x28/0xc0 el0t_64_sync_handler+0x98/0xdc el0t_64_sync+0x154/0x158 ---[ end trace 0000000000000000 ]--- For NULL packets sent to probe stations, set the band information only for non-MLD, since MLD transmissions does not rely on band. Signed-off-by: Suraj P Kizhakkethil Link: https://patch.msgid.link/20260213100126.1414398-2-suraj.kizhakkethil@oss.qualcomm.com Signed-off-by: Johannes Berg commit ae5e95d4157481693be2317e3ffcd84e36010cbb Author: Daniel Hodges Date: Fri Feb 6 14:44:01 2026 -0500 wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() The mwifiex_adapter_cleanup() function uses timer_delete() (non-synchronous) for the wakeup_timer before the adapter structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If the wakeup_timer callback (wakeup_timer_fn) is executing when mwifiex_adapter_cleanup() is called, the callback will continue to access adapter fields (adapter->hw_status, adapter->if_ops.card_reset, etc.) which may be freed by mwifiex_free_adapter() called later in the mwifiex_remove_card() path. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning. Fixes: 4636187da60b ("mwifiex: add wakeup timer based recovery mechanism") Cc: stable@vger.kernel.org Signed-off-by: Daniel Hodges Link: https://patch.msgid.link/20260206194401.2346-1-git@danielhodges.dev Signed-off-by: Johannes Berg commit 668b233b7a3e50815ff79798236780bedf8b2aae Author: Janusz Dziedzic Date: Fri Feb 6 18:15:51 2026 +0100 wifi: mac80211_hwsim: background CAC support Report background CAC support and add allow to cancel background CAC and simulate radar. echo cancel > /sys/kernel/debug/ieee80211/phy2/hwsim/dfs_background_cac echo radar > /sys/kernel/debug/ieee80211/phy2/hwsim/dfs_background_cac Signed-off-by: Janusz Dziedzic Link: https://patch.msgid.link/20260206171830.553879-5-janusz.dziedzic@gmail.com Signed-off-by: Johannes Berg commit 68b908b3c83b29442cc80266fc2146ca01d15dd1 Author: Janusz Dziedzic Date: Fri Feb 6 18:15:50 2026 +0100 wifi: cfg80211: events, report background radar In case we report radar event add also information this is connected with background one, so user mode application like hostapd, could check it and behave correctly. Signed-off-by: Janusz Dziedzic Link: https://patch.msgid.link/20260206171830.553879-4-janusz.dziedzic@gmail.com Signed-off-by: Johannes Berg commit d69cb039ab1930706428566caf5a714d0cb3ed3d Author: Janusz Dziedzic Date: Fri Feb 6 18:15:49 2026 +0100 wifi: cfg80211: set and report chandef CAC ongoing Allow to track and check CAC state from user mode by simple check phy channels eg. using iw phy1 channels command. This is done for regular CAC and background CAC. It is important for background CAC while we can start it from any app (eg. iw or hostapd). Signed-off-by: Janusz Dziedzic Link: https://patch.msgid.link/20260206171830.553879-3-janusz.dziedzic@gmail.com Signed-off-by: Johannes Berg commit 92fecd2744552702285fe4e31ab9cb31a59e7391 Author: Janusz Dziedzic Date: Fri Feb 6 18:15:48 2026 +0100 wifi: cfg80211: fix background CAC Fix: - Send CAC_ABORT event when background CAC is canceled - Cancel CAC done workqueue when radar is detected - Release background wdev ownership when CAC is aborted or passed - Clean lower layer background radar state when CAC is aborted or passed - Prevent sending abort event when radar event is sent Signed-off-by: Janusz Dziedzic Link: https://patch.msgid.link/20260206171830.553879-2-janusz.dziedzic@gmail.com Signed-off-by: Johannes Berg commit 6a7084102bb9659f699005c420eb59eade6d3b4f Author: Krishna Chaitanya Chundru Date: Fri Jan 23 17:16:17 2026 +0530 bus: mhi: host: pci_generic: Add Qualcomm SDX35 modem Add support for sdx35 modem. Similar to SDX75, SDX35 can take longer to transition to ready during power up, so use modem_qcom_v2_mhiv_config configurations. 01:00.0 Unassigned class [ff00]: Qualcomm Device 011a Subsystem: Qualcomm Device 011a Signed-off-by: Krishna Chaitanya Chundru Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260123-mhi_sdx35-v1-1-79440abf0c92@oss.qualcomm.com commit 990a73dec3fdc145fef6c827c29205437d533ece Author: Zilin Guan Date: Mon Jan 19 09:26:25 2026 +0000 wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() In mwifiex_11n_aggregate_pkt(), skb_aggr is allocated via mwifiex_alloc_dma_align_buf(). If mwifiex_is_ralist_valid() returns false, the function currently returns -1 immediately without freeing the previously allocated skb_aggr, causing a memory leak. Since skb_aggr has not yet been queued via skb_queue_tail(), no other references to this memory exist. Therefore, it has to be freed locally before returning the error. Fix this by calling mwifiex_write_data_complete() to free skb_aggr before returning the error status. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by: Zilin Guan Reviewed-by: Jeff Chen Link: https://patch.msgid.link/20260119092625.1349934-1-zilin@seu.edu.cn Signed-off-by: Johannes Berg commit 21f6bcdf2be72e750dbe430b7227a66763a58466 Merge: 11439c4635edd6 2622649ad6cdbb Author: Dave Airlie Date: Mon Mar 2 16:57:26 2026 +1000 Merge tag 'drm-misc-next-2026-02-26' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.1: UAPI Changes: connector: - Add panel_type property fourcc: - Add ARM interleaved 64k modifier nouveau: - Query Z-Cull info with DRM_IOCTL_NOUVEAU_GET_ZCULL_INFO Cross-subsystem Changes: coreboot: - Clean up coreboot framebuffer support dma-buf: - Provide revoke mechanism for shared buffers - Rename move_notify callback to invalidate_mappings and update users. - Always enable move_notify - Support dma_fence_was_initialized() test - Protect dma_fence_ops by RCU and improve locking - Fix sparse warnings Core Changes: atomic: - Allocate drm_private_state via callback and convert drivers atomic-helper: - Use system_percpu_wq buddy: - Make buddy allocator available to all DRM drivers - Document flags and structures colorop: - Add destroy helper and convert drivers fbdev-emulation: - Clean up gem: - Fix drm_gem_objects_lookup() error cleanup Driver Changes: amdgpu: - Set panel_type to OELD for eDP atmel-hlcdc: - Support sana5d65 LCD controller bridge: - anx7625: Support USB-C plus DT bindings - connector: Fix EDID detection - dw-hdmi-qp: Support Vendor-Specfic and SDP Infoframes; improve others - fsl-ldb: Fix visual artifacts plus related DT property 'enable-termination-resistor' - imx8qxp-pixel-link: Improve bridge reference handling - lt9611: Support Port-B-only input plus DT bindings - tda998x: Support DRM_BRIDGE_ATTACH_NO_CONNECTOR; Clean up - Support TH1520 HDMI plus DT bindings - Clean up imagination: - Clean up komeda: - Fix integer overflow in AFBC checks mcde: - Improve bridge handling nouveau: - Provide Z-cull info to user space - gsp: Support GA100 - Shutdown on PCI device shutdown - Clean up panel: - panel-jdi-lt070me05000: Use mipi-dsi multi functions - panel-edp: Support Add AUO B116XAT04.1 (HW: 1A); Support CMN N116BCL-EAK (C2); Support FriendlyELEC plus DT changes - Fix Kconfig dependencies panthor: - Add tracepoints for power and IRQs rcar-du: - dsi: fix VCLK calculation rockchip: - vop2: Use drm_ logging functions - Support DisplayPort on RK3576 sysfb: - corebootdrm: Support system framebuffer on coreboot firmware; detect orientation - Clean up pixel-format lookup sun4i: - Clean up tilcdc: - Use DT bindings scheme - Use managed DRM interfaces - Support DRM_BRIDGE_ATTACH_NO_CONNECTOR - Clean up a lot of obsolete code v3d: - Clean up vc4: - Use system_percpu_wq - Clean up verisilicon: - Support DC8200 plus DT bindings virtgpu: - Support PRIME imports with enabled 3D Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20260226143615.GA47200@linux.fritz.box commit 59b03d12b1f6d14d936a3ebec225f8d914dc3b70 Author: Rene Sapiens Date: Fri Feb 6 16:25:57 2026 -0800 thunderbolt: Disable CLx on Titan Ridge-based devices with old firmware Thunderbolt 3 devices based on Titan Ridge routers with NVM firmware version < 0x65 have been observed to become unstable when CL states are enabled. This can lead to link disconnect events and the device failing to enumerate. Enable CLx on Titan Ridge only when the running NVM firmware version is >= 0x65. Signed-off-by: Rene Sapiens Signed-off-by: Mika Westerberg commit 4573add760b8dd52a215fd134effb76da10ebcf5 Author: Rene Sapiens Date: Fri Feb 6 16:25:56 2026 -0800 thunderbolt: Read router NVM version before applying quirks The router NVM version is currently only available after the NVMem devices have been registered. This is too late for firmware-dependent quirks that are evaluated during tb_switch_add() before device registration. Split router NVM handling into two phases: - tb_switch_nvm_init() allocates the NVM object and reads the version - tb_switch_nvm_add() registers the NVMem devices using the pre-read NVM This makes the NVM major/minor version available before tb_check_quirks() without changing when the NVMem devices are registered. Signed-off-by: Rene Sapiens Signed-off-by: Mika Westerberg commit 36bfc3642b19a98f1302aed4437c331df9b481f0 Author: Daniel Hodges Date: Fri Feb 6 15:05:29 2026 -0500 PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete pci_epf_mhi_edma_read() and pci_epf_mhi_edma_write() start DMA operations and wait for completion with a timeout. On successful completion, they previously returned the remaining timeout, which callers may treat as an error. In particular, mhi_ep_ring_add_element(), which calls pci_epf_mhi_edma_write() via mhi_cntrl->write_sync(), interprets any non-zero return value as failure. Return 0 on success instead of the remaining timeout to prevent mhi_ep_ring_add_element() from treating successful completion as an error. Fixes: 7b99aaaddabb ("PCI: epf-mhi: Add eDMA support") Signed-off-by: Daniel Hodges [mani: changed commit log as per https://lore.kernel.org/linux-pci/20260227191510.GA3904799@bhelgaas] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Krishna Chaitanya Chundru Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260206200529.10784-1-git@danielhodges.dev commit 34b4fc44e4f904fbb81335d53163ffdcb0180000 Author: Bard Liao Date: Wed Feb 25 21:50:04 2026 +0800 ASoC: soc_sdw_utils: remove index from sdca codec name The index is not fixed and it will lead to the DAI link can't bind the codec component with the name when the index is different from the predefined one. Signed-off-by: Bard Liao Reviewed-by: Charles Keepax Reviewed-by: Péter Ujfalusi Link: https://patch.msgid.link/20260225135004.2322987-4-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit c5ae3d8bc968a28aaeefbb772ec42e50cf3a15f0 Author: Bard Liao Date: Wed Feb 25 21:50:03 2026 +0800 ASoC: soc_sdw_utils: partial match the codec name Currently, we can set codec name in the dai info which will be set as the codec component name in a DAI link. However, the codec name may not be fixed. For example, there is an index in a SDCA codec name and that is not fixed. Lookup the fixed codec name string from the component list to get the right component name to ensure the DAI link will bind to the right codec component. Signed-off-by: Bard Liao Reviewed-by: Charles Keepax Reviewed-by: Péter Ujfalusi Link: https://patch.msgid.link/20260225135004.2322987-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 98eb42c7de6b0185c914df4cca61b49ff76821ee Author: Bard Liao Date: Wed Feb 25 21:50:02 2026 +0800 ASoC: add snd_soc_lookup_component_by_name helper Add a helper to help user to get the component by name. Signed-off-by: Bard Liao Reviewed-by: Charles Keepax Reviewed-by: Péter Ujfalusi Link: https://patch.msgid.link/20260225135004.2322987-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 17c6bf433742e0c1ff5ce175145877c0194e4a7a Author: Ricardo Rivera-Matos Date: Tue Feb 24 16:18:08 2026 +0000 ASoC: cs35l45: Hibernate wm_adsp on runtime suspend When the CS35L45 driver suspends, it is put into hibernation, and the regmap goes into cache_only, but the firmware is still running, and wm_adsp is not stopped. If userspace attempts to read a firmware control, it will perform a regmap_raw_read() and this will produce an error in the kernel log. To prevent spurious errors, put the DSP into hibernation which prevents access to the hardware for the ALSA controls. Signed-off-by: Ricardo Rivera-Matos Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20260224161821.93365-5-sbinding@opensource.cirrus.com Signed-off-by: Mark Brown commit 4d80c0dbcda551b8b86ff14c6ae93026993970b2 Author: Stefan Binding Date: Tue Feb 24 16:18:07 2026 +0000 ASoC: cs35l41: Hibernate wm_adsp on runtime suspend When the CS35L41 driver suspends, it is put into hibernation, and the regmap goes into cache_only, but the firmware is still running, and wm_adsp is not stopped. If userspace attempts to read a firmware control, it will perform a regmap_raw_read() and this will produce an error in the kernel log. To prevent spurious errors, put the DSP into hibernation which prevents access to the hardware for the ALSA controls. Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20260224161821.93365-4-sbinding@opensource.cirrus.com Signed-off-by: Mark Brown commit 6394a52c90c4abd10c8265983ec1f53207cd283e Author: Stefan Binding Date: Tue Feb 24 16:18:06 2026 +0000 ASoC: codecs: wm_adsp: Allow wm_adsp to hibernate without stopping DSP Some parts do not stop the DSP core before runtime suspend, however, this leaves the DSP controls enabled and accessible whilst the part is suspended and the regmap is cache_only. Add new APIs to allow for the DSP to hibernate when the part is suspended, and the DSP is not shut down. Signed-off-by: Stefan Binding Reviewed-by: Richard Fitzgerald Link: https://patch.msgid.link/20260224161821.93365-3-sbinding@opensource.cirrus.com Signed-off-by: Mark Brown commit 73942a6ea26bd7e02b7c260b8b7aa942397be894 Author: Stefan Binding Date: Tue Feb 24 16:18:05 2026 +0000 firmware: cs_dsp: Add API to hibernate the DSP For some parts, the DSP is kept running when in low power mode (hibernation), leaving the firmware ALSA controls enabled, but the registers are inaccessible. Attempts to access volatile firmware controls whilst in this state would produce errors in the kernel log due to a regmap_raw_read() into DSP registers whilst the regmap is in cache_only. To remove this error log, add a hibernating flag to indicate that the controls are inaccessible, so we no longer try to read or write to the registers whilst the regmap is in cache_only. This would still produce an error when trying to read or write to these controls, but this would be a different error (-EPERM instead of -EBUSY), and would not produce a spurious error log in the kernel. Upon wake from hibernation, the control caches are re-synced to the hardware, if the DSP is running. Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20260224161821.93365-2-sbinding@opensource.cirrus.com Reviewed-by: Richard Fitzgerald Signed-off-by: Mark Brown commit 06dba254de95b16e7793224d29daa5195de2e581 Author: Svyatoslav Ryhel Date: Mon Feb 23 08:50:51 2026 +0200 ASoC: dt-bindings: nvidia,tegra-audio-max9808x: document additional board pins Document additional board pins that may be used in routing. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223065051.13070-6-clamor95@gmail.com Signed-off-by: Mark Brown commit 536ffa105e16ca3f6e7de53f9d6059f53d0207f7 Author: Jonas Schwöbel Date: Mon Feb 23 08:50:50 2026 +0200 ASoC: tegra: Support WM8962 by machine driver Add Wolfson Microelectronics WM8962 codec support to the Tegra ASoC machine driver. The WM8962 codec is found on devices like Microsoft Surface RT and Microsoft Surface 2 Windows RT based tablets. Co-developed-by: Svyatoslav Ryhel Signed-off-by: Svyatoslav Ryhel Signed-off-by: Jonas Schwöbel Link: https://patch.msgid.link/20260223065051.13070-5-clamor95@gmail.com Signed-off-by: Mark Brown commit 79d73f5a0b7a702a19189c1a237ae3728d88de59 Author: Svyatoslav Ryhel Date: Mon Feb 23 08:50:49 2026 +0200 ASoC: dt-bindings: nvidia,tegra-audio: document WM8962 CODEC Add dt-binding for WM8962 CODEC. Signed-off-by: Svyatoslav Ryhel Link: https://patch.msgid.link/20260223065051.13070-4-clamor95@gmail.com Signed-off-by: Mark Brown commit a34547b389a91bf0709f0901c3752ccaf63730cd Author: Svyatoslav Ryhel Date: Mon Feb 23 08:50:48 2026 +0200 ASoC: tegra: Support CPCAP by machine driver Add CPCAP codec support to the Tegra ASoC machine driver. This codec is found in Motorola T20 devices like Atrix 4G and Droid X2. Signed-off-by: Svyatoslav Ryhel Link: https://patch.msgid.link/20260223065051.13070-3-clamor95@gmail.com Signed-off-by: Mark Brown commit d6b634cbc2eed73497877c95a7807d0f34fa4459 Author: Svyatoslav Ryhel Date: Mon Feb 23 08:50:47 2026 +0200 ASoC: dt-bindings: nvidia,tegra-audio: document CPCAP CODEC Add dt-binding for CPCAP CODEC. Signed-off-by: Svyatoslav Ryhel Link: https://patch.msgid.link/20260223065051.13070-2-clamor95@gmail.com Signed-off-by: Mark Brown commit 1696fad8b259a2d46e51cd6e17e4bcdbe02279fa Author: Sander Vanheule Date: Fri Feb 20 16:26:34 2026 +0100 ASoC: sti: use managed regmap_field allocations The regmap_field objects allocated at player init are never freed and may leak resources if the driver is removed. Switch to devm_regmap_field_alloc() to automatically limit the lifetime of the allocations the lifetime of the device. Fixes: 76c2145ded6b ("ASoC: sti: Add CPU DAI driver for playback") Signed-off-by: Sander Vanheule Link: https://patch.msgid.link/20260220152634.480766-3-sander@svanheule.net Signed-off-by: Mark Brown commit 272aabef50bc3fe58edd26de000f4cdd41bdbe60 Author: Sander Vanheule Date: Fri Feb 20 16:26:33 2026 +0100 ASoC: sti: Return errors from regmap_field_alloc() When regmap_field_alloc() fails, it can return an error. Specifically, it will return PTR_ERR(-ENOMEM) when the allocation returns a NULL pointer. The code then uses these allocations with a simple NULL check: if (player->clk_sel) { // May dereference invalid pointer (-ENOMEM) err = regmap_field_write(player->clk_sel, ...); } Ensure initialization fails by forwarding the errors from regmap_field_alloc(), thus avoiding the use of the invalid pointers. Fixes: 76c2145ded6b ("ASoC: sti: Add CPU DAI driver for playback") Signed-off-by: Sander Vanheule Link: https://patch.msgid.link/20260220152634.480766-2-sander@svanheule.net Signed-off-by: Mark Brown commit 309d8808eef93d29b65ae69241a4475b2c8bd6fe Merge: f620af11c27b8e eb71ab2bf72260 Author: Alexei Starovoitov Date: Sun Mar 1 09:03:45 2026 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf before 7.0-rc2 Cross-merge BPF and other fixes after downstream PR. No conflicts. Signed-off-by: Alexei Starovoitov commit d3b693a13b39bce16e284e1c737874966b3a96de Author: Randy Dunlap Date: Sat Feb 28 17:47:43 2026 -0800 spi: spi-mem: clean up kernel-doc in spi-mem.h Eliminate all kernel-doc warnings in spi-mem.h: - add missing struct member descriptions - don't use "struct" for function descrptions Warning: include/linux/spi/spi-mem.h:202 struct member 'cmd' not described in 'spi_mem_op' Warning: include/linux/spi/spi-mem.h:202 struct member 'addr' not described in 'spi_mem_op' Warning: include/linux/spi/spi-mem.h:202 struct member 'dummy' not described in 'spi_mem_op' Warning: include/linux/spi/spi-mem.h:202 struct member 'data' not described in 'spi_mem_op' Warning: include/linux/spi/spi-mem.h:286 Incorrect use of kernel-doc format: * struct spi_mem_get_drvdata() - get driver private data attached to a SPI mem Warning: include/linux/spi/spi-mem.h:298 Incorrect use of kernel-doc format: * struct spi_controller_mem_ops - SPI memory operations Warning: include/linux/spi/spi-mem.h:362 expecting prototype for struct spi_mem_set_drvdata. Prototype was for struct spi_controller_mem_ops instead Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260301014743.3133167-1-rdunlap@infradead.org Signed-off-by: Mark Brown commit da37bfe76b5b4ccc01ed8132215098e20d78e5f3 Author: Shengjiu Wang Date: Wed Feb 25 18:09:07 2026 +0800 ASoC: cs42xx8: add error checks for constraints in TDM mode In the TDM format the ADC and DAC serial ports will only operate as a slave, the sysclk should not be less than 256FS and Quad-Speed Mode (100 to 200 kHz sample rates) is not supported by ADC. So add error checks for these constraints. Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260225100907.686470-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 6ca4bcc23ae86a1330e5347ae9eb6c5d0cb690ab Author: Joel Fernandes Date: Tue Feb 24 17:53:00 2026 -0500 gpu: nova-core: Kconfig: Sort select statements alphabetically Reorder the select statements in NOVA_CORE Kconfig to be in alphabetical order. Suggested-by: Danilo Krummrich Signed-off-by: Joel Fernandes Link: https://patch.msgid.link/20260224225323.3312204-3-joelagnelf@nvidia.com [acourbot@nvidia.com: fix conflict due to patch reordering.] Signed-off-by: Alexandre Courbot commit bfd61205aca379121b1913885d4d06c51857119b Author: Jun Yan Date: Thu Feb 5 23:07:30 2026 +0800 dt-bindings: iio: gyroscope: bosch,bmg160: add bmx055 gyroscope binding Add the device-tree binding for the bosch BMX055 IMU (gyroscope part), which is compatible with bmg160. Datasheet: https://cdn.sparkfun.com/assets/b/9/1/f/4/bst-bmx055-ds000_datasheet.pdf Signed-off-by: Jun Yan Reviewed-by: Linus Walleij Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit e1d2445bb01eb113105d7dce598785a915391e66 Author: Jun Yan Date: Thu Feb 5 23:07:29 2026 +0800 dt-bindings: iio: magnetometer: bosch,bmc150_magn: add bmx055 magnetometer binding Add the device-tree binding for the bosch BMX055 IMU (magnetometer part), which is compatible with bmc150_magn. Datasheet: https://cdn.sparkfun.com/assets/b/9/1/f/4/bst-bmx055-ds000_datasheet.pdf Signed-off-by: Jun Yan Reviewed-by: Linus Walleij Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit 3712dd05dc77b2329bcc0a5ce81fbe9e6603a22c Author: Jun Yan Date: Thu Feb 5 23:07:28 2026 +0800 dt-bindings: iio: accel: bosch,bma255: add bmx055 accel binding Add the device-tree binding for the Bosch BMX055 IMU (accelerometer part), which is compatible with bmc150_accel. Datasheet: https://cdn.sparkfun.com/assets/b/9/1/f/4/bst-bmx055-ds000_datasheet.pdf Signed-off-by: Jun Yan Reviewed-by: Linus Walleij Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit cdf89f225331cfa25451e139d16d748738546bb0 Author: Bhargav Joshi Date: Sun Mar 1 00:44:00 2026 +0530 iio: hid-sensor-gyro-3d: fix typo in array name The array 'gryo_3d_sensitivity_addresses' has a clear spelling mistake in its prefix. Rename it to 'gyro_3d_sensitivity_addresses' to correctly match the naming convention. Signed-off-by: Bhargav Joshi Signed-off-by: Jonathan Cameron commit 6ea592a31be5a45c1e695df8e3907c97f2c5213b Author: Jonathan Santos Date: Mon Feb 23 08:59:53 2026 -0300 iio: adc: ad7768-1: add support for SPI offload The AD7768-1 family supports sampling rates up to 1 MSPS, which exceeds the capabilities of conventional triggered buffer operations due to SPI transaction overhead and interrupt latency. Add SPI offload support to enable hardware-accelerated data acquisition that bypasses software SPI transactions using continuous data streaming. Signed-off-by: Jonathan Santos Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit 68fe7c28faeac160c6474c5df93de6194af17a67 Author: Jonathan Santos Date: Mon Feb 23 08:59:44 2026 -0300 iio: adc: ad7768-1: disable IRQ autoenable The device continuously converts data while powered up, generating interrupts in the background. Configure the IRQ to be enabled and disabled manually as needed to avoid unnecessary CPU load. Signed-off-by: Jonathan Santos Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit 81fdc3127d013a552465c3bf9829afbed5184406 Author: Jonathan Santos Date: Mon Feb 23 08:59:35 2026 -0300 iio: adc: ad7768-1: remove switch to one-shot mode wideband low ripple FIR Filter is not available in one-shot mode. In order to make direct reads work for all filter options, remove the switch for one-shot mode and guarantee device is always in continuous conversion mode. Fixes: fb1d3b24ebf5 ("iio: adc: ad7768-1: add filter type and oversampling ratio attributes") Signed-off-by: Jonathan Santos Reviewed-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit 8be19e233744961db6069da9c9ab63eb085a0447 Author: Jonathan Santos Date: Mon Feb 23 08:59:26 2026 -0300 iio: adc: ad7768-1: fix one-shot mode data acquisition According to the datasheet, one-shot mode requires a SYNC_IN pulse to trigger a new sample conversion. In the current implementation, No sync pulse was sent after switching to one-shot mode and reinit_completion() was called before mode switching, creating a race condition where spurious interrupts during mode change could trigger completion prematurely. Fix by sending a sync pulse after configuring one-shot mode and reinit_completion() to ensure it only waits for the actual conversion completion. Fixes: a5f8c7da3dbe ("iio: adc: Add AD7768-1 ADC basic support") Signed-off-by: Jonathan Santos Reviewed-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit 185f7b6cee61a2c764e6a5026f5c0dc57e14277a Author: Marcelo Schmitt Date: Mon Feb 23 14:10:23 2026 -0300 iio: adc: ad4030: Add support for ADAQ4216 and ADAQ4224 ADAQ4216 and ADAQ4224 are similar to AD4030, but feature a PGA circuitry that scales the analog input signal prior to it reaching the ADC. The PGA is controlled through a pair of pins (A0 and A1) whose state define the gain that is applied to the input signal. Add support for ADAQ4216 and ADAQ4224. Provide a list of PGA options through the IIO device channel scale available interface and enable control of the PGA through the channel scale interface. Signed-off-by: Marcelo Schmitt Signed-off-by: Jonathan Cameron commit addb98c43b58609218e728f5cb578510d15e8737 Author: Marcelo Schmitt Date: Mon Feb 23 14:10:01 2026 -0300 dt-bindings: iio: adc: adi,ad4030: Add ADAQ4216 and ADAQ4224 ADAQ4216 and ADAQ4224 are similar to AD4030 except that ADAQ devices have a PGA (programmable gain amplifier) that scales the input signal prior to it reaching the ADC inputs. The PGA is controlled through a couple of pins (A0 and A1) that set one of four possible signal gain configurations. Reviewed-by: Conor Dooley Signed-off-by: Marcelo Schmitt Signed-off-by: Jonathan Cameron commit a98edf7de54dffcacbd4bec8dd420f69ceeff7b1 Author: Marcelo Schmitt Date: Mon Feb 23 14:09:47 2026 -0300 iio: adc: ad4030: Add SPI offload support AD4030 and similar ADCs can capture data at sample rates up to 2 mega samples per second (MSPS). Not all SPI controllers are able to achieve such high throughputs and even when the controller is fast enough to run transfers at the required speed, it may be costly to the CPU to handle transfer data at such high sample rates. Add SPI offload support for AD4030 and similar ADCs to enable data capture at maximum sample rates. Note that a pair of PWM devices are used for the supported setup. One of the PWM goes to the ADC CNV pin to initiate conversions while the other PWM is connected to the SPI offload trigger to signal when to fetch data from the peripheral. Note also that the PWMs must be somewhat synchronized such to make the controller run transfers only when ADC sample data is available. See Documentation/iio/ad4030.rst for details. Reviewed-by: David Lechner Co-developed-by: Trevor Gamblin Signed-off-by: Trevor Gamblin Co-developed-by: Axel Haslam Signed-off-by: Axel Haslam Signed-off-by: Marcelo Schmitt Signed-off-by: Jonathan Cameron commit 5e0d71dc04e24bdcdc3468bf0081eb79dd016b9a Author: Marcelo Schmitt Date: Mon Feb 23 14:09:31 2026 -0300 dt-bindings: iio: adc: adi,ad4030: Add PWM In setups designed for high speed data rate capture, a PWM is used to generate the CNV signal that issues data captures from the ADC. Document the use of a PWM for AD4030 and similar devices. Reviewed-by: David Lechner Acked-by: Conor Dooley Signed-off-by: Marcelo Schmitt Signed-off-by: Jonathan Cameron commit c4c1c5b773f7615fa7a9e3b421f0b788a94d0a09 Author: Marcelo Schmitt Date: Mon Feb 23 14:09:11 2026 -0300 Docs: iio: ad4030: Add double PWM SPI offload doc Document double PWM setup SPI offload wiring schema. Reviewed-by: David Lechner Signed-off-by: Marcelo Schmitt Signed-off-by: Jonathan Cameron commit 1037352197476f5eee4804e13a64c242be297aa2 Author: Giorgi Tchankvetadze Date: Wed Feb 25 17:08:59 2026 +0400 iio: adc: fix typos found by codespell Fix various spelling mistakes in comments and error messages across drivers/iio/adc/, found by running codespell. Signed-off-by: Giorgi Tchankvetadze Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit d6bd0e2745e66106dea47e3781275fa305492f02 Author: Taha Ed-Dafili <0rayn.dev@gmail.com> Date: Thu Feb 26 15:11:06 2026 +0000 docs: iio: adxl345: update event attributes and scaling math Update the documentation to reflect the recent driver additions for event scaling and the double tap threshold value, alongside correcting existing technical errors in scale calculations. Key changes: - Fix the 62.5 g/LSB typo to 62.5 mg/LSB and add SI unit conversion. - Correct decimal precision of in_accel_scale and in_accel_scale_available to match the actual SI unit (m/s^2) values reported by the driver. - Document the newly generated event scale attributes in the ABI table (e.g., in_accel_mag_rising_scale, in_accel_gesture_singletap_scale). - Document the newly exposed in_accel_gesture_doubletap_value attribute. - Add a sysfs example showing how to read and interpret the newly implemented event scale factor. Suggested-by: Jonathan Cameron Signed-off-by: Taha Ed-Dafili <0rayn.dev@gmail.com> Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit 9fb007705c77b85bfad2d3d4818ebcd5fcfa9571 Author: Taha Ed-Dafili <0rayn.dev@gmail.com> Date: Thu Feb 26 15:11:05 2026 +0000 iio: accel: adxl345: Implement event scaling for ABI compliance The ADXL345 uses a fixed threshold resolution of 62.5 mg/LSB for event-related registers. Previously, the driver reported raw values without a scale factor. Implement IIO_EV_INFO_SCALE for all event types to provide the conversion factor (0.612915 m/s^2) as required by the IIO ABI. Consequently, remove the obsolete comment in adxl345_read_event_value() which stated that the scale factor is not applied. Add explicit write rejection for IIO_EV_INFO_SCALE in adxl345_write_event_value() returning -EINVAL. Suggested-by: Jonathan Cameron Signed-off-by: Taha Ed-Dafili <0rayn.dev@gmail.com> Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit da29db0bcc95fb554ce9969ab57ba8f84c405be7 Author: Taha Ed-Dafili <0rayn.dev@gmail.com> Date: Thu Feb 26 15:11:04 2026 +0000 iio: accel: adxl345: Expose IIO_EV_INFO_VALUE for double tap The ADXL345 uses a single hardware register (ADXL345_REG_THRESH_TAP) to store the threshold for both single tap and double tap events. Currently, the driver only exposes the IIO_EV_INFO_VALUE attribute for the single tap event. However, the IIO ABI dictates that if an event is supported, its associated configuration attributes should be exposed to userspace. This applies even if writing to one channel property alters the value of another due to shared underlying hardware state. Add IIO_EV_INFO_VALUE to the double tap event specification to ensure full ABI compliance. Suggested-by: Jonathan Cameron Signed-off-by: Taha Ed-Dafili <0rayn.dev@gmail.com> Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit 2a76a626670b2ef391da37f457e8e51f168432a6 Author: Taha Ed-Dafili <0rayn.dev@gmail.com> Date: Thu Feb 26 15:11:03 2026 +0000 iio: core: Add IIO_EV_INFO_SCALE to event info Implement support for IIO_EV_INFO_SCALE in the internal enum iio_event_info to allow proper ABI compliance. This allows drivers (like the ADXL345) to expose event scale attributes using the standard IIO ABI rather than manual device attributes. Signed-off-by: Taha Ed-Dafili <0rayn.dev@gmail.com> Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit a1fe33e07b612d099684b7e7af0863f80f019691 Author: Taha Ed-Dafili <0rayn.dev@gmail.com> Date: Thu Feb 26 15:11:02 2026 +0000 docs: iio: adxl345: grammar and formatting cleanups Correct several grammatical errors, typos, and pluralization issues throughout the ADXL345 documentation. Key changes include: - Changing 'generic' to 'general-purpose' - Correcting 'axis' to 'axes' in multiple tables and descriptions - Improving phrasing in the device attributes section - Fixing 'latent' to 'latency' in usage examples - Sorting the existing event attribute table alphabetically for better readability and to establish a clean baseline for future additions. Suggested-by: David Lechner Signed-off-by: Taha Ed-Dafili <0rayn.dev@gmail.com> Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit a8fde8be9aa8e5f10ef73b59b2ad4fba585ccdc5 Author: Namjae Jeon Date: Sun Mar 1 14:52:16 2026 +0900 ntfs: fix sysctl table registration and path The presence of a sentinel (an empty {}) at the end of the ctl_table array now causes a "sysctl table check failed" error because the kernel attempts to validate the null entry as a functional node. Deleted the empty {} from the ntfs_sysctls array to prevent the "procname is null" and "No proc_handler" errors and updated the base path from "fs" to "fs/ntfs" to ensure the ntfs-debug node is correctly located under /proc/sys/fs/ntfs/. Reported-by: Woody Suwalski Signed-off-by: Namjae Jeon commit 3bf5404fc93825ddde89992acad095a297ed9a31 Author: Dmitry Torokhov Date: Fri Feb 20 19:27:06 2026 -0800 Input: atkbd - fix various formatting issues Over the years we accumulated a number of formatting issues, fix them. Signed-off-by: Dmitry Torokhov commit b96fee7ddb0d1908d3466cc8848e6336b8b7f467 Author: Dmitry Torokhov Date: Fri Feb 20 19:12:12 2026 -0800 Input: atkbd - switch to using explicitly sized types Instead of using "unsigned short" and "unsigned char" for holding 16-bit and 8-bit data, switch to using common in kernel u16 and u8. Signed-off-by: Dmitry Torokhov commit 9df4a9d2129f779449c0cbc1bd9ce37451d8b4f3 Author: Dmitry Torokhov Date: Fri Feb 20 19:02:45 2026 -0800 Input: atkbd - use dev_warn_ratelimited() Instead of explicitly using printk_ratelimit() switch to using dev_warn_ratelimited(). Signed-off-by: Dmitry Torokhov commit 1fe01b817921d2bbb10cc9c83d36364738ecfe5d Author: Dmitry Torokhov Date: Fri Feb 20 18:57:58 2026 -0800 Input: atkbd - use __free() cleanup facility in when parsing FW keymap Annotating the temporary keymap pointer as __free(kfree) ensures that it will get released when exiting the function and explicit freeing in all the return paths can be removed. Signed-off-by: Dmitry Torokhov commit 0c695e6b90674c67e03866123456cabfe1f74d9c Author: Ariel Silver Date: Fri Feb 20 10:44:28 2026 +0200 Input: atkbd - validate scancode in firmware keymap entries The SCANCODE() macro extracts a 16-bit value (0..65535) from firmware device property data, but atkbd_get_keymap_from_fwnode() uses it directly to index atkbd->keycode[], which only has ATKBD_KEYMAP_SIZE (512) elements. A firmware-supplied scancode >= 512 causes a heap out-of-bounds write that can corrupt adjacent struct atkbd fields and neighboring slab objects. Add a bounds check that rejects the entire firmware keymap if any entry contains an out-of-range scancode, consistent with the validation performed by matrix_keypad_parse_keymap() in drivers/input/matrix-keymap.c for the same "linux,keymap" property format. When rejected, the driver falls back to the default keycode table. Fixes: 9d17ad2369dc ("Input: atkbd - receive and use physcode->keycode mapping from FW") Signed-off-by: Ariel Silver Signed-off-by: Dmitry Torokhov commit 1bf5c303eb9898930c5313769df14a76c51075c1 Merge: 7179e626b76eb4 a4d72d2dd0cbc3 Author: Martin K. Petersen Date: Sat Feb 28 21:05:49 2026 -0500 Merge patch series "scsi: target: Add support for completing commands from backend context" The following patches made over Linus's current tree allow users to tell the target layer to perform direct completions instead of always deferring to LIO's completion workqueue. When the frontend driver already has multiple worker threads (or you are doing a LUN per target with a single thread per target) then bypassing the LIO workqueue can increase performance 20-30%. Link: https://patch.msgid.link/20260222232946.7637-1-michael.christie@oracle.com Signed-off-by: Martin K. Petersen commit a4d72d2dd0cbc3ff20f66a9168dd68b191c57409 Author: Mike Christie Date: Sun Feb 22 17:27:04 2026 -0600 scsi: vhost-scsi: Report direction completion support This has vhost-scsi report that it supports direct completions. When using a worker task per queue or group of queues with fast backends then enabling direct completion and submissions increases performance 20-30% with workloads like: fio --filename=/dev/sdb --direct=1 --rw=randrw --bs=8K \ --ioengine=libaio --iodepth=128 --numjobs=$jobs As jobs matches and passes the number of vCPUs in the VM then the benefit increases. However, when using a single worker then queueing completions and submissions is best as the worker is busy handling mapping data and setting/tearing down commands. Signed-off-by: Mike Christie Link: https://patch.msgid.link/20260222232946.7637-5-michael.christie@oracle.com Signed-off-by: Martin K. Petersen commit e1502d990c8e26fa679b3253ff7db51483e6eb82 Author: Mike Christie Date: Sun Feb 22 17:27:03 2026 -0600 scsi: target: Allow userspace to set the completion type This allows userspace to request if we complete in the backend context or the frontend driver. It works the same as submission where you can write 0 to 2 to complete_type: 0 - Use the fabric driver's preference. 1 - Complete from the backend calling context if the fabric supports it. 2 - Queue the completion to LIO's completion workqueue. Signed-off-by: Mike Christie Link: https://patch.msgid.link/20260222232946.7637-4-michael.christie@oracle.com Signed-off-by: Martin K. Petersen commit 89663fb2e53822863de9cf4bca9636989da96615 Author: Mike Christie Date: Sun Feb 22 17:27:02 2026 -0600 scsi: target: Use driver completion preference by default This has us use the driver's completion preference by default. There is no behavior changes with this patch and we queue completion to LIO's completion workqueue by default. Signed-off-by: Mike Christie Link: https://patch.msgid.link/20260222232946.7637-3-michael.christie@oracle.com Signed-off-by: Martin K. Petersen commit 06933066d88a3093953b062922c016a67d2cdbf8 Author: Mike Christie Date: Sun Feb 22 17:27:01 2026 -0600 scsi: target: Add support for completing commands from backend context To complete a command several drivers just drop their reference and add it to list to be processed by a driver specific thread. So there's no need to go from backend context to the LIO thread then to the driver's thread. When avoiding the LIO thread, IOPS can increase from 20-30% for workloads like: fio --filename=/dev/sdb --direct=1 --rw=randrw --bs=8K \ --ioengine=libaio --iodepth=128 --numjobs=$jobs where increasing jobs increases the performance improvement (this is using NVMe drives with LIO's submit_type=1 to directly submit). Add the infrastructure so drivers and userspace can control how to complete a command like is done for the submission path. In this commit there is no behavior change and we continue to defer to the LIO workqueue thread. In the subsequent commits we will allow drivers to report what they support and allow userspace to control the behavior. Signed-off-by: Mike Christie Link: https://patch.msgid.link/20260222232946.7637-2-michael.christie@oracle.com Signed-off-by: Martin K. Petersen commit 7179e626b76eb42f2529c6f6dd6ba88ea2445372 Author: Swarna Prabhu Date: Wed Feb 18 20:37:42 2026 -0800 scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver The WRITE SAME(16) and WRITE SAME(10) SCSI commands use a page from a dedicated mempool (sd_page_pool) for their payload. This pool was initialized to allocate single pages, which was sufficient as long as the device sector size did not exceed the PAGE_SIZE. Given that block layer now supports block size upto 64KB, i.e. beyond PAGE_SIZE, initialize a large page pool in sd_probe() if a higher sector device is attached, ensuring atomicity. Adapt sd_set_special_bvec() to use large page pool when a higher sector size device is attached. Hence enable sector sizes > PAGE_SIZE in SCSI sd driver. Reviewed-by: Damien Le Moal Signed-off-by: Swarna Prabhu Co-developed-by: Pankaj Raghav Signed-off-by: Pankaj Raghav Link: https://patch.msgid.link/20260219043741.276729-2-sw.prabhu6@gmail.com Signed-off-by: Martin K. Petersen commit 50209dec14f8c594a9ef26237b7e7ddd39e12a40 Author: Yang Erkun Date: Tue Jan 27 14:20:44 2026 +0800 scsi: sg: Remove deprecated sg-big-buff These deprecated sysctl has been broken since commit 26d1c80fd61e ("scsi/sg: move sg-big-buff sysctl to scsi/sg.c") and nobody has found this. I believe it's time to remove it, which will allow us to clean up a significant amount of code. Signed-off-by: Yang Erkun Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260127062044.3034148-4-yangerkun@huawei.com Signed-off-by: Martin K. Petersen commit d06a310b45e153872033dd0cf19d5a2279121099 Author: Yang Erkun Date: Tue Jan 27 14:20:43 2026 +0800 scsi: sg: Resolve soft lockup issue when opening /dev/sgX The parameter def_reserved_size defines the default buffer size reserved for each Sg_fd and should be restricted to a range between 0 and 1,048,576 (see https://tldp.org/HOWTO/SCSI-Generic-HOWTO/proc.html). Although the function sg_proc_write_dressz enforces this limit, it is possible to bypass it by directly modifying the module parameter as shown below, which then causes a soft lockup: echo -1 > /sys/module/sg/parameters/def_reserved_size exec 4<> /dev/sg0 watchdog: BUG: soft lockup - CPU#5 stuck for 26 seconds! [bash:537] Modules loaded: CPU: 5 UID: 0 PID: 537 Command: bash, kernel version 6.19.0-rc3+ #134, PREEMPT disabled Hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS version 1.16.1-2.fc37 dated 04/01/2014 ... Call Trace: sg_build_reserve+0x5c/0xa0 sg_add_sfp+0x168/0x270 sg_open+0x16e/0x340 chrdev_open+0xbe/0x230 do_dentry_open+0x175/0x480 vfs_open+0x34/0xf0 do_open+0x265/0x3d0 path_openat+0x110/0x290 do_filp_open+0xc3/0x170 do_sys_openat2+0x71/0xe0 __x64_sys_openat+0x6d/0xa0 do_syscall_64+0x62/0x310 entry_SYSCALL_64_after_hwframe+0x76/0x7e The fix is to use module_param_cb to validate and reject invalid values assigned to def_reserved_size. Fixes: 6460e75a104d ("[SCSI] sg: fixes for large page_size") Signed-off-by: Yang Erkun Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260127062044.3034148-3-yangerkun@huawei.com Signed-off-by: Martin K. Petersen commit 3033c471aaf675254efaa0da431e95d91a104b41 Author: Yang Erkun Date: Tue Jan 27 14:20:42 2026 +0800 scsi: sg: Fix sysctl sg-big-buff register during sg_init() Commit 26d1c80fd61e ("scsi/sg: move sg-big-buff sysctl to scsi/sg.c") made a mistake. sysctl sg-big-buff was not created because the call to register_sg_sysctls() was placed on the wrong code path. Fixes: 26d1c80fd61e ("scsi/sg: move sg-big-buff sysctl to scsi/sg.c") Signed-off-by: Yang Erkun Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260127062044.3034148-2-yangerkun@huawei.com Signed-off-by: Martin K. Petersen commit 94c125bafa00042daf6d63b4fdd78384abc121fc Author: Igor Pylypiv Date: Mon Feb 9 13:21:51 2026 -0800 scsi: core: Add 'serial' sysfs attribute for SCSI/SATA Add a 'serial' sysfs attribute for SCSI and SATA devices. This attribute exposes the Unit Serial Number, which is derived from the Device Identification Vital Product Data (VPD) page 0x80. Whitespace is stripped from the retrieved serial number to handle the different alignment (right-aligned for SCSI, potentially left-aligned for SATA). As noted in SAT-5 10.5.3, "Although SPC-5 defines the PRODUCT SERIAL NUMBER field as right-aligned, ACS-5 does not require its SERIAL NUMBER field to be right-aligned. Therefore, right-alignment of the PRODUCT SERIAL NUMBER field for the translation is not assured." This attribute is used by tools such as lsblk to display the serial number of block devices. [mkp: length adjustment] Signed-off-by: Igor Pylypiv Reviewed-by: Bart Van Assche Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260209212151.342151-1-ipylypiv@google.com Signed-off-by: Martin K. Petersen commit 01857fc712f6469cab9cc578120cdc80f1c2a634 Merge: 52d534aa6640a4 67713dff639831 Author: Jakub Kicinski Date: Sat Feb 28 15:31:38 2026 -0800 Merge branch 'net-sched-refactor-qdisc-drop-reasons-into-dedicated-tracepoint' Jesper Dangaard Brouer says: ==================== net: sched: refactor qdisc drop reasons into dedicated tracepoint This series refactors qdisc drop reason handling by introducing a dedicated enum qdisc_drop_reason and trace_qdisc_drop tracepoint, providing qdisc layer drop diagnostics with direct qdisc context visibility. Background: ----------- Identifying which qdisc dropped a packet via skb_drop_reason is difficult. Normally, the kfree_skb tracepoint caller "location" hints at the dropping code, but qdisc drops happen at a central point (__dev_queue_xmit), making this unusable. As a workaround, commits 5765c7f6e317 ("net_sched: sch_fq: add three drop_reason") and a42d71e322a8 ("net_sched: sch_cake: Add drop reasons") encoded qdisc names directly in the drop reason enums. This series provides a cleaner solution by creating a dedicated qdisc tracepoint that naturally includes qdisc context (handle, parent, kind). Solution: --------- Create a new tracepoint trace_qdisc_drop that builds on top of existing trace_qdisc_enqueue infrastructure. It includes qdisc handle, parent, qdisc kind (name), and device information directly. The existing SKB_DROP_REASON_QDISC_DROP is retained for backwards compatibility via kfree_skb_reason(). The qdisc-specific drop reasons (QDISC_DROP_*) provide fine-grained detail via the new tracepoint. The enum uses subsystem encoding (offset by SKB_DROP_REASON_SUBSYS_QDISC) to catch type mismatches during debugging. This implements the alternative approach described in: https://lore.kernel.org/all/6be17a08-f8aa-4f91-9bd0-d9e1f0a92d90@kernel.org/ ==================== Link: https://patch.msgid.link/177211325634.3011628.9343837509740374154.stgit@firesoul Signed-off-by: Jakub Kicinski commit 67713dff6398315461db56fdf208e7fd7e37078e Author: Jesper Dangaard Brouer Date: Thu Feb 26 14:45:19 2026 +0100 net: sched: sch_dualpi2: use qdisc_dequeue_drop() for dequeue drops DualPI2 drops packets during dequeue but was using kfree_skb_reason() directly, bypassing trace_qdisc_drop. Convert to qdisc_dequeue_drop() and add QDISC_DROP_L4S_STEP_NON_ECN to the qdisc drop reason enum. - Set TCQ_F_DEQUEUE_DROPS flag in dualpi2_init() - Use enum qdisc_drop_reason in drop_and_retry() - Replace kfree_skb_reason() with qdisc_dequeue_drop() Signed-off-by: Jesper Dangaard Brouer Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/177211351978.3011628.11267023360997620069.stgit@firesoul Signed-off-by: Jakub Kicinski commit 9d3e7f9718987338d9cfbd64292aab6a739d9d32 Author: Jesper Dangaard Brouer Date: Thu Feb 26 14:44:35 2026 +0100 net: sched: rename QDISC_DROP_CAKE_FLOOD to QDISC_DROP_FLOOD_PROTECTION Rename QDISC_DROP_CAKE_FLOOD to QDISC_DROP_FLOOD_PROTECTION to use a generic name without embedding the qdisc name. This follows the principle that drop reasons should describe the drop mechanism rather than being tied to a specific qdisc implementation. The flood protection drop reason is used by qdiscs implementing probabilistic drop algorithms (like BLUE) that detect unresponsive flows indicating potential DoS or flood attacks. CAKE uses this via its Cobalt AQM component. Signed-off-by: Jesper Dangaard Brouer Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/177211347537.3011628.13759059534638729639.stgit@firesoul Signed-off-by: Jakub Kicinski commit f30d9073ec1909a3b06a9cee57215bed3458da80 Author: Jesper Dangaard Brouer Date: Thu Feb 26 14:44:29 2026 +0100 net: sched: rename QDISC_DROP_FQ_* to generic names Rename FQ-specific drop reasons to generic names: - QDISC_DROP_FQ_BAND_LIMIT -> QDISC_DROP_BAND_LIMIT - QDISC_DROP_FQ_HORIZON_LIMIT -> QDISC_DROP_HORIZON_LIMIT This follows the principle that drop reasons should describe the drop mechanism rather than being tied to a specific qdisc implementation. These concepts (priority band limits, timestamp horizon) could apply to other qdiscs as well. Remove the local macro define FQDR() and instead use the full QDISC_DROP_* name to make it easier to navigate code. Signed-off-by: Jesper Dangaard Brouer Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/177211346902.3011628.12523261489552097455.stgit@firesoul Signed-off-by: Jakub Kicinski commit 3e28f8ad478f165260deba751858afac46cffd2f Author: Jesper Dangaard Brouer Date: Thu Feb 26 14:44:19 2026 +0100 net: sched: sfq: convert to qdisc drop reasons Convert SFQ to use the new qdisc-specific drop reason infrastructure. This patch demonstrates how to convert a flow-based qdisc to use the new enum qdisc_drop_reason. As part of this conversion: - Add QDISC_DROP_MAXFLOWS for flow table exhaustion - Rename FQ_FLOW_LIMIT to generic FLOW_LIMIT, now shared by FQ and SFQ - Use QDISC_DROP_OVERLIMIT for sfq_drop() when overall limit exceeded - Use QDISC_DROP_FLOW_LIMIT for per-flow depth limit exceeded The FLOW_LIMIT reason is now a common drop reason for per-flow limits, applicable to both FQ and SFQ qdiscs. Signed-off-by: Jesper Dangaard Brouer Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/177211345946.3011628.12770616071857185664.stgit@firesoul Signed-off-by: Jakub Kicinski commit ff2998f29f390d963299103f0b247cc79106ced5 Author: Jesper Dangaard Brouer Date: Thu Feb 26 14:44:12 2026 +0100 net: sched: introduce qdisc-specific drop reason tracing Create new enum qdisc_drop_reason and trace_qdisc_drop tracepoint for qdisc layer drop diagnostics with direct qdisc context visibility. The new tracepoint includes qdisc handle, parent, kind (name), and device information. Existing SKB_DROP_REASON_QDISC_DROP is retained for backwards compatibility via kfree_skb_reason(). Convert qdiscs with drop reasons to use the new infrastructure. Change CAKE's cobalt_should_drop() return type from enum skb_drop_reason to enum qdisc_drop_reason to fix implicit enum conversion warnings. Use QDISC_DROP_UNSPEC as the 'not dropped' sentinel instead of SKB_NOT_DROPPED_YET. Both have the same compiled value (0), so the comparison logic remains semantically equivalent. Signed-off-by: Jesper Dangaard Brouer Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/177211345275.3011628.1974310302645218067.stgit@firesoul Signed-off-by: Jakub Kicinski commit 52d534aa6640a41f9813c7dfe30b65b11e4d7416 Merge: d578b472939997 5b43d35e571fc9 Author: Jakub Kicinski Date: Sat Feb 28 15:08:19 2026 -0800 Merge branch 'icmp-fix-icmp-error-source-address-over-xfrm-tunnel' Antony Antony says: ==================== icmp: Fix icmp error source address over xfrm tunnel icmp: Fix icmp error source address over xfrm tunnel This fix, originally sent to XFRM/IPsec, has been recommended by Steffen Klassert to submit to the net tree, since it changes ICMP behavior. The patch addresses a minor issue related to the IPv4 source address of ICMP error messages. The bug only occurs when xfrm policies are configured. It originated from an old 2011 commit: commit 415b3334a21a ("icmp: Fix regression in nexthop resolution during replies.") ==================== Link: https://patch.msgid.link/cover.1772101380.git.antony.antony@secunet.com Signed-off-by: Jakub Kicinski commit 5b43d35e571fc957fd126c310663a4665f1e7511 Author: Antony Antony Date: Thu Feb 26 11:28:21 2026 +0100 selftests: net: add ICMP error source address test over xfrm tunnel Test that ICMP error messages generated by an IPsec gateway use the correct source address (the gateway's address, not the unreachable destination). Signed-off-by: Antony Antony Link: https://patch.msgid.link/79d526f96cf2252d71550d38772876bc72c7e3c7.1772101380.git.antony.antony@secunet.com Signed-off-by: Jakub Kicinski commit 595da751c8222ca957cfdc0161d9845a75c67046 Author: Antony Antony Date: Thu Feb 26 11:27:51 2026 +0100 icmp: fix ICMP error source address when xfrm policy matches When an IPsec gateway generates an ICMP error (e.g., Destination Host Unreachable), the source address incorrectly shows the unreachable destination instead of the gateway's address. IPv6 behaves correctly. Before fix: ping 10.1.6.3 From 10.1.6.3 icmp_seq=1 Destination Host Unreachable (wrong - 10.1.6.3 is the unreachable host) After fix: ping 10.1.6.3 From 10.1.5.2 icmp_seq=1 Destination Host Unreachable (correct - 10.1.5.2 is the gateway) The fix removes the memcpy that overwrote fl4 with fl4_dec after xfrm_lookup(). A follow-up commit adds a selftest. Fixes: 415b3334a21a ("icmp: Fix regression in nexthop resolution during replies.") Cc: stable+noautosel@kernel.org # Avoid false positives in tests Signed-off-by: Antony Antony Acked-by: Tobias Brunner Reviewed-by: David Ahern Link: https://patch.msgid.link/19a0156ff6e76baa323a81d710510d399a6ff63a.1772101380.git.antony.antony@secunet.com Signed-off-by: Jakub Kicinski commit 690d41fae92f0f255b1059d586bf064c63b5bfc3 Author: Pradeep P V K Date: Wed Feb 11 18:59:24 2026 +0530 scsi: ufs: qcom,sc7180-ufshc: dt-bindings: Add UFSHC compatible for x1e80100 Add UFS Host Controller (UFSHC) compatible for x1e80100 SoC. Use SM8550 as a fallback since x1e80100 is fully compatible with it. Qualcomm UFSHC is no longer compatible with JEDEC UFS-2.0 binding. Avoid using the "jedec,ufs-2.0" string in the compatible property. [mkp: conflict resolution] Acked-by: Manivannan Sadhasivam Reviewed-by: Krzysztof Kozlowski Signed-off-by: Pradeep P V K Link: https://patch.msgid.link/20260211132926.3716716-2-pradeep.pragallapati@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit cf44b6369b8350e46e66bb69ef975c5aa22cec5e Author: Luca Weiss Date: Mon Jan 12 14:53:15 2026 +0100 scsi: ufs: qcom,sc7180-ufshc: dt-bindings: Document the Milos UFS Controller Document the UFS Controller on the Milos SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20260112-milos-ufs-v2-2-d3ce4f61f030@fairphone.com Signed-off-by: Martin K. Petersen commit 5e0d4fdb98f3ab4c25aabda00b31dd5d4a806638 Author: Randy Dunlap Date: Tue Feb 24 15:49:54 2026 -0800 scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h Avoid all kernel-doc warnings in lpfc.h: - Use the correct function parameter name - Add a '*' to a kernel-doc line - Repair the function Returns: comments Fixes these warnings: Warning: drivers/scsi/lpfc/lpfc.h:1674 No description found for return value of 'lpfc_next_online_cpu' Warning: drivers/scsi/lpfc/lpfc.h:1686 No description found for return value of 'lpfc_next_present_cpu' Warning: drivers/scsi/lpfc/lpfc.h:1700 function parameter 'eq' not described in 'lpfc_sli4_mod_hba_eq_delay' Warning: drivers/scsi/lpfc/lpfc.h:1755 bad line: -------------------------- Warning: drivers/scsi/lpfc/lpfc.h:1759 No description found for return value of 'lpfc_is_vmid_enabled' Signed-off-by: Randy Dunlap Reviewed-by: Justin Tee Link: https://patch.msgid.link/20260224234954.3606638-1-rdunlap@infradead.org Signed-off-by: Martin K. Petersen commit e521b77688365e0ed495baa6dae4905428a9f517 Author: Bart Van Assche Date: Mon Feb 23 14:00:30 2026 -0800 scsi: megaraid_sas: Protect more code with instance->reset_mutex megasas_get_device_list() and megasas_get_snapdump_properties() may unlock instance->reset_mutex indirectly. Hence, hold reset_mutex while calling these functions. Cc: Kashyap Desai Cc: Sumit Saxena Cc: Shivasharan S Cc: Chandrakanth patil Cc: James E.J. Bottomley Cc: Martin K. Petersen Cc: megaraidlinux.pdl@broadcom.com Cc: linux-scsi@vger.kernel.org Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260223220102.2158611-31-bart.vanassche@linux.dev Signed-off-by: Martin K. Petersen commit fc803a39c42ad3887796cb3afbf7bdd4221199bf Author: Bart Van Assche Date: Mon Feb 23 14:00:29 2026 -0800 scsi: fnic: Make fnic_queuecommand() easier to analyze Move a spin_unlock_irqrestore() call such that the io_lock_acquired variable can be eliminated. This patch prepares for enabling the Clang thread-safety analyzer. Cc: Satish Kharat Cc: Sesidhar Baddela Cc: Karan Tilak Kumar Cc: James E.J. Bottomley Cc: Martin K. Petersen Cc: linux-scsi@vger.kernel.org Signed-off-by: Bart Van Assche Reviewed-by: Karan Tilak Kumar Link: https://patch.msgid.link/20260223220102.2158611-30-bart.vanassche@linux.dev Signed-off-by: Martin K. Petersen commit 04d52a5a288ad0349d5d03b384d9cda3cc63d4a1 Merge: f707860ebc84dd 47e088c9d1a06e Author: Martin K. Petersen Date: Sat Feb 28 17:16:17 2026 -0500 Merge patch series "fnic 1.8.0.3 update" Karan Tilak Kumar says: Signed-off-by: Martin K. Petersen commit d578b4729399979f14f7ddd6a80e3ae0832c2e0c Merge: ded4a02e7d0497 2e8aeb7ff0b279 Author: Jakub Kicinski Date: Sat Feb 28 10:30:26 2026 -0800 Merge branch 'npc-hw-block-support-for-cn20k' Ratheesh Kannoth says: ==================== NPC HW block support for cn20k This patchset adds comprehensive support for the CN20K NPC architecture. CN20K introduces significant changes in MCAM layout, parser design, KPM/KPU mapping, index management, virtual index handling, and dynamic rule installation. The patches update the AF, PF/VF, and common layers to correctly support these new capabilities while preserving compatibility with previous silicon variants. MCAM on CN20K differs from older designs: the hardware now contains two vertical banks of depth 8192, and thirty-two horizontal subbanks of depth 256. Each subbank can be configured as x2 or x4, enabling 256-bit or 512-bit key storage. Several allocation models are added to support this layout, including contiguous and non-contiguous allocation with or without reference ranges and priorities. Parser and extraction logic are also enhanced. CN20K introduces a new profile model where up to twenty-four extractors may be configured for each parsing profile. A new KPM profile scheme is added, grouping sixteen KPUs into eight KPM profiles, each formed by two KPUs. Support is added for default index allocation for CN20K-specific MCAM entry structures, virtual index allocation, improved defragmentation, and TC rule installation by allowing the AF driver to determine required x2/x4 rule width during flow install. ==================== Link: https://patch.msgid.link/20260224080009.4147301-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 2e8aeb7ff0b27966e988b0f464fb1b91e7dfafb7 Author: Ratheesh Kannoth Date: Tue Feb 24 13:30:09 2026 +0530 octeontx2-af: npc: Use common structures CN20K and legacy silicon differ in the size of key words used in NPC MCAM. However, SoC-specific structures are not required for low-level functions. Remove the SoC-specific structures and rename the macros to improve readability. Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-14-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 528530dff56b4a39a19b1ead9de376d22d0baf71 Author: Ratheesh Kannoth Date: Tue Feb 24 13:30:08 2026 +0530 octeontx2-af: npc: cn20k: add debugfs support CN20K silicon divides the NPC MCAM into banks and subbanks, with each subbank configurable for x2 or x4 key widths. This patch adds debugfs entries to expose subbank usage details and their configured key type. A debugfs entry is also added to display the default MCAM indexes allocated for each pcifunc. Additionally, debugfs support is introduced to show the mapping between virtual indexes and real MCAM indexes, and vice versa. Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-13-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 0d12d26701b0d35fd992551cf5608485a706e686 Author: Subbaraya Sundeep Date: Tue Feb 24 13:30:07 2026 +0530 octeontx2-pf: cn20k: Add TC rules support Unlike previous silicons, MCAM entries required for TC rules in CN20K are allocated dynamically. The key size can also be dynamic, i.e., X2 or X4. Based on the size of the TC rule match criteria, the AF driver allocates an X2 or X4 rule. This patch implements the required changes for CN20K TC by requesting an MCAM entry from the AF driver on the fly when the user installs a rule. Based on the TC rule priority added or deleted by the user, the PF driver shifts MCAM entries accordingly. If there is a mix of X2 and X4 rules and the user tries to install a rule in the middle of existing rules, the PF driver detects this and rejects the rule since X2 and X4 rules cannot be shifted in hardware. Signed-off-by: Subbaraya Sundeep Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-12-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 9000cada7aa9593df9b0c105f906fdfb43a5b341 Author: Ratheesh Kannoth Date: Tue Feb 24 13:30:06 2026 +0530 octeontx2-af: npc: cn20k: Allocate MCAM entry for flow installation In CN20K, the PF/VF driver is unaware of the NPC MCAM entry type (x2/x4) required for a particular TC rule when the user installs rules through the TC command. This forces the PF/VF driver to first query the AF driver for the rule size, then allocate an entry, and finally install the flow. This sequence requires three mailbox request/response exchanges from the PF. To speed up the installation, the `install_flow` mailbox request message is extended with additional fields that allow the AF driver to determine the required NPC MCAM entry type, allocate the MCAM entry, and complete the flow installation in a single step. Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-11-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 645c6e3c19999007446790b4b823452a7b3a3981 Author: Ratheesh Kannoth Date: Tue Feb 24 13:30:05 2026 +0530 octeontx2-af: npc: cn20k: virtual index support This patch adds support for virtual MCAM index allocation and improves CN20K MCAM defragmentation handling. A new field is introduced in the non-ref, non-contiguous MCAM allocation mailbox request to indicate that virtual indexes should be returned instead of physical ones. Virtual indexes allow the hardware to move mapped MCAM entries internally, enabling defragmentation and preventing scattered allocations across subbanks. The patch also enhances defragmentation by treating non-ref, non-contiguous allocations as ideal candidates for packing sparsely used regions, which can free up subbanks for potential x2 or x4 configuration. All such allocations are tracked and always returned as virtual indexes so they remain stable even when entries are moved during defrag. During defragmentation, MCAM entries may shift between subbanks, but their virtual indexes remain unchanged. Additionally, this update fixes an issue where entry statistics were not being restored correctly after defragmentation. Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-10-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 4e527f1e5c155ce28164ba34cad47b635d16f827 Author: Suman Ghosh Date: Tue Feb 24 13:30:04 2026 +0530 octeontx2-af: npc: cn20k: Add new mailboxes for CN20K silicon To enable enhanced MCAM capabilities for CN20K, the struct mcam_entry has been extended to support expanded keyword requirements. Specifically, the kw and kw_mask arrays have been increased from a size of 7 to 8 to accommodate the additional keyword field introduced for CN20K. To ensure seamless integration while preserving compatibility with existing platforms, dedicated CN20K-specific mailboxes have been introduced that leverage the updated struct mcam_entry. This approach allows CN20K to utilize the extended structure without impacting current implementations. This patch identifies the relevant mailboxes and introduces the following CN20K-specific additions: New mailboxes added: 1. `NPC_CN20K_MCAM_WRITE_ENTRY` 2. `NPC_CN20K_MCAM_ALLOC_AND_WRITE_ENTRY` 3. `NPC_CN20K_MCAM_READ_ENTRY` 4. `NPC_CN20K_MCAM_READ_BASE_RULE` Signed-off-by: Suman Ghosh Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-9-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit de3f88b465c8fda07b1dc44648a99f7dec390705 Author: Ratheesh Kannoth Date: Tue Feb 24 13:30:03 2026 +0530 octeontx2-af: npc: cn20k: Prepare for new SoC Current code pass mcam_entry structure to all low level functions. This is not proper: 1) We need to modify all functions to support a new SoC 2) It does not look good to pass soc specific structure to all common functions. This patch adds a mcam meta data structure, which is populated and passed to low level functions. Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-8-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 6d1e70282f7607948085a510ea03b9a10b5571f7 Author: Suman Ghosh Date: Tue Feb 24 13:30:02 2026 +0530 octeontx2-af: npc: cn20k: Use common APIs In cn20k silicon, the register definitions and the algorithms used to read, write, copy, and enable MCAM entries have changed. This patch updates the common APIs to support both cn20k and previous silicon variants. Additionally, cn20k introduces a new algorithm for MCAM index management. The common APIs are updated to invoke the cn20k-specific index management routines for allocating, freeing, and retrieving default MCAM entries. Signed-off-by: Suman Ghosh Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-7-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 09d3b7a1403f018331afb42e16404942d831b029 Author: Ratheesh Kannoth Date: Tue Feb 24 13:30:01 2026 +0530 octeontx2-af: npc: cn20k: Allocate default MCAM indexes Reserving MCAM entries in the AF driver for installing default MCAM entries is not an efficient allocation method, as it results in significant wastage of entries. This patch allocates MCAM indexes for promiscuous, multicast, broadcast, and unicast traffic in descending order of indexes (from lower to higher priority) when the NIX LF is attached to the PF/VF. Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-6-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit ef992a0f12e8268908ebabe91ab40442a876f303 Author: Suman Ghosh Date: Tue Feb 24 13:30:00 2026 +0530 octeontx2-af: npc: cn20k: MKEX profile support In new silicon variant cn20k, a new parser profile is introduced. Instead of having two layer-data information per key field type, a new key extractor concept is introduced. As part of this change now a maximum of 24 extractor can be configured per packet parsing profile. For example, LA type(ether) can have 24 unique parsing key, LC type(ip), LD type(tcp/udp) also can have unique 24 parsing key associated. Signed-off-by: Suman Ghosh Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-5-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit a2df2f95eac06352f33636c0ba189608a64646ef Author: Suman Ghosh Date: Tue Feb 24 13:29:59 2026 +0530 octeontx2-af: npc: cn20k: Add default profile Default mkex profile for cn20k silicon. This commit changes attribute of objects to may_be_unused to avoid compiler warning Signed-off-by: Suman Ghosh Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-4-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 5868682b68dd4ff3b8ef7fcbf3db4e2de5ae8cb2 Author: Suman Ghosh Date: Tue Feb 24 13:29:58 2026 +0530 octeontx2-af: npc: cn20k: KPM profile changes KPU (Kangaroo Processing Unit) profiles are primarily used to set the required packet pointers that will be used in later stages for key generation. In the new CN20K silicon variant, a new KPM profile is introduced alongside the existing KPU profiles. In CN20K, a total of 16 KPUs are grouped into 8 KPM profiles. As per the current hardware design, each KPM configuration contains a combination of 2 KPUs: KPM0 = KPU0 + KPU8 KPM1 = KPU1 + KPU9 ... KPM7 = KPU7 + KPU15 This configuration enables more efficient use of KPU resources. This patch adds support for the new KPM profile configuration. Signed-off-by: Suman Ghosh Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-3-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit 1396771b0b7741d517d591cfb63333d3f97a8f6d Author: Ratheesh Kannoth Date: Tue Feb 24 13:29:57 2026 +0530 octeontx2-af: npc: cn20k: Index management In CN20K silicon, the MCAM is divided vertically into two banks. Each bank has a depth of 8192. The MCAM is divided horizontally into 32 subbanks, with each subbank having a depth of 256. Each subbank can accommodate either x2 keys or x4 keys. x2 keys are 256 bits in size, and x4 keys are 512 bits in size. Bank1 Bank0 |-----------------------------| | | | subbank 31 { depth 256 } | | | |-----------------------------| | | | subbank 30 | | | ------------------------------ ............................... |-----------------------------| | | | subbank 0 | | | ------------------------------| This patch implements the following allocation schemes in NPC. The allocation API accepts reference (ref), limit, contig, priority, and count values. For example, specifying ref=100, limit=200, contig=1, priority=LOW, and count=20 will allocate 20 contiguous MCAM entries between entries 100 and 200. 1. Contiguous allocation with ref, limit, and priority. 2. Non-contiguous allocation with ref, limit, and priority. 3. Non-contiguous allocation without ref. 4. Contiguous allocation without ref. Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260224080009.4147301-2-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit ded4a02e7d0497c91ec8665e904c7dc817922993 Author: Thorsten Blum Date: Fri Feb 27 01:45:42 2026 +0100 ipv6: sit: Replace deprecated strcpy with strscpy strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy(). Use the two-argument version of strscpy() to copy 'parms->name' in ipip6_tunnel_locate(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260227004541.798966-3-thorsten.blum@linux.dev Signed-off-by: Jakub Kicinski commit eed562b2a6d088d1afa83cd60b2eccaec08e81ca Merge: a9a13c7379ec57 a2f19184014f30 Author: Jakub Kicinski Date: Sat Feb 28 08:58:40 2026 -0800 Merge branch 'gve-support-larger-ring-sizes-in-dqo-qpl-mode' Max Yuan says: ==================== gve: Support larger ring sizes in DQO-QPL mode This patch series updates the gve driver to improve Queue Page List (QPL) management and enable support for larger ring sizes when using the DQO-QPL queue format. Previously, the driver used hardcoded multipliers to determine the number of pages to register for QPLs (e.g., 2x ring size for RX). This rigid approach made it difficult to support larger ring sizes without potentially exceeding the "max_registered_pages" limit reported by the device. The first patch introduces a unified and flexible logic for calculating QPL page requirements. It balances TX and RX page allocations based on the configured ring sizes and scales the total count down proportionally if it would otherwise exceed the device's global registration limit. The second patch leverages this new flexibility to stop ignoring the maximum ring size supported by the device in DQO-QPL mode. Users can now configure ring sizes up to the device-reported maximum, as the driver will automatically adjust the QPL size to stay within allowed memory bounds. ==================== Link: https://patch.msgid.link/20260225182342.1049816-1-joshwash@google.com Signed-off-by: Jakub Kicinski commit a2f19184014f309165d2d4cfb41088b75c1121a4 Author: Matt Olson Date: Wed Feb 25 10:23:42 2026 -0800 gve: Enable reading max ring size from the device in DQO-QPL mode The gVNIC device indicates a device option (MODIFY_RING) to the driver, which presents a range of ring sizes from which the user is allowed to select. But in DQO-QPL queue format, the driver ignores the "max" of this range and instead allows the user to configure the ring size in the range [min, default]. This was done because increasing the ring size could result in the number of registered pages being higher than the max allowed by the device. In order to support large ring sizes, stop ignoring the "max" of the range presented in the MODIFY_RING option. Signed-off-by: Matt Olson Signed-off-by: Max Yuan Reviewed-by: Jordan Rhee Reviewed-by: Harshitha Ramamurthy Reviewed-by: Praveen Kaligineedi Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20260225182342.1049816-3-joshwash@google.com Signed-off-by: Jakub Kicinski commit 07993df560917357610e0625a9a2e7531c3211fc Author: Matt Olson Date: Wed Feb 25 10:23:41 2026 -0800 gve: Update QPL page registration logic For DQO, change QPL page registration logic to be more flexible to honor the "max_registered_pages" parameter from the gVNIC device. Previously the number of RX pages per QPL was hardcoded to twice the ring size, and the number of TX pages per QPL was dictated by the device in the DQO-QPL device option. Now [in DQO-QPL mode], the driver will ignore the "tx_pages_per_qpl" parameter indicated in the DQO-QPL device option and instead allocate up to (tx_queue_length / 2) pages per TX QPL and up to (rx_queue_length * 2) pages per RX QPL while keeping the total number of pages under the "max_registered_pages". Merge DQO and GQI QPL page calculation logic into a unified gve_update_num_qpl_pages function. Add rx_pages_per_qpl to the priv struct for consumption by both DQO and GQI. Signed-off-by: Matt Olson Signed-off-by: Max Yuan Reviewed-by: Jordan Rhee Reviewed-by: Harshitha Ramamurthy Reviewed-by: Willem de Bruijn Reviewed-by: Praveen Kaligineedi Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20260225182342.1049816-2-joshwash@google.com Signed-off-by: Jakub Kicinski commit a9a13c7379ec577e676dca57aa2d7b7980aaa05b Author: Thorsten Blum Date: Thu Feb 26 22:49:29 2026 +0100 keys, dns: Use kmalloc_flex to improve dns_resolver_preparse Use kmalloc_flex() when allocating a new 'struct user_key_payload' in dns_resolver_preparse() to replace the open-coded size arithmetic. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260226214930.785423-3-thorsten.blum@linux.dev Signed-off-by: Jakub Kicinski commit 58e443b773ef054ae069cf777ba19adb99d73829 Author: Jiayuan Chen Date: Sat Feb 28 19:13:18 2026 +0800 net: fix sock compilation error under CONFIG_PREEMPT_RT When CONFIG_PREEMPT_RT is enabled, __SPIN_LOCK_UNLOCKED() expands to a brace-enclosed initializer rather than a compound literal, which cannot be used in assignment expressions. This causes a build failure: net/core/sock.c:3787:29: error: expected expression before '{' token 3787 | tmp.slock = __SPIN_LOCK_UNLOCKED(tmp.slock); Use declaration-with-initializer instead of assignment, consistent with how __SPIN_LOCK_UNLOCKED() is used elsewhere in the kernel (e.g. DEFINE_SPINLOCK). Fixes: 5151ec54f586 ("net: use try_cmpxchg() in lock_sock_nested()") Suggested-by: Eric Dumazet Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260228111319.79506-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit ba75d4dde8ca9f457c224968121239d7e05d7121 Author: Krzysztof Kozlowski Date: Thu Feb 26 21:54:47 2026 +0100 clk: samsung: Use %pe format to simplify Make code printing pointer error value a bit simpler and fix coccinelle suggestion: clk.c:363:16-23: WARNING: Consider using %pe to print PTR_ERR() Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260226205445.336839-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit b8d1706ab3d99c1f96d0c9ed7d16d29b8a178d4c Author: Krzysztof Kozlowski Date: Thu Feb 26 21:54:46 2026 +0100 clk: samsung: pll: Fix possible truncation in a9fraco recalc rate samsung_a9fraco_recalc_rate(), unlike other functions in the unit, is the first case dividing u64 by u64, thus it should rather use div64_u64 to avoid possible truncation. Note that the original code did not use remainder. This fixes Coccinelle warning: clk-pll.c:1489:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602250053.wEU1hlpY-lkp@intel.com/ Fixes: f051dc5bc8e7 ("clk: samsung: Add clock PLL support for ARTPEC-9 SoC") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260226205445.336839-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit a2be37eedb52ea26938fa4cc9de1ff84963c57ad Author: Krzysztof Kozlowski Date: Tue Feb 24 11:42:04 2026 +0100 firmware: exynos-acpm: Drop fake 'const' on handle pointer All the functions operating on the 'handle' pointer are claiming it is a pointer to const thus they should not modify the handle. In fact that's a false statement, because first thing these functions do is drop the cast to const with container_of: struct acpm_info *acpm = handle_to_acpm_info(handle); And with such cast the handle is easily writable with simple: acpm->handle.ops.pmic_ops.read_reg = NULL; The code is not correct logically, either, because functions like acpm_get_by_node() and acpm_handle_put() are meant to modify the handle reference counting, thus they must modify the handle. Modification here happens anyway, even if the reference counting is stored in the container which the handle is part of. The code does not have actual visible bug, but incorrect 'const' annotations could lead to incorrect compiler decisions. Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260224104203.42950-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit a94b4c84ae9294e4f2e398c61d94bedd56162785 Author: Raghav Sharma Date: Mon Feb 2 16:05:55 2026 +0530 arm64: dts: exynosautov920: add CMU_G3D clock DT nodes Add required dt node for cmu_g3d block, which provides clocks for G3D IP Signed-off-by: Raghav Sharma Link: https://patch.msgid.link/20260202103555.2089376-4-raghav.s@samsung.com Signed-off-by: Krzysztof Kozlowski commit 5e5f3286d66712fb49264da20e3d89534754d707 Author: Raghav Sharma Date: Mon Feb 2 16:05:54 2026 +0530 clk: samsung: exynosautov920: add block G3D clock support Add support for CMU_G3D which provides clocks to G3D block, and register the required compatible and cmu_info for the same. Signed-off-by: Raghav Sharma Link: https://patch.msgid.link/20260202103555.2089376-3-raghav.s@samsung.com Signed-off-by: Krzysztof Kozlowski commit 6e5913328102f818303b01e854df37fa9f251a47 Author: Raghav Sharma Date: Mon Feb 2 16:05:53 2026 +0530 dt-bindings: clock: exynosautov920: add G3D clock definitions Add device tree clock binding definitions for CMU_G3D Signed-off-by: Raghav Sharma Link: https://patch.msgid.link/20260202103555.2089376-2-raghav.s@samsung.com Signed-off-by: Krzysztof Kozlowski commit 862529843fb0de9b007a9423996d4cfe19cea883 Author: André Draszik Date: Tue Feb 10 11:30:43 2026 +0000 arm64: dts: exynos: gs101-pixel: add all S2MPG1x regulators Most rails are the same between Pixel 6 and Pro, with the following differences: * only Pro has UWB * Pro uses l2m, not l14m, for TCXO * Pro uses bucka, not l31m, for NFC Signed-off-by: André Draszik Link: https://patch.msgid.link/20260210-s2mpg1x-regulators-dts-v2-1-68783c9e0a32@linaro.org Signed-off-by: Krzysztof Kozlowski commit d83734a0bd253cab38b52065b2e35fa34c2d8770 Author: Ryan Wanner Date: Wed Feb 25 14:24:27 2026 +0530 ARM: dts: microchip: sama7d65: add LVDS controller Add support for LVDS controller node Signed-off-by: Ryan Wanner Signed-off-by: Manikandan Muralidharan Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20260225085430.480052-4-manikandan.m@microchip.com Signed-off-by: Claudiu Beznea commit b18c8aea6d962bfd89c6c265d7656eb45cc0e432 Author: Ryan Wanner Date: Wed Feb 25 14:24:25 2026 +0530 ARM: dts: microchip: sama7d65: add LCD controller Add support for LCD controller node Signed-off-by: Ryan Wanner Signed-off-by: Manikandan Muralidharan Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20260225085430.480052-2-manikandan.m@microchip.com [claudiu.beznea: add a space b/w the node address and the next '{'] Signed-off-by: Claudiu Beznea commit 1f17fce8bf19a48e5e5610c6da8f806eab81878a Author: Aubin Constans Date: Wed Feb 25 14:24:30 2026 +0530 ARM: configs: at91: sama7: enable LVDS serializer support Add config support to enable LVDS serializer Signed-off-by: Aubin Constans Signed-off-by: Manikandan Muralidharan Link: https://lore.kernel.org/r/20260225085430.480052-7-manikandan.m@microchip.com Signed-off-by: Claudiu Beznea commit 127090601edf9802bca2a0cf862c6ffa405c5c57 Author: Romain Sioen Date: Wed Feb 25 14:24:29 2026 +0530 ARM: configs: at91: sama7: enable config for atmel maxtouch Add config support to enable maxtouch capacitive touchscreen Signed-off-by: Romain Sioen Signed-off-by: Manikandan Muralidharan Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20260225085430.480052-6-manikandan.m@microchip.com Signed-off-by: Claudiu Beznea commit 57e5e24a5b34b154c5c027f80a44d272cc6d17d8 Author: Ryan Wanner Date: Wed Feb 25 14:24:28 2026 +0530 ARM: configs: at91: sama7: enable DRM hlcdc support Add configs for DRM Atmel LCD Controller, Backlight and Simple Panel Signed-off-by: Ryan Wanner Signed-off-by: Manikandan Muralidharan Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20260225085430.480052-5-manikandan.m@microchip.com Signed-off-by: Claudiu Beznea commit 8021729acf21f4bf3c43866b8919b68968028478 Author: Randy Dunlap Date: Wed Feb 25 21:12:57 2026 -0800 iio: tsl2772: fix all kernel-doc warnings Use the correct kernel-doc notation for struct members to eliminate kernel-doc warnings: Warning: include/linux/platform_data/tsl2772.h:88 struct member 'prox_diode' not described in 'tsl2772_settings' Warning: include/linux/platform_data/tsl2772.h:88 struct member 'prox_power' not described in 'tsl2772_settings' Signed-off-by: Randy Dunlap Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit dfe5e8fb17518e5af346a5e8139e704d63f82a11 Author: Bhargav Joshi Date: Fri Feb 27 04:40:57 2026 +0530 iio: frequency: ad9523: use octal permissions The driver currently defines device attributes using symbolic permission flags (S_IRUGO and S_IWUSR). Update these to use octal permissions (0444 and 0200) to resolve checkpatch warnings. Signed-off-by: Bhargav Joshi Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 787c9a9cdc5156d6465129caa9f9276911901f56 Author: Bhargav Joshi Date: Fri Feb 27 04:40:56 2026 +0530 iio: frequency: ad9523: fix multi-line dereferences Platform data pointer dereferences for pll1_charge_pump_current_nA and pll2_charge_pump_current_nA were split across multiple lines. Bring the dereference chains onto a single line. This resolves the following checkpatch.pl warnings: WARNING: Avoid multiple line dereference - prefer 'pdata->pll1_charge_pump_current_nA' WARNING: Avoid multiple line dereference - prefer 'pdata->pll2_charge_pump_current_nA' Signed-off-by: Bhargav Joshi Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit e830a8894ecbacd20bc8bcff9a726682ca5ef6f9 Author: Bhargav Joshi Date: Fri Feb 27 04:40:55 2026 +0530 iio: frequency: ad9523: fix implicit variable macros The macros AD9523_CLK_DIST_DIV_PHASE_REV(x) and AD9523_CLK_DIST_DIV_REV(x) implicitly relied on the variable named 'ret' instead of using passed argument '(x)'. Update the macros to explicitly use the argument '(x)' for their operations. This also resolves the following checkpatch.pl warning: Argument '(x)' is not used in function-like macro. Signed-off-by: Bhargav Joshi Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit aac15061093d14b216179b66adfff4af53dd19ab Author: Giorgi Tchankvetadze Date: Fri Feb 27 12:58:13 2026 +0400 iio: adc: ade9000: remove unused AD9000_CHANNELS_PER_PHASE macro Remove the AD9000_CHANNELS_PER_PHASE macro which is unused, has a misspelled prefix (AD9000 instead of ADE9000), and has an incorrect value (10 instead of 11, there are 33 total channels and 3 phases, so 11 per phase). Signed-off-by: Giorgi Tchankvetadze Signed-off-by: Jonathan Cameron commit 82035b16c47e3f6378ddf6b3df8c2e220d3d2085 Author: Antoniu Miclaus Date: Fri Feb 27 16:01:41 2026 +0200 iio: filter: admv8818: use dev_err_probe() Use dev_err_probe() consistently in the probe path to simplify error handling and ensure deferred probes are logged correctly. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 008120ca31a70a018b9fae7e887de8a32b1bd9a4 Author: Antoniu Miclaus Date: Fri Feb 27 16:01:40 2026 +0200 iio: filter: admv8818: add dev variable Introduce a local struct device pointer in functions that reference &spi->dev for device-managed resource calls and device property reads, improving code readability. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit bbb8e1206716b6d4c46c931d741140098618f8fb Author: Antoniu Miclaus Date: Fri Feb 27 16:01:39 2026 +0200 iio: dac: ad7293: use dev_err_probe() Use dev_err_probe() consistently in the probe path to simplify error handling and ensure deferred probes are logged correctly. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 70b9d4af16759ff606756fbd09bb5d167c4917fe Author: Antoniu Miclaus Date: Fri Feb 27 16:01:38 2026 +0200 iio: dac: ad7293: add dev variable Introduce a local struct device pointer in functions that reference &spi->dev for device-managed resource calls and device property reads, improving code readability. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 3e1c0b9501c227f2e567b20386774acc19f26c1c Author: Antoniu Miclaus Date: Fri Feb 27 16:01:37 2026 +0200 iio: frequency: adf4377: use dev_err_probe() Use dev_err_probe() consistently in the probe path to simplify error handling and ensure deferred probes are logged correctly. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit b2d2a6ea12a1a47fbab515b2a1290384ecc7fef7 Author: Antoniu Miclaus Date: Fri Feb 27 16:01:36 2026 +0200 iio: frequency: adf4377: add dev variable Introduce a local struct device pointer in functions that reference &spi->dev for device-managed resource calls and device property reads, improving code readability. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 9e9f38c44b2ed86c9a2a7583b9b88d8eec4b7793 Author: Antoniu Miclaus Date: Fri Feb 27 16:01:35 2026 +0200 iio: frequency: admv1013: use dev_err_probe() Use dev_err_probe() consistently in the probe path to simplify error handling and ensure deferred probes are logged correctly. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit e61b5bb0e91390adee41eaddc0a1a7d55d5652b2 Author: Antoniu Miclaus Date: Fri Feb 27 16:01:34 2026 +0200 iio: frequency: admv1013: add dev variable Introduce a local struct device pointer in functions that reference &spi->dev for device-managed resource calls and device property reads, improving code readability. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit b343f010d55e7a1c5a43a8d2933db99cb84af48e Author: Antoniu Miclaus Date: Fri Feb 27 16:01:33 2026 +0200 iio: frequency: admv1014: use dev_err_probe() Use dev_err_probe() consistently in the probe path to simplify error handling and ensure deferred probes are logged correctly. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 4ced084be4cfbb8ee08a79a0b09e4db3ff1ed9fa Author: Antoniu Miclaus Date: Fri Feb 27 16:01:32 2026 +0200 iio: frequency: admv1014: add dev variable Introduce a local struct device pointer in functions that reference &spi->dev for device-managed resource calls and device property reads, improving code readability. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 6faa419480ecc6647c29137e565f47c7e0d5ad23 Author: Antoniu Miclaus Date: Fri Feb 27 16:01:31 2026 +0200 iio: frequency: adrf6780: use dev_err_probe() Use dev_err_probe() consistently in the probe path to simplify error handling and ensure deferred probes are logged correctly. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 9047ea8defe2b91ea5ca88b52862e85bae0314f1 Author: Antoniu Miclaus Date: Fri Feb 27 16:01:30 2026 +0200 iio: frequency: adrf6780: add dev variable Introduce a local struct device pointer in functions that reference &spi->dev for device-managed resource calls and device property reads, improving code readability. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit b2ea0f541d354c10186a894e8bf5bf83abf8a517 Author: Ravi Bangoria Date: Mon Feb 16 04:25:30 2026 +0000 perf/amd/ibs: Advertise remote socket capability IBS OP on future hardware can indicate data source from remote socket as well. Advertise this capability to userspace so that userspace tools can decode IBS data accordingly. Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260216042530.1546-8-ravi.bangoria@amd.com commit 8ae68bfec97596a3656ce8d0a7b1240d888eab10 Author: Ravi Bangoria Date: Mon Feb 16 04:25:29 2026 +0000 perf/amd/ibs: Enable streaming store filter IBS OP on future hardware supports recording samples only for instructions that does streaming store. Like the existing IBS filters, samples pointing to instruction which does not cause streaming store are discarded and IBS restarts internally. Example: $ perf record -e ibs_op/strmst=1/ -- Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260216042530.1546-7-ravi.bangoria@amd.com commit 8c63c4af92ac5f041ce437c1f2a31ce3ef03c585 Author: Ravi Bangoria Date: Mon Feb 16 04:25:28 2026 +0000 perf/amd/ibs: Enable RIP bit63 hardware filtering IBS on future hardware adds the ability to filter IBS events by examining RIP bit 63. Because Linux kernel addresses always have bit 63 set while user-space addresses never do, this capability can be used as a privilege filter. So far, IBS supports privilege filtering in software (swfilt=1), where samples are dropped in the NMI handler. The RIP bit63 hardware filter enables IBS to be usable by unprivileged users without passing swfilt flag. So, swfilt flag will silently be ignored when the hardware filtering capability is present. Example (non-root user): $ perf record -e ibs_op//u -- Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260216042530.1546-6-ravi.bangoria@amd.com commit 35247fa60b74e1c643423c3bc7c6a59cbca262bb Author: Ravi Bangoria Date: Mon Feb 16 04:25:27 2026 +0000 perf/amd/ibs: Enable fetch latency filtering IBS Fetch on future hardware adds fetch latency filtering which generates interrupt only when FetchLat value exceeds a programmable threshold. Hardware allows threshold in 128-cycle increment (i.e. 128, 256, 384 etc.) from 128 to 1920 cycles. Like the existing IBS filters, samples that fail the latency test are dropped and IBS restarts internally. Since hardware supports threshold in multiple of 128, add a software filter on top to support latency threshold with the granularity of 1 cycle in between [128-1920]. Example: # perf record -e ibs_fetch/fetchlat=128/ -c 10000 -a -- sleep 5 Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260216042530.1546-5-ravi.bangoria@amd.com commit efa5700ec0da66662dc8375fe4e4b888487a6b84 Author: Ravi Bangoria Date: Mon Feb 16 04:25:26 2026 +0000 perf/amd/ibs: Support IBS_{FETCH|OP}_CTL2[Dis] to eliminate RMW race The existing IBS_{FETCH|OP}_CTL MSRs combine control and status bits which leads to RMW race between HW and SW: HW SW ------------------------ ------------------------------ config = rdmsr(IBS_OP_CTL); config &= ~EN; Set IBS_OP_CTL[Val] to 1 trigger NMI wrmsr(IBS_OP_CTL, config); // Val is accidentally cleared Future hardware adds a control-only MSR, IBS_{FETCH|OP}_CTL2, which provides a second-level "disable" bit (Dis). IBS is now: Enabled: IBS_{FETCH|OP}_CTL[En] = 1 && IBS_{FETCH|OP}_CTL2[Dis] = 0 Disabled: IBS_{FETCH|OP}_CTL[En] = 0 || IBS_{FETCH|OP}_CTL2[Dis] = 1 The separate "Dis" bit lets software disable IBS without touching any status fields, eliminating the hardware/software race. Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260216042530.1546-4-ravi.bangoria@amd.com commit a69f67702091429316bf7b8dd2c7a405e8c26a65 Author: Christophe JAILLET Date: Thu Feb 26 21:44:10 2026 +0100 ALSA: aoa: Constify struct codec_connection 'struct codec_connection' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 10034 3392 12 13438 347e sound/aoa/fabrics/layout.o After: ===== text data bss dec hex filename 10370 3040 12 13422 346e sound/aoa/fabrics/layout.o Signed-off-by: Christophe JAILLET Link: https://patch.msgid.link/4009c337cc1a1a57795562279270c03687973b3b.1772138640.git.christophe.jaillet@wanadoo.fr Signed-off-by: Takashi Iwai commit 84446536f63d471ab16b2faa25eeab1df21ace0a Author: Cezary Rojewski Date: Tue Feb 24 21:56:19 2026 +0100 ALSA: control: Verify put() result when in debug mode The put() operation is expected to return: 1) 0 on success if no changes were made 2) 1 on success if changes were made 3) error code otherwise Currently 2) is usually ignored when writing control-operations. While forcing compliance is not an option right now, make it easier for developers to adhere to the expectations and notice problems by logging them when CONFIG_SND_CTL_DEBUG is enabled. Due to large size of struct snd_ctl_elem_value, 'value_buf' is provided as a reusable buffer for kctl->put() verification. This prevents exhausting the stack when verifying the operation. >From user perspective, patch introduces a new trace/events category 'snd_ctl' containing a single 'snd_ctl_put' event type. Log sample: amixer-1086 [003] ..... 8.035939: snd_ctl_put: success: expected=0, actual=0 for ctl numid=1, iface=MIXER, name='Master Playback Volume', index=0, device=0, subdevice=0, card=0 amixer-1087 [003] ..... 8.938721: snd_ctl_put: success: expected=1, actual=1 for ctl numid=1, iface=MIXER, name='Master Playback Volume', index=0, device=0, subdevice=0, card=0 amixer-1088 [003] ..... 9.631470: snd_ctl_put: success: expected=1, actual=1 for ctl numid=1, iface=MIXER, name='Master Playback Volume', index=0, device=0, subdevice=0, card=0 amixer-1089 [000] ..... 9.636786: snd_ctl_put: fail: expected=1, actual=0 for ctl numid=5, iface=MIXER, name='Loopback Mute', index=0, device=0, subdevice=0, card=0 Signed-off-by: Cezary Rojewski Reviewed-by: Mark Brown Reviewed-by: Jaroslav Kysela Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260224205619.584795-1-cezary.rojewski@intel.com commit 1eb6c478f1edc4384d8fea765cd13ac01199e8b5 Author: Abhinaba Rakshit Date: Thu Feb 19 15:09:13 2026 +0530 dt-bindings: crypto: ice: add operating-points-v2 property for QCOM ICE Add support for specifying OPPs for the Qualcomm Inline Crypto Engine by allowing the use of the standard "operating-points-v2" property in the ICE device node. ICE clock management was handled by the storage drivers in legacy bindings, so the ICE driver itself had no mechanism for clock scaling. With the introduction of the new standalone ICE device node, clock control must now be performed directly by the ICE driver. Enabling operating-points-v2 allows the driver to describe and manage the frequency and voltage requirements for proper DVFS operation. Acked-by: Rob Herring (Arm) Signed-off-by: Abhinaba Rakshit Signed-off-by: Herbert Xu commit 635c3a757a567b2479639237f5f0d4d9439015f1 Author: Thorsten Blum Date: Mon Feb 16 08:45:51 2026 +0100 crypto: atmel-sha204a - Fix OTP sysfs read and error handling Fix otp_show() to read and print all 64 bytes of the OTP zone. Previously, the loop only printed half of the OTP (32 bytes), and partial output was returned on read errors. Propagate the actual error from atmel_sha204a_otp_read() instead of producing partial output. Replace sprintf() with sysfs_emit_at(), which is preferred for formatting sysfs output because it provides safer bounds checking. Cc: stable@vger.kernel.org Fixes: 13909a0c8897 ("crypto: atmel-sha204a - provide the otp content") Signed-off-by: Thorsten Blum Reviewed-by: Lothar Rubusch Signed-off-by: Herbert Xu commit 094c276da6a0d4971c3faae09a36b51d096659b2 Author: Thorsten Blum Date: Sun Feb 15 21:51:53 2026 +0100 crypto: atmel-sha204a - Fix error codes in OTP reads Return -EINVAL from atmel_i2c_init_read_otp_cmd() on invalid addresses instead of -1. Since the OTP zone is accessed in 4-byte blocks, valid addresses range from 0 to OTP_ZONE_SIZE / 4 - 1. Fix the bounds check accordingly. In atmel_sha204a_otp_read(), propagate the actual error code from atmel_i2c_init_read_otp_cmd() instead of -1. Also, return -EIO instead of -EINVAL when the device is not ready. Cc: stable@vger.kernel.org Fixes: e05ce444e9e5 ("crypto: atmel-sha204a - add reading from otp zone") Signed-off-by: Thorsten Blum Reviewed-by: Lothar Rubusch Signed-off-by: Herbert Xu commit b7abbc8c7acaeb60c114b038f1fa91bbedb3d16a Author: Aleksander Jan Bajkowski Date: Sun Feb 8 11:35:53 2026 +0100 crypto: inside-secure/eip93 - fix register definition Checked the register definitions with the documentation[1]. Turns out that the PKTE_INBUF_CNT register has a bad offset. It's used in Direct Host Mode (DHM). The driver uses Autonomous Ring Mode (ARM), so it causes no harm. 1. ADSP-SC58x/ADSP-2158x SHARC+ Processor Hardware Reference Fixes: 9739f5f93b78 ("crypto: eip93 - Add Inside Secure SafeXcel EIP-93 crypto engine support") Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit 2127a1bf8940ea76b4fc604fa6b5e4d734ca22ed Author: Pat Somaru Date: Sat Feb 7 13:20:01 2026 -0500 crypto: virtio - Convert from tasklet to BH workqueue The only generic interface to execute asynchronously in the BH context is tasklet; however, it's marked deprecated and has some design flaws such as the execution code accessing the tasklet item after the execution is complete which can lead to subtle use-after-free in certain usage scenarios and less-developed flush and cancel mechanisms. To replace tasklets, BH workqueue support was recently added. A BH workqueue behaves similarly to regular workqueues except that the queued work items are executed in the BH context. Convert virtio_crypto_core.c from tasklet to BH workqueue. Semantically, this is an equivalent conversion and there shouldn't be any user-visible behavior changes. The BH workqueue implementation uses the same softirq infrastructure, and performance-critical networking conversions have shown no measurable performance impact. Signed-off-by: Pat Somaru Signed-off-by: Herbert Xu commit 404ba6b46b6e234384b962210a98931f7423f139 Author: Aleksander Jan Bajkowski Date: Sat Feb 7 15:51:03 2026 +0100 crypto: testmgr - Add test vectors for authenc(hmac(md5),cbc(des)) Test vector was generated using a software implementation and then double checked on Mediatek MT7981 (safexcel) and NXP P2020 (talitos). Both platforms pass self-tests. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit 0441ee8d35ad6998da5043c65c4124904e8daee2 Author: Aleksander Jan Bajkowski Date: Fri Feb 6 20:26:59 2026 +0100 crypto: tesmgr - allow authenc(hmac(sha224/sha384),cbc(aes)) in fips mode The remaining combinations of AES-CBC and SHA* have already been marked as allowed. This commit does the same for SHA224 and SHA384. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit f050e4209ab0ba3f13bb6272a07ce87cbea922c9 Author: Aleksander Jan Bajkowski Date: Tue Feb 3 19:21:52 2026 +0100 crypto: safexcel - Add support for authenc(hmac(md5),*) suites This patch adds support for the following AEAD ciphersuites: - authenc(hmac(md5),cbc(aes)) - authenc(hmac(md5),cbc(des))) - authenc(hmac(md5),cbc(des3_ede)) - authenc(hmac(md5),rfc3686(ctr(aes))) The first three ciphersuites were tested using testmgr and the recently sent test vectors. They passed self-tests. This is enhanced version of the patch found in the mtk-openwrt-feeds repo. Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Antoine Tenart Signed-off-by: Herbert Xu commit c75daa3730132c55dea7cc9c0f8818aea491fe0c Author: Aleksander Jan Bajkowski Date: Tue Feb 3 19:21:51 2026 +0100 crypto: safexcel - Group authenc ciphersuites Move authenc(sha1,des) and authenc(sha1,3des) ciphersuites to appropriate groups. No functional changes intended. Signed-off-by: Aleksander Jan Bajkowski Acked-by: Antoine Tenart Signed-off-by: Herbert Xu commit 476466e927ab5354dae90ea0bc3353cfcec0646a Author: Thorsten Blum Date: Tue Feb 3 00:01:17 2026 +0100 crypto: caam - Replace snprintf with strscpy in caam_hash_alloc Replace snprintf("%s", ...) with the faster and more direct strscpy(). Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit a4559a2b37ebbbd3c23041125624f55ef36905d1 Author: Thorsten Blum Date: Mon Feb 2 18:33:21 2026 +0100 crypto: octeontx - Replace scnprintf with strscpy in print_ucode_info Replace scnprintf("%s", ...) with the faster and more direct strscpy(). Remove the parentheses while we're at it. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 1e08faf996c3dc7baf584ba72e52215a3d028a8f Merge: 57cc8ab3e9f2c4 621e3634dfab89 Author: Jakub Kicinski Date: Fri Feb 27 19:25:19 2026 -0800 Merge branch 'net-ethernet-litex-minor-improvment-for-the-codebase' Inochi Amaoto says: ==================== net: ethernet: litex: minor improvment for the codebase Improve the litex code for using the device managed function to register netdev and replace all the "pdev->dev" with dev pointer instead. ==================== Link: https://patch.msgid.link/20260227003351.752934-1-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit 621e3634dfab890e8d97e082588b3d6d6d688d91 Author: Inochi Amaoto Date: Fri Feb 27 08:33:48 2026 +0800 net: ethernet: litex: use device pointer to simplify code. As there is already a device pointer in the probe function, replace all "&pdev->dev" pattern with this predefined device pointer. Signed-off-by: Inochi Amaoto Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260227003351.752934-3-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit 97c55c1298ac89f4dc00c055a593c13004141661 Author: Inochi Amaoto Date: Fri Feb 27 08:33:47 2026 +0800 net: ethernet: litex: use devm_register_netdev() to register netdev Use devm_register_netdev to avoid unnecessary remove() callback in platform_driver structure. Signed-off-by: Inochi Amaoto Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260227003351.752934-2-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit 57cc8ab3e9f2c460204bc8facb7932b9b53be878 Author: Leon Kral Date: Fri Feb 27 00:07:47 2026 +0000 net/handshake: Fixed grammar mistake The word "a" was used instead of "an" which is grammatically incorrect. Fixed by changing from "a" to "an". This improves readability of the documentation. Signed-off-by: Leon Kral Reviewed-by: Alistair Francis Link: https://patch.msgid.link/20260227001151.41610-1-leon.j.kral@protonmail.com Signed-off-by: Jakub Kicinski commit 2164242c50084bd5b359b7d554d3a124e2c19074 Author: Randy Dunlap Date: Thu Feb 26 14:10:04 2026 -0800 NFC: fix header file kernel-doc warnings Repair some of the comments: - use the correct enum names - don't use "/**" for a non-kernel-doc comment to fix these warnings: Warning: include/uapi/linux/nfc.h:127 Excess enum value '@NFC_EVENT_DEVICE_DEACTIVATED' description in 'nfc_commands' Warning: include/uapi/linux/nfc.h:204 Excess enum value '@NFC_ATTR_APDU' description in 'nfc_attrs' Warning: include/uapi/linux/nfc.h:302 expecting prototype for Pseudo(). Prototype was for NFC_RAW_HEADER_SIZE() instead Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260226221004.1037909-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 6466441a5ecd1c1168264e4c322bae455579b156 Author: Eric Dumazet Date: Thu Feb 26 04:12:13 2026 +0000 net: inline skb_add_rx_frag_netmem() This critical helper (via skb_add_rx_frag()) is mostly used from drivers rx fast path. It is time to inline it, this actually saves space in vmlinux: size vmlinux.old vmlinux text data bss dec hex filename 37350766 23092977 4846992 65290735 3e441ef vmlinux.old 37350600 23092977 4846992 65290569 3e44149 vmlinux Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260226041213.1892561-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9ff2d2a9837015ff4b3579b028aeae8c180aa8d3 Author: Fernando Fernandez Mancera Date: Wed Feb 25 14:37:58 2026 +0100 ipv6: discard fragment queue earlier if there is malformed datagram Currently the kernel IPv6 implementation is not dicarding the fragment queue upon receiving a IPv6 fragment that is not 8 bytes aligned. It relies on queue expiration to free the queue. While RFC 8200 section 4.5 does not explicitly mention that the rest of fragments must be discarded, it does not make sense to keep them. The parameter problem message is sent regardless that. In addition, if the sender is able to re-compose the datagram so it is 8 bytes aligned it would qualify as a new whole datagram not fitting into the same fragment queue. The same situation happens if segment end is exceeding the IPv6 maximum packet length. The sooner we can free resources the better during reassembly, the better. Signed-off-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260225133758.4553-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit e6eb3a0584628f84e6f3fcf258fba8fd11f42d2e Author: Colin Ian King Date: Fri Feb 27 23:18:54 2026 +0000 ntfs: Fix spelling mistake "initiailized" -> "initialized" There is a spelling mistake in an ntfs_debug message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Namjae Jeon commit e8e83b67960c20a9e60d4181631509d59f03488b Author: Birger Koblitz Date: Tue Feb 24 18:40:14 2026 +0100 r8152: Add 2500baseT EEE status/configuration support The r8152 driver supports the RTL8156, which is a 2.5Gbit Ethernet controller for USB 3.0, for which support is added for configuring and displaying the EEE advertisement status for 2.5GBit connections. The patch also corrects the determination of whether EEE is active to include the 2.5GBit connection status and make the determination dependent not on the desired speed configuration (tp->speed), but on the actual speed used by the controller. For consistency, this is corrected also for the RTL8152/3. This was tested on an Edimax EU-4307 V1.0 USB-Ethernet adapter with RTL8156, and a SECOMP Value 12.99.1115 USB-C 3.1 Ethernet converter with RTL8153. Signed-off-by: Birger Koblitz Link: https://patch.msgid.link/20260224-b4-eee2g5-v2-1-cf5c83df036e@birger-koblitz.de Signed-off-by: Jakub Kicinski commit c31770c49348fb019167fa95119f330597c99193 Author: Aaron Tomlin Date: Thu Feb 26 11:31:21 2026 -0500 vmxnet3: Suppress page allocation warning for massive Rx Data ring The vmxnet3 driver supports an Rx Data ring (rx-mini) to optimise the processing of small packets. The size of this ring's DMA-coherent memory allocation is determined by the product of the primary Rx ring size and the data ring descriptor size: sz = rq->rx_ring[0].size * rq->data_ring.desc_size; When a user configures the maximum supported parameters via ethtool (rx_ring[0].size = 4096, data_ring.desc_size = 2048), the required contiguous memory allocation reaches 8 MB (8,388,608 bytes). In environments lacking Contiguous Memory Allocator (CMA), dma_alloc_coherent() falls back to the standard zone buddy allocator. An 8 MB allocation translates to a page order of 11, which strictly exceeds the default MAX_PAGE_ORDER (10) on most architectures. Consequently, __alloc_pages_noprof() catches the oversize request and triggers a loud kernel warning stack trace: WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) This warning is unnecessary and alarming to system administrators because the vmxnet3 driver already handles this allocation failure gracefully. If dma_alloc_coherent() returns NULL, the driver safely disables the Rx Data ring (adapter->rxdataring_enabled = false) and falls back to standard, streaming DMA packet processing. To resolve this, append the __GFP_NOWARN flag to the dma_alloc_coherent() gfp_mask. This instructs the page allocator to silently fail the allocation if it exceeds order limits or memory is too fragmented, preventing the spurious warning stack trace. Furthermore, enhance the subsequent netdev_err() fallback message to include the requested allocation size. This provides critical debugging context to the administrator (e.g., revealing that an 8 MB allocation was attempted and failed) without making hardcoded assumptions about the state of the system's configurations. Reviewed-by: Jijie Shao Signed-off-by: Aaron Tomlin Link: https://patch.msgid.link/20260226163121.4045808-1-atomlin@atomlin.com Signed-off-by: Jakub Kicinski commit 9a04d3b2f0708a9e5e1f731bafb69b040bb934a0 Author: Joris Vaisvila Date: Thu Feb 26 15:45:18 2026 +0000 net: ethernet: mtk_eth_soc: avoid writing to ESW registers on MT7628 The MT7628 has a fixed-link PHY and does not expose MAC control registers. Writes to these registers only corrupt the ESW VLAN configuration. This patch explicitly registers no-op phylink_mac_ops for MT7628, as after removing the invalid register accesses, the existing phylink_mac_ops effectively become no-ops. This code was introduced by commit 296c9120752b ("net: ethernet: mediatek: Add MT7628/88 SoC support") Signed-off-by: Joris Vaisvila Reviewed-by: Daniel Golle Reviewed-by: Stefan Roese Link: https://patch.msgid.link/20260226154547.68553-1-joey@tinyisr.com Signed-off-by: Jakub Kicinski commit da89f2e3121531804f45abd33db05b432e42606c Author: Sabrina Dubroca Date: Thu Feb 26 15:26:27 2026 +0100 tls: don't select STREAM_PARSER ktls was converted to its own stream parser in commit 84c61fe1a75b ("tls: rx: do not use the standard strparser"), but the Kconfig dependency was left. The only part of the original strparser that's shared with ktls are a few structs (strp_msg, sk_skb_cb) and the strp_msg helper, those don't require building the net/strparser code. Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/cb41e513a30eeaac0b419284cc87433f049b2ee0.1771871995.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 5151ec54f5861ad71e08190a7ce2173df788d36a Author: Eric Dumazet Date: Thu Feb 26 02:12:15 2026 +0000 net: use try_cmpxchg() in lock_sock_nested() Add a fast path in lock_sock_nested(), to avoid acquiring the socket spinlock only to set @owned to one: spin_lock_bh(&sk->sk_lock.slock); if (unlikely(sock_owned_by_user_nocheck(sk))) __lock_sock(sk); sk->sk_lock.owned = 1; spin_unlock_bh(&sk->sk_lock.slock); On x86_64 compiler generates something quite efficient: 00000000000077c0 : 77c0: f3 0f 1e fa endbr64 77c4: e8 00 00 00 00 call __fentry__ 77c9: b9 01 00 00 00 mov $0x1,%ecx 77ce: 31 c0 xor %eax,%eax 77d0: f0 48 0f b1 8f 48 01 00 00 lock cmpxchg %rcx,0x148(%rdi) 77d9: 75 06 jne slow_path 77db: 2e e9 00 00 00 00 cs jmp __x86_return_thunk-0x4 slow_path: ... Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Reviewed-by: Jason Xing Link: https://patch.msgid.link/20260226021215.1764237-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b99ccb37eda85a9070d1f9f275fc8ca1f4e33024 Author: Kexin Sun Date: Wed Feb 25 22:51:59 2026 +0800 net/hsr: update outdated comments The function hsr_rcv() was renamed hsr_handle_frame() and moved to net/hsr/hsr_slave.c by commit 81ba6afd6e64 ("net/hsr: Switch from dev_add_pack() to netdev_rx_handler_register()"). Update all remaining references in the comments accordingly. Signed-off-by: Kexin Sun Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260225145159.2953-1-kexinsun@smail.nju.edu.cn Signed-off-by: Jakub Kicinski commit 11c0663a595801b6e6f7a937adec8532706ef486 Author: Jens Emil Schulz Østergaard Date: Thu Feb 26 09:24:19 2026 +0100 net: phy: micrel: Add support for lan9645x internal phy LAN9645X is a family of switch chips with 5 internal copper phys. The internal PHY is based on parts of LAN8832. This is a low-power, single port triple-speed (10BASE-T/100BASE-TX/1000BASE-T) ethernet physical layer transceiver (PHY) that supports transmission and reception of data on standard CAT-5, as well as CAT-5e and CAT-6 Unshielded Twisted Pair (UTP) cables. Add support for the internal PHY of the lan9645x chip family. Reviewed-by: Steen Hegelund Reviewed-by: Daniel Machon Signed-off-by: Jens Emil Schulz Østergaard Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260226-phy_micrel_add_support_for_lan9645x_internal_phy-v3-1-1fe82379962b@microchip.com Signed-off-by: Jakub Kicinski commit 60477d78971342c476e221b643e56ed0dce8e888 Author: Song Hongyi Date: Wed Feb 25 17:38:14 2026 +0800 of: property: fix typo in kernel-doc return description Fix the spelling of "success" in the return value description of the kernel-doc comment to improve documentation quality. Signed-off-by: Song Hongyi Link: https://patch.msgid.link/20260225093814.124735-1-szpcq123@gmail.com Signed-off-by: Rob Herring (Arm) commit 28f060c4b0667a7fbed9818ef19b6974d53ad708 Author: Kenny Cheng Date: Mon Feb 23 07:47:15 2026 +0800 of: fix incorrect device creation for reserved memory nodes The current global search for nodes in reserved_mem_matches can find nodes outside "/reserved-memory". These nodes might not have actual memory reserved (via memblock), leading to drivers (e.g., ramoops) accessing unreserved memory and causing memory corruption. Restrict the scan to the "/reserved-memory" node to ensure created devices are correctly backed by reserved memory. This enforces specification compliance and avoids dangerous probing. Signed-off-by: Kenny Cheng Link: https://patch.msgid.link/20260222234715.1748302-1-chao.shun.cheng.tw@gmail.com Signed-off-by: Rob Herring (Arm) commit 591230c6f268306a673112fc3c3b74ab06fa9ee3 Author: Armin Wolf Date: Wed Feb 4 22:29:31 2026 +0100 ACPI: OSL: Poweroff when encountering a fatal ACPI error The ACPI spec states that the operating system should respond to a fatal ACPI error by "performing a controlled OS shutdown in a timely fashion". Comply with the ACPI specification by powering off the system when ACPICA signals a fatal ACPI error. Users can still disable this behavior by using the acpi.poweroff_on_fatal kernel option to work around firmware bugs. Link: https://uefi.org/specs/ACPI/6.6/19_ASL_Reference.html#fatal-fatal-error-check Signed-off-by: Armin Wolf [ rjw: Dropped the new Kconfig option, adjusted header file inclusions ] Link: https://patch.msgid.link/20260204212931.3860-1-W_Armin@gmx.de Signed-off-by: Rafael J. Wysocki commit aef50ed5b23918345478adf5224a059dfff87df1 Author: Vijay Sundar Selvamani Date: Fri Feb 13 09:14:03 2026 +0000 vfio/qat: extend Kconfig dependencies for 420xx and 6xxx devices Currently, the QAT VFIO PCI driver can only be configured when the 4xxx QAT driver (CRYPTO_DEV_QAT_4XXX) is enabled. This is too restrictive as the VFIO driver also supports VFs from the 420xx and 6xxx device families, which share a compatible migration interface. Extends the Kconfig dependencies to allow configuration when any of the supported QAT device families (4xxx, 420xx, or 6xxx) are enabled. Signed-off-by: Vijay Sundar Selvamani Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Link: https://lore.kernel.org/r/20260213091403.72338-1-suman.kumar.chakraborty@intel.com Signed-off-by: Alex Williamson commit 856250ba2e810e772dc95b3234ebf0d6393a51d9 Author: Sumit Gupta Date: Fri Feb 6 19:56:58 2026 +0530 cpufreq: CPPC: Add sysfs documentation for perf_limited Add ABI documentation for the Performance Limited Register sysfs interface in the cppc_cpufreq driver. Signed-off-by: Sumit Gupta Reviewed-by: Randy Dunlap Reviewed-by: Pierre Gondois Reviewed-by: Lifeng Zheng Link: https://patch.msgid.link/20260206142658.72583-8-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki commit 13c45a26635fa51a68911aa57e6778bdad18b103 Author: Sumit Gupta Date: Fri Feb 6 19:56:57 2026 +0530 ACPI: CPPC: add APIs and sysfs interface for perf_limited Add sysfs interface to read/write the Performance Limited register. The Performance Limited register indicates to the OS that an unpredictable event (like thermal throttling) has limited processor performance. It contains two sticky bits set by the platform: - Bit 0 (Desired_Excursion): Set when delivered performance is constrained below desired performance. Not used when Autonomous Selection is enabled. - Bit 1 (Minimum_Excursion): Set when delivered performance is constrained below minimum performance. These bits remain set until OSPM explicitly clears them. The write operation accepts a bitmask of bits to clear: - Write 0x1 to clear bit 0 - Write 0x2 to clear bit 1 - Write 0x3 to clear both bits This enables users to detect if platform throttling impacted a workload. Users clear the register before execution, run the workload, then check afterward - if set, hardware throttling occurred during that time window. The interface is exposed as: /sys/devices/system/cpu/cpuX/cpufreq/perf_limited Signed-off-by: Sumit Gupta Reviewed-by: Pierre Gondois Reviewed-by: Lifeng Zheng Link: https://patch.msgid.link/20260206142658.72583-7-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki commit ea3db45ae476889a1ba0ab3617e6afdeeefbda3d Author: Sumit Gupta Date: Fri Feb 6 19:56:56 2026 +0530 cpufreq: cppc: Update MIN_PERF/MAX_PERF in target callbacks Update MIN_PERF and MAX_PERF registers from policy->min and policy->max in the .target() and .fast_switch() callbacks. This allows controlling performance bounds via standard scaling_min_freq and scaling_max_freq sysfs interfaces. Similar to intel_cpufreq which updates HWP min/max limits in .target(), cppc_cpufreq now programs MIN_PERF/MAX_PERF along with DESIRED_PERF. Since MIN_PERF/MAX_PERF can be updated even when auto_sel is disabled, they are updated unconditionally. Also program MIN_PERF/MAX_PERF in store_auto_select() when enabling autonomous selection so the platform uses correct bounds immediately. Suggested-by: Rafael J. Wysocki Signed-off-by: Sumit Gupta Link: https://patch.msgid.link/20260206142658.72583-6-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki commit 24ad4c6c136bdaa4c92c5c5948856752ce3e9f76 Author: Sumit Gupta Date: Fri Feb 6 19:56:55 2026 +0530 cpufreq: CPPC: Update cached perf_ctrls on sysfs write Update the cached perf_ctrls values when writing via sysfs to keep them in sync with hardware registers: - store_auto_select(): update perf_ctrls.auto_sel - store_energy_performance_preference_val(): update perf_ctrls.energy_perf This ensures consistent cached values after sysfs writes, which complements the cppc_get_perf() initialization during policy setup. Signed-off-by: Sumit Gupta Reviewed-by: Pierre Gondois Reviewed-by: Lifeng Zheng Link: https://patch.msgid.link/20260206142658.72583-5-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki commit 38428a680026c52a1fc64212325d161974c3e4cf Author: Sumit Gupta Date: Fri Feb 6 19:56:54 2026 +0530 ACPI: CPPC: Extend cppc_set_epp_perf() for FFH/SystemMemory Extend cppc_set_epp_perf() to write both auto_sel and energy_perf registers when they are in FFH or SystemMemory address space. This keeps the behavior consistent with PCC case where both registers are already updated together, but was missing for FFH/SystemMemory. Signed-off-by: Sumit Gupta Reviewed-by: Pierre Gondois Reviewed-by: Lifeng Zheng Link: https://patch.msgid.link/20260206142658.72583-4-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki commit b3e45fb2db9d8a733e94b315f1272e2c4468ed4b Author: Sumit Gupta Date: Fri Feb 6 19:56:53 2026 +0530 ACPI: CPPC: Warn on missing mandatory DESIRED_PERF register Add a warning during CPPC processor probe if the Desired Performance register is not supported when it should be. As per 8.4.6.1.2.3 section of ACPI 6.6 specification, "The Desired Performance Register is optional only when OSPM indicates support for CPPC2 in the platform-wide _OSC capabilities and the Autonomous Selection Enable field is encoded as an Integer with a value of 1." In other words: - In CPPC v1, DESIRED_PERF is mandatory - In CPPC v2, it becomes optional only when AUTO_SEL_ENABLE is supported This helps detect firmware configuration issues early during boot. Link: https://lore.kernel.org/lkml/9fa21599-004a-4af8-acc2-190fd0404e35@nvidia.com/ Suggested-by: Pierre Gondois Signed-off-by: Sumit Gupta Reviewed-by: Pierre Gondois Reviewed-by: Lifeng Zheng Link: https://patch.msgid.link/20260206142658.72583-3-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki commit 658fa7b1c47a857af484c5c5dff8d0164b7c7bfb Author: Sumit Gupta Date: Fri Feb 6 19:56:52 2026 +0530 ACPI: CPPC: Add cppc_get_perf() API to read performance controls Add cppc_get_perf() function to read values of performance control registers including desired_perf, min_perf, max_perf, energy_perf, and auto_sel. This provides a read interface to complement the existing cppc_set_perf() write interface for performance control registers. Note that auto_sel is read by cppc_get_perf() but not written by cppc_set_perf() to avoid unintended mode changes during performance updates. It can be updated with existing dedicated cppc_set_auto_sel() API. Use cppc_get_perf() in cppc_cpufreq_get_cpu_data() to initialize perf_ctrls with current hardware register values during cpufreq policy initialization. Signed-off-by: Sumit Gupta Reviewed-by: Pierre Gondois Reviewed-by: Lifeng Zheng Link: https://patch.msgid.link/20260206142658.72583-2-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki commit 0bd96853ba723bc3b174e0158a4499758e3296aa Author: Sebastian Andrzej Siewior Date: Fri Feb 27 18:01:03 2026 +0100 efi: Allow to expose the workqueue via sysfs Exposing the efi_rts_wq workqueue via sysfs provides an easy mechanism to restrict EFI firmware invocation to certain CPU(s). This can be used to restrict EFI invocations to specific CPUs while allowing other workqueue to use the remaning CPUs. Expose the workqueue via sysfs. Change the name to efi_runtime which is what will be visible under sysfs. Signed-off-by: Sebastian Andrzej Siewior Acked-by: Ard Biesheuvel Signed-off-by: Tejun Heo commit a4aa8d94f24317338cf6f62eb3267ad99a2ff7f7 Author: Sebastian Andrzej Siewior Date: Fri Feb 27 18:01:02 2026 +0100 workqueue: Allow to expose ordered workqueues via sysfs Ordered workqueues are not exposed via sysfs because the 'max_active' attribute changes the number actives worker. More than one active worker can break ordering guarantees. This can be avoided by forbidding writes the file for ordered workqueues. Exposing it via sysfs allows to alter other attributes such as the cpumask on which CPU the worker can run. The 'max_active' value shouldn't be changed for BH worker because the core never spawns additional worker and the worker itself can not be preempted. So this make no sense. Allow to expose ordered workqueues via sysfs if requested and forbid changing 'max_active' value for ordered and BH worker. Signed-off-by: Sebastian Andrzej Siewior Acked-by: Tejun Heo Acked-by: Ard Biesheuvel Signed-off-by: Tejun Heo commit ab05515757fcb77edbbe7c68fbc7c0c930c0f668 Author: Romain Sioen Date: Fri Feb 6 17:31:53 2026 +0100 HID: mcp2221: use mcp_i2c_smbus_read for block reads Refactor mcp_smbus_xfer() to use the mcp_i2c_smbus_read() helper function for I2C_SMBUS_BLOCK_DATA and I2C_SMBUS_I2C_BLOCK_DATA read operations. This replaces the manual setup of the receive buffer and explicit calls to mcp_send_data_req_status(), making the code cleaner and more consistent with other read paths in the driver. Signed-off-by: Romain Sioen Signed-off-by: Marius Cristea Signed-off-by: Jiri Kosina commit e1092d5e15e6a9b168bf830af9a26d7ea17cd57d Author: Mika Westerberg Date: Tue Feb 24 12:10:44 2026 +0100 PCI/PTM: Do not enable PTM automatically for Root and Switch Upstream Ports Currently we enable PTM automatically for Root and Switch Upstream Ports if the advertised capabilities support the relevant role. However, there are a few issues with this. First of all, if there is no Endpoint that actually needs the PTM functionality, this is just wasting link bandwidth. There are just a couple of drivers calling pci_ptm_enable() in the tree. Secondly, we do the enablement in pci_ptm_init() that is called pretty early for the Switch Upstream Port before Downstream Ports are even enumerated. Since the Upstream Port configuration affects the whole Switch, enabling it this early might cause PTM requests to be sent. We actually do see effects of this: pcieport 0000:00:07.1: pciehp: Slot(6-1): Card present pcieport 0000:00:07.1: pciehp: Slot(6-1): Link Up pci 0000:2c:00.0: [8086:5786] type 01 class 0x060400 PCIe Switch Upstream Port ... pci 0000:2c:00.0: PTM enabled, 4ns granularity At this point we have only enumerated the Switch Upstream Port and now PTM got enabled which immediately triggers a flood of errors: pcieport 0000:00:07.1: AER: Multiple Uncorrectable (Non-Fatal) error message received from 0000:00:07.1 pcieport 0000:00:07.1: PCIe Bus Error: severity=Uncorrectable (Non-Fatal), type=Transaction Layer, (Receiver ID) pcieport 0000:00:07.1: device [8086:d44f] error status/mask=00200000/00000000 pcieport 0000:00:07.1: [21] ACSViol (First) pcieport 0000:00:07.1: AER: TLP Header: 0x34000000 0x00000052 0x00000000 0x00000000 pcieport 0000:00:07.1: AER: device recovery successful pcieport 0000:00:07.1: AER: Uncorrectable (Non-Fatal) error message received from 0000:00:07.1 In the above TLP Header the Requester ID is 0 which causes an error as we have ACS Source Validation enabled. Change the PTM enablement to happen at the time pci_enable_ptm() is called. It will try to enable PTM first for upstream devices before enabling for the Endpoint itself. For disable path we need to keep count of how many times PTM has been enabled and disable it only on the last, so change the dev->ptm_enabled to a counter (and rename it to dev->ptm_enable_cnt analogous to dev->pci_enable_cnt). Signed-off-by: Mika Westerberg Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260224111044.3487873-6-mika.westerberg@linux.intel.com commit 4a91a33f15c634fb3477d122bdf1eef098d77ee3 Author: Mallesh Koujalagi Date: Fri Feb 27 14:24:01 2026 +0530 workqueue: Update documentation as per system_percpu_wq naming Update documentation to use "per-CPU workqueue" instead of "global workqueue" to match the system_wq to system_percpu_wq rename. The workqueue behavior remains unchanged; this just aligns terminology with the clearer naming. Fixes: a2be943b46b4 ("workqueue: replace use of system_wq with system_percpu_wq") Signed-off-by: Mallesh Koujalagi Signed-off-by: Tejun Heo commit c692ae39e9fd33d0e58ac24bf3d98b352b5064da Author: Tomasz Lis Date: Thu Feb 26 22:27:01 2026 +0100 drm/xe/vf: Redo LRC creation while in VF fixups If the xe module within a VM was creating a new LRC during save/ restore, this LRC will be invalid. The fixups procedure may not be able to reach it, as there will be a race to add the new LRC reference to an exec queue. Even if the new LRC which was being created during VM migration is added to EQ in time for fixups, said LRC may still remain damaged. In a small percentage of specially crafted test cases, the resulting LRC was still damaged and caused GPU hang. Any LRC which could be created in such a situation, have to be re-created. Due to VM having arbitrarily set amount of CPU cores, it is possible to limit the amount to 1. In such case, there is a possibility that kernel will switch CPU contexts in a way which allows to miss VF migration recovery running in parallel (by simply not switching to the LRC creation thread during recovery). Therefore checking if the migration is in progress just after LRC creation, is not enough to ensure detection. Free the incorrectly created LRC, and trigger a re-run of the creation, but only after waiting for default LRC to get fixups. Use additional atomic value increased after fixups, to ensure any VF migration that avoided detection by just checking for recovery in progress, will be caught. v2: Merge marker and wait for default LRC, reducing amount of calls within xe_init_eq(). Alter the LRC creation loop to remove a race with post-migration fixups worker. v3: Kerneldoc fixes. Rename fixups_complete_count. Signed-off-by: Tomasz Lis Reviewed-by: Matthew Brost Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260226212701.2937065-5-tomasz.lis@intel.com commit f3fb5f1ebbf39e685dd2885c9dbc8bb0a80be7c6 Author: Tomasz Lis Date: Thu Feb 26 22:27:00 2026 +0100 drm/xe/vf: Wait for all fixups before using default LRCs When a context is being created during save/restore, the LRC creation needs to wait for GGTT address space to be shifted. But it also needs to have fixed default LRCs. This is mandatory to avoid the situation where LRC will be created based on data from before the fixups, but reference within exec queue will be set too late for fixups. This fixes an issue where contexts created during save/restore have a large chance of having one unfixed LRC, due to the xe_lrc_create() being synced for equal start to race with default LRC fixups. v2: Move the fixups confirmation further, behind all fixups. Revert some renames. Signed-off-by: Tomasz Lis Reviewed-by: Matthew Brost Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260226212701.2937065-4-tomasz.lis@intel.com commit ec172c7befc4a48ea7d6afe6f0fa23c533222233 Author: Tomasz Lis Date: Thu Feb 26 22:26:59 2026 +0100 drm/xe: Wrappers for setting and getting LRC references There is a small but non-zero chance that VF post migration fixups are running on an exec queue during teardown. The chances are decreased by starting the teardown by releasing guc_id, but remain non-zero. On the other hand the sync between fixups and EQ creation (wait_valid_ggtt) drastically increases the chance for such parallel teardown if queue creation error path is entered (err_lrc label). The exec queue itself is not going to cause an issue, but LRCs have a small chance of getting freed during the fixups. Creating a setter and a getter makes it easier to protect the fixup operations with a lock. For other driver activities, the original access method (without any protection) can still be used. v2: Separate lock, only for LRCs. Kerneldoc fixes. Subject tag fix. Signed-off-by: Tomasz Lis Reviewed-by: Matthew Brost Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260226212701.2937065-3-tomasz.lis@intel.com commit 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079 Author: Tomasz Lis Date: Thu Feb 26 22:26:58 2026 +0100 drm/xe/queue: Call fini on exec queue creation fail Every call to queue init should have a corresponding fini call. Skipping this would mean skipping removal of the queue from GuC list (which is part of guc_id allocation). A damaged queue stored in exec_queue_lookup list would lead to invalid memory reference, sooner or later. Call fini to free guc_id. This must be done before any internal LRCs are freed. Since the finalization with this extra call became very similar to __xe_exec_queue_fini(), reuse that. To make this reuse possible, alter xe_lrc_put() so it can survive NULL parameters, like other similar functions. v2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs. Fixes: 3c1fa4aa60b1 ("drm/xe: Move queue init before LRC creation") Signed-off-by: Tomasz Lis Reviewed-by: Matthew Brost (v1) Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260226212701.2937065-2-tomasz.lis@intel.com commit 223b2f51ba6bbf70dbebdb69b93b66b074289e04 Author: Xin Wang Date: Tue Feb 24 18:20:14 2026 -0800 drm/xe: restrict multi-lrc to VCS/VECS engines Tighten uapi validation to restrict multi-lrc support to VIDEO_DECODE and VIDEO_ENHANCE engines only. This check should have been in place from the start, as the driver typically avoids allowing uapi cases that we have no userspace consumer for. Additionally, the GuC firmware on ModSched platforms no longer supports multi-lrc on non-media engines. V4: - use a unified mask for all platforms since engine instance count is an independent runtime check (Matt Roper, Matthew Brost) V3: - store a multi-lrc enable class mask in xe->info and populate from xe_device_desc in xe_pci.c (Matthew Brost) V2: - correct the typo (Shuicheng) - move the check earlier to avoid VM lookup (Shuicheng, Matt Roper) - remove the graphics version check (Matt Roper) - input more details in the commit info (Matt Roper) Cc: Shuicheng Lin Cc: Matt Roper Cc: Matthew Brost Signed-off-by: Xin Wang Reviewed-by: Shuicheng Lin Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260225022014.45394-1-x.wang@intel.com Signed-off-by: Matt Roper commit 8ccf5f6b2295164962bbee5b0770f4366fd9bee2 Author: Matt Roper Date: Tue Feb 24 15:50:56 2026 -0800 drm/xe/tuning: Apply windower hardware filtering setting on Xe3 and Xe3p A recent bspec tuning guide update asks us to program COMMON_SLICE_CHICKEN4[5] on Xe3 and Xe3p platforms. Add this setting to our LRC tuning RTP table so that the setting will become part of each context's LRC. Bspec: 72161, 55902 Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260224235055.3038710-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit e267b4178134e36e83ddfe4f7f5b4b162a286148 Author: Ravi Bangoria Date: Mon Feb 16 04:25:25 2026 +0000 perf/amd/ibs: Add new MSRs and CPUID bits definitions IBS on upcoming microarch introduced two new control MSRs and couple of new features. Define macros for them. New capabilities: o IBS_CAPS_DIS: Alternate Fetch and Op IBS disable bits o IBS_CAPS_FETCHLAT: Fetch Latency filter o IBS_CAPS_BIT63_FILTER: Virtual address bit 63 based filters for Fetch and Op o IBS_CAPS_STRMST_RMTSOCKET: Streaming store filter and indicator, remote socket indicator New control MSRs for above features: o MSR_AMD64_IBSFETCHCTL2 o MSR_AMD64_IBSOPCTL2 Also do cosmetic alignment changes. Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dapeng Mi Link: https://patch.msgid.link/20260216042530.1546-3-ravi.bangoria@amd.com commit f9d55ccf0199d1a80c2519084578f0c345dedd2f Author: Ravi Bangoria Date: Mon Feb 16 04:25:24 2026 +0000 perf/amd/ibs: Define macro for ldlat mask and shift Load latency filter threshold is encoded in config1[11:0]. Define a mask for it instead of hardcoded 0xFFF. Unlike "config" fields whose layout maps to PERF_{FETCH|OP}_CTL MSR, layout of "config1" is custom defined so a new set of macros are needed for "config1" fields. Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dapeng Mi Link: https://patch.msgid.link/20260216042530.1546-2-ravi.bangoria@amd.com commit 1b044ff3c17e9d7fd93ffc0ba541ccdeb992d7f5 Author: Ravi Bangoria Date: Mon Feb 16 04:22:16 2026 +0000 perf/amd/ibs: Avoid race between event add and NMI Consider the following race: -------- o OP_CTL contains stale value: OP_CTL[Val]=1, OP_CTL[En]=0 o A new IBS OP event is being added o [P]: Process context, [N]: NMI context [P] perf_ibs_add(event) { [P] if (test_and_set_bit(IBS_ENABLED, pcpu->state)) [P] return; [P] /* pcpu->state = IBS_ENABLED */ [P] [P] pcpu->event = event; [P] [P] perf_ibs_start(event) { [P] set_bit(IBS_STARTED, pcpu->state); [P] /* pcpu->state = IBS_ENABLED | IBS_STARTED */ [P] clear_bit(IBS_STOPPING, pcpu->state); [P] /* pcpu->state = IBS_ENABLED | IBS_STARTED */ [N] --> NMI due to genuine FETCH event. perf_ibs_handle_irq() [N] called for OP PMU as well. [N] [N] perf_ibs_handle_irq(perf_ibs) { [N] event = pcpu->event; /* See line 6 */ [N] [N] if (!test_bit(IBS_STARTED, pcpu->state)) /* false */ [N] return 0; [N] [N] if (WARN_ON_ONCE(!event)) /* false */ [N] goto fail; [N] [N] if (!(*buf++ & perf_ibs->valid_mask)) /* false due to stale [N] * IBS_OP_CTL value */ [N] goto fail; [N] [N] ... [N] [N] perf_ibs_enable_event() // *Accidentally* enable the event. [N] } [N] [N] /* [N] * Repeated NMIs may follow due to accidentally enabled IBS OP [N] * event if the sample period is very low. It could also lead [N] * to pcpu->state corruption if the event gets throttled due [N] * to too frequent NMIs. [N] */ [P] perf_ibs_enable_event(); [P] } [P] } -------- We cannot safely clear IBS_{FETCH|OP}_CTL while disabling the event, because the register might be read again later. So, clear the register in the enable path - before we update pcpu->state and enable the event. This guarantees that any NMI that lands in the gap finds Val=0 and bails out cleanly. Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Acked-by: Namhyung Kim Link: https://patch.msgid.link/20260216042216.1440-6-ravi.bangoria@amd.com commit b0a09142622a994c4f4088c3f61db5da87cfc711 Author: Ravi Bangoria Date: Mon Feb 16 04:22:15 2026 +0000 perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler Calling perf_allow_kernel() from the NMI context is unsafe and could be fatal. Capture the permission at event-initialization time by storing it in event->hw.flags, and have the NMI handler rely on that cached flag instead of making the call directly. Fixes: 50a53b60e141d ("perf/amd/ibs: Prevent leaking sensitive data to userspace") Reported-by: Sadasivan Shaiju Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Acked-by: Namhyung Kim Link: https://patch.msgid.link/20260216042216.1440-5-ravi.bangoria@amd.com commit 723a290326e015b07931eabc603d3735999377be Author: Ravi Bangoria Date: Mon Feb 16 04:22:14 2026 +0000 perf/amd/ibs: Preserve PhyAddrVal bit when clearing PhyAddr MSR Commit 50a53b60e141 ("perf/amd/ibs: Prevent leaking sensitive data to userspace") zeroed the physical address and also cleared the PhyAddrVal flag before copying the value into a perf sample to avoid exposing physical addresses to unprivileged users. Clearing PhyAddrVal, however, has an unintended side-effect: several other IBS fields are considered valid only when this bit is set. As a result, those otherwise correct fields are discarded, reducing IBS functionality. Continue to zero the physical address, but keep the PhyAddrVal bit intact so the related fields remain usable while still preventing any address leak. Fixes: 50a53b60e141 ("perf/amd/ibs: Prevent leaking sensitive data to userspace") Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Acked-by: Namhyung Kim Link: https://patch.msgid.link/20260216042216.1440-4-ravi.bangoria@amd.com commit 898138efc99096c3ee836fea439ba6da3cfafa4d Author: Ravi Bangoria Date: Mon Feb 16 04:22:13 2026 +0000 perf/amd/ibs: Limit ldlat->l3missonly dependency to Zen5 The ldlat dependency on l3missonly is specific to Zen 5; newer generations are not affected. This quirk is documented as an erratum in the following Revision Guide. Erratum: 1606 IBS (Instruction Based Sampling) OP Load Latency Filtering May Capture Unwanted Samples When L3Miss Filtering is Disabled Revision Guide for AMD Family 1Ah Models 00h-0Fh Processors, Pub. 58251 Rev. 1.30 July 2025 https://bugzilla.kernel.org/attachment.cgi?id=309193 Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Acked-by: Namhyung Kim Link: https://patch.msgid.link/20260216042216.1440-3-ravi.bangoria@amd.com commit 01336b5559785a136de1cac49705f63a70a755bc Author: Ravi Bangoria Date: Mon Feb 16 04:22:12 2026 +0000 perf/amd/ibs: Account interrupt for discarded samples Add interrupt throttling accounting for below cases: o IBS Op PMU: A software filter (in addition to the hardware filter) drops samples whose load latency is below the user-specified threshold. o IBS Fetch PMU: Samples discarded due to the zero-RIP erratum (#1197). Although these samples are discarded, the NMI cost is still incurred, so they should be counted for interrupt throttling. Fixes: 26db2e0c51fe83e1dd852c1321407835b481806e ("perf/x86/amd/ibs: Work around erratum #1197") Fixes: d20610c19b4a22bc69085b7eb7a02741d51de30e ("perf/amd/ibs: Add support for OP Load Latency Filtering") Signed-off-by: Ravi Bangoria Signed-off-by: Peter Zijlstra (Intel) Acked-by: Namhyung Kim Link: https://patch.msgid.link/20260216042216.1440-2-ravi.bangoria@amd.com commit da45c8d5f051434a3c68397e66ae2d3b3c97cdec Author: Namhyung Kim Date: Wed Feb 11 14:32:21 2026 -0800 perf/core: Simplify __detach_global_ctx_data() Like in the attach_global_ctx_data() it has a O(N^2) loop to delete task context data for each thread. But perf_free_ctx_data_rcu() can be called under RCU read lock, so just calls it directly rather than iterating the whole thread list again. Signed-off-by: Namhyung Kim Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260211223222.3119790-4-namhyung@kernel.org commit bec2ee2390c95ed0c44494340464e69e79802e4a Author: Namhyung Kim Date: Wed Feb 11 14:32:20 2026 -0800 perf/core: Try to allocate task_ctx_data quickly The attach_global_ctx_data() has O(N^2) algorithm to allocate the context data for each thread. This caused perfomance problems on large systems with O(100k) threads. Because kmalloc(GFP_KERNEL) can go sleep it cannot be called under the RCU lock. So let's try with GFP_NOWAIT first so that it can proceed in normal cases. Signed-off-by: Namhyung Kim Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260211223222.3119790-3-namhyung@kernel.org commit 28c75fbfec8f024db1278194918e5f6eda4c570f Author: Namhyung Kim Date: Wed Feb 11 14:32:19 2026 -0800 perf/core: Pass GFP flags to attach_task_ctx_data() This is a preparation for the next change to reduce the computational complexity in the global context data handling for LBR callstacks. Signed-off-by: Namhyung Kim Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260211223222.3119790-2-namhyung@kernel.org commit 3dcef70e41ab13483803c536ddea8d5f1803ee25 Author: Bart Van Assche Date: Wed Feb 25 10:32:43 2026 -0800 ww-mutex: Fix the ww_acquire_ctx function annotations The ww_acquire_done() call is optional. Reflect this in the annotations of ww_acquire_done(). Fixes: 47907461e4f6 ("locking/ww_mutex: Support Clang's context analysis") Signed-off-by: Bart Van Assche Signed-off-by: Peter Zijlstra (Intel) Acked-by: Maarten Lankhorst Acked-by: Marco Elver Link: https://patch.msgid.link/20260225183244.4035378-4-bvanassche@acm.org commit 39be7b21af24d1d2ed3b18caac57dd219fef226e Author: Bart Van Assche Date: Wed Feb 25 10:32:42 2026 -0800 signal: Fix the lock_task_sighand() annotation lock_task_sighand() may return NULL. Make this clear in its lock context annotation. Fixes: 04e49d926f43 ("sched: Enable context analysis for core.c and fair.c") Signed-off-by: Bart Van Assche Signed-off-by: Peter Zijlstra (Intel) Acked-by: Marco Elver Link: https://patch.msgid.link/20260225183244.4035378-3-bvanassche@acm.org commit 38e18d825f7281fdc16d3241df5115ce6eaeaf79 Author: Bart Van Assche Date: Wed Feb 25 10:32:41 2026 -0800 locking: Fix rwlock and spinlock lock context annotations Fix two incorrect rwlock_t lock context annotations. Add the raw_spinlock_t lock context annotations that are missing. Fixes: f16a802d402d ("locking/rwlock, spinlock: Support Clang's context analysis") Signed-off-by: Bart Van Assche Signed-off-by: Peter Zijlstra (Intel) Acked-by: Marco Elver Link: https://patch.msgid.link/20260225183244.4035378-2-bvanassche@acm.org commit 9213aa4784cf4e63e6d8d30ba71fd61c3d110247 Author: Peter Zijlstra Date: Tue Feb 24 17:39:08 2026 +0100 sched: Default enable HRTICK when deferred rearming is enabled The deferred rearm of the clock event device after an interrupt and and other hrtimer optimizations allow now to enable HRTICK for generic entry architectures. This decouples preemption from CONFIG_HZ, leaving only the periodic load-balancer and various accounting things relying on the tick. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.937531564@kernel.org commit 343f2f4dc5425107d509d29e26ef59c2053aeaa4 Author: Thomas Gleixner Date: Tue Feb 24 17:39:02 2026 +0100 hrtimer: Try to modify timers in place When modifying the expiry of a armed timer it is first dequeued, then the expiry value is updated and then it is queued again. This can be avoided when the new expiry value is within the range of the previous and the next timer as that does not change the position in the RB tree. The linked timerqueue allows to peak ahead to the neighbours and check whether the new expiry time is within the range of the previous and next timer. If so just modify the timer in place and spare the enqueue and requeue effort, which might end up rotating the RB tree twice for nothing. This speeds up the handling of frequently rearmed hrtimers, like the hrtick scheduler timer significantly. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.873359816@kernel.org commit b7418e6e9b87b849af4df93d527ff83498d1e4c3 Author: Thomas Gleixner Date: Tue Feb 24 17:38:57 2026 +0100 hrtimer: Use linked timerqueue To prepare for optimizing the rearming of enqueued timers, switch to the linked timerqueue. That allows to check whether the new expiry time changes the position of the timer in the RB tree or not, by checking the new expiry time against the previous and the next timers expiry. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.806643179@kernel.org commit 1339eeb73d6b99cf3aa9981f3f91d6ac4a49c72e Author: Thomas Gleixner Date: Tue Feb 24 17:38:52 2026 +0100 timerqueue: Provide linked timerqueue The hrtimer subsystem wants to peak ahead to the next and previous timer to evaluated whether a to be rearmed timer can stay at the same position in the RB tree with the new expiry time. The linked RB tree provides the infrastructure for this as it maintains links to the previous and next nodes for each entry in the tree. Provide timerqueue wrappers around that. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.734827095@kernel.org commit 671047943dce5af24e023bca3c5cc244d7565f5a Author: Thomas Gleixner Date: Tue Feb 24 17:38:47 2026 +0100 rbtree: Provide rbtree with links Some RB tree users require quick access to the next and the previous node, e.g. to check whether a modification of the node results in a change of the nodes position in the tree. If the node position does not change, then the modification can happen in place without going through a full enqueue requeue cycle. A upcoming use case for this are the timer queues of the hrtimer subsystem as they can optimize for timers which are frequently rearmed while enqueued. This can be obviously achieved with rb_next() and rb_prev(), but those turned out to be quite expensive for hotpath operations depending on the tree depth. Add a linked RB tree variant where add() and erase() maintain the links between the nodes. Like the cached variant it provides a pointer to the left most node in the root. It intentionally does not use a [h]list head as there is no real need for true list operations as the list is strictly coupled to the tree and and cannot be manipulated independently. It sets the nodes previous pointer to NULL for the left most node and the next pointer to NULL for the right most node. This allows a quick check especially for the left most node without consulting the list head address, which creates better code. Aside of the rb_leftmost cached pointer this could trivially provide a rb_rightmost pointer as well, but there is no usage for that (yet). Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.668401024@kernel.org commit 3601a1d85028d7d479e1571419174fc3334f58f5 Author: Thomas Gleixner Date: Tue Feb 24 17:38:42 2026 +0100 hrtimer: Optimize for_each_active_base() Give the compiler some help to emit way better code. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.599804894@kernel.org commit a64ad57e41c7e3daadbc2c1bc252d9a90c87222f Author: Thomas Gleixner Date: Tue Feb 24 17:38:37 2026 +0100 hrtimer: Simplify run_hrtimer_queues() Replace the open coded container_of() orgy with a trivial clock_base_next_timer() helper. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.532927977@kernel.org commit 2bd1cc24fafc84be844c9ef66aa819d7dec285bf Author: Thomas Gleixner Date: Tue Feb 24 17:38:33 2026 +0100 hrtimer: Rework next event evaluation The per clock base cached expiry time allows to do a more efficient evaluation of the next expiry on a CPU. Separate the reprogramming evaluation from the NOHZ idle evaluation which needs to exclude the NOHZ timer to keep the reprogramming path lean and clean. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.468186893@kernel.org commit eddffab8282e388dddf032f3295fcec87eb08095 Author: Thomas Gleixner Date: Tue Feb 24 17:38:28 2026 +0100 hrtimer: Keep track of first expiring timer per clock base Evaluating the next expiry time of all clock bases is cache line expensive as the expiry time of the first expiring timer is not cached in the base and requires to access the timer itself, which is definitely in a different cache line. It's way more efficient to keep track of the expiry time on enqueue and dequeue operations as the relevant data is already in the cache at that point. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.404839710@kernel.org commit b95c4442b02162904e9012e670b602ebeb3c6c1b Author: Thomas Gleixner Date: Tue Feb 24 17:38:23 2026 +0100 hrtimer: Avoid re-evaluation when nothing changed Most times there is no change between hrtimer_interrupt() deferring the rearm and the invocation of hrtimer_rearm_deferred(). In those cases it's a pointless exercise to re-evaluate the next expiring timer. Cache the required data and use it if nothing changed. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.338569372@kernel.org commit 15dd3a9488557d3e6ebcecacab79f4e56b69ab54 Author: Peter Zijlstra Date: Tue Feb 24 17:38:18 2026 +0100 hrtimer: Push reprogramming timers into the interrupt return path Currently hrtimer_interrupt() runs expired timers, which can re-arm themselves, after which it computes the next expiration time and re-programs the hardware. However, things like HRTICK, a highres timer driving preemption, cannot re-arm itself at the point of running, since the next task has not been determined yet. The schedule() in the interrupt return path will switch to the next task, which then causes a new hrtimer to be programmed. This then results in reprogramming the hardware at least twice, once after running the timers, and once upon selecting the new task. Notably, *both* events happen in the interrupt. By pushing the hrtimer reprogram all the way into the interrupt return path, it runs after schedule() picks the new task and the double reprogram can be avoided. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.273488269@kernel.org commit b0a44fa5e2a22ff67752bbc08c651a2efac3e5fe Author: Peter Zijlstra Date: Tue Feb 24 17:38:12 2026 +0100 sched/core: Prepare for deferred hrtimer rearming The hrtimer interrupt expires timers and at the end of the interrupt it rearms the clockevent device for the next expiring timer. That's obviously correct, but in the case that a expired timer sets NEED_RESCHED the return from interrupt ends up in schedule(). If HRTICK is enabled then schedule() will modify the hrtick timer, which causes another reprogramming of the hardware. That can be avoided by deferring the rearming to the return from interrupt path and if the return results in a immediate schedule() invocation then it can be deferred until the end of schedule(), which avoids multiple rearms and re-evaluation of the timer wheel. Add the rearm checks to the existing sched_hrtick_enter/exit() functions, which already handle the batched rearm of the hrtick timer. For now this is just placing empty stubs at the right places which are all optimized out by the compiler until the guard condition becomes true. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.208580085@kernel.org commit 7e641e52cf5f284706514f789df8c497aea984e1 Author: Peter Zijlstra Date: Tue Feb 24 17:38:07 2026 +0100 softirq: Prepare for deferred hrtimer rearming The hrtimer interrupt expires timers and at the end of the interrupt it rearms the clockevent device for the next expiring timer. That's obviously correct, but in the case that a expired timer sets NEED_RESCHED the return from interrupt ends up in schedule(). If HRTICK is enabled then schedule() will modify the hrtick timer, which causes another reprogramming of the hardware. That can be avoided by deferring the rearming to the return from interrupt path and if the return results in a immediate schedule() invocation then it can be deferred until the end of schedule(), which avoids multiple rearms and re-evaluation of the timer wheel. In case that the return from interrupt ends up handling softirqs before reaching the rearm conditions in the return to user entry code functions, a deferred rearm has to be handled before softirq handling enables interrupts as soft interrupt handling can be long and would therefore introduce hard to diagnose latencies to the timer interrupt. Place the for now empty stub call right before invoking the softirq handling routine. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.142854488@kernel.org commit 0e98eb14814ef669e07ca6effaa03df2e57ef956 Author: Peter Zijlstra Date: Tue Feb 24 17:38:03 2026 +0100 entry: Prepare for deferred hrtimer rearming The hrtimer interrupt expires timers and at the end of the interrupt it rearms the clockevent device for the next expiring timer. That's obviously correct, but in the case that a expired timer sets NEED_RESCHED the return from interrupt ends up in schedule(). If HRTICK is enabled then schedule() will modify the hrtick timer, which causes another reprogramming of the hardware. That can be avoided by deferring the rearming to the return from interrupt path and if the return results in a immediate schedule() invocation then it can be deferred until the end of schedule(), which avoids multiple rearms and re-evaluation of the timer wheel. As this is only relevant for interrupt to user return split the work masks up and hand them in as arguments from the relevant exit to user functions, which allows the compiler to optimize the deferred handling out for the syscall exit to user case. Add the rearm checks to the approritate places in the exit to user loop and the interrupt return to kernel path, so that the rearming is always guaranteed. In the return to user space path this is handled in the same way as TIF_RSEQ to avoid extra instructions in the fast path, which are truly hurtful for device interrupt heavy work loads as the extra instructions and conditionals while benign at first sight accumulate quickly into measurable regressions. The return from syscall path is completely unaffected due to the above mentioned split so syscall heavy workloads wont have any extra burden. For now this is just placing empty stubs at the right places which are all optimized out by the compiler until the actual functionality is in place. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.066469985@kernel.org commit a43b4856bc039675165a50d9ef5f41b28520f0f4 Author: Peter Zijlstra Date: Tue Feb 24 17:37:58 2026 +0100 hrtimer: Prepare stubs for deferred rearming The hrtimer interrupt expires timers and at the end of the interrupt it rearms the clockevent device for the next expiring timer. That's obviously correct, but in the case that a expired timer set NEED_RESCHED the return from interrupt ends up in schedule(). If HRTICK is enabled then schedule() will modify the hrtick timer, which causes another reprogramming of the hardware. That can be avoided by deferring the rearming to the return from interrupt path and if the return results in a immediate schedule() invocation then it can be deferred until the end of schedule(). To make this correct the affected code parts need to be made aware of this. Provide empty stubs for the deferred rearming mechanism, so that the relevant code changes for entry, softirq and scheduler can be split up into separate changes independent of the actual enablement in the hrtimer code. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163431.000891171@kernel.org commit 9e07a9c980eaa93fd1bba722d31eeb4bf0cbbfb4 Author: Thomas Gleixner Date: Tue Feb 24 17:37:53 2026 +0100 hrtimer: Rename hrtimer_cpu_base::in_hrtirq to deferred_rearm The upcoming deferred rearming scheme has the same effect as the deferred rearming when the hrtimer interrupt is executing. So it can reuse the in_hrtirq flag, but when it gets deferred beyond the hrtimer interrupt path, then the name does not make sense anymore. Rename it to deferred_rearm upfront to keep the actual functional change separate from the mechanical rename churn. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.935623347@kernel.org commit 2889243848560b6b0211aba401d2fc122070ba2f Author: Peter Zijlstra Date: Tue Feb 24 17:37:48 2026 +0100 hrtimer: Re-arrange hrtimer_interrupt() Rework hrtimer_interrupt() such that reprogramming is split out into an independent function at the end of the interrupt. This prepares for reprogramming getting delayed beyond the end of hrtimer_interrupt(). Notably, this changes the hang handling to always wait 100ms instead of trying to keep it proportional to the actual delay. This simplifies the state, also this really shouldn't be happening. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.870639266@kernel.org commit 8e10f6b81afbf60e48bb4a71676ede4c7e374e79 Author: Thomas Gleixner Date: Tue Feb 24 17:37:43 2026 +0100 hrtimer: Add hrtimer_rearm tracepoint Analyzing the reprogramming of the clock event device is essential to debug the behaviour of the hrtimer subsystem especially with the upcoming deferred rearming scheme. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.803669745@kernel.org commit 85a690d1c19cc266eed74ec3fcdaacadc03ed1b2 Author: Thomas Gleixner Date: Tue Feb 24 17:37:38 2026 +0100 hrtimer: Separate remove/enqueue handling for local timers As the base switch can be avoided completely when the base stays the same the remove/enqueue handling can be more streamlined. Split it out into a separate function which handles both in one go which is way more efficient and makes the code simpler to follow. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.737600486@kernel.org commit c939191457fead7bce2f991fe5bf39d4d5dde90f Author: Thomas Gleixner Date: Tue Feb 24 17:37:33 2026 +0100 hrtimer: Use NOHZ information for locality The decision to keep a timer which is associated to the local CPU on that CPU does not take NOHZ information into account. As a result there are a lot of hrtimer base switch invocations which end up not switching the base and stay on the local CPU. That's just work for nothing and can be further improved. If the local CPU is part of the NOISE housekeeping mask, then check: 1) Whether the local CPU has the tick running, which means it is either not idle or already expecting a timer soon. 2) Whether the tick is stopped and need_resched() is set, which means the CPU is about to exit idle. This reduces the amount of hrtimer base switch attempts, which end up on the local CPU anyway, significantly and prepares for further optimizations. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.673473029@kernel.org commit 3288cd486376b322868c9fb41f10e35916e7e989 Author: Thomas Gleixner Date: Tue Feb 24 17:37:28 2026 +0100 hrtimer: Optimize for local timers The decision whether to keep timers on the local CPU or on the CPU they are associated to is suboptimal and causes the expensive switch_hrtimer_base() mechanism to be invoked more than necessary. This is especially true for pinned timers. Rewrite the decision logic so that the current base is kept if: 1) The callback is running on the base 2) The timer is associated to the local CPU and the first expiring timer as that allows to optimize for reprogramming avoidance 3) The timer is associated to the local CPU and pinned 4) The timer is associated to the local CPU and timer migration is disabled. Only #2 was covered by the original code, but especially #3 makes a difference for high frequency rearming timers like the scheduler hrtick timer. If timer migration is disabled, then #4 avoids most of the base switches. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.607935269@kernel.org commit 22f011be7aaa77ca8f502b9dd07b7334f9965d18 Author: Thomas Gleixner Date: Tue Feb 24 17:37:23 2026 +0100 hrtimer: Convert state and properties to boolean All 'u8' flags are true booleans, so make it entirely clear that these can only contain true or false. This is especially true for hrtimer::state, which has a historical leftover of using the state with bitwise operations. That was used in the early hrtimer implementation with several bits, but then converted to a boolean state. But that conversion missed to replace the bit OR and bit check operations all over the place, which creates suboptimal code. As of today 'state' is a misnomer because it's only purpose is to reflect whether the timer is enqueued into the RB-tree or not. Rename it to 'is_queued' and make all operations on it boolean. This reduces text size from 8926 to 8732 bytes. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.542427240@kernel.org commit 7d27eafe54659d19cef10dab4520cbcdfb17b0e3 Author: Thomas Gleixner Date: Tue Feb 24 17:37:18 2026 +0100 hrtimer: Replace the bitfield in hrtimer_cpu_base Use bool for the various flags as that creates better code in the hot path. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.475262618@kernel.org commit 8ffc9ea88136903812448a04127e1ee2c0460f24 Author: Thomas Gleixner Date: Tue Feb 24 17:37:14 2026 +0100 hrtimer: Evaluate timer expiry only once No point in accessing the timer twice. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.409352042@kernel.org commit 0c6af0ea51bd2774f41a00a81ac276800975c3cc Author: Thomas Gleixner Date: Tue Feb 24 17:37:09 2026 +0100 hrtimer: Cleanup coding style and comments As this code has some major surgery ahead, clean up coding style and bring comments up to date. No functional change intended. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.342740952@kernel.org commit 6abfc2bd5b0cff70db99a273f2a161e2273eae6d Author: Thomas Gleixner Date: Tue Feb 24 17:37:04 2026 +0100 hrtimer: Use guards where appropriate Simplify and tidy up the code where possible. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.275551488@kernel.org commit f2e388a019e4cf83a15883a3d1f1384298e9a6aa Author: Thomas Gleixner Date: Tue Feb 24 17:36:59 2026 +0100 hrtimer: Reduce trace noise in hrtimer_start() hrtimer_start() when invoked with an already armed timer traces like: -.. [032] d.h2. 5.002263: hrtimer_cancel: hrtimer= .... -.. [032] d.h1. 5.002263: hrtimer_start: hrtimer= .... Which is incorrect as the timer doesn't get canceled. Just the expiry time changes. The internal dequeue operation which is required for that is not really interesting for trace analysis. But it makes it tedious to keep real cancellations and the above case apart. Remove the cancel tracing in hrtimer_start() and add a 'was_armed' indicator to the hrtimer start tracepoint, which clearly indicates what the state of the hrtimer is when hrtimer_start() is invoked: -.. [032] d.h1. 6.200103: hrtimer_start: hrtimer= .... was_armed=0 -.. [032] d.h1. 6.200558: hrtimer_start: hrtimer= .... was_armed=1 Fixes: c6a2a1770245 ("hrtimer: Add tracepoint for hrtimers") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.208491877@kernel.org commit 513e744a0a4a70ebdb155611b897e9ed4d83831c Author: Thomas Gleixner Date: Tue Feb 24 17:36:54 2026 +0100 hrtimer: Add debug object init assertion The debug object coverage in hrtimer_start_range_ns() happens too late to do anything useful. Implement the init assert assertion part and invoke that early in hrtimer_start_range_ns(). Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.143098153@kernel.org commit f246ec3478cfdab830ee0815209f48923e7ee5e2 Author: Thomas Gleixner Date: Tue Feb 24 17:36:49 2026 +0100 x86/apic: Enable TSC coupled programming mode The TSC deadline timer is directly coupled to the TSC and setting the next deadline is tedious as the clockevents core code converts the CLOCK_MONOTONIC based absolute expiry time to a relative expiry by reading the current time from the TSC. It converts that delta to cycles and hands the result to lapic_next_deadline(), which then has read to the TSC and add the delta to program the timer. The core code now supports coupled clock event devices and can provide the expiry time in TSC cycles directly without reading the TSC at all. This obviouly works only when the TSC is the current clocksource, but that's the default for all modern CPUs which implement the TSC deadline timer. If the TSC is not the current clocksource (e.g. early boot) then the core code falls back to the relative set_next_event() callback as before. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.076565985@kernel.org commit 89f951a1e8ad781e7ac70eccddab0e0c270485f9 Author: Thomas Gleixner Date: Tue Feb 24 17:36:45 2026 +0100 clockevents: Provide support for clocksource coupled comparators Some clockevent devices are coupled to the system clocksource by implementing a less than or equal comparator which compares the programmed absolute expiry time against the underlying time counter. The timekeeping core provides a function to convert and absolute CLOCK_MONOTONIC based expiry time to a absolute clock cycles time which can be directly fed into the comparator. That spares two time reads in the next event progamming path, one to convert the absolute nanoseconds time to a delta value and the other to convert the delta value back to a absolute time value suitable for the comparator. Provide a new clocksource callback which takes the absolute cycle value and wire it up in clockevents_program_event(). Similar to clocksources allow architectures to inline the rearm operation. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163430.010425428@kernel.org commit cd38bdb8e696a1a1eb12fc6662a6e420977aacfd Author: Thomas Gleixner Date: Tue Feb 24 17:36:40 2026 +0100 timekeeping: Provide infrastructure for coupled clockevents Some architectures have clockevent devices which are coupled to the system clocksource by implementing a less than or equal comparator which compares the programmed absolute expiry time against the underlying time counter. Well known examples are TSC/TSC deadline timer and the S390 TOD clocksource/comparator. While the concept is nice it has some downsides: 1) The clockevents core code is strictly based on relative expiry times as that's the most common case for clockevent device hardware. That requires to convert the absolute expiry time provided by the caller (hrtimers, NOHZ code) to a relative expiry time by reading and substracting the current time. The clockevent::set_next_event() callback must then read the counter again to convert the relative expiry back into a absolute one. 2) The conversion factors from nanoseconds to counter clock cycles are set up when the clockevent is registered. When NTP applies corrections then the clockevent conversion factors can deviate from the clocksource conversion substantially which either results in timers firing late or in the worst case early. The early expiry then needs to do a reprogam with a short delta. In most cases this is papered over by the fact that the read in the set_next_event() callback happens after the read which is used to calculate the delta. So the tendency is that timers expire mostly late. All of this can be avoided by providing support for these devices in the core code: 1) The timekeeping core keeps track of the last update to the clocksource by storing the base nanoseconds and the corresponding clocksource counter value. That's used to keep the conversion math for reading the time within 64-bit in the common case. This information can be used to avoid both reads of the underlying clocksource in the clockevents reprogramming path: delta = expiry - base_ns; cycles = base_cycles + ((delta * clockevent::mult) >> clockevent::shift); The resulting cycles value can be directly used to program the comparator. 2) As #1 does not longer provide the "compensation" through the second read the deviation of the clocksource and clockevent conversions caused by NTP become more prominent. This can be cured by letting the timekeeping core compute and store the reverse conversion factors when the clocksource cycles to nanoseconds factors are modified by NTP: CS::MULT (1 << NS_TO_CYC_SHIFT) --------------- = ---------------------- (1 << CS:SHIFT) NS_TO_CYC_MULT Ergo: NS_TO_CYC_MULT = (1 << (CS::SHIFT + NS_TO_CYC_SHIFT)) / CS::MULT The NS_TO_CYC_SHIFT value is calculated when the clocksource is installed so that it aims for a one hour maximum sleep time. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.944763521@kernel.org commit 23028286128d817a414eee0c0a2c6cdc57a83e6f Author: Thomas Gleixner Date: Tue Feb 24 17:36:34 2026 +0100 x86/apic: Avoid the PVOPS indirection for the TSC deadline timer XEN PV does not emulate the TSC deadline timer, so the PVOPS indirection for writing the deadline MSR can be avoided completely. Use native_wrmsrq() instead. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.877429827@kernel.org commit 92d0e753d57ec581a424d9903afff5e17bd1e6e4 Author: Thomas Gleixner Date: Tue Feb 24 17:36:29 2026 +0100 x86/apic: Remove pointless fence in lapic_next_deadline() lapic_next_deadline() contains a fence before the TSC read and the write to the TSC_DEADLINE MSR with a content free and therefore useless comment: /* This MSR is special and need a special fence: */ The MSR is not really special. It is just not a serializing MSR, but that does not matter at all in this context as all of these operations are strictly CPU local. The only thing the fence prevents is that the RDTSC is speculated ahead, but that's not really relevant as the delta is calculated way before based on a previous TSC read and therefore inaccurate by definition. So removing the fence is just making it slightly more inaccurate in the worst case, but that is irrelevant as it's way below the actual system immanent latencies and variations. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.809059527@kernel.org commit b27801189f7fc97a960a96a63b78dcabbb67a52f Author: Thomas Gleixner Date: Tue Feb 24 17:36:24 2026 +0100 x86: Inline TSC reads in timekeeping Avoid the overhead of the indirect call for a single instruction to read the TSC. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.741886362@kernel.org commit 2e27beeb66e43f3b84aef5a07e486a5d50695c06 Author: Thomas Gleixner Date: Tue Feb 24 17:36:20 2026 +0100 timekeeping: Allow inlining clocksource::read() On some architectures clocksource::read() boils down to a single instruction, so the indirect function call is just a massive overhead especially with speculative execution mitigations in effect. Allow architectures to enable conditional inlining of that read to avoid that by: - providing a static branch to switch to the inlined variant - disabling the branch before clocksource changes - enabling the branch after a clocksource change, when the clocksource indicates in a feature flag that it is the one which provides the inlined variant This is intentionally not a static call as that would only remove the indirect call, but not the rest of the overhead. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.675151545@kernel.org commit 70802807398c65f5a49b2baec87e1f6c8db43de6 Author: Thomas Gleixner Date: Tue Feb 24 17:36:15 2026 +0100 clockevents: Remove redundant CLOCK_EVT_FEAT_KTIME The only real usecase for this is the hrtimer based broadcast device. No point in using two different feature flags for this. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.609049777@kernel.org commit adcec6a7f566aa237db211f2947b039418450b92 Author: Thomas Gleixner Date: Tue Feb 24 17:36:10 2026 +0100 tick/sched: Avoid hrtimer_cancel/start() sequence The sequence of cancel and start is inefficient. It has to do the timer lock/unlock twice and in the worst case has to reprogram the underlying clock event device twice. The reason why it is done this way is the usage of hrtimer_forward_now(), which requires the timer to be inactive. But that can be completely avoided as the forward can be done on a variable and does not need any of the overrun accounting provided by hrtimer_forward_now(). Implement a trivial forwarding mechanism and replace the cancel/reprogram sequence with hrtimer_start(..., new_expiry). For the non high resolution case the timer is not actually armed, but used for storage so that code checking for expiry times can unconditially look it up in the timer. So it is safe for that case to set the new expiry time directly. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.542178086@kernel.org commit 0abec32a6836eca6b61ae81e4829f94abd4647c7 Author: Peter Zijlstra Date: Tue Feb 24 17:36:06 2026 +0100 sched/hrtick: Mark hrtick timer LAZY_REARM The hrtick timer is frequently rearmed before expiry and most of the time the new expiry is past the armed one. As this happens on every context switch it becomes expensive with scheduling heavy work loads especially in virtual machines as the "hardware" reprogamming implies a VM exit. hrtimer now provide a lazy rearm mode flag which skips the reprogamming if: 1) The timer was the first expiring timer before the rearm 2) The new expiry time is farther out than the armed time This avoids a massive amount of reprogramming operations of the hrtick timer for the price of eventually taking the alredy armed interrupt for nothing. Mark the hrtick timer accordingly. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.475409346@kernel.org commit b7dd64778aa3f89de9afa1e81171cfe110ddc525 Author: Peter Zijlstra Date: Tue Feb 24 17:36:01 2026 +0100 hrtimer: Provide LAZY_REARM mode The hrtick timer is frequently rearmed before expiry and most of the time the new expiry is past the armed one. As this happens on every context switch it becomes expensive with scheduling heavy work loads especially in virtual machines as the "hardware" reprogamming implies a VM exit. Add a lazy rearm mode flag which skips the reprogamming if: 1) The timer was the first expiring timer before the rearm 2) The new expiry time is farther out than the armed time This avoids a massive amount of reprogramming operations of the hrtick timer for the price of eventually taking the alredy armed interrupt for nothing. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.408524456@kernel.org commit c8cdb9b516407a0b8c653c9c1d6f0931c3864384 Author: Thomas Gleixner Date: Tue Feb 24 17:35:56 2026 +0100 sched/hrtick: Avoid tiny hrtick rearms Tiny adjustments to the hrtick expiry time below 5 microseconds are just causing extra work for no real value. Filter them out when restarting the hrtick. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.340593047@kernel.org commit 96d1610e0b20b5a627773874b4514ae922ad98f6 Author: Thomas Gleixner Date: Tue Feb 24 17:35:52 2026 +0100 sched: Optimize hrtimer handling schedule() provides several mechanisms to update the hrtick timer: 1) When the next task is picked 2) When the balance callbacks are invoked before rq::lock is released Each of them can result in a first expiring timer and cause a reprogram of the clock event device. Solve this by deferring the rearm to the end of schedule() right before releasing rq::lock by setting a flag on entry which tells hrtick_start() to cache the runtime constraint in rq::hrtick_delay without touching the timer itself. Right before releasing rq::lock evaluate the flags and either rearm or cancel the hrtick timer. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.273068659@kernel.org commit c3a92213eb3dd8ea6f664d16a08eda800e34eaad Author: Thomas Gleixner Date: Tue Feb 24 17:35:47 2026 +0100 sched: Use hrtimer_highres_enabled() Use the static branch based variant and thereby avoid following three pointers. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.203610956@kernel.org commit 0a93d30861617ecf207dcc4c6c736435fac36dae Author: Thomas Gleixner Date: Tue Feb 24 17:35:42 2026 +0100 hrtimer: Provide a static branch based hrtimer_hres_enabled() The scheduler evaluates this via hrtimer_is_hres_active() every time it has to update HRTICK. This needs to follow three pointers, which is expensive. Provide a static branch based mechanism to avoid that. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.136503358@kernel.org commit d19ff16c11db38f3ee179d72751fb9b340174330 Author: Peter Zijlstra Date: Tue Feb 24 17:35:37 2026 +0100 hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() Much like hrtimer_reprogram(), skip programming if the cpu_base is running the hrtimer interrupt. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Juri Lelli Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/20260224163429.069535561@kernel.org commit d70c1080a957a5144e6c40e95bcbe04ab542fe05 Author: Thomas Gleixner Date: Tue Feb 24 17:35:32 2026 +0100 sched: Avoid ktime_get() indirection The clock of the hrtick and deadline timers is known to be CLOCK_MONOTONIC. No point in looking it up via hrtimer_cb_get_time(). Just use ktime_get() directly. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163429.001511662@kernel.org commit 5d88e424ec1b3ea7f552bd14d932f510146c45c7 Author: Peter Zijlstra (Intel) Date: Tue Feb 24 17:35:27 2026 +0100 sched/fair: Make hrtick resched hard Since the tick causes hard preemption, the hrtick should too. Letting the hrtick do lazy preemption completely defeats the purpose, since it will then still be delayed until a old tick and be dependent on CONFIG_HZ. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163428.933894105@kernel.org commit 97015376642f3cb7aa5c3cdb13bf094e94fbcd81 Author: Peter Zijlstra (Intel) Date: Tue Feb 24 17:35:22 2026 +0100 sched/fair: Simplify hrtick_update() hrtick_update() was needed when the slice depended on nr_running, all that code is gone. All that remains is starting the hrtick when nr_running becomes more than 1. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260224163428.866374835@kernel.org commit 558c18d3fbb6c5b9c0b42629d7fe34476363ac00 Author: Peter Zijlstra Date: Tue Feb 24 17:35:17 2026 +0100 sched/eevdf: Fix HRTICK duration The nominal duration for an EEVDF task to run is until its deadline. At which point the deadline is moved ahead and a new task selection is done. Try and predict the time 'lost' to higher scheduling classes. Since this is an estimate, the timer can be both early or late. In case it is early task_tick_fair() will take the !need_resched() path and restarts the timer. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Juri Lelli Link: https://patch.msgid.link/20260224163428.798198874@kernel.org commit caf08514bbee0736c31d8d4f406e3415cdf726bb Author: Abel Vesa Date: Mon Feb 23 10:19:38 2026 +0200 dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: document the Eliza QMP UFS PHY Document the QMP UFS PHY compatible for the Eliza Platform. It is fully compatible with the PHY implemented in SM8650, so use the SM8650 compatible as fallback. While at it, move the QCS8300 one so that it is sorted correctly by fallback compatible. Reviewed-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Link: https://patch.msgid.link/20260223-eliza-bindings-phy-ufs-v3-1-2b0c0f00bcb6@oss.qualcomm.com Signed-off-by: Vinod Koul commit 520a98bdf7ae0130e22d8adced3d69a2e211b41f Author: Elson Serrao Date: Tue Feb 17 12:11:30 2026 -0800 phy: qcom: m31-eusb2: clear PLL_EN during init The driver currently sets bit 0 of USB_PHY_CFG1 (PLL_EN) during PHY initialization. According to the M31 EUSB2 PHY hardware documentation, this bit is intended only for test/debug scenarios and does not control mission mode operation. Keeping PLL_EN asserted causes the PHY to draw additional current during USB bus suspend. Clearing this bit results in lower suspend power consumption without affecting normal operation. Update the driver to leave PLL_EN cleared as recommended by the hardware documentation. Fixes: 9c8504861cc4 ("phy: qcom: Add M31 based eUSB2 PHY driver") Cc: stable@vger.kernel.org Signed-off-by: Elson Serrao Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260217201130.2804550-1-elson.serrao@oss.qualcomm.com Signed-off-by: Vinod Koul commit 945d0fec02f6c22b182d51d8da39aa1b0df9f622 Author: Thomas Zimmermann Date: Fri Feb 27 14:31:04 2026 +0100 drm/i915: Test for imported buffers with drm_gem_is_imported() Instead of testing import_attach for imported GEM buffers, invoke drm_gem_is_imported() to do the test. The test itself does not change. Signed-off-by: Thomas Zimmermann Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: intel-gfx@lists.freedesktop.org Reviewed-by: Tvrtko Ursulin Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260227133113.235940-5-tzimmermann@suse.de commit 67ee9ccaa34a11c317411bb8e7d305d93d0b4111 Author: Yulin Lu Date: Thu Feb 5 16:22:19 2026 +0800 phy: eswin: Create eswin directory and add EIC7700 SATA PHY driver Create the eswin phy driver directory and add support for the SATA PHY driver on the EIC7700 SoC platform. Signed-off-by: Yulin Lu Link: https://patch.msgid.link/20260205082219.1521-1-luyulin@eswincomputing.com Signed-off-by: Vinod Koul commit 820265f7b666d588bcb7df06f3332265c59e8cea Author: Yulin Lu Date: Thu Feb 5 16:21:29 2026 +0800 dt-bindings: phy: eswin: Document the EIC7700 SoC SATA PHY Document the SATA PHY on the EIC7700 SoC platform, describing its usage. Signed-off-by: Yulin Lu Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260205082129.1482-1-luyulin@eswincomputing.com Signed-off-by: Vinod Koul commit 290a35756aaef85bbe0527eaf451f533a61b5f6c Author: Janne Grunau Date: Sun Feb 15 09:02:51 2026 +0100 phy: apple: apple: Use local variable for ioremap return value The indirection through the resources array is unnecessarily complicated and resuling in using IS_ERR() and PTR_ERR() on a valid address. A local variable for the devm_ioremap_resource() return value is both easier to read and matches expectations when reading code. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/asahi/aYXvX1bYOXtYCgfC@stanley.mountain/ Suggested-by: Vladimir Oltean Fixes: 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY") Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260215-phy-apple-resource-err-ptr-v2-1-e43c22453682@jannau.net Signed-off-by: Vinod Koul commit 41dae5ac5e157b0bb260f381eb3df2f4a4610205 Author: Thomas Zimmermann Date: Fri Feb 27 14:31:05 2026 +0100 drm/nouveau: Test for imported buffers with drm_gem_is_imported() Instead of testing import_attach for imported GEM buffers, invoke drm_gem_is_imported() to do the test. The test itself does not change. Signed-off-by: Thomas Zimmermann Cc: Lyude Paul Cc: Danilo Krummrich Cc: nouveau@lists.freedesktop.org Link: https://patch.msgid.link/20260227133113.235940-6-tzimmermann@suse.de Signed-off-by: Danilo Krummrich commit b6b7d1ae0653dcaa356be31c0de221311e922ccd Author: Krzysztof Kozlowski Date: Mon Feb 16 12:04:16 2026 +0100 phy: qcom: qmp-usbc: Simplify check for non-NULL pointer Pointers should not use explicit '0' comparison, so just use standard evaluation as non-NULL: phy-qcom-qmp-usbc.c:1682:31: warning: Using plain integer as NULL pointer Signed-off-by: Krzysztof Kozlowski Reviewed-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260216110413.159994-6-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Vinod Koul commit c77eee5b44b8d32d471cf17fa193b395e321ef37 Author: Krzysztof Kozlowski Date: Mon Feb 16 12:04:15 2026 +0100 phy: marvell: mmp3-hsic: Avoid re-casting __iomem __iomem annotated memory must be accessed via dedicated accessors, even if actual code is correct (accessing the driver data in mmp3_hsic_phy_init() brings back the __iomem cast), but dropping its cast (with or without __force) when storing as driver data seems like less readable code for any future changes. Instead, add a dedicated wrapping structure just to hold the pointer without changing the __iomem cast. This makes the code explicit, obvious and solves the sparse warning: phy-mmp3-hsic.c:58:31: warning: cast removes address space '__iomem' of expression Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260216110413.159994-5-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Vinod Koul commit b3fddddf3fb49c7472e73680d6ea5d771f9514e8 Author: Krzysztof Kozlowski Date: Mon Feb 16 12:04:14 2026 +0100 phy: apple: atc: Make atcphy_dwc3_reset_ops variable static File-scope 'atcphy_dwc3_reset_ops' is not used outside of this unit, so make it static to silence sparse warning: atc.c:2026:32: warning: symbol 'atcphy_dwc3_reset_ops' was not declared. Should it be static? Signed-off-by: Krzysztof Kozlowski Reviewed-by: Janne Grunau Link: https://patch.msgid.link/20260216110413.159994-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Vinod Koul commit 7df891f2c39442c120fb4f9bfdd7c80e6de84015 Author: Luca Leonardo Scorcia Date: Mon Feb 23 16:22:47 2026 +0000 dt-bindings: phy: mediatek,dsi-phy: Add support for mt8167 Add support for the MediaTek mt8167 SoC: the DSI PHY found in this chip is fully compatible with the one found in the mt2701 SoC. Signed-off-by: Luca Leonardo Scorcia Reviewed-by: AngeloGioacchino Del Regno Acked-by: Krzysztof Kozlowski Reviewed-by: CK Hu Link: https://patch.msgid.link/92530e0a31eca1feb822f5c5fd4ac894937dd6c7.1771863641.git.l.scorcia@gmail.com Signed-off-by: Vinod Koul commit 8787fa1da603e9e51efff11841e97b5d374aef34 Author: Jiayu Du Date: Wed Jan 21 22:55:24 2026 +0800 phy: usb: Add driver for Canaan K230 USB 2.0 PHY Add driver for the USB 2.0 PHY in Canaan K230 SoC, which supports PHY initialization and power management. Add Kconfig/Makefile under drivers/phy/canaan/. Signed-off-by: Jiayu Du Link: https://patch.msgid.link/20260121145526.14672-4-jiayu.riscv@isrc.iscas.ac.cn Signed-off-by: Vinod Koul commit 50357e7d7992ba8f02c87ff7a5c4db17918635da Author: Jiayu Du Date: Wed Jan 21 22:55:22 2026 +0800 dt-bindings: phy: Add Canaan K230 USB PHY K230 SoC USB PHY requires configuring registers for control and configuration. Add USB phy bindings for K230 SoC. Reviewed-by: Rob Herring (Arm) Signed-off-by: Jiayu Du Link: https://patch.msgid.link/20260121145526.14672-2-jiayu.riscv@isrc.iscas.ac.cn Signed-off-by: Vinod Koul commit 9587fde0da0365d300ea1c967e63ad3fe09b883e Author: Yuto Ohnuki Date: Mon Feb 23 14:03:33 2026 +0000 fuse: refactor duplicate queue teardown operation Extract common queue iteration and teardown logic into fuse_uring_teardown_all_queues() helper function to eliminate code duplication between fuse_uring_async_stop_queues() and fuse_uring_stop_queues(). This is a pure refactoring with no functional changes, intended to improve maintainability. Signed-off-by: Yuto Ohnuki Reviewed-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit 68b69fa0edb241a946cd4c850110990f30705164 Author: Yuto Ohnuki Date: Mon Feb 16 07:31:58 2026 +0000 virtiofs: add FUSE protocol validation Add virtio_fs_verify_response() to validate that the server properly follows the FUSE protocol by checking: - Response length is at least sizeof(struct fuse_out_header). - oh.len matches the actual response length. - oh.unique matches the request's unique identifier. On validation failure, set error to -EIO and normalize oh.len to prevent underflow in copy_args_from_argbuf(). Addresses the TODO comment in virtio_fs_request_complete(). Signed-off-by: Yuto Ohnuki Reviewed-by: Stefan Hajnoczi Signed-off-by: Miklos Szeredi commit 42fbb31310b2c145308d3cdcb32d8f05998cfd6c Author: Sergio Lopez Date: Mon Jan 19 00:24:11 2026 +0100 fuse: mark DAX inode releases as blocking Commit 26e5c67deb2e ("fuse: fix livelock in synchronous file put from fuseblk workers") made fputs on closing files always asynchronous. As cleaning up DAX inodes may require issuing a number of synchronous request for releasing the mappings, completing the release request from the worker thread may lead to it hanging like this: [ 21.386751] Workqueue: events virtio_fs_requests_done_work [ 21.386769] Call trace: [ 21.386770] __switch_to+0xe4/0x140 [ 21.386780] __schedule+0x294/0x72c [ 21.386787] schedule+0x24/0x90 [ 21.386794] request_wait_answer+0x184/0x298 [ 21.386799] __fuse_simple_request+0x1f4/0x320 [ 21.386805] fuse_send_removemapping+0x80/0xa0 [ 21.386810] dmap_removemapping_list+0xac/0xfc [ 21.386814] inode_reclaim_dmap_range.constprop.0+0xd0/0x204 [ 21.386820] fuse_dax_inode_cleanup+0x28/0x5c [ 21.386825] fuse_evict_inode+0x120/0x190 [ 21.386834] evict+0x188/0x320 [ 21.386847] iput_final+0xb0/0x20c [ 21.386854] iput+0xa0/0xbc [ 21.386862] fuse_release_end+0x18/0x2c [ 21.386868] fuse_request_end+0x9c/0x2c0 [ 21.386872] virtio_fs_request_complete+0x150/0x384 [ 21.386879] virtio_fs_requests_done_work+0x18c/0x37c [ 21.386885] process_one_work+0x15c/0x2e8 [ 21.386891] worker_thread+0x278/0x480 [ 21.386898] kthread+0xd0/0xdc [ 21.386902] ret_from_fork+0x10/0x20 Here, the virtio-fs worker_thread is waiting on request_wait_answer() for a reply from the virtio-fs server that is already in the virtqueue but will never be processed since it's that same worker thread the one in charge of consuming the elements from the virtqueue. To address this issue, when relesing a DAX inode mark the operation as potentially blocking. Doing this will ensure these release requests are processed on a different worker thread. Signed-off-by: Sergio Lopez Reviewed-by: Darrick J. Wong Signed-off-by: Miklos Szeredi commit 0919db9f358328060af5d2501905311000dfafc1 Author: Denis Benato Date: Mon Feb 16 18:55:39 2026 +0100 HID: asus: always fully initialize devices ASUS has more devices other than laptop keyboards which needs to be initializated: the init sequence is the same as keyboards. ID1 and ID2 are USB report IDs that are correctly enumerated: send init commands to all devices that supports those reports IDs. Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina commit 19134a133184fcc49c41cf42797cb2e7fef76065 Author: Ziyi Guo Date: Wed Feb 11 02:20:52 2026 +0000 ext2: avoid drop_nlink() during unlink of zero-nlink inode in ext2_unlink() ext2_unlink() calls inode_dec_link_count() unconditionally, which invokes drop_nlink(). If the inode was loaded from a corrupted disk image with i_links_count == 0, drop_nlink() triggers WARN_ON(inode->i_nlink == 0) Follow the ext4 pattern from __ext4_unlink(): check i_nlink before decrementing. If already zero, skip the decrement. Signed-off-by: Ziyi Guo Link: https://patch.msgid.link/20260211022052.973114-1-n7l8m4@u.northwestern.edu Signed-off-by: Jan Kara commit ad0e9663f0f5b0ed8e27d3690c5ac9de72243fba Author: Milos Nikic Date: Fri Feb 6 18:29:20 2026 -0800 ext2: guard reservation window dump with EXT2FS_DEBUG The function __rsv_window_dump() is a heavyweight debug tool that walks the reservation red-black tree. It is currently guarded by #if 1, forcing it to be compiled into all kernels, even production ones. Match the rest of the file by guarding it with #ifdef EXT2FS_DEBUG, so it is only included when explicit debugging is enabled. This removes the unused function code from standard builds. Signed-off-by: Milos Nikic Link: https://patch.msgid.link/20260207022920.258247-1-nikic.milos@gmail.com Signed-off-by: Jan Kara commit 0cf9c58bf654d0f27abe18005281dbf9890de401 Author: Milos Nikic Date: Fri Feb 6 17:06:17 2026 -0800 ext2: replace BUG_ON with WARN_ON_ONCE in ext2_get_blocks If ext2_get_blocks() is called with maxblocks == 0, it currently triggers a BUG_ON(), causing a kernel panic. While this condition implies a logic error in the caller, a filesystem should not crash the system due to invalid arguments. Replace the BUG_ON() with a WARN_ON_ONCE() to provide a stack trace for debugging, and return -EINVAL to handle the error gracefully. Signed-off-by: Milos Nikic Link: https://patch.msgid.link/20260207010617.216675-1-nikic.milos@gmail.com Signed-off-by: Jan Kara commit 6d942c874f6fc8cea801981b6f2cfd9829a641d4 Author: Milos Nikic Date: Fri Feb 6 16:29:08 2026 -0800 ext2: remove stale TODO about kmap The TODO comment in the file header asking to get rid of kmap() is outdated. The code has already been converted to use the folio API (specifically kmap_local_folio). Remove the stale comment to reflect the current state of the code. Signed-off-by: Milos Nikic Link: https://patch.msgid.link/20260207002908.176933-1-nikic.milos@gmail.com Signed-off-by: Jan Kara commit 937c262d4f55e472f5bd66cf8a293f20da2616f4 Author: Adarsh Das Date: Fri Feb 6 18:26:38 2026 +0530 fs: udf: avoid assignment in condition when selecting allocation goal Avoid assignment inside an if condition when choosing the block allocation goal in inode_getblk(), and make the priority order explicit. No functional change. [JK: Fixup conditions to really not change functionality] Signed-off-by: Adarsh Das Link: https://patch.msgid.link/20260206125638.94194-1-adarshdas950@gmail.com Signed-off-by: Jan Kara commit ac9ccb6e75c5af84095bece1019f22cb45ab43e5 Author: Ethan Tidmore Date: Thu Feb 26 10:09:06 2026 -0600 ntfs: Fix possible deadlock In the error path for ntfs_attr_map_whole_runlist() the lock is not released. Add release for lock. Detected by Smatch: fs/ntfs/attrib.c:5197 ntfs_non_resident_attr_collapse_range() warn: inconsistent returns '&ni->runlist.lock'. Signed-off-by: Ethan Tidmore Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 1c85157ea88e87644e171c7ae3e1877f43b4b345 Author: Ethan Tidmore Date: Thu Feb 26 10:09:05 2026 -0600 ntfs: Add missing error code If ntfs_attr_iget() fails no error code is assigned to be returned. Detected by Smatch: fs/ntfs/attrib.c:2665 ntfs_attr_add() warn: missing error code 'err' Signed-off-by: Ethan Tidmore Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit c418e96754100a9cafd7bff32c83cad746f32781 Author: Ethan Tidmore Date: Thu Feb 26 10:09:04 2026 -0600 ntfs: Place check before dereference The variable ni has the possiblity of being null and is checked for it but, only after it was dereferenced in a log message. Put check before dereference. Detected by Smatch: fs/ntfs/attrib.c:2115 ntfs_resident_attr_record_add() warn: variable dereferenced before check 'ni' (see line 2111) fs/ntfs/attrib.c:2237 ntfs_non_resident_attr_record_add() warn: variable dereferenced before check 'ni' (see line 2232) Signed-off-by: Ethan Tidmore Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 5ea5b6ff0d63aef1dc3fb25445acea183f61a934 Author: Maxime Ripard Date: Tue Feb 24 12:03:10 2026 +0100 drm/tests: Mark slow tests as slow Some DRM tests cross the 1s execution time threshold that defines a test as slow. Let's flag them as such. Reviewed-by: Arunpravin Paneer Selvam Reviewed-by: Tvrtko Ursulin Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260224110310.1854608-1-mripard@kernel.org Signed-off-by: Maxime Ripard commit c7f92042d3f3d4f084794f5314fa10366084179c Author: Tzung-Bi Shih Date: Mon Feb 23 14:17:26 2026 +0800 selftests: gpio: Add gpio-cdev-uaf tests Add tests for gpiolib-cdev to make sure accessing to dangling resources via the opening file descriptor won't crash the system after the underlying resource providers have gone. Reviewed-by: Linus Walleij Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260223061726.82161-7-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit ee68f18d1f0d943d93070eb8cb05598b8b7f0922 Author: Tzung-Bi Shih Date: Mon Feb 23 14:17:25 2026 +0800 gpio: cdev: Don't check struct gpio_chip in gpio_chrdev_open() It's harmless even if: chrdev_open() and cdev_device_del() run at the same time, and gpio_chrdev_open() gets called after the underlying GPIO chip has gone. The subsequent file operations check the availability of struct gpio_chip anyway. Don't check struct gpio_chip in gpio_chrdev_open(). Reviewed-by: Linus Walleij Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260223061726.82161-6-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit cf674f1a0c9893ee1acef832679562007a94250a Author: Tzung-Bi Shih Date: Mon Feb 23 14:17:24 2026 +0800 gpio: Ensure struct gpio_chip for gpiochip_setup_dev() Ensure struct gpio_chip for gpiochip_setup_dev(). This eliminates a few checks for struct gpio_chip. Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260223061726.82161-5-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit 395b8e555dfcbab6b28f360e39bd048b2f3e362b Author: Tzung-Bi Shih Date: Mon Feb 23 14:17:23 2026 +0800 gpio: sysfs: Remove redundant check for struct gpio_chip gpiochip_sysfs_unregister() is only called by gpiochip_remove() where the struct gpio_chip is ensured. Remove the redundant check. Reviewed-by: Linus Walleij Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260223061726.82161-4-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit 049f71131734c47a6aaca2472273aef2cd17a6d8 Author: Tzung-Bi Shih Date: Mon Feb 23 14:17:22 2026 +0800 gpio: Remove redundant check for struct gpio_chip gpiolib_dbg_show() is only called by gpiolib_seq_show() which has ensured the struct gpio_chip. Remove the redundant check in gpiolib_dbg_show(). Reviewed-by: Linus Walleij Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260223061726.82161-3-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit cc11f4ef666fbca02c8a2f11d0184d57e6b75579 Author: Tzung-Bi Shih Date: Mon Feb 23 14:17:21 2026 +0800 gpio: Access `gpio_bus_type` in gpiochip_setup_dev() To make the intent clear, access `gpio_bus_type` only when it's ready in gpiochip_setup_dev(). Reviewed-by: Linus Walleij Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260223061726.82161-2-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit b08b3f16bbf3330d7c764d019564ebff0b68e390 Merge: eb58f2b9bb0909 16fdabe143fce2 Author: Bartosz Golaszewski Date: Fri Feb 27 10:04:49 2026 +0100 Merge branch 'gpio/dev-init-rework' into gpio/for-next Pull in a major rework of gpiochip_add_data_with_key() commit 4827d6d83f079f7d58d6ec0ed49f85dd2b90837f Author: Philipp Stanner Date: Thu Jan 8 09:30:20 2026 +0100 drm/sched: Remove racy hack from drm_sched_fini() drm_sched_fini() contained a hack to work around a race in amdgpu. According to AMD, the hack should not be necessary anymore. In case there should have been undetected users, commit 975ca62a014c ("drm/sched: Add warning for removing hack in drm_sched_fini()") had added a warning one release cycle ago. Thus, it can be derived that the hack can be savely removed by now. Remove the hack. Acked-by: Danilo Krummrich Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20260108083019.63532-2-phasta@kernel.org commit eb58f2b9bb0909ebce64e1a90b21b5cc2c9f17df Author: Bartosz Golaszewski Date: Thu Feb 26 10:56:36 2026 +0100 gpiolib: match secondary fwnode too in gpio_device_find_by_fwnode() In GPIOLIB, during fwnode lookup, after having resolved the consumer's reference to a specific fwnode, we only match it against the primary node of the controllers. Let's extend that to also the secondary node by reworking gpio_chip_match_by_fwnode() Suggested-by: Dmitry Torokhov Reviewed-by: Danilo Krummrich Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Linus Walleij Reviewed-by: Sakari Ailus Link: https://patch.msgid.link/20260226-device-match-secondary-fwnode-v4-1-27bd0cfbd8c6@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit fa4a3a95139e7293c1333a33bd7b19e7261e3bd0 Author: Bartosz Golaszewski Date: Mon Feb 23 18:20:06 2026 +0100 gpio: introduce a header for symbols shared by suppliers and consumers GPIO_LINE_DIRECTION_IN/OUT definitions are used both in supplier (GPIO controller drivers) as well as consumer code. In order to not force the consumers to include gpio/driver.h or - even worse - to redefine these values, create a new header file - gpio/defs.h - and move them over there. Include this header from both gpio/consumer.h and gpio/driver.h. Reviewed-by: Linus Walleij Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260223172006.204268-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit b2d51bc1601c762c63f19c119589a0a0c44bc8ec Author: Andy Shevchenko Date: Thu Feb 26 10:20:23 2026 +0100 gpio: generic: Don't use 'proxy' headers Update header inclusions to follow IWYU (Include What You Use) principle. Signed-off-by: Andy Shevchenko Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260226092023.4096921-1-andriy.shevchenko@linux.intel.com Signed-off-by: Bartosz Golaszewski commit e3f33adfa3a3be16ef59ed849fbbd10e966e98b0 Author: Ville Syrjälä Date: Thu Feb 26 15:01:50 2026 +0200 drm/i915/overlay: Convert overlay to parent interface Convert the direct i915_overlay_*() calls from the display side to go over a new parent interface instead. v2: Correctly handle the ERR_PTR returned by i915_overlay_obj_lookup() (Jani) v3: Rebase due to the NULL check in intel_overlay_cleanup() Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226130150.16816-1-ville.syrjala@linux.intel.com commit 059f8782bfd6becaa382089fba95f7447469cbc1 Author: Ville Syrjälä Date: Thu Feb 26 15:38:55 2026 +0200 drm/i915/overlay: Move i915 specific code into i915_overlay.c Relocate the i915 driver specific parts of the overlay code into i915_overlay.c. This leaves intel_overlay.c with just the display specific code. The one annoyance here is the DSPCLK_GATE_D register access being done from i830_overlay_clock_gating(). The register definition lives on the display side as we do need to access it on other platforms there. Since it's just one register and bit, I decided to just duplicate that part in i915_reg.h. v2: Use kzalloc_obj() Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226133855.17690-1-ville.syrjala@linux.intel.com commit 5b3fe7c78cbefb646b01a1a94e0c1cce674d4c56 Author: Ville Syrjälä Date: Thu Feb 26 15:01:13 2026 +0200 drm/i915/overlay: Don't use fetch_and_zero() in display code We don't generally want fetch_and_zero() on the display side, so stop using it in the display side intel_overlay_cleanup(). Fortunately we don't really have anything to do here apart from freeing the data. And we'll keep on clearing the pointer, just in case something somewhere cares about it. Note that once i915_overlay_cleanup() is converted to the parent interface we can't call it unconditionally (as xe won't have it). So we need to keep the early bailout for overlay==NULL. v2: Adjust the commit message since we do apparently have fetch_and_zero() in display code as well (Jani) v3: Skip i915_overlay_cleanup() if the overlay wasn't initialized Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226130113.16714-1-ville.syrjala@linux.intel.com commit 4f7a2a45e0f3a5449e1ceae603786816c7ed7f76 Author: Ville Syrjälä Date: Thu Feb 26 12:07:35 2026 +0200 drm/i915/overlay: Split 'struct intel_overlay' Split the i915 driver specific bits from 'struct intel_overlay' into a seaarate 'struct i915_overlay'. The latter will move to the i915 side of the parent vs. display driver split. The display side will also need to know the virtual address of the register map. That now gets passed as the return value from i915_overlay_setup(), so that the display side doesn't need to know how the mapping was achieved. v2: Use kzalloc_obj() Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-17-ville.syrjala@linux.intel.com commit 805d0447b7fcd78e1300e72819012d8af33843cd Author: Ville Syrjälä Date: Thu Feb 26 12:07:34 2026 +0200 drm/i915/overlay: s/dev_priv/i915/ Rename the one lingering 'dev_priv' variable to the more modern 'i915' in the overlay code. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-16-ville.syrjala@linux.intel.com commit ca0eacbb4643bef82bb5aaba65ed4425a5922f6f Author: Ville Syrjälä Date: Thu Feb 26 12:07:33 2026 +0200 drm/i915/overlay: Make i830_overlay_clock_gating() i915 specific i830_overlay_clock_gating() will remain on the i915 side of the parent vs. display driver split. Stop using display specific stuff inside it. The one annoyance here is access to the display engine's DSPCLK_GATE_D register. The proper way to deal with that might be to move it to the display side, but that seems a bit hard right now. So leave it where it is for now. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-15-ville.syrjala@linux.intel.com commit 21f424e22023aab1f1757dedd1520a7e3a98f78a Author: Ville Syrjälä Date: Thu Feb 26 12:07:32 2026 +0200 drm/i915/overlay: Adjust i915 specific interfaces Adjust the names ("i915_overlay_" prefix) and calling convention (pass the driver agnostic 'struct drm_device'() of the functions that will provide the remainder of the parent driver interface to be used by the overlay display code. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-14-ville.syrjala@linux.intel.com commit 99e33b5283b909b592e43c0c5b710b9ff95147ec Author: Ville Syrjälä Date: Thu Feb 26 12:07:31 2026 +0200 drm/i915/overlay: Rename low level i915 specific functions Some of the lower level functions in the overlay code will move to the i915 side of the upcoming parent vs. display driver split. Move all such functions to the "i915_overlay_" namespace to make it easier to see what belongs where. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-13-ville.syrjala@linux.intel.com commit c5649ff6e898456fe30693ce4c38c77b1b728b12 Author: Ville Syrjälä Date: Thu Feb 26 12:07:30 2026 +0200 drm/i915/overlay: Abstract buffer (un)pinning Make the buffer (un)pinning a bit more abstract so that the display side of the code doesn't need to know about i915 specific things (i915_ggtt_offset() and i915_vma_unpin()). In preparation for the full parent vs. display driver split we'll also pass in the drm_device to these functions, although not strictly needed yet. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-12-ville.syrjala@linux.intel.com commit dc1d78b6198822f7fbda273a0beb5236d6dc5989 Author: Ville Syrjälä Date: Thu Feb 26 12:07:29 2026 +0200 drm/i915/overlay: Extract i915_overlay_cleanup() Pull the i915 specific bits of the overlay cleanup into a separate function (i915_overlay_cleanup()) to accommodate the upcoming parent vs. display driver split. For now we'll also have to pass in the overlay struct, but that will disappear once the i915 vs. display split is completed. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-11-ville.syrjala@linux.intel.com commit 8f7bf40ce24969b93c1b086caefb545082f27aab Author: Ville Syrjälä Date: Thu Feb 26 12:07:28 2026 +0200 drm/i915/overlay: Extract i915_overlay_setup() Pull the gem/gt related bits of the overlay setup into a separate function (i915_overlay_setup()) that will eventually move to the i915 side of the parent vs. display driver split. For now we'll also have to pass in the overlay struct, but that will disappear once the i915 vs. display split is completed. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-10-ville.syrjala@linux.intel.com commit b0d7a69ca09deeb4933dcd9b3797e6d96a6f87db Author: Ville Syrjälä Date: Thu Feb 26 12:07:27 2026 +0200 drm/i915/overlay: Extract i915_overlay_reset() overlay->frontbuffer_bits tracking will move to the i915 side of the parent vs. display driver split, so extract the reset part of that into a new function (i915_overlay_reset()). Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-9-ville.syrjala@linux.intel.com commit 35305c65b76e37cc59d7a9e159c614d9914c580a Author: Ville Syrjälä Date: Thu Feb 26 12:07:26 2026 +0200 drm/i915/overlay: Use struct drm_gem_object as the type Use 'struct drm_gem_object' for the BO instead of 'struct drm_i915_gem_object', to avoid having the display side know anything about the i915 specific BO type. v2: Correctly handle the ERR_PTR returned by i915_overlay_obj_lookup() (Jani) Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-8-ville.syrjala@linux.intel.com commit 24d87ce98e54feae55259bb93a436f872f6cc574 Author: Ville Syrjälä Date: Thu Feb 26 12:07:25 2026 +0200 drm/i915/overlay: Introduce i915_overlay_obj_lookup() Extract the BO lookup and tiling check into a new helper called i915_overlay_obj_lookup(). This will have to move to the i915 side of the parent vs. display driver split. There is a slight change here in that we now do the tiling check before taking the modeset locks, but those locks don't protect the BO tiling stuff in any way, so nothing is really different here. Note that the hardware should support X-tiled scanout also for the overlay, but I guess no one ever bothered to hook it up and test it. So the check should stay at least for now. v2: Correctly handle the ERR_PTR returned by i915_overlay_obj_lookup() (Jani) Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-7-ville.syrjala@linux.intel.com commit 6daf9a495c47337b366ad6d8a096a35d38a388e8 Author: Ville Syrjälä Date: Thu Feb 26 12:07:24 2026 +0200 drm/i915/overlay: Relocate the underrun check Move the underrun check out from intel_overlay_continue() so that the DOVSTA register access can stay on the display side of the parent vs. display driver split. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-6-ville.syrjala@linux.intel.com commit 7e3517dfb6933214c00afdfb6fe8fab1ae000aab Author: Ville Syrjälä Date: Thu Feb 26 12:07:23 2026 +0200 drm/i915/overlay: Remove redundant overlay->active Now that we have overlay->frontbuffer_bits, overlay->active is completely redundant, so remove it. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-5-ville.syrjala@linux.intel.com commit 38d9a352c45e6d1d2a42ce173f04b43892d72eb2 Author: Ville Syrjälä Date: Thu Feb 26 12:07:22 2026 +0200 drm/i915/overlay: Extract i915_overlay_is_active() Pull the "is the overlay active?" check to a helper (i915_overlay_is_active()). This will have to move to the i915 side of the parent vs. display driver split. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-4-ville.syrjala@linux.intel.com commit 12cdd837b43bee31f4d0b6c4efc2ae06c93de64d Author: Ville Syrjälä Date: Thu Feb 26 12:07:21 2026 +0200 drm/i915/overlay: Track current frontbuffer_bits Store the current frontbuffer_bits in the overlay data. The main benefit here is that we get rid of the 'crtc->pipe' usage from intel_overlay_flip_prepare() which will have to move to the i915 side of the parent vs. display driver split. And since the goal is to get rid of the crtc stuff, move those out from intel_overlay_off_tail() into intel_overlay_switch_off() since the i915 side doesn't use those anymore, and the display side doesn't need those anymore after that anyway. intel_overlay_off_tail() will itself move to the i915 side of the fence once the driver split is done. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-3-ville.syrjala@linux.intel.com commit 102d712ded3ef2ee5b38ee6afa686aff63afd444 Author: Nicolas Schier Date: Fri Feb 20 19:55:19 2026 +0100 kconfig: Error out on duplicated kconfig inclusion Let kconfig exit with error on duplicated Kconfig file inclusion. Repeated inclusion of Kbuild files are considered bad-practise with regard to maintenance; and Kconfig language is rich enough that there should be no need for that. If repeated inclusion of Kconfig files is detected, error out with messages like: Kconfig.inc1:4: error: repeated inclusion of Kconfig.inc3 Kconfig.inc2:3: note: location of first inclusion of Kconfig.inc3 While commit f094f8a1b273 ("kconfig: allow multiple inclusion of the same file") introduced detection of recursive inclusions of Kconfig files, it explicitly allowed repeated inclusions, unfortunately w/o reasoning. Reported-by: Linus Torvalds Closes: https://lore.kernel.org/all/CAHk-=wj03hLzK2D=+OYmjgcmGM+XYymp8GyaEs=C0=rXG2nb7w@mail.gmail.com/ Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Link: https://patch.msgid.link/20260220-kconfig-error-out-on-duplicated-inclusion-v1-1-be78aa241a53@kernel.org Signed-off-by: Nicolas Schier commit c778db2887f35f77f9e747f4a35285b6b563e5d8 Author: Ville Syrjälä Date: Thu Feb 26 12:07:20 2026 +0200 drm/i915/overlay: Remove GPU hang snapshot stuff The overlay snapshot stuff is a bit annoying because some of it more or less of belongs on the gt side, and some on the display side. Remove the whole thing to avoid having to deal with it when splitting the overlay code around the i915 vs. display boundary. I don't think I've ever actually used this for anything, so no real loss from my POV. And it can always be resurrected later should the need arise. v2: Rebase due to kmalloc_obj() Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260226100738.29997-2-ville.syrjala@linux.intel.com commit 977000589d30f8d4f0777893711199350d474363 Author: Ian Rogers Date: Thu Feb 26 09:59:36 2026 -0800 perf vendor events intel: Update sierraforest events from 1.13 to 1.15 The updated events were published in: https://github.com/intel/perfmon/commit/996bacad8f144e675b32f0096b9fe6813380695c https://github.com/intel/perfmon/commit/93b6ef08ca9b01788458e8f5a0e7cbb716715b7c Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit c592a539172664afa1240ea324d6117dcb461ba3 Author: Ian Rogers Date: Thu Feb 26 09:59:35 2026 -0800 perf vendor events intel: Update sapphirerapids events from 1.35 to 1.36 The updated events were published in: https://github.com/intel/perfmon/commit/bda7f1e1839e2f9ea1ac45da338e6fe5ca6fdbb0 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 19967a42049166dbaa12fbe38d7c93a7148dd4ab Author: Ian Rogers Date: Thu Feb 26 09:59:34 2026 -0800 perf vendor events intel: Update pantherlake events from 1.02 to 1.04 The updated events were published in: https://github.com/intel/perfmon/commit/1f46fa264d202d57dade1d3fd5b58e79c4706147 https://github.com/intel/perfmon/commit/e49581aeb2903dde6fb1d187e9d412df58e01038 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 698fd9606ee685295313b929e64e3efd2cdd924e Author: Ian Rogers Date: Thu Feb 26 09:59:33 2026 -0800 perf vendor events intel: Update meteorlake events from 1.18 to 1.20 The updated events were published in: https://github.com/intel/perfmon/commit/2eebd8e2612a0655e82b88e1d2fab960315c025b https://github.com/intel/perfmon/commit/81c4ce2c16f05b839d2c40e8cf183ed110357b73 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 6ac2011cd0c75f1de029942634c7daf1e31078f2 Author: Ian Rogers Date: Thu Feb 26 09:59:32 2026 -0800 perf vendor events intel: Update lunarlake events from 1.19 to 1.21 The updated events were published in: https://github.com/intel/perfmon/commit/d6755a30419d02930889497741552309343bdb1e https://github.com/intel/perfmon/commit/6c9f684ae1de6229511fd56d1196fdc2db242a41 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 2c0b30e6cc0e09c669a0f166ca3d0d566246d560 Author: Ian Rogers Date: Thu Feb 26 09:59:31 2026 -0800 perf vendor events intel: Update graniterapids events from 1.16 to 1.17 The updated events were published in: https://github.com/intel/perfmon/commit/c9ebc3ff9c3d408a888fbfbe73d386ef86c7306f With new IO and SNC metrics in: https://github.com/intel/perfmon/commit/04cf5e1e804afd775401167870d48cd25864be7b https://github.com/intel/perfmon/commit/98b2602d83de6625bae1e6fcaab3a39b0a341255 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit e4f8be34479c9d29ac0b35c0c8b33250b62cfaad Author: Ian Rogers Date: Thu Feb 26 09:59:30 2026 -0800 perf vendor events intel: Update grandridge events from 1.10 to 1.11 The updated events were published in: https://github.com/intel/perfmon/commit/8ada944c087300c4fc79afcd8512aa3b91bd34f2 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 5c0df1e860100a822d3192edcbf03c1e3b1449a2 Author: Ian Rogers Date: Thu Feb 26 09:59:29 2026 -0800 perf vendor events intel: Update emeraldrapid events from 1.20 to 1.21 The updated events were published in: https://github.com/intel/perfmon/commit/210676cfa8743cd5b9e7cc984fdef1a48542eda4 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 171923140876fa243e7de63a5cc2f3f0eaa48642 Author: Ian Rogers Date: Thu Feb 26 09:59:28 2026 -0800 perf vendor events intel: Update arrowlake events from 1.14 to 1.16 The updated events were published in: https://github.com/intel/perfmon/commit/f0267f720eeab3b5416886c9e0e132fafcb38bbd https://github.com/intel/perfmon/commit/d40cfa317e567fb5e8f6cbd92c81feeb7e6bd3dd Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 5d580ffbb43807153a71113fd725fbf8a416d2d9 Author: Ian Rogers Date: Thu Feb 26 09:59:27 2026 -0800 perf vendor events intel: Update alderlake events from 1.35 to 1.37 The updated events were published in: https://github.com/intel/perfmon/commit/632936400cfc5978c7b4519c865c137de523bfdd https://github.com/intel/perfmon/commit/a96d6bf4b50d6ce31e2ffd0be8d13022d07ae319 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit cc2c37f096f14a4cfcb6297a6c06ed38dc31d885 Author: Uma Shankar Date: Thu Feb 26 23:25:31 2026 +0530 drm/xe/compat: Remove unused i915_reg.h from compat header Display Code is made independent of i915_reg.h, hence it can be dropped from compat header. Signed-off-by: Uma Shankar Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260226175531.2324526-1-uma.shankar@intel.com commit 34268365a9e9424e38083c8f318cc34b153dcb07 Author: Shivam Kalra Date: Mon Feb 16 19:39:57 2026 +0530 rust_binder: shrink all_procs when deregistering processes When a process is deregistered from the binder context, the all_procs vector may have significant unused capacity. Add logic to shrink the vector using a conservative strategy that prevents shrink-then-regrow oscillation. The shrinking strategy triggers when length drops below 1/4 of capacity, and shrinks to twice the current length rather than to the exact length. This provides hysteresis to avoid repeated reallocations when the process count fluctuates. The shrink operation uses GFP_KERNEL and is allowed to fail gracefully since it is purely an optimization. The vector remains valid and functional even if shrinking fails. Suggested-by: Alice Ryhl Reviewed-by: Alice Ryhl Signed-off-by: Shivam Kalra Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260216-binder-shrink-vec-v3-v6-3-ece8e8593e53@zohomail.in Signed-off-by: Greg Kroah-Hartman commit fbfc0d615368ddf71899dbea2205e741c79b23e8 Author: Shivam Kalra Date: Mon Feb 16 19:39:56 2026 +0530 rust: alloc: add KUnit tests for KVVec shrink_to Add comprehensive KUnit tests for the shrink_to method for KVVec. The tests verify: - Basic shrinking from multiple pages to fewer pages with data integrity preservation - Empty vector shrinking to zero capacity - No-op behavior when shrinking to a larger capacity than current - Respect for min_capacity parameter when larger than vector length These tests ensure that the shrinking logic correctly identifies when memory can be reclaimed (by freeing at least one page) and that data integrity is maintained throughout shrink operations. Reviewed-by: Alice Ryhl Acked-by: Danilo Krummrich Signed-off-by: Shivam Kalra Link: https://patch.msgid.link/20260216-binder-shrink-vec-v3-v6-2-ece8e8593e53@zohomail.in Signed-off-by: Greg Kroah-Hartman commit 47ac2a4b5cd8f0cb826f6368c2fc0eeb97e5d55f Author: Shivam Kalra Date: Mon Feb 16 19:39:55 2026 +0530 rust: kvec: implement shrink_to for KVVec Implement shrink_to method specifically for `KVVec` (i.e., `Vec`). `shrink_to` reduces the vector's capacity to a specified minimum. For kmalloc-backed allocations, the method delegates to realloc(), letting the allocator decide whether shrinking is worthwhile. For vmalloc-backed allocations (detected via is_vmalloc_addr), shrinking only occurs if at least one page of memory can be freed, using an explicit alloc+copy+free since vrealloc does not yet support in-place shrinking. A TODO note marks this for future replacement with a generic shrink_to for all allocators that uses A::realloc() once the underlying allocators properly support shrinking via realloc. Suggested-by: Alice Ryhl Suggested-by: Danilo Krummrich Reviewed-by: Alice Ryhl Acked-by: Danilo Krummrich Signed-off-by: Shivam Kalra Link: https://patch.msgid.link/20260216-binder-shrink-vec-v3-v6-1-ece8e8593e53@zohomail.in Signed-off-by: Greg Kroah-Hartman commit d31ed22a0678da8948439c3009b01c4806a677c9 Author: Jann Horn Date: Fri Feb 13 22:37:31 2026 +0100 rust_binder: use current_euid() for transaction sender identity Binder currently uses from.process.task.euid() as the transaction sender EUID, where from.process.task is the main thread of the process that opened /dev/binder. That's not clean; use the subjective EUID of the current task instead. Signed-off-by: Jann Horn Reviewed-by: Alice Ryhl Acked-by: Gary Guo Link: https://patch.msgid.link/20260213-binder-uid-v1-2-7b795ae05523@google.com Signed-off-by: Greg Kroah-Hartman commit 65b6721522892a4994472fbac41386c63c769511 Author: Jann Horn Date: Fri Feb 13 22:37:30 2026 +0100 binder: use current_euid() for transaction sender identity Binder currently uses task_euid(proc->tsk) as the transaction sender EUID, where proc->tsk is the main thread of the process that opened /dev/binder. That's not clean; use the subjective EUID of the current task instead. Signed-off-by: Jann Horn Reviewed-by: Alice Ryhl Acked-by: Gary Guo Link: https://patch.msgid.link/20260213-binder-uid-v1-1-7b795ae05523@google.com Signed-off-by: Greg Kroah-Hartman commit f3e0b76fc29c4e1ee542f5173a4a631803e69436 Author: Alice Ryhl Date: Thu Feb 19 11:27:00 2026 +0000 rust_binder: avoid name mangling for get_work[_local] Currently ps -A shows processes waiting on schedule() in functions with names such as do_epoll_wait, wait_woken, and the impeccably named _RNvMs2_NtCs8QPsHWIn21X_16rust_binder_main6threadNtB5_6Thread8get_work. To improve how ps output looks, give explicit non-mangled names to the functions where Rust Binder calls schedule(), since these are the most likely places to show up on ps output. The name of rust_binder_waitlcl is truncated instead of using _local suffix because rust_binder_wait_local is sufficiently long that ps shows unaligned output. This is intended to be a temporary workaround until we find a better solution. Adding #[export_name] to every Rust function that calls schedule() is not a great long-term solution. Suggested-by: Matthew Maurer Signed-off-by: Alice Ryhl Acked-by: Gary Guo Link: https://patch.msgid.link/20260219-rust-binder-ps-v2-1-773eca09c125@google.com Signed-off-by: Greg Kroah-Hartman commit f505e978d1a0442adbbde48aed38c084ddea6d6e Author: Mauro Carvalho Chehab Date: Tue Jan 27 10:16:44 2026 +0100 docs: media: document media multi-committers rules and process As the media subsystem will experiment with a multi-committers model, update the Maintainer's entry profile to the new rules, and add a file documenting the process to become a committer and to maintain such rights. Reviewed-by: Ricardo Ribalda Reviewed-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Hans Verkuil commit afdf5530b531c26d0882c88371e60df08df42b9a Author: Hans Verkuil Date: Mon Oct 27 14:13:51 2025 +0100 docs: media: document Media Maintainers Document who the Media Maintainers are and what their responsibilities are. Signed-off-by: Hans Verkuil Reviewed-by: Nicolas Dufresne Reviewed-by: Bryan O'Donoghue Reviewed-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit cc353539ec33971dcabd92279565f7d67d6bef78 Author: Mauro Carvalho Chehab Date: Tue Sep 2 12:02:20 2025 +0200 docs: media: update maintainer-entry-profile for multi-committers As the media subsystem will experiment with a multi-committers model, update the Maintainer's entry profile to the new rules. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Ricardo Ribalda Reviewed-by: Sean Young Reviewed-by: Bryan O'Donoghue Reviewed-by: Sakari Ailus Signed-off-by: Hans Verkuil commit a06f4f9799d292da685a35052a3c87f5961e106d Author: Mauro Carvalho Chehab Date: Tue Sep 2 12:02:19 2025 +0200 MAINTAINERS: fix a couple issues at media input infrastructure The media input infrastructure is missing a record for our maintainer's entry profile. Also, patchwork link is wrong. Fix it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Hans Verkuil commit 54857c52452a7e0d0a7dabee2643bd8adc381dbe Author: Mauro Carvalho Chehab Date: Tue Sep 2 12:02:18 2025 +0200 docs: maintainer-pgp-guide.rst: add a reference for kernel.org sign The media profile documentation will point to kernel.org sign. Add a link to it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Hans Verkuil commit fd6dad4e1ae296b67b87291256878a58dad36c93 Author: Byungchul Park Date: Tue Feb 24 15:14:24 2026 +0900 netmem: remove the pp fields from net_iov Now that the pp fields in net_iov have no users, remove them from net_iov and clean up. Signed-off-by: Byungchul Park Reviewed-by: Simon Horman Reviewed-by: Pavel Begunkov Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260224061424.11219-1-byungchul@sk.com Signed-off-by: Jakub Kicinski commit aebf15e8eb09b01e99f043e9f5d423798aac9d32 Author: Zhengping Zhang Date: Thu Feb 26 10:37:08 2026 +0800 net: airoha: fix typo in function name Corrected the typo in the function name from `airhoa_is_lan_gdm_port` to `airoha_is_lan_gdm_port`. This change ensures consistency in the API naming convention. Signed-off-by: Zhengping Zhang Reviewed-by: Simon Horman Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/tencent_E4FD5D6BC0131E617D848896F5F9FCED6E0A@qq.com Signed-off-by: Jakub Kicinski commit b70190d767be4464e092b252185fa65398bcc662 Author: Tiernan Hubble Date: Tue Feb 24 18:20:25 2026 -0600 net: atlantic: fix reading SFP module info on some AQC100 cards Commit 853a2944aaf3 ("net: atlantic: support reading SFP module info") added support for reading SFP module info on AQC100-based cards. However, it only supports reading directly from the controller's hardware registers, and this does not seem to be supported on certain cards, including my TRENDnet TEG-10GECSFP V3. "ethtool -m" times out when reading certain registers, even when I increase the read poll timeout values. The DPDK "atlantic" driver reads module info via firmware calls instead of directly reading the hardware registers, provided that the NIC's firmware version supports it. This change adapts the DPDK firmware call code to the kernel driver. It preserves the old hardware-based module read code as a fallback when the firmware does not support it, to avoid breaking cards that are currently working. Tested on 2 different TRENDnet TEG-10GECSFP V3 cards, both with firmware version 3.1.121 (current at the time of this patch). Both cards correctly reported module info for a passive DAC cable and 2 different 10G optical transceivers. Signed-off-by: Tiernan Hubble Link: https://patch.msgid.link/20260225002026.1754045-1-thubble@thubble.ca Signed-off-by: Jakub Kicinski commit ed02c6b8b570d49e9766d60b1d9b48ea5e2cfaed Merge: 363c5108e4e2b3 d3549e2b48187d Author: Jakub Kicinski Date: Thu Feb 26 19:19:27 2026 -0800 Merge branch 'support-phys-that-have-inband-autoneg-disabled-with-gem' Charles Perry says: ==================== Support PHYs that have inband autoneg disabled with GEM I'm testing SGMII with a VSC8574 PHY [1] and microchip HPSC SoC [2]. The link can work with or without autoneg, as long as the MAC and the PHY are configured the same way. This doesn't work with the current MAC driver because the MAC inband autoneg is always enabled (in the ->mac_config() phylink_mac_ops). More precisely, the PHY driver (mscc_main.c) has phylink's ->config_inband() implemented while the MAC ->pcs_config() ops has an empty body. This is based on code written by Sean Anderson [3]. Let me know if I should add a From: or Co-developed-by: tag. Logs with inband autoneg (managed = "in-band-status"): root@p64h:~# ifconfig eth1 up 10.180.59.33 macb 40004184000.ethernet eth1: PHY 4000c21e000.mdio-mdio:02 doesn't supply possible interfaces macb 40004184000.ethernet eth1: PHY [4000c21e000.mdio-mdio:02] driver [Microsemi GE VSC8574 SyncE] (irq=POLL) macb 40004184000.ethernet eth1: phy: sgmii setting supported 00000000,00000000,00000000,000042ff advertising 00000000,00000000,00000000,000042ff macb 40004184000.ethernet eth1: configuring for inband/sgmii link mode macb 40004184000.ethernet eth1: major config, requested inband/sgmii macb 40004184000.ethernet eth1: interface sgmii inband modes: pcs=03 phy=03 macb 40004184000.ethernet eth1: major config, active inband/inband,an-enabled/sgmii macb 40004184000.ethernet eth1: phylink_mac_config: mode=inband/sgmii/none adv=00000000,00000000,00000000,000042ff pause=00 macb_pcs_config: PCSANADV=0x1 PCSCNTRL=0x1040 macb_pcs_get_state: PCSSTS=0x109 PCSANLPBASE=0x1 macb_pcs_get_state: PCSSTS=0x12d PCSANLPBASE=0x1801 macb 40004184000.ethernet eth1: phy link down sgmii/Unknown/Unknown/none/off/nolpi macb_pcs_get_state: PCSSTS=0x12d PCSANLPBASE=0x1801 macb_pcs_get_state: PCSSTS=0x12d PCSANLPBASE=0x1801 macb 40004184000.ethernet eth1: phy link up sgmii/1Gbps/Full/none/tx/nolpi macb_pcs_get_state: PCSSTS=0x129 PCSANLPBASE=0x9801 macb_pcs_get_state: PCSSTS=0x12d PCSANLPBASE=0x9801 macb 40004184000.ethernet eth1: Link is Up - 1Gbps/Full - flow control tx Logs without inband autoneg: root@p64h:~# ifconfig eth1 up 10.180.59.33 macb 40004184000.ethernet eth1: PHY 4000c21e000.mdio-mdio:02 doesn't supply possible interfaces macb 40004184000.ethernet eth1: PHY [4000c21e000.mdio-mdio:02] driver [Microsemi GE VSC8574 SyncE] (irq=POLL) macb 40004184000.ethernet eth1: phy: sgmii setting supported 00000000,00000000,00000000,000042ff advertising 00000000,00000000,00000000,000042ff macb 40004184000.ethernet eth1: configuring for phy/sgmii link mode macb 40004184000.ethernet eth1: major config, requested phy/sgmii macb 40004184000.ethernet eth1: interface sgmii inband modes: pcs=03 phy=03 macb 40004184000.ethernet eth1: major config, active phy/outband/sgmii macb 40004184000.ethernet eth1: phylink_mac_config: mode=phy/sgmii/none adv=00000000,00000000,00000000,00000000 pause=00 macb_pcs_config: PCSANADV=0x1 PCSCNTRL=0x40 macb 40004184000.ethernet eth1: phy link down sgmii/Unknown/Unknown/none/off/nolpi macb 40004184000.ethernet eth1: phy link up sgmii/1Gbps/Full/none/tx/nolpi macb 40004184000.ethernet eth1: Link is Up - 1Gbps/Full - flow control tx The above logs are generated with an additional printk() in macb_psc_config() and macb_pcs_get_state() and "#define DEBUG" in phylink.c. [1]: https://www.microchip.com/en-us/product/vsc8574 [2]: https://www.microchip.com/en-us/products/microprocessors/64-bit-mpus/pic64-hpsc [3]: https://lore.kernel.org/all/20250610233547.3588356-1-sean.anderson@linux.dev/ ==================== Link: https://patch.msgid.link/20260224202854.112813-1-charles.perry@microchip.com Signed-off-by: Jakub Kicinski commit d3549e2b48187dc042c0b37bac387948146a023b Author: Charles Perry Date: Tue Feb 24 12:28:54 2026 -0800 net: macb: add the .pcs_inband_caps() callback for SGMII In SGMII mode, GEM can work with or without inband autonegotiation. Signed-off-by: Charles Perry Link: https://patch.msgid.link/20260224202854.112813-4-charles.perry@microchip.com Signed-off-by: Jakub Kicinski commit 7f44b2acc5a111471d8a3ae0e809bd419c0237e0 Author: Charles Perry Date: Tue Feb 24 12:28:53 2026 -0800 net: macb: add support for reporting SGMII inband link status This makes it possible to use in-band autonegotiation with SGMII. If using a device tree, this can be done by adding the managed = "in-band-status" property to the gem node. Signed-off-by: Charles Perry Link: https://patch.msgid.link/20260224202854.112813-3-charles.perry@microchip.com Signed-off-by: Jakub Kicinski commit 1338cfef1ff1b95891990f8677631a834c2cf22d Author: Charles Perry Date: Tue Feb 24 12:28:52 2026 -0800 net: macb: fix SGMII with inband aneg disabled Make it possible to connect a PHY which does not use inband autoneg to a gem MAC using phylink's information. The previous implementation relied on whether or not the link was a fixed-link to disable SGMII autoneg. This commit extend this to all link which are not configured for inband autonegotiation. Signed-off-by: Charles Perry Link: https://patch.msgid.link/20260224202854.112813-2-charles.perry@microchip.com Signed-off-by: Jakub Kicinski commit 40d2f5820951dee818d05c14677277048bd85f9f Author: Suraj Kandpal Date: Tue Feb 24 08:43:22 2026 +0530 drm/i915/backlight: Remove try_vesa_interface Some panels need VESA DPCD AUX backlight but VBT says otherwise. This is why we try with Intel backlight interface over VESA backlight interface. This causes a blankout on such panels without any fallback mechanism. Remove try_vesa_interface and use VESA AUX backlight interface as a fallback mechanism. While at in sneak in a small comment cleanup too. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15679 Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260224031322.2568874-1-suraj.kandpal@intel.com commit 8d869bc943cfe5db08f5aff355b1d8d3abeda865 Author: Vinod Koul Date: Mon Feb 23 12:40:32 2026 +0530 phy: phy-mtk-tphy: Update names and format of kernel-doc comments mtk_phy_pdata documentation does not use correct tag for struct, while at it fix one of member wrongly documented. Warning: drivers/phy/mediatek/phy-mtk-tphy.c:289 cannot understand function prototype: 'struct mtk_phy_pdata' Warning: drivers/phy/mediatek/phy-mtk-tphy.c:296 struct member 'slew_ref_clock_mhz' not described in 'mtk_phy_pdata' Link: https://patch.msgid.link/20260223071032.408425-1-vkoul@kernel.org Signed-off-by: Vinod Koul commit dee40773abe543723adab47319bc25dc70de10a2 Author: Vinod Koul Date: Mon Feb 23 12:28:19 2026 +0530 phy: Sort the subsystem Kconfig Kconfig is supposed to be sorted alphabetically, sadly it has bitrotted so fix that Link: https://patch.msgid.link/20260223065819.395612-1-vkoul@kernel.org Signed-off-by: Vinod Koul commit d8f0ef2aebaa90c0155e266c1fdd6fa2aef44bb1 Author: Vinod Koul Date: Mon Feb 23 12:27:43 2026 +0530 phy: Sort the subsystem Makefile Makefile is supposed to be sorted alphabetically, sadly it has bitrotted so fix that Link: https://patch.msgid.link/20260223065743.395539-1-vkoul@kernel.org Signed-off-by: Vinod Koul commit 75fb1a33f9ac4c9730e61bb19aaaab02023a99b2 Author: Vinod Koul Date: Mon Feb 23 12:12:39 2026 +0530 phy: move spacemit pcie driver to its subfolder Commit fe4bc1a08638 ("phy: spacemit: support K1 USB2.0 PHY controller") created spacemit subfolder with usb driver while commit 57e920b92724 ("phy: spacemit: Introduce PCIe/combo PHY") added pcie driver in phy folder. Move latter into spacemit subfolder and rename file to phy-k1-pcie.c Reviewed-by: Alex Elder Reviewed-by: Yixun Lan Link: https://patch.msgid.link/20260223064240.386617-1-vkoul@kernel.org Signed-off-by: Vinod Koul commit 363c5108e4e2b3b5f99243e61d524dd9c23d8c1b Author: Eric Dumazet Date: Wed Feb 25 13:40:23 2026 +0000 inet: remove three EXPORT_SYMBOL() inet_rcv_saddr_equal() and inet_csk_listen_stop() are not used from any modules. inet_csk_accept() can use EXPORT_IPV6_MOD() Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260225134023.1176738-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit c8e9b1d9febc83ee94944695a07cfd40a1b29743 Author: Randy Dunlap Date: Wed Feb 25 21:12:20 2026 -0800 dmaengine: fsl-edma: fix all kernel-doc warnings Use the correct kernel-doc format and struct member names to eliminate these kernel-doc warnings: Warning: include/linux/platform_data/dma-mcf-edma.h:35 struct member 'dma_channels' not described in 'mcf_edma_platform_data' Warning: include/linux/platform_data/dma-mcf-edma.h:35 struct member 'slave_map' not described in 'mcf_edma_platform_data' Warning: include/linux/platform_data/dma-mcf-edma.h:35 struct member 'slavecnt' not described in 'mcf_edma_platform_data' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260226051220.548566-1-rdunlap@infradead.org Signed-off-by: Vinod Koul commit 5cf47393d96f211836ce98a22cebdf0eb8555413 Author: Yohei Kojima Date: Thu Feb 26 00:12:09 2026 +0900 docs: ethtool: clarify the bit-by-bit bitset format description Clarify the bit-by-bit bitset format's behavior around mandatory attributes and bit identification. More specifically, the following changes are made: * Rephrase a misleading sentence which implies name and index are mutually exclusive * Describe that ETHTOOL_A_BITSET_BITS nest is mandatory * Describe that a request fails if inconsistent identifiers are given Signed-off-by: Yohei Kojima Reviewed-by: Jakub Kicinski Reviewed-by: Simon Horman Link: https://patch.msgid.link/ef90a56965ca66e57aa177929ce3e10c5ca815fa.1772031974.git.yk@y-koj.net Signed-off-by: Jakub Kicinski commit f22b4e6fbba5c50612ca82220f34f8fa2ad1d24d Author: Bo Sun Date: Wed Feb 25 16:23:48 2026 +0800 octeontx2-af: CGX: replace kfree() with rvu_free_bitmap() mac_to_index_bmap is allocated with rvu_alloc_bitmap(), so free it with rvu_free_bitmap() instead of open-coding kfree(.bmap) to keep the alloc/free API pairing consistent. Signed-off-by: Bo Sun Reviewed-by: Vadim Fedorenko Reviewed-by: Jijie Shao Link: https://patch.msgid.link/20260225082348.2519131-1-bo@mboxify.com Signed-off-by: Jakub Kicinski commit d68d21ea6b29f87f1c334f007e845ca5fb678c80 Author: Gabriel Goller Date: Wed Feb 25 10:58:10 2026 +0100 docs: net: document neigh gc_interval sysctl Add entry for the neigh/default/gc_interval sysctl. This sysctl is unused since kernel v2.6.8. Suggested-by: Jakub Kicinski Signed-off-by: Gabriel Goller Link: https://patch.msgid.link/20260225095822.44050-1-g.goller@proxmox.com Signed-off-by: Jakub Kicinski commit 5c894879f17c70cd93712b30fa62e6803b1c46e2 Author: Russell King (Oracle) Date: Wed Feb 25 10:01:19 2026 +0000 net: stmmac: ptp: limit n_per_out ptp_clock_ops.n_per_out sets the number of PPS outputs, which the PTP subsystem uses to validate userspace input, such as the index number used in a PTP_CLK_REQ_PEROUT request. stmmac_enable() uses this to index the priv->pps array, which is an array of size STMMAC_PPS_MAX. ptp_clock_ops.n_per_out is initialised using priv->dma_cap.pps_out_num, which is a three bit field read from hardware. Documentation that I've checked suggests that values >= 5 are reserved, but that doesn't mean such values won't appear, and if they do, we can overrun the priv->pps array in stmmac_enable(). stmmac_ptp_register() has protection against this in its loop, but it doesn't act to limit ptp_clock_ops.n_per_out. Fix this by introducing a local variable, pps_out_num which is limited to STMMAC_PPS_MAX, and use that when initialising the array and setting priv->ptp_clock_ops.n_per_out. Print a warning when we limit the number of outputs. Reviewed-by: Simon Horman Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vvBhn-0000000ArCg-4C4u@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 2974aa42e6696a1d95b727d677dc01a71af5b998 Author: Kuninori Morimoto Date: Fri Feb 27 01:17:19 2026 +0000 ASoC: remove snd_soc_pcm_subclass enum snd_soc_pcm_subclass has added at v3.1 commit b8c0dab9bf337 ("ASoC: core - PCM mutex per rtd"), but has never been used during this 15 years. Let's remove it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/878qcfyogw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f168e849b7b85ef102fb0b889c0fe90a328042af Merge: 5c74a008ffc62f 501efdcb3b3ab0 Author: Mark Brown Date: Fri Feb 27 01:13:41 2026 +0000 SDCA Improvements Merge series from Charles Keepax : Another fairly mixed bag of small SDCA fixes/improvements. Fix one DisCo property that was treated as mandatory but is actually not present in the first version of the specification. Fix the counting of routes for SU/GE DAPM widgets, this currently makes assumptions that are not guaranteed to be true which can result in too many/few DAPM routes. Then finally a couple improvements to the volume controls, simplify the mapping between ALSA and SDCA volumes and pull the volume stuff back into the SDCA code. It just wasn't sitting right with me that it was being handled in the ASoC core given it is unlikely to ever see any reuse outside of SDCA. commit a901e8705f89f3616fad3bb6aeddba33be86b08a Author: Conor Dooley Date: Tue Feb 24 13:39:05 2026 +0000 dt-bindings: pinctrl: pincfg-node: add restrictions on conflicting properties Many of the possible pincfg properties are not compatible with one another, either because they represent mutually exclusive states for a pin or because they provide the same information in different units. Add some simple restrictions to prevent invalid configurations. Signed-off-by: Conor Dooley Signed-off-by: Linus Walleij commit 9c105255108b57f0b0241ee488e5b84d6196789c Author: Conor Dooley Date: Tue Feb 24 13:39:04 2026 +0000 pinctrl: pinconf-generic: perform basic checks on pincfg properties Some pinconf properties are mutually exclusive, either because they convey the same information in different units or represent incompatible configurations of the same pin. Attempt, in two ways, to prevent these situations. Firstly, for enable/disable properties, produce an error if both are set. Since enable/disable properties share the same enum value, they can be trivially checked via the newly added bitmap. Having both enable and disable for the same config makes no sense at all, so produce an error in this case. For interactions between properties, doing them outside the loop makes more sense as it can be evaluated once. In case there are some edge cases that would be broken by producing an error, only warn for now. Signed-off-by: Conor Dooley Signed-off-by: Linus Walleij commit 41c78b33e96f9ac4abb618d36625e6e7f7e7aeb7 Author: Andy Shevchenko Date: Mon Feb 23 19:06:58 2026 +0100 pinctrl: cy8c95x0: Gather ID tables in one place We have three ID tables spread over the driver code. Move all of them closer to the end of the file where the first user appears to be. With that done, drop unneeded trailing commas. Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 04fcdb3a34d66a2848f5c7073f85071eeb1e5fae Author: Andy Shevchenko Date: Mon Feb 23 19:06:57 2026 +0100 pinctrl: cy8c95x0: Eliminate fragile use of I²C ID table The I²C ID table is a subject to new entries that may potentially break the order of the existing ones. Avoid this by using string literals for the chip naming. Note, linker will deduplicate same string literals and use only a single copy, hence it won't be the change in size in data section. Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit a603cf701f94f233032dd66bbc6e1b03d866550f Author: Andy Shevchenko Date: Mon Feb 23 19:06:56 2026 +0100 pinctrl: cy8c95x0: Drop unused 'name' in struct cy8c95x0_pinctrl The 'name' is only assigned and never used. Drop it for good. Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 8434c691193b9f812a446833c657fb2431aa94fd Author: Andy Shevchenko Date: Mon Feb 23 19:06:55 2026 +0100 pinctrl: cy8c95x0: Move driver data to the local variable in ->probe() For all these years of driver existence the driver_data has been used only as a raw material for other fields in the struct cy8c95x0_pinctrl. Move it from the structure to be just a local variable in ->probe(). Later, if ever need arises, we may reconsider that. While at it, drop an unneeded validation and replace uintptr_t with plain unsigned long which is more readable and works in the same way. Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 014884732095b982412d13d3220c3fe8483b9b3e Author: Andy Shevchenko Date: Mon Feb 23 19:06:54 2026 +0100 pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() Unify error messages that might appear during probe phase by switching to use dev_err_probe(). Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 970dacb3b9f0fedbbbcfd7dbf1f4f22340b3f359 Author: Andy Shevchenko Date: Mon Feb 23 19:06:53 2026 +0100 pinctrl: cy8c95x0: remove duplicate error message The pin control core is covered to report any error via message. The devm_request_threaded_irq() already prints an error message. Remove the duplicates. While at it, drop the info message as the same information about an IRQ in use can be retrieved differently. Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 5ffb2da4a38fd85cc8f71fca7c04be28897d2354 Author: Andy Shevchenko Date: Mon Feb 23 19:06:52 2026 +0100 pinctrl: cy8c95x0: Use devm_mutex_init() for mutex initialization Use devm_mutex_init() since it brings some benefits when CONFIG_DEBUG_MUTEXES is enabled. Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit a235e7d0098337c3f2d1e8f3610c719a589e115f Author: Shuicheng Lin Date: Wed Feb 25 01:34:49 2026 +0000 drm/xe/configfs: Free ctx_restore_mid_bb in release ctx_restore_mid_bb memory is allocated in wa_bb_store(), but xe_config_device_release() only frees ctx_restore_post_bb. Free ctx_restore_mid_bb[0].cs as well to avoid leaking the allocation when the configfs device is removed. Fixes: b30d5de3d40c ("drm/xe/configfs: Add mid context restore bb") Signed-off-by: Shuicheng Lin Reviewed-by: Nitin Gote Link: https://patch.msgid.link/20260225013448.3547687-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper commit ec6fd28baf61a6ae89e0208d7bc1447bc61b072e Author: Jonathan Corbet Date: Thu Feb 26 15:12:08 2026 -0700 docs: remove unneeded maintainer_handbooks_main label Somehow people got into the habit of putting labels at the tops of documentation files, even when they are not used. It is better to just give the name of a file when linking to the whole thing; remove the label and update the references accordingly. Signed-off-by: Jonathan Corbet commit 9941b3ca10977a583a6e78707023066fd9cd6311 Author: Matt Roper Date: Wed Feb 25 12:37:20 2026 -0800 drm/xe/xe3p_xpc: Drop stale MCR steering TODO comment Proper steering+termination for Xe3p_XPC NODE and BANK multicast ranges was added in commit 6d5511e56b2d ("drm/xe/xe3p_xpc: Add MCR steering for NODE and L3BANK ranges") but we forgot to remove the corresponding TODO comment at the top of the block. Drop it now to avoid confusion. Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260225203719.3310570-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 4add09ab359c8caa6e65b2200911e1de66565eeb Merge: f308205e3b370d d90c0f78379454 Author: Mark Brown Date: Thu Feb 26 21:36:20 2026 +0000 mfd: cpcap: convert documentation to schema and add Merge series from Svyatoslav Ryhel : The initial goal was only to add support for the CPCAP used in the Mot Tegra20 board; however, since the documentation was already partially converted, I decided to complete the conversion to schema too. commit 4226479f912e829ffba3993438ebc64dac90ae18 Author: Jani Nikula Date: Wed Feb 25 16:49:16 2026 +0200 drm/i915/dpt: pass opaque struct intel_dpt around instead of i915_address_space struct i915_address_space is used in an opaque fashion in the display parent interface, but it's just one include away from being non-opaque. And anyway the name is rather specific. Switch to using the struct intel_dpt instead, which embeds struct i915_address_space anyway. With the definition hidden in i915_dpt.c, this can't be accidentally made non-opaque, and the type seems rather more generic anyway. We do have to add a new helper i915_dpt_to_vm(), as there's one case in intel_fb_pin_to_dpt() that requires direct access to struct i915_address_space. But this just underlines the point about opacity. Reviewed-by: Juha-Pekka Heikkila Link: https://patch.msgid.link/daa39178c0b0305b010564952d691f06e3cd63ca.1772030909.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a8ea895d34f9b3069d8eab1f6814e93e276dacee Author: Jani Nikula Date: Wed Feb 25 16:49:15 2026 +0200 drm/i915/dpt: rename struct i915_dpt to intel_dpt Rename struct i915_dpt to intel_dpt. This may seem rather inconsistent considering we just renamed the functions the other way round, but the intent here is to lift struct intel_dpt to the display parent interface as the generic opaque type for DPT instead of the very specific struct i915_address_space. Reviewed-by: Juha-Pekka Heikkila Link: https://patch.msgid.link/afb89dcce35c5b0cff2007b58d6ee20fd3200c24.1772030909.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 9044001dd1ab3a879c3de4b52755b86e378aa4d9 Author: Jani Nikula Date: Wed Feb 25 16:49:14 2026 +0200 drm/i915/dpt: rename i915 specific functions to i915_dpt_ prefix Follow the common convention of naming functions by file name, in this case also clarifying which functions are i915 specific. Reviewed-by: Juha-Pekka Heikkila Link: https://patch.msgid.link/9bb94942ed4a15bcdd89be3f0029a2cb6cdf170d.1772030909.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 5c6905c73a648094e4c012902fb832d45c863625 Author: Jani Nikula Date: Wed Feb 25 16:49:13 2026 +0200 drm/i915/dpt: switch to i915 runtime pm calls The i915 specific code doesn't need to, and should not, call the display runtime pm functions. Just call the i915 functions directly, instead of routing through the parent interface. Reviewed-by: Juha-Pekka Heikkila Link: https://patch.msgid.link/e8e00552ebf439b5f7b5d293014cce950c9c2999.1772030909.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit bbc4500132b9cc7682f3c50d31b4f3de6cac11db Author: Jani Nikula Date: Wed Feb 25 16:49:12 2026 +0200 drm/i915/dpt: drop _common from the DPT file names With the intel_dpt.[ch] file names vacated, and i915 specific code moved away, we can rename the intel_dpt_common.[ch] files to the simpler name. Reviewed-by: Juha-Pekka Heikkila Link: https://patch.msgid.link/3f2da737a26bb71a7bc05a3e6c456302e3c72656.1772030909.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit c6946bcf4a85d15510a2e01fdc922b6fa0d58d38 Author: Jani Nikula Date: Wed Feb 25 16:49:11 2026 +0200 drm/i915/dpt: remove display/intel_dpt.h The remaining functions declared in intel_dpt.h are i915 specific, and so are the users, so we can move them to i915_dpt.h. There are some useless intel_dpt.h includes around that we can remove. Reviewed-by: Juha-Pekka Heikkila Link: https://patch.msgid.link/de16eddbb49110b56ff44899d9498e3081da91fa.1772030909.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 3834ea7499ca2c88e0f67bb6929668f78bb67127 Author: Jani Nikula Date: Wed Feb 25 16:49:10 2026 +0200 drm/i915/dpt: move suspend/resume to parent interface Add per-vm DPT suspend/resume calls to the display parent interface, and lift the generic code away from i915 specific code. Reviewed-by: Juha-Pekka Heikkila Link: https://patch.msgid.link/080945a49559ec1f5183ad409e1526736e828d90.1772030909.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 2a62dc74726b03b76bab4641ee54b88b6eb7a1d5 Author: Jani Nikula Date: Wed Feb 25 16:49:09 2026 +0200 drm/i915/dpt: move create/destroy to parent interface Move the DPT create/destroy calls to the display parent interface. With this, we can remove the dummy xe implementation. Reviewed-by: Juha-Pekka Heikkila Link: https://patch.msgid.link/9753b21466c668872f468ccff827eab7be034b0c.1772030909.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit b3e523e5deb56d10feb83fe20e223763dcfd18d4 Author: Jani Nikula Date: Wed Feb 25 16:49:08 2026 +0200 drm/i915/dpt: pass obj, size instead of framebuffer to intel_dpt_create() Split the size determination between caller and callee to drop the dependency on struct intel_framebuffer from DPT code, but avoid adding a dependency on I915_GTT_PAGE_SIZE in the caller side. Pass zero size to let intel_dpt_create() handle the regular obj->size case, but remapped size if fb needs stride remap. Reviewed-by: Juha-Pekka Heikkila Link: https://patch.msgid.link/3a6e987ce8bb9f2c8d90c35342de14494a64de1b.1772030909.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit dc88f63aeada8eea011af15b8fab4b61bf334e93 Author: Jani Nikula Date: Wed Feb 25 16:49:07 2026 +0200 drm/i915/dpt: move display/intel_dpt.c to i915_dpt.c The DPT implementation is i915 specific. The xe driver has a different implementation. Move display/intel_dpt.c to i915_dpt.c. Cleanups will follow. Reviewed-by: Juha-Pekka Heikkila Link: https://patch.msgid.link/20a3bfb2762f39f9666d9a5752b8d2fb133583b0.1772030909.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit ff49eba595df500e4ddccc593088c8a4ab5f2c27 Author: Zilin Guan Date: Fri Jan 30 08:44:51 2026 +0000 wifi: ath11k: fix memory leaks in beacon template setup The functions ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() allocate memory for beacon templates but fail to free it when parameter setup returns an error. Since beacon templates must be released during normal execution, they must also be released in the error handling paths to prevent memory leaks. Fix this by using unified exit paths with proper cleanup in the respective error paths. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 3a415daa3e8b ("wifi: ath11k: add P2P IE in beacon template") Fixes: 335a92765d30 ("wifi: ath11k: MBSSID beacon support") Suggested-by: Baochen Qiang Signed-off-by: Zilin Guan Reviewed-by: Vasanthakumar Thiagarajan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260130084451.110768-1-zilin@seu.edu.cn Signed-off-by: Jeff Johnson commit 151322bccdbdb132f5a73cc8ad5d3ab89b90ed52 Author: Maharaja Kennadyrajan Date: Mon Feb 23 18:56:22 2026 +0530 wifi: ath12k: add basic hwmon temperature reporting Add initial thermal support by wiring up a per-radio (pdev) hwmon temperature sensor backed by the existing WMI pdev temperature command and event. When userspace reads the sysfs file temp1_input, the driver sends WMI_PDEV_GET_TEMPERATURE_CMDID (tag WMI_TAG_PDEV_GET_TEMPERATURE_CMD) and waits for the corresponding WMI_PDEV_TEMPERATURE_EVENTID (tag WMI_TAG_PDEV_TEMPERATURE_EVENT) to get the temperature and pdev_id. Export the reported value in millidegrees Celsius as required by hwmon. The temperature reported is per-radio (pdev). In a multi-radio wiphy under a single phy, a separate hwmon device is created for each radio. Sample command and output: $ cat /sys/devices/pci0000:00/.../ieee80211/phyX/hwmonY/temp1_input $ 50000 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Co-developed-by: Aishwarya R Signed-off-by: Aishwarya R Signed-off-by: Maharaja Kennadyrajan Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260223132622.43464-1-maharaja.kennadyrajan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 0ef4738f0d38f103e525ffb12c112a935c2cf011 Author: Baochen Qiang Date: Mon Feb 9 10:52:19 2026 +0800 wifi: ath12k: fix indentation in ath12k_qmi_aux_uc_load() Smatch complains: drivers/net/wireless/ath/ath12k/qmi.c:3342 ath12k_qmi_aux_uc_load() warn: inconsistent indenting Fix it. Compile tested only. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602061221.5SCuwKhy-lkp@intel.com/ Signed-off-by: Baochen Qiang Link: https://patch.msgid.link/20260209-ath12k-fix-indention-v1-1-6b87ae99745e@oss.qualcomm.com Signed-off-by: Jeff Johnson commit a8911fbeff8bee4fe3376c5044b64fbf3cceb78e Author: Alejandro Colomar Date: Sun Dec 21 23:25:54 2025 +0100 wifi: ath9k: Fix typo This only worked by chance, because all callers of this macro used the same identifiers that were expected by the macro. $ grep -rn ath_for_each_chanctx drivers/net/wireless/ath/ath9k/main.c:1576: ath_for_each_chanctx(sc, ctx) drivers/net/wireless/ath/ath9k/main.c:2554: ath_for_each_chanctx(sc, ctx) { drivers/net/wireless/ath/ath9k/channel.c:165: ath_for_each_chanctx(sc, ctx) { drivers/net/wireless/ath/ath9k/channel.c:291: ath_for_each_chanctx(sc, ctx) { drivers/net/wireless/ath/ath9k/channel.c:861: ath_for_each_chanctx(sc, ctx) { drivers/net/wireless/ath/ath9k/debug.c:717: ath_for_each_chanctx(sc, ctx) { drivers/net/wireless/ath/ath9k/ath9k.h:446:#define ath_for_each_chanctx(_sc, _ctx) \ Cc: Rajkumar Manoharan Cc: John W. Linville Cc: Toke Høiland-Jørgensen Cc: # the code worked by chance Fixes: c4dc0d040e35 ("ath9k: Fetch appropriate operating channel context") Signed-off-by: Alejandro Colomar Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/6ab107cf786f9d05dc4d84ea4e2d1b219ce108c0.1766355822.git.alx@kernel.org Signed-off-by: Jeff Johnson commit 32d4b991f25eeffac7568ef51367f924394fbdc5 Author: Alexandre Marquet Date: Tue Jan 27 21:40:58 2026 +0100 ARM: samsung: exynos5250: Allow CPU1 to boot The firmware trustzone needs a special call to bring up the secondary cpu core on the Manta board. This seems to be not needed on other exynos5 boards and comes down to the available firmware on a particular board. Signed-off-by: Alexandre Marquet Signed-off-by: Lukas Timmermann Reviewed-by: Henrik Grimler Link: https://patch.msgid.link/20260127-lat3st-staging-v4-3-797469aaaf9d@timmermann.space Signed-off-by: Krzysztof Kozlowski commit 16319efc63cb41abd29337dc0dcfbef723ec1dea Author: Alexandre Marquet Date: Tue Jan 27 21:40:57 2026 +0100 ARM: dts: exynos: Add Google Manta (Nexus 10) Manta is the code name for Google Nexus 10, and was manufactured by Samsung with their Exynos5250 SoC. Add an initial device-tree file for this board. Signed-off-by: Alexandre Marquet Co-developed-by: Lukas Timmermann Signed-off-by: Lukas Timmermann Link: https://patch.msgid.link/20260127-lat3st-staging-v4-2-797469aaaf9d@timmermann.space Signed-off-by: Krzysztof Kozlowski commit 1e7e6c6301d529fac07554fbdb215c70c8510f7b Author: Alexandre Marquet Date: Tue Jan 27 21:40:56 2026 +0100 dt-bindings: ARM: samsung: Add Google Manta (Nexus 10) Add the Google Nexus 10 board to documentation. Signed-off-by: Alexandre Marquet Signed-off-by: Lukas Timmermann Link: https://patch.msgid.link/20260127-lat3st-staging-v4-1-797469aaaf9d@timmermann.space Signed-off-by: Krzysztof Kozlowski commit 501efdcb3b3ab099fc0ce2f6e668b1c4095dd476 Author: Charles Keepax Date: Wed Feb 25 14:01:18 2026 +0000 ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops It is cleaner to keep the SDCA code contained and not update the core code for things that are unlikely to see reuse outside of SDCA. Move the Q7.8 volume helpers back into the SDCA core code. Reviewed-by: Pierre-Louis Bossart Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260225140118.402695-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit d4f7d5a9a0f963dc895c18084425ce332a80d3a8 Author: Charles Keepax Date: Wed Feb 25 14:01:17 2026 +0000 ASoC: SDCA: Improve mapping of Q7.8 SDCA volumes SDCA measures volumes in 256ths of a dB, whereas ALSA measures volumes in 100ths of a dB. Currently the SDCA volume controls are mapped to ALSA controls by mapping the step size and working out the number of steps for this mapped step size. Due to quantization of the step size this means the number of steps in the ALSA control will rarely match the number of steps in the SDCA control, leading to skipped values and multiple values that map to the same volume. This is not a huge problem, the volume is still increasing and the differences will be small but it is not really desirable. It is simpler and more accurate to count the number of steps based on the SDCA volume levels. This gives a 1-to-1 mapping between control values and register volumes. The TLV is based on a minimum and maximum volume so still accurately specifies the volume range. Tested-by: Richard Fitzgerald Reviewed-by: Pierre-Louis Bossart Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260225140118.402695-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 1fb720d33eecdb9a90ee340b3000ba378d49f5ca Author: Charles Keepax Date: Wed Feb 25 14:01:16 2026 +0000 ASoC: SDCA: Update counting of SU/GE DAPM routes Device Layer Selector Unit's are controlled by a Group Entity control rather than by the host directly. For the purposes of the ASoC class driver the number of input routes to the SU is controlled by the number of options within the Group Entity Selected Mode Control. ie. One valid DAPM route for each valid route defined in the Group Entity. Currently the code assumes that a Device Layer SU will have a number of routes equal to the number of potential sources for the SU. ie. it counts the routes using the SU, but then creates the routes using the GE. However, this isn't actually true, it is perfectly allowed for the GE to only define options for some of the potential sources of the SU.o In such a case the number of routes return will not match those created, leading to either an overflow of the routes array or undefined routes to be past to the ASoC core, both of which generally lead to the sound card failing to probe. Update the handling for the counting of routes to count the connected routes on the GE itself and then ignore the source routes on the SU. This makes it match the logic generating the routes and ensuring that both remain in sync. Fixes: 2c8b3a8e6aa8 ("ASoC: SDCA: Create DAPM widgets and routes from DisCo") Reviewed-by: Pierre-Louis Bossart Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260225140118.402695-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 1bbbda5b178a1399339139eb3c326300008b72d6 Author: Charles Keepax Date: Wed Feb 25 14:01:15 2026 +0000 ASoC: SDCA: Add default value for mipi-sdca-function-reset-max-delay Add a default value for the function reset timeout since version 1.0 of the SDCA specification doesn't actually include this property, it was added later. Fixes: 7b6be935e7ef ("ASoC: SDCA: Parse Function Reset max delay") Reviewed-by: Pierre-Louis Bossart Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260225140118.402695-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit d90c0f78379454d51a428e312ac6db573060185c Author: Svyatoslav Ryhel Date: Mon Feb 23 08:38:52 2026 +0200 regulator: cpcap-regulator: add support for Mot regulators Add support for regulator set used in Motorola Mot board, used as a base for Atrix 4G and Droid X2 smartphones. Signed-off-by: Svyatoslav Ryhel Link: https://patch.msgid.link/20260223063858.12208-4-clamor95@gmail.com Signed-off-by: Mark Brown commit 0e5646030212856a7f022387a647694ba65e75a7 Author: Svyatoslav Ryhel Date: Mon Feb 23 08:38:51 2026 +0200 regulator: dt-bindings: cpcap-regulator: document Mot regulator Document regulator composition used by the CPCAP of Tegra20 Mot board, that is a base for Atrix 4G and Droid X2. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223063858.12208-3-clamor95@gmail.com Signed-off-by: Mark Brown commit 5a8ffc5dca9c096fe9c8879fa3a2faff723fbb8a Author: Svyatoslav Ryhel Date: Mon Feb 23 08:38:50 2026 +0200 regulator: dt-bindings: cpcap-regulator: convert to DT schema Convert devicetree bindings for the Motorola CPCAP MFD regulator subnode from TXT to YAML format. Main functionality preserved. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260223063858.12208-2-clamor95@gmail.com Signed-off-by: Mark Brown commit c1f70c83be55e6721267f850dbfaf2ae07a04858 Author: Namhyung Kim Date: Wed Feb 18 16:44:17 2026 -0800 perf bench: Add -t/--threads option to perf bench mem mmap So that it can measure overhead of mmap_lock and/or per-VMA lock contention. $ perf bench mem mmap -f demand -l 1000 -t 1 # Running 'mem/mmap' benchmark: # function 'demand' (Demand loaded mmap()) # Copying 1MB bytes ... 2.786858 GB/sec $ perf bench mem mmap -f demand -l 1000 -t 2 # Running 'mem/mmap' benchmark: # function 'demand' (Demand loaded mmap()) # Copying 1MB bytes ... 1.624468 GB/sec/thread ( +- 0.30% ) $ perf bench mem mmap -f demand -l 1000 -t 3 # Running 'mem/mmap' benchmark: # function 'demand' (Demand loaded mmap()) # Copying 1MB bytes ... 1.493068 GB/sec/thread ( +- 0.15% ) $ perf bench mem mmap -f demand -l 1000 -t 4 # Running 'mem/mmap' benchmark: # function 'demand' (Demand loaded mmap()) # Copying 1MB bytes ... 1.006087 GB/sec/thread ( +- 0.41% ) Reviewed-by: Ankur Arora Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit af894feb32570cafea582b100d674b042479544f Author: Namhyung Kim Date: Wed Feb 25 17:49:55 2026 -0800 perf trace: Handle task exit in BPF syscall summary Some system calls never return because it'd terminate the calling thread. Let's hook the task exit path and update the duration of the last syscall. Before: $ sudo perf trace -as --bpf-summary -- true |& grep exit (nothing) After: $ sudo perf trace -as --bpf-summary -- true |& grep exit exit_group 1 0 0.004 0.004 0.004 0.004 0.00% Reviewed-by: Ian Rogers Acked-by: Howard Chu Signed-off-by: Namhyung Kim commit 96f202eab8133f94479b14a32902c636e9bdf6af Author: wangguangju Date: Thu Feb 26 20:22:08 2026 +0800 perf trace: Fix IS_ERR() vs NULL check bug The alloc_syscall_stats() function always returns an error pointer (ERR_PTR) on failure. So replace NULL check with IS_ERR() check after calling delete_syscall_stats() function. Fixes: ef2da619b132c6f74 ("perf trace: Convert syscall_stats to hashmap") Signed-off-by: wangguangju Reviewed-by: Howard Chu Acked-by: Ian Rogers Signed-off-by: Namhyung Kim commit 0314e382cf02983eb3c33ac537ad9701e7858bc9 Merge: 4916f2e2f3fc9a b9c8fc2caea6ff Author: Jakub Kicinski Date: Thu Feb 26 10:20:47 2026 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-7.0-rc2). Conflicts: tools/testing/selftests/drivers/net/hw/rss_ctx.py 19c3a2a81d2b ("selftests: drv-net: rss: Generate unique ports for RSS context tests") ce5a0f4612db ("selftests: drv-net: rss_ctx: test RSS contexts persist after ifdown/up") include/net/inet_connection_sock.h 858d2a4f67ff6 ("tcp: fix potential race in tcp_v6_syn_recv_sock()") fcd3d039fab69 ("tcp: make tcp_v{4,6}_send_check() static") https://lore.kernel.org/aZ8PSFLzBrEU3I89@sirena.org.uk drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c drivers/net/ethernet/mellanox/mlx5/core/en/xsk/pool.c 69050f8d6d075 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") bf4afc53b77ae ("Convert 'alloc_obj' family to use the new default GFP_KERNEL argument") 8a96b9144f18a ("net/mlx5e: Alloc xsk channel param out of mlx5e_open_xsk()") Adjacent changes: net/netfilter/ipvs/ip_vs_ctl.c c59bd9e62e06 ("ipvs: use more counters to avoid service lookups") bf4afc53b77a ("Convert 'alloc_obj' family to use the new default GFP_KERNEL argument") Signed-off-by: Jakub Kicinski commit 3954313b39e4ce37d444c66e1fd1219a43a719c7 Author: Matthew Brost Date: Tue Feb 17 20:33:19 2026 -0800 drm/xe: Move LRC seqno to system memory to avoid slow dGPU reads The LRC seqno is read by the CPU in the fence signaling path. On dGPU that read can turn into a PCIe transaction when the seqno lives in the main LRC BO, making the hot-path poll/peek much more expensive. Allocate a small dedicated seqno BO in system memory and map the seqno and start_seqno fields from there instead. The GPU still updates the values, but CPU reads stay in cached system memory and avoid PCIe read latency. Update the LRC map/address helpers to accept a BO expression and use the new lrc->seqno_bo for seqno mappings. Unpin/unmap seqno_bo during teardown. Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20260218043319.809548-4-matthew.brost@intel.com commit 74bbd87dcc5c102147e24058e8db97a228d6ee03 Author: Matthew Brost Date: Tue Feb 17 20:33:18 2026 -0800 drm/xe: Avoid unconditional VRAM reads in H2G path desc_read() issues an VRAM read which serializes the CPU and drains posted writes on dGPU platforms. The H2G tracepoint evaluated its arguments unconditionally, so even with tracing disabled the submission path paid the full VRAM readf latency. Guard the tracepoint with trace_xe_guc_ctb_h2g_enabled(). Adso move the descriptor status verification under CONFIG_DRM_XE_DEBUG. This removes another unnecessary VRAM read in non-debug builfds. This results in ~10× faster H2G submission and significantly reduces lock contention across the driver. Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20260218043319.809548-3-matthew.brost@intel.com commit af3de6cf06f9497a60510b87bf77e8fb4124ba9f Author: Matthew Brost Date: Tue Feb 17 20:33:17 2026 -0800 drm/xe: Split H2G and G2H into separate buffer objects H2G and G2H buffers have different access patterns (H2G is CPU-write, GuC-read, while G2H is GPU-write, CPU-read). On dGPU, these patterns benefit from different memory placements: H2G in VRAM and G2H in system memory. Split the CT buffer into two separate buffers—one for H2G and one for G2H—and select the optimal placement for each. This provides a significant performance improvement on the G2H read path, reducing a single read from ~20 µs to under 1 µs on BMG. Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20260218043319.809548-2-matthew.brost@intel.com commit 2bcbf2dcde0c839a73af664a3c77d4e77d58a3eb Author: Matthew Brost Date: Wed Jan 14 16:45:46 2026 -0800 drm/xe: Do not preempt fence signaling CS instructions If a batch buffer is complete, it makes little sense to preempt the fence signaling instructions in the ring, as the largest portion of the work (the batch buffer) is already done and fence signaling consists of only a few instructions. If these instructions are preempted, the GuC would need to perform a context switch just to signal the fence, which is costly and delays fence signaling. Avoid this scenario by disabling preemption immediately after the BB start instruction and re-enabling it after executing the fence signaling instructions. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Daniele Ceraolo Spurio Cc: Carlos Santa Signed-off-by: Matthew Brost Reviewed-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260115004546.58060-1-matthew.brost@intel.com commit 773b24bcedc16a4a29e8579d66ec67ca7aa0014f Author: Marco Elver Date: Mon Feb 16 15:16:23 2026 +0100 arm64, compiler-context-analysis: Permit alias analysis through __READ_ONCE() with CONFIG_LTO=y When enabling Clang's Context Analysis (aka. Thread Safety Analysis) on kernel/futex/core.o (see Peter's changes at [1]), in arm64 LTO builds we could see: | kernel/futex/core.c:982:1: warning: spinlock 'atomic ? __u.__val : q->lock_ptr' is still held at the end of function [-Wthread-safety-analysis] | 982 | } | | ^ | kernel/futex/core.c:976:2: note: spinlock acquired here | 976 | spin_lock(lock_ptr); | | ^ | kernel/futex/core.c:982:1: warning: expecting spinlock 'q->lock_ptr' to be held at the end of function [-Wthread-safety-analysis] | 982 | } | | ^ | kernel/futex/core.c:966:6: note: spinlock acquired here | 966 | void futex_q_lockptr_lock(struct futex_q *q) | | ^ | 2 warnings generated. Where we have: extern void futex_q_lockptr_lock(struct futex_q *q) __acquires(q->lock_ptr); .. void futex_q_lockptr_lock(struct futex_q *q) { spinlock_t *lock_ptr; /* * See futex_unqueue() why lock_ptr can change. */ guard(rcu)(); retry: >> lock_ptr = READ_ONCE(q->lock_ptr); spin_lock(lock_ptr); ... } At the time of the above report (prior to removal of the 'atomic' flag), Clang Thread Safety Analysis's alias analysis resolved 'lock_ptr' to 'atomic ? __u.__val : q->lock_ptr' (now just '__u.__val'), and used this as the identity of the context lock given it cannot "see through" the inline assembly; however, we want 'q->lock_ptr' as the canonical context lock. While for code generation the compiler simplified to '__u.__val' for pointers (8 byte case -> 'atomic' was set), TSA's analysis (a) happens much earlier on the AST, and (b) would be the wrong deduction. Now that we've gotten rid of the 'atomic' ternary comparison, we can return '__u.__val' through a pointer that we initialize with '&x', but then update via a pointer-to-pointer. When READ_ONCE()'ing a context lock pointer, TSA's alias analysis does not invalidate the initial alias when updated through the pointer-to-pointer, and we make it effectively "see through" the __READ_ONCE(). Code generation is unchanged. Link: https://lkml.kernel.org/r/20260121110704.221498346@infradead.org [1] Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601221040.TeM0ihff-lkp@intel.com/ Cc: Peter Zijlstra Tested-by: Boqun Feng Reviewed-by: David Laight Signed-off-by: Marco Elver Signed-off-by: Will Deacon commit abf1be684dc270b94b7c8782f562959b33766fc0 Author: Marco Elver Date: Mon Feb 16 15:16:22 2026 +0100 arm64: Optimize __READ_ONCE() with CONFIG_LTO=y Rework arm64 LTO __READ_ONCE() to improve code generation as follows: 1. Replace _Generic-based __unqual_scalar_typeof() with more complete __rwonce_typeof_unqual(). This strips qualifiers from all types, not just integer types, which is required to be able to assign (must be non-const) to __u.__val in the non-atomic case (required for #2). One subtle point here is that non-integer types of __val could be const or volatile within the union with the old __unqual_scalar_typeof(), if the passed variable is const or volatile. This would then result in a forced load from the stack if __u.__val is volatile; in the case of const, it does look odd if the underlying storage changes, but the compiler is told said member is "const" -- it smells like UB. 2. Eliminate the atomic flag and ternary conditional expression. Move the fallback volatile load into the default case of the switch, ensuring __u is unconditionally initialized across all paths. The statement expression now unconditionally returns __u.__val. This refactoring appears to help the compiler improve (or fix) code generation. With a defconfig + LTO + debug options builds, we observe different codegen for the following functions: btrfs_reclaim_sweep (708 -> 1032 bytes) btrfs_sinfo_bg_reclaim_threshold_store (200 -> 204 bytes) check_mem_access (3652 -> 3692 bytes) [inlined bpf_map_is_rdonly] console_flush_all (1268 -> 1264 bytes) console_lock_spinning_disable_and_check (180 -> 176 bytes) igb_add_filter (640 -> 636 bytes) igb_config_tx_modes (2404 -> 2400 bytes) kvm_vcpu_on_spin (480 -> 476 bytes) map_freeze (376 -> 380 bytes) netlink_bind (1664 -> 1656 bytes) nmi_cpu_backtrace (404 -> 400 bytes) set_rps_cpu (516 -> 520 bytes) swap_cluster_readahead (944 -> 932 bytes) tcp_accecn_third_ack (328 -> 336 bytes) tcp_create_openreq_child (1764 -> 1772 bytes) tcp_data_queue (5784 -> 5892 bytes) tcp_ecn_rcv_synack (620 -> 628 bytes) xen_manage_runstate_time (944 -> 896 bytes) xen_steal_clock (340 -> 296 bytes) Increase of some functions are due to more aggressive inlining due to better codegen (in this build, e.g. bpf_map_is_rdonly is no longer present due to being inlined completely). NOTE: The return-value-of-function-drops-qualifiers hack was first suggested by Al Viro in [1], which notes some of its limitations which make it unsuitable for a general __unqual_scalar_typeof() replacement. Notably, array types are not supported, and GCC 8.1-8.3 still fail. Why should we use it here? READ_ONCE() does not support reading whole arrays, and the GCC version problem only affects 3 minor releases of a very ancient still-supported GCC version; not only that, this arm64 READ_ONCE() version is currently only activated by LTO builds, which to-date are *only supported by Clang*! Link: https://lore.kernel.org/all/20260111182010.GH3634291@ZenIV/ [1] Signed-off-by: Marco Elver Signed-off-by: Will Deacon commit e8d1eb65193ce93283f8f56a069eee5d548a6b70 Author: Rafael J. Wysocki Date: Mon Feb 23 16:33:27 2026 +0100 ACPI: TAD/x86: cmos_rtc: Consolidate address space handler setup On x86, as a rule the CMOS RTC address space handler is set up by the CMOS RTC ACPI scan handler attach callback, acpi_cmos_rtc_attach(), but if the ACPI namespace does not contain a CMOS RTC device object, the CMOS RTC address space handler installation is taken care of the ACPI TAD (Timer and Alarm Device) driver. This is not particularly straightforward and can be avoided by adding the ACPI TAD device ID to the CMOS RTC ACPI scan handler which will cause it to create a platform device for ACPI TAD after installing the CMOS RTC address space handler. One related detail that needs to be taken care of, though, is that the creation of an ACPI TAD platform device should not cause cmos_rtc_platform_device_present to be set, since this may cause add_rtc_cmos() to suppress the creation of a fallback CMOS RTC platform device which may not be the right thing to do (for instance, due to the fact that the ACPI TAD driver is missing an RTC class device interface). After doing the above, the CMOS RTC address space handler installation and removal can be dropped from the ACPI TAD driver (which allows it to be simplified quite a bit), acpi_remove_cmos_rtc_space_handler() can be dropped and acpi_install_cmos_rtc_space_handler() can be made static. Update the code as per the above. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/23028644.EfDdHjke4D@rafael.j.wysocki commit 62bf102c9d47a4eeb7a4f82f5ba032187942dc7d Author: Rafael J. Wysocki Date: Mon Feb 23 16:32:29 2026 +0100 rtc: cmos: Drop PNP device support Previous changes effectively prevented PNP devices from being created for the CMOS RTC on x86 with ACPI. Although in principle a CMOS RTC PNP device may exist on an x86 system without ACPI (that is, an x86 system where there is no ACPI at all, not one booted with ACPI disabled), such systems were there in the field ~30 years ago and most likely they would not be able to run a contemporary Linux kernel. For the above reasons, drop the PNP device support from the rtc-cmos driver. Signed-off-by: Rafael J. Wysocki Acked-by: Alexandre Belloni Link: https://patch.msgid.link/2355012.iZASKD2KPV@rafael.j.wysocki commit 0139085310c40853cc429d5c38fd66e540c97d34 Author: Rafael J. Wysocki Date: Mon Feb 23 16:31:49 2026 +0100 x86: rtc: Drop PNP device check Previous changes effectively prevented PNP devices from being created for the CMOS RTC on x86 with ACPI. Although in principle a CMOS RTC PNP device may exist on an x86 system without ACPI (that is, an x86 system where there is no ACPI at all, not one booted with ACPI disabled), such systems were there in the field ~30 years ago and most likely they would not be able to run a contemporary Linux kernel. For the above reasons, drop the PNP device check from add_rtc_cmos(). Signed-off-by: Rafael J. Wysocki Acked-by: Dave Hansen # x86 Link: https://patch.msgid.link/8660687.T7Z3S40VBb@rafael.j.wysocki commit d15f1c2e413e861270ca6aa5dc5d9da1bcd678ca Author: Rafael J. Wysocki Date: Mon Feb 23 16:31:03 2026 +0100 ACPI: PNP: Drop CMOS RTC PNP device support A previous change updated is_cmos_rtc_device() to effectively never allow PNP devices to be created for the CMOS RTC on x86 with ACPI and the PNP bus type is only used on x86, so the CMOS RTC device IDs can be dropped from acpi_pnp_device_ids[] and is_cmos_rtc_device() can go away completely. Update the code accordingly. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3411834.aeNJFYEL58@rafael.j.wysocki commit 2a78e42104444f948698f1225deaf515e9b7224d Author: Rafael J. Wysocki Date: Mon Feb 23 16:30:21 2026 +0100 ACPI: x86/rtc-cmos: Use platform device for driver binding Modify the rtc-cmos driver to bind to a platform device on systems with ACPI via acpi_match_table and advertise the CMOST RTC ACPI device IDs for driver auto-loading. Note that adding the requisite device IDs to it and exposing them via MODULE_DEVICE_TABLE() is sufficient for this purpose. Since the ACPI device IDs in question are the same as for the CMOS RTC ACPI scan handler, put them into a common header file and use the definition from there in both places. Additionally, to prevent a PNP device from being created for the CMOS RTC if a platform one is present already, make is_cmos_rtc_device() check cmos_rtc_platform_device_present introduced previously. Signed-off-by: Rafael J. Wysocki Acked-by: Alexandre Belloni Link: https://patch.msgid.link/13969123.uLZWGnKmhe@rafael.j.wysocki commit 1ae2f435350ec05224a39995c3a680aa6fdae5a5 Author: Rafael J. Wysocki Date: Mon Feb 23 16:29:37 2026 +0100 ACPI: x86: cmos_rtc: Create a CMOS RTC platform device Make the CMOS RTC ACPI scan handler create a platform device that will be used subsequently by rtc-cmos for driver binding on x86 systems with ACPI and update add_rtc_cmos() to skip registering a fallback platform device for the CMOS RTC when the above one has been registered. Signed-off-by: Rafael J. Wysocki Acked-by: Dave Hansen # x86 Link: https://patch.msgid.link/1962427.tdWV9SEqCh@rafael.j.wysocki commit c2190f11dc3bf24b177e364c23e232b859c8716f Author: Uma Shankar Date: Thu Feb 26 17:04:13 2026 +0530 Revert "drm/xe/compat: Remove unused i915_reg.h from compat header" This reverts commit 4953d806a423087fcc49d4f8884fde85cd23ec1e. Change breaks build for drm-xe-next, hence revert. Signed-off-by: Uma Shankar Acked-by: Jani Nikula Link: https://patch.msgid.link/20260226113413.2045899-1-uma.shankar@intel.com commit bbe814bcb961ed2f30706ffdc806f18150709d2d Author: Haikun Zhou Date: Thu Feb 26 16:32:35 2026 +0800 drm/panel-edp: Change BOE NV140WUM-N64 timings This screen timing requires a backlight off time of more than 100ms from the end of the data stream to avoid screen flickering and red light caused by screen material limitations. Signed-off-by: Haikun Zhou Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260226083235.2176689-1-zhouhaikun5@huaqin.corp-partner.google.com commit 911e2c0525e38133c849ee683830fdc63b4ee44d Author: Alex Deucher Date: Thu Feb 26 11:18:29 2026 -0500 drm/amdkfd: fix CWSR trap handler Fix up what looks like a bad merge. Signed-off-by: Alex Deucher commit 4410a3f14c305de493036b7d982f24b84e4c8e03 Author: Langyan Ye Date: Thu Jan 8 14:35:24 2026 +0800 HID: i2c-hid: elan: Add parade-tc3408 timing Parade-tc3408 requires reset to pull down time greater than 10ms, so the configuration post_power_delay_ms is 10, and the chipset initial time is required to be greater than 300ms, so the post_gpio_reset_on_delay_ms is set to 300. Signed-off-by: Langyan Ye Reviewed-by: Douglas Anderson Acked-by: Jiri Kosina Link: https://patch.msgid.link/20260108063524.742464-3-yelangyan@huaqin.corp-partner.google.com Signed-off-by: Dmitry Torokhov commit b0ef098d5fc1d2f75f4fcc6ca7ad41f29210c4d0 Author: Langyan Ye Date: Thu Jan 8 14:35:23 2026 +0800 dt-bindings: input: Add Parade TC3408 touchscreen controller The tc3408 touch screen chip same as Elan eKTH6915 controller has a reset gpio. The difference is that they have different post_power_delay_ms. Signed-off-by: Langyan Ye Reviewed-by: Conor Dooley Link: https://patch.msgid.link/20260108063524.742464-2-yelangyan@huaqin.corp-partner.google.com Signed-off-by: Dmitry Torokhov commit 5b50b7c2ce273e6361e44113e3c0efbbc2cd68cf Author: Maciej Falkowski Date: Fri Feb 20 17:01:16 2026 +0100 accel/ivpu: Update FW Boot API to version 3.29.4 Update firmware boot API to the version 3.29.4. Remove unused boot parameters from the vpu_firmware_header structure. Reviewed-by: Lizhi Hou Signed-off-by: Maciej Falkowski Link: https://patch.msgid.link/20260220160116.220367-1-maciej.falkowski@linux.intel.com commit d1ba2e5f6cfc6ec8786ceeb45b75a080fca313ea Author: Andy Shevchenko Date: Fri Jan 9 18:35:43 2026 +0100 dmaengine: Sort headers alphabetically For better maintenance sort headers alphabetically. Signed-off-by: Andy Shevchenko Reviewed-by: Dave Jiang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260109173718.3605829-4-andriy.shevchenko@linux.intel.com Signed-off-by: Vinod Koul commit d42a8378faa35d7958f2d71848f7899e011b829e Author: Andy Shevchenko Date: Fri Jan 9 18:35:42 2026 +0100 dmaengine: Use device_match_of_node() helper Instead of open coding, use device_match_of_node() helper. Signed-off-by: Andy Shevchenko Reviewed-by: Dave Jiang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260109173718.3605829-3-andriy.shevchenko@linux.intel.com Signed-off-by: Vinod Koul commit f709b38e5bfec5846f3f062e87f86ead0c881028 Author: Andy Shevchenko Date: Fri Jan 9 18:35:41 2026 +0100 dmaengine: Refactor devm_dma_request_chan() for readability Yes, while it's a bit longer in terms of LoCs, it's more readable when we use the usual patter to check for errors, and not for a success). This eliminates unneeded assignment and moves the needed one closer to its user which is better programming pattern because it allows avoiding potential errors in case the variable is getting reused. Also note that the same pattern have been used already in dmaenginem_async_device_register(). Signed-off-by: Andy Shevchenko Reviewed-by: Dave Jiang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260109173718.3605829-2-andriy.shevchenko@linux.intel.com Signed-off-by: Vinod Koul commit b49c70273801bf2f7c16ac49f403a5c253b46159 Author: Inochi Amaoto Date: Tue Jan 20 09:37:04 2026 +0800 dmaengine: dw-axi-dmac: Add support for CV1800B DMA As the DMA controller on Sophgo CV1800 series SoC only has 8 channels, the SoC provides a dma multiplexer to reuse the DMA channel. However, the dma multiplexer also controls the DMA interrupt multiplexer, which means that the dma multiplexer needs to know the channel number. Allow the driver to use DMA phandle args as the channel number, so the DMA multiplexer can route the DMA interrupt correctly. Signed-off-by: Inochi Amaoto Reviewed-by: Frank Li Link: https://patch.msgid.link/20260120013706.436742-3-inochiama@gmail.com Signed-off-by: Vinod Koul commit be3e2a0419c639b6a192141639259a4d34556dd0 Author: Inochi Amaoto Date: Tue Jan 20 09:37:03 2026 +0800 dt-bindings: dma: snps,dw-axi-dmac: Add CV1800B compatible The DMA controller on CV1800B needs to use the DMA phandle args as the channel number instead of hardware handshake number, so add a new compatible for the DMA controller on CV1800B. Signed-off-by: Inochi Amaoto Acked-by: Conor Dooley Link: https://patch.msgid.link/20260120013706.436742-2-inochiama@gmail.com Signed-off-by: Vinod Koul commit 48278a72fce8a8d30efaedeb206c9c3f05c1eb3f Author: Khairul Anuar Romli Date: Mon Feb 2 14:02:19 2026 +0800 dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function checkpatch.pl --strict reports a WARNING in dw-axi-dmac-platform.c: WARNING: void function return statements are not generally useful FILE: drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c According to Linux kernel coding style [Documentation/process/ coding-style.rst], explicit "return;" statements at the end of void functions are redundant and should be omitted. The function will automatically return upon reaching the closing brace, so the extra statement adds unnecessary clutter without functional benefit. This patch removes the superfluous "return;" statement in dw_axi_dma_set_hw_channel() to comply with kernel coding standards and eliminate the checkpatch warning. Fixes: 32286e279385 ("dmaengine: dw-axi-dmac: Remove free slot check algorithm in dw_axi_dma_set_hw_channel") Signed-off-by: Khairul Anuar Romli Link: https://patch.msgid.link/20260202060224.12616-4-karom.9560@gmail.com Signed-off-by: Vinod Koul commit b6f1d1b08edc406d9f5c140e9eb05d00a23a57b0 Author: Khairul Anuar Romli Date: Mon Feb 2 14:02:18 2026 +0800 dmaengine: dw-axi-dmac: Add blank line after function checkpatch.pl reports a CHECK warning in dw-axi-dmac-platform.c: CHECK: Please use a blank line after function/struct/union/enum declarations drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c: The Linux kernel coding style [Documentation/process/coding-style.rst] requires a blank line after function definitions to provide visual separation between distinct code elements. This patch inserts the required blank line after the closing brace of the function definition after dw_axi_dma_set_byte_halfword(), placing it before the contextual comment that describes the locking requirements. Signed-off-by: Khairul Anuar Romli Link: https://patch.msgid.link/20260202060224.12616-3-karom.9560@gmail.com Signed-off-by: Vinod Koul commit 87c266bb30dc09979b7b7e8f962598367d626b57 Author: Mike Leach Date: Thu Feb 26 14:13:53 2026 +0000 MAINTAINERS: Change e-mail address for reviewer My e-mail address for linux work is changing to mike.leach@arm.com from 1st Jan 2026. Update MAINTAINERS file accordingly Updated .mailmap file accordingly. Signed-off-by: Mike Leach Signed-off-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260226141354.638962-1-mike.leach@arm.com commit f8d379460bd088753e47505eebe6a76beecc48c7 Author: Tomasz Pakuła Date: Tue Feb 3 18:45:31 2026 +0100 HID: Update MAINTAINERS for USB HID PID Take de-facto ownership of core hid-pidff driver Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 7daaa0fc44f47882e7b2efff7b95c5f72bb08c26 Author: Tomasz Pakuła Date: Tue Feb 3 18:45:30 2026 +0100 HID: pidff: Add MISSING_DEADBAND quirk Some devices (mainly Asetek) do not have deadband field in set conditional usage. Do not fail set conditional usage search if it's missing. Allows conditional effect playback on Asetek wheelbases. Deadband is practically never used in simracing anyway. Align property name in the whole driver to use 'deadband' without space. Co-developed-by: Oleg Makarenko Signed-off-by: Oleg Makarenko Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit d9cef0989ace79582dac90a2915c100144460e9f Author: Tomasz Pakuła Date: Tue Feb 3 18:45:29 2026 +0100 HID: pidff: Add MISSING_NEG_SATURATION quirk This is the same case as the previous MISSING_NEG_COEFFICIENT quirk Co-developed-by: Oleg Makarenko Signed-off-by: Oleg Makarenko Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit cf3bf7ad4e7722735d085b5fd5ab90a01be831d4 Author: Tomasz Pakuła Date: Tue Feb 3 18:45:28 2026 +0100 HID: pidff: Add MISSING_NEG_COEFFICIENT quirk Windows/Directinput allows devices with missing negative coefficient for conditional effects. Negative coefficient is ignored in such cases. Donot fail set_condition usage search if negative coefficient is missing. Fixes conditional effect playback on Asetek wheelbases. https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ee416601(v=vs.85) Co-developed-by: Oleg Makarenko Signed-off-by: Oleg Makarenko Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 446e303982a616f5cd48beabd236f0e6a17ec0ab Author: Tomasz Pakuła Date: Tue Feb 3 18:45:27 2026 +0100 HID: pidff: Refactor field quirks detection In preparation for additional quirks Co-developed-by: Oleg Makarenko Signed-off-by: Oleg Makarenko Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 9042e77a5c29d42a56540b9402c8cc01b1c126e7 Author: Thomas Weißschuh Date: Mon Feb 23 22:37:44 2026 +0100 mm/slab: constify sysfs attributes These attributes are never modified, make them read-only. Signed-off-by: Thomas Weißschuh Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20260223-sysfs-const-slub-v1-2-ff86ffc26fff@weissschuh.net Signed-off-by: Vlastimil Babka (SUSE) commit 5aa2a02b985f36a9042b2c7fa63a15de096effb9 Author: Thomas Weißschuh Date: Mon Feb 23 22:37:43 2026 +0100 mm/slab: create sysfs attribute through default_groups The driver core can automatically create custom type attributes. This makes the code and error-handling shorter. Signed-off-by: Thomas Weißschuh Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20260223-sysfs-const-slub-v1-1-ff86ffc26fff@weissschuh.net Signed-off-by: Vlastimil Babka (SUSE) commit 4520b96b8136ba2465a3f4dc5c3fb8bdf3d92e4e Author: Sun Jian Date: Sat Feb 14 13:12:17 2026 +0800 fsnotify: inotify: pass mark connector to fsnotify_recalc_mask() fsnotify_recalc_mask() expects a plain struct fsnotify_mark_connector *, but inode->i_fsnotify_marks is an __rcu pointer. Use fsn_mark->connector instead to avoid sparse "different address spaces" warnings. Signed-off-by: Sun Jian Link: https://patch.msgid.link/20260214051217.1381363-1-sun.jian.kdev@gmail.com Signed-off-by: Jan Kara commit 66052a768d4726a31e939b5ac902f2b0b452c8d5 Author: Ondrej Mosnacek Date: Mon Feb 16 16:06:25 2026 +0100 fanotify: call fanotify_events_supported() before path_permission() and security_path_notify() The latter trigger LSM (e.g. SELinux) checks, which will log a denial when permission is denied, so it's better to do them after validity checks to avoid logging a denial when the operation would fail anyway. Fixes: 0b3b094ac9a7 ("fanotify: Disallow permission events for proc filesystem") Signed-off-by: Ondrej Mosnacek Reviewed-by: Amir Goldstein Reviewed-by: Paul Moore Link: https://patch.msgid.link/20260216150625.793013-3-omosnace@redhat.com Signed-off-by: Jan Kara commit 0d5ee3373426395478c355f3e93ba4b1118a04e9 Author: Ondrej Mosnacek Date: Mon Feb 16 16:06:24 2026 +0100 fanotify: avoid/silence premature LSM capability checks Make sure calling capable()/ns_capable() actually leads to access denied when false is returned, because these functions emit an audit record when a Linux Security Module denies the capability, which makes it difficult to avoid allowing/silencing unnecessary permissions in security policies (namely with SELinux). Where the return value just used to set a flag, use the non-auditing ns_capable_noaudit() instead. Fixes: 7cea2a3c505e ("fanotify: support limited functionality for unprivileged users") Signed-off-by: Ondrej Mosnacek Reviewed-by: Paul Moore Reviewed-by: Amir Goldstein Link: https://patch.msgid.link/20260216150625.793013-2-omosnace@redhat.com Signed-off-by: Jan Kara commit 6a320935fa4293e9e599ec9f85dc9eb3be7029f8 Author: Chia-Ming Chang Date: Tue Feb 24 17:34:42 2026 +0800 inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails When fsnotify_add_inode_mark_locked() fails in inotify_new_watch(), the error path calls inotify_remove_from_idr() but does not call dec_inotify_watches() to undo the preceding inc_inotify_watches(). This leaks a watch count, and repeated failures can exhaust the max_user_watches limit with -ENOSPC even when no watches are active. Prior to commit 1cce1eea0aff ("inotify: Convert to using per-namespace limits"), the watch count was incremented after fsnotify_add_mark_locked() succeeded, so this path was not affected. The conversion moved inc_inotify_watches() before the mark insertion without adding the corresponding rollback. Add the missing dec_inotify_watches() call in the error path. Fixes: 1cce1eea0aff ("inotify: Convert to using per-namespace limits") Cc: stable@vger.kernel.org Signed-off-by: Chia-Ming Chang Signed-off-by: robbieko Reviewed-by: Nikolay Borisov Link: https://patch.msgid.link/20260224093442.3076294-1-chiamingc@synology.com Signed-off-by: Jan Kara commit 4cb522015a87ae0fdb6110fcda09f992ca61dac0 Author: Michal Wajdeczko Date: Mon Feb 16 19:32:40 2026 +0100 drm/xe: Don't expose display modparam if no display support With CONFIG_DRM_XE_DISPLAY=n the display support will be compiled out, so exposing probe_display modparam is pointless. Signed-off-by: Michal Wajdeczko Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260216183240.1308-1-michal.wajdeczko@intel.com commit 6d09a56b49380d996f225fcbcb96a64512bbe8e8 Author: Michal Wajdeczko Date: Sat Feb 21 16:22:30 2026 +0100 drm/xe/pf: Don't use LMTT page size if no LMTT While today all our DGFX platforms have LMTT, we already started preparation to do not rely on this assumption. Add check for the LMTT presence and return default page size as VRAM/LMEM alignment if there is no LMTT. Signed-off-by: Michal Wajdeczko Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260221152230.7071-4-michal.wajdeczko@intel.com commit 494752bdc41547b7525d94e6a3de3e44c691520a Author: Michal Wajdeczko Date: Sat Feb 21 16:22:29 2026 +0100 drm/xe/pf: Don't force 2MB VRAM alignment There is no need to always request VRAM BO to have 2MB alignment as for now this is required by the LMTT only, which could be not present on some platforms with VRAM. Signed-off-by: Michal Wajdeczko Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260221152230.7071-3-michal.wajdeczko@intel.com commit 57a5422d72c293b8e48da8b4b5c76a0d5f84c79e Author: Michal Wajdeczko Date: Sat Feb 21 16:22:28 2026 +0100 drm/xe/pf: Use explicit VRAM BO flag for VRAM provisioning When we are about to provision VRAM/LMEM for VF, there is no point in using semi-automatic flag that supports fallback to the SMEM. Signed-off-by: Michal Wajdeczko Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260221152230.7071-2-michal.wajdeczko@intel.com commit 4916f2e2f3fc9aef289fcd07949301e5c29094c2 Author: Hangbin Liu Date: Tue Feb 24 02:02:14 2026 +0000 bonding: print churn state via netlink Currently, the churn state is printed only in sysfs. Add netlink support so users could get the state via netlink. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20260224020215.6012-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 15c9ed1d8286dc0297f01347dc74f5a8cbc173de Author: Qingfang Deng Date: Tue Feb 24 09:50:52 2026 +0800 pppoe: remove kernel-mode relay support The kernel-mode PPPoE relay feature and its two associated ioctls (PPPOEIOCSFWD and PPPOEIOCDFWD) are not used by any existing userspace PPPoE implementations. The most commonly-used package, RP-PPPoE [1], handles the relaying entirely in userspace. This legacy code has remained in the driver since its introduction in kernel 2.3.99-pre7 for over two decades, but has served no practical purpose. Remove the unused relay code. [1] https://dianne.skoll.ca/projects/rp-pppoe/ Signed-off-by: Qingfang Deng Acked-by: Arnd Bergmann Reviewed-by: Guillaume Nault Link: https://patch.msgid.link/20260224015053.42472-1-dqfext@gmail.com Signed-off-by: Paolo Abeni commit 36ffbbc2b387bc5320e9caa90c0313743b87ba51 Author: Jie Gan Date: Thu Feb 19 22:46:57 2026 +0800 coresight: ctcu: fix the spin_bug Acquiring an uninitialized raw_spin_lock is invalid and may trigger unexpected behavior or spin_bug. Fixes: f78d206f3d73 ("Coresight: Add Coresight TMC Control Unit driver") Signed-off-by: Jie Gan Reviewed-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260219-fix-spin-lock-issue-v1-1-557f7d513d7e@oss.qualcomm.com commit 90fcb0f3bc5ab67773b35030af68ed8c6bd83e1c Merge: c7f5c6fb0f2b1a df5135fced85bf Author: Paolo Abeni Date: Thu Feb 26 10:54:41 2026 +0100 Merge branch 'net-mlx5e-shampo-allow-high-order-pages-in-zerocopy-mode' Tariq Toukan says: ==================== net/mlx5e: SHAMPO, Allow high order pages in zerocopy mode This series adds support for high order pages when io_uring/devmem zero copy is used. See detailed description by Dragos below. The first patches are moving code around to allow using queue specific parameters that are not just for XSK. They are a bit large as they touch a lot of functions. The middle part of the series is updating various formulas to remove remaining hardcoded use of PAGE_SIZE/PAGE_SHIFT. The last part adds support for high order pages by implementing the queue configuration functions and allowing larger rx_page_size configurations when in zero-copy mode. Results show an increase in BW and a decrease in CPU usage. The benchmark was done with the zcrx samples from liburing [0]. rx_buf_len=4K, oncpu [1]: packets=3358832 (MB=820027), rps=55794 (MB/s=13621) Average: CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle Average: 9 1.56 0.00 18.09 13.42 0.00 66.80 0.00 0.00 0.00 0.12 rx_buf_len=128K, oncpu [2]: packets=3781376 (MB=923187), rps=62813 (MB/s=15335) Average: CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle Average: 9 0.33 0.00 7.61 18.86 0.00 73.08 0.00 0.00 0.00 0.12 rx_buf_len=4K, offcpu [3]: packets=3460368 (MB=844816), rps=57481 (MB/s=14033) Average: CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle Average: 9 0.00 0.00 0.26 0.00 0.00 92.63 0.00 0.00 0.00 7.11 Average: 11 3.04 0.00 68.09 28.87 0.00 0.00 0.00 0.00 0.00 0.00 rx_buf_len=128K, offcpu [4]: packets=4119840 (MB=1005820), rps=68435 (MB/s=16707) Average: CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle Average: 9 0.00 0.00 0.87 0.00 0.00 63.77 0.00 0.00 0.00 35.36 Average: 11 1.96 0.00 43.68 54.37 0.00 0.00 0.00 0.00 0.00 0.00 [0] https://github.com/isilence/liburing/tree/zcrx/rx-buf-len [1] commands: $> taskset -c 9 ./zcrx 6 -i eth2 -q 9 -A 1 -B 4096 -S 33554432 $> ./send-zerocopy tcp -6 -D 2001:db8::1 -t 60 -C 0 -l 1 -b 1 -n 1 -z 1 -d -s 256000 [2] commands: $> taskset -c 9 ./zcrx 6 -i eth2 -q 9 -A 1 -B 131072 -S 33554432 $> ./send-zerocopy tcp -6 -D 2001:db8::1 -t 60 -C 0 -l 1 -b 1 -n 1 -z 1 -d -s 256000 [3] commands: $> taskset -c 11 ./zcrx 6 -i eth2 -q 9 -A 1 -B 4096 -S 33554432 $> ./send-zerocopy tcp -6 -D 2001:db8::1 -t 60 -C 0 -l 1 -b 1 -n 1 -z 1 -d -s 256000 [4] commands: $> taskset -c 11 ./zcrx 6 -i eth2 -q 9 -A 1 -B 131072 -S 33554432 $> ./send-zerocopy tcp -6 -D 2001:db8::1 -t 60 -C 0 -l 1 -b 1 -n 1 -z 1 -d -s 256000 ==================== Link: https://patch.msgid.link/20260223204155.1783580-1-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit df5135fced85bf3c3dfe174f1cf853cdf39312e5 Author: Dragos Tatulea Date: Mon Feb 23 22:41:55 2026 +0200 net/mlx5e: SHAMPO, Allow high order pages in zerocopy mode Allow high order pages only when SHAMPO mode is enabled (hw-gro) and the queue is used for zerocopy (has memory provider ops set). The limit is 128K and it was chosen for the following reasons: - 256K size requires a special case during MTT calculation to split the page in two. That's because two MTTs are needed to form an octword. - Higher sizes require increasing WQE size and/or reducing the number of WQEs. - Having the RQ lined with too few large pages can lead to refill issues. Results show an increase in BW and a decrease in CPU usage. The benchmark was done with the zcrx samples from liburing [0]. rx_buf_len=4K, oncpu [1]: packets=3358832 (MB=820027), rps=55794 (MB/s=13621) Average: CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle Average: 9 1.56 0.00 18.09 13.42 0.00 66.80 0.00 0.00 0.00 0.12 rx_buf_len=128K, oncpu [2]: packets=3781376 (MB=923187), rps=62813 (MB/s=15335) Average: CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle Average: 9 0.33 0.00 7.61 18.86 0.00 73.08 0.00 0.00 0.00 0.12 rx_buf_len=4K, offcpu [3]: packets=3460368 (MB=844816), rps=57481 (MB/s=14033) Average: CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle Average: 9 0.00 0.00 0.26 0.00 0.00 92.63 0.00 0.00 0.00 7.11 Average: 11 3.04 0.00 68.09 28.87 0.00 0.00 0.00 0.00 0.00 0.00 rx_buf_len=128K, offcpu [4]: packets=4119840 (MB=1005820), rps=68435 (MB/s=16707) Average: CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle Average: 9 0.00 0.00 0.87 0.00 0.00 63.77 0.00 0.00 0.00 35.36 Average: 11 1.96 0.00 43.68 54.37 0.00 0.00 0.00 0.00 0.00 0.00 [0] https://github.com/isilence/liburing/tree/zcrx/rx-buf-len [1] commands: $> taskset -c 9 ./zcrx 6 -i eth2 -q 9 -A 1 -B 4096 -S 33554432 $> ./send-zerocopy tcp -6 -D 2001:db8::1 -t 60 -C 0 -l 1 -b 1 -n 1 -z 1 -d -s 256000 [2] commands: $> taskset -c 9 ./zcrx 6 -i eth2 -q 9 -A 1 -B 131072 -S 33554432 $> ./send-zerocopy tcp -6 -D 2001:db8::1 -t 60 -C 0 -l 1 -b 1 -n 1 -z 1 -d -s 256000 [3] commands: $> taskset -c 11 ./zcrx 6 -i eth2 -q 9 -A 1 -B 4096 -S 33554432 $> ./send-zerocopy tcp -6 -D 2001:db8::1 -t 60 -C 0 -l 1 -b 1 -n 1 -z 1 -d -s 256000 [4] commands: $> taskset -c 11 ./zcrx 6 -i eth2 -q 9 -A 1 -B 131072 -S 33554432 $> ./send-zerocopy tcp -6 -D 2001:db8::1 -t 60 -C 0 -l 1 -b 1 -n 1 -z 1 -d -s 256000 Signed-off-by: Dragos Tatulea Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-16-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 5b6e0ddb368625f37b66f6f3efba88e5bc93618e Author: Dragos Tatulea Date: Mon Feb 23 22:41:54 2026 +0200 net/mlx5e: Add param helper to calculate max page size This function will be necessary to determine the upper limit of rx-page-size. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-15-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 585cfa99d3578db997423e79c9c99d4e5e428271 Author: Dragos Tatulea Date: Mon Feb 23 22:41:53 2026 +0200 net/mlx5e: Pass netdev queue config to param calculations If set, take rx_page_size into consideration when calculating the page shift in Multi Packet WQE mode. The queue config is saved in the mlx5e_rq_opt_param struct which is added to the mlx5e_channel_param struct. Now the configuration can be read from the struct instead of adding it as an argument to all call sites. For consistency, the queue config is assigned in mlx5e_build_channel_param(). The queue configuration is read only from queue management ops as that's the only place where it is currently useful. Furthermore, netdev_queue_config() expects netdev->queue_mgmt_ops to be set which is not always the case (representor netdevs). Signed-off-by: Dragos Tatulea Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-14-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 0fa8c93357601cbfb7006a420fd3b63f4a06af11 Author: Dragos Tatulea Date: Mon Feb 23 22:41:52 2026 +0200 net/mlx5e: Add queue config ops for page size For now allow only PAGE_SIZE. A subsequent patch will add support for high order pages in zero-copy mode. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-13-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 8611660778bf5db9f5f063c9bd58d41012801cb8 Author: Dragos Tatulea Date: Mon Feb 23 22:41:51 2026 +0200 net/mlx5e: RX, Make page frag bias more robust The formula uses the system page size but does not account for high order pages. One way to fix this would be to adapt the formula to take into account the pool order. This would require calculating it for every allocation or adding an additional rq struct member to hold the bias max. However, the above is not really needed as the driver doesn't check the bias value. It has other means to calculate the expected number of fragments based on context. This patch simply sets the value to the max possible value. A sanity check is added during queue init phase to avoid having really big pages from using more fragments than the type can fit. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-12-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 0285cc3dac1b4ceb3dacdfce43627d41d649cf47 Author: Dragos Tatulea Date: Mon Feb 23 22:41:50 2026 +0200 net/mlx5e: Alloc rq drop page based on calculated page_shift An upcoming patch will allow setting the page order for RX pages to be greater than 0. Make sure that the drop page will also be allocated with the right size when that happens. Take extra care when calculating the drop page size to account for page_shift < PAGE_SHIFT which can happen for xsk. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-11-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 3a145cf492a3a154afb288cd460adf6721614eab Author: Dragos Tatulea Date: Mon Feb 23 22:41:49 2026 +0200 net/mlx5e: Set page_pool order based on calculated page_shift Instead of unconditionally setting the page_pool to 0, calculate it from page_shift for MPWQE case. Signed-off-by: Dragos Tatulea Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-10-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit dff1c3164a69284ac9fedb1c25d4c008139e9fb8 Author: Dragos Tatulea Date: Mon Feb 23 22:41:48 2026 +0200 net/mlx5e: SHAMPO, Always calculate page size Adapt the rx path in SHAMPO mode to calculate page size based on configured page_shift when dealing with payload data. This is necessary as an upcoming patch will add support for using different page sizes. This change has no functional changes. Signed-off-by: Dragos Tatulea Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-9-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 3707a73854c1614a268e43a0fd98292a699f3b35 Author: Dragos Tatulea Date: Mon Feb 23 22:41:47 2026 +0200 net/mlx5e: Drop unused channel parameters The channel parameters from struct mlx5_qmgmt_data are built in mlx5e_queue_mem_alloc() but are not used. mlx5e_open_channel() builds the channel parameters internally and those parameters will be the ones that are used when opening the queue. This patch drops the unused parameters. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-8-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 099efb294e0a0c8cc4984a8c56b9a69e480ac5e9 Author: Dragos Tatulea Date: Mon Feb 23 22:41:46 2026 +0200 net/mlx5e: Move xsk param into new option container struct The xsk parameter configuration (struct mlx5e_xsk_param) is passed around many places during parameter calculation. It is used to contain channel specific information (as opposed to the global info from struct mlx5e_params). Upcoming changes will need to push similar channel specific rq configuration. Instead of adding one more parameter to all these functions, create a new container structure that has optional rq specific parameters. The xsk parameter will be the first of such kind. The new container struct is itself optional. That means that before checking its members, it has to be checked itself for validity. This patch has no functional changes. Signed-off-by: Dragos Tatulea Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-7-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 8a96b9144f18a2c996d3cfead85e4ca0f9e58de7 Author: Dragos Tatulea Date: Mon Feb 23 22:41:45 2026 +0200 net/mlx5e: Alloc xsk channel param out of mlx5e_open_xsk() Currently the allocation and filling of the xsk channel parameters was done in mlx5e_open_xsk(). Move this responsibility out of mlx5e_open_xsk() and have the function take an already filled mlx5e_channel_param. mlx5e_open_channel() already allocates channel parameters. The only precaution that is needed is to call mlx5e_build_xsk_channel_param() before mlx5e_open_xsk(). mlx5e_xsk_enable_locked() now allocates and fills the xsk parameters. For simplicity, link the xsk parameters in struct mlx5e_channel_params so that channel params can be passed around. This patch has no functional changes. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-6-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit ba4f39c256f503b4c6685f83f2a09d0a170a8144 Author: Dragos Tatulea Date: Mon Feb 23 22:41:44 2026 +0200 net/mlx5e: Expose and rename xsk channel parameter function mlx5e_build_xsk_cparam() is meant to be the alternative to mlx5e_build_channel_param(). It calculates only the parameters that it requires using the previously configured mlx5e_xsk_param. Move this function to params.c to be alongside mlx5e_build_channel_param() and give it a similar name. Expose the function as it will be needed by upcoming changes. This patch has no functional changes. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-5-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit a2ff2f5f808fe2638361fc634e8f3a2d73353bc8 Author: Dragos Tatulea Date: Mon Feb 23 22:41:43 2026 +0200 net/mlx5e: Extract max_xsk_wqebbs into its own function Calculating max_xsk_wqebbs seems large enough to deserve its own function. It will make upcoming changes easier. This patch has no functional changes. Signed-off-by: Dragos Tatulea Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-4-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit d3a99b71a29ce6a9c157bba50028a82c4a129c3c Author: Dragos Tatulea Date: Mon Feb 23 22:41:42 2026 +0200 net/mlx5e: Extract striding rq param calculation in function Calculating parameters for striding rq is large enough to deserve its own function. As the names are also very long it is very easy to hit on the 80 char limitation every time a change is made. This is an additional sign that it should be extracted into its own function. This patch has no functional change. Signed-off-by: Dragos Tatulea Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-3-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 376cf4227401f538cce799aee91bc33fb008d388 Author: Dragos Tatulea Date: Mon Feb 23 22:41:41 2026 +0200 net/mlx5e: Make mlx5e_rq_param naming consistent This structure is used under different names: rq_param, rq_params, param, rqp. Refactor the code to use a single name: rq_param. This patch has no functional change. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260223204155.1783580-2-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 108c77b34b929e6bdb7ac9613ed65c90da8bcb9f Author: Guodong Xu Date: Fri Feb 6 10:32:04 2026 +0800 riscv: dts: spacemit: Update PMIC supply properties for BPI-F3 and Jupiter Use per-regulator supply names in pmic "spacemit,p1" node to specify each board's power tree topology and match the updated dt-binding. Signed-off-by: Guodong Xu Reviewed-by: Alex Elder Link: https://lore.kernel.org/r/20260206-spacemit-p1-v4-3-8f695d93811e@riscstar.com Signed-off-by: Yixun Lan commit 8a9071299dec817a544c0fb48f7302396fafdc4b Author: Yixun Lan Date: Thu Feb 26 08:17:55 2026 +0000 riscv: dts: spacemit: pcie: fix missing power regulator The PCIe port require 3.3v power regulator for device to work properly, So explicitly add it to fix the DT warning: arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dtb: pcie@ca400000 (spacemit,k1-pcie): pcie@0: 'vpcie3v3-supply' is a required property from schema $id: http://devicetree.org/schemas/pci/spacemit,k1-pcie-host.yaml Fixes: 0be016a4b5d1 ("riscv: dts: spacemit: PCIe and PHY-related updates") Reported-by: Conor Dooley Link: https://lore.kernel.org/r/20260226-k1-pcie-fix-pwr-v1-1-94b493cd27e5@kernel.org Signed-off-by: Yixun Lan commit 4637b4cdd7aebfa2e38fa39f4db91fa089b809c5 Author: Yang Wen Date: Wed Feb 25 22:59:42 2026 +0800 exfat: use truncate_inode_pages_final() at evict_inode() Currently, exfat uses truncate_inode_pages() in exfat_evict_inode(). However, truncate_inode_pages() does not mark the mapping as exiting, so reclaim may still install shadow entries for the mapping until the inode teardown completes. In older kernels like Linux 5.10, if shadow entries are present at that point,clear_inode() can hit BUG_ON(inode->i_data.nrexceptional); To align with VFS eviction semantics and prevent this situation, switch to truncate_inode_pages_final() in ->evict_inode(). Other filesystems were updated to use truncate_inode_pages_final() in ->evict_inode() by commit 91b0abe36a7b ("mm + fs: store shadow entries in page cache")'. Signed-off-by: Yang Wen Signed-off-by: Namjae Jeon commit 7c76484fbb222e82f1db34009eb441d08db0a158 Author: Ethan Tidmore Date: Wed Feb 25 22:03:55 2026 -0600 ntfs: Remove impossible condition The variable name_len is checked to see if it's larger than the macro NTFS_MAX_NAME_LEN however this condition is impossible because name_len is of type u8 and NTFS_MAX_NAME_LEN is hardcoded to be 255. Detected by Smatch: fs/ntfs/namei.c:1175 __ntfs_link() warn: impossible condition '(name_len > 255) => (0-255 > 255)' Signed-off-by: Ethan Tidmore Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit ec8676c84f665257f4bf9349d4c12c05e09e31b3 Author: Ethan Tidmore Date: Wed Feb 25 22:03:54 2026 -0600 ntfs: Replace ERR_PTR(0) with NULL The variable err is confirmed to be 0 and then never reassigned in the success path. The function then returns with ERR_PTR(err) which just equals NULL and can be misleading. Detected by Smatch: fs/ntfs/namei.c:1091 ntfs_mkdir() warn: passing zero to 'ERR_PTR' Signed-off-by: Ethan Tidmore Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 9b4253cd63ac00f6944fa0ac58d981c21859db3b Author: Randy Dunlap Date: Wed Feb 25 18:06:15 2026 -0800 ntfs: repair docum. malformed table Make the top and bottom borders be that same length to avoid a documentation build error: Documentation/filesystems/ntfs.rst:159: ERROR: Malformed table. Bottom border or header rule does not match top border. (top) ======================= =================================================== (bottom) ======================= ================================================== Signed-off-by: Randy Dunlap Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 1dbe39666bf33f0713012dc3c0ecb559a1b5c36a Author: Chen Ni Date: Thu Feb 26 09:45:28 2026 +0800 ntfs: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 40c31f0563ec10e5b112be35e2e003f8ce4afe98 Author: Ethan Tidmore Date: Wed Feb 25 16:24:53 2026 -0600 ntfs: Fix null pointer dereference The variable ctx can be null and once confirmed to be null in its error path goes to label err_out. Once there it can be immediately dereferenced by the function ntfs_attr_put_search_ctx() which has no null pointer check. Detected by Smatch: fs/ntfs/ea.c:687 ntfs_new_attr_flags() error: we previously assumed 'ctx' could be null (see line 577) Add null pointer check before running ntfs_attr_put_search_ctx() in error path. Signed-off-by: Ethan Tidmore Reviewed-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit a969a0835152984a0f556434eafdee0b84213670 Author: Florian Fainelli Date: Wed Jan 21 16:35:00 2026 -0800 memory: brcmstb_memc: Expand LPDDR4 check to cover for LPDDR5 The same limitations that apply to LPDDR4 also apply to LPDDR5. Expand the check and rename accordingly. Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20260122003501.1191059-1-florian.fainelli@broadcom.com Signed-off-by: Krzysztof Kozlowski commit cdd94147fd72974eb1d118b1ba3b79e8df0ea716 Author: André Draszik Date: Thu Feb 5 22:01:57 2026 +0000 clk: samsung: gs101: harmonise symbol names (clock arrays) Most symbols for the clock descriptions (arrays) don't have a cmu_ prefix and all symbols have a _clks suffix where appropriate. Update the few outliers to also fall into this same scheme for consistency. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260205-clk-gs101-symbol-names-v1-1-a7d9a7a4d108@linaro.org Signed-off-by: Krzysztof Kozlowski commit f2e83070febf61fc72765cdc28d2a45c89b77ce4 Author: André Draszik Date: Tue Feb 10 12:42:32 2026 +0000 dt-bindings: firmware: google,gs101-acpm-ipc: add S2MPG11 secondary PMIC In a typical system using the Samsung S2MPG10 PMIC, an S2MPG11 is used as a sub-PMIC. The interface for both is the ACPM firmware protocol, so update the binding to allow the relevant node and update the example here to describe the connection for both PMICs. Since we have two PMICs here, but can not use the 'reg' property (as the addressing is based on software, i.e. the ACPM firmware), the node names reflect that with their respective suffix. The existing 'pmic' therefore becomes deprecated in favour of 'pmic-1'. While at it, update the example. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://patch.msgid.link/20260210-s2mpg1x-regulators-v8-1-c429d709c0e0@linaro.org Signed-off-by: Krzysztof Kozlowski commit 5d692f20de6311fa507c952adc3487c641edee00 Author: Rayan Marzouk Date: Sun Jan 25 01:35:27 2026 +0530 arm64: dts: exynos: add initial support for Samsung Galaxy J7 (2016) Add initial devicetree support for Samsung Galaxy J7 (2016) (codename: j7xelte), an Exynos7870 device. Signed-off-by: Rayan Marzouk Signed-off-by: Kaustabh Chakraborty Link: https://patch.msgid.link/20260125-exynos7870-j7xelte-v1-2-5cacc3042c42@disroot.org Link: https://lore.kernel.org/r/DGNRDQ5886K7.3NSLKILM1GDWR@disroot.org/ Signed-off-by: Krzysztof Kozlowski commit be961cdb8ed3befa81dce118a6a41f0138732d10 Author: Kaustabh Chakraborty Date: Sun Jan 25 01:35:26 2026 +0530 dt-bindings: arm: samsung: add compatible for samsung-j7xelte Document the board compatible for Samsung Galaxy J7 (2016), an Exynos7870 device. Signed-off-by: Kaustabh Chakraborty Link: https://patch.msgid.link/20260125-exynos7870-j7xelte-v1-1-5cacc3042c42@disroot.org Signed-off-by: Krzysztof Kozlowski commit eed390775470ff0db32cce37a681f3acc2b941c3 Author: Manivannan Sadhasivam Date: Tue Feb 17 17:01:42 2026 +0530 PCI: dwc: Proceed with system suspend even if the endpoint doesn't respond with PME_TO_Ack message PCIe spec r7.0, sec 5.3.3.2.1, recommends proceeding with L2/L3 sequence even if one or devices do not respond with PME_TO_Ack message after 10ms timeout. So just print a warning if the timeout happens and proceed with the system suspend. Reported-by: Neil Armstrong Signed-off-by: Manivannan Sadhasivam Signed-off-by: Manivannan Sadhasivam Tested-by: Neil Armstrong # on SM8650-HDK Reviewed-by: Frank Li Link: https://patch.msgid.link/20260217113142.9140-1-manivannan.sadhasivam@oss.qualcomm.com commit be14d13625c9b070c33c423026b598ed65695225 Author: kexinsun Date: Tue Feb 24 10:18:21 2026 +0800 xfrm: update outdated comment The function __xfrm4_bundle_create() was refactored into xfrm_bundle_create() (among others) by commit 25ee3286dcbc ("xfrm: Merge common code into xfrm_bundle_create"). The responsibility for setting dst->obsolete to DST_OBSOLETE_FORCE_CHK now lives in xfrm_bundle_create(). Update the comment accordingly. Signed-off-by: kexinsun Signed-off-by: Steffen Klassert commit 9983d51d1a68520ce74663920929e27b191cf43a Author: Andy Shevchenko Date: Wed Feb 25 18:37:21 2026 +0100 dt-bindings: cache: bt1-l2-ctl: Remove unused bindings As stated in [1] the Baikal platforms are not supported and the respective driver code has just been removed. Remove unused bindings. Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1] Acked-by: Conor Dooley Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260225173930.3819351-3-andriy.shevchenko@linux.intel.com Signed-off-by: Krzysztof Kozlowski commit d455e0f602d7e4d4ba709418009c39be48fc2149 Author: Andy Shevchenko Date: Wed Feb 25 18:37:20 2026 +0100 memory: bt1-l2-ctl: Remove not-going-to-be-supported code for Baikal SoC As noticed in the discussion [1] the Baikal SoC and platforms are not going to be finalized, hence remove stale code. Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1] Reviewed-by: Randy Dunlap Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260225173930.3819351-2-andriy.shevchenko@linux.intel.com Signed-off-by: Krzysztof Kozlowski commit 3b55079d6387805ede687e234d84669aeb0f7e98 Author: Felix Gu Date: Sat Jan 24 23:42:45 2026 +0800 PCI: imx6: Fix device node reference leak in imx_pcie_probe() In imx_pcie_probe(), of_parse_phandle() returns the device node pointer with increased refcount. The pointer reference must be dropped by the caller when it's no longer needed. However, imx_pcie_probe() doesn't drop the reference, causing reference leak. Fix this by using the __free(device_node) cleanup handler to drop the reference when the function goes out of scope. Fixes: 1df82ec46600 ("PCI: imx: Add workaround for e10728, IMX7d PCIe PLL failure") Signed-off-by: Felix Gu [mani: commit log] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Acked-by: Richard Zhu Link: https://patch.msgid.link/20260124-pci_imx6-v2-1-acb8d5187683@gmail.com commit e36262c5e6c25e19d7d082936f63b3a8e62739f9 Author: Sascha Hauer Date: Mon Jan 12 20:17:11 2026 +0100 PCI: layerscape: Allow to compile as module The layerscape pcie host controller could also be compiled as module. Add the necessary infrastructure to allow building as module instead of only as builtin driver. Since the driver doesn't expose an irqchip controller, it is also safe to be removed during runtime. Signed-off-by: Sascha Hauer Signed-off-by: Steffen Trumtrar [mani: added a note about driver removability] Signed-off-by: Manivannan Sadhasivam Acked-by: Roy Zang Link: https://patch.msgid.link/20260112-v6-19-topic-layerscape-pcie-v1-1-1cd863fce50e@pengutronix.de commit c7f5c6fb0f2b1a44490a36582a251f0a304d6b0c Merge: 2cd63825c7c610 19c3a2a81d2bca Author: Jakub Kicinski Date: Wed Feb 25 19:42:05 2026 -0800 Merge branch 'add-selftests-helper-to-get-n-unique-ports' Dimitri Daskalakis says: ==================== Add selftests helper to get N unique ports The rss_ctx.py tests would occasionally flake. I found that the successive calls to rand_port would occasionally return duplicate ports, breaking the tests invariants. Add a new helper that guarantees generated ports are unique. ==================== Link: https://patch.msgid.link/20260224224659.1507082-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit 19c3a2a81d2bca7ca2187ea3686c4bdfd147115b Author: Dimitri Daskalakis Date: Tue Feb 24 14:46:59 2026 -0800 selftests: drv-net: rss: Generate unique ports for RSS context tests The RSS ctx tests rely on NFC rules with unique ports to steer packets to the correct ctx. This updates the test to use the new rand_ports() helper to guarantee the ports are unique. Manual testing shows that generating 32 ports with the existing method would result in at least one duplicate 4% of the time. Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20260224224659.1507082-3-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit b0249c0d41b306ddd79de58ca7fea543ab5e7a2e Author: Dimitri Daskalakis Date: Tue Feb 24 14:46:58 2026 -0800 selftests: net: py: Add rand_ports helper method Certain tests need a unique set of ports. Successive calls to the existing rand_port method may return a duplicate port, resulting in test flakiness. The new helper keeps sockets open while building a list of ephemeral ports, thus the kernel enforces their uniqueness. Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20260224224659.1507082-2-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit 2cd63825c7c6105bc298474fbb073d25f48114cf Merge: 7717fbb14028be 6b94d081f81dd5 Author: Jakub Kicinski Date: Wed Feb 25 19:36:28 2026 -0800 Merge branch 'netfilter-updates-for-net-next' Florian Westphal says: ==================== netfilter: updates for net-next including IPVS updates from and via Julian Anastasov. First updates for IPVS. From Julians cover-letter: * Convert the global __ip_vs_mutex to per-net service_mutex and switch the service tables to be per-net, cowork by Jiejian Wu and Dust Li * Convert some code that walks the service lists to use RCU instead of the service_mutex * We used two tables for services (non-fwmark and fwmark), merge them into single svc_table * The list for unavailable destinations (dest_trash) holds dsts and thus dev references causing extra work for the ip_vs_dst_event() dev notifier handler. Change this by dropping the reference when dest is removed and saved into dest_trash. The dest_trash will need more changes to make it light for lookups. TODO. * On new connection we can do multiple lookups for services by trying different fallback options. Add more counters for service types, so that we can avoid unneeded lookups for services. * The no_cport and dropentry counters can be per-net and also we can avoid extra conn lookups Then, a few cleanups for nf_tables: * keep BH enabled during nft_set_rbtree inserts, this is possible because the root lock is now only taken from control plane. * toss a few EXPORT_SYMBOLs from nf_tables; these were historic leftovers from back in the day when e.g. set backends were still residing in their own modules. * remove the register tracking infra from nftables. It was disabled years ago in 5.18 and there are no plans to salvage this work; the idea was good (remove redundant register stores), but there is just one too many pitfalls, and better rule structuring (verdict maps) largely avoids the scenarios where this would have helped. ==================== Link: https://patch.msgid.link/20260224205048.4718-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 6b94d081f81dd524626f7aab2b98a9de335edb72 Author: Florian Westphal Date: Tue Feb 24 21:50:48 2026 +0100 netfilter: nf_tables: remove register tracking infrastructure This facility was disabled in commit 9e539c5b6d9c ("netfilter: nf_tables: disable expression reduction infra"), because not all nft_exprs guarantee they will update the destination register: some may set NFT_BREAK instead to cancel evaluation of the rule. This has been dead code ever since. There are no plans to salvage this at this time, so remove this. Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260224205048.4718-10-fw@strlen.de Signed-off-by: Jakub Kicinski commit b6461103e01ae863148e30c663a06f7327cf6681 Author: Florian Westphal Date: Tue Feb 24 21:50:47 2026 +0100 netfilter: nf_tables: drop obsolete EXPORT_SYMBOLs These are no longer required, calling objects are nowadays baked into nf_tables.ko itself. Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260224205048.4718-9-fw@strlen.de Signed-off-by: Jakub Kicinski commit 3aea466a439984053d9240b0ca946842a91e484d Author: Florian Westphal Date: Tue Feb 24 21:50:46 2026 +0100 netfilter: nft_set_rbtree: don't disable bh when acquiring tree lock As of commit 7e43e0a1141d ("netfilter: nft_set_rbtree: translate rbtree to array for binary search") the lock is only taken from control plane, no need to disable BH anymore. Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260224205048.4718-8-fw@strlen.de Signed-off-by: Jakub Kicinski commit 09b71fb459468b408f3fa3e2b75d20113374f057 Author: Julian Anastasov Date: Tue Feb 24 21:50:45 2026 +0100 ipvs: no_cport and dropentry counters can be per-net Change the no_cport counters to be per-net and address family. This should reduce the extra conn lookups done during present NO_CPORT connections. By changing from global to per-net dropentry counters, one net will not affect the drop rate of another net. Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260224205048.4718-7-fw@strlen.de Signed-off-by: Jakub Kicinski commit c59bd9e62e060bb5cd4d697b73bbe6f23a723345 Author: Julian Anastasov Date: Tue Feb 24 21:50:44 2026 +0100 ipvs: use more counters to avoid service lookups When new connection is created we can lookup for services multiple times to support fallback options. We already have some counters to skip specific lookups because it costs CPU cycles for hash calculation, etc. Add more counters for fwmark/non-fwmark services (fwm_services and nonfwm_services) and make all counters per address family. Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260224205048.4718-6-fw@strlen.de Signed-off-by: Jakub Kicinski commit 40fb72209fd83edaf3632dba644b1fcf81143cfc Author: Julian Anastasov Date: Tue Feb 24 21:50:43 2026 +0100 ipvs: do not keep dest_dst after dest is removed Before now dest->dest_dst is not released when server is moved into dest_trash list after removal. As result, we can keep dst/dev references for long time without actively using them. It is better to avoid walking the dest_trash list when ip_vs_dst_event() receives dev events. So, make sure we do not hold dev references in dest_trash list. As packets can be flying while server is being removed, check the IP_VS_DEST_F_AVAILABLE flag in slow path to ensure we do not save new dev references to removed servers. Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260224205048.4718-5-fw@strlen.de Signed-off-by: Jakub Kicinski commit b24ae1a387e404e832385448ccad30cb03520e45 Author: Julian Anastasov Date: Tue Feb 24 21:50:42 2026 +0100 ipvs: use single svc table fwmark based services and non-fwmark based services can be hashed in same service table. This reduces the burden of working with two tables. Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260224205048.4718-4-fw@strlen.de Signed-off-by: Jakub Kicinski commit 3de0ec2873eac27ba033e867f5da23e081929c8f Author: Julian Anastasov Date: Tue Feb 24 21:50:41 2026 +0100 ipvs: some service readers can use RCU Some places walk the services under mutex but they can just use RCU: * ip_vs_dst_event() uses ip_vs_forget_dev() which uses its own lock to modify dest * ip_vs_genl_dump_services(): ip_vs_genl_fill_service() just fills skb * ip_vs_genl_parse_service(): move RCU lock to callers ip_vs_genl_set_cmd(), ip_vs_genl_dump_dests() and ip_vs_genl_get_cmd() * ip_vs_genl_dump_dests(): just fill skb Signed-off-by: Julian Anastasov Reviewed-by: Dust Li Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260224205048.4718-3-fw@strlen.de Signed-off-by: Jakub Kicinski commit 74455a5b4326add2499cb4a1f9706154b3a1eab4 Author: Jiejian Wu Date: Tue Feb 24 21:50:40 2026 +0100 ipvs: make ip_vs_svc_table and ip_vs_svc_fwm_table per netns Current ipvs uses one global mutex "__ip_vs_mutex" to keep the global "ip_vs_svc_table" and "ip_vs_svc_fwm_table" safe. But when there are tens of thousands of services from different netns in the table, it takes a long time to look up the table, for example, using "ipvsadm -ln" from different netns simultaneously. We make "ip_vs_svc_table" and "ip_vs_svc_fwm_table" per netns, and we add "service_mutex" per netns to keep these two tables safe instead of the global "__ip_vs_mutex" in current version. To this end, looking up services from different netns simultaneously will not get stuck, shortening the time consumption in large-scale deployment. It can be reproduced using the simple scripts below. init.sh: #!/bin/bash for((i=1;i<=4;i++));do ip netns add ns$i ip netns exec ns$i ip link set dev lo up ip netns exec ns$i sh add-services.sh done add-services.sh: #!/bin/bash for((i=0;i<30000;i++)); do ipvsadm -A -t 10.10.10.10:$((80+$i)) -s rr done runtest.sh: #!/bin/bash for((i=1;i<4;i++));do ip netns exec ns$i ipvsadm -ln > /dev/null & done ip netns exec ns4 ipvsadm -ln > /dev/null Run "sh init.sh" to initiate the network environment. Then run "time ./runtest.sh" to evaluate the time consumption. Our testbed is a 4-core Intel Xeon ECS. The result of the original version is around 8 seconds, while the result of the modified version is only 0.8 seconds. Signed-off-by: Jiejian Wu Co-developed-by: Dust Li Signed-off-by: Dust Li Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260224205048.4718-2-fw@strlen.de Signed-off-by: Jakub Kicinski commit 7717fbb14028be5735acb911aeb7553b7c662418 Author: Eric Woudstra Date: Tue Feb 24 16:50:30 2026 +0100 net: pppoe: avoid zero-length arrays in struct pppoe_hdr Jakub Kicinski reported following issue in upcoming patches: W=1 C=1 GCC build gives us: net/bridge/netfilter/nf_conntrack_bridge.c: note: in included file (through ../include/linux/if_pppox.h, ../include/uapi/linux/netfilter_bridge.h, ../include/linux/netfilter_bridge.h): include/uapi/linux/if_pppox.h: 153:29: warning: array of flexible structures sparse doesn't like that hdr has a zero-length array which overlaps proto. The kernel code doesn't currently need those arrays. PPPoE connection is functional after applying this patch. Reviewed-by: Nikolay Aleksandrov Reviewed-by: Kees Cook Signed-off-by: Eric Woudstra Link: https://patch.msgid.link/20260224155030.106918-1-ericwouds@gmail.com Signed-off-by: Jakub Kicinski commit 8debe7a22309497f42fb963494833b9abd446328 Author: Abhilekh Deka Date: Tue Feb 24 21:06:01 2026 +0530 net/ibmveth: fix comment typos in ibmveth.c Correct spelling mistakes in comments: - Fix misspelling of gro_receive - Fix misspelling of Partition Signed-off-by: Abhilekh Deka Reviewed-by: Dave Marquardt Link: https://patch.msgid.link/20260224153601.17534-1-abhindeka@gmail.com Signed-off-by: Jakub Kicinski commit 45ce4b753a5047c2e61c45c9d8d878b835b39c14 Author: Nicolai Buchwitz Date: Tue Feb 24 15:57:23 2026 +0100 net: cadence: macb: add ethtool nway_reset support Wire phy_ethtool_nway_reset() as the .nway_reset ethtool operation, allowing userspace to restart PHY autonegotiation via 'ethtool -r'. Signed-off-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260224145723.49450-1-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit 23a611b9b3bdcad2c63f291f14a9ea0ac50cc509 Merge: 51432958b5655e dd53a0e85969c6 Author: Jakub Kicinski Date: Wed Feb 25 19:12:36 2026 -0800 Merge branch 'net-stmmac-fix-interrupt-coalescing' Russell King says: ==================== net: stmmac: fix interrupt coalescing While cleaning up the descriptor handling, I noticed that the accounting of transmit "packets" for interrupt coalescing was buggy in that it takes the difference of the two indexes into the circular list of transmit discriptors and merely subtracts one from the other without regard for the indexes wrapping. This can result in a negative number or very large positive number which would have the effect of either reducing tx_q->tx_count_frames or making that very large. Either way, the result is numerically incorrect, and could trigger interrupts or not trigger interrupts when required. This series converts stmmac to use the circ_buf helpers, and then fixes this problem. ==================== Link: https://patch.msgid.link/aZ1o2dmfpeiubCik@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit dd53a0e85969c6b2a5a4e4e46ba05b3187231017 Author: Russell King (Oracle) Date: Tue Feb 24 09:01:55 2026 +0000 net: stmmac: fix transmit interrupt coalescing The accounting for transmit frames does not count the descriptors correctly. It uses: tx_packets = (tx_q->cur_tx + 1) - first_tx; however, these are indexes into a circular buffer, so cur_tx can be less than first_tx, and when that happens, tx_packets becomes a very large unsigned integer. When this is added to tx_q->tx_count_frames, it has the effect of reducing the count of frames, possibly causing it to also wrap to a very large unsigned integer. Fix this by using CIRC_CNT() to calculate the number of descriptors used. Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Link: https://patch.msgid.link/E1vuoIl-0000000Aouz-0ttb@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 819101c3c158f6e220be9a9ded3c48ff5701cf42 Author: Russell King (Oracle) Date: Tue Feb 24 09:01:50 2026 +0000 net: stmmac: use circ_buf helpers for descriptors The stmmac descriptor queues are circular buffers, operated as far as the hardware is concerned as either a ring, or a chain that loops back on itself. From the software perspective, it forms a circular buffer. We have a few places which calculate the number of in-use and free entries in these circular buffers, for which we have macros for. Use CIRC_CNT() and CIRC_SPACE() as appropriate to calculate these values. Validating, for stmmac_tx_avail(), which uses CIRC_SPACE(): dirty_tx = 1, cur_tx = 0 -> 0 dirty_tx = 0, cur_tx = 0 -> dma_tx_size - 1 dirty_tx = 0, cur_tx = 1 -> dma_tx_size - 2 dirty_tx passed as end, reduced by one. cur_tx passed as start. Output on sane computers is identical. For stmmac_rx_dirty(), which uses CIRC_CNT(): dirty_rx = 1, cur_rx = 0 -> dma_rx_size - 1 dirty_rx = 0, cur_rx = 0 -> 0 dirty_rx = 0, cur_rx = 1 -> 1 dirty_rx passed as start, cur_rx passed as end. Output is identical. Same validation performed on the is_last_segment calculation, which also gets converted to CIRC_CNT(). Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Link: https://patch.msgid.link/E1vuoIg-0000000Aout-0LyS@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 51432958b5655e9f848b559ca59ae1a7f00a9166 Author: kexinsun Date: Tue Feb 24 10:07:20 2026 +0800 rds: update outdated comment The function rds_send_reset() was subsumed by rds_send_path_reset() by commit d769ef81d5b5 ("RDS: Update rds_conn_shutdown to work with rds_conn_path"). Update the comment accordingly. Signed-off-by: kexinsun Link: https://patch.msgid.link/20260224020720.1174-1-kexinsun@smail.nju.edu.cn Signed-off-by: Jakub Kicinski commit dc2a1facbde80b388d5052c572577d74eb4da69f Author: Rosen Penev Date: Mon Feb 23 17:46:06 2026 -0800 net: fs_enet: allow nvmem to override MAC address NVMEM typically loads after the ethernet driver and of_get_ethdev_address returns -EPROBE_DEFER. return in such a case to allow NVMEM to work. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260224014607.353378-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski commit 6698d6ce6a6b20d8780ade93b9b689787b5a4945 Author: Jakub Kicinski Date: Mon Feb 23 12:40:30 2026 -0800 selftests: hw-net: tso: set a TCP window clamp to avoid spurious drops The TSO test wants to make sure that there isn't a lot of retransmits, because that could indicate that device has a buggy TSO implementation. On debug kernels, however, we're likely to see significant packet loss because we simply overwhelm the receiver. In a QEMU loop with virtio devices we see ~10% false positive rate with occasional run hitting the threshold of 25% packet loss. Since we're only sending 4MB of data, set a TCP_WINDOW_CLAMP to 200k. This seems to make virtio happy while having little impact since we're primarily interested in testing the sender, and the test doesn't currently enable BIG TCP. Running socat over virtio loop for 2 sec on a debug kernel shows: TcpOutSegs 27327 0.0 TcpRetransSegs 83 0.0 TcpOutSegs 30012 0.0 TcpRetransSegs 80 0.0 TcpOutSegs 28767 0.0 TcpRetransSegs 77 0.0 But with the clamp the 3 attempts show no retransmit: TcpOutSegs 31537 0.0 TcpRetransSegs 0 0.0 TcpOutSegs 30323 0.0 TcpRetransSegs 0 0.0 TcpOutSegs 28700 0.0 TcpRetransSegs 0 0.0 Since we expect no receiver-related drops now we can significantly increase test's sensitivity to drops. All the testing we do in NIPA uses cubic. Link: https://patch.msgid.link/20260223204030.4142884-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8215d7cbfbcf7f40ad409f5217d88c7abce76fe0 Author: Russell King (Oracle) Date: Mon Feb 23 12:17:13 2026 +0000 net: stmmac: fix EEE supportable interfaces According to the dwmac v3.74a databook, only MII, GMII and RGMII dwmac interface modes are supported for EEE. Restrict EEE to these modes, or the modules supported by a PCS other than the GMAC's integrated PCS. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vuUsD-0000000Afci-0XxO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0feca0b788567debbaec6a9a329f5bee1b15c705 Author: Andi Kleen Date: Tue Feb 17 17:40:56 2026 -0800 perf script: Fix brcntr output with --xed brcntr in perf script brstack insn currently outputs $ perf record -j any,counter ... $ perf script -F +brcntr,+brstackinsn ... BC1s 3450809 5665912.127194: 100127 cpu_core/cycles/: 7f0475d6cc89 handle_intel.constprop.0+0x2b (/usr/lib64/ld-linux- x86-64.so.2) intel_check_word.constprop.0+224: 00007f0475d6ca7e insn: 00 4b db br_cntr: # PRED 21 cycles [21] ... This has two issues: - The description says no event is a single dash, but that is not what is printed. - The b in brcntr is ambigious with the hex numbers in insns, which breaks with --xed. It parses the b as another instruction byte and merges the instruction with a missing b and no space: $ perf script -F +brstackinsn,+brcntr --xed ... 00005618c6d683b5 jnz 0x5618c6d683bdr_cntr: # PRED 5 cycles [1396] 8.60 IPC This patches fixes these two problems. It moves the brcntr output into the "#" comment which also looks nicer and also fixes the no event case. $ perf script -F +brstackinsn,+brcntr --xed ... 00005618c6d6624f jnz 0x5618c6d65fb7 # br_cntr: - MISPRED 1 cycles [1398] 3.00 IPC Since the old broken format has shipped for a few releases there is a risk of breaking some existing parser, but since this is a obscure feature I hope they're not too common and can adapt. Signed-off-by: Andi Kleen Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit b5425f5406ee1b4bd84720f68020ef18ce380bab Author: Vishal Verma Date: Fri Jan 9 12:14:31 2026 -0700 x86/virt/tdx: Print TDX module version during init It is useful to print the TDX module version in dmesg logs. This is currently the only way to determine the module version from the host. It also creates a record for any future problems being investigated. This was also requested in [1]. Include the version in the log messages during init, e.g.: virt/tdx: TDX module version: 1.5.24 virt/tdx: 1034220 KB allocated for PAMT virt/tdx: module initialized Print the version in get_tdx_sys_info(), right after the version metadata is read, which makes it available even if there are subsequent initialization failures. Based on a patch by Kai Huang [2] Signed-off-by: Vishal Verma Signed-off-by: Dave Hansen Reviewed-by: Chao Gao Reviewed-by: Tony Lindgren Reviewed-by: Kiryl Shutsemau Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Reviewed-by: Rick Edgecombe Reviewed-by: Kai Huang Link: https://lore.kernel.org/all/CAGtprH8eXwi-TcH2+-Fo5YdbEwGmgLBh9ggcDvd6N=bsKEJ_WQ@mail.gmail.com/ # [1] Link: https://lore.kernel.org/all/6b5553756f56a8e3222bfc36d0bdb3e5192137b7.1731318868.git.kai.huang@intel.com # [2] Link: https://patch.msgid.link/20260109-tdx_print_module_version-v2-2-e10e4ca5b450@intel.com commit 311214bf1df4b110f6b0646615aecfab388a25ef Author: Chao Gao Date: Fri Jan 9 12:14:30 2026 -0700 x86/virt/tdx: Retrieve TDX module version Each TDX module has several bits of metadata about which specific TDX module it is. The primary bit of info is the version, which has an x.y.z format. These represent the major version, minor version, and update version respectively. Knowing the running TDX Module version is valuable for bug reporting and debugging. Note that the module does expose other pieces of version-related metadata, such as build number and date. Those aren't retrieved for now, that can be added if needed in the future. Retrieve the TDX Module version using the existing metadata reading interface. Later changes will expose this information. The metadata reading interfaces have existed for quite some time, so this will work with older versions of the TDX module as well - i.e. this isn't a new interface. As a side note, the global metadata reading code was originally set up to be auto-generated from a JSON definition [1]. However, later [2] this was found to be unsustainable, and the autogeneration approach was dropped in favor of just manually adding fields as needed (e.g. as in this patch). Signed-off-by: Chao Gao Signed-off-by: Vishal Verma Signed-off-by: Dave Hansen Reviewed-by: Kiryl Shutsemau Reviewed-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Tony Lindgren Reviewed-by: Xiaoyao Li Reviewed-by: Kai Huang Link: https://lore.kernel.org/kvm/CABgObfYXUxqQV_FoxKjC8U3t5DnyM45nz5DpTxYZv2x_uFK_Kw@mail.gmail.com/ # [1] Link: https://lore.kernel.org/all/1e7bcbad-eb26-44b7-97ca-88ab53467212@intel.com/ # [2] Link: https://patch.msgid.link/20260109-tdx_print_module_version-v2-1-e10e4ca5b450@intel.com commit 9973e64bd6ee7642860a6f3b6958cbf14e89cabd Author: Mario Limonciello Date: Wed Feb 25 10:51:16 2026 -0600 drm/amd: Disable MES LR compute W/A A workaround was introduced in commit 1fb710793ce2 ("drm/amdgpu: Enable MES lr_compute_wa by default") to help with some hangs observed in gfx1151. This WA didn't fully fix the issue. It was actually fixed by adjusting the VGPR size to the correct value that matched the hardware in commit b42f3bf9536c ("drm/amdkfd: bump minimum vgpr size for gfx1151"). There are reports of instability on other products with newer GC microcode versions, and I believe they're caused by this workaround. As we don't need the workaround any more, remove it. Fixes: b42f3bf9536c ("drm/amdkfd: bump minimum vgpr size for gfx1151") Acked-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit bb71362182e59caa227e4192da5a612b09349696 Author: Lijo Lazar Date: Tue Feb 24 10:18:51 2026 +0530 drm/amdgpu: Fix error handling in slot reset If the device has not recovered after slot reset is called, it goes to out label for error handling. There it could make decision based on uninitialized hive pointer and could result in accessing an uninitialized list. Initialize the list and hive properly so that it handles the error situation and also releases the reset domain lock which is acquired during error_detected callback. Fixes: 732c6cefc1ec ("drm/amdgpu: Replace tmp_adev with hive in amdgpu_pci_slot_reset") Signed-off-by: Lijo Lazar Reviewed-by: Ce Sun Signed-off-by: Alex Deucher commit 9eaaae4c4b7a999d59e534c6e4218b175274ff33 Author: Jinzhou Su Date: Tue Feb 10 14:49:35 2026 +0800 drm/amd/ras: Handle check address validity in SR-IOV Handle check address validity command in SR-IOV guest. Signed-off-by: Jinzhou Su Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher commit f0f23c315b38c55e8ce9484cf59b65811f350630 Author: sguttula Date: Sat Feb 21 10:03:32 2026 +0530 drm/amdgpu/vcn5: Add SMU dpm interface type This will set AMDGPU_VCN_SMU_DPM_INTERFACE_* smu_type based on soc type and fixing ring timeout issue seen for DPM enabled case. Signed-off-by: sguttula Reviewed-by: Pratik Vishwakarma Signed-off-by: Alex Deucher commit edd786e9cf355ce777705f44b6e9c3f432c04f73 Author: Jinzhou Su Date: Tue Feb 10 14:36:48 2026 +0800 drm/amd/ras: Add function to convert retired address Add function to convert retired address in SR-IOV guest. Signed-off-by: Jinzhou Su Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher commit a1fafed0f529d8f79e7deac762dc53f901fa13ec Author: Jinzhou Su Date: Tue Feb 10 14:32:40 2026 +0800 drm/amd/ras: Handle address check in SR-IOV guest Handle address check validity command in SR-IOV guest Signed-off-by: Jinzhou Su Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher commit 186eb92a1a7fd69d9ee3de04bfc84f55f14367da Author: Jinzhou Su Date: Mon Feb 9 15:42:25 2026 +0800 drm/amd/ras: Add convert retired address structure Add convert retired address command and structure for uniras. Signed-off-by: Jinzhou Su Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher commit 2480d3bf9e7128ecfc2c7d10d16991356043670b Author: Jinzhou Su Date: Tue Feb 10 15:46:13 2026 +0800 drm/amd/ras: Add address check structure Add address check command and data structure for uniras. Signed-off-by: Jinzhou Su Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher commit 6fa01b4335978051d2cd80841728fd63cc597970 Author: Bart Van Assche Date: Mon Feb 23 13:50:23 2026 -0800 drm/amdgpu: Fix locking bugs in error paths Do not unlock psp->ras_context.mutex if it has not been locked. This has been detected by the Clang thread-safety analyzer. Cc: Alex Deucher Cc: Christian König Cc: YiPeng Chai Cc: Hawking Zhang Cc: amd-gfx@lists.freedesktop.org Fixes: b3fb79cda568 ("drm/amdgpu: add mutex to protect ras shared memory") Acked-by: Christian König Signed-off-by: Bart Van Assche Signed-off-by: Alex Deucher commit 270258ba320beb99648dceffb67e86ac76786e55 Author: Bart Van Assche Date: Mon Feb 23 14:00:07 2026 -0800 drm/amdgpu: Unlock a mutex before destroying it Mutexes must be unlocked before these are destroyed. This has been detected by the Clang thread-safety analyzer. Cc: Alex Deucher Cc: Christian König Cc: Yang Wang Cc: Hawking Zhang Cc: amd-gfx@lists.freedesktop.org Fixes: f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework") Reviewed-by: Yang Wang Acked-by: Christian König Signed-off-by: Bart Van Assche Signed-off-by: Alex Deucher commit b42dae2ebc5c84a68de63ec4ffdfec49362d53f1 Author: Natalie Vock Date: Mon Feb 23 12:45:37 2026 +0100 drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink This can be called while preemption is disabled, for example by dcn32_internal_validate_bw which is called with the FPU active. Fixes "BUG: scheduling while atomic" messages I encounter on my Navi31 machine. Signed-off-by: Natalie Vock Signed-off-by: Alex Deucher commit fcec012c664247531aed3e662f4280ff804d1476 Author: Sunil Khatri Date: Tue Feb 24 12:13:09 2026 +0530 drm/amdgpu: add upper bound check on user inputs in wait ioctl Huge input values in amdgpu_userq_wait_ioctl can lead to a OOM and could be exploited. So check these input value against AMDGPU_USERQ_MAX_HANDLES which is big enough value for genuine use cases and could potentially avoid OOM. v2: squash in Srini's fix Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit be267e15f99bc97cbe202cd556717797cdcf79a5 Author: Sunil Khatri Date: Fri Feb 20 13:47:58 2026 +0530 drm/amdgpu: add upper bound check on user inputs in signal ioctl Huge input values in amdgpu_userq_signal_ioctl can lead to a OOM and could be exploited. So check these input value against AMDGPU_USERQ_MAX_HANDLES which is big enough value for genuine use cases and could potentially avoid OOM. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 2de9353e193fd62dfa65c45890dd2f9c53f12527 Author: Tvrtko Ursulin Date: Mon Feb 23 12:41:34 2026 +0000 drm/amdgpu/userq: Use drm_gem_objects_lookup in amdgpu_userq_wait_ioctl Use the existing helper instead of open coding it Signed-off-by: Tvrtko Ursulin Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit 4ca06f6fb45da38e19e88b7dcf76b2a7e9d6a9e2 Author: Tvrtko Ursulin Date: Mon Feb 23 12:41:33 2026 +0000 drm/amdgpu/userq: Use drm_gem_objects_lookup in amdgpu_userq_signal_ioctl Use the existing helper instead of open coding it. Signed-off-by: Tvrtko Ursulin Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit cb48a6b2b61d7ebf2f1099041067800ffd8a5c2d Author: YiPeng Chai Date: Mon Feb 9 16:29:57 2026 +0800 drm/amd/ras: use dedicated memory as vf ras command buffer Use dedicated memory as vf ras command buffer. V2: Add lock to ensure serialization of sending vf ras commands. Signed-off-by: YiPeng Chai Reviewed-by: Jinzhou Su Tested-by: Jinzhou Su Signed-off-by: Alex Deucher commit bfe60e539cf7690a6739466b41fb6be250bb783e Author: Andrew Martin Date: Mon Feb 23 16:08:16 2026 -0500 drm/amdkfd: Removed commented line for MQD queue priority Missed deleting the commented line in the original patch. Fixes: 73463e26f7e2 ("drm/amdkfd: Disable MQD queue priority") Signed-off-by: Andrew Martin Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit bea29bb0dd29012949cd44fdb122465a9fd5cf91 Author: Tvrtko Ursulin Date: Mon Feb 23 12:41:32 2026 +0000 drm/amdgpu/userq: Consolidate wait ioctl exit path If we gate the fence destruction with a check telling us whether there are valid pointers in there we can eliminate the need for dual, basically identical, exit paths. Reviewed-by: Alex Deucher Signed-off-by: Tvrtko Ursulin Signed-off-by: Alex Deucher commit 2c333ea579de6cc20ea7bc50e9595ef72863e65c Author: Tvrtko Ursulin Date: Mon Feb 23 12:41:31 2026 +0000 drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings Userspace can either deliberately pass in the too small num_fences, or the required number can legitimately grow between the two calls to the userq wait ioctl. In both cases we do not want the emit the kernel warning backtrace since nothing is wrong with the kernel and userspace will simply get an errno reported back. So lets simply drop the WARN_ONs. Reviewed-by: Alex Deucher Signed-off-by: Tvrtko Ursulin Fixes: a292fdecd728 ("drm/amdgpu: Implement userqueue signal/wait IOCTL") Cc: Arunpravin Paneer Selvam Cc: Christian König Cc: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 68951e9c3e6bb22396bc42ef2359751c8315dd27 Author: Tvrtko Ursulin Date: Mon Feb 23 12:41:30 2026 +0000 drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctl Drop reference to syncobj and timeline fence when aborting the ioctl due output array being too small. Reviewed-by: Alex Deucher Signed-off-by: Tvrtko Ursulin Fixes: a292fdecd728 ("drm/amdgpu: Implement userqueue signal/wait IOCTL") Cc: Arunpravin Paneer Selvam Cc: Christian König Cc: Alex Deucher Signed-off-by: Alex Deucher commit bb375c251ab40bdbc5272008fcf2bc6cd5266610 Author: Charan Pedumuru Date: Tue Feb 24 13:32:38 2026 +0000 dt-bindings: usb: st,st-ohci-300x: convert to DT schema Convert STMicroelectronics USB OHCI Controller binding to DT schema. Signed-off-by: Charan Pedumuru Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260224-st-usb-v2-1-e8b7cb6524c6@gmail.com Signed-off-by: Greg Kroah-Hartman commit 76fc9452a6bfb63a297fa0410d5368a691ed411b Author: Xu Yang Date: Thu Feb 12 17:40:28 2026 +0800 usb: dwc3: introduce flatten model driver of i.MX Soc The i.MX USB glue and DWC3 core are closely coupled. Describe the i.MX USB block in a single block will bring more benefits than a parent- child relation. To support the flatten model devicetree, DWC3 USB core driver already support to directly register and initialize the core in glue layer using one device. And many notification can be received in glue layer timely and proper actions can be executed accordingly. To align with mainstream, introduce a new driver to support flatten dwc3 devicetree model for i.MX Soc. Besides this driver disables wakeup irq when system is active, no other function change in this version compared to dwc3-imx8mp.c. After this new driver is settled, only maintenance fixes will be added to dwc3-imx8mp.c, new features will only be added to this new driver. Once all users switch to this new one, the legacy driver will be removed at proper time. Signed-off-by: Xu Yang Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260212-add-flatten-dts-based-dwc3-imx-driver-v5-3-ff04a75ce221@nxp.com Signed-off-by: Greg Kroah-Hartman commit a717321ad7c4046eec60fa9469e1401d20071d5a Author: Xu Yang Date: Thu Feb 12 17:40:27 2026 +0800 usb: dwc3: add needs_full_reinit flag The current design assumes that the controller remains powered when wakeup is enabled. However, some SoCs provide wakeup capability even when the controller itself is powered down, using separate dedicated wakeup logic. This allows additional power savings, but requires the controller to be fully re‑initialized after system resume. To support these SoCs, introduce a flag needs_full_reinit for the purpose. And the glue layer needs to indicate if the controller needs this behavior by setting a same flag needs_full_reinit in dwc3_properties. Reviewed-by: Frank Li Signed-off-by: Xu Yang Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260212-add-flatten-dts-based-dwc3-imx-driver-v5-2-ff04a75ce221@nxp.com Signed-off-by: Greg Kroah-Hartman commit 9ac1befac36c47f419d29c96bd7ba589dfe94422 Author: Xu Yang Date: Thu Feb 12 17:40:26 2026 +0800 dt-bindings: usb: introduce nxp,imx-dwc3 The i.MX USB glue and DWC3 core are closely coupled. Describe the i.MX USB block in a single block will bring more benefits than a parent-child relation. The new binding is used to describe flattened usb controller node. It's a copy of the legacy binding fsl,imx8mp-dwc3.yaml with the needed modifications. Reviewed-by: Rob Herring (Arm) Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260212-add-flatten-dts-based-dwc3-imx-driver-v5-1-ff04a75ce221@nxp.com Signed-off-by: Greg Kroah-Hartman commit ca47d656ad6a8250a0dd2c60fb8d6c94d9cc56e1 Author: Charan Pedumuru Date: Tue Jan 27 17:42:14 2026 +0000 dt-bindings: usb: ti,dwc3: convert to DT schema Convert OMAP DWC3 USB Glue Layer binding to DT schema. Changes made during the conversion: - Drop the ti,hwmods property, as it is not used by any in-tree DTS files. Signed-off-by: Charan Pedumuru Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260127-ti-usb-v2-2-9dd6a65b43df@gmail.com Signed-off-by: Greg Kroah-Hartman commit 70fcdc82cf4a10cf1d220e036db787cd2d33e65a Author: Charan Pedumuru Date: Tue Jan 27 17:42:13 2026 +0000 dt-bindings: usb: ti,omap4-musb: convert to DT schema Convert OMAP MUSB USB OTG Controller binding to DT schema. Changes during conversion: - Include "interrupts" and "interrupt-names" properties in the YAML, as they are used by many in-tree DTS files. - Extend the "power" property to allow the value 150 (in addition to existing values), since this is present in several in-tree DTS examples. - Drop the ti,hwmods property, as it is not used by any in-tree DTS files. Signed-off-by: Charan Pedumuru Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260127-ti-usb-v2-1-9dd6a65b43df@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5c74a008ffc62fc57a041602b4517519c8bf9436 Author: Richard Fitzgerald Date: Wed Feb 25 12:56:44 2026 +0000 firmware: cs_dsp: Mark KUnit test suites KUNIT_SPEED_SLOW Most of the test suites perform a large number of test cases, so mark the suites as KUNIT_SPEED_SLOW for anyone who finds that useful. The callback test suites haven't been marked because they don't perform many test cases, and the tests are quick. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260225125644.1248826-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit b8c904a37608c9b2ef4ffa35f44a7e552454df51 Author: Bhaskar Chowdhury Date: Mon Feb 23 04:19:56 2026 +0530 Doc: dev-tools: Added Gentoo in the Operating system list under Getting Coccinelle Adding Gentoo in the operating system list under "Getting Coccinelle". Signed-off-by: Bhaskar Chowdhury Signed-off-by: Jonathan Corbet Message-ID: <20260222225536.19196-1-unixbhaskar@gmail.com> commit 9a7bf1dc886f8c6becac4af7a0c2d17db2ae66b8 Author: Daniel Pereira Date: Tue Feb 24 00:18:41 2026 -0300 docs: pt_BR: translate process/changes.rst Translate the Documentation/process/changes.rst file into Portuguese. This document provides the list of minimum software requirements necessary to compile and run the Linux kernel. Signed-off-by: Daniel Pereira Signed-off-by: Jonathan Corbet Message-ID: <20260224031842.140732-1-danielmaraboo@gmail.com> commit 4058b259b9eb6371e3a10d0fd517820b5dfa2faa Author: Pranav Kharche Date: Wed Feb 25 18:59:51 2026 +0530 docs: kernel-parameters: Fix repeated word in initramfs_options entry Remove the duplicate word 'for' in the initramfs_options description. Signed-off-by: Pranav Kharche Signed-off-by: Jonathan Corbet Message-ID: <20260225132951.36624-1-pranavkharche7@gmail.com> commit 9c1ea3962e0a24db88fd0fa3663f88416a2dacbc Author: Shuicheng Lin Date: Mon Feb 23 16:23:53 2026 +0000 drm/xe/guc: Refine CT queue checks and log formatting Fix three code-level cleanups in xe_guc_ct.c: - Use SZ_4K for the queue size alignment assertion in xe_guc_ct_queue_proc_time_jiffies(). - Drop an unused local variable in guc_ct_send_wait_for_retry(). - Add missing trailing newlines in CT error/warn log messages. These changes keep behavior unchanged while improving correctness checks and log formatting. Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260223162350.3205364-6-shuicheng.lin@intel.com Signed-off-by: Matt Roper commit 8313c938dc1a070256f07b1dbfc06cab8bd58311 Author: Shuicheng Lin Date: Mon Feb 23 16:23:52 2026 +0000 drm/xe/guc: Accumulate CT H2G retry sleep budget guc_ct_send_wait_for_retry() introduced sleep_total_ms as a budget guard, but never incremented it. As a result, the "about 1 second" bailout condition never triggers in the H2G backpressure path. Accumulate the delay returned by xe_sleep_exponential_ms() into sleep_total_ms so the timeout logic works as intended. Fixes: 943c4d0637cf ("drm/xe/guc: Limit sleep while waiting for H2G credits") Cc: Michal Wajdeczko Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260223162350.3205364-5-shuicheng.lin@intel.com Signed-off-by: Matt Roper commit d9a2a92b4209838c513f31eecc6c8bef4a107ab2 Author: Vaibhav Gupta Date: Sat Feb 21 08:11:57 2026 +0000 mtd: rawnand: cafe: Use generic power management Switch from PCI power management to the generic power management framework so the pci_driver hooks can eventually be retired. Signed-off-by: Vaibhav Gupta Reviewed-by: Bjorn Helgaas Signed-off-by: Miquel Raynal commit 4953d806a423087fcc49d4f8884fde85cd23ec1e Author: Uma Shankar Date: Mon Feb 23 22:40:15 2026 +0530 drm/xe/compat: Remove unused i915_reg.h from compat header Display Code is made independent of i915_reg.h, hence it can be dropped from compat header. Signed-off-by: Uma Shankar Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260223171015.1035550-1-uma.shankar@intel.com commit d86e70e9ca995942e848515b089e9be7430c862e Author: Frank Li Date: Fri Feb 13 12:08:25 2026 -0500 dt-bindings: mtd: mxc-nand: add i.MX25 and i.MX27 nand support Add compatible string fsl,imx25-nand and fsl,imx27-nand (over 15 years chips). Add one optional clocks for it because i.MX25 and i.MX27 upstream DTS defines them. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Frank Li Signed-off-by: Miquel Raynal commit 0c741b8b6963e584b41c284cd743c545636edb04 Author: Ahmed Naseef Date: Sat Feb 7 11:02:43 2026 +0400 mtd: nand: realtek-ecc: relax OOB size check to minimum The ECC engine strictly validates that flash OOB size equals exactly 64 bytes. However, some NAND chips have a larger physical OOB while vendor firmware only uses the first 64 bytes for the ECC layout. For example the Macronix MX35LF1G24AD found in the Netlink HG323DAC has 128 byte physical OOB but vendor firmware only uses the first 64 bytes (24 bytes free + 40 bytes BCH6 parity), leaving bytes 64-127 unused. Since the engine only operates on the first 64 bytes of OOB regardless of the physical size, change the check from exact match to minimum size. Flash with OOB >= 64 bytes works correctly with the engine's 64-byte layout. Suggested-by: Markus Stockhausen Signed-off-by: Ahmed Naseef Signed-off-by: Miquel Raynal commit 43479bb3703f17da6cdfaa2a7f4b93db9c6908bc Author: Miquel Raynal Date: Thu Feb 5 19:49:15 2026 +0100 mtd: spinand: Clean the flags section Mention that we are declaring the main SPI NAND flags with a comment. Align the values with tabs. Signed-off-by: Miquel Raynal commit 43db6366fc2de02050e66389f5628d3fdc9af10a Author: Amit Kumar Mahapatra Date: Wed Feb 4 09:32:18 2026 +0100 mtd: Add driver for concatenating devices Introducing CONFIG_MTD_VIRT_CONCAT to separate the legacy flow from the new approach, where only the concatenated partition is registered as an MTD device, while the individual partitions that form it are not registered independently, as they are typically not required by the user. CONFIG_MTD_VIRT_CONCAT is a boolean configuration option that depends on CONFIG_MTD_PARTITIONED_MASTER. When enabled, it allows flash nodes to be exposed as individual MTD devices along with the other partitions. The solution focuses on fixed-partitions description only as it depends on device boundaries. It supports multiple sets of concatenated devices, each comprising two or more partitions. flash@0 { reg = <0>; partitions { compatible = "fixed-partitions"; part0@0 { part-concat-next = <&flash0_part1>; label = "part0_0"; reg = <0x0 0x800000>; }; flash0_part1: part1@800000 { label = "part0_1"; reg = <800000 0x800000>; }; part2@1000000 { part-concat-next = <&flash1_part0>; label = "part0_2"; reg = <0x800000 0x800000>; }; }; }; flash@1 { reg = <1>; partitions { compatible = "fixed-partitions"; flash1_part0: part1@0 { label = "part1_0"; reg = <0x0 0x800000>; }; part1@800000 { label = "part1_1"; reg = <0x800000 0x800000>; }; }; }; The partitions that gets created are flash@0 part0_0-part0_1-concat flash@1 part1_1 part0_2-part1_0-concat Suggested-by: Bernhard Frauendienst Suggested-by: Miquel Raynal Signed-off-by: Amit Kumar Mahapatra Signed-off-by: Luca Ceresoli Signed-off-by: Miquel Raynal commit 59509da0cb51dc48e4edc57d7d3ef1d424c58fc9 Author: Amit Kumar Mahapatra Date: Wed Feb 4 09:32:17 2026 +0100 mtd: Move struct mtd_concat definition to header file To enable a more generic approach for concatenating MTD devices, struct mtd_concat should be accessible beyond the mtdconcat driver. Therefore, the definition is being moved to a header file. Signed-off-by: Amit Kumar Mahapatra Signed-off-by: Luca Ceresoli Signed-off-by: Miquel Raynal commit 5c543de856c463235cef0808c2b100e475fc8438 Author: Amit Kumar Mahapatra Date: Wed Feb 4 09:32:16 2026 +0100 dt-bindings: mtd: Describe MTD partitions concatenation The AMD QSPI controller supports an advanced connection modes called Stacked mode which allow the controller to treat two different flashes as one storage. In Stacked connection mode flashes share the same SPI bus, but different CS line, controller driver asserts the CS of the flash to which it needs to communicate. Stacked mode is a software abstraction rather than a controller feature or capability. At any given time, the controller communicates with one of the two connected flash devices, as determined by the requested address and data length. If an operation starts on one flash and ends on the other, the mtd layer needs to split it into two separate operations and adjust the data length accordingly. For more information on the modes please feel free to go through the controller flash interface below [1]. To support stacked mode, the existing MTD concat driver has been extended to be more generic, enabling multiple sets of MTD partitions to be virtually concatenated, with each set forming a distinct logical MTD device. A new Device Tree property is introduced to facilitate this, containing phandles of the partitions to be concatenated with the one where the property is defined. This approach supports multiple sets of concatenated partitions. [1] https://docs.amd.com/r/en-US/am011-versal-acap-trm/QSPI-Flash-Device-Interface Suggested-by: Miquel Raynal Suggested-by: Rob Herring Signed-off-by: Amit Kumar Mahapatra Reviewed-by: Rob Herring (Arm) Signed-off-by: Luca Ceresoli Signed-off-by: Miquel Raynal commit 2f0dad8baae2042482b50977fd1d215d051510df Merge: ba30a9f9beae4c a75281626fc8fa Author: Greg Kroah-Hartman Date: Wed Feb 25 07:15:08 2026 -0800 Merge branch 'staging-linus' into branch 'staging-next' There were merge conflicts in: drivers/staging/rtl8723bs/core/rtw_ieee80211.c drivers/staging/sm750fb/sm750_hw.c that were causing problems, so fix this up in here so that going forward everyone is on the same page and linux-next does not have problems. Reported-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit ba30a9f9beae4c9caf70a38859701acf24b92395 Author: Hardik Phalet Date: Tue Feb 24 18:55:07 2026 +0000 staging: greybus: audio: drop stale TODO comment Modules are removed from modules_list in gb_audio_manager_remove() and gb_audio_manager_remove_all() before kobject_put(). The TODO suggesting list deletion in the kobject release callback is stale and misleading. Signed-off-by: Hardik Phalet Link: https://patch.msgid.link/20260224185421.824210-3-hardik.phalet@pm.me Signed-off-by: Greg Kroah-Hartman commit 785fe65012d19ed0c7e504373d958581818cd963 Author: Hardik Phalet Date: Tue Feb 24 18:54:59 2026 +0000 staging: greybus: audio: remove unused gb_audio_manager_get_module() gb_audio_manager_get_module() has no in-tree callers so remove the unused function to avoid carrying dead code. Signed-off-by: Hardik Phalet Link: https://patch.msgid.link/20260224185421.824210-2-hardik.phalet@pm.me Signed-off-by: Greg Kroah-Hartman commit 0886fb23a876aa31273281f53e6d6852bf4c2820 Author: Artem Lytkin Date: Tue Feb 24 21:07:50 2026 +0300 staging: most: dim2: remove unnecessary string indirection in dev_err Replace dev_err(&pdev->dev, "%s\n", "clk_prepare_enable failed") with the direct format string dev_err(&pdev->dev, "clk_prepare_enable failed\n"). The extra level of indirection through %s is unnecessary. Signed-off-by: Artem Lytkin Link: https://patch.msgid.link/20260224180750.28468-4-iprintercanon@gmail.com Signed-off-by: Greg Kroah-Hartman commit b7a013c12504ba6468e098fab5b91011079daf57 Author: Artem Lytkin Date: Tue Feb 24 21:07:49 2026 +0300 staging: most: dim2: use dev_err_probe and proper error codes for clock Replace hardcoded -EFAULT returns with dev_err_probe() and PTR_ERR() when devm_clk_get() fails in fsl_mx6_enable(). This ensures the correct error code is propagated (e.g. -EPROBE_DEFER for deferred probing) and avoids log noise during probe deferral. Signed-off-by: Artem Lytkin Link: https://patch.msgid.link/20260224180750.28468-3-iprintercanon@gmail.com Signed-off-by: Greg Kroah-Hartman commit 24b28dc2189790810dbbc29e01759aed39dff5e3 Author: Artem Lytkin Date: Tue Feb 24 21:07:48 2026 +0300 staging: most: dim2: replace IS_ERR_OR_NULL with IS_ERR for devm_clk_get devm_clk_get() never returns NULL, so IS_ERR_OR_NULL() checks are unnecessary. Replace them with IS_ERR() for both the "mlb" and "pll8_mlb" clock lookups in fsl_mx6_enable(). Signed-off-by: Artem Lytkin Link: https://patch.msgid.link/20260224180750.28468-2-iprintercanon@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4895acd1b4306fea49ec8b7b1dcc03df8e73efbc Author: Dhyan K Prajapati Date: Wed Feb 25 14:27:47 2026 +0530 staging: rtl8723bs: fix function header alignment fixed header alignment in hal_sdio_get_cmd_addr_8723b that violated kernel coding style, cleaned the header by pulling arguments onto the same line. Signed-off-by: Dhyan K Prajapati Link: https://patch.msgid.link/20260225085747.9639-1-dhyan19022009@gmail.com Signed-off-by: Greg Kroah-Hartman commit 14c91651df343b2b66f46451c56362167fa3df3d Author: Shubham Chakraborty Date: Wed Feb 25 12:42:12 2026 +0530 staging: greybus: audio: Use sysfs_emit in show functions Refactor sprintf to sysfs_emit in all show functions of the greybus audio manager module. This follows the standard kernel practice of using sysfs_emit for sysfs attributes. Signed-off-by: Shubham Chakraborty Link: https://patch.msgid.link/20260225071212.9050-1-chakrabortyshubham66@gmail.com Signed-off-by: Greg Kroah-Hartman commit 393b267e6f04a11d4b18b7dc1423fa59f173f72b Author: Khasar Munkh-Erdene <02khasar@gmail.com> Date: Tue Feb 24 20:29:09 2026 -0700 staging: rtl8723bs: fix spacing around operators in rtw_recv.c Fix coding style issues by adding missing spaces around binary and ternary operators, as reported by checkpatch.pl. Signed-off-by: Khasar Munkh-Erdene <02khasar@gmail.com> Link: https://patch.msgid.link/20260225032909.72799-1-02khasar@gmail.com Signed-off-by: Greg Kroah-Hartman commit b0829cd6a633d1cd18d1560937dd0455bb8d4d28 Author: Jens Glathe Date: Sat Feb 14 09:32:56 2026 +0100 arm64: dts: qcom: x1-vivobook-s15: add Purwa-compatible device tree The ASUS Vivobook S15 (S5507) [1] is available with Hamoa and Purwa SoC. Add the Purwa-based device tree. [1]: https://www.asus.com/de/laptops/for-home/vivobook/asus-vivobook-s-15-s5507/techspec/ Tested-by: Colin K. Williams Reviewed-by: Konrad Dybcio Signed-off-by: Jens Glathe Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260214-b4-vivobook-v3-4-3c88065bbf77@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit da35a8931fccda7a165a2ec07f3bd48664eadaf4 Author: Jens Glathe Date: Sat Feb 14 09:32:55 2026 +0100 arm64: dts: qcom: x1-vivobook-s15: create a common dtsi for Hamoa and Purwa variants The Asus VivoBook S15 S5507QA is sold with x1e-78-100 and x1p-42-100 SKUs. Put the common part into one dtsi file to be included for model-specific dts. Include the common part in the existing Vivobook S15 device tree. Tested-by: Colin K. Williams Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Jens Glathe Tested-by: Maud Spierings Link: https://lore.kernel.org/r/20260214-b4-vivobook-v3-3-3c88065bbf77@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit 1fdbcc6d3f39a67e65d1fbdb91af43ae6b576110 Author: Jens Glathe Date: Sat Feb 14 09:32:53 2026 +0100 dt-bindings: arm: qcom: Add ASUS Vivobook X1P42100 variant The ASUS Vivobook S15 (S5507) [1] is available with Hamoa and Purwa SoC. Add the Purwa-based variant: asus,vivobook-s15-x1p4 compatible to Purwa SoC [1]: https://www.asus.com/de/laptops/for-home/vivobook/asus-vivobook-s-15-s5507/techspec/ Acked-by: Krzysztof Kozlowski Signed-off-by: Jens Glathe Link: https://lore.kernel.org/r/20260214-b4-vivobook-v3-1-3c88065bbf77@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit 26b86610650eaac17bf6574f34d9119151b95483 Author: Jens Glathe Date: Sat Feb 14 09:32:54 2026 +0100 firmware: qcom: scm: allow QSEECOM on ASUS Vivobook X1P42100 variant Enables access to EFI variables on this machine. Reviewed-by: Dmitry Baryshkov Tested-by: Colin K. Williams Signed-off-by: Jens Glathe Link: https://lore.kernel.org/r/20260214-b4-vivobook-v3-2-3c88065bbf77@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit 9bf1804229a7a768710a0462ac6ae9b28832382d Author: Nikolay Kulikov Date: Tue Feb 24 19:43:19 2026 +0300 staging: rtl8723bs: remove recurring counter increment The code: cnt += in_ie[cnt + 1] + 2; /* get next */ is in both the "if" and "else" branches. Remove this repetition, which will simplify the code and improve readability. Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260224164445.18316-1-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0c038cb19a8ac4531a144e3df9ca6fb1458627f1 Author: Gabriel Windlin Date: Tue Feb 24 17:13:19 2026 +0100 staging: rtl8723bs: remove multiple blank lines Remove multiple consecutive blank lines to adhere to the Linux kernel coding style. Issues reported by checkpatch.pl. Signed-off-by: Gabriel Windlin Link: https://patch.msgid.link/20260224161319.89187-1-gawindlin@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2e7af192697ef2a71c76fd57860b0fcd02754e14 Author: Tommaso Cucinotta Date: Fri Sep 12 07:38:29 2025 +0200 sched/deadline: Add reporting of runtime left & abs deadline to sched_getattr() for DEADLINE tasks The SCHED_DEADLINE scheduler allows reading the statically configured run-time, deadline, and period parameters through the sched_getattr() system call. However, there is no immediate way to access, from user space, the current parameters used within the scheduler: the instantaneous runtime left in the current cycle, as well as the current absolute deadline. The `flags' sched_getattr() parameter, so far mandated to contain zero, now supports the SCHED_GETATTR_FLAG_DL_DYNAMIC=1 flag, to request retrieval of the leftover runtime and absolute deadline, converted to a CLOCK_MONOTONIC reference, instead of the statically configured parameters. This feature is useful for adaptive SCHED_DEADLINE tasks that need to modify their behavior depending on whether or not there is enough runtime left in the current period, and/or what is the current absolute deadline. Notes: - before returning the instantaneous parameters, the runtime is updated; - the abs deadline is returned shifted from rq_clock() to ktime_get_ns(), in CLOCK_MONOTONIC reference; this causes multiple invocations from the same period to return values that may differ for a few ns (showing some small drift), albeit the deadline doesn't move, in rq_clock() reference; - the abs deadline value returned to user-space, as unsigned 64-bit value, can represent nearly 585 years since boot time; - setting flags=0 provides the old behavior (retrieve static parameters). See also the notes from discussion held at OSPM 2025 on the topic "Making user space aware of current deadline-scheduler parameters". Signed-off-by: Tommaso Cucinotta Signed-off-by: Peter Zijlstra (Intel) Tested-by: Matteo Martelli Link: https://patch.msgid.link/20250912053937.31636-2-tommaso.cucinotta@santannapisa.it commit 463279e5881184b608e00b335feba5411a1814e1 Merge: 7c12f6ead4672c e02902dd493bf9 Author: Mark Brown Date: Wed Feb 25 13:42:27 2026 +0000 spi: add devm_spi_new_ancillary_device() Merge series from Antoniu Miclaus : Add a devres-managed version of spi_new_ancillary_device() that automatically unregisters the ancillary SPI device when the parent device is removed. commit 230f8c9956c0069c509bf75bac6bf1a4f7b26dd8 Author: Imre Deak Date: Thu Feb 19 20:28:23 2026 +0200 drm/i915/dp_tunnel: Send BW change notification after tunnel creation Detecting a bandwidth change for a sink connected through a DP tunnel depends on updating the sink's DPRX link rate and lane count. detect_new_tunnel() -> update_tunnel_state() updates the link configuration only if the tunnel state changes. However, after the tunnel is created and bandwidth allocation mode is enabled, the tunnel state itself may remain unchanged. Record the sink bandwidth before creating the tunnel and compare it to the bandwidth after tunnel creation and enabling bandwidth allocation mode, ensuring that any bandwidth change is detected and userspace is notified accordingly. Reviewed-by: Arun R Murthy Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260219182823.926702-6-imre.deak@intel.com commit 23a5fd5bec4dc36345213cf909db4b7f6a17c669 Author: Imre Deak Date: Thu Feb 19 20:28:22 2026 +0200 drm/i915/dp_tunnel: Sanitize documentation of intel_dp_tunnel_detect() Clarify the documentation of detect_new_tunnel() return values, including the failure case. Reviewed-by: Arun R Murthy Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260219182823.926702-5-imre.deak@intel.com commit bcc7907398c84c139461b60925427955caf4db6a Author: Imre Deak Date: Thu Feb 19 20:28:21 2026 +0200 drm/i915/dp_tunnel: Split update_tunnel_state() Split update_tunnel_state() into two helpers: one that updates the tunnel state, and another that detects whether the tunnel bandwidth has changed. This prepares for a follow-up change that needs to compare the current bandwidth against the value from before the DP tunnel was detected and bandwidth allocation mode was enabled. While at it, document the return value of update_tunnel_state(). Reviewed-by: Arun R Murthy Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260219182823.926702-4-imre.deak@intel.com commit 02feab823760cf08272b12901776e117616f1047 Author: Imre Deak Date: Thu Feb 19 20:28:20 2026 +0200 drm/i915/dp_tunnel: Simplify detection of link BW change update_tunnel_state() checks whether a tunnel state change (e.g. available tunnel bandwidth) affects the list of valid modes for the sink connected through the tunnel. If so, its caller sends a hotplug event so userspace can re-enumerate the modes. A change in tunnel bandwidth does not affect the mode list if the bandwidth was above the sink's DPRX bandwidth both before and after the update, since in that case the effective bandwidth remains limited by the DPRX. As get_current_link_bw() via intel_dp_max_link_data_rate() already returns bandwidth values clamped to the DPRX limit, the condition for detecting a mode list change can be simplified to: old_bw != new_bw Remove the explicit checks for whether the bandwidth was below the maximum DPRX bandwidth before and after the update, and rely on the clamped bandwidth values instead. Reviewed-by: Arun R Murthy Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260219182823.926702-3-imre.deak@intel.com commit afe3f74716235f9c137e9850ee0027391b46b570 Author: Imre Deak Date: Thu Feb 19 20:28:19 2026 +0200 drm/i915/dp_tunnel: Don't update tunnel state during system resume During system resume, restoring the pre-suspend display state must not fail. This requires preserving the sink capabilities from before suspend, including the available link bandwidth. If these capabilities are not preserved, the restore modeset may fail, either due to a missing sink capability or insufficient link bandwidth for the restored mode. When the sink is connected through a DP tunnel, prevent such capability changes by skipping tunnel state updates during resume. This also avoids updating the sink state via the tunnel while it is being resumed. Reviewed-by: Arun R Murthy Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260219182823.926702-2-imre.deak@intel.com commit 58409f0d4dd3f9e987214064e49b088823934304 Author: Leon Romanovsky Date: Fri Feb 13 12:57:50 2026 +0200 RDMA/mlx4: Remove unused create_flags field from CQ structure The CQ creation flags do not need to be cached, as they are used immediately at the point where they are stored. Remove the unused field and reclaim 4 bytes. Link: https://patch.msgid.link/20260213-refactor-umem-v1-14-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit f45f195af521b6741d518c0fc601c735fbc42c64 Author: Leon Romanovsky Date: Fri Feb 13 12:57:49 2026 +0200 RDMA/mlx4: Introduce a modern CQ creation interface The uverbs CQ creation UAPI allows users to supply their own umem when creating a CQ. Update mlx4 to support this model while preserving compatibility with the legacy interface that allocates umem internally. Link: https://patch.msgid.link/20260213-refactor-umem-v1-13-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit 0e4b9841f4135d8066d46072b2bad81c205f0247 Author: Leon Romanovsky Date: Fri Feb 13 12:57:48 2026 +0200 RDMA/mlx4: Inline mlx4_ib_get_cq_umem into callers Inline the mlx4_ib_get_cq_umem helper function into its two call sites (mlx4_ib_create_cq and mlx4_alloc_resize_umem) to prepare for the transition to modern CQ creation interface. Link: https://patch.msgid.link/20260213-refactor-umem-v1-12-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit 14738dce7ed682e00e603ec224c54c885eb1ce6b Author: Leon Romanovsky Date: Fri Feb 13 12:57:47 2026 +0200 RDMA/mlx5: Provide a modern CQ creation interface The uverbs CQ creation UAPI allows users to supply their own umem for a CQ. Update mlx5 to support this workflow while preserving support for creating umem through the legacy interface. Link: https://patch.msgid.link/20260213-refactor-umem-v1-11-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit eebea464f548923a7d624002a04c50fd600a1cf5 Author: Leon Romanovsky Date: Fri Feb 13 12:57:46 2026 +0200 RDMA/mlx5: Save 4 bytes in CQ structure There is no need to maintain separate, nearly empty create_flags and private_flags fields. Unifying them reduces memory usage. Link: https://patch.msgid.link/20260213-refactor-umem-v1-10-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit 66011c1bd797f13124259db201ac9a430a40ba75 Author: Leon Romanovsky Date: Fri Feb 13 12:57:45 2026 +0200 RDMA/efa: Remove check for zero CQE count Since ib_core now handles validation, the device driver no longer needs to verify that the CQE count is non‑zero. Link: https://patch.msgid.link/20260213-refactor-umem-v1-9-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit a2917582887ac7c3aaccad60cb5eb876b1a83594 Author: Leon Romanovsky Date: Fri Feb 13 12:57:44 2026 +0200 RDMA/core: Reject zero CQE count All drivers already ensure that the number of CQEs is at least 1. Add this validation to the core so drivers no longer need to repeat it. Future patches converting to the .create_user_cq() interface will remove the per‑driver checks. Link: https://patch.msgid.link/20260213-refactor-umem-v1-8-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit 584ec74748e6fea9042dbd4fd516b025fbe38372 Author: Leon Romanovsky Date: Fri Feb 13 12:57:43 2026 +0200 RDMA/core: Prepare create CQ path for API unification Ensure that .create_cq_umem() and .create_cq() follow the same API contract, allowing drivers to be gradually migrated to the umem-aware CQ management flow. Link: https://patch.msgid.link/20260213-refactor-umem-v1-7-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit 2ead7b09bc92921ba4a465af5de90197b353c2c8 Author: Leon Romanovsky Date: Fri Feb 13 12:57:42 2026 +0200 RDMA/efa: Rely on CPU address in create‑QP Align this code with other locations where efa_free_mapped() depends on the presence of a valid CPU address, which is guaranteed when qp->rq_size != 0. Link: https://patch.msgid.link/20260213-refactor-umem-v1-6-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit 25c741048891c4d3fc627cd5220e2cae4bab42a1 Author: Leon Romanovsky Date: Fri Feb 13 12:57:41 2026 +0200 RDMA/core: Manage CQ umem in core code In the current implementation, CQ umem is handled both by ib_core and the driver. ib_core sometimes creates and destroys it, while the driver also destroys it. Store the umem in struct ib_cq and ensure that only ib_core manages its lifetime, relying solely on its internal reference counter. Link: https://patch.msgid.link/20260213-refactor-umem-v1-5-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit a731c8626507d2df0b34a572719e3e6efcf10530 Author: Leon Romanovsky Date: Fri Feb 13 12:57:40 2026 +0200 RDMA/core: Promote UMEM to a core component To manage UMEM objects at the core level and reuse the existing ib_destroy_cq*() flow, move the UMEM files to be built together with ib_core. Attempting to call ib_umem_release() from verbs.c currently results in the following error: depmod: ERROR: Cycle detected: ib_core -> ib_uverbs -> ib_core depmod: ERROR: Found 2 modules in dependency cycles! verbs.c:(.text+0x250c): undefined reference to `ib_umem_release' Link: https://patch.msgid.link/20260213-refactor-umem-v1-4-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit e3104fe9217b08c12df8041c50d11df1159ef330 Author: Leon Romanovsky Date: Fri Feb 13 12:57:39 2026 +0200 RDMA/umem: Remove unnecessary includes and defines from ib_umem header The ib_umem header no longer requires the removed includes or forward declarations, so drop them to reduce clutter. Link: https://patch.msgid.link/20260213-refactor-umem-v1-3-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit 2ae3c4f6eae911946d0971f377fd00543d2a933e Author: Leon Romanovsky Date: Fri Feb 13 12:57:38 2026 +0200 RDMA/umem: Allow including ib_umem header from any location Including ib_umem.h currently triggers circular dependency errors. These issues can be resolved by removing the include of ib_verbs.h, which was only needed to resolve the struct ib_device pointer. >> depmod: ERROR: Cycle detected: ib_core -> ib_uverbs -> ib_core >> depmod: ERROR: Found 2 modules in dependency cycles! make[3]: *** [scripts/Makefile.modinst:132: depmod] Error 1 make[3]: Target '__modinst' not remade because of errors. make[2]: *** [Makefile:1960: modules_install] Error 2 make[1]: *** [Makefile:248: __sub-make] Error 2 make[1]: Target 'modules_install' not remade because of errors. make: *** [Makefile:248: __sub-make] Error 2 make: Target 'modules_install' not remade because of errors. Link: https://patch.msgid.link/20260213-refactor-umem-v1-2-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit 6094ea64c69520ed1e770e7c79c43412de202bfa Author: Leon Romanovsky Date: Fri Feb 13 12:57:37 2026 +0200 RDMA: Move DMA block iterator logic into dedicated files The DMA iterator logic was mixed into verbs and umem-specific code, forcing all users to include rdma/ib_umem.h. Move the block iterator logic into iter.c and rdma/iter.h so that rdma/ib_umem.h and rdma/ib_verbs.h can be separated in a follow-up patch. Link: https://patch.msgid.link/20260213-refactor-umem-v1-1-f3be85847922@nvidia.com Signed-off-by: Leon Romanovsky commit 13665885b14d907ebd7527a19c90e530e86c6bf0 Author: Vinod Govindapillai Date: Fri Feb 20 19:09:08 2026 +0200 drm/i915/fbdev: print info about stolen memory preference for fbdev If stolen memory cannot be allocated for the fbdev because of the preference for fbc, have an info about that in the log. v2: log text changed Signed-off-by: Vinod Govindapillai Reviewed-by: Uma Shankar Acked-by: Mika Kahola Link: https://patch.msgid.link/20260220170908.201422-7-vinod.govindapillai@intel.com commit 83f757346dda2c94f9adb64ad8ee431a128f08ac Author: Vinod Govindapillai Date: Fri Feb 20 19:09:07 2026 +0200 drm/xe/fbdev: print info about stolen memory preference for fbdev If stolen memory cannot be allocated for the fbdev and initial plane bo because of the preference for fbc, have an info about that in the log. v2: log text changed Signed-off-by: Vinod Govindapillai Reviewed-by: Uma Shankar Acked-by: Mika Kahola Link: https://patch.msgid.link/20260220170908.201422-6-vinod.govindapillai@intel.com commit 27c56f73c3af03bb057fc1f0f99684deb2741fe0 Author: Ville Syrjälä Date: Fri Feb 20 19:09:06 2026 +0200 drm/xe/fbdev: Extract intel_fbdev_fb_prefer_stolen() Pull the "should we keep the bios fb in stolen?" logic into into a helper function, same as was done for i915. Gives us a single place where to tweak the heuristics. v2: changes related to rebase and consolidated other conditions for the stolen preference into this single function (Vinod) v3: avoid including intel_display_core.h (Jani Nikula) Signed-off-by: Ville Syrjälä Signed-off-by: Vinod Govindapillai Reviewed-by: Uma Shankar Acked-by: Mika Kahola Link: https://patch.msgid.link/20260220170908.201422-5-vinod.govindapillai@intel.com commit 94c7d286129268ead0fb76d684fe4363d57da415 Author: Ville Syrjälä Date: Fri Feb 20 19:09:05 2026 +0200 drm/i915/fbdev: Extract intel_fbdev_fb_prefer_stolen() Consolidate the "should we allocate fbdev fb in stolen?" check into a helper function. Makes it easier to change the heuristics without having to change so many places. v2: rebase related changes and consolidate all the prefer stolen conditions into a single function (Vinod) v3: avoid including intel_display_core.h (Jani) Signed-off-by: Ville Syrjälä Signed-off-by: Vinod Govindapillai Reviewed-by: Uma Shankar Acked-by: Mika Kahola Link: https://patch.msgid.link/20260220170908.201422-4-vinod.govindapillai@intel.com commit 26a3e4bffcbb6ad7fbe56fc9060ebaa88c3d7e62 Author: Vinod Govindapillai Date: Fri Feb 20 19:09:04 2026 +0200 drm/i915/display: remove the usage of dev_priv Remove the remaining usage of dev_priv in intel_fbdev_fb.c and use i915 instead. Signed-off-by: Vinod Govindapillai Reviewed-by: Mika Kahola Link: https://patch.msgid.link/20260220170908.201422-3-vinod.govindapillai@intel.com commit dfd1d2f7eb3956e3646ac33595e093b1b7fdaa1f Author: Ville Syrjälä Date: Fri Feb 20 19:09:03 2026 +0200 drm/xe/fbdev: Fix BIOS FB vs. stolen size check Looks like stolen->size is in bytes, not pages. Remove the bogus PAGE_SHIFT stuff. Also for some random reason xe rejects the FB if it takes up exactly half of stolen, whereas i915 allows it to be used in that case. Adjust xe to follow the i915 rule for consistency. v2: rebase related updates Signed-off-by: Ville Syrjälä Signed-off-by: Vinod Govindapillai Reviewed-by: Uma Shankar Acked-by: Mika Kahola Link: https://patch.msgid.link/20260220170908.201422-2-vinod.govindapillai@intel.com commit 260c3fff1fefc570d8f23e87953e181d7d248861 Author: Richard Fitzgerald Date: Wed Feb 25 11:23:39 2026 +0000 ASoC: cs-amp-lib-test: Stop including platform_device.h commit d1965f008f22 ("ASoC: cs-amp-lib-test: Use faux bus instead of creating a dummy platform device") replaced all use of platform device with faux_bus but forgot to remove the header include. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260225112339.1179585-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 61af3f6ed058a455c4868d6b5baa4ddcbf6a2fe9 Merge: 70bbd833986ae6 ada32396f90951 Author: Mark Brown Date: Wed Feb 25 11:58:04 2026 +0000 ASoC: SDCA: Initial support for Cirrus Logic CS47L47 Merge series from Richard Fitzgerald : The CS47L47 is a SDCA smart codec with UAJ (headset, jack detect) and DMIC. This series adds the initial support for the Cirrus Logic CS47L47 codec. commit f09812b85fa6f41058bcc46e70ac406bf9b0493a Merge: 24e2e6581d602f 6de23f81a5e08b Author: Jani Nikula Date: Wed Feb 25 13:23:04 2026 +0200 Merge drm/drm-next into drm-intel-next Sync with v7.0-rc1 which contains a few treewide changes affecting i915. Signed-off-by: Jani Nikula commit d1fc91be263d0af025684c1b57ff812c1e75a2da Author: Yonatan Nachum Date: Tue Feb 17 11:23:04 2026 +0000 RDMA/efa: Use extended inline buff size for inline validation On QP creation we validate the requested max inline size is supported by the device. Use the new extended max inline size instead of the old one to support actual max inline available. Reviewed-by: Michael Margolin Signed-off-by: Yonatan Nachum Link: https://patch.msgid.link/20260217112304.36849-4-ynachum@amazon.com Signed-off-by: Leon Romanovsky commit e736a223ab150689b639a60c70a9490d884971ad Author: Yonatan Nachum Date: Tue Feb 17 11:23:03 2026 +0000 RDMA/efa: Expose new extended max inline buff size Add new extended max inline query and report the new value to userspace. Reviewed-by: Firas Jahjah Reviewed-by: Michael Margolin Signed-off-by: Yonatan Nachum Link: https://patch.msgid.link/20260217112304.36849-3-ynachum@amazon.com Signed-off-by: Leon Romanovsky commit 6b8d5a0cdb19610177ddb4f4ebe848a241e7e4eb Author: Yonatan Nachum Date: Tue Feb 17 11:23:02 2026 +0000 RDMA/efa: Rename admin queue attributes struct name for extendability As preparation for adding a second queue attributes query, change the name of the existing queue attributes. Reviewed-by: Michael Margolin Signed-off-by: Yonatan Nachum Link: https://patch.msgid.link/20260217112304.36849-2-ynachum@amazon.com Signed-off-by: Leon Romanovsky commit eef33a7cce239783d0422526a4d786289a936f1b Author: Leo Yan Date: Mon Feb 9 12:44:40 2026 +0000 coresight: Unify bus unregistration via coresight_unregister() Once a device is successfully registered, set the "registered" flag to true. After that point, all failures jump to the out_unlock label to unwind the flow via coresight_unregister(). Since failure handling is unified, the comment about resource release for the etm_perf_add_symlink_sink() failure is no need, remove it. Signed-off-by: Leo Yan Reviewed-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260209-arm_coresight_refactor_dev_register-v4-8-62d6042f76f7@arm.com commit 8573756b235ddfa005837a958241caf204696a0a Author: Leo Yan Date: Mon Feb 9 12:44:39 2026 +0000 coresight: Do not mix success path with failure handling Separate the failure handling path from the successful case. Use the 'out_unlock' label only for failure handling. Reviewed-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260209-arm_coresight_refactor_dev_register-v4-7-62d6042f76f7@arm.com commit 6b1ffc542850e5dd1c71394f6205582a9c8ad9c8 Author: Leo Yan Date: Mon Feb 9 12:44:38 2026 +0000 coresight: Move sink validation into etm_perf_add_symlink_sink() Move the sink device type checks into etm_perf_add_symlink_sink(), and return -EOPNOTSUPP for unsupported devices. This simplifies the registration flow to invoke etm_perf_add_symlink_sink() unconditionally. Reviewed-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260209-arm_coresight_refactor_dev_register-v4-6-62d6042f76f7@arm.com commit babb987968d3610f8953f24b26154bf03c169811 Author: Leo Yan Date: Mon Feb 9 12:44:37 2026 +0000 coresight: Refactor sysfs connection group cleanup Move the sysfs connection group cleanup into coresight_remove_conns(), so that the driver removes connections and related sysfs resources in one go. As side effect, the csdev argument to coresight_release_platform_data() is no longer needed; adjust the code for this. Reviewed-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260209-arm_coresight_refactor_dev_register-v4-5-62d6042f76f7@arm.com commit 32c225491ed8dc90c9ba4a8d07f064133d52a179 Author: Leo Yan Date: Mon Feb 9 12:44:36 2026 +0000 coresight: Refactor output connection sysfs link cleanup To use a central place for releasing connections, move the output connection sysfs link cleanup into coresight_remove_conns(). Also update the comments accordingly. Reviewed-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260209-arm_coresight_refactor_dev_register-v4-4-62d6042f76f7@arm.com commit a6c4da4b95a3cfe4f6031bef2d913331dc186142 Author: Leo Yan Date: Mon Feb 9 12:44:35 2026 +0000 coresight: Protect unregistration with mutex The device registration is protected by CoreSight mutex to ensure the atomic operations when adding a device onto bus. One the other hand, the locking is absent when unregister a device. Use mutex to ensure atomicity on device unregistration. During unregistration, unbinding the associated CTI device is not included in the locking region, as CTI has its own locking mechanism. Fixes: 8c1d3f79d9ca ("coresight: core: Fix coresight device probe failure issue") Reviewed-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260209-arm_coresight_refactor_dev_register-v4-3-62d6042f76f7@arm.com commit 2f322f0392814a1b704e14927d282f4b2edb9e98 Author: Leo Yan Date: Mon Feb 9 12:44:34 2026 +0000 coresight: Get parent device reference after sink ID map allocation The parent device's reference count is incremented before allocating the sink ID map. If the allocation fails, the reference count is not decremented, preventing proper cleanup. Fix this by incrementing the reference count only after the sink ID map is successfully allocated. Fixes: 5ad628a76176 ("coresight: Use per-sink trace ID maps for Perf sessions") Reviewed-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260209-arm_coresight_refactor_dev_register-v4-2-62d6042f76f7@arm.com commit 0289ada4a31661016a0611a41a4886bb958e9985 Author: Leo Yan Date: Mon Feb 9 12:44:33 2026 +0000 coresight: Fix memory leak in coresight_alloc_device_name() The memory leak detector reports: echo clear > /sys/kernel/debug/kmemleak modprobe coresight_funnel rmmod coresight_funnel # Scan memory leak and report it echo scan > /sys/kernel/debug/kmemleak cat /sys/kernel/debug/kmemleak unreferenced object 0xffff0008020c7200 (size 64): comm "modprobe", pid 410, jiffies 4295333721 hex dump (first 32 bytes): d8 da fe 7e 09 00 ff ff e8 2e ff 7e 09 00 ff ff ...~.......~.... b0 6c ff 7e 09 00 ff ff 30 83 00 7f 09 00 ff ff .l.~....0....... backtrace (crc 4116a690): kmemleak_alloc+0xd8/0xf8 __kmalloc_node_track_caller_noprof+0x2c8/0x6f0 krealloc_node_align_noprof+0x13c/0x2c8 coresight_alloc_device_name+0xe4/0x158 [coresight] 0xffffd327ecef8394 0xffffd327ecef85ec amba_probe+0x118/0x1c8 really_probe+0xc8/0x3f0 __driver_probe_device+0x88/0x190 driver_probe_device+0x44/0x120 __driver_attach+0x100/0x238 bus_for_each_dev+0x84/0xf0 driver_attach+0x2c/0x40 bus_add_driver+0x128/0x258 driver_register+0x64/0x138 __amba_driver_register+0x2c/0x48 The memory leak is caused by not freeing the device list that maintains device indices. This device list preserves stable device indices across unbind and rebind device operations, so it does not share the same lifetime as a device instances and must only be freed when the module is unloaded. Some modules do not implement a module exit callback because they are registered using module_platform_driver(). As a result, the device list cannot be released during module exit for those modules. Fix this by moving the device list into the core layer. As a general solution, instead of maintaining a static list in each driver, drivers now allocate device lists via coresight_allocate_device_list() and device indices via coresight_allocate_device_idx(). The list is released only when the core module is unloaded by calling coresight_release_device_list(), avoiding the leak. Fixes: 0f5f9b6ba9e1 ("coresight: Use platform agnostic names") Reviewed-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260209-arm_coresight_refactor_dev_register-v4-1-62d6042f76f7@arm.com commit 6c5883a9ba296d2797437066592d15b2d202de7a Author: Khairul Anuar Romli Date: Mon Feb 2 14:02:17 2026 +0800 dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis checkpatch.pl --strict reports a CHECK warning in dw-axi-dmac-platform.c: CHECK: Alignment should match open parenthesis This warning occurs when multi-line function calls or expressions have continuation lines that don't properly align with the opening parenthesis position. This patch fixes all instances in dw-axi-dmac-platform.c where continuation lines were indented with an inconsistent number of spaces/tabs that neither matched the parenthesis column nor followed a standard indent pattern. Proper alignment improves code readability and maintainability by making parameter lists visually consistent across the kernel codebase. Fixes: 1fe20f1b8454 ("dmaengine: Introduce DW AXI DMAC driver") Fixes: e32634f466a9 ("dma: dw-axi-dmac: support per channel interrupt") Signed-off-by: Khairul Anuar Romli Link: https://patch.msgid.link/20260202060224.12616-2-karom.9560@gmail.com Signed-off-by: Vinod Koul commit ff7cbcca2b32c6e079941e577c41c74036861d5a Author: Khairul Anuar Romli Date: Sat Jan 31 11:28:56 2026 -0600 dt-bindings: dma: snps,dw-axi-dmac: add dma-coherent property The Synopsys DesignWare AXI DMA Controller on Agilex5, the controller operates on a cache-coherent AXI interface, where DMA transactions are automatically kept coherent with the CPU caches. In previous generations SoC (Stratix10 and Agilex) the interconnect was non-coherent, hence there is no need for dma-coherent property to be presence. In Agilex 5, the architecture has changed. It introduced a coherent interconnect that supports cache-coherent DMA. Signed-off-by: Khairul Anuar Romli Reviewed-by: Rob Herring (Arm) Signed-off-by: Dinh Nguyen Link: https://patch.msgid.link/20260131172856.29227-1-dinguyen@kernel.org Signed-off-by: Vinod Koul commit e45cf0c7d9b960f1aae4ee56c3c3d46549ccde86 Author: Biju Das Date: Tue Feb 3 10:30:09 2026 +0000 dt-bindings: dma: rz-dmac: Document RZ/G3L SoC Document the Renesas RZ/G3L DMAC block. This is identical to the one found on the RZ/G3S SoC. Reviewed-by: Fabrizio Castro Acked-by: Conor Dooley Signed-off-by: Biju Das Link: https://patch.msgid.link/20260203103031.247435-2-biju.das.jz@bp.renesas.com Signed-off-by: Vinod Koul commit d9d5e1bdd18074ea27985c777ddc3a8a0b007468 Author: Koichiro Den Date: Mon Feb 16 00:22:16 2026 +0900 dmaengine: dw-edma: Add virtual IRQ for interrupt-emulation doorbells Interrupt emulation can assert the dw-edma IRQ line without updating the DONE/ABORT bits. With the shared read/write/common IRQ handlers, the driver cannot reliably distinguish such an emulated interrupt from a real one and leaving a level IRQ asserted may wedge the line. Allocate a dedicated, requestable Linux virtual IRQ (db_irq) for interrupt emulation and attach an irq_chip whose .irq_ack runs the core-specific deassert sequence (.ack_emulated_irq()). The physical dw-edma interrupt handlers raise this virtual IRQ via generic_handle_irq(), ensuring emulated IRQs are always deasserted. Export the virtual IRQ number (db_irq) and the doorbell register offset (db_offset) via struct dw_edma_chip so platform users can expose interrupt emulation as a doorbell. Without this, a single interrupt-emulation write can leave the level IRQ line asserted and cause the generic IRQ layer to disable it. Signed-off-by: Koichiro Den Reviewed-by: Frank Li Link: https://patch.msgid.link/20260215152216.3393561-3-den@valinux.co.jp Signed-off-by: Vinod Koul commit 2e8726879559144b4582fa059780e452b3a1ad41 Author: Koichiro Den Date: Mon Feb 16 00:22:15 2026 +0900 dmaengine: dw-edma: Add interrupt-emulation hooks DesignWare eDMA instances support "interrupt emulation", where a software write can assert the IRQ line without setting the normal DONE/ABORT status bits. Introduce core callbacks needed to support this feature: - .ack_emulated_irq(): core-specific sequence to deassert an emulated IRQ - .db_offset(): offset from the DMA register base that is suitable as a host-writable doorbell target for interrupt emulation Implement both hooks for the v0 register map. For dw-hdma-v0, provide a stub .db_offset() returning ~0 until the correct offset is known. The next patch wires these hooks into the dw-edma IRQ path and exports the doorbell resources to platform users. Signed-off-by: Koichiro Den Reviewed-by: Frank Li Link: https://patch.msgid.link/20260215152216.3393561-2-den@valinux.co.jp Signed-off-by: Vinod Koul commit 490c367b5fbcba6bb653077312c8ef477adf79b5 Author: Zhen Ni Date: Tue Oct 14 10:47:30 2025 +0800 dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() clk_disable_unprepare() is safe to call with a NULL clk, the FSL_EDMA_DRV_HAS_CHCLK check is reduntante. Clean up redundant checks. Suggested-by: Frank Li Signed-off-by: Zhen Ni Reviewed-by: Frank Li Link: https://patch.msgid.link/20251014024730.751237-1-zhen.ni@easystack.cn Signed-off-by: Vinod Koul commit 55bf8be6f4a80d44c7f10e9d39b583e9645edf93 Author: Leo Yan Date: Tue Feb 24 10:56:14 2026 +0000 coresight: cti: Move resource release to cti_remove() Currently, CTI driver releases resource by deferring cti_device_release() to the device unregistration: cti_remove() `> coresight_unregister() `> cti_remove_assoc_from_csdev() `> device_unregister() `> cti_device_release() `> mutex_lock(&ect_mutex) `> release CTI resource `> mutex_unlock(&ect_mutex) In the above flow, two different CTI release callbacks are involved: cti_remove_assoc_from_csdev() and cti_device_release(). The former is used by a CoreSight device to unbind its associated CTI helper device, while the latter releases resources for the CTI device itself. Since there is no dependency between them, it is unnecessary to defer the CTI resource release until device unregistration. This commit releases the resources directly in cti_remove() and remove the injected release callback. Signed-off-by: Leo Yan Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260224-arm_coresight_refactor_cti_resource_release-v1-1-ff1b2bca9176@arm.com commit 2622649ad6cdbb3e77bfafc8c0fe686090b77f70 Author: Matthew Brost Date: Tue Feb 24 10:39:22 2026 -0800 dma-buf: Assign separate lockdep class to array lock dma_fence_array_enable_signaling() runs while holding the array inline_lock and may add callbacks to underlying fences, which takes their inline_lock. Since both locks share the same lockdep class, this valid nesting triggers a recursive locking warning. Assign a distinct lockdep class to the array inline_lock so lockdep can correctly model the hierarchy. Fixes: 5943243914b9 ("dma-buf: use inline lock for the dma-fence-array") Cc: Christian König Cc: Tvrtko Ursulin Cc: Philipp Stanner Cc: Boris Brezillon Signed-off-by: Matthew Brost Reviewed-by: Christian König Link: https://patch.msgid.link/20260224183922.2256492-2-matthew.brost@intel.com commit 2ec86535555c0e748443c1f07087c088b645a9d5 Author: Matthew Brost Date: Tue Feb 24 10:39:21 2026 -0800 dma-buf: Assign separate lockdep class to chain lock dma_fence_chain_enable_signaling() and runs while holding the chain inline_lock and may add callbacks to underlying fences, which takes their inline_lock. Since both locks share the same lockdep class, this valid nesting triggers a recursive locking warning. Assign a distinct lockdep class to the chain inline_lock so lockdep can correctly model the hierarchy. Fixes: a408c0ca0c41 ("dma-buf: use inline lock for the dma-fence-chain") Cc: Christian König Cc: Tvrtko Ursulin Cc: Philipp Stanner Cc: Boris Brezillon Signed-off-by: Matthew Brost Reviewed-by: Christian König Link: https://patch.msgid.link/20260224183922.2256492-1-matthew.brost@intel.com commit 4b8fc2b17272d4379f3c80cee2d6d8b7d998fa8f Author: Richard Fitzgerald Date: Mon Feb 23 15:02:54 2026 +0000 soundwire: intel_auxdevice: Add CS47L47 to wake_capable_list The Cirrus Logic CS47L47 codec can generate Jack events so add it to the wake-capable list. Signed-off-by: Richard Fitzgerald Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260223150256.326143-2-rf@opensource.cirrus.com Signed-off-by: Vinod Koul commit de67b4ea168f01dac24e328aab6be0802a5c96f6 Author: Charles Keepax Date: Mon Feb 23 09:20:48 2026 +0000 soundwire: slave: Don't register devices that are disabled in ACPI If a piece of hardware is disabled in ACPI it shouldn't be added to the bus. Add code to handle this similar to other buses like SPI/I2C. Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260223092048.3695135-1-ckeepax@opensource.cirrus.com Signed-off-by: Vinod Koul commit 55f1d6a9d6780e779e882a4d2d1b3db311835798 Author: Thomas Weißschuh Date: Mon Feb 23 22:40:14 2026 +0100 tools/nolibc: rename my_syscallX() to __nolibc_syscallX() The naming convention of the my_syscallX() macros is a bit unfortunate. They may conflict with application code and the name is very generic. Switch to __nolibc_syscallX(). The leading underscores place the symbols in the implementation-defined namespace, avoiding conflicting names. It is also clearer that these are non-standard extensions from nolibc. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://patch.msgid.link/20260223-nolibc-namespacing-v1-1-52574ffebb2c@weissschuh.net commit 46a9d97069cab311738c950d0fcef85a459c7b8f Author: Damien Le Moal Date: Tue Feb 24 11:06:38 2026 +0900 ata: libata-eh: avoid unnecessary calls to ata_scsi_port_error_handler() When handling SCSI command timeouts, if we had no actual command timeouts (either because the command was a deferred qc or the completion path won the race with ata_scsi_cmd_error_handler()), we do not need to go through a port error handling, as there was in fact no errors at all. Modify ata_scsi_cmd_error_handler() to return the number of commands that timed out and use this return value in ata_scsi_error() to call ata_scsi_port_error_handler() only if we had command timeouts, or if the port EH has already been scheduled due to failed commands. Otherwise, simply call scsi_eh_flush_done_q() to finish the completed commands without running the full port error handling. Signed-off-by: Damien Le Moal Reviewed-by: Martin K. Petersen Reviewed-by: Niklas Cassel Signed-off-by: Niklas Cassel commit 3d8fd28d056a6f191763061b05564d46110bbea9 Author: Ryan Wanner Date: Thu Dec 18 09:35:21 2025 +0530 drm: atmel-hlcdc: add LCD controller layer definition for sama7d65 Add the LCD controller layer definition and atmel_hlcdc_of_match entry for sama7d65. Signed-off-by: Ryan Wanner Acked-by: Nicolas Ferre Link: https://patch.msgid.link/20251218040521.463937-3-manikandan.m@microchip.com Signed-off-by: Manikandan Muralidharan commit 5ccfabc0a5ad631312d815b2c46de70ad5e7715a Author: Yijie Yang Date: Wed Jan 14 12:30:43 2026 +0800 arm64: dts: qcom: merge duplicate references to pmc8380_3_gpios Merge the two identical references to the pmc8380_3_gpios node to improve clarity and remove redundancy. Signed-off-by: Yijie Yang Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260114-hamoa-v1-1-c96ab354924c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit db24f1fa263fdb473a23af461f82b4bc97af28b1 Author: Dmitry Baryshkov Date: Tue Nov 11 18:02:52 2025 +0200 arm64: dts: qcom: add apq8096sg-db820c, AP8096SG variant of DB820c There has been a (rare) variant of Dragonboard 820c, utilizing Pro version of the SoC, with the major difference being CPU and GPU clock tables. Add a DT file representing this version of the board. 01:13:26.275: B - 417880 - 8996 Pro v1.x detected, Max frequency = 1.8 GHz Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251111-db820c-pro-v1-2-6eece16c5c23@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 2d2b7e724e4ad69055553f3c48cd45fb644f3689 Author: Dmitry Baryshkov Date: Tue Nov 11 18:02:51 2025 +0200 dt-bindings: arm: qcom: add Dragonboard 820c using APQ8096SG SoC There exists a variant of the DB820c board, using the APQ8096SG (MSM8996 Pro) SoC. Describe it in the bindings. Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20251111-db820c-pro-v1-1-6eece16c5c23@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b99deb6157a13098223f551570c8d11545def0f4 Author: Luca Ceresoli Date: Wed Feb 11 22:39:49 2026 +0100 drm/bridge: imx8qxp-pixel-link: get/put the next bridge This driver obtains a bridge pointer from of_drm_find_bridge() in the probe function and stores it until driver removal. of_drm_find_bridge() is deprecated, so move to of_drm_find_and_get_bridge() for the bridge to be refcounted and use bridge->next_bridge to put the reference on deallocation. To keep the code as simple and reliable as possible remove the intermediate next_bridge and selected_bridge variables. Get/put operations on the remaining pointer is pl->bridge.next_bridge, which is tied to the struct imx8qxp_pixel_link lifetime, are: - get reference when assigned (by of_drm_find_and_get_bridge()) - put reference before reassignment if reassignment happens - put reference when the struct imx8qxp_pixel_link embedding the struct drm_bridge is destroyed (struct drm_bridge::next_bridge) Signed-off-by: Luca Ceresoli Acked-by: Liu Ying Signed-off-by: Liu Ying Link: https://lore.kernel.org/r/20260211-drm-bridge-alloc-getput-drm_of_find_bridge-v6-1-651ddfd13bdb@bootlin.com commit d2adf01780b8957b31f4954d56646b02de956f65 Author: Rosen Penev Date: Mon Feb 23 17:41:41 2026 -0800 net: freescale: ucc_geth: call of_node_put once Move it up to avoid placing it in both the error and success paths. Signed-off-by: Rosen Penev Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260224014141.352642-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski commit 7235555e9af67be72bd5ef3f8a28416b93ce2a64 Merge: 6c32b07650676a 6e4dff20021ad2 Author: Jakub Kicinski Date: Tue Feb 24 18:25:32 2026 -0800 Merge branch 'selftests-net-py-improve-bkg-error-reporting' Jakub Kicinski says: ==================== selftests: net: py: improve bkg() error reporting bkg() is a helper for running commands in the background. When init or body of a with() block fails check if the bkg() process already exited and report its status (including stdout/ /stderr). This significantly improves debugability. ==================== Link: https://patch.msgid.link/20260223202633.4126087-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6e4dff20021ad280bc9c8e047239707da7689431 Author: Jakub Kicinski Date: Mon Feb 23 12:26:33 2026 -0800 selftests: net: py: add cmd info for ksft_wait failure Gal recently complained: When [ksft_wait failure] happens, the test fails with a cryptic message: # Exception| Exception: Did not receive ready message Let's try to include the stdout/stderr of the command we tried to start. E.g. for cmd("false", ksft_wait=True): # Exception| lib.py.utils.CmdInitFailure: Did not receive ready message # Exception| CMD: false # Exception| EXIT: 1 We need to factor out _process_terminate() otherwise the exit path may try to write to already disconnected self.ksft_term_fd. Reviewed-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260223202633.4126087-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 04abab18e1205a9e2037fb95f334b80cf74f89c9 Author: Jakub Kicinski Date: Mon Feb 23 12:26:32 2026 -0800 selftests: net: py: use repr(cmd) for failure exceptions Reuse repr(cmd) instead of manually formatting a similar string. Before: # Exception| lib.py.utils.CmdExitFailure: Command failed: false # Exception| STDOUT: b'' # Exception| STDERR: b'' After: # Exception| lib.py.utils.CmdExitFailure: Command failed # Exception| CMD: false # Exception| EXIT: 1 Reviewed-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260223202633.4126087-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d99aa5912c3af4c0f84738d9471836f068d73d69 Author: Jakub Kicinski Date: Mon Feb 23 12:26:31 2026 -0800 selftests: net: py: avoid masking exceptions in bkg() failures bkg() failures are currently quite hard to debug and spot. Often we have code along the lines of: with bkg("./cmd_rx_something -p PORT"): wait_port_listen(PORT) cmd("./cmd_tx_something", host=remote) When wait_port_listen() fails we don't get to see the exit status of bkg(). Even tho very often it's a failure in the bkg() command that's actually to blame. Try not to interfere with the bkg() command error checking. With: with bkg("false", exit_wait=True): time.sleep(0.01) # let the 'false' cmd run raise Exception("bla") Before: .. stack trace .. # Exception| Exception: bla After: .. stack trace .. # Exception| Exception: bla # Exception| # Exception| During handling of the above exception, another exception occurred: .. stack trace .. # Exception| lib.py.utils.CmdExitFailure: Command failed: false # Exception| STDOUT: b'' # Exception| STDERR: b'' Reviewed-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260223202633.4126087-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6c32b07650676ab4c112ff8e9d345b6770ae2be5 Author: Jakub Kicinski Date: Mon Feb 23 12:37:01 2026 -0800 eth: bnxt: rename ring_err_stats -> ring_drv_stats We recently added GRO stats to bnxt, which are maintained by the driver. Having "err" in the name of the struct for ring stats no longer makes sense (as pointed out by Michael, see Link). Rename them to "drv" stats, as these are all maintained by the driver (even if partially based on info from descriptors). Michael suggested calling these misc, happy to go back to that. IMHO "drv" is a bit more meaningful that "misc". Pure rename using sed, no functional changes. Link: https://lore.kernel.org/CACKFLimgibJ0qkM1AacZVh8MKKy-pE_AAc4KPKZ7GUqebmXW9A@mail.gmail.com Reviewed-by: Michael Chan Link: https://patch.msgid.link/20260223203702.4137801-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit fc1f97929ada9e923c3b0c70a999469eeb0b9f94 Author: Kuniyuki Iwashima Date: Mon Feb 23 23:07:18 2026 +0000 bonding: Optimise is_netpoll_tx_blocked(). bond_start_xmit() spends some cycles in is_netpoll_tx_blocked(): if (unlikely(is_netpoll_tx_blocked(dev))) return NETDEV_TX_BUSY; because of the "pushf;pop reg" sequence (aka irqs_disabled()). Let's swap the conditions in is_netpoll_tx_blocked() and convert netpoll_block_tx to a static key. Before: 1.23 │ mov %gs:0x28,%rax 1.24 │ mov %rax,0x18(%rsp) 29.45 │ pushfq 0.50 │ pop %rax 0.47 │ test $0x200,%eax │ ↓ je 1b4 0.49 │ 32: lea 0x980(%rsi),%rbx After: 0.72 │ mov %gs:0x28,%rax 0.81 │ mov %rax,0x18(%rsp) 0.82 │ nop 2.77 │ 2a: lea 0x980(%rsi),%rbx Suggested-by: Eric Dumazet Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260223230749.2376145-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 64db5933c7adcdc4dd8f5ef6506cc998ecbe63ac Author: Eric Dumazet Date: Mon Feb 23 16:17:42 2026 +0000 icmp: increase net.ipv4.icmp_msgs_{per_sec,burst} These sysctls were added in 4cdf507d5452 ("icmp: add a global rate limitation") and their default values might be too small. Some network tools send probes to closed UDP ports from many hosts to estimate proportion of packet drops on a particular target. This patch sets both sysctls to 10000. Note the per-peer rate-limit (as described in RFC 4443 2.4 (f)) intent is still enforced. This also increases security, see b38e7819cae9 ("icmp: randomize the global rate limiter") for reference. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260223161742.929830-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 539a6cf0844da56c32513b86305a7327760f9932 Author: Eric Dumazet Date: Mon Feb 23 15:30:47 2026 +0000 tcp: move inet6_csk_update_pmtu() to tcp_ipv6.c This function is only called from tcp_v6_mtu_reduced() and can be (auto)inlined by the compiler. Note that inet6_csk_route_socket() is no longer (auto)inlined, which is a good thing as it is slow path. $ scripts/bloat-o-meter -t vmlinux.0 vmlinux.1 add/remove: 0/2 grow/shrink: 2/0 up/down: 93/-129 (-36) Function old new delta tcp_v6_mtu_reduced 139 228 +89 inet6_csk_route_socket 486 490 +4 __pfx_inet6_csk_update_pmtu 16 - -16 inet6_csk_update_pmtu 113 - -113 Total: Before=25076512, After=25076476, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260223153047.886683-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit fca59a2dd0b8ce55ad090707ec425d6d37b8b932 Author: Eric Dumazet Date: Mon Feb 23 11:35:01 2026 +0000 tcp: reduce calls to tcp_schedule_loss_probe() For RPC workloads, we alternate tcp_schedule_loss_probe() calls from output path and from input path, with tp->packets_out value oscillating between !zero and zero, leading to poor branch prediction. Move tp->packets_out check from tcp_schedule_loss_probe() to tcp_set_xmit_timer(). We avoid one call to tcp_schedule_loss_probe() from tcp_ack() path for typical RPC workloads, while improving branch prediction. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260223113501.4070245-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a09eb622f383e6ceff7d55072cba4d4b8234d5d5 Merge: 583706230ea4d5 9192320a65b7b1 Author: Jakub Kicinski Date: Tue Feb 24 17:43:25 2026 -0800 Merge branch 'net-stmmac-qcom-ethqos-cleanups-and-re-organise-serdes-handling' Russell King says: ==================== net: stmmac: qcom-ethqos: cleanups and re-organise SerDes handling As the last series had issues with stability, I've changed the approach in this series to concentrate on keeping much of the SerDes related code within the qcom-ethqos driver rather than trying to move it out at this stage. This means it should be possible to bisect these patches and pinpoint exactly the code movement that causes any instability. This series starts with various cleanups to qcom-ethqos (the first four patches) before beginning to move code, passing phylink's phy interface (which will change) to the fix_mac_speed() method, and then using that to configure the serdes and inband setting before moving the SerDes code. This patch set has been tested. ==================== Link: https://patch.msgid.link/aZwfAFJQcp9f0niI@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9192320a65b7b1496fa9d39f7207d6d1fca48b06 Author: Russell King (Oracle) Date: Mon Feb 23 09:35:01 2026 +0000 net: stmmac: qcom-ethqos: convert to set_clk_tx_rate() method Set the RGMII link clock using the set_clk_tx_rate() method rather than coding it into the .fix_mac_speed() method. This simplifies ethqos's ethqos_fix_mac_speed(). Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vuSLF-0000000ASci-42kh@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit fb42f19e671f831bab406d795664f98e1242d478 Author: Russell King (Oracle) Date: Mon Feb 23 09:34:56 2026 +0000 net: stmmac: qcom-ethqos: move SerDes speed configuration Move the SerDes speed configuration to phylink's .mac_finish() stage so that the SerDes is appropriately configured for the interface mode prior to the link coming up. Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vuSLA-0000000AScc-3RFf@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b8ab32315e22c0ef2c466d4f5ef4de0b5852e735 Author: Russell King (Oracle) Date: Mon Feb 23 09:34:51 2026 +0000 net: stmmac: qcom-ethqos: use phy interface mode for inband qcom-ethqos currently forces inband to be enabled for the Cisco SGMII speeds (1G, 100M and 10M) but not for 2500BASE-X (2.5G). Rather than using the speed to determine the forced inband state, use phylink's PHY interface mode which will switch between SGMII for the 10M, 100M and 1G speeds, and 2500BASE-X for 2.5G. Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vuSL5-0000000AScX-2wuM@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b560938163db801d5ba27fa55a1aa68ccaf1ef2e Author: Russell King (Oracle) Date: Mon Feb 23 09:34:46 2026 +0000 net: stmmac: qcom-ethqos: pass phy interface mode to configs Pass the current phylink phy interface mode to the RGMII and "SGMII" configuration functions. Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vuSL0-0000000AScM-2TN0@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit cd0aa651535092afd5d776bfe94e4fdf750f89c3 Author: Russell King (Oracle) Date: Mon Feb 23 09:34:41 2026 +0000 net: stmmac: pass interface mode into fix_mac_speed() method Pass the current interface mode reported by phylink into the fix_mac_speed() method. This will be used by qcom-ethqos for its "SGMII" configuration. Reviewed-by: Maxime Chevallier Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vuSKv-0000000AScG-1zv6@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 834c72ca306cf4c8dc84b39447fee316c9f868ab Author: Russell King (Oracle) Date: Mon Feb 23 09:34:36 2026 +0000 net: stmmac: qcom-ethqos: move loopback disable to .mac_finish() Loopback is enabled to allow the dwmac soft reset to succeed. This is enabled when clocks are enabled in ethqos_clks_config(), which happens at driver probe and runtime PM resume - e.g. when the network device is administratively brought up. Currently, the loopback is disabled when the link comes up (via .mac_link_up() calling this driver's .fix_mac_speed().) Move the qcom_ethqos_set_sgmii_loopback() call which disables loopback from ethqos_fix_mac_speed() into ethqos' SerDes specific .mac_finish() method so that loopback is disabled a little earlier after reset has completed, and dwmac setup has completed. Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vuSKq-0000000AScA-1Wh3@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3baa791f19be6a4701047fa23058e84fe4ccc1c4 Author: Russell King (Oracle) Date: Mon Feb 23 09:34:31 2026 +0000 net: stmmac: qcom-ethqos: move qcom_ethqos_set_sgmii_loopback() up ethqos_set_func_clk_en() configures both SGMII loopback and the RGMII functional clock setting. qcom_ethqos_set_sgmii_loopback() is only called from within ethqos_set_func_clk_en(), and checks for PHY_INTERFACE_MODE_2500BASEX. Move qcom_ethqos_set_sgmii_loopback() to the callers of ethqos_set_func_clk_en() except for ethqos_configure_rgmii() where we know that ethqos->phy_mode will not be PHY_INTERFACE_MODE_2500BASEX. Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vuSKl-0000000ASc1-18ka@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 649a00c3926fd3a52fc59bc52769ddb94a746bf8 Author: Russell King (Oracle) Date: Mon Feb 23 09:34:26 2026 +0000 net: stmmac: qcom-ethqos: change ethqos_configure*() to return void The ethqos_configure*() family of functions always return zero, and the return value is never checked. Change the int return type to void. Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vuSKg-0000000ASbv-0iWL@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e6f43a41ba6206b691c8e9a301f0b4528b8f2278 Author: Russell King (Oracle) Date: Mon Feb 23 09:34:20 2026 +0000 net: stmmac: qcom-ethqos: remove register field value obfuscations Convert the register field values to something more human readable. For example, using (BIT(29) | BIT(27)) to update a register field that consists of bits 29:27 is an obfuscated way of writing decimal 5 for this field. The comment above needs to explain that this value is 5. Worse still is BIT(12) | GENMASK(9, 8), which is used to hide the decimal value 19 for the bitfield 16:8. Fix these, and a few others by using FIELD_PREP(). While it means we have bare numeric constants, this is more preferable than having the obfuscation. Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vuSKa-0000000ASbo-2zQg@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ebfc2be12ec599e3504ad2c1eaa9fc5892c94c9d Author: Russell King (Oracle) Date: Mon Feb 23 09:34:15 2026 +0000 net: stmmac: qcom-ethqos: rename "por" members to "rgmii_por" Rename the "por" and "num_por" members to indicate that they are for RGMII mode only as ethqos_configure_rgmii() is the only place that the values are programmed into the registers. Reviewed-by: Mohd Ayaan Anwar Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vuSKV-0000000ASbg-28JK@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 583706230ea4d5f7f88563cd63056220a5f48c73 Merge: 3197cce4d48c1e 426f1f5b8752d6 Author: Jakub Kicinski Date: Tue Feb 24 17:20:13 2026 -0800 Merge branch 'net-ethernet-enic-add-vic-ids-and-link-modes' Satish Kharat says: ==================== eth: enic: add VIC ids and link modes Add VIC subsystem ids and their supported/advertised media types so ethtool reflects the hardware capabilities for the VIC variants. ==================== Link: https://patch.msgid.link/20260223-enic-cscwi36355-v2-0-63488194a974@cisco.com Signed-off-by: Jakub Kicinski commit 426f1f5b8752d68e729fb65a00795a0f919b47d1 Author: Satish Kharat Date: Mon Feb 23 02:27:21 2026 -0800 net:ethernet:enic: map ethtool link modes by VIC type Report supported media types based on the VIC subsystem ID so ethtool reflects the hardware capabilities. Signed-off-by: Satish Kharat Link: https://patch.msgid.link/20260223-enic-cscwi36355-v2-2-63488194a974@cisco.com Signed-off-by: Jakub Kicinski commit 472e079f8c9013057fe57e7ec1eb16fe695fc2d3 Author: Satish Kharat Date: Mon Feb 23 02:27:20 2026 -0800 net:ethernet:enic: add VIC subsystem ids Add VIC subsystem id for 12xx, 13xx, 14xx and 15xxx series Signed-off-by: Satish Kharat Link: https://patch.msgid.link/20260223-enic-cscwi36355-v2-1-63488194a974@cisco.com Signed-off-by: Jakub Kicinski commit 3197cce4d48c1e5f159f8f24a4e3b9bd83385c14 Author: Gabriel Goller Date: Mon Feb 23 11:12:54 2026 +0100 docs: net: document neigh gc_stale_time sysctl Add missing documentation for a neighbor table garbage collector sysctl parameter in ip-sysctl.rst: neigh/default/gc_stale_time: controls how long an unused neighbor entry is kept before becoming eligible for garbage collection (default: 60 seconds) Signed-off-by: Gabriel Goller Link: https://patch.msgid.link/20260223101257.47563-1-g.goller@proxmox.com Signed-off-by: Jakub Kicinski commit 54ef3e6bbeb2b66ddefebc2155bbea6f32ea0bbb Merge: f033335937d6f7 fcd3d039fab693 Author: Jakub Kicinski Date: Tue Feb 24 17:16:18 2026 -0800 Merge branch 'tcp-rework-tcp_v-4-6-_send_check' Eric Dumazet says: ==================== tcp: rework tcp_v{4,6}_send_check() tcp_v{4,6}_send_check() are only called from __tcp_transmit_skb() They currently are in different files (tcp_ipv4.c and tcp_ipv6.c) thus out of line. This series move them close to their caller so that compiler can inline them. For all patches in the series: $ scripts/bloat-o-meter -t vmlinux.0 vmlinux.3 add/remove: 0/2 grow/shrink: 1/3 up/down: 102/-178 (-76) Function old new delta __tcp_transmit_skb 3321 3423 +102 tcp_v4_send_check 136 132 -4 __tcp_v4_send_check 130 121 -9 mptcp_subflow_init 777 763 -14 __pfx_tcp_v6_send_check 16 - -16 tcp_v6_send_check 135 - -135 Total: Before=25143100, After=25143024, chg -0.00% ==================== Link: https://patch.msgid.link/20260223100729.3761597-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit fcd3d039fab693df3d41ac9bcb12fb4e8ddd69fe Author: Eric Dumazet Date: Mon Feb 23 10:07:29 2026 +0000 tcp: make tcp_v{4,6}_send_check() static tcp_v{4,6}_send_check() are only called from tcp_output.c and should be made static so that the compiler does not need to put an out of line copy of them. Remove (struct inet_connection_sock_af_ops) send_check field and use instead @net_header_len. Move @net_header_len close to @queue_xmit for data locality as both are used in TCP tx fast path. $ scripts/bloat-o-meter -t vmlinux.2 vmlinux.3 add/remove: 0/2 grow/shrink: 0/3 up/down: 0/-172 (-172) Function old new delta __tcp_transmit_skb 3426 3423 -3 tcp_v4_send_check 136 132 -4 mptcp_subflow_init 777 763 -14 __pfx_tcp_v6_send_check 16 - -16 tcp_v6_send_check 135 - -135 Total: Before=25143196, After=25143024, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260223100729.3761597-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 255688652b8c439eb35c68ec5cdac4aa63737d35 Author: Eric Dumazet Date: Mon Feb 23 10:07:28 2026 +0000 tcp: move tcp_v6_send_check() to tcp_output.c Move tcp_v6_send_check() so that __tcp_transmit_skb() can inline it. $ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2 add/remove: 0/0 grow/shrink: 1/0 up/down: 105/0 (105) Function old new delta __tcp_transmit_skb 3321 3426 +105 Total: Before=25143091, After=25143196, chg +0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260223100729.3761597-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit bd5e5e1d41d316c47dd9001104b62033992daf6e Author: Eric Dumazet Date: Mon Feb 23 10:07:27 2026 +0000 tcp: inline __tcp_v4_send_check() Inline __tcp_v4_send_check(), like __tcp_v6_send_check(). Move tcp_v4_send_check() to tcp_output.c close to its fast path caller (__tcp_transmit_skb()). Note __tcp_v4_send_check() is still out-of-line for tcp4_gso_segment() because it is called in an unlikely() section. $ scripts/bloat-o-meter -t vmlinux.0 vmlinux.1 add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-9 (-9) Function old new delta __tcp_v4_send_check 130 121 -9 Total: Before=25143100, After=25143091, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260223100729.3761597-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit f620af11c27b8ec9994a39fe968aa778112d1566 Author: Maciej Fijalkowski Date: Wed Feb 18 16:00:00 2026 +0100 xsk: avoid double checking against rx queue being full Currently non-zc xsk rx path for multi-buffer case checks twice if xsk rx queue has enough space for producing descriptors: 1. if (xskq_prod_nb_free(xs->rx, num_desc) < num_desc) { xs->rx_queue_full++; return -ENOBUFS; } 2. __xsk_rcv_zc(xs, xskb, copied - meta_len, rem ? XDP_PKT_CONTD : 0); -> err = xskq_prod_reserve_desc(xs->rx, addr, len, flags); -> if (xskq_prod_is_full(q)) Second part is redundant as in 1. we already peeked onto rx queue and checked that there is enough space to produce given amount of descriptors. Provide helper functions that will skip it and therefore optimize code. Signed-off-by: Maciej Fijalkowski Acked-by: Stanislav Fomichev Reviewed-by: Jason Xing Link: https://lore.kernel.org/r/20260218150000.301176-1-maciej.fijalkowski@intel.com Signed-off-by: Alexei Starovoitov commit 8ebfe65e22d5016c0ef2f7b5831117202493f794 Author: Hari Bathini Date: Mon Feb 16 14:38:02 2026 +0530 selftests/bpf: Test accounting of tail calls when prog is NULL Test whether tail call count is incorrectly accounted for, when the tail call fails due to a missing BPF program. Signed-off-by: Hari Bathini Reviewed-by: Ilya Leoshkevich Tested-by: Venkat Rao Bagalkote Link: https://lore.kernel.org/r/20260216090802.1805655-1-hbathini@linux.ibm.com Signed-off-by: Alexei Starovoitov commit f033335937d6f72a13bb38d82422eef30da31972 Author: Eric Dumazet Date: Mon Feb 23 09:34:45 2026 +0000 udp: move udp6_csum_init() back to net/ipv6/udp.c This function has a single caller in net/ipv6/udp.c. Move it there so that the compiler can decide to (auto)inline it if he prefers to. IBT glue is removed anyway. With clang, we can see it was able to inline it and also inlined one other helper at the same time. UDPLITE removal will also help. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/2 grow/shrink: 1/0 up/down: 840/-785 (55) Function old new delta __udp6_lib_rcv 1247 2087 +840 __pfx_udp6_csum_init 16 - -16 udp6_csum_init 769 - -769 Total: Before=25074399, After=25074454, chg +0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260223093445.3696368-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2550def53bbf2323894265e0e64363998bf9e5c3 Author: Eric Dumazet Date: Mon Feb 23 09:27:15 2026 +0000 net: __lock_sock() can be static After commit 6511882cdd82 ("mptcp: allocate fwd memory separately on the rx and tx path") __lock_sock() can be static again. Make sure __lock_sock() is not inlined, so that lock_sock_nested() no longer needs a stack canary. Add a noinline attribute on lock_sock_nested() so that calls to lock_sock() from net/core/sock.c are not inlined, none of them are fast path to deserve that: - sockopt_lock_sock() - sock_set_reuseport() - sock_set_reuseaddr() - sock_set_mark() - sock_set_keepalive() - sock_no_linger() - sock_bindtoindex() - sk_wait_data() - sock_set_rcvbuf() $ scripts/bloat-o-meter -t vmlinux.old vmlinux add/remove: 0/0 grow/shrink: 0/3 up/down: 0/-312 (-312) Function old new delta __lock_sock 192 188 -4 __lock_sock_fast 239 86 -153 lock_sock_nested 227 72 -155 Total: Before=24888707, After=24888395, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260223092716.3673939-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4a49fe23e357b48845e31fe9c28a802c05458198 Author: Alexandre Courbot Date: Tue Feb 17 11:45:55 2026 +0900 gpu: nova-core: use core library's CStr instead of kernel one The kernel's own CStr type has been replaced by the one in the core library, and is now an alias to the latter. Change our imports to directly reference the actual type. Reviewed-by: Lyude Paul Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260217-nova-misc-v3-7-b4e2d45eafbc@nvidia.com [acourbot@nvidia.com: remove unneeded imports reorganization in firmware/gsp.rs] Signed-off-by: Alexandre Courbot commit 8e10d462e66db8b4702a8bd40642b214599270ba Author: Alexandre Courbot Date: Tue Feb 17 11:45:54 2026 +0900 gpu: nova-core: gsp: derive Zeroable for GspStaticConfigInfo We can now derive `Zeroable` on tuple structs, so do this instead of providing our own implementation. Reviewed-by: Lyude Paul Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260217-nova-misc-v3-6-b4e2d45eafbc@nvidia.com Signed-off-by: Alexandre Courbot commit f86226d3c67b72ae1908f82776dcc7f259e42ff6 Author: Alexandre Courbot Date: Tue Feb 17 11:45:53 2026 +0900 gpu: nova-core: gsp: derive `Debug` on more sequencer types Being able to print these is useful when debugging the sequencer. Reviewed-by: Lyude Paul Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260217-nova-misc-v3-5-b4e2d45eafbc@nvidia.com Signed-off-by: Alexandre Courbot commit 953278c19d3496b8b0848d60b80485db42782d72 Author: Alexandre Courbot Date: Tue Feb 17 11:45:52 2026 +0900 gpu: nova-core: gsp: remove unneeded sequencer trait The `GspSeqCmdRunner` trait is never used as we never call the `run` methods from generic code. Remove it. Reviewed-by: Lyude Paul Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260217-nova-misc-v3-4-b4e2d45eafbc@nvidia.com Signed-off-by: Alexandre Courbot commit 4503e61a625c1afff6d3f3e2a2e357a4007cc5c0 Author: Alexandre Courbot Date: Tue Feb 17 11:45:51 2026 +0900 gpu: nova-core: gsp: simplify sequencer opcode parsing The opcodes are already the right type in the C union, so we can use them directly instead of converting them to a byte stream and back again using `FromBytes`. Reviewed-by: Lyude Paul Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260217-nova-misc-v3-3-b4e2d45eafbc@nvidia.com Signed-off-by: Alexandre Courbot commit 3614290d75a4853a74ac501a64f1a4916c99bfe6 Author: Alexandre Courbot Date: Tue Feb 17 11:45:50 2026 +0900 gpu: nova-core: gsp: remove unnecessary Display impls We only ever display these in debug context, for which the automatically derived `Debug` impls work just fine - so use them and remove these boilerplate-looking implementations. Reviewed-by: Lyude Paul Reviewed-by: Alistair Popple Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260217-nova-misc-v3-2-b4e2d45eafbc@nvidia.com Signed-off-by: Alexandre Courbot commit b45b9f2668b723f8117a3585d75d01e93281aa38 Author: Alexandre Courbot Date: Tue Feb 17 11:45:49 2026 +0900 gpu: nova-core: gsp: warn if data remains after processing a message Not processing the whole data from a received message is a strong indicator of a bug - emit a warning when such cases are detected. Reviewed-by: Lyude Paul Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20260217-nova-misc-v3-1-b4e2d45eafbc@nvidia.com Signed-off-by: Alexandre Courbot commit 5cdbed3ad782700d6381bf5901e3f61c4d8b28bc Author: Eliot Courtney Date: Thu Jan 29 16:45:03 2026 +0900 gpu: nova-core: gsp: fix improper indexing in driver_read_area The current code indexes into `after_rx` using `tx` which is an index for the whole buffer, not the split buffer `after_rx`. Also add more rigorous no-panic proofs. Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling") Signed-off-by: Eliot Courtney Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260129-nova-core-cmdq1-v3-5-2ede85493a27@nvidia.com Signed-off-by: Alexandre Courbot commit f64caf673cb5add9ac2065609a52049e2317c498 Author: Eliot Courtney Date: Thu Jan 29 16:45:02 2026 +0900 gpu: nova-core: gsp: fix improper handling of empty slot in cmdq The current code hands out buffers that go all the way up to and including `rx - 1`, but we need to maintain an empty slot to prevent the ring buffer from wrapping around into having 'tx == rx', which means empty. Also add more rigorous no-panic proofs. Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling") Signed-off-by: Eliot Courtney Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260129-nova-core-cmdq1-v3-4-2ede85493a27@nvidia.com Signed-off-by: Alexandre Courbot commit f6f072d8ef06ff5d29a6bb1bade3da29a1aafeec Author: Eliot Courtney Date: Thu Jan 29 16:45:01 2026 +0900 gpu: nova-core: gsp: use empty slices instead of [0..0] ranges The current code unnecessarily uses, for example, &before_rx[0..0] to return an empty slice. Instead, just use an empty slice. Signed-off-by: Eliot Courtney Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260129-nova-core-cmdq1-v3-3-2ede85493a27@nvidia.com Signed-off-by: Alexandre Courbot commit bbe6831c02d8a381d0858382597b0bea3252fd6a Author: Eliot Courtney Date: Thu Jan 29 16:45:00 2026 +0900 gpu: nova-core: gsp: clarify comments about invariants and pointer roles Disambiguate a few things in comments in cmdq.rs. Signed-off-by: Eliot Courtney Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260129-nova-core-cmdq1-v3-2-2ede85493a27@nvidia.com Signed-off-by: Alexandre Courbot commit 9045ae2afc7b7cd51a98d7d773529b56572a4b1b Author: Eliot Courtney Date: Thu Jan 29 16:44:59 2026 +0900 gpu: nova-core: gsp: fix incorrect advancing of write pointer We should modulo not bitwise-and here. The current code could, for example, set wptr to MSGQ_NUM_PAGES which is not valid. Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling") Signed-off-by: Eliot Courtney Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260129-nova-core-cmdq1-v3-1-2ede85493a27@nvidia.com Signed-off-by: Alexandre Courbot commit 4bef417ea46cbc701500b1b92b962586ec6e0900 Author: Joel Fernandes Date: Mon Jan 26 15:23:05 2026 -0500 gpu: nova-core: use checked arithmetic in RISC-V firmware parsing Use checked_add() when computing offsets from firmware-provided values in the RISC-V firmware parsing code. These values come from the BinHdr structure parsed from the firmware file header. Reviewed-by: Zhi Wang Signed-off-by: Joel Fernandes Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260126202305.2526618-6-joelagnelf@nvidia.com Signed-off-by: Alexandre Courbot commit 35ae4e58a7c0edd7249a0bcd0d2c151afc185bc2 Author: Joel Fernandes Date: Mon Jan 26 15:23:04 2026 -0500 gpu: nova-core: use checked arithmetic in BinFirmware::data Use checked_add() when computing the firmware data end offset in the BinFirmware::data() method. The data_offset and data_size fields come from the BinHdr structure parsed from the firmware file header. Reviewed-by: Zhi Wang Signed-off-by: Joel Fernandes Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260126202305.2526618-5-joelagnelf@nvidia.com Signed-off-by: Alexandre Courbot commit 457c70b7dde5c14f940664fdc7f0e1998aff56be Author: Joel Fernandes Date: Mon Jan 26 15:23:03 2026 -0500 gpu: nova-core: use checked arithmetic in frombytes_at helper Use checked_add() when computing the end offset in the frombytes_at() helper function. This function is called with firmware-provided offsets. Reviewed-by: Zhi Wang Signed-off-by: Joel Fernandes Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260126202305.2526618-4-joelagnelf@nvidia.com Signed-off-by: Alexandre Courbot commit 4f2609685418cc995ff6a2d558ed62214dec75dc Author: Joel Fernandes Date: Mon Jan 26 15:23:02 2026 -0500 gpu: nova-core: use checked arithmetic in Booter signature parsing Use checked_add() when computing signature offsets from firmware- provided values in signatures_iter(). Without checked arithmetic, overflow could wrap to a small plausible offset that points to entirely wrong data. Reviewed-by: Zhi Wang Signed-off-by: Joel Fernandes Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260126202305.2526618-3-joelagnelf@nvidia.com [acourbot@nvidia.com: remove obvious computation comments.] Signed-off-by: Alexandre Courbot commit 0568b376a0b13da6582bce1f2e2bbb2eae7fc266 Author: Joel Fernandes Date: Mon Jan 26 15:23:01 2026 -0500 gpu: nova-core: use checked arithmetic in FWSEC firmware parsing Use checked_add() and checked_mul() when computing offsets from firmware-provided values in new_fwsec(). Without checked arithmetic, corrupt firmware could cause integer overflow. The danger is not just wrapping to a huge value, but potentially wrapping to a small plausible offset that passes validation yet accesses entirely wrong data, causing silent corruption or security issues. Reviewed-by: Zhi Wang Signed-off-by: Joel Fernandes Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260126202305.2526618-2-joelagnelf@nvidia.com [acourbot@nvidia.com: rewrap commit message to make checkpatch happy.] [acourbot@nvidia.com: add missing empty lines after new code blocks.] [acourbot@nvidia.com: move SAFETY comments to the unsafe statement they describe.] [acourbot@nvidia.com: remove obvious computation comments and use `CALC:` for the remaining ones.] Signed-off-by: Alexandre Courbot commit 399c6e3385a79e0e93837b504ad58477c22db841 Author: Luke Wang Date: Tue Feb 3 19:23:09 2026 +0800 arm64: dts: imx93-11x11-evk: change usdhc tuning step for eMMC and SD During system resume, the following errors occurred: [ 430.638625] mmc1: error -84 writing Cache Enable bit [ 430.643618] mmc1: error -84 doing runtime resume For eMMC and SD, there are two tuning pass windows and the gap between those two windows may only have one cell. If tuning step > 1, the gap may just be skipped and host assumes those two windows as a continuous windows. This will cause a wrong delay cell near the gap to be selected. Set the tuning step to 1 to avoid selecting the wrong delay cell. For SDIO, the gap is sufficiently large, so the default tuning step does not cause this issue. Fixes: e37907bd8294 ("arm64: dts: freescale: add i.MX93 11x11 EVK basic support") Signed-off-by: Luke Wang Reviewed-by: Frank Li Signed-off-by: Frank Li commit 5ab0c76df2403137a6d0fb27a55e03cedf47f44c Author: Luke Wang Date: Tue Feb 3 19:23:10 2026 +0800 arm64: dts: imx91-11x11-evk: change usdhc tuning step for eMMC and SD During system resume, the following errors occurred: [ 430.638625] mmc1: error -84 writing Cache Enable bit [ 430.643618] mmc1: error -84 doing runtime resume For eMMC and SD, there are two tuning pass windows and the gap between those two windows may only have one cell. If tuning step > 1, the gap may just be skipped and host assumes those two windows as a continuous windows. This will cause a wrong delay cell near the gap to be selected. Set the tuning step to 1 to avoid selecting the wrong delay cell. For SDIO, the gap is sufficiently large, so the default tuning step does not cause this issue. Fixes: 6772c4cffd87 ("arm64: dts: freescale: add i.MX91 11x11 EVK basic support") Signed-off-by: Luke Wang Reviewed-by: Frank Li Signed-off-by: Frank Li commit c89b50cc6b9f3df4e21e5b9c10dcdfe830200c72 Author: Ihor Solodrai Date: Tue Feb 24 13:12:02 2026 -0800 selftests/bpf: Fix flakiness of task_local_storage/sys_enter_exit The test_sys_enter_exit test was setting target_pid before attaching the BPF programs, which causes syscalls made during the attach phase to be counted. This is flaky because, apparently, there is no guarantee that both on_enter and on_exit will trigger during the attachment. Move the target_pid assignment to after task_local_storage__attach() so that only explicit sys_gettid() calls are counted. Reported-by: BPF CI Bot (Claude Opus 4.6) Closes: https://github.com/kernel-patches/vmtest/issues/448 Signed-off-by: Ihor Solodrai Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260224211202.214325-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 1046bc7b416814833a43af8e66c52b0ea71c2021 Author: Matt Roper Date: Mon Feb 23 16:11:33 2026 -0800 drm/xe/xe2_hpg: Drop invalid workaround Wa_15010599737 Wa_15010599737 was a workaround originally proposed (and ultimately rejected) for DG2-G10. There's no record of it ever being relevant or even considered for any other platforms. The specific bit this workaround was setting is documented as "This bit should be set to 1 for the DX9 API and 0 for all other APIs" which means that it should almost always be left at the default value of 0 on Linux. The register itself is directly accessible from userspace, so in the special cases where it might be relevant (e.g., Wine/Proton running Windows DX9 apps), the userspace drivers already have the ability to change the setting without involvement of the kernel. Fixes: 7f3ee7d88058 ("drm/xe/xe2hpg: Add initial GT workarounds") Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260223-forupstream-wa_cleanup-v3-2-7f201eb2f172@intel.com Signed-off-by: Matt Roper commit ef547cf1b823ee73c52bd2fedfc77b99a17198e9 Author: Matt Roper Date: Mon Feb 23 16:11:32 2026 -0800 drm/xe: Consolidate workaround entries for Wa_18041344222 Wa_18041344222 applies to all graphics versions from 20.01 through 30.00 (inclusive). Consolidate the RTP entries into a single range-based entry. v2: - Drop the FUNC(xe_rtp_match_not_sriov_vf) to align with commit a800b95c2498 ("drm/xe/xe2hpg: Remove SRIOV VF check for Wa_18041344222") and commit 0ffe9dcf260b ("drm/xe/xe3: Remove SRIOV VF check for Wa_18041344222") which just landed. (Shuicheng) Cc: Shuicheng Lin Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260223-forupstream-wa_cleanup-v3-1-7f201eb2f172@intel.com Signed-off-by: Matt Roper commit be4b91d9aae51cfbc1d80f899c0f8aad081fc711 Author: Markus Heidelberg Date: Mon Feb 23 12:12:03 2026 +0100 docs: dt: unittest: update to current unittest filenames There have been several renamings and modified Make rules since introduction of this unittest document. The file list in the Chinese translation had been extended. For a change to drivers/of/unittest-data/tests-*.dtsi surrounding translation has to be updated. Signed-off-by: Markus Heidelberg Link: https://patch.msgid.link/20260223111207.54640-1-m.heidelberg@cab.de Signed-off-by: Rob Herring (Arm) commit 0220405d7e09955195164292d3938a0bcbdd6924 Author: Krzysztof Kozlowski Date: Mon Feb 23 08:44:23 2026 +0100 dt-bindings: arm: cpus: Deprecate Qualcomm generic compatibles Move compatibles for Qualcomm Kryo and Oryon custom CPU cores out of the enum into separate one with deprecated: true annotation, because these are too generic names. These are names of the families and there are significant differences within individual processors, e.g. Kryo6xx can based on architectures from Cortex-X2, A710, A510 to A78 and probably more. Just like other vendor processors are differentiated, also Qualcomm CPUs should come with specific compatibles. Cc: Bjorn Andersson Cc: Konrad Dybcio Cc: linux-arm-msm@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Link: https://patch.msgid.link/20260223074422.18468-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 4048cdc0655b9d79d8d7475859de186e3f592027 Author: Sherry Sun Date: Wed Feb 4 16:35:47 2026 +0800 dt-bindings: arm: fsl: Add i.MX93 Wireless EVK board Add DT compatible string for NXP i.MX93 Wireless EVK board. i.MX93 Wireless SiP is created by integrating i.MX93 and IW610 WLCSP (Wi-Fi + BLE + 802.15.4). And i.MX93 Wireless EVK board with the i.MX93 Wireless SiP basically reuse the i.MX93 11x11 EVK board, with some minor functional and pin connection differences. Signed-off-by: Sherry Sun Acked-by: Krzysztof Kozlowski Signed-off-by: Frank Li commit 26279c8d5ede072e8fad9b2f14b03fc27888f471 Author: Shengjiu Wang Date: Mon Jan 26 17:11:56 2026 +0800 bus: imx-aipstz: set default value for opacr registers The sdma script app_2_mcu needs the permission to access the peripheral devices: 1) SDMA2 transactions are set to user-mode in this particular case. 2) This type of script doesn't use the peripheral interface (connected directly to SPBA), but it uses the peripheral DMA interface, then the SDMA2-issued transactions are subjected to AIPSTZ5's security-related checks. So need to clear the Supervisor Protect bit of SPBA2, otherwise the sdma script can't work. As the imx-aipstz is a common driver for all aips bus, so set default value (zero) for all opacr registers. Signed-off-by: Shengjiu Wang Reviewed-by: Laurentiu Mihalcea Reviewed-by: Daniel Baluta Reviewed-by: Frank Li Signed-off-by: Frank Li commit 28e99f8bc651636e74c1dab259e92c3264f9dc51 Author: Stefano Radaelli Date: Mon Jan 19 19:35:53 2026 +0100 dt-bindings: arm: fsl: add Variscite DART-MX95 Boards Add DT compatible strings for Variscite DART-MX95 SoM and Variscite development carrier Board. Link: https://variscite.com/system-on-module-som/i-mx-9/dart-mx95/ Link: https://variscite.com/carrier-boards/sonata-board/ Acked-by: Krzysztof Kozlowski Signed-off-by: Stefano Radaelli Signed-off-by: Frank Li commit 3feaa4342637eef673243dd38ccb32e8dc8efd5a Author: Liu Ying Date: Thu Jan 15 16:24:51 2026 +0100 dt-bindings: soc: imx93-media-blk-ctrl: Add PDFC subnode to schema and example i.MX93 SoC mediamix blk-ctrl contains one DISPLAY_MUX register which configures parallel display format by using the "PARALLEL_DISP_FORMAT" field. Document the Parallel Display Format Configuration(PDFC) subnode and add the subnode to example. [m.felsch@pengutronix.de: add bus-width] Signed-off-by: Liu Ying [m.felsch@pengutronix.de: port to v6.18-rc1] Signed-off-by: Marco Felsch Reviewed-by: Rob Herring (Arm) Signed-off-by: Frank Li commit 12f56ee0ad2b7512808e06a804290bc7720530b1 Author: Joy Zou Date: Wed Feb 11 17:28:26 2026 +0800 arm64: dts: imx95-evk: update the dma-channel-mask property Have reserved eDMA2 channels 0 and 1 for V2X fast hash in imx95.dtsi. So update the dma-channel-mask from 0xc0000000 to 0xc0000003 to mark channels 0, 1, 30, and 31 as reserved. Signed-off-by: Joy Zou Signed-off-by: Frank Li commit c915f81aa3c71247601edad955602d60d629fcdd Author: Joy Zou Date: Wed Feb 11 17:28:25 2026 +0800 arm64: dts: imx95: Reserve eDMA channels 0-1 for V2X Reserve eDMA channels 0 and 1 on the AXI eDMA controller for exclusive use by V2X (Vehicle-to-Everything) fast hash operations. Reviewed-by: Laurentiu Mihalcea Tested-by: Laurentiu Mihalcea Signed-off-by: Joy Zou Signed-off-by: Frank Li commit 8c2d3dd02d1a22d3f2c00ba98e90e283c1d0db20 Author: Sherry Sun Date: Wed Feb 4 16:35:51 2026 +0800 arm64: dts: imx93: Add i.MX93 Wireless EVK board support i.MX93 Wireless SiP is created by integrating i.MX93 and IW610 WLCSP (Wi-Fi + BLE + 802.15.4). And i.MX93 Wireless EVK board with the i.MX93 Wireless SiP basically reuse the i.MX93 11x11 EVK board, with some minor functional and pin connection differences. Reuse the new imx93-11x11-evk-common.dtsi and add the board-specific changes here. Here are the detailed differences between i.MX93 Wireless EVK and i.MX93 11x11 EVK board. Function differences: Function i.MX93W EVK i.MX93 EVK WIFI/BT IW610 in i.MX93W IW612 M.2 module MQS N Y PDM MIC N Y M.2 N Y RPi 40-pin HDR Limited support(pin conflict) Y Pin connection differences: Function Signal name i.MX93W EVK i.MX93 EVK WIFI/BT SPI_FRM SAI1_TXFS (spi1.PCS0) GPIO_IO08 (spi3.PCS0) SPI_TXD SAI1_TXC (spi1.SIN) GPIO_IO09 (spi3.SIN) SPI_RXD SAI1_RXD0 (spi1.SOUT) GPIO_IO10 (spi3.SOUT) SPI_CLK SAI1_TXD0 (spi1.SCK) GPIO_IO11 (spi3.SCK) SPI_INT CCM_CLKO1 on-board IO expander NB_WAKE_IN PDM_CLK on-module IO expander WL_WAKE_IN PDM_BIT_STREAM0 on-module IO expander IND_RST_WL PDM_BIT_STREAM1 on-module IO expander IND_RST_NB GPIO_IO28 on-module IO expander PDn GPIO_IO29 on-module IO expander NB_WAKE_OUT GPIO_IO14 on-board IO expander WL_WAKE_OUT GPIO_IO15 CCM_CLKO1 I2C3 I2C3_SDA GPIO_IO00 GPIO_IO28 I2C3_SCL GPIO_IO01 GPIO_IO29 Signed-off-by: Sherry Sun Reviewed-by: Frank Li Signed-off-by: Frank Li commit 6c41fe5964c270d11fceb683c041ccc35c4434d1 Author: Sherry Sun Date: Wed Feb 4 16:35:50 2026 +0800 arm64: dts: imx93: Add imx93w.dtsi for i.MX93 Wireless SiP Introduce imx93w.dtsi to describe the new NXP i.MX93 Wireless SiP, which integrates the i.MX93 application processor with the NXP IW610 WLCSP (Wi-Fi + Bluetooth LE + 802.15.4) connectivity device. The new imx93w.dtsi is based on imx93.dtsi and adds the pieces required for the internal connection between i.MX93 and IW610 inside the SiP. This includes USDHC3 which is used as the host interface to the IW610 and the required GPIO settings(e.g. WL_RST, WL_REG_ON, etc.). These nodes reflect internal SiP wiring and are not board specific, so they are placed in a dedicated imx93w.dtsi file that can be reused by multiple boards adopting the i.MX93 Wireless SiP. Signed-off-by: Sherry Sun Reviewed-by: Frank Li Signed-off-by: Frank Li commit f245e8eb168932a68c87c6e13d46eacb1893478d Author: Sherry Sun Date: Wed Feb 4 16:35:49 2026 +0800 arm64: dts: imx93: Move 11x11 EVK specific parts back to imx93-11x11-evk.dts The previous patch renamed imx93-11x11-evk.dts to imx93-11x11-evk-common.dtsi to prepare for adding the i.MX93 Wireless EVK, which shares most of its design with the 11x11 EVK. Move the board specific differences out of imx93-11x11-evk-common.dtsi and back into imx93-11x11-evk.dts, ensuring that the common dtsi only contains the truly shared parts between the two EVK boards. No functional changes intended. Signed-off-by: Sherry Sun Reviewed-by: Frank Li Signed-off-by: Frank Li commit 3eb100e561953d36bb6d1eb4ee27d3676e17c0ab Author: Sherry Sun Date: Wed Feb 4 16:35:48 2026 +0800 arm64: dts: imx93: Extract common EVK description into shared dtsi The i.MX93 Wireless EVK reuses most of the 11x11 EVK design. To avoid duplication and DTS-to-DTS includes, extract the common parts into a new imx93-11x11-evk-common.dtsi shared by both boards. Rename imx93-11x11-evk.dts to imx93-11x11-evk-common.dtsi and include it from imx93-11x11-evk.dts. Only structural changes are introduced, with no intended functional impact. Signed-off-by: Sherry Sun Reviewed-by: Krzysztof Kozlowski Reviewed-by: Frank Li Signed-off-by: Frank Li commit 87e4207ddfe945907da45ea7d1d5eb26c879ec59 Author: Laurentiu Mihalcea Date: Tue Feb 3 02:03:32 2026 -0800 arm64: dts: imx95-15x15-frdm: support AONMIX MQS Add support for AONMIX MQS (i.e. MQS1). Reviewed-by: Chancel Liu Reviewed-by: Daniel Baluta Signed-off-by: Laurentiu Mihalcea Reviewed-by: Frank Li Signed-off-by: Frank Li commit 77ae6ab96581773dc799739252e632263a29b58f Author: Laurentiu Mihalcea Date: Tue Feb 3 02:03:31 2026 -0800 arm64: dts: imx95: add AONMIX MQS node Add DT node for AONMIX MQS (i.e. MQS1). Signed-off-by: Laurentiu Mihalcea Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Signed-off-by: Frank Li commit 0c9d379d436e119285ef39a4f96b012f576ed74c Author: Emanuele Ghidoli Date: Thu Jan 29 11:47:35 2026 +0100 arm64: dts: freescale: imx95-toradex-smarc: fix PMIC_SD2_VSEL label position Fix the PMIC_SD2_VSEL gpio-line-name position. It should be on line 19 of gpio3, not line 20. Fixes: 90bbe88e0ea6 ("arm64: dts: freescale: add Toradex SMARC iMX95") Cc: stable@vger.kernel.org Signed-off-by: Emanuele Ghidoli Reviewed-by: Frank Li Reviewed-by: Francesco Dolcini Signed-off-by: Frank Li commit 7e660488ba1377441bab56850b8d72bf868a59f5 Author: Frank Li Date: Mon Feb 2 14:43:22 2026 -0500 ARM: dts: imx51-babbage: rename at45db321d@1 to flash@1 Rename at45db321d@1 to flash@1 to fix below CHECK_DTBS warnings: at45db321d@1 (atmel,at45db321d): $nodename:0: 'at45db321d@1' does not match '^(flash|.*sram|nand)(@.*)?$' from schema $id: http://devicetree.org/schemas/mtd/atmel,dataflash.yaml Signed-off-by: Frank Li commit cf1215fd56cfe552f4d7df17fb995f52a88a2181 Author: Frank Li Date: Mon Feb 2 14:43:21 2026 -0500 ARM: dts: imx51-ts4800: rename fpga@0 to fpga@0,0 Change node name fpga@0 to fpga@0,0 to fix below CHECK_DTBS warnings: memory-controller@83fda000 (fsl,imx51-weim): 'fpga@0' does not match any of the regexes: '^.*@[0-7],[0-9a-f]+$', '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/memory-controllers/fsl/fsl,imx-weim.yam Signed-off-by: Frank Li commit 1c764712672bc984691d01716d2838b26230b587 Author: Frank Li Date: Mon Feb 2 14:43:20 2026 -0500 ARM: dts: imx35: remove simple-bus 'usbphy' Remove simple bus 'usbphy' and move chip nodes to up layers to fix below CHECK_DTBS warnings. arch/arm/boot/dts/nxp/imx/imx35-pdk.dtb: usbphy (simple-bus): usb-phy@1:reg:0: [1] is too short from schema $id: http://devicetree.org/schemas/simple-bus.yaml Remove property 'reg' because it is never used at driver. Signed-off-by: Frank Li commit 3645ed51986b10560081bc32a8ff66daf7b1c0ed Author: Frank Li Date: Mon Feb 2 14:43:19 2026 -0500 ARM: dts: imx35: rename i2c clock-names to ipg Rename the i2c clock-names from "ipg_per" to "ipg" to match the binding documentation. Fix the following CHECK_DTBS warning: i2c@43f80000 (fsl,imx35-i2c): clock-names:0: 'ipg' was expected Signed-off-by: Frank Li commit c79cb42baf2ab1bbaac49cc46a3536af593e46c3 Author: Frank Li Date: Mon Feb 2 14:43:18 2026 -0500 ARM: dts: imx35: rename emi to emi-bus to fix CHECK_DTBS warning Rename emi to emi-bus to fix below CHECK_DTBS warning: arch/arm/boot/dts/nxp/imx/imx31-bug.dtb: emi@b8000000 (simple-bus): $nodename:0: 'emi@b8000000' does not match '^([a-z][a-z0-9\\-]+-bus|bus|localbus|soc|axi|ahb|apb)(@.+)?$' from schema $id: http://devicetree.org/schemas/simple-bus.yaml Signed-off-by: Frank Li commit 47e088c9d1a06e0f762ac7ea62ae48c9e16c4def Author: Karan Tilak Kumar Date: Tue Feb 17 14:39:43 2026 -0800 scsi: fnic: Bump up version number Bump up version number. Tested-by: Karan Tilak Kumar Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Signed-off-by: Karan Tilak Kumar Link: https://patch.msgid.link/20260217223943.7938-5-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 927b5282df6463fea8eeb1342e58cec0fa03b35e Author: Karan Tilak Kumar Date: Tue Feb 17 14:39:42 2026 -0800 scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() Modify logic to remove unnecessary acquire/release of spinlock to set in_remove flag. There's also no need to check for init status to call fnic_fcpio_reset. Tested-by: Karan Tilak Kumar Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260217223943.7938-4-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 31eda39bfd468a0fbabc0179e913c0755377e3b5 Author: Karan Tilak Kumar Date: Tue Feb 17 14:39:41 2026 -0800 scsi: fnic: Rename fnic_scsi_fcpio_reset() The function has no dependency on SCSI/FCP, so rename it to fnic_fcpio_reset() and move it to fnic_fcs.c Tested-by: Karan Tilak Kumar Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260217223943.7938-3-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit a59d1caf1ded07e38a0f6e98c6491a75faedd70f Author: Karan Tilak Kumar Date: Tue Feb 17 14:39:40 2026 -0800 scsi: fnic: Do not use GFP_ZERO for mempools One cannot use the GFP_ZERO flag for mempool allocation, so use memset() instead. Tested-by: Karan Tilak Kumar Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Reviewed-by: Lee Duncan Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260217223943.7938-2-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 0e07baae55bc319e4e9559fee352b9252a467db6 Author: Karan Tilak Kumar Date: Tue Feb 17 14:39:39 2026 -0800 scsi: fnic: Use mempool for receive frames The receive frames are constantly replenished so we should rather use a mempool here. fip_frame_queue is an rxq. Deallocate it in fnic_free_rxq(). Tested-by: Karan Tilak Kumar Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Reviewed-by: Hannes Reinecke Signed-off-by: Karan Tilak Kumar Co-developed-by: Hannes Reinecke Link: https://patch.msgid.link/20260217223943.7938-1-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit e8619bcb08b3012117cb2dbac8d02e78a39646cc Author: Sun Jian Date: Sat Feb 7 22:45:52 2026 +0800 fs/ntfs3: return folios from ntfs_lock_new_page() ntfs_lock_new_page() currently returns a struct page * but it primarily operates on folios via __filemap_get_folio(). Convert it to return a struct folio * and use folio_alloc() + __folio_set_locked() for the temporary page used to avoid data corruption during decompression. When the cached folio is not uptodate, preserve the existing behavior by using folio_file_page() and converting the returned page back to a folio. Update ni_readpage_cmpr() and ni_decompress_file() to handle the new return type while keeping the existing struct page * array and the unlock_page()/put_page() cleanup paths unchanged. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602072013.jwrURE2e-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202602071921.nGIiI1J5-lkp@intel.com/ Signed-off-by: Sun Jian [almaz.alexandrovich@paragon-software.com: removed ni_fiemap function, added reported-by and closes tags to commit] Signed-off-by: Konstantin Komarov commit 3a2141b2f1c34fda9a4e5af6df519656b5c47013 Author: Adarsh Das Date: Sun Feb 8 14:09:04 2026 +0530 fs/ntfs3: resolve compare function in public index APIs Previously the comparator was stored in struct ntfs_index and used by low-level helpers such as hdr_find_e(). This creates a dependency on index state in private helpers. Resolve the compare function in the public index APIs and pass it explicitly to internal helpers. This should make the ownership of the comparator explicit and keeps low-level index code independent of index-root policy. This also resolves the TODO comment about dropping the stored comparator from struct ntfs_index. Signed-off-by: Adarsh Das Signed-off-by: Konstantin Komarov commit e10e72f69734a90c8719d160e8efb164ce5d9e26 Author: Ziyi Guo Date: Tue Feb 10 15:56:34 2026 +0000 ntfs3: reject inodes with zero non-DOS link count ntfs_read_mft() counts file name attributes into two variables: names (all names including DOS 8.3) and links (non-DOS names only). The validation at line 424 checks names but set_nlink() at line 436 uses links. A corrupted NTFS image where all file name attributes have type FILE_NAME_DOS passes the names check but results in set_nlink(inode, 0). When such an inode is loaded via a code path that passes name=NULL to ntfs_iget5() and the nlink=0 inode enters the VFS. The subsequent unlink, rmdir, or rename targeting this inode calls drop_nlink() which triggers WARN_ON(inode->i_nlink == 0) in fs/inode.c. An all-DOS-name MFT record cannot exist on a valid NTFS volume. Reject such records by checking for links == 0 before calling set_nlink(). Signed-off-by: Ziyi Guo Signed-off-by: Konstantin Komarov commit e4094d56c5592dd90aa619f9480265b0689ed3d9 Author: Ilya Leoshkevich Date: Tue Feb 17 17:10:06 2026 +0100 s390/bpf: Do not increment tailcall count when prog is NULL Currently tail calling a non-existent prog results in tailcall count increment. This is what the interpreter is doing, but this is clearly wrong, so replace load-and-increment and compare-and-jump with load and compare-and-jump, conditionally followed by increment and store. Reported-by: Hari Bathini Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20260217161058.101346-1-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit f707860ebc84dd07148c3855e2f0fa9f41a3ed4a Author: Peter Wang Date: Tue Feb 10 15:17:30 2026 +0800 scsi: ufs: core: Support UFSHCI 4.1 CQ entry tag The UFSHCI 4.1 specification introduces a new completion queue (CQ) entry format, allowing the tag to be obtained directly. Signed-off-by: Peter Wang Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260210071834.1837878-1-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 3abe4113e784b4a1135fe0e89828afecbfebf862 Author: Peter Wang Date: Tue Feb 10 14:41:44 2026 +0800 scsi: ufs: core: Add debug log for MCQ command timeout It is difficult to debug situations where an MCQ command timeout occurs, the corresponding CQ tag response is received, but the request is not completed. Add a one-line log to indicate when the CQ entry is abnormal. Signed-off-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260210070837.1820710-3-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 01517654bc258efb2610e53e99fa4ef641d134b9 Author: Peter Wang Date: Tue Feb 10 14:41:43 2026 +0800 scsi: ufs: core: Add debug log for UIC command timeout It is difficult to debug when a UIC command timeout occurs simultaneously with a UIC command complete interrupt. Currently, we only see the timeout log without any debug information, making it unclear whether the UFS device failed to respond or the host entered an incorrect state. Add a one-line log to cover this situation. Signed-off-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260210070837.1820710-2-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 3733f4be287029dad963534da3d91ac806df233d Author: Hari Bathini Date: Fri Feb 20 11:59:58 2026 +0530 bpf: Do not increment tailcall count when prog is NULL Currently, tailcall count is incremented in the interpreter even when tailcall fails due to non-existent prog. Fix this by holding off on the tailcall count increment until after NULL check on the prog. Suggested-by: Ilya Leoshkevich Signed-off-by: Hari Bathini Link: https://lore.kernel.org/r/20260220062959.195101-1-hbathini@linux.ibm.com Signed-off-by: Alexei Starovoitov commit ccc66ba50b70e0ab600df547b60c43f9b9e87c82 Author: Tomasz Unger Date: Mon Feb 23 21:00:06 2026 +0100 staging: rtl8723bs: convert single-line comment to multi-line format Convert a long single-line comment to multi-line format as per coding-style.rst. Signed-off-by: Tomasz Unger Link: https://patch.msgid.link/20260223200006.145296-2-tomasz.unger@yahoo.pl Signed-off-by: Greg Kroah-Hartman commit 4fcaf09f5ddffe7021266957e9623eac2fb03ff7 Author: Tomasz Unger Date: Mon Feb 23 21:00:05 2026 +0100 staging: rtl8723bs: fix spelling mistakes in rtw_wlan_util.c Fix spelling mistakes in comments found by codespell: - alloction => allocation - overwirte => overwrite - indx => index Signed-off-by: Tomasz Unger Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260223200006.145296-1-tomasz.unger@yahoo.pl Signed-off-by: Greg Kroah-Hartman commit e5448f8d2ec5b4452ba34d376970c05dca2f0a22 Author: Artem Lytkin Date: Mon Feb 23 20:40:36 2026 +0000 staging: sm750fb: convert logging to device-based in sm750_hw.c Replace pr_err() calls with dev_err() using &pdev->dev or &sm750_dev->pdev->dev to provide proper device context in log messages. This makes it easier to identify which device generated the message when multiple framebuffer devices are present. Signed-off-by: Artem Lytkin Link: https://patch.msgid.link/20260223204036.1780-3-iprintercanon@gmail.com Signed-off-by: Greg Kroah-Hartman commit db7fb3588ab49203bdc9d30bb4e7a8fbb7dc0fe0 Author: Artem Lytkin Date: Mon Feb 23 20:40:35 2026 +0000 staging: sm750fb: remove debug and diagnostic prints Remove all pr_info, pr_debug, and pr_warn calls that dump internal variable values, pointer addresses, and structure contents not useful for production use. This includes the complete fb_find_mode() result logging in lynxfb_set_fbinfo(), the CH7301 DVI chip status messages in hw_sm750_inithw(), and various debug prints throughout the driver. Signed-off-by: Artem Lytkin Link: https://patch.msgid.link/20260223204036.1780-2-iprintercanon@gmail.com Signed-off-by: Greg Kroah-Hartman commit 931c105de11c2e0e9675fbc061b16a9c5f134dcf Author: Thorsten Blum Date: Tue Feb 24 15:48:27 2026 +0100 scsi: BusLogic: Replace deprecated strcpy() + strcat() in blogic_rdconfig() strcpy() is deprecated [1] and using strcat() is discouraged. Replace them with scnprintf(). No functional changes. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260224144828.585577-1-thorsten.blum@linux.dev Signed-off-by: Martin K. Petersen commit 8bd9b67dc6e272f88c59365a2f55d38d52091cf9 Author: Ahmet Ramazan Capoglu Date: Tue Feb 24 14:37:23 2026 +0300 staging: sm750fb: Fix "varios" typo in ddk750_swi2c.c Fix spelling of "varios" to "various". Signed-off-by: Ahmet Ramazan Capoglu Link: https://patch.msgid.link/20260224113806.1506361-1-ahmetramazancapoglu@gmail.com Signed-off-by: Greg Kroah-Hartman commit 25b510c1923a0b42cd0f97d96a8051f38961890a Author: Giorgi Tchankvetadze Date: Tue Feb 24 13:46:17 2026 +0400 staging: sm750fb: Fix "programed" typo in ddk750_mode.c Fix spelling of "programed" to "programmed" and remove extra space. Signed-off-by: Giorgi Tchankvetadze Link: https://patch.msgid.link/20260224094616.42494-2-giorgitchankvetadze1997@gmail.com Signed-off-by: Greg Kroah-Hartman commit 29e79c66b3ccb46cacd2dcd92f45291506fb5259 Author: Kibaek Yoo Date: Tue Feb 24 13:49:46 2026 +0900 staging: nvec: fix block comment style in nvec_interrupt() Fix multi-line block comment to use the preferred kernel comment style with leading asterisks on each line and a trailing */ on a separate line, as reported by checkpatch.pl. Signed-off-by: Kibaek Yoo Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260224044946.54022-1-psykibaek@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2a433bf17ca21d6c79d25dc68dd5051b972ba627 Merge: 6de23f81a5e08b 6446e8c2b6c76b Author: Martin K. Petersen Date: Tue Feb 24 13:08:32 2026 -0500 Merge patch series "Update lpfc to revision 14.4.0.14" Justin Tee says: Update lpfc to revision 14.4.0.14 This patch set contains updates to log messaging, trivial typecast and pointer changes, bug fixes related to kref accounting and cleanup handling, an update to a WQE submission bitfield, and restriction of first burst to specific HBAs only. The patches were cut against Martin's 6.20/scsi-queue tree. Link: https://patch.msgid.link/20260212213008.149873-1-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 6446e8c2b6c76b4d253c46352540ca1f5fa3f854 Author: Justin Tee Date: Thu Feb 12 13:30:08 2026 -0800 scsi: lpfc: Update lpfc version to 14.4.0.14 Update lpfc version to 14.4.0.14. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-14-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 107cb8ed4f44eeb17f9624e183603c0b885ef039 Author: Justin Tee Date: Thu Feb 12 13:30:07 2026 -0800 scsi: lpfc: Update copyright year string for 2026 Update copyright string to 2026 for this version patch set. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-13-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 5807d96c46d5ccfb4c247f16653e616e8c90ae06 Author: Justin Tee Date: Thu Feb 12 13:30:06 2026 -0800 scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only First burst is only supported on adapters running in SLI4 mode and that are non-FCoE based. Include sli_rev and FCoE mode checks before setting the write transfer ready disabled bit in PRLIs. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-12-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 9714c5463fd1d963fe30193ed75b9578e84278ab Author: Justin Tee Date: Thu Feb 12 13:30:05 2026 -0800 scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions WQE submissions only require a 3 bit field when specifying the class of service to use. So, update WQE submission paths to use a 3 bit field instead of 0x0f as the bit mask. A NLP_FCP_CLASS_MASK bitmask is defined to ensure only a 3 bit mask is used. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-11-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 559a6c2ab097695f7b3cd4fdd5f6aca81ae3da09 Author: Justin Tee Date: Thu Feb 12 13:30:04 2026 -0800 scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset When handling a PCI function reset, notification to the NVMe transport layer is skipped for outstanding aborted NVMe I/O. Introduce a new routine called lpfc_nvme_flush_abts_list(), which notifies upper NVMe transport layer of outstanding aborted NVMe I/O that are not planned to be completed normally due to a PCI function reset request. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-10-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 2da10bcaa58a389ca60f8e788180e0dca00739bc Author: Justin Tee Date: Thu Feb 12 13:30:03 2026 -0800 scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() When a port is offline in lpfc_sli_abort_ring, the phba->txcmplq is cleared but the phba->txcmplq_cnt is not reset to zero. This can sometimes result in a phba->txcmplq_cnt that never reaches zero, which hangs the cleanup process. Update lpfc_sli_abort_ring so that txcmplq_cnt is reset to zero and also ensure that the LPFC_IO_ON_TXCMPLQ flag is properly cleared. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-9-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 6b0bcf4b6430688984fe1ee69fce7165a3e24b92 Author: Justin Tee Date: Thu Feb 12 13:30:02 2026 -0800 scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages Error labels in lpfc_fdmi_cmd() accidentally return success status and can potentially leak memory. Change error exit path status to return a non-zero value using a common exit path for failure cases. The error path also frees allocated memory and provides logging. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-8-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit f6bfb8d149336661bb80e62980da9a45b920403c Author: Justin Tee Date: Thu Feb 12 13:30:01 2026 -0800 scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss When NLP_IN_RECOV_POST_DEV_LOSS is set, the initial node reference remains held while recovery is in progress. Taking a reference when NLP_IN_RECOV_POST_DEV_LOSS is cleared results in an additional reference being held. This causes an extra reference when cleaning up lpfc_vport instances. Thus, remove the extraneous ndlp kref get in lpfc_check_nlp_post_devloss. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-7-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 70b468d41b822e4b510761120be3924df966a62d Author: Justin Tee Date: Thu Feb 12 13:30:00 2026 -0800 scsi: lpfc: Reduce pointer chasing when accessing vmid_flag For all FLOGI completions, the vport->phba->pport pointer is actually a pointer to the original vport pointer because FLOGIs always complete on the physical lpfc_vport object. Thus, we can reduce the vport->phba->pport->vmid_flag dereference to simply vport->vmid_flag. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-6-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit f8c599ad90f53dbe2246935f90ff49693c26b34f Author: Justin Tee Date: Thu Feb 12 13:29:59 2026 -0800 scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup The member called cfg_sg_dma_buf_size is declared as a u32, while the min comparator's second argument called SLI4_PAGE_SIZE is a #define. Proper comparison should be using the same type, therefore change to use min_t. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-5-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 5f442e54e9ef662aaad736ca1af13f20d0448f08 Author: Justin Tee Date: Thu Feb 12 13:29:58 2026 -0800 scsi: lpfc: Add log messages to fabric login error labels Should fabric login or related initialization mailbox commands fail, there are no log messages to notify which step encountered an issue. Update error label paths to log when unexpected fabric login issues occur. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-4-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit b4082ac8e62ca669beabddff47238cdb33ea47dc Author: Justin Tee Date: Thu Feb 12 13:29:57 2026 -0800 scsi: lpfc: Log discarded and insufficient RQE buffer events An RCQE with statuses indicating that an RQE is dropped or when there are insufficient buffers to receive new RQEs are currently occuring silently. Add a new log message to warn when such events occur. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-3-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 8ecb3ec244acd7db2a6c071d53eb4870619fb5e6 Author: Justin Tee Date: Thu Feb 12 13:29:56 2026 -0800 scsi: lpfc: Update log message when ndlp kref get is unsuccessful If kref_get_unless_zero on ndlp->kref is unsuccessful, then there's no point to log kref_read(&ndlp->kref) because it will of course be zero. In such cases, ndlp->vport would also be an invalid pointer. Thus, use pr_info() instead of lpfc_printf_vlog() to log when a kref get is attempted on an ndlp with a zero kref. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20260212213008.149873-2-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 645186bf86932c6b9deed2e564cffd09576ba9a4 Author: Randy Dunlap Date: Thu Feb 19 13:55:24 2026 -0800 drm/sun4i: fix kernel-doc warnings in sunxi_engine.h Correct the kernel-doc notation, add a missing struct member comment, and add a missing "Returns:" function comment to eliminate kernel-doc warnings: Warning: drivers/gpu/drm/sun4i/sunxi_engine.h:116 Incorrect use of kernel-doc format: * @mode_set Warning: drivers/gpu/drm/sun4i/sunxi_engine.h:125 struct member 'mode_set' not described in 'sunxi_engine_ops' Warning: drivers/gpu/drm/sun4i/sunxi_engine.h:144 struct member 'list' not described in 'sunxi_engine' Warning: drivers/gpu/drm/sun4i/sunxi_engine.h:168 No description found for return value of 'sunxi_engine_layers_init' Signed-off-by: Randy Dunlap Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260219215524.468142-1-rdunlap@infradead.org Signed-off-by: Chen-Yu Tsai commit 477174ac35c510d0ed3043f5bd4fba25546a21ce Author: David Carlier Date: Tue Feb 24 05:56:37 2026 +0000 sched_ext: Optimize sched_ext_entity layout for cache locality Reorder struct sched_ext_entity to place ops_state, ddsp_dsq_id, and ddsp_enq_flags immediately after dsq. These fields are accessed together in the do_enqueue_task() and finish_dispatch() hot paths but were previously spread across three different cache lines. Grouping them on the same cache line reduces cache misses on every enqueue and dispatch operation. Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit 06277983eca4a31d3c2114fa33d99a6e82484b11 Author: Ethan Tidmore Date: Mon Feb 16 19:48:01 2026 -0600 drm/sun4i: backend: fix error pointer dereference The function drm_atomic_get_plane_state() can return an error pointer and is not checked for it. Add error pointer check. Detected by Smatch: drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error: 'plane_state' dereferencing possible ERR_PTR() Fixes: 96180dde23b79 ("drm/sun4i: backend: Add a custom atomic_check for the frontend") Signed-off-by: Ethan Tidmore Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260217014801.60760-1-ethantidmore06@gmail.com Signed-off-by: Chen-Yu Tsai commit c5a244bf17caf2de22f9e100832b75f72b31d3e6 Author: Ian Rogers Date: Fri Feb 6 16:49:56 2026 -0800 perf metricgroup: Fix metricgroup__has_metric_or_groups Use metricgroup__for_each_metric rather than pmu_metrics_table__for_each_metric that combines the default metric table with, a potentially empty, CPUID table. Fixes: cee275edcdb1 ("perf metricgroup: Don't early exit if no CPUID table exists") Signed-off-by: Ian Rogers Reviewed-by: Leo Yan Tested-by: Leo Yan Signed-off-by: Namhyung Kim commit aa6a6a2d16c1e2e27e986936369959d70316199f Author: Thomas Richter Date: Tue Feb 17 14:14:56 2026 +0100 perf parse-events: Fix big-endian 'overwrite' by writing correct union member The "Read backward ring buffer" test crashes on big-endian (e.g. s390x) due to a NULL dereference when the backward mmap path isn't enabled. Reproducer: # ./perf test -F 'Read backward ring buffer' Segmentation fault (core dumped) # uname -m s390x # Root cause: get_config_terms() stores into evsel_config_term::val.val (u64) while later code reads boolean fields such as evsel_config_term::val.overwrite. On big-endian the 1-byte boolean is left-aligned, so writing evsel_config_term::val.val = 1 is read back as evsel_config_term::val.overwrite = 0, leaving backward mmap disabled and a NULL map being used. Store values in the union member that matches the term type, e.g.: /* for OVERWRITE */ new_term->val.overwrite = 1; /* not new_term->val.val = 1 */ to fix this. Improve add_config_term() and add two more parameters for string and value. Function add_config_term() now creates a complete node element of type evsel_config_term and handles all evsel_config_term::val union members. Impact: Enables backward mmap on big-endian and prevents the crash. No change on little-endian. Output after: # ./perf test -Fv 44 --- start --- Using CPUID IBM,9175,705,ME1,3.8,002f mmap size 1052672B mmap size 8192B ---- end ---- 44: Read backward ring buffer : Ok # Fixes: 159ca97cd97c ("perf parse-events: Refactor get_config_terms() to remove macros") Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Reviewed-by: James Clark Acked-by: Ian Rogers Signed-off-by: Namhyung Kim commit e02902dd493bf9c9b05353c761737ac514ad7a5c Author: Antoniu Miclaus Date: Mon Feb 23 18:21:01 2026 +0200 spi: add devm_spi_new_ancillary_device() Add a devres-managed version of spi_new_ancillary_device() that automatically unregisters the ancillary SPI device when the parent device is removed. This follows the same devm_add_action_or_reset() pattern used by the other managed SPI functions (devm_spi_optimize_message, devm_spi_register_controller, etc.) and eliminates the need for drivers to open-code their own devm cleanup callbacks for ancillary devices. Acked-by: Nuno Sá Signed-off-by: Antoniu Miclaus Link: https://patch.msgid.link/20260223162110.156746-3-antoniu.miclaus@analog.com Signed-off-by: Mark Brown commit 744629904c68bde847c31819f23482d09152f810 Author: Jernej Skrabec Date: Wed Feb 18 19:34:54 2026 +0100 drm/sun4i: mixer: Fix layer init code Code refactoring dropped extra NULL sentinel entry at the end of the drm planes array. Add it back. Reported-by: Chen-Yu Tsai Closes: https://lore.kernel.org/linux-sunxi/CAGb2v65wY2pF6sR+0JgnpLa4ysvjght5hAKDa1RUyo=zEKXreg@mail.gmail.com/ Fixes: 4fa45b04a47d ("drm/sun4i: layer: move num of planes calc out of layer code") Signed-off-by: Jernej Skrabec Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260218183454.7881-1-jernej.skrabec@gmail.com [wens@kernel.org: Fix "Fixes" commit hash] Signed-off-by: Chen-Yu Tsai commit 571cc8356cbf01252d2bbf4101da99380129a727 Author: Matthew Brost Date: Mon Feb 23 09:25:53 2026 -0800 drm/i915/selftests: Fix build after dma-fence locking rework The i915_active selftest no longer builds after the dma-fence locking rework because it directly accessed the fence’s spinlock. The helper dma_fence_spinlock() must now be used to obtain the spinlock. Update the selftest to use dma_fence_spinlock() accordingly. Fixes: 1f32f310a13c ("dma-buf: inline spinlock for fence protection v5") Cc: Christian König Signed-off-by: Matthew Brost Reviewed-by: Jonathan Cavitt Reviewed-by: Christian König Link: https://patch.msgid.link/20260223172553.1663749-1-matthew.brost@intel.com commit 0ac82bc7b7922add7f92d85732b4531af55c1e90 Author: Andreas Gruenbacher Date: Mon Nov 10 21:05:45 2025 +0000 gfs2: Remove unnecessary check in gfs2_evict_inode We are no longer using LM_FLAG_TRY or LM_FLAG_TRY_1CB during inode evict, so ret cannot be GLR_TRYFAILED here. Signed-off-by: Andreas Gruenbacher commit 92ab53b9bb2a72581c32073755077af916eb9aee Author: Francesco Dolcini Date: Mon Jan 19 11:34:09 2026 +0100 arm64: dts: imx8-apalis: Fix LEDs name collision Ixora boards have multiple instances of status leds, to avoid a name collision add the function-enumerator property. This fixes the following Linux kernel warnings: leds-gpio leds: Led green:status renamed to green:status_1 due to name collision leds-gpio leds: Led red:status renamed to red:status_1 due to name collision Fixes: c083131c9021 ("arm64: dts: freescale: add apalis imx8 aka quadmax carrier board support") Signed-off-by: Francesco Dolcini Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Signed-off-by: Frank Li commit aa8671af0c380c15989b88325a2d5a6c5341771d Author: Mika Westerberg Date: Tue Feb 24 12:10:43 2026 +0100 PCI/PTM: Drop pci_enable_ptm() granularity parameter No pci_enable_ptm() callers supply the "granularity" pointer where the clock granularity would be returned. Drop the unused pci_enable_ptm() parameter. Signed-off-by: Mika Westerberg [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260224111044.3487873-5-mika.westerberg@linux.intel.com commit 3ae57df0b37e638e587c6d6076847d303db3438b Author: Francesco Dolcini Date: Mon Jan 19 11:36:53 2026 +0100 arm64: dts: imx8-apalis: Remove obsolete TODO comment The GPU is supported since Linux v6.9, with changes in the SoC dtsi file. Remove the related obsolete TODO comment. Signed-off-by: Francesco Dolcini Reviewed-by: Daniel Baluta Signed-off-by: Frank Li commit b2150811e0efc767928b45ccebc9671fdf5c4c18 Author: Sherry Sun Date: Mon Jan 19 18:52:15 2026 +0800 arm64: dts: imx943-evk: enable lpuart6 for Bluetooth Enable lpuart6 for Bluetooth support. Signed-off-by: Sherry Sun Reviewed-by: Frank Li Signed-off-by: Frank Li commit 722094c436d6e393ca16441da9642eb61d102145 Author: Sherry Sun Date: Tue Jan 20 10:52:05 2026 +0800 arm64: dts: imx93-14x14-evk: enable lpuart5 for Bluetooth Enable lpuart5 for Bluetooth support. Signed-off-by: Sherry Sun Reviewed-by: Frank Li Signed-off-by: Frank Li commit 5f93cce741bc9ffbc9ce4b8ca4a1ff6bf1a881f0 Author: Francesco Dolcini Date: Tue Jan 20 11:02:20 2026 +0100 arm64: dts: imx8-apalis: Disable the audmix The audmix is not used on apalis imx8, disable it. This solves the following warning message imx-audmix imx-audmix.0: failed to find SAI platform device imx-audmix imx-audmix.0: probe with driver imx-audmix failed with error -22 Signed-off-by: Francesco Dolcini Reviewed-by: Frank Li Signed-off-by: Frank Li commit c13e6652c7ea2984b3e3094a18e1e6c441a06ce3 Author: Sherry Sun Date: Tue Jan 20 18:48:42 2026 +0800 arm64: dts: imx95-19x19-evk: enable lpuart5 for Bluetooth support Enable lpuart5 on imx95-19x19-evk board for Bluetooth support. Signed-off-by: Sherry Sun Reviewed-by: Frank Li Signed-off-by: Frank Li commit 8940756346ec498727acce4dd3fb4659b1fd83d3 Author: Sherry Sun Date: Wed Jan 21 19:13:46 2026 +0800 arm64: dts: imx93-evk/qsb: add m2-pcm-level-shifter-hog to enable BT HFP For i.MX93 11x11 EVK and 9x9 QSB boards, add the gpio-hog to enable the M.2 PCM pins level shifter connected between soc sai1 interface and M.2 PCM pins so that HFP feature can be supported. Since the HFP is only used at a later stage — after the BT firmware has been downloaded and the BT connection with the remote device has been established — both the pcal6524 expander and sai1 interface are already fully initialized and available by that time. Therefore, using a gpio-hog here will not introduce any probe ordering or dependency issues for the HFP use case. Signed-off-by: Sherry Sun Reviewed-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Frank Li commit fb20ccf70cf695f178d7c32e2d33b376560df0ff Author: Chen-Yu Tsai Date: Tue Feb 17 17:30:03 2026 +0800 clk: sunxi-ng: sun55i-a523-r: Add missing r-spi module clock When the PRCM clk driver was added, somehow the r-spi module clock was skipped over. Add it so that r-spi can actually work. Fixes: 8cea339cfb81 ("clk: sunxi-ng: add support for the A523/T527 PRCM CCU") Reviewed-by: Andre Przywara Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20260217093004.3239051-1-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 43eeae2b00013460193ae44fb71cf005098e16a1 Author: Marco Felsch Date: Thu Jan 15 16:24:53 2026 +0100 arm64: dts: imx93: Add parallel display output nodes Add required OF nodes to support the i.MX93 parallel output (DPI) path. On the i.MX93 a single LCDIF is connected to three bridges: DPI, LVDS LDB and the MIPI-DSI whereas the i.MX91 support only the DPI bridge. Map endpoint@0 as DPI bridge output since the i.MX93 TRM (Figure 485. MEDIAMIX block diagram) doesn't mention any port-number <-> bridge combination. Set the MEDIA-AXI and MEDIA-APB clocks to the overdrive (OD) values since the i.MX93 and i.MX91 use the overdrive (OD) clk settings per default. Signed-off-by: Marco Felsch Signed-off-by: Frank Li commit 37983fad7f3ef296fa0504c8e945987459dc5487 Author: Sander Vanheule Date: Fri Feb 20 17:01:12 2026 +0100 regmap: define cleanup helper for regmap_field For temporary field allocation, the user has to perform manual cleanup, or rely on devm_regmap_field_alloc() to (eventually) clean up the allocated resources when an error occurs. Add a cleanup helper that takes care of freeing the allocated regmap_field whenever it goes out of scope. This can simplify this example: struct regmap_field *field = regmap_field_alloc(...); if (IS_ERR(field)) return PTR_ERR(field); int err = regmap_field_read(...); if (err) goto out; /* some logic that may also error */ err = regmap_field_write(...); out: regmap_field_free(field); return err; into the shorter: struct regmap_field *field __free(regmap_field) = regmap_field_alloc(...); if (IS_ERR(field)) return PTR_ERR(field); int err = regmap_field_read(...); if (err) return err; /* some logic that may also error */ return regmap_field_write(...); Signed-off-by: Sander Vanheule Link: https://patch.msgid.link/20260220160112.543391-2-sander@svanheule.net Signed-off-by: Mark Brown commit 38ab6557234d8629407a824be90e82514d6129a0 Author: Sander Vanheule Date: Fri Feb 20 17:01:11 2026 +0100 regmap: sort header includes Sort the included headers to make spotting duplicates easier and avoid discussions on where to add new includes. Signed-off-by: Sander Vanheule Link: https://patch.msgid.link/20260220160112.543391-1-sander@svanheule.net Signed-off-by: Mark Brown commit ada32396f90951e12465224c04742607ca56a982 Author: Richard Fitzgerald Date: Mon Feb 23 15:02:56 2026 +0000 ASoC: SDCA: Add CS47L47 to class driver Add the SoundWire ID for CS47L47 to the class driver. Signed-off-by: Richard Fitzgerald Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260223150256.326143-4-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 80930d81c4b0753ba2ca750708e4d2fcc0627dc8 Author: Richard Fitzgerald Date: Mon Feb 23 15:02:55 2026 +0000 ASoC: soc_sdw_utils: Add device info for CS47L47 Add a device info entry for the Cirrus Logic CS47L47. CS47L47 has UAJ (headset speaker + mic + jack detect) and DMICs. The audio ports are similar to the CS42L45 so can be based on the CS42L45 code. Signed-off-by: Richard Fitzgerald Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260223150256.326143-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit d116bccf6f1c199b27c9ebdf07cc3cfe868f919c Author: Tim Michals Date: Wed Feb 4 12:27:30 2026 -0800 remoteproc: xlnx: Fix sram property parsing As per sram bindings, "sram" property can be list of phandles. When more than one sram phandles are listed, driver can't parse second phandle's address correctly. Because, phandle index is passed to the API instead of offset of address from reg property which is always 0 as per sram.yaml bindings. Fix it by passing 0 to the API instead of sram phandle index. Fixes: 77fcdf51b8ca ("remoteproc: xlnx: Add sram support") Signed-off-by: Tim Michals Signed-off-by: Tanmay Shah Link: https://lore.kernel.org/r/20260204202730.3729984-1-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier commit 7c12f6ead4672cb08b74e6f6115eb04dca8ccfa4 Author: Vishwaroop A Date: Tue Feb 24 09:24:52 2026 +0000 spi: tegra210-quad: Add runtime autosuspend support Using Tegra234, it was found that it takes about 10us to disable clocks and 20us to enable clocks, adding about 30us overhead per operation. For a 4MB firmware update with 16,384 page programs, this results in ~491ms total overhead (12% impact). With Tegra234, flash operations were observed to occur in bursts with 50-200μs gaps between page programs. Testing on Tegra234 with various operation patterns shows 500ms delay provides optimal balance, and for longer operations (>500ms), the overhead is negligible. Therefore, update the driver to use pm-runtime autosuspend with the default timeout of 500ms to reduce the clock gating overhead during consecutive QSPI transfers. Signed-off-by: Vishwaroop A Link: https://patch.msgid.link/20260224092452.1482800-1-va@nvidia.com Signed-off-by: Mark Brown commit 6ad005ce6994599e2ae338007a54dd21063aae15 Author: Lyude Paul Date: Thu Jan 22 16:43:03 2026 -0500 rust/drm: Remove imports covered by prelude::* This just removes any explicit imports of items in files that are already being pulled in by `use prelude::*;`. There should be no functional changes in this patch. Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20260122214316.3281257-2-lyude@redhat.com Signed-off-by: Danilo Krummrich commit b7a124928b5875675539b6a6f708f56911f271f7 Author: Lyude Paul Date: Thu Jan 22 16:43:02 2026 -0500 rust/drm: Fixup import styles This is to match https://docs.kernel.org/rust/coding-guidelines.html#imports There should be no functional changes in this patch. Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20260122214316.3281257-1-lyude@redhat.com [ Move trailing `//` at the end. - Danilo ] Signed-off-by: Danilo Krummrich commit d3f36fa57aa289c43e01da16c928a2cd971ad5dc Author: John Hubbard Date: Fri Feb 20 18:09:15 2026 -0800 gpu: nova-core: fix aux device registration for multi-GPU systems The auxiliary device registration was using a hardcoded ID of 0, which caused probe() to fail on multi-GPU systems with: sysfs: cannot create duplicate filename '/bus/auxiliary/devices/NovaCore.nova-drm.0' Fix this by using an atomic counter to generate unique IDs for each GPU's aux device registration. The TODO item to eventually use XArray for recycling aux device IDs is retained, but for now, this works very nicely. This has the side effect of making debugfs[1] work on multi-GPU systems. [1] https://lore.kernel.org/20260203224757.871729-1-ttabi@nvidia.com Reviewed-by: Gary Guo Signed-off-by: John Hubbard Link: https://patch.msgid.link/20260221020952.412352-2-jhubbard@nvidia.com [ Use LKMM atomics; inline and slightly reword TODO comment. - Danilo ] Signed-off-by: Danilo Krummrich commit db1d3cfaf3cd54b3fdfa63bbf40dc9f13787e65b Author: Andy Shevchenko Date: Fri Feb 20 14:35:46 2026 +0100 ata: ahci-dwc: Remove not-going-to-be-supported code for Baikal SoC As noticed in the discussion [1] the Baikal SoC and platforms are not going to be finalized, hence remove stale code. Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1] Signed-off-by: Andy Shevchenko Acked-by: Rob Herring (Arm) Signed-off-by: Niklas Cassel commit 369cc88049855269b7620426bda4fb9ce2a2d1ca Author: Thomas Hellström Date: Wed Feb 4 16:33:20 2026 +0100 drm/xe/uapi: Introduce a flag to disallow vm overcommit in fault mode Some compute applications may try to allocate device memory to probe how much device memory is actually available, assuming that the application will be the only one running on the particular GPU. That strategy fails in fault mode since it allows VM overcommit. While this could be resolved in user-space it's further complicated by cgroups potentially restricting the amount of memory available to the application. Introduce a vm create flag, DRM_XE_VM_CREATE_NO_VM_OVERCOMMIT, that allows fault mode to mimic the behaviour of !fault mode WRT this. It blocks evicting same vm bos during VM_BIND processing. However, it does *not* block evicting same-vm bos during pagefault processing, preferring eviction rather than VM banning in OOM situations. Cc: John Falkowski Cc: Michal Mrozek Cc: Matthew Brost Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260204153320.17989-1-thomas.hellstrom@linux.intel.com commit 8d1a65c2defdc4213a49008d0531bd35d26fdf35 Author: Gary Guo Date: Fri Jan 23 17:58:44 2026 +0000 gpu: nova-core: remove redundant `.as_ref()` for `dev_*` print This is now handled by the macro itself. Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260123175854.176735-7-gary@kernel.org Signed-off-by: Danilo Krummrich commit 8636385b9f0175220318bc23f6926b3fd013b131 Author: Nicolai Buchwitz Date: Mon Feb 23 09:54:42 2026 +0100 net: microchip: lan743x: add ethtool nway_reset support Wire phylink_ethtool_nway_reset() as the .nway_reset ethtool operation, allowing userspace to restart PHY autonegotiation via 'ethtool -r'. Signed-off-by: Nicolai Buchwitz Reviewed-by: Russel King (Oracle) Link: https://patch.msgid.link/20260223085442.42852-1-nb@tipi-net.de Signed-off-by: Paolo Abeni commit 196b2b95fec447c2c4460f753b277d840633fbef Author: Mel Henning Date: Thu Feb 19 15:05:54 2026 -0500 drm/nouveau: Add DRM_IOCTL_NOUVEAU_GET_ZCULL_INFO Add kernel-side support for using the zcull hardware in nvidia gpus. zcull aims to improve memory bandwidth by using an early approximate depth test, similar to hierarchical Z on an AMD card. Add a new ioctl that exposes zcull information that has been read from the hardware. Userspace uses each of these parameters either in a heuristic for determining zcull region parameters or in the calculation of a buffer size. It appears the hardware hasn't changed its structure for these values since FERMI_C (circa 2011), so the assumption is that it won't change on us too quickly, and is therefore reasonable to include in UAPI. This bypasses the nvif layer and instead accesses nvkm_gr directly, which mirrors existing usage of nvkm_gr_units(). There is no nvif object for nvkm_gr yet, and adding one is not trivial. Signed-off-by: Mel Henning Link: https://patch.msgid.link/20260219-zcull3-v3-2-dbe6a716f104@darkrefraction.com Signed-off-by: Danilo Krummrich commit 27e125e5568ae4185ffd97abe5b7851ce4f67fe5 Author: Mel Henning Date: Thu Feb 19 15:05:53 2026 -0500 drm/nouveau: Fetch zcull info from device This information will be exposed to userspace in the following commit. Add struct nvkm_gr_zcull_info, which serves as abstraction layer between the corresponding uAPI (added in a subsequent patch) and the firmware structure. Extend the existing get_ctxbufs callback to also fill in zcull info. ctxsw_size and ctxsw_align come from NV2080_CTRL_CMD_INTERNAL_STATIC_KGR_GET_CONTEXT_BUFFERS_INFO, which is already called by r570_gr_get_ctxbufs, while the rest of the zcull info comes from NV0080_CTRL_FIFO_GET_ENGINE_CONTEXT_PROPERTIES_ENGINE_ID_GRAPHICS_ZCULL. Adding a separate callback for zcull info would require us to either: 1) Call GET_CONTEXT_BUFFERS_INFO twice, once for each callback. This is a little slower and more verbose than calling it once. or 2) Fill out zcull_info partially in r570_gr_get_ctxbufs and partially in the new callback. Since we fill out only some of the info in each we now need to handle edge cases where one function is called but not the other as well as them being called in an arbitrary order. Because of this, it's simplest to combine them in a single call (get_ctxbufs_and_zcull_info), which avoids repeated rpc calls to the gpu without the complexity of handling partially complete states. Signed-off-by: Mel Henning Link: https://patch.msgid.link/20260219-zcull3-v3-1-dbe6a716f104@darkrefraction.com Signed-off-by: Danilo Krummrich commit e5a80f5e67ce95c41615471d89ae7412b298cd85 Author: Thorsten Blum Date: Mon Feb 23 08:41:34 2026 +0100 net: l2tp_eth: Replace deprecated strcpy with strscpy in l2tp_eth_create strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy(). Use the two-argument version of strscpy() to copy 'cfg->ifname'. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260223074137.321862-1-thorsten.blum@linux.dev Signed-off-by: Paolo Abeni commit 1f8fb2a87b58c2d12b7a9c817b8e781be90fe37d Author: Krzysztof Kozlowski Date: Tue Feb 24 13:27:40 2026 +0100 arm64: dts: axis: artpec9: Fix missing soc unit address Fix W=1 build warning to comply with Samsuung SoC maintainer profile: artpec9.dtsi:121.11-268.4: Warning (unit_address_vs_reg): /soc: node has a reg or ranges property, but no unit name Fixes: 3ae2b7442cb8 ("arm64: dts: exynos: axis: Add initial ARTPEC-9 SoC support") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260224122739.95168-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit f2f0587dcdecc29a8da59b1f0e720955f25ab015 Author: Krzysztof Kozlowski Date: Tue Dec 23 16:24:59 2025 +0100 ARM: dts: arm: Use lowercase hex The DTS code coding style expects lowercase hex for values and unit addresses. Signed-off-by: Krzysztof Kozlowski Acked-by: Sudeep Holla Acked-by: Vincenzo Frascino Link: https://patch.msgid.link/20251223152457.155392-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit b567d42112a2b38c186b37f7ffb2e36fc567e442 Author: Ravi Patel Date: Wed Nov 19 18:43:02 2025 +0530 arm64: dts: axis: Add ARTPEC-9 Alfred board support Add initial devcie tree for the ARTPEC-9 Alfred board. The ARTPEC-9 Alfred is a board developed by Axis, based on the Axis ARTPEC-9 SoC. Signed-off-by: SungMin Park Signed-off-by: Ravi Patel Link: https://patch.msgid.link/20251119131302.79088-4-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit 3ae2b7442cb878c8b38fc39855f89e47ba43c405 Author: SungMin Park Date: Wed Nov 19 18:43:01 2025 +0530 arm64: dts: exynos: axis: Add initial ARTPEC-9 SoC support Add initial device tree support for Axis ARTPEC-9 SoC. This SoC contains 6 Cortex-A55 CPUs and several other peripheral IPs. Signed-off-by: SungMin Park Signed-off-by: Ravi Patel Link: https://patch.msgid.link/20251119131302.79088-3-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit 7b43a16c48fe761480ddb0312e6727d0f5fb0b4a Author: Ravi Patel Date: Wed Nov 19 18:43:00 2025 +0530 dt-bindings: arm: axis: Add ARTPEC-9 alfred board Document the Axis ARTPEC-9 SoC binding and the alfred board which uses ARTPEC-9 SoC. Signed-off-by: Ravi Patel Acked-by: Conor Dooley Link: https://patch.msgid.link/20251119131302.79088-2-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit 85cc5be65b82481d9eb14afb6a6d52d5bde36cb0 Author: GyoungBo Min Date: Wed Oct 29 18:37:30 2025 +0530 clk: samsung: artpec-9: Add initial clock support for ARTPEC-9 SoC Add initial clock support for Axis ARTPEC-9 SoC which is required for enabling basic clock management. Add clock support for below CMU (Clock Management Unit) blocks in ARTPEC-9 SoC: - CMU_CMU - CMU_BUS - CMU_CORE - CMU_CPUCL - CMU_FSYS0 - CMU_FSYS1 - CMU_IMEM - CMU_PERI Signed-off-by: GyoungBo Min Signed-off-by: Ravi Patel Link: https://patch.msgid.link/20251029130731.51305-4-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit f051dc5bc8e785b221d2e69094e774507c3a52dd Author: GyoungBo Min Date: Wed Oct 29 18:37:29 2025 +0530 clk: samsung: Add clock PLL support for ARTPEC-9 SoC Add below clock PLL support for Axis ARTPEC-9 SoC platform: - pll_a9fracm: Integer PLL with mid frequency FVCO (800 to 6400 MHz) This is used in ARTPEC-9 SoC for shared PLL - pll_a9fraco: Integer/Fractional PLL with mid frequency FVCO (600 to 2400 MHz) This is used in ARTPEC-9 SoC for Audio PLL FOUT calculation for pll_a9fracm and pll_a9fraco: FOUT = (MDIV x FIN)/(PDIV x (SDIV + 1)) for integer PLL FOUT = (((MDIV + (KDIV/2^24)) x FIN)/(PDIV x (SDIV + 1)) for fractional PLL Signed-off-by: GyoungBo Min Reviewed-by: Kyunghwan Kim Signed-off-by: Ravi Patel Link: https://patch.msgid.link/20251029130731.51305-3-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit 6974ae5aa23b7f37182da6b66d7f58313a55a88e Author: GyoungBo Min Date: Wed Oct 29 18:37:28 2025 +0530 dt-bindings: clock: Add ARTPEC-9 clock controller Add dt-schema for Axis ARTPEC-9 SoC clock controller. The Clock Management Unit (CMU) has a top-level block CMU_CMU which generates clocks for other blocks. Add device-tree binding definitions for following CMU blocks: - CMU_CMU - CMU_BUS - CMU_CORE - CMU_CPUCL - CMU_FSYS0 - CMU_FSYS1 - CMU_IMEM - CMU_PERI Signed-off-by: GyoungBo Min Reviewed-by: Kyunghwan Kim Signed-off-by: Ravi Patel Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251029130731.51305-2-ravi.patel@samsung.com Signed-off-by: Krzysztof Kozlowski commit 8ac768bb198ccdb1b6dde4bb3616a115642de65c Author: Naveen Anandhan Date: Sun Feb 22 15:25:36 2026 +0530 selftests: tc-testing: preserve list order when removing duplicates Using set() removes duplicates but breaks ordering. Test output should be deterministic, so replace with dict.fromkeys(). Signed-off-by: Naveen Anandhan Link: https://patch.msgid.link/20260222095536.17371-1-mr.navi8680@gmail.com Signed-off-by: Paolo Abeni commit 951b8eee0581bbf39e7b0464d679eee8cb9da3e0 Author: Krzysztof Kozlowski Date: Thu Feb 19 12:27:12 2026 +0100 firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr Use __counted_by_ptr() attribute on the acpm_xfer buffers so UBSAN will validate runtime that we do not pass over the buffer size, thus making code safer. Usage of __counted_by_ptr() (or actually __counted_by()) requires that counter is initialized before counted array. Tested-by: Tudor Ambarus Reviewed-by: Tudor Ambarus Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260219-firmare-acpm-counted-v2-3-e1f7389237d3@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit 00808ae2e679a97dccc5cf0ee4474ba1e2e8a21a Author: Krzysztof Kozlowski Date: Thu Feb 19 12:27:11 2026 +0100 firmware: exynos-acpm: Count number of commands in acpm_xfer Struct acpm_xfer holds two buffers with u32 commands - rxd and txd - and counts their size by rxlen and txlen. "len" suffix is here ambiguous, so could mean length of the buffer or length of commands, and these are not the same since each command is u32. Rename these to rxcnt and txcnt, and change their usage to count the number of commands in each buffer. This will have a benefit of allowing to use __counted_by_ptr later. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Tudor Ambarus Link: https://patch.msgid.link/20260219-firmare-acpm-counted-v2-2-e1f7389237d3@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit 910e91a6496f7e0af80e945a6b850b589b90669e Author: Krzysztof Kozlowski Date: Thu Feb 19 12:27:10 2026 +0100 firmware: exynos-acpm: Use unsigned int for acpm_pmic_linux_errmap index acpm_pmic_to_linux_err() uses an unsigned integer obtained from messages as index of array to map them to error codes. Array index cannot be negative, so make that explicit. Reviewed-by: Tudor Ambarus Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260219-firmare-acpm-counted-v2-1-e1f7389237d3@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski commit 0a93f2355cf4922ad2399dbef5ea1049fef116d4 Author: Mikko Perttunen Date: Mon Jan 26 15:50:43 2026 +0900 memory: tegra30-emc: Fix dll_change check The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check. Fixes: e34212c75a68 ("memory: tegra: Introduce Tegra30 EMC driver") Signed-off-by: Mikko Perttunen Link: https://patch.msgid.link/20260126-fix-emc-dllchange-v1-2-47ad3bb63262@nvidia.com Signed-off-by: Krzysztof Kozlowski commit 9597ab9a8296ab337e6820f8a717ff621078b632 Author: Mikko Perttunen Date: Mon Jan 26 15:50:42 2026 +0900 memory: tegra124-emc: Fix dll_change check The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check. Fixes: 73a7f0a90641 ("memory: tegra: Add EMC (external memory controller) driver") Signed-off-by: Mikko Perttunen Link: https://patch.msgid.link/20260126-fix-emc-dllchange-v1-1-47ad3bb63262@nvidia.com Signed-off-by: Krzysztof Kozlowski commit ef4d7b9975d6d87a21574f98473945c8e499a0d2 Author: Thierry Reding Date: Fri Jan 16 13:37:32 2026 +0100 memory: tegra: Add support for DBB clock on Tegra264 The DBB clock is needed by many IP blocks in order to access system memory via the data backbone. The memory controller and external memory controllers are the central place where these accesses are managed, so make sure that the clock can be controlled from the corresponding driver. Note that not all drivers fully register bandwidth requests, and hence the EMC driver doesn't have enough information to know when it's safe to switch the clock off, so for now it will be kept on permanently. Signed-off-by: Thierry Reding Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260116123732.140813-1-thierry.reding@gmail.com Signed-off-by: Krzysztof Kozlowski commit 2865500db9339bff85a504c7fbad0047ebbf9331 Author: Randy Dunlap Date: Mon Feb 23 16:31:49 2026 -0800 RDMA/restrack: fix kernel-doc indicator Use "/**" to begin kernel-doc comments. This eliminates these kernel-doc warnings: Warning: include/rdma/restrack.h:123 struct member 'kref' not described in 'rdma_restrack_entry' Warning: include/rdma/restrack.h:123 struct member 'comp' not described in 'rdma_restrack_entry' (not adding missing return value kernel-doc descriptions) Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260224003149.3175815-1-rdunlap@infradead.org Signed-off-by: Leon Romanovsky commit 16dc2d72de577de4b413ba01b1b4a80d31832022 Author: Randy Dunlap Date: Mon Feb 23 16:31:34 2026 -0800 RDMA/iwcm: fix some kernel-doc issues in iw_cm.h Use the "typedef" keyword as needed. Correct 2 function parameter names. Warning: include/rdma/iw_cm.h:42 function parameter 'iw_cm_handler' not described in 'int' Warning: include/rdma/iw_cm.h:42 expecting prototype for iw_cm_handler(). Prototype was for int() instead Warning: include/rdma/iw_cm.h:53 function parameter 'iw_event_handler' not described in 'int' Warning: include/rdma/iw_cm.h:53 expecting prototype for iw_event_handler(). Prototype was for int() instead Warning: include/rdma/iw_cm.h:104 function parameter 'cm_handler' not described in 'iw_create_cm_id' Warning: include/rdma/iw_cm.h:158 function parameter 'private_data' not described in 'iw_cm_reject' (not adding missing return value kernel-doc descriptions) Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260224003134.3174856-1-rdunlap@infradead.org Signed-off-by: Leon Romanovsky commit ff46d1392750444fab5ae5a0194764ffdc4ac0d2 Author: Randy Dunlap Date: Mon Feb 23 16:31:20 2026 -0800 RDMA/umem: fix kernel-doc warnings Add or correct kernel-doc comments to eliminate warnings: Warning: include/rdma/ib_umem.h:104 function parameter 'biter' not described in 'rdma_umem_for_each_dma_block' Warning: include/rdma/ib_umem.h:140 function parameter 'pgsz_bitmap' not described in 'ib_umem_find_best_pgoff' Warning: include/rdma/ib_umem.h:141 No description found for return value of 'ib_umem_find_best_pgoff' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260224003120.3173892-1-rdunlap@infradead.org Signed-off-by: Leon Romanovsky commit 2ecd012774bc2342f28f47620100a7ad9046f586 Author: Randy Dunlap Date: Mon Feb 23 16:31:06 2026 -0800 IB/cache: avoid kernel-doc warnings Use the correct function parameters names to eliminate kernel-doc warnings: Warning: include/rdma/ib_cache.h:47 function parameter 'device_handle' not described in 'ib_get_cached_pkey' Warning: include/rdma/ib_cache.h:89 function parameter 'port_active' not described in 'ib_get_cached_port_state' (not adding missing function return value descriptions) Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260224003106.3172916-1-rdunlap@infradead.org Signed-off-by: Leon Romanovsky commit 8eaff52fc101c1f6b3215db93bba02c815155806 Author: Koichiro Den Date: Thu Feb 19 23:56:33 2026 +0900 PCI: endpoint: pci-epf-vntb: Return -ERANGE for out-of-range MW index The mw1..mw4 configfs attributes are only valid when the MW index is within the configured num_mws range. Return -ERANGE instead of -EINVAL when a configfs MW size attribute is accessed with an out-of-range MW index. Suggested-by: Manivannan Sadhasivam Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260219145633.4191325-1-den@valinux.co.jp commit 26cd5ca272a44031c4ff381928aa1b816829d18d Author: Koichiro Den Date: Mon Jan 5 16:56:06 2026 +0900 PCI: endpoint: pci-epf-vntb: Use array_index_nospec() on mws_size[] access Follow common kernel idioms for indices derived from configfs attributes and suppress Smatch warnings: epf_ntb_mw1_show() warn: potential spectre issue 'ntb->mws_size' [r] epf_ntb_mw1_store() warn: potential spectre issue 'ntb->mws_size' [w] Also fix the error message for out-of-range MW indices and %lld format for unsigned values. Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Link: https://patch.msgid.link/20260105075606.1253697-1-den@valinux.co.jp commit f457c18d7904b22f8b6a9c6475161810085c34c9 Author: Christophe JAILLET Date: Mon Dec 29 12:13:29 2025 +0100 PCI: endpoint: Constify struct configfs_item_operations and configfs_group_operations 'struct configfs_item_operations' and 'configfs_group_operations' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 27503 12184 256 39943 9c07 drivers/pci/endpoint/pci-ep-cfs.o After: ===== text data bss dec hex filename 27855 11832 256 39943 9c07 drivers/pci/endpoint/pci-ep-cfs.o Signed-off-by: Christophe JAILLET Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/f1f05f1c10c6caf37dd620fa12f508c53536996b.1765705512.git.christophe.jaillet@wanadoo.fr commit b4a31737679576dc8aa6de43d3c10bfad7d3f57e Author: Koichiro Den Date: Mon Feb 16 00:03:34 2026 +0900 selftests: pci_endpoint: Skip doorbell test when unsupported PCITEST_DOORBELL may return -EOPNOTSUPP when the endpoint does not advertise CAP_DYNAMIC_INBOUND_MAPPING. Treat this like other optional capabilities and skip the doorbell test instead of reporting a failure. Suggested-by: Niklas Cassel Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260215150334.3391943-4-den@valinux.co.jp commit 51fba4aa66192fa65a31f213218167d9af326f1e Author: Koichiro Den Date: Mon Feb 16 00:03:33 2026 +0900 misc: pci_endpoint_test: Gate doorbell test on dynamic inbound mapping The doorbell test relies on the endpoint being able to update inbound translations at runtime so the host can reach the doorbell target through a BAR mapping. If the endpoint does not advertise CAP_DYNAMIC_INBOUND_MAPPING, return -EOPNOTSUPP from PCITEST_DOORBELL. This avoids confusing failures in user space and kselftests when the required capability is not available. Suggested-by: Niklas Cassel Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260215150334.3391943-3-den@valinux.co.jp commit 9a940a3d08b25cf8e864785ee06b65756d6e4573 Author: Koichiro Den Date: Mon Feb 16 00:03:32 2026 +0900 PCI: endpoint: pci-epf-test: Advertise dynamic inbound mapping support The doorbell test requires the EPC driver to support dynamic inbound mapping so the host can map the doorbell target address into a BAR aperture. Expose epc_features->dynamic_inbound_mapping via a new CAP_DYNAMIC_INBOUND_MAPPING bit in the pci-epf-test capability register, so the host-side pci_endpoint_test driver can detect missing support and return -EOPNOTSUPP instead of running the test fruitlessly. Suggested-by: Niklas Cassel Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260215150334.3391943-2-den@valinux.co.jp commit 1cba96c0a795124c3229293ed7b5b5765e66f259 Author: Koichiro Den Date: Tue Feb 17 15:38:56 2026 +0900 PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc pci_epf_alloc_doorbell() stores the allocated doorbell message array in epf->db_msg/epf->num_db before requesting MSI vectors. If MSI allocation fails, the array is freed but the EPF state may still point to freed memory. Clear epf->db_msg and epf->num_db on the MSI allocation failure path so that later cleanup cannot double-free the array and callers can retry allocation. Also return -EBUSY when doorbells have already been allocated to prevent leaking or overwriting an existing allocation. Fixes: 1c3b002c6bf6 ("PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller") Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260217063856.3759713-4-den@valinux.co.jp commit e81fa70179aac6ac3a6636565d5d35968dca3900 Author: Koichiro Den Date: Tue Feb 17 15:38:55 2026 +0900 PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested pci_epf_test_doorbell_cleanup() unconditionally calls free_irq() for the doorbell virq, which can trigger "Trying to free already-free IRQ" warnings when the IRQ was never requested or when request_threaded_irq() failed. Move free_irq() out of pci_epf_test_doorbell_cleanup() and invoke it only after a successful request, so that free_irq() is not called for an unrequested IRQ. Fixes: eff0c286aa91 ("PCI: endpoint: pci-epf-test: Add doorbell test support") Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260217063856.3759713-3-den@valinux.co.jp commit cc04f2bfb9dae60b6e34d6bff75c26d4ec3237ce Author: Koichiro Den Date: Tue Feb 17 15:38:54 2026 +0900 PCI: endpoint: pci-epf-vntb: Fix MSI doorbell IRQ unwind epf_ntb_db_bar_init_msi_doorbell() requests ntb->db_count doorbell IRQs and then performs additional MSI doorbell setup that may still fail. The error path unwinds the requested IRQs, but it uses a loop variable that is reused later in the function. When a later step fails, the unwind can run with an unexpected index value and leave some IRQs requested. Track the number of successfully requested IRQs separately and use that counter for the unwind so all previously requested IRQs are freed on failure. Fixes: dc693d606644 ("PCI: endpoint: pci-epf-vntb: Add MSI doorbell support") Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260217063856.3759713-2-den@valinux.co.jp commit f3f9825837dfdc90dd19251be1a8189038e0ff40 Author: Evan Green Date: Fri Feb 20 10:55:04 2026 -0800 RDMA/rxe: Generate async error for r_key violations Table 63 of the IBTA spec lists R_Key violations as a class C error. 9.9.3.1.3 Responder Class C Fault Behavior indicates an affiliated asynchronous error should be generated at the responder if the error can be associated to a QP but not a particular RX WQE. Relevant portion of the spec: C9-222.1.1: For an HCA responder using Reliable Connection service, for a Class C responder side error, the error shall be reported to the requester by generating the appropriate NAK code as specified in Table 63 Responder Error Behavior Summary on page 448. If the error can be related to a particular QP but cannot be related to a particular WQE on that receive queue (e.g. the error occurred while executing an RDMA Write Request without immediate data), the error shall be reported to the responder’s client as an Affiliated Asynchronous error. See Section 10.10.2.3 Asynchronous Errors on page 576 for details. If the error can be related to a particular WQE on a given receive queue, the QP shall be placed into the error state and the error shall be reported to the responder’s client as a Completion error. Generate an affiliated asynchronous error upon Rkey violations if the opcode does not carry an immediate. This causes async events at the responder for all ops that generate R_Key violations except WRITE_WITH_IMM, where the error can ride in with the RX WQE. Signed-off-by: Evan Green Link: https://patch.msgid.link/20260220185533.252759-1-evgreen@meta.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 61c0f69a2ff79c8f388a9e973abb4853be467127 Author: Mark Brown Date: Mon Feb 23 18:27:51 2026 +0000 RDMA/uverbs: Update for semantic conflict with drm-misc /tmp/next/build/drivers/infiniband/core/ib_core_uverbs.c: In function 'rdma_user_mmap_entry_remove': /tmp/next/build/drivers/infiniband/core/ib_core_uverbs.c:249:17: error: implicit declaration of function 'dma_buf_move_notify' [-Wimplicit-function-declaration] 249 | dma_buf_move_notify(uverbs_dmabuf->dmabuf); | ^~~~~~~~~~~~~~~~~~~ Signed-off-by: Mark Brown Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/aZyhDuaF5vi05KBY@sirena.org.uk commit 5978ff33cc6f0988388a2830dc5cd2ea4e81f36a Author: Rafał Miłecki Date: Tue Feb 24 09:25:41 2026 +0100 ARM: dts: mediatek: mt7623: fix efuse fallback compatible Fix following validation error: arch/arm/boot/dts/mediatek/mt7623a-rfb-emmc.dtb: efuse@10206000: compatible: 'oneOf' conditional failed, one must be fixed: ['mediatek,mt7623-efuse', 'mediatek,mt8173-efuse'] is too long 'mediatek,mt8173-efuse' was expected 'mediatek,efuse' was expected from schema $id: http://devicetree.org/schemas/nvmem/mediatek,efuse.yaml# arch/arm/boot/dts/mediatek/mt7623a-rfb-emmc.dtb: efuse@10206000: Unevaluated properties are not allowed ('compatible' was unexpected) from schema $id: http://devicetree.org/schemas/nvmem/mediatek,efuse.yaml# Fixes: 43c7a91b4b3a ("arm: dts: mt7623: add efuse nodes to the mt7623.dtsi file") Signed-off-by: Rafał Miłecki Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit d51b7191f2072e11259edd2bff88385891d0ae56 Author: Luca Leonardo Scorcia Date: Mon Feb 23 16:22:45 2026 +0000 arm64: dts: mt8167: Reorder nodes according to mmio address In preparation for adding display nodes. No other changes. Signed-off-by: Luca Leonardo Scorcia Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit 6a4a4c1cc0012590b8bebf6c95d51687d39b420c Merge: 26fd3865e42f3b 901084c51a0a8f Author: Ulf Hansson Date: Tue Feb 24 10:32:56 2026 +0100 mmc: Merge branch fixes into next Merge the mmc fixes for v7.0-rc[n] into the next branch, to allow them to get tested together with the mmc changes that are targeted for the next release. Signed-off-by: Ulf Hansson commit 26fd3865e42f3bd3f17f6c3ca36b40d2b90a7254 Author: Brian Masney Date: Sun Feb 22 18:39:14 2026 -0500 mmc: sdhci-pic32: allow driver to be compiled with COMPILE_TEST This driver currently only supports builds against a PIC32 target. Now that commit d6618d277c1a ("mmc: sdhci-pic32: update include to use pic32.h from platform_data") is merged, it's possible to compile this driver on other architectures. To avoid future breakage of this driver in the future, let's update the Kconfig so that it can be built with COMPILE_TEST enabled on all architectures. Signed-off-by: Brian Masney Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit b13b3203be1a9b5eabe407c1027ea16688e07cb5 Author: Brian Masney Date: Sun Feb 22 18:39:13 2026 -0500 mmc: sdhci-pic32: add SPDX license identifier Add the missing SPDX license identifier to the top of the file, and drop the boiler plate license text. Signed-off-by: Brian Masney Cc: linux-spdx@vger.kernel.org Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit ad1aec8f15bf966d9f1d3fbca9fa878ff6d824a4 Author: Shawn Lin Date: Wed Feb 11 22:00:34 2026 +0800 mmc: dw_mmc: Rename dw_mci_pltfm_pmops to dw_mci_pmops Since it's moved to dw_mmc core and resued by others variant host drivers, so drop the pltfm notation. Suggested-by: Ulf Hansson Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 517b1e3c9455698b5ce7fc479aa0b91731e5d9fa Author: Fabio Estevam Date: Sat Feb 7 10:10:41 2026 -0300 dt-bindings: mmc: rockchip-dw-mshc: Add RV1103B compatible The RV1103B uses the DesignWare MSHC controller compatible with the existing Rockchip RK3288 variant. Add the rockchip,rv1103b-dw-mshc compatible string. Signed-off-by: Fabio Estevam Reviewed-by: Heiko Stuebner Acked-by: Krzysztof Kozlowski Reviewed-by: Shawn Lin Signed-off-by: Ulf Hansson commit 0b02521bbc77b36980ccd77a7f058c333de19754 Author: SriNavmani A Date: Fri Feb 6 16:23:08 2026 +0800 mmc: sdhci-of-arasan: add support on Axiado AX3000 SoC Axiado AX3000 SoC eMMC controller is based on Arasan eMMC 5.1 host controller IP. Signed-off-by: SriNavmani A Signed-off-by: Tzu-Hao Wei Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 7d608bea4adab7869450442e7985b09fdc84117e Author: SriNavmani A Date: Fri Feb 6 16:23:07 2026 +0800 dt-bindings: mmc: arasan,sdhci: Add Axiado AX3000 SoC Add compatible strings for Axiado AX3000 SoC eMMC controller which is based on Arasan eMMC controller. Signed-off-by: SriNavmani A Signed-off-by: Tzu-Hao Wei Acked-by: Rob Herring (Arm) Signed-off-by: Ulf Hansson commit d91639d0ab3223b61c00442021dc639c9ddc2b76 Author: David Lechner Date: Thu Feb 19 16:55:29 2026 -0600 arm64: dts: mediatek: mt6359: give regulators unique names Change the regulator-name properties to be unique for all regulators. U-Boot cannot handle duplicate names. Signed-off-by: David Lechner Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit 97720432b093e28123c78d39030c8680114b885d Author: Ethan Nelson-Moore Date: Fri Jan 30 18:00:38 2026 -0800 mmc: host: Remove unnecessary module_init/exit functions Three MMC drivers have unnecessary module_init and module_exit functions that are empty or just print a message. Remove them. Note that if a module_init function exists, a module_exit function must also exist; otherwise, the module cannot be unloaded. Signed-off-by: Ethan Nelson-Moore Acked-by: Shawn Lin Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 0651c24658360706c30588cec0a12c05edb03e9a Author: Nícolas F. R. A. Prado Date: Fri May 2 12:43:22 2025 -0400 arm64: dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon The infracfg-nao register space at 0x1020e000 has different registers than the infracfg space at 0x10001000, and most importantly, doesn't contain any clock controls. Therefore it shouldn't use the same compatible used for the mt8365 infracfg clocks driver: mediatek,mt8365-infracfg. Since it currently does, probe errors are reported in the kernel logs: [ 0.245959] Failed to register clk ifr_pmic_tmr: -EEXIST [ 0.245998] clk-mt8365 1020e000.infracfg: probe with driver clk-mt8365 failed with error -17 This register space is used only as a syscon for bus control by the power domain controller, so in order to properly describe it and fix the errors, set its compatible to a distinct compatible used exclusively as a syscon, drop the clock-cells, and while at it rename the node to 'syscon' following the naming convention. Fixes: 6ff945376556 ("arm64: dts: mediatek: Initial mt8365-evk support") Signed-off-by: Nícolas F. R. A. Prado Reviewed-by: David Lechner Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit eaa699ee20847335d57216b4e0b779c762f544d8 Author: Louis-Alexis Eyraud Date: Wed Feb 18 10:23:04 2026 +0100 arm64: dts: mediatek: mt8365-evk: add mmc aliases Add aliases for mmc nodes, so that the eMMC and SDCard host controllers get enumerated in a consistent order for the Mediatek Genio 350-EVK board. Also, reorder serial0 so all aliases are sorted alphanumerically. Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit 4d580d122bb52efd4a7e5e93d61c066bb850c06f Author: Louis-Alexis Eyraud Date: Wed Feb 18 10:23:03 2026 +0100 arm64: dts: mediatek: mt8395-radxa-nio-12l: add mmc aliases Add aliases for mmc nodes, so that the eMMC and SDCard host controllers get enumerated in a consistent order for the Radxa NIO-12L board. Also, reorder ethernet0 so all aliases are sorted alphanumerically. Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit addd3eaf5330d4b5bde930b89f7c7f3310dd9bf5 Author: Louis-Alexis Eyraud Date: Wed Feb 18 10:23:02 2026 +0100 arm64: dts: mediatek: mt8395-genio-common: add mmc aliases Add aliases for mmc nodes, so that the eMMC and SDCard host controllers get enumerated in a consistent order for the Mediatek Genio 1200-EVK board. Also, reorder serial0 so all aliases are sorted alphanumerically. Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit beb60276eb3a488d8154fc498ed11270bcfe979f Author: Chen-Yu Tsai Date: Tue Feb 24 15:03:05 2026 +0800 arm64: dts: mediatek: mt8195-cherry: Disable xhci1 completely There is nothing connected to xhci1 in this design, nor in the actual end devices. Disable xhci1. Keep the USB PHY enabled, as it is a shared PHY and used for pcie1. Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit 575f0bcd2d64e12bbe8f1f28d4f287a8872f2012 Author: Brian Masney Date: Sun Feb 22 18:33:31 2026 -0500 pinctrl: pic32: allow driver to be compiled with COMPILE_TEST This driver currently only supports builds against a PIC32 target. Now that commit b8694faa1a0f ("pinctrl: pic32: update include to use pic32.h from platform_data") is merged, it's possible to compile this driver on other architectures. To avoid future breakage of this driver in the future, let's update the Kconfig so that it can be built with COMPILE_TEST enabled on all architectures. Signed-off-by: Brian Masney Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 8932547b4b28d2d1ec95f7d0bb5f9011a24dcfc7 Author: Brian Masney Date: Sun Feb 22 18:33:30 2026 -0500 pinctrl: pic32: use consistent spacing around '+' Address the following warning from checkpatch.pl: ERROR: need consistent spacing around '+' (ctx:WxV) Fixes: 2ba384e6c3810 ("pinctrl: pinctrl-pic32: Add PIC32 pin control driver") Signed-off-by: Brian Masney Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit f10f6fca875e8360de7dd40652f5076234ea7a9d Author: Brian Masney Date: Sun Feb 22 18:33:29 2026 -0500 pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' Address the following warning from checkpatch.pl: WARNING: Prefer 'unsigned int' to bare use of 'unsigned' Fixes: 2ba384e6c3810 ("pinctrl: pinctrl-pic32: Add PIC32 pin control driver") Signed-off-by: Brian Masney Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit af5e323bd9a94756c5b2b4e200d0232cf85431cd Author: Frank Li Date: Wed Feb 11 16:00:01 2026 -0500 dt-bindings: pinctrl: imx35: add compatible string fsl,imx25-iomuxc Add compatible string fsl,imx25-iomuxc. Signed-off-by: Frank Li Acked-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit 8dba7a13a4142069b3586c5514453fa460cc8b6c Author: Frank Li Date: Wed Feb 11 16:00:00 2026 -0500 dt-bindings: pinctrl: convert fsl,imx27-pinctrl.txt to YAML Convert fsl,imx27-pinctrl.txt to YAML format. Additional changes: - Add the compatible string "fsl,imx1-iomuxc". - Add gpio@... child nodes. - Add ranges property. - Remove the redundant intermediate node between pinmux and group nodes. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Signed-off-by: Linus Walleij commit 7a29f373251e4d722a883184d4eab3bd763bb628 Author: Krzysztof Kozlowski Date: Tue Feb 17 13:57:36 2026 +0100 pinctrl: qcom: De-acronymize Glymur SoC name Glymur is a codename of Qualcomm SoC, not an acronym. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Linus Walleij commit 6f26989e15fbabe3cdcc9afd25fca6ef99ed4dc4 Author: Abel Vesa Date: Mon Feb 16 15:44:04 2026 +0200 pinctrl: qcom: Add Eliza pinctrl driver Add pinctrl driver for TLMM block found in the Eliza SoC. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Bjorn Andersson Signed-off-by: Abel Vesa Signed-off-by: Linus Walleij commit a7f8f004c6e61a584d1b42c74849af2db44db801 Author: Abel Vesa Date: Mon Feb 16 15:44:03 2026 +0200 dt-bindings: pinctrl: document the Eliza Top Level Mode Multiplexer Document the Top Level Mode Multiplexer on the Eliza Platform. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Signed-off-by: Abel Vesa Signed-off-by: Linus Walleij commit 0e129487c36b271e279eeafc186bd9a3e5756ac6 Author: Vignesh Raghavendra Date: Thu Feb 12 15:38:09 2026 -0600 pinctrl: pinctrl-single: add ti,am62l-padconf compatible string Add "ti,am62l-padconf" compatible string for the AM62L SoC, which requires register configurations to be restored during system resume after suspend to RAM (RTC only + DDR mode). This reuses the j7200 configuration which includes the PCS_CONTEXT_LOSS_OFF flag needed for proper restoration. Signed-off-by: Vignesh Raghavendra Signed-off-by: Kendall Willis Reviewed-by: Dhruva Gole Signed-off-by: Linus Walleij commit dc71d92f0d36dcb68fcf0ef126131a2dedef9393 Author: Ovidiu Panait Date: Sun Jan 25 19:27:01 2026 +0000 clk: renesas: r9a09g056: Fix ordering of module clocks array The r9a09g056_mod_clks array is sorted by CPG_CLKON register number and bit position. Move the RSPI 0/1/2 module clock entries to their correct position to restore the array sort order. Fixes: 1f76689d1715 ("clk: renesas: r9a09g056: Add entries for RSCIs") Signed-off-by: Ovidiu Panait Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260125192706.27099-2-ovidiu.panait.rb@renesas.com Signed-off-by: Geert Uytterhoeven commit 79cac2b8dc1d9f63fbf6c6793e423052118cc51a Author: Ovidiu Panait Date: Sun Jan 25 19:03:14 2026 +0000 clk: renesas: r9a09g057: Fix ordering of module clocks array The r9a09g057_mod_clks array is sorted by CPG_CLKON register number and bit position. Move the RTC and RSPI module clock entries to their correct position to restore the array sort order. Fixes: 2efea3b35cc9 ("clk: renesas: r9a09g057: Add entries for RSCIs") Signed-off-by: Ovidiu Panait Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260125190314.26729-1-ovidiu.panait.rb@renesas.com Signed-off-by: Geert Uytterhoeven commit bc47b2e823914966c15a09422f8fc3aa98d34c1b Author: Ryota Sakamoto Date: Mon Feb 23 15:23:24 2026 +0900 time/kunit: Add .kunitconfig Add .kunitconfig file to the time directory to enable easy execution of KUnit tests. With the .kunitconfig, developers can run the tests: $ ./tools/testing/kunit/kunit.py run --kunitconfig kernel/time Also, add the new .kunitconfig file to the TIMEKEEPING section in the MAINTAINERS file. Signed-off-by: Ryota Sakamoto Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260223-add-time-kunitconfig-v1-1-1801eeb33ece@gmail.com commit ecfa23b486b22844855844202424bc1966cebb33 Author: Petr Pavlu Date: Tue Feb 17 12:26:15 2026 +0100 jiffies: Remove unused __jiffy_arch_data The __jiffy_arch_data definition was added in 2017 by commit 60b0a8c3d248 ("frv: declare jiffies to be located in the .data section") for the needs of the frv port. The frv support was removed in 2018 by commit fd8773f9f544 ("arch: remove frv port") and no other architecture has required __jiffy_arch_data. Therefore, remove this unused definition. Signed-off-by: Petr Pavlu Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260217112638.1525094-1-petr.pavlu@suse.com commit ef2964f11e9f24b4681b52161cc37ba1a226d5af Author: Deborah Brouwer Date: Mon Feb 23 12:38:33 2026 -0800 drm/tyr: Use vertical style for imports Currently Tyr uses rustfmt style for imports, but the kernel uses a vertical layout that makes it easier to resolve conflicts and rebase. Import guidelines are documented here: https://docs.kernel.org/rust/coding-guidelines.html#imports Change all of Tyr's imports to use the vertical layout. This will ease the introduction of additional Tyr patches upstream. There should be no functional changes in this patch. Reviewed-by: Boris Brezillon Signed-off-by: Deborah Brouwer Link: https://patch.msgid.link/20260223203833.207955-1-deborah.brouwer@collabora.com Signed-off-by: Alice Ryhl commit 289cf6f9145913590f74f8d00a4a23e4e9be75bb Author: Onur Özkan Date: Tue Feb 10 21:38:12 2026 +0300 drm/tyr: gpu: fix GpuInfo::log model/version decoding GpuInfo::log() was decoding GPU_ID like this: major = (self.gpu_id >> 16) & 0xff; minor = (self.gpu_id >> 8) & 0xff; status = self.gpu_id & 0xff; That does not match the Mali GPU_ID layout and mixes unrelated fields. Due to that, model detection becomes `mali-unknown` on rk3588s which is wrong. We can already get all the version information with a single GpuId::from call (less code and cleaner), so this patch uses it. Also renamed `GpuModels` fields from `major/minor` to `arch_major/prod_major` to reflect their real meaning. This change was tested on Orange Pi 5 (rk3588s) board and the results are as follows: Before this change: $ dmesg | grep 'tyr' [ 19.698338] tyr fb000000.gpu: mali-unknown id 0xa867 major 0x67 minor 0x0 status 0x5 [ 19.699050] tyr fb000000.gpu: Features: L2:0x7120306 Tiler:0x809 Mem:0x301 MMU:0x2830 AS:0xff [ 19.699817] tyr fb000000.gpu: shader_present=0x0000000000050005 l2_present=0x0000000000000001 tiler_present=0x0000000000000001 [ 19.702493] tyr fb000000.gpu: Tyr initialized correctly. After this change: $ dmesg | grep 'tyr' [ 19.591692] tyr fb000000.gpu: mali-g610 id 0xa867 major 0x0 minor 0x0 status 0x5 [ 19.592374] tyr fb000000.gpu: Features: L2:0x7120306 Tiler:0x809 Mem:0x301 MMU:0x2830 AS:0xff [ 19.593141] tyr fb000000.gpu: shader_present=0x0000000000050005 l2_present=0x0000000000000001 tiler_present=0x0000000000000001 [ 19.595831] tyr fb000000.gpu: Tyr initialized correctly. Signed-off-by: Onur Özkan Reviewed-by: Boris Brezillon Tested-by: Alvin Sun Link: https://patch.msgid.link/20260210183812.261142-1-work@onurozkan.dev Signed-off-by: Alice Ryhl commit aa80869b77e16d30ce69523528c63a2e2b050634 Author: Thomas Gleixner Date: Tue Feb 3 22:05:44 2026 +0100 irqchip/msi-lib: Refuse initialization when irq_write_msi_msg() is missing MSI parent domains rely on the fact that the top level device domain provides a irq_write_msi_msg() callback. Check for that and if missing warn and refuse to initialize the device domain. Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/87a4xp35cn.ffs@tglx commit 4b52df1b4e1d9cf4cb5a8e1b5287d1e3d1a6aa0c Author: Brian Masney Date: Sun Feb 22 18:43:48 2026 -0500 irqchip/irq-pic32-evic: Allow driver to be compiled with COMPILE_TEST This driver currently only supports builds against a PIC32 target. To avoid future breakage in the future update Kconfig so that it can be built with COMPILE_TEST enabled. [ tglx: Drop the now pointless select in the pic32 Kconfig ] Signed-off-by: Brian Masney Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260222-irqchip-pic32-v1-5-37f50d1f14af@redhat.com commit 6096f427ed8efff6198f2330f1756f9381c8a8ec Author: Brian Masney Date: Sun Feb 22 18:43:47 2026 -0500 irqchip/irq-pic32-evic: Only include asm headers when compiling for MIPS The asm headers are not actually needed when compiling on architectures other than MIPS, and traps.h is not available on all architectures. Include them on MIPS systems so that this driver can be compiled on other architectures. [ tglx: Massaged change log ] Signed-off-by: Brian Masney Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260222-irqchip-pic32-v1-4-37f50d1f14af@redhat.com commit 282f8b547d51d8a33b9230ba58e2324babe0a96a Author: Brian Masney Date: Sun Feb 22 18:43:46 2026 -0500 irqchip/irq-pic32-evic: Define board_bind_eic_interrupt for !MIPS builds The board_bind_eic_interrupt() pointer is MIPS specific. When compiling for other architectures it is undefined which breaks the build. Define it as a static variable when building for non MIPS architectures with COMPILE_TEST. Signed-off-by: Brian Masney Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260222-irqchip-pic32-v1-3-37f50d1f14af@redhat.com commit 15f9b251fe404997eef1d7685877479364c4cfcb Author: Brian Masney Date: Sun Feb 22 18:43:45 2026 -0500 irqchip/irq-pic32-evic: Don't define plat_irq_dispatch() for !MIPS builds plat_irq_dispatch() is specific to the MIPS architecture, so only include it when the driver is compiled on that architecture. This is in preparation for allowing this driver to be compiled on all architectures. Signed-off-by: Brian Masney Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260222-irqchip-pic32-v1-2-37f50d1f14af@redhat.com commit 86be659415b0ddefebc3120e309091aa215a9064 Author: Brian Masney Date: Sun Feb 22 18:43:44 2026 -0500 irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter This driver is currently only build on 32 bit MIPS systems. When building it on x86_64, the following warning occurs: drivers/irqchip/irq-pic32-evic.c: In function ‘pic32_ext_irq_of_init’: ./include/linux/kern_levels.h:5:25: error: format ‘%d’ expects argument of type ‘int’, but argument 2 has type ‘long unsigned int’ [-Werror=format=] Update the printf() formatter in preparation for allowing this driver to be compiled on all architectures. Fixes: aaa8666ada780 ("IRQCHIP: irq-pic32-evic: Add support for PIC32 interrupt controller") Signed-off-by: Brian Masney Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260222-irqchip-pic32-v1-1-37f50d1f14af@redhat.com commit 8813837aa7f5f5a262a5ebc1a1a2a3a5ec818c70 Author: Massimiliano Pellizzer Date: Tue Jan 20 15:24:05 2026 +0100 apparmor: return error on namespace mismatch in verify_header When profiles in a multi-profile load specify different namesapaces, the audit record is generated but execution continues, causing the function to return success. This violates the load requirement that all profiles must target the same namespace. Add the missing return statement after auditing the error. Reported-by: Qualys Security Advisory Fixes: dd51c8485763 ("apparmor: provide base for multiple profiles to be replaced at once") Signed-off-by: Massimiliano Pellizzer Signed-off-by: John Johansen commit 4afc61702bdcc3b9b519749ef966cf762a6e7051 Author: Cengiz Can Date: Tue Feb 10 11:17:14 2026 +0300 apparmor: use target task's context in apparmor_getprocattr() apparmor_getprocattr() incorrectly calls task_ctx(current) instead of task_ctx(task) when retrieving prev and exec attributes, returning the caller's labels rather than the target's. Fix by passing task to task_ctx(). The issue can be reproduced when a process with an onexec transition (e.g., configured by a container runtime) is inspected via /proc//attr/apparmor/exec. The reader's own value is returned instead of the target's. Reported-by: Qualys Security Advisory Fixes: 3b529a7600d8 ("apparmor: move task domain change info to task security") Cc: stable@vger.kernel.org Co-developed-by: Cengiz Can Signed-off-by: Cengiz Can Co-developed-by: John Johansen Signed-off-by: John Johansen commit cc27314c67516c138ee3829197d1c3b998e29fae Author: Koen Koning Date: Fri Feb 13 16:20:47 2026 +0100 gpu: Fix uninitialized buddy for built-in drivers Move buddy to the start of the link order, so its __init runs before any other built-in drivers that may depend on it. Otherwise, a built-in driver that tries to use the buddy allocator will run into a kernel NULL pointer dereference because slab_blocks is uninitialized. Specifically, this fixes drm/xe (as built-in) running into a kernel panic during boot, because it uses buddy during device probe. Fixes: ba110db8e1bc ("gpu: Move DRM buddy allocator one level up (part two)") Cc: Joel Fernandes Cc: Dave Airlie Cc: intel-xe@lists.freedesktop.org Reviewed-by: Dave Airlie Tested-by: Peter Senna Tschudin Signed-off-by: Koen Koning Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260213152047.179628-1-koen.koning@linux.intel.com commit 24e2e6581d602f75174010b32bf3e96ec39465ab Author: Arun R Murthy Date: Mon Feb 16 10:29:40 2026 +0530 drm/i915/lt_phy_regs: Add SoC/OS turnaround time On top the timeouts mentioned in the spec which includes only the PHY timeouts include the SoC and the OS turnaround time. The overhead value is based on the stress test results with multiple available panels. Signed-off-by: Arun R Murthy Reviewed-by: Suraj Kandpal Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260216-timeout-v3-2-055522c22560@intel.com commit 122439234f6ae2583a3701d7619f9a8242748547 Author: Arun R Murthy Date: Mon Feb 16 10:29:39 2026 +0530 drm/i915/cx0_phy_regs: Include SoC and OS turnaround time The port refclk enable timeout and the soc ready timeout value mentioned in the spec is the PHY timings and doesn't include the turnaround time from the SoC or OS. So add an overhead timeout value on top of the recommended timeouts from the PHY spec. The overhead value is based on the stress test results with multiple available panels. Reported-by: Cole Leavitt Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14713 Signed-off-by: Arun R Murthy Reviewed-by: Suraj Kandpal Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260216-timeout-v3-1-055522c22560@intel.com commit 055d8dd55302927e5b12d7ad4406730aba9f3f75 Author: Amery Hung Date: Thu Feb 19 14:58:49 2026 -0800 selftests/bpf: Update task local data license Change the license of task local data mini library to LGPL-2.1 or BSD-2-Clause to allow it being in a wider range of projects. Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260219225849.2426421-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 99726ece0c8ada4646f6bc68014b8d5676689d29 Author: Abhishek Dubey Date: Mon Feb 23 15:35:11 2026 -0500 selftests/bpf: Enable test for instruction array on arm64 As arm64 JIT now supports instruction array, make sure all relevant tests run on this architecture. Summary: 1/9 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Abhishek Dubey Acked-by: Anton Protopopov Link: https://lore.kernel.org/r/20260223203511.118475-1-adubey@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 0d6bc03d73673ad54945c0f7d7ee2f4e3979c2a5 Merge: 3ecf0b4a0e0ed4 ed8fa4b8894f7e Author: Alexei Starovoitov Date: Mon Feb 23 17:37:06 2026 -0800 Merge branch 'bpf-expand-the-usage-scenarios-of-bpf_kptr_xchg' Kaitao Cheng says: ==================== When using bpf_kptr_xchg, we triggered the following error: 31: (85) call bpf_kptr_xchg#194 function calls are not allowed while holding a lock bpf_kptr_xchg can now be used in lock-held contexts, so we extended its usage scope in [patch 1/5]. When writing test cases using bpf_kptr_xchg and bpf_rbtree_*, the following approach must be followed: bpf_spin_lock(&lock); rb_n = bpf_rbtree_root(&root); while (rb_n && can_loop) { rb_n = bpf_rbtree_remove(&root, rb_n); if (!rb_n) goto fail; tnode = container_of(rb_n, struct tree_node, node); node_data = bpf_kptr_xchg(&tnode->node_data, NULL); if (!node_data) goto fail; data = node_data->data; /* use data to do something */ node_data = bpf_kptr_xchg(&tnode->node_data, node_data); if (node_data) goto fail; bpf_rbtree_add(&root, rb_n, less); if (lookup_key < tnode->key) rb_n = bpf_rbtree_left(&root, rb_n); else rb_n = bpf_rbtree_right(&root, rb_n); } bpf_spin_unlock(&lock); The above illustrates a lock-remove-read-add-unlock workflow, which exhibits lower performance. To address this, we introduced support for a streamlined lock-read-unlock operation in [patch 2/5] and [patch 4/5]. Changes in v7: - Add a comma to the variable declaration in enum bpf_reg_type - Modify the prefixes Changes in v6: - allow using bpf_kptr_xchg even if the MEM_RCU flag is set - Add test case Changes in v5: - add lastname Changes in v4: - Fix the dead logic issue in the test case Changes in v3: - Fix compilation errors Changes in v2: - Allow using bpf_kptr_xchg even if the NON_OWN_REF flag is set - Add test case Link to v6: https://lore.kernel.org/all/20260208024846.18653-1-pilgrimtao@gmail.com/ Link to v5: https://lore.kernel.org/all/20260203022712.99347-1-pilgrimtao@gmail.com/ Link to v4: https://lore.kernel.org/all/20260202090051.87802-1-pilgrimtao@gmail.com/ Link to V3: https://lore.kernel.org/all/20260202055818.78231-1-pilgrimtao@gmail.com/ Link to V2: https://lore.kernel.org/all/20260201031607.32940-1-pilgrimtao@gmail.com/ Link to V1: https://lore.kernel.org/all/20260122081426.78472-1-pilgrimtao@gmail.com/ ==================== Link: https://patch.msgid.link/20260214124042.62229-1-pilgrimtao@gmail.com Signed-off-by: Alexei Starovoitov commit ed8fa4b8894f7e80d3a6bf63e4cb880c7545c63a Author: Kaitao Cheng Date: Sat Feb 14 20:40:42 2026 +0800 selftests/bpf: Add test case for rbtree nodes that contain both bpf_refcount and kptr fields. Allow bpf_kptr_xchg to directly operate on pointers marked with NON_OWN_REF | MEM_RCU. In the example demonstrated in this patch, as long as "struct bpf_refcount ref" exists, the __kptr pointer is guaranteed to carry the MEM_RCU flag. The ref member itself does not need to be explicitly used. Signed-off-by: Kaitao Cheng Link: https://lore.kernel.org/r/20260214124042.62229-6-pilgrimtao@gmail.com Signed-off-by: Alexei Starovoitov commit fb1590448ff7e79e304f9bbe662fc20334038b50 Author: Kaitao Cheng Date: Sat Feb 14 20:40:41 2026 +0800 bpf: allow using bpf_kptr_xchg even if the MEM_RCU flag is set For the following scenario: struct tree_node { struct bpf_refcount ref; struct bpf_rb_node node; struct node_data __kptr * node_data; u64 key; }; This means node_data would have the type PTR_TO_BTF_ID | MEM_ALLOC | NON_OWN_REF | MEM_RCU. When traversing an rbtree using bpf_rbtree_left/right, if we need to use bpf_kptr_xchg to read the __kptr pointer, we still need to follow the remove-read-add sequence. This patch allows us to use bpf_kptr_xchg to directly read the __kptr pointer without any prior operations. Signed-off-by: Kaitao Cheng Signed-off-by: Feng Yang Link: https://lore.kernel.org/r/20260214124042.62229-5-pilgrimtao@gmail.com Signed-off-by: Alexei Starovoitov commit 580fa3430b5d164fe8841e99825601d7a85af0d3 Author: Kaitao Cheng Date: Sat Feb 14 20:40:40 2026 +0800 selftests/bpf: Add supplementary tests for bpf_kptr_xchg 1. Allow using bpf_kptr_xchg while holding a lock. 2. When the rb_node contains a __kptr pointer, we do not need to perform a remove-read-add operation. This patch implements the following workflow: 1. Construct a rbtree with 16 elements. 2. Traverse the rbtree, locate the kptr pointer in the target node, and read the content pointed to by the pointer. 3. Remove all nodes from the rbtree. Signed-off-by: Kaitao Cheng Signed-off-by: Feng Yang Link: https://lore.kernel.org/r/20260214124042.62229-4-pilgrimtao@gmail.com Signed-off-by: Alexei Starovoitov commit ee9886c40aaeb0fa0817e28d995bb7c58d66ab25 Author: Kaitao Cheng Date: Sat Feb 14 20:40:39 2026 +0800 bpf: allow using bpf_kptr_xchg even if the NON_OWN_REF flag is set When traversing an rbtree using bpf_rbtree_left/right, if bpf_kptr_xchg is used to access the __kptr pointer contained in a node, it currently requires first removing the node with bpf_rbtree_remove and clearing the NON_OWN_REF flag, then re-adding the node to the original rbtree with bpf_rbtree_add after usage. This process significantly degrades rbtree traversal performance. The patch enables accessing __kptr pointers with the NON_OWN_REF flag set while holding the lock, eliminating the need for this remove-read-add sequence. Signed-off-by: Kaitao Cheng Signed-off-by: Feng Yang Link: https://lore.kernel.org/r/20260214124042.62229-3-pilgrimtao@gmail.com Signed-off-by: Alexei Starovoitov commit 964c0747686abda124cf718a91ac1c0c325ca52a Author: Kaitao Cheng Date: Sat Feb 14 20:40:38 2026 +0800 bpf: allow calling bpf_kptr_xchg while holding a lock For the following scenario: struct tree_node { struct bpf_rb_node node; struct request __kptr *req; u64 key; }; struct bpf_rb_root tree_root __contains(tree_node, node); struct bpf_spin_lock tree_lock; If we need to traverse all nodes in the rbtree, retrieve the __kptr pointer from each node, and read kernel data from the referenced object, using bpf_kptr_xchg appears unavoidable. This patch skips the BPF verifier checks for bpf_kptr_xchg when called while holding a lock. Signed-off-by: Kaitao Cheng Link: https://lore.kernel.org/r/20260214124042.62229-2-pilgrimtao@gmail.com Signed-off-by: Alexei Starovoitov commit f77c7b96014471f2c39823ed9fcb42967e7d9ede Author: Linus Heckemann Date: Sat Feb 21 12:48:06 2026 +0100 selftests/net: add test for IP-in-IPv6 tunneling commit 81c734dae203 ("ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()") was fine in and of itself, but its backport to 6.12 (and 6.6) broke IPv4-in-IPv6 tunneling, see [1]. This adds a self-test for basic IPv4-in-IPv6 and IPv6-in-IPv6 functionality. [1]: https://lore.kernel.org/all/CAA2RiuSnH_2xc+-W6EnFEG00XjS-dszMq61JEvRjcGS31CBw=g@mail.gmail.com/ Signed-off-by: Linus Heckemann Reviewed-by: Hangbin Liu Reviewed-by: Ricardo B. Marlière Tested-by: Ricardo B. Marlière Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260221114806.1231666-1-git@sphalerite.org Signed-off-by: Jakub Kicinski commit 99d6b9014bbd128dc73b7097e78dab1f1f70aab0 Author: Damien Le Moal Date: Thu Feb 19 10:58:40 2026 +0900 ata: libata-scsi: rename and improve ata_qc_done() Rename ata_qc_done() to ata_scsi_qc_done() and allow to pass a scsi command result value to set for the completed command to simplify the caller sites. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke commit fa4f81a8c15d4018eb2053b093bf1584777e80d4 Author: Damien Le Moal Date: Thu Feb 19 10:47:03 2026 +0900 ata: libata-scsi: make ata_scsi_simulate() static ata_scsi_simulate() is called only from libata-scsi.c. Move this function definition as a static function before its call in __ata_scsi_queuecmd() and remove its declaration from include/linux/libata.h. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke commit 9a5eb2adb1ec90f854d9b45c75f0fcb3ae981356 Author: Damien Le Moal Date: Thu Feb 19 08:49:17 2026 +0900 ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() In ata_scsi_requeue_deferred_qc(), use ata_qc_done() instead of calling ata_qc_free() and scsi_done() directly. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke commit a21b4040b3886555cba5e72ef475a556ad04700d Author: Damien Le Moal Date: Thu Feb 19 08:18:52 2026 +0900 ata: libata-sata: simplify ata_sas_queuecmd() Change ata_sas_queuecmd() to return early the result of __ata_scsi_queuecmd() and remove the rc local variable. This simplifies the code without any functional change. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke commit 6158e34e594dd150f3f2df81a1b0fe636e156757 Author: Damien Le Moal Date: Thu Feb 19 08:11:35 2026 +0900 ata: libata-core: improve tag checks in ata_qc_issue() Make sure to check that the tag of a queued command is valid when ata_qc_issue() is called, and fail the QC if the tag is not valid, or if there is an on-going non-NCQ command already on the link. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke commit 1aafc0a9916b95b3f2bdecc8951bd0bb5c3a352b Author: Matt Roper Date: Fri Feb 20 09:27:45 2026 -0800 drm/xe: Consolidate workaround entries for Wa_14023061436 Wa_14023061436 applies to all graphics versions from 30.00 through 30.05 (inclusive) since there is currently no IP that uses version 30.02. Consolidate the RTP rules into a single range. Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-23-b12005a05af6@intel.com Signed-off-by: Matt Roper commit a2d0403de6492a32e5c175b22ebac053f579d350 Author: Matt Roper Date: Fri Feb 20 09:27:44 2026 -0800 drm/xe/wa_oob: Consolidate some OOB rules Given the new policy of allowing graphics/media IP ranges to extend over unused IP versions, we can consolidate some of the OOB workaround rules and simplify the table. If new IP variants eventually show up that use these unused versions (e.g., media version 30.01, graphics versions 20.03 / 30.02, etc.), and if an existing workaround does not extend to that new intermediate version, the ranges will be split back apart as part of the enablement work for that new IP version. Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-22-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 97ec6cb8109cea75c8feb0ec540c124c9b4be749 Author: Matt Roper Date: Fri Feb 20 09:27:42 2026 -0800 drm/xe: Consolidate workaround entries for Wa_15016589081 Wa_15016589081 applies to all graphics versions from 20.01 through 20.04 (inclusive). Consolidate the RTP entries into a single range-based entry. Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-20-b12005a05af6@intel.com Signed-off-by: Matt Roper commit fe681e7b44d78fd77d79de21eca58c3b6bdcda0e Author: Matt Roper Date: Fri Feb 20 09:27:41 2026 -0800 drm/xe: Consolidate workaround entries for Wa_18033852989 Wa_18033852989 applies to all graphics versions from 20.01 through 20.04 (inclusive). Consolidate the RTP entries into a single range-based entry. Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-19-b12005a05af6@intel.com Signed-off-by: Matt Roper commit c2142a1a841525d897ef69b3e6a5ab48183e1fcf Author: Matt Roper Date: Fri Feb 20 09:27:40 2026 -0800 drm/xe: Consolidate workaround entries for Wa_14019988906 Wa_14019988906 applies to all graphics versions from 20.01 through 20.04 (inclusive). Consolidate the RTP entries into a single range-based entry. Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-18-b12005a05af6@intel.com Signed-off-by: Matt Roper commit f0d6d356f8ac427d1f3eb8fb783a64ac3efd6fc7 Author: Matt Roper Date: Fri Feb 20 09:27:39 2026 -0800 drm/xe: Consolidate workaround entries for Wa_14019386621 Wa_14019386621 applies to all graphics versions from 20.01 through 20.04 (inclusive). Consolidate the RTP entries into a single range-based entry. Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-17-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 55b19abb6c44db40fe1ebd01e9c16aa02c4cf663 Author: Matt Roper Date: Fri Feb 20 09:27:38 2026 -0800 drm/xe: Consolidate workaround entries for Wa_14019877138 Wa_14019877138 applies to all graphics versions from 12.55 through 20.04 (inclusive) that have a render engine. Consolidate the RTP entries into a single range-based entry. Note that the DG2 entry for this workaround was missing an ENGINE_CLASS(RENDER) rule; that mistake is fixed by this consolidation. Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-16-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 7b6f615d2b1f01e2860e9aa7977884c31af30df1 Author: Matt Roper Date: Fri Feb 20 09:27:36 2026 -0800 drm/xe: Consolidate workaround entries for Wa_13012615864 Wa_13012615864 applies to all graphics versions from 20.01 through 30.05 (inclusive). Consolidate the RTP entries into a single range-based entry. Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-14-b12005a05af6@intel.com Signed-off-by: Matt Roper commit a9b2f1467464fd4521c938d15cc6e1fdf35f1f28 Author: Matt Roper Date: Fri Feb 20 09:27:35 2026 -0800 drm/xe: Consolidate workaround entries for Wa_14021402888 Wa_14021402888 applies to all graphics versions from 20.01 through 30.05 (inclusive). Consolidate the RTP entries into a single range-based entry. Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-13-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 909a0bcd37c6c9e1fb7452820bcfb76d64fc84f1 Author: Matt Roper Date: Fri Feb 20 09:27:34 2026 -0800 drm/xe: Consolidate workaround entries for Wa_16021639441 Wa_16021639441 applies to all graphics versions from 20.01 through 20.04 (inclusive) and all media versions from 13.01 to 20.00 (inclusive). Consolidate the RTP entries into a single range-based entry. Also drop the reference to Wa_18032095049 which was only relevant to pre-production platforms that we no longer support. Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-12-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 792880cada369a92da375c0393c7f0359706e547 Author: Matt Roper Date: Fri Feb 20 09:27:33 2026 -0800 drm/xe: Consolidate workaround entries for Wa_14018471104 Wa_14018471104 applies to all graphics versions from 20.01 through 20.04 (inclusive). Consolidate the two RTP entries into a single range-based entry. Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-11-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 37681c32f25970aa7d7968343e467e0e10453819 Author: Matt Roper Date: Fri Feb 20 09:27:32 2026 -0800 drm/xe: Consolidate workaround entries for Wa_14020338487 Wa_14020338487 applies to all graphics versions from 20.01 through 20.04 (inclusive). Consolidate the two RTP entries into a single range-based entry. Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-10-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 1aaea53115870d2acce80ce9c0f3566438545755 Author: Matt Roper Date: Fri Feb 20 09:27:31 2026 -0800 drm/xe: Consolidate workaround entries for Wa_16018712365 Wa_16018712365 applies to all graphics versions from 20.01 through 20.04 (inclusive). Consolidate the two RTP entries into a single range-based entry. Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-9-b12005a05af6@intel.com Signed-off-by: Matt Roper commit ef32868d58490f62a67458f57f69a11c466e64dd Author: Matt Roper Date: Fri Feb 20 09:27:30 2026 -0800 drm/xe: Consolidate workaround entries for Wa_18032247524 Wa_18032247524 applies to all graphics versions from 20.01 through 20.04 (inclusive). Consolidate the two RTP entries into a single range-based entry. Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-8-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 6b4578b7c1b5bb1e0ec46cea87858bb4eed7092f Author: Matt Roper Date: Fri Feb 20 09:27:29 2026 -0800 drm/xe: Consolidate workaround entries for Wa_16021865536 Wa_16021865536 applies to both media versions 30.00 and 30.02; since version 30.01 is currently unused we can consolidate the two RTP entries into a single range-based entry. Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-7-b12005a05af6@intel.com Signed-off-by: Matt Roper commit c9459e8c8baa9ff6f90b047505a03b394b3e27f4 Author: Matt Roper Date: Fri Feb 20 09:27:28 2026 -0800 drm/xe: Consolidate workaround entries for Wa_16028005424 Wa_16028005424 applies to all media IPs from 13.01 to 35.00 (inclusive) and all graphics IPs from 30.00 and 30.05 (inclusive). Conslidate the multiple RTP entries into a single range-based entry. Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-6-b12005a05af6@intel.com Signed-off-by: Matt Roper commit aa0f0a678370b026235481d2a05eebe6e3cc90d8 Author: Matt Roper Date: Fri Feb 20 09:27:27 2026 -0800 drm/xe: Consolidate workaround entries for Wa_14019449301 Wa_14019449301 applies to both media IP 13.01 and 20.00 and none of the version numbers between those are used. Conslidate the two entries into a single range entry. Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-5-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 941f538b0af81512212374031ad2db8cde0e3b6f Author: Matt Roper Date: Fri Feb 20 09:27:26 2026 -0800 drm/xe: Consolidate workaround entries for Wa_16021867713 Wa_16021867713 applies to every single media IP from 13.00 to 30.02 (inclusive). We can consolidate the multiple per-version entries down to a single range entry. Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-4-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 32fbd22860326af33db6b421dd478211d2106e1d Author: Matt Roper Date: Fri Feb 20 09:27:25 2026 -0800 drm/xe/wa: Document new policy regarding workaround IP ranges During early Xe driver development, our policy for applying workarounds to ranges of IP versions was to only use GRAPHICS_VERSION_RANGE and MEDIA_VERSION_RANGE rules when all of the affected IP versions had consecutive version numbers; otherwise separate RTP entries should be used. For example, a workaround that applies to all Xe2-based platforms would be implemented in the driver with two RTP entries: one using GRAPHICS_VERSION_RANGE(2001, 2002) and the other using GRAPHICS_VERSION(2004). This ensured that if a new IP variant showed up in the future with currently unused version 20.03, an old workaround entry wouldn't automatically apply to it by accident (and we could always consolidate those two distinct entries in the future if the workaround database did explicitly indicate that 20.03 also needed the workaround). Now that we're a couple years down the road with this driver, the number of IP versions supported is much larger (several Xe2 20.xx versions, several Xe3 30.xx versions, and a couple Xe3p 35.xx versions). When new workarounds are discovered that need to apply to a wide range of IPs, it's becoming more of a pain to create independent entries for each non-contiguous range of versions, and the general consensus is that we should revisit our previous policy and start allowing use of VERSION_RANGE constructs for non-contiguous version ranges. Note that allowing ranges that cover currently unused versions will require additional care if/when some of those intermediate version numbers start being used in the future. We'll need to re-check every workaround that has a range including the new IP version and check the hardware database to see whether the workaround also applies to the new version (no code change required) or whether we need to split the existing range into two separate ranges that don't cover the new version. The platform enabling engineers are willing to take on this extra review burden at the time we first enable a new IP in the driver (see lore link below for one recent discussion). Update the kerneldoc for the workaround file to make the new policy official. Link: https://lore.kernel.org/all/20260203233600.GT458797@mdroper-desk1.amr.corp.intel.com/ Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-3-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 4405938293631604f0bec290c2e30bd392608393 Author: Matt Roper Date: Fri Feb 20 09:27:24 2026 -0800 drm/xe/pvc: Drop pre-prod workarounds Production PVC hardware had a graphics stepping of C0. Xe1 platforms already aren't officially supported by the Xe driver, but pre-production steppings are especially out of scope (and 'has_pre_prod_wa' is not set in the device descriptor). Drop the workarounds that aren't relevant to production hardware. v2: - Drop the stream->override_gucrc which is no longer set anywhere after the removal of Wa_1509372804. (Bala) - Drop xe_guc_rc_set_mode / xe_guc_rc_unset_mode which are no longer used after the removal of Wa_1509372804. Bspec: 44484 Cc: Balasubramani Vivekanandan Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-2-b12005a05af6@intel.com Signed-off-by: Matt Roper commit ad41e9418d97aa48a30517845a56ae8032c24a87 Author: Matt Roper Date: Fri Feb 20 09:27:23 2026 -0800 drm/xe/mtl: Drop pre-prod workarounds Wa_14015795083 & Wa_14014475959 Wa_14015795083 and Wa_14014475959 only apply to early steppings of Xe_LPG that appeared only in pre-production hardware (in fact Wa_14014475959 wasn't supposed to apply to _any_ steppings of version 12.71). Xe1 platforms already aren't officially supported by the Xe driver, but pre-production steppings are especially out of scope (and 'has_pre_prod_wa' is not set in the device descriptor). Drop both workarounds. Bspec: 55420 Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260220-forupstream-wa_cleanup-v2-1-b12005a05af6@intel.com Signed-off-by: Matt Roper commit 89320a1b9b93cf83ba97e18c69568184f8f7fda8 Author: Primoz Fiser Date: Thu Oct 23 12:34:26 2025 +0200 arm64: dts: freescale: imx93-phy{core,board}: Add i2c bus recovery Add bus recovery feature for I2C buses on the PHYTEC phyCORE-i.MX93 SoM based boards (that is phyBOARD-Nash-i.MX93 and phyBOARD-Segin-i.MX93). This enables the i2c-imx-lpi2c driver to recover the stuck I2C bus by switching the SCL and SDA pinmuxing and do the I2C bus bit-banging. Signed-off-by: Primoz Fiser Signed-off-by: Frank Li commit fe539166e3f867c9761208d09a4f295bd9b7e910 Author: Askar Safin Date: Fri Feb 20 16:52:38 2026 +0000 doc: early_userspace_support.rst: trivial fix: directory -> file Trivial fix. Signed-off-by: Askar Safin Signed-off-by: Jonathan Corbet Message-ID: <20260220165238.4162735-1-safinaskar@gmail.com> commit 32437123ee1c5a091adbf9531e3992c0ca0a97a1 Author: Haowen Hu Date: Sat Feb 21 00:01:26 2026 +0800 docs/zh_TW: remove trailing space Remove one trailing space character. Signed-off-by: Haowen Hu Message-ID: <20260220160201.41149-2-srcres258@furdevs.cn> Signed-off-by: Jonathan Corbet commit 21a60fcd24bae2ecdb96351463618647e1edf871 Author: Dmitry Torokhov Date: Mon Feb 23 13:31:12 2026 -0800 Input: cros_ec_keyb - factor out column processing Factor out column processing and eagerly skip processing columns that do not have any changes in them. Reviewed-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260222003717.471977-7-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit fd3c7a4522dc75b8828e03b26ae7a84fee9cb4a0 Author: Dmitry Torokhov Date: Mon Feb 23 13:30:19 2026 -0800 Input: cros_ec_keyb - do not allocate keyboard state separately Now that we know the upper bound for the number of columns, and know that it is pretty small, there is no point in allocating it separately. We are wasting more memory tracking the allocations. Embed valid_keys and old_kb_state directly into cros_ec_keyb structure. Reviewed-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260222003717.471977-6-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 7d2657320c788318a5ddf670441aba83211c7a4d Author: Dmitry Torokhov Date: Mon Feb 23 13:28:59 2026 -0800 Input: cros_ec_keyb - simplify cros_ec_keyb_work() Introduce temporaries for event_data pointer and event_size to simplify the code a bit. In cros_ec_keyb_compute_valid_keys() explicitly compare with KEY_RESERVED to make the intent of the comparison more clear. Reviewed-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260222003717.471977-5-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 2384e0e69275672485b3215c7d284ac51d4e869c Author: Dmitry Torokhov Date: Mon Feb 23 13:28:38 2026 -0800 Input: cros_ec_keyb - use BIT() macro instead of open-coding shifts Using the macro clarifies the code. Reviewed-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260222003717.471977-4-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 2c33bd615e75771b50db416f2854ba51e2d83b3a Author: Dmitry Torokhov Date: Mon Feb 23 13:28:08 2026 -0800 Input: cros_ec_keyb - use u8 instead of uint8_t In the kernel u8/u16/u32 are preferred to the uint*_t variants. Reviewed-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260222003717.471977-3-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit d8df89904cb46bd7995db1dda3405cbbe34247d7 Author: Fabio Baltieri Date: Mon Feb 23 13:27:15 2026 -0800 Input: cros_ec_keyb - add function key support Add support for handling an Fn button and sending separate keycodes for a subset of keys in the matrix defined in the upper half of the keymap. Signed-off-by: Fabio Baltieri Reviewed-by: Simon Glass Reviewed-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260222003717.471977-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 3d35d41169d000f4fbf3c23999b8443e1173efce Author: Fabio Baltieri Date: Mon Feb 23 13:25:55 2026 -0800 Input: export input_default_setkeycode Export input_default_setkeycode so that a driver can set a custom setkeycode handler to take some driver specific action but still call the default handler at some point. Signed-off-by: Fabio Baltieri Reviewed-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260222003717.471977-1-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 1e9ae338eadda5796a57cc022359055ac3674bc9 Author: Miquel Sabaté Solà Date: Fri Feb 20 00:40:40 2026 +0100 documentation: update arch features PA-RISC has perf-event support since commit 610cb23bcc75 ("parisc: Add initial kernel-side perf_event support"); and s390 has stackprotector support since commit f5730d44e05e ("s390: Add stackprotector support"). Signed-off-by: Miquel Sabaté Solà Signed-off-by: Jonathan Corbet Message-ID: <20260219234040.3260616-1-mssola@mssola.com> commit 95c0cd8bee59bc7ccc0d8c3008fec373ce8f0301 Author: Randy Dunlap Date: Sun Feb 15 22:37:29 2026 -0800 docs: admin-guide: update tiny script for number of taint flags Account for 2 new taint flags being added by increasing the number of bits handled by the tiny show-tainted-flags example script. Fixes: 8eea4e744758 ("taint: Add TAINT_FWCTL") Fixes: 2852ca7fba9f ("panic: Taint kernel if tests are run") Signed-off-by: Randy Dunlap Reviewed-by: David Gow Signed-off-by: Jonathan Corbet Message-ID: <20260216063729.2832770-1-rdunlap@infradead.org> commit 46298375477b093204c1843b931c637621952ead Author: Randy Dunlap Date: Sun Feb 15 22:07:39 2026 -0800 linux-next: update maintainer info. Update the MAINTAINERS file and Documentation/process/2.Process.rst with the current linux-next maintainer information. Translations of 2.Process.rst should also be updated. Signed-off-by: Randy Dunlap Acked-by: Stephen Rothwell Acked-by: Mark Brown Signed-off-by: Jonathan Corbet Message-ID: <20260216060739.2791462-1-rdunlap@infradead.org> commit 8cf7280ccd01d777f5744d90381141a64f70fb5d Author: Costa Shulyupin Date: Sun Feb 15 15:12:48 2026 +0200 Documentation/rtla: Add hwnoise to main page Add hwnoise to the command list and SEE ALSO section. The command list is ordered from low level to high level. Signed-off-by: Costa Shulyupin Signed-off-by: Jonathan Corbet Message-ID: <20260215131249.33437-1-costa.shul@redhat.com> commit c99fcb58501e1fbbfa5c9ee6f272db0623553f69 Author: Jonathan Corbet Date: Mon Feb 23 14:29:30 2026 -0700 docs: Fix an erroneous reference to sphinx.rst Just give the name of the file and let the automarkup stuff do its thing. Signed-off-by: Jonathan Corbet commit ba53939bbadd40aef1d9096b958dcf93dee10a8d Author: Antoniu Miclaus Date: Mon Feb 23 12:14:40 2026 +0200 iio: addac: ad74413r: simplify timeout return Return -ETIMEDOUT directly instead of assigning it to an intermediate variable first. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 049875cb16a02473f141968e1b3f29f226504dd9 Author: Giorgi Tchankvetadze Date: Mon Feb 23 12:24:00 2026 +0400 iio: adc: ad7173: move opening brace to a separate line Place the opening brace of ad7173_calc_openwire_thrsh_raw() on its own line to comply with the kernel coding style for function definitions. Issue found by checkpatch. Signed-off-by: Giorgi Tchankvetadze Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit a96f415ab504484f10673be0d0d9c0e502ca9290 Author: Dario Binacchi Date: Tue Sep 23 16:37:36 2025 +0200 ARM: dts: imx6ull-engicam-microgea-bmm: set touchscreen glitch threshold This way the detected signal is valid only if it lasts longer than 62 µs, otherwise it is not sampled. Signed-off-by: Dario Binacchi Reviewed-by: Frank Li Signed-off-by: Frank Li commit 06cdcd389ec464d42efa60fd096e91da6931773e Author: Andy Shevchenko Date: Sun Feb 22 21:40:20 2026 -0600 iio: light: gp2ap020a00f: Join some lines of code to be a single line In some cases the wrapped lines are harder to follow. Join them despite being longer than 80 characters in some cases. Signed-off-by: Andy Shevchenko Signed-off-by: Ethan Tidmore Signed-off-by: Jonathan Cameron commit 2eb3741b62200d430f1aba258d0653851e03ce46 Author: Andy Shevchenko Date: Sun Feb 22 21:40:19 2026 -0600 iio: light: gp2ap020a00f: Remove trailing comma in termination entry Termination entry by definition should be the last one, hence remove stray comma after it. Signed-off-by: Andy Shevchenko Signed-off-by: Ethan Tidmore Signed-off-by: Jonathan Cameron commit b047a2bc7a08247f603316060a1fce7b556207b9 Author: Andy Shevchenko Date: Sun Feb 22 21:40:18 2026 -0600 iio: light: gp2ap020a00f: Explicitly use string literal for driver name The driver name should be easily greppable and clearly spelled. Replace a level of indirection and explicitly use string literal. While at it, remove useless blank lines before module_*() and MODULE_*() macros. Signed-off-by: Andy Shevchenko Signed-off-by: Ethan Tidmore Signed-off-by: Jonathan Cameron commit 7b53652c8c4df0b0f48f1f54be896c959730b11a Author: Andy Shevchenko Date: Sun Feb 22 21:40:17 2026 -0600 iio: light: gp2ap020a00f: Use temporary variable for struct device Use temporary variable for struct device to make code neater. Signed-off-by: Andy Shevchenko Signed-off-by: Ethan Tidmore Signed-off-by: Jonathan Cameron commit 7b9e5e513915c99818780b2bb77c24da9d71a904 Author: Andy Shevchenko Date: Sun Feb 22 21:40:16 2026 -0600 iio: light: gp2ap020a00f: Replace custom implementation of min() Replace custom implementation of min() to save a few lines of code. Signed-off-by: Andy Shevchenko Signed-off-by: Ethan Tidmore Signed-off-by: Jonathan Cameron commit 8dd9b4378b8a6b63efb1528b174d12fd93f6ca8a Author: Daniel Pereira Date: Wed Feb 4 08:32:09 2026 -0300 docs: pt_BR: Add initial Portuguese translation Introduce the initial Portuguese (Brazilian) translation for the Linux kernel documentation (HOWTO document). It establishes the directory structure for the pt_BR locale and adds the official entry for the pt_BR maintainer in the MAINTAINERS file. Additionally, this version adds pt_BR support to the documentation build script (Documentation/sphinx/translations.py) to ensure proper rendering and fixes the documentation hierarchy to avoid orphan file warnings. Signed-off-by: Daniel Pereira Acked-by: Randy Dunlap Tested-by: Randy Dunlap [jc: fix duplicate process_howto label] Signed-off-by: Jonathan Corbet Message-ID: <20260204113210.185221-1-danielmaraboo@gmail.com> commit 550f5c010465b6bf735264cd11d27e1f258508b1 Author: Ethan Tidmore Date: Sun Feb 22 21:40:15 2026 -0600 iio: light: gp2ap020a00f: Fix possible error swallow Move error check into for loop in gp2ap020a00f_buffer_postenable() and gp2ap020a00f_buffer_predisable(), this fixes a possible error swallow. Suggested-by: Andy Shevchenko Signed-off-by: Ethan Tidmore Signed-off-by: Jonathan Cameron commit f6d460ec01556d8c5871a0abbb5baa31f8b0d630 Author: Andy Shevchenko Date: Sun Feb 22 21:40:14 2026 -0600 iio: light: gp2ap020a00f: Return directly from the switch cases Return directly from the switch cases which makes code easier to follow. In some cases convert pieces to the standard pattern which also unifies it with the accepted kernel practices. Signed-off-by: Andy Shevchenko Signed-off-by: Ethan Tidmore Signed-off-by: Jonathan Cameron commit c579a6a7a7454b2de83a1f3841a60fd20ec9ef5c Author: Andy Shevchenko Date: Sun Feb 22 21:40:13 2026 -0600 iio: light: gp2ap020a00f: Use correct types for 16-bit LE data Instead of using byte arrays and then explicit castings, change the types of byte arrays to be __le16 and update the endianness conversions accordingly. Signed-off-by: Andy Shevchenko Signed-off-by: Ethan Tidmore Signed-off-by: Jonathan Cameron commit b969e76585e9cc3ce0df52e8290841f132a5ea6f Author: Ethan Tidmore Date: Sun Feb 22 21:40:12 2026 -0600 iio: light: gp2ap020a00f: correct return type to int The function gp2ap020a00f_get_thresh_reg() can return -EINVAL in its error path. Yet, the function has return type of u8. Added error checking for gp2ap020a00f_get_thresh_reg() return value. Detected by Smatch: drivers/iio/light/gp2ap020a00f.c:1013 gp2ap020a00f_get_thresh_reg() warn: signedness bug returning '(-22)' Reviewed-by: Andy Shevchenko Signed-off-by: Ethan Tidmore Signed-off-by: Jonathan Cameron commit 34be156c88080ce1a58d44e409e3ac41ced572c1 Author: Ethan Tidmore Date: Sun Feb 22 21:40:11 2026 -0600 iio: light: gp2ap020a00f: simplify locking with guard() Use the guard() cleanup handler to manage the device lock. This simplifies the code by removing the need for manual unlocking and goto error handling paths. Suggested-by: Jonathan Cameron Signed-off-by: Ethan Tidmore Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit c99ccbba912c859fd579fe3a00071adc5fd0236d Merge: 70a9ae59c5b1f2 baff45179e9027 Author: Jonathan Cameron Date: Mon Feb 23 21:03:25 2026 +0000 Merge branch 'ib-iio-thermal-qcom-pmic5' into togreg Immutable branch to allow this base work to be merged into thermal. commit 70a9ae59c5b1f2f5501e78e2d85bfeefd153f854 Author: Antoniu Miclaus Date: Mon Feb 2 13:57:30 2026 +0200 iio: adc: at91_adc: change at91_ts_sample to return void The return value of at91_ts_sample() is never checked by its caller. Change the return type to void to make this explicit. The error conditions are already logged via dev_err() which provides sufficient visibility into hardware issues. Signed-off-by: Antoniu Miclaus Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit 76878a3820b52ef463c2f63f107d37a8c6fe7bc6 Author: Rodrigo Alencar Date: Mon Feb 16 17:10:55 2026 +0000 iio: amplifiers: ad8366: update device support Add support for the following digital step attenuators: - HMC271A: 1dB LSB 5-Bit Digital Attenuator SMT, 0.7 - 3.7 GHz - ADRF5720: 0.5 dB LSB, 6-Bit, Digital Attenuator, 9 kHz to 40 GHz - ADRF5730: 0.5 dB LSB, 6-Bit, Digital Attenuator, 100 MHz to 40 GHz - ADRF5731: 2 dB LSB, 4-Bit, Digital Attenuator, 100 MHz to 40 GHz - HMC1018A: 1.0 dB LSB GaAs MMIC 5-BIT DIGITAL ATTENUATOR, 0.1 - 30 GHz - HMC1019A: 0.5 dB LSB GaAs MMIC 5-BIT DIGITAL ATTENUATOR, 0.1 - 30 GHz Additionally, copyright notice was updated with current year. Co-developed-by: Alexandru Ardelean Signed-off-by: Alexandru Ardelean Co-developed-by: Michael Hennerich Signed-off-by: Michael Hennerich Reviewed-by: Andy Shevchenko Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit d99a03d6dda43226fd3138e5cd89ddba739a11cf Author: Rodrigo Alencar Date: Mon Feb 16 17:10:54 2026 +0000 iio: amplifiers: ad8366: consume enable gpio Some parts may consume enable GPIO to enable serial mode (HMC1119's and HMC792A P/S pin) or powerup the device (e.g. ADA4961's PWUP pin). Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit d5e02d0d00b99bb37f935f250181bf310d3d6e85 Author: Rodrigo Alencar Date: Mon Feb 16 17:10:53 2026 +0000 iio: amplifiers: ad8366: add device tree support Drop the enum ID, split chip info table into per-device structs and add of_match_table. Additionally, add 'name' field into the chip info struct, dropping the usage of spi_get_device_id(). Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit 314b184b8202563b41317132c8aeb79fc10e14f7 Author: Rodrigo Alencar Date: Mon Feb 16 17:10:52 2026 +0000 iio: amplifiers: ad8366: prepare for device-tree support Drop switch case on the enum ID in favor of extended chip info table, containing: - gain_step, indicating with sign the start of the code range; - num_channels, to indicate the number IIO channels; - pack_code() function to describe how SPI buffer is populated; Which allowed for a simplified read_raw() and write_raw() callbacks. The probe() function was adjusted accordingly. The linux/array_size.h include is removed as number of channels is provided by chip info table. Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit ee4f8c56e46abd4bfeab1cee96cd391c0b7a3e4a Author: Rodrigo Alencar Date: Mon Feb 16 17:10:51 2026 +0000 iio: amplifiers: ad8366: replace reset-gpio with reset controller Remove reset_gpio from the device state struct and use the reset_control interface instead, using a local variable, as it is not being used anywhere else. The reset controller init is moved out from the switch case and optionally initialized for every device variant. Although not all devices have a reset pin the code does not need to change if it is not wired. Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit 5fdb9c833293c6c341f58dc8109a6fdd2556a034 Author: Rodrigo Alencar Date: Mon Feb 16 17:10:50 2026 +0000 iio: amplifiers: ad8366: refactor device resource management Adhere modern device resource management with the following: - Voltage regulator managed and enabled internally; - IIO device registration handled with devm_iio_device_register(); - removal of goto's from the probe function; - ad8366_remove() removed as it is not needed anymore; With the drop of goto's dev_err_probe() is used to report probe errors. Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit 5603a07af9f171b8402e839537698f0ecff4796b Author: Rodrigo Alencar Date: Mon Feb 16 17:10:49 2026 +0000 iio: amplifiers: ad8366: use devm_mutex_init() and drop mutex_init() Adopt proper mutex lifecycle with devm_mutex_init(), replacing mutex_init(). Mutex init is moved up (before regulator init), so that goto statement in the error path is avoided (which will be cleaned up later). Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit d9eece6f39c64b958e590686781e2aa16d7d6ae4 Author: Rodrigo Alencar Date: Mon Feb 16 17:10:48 2026 +0000 iio: amplifiers: ad8366: add local dev pointer to the probe function Create local device pointer in the probe function to shorten lines, making the code easier to read. The local device pointer replaces &spi->dev and will be reused across other probe function places in later patches. Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit 5593bddbf9dd5d94ba6547cc01cb894825c2fac5 Author: Rodrigo Alencar Date: Mon Feb 16 17:10:47 2026 +0000 iio: amplifiers: ad8366: refactor include headers Apply IWYU principle, removing the following headers: - linux/device.h: no usage of devm_add_action_or_reset, device_attr... - linux/kernel.h: no usage of container_of, kasprintf, ... - linux/slab.h: memory management handled by iio - linux/sysfs.h: sysfs interaction is managed by iio - linux/iio/sysfs.h: not using iio device attributes in this driver Adding the following missing headers: + linux/array_size.h: for ARRAY_SIZE + linux/bits.h: for BIT + linux/dev_printk.h: for dev_err + linux/math.h: for abs + linux/mutex.h: for mutex_lock, mutex_unlock + linux/mod_devicetable.h: for spi_device_id + linux/types.h for NULL, __aligned Additionally, those include directives are alphabetically sorted. Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit 3cfbb50d1414a1e40c03a595eae56b6b3ffe2691 Author: Rodrigo Alencar Date: Mon Feb 16 17:10:46 2026 +0000 dt-bindings: iio: amplifiers: Add AD8366 support Add device tree binding documentation for amplifiers and digital attenuators. This covers different device variants with similar SPI control. Each device has its own gain range and step, hence no fallback compatibles are used. Reviewed-by: Conor Dooley Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit 2ee227268c3673031335c10be0dfeaa5222f87f6 Author: Rodrigo Alencar Date: Mon Feb 16 17:10:45 2026 +0000 MAINTAINERS: Add missing maintainer entry for AD8366 driver Add maintainers entry for drivers/iio/amplifiers/ad8366.c Signed-off-by: Rodrigo Alencar Signed-off-by: Jonathan Cameron commit 4b0d26cb9a79d38fcf61fdcf821e70b335718610 Author: Antoniu Miclaus Date: Fri Feb 20 15:11:43 2026 +0200 iio: adc: ade9000: use dev_err_probe() in probe path Replace dev_err() + return with dev_err_probe() in ade9000_reset(), which is called during probe. This simplifies error handling. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 4d9fccb3e98712df571936ec3d31338e3b906690 Author: Andy Shevchenko Date: Fri Feb 20 14:25:19 2026 +0100 iio: core: Simplify IIO core managed APIs Use devm_add_action_or_reset() instead of devres_alloc() and devres_add(), which works the same. This will simplify the code. There is no functional changes. While at it, inline devm_iio_kfifo_allocate() into its only user. Reviewed-by: Nuno Sá Signed-off-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit b40be056eefe458698d75ff2b78ed853efdf5e8a Author: Antoniu Miclaus Date: Fri Feb 20 15:18:46 2026 +0200 iio: adc: ad7266: simplify error return Return PTR_ERR() directly instead of assigning it to an intermediate variable first. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 3d8fedcc62b663f6c04b1d172e7298c71bbddb8f Author: Antoniu Miclaus Date: Fri Feb 20 15:33:34 2026 +0200 iio: filter: admv8818: remove redundant else after return The else in admv8818_init() is unnecessary since the if block already returns after calling admv8818_rfin_band_select() when clkin is present. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 12b393486c707dc005540da58f6c7a60776941ac Author: Salah Triki Date: Sat Feb 21 08:32:42 2026 +0100 iio: core: Clean up device correctly on viio_trigger_alloc() failure Move device_initialize() after all error paths in viio_trigger_alloc(). Previously, put_device() should have been called on all error paths after device_initialize(), but that was not done. Rather than adding put_device(), move device_initialize() to avoid needing to unwind it on error. In addition move trig->dev initialization to just before device_initialize() to related code together. Signed-off-by: Salah Triki Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit d1e13ac7c2641a8ec815a9fe10835726eaf05302 Author: Felix Gu Date: Sun Feb 22 02:09:08 2026 +0800 iio: adc: nxp-sar-adc: Remove unnecessary type casting The readl_poll_timeout() macro returns a signed integer error code. In nxp_sar_adc_calibration_wait(), the return value is casted to u32 before being returned as int, which is unnecessary. Signed-off-by: Felix Gu Signed-off-by: Jonathan Cameron commit 0e2af0fc30eca0ae92abcf1c8fc7be94a8cc95c3 Author: Archit Anant Date: Wed Feb 18 18:23:27 2026 +0530 staging: iio: impedance-analyzer: ad5933: use div64_ul() instead of do_div() Replace do_div() with div64_ul() since the remainder is not used. div64_ul() is the preferred API for 64-bit by 32-bit division when only the quotient is needed. Also replace explicit casting and shifting with the BIT_ULL(27) macro for clarity. Note: A mathematical simplification to `(freq * BIT_ULL(29)) / mclk` was suggested during review to improve precision. However, as confirmed by maintainers, the original driver's truncation via `(mclk / 4)` might be intentional or relied upon by userspace. Since hardware is not available for verification, this patch preserves the original logic to avoid regression risk in the absence of testing. Issue identified by coccicheck using do_div.cocci. Signed-off-by: Archit Anant Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit f5ab554a6a4a1303dc6b7485ecc84d6523ca54c7 Author: Varun Gupta Date: Mon Feb 23 11:49:06 2026 +0530 drm/xe: Add prefetch fault support for Xe3p Xe3p hardware prefetches memory ranges and notifies software via an additional bit (bit 11) in the page fault descriptor that the fault was caused by prefetch. Extract the prefetch bit from the fault descriptor and echo it in the response (bit 6) only when the page fault handling fails. This allows the HW to suppress CAT errors for unsuccessful prefetch faults. For prefetch faults that fail, increment stats counter without verbose logging to avoid spamming the log. The prefetch flag is packed into BIT(7) of the access_type field to avoid growing the consumer struct. Based on original patches by Brian Welty and Priyanka Dandamudi . Bspec: 59311 Cc: Matthew Brost Cc: Priyanka Dandamudi Cc: Matt Roper Reviewed-by: Matthew Brost Signed-off-by: Lucas De Marchi Signed-off-by: Varun Gupta Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260223061906.1420883-3-varun.gupta@intel.com commit c129f8ebca1750bde614a101c3cd03945d27646a Author: Varun Gupta Date: Mon Feb 23 11:49:05 2026 +0530 drm/xe: Add counter for invalid prefetch pagefaults Add a stats counter for invalid prefetch page faults to avoid excessive logging. Cc: Matthew Brost Cc: Matt Roper Reviewed-by: Matthew Brost Signed-off-by: Lucas De Marchi Signed-off-by: Varun Gupta Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260223061906.1420883-2-varun.gupta@intel.com commit baff45179e90276a14acb9dffce17ff517708453 Author: Jishnu Prakash Date: Fri Jan 30 17:24:20 2026 +0530 iio: adc: Add support for QCOM PMIC5 Gen3 ADC The ADC architecture on PMIC5 Gen3 is similar to that on PMIC5 Gen2, with all SW communication to ADC going through PMK8550 which communicates with other PMICs through PBS. One major difference is that the register interface used here is that of an SDAM (Shared Direct Access Memory) peripheral present on PMK8550. There may be more than one SDAM used for ADC5 Gen3 and each has eight channels, which may be used for either immediate reads (same functionality as previous PMIC5 and PMIC5 Gen2 ADC peripherals) or recurring measurements (same as ADC_TM functionality). By convention, we reserve the first channel of the first SDAM for all immediate reads and use the remaining channels across all SDAMs for ADC_TM monitoring functionality. Add support for PMIC5 Gen3 ADC driver for immediate read functionality. ADC_TM is implemented as an auxiliary thermal driver under this ADC driver. Signed-off-by: Jishnu Prakash Signed-off-by: Jonathan Cameron commit 1c1b853eefcdbf4670020a917e25a6ac3548069d Author: Jishnu Prakash Date: Fri Jan 30 17:24:19 2026 +0530 dt-bindings: iio: adc: Add support for QCOM PMIC5 Gen3 ADC For the PMIC5-Gen3 type PMICs, ADC peripheral is present in HW for the following PMICs: PMK8550, PM8550, PM8550B and PM8550VX PMICs. It is similar to PMIC5-Gen2, with SW communication to ADCs on all PMICs going through PBS(Programmable Boot Sequence) firmware through a single register interface. This interface is implemented on SDAM (Shared Direct Access Memory) peripherals on the master PMIC PMK8550 rather than a dedicated ADC peripheral. Add documentation for PMIC5 Gen3 ADC and update SPMI PMIC bindings to allow ADC5 Gen3 as adc@ subnode. Acked-by: Jonathan Cameron Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jishnu Prakash Signed-off-by: Jonathan Cameron commit 9f3a352e9ff0c2ba89cc81555b2de0a4a5ed4221 Author: Jishnu Prakash Date: Fri Jan 30 17:24:18 2026 +0530 dt-bindings: iio: adc: Split out QCOM VADC channel properties Split out the common channel properties for QCOM VADC devices into a separate file so that it can be included as a reference for devices using them. This will be needed for the upcoming ADC5 Gen3 binding support patch, as ADC5 Gen3 also uses all of these common properties. Reviewed-by: Krzysztof Kozlowski Acked-by: Jonathan Cameron Signed-off-by: Jishnu Prakash Signed-off-by: Jonathan Cameron commit 658ad2259b3e95aea21e548f7ca3440f620bf95f Author: Andrea Righi Date: Sat Feb 21 21:02:20 2026 +0100 selftests/sched_ext: Add test to validate ops.dequeue() semantics Add a new kselftest to validate that the new ops.dequeue() semantics work correctly for all task lifecycle scenarios, including the distinction between terminal DSQs (where BPF scheduler is done with the task), user DSQs (where BPF scheduler manages the task lifecycle) and BPF data structures, regardless of which event performs the dispatch. The test validates the following scenarios: - From ops.select_cpu(): - scenario 0 (local DSQ): tasks dispatched to the local DSQ bypass the BPF scheduler entirely; they never enter BPF custody, so ops.dequeue() is not called, - scenario 1 (global DSQ): tasks dispatched to SCX_DSQ_GLOBAL also bypass the BPF scheduler, like the local DSQ; ops.dequeue() is not called, - scenario 2 (user DSQ): tasks dispatched to user DSQs from ops.select_cpu(): tasks enter BPF scheduler's custody with full enqueue/dequeue lifecycle tracking and state machine validation, expects 1:1 enqueue/dequeue pairing, - From ops.enqueue(): - scenario 3 (local DSQ): same behavior as scenario 0, - scenario 4 (global DSQ): same behavior as scenario 1, - scenario 5 (user DSQ): same behavior as scenario 2, - scenario 6 (BPF internal queue): tasks are stored in a BPF queue from ops.enqueue() and consumed from ops.dispatch(); similarly to scenario 5, tasks enter BPF scheduler's custody with full lifecycle tracking and 1:1 enqueue/dequeue validation. This verifies that: - terminal DSQ dispatch (local, global) don't trigger ops.dequeue(), - tasks dispatched to user DSQs, either from ops.select_cpu() or ops.enqueue(), enter BPF scheduler's custody and have exact 1:1 enqueue/dequeue pairing, - tasks stored to internal BPF data structures from ops.enqueue() enter BPF scheduler's custody and have exact 1:1 enqueue/dequeue pairing, - dispatch dequeues have no flags (normal workflow), - property change dequeues have the %SCX_DEQ_SCHED_CHANGE flag set, - no duplicate enqueues or invalid state transitions are happening. Cc: Tejun Heo Cc: Emil Tsalapatis Cc: Kuba Piecuch Reviewed-by: Daniel Jordan Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit ebf1ccff79c43f860cbd2f9d6cfab9a462d0cb2d Author: Andrea Righi Date: Wed Feb 18 09:32:17 2026 +0100 sched_ext: Fix ops.dequeue() semantics Currently, ops.dequeue() is only invoked when the sched_ext core knows that a task resides in BPF-managed data structures, which causes it to miss scheduling property change events. In addition, ops.dequeue() callbacks are completely skipped when tasks are dispatched to non-local DSQs from ops.select_cpu(). As a result, BPF schedulers cannot reliably track task state. Fix this by guaranteeing that each task entering the BPF scheduler's custody triggers exactly one ops.dequeue() call when it leaves that custody, whether the exit is due to a dispatch (regular or via a core scheduling pick) or to a scheduling property change (e.g. sched_setaffinity(), sched_setscheduler(), set_user_nice(), NUMA balancing, etc.). BPF scheduler custody concept: a task is considered to be in the BPF scheduler's custody when the scheduler is responsible for managing its lifecycle. This includes tasks dispatched to user-created DSQs or stored in the BPF scheduler's internal data structures from ops.enqueue(). Custody ends when the task is dispatched to a terminal DSQ (such as the local DSQ or %SCX_DSQ_GLOBAL), selected by core scheduling, or removed due to a property change. Tasks directly dispatched to terminal DSQs bypass the BPF scheduler entirely and are never in its custody. Terminal DSQs include: - Local DSQs (%SCX_DSQ_LOCAL or %SCX_DSQ_LOCAL_ON): per-CPU queues where tasks go directly to execution. - Global DSQ (%SCX_DSQ_GLOBAL): the built-in fallback queue where the BPF scheduler is considered "done" with the task. As a result, ops.dequeue() is not invoked for tasks directly dispatched to terminal DSQs. To identify dequeues triggered by scheduling property changes, introduce the new ops.dequeue() flag %SCX_DEQ_SCHED_CHANGE: when this flag is set, the dequeue was caused by a scheduling property change. New ops.dequeue() semantics: - ops.dequeue() is invoked exactly once when the task leaves the BPF scheduler's custody, in one of the following cases: a) regular dispatch: a task dispatched to a user DSQ or stored in internal BPF data structures is moved to a terminal DSQ (ops.dequeue() called without any special flags set), b) core scheduling dispatch: core-sched picks task before dispatch (ops.dequeue() called with %SCX_DEQ_CORE_SCHED_EXEC flag set), c) property change: task properties modified before dispatch, (ops.dequeue() called with %SCX_DEQ_SCHED_CHANGE flag set). This allows BPF schedulers to: - reliably track task ownership and lifecycle, - maintain accurate accounting of managed tasks, - update internal state when tasks change properties. Cc: Tejun Heo Cc: Emil Tsalapatis Cc: Kuba Piecuch Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 482bb06f83ab26cc055835eb7d94d615520e9de9 Author: Andrea Righi Date: Wed Feb 18 09:32:16 2026 +0100 sched_ext: Add rq parameter to dispatch_enqueue() This prepares for a later commit fixing the ops.dequeue() semantics. No functional change intended. Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit b75aaea24c9fc776e5bd14df38147270a3c00450 Author: Andrea Righi Date: Wed Feb 18 09:32:15 2026 +0100 sched_ext: Properly mark SCX-internal migrations via sticky_cpu Reposition the setting and clearing of sticky_cpu to better define the scope of SCX-internal migrations. This ensures @sticky_cpu is set for the entire duration of an internal migration (from dequeue through enqueue), making it a reliable indicator that an SCX-internal migration is in progress. The dequeue and enqueue paths can then use @sticky_cpu to identify internal migrations and skip BPF scheduler notifications accordingly. This prepares for a later commit fixing the ops.dequeue() semantics. No functional change intended. Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 68b518773213e6c54542171cc12cc821460615e2 Author: Barnabás Czémán Date: Wed Jan 7 12:34:09 2026 +0100 remoteproc: qcom_q6v5_mss: Add MSM8940 Add support for MSM8940 MSS it is similar for MSM8937 MSS without inrush current mitigation. Signed-off-by: Barnabás Czémán Acked-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260107-mss-v4-9-9f4780345b6f@mainlining.org Signed-off-by: Bjorn Andersson commit 3c8c90f050e984c21c3b0cc05d8a1843b83b1a64 Author: Barnabás Czémán Date: Wed Jan 7 12:34:08 2026 +0100 dt-bindings: remoteproc: qcom,msm8916-mss-pil: Add MSM8940 Add the compatible for MSS as found on the MSM8940 platform. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260107-mss-v4-8-9f4780345b6f@mainlining.org Signed-off-by: Bjorn Andersson commit 2c4f52dd8baf62f80987c28040c411500a077066 Author: Barnabás Czémán Date: Wed Jan 7 12:34:07 2026 +0100 remoteproc: qcom_q6v5_mss: Add MSM8937 Add support for MSM8937 MSS it is similar to MSM8917 MSS. It differs primarily in that TZ needs to be informed of the modem start address and pas_id. Signed-off-by: Barnabás Czémán Acked-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260107-mss-v4-7-9f4780345b6f@mainlining.org Signed-off-by: Bjorn Andersson commit aebef677bb6d2b421076a868d3d0f021afbe1170 Author: Barnabás Czémán Date: Wed Jan 7 12:34:06 2026 +0100 dt-bindings: remoteproc: qcom,msm8916-mss-pil: Add MSM8937 Add the compatible for MSS as found on the MSM8937 platform. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260107-mss-v4-6-9f4780345b6f@mainlining.org Signed-off-by: Bjorn Andersson commit be086d05aa032b50d606c38603c59485cee25137 Author: Barnabás Czémán Date: Wed Jan 7 12:34:05 2026 +0100 remoteproc: qcom_q6v5_mss: Add MSM8917 Add support for MSM8917 MSS it is similar for MDM9607 MSS only difference is the mss supply. Signed-off-by: Barnabás Czémán Acked-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260107-mss-v4-5-9f4780345b6f@mainlining.org Signed-off-by: Bjorn Andersson commit b83f08e0d228b6b57590d00d719f2b481ed08d93 Author: Barnabás Czémán Date: Wed Jan 7 12:34:04 2026 +0100 dt-bindings: remoteproc: qcom,msm8916-mss-pil: Add MSM8917 Add the compatible for MSS as found on the MSM8917 platform. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260107-mss-v4-4-9f4780345b6f@mainlining.org Signed-off-by: Bjorn Andersson commit 4fe236a1d0243451e942c197cfd917a3b6e5b82c Author: Stephan Gerhold Date: Wed Jan 7 12:34:03 2026 +0100 remoteproc: qcom_q6v5_mss: Add MDM9607 Add support for MDM9607 MSS it have different ACC settings and it needs mitigation for inrush current issue. Signed-off-by: Stephan Gerhold [Reword the commit, add necessary flags, rework inrush current mitigation] Signed-off-by: Barnabás Czémán Acked-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260107-mss-v4-3-9f4780345b6f@mainlining.org Signed-off-by: Bjorn Andersson commit 1edab01aed302577ebcd88a40675d4c94b11fd91 Author: Barnabás Czémán Date: Wed Jan 7 12:34:02 2026 +0100 dt-bindings: remoteproc: qcom,msm8916-mss-pil: Add MDM9607 Add the compatible for MSS as found on the MDM9607 platform. Acked-by: Krzysztof Kozlowski Signed-off-by: Barnabás Czémán Link: https://lore.kernel.org/r/20260107-mss-v4-2-9f4780345b6f@mainlining.org Signed-off-by: Bjorn Andersson commit f56052f4d87cee246e6dadacac771097343f3eba Author: Barnabás Czémán Date: Wed Jan 7 12:34:01 2026 +0100 remoteproc: qcom_q6v5_mss: Introduce need_pas_mem_setup Some platforms like MSM8953 and MSM8937 TZ needs to be informed of the modem start address and pas_id. Lets introduce need_pas_mem_setup flag for handle this case. Reviewed-by: Bryan O'Donoghue Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260107-mss-v4-1-9f4780345b6f@mainlining.org Signed-off-by: Bjorn Andersson commit 6fde419222a82e4dd201a0cafca63ef8cf56045f Author: Srinivasan Shanmugam Date: Mon Feb 23 19:14:41 2026 +0530 drm/amd/display: Fix kdoc formatting in dcn42_hwseq.c Kernel-doc requires all lines within a documentation comment to start with " *". The previous empty line caused a "bad line" warning during build. Cc: Harry Wentland Cc: Mario Limonciello Cc: Alex Hung Cc: Aurabindo Pillai Cc: ChiaHsuan Chung Cc: Roman Li Signed-off-by: Srinivasan Shanmugam Reviewed-by: Roman Li Signed-off-by: Alex Deucher commit 5eb2a72bac35e8eddc36d4a614b3fb976457bfbc Author: Tvrtko Ursulin Date: Fri Dec 5 13:40:30 2025 +0000 drm/amdgpu/userq: Use memdup_array_user in amdgpu_userq_signal_ioctl Use the existing helper instead of multiplying the size. Signed-off-by: Tvrtko Ursulin Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit fb1bf29acdd5283ec1d3f291b509a060d940cf1f Author: Tvrtko Ursulin Date: Fri Dec 5 13:40:29 2025 +0000 drm/amdgpu/userq: Use memdup_array_user in amdgpu_userq_wait_ioctl Use the existing helper instead of multiplying the size. Signed-off-by: Tvrtko Ursulin Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit e757981cd8c3974fa1313ac2b529294462785e59 Author: Alex Deucher Date: Thu Feb 19 10:48:39 2026 -0500 drm/amdgpu/sdma7.1: adjust SDMA limits SDMA 7.1 has increased transfer limits. Cc: Vitaly Prosyak Reviewed-by: Vitaly Prosyak Signed-off-by: Alex Deucher commit 6dae3cb921450f81832a738a882e147865d583b6 Author: Alex Deucher Date: Thu Sep 11 10:34:59 2025 -0400 drm/amdgpu/sdma7.0: adjust SDMA limits SDMA 7.0 has increased transfer limits. v2: fix harder, use shifts to make it more obvious Cc: Vitaly Prosyak Reviewed-by: Vitaly Prosyak Signed-off-by: Alex Deucher commit dd3cac327b4627923b4983445a022c3dee4cb458 Author: Alex Deucher Date: Thu Sep 11 10:34:11 2025 -0400 drm/amdgpu/sdma6.0: adjust SDMA limits SDMA 6.x has increased transfer limits. v2: fix harder, use shifts to make it more obvious Cc: Vitaly Prosyak Reviewed-by: Vitaly Prosyak Signed-off-by: Alex Deucher commit a927070b057711bbfd8c85bfa18cfb20da543c7c Author: Alex Deucher Date: Thu Sep 11 10:33:39 2025 -0400 drm/amdgpu/sdma5.2: adjust SDMA limits SDMA 5.2.x has increased transfer limits. v2: fix harder, use shifts to make it more obvious v3: align const fill with PAL limits v4: re-align with hw limits Cc: Vitaly Prosyak Reviewed-by: Vitaly Prosyak Signed-off-by: Alex Deucher commit c521b507a6567b3a21b407cf6a6b0e9abb601b4c Author: Alex Deucher Date: Thu Sep 11 10:38:57 2025 -0400 drm/amdgpu/sdma4.4: adjust SDMA limits SDMA 4.4.x has increased transfer limits. v2: fix harder, use shifts to make it more obvious Cc: Vitaly Prosyak Reviewed-by: Vitaly Prosyak Signed-off-by: Alex Deucher commit e210ed64d24ea8ac06750361630e3e5cda841a51 Author: Alex Deucher Date: Thu Sep 11 10:32:34 2025 -0400 drm/amdgpu/sdma4.0: adjust SDMA limits SDMA 4.4.x has increased transfer limits. v2: fix harder, use shifts to make it more obvious Cc: Vitaly Prosyak Reviewed-by: Vitaly Prosyak Signed-off-by: Alex Deucher commit 137d464b0787a90dafd7d92f13fc2e0789069113 Author: Taimur Hassan Date: Thu Feb 12 18:12:35 2026 -0500 drm/amd/display: Promote DC to 3.2.371 This version brings along the follwing updates: - Add visualconfirm support for refresh rate change testing. - Fix IPS exit with DC helper for all dc_set_power_state cases. - Fix cursor position at overlay plane edges on DCN4. - Introduce DMUB IHC command. - Add missing dprefclk and dtbclk clock types and fix formatting. - Fix DPIA number and driver ID field sizes per spec. - Minor code fixes. Reviewed-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 72835a05dbb78ddfc469acb7610d1d96824c4704 Author: Taimur Hassan Date: Thu Feb 12 16:49:15 2026 -0500 drm/amd/display: [FW Promotion] Release 0.1.48.0 [Why&How] Introduce DMUB IHC command. Reviewed-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 29c9087b96c6dc92660f0dcff4e7e67eda40cf46 Author: Muaaz Nisar Date: Thu Dec 18 16:03:44 2025 -0500 drm/amd/display: Add Visual Confirm Support for Testing [WHY+HOW] Adding visual confirm to visually track changes in refresh rate. Reviewed-by: Aric Cyr Signed-off-by: Muaaz Nisar Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit ff374446c18fc564a0850d9207f23eee6b39e478 Author: Ovidiu Bunea Date: Mon Feb 2 19:14:23 2026 -0500 drm/amd/display: Add missing clock types & fix formatting [why & how] Add the missing dprefclk and dtbclk clock types to the enum. Reviewed-by: Dillon Varone Signed-off-by: Ovidiu Bunea Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 002f32db0d4292f117994c330928d2374887b28e Author: Charlene Liu Date: Wed Feb 11 16:53:44 2026 -0500 drm/amd/display: Fix dcn401_optimize_bandwidth [Why&How] We should check for != zstate disallow and programming extend blank from a different struct. Reviewed-by: Leo Chen Reviewed-by: Dmytro Laktyushkin Signed-off-by: Charlene Liu Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 44081e86fc56f4b08f52abfdd85733762c0e084d Author: Gaghik Khachatrian Date: Mon Feb 16 11:26:58 2026 -0500 drm/amd/display: Silence type mismatch warning [Why&How] Resolve type mismatch warnings by ensuring loop counters and compared values use matching unsigned types (size_t or int) in array iteration. Reviewed-by: Aric Cyr Signed-off-by: Gaghik Khachatrian Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit cf1b9cbb5923a471c3b3bb6553da41004c75ebab Author: Cruise Hung Date: Tue Feb 10 17:40:42 2026 +0800 drm/amd/display: Fix DPIA number and driver ID field issue [Why] The DPIA number field is 6 bits in the spec. In dp_type, it only defines 5 bits. The driver ID is only 4 bits in the spec. [How] Set DPIA number field size to 6. And only update 4 bits for driver id. Reviewed-by: Meenakshikumar Somasundaram Signed-off-by: Cruise Hung Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d8f6c978fd3d12ae129879dd1c514cec2e8cf2f8 Author: Ivan Lipski Date: Mon Feb 2 15:57:19 2026 -0500 drm/amd/display: Fix cursor pos at overlay plane edges on DCN4 [Why&How] On DCN4, when cursor straddles the left/top edge of an overlay plane, the recout-relative position becomes negative. These negative values wrap to large positive numbers when cast to uint32_t, causing the cursor on the the overlay plane to disappear. Fix by adding hotspot adjustment and position clamping after the recout-relative calculation, matching the existing ODM/MPC slice boundary handling. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f44c094449669c7d9ac403cc73ce23e255f0828b Author: Ovidiu Bunea Date: Wed Feb 4 17:08:01 2026 -0500 drm/amd/display: Exit IPS w/ DC helper for all dc_set_power_state cases [why & how] On D3 path during dc_set_power_state, we may be in idle_allowed=true, at which point we will exit idle via dc_wake_and_execute_dmub_cmd_list which doesn't update dc->idle_optimizations_allowed to false. This would cause any future attempts to allow idle optimizations via the DC helper to get skipped because the value is stale and not reflective of the actual HW state. Move dc_exit_ips_for_hw_access() to the top of the function. Additionally ensure that dc_power_down_on_boot thread holds the DC lock and only runs if there are 0 streams. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Ovidiu Bunea Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 413dd2fc603b18566e0d8cd6e79acf1ae292808a Author: Simon Louis Date: Tue Feb 3 15:42:00 2026 +0000 drm/amdgpu: Add xgmi link status for VFs Xgmi link status is unavailable in guest. This patch returns AMDGPU_XGMI_LINK_NA for VFs. Signed-off-by: Simon Louis Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit b02ed0910623782877a29b8245cf6cdce4e7fee7 Author: Aurabindo Pillai Date: Wed Feb 18 15:42:08 2026 -0500 drm/amd/display: Add atomfirmware cap for DP++ Type2 Add ATOM_CONNECTOR_CAP_DP_PLUS_PLUS_TYPE2_ONLY in atom connector caps definitions. Signed-off-by: Aurabindo Pillai Signed-off-by: Nevenko Stupar Acked-by: Alex Hung Signed-off-by: Alex Deucher commit 4fd7b724a87a4051401ee2ed64c26c9249582040 Author: Lijo Lazar Date: Wed Feb 18 16:21:23 2026 +0530 drm/amdgpu: Print full vbios info Add build number, version and date to the existing part number print. Example: [drm] ATOM BIOS: 113-PN000108-103, build: 00159017, ver: 022.040.003.043.000001, 2025/07/27 Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit a17ef941212bf26e9985ec31486a9606420d8257 Author: Alex Deucher Date: Thu Jan 15 22:01:15 2026 -0500 drm/amdgpu: rework ring reset backup and reemit v9 Store the start wptr and ib size in the IB fence. On queue reset, save the ring contents of all IBs. For reemit, reemit the entire IB state for non-guilty contexts. For guilty contexts, replace the IB submission with nops, but reemit the rest. Split the reemit per fence and when we reemit, update the wptr with the new values from reemit. This allows us to reemit jobs repeatedly as the wptrs get properly updated each time. v2: further simplify the logic v3: reemit vm state, not just vm fence v4: just nop the IB and possibly the VM portion of the submission v5: simplify the vm fence check v6: split the vm and ib fences v7: fix commit message v8: use wptr rather than count_dw to calculate offsets v9: fix missing documenation update spotted by the kernel test robot Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit b43effe1887aa5b5ce43ccdfc3b05b3a4bdc5d96 Author: Roman Li Date: Wed Feb 18 10:29:46 2026 -0500 drm/amdgpu/discovery: Enable DM for DCN42 Add DM ipblock for DCN 4.2.0 Signed-off-by: Roman Li Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 70bbd833986ae6691b3609a0052a733ff2421565 Merge: 5ebc20921b7fff 78dfbd4ad0be9f Author: Mark Brown Date: Mon Feb 23 19:31:42 2026 +0000 ASoC: Add DMIC support for the AMD RPL platform Merge series from Mingyou Chen : Add DMIC support for the AMD RPL platforma. commit a6713b890c79f668870746a1aec6c5325d143c07 Author: Roman Li Date: Mon Feb 2 19:45:35 2026 -0500 drm/amd/display: Enable dcn42 in DM Add support for DCN 4.2 in Display Manager Signed-off-by: Roman Li Acked-by: Harry Wentland Signed-off-by: Alex Deucher commit 6b2dd7d37badd8bf076875397f9f39b494258ca7 Author: Roman Li Date: Mon Feb 2 18:47:34 2026 -0500 drm/amd/display: Enable dcn42 DC Add support for DCN 4.2 in Display Core Signed-off-by: Roman Li Acked-by: Harry Wentland Signed-off-by: Alex Deucher commit 083a1638330951dd57be201fc53a4b86e3115960 Author: Roman Li Date: Mon Feb 2 18:40:41 2026 -0500 drm/amd/display: Enable dcn42 DMUB Enable DMUB support for DCN 4.2 Signed-off-by: Roman Li Acked-by: Harry Wentland Signed-off-by: Alex Deucher commit 7c4757c20e9f1b74a42a23ae450610c140e1224f Author: Roman Li Date: Mon Feb 2 18:35:37 2026 -0500 drm/amd/display: Add DMUB support for dcn42 DMUB support for DCN 4.2 Signed-off-by: Roman Li Acked-by: Harry Wentland Signed-off-by: Alex Deucher commit bd096a56da7cad1c93c0138a64478b43f5a94736 Author: Roman Li Date: Mon Feb 2 18:06:17 2026 -0500 drm/amd/display: Add dcn42 DC resources Display Core resources for DCN 4.2: - CLK_MGR - DCCG - DIO - DPP - GPIO - HPO - HUBBUB - HUBP - HWSS - IRQ - MMHUBBUB - MPC - OPTC - PG Signed-off-by: Roman Li Acked-by: Harry Wentland Signed-off-by: Alex Deucher commit 2214b716a4bdae0dcaa5f08a190396dec9d8ef2f Author: Roman Li Date: Mon Feb 2 17:11:43 2026 -0500 drm/amd/display: Add dcn42 register headers Register headers for the following IPs: - DCN 4.2.0 - DPCS 4.0.0 Signed-off-by: Roman Li Acked-by: Harry Wentland Signed-off-by: Alex Deucher commit c81f35cdbab210cb8581a0502ba7355d14570abc Author: Timur Kristóf Date: Mon Jan 26 22:08:37 2026 +0100 drm/amdgpu: Use DC by default on CIK APUs Now that DC supports external DP bridge encoders, it has reached feature parity with the legacy non-DC display driver on CIK APUs: Kaveri, Kabini, Mullins. Use the DC display driver by default on SI APUs, unless it is explicitly disabled using the amdgpu.dc=0 module parameter. DC brings proper support for DP/HDMI audio, DP MST, VRR, 10-bit colors, some HDR features, atomic modesetting, etc. Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 213f95dca44e196269958a2580eda5e597d66437 Author: Timur Kristóf Date: Mon Jan 26 22:08:36 2026 +0100 drm/amd/display: Implement DAC load detection on external DP bridge encoders Use the pre-existing implementation in the BIOS parser, but call the ExternalEncoderControl function for external encoders instead of the built-in DAC load detection function. Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit d0b8bf128c82defd648e5ab52523cfaba762fd38 Author: Timur Kristóf Date: Mon Jan 26 22:08:35 2026 +0100 drm/amd/display: Use external DP bridge encoders Implement link creation for external DP bridge encoders such as NUTMEG and TRAVIS used with CIK APUs such as Kaveri for supporting analog and LVDS connections. Typically found in CIK APU based laptops or on FM2 motherboards that have analog connectors. When we query connector information from the VBIOS and discover a connector using such an encoder, let's find the real DisplayPort encoder and use that. Set the connector signal type to DP, so the pre-existing DP code paths can work with it without refactoring every signal type check in the DC code base. In the DM, make sure to report correct connector type and also to initialize DP specifics such as the AUX channel. Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit d740af07a7132486c311b3fdc7e871a34b6c745d Author: Timur Kristóf Date: Mon Jan 26 22:08:34 2026 +0100 drm/amd/display: Link detection for external DP bridge encoders Deal with some minor idiosyncracies of TRAVIS and NUTMEG chips. - Always use DP signal type with these chips so that the normal DP code paths can work with them without a major refactor of the code base. Properly set this. - NUTMEG seems to only work with HBR, not RBR, so set a preferred link rate for this chip. See amdgpu_atombios_dp_get_dp_link_config() for reference. - NUTMEG is recognized as a DP branch device but reports 0 sinks, which is wrong and confuses DC (it hits an early return). Fix that by hardcoding the sink count to 1. - Fixup old DC code selecting a special panel mode necessary for NUTMEG and TRAVIS. Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 9f556ac2e3c2a175685186355bc0f815b12929f2 Author: Timur Kristóf Date: Mon Jan 26 22:08:33 2026 +0100 drm/amd/display: Add DCE HWSS support for external DP bridge encoders Some GPUs use external DP bridge encoders NUTMEG and TRAVIS to implement analog and/or LVDS connections. Typically found in CIK APU based laptops or on FM2 motherboards that have analog connectors. These were necessary at the time because Kaveri didn't have a built-in DAC nor LVDS support. These devices sadly don't work transparently and need to be controlled by the driver. Implement the necessary control for the NUTMEG and TRAVIS encoders in the DCE HWSS. For reference, see the legacy non-DC amdgpu display code: amdgpu_atombios_encoder_setup_external_encoder() amdgpu_atombios_encoder_setup_dig() amdgpu_atombios_encoder_setup_ext_encoder_ddc() - Prepare DDC before using it: Call the EXTERNAL_ENCODER_CONTROL_DDC_SETUP action so that the encoder knows to set up DDC over the AUX channel. - When a stream is enabled or disabled: Call the EXTERNAL_ENCODER_CONTROL_ENABLE/DISABLE actions. - Before enabling the DP link: Call the EXTERNAL_ENCODER_CONTROL_SETUP action. This commit just hooks up the HWSS support. Detecting the external DP bridge encoders will be done in a subsequent commit. Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 88b2cbd2bc76d7c95003a3f027d9c2ffc14eb9c4 Author: Timur Kristóf Date: Mon Jan 26 22:08:32 2026 +0100 drm/amd/display: Use preferred DP link rate if specified The DisplayPort code already has the concept of preferred link settings, but it only allows setting a preferred lane count and link width at the same time. It does not consider the possiblity that some devices may not work on lower link rates but may support various lane counts. Allow specifying a preferred link rate which will be used as the initial link rate when deciding the DP link settings. This is necessary to support NUTMEG which only works with HBR but not with RBR. For reference, see the legacy non-DC amdgpu display code: amdgpu_atombios_dp_get_dp_link_config() Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 05a606fc39840257b66bbe3bafef733218657304 Author: Timur Kristóf Date: Mon Jan 26 22:08:31 2026 +0100 drm/amd/display: Add ability for HWSS to prepare the DDC before use Make it possible to add a HWSS function to prepare the DDC before trying to use it. This is going to be necessary for external DP bridge encoders. This commit just adds the function to common DC code. The actual implementation of this function for DCE is done in a subsequent commit. Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 7b6e66b6dd55350be309f43772b7de8ae57c56eb Author: Timur Kristóf Date: Mon Jan 26 22:08:30 2026 +0100 drm/amd/display: Implement DDC probe over AUX channel DDC probe means that we use the DDC (Display Data Channel) to verify whether a display is connected or not. This was written with mainly analog connectors in mind, so it didn't work over the AUX channel. However, in order to support external DP bridge encoders found in CIK APUs, it needs to work over the AUX channel too. Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit ee5c4855f43c1af96c3f7e4412ce9492b00023fe Author: Timur Kristóf Date: Mon Jan 26 22:08:29 2026 +0100 drm/amd/display: Implement BIOS parser external encoder control The VBIOS has a function called ExternalEncoderControl which controls the DP bridge encoders that some GPUs use for analog and LVDS output. Fixup this old functionality. For reference, see the legacy non-DC amdgpu display code: amdgpu_atombios_encoder_setup_external_encoder() - Set same parameters for the ENABLE action as the SETUP action - Add missing enum values for DDC setup and DAC load detection - Fix the bits per color field - Clarify the code that sets the link rate - Expose the function so that it can be called by rest of DC A subsequent commit will call this function from DCE HWSS. Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit f7d1c50aecdaafcefc6e83e0b627297b6c633076 Author: Timur Kristóf Date: Mon Jan 26 22:08:28 2026 +0100 drm/amd/display: Refactor DAC load detection, move to HWSS Slightly refactor and simplify DAC load detection. This prepares the code to be used for also executing DAC load detection on external DP bridge encoders. DAC load detection belongs better in the hardware sequencer code because the implementation is HW dependent and not all chips support the functionality. The code is cleaner when link detection probably doesn't call the VBIOS directly. Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 2e26056f36ebe69608197d6a26a2abb7d11e2aad Author: Timur Kristóf Date: Mon Jan 26 22:08:27 2026 +0100 drm/amd/display: Add color depth helper function to BIOS parser To improve consistency and avoid duplicating the same code. Also, properly handle all enum values where they weren't handled correctly before. Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 2463b2952e9a0064ead5a95b709cd9c90ddf199b Author: Timur Kristóf Date: Sun Jan 18 18:31:50 2026 +0100 drm/amd/display: Handle DCE 6 in dce110_register_irq_handlers The dce60_register_irq_handlers function was basically identical to dce110_register_irq_handlers. They can use the same function, reducing duplicated code and easing the maintenance burden for old DCE versions. Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit d31e61604820b700d51d5b0a285363be0d95eee8 Author: Timur Kristóf Date: Sun Jan 18 18:31:49 2026 +0100 drm/amd/display: Handle DCE 6 in dce_clk_mgr.c dce60_clk_mgr was basically identical to dce_clk_mgr other than a few minor details. They can be all handled in the same file, reducing duplicated code and easing the maintenance burden for old DCE versions. Signed-off-by: Timur Kristóf Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 3a3aaed8f04bc1869fdcc1b769b3b1172a5f4e2c Author: Timur Kristóf Date: Sun Jan 18 18:31:48 2026 +0100 drm/amd/display: Remove unused dce60_clk_mgr register definitions It turned out that these were actually not necessary. Signed-off-by: Timur Kristóf Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit ecdf982ccc680deea59f4577c9a4947a5182e574 Author: Timur Kristóf Date: Sun Jan 18 18:31:47 2026 +0100 drm/amd/display: Delete unused dce_clk_mgr.c This file was not compiled or included anywhere and not modified for years. And it has duplicate function definitions of many functions that are defined in other files. That leads to a lot of confusion (for both developers and for code editors), eg. when searching for a definition of a function it can end up on one of the functions in this file instead of the real implementations. I suspect that it was forgotten that this should be deleted after the various clock manager functions were split into hardware generation specific files. Delete it now. Signed-off-by: Timur Kristóf Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit a1d3efc329b45318721a4b1e1f893322ba82c876 Author: Timur Kristóf Date: Sun Jan 18 18:31:46 2026 +0100 drm/amd/display: Use dce_audio_create for DCE 6 The only difference between DCE 6 and other DCE versions is that DCE 6 doesn't support DCCG_AUDIO_DTO2_USE_512FBR_DTO. Recently a check was added to dce_aud_wall_dto_setup() to check that. So now DCE 6 can just use dce_aud_wall_dto_setup() just like other DCE versions. Clean up DCE 6 specific audio functions which were otherwise identical to the rest. Signed-off-by: Timur Kristóf Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 619cf5be962f868f9225225e028edd1370296c90 Author: Roman Li Date: Mon Feb 2 18:18:39 2026 -0500 drm/amd/display: Add dcn42 version identifiers Add DCN 4.2 asic version identifiers. Signed-off-by: Roman Li Acked-by: Harry Wentland Signed-off-by: Alex Deucher commit 37872d06f85f0349e7b1f0680aea77326f7c135e Author: Srinivasan Shanmugam Date: Thu Feb 12 21:30:50 2026 +0530 drm/amdgpu: Make amdgpu_vm_flush() non-failing in submission path amdgpu_vm_flush() is used during job submission and is not expected to fail. Convert it to return void and simplify the caller. Initialize the COND_EXEC patch location to 0 so it is safe to call amdgpu_ring_patch_cond_exec() when init_cond_exec is not supported. Suggested-by: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 7abc868acf804e1340b6e2978c255fa490710543 Author: Srinivasan Shanmugam Date: Tue Feb 10 20:25:05 2026 +0530 drm/amdgpu: Make amdgpu_fence_emit() non-failing v2 dma_fence_wait(old, false) is not interruptible and cannot return an error. Drop the unreachable error handling in amdgpu_fence_emit(). Since the function can no longer fail, convert amdgpu_fence_emit() to return void and remove return value handling from all callers. v2: - Add comment explaining why dma_fence_wait(..., false) return value is ignored (Alex) Suggested-by: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit d3499de3b737f3f6a2058382f7bff641c74f52a4 Author: Alex Deucher Date: Fri Jan 23 09:27:23 2026 -0500 drm/amdgpu: reorder IB schedule sequence This reorders the IB schedule sequence to cleanly separate the vm operation from the IB submission. This makes the two independent so we can cleanly associate each one with its respective fence. v2: fixes for VCN Acked-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Alex Deucher commit 90d5122115fb4513161e7a8413d28215c237295c Author: Tvrtko Ursulin Date: Mon Jan 12 10:22:38 2026 +0000 drm/amdgpu: Remove duplicate struct member Struct amdgpu_ctx contains two copies of the pointer to the context manager. Remove one. Signed-off-by: Tvrtko Ursulin Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 08e7d6c3cee880bd3ec3eb14c478f9fa805b0bdc Author: Alex Deucher Date: Thu Jan 29 14:49:13 2026 -0500 drm/amdgpu: add a helper to calculate ring distance Add a helper to calculate the distance in DWs between two wptrs. Reviewed-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Alex Deucher commit d8e4e77c4d5f3284cba221e3137b4cadccec2c9c Author: Alex Deucher Date: Mon Feb 9 11:59:40 2026 -0500 drm/amdgpu: remove some retired module parameters The mes and mes_kiq parameters we originally added for mes bring up. However, mes is required for operation on gfx11 and newer so these parameters aren't actually used by the driver anymore. Remove them. Reviewed-by: Kent Russell Signed-off-by: Alex Deucher commit 01fb6e8568866e98f250dde9d70c97f308db5f7b Author: Alex Deucher Date: Sat Jan 3 13:29:19 2026 -0500 drm/amdgpu: don't call drm_sched_stop/start() in asic reset We only want to stop the work queues, not mess with the fences, etc. v2: add the job back to the pending list. v3: return the proper job status so scheduler adds the job back to the pending list Acked-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Alex Deucher commit d5e53ff42fa53fcf9ce7e9b9fef6876ebd14378e Author: Tvrtko Ursulin Date: Mon Jan 12 10:22:37 2026 +0000 drm/amdgpu: Remove a few holes from struct amdgpu_ctx Re-order the struct members a bit to avoid some holes: /* size: 408, cachelines: 7, members: 15 */ /* sum members: 393, holes: 4, sum holes: 15 */ /* last cacheline: 24 bytes */ /* size: 400, cachelines: 7, members: 15 */ /* sum members: 393, holes: 1, sum holes: 7 */ /* last cacheline: 16 bytes */ While doing so we notice a duplicate but will address than in the following patch. Signed-off-by: Tvrtko Ursulin Reviewed-by: Christian König Signed-off-by: Alex Deucher commit cb9a5ff7ad2c568ec6084906fc8b1cb6298cfeee Author: Jesse.Zhang Date: Fri Jan 23 13:05:29 2026 +0800 drm/amdgpu/gfx12: add CU mask support for compute MQD initialization Extend the GFX12 compute MQD initialization to support Compute Unit (CU) masking for fine-grained resource allocation. This allows compute queues to be limited to specific CUs for performance isolation and debugging purposes. Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit d68c4e48e4357b782de09a5e3150d0dbe7dcb58e Author: Jesse.Zhang Date: Fri Jan 23 13:00:13 2026 +0800 drm/amdgpu/gfx11: add CU mask support for compute MQD initialization Extend the GFX11 compute MQD initialization to support Compute Unit (CU) masking for fine-grained resource allocation. This allows compute queues to be limited to specific CUs for performance isolation and debugging purposes. Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 0ea556047d49d8d735d324c9c0176e67e252ad77 Author: Jesse.Zhang Date: Fri Jan 23 16:39:20 2026 +0800 drm/amdgpu: Add CU mask support for MQD properties Add new fields to the amdgpu_mqd_prop structure to track CU (Compute Unit) mask information, including the mask itself, count, flags, and a flag to indicate if user-specified CU masking is active. v2: Create a generic function amdgpu_gfx_mqd_symmetrically_map_cu_mask() Suggested-by: Alex Deucher Signed-off-by: Jesse Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit c26ad36d9072e0e7b0974fb67c196d043af51c2f Author: Jesse.Zhang Date: Fri Jan 23 15:37:49 2026 +0800 drm/amdgpu: add mqd_update callback to AMDGPU user queue interface Extend the AMDGPU user queue function interface to support MQD updates by adding an mqd_update callback. v2: add the input paramter struct drm_amdgpu_userq_in in mqd_update Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 79a0ff59a55fa8c2cf9a7148a04dd45e9294e13f Author: Pierre-Eric Pelloux-Prayer Date: Wed Nov 19 14:13:00 2025 +0100 drm/amdgpu: move sched status check inside amdgpu_ttm_set_buffer_funcs_status It avoids duplicated code and allows to output a warning. --- v4: move check inside the existing if (enable) test --- Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit e3dc7976054668a5556291f8162f050693160afb Author: Pierre-Eric Pelloux-Prayer Date: Tue Sep 9 15:39:24 2025 +0200 drm/amdgpu: introduce amdgpu_sdma_set_vm_pte_scheds All sdma versions used the same logic, so add a helper and move the common code to a single place. --- v2: pass amdgpu_vm_pte_funcs as well v3: drop all the *_set_vm_pte_funcs one liners v5: rebased --- Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 91ff83b58ca60cf8a31b64c9e82f796896284689 Author: Pierre-Eric Pelloux-Prayer Date: Fri Sep 19 10:35:27 2025 +0200 drm/amdgpu: double AMDGPU_GTT_MAX_TRANSFER_SIZE Makes copies/evictions faster when gart windows are required. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit f633edd26562104bbc206858aea38d461abcdc9f Author: Pierre-Eric Pelloux-Prayer Date: Tue Nov 18 15:09:14 2025 +0100 drm/amdgpu: check entity lock is held in amdgpu_ttm_job_submit drm_sched_job_arm and drm_sched_entity_push_job must be called under the same lock to guarantee the order of execution. This commit adds a check in amdgpu_ttm_job_submit and fix the places where the lock was missing. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 30f2daedf4d8adfa331b05fcce06746e643e1f18 Author: Pierre-Eric Pelloux-Prayer Date: Tue Nov 18 15:15:04 2025 +0100 drm/amdgpu: add missing lock in amdgpu_benchmark_do_move Taking the entity lock is required to guarantee the ordering of execution. The next commit will add a check that the lock is held. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 3d9eea6d000b34a087d02b1614931cff039d7f26 Author: Pierre-Eric Pelloux-Prayer Date: Mon Jan 26 10:17:43 2026 +0100 amdgpu/gtt: remove AMDGPU_GTT_NUM_TRANSFER_WINDOWS It's not needed anymore. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit db3b7488e6859223fa0d8e8b419202cf599dde75 Author: Pierre-Eric Pelloux-Prayer Date: Mon Jan 26 10:17:24 2026 +0100 amdgpu/ttm: use amdgpu_gtt_mgr_alloc_entries Use amdgpu_gtt_mgr_alloc_entries for each entity instead of reserving a fixed number of pages. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 71aec08f80e7062027a59ddb0ff1924f4b672452 Author: Pierre-Eric Pelloux-Prayer Date: Mon Jan 26 09:48:16 2026 +0100 amdgpu/vce: use amdgpu_gtt_mgr_alloc_entries Instead of reserving a number of GTT pages for VCE 1.0 this commit now uses amdgpu_gtt_mgr_alloc_entries to allocate the pages when initializing vce 1.0. While at it remove the "does the VCPU BO already have a 32-bit address" check as suggested by Timur. This decouples vce init from gtt init. --- v7: renamed variables (Christian) --- Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 866eedef4cc6d8e06c1888860ef2b98c8f6aaca4 Author: Pierre-Eric Pelloux-Prayer Date: Wed Jan 28 16:47:01 2026 +0100 drm/amdgpu: add amdgpu_gtt_node_to_byte_offset helper Having a helper avoids code duplication. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 2e88530255e76e11266bcdbb1eaf533e75f95d37 Author: Pierre-Eric Pelloux-Prayer Date: Fri Jan 9 16:19:10 2026 +0100 drm/amdgpu: add amdgpu_ttm_buffer_entity_fini func This allows to have init/fini functions to hold all the init and teardown code for amdgpu_ttm_buffer_entity. For now only drm_sched_entity init/destroy function calls are moved here, but as entities gain new members it will make code simpler. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 2c3725572561e962aa8eeeba2f51394d4c6b7c27 Author: Pierre-Eric Pelloux-Prayer Date: Tue Nov 18 14:58:43 2025 +0100 drm/amdgpu: statically assign gart windows to ttm entities If multiple entities share the same window we must make sure that jobs using them are executed sequentially. This commit gives separate windows to each entity, so jobs from multiple entities could execute in parallel if needed. (for now they all use the first sdma engine, so it makes no difference yet). The entity stores the gart window offsets to centralize the "window id" to "window offset" in a single place. default_entity doesn't get any windows reserved since there is no use for them. --- v3: - renamed gart_window_lock -> lock (Christian) - added amdgpu_ttm_buffer_entity_init (Christian) - fixed gart_addr in svm_migrate_gart_map (Felix) - renamed gart_window_idX -> gart_window_offs[] - added amdgpu_compute_gart_address v4: - u32 -> u64 - added kerneldoc v5: - removed gtt_window_lock - simplified gart window creation and use: entities using a single window now uses window #0 instead of #1 - fix dst_addr calculation in kfd_migrate.c --- Signed-off-by: Pierre-Eric Pelloux-Prayer Acked-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 49fe425da6756b3790ad9a1dd9a051998737e81d Author: Pierre-Eric Pelloux-Prayer Date: Thu Jan 8 17:08:06 2026 +0100 drm/amdgpu: remove gart_window_lock usage from gmc v12_1 Same as what was done in commit c79cf5a7d903 ("drm/amdgpu: remove gart_window_lock usage from gmc v12") for v12. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher commit e20592cd37ffa0d93b3559584a8bef1ac3afff9e Author: Taimur Hassan Date: Fri Feb 6 18:06:54 2026 -0500 drm/amd/display: Promote DC to 3.2.370 This version brings along the following updates: - Add static keyword for sharpness tables. - Refactor fams2 calculations. - Add gpuvm and hvm params to dml21. - Expose functions of other dcn use. - Disable SR feature on eDP1 by default. - Implement ramless idle mouse trigger. - Migrate DCCG register access from hwseq to dccg component. - Revert "Add Handling for gfxversion DcGfxBase". - Revert changes to Gfx Linear Tiling handling. - Skip eDP detection when no sink. - Refactor and fix link_dpms I2C. - Refactor and fix link_dpms info. - Correct logic check error for fast boot. - Check return of shaper curve to HW format. - Remove conditional for shaper 3DLUT power-on. Acked-by: Tom Chung Signed-off-by: Taimur Hassan Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 40989bf0e7d13d2f290f081ae8f683c080efe877 Author: Dominik Kaszewski Date: Thu Jan 29 11:53:29 2026 +0100 drm/amd/display: Refactor and fix link_dpms info [Why] get_ext_hdmi_settings contained a copy-paste error, assigning both reg_num_6g and reg_num from dp0_ext_hdmi_6g_reg_num. [How] * Correctly assign reg_num from dp0_ext_hdmi_reg_num. * Refactor and clean the function. Reviewed-by: Wenjing Liu Signed-off-by: Dominik Kaszewski Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit a4f01bf729b2e0042bc725bb6254a8abea17f1a7 Author: Dominik Kaszewski Date: Thu Jan 29 11:26:13 2026 +0100 drm/amd/display: Refactor and fix link_dpms I2C [Why] link_dpms.c issues I2C writes during HDMI link enablement. Current implementation contains a lot of duplicated code with copy-paste errors. [How] * Refactor common logic into helper functions. * Invert logic with early returns to decrease indentation. * Sequence writes by looping over data arrays. * Fix write_i2c_retimer_setting is_over_340mhz checking reg_settings instead of reg_settings_6g in the i2c_reg_index <= 0x20 check. Reviewed-by: Wenjing Liu Signed-off-by: Dominik Kaszewski Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 49bf43ac9838553b63bcd32b84e87f834a7e2234 Author: Dmytro Laktyushkin Date: Fri Jan 23 09:52:40 2026 -0500 drm/amd/display: Add gpuvm and hvm params to dml21 [Why & How] Add missing params to display configuration for dml21 Reviewed-by: Charlene Liu Signed-off-by: Dmytro Laktyushkin Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f373ef3622662026dd32059a186f63bd898cf039 Author: Dillon Varone Date: Tue Dec 9 16:20:26 2025 -0500 drm/amd/display: Refactor fams2 calculations [WHY&HOW] Cleanup calculations based on version to improve for future expansion. Reviewed-by: Austin Zheng Signed-off-by: Dillon Varone Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 507a071d9868cb60e4e76f8a06fc8eb014f59ae4 Author: Andy Shevchenko Date: Mon Feb 23 16:30:54 2026 +0100 spi: pxa2xx: use min() instead of min_t() min_t(int, a, b) casts an 'u32' to 'int'. This might lead to the cases when big number is wrongly chosen. On the other hand, the SPI transfer speed rate is unsigned and driver uses signed type for an unknown reason. Change the type of the SPI transfer speed to be unsigned and convert to use min() instead of min_t(). Signed-off-by: Andy Shevchenko Reviewed-by: David Laight Link: https://patch.msgid.link/20260223153117.2838840-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 6cee29ad9d7e400d39ae0b1a54447fedcb62eecd Author: Rafael J. Wysocki Date: Mon Feb 23 16:28:57 2026 +0100 ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver If a CMOS RTC (PNP0B00/PNP0B01/PNP0B02) device coexists with an ACPI TAD (timer and event alarm device, ACPI000E), the ACPI TAD driver will attempt to install the CMOS RTC address space hanlder that has been installed already and the TAD probing will fail. Avoid that by changing acpi_install_cmos_rtc_space_handler() to return zero and acpi_remove_cmos_rtc_space_handler() to do nothing if the CMOS RTC address space handler has been installed already. Fixes: 596ca52a56da ("ACPI: TAD: Install SystemCMOS address space handler for ACPI000E") Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2415111.ElGaqSPkdT@rafael.j.wysocki commit ba0b236736dde4059bdcb8e99beaa50d6e5b6e7e Author: Rafael J. Wysocki Date: Mon Feb 23 16:28:15 2026 +0100 ACPI: x86: cmos_rtc: Clean up address space handler driver Make multiple changes that do not alter functionality to the CMOS RTC ACPI address space handler driver, including the following: - Drop the unused .detach() callback from cmos_rtc_handler. - Rename acpi_cmos_rtc_attach_handler() to acpi_cmos_rtc_attach(). - Rearrange acpi_cmos_rtc_space_handler() to reduce the number of redundant checks and make white space follow the coding style. - Adjust an error message in acpi_install_cmos_rtc_space_handler() and make the white space follow the coding style. - Rearrange acpi_remove_cmos_rtc_space_handler() and adjust an error message in it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5094429.31r3eYUQgx@rafael.j.wysocki commit 8c5f9645c3893f0db679d9affe4fe4e665b990dd Author: Leon Romanovsky Date: Sat Jan 31 07:34:18 2026 +0200 iommufd: Add dma_buf_pin() IOMMUFD relies on a private protocol with VFIO, and this always operated in pinned mode. Now that VFIO can support pinned importers update IOMMUFD to invoke the normal dma-buf flow to request pin. This isn't enough to allow IOMMUFD to work with other exporters, it still needs a way to get the physical address list which is another series. IOMMUFD supports the defined revoke semantics. It immediately stops and fences access to the memory inside it's invalidate_mappings() callback, and it currently doesn't use scatterlists so doesn't call map/unmap at all. It is expected that a future revision can synchronously call unmap from the move_notify callback as well. Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Acked-by: Christian König Signed-off-by: Leon Romanovsky Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260131-dmabuf-revoke-v7-8-463d956bd527@nvidia.com commit 6ffe939bf94fbbeaaa4050a0e9c22820e959b15f Author: Leon Romanovsky Date: Sat Jan 31 07:34:17 2026 +0200 vfio: Permit VFIO to work with pinned importers Till now VFIO has rejected pinned importers, largely to avoid being used with the RDMA pinned importer that cannot handle a move_notify() to revoke access. Using dma_buf_attach_revocable() it can tell the difference between pinned importers that support the flow described in dma_buf_invalidate_mappings() and those that don't. Thus permit compatible pinned importers. This is one of two items IOMMUFD requires to remove its private interface to VFIO's dma-buf. Reviewed-by: Kevin Tian Reviewed-by: Alex Williamson Reviewed-by: Christian König Signed-off-by: Leon Romanovsky Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260131-dmabuf-revoke-v7-7-463d956bd527@nvidia.com commit be6d4c9e9d714ebbf358be41332726a0f94b9ffa Author: Leon Romanovsky Date: Sat Jan 31 07:34:16 2026 +0200 dma-buf: Add dma_buf_attach_revocable() Some exporters need a flow to synchronously revoke access to the DMA-buf by importers. Once revoke is completed the importer is not permitted to touch the memory otherwise they may get IOMMU faults, AERs, or worse. DMA-buf today defines a revoke flow, for both pinned and dynamic importers, which is broadly: dma_resv_lock(dmabuf->resv, NULL); // Prevent new mappings from being established priv->revoked = true; // Tell all importers to eventually unmap dma_buf_invalidate_mappings(dmabuf); // Wait for any inprogress fences on the old mapping dma_resv_wait_timeout(dmabuf->resv, DMA_RESV_USAGE_BOOKKEEP, false, MAX_SCHEDULE_TIMEOUT); dma_resv_unlock(dmabuf->resv, NULL); // Wait for all importers to complete unmap wait_for_completion(&priv->unmapped_comp); This works well, and an importer that continues to access the DMA-buf after unmapping it is very buggy. However, the final wait for unmap is effectively unbounded. Several importers do not support invalidate_mappings() at all and won't unmap until userspace triggers it. This unbounded wait is not suitable for exporters like VFIO and RDMA tha need to issue revoke as part of their normal operations. Add dma_buf_attach_revocable() to allow exporters to determine the difference between importers that can complete the above in bounded time, and those that can't. It can be called inside the exporter's attach op to reject incompatible importers. Document these details about how dma_buf_invalidate_mappings() works and what the required sequence is to achieve a full revocation. Signed-off-by: Leon Romanovsky Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260131-dmabuf-revoke-v7-6-463d956bd527@nvidia.com commit 575157b1b5fcfcdd0f9c42d635dcf8219f8c86dc Author: Leon Romanovsky Date: Sat Jan 31 07:34:15 2026 +0200 dma-buf: Make .invalidate_mapping() truly optional The .invalidate_mapping() callback is documented as optional, yet it effectively became mandatory whenever importer_ops were provided. This led to cases where RDMA non-ODP code had to supply an empty stub. Relax the checks in the dma-buf core so the callback can be omitted, allowing RDMA code to drop the unnecessary function. Removing the stub allows the next patch to tell that RDMA does not support .invalidate_mapping() by checking for a NULL op. Signed-off-by: Leon Romanovsky Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260131-dmabuf-revoke-v7-5-463d956bd527@nvidia.com commit 92dfd92f747698352b256cd9ddd7497bb7ebe9c8 Author: Francesco Lavra Date: Wed Nov 26 11:46:18 2025 +0100 hte: tegra194: remove Kconfig dependency on Tegra194 SoC This driver runs also on other Tegra SoCs (e.g. Tegra234). Replace Kconfig dependency on Tegra194 with more generic dependency on Tegra, and amend the Kconfig help text to reflect the fact that this driver works on SoCs other than Tegra194. Fixes: b003fb5c9df8 ("hte: Add Tegra234 provider") Signed-off-by: Francesco Lavra Acked-by: Dipen Patel Signed-off-by: Dipen Patel commit 52bc3daed226a01f2b4895792a55e23f7c6be509 Author: Marco Crivellari Date: Wed Dec 24 15:32:34 2025 +0100 hte: replace use of system_unbound_wq with system_dfl_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Dipen Patel commit 2d763a22a64c6960af35aeea1de2ba2a0344c831 Author: Sherry Sun Date: Sun Jan 18 11:28:06 2026 -0500 arm64: dts: imx8mp-evk: add bluetooth dts node Add bluetooth dts node. Signed-off-by: Sherry Sun Signed-off-by: Frank Li commit 7dd78559984d2dc2d69a5aa183b3efd19b7593da Author: Frank Li Date: Sun Jan 18 11:28:05 2026 -0500 arm64: dts: imx8mp-evk: replace space with tab Replace spaces with tabs to follow the coding style. Reviewed-by: Marco Felsch Signed-off-by: Frank Li commit 556de0fc240d5a182cbff6526f7712066a6011cc Author: Sherry Sun Date: Sun Jan 18 11:28:03 2026 -0500 arm64: dts: imx8mn-evk: add bluetooth dts node Add bluetooth dts node. Signed-off-by: Sherry Sun Reviewed-by: Marco Felsch Signed-off-by: Frank Li commit 09a38b6f101aaac7cd66ec4af818484f79b1ee20 Author: Fugang Duan Date: Sun Jan 18 11:28:02 2026 -0500 arm64: dts: imx8mm-evk: add uart3 port Add uart3 port. Signed-off-by: Fugang Duan Signed-off-by: Frank Li commit 193be56821bc417d14e28a58d2502bcf37c318e1 Author: Sherry Sun Date: Sun Jan 18 11:28:00 2026 -0500 arm64: dts: imx8mm-evk: add uart1 and bluetooth node Add uart1 and bluetooth node. Signed-off-by: Sherry Sun Reviewed-by: Marco Felsch Signed-off-by: Frank Li commit 9184a2c9b1937c46f58fc419114efebec7a0b99b Author: Shengjiu Wang Date: Sun Jan 18 11:27:59 2026 -0500 arm64: dts: imx8mm-evk: correct the spdif compatible string Correct the spdif compatible string to "fsl,imx8mm-spdif". Signed-off-by: Shengjiu Wang Reviewed-by: Marco Felsch Signed-off-by: Frank Li commit a3959de80f55d46b9a4001622b1e328dd218e051 Author: Frank Li Date: Sun Jan 18 11:27:58 2026 -0500 arm64: dts: imx8mm-evk: replace space with tab Replace spaces with tabs to follow the coding style. Reviewed-by: Marco Felsch Signed-off-by: Frank Li commit 0e629783f493ae450196ce8e33c5558ced351d4a Author: Frank Li Date: Wed Feb 11 17:15:25 2026 -0500 dt-bindings: fsl: add compatible string fsl,imx25-aips Add compatible string fsl,imx25-aips to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dtb: /soc/bus@43f00000/bridge@43f00000: failed to match any schema with compatible: ['fsl,imx25-aips'] Signed-off-by: Frank Li Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20260211221529.3745404-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit a45ff9dd3fec5d604f99b2665c40db26ce81ec0c Author: Rob Herring (Arm) Date: Wed Jan 21 15:27:14 2026 -0600 checkpatch: Fix false DT_SPLIT_BINDING_PATCH warnings Patches which both remove and add/modify DT binding files are incorrectly flagged as needing to split the patch. The issue is the check sees "dev/null" as one of the files in the patch which is not a DT binding file. Add "dev/null" to the skipped files. Link: https://patch.msgid.link/20260121212715.144495-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit fd54d81c2c0e6cffd5470c2c27fbb04d0ebe7da0 Author: Christian Loehle Date: Tue Feb 3 18:49:39 2026 +0000 sched/fair: Skip SCHED_IDLE rq for SCHED_IDLE task CPUs whose rq only have SCHED_IDLE tasks running are considered to be equivalent to truly idle CPUs during wakeup path. For fork and exec SCHED_IDLE is even preferred. This is based on the assumption that the SCHED_IDLE CPU is not in an idle state and might be in a higher P-state, allowing the task/wakee to run immediately without sharing the rq. However this assumption doesn't hold if the wakee has SCHED_IDLE policy itself, as it will share the rq with existing SCHED_IDLE tasks. In this case, we are better off continuing to look for a truly idle CPU. On a Intel Xeon 2-socket with 64 logical cores in total this yields for kernel compilation using SCHED_IDLE: +---------+----------------------+----------------------+--------+ | workers | mainline (seconds) | patch (seconds) | delta% | +=========+======================+======================+========+ | 1 | 4384.728 ± 21.085 | 3843.250 ± 16.235 | -12.35 | | 2 | 2242.513 ± 2.099 | 1971.696 ± 2.842 | -12.08 | | 4 | 1199.324 ± 1.823 | 1033.744 ± 1.803 | -13.81 | | 8 | 649.083 ± 1.959 | 559.123 ± 4.301 | -13.86 | | 16 | 370.425 ± 0.915 | 325.906 ± 4.623 | -12.02 | | 32 | 234.651 ± 2.255 | 217.266 ± 0.253 | -7.41 | | 64 | 202.286 ± 1.452 | 197.977 ± 2.275 | -2.13 | | 128 | 217.092 ± 1.687 | 212.164 ± 1.138 | -2.27 | +---------+----------------------+----------------------+--------+ Signed-off-by: Christian Loehle Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Vincent Guittot Tested-by: K Prateek Nayak Link: https://patch.msgid.link/20260203184939.2138022-1-christian.loehle@arm.com commit c2a57380df9dd5df6fae11c6ba9f624b9cad3e6a Author: Marco Crivellari Date: Fri Nov 7 10:24:52 2025 +0100 sched: Replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. For more details see the Link tag below. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Switch to using system_dfl_wq because system_unbound_wq is going away as part of a workqueue restructuring. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Link: https://patch.msgid.link/20251107092452.43399-1-marco.crivellari@suse.com commit c0e1832ba6dad7057acf3f485a87e0adccc23141 Author: Dengjun Su Date: Wed Feb 4 19:59:29 2026 +0800 sched: Fix incorrect schedstats for rt and dl thread For RT and DL thread, only 'set_next_task_(rt/dl)' will call 'update_stats_wait_end_(rt/dl)' to update schedstats information. However, during the migration process, 'update_stats_wait_start_(rt/dl)' will be called twice, which will cause the values of wait_max and wait_sum to be incorrect. The specific output as follows: $ cat /proc/6046/task/6046/sched | grep wait wait_start : 0.000000 wait_max : 496717.080029 wait_sum : 7921540.776553 A complete schedstats information update flow of migrate should be __update_stats_wait_start() [enter queue A, stage 1] -> __update_stats_wait_end() [leave queue A, stage 2] -> __update_stats_wait_start() [enter queue B, stage 3] -> __update_stats_wait_end() [start running on queue B, stage 4] Stage 1: prev_wait_start is 0, and in the end, wait_start records the time of entering the queue. Stage 2: task_on_rq_migrating(p) is true, and wait_start is updated to the waiting time on queue A. Stage 3: prev_wait_start is the waiting time on queue A, wait_start is the time of entering queue B, and wait_start is expected to be greater than prev_wait_start. Under this condition, wait_start is updated to (the moment of entering queue B) - (the waiting time on queue A). Stage 4: the final wait time = (time when starting to run on queue B) - (time of entering queue B) + (waiting time on queue A) = waiting time on queue B + waiting time on queue A. The current problem is that stage 2 does not call __update_stats_wait_end to update wait_start, which causes the final computed wait time = waiting time on queue B + the moment of entering queue A, leading to incorrect wait_max and wait_sum. Add 'update_stats_wait_end_(rt/dl)' in 'update_stats_dequeue_(rt/dl)' to update schedstats information when dequeue_task. Signed-off-by: Dengjun Su Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260204115959.3183567-1-dengjun.su@mediatek.com commit d3d663faa1d4e86491b77ab72eabc3ea2f58b197 Author: Vincent Guittot Date: Fri Feb 6 10:54:54 2026 +0100 sched/fair: Filter false overloaded_group case for EAS With EAS, a group should be set overloaded if at least 1 CPU in the group is overutilized but it can happen that a CPU is fully utilized by tasks because of clamping the compute capacity of the CPU. In such case, the CPU is not overutilized and as a result should not be set overloaded as well. group_overloaded being a higher priority than group_misfit, such group can be selected as the busiest group instead of a group with a mistfit task and prevents load_balance to select the CPU with the misfit task to pull the latter on a fitting CPU. Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Tested-by: Pierre Gondois Link: https://patch.msgid.link/20260206095454.1520619-1-vincent.guittot@linaro.org commit 9264758066061e660c86e48cff1bac4a58a7324a Author: Vincent Guittot Date: Fri Feb 13 11:17:51 2026 +0100 sched/fair: Update overutilized detection Checking uclamp_min is useless and counterproductive for overutilized state as misfit can now happen without being in overutilized state. Since commit e5ed0550c04c ("sched/fair: unlink misfit task from cpu overutilized") util_fits_cpu returns -1 when uclamp_min is above capacity which is not considered as cpu overutilized. Remove the useless rq_util_min parameter. Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Qais Yousef Reviewed-by: Christian Loehle Link: https://patch.msgid.link/20260213101751.3121899-1-vincent.guittot@linaro.org commit db4551e2ba346663b7b16f0b5d36d308b615c50e Author: Peter Zijlstra Date: Wed Feb 11 17:07:58 2026 +0100 sched/fair: Use full weight to __calc_delta() Since we now use the full weight for avg_vruntime(), also make __calc_delta() use the full value. Since weight is effectively NICE_0_LOAD, this is 20 bits on 64bit. This leaves 44 bits for delta_exec, which is ~16k seconds, way longer than any one tick would ever be, so no worry about overflow. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Vincent Guittot Tested-by: K Prateek Nayak Tested-by: Shubhang Kaushik Link: https://patch.msgid.link/20260219080625.183283814%40infradead.org commit 101f3498b4bdfef97152a444847948de1543f692 Author: Peter Zijlstra Date: Mon Jan 26 20:56:23 2026 +0100 sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") Zicheng Qu reported that, because avg_vruntime() always includes cfs_rq->curr, when ->on_rq, place_entity() doesn't work right. Specifically, the lag scaling in place_entity() relies on avg_vruntime() being the state *before* placement of the new entity. However in this case avg_vruntime() will actually already include the entity, which breaks things. Also, Zicheng Qu argues that avg_vruntime should be invariant under reweight. IOW commit 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") was wrong! The issue reported in 6d71a9c61604 could possibly be explained by rounding artifacts -- notably the extreme weight '2' is outside of the range of avg_vruntime/sum_w_vruntime, since that uses scale_load_down(). By scaling vruntime by the real weight, but accounting it in vruntime with a factor 1024 more, the average moves significantly. However, that is now cured. Tested by reverting 66951e4860d3 ("sched/fair: Fix update_cfs_group() vs DELAY_DEQUEUE") and tracing vruntime and vlag figures again. Reported-by: Zicheng Qu Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Vincent Guittot Tested-by: K Prateek Nayak Tested-by: Shubhang Kaushik Link: https://patch.msgid.link/20260219080625.066102672%40infradead.org commit 4823725d9d1d9cc5b36647e0cb8ff616cad6536f Author: Peter Zijlstra Date: Fri Sep 26 21:43:56 2025 +0200 sched/fair: Increase weight bits for avg_vruntime Due to the zero_vruntime patch, the deltas are now a lot smaller and measurement with kernel-build and hackbench runs show about 45 bits used. This ensures avg_vruntime() tracks the full weight range, reducing numerical artifacts in reweight and the like. Also, lets keep the paranoid debug code around fow now. Signed-off-by: Peter Zijlstra (Intel) Tested-by: K Prateek Nayak Tested-by: Shubhang Kaushik Link: https://patch.msgid.link/20260219080624.942813440%40infradead.org commit 9fe89f022c05d99c052d6bc088b82d4ff83bf463 Author: Peter Zijlstra Date: Tue Jan 27 16:17:48 2026 +0100 sched/fair: More complex proportional newidle balance It turns out that a few workloads (easyWave, fio) have a fairly low success rate on newidle balance, but still benefit greatly from having it anyway. Luckliky these workloads have a faily low newidle rate, so the cost if doing the newidle is relatively low, even if unsuccessfull. Add a simple rate based part to the newidle ratio compute, such that low rate newidle will still have a high newidle ratio. This cures the easyWave and fio workloads while not affecting the schbench numbers either (which have a very high newidle rate). Reported-by: Mario Roy Reported-by: "Mohamed Abuelfotoh, Hazem" Signed-off-by: Peter Zijlstra (Intel) Tested-by: Mario Roy Tested-by: "Mohamed Abuelfotoh, Hazem" Link: https://patch.msgid.link/20260127151748.GA1079264@noisy.programming.kicks-ass.net commit 141af1be817c42c7f1e1605348d4b1983d319bea Author: Dmitry Baryshkov Date: Mon Jan 12 04:12:23 2026 +0200 clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source The clk_dp_ops are supposed to be used for DP-related clocks with a proper MND divier. Use standard RCG2 ops for dptx1_aux_clk_src, the same as all other DPTX AUX clocks in this driver. Fixes: 16fb89f92ec4 ("clk: qcom: Add support for Display Clock Controller on SM8450") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Reviewed-by: Taniya Das Link: https://lore.kernel.org/r/20260112-dp-aux-clks-v1-2-456b0c11b069@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e7c8eb1646db5d967d77ee67793dd95a2c5ff451 Author: Dmitry Baryshkov Date: Mon Jan 12 04:12:22 2026 +0200 clk: qcom: dispcc-glymur: use RCG2 ops for DPTX1 AUX clock source The clk_dp_ops are supposed to be used for DP-related clocks with a proper MND divier. Use shared RCG2 ops for dptx1_aux_clk_src, the same as all other DPTX AUX clocks in this driver. Fixes: b4d15211c408 ("clk: qcom: dispcc-glymur: Add support for Display Clock Controller") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Reviewed-by: Taniya Das Link: https://lore.kernel.org/r/20260112-dp-aux-clks-v1-1-456b0c11b069@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e2e0d2f3dab4e9838cfe3d94a5cb42aa7b51fddb Author: Taniya Das Date: Mon Feb 2 16:26:53 2026 +0530 clk: qcom: videocc-glymur: Add video clock controller driver for Glymur Add support for the video clock controller for video clients to be able to request for videocc clocks on Glymur platform. Signed-off-by: Taniya Das Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260202-glymur_videocc-v2-4-8f7d8b4d8edd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1c8ce43e1e07ecc531fb517f95620ed85e998608 Author: Taniya Das Date: Mon Feb 2 16:26:52 2026 +0530 clk: qcom: gcc-glymur: Add video axi clock resets for glymur The global clock controller video axi reset clocks are required by the video SW driver to assert and deassert the clock resets during their power down sequence. Hence add these clock resets. Fixes: efe504300a17 ("clk: qcom: gcc: Add support for Global Clock Controller") Signed-off-by: Taniya Das Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260202-glymur_videocc-v2-3-8f7d8b4d8edd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit ed9ca829614735ab0de0c97af9239bd20a618de1 Author: Taniya Das Date: Mon Feb 2 16:26:51 2026 +0530 dt-bindings: clock: qcom: Add video clock controller on Glymur SoC Add compatible string for Glymur video clock controller and the bindings for Glymur Qualcomm SoC. Signed-off-by: Taniya Das Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260202-glymur_videocc-v2-2-8f7d8b4d8edd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7c3260327fc874b7c89d7bb230cd569d2e78aff7 Author: Taniya Das Date: Mon Feb 2 16:26:50 2026 +0530 dt-bindings: clock: qcom: Add GCC video axi reset clock for Glymur The global clock controller video axi reset clocks are required by the video SW driver to assert and deassert the clock resets. Signed-off-by: Taniya Das Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260202-glymur_videocc-v2-1-8f7d8b4d8edd@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 67e645285dd06944d0ef7ceb07de5c4053829075 Author: Taniya Das Date: Tue Jan 27 12:45:50 2026 +0530 clk: qcom: Add support for GPUCC and GXCLK for Glymur Support the graphics clock controller for Glymur for Graphics SW driver to use the clocks. GXCLKCTL (Graphics GX Clock Controller) is a block dedicated to managing clocks for the GPU subsystem on GX power domain. The GX clock controller driver manages only the GX GDSC and the rest of the resources of the controller are managed by the firmware. Update the compatible for Graphics GX Clock Controller for Glymur as the GX clock controller is a reuse of the Kaanapali driver. Signed-off-by: Taniya Das Reviewed-by: Konrad Dybcio Reviewed-By: Jagadeesh Kona Link: https://lore.kernel.org/r/20260127-glymur_gpucc-v1-2-547334c81ba2@oss.qualcomm.com [bjorn: Fixed copyright and de-acronymized MODULE_DESCRIPTION] Signed-off-by: Bjorn Andersson commit 4aff230cf28b5f68a62fcd79de341c58245ea8e2 Author: Taniya Das Date: Tue Jan 27 12:45:49 2026 +0530 dt-bindings: clock: qcom: document the Glymur GPU Clock Controller Glymur SoC has Qualcomm GX(graphics) clock controller and also the Graphics clock controller. The GX graphics clock controller helps in the recovery of the Graphics subsystem. Add bindings documentation for the Glymur Graphics Clock and Graphics power domain Controller for Glymur SoC. Signed-off-by: Taniya Das Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260127-glymur_gpucc-v1-1-547334c81ba2@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9386d9e8cc72edc1a55ee1337c442b3ceff1d1ba Author: Anjelique Melendez Date: Mon Feb 9 12:49:13 2026 -0800 soc: qcom: pmic_glink: Add support for Glymur and Kaanapali On Glymur, a compute platform, and Kaanapali, a mobile platform, charger FW runs on SOCCP (another subsystem). SOCCP does not have any specific charger PDs defined. So, add support for Glymur and Kaanapali compatible strings. Signed-off-by: Anjelique Melendez Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260209204915.1983997-4-anjelique.melendez@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 540262793df13d90274aae90aa70584ef6fb3aa4 Author: Anjelique Melendez Date: Mon Feb 9 12:49:12 2026 -0800 soc: qcom: pmic_glink: Add charger PDR service information to client data Currently, the charger PD service path and service name are hard coded however these paths are not guaranteed to be the same between SOCs. Define charger PDR service path and service name as client data so that each PMIC generation can properly define these paths. Signed-off-by: Anjelique Melendez Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260209204915.1983997-3-anjelique.melendez@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit aed7440146548cbbcb36780ccc6f9db4cf18f832 Author: Anjelique Melendez Date: Mon Feb 9 12:49:11 2026 -0800 dt-bindings: soc: qcom: qcom,pmic-glink: Add Glymur and Kaanapali compatibles Glymur (a recent compute platform) and Kaanapali (a recent mobile platform) have the charger FW running on a new subsystem SOCCP (SOC Control Processor) instead of on ADSP like in previous platforms. Because of this, pmic_glink interface on Glymur and Kaanapali platforms are not compatible with previous platforms. Hence, add new compatible strings for Glymur and Kaanapali. Signed-off-by: Anjelique Melendez Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260209204915.1983997-2-anjelique.melendez@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 85072bcd4f3fe65fe5819de1a2a677f59d811dbe Author: Krzysztof Kozlowski Date: Tue Feb 17 14:00:49 2026 +0100 clk: qcom: De-acronymize Glymur SoC name Glymur is a codename of Qualcomm SoC, not an acronym. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260217130047.281813-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit eba8bcf96e763ba250a993b053d6ecaaaa1f4cf3 Author: Krzysztof Kozlowski Date: Tue Feb 17 14:00:48 2026 +0100 dt-bindings: clock: qcom,glymur-dispcc: De-acronymize SoC name Glymur is a codename of Qualcomm SoC, not an acronym. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Taniya Das Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260217130047.281813-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8dc51459ef702bcc0ef5fb26bb4d362b38aa56c2 Author: Christian Göttsche Date: Mon Feb 2 14:48:03 2026 +0100 selinux: annotate intentional data race in inode_doinit_with_dentry() Like other `isec->initialized == LABEL_INITIALIZED` checks annotate the check in inode_doinit_with_dentry() with data_race to please KCSAN. The value is rechecked next with lock held. Reported-by: syzbot+9ab96b38b76bec93939a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9ab96b38b76bec93939a Signed-off-by: Christian Göttsche Signed-off-by: Paul Moore commit 3cd82bca8448d12f6ea0ef2c9d55a80d1712385f Author: Pankaj Patil Date: Thu Feb 19 18:53:27 2026 +0530 arm64: defconfig: Enable configs for Qualcomm Glymur SoC Enable pinctrl, clocks and interconnect drivers as built-in in order for serial console to be available before kernel reaches "init" on Qualcomm Glymur CRD. Additionally, booting rootfs from NVMe requires TCSRCC to be enabled as module Enable dispcc as module which is a dependency for display enablement Reviewed-by: Krzysztof Kozlowski Reviewed-by: Abel Vesa Signed-off-by: Pankaj Patil Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260219-upstream_v3_glymur_introduction-v8-2-8ce4e489ebb6@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9314c6ecace1a49aa40f75f72278e14d2feb2cd2 Author: Pankaj Patil Date: Thu Feb 19 18:53:29 2026 +0530 arm64: dts: qcom: glymur: Enable Glymur CRD board support Add initial device tree support for the Glymur Compute Reference Device(CRD) board, with this board dts glymur crd can boot to shell with rootfs on nvme and uart21 as serial console Features enabled are: - Board and sleep clocks - Volume up/down keys - Regulators 0 - 4 - Power supplies and sideband signals (PERST, WAKE, CLKREQ) for PCIe3b/4/5/6 controllers and PHYs Co-developed-by: Kamal Wadhwa Signed-off-by: Kamal Wadhwa Co-developed-by: Qiang Yu Signed-off-by: Qiang Yu Co-developed-by: Sibi Sankar Signed-off-by: Sibi Sankar Co-developed-by: Jyothi Kumar Seerapu Signed-off-by: Jyothi Kumar Seerapu Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Pankaj Patil Link: https://lore.kernel.org/r/20260219-upstream_v3_glymur_introduction-v8-4-8ce4e489ebb6@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 41b6e8db400ccba9fc373ac3f0c9ebfd3a22c810 Author: Pankaj Patil Date: Thu Feb 19 18:53:28 2026 +0530 arm64: dts: qcom: Introduce Glymur base dtsi Introduce the base device tree support for Glymur – Qualcomm's next-generation compute SoC. The new glymur.dtsi describes the core SoC components, including: - CPUs and CPU topology - Interrupt controller and TLMM - GCC,DISPCC and RPMHCC clock controllers - Reserved memory and interconnects - APPS and PCIe SMMU and firmware SCM - Watchdog, RPMHPD, APPS RSC and SRAM - PSCI and PMU nodes - QUPv3 serial engines - CPU power domains and idle states, plus SCMI/ SRAM pieces for CPU DVFS - PDP0 mailbox, IPCC and AOSS - Display clock controller - SPMI PMIC arbiter with SPMI0/1/2 buses - SMP2P nodes - TSENS and thermal zones (8 instances, 92 sensors) Add dtsi files for PMH0101, PMK8850, PMCX0102, SMB2370, PMH0104, PMH0110, PMIC's along with temp-alarm and GPIO nodes needed on Glymur Enabled PCIe controllers and associated PHY to support boot to shell with nvme storage, List of PCIe instances enabled: - PCIe3b - PCIe4 - PCIe5 - PCIe6 Co-developed-by: Raviteja Laggyshetty Signed-off-by: Raviteja Laggyshetty Co-developed-by: Jyothi Kumar Seerapu Signed-off-by: Jyothi Kumar Seerapu Co-developed-by: Maulik Shah Signed-off-by: Maulik Shah Co-developed-by: Sibi Sankar Signed-off-by: Sibi Sankar Co-developed-by: Taniya Das Signed-off-by: Taniya Das Co-developed-by: Kamal Wadhwa Signed-off-by: Kamal Wadhwa Co-developed-by: Qiang Yu Signed-off-by: Qiang Yu Co-developed-by: Abel Vesa Signed-off-by: Abel Vesa Co-developed-by: Manaf Meethalavalappu Pallikunhi Signed-off-by: Manaf Meethalavalappu Pallikunhi Co-developed-by: Jishnu Prakash Signed-off-by: Jishnu Prakash Reviewed-by: Konrad Dybcio Signed-off-by: Pankaj Patil Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260219-upstream_v3_glymur_introduction-v8-3-8ce4e489ebb6@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4ed5f35359db5fac587d4fb9f7f61c1c6f0729d7 Author: Pankaj Patil Date: Thu Feb 19 18:53:26 2026 +0530 dt-bindings: arm: qcom: Document Glymur SoC and board Document Glymur SoC bindings and Compute Reference Device (CRD) board id Signed-off-by: Pankaj Patil Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260219-upstream_v3_glymur_introduction-v8-1-8ce4e489ebb6@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3ecf0b4a0e0ed4783aa32c5f3e42d23c7021e1c8 Merge: 9cd168a2720bc6 6de23f81a5e08b Author: Alexei Starovoitov Date: Mon Feb 23 08:06:33 2026 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf after 7.0-rc1 Cross-merge trees after 7.0-rc1. No conflicts. Signed-off-by: Alexei Starovoitov commit 63931aa0d96203a7e656485dd31bd5528d3202ad Author: Taniya Das Date: Fri Feb 20 11:55:08 2026 +0530 arm64: defconfig: Enable SM8750 clock controllers Enable the SM8750 video, camera and gpu clock controller for their respective functionalities on the Qualcomm SM8750 MTP boards. Signed-off-by: Taniya Das Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260220-sm8750_defconfig_cc-v1-1-666aa922b392@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 1a8a5227f22996d3e503c60569b1813a404da033 Author: Leon Romanovsky Date: Sat Jan 31 07:34:14 2026 +0200 vfio: Wait for dma-buf invalidation to complete dma-buf invalidation is handled asynchronously by the hardware, so VFIO must wait until all affected objects have been fully invalidated. In addition, the dma-buf exporter is expecting that all importers unmap any buffers they previously mapped. Fixes: 5d74781ebc86 ("vfio/pci: Add dma-buf export support for MMIO regions") Reviewed-by: Kevin Tian Reviewed-by: Alex Williamson Signed-off-by: Leon Romanovsky Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260131-dmabuf-revoke-v7-4-463d956bd527@nvidia.com commit f1e7b8929eefc325ae250f7fec30c6f9d9eefcc1 Author: Tomasz Unger Date: Mon Feb 23 12:59:43 2026 +0100 staging: rtl8723bs: fix spelling mistakes in include files Fix spelling mistakes in comments found by codespell: - sequcne => sequence (rtw_cmd.h) - modifiying => modifying (rtw_mlme.h) Signed-off-by: Tomasz Unger Link: https://patch.msgid.link/20260223115943.69463-1-tomasz.unger@yahoo.pl Signed-off-by: Greg Kroah-Hartman commit d81d7e8c0f3545faff62f711475f82074687320d Author: Tomasz Unger Date: Mon Feb 23 12:40:53 2026 +0100 staging: rtl8723bs: fix spelling mistakes in sdio_halinit.c Fix spelling mistakes in comments found by codespell: - gurantee => guarantee - ser => set (two occurrences) Signed-off-by: Tomasz Unger Link: https://patch.msgid.link/20260223114053.67890-1-tomasz.unger@yahoo.pl Signed-off-by: Greg Kroah-Hartman commit 282a976a0fc0532d78888200b2b6efbb1c59f74a Author: Yan Pan Date: Sun Feb 22 15:26:32 2026 +0800 staging: rtl8723bs: remove unnecessary parentheses Remove unnecessary parentheses around variables and struct members in rtw_sta_mgt.c to comply with the Linux kernel coding style. This issue was reported by checkpatch.pl. Signed-off-by: Yan Pan Link: https://patch.msgid.link/20260222072632.2931217-1-maxwell2119@163.com Signed-off-by: Greg Kroah-Hartman commit 0c9d1b56f9af0762a5be5118e1bb962f23784dc4 Author: Nikolay Kulikov Date: Sat Feb 21 20:24:00 2026 +0300 staging: rtl8723bs: fix spaces around binary operators Add missing spaces and fix line length to comply with kernel coding style. Signed-off-by: Nikolay Kulikov Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260221172751.52329-1-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6bd2cd06446f9073919a33d6d5ac6a70b0109aff Author: Filippo Muscherà Date: Sun Feb 8 18:02:47 2026 +0100 staging: rtl8723bs: fix inconsistent indenting detected by smatch Fix the following inconsistent indentation warnings reported by Smatch: drivers/staging/rtl8723bs/hal/HalBtc8723b1Ant.c:2319 EXhalbtc8723b1ant_ConnectNotify(): inconsistent indenting drivers/staging/rtl8723bs/hal/HalPhyRf_8723B.c:1410 phy_IQCalibrate_8723B(): inconsistent indenting The affected code used a mix of tabs and spaces or excessive indentation, making it misleading to read. Align the lines with the surrounding code using tabs. While at it, wrap long lines in HalPhyRf_8723B.c to silence checkpatch warnings. Signed-off-by: Filippo Muscherà Reviewed-by: Bera Yüzlü Link: https://patch.msgid.link/20260208170247.7013-1-filippo.muschera@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8af39f074c46884d7f7aa7a42595c354f3e48a91 Author: Giorgi Tchankvetadze Date: Sat Feb 21 17:39:34 2026 +0400 staging: rtl8723bs: Use kmemdup in sdio_ops.c Replace kmalloc() + memcpy() with kmemdup() to simplify the code. No functional change. Signed-off-by: Giorgi Tchankvetadze Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260221133933.336909-2-giorgitchankvetadze1997@gmail.com Signed-off-by: Greg Kroah-Hartman commit 29c7e7b6a3ed588ef0fabd168c26c7914b421a14 Author: Giorgi Tchankvetadze Date: Wed Feb 18 15:33:52 2026 +0400 staging: rtl8723bs: remove unused macros from rtl8192c_recv.h RECV_BLK_SZ, RECV_BLK_CNT, and RECV_BLK_TH are defined but never referenced anywhere in the tree. Remove them. Signed-off-by: Giorgi Tchankvetadze Link: https://patch.msgid.link/20260218113351.405150-2-giorgitchankvetadze1997@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0cffdcc356b2f892323b28f56e9d09a9e78756ba Author: Bryant Boatright Date: Tue Feb 17 14:54:28 2026 +0000 staging: rtl8723bs: Rename camel case variable Adhere to Linux kernel coding style. Reported by checkpatch: CHECK: Avoid CamelCase: Signed-off-by: Bryant Boatright Link: https://patch.msgid.link/20260217145352.2172407-3-bryant.boatright@proton.me Signed-off-by: Greg Kroah-Hartman commit b38a0d2f24d72aec1a5dfe51e1c05c83b8068fa2 Author: Bryant Boatright Date: Tue Feb 17 14:54:19 2026 +0000 staging: rtl8723bs: Rename camel case enumeration Rename camel case enumeration to snake case and expand enumeration name for clarity. Update indentation of function prototype/definition based on new name length. Move enumeration definition from single line to multi-line definition. Reported by checkpatch: CHECK: Avoid CamelCase: CHECK: Avoid CamelCase: CHECK: Avoid CamelCase: CHECK: Avoid CamelCase: Signed-off-by: Bryant Boatright Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260217145352.2172407-2-bryant.boatright@proton.me Signed-off-by: Greg Kroah-Hartman commit 260ef0a2ed41c8625d3d715ca660a3cbfc02444b Author: Nikolay Kulikov Date: Mon Feb 16 10:28:06 2026 +0300 staging: rtl8723bs: rename camelCase variable Rename "pHT_caps_ie" to "ht_caps_ie" local variable to comply with Linux kernel coding style. This fixes the following checkpatch.pl warnings: CHECK: Avoid CamelCase: Signed-off-by: Nikolay Kulikov Link: https://patch.msgid.link/20260216072830.4260-1-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit 232046c209666acc56a872d47804c14f308356f9 Author: Nikolay Kulikov Date: Sat Feb 14 22:09:11 2026 +0300 staging: rtl8723bs: remove unnecessary boolean comparison Remove explicit comparison to true in boolean expression to follow Linux kernel coding style. Signed-off-by: Nikolay Kulikov Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260214190958.68282-1-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman commit 791af501f51c7d7e1a364fb52f38647aac400e9a Author: Khushal Chitturi Date: Thu Feb 12 19:51:31 2026 +0530 staging: rtl8723bs: align and split variable declarations Split multi variable declarations into single lines and move trailing comments to the line above to fix line length and alignment warnings. Signed-off-by: Khushal Chitturi Link: https://patch.msgid.link/20260212142131.28131-8-khushalchitturi@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2ad4e71ec9058db9c123ee399d1e94e07fb3460b Author: Khushal Chitturi Date: Thu Feb 12 19:51:30 2026 +0530 staging: rtl8723bs: simplify boolean expressions Remove redundant comparisons with true/false and simplify boolean conditions. Signed-off-by: Khushal Chitturi Link: https://patch.msgid.link/20260212142131.28131-7-khushalchitturi@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2b8144be611f6ebf69df5415c03370219e70fdc7 Author: Khushal Chitturi Date: Thu Feb 12 19:51:29 2026 +0530 staging: rtl8723bs: use bool for traffic_status_watchdog() This patch changes the return type of traffic_status_watchdog(), its parameter, and its local variables from u8 to bool as they represent boolean state. Signed-off-by: Khushal Chitturi Link: https://patch.msgid.link/20260212142131.28131-6-khushalchitturi@gmail.com Signed-off-by: Greg Kroah-Hartman commit d357fe8446798bf76c2dd0f876cf0bb09bccfca9 Author: Khushal Chitturi Date: Thu Feb 12 19:51:28 2026 +0530 staging: rtl8723bs: remove stale commented code Drop unused commented code left from older versions Signed-off-by: Khushal Chitturi Link: https://patch.msgid.link/20260212142131.28131-5-khushalchitturi@gmail.com Signed-off-by: Greg Kroah-Hartman commit ed8382fb4fadc86c24dc0fc54c53ae99dad08b9d Author: Khushal Chitturi Date: Thu Feb 12 19:51:27 2026 +0530 staging: rtl8723bs: convert traffic_status_watchdog() local variables to snake_case Convert the local variable names in traffic_status_watchdog() to snake_case to follow naming conventions. Signed-off-by: Khushal Chitturi Link: https://patch.msgid.link/20260212142131.28131-4-khushalchitturi@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1d4d268ff2f22d6f68131a01ecf0d14e63a788e4 Author: Khushal Chitturi Date: Thu Feb 12 19:51:26 2026 +0530 staging: rtl8723bs: rename rt_link_detect_t fields to snake_case Convert the CamelCase field names in struct rt_link_detect_t to snake_case to follow naming conventions. Signed-off-by: Khushal Chitturi Link: https://patch.msgid.link/20260212142131.28131-3-khushalchitturi@gmail.com Signed-off-by: Greg Kroah-Hartman commit c17a99a866325d8174bedff2d38ecaa183d6e819 Author: Khushal Chitturi Date: Thu Feb 12 19:51:25 2026 +0530 staging: rtl8723bs: rename LinkDetectInfo to link_detect_info Rename LinkDetectInfo to link_detect_info in struct mlme_priv to follow naming conventions. Signed-off-by: Khushal Chitturi Link: https://patch.msgid.link/20260212142131.28131-2-khushalchitturi@gmail.com Signed-off-by: Greg Kroah-Hartman commit 134fdc1c972840ac57e77e6f5b2b62f3c433afae Author: Haroen Tmimi Date: Tue Feb 10 19:56:30 2026 +0100 staging: rtl8723bs: remove shadowed variable in sdio_halinit The variable 'bMacPwrCtrlOn' was redeclared in the function CardEnable, shadowing a variable of the same name declared at the top of the function (line 21). Remove the redundant 'u8' type declaration to use the existing outer variable and resolve a -Wshadow warning. Signed-off-by: Haroen Tmimi Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260210185630.54577-1-tmimiharoen@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8fd94d0e44f06c40e2cff6296807713a87a1590e Author: Haroen Tmimi Date: Tue Feb 10 17:16:28 2026 +0100 staging: rtl8723bs: remove explicit comparisons to false in rtw_ap.c Fix checkpatch.pl checks regarding error prone boolean comparisons. Replace explicit comparisons to false with the logical NOT operator to improve readability and match kernel coding style. These instances were remaining after recent cleanups in this file. Signed-off-by: Haroen Tmimi Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260210161628.42130-1-tmimiharoen@gmail.com Signed-off-by: Greg Kroah-Hartman commit a408c0ca0c411ca1ead995bdae3112a806c87556 Author: Christian König Date: Thu Oct 9 16:32:33 2025 +0200 dma-buf: use inline lock for the dma-fence-chain Using the inline lock is now the recommended way for dma_fence implementations. So use this approach for the framework's internal fences as well. Also saves about 4 bytes for the external spinlock. Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Reviewed-by: Philipp Stanner Reviewed-by: Boris Brezillon Link: https://lore.kernel.org/r/20260219160822.1529-9-christian.koenig@amd.com commit 5943243914b9fed8e26edcb9d45421721a5e3576 Author: Christian König Date: Thu Oct 9 16:18:53 2025 +0200 dma-buf: use inline lock for the dma-fence-array Using the inline lock is now the recommended way for dma_fence implementations. So use this approach for the framework's internal fences as well. Also saves about 4 bytes for the external spinlock. Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Reviewed-by: Philipp Stanner Reviewed-by: Boris Brezillon Link: https://lore.kernel.org/r/20260219160822.1529-8-christian.koenig@amd.com commit ed0d6a0003fdcf8c93ff1544cf104a5456bf520e Author: Christian König Date: Thu Oct 9 16:07:49 2025 +0200 dma-buf: use inline lock for the stub fence v2 Using the inline lock is now the recommended way for dma_fence implementations. So use this approach for the framework's internal fences as well. Also saves about 4 bytes for the external spinlock. v2: drop unnecessary changes Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Reviewed-by: Philipp Stanner Reviewed-by: Boris Brezillon Link: https://lore.kernel.org/r/20260219160822.1529-7-christian.koenig@amd.com commit 3695d754ffbb176afe3cb47b705b72bf85ed63f0 Author: Christian König Date: Thu Dec 11 11:37:47 2025 +0100 dma-buf/selftests: test RCU ops and inline lock v2 Drop the mock_fence and the kmem_cache, instead use the inline lock and test if the ops are properly dropped after signaling. v2: move the RCU check to the end of the test Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260219160822.1529-6-christian.koenig@amd.com commit 1f32f310a13c9fb67a9993ab67f596b3f960206f Author: Christian König Date: Thu Oct 9 10:40:06 2025 +0200 dma-buf: inline spinlock for fence protection v5 Implement per-fence spinlocks, allowing implementations to not give an external spinlock to protect the fence internal state. Instead a spinlock embedded into the fence structure itself is used in this case. Shared spinlocks have the problem that implementations need to guarantee that the lock lives at least as long all fences referencing them. Using a per-fence spinlock allows completely decoupling spinlock producer and consumer life times, simplifying the handling in most use cases. v2: improve naming, coverage and function documentation v3: fix one additional locking in the selftests v4: separate out some changes to make the patch smaller, fix one amdgpu crash found by CI systems v5: improve comments Signed-off-by: Christian König Reviewed-by: Boris Brezillon Link: https://lore.kernel.org/r/20260219160822.1529-5-christian.koenig@amd.com commit 3e5067931b5df667f5350fafe4410554e228e53e Author: Christian König Date: Thu Oct 9 10:40:06 2025 +0200 dma-buf: abstract fence locking v2 Add dma_fence_lock_irqsafe() and dma_fence_unlock_irqrestore() wrappers and mechanically apply them everywhere. Just a pre-requisite cleanup for a follow up patch. v2: add some missing i915 bits, add abstraction for lockdep assertion as well v3: one more suggestion by Tvrtko Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260219160822.1529-4-christian.koenig@amd.com commit 541c8f2468b933acc5d129e84bd264923675a66e Author: Christian König Date: Wed Oct 8 18:12:46 2025 +0200 dma-buf: detach fence ops on signal v3 When neither a release nor a wait backend ops is specified it is possible to let the dma_fence live on independently of the module who issued it. This makes it possible to unload drivers and only wait for all their fences to signal. v2: fix typo in comment v3: fix sparse rcu warnings Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Reviewed-by: Philipp Stanner Reviewed-by: Boris Brezillon Link: https://lore.kernel.org/r/20260219160822.1529-3-christian.koenig@amd.com commit f4cc3ab824d6772a48ca9d9c74ac623b3309985d Author: Christian König Date: Tue Oct 7 14:06:05 2025 +0200 dma-buf: protected fence ops by RCU v8 The fence ops of a dma_fence currently need to life as long as the dma_fence is alive. This means that the module which originally issued a dma_fence can't unload unless all fences are freed up. As first step to solve this issue protect the fence ops by RCU. While it is counter intuitive to protect a constant function pointer table by RCU it allows modules to wait for an RCU grace period before they unload, to make sure that nobody is executing their functions any more. This patch has not much functional change, but only adds the RCU handling for the static checker to test. v2: make one the now duplicated lockdep warnings a comment instead. v3: Add more documentation to ->wait and ->release callback. v4: fix typo in documentation v5: rebased on drm-tip v6: improve code comments v7: improve commit message and code comments v8: fix sparse rcu warnings Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Reviewed-by: Boris Brezillon Link: https://lore.kernel.org/r/20260219160822.1529-2-christian.koenig@amd.com commit a4b887ae7dc541ef9fc51bcbd6baccf71f601c83 Author: Ethan Tidmore Date: Mon Feb 9 17:09:36 2026 -0600 staging: rtl8723bs: Remove unused members in struct rtw_wdev_priv Remove members p2p_enabled, provdisc_req_issued, bandroid_scan in rtw_wdev_priv as they are never used anywhere in the driver. Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260209230936.37385-3-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4b8e8805fd3d643e7d7d4c08cefa1aefb08db7a2 Author: Ethan Tidmore Date: Mon Feb 9 17:09:35 2026 -0600 staging: rtl8723bs: Remove unused structs and helper functions Remove structs rtw_wdev_invit_info and rtw_wdev_nego_info along with their initializer macros as they are never used anywhere in the driver. Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260209230936.37385-2-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit e0a17573dc57aa617751cf160ea0ef7f2ad6521f Author: Siwanan Bungtong Date: Mon Feb 9 10:22:30 2026 +0700 staging: rtl8723bs: wrap long comments to 100 columns Wrap long comments to comply with kernel coding style and avoid checkpatch warnings. Signed-off-by: Siwanan Bungtong Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260209032230.190259-1-horstaufmental@gmail.com Signed-off-by: Greg Kroah-Hartman commit 874b07eb0875729b9a47441e03b125d9fa735645 Author: Shawn Lin Date: Wed Feb 11 16:24:59 2026 +0800 PCI/MSI: Add TODO comment about legacy pcim_enable_device() side-effect Add a TODO comment in pci/msi/msi.c to document that the automatic IRQ vector management activated by pcim_enable_device() is a dangerous and confusing. Suggested-by: Philipp Stanner Signed-off-by: Shawn Lin Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/1770798299-202288-4-git-send-email-shawn.lin@rock-chips.com commit 03e4905402ae60aa1d7a65770076bb2c1df8f6ac Author: Shawn Lin Date: Wed Feb 11 16:24:57 2026 +0800 PCI/MSI: Clarify pci_free_irq_vectors() usage for managed devices Update pci_free_irq_vectors() documentation to clarify that drivers using pcim_enable_device() must not call pci_free_irq_vectors(). For legacy reasons, pcim_enable_device() switches several normally un-managed functions into managed mode. Currently, the only function affected in this way is pcim_setup_msi_release(), which results in automatic IRQ vector management. This behavior is dangerous and confusing. Drivers using pcim_enable_device() should rely on the automatic IRQ vector management and avoid calling pci_free_irq_vectors() manually. Suggested-by: Philipp Stanner Signed-off-by: Shawn Lin [bhelgaas: squash both updates to pci_free_irq_vectors() documentation] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/1770798299-202288-2-git-send-email-shawn.lin@rock-chips.com Link: https://patch.msgid.link/1770798299-202288-3-git-send-email-shawn.lin@rock-chips.com commit d3e996a596967a62c8a13a279221513461f6ab97 Author: George Abraham P Date: Fri Jan 9 10:59:23 2026 +0530 PCI/TPH: Allow TPH enable for RCiEPs Previously, pcie_enable_tph() only enabled TLP Processing Hints (TPH) if both the Endpoint and its Root Port advertised TPH support. Root Complex Integrated Endpoints (RCiEPs) are directly integrated into a Root Complex and do not have an associated Root Port, so pcie_enable_tph() never enabled TPH for RCiEPs. PCIe r7.0 doesn't seem to include a way to learn whether a Root Complex supports TPH, but sec 2.2.7.1.1 says Functions that lack TPH support should ignore TPH, and maybe the same is true for Root Complexes: A Function that does not support the TPH Completer or Routing capability and receives a transaction with the TH bit [which indicates the presence of TPH in the TLP header] Set is required to ignore the TH bit and handle the Request in the same way as Requests of the same transaction type without the TH bit Set. Allow drivers to enable TPH for any RCiEP with a TPH Requester Capability. Fixes: f69767a1ada3 ("PCI: Add TLP Processing Hints (TPH) support") Signed-off-by: George Abraham P [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260109052923.1170070-1-george.abraham.p@intel.com commit cc33985d26c92a5c908c0185239c59ec35b8637c Author: Lukas Wunner Date: Mon Feb 16 08:46:13 2026 +0100 PCI/ASPM: Fix pci_clear_and_set_config_dword() usage When aspm_calc_l12_info() programs the L1 PM Substates Control 1 register fields Common_Mode_Restore_Time, LTR_L1.2_THRESHOLD_Value and _Scale, it invokes pci_clear_and_set_config_dword() in an incorrect way: For the bits to clear it selects those corresponding to the field. So far so good. But for the bits to set it passes a full register value. pci_clear_and_set_config_dword() performs a boolean OR operation which sets all bits of that value, not just the ones that were just cleared. Thus, when setting the LTR_L1.2_THRESHOLD_Value and _Scale on the child of an ASPM link, aspm_calc_l12_info() also sets the Common_Mode_Restore_Time. That's a spec violation: PCIe r7.0 sec 7.8.3.3 says this field is RsvdP for Upstream Ports. On Adrià's Pixelbook Eve, Common_Mode_Restore_Time of the Intel 7265 "Stone Peak" wifi card is zero, yet aspm_calc_l12_info() does not preserve the zero bits but instead programs the value calculated for the Root Port into the wifi card. Likewise, when setting the Common_Mode_Restore_Time on the Root Port, aspm_calc_l12_info() also changes the LTR_L1.2_THRESHOLD_Value and _Scale from the initial 163840 nsec to 237568 nsec (due to ORing those fields), only to reduce it afterwards to 106496 nsec. Amend all invocations of pci_clear_and_set_config_dword() to only set bits which are cleared. Finally, when setting the T_POWER_ON_Value and _Scale on the Root Port and the wifi card, aspm_calc_l12_info() fails to preserve bits declared RsvdP and instead overwrites them with zeroes. Replace pci_write_config_dword() with pci_clear_and_set_config_dword() to avoid this. Fixes: aeda9adebab8 ("PCI/ASPM: Configure L1 substate settings") Link: https://bugzilla.kernel.org/show_bug.cgi?id=220705#c22 Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Tested-by: Adrià Vilanova Martínez Cc: stable@vger.kernel.org # v4.11+ Link: https://patch.msgid.link/5c1752d7512eed0f4ea57b84b12d7ee08ca61fc5.1771226659.git.lukas@wunner.de commit a8aeea1bf3c80cc87983689e0118770e019bd4f3 Author: Shuai Xue Date: Wed Feb 11 20:46:24 2026 +0800 PCI/AER: Clear only error bits in PCIe Device Status Currently, pcie_clear_device_status() clears the entire PCIe Device Status register (PCI_EXP_DEVSTA) by writing back the value read from the register, which affects not only the error status bits but also other writable bits. According to PCIe r7.0, sec 7.5.3.5, this register contains: - RW1C error status bits (CED, NFED, FED, URD at bits 0-3): These are the four error status bits that need to be cleared. - Read-only bits (AUXPD at bit 4, TRPND at bit 5): Writing to these has no effect. - Emergency Power Reduction Detected (bit 6): A RW1C non-error bit introduced in PCIe r5.0 (2019). This is currently the only writable non-error bit in the Device Status register. Unconditionally clearing this bit can interfere with other software components that rely on this power management indication. - Reserved bits (RsvdZ): These bits are required to be written as zero. Writing 1s to them (as the current implementation may do) violates the specification. To prevent unintended side effects, modify pcie_clear_device_status() to only write 1s to the four error status bits (CED, NFED, FED, URD), leaving the Emergency Power Reduction Detected bit and reserved bits unaffected. Fixes: ec752f5d54d7 ("PCI/AER: Clear device status bits during ERR_FATAL and ERR_NONFATAL") Suggested-by: Lukas Wunner Signed-off-by: Shuai Xue Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Lukas Wunner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260211124624.49656-1-xueshuai@linux.alibaba.com commit 5ebc20921b7fff9feb44de465448e17a382c9965 Author: Marek Vasut Date: Fri Feb 20 21:22:19 2026 +0100 ASoC: tas2552: Allow audio enable GPIO to sleep The audio enable GPIO is not toggled in any critical section where it could not sleep, allow the audio enable GPIO to sleep. This allows the driver to operate the audio enable GPIO connected to I2C GPIO expander. Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260220202332.241035-1-marex@nabladev.com Signed-off-by: Mark Brown commit f308205e3b370d0bb4be696ae678b0f0ce65d2c7 Merge: 0556bb42a84ee3 fbb4c52ccdcb4a Author: Mark Brown Date: Mon Feb 23 14:49:44 2026 +0000 regulator: spacemit-p1: Support board power tree Merge series from Guodong Xu : Patch 1, 2 and 3 (previously 2-4) enable flexible power tree configurations for the SpacemiT P1 PMIC. Hardcoded supply assumptions are replaced with explicit devicetree properties. PMIC supply connections are board-design decisions. Moving this to DT allows supporting varied topologies without driver modifications. The supply binding change is an ABI change. The breakage is acceptable: Yixun Lan checked the DTS tree queued for v6.20 and found no consumers of the P1/PMIC regulator yet [1]. For the two K1 boards in-tree (BPI-F3 and Jupiter), initial power settings come from boot firmware and a probe failure of pmic node "spacemit,p1" has minimal impact. In v4, the old "vin-supply" property is dropped from the binding document as the updated driver no longer parses it and there is no fallback logic. Only the per-rail names ("vin1-supply", "vin2-supply", ...) are supported going forward. Intermittent dtbs_check warnings are expected while the binding and DTS changes land through different trees, but will resolve once both are merged. Link: https://lore.kernel.org/lkml/20260125110333-GYD71302@gentoo.org/ [1] commit 910a78d816e4b0277f4917d607a1213e0dd6cdd6 Merge: 85b47b36303e9f bf122191473e26 Author: Mark Brown Date: Mon Feb 23 14:49:36 2026 +0000 ASoC rt5677: Prepare to support Lenovo Yoga Book tablets Merge series from Yauhen Kharuzhy : There are two Intel Cherry Trail-based devices using the RT5677 as a sound codec: Lenovo Yoga Book YB1-X90 (Android tablet) and YB1-X91 (Windows tablet). They both have the same hardware configuration, but the X90 doesn't have correct ACPI table definitions for many peripherals, whereas the X91 does. Devices missing in the ACPI are defined in the board-specific driver platform/x86/x86-android-tablets. In the X91 tablet, an ACPI _CRS method for the RT5677 contains GPIO configuration entries which were not supported by the codec driver before. To support such device definitions, some modifications are added to the RT5677 code: ACPI, SPI, and I2C matching ids have been introduced, as well as some GPIO-related magic. commit 85b47b36303e9fc5fe8077ac495a2c79643bdec3 Merge: d075cef4af6327 171b3663f33e1e Author: Mark Brown Date: Mon Feb 23 14:49:32 2026 +0000 Bitmask logic fix and firmware-name support for Merge series from Luca Weiss : First a patch which fixes a logic error in the aw88261 driver. And then we add "firmware-name" support for that driver to support loading the device-specific firmware properly. commit a8422facc2c8167d7bd72da99c8dc1ee3bfc181f Author: Gustavo Piaz da Silva Date: Mon Feb 23 08:42:07 2026 -0300 staging: axis-fifo: refactor device tree parsing Refactor the device tree parsing logic in axis_fifo_probe() to reduce verbosity and simplify error handling. Remove the verbose error logging and goto logic. Instead, check of_property_read_u32() return values directly and propagate error codes immediately. This aligns the driver with modern kernel standards by removing unnecessary error messages during probe. Signed-off-by: Gustavo Piaz da Silva Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260223114207.3639-3-gustavopiazdasilva2102@gmail.com Signed-off-by: Greg Kroah-Hartman commit c2be939e93369568066554c37b222c4c309710c9 Author: Gustavo Piaz da Silva Date: Mon Feb 23 08:42:06 2026 -0300 staging: axis-fifo: use u32 for fifo depth flags Update has_rx_fifo and has_tx_fifo types from int to u32 in struct axis_fifo. The of_property_read_u32() function expects a pointer to u32. Although the current code works correctly with int, using u32 aligns the data structure with the Device Tree API and prevents potential type-mismatch issues. Signed-off-by: Gustavo Piaz da Silva Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260223114207.3639-2-gustavopiazdasilva2102@gmail.com Signed-off-by: Greg Kroah-Hartman commit 36e20eb1cac2bac6e5399c60cd864a52957c5762 Author: Giorgi Tchankvetadze Date: Sat Feb 21 16:47:33 2026 +0400 staging: rtl8723bs: remove redundant NULL check on premainder_ie premainder_ie is computed as pwps_ie + wps_ielen, where pwps_ie is already validated non-NULL earlier in the function. Pointer arithmetic on a non-NULL pointer can never yield NULL, making this check always true and misleading. Replace with a simple check on remainder_ielen. Signed-off-by: Giorgi Tchankvetadze Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260221124732.327156-2-giorgitchankvetadze1997@gmail.com Signed-off-by: Greg Kroah-Hartman commit b8232ea5d1612cde68563075bfaf2ead304b9cd5 Author: Artem Lytkin Date: Mon Feb 16 20:20:11 2026 +0000 staging: nvec: propagate error codes in tegra_nvec_probe() Several error paths in tegra_nvec_probe() return -ENODEV instead of propagating the actual error code from the called function. This prevents probe deferral from working correctly when a dependency (clock, IRQ) is not yet available. Fix this for platform_get_irq(), devm_clk_get(), and devm_request_irq() by propagating their return values. Use dev_err_probe() for the latter two to suppress log messages during deferred probing. The remaining -ENODEV returns for missing device tree node and slave-addr property are left unchanged as those are permanent configuration errors unrelated to probe deferral. Signed-off-by: Artem Lytkin Link: https://patch.msgid.link/20260216202011.1806-1-iprintercanon@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6edec96a66cac874e39e19c7f69ea042f90d7155 Author: Tomasz Unger Date: Thu Feb 19 15:29:42 2026 +0100 staging: fbtft: fb_tinylcd: replace udelay() with fsleep() fsleep() is the preferred modern API for flexible sleeping as it automatically selects the best sleep mechanism based on the duration. Replace udelay() with fsleep() to improve power efficiency. init_display() is a driver initialization callback which runs in sleeping context, so fsleep() is safe to use here. Signed-off-by: Tomasz Unger Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20260219142942.74087-1-tomasz.unger@yahoo.pl Signed-off-by: Greg Kroah-Hartman commit b8077a5becb0a927337a07e6cde1da09a10cb5da Author: Azamat Rakhim Date: Sun Feb 15 20:56:59 2026 +0500 staging: rtl8723bs: remove unused MAX_PATH_NUM defines for other chips Remove MAX_PATH_NUM defines for chips not supported by this driver (92CS, 8188E, 8192E, 8812A, 8821A, 8814A, 8822B). Only MAX_PATH_NUM_8723B is used. Signed-off-by: Azamat Rakhim Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260215155659.67324-1-azamatrakhim8@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2cb8949354212e3fe97160932fe833fc58a027da Author: Nam Cao Date: Fri Feb 13 09:59:27 2026 +0100 staging: fbtft: Remove duplications of fbtft_set_addr_win() Lots of drivers duplicate the default fbtft_set_addr_win(). Just use the default instead. Signed-off-by: Nam Cao Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260213085927.3673653-1-namcao@linutronix.de Signed-off-by: Greg Kroah-Hartman commit 41db5b76eeb4cc11a1097384caba7cfc659f7293 Author: Yuvraj Singh Chauhan Date: Thu Feb 12 22:49:03 2026 +0530 staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown In cvm_oct_rx_initialize(), request_irq() is called with &oct_rx_group[i].napi as the dev_id: request_irq(oct_rx_group[i].irq, cvm_oct_do_interrupt, 0, "Ethernet", &oct_rx_group[i].napi); However, cvm_oct_rx_shutdown() passes cvm_oct_device (an array of struct net_device pointers) as the dev_id to free_irq(): free_irq(oct_rx_group[i].irq, cvm_oct_device); Since __free_irq() matches the action to remove by comparing dev_id pointers, the mismatched cookie means the IRQ handler is never found, triggering a WARN and leaving the IRQ line permanently allocated. This prevents proper driver cleanup on module removal. Fix the mismatch by passing &oct_rx_group[i].napi as the dev_id to free_irq(), matching what was used during request_irq(). Signed-off-by: Yuvraj Singh Chauhan Link: https://patch.msgid.link/20260212171903.1417804-1-ysinghcin@gmail.com Signed-off-by: Greg Kroah-Hartman commit 532fc90fa51ab2044917f788ccb8f8c2dce9a283 Author: Haroen Tmimi Date: Tue Feb 10 19:50:44 2026 +0100 staging: rtl8723bs: remove redundant 'Adapter' variable in HalPhyRf_8723B The variable Adapter was declared and initialized locally in an if-statement, but it shadowed a variable of the same name and value declared in the function scope (line 169). Removing the inner declaration allows the code to use the existing outer variable, resolving a -Wshadow warning. Signed-off-by: Haroen Tmimi Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260210185044.53754-1-tmimiharoen@gmail.com Signed-off-by: Greg Kroah-Hartman commit c6b7a9a248e9257ada0a7bf3bd3ed1be7efb51b7 Author: Yoelvis Oliveros Date: Tue Feb 10 14:48:25 2026 +0000 staging: octeon: type change from uint_t to u Runing the ckeckpatch.pl on the staging/octeon driver they where using uint<8/16/32/64>_T as type declaration and the checkpatch.pl was putting a [CHECK] flag on those and that they should be change to u<8/16/32/64> Signed-off-by: Yoelvis Oliveros Link: https://patch.msgid.link/aYtDmUdoYPL58uVO@archlinux Signed-off-by: Greg Kroah-Hartman commit eefd687afb48c9ec610d1353b327f567fe1de521 Author: Siwanan Bungtong Date: Tue Feb 10 10:06:07 2026 +0700 staging: rtl8723bs: remove unnecessary void * casts in ioctl_cfg80211.c Remove redundant (void *) casts when calling memcpy/memset and other helpers. These casts are unnecessary since C implicitly converts to void * and they only add noise. No functional change. Signed-off-by: Siwanan Bungtong Link: https://patch.msgid.link/20260210030607.1430567-8-horstaufmental@gmail.com Signed-off-by: Greg Kroah-Hartman commit 97926ebe5485770e5474cb994ad7c16b6ac6896b Author: Siwanan Bungtong Date: Tue Feb 10 10:06:06 2026 +0700 staging: rtl8723bs: remove unnecessary void * casts in rtl8723b_hal_init.c Remove redundant (void *) casts when calling memcpy/memset and other helpers. These casts are unnecessary since C implicitly converts to void * and they only add noise. No functional change. Signed-off-by: Siwanan Bungtong Link: https://patch.msgid.link/20260210030607.1430567-7-horstaufmental@gmail.com Signed-off-by: Greg Kroah-Hartman commit 102e8dbdfd85546728b3f2754c1c50e2879962f4 Author: Siwanan Bungtong Date: Tue Feb 10 10:06:05 2026 +0700 staging: rtl8723bs: remove unnecessary void * casts in rtw_security.c Remove redundant (void *) casts when calling memcpy/memset and other helpers. These casts are unnecessary since C implicitly converts to void * and they only add noise. No functional change. Signed-off-by: Siwanan Bungtong Link: https://patch.msgid.link/20260210030607.1430567-6-horstaufmental@gmail.com Signed-off-by: Greg Kroah-Hartman commit ee98bf15839a70e770efdb57d62f9cf7d32d0a2e Author: Siwanan Bungtong Date: Tue Feb 10 10:06:04 2026 +0700 staging: rtl8723bs: remove unnecessary void * casts in rtw_mlme_ext.c Remove redundant (void *) casts when calling memcpy/memset and other helpers. These casts are unnecessary since C implicitly converts to void * and they only add noise. No functional change. Signed-off-by: Siwanan Bungtong Link: https://patch.msgid.link/20260210030607.1430567-5-horstaufmental@gmail.com Signed-off-by: Greg Kroah-Hartman commit 52e3776055a2d12231425ec92c83707cd2d60ab0 Author: Siwanan Bungtong Date: Tue Feb 10 10:06:03 2026 +0700 staging: rtl8723bs: remove unnecessary void * casts in rtw_ieee80211.c Remove redundant (void *) casts when calling memcpy/memset and other helpers. These casts are unnecessary since C implicitly converts to void * and they only add noise. No functional change. Signed-off-by: Siwanan Bungtong Link: https://patch.msgid.link/20260210030607.1430567-4-horstaufmental@gmail.com Signed-off-by: Greg Kroah-Hartman commit fd865573df743e469121913568e904e1a96e09f4 Author: Siwanan Bungtong Date: Tue Feb 10 10:06:02 2026 +0700 staging: rtl8723bs: remove unnecessary void * casts in rtw_efuse.c Remove redundant (void *) casts when calling memcpy/memset and other helpers. These casts are unnecessary since C implicitly converts to void * and they only add noise. No functional change. Signed-off-by: Siwanan Bungtong Link: https://patch.msgid.link/20260210030607.1430567-3-horstaufmental@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8466b076b3d79c517cb652b2bd6971990df55bcb Author: Siwanan Bungtong Date: Tue Feb 10 10:06:01 2026 +0700 staging: rtl8723bs: remove unnecessary void * casts in rtw_ap.c Remove redundant (void *) casts when calling memcpy/memset and other helpers. These casts are unnecessary since C implicitly converts to void * and they only add noise. No functional change. Signed-off-by: Siwanan Bungtong Link: https://patch.msgid.link/20260210030607.1430567-2-horstaufmental@gmail.com Signed-off-by: Greg Kroah-Hartman commit cd3589550059d43a27d613021c626ba6ead7334e Author: William Hansen-Baird Date: Sat Feb 7 17:01:36 2026 -0500 staging: rtl8723bs: replace ternary min comparison with min() Change type of local variable wpa_ie_len from int to u8. wpa_ie_len gets its value either from elems->wpa_ie_len or elems->rsn_ie_len which are both u8, and thus there's no reason to cast them to int. This allows rewriting ternary min comparison using the min() function from linux/minmax.h as now both sides are unsigned. Rewrite as well wpa_ie_len + 2 to wpa_ie_len + 2u, to keep the expression unsigned and avoid overflows. Signed-off-by: William Hansen-Baird Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260207220136.67923-1-william.hansen.baird@gmail.com Signed-off-by: Greg Kroah-Hartman commit c18828f2f8a8846ccba17a1546766fd56e9dd750 Author: Siwanan Bungtong Date: Mon Feb 9 10:10:34 2026 +0700 staging: rtl8723bs: Wrap long function parameter lists Wrap long function parameter lists to comply with kernel coding style and avoid checkpatch warnings. Signed-off-by: Siwanan Bungtong Link: https://patch.msgid.link/20260209031034.130269-1-horstaufmental@gmail.com Signed-off-by: Greg Kroah-Hartman commit 94c1e3abce312fe89a6a9da7690affc7df8839bf Author: Tabrez Ahmed Date: Sun Feb 8 10:43:41 2026 +0530 staging: rtl8723bs: fix spacing around operators Fix checkpatch check: CHECK: spaces preferred around that '+' (ctx:VxV) CHECK: spaces preferred around that '-' (ctx:VxV) The kernel coding style prefers spaces around binary operators for better readability. Signed-off-by: Tabrez Ahmed Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260208051341.38631-1-tabreztalks@gmail.com Signed-off-by: Greg Kroah-Hartman commit f80760f5fc02c1ab384a974097964aa8e6720331 Author: Artem Lytkin Date: Sat Feb 7 22:05:23 2026 +0000 staging: fbtft: fix unchecked write return value in fb_agm1264k-fl The second call to par->fbtftops.write() does not capture the return value, so the subsequent error check tests a stale value from the first write call. Add the missing assignment so the error check applies to the correct write operation. Signed-off-by: Artem Lytkin Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20260207220523.3816-1-iprintercanon@gmail.com Signed-off-by: Greg Kroah-Hartman commit fbab250eb51d6d6a528ba58e884185c83f796e4c Author: Artem Lytkin Date: Sat Feb 7 15:37:02 2026 +0000 staging: sm750fb: convert logging to device-based in sm750.c Replace pr_err() calls with dev_err() using info->device to provide proper device context in log messages. This makes it easier to identify which device generated the message when multiple framebuffer devices are present. Signed-off-by: Artem Lytkin Link: https://patch.msgid.link/20260207153703.2049-3-iprintercanon@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5c05c1ac4baa600f4b6743dabb18e1fb6d64c048 Author: Nam Cao Date: Mon Feb 16 07:57:30 2026 +0700 staging: fbtft: Optimize partial write() When user write() only to part of the screen, the driver still updates the entire screen. That wastes CPU cycles. Optimize by updating only the changed lines. Also remove a "special case" in fbtft_mkdirty() as its only user is removed in this patch. Tested with an Adafruit ILI9340 (drivers/staging/fbtft/fb_ili9340.c). Improvement is measured by a pair of trace_printk() at the beginning of fb_write() and at the end of fbtft_deferred_io(). Update type Before After ==================================== full screen 196ms 200ms half screen 200ms 124ms quarter screen 193ms 81ms one pixel 199ms 43ms It is interesting to note that if the deferred IO's delay time (40ms) is subtracted, then the time amount scales linearly with the write size. Reviewed-by: Andy Shevchenko Signed-off-by: Nam Cao Link: https://patch.msgid.link/20260216005730.4535-1-namcao@linutronix.de Signed-off-by: Greg Kroah-Hartman commit 6bb9204e2995c9cecf9a5c3051dcdb6ad589423e Author: Santiago Almeida Date: Thu Feb 12 00:54:02 2026 -0500 staging: fbtft: fix spelling mistake "dinamically" -> "dynamically" Correct a typo in the fb_ili9163 driver. Found by codespell. Signed-off-by: Santiago Almeida Link: https://patch.msgid.link/20260212055402.457375-1-santiagoalmeidaburbano@gmail.com Signed-off-by: Greg Kroah-Hartman commit e50ecef464e87736ba0beaddaba8bd8769c73c78 Author: Bera Yüzlü Date: Sun Feb 8 13:54:24 2026 +0300 staging: rtl8723bs: Refactor setCCKFilterCoefficient to remove duplicated rtw_write8() calls Previously, the function used 16 individual and repetitive rtw_write8() calls (8 for each channel condition) to set the filter coefficients. The new implementation uses a table pointer to select the appropriate swingtable and iterates through the 8-byte coefficient array using a single for loop. This achieves the same result without changing logic. Signed-off-by: Bera Yüzlü Link: https://patch.msgid.link/aYhrYLYDsxAzWfd1@BERA.localdomain Signed-off-by: Greg Kroah-Hartman commit d1c2574d03cced16a9b363807b41d599285e3e60 Author: Artem Lytkin Date: Mon Feb 16 20:19:20 2026 +0000 staging: most: dim2: check return value of clk_prepare_enable for PLL The return value of clk_prepare_enable() for the PLL clock is not checked, while the same call for the MLB clock is properly checked earlier in the function. If clk_prepare_enable() fails, the driver continues without the PLL clock enabled, leading to undefined hardware behavior. Add the missing error check and disable the MLB clock on failure to keep the cleanup consistent with the rest of the function. Signed-off-by: Artem Lytkin Link: https://patch.msgid.link/20260216201921.1788-2-iprintercanon@gmail.com Signed-off-by: Greg Kroah-Hartman commit d289635eb0f197ad22851e393cebd1e772ebdd89 Author: Rajveer Chaudhari Date: Tue Feb 10 22:18:41 2026 +0530 staging: most: net: remove unused header include Remove unused header include from net.c to reduce unnecessary dependencies and improve compilation time. Signed-off-by: Rajveer Chaudhari Link: https://patch.msgid.link/20260210164841.118503-1-rajveer.chaudhari.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3094fbd606ab23743379664f51890a9c05777ed0 Author: Rajveer Chaudhari Date: Sun Feb 8 13:39:32 2026 +0530 staging: most: dim2: remove unused header includes Remove unused header includes from dim2.c and hal.c to reduce unnecessary dependencies and improve compilation time. Signed-off-by: Rajveer Chaudhari Link: https://patch.msgid.link/20260208080932.124960-1-rajveer.chaudhari.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 4f083b987ef1993ab4ac7d0bd4e28eb9037f543b Author: Zeeshan Ahmad Date: Tue Feb 10 11:51:21 2026 +0500 staging: most: dim2: convert pr_err/warn to dev_err/warn The dim2 driver currently uses generic pr_* logging macros for reporting hardware errors. Modern hardware drivers should use the device-specific dev_* logging macros. This provides better context in the system logs by identifying the specific hardware instance associated with the error or warning, which is especially helpful in systems with multiple controllers. Signed-off-by: Zeeshan Ahmad Link: https://patch.msgid.link/20260210065121.3661-3-zeeshanahmad022019@gmail.com Signed-off-by: Greg Kroah-Hartman commit b708971b2919ed9df158284a3f7dc7f284ba344f Author: Zeeshan Ahmad Date: Tue Feb 10 11:51:20 2026 +0500 staging: most: dim2: move extra info messages to dev_dbg The dim2 driver is currently too talkative in the system logs. Informational messages such as node addresses and state changes are useful for developers but provide unnecessary noise for regular users during normal operation. Move these non-critical info messages to the debug level using dev_dbg(). This ensures a quiet log by default while preserving the information for debugging purposes. Signed-off-by: Zeeshan Ahmad Link: https://patch.msgid.link/20260210065121.3661-2-zeeshanahmad022019@gmail.com Signed-off-by: Greg Kroah-Hartman commit 06ffbc63d18214ca0004b95d8bea23546766b93a Author: Giorgi Tchankvetadze Date: Mon Feb 16 10:07:54 2026 +0400 staging: greybus: sdio: Remove double whitespace Fix double space in variable initialization. Signed-off-by: Giorgi Tchankvetadze Link: https://patch.msgid.link/20260216060753.19007-2-giorgitchankvetadze1997@gmail.com Signed-off-by: Greg Kroah-Hartman commit 08d53e5479ca8653502c1e561938ca91af502e63 Author: Tomasz Unger Date: Sat Feb 21 12:03:55 2026 +0100 staging: greybus: Fix spelling mistake in Kconfig Replace 'busses' with 'buses' in help text. Found using codespell. Signed-off-by: Tomasz Unger Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260221110355.9006-1-tomasz.unger@yahoo.pl Signed-off-by: Greg Kroah-Hartman commit 344c8694995a05be1f0e42bf753ee0d239cf27d6 Author: Giorgi Tchankvetadze Date: Mon Feb 16 09:53:45 2026 +0400 staging: greybus: sdio: Fix typo in comment Fix a grammatical typo in a comment: change "is" to "if". The sentence should read "check if a stop transmission is pending". Signed-off-by: Giorgi Tchankvetadze Link: https://patch.msgid.link/20260216055344.17033-2-giorgitchankvetadze1997@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3e63ff8e224d628ac728492535e746a5c3ff23c7 Author: Giorgi Tchankvetadze Date: Sat Feb 14 14:09:47 2026 +0400 staging: greybus: pwm: Fix typo in comment Change "privodes" to "provides" in a comment. Signed-off-by: Giorgi Tchankvetadze Link: https://patch.msgid.link/20260214100947.70527-1-giorgitchankvetadze1997@gmail.com Signed-off-by: Greg Kroah-Hartman commit fed6e5084894373d76270cad4a32eb6479ad8247 Author: Pei Xiao Date: Fri Feb 20 10:44:25 2026 +0800 spi: atcspi200: Remove redundant assignment to .owner The coccicheck tool reports the following warning for this driver: ./spi-atcspi200.c:670:3-8: No need to set .owner here. The core will do it. The manual assignment of .owner = THIS_MODULE; in the platform_driver struct is redundant. The platform_driver_register() function, which is called to register the driver, is a macro that automatically sets the driver's owner to THIS_MODULE. The driver core handles this assignment internally, making the explicit initialization in the struct definition unnecessary. Remove the unnecessary line. Signed-off-by: Pei Xiao Link: https://patch.msgid.link/tencent_65C9C09CBD2B68C400F7145521A4B217E606@qq.com Signed-off-by: Mark Brown commit 6f7e9b11549dc726270a7e8539201d4270f15803 Author: Antoni Pokusinski Date: Sat Feb 14 22:28:00 2026 +0100 spi: omap2-mcspi: add support for 3-wire transfers Update omap_mcspi_setup_transfer() so that the driver supports communication over a single data line for 3-wire SPI devices. Signed-off-by: Antoni Pokusinski Link: https://patch.msgid.link/20260214212800.262461-1-apokusinski01@gmail.com Signed-off-by: Mark Brown commit 4d28f38f64ef69ab27839069ef3346c3c878d137 Author: Cosmin Tanislav Date: Wed Jan 28 23:51:30 2026 +0200 spi: dt-bindings: renesas,rzv2h-rspi: allow multiple DMAs All supported SoCs have multiple DMA controllers that can be used with the RSPI peripheral. The current bindings only allow a single pair of RX and TX DMAs. The DMA core allows specifying multiple DMAs with the same name, and it will pick the first available one. There is an exception in the base dt-schema rules specifically for allowing this behavior (dtschema/schemas/dma/dma.yaml). dma-names: anyOf: - uniqueItems: true - items: # Hack around Renesas bindings which repeat entries to support # multiple possible DMA providers enum: [rx, tx] Allow multiple DMAs to have the same name and only restrict the possible names of the DMA channels, not their count. For RZ/T2H and RZ/N2H SoCs, limit the number of DMA channels to 6, as they have 3 DMA controllers. For RZ/V2H and RZ/V2N SoCs, limit the number of DMA channels to 10, as they have 5 DMA controllers. Signed-off-by: Cosmin Tanislav Acked-by: Conor Dooley Link: https://patch.msgid.link/20260128215132.1353381-2-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit 5e897a498a6b45145350e9de5e4753e9eee7d4f6 Author: Krzysztof Kozlowski Date: Mon Feb 16 09:58:17 2026 +0100 spi: stm32: Use NULL instead of 0 for pointer Pointers should use NULL instead of explicit '0', as pointed out by sparse: spi-stm32.c:1659:65: warning: Using plain integer as NULL pointer Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260216085816.69888-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown commit 52531750d39b94803e089dda95e43925730c03bd Author: Patrice Chotard Date: Fri Feb 13 09:19:11 2026 +0100 spi: stm32-ospi: Remove exec_op() callback debug log Since commit ad4488845193 ("spi: spi-mem: Introduce a default ->exec_op() debug log") a common debug log is available in spi-mem, so remove the one from spi-stm32-ospi driver. Signed-off-by: Patrice Chotard Link: https://patch.msgid.link/20260213-upstream_ospi_remove_exec_op_debug_log-v1-1-164f17515fd0@foss.st.com Signed-off-by: Mark Brown commit 837f6691d5f39ea6453e4489dded40fb17755c60 Author: Alain Volmat Date: Thu Feb 12 12:49:10 2026 +0100 spi: stm32: fix rx DMA request error handling Avoid trying to release the RX DMA channel when an error occurs during RX dma_request_chan() call. Instead, jump directly to release the TX channel, if applicable. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-spi/aYXvY6NH7OlZ-OAF@stanley.mountain/T/#u Signed-off-by: Alain Volmat Link: https://patch.msgid.link/20260212-spi-stm32-fix-dma-rx-release-v1-1-53a37c31626b@foss.st.com Signed-off-by: Mark Brown commit 20a88c156f37634fdd88b746fa34e3622f567130 Author: Charles Keepax Date: Mon Feb 23 10:07:17 2026 +0000 spi: cs42l43: Don't support sidecar properties on device tree systems On some systems the cs42l43 has amplifiers attached to its SPI controller that are not properly defined in ACPI. However, this exists to provide compatibility with existing Windows ACPI. On device tree systems this functionality should never be used, there is no reason not to specify the amplifiers properly through device tree. Make this more clear by only allowing the "sidecar" functionality to be used on non-DT systems. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260223100717.4011114-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit ffef4123043c5bb29e61052a41e577ae1ee6837a Author: Antoniu Miclaus Date: Fri Feb 6 18:07:13 2026 +0200 spi: allow ancillary devices to share parent's chip selects When registering an ancillary SPI device, the current code flags a chip select conflict with the parent device. This happens because the ancillary device intentionally uses one of the parent's chip selects, but __spi_add_device() checks against all existing devices including the parent. Allow this by passing the parent device pointer to __spi_add_device() and skipping the conflict check when the existing device is the parent. Signed-off-by: Antoniu Miclaus Reviewed-by: David Lechner Link: https://patch.msgid.link/bcb1eb34fc5e86fd5dbb4472ad1d3ea3cf3e9779.1770393792.git.antoniu.miclaus@analog.com Signed-off-by: Mark Brown commit 52b364fed6e1578e551fee20c76fecb3fc0e10ed Author: Christian Brauner Date: Mon Feb 16 14:31:59 2026 +0100 shmem: adapt to rhashtable-based simple_xattrs with lazy allocation Adapt tmpfs/shmem to use the rhashtable-based xattr path and switch from an embedded struct to pointer-based lazy allocation. Change shmem_inode_info.xattrs from embedded 'struct simple_xattrs' to a pointer 'struct simple_xattrs *', initialized to NULL. This avoids the rhashtable overhead for every tmpfs inode, which helps when a lot of inodes exist. The xattr store is allocated on first use: - shmem_initxattrs(): Allocates via simple_xattrs_alloc() when security modules set initial xattrs during inode creation. - shmem_xattr_handler_set(): Allocates on first setxattr, with a short-circuit for removal when no xattrs are stored yet. All read paths (shmem_xattr_handler_get, shmem_listxattr) check for NULL xattrs pointer and return -ENODATA or 0 respectively. Replaced xattr entries are freed via simple_xattr_free_rcu() to allow concurrent RCU readers to finish. shmem_evict_inode() conditionally frees the xattr store only when allocated. Also change simple_xattr_add() from void to int to propagate rhashtable insertion failures. shmem_initxattrs() is the only caller. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-3-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit b32c4a213698ab351b44da2fd1b2a5976c7fa033 Author: Christian Brauner Date: Mon Feb 16 14:31:58 2026 +0100 xattr: add rhashtable-based simple_xattr infrastructure Add rhashtable support to the simple_xattr subsystem while keeping the existing rbtree code fully functional. This allows consumers to be migrated one at a time without breaking any intermediate build. struct simple_xattrs gains a dispatch flag and a union holding either the rbtree (rb_root + rwlock) or rhashtable state: struct simple_xattrs { bool use_rhashtable; union { struct { struct rb_root rb_root; rwlock_t lock; }; struct rhashtable ht; }; }; simple_xattrs_init() continues to set up the rbtree path for existing embedded-struct callers. Add simple_xattrs_alloc() which dynamically allocates a simple_xattrs and initializes the rhashtable path. This is the entry point for consumers switching to pointer-based lazy allocation. The five core functions (get, set, list, add, free) dispatch based on the use_rhashtable flag. Existing callers continue to use the rbtree path unchanged. As each consumer is converted it will switch to simple_xattrs_alloc() and the rhashtable path. Once all consumers are converted a follow-up patch will remove the rbtree code. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-2-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 94d709be8c0dc875dfc9ebb64d3b8093d0790c15 Author: Christian Brauner Date: Mon Feb 16 14:31:57 2026 +0100 xattr: add rcu_head and rhash_head to struct simple_xattr In preparation for converting simple_xattrs from rbtree to rhashtable, add rhash_head and rcu_head members to struct simple_xattr. The rhashtable implementation will use rhash_head for hash table linkage and RCU-based lockless reads, requiring that replaced or removed xattr entries be freed via call_rcu() rather than immediately. Add simple_xattr_free_rcu() which schedules RCU-deferred freeing of an xattr entry. This will be used by callers of simple_xattr_set() once they switch to the rhashtable-based xattr store. No functional changes. Link: https://patch.msgid.link/20260216-work-xattr-socket-v1-1-c2efa4f74cb7@kernel.org Acked-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 2ff7cf7e0640ff071ebc5c7e3dc2df024a7c91e6 Author: Andreas Gruenbacher Date: Mon Feb 23 12:04:05 2026 +0100 gfs2: Call unlock_new_inode before d_instantiate As Neil Brown describes in detail in the link referenced below, new inodes must be unlocked before they can be instantiated. An even better fix is to use d_instantiate_new(), which combines d_instantiate() and unlock_new_inode(). Fixes: 3d36e57ff768 ("gfs2: gfs2_create_inode rework") Reported-by: syzbot+0ea5108a1f5fb4fcc2d8@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-fsdevel/177153754005.8396.8777398743501764194@noble.neil.brown.name/ Signed-off-by: Andreas Gruenbacher commit d6bf2e64dec87322f2b11565ddb59c0e967f96e3 Author: Luke Wang Date: Wed Feb 4 11:40:03 2026 +0800 mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Kingston eMMC IY2964 and IB2932 takes a fixed ~2 seconds for each secure erase/trim operation regardless of size - that is, a single secure erase/trim operation of 1MB takes the same time as 1GB. With default calculated 3.5MB max discard size, secure erase 1GB requires ~300 separate operations taking ~10 minutes total. Add a card quirk, MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME, to set maximum secure erase size for those devices. This allows 1GB secure erase to complete in a single operation, reducing time from 10 minutes to just 2 seconds. Signed-off-by: Luke Wang Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit f3b9683bf5432aaada84bb4a7f815f3eb3148a90 Author: Arnd Bergmann Date: Wed Feb 4 14:00:19 2026 +0100 mmc: dw_mmc: move pmops into core driver Since the platform power management structure is now shared with the PCI front-end, there is a link failure if only the PCI variant is enabled: arm-linux-gnueabi/bin/arm-linux-gnueabi-ld: drivers/mmc/host/dw_mmc-pci.o:(.data+0x74): undefined reference to `dw_mci_pltfm_pmops' This could be fixed by selecting the platform driver from the PCI one in Kconfig, or by reverting the change to the PCI driver, but since this is now used by all dw_mmc variants, just move the structure into the core code as well. Signed-off-by: Arnd Bergmann Signed-off-by: Ulf Hansson commit 4cd4e8231652872823ac5ed0be66df59ce7c778f Author: Andre Korol Date: Thu Jan 29 00:59:17 2026 -0300 mmc: loongson2-mmc: drop redundant memset after dma_alloc_coherent() dma_alloc_coherent() returns zeroed memory, so the memset() immediately after allocation is redundant. Signed-off-by: Andre Korol Reviewed-by: Binbin Zhou Signed-off-by: Ulf Hansson commit 8ea84b50a95f4529a78161afd9b6bc7fa9f0fc55 Author: Shawn Lin Date: Fri Jan 23 20:24:09 2026 +0800 mmc: dw_mmc: Remove mshc alias support Remove the long-deprecated mshc alias support, as the mmc core already provides alias functionality through the standard mmc alias. This eliminates the redundant dual-alias system. The driver now obtains the controller ID from struct mmc_host::index(supplied by mmc alias) instead of the legacy mshc alias. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 9b541ceaf5b462f852f35245add4f2d3afd579f4 Author: Shawn Lin Date: Fri Jan 23 20:24:08 2026 +0800 mmc: dw_mmc-k3: Remove mshc alias support Remove the long-deprecated mshc alias support, as the mmc core already provides alias functionality through the standard mmc alias. This eliminates the redundant dual-alias system. The driver now obtains the controller ID from struct mmc_host::index(supplied by mmc alias) instead of the legacy mshc alias. dw_mci_hi6220_parse_dt() which parse mshc alias is used for hi6220, hi3660 and hi3670. Given hi6220 never assigned mshc alias on the DTS files, and hi3360 and hi3670 share the same code, so with it removed, add a return value to dw_mci_hs_set_timing() and let dw_mci_hi3660_init() check if index exceeds TIMING_MODE in the firs place to bail out early, the same as before. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 6aaa6c561fe6e4a9011534ed050ca50fa6491f2f Author: Shawn Lin Date: Fri Jan 23 20:24:07 2026 +0800 arm64: dts: hisilicon: hikey960/970: Convert to use standard mmc alias Convert the long-deprecated mshc alias to standard mmc alias. Signed-off-by: Shawn Lin Reviewed-by: Wei Xu Signed-off-by: Ulf Hansson commit 1e618364767cd03350dd6cba01411c68803044c5 Author: Albert Yang Date: Fri Jan 23 17:53:42 2026 +0800 MAINTAINERS: add MMC files to BST entry Add the MMC device tree binding and driver files to the existing ARM/BST SOC SUPPORT maintainer entry. Signed-off-by: Albert Yang Signed-off-by: Ulf Hansson commit 695824f45629dfad8834f432d78f8b60fdcbe3d8 Author: Albert Yang Date: Fri Jan 23 17:53:39 2026 +0800 mmc: sdhci: add Black Sesame Technologies BST C1200 controller driver Add SDHCI controller driver for Black Sesame Technologies C1200 SoC. This driver supports the DWCMSHC SDHCI controller with BST-specific enhancements including: - Custom clock management and tuning - Power management support - BST-specific register configurations - Support for eMMC and SD card interfaces - Hardware limitation workaround for 32-bit DMA addressing The driver addresses specific hardware constraints where: - System memory uses 64-bit bus, eMMC controller uses 32-bit bus - eMMC controller cannot access memory through SMMU due to hardware bug - All system DRAM is configured outside 4GB boundary (ZONE_DMA32) - Uses SRAM-based bounce buffer within 32-bit address space Signed-off-by: Ge Gordon Signed-off-by: Albert Yang Acked-by: Arnd Bergmann Signed-off-by: Ulf Hansson commit ef7eb1a7094dbb5042ea1bed34193c1415fb9844 Author: Albert Yang Date: Fri Jan 23 17:53:38 2026 +0800 mmc: sdhci: allow drivers to pre-allocate bounce buffer Allow platform drivers to pre-allocate bounce buffer by checking if host->bounce_buffer is already set before attempting allocation. This enables platforms with specific DMA constraints (such as 32-bit DMA on controllers that cannot access high memory) to use their own reserved memory regions for the bounce buffer. Suggested-by: Adrian Hunter Signed-off-by: Albert Yang Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit d5159623162cc3d462ba1e661f8362c181756d65 Author: Albert Yang Date: Fri Jan 23 17:53:37 2026 +0800 dt-bindings: mmc: add binding for BST DWCMSHC SDHCI controller Add device tree bindings for the Black Sesame Technologies DWCMSHC SDHCI controller used in C1200 SoC. The binding describes a Synopsys DesignWare Cores Mobile Storage Host Controller with BST-specific extensions including: - Two register regions (core SDHCI and CRM registers) - Optional memory-region for bounce buffer support - Fixed clock input Signed-off-by: Ge Gordon Signed-off-by: Albert Yang Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit 1e9f43a1dbefd3de45b97545e5773d2b52dc7f02 Author: Yixun Lan Date: Thu Jan 22 17:37:31 2026 +0800 mmc: sdhci-of-k1: spacemit: Add support for K3 SoC The SDHCI controller found on SpacemiT K3 SoC share the same IP with K1 generation and introduce a compatible data to denote the change that broken 64BIT DMA issue has been fixed. Signed-off-by: Yixun Lan Signed-off-by: Ulf Hansson commit b4206966e2d48883f04d5a2b2ae6c46b528245d3 Author: Yixun Lan Date: Thu Jan 22 17:37:30 2026 +0800 dt-bindings: mmc: spacemit,sdhci: add support for K3 SoC The SDHCI controller found on SpacemiT K3 SoC share the same IP with K1 generation, while fixed the broken 64BIT DMA issue. Introduce a compatible string to enable support for it. Acked-by: Rob Herring (Arm) Signed-off-by: Yixun Lan Signed-off-by: Ulf Hansson commit 366b5941566cebdb8a972ff296f4f889f3887741 Author: Linus Walleij Date: Tue Jan 20 14:05:50 2026 +0100 mmc: sdhci: Stop advertising the driver in dmesg As much as we have grown used to seeing this message on every kernel boot, it does not add any technical value. Drop all messages from sdhci_drv_init(), and drop the module_init() and module_exit() calls as well since they now become empty. The modules becomes a pure library module, meaning it will get pulled in by modprobe() when the symbols inside it are needed, or compiled in if any users are compiled in. Signed-off-by: Linus Walleij Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit c0b68bc25efeaca8a1ef3a0cfab5fbf5f81d002d Author: Jeff Chen Date: Tue Jan 13 11:15:17 2026 +0800 mmc: sdio: add NXP vendor and IW61x device IDs Add NXP's SDIO vendor ID (0x0471) and IW61x device ID (0x0205) to sdio_ids.h for future support of NXP Wi-Fi chips over SDIO. Signed-off-by: Jeff Chen Signed-off-by: Ulf Hansson commit 2c7fe99a71f65d61b677f1c7d5cf5e9bd859c5ee Author: Shawn Lin Date: Tue Jan 6 10:17:08 2026 +0800 mmc: dw_mmc-pltfm: use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. When this's done, remove all variant drivers' local pm definition and replace it with dw_mci_pltfm_pmops. Signed-off-by: Shawn Lin [Ulf: Fixed conflict by dropping changes for dw_mmc-rockchip] Signed-off-by: Ulf Hansson commit 765f4836ec6620212004dc7ce6b40a88dba71c30 Author: Shawn Lin Date: Tue Jan 6 10:17:07 2026 +0800 mmc: dw_mmc-pci: Use BAR_2 and pcim_iomap_region() PCIe endpoint framework defines standard BAR enum for EP drivers to use, so remove PCI_BAR_NO here. Then, pcim_iomap_regions has been deprecated for a long time, replace it with pcim_iomap_region(); Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit c6969a13f6d3e8706bc9c0df23576c1884d6f7fb Author: Shawn Lin Date: Tue Jan 6 10:17:05 2026 +0800 mmc: dw_mmc: Remove unused register access macros The mci_readw/mci_writew/mci_readq/mci_writeq macros were added to provide 16-bit and 64-bit register access operations, but they have remained unused since their introduction. Remove these dead code. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 7597d68cea6827f721e66b69d85e50e8ba820b09 Author: Shawn Lin Date: Tue Jan 6 10:17:04 2026 +0800 mmc: dw_mmc: Improve dw_mci_get_cd() The current dw_mci_get_cd() implementation maintains a DW_MMC_CARD_PRESENT flag primarily for logging purposes, which adds unnecessary complexity. Additionally, the if-else-elif control flow does not align with the Linux kernel coding style. This commit simplifies the function by: - Removing the redundant card presence flag - Replacing the conditional chain with a cleaner implementation - Improving code readability while maintaining functionality The change reduces code complexity without affecting the actual card detection behavior. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 29d3f6a64376eff2d44e1f181d7770434b05274b Author: Shawn Lin Date: Tue Jan 6 10:17:03 2026 +0800 mmc: dw_mmc: Remove DW_MCI_SEND_STATUS and DW_MCI_RECV_STATUS macros Use MMC_DATA_READ and MMC_DATA_WRITE defined by MMC core instead. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit e453a08b3a1199809b27a2c6982261710abe0170 Author: Shawn Lin Date: Tue Jan 6 10:17:02 2026 +0800 mmc: dw_mmc: Remove redundant struct mmc_data forward declaration The header file linux/mmc/core.h, which is already included in dw_mmc.h, contains the forward declaration of struct mmc_data. There's no need to redeclare it here. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 792bd24b6eb6625e9b7ea926597c5c15a5554266 Author: Shawn Lin Date: Tue Jan 6 10:17:01 2026 +0800 mmc: dw_mmc: Remove struct dw_mci_board The only user of dw_mci_board is dw_pci-pci, now we can provide the caps from dw_mci_drv_data, so we could let dw_pci-pci use dw_mci_drv_data and remove caps from struct dw_mci_board. With that, struct dw_mci_board is no longer needed, we can remove it. Then we should check all settings in dw_mci_parse_dt in order not to overwrite them if provided from variant drivers. Also, without CONFIG_OF support, dw_mmc doesn' work as host->pdata is always ERR_PTR(-EINVAL), we could remove it together. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit ec6d8bb39dc8d8ee976d65349290411cab209764 Author: Shawn Lin Date: Tue Jan 6 10:17:00 2026 +0800 mmc: dw_mmc: Remove bus_hz from struct dw_mci_board struct dw_mci already keeps one, reuse it. Now, as dw_mmc-pci still provide struct dw_mci_board, so host->bus_hz will not be overwritten. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit d3fcd6362aafe5f30d85c2f1639cdcb7288ca4bf Author: Shawn Lin Date: Tue Jan 6 10:16:59 2026 +0800 mmc: dw_mmc: Move detect_delay_ms from struct dw_mci_board to struct dw_mci Now, as dw_mmc-pci still provide struct dw_mci_board, so host->detect_delay_ms will not be overwritten. So it's fine to move it. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit dc1f8aacc9941150be504048a46dd94c111717bc Author: Shawn Lin Date: Tue Jan 6 10:16:58 2026 +0800 mmc: dw_mmc: Remove fifo_depth from struct dw_mci_board struct dw_mci already keeps one, so remove it from struct dw_mci_board. Now, as dw_mmc-pci still provide struct dw_mci_board, so host->fifo_depth will not be overwritten. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit d917f35c33fd0abe49f5a93a85489d96b8a9af3b Author: Shawn Lin Date: Tue Jan 6 10:16:57 2026 +0800 mmc: dw_mmc: Move rstc from struct dw_mci_board to struct dw_mci Nobody using dw_mci_board passes in rstc, move it to the common struct dw_mci needed by all users. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit cea6e1a151bf4e97f76620441d56e97ef38a2dbd Author: Shawn Lin Date: Tue Jan 6 10:16:56 2026 +0800 mmc: dw_mmc: Remove caps2 and pm_caps from struct dw_mci_board Nobody uses them. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit fedf31e20405db12d1019f3df7b27fb7c92d2c61 Author: Shawn Lin Date: Tue Jan 6 10:16:55 2026 +0800 mmc: dw_mmc: Remove assignment of pdata in dw_mci_pltfm_register() No one using dw_mci_pltfm_register() passes in platform_data when searching host and arch directories, remove it. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 137cf0a4d63322f4be50954da8378bf389493f2e Author: Shawn Lin Date: Tue Jan 6 10:16:54 2026 +0800 mmc: dw_mmc: Remove SDMMC_INT_ERROR SDMMC_INT_ERROR is defined as 0xbfc2, which looks like a magic number and it's never used, so remove it. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 57cc962430a1026f68bcda583d0bdd02dd564298 Author: Shawn Lin Date: Tue Jan 6 10:16:53 2026 +0800 mmc: dw_mmc: Remove dma_ops from struct dw_mci_board It does take dma_ops from struct dw_mci_board, but we immediately re-assign it from either dw_mci_idmac_ops or dw_mci_edmac_ops in dw_mci_init_dma(). That means it's never used now, or has been broken for a long time without noticed. It seems no drivers need it, so remove it now. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 4db2a6c8576f75f16b253c1fd15c821c40662aa2 Author: Shawn Lin Date: Tue Jan 6 10:16:52 2026 +0800 mmc: dw_mmc: Check return value of dma_ops->init() in resume dma_ops->init() may fail, should check the return value. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit c740532de087009b18981ab14be42c45494c246d Author: Vladimir Zapolskiy Date: Thu Dec 25 20:16:15 2025 +0200 dt-bindings: mmc: arm,pl18x: Do not use plural form of a proper noun PrimeCell As a proper noun PrimeCell is a single entity and it can not have a plural form, fix the typo. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Ulf Hansson commit 6fba00c98eb9da19118f4d1f50fe0d790ef79341 Author: Krzysztof Kozlowski Date: Wed Dec 24 13:44:35 2025 +0100 mmc: sdhci-of-aspeed: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit f6b3889812e4f37fe5f1eeca9741eb7d7e39a764 Author: Krzysztof Kozlowski Date: Wed Dec 24 13:44:34 2025 +0100 mmc: jz4740: Fix Wvoid-pointer-to-enum-cast warning "jz4740" is an enum, thus cast of pointer on 64-bit compile test with clang W=1 causes: jz4740_mmc.c:1055:18: error: cast to smaller integer type 'enum jz4740_mmc_version' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] Signed-off-by: Krzysztof Kozlowski Reviewed-by: Paul Cercueil Signed-off-by: Ulf Hansson commit 4e709d5d62f3cc6d520a2a1a7ae9d2c74fcd95ac Author: Krzysztof Kozlowski Date: Wed Dec 24 13:44:33 2025 +0100 mmc: cavium-octeon: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit e8c23b466bcc3eae2528ef1e070a759079f092bf Author: Krzysztof Kozlowski Date: Wed Dec 24 13:44:32 2025 +0100 mmc: atmel-mci: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Nicolas Ferre Signed-off-by: Ulf Hansson commit 0621d52b1ddfcdcee8216beec18646d23ed3f165 Author: Thorsten Blum Date: Mon Dec 22 11:03:33 2025 +0100 mmc: cavium: Use clamp to simplify cvm_mmc_set_clock Use clamp() to simplify cvm_mmc_set_clock() and improve its readability. Signed-off-by: Thorsten Blum Signed-off-by: Ulf Hansson commit 658b716c048684ad13d78280d69b883f181251da Author: Yixun Lan Date: Tue Dec 23 10:24:50 2025 +0800 mmc: sdhci-of-k1: add reset support The SDHCI controller of SpacemiT K1 SoC requires two resets, add support to explicitly request the reset line and deassert during initialization phase. Still using devm_xx_get_optional() API to make the request optional. Signed-off-by: Yixun Lan Reviewed-by: Javier Martinez Canillas Signed-off-by: Ulf Hansson commit 4231325cfb87f712fcbe1fcbeea4186d18c78513 Author: Yixun Lan Date: Tue Dec 23 10:24:49 2025 +0800 dt-bindings: mmc: spacemit,sdhci: add reset support The SpacemiT SDHCI controller has two reset lines, one connect to AXI bus which shared by all controllers, while another one connect to individual controller separately. Signed-off-by: Yixun Lan Reviewed-by: Javier Martinez Canillas Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit 5e9f849d8d2303e95569124444837afa2ff812ba Author: Shawn Lin Date: Sat Dec 20 13:22:06 2025 +0800 mmc: dw_mmc: Remove struct dw_mci_slot Use dw_mci_alloc_host() helper to allocate struct dw_mci for dw_mmc-pci.c and dw_mmc-pltfm.c. With that, we could get rid of struct dw_mci_slot and remove it everywhere. Signed-off-by: Shawn Lin Tested-by: Marek Szyprowski Signed-off-by: Ulf Hansson commit c72be4c3066d5f8bee2c699e5c5ff6df5896f74e Author: Shawn Lin Date: Sat Dec 20 13:22:05 2025 +0800 mmc: dw_mmc: Introduce dw_mci_alloc_host() This helper is used for variant drivers to allocate struct dw_mci and set struct dw_mci as private data of struct mmc_host. Signed-off-by: Shawn Lin Tested-by: Marek Szyprowski Signed-off-by: Ulf Hansson commit 3449b31eb18f9439dcebfd999c51c47bed148d3b Author: Shawn Lin Date: Tue Dec 16 19:50:06 2025 +0800 mmc: dw_mmc: Remove queue from dw_mci It's pointless to use a queue if only one slot is supported. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 78983c4d608b552de2e59e798c31230e03ca5a2d Author: Shawn Lin Date: Tue Dec 16 19:50:05 2025 +0800 mmc: dw_mmc: Remove mrq from struct dw_mci_slot struct dw_mci has already kept mrq, so removing keeping mrq again from struct dw_mci_slot. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 027e1688bc4a77134f3bd9a2b0cac031e743cded Author: Shawn Lin Date: Tue Dec 16 19:50:04 2025 +0800 mmc: dw_mmc: Move clock rate stuff from struct dw_mci_slot to struct dw_mci Except for moving them, this patch also renames __clk_old to clk_old. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit a1513290091078206f0d2af199104bf11cf8c9a9 Author: Shawn Lin Date: Tue Dec 16 19:50:03 2025 +0800 mmc: dw_mmc: Remove sdio_id from struct dw_mci_slot There is only one slot support, the sdio_id is used to indicate the SDIO slot and where is the irq located. So it's pointless now, remove it. Given sdio_id0 is only used by Rockchip to inform dwc core the irq is located with a offset, rename sdio_id0 to sdio_irq to reflect the fact. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit b8cc1e80668aba7d1206a1f03c12908c078a7168 Author: Shawn Lin Date: Tue Dec 16 19:50:02 2025 +0800 mmc: dw_mmc: Remove id and ctype from dw_mci_slot There is only one slot support, id should be zero. So no need to keep it in track as long as ctype associated. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 1a1936f808d791b24f9b8dc9c2171dbbd5f18653 Author: Shawn Lin Date: Tue Dec 16 19:50:01 2025 +0800 mmc: dw_mmc: Move flags from struct dw_mci_slot to struct dw_mci With this, dw_mmc-exynos.c will not need to access slot. While at it, since the host->slot is always present when calling dw_mci_exynos_set_clksel_timing(), let's remove it. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit d7ab40c3bd2a40a57fa5a09a6f7e561f59c733a6 Author: Shawn Lin Date: Tue Dec 16 19:50:00 2025 +0800 mmc: dw_mmc: Let variant drivers to use struct dw_mci as possible This patch changes the callbacks of switch_voltage() and execute_tuning() in order for variant drivers to avoid accessing to struct dw_mci_slot. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 1a990def44fbb714e55794dc28d03e77bed66879 Author: Shawn Lin Date: Tue Dec 16 19:49:59 2025 +0800 mmc: dw_mmc: Move struct mmc_host from struct dw_mci_slot to struct dw_mci Move struct mmc_host to struct dw_mci in preparation for removing dw_mci_slot. No functional change intended. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 53f05821b7f7e096d9987ab78e7009847066bb80 Author: Shawn Lin Date: Tue Dec 16 19:49:58 2025 +0800 mmc: dw_mmc: Remove unused header files and keep alphabetical order Some header files are not needed and they are out of order, this patch remove unused header files and re-order them alphabetically. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 9edf45987d08c0115ea9a66887be8bc9f59cef27 Author: Shawn Lin Date: Tue Dec 16 19:49:57 2025 +0800 mmc: dw_mmc: Remove check before calling mmc_regulator_set_ocr() mmc_regulator_set_ocr() already checks if vqmmc is correct. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 9313c6c3dbd7aab645f1a37943f8187ea48edc6f Author: Shawn Lin Date: Tue Dec 16 19:49:56 2025 +0800 mmc: dw_mmc: Remove vqmmc_enabled from struct dw_mci and update the reset commit 51da2240906c ("mmc: dw_mmc: use mmc_regulator_get_supply to handle regulators") introduced tracking of vqmmc_enabled. Currently, mmc_regulator_enable_vqmmc() and mmc_regulator_disable_vqmmc() well record the status of vqmmc, so use these two helpers to remove vqmmc_enabled locally. With vqmmc_enabled gone, resetting controller on MMC_POWER_ON phase won't work as dw_mci_set_ios() will be called several times during enumerating which leads to reset the controller several times too. This messes up the status machine of controller. By looking into the commit d1f1dd86006c ("mmc: dw_mmc: Give a good reset after we give power"), it tried to solve failures on rk3288. The problem is probably because the vqmmc is used for IO block associated with dw controller. When SD is removed during I/O, cutting off vqmmc in MMC_POWER_OFF phase will confuse the controller as its status machine refers to several IO status, such as data_state_mc_busy and data_busy on SDMMC_STATUS reg. So the controller could run into an unexpected state and could not enumerate cards correctly the next time. Reset it on MMC_POWER_ON phase or MMC_POWER_OFF phase should work, let's do the latter. This patch is tested on RK3588s/RK3399/RK3576 EVB with TF cards with both vqmmc present or not. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 5962f68603ea74b804f7bb01a475b08846932aad Author: Rob Herring (Arm) Date: Mon Dec 15 15:27:50 2025 -0600 dt-bindings: mmc: arasan,sdhci: Allow "dma-coherent" property The Arasan SDHCI controller is DMA coherent on the APM merlin SoC, so allow the dma-coherent property. No reason implementations can't also be coherent and there's not an SoC specific compatible, so allow it on any platform. Signed-off-by: Rob Herring (Arm) Signed-off-by: Ulf Hansson commit acb52756e90c99648c993e4ea8a550e126d29d9d Author: Rob Herring (Arm) Date: Mon Dec 15 15:27:36 2025 -0600 dt-bindings: mmc: brcm,iproc-sdhci: Allow "dma-coherent" and "iommus" properties The Broadcom iProc SDHCI controller is DMA coherent and/or behind an IOMMU on some Broadcom SoCs, so allow the dma-coherent and iommus properties. Signed-off-by: Rob Herring (Arm) Reviewed-by: Florian Fainelli Signed-off-by: Ulf Hansson commit 182b650e4e9c3d68ac636048463db21f8375a057 Author: Rob Herring (Arm) Date: Mon Dec 15 15:27:27 2025 -0600 dt-bindings: mmc: cdns,sdhci: Drop required "resets" on AMD Pensando ELBA The AMD Pensando ELBA DT defines no reset for the SDHCI, so it is obviously not required. Signed-off-by: Rob Herring (Arm) Signed-off-by: Ulf Hansson commit 8ceb70c9f970bfbdceb1e51578850a60b9de2236 Author: Luke Wang Date: Thu Dec 11 15:56:03 2025 +0800 mmc: sdhci-esdhc-imx: wait for data transfer completion before reset On IMX7ULP platforms, certain SD cards (e.g. Kingston Canvas Go! Plus) cause system hangs and reboots during manual tuning. These cards exhibit large gaps (~16us) between tuning command response and data transmission. When cmd CRC errors occur during tuning, the code assumes data errors even tuning data hasn't been fully received and then reset host data circuit. Per IMX7ULP reference manual, reset operations (RESET_DATA/ALL) need to make sure no active data transfers. Previously, resetting while data was in-flight would clear data circuit, including ADMA/SDMA address, causing data to be transmitted to incorrect memory address. This patch adds polling for data transfer completion before executing resets. Signed-off-by: Luke Wang Reviewed-by: Bough Chen Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 846a3a2fdff57131725029e0e95d46e08a323da6 Author: Louis-Alexis Eyraud Date: Wed Dec 3 12:45:36 2025 +0100 mmc: mtk-sd: add support for MT8189 SoC Even though MMC IP in MT8189 SoC is partially compatible with the one found in MT8196 SoC, its register layout has some slight differences and additional features such as the system power management release resource control support. Thus, add new compatible and platform data to support this SoC. Signed-off-by: Louis-Alexis Eyraud Signed-off-by: Ulf Hansson commit a834e60c8a9954974360a9486f1fdad7ce4776f5 Author: Louis-Alexis Eyraud Date: Wed Dec 3 12:45:35 2025 +0100 mmc: mtk-sd: add support for SPM resource release control The MT8189 SoC has in the status register an additional bit field to release all System Power management (SPM) resource requests. In preparation of MT8189 SoC support, add its use in suspend callback and a support flag in the platform data. Signed-off-by: Louis-Alexis Eyraud Signed-off-by: Ulf Hansson commit 7514f64780a47306ebcc26f06b30eeec376b2bf4 Author: Louis-Alexis Eyraud Date: Wed Dec 3 12:45:34 2025 +0100 dt-bindings: mmc: mtk-sd: Add support for MT8189 SoC Add a new compatible for MMC IP in MT8189 SoC. Even though this is partially compatible with the one found in MT8196 SoC, the MT8189 SoC register layout has some slight differences and additional features. Signed-off-by: Louis-Alexis Eyraud Acked-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit 263ff314cc5602599d481b0912a381555fcbad28 Author: Avri Altman Date: Fri Nov 28 07:20:11 2025 +0200 mmc: core: Add quirk for incorrect manufacturing date Some eMMC vendors need to report manufacturing dates beyond 2025 but are reluctant to update the EXT_CSD revision from 8 to 9. Changing the Updating the EXT_CSD revision may involve additional testing or qualification steps with customers. To ease this transition and avoid a full re-qualification process, a workaround is needed. This patch introduces a temporary quirk that re-purposes the year codes corresponding to 2010, 2011, and 2012 to represent the years 2026, 2027, and 2028, respectively. This solution is only valid for this three-year period. After 2028, vendors must update their firmware to set EXT_CSD_REV=9 to continue reporting the correct manufacturing date in compliance with the JEDEC standard. The `MMC_QUIRK_BROKEN_MDT` is introduced and enabled for all Sandisk devices to handle this behavior. Signed-off-by: Avri Altman Signed-off-by: Ulf Hansson commit 3e487a634bc019166e452ea276f7522710eda9f4 Author: Avri Altman Date: Fri Nov 28 07:20:10 2025 +0200 mmc: core: Adjust MDT beyond 2025 JEDEC JESD84-B51B which was released in September 2025, increases the manufacturing year limit for eMMC devices. The eMMC manufacturing year is stored in a 4-bit field in the CID register. Originally, it covered 1997–2012. Later, with EXT_CSD_REV=8, it was extended up to 2025. Now, with EXT_CSD_REV=9, the range is rolled over by another 16 years, up to 2038. The mapping is as follows: cid[8..11] | rev ≤ 4 | 8 ≥ rev > 4 | rev > 8 --------------------------------------------- 0 | 1997 | 2013 | 2029 1 | 1998 | 2014 | 2030 2 | 1999 | 2015 | 2031 3 | 2000 | 2016 | 2032 4 | 2001 | 2017 | 2033 5 | 2002 | 2018 | 2034 6 | 2003 | 2019 | 2035 7 | 2004 | 2020 | 2036 8 | 2005 | 2021 | 2037 9 | 2006 | 2022 | 2038 10 | 2007 | 2023 | 11 | 2008 | 2024 | 12 | 2009 | 2025 | 13 | 2010 | | 2026 14 | 2011 | | 2027 15 | 2012 | | 2028 Signed-off-by: Avri Altman Reviewed-by: Shawn Lin Signed-off-by: Ulf Hansson commit 3d9ce86b52b7b328f5662436904789942a5eca1f Author: Md Sadre Alam Date: Wed Nov 26 12:12:51 2025 +0530 mmc: sdhci-msm: Enable ICE for CQE-capable controllers with non-CQE cards Enable Inline Crypto Engine (ICE) support for CQE-capable sdhci-msm controllers when used with eMMC cards that do not support CQE. This addresses the scenario where: - The host controller supports CQE (and has CQHCI crypto infrastructure) - The eMMC card does not support CQE - Standard (non-CMDQ) requests need crypto support This allows hardware-accelerated encryption and decryption for standard requests on CQE-capable hardware by utilizing the existing CQHCI crypto register space even when CQE functionality is not available due to card limitations. The implementation: - Adds ICE register definitions for non-CQE crypto configuration - Implements per-request crypto setup via sdhci_msm_ice_cfg() - Hooks into the request path via mmc_host_ops.request for non-CQE requests - Uses CQHCI register space (NONCQ_CRYPTO_PARM/DUN) for crypto configuration With this, CQE-capable controllers can benefit from inline encryption when paired with non-CQE cards, improving performance for encrypted I/O while maintaining compatibility with existing CQE crypto support. Signed-off-by: Md Sadre Alam Acked-by: Adrian Hunter Acked-by: Eric Biggers Signed-off-by: Ulf Hansson commit 541fe77cc4d77799ac1b869e2183e1bdd716a1f2 Author: Shawn Lin Date: Wed Nov 26 08:14:42 2025 +0800 mmc: dw_mmc: add dw_mci_prepare_desc() for both of 32bit and 64bit DMA dw_mci_prepare_desc64() and dw_mci_prepare_desc32() duplicate a lot of code, add a new dw_mci_prepare_desc() to save the bits. No functional change intended. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aUJatHzP5fr1zvRF@stanley.mountain Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 40dfdd8d1449382cae3db2cefb1f5521ce19259b Author: Shawn Lin Date: Wed Nov 26 08:14:41 2025 +0800 mmc: dw_mmc: Remove unused struct dma_pdata None of the variant drivers pass in dma_pdata, which means it's unused and could be removed. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 82d58440cd72dd4bf719e50eddfb9c4ef50f2deb Author: Irving-CH Lin Date: Mon Feb 2 14:48:13 2026 +0800 dt-bindings: power: Add MediaTek MT8189 power domain Add dt schema and IDs for the power domain of MediaTek MT8189 SoC. The MT8189 power domain IP provide power domains control function for subsys (eg. MFG, audio, venc/vdec ...). Signed-off-by: Irving-CH Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Ulf Hansson commit 3cdac25e80a23ca107189b55deaadf0a49bab44b Author: AngeloGioacchino Del Regno Date: Tue Jan 13 12:00:09 2026 +0100 dt-bindings: power: mt7622-power: Add MT7622_POWER_DOMAIN_AUDIO Add the missing power domain for the Audio IPs in this SoC. Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Ulf Hansson commit 425fec07d42954a7eb4d0694dc33be4991d67420 Author: Nicolas Frattaroli Date: Sat Dec 20 19:49:53 2025 +0100 dt-bindings: power: mt8196-gpufreq: Describe nvmem provider ability On the MediaTek MT8196 SoC, the Mali GPU's "shader_present" hardware register may also include a non-functional shader core, along with the present shader cores. An efuse elsewhere in the SoC provides the shader_present mask with the fused off core omitted. However, the efuse address is not publicly disclosed. What is known though is that the GPUEB MCU reads this efuse, and exposes its contents in the memory it shares with the application processor. We can therefore describe the mediatek,mt8196-gpufreq device as being an nvmem provider for this purpose, as it does provide nvmem access in an indirect way. The shader-present child node is left out of the list of required properties as we may one day be able to describe the actual efuse region this value comes from, so the gpufreq device isn't necessarily the only device that can provide this cell, and implementations shouldn't need to implement this functionality once this is the case. Reviewed-by: Rob Herring (Arm) Signed-off-by: Nicolas Frattaroli Signed-off-by: Ulf Hansson commit d28cb72e07b21acb90204be201966b9e92eca75a Author: Karel Balej Date: Sat Dec 13 09:48:12 2025 +0100 dt-bindings: power: define ID for Marvell PXA1908 audio domain Define an identifier for the SoC's audio power island so that it can be referenced through device tree. Acked-by: Krzysztof Kozlowski Reviewed-by: Duje Mihanović Signed-off-by: Karel Balej Signed-off-by: Ulf Hansson commit 8b85987d3cf50178f67618122d9f3bb202f62f42 Merge: a480f5c6f5fa14 6de23f81a5e08b Author: Maxime Ripard Date: Mon Feb 23 11:48:20 2026 +0100 Merge drm/drm-next into drm-misc-next Let's merge 7.0-rc1 to start the new drm-misc-next window Signed-off-by: Maxime Ripard commit 50214dc4382055352fb1d7b9779550dabf5059e5 Author: Davidlohr Bueso Date: Tue Feb 17 11:15:12 2026 -0800 locking/mutex: Add killable flavor to guard definitions The mutex guard family defines _try and _intr variants but is missing the killable one. Signed-off-by: Davidlohr Bueso Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260217191512.1180151-4-dave@stgolabs.net commit babcde3be8c9148aa60a14b17831e8f249854963 Author: Davidlohr Bueso Date: Tue Feb 17 11:15:11 2026 -0800 locking/mutex: Fix wrong comment for CONFIG_DEBUG_LOCK_ALLOC ... that endif block should be CONFIG_DEBUG_LOCK_ALLOC, not CONFIG_LOCKDEP. Fixes: 51d7a054521d ("locking/mutex: Redo __mutex_init() to reduce generated code size") Signed-off-by: Davidlohr Bueso Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260217191512.1180151-3-dave@stgolabs.net commit 8b65eb52d93e4e496bd26e6867152344554eb39e Author: Davidlohr Bueso Date: Tue Feb 17 11:15:10 2026 -0800 locking/mutex: Rename mutex_init_lockep() Typo, this wants to be _lockdep(). Fixes: 51d7a054521d ("locking/mutex: Redo __mutex_init() to reduce generated code size") Signed-off-by: Davidlohr Bueso Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260217191512.1180151-2-dave@stgolabs.net commit 38e8cc1c79385c6317f3416519d8beff481c175b Author: Linus Walleij Date: Tue Feb 10 17:02:29 2026 +0100 pinctrl: Fix spelling problem The grammar is off. This fixes it. Fixes: 6e4f3db8dfcf ("pinctrl: just return if no valid maps") Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit e8fc8588d06cf46cd7df622886e5a4be57442b65 Author: Thorsten Blum Date: Sun Feb 22 18:03:27 2026 +0100 gpiolib: replace snprintf("%s") with strscpy Replace snprintf("%s", ...) with strscpy() for direct string copying. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260222170327.281576-2-thorsten.blum@linux.dev Signed-off-by: Bartosz Golaszewski commit 0acbe817c37344f10cb413663be494ad66bf40bc Author: Andy Shevchenko Date: Thu Feb 19 14:46:47 2026 +0100 gpio: ts4800: Remove duplicate code to handle 'ngpios' property The gpio_generic_chip_init() handles the 'ngpios' property and assigns the respective field in struct gpio_chip either with the value of it, or, if not found, with the default based on the register size. There is no need to repeat this in the driver. Signed-off-by: Andy Shevchenko Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260219134647.2258593-1-andriy.shevchenko@linux.intel.com Signed-off-by: Bartosz Golaszewski commit c08381ad56a9cc111f893b2b21400ceb468cc698 Author: Dmitry Torokhov Date: Wed Feb 18 11:06:56 2026 -0800 gpio: viperboard: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by vprbrd_gpiob_get() in the output case is normalized to the [0, 1] range. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260218190657.2974723-7-dmitry.torokhov@gmail.com Signed-off-by: Bartosz Golaszewski commit 9eb7ecfd20f868421e44701274896ba9e136daae Author: Dmitry Torokhov Date: Wed Feb 18 11:06:55 2026 -0800 gpio: tps65086: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by tps65086_gpio_get() is normalized to the [0, 1] range. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260218190657.2974723-6-dmitry.torokhov@gmail.com Signed-off-by: Bartosz Golaszewski commit e62b94a690c8cd7050c3d308e01ee1b24ee9bb0b Author: Dmitry Torokhov Date: Wed Feb 18 11:06:54 2026 -0800 gpio: stp-xway: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by xway_stp_get() is normalized to the [0, 1] range. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260218190657.2974723-5-dmitry.torokhov@gmail.com Signed-off-by: Bartosz Golaszewski commit 5a32ebabb6819fafce99e7bc6575ca568af6d22a Author: Dmitry Torokhov Date: Wed Feb 18 11:06:53 2026 -0800 gpio: lp873x: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by lp873x_gpio_get() is normalized to the [0, 1] range. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260218190657.2974723-4-dmitry.torokhov@gmail.com Signed-off-by: Bartosz Golaszewski commit 4d720b0d68e9a251d60804eace42aac800d7a79f Author: Dmitry Torokhov Date: Wed Feb 18 11:06:52 2026 -0800 gpio: da9055: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by da9055_gpio_get() is normalized to the [0, 1] range. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260218190657.2974723-3-dmitry.torokhov@gmail.com Signed-off-by: Bartosz Golaszewski commit 49621f1c97788216f2f10f1a9e903f216e289f5d Author: Dmitry Torokhov Date: Wed Feb 18 11:06:51 2026 -0800 gpio: cgbc: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by cgbc_gpio_get() is normalized to the [0, 1] range. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260218190657.2974723-2-dmitry.torokhov@gmail.com Signed-off-by: Bartosz Golaszewski commit c43778680546dd379b3d8219c177b1a34ba87002 Author: Dmitry Torokhov Date: Wed Feb 18 11:06:50 2026 -0800 gpio: bd9571mwv: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by bd9571mwv_gpio_get() is normalized to the [0, 1] range. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/20260218190657.2974723-1-dmitry.torokhov@gmail.com Signed-off-by: Bartosz Golaszewski commit 2c299030c6813eaa9ef95773c64d65c50fa706ac Author: Prathamesh Shete Date: Tue Feb 17 08:14:31 2026 +0000 gpio: tegra186: Support multi-socket devices On Tegra platforms, multiple SoC instances may be present with each defining the same GPIO name. For such devices, this results in duplicate GPIO names. When the device has a valid NUMA node, prepend the NUMA node ID to the GPIO name prefix. The node ID identifies each socket, ensuring GPIO line names remain distinct across multiple sockets. Signed-off-by: Prathamesh Shete Acked-by: Thierry Reding Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260217081431.1208351-2-pshete@nvidia.com Signed-off-by: Bartosz Golaszewski commit 2423e336d94868f0d2fcd81a87b90c5ea59736e0 Author: Prathamesh Shete Date: Tue Feb 17 08:14:30 2026 +0000 gpio: tegra186: Simplify GPIO line name prefix handling Introduce TEGRA_GPIO_PREFIX() to define the Tegra SoC GPIO name prefix in one place. Use it for the Tegra410 COMPUTE and SYSTEM controllers so the prefix is "COMPUTE-" and "SYSTEM-" respectively. Signed-off-by: Prathamesh Shete Acked-by: Thierry Reding Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260217081431.1208351-1-pshete@nvidia.com Signed-off-by: Bartosz Golaszewski commit 96c02c906a44bc280ef26e343126dd3349d8cae9 Author: Kent Gibson Date: Mon Feb 16 20:37:09 2026 +0800 gpio: cdev: convert lineevent_create() and linereq_create() to FD_PREPARE() linehandle_create() was recently converted to use FD_PREPARE() to simplify fd creation and cleanup logic. Apply the equivalent conversion to lineevent_create() and linereq_create(). Signed-off-by: Kent Gibson Link: https://patch.msgid.link/20260216123709.281444-1-warthog618@gmail.com Signed-off-by: Bartosz Golaszewski commit 2c46f19c9adf7634d1eb4ce89a715ca3b0374134 Author: Doug Berger Date: Wed Feb 4 08:43:33 2026 -0800 gpio: brcmstb: allow parent_irq to wake The classic parent_wake_irq can only occur after the system has been placed into a hardware managed power management state. This prevents its use for waking from software managed suspend states like s2idle. By allowing the parent_irq to be enabled for wake enabled GPIO during suspend, these GPIO can now be used to wake from these states. The 'suspended' boolean is introduced to support wake event accounting. Signed-off-by: Doug Berger [florian: port changes after generic gpio chip conversion] Signed-off-by: Florian Fainelli Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260204164333.1146039-4-florian.fainelli@broadcom.com Signed-off-by: Bartosz Golaszewski commit 66ff5094240e6e5cea743f5e656e28734de31f1e Author: Doug Berger Date: Wed Feb 4 08:43:32 2026 -0800 gpio: brcmstb: implement .irq_mask_ack() The .irq_mask_ack() operation is slightly more efficient than doing .irq_mask() and .irq_ack() separately. More importantly for this driver it bypasses the check of irqd_irq_masked ensuring a previously masked but still active interrupt gets remasked if unmasked at the hardware level. This allows the driver to more efficiently unmask the wake capable interrupts when quiescing without needing to enable the irqs individually to clear the irqd_irq_masked state. Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Signed-off-by: Doug Berger Co-developed-by: Florian Fainelli Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20260204164333.1146039-3-florian.fainelli@broadcom.com Signed-off-by: Bartosz Golaszewski commit 5711ae6de0646dcf5bf90cc9d4d7cacd34896472 Author: Florian Fainelli Date: Wed Feb 4 08:43:31 2026 -0800 gpio: brcmstb: Utilize irqd_to_hwirq(d) instead of d->hwirq Consistently use irqd_to_hwirq(d) which is the recommended helper to fetch the hardware IRQ number from an irq_data structure. While at it, update the brcmstb_gpio_set_imask() function signature to use the proper type for the "hwirq" argument rather than "unsigned int". Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20260204164333.1146039-2-florian.fainelli@broadcom.com Signed-off-by: Bartosz Golaszewski commit 1c5986eefde922cccaa9f74567ddf4cf468d8400 Author: Mohammad Rafi Shaik Date: Mon Feb 9 19:15:29 2026 +0530 dt-bindings: pinctrl: qcom,sm8450-lpass-lpi-pinctrl: Add SA8775P and QCS8300 pinctrl Document compatible for Qualcomm SA8775P and QCS8300 SoC LPASS TLMM pin controller, fully compatible with previous SM8450 generation (same amount of pins and functions). Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit 6d3ea3120eaa51432c1788b0a48cfab3ab77d697 Author: Fabio Estevam Date: Sat Feb 7 10:06:42 2026 -0300 pinctrl: rockchip: Add RV1103B pinctrl support Add pinctrl support for the RV1103B. Based on the 5.10 Rockchip vendor kernel driver. Signed-off-by: Fabio Estevam Signed-off-by: Linus Walleij commit 540e666a7662dc570f0eca451f75ba3cc31445bb Author: Fabio Estevam Date: Sat Feb 7 10:06:41 2026 -0300 dt-bindings: pinctrl: rockchip: Add RV1103B compatible Document the compatible string for the RV1103B SoC. Signed-off-by: Fabio Estevam Acked-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit a480f5c6f5fa14c954aa8c462302d34223947510 Author: Luca Ceresoli Date: Sat Jan 31 16:58:36 2026 +0100 drm/mcde: dsi: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done. We need to handle the two cases: when a panel is found and when it isn't, even though the latter is not supported. So: * in case a panel is not found and bridge is, get a reference to the found bridge * in case a panel is found, get a reference to the panel_bridge when it is added, so the following code always get exactly one reference that it needs to put Finally, use the next_bridge pointer in struct drm_bridge in order to simplify putting the reference. Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260131-drm-bridge-alloc-getput-drm_of_find_bridge-4-v2-4-e081bcdc1467@bootlin.com Signed-off-by: Luca Ceresoli commit fe0b1b8269eba268a7dee293b32d6c008a6c3fec Author: Luca Ceresoli Date: Sat Jan 31 16:58:35 2026 +0100 drm/mcde: dsi: mcde_dsi_bind: break when a panel or bridge is found mcde_dsi_bind() has a loop over all subnodes looking for a panel, but does not exit when a match is found and only stores the last match. However this will be problematic when introducing refcounting on the struct drm_device pointer in a following commit, because of_drm_find_and_get_bridge() would get a reference to multiple bridges. There seem to be no real reason for looking for multiple panels, so just break as soon as a match is found. Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260131-drm-bridge-alloc-getput-drm_of_find_bridge-4-v2-3-e081bcdc1467@bootlin.com Signed-off-by: Luca Ceresoli commit 08eea726f4a30dc7e3ee4bf76a1497c54948ff51 Author: Gabriel Almeida Date: Tue Feb 17 11:31:57 2026 -0300 iio: light: zopt2201: use lock guards Use guard() and scoped_guard() to handle the mutex lock instead of manually locking and unlocking it. Signed-off-by: Gabriel Almeida Signed-off-by: Jonathan Cameron commit f808d21ef7d5a93f14c3465a3268c46474cf04b8 Author: Gabriel Almeida Date: Tue Feb 17 11:31:56 2026 -0300 iio: light: zopt2201: Reorder header includes Reorder the header includes to follow the usual kernel ordering conventions and improve readability. Signed-off-by: Gabriel Almeida Signed-off-by: Jonathan Cameron commit 1261aea929a95097d05c9fc4fa9f9419720c64a8 Author: Pranav Kharche Date: Wed Feb 18 09:25:49 2026 +0530 dt-bindings: iio: dac: Fix typo in ti,dac7612.yaml Fix a typo in the description where "Is is" should be "It is". Signed-off-by: Pranav Kharche Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit 419a96f82474e7b1657c6086ef692379315bffc5 Author: Antoniu Miclaus Date: Mon Feb 16 17:11:11 2026 +0200 iio: adc: ad4080: add support for AD4082, AD4085 and AD4088 Add support for the AD4082, AD4085 and AD4088 SAR ADCs. These devices share the same resolution as their base variants but differ in LVDS CNV clock count maximum: - AD4082 (20-bit, like AD4080): lvds_cnv_clk_cnt_max 8 vs 7 - AD4085 (16-bit, like AD4084): lvds_cnv_clk_cnt_max 8 vs 2 - AD4088 (14-bit, like AD4087): lvds_cnv_clk_cnt_max 8 vs 1 Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 6cfb965afed9b63b4614897ef9aac92ce1419c29 Author: Antoniu Miclaus Date: Mon Feb 16 17:11:10 2026 +0200 dt-bindings: iio: adc: adi,ad4080: add support for AD4082, AD4085 and AD4088 Add device tree binding support for AD4082, AD4085 and AD4088 SAR ADCs. Add adi,ad4082, adi,ad4085 and adi,ad4088 to the compatible enum. A fallback compatible string is not appropriate for these devices as they differ in LVDS CNV clock count maximum from their base variants: - AD4082 (20-bit) vs AD4080: lvds_cnv_clk_cnt_max 8 vs 7 - AD4085 (16-bit) vs AD4084: lvds_cnv_clk_cnt_max 8 vs 2 - AD4088 (14-bit) vs AD4087: lvds_cnv_clk_cnt_max 8 vs 1 Acked-by: Conor Dooley Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit a10f6dd4eef2e64fe1f366613bed45aa308494de Author: Marcelo Schmitt Date: Mon Feb 16 12:00:22 2026 -0300 iio: adc: ad4030: Use BIT macro to improve code readability Use BIT macro to make the list of average modes more readable. Suggested-by: Andy Shevchenko Reviewed-by: Nuno Sá Acked-by: Andy Shevchenko Signed-off-by: Marcelo Schmitt Signed-off-by: Jonathan Cameron commit 34773346827bcaa685be325946fd7bdf6f32bda2 Author: Marcelo Schmitt Date: Mon Feb 16 11:59:10 2026 -0300 dt-bindings: iio: adc: adi,ad4030: Reference spi-peripheral-props AD4030 and similar devices all connect to the system as SPI peripherals. Reference spi-peripheral-props so common SPI peripheral can be used from ad4030 dt-binding. Acked-by: Conor Dooley Signed-off-by: Marcelo Schmitt Signed-off-by: Jonathan Cameron commit 65d887ff21057dede1684c176e910991700a8bd0 Author: Antoniu Miclaus Date: Mon Feb 16 15:17:05 2026 +0200 iio: dac: max5522: simplify probe with devm_regulator_get_enable_read_voltage() Simplify probe by using devm_regulator_get_enable_read_voltage() to get, enable and read the regulator voltage in a single call, caching the value at probe time. The reference voltage for this DAC is a fixed hardware configuration that is not expected to change at runtime, so reading it once during probe and caching the millivolt value is sufficient. Reviewed-by: Andy Shevchenko Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 93f60f67215e09d281fb0b22d29cb33ff033db61 Author: Antoniu Miclaus Date: Mon Feb 16 15:17:04 2026 +0200 iio: magnetometer: si7210: simplify probe with devm_regulator_get_enable_read_voltage() Simplify probe by using devm_regulator_get_enable_read_voltage() to get, enable and read the regulator voltage in a single call, caching the value at probe time. This is a functional change as VDD voltage is now read once at probe rather than dynamically on each temperature measurement. However, in real deployments it is very rare for VDD to change after initial probe. Reviewed-by: Andy Shevchenko Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 0309e66abea141f3ec339b064b8f8b8003d2a634 Author: Andy Shevchenko Date: Tue Feb 17 09:05:14 2026 +0100 iio: adc: ad7192: Revert "properly check spi_get_device_match_data()" This reverts commit b7f99fa1b64af2f696b13cec581cb4cd7d3982b8. The added code is currently a dead code. Moreover, the driver is not designed to have any defaults effectively making driver data a mandatory information to work with. Taking all together, revert unneeded change. Discussion at #1 concluded in agreeing a new policy on this for IIO. Link: https://lore.kernel.org/linux-iio/20260217080514.1288115-1-andriy.shevchenko@linux.intel.com/ #1 Reported-by: Harshit Mogalapalli Signed-off-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit d6ae9f202f616527f0d9a3a3fe980d36ec332707 Author: Harshit Mogalapalli Date: Mon Feb 16 02:24:48 2026 -0800 iio: sca3000: simplify with spi_get_device_match_data() Refactor each sca3000 variant with it's own chip_info struct, update the sca3000_probe() to use spi_get_device_match_data(). Suggested-by: David Lechner Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Harshit Mogalapalli Signed-off-by: Jonathan Cameron commit 094d5d37d385ed99461883da013995ac2586dae0 Author: Neel Bullywon Date: Sun Feb 15 20:54:54 2026 -0500 iio: magnetometer: bmc150_magn: minor formatting cleanup Improve initializer list style for bmc150_magn_samp_freq_table by moving the opening brace to its own line and using one entry per line with proper indentation and spaces inside braces. Add spaces inside braces for initializer lists in the preset table for consistency. Fix indentation of bmc150_magn_scan_masks array. No functional changes. Signed-off-by: Neel Bullywon Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit d1fa7b316b9fc8f11f8158b1beda9150165a377c Author: Neel Bullywon Date: Sun Feb 15 20:54:53 2026 -0500 iio: magnetometer: bmc150_magn: replace msleep with fsleep Replace msleep(5) with fsleep(5 * USEC_PER_MSEC) to allow the kernel to select the most appropriate delay mechanism based on duration. Using USEC_PER_MSEC makes the unit conversion explicit. Signed-off-by: Neel Bullywon Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit e3310a32e0573ade05ae09521b17c1463753e872 Author: Erikas Bitovtas Date: Tue Feb 17 14:13:16 2026 +0200 iio: light: vcnl4000: add support for Capella CM36686 and CM36672P Add support for Capella's CM36686 and CM36672P sensors. Capella CM36686 is an ambient light and proximity sensor that is fully compatible with VCNL4040 and can be used as is. CM36672P is partially compatible with VCNL4040 - it uses the same register fields for proximity sensing, but the ambient light registers are reserved. For CM36672P, we reuse vcnl4040_channels, but remove the IIO_LIGHT channel and ambient light integration time. Reviewed-by: Andy Shevchenko Signed-off-by: Erikas Bitovtas Signed-off-by: Jonathan Cameron commit f48bfc823c13eb2a8f0e32229d3ca32d849ff876 Author: Erikas Bitovtas Date: Tue Feb 17 14:13:15 2026 +0200 dt-bindings: iio: light: vcnl4000: add Capella CM36686 and CM36672P Capella CM36686 is an ambient light and proximity sensor developed by Capella Microsystems, now a subsidiary of Vishay Intertechnology Inc. It has an I2C address of 0x60 and is fully compatible with an existing driver for VCNL4040. Capella CM36672P is a proximity-only sensor that is partially compatible with CM36686 - they share the same register fields for proximity sensing, but ambient light sensor register fields in CM36672P are reserved. Add compatibles for cm36672p and cm36686, with a fallback for cm36686 of vcnl4040. Signed-off-by: Erikas Bitovtas Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit 196c9df178652732ceab85b743997a4ab9e8cc82 Author: David Lechner Date: Fri Jan 23 14:37:32 2026 -0600 iio: adc: ad7380: add support for multiple SPI lanes Add support for multiple SPI lanes to increase throughput. The AD7380 family of ADCs have multiple SDO lines on the chip that can be used to read each channel on a separate SPI lane. If wired up to a SPI controller that supports it, the driver will now take advantage of this feature. This allows reaching the maximum sample rate advertised in the datasheet when combined with SPI offloading. Reviewed-by: Nuno Sá Reviewed-by: Marcelo Schmitt Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron commit 63670c90f02b3732c49c2b1fee8f5dffd2dc8eb7 Author: David Lechner Date: Fri Jan 23 14:37:31 2026 -0600 dt-bindings: iio: adc: adi,ad7380: add spi-rx-bus-width property Add spi-rx-bus-width property to describe how many SDO lines are wired up on the ADC. These chips are simultaneous sampling ADCs and have one SDO line per channel, either 2 or 4 total depending on the part number. Reviewed-by: Rob Herring (Arm) Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron commit 5cf5654b1975d76dbd2e5696a8a8e81c601e0744 Author: Ethan Tidmore Date: Fri Feb 13 18:53:32 2026 -0600 iio: adc: ad4062: Add missing IS_ERR() check In the function ad4062_sizeof_storagebits() iio_get_current_scan_type() is called which can return an error pointer and is not checked for it. Also the function ad4062_sizeof_storagebits() returns type size_t but, is only used once and the variable assigned from it is type u8. Add check for error pointer in ad4062_sizeof_storagebits() and change return type to int so the error code can be properly propagated and then checked. Fixes: 23cc92280302d ("iio: adc: ad4062: Add IIO Trigger support") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202512280539.AholFF7m-lkp@intel.com/ Signed-off-by: Ethan Tidmore Reviewed-by: Jorge Marques Signed-off-by: Jonathan Cameron commit bc2cb23607eb0ff99a67e260ec33d01c6e6f1290 Author: Antoniu Miclaus Date: Wed Feb 11 19:10:06 2026 +0200 iio: frequency: adf4350: Return -ENOMEM on memory allocation failure adf4350_parse_dt() returns NULL only when devm_kzalloc() fails. The caller should return -ENOMEM in this case, not -EINVAL. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 25ac1dea217f328ea71f8f09bfb290534de3cbce Author: Antoniu Miclaus Date: Wed Feb 11 19:10:05 2026 +0200 iio: adc: pac1934: Return -ENOMEM on memory allocation failure devm_kzalloc() returns NULL on allocation failure. The appropriate error code for this condition is -ENOMEM, not -EINVAL. Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 8e901c49ffc8d59adabae4020724f96770d35db7 Author: Yasin Lee Date: Fri Feb 13 23:14:46 2026 +0800 iio: proximity: hx9023s: support firmware-name property Add an optional firmware-name property to specify the firmware file. If not provided, the driver falls back to the default firmware name. Reviewed-by: Andy Shevchenko Signed-off-by: Yasin Lee Signed-off-by: Jonathan Cameron commit 577fe2fdd42fb16cacb1178cb94a42dd7c595914 Author: Yasin Lee Date: Fri Feb 13 23:14:45 2026 +0800 dt-bindings: iio: proximity: hx9023s: support firmware-name property The hx9023s requires a firmware blob containing board-specific configuration data used to initialize its internal sensing engine. Although the silicon is identical across platforms, different products may use different electrode layouts, PCB routing, cover materials and mechanical stack-ups. These physical differences require distinct calibration parameters and register configuration tables in order for the sensor to operate correctly. The driver has always required firmware and historically assumed a single default firmware file name suitable for the reference design. However, this assumption does not hold for boards with different physical sensor layouts. The default firmware file name remains unchanged and continues to be used for existing platforms. Allowing the firmware file name to be specified via device tree enables selecting the appropriate hardware-specific configuration when the board design differs. This property does not change the existing ABI and is optional. Signed-off-by: Yasin Lee Acked-by: Krzysztof Kozlowski Signed-off-by: Jonathan Cameron commit 2e47110413d94cde2282f46112f3035237ace249 Author: Tomas Melin Date: Tue Feb 10 10:53:39 2026 +0000 iio: adc: ad9467: check for backend capabilities Add capability checks for operation with backends that do not necessarily support full set of features, but are otherwise compatible with the device. This ensures a fully functional device, but with limited capabilities. Reviewed-by: Nuno Sá Reviewed-by: David Lechner Signed-off-by: Tomas Melin Signed-off-by: Jonathan Cameron commit 89443dc7843c22411f7bdeffa513e4dc709c7ba2 Author: Tomas Melin Date: Tue Feb 10 10:53:38 2026 +0000 iio: adc: ad9467: simplify device pointer in probe Create alias for the device pointer to simplify referencing and keeping syntax and column width shorter. Suggested-by: Andy Shevchenko Signed-off-by: Tomas Melin Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron commit 519ecb5f100193dd79de2760dd7296688b2484b4 Author: Tomas Melin Date: Tue Feb 10 10:53:37 2026 +0000 iio: adc: sd_adc_modulator: define supported iio-backend capabilities This backend supports the added CAP_ENABLE capability. Reviewed-by: Nuno Sá Reviewed-by: David Lechner Signed-off-by: Tomas Melin Signed-off-by: Jonathan Cameron commit 9db3e8ddca3d84cc46e12344c38cf17f4f8744e8 Author: Tomas Melin Date: Tue Feb 10 10:53:36 2026 +0000 iio: dac: adi-axi-dac: define supported iio-backend capabilities Backends support the buffer/enable capabilities so advertise it while registering in case a frontend makes checks for it. Reviewed-by: Nuno Sá Reviewed-by: David Lechner Signed-off-by: Tomas Melin Signed-off-by: Jonathan Cameron commit ed3be723b0ed3e8e35ee1b9ab14a94cc5630ff02 Author: Tomas Melin Date: Tue Feb 10 10:53:35 2026 +0000 iio: adc: adi-axi-adc: define supported iio-backend capabilities axi-adc and axi-ad485x backend variants provide calibration support, whereas the axi-ad408x does not. Set accordingly. Reviewed-by: Nuno Sá Reviewed-by: David Lechner Signed-off-by: Tomas Melin Signed-off-by: Jonathan Cameron commit 88440208c6074e639a7ccc038c6a7ed4b6f8bb99 Author: Tomas Melin Date: Tue Feb 10 10:53:34 2026 +0000 iio: industrialio-backend: support backend capabilities Not all backends support the full set of capabilities provided by the industrialio-backend framework. Capability bits can be used in frontends and backends for checking for a certain feature set, or if using related functions can be expected to fail. Capability bits should be set by a compatible backend and provided when registering the backend. Reviewed-by: Nuno Sá Reviewed-by: David Lechner Signed-off-by: Tomas Melin Signed-off-by: Jonathan Cameron commit 286386820d524a76647b8a1de9e4122270da6975 Author: Gwendal Grignou Date: Tue Feb 3 19:50:36 2026 -0800 platform/chrome: lightbar: Optimize command size Enabling tracing with: echo 1 > /sys/kernel/debug/tracing/events/cros_ec/cros_ec_request_start/enable To monitor the command and response size. The defaults are 194 and 128 respectively: cros_ec_request_start: version: 0, offset: 0, command: EC_CMD_LIGHTBAR_CMD, outsize: 194, insize: 128 Reduce the sizes to the expected subcommands. Signed-off-by: Gwendal Grignou Link: https://lore.kernel.org/r/20260204035036.697955-1-gwendal@google.com Signed-off-by: Tzung-Bi Shih commit 8167d7f674648cfd428ed49773522f9df5c4fdfd Author: Randy Dunlap Date: Sun Feb 15 21:44:18 2026 -0800 soundwire: sdw.h: repair names and format of kernel-doc comments Fix all kernel-doc warnings in sdw.h: Warning: include/linux/soundwire/sdw.h:538 cannot understand function prototype: 'enum sdw_reg_bank' Warning: include/linux/soundwire/sdw.h:779 struct member 'port_num' not described in 'sdw_transport_params' Warning: include/linux/soundwire/sdw.h:792 struct member 'port_num' not described in 'sdw_enable_ch' Warning: include/linux/soundwire/sdw.h:892 cannot understand function prototype: 'struct sdw_port_config' Warning: include/linux/soundwire/sdw.h:906 cannot understand function prototype: 'struct sdw_stream_config' Warning: include/linux/soundwire/sdw.h:925 cannot understand function prototype: 'enum sdw_stream_state' Warning: include/linux/soundwire/sdw.h:942 cannot understand function prototype: 'struct sdw_stream_params' Warning: include/linux/soundwire/sdw.h:960 cannot understand function prototype: 'struct sdw_stream_runtime' Warning: include/linux/soundwire/sdw.h:1047 struct member 'bpt_stream_refcount' not described in 'sdw_bus' Signed-off-by: Randy Dunlap Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260216054418.2766846-1-rdunlap@infradead.org Signed-off-by: Vinod Koul commit df8c7892e06efa5df2aa780a338f33a4f666370b Author: Sanjay Yadav Date: Thu Feb 12 14:55:30 2026 +0530 drm/buddy: Move internal helpers to buddy.c Move gpu_buddy_block_state(), gpu_buddy_block_is_allocated(), and gpu_buddy_block_is_split() from gpu_buddy.h to gpu_buddy.c as static functions since they have no external callers. Remove gpu_get_buddy() as it was an unused exported wrapper around the internal __get_buddy(). No functional changes. v2: - Rebased after DRM buddy allocator moved to drivers/gpu/ - Keep gpu_buddy_block_is_free() in header since it's now used by drm_buddy.c - Updated commit message Cc: Christian König Cc: Arunpravin Paneer Selvam Suggested-by: Matthew Auld Signed-off-by: Sanjay Yadav Reviewed-by: Arunpravin Paneer Selvam Signed-off-by: Arunpravin Paneer Selvam Link: https://patch.msgid.link/20260212092527.718455-6-sanjay.kumar.yadav@intel.com commit 5cab6d386bd30c3bb4efceb05b25842a6f144693 Author: Sanjay Yadav Date: Thu Feb 12 14:55:29 2026 +0530 drm/buddy: Add kernel-doc for allocator structures and flags Add missing kernel-doc for GPU buddy allocator flags, gpu_buddy_block, and gpu_buddy. The documentation covers block header fields, allocator roots, free trees, and allocation flags such as RANGE, TOPDOWN, CONTIGUOUS, CLEAR, and TRIM_DISABLE. Private members are marked with kernel-doc private markers and documented with regular comments. No functional changes. v2: - Corrected GPU_BUDDY_CLEAR_TREE and GPU_BUDDY_DIRTY_TREE index values (Arun) - Rebased after DRM buddy allocator moved to drivers/gpu/ - Updated commit message v3: - Document reserved bits 8:6 in header layout (Arun) - Fix checkpatch warning Cc: Christian König Cc: Arunpravin Paneer Selvam Suggested-by: Matthew Auld Signed-off-by: Sanjay Yadav Reviewed-by: Arunpravin Paneer Selvam Signed-off-by: Arunpravin Paneer Selvam Link: https://patch.msgid.link/20260212092527.718455-5-sanjay.kumar.yadav@intel.com commit 3d2398f44a2d48fb1c575a6e0bc6b38f3e689e22 Author: Viresh Kumar Date: Mon Feb 23 11:05:59 2026 +0530 OPP: Move break out of scoped_guard in dev_pm_opp_xlate_required_opp() The commit ff9c512041f2 ("OPP: Use mutex locking guards") unintentionally made the for loop run longer than required. scoped_guard() is implemented as a for loop. The break statement now breaks out out the scoped_guard() and not out of the outer for loop. The outer loop always iterates to completion. Fix it. Fixes: ff9c512041f2 ("OPP: Use mutex locking guards") Reported-by: David Lechner Signed-off-by: Viresh Kumar commit e560083c0467f86b72aecac377b27bd1e7d16c49 Author: Manivannan Sadhasivam Date: Fri Jan 30 12:49:40 2026 +0530 OPP: debugfs: Use performance level if available to distinguish between rates Some OPP tables have entries with same rate and different performance level. For these entries, using only the rate as the debugfs directory name causes below error: debugfs: 'opp:5000000' already exists in 'soc@0-1c00000.pci' Fix it by appending the performance level to the dir name if available. Reported-by: Bjorn Andersson Closes: https://lore.kernel.org/linux-arm-msm/75lzykd37zdvrks5i2bb4zb2yzjtm25kv3hegmikndkbr772mz@w2ykff3ny45u/ Fixes: 05db35963eef ("OPP: Add support to find OPP for a set of keys") Signed-off-by: Manivannan Sadhasivam Signed-off-by: Viresh Kumar commit de716275941af60247967887be3303e144ed57d7 Author: Thorsten Blum Date: Mon Feb 23 01:03:04 2026 +0100 Input: adxl34x - drop redundant error variable in adxl34x_i2c_probe Inline i2c_check_functionality(), which really returns a bool and not an error code, and remove the local variable. No functional changes. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260223000308.319335-1-thorsten.blum@linux.dev Signed-off-by: Dmitry Torokhov commit 76b4ec8efdc3887cdbf730da2e55881fc1a18770 Author: Dirk Chen Date: Thu Feb 19 23:44:47 2026 +0800 ARM: dts: aspeed: anacapa: Add retimer EEPROMs The Anacapa board features Atmel 24C2048 EEPROMs on i2c0 and i2c1, which are used to store retimer configurations. Add the corresponding device tree nodes to support these components. Signed-off-by: Dirk Chen Signed-off-by: Andrew Jeffery commit c2bcf62ca75c541ec4297e6ff02a68ddc2e02029 Author: Andy Shevchenko Date: Tue Feb 10 17:09:09 2026 +0100 regcache: Split regcache_count_cacheable_registers() helper The introduced helper allows to check for the non-cacheable configurations earlier during initialisation. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260210161058.53093-3-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 1fcf171178f021ef2005d47e281544624b93c5a5 Author: Andy Shevchenko Date: Tue Feb 10 17:09:08 2026 +0100 regcache: Remove duplicate check in regcache_hw_init() The regcache_hw_init() is never called without preliminary check for num_reg_defaults_raw not being 0. Thus, remove duplicate in the function. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260210161058.53093-2-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 0556bb42a84ee391a2145ddba86756f9747bc27f Author: Krzysztof Kozlowski Date: Mon Feb 16 09:58:05 2026 +0100 regulator: pf0900: Make regu_irqs variable static const File-scope 'regu_irqs' is not used outside of this unit and is not modified anywhere, so make it static const to silence sparse warning: pf0900-regulator.c:774:29: warning: symbol 'regu_irqs' was not declared. Should it be static? Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260216085804.69102-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown commit fbb4c52ccdcb4a612d2b7f800aa57090eeee16d7 Author: Guodong Xu Date: Fri Feb 6 10:32:03 2026 +0800 regulator: spacemit-p1: Update supply names Update supply names to match the P1 PMIC's actual hardware pinout where each buck has an individual VIN pin (vin1-vin6) and LDO groups have dedicated input pins (aldoin, dldoin1, dldoin2). This is an ABI change from the original "vin" and "buck5" supplies. The P1/PMIC regulator has no consumers in the DTS tree yet. For the two K1 boards in-tree (BPI-F3 and Jupiter), power settings come from boot firmware, so a probe failure has minimal impact. Signed-off-by: Guodong Xu Link: https://developer.spacemit.com/documentation?token=T1Btw2BdiiSlSXkAdibcoMetnag [1] Reviewed-by: Alex Elder Link: https://patch.msgid.link/20260206-spacemit-p1-v4-2-8f695d93811e@riscstar.com Signed-off-by: Mark Brown commit 82ffa9610ba39d3628a9bec968ddc68fe2fe6612 Author: Guodong Xu Date: Fri Feb 6 10:32:02 2026 +0800 dt-bindings: mfd: spacemit,p1: Add individual regulator supply properties Add supply properties that match the P1 PMIC's actual hardware topology where each buck converter has its own VIN pin and LDO groups share common input pins. Supply names are defined according to the pinout names in the P1 datasheet. The existing "vin-supply" is dropped from the binding document as the updated spacemit P1 driver no longer parses it. Only the per-rail names ("vin1-supply", "vin2-supply", ...) are supported. Signed-off-by: Guodong Xu Acked-by: Conor Dooley Reviewed-by: Alex Elder Link: https://patch.msgid.link/20260206-spacemit-p1-v4-1-8f695d93811e@riscstar.com Signed-off-by: Mark Brown commit d075cef4af6327a5de4bee7bf77591e3201e54f4 Author: Stefano Radaelli Date: Fri Feb 13 16:03:55 2026 +0100 ASoC: simple-card-utils: add sysclk ordering support When simple-audio-card programs sysclk for CPU and codec DAIs during hw_params, the ordering of these calls may matter on some platforms. Some CPU DAIs finalize or adjust the MCLK rate as part of their set_sysclk() callback (for example by calling clk_set_rate()). If the codec sysclk is configured before the CPU DAI applies the final MCLK rate, the codec may configure its internal clocking based on a non-final MCLK value. Such situations can arise depending on the clock provider/consumer relationship between the CPU DAI and the codec. Introduce an explicit sysclk ordering enum in simple-card-utils and use it to control the order of snd_soc_dai_set_sysclk() calls in the mclk-fs handling path. The default behaviour remains unchanged (codec-first) to avoid regressions. Signed-off-by: Stefano Radaelli Acked-by: Kuninori Morimoto Link: https://patch.msgid.link/20260213150355.442609-1-stefano.r@variscite.com Signed-off-by: Mark Brown commit 5879521cb558871472b97c4744dbe634a4286f0e Author: Sen Wang Date: Wed Feb 11 16:10:01 2026 -0600 ASoC: ti: davinci-mcasp: Add system suspend/resume support The McASP driver supports runtime PM callbacks for register save/restore during device idle, but doesn't provide system suspend/resume callbacks. This causes audio to fail to resume after system suspend. Since the driver already handles runtime suspend & resume, we can reuse existing runtime PM logics. Signed-off-by: Sen Wang Link: https://patch.msgid.link/20260211221001.155843-1-sen@ti.com Signed-off-by: Mark Brown commit 07c774dd64ba0c605dbf844132122e3edbdbea93 Author: Kuninori Morimoto Date: Thu Feb 19 04:53:52 2026 +0000 ASoC: soc-compress: use function to clear symmetric params Current soc-compress.c clears symmetric_rate, but it clears rate only, not clear other symmetric_channels/sample_bits. static int soc_compr_clean(...) { ... if (!snd_soc_dai_active(cpu_dai)) => cpu_dai->symmetric_rate = 0; if (!snd_soc_dai_active(codec_dai)) => codec_dai->symmetric_rate = 0; ... }; This feature was added when v3.7 kernel [1], and there was only symmetric_rate, no symmetric_channels/sample_bits in that timing. symmetric_channels/sample_bits were added in v3.14 [2], but I guess it didn't notice that soc-compress.c is updating symmetric_xxx. We are clearing symmetry_xxx by soc_pcm_set_dai_params(), but is soc-pcm.c local function. Makes it global function and clear symmetry_xxx by it. [1] commit 1245b7005de02 ("ASoC: add compress stream support") [2] commit 3635bf09a89cf ("ASoC: soc-pcm: add symmetry for channels and sample bits") Fixes: 3635bf09a89c ("ASoC: soc-pcm: add symmetry for channels and sample bits") Cc: Nicolin Chen Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ms15e3kv.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0fa3df83d5537c5cc3eacb9896c457f0c22791f8 Author: Tim Bird Date: Tue Feb 17 12:08:37 2026 -0700 ASoC: Add SPDX ids to many soc files Add appropriate SPDX-License-Identifier lines to the the remaining files that are missing such lines in the sound/soc directory, and in a few other miscelaneous files. Remove boilerplate license text. Signed-off-by: Tim Bird Link: https://patch.msgid.link/20260217190837.165504-1-tim.bird@sony.com Signed-off-by: Mark Brown commit f817c6a21235b503e68c50d0900d66cb1e1cf7bc Author: Pei Xiao Date: Fri Feb 20 10:56:40 2026 +0800 ASoC: rt5575: Remove redundant assignment to .owner The coccicheck tool reports the following warning for this driver: ./rt5575.c:342:3-8: No need to set .owner here. The core will do it. The manual assignment of .owner = THIS_MODULE; in the rt5575_i2c_driver struct is redundant. The i2c_add_driver() function, which is called to register the driver, automatically sets the driver's owner to THIS_MODULE. The driver core handles this assignment internally, making the explicit initialization in the struct definition unnecessary. Remove the unnecessary line. Signed-off-by: Pei Xiao Link: https://patch.msgid.link/tencent_D7DDB8B646B471AF50B541DA7AC99FBCCD0A@qq.com Signed-off-by: Mark Brown commit bf122191473e26a8f195308b1ba924c98424c8e1 Author: Yauhen Kharuzhy Date: Wed Feb 11 02:18:39 2026 +0200 ASoC: rt5677-spi: Add SPI device ID matching table To allow defining a device in board-specific drivers, add 'rt5677' as a supported SPI device ID. Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260211002255.4090440-8-jekhor@gmail.com Signed-off-by: Mark Brown commit 904e71d42505ca2af19b0031ffffefc8c1fefb48 Author: Yauhen Kharuzhy Date: Wed Feb 11 02:18:38 2026 +0200 ASoC: rt5677: Reset the codec during probing To ensure that the codec is in a known state, reset it during driver initialization. Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260211002255.4090440-7-jekhor@gmail.com Signed-off-by: Mark Brown commit 0cc00de3dd5b66c80e6ec1705ec929f4a45ffa1c Author: Yauhen Kharuzhy Date: Wed Feb 11 02:18:37 2026 +0200 ASoC: rt5677: Set up ACPI GPIO pins mapping table To get GPIO configuration from ACPI, define an ACPI GPIO mapping table, linking GPIO names with CRS entries. The only known device that has an ACPI entry for the RT5677 codec is the Lenovo Yoga Book YB1-X91, and it uses this entry to describe the entire sound system configuration: codec connections and jack detection chip connections. This ACPI definition looks YogaBook-specific, but codec GPIOs may be recognized as generic, so add this lookup table for all devices. Details about the YogaBook RT5677 ACPI entry are provided below. CRS resources: I2C devices: 0: rt5677 codec 1: ts3a227e jack detection IC GPIOs: 0: rt5677 codec reset 1: rt5677 codec pow-ldo2 2: speaker enable INTs: 0: rt5677 codec 1: ts3a227e jack detection IC SPI device: 0: rt5677 codec SPI connection ACPI decompiled dump fragment: Device (RTEK) { Name (_ADR, Zero) // _ADR: Address Name (_HID, "10EC5677") // _HID: Hardware ID Name (_CID, "10EC5677") // _CID: Compatible ID Name (_DDN, "Realtek IIS Audio Codec") // _DDN: DOS Device Name Name (_SUB, "17AA7005") // _SUB: Subsystem ID Name (_UID, One) // _UID: Unique ID Name (_PR0, Package (0x01) // _PR0: Power Resources for D0 { CLK3 }) Name (CHAN, Package (0x02) { One, 0x0124F800 }) Method (_CRS, 0, NotSerialized) // _CRS: Current Resource Settings { Name (SBUF, ResourceTemplate () { I2cSerialBusV2 (0x002C, ControllerInitiated, 0x000186A0, AddressingMode7Bit, "\\_SB.PCI0.I2C1", 0x00, ResourceConsumer, , Exclusive, ) I2cSerialBusV2 (0x003B, ControllerInitiated, 0x000186A0, AddressingMode7Bit, "\\_SB.PCI0.I2C1", 0x00, ResourceConsumer, , Exclusive, ) GpioIo (Exclusive, PullDefault, 0x0000, 0x0000, IoRestrictionOutputOnly, "\\_SB.GPO3", 0x00, ResourceConsumer, , ) { // Pin list 0x0019 } GpioIo (Exclusive, PullDefault, 0x0000, 0x0000, IoRestrictionOutputOnly, "\\_SB.GPO3", 0x00, ResourceConsumer, , ) { // Pin list 0x0012 } GpioIo (Exclusive, PullDefault, 0x0000, 0x0000, IoRestrictionOutputOnly, "\\_SB.GPO3", 0x00, ResourceConsumer, , ) { // Pin list 0x0030 } GpioInt (Edge, ActiveLow, Exclusive, PullNone, 0x0000, "\\_SB.GPO0", 0x00, ResourceConsumer, , ) { // Pin list 0x005B } GpioInt (Edge, ActiveLow, Exclusive, PullNone, 0x0000, "\\_SB.GPO0", 0x00, ResourceConsumer, , ) { // Pin list 0x004D } SpiSerialBusV2 (0x0001, PolarityLow, FourWireMode, 0x08, ControllerInitiated, 0x003D0900, ClockPolarityHigh, ClockPhaseSecond, "\\_SB.PCI0.SPI1", 0x00, ResourceConsumer, , Exclusive, ) }) Return (SBUF) /* \_SB_.PCI0.I2C1.RTEK._CRS.SBUF */ } } Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260211002255.4090440-6-jekhor@gmail.com Signed-off-by: Mark Brown commit 14848e6a8058916e9b008734aa36da989725b6df Author: Yauhen Kharuzhy Date: Wed Feb 11 02:18:36 2026 +0200 ASoC: rt5677: Report error if the ID register cannot be read To make error messages clearer, report if the ID register failed to be read via I2C during probing. Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260211002255.4090440-5-jekhor@gmail.com Signed-off-by: Mark Brown commit 687f2679e8bf65bca247ca7f4013130d609e1e56 Author: Yauhen Kharuzhy Date: Wed Feb 11 02:18:35 2026 +0200 ASoC: rt5677: Fix typo in the header file Fix a typo in the DAC1 Digital Volume register description comment (it was mistakenly named as DAC3). Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260211002255.4090440-4-jekhor@gmail.com Signed-off-by: Mark Brown commit 9f56f0bd2e49876ceeaf9036887fe9b50dfa6b6b Author: Yauhen Kharuzhy Date: Wed Feb 11 02:18:34 2026 +0200 ASoC: rt5677: Allow it to be defined as an I2C board Some devices (e.g., Lenovo Yoga Book YB1-X90) define the codec as i2c_board, so add an I2C ID table to support this. Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260211002255.4090440-3-jekhor@gmail.com Signed-off-by: Mark Brown commit f43aed8dfecb10e95b8235d002990739ebe72c5e Author: Yauhen Kharuzhy Date: Wed Feb 11 02:18:33 2026 +0200 ASoC: rt5677: Add 10EC5677 ACPI ID as supported Add 10EC5677 ACPI ID to the match table. It is used in the Lenovo Yoga Book YB1-X91 tablet at least. Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260211002255.4090440-2-jekhor@gmail.com Signed-off-by: Mark Brown commit 171b3663f33e1efdc97f5112f49be10b47b20fa8 Author: Luca Weiss Date: Wed Feb 11 11:27:34 2026 +0100 ASoC: codecs: aw88261: Add firmware-name support Since the aw88261_acf.bin file appears to be device-specific, add firmware-name support so that devicetree users can point to a device-specific path to not conflict with other devices that might also ship a aw88261_acf.bin. Read the "firmware-name" property if available, and otherwise fall back to the generic name. Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20260211-aw88261-fwname-v1-3-e24e833a019d@fairphone.com Signed-off-by: Mark Brown commit c5ad3f623103c5b606043517a63f202a22283d32 Author: Luca Weiss Date: Wed Feb 11 11:27:33 2026 +0100 ASoC: dt-bindings: awinic,aw88395: Document firmware-name property Since the aw88261_acf.bin file appears to be device-specific, add a firmware-name property so that devicetree users can point to a device-specific path to not conflict with other devices that might also ship a aw88261_acf.bin. Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260211-aw88261-fwname-v1-2-e24e833a019d@fairphone.com Signed-off-by: Mark Brown commit 78dfbd4ad0be9f51de7b9a19388809254aeccd26 Author: Mingyou Chen Date: Fri Feb 13 13:59:04 2026 +0800 ASoC: Add quirk for Lecoo Bellator N176 The Lecoo Bellator N176 requires a specific quirk to enable the DMIC support. Signed-off-by: Mingyou Chen Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20260213055904.110256-4-qby140326@gmail.com Reviewed-by: Vijendar Mukunda Signed-off-by: Mark Brown commit d3fbf61317f6ec99398661b95d1046008ee61282 Author: Mingyou Chen Date: Fri Feb 13 13:59:03 2026 +0800 ASoC: Drop RPL driver The RPL driver is no longer needed because its functionality has been superseded by the YC driver Signed-off-by: Mingyou Chen Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20260213055904.110256-3-qby140326@gmail.com Reviewed-by: Vijendar Mukunda Signed-off-by: Mark Brown commit df4148a5a3cf18ee6e13e262079130b169ee51ac Author: Mingyou Chen Date: Fri Feb 13 13:59:02 2026 +0800 ASoC: Add DMIC support for the AMD RPL platform Add RPL rev 0x62 check and reserve ACP CONFIG PIN 10 to 14 for RPL platform Signed-off-by: Mingyou Chen Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20260213055904.110256-2-qby140326@gmail.com Reviewed-by: Vijendar Mukunda Signed-off-by: Mark Brown commit 6ee3f20368a4a6198988a54c1a744cbae1354359 Author: Tomer Maimon Date: Wed Feb 18 20:48:00 2026 +0200 arm64: dts: nuvoton: drop unused syscon property from watchdog node The NPCM8XX DTSI currently includes a 'syscon' phandle in the watchdog node, but this property is not used by any upstream driver and is not documented in the NPCM watchdog binding. Since it was never reviewed and does not form part of the DT ABI, remove it. [arj: Drop 'safely' language in line with Krzysztof's commentary] Signed-off-by: Tomer Maimon Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260218184800.2261674-1-tmaimon77@gmail.com Signed-off-by: Andrew Jeffery commit c5902c06742c7fd241508c3573fb0cff0c97f33a Author: Carl Lee Date: Mon Feb 9 10:25:59 2026 +0800 ARM: dts: aspeed: anacapa: add NFC device add NFC NXP NCI device support to NFC tag reading Signed-off-by: Carl Lee Signed-off-by: Andrew Jeffery commit 633d9ef1da63e82cfb4c1e731abd6e9ade544c92 Author: Anirudh Srinivasan Date: Sun Jan 25 15:00:39 2026 -0600 ARM: dts: aspeed: Add Asrock Paul IPMI card Add device tree for Asrock Paul IPMI card, an AST2500 based PCIe BMC card. Signed-off-by: Anirudh Srinivasan Link: https://patch.msgid.link/20260125-asrock-paul-v1-2-956085a4bd06@gmail.com Signed-off-by: Andrew Jeffery commit d335425728aaafdfe1796753d5f45b306629897e Author: Anirudh Srinivasan Date: Sun Jan 25 15:00:38 2026 -0600 dt-bindings: arm: aspeed: Add Asrock Paul IPMI card Document the new comptaibles for AST2500 based Asrock Paul IPMI card Signed-off-by: Anirudh Srinivasan Acked-by: Conor Dooley Link: https://patch.msgid.link/20260125-asrock-paul-v1-1-956085a4bd06@gmail.com Signed-off-by: Andrew Jeffery commit 62f0fd7599f092f07203d7113612870fe98b60d5 Author: Marc Olberding Date: Tue Jan 20 12:34:14 2026 -0800 ARM: dts: aspeed: Add 128M alt flash layout to NVIDIA MSX4 Add a 128M layout for the BMC flash chip we didn't boot from. Including this allows the user to write to each partition on the alternate spi chip. This dtsi follows the existing standard of using the same layout as non alt version and prepending `alt` to each partition's name. [arj: Update subject, elide test demonstration] Signed-off-by: Marc Olberding Link: https://patch.msgid.link/20260120-alt-128-v4-1-0e5c491a532c@nvidia.com Signed-off-by: Andrew Jeffery commit 36c1cea299fe548a02b6d652e53908ce3ffad008 Author: Anirudh Srinivasan Date: Wed Jan 14 23:31:08 2026 -0600 ARM: dts: aspeed: Add Asus Kommando IPMI card Add device tree for Asus Kommando IPMI Expansion card, an AST2600 based PCIe BMC card. Signed-off-by: Anirudh Srinivasan Signed-off-by: Andrew Jeffery commit d3f857e397ffff932edd08da5fad2771331e803e Author: Anirudh Srinivasan Date: Wed Jan 14 23:31:07 2026 -0600 dt-bindings: arm: aspeed: Add Asus Kommando IPMI card Document the new comptaibles for AST2600 based Asus Kommando IPMI card Signed-off-by: Anirudh Srinivasan Acked-by: Krzysztof Kozlowski Signed-off-by: Andrew Jeffery commit d4851759742c1322f498021dab882d322fc34a1d Author: Brian Masney Date: Thu Jan 8 16:16:45 2026 -0500 clk: divider: remove divider_round_rate() and divider_round_rate_parent() There are no remaining users of divider_round_rate() and divider_round_rate_parent(), so let's go ahead and remove them. Signed-off-by: Brian Masney commit 4b5231d608d00749a2346a3dd11bd6d05c0662e3 Author: Brian Masney Date: Thu Jan 8 16:16:44 2026 -0500 clk: divider: remove divider_ro_round_rate_parent() There are no remaining users of divider_ro_round_rate_parent(), so let's go ahead and remove it. Signed-off-by: Brian Masney commit dc652a33cf08ecd7c9935bf9168a1a27c9a246f0 Author: Brian Masney Date: Fri Dec 12 08:41:42 2025 +0900 clk: remove round_rate() clk ops The round_rate() clk ops is deprecated, and all in tree drivers have been converted, so let's go ahead and remove any references to the round_rate() clk ops. Signed-off-by: Brian Masney commit 4ce1f19e529b16b0ec871e536e18a871cadb86cf Author: Brian Masney Date: Fri Dec 12 08:41:41 2025 +0900 clk: composite: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated and going away, so migrate this driver from round_rate() to determine_rate(). Signed-off-by: Brian Masney commit e270dc63837f3f3439f37c556869444cdf1b536a Author: Brian Masney Date: Fri Dec 12 08:41:40 2025 +0900 clk: test: remove references to clk_ops.round_rate The round_rate() clk ops is going away, so let's go ahead and remove any references to it in the comments. Signed-off-by: Brian Masney commit 99372d2430c07476e36a1964cb6f21334183db44 Author: Robin Murphy Date: Mon Jan 26 12:32:05 2026 +0000 arm64: dts: rockchip: Describe HDMI supplies for nanopi4 boards We already describe the 0v9 and 1v8 rails used for analog supplies on the nanopi4 boards, so hook them up to make the HDMI driver happy too. Signed-off-by: Robin Murphy Link: https://patch.msgid.link/8c1837976937a0ef03811109ca12f353c4d5e67d.1767111968.git.robin.murphy@arm.com Signed-off-by: Heiko Stuebner commit 1e6568db5a4e65ec60d2ccc1fd2ba38cd6db59bc Author: Robin Murphy Date: Mon Jan 26 12:32:03 2026 +0000 arm64: dts: rockchip: Clean up NanoPi-R2S Plus gmac2io Apparently something went wonky in the refactoring, and NanoPi R2S Plus has ended up "overriding" the GMAC properties from the base R2S include with all identical values. Clean up the redundancy. Signed-off-by: Robin Murphy Link: https://patch.msgid.link/94f66f34d6023887111884093f31a8980e993ef9.1767111968.git.robin.murphy@arm.com Signed-off-by: Heiko Stuebner commit 0c02a103908b8c55633013deb9c76843db879bd6 Author: Hugh Cole-Baker Date: Sun Jan 25 18:10:14 2026 +0000 arm64: dts: rockchip: add pwm-fan for NanoPC-T6 FriendlyELEC offers an optional heatsink and fan addon [1] for the NanoPC-T6 and T6 LTS, which plugs in to the fan connector on the board driven by pwm1. Add the fan as an active cooling device for the SoC package. The PWM duty cycle values are taken from the vendor's source [2]. Signed-off-by: Hugh Cole-Baker [1]: https://www.friendlyelec.com/index.php?route=product/product&product_id=305 [2]: https://github.com/friendlyarm/kernel-rockchip/blob/4944602540b62f5aad139fe602a76cf7c3176128/arch/arm64/boot/dts/rockchip/rk3588-nanopi6-rev01.dts#L75-L90 Reviewed-by: Dragan Simic Link: https://patch.msgid.link/20260125181228.25145-1-sigmaris@gmail.com Signed-off-by: Heiko Stuebner commit 86a82f7a7eeda451ce1a34425133163b5b581edb Author: Chaoyi Chen Date: Sat Jan 31 16:14:38 2026 +0800 arm64: dts: rockchip: Add rk3576 evb2 board General features for rk3576 evb2 board: - Rockchip RK3576 - LPDDR4/4X - eMMC5.1 - RK806-2x2pcs + DiscretePower - 1x HDMI2.1 TX / HDMI2.0 RX - 1x full size DP1.4 TX (Only 2 Lanes) - 2x 10/100/1000M Ethernet - 5x SATA3.0 7Pin Slot - 2x USB3.2 Gen1 Host - 3x USB2.0 Host - WIFI/BT - ... Tested with eMMC/SDMMC/HDMI/USB/Ethernet/WIFI/BT module. Signed-off-by: Chaoyi Chen Reviewed-by: Alexey Charkov Link: https://patch.msgid.link/20260131081438.100-3-kernel@airkyi.com [added "s" to usb-hub preferred reset-gpio(s) - caused dtbs check errors] Signed-off-by: Heiko Stuebner commit 912fe17d0a524b571e8aab57de643c5fb5cb6376 Author: Chaoyi Chen Date: Sat Jan 31 16:14:37 2026 +0800 dt-bindings: arm: rockchip: Add rk3576 evb2 board Add devicetree binding for the rk3576 evb2 board. Signed-off-by: Chaoyi Chen Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260131081438.100-2-kernel@airkyi.com Signed-off-by: Heiko Stuebner commit 25afddad23b8e91fcff625756e51a805e288ab38 Author: Robin Murphy Date: Fri Jan 23 19:22:23 2026 +0000 arm64: dts: rockchip: Add overlay for FriendlyElec HD702E Add an overlay to support FriendlyElec's HD702E 7" eDP LCD touchscreen module for the NanoPC-T4 board: https://www.friendlyelec.com/index.php?route=product/product&path=81&product_id=230 Signed-off-by: Robin Murphy Link: https://patch.msgid.link/2bbc2e62ae9b54ac7594355001ce2b15885d3493.1769191673.git.robin.murphy@arm.com [changed edp-panel auxbus node to panel to conform to the binding] Signed-off-by: Heiko Stuebner commit 638fa970ac669e5d0fb2c5cc0bea3d4443299ac6 Author: Robin Murphy Date: Fri Jan 23 19:22:22 2026 +0000 arm64: dts: rockchip: Move RK3399 eDP pinctrl to boards The EDP_HOTPLUG pin is optional, and muxed with other functions (notably HDMI CEC), so move its selection from the SoC DTSI to the boards which apparently want it, namely those which enable eDP without "force-hpd". By the same token we drop it from Pinebook Pro, which already uses "force-hpd", and according to the schematics does not have the pin wired at all. Reviewed-by: Dragan Simic Signed-off-by: Robin Murphy Link: https://patch.msgid.link/c7d972d07875241805db8659305b26bd694867d4.1769191673.git.robin.murphy@arm.com Signed-off-by: Heiko Stuebner commit 5fdd6701fad197d0dfe21de3beed8ac45343aa73 Author: Heiko Stuebner Date: Sun Feb 1 20:18:04 2026 +0100 arm64: dts: rockchip: add overlay for qnap-ts133 device revision TS433 devices received a board revision adding gpios for per hard-disk presence-detection and power-control. These boards have a PCB-id of at least 13 which can be read from an EEPROM. The presence detection is not really necessary and there are also no existing bindings for doing something with it. So add them as gpio hog to at least document them and allow its state to be read from debugfs. The power-control is modelled as regulator, with connected to the RK3568's SATA controller as target-supply. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260201191804.41421-5-heiko@sntech.de Signed-off-by: Heiko Stuebner commit a12bd8d24f2f942a6684431af9f885b4a4ae84fe Author: Heiko Stuebner Date: Sun Feb 1 20:18:03 2026 +0100 arm64: dts: rockchip: add overlay for qnap-ts233 device revision TS233 devices received a board revision adding gpios for per hard-disk presence-detection and power-control. These boards have a PCB-id of at least 12 (mainboard) and 11 (backplane), which can be read from an EEPROM. The presence detection is not really necessary and there are also no existing bindings for doing something with it. So add them as gpio hogs to at least document them and allow their state to be read from debugfs. The power-control is modelled as regulators, with the hdd1+hdd2 variants connected to the RK3568's SATA controllers as target-supplies. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260201191804.41421-4-heiko@sntech.de Signed-off-by: Heiko Stuebner commit 406c5515eb62fe6837fc1257855024b1ac6c52e1 Author: Heiko Stuebner Date: Sun Feb 1 20:18:02 2026 +0100 arm64: dts: rockchip: add overlay for qnap-ts433 device revision TS433 devices received a board revision adding gpios for per hard-disk presence-detection and power-control. These board have a PCB-id of at least 12 (mainboard) and 10 (backplane), which can be read from an EEPROM. The presence detection is not really necessary and there are also no existing bindings for doing something with it. So add them as gpio hogs to at least document them and allow their state to be read from debugfs. The power-control is modelled as regulators, with the hdd1+hdd2 variants connected to the RK3568's SATA controllers as target-supplies. The JMicron AHCI controller on PCIe didn't have bindings for that, I could find, so they get an always-on state for now. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260201191804.41421-3-heiko@sntech.de Signed-off-by: Heiko Stuebner commit 5918bf2a17f4689abfb94d341c5240088f8bd16e Author: Heiko Stuebner Date: Sun Feb 1 20:18:01 2026 +0100 arm64: dts: rockchip: Add port subnodes to RK356x SATA controllers The SATA controllers on RK356x are identical to the ones found on RK3588, but don't yet provide a port sub-node. Per the datasheet the RK356x also supports the fbscp capability and has the same queue maximums. So add port sub-nodes to both sata controllers on RK356x, and move the phy properties to it. Also add phandles to the ports, so that boards can add their target-supply when available. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260201191804.41421-2-heiko@sntech.de Signed-off-by: Heiko Stuebner commit 1ee69b9cdcd1b838e514520fb4103ca77acd068a Author: Chris Morgan Date: Wed Jan 28 11:46:08 2026 -0600 arm64: dts: rockchip: add Awinic aw87391 amplifiers for Anbernic RG-DS Add support for the two Awinic aw87391 audio amplifiers used in the Anbernic RG-DS. These amplifiers require a specific init sequence to start which is usually provided by a firmware file, but in our case the manufacturer only provided the sequence. As a result, we hard-code a device specific compatible. Additionally, add support for the VDD regulator used to power both amplifiers. Note that the amps can accept and respond to i2c commands even without regulator power (perhaps due to a secondary power source) but cannot play audio. Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20260128174608.1498-4-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 52ad35272559db09ad571d698665fe33d93534a8 Author: Shawn Lin Date: Fri Feb 13 10:35:13 2026 +0800 arm64: dts: rockchip: Add supply for pd_rkvdec and pd_venc on rk3388-evbs The power domains pd_rkvdec0/1 and pd_venc0/1 depend on two voltage supplies, vdd_vdenc_s0 and vdd_vdenc_mem_s0. These supplies might be missing or cause probe deferral. Since the Rockchip power domain management code currently supports managing only one power supply, and both supplies belong to the same PMIC (making it highly unlikely for one to be available while the other is not), a practical solution is implemented. Both supplies are configured with the boot-on and always-on properties. Only one of them is assigned as the domain-supply for pd_rkvdec0/1 and pd_venc0/1. This allows the power domain code to perform a nominal enable operation on this single supply, thereby successfully acquiring a reference to both supplies (as they are from the same PMIC). The system then relies on their boot-on and always-on flags to maintain the correct state. Crucially, this approach handles cases like probe deferral correctly: if the PMIC is not yet ready, enabling the power domain will be deferred until the necessary supplies become available. Signed-off-by: Shawn Lin Link: https://patch.msgid.link/1770950113-19802-2-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Heiko Stuebner commit 9e79dcc4d8681df3ea1a0665dce5e35a37ece4b6 Author: Shawn Lin Date: Fri Feb 13 10:35:12 2026 +0800 arm64: dts: rockchip: add node name for RK3588_PD_RKVDEC0/1 and RK3588_PD_VENC0/1 Thus the board dts files could add property for these nodes. Signed-off-by: Shawn Lin Link: https://patch.msgid.link/1770950113-19802-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Heiko Stuebner commit 53ec6d21fe1ec0677f9db56a23dda8d145eda102 Author: Jun Yan Date: Sat Feb 14 10:17:16 2026 +0800 arm64: dts: rockchip: Add OneThing Edge Cube series The OneThing Edge Cube (OEC) series features the RK3566 SoC, 8GB eMMC storage, and supports one SATA interface, one Gigabit Ethernet port, and one USB 3.0 port. Other than the difference in RAM capacity, the OEC and OEC-turbo are identical in all other specifications. Specification: - Rockchip RK3566 - LPDDR4X 2GB (OEC) / 4GB (OEC-turbo) - eMMC 8GB - Gigabit Ethernet port x 1 - USB 3.0 port x 1 - USB-C 2.0 port x 1 - 12V DC Power supply - SATA 3.0 connector x 1 These devices do not have a PMIC, and their hardware circuit design is highly similar to that of the rk3566-box-demo[1]. Hardware schematics are not available at this time, with the vendor firmware dts available for reference[2]. Ethernet, USB 3.0 and SATA 3.0 ports tested, all working well. [1] https://elixir.bootlin.com/linux/v6.18.6/source/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts [2] https://archive.org/download/wxy-oec-RK3566-4G-dump/wxy-oec-RK3566-4G-dump.dts Signed-off-by: Jun Yan Link: https://patch.msgid.link/20260214021719.620752-4-jerrysteve1101@gmail.com Signed-off-by: Heiko Stuebner commit d49566ff47e7748b291ba82d0620a5c93f30e310 Author: Jun Yan Date: Sat Feb 14 10:17:15 2026 +0800 dt-bindings: arm: rockchip: Add OneThing Edge Cube series Add devicetree binding for the OneThing OEC and OEC-turbo The OneThing Edge Cube (OEC) series features the RK3566 SoC, 8GB eMMC storage, and supports one SATA interface, one Gigabit Ethernet port, and one USB 3.0 port. Among the lineup, the standard OEC model comes with 2GB of RAM, while the OEC-turbo features 4GB of RAM; The rest of the specifications are identical. The OneThing Edge Cube series (shipping with the vendor firmware) is originally designed as a PCDN (P2P Content Delivery Network) device. Signed-off-by: Jun Yan Acked-by: Conor Dooley Link: https://patch.msgid.link/20260214021719.620752-3-jerrysteve1101@gmail.com Signed-off-by: Heiko Stuebner commit c6d26a9425631c69087a407d3cf8372db0afee09 Author: Jun Yan Date: Sat Feb 14 10:17:14 2026 +0800 dt-bindings: vendor-prefixes: Add Shenzhen OneThing Technologies Co., Ltd. OneThing is a company engaged in edge computing. Signed-off-by: Jun Yan Acked-by: Conor Dooley Link: https://patch.msgid.link/20260214021719.620752-2-jerrysteve1101@gmail.com Signed-off-by: Heiko Stuebner commit 753ed4fa4e815669a025e08f5101ce0d91f46c8a Author: Andy Yan Date: Fri Feb 6 09:04:15 2026 +0800 arm64: dts: rockchip: Add DisplayPort dt node for rk3576 The DisplayPort on rk3576 is compliant with DisplayPort Specification Version 1.4 with MST support, and share the USBDP combo PHY with USB 3.1 OTG0 controller. Signed-off-by: Andy Yan Reviewed-by: Sebastian Reichel Tested-by: Sebastian Reichel Link: https://patch.msgid.link/20260206010421.443605-6-andyshrk@163.com Signed-off-by: Heiko Stuebner commit 70ad4780431e3936e9cb0cf13e286d304b418f94 Author: Andy Yan Date: Fri Feb 6 09:04:14 2026 +0800 drm/rockchip: dw_dp: Add DisplayPort support for rk3576 The DisplayPort of the RK3576 is basically the same as that of the RK3588, but it operates in dual-pixel mode and also support MST. This patch only enable the SST output now. Signed-off-by: Andy Yan Reviewed-by: Sebastian Reichel Tested-by: Sebastian Reichel Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260206010421.443605-5-andyshrk@163.com commit 388bb0899bc9acdb6e4eeaad9eb9dce3427ceca4 Author: Andy Yan Date: Fri Feb 6 09:04:13 2026 +0800 drm/bridge: synopsys: dw-dp: Make i2s/spdif clk optional The i2s/spdif clk are mandatory for rk3588, but not used for the upcoming rk3576, so make it optional here. Signed-off-by: Andy Yan Reviewed-by: Sebastian Reichel Tested-by: Sebastian Reichel Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260206010421.443605-4-andyshrk@163.com commit 77ae37018a2705f5abe8cc428e3496651258901d Author: Andy Yan Date: Fri Feb 6 09:04:12 2026 +0800 drm/bridge: synopsys: dw-dp: Set pixel mode by platform data In the implementation and integration of the SoC, the DW DisplayPort hardware block can be configured to work in single, dual, quad pixel mode on differnt platforms, so make the pixel mode set by plat_data to support the upcoming rk3576 variant. Signed-off-by: Andy Yan Reviewed-by: Sebastian Reichel Tested-by: Sebastian Reichel Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260206010421.443605-3-andyshrk@163.com commit 3410ab9fbd642e24f21d2fe6db6e995fa14991de Author: Andy Yan Date: Fri Feb 6 09:04:11 2026 +0800 dt-bindings: display: rockchip: Add rk3576 DisplayPort The DisplayPort found on RK3576 is very similar to that of RK3588, but work in dual pixel mode. And itself does not depend on the I2S clock or the SPDIF clock when transmit audio. Signed-off-by: Andy Yan Reviewed-by: Sebastian Reichel Reviewed-by: Krzysztof Kozlowski Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260206010421.443605-2-andyshrk@163.com commit f33a0a7f902d0715c1c09d7a128b1c94c09fcfc1 Author: Hsieh Hung-En Date: Tue Feb 10 00:16:21 2026 +0800 drm/rockchip: vop2: Use drm_err_ratelimited() for wait timeouts Replace deprecated DRM_DEV_ERROR() with drm_err_ratelimited() in the VOP2 register wait timeout paths to align with current DRM logging helpers and avoid flooding the kernel log when timeouts repeat. Signed-off-by: Hsieh Hung-En Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260209161621.6136-1-hungen3108@gmail.com commit dfeef98e55d0e5f622886d0a9980c235ff08fd97 Author: Satyanarayana K V P Date: Fri Feb 20 05:55:23 2026 +0000 drm/xe/sa: Add lockdep annotations for SA manager swap_guard Annotate the SA manager init path to model taking swap_guard while under reclaim context. This helps lockdep catch potential circular dependencies between fs_reclaim and swap_guard in debug builds. Without this annotation, lockdep is unaware of this chain until the shrinker runs. Signed-off-by: Satyanarayana K V P Suggested-by: Matthew Brost Cc: Michal Wajdeczko Cc: Matthew Auld Reviewed-by: Matthew Brost Reviewed-by: Thomas Hellström Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260220055519.2485681-8-satyanarayana.k.v.p@intel.com commit bcd768d787e7bb4e06d77709fa17d5bafec8612e Author: Satyanarayana K V P Date: Fri Feb 20 05:55:22 2026 +0000 drm/xe/vf: Fix fs_reclaim warning with CCS save/restore BB allocation CCS save/restore batch buffers are attached during BO allocation and detached during BO teardown. The shrinker triggers xe_bo_move(), which is used for both allocation and deletion paths. When BO allocation and shrinking occur concurrently, a circular locking dependency involving fs_reclaim and swap_guard can occur, leading to a deadlock such as: *===============================================================* * WARNING: possible circular locking dependency detected * *---------------------------------------------------------------* * * * CPU0 CPU1 * * ---- ---- * * lock(fs_reclaim); * * lock(&sa_manager->swap_guard); * * lock(fs_reclaim); * * lock(&sa_manager->swap_guard); * * * * *** DEADLOCK *** * *===============================================================* To avoid this, the BB pointer and SA are allocated using xe_bb_alloc() before taking lock and SA is initialized using xe_bb_init() preventing reclaim from being invoked in this context. Fixes: 864690cf4dd62 ("drm/xe/vf: Attach and detach CCS copy commands with BO") Signed-off-by: Satyanarayana K V P Cc: Matthew Brost Cc: Michal Wajdeczko Cc: Matthew Auld Cc: Thomas Hellström Cc: Maarten Lankhorst Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260220055519.2485681-7-satyanarayana.k.v.p@intel.com commit 16843e6638b743dd0376a1fc0845f2fd34daff98 Author: Satyanarayana K V P Date: Fri Feb 20 05:55:21 2026 +0000 drm/sa: Split drm_suballoc_new() into SA alloc and init helpers drm_suballoc_new() currently both allocates the SA object using kmalloc() and searches for a suitable hole in the sub-allocator for the requested size. If SA allocation is done by holding sub-allocator mutex, this design can lead to reclaim safety issues. By splitting the kmalloc() step outside of the critical section, we allow the memory allocation to use GFP_KERNEL (reclaim-safe) while ensuring that the initialization step that holds reclaim-tainted locks (sub-allocator mutex) operates in a reclaim-unsafe context with pre-allocated memory. This separation prevents potential deadlocks where memory reclaim could attempt to acquire locks that are already held during the sub-allocator operations. Signed-off-by: Satyanarayana K V P Suggested-by: Matthew Brost Cc: Thomas Hellström Cc: Michal Wajdeczko Cc: Matthew Auld Cc: Christian König Cc: dri-devel@lists.freedesktop.org Cc: Maarten Lankhorst Reviewed-by: Christian König Reviewed-by: Thomas Hellström Reviewed-by: Matthew Brost Acked-by: Maarten Lankhorst Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260220055519.2485681-6-satyanarayana.k.v.p@intel.com commit a5d5634cde48a9fcd68c8504aa07f89f175074a0 Author: Shuicheng Lin Date: Thu Feb 19 23:35:19 2026 +0000 drm/xe/sync: Fix user fence leak on alloc failure When dma_fence_chain_alloc() fails, properly release the user fence reference to prevent a memory leak. Fixes: adda4e855ab6 ("drm/xe: Enforce correct user fence signaling order using") Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260219233516.2938172-6-shuicheng.lin@intel.com commit f939bdd9207a5d1fc55cced5459858480686ce22 Author: Shuicheng Lin Date: Thu Feb 19 23:35:18 2026 +0000 drm/xe/sync: Cleanup partially initialized sync on parse failure xe_sync_entry_parse() can allocate references (syncobj, fence, chain fence, or user fence) before hitting a later failure path. Several of those paths returned directly, leaving partially initialized state and leaking refs. Route these error paths through a common free_sync label and call xe_sync_entry_cleanup(sync) before returning the error. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260219233516.2938172-5-shuicheng.lin@intel.com commit 9ca192cbcd5b9baefdc3c4a0d2740e04a427cd18 Author: Michal Wajdeczko Date: Wed Feb 18 21:55:52 2026 +0100 drm/xe/pf: Add documentation for vram_quota Add initial documentation for recently added VRAM provisioning Xe driver specific SR-IOV sysfs files under device/sriov_admin. Signed-off-by: Michal Wajdeczko Cc: Rodrigo Vivi Reviewed-by: Piotr Piórkowski Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/20260218205553.3561-11-michal.wajdeczko@intel.com commit d039fa856ee190ae8cd799800972137a00b55d43 Author: Michal Wajdeczko Date: Wed Feb 18 21:55:51 2026 +0100 drm/xe/pf: Skip VRAM auto-provisioning if already provisioned In case VF's VRAM provisioning using sysfs is done by the admin prior to VFs enabling, this provisioning will be lost as PF will run VRAM auto-provisioning anyway. To avoid that skip this auto- provisioning if any VF has been already provisioned with VRAM. To help admin find any mistakes, add diagnostics messages about which VFs were provisioned with VRAM and which were missed. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20260218205553.3561-10-michal.wajdeczko@intel.com commit 67a716b693f96177be253c1fa6a205db743d5445 Author: Michal Wajdeczko Date: Wed Feb 18 21:55:50 2026 +0100 drm/xe/pf: Prefer guard(mutex) when doing fair LMEM provisioning We will add more code there and with guard() it will easier to avoid mistakes in unlocking. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20260218205553.3561-9-michal.wajdeczko@intel.com commit 62acbb1dd5c281ad708f7985031230b0268ddc61 Author: Michal Wajdeczko Date: Wed Feb 18 21:55:49 2026 +0100 drm/xe/pf: Don't check for empty config We already turn off VFs auto-provisioning once we detect manual VFs provisioning over the debugfs, so we can skip additional check for all VFs configs being still empty. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20260218205553.3561-8-michal.wajdeczko@intel.com commit cbe29da6f7c0d0541ec135e7292b35b97f8ca402 Author: Michal Wajdeczko Date: Wed Feb 18 21:55:48 2026 +0100 drm/xe/tests: Add KUnit tests for new VRAM fair provisioning Add basic test cases to check outcome of the fair VRAM provisioning for regular and admin-only PF mode. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20260218205553.3561-7-michal.wajdeczko@intel.com commit 81d417d56a23f94b288587af59111f20aaf83c03 Author: Michal Wajdeczko Date: Wed Feb 18 21:55:47 2026 +0100 drm/xe/pf: Use migration-friendly VRAM auto-provisioning Instead of trying very hard to find the largest fair VRAM (aka LMEM) size that could be allocated for VFs on the current tile, pick some smaller rounded down to power-of-two value that is more likely to be provisioned in the same manner by the other PF instances. In some cases, the outcome of above calculation might not be optimal, but it's expected that admin will do fine-tuning using sysfs files. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20260218205553.3561-6-michal.wajdeczko@intel.com commit b1d2746aa5af17d1c901c36564e52da5c6bedae5 Author: Michal Wajdeczko Date: Wed Feb 18 21:55:46 2026 +0100 drm/xe/pf: Allow to change VFs VRAM quota using sysfs On current discrete platforms, PF will provision all VFs with a fair amount of the VRAM (LMEM) during VFs enabling. However, in some cases this automatic VRAM provisioning might be either non-reproducible or sub-optimal. This could break VF's migration or impact performance. Expose per-VF VRAM quota read-write sysfs attributes to allow admin change default VRAM provisioning performed by the PF. /sys/bus/pci/drivers/xe/BDF/ ├── sriov_admin/ ├── .bulk_profile │ └── vram_quota [RW] unsigned integer ├── vf1/ │ └── profile │ └── vram_quota [RW] unsigned integer ├── vf2/ │ └── profile │ └── vram_quota [RW] unsigned integer Above values represent total provisioned VRAM from all tiles where VFs were assigned, and currently it's from all tiles always. Note that changing VRAM provisioning is only possible when VF is not running, otherwise GuC will complain. To make sure that given VF is idle, triggering VF FLR might be needed. Signed-off-by: Michal Wajdeczko Cc: Rodrigo Vivi Reviewed-by: Piotr Piórkowski Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/20260218205553.3561-5-michal.wajdeczko@intel.com commit 5ae3c886a1f5d54fbd5e477bcbfb4f3154a7247e Author: Michal Wajdeczko Date: Wed Feb 18 21:55:45 2026 +0100 drm/xe/pf: Add functions for VRAM provisioning We already have functions to configure VF LMEM (aka VRAM) on the tile/GT level, used by the auto-provisioning and debugfs, but we also need functions that will work on the device level that will configure VRAM on all tiles at once. We will use these new functions in upcoming patch. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20260218205553.3561-4-michal.wajdeczko@intel.com commit 146f25b40ce4b97b193ec19ae747629e44dfdce9 Author: Michal Wajdeczko Date: Wed Feb 18 21:55:44 2026 +0100 drm/xe/pf: Add locked variants of VRAM configuration functions We already have few functions to configure LMEM (aka VRAM) but they all are taking master mutex. Split them and expose locked variants to allow use by the caller who already hold this mutex. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20260218205553.3561-3-michal.wajdeczko@intel.com commit 2d892455f38b82fb4e93f45e7a8e8ea41683ca78 Author: Michal Wajdeczko Date: Wed Feb 18 21:55:43 2026 +0100 drm/xe/pf: Expose LMTT page size The underlying LMTT implementation already provides the info about the page size it is using. There is no need to have a separate helper function that is making assumption about the required size. Signed-off-by: Michal Wajdeczko Cc: Piotr Piórkowski Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20260218205553.3561-2-michal.wajdeczko@intel.com commit 058fc04b8587ad07a86dfa8f99d8d99db0a55443 Author: Thomas Zimmermann Date: Tue Feb 17 16:56:22 2026 +0100 drm/sysfb: corebootdrm: Support panel orientation Add fields and constants for coreboot framebuffer orientation. Set corebootdrm's DRM connector state from the values. Not all firmware provides orientation, so make it optional. Systems without, continue to use unknown orientation. v3: - comment on _HAS_ORIENTATION semantics (Tzung-Bi) Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Acked-by: Julius Werner Acked-by: Tzung-Bi Shih # coreboot Link: https://patch.msgid.link/20260217155836.96267-13-tzimmermann@suse.de commit a29a1f0ec8d69ee917a9d4c84b844df0decff0ef Author: Thomas Zimmermann Date: Tue Feb 17 16:56:21 2026 +0100 drm/sysfb: corebootdrm: Add DRM driver for coreboot framebuffers Add corebootdrm, a DRM driver for coreboot framebuffers. The driver supports a pre-initialized framebuffer with various packed RGB formats. The driver code is fairly small and uses the same logic as the other sysfb drivers. Most of the implementation comes from existing sysfb helpers. Until now, coreboot relied on simpledrm or simplefb for boot-up graphics output. Initialize the platform device for corebootdrm in the same place in framebuffer_probe(). With a later commit, the simple-framebuffer should be removed. v4: - sort include statements (Tzung-Bi) v3: - comment on _HAS_LFB semantics (Tzung-Bi) - fix typo in commit description (Tzung-Bi) - comment on simple-framebuffer being obsolete for coreboot v2: - reimplement as platform driver - limit resources and mappings to known framebuffer memory; no page alignment - create corebootdrm device from coreboot framebuffer code Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Acked-by: Julius Werner Acked-by: Tzung-Bi Shih # coreboot Link: https://patch.msgid.link/20260217155836.96267-12-tzimmermann@suse.de commit b3728905dca29ea4e00c0587f27c3a637b13b2d8 Author: Thomas Zimmermann Date: Tue Feb 17 16:56:20 2026 +0100 drm/sysfb: Generalize pixel-format matching Provide drm_sysfb_get_format(), a helper that finds a specific DRM format from a list of pixel formats. The new function builds upon drm_sysfb_get_format_si(), which finds the DRM format from a given instance of struct screen_info. Now get the screen_info's pixel format in the caller. Allows for matching pixel formats in drivers without screen_info. Convert the callers in efidrm and vesadrm to the new interface. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Acked-by: Julius Werner Link: https://patch.msgid.link/20260217155836.96267-11-tzimmermann@suse.de commit 27fc52b5505a3acca96b884a4bf1345344e5a566 Author: Thomas Zimmermann Date: Tue Feb 17 16:56:19 2026 +0100 firmware: google: Pack structures for coreboot table entries Pack the fields in the coreboot table entries. These entries are part of the coreboot ABI, so they don't follow regular calling conventions. Fields of type u64 are aligned to boundaries of 4 bytes instead of 8. [1] So far this has not been a problem. In the future, padding bytes should be added where explicit alignment is required. Signed-off-by: Thomas Zimmermann Link: https://github.com/coreboot/coreboot/blob/main/payloads/libpayload/include/coreboot_tables.h#L96 # [1] Suggested-by: Julius Werner Acked-by: Julius Werner Acked-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260217155836.96267-10-tzimmermann@suse.de commit 95cef38e70250234a254e6228eb7342b6deaaffa Author: Thomas Zimmermann Date: Tue Feb 17 16:56:18 2026 +0100 firmware: google: Export coreboot table entries Move types for coreboot table entries to . Allows drivers in other subsystems to use these structures. Signed-off-by: Thomas Zimmermann Acked-by: Tzung-Bi Shih Acked-by: Julius Werner Link: https://patch.msgid.link/20260217155836.96267-9-tzimmermann@suse.de commit 086831fbd2a50384282a486014529893833f68c4 Author: Thomas Zimmermann Date: Tue Feb 17 16:56:17 2026 +0100 firmware: google: Clean up include statements in coreboot_table.h Include from source files and only forward- declare struct coreboot_device_id in coreboot_table.h. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Acked-by: Tzung-Bi Shih Acked-by: Julius Werner Link: https://patch.msgid.link/20260217155836.96267-8-tzimmermann@suse.de commit b44308c864b86ebcc03d73ae74bb9ac3ce1c5d4b Author: Thomas Zimmermann Date: Tue Feb 17 16:56:16 2026 +0100 firmware: google: Init coreboot bus with subsys_initcall() Using module_init()/device_initcall() is too late to initialize the coreboot bus, as there might already be drivers that depend on it. So far this hasn't been a problem, as coreboot controls all device creation. Initializing the coreboot bus earlier in subsys_initcall() will allow for external coreboot drivers to register themselves with device_initcall(). Prepares coreboot to support additional coreboot drivers from other subsystems. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Acked-by: Tzung-Bi Shih Acked-by: Julius Werner Link: https://patch.msgid.link/20260217155836.96267-7-tzimmermann@suse.de commit 73d8aa63b22b1e49f3f025da394bbe339e7a880f Author: Thomas Zimmermann Date: Tue Feb 17 16:56:15 2026 +0100 firmware: google: framebuffer: Fix dependencies The framebuffer on the coreboot bus represents an entry in the coreboot payload table; not the actual device. [1] Hence it must not depend on any other driver setting. Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/dri-devel/CAODwPW9_ym3E4za3yoUAs0+1sQfaKTDOau4Oh9Zm8+2uvYVgFQ@mail.gmail.com/ # [1] Acked-by: Tzung-Bi Shih Acked-by: Julius Werner Link: https://patch.msgid.link/20260217155836.96267-6-tzimmermann@suse.de commit 0d847e16ca6c23a99a0228db6c2589d4b1898321 Author: Thomas Zimmermann Date: Tue Feb 17 16:56:14 2026 +0100 firmware: google: framebuffer: Tie platform device to PCI hardware Use the PCI device as parent of the system-framebuffer device instead of the coreboot device. Prevents SIGBUS or SIGSEG after hot-unplug of the PCI device while the framebuffer is active. The simple-framebuffer device depends on the PCI hardware, so this device needs to be its parent. The current coreboot parent is no longer needed after the system-framebuffer device has been created. On systems without PCI or if no PCI parent device could be found, the platform device hangs on the platform bus directly. The fix here is similar to code in sysfb, which contained that same bug. Signed-off-by: Thomas Zimmermann Acked-by: Tzung-Bi Shih Acked-by: Julius Werner Link: https://patch.msgid.link/20260217155836.96267-5-tzimmermann@suse.de commit 94918485d266ea2b578f36955c8cc88a33706e28 Author: Thomas Zimmermann Date: Tue Feb 17 16:56:13 2026 +0100 firmware: google: framebuffer: Init memory resource with helper macro Initialize framebuffer memory resource with DEFINE_RES_MEM() instead of open-coding the setup. While at it, drop the resource name to make the kernel use the device name of the simple-framebuffer device for the resource. The latter includes a device number. While the meaning of the resource name is somewhat fuzzy and varies across entries in /proc/iomem, showing the device name seems more helpful than showing a fixed name. Signed-off-by: Thomas Zimmermann Acked-by: Tzung-Bi Shih Acked-by: Julius Werner Link: https://patch.msgid.link/20260217155836.96267-4-tzimmermann@suse.de commit f3850d399de3b6142b02315227ef9e772ed0c302 Author: Thomas Zimmermann Date: Tue Feb 17 16:56:12 2026 +0100 firmware: google: framebuffer: Do not mark framebuffer as busy Remove the flag IORESOURCE_BUSY flag from coreboot's framebuffer resource. It prevents simpledrm from successfully requesting the range for its own use; resulting in errors such as [ 2.775430] simple-framebuffer simple-framebuffer.0: [drm] could not acquire memory region [mem 0x80000000-0x80407fff flags 0x80000200] As with other uses of simple-framebuffer, the simple-framebuffer device should only declare it's I/O resources, but not actively use them. Signed-off-by: Thomas Zimmermann Fixes: 851b4c14532d ("firmware: coreboot: Add coreboot framebuffer driver") Acked-by: Tzung-Bi Shih Acked-by: Julius Werner Cc: Samuel Holland Cc: Greg Kroah-Hartman Cc: Tzung-Bi Shih Cc: Brian Norris Cc: Julius Werner Cc: chrome-platform@lists.linux.dev Cc: # v4.18+ Link: https://patch.msgid.link/20260217155836.96267-3-tzimmermann@suse.de commit 5cd28bd28c8ce426b56ce4230dbd17537181d5ad Author: Thomas Zimmermann Date: Tue Feb 17 16:56:11 2026 +0100 firmware: google: framebuffer: Do not unregister platform device The native driver takes over the framebuffer aperture by removing the system- framebuffer platform device. Afterwards the pointer in drvdata is dangling. Remove the entire logic around drvdata and let the kernel's aperture helpers handle this. The platform device depends on the native hardware device instead of the coreboot device anyway. When commit 851b4c14532d ("firmware: coreboot: Add coreboot framebuffer driver") added the coreboot framebuffer code, the kernel did not support device-based aperture management. Instead native driviers only removed the conflicting fbdev device. At that point, unregistering the framebuffer device most likely worked correctly. It was definitely broken after commit d9702b2a2171 ("fbdev/simplefb: Do not use struct fb_info.apertures"). So take this commit for the Fixes tag. Earlier releases might work depending on the native hardware driver. Signed-off-by: Thomas Zimmermann Fixes: d9702b2a2171 ("fbdev/simplefb: Do not use struct fb_info.apertures") Acked-by: Tzung-Bi Shih Acked-by: Julius Werner Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: Hans de Goede Cc: linux-fbdev@vger.kernel.org Cc: # v6.3+ Link: https://patch.msgid.link/20260217155836.96267-2-tzimmermann@suse.de commit c2366539d3746219000f58d821fdf8607bd8cfec Author: Tomasz Lis Date: Fri Feb 13 15:00:08 2026 +0100 drm/xe/guc: Increase GuC log sizes in debug builds Increase event log size for GuC debug to 16MB, and for general debug to 8MB. This allows for useful debug even if performance-affecting DRM_XE_DEBUG_GUC is not enabled. Without this change, GuC logs gathered by CI are useless for debug due to limited size, which translates to time frame not even able to cover cleanup after test. Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Cc: Daniele Ceraolo Spurio Cc: Matthew Brost Cc: Matt Roper Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260213140008.1473400-1-tomasz.lis@intel.com commit 008304c9ae75c772d3460040de56e12112cdf5e6 Author: Jouni Högander Date: Thu Feb 12 08:27:31 2026 +0200 drm/i915/alpm: ALPM disable fixes PORT_ALPM_CTL is supposed to be written only before link training. Remove writing it from ALPM disable. Also clearing ALPM_CTL_ALPM_AUX_LESS_ENABLE and is not about disabling ALPM but switching to AUX-Wake ALPM. Stop touching this bit on ALPM disable. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7153 Fixes: 1ccbf135862b ("drm/i915/psr: Enable ALPM on source side for eDP Panel replay") Cc: Animesh Manna Cc: Jani Nikula Cc: # v6.10+ Signed-off-by: Jouni Högander Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/20260212062731.397801-1-jouni.hogander@intel.com commit 7c9b2de8a95c4b65b6e83c1312d225c6444dfbf7 Author: Harish Chegondi Date: Tue Feb 10 13:58:27 2026 -0800 drm/xe/xe2lpg: Extend Wa_18041344222 to graphics IP 20.04 Apply WA 18041344222 to Xe2 LPG graphics IP version 20.04 too. Bspec: 56024 Cc: Matt Roper Cc: Dnyaneshwar Bhadane Signed-off-by: Harish Chegondi Reviewed-by: Matt Roper Link: https://patch.msgid.link/6e66746246439249a278f3d157f06071d83504b6.1770760591.git.harish.chegondi@intel.com Signed-off-by: Matt Roper commit 0ffe9dcf260b3cd3885fa2e43f592bd55adfddd7 Author: Harish Chegondi Date: Tue Feb 10 13:58:26 2026 -0800 drm/xe/xe3: Remove SRIOV VF check for Wa_18041344222 Engine WAs are not applied for SRIOV VF, even though they are processed. Remove the SRIOV VF check. Cc: Matt Roper Signed-off-by: Harish Chegondi Reviewed-by: Matt Roper Link: https://patch.msgid.link/5879396bf202b64d9b5c4cb8c720f3e65d358fc1.1770760591.git.harish.chegondi@intel.com Signed-off-by: Matt Roper commit a800b95c2498b1f67a8a37ca98b827042d0e926e Author: Harish Chegondi Date: Tue Feb 10 13:58:25 2026 -0800 drm/xe/xe2hpg: Remove SRIOV VF check for Wa_18041344222 Engine WAs are not applied for SRIOV VF, even though they are processed. Remove the SRIOV VF check. Cc: Matt Roper Signed-off-by: Harish Chegondi Reviewed-by: Matt Roper Link: https://patch.msgid.link/4043a30d6a971cda3c13145e081e4eed7cc4e440.1770760591.git.harish.chegondi@intel.com Signed-off-by: Matt Roper commit 9812865cc6d029313a607e54ff5ba76f56278cdc Author: Nitin Gote Date: Thu Feb 19 13:59:32 2026 +0530 drm/xe/xe3p_lpg: Add Wa_14026781792 Wa_14026781792 applies Xe3p_LPG graphics version 35.10. Signed-off-by: Nitin Gote Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260219082931.2199618-2-nitin.r.gote@intel.com Signed-off-by: Matt Roper commit 9cd168a2720bc614647dd20bc5d1c308c56a44ec Merge: b0a67f310bfa5e 18a1d365e825cf Author: Alexei Starovoitov Date: Thu Feb 19 11:29:41 2026 -0800 Merge branch 'selftests-bpf-fix-flaky-build_id-test' Gregory Bell says: ==================== selftests/bpf: fix flaky build_id test The build_id selftest intermittently fails with the following error: ./test_progs -t build_id/nofault-paged-out serial_test_build_id:PASS:parse_build_id 0 nsec subtest_nofault:PASS:skel_open 0 nsec subtest_nofault:PASS:link 0 nsec subtest_nofault:PASS:trigger_uprobe 0 nsec subtest_nofault:PASS:res 0 nsec subtest_nofault:FAIL:build_id_status unexpected build_id_status: actual 1 != expected 2 46/1 build_id/nofault-paged-out:FAIL 46 build_id:FAIL 397 stacktrace_build_id:OK 398 stacktrace_build_id_nmi:OK On RHEL we consistently hit the reported failure on the first run of the test following installation, after which subsequent runs pass. This patch implements the approach discussed in the following thread: https://lore.kernel.org/all/CAEf4BzYWVtfZh07iQm5Fo=kMm+8hgAu+rXRx1uLRHz07wc59+Q@mail.gmail.com/ Following the discussion, the fix makes the test verify eviction rather than assuming it. In the discussion it was recommended to add a sleep before and after the madvise operations, this did not resolve the issue in our case, rather the test timed out every time. I was successful by retrying the page-out sequence until the page is actually evicted. Additionally, the mapping alignment is increased to 64K so the test operates on a properly page-aligned buffer across supported architectures. changelog: - fixed indentations - removed trailing whitespace - add space between opening and closing brackets ==================== Link: https://patch.msgid.link/cover.1771338492.git.grbell@redhat.com Signed-off-by: Alexei Starovoitov commit 18a1d365e825cf936074d53d0a91c58a995a60b0 Author: Gregory Bell Date: Tue Feb 17 09:32:37 2026 -0500 selftests/bpf: align build_id test mapping to 64K page size Some architectures require mappings to be aligned to the system page size. The build_id selftest currently uses a smaller alignment, which can result in madvise operations executing on a different page than intended. Increase the mapping alignment to 64K so the buffer is page-aligned on all supported architectures. Signed-off-by: Gregory Bell Link: https://lore.kernel.org/r/93543253b32d1cb178ab6e31e4291e387ba1c372.1771338492.git.grbell@redhat.com Signed-off-by: Alexei Starovoitov commit d820fa3114825c43a6a2f3d66d3d1029db811fe3 Author: Gregory Bell Date: Tue Feb 17 09:32:36 2026 -0500 selftests/bpf: fix flaky build_id test The build_id selftest occasionally fails because MADV_PAGEOUT does not guarantee the immediate eviction of the page. The test assumes eviction happens and proceeds without verifying that the page was actually reclaimed, leading to false test failures. Fix the test by retrying the page-out sequence until eviction is successful, instead of relying on a single MADV_PAGEOUT attempt. Signed-off-by: Gregory Bell Link: https://lore.kernel.org/r/038bd27c69dd3a16958894fcb19e4fb6fbfe317e.1771338492.git.grbell@redhat.com Signed-off-by: Alexei Starovoitov commit b0a67f310bfa5e13d66c9f6b4bd88ea504a576a9 Merge: 4c51f90d45dca7 8bf22c33e7a172 Author: Alexei Starovoitov Date: Thu Feb 19 11:08:53 2026 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf before 7.0-rc1 Cross-merge BPF and other fixes after downstream PR. No conflicts. Signed-off-by: Alexei Starovoitov commit 764af38af22a6231af2b3685f74d214a9175b822 Author: Matt Roper Date: Wed Feb 18 14:09:15 2026 -0800 drm/xe/reg_sr: Allow register_save_restore_check debugfs to verify LRC values reg_sr programming that applies to an engines LRC cannot be verified by a simple CPU-based register readout because the reg_sr's values may not be in effect if no context is executing on the hardware at the time we check. Instead, we should verify correct reg_sr application by searching for the register in the default_lrc. Reviewed-by: Ashutosh Dixit Link: https://patch.msgid.link/20260218-sr_verify-v4-4-35d6deeb3421@intel.com Signed-off-by: Matt Roper commit e950b06014793c035f5328915f2d6d93ec0b5874 Author: Matt Roper Date: Wed Feb 18 14:09:14 2026 -0800 drm/xe: Add facility to lookup the value of a register in a default LRC An LRC is stored in memory as a special batchbuffer that hardware will execute to re-load state when switching to the context; it's a collection of register values (encoded as MI_LOAD_REGISTER_IMM commands) and other state instructions (e.g., 3DSTATE_*). The value that will be loaded for a given register can be determined by parsing the batchbuffer to find MI_LRI commands and extracting the value from the offset/value pairs it contains. Add functions to do this, which will be used in a future patch to help verify that our expected reg_sr programming is in place. The implementation here returns the value as soon as it finds a match in the LRC. Technically a register could appear multiple times (either due to memory corruption or a hardware defect) and the last value encountered would be the one in effect when the context resumes execution. We can adjust the logic to keep looking and return the last match instead of first in the future if we encounter real-world cases where this would assist with debugging. Reviewed-by: Ashutosh Dixit Link: https://patch.msgid.link/20260218-sr_verify-v4-3-35d6deeb3421@intel.com Signed-off-by: Matt Roper commit d389489225b85aac3ad90ed8b5661679f27a2da4 Author: Matt Roper Date: Wed Feb 18 14:09:13 2026 -0800 drm/xe/reg_sr: Add debugfs to verify status of reg_sr programming When applying save-restore register programming for workarounds, tuning settings, and general device configuration we assume the programming was successful. However there are a number of cases where the desired reg_sr programming can become lost: - workarounds implemented on the wrong RTP table might not get saved/restored at the right time leading to, for example, failure to re-apply the programming after engine resets - some hardware registers become "locked" and can no longer be updated after firmware or the driver finishes initializing them - sometimes the hardware teams just made a mistake when documenting the register and/or bits that needed to be programmed Add a debugfs entry that will read back the registers referenced on a GT's save-restore lists and print any cases where the desired programming is no longer in effect. Such cases might indicate the presence of a driver/firmware bug, might indicate that the documentation we were following has a mistake, or might be benign (occasionally registers have broken read-back capability preventing verification, but previous writes were still successful and effective). For now we only verify the GT and engine reg_sr lists. Verifying the LRC list will require checking the expected programming against the default_lrc contents, not the live registers (which may not reflect the reg_sr programming if no context is actively running). Reviewed-by: Ashutosh Dixit Link: https://patch.msgid.link/20260218-sr_verify-v4-2-35d6deeb3421@intel.com Signed-off-by: Matt Roper commit a41ee215b59d78f8cd0a4b05e373335944e0ecb0 Author: Matt Roper Date: Wed Feb 18 14:09:12 2026 -0800 drm/xe/reg_sr: Don't process gt/hwe lists in VF There are a few different reg_sr lists managed by the driver for workarounds/tuning: - gt->reg_sr - hwe->reg_sr - hwe->reg_lrc The first two are not relevant to SRIOV VFs; a VF KMD does not have access to the registers that appear on this list and it is the PF KMD's responsibility to apply such programming on behalf of the entire system. However the third list contains per-client values that the VF KMD needs to ensure are incorporated whenever a new LRC is created. Handling of reg_sr lists comes in two steps: processing an RTP table to build a reg_sr from the relevant entries, and then applying the contents of the reg_sr. Skipping the RTP processing (resulting in an empty reg_sr) or skipping the application of a reg_sr are both valid ways to avoid having a VF accidentally try to write registers it doesn't have access to. In commit c19e705ec981 ("drm/xe/vf: Stop applying save-restore MMIOs if VF") and commit 92a5bd302458 ("drm/xe/vf: Unblock xe_rtp_process_to_sr for VFs") we adjusted the drivers behavior to always process the RTP table into a reg_sr and just skipped the application step. This works fine functionally, but can lead to confusion during debugging since facilities like the debugfs 'register-save-restore' will still report a bunch of registers that the VF KMD isn't actually trying to handle. It will also mislead other upcoming debug changes. Let's go back to skipping the RTP => reg_sr processing step, but only for GT / hwe tables this time. This will allow LRC reg_sr handling to continue to work, but will ensure that gt->reg_sr and hwe->reg_sr remain empty and that debugfs reporting more accurately reflects the KMD's behavior. v2: - Also skip the hwe processing in hw_engine_setup_default_state() and xe_reg_whitelist_process_engine(). v3: - Handle skipping via an additional parameter passed to xe_rtp_process_to_sr() rather than adding conditions at each callsite. (Ashutosh) Cc: Michal Wajdeczko Cc: Ashutosh Dixit Cc: Harish Chegondi Reviewed-by: Ashutosh Dixit Link: https://patch.msgid.link/20260218-sr_verify-v4-1-35d6deeb3421@intel.com Signed-off-by: Matt Roper commit 6c2e331c915ba9e774aa847921262805feb00863 Author: Matt Roper Date: Fri Feb 6 14:30:59 2026 -0800 drm/xe/wa: Steer RMW of MCR registers while building default LRC When generating the default LRC, if a register is not masked, we apply any save-restore programming necessary via a read-modify-write sequence that will ensure we only update the relevant bits/fields without clobbering the rest of the register. However some of the registers that need to be updated might be MCR registers which require steering to a non-terminated instance to ensure we can read back a valid, non-zero value. The steering of reads originating from a command streamer is controlled by register CS_MMIO_GROUP_INSTANCE_SELECT. Emit additional MI_LRI commands to update the steering before any RMW of an MCR register to ensure the reads are performed properly. Note that needing to perform a RMW of an MCR register while building the default LRC is pretty rare. Most of the MCR registers that are part of an engine's LRCs are also masked registers, so no MCR is necessary. Fixes: f2f90989ccff ("drm/xe: Avoid reading RMW registers in emit_wa_job") Cc: Michal Wajdeczko Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260206223058.387014-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 1a0c73b2aaf2198f36d8156b78e083c58806d47b Merge: f08fe8891c3eeb bc014937bc112d Author: Christian Brauner Date: Thu Feb 19 14:34:31 2026 +0100 Merge patch series "remove or unexport unused fs_conext infrastructure" Christoph Hellwig says: Now that the fs_context conversion is finished, remove all the bits that did not end up having users, or unexport them if the users are always built in. * patches from https://patch.msgid.link/20260219065014.3550402-1-hch@lst.de: fs: unexport fs_context_for_reconfigure fs: remove fsparam_path / fs_param_is_path fs: remove fsparam_blob / fs_param_is_blob fs: mark bool_names static Link: https://patch.msgid.link/20260219065014.3550402-1-hch@lst.de Signed-off-by: Christian Brauner commit bc014937bc112d4d44b3f3186fb8e87a3c80f735 Author: Christoph Hellwig Date: Thu Feb 19 07:50:04 2026 +0100 fs: unexport fs_context_for_reconfigure fs_context_for_reconfigure is only used by core VFS code and devtmpfs, so unexport it. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260219065014.3550402-5-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit d2f2f7cf8e898f7b80fe031a263df9c7de94b0b7 Author: Christoph Hellwig Date: Thu Feb 19 07:50:03 2026 +0100 fs: remove fsparam_path / fs_param_is_path These are not used anywhere even after the fs_context conversion is finished, so remove them. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260219065014.3550402-4-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 8823db29744fceda9f94e674f74deea446c620b3 Author: Christoph Hellwig Date: Thu Feb 19 07:50:02 2026 +0100 fs: remove fsparam_blob / fs_param_is_blob These are not used anywhere even after the fs_context conversion is finished, so remove them. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260219065014.3550402-3-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 0d799df5b147e08828887fe7299efd7a9e0eea40 Author: Christoph Hellwig Date: Thu Feb 19 07:50:01 2026 +0100 fs: mark bool_names static The bool_names array is only used in fs_parser.c so mark it static. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260219065014.3550402-2-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit f08fe8891c3eeb63b73f9f1f6d97aa629c821579 Author: Zhihao Cheng Date: Fri Jan 30 11:48:53 2026 +0800 dcache: Limit the minimal number of bucket to two There is an OOB read problem on dentry_hashtable when user sets 'dhash_entries=1': BUG: unable to handle page fault for address: ffff888b30b774b0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP PTI RIP: 0010:__d_lookup+0x56/0x120 Call Trace: d_lookup.cold+0x16/0x5d lookup_dcache+0x27/0xf0 lookup_one_qstr_excl+0x2a/0x180 start_dirop+0x55/0xa0 simple_start_creating+0x8d/0xa0 debugfs_start_creating+0x8c/0x180 debugfs_create_dir+0x1d/0x1c0 pinctrl_init+0x6d/0x140 do_one_initcall+0x6d/0x3d0 kernel_init_freeable+0x39f/0x460 kernel_init+0x2a/0x260 There will be only one bucket in dentry_hashtable when dhash_entries is set as one, and d_hash_shift is calculated as 32 by dcache_init(). Then, following process will access more than one buckets(which memory region is not allocated) in dentry_hashtable: d_lookup b = d_hash(hash) dentry_hashtable + ((u32)hashlen >> d_hash_shift) // The C standard defines the behavior of right shift amounts // exceeding the bit width of the operand as undefined. The // result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen', // so 'b' will point to an unallocated memory region. hlist_bl_for_each_entry_rcu(b) hlist_bl_first_rcu(head) h->first // read OOB! Fix it by limiting the minimal number of dentry_hashtable bucket to two, so that 'd_hash_shift' won't exceeds the bit width of type u32. Cc: stable@vger.kernel.org Signed-off-by: Zhihao Cheng Link: https://patch.msgid.link/20260130034853.215819-1-chengzhihao1@huawei.com Reviewed-by: Yang Erkun Signed-off-by: Christian Brauner commit 2dec6931ee04cab66658a50f6dbe5dd5a2cf4de2 Author: Namjae Jeon Date: Fri Jan 9 16:24:46 2026 +0900 MAINTAINERS: update ntfs filesystem entry Add myself and Hyunchul Lee as ntfs maintainer. Since Anton is already listed in CREDITS, only his outdated information is updated here. the web address in the W: field in his entry is no longer accessible. Update his CREDITS with the web and email address found in the ntfs filesystem entry. Cc: Anton Altaparmakov Reviewed-by: Amir Goldstein Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon commit ab00f20ab6c74d7594dd93eed0d543313e4713c7 Author: Namjae Jeon Date: Wed Feb 4 14:10:17 2026 +0900 Documentation: filesystems: update NTFS driver documentation Update the NTFS driver documentation to reflect the update implementation. Remove outdated sections (web site, old features list, known bugs, volume/stripe sets with MD/DM driver, limitations of old driver), add a concise overview of current driver features and long-term maintenance focus, add a utilities support section pointing to ntfsprogs-plus project and update mount options list with current supported options. Reviewed-by: Christoph Hellwig Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon commit 47503f989736d6c4c9f8bfca1c28d267473ccd4b Author: Namjae Jeon Date: Mon Feb 2 16:00:57 2026 +0900 ntfs: add Kconfig and Makefile Introduce Kconfig and Makefile for remade ntfs. And this patch make ntfs and ntfs3 mutually exclusive so only one can be built-in(y), while both can still be built as modules(m). Reviewed-by: Amir Goldstein Reviewed-by: Christoph Hellwig Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon commit f3b47720c2b1e3ded09ad86c55b50af24b4170bb Author: Namjae Jeon Date: Fri Feb 13 10:54:02 2026 +0900 ntfs3: remove legacy ntfs driver support Reverts the following commits that introduced legacy ntfs driver alias and related support code: 74871791ffa9 ntfs3: serve as alias for the legacy ntfs driver 1ff2e956608c fs/ntfs3: Redesign legacy ntfs support 9b872cc50daa ntfs3: add legacy ntfs file operations d55f90e9b243 ntfs3: enforce read-only when used as legacy ntfs driver The legacy ntfs driver has been remade as a new implementation, so the alias and related codes in ntfs3 are no longer needed. Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon commit 5218cd102aec7ae8df6af6e681ebb0b6d8e798f4 Author: Namjae Jeon Date: Fri Feb 13 10:49:27 2026 +0900 ntfs: update misc operations Updates various miscellaneous operations including collation, debugging, logfile handling, unicode string processing, bdev io helpers, object id system file handling. Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon commit fc053f05ca282a5e760b41f6560ac835c4e28037 Author: Namjae Jeon Date: Fri Feb 13 10:45:36 2026 +0900 ntfs: add reparse and ea operations Implement support for Extended Attributes and Reparse Points, enabling Posix ACL support and, and compatibility with Windows Subsystem for Linux (WSL) metadata. Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon commit 11ccc9107dc460de28af90fac1f42404d9802735 Author: Namjae Jeon Date: Fri Feb 13 10:44:35 2026 +0900 ntfs: update runlist handling and cluster allocator Updates runlist handling and cluster allocation to support contiguous allocations and filesystem trimming. Improve the runlist API to handle allocation failures and introduces discard support. Acked-by: Christoph Hellwig Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 495e90fa334828d4119061e2726af51d0a0fb4ed Author: Namjae Jeon Date: Fri Feb 13 10:43:34 2026 +0900 ntfs: update attrib operations Overhaul the attribute operations to support write access, including full attribute list management for handling multiple MFT records, and compressed writes. Acked-by: Christoph Hellwig Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit b041ca562526b3c4a71b41b80ba5e520eac636ad Author: Namjae Jeon Date: Fri Feb 13 10:42:29 2026 +0900 ntfs: update iomap and address space operations Update the address space operations to use the iomap framework, replacing legacy buffer-head based code. Acked-by: Christoph Hellwig Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 9c87959601e80b39a45250e362e6ddfec17cb0fa Author: Namjae Jeon Date: Fri Feb 13 10:41:19 2026 +0900 ntfs: update file operations Rewrite the file operations to utilize the iomap infrastructure, replacing the legacy buffer-head based implementation. Implement ntfs_setattr() with size change handling, uid/gid/mode. Add support for Direct I/O. Add support for fallocate with the FALLOC_FL_KEEP_SIZE, FALLOC_FL_PUNCH_HOLE, FALLOC_FL_COLLAPSE_RANGE, FALLOC_FL_INSERT_RANGE and FALLOC_FL_ALLOCATE_RANGE modes. Implement .llseek with SEEK_DATA / SEEK_HOLE support. Implement ntfs_fiemap() using iomap_fiemap(). Add FS_IOC_SHUTDOWN, FS_IOC_[GS]ETFSLABEL, FITRIM ioctl support. Reviewed-by: Christoph Hellwig Acked-by: Christoph Hellwig Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 0a8ac0c1fa0b99a5b29002bc7f232ed7eafddef0 Author: Namjae Jeon Date: Fri Feb 13 10:40:41 2026 +0900 ntfs: update directory operations Update the directory and index operations to support full read-write functionality and use the folio API, including directory modification. Acked-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Signed-off-by: Namjae Jeon commit 115380f9a2f9675c7924563cbba70d40cae8fb81 Author: Namjae Jeon Date: Fri Feb 13 10:39:43 2026 +0900 ntfs: update mft operations Refactors MFT record handling to use folio APIs with consistency validation, and improving allocation extension and writeback paths for and . Acked-by: Christoph Hellwig Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit af0db57d4293cc9fe6ce99fb5592dc2652228c9d Author: Namjae Jeon Date: Fri Feb 13 10:38:45 2026 +0900 ntfs: update inode operations Add extent inode loading via ntfs_extent_inode_open() and ntfs_inode_attach_all_extents(). Allow dynamic creation of with ntfs_inode_add_attrlist() when the base MFT record overflows. Introduce ntfs_inode_free_space() to move attributes out of the base record on demand. Implement direct attribute I/O through ntfs_inode_attr_pread() and ntfs_inode_attr_pwrite(). Implement .create, .unlink, .mkdir, .rmdir, .rename, .symlink, .mknod, .link callbacks. Introduce ntfs_non_resident_dealloc_clusters() to free clusters of non-resident attributes during inode eviction. Add ntfs_drop_big_inode() logic to safely truncate and deallocate clusters. Acked-by: Christoph Hellwig Signed-off-by: Hyunchul Lee Signed-off-by: Namjae Jeon commit 6251f0b0de7d645e3591931ca4c11d8322c1866f Author: Namjae Jeon Date: Fri Feb 13 10:37:53 2026 +0900 ntfs: update super block operations Update the super block operations to support the new fs_context-based mount API, full read-write support including ->sync_fs, and file system shutdown support. Update ntfs_statfs() to provide statistics using atomic counters for free clusters and MFT records. Add a dedicated workqueue to compute the total number of free clusters by scanning asynchronously. Synchronous bitmap scanning during mount can take a very long time on large volumes, severely delaying mount completion. Moving this to the background allows mount to finish almost immediately. Implement ntfs_write_volume_label() to allow changing the volume label. Reviewed-by: Christoph Hellwig Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon commit 40796051991d9dacadebbdbee11e0c851215c4c4 Author: Namjae Jeon Date: Fri Feb 13 10:36:38 2026 +0900 ntfs: update in-memory, on-disk structures and headers Update the NTFS filesystem driver's in-memory and on-disk structures: - Introduce the infrastructure and initial support for reparse points and EA attribute. - Refactor the core ntfs_inode and ntfs_volume structures to support new features such as iomap. - Remove the unnecessary types.h and endian.h headers. - Reorganize the comments in headers for better readability, including fixing warnings from checkpatch.pl. Reviewed-by: Christoph Hellwig Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon commit 1f662195dbc07a66241cb5fe483036e5d07fb642 Author: Namjae Jeon Date: Fri Jan 30 14:59:19 2026 +0900 fs: add generic FS_IOC_SHUTDOWN definitions Currently, several filesystems (e.g., xfs, ext4, btrfs) implement a "shutdown" or "going down" ioctl to simulate filesystem force a shutdown. While they often use the same underlying numeric value, the definition is duplicated across filesystem headers or private definitions. Add generic definitions for FS_IOC_SHUTDOWN in uapi/linux/fs.h. This allows new filesystems (like ntfs) to implement this feature using a standard VFS definition and paves the way for existing filesystems to unify their definitions later. The flag names are standardized as FS_SHUTDOWN_* to be consistent with the ioctl name, replacing the historical GOING_DOWN naming convention. Reviewed-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Reviewed-by: Jan Kara Signed-off-by: Namjae Jeon commit 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 Author: Namjae Jeon Date: Tue Dec 30 14:24:16 2025 +0900 Revert "fs: Remove NTFS classic" This reverts commit 7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89. Reverts the removal of the classic read-only ntfs driver to serve as the base for a new read-write ntfs implementation. If we stack changes on top of the revert patch, It will significantly reduce the diff size, making the review easier. This revert intentionally excludes the restoration of Kconfig and Makefile. The Kconfig and Makefile will be added back in the final patch of this series, enabling the driver only after all features and improvements have been applied. Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon commit 84fa9532c66a58dc76fa2d4d2ea5e0034871111b Author: Imre Deak Date: Wed Feb 18 12:57:08 2026 +0200 drm/i915/dp_mst: Fix ww mutex lock failure in for_each_joiner_candidate() loop Handle modeset WW mutex lock failures due to contention properly. Return -EDEADLK to the caller instead of attempting to lock the same mutex again in a subsequent joiner candidate iteration, where the WW mutex is already in a contended state. This fixes the following warning: WARNING: drivers/gpu/drm/drm_modeset_lock.c:298 at modeset_lock+0x1c0/0x210 triggered by ctx->contended. Cc: Ankit Nautiyal Fixes: b506a8e18c972 ("drm/i915/dp_mst: Rework pipe joiner logic in compute_config") Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260218105708.845161-2-imre.deak@intel.com commit c860076ea9b56032dd31c0a5560bba45637e4264 Author: Imre Deak Date: Wed Feb 18 12:57:07 2026 +0200 drm/i915/dp: Fix ww mutex lock failure in for_each_joiner_candidate() loop Handle modeset WW mutex lock failures due to contention properly. Return -EDEADLK to the caller instead of attempting to lock the same mutex again in a subsequent joiner candidate iteration, where the WW mutex is already in a contended state. This fixes the following warning: WARNING: drivers/gpu/drm/drm_modeset_lock.c:298 at modeset_lock+0x1c0/0x210 triggered by ctx->contended. Cc: Ankit Nautiyal Fixes: 1f1e3e5c65f6d ("drm/i915/dp: Rework pipe joiner logic in compute_config") Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260218105708.845161-1-imre.deak@intel.com commit e7b53288d9ea899abc6d47a7f20065ab511a810c Author: Yauhen Kharuzhy Date: Tue Feb 17 10:12:27 2026 -0800 Input: drv260x - fix unbalanced regulator_disable() call The driver acquires the 'vbat' regulator during probing but never enables it. Consequently, in the suspend method, the driver disables the regulator without enabling it first, causing an 'Unbalanced regulator_disable()' error. Enable the regulator in the probe() method and add the remove() method with regulator disabling to fix this. Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260215141435.727872-5-jekhor@gmail.com Signed-off-by: Dmitry Torokhov commit 710a1a8c591e93fa49946b68a4f1e25ae9687ecf Author: Yauhen Kharuzhy Date: Tue Feb 17 10:10:27 2026 -0800 Input: drv260x - handle calibration timeout If something goes wrong during calibration (for instance, if the 'enable' GPIO was not properly defined), the GO bit may not be cleared after some time, causing the driver to get stuck. To prevent this, add a timeout check to the waiting loop and return an error if it times out. Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260215141435.727872-6-jekhor@gmail.com Signed-off-by: Dmitry Torokhov commit 029edcfc4331f404570affbbd4f7d11f0a7fb13e Author: Yauhen Kharuzhy Date: Tue Feb 17 10:09:20 2026 -0800 Input: drv260x - add support for ACPI-enumerated devices Add ACPI ID for drv2604 haptics device found in Lenovo Yoga Book YB1-X91L tablet. Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260215141435.727872-4-jekhor@gmail.com Signed-off-by: Dmitry Torokhov commit c0347a38be6665986520abeba24a19cebfae68e3 Author: Yauhen Kharuzhy Date: Tue Feb 17 10:09:05 2026 -0800 Input: drv260x - sort all #include alphabetically Sort all #include directives alphabetically before adding new entries. Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260215141435.727872-3-jekhor@gmail.com Signed-off-by: Dmitry Torokhov commit c88c63f2710dae9a0e19d86ec7ff7038314a5603 Author: Yauhen Kharuzhy Date: Tue Feb 17 10:08:52 2026 -0800 Input: drv260x - add I2C IDs for all device variants Add drv2604(L) and drv2605 to the list of supported I2C device IDs for clarity. Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260215141435.727872-2-jekhor@gmail.com Signed-off-by: Dmitry Torokhov commit ffcdb6856a1be07ad46b38926dfb3bc053e98a8f Author: Michael Tretter Date: Tue Feb 17 22:53:08 2026 -0800 Input: st1232 - expose firmware version via sysfs Allow user space programs to read the firmware version and revision of the touch controller from the sysfs. Suggested-by: Khalid Talash Signed-off-by: Michael Tretter Link: https://patch.msgid.link/20260123-input-st1232-firmware-version-v1-2-32df7eefdafe@pengutronix.de Signed-off-by: Dmitry Torokhov commit 004703baa5a9352182307dd9a747e9411802df32 Author: Michael Tretter Date: Mon Feb 9 22:21:00 2026 -0800 Input: st1232 - read firmware version and revision According to the data sheet, the st1332 contains a firmware, which may be updated. The version and revision of the firmware may be read from the registers of the device. Read the firmware version and revision and report it to the log when probing the device. Suggested-by: Khalid Talash Signed-off-by: Michael Tretter Link: https://patch.msgid.link/20260123-input-st1232-firmware-version-v1-1-32df7eefdafe@pengutronix.de Signed-off-by: Dmitry Torokhov commit 9ff885ef8b428febbf41f13a511755d74704949e Author: Matthew Brost Date: Tue Feb 17 12:05:52 2026 -0800 drm/xe: Convert GT stats to per-cpu counters Current GT statistics use atomic64_t counters. Atomic operations incur a global coherency penalty. Transition to dynamic per-cpu counters using alloc_percpu(). This allows stats to be incremented via this_cpu_add(), which compiles to a single non-locking instruction. This approach keeps the hot-path updates local to the CPU, avoiding expensive cross-core cache invalidation traffic. Use for_each_possible_cpu() during aggregation and clear operations to ensure data consistency across CPU hotplug events. Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20260217200552.596718-1-matthew.brost@intel.com commit 48eb073c7d95883eca2789447f94e1e8cafbabe5 Author: Karthik Poosa Date: Fri Feb 6 13:46:55 2026 +0530 drm/xe/hwmon: Prevent unintended VRAM channel creation Remove the unnecessary VRAM channel entry introduced in xe_hwmon_channel. Without this, adding any new hwmon channel causes extra VRAM channel to appear. This remained unnoticed earlier because VRAM was the final xe hwmon channel. v2: Use MAX_VRAM_CHANNELS with in_range() instead of CHANNEL_VRAM_N_MAX. (Raag) Fixes: 49a498338417 ("drm/xe/hwmon: Expose individual VRAM channel temperature") Signed-off-by: Karthik Poosa Reviewed-by: Raag Jadav Link: https://patch.msgid.link/20260206081655.2115439-1-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi commit 6075dd69c57d203e6a5f97067860afe90c682e47 Author: Max Brener Date: Sat Feb 14 22:37:24 2026 +0200 Input: libps2 - embed WARN_ON(1) macros into their enclosing if statements Make WARN_ON(1) statements embedded inside their respective 'if' expressions, to improve code clarity. Signed-off-by: Max Brener Link: https://patch.msgid.link/20260214203725.6463-1-linmaxi@gmail.com Signed-off-by: Dmitry Torokhov commit 948e195dfaa56e48eabda591f97630502ff7e27e Author: Jocelyn Falempe Date: Thu Feb 12 11:05:54 2026 +0100 drm/panic: depends on PRINTK drm_panic uses kmsg_dump_register() to register its panic handler, so it won't work if CONFIG_PRINTK is not enabled. Let's not pretend it could work without PRINTK, and depends explicitly on it. Suggested-by: Michael Kelley Reviewed-by: Michael Kelley Link: https://patch.msgid.link/20260212100615.989957-1-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit 552399c4350fa818874de97abd943fdbc1ea3a7d Author: Imre Deak Date: Mon Feb 16 09:04:21 2026 +0200 drm/i915/dp_mst: Allow modes requiring compression for DSC passthrough The DSC passthrough mode allows a compressed stream to be forwarded to the sink instead of being decompressed at the last MST branch device, provided that the branch device supports passthrough and the sink supports decompression. This enables modes that would not be possible without compression, as the bandwidth required for the uncompressed stream exceeds what is available on the full MST path from source to sink. Currently, MST mode validation assumes the stream is uncompressed and uses the corresponding uncompressed minimum link BPP for bandwidth calculation. Use the minimum compressed link BPP instead when DSC passthrough is available to enable the modes described above. The non-passthrough DSC mode, where the last MST branch device decompresses the stream, may also allow enabling additional modes. This would require determining the link bandwidth between the last branch device and the sink based on the DFP_Link_Available_Payload_Bandwidth_Number reported by the branch device for the sink via the ENUM_PATH_RESOURCES MST message. Supporting this is left for a follow-up for the following reasons: 1. DFP Link Available PBN reporting is not supported by any of the available MST devices used for testing. 2. Non-passthrough mode would enable additional modes only if the link bandwidth between the last branch device and the sink exceeded that of the full MST path. Unless multiple MST devices are used, or link training forces a reduced bandwidth between the source and the first branch device, both rare cases, this is unlikely. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4332 Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260216070421.714884-5-imre.deak@intel.com commit f34c6b31d1b50c581da8bec97b86190faa49e7cb Author: Imre Deak Date: Mon Feb 16 09:04:20 2026 +0200 drm/i915/dp_mst: Track min link BPP as x16 fixed-point during mode validation Track the minimum link BPP as an x16 fixed-point value and, for clarity, rename the variable storing it to min_link_bpp_x16. Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260216070421.714884-4-imre.deak@intel.com commit 076c05a21aa8934c80b7a8210fc2a90df6a3cbd5 Author: Imre Deak Date: Mon Feb 16 09:04:19 2026 +0200 drm/i915/dp: Export intel_dp_compute_min_compressed_bpp_x16() Export intel_dp_compute_min_compressed_bpp_x16() for use by a follow-up change validating MST modes with DSC enabled. Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260216070421.714884-3-imre.deak@intel.com commit ec4db429fd38e5c5cbea3521049739fd2718845c Author: Imre Deak Date: Mon Feb 16 09:04:18 2026 +0200 drm/i915/dp: Add missing slice count check during mode validation Add the missing check for a valid slice count during mode validation when DSC is enabled. Cc: Vinod Govindapillai Fixes: 745395b51c26 ("drm/i915/dp: Add intel_dp_mode_valid_with_dsc()") Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260216070421.714884-2-imre.deak@intel.com commit 86566865986c4fa1963aace4ef5181501b2974c7 Merge: 9702969978695d fd15b9c6ec8a3a Author: Christian Brauner Date: Tue Feb 17 13:25:19 2026 +0100 Merge patch series "Avoid filesystem references to writeback internals" Kundan Kumar says: The series introduces writeback helper APIs and converts f2fs, gfs2 and nfs to stop accessing writeback internals directly. As suggested by Christoph [1], filesystem code that directly accesses writeback internals is split out: [1] https://lore.kernel.org/all/20251015072912.GA11294@lst.de/ * patches from https://patch.msgid.link/20260213054634.79785-1-kundan.kumar@samsung.com: nfs: stop using writeback internals for WB_WRITEBACK accounting gfs2: stop using writeback internals for dirty_exceeded check f2fs: stop using writeback internals for dirty_exceeded checks writeback: prep helpers for dirty-limit and writeback accounting Link: https://patch.msgid.link/20260213054634.79785-1-kundan.kumar@samsung.com Signed-off-by: Christian Brauner commit fd15b9c6ec8a3a6105a3295af52adea6d6e4cf59 Author: Kundan Kumar Date: Fri Feb 13 11:16:34 2026 +0530 nfs: stop using writeback internals for WB_WRITEBACK accounting Convert NFS WB_WRITEBACK accounting to writeback helper, eliminating direct access to writeback. Suggested-by: Christoph Hellwig Signed-off-by: Kundan Kumar Signed-off-by: Anuj Gupta Link: https://patch.msgid.link/20260213054634.79785-5-kundan.kumar@samsung.com Signed-off-by: Christian Brauner commit 8cab8dc0e141d7866c723cf7cb44ecaf7a97808c Author: Kundan Kumar Date: Fri Feb 13 11:16:33 2026 +0530 gfs2: stop using writeback internals for dirty_exceeded check Convert gfs2 dirty_exceeded handling to use the writeback core helper instead of accessing writeback directly. Reviewed-by: Jeff Layton Reviewed-by: Andreas Gruenbacher Suggested-by: Christoph Hellwig Signed-off-by: Kundan Kumar Signed-off-by: Anuj Gupta Link: https://patch.msgid.link/20260213054634.79785-4-kundan.kumar@samsung.com Signed-off-by: Christian Brauner commit 07043a6ebeb27a9f89b60484c163b20220f81325 Author: Kundan Kumar Date: Fri Feb 13 11:16:32 2026 +0530 f2fs: stop using writeback internals for dirty_exceeded checks Replace direct dereferences of dirty_exceeded with the core helper bdi_wb_dirty_exceeded(), removing f2fs dependencies on writeback internals. Reviewed-by: Jeff Layton Reviewed-by: Andreas Gruenbacher Suggested-by: Christoph Hellwig Signed-off-by: Kundan Kumar Signed-off-by: Anuj Gupta Link: https://patch.msgid.link/20260213054634.79785-3-kundan.kumar@samsung.com Signed-off-by: Christian Brauner commit a235d3bcd28ba2d472f5b4cb6b259baeab75bafd Author: Kundan Kumar Date: Fri Feb 13 11:16:31 2026 +0530 writeback: prep helpers for dirty-limit and writeback accounting Add helper APIs needed by filesystems to avoid poking into writeback internals. Reviewed-by: Jan Kara Reviewed-by: Jeff Layton Reviewed-by: Andreas Gruenbacher Suggested-by: Christoph Hellwig Signed-off-by: Kundan Kumar Signed-off-by: Anuj Gupta Link: https://patch.msgid.link/20260213054634.79785-2-kundan.kumar@samsung.com Signed-off-by: Christian Brauner commit 95162db0208aee122d10ac1342fe97a1721cd258 Author: Arnd Bergmann Date: Mon Feb 16 14:46:01 2026 +0100 drm/pagemap: pass pagemap_addr by reference Passing a structure by value into a function is sometimes problematic, for a number of reasons. Of of these is a warning from the 32-bit arm compiler: drivers/gpu/drm/drm_gpusvm.c: In function '__drm_gpusvm_unmap_pages': drivers/gpu/drm/drm_gpusvm.c:1152:33: note: parameter passing for argument of type 'struct drm_pagemap_addr' changed in GCC 9.1 1152 | dpagemap->ops->device_unmap(dpagemap, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1153 | dev, *addr); | ~~~~~~~~~~~ This particular problem is harmless since we are not mixing compiler versions inside of the compiler. However, passing this by reference avoids the warning along with providing slightly better calling conventions as it avoids an extra copy on the stack. Fixes: 75af93b3f5d0 ("drm/pagemap, drm/xe: Support destination migration over interconnect") Fixes: 2df55d9e66a2 ("drm/xe: Support pcie p2p dma as a fast interconnect") Signed-off-by: Arnd Bergmann Reviewed-by: Thomas Hellström Signed-off-by: Thomas Hellström Link: https://patch.msgid.link/20260216134644.1025365-1-arnd@kernel.org Acked-by: Maarten Lankhorst commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad Author: Rahul Bukte Date: Tue Feb 3 10:18:39 2026 +0530 drm/i915/gt: Check set_default_submission() before deferencing When the i915 driver firmware binaries are not present, the set_default_submission pointer is not set. This pointer is dereferenced during suspend anyways. Add a check to make sure it is set before dereferencing. [ 23.289926] PM: suspend entry (deep) [ 23.293558] Filesystems sync: 0.000 seconds [ 23.298010] Freezing user space processes [ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds) [ 23.309766] OOM killer disabled. [ 23.313027] Freezing remaining freezable tasks [ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [ 23.342038] serial 00:05: disabled [ 23.345719] serial 00:02: disabled [ 23.349342] serial 00:01: disabled [ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache [ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache [ 23.361635] ata1.00: Entering standby power mode [ 23.368863] ata2.00: Entering standby power mode [ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 23.452194] #PF: supervisor instruction fetch in kernel mode [ 23.457896] #PF: error_code(0x0010) - not-present page [ 23.463065] PGD 0 P4D 0 [ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI [ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary) [ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN [ 23.496511] Workqueue: async async_run_entry_fn [ 23.501087] RIP: 0010:0x0 [ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246 [ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f [ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000 [ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff [ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8 [ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68 [ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000 [ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0 [ 23.572539] PKRU: 55555554 [ 23.575281] Call Trace: [ 23.577770] [ 23.579905] intel_engines_reset_default_submission+0x42/0x60 [ 23.585695] __intel_gt_unset_wedged+0x191/0x200 [ 23.590360] intel_gt_unset_wedged+0x20/0x40 [ 23.594675] gt_sanitize+0x15e/0x170 [ 23.598290] i915_gem_suspend_late+0x6b/0x180 [ 23.602692] i915_drm_suspend_late+0x35/0xf0 [ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10 [ 23.611843] dpm_run_callback+0x78/0x1c0 [ 23.615817] device_suspend_late+0xde/0x2e0 [ 23.620037] async_suspend_late+0x18/0x30 [ 23.624082] async_run_entry_fn+0x25/0xa0 [ 23.628129] process_one_work+0x15b/0x380 [ 23.632182] worker_thread+0x2a5/0x3c0 [ 23.635973] ? __pfx_worker_thread+0x10/0x10 [ 23.640279] kthread+0xf6/0x1f0 [ 23.643464] ? __pfx_kthread+0x10/0x10 [ 23.647263] ? __pfx_kthread+0x10/0x10 [ 23.651045] ret_from_fork+0x131/0x190 [ 23.654837] ? __pfx_kthread+0x10/0x10 [ 23.658634] ret_from_fork_asm+0x1a/0x30 [ 23.662597] [ 23.664826] Modules linked in: [ 23.667914] CR2: 0000000000000000 [ 23.671271] ------------[ cut here ]------------ Signed-off-by: Rahul Bukte Reviewed-by: Suraj Kandpal Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260203044839.1555147-1-suraj.kandpal@intel.com commit 08d05c736605fb3dd3852a37c8bf20cd0fc2e08b Author: Maarten Lankhorst Date: Fri Feb 6 12:21:14 2026 +0100 drm/xe: Remove xe_ggtt_node_allocated With the intermediate state gone, no longer useful. Just check against NULL where needed. After looking carefully, the check for allocated in xe_fb_pin.c is unneeded. vma->node is never NULL. The check is specifically only to check if vma->node == the bo's root tile ggtt_obj. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20260206112108.1453809-12-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit a4eac88e313529e6c0bc67e28061a481b08a6477 Author: Maarten Lankhorst Date: Fri Feb 6 12:21:13 2026 +0100 drm/xe: Make xe_ggtt_node_insert return a node This extra step is easier to handle inside xe_ggtt.c and makes xe_ggtt_node_allocated a simple null check instead, as the intermediate state 'allocated but not inserted' is no longer used. Privatize xe_ggtt_node_fini() and init() as they're no longer used outside of xe_ggtt.c Reviewed-by: Matthew Brost #v1 Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20260206112108.1453809-11-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 95f5f9a96dcfb2982af28d0915598bad3abb8b86 Author: Maarten Lankhorst Date: Fri Feb 6 12:21:12 2026 +0100 drm/xe: Move struct xe_ggtt to xe_ggtt.c No users left outside of xe_ggtt.c, so we can make the struct private. This prevents us from accidentally touching it before init. Reviewed-by: Matthew Brost Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20260206112108.1453809-10-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit e904c56ba6e0d4eff5f48a70356fd5d764c2a966 Author: Maarten Lankhorst Date: Fri Feb 6 12:21:11 2026 +0100 drm/xe: Rewrite GGTT VF initialization The previous code was using a complicated system with 2 balloons to set GGTT size and adjust GGTT offset. While it works, it's overly complicated. A better approach is to set the offset and size when initializing GGTT, this removes the need for adding balloons. The resize function only needs readjust ggtt->start to have GGTT at the new offset. This removes the need to manipulate the internals of xe_ggtt outside of xe_ggtt, and cleans up a lot of now unneeded code. Co-developed-by: Matthew Brost Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20260206112108.1453809-9-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 7feebdb041a99ff4bfac72f1a18de44de2ed5d63 Author: Maarten Lankhorst Date: Fri Feb 6 12:21:10 2026 +0100 drm/xe: Make xe_ggtt_node offset relative to starting offset Fix all functions that use node->start to use xe_ggtt_node_addr, and add ggtt->start to node->start. This will make node shifting for SR-IOV VF a one-liner, instead of manually changing each GGTT node's base address. Also convert some uses of mutex_lock/unlock to mutex guards. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20260206112108.1453809-8-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 0ef1dcf4c16bb6d90e8fbf7b18f3d76b79fcde9d Author: Marco Crivellari Date: Wed Nov 5 11:11:34 2025 +0100 drm/vc4: hdmi: replace use of system_wq with system_percpu_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Maíra Canal Link: https://patch.msgid.link/20251105101134.82064-1-marco.crivellari@suse.com Signed-off-by: Maíra Canal commit 20e0c197802c545db220157fafd567a10f2b7672 Author: Timur Tabi Date: Mon Feb 9 16:40:36 2026 -0600 drm/nouveau/gsp: add support for GA100 GA100 is a compute-only variant of GA102 that boots GSP-RM like a Turing. Although architecturally like an Ampere, GA100 uses the same GSP-RM firmware files as Turing, and therefore must boot it like Turing does. In addition, as a compute-only part, GA100 has no display engine, no VBIOS, and no graphics (GR) engine. Since it doesn't have VBIOS, there is no FWSEC firmware, and so there is no FRTS region that needs to be reserved or initialized. Although Nouveau now supports GA100, there is currently no real support for this GPU with either Clover or Rusticl/NVK, as both require a 3D engine. This is in contrast with GH100, which does contain a GR engine and is supported. Also note that this patch partially reverts commit e8b3627bec35 ("nouveau: don't attempt fwsec on sb on newer platforms."), which added fwsec pointers to struct ga100_gsp erroneously. Signed-off-by: Timur Tabi Acked-by: John Hubbard Reviewed-by: Dave Airlie Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260209224036.3283326-1-ttabi@nvidia.com commit 4a175759e30cde8182ae9c65fad5cf35864546a0 Author: Jani Nikula Date: Thu Feb 12 15:12:06 2026 +0200 drm/xe: remove unnecessary struct dram_info forward declaration There's no longer any need for the struct dram_info forward declaration. Remove it. Signed-off-by: Jani Nikula Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260212131206.1804113-1-jani.nikula@intel.com Signed-off-by: Matt Roper commit e8bd92c4a0d2ee0fe8ee2b33c94dcffb3a39749b Author: Hongyang Zhao Date: Sat Feb 7 15:32:55 2026 +0800 drm/bridge: lt9611: Add support for single Port B input The LT9611 has two DSI input ports. The driver currently assumes Port A is always used for single-port configurations. However, some boards connect DSI to Port B only. Update the driver to detect which ports are populated from devicetree and configure the hardware accordingly: - If only port@1 (Port B) is populated, configure port swap (0x8303 bit 6) and byte_clk source (0x8250 bit 3:2) for Port B operation - If both ports are populated, use dual-port mode (Port A + B) - If only port@0 (Port A) is populated, use single Port A (existing behavior) Reviewed-by: Dmitry Baryshkov Signed-off-by: Hongyang Zhao Reviewed-by: Roger Shimizu Tested-by: Roger Shimizu Link: https://patch.msgid.link/20260207-rubikpi-next-20260116-v3-2-23b9aa189a3a@thundersoft.com Signed-off-by: Dmitry Baryshkov commit 5ae47f510f38ba125b3bf213735f70d90a44e52b Author: Hongyang Zhao Date: Sat Feb 7 15:32:54 2026 +0800 dt-bindings: display: lt9611: Support single Port B input The LT9611 has two DSI input ports (Port A and Port B). Update the binding to clearly document the port mapping and allow using Port B alone when DSI is physically connected to Port B only. Changes: - Clarify port@0 corresponds to DSI Port A input - Clarify port@1 corresponds to DSI Port B input - Change port requirement from mandatory port@0 to anyOf port@0/port@1, allowing either port to be used independently Reviewed-by: Neil Armstrong Signed-off-by: Hongyang Zhao Reviewed-by: Rob Herring (Arm) Reviewed-by: Roger Shimizu Tested-by: Roger Shimizu Link: https://patch.msgid.link/20260207-rubikpi-next-20260116-v3-1-23b9aa189a3a@thundersoft.com Signed-off-by: Dmitry Baryshkov commit 4c51f90d45dca71e7974ed5a7c40b9c04a6c6762 Author: Saket Kumar Bhaskar Date: Thu Feb 12 14:55:58 2026 +0530 selftests/bpf: Add powerpc support for get_preempt_count() in selftest get_preempt_count() is enabled to return preempt_count for powerpc, so that bpf_in_interrupt()/bpf_in_nmi()/bpf_in_serving_softirq()/ bpf_in_task()/bpf_in_hardirq()/get_preempt_count() works for powerpc as well. Signed-off-by: Saket Kumar Bhaskar Tested-by: Venkat Rao Bagalkote Link: https://lore.kernel.org/r/20260212092558.370623-1-skb99@linux.ibm.com Signed-off-by: Alexei Starovoitov commit bd86ab5bbe3c0d61bfcbe1ba12e693b82f419cfb Merge: f632de6e195533 3d91c618aca403 Author: Alexei Starovoitov Date: Fri Feb 13 14:41:23 2026 -0800 Merge branch 'bpf-consolidate-pointer-offset-tracking-in-var_off' Eduard Zingerman says: ==================== bpf: consolidate pointer offset tracking in var_off Consolidate static and varying pointer offset tracking logic in the BPF verifier. All pointer offsets are now represented solely using `reg->var_off` and min/max fields, simplifying pointer tracking code and making it easier to widen pointer registers for loop convergence checks. Patch 1 is a preparatory refactoring of check_reg_sane_offset(). Patch 2 is the main change, moving pointer offsets from `reg->off` to `reg->var_off`. Patch 3 removes references to `reg->off` in netronome code. Patch 4 renames the now-repurposed `reg->off` field to `reg->delta`, reflecting its remaining role as a constant delta between linked scalar registers. Note: netronome changes are compile-tested only! Changelog: v1 -> v2: - put back WARN_ON_ONCE in mark_ptr_or_null_reg() (Alexei). - references to `ptr->off` field are removed from netronome code (bot+bpf-ci, kernel test robot). - fix for a comment referencing `ptr->off` in bpf_verifier.h (bot+bpf-ci). v1: https://lore.kernel.org/bpf/20260211-ptrs-off-migration-v1-0-996c2a37b063@gmail.com/ --- ==================== Link: https://patch.msgid.link/20260212-ptrs-off-migration-v2-0-00820e4d3438@gmail.com Signed-off-by: Alexei Starovoitov commit 3d91c618aca403a7f7d2064272f528a97b849475 Author: Eduard Zingerman Date: Thu Feb 12 13:34:24 2026 -0800 bpf: rename bpf_reg_state->off to bpf_reg_state->delta This field is now used only for linked scalar registers tracking. Rename it to 'delta' to better describe it's purpose: constant delta between "linked" scalars with the same ID. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260212-ptrs-off-migration-v2-4-00820e4d3438@gmail.com Signed-off-by: Alexei Starovoitov commit 6363fc17c9f5952ce40c2fe779892511e371a359 Author: Eduard Zingerman Date: Thu Feb 12 13:34:23 2026 -0800 nfp: bpf: remove references to bpf_reg_state->off for pointers Previous commit changed BPF verifier to track pointer offsets entirely in bpf_reg_state->var_off. This commit removes references to bpf_reg_state->off in netronome code. - In most of the places `.off` field is used as a part of a sum: `reg->off + reg->var_off.value`. In such code the `reg->off` addend is removed. - Function jit.c:cross_mem_access() uses `.off` but ignores `.var_off` to compute memory access offset. Here access to `.off` is replaced with access to `.var_off.value`. verifier.c:nfp_bpf_check_ptr() rejects programs for which !tnum_is_const(reg->var_off), so the above change will read a valid constant. Not sure why `.var_off` was ignored in this function previously. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260212-ptrs-off-migration-v2-3-00820e4d3438@gmail.com Signed-off-by: Alexei Starovoitov commit 022ac075088366b62e130da5e1b200bc93a47191 Author: Eduard Zingerman Date: Thu Feb 12 13:34:22 2026 -0800 bpf: use reg->var_off instead of reg->off for pointers This commit consolidates static and varying pointer offset tracking logic. All offsets are now represented solely using `.var_off` and min/max fields. The reasons are twofold: - This simplifies pointer tracking code, as each relevant function needs to check the `.var_off` field anyway. - It makes it easier to widen pointer registers for the purpose of loop convergence checks, by forgoing the `regsafe()` logic demanding `.off` fields to be identical. The changes are spread across many functions and are hard to group into smaller patches. Some of the logical changes include: - Checks in __check_ptr_off_reg() are reordered so that the tnum_is_const() check is done before operating on reg->var_off.value. - check_packet_access() now uses check_mem_region_access() to handle possible 'off' overflow cases. - In check_helper_mem_access() utility functions like check_packet_access() are now called with 'off=0', as these utility functions now account for the complete register offset range. - In check_reg_type() a call to __check_ptr_off_reg() is added before a call to btf_struct_ids_match(). This prevents btf_struct_ids_match() from potentially working on non-constant reg->var_off.value. - regsafe() is relaxed to avoid comparing '.off' field for pointers. As a precaution, the changes are verified in [1] by adding a pass checking that no pointer has non-zero '.off' field on each do_check_insn() iteration. [1] https://github.com/eddyz87/bpf/tree/ptrs-off-migration Notable selftests changes: - `.var_off` value changed because it now combines static and varying offsets. Affected tests: - linked_list/incorrect_node_var_off - linked_list/incorrect_head_var_off2 - verifier_align/packet_variable_offset - Overflowing `smax_value` bound leads to a pointer with big negative or positive offset to be rejected immediately (previously overflowing `rX += const` instruction updated `.off` field avoiding the overflow). Affected tests: - verifier_align/dubious_pointer_arithmetic - verifier_bounds/var_off_insn_off_test1 - Invalid access to packet now reports full offset inside a packet. Affected tests: - verifier_direct_packet_access/test23_x_pkt_ptr_4 - A change in check_mem_region_access() behavior: when register `.smin_value` is negative, it reports "rX min value is negative..." before calling into __check_mem_access() which reports "invalid access to ...". In the tests below, the `.off` field was negative, while `.smin_value` remained positive. This is no longer the case after the changes in this commit. Affected tests: - verifier_gotox/jump_table_invalid_mem_acceess_neg - verifier_helper_packet_access/test15_cls_helper_fail_sub - verifier_helper_value_access/imm_out_of_bound_2 - verifier_helper_value_access/reg_out_of_bound_2 - verifier_meta_access/meta_access_test2 - verifier_value_ptr_arith/known_scalar_from_different_maps - lower_oob_arith_test_1 - value_ptr_known_scalar_3 - access_value_ptr_known_scalar - Usage of check_mem_region_access() instead of __check_mem_access() in check_packet_access() changes the reported message from "rX offset is outside ..." to "rX min/max value is outside ...". Affected tests: - verifier_xdp_direct_packet_access/* - In check_func_arg_reg_off() the check for zero offset now operates on `.var_off` field instead of `.off` field. For tests where the pattern looks like `kfunc(reg_with_var_off, ...)`, this changes the reported error: - previously the error "variable ... access ... disallowed" was reported by __check_ptr_off_reg(); - now "R1 must have zero offset ..." is reported by check_func_arg_reg_off() itself. Affected tests: - verifier/calls.c "calls: invalid kfunc call: PTR_TO_BTF_ID with variable offset" Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260212-ptrs-off-migration-v2-2-00820e4d3438@gmail.com Signed-off-by: Alexei Starovoitov commit ed20a14309e09216d1fa86e12b1578fa822119b4 Author: Eduard Zingerman Date: Thu Feb 12 13:34:21 2026 -0800 bpf: split check_reg_sane_offset() in two parts check_reg_sane_offset() is used when verifying operations like: dst_reg += src_reg ^ ^ | '-------- scalar '------------------- pointer To verify range for both dst_reg and src_reg. Split it in two parts: - one to check a pointer offset - another to check scalar offset This would be useful for further refactoring. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260212-ptrs-off-migration-v2-1-00820e4d3438@gmail.com Signed-off-by: Alexei Starovoitov commit f632de6e195533426017187b85f55f6169b09a50 Author: Eduard Zingerman Date: Tue Feb 10 21:13:10 2026 -0800 selftests/bpf: Migrate align.c tests to test_loader framework While working on pointer tracking changes I found it necessary to update expected log messages in align.c series of tests. As a preliminary step, migrate these tests to test_loader framework. The tests in question load BPF program and check if expected log is produced, the log is specified as: .matches = { ... {4, "R3", "32"}, ... } Where: - '4' is an *instruction number* (contrary to the field name in struct bpf_reg_match). - 'R3' is the name of the register to check. - '32' is the value expected for this register. Mimic the same logic using __msg macro. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260211051310.2782558-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 2405ba53ffe8dad77c530677bfec4c601bd2110a Author: Matthew Brost Date: Thu Feb 12 12:42:27 2026 -0800 drm/xe: Avoid touching consumer fields in GuC pagefault ack The GuC pagefault acknowledgment code is designed to extract the fields needed for the acknowledgment from the producer-stored message so that the consumer fields can be overloaded to return additional information. The ASID is stored in the producer message; extract it from there to future‑proof this logic. Signed-off-by: Matthew Brost Reviewed-by: Francois Dugast Link: https://patch.msgid.link/20260212204227.2764054-3-matthew.brost@intel.com commit 68be2bfe4bcd70932a3dcb2eb20398933b5f454f Author: Matthew Brost Date: Thu Feb 12 12:42:26 2026 -0800 drm/xe: Pack fault type and level into a u8 Pack the fault type and level fields into a single u8 to save space in struct xe_pagefault. This also makes future extensions easier. Signed-off-by: Matthew Brost Reviewed-by: Francois Dugast Link: https://patch.msgid.link/20260212204227.2764054-2-matthew.brost@intel.com commit 2882094e0db192c431db14aab09cc08d18dcd059 Author: Arvind Yadav Date: Thu Feb 12 12:29:20 2026 +0530 drm/xe/xe2: Apply Wa_14024997852 Applied Wa_14024997852 to Graphics version 20.01 to 20.04 Whitelist registers needed for userspace to control autostrip on xe2. v2: - set Bit 31 of FF_MODE, for TE autostrip disable (Nitin) v3: - Need to whitelist these for Xe2 IPs (MATT R) v4: - Combine these into a single range for simplicity:(2001, 3005) (MATT R) Cc: Tejas Upadhyay Reviewed-by: Nitin Gote Reviewed-by: Matt Roper Signed-off-by: Arvind Yadav Link: https://patch.msgid.link/20260212065920.1815979-1-arvind.yadav@intel.com Signed-off-by: Matt Roper commit c020fff70d757612933711dd3cc3751d7d782d3c Author: Raag Jadav Date: Thu Feb 12 11:26:22 2026 +0530 drm/xe/bo: Redirect faults to dummy page for wedged device As per uapi documentation[1], the prerequisite for wedged device is to redirected page faults to a dummy page. Follow it. [1] Documentation/gpu/drm-uapi.rst v2: Add uapi reference and fixes tag (Matthew Brost) Fixes: 7bc00751f877 ("drm/xe: Use device wedged event") Signed-off-by: Raag Jadav Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260212055622.2054991-1-raag.jadav@intel.com Signed-off-by: Matt Roper commit aafbb42be589d4a3d282b377f50a1ddb42400628 Author: Piotr Piórkowski Date: Wed Feb 11 18:14:41 2026 +0100 drm/xe: Force EXEC_QUEUE_FLAG_KERNEL for kernel internal VMs VMs created without an associated xe_file originate from kernel contexts and should use kernel exec queues. Ensure such VMs create bind exec queues with EXEC_QUEUE_FLAG_KERNEL set. Let's ensure bind exec queues created for kernel VMs are always marked with EXEC_QUEUE_FLAG_KERNEL. Signed-off-by: Piotr Piórkowski Reviewed-by: Matthew Brost Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260211171441.3246686-1-piotr.piorkowski@intel.com commit 1ff4b1730ca421de6bd84b871f68107b9ae46bcf Author: Matt Roper Date: Wed Feb 11 15:47:36 2026 -0800 drm/xe: Stop applying Wa_16018737384 from Xe3 onward Wa_16018737384 is one of the rare cases where the hardware teams mark a workaround as "driver change required" rather than "permanent/temporary workaround" in the internal workaround database, signifying that the implementation details of the workaround should just be considered standard programming instructions on all platforms going forward. Cases like this are the only time that using XE_RTP_END_VERSION_UNDEFINED as an upper bound for a workaround's IP range is warranted and correct. However in this specific case, the register bit in question (0xE4F0[1]) simply no longer exists in hardware from Xe3 onward. Trying to write to that bit on Xe3 or Xe3p platforms is harmless and just doesn't have any effect, but it's possible that the register bit could get repurposed to control something else down the road on future platforms. To avoid any surprises in the future we should replace the unbounded upper bound in our RTP table with a value that accurately reflects that Wa_16018737384 can only apply to Xe2 platforms. Bspec: 56849 Reviewed-by: Dnyaneshwar Bhadane Link: https://patch.msgid.link/20260211234735.620087-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit b5b55d0932eef682b648e456df177430968e19d5 Author: Matt Roper Date: Tue Feb 10 10:25:19 2026 -0800 drm/xe/xe3p_xpc: Add new XeCore fuse registers to VF runtime regs SRIOV VFs do not automatically have access to the XeCore fuse registers. Add the two new registers that show up on Xe3p_XPC to the runtime register list to grant VFs access. Since there's a single runtime register list for all Xe3p, this will technically also grant access on Xe3p_LPG platforms where the registers don't exist, but that should be harmless since even if a VF tries to read a non-existent register on those platforms it will just get back a sensible value of 0x0. Fixes: e8100643ff01 ("drm/xe/xe3p_xpc: XeCore mask spans four registers") Cc: Michal Wajdeczko Reviewed-by: Ngai-Mint Kwan Link: https://patch.msgid.link/20260210182519.206952-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 59dbcb6fc389850c23066373e1e88ffdf8abb896 Author: Imre Deak Date: Wed Feb 11 13:58:11 2026 +0200 drm/i915/dp: Clamp the connector max_bpc request to the valid pipe bpp range The user's request for a maximum BPC - via the max-bpc connector property - determines the pipe BPP selected by the encoder, which is in turn used either as the uncompressed output BPP or as the input BPP for the DSC engine. This user-requested BPC->BPP can be outside of the source/sink's supported valid min/max pipe BPP range and atm such an out-of-bound request will be rejected by the encoder's state computation. As opposed to the above, the semantics for the max-bpc connector property - which the user may reasonably expect - should not be to fail the modeset in case of an out-of-bound max BPC request, but rather to adjust the request, clamping it to the valid BPP range. Based on the above, calculate the baseline (i.e. the non-DP specific platform/EDID) _maximum_ pipe BPP, storing it in intel_crtc_state::max_pipe_bpp, separately from the baseline _target_ pipe BPP (which is the lower BPP of the baseline maximum and requested maximum BPP, stored in intel_crtc_state::pipe_bpp). This allows the encoder state computation to use the baseline maximum pipe BPP as a hard limit for the selected pipe BPP, while also letting it use the baseline target pipe BPP only as a preference, clamping this target BPP to the valid DP pipe BPP range. v2: - Fix typos in the commit message. (Michał) - Clarify code comment's reference to the baseline max BPP value. (Ankit) Reviewed-by: Michał Grzelak Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260211115811.508496-2-imre.deak@intel.com commit 9f77d4c363f7f487f53da63f040a3d81f27f5c7e Author: Imre Deak Date: Wed Feb 11 13:58:10 2026 +0200 drm/i915/display: Clarify target pipe bpp variable name in compute_sink_pipe_bpp() Clarify that the baseline pipe BPP - i.e. the non-DP specific platform/EDID maximum BPP limited by any user-requested max-bpc setting - set by compute_sink_pipe_bpp() is a baseline _target_ pipe BPP. This target BPP can get either rejected or adjusted (lowering or increasing it as needed) by the encoder state computation based on other constraints, like a minimum pipe BPP dictated by a non-RGB output format (24 BPP) or a min/max DSC input BPP dictated by a DSC sink. Whether an out-of-bound target BPP is adjusted or rejected depends on the max-bpc property's semantics assumed by the driver, which is atm to reject such a request. A follow-up change will also compute the baseline _maximum_ pipe BPP, which is the non-DP specific platform/EDID maximum BPP w/o the requested max-bpc adjustment and as such is a hard limit: the encoder state computation must ensure that the final BPP selected for the modeset is below this maximum. Tracking the baseline maximum pipe BPP separately will allow for adjusting the baseline target BPP as needed, clamping it to the valid DP min/max pipe BPP range, instead of rejecting an out-of-bound BPC/BPP request. To clarify the above semantics rename bpp in compute_sink_pipe_bpp() to target_pipe_bpp in this patch, preparing for a follow-up change also computing max_pipe_bpp in the same function. v2: Fix typos in the commit log. (Michał) Reviewed-by: Michał Grzelak Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260211115811.508496-1-imre.deak@intel.com commit 6d83ef1adaae89c2b85ec486ec90397538deba1b Author: Raag Jadav Date: Thu Feb 5 17:04:24 2026 +0530 drm/xe: Update xe_device_declare_wedged() error log Since the introduction of DRM wedged event, there are now a few different procedures to recover the device depending on selected recovery method. Update the error log to reflect this and point the user to correct documentation for it. Signed-off-by: Raag Jadav Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260205113424.1629204-1-raag.jadav@intel.com Signed-off-by: Rodrigo Vivi commit 949d39a97b35fb8e7d088e15085174822f29eb06 Author: Uma Shankar Date: Thu Feb 5 15:13:41 2026 +0530 drm/{i915, xe}: Remove i915_reg.h from display Make display files free from including i915_reg.h. v2: Move pcode_regs.h out of i915_reg.h (Jani) Signed-off-by: Uma Shankar Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260205094341.1882816-21-uma.shankar@intel.com commit 80809c91fbd7bae15ed59530342d390e2d885bfd Author: Uma Shankar Date: Thu Feb 5 15:13:40 2026 +0530 drm/i915: Remove i915_reg.h from intel_modeset_setup.c Move GEN9_CLKGATE_DIS_0 reg to display header to make intel_modeset_setup.c free from i915_reg.h include. v2: Remove from gmd common header and use display_regs.h (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-20-uma.shankar@intel.com commit b4c9ae4eb4ea0c766e3401b92adce2b9c151192f Author: Uma Shankar Date: Thu Feb 5 15:13:39 2026 +0530 drm/i915: Remove i915_reg.h from intel_display_power_well.c Make intel_display_power_well.c free from including i915_reg.h. v3: Separate bit field for VLV (Ville) v2: Include specific pcode header, drop common header (Jani) Signed-off-by: Uma Shankar Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260205094341.1882816-19-uma.shankar@intel.com commit 6ef8bf1e2c110ac5a2065b8dc945dffba999db5a Author: Uma Shankar Date: Thu Feb 5 15:13:38 2026 +0530 drm/i915: Remove i915_reg.h from intel_display_irq.c Move VLV_IRQ_REGS to common header for interrupt to make intel_display_irq.c free from including i915_reg.h. v2: Move interrupt to dedicated header (Jani) Signed-off-by: Uma Shankar Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260205094341.1882816-18-uma.shankar@intel.com commit 1506ba800f5843f990304440121ca245bc1ffccf Author: Uma Shankar Date: Thu Feb 5 15:13:37 2026 +0530 drm/i915: Remove i915_reg.h from intel_fifo_underrun.c Move GEN7_ERR_INT reg to common header to make intel_fifo_underrun.c free from including i915_reg.h. v2: Move GEN7_ERR_INT regs to display header (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-17-uma.shankar@intel.com commit 8ed752123d5076ef87ba401434e09d0c199ab373 Author: Uma Shankar Date: Thu Feb 5 15:13:36 2026 +0530 drm/i915: Remove i915_reg.h from intel_psr.c Move some chicken registers to display header to make intel_psr.c free from including i915_reg.h. v3: Update commit header v2: Use display header instead of gmd common include (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-16-uma.shankar@intel.com commit 5344a8bb51e4b0ec2ae7270b941e40983d37d485 Author: Uma Shankar Date: Thu Feb 5 15:13:35 2026 +0530 drm/i915: Remove i915_reg.h from intel_rom.c Make intel_rom.c free from including i915_reg.h. v5: Use SPDX (Jani) v4: Move oprom reg to separate header (Ville) v3: Update patch header v2: Use display header instead of gmd common include (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-15-uma.shankar@intel.com commit 1a3c0049b3f56278c9caf2784c53f6ab435fd12c Author: Thomas Hellström Date: Wed Feb 11 11:41:59 2026 +0100 Revert "drm/pagemap: Disable device-to-device migration" With commit a69d1ab971a6 ("mm: Fix a hmm_range_fault() livelock / starvation problem") device-to-device migration is not functional again and the disabling can be reverted. Add the above commit as a Fixes: tag in order for the revert to not take place unless that commit is present. This reverts commit 10dd1eaa80a56d3cf6d7c36b5269c8fed617f001. Cc: Matthew Brost Fixes: a69d1ab971a6 ("mm: Fix a hmm_range_fault() livelock / starvation problem") Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260211104159.114947-1-thomas.hellstrom@linux.intel.com commit 22625d19470c317ee7a7627d4382f1102473d69d Author: Uma Shankar Date: Thu Feb 5 15:13:34 2026 +0530 drm/{i915, xe}: Remove i915_reg.h from g4x_hdmi.c Move TRANS_CHICKEN1 reg to display header to make g4x_hdmi.c free from i915_reg.h dependency. v2: Remove from common header in include and use display_regs.h (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-14-uma.shankar@intel.com commit a8454813854d93649dd21bc926e7c6f1d0c83e3c Author: Uma Shankar Date: Thu Feb 5 15:13:33 2026 +0530 drm/i915: Remove i915_reg.h from i9xx_wm.c Move FW_BLC_SELF to common header to make i9xx_wm.c free from i915_reg.h include. Introduce a common intel_gmd_misc_regs.h to define common miscellaneous register definitions across graphics and display. v3: MISC header included as needed, drop from i915_reg (Jani) v2: Introdue a common misc header for GMD Signed-off-by: Uma Shankar Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260205094341.1882816-13-uma.shankar@intel.com commit 5504f1ac92824ac3519f66439c07ddf025228fec Author: Uma Shankar Date: Thu Feb 5 15:13:32 2026 +0530 drm/i915: Remove i915_reg.h from g4x_dp.c Move DE_IRQ_REGS to display header to make g4x_dp.c free from i915_reg.h dependency. These registers are only used by display and gvt. v3: Drop a superfluous include (Jani) v2: Move DE interrupt regs from common to display header (Jani) Signed-off-by: Uma Shankar Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260205094341.1882816-12-uma.shankar@intel.com commit 85bba73b29f4ae923ad508a4ce8a87c1c1ec518f Author: Uma Shankar Date: Thu Feb 5 15:13:31 2026 +0530 drm/i915: Remove i915_reg.h from intel_overlay.c Move GEN2_ISR and some interrupt definitions to common header. This removes dependency of i915_reg.h from intel_overlay.c. v3: Rename interrupt header with regs suffix (Jani) v2: Create a separate file for common interrupts (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-11-uma.shankar@intel.com commit 07437917a35f912db713883969d2d328e518b671 Author: Uma Shankar Date: Thu Feb 5 15:13:30 2026 +0530 drm/i915: Remove i915_reg.h from intel_display.c Move CHICKEN_PIPESL_1 register definition to display header. This allows intel_display.c free of i915_reg.h include. v3: Fix commit header (Jani) v2: Drop common header in include and use display_regs.h (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-10-uma.shankar@intel.com commit f070238027aed0e7e9fede4107ac9fad05068653 Author: Uma Shankar Date: Thu Feb 5 15:13:29 2026 +0530 drm/i915: Remove i915_reg.h from intel_dram.c Make intel_dram.c free from including i915_reg.h. v3: Move MEM_SS info reg to display instead of pcode header (Jani) v2: Move mem config register to newly added pcode header (Jani) Signed-off-by: Uma Shankar Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260205094341.1882816-9-uma.shankar@intel.com commit 8b21f7538b1e5b150aa67bfae025f0181d0adc26 Author: Uma Shankar Date: Thu Feb 5 15:13:28 2026 +0530 drm/i915: Move GMD_ID and mask to intel_gt header GMD_ID* is relevant only for GT, hence moving the same together in gt/intel_gt_regs.h Signed-off-by: Uma Shankar Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260205094341.1882816-8-uma.shankar@intel.com commit 08b970ab01c94e9e79e57695bfdcc48df3d179ba Author: Uma Shankar Date: Thu Feb 5 15:13:27 2026 +0530 drm/i915: Remove i915_reg.h from intel_display_device.c Move GU_CNTL_PROTECTED and GMD_ID_DISPLAY to common header, this helps intel_display_device.c free from i915_reg.h dependency. v2: Move GMD_ID_DISPLAY to display header instead of common (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-7-uma.shankar@intel.com commit 15e86b3abdc20f62e0ab8fed0030ff39e7320587 Author: Uma Shankar Date: Thu Feb 5 15:13:26 2026 +0530 drm/{i915, xe}: Extract pcode definitions to common header There are certain register definitions which are commonly shared by i915, xe and display. Extract the same to a common header to avoid duplication. Move GEN6_PCODE_MAILBOX to common pcode header to make intel_cdclk.c free from including i915_reg.h. v3: Include pcode header as required, instead in i915_reg.h (Jani) v2: Make the header granular and per feature (Jani) Signed-off-by: Uma Shankar Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260205094341.1882816-6-uma.shankar@intel.com commit 27442c5fe702acdb8fd8bc4fa4916f6131a9861c Author: Uma Shankar Date: Thu Feb 5 15:13:25 2026 +0530 drm/i915: Extract DSPCLK_GATE_D from i915_reg to display Move DSPCLK_GATE_D register definition to display header. This allows intel_gmbus.c not to include i915_reg.h. v3: Update commit header and message (Jani) v2: Drop common header in include and use display_regs.h (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-5-uma.shankar@intel.com commit b425c278e14c2c1a82e58cd1e3c21affb7c8edd3 Author: Uma Shankar Date: Thu Feb 5 15:13:24 2026 +0530 drm/i915: Extract display interrupt definitions Extract DE Interrupt registers from i915_reg.h to display header. This allows intel_display_rps.c not to include i915_reg.h v2: Update commit message (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-4-uma.shankar@intel.com commit 0ca7e27a465cd16a80acf198dc568c3810df5585 Author: Uma Shankar Date: Thu Feb 5 15:13:23 2026 +0530 drm/i915: Extract South chicken registers from i915_reg.h to display Extract South Chicken registers from i915_reg.h to display header. This allows intel_pch_refclk.c not to include i915_reg.h v3: Drop whitespace changes, commit header updated (Jani) v2: Drop common header in include and use display_regs.h (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-3-uma.shankar@intel.com commit 0635d554de9569e0231dbd75162695d295d1a676 Author: Uma Shankar Date: Thu Feb 5 15:13:22 2026 +0530 drm/i915: Extract display registers from i915_reg.h to display There are certain register definitions which are defined in i915_reg.h which are exclusively needed by display. Move the same to display headers to remove i915_reg.h includes from display. This is a step towards making display independent of i915. intel_clock_gating.c can include display header directly, since its usage is planned to be re-factored and will be moved within display. v3: Updated subject and commit message (Jani) v2: Drop common header in include and use display_regs.h (Jani) Reviewed-by: Jani Nikula Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20260205094341.1882816-2-uma.shankar@intel.com commit df4dc947c46bb9f80038f52c6e38cb2d40c10e50 Author: Val Packett Date: Wed Dec 10 12:39:23 2025 -0300 drm/virtio: Allow importing prime buffers when 3D is enabled This functionality was added for using a KMS-only virtgpu with a physical (or SR-IOV) headless GPU in passthrough, but it should not be restricted to KMS-only mode. It can be used with cross-domain to pass guest memfds to the host compositor with zero copies (using udmabuf on both sides). Drop the check for the absence of virgl_3d to allow for more use cases. Fixes: ca77f27a2665 ("drm/virtio: Import prime buffers from other devices as guest blobs") Signed-off-by: Val Packett Reviewed-by: Dmitry Osipenko Signed-off-by: Dmitry Osipenko Link: https://patch.msgid.link/20251210154755.1119861-2-val@invisiblethingslab.com commit 25c9aa4dcb5ef2ad9f354d19f8f1eeb690d1c161 Author: Shuicheng Lin Date: Mon Feb 2 18:18:54 2026 +0000 drm/xe: Make xe_modparam.force_vram_bar_size signed vram_bar_size is registered as an int module parameter and is documented to accept negative values to disable BAR resizing. Store it as an int in xe_modparam as well, so negative values work as intended and the module_param type matches. Fixes: 80742a1aa26e ("drm/xe: Allow to drop vram resizing") Reviewed-by: Michal Wajdeczko Signed-off-by: Shuicheng Lin Link: https://patch.msgid.link/20260202181853.1095736-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper commit c0a27a0ca8a34e96d08bb05a2c5d5ccf63fb8dc0 Author: Kaushlendra Kumar Date: Fri Jan 9 08:55:49 2026 +0530 drm/i915/acpi: free _DSM package when no connectors acpi_evaluate_dsm_typed() returns an ACPI package in pkg. When pkg->package.count == 0, we returned without freeing pkg, leaking memory. Free pkg before returning on the empty case. Signed-off-by: Kaushlendra Kumar Fixes: 337d7a1621c7 ("drm/i915: Fix invalid access to ACPI _DSM objects") Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260109032549.1826303-1-kaushlendra.kumar@intel.com Signed-off-by: Jani Nikula commit 0bcacf56dc0b265f9c47056c6a4f0c1394a8a3f0 Author: Piotr Piórkowski Date: Mon Feb 2 12:50:41 2026 +0100 drm/xe/vf: Avoid reading media version when media GT is disabled When the media GT is not allowed, a VF must not attempt to read the media version from the GuC. The GuC may not be loaded, and any attempt to communicate with it would result in a timeout and a VF probe failure: (...) [ 1912.406046] xe 0000:01:00.1: [drm] *ERROR* Tile0: GT1: GuC mmio request 0x5507: no reply 0x5507 [ 1912.407277] xe 0000:01:00.1: [drm] *ERROR* Tile0: GT1: [GUC COMMUNICATION] MMIO send failed (-ETIMEDOUT) [ 1912.408689] xe 0000:01:00.1: [drm] *ERROR* VF: Tile0: GT1: Failed to reset GuC state (-ETIMEDOUT) [ 1912.413986] xe 0000:01:00.1: probe with driver xe failed with error -110 Let's skip reading the media version for VFs when the media GT is not allowed. v2: move the condition directly to the VF path Fixes: 7abd69278bb5 ("drm/xe/configfs: Add attribute to disable GT types") Signed-off-by: Piotr Piórkowski Cc: Matt Roper Cc: Michal Wajdeczko Cc: Shuicheng Lin Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260202115041.2863357-1-piotr.piorkowski@intel.com Signed-off-by: Michał Winiarski commit 40c1ccc1a3b86259e455a9a5082d5c8e0f944d62 Author: Icenowy Zheng Date: Tue Feb 10 22:15:37 2026 +0800 drm: verisilicon: assign git tree to drm/misc in MAINTAINERS Like other SoC display controllers, patches for the verisilicon driver go through the drm/misc tree. Add the T: clause to the MAINTAINERS item. Signed-off-by: Icenowy Zheng Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260210141537.752890-1-zhengxingda@iscas.ac.cn commit a69d1ab971a624c6f112cea61536569d579c3215 Author: Thomas Hellström Date: Tue Feb 10 12:56:53 2026 +0100 mm: Fix a hmm_range_fault() livelock / starvation problem If hmm_range_fault() fails a folio_trylock() in do_swap_page, trying to acquire the lock of a device-private folio for migration, to ram, the function will spin until it succeeds grabbing the lock. However, if the process holding the lock is depending on a work item to be completed, which is scheduled on the same CPU as the spinning hmm_range_fault(), that work item might be starved and we end up in a livelock / starvation situation which is never resolved. This can happen, for example if the process holding the device-private folio lock is stuck in migrate_device_unmap()->lru_add_drain_all() sinc lru_add_drain_all() requires a short work-item to be run on all online cpus to complete. A prerequisite for this to happen is: a) Both zone device and system memory folios are considered in migrate_device_unmap(), so that there is a reason to call lru_add_drain_all() for a system memory folio while a folio lock is held on a zone device folio. b) The zone device folio has an initial mapcount > 1 which causes at least one migration PTE entry insertion to be deferred to try_to_migrate(), which can happen after the call to lru_add_drain_all(). c) No or voluntary only preemption. This all seems pretty unlikely to happen, but indeed is hit by the "xe_exec_system_allocator" igt test. Resolve this by waiting for the folio to be unlocked if the folio_trylock() fails in do_swap_page(). Rename migration_entry_wait_on_locked() to softleaf_entry_wait_unlock() and update its documentation to indicate the new use-case. Future code improvements might consider moving the lru_add_drain_all() call in migrate_device_unmap() to be called *after* all pages have migration entries inserted. That would eliminate also b) above. v2: - Instead of a cond_resched() in hmm_range_fault(), eliminate the problem by waiting for the folio to be unlocked in do_swap_page() (Alistair Popple, Andrew Morton) v3: - Add a stub migration_entry_wait_on_locked() for the !CONFIG_MIGRATION case. (Kernel Test Robot) v4: - Rename migrate_entry_wait_on_locked() to softleaf_entry_wait_on_locked() and update docs (Alistair Popple) v5: - Add a WARN_ON_ONCE() for the !CONFIG_MIGRATION version of softleaf_entry_wait_on_locked(). - Modify wording around function names in the commit message (Andrew Morton) Suggested-by: Alistair Popple Fixes: 1afaeb8293c9 ("mm/migrate: Trylock device page in do_swap_page") Cc: Ralph Campbell Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Andrew Morton Cc: Matthew Brost Cc: John Hubbard Cc: Alistair Popple Cc: linux-mm@kvack.org Cc: Signed-off-by: Thomas Hellström Cc: # v6.15+ Reviewed-by: John Hubbard #v3 Reviewed-by: Alistair Popple Link: https://patch.msgid.link/20260210115653.92413-1-thomas.hellstrom@linux.intel.com commit 400a84e1f7a3681ef24d58d49b5d07e81c14f4e9 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:43 2026 +0100 drm/tilcdc: Add support for DRM_BRIDGE_ATTACH_NO_CONNECTOR Convert the driver to use the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag when attaching bridges. This modernizes the driver by delegating connector creation to the bridge subsystem through drm_bridge_connector_init() instead of manually searching for connectors created by the bridge. The custom tilcdc_encoder_find_connector() function is removed and replaced with the standard drm_bridge_connector infrastructure, which simplifies the code and aligns with current DRM bridge best practices. This change is safe as there are now no in-tree devicetrees that connect tilcdc to bridges which do not support the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-25-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit c76a8be4feecebbb39095e3c012b67e0f939543d Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:42 2026 +0100 drm/bridge: tda998x: Add support for DRM_BRIDGE_ATTACH_NO_CONNECTOR Add support for the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag to allow display controller drivers to create their own connectors. This modernizes the driver to work with the current DRM bridge framework. The implementation includes: - Refactoring detection and EDID reading into bridge-usable helpers - Adding bridge operations: edid_read, detect, hpd_enable, hpd_disable - Setting appropriate bridge ops (DRM_BRIDGE_OP_EDID, DRM_BRIDGE_OP_DETECT, DRM_BRIDGE_OP_HPD) and connector type (HDMIA) - Skipping connector creation when DRM_BRIDGE_ATTACH_NO_CONNECTOR is set - Handling conditional connector cleanup in bridge_detach The driver maintains backward compatibility by continuing to create its own connector when the flag is not set. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-24-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 8ab51f56fd711cd9aa3960916cb0cc4bbc978eb5 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:41 2026 +0100 drm/bridge: tda998x: Remove useless tda998x_connector_destroy wrapper Use directly drm_connector_cleanup in the destroy ops instead of having a custom function that does nothing more. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-23-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 22b88deb83af2b94f0441075e5528d16d5dcf5b2 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:40 2026 +0100 drm/bridge: tda998x: Move tda998x_create/destroy into probe and remove Now that tda998x_create and tda998x_destroy are called only in the probe function, there is no need for separate functions. Move the code into the tda998x_probe and tda998x_remove functions. Rewrite the cleanup path using goto calls in probe and reorder it in the remove function. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-22-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit d700fd0ff100f4c301dafeb6b944c7229d0adda7 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:39 2026 +0100 drm/bridge: tda998x: Remove component support The tilcdc driver no longer uses the component framework to bind the tda998x bridge driver. The component bind/unbind operations and the encoder initialization code are now dead code and can be safely removed. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-21-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 1b47ea9fddcf89e4b65045d233bc5a2ee7775df7 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:38 2026 +0100 drm/tilcdc: Use devm_drm_of_get_bridge() helper Replace drm_of_find_panel_or_bridge() with the newer devm_drm_of_get_bridge() helper which simplifies the code by: - Automatically handling both panel and bridge cases internally - Managing the panel-to-bridge conversion when needed - Using devres for resource management, eliminating manual cleanup This removes the need for explicit panel-to-bridge conversion via devm_drm_panel_bridge_add_typed() and the associated error handling path. Signed-off-by: Kory Maincent (TI.com) Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-20-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 2c6f1b1fa78acd5f3bd80e3519b6b23907ea9c2f Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:37 2026 +0100 drm/tilcdc: Convert to drm_device-based logging helpers Replace dev_* logging calls with their DRM equivalents. This aligns with the DRM subsystem's logging infrastructure and provides better integration with DRM debugging mechanisms. The drm_* helpers automatically include device information and integrate with DRM's debug category filtering. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-19-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 323401c9a166ea5faa300778f3ca336c01d8835a Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:36 2026 +0100 drm/tilcdc: Convert to DRM managed resources Convert the tilcdc driver to use DRM managed resources (drmm_* APIs) to eliminate resource lifetime issues, particularly in probe deferral scenarios. This conversion addresses potential use-after-free bugs by ensuring proper cleanup ordering through the DRM managed resource framework. The changes include: - Replace drm_crtc_init_with_planes() with drmm_crtc_alloc_with_planes() - Replace drm_universal_plane_init() with drmm_universal_plane_alloc() - Replace drm_simple_encoder_init() with drmm_simple_encoder_alloc() - Remove manual cleanup in tilcdc_crtc_destroy() and error paths - Remove drm_encoder_cleanup() from encoder error handling paths - Use drmm_add_action_or_reset() for remaining cleanup operations This approach is recommended by the DRM subsystem for improved resource lifetime management and is particularly important for drivers that may experience probe deferral. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-18-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 968fefee98d80bedbf1765e48201746880bf7277 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:35 2026 +0100 drm/tilcdc: Remove the use of drm_device private_data The DRM core documentation recommends against using dev_private: "Instead of using this pointer it is recommended that drivers use embed the struct &drm_device in their larger per-device structure." This patch refactors the tilcdc driver to follow this recommendation by embedding struct drm_device within struct tilcdc_drm_private and replacing all dev->dev_private accesses with the ddev_to_tilcdc_priv() helper macro that uses container_of(). This change aligns the driver with modern DRM best practices. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-17-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 3301302060da8c2034e5e10dc231023ec98051fb Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:34 2026 +0100 drm/tilcdc: Modernize driver initialization and cleanup paths Refactor the driver initialization to use modern DRM managed resource APIs, simplifying the code. The tilcdc_init and tilcdc_fini wrapper functions are removed since they served no purpose after the component framework was eliminated. Their logic is integrated directly into probe and remove. Key changes: - Use devm_drm_dev_alloc() instead of drm_dev_alloc(). - Use drmm_mode_config_init() instead of drm_mode_config_init(). - Align the remove path with the probe error path to ensure consistent cleanup ordering in both success and failure cases. - Adjust platform_set_drvdata() to store the private structure instead of the drm_device, matching the new allocation pattern. These changes reduce error-prone code while maintaining the same functional behavior. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-16-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit e41591e7474920187be7af0404ec9ed63b5f4614 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:33 2026 +0100 drm/tilcdc: Move tilcdc_init/fini closer to probe/remove Move tilcdc_init/fini functions adjacent to the probe and remove functions in preparation for cleanup and modernization. This improves readability for subsequent commits that will refactor these functions. No functional changes, only code reorganization. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-15-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 87e66f60f63a746094134bc3e0ffdb6bd87afcb1 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:32 2026 +0100 drm/tilcdc: Use drm_module_platform_driver() helper Use the drm_module_platform_driver() helper macro to simplify driver registration. This macro handles both the platform driver registration and the drm_firmware_drivers_only() check, making the custom init/exit functions unnecessary. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-14-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 8fcc0eb34d79d2733ce617073a4c52b42ffeb00f Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:31 2026 +0100 drm/tilcdc: Remove the useless module list support The tilcdc driver previously supported a sub-module system where external display drivers (panels, encoders) could register themselves through tilcdc_module_init() and be automatically initialized through a module list. This infrastructure became unused after the component framework support and panel driver was removed. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-13-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit cb18dbb74f46bd0aa612aaae144dd191c548739c Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:30 2026 +0100 drm/tilcdc: Rename tilcdc_external to tilcdc_encoder The tilcdc_external module describes the encoder part of the tilcdc driver. Rename it to tilcdc_encoder for better clarity and to make the naming more consistent with DRM subsystem conventions, where encoder-related files typically use "encoder" in their names. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-12-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 9a49c20f3360699439035e0d8543292e4b028f04 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:29 2026 +0100 drm/tilcdc: Rename external_encoder and external_connector to encoder and connector Remove the "external_" prefix from encoder and connector members in the tilcdc driver. These are internal driver structures and the "external" naming is misleading. The simpler names better reflect that these are the primary encoder and connector managed by this driver. Also rename tilcdc_attach_external_device() to tilcdc_encoder_create() for consistency and to better describe the function's purpose. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-11-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit e9946e3a869406ed743f64c9fdf8fb5c6af739ba Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:28 2026 +0100 drm/tilcdc: Remove unused encoder and connector tracking arrays The num_encoders/encoders and num_connectors/connectors arrays in tilcdc_drm_private are never populated or used by the driver. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-10-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit da4837fb7513db5da6be7fd32e8d8efe8bff673b Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:27 2026 +0100 drm/tilcdc: Remove redundant #endif/#ifdef in debugfs code Remove the unnecessary #endif/#ifdef CONFIG_DEBUG_FS pair that splits the debugfs code section. This keeps all debugfs-related code within a single preprocessor conditional block, improving code readability. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-9-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 1184e7785d0fafd3b111b0eaf1caeaeec32ba88d Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:26 2026 +0100 drm/tilcdc: Remove tilcdc_panel_info structure Remove the tilcdc_panel_info structure and its associated helper function as the structure contains only redundant or unused parameters. Most panel configuration parameters in tilcdc_panel_info are either: - Already represented by existing DRM mode flags (invert_pxl_clk, sync_edge via DRM_BUS_FLAG_*), or - Set to identical values across all instances (panel_info_default), making them effectively constants The removed fifo_th field is already handled by priv->fifo_th when set. Other removed fields (tft_alt_mode, raster_order) were always set to 0 in the only instance (panel_info_default) and thus had no effect. This simplifies the code by eliminating unnecessary abstraction while preserving all functional behavior. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-8-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit b8c3fd741f02b79dceb0489dec49692d447015f9 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:25 2026 +0100 drm/tilcdc: Remove component framework support The tilcdc driver previously used the component framework to bind external encoder subdrivers (specifically the TDA998x HDMI encoder). With the removal of these subdrivers in previous commits, the component framework is no longer needed. This commit removes all component framework infrastructure including: - Component master operations and bind/unbind callbacks - The is_componentized flag and conditional code paths - tilcdc_get_external_components() and tilcdc_add_component_encoder() - TDA998x-specific panel configuration The driver now uses a simplified initialization path that directly attaches external devices via the DRM bridge API, eliminating the complexity of dual code paths for componentized vs non-componentized configurations. This cleanup removes approximately 140 lines of code and makes the driver initialization flow more straightforward. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-7-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 8f1e1ab9c794a6efa7ab2b076405b4984319efec Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:24 2026 +0100 drm/tilcdc: Remove tilcdc panel driver The tilcdc panel subdriver is a legacy, non-standard driver that has been replaced by the standard panel-dpi driver and panel-simple infrastructure. With the device tree bindings removed and all in-tree users migrated to use panel-dpi, this driver no longer has any associated device tree bindings or users. The panel-dpi driver combined with DRM bus flags provides equivalent functionality in a standard way that is compatible with the broader DRM panel ecosystem. This removal eliminates 400+ lines of redundant code and completes the migration to standard panel handling. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-6-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 0ff223d991477fa4677dcb0f1fb00065847e2212 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:23 2026 +0100 drm/tilcdc: Convert legacy panel binding via DT overlay at boot time To maintain backward compatibility while removing the deprecated tilcdc_panel driver, add a tilcdc_panel_legacy subdriver that converts the legacy "ti,tilcdc,panel" devicetree binding to the standard panel-dpi binding at early boot. The conversion uses an embedded device tree overlay that is applied and modified during subsys_initcall. The process: - Apply embedded overlay to create a tilcdc-panel-dpi node with port/endpoint connections to the LCDC - Copy all properties from the legacy panel node to the new tilcdc-panel-dpi node - Copy display-timings from the legacy panel - Convert legacy panel-info properties (invert-pxl-clk, sync-edge) to standard display timing properties (pixelclk-active, syncclk-active) - Disable the legacy panel by removing its compatible property to prevent the deprecated driver from binding The result is a standard tilcdc-panel-dpi node with proper endpoints and timing properties, allowing the DRM panel infrastructure to work with legacy devicetrees without modification. Other legacy panel-info properties are not migrated as they consistently use default values across all mainline devicetrees and can be hardcoded in the tilcdc driver. This feature is optional via CONFIG_DRM_TILCDC_PANEL_LEGACY and should only be enabled for systems with legacy devicetrees containing "ti,tilcdc,panel" nodes. Suggested-by: Tomi Valkeinen Link: https://lore.kernel.org/all/1d9a9269-bfda-4d43-938b-2df6b82b9369@ideasonboard.com/ Reviewed-by: Luca Ceresoli Reviewed-by: Herve Codina Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-5-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit ca062af436593d66ce2afa4cd00a4cb2fb775755 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:22 2026 +0100 drm/tilcdc: Add support for DRM bus flags and simplify panel config Migrate CRTC mode configuration to use standard DRM bus flags in preparation for removing the tilcdc_panel driver and its custom tilcdc_panel_info structure. Add support for DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE and DRM_BUS_FLAG_SYNC_DRIVE_NEGEDGE flags to control pixel clock and sync signal edge polarity, while maintaining backward compatibility with the existing tilcdc panel info structure. Simplify several hardware parameters by setting them to fixed defaults based on common usage across existing device trees: - DMA burst size: 16 (previously configurable via switch statement) - AC bias frequency: 255 (previously panel-specific) - FIFO DMA request delay: 128 (previously panel-specific) These parameters show no variation in real-world usage, so hardcoding them simplifies the driver without losing functionality. Preserve FIFO threshold configurability by detecting the SoC type, as this parameter varies between AM33xx (8) and DA850 (16) platforms. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-4-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit 332146d21d1d4211520957458973f4316a6c2fa7 Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:21 2026 +0100 drm/tilcdc: Remove simulate_vesa_sync flag The tilcdc hardware does not generate VESA-compliant sync signals. It aligns the vertical sync (VS) on the second edge of the horizontal sync (HS) instead of the first edge. To compensate for this hardware behavior, the driver applies a timing adjustment in mode_fixup(). Previously, this adjustment was conditional based on the simulate_vesa_sync flag, which was only set when using external encoders. This appears problematic because: 1. The timing adjustment seems needed for the hardware behavior regardless of whether an external encoder is used 2. The external encoder infrastructure is driver-specific and being removed due to design issues 3. Boards using tilcdc without bridges (e.g., am335x-evm, am335x-evmsk) may not be getting the necessary timing adjustments Remove the simulate_vesa_sync flag and apply the VESA sync timing adjustment unconditionally, ensuring consistent behavior across all configurations. While it's unclear if the previous conditional behavior was causing actual issues, the unconditional adjustment better reflects the hardware's characteristics. Reviewed-by: Luca Ceresoli Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-3-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit bc3f1e36d12969060c9068b9c7c14407f869270e Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:20 2026 +0100 dt-bindings: display: tilcdc: Mark panel binding as deprecated Mark the ti,tilcdc,panel binding as deprecated in the documentation. This legacy binding should no longer be used for new designs. Users should migrate to the standard DRM panel bindings instead. Acked-by: Krzysztof Kozlowski Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-2-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit e88bb45cf742177a18d63d306be345a294b4c1db Author: Kory Maincent (TI.com) Date: Fri Jan 23 17:12:19 2026 +0100 dt-bindings: display: tilcdc: Convert to DT schema Convert the device tree binding documentation for tilcdc from plain text to DT binding schema. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20260123-feature_tilcdc-v5-1-5a44d2aa3f6f@bootlin.com Signed-off-by: Luca Ceresoli commit d287dee565c3c32e1ed76ec1847af46809c29b90 Author: Maciej Patelczyk Date: Mon Feb 9 13:34:33 2026 +0100 drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm() There is a unbalanced lock/unlock to gpusvm notifier lock: [ 931.045868] ===================================== [ 931.046509] WARNING: bad unlock balance detected! [ 931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G U [ 931.048150] ------------------------------------- [ 931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->notifier_lock) at: [ 931.049801] [] drm_gpusvm_scan_mm+0x188/0x460 [drm_gpusvm_helper] [ 931.050802] but there are no more locks to release! [ 931.051463] The drm_gpusvm_notifier_unlock() sits under err_free label and the first jump to err_free is just before calling the drm_gpusvm_notifier_lock() causing unbalanced unlock. Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state") Signed-off-by: Maciej Patelczyk Cc: Thomas Hellström Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260209123433.1271053-1-maciej.patelczyk@intel.com commit 857e2d886ad32d9a49fe99fd06bd78f4354043f4 Author: Chintan Patel Date: Mon Feb 2 20:46:04 2026 -0800 drm/panel: jdi-lt070me05000: Use MIPI DSI multi functions Convert to the non-deprecated mipi_dsi_*_multi() helpers per the TODO list. This reduces boilerplate error checking while providing proper error accumulation. Use mipi_dsi_msleep() and mipi_dsi_usleep_range() macros for delays. Replace mdelay(10) and mdelay(20) with mipi_dsi_usleep_range() calls using tighter slop (10-11ms and 20-21ms respectively) since these functions aren't run often and don't need large timing windows. In jdi_panel_off(), reset the error context between display_off and enter_sleep_mode to preserve the original behavior of continuing power-down even if display_off fails. This ensures enter_sleep_mode executes before GPIO/regulator control, which is critical for proper power sequencing. Signed-off-by: Chintan Patel Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260203044605.5890-1-chintanlike@gmail.com commit e04c609eedf4d6748ac0bcada4de1275b034fed6 Author: Matt Roper Date: Thu Feb 5 14:05:09 2026 -0800 drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138 The PSS_CHICKEN register has been part of the RCS engine's LRC since it was first introduced in Xe_LP. That means that any workarounds that adjust its value (such as Wa_14019988906 and Wa_14019877138) need to be implemented in the lrc_was[] table so that they become part of the default LRC from which all subsequent LRCs are copied. Although these workarounds were implemented correctly on most platforms, they were incorrectly placed on the engine_was[] table for Xe2_HPG. Move the workarounds to the proper lrc_was[] table and switch the 'xe_rtp_match_first_render_or_compute' rule to specifically match the RCS since that's the engine whose LRC manages the register. Bspec: 65182 Fixes: 7f3ee7d88058 ("drm/xe/xe2hpg: Add initial GT workarounds") Reviewed-by: Shekhar Chauhan Link: https://patch.msgid.link/20260205220508.51905-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit d2e0540a62693f324d8e1f5ad7440994350cd998 Author: Gustavo Sousa Date: Fri Feb 6 15:36:11 2026 -0300 drm/xe/nvlp: Bump maximum WOPCM size On NVL-P, the primary GT's WOPCM gained an extra 8MiB for the Memory URB. As such, we need to bump the maximum size in the driver so that the driver is able to load without erroring out thinking that the WOPCM is too small. FIXME: The wopcm code in xe driver is a bit confusing. For the case where the offsets for GUC WOPCM are already locked, it appears we are using the maximum overall WOPCM size instead of the sizes relative to each type of GT. The function __check_layout() should be checking against the latter. Bspec: 67090 Reviewed-by: Dnyaneshwar Bhadane Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-15-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit d59d94f91f056f007bffb27d2689d82a14448889 Author: Matt Roper Date: Fri Feb 6 15:36:10 2026 -0300 drm/i915/nvlp: Hook up display support Although NVL-S and NVL-P are quite different on the GT side, they use identical Xe3p_LPD display IP and should take all the same codepaths. Signed-off-by: Matt Roper Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-14-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit b9006dacb8e4a6d2a7bc870c7f037c2ea21bdf34 Author: Dnyaneshwar Bhadane Date: Fri Feb 6 15:36:09 2026 -0300 drm/xe/nvlp: Attach MOCS table for nvlp The MOCS table for NVL-P is same as for Xe2/Xe3 platforms. Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-13-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit be07d8f707e41cb694c4a56364978c30683a687d Author: Shekhar Chauhan Date: Fri Feb 6 15:36:08 2026 -0300 drm/xe/nvlp: Add NVL-P platform definition Add platform definition along with device IDs for NVL-P. Here is the list of device descriptor fields and associated Bspec references: .dma_mask_size (Bspec 74198) .has_cached_pt (Bspec 71582) .has_display (Bspec 74196) .has_flat_ccs (Bspec 74110) .has_page_reclaim_hw_assist (Bspec 73451) .max_gt_per_tile (Bspec 74196) .va_bits (Bspec 74198) .vm_max_level (Bspec 59507) v2: - Add list of descriptor fields and Bspec references. (Matt) Signed-off-by: Shekhar Chauhan Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-12-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit 377c89bfaa5d5588214202515d60eacac61395d4 Author: Aradhya Bhatia Date: Fri Feb 6 15:36:07 2026 -0300 drm/xe/xe3p_lpg: Set STLB bank hash mode to 4KB Since the dominant size of the pages referred in an i-gpu, such as Xe3p_LPG, will be 4KB, the HW default of mix of 64K and 2M for STLB bank hash mode does not make sense. Allow the SW to change it to 4KB Mode, for Xe3p_LPG. v2: - Add Bspec reference. (Matt) Bspec: 78248 Signed-off-by: Aradhya Bhatia Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-11-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit 1888b3397e11f5663452e0fc14811f9b27d633a2 Author: Gustavo Sousa Date: Fri Feb 6 15:36:06 2026 -0300 drm/xe/xe3p_lpg: Update LRC sizes Like with previous generations, the engine context images for of both RCS and CCS in Xe3p_LPG contain a common layout at the end for the context related to the "Compute Pipeline". The size of the memory area written to such section varies; it depends on the type of preemption has taken place during the execution and type of command streamer instruction that was used on the pipeline. For Xe3p_LPG, the maximum possible size, including NOOPs for cache line alignment, is 4368 dwords, which would be the case of a mid-thread preemption during the execution of a COMPUTE_WALKER_2 instruction. The maximum size has increased in such a way that we need to update xe_gt_lrc_size() to match the new sizing requirement. When we add that to the engine-specific parts, we have: - RCS context image: 6672 dwords = 26688 bytes -> 7 pages - CCS context image: 5024 dwords = 20096 bytes -> 5 pages Bspec: 65182, 55793, 73590 Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-10-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit 60fcdf645c47699c04e421382d5b36130b476262 Author: Matt Roper Date: Fri Feb 6 15:36:05 2026 -0300 drm/xe/xe3p_lpg: Extend 'group ID' mask size Xe3p_LPG extends the 'group ID' register mask by one bit. Since the new upper bit (12) was unused on previous platforms, we can safely extend the existing mask size without worrying about adding conditional version checks to the register programming. Bspec: 67175 Signed-off-by: Matt Roper Reviewed-by: Dnyaneshwar Bhadane Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-9-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit ce0e1a6384f7b6f2ee39ef2a747e61455b418dcd Author: Matt Roper Date: Fri Feb 6 15:36:04 2026 -0300 drm/xe/xe3p_lpg: Drop unnecessary tuning settings From Xe3p onward, the desired settings are now the hardware's default values and the driver does not need to program them explicitly. Since 35.xx seems to be the starting point for "Xe3p" version numbers; we'll adjust the bounds of the old programming to stop at 34.99. Even though there's no platform with version 35.00 at the moment, this is simplest in case one does show up in the future. Bspec: 72161, 59928, 59930 Signed-off-by: Matt Roper Reviewed-by: Matt Atwood Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-8-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit e5db97a30594e6b6406b7721d8a734df7af80c2c Author: Matt Roper Date: Fri Feb 6 15:36:03 2026 -0300 drm/xe/xe3p_lpg: Disable reporting of context switch status to GHWSP By default the hardware reports context switch status into the global hardware status page. The Xe driver doesn't use this information for anything, and as of Xe3p, leaving this setting enabled will prevent other hardware optimizations from being enabled. Disable this reporting as suggested by the tuning guide. Bspec: 72161 Signed-off-by: Matt Roper Reviewed-by: Matt Atwood Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-7-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit 4a0836a2604f1300b9f8886049e47f5aa4300c57 Author: Matt Roper Date: Fri Feb 6 15:36:02 2026 -0300 drm/xe/xe3p_lpg: Add LRC parsing for additional RCS engine state Xe3p_LPG adds some additional state instructions to the RCS engine's LRC. Add support for these to the debugfs LRC parser. Note that the bspec's LRC description page seems to have a few mistakes in the name/spelling of these new instructions (e.g., "3DSTATE_TASK_DATA_EXT" instead of "3DSTATE_TASK_SHADER_DATA_EXT" or "3DSTATE_VIEWPORT_STATE_POINTERS_CL_SF_2" instead of "3DSTATE_VIEWPORT_STATE_POINTERS_SF_CLIP_2"). Bspec: 65182 Signed-off-by: Matt Roper Reviewed-by: Matt Atwood Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-6-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit 641a2208c052256242f4e7808d997cd2239bb7e2 Author: Matt Roper Date: Fri Feb 6 15:36:01 2026 -0300 drm/xe/xe3p_lpg: Add MCR steering Xe3p_LPG has nearly identical steering to Xe2 and Xe3. The only DSS/XeCore change from those IPs is an additional range from 0xDE00-0xDE7F that was previously reserved, so we can simply grow one of the existing ranges in the Xe2 table to include it. Similarly, the "instance0" table is also almost identical, but gains one additional PSMI range and requires a separate table. v2: - Drop reserved range from MEMPIPE range. (Dnyaneshwar) Bspec: 75242 Signed-off-by: Matt Roper Reviewed-by: Dnyaneshwar Bhadane Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-5-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit f3e5f71fd6eaa3363df966bad7755980ac276910 Author: Matt Roper Date: Fri Feb 6 15:36:00 2026 -0300 drm/xe/xe3p_lpg: Add new PAT table PAT programming for Xe3p_LPG is more similar to Xe2 and Xe3 than it is to Xe3p_XPC. Compared to Xe2/Xe3 we have: * There's a slight update to the PAT table, where two new indices (18 and 19) are added to expose a new "WB - Transient App" L3 caching mode. * The PTA_MODE entry must be programmed differently according to the media type, and both differ from Xe2. There are no changes to the underlying registers, so the Xe2 ops can be re-used for Xe3p. Bspec: 71582, 74160 Signed-off-by: Matt Roper Reviewed-by: Matt Atwood Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-4-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit a08104551d08cf5c1542ba552bd7d1cf9d4ecd23 Author: Gustavo Sousa Date: Fri Feb 6 15:35:59 2026 -0300 drm/xe/pat: Differentiate between primary and media for PTA Differently from currently supported platforms, in upcoming changes we will need to have different PAT entries for PTA based on the GT type. As such, let's prepare the code to support that by having two separate PTA-specific members in the pat struct, one for each type of GT. While at it, also fix the kerneldoc for pat_ats. Co-developed-by: Tejas Upadhyay Signed-off-by: Tejas Upadhyay Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-3-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit 835cd6cbb0d0e44c3fc4efc1ba6c79ffb2e2f751 Author: Shekhar Chauhan Date: Fri Feb 6 15:35:58 2026 -0300 drm/xe/xe3p_lpg: Add initial workarounds for graphics version 35.10 Add the initial set of workarounds for Xe3p_LPG graphics version 35.10. v2: - Fix spacing style for field LOCALITYDIS. (Matt) - Drop unnecessary Wa_14025780377. (Matt) Signed-off-by: Shekhar Chauhan Co-developed-by: Nitin Gote Signed-off-by: Nitin Gote Co-developed-by: Tangudu Tilak Tirumalesh Signed-off-by: Tangudu Tilak Tirumalesh Co-developed-by: Mallesh Koujalagi Signed-off-by: Mallesh Koujalagi Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-2-636e1ad32688@intel.com Co-developed-by: Gustavo Sousa Signed-off-by: Gustavo Sousa commit 8fcb7dfb8bbfeb05073f834d07f3eb44df797f20 Author: Shekhar Chauhan Date: Fri Feb 6 15:35:57 2026 -0300 drm/xe/xe3p_lpg: Add support for graphics IP 35.10 Add Xe3p_LPG graphics IP version 35.10. Xe3p_LPG supports all features described by XE2_GFX_FEATURES and also multi-queue feature on BCS and CCS engines. As such, create a new struct xe_graphics_desc named graphics_xe3p_lpg that inherits from XE2_GFX_FEATURES and also includes the necessary .multi_queue_engine_class_mask. Here is a list of fields and associated Bspec references for the members of the IP descriptor: .hw_engine_mask (Bspec 60149) .multi_queue_engine_class_mask (Bspec 74110) .has_asid (Bspec 71132) .has_atomic_enable_pte_bit (Bspec 59510, 74675) .has_indirect_ring_state (Bspec 67296) .has_range_tlb_inval (Bspec 71126) .has_usm (Bspec 59651) .has_64bit_timestamp (Bspec 60318) .num_geometry_xecore_fuse_regs (Bspec 62566, 67401, 67536) .num_compute_xecore_fuse_regs (Bspec 62565, 62561, 67537) v2: - Drop non-existing fields from the list in the commit message. (Matt) - Squash patch adding .multi_queue_engine_class_mask here. (Matt) - Rename graphics_xe3p to graphics_xe3p_lpg. (Matt) - Add fields .num_geometry_xecore_fuse_regs and .num_compute_xecore_fuse_regs after rebasing and inheriting commit 6acf3d3ed6c1 ("drm/xe: Move number of XeCore fuse registers to graphics descriptor"). (Gustavo) Signed-off-by: Shekhar Chauhan Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260206-nvl-p-upstreaming-v3-1-636e1ad32688@intel.com Signed-off-by: Gustavo Sousa commit 486200bdcf8fa64dc4b9389ddc659bbcd7363831 Author: Jani Nikula Date: Fri Feb 6 14:59:49 2026 +0200 drm/i915/overlay: remove dead code with MTL platform checks Commit c5741c5c1122 ("drm/i915/display: Do not use stolen on MTL") added some checks for MTL in overlay code. However, this is never run on MTL. Clean it up. Reviewed-by: Ville Syrjälä Link: https://patch.msgid.link/20260206125949.243643-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 4af267ce3441e10198daa52a8cc4b5cb4575d06f Author: Matt Coster Date: Fri Feb 6 16:02:13 2026 +0000 drm/imagination: Mark FWCCB_CMD_UPDATE_STATS as known Suppress the "unknown type" warning when processing a FWCCB command of type CMD_UPDATE_STATS which is known but (currently) unused. Reviewed-by: Frank Binns Link: https://patch.msgid.link/20260206-improve-bad-fwccb-cmd-v1-2-831a852ca127@imgtec.com Signed-off-by: Matt Coster commit c7384288d9266e52cd35aadb1749872caf3c0257 Author: Matt Coster Date: Fri Feb 6 16:02:12 2026 +0000 drm/imagination: Improve handling of unknown FWCCB commands A couple small changes: - Validate the magic value at the head of FWCCB commands, and - Mask off the magic value before logging unknown command types to make them easier to interpret on sight. Reviewed-by: Frank Binns Link: https://patch.msgid.link/20260206-improve-bad-fwccb-cmd-v1-1-831a852ca127@imgtec.com Signed-off-by: Matt Coster commit 7229474d415485b1d864ee7935f2f64ce858eee0 Author: Imre Deak Date: Mon Feb 9 15:38:17 2026 +0200 drm/i915/dp: Verify valid pipe BPP range Ensure that the pipe BPP range is valid after calculating the minimum and maximum pipe BPP values separately. Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260209133817.395823-2-imre.deak@intel.com commit 08b7ef16b6a03e8c966e286ee1ac608a6ffb3d4a Author: Imre Deak Date: Mon Feb 9 15:38:16 2026 +0200 drm/i915/dp: Fix pipe BPP clamping due to HDR The pipe BPP value shouldn't be set outside of the source's / sink's valid pipe BPP range, ensure this when increasing the minimum pipe BPP value to 30 due to HDR. While at it debug print if the HDR mode was requested for a connector by setting the corresponding HDR connector property. This indicates if the requested HDR mode could not be enabled, since the selected pipe BPP is below 30, due to a sink capability or link BW limit. v2: - Also handle the case where the sink could support the target 30 BPP only in DSC mode due to a BW limit, but the sink doesn't support DSC or 30 BPP as a DSC input BPP. (Chaitanya) - Debug print the connector's HDR mode in the link config dump, to indicate if a BPP >= 30 required by HDR couldn't be reached. (Ankit) - Add Closes: trailer. (Ankit) - Don't print the 30 BPP-outside of valid BPP range debug message if the min BPP is already > 30 (and so a target BPP >= 30 required for HDR is ensured). Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7052 Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15503 Fixes: ba49a4643cf53 ("drm/i915/dp: Set min_bpp limit to 30 in HDR mode") Cc: Chaitanya Kumar Borah Cc: # v6.18+ Reviewed-by: Ankit Nautiyal # v1 Reviewed-by: Chaitanya Kumar Borah Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260209133817.395823-1-imre.deak@intel.com commit 5491f668910ed0b282beb10f3f6b2e4d3988a1a8 Author: Maxime Ripard Date: Wed Jan 28 13:43:58 2026 +0100 drm/vc4: Switch private_obj initialization to atomic_create_state The vc4 driver relies on a drm_private_obj, that is initialized by allocating and initializing a state, and then passing it to drm_private_obj_init. Since we're gradually moving away from that pattern to the more established one relying on a atomic_create_state implementation, let's migrate this instance to the new pattern. Reviewed-by: Maíra Canal Link: https://patch.msgid.link/20260128-drm-private-obj-reset-v4-14-90891fa3d3b0@redhat.com Signed-off-by: Maxime Ripard commit 9bf5b4dfe1ea7af0bc7846bec2c46da68a6f03e6 Author: Maxime Ripard Date: Wed Jan 28 13:43:55 2026 +0100 drm/msm: dpu1: Switch private_obj initialization to atomic_create_state The MSM dpu1 driver relies on a drm_private_obj, that is initialized by allocating and initializing a state, and then passing it to drm_private_obj_init. Since we're gradually moving away from that pattern to the more established one relying on a atomic_create_state implementation, let's migrate this instance to the new pattern. Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260128-drm-private-obj-reset-v4-11-90891fa3d3b0@redhat.com Signed-off-by: Maxime Ripard commit 4ada3ac5ffbc5279ab4bb16a7e038c027c0fa19a Author: Maxime Ripard Date: Wed Jan 28 13:43:54 2026 +0100 drm/msm: mdp5: Switch private_obj initialization to atomic_create_state The MSM mdp5 driver relies on a drm_private_obj, that is initialized by allocating and initializing a state, and then passing it to drm_private_obj_init. Since we're gradually moving away from that pattern to the more established one relying on a atomic_create_state implementation, let's migrate this instance to the new pattern. Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260128-drm-private-obj-reset-v4-10-90891fa3d3b0@redhat.com Signed-off-by: Maxime Ripard commit 8e46b1ebf37048303ac6cdd8abf9e31f9b4772ef Author: Maxime Ripard Date: Wed Jan 28 13:43:53 2026 +0100 drm/ingenic: Switch private_obj initialization to atomic_create_state The ingenic driver relies on two drm_private_objs, that are initialized by allocating and initializing a state, and then passing it to drm_private_obj_init. Since we're gradually moving away from that pattern to the more established one relying on a atomic_create_state implementation, let's migrate this instance to the new pattern. Acked-by: Paul Cercueil Link: https://patch.msgid.link/20260128-drm-private-obj-reset-v4-9-90891fa3d3b0@redhat.com Signed-off-by: Maxime Ripard commit d2bbd8a4273e2f274a568f501ab93184a33328fd Author: Maxime Ripard Date: Wed Jan 28 13:43:52 2026 +0100 drm/arm: komeda: Switch private_obj initialization to atomic_create_state The ARM komeda driver relies on a number of drm_private_objs, that are initialized by allocating and initializing a state, and then passing it to drm_private_obj_init. Since we're gradually moving away from that pattern to the more established one relying on a atomic_create_state implementation, let's migrate this instance to the new pattern. Acked-by: Liviu Dudau Acked-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260128-drm-private-obj-reset-v4-8-90891fa3d3b0@redhat.com Signed-off-by: Maxime Ripard commit 8e6da25bd60dcce21717b168851b76cae5497179 Author: Maxime Ripard Date: Wed Jan 28 13:43:50 2026 +0100 drm/dp_tunnel: Switch private_obj initialization to atomic_create_state The DP tunnel implementation relies on a drm_private_obj, that is initialized by allocating and initializing a state, and then passing it to drm_private_obj_init. Since we're gradually moving away from that pattern to the more established one relying on a atomic_create_state implementation, let's migrate this instance to the new pattern. Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260128-drm-private-obj-reset-v4-6-90891fa3d3b0@redhat.com Signed-off-by: Maxime Ripard commit 2dce31863b2867a54a0e7b97657ee09a7ea8ad21 Author: Maxime Ripard Date: Wed Jan 28 13:43:49 2026 +0100 drm/dp_mst: Switch private_obj initialization to atomic_create_state The DP MST implementation relies on a drm_private_obj, that is initialized by allocating and initializing a state, and then passing it to drm_private_obj_init. Since we're gradually moving away from that pattern to the more established one relying on a atomic_create_state implementation, let's migrate this instance to the new pattern. Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260128-drm-private-obj-reset-v4-5-90891fa3d3b0@redhat.com Signed-off-by: Maxime Ripard commit ca8453ce037e4485c67e9ad5207744158be7f0ca Author: Maxime Ripard Date: Wed Jan 28 13:43:48 2026 +0100 drm/bridge: Switch private_obj initialization to atomic_create_state The bridge implementation relies on a drm_private_obj, that is initialized by allocating and initializing a state, and then passing it to drm_private_obj_init. Since we're gradually moving away from that pattern to the more established one relying on a atomic_create_state implementation, let's migrate this instance to the new pattern. Reviewed-by: Dmitry Baryshkov Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260128-drm-private-obj-reset-v4-4-90891fa3d3b0@redhat.com Signed-off-by: Maxime Ripard commit e7be39ed171662474d6d5c9a83d790ef7d244bcd Author: Maxime Ripard Date: Wed Jan 28 13:43:47 2026 +0100 drm/atomic-helper: Add private_obj atomic_create_state helper Now that we have an atomic_create_state callback for drm_private_objs, we can provide a helper for it. It's somewhat different from the other similar helpers though, because we definitely expect drm_private_obj to be subclassed. It wouldn't make sense for a driver to use it as-is. So we can't provide a straight implementation of the atomic_create_state callback, but rather we provide the parts that will deal with the drm_private_obj initialization, and we will leave the allocation and initialization of the subclass to drivers. Reviewed-by: Dmitry Baryshkov Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260128-drm-private-obj-reset-v4-3-90891fa3d3b0@redhat.com Signed-off-by: Maxime Ripard commit 47b5ac7daa46e2bc8e4916d856fdc036ac145bb6 Author: Maxime Ripard Date: Wed Jan 28 13:43:46 2026 +0100 drm/atomic: Add new atomic_create_state callback to drm_private_obj The drm_private_obj initialization was inconsistent with the rest of the KMS objects. Indeed, it required to pass a preallocated state in drm_private_obj_init(), while all the others objects would have a reset callback that would be called later on to create the state. However, reset really is meant to reset the hardware and software state. That it creates an initial state is a side-effect that has been used in all objects but drm_private_obj. This is made more complex since some drm_private_obj, the DisplayPort ones in particular, need to be persistent across and suspend/resume cycle, and such a cycle would call drm_mode_config_reset(). Thus, we need to add a new callback to allocate a pristine state for a given private object. This discussion has also came up during the atomic state readout discussion, so it might be introduced into the other objects later on. Until all drivers are converted to that new allocation pattern, we will only call it if the passed state is NULL. This will be removed eventually. Reviewed-by: Dmitry Baryshkov Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260128-drm-private-obj-reset-v4-2-90891fa3d3b0@redhat.com Signed-off-by: Maxime Ripard commit 95ffa10056b33bf5a90090b02da2edd52e1e281c Author: Maxime Ripard Date: Wed Jan 28 13:43:45 2026 +0100 drm/atomic: Make drm_atomic_private_obj_init fallible Since we're going to move the drm_private_obj state allocation to a callback, we need to be able to deal with its possible failure. Make drm_private_obj_init return an error code on failure. Suggested-by: Ville Syrjälä Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260128-drm-private-obj-reset-v4-1-90891fa3d3b0@redhat.com Signed-off-by: Maxime Ripard commit 55c19e27c56d7843afd08634114d510f67f75370 Author: Chaitanya Kumar Borah Date: Mon Feb 2 15:12:02 2026 +0530 drm/i915/color: Add failure handling in plane color pipeline init The plane color pipeline initialization built up multiple colorop blocks inline, but did not reliably clean up partially constructed pipelines when an intermediate step failed. This could lead to leaked colorop objects and fragile error handling as the pipeline grows. Refactor the pipeline construction to use a common helper for adding colorop blocks. This centralizes allocation, initialization, and teardown logic, allowing the caller to reliably unwind all previously created colorops on failure. v2: - Refactor code to avoid repetition (Suraj) v3: - s/nvl/xe3plpd (Suraj) Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260202094202.2871478-10-chaitanya.kumar.borah@intel.com commit 3c2d28f4a67af7ada8f3332270b0d349967e6aa1 Author: Chaitanya Kumar Borah Date: Mon Feb 2 15:12:01 2026 +0530 drm/colorop: Use destroy callback for color pipeline teardown Switch drm_colorop_pipeline_destroy() to use the driver-provided destroy callback instead of directly calling drm_colorop_cleanup() and freeing the object. This allows drivers that embed struct drm_colorop in driver-specific objects to perform correct teardown. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Suraj Kandpal Reviewed-by: Uma Shankar Reviewed-by: Alex Hung Acked-by: Jani Nikula Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260202094202.2871478-9-chaitanya.kumar.borah@intel.com commit fe057ba431868a926fa54f28a0d2891aea6f0584 Author: Chaitanya Kumar Borah Date: Mon Feb 2 15:12:00 2026 +0530 drm/vkms: Remove drm_colorop_pipeline_destroy() from vkms_destroy() Now that colorops are cleaned from drm_mode_config_cleanup(), remove drm_colorop_pipeline_destroy() from vkms_destroy(). Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Reviewed-by: Louis Chauvet Acked-by: Jani Nikula Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260202094202.2871478-8-chaitanya.kumar.borah@intel.com commit fa15259eb65944551ad52988e5822dca0a21b090 Author: Chaitanya Kumar Borah Date: Mon Feb 2 15:11:59 2026 +0530 drm: Clean up colorop objects during mode_config cleanup Tear down all registered drm_colorop objects during drm_mode_config_cleanup() by invoking their destroy callbacks. This ensures proper cleanup of color pipeline objects during DRM device removal. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Suraj Kandpal Reviewed-by: Uma Shankar Reviewed-by: Alex Hung Acked-by: Jani Nikula Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260202094202.2871478-7-chaitanya.kumar.borah@intel.com commit a6e1c068be198ae37af478ccd852bd1a15abc8ed Author: Chaitanya Kumar Borah Date: Mon Feb 2 15:11:58 2026 +0530 drm/i915/display: Hook up intel_colorop_destroy i915 embeds struct drm_colorop inside struct intel_colorop, so the default drm_colorop_destroy() helper cannot be used. Add an intel_colorop_destroy() helper that performs common DRM cleanup and frees intel_colorop object. This ensures correct teardown of plane color pipeline objects. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Suraj Kandpal Reviewed-by: Uma Shankar Acked-by: Jani Nikula Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260202094202.2871478-6-chaitanya.kumar.borah@intel.com commit f3d51fbe48e0f94a1981fbe3c5121dcac58c4f98 Author: Chaitanya Kumar Borah Date: Mon Feb 2 15:11:57 2026 +0530 drm/vkms: Hook up colorop destroy helper for plane pipelines Provide a drm_colorop_funcs instance for vkms color pipeline objects and hook up the common drm_colorop_destroy() helper as the destroy callback. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Reviewed-by: Alex Hung Reviewed-by: Louis Chauvet Acked-by: Jani Nikula Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260202094202.2871478-5-chaitanya.kumar.borah@intel.com commit 3f85dd9b8a2a2ea1599e4e16f57aeb693a059c55 Author: Chaitanya Kumar Borah Date: Mon Feb 2 15:11:56 2026 +0530 drm/amd/display: Hook up colorop destroy helper for plane pipelines Provide a drm_colorop_funcs instance for amdgpu_dm color pipeline objects and hook up the common drm_colorop_destroy() helper as the destroy callback. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Reviewed-by: Alex Hung Acked-by: Jani Nikula Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260202094202.2871478-4-chaitanya.kumar.borah@intel.com commit 2864667476a40525511a1e854bcfa7c90392a990 Author: Chaitanya Kumar Borah Date: Mon Feb 2 15:11:55 2026 +0530 drm: Allow driver-managed destruction of colorop objects Some drivers might want to embed struct drm_colorop inside driver-specific objects, similar to planes or CRTCs. In such cases, freeing only the drm_colorop is incorrect. Add a drm_colorop_funcs callback to allow drivers to provide a destroy hook that cleans up the full enclosing object. Make changes in helper functions to accept helper functions as argument. Pass NULL for now to retain current behavior. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Suraj Kandpal Reviewed-by: Uma Shankar Reviewed-by: Alex Hung Acked-by: Jani Nikula Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260202094202.2871478-3-chaitanya.kumar.borah@intel.com commit 24a4241995ab7456c6751e0bd63382a95e70757f Author: Chaitanya Kumar Borah Date: Mon Feb 2 15:11:54 2026 +0530 drm/colorop: Add destroy helper for colorop objects Add a helper that performs common cleanup and frees the associated object. This can be used by drivers if they do not require any driver-specific teardown. v2: - Add function documentation only before definition (Jani) Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Suraj Kandpal Reviewed-by: Uma Shankar Reviewed-by: Alex Hung Acked-by: Jani Nikula Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260202094202.2871478-2-chaitanya.kumar.borah@intel.com commit a30f999681126b128a43137793ac84b6a5b7443f Author: Shuicheng Lin Date: Fri Jan 30 16:56:22 2026 +0000 drm/xe/mmio: Avoid double-adjust in 64-bit reads xe_mmio_read64_2x32() was adjusting register addresses and then calling xe_mmio_read32(), which applies the adjustment again. This may shift accesses twice if adj_offset < adj_limit. There is no issue currently, as for media gt, adj_offset > adj_limit, so the 2nd adjust will be a no-op. But it may not work in future. To fix it, replace the adjusted-address comparison with a direct sanity check that ensures the MMIO address adjustment cutoff never falls within the 8-byte range of a 64-bit register. And let xe_mmio_read32() handle address translation. v2: rewrite the sanity check in a more natural way. (Matt) v3: Add Fixes tag. (Jani) Fixes: 07431945d8ae ("drm/xe: Avoid 64-bit register reads") Reviewed-by: Matt Roper Cc: Jani Nikula Cc: Rodrigo Vivi Signed-off-by: Shuicheng Lin Link: https://patch.msgid.link/20260130165621.471408-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper commit 4e2796c8280ad21f1a252c05204845261d988e2f Author: Michal Wajdeczko Date: Sat Feb 7 22:44:28 2026 +0100 drm/xe/vf: Allow VF to initialize MCR tables While VFs can't access MCR registers, it's still safe to initialize our per-platform MCR tables, as we might need them later in the LRC programming, as engines itself may access MCR steer registers and thanks to all our past fixes to the VF probe initialization order, VFs are able to use values of the fuse registers needed here. Signed-off-by: Michal Wajdeczko Cc: Matt Roper Link: https://patch.msgid.link/20260207214428.5205-1-michal.wajdeczko@intel.com Reviewed-by: Matt Roper Signed-off-by: Matt Roper commit 310326bb7df4bba094a3fc60364c641c547fd923 Author: Li Chen Date: Wed Jan 21 19:36:44 2026 +0800 nouveau: pci: quiesce GPU on shutdown Kexec reboot does not reset PCI devices. Invoking the full DRM/TTM teardown from ->shutdown can trigger WARNs when userspace still holds DRM file descriptors. Quiesce the GPU through the suspend path and then power down the PCI function so the next kernel can re-initialize the device from a consistent state. WARNING: drivers/gpu/drm/drm_mode_config.c:578 at drm_mode_config_cleanup+0x2e7/0x300, CPU#2: kexec/1300 Call Trace: ? srso_return_thunk+0x5/0x5f ? enable_work+0x3a/0x100 nouveau_display_destroy+0x39/0x70 [nouveau c19e0da7fd83583a023f855c510d9a3903808734] nouveau_drm_device_fini+0x7b/0x1f0 [nouveau c19e0da7fd83583a023f855c510d9a3903808734] nouveau_drm_shutdown+0x52/0xc0 [nouveau c19e0da7fd83583a023f855c510d9a3903808734] pci_device_shutdown+0x35/0x60 device_shutdown+0x11c/0x1b0 kernel_kexec+0x13a/0x160 __do_sys_reboot+0x209/0x240 do_syscall_64+0x81/0x610 ? srso_return_thunk+0x5/0x5f ? __rtnl_unlock+0x37/0x70 ? srso_return_thunk+0x5/0x5f ? netdev_run_todo+0x63/0x570 ? netif_change_flags+0x54/0x70 ? srso_return_thunk+0x5/0x5f ? devinet_ioctl+0x1e5/0x790 ? srso_return_thunk+0x5/0x5f ? inet_ioctl+0x1e9/0x200 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? sock_do_ioctl+0x7d/0x130 ? srso_return_thunk+0x5/0x5f ? __x64_sys_ioctl+0x97/0xe0 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? do_syscall_64+0x23b/0x610 ? srso_return_thunk+0x5/0x5f ? put_user_ifreq+0x7a/0x90 ? srso_return_thunk+0x5/0x5f ? sock_do_ioctl+0x107/0x130 ? srso_return_thunk+0x5/0x5f ? __x64_sys_ioctl+0x97/0xe0 ? srso_return_thunk+0x5/0x5f ? do_syscall_64+0x81/0x610 ? srso_return_thunk+0x5/0x5f ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e nouveau 0000:26:00.0: [drm] drm_WARN_ON(!list_empty(&fb->filp_head)) WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at drm_framebuffer_free+0x73/0xa0, CPU#2: kexec/1300 Call Trace: drm_mode_config_cleanup+0x248/0x300 ? __pfx___drm_printfn_dbg+0x10/0x10 ? drm_mode_config_cleanup+0x1dc/0x300 nouveau_display_destroy+0x39/0x70 [nouveau c19e0da7fd83583a023f855c510d9a3903808734] nouveau_drm_device_fini+0x7b/0x1f0 [nouveau c19e0da7fd83583a023f855c510d9a3903808734] nouveau_drm_shutdown+0x52/0xc0 [nouveau c19e0da7fd83583a023f855c510d9a3903808734] pci_device_shutdown+0x35/0x60 device_shutdown+0x11c/0x1b0 kernel_kexec+0x13a/0x160 __do_sys_reboot+0x209/0x240 do_syscall_64+0x81/0x610 ? srso_return_thunk+0x5/0x5f ? __rtnl_unlock+0x37/0x70 ? srso_return_thunk+0x5/0x5f ? netdev_run_todo+0x63/0x570 ? netif_change_flags+0x54/0x70 ? srso_return_thunk+0x5/0x5f ? devinet_ioctl+0x1e5/0x790 ? srso_return_thunk+0x5/0x5f ? inet_ioctl+0x1e9/0x200 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? sock_do_ioctl+0x7d/0x130 ? srso_return_thunk+0x5/0x5f ? __x64_sys_ioctl+0x97/0xe0 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? do_syscall_64+0x23b/0x610 ? srso_return_thunk+0x5/0x5f ? put_user_ifreq+0x7a/0x90 ? srso_return_thunk+0x5/0x5f ? sock_do_ioctl+0x107/0x130 ? srso_return_thunk+0x5/0x5f ? __x64_sys_ioctl+0x97/0xe0 ? srso_return_thunk+0x5/0x5f ? do_syscall_64+0x81/0x610 ? srso_return_thunk+0x5/0x5f ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e WARNING: include/drm/ttm/ttm_resource.h:406 at nouveau_ttm_fini+0x257/0x270 [nouveau], CPU#2: kexec/1300 Call Trace: nouveau_drm_device_fini+0x93/0x1f0 [nouveau c19e0da7fd83583a023f855c510d9a3903808734] nouveau_drm_shutdown+0x52/0xc0 [nouveau c19e0da7fd83583a023f855c510d9a3903808734] pci_device_shutdown+0x35/0x60 device_shutdown+0x11c/0x1b0 kernel_kexec+0x13a/0x160 __do_sys_reboot+0x209/0x240 do_syscall_64+0x81/0x610 ? srso_return_thunk+0x5/0x5f ? __rtnl_unlock+0x37/0x70 ? srso_return_thunk+0x5/0x5f ? netdev_run_todo+0x63/0x570 ? netif_change_flags+0x54/0x70 ? srso_return_thunk+0x5/0x5f ? devinet_ioctl+0x1e5/0x790 ? srso_return_thunk+0x5/0x5f ? inet_ioctl+0x1e9/0x200 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? sock_do_ioctl+0x7d/0x130 ? srso_return_thunk+0x5/0x5f ? __x64_sys_ioctl+0x97/0xe0 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? do_syscall_64+0x23b/0x610 ? srso_return_thunk+0x5/0x5f ? put_user_ifreq+0x7a/0x90 ? srso_return_thunk+0x5/0x5f ? sock_do_ioctl+0x107/0x130 ? srso_return_thunk+0x5/0x5f ? __x64_sys_ioctl+0x97/0xe0 ? srso_return_thunk+0x5/0x5f ? do_syscall_64+0x81/0x610 ? srso_return_thunk+0x5/0x5f ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Signed-off-by: Li Chen Reviewed-by: Dave Airlie Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260121113646.111561-1-me@linux.beauty commit c57db41b8d2cd410e7219729f446aa17965485ad Author: Sk Anirban Date: Mon Feb 2 16:23:15 2026 +0530 drm/xe/guc: Add Wa_14025883347 for GuC DMA failure on reset Prevent GuC firmware DMA failures during GuC-only reset by disabling idle flow and verifying SRAM handling completion. Without this, reset can be issued while SRAM handler is copying WOPCM to SRAM, causing GuC HW to get stuck. v2: Modify error message (Badal) Rename reg bit name (Daniele) Update WA skip condition (Daniele) Update SRAM handling logic (Daniele) v3: Reorder WA call (Badal) Wait for GuC ready status (Daniele) v4: Update reg name (Badal) Add comment (Daniele) Add extended graphics version (Daniele) Modify rules Signed-off-by: Sk Anirban Reviewed-by: Badal Nilawar Acked-by: Matt Roper Reviewed-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260202105313.3338094-4-sk.anirban@intel.com Signed-off-by: Matt Roper commit 62918542b7bf08860a60ebbde7654486e0ac0776 Author: Tvrtko Ursulin Date: Mon Jun 16 16:59:52 2025 +0100 dma-fence: Fix sparse warnings due __rcu annotations __rcu annotations on the return types from dma_fence_driver_name() and dma_fence_timeline_name() cause sparse to complain because both the constant signaled strings, and the strings return by the dma_fence_ops are not __rcu annotated. For a simple fix it is easiest to cast them with __rcu added and undo the smarts from the tracpoints side of things. There is no functional change since the rest is left in place. Later we can consider changing the dma_fence_ops return types too, and handle all the individual drivers which define them. Signed-off-by: Tvrtko Ursulin Fixes: 506aa8b02a8d ("dma-fence: Add safe access helpers and document the rules") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506162214.1eA69hLe-lkp@intel.com/ Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250616155952.24259-1-tvrtko.ursulin@igalia.com Signed-off-by: Christian König commit dc90ead44054736131f73b1dd319b8be06088d36 Author: Matthew Auld Date: Fri Jan 30 12:51:06 2026 +0000 drm/xe/uapi: update used tracking kernel-doc In commit 4d0b035fd6da ("drm/xe/uapi: loosen used tracking restriction") we dropped the CAP_PERMON restriction but missed updating the corresponding kernel-doc. Fix that. v2 (Sanjay): - Don't drop the note around the extra cpu_visible_used expectations. Reported-by: Ulisses Furquim Fixes: 4d0b035fd6da ("drm/xe/uapi: loosen used tracking restriction") Signed-off-by: Matthew Auld Cc: Sanjay Yadav Reviewed-by: Sanjay Yadav Link: https://patch.msgid.link/20260130125105.451229-2-matthew.auld@intel.com commit 944a3329b05510d55c69c2ef455136e2fc02de29 Author: Jia Yao Date: Thu Feb 5 16:15:29 2026 +0000 drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise When user provides a bogus pat_index value through the madvise IOCTL, the xe_pat_index_get_coh_mode() function performs an array access without validating bounds. This allows a malicious user to trigger an out-of-bounds kernel read from the xe->pat.table array. The vulnerability exists because the validation in madvise_args_are_sane() directly calls xe_pat_index_get_coh_mode(xe, args->pat_index.val) without first checking if pat_index is within [0, xe->pat.n_entries). Although xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug builds, it still performs the unsafe array access in production kernels. v2(Matthew Auld) - Using array_index_nospec() to mitigate spectre attacks when the value is used v3(Matthew Auld) - Put the declarations at the start of the block Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe") Reviewed-by: Matthew Auld Cc: # v6.18+ Cc: Matthew Brost Cc: Shuicheng Lin Cc: Himal Prasad Ghimiray Cc: "Thomas Hellström" Cc: Rodrigo Vivi Cc: Matthew Auld Signed-off-by: Jia Yao Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260205161529.1819276-1-jia.yao@intel.com commit f2edbafc6cb905caec2b231e8e2226b4c75daad9 Author: Icenowy Zheng Date: Sat Feb 7 09:32:55 2026 +0800 drm: verisilicon: suppress snprintf warning for pixel clock name Although it's generally expected that the pixel clock ID will only have one decimal digit, this isn't enforced in vs_dc.c source code, and the compiler will argue about the buffer being not long enough. Enlarge the snprintf() buffer for generating pixel clock name to be enough for a UINT_MAX pixel clock ID in order to suppress the compiler warning. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602060154.ONBYvM9m-lkp@intel.com/ Signed-off-by: Icenowy Zheng Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260207013255.2075294-1-zhengxingda@iscas.ac.cn commit 391ce961bcaf88fcd5a7d710f43c1806aa03ecfe Author: Marco Crivellari Date: Thu Oct 30 17:20:43 2025 +0100 drm/self_refresh: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251030162043.292468-4-marco.crivellari@suse.com commit ecae1bb8b0870cfa338c11083ef7ef02180e40be Author: Marco Crivellari Date: Thu Oct 30 17:20:42 2025 +0100 drm/probe-helper: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251030162043.292468-3-marco.crivellari@suse.com commit b351df4bbd127f3fa80b06f1a0cd7ccfcded4f7a Author: Marco Crivellari Date: Thu Oct 30 17:20:41 2025 +0100 drm/atomic-helper: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251030162043.292468-2-marco.crivellari@suse.com commit 6fa45759cf43df3508a94dda7b6b02735ab19c4f Author: Michał Winiarski Date: Fri Jan 30 22:56:24 2026 +0100 drm/xe/pf: Fix the address range assert in ggtt_get_pte helper The ggtt_get_pte helper used for saving VF GGTT incorrectly assumes that ggtt_size == ggtt_end. Fix it to avoid triggering spurious asserts if VF GGTT object lands in high GGTT range. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20260130215624.556099-1-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 20df14666adfe05156902bec0a54b1aba05ec4d4 Author: Ankit Nautiyal Date: Fri Feb 6 10:17:53 2026 +0530 drm/i915/dp: Restore the missing check for intel_dp_has_joiner Commit ad121a62d566 ("drm/i915/dp: Rework pipe joiner logic in mode_valid") replaced intel_dp_num_joined_pipes() with an explicit joiner candidate iteration. The previous code implicitly checked for DP joiner capability via intel_dp_has_joiner(), but this check was lost during the refactor. Restore the missing intel_dp_has_joiner() check in intel_dp_can_join() so that DP specific joiner conditions are taken into account. v2: Derive intel_dp from intel_attached_dp(). (Imre) Fixes: ad121a62d566 ("drm/i915/dp: Rework pipe joiner logic in mode_valid") Cc: Ankit Nautiyal Cc: Imre Deak Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260206044753.808631-1-ankit.k.nautiyal@intel.com commit 5293d4ab3a79e16b9cd24906262be31afc1fa230 Author: Ankit Nautiyal Date: Thu Feb 5 14:06:22 2026 +0530 drm/i915/dp: Make intel_dp_can_join() static intel_dp_can_join() was previously exposed in intel_dp.h, but after the recent joiner refactor it is only used internally via intel_dp_joiner_candidate_valid(). It no longer needs external visibility, so make it static and drop the prototype from intel_dp.h. Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260205083623.793902-2-ankit.k.nautiyal@intel.com commit 9d757669b2b22cd224c334924f798393ffca537c Author: Andy Shevchenko Date: Tue Jan 20 16:20:49 2026 +0100 drm/nouveau/gsp: simplify code with acpi_get_local_u64_address() Now we have a helper so there's no need to open-code. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260120152049.1763055-1-andriy.shevchenko@linux.intel.com Signed-off-by: Danilo Krummrich commit dbce431756f85ec76a189312afdae2dee14fb0de Author: Srinivasan Shanmugam Date: Fri Feb 6 18:51:41 2026 +0530 drm/gem: Make drm_gem_objects_lookup() self-cleaning on failure v6 drm_gem_objects_lookup() can allocate the output array and take references on GEM objects before it fails. If an error happens part-way through, callers previously had to clean up partially created results themselves. This relied on subtle and undocumented behavior and was easy to get wrong. Make drm_gem_objects_lookup() clean up on failure. The function now drops any references it already took, frees the array, and sets *objs_out to NULL before returning an error. On success, behavior is unchanged. Existing callers remain correct and their error cleanup paths simply do nothing when *objs_out is NULL. v2/v3: Move partial-lookup cleanup into objects_lookup(), perform reference dropping outside the lock, and remove reliance on __GFP_ZERO or implicit NULL handling. (Christian) v4: Use goto-style error handling in objects_lookup(), drop partial references outside the lock, and simplify drm_gem_objects_lookup() cleanup by routing failures through err_free_handles as suggested. (Christian) v5: Rebase on drm-misc-next, drop the ret local variable. (Christian) v6: Drop superfluous initialization of handles. (Christian/Tvrtko) Cc: Alex Deucher Suggested-by: Christian König Suggested-by: Tvrtko Ursulin Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Reviewed-by: Tvrtko Ursulin Signed-off-by: Arunpravin Paneer Selvam Link: https://patch.msgid.link/20260206132141.1474191-1-srinivasan.shanmugam@amd.com commit 8ad0f7d2e6fdfc4462a5b168ec64d73b7e952ab9 Author: Dmitry Baryshkov Date: Wed Jan 21 12:15:47 2026 +0200 drm: bridge: anx7625: implement message sending Swapping the data role requires sending the message to the other USB-C side. Implement sending these messages through the OCM. The code is largely based on the anx7411.c USB-C driver. Reviewed-by: Xin Ji Link: https://patch.msgid.link/20260121-anx7625-typec-v2-3-d14f31256a17@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit f81455b2d3327a5685623e7db4050dbbe5513bc3 Author: Dmitry Baryshkov Date: Wed Jan 21 12:15:46 2026 +0200 drm: bridge: anx7625: implement minimal Type-C support ANX7625 can be used as a USB-C controller, handling USB and DP data streams. Provide minimal Type-C support necessary for ANX7625 to register the Type-C port device and properly respond to data / power role events from the Type-C partner. While ANX7625 provides TCPCI interface, using it would circumvent the on-chip running firmware. Analogix recommended using the higher-level interface instead of TCPCI. Reviewed-by: Xin Ji Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260121-anx7625-typec-v2-2-d14f31256a17@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 1d7532444a32b53ff7344dc52019bab5a4b5ed66 Author: Dmitry Baryshkov Date: Wed Jan 21 12:15:45 2026 +0200 dt-bindings: drm/bridge: anx7625: describe Type-C connector ANX7625 can be used to mux converted video stream with the USB signals on a Type-C connector. Describe the optional connector subnode, make it exclusive with the AUX bus and port@1 as it is impossible to have both eDP panel and USB-C connector. Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260121-anx7625-typec-v2-1-d14f31256a17@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit e8100643ff01be0fc74048b8296cfb2b9b5c90ed Author: Matt Roper Date: Thu Feb 5 13:41:41 2026 -0800 drm/xe/xe3p_xpc: XeCore mask spans four registers On Xe3p_XPC, there are now four registers reserved to express the XeCore mask rather than just three. Define the new registers and update the IP descriptor accordingly. Note that this only applies to Xe3p_XPC for now; Xe3p_LPG still only uses three registers to express the mask. Reviewed-by: Gustavo Sousa Link: https://patch.msgid.link/20260205214139.48515-4-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 6acf3d3ed6c1f0febdd046578ea9cafcd47912f4 Author: Matt Roper Date: Thu Feb 5 13:41:40 2026 -0800 drm/xe: Move number of XeCore fuse registers to graphics descriptor The number of registers used to express the XeCore mask has some "special cases" that don't always get inherited by later IP versions so it's cleaner and simpler to record the numbers in the IP descriptor rather than adding extra conditions to the standalone get_num_dss_regs() function. Note that a minor change here is that we now always treat the number of registers as 0 for the media GT. Technically a copy of these fuse registers does exist in the media GT as well (at the usual 0x380000+$offset location), but the value of those is always supposed to read back as 0 because media GTs never have any XeCores or EUs. v2: - Add a kunit assertion to catch descriptors that forget to initialize either count. (Gustavo) Cc: Gustavo Sousa Reviewed-by: Gustavo Sousa Link: https://patch.msgid.link/20260205214139.48515-3-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit e19cc5ab347e3cdcc21c97ea5d11af8da7f1358d Author: Matt Coster Date: Fri Jan 23 14:44:50 2026 +0000 drm/imagination: Use dev_pm_domain_attach_list() This helper handles the attaching and linking of the entire list of power domains. Besides making pvr_power_domains_init() simpler, this also lays the groundwork to simplify supporting the varied power domain names used in Volcanic GPU cores. Note that we still need to create the links between power domains to ensure they're brought up in a valid sequence. Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20260123-pm-domain-attach-list-v1-1-d51dd7e43253@imgtec.com Signed-off-by: Matt Coster commit 55473b60178060a4fdb4631bd0c91879cc7d18d8 Author: Thomas Zimmermann Date: Thu Feb 5 15:40:48 2026 +0100 drm/fbdev-emulation: Remove support for legacy emulation Remove the internal DRM client from fbdev emulation. This has been required when some DRM drivers provided their own fbdev emulation. This is no longer the case with commit b55f3bbab891 ("drm/{i915, xe}: Implement fbdev emulation as in-kernel client") from 2024. Now there's only a single DRM client for fbdev-emulation that fills out the client callback functions as required. Signed-off-by: Thomas Zimmermann Reviewed-by: Maarten Lankhorst Link: https://patch.msgid.link/20260205144056.416759-1-tzimmermann@suse.de commit 6d438685340df6ac8570326aaa51c3603a2fe25c Author: Thomas Zimmermann Date: Thu Feb 5 15:10:44 2026 +0100 drm/fbdev-emulation: Remove empty placeholders Only DRM clients for fbdev emulation invoke fbdev helpers. Hence remove the empty placeholders for non-fbdev builds, as they are unused. Signed-off-by: Thomas Zimmermann Reviewed-by: Maarten Lankhorst Link: https://patch.msgid.link/20260205141142.412048-1-tzimmermann@suse.de commit c7c30c4093cc11ff66672471f12599a555708343 Author: Ankit Nautiyal Date: Fri Dec 26 10:03:59 2025 +0530 drm/i915/quirks: Fix device id for QUIRK_EDP_LIMIT_RATE_HBR2 entry Update the device ID for Dell XPS 13 7390 2-in-1 in the quirk `QUIRK_EDP_LIMIT_RATE_HBR2` entry. The previous ID (0x8a12) was incorrect; the correct ID is 0x8a52. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/5969 Fixes: 21c586d9233a ("drm/i915/dp: Add device specific quirk to limit eDP rate to HBR2") Cc: Jani Nikula Cc: Ville Syrjälä Cc: Ankit Nautiyal Cc: # v6.18+ Signed-off-by: Ankit Nautiyal Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20251226043359.2553-1-ankit.k.nautiyal@intel.com commit ee8bfb15d02dddb554ad4bdd6c44297f19556563 Author: Dave Airlie Date: Fri Feb 6 11:44:09 2026 +1000 drm: drop lib from header search path. This was leftover from when I dropped it in 4a9671a03f2b ("gpu: Move DRM buddy allocator one level up (part one)") Signed-off-by: Dave Airlie commit ba110db8e1bc206c13fd7d985e79b033f53bfdea Author: Joel Fernandes Date: Fri Feb 6 08:52:38 2026 +1000 gpu: Move DRM buddy allocator one level up (part two) Move the DRM buddy allocator one level up so that it can be used by GPU drivers (example, nova-core) that have usecases other than DRM (such as VFIO vGPU support). Modify the API, structures and Kconfigs to use "gpu_buddy" terminology. Adapt the drivers and tests to use the new API. The commit cannot be split due to bisectability, however no functional change is intended. Verified by running K-UNIT tests and build tested various configurations. Signed-off-by: Joel Fernandes Reviewed-by: Dave Airlie [airlied: I've split this into two so git can find copies easier. I've also just nuked drm_random library, that stuff needs to be done elsewhere and only the buddy tests seem to be using it]. Signed-off-by: Dave Airlie commit 4a9671a03f2be13acde0cb15c5208767a9cc56e4 Author: Joel Fernandes Date: Fri Feb 6 08:52:38 2026 +1000 gpu: Move DRM buddy allocator one level up (part one) Move the DRM buddy allocator one level up so that it can be used by GPU drivers (example, nova-core) that have usecases other than DRM (such as VFIO vGPU support). Modify the API, structures and Kconfigs to use "gpu_buddy" terminology. Adapt the drivers and tests to use the new API. The commit cannot be split due to bisectability, however no functional change is intended. Verified by running K-UNIT tests and build tested various configurations. Signed-off-by: Joel Fernandes Reviewed-by: Dave Airlie [airlied: I've split this into two so git can find copies easier. I've also just nuked drm_random library, that stuff needs to be done elsewhere and only the buddy tests seem to be using it]. Signed-off-by: Dave Airlie commit 91be6115e4677ad69bf8186988972b319d32ae61 Author: Vinay Belgaumkar Date: Wed Feb 4 11:03:14 2026 -0800 drm/xe: Add forcewake status to powergate_info Dump forcewake status and ref counts for all domains as part of this debugfs. This is the sample output from gt1- $ cat /sys/kernel/debug/dri//0/gt1/powergate_info Media Power Gating Enabled: yes Media Slice0 Power Gate Status: down GSC Power Gate Status: down GT.ref_count=0, GT.forcewake=0x10000 VDBox0.ref_count=0, VDBox0.forcewake=0x10000 VEBox0.ref_count=0, VEBox0.forcewake=0x10000 GSC.ref_count=0, GSC.forcewake=0x10000 v2: Fix checkpatch issues Reviewed-by: Badal Nilawar Signed-off-by: Vinay Belgaumkar Link: https://patch.msgid.link/20260204190314.2904009-3-vinay.belgaumkar@intel.com commit 2ea05b4b023129f3f70e341bc3b8dc39debb266b Author: Vinay Belgaumkar Date: Wed Feb 4 11:03:13 2026 -0800 drm/xe: Add GSC to powergate_info Add GSC powergate status to the existing debugfs. Reviewed-by: Badal Nilawar Signed-off-by: Vinay Belgaumkar Link: https://patch.msgid.link/20260204190314.2904009-2-vinay.belgaumkar@intel.com commit fabedb758fcb16fcd80230c28356f8aaff972446 Author: Vinay Belgaumkar Date: Tue Feb 3 17:42:34 2026 -0800 drm/xe: Add a wrapper for SLPC set/unset params Also, extract out the GuC RC related set/unset param functions into xe_guc_rc file. GuC still allows us to override GuC RC mode using an SLPC H2G interface. Continue to use that interface, but move the related code to the newly created xe_guc_rc file. Cc: Riana Tauro Cc: Michal Wajdeczko Reviewed-by: Riana Tauro Reviewed-by: Michal Wajdeczko Signed-off-by: Vinay Belgaumkar Link: https://patch.msgid.link/20260204014234.2867763-4-vinay.belgaumkar@intel.com commit a3f949cd61e0ea1bc93c00241ea1d7d9e1fcb3e9 Author: Vinay Belgaumkar Date: Tue Feb 3 17:42:33 2026 -0800 drm/xe: Use FORCEWAKE_GT in xe_guc_pc_fini_hw() No need to use FORCEWAKE_ALL since the registers being written are in GT domain. Cc: Michal Wajdeczko Signed-off-by: Vinay Belgaumkar Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20260204014234.2867763-3-vinay.belgaumkar@intel.com commit 40a684f91d267164f9adf0d35b572b4cad0b8d3c Author: Vinay Belgaumkar Date: Tue Feb 3 17:42:32 2026 -0800 drm/xe: Decouple GuC RC code from xe_guc_pc Move enable/disable GuC RC logic into the new file. This will allow us to independently enable/disable GuC RC and not rely on SLPC related functions. GuC already provides separate H2G interfaces to setup GuC RC and SLPC. Cc: Riana Tauro Cc: Michal Wajdeczko Reviewed-by: Michal Wajdeczko Reviewed-by: Riana Tauro Signed-off-by: Vinay Belgaumkar Link: https://patch.msgid.link/20260204014234.2867763-2-vinay.belgaumkar@intel.com commit 106340775a8f5ec45e18bab18666f56e4af13d92 Author: Pallavi Mishra Date: Thu Jan 29 05:47:22 2026 +0000 drm/xe/tests: Fix g2g_test_array indexing The G2G KUnit test allocates a compact N×N matrix sized by gt_count and verifies entries using dense indices: idx = (j * gt_count) + i The producer path currently computes idx using gt->info.id. However, gt->info.id values are not guaranteed to be contiguous. For example, with gt_count=2 and IDs {0,3}, this formula produces indices beyond the allocated range, causing mismatches and potential out-of-bounds access. Update the producer to map each GT to a dense index in [0..gt_count-1] and compute: idx = (tx_dense * gt_count) + rx_dense Additionally, introduce an event-based delay in g2g_test_in_order() to ensure ordering between sends. v2: Add single helper function (Daniele) v3: Modify comment (Daniele) Signed-off-by: Pallavi Mishra Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Vinay Belgaumkar Link: https://patch.msgid.link/20260129054722.2150674-1-pallavi.mishra@intel.com commit 9b5e995e61290741b0e2b70fc631cc591e21d499 Author: Nareshkumar Gollakoti Date: Mon Feb 2 22:38:13 2026 +0530 drm/xe: Mutual exclusivity between CCS-mode and PF Due to SLA agreement between PF and VFs, currently we block CCS mode changes if driver is running as PF, even if there are no VFs enabled yet. Use lockdown mechanism provided by the PF to relax that limitation and still enforce above VFs related requirements. Reviewed-by: Michal Wajdeczko Signed-off-by: Nareshkumar Gollakoti Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260202170810.1393147-6-naresh.kumar.g@intel.com commit 4e8f602ac3574cf1ebc7acfb6624d06e04b30c91 Author: Nareshkumar Gollakoti Date: Mon Feb 2 22:38:12 2026 +0530 drm/xe: Prevent VFs from exposing the CCS mode sysfs file Skip creating CCS sysfs files in VF mode to ensure VFs do not try to change CCS mode, as it is predefined and immutable in the SR-IOV mode. Reviewed-by: Michal Wajdeczko Signed-off-by: Nareshkumar Gollakoti Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260202170810.1393147-5-naresh.kumar.g@intel.com commit f59cde8a2452b392115d2af8f1143a94725f4827 Author: Michal Wajdeczko Date: Tue Feb 3 20:37:45 2026 +0100 drm/xe/configfs: Fix 'parameter name omitted' errors On some configs and old compilers we can get following build errors: ../drivers/gpu/drm/xe/xe_configfs.h: In function 'xe_configfs_get_ctx_restore_mid_bb': ../drivers/gpu/drm/xe/xe_configfs.h:40:76: error: parameter name omitted static inline u32 xe_configfs_get_ctx_restore_mid_bb(struct pci_dev *pdev, enum xe_engine_class, ^~~~~~~~~~~~~~~~~~~~ ../drivers/gpu/drm/xe/xe_configfs.h: In function 'xe_configfs_get_ctx_restore_post_bb': ../drivers/gpu/drm/xe/xe_configfs.h:42:77: error: parameter name omitted static inline u32 xe_configfs_get_ctx_restore_post_bb(struct pci_dev *pdev, enum xe_engine_class, ^~~~~~~~~~~~~~~~~~~~ when trying to define our configfs stub functions. Fix that. Fixes: 7a4756b2fd04 ("drm/xe/lrc: Allow to add user commands mid context switch") Signed-off-by: Michal Wajdeczko Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260203193745.576-1-michal.wajdeczko@intel.com commit 18443ff22559c4d1c83356ab75108db30c1f893b Author: Michal Wajdeczko Date: Tue Feb 3 22:12:39 2026 +0100 drm/xe: Drop unnecessary include from xe_tile.h We don't need to include xe_device_types.h there. Signed-off-by: Michal Wajdeczko Reviewed-by: Matt Roper Reviewed-by: Tejas Upadhyay Link: https://patch.msgid.link/20260203211240.745-5-michal.wajdeczko@intel.com commit e7002e0eb438450822212bb36d16ef4318cde78a Author: Michal Wajdeczko Date: Tue Feb 3 22:12:38 2026 +0100 drm/xe: Promote struct xe_tile definition to own file We already have separate .c and .h files for xe_tile functions, time to introduce _types.h to follow what other components do. Signed-off-by: Michal Wajdeczko Cc: Matt Roper Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260203211240.745-4-michal.wajdeczko@intel.com commit ed61c18617b1d95a9e0d4917749f28776eccefb7 Author: Michal Wajdeczko Date: Tue Feb 3 22:12:37 2026 +0100 drm/xe: Promote struct xe_mmio definition to own file We already have separate .c and .h files for xe_mmio functions, time to introduce _types.h to follow what other components do. Signed-off-by: Michal Wajdeczko Reviewed-by: Stuart Summers #v1 Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260203211240.745-3-michal.wajdeczko@intel.com commit 8965e00883cc4d66749e1aa89322588c860077cd Author: Michal Wajdeczko Date: Tue Feb 3 22:12:36 2026 +0100 drm/xe: Move xe_root_tile_mmio() to xe_device.h It seems to be a better place for this helper function, where we already have other 'root' oriented helpers. Signed-off-by: Michal Wajdeczko Reviewed-by: Stuart Summers Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260203211240.745-2-michal.wajdeczko@intel.com commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324 Author: Michal Wajdeczko Date: Wed Feb 4 00:53:32 2026 +0100 drm/xe/pf: Fix sysfs initialization In case of devm_add_action_or_reset() failure the provided cleanup action will be run immediately on the not yet initialized kobject. This may lead to errors like: [ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called. [ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9 [ ] RIP: 0010:kobject_put+0xdf/0x250 [ ] Call Trace: [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe] [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe] [ ] xe_sriov_init_late+0x5f/0x2c0 [xe] [ ] xe_device_probe+0x5f2/0xc20 [xe] [ ] xe_pci_probe+0x396/0x610 [xe] [ ] local_pci_probe+0x47/0xb0 [ ] refcount_t: underflow; use-after-free. [ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9 [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0 [ ] Call Trace: [ ] kobject_put+0x174/0x250 [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe] [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe] [ ] xe_sriov_init_late+0x5f/0x2c0 [xe] [ ] xe_device_probe+0x5f2/0xc20 [xe] [ ] xe_pci_probe+0x396/0x610 [xe] [ ] local_pci_probe+0x47/0xb0 Fix that by calling kobject_init() and kobject_add() separately and register cleanup action after the kobject is initialized. Also make this cleanup registration a part of the create helper to fix another mistake, as in the loop we were wrongly passing parent kobject while registering cleanup action, and this resulted in some undetected leaks. Fixes: 5c170a4d9c53 ("drm/xe/pf: Prepare sysfs for SR-IOV admin attributes") Signed-off-by: Michal Wajdeczko Cc: Rodrigo Vivi Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260203235332.1350-1-michal.wajdeczko@intel.com commit f27e64422054ff78566316509120f7ee2ecc7660 Author: Matt Roper Date: Wed Feb 4 11:10:26 2026 -0800 drm/xe: Drop unnecessary goto in xe_device_create The error label in this function just does an immediate return without any further cleanup or processing. Replace the goto statements with returns. Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260204191025.3957211-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 779ec12c85c9e4547519e3903a371a3b26a289de Author: Alexander Konyukhov Date: Tue Feb 3 16:48:46 2026 +0300 drm/komeda: fix integer overflow in AFBC framebuffer size check The AFBC framebuffer size validation calculates the minimum required buffer size by adding the AFBC payload size to the framebuffer offset. This addition is performed without checking for integer overflow. If the addition oveflows, the size check may incorrectly succed and allow userspace to provide an undersized drm_gem_object, potentially leading to out-of-bounds memory access. Add usage of check_add_overflow() to safely compute the minimum required size and reject the framebuffer if an overflow is detected. This makes the AFBC size validation more robust against malformed. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 65ad2392dd6d ("drm/komeda: Added AFBC support for komeda driver") Signed-off-by: Alexander Konyukhov Acked-by: Liviu Dudau Signed-off-by: Liviu Dudau Link: https://lore.kernel.org/r/20260203134907.1587067-1-Alexander.Konyukhov@kaspersky.com commit 2bcbc706dfa02ae50118173a6f6d8a12e735480c Author: Christian König Date: Fri Dec 19 11:41:54 2025 +0100 dma-buf: add dma_fence_was_initialized function v2 Some driver use fence->ops to test if a fence was initialized or not. The problem is that this utilizes internal behavior of the dma_fence implementation. So better abstract that into a function. v2: use a flag instead of testing fence->ops, rename the function, move to the beginning of the patch set. Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260120105655.7134-2-christian.koenig@amd.com commit 2bebc88d5e37ddcb5ea5039a39f39527662b27f0 Merge: 96f30ee0fb9db1 3cc9398a9ea69b Author: Thomas Zimmermann Date: Thu Feb 5 10:33:06 2026 +0100 Merge drm/drm-next into drm-misc-next Backmerging to get bug fixes from v6.19-rc7. Signed-off-by: Thomas Zimmermann commit fcb7a015464ddbb59001df46ea3f75a9501e131b Author: Ankit Nautiyal Date: Wed Feb 4 10:32:50 2026 +0530 drm/i915/alpm: Disable LOBF around transitioning for LRR/seamless MN When enabling LRR/seamless MN disable LOBF first and re-enable afterwards. - pre_plane_update: if LOBF was enabled, disable LOBF before the update_lrr/update_m_n transition. - post_plane_update: Re-enable LOBF after the transition. Signed-off-by: Ankit Nautiyal Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/20260204050250.762718-6-ankit.k.nautiyal@intel.com commit 96f30ee0fb9db1663eb8fd55c12e4c67da8c4a90 Author: Icenowy Zheng Date: Thu Jan 29 10:39:19 2026 +0800 drm/bridge: add a driver for T-Head TH1520 HDMI controller T-Head TH1520 SoC contains a Synopsys DesignWare HDMI controller (paired with DesignWare HDMI TX PHY Gen2) that takes the "DP" output from the display controller. Add a driver for this controller utilizing the common DesignWare HDMI code in the kernel. Signed-off-by: Icenowy Zheng Signed-off-by: Icenowy Zheng Tested-by: Han Gao Tested-by: Michal Wilczynski Acked-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260129023922.1527729-6-zhengxingda@iscas.ac.cn commit 3d60ff99a78ccd3b72765542dd083b134d6ae4bb Author: Icenowy Zheng Date: Thu Jan 29 10:39:18 2026 +0800 dt-bindings: display/bridge: add binding for TH1520 HDMI controller T-Head TH1520 SoC contains a Synopsys DesignWare HDMI controller paired with DesignWare HDMI PHY, with an extra clock gate for HDMI pixel clock and two reset controls. Add a device tree binding to it. Signed-off-by: Icenowy Zheng Signed-off-by: Icenowy Zheng Reviewed-by: Krzysztof Kozlowski Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260129023922.1527729-5-zhengxingda@iscas.ac.cn commit 31106c684db72b0714013e2620ad415cc8756109 Author: Ankit Nautiyal Date: Wed Feb 4 10:32:49 2026 +0530 drm/i915/alpm: Simplify and align LOBF checks in pre/post plane update The pre_plane_update and post_plane_update hooks essentially disable/enable lobf feature. Use the existing _is_enabling/is_disabling logic for this in the pre_plane_update and post_plane_update paths. Also rename the helpers to intel_alpm_lobf_{en,dis}able(). v2: Remove redeundant checks during enabling/disabling. (Jouni) Signed-off-by: Ankit Nautiyal Reviewed-by: Michał Grzelak Reviewed-by: Jouni Högander Link: https://patch.msgid.link/20260204050250.762718-5-ankit.k.nautiyal@intel.com commit dbf21777caa8b8c88c12f7f036b01208fec0d55a Author: Icenowy Zheng Date: Thu Jan 29 10:39:17 2026 +0800 drm: verisilicon: add a driver for Verisilicon display controllers This is a from-scratch driver targeting Verisilicon DC-series display controllers, which feature self-identification functionality like their GC-series GPUs. Only DC8200 is being supported now, and only the main framebuffer is set up (as the DRM primary plane). Support for more DC models and more features is my further targets. As the display controller is delivered to SoC vendors as a whole part, this driver does not use component framework and extra bridges inside a SoC is expected to be implemented as dedicated bridges (this driver properly supports bridge chaining). Signed-off-by: Icenowy Zheng Signed-off-by: Icenowy Zheng Tested-by: Han Gao Tested-by: Michal Wilczynski Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260129023922.1527729-4-zhengxingda@iscas.ac.cn commit 8a517b1e6d8bdde298a7006234c8188c6fb43747 Author: Ankit Nautiyal Date: Wed Feb 4 10:32:48 2026 +0530 drm/i915/alpm: Allow LOBF only for platform that have Always on VRR TG As per bspec the LOBF is allowed when running in fixed refresh rate mode i.e. when flipline = vmin = vmax and when window1 is non zero. This implies that we can allow LOBF only when VRR timing generator is running in the fixed refresh rate mode. Use the check intel_vrr_always_use_vrr_tg() to avoid LOBF with legacy timing generator. Also use intel_vrr_is_fixed_rr() to check for fixed refresh rate mode. v2: Modify commit message to clarify window1 requirement for LOBF. (Ville) Signed-off-by: Ankit Nautiyal Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/20260204050250.762718-4-ankit.k.nautiyal@intel.com commit 79ee2fbb8e11ec193326ba3595aaabb46f96defc Author: Ankit Nautiyal Date: Wed Feb 4 10:32:47 2026 +0530 drm/i915/alpm: Allow LOBF only if window1 > alpm check_entry lines LOBF must be disabled if the number of lines within Window 1 is not greater than ALPM_CTL[ALPM Entry Check] v2: Consider the case where SCL is in the active region. (Ville) Bspec:71041 Signed-off-by: Ankit Nautiyal Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/20260204050250.762718-3-ankit.k.nautiyal@intel.com commit 32c471e8f0958fae3d461f4dd299090fa44a6d45 Author: Ankit Nautiyal Date: Wed Feb 4 10:32:46 2026 +0530 drm/i915/alpm: Compute LOBF late after guardband is already determined Currently intel_alpm_lobf_compute_config() tries to account for guardband +SCL requirements during encoder->compute_config() phase, even before guardband is computed. Also, LOBF depends on crtc_state->has_psr which can be modified in encoder->compute_config_late(). Account for lobf requirements while optimizing the guardband and add checks for final guardband in encoder->compute_config_late() phase after the guardband and the final state of crtc_state->has_psr are already computed. Use crtc_state->vrr.guardband and crtc_state->set_context_latency for the computation and add more documentation for the dependency of first sdp position, guardband, set context latency and wake lines. v2: Add helper to use min guardband required for lobf. v3: Remove unrelated inadvertent changes. (Michał) v4: Add a #FIXME note for computing wakelines based on feature. (Jouni) Bspec:71041 Signed-off-by: Ankit Nautiyal Reviewed-by: Michał Grzelak Reviewed-by: Jouni Högander Link: https://patch.msgid.link/20260204050250.762718-2-ankit.k.nautiyal@intel.com commit 5f6965fa1e2ec8ac69e1d448d343a528dc60cdfb Author: Icenowy Zheng Date: Thu Jan 29 10:39:16 2026 +0800 dt-bindings: display: add verisilicon,dc Verisilicon has a series of display controllers prefixed with DC and with self-identification facility like their GC series GPUs. Add a device tree binding for it. Depends on the specific DC model, it can have either one or two display outputs, and each display output could be set to DPI signal or "DP" signal (which seems to be some plain parallel bus to HDMI controllers). Signed-off-by: Icenowy Zheng Signed-off-by: Icenowy Zheng Reviewed-by: Rob Herring (Arm) Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260129023922.1527729-3-zhengxingda@iscas.ac.cn commit c131d78840d7487e41c3afdc52bb74fd3f8861ef Author: Icenowy Zheng Date: Thu Jan 29 10:39:15 2026 +0800 dt-bindings: vendor-prefixes: add verisilicon VeriSilicon is a Silicon IP vendor, which is the current owner of Vivante series video-related IPs and Hantro series video codec IPs. Add a vendor prefix for this company. Signed-off-by: Icenowy Zheng Signed-off-by: Icenowy Zheng Acked-by: Rob Herring (Arm) Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260129023922.1527729-2-zhengxingda@iscas.ac.cn commit 58bb61161ee121b09bd61ad26ed424c4db5c03c2 Author: Suraj Kandpal Date: Wed Feb 4 08:02:47 2026 +0530 drm/i915/ltphy: Return true for TBT scenario during lt_phy_state compare TBT PHY is enablement/disablement is handled by its own TBT module. We do not play a big part in it's state management, that being take care by it's own TBT modeule. The PHY/PLL TypeC mode (TBT, DP-alt) can change after the PLL state was computed for a modeset, so the state verification after the modeset sequence would indicate a mismatch in case the mode changed from DP-alt to TBT, or from TBT to DP-alt mode. To avoid such a mismatch error the verification is skipped if the mode for either the read-out or the computed state is TBT (where that TBT PLL state doesn't reflect anyway the PLL's actual HW state). Simply return true when we are in tbt mode. Signed-off-by: Suraj Kandpal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260204023247.1560196-1-suraj.kandpal@intel.com commit ec49857ad181f2a68a3bea15422f2936ff366d47 Author: Matthew Brost Date: Fri Jan 30 11:49:28 2026 -0800 drm/gpusvm: Allow device pages to be mapped in mixed mappings after system pages The current code rejects device mappings whenever system pages have already been encountered. This is not the intended behavior when allow_mixed is set. Relax the restriction by permitting a single pagemap to be selected when allow_mixed is enabled, even if system pages were found earlier. Fixes: bce13d6ecd6c ("drm/gpusvm, drm/xe: Allow mixed mappings for userptr") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Francois Dugast Link: https://patch.msgid.link/20260130194928.3255613-3-matthew.brost@intel.com commit 556dba95473900073a6c03121361c11f646dc551 Author: Matthew Brost Date: Fri Jan 30 11:49:27 2026 -0800 drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages drm_gpusvm_get_pages() only sets the local flags prior to committing the pages. If an error occurs mid-mapping, has_dma_mapping will be clear, causing the unmap function to skip unmapping pages that were successfully mapped before the error. Fix this by forcibly setting has_dma_mapping in the error path to ensure all previously mapped pages are properly unmapped. Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Francois Dugast Link: https://patch.msgid.link/20260130194928.3255613-2-matthew.brost@intel.com commit d317e2ef9dcf673c9f37cda784284af7c6812757 Author: Yuwen Chen Date: Wed Jan 28 10:03:10 2026 +0800 selftests/futex: Fix incorrect result reporting of futex_requeue test item When using the TEST_HARNESS_MAIN macro definition to declare the main function, it is required to use the EXPECT*() and ASSERT*() macros in conjunction and not ksft_test_result_*(). Otherwise, even if a test item fails, the test will still return a success result because ksft_test_result_*() does not affect the test harness state. Convert the code to use EXPECT/ASSERT() variants, which ensures that the overall test result is fail if one of the EXPECT()s fails. [ tglx: Massaged change log to explain _why_ ksft_test_result*() is the wrong choice ] Fixes: f341a20f6d7e ("selftests/futex: Refactor futex_requeue with kselftest_harness.h") Signed-off-by: Yuwen Chen Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/tencent_51851B741CC4B5EC9C22AFF70BA82BB60805@qq.com commit 05cffc0749388d5979a75039f3715b17092c3f40 Author: Mitul Golani Date: Tue Feb 3 14:19:37 2026 +0530 drm/i915/display: Implement Wa_16024710867 Defeature port sync feature for xe3lpd onwards. --v1: - Use xe3lpd naming (Suraj) - Use IS_DISPLAY_VER (Suraj) --v2: - Comments update and Adding Bspec link (Suraj) Bspec: 69965 Signed-off-by: Mitul Golani Reviewed-by: Suraj Kandpal Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260203084937.1447834-2-mitulkumar.ajitkumar.golani@intel.com commit 39125eaf8863ab09d70c4b493f58639b08d5a897 Author: Karthik Poosa Date: Fri Jan 23 23:02:38 2026 +0530 drm/xe/pm: Disable D3Cold for BMG only on specific platforms Restrict D3Cold disablement for BMG to unsupported NUC platforms, instead of disabling it on all platforms. Signed-off-by: Karthik Poosa Fixes: 3e331a6715ee ("drm/xe/pm: Temporarily disable D3Cold on BMG") Link: https://patch.msgid.link/20260123173238.1642383-1-karthik.poosa@intel.com Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi commit cff3f89ffbdd4b6c43a117c01aaf5b290ff80803 Author: Damon Ding Date: Wed Dec 17 17:33:06 2025 +0800 drm/bridge: analogix_dp: Move &drm_bridge_funcs.mode_set to &drm_bridge_funcs.atomic_enable According to the include/drm/drm_bridge.h, the callback &drm_bridge_funcs.mode_set is deprecated and it should be better to include the mode setting in the &drm_bridge_funcs.atomic_enable instead. Signed-off-by: Damon Ding Reviewed-by: Dmitry Baryshkov Tested-by: Marek Szyprowski Reviewed-by: Luca Ceresoli Tested-by: Heiko Stuebner (on rk3588) Link: https://patch.msgid.link/20251217093321.3108939-4-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli commit 10a2694fde68ba214eca7d24229094fc2427fddd Author: Damon Ding Date: Wed Dec 17 17:33:05 2025 +0800 drm/bridge: analogix_dp: Formalize the struct analogix_dp_device Use the tap instead of the space for &analogix_dp_device.aux and &analogix_dp_device.force_hpd. Signed-off-by: Damon Ding Reviewed-by: Dmitry Baryshkov Tested-by: Marek Szyprowski Reviewed-by: Luca Ceresoli Tested-by: Heiko Stuebner (on rk3588) Link: https://patch.msgid.link/20251217093321.3108939-3-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli commit 3c05e956b85e70cbd5042e03f615b23ca4635385 Author: Damon Ding Date: Wed Dec 17 17:33:04 2025 +0800 drm/display: bridge_connector: Ensure last bridge determines EDID/modes detection capabilities When multiple bridges are present, EDID detection capability (DRM_BRIDGE_OP_EDID) takes precedence over modes detection (DRM_BRIDGE_OP_MODES). To ensure the above two capabilities are determined by the last bridge in the chain, we handle three cases: Case 1: The later bridge declares only DRM_BRIDGE_OP_MODES - If the previous bridge declares DRM_BRIDGE_OP_EDID, set &drm_bridge_connector.bridge_edid to NULL and set &drm_bridge_connector.bridge_modes to the later bridge. - Ensure modes detection capability of the later bridge will not be ignored. Case 2: The later bridge declares only DRM_BRIDGE_OP_EDID - If the previous bridge declares DRM_BRIDGE_OP_MODES, set &drm_bridge_connector.bridge_modes to NULL and set &drm_bridge_connector.bridge_edid to the later bridge. - Although EDID detection capability has higher priority, this operation is for balance and makes sense. Case 3: the later bridge declares both of them - Assign later bridge as &drm_bridge_connector.bridge_edid and and &drm_bridge_connector.bridge_modes to this bridge. - Just leave transfer of these two capabilities as before. Signed-off-by: Damon Ding Suggested-by: Dmitry Baryshkov Tested-by: Marek Szyprowski Reviewed-by: Luca Ceresoli Tested-by: Heiko Stuebner (on rk3588) Link: https://patch.msgid.link/20251217093321.3108939-2-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli commit 3921250835583a4e70dd8853d6ed59319c746b95 Author: Mika Kahola Date: Mon Feb 2 14:02:42 2026 +0000 drm/i915/power_well: Enable workaround for DSS clock gating issue Prevent display corruption observed after restart, hotplug, or unplug operations on Meteor Lake and newer platforms. The issue is caused by DSS clock gating affecting DSC logic when pipe power wells are disabled. Apply this WA by disabling DSS clock gating for the affected pipes before turning off their power wells. This avoids DSC corruption on external displays. v2: Use single intel_de_rmw() (Jani) Switch to use drm_dbg_kms() instead of drm_printf() (Jani) Remove WA number from commit message (Suraj) rename dss_clock_gating_enable_disable() to dss_pipe_gating_enable_disable(); v3: Do not use open ended display version when checking wa (Matt) WA: 22021048059 BSpec: 690991, 666241 Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260202140242.704234-1-mika.kahola@intel.com commit 34ef561a0d497dd86dd4f511a86c7481ddf29aeb Author: Michal Wajdeczko Date: Wed Jan 21 22:42:16 2026 +0100 drm/xe/configfs: Add sriov.admin_only_pf attribute Instead of relying on fixed relation to the display probe flag, add configfs attribute to allow an administrator to configure desired PF operation mode in a more flexible way. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/20260121214218.2817-6-michal.wajdeczko@intel.com commit 10f817c256d7d5fd2680ecdb4ab52c5506fe90b5 Author: Michal Wajdeczko Date: Tue Jan 27 22:05:01 2026 +0100 drm/xe/pf: Define admin_only as real flag Instead of doing guesses each time during the runtime, set flag admin_only once during PF's initialization. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/20260127210501.794-1-michal.wajdeczko@intel.com commit 0dfc7306b9600127afce5dbcb53389ca72237031 Author: Michal Wajdeczko Date: Wed Jan 21 22:42:14 2026 +0100 drm/xe/configfs: Always return consistent max_vfs value The max_vfs parameter used by the Xe driver has its default value definition, but it could be altered by the module parameter or by the device specific configfs attribute. To avoid mistakes or code duplication, always rely on the configfs helper (or stub), which will provide necessary fallback if needed. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/20260121214218.2817-4-michal.wajdeczko@intel.com commit 56dfa9fc39f0d03ca165f84382d088825f5e5404 Author: Michal Wajdeczko Date: Wed Jan 21 22:42:13 2026 +0100 drm/xe/configfs: Use proper notation for local include For local includes we should use "" notation, not <>. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/20260121214218.2817-3-michal.wajdeczko@intel.com commit 44f44d43f991825c856903bed01390c26c21e489 Author: Michal Wajdeczko Date: Wed Jan 21 22:42:12 2026 +0100 drm/xe: Keep all defaults in single header We already have most of Xe defaults defined in xe_module.c, where we use them for the modparam initializations, but some were defined elsewhere, which breaks the consistency. Introduce xe_defaults.h file, that will act as a placeholder for all our default values, and can be used from other places. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/20260121214218.2817-2-michal.wajdeczko@intel.com commit e675b248278c784b0de50ff95586965bbba7372e Author: Chaitanya Kumar Borah Date: Mon Feb 2 16:07:31 2026 +0530 drm/i915/display: Extend the max dotclock limit to WCL Add upper limit check for pixel clock for WCL. For prior platforms though the bspec mentions the dotclock limits, however these are intentionally not enforced to avoid regressions, unless real issues are observed. BSpec: 49199, 68912 Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-18-ankit.k.nautiyal@intel.com commit 50f5168775685f78e4492fcc69dc10d288c579d0 Author: Chaitanya Kumar Borah Date: Mon Feb 2 16:07:30 2026 +0530 drm/i915/display: Add upper limit check for pixel clock Add upper limit check for pixel clock for DISPLAY_VER >= 30. Limits don't apply when DSC is enabled. The helper returns the upper limit for the platforms, capped to the max dotclock (khz). For the currently supported versions of HDMI, pixel clock is already limited to 600Mhz so nothing needs to be done there as of now. v2: - Add this limit to the new helper. v3: - Rename helper to intel_max_uncompressed_dotclock(). (Imre) - Limit only for PTL and cap the limit to max_dotclock. (Imre) BSpec: 49199, 68912 Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-17-ankit.k.nautiyal@intel.com commit a049ced86a40faf1997745d1e748b57f50701bbe Author: Ankit Nautiyal Date: Mon Feb 2 16:07:29 2026 +0530 drm/i915/dp: Add helpers for joiner candidate loops Introduce for_each_joiner_candidate(), intel_dp_joiner_candidate_valid() and intel_dp_joiner_candidate_valid() to remove duplicated joiner enumeration and validity checks across DP SST and MST paths. Suggested-by: Imre Deak Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-16-ankit.k.nautiyal@intel.com commit 5ec260d7bb47c8a63a6c8b31138a1a43f461d902 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:28 2026 +0530 drm/i915/dp: Account for DSC slice overhead Account for DSC slice overhead bubbles and adjust the pixel rate while checking the pixel rate against the max dotclock limits. v2: Add missing assignment for dsc_slice_count in mst_connector_mode_valid_ctx(). (Imre) v3: Explicitly pass dsc_slice_count as 0 for Non-DSC case. (Imre) Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-15-ankit.k.nautiyal@intel.com commit 0bdd29f5855b54fc4344a3036552f75554ae7573 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:27 2026 +0530 drm/i915/dp: Refactor dsc_slice_count handling in intel_dp_mode_valid() Make dsc_slice_count closer to the block where it is used and promote it from u8 to int. This aligns it with upcoming DSC bubble pixel-rate adjustments, where the slice count participates in wider arithmetic. Currently, for non-eDP (DP/DP_MST) cases the slice count is computed only inside intel_dp_dsc_mode_valid() and is not used by the caller. Once DSC bubble handling is added, dp_mode_valid() will need access to its own local slice count for non-eDP cases as well. Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-14-ankit.k.nautiyal@intel.com commit 7a687f705e2c62f012d6d803ef86f5bfff41c015 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:26 2026 +0530 drm/i915/dp: Introduce helper to check pixel rate against dotclock limits Add intel_dp_dotclk_valid() helper, that checks the required pixel rate against platform dotclock limit. With joined pipes the effective dotclock limit depends upon the number of joined pipes. Call the helper from the mode_valid phase and from the compute_config phase where we need to check the limits for the given target clock for a given joiner candidate. v2: Rename the helper to intel_dp_dotclk_valid(). (Imre) Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-13-ankit.k.nautiyal@intel.com commit 87860a1ccc76f53b8667110fe367953876308d18 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:25 2026 +0530 drm/i915/dp: Remove unused joiner helpers The helpers intel_dp_num_joined_pipes() and intel_dp_needs_joiner() are no longer used now that joiner selection iterates over all candidates. Remove them. Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-12-ankit.k.nautiyal@intel.com commit b506a8e18c972ef55c9dee3528f2470299ef6798 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:24 2026 +0530 drm/i915/dp_mst: Rework pipe joiner logic in compute_config Similar to the DP SST, refactor mst_stream_compute_config() to iterate over joiner candidates and select the minimal joiner configuration that satisfies the mode requirements. This prepares the logic for future changes that will consider DSC slice overhead. v2: - Move the check for dotclock in the new helper and check for both DSC and non-DSC case. In case the check fails for non-DSC, fallback to DSC configuration. (Imre) - Propagate the return value from the core helper: mst_stream_compute_link_for_joined_pipes(). (Imre) v3: - Use num_joined_pipes instead of num_pipes. (Imre) v4: - Switch to 'ret == 0' for break condition to match SST code. Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-11-ankit.k.nautiyal@intel.com commit 331a58a6035f6049480ab17e3905d806c74a722b Author: Ankit Nautiyal Date: Mon Feb 2 16:07:23 2026 +0530 drm/i915/dp_mst: Extract helper to compute link for given joiner config Move the joiner-dependent portion of mst_stream_compute_config() into mst_stream_compute_link_for_joined_pipes(), which computes the MST link configuration for a specific num_joined_pipes. Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-10-ankit.k.nautiyal@intel.com commit a120f802e0004470fdab91e907ca43f226a73419 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:22 2026 +0530 drm/i915/dp_mst: Rework pipe joiner logic in mode_valid Refactor the logic to get the number of joined pipes. Start with a single pipe and incrementally try additional pipes only if needed. While DSC overhead is not yet computed here, this restructuring prepares the code to support that in follow-up changes. v2: - Remove fallback in case force-joiner configuration fails. (Imre) - Drop redundant MODE_OK assignment (Imre) v3: - Align with the changes in intel_dp_mode_valid(). (Imre) v4: - Set MODE_CLOCK_HIGH on DSC/rate failures aligning with SST case. (Imre) Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-9-ankit.k.nautiyal@intel.com commit c80311c04331f2f42446eac21d7c3528c2e3c062 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:21 2026 +0530 drm/i915/dp_mst: Move the joiner dependent code together Move the calculation of num_joined_pipes and other constraints that depend on it, into a single block in mst_stream_compute_config(). This groups all joiner-dependent logic together, preparing the code for a future loop-based evaluation of multiple joiner configurations. Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-8-ankit.k.nautiyal@intel.com commit f8c172660a2a08cfdd17b0394168e03f07feada2 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:20 2026 +0530 drm/i915/dp_mst: Move the check for dotclock at the end Refactor the mode_valid to have all joiner dependent stuff together and place the check for dotclock limit at the very end. This will help in the following refactor to iterate over the joiner candidates and find the best joiner candidate that satisfy all checks and limits. v2: Update status to MODE_CLOCK_HIGH if max_dotclock check fails. (Imre) v3: Drop redundant MODE_OK assignment and return. (Imre) Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-7-ankit.k.nautiyal@intel.com commit 1f1e3e5c65f6d8fe08bc0d300ba085ba29c887f6 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:19 2026 +0530 drm/i915/dp: Rework pipe joiner logic in compute_config Currently, the number of joined pipes are determined early in the flow, which limits flexibility for accounting DSC slice overhead. To address this, recompute the joined pipe count during DSC configuration. Refactor intel_dp_dsc_compute_config() to iterate over joiner candidates and select the minimal joiner configuration that satisfies the mode requirements. This prepares the logic for future changes that will consider DSC slice overhead. v2: - Rename helper to intel_dp_compute_link_for_joined_pipes(). (Imre) - Move the check for max dotclock inside the helper so that if dotclock check fails for non DSC case for a given number of joined pipes, we are able to fallback to the DSC mode. (Imre) v3: - Drop fallback to other joiner configurations, if the force joiner configuration fails. (Imre) - Check for maxdotclock limit for non-DSC case first and fall back to DSC if the check fails. (Imre) - Initialize ret to -EINVAL to handle case where we bail out early. (Imre) Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-6-ankit.k.nautiyal@intel.com commit ad121a62d5663f3b68ad55c9d733af0c4b663f85 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:18 2026 +0530 drm/i915/dp: Rework pipe joiner logic in mode_valid Currently in intel_dp_mode_valid(), we compute the number of joined pipes required before deciding whether DSC is needed. This ordering prevents us from accounting for DSC-related overhead when determining pipe requirements. It is not possible to first decide whether DSC is needed and then compute the required number of joined pipes, because the two depend on each other: - DSC need is a function of the pipe count (e.g., 4‑pipe always requires DSC; 2‑pipe may require it if uncompressed joiner is unavailable). - Whether a given pipe‑join configuration is sufficient depends on effective bandwidth, which itself changes when DSC is used. As a result, the only correct approach is to iterate candidate pipe counts. So, refactor the logic to start with a single pipe and incrementally try additional pipes only if needed. While DSC overhead is not yet computed here, this restructuring prepares the code to support that in a follow-up changes. If a forced joiner configuration is present, we just check for that configuration. If it fails, we bailout and return instead of trying with other joiner configurations. v2: - Iterate over number of pipes to be joined instead of joiner candidates. (Jani) - Document the rationale of iterating over number of joined pipes. (Imre) v3: - In case the force joiner configuration doesn't work, do not fallback to the normal routine, bailout instead of trying other joiner configurations. (Imre) v4: - Use num_joined_pipes instead of num_pipes. (Imre) - Inititialize status before the loops starts. (Imre) v5: - Fix status handling by setting MODE_CLOCK_HIGH on DSC/rate failures. (Imre) Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-5-ankit.k.nautiyal@intel.com commit 769bcb5733dd63b9e39f51125dfe417a10a783df Author: Ankit Nautiyal Date: Mon Feb 2 16:07:17 2026 +0530 drm/i915/dp: Extract helper to get the hdisplay limit Separate out function to get the hdisplay limit for a given platform. v2: Rename the helper to intel_dp_max_hdisplay_per_pipe(). (Imre) Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-4-ankit.k.nautiyal@intel.com commit 19f0dc41c7f259b304941e427e5cc33c0da18548 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:16 2026 +0530 drm/i915/dp: Move num_joined_pipes and related checks together Move the calculation of `num_joined_pipes` and other constraints that depend on it, into a single block. This groups all joiner-dependent logic together, preparing the code for a future loop-based evaluation of multiple joiner configurations. Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-3-ankit.k.nautiyal@intel.com commit efc85c10f5c211e9dcbb74d228560ef80b29fab6 Author: Ankit Nautiyal Date: Mon Feb 2 16:07:15 2026 +0530 drm/i915/dp: Early reject bad hdisplay in intel_dp_mode_valid Move check for bad hdisplay early as it is independent on other checks. Signed-off-by: Ankit Nautiyal Reviewed-by: Imre Deak Link: https://patch.msgid.link/20260202103731.357416-2-ankit.k.nautiyal@intel.com commit c766952016f2a42d0711260f2f56bdec17786cb7 Author: Suraj Kandpal Date: Mon Feb 2 13:48:02 2026 +0530 drm/i915/dp: Add a meaningful return to intel_dp_read_dsc_dpcd Add a meaningful return to intel_dp_read_dsc_dpcd. This is to avoid unwanted DPCD reads which are not needed once we know DSC DPCD read fails. To do this convert drm_dp_dpcd_read to drm_dp_dpcd_read_data which returns a meaningful error which can be propogated up when all bits are not read. While we are at it convert the drm_err in intel_dp_read_dsc_dpcd to drm_dbg_kms. This is because we do not want a hard ERROR when we call this function, during the intel_dp_detect phase since AUX may not be up, it is expected to fail but we do not expect a failure in read when we call intel_dp_dsc_get_sink_cap so we move the drm_err there. Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260202081801.1400708-1-suraj.kandpal@intel.com commit 0bc2c2e1a388fa4d94d2fca1a40d3619f923870f Author: Marco Crivellari Date: Mon Feb 2 11:37:56 2026 +0100 drm/xe: add WQ_PERCPU to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Link: https://lore.kernel.org/all/20250221112 Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260202103756.62138-3-marco.crivellari@suse.com Signed-off-by: Rodrigo Vivi commit fa171b805f25d774a358ad2af72da4c8444859cd Author: Marco Crivellari Date: Mon Feb 2 11:37:55 2026 +0100 drm/xe: replace use of system_unbound_wq with system_dfl_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260202103756.62138-2-marco.crivellari@suse.com Signed-off-by: Rodrigo Vivi commit 65b9886062137ad4d708045f2f4c92d06f285e8b Author: Michal Wajdeczko Date: Tue Jan 27 20:37:26 2026 +0100 drm/xe/guc: Allow second H2G retry on FLR During VF FLR the scratch registers could be cleared both by the GuC and by the PF driver. Allow to retry more times once we find out that the HXG header was cleared and wait at least 256ms before resending the same message again to the GuC. Signed-off-by: Michal Wajdeczko Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260127193727.601-7-michal.wajdeczko@intel.com commit e116fd5c60c4950171fbe7773a34a5841a021b9f Author: Michal Wajdeczko Date: Tue Jan 27 20:37:25 2026 +0100 drm/xe/guc: Wait before retrying sending H2G We shall resend H2G message after receiving NO_RESPONSE_RETRY reply, but since GuC dropped that H2G due to some interim state, we should give it a little time to stabilize. Wait before sending the same H2G again, start with 1ms delay, then increase exponentially to 256ms. Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260127193727.601-6-michal.wajdeczko@intel.com commit 09b45fd9d330e52a5b31d1abc0db4a22b16d340a Author: Michal Wajdeczko Date: Tue Jan 27 20:37:24 2026 +0100 drm/xe/guc: Drop redundant register read The xe_mmio_wait32() already returns the last value of the register for which we were waiting, there is no need read it again. Signed-off-by: Michal Wajdeczko Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260127193727.601-5-michal.wajdeczko@intel.com commit 943c4d0637cff358f7be8e71694475538e7b1ce3 Author: Michal Wajdeczko Date: Tue Jan 27 20:37:23 2026 +0100 drm/xe/guc: Limit sleep while waiting for H2G credits Instead of endlessly increasing the sleep timeout while waiting for the H2G credits, use exponential increase only up to the given limit, like it was initially done in the GuC submission code. While here, fix the actual timeout to the 1s as it was documented. Suggested-by: Matthew Brost Signed-off-by: Michal Wajdeczko Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260127193727.601-4-michal.wajdeczko@intel.com commit eec43f368466e0de9a4aaa4d09ac23815186d2a6 Author: Michal Wajdeczko Date: Tue Jan 27 20:37:22 2026 +0100 drm/xe: Move exponential sleep logic to helper We want to reuse the same increased sleep logic in other places. To avoid code duplication, move it to the helper. Signed-off-by: Michal Wajdeczko Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260127193727.601-3-michal.wajdeczko@intel.com commit 94a2ceb1906d2bcbf2c6afbc5ede400eea3872c8 Author: Michal Wajdeczko Date: Tue Jan 27 20:37:21 2026 +0100 drm/xe: Promote relaxed_ms_sleep We want to have single place with sleep related helpers for better code reuse. Create xe_sleep.h and move relaxed_ms_sleep() there. Signed-off-by: Michal Wajdeczko Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260127193727.601-2-michal.wajdeczko@intel.com commit 316b05ae7ed90544733f5c01e14f64d6e84a80dc Author: Michal Wajdeczko Date: Wed Jan 28 23:27:13 2026 +0100 drm/xe/pf: Simplify IS_SRIOV_PF macro Instead of two having variants of the IS_SRIOV_PF macro, move the CONFIG_PCI_IOV check to the xe_device_is_sriov_pf() function and let the compiler optimize that. This will help us drop poor man's type check of the macro parameter that fails on const xe pointer. Signed-off-by: Michal Wajdeczko Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260128222714.3056-1-michal.wajdeczko@intel.com commit 9f9c117ac566cb567dd56cc5b7564c45653f7a2a Author: Shuicheng Lin Date: Thu Jan 29 23:38:38 2026 +0000 drm/xe: Fix kerneldoc for xe_tlb_inval_job_alloc_dep Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_tlb_inval_job.c:210 expecting prototype for xe_tlb_inval_alloc_dep(). Prototype was for xe_tlb_inval_job_alloc_dep() instead" Fixes: 15366239e2130 ("drm/xe: Decouple TLB invalidations from GT") Reviewed-by: Michal Wajdeczko Signed-off-by: Shuicheng Lin Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129233834.419977-8-shuicheng.lin@intel.com commit 0651dbb9d6a72e99569576fbec4681fd8160d161 Author: Shuicheng Lin Date: Thu Jan 29 23:38:37 2026 +0000 drm/xe: Fix kerneldoc for xe_gt_tlb_inval_init_early Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_tlb_inval.c:136 expecting prototype for xe_gt_tlb_inval_init(). Prototype was for xe_gt_tlb_inval_init_early() instead" v2: add () for the function. (Michal) Fixes: db16f9d90c1d9 ("drm/xe: Split TLB invalidation code in frontend and backend") Reviewed-by: Michal Wajdeczko Signed-off-by: Shuicheng Lin Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129233834.419977-7-shuicheng.lin@intel.com commit 9fd8da717934f05125b9ba6782622c459a368dc0 Author: Shuicheng Lin Date: Thu Jan 29 23:38:36 2026 +0000 drm/xe: Fix kerneldoc for xe_migrate_exec_queue Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_migrate.c:1262 expecting prototype for xe_get_migrate_exec_queue(). Prototype was for xe_migrate_exec_queue() instead" Fixes: 916ee4704a865 ("drm/xe/vf: Register CCS read/write contexts with Guc") Reviewed-by: Michal Wajdeczko Signed-off-by: Shuicheng Lin Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129233834.419977-6-shuicheng.lin@intel.com commit c2a6859138e7f73ad904be17dd7d1da6cc7f06b3 Author: Shuicheng Lin Date: Fri Jan 30 04:39:08 2026 +0000 drm/xe/query: Fix topology query pointer advance The topology query helper advanced the user pointer by the size of the pointer, not the size of the structure. This can misalign the output blob and corrupt the following mask. Fix the increment to use sizeof(*topo). There is no issue currently, as sizeof(*topo) happens to be equal to sizeof(topo) on 64-bit systems (both evaluate to 8 bytes). Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Shuicheng Lin Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260130043907.465128-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper commit 568d9d0d83f5b55144c4486fefe26bd132a66ea1 Author: Xin Wang Date: Fri Jan 30 17:53:49 2026 +0000 drm/xe: use entry_dump callbacks for xe2+ PAT dumps Move xe2+ PAT entry printing into the entry_dump op so platform specific logic stays localized, simplifying future maintenance. v2: - Do not null xe->pat.ops for VFs. - Skip PAT init and dump on VFs (-EOPNOTSUPP), avoiding NULL ops use. v3: - fixed typo v4: (Matt) - Switch xe2_dump() to use the new ops->entry_dump() vfunc. - Remove xe3p_xpc_dump() and reuse the common xe2_dump() for Xe3p XPC. - This also fixes Xe3p_HPM media PAT dumping by using the proper non-MCR access for the PAT register range (bspec 76445). Cc: Matt Roper Suggested-by: Brian Nguyen Signed-off-by: Xin Wang Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260130175349.2249033-1-x.wang@intel.com Signed-off-by: Matt Roper commit f89dbe14a0c8854b7aaf960dd842c10698b3ff19 Author: Chaitanya Kumar Borah Date: Fri Jan 30 19:22:10 2026 +0530 drm/xe/guc: Fix kernel-doc warning in GuC scheduler ABI header The GuC scheduler ABI header contains a file-level comment that is not intended to document a kernel-doc symbol. Using kernel-doc comment syntax (/** */) triggers kernel-doc warnings. With "-Werror", this causes the build to fail. Convert the comment to a regular block comment. HDRTEST drivers/gpu/drm/xe/abi/guc_scheduler_abi.h Warning: drivers/gpu/drm/xe/abi/guc_scheduler_abi.h:11 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst * Generic defines required for registration with and submissions to the GuC 1 warnings as errors make[6]: *** [drivers/gpu/drm/xe/Makefile:377: drivers/gpu/drm/xe/abi/guc_scheduler_abi.hdrtest] Error 3 make[5]: *** [scripts/Makefile.build:544: drivers/gpu/drm/xe] Error 2 make[4]: *** [scripts/Makefile.build:544: drivers/gpu/drm] Error 2 make[3]: *** [scripts/Makefile.build:544: drivers/gpu] Error 2 make[2]: *** [scripts/Makefile.build:544: drivers] Error 2 make[1]: *** [/home/kbuild2/kernel/Makefile:2088: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 v2: - Add Fixes tag (Daniele) Fixes: b0c5cf4f5917 ("drm/gt/guc: extract scheduler-related defines from guc_fwif.h") Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Shuicheng Lin Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260130135210.2659200-1-chaitanya.kumar.borah@intel.com commit dd8ea2f2ab71b98887fdc426b0651dbb1d1ea760 Author: Daniele Ceraolo Spurio Date: Thu Jan 29 10:25:48 2026 -0800 drm/xe/guc: Fix CFI violation in debugfs access. xe_guc_print_info is void-returning, but the function pointer it is assigned to expects an int-returning function, leading to the following CFI error: [ 206.873690] CFI failure at guc_debugfs_show+0xa1/0xf0 [xe] (target: xe_guc_print_info+0x0/0x370 [xe]; expected type: 0xbe3bc66a) Fix this by updating xe_guc_print_info to return an integer. Fixes: e15826bb3c2c ("drm/xe/guc: Refactor GuC debugfs initialization") Signed-off-by: Daniele Ceraolo Spurio Cc: Michal Wajdeczko Cc: George D Sworo Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129182547.32899-2-daniele.ceraolospurio@intel.com commit 5c323ea948ff0f9e50418119cbbb3d94f2bd6a96 Author: Robin Murphy Date: Fri Jan 23 19:22:21 2026 +0000 drm/panel-edp: Move FriendlyELEC HD702E FriendlyELEC's HD702E module is an eDP panel (in as much as it's some LVDS LCD behind a Chrontel CH7511B eDP bridge), so move its data over to the eDP driver, also resolving the warning about the missing bpc value in the process. The unfortunate combination of HPD not being wired up and the RK3399 eDP controller's behaviour seems to result in the EDID not being readable over DP-AUX without probing the panel first, thus the hard-coded mode is still needed to get things going. Reviewed-by: Neil Armstrong Signed-off-by: Robin Murphy Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/a00a59dcef3693efb02a8ee942848fbeaeaf05ba.1769191673.git.robin.murphy@arm.com commit e2242223b714ac9fd8233546ca74ce972024111f Author: Robin Murphy Date: Fri Jan 23 19:22:20 2026 +0000 dt-bindings: display: panel: Move FriendlyElec HD702E to eDP The "E" alludes to the fact that FriendlyElec's HD702E is actually an eDP panel - move its compatible to the appropriate binding doc. Cc: devicetree@vger.kernel.org Acked-by: Rob Herring (Arm) Signed-off-by: Robin Murphy Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/c7f6f75d55a4801eab63a0dc81d14ae27866aca9.1769191673.git.robin.murphy@arm.com commit 3c55330aac69150a1a4ff20684b41e7f66ad5fe9 Author: Caio Ishikawa Date: Sat Jan 24 12:51:13 2026 +0000 drm/panel: boe-th101mb31ig002: Remove use of deprecated mipi_dsi_dcs_nop() Replace calls to deprecated mipi_dsi_dcs_nop() with mipi_dsi_dcs_nop_multi(). No intended functional changes. Signed-off-by: Caio Ishikawa Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260124124959.196051-3-caio.ishikawa@proton.me commit b1cc4172cc60b1039235c9dfc08c3c1ffa4fb863 Author: Maíra Canal Date: Tue Jan 27 08:57:00 2026 -0300 drm/vc4: Replace IDR with XArray for perfmon tracking The IDR interface is deprecated and the XArray API is the recommended replacement. Replace the per-file IDR used to track perfmons with an XArray. This allows us to remove the external mutex that protects the IDR. While at it, introduce the vc4_perfmon_delete() helper to consolidate the perfmon cleanup logic used by both vc4_perfmon_close_file() and vc4_perfmon_destroy_ioctl(). Also, remove the redundant assignment of vc4file->dev to itself in vc4_perfmon_open_file(). Reviewed-by: Iago Toral Quiroga Reviewed-by: Tvrtko Ursulin Link: https://patch.msgid.link/20260127115822.64401-2-mcanal@igalia.com Signed-off-by: Maíra Canal commit 0a5b0d095bcdb219348ed8ae1c97ee99fc4913b8 Author: Maíra Canal Date: Tue Jan 27 08:56:59 2026 -0300 drm/v3d: Replace IDR with XArray for perfmon tracking The IDR interface is deprecated and the XArray API is the recommended replacement. Replace the per-file IDR used to track perfmons with an XArray. This allows us to remove the external mutex that protects the IDR. While here, introduce the v3d_perfmon_delete() helper to consolidate the perfmon cleanup logic used by both v3d_perfmon_close_file() and v3d_perfmon_destroy_ioctl(). Reviewed-by: Iago Toral Quiroga Reviewed-by: Tvrtko Ursulin Link: https://patch.msgid.link/20260127115822.64401-1-mcanal@igalia.com Signed-off-by: Maíra Canal commit de96c43a69b1caf3190609a6509f22433a118782 Author: Balasubramani Vivekanandan Date: Wed Jan 28 11:59:12 2026 +0530 drm/xe: Apply WA_16028005424 to Media Apply WA_16028005424 to following IPs: Xe2_LPM, Xe2_HPM, Xe3_LPM, Xe3p_LPM While doing this move the same WA defined for Xe3_LPG under the comment for Xe3_LPG. It was wrongly placed under Xe3_LPM. Signed-off-by: Balasubramani Vivekanandan Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260128062911.1456539-2-balasubramani.vivekanandan@intel.com commit c0dc68f4e2aa7eddb9ec6d95931f9576d8fe7334 Author: Vinod Govindapillai Date: Fri Jan 30 11:59:19 2026 +0200 drm/i915/display: fix the pixel normalization handling for xe3p_lpd Pixel normalizer is enabled with normalization factor as 1.0 for FP16 formats in order to support FBC for those formats in xe3p_lpd. Previously pixel normalizer gets disabled during the plane disable routine. But there could be plane format settings without explicitly calling the plane disable in-between and we could endup keeping the pixel normalizer enabled for formats which we don't require that. This is causing crc mismatches in yuv formats and FIFO underruns in planar formats like NV12. Fix this by updating the pixel normalizer configuration based on the pixel formats explicitly during the plane settings arm calls itself - enable it for FP16 and disable it for other formats in HDR capable planes. v2: avoid redundant pixel normalization setting updates v3: moved the normalization factor definition to intel_fbc.c and some updates to comments v4: simplified the pixel normalizer setting handling Fixes: 5298eea7ed20 ("drm/i915/xe3p_lpd: use pixel normalizer for fp16 formats for FBC") Signed-off-by: Vinod Govindapillai Reviewed-by: Uma Shankar Link: https://patch.msgid.link/20260130095919.107805-1-vinod.govindapillai@intel.com commit 129a4da117075746bd1a0809f684fc1c7eabfd65 Author: Jouni Högander Date: Tue Jan 27 14:41:20 2026 +0200 drm/i915/psr: Use TRANS_PUSH to trigger frame change event Now we have everything in place for triggering PSR "frame change" event using TRANS_PUSH: use TRANS_PUSH for LunarLake and onwards. v4: - Added call to intel_vrr_psr_frame_change_enable call - added setting LNL_TRANS_PUSH_PSR_PR_EN into intel_vrr_send_push v3: use HAS_PSR_FRAME_CHANGE macro v2: use AND instead of OR in intel_psr_use_trans_push Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260127124120.1069026-12-jouni.hogander@intel.com commit 8c55f7afde2e76ec4053646fe5744de638a39cff Author: Jouni Högander Date: Tue Jan 27 14:41:19 2026 +0200 drm/i915/display: Add HAS_PSR_TRANS_PUSH_FRAME_CHANGE macro Add a macro indicating that the platform supports triggering a Frame Change event for the PSR HW using the TRANS PUSH mechanism. Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260127124120.1069026-11-jouni.hogander@intel.com commit 3a49c54eeffde852b8d3339b30d55a3f29ef4511 Author: Jouni Högander Date: Tue Jan 27 14:41:18 2026 +0200 drm/i915/psr: Do PSR exit on frontbuffer flush on LunarLake and onwards We need to use intel_psr_exit in frontbuffer flush on LunarLake and onwards if we want to move using trans push mechanism to trigger Frame Change event. Keep PSR1 and PSR2 HW tracking as it is for older platforms as this was seen causing problems there. v2: typo fixed Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260127124120.1069026-10-jouni.hogander@intel.com commit 74222f79bc1643c13bf1d8ee065fc9a895c105c4 Author: Jouni Högander Date: Tue Jan 27 14:41:17 2026 +0200 drm/i915/psr: Wait for idle only after possible send push We are planning to move using trans push mechanism to trigger the Frame Change event. In that case we can't wait PSR to idle before send push happens. Due to this move wait for idle to be done after possible send push is done. This should be ok for Frame Change event triggered by register write as well. Wait for idle is needed only for corner case where PSR is transitioning into DEEP_SLEEP when Frame Change event is triggered. It just has to be before wait for vblank. Otherwise we may have vblank before PSR enters DEEP_SLEEP and still using old frame buffers for first frame after wake up. v2: some typos fixed Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260127124120.1069026-9-jouni.hogander@intel.com commit 7bb01e326568f3489636723bf6dd9803f7293094 Author: Jouni Högander Date: Tue Jan 27 14:41:16 2026 +0200 drm/i915/display: Wait for vblank in case of PSR is using trans push In case PSR uses trans push as a "frame change" event and we need to wait vblank after triggering PSR "frame change" event. Otherwise we may miss selective updates. DSB skips all waits while PSR is active. Check push send is skipped as well because trans push send bit is not reset by the HW if VRR is not enabled -> we may start configuring new selective update while previous is not complete. Avoid this by waiting for vblank after sending trans push. v2: some typos fixed Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260127124120.1069026-8-jouni.hogander@intel.com commit f8c7baf813074c557ac708135713718b1df57428 Author: Jouni Högander Date: Tue Jan 27 14:41:15 2026 +0200 drm/i915/dsb: Set DSB_SKIP_WAITS_EN chicken bit for LunarLake and onwards On LunarLake we are using TRANS_PUSH mechanism to trigger "Frame Change" event. This way we have more control on when PSR HW is woken up. I.e. not every display register write is triggering sending update. This allows us setting DSB_SKIP_WAITS_EN chicken bit as well. Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260127124120.1069026-7-jouni.hogander@intel.com commit 0dcead77c111fbf7417213ed0e259fca62afb7ba Author: Jouni Högander Date: Tue Jan 27 14:41:14 2026 +0200 drm/i915/vrr: Prepare to Use TRANS_PUSH mechanism for PSR frame change On Lunarlake and onward it is possible to generate PSR Frame Change event using TRANS_PUSH mechanism: Ensure push is performed on flip if needed by PSR. Don't use intel_psr_trigger_frame_change_event if PSR uses trans push as Frame Change event: When not using trans push to generate Frame Change event plane/pipe register writes are triggering the event. This is causing problems when transiting to PSR active/idle and the event is coming in. To tackle this we are waiting PSR to idle and using intel_psr_trigger_frame_change_event to ensure PSR exit. If the Frame change event is triggered after everything is configured (on trans push) we don't need to worry about all this. Ensure possible intel_vrr_tg_disable call is not overwriting LNL_TRANS_PUSH_PSR_PR_EN. v8: - split adding intel_vrr_psr_frame_change_enable as a separate change - update commit message v7: - HAS_PSR_FRAME_CHANGE macro moved to separate patch and renamed as HAS_PSR_TRANS_PUSH_FRAME_CHANGE - use intel_psr_use_trans_push instead of HAS_PSR_FRAME_CHANGE in intel_psr_trigger_frame_change - moved calling intel_vrr_psr_frame_change_enable away from this patch v6: - add HAS_PSR_FRAME_CHANGE macro - use TRANS_PUSH in instead of TRAN_VRR_CTL v5: use intel_psr_use_trans_push for intel_vrr_psr_frame_change_enable v4: - use rmw when enabling/disabling transcoder - set TRANS_PUSH_EN conditionally in intel_vrr_send_push - do not call intel_vrr_send_push from intel_psr_trigger_frame_change - do not enable using TRANS_PUSH mechanism for PSR "Frame Change" v3: - use rmw when enabling/disabling - keep LNL_TRANS_PUSH_PSR_PR_EN set always on LunarLake and onwards v2: use intel_vrr_trans_push_enabled_set_clear instead of rmw Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260127124120.1069026-6-jouni.hogander@intel.com commit ef7ae0e3f61e0f78109d35f10ab26d2ff090980e Author: Jouni Högander Date: Tue Jan 27 14:41:13 2026 +0200 drm/i915/vrr: Add helper for PSR to enable Frame Change event on trans push Add new helper to enable PSR Frame Change event generation using trans push mechanism. This helper is to be used by PSR code on PSR enable. Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260127124120.1069026-5-jouni.hogander@intel.com commit 37d4001a725305a9002aef65e223b058447ea688 Author: Jouni Högander Date: Tue Jan 27 14:41:12 2026 +0200 drm/i915/vrr: Add helper for parsing value to be written into TRANS_PUSH On Lunarlake and onwards it is possible to generate PSR "frame change" event using TRANS_PUSH mechanism. As a preparation add new helper to parse value to be written into TRANS_PUSH register. Setting LNL_TRANS_PUSH_PSR_PR_EN is done in upcoming change. Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260127124120.1069026-4-jouni.hogander@intel.com commit 28b086fd19a11bcc23f3b2904916209b5edd6940 Author: Jouni Högander Date: Tue Jan 27 14:41:11 2026 +0200 drm/i915/psr: Add intel_psr_use_trans_push to query if TRANS_PUSH is used This is a preparation to start using trans push as a PSR "Frame Change" event. It adds intel_psr_use_trans_push placeholder which return false for now until we have everything in place. v2: - modify commit message - add TODO Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260127124120.1069026-3-jouni.hogander@intel.com commit 134f3c7022b5d3f129a62c3df5d126967227075e Author: Jouni Högander Date: Tue Jan 27 14:41:10 2026 +0200 drm/i915/psr: Add TRANS_PUSH register bit definition for PSR Add TRANS_PUSH register bit LNL_TRANS_PUSH_PSR_PR_EN definition for PSR usage. v2: add bspec reference Bspec: 69984 Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260127124120.1069026-2-jouni.hogander@intel.com commit b47239bc30ef85e70b93e357ce76b205baac3b77 Author: Michal Wajdeczko Date: Wed Dec 17 16:07:02 2025 +0100 drm/xe/pf: Fix typo in function kernel-doc The function name is missing an underscore, which results in: Warning: ../drivers/gpu/drm/xe/xe_gt_sriov_pf_control.c:1261 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst * xe_gt_sriov_pf_control_trigger restore_vf() - Start ... Signed-off-by: Michal Wajdeczko Reviewed-by: Rodrigo Vivi Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20251217150702.2669-1-michal.wajdeczko@intel.com Signed-off-by: Rodrigo Vivi commit 3d65e4c276b32c03450261d114e495fda03c8e97 Author: Cong Yang Date: Fri Jan 30 11:04:56 2026 +0800 drm/panel-edp: Add CMN N116BCL-EAK (C2) Add support for the CMN N116BCL-EAK (C2) panel, pleace the EDID here for subsequent reference. edid-decode (hex): 00 ff ff ff ff ff ff 00 0d ae 7a 11 00 00 00 00 08 22 01 04 95 1a 0e 78 03 46 a5 9c 5b 53 8b 24 1d 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 e6 1e 56 e2 50 00 3c 30 30 20 a6 00 00 90 10 00 00 1a 00 00 00 fd 00 28 3c 32 32 08 01 0a 20 20 20 20 20 20 00 00 00 fe 00 43 4d 4e 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe 00 4e 31 31 36 42 43 4c 2d 45 41 4b 0a 20 01 80 70 20 79 02 00 25 01 09 fc 34 01 fc 34 01 28 3c 80 81 00 10 72 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 90 Signed-off-by: Cong Yang Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260130030456.2080748-1-yangcong5@huaqin.corp-partner.google.com commit 3ea699b56d31c2a5140d9fac309ff5e0f2041411 Author: Cristian Ciocaltea Date: Thu Jan 29 14:13:36 2026 +0200 drm/bridge: dw-hdmi-qp: Rework Audio InfoFrame handler Make use of the recently introduced dw_hdmi_qp_write_infoframe() helper to simplify the writing of the Audio InfoFrame packet header and body registers. Additionally, discard the redundant static values identifying the frame version and length. Moreover, since now having dedicated callbacks per InfoFrame type, move the implementation to dw_hdmi_qp_bridge_write_audio_infoframe() and drop dw_hdmi_qp_config_audio_infoframe(). Signed-off-by: Cristian Ciocaltea Reviewed-by: Maxime Ripard Reviewed-by: Daniel Stone Link: https://patch.msgid.link/20260129-dw-hdmi-qp-iframe-v2-5-0157ad05232c@collabora.com Signed-off-by: Daniel Stone commit 08116cf29e36968bf57abc2e2f93b5ccf2903e52 Author: Cristian Ciocaltea Date: Thu Jan 29 14:13:35 2026 +0200 drm/bridge: dw-hdmi-qp: Rework DRM InfoFrame handler Make use of the recently introduced dw_hdmi_qp_write_infoframe() helper to simplify the writing of the Dynamic Range and Mastering (DRM) InfoFrame packet header and body registers. Moreover, since now having dedicated callbacks per InfoFrame type, move the implementation to dw_hdmi_qp_bridge_write_hdr_drm_infoframe() and drop dw_hdmi_qp_config_drm_infoframe(). While at it, also discard the unnecessary infoframe size verification, as well as the redundant disabling of the packet transmission (already done by the explicit call to the clear callback). Signed-off-by: Cristian Ciocaltea Reviewed-by: Maxime Ripard Reviewed-by: Daniel Stone Link: https://patch.msgid.link/20260129-dw-hdmi-qp-iframe-v2-4-0157ad05232c@collabora.com Signed-off-by: Daniel Stone commit 1933d1508a9d56fc08a1586ef244eb5516b271ac Author: Cristian Ciocaltea Date: Thu Jan 29 14:13:34 2026 +0200 drm/bridge: dw-hdmi-qp: Rework AVI InfoFrame handler Make use of the recently introduced dw_hdmi_qp_write_infoframe() helper to simplify the writing of the Auxiliary Video InfoFrame (AVI) packet header and body registers. Moreover, since now having dedicated callbacks per InfoFrame type, move the implementation to dw_hdmi_qp_bridge_write_avi_infoframe() and drop dw_hdmi_qp_config_avi_infoframe(). While at it, also discard the superfluous infoframe size verification. Signed-off-by: Cristian Ciocaltea Reviewed-by: Maxime Ripard Reviewed-by: Daniel Stone Link: https://patch.msgid.link/20260129-dw-hdmi-qp-iframe-v2-3-0157ad05232c@collabora.com Signed-off-by: Daniel Stone commit 1df09ea64b04920d574b4277ff194bdfa38569a7 Author: Cristian Ciocaltea Date: Thu Jan 29 14:13:33 2026 +0200 drm/bridge: dw-hdmi-qp: Provide SPD InfoFrame The hardware is capable of sending Source Product Description (SPD) InfoFrames, hence enable the missing support. Signed-off-by: Cristian Ciocaltea Reviewed-by: Maxime Ripard Reviewed-by: Daniel Stone Link: https://patch.msgid.link/20260129-dw-hdmi-qp-iframe-v2-2-0157ad05232c@collabora.com Signed-off-by: Daniel Stone commit e54c6ac22a8fda74401b2d8c4857728a1ffddb64 Author: Cristian Ciocaltea Date: Thu Jan 29 14:13:32 2026 +0200 drm/bridge: dw-hdmi-qp: Provide HDMI Vendor Specific InfoFrame Since commit b626b1a1c9cc ("drm/bridge: refactor HDMI InfoFrame callbacks"), the following warning is generated: [ 13.654149] rockchip-drm display-subsystem: [drm] HDMI VSI not supported Add the missing support for sending HDMI Vendor-Specific Infoframes. Additionally, introduce dw_hdmi_qp_write_{pkt|infoframe}() helpers, as a prerequisite to rework all dw_hdmi_qp_bridge_write_*_infoframe() callbacks and get rid of some boilerplate code. Signed-off-by: Cristian Ciocaltea Reviewed-by: Maxime Ripard Reviewed-by: Daniel Stone Link: https://patch.msgid.link/20260129-dw-hdmi-qp-iframe-v2-1-0157ad05232c@collabora.com Signed-off-by: Daniel Stone commit ecb21d61562e8fcb9a7275a935e4547480b97418 Author: Michał Grzelak Date: Thu Jan 29 10:01:29 2026 +0100 drm/i915: move intel_gvt_init() level higher Both initialisation and removal of GVT happen at different abstraction levels. Hence caller of i915_driver_hw_probe() has no way of knowing status of intel_gvt_init(). This can lead to an unbalanced number of calls of intel_gvt_init() and intel_gvt_driver_remove() since GVT error path is currently handled in i915_driver_probe(). One such scenario has been seen with i915_driver_hw_probe() fault injection, which caused double entry deletion and list corruption. Move intel_gvt_init() up to i915_driver_probe(). Add out_cleanup_gvt error path for removing gvt. Trigger it only after intel_gvt_init() succeeded. In case intel_gvt_init() failed, theoretically we should follow err_msi error path. That is actually impossible since call to intel_gvt_init() unconditionally returns 0, although it claims to return negative error code on failure. Thus follow standard out_cleanup_hw error path on a hypothetical future intel_gvt_init() failure. Remove err_msi label from i915_driver_hw_probe() since intel_gvt_init() was the only user of it. Changelog: v1->v2 - don't move err_msi error path from i915_driver_hw_probe (Jani) - rewrite commit message Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15481 Signed-off-by: Michał Grzelak Reviewed-by: Andi Shyti Link: https://patch.msgid.link/20260129090129.2601661-2-michal.grzelak@intel.com Signed-off-by: Jani Nikula commit e694179a2c02700087185bc300ba81dd17b7ad40 Author: Niranjana Vishwanathapura Date: Mon Jan 26 09:42:42 2026 -0800 drm/xe/multi_queue: Protect priority against concurrent access Use a spinlock to protect multi-queue priority being concurrently updated by multiple set_priority ioctls and to protect against concurrent read and write to this field. v2: Update documentation, remove WRITE/READ_LOCK() (Thomas) Use scoped_guard, reduced lock scope (Matt Brost) v3: Fix author (checkpatch) Signed-off-by: Niranjana Vishwanathapura Reviewed-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20260126174241.3470390-2-niranjana.vishwanathapura@intel.com commit 4eda1d5fe99db2a71da0156387b7b69e8e0dc32f Author: Luca Ceresoli Date: Wed Jan 7 10:56:28 2026 +0100 drm/bridge: imx8qxp-pixel-link: imx8qxp_pixel_link_find_next_bridge: return int, not ERR_PTR In preparation for using bridge->next_bridge, we need to ensure that it will never contain anything but NULL or a valid bridge pointer. Current code stores an ERR_PTR when imx8qxp_pixel_link_find_next_bridge() errors out. Instead of fixing that after the facts in the caller, change the function to internally set pl->next_bridge and just return an int error value. No functional changes. Reviewed-by: Maxime Ripard Acked-by: Liu Ying Link: https://patch.msgid.link/20260107-drm-bridge-alloc-getput-drm_of_find_bridge-v4-3-a62b4399a6bf@bootlin.com Signed-off-by: Luca Ceresoli commit 42bb487369e56f8f07c82ac11fe771ba2b70cd68 Author: Luca Ceresoli Date: Wed Jan 7 10:56:27 2026 +0100 drm/bridge: imx8qxp-pixel-link: simplify freeing of the remote device_node The main loop in imx8qxp_pixel_link_find_next_bridge() requires calling of_node_put() in multiple places, complicating code flow. Simplify it by using a cleanup action and making the 'remote' variable scope local to the loop. Reviewed-by: Maxime Ripard Reviewed-by: Liu Ying Link: https://patch.msgid.link/20260107-drm-bridge-alloc-getput-drm_of_find_bridge-v4-2-a62b4399a6bf@bootlin.com Signed-off-by: Luca Ceresoli commit 96476ab8690290aa27084b12a481e48f3af7afb2 Author: Luca Ceresoli Date: Wed Jan 7 10:56:26 2026 +0100 drm/bridge: imx8qxp-pixel-link: simplify logic to find next bridge imx8qxp_pixel_link_find_next_bridge() uses a sophisticated logic to find the preferred next bridge, using an array with two supporting index variables. This is more sophisticated than required because we only ever need a pointer to the "current" bridge and to the "best so far" bridge. Additionally this logic is going to make the addition of proper refcounting quite complex. Rewrite the logic using two drm_bridge pointers, which is by itself slightly simpler and is a preparation step for introducing bridge refcounting in a later commit. Also reword a comment to make it clearer. Reviewed-by: Liu Ying Link: https://patch.msgid.link/20260107-drm-bridge-alloc-getput-drm_of_find_bridge-v4-1-a62b4399a6bf@bootlin.com Signed-off-by: Luca Ceresoli commit 3aecd55af5b83d16d84e3c333d4163999ee8ff51 Author: Caterina Shablia Date: Wed Jan 28 18:40:57 2026 +0000 drm: add ARM interleaved 64k modifier This modifier is primarily intended to be used by panvk to implement sparse partially-resident images with better map and unmap performance, and no worse access performance, compared to implementing them in terms of U-interleaved. With this modifier, the plane is divided into 64k byte 1:1 or 2:1 -sided tiles. The 64k tiles are laid out linearly. Each 64k tile is divided into blocks of 16x16 texel blocks each, which themselves are laid out linearly within a 64k tile. Then within each such 16x16 block, texel blocks are laid out according to U order, similar to 16X16_BLOCK_U_INTERLEAVED. Unlike 16X16_BLOCK_U_INTERLEAVED, the layout does not depend on whether a format is compressed or not. The hardware features corresponding to this modifier are available starting with v10 (second gen Valhall.) The corresponding panvk MR can be found at: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/38986 Previous version: https://lists.freedesktop.org/archives/dri-devel/2026-January/547072.html No changes since v2 Changes since v1: * Rewrite the description of the modifier to be hopefully unambiguous. Signed-off-by: Caterina Shablia Reviewed-by: Boris Brezillon Reviewed-by: Liviu Dudau Link: https://patch.msgid.link/20260128184058.807213-1-caterina.shablia@collabora.com Signed-off-by: Boris Brezillon commit c0f211b249f699fb48c20052008617e59e411a49 Author: Jani Nikula Date: Wed Jan 28 16:59:10 2026 +0200 drm/i915/gvt: drop unnecessary include of intel_display.h This does not appear to be needed at all. Cc: Ankit Nautiyal Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/32359d5d5feb777ecc7c983d970823218851035f.1769612208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 581e9a471a5149cb600f7a022dda8b37581dc001 Author: Jani Nikula Date: Wed Jan 28 16:59:09 2026 +0200 drm/i915/gvt: drop dependency on intel_display_types.h Avoid even accidental use of display details by dropping the include of intel_display_types.h. We'll still have to include intel_dpll_mgr.h for the DPLL IDs, but at least the surface is smaller. Add duplicate defines of pipe_name() and port_name() to avoid depending on display. They're trivial enough to be acceptable. Cc: Ankit Nautiyal Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/2fa5677f5ff3dbeaa75a7984d74fb9855a4ba3d2.1769612208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a9ec4e6e7b6c65aa8280ffdff0d7c4eaadc2c58f Author: Jani Nikula Date: Wed Jan 28 16:59:08 2026 +0200 drm/i915/gvt: drop dependency on display struct dpll The gvt code has no real need for struct dpll, it's just a collection of variables. So use a bunch of variables instead. Cc: Ankit Nautiyal Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/ff7478efa80323c638a31c578cb1d707692ef51d.1769612208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit dccc15e55ad7f7d86d48a5c7f4ef9feffd1d5805 Author: Jani Nikula Date: Wed Jan 28 16:59:07 2026 +0200 drm/i915/display: move enum aux_ch to intel_display_limits.h Move enum aux_ch from intel_display.h to intel_display_limits.h to avoid having to include the former from gvt. This currently happens via intel_display_types.h, which we can also drop in favour of intel_display_limits.h in intel_gvt_mmio_table.c. Cc: Ankit Nautiyal Reviewed-by: Ankit Nautiyal Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/86ccc91ee1ca96fa145b750e2f1935918ec288d0.1769612208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 7755ed58a49f4c7f603e2b7b9fd5073a70d96406 Author: Shuicheng Lin Date: Tue Jan 20 18:32:43 2026 +0000 drm/xe/nvm: Defer xe->nvm assignment until init succeeds Allocate and initialize the NVM structure using a local pointer and assign it to xe->nvm only after all initialization steps succeed. This avoids exposing a partially initialized xe->nvm and removes the need to explicitly clear xe->nvm on error paths, simplifying error handling and making the lifetime rules clearer. Cc: Alexander Usyskin Cc: Rodrigo Vivi Cc: Brian Nguyen Signed-off-by: Shuicheng Lin Reviewed-by: Brian Nguyen Signed-off-by: Ashutosh Dixit Link: https://patch.msgid.link/20260120183239.2966782-8-shuicheng.lin@intel.com commit a3187c0c2bbd947ffff97f90d077ac88f9c2a215 Author: Shuicheng Lin Date: Tue Jan 20 18:32:42 2026 +0000 drm/xe/nvm: Fix double-free on aux add failure After a successful auxiliary_device_init(), aux_dev->dev.release (xe_nvm_release_dev()) is responsible for the kfree(nvm). When there is failure with auxiliary_device_add(), driver will call auxiliary_device_uninit(), which call put_device(). So that the .release callback will be triggered to free the memory associated with the auxiliary_device. Move the kfree(nvm) into the auxiliary_device_init() failure path and remove the err goto path to fix below error. " [ 13.232905] ================================================================== [ 13.232911] BUG: KASAN: double-free in xe_nvm_init+0x751/0xf10 [xe] [ 13.233112] Free of addr ffff888120635000 by task systemd-udevd/273 [ 13.233120] CPU: 8 UID: 0 PID: 273 Comm: systemd-udevd Not tainted 6.19.0-rc2-lgci-xe-kernel+ #225 PREEMPT(voluntary) ... [ 13.233125] Call Trace: [ 13.233126] [ 13.233127] dump_stack_lvl+0x7f/0xc0 [ 13.233132] print_report+0xce/0x610 [ 13.233136] ? kasan_complete_mode_report_info+0x5d/0x1e0 [ 13.233139] ? xe_nvm_init+0x751/0xf10 [xe] ... " v2: drop err goto path. (Alexander) Fixes: d4c3ed963e41 ("drm/xe: defer free of NVM auxiliary container to device release callback") Reviewed-by: Nitin Gote Reviewed-by: Brian Nguyen Cc: Alexander Usyskin Cc: Rodrigo Vivi Suggested-by: Brian Nguyen Signed-off-by: Shuicheng Lin Signed-off-by: Ashutosh Dixit Link: https://patch.msgid.link/20260120183239.2966782-7-shuicheng.lin@intel.com commit 11035eab1b7d88daa7904440046e64d3810b1ca1 Author: Shuicheng Lin Date: Tue Jan 20 18:32:41 2026 +0000 drm/xe/nvm: Manage nvm aux cleanup with devres Move nvm teardown to a devm-managed action registered from xe_nvm_init(). This ensures the auxiliary NVM device is deleted on probe failure and device detach without requiring explicit calls from remove paths. As part of this, drop xe_nvm_fini() from xe_device_remove() and from the survivability sysfs teardown, and remove the public xe_nvm_fini() API from the header. This is to fix below warn message when there is probe failure after xe_nvm_init(), then xe_device_probe() is called again: " [ 207.318152] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/xe.nvm.768' [ 207.318157] CPU: 5 UID: 0 PID: 10261 Comm: modprobe Tainted: G B W 6.19.0-rc2-lgci-xe-kernel+ #223 PREEMPT(voluntary) [ 207.318160] Tainted: [B]=BAD_PAGE, [W]=WARN [ 207.318161] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023 [ 207.318163] Call Trace: [ 207.318163] [ 207.318165] dump_stack_lvl+0xa0/0xc0 [ 207.318170] dump_stack+0x10/0x20 [ 207.318171] sysfs_warn_dup+0xd5/0x110 [ 207.318175] sysfs_create_dir_ns+0x1f6/0x280 [ 207.318177] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 207.318179] ? lock_acquire+0x1a4/0x2e0 [ 207.318182] ? __kasan_check_read+0x11/0x20 [ 207.318185] ? do_raw_spin_unlock+0x5c/0x240 [ 207.318187] kobject_add_internal+0x28d/0x8e0 [ 207.318189] kobject_add+0x11f/0x1f0 [ 207.318191] ? __pfx_kobject_add+0x10/0x10 [ 207.318193] ? lockdep_init_map_type+0x4b/0x230 [ 207.318195] ? get_device_parent.isra.0+0x43/0x4c0 [ 207.318197] ? kobject_get+0x55/0xf0 [ 207.318199] device_add+0x2d7/0x1500 [ 207.318201] ? __pfx_device_add+0x10/0x10 [ 207.318203] ? lockdep_init_map_type+0x4b/0x230 [ 207.318205] __auxiliary_device_add+0x99/0x140 [ 207.318208] xe_nvm_init+0x7a2/0xef0 [xe] [ 207.318333] ? xe_devcoredump_init+0x80/0x110 [xe] [ 207.318452] ? __devm_add_action+0x82/0xc0 [ 207.318454] ? fs_reclaim_release+0xc0/0x110 [ 207.318457] xe_device_probe+0x17dd/0x2c40 [xe] [ 207.318574] ? __pfx___drm_dev_dbg+0x10/0x10 [ 207.318576] ? add_dr+0x180/0x220 [ 207.318579] ? __pfx___drmm_mutex_release+0x10/0x10 [ 207.318582] ? __pfx_xe_device_probe+0x10/0x10 [xe] [ 207.318697] ? xe_pm_init_early+0x33a/0x410 [xe] [ 207.318850] xe_pci_probe+0x936/0x1250 [xe] [ 207.318999] ? lock_acquire+0x1a4/0x2e0 [ 207.319003] ? __pfx_xe_pci_probe+0x10/0x10 [xe] [ 207.319151] local_pci_probe+0xe6/0x1a0 [ 207.319154] pci_device_probe+0x523/0x840 [ 207.319157] ? __pfx_pci_device_probe+0x10/0x10 [ 207.319159] ? sysfs_do_create_link_sd.isra.0+0x8c/0x110 [ 207.319162] ? sysfs_create_link+0x48/0xc0 ... " Fixes: c28bfb107dac ("drm/xe/nvm: add on-die non-volatile memory device") Reviewed-by: Alexander Usyskin Reviewed-by: Brian Nguyen Cc: Rodrigo Vivi Cc: Riana Tauro Signed-off-by: Shuicheng Lin Signed-off-by: Ashutosh Dixit Link: https://patch.msgid.link/20260120183239.2966782-6-shuicheng.lin@intel.com commit 63b33604365bdca43dee41bab809da2230491036 Author: Shuicheng Lin Date: Wed Jan 21 17:37:51 2026 +0000 drm/xe/configfs: Fix is_bound() pci_dev lifetime Move pci_dev_put() after pci_dbg() to avoid using pdev after dropping its reference. Fixes: 2674f1ef29f46 ("drm/xe/configfs: Block runtime attribute changes") Signed-off-by: Shuicheng Lin Reviewed-by: Ashutosh Dixit Signed-off-by: Ashutosh Dixit Link: https://patch.msgid.link/20260121173750.3090907-2-shuicheng.lin@intel.com commit 6edeabacb71cfaadb6b406655cdbc53ed40b521c Author: Shuicheng Lin Date: Fri Jan 23 18:04:26 2026 +0000 drm/xe/gt: Use CLASS() for forcewake in xe_gt_enable_comp_1wcoh Adopt the scoped forcewake management using CLASS(xe_force_wake, ...) to simplify the code and ensure proper resource release. Cc: Xin Wang Cc: Matthew Auld Cc: Matt Roper Signed-off-by: Shuicheng Lin Reviewed-by: Xin Wang Reviewed-by: Matt Roper Signed-off-by: Ashutosh Dixit Link: https://patch.msgid.link/20260123180425.3262944-2-shuicheng.lin@intel.com commit 34c52c79276994453f866202ba5b66d3cf472adb Author: Gustavo Sousa Date: Thu Jan 22 09:37:07 2026 -0300 drm/i915/cdclk: Extend Wa_13012396614 to Xe3p_LPD Xe3p_LPD also needs Wa_13012396614. Update the conditions for that workaround accordingly. Signed-off-by: Gustavo Sousa Reviewed-by: Mika Kahola Link: https://patch.msgid.link/20260122-wa_13012396614-xe3p_lpd-v1-1-39d34a3a5b77@intel.com Signed-off-by: Matt Roper commit 671e1cfe5b23384245be5ec094e92906ca585fce Author: Jonathan Cavitt Date: Fri Jan 23 17:09:15 2026 +0000 drm/i915/display: vcpi is always greater than zero Static analysis issue: intel_conn_to_vcpi currently checks and asserts vcpi >= 0, as grabbed from payload->vcpi. But payload->vcpi is a u8, so this is always true. Remove this unnecessary check. While we're here, the jump statements in this function are largely defunct now, so remove those as well. Signed-off-by: Jonathan Cavitt Cc: Matt Roper Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260123170914.64548-2-jonathan.cavitt@intel.com Signed-off-by: Matt Roper commit a50007089e078a1b7a826559a02277b1601ee189 Author: Fabio Estevam Date: Tue Jan 20 20:19:30 2026 -0300 drm/bridge: fsl-ldb: Allow the termination resistor to be enabled The LVDS Control Register (LVDS_CTRL) register has an HS_EN bit that allows the 100 Ohm termination resistor in the chip to be enabled. Add support to setting the HS_EN bit when the optional property "nxp,enable-termination-resistor" is present. The motivation for introducing this property was a custom i.MX8MP board that was showing visual artifacts. After enabling the 100 Ohm termination resistor the LVDS signal quality improved causing the artifacts to disappear. Signed-off-by: Fabio Estevam Reviewed-by: Liu Ying Signed-off-by: Liu Ying Link: https://lore.kernel.org/r/20260120231930.2782444-2-festevam@gmail.com commit 2ae03ce28679e45dc3c5cb7b93a8507edfe313b0 Author: Fabio Estevam Date: Tue Jan 20 20:19:29 2026 -0300 dt-bindings: display: bridge: ldb: Document nxp, enable-termination-resistor Document the optional nxp,enable-termination-resistor property for the i.MX LVDS display bridge. This boolean property indicates that the built-in 100 Ohm termination resistor on the LVDS output is enabled. It is controlled via the HS_EN bit in the LVDS_CTRL register. Enabling the resistor can improve LVDS signal quality and may prevent visual artifacts on some boards, but increases the power consumption. Signed-off-by: Fabio Estevam Acked-by: Rob Herring (Arm) Signed-off-by: Liu Ying Link: https://lore.kernel.org/r/20260120231930.2782444-1-festevam@gmail.com commit d043b95983e692718922abdc6ba652322e66d318 Author: Michal Wajdeczko Date: Thu Jan 22 16:19:24 2026 +0100 drm/xe/vf: Reset VF GuC state on fini Unlike native/PF driver, which was explicitly triggering full GuC reset during driver unwind, the VF driver was not notifying GuC that it is about to unwind, and this could lead GuC to access stale data, which in turn could be interpreted as VF's malicious activity. Add managed action to send to GuC VF_RESET message during GT unwind. Signed-off-by: Michal Wajdeczko Cc: Daniele Ceraolo Spurio Reviewed-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260122151924.3726-1-michal.wajdeczko@intel.com commit 91e0c2fec10c975a0e2a4b91e137825d1447f50f Author: Nathan Chancellor Date: Wed Jan 21 15:57:35 2026 -0700 drm/xe: Move _THIS_IP_ usage from xe_vm_create() to dedicated function After commit a3866ce7b122 ("drm/xe: Add vm to exec queues association"), building for an architecture other than x86 (which defines its own _THIS_IP_) with clang fails with: drivers/gpu/drm/xe/xe_vm.c:1586:3: error: cannot jump from this indirect goto statement to one of its possible targets 1586 | drm_exec_retry_on_contention(&exec); | ^ include/drm/drm_exec.h:123:4: note: expanded from macro 'drm_exec_retry_on_contention' 123 | goto *__drm_exec_retry_ptr; \ | ^ drivers/gpu/drm/xe/xe_vm.c:1542:3: note: possible target of indirect goto statement 1542 | might_lock(&vm->exec_queues.lock); | ^ include/linux/lockdep.h:553:33: note: expanded from macro 'might_lock' 553 | lock_release(&(lock)->dep_map, _THIS_IP_); \ | ^ include/linux/instruction_pointer.h:10:41: note: expanded from macro '_THIS_IP_' 10 | #define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; }) | ^ drivers/gpu/drm/xe/xe_vm.c:1583:2: note: jump exits scope of variable with __attribute__((cleanup)) 1583 | xe_validation_guard(&ctx, &xe->val, &exec, (struct xe_val_flags) {.interruptible = true}, | ^ drivers/gpu/drm/xe/xe_validation.h:189:2: note: expanded from macro 'xe_validation_guard' 189 | scoped_guard(xe_validation, _ctx, _val, _exec, _flags, &_ret) \ | ^ include/linux/cleanup.h:442:2: note: expanded from macro 'scoped_guard' 442 | __scoped_guard(_name, __UNIQUE_ID(label), args) | ^ include/linux/cleanup.h:433:20: note: expanded from macro '__scoped_guard' 433 | for (CLASS(_name, scope)(args); \ | ^ drivers/gpu/drm/xe/xe_vm.c:1542:3: note: jump enters a statement expression 1542 | might_lock(&vm->exec_queues.lock); | ^ include/linux/lockdep.h:553:33: note: expanded from macro 'might_lock' 553 | lock_release(&(lock)->dep_map, _THIS_IP_); \ | ^ include/linux/instruction_pointer.h:10:20: note: expanded from macro '_THIS_IP_' 10 | #define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; }) | ^ While this is a false positive error because __drm_exec_retry_ptr is only ever assigned the label in drm_exec_until_all_locked() (thus it can never jump over the cleanup variable), this error is not unreasonable in general because the only supported use case for taking the address of a label is computed gotos [1]. The kernel's use of the address of a label in _THIS_IP_ is considered problematic by both GCC [2][3] and clang [4] but they need to provide something equivalent before they can break this use case. Hide the usage of _THIS_IP_ by moving the CONFIG_PROVE_LOCKING if statement to its own function, avoiding the error. This is similar to commit 187e16f69de2 ("drm/xe: Work around clang multiple goto-label error") but with the sources of _THIS_IP_. Fixes: a3866ce7b122 ("drm/xe: Add vm to exec queues association") Link: https://gcc.gnu.org/onlinedocs/gcc/Labels-as-Values.html [1] Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=44298 [2] Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=120071 [3] Link: https://github.com/llvm/llvm-project/issues/138272 [4] Signed-off-by: Nathan Chancellor Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260121-xe-vm-fix-clang-goto-error-v1-1-7e121d81512e@kernel.org commit 5d9d1247b2d5aa75ceccc9f9a915d4ed1109a205 Author: Mario Limonciello (AMD) Date: Tue Jan 6 11:00:17 2026 -0600 drm/amd/display: Attach OLED property to eDP panels amdgpu verifies that a given panel is an OLED panel from extended caps and can provide accurate information to userspace. Attach a property to the DRM connector. Reviewed-by: Leo Li Link: https://patch.msgid.link/20260106170017.68158-3-superm1@kernel.org Signed-off-by: Mario Limonciello (AMD) commit 42dab3138176a944b09996441d837986f9ef13f8 Author: Mario Limonciello (AMD) Date: Tue Jan 6 11:00:16 2026 -0600 drm/connector: Add a new 'panel_type' property If the driver can make an assertion whether a connected panel is an OLED panel or not then it can attach a property to the connector that userspace can use as a hint for color schemes. Reviewed-by: Leo Li Link: https://patch.msgid.link/20260106170017.68158-2-superm1@kernel.org Signed-off-by: Mario Limonciello (AMD) commit 8103ecc1999eefc54b740d8d99f264ced1d9c54d Author: Krzysztof Karas Date: Wed Jan 14 16:04:21 2026 +0000 drm/i915/selftests: Keep mock file open during unfaultable migrate with fill igt_mmap_migrate() tests migration with various parameters. In one of the cases, where FILL and UNFAULTABLE flags are set, during first stages of this test, a mock file is opened in igt_mmap_offset(), which results in allocating GEM objects for page table structures and scratch in GPU mappable memory. Then, also in igt_mmap_offset(), the file is closed (fput) and the cleanup of these objects is scheduled on a delayed worqueue, which is designed to execute after unspecified amount of time. Next, the test calls igt_fill_mappable() to fill mappable GPU memory. At this point, three scenarios are possible (N = max size of GPU memory for this test in MiB): 1) the objects allocated for the mock file get cleaned up after crucial part of the test is over, so the memory is full with the 1 MiB they occupy and N - 1 MiB added by igt_fill_mappable(), so the migration fails properly; 2) the object cleanup fires before igt_fill_mappable() completes, so the whole memory is populated with N MiB from igt_fill_mappable(), so migration fails as well; 3) the object cleanup is performed right after fill is done, so only N - 1 MiB are in the mappable portion of GPU memory, allowing the migration to succeed - we'd expect no space left to perform migration, but an object was able to fit in the remaining 1 MiB, which caused get_user() to succeed, so a page fault did not fail. The test incorrectly assumes that the GPU mappable memory state is unchanging during the test. Amend this by keeping the mock file open until migration and page fault checking is complete. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13929 Signed-off-by: Krzysztof Karas Reviewed-by: Sebastian Brzezinka Acked-by: Andi Shyti Link: https://lore.kernel.org/r/6xc74s3mbmtliqxihtxbok32jobhc26vfm5mu6cod4ywov6utf@ujp3rmqcwmr3 Signed-off-by: Andi Shyti commit b3a2a91ae9b48c74e50833242af7d73f8a0ec3a6 Author: Jani Nikula Date: Mon Jan 26 13:29:25 2026 +0200 drm/{i915, xe}/pcode: move display pcode calls to parent interface Call the parent driver pcode functions through the parent interface function pointers instead of expecting both to have functions of the same name. In i915, add the interface to existing intel_pcode.[ch], while in xe move them to new display/xe_display_pcode.[ch] and build it only for CONFIG_DRM_XE_DISPLAY=y. Do not add separate write and write_timeout calls in the interface. Instead, handle the default 1 ms timeout in the intel_parent.c glue layer. This drops the last intel_pcode.h includes from display, and allows us to remove the corresponding xe compat header. v2: initialize .pcode in i915 Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/20260126112925.2452171-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit bda4b9b8cc2f4850af52fb35abf8ead434ba38dd Author: Marek Vasut Date: Mon Jan 5 18:52:04 2026 +0100 drm/rcar-du: dsi: Clean up VCLK divider calculation Currently, in rcar_mipi_dsi_parameters_calc(), the VCLK divider is stored in setup_info structure as BIT(divider). The rcar_mipi_dsi_parameters_calc() is called at the early beginning of rcar_mipi_dsi_startup() function. Later, in the same rcar_mipi_dsi_startup() function, the stored BIT(divider) value is passed to __ffs() to calculate back the divider out of the value again. Factor out VCLK divider calculation into rcar_mipi_dsi_vclk_divider() function and call the function from both rcar_mipi_dsi_parameters_calc() and rcar_mipi_dsi_startup() to avoid this back and forth BIT() and _ffs() and avoid unnecessarily storing the divider value in setup_info at all. This rework has a slight side-effect, in that it should allow the compiler to better evaluate the code and avoid compiler warnings about variable value overflows, which can never happen. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512051834.bESvhDiG-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202512222321.TeY4VbvK-lkp@intel.com/ Signed-off-by: Marek Vasut Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260105175250.64309-1-marek.vasut+renesas@mailbox.org Signed-off-by: Tomi Valkeinen commit 609fc8766d68da10697e1df0514d079d54bf48df Author: Leon Romanovsky Date: Sat Jan 24 21:14:15 2026 +0200 dma-buf: Always build with DMABUF_MOVE_NOTIFY DMABUF_MOVE_NOTIFY was introduced in 2018 and has been marked as experimental and disabled by default ever since. Six years later, all new importers implement this callback. It is therefore reasonable to drop CONFIG_DMABUF_MOVE_NOTIFY and always build DMABUF with support for it enabled. Suggested-by: Christian König Signed-off-by: Leon Romanovsky Reviewed-by: Christian König Link: https://lore.kernel.org/r/20260124-dmabuf-revoke-v5-3-f98fca917e96@nvidia.com Signed-off-by: Christian König commit 95308225e5baeaae1e313816059c59a0036ab6b2 Author: Leon Romanovsky Date: Sat Jan 24 21:14:14 2026 +0200 dma-buf: Rename dma_buf_move_notify() to dma_buf_invalidate_mappings() Along with renaming the .move_notify() callback, rename the corresponding dma-buf core function. This makes the expected behavior clear to exporters calling this function. Signed-off-by: Leon Romanovsky Reviewed-by: Christian König Link: https://lore.kernel.org/r/20260124-dmabuf-revoke-v5-2-f98fca917e96@nvidia.com Signed-off-by: Christian König commit ef246da8e63c486780dca4d9b4d79589cbebf5e5 Author: Leon Romanovsky Date: Sat Jan 24 21:14:13 2026 +0200 dma-buf: Rename .move_notify() callback to a clearer identifier Rename the .move_notify() callback to .invalidate_mappings() to make its purpose explicit and highlight that it is responsible for invalidating existing mappings. Suggested-by: Christian König Reviewed-by: Christian König Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/20260124-dmabuf-revoke-v5-1-f98fca917e96@nvidia.com Signed-off-by: Christian König commit ad381460c90bd3b9d39a5160df0b8b446b098736 Author: Suraj Kandpal Date: Thu Jan 22 08:48:18 2026 +0530 drm/i915/display: Disable DMG Clock Gating Incorrect clock is connected to DMG registers. Disable DMG Clock gating during display initialization. WA: 22021451799 Bspec: 69095 Signed-off-by: Suraj Kandpal Reviewed-by: Nemesa Garg Link: https://patch.msgid.link/20260122031818.703590-1-suraj.kandpal@intel.com commit bbde2759de1b85ae8c45281f251cdf61cd23fa7f Author: Suraj Kandpal Date: Thu Jan 22 10:18:59 2026 +0530 drm/i915/cx0: Rename intel_clear_response_ready flag Rename the non static intel_clear_response_ready_flag to intel_cx0_clear_response_ready_flag so that we follow the naming standards of non static function. Signed-off-by: Suraj Kandpal Reviewed-by: Nemesa Garg Link: https://patch.msgid.link/20260122044859.753682-2-suraj.kandpal@intel.com commit f86bed1bc93111a0308bc4d0335ee68d6fc9a1f4 Author: Suraj Kandpal Date: Thu Jan 22 10:18:58 2026 +0530 drm/i915/cx0: Clear response ready & error bit Clear the response ready and error bit of PORT_P2M_MESSAGE_BUS_STATUS before writing the transaction pending bit of PORT_M2P_MSGBUS_CTL as that is a hard requirement. If not done we find that the PHY hangs since it ends up in a weird state if left idle for more than 1 hour. Bspec: 65101 Signed-off-by: Suraj Kandpal Reviewed-by: Gustavo Sousa Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/20260122044859.753682-1-suraj.kandpal@intel.com commit 60bfb8baf8f0d5b0d521744dfd01c880ce1a23f3 Author: Shuicheng Lin Date: Fri Jan 9 21:10:42 2026 +0000 drm/xe: Unregister drm device on probe error Call drm_dev_unregister() when xe_device_probe() fails after successful drm_dev_register(). This ensures the DRM device is promptly unregistered before returning an error, avoiding leaving it registered on the failure path. Otherwise, there is warn message if xe_device_probe() is called again: " [ 207.322365] [drm:drm_minor_register] [ 207.322381] debugfs: '128' already exists in 'dri' [ 207.322432] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/drm/renderD128' [ 207.322435] CPU: 5 UID: 0 PID: 10261 Comm: modprobe Tainted: G B W 6.19.0-rc2-lgci-xe-kernel+ #223 PREEMPT(voluntary) [ 207.322439] Tainted: [B]=BAD_PAGE, [W]=WARN [ 207.322440] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023 [ 207.322441] Call Trace: [ 207.322442] [ 207.322443] dump_stack_lvl+0xa0/0xc0 [ 207.322446] dump_stack+0x10/0x20 [ 207.322448] sysfs_warn_dup+0xd5/0x110 [ 207.322451] sysfs_create_dir_ns+0x1f6/0x280 [ 207.322453] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 207.322455] ? lock_acquire+0x1a4/0x2e0 [ 207.322458] ? __kasan_check_read+0x11/0x20 [ 207.322461] kobject_add_internal+0x28d/0x8e0 [ 207.322464] kobject_add+0x11f/0x1f0 [ 207.322465] ? lock_acquire+0x1a4/0x2e0 [ 207.322467] ? __pfx_kobject_add+0x10/0x10 [ 207.322469] ? __kasan_check_write+0x14/0x20 [ 207.322471] ? kobject_put+0x62/0x4a0 [ 207.322473] ? get_device_parent.isra.0+0x1bb/0x4c0 [ 207.322475] ? kobject_put+0x62/0x4a0 [ 207.322477] device_add+0x2d7/0x1500 [ 207.322479] ? __pfx_device_add+0x10/0x10 [ 207.322481] ? drm_debugfs_add_file+0xfa/0x170 [ 207.322483] ? drm_debugfs_add_files+0x82/0xd0 [ 207.322485] ? drm_debugfs_add_files+0x82/0xd0 [ 207.322487] drm_minor_register+0x10a/0x2d0 [ 207.322489] drm_dev_register+0x143/0x860 [ 207.322491] ? xe_configfs_get_psmi_enabled+0x12/0x90 [xe] [ 207.322667] xe_device_probe+0x185b/0x2c40 [xe] [ 207.322812] ? __pfx___drm_dev_dbg+0x10/0x10 [ 207.322815] ? add_dr+0x180/0x220 [ 207.322818] ? __pfx___drmm_mutex_release+0x10/0x10 [ 207.322821] ? __pfx_xe_device_probe+0x10/0x10 [xe] [ 207.322966] ? xe_pm_init_early+0x33a/0x410 [xe] [ 207.323136] xe_pci_probe+0x936/0x1250 [xe] [ 207.323298] ? lock_acquire+0x1a4/0x2e0 [ 207.323302] ? __pfx_xe_pci_probe+0x10/0x10 [xe] [ 207.323464] local_pci_probe+0xe6/0x1a0 [ 207.323468] pci_device_probe+0x523/0x840 [ 207.323470] ? __pfx_pci_device_probe+0x10/0x10 [ 207.323473] ? sysfs_do_create_link_sd.isra.0+0x8c/0x110 [ 207.323476] ? sysfs_create_link+0x48/0xc0 [ 207.323479] really_probe+0x1fd/0x8a0 ... " Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Shuicheng Lin Reviewed-by: Jonathan Cavitt Link: https://patch.msgid.link/20260109211041.2446012-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper commit 40ee63f5df2d5c6471b583df800aac89dc0502a4 Author: Vinay Belgaumkar Date: Fri Jan 23 16:59:17 2026 -0800 drm/xe/ptl: Disable DCC on PTL On PTL, the recommendation is to disable DCC(Duty Cycle Control) as it may cause some regressions due to added latencies. Upcoming GuC releases will disable DCC on PTL as well, but we need to force it in KMD so that this behavior is propagated to older kernels. v2: Update commit message (Rodrigo) v3: Rebase v4: Fix typo: s/propagted/propagated Fixes: 5cdb71d3b0db ("drm/xe/ptl: Add GuC FW definition for PTL") Cc: Daniele Ceraolo Spurio Cc: Rodrigo Vivi Signed-off-by: Vinay Belgaumkar Link: https://patch.msgid.link/20260124005917.398522-1-vinay.belgaumkar@intel.com Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi commit 7fe6cae2f7fad2b5166b0fc096618629f9e2ebcb Author: Tvrtko Ursulin Date: Fri Jan 16 09:50:40 2026 +0000 drm/xe/xelp: Fix Wa_18022495364 It looks I mistyped CS_DEBUG_MODE2 as CS_DEBUG_MODE1 when adding the workaround. Fix it. Signed-off-by: Tvrtko Ursulin Fixes: ca33cd271ef9 ("drm/xe/xelp: Add Wa_18022495364") Cc: Matt Roper Cc: "Thomas Hellström" Cc: Rodrigo Vivi Cc: # v6.18+ Reviewed-by: Matt Roper Signed-off-by: Thomas Hellström Link: https://patch.msgid.link/20260116095040.49335-1-tvrtko.ursulin@igalia.com commit 68e28facbc8ab3e701e1814323d397a75b400865 Author: Maíra Canal Date: Thu Jan 15 09:50:48 2026 -0300 drm/panel: ilitek-ili9882t: Select DRM_DISPLAY_DSC_HELPER The panel-ilitek-ili9882t driver uses drm_dsc_pps_payload_pack() which is provided by the DRM_DISPLAY_DSC_HELPER. Add the missing Kconfig select to fix the following build error: ERROR: modpost: "drm_dsc_pps_payload_pack" [drivers/gpu/drm/panel/panel-ilitek-ili9882t.ko] undefined! Fixes: 65ce1f5834e9 ("drm/panel: ilitek-ili9882t: Switch Tianma TL121BVMS07 to DSC 120Hz mode") Reviewed-by: Neil Armstrong Tested-by: Nicolas Frattaroli Reviewed-by: Nicolas Frattaroli Link: https://patch.msgid.link/20260115125136.64866-1-mcanal@igalia.com Signed-off-by: Maíra Canal commit cca7eda1c73045d6fb12b3db34f90de65412e742 Author: Jani Nikula Date: Tue Jan 20 17:45:41 2026 +0200 drm/{i915, xe}/dsb: move DSB buffer to parent interface Move the DSB buffer handling to the display parent interface, making display more independent of i915 and xe driver implementations. Since the DSB parent interface is only called from intel_dsb.c, add the wrappers there with smaller visibility instead of the usual intel_parent.[ch], and using struct intel_dsb as the context parameter for convenience. Unfortunately, memset() being a macro in linux/fortify-string.h, we can't use that as the function pointer name. dsb->memset() would be using the macro and leading to build failures. Therefore, use .fill() for the memset() functionality. v2: s/memset/fill/ Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/df117c862a6d34dae340e4a85c2482b4e29c8884.1768923917.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 1617f5955c6458513787656afde819c91323ab03 Author: Jani Nikula Date: Tue Jan 20 17:45:40 2026 +0200 drm/i915/dsb: move i915 specific DSB buffer implementation to i915 The DSB buffer implementation is different for both i915 and xe. Move the i915 specific implementation from display to i915 core. Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/a01b3e69a3f79713eacf437af00dbe23d2f9c8dd.1768923917.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 4761791c1e736273d612ff564f318bfbbb04fa4e Author: Shuicheng Lin Date: Thu Jan 22 21:40:54 2026 +0000 drm/xe: Skip address copy for sync-only execs For parallel exec queues, xe_exec_ioctl() copied the batch buffer address array from userspace without checking num_batch_buffer. If user creates a sync-only exec that doesn't use the address field, the exec will fail with -EFAULT. Add num_batch_buffer check to skip the copy, and the exec could be executed successfully. Here is the sync-only exec: struct drm_xe_exec exec = { .extensions = 0, .exec_queue_id = qid, .num_syncs = 1, .syncs = (uintptr_t)&sync, .address = 0, /* ignored for sync-only */ .num_batch_buffer = 0, /* sync-only */ }; Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260122214053.3189366-2-shuicheng.lin@intel.com commit 2cb217301e0df17f7107a1b0941b28d4053eae8b Author: Terry Hsiao Date: Thu Jan 22 11:29:04 2026 +0800 drm/panel-edp: Add AUO B116XAT04.1 (HW: 1A) Add support for the AUO - B116XAT04.1 (HW: 1A) panel. This panel is used on MT8186 Chromebooks The raw EDID: 00 ff ff ff ff ff ff 00 06 af ba 89 00 00 00 00 0c 23 01 04 95 1a 0e 78 02 9e a5 96 59 58 96 28 1b 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ce 1d 56 ea 50 00 1a 30 30 20 46 00 00 90 10 00 00 18 df 13 56 ea 50 00 1a 30 30 20 46 00 00 90 10 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 10 48 ff 0f 3c 7d 0c 0a 2a 7d 20 20 20 00 21 Signed-off-by: Terry Hsiao Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260122032904.3933-1-terry_hsiao@compal.corp-partner.google.com commit f08f665f8cda9520d98ee24545d306a92f386616 Author: Nicolas Frattaroli Date: Fri Jan 23 14:11:44 2026 +0100 drm/panthor: Add src path to includes of panthor_gpu.o The file that defines CREATE_TRACE_POINTS needs to have the src directory added to its include paths, or else the build may fail, as define_trace.h won't be able to find the included trace file. Add it to the Makefile's CFLAGS for panthor_gpu.o. Fixes: 52ebfd8d2feb ("drm/panthor: Add tracepoint for hardware utilisation changes") Reported-by: Sasha Levin Closes: https://lore.kernel.org/r/aXLyzd6pMmexwWlY@laps/ Signed-off-by: Nicolas Frattaroli Reviewed-by: Liviu Dudau Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20260123-panthor-tracepoint-build-fix-v1-1-7d67b7c0ae9b@collabora.com Signed-off-by: Boris Brezillon commit ced8299146eb4cec326ffe0bc5fc642e94165a5b Author: Jani Nikula Date: Thu Jan 22 14:37:59 2026 +0200 drm/i915: move GEN7_ERR_INT snapshot to display irq code The error interrupt register GEN7_ERR_INT is a display irq register. Move its GPU error capture to display irq snapshot. Cc: Uma Shankar Reviewed-by: Uma Shankar Link: https://patch.msgid.link/20260122123759.1701492-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 6ef02656c3222b1e12032a40d644ed56806b14fc Author: Nitin Gote Date: Tue Jan 20 11:17:25 2026 +0530 drm/xe: derive mem copy capability from graphics version Drop .has_mem_copy_instr from the platform descriptors and set it in xe_info_init() after handle_gmdid() populates graphics_verx100. Centralizing the GRAPHICS_VER(xe) >= 20 check keeps MEM_COPY enabled on Xe2+ and removes redundant per-platform plumbing. Bspec: 57561 Fixes: 1e12dbae9d72 ("drm/xe/migrate: support MEM_COPY instruction") Cc: Matt Roper Reviewed-by: Matthew Auld Suggested-by: Matthew Auld Signed-off-by: Nitin Gote Link: https://patch.msgid.link/20260120054724.1982608-2-nitin.r.gote@intel.com Signed-off-by: Tejas Upadhyay commit 42bb7bdae97cc4e285fb741d9ebd1f5a36fe3f94 Author: Ville Syrjälä Date: Mon Dec 8 20:26:37 2025 +0200 drm/i915: Document the GMCH_CTRL register a bit The actual GMCH_CRTL lives in the host bridge aka. device 0, but device 2 has a read-only mirror on i85x/i865+. Document that fact. Also remove the ancient tales about where the defines are used. Those haven't been true in a long time. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-20-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 29ed5593ca202da679493c25f82bf89a59114092 Author: Ville Syrjälä Date: Mon Dec 8 20:26:36 2025 +0200 drm/i915: Clean up PCI config space reg defines The PCI config space register defines in i915_drm.h are a bit of a mess; Whitespace is all over the place, register masks and values are defined in inconsistent ways. Clean it up a bit. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-19-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 20382658ffbb98e1ea8bc22fd774f76d4f342dc9 Author: Ville Syrjälä Date: Mon Dec 8 20:26:35 2025 +0200 drm/i915: Get rid of the INTEL_GMCH_CTRL alias INTEL_GMCH_CTRL and I830_GMCH_CTRL are the same register. Get rid of the INTEL_GMCH_CTRL name. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-18-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 5f61ebd578126fc6b25fd3b4b13f8aa24b2cb9c6 Author: Ville Syrjälä Date: Mon Dec 8 20:26:34 2025 +0200 drm/i915/crt: Extract intel_crt_sense_above_threshold() Extract the CRT sense check into a helper instead of repeating the same thing twice. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-17-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 5dc670f24b055ef9f4a95f7db41e97465695c3f6 Author: Ville Syrjälä Date: Mon Dec 8 20:26:33 2025 +0200 drm/i915/crt: Use IS0_R instead of VGA_MIS_W Use the proper IS0_R name for the VGA input status register 0, instead of using the VGA_MIS_W alias which is meant for write accesses to the same address. Yes, VGA registers are weird. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-16-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 46e51fd0149a85e8165868761f7ede2fdec56654 Author: Ville Syrjälä Date: Tue Dec 9 09:55:49 2025 +0200 video/vga: Add VGA_IS0_R Add a proper name for the "Input status register 0" IO address. Currently we have some code that does reads using the aliasing VGA_MSR_W define, making it unclear what register we're actually reading. v2: Remove stray '?' Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251209075549.14051-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula Acked-by: Helge Deller commit 359dd735ef833f2d9b75917794d049761f9e007c Author: Ville Syrjälä Date: Mon Dec 8 20:26:31 2025 +0200 drm/i915/vga: Use MMIO for VGA registers on pre-g4x On pre-g4x VGA registers are accessible via MMIO. Make use of it so that we can avoid dealing with the VGA arbiter. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-14-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 3acd8cbbd738eb8c85fc5ec3c7d9fbee26db6d04 Author: Ville Syrjälä Date: Mon Dec 8 20:26:30 2025 +0200 drm/i915/vga: Introduce intel_vga_{read,write}() VGA register are rather special since they either get accessed via the global IO addresses, or possibly through MMIO on pre-g4x platforms. Wrap all VGA register accesses in intel_vga_{read,write}() to make it obvious where they get accessed. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-13-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 005a496d0f5b2c5818e320d58edc0a47f7bdb923 Author: Ville Syrjälä Date: Mon Dec 8 20:26:29 2025 +0200 drm/i915/de: Add intel_de_write8() Add a write counterpart to intel_de_read8(). Will be used for MMIO access to VGA registers on pre-g4x. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-12-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit d2bfe35f840d9fdfe76efcd4ffab185abad44046 Author: Ville Syrjälä Date: Mon Dec 8 20:26:28 2025 +0200 drm/i915/de: Simplify intel_de_read8() intel_de_read8() is only needed for VGA register MMIO access by the CRT code on gen2/3. Remove the redundant wakelock stuff, and add a platform check to make sure this won't get used on any platform where MMIO VGA register accesses don't work. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-11-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 7e47a14b02fe288029448f8ba80852fe2b0b2d53 Author: Ville Syrjälä Date: Mon Dec 8 20:26:27 2025 +0200 drm/i915/vga: Assert that VGA register accesses are going to the right GPU We want our VGA register accesses to land on the correct GPU. Check that the VGA routing is appropriately configured. For the iGPU this just means the IO decode enable on the GPU, but for dGPUs we also need the entire chain of bridges to forward the VGA accesses. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-10-ville.syrjala@linux.intel.com Acked-by: Jani Nikula commit 01f827140bcbde9f6b4ce68bc7657f9bb9739a69 Author: Ville Syrjälä Date: Mon Dec 8 20:26:26 2025 +0200 drm/i915/vga: Stop trying to use GMCH_CTRL for VGA decode control intel_gmch_vga_set_state() is a complete lie on ILK+ because the GMCH_CTRL register is locked and can't actually be written. But we still need to remove the iGPU from the VGA arbitration on iGPU+dGPU systems, or else Xorg performance will tank due to the constant VGA arbiter accesses. For VGA memory decode we can't turn off the PCI_COMMAND memory deocde as that would disable even normal MMIO. Instead we can disable just the VGA memory decode via the VGA MSR register. And we can do that just once when disabling the VGA plane. That way we don't have to touch VGA registers anywhere else. We can also inform the arbiter that we're no longer decoding VGA memory. This will stop the arbiter from disabling all memory decode for the iGPU via PCI_COMMAND (and thus breaking everything) whenever some other GPU wants to own the VGA memory accesses. For IO we can disable all IO decode via the PCI_COMMAND register, except around the few VGA register accesses that we need to do in intel_vga_disable(). Unfortunately we can't disable IO decode permanently as it makes some laptops (eg. Dell Latitude E5400) hang during reboot/shutdown. One option would be to re-enable IO decode from the poweroff hooks, but that won't help the sysrq emergency reboot/shutdown since it won't call said hooks. So let's try to keep IO decode in its original setting unless we really need to disable it to exclude the GPU from VGA arbitration. I suppose we could keep frobbing GMCH_CTRL on pre-ILK, but it seems better to not do it since it has other side effects such as changing the class code of the PCI device. For discrete GPUs we'll rely on the bridge control instead. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-9-ville.syrjala@linux.intel.com Acked-by: Jani Nikula commit cc6ed470caa201b25e9e7e1ca21144e17914644c Author: Ville Syrjälä Date: Mon Dec 8 20:26:25 2025 +0200 drm/i915/vga: Avoid VGA arbiter during intel_vga_disable() for iGPUs Avoid using the VGA arbiter during intel_vga_get() for iGPUs because that will clobber the VGA routing for whatever external GPU is the current VGA device. That will cause all reads from VGA memory to come back as 0xff/white, and thus we get a white rectangle on screen when the external GPU switches from vgacon to fbcon. The iGPU has the highest VGA decode priority so it will steal all VGA register accesses whenever its IO decoding is enabled. We'll only keep the IO decode enabled for a short time so hopefully we don't end up eating too many unrelated VGA register accesses. For discrete GPUs we need all the bridges to have their VGA forwarding bits correctly configured so we can't really avoid the VGA arbiter there. Although we only do this stuff on dGPUs when the VGA plane was actaully enabled, so the dGPU should be the current VGA device and thus have VGA routed to it already anyway. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-8-ville.syrjala@linux.intel.com Acked-by: Jani Nikula commit f1640f9d7fa44b19f06aa0e9b2e99bdd8e62863a Author: Ville Syrjälä Date: Mon Dec 8 20:26:24 2025 +0200 drm/i915/vga: Clean up VGA registers even if VGA plane is disabled Turns out at least some systems (eg. HSW Lenovo ThinkCentre E73) configure the VGA registers even when booting in UEFI mode. So in order to avoid any issues with the MSR register we should clean up the VGA registers anyway. For now this mostly avoids the potential for unclaimed register accesses due to the power well vs. MDA/CGA selection. But this will become more important soon as we'll start to rely on the MSR register to control VGA memory decode as well. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-7-ville.syrjala@linux.intel.com Acked-by: Jani Nikula commit 46ccf3fb55d5260e6e3535fec7bcb85f3e9ba667 Author: Ville Syrjälä Date: Mon Dec 8 20:26:23 2025 +0200 drm/i915/vga: Don't touch VGA registers if VGA decode is fully disabled On some systems the BIOS will disable the VGA decode logic in the iGPU (via GMCH_CTRL) when an external GPU is used as the primary VGA device. In that case the iGPU will never claim any VGA register accesses, and any access we do will in fact end up on the external GPU. Don't go poking around in the other GPUs' registers. Note that (at least on the g4x board where I tested this) the BIOS forgets to set the VGACNTR VGA_DISP_DISABLE bit, and the reset value for said bit is 0. That apparently prevents the pipes from running, so we must still remember to set the bit, despite the VGA plane was never actually enabled. On more modern platforms (hsw+ maybe?) the reset value for VGACNTR was changed to have VGA_DISP_DISABLE already set. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-6-ville.syrjala@linux.intel.com Acked-by: Jani Nikula commit d4470842e415e8e1b170bfac98c65077babdffcb Author: Ville Syrjälä Date: Mon Dec 8 20:26:22 2025 +0200 drm/i915/vga: Extract intel_gmch_ctrl_reg() Extract the GMCH_CTLR register offset determination into a helper rather than using a local varaible. I'll be needing this in another function soon. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-5-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 284c6d8043a82549ec4f3e0300ea14c53713d974 Author: Ville Syrjälä Date: Mon Dec 8 20:26:21 2025 +0200 drm/i915/power: Remove i915_power_well_desc::has_vga We no longer have any need for the has_vga flag in the display power well descriptor. Get rid of it. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-4-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 4d71ff25f3a027ed3acbb186d2208113d0e1ec82 Author: Ville Syrjälä Date: Mon Dec 8 20:26:20 2025 +0200 drm/i915/vga: Get rid of intel_vga_reset_io_mem() Remove the MSR VGA register access from the power well hook, and just do it once in intel_vga_disable(). Turns out that the hardware has two levels of MDA vs. CGA decode logic: GPU level and display engine level. When we write the MSR register MDA/CGA mode selection bit both decode logics are updated accordingly, so that whichever register accessed the GPU claims will also be claimed by the display engine on the RMbus. If the two get out of sync the GPU will claim the register accesses but the display engine will not, leading to RMbus NoClaim errors. The way to get the two decode logics out of sync is by resetting the power well housing the VGA stuff, while we are in CGA mode. At that point only the display engine level decode logic will be updated with the new MSR register reset value (which selects MDA mode), and the GPU level decode logic will retain its previous state (GGA mode). To avoid the mismatch we just have to switch to MDA mode with an explicit MSR register write. Currently this is being done in a somewhat dodgy manner whenever the power well gets enabled. But doing if from the power well hook is not actually necessary since the GPU level decode logic will retain its state even when the power well is disabled. Ie. doing it just the one time is sufficient, and that can be done when we're anyway writing other VGA registers while disabling the VGA plane. See commit f9dcb0dfee98 ("drm/i915: touch VGA MSR after we enable the power well") for the original details. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-3-ville.syrjala@linux.intel.com Acked-by: Jani Nikula commit 70ea362b84449b7061cefd63a532f648d2919916 Author: Ville Syrjälä Date: Mon Dec 8 20:26:19 2025 +0200 drm/i915/vga: Register vgaarb client later Currently we register to vgaarb way too early. Thus it is possible that the entire VGA decode logic gets nuked via GMCH_CTRL before intel_vga_disable() has even disabled the VGA plane. This could even cause a system hang because we'll be unable to turn off the VGA plane gracefully. Move the vgaarb registration into intel_display_driver_register(). I suppose we could do it a bit earlier (after intel_vga_disable()), but not convinced there's any point. Also the error handling here is pointless since the registration can't fail (unless the device isn't a VGA class in which case all VGA decode logic should aleady be disabled by the BIOS via GMCH_CTRL). But let's toss in a WARN to catch any future breakage of vga_client_register(). Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251208182637.334-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 15bd2f5d52de890f745ac0c60a44cd27d095bb0d Author: Nicolas Frattaroli Date: Fri Jan 16 13:57:33 2026 +0100 drm/panthor: Add gpu_job_irq tracepoint Mali's CSF firmware triggers the job IRQ whenever there's new firmware events for processing. While this can be a global event (BIT(31) of the status register), it's usually an event relating to a command stream group (the other bit indices). Panthor throws these events onto a workqueue for processing outside the IRQ handler. It's therefore useful to have an instrumented tracepoint that goes beyond the generic IRQ tracepoint for this specific case, as it can be augmented with additional data, namely the events bit mask. This can then be used to debug problems relating to GPU jobs events not being processed quickly enough. The duration_ns field can be used to work backwards from when the tracepoint fires (at the end of the IRQ handler) to figure out when the interrupt itself landed, providing not just information on how long the work queueing took, but also when the actual interrupt itself arrived. With this information in hand, the IRQ handler itself being slow can be excluded as a possible source of problems, and attention can be directed to the workqueue processing instead. Signed-off-by: Nicolas Frattaroli Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20260116-panthor-tracepoints-v10-4-d925986e3d1b@collabora.com Signed-off-by: Boris Brezillon commit 52ebfd8d2feb1f37bc75c6b662b620323de676ea Author: Nicolas Frattaroli Date: Fri Jan 16 13:57:32 2026 +0100 drm/panthor: Add tracepoint for hardware utilisation changes Mali GPUs have three registers that indicate which parts of the hardware are powered at any moment. These take the form of bitmaps. In the case of SHADER_READY for example, a high bit indicates that the shader core corresponding to that bit index is powered on. These bitmaps aren't solely contiguous bits, as it's common to have holes in the sequence of shader core indices, and the actual set of which cores are present is defined by the "shader present" register. When the GPU finishes a power state transition, it fires a GPU_IRQ_POWER_CHANGED_ALL interrupt. After such an interrupt is received, the _READY registers will contain new interesting data. During power transitions, the GPU_IRQ_POWER_CHANGED interrupt will fire, and the registers will likewise contain potentially changed data. This is not to be confused with the PWR_IRQ_POWER_CHANGED_ALL interrupt, which is something related to Mali v14+'s power control logic. The _READY registers and corresponding interrupts are already available in v9 and onwards. Expose the data as a tracepoint to userspace. This allows users to debug various scenarios and gather interesting information, such as: knowing how much hardware is lit up at any given time, correlating graphics corruption with a specific powered shader core, measuring when hardware is allowed to go to a powered off state again, and so on. The registration/unregistration functions for the tracepoint go through a wrapper in panthor_hw.c, so that v14+ can implement the same tracepoint by adding its hardware specific IRQ on/off callbacks to the panthor_hw.ops member. Signed-off-by: Nicolas Frattaroli Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20260116-panthor-tracepoints-v10-3-d925986e3d1b@collabora.com Signed-off-by: Boris Brezillon commit c5bf1d4e4473f0f18dfba0266a8fd48cb3700e73 Author: Nicolas Frattaroli Date: Fri Jan 16 13:57:31 2026 +0100 drm/panthor: Extend IRQ helpers for mask modification/restoration The current IRQ helpers do not guarantee mutual exclusion that covers the entire transaction from accessing the mask member and modifying the mask register. This makes it hard, if not impossible, to implement mask modification helpers that may change one of these outside the normal suspend/resume/isr code paths. Add a spinlock to struct panthor_irq that protects both the mask member and register. Acquire it in all code paths that access these, but drop it before processing the threaded handler function. Then, add the aforementioned new helpers: enable_events, and disable_events. They work by ORing and NANDing the mask bits. resume is changed to no longer have a mask passed, as pirq->mask is supposed to be the user-requested mask now, rather than a mirror of the INT_MASK register contents. Users of the resume helper are adjusted accordingly, including a rather painful refactor in panthor_mmu.c. In panthor_mmu.c, the bespoke mask modification is excised, and replaced with enable_events/disable_events in as_enable/as_disable. Co-developed-by: Boris Brezillon Signed-off-by: Boris Brezillon Signed-off-by: Nicolas Frattaroli Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20260116-panthor-tracepoints-v10-2-d925986e3d1b@collabora.com commit 0b2d86670a8438f6e98266a86ab5f407c6e2b0b6 Author: Nicolas Frattaroli Date: Fri Jan 16 13:57:30 2026 +0100 drm/panthor: Rework panthor_irq::suspended into panthor_irq::state To deal with the threaded interrupt handler and a suspend action overlapping, the boolean panthor_irq::suspended is not sufficient. Rework it into taking several different values depending on the current state, and check it and set it within the IRQ helper functions. Co-developed-by: Boris Brezillon Signed-off-by: Boris Brezillon Signed-off-by: Nicolas Frattaroli Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20260116-panthor-tracepoints-v10-1-d925986e3d1b@collabora.com commit dc2fc00ba94dee539593228a5e188c8e6a84ba47 Author: Sanjay Yadav Date: Wed Jan 21 16:44:17 2026 +0530 drm/xe: Use DRM_BUDDY_CONTIGUOUS_ALLOCATION for contiguous allocations The VRAM/stolen memory managers do not currently set DRM_BUDDY_CONTIGUOUS_ALLOCATION for contiguous allocations. Enabling this flag activates the buddy allocator's try_harder path, which helps handle fragmented memory scenarios. This enables the __alloc_contig_try_harder fallback in the buddy allocator, allowing contiguous allocation requests to succeed even when memory is fragmented by combining allocations from both(RHS and LHS) sides of a large free block. v2: (Matt B) - Remove redundant logic for rounding allocation size and trimming when TTM_PL_FLAG_CONTIGUOUS is set, since drm_buddy now handles this when DRM_BUDDY_CONTIGUOUS_ALLOCATION is enabled Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6713 Suggested-by: Matthew Auld Signed-off-by: Sanjay Yadav Reviewed-by: Matthew Brost Reviewed-by: Matthew Auld Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260121111416.3104399-2-sanjay.kumar.yadav@intel.com commit 9386f49316074d2d76fd78d6bd359996de42fb7f Author: Thomas Hellström Date: Wed Jan 21 10:10:48 2026 +0100 drm/xe: Select CONFIG_DEVICE_PRIVATE when DRM_XE_GPUSVM is selected CONFIG_DEVICE_PRIVATE is a prerequisite for DRM_XE_GPUSVM. Explicitly select it so that DRM_XE_GPUSVM is not unintentionally left out from distro configs not explicitly enabling CONFIG_DEVICE_PRIVATE. v2: - Select also CONFIG_ZONE_DEVICE since it's needed by CONFIG_DEVICE_PRIVATE. v3: - Depend on CONFIG_ZONE_DEVICE rather than selecting it. Cc: Matthew Auld Cc: Matthew Brost Cc: Rodrigo Vivi Cc: Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://patch.msgid.link/20260121091048.41371-3-thomas.hellstrom@linux.intel.com commit 1e372b246199ca7a35f930177fea91b557dac16e Author: Thomas Hellström Date: Wed Jan 21 10:10:47 2026 +0100 drm, drm/xe: Fix xe userptr in the absence of CONFIG_DEVICE_PRIVATE CONFIG_DEVICE_PRIVATE is not selected by default by some distros, for example Fedora, and that leads to a regression in the xe driver since userptr support gets compiled out. It turns out that DRM_GPUSVM, which is needed for xe userptr support compiles also without CONFIG_DEVICE_PRIVATE, but doesn't compile without CONFIG_ZONE_DEVICE. Exclude the drm_pagemap files from compilation with !CONFIG_ZONE_DEVICE, and remove the CONFIG_DEVICE_PRIVATE dependency from CONFIG_DRM_GPUSVM and the xe driver's selection of it, re-enabling xe userptr for those configs. v2: - Don't compile the drm_pagemap files unless CONFIG_ZONE_DEVICE is set. - Adjust the drm_pagemap.h header accordingly. Fixes: 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") Cc: Matthew Auld Cc: Himal Prasad Ghimiray Cc: Thomas Hellström Cc: Matthew Brost Cc: "Thomas Hellström" Cc: Rodrigo Vivi Cc: dri-devel@lists.freedesktop.org Cc: # v6.18+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Acked-by: Maarten Lankhorst Link: https://patch.msgid.link/20260121091048.41371-2-thomas.hellstrom@linux.intel.com commit 37d5f4da49821cd542561d5cfffea35d32f5bef6 Author: Ankit Nautiyal Date: Wed Jan 14 08:24:56 2026 +0530 drm/i915/gvt_mmio_table: Use the gvt versions of the display macros Include gvt/display_helpers.h so that the display register macros in intel_gvt_mmio_table.c expand through the exported display functions. This lets us keep the existing macro calls while avoiding direct access to display internals, helping the display modularization work. Signed-off-by: Ankit Nautiyal Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260114025456.1639171-1-ankit.k.nautiyal@intel.com commit 6695dc279820a50cb20ecd8b5250e05234dac780 Author: Jonathan Cavitt Date: Wed Jan 7 16:29:36 2026 +0000 drm/i915/display: Prevent u64 underflow in intel_fbc_stolen_end Static analysis reveals a potential integer underflow in intel_fbc_stolen_end. This can apparently occur if intel_parent_stolen_area_size returns zero (or, theoretically, any value less than 2^23), as 2^23 is subtracted from the return value and stored in a u64. While this doesn't appear to cause any issues due to the use of the min() function to clamp the return values from the intel_fbc_stolen_end function, it would be best practice to avoid undeflowing values like this on principle. So, rework the function to prevent the underflow from occurring. Note that the underflow at present would result in the value of intel_fbc_cfb_base_max being returned at the end of intel_fbc_stolen_end, so just return that if the value of intel_parent_stolen_area_size is too small. While we're here, fix the other comments here and modify the execution path for readability. v2: (Jani) - Fix the comments in intel_fbc_stolen_end - Use check_sub_overflow - Remove macro that mirrors SZ_8M, as it is now only referenced once - Misc. formatting fixes Fixes: a9da512b3ed7 ("drm/i915: avoid the last 8mb of stolen on BDW/SKL") Signed-off-by: Jonathan Cavitt Cc: Paulo Zanoni Cc: Ville Syrjälä Cc: Daniel Vetter Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260107162935.8123-2-jonathan.cavitt@intel.com Signed-off-by: Matt Roper commit 9dd1048bca4fe2aa67c7a286bafb3947537adedb Author: Matthew Auld Date: Tue Jan 20 11:06:11 2026 +0000 drm/xe/migrate: fix job lock assert We are meant to be checking the user vm for the bind queue, but actually we are checking the migrate vm. For various reasons this is not currently firing but this will likely change in the future. Now that we have the user_vm attached to the bind queue, we can fix this by directly checking that here. Fixes: dba89840a920 ("drm/xe: Add GT TLB invalidation jobs") Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Reviewed-by: Matthew Brost Reviewed-by: Arvind Yadav Link: https://patch.msgid.link/20260120110609.77958-4-matthew.auld@intel.com commit 9dd08fdecc0c98d6516c2d2d1fa189c1332f8dab Author: Matthew Auld Date: Tue Jan 20 11:06:10 2026 +0000 drm/xe/uapi: disallow bind queue sharing Currently this is very broken if someone attempts to create a bind queue and share it across multiple VMs. For example currently we assume it is safe to acquire the user VM lock to protect some of the bind queue state, but if allow sharing the bind queue with multiple VMs then this quickly breaks down. To fix this reject using a bind queue with any VM that is not the same VM that was originally passed when creating the bind queue. This a uAPI change, however this was more of an oversight on kernel side that we didn't reject this, and expectation is that userspace shouldn't be using bind queues in this way, so in theory this change should go unnoticed. Based on a patch from Matt Brost. v2 (Matt B): - Hold the vm lock over queue create, to ensure it can't be closed as we attach the user_vm to the queue. - Make sure we actually check for NULL user_vm in destruction path. v3: - Fix error path handling. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Reported-by: Thomas Hellström Signed-off-by: Matthew Auld Cc: José Roberto de Souza Cc: Matthew Brost Cc: Michal Mrozek Cc: Carl Zhang Cc: # v6.8+ Acked-by: José Roberto de Souza Reviewed-by: Matthew Brost Reviewed-by: Arvind Yadav Acked-by: Michal Mrozek Link: https://patch.msgid.link/20260120110609.77958-3-matthew.auld@intel.com commit 301929e3628bd8afc8919123e63763cefd14ce89 Author: Mika Kahola Date: Mon Jan 19 09:37:56 2026 +0000 drm/i915/display: Remove .clock member from eDP/DP/HDMI pll tables PLL state structure has a member .clock. This is not needed as the port clock is possible to calculate from the pll dividers. Remove the encoder from being passed to the port clock calculation function. v2: Keep the pll_state->clock assignment in intel_snps_hdmi_pll_compute_mpllb(). Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-16-mika.kahola@intel.com commit 1b85f96de24fd91274e46614c9d9d2a274dafe46 Author: Mika Kahola Date: Mon Jan 19 09:37:55 2026 +0000 drm/i915/lt_phy: Drop 27.2 MHz rate Drop 27.2 MHz PLL table as with these PLL dividers the port clock will be incorrectly calculated to 27.0 MHz. For 27.2 MHz rate the PLl dividers are calculated algorithmically making PLL table for this rate redundant. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-15-mika.kahola@intel.com commit 4fa244583e77fba2388f05a44f400f44f79da396 Author: Mika Kahola Date: Mon Jan 19 09:37:54 2026 +0000 drm/i915/cx0: Drop C20 25.175 MHz rate Drop C20 25.175 MHz PLL table as with these PLL dividers the port clock will be incorrectly calculated to 25.2 MHz. For 25.175 MHz rate the PLl dividers are calculated algorithmically making PLL table for this rate redundant. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-14-mika.kahola@intel.com commit 10d187b3560a45e6cf829a9c52ee54c6dfb42f3a Author: Mika Kahola Date: Mon Jan 19 09:37:53 2026 +0000 drm/i915/lt_phy: Add verification for lt phy pll dividers Add verification for lt phy pll dividers during boot. The port clock is calculated from pll dividers and compared against the requested port clock value. If there are a difference exceeding +-1 kHz an drm_warn() is thrown out to indicate possible pll divider mismatch. v2: - Move the LT_PHY_PLL_PARAMS -> LT_PHY_PLL_DP/HDMI_PARAMS change earlier. - Use tables[i].name != NULL as a terminating condition. - Use state vs. params term consistently in intel_c10pll_verify_clock() and intel_c20pll_verify_clock(). Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-13-mika.kahola@intel.com commit 58213c1d781cb4f5a4f6cadedf296dc6fc43b3a6 Author: Mika Kahola Date: Mon Jan 19 09:37:52 2026 +0000 drm/i915/cx0: Verify C10/C20 pll dividers Add verification for pll table dividers. The port clock is computed based on pll tables and, for hdmi case, the algorithmic model is applied to calculate pll dividers. If port clock differs more than +-1 kHz from expected value an drm_warn() is thrown and pll divider differences are printed out for debugging purposes. v2: - Move clock derivation from dividers in intel_cx0pll_enable() earlier in the patchset. - Keep intel_cx0_pll_power_save_wa() in intel_dpll_sanitize_state() - Use tables[i].name != NULL as a terminating condition. - Drop duplicate intel_cx0pll_clock_matches() declaration in header. - Use state vs. params term consistently in intel_c10pll_verify_clock() and intel_c20pll_verify_clock(). Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-12-mika.kahola@intel.com commit 50ad932880feaf6a526e0cfc314a4caf83310cd3 Author: Mika Kahola Date: Mon Jan 19 09:37:51 2026 +0000 drm/i915/cx0: Add a fuzzy check for DP/HDMI clock rates during programming Since the clock rate is derived from the PLL divider values it can have a +-1kHz difference wrt. the reference rates in the comparison Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-11-mika.kahola@intel.com commit 6af62d12317f369f96b0f272e9e074372d09e89d Author: Mika Kahola Date: Mon Jan 19 09:37:50 2026 +0000 drm/i915/cx0: Fix HDMI FRL clock rates HDMI FRL clock rates are incorrectly defined. Fix these rates. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-10-mika.kahola@intel.com commit 920fa5d920c362a2e57ffec7bb39b5c25bc59610 Author: Mika Kahola Date: Mon Jan 19 09:37:49 2026 +0000 drm/i915/display: Add helper function for fuzzy clock check The hard coded clock rate stored in the PLL state will be removed by a follow-up change. The clock is calculated instead of using clock from the PLL divider values. Since this calculated clock may vary due to fixed point rounding issues, a +-1 kHz variation is allowed with the request clock rate against the calculated clock rate. v2: - Use the stricter +-1 kHz allowed difference. - Derive the clock from PLL dividers in intel_cx0pll_enable(). - Move corresponding fuzzy check for LT PHY PLLs to this patch. v3: Reword commit message (Suraj) Move clock check to intel_dpll and rename it (Suraj) Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-9-mika.kahola@intel.com commit cf0635d40af0029ed5f600f366a395df3c58a19b Author: Mika Kahola Date: Mon Jan 19 09:37:48 2026 +0000 drm/i915/lt_phy: Create macro for LT PHY PLL state Create a macro for PLL state for LT PHY similar as for cx0 case. v2: - Move addition of LT_PHY_PLL_DP/HDMI_PARAMS() to this patch. - Fix end of table checking while looking up a table. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-8-mika.kahola@intel.com commit 52801b2eb532e8516e2366c4f67ef7cd022ef4ba Author: Mika Kahola Date: Mon Jan 19 09:37:47 2026 +0000 drm/i915/cx0: Create macro around PLL tables Create macro for storing PLL dividers with table name and clock rate. v2: Preserve the terminating {} in each PLL table. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-7-mika.kahola@intel.com commit 81152791701fdfa1bb9adff846a6eef888021227 Author: Mika Kahola Date: Mon Jan 19 09:37:46 2026 +0000 drm/i915/cx0: Drop encoder from port clock calculation For C10 and C20 we have unused encoder parameter passed to port clock calculation function. Remove the encoder from being passed to the port clock calculation function. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-6-mika.kahola@intel.com commit a35ab9c32f19a9435d3526fb6b025343c1dc7400 Author: Mika Kahola Date: Mon Jan 19 09:37:45 2026 +0000 drm/i915/lt_phy: Drop LT PHY crtc_state for port calculation Drop crtc_state from intel_lt_phy_calc_port_clock() function call and replace it with pll state instead. Follow-up changes will call these functions without a crtc_state available. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-5-mika.kahola@intel.com commit 2db8d9c26760f1c64137c4ebca76b61fc0e14548 Author: Mika Kahola Date: Mon Jan 19 09:37:44 2026 +0000 drm/i915/cx0: Drop Cx0 crtc_state from HDMI TMDS pll divider calculation Drop crtc_state from HDMI TMDS calculation and replace with the parameters that are only required. Follow-up changes will call these functions without a crtc_state available. v2: Keep required crtc_state param for intel_c20_pll_tables_get() and other functions calling this one. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-4-mika.kahola@intel.com commit c26ed2ec4d10d1fee7ef8f9987663765ee737487 Author: Mika Kahola Date: Mon Jan 19 09:37:43 2026 +0000 drm/i915/cx0: Move C20 port clock calculation Prepare removal of .clock member from the pll state structure by moving intel_c20pll_calc_port_clock() function. No functional change. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-3-mika.kahola@intel.com commit bc5ecacbdc4d315f656988fefb48ecffecdd3c76 Author: Mika Kahola Date: Mon Jan 19 09:37:42 2026 +0000 drm/i915/cx0: Move C10 port clock calculation Prepare removal of .clock member from pll state structures by moving intel_c10pll_calc_port_clock() function. No functional changes. Signed-off-by: Mika Kahola Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260119093757.2850233-2-mika.kahola@intel.com commit 33fd0375f1c31e20db08535aa9ac36df8156af8a Author: Nemesa Garg Date: Thu Jan 15 17:09:48 2026 +0530 drm/i915/casf: Disable CASF with joiner Disable CASF with joiner as it is not supported in hardware. v2: Replace dmesg_WARN with drm_dbg_kms. [Jani] v3: Modify commit message. [Suraj] Signed-off-by: Nemesa Garg Reviewed-by: Suraj Kandpal Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260115113948.641822-1-nemesa.garg@intel.com commit 650471948e495204f1f89731c71bcf48b3f81b08 Author: Ankit Nautiyal Date: Thu Jan 8 18:11:41 2026 +0530 drm/i915/dp: Avoid joiner for eDP if not enabled in VBT For eDP, enable the Pipe Joiner feature only if VBT explicitly allows it. If VBT disables the feature, skip joiner for eDP, even if the hardware supports it. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14616 Signed-off-by: Ankit Nautiyal Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260108124141.1407760-3-ankit.k.nautiyal@intel.com commit 1b85a9b04681423013bf6caeffde73aa6f29ab65 Author: Ankit Nautiyal Date: Thu Jan 8 18:11:40 2026 +0530 drm/i915/vbt: Add edp pipe joiner enable/disable bits Add VBT support to enable/disable eDP Pipe Joiner feature. The OEMs can choose to enable/disable the feature from VBT. ARL - VBTs default this field to disabled. PTL+ - VBTs default this field to enabled. Bspec:20142 Signed-off-by: Ankit Nautiyal Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260108124141.1407760-2-ankit.k.nautiyal@intel.com commit 6cdaa5346d6f3f6116e607e49c92c2401390c267 Author: Matthew Brost Date: Fri Jan 16 14:17:31 2026 -0800 drm/xe: Add context-based invalidation to GuC TLB invalidation backend Introduce context-based invalidation support to the GuC TLB invalidation backend. This is implemented by iterating over each exec queue per GT within a VM, skipping inactive queues, and issuing a context-based (GuC ID) H2G TLB invalidation. All H2G messages, except the final one, are sent with an invalid seqno, which the G2H handler drops to ensure the TLB invalidation fence is only signaled once all H2G messages are completed. A watermark mechanism is also added to switch between context-based TLB invalidations and full device-wide invalidations, as the return on investment for context-based invalidation diminishes when many exec queues are mapped. v2: - Fix checkpatch warnings v3: - Rebase on PRL - Use ref counting to avoid racing with deregisters v4: - Extra braces (Stuart) - Use per GT list (CI) - Reorder put Signed-off-by: Matthew Brost Tested-by: Stuart Summers Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20260116221731.868657-12-matthew.brost@intel.com commit 628d59392cc571930f52e121892c7a72f7c1d65b Author: Matthew Brost Date: Fri Jan 16 14:17:30 2026 -0800 drm/xe: Add exec queue active vfunc If an exec queue is inactive (e.g., not registered or scheduling is disabled), TLB invalidations are not issued for that queue. Add a virtual function to determine the active state, which TLB invalidation logic can hook into. v5: - Operate on primary in active function Signed-off-by: Matthew Brost Tested-by: Stuart Summers Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20260116221731.868657-11-matthew.brost@intel.com commit 6b42b635d6a20fd418ecc7c4c3ad52ef99fe7227 Author: Matthew Brost Date: Fri Jan 16 14:17:29 2026 -0800 drm/xe: Add xe_tlb_inval_idle helper Introduce the xe_tlb_inval_idle helper to detect whether any TLB invalidations are currently in flight. This is used in context-based TLB invalidations to determine whether dummy TLB invalidations need to be sent to maintain proper TLB invalidation fence ordering.. v2: - Implement xe_tlb_inval_idle based on pending list Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Tested-by: Stuart Summers Link: https://patch.msgid.link/20260116221731.868657-10-matthew.brost@intel.com commit 2d93d5d53024257e686b3aa839e148cde776e35e Author: Matthew Brost Date: Fri Jan 16 14:17:28 2026 -0800 drm/xe: Add send_tlb_inval_ppgtt helper Extract the common code that issues a TLB invalidation H2G for PPGTTs into a helper function. This helper can be reused for both ASID-based and context-based TLB invalidations. Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Tested-by: Stuart Summers Link: https://patch.msgid.link/20260116221731.868657-9-matthew.brost@intel.com commit edcc15f489c4c30667b78418228d6a84dbf6a464 Author: Matthew Brost Date: Fri Jan 16 14:17:27 2026 -0800 drm/xe: Rename send_tlb_inval_ppgtt to send_tlb_inval_asid_ppgtt Context-based TLB invalidations have their own set of GuC TLB invalidation operations. Rename the current PPGTT invalidation function, which operates on ASIDs, to a more descriptive name that reflects its purpose. Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Tested-by: Stuart Summers Link: https://patch.msgid.link/20260116221731.868657-8-matthew.brost@intel.com commit 8d7a9f801ed72c6a2506bb26f2eec1f8245bface Author: Matthew Brost Date: Fri Jan 16 14:17:26 2026 -0800 drm/xe: Taint TLB invalidation seqno lock with GFP_KERNEL Taint TLB invalidation seqno lock with GFP_KERNEL as TLB invalidations can be in the path of reclaim (e.g., MMU notifiers). Signed-off-by: Matthew Brost Reviewed-by: Matt Atwood Tested-by: Stuart Summers Link: https://patch.msgid.link/20260116221731.868657-7-matthew.brost@intel.com commit a3866ce7b1221353b795603bb8d0c81d81e60e65 Author: Matthew Brost Date: Fri Jan 16 14:17:25 2026 -0800 drm/xe: Add vm to exec queues association Maintain a list of exec queues per vm which will be used by TLB invalidation code to do context-ID based tlb invalidations. v4: - More asserts (Stuart) - Per GT list (CI) - Skip adding / removal if context TLB invalidatiions not supported (Stuart) Signed-off-by: Nirmoy Das Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Tested-by: Stuart Summers Link: https://patch.msgid.link/20260116221731.868657-6-matthew.brost@intel.com commit 43c3e6eacb22c7bcf871bd0220a35a03b5aa0e5c Author: Matthew Brost Date: Fri Jan 16 14:17:24 2026 -0800 drm/xe: Add xe_device_asid_to_vm helper Introduce the xe_device_asid_to_vm helper, which can be used throughout the driver to resolve the VM from a given ASID. v4: - Move forward declare after includes (Stuart) Signed-off-by: Matthew Brost Reviewed-by: Matt Atwood Reviewed-by: Stuart Summers Tested-by: Stuart Summers Link: https://patch.msgid.link/20260116221731.868657-5-matthew.brost@intel.com commit dea333b244818ab06253b8420a7534fd770eef36 Author: Matthew Brost Date: Fri Jan 16 14:17:23 2026 -0800 drm/xe: Add has_ctx_tlb_inval to device info Add has_ctx_tlb_inval to device info indicating a device has context basd TLB invalidation. Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Tested-by: Stuart Summers Link: https://patch.msgid.link/20260116221731.868657-4-matthew.brost@intel.com commit 444d78578e8a79537e527b50fda17d6aa2d30b79 Author: Matthew Brost Date: Fri Jan 16 14:17:22 2026 -0800 drm/xe: Make usm.asid_to_vm allocation use GFP_NOWAIT Ensure the asid_to_vm lookup is reclaim-safe so it can be performed during TLB invalidations, which is necessary for context-based TLB invalidation support. Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Tested-by: Stuart Summers Link: https://patch.msgid.link/20260116221731.868657-3-matthew.brost@intel.com commit 888c7f991ffe608a2c9ad9f9420e16c61adea79d Author: Matthew Brost Date: Fri Jan 16 14:17:21 2026 -0800 drm/xe: Add normalize_invalidation_range Extract the code that determines the alignment of TLB invalidation into a helper function — normalize_invalidation_range. This will be useful when adding context-based invalidations to the GuC TLB invalidation backend. Signed-off-by: Nirmoy Das Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Tested-by: Stuart Summers Link: https://patch.msgid.link/20260116221731.868657-2-matthew.brost@intel.com commit 769d7774a1b82f8fde8ce1ff8e4d006e68d8c153 Author: Niranjana Vishwanathapura Date: Fri Jan 16 14:03:33 2026 -0800 drm/xe/multi_queue: Enable multi_queue on xe3p_xpc xe3p_xpc supports multi_queue, enable it. v2: Rename multi_queue_enable_mask to multi_queue_engine_class_mask (Matt Brost) Signed-off-by: Niranjana Vishwanathapura Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260116220333.861850-3-matthew.brost@intel.com commit bbd36787308413d8564e1b0498fe6c1f765fa6c1 Author: Matthew Brost Date: Fri Jan 16 14:03:32 2026 -0800 drm/xe: Ban entire multi-queue group on any job timeout In multi-queue mode, we only have control over the entire group, so we cannot ban individual queues or signal fences until the whole group is removed from hardware. Implement banning of the entire group if any job within it times out. v2: - Fix lock inversion (Niranjana) - Initialize new queues in group to stopped v3: - Blindly call xe_exec_queue_multi_queue_primary (Niranjana) - More comments around temporary list when stopping (Niranjana) - Restart group on false timeout (Niranjana) Cc: Niranjana Vishwanathapura Signed-off-by: Matthew Brost Reviewed-by: Niranjana Vishwanathapura Link: https://patch.msgid.link/20260116220333.861850-2-matthew.brost@intel.com commit c5a52cd04e24f0ae53fda26f74ab027b8c548e0e Author: Jouni Högander Date: Thu Jan 15 09:00:39 2026 +0200 drm/i915/psr: Don't enable Panel Replay on sink if globally disabled With some panels informing support for Panel Replay we are observing problems if having Panel Replay enable bit set on sink when forced to use PSR instead of Panel Replay. Avoid these problems by not setting Panel Replay enable bit in sink when Panel Replay is globally disabled during link training. I.e. disabled by module parameter. The enable bit is still set when disabling Panel Replay via debugfs interface. Added note comment about this. Fixes: 68f3a505b367 ("drm/i915/psr: Enable Panel Replay on sink always when it's supported") Cc: Mika Kahola Cc: Jani Nikula Cc: Rodrigo Vivi Cc: # v6.15+ Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://patch.msgid.link/20260115070039.368965-1-jouni.hogander@intel.com commit c51595b3d25123cb98bd9b1d6f50e57cc6be592b Author: Nakshtra Goyal Date: Tue Jan 13 14:49:28 2026 +0530 drm/xe/xe_query: Remove check for gt There's no need to check a userspace-provided GT ID (which may come from any tile) against the number of GTs that can be present on a single tile. The xe_device_get_gt() lookup already checks that the GT ID passed is valid for the current device.(Matt Roper) Signed-off-by: Nakshtra Goyal Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260113091928.67446-1-nakshtra.goyal@intel.com Signed-off-by: Matt Roper commit 4d636e0fc26b90be9c56961d8a631f26dcedf4a4 Author: Imre Deak Date: Wed Jan 14 18:22:32 2026 +0200 drm/i915/dp: Use intel_dp_dsc_get_slice_config() Simplify things by computing the detailed slice configuration using intel_dp_dsc_get_slice_config(), instead of open-coding the same. While at it add a TODO comment to intel_dp_dsc_compute_config() to explore if it's worth increasing the number of VDSC stream engines used, in order to reduce the minimum CDCLK required. v2: Add a TODO comment to intel_dp_dsc_compute_config() to explore if it's worth increasing the number of slices in order to use a lower CDCLK. (Jouni) Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-16-imre.deak@intel.com commit 54cf7900c6eff4832a349806bef85e0e123aa626 Author: Imre Deak Date: Wed Jan 14 18:22:31 2026 +0200 drm/i915/dp: Add intel_dp_dsc_get_slice_config() Add intel_dp_dsc_get_slice_config() to compute the detailed slice configuration and determine the slices-per-line value (returned by intel_dp_dsc_get_slice_count()) using this function. v2: Fix incorrectly returning false from intel_dp_dsc_min_slice_count() due to rebase fail. (Jouni) Cc: Jouni Högander Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-15-imre.deak@intel.com commit 088d06bb17b024866401a20484017cd172ead3d8 Author: Imre Deak Date: Wed Jan 14 18:22:30 2026 +0200 drm/i915/dp: Unify DP and eDP slice count computation Unify the DP and eDP slices-per-line computation. Atm eDP simply returns the maximum slices-per-line value supported by the sink, but using the same helper function for both cases still makes sense, since a follow-up change will compute the detailed slice config for both cases. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-14-imre.deak@intel.com commit ba9f0bbecdc462ebf361f65f62842a1e85c8baa8 Author: Imre Deak Date: Wed Jan 14 18:22:29 2026 +0200 drm/i915/dsi: Use intel_dsc_get_slice_config() Use intel_dsc_get_slice_config() for DSI to compute the slice configuration based on the slices-per-line sink capability, instead of open-coding the same. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-13-imre.deak@intel.com commit 91f0a9497414443b708e84e60b3813ff119f2444 Author: Imre Deak Date: Wed Jan 14 18:22:28 2026 +0200 drm/i915/dsc: Add intel_dsc_get_slice_config() Add intel_dsc_get_slice_config() and move the logic to select a given slice configuration to that function from the configuration loop in intel_dp_dsc_get_slice_count(). The same functionality can be used by other outputs like DSI as well, done as a follow-up. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-12-imre.deak@intel.com commit da833bb4baf58a8c817818a064bc354429a8c091 Author: Imre Deak Date: Wed Jan 14 18:22:27 2026 +0200 drm/i915/dp: Simplify the DSC slice config loop's slices-per-pipe iteration Simplify the slice config loop in intel_dp_dsc_get_slice_count(), using the loop iterator as the slices-per-pipe value directly, instead of looking up the same value from an array. While at it move the code comment about the slice configuration closer to where the configuration is determined and clarify it a bit. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-11-imre.deak@intel.com commit 0e6d7b6e502158d6a12725471d57450dcc0b3326 Author: Imre Deak Date: Wed Jan 14 18:22:26 2026 +0200 drm/i915/dp: Rename test_slice_count to slices_per_line Rename test_slice_count to slices_per_line for clarity. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-10-imre.deak@intel.com commit 856428d1ce352b926d2eb026490503ec39424ac8 Author: Imre Deak Date: Wed Jan 14 18:22:25 2026 +0200 drm/i915/dp: Use int for DSC slice count variables There is no reason to use the more specific u8 type for slice count variables, use the more generic int type instead. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-9-imre.deak@intel.com commit 15f908bce5d90fcfbc0599e426530cc10e9dfef3 Author: Imre Deak Date: Wed Jan 14 18:22:24 2026 +0200 drm/i915/dp: Factor out intel_dp_dsc_min_slice_count() Factor out intel_dp_dsc_min_slice_count() for making intel_dp_dsc_get_slice_count() more readable and also to prepare for a follow-up change unifying the eDP and DP slice count/config computation. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-8-imre.deak@intel.com commit e941eb107847f7a910e309799cdde49493b857cf Author: Imre Deak Date: Wed Jan 14 18:22:23 2026 +0200 drm/i915/dsc: Switch to using intel_dsc_line_slice_count() By now all the places are updated to track the DSC slice configuration in intel_crtc_state::dsc.slice_config, so calculate the slices-per-line value using that config, instead of using intel_crtc_state::dsc.slice_count caching the same value and remove the cached slice_count. v2: Rebase on latest drm-tip, converting another user of dsc.slice_count in intel_vdsc_min_cdclk(). Cc: Ankit Nautiyal Reviewed-by: Jouni Högander # v1 Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-7-imre.deak@intel.com commit fd1e610ca21861f582e57e26e5e5628d01c6c36d Author: Imre Deak Date: Wed Jan 14 18:22:22 2026 +0200 drm/i915/dp: Track the detailed DSC slice configuration Add tracking for the DP DSC pipes-per-line and slices-per-stream value in the slice config state and compute the current slices-per-line (slice_count) value using this slice config. The slices-per-line value used atm will be removed by a follow-up change after converting all the places using it to use the slice config instead. For now the slices-per-stream value is calculated based on the slices-per-line value (slice_count) calculated by the drm_dp_dsc_sink_max_slice_count() / intel_dp_dsc_get_slice_count() functions. In a follow-up change these functions will be converted to calculate the slices-per-stream value directly, along with the detailed slice configuration. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-6-imre.deak@intel.com commit 57152a502ed2a4d8f0470321c9d482a76daa3cb9 Author: Imre Deak Date: Wed Jan 14 18:22:21 2026 +0200 drm/i915/dsi: Track the detailed DSC slice configuration Add tracking for the DSI DSC pipes-per-line and slices-per-stream value in the slice config state and compute the current slices-per-line value using this slice config state. The slices-per-line value used atm will be removed by a follow-up change after converting all the places using it to use the detailed slice config instead. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-5-imre.deak@intel.com commit 611cadd5c02b04ac461a5dddf3070ce4c1094829 Author: Imre Deak Date: Wed Jan 14 18:22:20 2026 +0200 drm/i915/dsi: Move initialization of DSI DSC streams-per-pipe to fill_dsc() Move the initialization of the DSI DSC streams-per-pipe value to fill_dsc() next to where the corresponding (per-line) slice_count value is initialized. This allows converting the initialization to use the detailed slice configuration state in follow-up changes. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-4-imre.deak@intel.com commit 2b8f5b5cb29786f03cd1805aad42da41ad7c51a4 Author: Imre Deak Date: Wed Jan 14 18:22:19 2026 +0200 drm/i915/dsc: Track the DSC stream count in the DSC slice config state Move the tracking for the DSC stream count from intel_crtc_state::dsc.num_streams to intel_crtc_state::dsc.slice_config.streams_per_pipe. While at it add a TODO comment to read out the full DSC configuration from HW including the pipes-per-line and slices-per-stream values. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-3-imre.deak@intel.com commit 889ff8dd4679ae7b608f79ebbbd511a3b8b315c1 Author: Imre Deak Date: Wed Jan 14 18:22:18 2026 +0200 drm/i915/dsc: Track the detaild DSC slice configuration Add a way to track the detailed DSC pipes-per-line, streams-per-pipe, slices-per-stream configuration instead of the current streams-per-pipe and slices-per-line value. This way describes the slice configuration in a clearer way, for instance providing a 2 pipes-per-line x 2 streams-per-pipe x 2 slices-per-stream = 8 slices-per-line view, instead of the current, coarser 2 streams-per-pipe, 8 slices-per-line view, the former better reflecting that each DSC stream engine has 2 slices. This also let's optimizing the configuration in a simpler/clearer way, for instance using 1 stream x 2 slices, or 1 stream x 4 slices instead of the current 2 stream x 1 slice, or 2 streams x 2 slices configuration (so that 1 DSC stream engine can be powered off in each pipe). Follow-up changes will convert the current slices-per-line computation logic to compute instead the above detailed slice configuration. Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260114162232.92731-2-imre.deak@intel.com commit e89aacd1ecdd3d13e8f347aa082687878621e03c Author: Matthew Brost Date: Wed Jan 14 10:49:05 2026 -0800 drm/xe: Reduce LRC timestamp stuck message on VFs to notice An LRC timestamp getting stuck is a somewhat normal occurrence. If a single VF submits a job that does not get timesliced, the LRC timestamp will not increment. Reduce the LRC timestamp stuck message on VFs to notice (same log level as job timeout) to avoid false CI bugs in tests where a VF submits a job that does not get timesliced. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7032 Fixes: bb63e7257e63 ("drm/xe: Avoid toggling schedule state to check LRC timestamp in TDR") Suggested-by: Daniele Ceraolo Spurio Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20260114184905.4189026-1-matthew.brost@intel.com